xmrig | 5cf7d45c60530f08d735b779e5b20b7048cbbcceff561e071be5bd02acc04d59

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
Size

2.8MB
MD5

4a0b0a9fc6ac7a007d688703b8b422f0
SHA1

11d569adbe7965f0e5fa014fb4355d4c1d854c3f
SHA256

5cf7d45c60530f08d735b779e5b20b7048cbbcceff561e071be5bd02acc04d59
SHA512

6d8d5ef89a900093e1598b4f29b9b989010afd52faffc76d430d8366963bacffad112b2815b5356e9aa699a8bc0876953f1411398f19745855581faf47977ecb
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hm6lgVJUwAd0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R3

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2380-1-0x000000013F4B0000-0x000000013F8A6000-memory.dmp	xmrig
\Windows\system\ziQTmDV.exe	xmrig
C:\Windows\system\yKFOISx.exe	xmrig
C:\Windows\system\WPjMomO.exe	xmrig
\Windows\system\pzhfoLi.exe	xmrig
C:\Windows\system\hIbrPml.exe	xmrig
C:\Windows\system\ZmJVjFd.exe	xmrig
C:\Windows\system\xcVvAIT.exe	xmrig
behavioral1/memory/2732-88-0x000000013FD40000-0x0000000140136000-memory.dmp	xmrig
C:\Windows\system\AjEBgqc.exe	xmrig
behavioral1/memory/1840-121-0x000000013F8A0000-0x000000013FC96000-memory.dmp	xmrig
C:\Windows\system\TTKZkBT.exe	xmrig
C:\Windows\system\UaHvlwS.exe	xmrig
C:\Windows\system\FCpYaxC.exe	xmrig
C:\Windows\system\RglXVku.exe	xmrig
C:\Windows\system\xzSIKKC.exe	xmrig
C:\Windows\system\UiLKZAv.exe	xmrig
C:\Windows\system\pxDSVpS.exe	xmrig
C:\Windows\system\WeBGwVO.exe	xmrig
C:\Windows\system\bLHmwNi.exe	xmrig
C:\Windows\system\MQmhxPp.exe	xmrig
C:\Windows\system\VkeoMLJ.exe	xmrig
C:\Windows\system\uzGTDBG.exe	xmrig
C:\Windows\system\jYASKdJ.exe	xmrig
C:\Windows\system\UDQLfJe.exe	xmrig
C:\Windows\system\eKEvqNu.exe	xmrig
behavioral1/memory/1196-90-0x000000013F3A0000-0x000000013F796000-memory.dmp	xmrig
C:\Windows\system\yxErVLF.exe	xmrig
behavioral1/memory/2584-72-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/memory/2728-123-0x000000013F290000-0x000000013F686000-memory.dmp	xmrig
\Windows\system\xyjzUGZ.exe	xmrig
C:\Windows\system\qqUNDjy.exe	xmrig
C:\Windows\system\CHCwoRa.exe	xmrig
C:\Windows\system\gToDRCf.exe	xmrig
C:\Windows\system\lFfYqlK.exe	xmrig
behavioral1/memory/2712-63-0x000000013F4D0000-0x000000013F8C6000-memory.dmp	xmrig
C:\Windows\system\eAxKmvV.exe	xmrig
behavioral1/memory/2580-53-0x000000013F290000-0x000000013F686000-memory.dmp	xmrig
behavioral1/memory/2772-37-0x000000013F330000-0x000000013F726000-memory.dmp	xmrig
C:\Windows\system\wcNLVEl.exe	xmrig
behavioral1/memory/3000-17-0x000000013FB20000-0x000000013FF16000-memory.dmp	xmrig
\Windows\system\fZDnIoO.exe	xmrig
behavioral1/memory/2772-5191-0x000000013F330000-0x000000013F726000-memory.dmp	xmrig
behavioral1/memory/3000-5194-0x000000013FB20000-0x000000013FF16000-memory.dmp	xmrig
behavioral1/memory/2580-5200-0x000000013F290000-0x000000013F686000-memory.dmp	xmrig
behavioral1/memory/2712-5204-0x000000013F4D0000-0x000000013F8C6000-memory.dmp	xmrig
behavioral1/memory/2584-5219-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/memory/2732-5246-0x000000013FD40000-0x0000000140136000-memory.dmp	xmrig
behavioral1/memory/1196-5248-0x000000013F3A0000-0x000000013F796000-memory.dmp	xmrig
behavioral1/memory/2380-6997-0x000000013F4B0000-0x000000013F8A6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2352 powershell.exe

pid	process
2352	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

ziQTmDV.exeyKFOISx.exefZDnIoO.exeWPjMomO.exepzhfoLi.exewcNLVEl.exehIbrPml.exeZmJVjFd.exeeAxKmvV.exexcVvAIT.exeyxErVLF.exelFfYqlK.exegToDRCf.exexyjzUGZ.exeCHCwoRa.exeqqUNDjy.exeAjEBgqc.exeeKEvqNu.exeUDQLfJe.exejYASKdJ.exeuzGTDBG.exeVkeoMLJ.exebLHmwNi.exeWeBGwVO.exepxDSVpS.exeUiLKZAv.exexzSIKKC.exeRglXVku.exeTTKZkBT.exeFCpYaxC.exeUaHvlwS.exeMQmhxPp.exeHdrqDWj.exeFooLvWU.exeREFPwCg.exeDIPdWDI.exejXvWkUv.exeXgVmhCR.exeDLjQelQ.exeEOhNvza.exeNtaJdbi.exeQxTOORU.exepICphxW.exemfBoWVK.exeNoAZYLQ.exeDTyGOHD.exefdCccDs.exehElAyDx.exegbDBhdt.exeHmiTMwe.exeATGLNIU.exeIGEjagH.exeGJQcCLW.exeVDRCxEL.exezZOdWVZ.exeEwDjdYm.exeXKawlHV.exejauLRwZ.exeUuqylcj.exetOKokde.exewtKzpZe.execXxutpJ.execJolUTK.exeGtaZaCa.exe

pid	process
3000	ziQTmDV.exe
2772	yKFOISx.exe
1840	fZDnIoO.exe
2580	WPjMomO.exe
2712	pzhfoLi.exe
2584	wcNLVEl.exe
2728	hIbrPml.exe
2732	ZmJVjFd.exe
1196	eAxKmvV.exe
2400	xcVvAIT.exe
2700	yxErVLF.exe
932	lFfYqlK.exe
2620	gToDRCf.exe
2504	xyjzUGZ.exe
1860	CHCwoRa.exe
548	qqUNDjy.exe
2800	AjEBgqc.exe
3020	eKEvqNu.exe
1984	UDQLfJe.exe
2520	jYASKdJ.exe
1480	uzGTDBG.exe
944	VkeoMLJ.exe
2792	bLHmwNi.exe
1764	WeBGwVO.exe
292	pxDSVpS.exe
280	UiLKZAv.exe
1424	xzSIKKC.exe
1460	RglXVku.exe
908	TTKZkBT.exe
1148	FCpYaxC.exe
1304	UaHvlwS.exe
2244	MQmhxPp.exe
1552	HdrqDWj.exe
980	FooLvWU.exe
1912	REFPwCg.exe
1856	DIPdWDI.exe
1112	jXvWkUv.exe
636	XgVmhCR.exe
1084	DLjQelQ.exe
2892	EOhNvza.exe
2912	NtaJdbi.exe
1760	QxTOORU.exe
1728	pICphxW.exe
2204	mfBoWVK.exe
1716	NoAZYLQ.exe
2752	DTyGOHD.exe
2472	fdCccDs.exe
2812	hElAyDx.exe
2564	gbDBhdt.exe
2828	HmiTMwe.exe
2940	ATGLNIU.exe
772	IGEjagH.exe
2636	GJQcCLW.exe
696	VDRCxEL.exe
2160	zZOdWVZ.exe
1120	EwDjdYm.exe
1620	XKawlHV.exe
2140	jauLRwZ.exe
2044	Uuqylcj.exe
2648	tOKokde.exe
2528	wtKzpZe.exe
2388	cXxutpJ.exe
2536	cJolUTK.exe
1696	GtaZaCa.exe

Loads dropped DLL 64 IoCs

Processes:

4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe

pid	process
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2380-1-0x000000013F4B0000-0x000000013F8A6000-memory.dmp	upx
\Windows\system\ziQTmDV.exe	upx
C:\Windows\system\yKFOISx.exe	upx
C:\Windows\system\WPjMomO.exe	upx
\Windows\system\pzhfoLi.exe	upx
C:\Windows\system\hIbrPml.exe	upx
C:\Windows\system\ZmJVjFd.exe	upx
C:\Windows\system\xcVvAIT.exe	upx
behavioral1/memory/2732-88-0x000000013FD40000-0x0000000140136000-memory.dmp	upx
C:\Windows\system\AjEBgqc.exe	upx
behavioral1/memory/1840-121-0x000000013F8A0000-0x000000013FC96000-memory.dmp	upx
C:\Windows\system\TTKZkBT.exe	upx
C:\Windows\system\UaHvlwS.exe	upx
C:\Windows\system\FCpYaxC.exe	upx
C:\Windows\system\RglXVku.exe	upx
C:\Windows\system\xzSIKKC.exe	upx
C:\Windows\system\UiLKZAv.exe	upx
C:\Windows\system\pxDSVpS.exe	upx
C:\Windows\system\WeBGwVO.exe	upx
C:\Windows\system\bLHmwNi.exe	upx
C:\Windows\system\MQmhxPp.exe	upx
C:\Windows\system\VkeoMLJ.exe	upx
C:\Windows\system\uzGTDBG.exe	upx
C:\Windows\system\jYASKdJ.exe	upx
C:\Windows\system\UDQLfJe.exe	upx
C:\Windows\system\eKEvqNu.exe	upx
behavioral1/memory/1196-90-0x000000013F3A0000-0x000000013F796000-memory.dmp	upx
C:\Windows\system\yxErVLF.exe	upx
behavioral1/memory/2584-72-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/memory/2728-123-0x000000013F290000-0x000000013F686000-memory.dmp	upx
\Windows\system\xyjzUGZ.exe	upx
C:\Windows\system\qqUNDjy.exe	upx
C:\Windows\system\CHCwoRa.exe	upx
C:\Windows\system\gToDRCf.exe	upx
C:\Windows\system\lFfYqlK.exe	upx
behavioral1/memory/2712-63-0x000000013F4D0000-0x000000013F8C6000-memory.dmp	upx
C:\Windows\system\eAxKmvV.exe	upx
behavioral1/memory/2580-53-0x000000013F290000-0x000000013F686000-memory.dmp	upx
behavioral1/memory/2772-37-0x000000013F330000-0x000000013F726000-memory.dmp	upx
C:\Windows\system\wcNLVEl.exe	upx
behavioral1/memory/3000-17-0x000000013FB20000-0x000000013FF16000-memory.dmp	upx
\Windows\system\fZDnIoO.exe	upx
behavioral1/memory/2772-5191-0x000000013F330000-0x000000013F726000-memory.dmp	upx
behavioral1/memory/3000-5194-0x000000013FB20000-0x000000013FF16000-memory.dmp	upx
behavioral1/memory/2580-5200-0x000000013F290000-0x000000013F686000-memory.dmp	upx
behavioral1/memory/2712-5204-0x000000013F4D0000-0x000000013F8C6000-memory.dmp	upx
behavioral1/memory/2584-5219-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/memory/2732-5246-0x000000013FD40000-0x0000000140136000-memory.dmp	upx
behavioral1/memory/1196-5248-0x000000013F3A0000-0x000000013F796000-memory.dmp	upx
behavioral1/memory/2380-6997-0x000000013F4B0000-0x000000013F8A6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

Processes:

4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\System\heTObWO.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\ujCzswj.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\hIAbchx.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\QARKCTi.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\ULugTzC.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\biYVjAA.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\zpjmclu.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\lyPPncY.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\vFyNWyG.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\pkacCRI.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\yxEsPSV.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\CnvNOud.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\DGVjRNW.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\GbSSrEh.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\qTxiBbk.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\nAeLqUw.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\HzLnafn.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\luuFxfh.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\XOqWlGs.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\zKMNRPH.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\FQsGNdZ.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\lMGhDjH.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\XnEIlCJ.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\zewFOAq.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\DIhUOND.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\SUyrNNt.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\IlAtPXf.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\xhuewcr.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\GlZdbSg.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\NUhEsun.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\zgNNosI.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\ijgjAKT.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\zMScYPT.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\aobZdmS.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\nAwAzkG.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\nlSNsjy.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\PZtMPjN.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\PMcalab.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\zDtayvH.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\WqpHmgD.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\geSOtuQ.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\AVnnCjL.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\LogURJj.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\WGkOeVh.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\mZynFPf.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\NrRqWPn.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\BkWObiZ.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\itYvjTt.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\XjychfQ.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\lPBdCOP.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\IkOSDIS.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\jDqhNqY.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\JYWfWKc.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\xuPAjjt.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\jnasAuQ.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\zwPoBbV.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\DWhUDyt.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\CcfDePR.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\sBPyiCH.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\wrBDNKq.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\hIbrPml.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\nCfOSYd.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\Erkowik.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
File created	C:\Windows\System\GtHkxrZ.exe	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2352 powershell.exe

pid	process
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe

description	pid	process	target process
PID 2380 wrote to memory of 2352	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	powershell.exe
PID 2380 wrote to memory of 2352	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	powershell.exe
PID 2380 wrote to memory of 2352	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	powershell.exe
PID 2380 wrote to memory of 3000	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	ziQTmDV.exe
PID 2380 wrote to memory of 3000	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	ziQTmDV.exe
PID 2380 wrote to memory of 3000	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	ziQTmDV.exe
PID 2380 wrote to memory of 2772	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	yKFOISx.exe
PID 2380 wrote to memory of 2772	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	yKFOISx.exe
PID 2380 wrote to memory of 2772	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	yKFOISx.exe
PID 2380 wrote to memory of 1840	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	fZDnIoO.exe
PID 2380 wrote to memory of 1840	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	fZDnIoO.exe
PID 2380 wrote to memory of 1840	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	fZDnIoO.exe
PID 2380 wrote to memory of 2580	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	WPjMomO.exe
PID 2380 wrote to memory of 2580	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	WPjMomO.exe
PID 2380 wrote to memory of 2580	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	WPjMomO.exe
PID 2380 wrote to memory of 2712	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	pzhfoLi.exe
PID 2380 wrote to memory of 2712	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	pzhfoLi.exe
PID 2380 wrote to memory of 2712	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	pzhfoLi.exe
PID 2380 wrote to memory of 2584	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	wcNLVEl.exe
PID 2380 wrote to memory of 2584	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	wcNLVEl.exe
PID 2380 wrote to memory of 2584	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	wcNLVEl.exe
PID 2380 wrote to memory of 2728	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	hIbrPml.exe
PID 2380 wrote to memory of 2728	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	hIbrPml.exe
PID 2380 wrote to memory of 2728	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	hIbrPml.exe
PID 2380 wrote to memory of 2620	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	gToDRCf.exe
PID 2380 wrote to memory of 2620	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	gToDRCf.exe
PID 2380 wrote to memory of 2620	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	gToDRCf.exe
PID 2380 wrote to memory of 2732	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	ZmJVjFd.exe
PID 2380 wrote to memory of 2732	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	ZmJVjFd.exe
PID 2380 wrote to memory of 2732	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	ZmJVjFd.exe
PID 2380 wrote to memory of 2504	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	xyjzUGZ.exe
PID 2380 wrote to memory of 2504	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	xyjzUGZ.exe
PID 2380 wrote to memory of 2504	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	xyjzUGZ.exe
PID 2380 wrote to memory of 1196	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	eAxKmvV.exe
PID 2380 wrote to memory of 1196	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	eAxKmvV.exe
PID 2380 wrote to memory of 1196	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	eAxKmvV.exe
PID 2380 wrote to memory of 3020	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	eKEvqNu.exe
PID 2380 wrote to memory of 3020	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	eKEvqNu.exe
PID 2380 wrote to memory of 3020	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	eKEvqNu.exe
PID 2380 wrote to memory of 2400	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	xcVvAIT.exe
PID 2380 wrote to memory of 2400	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	xcVvAIT.exe
PID 2380 wrote to memory of 2400	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	xcVvAIT.exe
PID 2380 wrote to memory of 1984	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	UDQLfJe.exe
PID 2380 wrote to memory of 1984	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	UDQLfJe.exe
PID 2380 wrote to memory of 1984	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	UDQLfJe.exe
PID 2380 wrote to memory of 2700	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	yxErVLF.exe
PID 2380 wrote to memory of 2700	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	yxErVLF.exe
PID 2380 wrote to memory of 2700	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	yxErVLF.exe
PID 2380 wrote to memory of 2520	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	jYASKdJ.exe
PID 2380 wrote to memory of 2520	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	jYASKdJ.exe
PID 2380 wrote to memory of 2520	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	jYASKdJ.exe
PID 2380 wrote to memory of 932	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	lFfYqlK.exe
PID 2380 wrote to memory of 932	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	lFfYqlK.exe
PID 2380 wrote to memory of 932	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	lFfYqlK.exe
PID 2380 wrote to memory of 1480	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	uzGTDBG.exe
PID 2380 wrote to memory of 1480	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	uzGTDBG.exe
PID 2380 wrote to memory of 1480	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	uzGTDBG.exe
PID 2380 wrote to memory of 1860	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	CHCwoRa.exe
PID 2380 wrote to memory of 1860	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	CHCwoRa.exe
PID 2380 wrote to memory of 1860	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	CHCwoRa.exe
PID 2380 wrote to memory of 944	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	VkeoMLJ.exe
PID 2380 wrote to memory of 944	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	VkeoMLJ.exe
PID 2380 wrote to memory of 944	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	VkeoMLJ.exe
PID 2380 wrote to memory of 548	2380	4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe	qqUNDjy.exe

C:\Users\Admin\AppData\Local\Temp\4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a0b0a9fc6ac7a007d688703b8b422f0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System\ziQTmDV.exe
  C:\Windows\System\ziQTmDV.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\yKFOISx.exe
  C:\Windows\System\yKFOISx.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\fZDnIoO.exe
  C:\Windows\System\fZDnIoO.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\WPjMomO.exe
  C:\Windows\System\WPjMomO.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\pzhfoLi.exe
  C:\Windows\System\pzhfoLi.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\wcNLVEl.exe
  C:\Windows\System\wcNLVEl.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\hIbrPml.exe
  C:\Windows\System\hIbrPml.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\gToDRCf.exe
  C:\Windows\System\gToDRCf.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\ZmJVjFd.exe
  C:\Windows\System\ZmJVjFd.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\xyjzUGZ.exe
  C:\Windows\System\xyjzUGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\eAxKmvV.exe
  C:\Windows\System\eAxKmvV.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\eKEvqNu.exe
  C:\Windows\System\eKEvqNu.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\xcVvAIT.exe
  C:\Windows\System\xcVvAIT.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\UDQLfJe.exe
  C:\Windows\System\UDQLfJe.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\yxErVLF.exe
  C:\Windows\System\yxErVLF.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\jYASKdJ.exe
  C:\Windows\System\jYASKdJ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\lFfYqlK.exe
  C:\Windows\System\lFfYqlK.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\uzGTDBG.exe
  C:\Windows\System\uzGTDBG.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\CHCwoRa.exe
  C:\Windows\System\CHCwoRa.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\VkeoMLJ.exe
  C:\Windows\System\VkeoMLJ.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\qqUNDjy.exe
  C:\Windows\System\qqUNDjy.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\bLHmwNi.exe
  C:\Windows\System\bLHmwNi.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\AjEBgqc.exe
  C:\Windows\System\AjEBgqc.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\WeBGwVO.exe
  C:\Windows\System\WeBGwVO.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\pxDSVpS.exe
  C:\Windows\System\pxDSVpS.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\UiLKZAv.exe
  C:\Windows\System\UiLKZAv.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\xzSIKKC.exe
  C:\Windows\System\xzSIKKC.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\RglXVku.exe
  C:\Windows\System\RglXVku.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\TTKZkBT.exe
  C:\Windows\System\TTKZkBT.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\FCpYaxC.exe
  C:\Windows\System\FCpYaxC.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\UaHvlwS.exe
  C:\Windows\System\UaHvlwS.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\MQmhxPp.exe
  C:\Windows\System\MQmhxPp.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\HdrqDWj.exe
  C:\Windows\System\HdrqDWj.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\zkdsrBn.exe
  C:\Windows\System\zkdsrBn.exe
  2⤵
  PID:1996
- C:\Windows\System\FooLvWU.exe
  C:\Windows\System\FooLvWU.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\fQQaEIW.exe
  C:\Windows\System\fQQaEIW.exe
  2⤵
  PID:956
- C:\Windows\System\REFPwCg.exe
  C:\Windows\System\REFPwCg.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\oBUkHON.exe
  C:\Windows\System\oBUkHON.exe
  2⤵
  PID:1832
- C:\Windows\System\DIPdWDI.exe
  C:\Windows\System\DIPdWDI.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\DpzTEmW.exe
  C:\Windows\System\DpzTEmW.exe
  2⤵
  PID:1204
- C:\Windows\System\jXvWkUv.exe
  C:\Windows\System\jXvWkUv.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\EZPBmZm.exe
  C:\Windows\System\EZPBmZm.exe
  2⤵
  PID:2132
- C:\Windows\System\XgVmhCR.exe
  C:\Windows\System\XgVmhCR.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\xVDzbJJ.exe
  C:\Windows\System\xVDzbJJ.exe
  2⤵
  PID:2152
- C:\Windows\System\DLjQelQ.exe
  C:\Windows\System\DLjQelQ.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\RRDMFka.exe
  C:\Windows\System\RRDMFka.exe
  2⤵
  PID:2996
- C:\Windows\System\EOhNvza.exe
  C:\Windows\System\EOhNvza.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\cJHjiCL.exe
  C:\Windows\System\cJHjiCL.exe
  2⤵
  PID:2932
- C:\Windows\System\NtaJdbi.exe
  C:\Windows\System\NtaJdbi.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\CBcjgeT.exe
  C:\Windows\System\CBcjgeT.exe
  2⤵
  PID:892
- C:\Windows\System\QxTOORU.exe
  C:\Windows\System\QxTOORU.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\TjNlgVc.exe
  C:\Windows\System\TjNlgVc.exe
  2⤵
  PID:2216
- C:\Windows\System\pICphxW.exe
  C:\Windows\System\pICphxW.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\nFgxMiY.exe
  C:\Windows\System\nFgxMiY.exe
  2⤵
  PID:1584
- C:\Windows\System\mfBoWVK.exe
  C:\Windows\System\mfBoWVK.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\DXjUVKx.exe
  C:\Windows\System\DXjUVKx.exe
  2⤵
  PID:848
- C:\Windows\System\NoAZYLQ.exe
  C:\Windows\System\NoAZYLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\kMMLToV.exe
  C:\Windows\System\kMMLToV.exe
  2⤵
  PID:2660
- C:\Windows\System\DTyGOHD.exe
  C:\Windows\System\DTyGOHD.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\rnAOczW.exe
  C:\Windows\System\rnAOczW.exe
  2⤵
  PID:2604
- C:\Windows\System\fdCccDs.exe
  C:\Windows\System\fdCccDs.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\bPZdUaY.exe
  C:\Windows\System\bPZdUaY.exe
  2⤵
  PID:2444
- C:\Windows\System\hElAyDx.exe
  C:\Windows\System\hElAyDx.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\QunmOPd.exe
  C:\Windows\System\QunmOPd.exe
  2⤵
  PID:1264
- C:\Windows\System\gbDBhdt.exe
  C:\Windows\System\gbDBhdt.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\PKbTvNM.exe
  C:\Windows\System\PKbTvNM.exe
  2⤵
  PID:2696
- C:\Windows\System\HmiTMwe.exe
  C:\Windows\System\HmiTMwe.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\gNwhWlX.exe
  C:\Windows\System\gNwhWlX.exe
  2⤵
  PID:1464
- C:\Windows\System\ATGLNIU.exe
  C:\Windows\System\ATGLNIU.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\ZuDefXm.exe
  C:\Windows\System\ZuDefXm.exe
  2⤵
  PID:2188
- C:\Windows\System\IGEjagH.exe
  C:\Windows\System\IGEjagH.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\CVuXzrz.exe
  C:\Windows\System\CVuXzrz.exe
  2⤵
  PID:1640
- C:\Windows\System\GJQcCLW.exe
  C:\Windows\System\GJQcCLW.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\eoGuCQf.exe
  C:\Windows\System\eoGuCQf.exe
  2⤵
  PID:844
- C:\Windows\System\VDRCxEL.exe
  C:\Windows\System\VDRCxEL.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\IZUwDzQ.exe
  C:\Windows\System\IZUwDzQ.exe
  2⤵
  PID:1028
- C:\Windows\System\zZOdWVZ.exe
  C:\Windows\System\zZOdWVZ.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\kOlHQXr.exe
  C:\Windows\System\kOlHQXr.exe
  2⤵
  PID:2344
- C:\Windows\System\EwDjdYm.exe
  C:\Windows\System\EwDjdYm.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\tDQSwlB.exe
  C:\Windows\System\tDQSwlB.exe
  2⤵
  PID:3068
- C:\Windows\System\XKawlHV.exe
  C:\Windows\System\XKawlHV.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\XoynYlK.exe
  C:\Windows\System\XoynYlK.exe
  2⤵
  PID:2884
- C:\Windows\System\jauLRwZ.exe
  C:\Windows\System\jauLRwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\vIlZIZf.exe
  C:\Windows\System\vIlZIZf.exe
  2⤵
  PID:1072
- C:\Windows\System\Uuqylcj.exe
  C:\Windows\System\Uuqylcj.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\tBdTOcV.exe
  C:\Windows\System\tBdTOcV.exe
  2⤵
  PID:1568
- C:\Windows\System\tOKokde.exe
  C:\Windows\System\tOKokde.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\TgGPzQr.exe
  C:\Windows\System\TgGPzQr.exe
  2⤵
  PID:2136
- C:\Windows\System\wtKzpZe.exe
  C:\Windows\System\wtKzpZe.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\yVRgqEm.exe
  C:\Windows\System\yVRgqEm.exe
  2⤵
  PID:2684
- C:\Windows\System\cXxutpJ.exe
  C:\Windows\System\cXxutpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\KDKSfvb.exe
  C:\Windows\System\KDKSfvb.exe
  2⤵
  PID:2288
- C:\Windows\System\cJolUTK.exe
  C:\Windows\System\cJolUTK.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\EbSicli.exe
  C:\Windows\System\EbSicli.exe
  2⤵
  PID:3056
- C:\Windows\System\GtaZaCa.exe
  C:\Windows\System\GtaZaCa.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\hyMTsHM.exe
  C:\Windows\System\hyMTsHM.exe
  2⤵
  PID:2960
- C:\Windows\System\psbwPzN.exe
  C:\Windows\System\psbwPzN.exe
  2⤵
  PID:2836
- C:\Windows\System\GUWYgcx.exe
  C:\Windows\System\GUWYgcx.exe
  2⤵
  PID:3120
- C:\Windows\System\eDioznM.exe
  C:\Windows\System\eDioznM.exe
  2⤵
  PID:3136
- C:\Windows\System\OFvFkuK.exe
  C:\Windows\System\OFvFkuK.exe
  2⤵
  PID:3156
- C:\Windows\System\lFaHBRn.exe
  C:\Windows\System\lFaHBRn.exe
  2⤵
  PID:3176
- C:\Windows\System\eSgMbbg.exe
  C:\Windows\System\eSgMbbg.exe
  2⤵
  PID:3192
- C:\Windows\System\cfwRIqL.exe
  C:\Windows\System\cfwRIqL.exe
  2⤵
  PID:3212
- C:\Windows\System\RarVYfB.exe
  C:\Windows\System\RarVYfB.exe
  2⤵
  PID:3232
- C:\Windows\System\rTsAvDs.exe
  C:\Windows\System\rTsAvDs.exe
  2⤵
  PID:3248
- C:\Windows\System\czjtkpk.exe
  C:\Windows\System\czjtkpk.exe
  2⤵
  PID:3268
- C:\Windows\System\xpFFJNo.exe
  C:\Windows\System\xpFFJNo.exe
  2⤵
  PID:3284
- C:\Windows\System\ujCzswj.exe
  C:\Windows\System\ujCzswj.exe
  2⤵
  PID:3300
- C:\Windows\System\OEZMrqS.exe
  C:\Windows\System\OEZMrqS.exe
  2⤵
  PID:3316
- C:\Windows\System\RMvLGHO.exe
  C:\Windows\System\RMvLGHO.exe
  2⤵
  PID:3336
- C:\Windows\System\KHeCVnV.exe
  C:\Windows\System\KHeCVnV.exe
  2⤵
  PID:3364
- C:\Windows\System\OFLDQJE.exe
  C:\Windows\System\OFLDQJE.exe
  2⤵
  PID:3384
- C:\Windows\System\ggiVtAW.exe
  C:\Windows\System\ggiVtAW.exe
  2⤵
  PID:3404
- C:\Windows\System\lJzlPeb.exe
  C:\Windows\System\lJzlPeb.exe
  2⤵
  PID:3424
- C:\Windows\System\TossmVH.exe
  C:\Windows\System\TossmVH.exe
  2⤵
  PID:3444
- C:\Windows\System\FiNnZyU.exe
  C:\Windows\System\FiNnZyU.exe
  2⤵
  PID:3464
- C:\Windows\System\zYQZcIN.exe
  C:\Windows\System\zYQZcIN.exe
  2⤵
  PID:3488
- C:\Windows\System\WNGScoN.exe
  C:\Windows\System\WNGScoN.exe
  2⤵
  PID:3512
- C:\Windows\System\uyjKpSX.exe
  C:\Windows\System\uyjKpSX.exe
  2⤵
  PID:3532
- C:\Windows\System\CBZzzZw.exe
  C:\Windows\System\CBZzzZw.exe
  2⤵
  PID:3552
- C:\Windows\System\LRGRjto.exe
  C:\Windows\System\LRGRjto.exe
  2⤵
  PID:3580
- C:\Windows\System\CtLNgTh.exe
  C:\Windows\System\CtLNgTh.exe
  2⤵
  PID:3600
- C:\Windows\System\GsVgtBA.exe
  C:\Windows\System\GsVgtBA.exe
  2⤵
  PID:3620
- C:\Windows\System\eHcwSgL.exe
  C:\Windows\System\eHcwSgL.exe
  2⤵
  PID:3640
- C:\Windows\System\OCCiXFC.exe
  C:\Windows\System\OCCiXFC.exe
  2⤵
  PID:3664
- C:\Windows\System\FkdGNTX.exe
  C:\Windows\System\FkdGNTX.exe
  2⤵
  PID:3684
- C:\Windows\System\QeNiAMz.exe
  C:\Windows\System\QeNiAMz.exe
  2⤵
  PID:3700
- C:\Windows\System\lRtnOWi.exe
  C:\Windows\System\lRtnOWi.exe
  2⤵
  PID:3720
- C:\Windows\System\SMEAwZa.exe
  C:\Windows\System\SMEAwZa.exe
  2⤵
  PID:3740
- C:\Windows\System\EdKdWAe.exe
  C:\Windows\System\EdKdWAe.exe
  2⤵
  PID:3760
- C:\Windows\System\xNCTmJd.exe
  C:\Windows\System\xNCTmJd.exe
  2⤵
  PID:3776
- C:\Windows\System\MULVgjd.exe
  C:\Windows\System\MULVgjd.exe
  2⤵
  PID:3796
- C:\Windows\System\TZLjCGk.exe
  C:\Windows\System\TZLjCGk.exe
  2⤵
  PID:3812
- C:\Windows\System\bYjLRwL.exe
  C:\Windows\System\bYjLRwL.exe
  2⤵
  PID:3828
- C:\Windows\System\EVhOgwq.exe
  C:\Windows\System\EVhOgwq.exe
  2⤵
  PID:3844
- C:\Windows\System\OJMmdBl.exe
  C:\Windows\System\OJMmdBl.exe
  2⤵
  PID:3940
- C:\Windows\System\dZAhrsb.exe
  C:\Windows\System\dZAhrsb.exe
  2⤵
  PID:3960
- C:\Windows\System\voJdMTS.exe
  C:\Windows\System\voJdMTS.exe
  2⤵
  PID:3984
- C:\Windows\System\DdVgRBr.exe
  C:\Windows\System\DdVgRBr.exe
  2⤵
  PID:4008
- C:\Windows\System\IkOSDIS.exe
  C:\Windows\System\IkOSDIS.exe
  2⤵
  PID:4032
- C:\Windows\System\QaKrdOm.exe
  C:\Windows\System\QaKrdOm.exe
  2⤵
  PID:4048
- C:\Windows\System\CbsIAEU.exe
  C:\Windows\System\CbsIAEU.exe
  2⤵
  PID:4064
- C:\Windows\System\CIlMJww.exe
  C:\Windows\System\CIlMJww.exe
  2⤵
  PID:4080
- C:\Windows\System\DgBKPyL.exe
  C:\Windows\System\DgBKPyL.exe
  2⤵
  PID:1864
- C:\Windows\System\GnicHbb.exe
  C:\Windows\System\GnicHbb.exe
  2⤵
  PID:1672
- C:\Windows\System\IMLepxQ.exe
  C:\Windows\System\IMLepxQ.exe
  2⤵
  PID:2032
- C:\Windows\System\kjCHvwC.exe
  C:\Windows\System\kjCHvwC.exe
  2⤵
  PID:1512
- C:\Windows\System\ChuMrFl.exe
  C:\Windows\System\ChuMrFl.exe
  2⤵
  PID:1800
- C:\Windows\System\KsQnUmL.exe
  C:\Windows\System\KsQnUmL.exe
  2⤵
  PID:1756
- C:\Windows\System\JXEVbWQ.exe
  C:\Windows\System\JXEVbWQ.exe
  2⤵
  PID:3088
- C:\Windows\System\XybRCcP.exe
  C:\Windows\System\XybRCcP.exe
  2⤵
  PID:3104
- C:\Windows\System\jVmUEPC.exe
  C:\Windows\System\jVmUEPC.exe
  2⤵
  PID:2952
- C:\Windows\System\dmzDoMm.exe
  C:\Windows\System\dmzDoMm.exe
  2⤵
  PID:876
- C:\Windows\System\vfgCDFj.exe
  C:\Windows\System\vfgCDFj.exe
  2⤵
  PID:2984
- C:\Windows\System\faowEZb.exe
  C:\Windows\System\faowEZb.exe
  2⤵
  PID:704
- C:\Windows\System\vjVTMVo.exe
  C:\Windows\System\vjVTMVo.exe
  2⤵
  PID:2888
- C:\Windows\System\NWjRSyv.exe
  C:\Windows\System\NWjRSyv.exe
  2⤵
  PID:1588
- C:\Windows\System\UoedwQV.exe
  C:\Windows\System\UoedwQV.exe
  2⤵
  PID:2628
- C:\Windows\System\GxnMpex.exe
  C:\Windows\System\GxnMpex.exe
  2⤵
  PID:1668
- C:\Windows\System\mLtMoAu.exe
  C:\Windows\System\mLtMoAu.exe
  2⤵
  PID:2788
- C:\Windows\System\jzNQTGf.exe
  C:\Windows\System\jzNQTGf.exe
  2⤵
  PID:540
- C:\Windows\System\xGDXiwG.exe
  C:\Windows\System\xGDXiwG.exe
  2⤵
  PID:2008
- C:\Windows\System\XuXOjDR.exe
  C:\Windows\System\XuXOjDR.exe
  2⤵
  PID:2920
- C:\Windows\System\KaLNuXW.exe
  C:\Windows\System\KaLNuXW.exe
  2⤵
  PID:2876
- C:\Windows\System\HRDyohw.exe
  C:\Windows\System\HRDyohw.exe
  2⤵
  PID:3220
- C:\Windows\System\NOBtivT.exe
  C:\Windows\System\NOBtivT.exe
  2⤵
  PID:3260
- C:\Windows\System\OyXGqcV.exe
  C:\Windows\System\OyXGqcV.exe
  2⤵
  PID:3328
- C:\Windows\System\PagZCVv.exe
  C:\Windows\System\PagZCVv.exe
  2⤵
  PID:3412
- C:\Windows\System\MrAcQml.exe
  C:\Windows\System\MrAcQml.exe
  2⤵
  PID:3460
- C:\Windows\System\xNazaOB.exe
  C:\Windows\System\xNazaOB.exe
  2⤵
  PID:3508
- C:\Windows\System\GHxnCll.exe
  C:\Windows\System\GHxnCll.exe
  2⤵
  PID:3588
- C:\Windows\System\MHMYwGp.exe
  C:\Windows\System\MHMYwGp.exe
  2⤵
  PID:3064
- C:\Windows\System\gzvrUvx.exe
  C:\Windows\System\gzvrUvx.exe
  2⤵
  PID:2464
- C:\Windows\System\JRhXWqf.exe
  C:\Windows\System\JRhXWqf.exe
  2⤵
  PID:3676
- C:\Windows\System\UlllOCd.exe
  C:\Windows\System\UlllOCd.exe
  2⤵
  PID:3748
- C:\Windows\System\XrwbzoD.exe
  C:\Windows\System\XrwbzoD.exe
  2⤵
  PID:3788
- C:\Windows\System\jkIudAz.exe
  C:\Windows\System\jkIudAz.exe
  2⤵
  PID:3852
- C:\Windows\System\TAaabKI.exe
  C:\Windows\System\TAaabKI.exe
  2⤵
  PID:1664
- C:\Windows\System\FdmJTtb.exe
  C:\Windows\System\FdmJTtb.exe
  2⤵
  PID:3868
- C:\Windows\System\QtXnGiM.exe
  C:\Windows\System\QtXnGiM.exe
  2⤵
  PID:3892
- C:\Windows\System\YAOabkB.exe
  C:\Windows\System\YAOabkB.exe
  2⤵
  PID:3912
- C:\Windows\System\KGDtXRu.exe
  C:\Windows\System\KGDtXRu.exe
  2⤵
  PID:3928
- C:\Windows\System\aPGBjmR.exe
  C:\Windows\System\aPGBjmR.exe
  2⤵
  PID:3968
- C:\Windows\System\zVvWTQq.exe
  C:\Windows\System\zVvWTQq.exe
  2⤵
  PID:2548
- C:\Windows\System\ameXNxs.exe
  C:\Windows\System\ameXNxs.exe
  2⤵
  PID:2592
- C:\Windows\System\bodHaGo.exe
  C:\Windows\System\bodHaGo.exe
  2⤵
  PID:4092
- C:\Windows\System\QBgFuav.exe
  C:\Windows\System\QBgFuav.exe
  2⤵
  PID:2148
- C:\Windows\System\WgyvePY.exe
  C:\Windows\System\WgyvePY.exe
  2⤵
  PID:3076
- C:\Windows\System\ESWrnIS.exe
  C:\Windows\System\ESWrnIS.exe
  2⤵
  PID:3116
- C:\Windows\System\TeYsavz.exe
  C:\Windows\System\TeYsavz.exe
  2⤵
  PID:2576
- C:\Windows\System\wQHaRAY.exe
  C:\Windows\System\wQHaRAY.exe
  2⤵
  PID:1916
- C:\Windows\System\dDGcHJU.exe
  C:\Windows\System\dDGcHJU.exe
  2⤵
  PID:3240
- C:\Windows\System\cCbtpfq.exe
  C:\Windows\System\cCbtpfq.exe
  2⤵
  PID:3308
- C:\Windows\System\QHpuvwi.exe
  C:\Windows\System\QHpuvwi.exe
  2⤵
  PID:3356
- C:\Windows\System\DWWOhCe.exe
  C:\Windows\System\DWWOhCe.exe
  2⤵
  PID:2208
- C:\Windows\System\crtqEvz.exe
  C:\Windows\System\crtqEvz.exe
  2⤵
  PID:3480
- C:\Windows\System\VuMGBUO.exe
  C:\Windows\System\VuMGBUO.exe
  2⤵
  PID:3224
- C:\Windows\System\THJNNTk.exe
  C:\Windows\System\THJNNTk.exe
  2⤵
  PID:3500
- C:\Windows\System\NlTBZzR.exe
  C:\Windows\System\NlTBZzR.exe
  2⤵
  PID:3564
- C:\Windows\System\RIuMNfu.exe
  C:\Windows\System\RIuMNfu.exe
  2⤵
  PID:3608
- C:\Windows\System\QiTwgEF.exe
  C:\Windows\System\QiTwgEF.exe
  2⤵
  PID:2480
- C:\Windows\System\qOpkPiw.exe
  C:\Windows\System\qOpkPiw.exe
  2⤵
  PID:3732
- C:\Windows\System\ftFnHvS.exe
  C:\Windows\System\ftFnHvS.exe
  2⤵
  PID:3808
- C:\Windows\System\wILGXjY.exe
  C:\Windows\System\wILGXjY.exe
  2⤵
  PID:3952
- C:\Windows\System\kcCZFcp.exe
  C:\Windows\System\kcCZFcp.exe
  2⤵
  PID:3596
- C:\Windows\System\hPZjLUs.exe
  C:\Windows\System\hPZjLUs.exe
  2⤵
  PID:3784
- C:\Windows\System\pUBLYeJ.exe
  C:\Windows\System\pUBLYeJ.exe
  2⤵
  PID:3880
- C:\Windows\System\XjBOLXH.exe
  C:\Windows\System\XjBOLXH.exe
  2⤵
  PID:3920
- C:\Windows\System\PhVPIzi.exe
  C:\Windows\System\PhVPIzi.exe
  2⤵
  PID:2468
- C:\Windows\System\YmgNoqJ.exe
  C:\Windows\System\YmgNoqJ.exe
  2⤵
  PID:2748
- C:\Windows\System\HMtKWUN.exe
  C:\Windows\System\HMtKWUN.exe
  2⤵
  PID:3164
- C:\Windows\System\SCFwpRr.exe
  C:\Windows\System\SCFwpRr.exe
  2⤵
  PID:3372
- C:\Windows\System\ytmrkAI.exe
  C:\Windows\System\ytmrkAI.exe
  2⤵
  PID:3576
- C:\Windows\System\eKegoin.exe
  C:\Windows\System\eKegoin.exe
  2⤵
  PID:3840
- C:\Windows\System\PjmjEFF.exe
  C:\Windows\System\PjmjEFF.exe
  2⤵
  PID:3672
- C:\Windows\System\qdWsSOj.exe
  C:\Windows\System\qdWsSOj.exe
  2⤵
  PID:4060
- C:\Windows\System\CMurFRj.exe
  C:\Windows\System\CMurFRj.exe
  2⤵
  PID:4132
- C:\Windows\System\QLLcCSz.exe
  C:\Windows\System\QLLcCSz.exe
  2⤵
  PID:4148
- C:\Windows\System\MMXVNZD.exe
  C:\Windows\System\MMXVNZD.exe
  2⤵
  PID:4172
- C:\Windows\System\mMytQSm.exe
  C:\Windows\System\mMytQSm.exe
  2⤵
  PID:4220
- C:\Windows\System\sNlccND.exe
  C:\Windows\System\sNlccND.exe
  2⤵
  PID:4248
- C:\Windows\System\NaHzVVd.exe
  C:\Windows\System\NaHzVVd.exe
  2⤵
  PID:4264
- C:\Windows\System\qdSxwRF.exe
  C:\Windows\System\qdSxwRF.exe
  2⤵
  PID:4284
- C:\Windows\System\dCTtxtN.exe
  C:\Windows\System\dCTtxtN.exe
  2⤵
  PID:4300
- C:\Windows\System\akVKGse.exe
  C:\Windows\System\akVKGse.exe
  2⤵
  PID:4320
- C:\Windows\System\yzcCdQh.exe
  C:\Windows\System\yzcCdQh.exe
  2⤵
  PID:4336
- C:\Windows\System\aGxHxRd.exe
  C:\Windows\System\aGxHxRd.exe
  2⤵
  PID:4360
- C:\Windows\System\DjdHMTq.exe
  C:\Windows\System\DjdHMTq.exe
  2⤵
  PID:4376
- C:\Windows\System\cHIRPSb.exe
  C:\Windows\System\cHIRPSb.exe
  2⤵
  PID:4392
- C:\Windows\System\lsAdEmq.exe
  C:\Windows\System\lsAdEmq.exe
  2⤵
  PID:4416
- C:\Windows\System\elcUKpw.exe
  C:\Windows\System\elcUKpw.exe
  2⤵
  PID:4432
- C:\Windows\System\EYciIku.exe
  C:\Windows\System\EYciIku.exe
  2⤵
  PID:4452
- C:\Windows\System\ZwNJhfy.exe
  C:\Windows\System\ZwNJhfy.exe
  2⤵
  PID:4484
- C:\Windows\System\YlmiuUE.exe
  C:\Windows\System\YlmiuUE.exe
  2⤵
  PID:4504
- C:\Windows\System\GNBuARZ.exe
  C:\Windows\System\GNBuARZ.exe
  2⤵
  PID:4520
- C:\Windows\System\sfjzvaw.exe
  C:\Windows\System\sfjzvaw.exe
  2⤵
  PID:4544
- C:\Windows\System\Cdanbav.exe
  C:\Windows\System\Cdanbav.exe
  2⤵
  PID:4564
- C:\Windows\System\muxQATw.exe
  C:\Windows\System\muxQATw.exe
  2⤵
  PID:4580
- C:\Windows\System\UItlqgp.exe
  C:\Windows\System\UItlqgp.exe
  2⤵
  PID:4608
- C:\Windows\System\jwNbgnc.exe
  C:\Windows\System\jwNbgnc.exe
  2⤵
  PID:4624
- C:\Windows\System\YMzGPrk.exe
  C:\Windows\System\YMzGPrk.exe
  2⤵
  PID:4640
- C:\Windows\System\tZxXpEP.exe
  C:\Windows\System\tZxXpEP.exe
  2⤵
  PID:4656
- C:\Windows\System\eYgGBqp.exe
  C:\Windows\System\eYgGBqp.exe
  2⤵
  PID:4672
- C:\Windows\System\NRDQxFs.exe
  C:\Windows\System\NRDQxFs.exe
  2⤵
  PID:4688
- C:\Windows\System\EOlWcZE.exe
  C:\Windows\System\EOlWcZE.exe
  2⤵
  PID:4704
- C:\Windows\System\LgqSNcD.exe
  C:\Windows\System\LgqSNcD.exe
  2⤵
  PID:4720
- C:\Windows\System\cMQGhoP.exe
  C:\Windows\System\cMQGhoP.exe
  2⤵
  PID:4736
- C:\Windows\System\AByILYG.exe
  C:\Windows\System\AByILYG.exe
  2⤵
  PID:4752
- C:\Windows\System\mEQvXkx.exe
  C:\Windows\System\mEQvXkx.exe
  2⤵
  PID:4768
- C:\Windows\System\PFYIidM.exe
  C:\Windows\System\PFYIidM.exe
  2⤵
  PID:4784
- C:\Windows\System\BwbGThH.exe
  C:\Windows\System\BwbGThH.exe
  2⤵
  PID:4800
- C:\Windows\System\cJuFGpZ.exe
  C:\Windows\System\cJuFGpZ.exe
  2⤵
  PID:4816
- C:\Windows\System\uNDQkEF.exe
  C:\Windows\System\uNDQkEF.exe
  2⤵
  PID:4832
- C:\Windows\System\LogURJj.exe
  C:\Windows\System\LogURJj.exe
  2⤵
  PID:4848
- C:\Windows\System\NacLpmO.exe
  C:\Windows\System\NacLpmO.exe
  2⤵
  PID:4864
- C:\Windows\System\sggRAgR.exe
  C:\Windows\System\sggRAgR.exe
  2⤵
  PID:4880
- C:\Windows\System\xoZkJJz.exe
  C:\Windows\System\xoZkJJz.exe
  2⤵
  PID:4896
- C:\Windows\System\bLgeckA.exe
  C:\Windows\System\bLgeckA.exe
  2⤵
  PID:4912
- C:\Windows\System\IyaJigp.exe
  C:\Windows\System\IyaJigp.exe
  2⤵
  PID:4928
- C:\Windows\System\OfdtHLu.exe
  C:\Windows\System\OfdtHLu.exe
  2⤵
  PID:4944
- C:\Windows\System\FGFthWi.exe
  C:\Windows\System\FGFthWi.exe
  2⤵
  PID:4960
- C:\Windows\System\LXKdlJp.exe
  C:\Windows\System\LXKdlJp.exe
  2⤵
  PID:4976
- C:\Windows\System\LhXnNRk.exe
  C:\Windows\System\LhXnNRk.exe
  2⤵
  PID:4992
- C:\Windows\System\cyVGqSU.exe
  C:\Windows\System\cyVGqSU.exe
  2⤵
  PID:5008
- C:\Windows\System\obEYwOa.exe
  C:\Windows\System\obEYwOa.exe
  2⤵
  PID:5028
- C:\Windows\System\tYtKgOo.exe
  C:\Windows\System\tYtKgOo.exe
  2⤵
  PID:5044
- C:\Windows\System\zshFpCO.exe
  C:\Windows\System\zshFpCO.exe
  2⤵
  PID:5060
- C:\Windows\System\OwtoRQX.exe
  C:\Windows\System\OwtoRQX.exe
  2⤵
  PID:5076
- C:\Windows\System\TKbmqLB.exe
  C:\Windows\System\TKbmqLB.exe
  2⤵
  PID:5092
- C:\Windows\System\NdovWmV.exe
  C:\Windows\System\NdovWmV.exe
  2⤵
  PID:5108
- C:\Windows\System\CBjAGbP.exe
  C:\Windows\System\CBjAGbP.exe
  2⤵
  PID:2736
- C:\Windows\System\jaGiwkB.exe
  C:\Windows\System\jaGiwkB.exe
  2⤵
  PID:3696
- C:\Windows\System\MAqXUlh.exe
  C:\Windows\System\MAqXUlh.exe
  2⤵
  PID:4144
- C:\Windows\System\vnVLgYb.exe
  C:\Windows\System\vnVLgYb.exe
  2⤵
  PID:4192
- C:\Windows\System\OSdlLFz.exe
  C:\Windows\System\OSdlLFz.exe
  2⤵
  PID:4204
- C:\Windows\System\DcyeWqd.exe
  C:\Windows\System\DcyeWqd.exe
  2⤵
  PID:2460
- C:\Windows\System\yYZvmTM.exe
  C:\Windows\System\yYZvmTM.exe
  2⤵
  PID:1676
- C:\Windows\System\cWqGbNK.exe
  C:\Windows\System\cWqGbNK.exe
  2⤵
  PID:4256
- C:\Windows\System\DsSrhsP.exe
  C:\Windows\System\DsSrhsP.exe
  2⤵
  PID:4292
- C:\Windows\System\JEDxBui.exe
  C:\Windows\System\JEDxBui.exe
  2⤵
  PID:3456
- C:\Windows\System\hjouCJf.exe
  C:\Windows\System\hjouCJf.exe
  2⤵
  PID:1036
- C:\Windows\System\vytNesI.exe
  C:\Windows\System\vytNesI.exe
  2⤵
  PID:1572
- C:\Windows\System\JtuWXCV.exe
  C:\Windows\System\JtuWXCV.exe
  2⤵
  PID:3824
- C:\Windows\System\WihpcRb.exe
  C:\Windows\System\WihpcRb.exe
  2⤵
  PID:4400
- C:\Windows\System\jnMLoYQ.exe
  C:\Windows\System\jnMLoYQ.exe
  2⤵
  PID:4440
- C:\Windows\System\glzhgRd.exe
  C:\Windows\System\glzhgRd.exe
  2⤵
  PID:3904
- C:\Windows\System\YKYnpzt.exe
  C:\Windows\System\YKYnpzt.exe
  2⤵
  PID:4496
- C:\Windows\System\UsldkHT.exe
  C:\Windows\System\UsldkHT.exe
  2⤵
  PID:4536
- C:\Windows\System\bonScZp.exe
  C:\Windows\System\bonScZp.exe
  2⤵
  PID:4024
- C:\Windows\System\HvNMZtq.exe
  C:\Windows\System\HvNMZtq.exe
  2⤵
  PID:4540
- C:\Windows\System\AyvnwLL.exe
  C:\Windows\System\AyvnwLL.exe
  2⤵
  PID:3084
- C:\Windows\System\CqWONaG.exe
  C:\Windows\System\CqWONaG.exe
  2⤵
  PID:584
- C:\Windows\System\RgSgrTU.exe
  C:\Windows\System\RgSgrTU.exe
  2⤵
  PID:3392
- C:\Windows\System\SaeJBcR.exe
  C:\Windows\System\SaeJBcR.exe
  2⤵
  PID:3436
- C:\Windows\System\baYpqYv.exe
  C:\Windows\System\baYpqYv.exe
  2⤵
  PID:3528
- C:\Windows\System\oJliXvs.exe
  C:\Windows\System\oJliXvs.exe
  2⤵
  PID:3652
- C:\Windows\System\oeFYEac.exe
  C:\Windows\System\oeFYEac.exe
  2⤵
  PID:3804
- C:\Windows\System\mjeIMGl.exe
  C:\Windows\System\mjeIMGl.exe
  2⤵
  PID:3476
- C:\Windows\System\SZtzjii.exe
  C:\Windows\System\SZtzjii.exe
  2⤵
  PID:3980
- C:\Windows\System\ALFzFJS.exe
  C:\Windows\System\ALFzFJS.exe
  2⤵
  PID:2240
- C:\Windows\System\SqwSvVb.exe
  C:\Windows\System\SqwSvVb.exe
  2⤵
  PID:3208
- C:\Windows\System\ZsXvKmF.exe
  C:\Windows\System\ZsXvKmF.exe
  2⤵
  PID:2348
- C:\Windows\System\dLYSqkE.exe
  C:\Windows\System\dLYSqkE.exe
  2⤵
  PID:4108
- C:\Windows\System\rsdiSPP.exe
  C:\Windows\System\rsdiSPP.exe
  2⤵
  PID:4124
- C:\Windows\System\qdpbxEI.exe
  C:\Windows\System\qdpbxEI.exe
  2⤵
  PID:1624
- C:\Windows\System\lRwnval.exe
  C:\Windows\System\lRwnval.exe
  2⤵
  PID:4164
- C:\Windows\System\OyOuorG.exe
  C:\Windows\System\OyOuorG.exe
  2⤵
  PID:2264
- C:\Windows\System\XdFPYKZ.exe
  C:\Windows\System\XdFPYKZ.exe
  2⤵
  PID:3152
- C:\Windows\System\wjvlWWV.exe
  C:\Windows\System\wjvlWWV.exe
  2⤵
  PID:1652
- C:\Windows\System\OOXgWvA.exe
  C:\Windows\System\OOXgWvA.exe
  2⤵
  PID:4240
- C:\Windows\System\DlohZZp.exe
  C:\Windows\System\DlohZZp.exe
  2⤵
  PID:4308
- C:\Windows\System\YmQeBwB.exe
  C:\Windows\System\YmQeBwB.exe
  2⤵
  PID:4352
- C:\Windows\System\vnRIHJR.exe
  C:\Windows\System\vnRIHJR.exe
  2⤵
  PID:1632
- C:\Windows\System\mezumaz.exe
  C:\Windows\System\mezumaz.exe
  2⤵
  PID:3452
- C:\Windows\System\NabPFcO.exe
  C:\Windows\System\NabPFcO.exe
  2⤵
  PID:4464
- C:\Windows\System\uzAzhmH.exe
  C:\Windows\System\uzAzhmH.exe
  2⤵
  PID:4480
- C:\Windows\System\WeLVuMt.exe
  C:\Windows\System\WeLVuMt.exe
  2⤵
  PID:4652
- C:\Windows\System\MDfiETj.exe
  C:\Windows\System\MDfiETj.exe
  2⤵
  PID:4604
- C:\Windows\System\raqDEnE.exe
  C:\Windows\System\raqDEnE.exe
  2⤵
  PID:4716
- C:\Windows\System\aDqxMpH.exe
  C:\Windows\System\aDqxMpH.exe
  2⤵
  PID:4748
- C:\Windows\System\mXgwttw.exe
  C:\Windows\System\mXgwttw.exe
  2⤵
  PID:4812
- C:\Windows\System\SaPPPhM.exe
  C:\Windows\System\SaPPPhM.exe
  2⤵
  PID:4668
- C:\Windows\System\zpWnTGi.exe
  C:\Windows\System\zpWnTGi.exe
  2⤵
  PID:4876
- C:\Windows\System\dIOhOYI.exe
  C:\Windows\System\dIOhOYI.exe
  2⤵
  PID:3616
- C:\Windows\System\tZyzmqd.exe
  C:\Windows\System\tZyzmqd.exe
  2⤵
  PID:4764
- C:\Windows\System\JDJyYCi.exe
  C:\Windows\System\JDJyYCi.exe
  2⤵
  PID:4968
- C:\Windows\System\WdCmlGf.exe
  C:\Windows\System\WdCmlGf.exe
  2⤵
  PID:5036
- C:\Windows\System\WGrIMut.exe
  C:\Windows\System\WGrIMut.exe
  2⤵
  PID:5104
- C:\Windows\System\KtWWIXU.exe
  C:\Windows\System\KtWWIXU.exe
  2⤵
  PID:4184
- C:\Windows\System\XvpoWPq.exe
  C:\Windows\System\XvpoWPq.exe
  2⤵
  PID:3188
- C:\Windows\System\alBeZVZ.exe
  C:\Windows\System\alBeZVZ.exe
  2⤵
  PID:3712
- C:\Windows\System\VFGjLpx.exe
  C:\Windows\System\VFGjLpx.exe
  2⤵
  PID:4448
- C:\Windows\System\pSzyFqk.exe
  C:\Windows\System\pSzyFqk.exe
  2⤵
  PID:1972
- C:\Windows\System\WbVxDPW.exe
  C:\Windows\System\WbVxDPW.exe
  2⤵
  PID:2412
- C:\Windows\System\XSXzPnl.exe
  C:\Windows\System\XSXzPnl.exe
  2⤵
  PID:3432
- C:\Windows\System\iSDhurx.exe
  C:\Windows\System\iSDhurx.exe
  2⤵
  PID:1812
- C:\Windows\System\inBtndD.exe
  C:\Windows\System\inBtndD.exe
  2⤵
  PID:3380
- C:\Windows\System\daWOhaA.exe
  C:\Windows\System\daWOhaA.exe
  2⤵
  PID:4160
- C:\Windows\System\LgyTMrC.exe
  C:\Windows\System\LgyTMrC.exe
  2⤵
  PID:4792
- C:\Windows\System\lHluHvv.exe
  C:\Windows\System\lHluHvv.exe
  2⤵
  PID:4892
- C:\Windows\System\pevqoCW.exe
  C:\Windows\System\pevqoCW.exe
  2⤵
  PID:2724
- C:\Windows\System\PTVRSip.exe
  C:\Windows\System\PTVRSip.exe
  2⤵
  PID:4988
- C:\Windows\System\VeCwlKl.exe
  C:\Windows\System\VeCwlKl.exe
  2⤵
  PID:4236
- C:\Windows\System\mgzkOjf.exe
  C:\Windows\System\mgzkOjf.exe
  2⤵
  PID:4388
- C:\Windows\System\dSXWSsE.exe
  C:\Windows\System\dSXWSsE.exe
  2⤵
  PID:4600
- C:\Windows\System\KckyDnU.exe
  C:\Windows\System\KckyDnU.exe
  2⤵
  PID:4664
- C:\Windows\System\ZARqGDh.exe
  C:\Windows\System\ZARqGDh.exe
  2⤵
  PID:4940
- C:\Windows\System\DIXHmXN.exe
  C:\Windows\System\DIXHmXN.exe
  2⤵
  PID:1752
- C:\Windows\System\xsCSsln.exe
  C:\Windows\System\xsCSsln.exe
  2⤵
  PID:5084
- C:\Windows\System\HgkSeXF.exe
  C:\Windows\System\HgkSeXF.exe
  2⤵
  PID:4208
- C:\Windows\System\fszHaHN.exe
  C:\Windows\System\fszHaHN.exe
  2⤵
  PID:3872
- C:\Windows\System\hNOVElf.exe
  C:\Windows\System\hNOVElf.exe
  2⤵
  PID:4200
- C:\Windows\System\FOMvRwo.exe
  C:\Windows\System\FOMvRwo.exe
  2⤵
  PID:3420
- C:\Windows\System\LpmyiOx.exe
  C:\Windows\System\LpmyiOx.exe
  2⤵
  PID:4560
- C:\Windows\System\WclIQif.exe
  C:\Windows\System\WclIQif.exe
  2⤵
  PID:4596
- C:\Windows\System\hxhgJrn.exe
  C:\Windows\System\hxhgJrn.exe
  2⤵
  PID:788
- C:\Windows\System\UgHyFso.exe
  C:\Windows\System\UgHyFso.exe
  2⤵
  PID:4044
- C:\Windows\System\VgmUawk.exe
  C:\Windows\System\VgmUawk.exe
  2⤵
  PID:1236
- C:\Windows\System\hHhndOP.exe
  C:\Windows\System\hHhndOP.exe
  2⤵
  PID:3204
- C:\Windows\System\MNJGATQ.exe
  C:\Windows\System\MNJGATQ.exe
  2⤵
  PID:4956
- C:\Windows\System\EoPJLJW.exe
  C:\Windows\System\EoPJLJW.exe
  2⤵
  PID:4844
- C:\Windows\System\fIumOZw.exe
  C:\Windows\System\fIumOZw.exe
  2⤵
  PID:1804
- C:\Windows\System\sUixPQS.exe
  C:\Windows\System\sUixPQS.exe
  2⤵
  PID:1988
- C:\Windows\System\NJNSqzR.exe
  C:\Windows\System\NJNSqzR.exe
  2⤵
  PID:4276
- C:\Windows\System\adXYosx.exe
  C:\Windows\System\adXYosx.exe
  2⤵
  PID:4428
- C:\Windows\System\JKnYoYS.exe
  C:\Windows\System\JKnYoYS.exe
  2⤵
  PID:4684
- C:\Windows\System\EvpGovM.exe
  C:\Windows\System\EvpGovM.exe
  2⤵
  PID:3648
- C:\Windows\System\RmuJpMk.exe
  C:\Windows\System\RmuJpMk.exe
  2⤵
  PID:4732
- C:\Windows\System\VWxJakZ.exe
  C:\Windows\System\VWxJakZ.exe
  2⤵
  PID:4808
- C:\Windows\System\lULjzwR.exe
  C:\Windows\System\lULjzwR.exe
  2⤵
  PID:4860
- C:\Windows\System\BTUSwdI.exe
  C:\Windows\System\BTUSwdI.exe
  2⤵
  PID:2164
- C:\Windows\System\xSZvqBV.exe
  C:\Windows\System\xSZvqBV.exe
  2⤵
  PID:4228
- C:\Windows\System\iqBxoUs.exe
  C:\Windows\System\iqBxoUs.exe
  2⤵
  PID:4372
- C:\Windows\System\ekjUKHp.exe
  C:\Windows\System\ekjUKHp.exe
  2⤵
  PID:3660
- C:\Windows\System\fzSVtYU.exe
  C:\Windows\System\fzSVtYU.exe
  2⤵
  PID:1956
- C:\Windows\System\PeLvgVB.exe
  C:\Windows\System\PeLvgVB.exe
  2⤵
  PID:5016
- C:\Windows\System\CeTnzxO.exe
  C:\Windows\System\CeTnzxO.exe
  2⤵
  PID:2896
- C:\Windows\System\oUKmczD.exe
  C:\Windows\System\oUKmczD.exe
  2⤵
  PID:4516
- C:\Windows\System\AiyrFMY.exe
  C:\Windows\System\AiyrFMY.exe
  2⤵
  PID:1532
- C:\Windows\System\KZhUzZd.exe
  C:\Windows\System\KZhUzZd.exe
  2⤵
  PID:2484
- C:\Windows\System\FeYFOwk.exe
  C:\Windows\System\FeYFOwk.exe
  2⤵
  PID:4872
- C:\Windows\System\CHnFuCb.exe
  C:\Windows\System\CHnFuCb.exe
  2⤵
  PID:5136
- C:\Windows\System\LCDTjqi.exe
  C:\Windows\System\LCDTjqi.exe
  2⤵
  PID:5152
- C:\Windows\System\btfdQBU.exe
  C:\Windows\System\btfdQBU.exe
  2⤵
  PID:5168
- C:\Windows\System\ATmOYjh.exe
  C:\Windows\System\ATmOYjh.exe
  2⤵
  PID:5184
- C:\Windows\System\fjWLzPq.exe
  C:\Windows\System\fjWLzPq.exe
  2⤵
  PID:5200
- C:\Windows\System\uXiZVyp.exe
  C:\Windows\System\uXiZVyp.exe
  2⤵
  PID:5216
- C:\Windows\System\plWnYxy.exe
  C:\Windows\System\plWnYxy.exe
  2⤵
  PID:5232
- C:\Windows\System\lyAVQGB.exe
  C:\Windows\System\lyAVQGB.exe
  2⤵
  PID:5248
- C:\Windows\System\EwJBWtz.exe
  C:\Windows\System\EwJBWtz.exe
  2⤵
  PID:5264
- C:\Windows\System\KbKXnNy.exe
  C:\Windows\System\KbKXnNy.exe
  2⤵
  PID:5280
- C:\Windows\System\PdqOPuM.exe
  C:\Windows\System\PdqOPuM.exe
  2⤵
  PID:5296
- C:\Windows\System\QHPZifN.exe
  C:\Windows\System\QHPZifN.exe
  2⤵
  PID:5312
- C:\Windows\System\QSdCAge.exe
  C:\Windows\System\QSdCAge.exe
  2⤵
  PID:5328
- C:\Windows\System\klWfOBp.exe
  C:\Windows\System\klWfOBp.exe
  2⤵
  PID:5344
- C:\Windows\System\pSJgwgg.exe
  C:\Windows\System\pSJgwgg.exe
  2⤵
  PID:5360
- C:\Windows\System\aIkLMeJ.exe
  C:\Windows\System\aIkLMeJ.exe
  2⤵
  PID:5376
- C:\Windows\System\QiYBEGj.exe
  C:\Windows\System\QiYBEGj.exe
  2⤵
  PID:5392
- C:\Windows\System\agpTHtz.exe
  C:\Windows\System\agpTHtz.exe
  2⤵
  PID:5408
- C:\Windows\System\cGQLSGs.exe
  C:\Windows\System\cGQLSGs.exe
  2⤵
  PID:5424
- C:\Windows\System\GbyoCUy.exe
  C:\Windows\System\GbyoCUy.exe
  2⤵
  PID:5440
- C:\Windows\System\CYbrrNz.exe
  C:\Windows\System\CYbrrNz.exe
  2⤵
  PID:5460
- C:\Windows\System\kwyRXBo.exe
  C:\Windows\System\kwyRXBo.exe
  2⤵
  PID:5476
- C:\Windows\System\MOynqmS.exe
  C:\Windows\System\MOynqmS.exe
  2⤵
  PID:5492
- C:\Windows\System\bbOlDzu.exe
  C:\Windows\System\bbOlDzu.exe
  2⤵
  PID:5508
- C:\Windows\System\nItJcWx.exe
  C:\Windows\System\nItJcWx.exe
  2⤵
  PID:5524
- C:\Windows\System\nsvbNXg.exe
  C:\Windows\System\nsvbNXg.exe
  2⤵
  PID:5540
- C:\Windows\System\nAwAzkG.exe
  C:\Windows\System\nAwAzkG.exe
  2⤵
  PID:5556
- C:\Windows\System\uZZoxZs.exe
  C:\Windows\System\uZZoxZs.exe
  2⤵
  PID:5572
- C:\Windows\System\MYDaFmy.exe
  C:\Windows\System\MYDaFmy.exe
  2⤵
  PID:5588
- C:\Windows\System\YdpSiir.exe
  C:\Windows\System\YdpSiir.exe
  2⤵
  PID:5604
- C:\Windows\System\OeOWQwm.exe
  C:\Windows\System\OeOWQwm.exe
  2⤵
  PID:5620
- C:\Windows\System\SbJcOOp.exe
  C:\Windows\System\SbJcOOp.exe
  2⤵
  PID:5636
- C:\Windows\System\kcIMMMd.exe
  C:\Windows\System\kcIMMMd.exe
  2⤵
  PID:5652
- C:\Windows\System\vatMWSp.exe
  C:\Windows\System\vatMWSp.exe
  2⤵
  PID:5668
- C:\Windows\System\mcwpwhZ.exe
  C:\Windows\System\mcwpwhZ.exe
  2⤵
  PID:5684
- C:\Windows\System\IEGGBer.exe
  C:\Windows\System\IEGGBer.exe
  2⤵
  PID:5700
- C:\Windows\System\exHwtUz.exe
  C:\Windows\System\exHwtUz.exe
  2⤵
  PID:5720
- C:\Windows\System\CJnLJlG.exe
  C:\Windows\System\CJnLJlG.exe
  2⤵
  PID:5736
- C:\Windows\System\mAiWFGz.exe
  C:\Windows\System\mAiWFGz.exe
  2⤵
  PID:5752
- C:\Windows\System\zyZkITB.exe
  C:\Windows\System\zyZkITB.exe
  2⤵
  PID:5768
- C:\Windows\System\sbkwpyU.exe
  C:\Windows\System\sbkwpyU.exe
  2⤵
  PID:5788
- C:\Windows\System\gcFebaq.exe
  C:\Windows\System\gcFebaq.exe
  2⤵
  PID:5804
- C:\Windows\System\KDmlFXG.exe
  C:\Windows\System\KDmlFXG.exe
  2⤵
  PID:5820
- C:\Windows\System\eTznFKb.exe
  C:\Windows\System\eTznFKb.exe
  2⤵
  PID:5836
- C:\Windows\System\gQSDBIJ.exe
  C:\Windows\System\gQSDBIJ.exe
  2⤵
  PID:5852
- C:\Windows\System\iJayNaw.exe
  C:\Windows\System\iJayNaw.exe
  2⤵
  PID:5868
- C:\Windows\System\gajVnfz.exe
  C:\Windows\System\gajVnfz.exe
  2⤵
  PID:5884
- C:\Windows\System\RfeGygZ.exe
  C:\Windows\System\RfeGygZ.exe
  2⤵
  PID:5908
- C:\Windows\System\ddVvwBH.exe
  C:\Windows\System\ddVvwBH.exe
  2⤵
  PID:5924
- C:\Windows\System\TjJHGIk.exe
  C:\Windows\System\TjJHGIk.exe
  2⤵
  PID:5940
- C:\Windows\System\DPXQhZk.exe
  C:\Windows\System\DPXQhZk.exe
  2⤵
  PID:5956
- C:\Windows\System\pMDBKuq.exe
  C:\Windows\System\pMDBKuq.exe
  2⤵
  PID:5972
- C:\Windows\System\rKujvci.exe
  C:\Windows\System\rKujvci.exe
  2⤵
  PID:5988
- C:\Windows\System\cjayZgt.exe
  C:\Windows\System\cjayZgt.exe
  2⤵
  PID:6004
- C:\Windows\System\BIExzYe.exe
  C:\Windows\System\BIExzYe.exe
  2⤵
  PID:6020
- C:\Windows\System\LccHAuN.exe
  C:\Windows\System\LccHAuN.exe
  2⤵
  PID:6036
- C:\Windows\System\igIJiXP.exe
  C:\Windows\System\igIJiXP.exe
  2⤵
  PID:6052
- C:\Windows\System\tibHUWi.exe
  C:\Windows\System\tibHUWi.exe
  2⤵
  PID:6068
- C:\Windows\System\lNKJIbj.exe
  C:\Windows\System\lNKJIbj.exe
  2⤵
  PID:6084
- C:\Windows\System\NWAEtzv.exe
  C:\Windows\System\NWAEtzv.exe
  2⤵
  PID:6100
- C:\Windows\System\VWpqaoK.exe
  C:\Windows\System\VWpqaoK.exe
  2⤵
  PID:6116
- C:\Windows\System\DBmDmkP.exe
  C:\Windows\System\DBmDmkP.exe
  2⤵
  PID:6132
- C:\Windows\System\HgzWUXO.exe
  C:\Windows\System\HgzWUXO.exe
  2⤵
  PID:2956
- C:\Windows\System\MRxCqSk.exe
  C:\Windows\System\MRxCqSk.exe
  2⤵
  PID:2256
- C:\Windows\System\tPeCrxz.exe
  C:\Windows\System\tPeCrxz.exe
  2⤵
  PID:5132
- C:\Windows\System\UGdGIFI.exe
  C:\Windows\System\UGdGIFI.exe
  2⤵
  PID:4244
- C:\Windows\System\buJotPX.exe
  C:\Windows\System\buJotPX.exe
  2⤵
  PID:2872
- C:\Windows\System\zPZyVMC.exe
  C:\Windows\System\zPZyVMC.exe
  2⤵
  PID:1968
- C:\Windows\System\HPdaARj.exe
  C:\Windows\System\HPdaARj.exe
  2⤵
  PID:4576
- C:\Windows\System\drynRlW.exe
  C:\Windows\System\drynRlW.exe
  2⤵
  PID:4344
- C:\Windows\System\jbkSBYx.exe
  C:\Windows\System\jbkSBYx.exe
  2⤵
  PID:4076
- C:\Windows\System\bpazwqg.exe
  C:\Windows\System\bpazwqg.exe
  2⤵
  PID:5256
- C:\Windows\System\wuIOPTl.exe
  C:\Windows\System\wuIOPTl.exe
  2⤵
  PID:5320
- C:\Windows\System\gsVBhmq.exe
  C:\Windows\System\gsVBhmq.exe
  2⤵
  PID:1992
- C:\Windows\System\TndPbfh.exe
  C:\Windows\System\TndPbfh.exe
  2⤵
  PID:5356
- C:\Windows\System\UmrOTRX.exe
  C:\Windows\System\UmrOTRX.exe
  2⤵
  PID:5388
- C:\Windows\System\QvJLwBZ.exe
  C:\Windows\System\QvJLwBZ.exe
  2⤵
  PID:4104
- C:\Windows\System\aEGgMeI.exe
  C:\Windows\System\aEGgMeI.exe
  2⤵
  PID:3728
- C:\Windows\System\KtKOYxH.exe
  C:\Windows\System\KtKOYxH.exe
  2⤵
  PID:5452
- C:\Windows\System\SJJfhad.exe
  C:\Windows\System\SJJfhad.exe
  2⤵
  PID:5208
- C:\Windows\System\EBOmAwh.exe
  C:\Windows\System\EBOmAwh.exe
  2⤵
  PID:5272
- C:\Windows\System\azFFeeR.exe
  C:\Windows\System\azFFeeR.exe
  2⤵
  PID:5308
- C:\Windows\System\NARCWGg.exe
  C:\Windows\System\NARCWGg.exe
  2⤵
  PID:4760
- C:\Windows\System\PzhRTyq.exe
  C:\Windows\System\PzhRTyq.exe
  2⤵
  PID:4824
- C:\Windows\System\CNAdncs.exe
  C:\Windows\System\CNAdncs.exe
  2⤵
  PID:5400
- C:\Windows\System\YbKqPIw.exe
  C:\Windows\System\YbKqPIw.exe
  2⤵
  PID:5612
- C:\Windows\System\lKiatTU.exe
  C:\Windows\System\lKiatTU.exe
  2⤵
  PID:5648
- C:\Windows\System\QiYcQzs.exe
  C:\Windows\System\QiYcQzs.exe
  2⤵
  PID:5680
- C:\Windows\System\wlnHdJU.exe
  C:\Windows\System\wlnHdJU.exe
  2⤵
  PID:5716
- C:\Windows\System\LYKYrie.exe
  C:\Windows\System\LYKYrie.exe
  2⤵
  PID:2864
- C:\Windows\System\DSFjCeA.exe
  C:\Windows\System\DSFjCeA.exe
  2⤵
  PID:5148
- C:\Windows\System\MCknHpR.exe
  C:\Windows\System\MCknHpR.exe
  2⤵
  PID:5776
- C:\Windows\System\NHiSsqh.exe
  C:\Windows\System\NHiSsqh.exe
  2⤵
  PID:5436
- C:\Windows\System\GKMmPcj.exe
  C:\Windows\System\GKMmPcj.exe
  2⤵
  PID:5844
- C:\Windows\System\pGAXhfg.exe
  C:\Windows\System\pGAXhfg.exe
  2⤵
  PID:5536
- C:\Windows\System\zBIWVjJ.exe
  C:\Windows\System\zBIWVjJ.exe
  2⤵
  PID:5628
- C:\Windows\System\tEWDQoW.exe
  C:\Windows\System\tEWDQoW.exe
  2⤵
  PID:5660
- C:\Windows\System\sBpDVDN.exe
  C:\Windows\System\sBpDVDN.exe
  2⤵
  PID:5692
- C:\Windows\System\iOvMKcV.exe
  C:\Windows\System\iOvMKcV.exe
  2⤵
  PID:5732
- C:\Windows\System\vqjCIqS.exe
  C:\Windows\System\vqjCIqS.exe
  2⤵
  PID:5892
- C:\Windows\System\gJElMfq.exe
  C:\Windows\System\gJElMfq.exe
  2⤵
  PID:5980
- C:\Windows\System\qkSHjJa.exe
  C:\Windows\System\qkSHjJa.exe
  2⤵
  PID:5796
- C:\Windows\System\ckJPDRM.exe
  C:\Windows\System\ckJPDRM.exe
  2⤵
  PID:5964
- C:\Windows\System\VfWmcpV.exe
  C:\Windows\System\VfWmcpV.exe
  2⤵
  PID:5832
- C:\Windows\System\BPgxMsv.exe
  C:\Windows\System\BPgxMsv.exe
  2⤵
  PID:6108
- C:\Windows\System\oHDPEdR.exe
  C:\Windows\System\oHDPEdR.exe
  2⤵
  PID:4196
- C:\Windows\System\UkXksFi.exe
  C:\Windows\System\UkXksFi.exe
  2⤵
  PID:3772
- C:\Windows\System\EiqnqJt.exe
  C:\Windows\System\EiqnqJt.exe
  2⤵
  PID:6064
- C:\Windows\System\MreUuIV.exe
  C:\Windows\System\MreUuIV.exe
  2⤵
  PID:5160
- C:\Windows\System\fpLerlD.exe
  C:\Windows\System\fpLerlD.exe
  2⤵
  PID:5164
- C:\Windows\System\fRjzCiG.exe
  C:\Windows\System\fRjzCiG.exe
  2⤵
  PID:5292
- C:\Windows\System\PDVgpdz.exe
  C:\Windows\System\PDVgpdz.exe
  2⤵
  PID:5224
- C:\Windows\System\TpazLoQ.exe
  C:\Windows\System\TpazLoQ.exe
  2⤵
  PID:5420
- C:\Windows\System\MMiNroJ.exe
  C:\Windows\System\MMiNroJ.exe
  2⤵
  PID:868
- C:\Windows\System\HOwuSTt.exe
  C:\Windows\System\HOwuSTt.exe
  2⤵
  PID:5516
- C:\Windows\System\ibDLlTM.exe
  C:\Windows\System\ibDLlTM.exe
  2⤵
  PID:5368
- C:\Windows\System\hOiOdXW.exe
  C:\Windows\System\hOiOdXW.exe
  2⤵
  PID:5520
- C:\Windows\System\xtxVkHI.exe
  C:\Windows\System\xtxVkHI.exe
  2⤵
  PID:5644
- C:\Windows\System\WKYFPRq.exe
  C:\Windows\System\WKYFPRq.exe
  2⤵
  PID:5144
- C:\Windows\System\sFPSmlI.exe
  C:\Windows\System\sFPSmlI.exe
  2⤵
  PID:4888
- C:\Windows\System\MYjUodt.exe
  C:\Windows\System\MYjUodt.exe
  2⤵
  PID:5056
- C:\Windows\System\HxdaGHE.exe
  C:\Windows\System\HxdaGHE.exe
  2⤵
  PID:4492
- C:\Windows\System\LbZhJdU.exe
  C:\Windows\System\LbZhJdU.exe
  2⤵
  PID:5088
- C:\Windows\System\WDrOPhI.exe
  C:\Windows\System\WDrOPhI.exe
  2⤵
  PID:5948
- C:\Windows\System\SuoOiaD.exe
  C:\Windows\System\SuoOiaD.exe
  2⤵
  PID:6016
- C:\Windows\System\JLFDnRU.exe
  C:\Windows\System\JLFDnRU.exe
  2⤵
  PID:5996
- C:\Windows\System\doMiNgY.exe
  C:\Windows\System\doMiNgY.exe
  2⤵
  PID:6044
- C:\Windows\System\aqKVYjD.exe
  C:\Windows\System\aqKVYjD.exe
  2⤵
  PID:6096
- C:\Windows\System\NwvojqU.exe
  C:\Windows\System\NwvojqU.exe
  2⤵
  PID:6128
- C:\Windows\System\pcCKhJG.exe
  C:\Windows\System\pcCKhJG.exe
  2⤵
  PID:6124
- C:\Windows\System\vJIbAtk.exe
  C:\Windows\System\vJIbAtk.exe
  2⤵
  PID:2340
- C:\Windows\System\YgbXKAr.exe
  C:\Windows\System\YgbXKAr.exe
  2⤵
  PID:5472
- C:\Windows\System\nuFVOZJ.exe
  C:\Windows\System\nuFVOZJ.exe
  2⤵
  PID:3292
- C:\Windows\System\ClmAKSF.exe
  C:\Windows\System\ClmAKSF.exe
  2⤵
  PID:3036
- C:\Windows\System\dNIboJf.exe
  C:\Windows\System\dNIboJf.exe
  2⤵
  PID:3400
- C:\Windows\System\sgfccQF.exe
  C:\Windows\System\sgfccQF.exe
  2⤵
  PID:5212
- C:\Windows\System\RMVFgIz.exe
  C:\Windows\System\RMVFgIz.exe
  2⤵
  PID:4588
- C:\Windows\System\DfyhSLx.exe
  C:\Windows\System\DfyhSLx.exe
  2⤵
  PID:4532
- C:\Windows\System\qTkgVYc.exe
  C:\Windows\System\qTkgVYc.exe
  2⤵
  PID:6092
- C:\Windows\System\BSEVkeJ.exe
  C:\Windows\System\BSEVkeJ.exe
  2⤵
  PID:5748
- C:\Windows\System\zHVgdQZ.exe
  C:\Windows\System\zHVgdQZ.exe
  2⤵
  PID:5596
- C:\Windows\System\KtTBLnR.exe
  C:\Windows\System\KtTBLnR.exe
  2⤵
  PID:5000
- C:\Windows\System\MnpSjdq.exe
  C:\Windows\System\MnpSjdq.exe
  2⤵
  PID:5728
- C:\Windows\System\WRSuPYe.exe
  C:\Windows\System\WRSuPYe.exe
  2⤵
  PID:5696
- C:\Windows\System\IxZBbxi.exe
  C:\Windows\System\IxZBbxi.exe
  2⤵
  PID:6140
- C:\Windows\System\jbfMsZv.exe
  C:\Windows\System\jbfMsZv.exe
  2⤵
  PID:5504
- C:\Windows\System\pReIEKL.exe
  C:\Windows\System\pReIEKL.exe
  2⤵
  PID:4332
- C:\Windows\System\UsasUDx.exe
  C:\Windows\System\UsasUDx.exe
  2⤵
  PID:5600
- C:\Windows\System\hIqWjln.exe
  C:\Windows\System\hIqWjln.exe
  2⤵
  PID:5456
- C:\Windows\System\zACkEce.exe
  C:\Windows\System\zACkEce.exe
  2⤵
  PID:6012
- C:\Windows\System\CzMrCwb.exe
  C:\Windows\System\CzMrCwb.exe
  2⤵
  PID:2776
- C:\Windows\System\MEnCepR.exe
  C:\Windows\System\MEnCepR.exe
  2⤵
  PID:6160
- C:\Windows\System\qoULRyI.exe
  C:\Windows\System\qoULRyI.exe
  2⤵
  PID:6176
- C:\Windows\System\QLzOBsh.exe
  C:\Windows\System\QLzOBsh.exe
  2⤵
  PID:6192
- C:\Windows\System\WTeJBRE.exe
  C:\Windows\System\WTeJBRE.exe
  2⤵
  PID:6208
- C:\Windows\System\jGKYdjG.exe
  C:\Windows\System\jGKYdjG.exe
  2⤵
  PID:6224
- C:\Windows\System\FoqSkSj.exe
  C:\Windows\System\FoqSkSj.exe
  2⤵
  PID:6240
- C:\Windows\System\TJIVaMK.exe
  C:\Windows\System\TJIVaMK.exe
  2⤵
  PID:6256
- C:\Windows\System\yuvSwhe.exe
  C:\Windows\System\yuvSwhe.exe
  2⤵
  PID:6272
- C:\Windows\System\aVjTluH.exe
  C:\Windows\System\aVjTluH.exe
  2⤵
  PID:6288
- C:\Windows\System\QOWlMCi.exe
  C:\Windows\System\QOWlMCi.exe
  2⤵
  PID:6304
- C:\Windows\System\nFPYvTN.exe
  C:\Windows\System\nFPYvTN.exe
  2⤵
  PID:6320
- C:\Windows\System\hSdDVVX.exe
  C:\Windows\System\hSdDVVX.exe
  2⤵
  PID:6336
- C:\Windows\System\JJeszhR.exe
  C:\Windows\System\JJeszhR.exe
  2⤵
  PID:6352
- C:\Windows\System\xfKuRmH.exe
  C:\Windows\System\xfKuRmH.exe
  2⤵
  PID:6368
- C:\Windows\System\hywSiyw.exe
  C:\Windows\System\hywSiyw.exe
  2⤵
  PID:6384
- C:\Windows\System\elSVtaY.exe
  C:\Windows\System\elSVtaY.exe
  2⤵
  PID:6400
- C:\Windows\System\KzEHthj.exe
  C:\Windows\System\KzEHthj.exe
  2⤵
  PID:6416
- C:\Windows\System\awqEKgL.exe
  C:\Windows\System\awqEKgL.exe
  2⤵
  PID:6432
- C:\Windows\System\NaPudnF.exe
  C:\Windows\System\NaPudnF.exe
  2⤵
  PID:6448
- C:\Windows\System\EvwSEWA.exe
  C:\Windows\System\EvwSEWA.exe
  2⤵
  PID:6464
- C:\Windows\System\QmeMWLn.exe
  C:\Windows\System\QmeMWLn.exe
  2⤵
  PID:6480
- C:\Windows\System\nkKFftq.exe
  C:\Windows\System\nkKFftq.exe
  2⤵
  PID:6496
- C:\Windows\System\nPknvcp.exe
  C:\Windows\System\nPknvcp.exe
  2⤵
  PID:6512
- C:\Windows\System\gQhBVft.exe
  C:\Windows\System\gQhBVft.exe
  2⤵
  PID:6528
- C:\Windows\System\orsBGCg.exe
  C:\Windows\System\orsBGCg.exe
  2⤵
  PID:6544
- C:\Windows\System\PJYYiCG.exe
  C:\Windows\System\PJYYiCG.exe
  2⤵
  PID:6560
- C:\Windows\System\tuBRLbl.exe
  C:\Windows\System\tuBRLbl.exe
  2⤵
  PID:6576
- C:\Windows\System\rAOLYuB.exe
  C:\Windows\System\rAOLYuB.exe
  2⤵
  PID:6592
- C:\Windows\System\NOeXHHV.exe
  C:\Windows\System\NOeXHHV.exe
  2⤵
  PID:6608
- C:\Windows\System\CsRhIco.exe
  C:\Windows\System\CsRhIco.exe
  2⤵
  PID:6636
- C:\Windows\System\mhHQrfx.exe
  C:\Windows\System\mhHQrfx.exe
  2⤵
  PID:6652
- C:\Windows\System\NtDDOML.exe
  C:\Windows\System\NtDDOML.exe
  2⤵
  PID:6668
- C:\Windows\System\QUFAIBO.exe
  C:\Windows\System\QUFAIBO.exe
  2⤵
  PID:6684
- C:\Windows\System\fIdVORW.exe
  C:\Windows\System\fIdVORW.exe
  2⤵
  PID:6700
- C:\Windows\System\KBtvvqL.exe
  C:\Windows\System\KBtvvqL.exe
  2⤵
  PID:6716
- C:\Windows\System\HrQqTwT.exe
  C:\Windows\System\HrQqTwT.exe
  2⤵
  PID:6732
- C:\Windows\System\DMLakgB.exe
  C:\Windows\System\DMLakgB.exe
  2⤵
  PID:6748
- C:\Windows\System\ZtPunxO.exe
  C:\Windows\System\ZtPunxO.exe
  2⤵
  PID:6764
- C:\Windows\System\BjBaSzI.exe
  C:\Windows\System\BjBaSzI.exe
  2⤵
  PID:6780
- C:\Windows\System\cQWzoXK.exe
  C:\Windows\System\cQWzoXK.exe
  2⤵
  PID:6800
- C:\Windows\System\nOfgCmg.exe
  C:\Windows\System\nOfgCmg.exe
  2⤵
  PID:6816
- C:\Windows\System\CZHYOtU.exe
  C:\Windows\System\CZHYOtU.exe
  2⤵
  PID:6832
- C:\Windows\System\MxVjgxh.exe
  C:\Windows\System\MxVjgxh.exe
  2⤵
  PID:6848
- C:\Windows\System\diaurQE.exe
  C:\Windows\System\diaurQE.exe
  2⤵
  PID:6864
- C:\Windows\System\amvmOKg.exe
  C:\Windows\System\amvmOKg.exe
  2⤵
  PID:6880
- C:\Windows\System\WjQoFwK.exe
  C:\Windows\System\WjQoFwK.exe
  2⤵
  PID:6896
- C:\Windows\System\iLTRYnb.exe
  C:\Windows\System\iLTRYnb.exe
  2⤵
  PID:6912
- C:\Windows\System\kwiKgdu.exe
  C:\Windows\System\kwiKgdu.exe
  2⤵
  PID:6928
- C:\Windows\System\hctVGyk.exe
  C:\Windows\System\hctVGyk.exe
  2⤵
  PID:6944
- C:\Windows\System\DjZtjfY.exe
  C:\Windows\System\DjZtjfY.exe
  2⤵
  PID:6960
- C:\Windows\System\KaxGliR.exe
  C:\Windows\System\KaxGliR.exe
  2⤵
  PID:6976
- C:\Windows\System\cirsXSV.exe
  C:\Windows\System\cirsXSV.exe
  2⤵
  PID:6992
- C:\Windows\System\rqbVElP.exe
  C:\Windows\System\rqbVElP.exe
  2⤵
  PID:7008
- C:\Windows\System\yBBgLfU.exe
  C:\Windows\System\yBBgLfU.exe
  2⤵
  PID:7024
- C:\Windows\System\aBEpnVk.exe
  C:\Windows\System\aBEpnVk.exe
  2⤵
  PID:7040
- C:\Windows\System\MzygNEB.exe
  C:\Windows\System\MzygNEB.exe
  2⤵
  PID:7056
- C:\Windows\System\dEPtGZR.exe
  C:\Windows\System\dEPtGZR.exe
  2⤵
  PID:7072
- C:\Windows\System\qCTZhUk.exe
  C:\Windows\System\qCTZhUk.exe
  2⤵
  PID:7088
- C:\Windows\System\dDgdSzm.exe
  C:\Windows\System\dDgdSzm.exe
  2⤵
  PID:7104
- C:\Windows\System\hUTFzbw.exe
  C:\Windows\System\hUTFzbw.exe
  2⤵
  PID:7120
- C:\Windows\System\zGWMUuc.exe
  C:\Windows\System\zGWMUuc.exe
  2⤵
  PID:7136
- C:\Windows\System\oismpVA.exe
  C:\Windows\System\oismpVA.exe
  2⤵
  PID:7152
- C:\Windows\System\FQTIeQW.exe
  C:\Windows\System\FQTIeQW.exe
  2⤵
  PID:6028
- C:\Windows\System\BQXpHDq.exe
  C:\Windows\System\BQXpHDq.exe
  2⤵
  PID:6152
- C:\Windows\System\HVCEUHb.exe
  C:\Windows\System\HVCEUHb.exe
  2⤵
  PID:6200
- C:\Windows\System\mvnJEGo.exe
  C:\Windows\System\mvnJEGo.exe
  2⤵
  PID:6232
- C:\Windows\System\moHSZFH.exe
  C:\Windows\System\moHSZFH.exe
  2⤵
  PID:6156
- C:\Windows\System\czfYiAx.exe
  C:\Windows\System\czfYiAx.exe
  2⤵
  PID:6296
- C:\Windows\System\rYibZwX.exe
  C:\Windows\System\rYibZwX.exe
  2⤵
  PID:6280
- C:\Windows\System\ogxaevQ.exe
  C:\Windows\System\ogxaevQ.exe
  2⤵
  PID:6360
- C:\Windows\System\zOgwxYq.exe
  C:\Windows\System\zOgwxYq.exe
  2⤵
  PID:6364
- C:\Windows\System\bGdynZM.exe
  C:\Windows\System\bGdynZM.exe
  2⤵
  PID:6408
- C:\Windows\System\ckOwWYP.exe
  C:\Windows\System\ckOwWYP.exe
  2⤵
  PID:6456
- C:\Windows\System\wjkPjzb.exe
  C:\Windows\System\wjkPjzb.exe
  2⤵
  PID:6520
- C:\Windows\System\iNzXcWB.exe
  C:\Windows\System\iNzXcWB.exe
  2⤵
  PID:6584
- C:\Windows\System\TxzlJaj.exe
  C:\Windows\System\TxzlJaj.exe
  2⤵
  PID:6312
- C:\Windows\System\jlvEsTt.exe
  C:\Windows\System\jlvEsTt.exe
  2⤵
  PID:6376
- C:\Windows\System\NrknDmz.exe
  C:\Windows\System\NrknDmz.exe
  2⤵
  PID:6600
- C:\Windows\System\jrHdSjV.exe
  C:\Windows\System\jrHdSjV.exe
  2⤵
  PID:6568
- C:\Windows\System\zTVwVRh.exe
  C:\Windows\System\zTVwVRh.exe
  2⤵
  PID:2516
- C:\Windows\System\KhSQbVD.exe
  C:\Windows\System\KhSQbVD.exe
  2⤵
  PID:1476
- C:\Windows\System\dhKZvyf.exe
  C:\Windows\System\dhKZvyf.exe
  2⤵
  PID:684
- C:\Windows\System\PlZawHs.exe
  C:\Windows\System\PlZawHs.exe
  2⤵
  PID:1636
- C:\Windows\System\AGZsdJc.exe
  C:\Windows\System\AGZsdJc.exe
  2⤵
  PID:2252
- C:\Windows\System\obgTlAm.exe
  C:\Windows\System\obgTlAm.exe
  2⤵
  PID:2596
- C:\Windows\System\cPXxSqy.exe
  C:\Windows\System\cPXxSqy.exe
  2⤵
  PID:6644
- C:\Windows\System\OZoHcpu.exe
  C:\Windows\System\OZoHcpu.exe
  2⤵
  PID:1452
- C:\Windows\System\CQtGbsk.exe
  C:\Windows\System\CQtGbsk.exe
  2⤵
  PID:6708
- C:\Windows\System\EgHWTsu.exe
  C:\Windows\System\EgHWTsu.exe
  2⤵
  PID:6712
- C:\Windows\System\fOJsbnX.exe
  C:\Windows\System\fOJsbnX.exe
  2⤵
  PID:6808
- C:\Windows\System\sIPLKVp.exe
  C:\Windows\System\sIPLKVp.exe
  2⤵
  PID:1504
- C:\Windows\System\WtzpIxn.exe
  C:\Windows\System\WtzpIxn.exe
  2⤵
  PID:6740
- C:\Windows\System\oiKYtiG.exe
  C:\Windows\System\oiKYtiG.exe
  2⤵
  PID:6936
- C:\Windows\System\SSNrZhQ.exe
  C:\Windows\System\SSNrZhQ.exe
  2⤵
  PID:7000
- C:\Windows\System\OtuvMrM.exe
  C:\Windows\System\OtuvMrM.exe
  2⤵
  PID:6876
- C:\Windows\System\wJYWxjY.exe
  C:\Windows\System\wJYWxjY.exe
  2⤵
  PID:7096
- C:\Windows\System\jOAWXRh.exe
  C:\Windows\System\jOAWXRh.exe
  2⤵
  PID:7160
- C:\Windows\System\bCRPDUQ.exe
  C:\Windows\System\bCRPDUQ.exe
  2⤵
  PID:6168
- C:\Windows\System\ryMmPEW.exe
  C:\Windows\System\ryMmPEW.exe
  2⤵
  PID:6236
- C:\Windows\System\TeXuOsr.exe
  C:\Windows\System\TeXuOsr.exe
  2⤵
  PID:6300
- C:\Windows\System\uKKkMLG.exe
  C:\Windows\System\uKKkMLG.exe
  2⤵
  PID:6824
- C:\Windows\System\AeXplVP.exe
  C:\Windows\System\AeXplVP.exe
  2⤵
  PID:6892
- C:\Windows\System\BeVhuBF.exe
  C:\Windows\System\BeVhuBF.exe
  2⤵
  PID:6956
- C:\Windows\System\gdXuLMQ.exe
  C:\Windows\System\gdXuLMQ.exe
  2⤵
  PID:7020
- C:\Windows\System\DwkTChv.exe
  C:\Windows\System\DwkTChv.exe
  2⤵
  PID:7052
- C:\Windows\System\tvkWRox.exe
  C:\Windows\System\tvkWRox.exe
  2⤵
  PID:7148
- C:\Windows\System\oAOKjrr.exe
  C:\Windows\System\oAOKjrr.exe
  2⤵
  PID:6188
- C:\Windows\System\XDckQjp.exe
  C:\Windows\System\XDckQjp.exe
  2⤵
  PID:6220
- C:\Windows\System\cYFuZTq.exe
  C:\Windows\System\cYFuZTq.exe
  2⤵
  PID:6348
- C:\Windows\System\ADUKCMk.exe
  C:\Windows\System\ADUKCMk.exe
  2⤵
  PID:6556
- C:\Windows\System\GfItzMH.exe
  C:\Windows\System\GfItzMH.exe
  2⤵
  PID:6540
- C:\Windows\System\ZAjbSUt.exe
  C:\Windows\System\ZAjbSUt.exe
  2⤵
  PID:1428
- C:\Windows\System\VsPKgwR.exe
  C:\Windows\System\VsPKgwR.exe
  2⤵
  PID:6676
- C:\Windows\System\LiGayBW.exe
  C:\Windows\System\LiGayBW.exe
  2⤵
  PID:412
- C:\Windows\System\DWGaULU.exe
  C:\Windows\System\DWGaULU.exe
  2⤵
  PID:2092
- C:\Windows\System\VDOQjpF.exe
  C:\Windows\System\VDOQjpF.exe
  2⤵
  PID:7032
- C:\Windows\System\eXxbePC.exe
  C:\Windows\System\eXxbePC.exe
  2⤵
  PID:2064
- C:\Windows\System\TyWEviZ.exe
  C:\Windows\System\TyWEviZ.exe
  2⤵
  PID:6460
- C:\Windows\System\YPFApfp.exe
  C:\Windows\System\YPFApfp.exe
  2⤵
  PID:6476
- C:\Windows\System\gXKvmCo.exe
  C:\Windows\System\gXKvmCo.exe
  2⤵
  PID:2644
- C:\Windows\System\jFwMGwX.exe
  C:\Windows\System\jFwMGwX.exe
  2⤵
  PID:6772
- C:\Windows\System\NXTfyKR.exe
  C:\Windows\System\NXTfyKR.exe
  2⤵
  PID:6968
- C:\Windows\System\dTrsKMs.exe
  C:\Windows\System\dTrsKMs.exe
  2⤵
  PID:1788
- C:\Windows\System\POVWDET.exe
  C:\Windows\System\POVWDET.exe
  2⤵
  PID:6728
- C:\Windows\System\zcjOTzA.exe
  C:\Windows\System\zcjOTzA.exe
  2⤵
  PID:6828
- C:\Windows\System\ynhbfbL.exe
  C:\Windows\System\ynhbfbL.exe
  2⤵
  PID:2524
- C:\Windows\System\vDIptZA.exe
  C:\Windows\System\vDIptZA.exe
  2⤵
  PID:7112
- C:\Windows\System\VSJtvgl.exe
  C:\Windows\System\VSJtvgl.exe
  2⤵
  PID:7084
- C:\Windows\System\qIpBcRk.exe
  C:\Windows\System\qIpBcRk.exe
  2⤵
  PID:7116
- C:\Windows\System\fGvkicQ.exe
  C:\Windows\System\fGvkicQ.exe
  2⤵
  PID:6252
- C:\Windows\System\hRgENom.exe
  C:\Windows\System\hRgENom.exe
  2⤵
  PID:6428
- C:\Windows\System\BhwlUMh.exe
  C:\Windows\System\BhwlUMh.exe
  2⤵
  PID:1608
- C:\Windows\System\BisvVoR.exe
  C:\Windows\System\BisvVoR.exe
  2⤵
  PID:1296
- C:\Windows\System\CnsQoti.exe
  C:\Windows\System\CnsQoti.exe
  2⤵
  PID:1312
- C:\Windows\System\jScPKUJ.exe
  C:\Windows\System\jScPKUJ.exe
  2⤵
  PID:4004
- C:\Windows\System\SnVMmwj.exe
  C:\Windows\System\SnVMmwj.exe
  2⤵
  PID:6380
- C:\Windows\System\aWBNVId.exe
  C:\Windows\System\aWBNVId.exe
  2⤵
  PID:6972
- C:\Windows\System\dupAhPf.exe
  C:\Windows\System\dupAhPf.exe
  2⤵
  PID:6792
- C:\Windows\System\zKBbFPy.exe
  C:\Windows\System\zKBbFPy.exe
  2⤵
  PID:7144
- C:\Windows\System\onWHLcJ.exe
  C:\Windows\System\onWHLcJ.exe
  2⤵
  PID:6216
- C:\Windows\System\KmCptnw.exe
  C:\Windows\System\KmCptnw.exe
  2⤵
  PID:6328
- C:\Windows\System\FnNjeHh.exe
  C:\Windows\System\FnNjeHh.exe
  2⤵
  PID:3048
- C:\Windows\System\IyKTMpE.exe
  C:\Windows\System\IyKTMpE.exe
  2⤵
  PID:2176
- C:\Windows\System\EVbuRHm.exe
  C:\Windows\System\EVbuRHm.exe
  2⤵
  PID:6908
- C:\Windows\System\ZikUqKJ.exe
  C:\Windows\System\ZikUqKJ.exe
  2⤵
  PID:2496
- C:\Windows\System\NqcIvzv.exe
  C:\Windows\System\NqcIvzv.exe
  2⤵
  PID:1684
- C:\Windows\System\rFZkzeo.exe
  C:\Windows\System\rFZkzeo.exe
  2⤵
  PID:2220
- C:\Windows\System\HqmOHML.exe
  C:\Windows\System\HqmOHML.exe
  2⤵
  PID:6344
- C:\Windows\System\KcZIPLM.exe
  C:\Windows\System\KcZIPLM.exe
  2⤵
  PID:1548
- C:\Windows\System\WKjZqMs.exe
  C:\Windows\System\WKjZqMs.exe
  2⤵
  PID:1280
- C:\Windows\System\IFBKSdw.exe
  C:\Windows\System\IFBKSdw.exe
  2⤵
  PID:6860
- C:\Windows\System\FYIsgeQ.exe
  C:\Windows\System\FYIsgeQ.exe
  2⤵
  PID:2260
- C:\Windows\System\gNCTizj.exe
  C:\Windows\System\gNCTizj.exe
  2⤵
  PID:7172
- C:\Windows\System\wUcVQCB.exe
  C:\Windows\System\wUcVQCB.exe
  2⤵
  PID:7188
- C:\Windows\System\IDzfcJW.exe
  C:\Windows\System\IDzfcJW.exe
  2⤵
  PID:7204
- C:\Windows\System\kEsqgJT.exe
  C:\Windows\System\kEsqgJT.exe
  2⤵
  PID:7224
- C:\Windows\System\RXFmpjE.exe
  C:\Windows\System\RXFmpjE.exe
  2⤵
  PID:7240
- C:\Windows\System\FyJtqXr.exe
  C:\Windows\System\FyJtqXr.exe
  2⤵
  PID:7260
- C:\Windows\System\IKdZGIB.exe
  C:\Windows\System\IKdZGIB.exe
  2⤵
  PID:7276
- C:\Windows\System\MNDSqzt.exe
  C:\Windows\System\MNDSqzt.exe
  2⤵
  PID:7292
- C:\Windows\System\NObjkWr.exe
  C:\Windows\System\NObjkWr.exe
  2⤵
  PID:7308
- C:\Windows\System\oIDPfyu.exe
  C:\Windows\System\oIDPfyu.exe
  2⤵
  PID:7324
- C:\Windows\System\VfFLvtk.exe
  C:\Windows\System\VfFLvtk.exe
  2⤵
  PID:7340
- C:\Windows\System\GHyyPQu.exe
  C:\Windows\System\GHyyPQu.exe
  2⤵
  PID:7356
- C:\Windows\System\WgQnLgz.exe
  C:\Windows\System\WgQnLgz.exe
  2⤵
  PID:7372
- C:\Windows\System\uyyQEBL.exe
  C:\Windows\System\uyyQEBL.exe
  2⤵
  PID:7388
- C:\Windows\System\gLhrYsF.exe
  C:\Windows\System\gLhrYsF.exe
  2⤵
  PID:7404
- C:\Windows\System\BqKnQdf.exe
  C:\Windows\System\BqKnQdf.exe
  2⤵
  PID:7420
- C:\Windows\System\Wptyzho.exe
  C:\Windows\System\Wptyzho.exe
  2⤵
  PID:7436
- C:\Windows\System\AKnJyVa.exe
  C:\Windows\System\AKnJyVa.exe
  2⤵
  PID:7452
- C:\Windows\System\FnKTVTe.exe
  C:\Windows\System\FnKTVTe.exe
  2⤵
  PID:7468
- C:\Windows\System\AmPGWXg.exe
  C:\Windows\System\AmPGWXg.exe
  2⤵
  PID:7484
- C:\Windows\System\MXBsITj.exe
  C:\Windows\System\MXBsITj.exe
  2⤵
  PID:7500
- C:\Windows\System\VqMkjRJ.exe
  C:\Windows\System\VqMkjRJ.exe
  2⤵
  PID:7516
- C:\Windows\System\gpEdrPc.exe
  C:\Windows\System\gpEdrPc.exe
  2⤵
  PID:7532
- C:\Windows\System\rUllTus.exe
  C:\Windows\System\rUllTus.exe
  2⤵
  PID:7548
- C:\Windows\System\PedOkvY.exe
  C:\Windows\System\PedOkvY.exe
  2⤵
  PID:7564
- C:\Windows\System\fGxOjhA.exe
  C:\Windows\System\fGxOjhA.exe
  2⤵
  PID:7580
- C:\Windows\System\NyhOOgk.exe
  C:\Windows\System\NyhOOgk.exe
  2⤵
  PID:7596
- C:\Windows\System\uXZDPNu.exe
  C:\Windows\System\uXZDPNu.exe
  2⤵
  PID:7612
- C:\Windows\System\nJBCkYE.exe
  C:\Windows\System\nJBCkYE.exe
  2⤵
  PID:7628
- C:\Windows\System\waOwjiP.exe
  C:\Windows\System\waOwjiP.exe
  2⤵
  PID:7644
- C:\Windows\System\eIWsXmp.exe
  C:\Windows\System\eIWsXmp.exe
  2⤵
  PID:7660
- C:\Windows\System\WrzEjyz.exe
  C:\Windows\System\WrzEjyz.exe
  2⤵
  PID:7676
- C:\Windows\System\PQtbDWa.exe
  C:\Windows\System\PQtbDWa.exe
  2⤵
  PID:7692
- C:\Windows\System\RhRjOfz.exe
  C:\Windows\System\RhRjOfz.exe
  2⤵
  PID:7708
- C:\Windows\System\xsfcOXv.exe
  C:\Windows\System\xsfcOXv.exe
  2⤵
  PID:7724
- C:\Windows\System\VnyXkHs.exe
  C:\Windows\System\VnyXkHs.exe
  2⤵
  PID:7740
- C:\Windows\System\ZnbxRcX.exe
  C:\Windows\System\ZnbxRcX.exe
  2⤵
  PID:7756
- C:\Windows\System\meDnvlY.exe
  C:\Windows\System\meDnvlY.exe
  2⤵
  PID:7772
- C:\Windows\System\jstJqug.exe
  C:\Windows\System\jstJqug.exe
  2⤵
  PID:7788
- C:\Windows\System\aVJuywA.exe
  C:\Windows\System\aVJuywA.exe
  2⤵
  PID:7804
- C:\Windows\System\vVgKVpS.exe
  C:\Windows\System\vVgKVpS.exe
  2⤵
  PID:7820
- C:\Windows\System\YWywwOw.exe
  C:\Windows\System\YWywwOw.exe
  2⤵
  PID:7836
- C:\Windows\System\iaEbwqV.exe
  C:\Windows\System\iaEbwqV.exe
  2⤵
  PID:7852
- C:\Windows\System\NthTXQz.exe
  C:\Windows\System\NthTXQz.exe
  2⤵
  PID:7868
- C:\Windows\System\rZYtPuy.exe
  C:\Windows\System\rZYtPuy.exe
  2⤵
  PID:7884
- C:\Windows\System\LwErcgC.exe
  C:\Windows\System\LwErcgC.exe
  2⤵
  PID:7900
- C:\Windows\System\plolUhq.exe
  C:\Windows\System\plolUhq.exe
  2⤵
  PID:7916
- C:\Windows\System\mhbXDaZ.exe
  C:\Windows\System\mhbXDaZ.exe
  2⤵
  PID:7932
- C:\Windows\System\jiRSsAN.exe
  C:\Windows\System\jiRSsAN.exe
  2⤵
  PID:7948
- C:\Windows\System\nJfamdE.exe
  C:\Windows\System\nJfamdE.exe
  2⤵
  PID:7964
- C:\Windows\System\UjxMErL.exe
  C:\Windows\System\UjxMErL.exe
  2⤵
  PID:7980
- C:\Windows\System\drgNRWm.exe
  C:\Windows\System\drgNRWm.exe
  2⤵
  PID:7996
- C:\Windows\System\DTfIxmQ.exe
  C:\Windows\System\DTfIxmQ.exe
  2⤵
  PID:8012
- C:\Windows\System\vRvbWAd.exe
  C:\Windows\System\vRvbWAd.exe
  2⤵
  PID:8028
- C:\Windows\System\IggBzoB.exe
  C:\Windows\System\IggBzoB.exe
  2⤵
  PID:8044
- C:\Windows\System\inWQMMT.exe
  C:\Windows\System\inWQMMT.exe
  2⤵
  PID:8060
- C:\Windows\System\npmcyXp.exe
  C:\Windows\System\npmcyXp.exe
  2⤵
  PID:8076
- C:\Windows\System\eVtEivD.exe
  C:\Windows\System\eVtEivD.exe
  2⤵
  PID:8092
- C:\Windows\System\runIgIE.exe
  C:\Windows\System\runIgIE.exe
  2⤵
  PID:8108
- C:\Windows\System\lajUHvD.exe
  C:\Windows\System\lajUHvD.exe
  2⤵
  PID:8124
- C:\Windows\System\pqYixRi.exe
  C:\Windows\System\pqYixRi.exe
  2⤵
  PID:8140
- C:\Windows\System\avwAvao.exe
  C:\Windows\System\avwAvao.exe
  2⤵
  PID:8156
- C:\Windows\System\KnnJBTI.exe
  C:\Windows\System\KnnJBTI.exe
  2⤵
  PID:8172
- C:\Windows\System\tlosUsH.exe
  C:\Windows\System\tlosUsH.exe
  2⤵
  PID:8188
- C:\Windows\System\KECjFGa.exe
  C:\Windows\System\KECjFGa.exe
  2⤵
  PID:6872
- C:\Windows\System\CeZvEsT.exe
  C:\Windows\System\CeZvEsT.exe
  2⤵
  PID:7232
- C:\Windows\System\FjAAxLj.exe
  C:\Windows\System\FjAAxLj.exe
  2⤵
  PID:7272
- C:\Windows\System\pyiKuVJ.exe
  C:\Windows\System\pyiKuVJ.exe
  2⤵
  PID:7248
- C:\Windows\System\rkuzBWm.exe
  C:\Windows\System\rkuzBWm.exe
  2⤵
  PID:7304
- C:\Windows\System\UQBTMZb.exe
  C:\Windows\System\UQBTMZb.exe
  2⤵
  PID:7336
- C:\Windows\System\mnjzFGh.exe
  C:\Windows\System\mnjzFGh.exe
  2⤵
  PID:7368
- C:\Windows\System\amkVPnG.exe
  C:\Windows\System\amkVPnG.exe
  2⤵
  PID:7384
- C:\Windows\System\yRLQdon.exe
  C:\Windows\System\yRLQdon.exe
  2⤵
  PID:7432
- C:\Windows\System\vSDAOjE.exe
  C:\Windows\System\vSDAOjE.exe
  2⤵
  PID:7464
- C:\Windows\System\wtzdBQv.exe
  C:\Windows\System\wtzdBQv.exe
  2⤵
  PID:7480
- C:\Windows\System\DrhtgRQ.exe
  C:\Windows\System\DrhtgRQ.exe
  2⤵
  PID:7528
- C:\Windows\System\oTLbhkF.exe
  C:\Windows\System\oTLbhkF.exe
  2⤵
  PID:7560
- C:\Windows\System\nxWWUNk.exe
  C:\Windows\System\nxWWUNk.exe
  2⤵
  PID:7620
- C:\Windows\System\igdtKkn.exe
  C:\Windows\System\igdtKkn.exe
  2⤵
  PID:7652
- C:\Windows\System\kADxJYl.exe
  C:\Windows\System\kADxJYl.exe
  2⤵
  PID:7656
- C:\Windows\System\glDkZpf.exe
  C:\Windows\System\glDkZpf.exe
  2⤵
  PID:7672
- C:\Windows\System\dNtePEf.exe
  C:\Windows\System\dNtePEf.exe
  2⤵
  PID:7704
- C:\Windows\System\wrbiynE.exe
  C:\Windows\System\wrbiynE.exe
  2⤵
  PID:7732
- C:\Windows\System\QXWQpAS.exe
  C:\Windows\System\QXWQpAS.exe
  2⤵
  PID:7784
- C:\Windows\System\ByrYFZh.exe
  C:\Windows\System\ByrYFZh.exe
  2⤵
  PID:7816
- C:\Windows\System\xHweqXk.exe
  C:\Windows\System\xHweqXk.exe
  2⤵
  PID:7848
- C:\Windows\System\qGNFYZk.exe
  C:\Windows\System\qGNFYZk.exe
  2⤵
  PID:7880
- C:\Windows\System\iROkMuL.exe
  C:\Windows\System\iROkMuL.exe
  2⤵
  PID:7896
- C:\Windows\System\tfvuJHl.exe
  C:\Windows\System\tfvuJHl.exe
  2⤵
  PID:7972
- C:\Windows\System\FTbCoZS.exe
  C:\Windows\System\FTbCoZS.exe
  2⤵
  PID:8036
- C:\Windows\System\UjDJgyg.exe
  C:\Windows\System\UjDJgyg.exe
  2⤵
  PID:8100
- C:\Windows\System\xKhTRtS.exe
  C:\Windows\System\xKhTRtS.exe
  2⤵
  PID:8164
- C:\Windows\System\QvqAJjC.exe
  C:\Windows\System\QvqAJjC.exe
  2⤵
  PID:7268
- C:\Windows\System\bsnzRnU.exe
  C:\Windows\System\bsnzRnU.exe
  2⤵
  PID:7364
- C:\Windows\System\jcTnXKG.exe
  C:\Windows\System\jcTnXKG.exe
  2⤵
  PID:7492
- C:\Windows\System\oBjvXsz.exe
  C:\Windows\System\oBjvXsz.exe
  2⤵
  PID:8120
- C:\Windows\System\wTnlReA.exe
  C:\Windows\System\wTnlReA.exe
  2⤵
  PID:7956
- C:\Windows\System\KXZIquB.exe
  C:\Windows\System\KXZIquB.exe
  2⤵
  PID:8024
- C:\Windows\System\LOGGhhu.exe
  C:\Windows\System\LOGGhhu.exe
  2⤵
  PID:8088
- C:\Windows\System\KiogiNr.exe
  C:\Windows\System\KiogiNr.exe
  2⤵
  PID:8180
- C:\Windows\System\bPViOib.exe
  C:\Windows\System\bPViOib.exe
  2⤵
  PID:7316
- C:\Windows\System\mIVqkUQ.exe
  C:\Windows\System\mIVqkUQ.exe
  2⤵
  PID:7460
- C:\Windows\System\fANIncD.exe
  C:\Windows\System\fANIncD.exe
  2⤵
  PID:7604
- C:\Windows\System\wMHphnb.exe
  C:\Windows\System\wMHphnb.exe
  2⤵
  PID:7748
- C:\Windows\System\gyPLYlP.exe
  C:\Windows\System\gyPLYlP.exe
  2⤵
  PID:7812
- C:\Windows\System\DTfnIBQ.exe
  C:\Windows\System\DTfnIBQ.exe
  2⤵
  PID:7944
- C:\Windows\System\jcyoGms.exe
  C:\Windows\System\jcyoGms.exe
  2⤵
  PID:8072
- C:\Windows\System\UFDUzKz.exe
  C:\Windows\System\UFDUzKz.exe
  2⤵
  PID:7828
- C:\Windows\System\XIjBBXU.exe
  C:\Windows\System\XIjBBXU.exe
  2⤵
  PID:7572
- C:\Windows\System\QEINNLp.exe
  C:\Windows\System\QEINNLp.exe
  2⤵
  PID:7780
- C:\Windows\System\HbITjDp.exe
  C:\Windows\System\HbITjDp.exe
  2⤵
  PID:8132
- C:\Windows\System\jYLQTeX.exe
  C:\Windows\System\jYLQTeX.exe
  2⤵
  PID:7416
- C:\Windows\System\fdUORhr.exe
  C:\Windows\System\fdUORhr.exe
  2⤵
  PID:7448
- C:\Windows\System\yEsieaR.exe
  C:\Windows\System\yEsieaR.exe
  2⤵
  PID:7992
- C:\Windows\System\DlbsLif.exe
  C:\Windows\System\DlbsLif.exe
  2⤵
  PID:8068
- C:\Windows\System\AabuNpF.exe
  C:\Windows\System\AabuNpF.exe
  2⤵
  PID:8084
- C:\Windows\System\ktGIssc.exe
  C:\Windows\System\ktGIssc.exe
  2⤵
  PID:7908
- C:\Windows\System\llpirOz.exe
  C:\Windows\System\llpirOz.exe
  2⤵
  PID:7300
- C:\Windows\System\rRPyyvY.exe
  C:\Windows\System\rRPyyvY.exe
  2⤵
  PID:7752
- C:\Windows\System\hyIlOMN.exe
  C:\Windows\System\hyIlOMN.exe
  2⤵
  PID:8152
- C:\Windows\System\pfEMACU.exe
  C:\Windows\System\pfEMACU.exe
  2⤵
  PID:7700
- C:\Windows\System\cojFZir.exe
  C:\Windows\System\cojFZir.exe
  2⤵
  PID:7288
- C:\Windows\System\JngddUs.exe
  C:\Windows\System\JngddUs.exe
  2⤵
  PID:7380
- C:\Windows\System\uIxJDwC.exe
  C:\Windows\System\uIxJDwC.exe
  2⤵
  PID:6796
- C:\Windows\System\hZgayit.exe
  C:\Windows\System\hZgayit.exe
  2⤵
  PID:7048
- C:\Windows\System\haZgxla.exe
  C:\Windows\System\haZgxla.exe
  2⤵
  PID:7428
- C:\Windows\System\OwcMNBX.exe
  C:\Windows\System\OwcMNBX.exe
  2⤵
  PID:8056
- C:\Windows\System\XHLKDoW.exe
  C:\Windows\System\XHLKDoW.exe
  2⤵
  PID:7928
- C:\Windows\System\wZlryCe.exe
  C:\Windows\System\wZlryCe.exe
  2⤵
  PID:8208
- C:\Windows\System\alsDblV.exe
  C:\Windows\System\alsDblV.exe
  2⤵
  PID:8224
- C:\Windows\System\PzciOAP.exe
  C:\Windows\System\PzciOAP.exe
  2⤵
  PID:8240
- C:\Windows\System\KLYrBCR.exe
  C:\Windows\System\KLYrBCR.exe
  2⤵
  PID:8256
- C:\Windows\System\KyNxQQX.exe
  C:\Windows\System\KyNxQQX.exe
  2⤵
  PID:8272
- C:\Windows\System\hZRYAQG.exe
  C:\Windows\System\hZRYAQG.exe
  2⤵
  PID:8288
- C:\Windows\System\cKXdZcq.exe
  C:\Windows\System\cKXdZcq.exe
  2⤵
  PID:8304
- C:\Windows\System\RbfRvhT.exe
  C:\Windows\System\RbfRvhT.exe
  2⤵
  PID:8320
- C:\Windows\System\yfesACg.exe
  C:\Windows\System\yfesACg.exe
  2⤵
  PID:8336
- C:\Windows\System\mVBboeb.exe
  C:\Windows\System\mVBboeb.exe
  2⤵
  PID:8352
- C:\Windows\System\EQAsnSX.exe
  C:\Windows\System\EQAsnSX.exe
  2⤵
  PID:8368
- C:\Windows\System\IKpojqz.exe
  C:\Windows\System\IKpojqz.exe
  2⤵
  PID:8384
- C:\Windows\System\WDAObmy.exe
  C:\Windows\System\WDAObmy.exe
  2⤵
  PID:8400
- C:\Windows\System\TGqIGHQ.exe
  C:\Windows\System\TGqIGHQ.exe
  2⤵
  PID:8416
- C:\Windows\System\smRHhgb.exe
  C:\Windows\System\smRHhgb.exe
  2⤵
  PID:8432
- C:\Windows\System\jDqhNqY.exe
  C:\Windows\System\jDqhNqY.exe
  2⤵
  PID:8448
- C:\Windows\System\SPQigGx.exe
  C:\Windows\System\SPQigGx.exe
  2⤵
  PID:8464
- C:\Windows\System\LpghnmY.exe
  C:\Windows\System\LpghnmY.exe
  2⤵
  PID:8480
- C:\Windows\System\rPuaWQT.exe
  C:\Windows\System\rPuaWQT.exe
  2⤵
  PID:8496
- C:\Windows\System\LUwJNle.exe
  C:\Windows\System\LUwJNle.exe
  2⤵
  PID:8512
- C:\Windows\System\LOYNCSb.exe
  C:\Windows\System\LOYNCSb.exe
  2⤵
  PID:8528
- C:\Windows\System\IjAbqRJ.exe
  C:\Windows\System\IjAbqRJ.exe
  2⤵
  PID:8544
- C:\Windows\System\bmWVKly.exe
  C:\Windows\System\bmWVKly.exe
  2⤵
  PID:8560
- C:\Windows\System\lTVqPFr.exe
  C:\Windows\System\lTVqPFr.exe
  2⤵
  PID:8576
- C:\Windows\System\GmCmTDt.exe
  C:\Windows\System\GmCmTDt.exe
  2⤵
  PID:8592
- C:\Windows\System\AQuZMWN.exe
  C:\Windows\System\AQuZMWN.exe
  2⤵
  PID:8608
- C:\Windows\System\ltydocY.exe
  C:\Windows\System\ltydocY.exe
  2⤵
  PID:8624
- C:\Windows\System\onABkBX.exe
  C:\Windows\System\onABkBX.exe
  2⤵
  PID:8640
- C:\Windows\System\nCmOKth.exe
  C:\Windows\System\nCmOKth.exe
  2⤵
  PID:8656
- C:\Windows\System\KNACjxQ.exe
  C:\Windows\System\KNACjxQ.exe
  2⤵
  PID:8672
- C:\Windows\System\zXsljCe.exe
  C:\Windows\System\zXsljCe.exe
  2⤵
  PID:8688
- C:\Windows\System\cHhbxKC.exe
  C:\Windows\System\cHhbxKC.exe
  2⤵
  PID:8704
- C:\Windows\System\DwImdiM.exe
  C:\Windows\System\DwImdiM.exe
  2⤵
  PID:8720
- C:\Windows\System\QKXDMQn.exe
  C:\Windows\System\QKXDMQn.exe
  2⤵
  PID:8736
- C:\Windows\System\NtjtLls.exe
  C:\Windows\System\NtjtLls.exe
  2⤵
  PID:8752
- C:\Windows\System\pkacCRI.exe
  C:\Windows\System\pkacCRI.exe
  2⤵
  PID:8768
- C:\Windows\System\mbNBmIL.exe
  C:\Windows\System\mbNBmIL.exe
  2⤵
  PID:8788
- C:\Windows\System\NAPBiDd.exe
  C:\Windows\System\NAPBiDd.exe
  2⤵
  PID:8804
- C:\Windows\System\tifoaHL.exe
  C:\Windows\System\tifoaHL.exe
  2⤵
  PID:8820
- C:\Windows\System\rLUaKIC.exe
  C:\Windows\System\rLUaKIC.exe
  2⤵
  PID:8836
- C:\Windows\System\oZzAfNe.exe
  C:\Windows\System\oZzAfNe.exe
  2⤵
  PID:8852
- C:\Windows\System\LxbzYcM.exe
  C:\Windows\System\LxbzYcM.exe
  2⤵
  PID:8868
- C:\Windows\System\GPquDmr.exe
  C:\Windows\System\GPquDmr.exe
  2⤵
  PID:8884
- C:\Windows\System\rXwFUDK.exe
  C:\Windows\System\rXwFUDK.exe
  2⤵
  PID:8900
- C:\Windows\System\AEHSefB.exe
  C:\Windows\System\AEHSefB.exe
  2⤵
  PID:8916
- C:\Windows\System\EqEHvWF.exe
  C:\Windows\System\EqEHvWF.exe
  2⤵
  PID:8932
- C:\Windows\System\cPJBXyO.exe
  C:\Windows\System\cPJBXyO.exe
  2⤵
  PID:8948
- C:\Windows\System\BrFvPJu.exe
  C:\Windows\System\BrFvPJu.exe
  2⤵
  PID:8964
- C:\Windows\System\xrAxnuo.exe
  C:\Windows\System\xrAxnuo.exe
  2⤵
  PID:8980
- C:\Windows\System\jhKzVVO.exe
  C:\Windows\System\jhKzVVO.exe
  2⤵
  PID:8996
- C:\Windows\System\XoMBpfM.exe
  C:\Windows\System\XoMBpfM.exe
  2⤵
  PID:9012
- C:\Windows\System\rgeDhRl.exe
  C:\Windows\System\rgeDhRl.exe
  2⤵
  PID:9028
- C:\Windows\System\PHofawE.exe
  C:\Windows\System\PHofawE.exe
  2⤵
  PID:9044
- C:\Windows\System\CYshGkX.exe
  C:\Windows\System\CYshGkX.exe
  2⤵
  PID:9060
- C:\Windows\System\eIiIrLp.exe
  C:\Windows\System\eIiIrLp.exe
  2⤵
  PID:9076
- C:\Windows\System\qeIDvai.exe
  C:\Windows\System\qeIDvai.exe
  2⤵
  PID:9092
- C:\Windows\System\NQDrqAU.exe
  C:\Windows\System\NQDrqAU.exe
  2⤵
  PID:9108
- C:\Windows\System\nTgpOPv.exe
  C:\Windows\System\nTgpOPv.exe
  2⤵
  PID:9124
- C:\Windows\System\QpWIRDE.exe
  C:\Windows\System\QpWIRDE.exe
  2⤵
  PID:9140
- C:\Windows\System\XADJVhf.exe
  C:\Windows\System\XADJVhf.exe
  2⤵
  PID:9156
- C:\Windows\System\OYHUpVD.exe
  C:\Windows\System\OYHUpVD.exe
  2⤵
  PID:9172
- C:\Windows\System\fEpeYpG.exe
  C:\Windows\System\fEpeYpG.exe
  2⤵
  PID:9188
- C:\Windows\System\GwRnSjf.exe
  C:\Windows\System\GwRnSjf.exe
  2⤵
  PID:9204
- C:\Windows\System\dxQNdyi.exe
  C:\Windows\System\dxQNdyi.exe
  2⤵
  PID:8204
- C:\Windows\System\gqlfMvJ.exe
  C:\Windows\System\gqlfMvJ.exe
  2⤵
  PID:8020
- C:\Windows\System\rAtRJcH.exe
  C:\Windows\System\rAtRJcH.exe
  2⤵
  PID:8264
- C:\Windows\System\qgyzZEI.exe
  C:\Windows\System\qgyzZEI.exe
  2⤵
  PID:8300
- C:\Windows\System\dCurdkz.exe
  C:\Windows\System\dCurdkz.exe
  2⤵
  PID:8284
- C:\Windows\System\KxhcOZd.exe
  C:\Windows\System\KxhcOZd.exe
  2⤵
  PID:8344
- C:\Windows\System\ONpREQm.exe
  C:\Windows\System\ONpREQm.exe
  2⤵
  PID:8392
- C:\Windows\System\YYGySPq.exe
  C:\Windows\System\YYGySPq.exe
  2⤵
  PID:8424
- C:\Windows\System\cJpWmGB.exe
  C:\Windows\System\cJpWmGB.exe
  2⤵
  PID:8440
- C:\Windows\System\tXtZkJM.exe
  C:\Windows\System\tXtZkJM.exe
  2⤵
  PID:8488
- C:\Windows\System\HlJYprd.exe
  C:\Windows\System\HlJYprd.exe
  2⤵
  PID:8472
- C:\Windows\System\hbPmfqm.exe
  C:\Windows\System\hbPmfqm.exe
  2⤵
  PID:8536
- C:\Windows\System\onROvEc.exe
  C:\Windows\System\onROvEc.exe
  2⤵
  PID:8568
- C:\Windows\System\JHMubbg.exe
  C:\Windows\System\JHMubbg.exe
  2⤵
  PID:8616
- C:\Windows\System\WGOKURR.exe
  C:\Windows\System\WGOKURR.exe
  2⤵
  PID:8604
- C:\Windows\System\oYewCdZ.exe
  C:\Windows\System\oYewCdZ.exe
  2⤵
  PID:8664
- C:\Windows\System\obkiYCu.exe
  C:\Windows\System\obkiYCu.exe
  2⤵
  PID:8696
- C:\Windows\System\CQeDcQk.exe
  C:\Windows\System\CQeDcQk.exe
  2⤵
  PID:8748
- C:\Windows\System\aWCVKDl.exe
  C:\Windows\System\aWCVKDl.exe
  2⤵
  PID:8760
- C:\Windows\System\IAAwKxm.exe
  C:\Windows\System\IAAwKxm.exe
  2⤵
  PID:8812
- C:\Windows\System\pnDxGLw.exe
  C:\Windows\System\pnDxGLw.exe
  2⤵
  PID:8800
- C:\Windows\System\HfWspCV.exe
  C:\Windows\System\HfWspCV.exe
  2⤵
  PID:8832
- C:\Windows\System\eRYcvog.exe
  C:\Windows\System\eRYcvog.exe
  2⤵
  PID:8908
- C:\Windows\System\zxQsyNL.exe
  C:\Windows\System\zxQsyNL.exe
  2⤵
  PID:8940
- C:\Windows\System\zRddqGm.exe
  C:\Windows\System\zRddqGm.exe
  2⤵
  PID:8956
- C:\Windows\System\OgAVikC.exe
  C:\Windows\System\OgAVikC.exe
  2⤵
  PID:9008
- C:\Windows\System\EqcRvbX.exe
  C:\Windows\System\EqcRvbX.exe
  2⤵
  PID:9020
- C:\Windows\System\CnsqvQN.exe
  C:\Windows\System\CnsqvQN.exe
  2⤵
  PID:9056
- C:\Windows\System\mPQMwav.exe
  C:\Windows\System\mPQMwav.exe
  2⤵
  PID:9084
- C:\Windows\System\ueMjByI.exe
  C:\Windows\System\ueMjByI.exe
  2⤵
  PID:9132
- C:\Windows\System\ohNZPLp.exe
  C:\Windows\System\ohNZPLp.exe
  2⤵
  PID:9116
- C:\Windows\System\yQyEZvT.exe
  C:\Windows\System\yQyEZvT.exe
  2⤵
  PID:9120
- C:\Windows\System\VxtpXeK.exe
  C:\Windows\System\VxtpXeK.exe
  2⤵
  PID:8236
- C:\Windows\System\tTWEFba.exe
  C:\Windows\System\tTWEFba.exe
  2⤵
  PID:8268
- C:\Windows\System\fGTMWsJ.exe
  C:\Windows\System\fGTMWsJ.exe
  2⤵
  PID:7252
- C:\Windows\System\RwKHMdn.exe
  C:\Windows\System\RwKHMdn.exe
  2⤵
  PID:8460
- C:\Windows\System\YhkvGtr.exe
  C:\Windows\System\YhkvGtr.exe
  2⤵
  PID:8412
- C:\Windows\System\vgvReMH.exe
  C:\Windows\System\vgvReMH.exe
  2⤵
  PID:8520
- C:\Windows\System\TziQerV.exe
  C:\Windows\System\TziQerV.exe
  2⤵
  PID:8588
- C:\Windows\System\rHcbKCS.exe
  C:\Windows\System\rHcbKCS.exe
  2⤵
  PID:8716
- C:\Windows\System\MgOkrcW.exe
  C:\Windows\System\MgOkrcW.exe
  2⤵
  PID:8828
- C:\Windows\System\LLqwHOz.exe
  C:\Windows\System\LLqwHOz.exe
  2⤵
  PID:8864
- C:\Windows\System\MbIAnFZ.exe
  C:\Windows\System\MbIAnFZ.exe
  2⤵
  PID:8684
- C:\Windows\System\RzsaXHa.exe
  C:\Windows\System\RzsaXHa.exe
  2⤵
  PID:8848
- C:\Windows\System\dvuNLiW.exe
  C:\Windows\System\dvuNLiW.exe
  2⤵
  PID:8892
- C:\Windows\System\aVmVqNn.exe
  C:\Windows\System\aVmVqNn.exe
  2⤵
  PID:9068
- C:\Windows\System\OYYdSaM.exe
  C:\Windows\System\OYYdSaM.exe
  2⤵
  PID:9072
- C:\Windows\System\kBdaItV.exe
  C:\Windows\System\kBdaItV.exe
  2⤵
  PID:8200
- C:\Windows\System\gSSzdnV.exe
  C:\Windows\System\gSSzdnV.exe
  2⤵
  PID:1720
- C:\Windows\System\IjEwhIC.exe
  C:\Windows\System\IjEwhIC.exe
  2⤵
  PID:8396
- C:\Windows\System\wBfCwkv.exe
  C:\Windows\System\wBfCwkv.exe
  2⤵
  PID:8408
- C:\Windows\System\QLXjyzl.exe
  C:\Windows\System\QLXjyzl.exe
  2⤵
  PID:8504
- C:\Windows\System\JMdEfNE.exe
  C:\Windows\System\JMdEfNE.exe
  2⤵
  PID:8796
- C:\Windows\System\HuvKTPY.exe
  C:\Windows\System\HuvKTPY.exe
  2⤵
  PID:8844
- C:\Windows\System\qOyUpLZ.exe
  C:\Windows\System\qOyUpLZ.exe
  2⤵
  PID:9228
- C:\Windows\System\fZKkdjI.exe
  C:\Windows\System\fZKkdjI.exe
  2⤵
  PID:9244
- C:\Windows\System\onOnPeH.exe
  C:\Windows\System\onOnPeH.exe
  2⤵
  PID:9260
- C:\Windows\System\hrhWWPz.exe
  C:\Windows\System\hrhWWPz.exe
  2⤵
  PID:9276
- C:\Windows\System\IgjyPGU.exe
  C:\Windows\System\IgjyPGU.exe
  2⤵
  PID:9292
- C:\Windows\System\AcXIMcR.exe
  C:\Windows\System\AcXIMcR.exe
  2⤵
  PID:9308
- C:\Windows\System\CsQmDKK.exe
  C:\Windows\System\CsQmDKK.exe
  2⤵
  PID:9324
- C:\Windows\System\QcpbgzG.exe
  C:\Windows\System\QcpbgzG.exe
  2⤵
  PID:9340
- C:\Windows\System\ltrtdaI.exe
  C:\Windows\System\ltrtdaI.exe
  2⤵
  PID:9356
- C:\Windows\System\wCTdZTG.exe
  C:\Windows\System\wCTdZTG.exe
  2⤵
  PID:9372
- C:\Windows\System\BIjJHUe.exe
  C:\Windows\System\BIjJHUe.exe
  2⤵
  PID:9388
- C:\Windows\System\EJJmTUr.exe
  C:\Windows\System\EJJmTUr.exe
  2⤵
  PID:9404
- C:\Windows\System\JAJUKWF.exe
  C:\Windows\System\JAJUKWF.exe
  2⤵
  PID:9680
- C:\Windows\System\KdbBcXi.exe
  C:\Windows\System\KdbBcXi.exe
  2⤵
  PID:9716
- C:\Windows\System\cwEiOTI.exe
  C:\Windows\System\cwEiOTI.exe
  2⤵
  PID:9732
- C:\Windows\System\XwhJbFz.exe
  C:\Windows\System\XwhJbFz.exe
  2⤵
  PID:9756
- C:\Windows\System\qLliKcl.exe
  C:\Windows\System\qLliKcl.exe
  2⤵
  PID:9772
- C:\Windows\System\rwRuwXQ.exe
  C:\Windows\System\rwRuwXQ.exe
  2⤵
  PID:9788
- C:\Windows\System\ZMsVApC.exe
  C:\Windows\System\ZMsVApC.exe
  2⤵
  PID:9804
- C:\Windows\System\cyJgFZb.exe
  C:\Windows\System\cyJgFZb.exe
  2⤵
  PID:9824
- C:\Windows\System\kJrXxcX.exe
  C:\Windows\System\kJrXxcX.exe
  2⤵
  PID:9844
- C:\Windows\System\TvtwPZh.exe
  C:\Windows\System\TvtwPZh.exe
  2⤵
  PID:9896
- C:\Windows\System\UrUBsPX.exe
  C:\Windows\System\UrUBsPX.exe
  2⤵
  PID:9924
- C:\Windows\System\OAhTTiO.exe
  C:\Windows\System\OAhTTiO.exe
  2⤵
  PID:9960
- C:\Windows\System\BUObgzV.exe
  C:\Windows\System\BUObgzV.exe
  2⤵
  PID:9976
- C:\Windows\System\XYCZcWS.exe
  C:\Windows\System\XYCZcWS.exe
  2⤵
  PID:9996
- C:\Windows\System\ebHNGZh.exe
  C:\Windows\System\ebHNGZh.exe
  2⤵
  PID:10024
- C:\Windows\System\OQooKWO.exe
  C:\Windows\System\OQooKWO.exe
  2⤵
  PID:10040
- C:\Windows\System\mjyfIrC.exe
  C:\Windows\System\mjyfIrC.exe
  2⤵
  PID:10056
- C:\Windows\System\FCMLwkF.exe
  C:\Windows\System\FCMLwkF.exe
  2⤵
  PID:10072
- C:\Windows\System\WgiCoCk.exe
  C:\Windows\System\WgiCoCk.exe
  2⤵
  PID:10088
- C:\Windows\System\nEbdgoH.exe
  C:\Windows\System\nEbdgoH.exe
  2⤵
  PID:10104
- C:\Windows\System\MWQIdjm.exe
  C:\Windows\System\MWQIdjm.exe
  2⤵
  PID:10120
- C:\Windows\System\qmdmiyV.exe
  C:\Windows\System\qmdmiyV.exe
  2⤵
  PID:10136
- C:\Windows\System\dkctsWi.exe
  C:\Windows\System\dkctsWi.exe
  2⤵
  PID:10152
- C:\Windows\System\utDLSGe.exe
  C:\Windows\System\utDLSGe.exe
  2⤵
  PID:10168
- C:\Windows\System\VYQvNSq.exe
  C:\Windows\System\VYQvNSq.exe
  2⤵
  PID:10184
- C:\Windows\System\FiDKaLB.exe
  C:\Windows\System\FiDKaLB.exe
  2⤵
  PID:10204
- C:\Windows\System\zCkGpYp.exe
  C:\Windows\System\zCkGpYp.exe
  2⤵
  PID:10220
- C:\Windows\System\nqkJzZz.exe
  C:\Windows\System\nqkJzZz.exe
  2⤵
  PID:10236
- C:\Windows\System\JLWnwOI.exe
  C:\Windows\System\JLWnwOI.exe
  2⤵
  PID:8332
- C:\Windows\System\YXLRktv.exe
  C:\Windows\System\YXLRktv.exe
  2⤵
  PID:8976
- C:\Windows\System\TMPZAcm.exe
  C:\Windows\System\TMPZAcm.exe
  2⤵
  PID:8784
- C:\Windows\System\WKsNHkq.exe
  C:\Windows\System\WKsNHkq.exe
  2⤵
  PID:9332
- C:\Windows\System\PbSqrfM.exe
  C:\Windows\System\PbSqrfM.exe
  2⤵
  PID:9364
- C:\Windows\System\GcXBkeX.exe
  C:\Windows\System\GcXBkeX.exe
  2⤵
  PID:9400
- C:\Windows\System\vguHIRB.exe
  C:\Windows\System\vguHIRB.exe
  2⤵
  PID:9316
- C:\Windows\System\ZtfrQXr.exe
  C:\Windows\System\ZtfrQXr.exe
  2⤵
  PID:9284
- C:\Windows\System\BhAauvP.exe
  C:\Windows\System\BhAauvP.exe
  2⤵
  PID:9412
- C:\Windows\System\oXpdSiH.exe
  C:\Windows\System\oXpdSiH.exe
  2⤵
  PID:9428
- C:\Windows\System\VlHwinF.exe
  C:\Windows\System\VlHwinF.exe
  2⤵
  PID:9460
- C:\Windows\System\RvGTBkO.exe
  C:\Windows\System\RvGTBkO.exe
  2⤵
  PID:9476
- C:\Windows\System\vpzbdUd.exe
  C:\Windows\System\vpzbdUd.exe
  2⤵
  PID:9508
- C:\Windows\System\iPVUPIe.exe
  C:\Windows\System\iPVUPIe.exe
  2⤵
  PID:9524
- C:\Windows\System\Rvwpaxx.exe
  C:\Windows\System\Rvwpaxx.exe
  2⤵
  PID:9544
- C:\Windows\System\xWiFFaJ.exe
  C:\Windows\System\xWiFFaJ.exe
  2⤵
  PID:9560
- C:\Windows\System\onouivJ.exe
  C:\Windows\System\onouivJ.exe
  2⤵
  PID:9572
- C:\Windows\System\DPWXGxz.exe
  C:\Windows\System\DPWXGxz.exe
  2⤵
  PID:9588
- C:\Windows\System\JzUFTDr.exe
  C:\Windows\System\JzUFTDr.exe
  2⤵
  PID:9604
- C:\Windows\System\tOLvZvz.exe
  C:\Windows\System\tOLvZvz.exe
  2⤵
  PID:9620
- C:\Windows\System\zHCDFIF.exe
  C:\Windows\System\zHCDFIF.exe
  2⤵
  PID:9636
- C:\Windows\System\ubDnyJv.exe
  C:\Windows\System\ubDnyJv.exe
  2⤵
  PID:9652
- C:\Windows\System\OHocqKh.exe
  C:\Windows\System\OHocqKh.exe
  2⤵
  PID:9676
- C:\Windows\System\ENdcwMA.exe
  C:\Windows\System\ENdcwMA.exe
  2⤵
  PID:9708
- C:\Windows\System\ticWWPW.exe
  C:\Windows\System\ticWWPW.exe
  2⤵
  PID:9724
- C:\Windows\System\EyFNUQl.exe
  C:\Windows\System\EyFNUQl.exe
  2⤵
  PID:9780
- C:\Windows\System\GMqMPSt.exe
  C:\Windows\System\GMqMPSt.exe
  2⤵
  PID:9864
- C:\Windows\System\IlAtPXf.exe
  C:\Windows\System\IlAtPXf.exe
  2⤵
  PID:9832
- C:\Windows\System\FgkADVI.exe
  C:\Windows\System\FgkADVI.exe
  2⤵
  PID:9888
- C:\Windows\System\RXazuIh.exe
  C:\Windows\System\RXazuIh.exe
  2⤵
  PID:9956
- C:\Windows\System\hZOdLgf.exe
  C:\Windows\System\hZOdLgf.exe
  2⤵
  PID:9936
- C:\Windows\System\jEUsWwh.exe
  C:\Windows\System\jEUsWwh.exe
  2⤵
  PID:9968
- C:\Windows\System\qZMPifZ.exe
  C:\Windows\System\qZMPifZ.exe
  2⤵
  PID:9912
- C:\Windows\System\SXYeIef.exe
  C:\Windows\System\SXYeIef.exe
  2⤵
  PID:10116
- C:\Windows\System\VnckTTS.exe
  C:\Windows\System\VnckTTS.exe
  2⤵
  PID:10192
- C:\Windows\System\jqNwMdG.exe
  C:\Windows\System\jqNwMdG.exe
  2⤵
  PID:8944
- C:\Windows\System\rZuFTyM.exe
  C:\Windows\System\rZuFTyM.exe
  2⤵
  PID:9444
- C:\Windows\System\IHRkKQj.exe
  C:\Windows\System\IHRkKQj.exe
  2⤵
  PID:9484
- C:\Windows\System\ZcqFkWS.exe
  C:\Windows\System\ZcqFkWS.exe
  2⤵
  PID:9424
- C:\Windows\System\NcaEjvu.exe
  C:\Windows\System\NcaEjvu.exe
  2⤵
  PID:9468
- C:\Windows\System\ckemNFi.exe
  C:\Windows\System\ckemNFi.exe
  2⤵
  PID:9256
- C:\Windows\System\STYzMjA.exe
  C:\Windows\System\STYzMjA.exe
  2⤵
  PID:9612
- C:\Windows\System\HziChXM.exe
  C:\Windows\System\HziChXM.exe
  2⤵
  PID:9516
- C:\Windows\System\OYcMnFn.exe
  C:\Windows\System\OYcMnFn.exe
  2⤵
  PID:9632
- C:\Windows\System\TmAntTi.exe
  C:\Windows\System\TmAntTi.exe
  2⤵
  PID:9840
- C:\Windows\System\inoNGvN.exe
  C:\Windows\System\inoNGvN.exe
  2⤵
  PID:9704
- C:\Windows\System\iWQaqSR.exe
  C:\Windows\System\iWQaqSR.exe
  2⤵
  PID:9764
- C:\Windows\System\PupPmlw.exe
  C:\Windows\System\PupPmlw.exe
  2⤵
  PID:9696
- C:\Windows\System\uVCUViP.exe
  C:\Windows\System\uVCUViP.exe
  2⤵
  PID:9796
- C:\Windows\System\WGPqGsg.exe
  C:\Windows\System\WGPqGsg.exe
  2⤵
  PID:10004
- C:\Windows\System\lDFCcKo.exe
  C:\Windows\System\lDFCcKo.exe
  2⤵
  PID:9972
- C:\Windows\System\RSSZkhm.exe
  C:\Windows\System\RSSZkhm.exe
  2⤵
  PID:1564
- C:\Windows\System\TtQWplr.exe
  C:\Windows\System\TtQWplr.exe
  2⤵
  PID:10132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AjEBgqc.exe

Filesize
2.8MB

MD5
a53b056d7151fe57d5c6efae3b892423

SHA1
a1456cade3eee39288ca3d31178ffdcd2460d792

SHA256
1b992763d252cad0bc1f88b3c0014b5a16254a904d36dbd682671d455d9351a3

SHA512
19fe0d657ab874cad072be8d63dc2c56e41f48eea40feaf6f22f204ad32697a6bc258960a84f36f05b3e96a47a6b1ddc5ad96d5375ef100fa4961b909a75a044

Download Submit
C:\Windows\system\CHCwoRa.exe

Filesize
2.8MB

MD5
27125e420da3f6f2b8c5cf5dca32bbdb

SHA1
1e43d225da952afd87b0bfdbe242841e964b644b

SHA256
cbfdc2335edcc8ddf6c0cc771506a9619aff5970f41417dff7693ec498adfc60

SHA512
97e8d9f243709bfcde6fa46d0e3ab033d2491e112a6a507b02cb32756c739b269bad40bb43aa5ee8edc8cc2f5862cc4b1248060717d5e265776ec334c879fe57

Download Submit
C:\Windows\system\FCpYaxC.exe

Filesize
2.8MB

MD5
40916f213f5b00b4cde4a9b5054e51d6

SHA1
9068dfe242081ad914c45a53ce85e3e2d51a65e2

SHA256
e601d6b941441fd66c257599b1bd87816b0454af5f21927285ecf743f181b61a

SHA512
c7eaf6354425b8fe25ff6542178d2942507fecca02c166adf9850488ab1a770122e83193ce16dce144fcba388f6db5fde6e66ee54e549f3b3d6d2e8820d38891

Download Submit
C:\Windows\system\MQmhxPp.exe

Filesize
2.8MB

MD5
c265b335f3604210dba31c4f02ec048d

SHA1
bb64a5f636ce10a209ab97094adabbb68470962e

SHA256
920e6da2a325879b92c6d3762f91b9dd9e933537d0b28d3212b2c484aee0c764

SHA512
0806ce78922c3029344b11390eac62eeb6e046aea0fa3c35002d254dd03a8e42dac82081027d246fa54f156aae456016913eb3105017d1e2871a636f1aef21eb

Download Submit
C:\Windows\system\RglXVku.exe

Filesize
2.8MB

MD5
da91b62018bed7510a3e1b0429519254

SHA1
96200cdb4ad6839777310f055bfe979e06c12774

SHA256
76456eb33624497b6b4fe87af1f987863a5f6155c3a6121879cef3d735b6a6b7

SHA512
1962d6014730a1cc615dd9352823182a57e9d09408bce11eafa34bb4c55dda851d0185e100e6f3cb8cb6caf4ffc5926a7e8a67ff81eb472b2a4a53d486429d9e

Download Submit
C:\Windows\system\TTKZkBT.exe

Filesize
2.8MB

MD5
99095b04d3df1ec45dee86921574cc92

SHA1
0ecc2cb3bc1316fbfe1fb905c0e1ae19336795e9

SHA256
ddf398d72c84ebe18ebd7edc0923bab87f629f348265a9e6fa8bb5ca573e2f76

SHA512
a461c722fb16f013a3a5e1ef72be10806af7dde834a8e4dbca04ac78693f93cc45f4daf6881adb6e7f74d864b25c9ebe444b5e7b134d42d24b4e774ffae89481

Download Submit
C:\Windows\system\UDQLfJe.exe

Filesize
2.8MB

MD5
591059bb1a2dcfa1270c7705c39e84b1

SHA1
5dd31614abbfa09564162d8424cd7ad481cf9148

SHA256
093dec54ef89bb52e2e250fdf0f879531795f48b991b5278920d6ac46d0348a0

SHA512
37e393ee830d2effee90df2d5cfd10ddccf3904edab296972a224c8679afd12aaa054d33b990f0f5b17636cae1746c5ddc46de69b1f4e634e4d07f186f96587c

Download Submit
C:\Windows\system\UaHvlwS.exe

Filesize
2.8MB

MD5
94a3a189bf1ed2523d94ce82e32c541f

SHA1
9c0f78ddeaca283961f85a09a1a8d2df51c71c02

SHA256
97d052ac6ee1b198b071d9e5c5df37d931332b04c1814514749b9c308d9ad947

SHA512
3c251fa414a5da9a6f073e0e7e37ee0a60c777a58a6ef05179911808ab73c49f0f335fabbc62ad90d921b832c75d249f9252443a2e6937180bd8d4b6ce13c0b2

Download Submit
C:\Windows\system\UiLKZAv.exe

Filesize
2.8MB

MD5
80fdc622714f2927670007fbec94ae1a

SHA1
1d6751267e698c909f7c17bea69dc2bf3a6e5735

SHA256
eb8b79885b2011e302d56577ddda63bebf22fa2141910703b109526375d562e7

SHA512
d177a0a973108eab4d250da2e6fcd0fd91bbdee04594dceb86383d64f55070f9b86a50ed6b86c6d73770e9a4631bdfa6650edbecae72e89ad43ff94fb2ad0d8c

Download Submit
C:\Windows\system\VkeoMLJ.exe

Filesize
2.8MB

MD5
87dfde3b24ca170c9015122941173a76

SHA1
da6781bd8a2a0079da27f967fa4356c4282cb701

SHA256
ffac11bf8030b0d4fe9200a64d4e461372ac1c0038581f546e1eb5d0423d477f

SHA512
31cf1fffcdd383b53d14f084b07b2e61158d1d19feb97f69b4de5f3077d25f007c7b78d7e09ebe3bb58cfc3845dadae959ad3970ace1e64f810c5bc1c7367cb5

Download Submit
C:\Windows\system\WPjMomO.exe

Filesize
2.8MB

MD5
bd8f023b0831d17968a6410a86d991d7

SHA1
dd79fce45dcf2fa1067705c5d886857e09094a76

SHA256
42e2e5aa82ff218f6ff07391d57c9cbdd5eb6683609b8f0e700cf1fa03cc2d85

SHA512
399cfc7a2e6b9250cd551d0f1ff125abc90ed82f1f495b4fa496fd8b1739672790369501f0f2380c8d3f1fff9a3f85a030666131425cd79e37a34343e9affd15

Download Submit
C:\Windows\system\WeBGwVO.exe

Filesize
2.8MB

MD5
b59c161191bc77aeb3f5da96e58b4394

SHA1
68d1f45e5440eddf06bf242034e85209e1eea3c9

SHA256
08fa5ce317cefb8d37a9aa8fbb5b84320e2fc35c7d5bdece8d5dd047c498cb42

SHA512
342d7e04fdc387994349d5710cee0bbc7b50f2ee3828967b5b6006ec8640d9cacfd97b97c8a224a8ed4192c35ad8be4cb6a8ec043a8aa0cd545d0a8bc28a8538

Download Submit
C:\Windows\system\ZmJVjFd.exe

Filesize
2.8MB

MD5
ca1f242f9f521f7f81be0b1fbf529d25

SHA1
b25a59d12a7f09a4680dcb3354c04daa4c405533

SHA256
a0e0264179579ce98be7917c4d717f07b04e2464c8a912617ea133200ed0dc5e

SHA512
6b4fb50e2427811a8878bd1f38d2849d0b734739058eec4fd3516b472b9db32b2c6c7dcf34b529c2f9bb233b47e2238b70a6c2914b8ea6b10242ac097f62f476

Download Submit
C:\Windows\system\bLHmwNi.exe

Filesize
2.8MB

MD5
7dfe8292713475bf4669198578eeb2b6

SHA1
44bfbba3d1921ed7114cc22828f5551455b50354

SHA256
410ce6b784e33403415e4e02f8e5dbe3d1a15f5e72b6e5b231386fb82c54685a

SHA512
a597278d7bd76b416d2b56339758eac3a94e910137d3b830db882688dde099ac93d8fd1b2c15435bd0a88ab47960d5ca965b07934656d1cc6fe619a446b97c2e

Download Submit
C:\Windows\system\eAxKmvV.exe

Filesize
2.8MB

MD5
f61c2d1f3a0e224f67461eae18dc7503

SHA1
5c5e19c75bf4d6a9eb3d7fc996e8bb2792296630

SHA256
ed6223c7d75bb1e053ea1fdeb4ebb7334e1065781ee25884c81d68d58d022df9

SHA512
a157e6bec978945896c09a8acb816317add1e9522f4679ab2ea35a173dbbc20d222a95f75a4669bb5b3de777606afb0ddd2b7ab8df811679a4228e3ab9987480

Download Submit
C:\Windows\system\eKEvqNu.exe

Filesize
2.8MB

MD5
53738af13be03d30a22909e14e72d4ba

SHA1
4df25b1ea836d6ff0e8acc204902bacc086ed421

SHA256
67e5e93e3684b0f21c820f5bf808a38fcfa5523ad49335d6410cab7711b9cfb5

SHA512
1f55052955e94d9669c4bd9082e3f82c3c53fb6aaaadd2644326e27aa8226a4e21a49798d8d04d65205492f106c3de1b3c6dd8c4ae108fad7ced671b20f32880

Download Submit
C:\Windows\system\gToDRCf.exe

Filesize
2.8MB

MD5
bfd236aaef22c35bdc1df9fb0792c418

SHA1
a982a8221f2920d06d8241bb5dd848e4961936a2

SHA256
ca5617f9f77be06fe4843649e2873c612704fcbd97b62f597484f011cab24340

SHA512
4ce3f0a7e225c435bd8686378f3319c026a2a852e5480d696dea401282c6d58504aef6d6d88c9d433e48da3400ad5304fd792bfc09683b7da31303d7645c8de7

Download Submit
C:\Windows\system\hIbrPml.exe

Filesize
2.8MB

MD5
a7e2e951bf474017d5ecc1242231d093

SHA1
9fd62a477048b9fbd5dbf5ceca3e879b11cd9f56

SHA256
bb067b5b1c3866068d742449820123297cbff80e022eaafa28518dfffa768f64

SHA512
7608ceea7788edf4410ca9d6370b7594cfaf9038fd04110d5e3c04765c1a7509674cf979f126dafd56c5856f69daccf1026f8fff0ea27feb500bb3b641225d56

Download Submit
C:\Windows\system\jYASKdJ.exe

Filesize
2.8MB

MD5
1a5e521cbea06bbf2add2f16ddc7d243

SHA1
cc4b0e4ccf25a9aae9a7c98c626b16d89c3e654a

SHA256
eb77a2f02ec85dbdccd0830848d73f5b71f8ae979d1f0620918c62061764fb28

SHA512
bee559b9b1658f89caca0b651393b49a558f1dbac65344d40f973dfd743e4cfae403b08fc8a1c14f5e975b1dae6189bb704a26aee9e5bd30279762d06d2cae60

Download Submit
C:\Windows\system\lFfYqlK.exe

Filesize
2.8MB

MD5
8f1409071bc33e886b083ecfc11d1463

SHA1
18b609cf780653861c4060c06f95b7e58e1ff39a

SHA256
dc40deb02d386490fa5e57b048b7d4847e629fff87f93acccc7d7fdd125b6ebd

SHA512
cf52ee2632e79688b58361c2d8585a7a7d7d8cce965ddf63acef5705b0c3f6fd9280ab9b70c5022031de530c1eca18334650d3852b0d1358f1f017be98df898d

Download Submit
C:\Windows\system\pCcOstI.exe

Filesize
8B

MD5
ad0a600ae38696a8cc7e0f79411b2de6

SHA1
e87da271dcefadc951fbf5de19cf84d8eac21a84

SHA256
8b51c7a5f3eb99b3c4bcad7fefc2c88bfb65a6efdf82c5da3d059595d1d0e9e9

SHA512
8d7e2808f4dca3686017927cee741a76a04a23b60c921209487adb614bfe800ba56bdec391d20388143da8e914411c7e8c63572944ba9607a1d2a18c62d04b2f

Download Submit
C:\Windows\system\pxDSVpS.exe

Filesize
2.8MB

MD5
00523d62e6669e7d8421fc94a1064e46

SHA1
27ad29741280afef9752481c911472a7fac4148d

SHA256
e7497e68a2c5119a626cda906895ff7e284136f1bf3b9e93e024c4a1e811d179

SHA512
86e59fb23a19997f4efca6680f4a3837549956a73e570acc10f9bb35e6c964deab9da703c1d65ff5174cf8f7054d3ae5a302611e96c2f62666f78caa4584435c

Download Submit
C:\Windows\system\qqUNDjy.exe

Filesize
2.8MB

MD5
8cc539169166a53d0ca277a6b9769948

SHA1
e28f5042bf771eaf3fb66d87439b97c92ef97a33

SHA256
65ab812704b14ddb91dfe5d0822babe4243bbf2be5a03259a8ca0ac24680a539

SHA512
46313cf10a6afdc42447fef801fccd6dbedf1a3c18265ca03ec8800254a67a690a0436b2552ac5cd201c8a7a4a7a2dc956b9e02182c5abf1849d27e407e00ba3

Download Submit
C:\Windows\system\uzGTDBG.exe

Filesize
2.8MB

MD5
381aecc69fa9e700f14754ee46836b9a

SHA1
986f9be3daae02c192f19b8ed6b3320006eb75cd

SHA256
7e2f0737712e9e8c33f230f7e0eb7c5fcb0f976a246bbca13c0cd2ba20892f30

SHA512
3a1bc26494f8e231216b3188e9da102e984978086bc04802564e8c5b3afd69bc366259747e29fb6370383d3357ca468ed57c35f6724c05251af23b75aea14d2c

Download Submit
C:\Windows\system\wcNLVEl.exe

Filesize
2.8MB

MD5
98cbc84ff1573570f4d67d302235d208

SHA1
69cd0ea400e915ec6b2de8d214f40c59f298d9ba

SHA256
e89e50f7045a32f1dcf015ee8b1ac365624299f9ffaf6456bb35528ff9350c23

SHA512
4e2f89cdc2189105d6f3b82f29ae060f605c4f2de0433806c4a93b70231a5736a1577d7c34bc838be8209a09f8bc0596dab87ca72634edc81d913cbe9b4c089c

Download Submit
C:\Windows\system\xcVvAIT.exe

Filesize
2.8MB

MD5
457b622bbab0c61965ff29294daf3122

SHA1
ac8925cd20f5eb0b84ae7de323996befd8cb0b6b

SHA256
2126ac645de82cc13ade268c33a721d24a28e175b0092edd7c11bb4dbfad1867

SHA512
7be2bf4bc1ce19e9f8a32302233f066772af0d712303fbf3c35a07699c0ce09dced1c2629c313afc079b2c30f60a2a1bcc0764e91555c38c77639832bdef6f80

Download Submit
C:\Windows\system\xzSIKKC.exe

Filesize
2.8MB

MD5
b6e93a85f15e9670b002946314258baf

SHA1
f36e6114e06d0fe0cb291755dd9208cba9f34362

SHA256
6a924728da69bc79613d86395573fe8469cb3bed48cff95a92ddd29e1313e8a1

SHA512
c0a501a28dc019497af74467b21cc8bd17bdd4e01f015ee70a177f0c559a17f31ad06b553c2b257c797f3ff245499ab42366ab39fbc429ef4a58096765eb0a77

Download Submit
C:\Windows\system\yKFOISx.exe

Filesize
2.8MB

MD5
18205bdf30e247aa66db99239fe710d3

SHA1
f9dffd5cfb483e4116ec85ded526f5d227955d1e

SHA256
c8f47a73164f202daf949da8775e4e5dd2ef6363aba2ec9477b30a23162ea31c

SHA512
12e88dea111200cc760b7da51da6dd3713d42c26d36fd67a0746502890b3509a3e1dfbba86015c31fc4413de79a527080ab1ba181c1fc8d3ba3c072c27f8d7db

Download Submit
C:\Windows\system\yxErVLF.exe

Filesize
2.8MB

MD5
4614e517a24b618f62101d5bdfd42302

SHA1
d1d8f4164ac4e714334133fbe854550ded59c415

SHA256
9c0c3b5d7f389ac6fd91b6b504838fb0f93cb852798b6bcb58c3cd122447cb24

SHA512
81c29cea47ec4b01abd346252acdd89f7f5efaf58e53e9d63075f2c33ac6452096cec7d62a0156db7d02a30e96178c7b4cbe2e8b7f3bfeffffea56d46449a62e

Download Submit
\Windows\system\fZDnIoO.exe

Filesize
2.8MB

MD5
b2be1a7259c65fa89f026062d2f53154

SHA1
626ee974b06f4655b62116a3f3de7174545fc6df

SHA256
9965858875cb47d53a46e728b0a46f0783c0136c79bd3c94e592bb0d9d45adad

SHA512
9d238ad85d0a6983b3c1e8a444090f712179cdc532d3ca270a77affb3af3089b861b689283bd7ab23e75df20c025c27b62c060e67df9ed0a10d97a518955730d

Download Submit
\Windows\system\pzhfoLi.exe

Filesize
2.8MB

MD5
62d3e95b1a897e3b9d777de9ad20de5b

SHA1
a52ddf5ec84aaaa6c2c08b40b98bc7b8d454cebb

SHA256
d54956a131c232e23ce06739f45ecd62328b3ef961ac35c68f9ecf0f84121498

SHA512
697b482fcf0ff85a28319f750d644a6ad9dc6b0578b4a21d87012529107abc001883a5ce8db00a957995630e04d0afe8359de8f8c51e112320e1038ea79354d2

Download Submit
\Windows\system\xyjzUGZ.exe

Filesize
2.8MB

MD5
8db851ef0b3018251daaec15db64c211

SHA1
52be98585417688c21d94a58181e7e5cff349392

SHA256
9098784c2320cc0f67d2575339e1524582ea8c0774871aba68beeee4a8b89cbd

SHA512
b87ec069c1faecfd2c5887c38b88da44fe687317f45175730924ba38e7cf26068f4aaf4b603de23eb18ddc123c1d3df18aee7b0da6e51570d33fbbe30e4ab81c

Download Submit
\Windows\system\ziQTmDV.exe

Filesize
2.8MB

MD5
1623d4fd6f3e7cb0b587fb7e642a8a14

SHA1
18e7eaad91fec9521f3f5b540399ac8ba4f5a87f

SHA256
3191a5dfd44f9d79fb1a8f0aca3f8a78bf98c9fc30a3078a7e061cc844d00bd8

SHA512
0f9417022ca2fd27ef4b2739f43ccd67ef0170d9732c929de3fe36c7303434d76c13581b9a1413d9ae937157c6ecbdac4f22a2c21295004d8bd24131d3ae06f5

Download Submit
memory/1196-5248-0x000000013F3A0000-0x000000013F796000-memory.dmp

Filesize
4.0MB

Download
memory/1196-90-0x000000013F3A0000-0x000000013F796000-memory.dmp

Filesize
4.0MB

Download
memory/1840-121-0x000000013F8A0000-0x000000013FC96000-memory.dmp

Filesize
4.0MB

Download
memory/2352-186-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/2352-180-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2380-132-0x00000000038F0000-0x0000000003CE6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-122-0x0000000003120000-0x0000000003516000-memory.dmp

Filesize
4.0MB

Download
memory/2380-125-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/2380-8540-0x00000000038F0000-0x0000000003CE6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-56-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2380-82-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2380-120-0x0000000003120000-0x0000000003516000-memory.dmp

Filesize
4.0MB

Download
memory/2380-91-0x00000000038F0000-0x0000000003CE6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2380-127-0x00000000038F0000-0x0000000003CE6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-95-0x000000013F070000-0x000000013F466000-memory.dmp

Filesize
4.0MB

Download
memory/2380-128-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/2380-8533-0x00000000038F0000-0x0000000003CE6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-124-0x00000000038F0000-0x0000000003CE6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-7780-0x00000000038F0000-0x0000000003CE6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-6997-0x000000013F4B0000-0x000000013F8A6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-43-0x0000000003120000-0x0000000003516000-memory.dmp

Filesize
4.0MB

Download
memory/2380-1-0x000000013F4B0000-0x000000013F8A6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-54-0x0000000003120000-0x0000000003516000-memory.dmp

Filesize
4.0MB

Download
memory/2380-7-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/2580-53-0x000000013F290000-0x000000013F686000-memory.dmp

Filesize
4.0MB

Download
memory/2580-5200-0x000000013F290000-0x000000013F686000-memory.dmp

Filesize
4.0MB

Download
memory/2584-5219-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2584-72-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2712-63-0x000000013F4D0000-0x000000013F8C6000-memory.dmp

Filesize
4.0MB

Download
memory/2712-5204-0x000000013F4D0000-0x000000013F8C6000-memory.dmp

Filesize
4.0MB

Download
memory/2728-123-0x000000013F290000-0x000000013F686000-memory.dmp

Filesize
4.0MB

Download
memory/2732-88-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2732-5246-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2772-37-0x000000013F330000-0x000000013F726000-memory.dmp

Filesize
4.0MB

Download
memory/2772-5191-0x000000013F330000-0x000000013F726000-memory.dmp

Filesize
4.0MB

Download
memory/3000-5194-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/3000-17-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download