xmrig | 9bfb1c271e04d424980ddc70845bb77f16168b3b2c2ff3af0a6d9c3757f289a2

Analysis

max time kernel
148s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
Size

1.6MB
MD5

81b5bdbf61158b7960d55d6aa9f451a0
SHA1

68ce1e20c350f19d60cd898d6038926f62df2918
SHA256

9bfb1c271e04d424980ddc70845bb77f16168b3b2c2ff3af0a6d9c3757f289a2
SHA512

5218eea0e7d5f93d177a30d2c99f1e87045249b7ea3ec2fea40fadc6d2366b661493df74cee537170344bae41dd5cf0cff5c30bdcb477930761211a0e6882108
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeYusCJ7MNXnHXLHmYTInhtmK:Lz071uv4BPMki8CnfLDCtW7ivmX6

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2684-70-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2060-108-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2256-68-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2724-64-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2580-61-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2640-60-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/1880-58-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2676-47-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2676-5803-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/1880-5877-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2640-5880-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/1956-6419-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2724-6428-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2240-6427-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2256-6429-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2460-6430-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2060-6435-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2580-6432-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2684-6431-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1636	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1956	rmzlhhU.exe
2256	JjcLWoo.exe
2676	cRWHSQW.exe
2460	dsRLsTK.exe
1880	xGzpwGT.exe
2640	IUAYAXC.exe
2580	mbCLVmZ.exe
2724	rWGYhWK.exe
2684	lTpLnAw.exe
2060	euofvbw.exe
2240	KiyTKkE.exe
2168	OCWQghE.exe
2980	JZbeaKq.exe
1584	procYMm.exe
2816	dezFYYv.exe
1108	SLPtWfs.exe
2636	jfvxexO.exe
2972	lzQtDZp.exe
2984	TrzEIPC.exe
944	FWdbExW.exe
1068	wUSBJMq.exe
752	mOyTvkR.exe
992	gteEIKB.exe
1296	dWecXDB.exe
768	dusnifU.exe
2004	ZYASBky.exe
1564	AALaaVw.exe
1140	wEjBTqJ.exe
2916	mJbstrO.exe
864	BgEdCix.exe
1000	TXWeNpj.exe
3056	HGUajkp.exe
1660	JVWbxrQ.exe
616	jImaAEd.exe
1832	rizMHNq.exe
1828	qkvkIdv.exe
2172	wIkbhxu.exe
1608	TqErGWl.exe
2732	OdjougH.exe
2728	TDucZpN.exe
2488	cEElMeS.exe
2484	QIctcLO.exe
2404	Uqsehux.exe
2828	NMmuvIP.exe
2604	EazVckk.exe
600	jtRnwOq.exe
2260	krAijmV.exe
404	HfsWcIZ.exe
2692	YXCVgZq.exe
108	dYYZfTc.exe
1632	QRRUOfm.exe
2532	nLJWROa.exe
380	TsZcXqV.exe
896	IKwzwNs.exe
2592	dkUtzkw.exe
3100	fLuKBZt.exe
3132	SRPKDYO.exe
3164	WquOQHM.exe
3196	ypeXjgr.exe
3228	CUreuix.exe
3260	gQBIUga.exe
3292	RtlLHlZ.exe
3324	gUcfKBs.exe
3356	mXOntBl.exe

Loads dropped DLL 64 IoCs

pid	Process
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/756-0-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x000b0000000149f5-3.dat	upx
behavioral1/files/0x0007000000015626-26.dat	upx
behavioral1/files/0x000f000000005578-25.dat	upx
behavioral1/files/0x000a000000015c52-34.dat	upx
behavioral1/files/0x000a000000015c6b-42.dat	upx
behavioral1/files/0x0007000000015c78-43.dat	upx
behavioral1/files/0x000a000000015b6f-41.dat	upx
behavioral1/files/0x0008000000015616-40.dat	upx
behavioral1/files/0x0009000000015018-39.dat	upx
behavioral1/memory/1956-20-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2684-70-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/files/0x0007000000015c83-76.dat	upx
behavioral1/files/0x0006000000015cb6-83.dat	upx
behavioral1/files/0x00090000000155f3-99.dat	upx
behavioral1/files/0x0006000000015cfe-96.dat	upx
behavioral1/files/0x0006000000015d0f-113.dat	upx
behavioral1/files/0x0006000000015d27-120.dat	upx
behavioral1/files/0x0006000000015d98-130.dat	upx
behavioral1/files/0x0006000000015f01-140.dat	upx
behavioral1/files/0x0006000000016be2-175.dat	upx
behavioral1/memory/2240-107-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x0006000000016c51-184.dat	upx
behavioral1/files/0x0006000000016bfb-177.dat	upx
behavioral1/files/0x0006000000016a29-170.dat	upx
behavioral1/files/0x00060000000165ae-163.dat	upx
behavioral1/files/0x0006000000016448-156.dat	upx
behavioral1/files/0x0006000000016176-149.dat	upx
behavioral1/files/0x0006000000015f7a-142.dat	upx
behavioral1/files/0x0006000000015df1-134.dat	upx
behavioral1/files/0x0006000000015d31-125.dat	upx
behavioral1/files/0x0006000000015d1a-115.dat	upx
behavioral1/files/0x0007000000015c9f-81.dat	upx
behavioral1/files/0x0006000000015cce-110.dat	upx
behavioral1/memory/2060-108-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/files/0x0006000000015cee-105.dat	upx
behavioral1/files/0x0006000000015d07-101.dat	upx
behavioral1/files/0x0006000000015cf6-93.dat	upx
behavioral1/files/0x0006000000016c04-182.dat	upx
behavioral1/files/0x00060000000167d5-168.dat	upx
behavioral1/files/0x000600000001650c-161.dat	upx
behavioral1/files/0x0006000000016287-154.dat	upx
behavioral1/files/0x00060000000160af-147.dat	upx
behavioral1/memory/2256-68-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2724-64-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2580-61-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2640-60-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/1880-58-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2460-57-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2676-47-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2676-5803-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/1880-5877-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2640-5880-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/1956-6419-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2724-6428-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2240-6427-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2256-6429-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2460-6430-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2060-6435-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2580-6432-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2684-6431-0x000000013F140000-0x000000013F532000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lfVnbQy.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\QvHIarT.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\SIDYIuv.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\hIuzFvn.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\JszoqxH.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\cjRSgHH.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\iGfdZNX.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\pQFCIUq.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\KCBXpHd.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\hIHUwOh.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\YarUjFl.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\wJDoJpD.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\JkXtFvS.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\SbTKPwf.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\iatZaTv.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\qPuHqav.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\rsvopKx.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\PEXtjCY.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\rxWmrbd.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\eexdwQk.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\itzQbib.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\eQJOskz.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\KXUMkRj.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\ONgfhGJ.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\VWYfdwn.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\Upfpabm.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\SFsGyQY.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\AReIWLw.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\NIOkqau.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\yzgvPXF.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\fzrLTLs.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\QfDzwqd.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\DTKTXXT.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\sJudrSh.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\UUWxFKt.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\KLTtKzI.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\pIjpxom.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\aPCalgr.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\MNcsRrF.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\Ljkbvza.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\nVuLGfX.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\xzNXukp.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\fpSQFXu.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\bBHETbN.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\LaoFRee.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\uyYcZuI.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\iXpZXeD.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\YKyCCww.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\CqwqnaM.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\RmMnzLS.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\fKyGQdP.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\dEkuynp.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\gzjGzOO.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\EglUwoS.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\RFTtrNv.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\IUOLDJC.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZeJFHbE.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\XEuGfAC.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\RXhgFSm.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\ixtKCbZ.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\tnSriCC.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\YaNCkct.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\wpAmVec.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
File created	C:\Windows\System\UgEEVGl.exe	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1636	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1636	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1636	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	29
PID 756 wrote to memory of 1636	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	29
PID 756 wrote to memory of 1636	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	29
PID 756 wrote to memory of 1956	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	30
PID 756 wrote to memory of 1956	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	30
PID 756 wrote to memory of 1956	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	30
PID 756 wrote to memory of 1880	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	31
PID 756 wrote to memory of 1880	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	31
PID 756 wrote to memory of 1880	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	31
PID 756 wrote to memory of 2256	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	32
PID 756 wrote to memory of 2256	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	32
PID 756 wrote to memory of 2256	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	32
PID 756 wrote to memory of 2640	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	33
PID 756 wrote to memory of 2640	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	33
PID 756 wrote to memory of 2640	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	33
PID 756 wrote to memory of 2676	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	34
PID 756 wrote to memory of 2676	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	34
PID 756 wrote to memory of 2676	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	34
PID 756 wrote to memory of 2580	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	35
PID 756 wrote to memory of 2580	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	35
PID 756 wrote to memory of 2580	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	35
PID 756 wrote to memory of 2460	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	36
PID 756 wrote to memory of 2460	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	36
PID 756 wrote to memory of 2460	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	36
PID 756 wrote to memory of 2724	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	37
PID 756 wrote to memory of 2724	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	37
PID 756 wrote to memory of 2724	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	37
PID 756 wrote to memory of 2684	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	38
PID 756 wrote to memory of 2684	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	38
PID 756 wrote to memory of 2684	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	38
PID 756 wrote to memory of 2060	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	39
PID 756 wrote to memory of 2060	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	39
PID 756 wrote to memory of 2060	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	39
PID 756 wrote to memory of 2240	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	40
PID 756 wrote to memory of 2240	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	40
PID 756 wrote to memory of 2240	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	40
PID 756 wrote to memory of 2168	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	41
PID 756 wrote to memory of 2168	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	41
PID 756 wrote to memory of 2168	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	41
PID 756 wrote to memory of 2980	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	42
PID 756 wrote to memory of 2980	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	42
PID 756 wrote to memory of 2980	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	42
PID 756 wrote to memory of 1108	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	43
PID 756 wrote to memory of 1108	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	43
PID 756 wrote to memory of 1108	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	43
PID 756 wrote to memory of 1584	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	44
PID 756 wrote to memory of 1584	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	44
PID 756 wrote to memory of 1584	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	44
PID 756 wrote to memory of 1972	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	45
PID 756 wrote to memory of 1972	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	45
PID 756 wrote to memory of 1972	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	45
PID 756 wrote to memory of 2816	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	46
PID 756 wrote to memory of 2816	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	46
PID 756 wrote to memory of 2816	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	46
PID 756 wrote to memory of 2512	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	47
PID 756 wrote to memory of 2512	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	47
PID 756 wrote to memory of 2512	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	47
PID 756 wrote to memory of 2636	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	48
PID 756 wrote to memory of 2636	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	48
PID 756 wrote to memory of 2636	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	48
PID 756 wrote to memory of 2856	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	49
PID 756 wrote to memory of 2856	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	49
PID 756 wrote to memory of 2856	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	49
PID 756 wrote to memory of 2972	756	81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\81b5bdbf61158b7960d55d6aa9f451a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System\rmzlhhU.exe
  C:\Windows\System\rmzlhhU.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\xGzpwGT.exe
  C:\Windows\System\xGzpwGT.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\JjcLWoo.exe
  C:\Windows\System\JjcLWoo.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\IUAYAXC.exe
  C:\Windows\System\IUAYAXC.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\cRWHSQW.exe
  C:\Windows\System\cRWHSQW.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\mbCLVmZ.exe
  C:\Windows\System\mbCLVmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\dsRLsTK.exe
  C:\Windows\System\dsRLsTK.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\rWGYhWK.exe
  C:\Windows\System\rWGYhWK.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\lTpLnAw.exe
  C:\Windows\System\lTpLnAw.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\euofvbw.exe
  C:\Windows\System\euofvbw.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\KiyTKkE.exe
  C:\Windows\System\KiyTKkE.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\OCWQghE.exe
  C:\Windows\System\OCWQghE.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\JZbeaKq.exe
  C:\Windows\System\JZbeaKq.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\SLPtWfs.exe
  C:\Windows\System\SLPtWfs.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\procYMm.exe
  C:\Windows\System\procYMm.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\iJyvrco.exe
  C:\Windows\System\iJyvrco.exe
  2⤵
  PID:1972
- C:\Windows\System\dezFYYv.exe
  C:\Windows\System\dezFYYv.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\NWAOfwz.exe
  C:\Windows\System\NWAOfwz.exe
  2⤵
  PID:2512
- C:\Windows\System\jfvxexO.exe
  C:\Windows\System\jfvxexO.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\FdQbgFb.exe
  C:\Windows\System\FdQbgFb.exe
  2⤵
  PID:2856
- C:\Windows\System\lzQtDZp.exe
  C:\Windows\System\lzQtDZp.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\zAqkOTf.exe
  C:\Windows\System\zAqkOTf.exe
  2⤵
  PID:1456
- C:\Windows\System\TrzEIPC.exe
  C:\Windows\System\TrzEIPC.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\jlsCSuD.exe
  C:\Windows\System\jlsCSuD.exe
  2⤵
  PID:1776
- C:\Windows\System\FWdbExW.exe
  C:\Windows\System\FWdbExW.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\wZLldqp.exe
  C:\Windows\System\wZLldqp.exe
  2⤵
  PID:2032
- C:\Windows\System\wUSBJMq.exe
  C:\Windows\System\wUSBJMq.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\BXbpPgq.exe
  C:\Windows\System\BXbpPgq.exe
  2⤵
  PID:784
- C:\Windows\System\mOyTvkR.exe
  C:\Windows\System\mOyTvkR.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\gGAjAgq.exe
  C:\Windows\System\gGAjAgq.exe
  2⤵
  PID:2552
- C:\Windows\System\gteEIKB.exe
  C:\Windows\System\gteEIKB.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\qcuSEQp.exe
  C:\Windows\System\qcuSEQp.exe
  2⤵
  PID:2132
- C:\Windows\System\dWecXDB.exe
  C:\Windows\System\dWecXDB.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\VafoeEW.exe
  C:\Windows\System\VafoeEW.exe
  2⤵
  PID:2304
- C:\Windows\System\dusnifU.exe
  C:\Windows\System\dusnifU.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\fcfkicR.exe
  C:\Windows\System\fcfkicR.exe
  2⤵
  PID:2416
- C:\Windows\System\ZYASBky.exe
  C:\Windows\System\ZYASBky.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\qAIQavr.exe
  C:\Windows\System\qAIQavr.exe
  2⤵
  PID:2412
- C:\Windows\System\AALaaVw.exe
  C:\Windows\System\AALaaVw.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\dirRywj.exe
  C:\Windows\System\dirRywj.exe
  2⤵
  PID:1992
- C:\Windows\System\wEjBTqJ.exe
  C:\Windows\System\wEjBTqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\nzkpyky.exe
  C:\Windows\System\nzkpyky.exe
  2⤵
  PID:112
- C:\Windows\System\mJbstrO.exe
  C:\Windows\System\mJbstrO.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\RodRaLZ.exe
  C:\Windows\System\RodRaLZ.exe
  2⤵
  PID:1856
- C:\Windows\System\BgEdCix.exe
  C:\Windows\System\BgEdCix.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\uEcTEGy.exe
  C:\Windows\System\uEcTEGy.exe
  2⤵
  PID:1208
- C:\Windows\System\TXWeNpj.exe
  C:\Windows\System\TXWeNpj.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\RRNqsvf.exe
  C:\Windows\System\RRNqsvf.exe
  2⤵
  PID:3052
- C:\Windows\System\HGUajkp.exe
  C:\Windows\System\HGUajkp.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\SwpSvrl.exe
  C:\Windows\System\SwpSvrl.exe
  2⤵
  PID:3048
- C:\Windows\System\JVWbxrQ.exe
  C:\Windows\System\JVWbxrQ.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\VDOSDoV.exe
  C:\Windows\System\VDOSDoV.exe
  2⤵
  PID:3064
- C:\Windows\System\jImaAEd.exe
  C:\Windows\System\jImaAEd.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\PGyDcde.exe
  C:\Windows\System\PGyDcde.exe
  2⤵
  PID:2924
- C:\Windows\System\rizMHNq.exe
  C:\Windows\System\rizMHNq.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\jpacOKp.exe
  C:\Windows\System\jpacOKp.exe
  2⤵
  PID:2348
- C:\Windows\System\qkvkIdv.exe
  C:\Windows\System\qkvkIdv.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\xDjbxlz.exe
  C:\Windows\System\xDjbxlz.exe
  2⤵
  PID:2100
- C:\Windows\System\wIkbhxu.exe
  C:\Windows\System\wIkbhxu.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\aOiBcfv.exe
  C:\Windows\System\aOiBcfv.exe
  2⤵
  PID:1612
- C:\Windows\System\TqErGWl.exe
  C:\Windows\System\TqErGWl.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\FmntXTR.exe
  C:\Windows\System\FmntXTR.exe
  2⤵
  PID:960
- C:\Windows\System\OdjougH.exe
  C:\Windows\System\OdjougH.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\SbCHnSz.exe
  C:\Windows\System\SbCHnSz.exe
  2⤵
  PID:2556
- C:\Windows\System\TDucZpN.exe
  C:\Windows\System\TDucZpN.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\gSeBGcq.exe
  C:\Windows\System\gSeBGcq.exe
  2⤵
  PID:2672
- C:\Windows\System\cEElMeS.exe
  C:\Windows\System\cEElMeS.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\PLueDVo.exe
  C:\Windows\System\PLueDVo.exe
  2⤵
  PID:2456
- C:\Windows\System\QIctcLO.exe
  C:\Windows\System\QIctcLO.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\qUzqWXM.exe
  C:\Windows\System\qUzqWXM.exe
  2⤵
  PID:2088
- C:\Windows\System\Uqsehux.exe
  C:\Windows\System\Uqsehux.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\NCNPHwz.exe
  C:\Windows\System\NCNPHwz.exe
  2⤵
  PID:1980
- C:\Windows\System\NMmuvIP.exe
  C:\Windows\System\NMmuvIP.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\JjpebBT.exe
  C:\Windows\System\JjpebBT.exe
  2⤵
  PID:1952
- C:\Windows\System\EazVckk.exe
  C:\Windows\System\EazVckk.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ETDLWJc.exe
  C:\Windows\System\ETDLWJc.exe
  2⤵
  PID:1436
- C:\Windows\System\jtRnwOq.exe
  C:\Windows\System\jtRnwOq.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\PgKDSkA.exe
  C:\Windows\System\PgKDSkA.exe
  2⤵
  PID:572
- C:\Windows\System\krAijmV.exe
  C:\Windows\System\krAijmV.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\xtJoAbQ.exe
  C:\Windows\System\xtJoAbQ.exe
  2⤵
  PID:2312
- C:\Windows\System\HfsWcIZ.exe
  C:\Windows\System\HfsWcIZ.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\ACrqwGo.exe
  C:\Windows\System\ACrqwGo.exe
  2⤵
  PID:2696
- C:\Windows\System\YXCVgZq.exe
  C:\Windows\System\YXCVgZq.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\wJvdYkb.exe
  C:\Windows\System\wJvdYkb.exe
  2⤵
  PID:3060
- C:\Windows\System\dYYZfTc.exe
  C:\Windows\System\dYYZfTc.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\dlFiHZC.exe
  C:\Windows\System\dlFiHZC.exe
  2⤵
  PID:2944
- C:\Windows\System\QRRUOfm.exe
  C:\Windows\System\QRRUOfm.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\xVUdYxs.exe
  C:\Windows\System\xVUdYxs.exe
  2⤵
  PID:2784
- C:\Windows\System\nLJWROa.exe
  C:\Windows\System\nLJWROa.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\wOCDczp.exe
  C:\Windows\System\wOCDczp.exe
  2⤵
  PID:2968
- C:\Windows\System\TsZcXqV.exe
  C:\Windows\System\TsZcXqV.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\NhLsaNH.exe
  C:\Windows\System\NhLsaNH.exe
  2⤵
  PID:620
- C:\Windows\System\IKwzwNs.exe
  C:\Windows\System\IKwzwNs.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\lbSlZbn.exe
  C:\Windows\System\lbSlZbn.exe
  2⤵
  PID:2908
- C:\Windows\System\dkUtzkw.exe
  C:\Windows\System\dkUtzkw.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\QTwNSmj.exe
  C:\Windows\System\QTwNSmj.exe
  2⤵
  PID:3084
- C:\Windows\System\fLuKBZt.exe
  C:\Windows\System\fLuKBZt.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\GclBwks.exe
  C:\Windows\System\GclBwks.exe
  2⤵
  PID:3116
- C:\Windows\System\SRPKDYO.exe
  C:\Windows\System\SRPKDYO.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\gEDJjUK.exe
  C:\Windows\System\gEDJjUK.exe
  2⤵
  PID:3148
- C:\Windows\System\WquOQHM.exe
  C:\Windows\System\WquOQHM.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\juGGBKM.exe
  C:\Windows\System\juGGBKM.exe
  2⤵
  PID:3180
- C:\Windows\System\ypeXjgr.exe
  C:\Windows\System\ypeXjgr.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\RkhZkFE.exe
  C:\Windows\System\RkhZkFE.exe
  2⤵
  PID:3212
- C:\Windows\System\CUreuix.exe
  C:\Windows\System\CUreuix.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\SvWmGTf.exe
  C:\Windows\System\SvWmGTf.exe
  2⤵
  PID:3244
- C:\Windows\System\gQBIUga.exe
  C:\Windows\System\gQBIUga.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\islSAGp.exe
  C:\Windows\System\islSAGp.exe
  2⤵
  PID:3276
- C:\Windows\System\RtlLHlZ.exe
  C:\Windows\System\RtlLHlZ.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\PrRKwfO.exe
  C:\Windows\System\PrRKwfO.exe
  2⤵
  PID:3308
- C:\Windows\System\gUcfKBs.exe
  C:\Windows\System\gUcfKBs.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\otNlDjM.exe
  C:\Windows\System\otNlDjM.exe
  2⤵
  PID:3340
- C:\Windows\System\mXOntBl.exe
  C:\Windows\System\mXOntBl.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\DSryUja.exe
  C:\Windows\System\DSryUja.exe
  2⤵
  PID:3372
- C:\Windows\System\AyPfiWH.exe
  C:\Windows\System\AyPfiWH.exe
  2⤵
  PID:3388
- C:\Windows\System\CsSwmpY.exe
  C:\Windows\System\CsSwmpY.exe
  2⤵
  PID:3404
- C:\Windows\System\KNTwxrl.exe
  C:\Windows\System\KNTwxrl.exe
  2⤵
  PID:3420
- C:\Windows\System\qfOYrxU.exe
  C:\Windows\System\qfOYrxU.exe
  2⤵
  PID:3436
- C:\Windows\System\fvhBZlK.exe
  C:\Windows\System\fvhBZlK.exe
  2⤵
  PID:3452
- C:\Windows\System\zXhvubB.exe
  C:\Windows\System\zXhvubB.exe
  2⤵
  PID:3468
- C:\Windows\System\TMiAQCs.exe
  C:\Windows\System\TMiAQCs.exe
  2⤵
  PID:3484
- C:\Windows\System\lAmBxiQ.exe
  C:\Windows\System\lAmBxiQ.exe
  2⤵
  PID:3500
- C:\Windows\System\nAzgPzn.exe
  C:\Windows\System\nAzgPzn.exe
  2⤵
  PID:3516
- C:\Windows\System\ZeJFHbE.exe
  C:\Windows\System\ZeJFHbE.exe
  2⤵
  PID:3532
- C:\Windows\System\LXxTBNP.exe
  C:\Windows\System\LXxTBNP.exe
  2⤵
  PID:3548
- C:\Windows\System\Yhslxpn.exe
  C:\Windows\System\Yhslxpn.exe
  2⤵
  PID:3564
- C:\Windows\System\YKKkXfx.exe
  C:\Windows\System\YKKkXfx.exe
  2⤵
  PID:3580
- C:\Windows\System\EqhEWZz.exe
  C:\Windows\System\EqhEWZz.exe
  2⤵
  PID:3596
- C:\Windows\System\WpEiogj.exe
  C:\Windows\System\WpEiogj.exe
  2⤵
  PID:3612
- C:\Windows\System\nCuCznQ.exe
  C:\Windows\System\nCuCznQ.exe
  2⤵
  PID:3628
- C:\Windows\System\PdBkjtc.exe
  C:\Windows\System\PdBkjtc.exe
  2⤵
  PID:3644
- C:\Windows\System\NTEeKqT.exe
  C:\Windows\System\NTEeKqT.exe
  2⤵
  PID:3660
- C:\Windows\System\ZSzMZza.exe
  C:\Windows\System\ZSzMZza.exe
  2⤵
  PID:3676
- C:\Windows\System\ACvAUUg.exe
  C:\Windows\System\ACvAUUg.exe
  2⤵
  PID:3692
- C:\Windows\System\NtXlTJY.exe
  C:\Windows\System\NtXlTJY.exe
  2⤵
  PID:3708
- C:\Windows\System\fqCLAHE.exe
  C:\Windows\System\fqCLAHE.exe
  2⤵
  PID:3764
- C:\Windows\System\efeQukT.exe
  C:\Windows\System\efeQukT.exe
  2⤵
  PID:3780
- C:\Windows\System\kcfZYyy.exe
  C:\Windows\System\kcfZYyy.exe
  2⤵
  PID:3800
- C:\Windows\System\bVywwim.exe
  C:\Windows\System\bVywwim.exe
  2⤵
  PID:3824
- C:\Windows\System\vCzVcZQ.exe
  C:\Windows\System\vCzVcZQ.exe
  2⤵
  PID:3840
- C:\Windows\System\ikYIQzu.exe
  C:\Windows\System\ikYIQzu.exe
  2⤵
  PID:3856
- C:\Windows\System\TqvEiJY.exe
  C:\Windows\System\TqvEiJY.exe
  2⤵
  PID:3872
- C:\Windows\System\WJfTygE.exe
  C:\Windows\System\WJfTygE.exe
  2⤵
  PID:3888
- C:\Windows\System\MRRVnHU.exe
  C:\Windows\System\MRRVnHU.exe
  2⤵
  PID:3904
- C:\Windows\System\fUjbrMT.exe
  C:\Windows\System\fUjbrMT.exe
  2⤵
  PID:3920
- C:\Windows\System\TSUuvms.exe
  C:\Windows\System\TSUuvms.exe
  2⤵
  PID:3936
- C:\Windows\System\pSZJUDo.exe
  C:\Windows\System\pSZJUDo.exe
  2⤵
  PID:3956
- C:\Windows\System\pvQmpEZ.exe
  C:\Windows\System\pvQmpEZ.exe
  2⤵
  PID:3972
- C:\Windows\System\EhWeOnJ.exe
  C:\Windows\System\EhWeOnJ.exe
  2⤵
  PID:3988
- C:\Windows\System\VHiCFiy.exe
  C:\Windows\System\VHiCFiy.exe
  2⤵
  PID:4004
- C:\Windows\System\QpiSkrH.exe
  C:\Windows\System\QpiSkrH.exe
  2⤵
  PID:4020
- C:\Windows\System\noNLPFD.exe
  C:\Windows\System\noNLPFD.exe
  2⤵
  PID:4040
- C:\Windows\System\DagTJbr.exe
  C:\Windows\System\DagTJbr.exe
  2⤵
  PID:4056
- C:\Windows\System\UghfyUD.exe
  C:\Windows\System\UghfyUD.exe
  2⤵
  PID:4072
- C:\Windows\System\jEVPOBL.exe
  C:\Windows\System\jEVPOBL.exe
  2⤵
  PID:4088
- C:\Windows\System\HUBuVNl.exe
  C:\Windows\System\HUBuVNl.exe
  2⤵
  PID:3080
- C:\Windows\System\DdvPKLa.exe
  C:\Windows\System\DdvPKLa.exe
  2⤵
  PID:3144
- C:\Windows\System\zhOiigd.exe
  C:\Windows\System\zhOiigd.exe
  2⤵
  PID:2308
- C:\Windows\System\wZpImOY.exe
  C:\Windows\System\wZpImOY.exe
  2⤵
  PID:1624
- C:\Windows\System\qOPkblM.exe
  C:\Windows\System\qOPkblM.exe
  2⤵
  PID:3272
- C:\Windows\System\OmxHXON.exe
  C:\Windows\System\OmxHXON.exe
  2⤵
  PID:3336
- C:\Windows\System\YaviMWh.exe
  C:\Windows\System\YaviMWh.exe
  2⤵
  PID:3396
- C:\Windows\System\TcnFRuk.exe
  C:\Windows\System\TcnFRuk.exe
  2⤵
  PID:3432
- C:\Windows\System\nxedkbk.exe
  C:\Windows\System\nxedkbk.exe
  2⤵
  PID:1868
- C:\Windows\System\OQtDWBp.exe
  C:\Windows\System\OQtDWBp.exe
  2⤵
  PID:3560
- C:\Windows\System\CloYhNf.exe
  C:\Windows\System\CloYhNf.exe
  2⤵
  PID:3624
- C:\Windows\System\bzInUTc.exe
  C:\Windows\System\bzInUTc.exe
  2⤵
  PID:2844
- C:\Windows\System\RlYhwjw.exe
  C:\Windows\System\RlYhwjw.exe
  2⤵
  PID:1568
- C:\Windows\System\PBHhuyh.exe
  C:\Windows\System\PBHhuyh.exe
  2⤵
  PID:764
- C:\Windows\System\hUpIJAA.exe
  C:\Windows\System\hUpIJAA.exe
  2⤵
  PID:4108
- C:\Windows\System\TcQFdHC.exe
  C:\Windows\System\TcQFdHC.exe
  2⤵
  PID:4124
- C:\Windows\System\clYxaym.exe
  C:\Windows\System\clYxaym.exe
  2⤵
  PID:4140
- C:\Windows\System\FeuILhA.exe
  C:\Windows\System\FeuILhA.exe
  2⤵
  PID:4160
- C:\Windows\System\VQCNoDb.exe
  C:\Windows\System\VQCNoDb.exe
  2⤵
  PID:4176
- C:\Windows\System\XHdrLYK.exe
  C:\Windows\System\XHdrLYK.exe
  2⤵
  PID:4192
- C:\Windows\System\ctBxfMN.exe
  C:\Windows\System\ctBxfMN.exe
  2⤵
  PID:4208
- C:\Windows\System\DqLCrba.exe
  C:\Windows\System\DqLCrba.exe
  2⤵
  PID:4224
- C:\Windows\System\hraueGy.exe
  C:\Windows\System\hraueGy.exe
  2⤵
  PID:4240
- C:\Windows\System\vTpHeXl.exe
  C:\Windows\System\vTpHeXl.exe
  2⤵
  PID:4260
- C:\Windows\System\ETRgZTA.exe
  C:\Windows\System\ETRgZTA.exe
  2⤵
  PID:4276
- C:\Windows\System\xpOjBQA.exe
  C:\Windows\System\xpOjBQA.exe
  2⤵
  PID:4292
- C:\Windows\System\rCxQPgC.exe
  C:\Windows\System\rCxQPgC.exe
  2⤵
  PID:4308
- C:\Windows\System\KiehcJI.exe
  C:\Windows\System\KiehcJI.exe
  2⤵
  PID:4324
- C:\Windows\System\fYEaVCM.exe
  C:\Windows\System\fYEaVCM.exe
  2⤵
  PID:4340
- C:\Windows\System\KCBXpHd.exe
  C:\Windows\System\KCBXpHd.exe
  2⤵
  PID:4356
- C:\Windows\System\BBCibFs.exe
  C:\Windows\System\BBCibFs.exe
  2⤵
  PID:4372
- C:\Windows\System\ScTFAoH.exe
  C:\Windows\System\ScTFAoH.exe
  2⤵
  PID:4388
- C:\Windows\System\ysDouYz.exe
  C:\Windows\System\ysDouYz.exe
  2⤵
  PID:4408
- C:\Windows\System\IUrIXWZ.exe
  C:\Windows\System\IUrIXWZ.exe
  2⤵
  PID:4424
- C:\Windows\System\dnEfiKx.exe
  C:\Windows\System\dnEfiKx.exe
  2⤵
  PID:4440
- C:\Windows\System\UIpaAvX.exe
  C:\Windows\System\UIpaAvX.exe
  2⤵
  PID:4456
- C:\Windows\System\GIMOAJO.exe
  C:\Windows\System\GIMOAJO.exe
  2⤵
  PID:4472
- C:\Windows\System\DVoiALr.exe
  C:\Windows\System\DVoiALr.exe
  2⤵
  PID:4488
- C:\Windows\System\zloMyEc.exe
  C:\Windows\System\zloMyEc.exe
  2⤵
  PID:4504
- C:\Windows\System\mijINqF.exe
  C:\Windows\System\mijINqF.exe
  2⤵
  PID:4524
- C:\Windows\System\ddlFdDU.exe
  C:\Windows\System\ddlFdDU.exe
  2⤵
  PID:4540
- C:\Windows\System\ZHKzUZV.exe
  C:\Windows\System\ZHKzUZV.exe
  2⤵
  PID:4556
- C:\Windows\System\FOOFhZl.exe
  C:\Windows\System\FOOFhZl.exe
  2⤵
  PID:4572
- C:\Windows\System\gaNiYft.exe
  C:\Windows\System\gaNiYft.exe
  2⤵
  PID:4588
- C:\Windows\System\pVfzLks.exe
  C:\Windows\System\pVfzLks.exe
  2⤵
  PID:4604
- C:\Windows\System\ZLqYqsY.exe
  C:\Windows\System\ZLqYqsY.exe
  2⤵
  PID:4620
- C:\Windows\System\nIOBwbQ.exe
  C:\Windows\System\nIOBwbQ.exe
  2⤵
  PID:4636
- C:\Windows\System\NoJfGic.exe
  C:\Windows\System\NoJfGic.exe
  2⤵
  PID:4656
- C:\Windows\System\VOmtyki.exe
  C:\Windows\System\VOmtyki.exe
  2⤵
  PID:4672
- C:\Windows\System\sLQyzfI.exe
  C:\Windows\System\sLQyzfI.exe
  2⤵
  PID:4688
- C:\Windows\System\VtsImuO.exe
  C:\Windows\System\VtsImuO.exe
  2⤵
  PID:4704
- C:\Windows\System\GQKyZZR.exe
  C:\Windows\System\GQKyZZR.exe
  2⤵
  PID:4720
- C:\Windows\System\nUmzpJi.exe
  C:\Windows\System\nUmzpJi.exe
  2⤵
  PID:4736
- C:\Windows\System\KcmxjLX.exe
  C:\Windows\System\KcmxjLX.exe
  2⤵
  PID:4752
- C:\Windows\System\DRZywTI.exe
  C:\Windows\System\DRZywTI.exe
  2⤵
  PID:4772
- C:\Windows\System\PUSZvDG.exe
  C:\Windows\System\PUSZvDG.exe
  2⤵
  PID:4788
- C:\Windows\System\RvFWSvM.exe
  C:\Windows\System\RvFWSvM.exe
  2⤵
  PID:4804
- C:\Windows\System\rqVDuMC.exe
  C:\Windows\System\rqVDuMC.exe
  2⤵
  PID:4820
- C:\Windows\System\fGbqmPM.exe
  C:\Windows\System\fGbqmPM.exe
  2⤵
  PID:4836
- C:\Windows\System\CuHeLml.exe
  C:\Windows\System\CuHeLml.exe
  2⤵
  PID:4852
- C:\Windows\System\tPLvQGq.exe
  C:\Windows\System\tPLvQGq.exe
  2⤵
  PID:4872
- C:\Windows\System\ZPCvywi.exe
  C:\Windows\System\ZPCvywi.exe
  2⤵
  PID:4888
- C:\Windows\System\gNlTJnx.exe
  C:\Windows\System\gNlTJnx.exe
  2⤵
  PID:4904
- C:\Windows\System\OkmScCF.exe
  C:\Windows\System\OkmScCF.exe
  2⤵
  PID:4920
- C:\Windows\System\rMfeEys.exe
  C:\Windows\System\rMfeEys.exe
  2⤵
  PID:4936
- C:\Windows\System\KMYknrY.exe
  C:\Windows\System\KMYknrY.exe
  2⤵
  PID:4952
- C:\Windows\System\nFtxcuY.exe
  C:\Windows\System\nFtxcuY.exe
  2⤵
  PID:4968
- C:\Windows\System\RQhCFLh.exe
  C:\Windows\System\RQhCFLh.exe
  2⤵
  PID:4988
- C:\Windows\System\ZIodCTI.exe
  C:\Windows\System\ZIodCTI.exe
  2⤵
  PID:5004
- C:\Windows\System\MzoTRHL.exe
  C:\Windows\System\MzoTRHL.exe
  2⤵
  PID:5020
- C:\Windows\System\NbjcyqB.exe
  C:\Windows\System\NbjcyqB.exe
  2⤵
  PID:5036
- C:\Windows\System\ILrBOCw.exe
  C:\Windows\System\ILrBOCw.exe
  2⤵
  PID:5052
- C:\Windows\System\nctjYWL.exe
  C:\Windows\System\nctjYWL.exe
  2⤵
  PID:5068
- C:\Windows\System\OVWMmzK.exe
  C:\Windows\System\OVWMmzK.exe
  2⤵
  PID:5088
- C:\Windows\System\kiMMlke.exe
  C:\Windows\System\kiMMlke.exe
  2⤵
  PID:5104
- C:\Windows\System\tuFJqVB.exe
  C:\Windows\System\tuFJqVB.exe
  2⤵
  PID:588
- C:\Windows\System\RmIxBTM.exe
  C:\Windows\System\RmIxBTM.exe
  2⤵
  PID:1132
- C:\Windows\System\JcSSxqz.exe
  C:\Windows\System\JcSSxqz.exe
  2⤵
  PID:1560
- C:\Windows\System\VQcGyHb.exe
  C:\Windows\System\VQcGyHb.exe
  2⤵
  PID:1440
- C:\Windows\System\RWxPULN.exe
  C:\Windows\System\RWxPULN.exe
  2⤵
  PID:2280
- C:\Windows\System\FwLfMlY.exe
  C:\Windows\System\FwLfMlY.exe
  2⤵
  PID:5132
- C:\Windows\System\SrdPIDq.exe
  C:\Windows\System\SrdPIDq.exe
  2⤵
  PID:5148
- C:\Windows\System\eKTWsgO.exe
  C:\Windows\System\eKTWsgO.exe
  2⤵
  PID:5164
- C:\Windows\System\zvJloPW.exe
  C:\Windows\System\zvJloPW.exe
  2⤵
  PID:5180
- C:\Windows\System\vUTFJqt.exe
  C:\Windows\System\vUTFJqt.exe
  2⤵
  PID:5740
- C:\Windows\System\vmDctzU.exe
  C:\Windows\System\vmDctzU.exe
  2⤵
  PID:5756
- C:\Windows\System\ysGPCil.exe
  C:\Windows\System\ysGPCil.exe
  2⤵
  PID:5772
- C:\Windows\System\PPocHxz.exe
  C:\Windows\System\PPocHxz.exe
  2⤵
  PID:5788
- C:\Windows\System\kfjLAPt.exe
  C:\Windows\System\kfjLAPt.exe
  2⤵
  PID:5804
- C:\Windows\System\FaxHCOe.exe
  C:\Windows\System\FaxHCOe.exe
  2⤵
  PID:5820
- C:\Windows\System\OjEzfqm.exe
  C:\Windows\System\OjEzfqm.exe
  2⤵
  PID:5836
- C:\Windows\System\XeGfeQL.exe
  C:\Windows\System\XeGfeQL.exe
  2⤵
  PID:5852
- C:\Windows\System\vRJutuq.exe
  C:\Windows\System\vRJutuq.exe
  2⤵
  PID:5872
- C:\Windows\System\TmzcVDE.exe
  C:\Windows\System\TmzcVDE.exe
  2⤵
  PID:5888
- C:\Windows\System\hWrBsZj.exe
  C:\Windows\System\hWrBsZj.exe
  2⤵
  PID:5912
- C:\Windows\System\CgJzHdp.exe
  C:\Windows\System\CgJzHdp.exe
  2⤵
  PID:5932
- C:\Windows\System\mENKlka.exe
  C:\Windows\System\mENKlka.exe
  2⤵
  PID:5956
- C:\Windows\System\gIapXNW.exe
  C:\Windows\System\gIapXNW.exe
  2⤵
  PID:5972
- C:\Windows\System\JhjAHPN.exe
  C:\Windows\System\JhjAHPN.exe
  2⤵
  PID:5988
- C:\Windows\System\ifbPSGb.exe
  C:\Windows\System\ifbPSGb.exe
  2⤵
  PID:6008
- C:\Windows\System\lXFRQzv.exe
  C:\Windows\System\lXFRQzv.exe
  2⤵
  PID:6056
- C:\Windows\System\eXwhkGb.exe
  C:\Windows\System\eXwhkGb.exe
  2⤵
  PID:6072
- C:\Windows\System\qMmWHPI.exe
  C:\Windows\System\qMmWHPI.exe
  2⤵
  PID:6088
- C:\Windows\System\SaXYBFl.exe
  C:\Windows\System\SaXYBFl.exe
  2⤵
  PID:6104
- C:\Windows\System\LBVDLMJ.exe
  C:\Windows\System\LBVDLMJ.exe
  2⤵
  PID:6120
- C:\Windows\System\RFPfhAD.exe
  C:\Windows\System\RFPfhAD.exe
  2⤵
  PID:6136
- C:\Windows\System\bYAITST.exe
  C:\Windows\System\bYAITST.exe
  2⤵
  PID:1984
- C:\Windows\System\JIumJds.exe
  C:\Windows\System\JIumJds.exe
  2⤵
  PID:3808
- C:\Windows\System\HIiQMzv.exe
  C:\Windows\System\HIiQMzv.exe
  2⤵
  PID:3852
- C:\Windows\System\rdQDZLC.exe
  C:\Windows\System\rdQDZLC.exe
  2⤵
  PID:3688
- C:\Windows\System\WjvSiXN.exe
  C:\Windows\System\WjvSiXN.exe
  2⤵
  PID:2812
- C:\Windows\System\svuHbjo.exe
  C:\Windows\System\svuHbjo.exe
  2⤵
  PID:3884
- C:\Windows\System\hEUFYbZ.exe
  C:\Windows\System\hEUFYbZ.exe
  2⤵
  PID:3952
- C:\Windows\System\HZtVvoG.exe
  C:\Windows\System\HZtVvoG.exe
  2⤵
  PID:3984
- C:\Windows\System\BbzCLat.exe
  C:\Windows\System\BbzCLat.exe
  2⤵
  PID:4080
- C:\Windows\System\wdrEQCj.exe
  C:\Windows\System\wdrEQCj.exe
  2⤵
  PID:2068
- C:\Windows\System\nUAuosQ.exe
  C:\Windows\System\nUAuosQ.exe
  2⤵
  PID:3304
- C:\Windows\System\aEDjrBv.exe
  C:\Windows\System\aEDjrBv.exe
  2⤵
  PID:1136
- C:\Windows\System\iEcEcOq.exe
  C:\Windows\System\iEcEcOq.exe
  2⤵
  PID:2228
- C:\Windows\System\UXwnfUz.exe
  C:\Windows\System\UXwnfUz.exe
  2⤵
  PID:4188
- C:\Windows\System\uspErpn.exe
  C:\Windows\System\uspErpn.exe
  2⤵
  PID:4256
- C:\Windows\System\nmGpZni.exe
  C:\Windows\System\nmGpZni.exe
  2⤵
  PID:4320
- C:\Windows\System\vzTEknG.exe
  C:\Windows\System\vzTEknG.exe
  2⤵
  PID:4416
- C:\Windows\System\qxfSRpF.exe
  C:\Windows\System\qxfSRpF.exe
  2⤵
  PID:4480
- C:\Windows\System\keqrjmE.exe
  C:\Windows\System\keqrjmE.exe
  2⤵
  PID:4520
- C:\Windows\System\lZnWfkJ.exe
  C:\Windows\System\lZnWfkJ.exe
  2⤵
  PID:4584
- C:\Windows\System\UtTzLIG.exe
  C:\Windows\System\UtTzLIG.exe
  2⤵
  PID:4684
- C:\Windows\System\GoACkhl.exe
  C:\Windows\System\GoACkhl.exe
  2⤵
  PID:4748
- C:\Windows\System\GekojhU.exe
  C:\Windows\System\GekojhU.exe
  2⤵
  PID:4816
- C:\Windows\System\YeByuws.exe
  C:\Windows\System\YeByuws.exe
  2⤵
  PID:4944
- C:\Windows\System\urkXBLA.exe
  C:\Windows\System\urkXBLA.exe
  2⤵
  PID:5012
- C:\Windows\System\MlxmRPg.exe
  C:\Windows\System\MlxmRPg.exe
  2⤵
  PID:5176
- C:\Windows\System\XmtKvZU.exe
  C:\Windows\System\XmtKvZU.exe
  2⤵
  PID:3668
- C:\Windows\System\IRRdbcu.exe
  C:\Windows\System\IRRdbcu.exe
  2⤵
  PID:3572
- C:\Windows\System\HwQSaHp.exe
  C:\Windows\System\HwQSaHp.exe
  2⤵
  PID:3508
- C:\Windows\System\OFlpxck.exe
  C:\Windows\System\OFlpxck.exe
  2⤵
  PID:3412
- C:\Windows\System\apqkNhP.exe
  C:\Windows\System\apqkNhP.exe
  2⤵
  PID:3348
- C:\Windows\System\TuLvQzt.exe
  C:\Windows\System\TuLvQzt.exe
  2⤵
  PID:3256
- C:\Windows\System\fdcGoWL.exe
  C:\Windows\System\fdcGoWL.exe
  2⤵
  PID:3192
- C:\Windows\System\RQaWrLE.exe
  C:\Windows\System\RQaWrLE.exe
  2⤵
  PID:3096
- C:\Windows\System\GDSONpW.exe
  C:\Windows\System\GDSONpW.exe
  2⤵
  PID:2960
- C:\Windows\System\mBEvJZC.exe
  C:\Windows\System\mBEvJZC.exe
  2⤵
  PID:2452
- C:\Windows\System\QbJNJDi.exe
  C:\Windows\System\QbJNJDi.exe
  2⤵
  PID:2096
- C:\Windows\System\glGJaRQ.exe
  C:\Windows\System\glGJaRQ.exe
  2⤵
  PID:2328
- C:\Windows\System\kdBnaos.exe
  C:\Windows\System\kdBnaos.exe
  2⤵
  PID:1516
- C:\Windows\System\bPNaMnH.exe
  C:\Windows\System\bPNaMnH.exe
  2⤵
  PID:2448
- C:\Windows\System\SmemZkl.exe
  C:\Windows\System\SmemZkl.exe
  2⤵
  PID:1664
- C:\Windows\System\iUAStSS.exe
  C:\Windows\System\iUAStSS.exe
  2⤵
  PID:1852
- C:\Windows\System\vzKKaix.exe
  C:\Windows\System\vzKKaix.exe
  2⤵
  PID:2284
- C:\Windows\System\MkiFrQE.exe
  C:\Windows\System\MkiFrQE.exe
  2⤵
  PID:4052
- C:\Windows\System\opzRZEv.exe
  C:\Windows\System\opzRZEv.exe
  2⤵
  PID:2544
- C:\Windows\System\GvAeiFn.exe
  C:\Windows\System\GvAeiFn.exe
  2⤵
  PID:4252
- C:\Windows\System\jpdEHIn.exe
  C:\Windows\System\jpdEHIn.exe
  2⤵
  PID:4652
- C:\Windows\System\oKuveho.exe
  C:\Windows\System\oKuveho.exe
  2⤵
  PID:4948
- C:\Windows\System\Xxloiov.exe
  C:\Windows\System\Xxloiov.exe
  2⤵
  PID:5172
- C:\Windows\System\eslzAbL.exe
  C:\Windows\System\eslzAbL.exe
  2⤵
  PID:3416
- C:\Windows\System\jGjqTkL.exe
  C:\Windows\System\jGjqTkL.exe
  2⤵
  PID:1536
- C:\Windows\System\CzkISYt.exe
  C:\Windows\System\CzkISYt.exe
  2⤵
  PID:2708
- C:\Windows\System\SPBwGuN.exe
  C:\Windows\System\SPBwGuN.exe
  2⤵
  PID:3736
- C:\Windows\System\CHoRMZv.exe
  C:\Windows\System\CHoRMZv.exe
  2⤵
  PID:3720
- C:\Windows\System\rNJKBLf.exe
  C:\Windows\System\rNJKBLf.exe
  2⤵
  PID:3896
- C:\Windows\System\dEynVxu.exe
  C:\Windows\System\dEynVxu.exe
  2⤵
  PID:3964
- C:\Windows\System\DORzBwO.exe
  C:\Windows\System\DORzBwO.exe
  2⤵
  PID:4028
- C:\Windows\System\PsnTzcw.exe
  C:\Windows\System\PsnTzcw.exe
  2⤵
  PID:4068
- C:\Windows\System\DcLMauU.exe
  C:\Windows\System\DcLMauU.exe
  2⤵
  PID:3176
- C:\Windows\System\nyfisAp.exe
  C:\Windows\System\nyfisAp.exe
  2⤵
  PID:3368
- C:\Windows\System\iHeJmbn.exe
  C:\Windows\System\iHeJmbn.exe
  2⤵
  PID:3592
- C:\Windows\System\RCLRLeE.exe
  C:\Windows\System\RCLRLeE.exe
  2⤵
  PID:1532
- C:\Windows\System\XTQzvgA.exe
  C:\Windows\System\XTQzvgA.exe
  2⤵
  PID:4136
- C:\Windows\System\KJVfARY.exe
  C:\Windows\System\KJVfARY.exe
  2⤵
  PID:4204
- C:\Windows\System\AUZaVmm.exe
  C:\Windows\System\AUZaVmm.exe
  2⤵
  PID:4272
- C:\Windows\System\RQWAXnD.exe
  C:\Windows\System\RQWAXnD.exe
  2⤵
  PID:4336
- C:\Windows\System\VbSdLcB.exe
  C:\Windows\System\VbSdLcB.exe
  2⤵
  PID:4400
- C:\Windows\System\iheldiO.exe
  C:\Windows\System\iheldiO.exe
  2⤵
  PID:4468
- C:\Windows\System\ejYjewJ.exe
  C:\Windows\System\ejYjewJ.exe
  2⤵
  PID:4500
- C:\Windows\System\rdAopqs.exe
  C:\Windows\System\rdAopqs.exe
  2⤵
  PID:4568
- C:\Windows\System\fPRieKd.exe
  C:\Windows\System\fPRieKd.exe
  2⤵
  PID:4664
- C:\Windows\System\yLcEGaf.exe
  C:\Windows\System\yLcEGaf.exe
  2⤵
  PID:4732
- C:\Windows\System\bySzLCB.exe
  C:\Windows\System\bySzLCB.exe
  2⤵
  PID:4800
- C:\Windows\System\EEEkTWW.exe
  C:\Windows\System\EEEkTWW.exe
  2⤵
  PID:4864
- C:\Windows\System\GSsBydI.exe
  C:\Windows\System\GSsBydI.exe
  2⤵
  PID:4960
- C:\Windows\System\hTYvXjR.exe
  C:\Windows\System\hTYvXjR.exe
  2⤵
  PID:5032
- C:\Windows\System\qzIKmfc.exe
  C:\Windows\System\qzIKmfc.exe
  2⤵
  PID:5100
- C:\Windows\System\KUmteHL.exe
  C:\Windows\System\KUmteHL.exe
  2⤵
  PID:1904
- C:\Windows\System\yjQkAfo.exe
  C:\Windows\System\yjQkAfo.exe
  2⤵
  PID:5160
- C:\Windows\System\uafYNMt.exe
  C:\Windows\System\uafYNMt.exe
  2⤵
  PID:5232
- C:\Windows\System\hWyYSre.exe
  C:\Windows\System\hWyYSre.exe
  2⤵
  PID:5244
- C:\Windows\System\EiyEYIB.exe
  C:\Windows\System\EiyEYIB.exe
  2⤵
  PID:5252
- C:\Windows\System\ytandOp.exe
  C:\Windows\System\ytandOp.exe
  2⤵
  PID:3836
- C:\Windows\System\DKgDDAy.exe
  C:\Windows\System\DKgDDAy.exe
  2⤵
  PID:5512
- C:\Windows\System\FyuNury.exe
  C:\Windows\System\FyuNury.exe
  2⤵
  PID:5528
- C:\Windows\System\WnnraRJ.exe
  C:\Windows\System\WnnraRJ.exe
  2⤵
  PID:5544
- C:\Windows\System\ymwyydC.exe
  C:\Windows\System\ymwyydC.exe
  2⤵
  PID:5560
- C:\Windows\System\TMAxYrE.exe
  C:\Windows\System\TMAxYrE.exe
  2⤵
  PID:5576
- C:\Windows\System\HmdofEC.exe
  C:\Windows\System\HmdofEC.exe
  2⤵
  PID:5592
- C:\Windows\System\KnHBAAP.exe
  C:\Windows\System\KnHBAAP.exe
  2⤵
  PID:5608
- C:\Windows\System\CswDOWW.exe
  C:\Windows\System\CswDOWW.exe
  2⤵
  PID:5624
- C:\Windows\System\SNaapYy.exe
  C:\Windows\System\SNaapYy.exe
  2⤵
  PID:5636
- C:\Windows\System\sMKSUGn.exe
  C:\Windows\System\sMKSUGn.exe
  2⤵
  PID:5652
- C:\Windows\System\HfxHmDu.exe
  C:\Windows\System\HfxHmDu.exe
  2⤵
  PID:5668
- C:\Windows\System\fzrLTLs.exe
  C:\Windows\System\fzrLTLs.exe
  2⤵
  PID:5684
- C:\Windows\System\XzKJEZU.exe
  C:\Windows\System\XzKJEZU.exe
  2⤵
  PID:5700
- C:\Windows\System\BNzPAwp.exe
  C:\Windows\System\BNzPAwp.exe
  2⤵
  PID:5716
- C:\Windows\System\wDOqNpw.exe
  C:\Windows\System\wDOqNpw.exe
  2⤵
  PID:5732
- C:\Windows\System\ifAUckM.exe
  C:\Windows\System\ifAUckM.exe
  2⤵
  PID:448
- C:\Windows\System\QMillUS.exe
  C:\Windows\System\QMillUS.exe
  2⤵
  PID:1652
- C:\Windows\System\vyjIyRb.exe
  C:\Windows\System\vyjIyRb.exe
  2⤵
  PID:5764
- C:\Windows\System\TjZMplB.exe
  C:\Windows\System\TjZMplB.exe
  2⤵
  PID:5828
- C:\Windows\System\FvqSUuk.exe
  C:\Windows\System\FvqSUuk.exe
  2⤵
  PID:1656
- C:\Windows\System\gbeFRFQ.exe
  C:\Windows\System\gbeFRFQ.exe
  2⤵
  PID:2704
- C:\Windows\System\nAkgaLC.exe
  C:\Windows\System\nAkgaLC.exe
  2⤵
  PID:760
- C:\Windows\System\bMSKvoI.exe
  C:\Windows\System\bMSKvoI.exe
  2⤵
  PID:5880
- C:\Windows\System\qhyEoYT.exe
  C:\Windows\System\qhyEoYT.exe
  2⤵
  PID:5948
- C:\Windows\System\UzJRBEo.exe
  C:\Windows\System\UzJRBEo.exe
  2⤵
  PID:5752
- C:\Windows\System\tqKrKDh.exe
  C:\Windows\System\tqKrKDh.exe
  2⤵
  PID:5964
- C:\Windows\System\enygUbW.exe
  C:\Windows\System\enygUbW.exe
  2⤵
  PID:2664
- C:\Windows\System\rdFoykT.exe
  C:\Windows\System\rdFoykT.exe
  2⤵
  PID:6080
- C:\Windows\System\sBIYPHc.exe
  C:\Windows\System\sBIYPHc.exe
  2⤵
  PID:6116
- C:\Windows\System\CEdwyeh.exe
  C:\Windows\System\CEdwyeh.exe
  2⤵
  PID:6132
- C:\Windows\System\rHsbnBQ.exe
  C:\Windows\System\rHsbnBQ.exe
  2⤵
  PID:3848
- C:\Windows\System\sClvIUk.exe
  C:\Windows\System\sClvIUk.exe
  2⤵
  PID:3948
- C:\Windows\System\riAfHHu.exe
  C:\Windows\System\riAfHHu.exe
  2⤵
  PID:4220
- C:\Windows\System\aPpvfSf.exe
  C:\Windows\System\aPpvfSf.exe
  2⤵
  PID:3208
- C:\Windows\System\uqvsXyZ.exe
  C:\Windows\System\uqvsXyZ.exe
  2⤵
  PID:4352
- C:\Windows\System\nfZVwyB.exe
  C:\Windows\System\nfZVwyB.exe
  2⤵
  PID:4812
- C:\Windows\System\OQHmqnt.exe
  C:\Windows\System\OQHmqnt.exe
  2⤵
  PID:3700
- C:\Windows\System\mMCdWxM.exe
  C:\Windows\System\mMCdWxM.exe
  2⤵
  PID:3352
- C:\Windows\System\ZDEZIqO.exe
  C:\Windows\System\ZDEZIqO.exe
  2⤵
  PID:1708
- C:\Windows\System\yWbTeLR.exe
  C:\Windows\System\yWbTeLR.exe
  2⤵
  PID:2744
- C:\Windows\System\WPVPkiX.exe
  C:\Windows\System\WPVPkiX.exe
  2⤵
  PID:5144
- C:\Windows\System\qpeAfVl.exe
  C:\Windows\System\qpeAfVl.exe
  2⤵
  PID:3448
- C:\Windows\System\xOtWLYa.exe
  C:\Windows\System\xOtWLYa.exe
  2⤵
  PID:3156
- C:\Windows\System\VmWViYv.exe
  C:\Windows\System\VmWViYv.exe
  2⤵
  PID:1784
- C:\Windows\System\nmgwtUU.exe
  C:\Windows\System\nmgwtUU.exe
  2⤵
  PID:3880
- C:\Windows\System\XpduHNe.exe
  C:\Windows\System\XpduHNe.exe
  2⤵
  PID:3108
- C:\Windows\System\aGFRlEz.exe
  C:\Windows\System\aGFRlEz.exe
  2⤵
  PID:3428
- C:\Windows\System\odnTASa.exe
  C:\Windows\System\odnTASa.exe
  2⤵
  PID:4452
- C:\Windows\System\MavRldW.exe
  C:\Windows\System\MavRldW.exe
  2⤵
  PID:4580
- C:\Windows\System\BGTtNjA.exe
  C:\Windows\System\BGTtNjA.exe
  2⤵
  PID:4916
- C:\Windows\System\JvrByuv.exe
  C:\Windows\System\JvrByuv.exe
  2⤵
  PID:5084
- C:\Windows\System\bACrxsq.exe
  C:\Windows\System\bACrxsq.exe
  2⤵
  PID:1872
- C:\Windows\System\JVHQXeT.exe
  C:\Windows\System\JVHQXeT.exe
  2⤵
  PID:1760
- C:\Windows\System\YOsHIBz.exe
  C:\Windows\System\YOsHIBz.exe
  2⤵
  PID:4612
- C:\Windows\System\KAgPban.exe
  C:\Windows\System\KAgPban.exe
  2⤵
  PID:3188
- C:\Windows\System\GFsdBXM.exe
  C:\Windows\System\GFsdBXM.exe
  2⤵
  PID:3004
- C:\Windows\System\mLkiIBo.exe
  C:\Windows\System\mLkiIBo.exe
  2⤵
  PID:1464
- C:\Windows\System\eFRIhFN.exe
  C:\Windows\System\eFRIhFN.exe
  2⤵
  PID:4184
- C:\Windows\System\Tqufuwm.exe
  C:\Windows\System\Tqufuwm.exe
  2⤵
  PID:3672
- C:\Windows\System\nbmcVBi.exe
  C:\Windows\System\nbmcVBi.exe
  2⤵
  PID:2612
- C:\Windows\System\CRdroiv.exe
  C:\Windows\System\CRdroiv.exe
  2⤵
  PID:3868
- C:\Windows\System\uPojoei.exe
  C:\Windows\System\uPojoei.exe
  2⤵
  PID:3076
- C:\Windows\System\wcAkLOD.exe
  C:\Windows\System\wcAkLOD.exe
  2⤵
  PID:4104
- C:\Windows\System\grkdpFZ.exe
  C:\Windows\System\grkdpFZ.exe
  2⤵
  PID:4368
- C:\Windows\System\DDfHAMo.exe
  C:\Windows\System\DDfHAMo.exe
  2⤵
  PID:4628
- C:\Windows\System\xCOfsbp.exe
  C:\Windows\System\xCOfsbp.exe
  2⤵
  PID:4896
- C:\Windows\System\utQBKvv.exe
  C:\Windows\System\utQBKvv.exe
  2⤵
  PID:5064
- C:\Windows\System\BcfuiYg.exe
  C:\Windows\System\BcfuiYg.exe
  2⤵
  PID:5224
- C:\Windows\System\ShUAPsm.exe
  C:\Windows\System\ShUAPsm.exe
  2⤵
  PID:1492
- C:\Windows\System\OHazwEA.exe
  C:\Windows\System\OHazwEA.exe
  2⤵
  PID:2064
- C:\Windows\System\FSRHsgY.exe
  C:\Windows\System\FSRHsgY.exe
  2⤵
  PID:5644
- C:\Windows\System\whYRjfg.exe
  C:\Windows\System\whYRjfg.exe
  2⤵
  PID:5708
- C:\Windows\System\DLGpbYH.exe
  C:\Windows\System\DLGpbYH.exe
  2⤵
  PID:5864
- C:\Windows\System\qwWtgnR.exe
  C:\Windows\System\qwWtgnR.exe
  2⤵
  PID:1964
- C:\Windows\System\NINwZMA.exe
  C:\Windows\System\NINwZMA.exe
  2⤵
  PID:5952
- C:\Windows\System\PrrBQIG.exe
  C:\Windows\System\PrrBQIG.exe
  2⤵
  PID:5844
- C:\Windows\System\gDVpPJu.exe
  C:\Windows\System\gDVpPJu.exe
  2⤵
  PID:5928
- C:\Windows\System\BfoXUiM.exe
  C:\Windows\System\BfoXUiM.exe
  2⤵
  PID:3932
- C:\Windows\System\AfwAvep.exe
  C:\Windows\System\AfwAvep.exe
  2⤵
  PID:6128
- C:\Windows\System\fPYnERN.exe
  C:\Windows\System\fPYnERN.exe
  2⤵
  PID:3000
- C:\Windows\System\pkavheb.exe
  C:\Windows\System\pkavheb.exe
  2⤵
  PID:3512
- C:\Windows\System\TByQGxU.exe
  C:\Windows\System\TByQGxU.exe
  2⤵
  PID:4832
- C:\Windows\System\mkAgTqp.exe
  C:\Windows\System\mkAgTqp.exe
  2⤵
  PID:5028
- C:\Windows\System\kjiovwe.exe
  C:\Windows\System\kjiovwe.exe
  2⤵
  PID:5192
- C:\Windows\System\hqwpxoD.exe
  C:\Windows\System\hqwpxoD.exe
  2⤵
  PID:1420
- C:\Windows\System\yUyxqjs.exe
  C:\Windows\System\yUyxqjs.exe
  2⤵
  PID:5568
- C:\Windows\System\CpQQoOX.exe
  C:\Windows\System\CpQQoOX.exe
  2⤵
  PID:3576
- C:\Windows\System\KsXSdbc.exe
  C:\Windows\System\KsXSdbc.exe
  2⤵
  PID:5688
- C:\Windows\System\KsGPboe.exe
  C:\Windows\System\KsGPboe.exe
  2⤵
  PID:5924
- C:\Windows\System\XxZaYEp.exe
  C:\Windows\System\XxZaYEp.exe
  2⤵
  PID:5996
- C:\Windows\System\WaIPsKp.exe
  C:\Windows\System\WaIPsKp.exe
  2⤵
  PID:4036
- C:\Windows\System\yuRHhDL.exe
  C:\Windows\System\yuRHhDL.exe
  2⤵
  PID:4380
- C:\Windows\System\IgLCXOM.exe
  C:\Windows\System\IgLCXOM.exe
  2⤵
  PID:2876
- C:\Windows\System\QmZeusJ.exe
  C:\Windows\System\QmZeusJ.exe
  2⤵
  PID:4304
- C:\Windows\System\ustgGDy.exe
  C:\Windows\System\ustgGDy.exe
  2⤵
  PID:3792
- C:\Windows\System\QGpdHBj.exe
  C:\Windows\System\QGpdHBj.exe
  2⤵
  PID:2840
- C:\Windows\System\fCnQwbY.exe
  C:\Windows\System\fCnQwbY.exe
  2⤵
  PID:4596
- C:\Windows\System\riRTGnv.exe
  C:\Windows\System\riRTGnv.exe
  2⤵
  PID:5692
- C:\Windows\System\OFEYohV.exe
  C:\Windows\System\OFEYohV.exe
  2⤵
  PID:2372
- C:\Windows\System\lYYusVc.exe
  C:\Windows\System\lYYusVc.exe
  2⤵
  PID:2720
- C:\Windows\System\ToWyciH.exe
  C:\Windows\System\ToWyciH.exe
  2⤵
  PID:3288
- C:\Windows\System\YAORwdj.exe
  C:\Windows\System\YAORwdj.exe
  2⤵
  PID:3112
- C:\Windows\System\CMXSiwx.exe
  C:\Windows\System\CMXSiwx.exe
  2⤵
  PID:2880
- C:\Windows\System\ZXbUEes.exe
  C:\Windows\System\ZXbUEes.exe
  2⤵
  PID:1676
- C:\Windows\System\kVPpNwv.exe
  C:\Windows\System\kVPpNwv.exe
  2⤵
  PID:4912
- C:\Windows\System\efIAvgO.exe
  C:\Windows\System\efIAvgO.exe
  2⤵
  PID:3492
- C:\Windows\System\sFMtZvY.exe
  C:\Windows\System\sFMtZvY.exe
  2⤵
  PID:4744
- C:\Windows\System\lKwjBIA.exe
  C:\Windows\System\lKwjBIA.exe
  2⤵
  PID:3556
- C:\Windows\System\riputcc.exe
  C:\Windows\System\riputcc.exe
  2⤵
  PID:4152
- C:\Windows\System\YHFKlxc.exe
  C:\Windows\System\YHFKlxc.exe
  2⤵
  PID:4000
- C:\Windows\System\mmnYSxF.exe
  C:\Windows\System\mmnYSxF.exe
  2⤵
  PID:4796
- C:\Windows\System\aruuftz.exe
  C:\Windows\System\aruuftz.exe
  2⤵
  PID:1864
- C:\Windows\System\IpXsFTU.exe
  C:\Windows\System\IpXsFTU.exe
  2⤵
  PID:2420
- C:\Windows\System\xEiPRHf.exe
  C:\Windows\System\xEiPRHf.exe
  2⤵
  PID:5620
- C:\Windows\System\McvrhdF.exe
  C:\Windows\System\McvrhdF.exe
  2⤵
  PID:5940
- C:\Windows\System\NTlODik.exe
  C:\Windows\System\NTlODik.exe
  2⤵
  PID:5680
- C:\Windows\System\gKgJVYa.exe
  C:\Windows\System\gKgJVYa.exe
  2⤵
  PID:5984
- C:\Windows\System\CUNdxkV.exe
  C:\Windows\System\CUNdxkV.exe
  2⤵
  PID:3928
- C:\Windows\System\OKXVGGc.exe
  C:\Windows\System\OKXVGGc.exe
  2⤵
  PID:1580
- C:\Windows\System\SWeCvbf.exe
  C:\Windows\System\SWeCvbf.exe
  2⤵
  PID:3944
- C:\Windows\System\dlTvorY.exe
  C:\Windows\System\dlTvorY.exe
  2⤵
  PID:2500
- C:\Windows\System\ijfzTxd.exe
  C:\Windows\System\ijfzTxd.exe
  2⤵
  PID:4700
- C:\Windows\System\ZHjDxqI.exe
  C:\Windows\System\ZHjDxqI.exe
  2⤵
  PID:5540
- C:\Windows\System\PVziTzN.exe
  C:\Windows\System\PVziTzN.exe
  2⤵
  PID:5796
- C:\Windows\System\yMhLdCo.exe
  C:\Windows\System\yMhLdCo.exe
  2⤵
  PID:2824
- C:\Windows\System\UxJRWyw.exe
  C:\Windows\System\UxJRWyw.exe
  2⤵
  PID:2632
- C:\Windows\System\OYFTVIu.exe
  C:\Windows\System\OYFTVIu.exe
  2⤵
  PID:5748
- C:\Windows\System\HIafSZE.exe
  C:\Windows\System\HIafSZE.exe
  2⤵
  PID:540
- C:\Windows\System\mqWVNnj.exe
  C:\Windows\System\mqWVNnj.exe
  2⤵
  PID:4436
- C:\Windows\System\GNnRARn.exe
  C:\Windows\System\GNnRARn.exe
  2⤵
  PID:1812
- C:\Windows\System\aAhnRXR.exe
  C:\Windows\System\aAhnRXR.exe
  2⤵
  PID:2768
- C:\Windows\System\GTCYRak.exe
  C:\Windows\System\GTCYRak.exe
  2⤵
  PID:1080
- C:\Windows\System\tfdDwKw.exe
  C:\Windows\System\tfdDwKw.exe
  2⤵
  PID:4512
- C:\Windows\System\ziOdWsc.exe
  C:\Windows\System\ziOdWsc.exe
  2⤵
  PID:6004
- C:\Windows\System\XfVLDPh.exe
  C:\Windows\System\XfVLDPh.exe
  2⤵
  PID:3656
- C:\Windows\System\zmZcyrZ.exe
  C:\Windows\System\zmZcyrZ.exe
  2⤵
  PID:2400
- C:\Windows\System\lWUjBPy.exe
  C:\Windows\System\lWUjBPy.exe
  2⤵
  PID:3496
- C:\Windows\System\MMySTFO.exe
  C:\Windows\System\MMySTFO.exe
  2⤵
  PID:2012
- C:\Windows\System\TBGvTOt.exe
  C:\Windows\System\TBGvTOt.exe
  2⤵
  PID:3704
- C:\Windows\System\IUuaFSu.exe
  C:\Windows\System\IUuaFSu.exe
  2⤵
  PID:2600
- C:\Windows\System\RHSxbOf.exe
  C:\Windows\System\RHSxbOf.exe
  2⤵
  PID:4012
- C:\Windows\System\PGtuIvQ.exe
  C:\Windows\System\PGtuIvQ.exe
  2⤵
  PID:5676
- C:\Windows\System\DxitAXj.exe
  C:\Windows\System\DxitAXj.exe
  2⤵
  PID:2988
- C:\Windows\System\vzFCaLc.exe
  C:\Windows\System\vzFCaLc.exe
  2⤵
  PID:5616
- C:\Windows\System\MxpzpUp.exe
  C:\Windows\System\MxpzpUp.exe
  2⤵
  PID:2516
- C:\Windows\System\PPztTyI.exe
  C:\Windows\System\PPztTyI.exe
  2⤵
  PID:2252
- C:\Windows\System\JOpYvlF.exe
  C:\Windows\System\JOpYvlF.exe
  2⤵
  PID:2700
- C:\Windows\System\ywBkqlR.exe
  C:\Windows\System\ywBkqlR.exe
  2⤵
  PID:1960
- C:\Windows\System\OpfqHge.exe
  C:\Windows\System\OpfqHge.exe
  2⤵
  PID:2148
- C:\Windows\System\kQGALZf.exe
  C:\Windows\System\kQGALZf.exe
  2⤵
  PID:3476
- C:\Windows\System\osEVKbP.exe
  C:\Windows\System\osEVKbP.exe
  2⤵
  PID:4564
- C:\Windows\System\KtphoIV.exe
  C:\Windows\System\KtphoIV.exe
  2⤵
  PID:1092
- C:\Windows\System\yLvDaDc.exe
  C:\Windows\System\yLvDaDc.exe
  2⤵
  PID:3684
- C:\Windows\System\dVCZVLV.exe
  C:\Windows\System\dVCZVLV.exe
  2⤵
  PID:4648
- C:\Windows\System\ddASefr.exe
  C:\Windows\System\ddASefr.exe
  2⤵
  PID:5080
- C:\Windows\System\XBMwxrt.exe
  C:\Windows\System\XBMwxrt.exe
  2⤵
  PID:1164
- C:\Windows\System\MDrkNaT.exe
  C:\Windows\System\MDrkNaT.exe
  2⤵
  PID:4432
- C:\Windows\System\jIwkqhJ.exe
  C:\Windows\System\jIwkqhJ.exe
  2⤵
  PID:6100
- C:\Windows\System\PrKtpVG.exe
  C:\Windows\System\PrKtpVG.exe
  2⤵
  PID:5604
- C:\Windows\System\dRvzwgy.exe
  C:\Windows\System\dRvzwgy.exe
  2⤵
  PID:3528
- C:\Windows\System\MYZTxaQ.exe
  C:\Windows\System\MYZTxaQ.exe
  2⤵
  PID:564
- C:\Windows\System\fqvkTxj.exe
  C:\Windows\System\fqvkTxj.exe
  2⤵
  PID:2524
- C:\Windows\System\STqVIZI.exe
  C:\Windows\System\STqVIZI.exe
  2⤵
  PID:4696
- C:\Windows\System\dFFufUQ.exe
  C:\Windows\System\dFFufUQ.exe
  2⤵
  PID:6156
- C:\Windows\System\AbdeMbV.exe
  C:\Windows\System\AbdeMbV.exe
  2⤵
  PID:6172
- C:\Windows\System\kJhJOJH.exe
  C:\Windows\System\kJhJOJH.exe
  2⤵
  PID:6188
- C:\Windows\System\pChuQSR.exe
  C:\Windows\System\pChuQSR.exe
  2⤵
  PID:6204
- C:\Windows\System\UfBdlCu.exe
  C:\Windows\System\UfBdlCu.exe
  2⤵
  PID:6220
- C:\Windows\System\nNTTFhk.exe
  C:\Windows\System\nNTTFhk.exe
  2⤵
  PID:6236
- C:\Windows\System\eoTdEpn.exe
  C:\Windows\System\eoTdEpn.exe
  2⤵
  PID:6252
- C:\Windows\System\UMErCdI.exe
  C:\Windows\System\UMErCdI.exe
  2⤵
  PID:6268
- C:\Windows\System\TdQDgzC.exe
  C:\Windows\System\TdQDgzC.exe
  2⤵
  PID:6284
- C:\Windows\System\IeaYmqi.exe
  C:\Windows\System\IeaYmqi.exe
  2⤵
  PID:6300
- C:\Windows\System\vUTzXUr.exe
  C:\Windows\System\vUTzXUr.exe
  2⤵
  PID:6316
- C:\Windows\System\crVHYOf.exe
  C:\Windows\System\crVHYOf.exe
  2⤵
  PID:6332
- C:\Windows\System\hchZlvW.exe
  C:\Windows\System\hchZlvW.exe
  2⤵
  PID:6348
- C:\Windows\System\yZiFVVz.exe
  C:\Windows\System\yZiFVVz.exe
  2⤵
  PID:6364
- C:\Windows\System\NeTCABQ.exe
  C:\Windows\System\NeTCABQ.exe
  2⤵
  PID:6380
- C:\Windows\System\ERRWWQi.exe
  C:\Windows\System\ERRWWQi.exe
  2⤵
  PID:6396
- C:\Windows\System\OLAbyTk.exe
  C:\Windows\System\OLAbyTk.exe
  2⤵
  PID:6412
- C:\Windows\System\zjheCso.exe
  C:\Windows\System\zjheCso.exe
  2⤵
  PID:6428
- C:\Windows\System\fUFymnJ.exe
  C:\Windows\System\fUFymnJ.exe
  2⤵
  PID:6444
- C:\Windows\System\cZRhGiD.exe
  C:\Windows\System\cZRhGiD.exe
  2⤵
  PID:6460
- C:\Windows\System\ewRbzlV.exe
  C:\Windows\System\ewRbzlV.exe
  2⤵
  PID:6476
- C:\Windows\System\GIFzoUJ.exe
  C:\Windows\System\GIFzoUJ.exe
  2⤵
  PID:6492
- C:\Windows\System\mQeDbmA.exe
  C:\Windows\System\mQeDbmA.exe
  2⤵
  PID:6508
- C:\Windows\System\jwGiKxB.exe
  C:\Windows\System\jwGiKxB.exe
  2⤵
  PID:6524
- C:\Windows\System\hxzXEYa.exe
  C:\Windows\System\hxzXEYa.exe
  2⤵
  PID:6540
- C:\Windows\System\WKCAcbM.exe
  C:\Windows\System\WKCAcbM.exe
  2⤵
  PID:6556
- C:\Windows\System\hFeiAdD.exe
  C:\Windows\System\hFeiAdD.exe
  2⤵
  PID:6572
- C:\Windows\System\WZxBgii.exe
  C:\Windows\System\WZxBgii.exe
  2⤵
  PID:6588
- C:\Windows\System\WaCpqTq.exe
  C:\Windows\System\WaCpqTq.exe
  2⤵
  PID:6604
- C:\Windows\System\GDYOPmf.exe
  C:\Windows\System\GDYOPmf.exe
  2⤵
  PID:6620
- C:\Windows\System\nkpgesE.exe
  C:\Windows\System\nkpgesE.exe
  2⤵
  PID:6636
- C:\Windows\System\WCQtdcq.exe
  C:\Windows\System\WCQtdcq.exe
  2⤵
  PID:6656
- C:\Windows\System\NjTedVo.exe
  C:\Windows\System\NjTedVo.exe
  2⤵
  PID:6672
- C:\Windows\System\EnLIEGZ.exe
  C:\Windows\System\EnLIEGZ.exe
  2⤵
  PID:6688
- C:\Windows\System\ampdcbd.exe
  C:\Windows\System\ampdcbd.exe
  2⤵
  PID:6704
- C:\Windows\System\vOVifDk.exe
  C:\Windows\System\vOVifDk.exe
  2⤵
  PID:6720
- C:\Windows\System\uDDPkQI.exe
  C:\Windows\System\uDDPkQI.exe
  2⤵
  PID:6736
- C:\Windows\System\OrSsAGF.exe
  C:\Windows\System\OrSsAGF.exe
  2⤵
  PID:6752
- C:\Windows\System\WPkrLJW.exe
  C:\Windows\System\WPkrLJW.exe
  2⤵
  PID:6768
- C:\Windows\System\tKxyyjV.exe
  C:\Windows\System\tKxyyjV.exe
  2⤵
  PID:6784
- C:\Windows\System\zAYRbrK.exe
  C:\Windows\System\zAYRbrK.exe
  2⤵
  PID:6800
- C:\Windows\System\SSEFWpj.exe
  C:\Windows\System\SSEFWpj.exe
  2⤵
  PID:6816
- C:\Windows\System\rLybxkl.exe
  C:\Windows\System\rLybxkl.exe
  2⤵
  PID:6832
- C:\Windows\System\Upfpabm.exe
  C:\Windows\System\Upfpabm.exe
  2⤵
  PID:6848
- C:\Windows\System\gSbRXMY.exe
  C:\Windows\System\gSbRXMY.exe
  2⤵
  PID:6864
- C:\Windows\System\Zhciyix.exe
  C:\Windows\System\Zhciyix.exe
  2⤵
  PID:6880
- C:\Windows\System\XBMWXdz.exe
  C:\Windows\System\XBMWXdz.exe
  2⤵
  PID:6896
- C:\Windows\System\oOfpVOo.exe
  C:\Windows\System\oOfpVOo.exe
  2⤵
  PID:6912
- C:\Windows\System\hArPwDB.exe
  C:\Windows\System\hArPwDB.exe
  2⤵
  PID:6928
- C:\Windows\System\DMrYLOY.exe
  C:\Windows\System\DMrYLOY.exe
  2⤵
  PID:6944
- C:\Windows\System\HDCaksb.exe
  C:\Windows\System\HDCaksb.exe
  2⤵
  PID:6960
- C:\Windows\System\nIclAFw.exe
  C:\Windows\System\nIclAFw.exe
  2⤵
  PID:6976
- C:\Windows\System\CPYJhPJ.exe
  C:\Windows\System\CPYJhPJ.exe
  2⤵
  PID:6992
- C:\Windows\System\oLLbImg.exe
  C:\Windows\System\oLLbImg.exe
  2⤵
  PID:7008
- C:\Windows\System\roUtFnk.exe
  C:\Windows\System\roUtFnk.exe
  2⤵
  PID:7024
- C:\Windows\System\VYhXuNM.exe
  C:\Windows\System\VYhXuNM.exe
  2⤵
  PID:7040
- C:\Windows\System\mCRgUmU.exe
  C:\Windows\System\mCRgUmU.exe
  2⤵
  PID:7056
- C:\Windows\System\geAnxQx.exe
  C:\Windows\System\geAnxQx.exe
  2⤵
  PID:7072
- C:\Windows\System\BJaLDdi.exe
  C:\Windows\System\BJaLDdi.exe
  2⤵
  PID:7088
- C:\Windows\System\HHqUkOO.exe
  C:\Windows\System\HHqUkOO.exe
  2⤵
  PID:7104
- C:\Windows\System\KJJiXtc.exe
  C:\Windows\System\KJJiXtc.exe
  2⤵
  PID:7120
- C:\Windows\System\sYCCCoE.exe
  C:\Windows\System\sYCCCoE.exe
  2⤵
  PID:7136
- C:\Windows\System\IRhyOeu.exe
  C:\Windows\System\IRhyOeu.exe
  2⤵
  PID:7152
- C:\Windows\System\mVJmhPP.exe
  C:\Windows\System\mVJmhPP.exe
  2⤵
  PID:5436
- C:\Windows\System\LZuMHyF.exe
  C:\Windows\System\LZuMHyF.exe
  2⤵
  PID:988
- C:\Windows\System\aFimbGx.exe
  C:\Windows\System\aFimbGx.exe
  2⤵
  PID:5660
- C:\Windows\System\PwMioIN.exe
  C:\Windows\System\PwMioIN.exe
  2⤵
  PID:2712
- C:\Windows\System\WRGYRnf.exe
  C:\Windows\System\WRGYRnf.exe
  2⤵
  PID:6228
- C:\Windows\System\zobXHQs.exe
  C:\Windows\System\zobXHQs.exe
  2⤵
  PID:5140
- C:\Windows\System\NXWnGWa.exe
  C:\Windows\System\NXWnGWa.exe
  2⤵
  PID:3220
- C:\Windows\System\KFjWwQy.exe
  C:\Windows\System\KFjWwQy.exe
  2⤵
  PID:4120
- C:\Windows\System\kHtXgMc.exe
  C:\Windows\System\kHtXgMc.exe
  2⤵
  PID:6148
- C:\Windows\System\AxYhkap.exe
  C:\Windows\System\AxYhkap.exe
  2⤵
  PID:6216
- C:\Windows\System\FZhnGKA.exe
  C:\Windows\System\FZhnGKA.exe
  2⤵
  PID:6292
- C:\Windows\System\sahAdWW.exe
  C:\Windows\System\sahAdWW.exe
  2⤵
  PID:6360
- C:\Windows\System\UdZvSif.exe
  C:\Windows\System\UdZvSif.exe
  2⤵
  PID:6420
- C:\Windows\System\QJepsSR.exe
  C:\Windows\System\QJepsSR.exe
  2⤵
  PID:6308
- C:\Windows\System\arUpaDv.exe
  C:\Windows\System\arUpaDv.exe
  2⤵
  PID:6376
- C:\Windows\System\kURSspN.exe
  C:\Windows\System\kURSspN.exe
  2⤵
  PID:6436
- C:\Windows\System\fuTldqK.exe
  C:\Windows\System\fuTldqK.exe
  2⤵
  PID:6500
- C:\Windows\System\cpKTtwM.exe
  C:\Windows\System\cpKTtwM.exe
  2⤵
  PID:6484
- C:\Windows\System\ywssWxx.exe
  C:\Windows\System\ywssWxx.exe
  2⤵
  PID:6564
- C:\Windows\System\ilxeLNV.exe
  C:\Windows\System\ilxeLNV.exe
  2⤵
  PID:6548
- C:\Windows\System\FnKEigi.exe
  C:\Windows\System\FnKEigi.exe
  2⤵
  PID:6596
- C:\Windows\System\WJQRBpX.exe
  C:\Windows\System\WJQRBpX.exe
  2⤵
  PID:6696
- C:\Windows\System\BuDydlA.exe
  C:\Windows\System\BuDydlA.exe
  2⤵
  PID:6584
- C:\Windows\System\yNfwxJj.exe
  C:\Windows\System\yNfwxJj.exe
  2⤵
  PID:6612
- C:\Windows\System\tQFLZHm.exe
  C:\Windows\System\tQFLZHm.exe
  2⤵
  PID:6796
- C:\Windows\System\hvSCuQn.exe
  C:\Windows\System\hvSCuQn.exe
  2⤵
  PID:6616
- C:\Windows\System\eBTVFKA.exe
  C:\Windows\System\eBTVFKA.exe
  2⤵
  PID:6716
- C:\Windows\System\zGxNezT.exe
  C:\Windows\System\zGxNezT.exe
  2⤵
  PID:6780
- C:\Windows\System\pIkKQnj.exe
  C:\Windows\System\pIkKQnj.exe
  2⤵
  PID:6844
- C:\Windows\System\hOPIAqI.exe
  C:\Windows\System\hOPIAqI.exe
  2⤵
  PID:6904
- C:\Windows\System\VGdyYAI.exe
  C:\Windows\System\VGdyYAI.exe
  2⤵
  PID:6920
- C:\Windows\System\gbUwGtV.exe
  C:\Windows\System\gbUwGtV.exe
  2⤵
  PID:6984
- C:\Windows\System\mrfdUPq.exe
  C:\Windows\System\mrfdUPq.exe
  2⤵
  PID:2324
- C:\Windows\System\Gioupny.exe
  C:\Windows\System\Gioupny.exe
  2⤵
  PID:7004
- C:\Windows\System\AcOpGPZ.exe
  C:\Windows\System\AcOpGPZ.exe
  2⤵
  PID:7064
- C:\Windows\System\XcPIGXf.exe
  C:\Windows\System\XcPIGXf.exe
  2⤵
  PID:7020
- C:\Windows\System\dzAQHug.exe
  C:\Windows\System\dzAQHug.exe
  2⤵
  PID:7164
- C:\Windows\System\JHSvTvo.exe
  C:\Windows\System\JHSvTvo.exe
  2⤵
  PID:7112
- C:\Windows\System\UdvHGha.exe
  C:\Windows\System\UdvHGha.exe
  2⤵
  PID:7084
- C:\Windows\System\cCaMemh.exe
  C:\Windows\System\cCaMemh.exe
  2⤵
  PID:1200
- C:\Windows\System\XmoJMYU.exe
  C:\Windows\System\XmoJMYU.exe
  2⤵
  PID:6296
- C:\Windows\System\NQRbcvU.exe
  C:\Windows\System\NQRbcvU.exe
  2⤵
  PID:6344
- C:\Windows\System\zRvreRm.exe
  C:\Windows\System\zRvreRm.exe
  2⤵
  PID:6164
- C:\Windows\System\FOJSdIH.exe
  C:\Windows\System\FOJSdIH.exe
  2⤵
  PID:6280
- C:\Windows\System\LHbfNTe.exe
  C:\Windows\System\LHbfNTe.exe
  2⤵
  PID:6664
- C:\Windows\System\tdaGZpC.exe
  C:\Windows\System\tdaGZpC.exe
  2⤵
  PID:4200
- C:\Windows\System\AmuniXd.exe
  C:\Windows\System\AmuniXd.exe
  2⤵
  PID:6628
- C:\Windows\System\CbPkcRV.exe
  C:\Windows\System\CbPkcRV.exe
  2⤵
  PID:6356
- C:\Windows\System\onWWRkS.exe
  C:\Windows\System\onWWRkS.exe
  2⤵
  PID:6652
- C:\Windows\System\LscIfvC.exe
  C:\Windows\System\LscIfvC.exe
  2⤵
  PID:6840
- C:\Windows\System\BihuZaU.exe
  C:\Windows\System\BihuZaU.exe
  2⤵
  PID:6888
- C:\Windows\System\ZLdPJuI.exe
  C:\Windows\System\ZLdPJuI.exe
  2⤵
  PID:7016
- C:\Windows\System\hSjfyJS.exe
  C:\Windows\System\hSjfyJS.exe
  2⤵
  PID:7160
- C:\Windows\System\eIZJwHI.exe
  C:\Windows\System\eIZJwHI.exe
  2⤵
  PID:6248
- C:\Windows\System\wdNhDcd.exe
  C:\Windows\System\wdNhDcd.exe
  2⤵
  PID:6748
- C:\Windows\System\FvPSSxl.exe
  C:\Windows\System\FvPSSxl.exe
  2⤵
  PID:6876
- C:\Windows\System\qyvHUif.exe
  C:\Windows\System\qyvHUif.exe
  2⤵
  PID:6828
- C:\Windows\System\LgSfoUA.exe
  C:\Windows\System\LgSfoUA.exe
  2⤵
  PID:7000
- C:\Windows\System\AAbmgoK.exe
  C:\Windows\System\AAbmgoK.exe
  2⤵
  PID:2564
- C:\Windows\System\VnXifyN.exe
  C:\Windows\System\VnXifyN.exe
  2⤵
  PID:6340
- C:\Windows\System\cRBeXPs.exe
  C:\Windows\System\cRBeXPs.exe
  2⤵
  PID:1480
- C:\Windows\System\TTQNsLJ.exe
  C:\Windows\System\TTQNsLJ.exe
  2⤵
  PID:6264
- C:\Windows\System\BpjHIDi.exe
  C:\Windows\System\BpjHIDi.exe
  2⤵
  PID:6712
- C:\Windows\System\VnNMPPE.exe
  C:\Windows\System\VnNMPPE.exe
  2⤵
  PID:7080
- C:\Windows\System\SySDhnI.exe
  C:\Windows\System\SySDhnI.exe
  2⤵
  PID:6936
- C:\Windows\System\jajqXvv.exe
  C:\Windows\System\jajqXvv.exe
  2⤵
  PID:7036
- C:\Windows\System\jbPTcCJ.exe
  C:\Windows\System\jbPTcCJ.exe
  2⤵
  PID:7100
- C:\Windows\System\nVuLGfX.exe
  C:\Windows\System\nVuLGfX.exe
  2⤵
  PID:6516
- C:\Windows\System\VrHdbPB.exe
  C:\Windows\System\VrHdbPB.exe
  2⤵
  PID:6764
- C:\Windows\System\CsThgwQ.exe
  C:\Windows\System\CsThgwQ.exe
  2⤵
  PID:6452
- C:\Windows\System\lqhJueF.exe
  C:\Windows\System\lqhJueF.exe
  2⤵
  PID:6212
- C:\Windows\System\qyYshQB.exe
  C:\Windows\System\qyYshQB.exe
  2⤵
  PID:6580
- C:\Windows\System\sJPmhUv.exe
  C:\Windows\System\sJPmhUv.exe
  2⤵
  PID:6168
- C:\Windows\System\zuDbkEu.exe
  C:\Windows\System\zuDbkEu.exe
  2⤵
  PID:7176
- C:\Windows\System\LoYDXPB.exe
  C:\Windows\System\LoYDXPB.exe
  2⤵
  PID:7192
- C:\Windows\System\vxijcND.exe
  C:\Windows\System\vxijcND.exe
  2⤵
  PID:7208
- C:\Windows\System\eiFLBKM.exe
  C:\Windows\System\eiFLBKM.exe
  2⤵
  PID:7224
- C:\Windows\System\LKXOmmS.exe
  C:\Windows\System\LKXOmmS.exe
  2⤵
  PID:7240
- C:\Windows\System\IfZUmwA.exe
  C:\Windows\System\IfZUmwA.exe
  2⤵
  PID:7256
- C:\Windows\System\ICQWrSd.exe
  C:\Windows\System\ICQWrSd.exe
  2⤵
  PID:7272
- C:\Windows\System\KOfZeNm.exe
  C:\Windows\System\KOfZeNm.exe
  2⤵
  PID:7288
- C:\Windows\System\VdCywBS.exe
  C:\Windows\System\VdCywBS.exe
  2⤵
  PID:7304
- C:\Windows\System\OQgSvnS.exe
  C:\Windows\System\OQgSvnS.exe
  2⤵
  PID:7320
- C:\Windows\System\eQvoIHL.exe
  C:\Windows\System\eQvoIHL.exe
  2⤵
  PID:7336
- C:\Windows\System\vRGtOfj.exe
  C:\Windows\System\vRGtOfj.exe
  2⤵
  PID:7352
- C:\Windows\System\KalzFWb.exe
  C:\Windows\System\KalzFWb.exe
  2⤵
  PID:7376
- C:\Windows\System\ygjDedb.exe
  C:\Windows\System\ygjDedb.exe
  2⤵
  PID:7392
- C:\Windows\System\GaIFSmQ.exe
  C:\Windows\System\GaIFSmQ.exe
  2⤵
  PID:7408
- C:\Windows\System\jkVsCKt.exe
  C:\Windows\System\jkVsCKt.exe
  2⤵
  PID:7424
- C:\Windows\System\vGlwbRO.exe
  C:\Windows\System\vGlwbRO.exe
  2⤵
  PID:7440
- C:\Windows\System\CPmmsza.exe
  C:\Windows\System\CPmmsza.exe
  2⤵
  PID:7456
- C:\Windows\System\cFguxtg.exe
  C:\Windows\System\cFguxtg.exe
  2⤵
  PID:7472
- C:\Windows\System\VljhnAB.exe
  C:\Windows\System\VljhnAB.exe
  2⤵
  PID:7488
- C:\Windows\System\MnBEJjI.exe
  C:\Windows\System\MnBEJjI.exe
  2⤵
  PID:7504
- C:\Windows\System\KapgGiq.exe
  C:\Windows\System\KapgGiq.exe
  2⤵
  PID:7520
- C:\Windows\System\pZwxgcs.exe
  C:\Windows\System\pZwxgcs.exe
  2⤵
  PID:7536
- C:\Windows\System\LtAhMjB.exe
  C:\Windows\System\LtAhMjB.exe
  2⤵
  PID:7552
- C:\Windows\System\taDcNsp.exe
  C:\Windows\System\taDcNsp.exe
  2⤵
  PID:7568
- C:\Windows\System\fUOuVeo.exe
  C:\Windows\System\fUOuVeo.exe
  2⤵
  PID:7584
- C:\Windows\System\iDgylVS.exe
  C:\Windows\System\iDgylVS.exe
  2⤵
  PID:7600
- C:\Windows\System\tJqETot.exe
  C:\Windows\System\tJqETot.exe
  2⤵
  PID:7616
- C:\Windows\System\VaywNQO.exe
  C:\Windows\System\VaywNQO.exe
  2⤵
  PID:7632
- C:\Windows\System\RRQthfb.exe
  C:\Windows\System\RRQthfb.exe
  2⤵
  PID:7648
- C:\Windows\System\TRuabpb.exe
  C:\Windows\System\TRuabpb.exe
  2⤵
  PID:7664
- C:\Windows\System\NiFabkj.exe
  C:\Windows\System\NiFabkj.exe
  2⤵
  PID:7680
- C:\Windows\System\tnFkyoL.exe
  C:\Windows\System\tnFkyoL.exe
  2⤵
  PID:7696
- C:\Windows\System\cQXZZjo.exe
  C:\Windows\System\cQXZZjo.exe
  2⤵
  PID:7712
- C:\Windows\System\ebrRdYv.exe
  C:\Windows\System\ebrRdYv.exe
  2⤵
  PID:7728
- C:\Windows\System\ISTDfzA.exe
  C:\Windows\System\ISTDfzA.exe
  2⤵
  PID:7748
- C:\Windows\System\CbSTOVP.exe
  C:\Windows\System\CbSTOVP.exe
  2⤵
  PID:7764
- C:\Windows\System\aYiLaMH.exe
  C:\Windows\System\aYiLaMH.exe
  2⤵
  PID:7784
- C:\Windows\System\rserQHL.exe
  C:\Windows\System\rserQHL.exe
  2⤵
  PID:7800
- C:\Windows\System\zfqMPcP.exe
  C:\Windows\System\zfqMPcP.exe
  2⤵
  PID:7816
- C:\Windows\System\XnZpaIg.exe
  C:\Windows\System\XnZpaIg.exe
  2⤵
  PID:7836
- C:\Windows\System\CovJWcs.exe
  C:\Windows\System\CovJWcs.exe
  2⤵
  PID:7852
- C:\Windows\System\lNzffoa.exe
  C:\Windows\System\lNzffoa.exe
  2⤵
  PID:7868
- C:\Windows\System\wtFsMSd.exe
  C:\Windows\System\wtFsMSd.exe
  2⤵
  PID:7884
- C:\Windows\System\LYGNdNl.exe
  C:\Windows\System\LYGNdNl.exe
  2⤵
  PID:7900
- C:\Windows\System\bsPlGuz.exe
  C:\Windows\System\bsPlGuz.exe
  2⤵
  PID:7916
- C:\Windows\System\oWvQBZa.exe
  C:\Windows\System\oWvQBZa.exe
  2⤵
  PID:7936
- C:\Windows\System\mwShsrX.exe
  C:\Windows\System\mwShsrX.exe
  2⤵
  PID:7952
- C:\Windows\System\CoqEYCp.exe
  C:\Windows\System\CoqEYCp.exe
  2⤵
  PID:7968
- C:\Windows\System\QRuuAGG.exe
  C:\Windows\System\QRuuAGG.exe
  2⤵
  PID:7984
- C:\Windows\System\fLHrUWl.exe
  C:\Windows\System\fLHrUWl.exe
  2⤵
  PID:8000
- C:\Windows\System\MIPemEy.exe
  C:\Windows\System\MIPemEy.exe
  2⤵
  PID:8016
- C:\Windows\System\caZJvfd.exe
  C:\Windows\System\caZJvfd.exe
  2⤵
  PID:8032
- C:\Windows\System\Bgnbxwd.exe
  C:\Windows\System\Bgnbxwd.exe
  2⤵
  PID:8048
- C:\Windows\System\WVieqPt.exe
  C:\Windows\System\WVieqPt.exe
  2⤵
  PID:8064
- C:\Windows\System\XLXRGIV.exe
  C:\Windows\System\XLXRGIV.exe
  2⤵
  PID:8080
- C:\Windows\System\NBGBHFD.exe
  C:\Windows\System\NBGBHFD.exe
  2⤵
  PID:8096
- C:\Windows\System\dxOVfkM.exe
  C:\Windows\System\dxOVfkM.exe
  2⤵
  PID:8112
- C:\Windows\System\dnHONej.exe
  C:\Windows\System\dnHONej.exe
  2⤵
  PID:8128
- C:\Windows\System\SmbcJkV.exe
  C:\Windows\System\SmbcJkV.exe
  2⤵
  PID:8144
- C:\Windows\System\tPwYbJs.exe
  C:\Windows\System\tPwYbJs.exe
  2⤵
  PID:8160
- C:\Windows\System\GnzKziB.exe
  C:\Windows\System\GnzKziB.exe
  2⤵
  PID:8176
- C:\Windows\System\OjzXFKb.exe
  C:\Windows\System\OjzXFKb.exe
  2⤵
  PID:6792
- C:\Windows\System\xqGbYfg.exe
  C:\Windows\System\xqGbYfg.exe
  2⤵
  PID:6856
- C:\Windows\System\fKYLkCv.exe
  C:\Windows\System\fKYLkCv.exe
  2⤵
  PID:7172
- C:\Windows\System\cudbDKx.exe
  C:\Windows\System\cudbDKx.exe
  2⤵
  PID:7204
- C:\Windows\System\FuOUaaR.exe
  C:\Windows\System\FuOUaaR.exe
  2⤵
  PID:7216
- C:\Windows\System\SXQJTSS.exe
  C:\Windows\System\SXQJTSS.exe
  2⤵
  PID:7296
- C:\Windows\System\CKqHlFr.exe
  C:\Windows\System\CKqHlFr.exe
  2⤵
  PID:7248
- C:\Windows\System\hxyZrJa.exe
  C:\Windows\System\hxyZrJa.exe
  2⤵
  PID:7312
- C:\Windows\System\JPovAJo.exe
  C:\Windows\System\JPovAJo.exe
  2⤵
  PID:7384
- C:\Windows\System\KGTZZpY.exe
  C:\Windows\System\KGTZZpY.exe
  2⤵
  PID:7360
- C:\Windows\System\MSusDtZ.exe
  C:\Windows\System\MSusDtZ.exe
  2⤵
  PID:7404
- C:\Windows\System\xkeJCoB.exe
  C:\Windows\System\xkeJCoB.exe
  2⤵
  PID:7468
- C:\Windows\System\lhZAJoS.exe
  C:\Windows\System\lhZAJoS.exe
  2⤵
  PID:7496
- C:\Windows\System\ciqNuZx.exe
  C:\Windows\System\ciqNuZx.exe
  2⤵
  PID:7512
- C:\Windows\System\bHQvjQP.exe
  C:\Windows\System\bHQvjQP.exe
  2⤵
  PID:7500
- C:\Windows\System\VRGjmdU.exe
  C:\Windows\System\VRGjmdU.exe
  2⤵
  PID:7528
- C:\Windows\System\PODrkgh.exe
  C:\Windows\System\PODrkgh.exe
  2⤵
  PID:7612
- C:\Windows\System\hwnCZuI.exe
  C:\Windows\System\hwnCZuI.exe
  2⤵
  PID:7640
- C:\Windows\System\IaTcBph.exe
  C:\Windows\System\IaTcBph.exe
  2⤵
  PID:7676
- C:\Windows\System\ykOdmVY.exe
  C:\Windows\System\ykOdmVY.exe
  2⤵
  PID:7704
- C:\Windows\System\PNBvfLf.exe
  C:\Windows\System\PNBvfLf.exe
  2⤵
  PID:7772
- C:\Windows\System\gDoDSMw.exe
  C:\Windows\System\gDoDSMw.exe
  2⤵
  PID:7812
- C:\Windows\System\THEpriQ.exe
  C:\Windows\System\THEpriQ.exe
  2⤵
  PID:7848
- C:\Windows\System\JAcVXQS.exe
  C:\Windows\System\JAcVXQS.exe
  2⤵
  PID:7880
- C:\Windows\System\aPCalgr.exe
  C:\Windows\System\aPCalgr.exe
  2⤵
  PID:7796
- C:\Windows\System\bxmZTps.exe
  C:\Windows\System\bxmZTps.exe
  2⤵
  PID:7828
- C:\Windows\System\ezyRpdB.exe
  C:\Windows\System\ezyRpdB.exe
  2⤵
  PID:7896
- C:\Windows\System\vYIwDnr.exe
  C:\Windows\System\vYIwDnr.exe
  2⤵
  PID:7944
- C:\Windows\System\sQhGnoG.exe
  C:\Windows\System\sQhGnoG.exe
  2⤵
  PID:7960
- C:\Windows\System\rZQbvOj.exe
  C:\Windows\System\rZQbvOj.exe
  2⤵
  PID:7996
- C:\Windows\System\gSgVdOf.exe
  C:\Windows\System\gSgVdOf.exe
  2⤵
  PID:8024
- C:\Windows\System\QvvqUZO.exe
  C:\Windows\System\QvvqUZO.exe
  2⤵
  PID:8076
- C:\Windows\System\pvTVCiU.exe
  C:\Windows\System\pvTVCiU.exe
  2⤵
  PID:8140
- C:\Windows\System\XefjdNY.exe
  C:\Windows\System\XefjdNY.exe
  2⤵
  PID:8120
- C:\Windows\System\SnNPYHH.exe
  C:\Windows\System\SnNPYHH.exe
  2⤵
  PID:8188
- C:\Windows\System\SbtjWfW.exe
  C:\Windows\System\SbtjWfW.exe
  2⤵
  PID:8156
- C:\Windows\System\EtdOmAf.exe
  C:\Windows\System\EtdOmAf.exe
  2⤵
  PID:7264
- C:\Windows\System\jOZLhea.exe
  C:\Windows\System\jOZLhea.exe
  2⤵
  PID:7284
- C:\Windows\System\HJzAxOH.exe
  C:\Windows\System\HJzAxOH.exe
  2⤵
  PID:7344
- C:\Windows\System\FoOanlN.exe
  C:\Windows\System\FoOanlN.exe
  2⤵
  PID:7348
- C:\Windows\System\vBXiuXj.exe
  C:\Windows\System\vBXiuXj.exe
  2⤵
  PID:7464
- C:\Windows\System\XTTncVv.exe
  C:\Windows\System\XTTncVv.exe
  2⤵
  PID:7420
- C:\Windows\System\IHojxkr.exe
  C:\Windows\System\IHojxkr.exe
  2⤵
  PID:7560
- C:\Windows\System\sWTwAfM.exe
  C:\Windows\System\sWTwAfM.exe
  2⤵
  PID:7596
- C:\Windows\System\DZodoRe.exe
  C:\Windows\System\DZodoRe.exe
  2⤵
  PID:7692
- C:\Windows\System\KSezaiK.exe
  C:\Windows\System\KSezaiK.exe
  2⤵
  PID:7720
- C:\Windows\System\rVxrIgn.exe
  C:\Windows\System\rVxrIgn.exe
  2⤵
  PID:7824
- C:\Windows\System\TlUksQa.exe
  C:\Windows\System\TlUksQa.exe
  2⤵
  PID:7672
- C:\Windows\System\OcwqmGm.exe
  C:\Windows\System\OcwqmGm.exe
  2⤵
  PID:7912
- C:\Windows\System\qZGTaHV.exe
  C:\Windows\System\qZGTaHV.exe
  2⤵
  PID:7948
- C:\Windows\System\HxyMoEb.exe
  C:\Windows\System\HxyMoEb.exe
  2⤵
  PID:7980
- C:\Windows\System\ETvbCth.exe
  C:\Windows\System\ETvbCth.exe
  2⤵
  PID:8172
- C:\Windows\System\fcWKIFy.exe
  C:\Windows\System\fcWKIFy.exe
  2⤵
  PID:8152
- C:\Windows\System\GtkBiMG.exe
  C:\Windows\System\GtkBiMG.exe
  2⤵
  PID:8184
- C:\Windows\System\twmugEQ.exe
  C:\Windows\System\twmugEQ.exe
  2⤵
  PID:7480
- C:\Windows\System\zhRxvut.exe
  C:\Windows\System\zhRxvut.exe
  2⤵
  PID:7200
- C:\Windows\System\wbQqMEV.exe
  C:\Windows\System\wbQqMEV.exe
  2⤵
  PID:7436
- C:\Windows\System\kMOAGvl.exe
  C:\Windows\System\kMOAGvl.exe
  2⤵
  PID:7388
- C:\Windows\System\hlMsnmT.exe
  C:\Windows\System\hlMsnmT.exe
  2⤵
  PID:7624
- C:\Windows\System\qPCUsoa.exe
  C:\Windows\System\qPCUsoa.exe
  2⤵
  PID:7992
- C:\Windows\System\ujWwXAP.exe
  C:\Windows\System\ujWwXAP.exe
  2⤵
  PID:6392
- C:\Windows\System\RexeUQh.exe
  C:\Windows\System\RexeUQh.exe
  2⤵
  PID:6632
- C:\Windows\System\hqKfvkX.exe
  C:\Windows\System\hqKfvkX.exe
  2⤵
  PID:7580
- C:\Windows\System\muoiUuL.exe
  C:\Windows\System\muoiUuL.exe
  2⤵
  PID:8204
- C:\Windows\System\vPaqziY.exe
  C:\Windows\System\vPaqziY.exe
  2⤵
  PID:8220
- C:\Windows\System\hIHUwOh.exe
  C:\Windows\System\hIHUwOh.exe
  2⤵
  PID:8236
- C:\Windows\System\WyxtrUC.exe
  C:\Windows\System\WyxtrUC.exe
  2⤵
  PID:8252
- C:\Windows\System\ZZDEVrw.exe
  C:\Windows\System\ZZDEVrw.exe
  2⤵
  PID:8268
- C:\Windows\System\gRRBtEA.exe
  C:\Windows\System\gRRBtEA.exe
  2⤵
  PID:8284
- C:\Windows\System\gbiKtlV.exe
  C:\Windows\System\gbiKtlV.exe
  2⤵
  PID:8300
- C:\Windows\System\Zeyhncz.exe
  C:\Windows\System\Zeyhncz.exe
  2⤵
  PID:8316
- C:\Windows\System\HEBJjhx.exe
  C:\Windows\System\HEBJjhx.exe
  2⤵
  PID:8332
- C:\Windows\System\BcekTJq.exe
  C:\Windows\System\BcekTJq.exe
  2⤵
  PID:8348
- C:\Windows\System\daJKfkS.exe
  C:\Windows\System\daJKfkS.exe
  2⤵
  PID:8364
- C:\Windows\System\JdewqVQ.exe
  C:\Windows\System\JdewqVQ.exe
  2⤵
  PID:8380
- C:\Windows\System\Vbghgmc.exe
  C:\Windows\System\Vbghgmc.exe
  2⤵
  PID:8396
- C:\Windows\System\CzeAriS.exe
  C:\Windows\System\CzeAriS.exe
  2⤵
  PID:8412
- C:\Windows\System\nMcoqjc.exe
  C:\Windows\System\nMcoqjc.exe
  2⤵
  PID:8428
- C:\Windows\System\LPDSkhF.exe
  C:\Windows\System\LPDSkhF.exe
  2⤵
  PID:8444
- C:\Windows\System\fzNGbdt.exe
  C:\Windows\System\fzNGbdt.exe
  2⤵
  PID:8460
- C:\Windows\System\bOmJxQs.exe
  C:\Windows\System\bOmJxQs.exe
  2⤵
  PID:8476
- C:\Windows\System\Qvawjpy.exe
  C:\Windows\System\Qvawjpy.exe
  2⤵
  PID:8492
- C:\Windows\System\qsfAHkG.exe
  C:\Windows\System\qsfAHkG.exe
  2⤵
  PID:8508
- C:\Windows\System\bhvEhZt.exe
  C:\Windows\System\bhvEhZt.exe
  2⤵
  PID:8524
- C:\Windows\System\EcWCGYy.exe
  C:\Windows\System\EcWCGYy.exe
  2⤵
  PID:8540
- C:\Windows\System\xzNXukp.exe
  C:\Windows\System\xzNXukp.exe
  2⤵
  PID:8556
- C:\Windows\System\CPwODKS.exe
  C:\Windows\System\CPwODKS.exe
  2⤵
  PID:8572
- C:\Windows\System\yDCxRpm.exe
  C:\Windows\System\yDCxRpm.exe
  2⤵
  PID:8588
- C:\Windows\System\fttfrqF.exe
  C:\Windows\System\fttfrqF.exe
  2⤵
  PID:8604
- C:\Windows\System\kGdqIJt.exe
  C:\Windows\System\kGdqIJt.exe
  2⤵
  PID:8620
- C:\Windows\System\GGQRpqe.exe
  C:\Windows\System\GGQRpqe.exe
  2⤵
  PID:8636
- C:\Windows\System\XrGHHdY.exe
  C:\Windows\System\XrGHHdY.exe
  2⤵
  PID:8652
- C:\Windows\System\PPEFVCT.exe
  C:\Windows\System\PPEFVCT.exe
  2⤵
  PID:8668
- C:\Windows\System\cCAcvoH.exe
  C:\Windows\System\cCAcvoH.exe
  2⤵
  PID:8684
- C:\Windows\System\MNuTbNP.exe
  C:\Windows\System\MNuTbNP.exe
  2⤵
  PID:8700
- C:\Windows\System\NnhBHqq.exe
  C:\Windows\System\NnhBHqq.exe
  2⤵
  PID:8716
- C:\Windows\System\cZRNPtp.exe
  C:\Windows\System\cZRNPtp.exe
  2⤵
  PID:8732
- C:\Windows\System\yJKQRzN.exe
  C:\Windows\System\yJKQRzN.exe
  2⤵
  PID:8748
- C:\Windows\System\iInlKzY.exe
  C:\Windows\System\iInlKzY.exe
  2⤵
  PID:8764
- C:\Windows\System\TpXOVoC.exe
  C:\Windows\System\TpXOVoC.exe
  2⤵
  PID:8780
- C:\Windows\System\NclpvnJ.exe
  C:\Windows\System\NclpvnJ.exe
  2⤵
  PID:8796
- C:\Windows\System\RJvRctq.exe
  C:\Windows\System\RJvRctq.exe
  2⤵
  PID:8812
- C:\Windows\System\kvGyioz.exe
  C:\Windows\System\kvGyioz.exe
  2⤵
  PID:8832
- C:\Windows\System\bqdHsVF.exe
  C:\Windows\System\bqdHsVF.exe
  2⤵
  PID:8848
- C:\Windows\System\XyNuCwb.exe
  C:\Windows\System\XyNuCwb.exe
  2⤵
  PID:8864
- C:\Windows\System\eyOaOtW.exe
  C:\Windows\System\eyOaOtW.exe
  2⤵
  PID:8880
- C:\Windows\System\sAnNBAg.exe
  C:\Windows\System\sAnNBAg.exe
  2⤵
  PID:8896
- C:\Windows\System\ZLoAdsq.exe
  C:\Windows\System\ZLoAdsq.exe
  2⤵
  PID:8912
- C:\Windows\System\ziRxVWG.exe
  C:\Windows\System\ziRxVWG.exe
  2⤵
  PID:8928
- C:\Windows\System\uhKBsJr.exe
  C:\Windows\System\uhKBsJr.exe
  2⤵
  PID:8944
- C:\Windows\System\zlNNKlH.exe
  C:\Windows\System\zlNNKlH.exe
  2⤵
  PID:8960
- C:\Windows\System\OcRqvGe.exe
  C:\Windows\System\OcRqvGe.exe
  2⤵
  PID:8976
- C:\Windows\System\FuWwGsa.exe
  C:\Windows\System\FuWwGsa.exe
  2⤵
  PID:8992
- C:\Windows\System\zCbKLgG.exe
  C:\Windows\System\zCbKLgG.exe
  2⤵
  PID:9008
- C:\Windows\System\bgILwpy.exe
  C:\Windows\System\bgILwpy.exe
  2⤵
  PID:9024
- C:\Windows\System\FcwQDaX.exe
  C:\Windows\System\FcwQDaX.exe
  2⤵
  PID:9044
- C:\Windows\System\pnZspIs.exe
  C:\Windows\System\pnZspIs.exe
  2⤵
  PID:9076
- C:\Windows\System\iMoDhED.exe
  C:\Windows\System\iMoDhED.exe
  2⤵
  PID:9092
- C:\Windows\System\KhNLYLr.exe
  C:\Windows\System\KhNLYLr.exe
  2⤵
  PID:9108
- C:\Windows\System\rvbKtXO.exe
  C:\Windows\System\rvbKtXO.exe
  2⤵
  PID:9124
- C:\Windows\System\tFDajrN.exe
  C:\Windows\System\tFDajrN.exe
  2⤵
  PID:9140
- C:\Windows\System\UsdcMYY.exe
  C:\Windows\System\UsdcMYY.exe
  2⤵
  PID:9156
- C:\Windows\System\QDWZomt.exe
  C:\Windows\System\QDWZomt.exe
  2⤵
  PID:9172
- C:\Windows\System\QQDzPNj.exe
  C:\Windows\System\QQDzPNj.exe
  2⤵
  PID:9200
- C:\Windows\System\wIWImSJ.exe
  C:\Windows\System\wIWImSJ.exe
  2⤵
  PID:8200
- C:\Windows\System\fgnfKzX.exe
  C:\Windows\System\fgnfKzX.exe
  2⤵
  PID:8264
- C:\Windows\System\YxFImNh.exe
  C:\Windows\System\YxFImNh.exe
  2⤵
  PID:8324
- C:\Windows\System\dSsthdV.exe
  C:\Windows\System\dSsthdV.exe
  2⤵
  PID:8388
- C:\Windows\System\XGLmvvw.exe
  C:\Windows\System\XGLmvvw.exe
  2⤵
  PID:8452
- C:\Windows\System\yRAGTce.exe
  C:\Windows\System\yRAGTce.exe
  2⤵
  PID:7844
- C:\Windows\System\XFuqwRl.exe
  C:\Windows\System\XFuqwRl.exe
  2⤵
  PID:8124
- C:\Windows\System\zPCiZRm.exe
  C:\Windows\System\zPCiZRm.exe
  2⤵
  PID:7760
- C:\Windows\System\OGzEchB.exe
  C:\Windows\System\OGzEchB.exe
  2⤵
  PID:7908
- C:\Windows\System\tUXFcYh.exe
  C:\Windows\System\tUXFcYh.exe
  2⤵
  PID:8216
- C:\Windows\System\xtzoTuy.exe
  C:\Windows\System\xtzoTuy.exe
  2⤵
  PID:8280
- C:\Windows\System\MwkAAxe.exe
  C:\Windows\System\MwkAAxe.exe
  2⤵
  PID:8344
- C:\Windows\System\JwoegMz.exe
  C:\Windows\System\JwoegMz.exe
  2⤵
  PID:8488
- C:\Windows\System\xVcEaoj.exe
  C:\Windows\System\xVcEaoj.exe
  2⤵
  PID:8516
- C:\Windows\System\YpcTFYt.exe
  C:\Windows\System\YpcTFYt.exe
  2⤵
  PID:8552
- C:\Windows\System\lODNbli.exe
  C:\Windows\System\lODNbli.exe
  2⤵
  PID:8612
- C:\Windows\System\ibVCIaD.exe
  C:\Windows\System\ibVCIaD.exe
  2⤵
  PID:8536
- C:\Windows\System\APSinFU.exe
  C:\Windows\System\APSinFU.exe
  2⤵
  PID:8600
- C:\Windows\System\oynDOrX.exe
  C:\Windows\System\oynDOrX.exe
  2⤵
  PID:8676
- C:\Windows\System\rqDTVoo.exe
  C:\Windows\System\rqDTVoo.exe
  2⤵
  PID:8696
- C:\Windows\System\sWvMzuf.exe
  C:\Windows\System\sWvMzuf.exe
  2⤵
  PID:8728
- C:\Windows\System\qaGjORL.exe
  C:\Windows\System\qaGjORL.exe
  2⤵
  PID:8776
- C:\Windows\System\XAvpVrI.exe
  C:\Windows\System\XAvpVrI.exe
  2⤵
  PID:8872
- C:\Windows\System\bOafvSx.exe
  C:\Windows\System\bOafvSx.exe
  2⤵
  PID:8936
- C:\Windows\System\szCHxhH.exe
  C:\Windows\System\szCHxhH.exe
  2⤵
  PID:9000
- C:\Windows\System\glZShom.exe
  C:\Windows\System\glZShom.exe
  2⤵
  PID:9036
- C:\Windows\System\NaxLGEA.exe
  C:\Windows\System\NaxLGEA.exe
  2⤵
  PID:8828
- C:\Windows\System\FMEPrKY.exe
  C:\Windows\System\FMEPrKY.exe
  2⤵
  PID:8924
- C:\Windows\System\NewqUuq.exe
  C:\Windows\System\NewqUuq.exe
  2⤵
  PID:9148
- C:\Windows\System\dCysPmq.exe
  C:\Windows\System\dCysPmq.exe
  2⤵
  PID:8920
- C:\Windows\System\bfZfqvk.exe
  C:\Windows\System\bfZfqvk.exe
  2⤵
  PID:8756
- C:\Windows\System\ueavmxt.exe
  C:\Windows\System\ueavmxt.exe
  2⤵
  PID:9184
- C:\Windows\System\RbfPMEC.exe
  C:\Windows\System\RbfPMEC.exe
  2⤵
  PID:9188
- C:\Windows\System\eBAcoFv.exe
  C:\Windows\System\eBAcoFv.exe
  2⤵
  PID:9068
- C:\Windows\System\HrKhvbz.exe
  C:\Windows\System\HrKhvbz.exe
  2⤵
  PID:9164
- C:\Windows\System\UjHDerf.exe
  C:\Windows\System\UjHDerf.exe
  2⤵
  PID:8260
- C:\Windows\System\OiExmko.exe
  C:\Windows\System\OiExmko.exe
  2⤵
  PID:7452
- C:\Windows\System\swiuXkY.exe
  C:\Windows\System\swiuXkY.exe
  2⤵
  PID:8312
- C:\Windows\System\QMFhsyS.exe
  C:\Windows\System\QMFhsyS.exe
  2⤵
  PID:8580
- C:\Windows\System\hODaeLO.exe
  C:\Windows\System\hODaeLO.exe
  2⤵
  PID:8680
- C:\Windows\System\kJdYoOs.exe
  C:\Windows\System\kJdYoOs.exe
  2⤵
  PID:8248
- C:\Windows\System\kVnxiED.exe
  C:\Windows\System\kVnxiED.exe
  2⤵
  PID:9208
- C:\Windows\System\qcZFdpe.exe
  C:\Windows\System\qcZFdpe.exe
  2⤵
  PID:8808
- C:\Windows\System\eyEjtpy.exe
  C:\Windows\System\eyEjtpy.exe
  2⤵
  PID:8424
- C:\Windows\System\LSgKQfq.exe
  C:\Windows\System\LSgKQfq.exe
  2⤵
  PID:8844
- C:\Windows\System\SpRCrZw.exe
  C:\Windows\System\SpRCrZw.exe
  2⤵
  PID:8408
- C:\Windows\System\anVpAfd.exe
  C:\Windows\System\anVpAfd.exe
  2⤵
  PID:8568
- C:\Windows\System\DwiEger.exe
  C:\Windows\System\DwiEger.exe
  2⤵
  PID:9212
- C:\Windows\System\SYkZznU.exe
  C:\Windows\System\SYkZznU.exe
  2⤵
  PID:8660
- C:\Windows\System\sKpaWtu.exe
  C:\Windows\System\sKpaWtu.exe
  2⤵
  PID:8972
- C:\Windows\System\YAyzNAu.exe
  C:\Windows\System\YAyzNAu.exe
  2⤵
  PID:8860
- C:\Windows\System\mkAXbHT.exe
  C:\Windows\System\mkAXbHT.exe
  2⤵
  PID:8984
- C:\Windows\System\IjeoMto.exe
  C:\Windows\System\IjeoMto.exe
  2⤵
  PID:9016
- C:\Windows\System\PDpVxrT.exe
  C:\Windows\System\PDpVxrT.exe
  2⤵
  PID:8232
- C:\Windows\System\xZhowuv.exe
  C:\Windows\System\xZhowuv.exe
  2⤵
  PID:8908
- C:\Windows\System\WUzaqIJ.exe
  C:\Windows\System\WUzaqIJ.exe
  2⤵
  PID:8276
- C:\Windows\System\hkuNifL.exe
  C:\Windows\System\hkuNifL.exe
  2⤵
  PID:8744
- C:\Windows\System\UADHtvB.exe
  C:\Windows\System\UADHtvB.exe
  2⤵
  PID:7736
- C:\Windows\System\cGplFsM.exe
  C:\Windows\System\cGplFsM.exe
  2⤵
  PID:8468
- C:\Windows\System\efURjUc.exe
  C:\Windows\System\efURjUc.exe
  2⤵
  PID:8740
- C:\Windows\System\mKsGRPz.exe
  C:\Windows\System\mKsGRPz.exe
  2⤵
  PID:9116
- C:\Windows\System\dkCUkeW.exe
  C:\Windows\System\dkCUkeW.exe
  2⤵
  PID:8648
- C:\Windows\System\YbKRUHM.exe
  C:\Windows\System\YbKRUHM.exe
  2⤵
  PID:8892
- C:\Windows\System\OVSrwYr.exe
  C:\Windows\System\OVSrwYr.exe
  2⤵
  PID:8420
- C:\Windows\System\hnALsbI.exe
  C:\Windows\System\hnALsbI.exe
  2⤵
  PID:8484
- C:\Windows\System\Wwsnoya.exe
  C:\Windows\System\Wwsnoya.exe
  2⤵
  PID:8532
- C:\Windows\System\UkhUETG.exe
  C:\Windows\System\UkhUETG.exe
  2⤵
  PID:9132
- C:\Windows\System\RMnOmMV.exe
  C:\Windows\System\RMnOmMV.exe
  2⤵
  PID:8092
- C:\Windows\System\kGsSSaj.exe
  C:\Windows\System\kGsSSaj.exe
  2⤵
  PID:8772
- C:\Windows\System\SNrBVbF.exe
  C:\Windows\System\SNrBVbF.exe
  2⤵
  PID:9224
- C:\Windows\System\eJRioay.exe
  C:\Windows\System\eJRioay.exe
  2⤵
  PID:9244
- C:\Windows\System\pkaMIUT.exe
  C:\Windows\System\pkaMIUT.exe
  2⤵
  PID:9264
- C:\Windows\System\KwIFbeK.exe
  C:\Windows\System\KwIFbeK.exe
  2⤵
  PID:9280
- C:\Windows\System\PzjzfCH.exe
  C:\Windows\System\PzjzfCH.exe
  2⤵
  PID:9300
- C:\Windows\System\wwJTRtB.exe
  C:\Windows\System\wwJTRtB.exe
  2⤵
  PID:9316
- C:\Windows\System\TqBZVdX.exe
  C:\Windows\System\TqBZVdX.exe
  2⤵
  PID:9332
- C:\Windows\System\mkktbLH.exe
  C:\Windows\System\mkktbLH.exe
  2⤵
  PID:9348
- C:\Windows\System\dvAeIpa.exe
  C:\Windows\System\dvAeIpa.exe
  2⤵
  PID:9368
- C:\Windows\System\FvhAJnk.exe
  C:\Windows\System\FvhAJnk.exe
  2⤵
  PID:9384
- C:\Windows\System\pBkGBGK.exe
  C:\Windows\System\pBkGBGK.exe
  2⤵
  PID:9400
- C:\Windows\System\XdkCqPh.exe
  C:\Windows\System\XdkCqPh.exe
  2⤵
  PID:9416
- C:\Windows\System\rgPGnSt.exe
  C:\Windows\System\rgPGnSt.exe
  2⤵
  PID:9436
- C:\Windows\System\lCxbDyc.exe
  C:\Windows\System\lCxbDyc.exe
  2⤵
  PID:9452
- C:\Windows\System\AfMaarw.exe
  C:\Windows\System\AfMaarw.exe
  2⤵
  PID:9468
- C:\Windows\System\UVRnwJJ.exe
  C:\Windows\System\UVRnwJJ.exe
  2⤵
  PID:9488
- C:\Windows\System\hRvzYmf.exe
  C:\Windows\System\hRvzYmf.exe
  2⤵
  PID:9504
- C:\Windows\System\tayqfqT.exe
  C:\Windows\System\tayqfqT.exe
  2⤵
  PID:9520
- C:\Windows\System\AChQzqA.exe
  C:\Windows\System\AChQzqA.exe
  2⤵
  PID:9536
- C:\Windows\System\RFtzMec.exe
  C:\Windows\System\RFtzMec.exe
  2⤵
  PID:9552
- C:\Windows\System\FcgvRjN.exe
  C:\Windows\System\FcgvRjN.exe
  2⤵
  PID:9568
- C:\Windows\System\tNolmTR.exe
  C:\Windows\System\tNolmTR.exe
  2⤵
  PID:9588
- C:\Windows\System\mncspfb.exe
  C:\Windows\System\mncspfb.exe
  2⤵
  PID:9608
- C:\Windows\System\CftYfLi.exe
  C:\Windows\System\CftYfLi.exe
  2⤵
  PID:9624
- C:\Windows\System\KWHPEtR.exe
  C:\Windows\System\KWHPEtR.exe
  2⤵
  PID:9640
- C:\Windows\System\LKBQmjc.exe
  C:\Windows\System\LKBQmjc.exe
  2⤵
  PID:9660
- C:\Windows\System\iUbbenV.exe
  C:\Windows\System\iUbbenV.exe
  2⤵
  PID:9676
- C:\Windows\System\ZdUPjNR.exe
  C:\Windows\System\ZdUPjNR.exe
  2⤵
  PID:9692
- C:\Windows\System\HeWjkSB.exe
  C:\Windows\System\HeWjkSB.exe
  2⤵
  PID:9708
- C:\Windows\System\PazYZmS.exe
  C:\Windows\System\PazYZmS.exe
  2⤵
  PID:9728
- C:\Windows\System\CiQXJsm.exe
  C:\Windows\System\CiQXJsm.exe
  2⤵
  PID:9748
- C:\Windows\System\RcgaXWj.exe
  C:\Windows\System\RcgaXWj.exe
  2⤵
  PID:9764
- C:\Windows\System\zKrtTeD.exe
  C:\Windows\System\zKrtTeD.exe
  2⤵
  PID:9780
- C:\Windows\System\plGgWZp.exe
  C:\Windows\System\plGgWZp.exe
  2⤵
  PID:9796
- C:\Windows\System\yQzOywR.exe
  C:\Windows\System\yQzOywR.exe
  2⤵
  PID:9816
- C:\Windows\System\FcwUFog.exe
  C:\Windows\System\FcwUFog.exe
  2⤵
  PID:9848
- C:\Windows\System\OuTlxOV.exe
  C:\Windows\System\OuTlxOV.exe
  2⤵
  PID:9864
- C:\Windows\System\zFahiXY.exe
  C:\Windows\System\zFahiXY.exe
  2⤵
  PID:9880
- C:\Windows\System\cHtFqtk.exe
  C:\Windows\System\cHtFqtk.exe
  2⤵
  PID:9904
- C:\Windows\System\YisrFsr.exe
  C:\Windows\System\YisrFsr.exe
  2⤵
  PID:9924
- C:\Windows\System\qAKPBMO.exe
  C:\Windows\System\qAKPBMO.exe
  2⤵
  PID:9940
- C:\Windows\System\HAeIkmg.exe
  C:\Windows\System\HAeIkmg.exe
  2⤵
  PID:9964
- C:\Windows\System\RoZiIWA.exe
  C:\Windows\System\RoZiIWA.exe
  2⤵
  PID:9980
- C:\Windows\System\aVvvpjX.exe
  C:\Windows\System\aVvvpjX.exe
  2⤵
  PID:9996
- C:\Windows\System\YAEVxPC.exe
  C:\Windows\System\YAEVxPC.exe
  2⤵
  PID:10012
- C:\Windows\System\RjUvjth.exe
  C:\Windows\System\RjUvjth.exe
  2⤵
  PID:10028
- C:\Windows\System\VbSWyvK.exe
  C:\Windows\System\VbSWyvK.exe
  2⤵
  PID:10044
- C:\Windows\System\qoKDozV.exe
  C:\Windows\System\qoKDozV.exe
  2⤵
  PID:10060
- C:\Windows\System\YPddKri.exe
  C:\Windows\System\YPddKri.exe
  2⤵
  PID:10076
- C:\Windows\System\EPCkkXw.exe
  C:\Windows\System\EPCkkXw.exe
  2⤵
  PID:10092
- C:\Windows\System\iYfknwZ.exe
  C:\Windows\System\iYfknwZ.exe
  2⤵
  PID:10108
- C:\Windows\System\funhTWT.exe
  C:\Windows\System\funhTWT.exe
  2⤵
  PID:10124
- C:\Windows\System\kyuGduV.exe
  C:\Windows\System\kyuGduV.exe
  2⤵
  PID:10144
- C:\Windows\System\dHKAlWx.exe
  C:\Windows\System\dHKAlWx.exe
  2⤵
  PID:10160
- C:\Windows\System\qccDBIw.exe
  C:\Windows\System\qccDBIw.exe
  2⤵
  PID:10180
- C:\Windows\System\AaNYFpN.exe
  C:\Windows\System\AaNYFpN.exe
  2⤵
  PID:10196
- C:\Windows\System\WPElXdX.exe
  C:\Windows\System\WPElXdX.exe
  2⤵
  PID:10212
- C:\Windows\System\PgybpWI.exe
  C:\Windows\System\PgybpWI.exe
  2⤵
  PID:10232
- C:\Windows\System\UdRvPAi.exe
  C:\Windows\System\UdRvPAi.exe
  2⤵
  PID:8548
- C:\Windows\System\AIlofBA.exe
  C:\Windows\System\AIlofBA.exe
  2⤵
  PID:9288
- C:\Windows\System\UWBgjZG.exe
  C:\Windows\System\UWBgjZG.exe
  2⤵
  PID:9296
- C:\Windows\System\Uaeubfy.exe
  C:\Windows\System\Uaeubfy.exe
  2⤵
  PID:9196
- C:\Windows\System\vfZGYHy.exe
  C:\Windows\System\vfZGYHy.exe
  2⤵
  PID:8968
- C:\Windows\System\RoTHqKl.exe
  C:\Windows\System\RoTHqKl.exe
  2⤵
  PID:9272
- C:\Windows\System\PqLUEIz.exe
  C:\Windows\System\PqLUEIz.exe
  2⤵
  PID:9328
- C:\Windows\System\srLoIuo.exe
  C:\Windows\System\srLoIuo.exe
  2⤵
  PID:9528
- C:\Windows\System\qdbCMig.exe
  C:\Windows\System\qdbCMig.exe
  2⤵
  PID:9548
- C:\Windows\System\gnpBaWN.exe
  C:\Windows\System\gnpBaWN.exe
  2⤵
  PID:10004
- C:\Windows\System\ITGbaYV.exe
  C:\Windows\System\ITGbaYV.exe
  2⤵
  PID:10204
- C:\Windows\System\UTYbmCi.exe
  C:\Windows\System\UTYbmCi.exe
  2⤵
  PID:10228
- C:\Windows\System\LGWFOAa.exe
  C:\Windows\System\LGWFOAa.exe
  2⤵
  PID:9232
- C:\Windows\System\usYAddK.exe
  C:\Windows\System\usYAddK.exe
  2⤵
  PID:9260
- C:\Windows\System\heJlUgG.exe
  C:\Windows\System\heJlUgG.exe
  2⤵
  PID:9424
- C:\Windows\System\sfeoomf.exe
  C:\Windows\System\sfeoomf.exe
  2⤵
  PID:9464
- C:\Windows\System\tzhkVpK.exe
  C:\Windows\System\tzhkVpK.exe
  2⤵
  PID:9560
- C:\Windows\System\GwOKYHt.exe
  C:\Windows\System\GwOKYHt.exe
  2⤵
  PID:9380
- C:\Windows\System\IXXoIaA.exe
  C:\Windows\System\IXXoIaA.exe
  2⤵
  PID:9516
- C:\Windows\System\RFDFKHc.exe
  C:\Windows\System\RFDFKHc.exe
  2⤵
  PID:9688
- C:\Windows\System\QaQZPdZ.exe
  C:\Windows\System\QaQZPdZ.exe
  2⤵
  PID:9804
- C:\Windows\System\RkgcnOa.exe
  C:\Windows\System\RkgcnOa.exe
  2⤵
  PID:9744
- C:\Windows\System\cvxjARq.exe
  C:\Windows\System\cvxjARq.exe
  2⤵
  PID:9620
- C:\Windows\System\ahoRqhT.exe
  C:\Windows\System\ahoRqhT.exe
  2⤵
  PID:9824
- C:\Windows\System\ZeKMZui.exe
  C:\Windows\System\ZeKMZui.exe
  2⤵
  PID:9844
- C:\Windows\System\wgoyTWT.exe
  C:\Windows\System\wgoyTWT.exe
  2⤵
  PID:9860
- C:\Windows\System\EMywtax.exe
  C:\Windows\System\EMywtax.exe
  2⤵
  PID:9892
- C:\Windows\System\cYHwBYm.exe
  C:\Windows\System\cYHwBYm.exe
  2⤵
  PID:9920
- C:\Windows\System\NnMXjbn.exe
  C:\Windows\System\NnMXjbn.exe
  2⤵
  PID:9976
- C:\Windows\System\wgHAgGV.exe
  C:\Windows\System\wgHAgGV.exe
  2⤵
  PID:9952
- C:\Windows\System\LhRmkCE.exe
  C:\Windows\System\LhRmkCE.exe
  2⤵
  PID:10068
- C:\Windows\System\FCAIPSI.exe
  C:\Windows\System\FCAIPSI.exe
  2⤵
  PID:10100
- C:\Windows\System\HHJjIqL.exe
  C:\Windows\System\HHJjIqL.exe
  2⤵
  PID:10072
- C:\Windows\System\TNBSSOG.exe
  C:\Windows\System\TNBSSOG.exe
  2⤵
  PID:9104
- C:\Windows\System\ecgYdnv.exe
  C:\Windows\System\ecgYdnv.exe
  2⤵
  PID:10224
- C:\Windows\System\foRsJWb.exe
  C:\Windows\System\foRsJWb.exe
  2⤵
  PID:10120
- C:\Windows\System\VOniZdZ.exe
  C:\Windows\System\VOniZdZ.exe
  2⤵
  PID:10192
- C:\Windows\System\IUKTbRB.exe
  C:\Windows\System\IUKTbRB.exe
  2⤵
  PID:9324
- C:\Windows\System\uQqUiFN.exe
  C:\Windows\System\uQqUiFN.exe
  2⤵
  PID:9392
- C:\Windows\System\PniOJPi.exe
  C:\Windows\System\PniOJPi.exe
  2⤵
  PID:9480
- C:\Windows\System\EEhfLaT.exe
  C:\Windows\System\EEhfLaT.exe
  2⤵
  PID:9340
- C:\Windows\System\cNWIKrR.exe
  C:\Windows\System\cNWIKrR.exe
  2⤵
  PID:9408
- C:\Windows\System\muqbscw.exe
  C:\Windows\System\muqbscw.exe
  2⤵
  PID:9476
- C:\Windows\System\RKohZKw.exe
  C:\Windows\System\RKohZKw.exe
  2⤵
  PID:9584
- C:\Windows\System\EhRuXsX.exe
  C:\Windows\System\EhRuXsX.exe
  2⤵
  PID:9828
- C:\Windows\System\llhRbiQ.exe
  C:\Windows\System\llhRbiQ.exe
  2⤵
  PID:9936
- C:\Windows\System\iGHgicW.exe
  C:\Windows\System\iGHgicW.exe
  2⤵
  PID:9760
- C:\Windows\System\NvydDsw.exe
  C:\Windows\System\NvydDsw.exe
  2⤵
  PID:9724
- C:\Windows\System\TJZAvQb.exe
  C:\Windows\System\TJZAvQb.exe
  2⤵
  PID:9808
- C:\Windows\System\UHEXTnH.exe
  C:\Windows\System\UHEXTnH.exe
  2⤵
  PID:9856
- C:\Windows\System\anhjoWP.exe
  C:\Windows\System\anhjoWP.exe
  2⤵
  PID:10136
- C:\Windows\System\KePTXiu.exe
  C:\Windows\System\KePTXiu.exe
  2⤵
  PID:10056
- C:\Windows\System\qicURot.exe
  C:\Windows\System\qicURot.exe
  2⤵
  PID:2408
- C:\Windows\System\hNUYWLa.exe
  C:\Windows\System\hNUYWLa.exe
  2⤵
  PID:9600
- C:\Windows\System\hDGhdBF.exe
  C:\Windows\System\hDGhdBF.exe
  2⤵
  PID:10040
- C:\Windows\System\WjeaFTL.exe
  C:\Windows\System\WjeaFTL.exe
  2⤵
  PID:9836
- C:\Windows\System\foYoClV.exe
  C:\Windows\System\foYoClV.exe
  2⤵
  PID:10188
- C:\Windows\System\wCPbMQE.exe
  C:\Windows\System\wCPbMQE.exe
  2⤵
  PID:9896
- C:\Windows\System\uOkIJJR.exe
  C:\Windows\System\uOkIJJR.exe
  2⤵
  PID:9792
- C:\Windows\System\rgwDzOw.exe
  C:\Windows\System\rgwDzOw.exe
  2⤵
  PID:9152
- C:\Windows\System\MrfUnYQ.exe
  C:\Windows\System\MrfUnYQ.exe
  2⤵
  PID:9344
- C:\Windows\System\urQRnpW.exe
  C:\Windows\System\urQRnpW.exe
  2⤵
  PID:9364
- C:\Windows\System\vHHafDM.exe
  C:\Windows\System\vHHafDM.exe
  2⤵
  PID:9652
- C:\Windows\System\kzxEJOJ.exe
  C:\Windows\System\kzxEJOJ.exe
  2⤵
  PID:9704
- C:\Windows\System\mpmgFWg.exe
  C:\Windows\System\mpmgFWg.exe
  2⤵
  PID:9788
- C:\Windows\System\leFZqxa.exe
  C:\Windows\System\leFZqxa.exe
  2⤵
  PID:10156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FWdbExW.exe

Filesize
1.6MB

MD5
214b9b402bf5c2f1a553000e800d54a6

SHA1
22e82622b36893eee5aaaf30c14c7714c1f7ca68

SHA256
c4df188bac03c0577f3d0bcfc6039841812fa674f3645bd05f365fe3a59861ac

SHA512
e0840ea8969aff914531be98abf42c4748935cc848091f71c012651e6ed45021ecac1878bbb98ffae6f795d32c09c6abb82e1cf40982366dc304692731d9f560

Download Submit
C:\Windows\system\IUAYAXC.exe

Filesize
1.6MB

MD5
64e6af7bb3dc9b91a6797d1ecd3e5ad3

SHA1
4e2e912136caa29585852936e339916fb985bc10

SHA256
7925304f629b566b7290dfd1f5d3817291d2d0eee24799e377f86134c0398692

SHA512
f956f98ba251bb18bb8047f56507b257e0e2ce7848a2db31de1aa1aa8bac85306176a07cbe9bd956e63338ffbbbdc2a3b16e90a9e32a85253b5d7a7a937e946c

Download Submit
C:\Windows\system\JjcLWoo.exe

Filesize
1.6MB

MD5
68702335416440877ede76d79f421daa

SHA1
d6af4cbbf8f1077d33a30e60bb632351d3c853bb

SHA256
1ee72b58a1679342a586cedbb327337b90219c8e99e3f8d78d051e0730ddb94f

SHA512
741922bb8fe73c4ce1a9f87d627346455759e9f006892db86425ee2b2267da6dba1003fc43555022ced6e629c948d193f5e36988bfbe2eb3d8be4d0cbfd56dd7

Download Submit
C:\Windows\system\KiyTKkE.exe

Filesize
1.6MB

MD5
1288a6154184d95d7d6a2fbd9ff19829

SHA1
3dc61531b14dae83f228743f106a5dc5b452f53e

SHA256
fa720ad575f38fed904d9a9c305150bec9546819f0a6ebb053ad0ac5d4112aaf

SHA512
3cf9759eee7545f0b1e8a39ae4a116b5f541d3bebef458ec295be9e65b9d9732920dfb4388d0b8536db3479bc870a1fdb0105c9d7eadfc12257b927c2a240f37

Download Submit
C:\Windows\system\OCWQghE.exe

Filesize
1.6MB

MD5
861aa9318f2cc4c828d4462dbe4e2f3c

SHA1
b220bf654eb379c1a1a225c3b37d415723bdfa6b

SHA256
f1f2225b0a5a9f62c7d9d38b9fd576324e2628b8cd2e3294c415516c2ba399cc

SHA512
2a8f746c68a33f5592074c280024b2f8f12f00991e0807b9f8a45f5e59d9cbcf146c5dda1b8a2f61981a7f03917d577cff615084a9b69bf2a20cfe3274f2dda2

Download Submit
C:\Windows\system\SLPtWfs.exe

Filesize
1.6MB

MD5
d3e483290a934097c381d541664384cf

SHA1
fcf37dd667cf6c2513941146fb58de8c5824e578

SHA256
55768c41ffcf64fd93f0931291958a06a2ead0f88a126ac3cf27646167e5e62c

SHA512
9e122466f863cf231fbb0785f26f829974f167665b07b37f8988f27683c3e1fcc6ff819b0d301e2933d079ea5d07a7b6be51ca70bbb7a8fc1b453d6abef1309f

Download Submit
C:\Windows\system\SiVcRRL.exe

Filesize
18B

MD5
eec09c428f305dca2267ae6442221bb7

SHA1
96adf7ba7e8726e7265b027b8f171e7e5871b26e

SHA256
417df779ac4ae1d346bf5e9f15390f46dc644218d04a2c50b0296839e8ece0c6

SHA512
947850ebc7e746fbd069a1d20600981b5c39867f28d6fdb6c0ca09d95faeaa2ac07db8dd865f96c2a45270c50cd8e68179dcc281d5f19d18e069eee50c6940c6

Download Submit
C:\Windows\system\TrzEIPC.exe

Filesize
1.6MB

MD5
5cfc30e86f63690be9a916c144abf273

SHA1
c13d190e4e3d3cd148695e6397636bc9ab661e6b

SHA256
81ff96980d582902c1dfe568d48ffa6f56db41fb5bcbff9b26cb27f86488eea6

SHA512
91cff1aefe6dff938f8180634e919bb9c512ea97088cdd4c67466e2a5d81e55e62763267a4bcc99181ce083a04ed25fc0d9d2723e6d5765b9398e4584c1b20d8

Download Submit
C:\Windows\system\ZYASBky.exe

Filesize
1.6MB

MD5
a5b1e1d667eb970c52d367ccd3288f09

SHA1
1ad5c2107de4bf95037490dec317a39125031407

SHA256
203b84117a40c187c63b8350abdf118fc3b019f1f162c860d701ddcb4daa5209

SHA512
9bf47f277d11c80587e1357918c31a25addc459c6048f3d9519359d95a1dd3b9a0a25479f5398a01376f1726bc2cc0538bae6aa9908115a837b84973b4db3975

Download Submit
C:\Windows\system\cRWHSQW.exe

Filesize
1.6MB

MD5
d3ce69bab1ede9ebd5e0c73610ae95b7

SHA1
7cda73d04bf22f7afefee9d4b298b2f4f1cd817e

SHA256
90507a4b759f051b683ece0bf1b46f8d57e35c52d060d707660709428cdaa425

SHA512
c41e42805d3d99a3c37ff5bb122b2a39f093c4900630af90825a3cce9d6c32d192ba69eb67e6d428bc2ccb254b97feaef149099f675abc1165f47d218dc04f43

Download Submit
C:\Windows\system\dWecXDB.exe

Filesize
1.6MB

MD5
437f7222dab6d5e1682d8152419e8e42

SHA1
ad3ca72c17240d6787df4eec5478ec832d5b9846

SHA256
f4f1479988f4dfe307d9b847e50e62d7413a34b52b58c795787bf6dc31b4a0df

SHA512
c0c0a98bc980ce3760dca208de247240b83336d13c1193a971a5b5e9e3c3e6ea857e664fb25cc5a9865c74d40384a81e868a91d7f9469a271586381d188cfefa

Download Submit
C:\Windows\system\dsRLsTK.exe

Filesize
1.6MB

MD5
07ae9a5574d493a0d8adc77ef2ebe50d

SHA1
c66597486a51cd318d7b3d028b45f748a138eb30

SHA256
80caecb055d5fa61e509499ac13d57c20d43913e4c7b3cc7d970957fb17df74a

SHA512
6dc314fd01a05414b30a9b5383d838fcb3f174aee9c1e7083e8a6943c466cc55e00f72db61204772121f162f981b9ef0aabadf42aac9ae07c5cf2cf37535d0fd

Download Submit
C:\Windows\system\dusnifU.exe

Filesize
1.6MB

MD5
12102e338ad03cbc9ab3ad21fe75a32b

SHA1
036226bb5c17a6e2abc81dcd1ba6a859075feeda

SHA256
5f0861364b2d4e44350a38b2a565a666a1ec7755e7da246f529f587bacd42a1a

SHA512
fdfc0c569c7a47c94397d5a457fcb49f71b0f46fb84de5f302c00e563771a2f40a255c44caa5dc7562ab372e0fcabb7521410220a1ed29402e914c2803d1dfc5

Download Submit
C:\Windows\system\euofvbw.exe

Filesize
1.6MB

MD5
450f1cf0c13a96915844f07f65a7a0c0

SHA1
b895fa480d99d38ff8c1b4c7d0b72b595a628182

SHA256
63a3f445d40e63a682335545d6157afe8b43e6126f7475219ac3069175756532

SHA512
1c73f1458ac61fcba3722e952b18203a12c3d24a16c980243866819e9c3c5d176c177aa4e1c40243ee9d3e65c980733844d45a43c9d6bb255548d0e66be4f985

Download Submit
C:\Windows\system\gteEIKB.exe

Filesize
1.6MB

MD5
a84789f8be6d23ce12ac414cd28e4279

SHA1
bc7d2ee2f6a6d527d12f0037bdebbc62f6cab790

SHA256
065511d41832a2707c6691d96433d9d9cc9f3eaacd2179a51adebf0676317a41

SHA512
60c468e79bc99f2eb3350507f6001c85279072f5ee40a7aeb40c27f02cfd0e156ce0dd562828da4ce1a84ccb7dd3a1d49266b551e7448468b932c4e2e17cf411

Download Submit
C:\Windows\system\jfvxexO.exe

Filesize
1.6MB

MD5
a71adfc97ae32c62be01bf98254b7053

SHA1
ef50dcf4b19ebf2fa15522f1d560fdb135b1131f

SHA256
067c8bb8e516ac941315543e40831254a7001a52075437368617433c97783a37

SHA512
c7e54d7d940509d63d891bfbbf6b4b79e6888d7b20e34db7d26693cad4d36675f312091423d91691b5fc8c4892e37ff929ede115f8774ec7411cda3ef18e6662

Download Submit
C:\Windows\system\lzQtDZp.exe

Filesize
1.6MB

MD5
27879d876d06400279644009a612a985

SHA1
376d3bbde58d9e5d330d1485453c335d86ea0b83

SHA256
a506b87177b6bdd4c1efeffa5b1ee3fe35ef6e425d90eb8bf53c153fcd0e4817

SHA512
0b58899a437c3c1c78863555eb27dcf89609fbe161a87f267f19ae8bbd9a6ec66526289fd75c082f1eda09c46a0caf5f2529a18dd6c78e443d1976fdce0daa38

Download Submit
C:\Windows\system\mOyTvkR.exe

Filesize
1.6MB

MD5
9a846655400c88d30cf2f6ebc48c9e4b

SHA1
9233ba43f0f726d675a72e5f280e9ea1e4374141

SHA256
37da848adaeb0b9d4d1e4b434cf1c4bd0350574a7626d61560612912f2032d85

SHA512
7142f315f4bbf33f08fe79d299022006988cc6d9428388918a06aa124fe5af2818953acdafe36df61d8f0bfba5c186dc5a8aec4b3b58bddf3fbba3a0977252c4

Download Submit
C:\Windows\system\mbCLVmZ.exe

Filesize
1.6MB

MD5
298c992cc6478f34883acb0008e66684

SHA1
b0dc1ad709578d56944008963e650059c29db72f

SHA256
3e0d90409cc5c09816e54c55356585d1e0f02c66a29ec92ca4c101d9c7b211a7

SHA512
d7a8891f1d8b01f423efc059e530a36c52461634c3ef77fbff77116b06894e7593a125a083dcb2032c2acd54a8cfc17d1ec394d770273c41999b1f0fe28b5bf6

Download Submit
C:\Windows\system\procYMm.exe

Filesize
1.6MB

MD5
7e325cbfe247e5e7aeac0ea599f26d85

SHA1
154019a32d28cefc2dcacc3868f11ca7505b1573

SHA256
21d9786bb73a1602eaf32e6009d9d5e1c6086113d4ef18280dc9cfbc55fdd272

SHA512
a80f0122387de16c0b02d777024c8291fb5fe487373759fde353e90dbc2d516a717b5eaaa82b8b48da7cb8cba44bc4ab1f45ae9b9b800b5836ba4b0278fff427

Download Submit
C:\Windows\system\rWGYhWK.exe

Filesize
1.6MB

MD5
0f133a750e646258c31a5eae67453b63

SHA1
fd307d4eab978b21510fbc27420d0e55c04a5271

SHA256
d9dbb29b261063102d11f3e069a7a848cff4f5b2cb9ec1b68edcd29a67a2a25b

SHA512
3317aa0557a37cdbd6bd852921c0970ebc02fc73487d7c4b3159a126226b62e1f1b57416c31de9decaff3ec702f9ec4ddd30a62f3a00626c9eb0bc290253869a

Download Submit
C:\Windows\system\wUSBJMq.exe

Filesize
1.6MB

MD5
3e1ea8c9d9a82c584c6dd6188538d72b

SHA1
374edcfd21b31c8a598489b8c22288efc4778309

SHA256
66b56aec94aa76a1d9bef3057157405635adbd8a61fb5c1fe9740725c967ff48

SHA512
6673157ebdebbcba5d6a559ed547e0b93ef7d91138c04af7842256058fade1b61692290e1e5f165b08f9732924d5c666a4b7bcf40ece1290c4d50bd8e29dad86

Download Submit
C:\Windows\system\xGzpwGT.exe

Filesize
1.6MB

MD5
844562c7d19553ce68336a0264eebf74

SHA1
c49908c2746be3408af7ea5f0a9e8e3845b762f4

SHA256
183c1497affaff2426df429d03b207cb1c0cf77670e87831c8d586e9ad369e07

SHA512
6f786dcfb602e113259729c24d9f8fcfcffd0fd4b510cbb0d37457ea67a21d85417457eb2f437beb94d8e902c2a3f6b7beb5f68f55953bce140235b51f9e2ff6

Download Submit
\Windows\system\BXbpPgq.exe

Filesize
1.6MB

MD5
80bb42428796539d84dea5a135ec430e

SHA1
85369e49f464855435a9e6089e98faf1075f7753

SHA256
521eb1b4d4fe92f31b586f46d573d7b34bfc5f7c85a9aea2e8b4d0de167ce34f

SHA512
b7727e64265ce51029b533753400b938b953bad0f126cb34d05365ebed300937875b8a46059cea31243957bfcd40c1e030819c0517a0c22739dd0d7f07584ebf

Download Submit
\Windows\system\FdQbgFb.exe

Filesize
1.6MB

MD5
84076923c738726e017acf93d803287f

SHA1
3d6a81da615228a25baa192960c968765da18e8e

SHA256
63a2529dec591ae5276196230d45404fc4eb030f0e075f801ef7b92f9a5600f6

SHA512
0da0dc6aff93058729d9a109f645506fa006b6b4f7eec706684ab1c062e414a9b91080abc3f356e5384948d3bb3b62b3465e3ad6eaaba591065d92f93cccbf86

Download Submit
\Windows\system\JZbeaKq.exe

Filesize
1.6MB

MD5
8669d8d7b0124cbc918669f5308183ea

SHA1
4649cdaa751e1bf5aa694c7f814e209ba639965b

SHA256
1f876f56d6e26366cbd3da0ed3c6889a730ce827daf81e6dd98991d57ac3262f

SHA512
706c2df3dfe083a84bfffbb4dcab080ebd63df76fc792c273b40dd2b1a5fc27ad5923879c5bc3e0d689de46b37878c1acdcd75c8b1dda4f9be7e465dda1e843b

Download Submit
\Windows\system\NWAOfwz.exe

Filesize
1.6MB

MD5
cf246eb47af0710ddcf66f42abf76e7e

SHA1
25718d56abb20a980e85b8fa6c97a977709aa191

SHA256
2a91f312e95badcedc38efe14e7603fdbf02237c5ecdf31978a13d07740ce1e5

SHA512
cf7ae3d20f2da8d6b7be619820e32b16beaed76f0be806d05603fe4064332a594967acb419170da614cbc93adb838c824379aaf93ef6afd34b8c3d29ef00ac5a

Download Submit
\Windows\system\VafoeEW.exe

Filesize
1.6MB

MD5
e0ad9f8c1b4c6d55d5079b5f34ace2c1

SHA1
c81657d3ed80c2c2f6619f0839a91579a6d6140a

SHA256
7f775bf578e28b5a7c467e15701546dc2dd5df1af9b7bf403299790e342f5b4e

SHA512
9d7e58ca0433c526bf1bf4b12c7df6c5e1bff380ba032f57f6296eb97b55cce173eddc3381d7550e8fa66191a61b086f811eca4147299cf7f55077f5f941f970

Download Submit
\Windows\system\dezFYYv.exe

Filesize
1.6MB

MD5
377f199210f510af699c0cf41d5a1d71

SHA1
bbf15c1b72af54b148286cff9b3bcbb1abd67322

SHA256
568b3e4cb7874f3805802e58c9dedfc78ac163e4cc3ee8869ecd39d3bbe08668

SHA512
fa0c5af003c9c13c6bdbb2d1087db886178ebbacd68796d194d682d79f9b59a2af88575d4e6f3629462fd7c7c5e6697d1d0adc54b46ab33d6f92e3e895785d92

Download Submit
\Windows\system\fcfkicR.exe

Filesize
1.6MB

MD5
cb53b32e28803a7295e6154aa747e493

SHA1
681de9a08eeb6a1597a8039b1ab336779d118558

SHA256
68d336c0a0177eb025500a88408e9337c26fad8df9cdc9eabba0ae4669c60afc

SHA512
e96a00be3ac6cdb11fb8b5d91070d74b1bca8200fd604ab72b358dc4a29a1127e43badbe8c3f09ac1352d36c2c8cb9f3c1dbfe6818b499dd959690446e331a2c

Download Submit
\Windows\system\gGAjAgq.exe

Filesize
1.6MB

MD5
6674b2b0b2a448561ddde76d4f25846c

SHA1
5277e274880e7a6d8ea0436aca3d812152fa4207

SHA256
7259f835a7309a0d7ebdb5a589d3cc81f96973f8ed364826b1f3d94fbe265766

SHA512
56bcdc7a966827c9971e6356854ce95f0ceeb80e004a261d43e5025784d08dced15728bb008e4048189e373f38e17d429bc5edea1564f1888771a31f862b8f76

Download Submit
\Windows\system\iJyvrco.exe

Filesize
1.6MB

MD5
ff7d7398e70f55eb3fd46c0a36e23c80

SHA1
01150f4343e1cf88a8b9c608f237bb9ebacfe55d

SHA256
117fe0d6beead5b907bd316fe61ddcb849818c1a7c399e9b67ee563934097597

SHA512
cbf2675ada60200ba0c73b458456d3b6dcc8daadd47d2b8e6bc1e3714ccea3e13c5fa3a094aae57dbfa29598d53b7da1b5bee6d7d971b831744bd1fc281c6f8e

Download Submit
\Windows\system\jlsCSuD.exe

Filesize
1.6MB

MD5
a287f200e236e2ec48206b3e426e4432

SHA1
8248532967bbce548f3aad01c6cd6c420253f31b

SHA256
fb1d61683d857a729208252fa766c87feefa841ba93e8f38eab5e6fe838711ad

SHA512
bfe9cd0ea34a61a3b1edda88886a3f46963ddff27b9ce893f33fe20df6f300cf6533e613bc20ba6182aa0afe879769a07ef965d8e34ef3d23f9788c583313d96

Download Submit
\Windows\system\lTpLnAw.exe

Filesize
1.6MB

MD5
e01d212e41e9636fcf01d035af1425ae

SHA1
34164a2b0a8fab7920a5e12dc325c68aa62d368e

SHA256
4bface225e5aba890c41377aff05cb03cebcacb29c47a09e7f3f0a84be437278

SHA512
ff96471004137615b53d44f6635ca84ef59c529a5d3a59d0a504558505ae728ecfe1535c43e8c01a3d450b62eb3dd238f0bf8db2c885d17849b02278f50db253

Download Submit
\Windows\system\qAIQavr.exe

Filesize
1.6MB

MD5
c7ea4dff3fc7cf1acb6c999806e8208b

SHA1
8bbaae6b291c7d8a38ddbbfc800b6186cc22a13f

SHA256
471d0e392946d7e7c6a98262421a7f0712a1c92546a3f66a825f959cc0459101

SHA512
ae7136c42c741b6ca7b74e15429722c663d95dff00f8c669fb5856a8494f58983eec98b53b016245408938a13eeb553a2c50a5493b51b2715cd8cf893915fde2

Download Submit
\Windows\system\qcuSEQp.exe

Filesize
1.6MB

MD5
48763dd922dfb18e9ada3d0cc3efad83

SHA1
c07f77aec72d4bea8f51c7bbe549eb9296562ac5

SHA256
082fdb5434a9aa3da50b7c1e42d24c20793e2ece10ab12ea3ab644e99a15e0a2

SHA512
0e105b80ba1fc0eaae336d920358d7daf42114c497225003e016c4e4433da3d94a2a2fbb21112ffe90af846f51cbc621710847b0700b932153b9c5747bb376fa

Download Submit
\Windows\system\rmzlhhU.exe

Filesize
1.6MB

MD5
17c0f2881a55a44dee61b2321a7924f5

SHA1
aa9337a64b78a79f161bc4306c0d6ddb00a8432a

SHA256
99e960cab55e593a5440b8bdd6163cc54692243c8ef00f2f85df5ccc1819fe97

SHA512
95d8d451d7af8314c14b90bff36814dc9c9ff21f7f5a60262e011e75ee3f5d58e4b93080d121ad816974506f06c65183ca2d5b9b2a63719de6b60953fe684df6

Download Submit
\Windows\system\wZLldqp.exe

Filesize
1.6MB

MD5
3171adf3344b0ae2fb52188c466b08cf

SHA1
8227051529c0d6cc203e3f74dbd8d15f0a2d3a74

SHA256
91013ab1898be8a795bf8f51f0f26b43052ffb584f08dfe7a8d88a7d861f089b

SHA512
5d2161571780114675225025f1af2c0ed223f7fde35816dcadcb1813e02b96e0294d2e05a92ed5ca6f6e3a07da7920666a6270b3f98161fb0a045e4546bea2f8

Download Submit
\Windows\system\zAqkOTf.exe

Filesize
1.6MB

MD5
8e5d934ca877d29347ef67288854e01c

SHA1
b390899ba36b619bc71f51cd98f0b5d8abd6bbf2

SHA256
c8e3c708c32684ada8dfdf98c5a0bd4960dc83bd53107643af2ddb4696fc0b6a

SHA512
bd07b5e104aa05318db572bbf744e33f313813737d51b2a1693ad86f8384adb44f1d2019c2d77843b499d902b1e64692e5887f3456c51c150ec6b68a5d4786e1

Download Submit
memory/756-7-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/756-45-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/756-86-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/756-109-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/756-48-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/756-82-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/756-66-0x0000000003350000-0x0000000003742000-memory.dmp

Filesize
3.9MB

Download
memory/756-67-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/756-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/756-49-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/756-46-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/756-69-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/756-0-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/1636-65-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/1636-63-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/1880-58-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1880-5877-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-20-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-6419-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2060-108-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2060-6435-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2240-6427-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-107-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-6429-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2256-68-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2460-57-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2460-6430-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2580-61-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2580-6432-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2640-5880-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2640-60-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2676-5803-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-47-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-70-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2684-6431-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2724-6428-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2724-64-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download