xmrig | fbebbe8b289233e190a70ff2cc0adc2a88c5ee9837ad7242e2069425d42851c4

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
Size

2.8MB
MD5

416a861f3e4e362db493d4ec233c72b0
SHA1

45b3e74bad05e6ceaa8695a24415abb7ac63e5a4
SHA256

fbebbe8b289233e190a70ff2cc0adc2a88c5ee9837ad7242e2069425d42851c4
SHA512

48bf058bdcbf959476bb9c19084cab3138ba04f94283eb3e7df4f34abe28be7a2cc059913130d6506982f2494bb096687d94681db0d8fb619bc572be53f300f8
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a2yKmkt:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 63 IoCs

miner

resource	yara_rule
behavioral1/memory/2004-2-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/files/0x000a00000001466c-3.dat	xmrig
behavioral1/memory/2004-8-0x0000000002D40000-0x0000000003136000-memory.dmp	xmrig
behavioral1/memory/2256-9-0x000000013F790000-0x000000013FB86000-memory.dmp	xmrig
behavioral1/files/0x000a000000015364-17.dat	xmrig
behavioral1/files/0x0008000000015a98-45.dat	xmrig
behavioral1/files/0x00080000000155e2-39.dat	xmrig
behavioral1/memory/1708-52-0x0000000002990000-0x0000000002A10000-memory.dmp	xmrig
behavioral1/memory/2536-55-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	xmrig
behavioral1/memory/2696-58-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/files/0x0006000000015e5b-67.dat	xmrig
behavioral1/files/0x0006000000015eaf-83.dat	xmrig
behavioral1/files/0x0006000000015ec0-88.dat	xmrig
behavioral1/files/0x0006000000016283-103.dat	xmrig
behavioral1/files/0x0006000000016332-108.dat	xmrig
behavioral1/files/0x0006000000016cf0-178.dat	xmrig
behavioral1/memory/2620-228-0x000000013F210000-0x000000013F606000-memory.dmp	xmrig
behavioral1/memory/2768-271-0x000000013FF50000-0x0000000140346000-memory.dmp	xmrig
behavioral1/memory/2004-273-0x00000000032B0000-0x00000000036A6000-memory.dmp	xmrig
behavioral1/memory/2004-563-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/2428-263-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig
behavioral1/memory/2360-244-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	xmrig
behavioral1/memory/1156-235-0x000000013FA00000-0x000000013FDF6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016ccf-168.dat	xmrig
behavioral1/files/0x0006000000016cd4-173.dat	xmrig
behavioral1/files/0x0006000000016ca9-163.dat	xmrig
behavioral1/files/0x0006000000016c90-158.dat	xmrig
behavioral1/files/0x0006000000016c23-153.dat	xmrig
behavioral1/files/0x0006000000016c1a-148.dat	xmrig
behavioral1/files/0x0006000000016c10-143.dat	xmrig
behavioral1/files/0x0006000000016b96-138.dat	xmrig
behavioral1/files/0x0006000000016b5e-133.dat	xmrig
behavioral1/files/0x00060000000167db-128.dat	xmrig
behavioral1/files/0x000600000001663d-123.dat	xmrig
behavioral1/files/0x00060000000165ae-118.dat	xmrig
behavioral1/files/0x0006000000016476-113.dat	xmrig
behavioral1/files/0x000600000001604b-98.dat	xmrig
behavioral1/files/0x0006000000016042-93.dat	xmrig
behavioral1/files/0x0006000000015e7c-79.dat	xmrig
behavioral1/files/0x0006000000015e6f-73.dat	xmrig
behavioral1/memory/2004-59-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	xmrig
behavioral1/files/0x0007000000015c2f-57.dat	xmrig
behavioral1/files/0x0006000000015e41-63.dat	xmrig
behavioral1/memory/2496-51-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/2596-49-0x000000013FED0000-0x00000001402C6000-memory.dmp	xmrig
behavioral1/files/0x000a000000015a2d-37.dat	xmrig
behavioral1/memory/2436-30-0x000000013FBC0000-0x000000013FFB6000-memory.dmp	xmrig
behavioral1/files/0x000f0000000006fd-35.dat	xmrig
behavioral1/memory/1960-22-0x000000013FB50000-0x000000013FF46000-memory.dmp	xmrig
behavioral1/files/0x000c000000014fe1-19.dat	xmrig
behavioral1/memory/2256-2528-0x000000013F790000-0x000000013FB86000-memory.dmp	xmrig
behavioral1/memory/2436-2530-0x000000013FBC0000-0x000000013FFB6000-memory.dmp	xmrig
behavioral1/memory/1960-2529-0x000000013FB50000-0x000000013FF46000-memory.dmp	xmrig
behavioral1/memory/2596-2535-0x000000013FED0000-0x00000001402C6000-memory.dmp	xmrig
behavioral1/memory/2696-2552-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/2496-2551-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/2536-2544-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	xmrig
behavioral1/memory/2360-2562-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	xmrig
behavioral1/memory/2768-2570-0x000000013FF50000-0x0000000140346000-memory.dmp	xmrig
behavioral1/memory/2428-2558-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig
behavioral1/memory/1156-2557-0x000000013FA00000-0x000000013FDF6000-memory.dmp	xmrig
behavioral1/memory/2620-2902-0x000000013F210000-0x000000013F606000-memory.dmp	xmrig
behavioral1/memory/2620-2987-0x000000013F210000-0x000000013F606000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1708	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2256	IdHpsWg.exe
2436	TNkhmzR.exe
1960	jBenMmY.exe
2596	cLKkgeG.exe
2496	PUrdOhu.exe
2536	dvcaZIJ.exe
2696	GQeCFUt.exe
2620	HCjBXkP.exe
1156	NhfuIkp.exe
2360	lvUBgpC.exe
2428	KSHMCWw.exe
2768	nwinsGI.exe
640	GLlCRSJ.exe
1764	wKcVHBk.exe
1516	TXbFzxU.exe
1968	wjpdUFe.exe
1152	xCZvcyJ.exe
2236	iNUhrBR.exe
2312	WiDseWG.exe
1452	ZCkhsCW.exe
2216	KwNzENi.exe
1980	rXZtfJU.exe
1652	mJKfpwu.exe
1556	wMIIoam.exe
1468	uAPjXlt.exe
2668	ctkUziX.exe
1668	JVOhZWt.exe
2908	JeYlHGY.exe
2752	bYAQjzv.exe
2020	PYyBYdN.exe
2648	rkgDmvd.exe
2408	dYODrsJ.exe
2724	lFzBEIK.exe
476	dsNxaZT.exe
1988	FVEYlKf.exe
1756	ZJBjcjE.exe
1880	BQLcRqz.exe
1644	KCIONkQ.exe
1584	AABdUqH.exe
1640	EfToYns.exe
1676	ZYgxXRS.exe
1120	rxyCwBD.exe
1932	yqgJpCp.exe
2064	ZYlvfWS.exe
2708	REieCDr.exe
2688	qGXUHbO.exe
2744	hDuDlkQ.exe
1484	mKzngKQ.exe
2996	QFPoeCQ.exe
896	VpxhdHc.exe
1016	ciUQEpf.exe
2820	ctfbYIF.exe
1632	GaUSdYb.exe
1540	kebJDfR.exe
3024	iCvZvvz.exe
3016	abaxPbA.exe
2384	GKlfEeO.exe
2244	osdxwpL.exe
2632	BLsdPKX.exe
2088	hNOsNHU.exe
2392	eLZyHKh.exe
764	FshZvvs.exe
1884	ReXHBEY.exe
1768	yYXzDKU.exe

Loads dropped DLL 64 IoCs

pid	Process
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2004-2-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/files/0x000a00000001466c-3.dat	upx
behavioral1/memory/2004-8-0x0000000002D40000-0x0000000003136000-memory.dmp	upx
behavioral1/memory/2256-9-0x000000013F790000-0x000000013FB86000-memory.dmp	upx
behavioral1/files/0x000a000000015364-17.dat	upx
behavioral1/files/0x0008000000015a98-45.dat	upx
behavioral1/files/0x00080000000155e2-39.dat	upx
behavioral1/memory/2536-55-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	upx
behavioral1/memory/2696-58-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/files/0x0006000000015e5b-67.dat	upx
behavioral1/files/0x0006000000015eaf-83.dat	upx
behavioral1/files/0x0006000000015ec0-88.dat	upx
behavioral1/files/0x0006000000016283-103.dat	upx
behavioral1/files/0x0006000000016332-108.dat	upx
behavioral1/files/0x0006000000016cf0-178.dat	upx
behavioral1/memory/2620-228-0x000000013F210000-0x000000013F606000-memory.dmp	upx
behavioral1/memory/2768-271-0x000000013FF50000-0x0000000140346000-memory.dmp	upx
behavioral1/memory/2004-563-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/2428-263-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	upx
behavioral1/memory/2360-244-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	upx
behavioral1/memory/1156-235-0x000000013FA00000-0x000000013FDF6000-memory.dmp	upx
behavioral1/files/0x0006000000016ccf-168.dat	upx
behavioral1/files/0x0006000000016cd4-173.dat	upx
behavioral1/files/0x0006000000016ca9-163.dat	upx
behavioral1/files/0x0006000000016c90-158.dat	upx
behavioral1/files/0x0006000000016c23-153.dat	upx
behavioral1/files/0x0006000000016c1a-148.dat	upx
behavioral1/files/0x0006000000016c10-143.dat	upx
behavioral1/files/0x0006000000016b96-138.dat	upx
behavioral1/files/0x0006000000016b5e-133.dat	upx
behavioral1/files/0x00060000000167db-128.dat	upx
behavioral1/files/0x000600000001663d-123.dat	upx
behavioral1/files/0x00060000000165ae-118.dat	upx
behavioral1/files/0x0006000000016476-113.dat	upx
behavioral1/files/0x000600000001604b-98.dat	upx
behavioral1/files/0x0006000000016042-93.dat	upx
behavioral1/files/0x0006000000015e7c-79.dat	upx
behavioral1/files/0x0006000000015e6f-73.dat	upx
behavioral1/files/0x0007000000015c2f-57.dat	upx
behavioral1/files/0x0006000000015e41-63.dat	upx
behavioral1/memory/2496-51-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2596-49-0x000000013FED0000-0x00000001402C6000-memory.dmp	upx
behavioral1/files/0x000a000000015a2d-37.dat	upx
behavioral1/memory/2436-30-0x000000013FBC0000-0x000000013FFB6000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-35.dat	upx
behavioral1/memory/1960-22-0x000000013FB50000-0x000000013FF46000-memory.dmp	upx
behavioral1/files/0x000c000000014fe1-19.dat	upx
behavioral1/memory/2256-2528-0x000000013F790000-0x000000013FB86000-memory.dmp	upx
behavioral1/memory/2436-2530-0x000000013FBC0000-0x000000013FFB6000-memory.dmp	upx
behavioral1/memory/1960-2529-0x000000013FB50000-0x000000013FF46000-memory.dmp	upx
behavioral1/memory/2596-2535-0x000000013FED0000-0x00000001402C6000-memory.dmp	upx
behavioral1/memory/2696-2552-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/2496-2551-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2536-2544-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	upx
behavioral1/memory/2360-2562-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	upx
behavioral1/memory/2768-2570-0x000000013FF50000-0x0000000140346000-memory.dmp	upx
behavioral1/memory/2428-2558-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	upx
behavioral1/memory/1156-2557-0x000000013FA00000-0x000000013FDF6000-memory.dmp	upx
behavioral1/memory/2620-2902-0x000000013F210000-0x000000013F606000-memory.dmp	upx
behavioral1/memory/2620-2987-0x000000013F210000-0x000000013F606000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dzbdKdf.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\QrqDEfa.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\kttqJII.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\PxelAbE.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\qRQLrMZ.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\cVdyGJN.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\oStAIvd.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\YQtHLbx.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\nlxZfmz.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\KCIONkQ.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\IdoFGQp.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\hUdiuDh.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\RirGTBM.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\SRNvlHO.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\yMDHGHW.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\JlmwXQQ.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\QwwAkkO.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\LGeDAYh.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\YmLFZLc.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\BahBWSQ.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\xSxmrrY.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\UXijTUw.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\TMRxjJV.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\zOGrPJH.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\rLspjpS.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\VSJSnHO.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\rXEKRHY.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\PreclYW.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\kSEGEWh.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\Ybqwdya.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\HZKQmaz.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\cXkGBZI.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\jlowiCO.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\EyRMUhA.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\diiDYuQ.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\RitDDCx.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\VqXamBw.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\USrLQSv.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\DcXLSQD.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\xVuqxaf.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\zXSuZkx.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\QFPoeCQ.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\jvPNOOu.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\BzuawMw.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\DcekvTZ.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\nHDubfC.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\wWyqPtu.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\YoamSkE.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\qYevWFN.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\juHoquR.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\vHeVeYX.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\BHFXeRI.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\vtAUrKR.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\YPHsiSr.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\PxnDQpE.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\WZHLnjy.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\luOMtGE.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\jcPCYqM.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\dEGUmDi.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\PYyBYdN.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\JyZIHFz.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\caefufC.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\ZMyzNyw.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
File created	C:\Windows\System\DEBsIiW.exe	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1708	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1708	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1708	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	29
PID 2004 wrote to memory of 1708	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	29
PID 2004 wrote to memory of 1708	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	29
PID 2004 wrote to memory of 2256	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	30
PID 2004 wrote to memory of 2256	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	30
PID 2004 wrote to memory of 2256	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	30
PID 2004 wrote to memory of 1960	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	31
PID 2004 wrote to memory of 1960	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	31
PID 2004 wrote to memory of 1960	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	31
PID 2004 wrote to memory of 2436	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	32
PID 2004 wrote to memory of 2436	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	32
PID 2004 wrote to memory of 2436	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	32
PID 2004 wrote to memory of 2496	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	33
PID 2004 wrote to memory of 2496	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	33
PID 2004 wrote to memory of 2496	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	33
PID 2004 wrote to memory of 2596	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	34
PID 2004 wrote to memory of 2596	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	34
PID 2004 wrote to memory of 2596	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	34
PID 2004 wrote to memory of 2696	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	35
PID 2004 wrote to memory of 2696	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	35
PID 2004 wrote to memory of 2696	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	35
PID 2004 wrote to memory of 2536	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	36
PID 2004 wrote to memory of 2536	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	36
PID 2004 wrote to memory of 2536	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	36
PID 2004 wrote to memory of 2620	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	37
PID 2004 wrote to memory of 2620	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	37
PID 2004 wrote to memory of 2620	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	37
PID 2004 wrote to memory of 1156	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	38
PID 2004 wrote to memory of 1156	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	38
PID 2004 wrote to memory of 1156	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	38
PID 2004 wrote to memory of 2360	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	39
PID 2004 wrote to memory of 2360	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	39
PID 2004 wrote to memory of 2360	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	39
PID 2004 wrote to memory of 2428	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	40
PID 2004 wrote to memory of 2428	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	40
PID 2004 wrote to memory of 2428	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	40
PID 2004 wrote to memory of 2768	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	41
PID 2004 wrote to memory of 2768	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	41
PID 2004 wrote to memory of 2768	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	41
PID 2004 wrote to memory of 640	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	42
PID 2004 wrote to memory of 640	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	42
PID 2004 wrote to memory of 640	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	42
PID 2004 wrote to memory of 1764	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	43
PID 2004 wrote to memory of 1764	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	43
PID 2004 wrote to memory of 1764	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	43
PID 2004 wrote to memory of 1516	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	44
PID 2004 wrote to memory of 1516	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	44
PID 2004 wrote to memory of 1516	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	44
PID 2004 wrote to memory of 1968	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	45
PID 2004 wrote to memory of 1968	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	45
PID 2004 wrote to memory of 1968	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	45
PID 2004 wrote to memory of 1152	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	46
PID 2004 wrote to memory of 1152	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	46
PID 2004 wrote to memory of 1152	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	46
PID 2004 wrote to memory of 2236	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	47
PID 2004 wrote to memory of 2236	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	47
PID 2004 wrote to memory of 2236	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	47
PID 2004 wrote to memory of 2312	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	48
PID 2004 wrote to memory of 2312	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	48
PID 2004 wrote to memory of 2312	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	48
PID 2004 wrote to memory of 1452	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	49
PID 2004 wrote to memory of 1452	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	49
PID 2004 wrote to memory of 1452	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	49
PID 2004 wrote to memory of 2216	2004	416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\416a861f3e4e362db493d4ec233c72b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\System\IdHpsWg.exe
  C:\Windows\System\IdHpsWg.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\jBenMmY.exe
  C:\Windows\System\jBenMmY.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\TNkhmzR.exe
  C:\Windows\System\TNkhmzR.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\PUrdOhu.exe
  C:\Windows\System\PUrdOhu.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\cLKkgeG.exe
  C:\Windows\System\cLKkgeG.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\GQeCFUt.exe
  C:\Windows\System\GQeCFUt.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\dvcaZIJ.exe
  C:\Windows\System\dvcaZIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\HCjBXkP.exe
  C:\Windows\System\HCjBXkP.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\NhfuIkp.exe
  C:\Windows\System\NhfuIkp.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\lvUBgpC.exe
  C:\Windows\System\lvUBgpC.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\KSHMCWw.exe
  C:\Windows\System\KSHMCWw.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\nwinsGI.exe
  C:\Windows\System\nwinsGI.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\GLlCRSJ.exe
  C:\Windows\System\GLlCRSJ.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\wKcVHBk.exe
  C:\Windows\System\wKcVHBk.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\TXbFzxU.exe
  C:\Windows\System\TXbFzxU.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\wjpdUFe.exe
  C:\Windows\System\wjpdUFe.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\xCZvcyJ.exe
  C:\Windows\System\xCZvcyJ.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\iNUhrBR.exe
  C:\Windows\System\iNUhrBR.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\WiDseWG.exe
  C:\Windows\System\WiDseWG.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ZCkhsCW.exe
  C:\Windows\System\ZCkhsCW.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\KwNzENi.exe
  C:\Windows\System\KwNzENi.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\rXZtfJU.exe
  C:\Windows\System\rXZtfJU.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\mJKfpwu.exe
  C:\Windows\System\mJKfpwu.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\wMIIoam.exe
  C:\Windows\System\wMIIoam.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\uAPjXlt.exe
  C:\Windows\System\uAPjXlt.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\ctkUziX.exe
  C:\Windows\System\ctkUziX.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\JVOhZWt.exe
  C:\Windows\System\JVOhZWt.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\JeYlHGY.exe
  C:\Windows\System\JeYlHGY.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\bYAQjzv.exe
  C:\Windows\System\bYAQjzv.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\PYyBYdN.exe
  C:\Windows\System\PYyBYdN.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\rkgDmvd.exe
  C:\Windows\System\rkgDmvd.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\dYODrsJ.exe
  C:\Windows\System\dYODrsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\lFzBEIK.exe
  C:\Windows\System\lFzBEIK.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\dsNxaZT.exe
  C:\Windows\System\dsNxaZT.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\FVEYlKf.exe
  C:\Windows\System\FVEYlKf.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\BQLcRqz.exe
  C:\Windows\System\BQLcRqz.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\ZJBjcjE.exe
  C:\Windows\System\ZJBjcjE.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\KCIONkQ.exe
  C:\Windows\System\KCIONkQ.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\AABdUqH.exe
  C:\Windows\System\AABdUqH.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\EfToYns.exe
  C:\Windows\System\EfToYns.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ZYgxXRS.exe
  C:\Windows\System\ZYgxXRS.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\rxyCwBD.exe
  C:\Windows\System\rxyCwBD.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\yqgJpCp.exe
  C:\Windows\System\yqgJpCp.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\ZYlvfWS.exe
  C:\Windows\System\ZYlvfWS.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\REieCDr.exe
  C:\Windows\System\REieCDr.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\hDuDlkQ.exe
  C:\Windows\System\hDuDlkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\qGXUHbO.exe
  C:\Windows\System\qGXUHbO.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\QFPoeCQ.exe
  C:\Windows\System\QFPoeCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\mKzngKQ.exe
  C:\Windows\System\mKzngKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\ciUQEpf.exe
  C:\Windows\System\ciUQEpf.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\VpxhdHc.exe
  C:\Windows\System\VpxhdHc.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\kebJDfR.exe
  C:\Windows\System\kebJDfR.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\ctfbYIF.exe
  C:\Windows\System\ctfbYIF.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\abaxPbA.exe
  C:\Windows\System\abaxPbA.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\GaUSdYb.exe
  C:\Windows\System\GaUSdYb.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\osdxwpL.exe
  C:\Windows\System\osdxwpL.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\iCvZvvz.exe
  C:\Windows\System\iCvZvvz.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\BLsdPKX.exe
  C:\Windows\System\BLsdPKX.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\GKlfEeO.exe
  C:\Windows\System\GKlfEeO.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\hNOsNHU.exe
  C:\Windows\System\hNOsNHU.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\eLZyHKh.exe
  C:\Windows\System\eLZyHKh.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\FshZvvs.exe
  C:\Windows\System\FshZvvs.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\ReXHBEY.exe
  C:\Windows\System\ReXHBEY.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\yYXzDKU.exe
  C:\Windows\System\yYXzDKU.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\pIoXxwv.exe
  C:\Windows\System\pIoXxwv.exe
  2⤵
  PID:1776
- C:\Windows\System\fgLrAgl.exe
  C:\Windows\System\fgLrAgl.exe
  2⤵
  PID:1964
- C:\Windows\System\njvnDVz.exe
  C:\Windows\System\njvnDVz.exe
  2⤵
  PID:1840
- C:\Windows\System\bkVQsAU.exe
  C:\Windows\System\bkVQsAU.exe
  2⤵
  PID:1928
- C:\Windows\System\EhvBagR.exe
  C:\Windows\System\EhvBagR.exe
  2⤵
  PID:2056
- C:\Windows\System\NmFAapi.exe
  C:\Windows\System\NmFAapi.exe
  2⤵
  PID:1140
- C:\Windows\System\kwWUBky.exe
  C:\Windows\System\kwWUBky.exe
  2⤵
  PID:1296
- C:\Windows\System\OApqODP.exe
  C:\Windows\System\OApqODP.exe
  2⤵
  PID:780
- C:\Windows\System\yMxWEge.exe
  C:\Windows\System\yMxWEge.exe
  2⤵
  PID:1576
- C:\Windows\System\pNgxMdr.exe
  C:\Windows\System\pNgxMdr.exe
  2⤵
  PID:2712
- C:\Windows\System\GnLOrGF.exe
  C:\Windows\System\GnLOrGF.exe
  2⤵
  PID:2664
- C:\Windows\System\sHBYrQa.exe
  C:\Windows\System\sHBYrQa.exe
  2⤵
  PID:844
- C:\Windows\System\hHlqLJt.exe
  C:\Windows\System\hHlqLJt.exe
  2⤵
  PID:980
- C:\Windows\System\BvPYWND.exe
  C:\Windows\System\BvPYWND.exe
  2⤵
  PID:2240
- C:\Windows\System\DaLIkdh.exe
  C:\Windows\System\DaLIkdh.exe
  2⤵
  PID:2972
- C:\Windows\System\xOtsVEf.exe
  C:\Windows\System\xOtsVEf.exe
  2⤵
  PID:1536
- C:\Windows\System\byhLpCc.exe
  C:\Windows\System\byhLpCc.exe
  2⤵
  PID:2616
- C:\Windows\System\PPMqUfa.exe
  C:\Windows\System\PPMqUfa.exe
  2⤵
  PID:2352
- C:\Windows\System\IJcQpby.exe
  C:\Windows\System\IJcQpby.exe
  2⤵
  PID:2540
- C:\Windows\System\vsWQtLJ.exe
  C:\Windows\System\vsWQtLJ.exe
  2⤵
  PID:2844
- C:\Windows\System\FUVUOkA.exe
  C:\Windows\System\FUVUOkA.exe
  2⤵
  PID:804
- C:\Windows\System\ehEFdZI.exe
  C:\Windows\System\ehEFdZI.exe
  2⤵
  PID:2660
- C:\Windows\System\iswgDLf.exe
  C:\Windows\System\iswgDLf.exe
  2⤵
  PID:2452
- C:\Windows\System\XpCaXWf.exe
  C:\Windows\System\XpCaXWf.exe
  2⤵
  PID:2528
- C:\Windows\System\XdMLdBK.exe
  C:\Windows\System\XdMLdBK.exe
  2⤵
  PID:2888
- C:\Windows\System\cOdCBEe.exe
  C:\Windows\System\cOdCBEe.exe
  2⤵
  PID:1820
- C:\Windows\System\LCDxEkn.exe
  C:\Windows\System\LCDxEkn.exe
  2⤵
  PID:2992
- C:\Windows\System\BvEeLsn.exe
  C:\Windows\System\BvEeLsn.exe
  2⤵
  PID:1044
- C:\Windows\System\mmTxdbT.exe
  C:\Windows\System\mmTxdbT.exe
  2⤵
  PID:880
- C:\Windows\System\xzlwcBI.exe
  C:\Windows\System\xzlwcBI.exe
  2⤵
  PID:2936
- C:\Windows\System\vQAEMCC.exe
  C:\Windows\System\vQAEMCC.exe
  2⤵
  PID:2000
- C:\Windows\System\ehpyhzh.exe
  C:\Windows\System\ehpyhzh.exe
  2⤵
  PID:1716
- C:\Windows\System\drMGERu.exe
  C:\Windows\System\drMGERu.exe
  2⤵
  PID:1160
- C:\Windows\System\wSDReHK.exe
  C:\Windows\System\wSDReHK.exe
  2⤵
  PID:1744
- C:\Windows\System\bnBadEH.exe
  C:\Windows\System\bnBadEH.exe
  2⤵
  PID:2576
- C:\Windows\System\fbZJTtn.exe
  C:\Windows\System\fbZJTtn.exe
  2⤵
  PID:2008
- C:\Windows\System\JhxOUZr.exe
  C:\Windows\System\JhxOUZr.exe
  2⤵
  PID:1512
- C:\Windows\System\XGQPBlj.exe
  C:\Windows\System\XGQPBlj.exe
  2⤵
  PID:1628
- C:\Windows\System\bmpYBXn.exe
  C:\Windows\System\bmpYBXn.exe
  2⤵
  PID:2464
- C:\Windows\System\CRLNzuU.exe
  C:\Windows\System\CRLNzuU.exe
  2⤵
  PID:584
- C:\Windows\System\GwcbQvG.exe
  C:\Windows\System\GwcbQvG.exe
  2⤵
  PID:2320
- C:\Windows\System\vkVtBbM.exe
  C:\Windows\System\vkVtBbM.exe
  2⤵
  PID:768
- C:\Windows\System\rQDhUMq.exe
  C:\Windows\System\rQDhUMq.exe
  2⤵
  PID:1740
- C:\Windows\System\EkjBqKc.exe
  C:\Windows\System\EkjBqKc.exe
  2⤵
  PID:1784
- C:\Windows\System\nHDubfC.exe
  C:\Windows\System\nHDubfC.exe
  2⤵
  PID:2988
- C:\Windows\System\ysvowFu.exe
  C:\Windows\System\ysvowFu.exe
  2⤵
  PID:3032
- C:\Windows\System\ZEESvHN.exe
  C:\Windows\System\ZEESvHN.exe
  2⤵
  PID:2448
- C:\Windows\System\HiXUtwx.exe
  C:\Windows\System\HiXUtwx.exe
  2⤵
  PID:1996
- C:\Windows\System\dMnnsqo.exe
  C:\Windows\System\dMnnsqo.exe
  2⤵
  PID:2880
- C:\Windows\System\TjiCuEa.exe
  C:\Windows\System\TjiCuEa.exe
  2⤵
  PID:392
- C:\Windows\System\VUnCAFK.exe
  C:\Windows\System\VUnCAFK.exe
  2⤵
  PID:2544
- C:\Windows\System\zPyLDXO.exe
  C:\Windows\System\zPyLDXO.exe
  2⤵
  PID:2016
- C:\Windows\System\reGiMND.exe
  C:\Windows\System\reGiMND.exe
  2⤵
  PID:2876
- C:\Windows\System\rYtMHvy.exe
  C:\Windows\System\rYtMHvy.exe
  2⤵
  PID:632
- C:\Windows\System\rZkVIwg.exe
  C:\Windows\System\rZkVIwg.exe
  2⤵
  PID:2856
- C:\Windows\System\WZcnziG.exe
  C:\Windows\System\WZcnziG.exe
  2⤵
  PID:836
- C:\Windows\System\jqXGZxU.exe
  C:\Windows\System\jqXGZxU.exe
  2⤵
  PID:2732
- C:\Windows\System\GaXaOiW.exe
  C:\Windows\System\GaXaOiW.exe
  2⤵
  PID:2072
- C:\Windows\System\QFoQtKc.exe
  C:\Windows\System\QFoQtKc.exe
  2⤵
  PID:2376
- C:\Windows\System\mqQiiTa.exe
  C:\Windows\System\mqQiiTa.exe
  2⤵
  PID:3012
- C:\Windows\System\YBWXFDz.exe
  C:\Windows\System\YBWXFDz.exe
  2⤵
  PID:1580
- C:\Windows\System\DTWRrsX.exe
  C:\Windows\System\DTWRrsX.exe
  2⤵
  PID:1808
- C:\Windows\System\DEXLCaW.exe
  C:\Windows\System\DEXLCaW.exe
  2⤵
  PID:2424
- C:\Windows\System\ETJgGAE.exe
  C:\Windows\System\ETJgGAE.exe
  2⤵
  PID:1308
- C:\Windows\System\zhafjQE.exe
  C:\Windows\System\zhafjQE.exe
  2⤵
  PID:2316
- C:\Windows\System\lCewNDq.exe
  C:\Windows\System\lCewNDq.exe
  2⤵
  PID:1488
- C:\Windows\System\UARVgoW.exe
  C:\Windows\System\UARVgoW.exe
  2⤵
  PID:1956
- C:\Windows\System\GlTYsrp.exe
  C:\Windows\System\GlTYsrp.exe
  2⤵
  PID:1132
- C:\Windows\System\BmCPwUw.exe
  C:\Windows\System\BmCPwUw.exe
  2⤵
  PID:1912
- C:\Windows\System\sCZfUKS.exe
  C:\Windows\System\sCZfUKS.exe
  2⤵
  PID:2816
- C:\Windows\System\IvhIvOh.exe
  C:\Windows\System\IvhIvOh.exe
  2⤵
  PID:2960
- C:\Windows\System\XyenZfF.exe
  C:\Windows\System\XyenZfF.exe
  2⤵
  PID:2640
- C:\Windows\System\OoiBNMG.exe
  C:\Windows\System\OoiBNMG.exe
  2⤵
  PID:1520
- C:\Windows\System\ZeiuTnJ.exe
  C:\Windows\System\ZeiuTnJ.exe
  2⤵
  PID:2404
- C:\Windows\System\bDxrZeF.exe
  C:\Windows\System\bDxrZeF.exe
  2⤵
  PID:2652
- C:\Windows\System\PnmXsaf.exe
  C:\Windows\System\PnmXsaf.exe
  2⤵
  PID:2120
- C:\Windows\System\lJIiwKt.exe
  C:\Windows\System\lJIiwKt.exe
  2⤵
  PID:1760
- C:\Windows\System\ySiWiIY.exe
  C:\Windows\System\ySiWiIY.exe
  2⤵
  PID:1612
- C:\Windows\System\DLMFzVJ.exe
  C:\Windows\System\DLMFzVJ.exe
  2⤵
  PID:2484
- C:\Windows\System\kxwCuEM.exe
  C:\Windows\System\kxwCuEM.exe
  2⤵
  PID:2840
- C:\Windows\System\gjWCgtM.exe
  C:\Windows\System\gjWCgtM.exe
  2⤵
  PID:1704
- C:\Windows\System\VfccJjH.exe
  C:\Windows\System\VfccJjH.exe
  2⤵
  PID:856
- C:\Windows\System\MzctNZf.exe
  C:\Windows\System\MzctNZf.exe
  2⤵
  PID:2012
- C:\Windows\System\pDGdzKc.exe
  C:\Windows\System\pDGdzKc.exe
  2⤵
  PID:2212
- C:\Windows\System\yffmXgH.exe
  C:\Windows\System\yffmXgH.exe
  2⤵
  PID:1904
- C:\Windows\System\VFXXHgA.exe
  C:\Windows\System\VFXXHgA.exe
  2⤵
  PID:2184
- C:\Windows\System\HLTcyhf.exe
  C:\Windows\System\HLTcyhf.exe
  2⤵
  PID:1020
- C:\Windows\System\IKCYPjE.exe
  C:\Windows\System\IKCYPjE.exe
  2⤵
  PID:1728
- C:\Windows\System\MKCBYFn.exe
  C:\Windows\System\MKCBYFn.exe
  2⤵
  PID:912
- C:\Windows\System\DTbVjMZ.exe
  C:\Windows\System\DTbVjMZ.exe
  2⤵
  PID:2912
- C:\Windows\System\eSqxAqV.exe
  C:\Windows\System\eSqxAqV.exe
  2⤵
  PID:2100
- C:\Windows\System\qxIINhl.exe
  C:\Windows\System\qxIINhl.exe
  2⤵
  PID:1984
- C:\Windows\System\rjenXBE.exe
  C:\Windows\System\rjenXBE.exe
  2⤵
  PID:2444
- C:\Windows\System\bCMidfG.exe
  C:\Windows\System\bCMidfG.exe
  2⤵
  PID:2252
- C:\Windows\System\vQMsTox.exe
  C:\Windows\System\vQMsTox.exe
  2⤵
  PID:2800
- C:\Windows\System\YZLFmnq.exe
  C:\Windows\System\YZLFmnq.exe
  2⤵
  PID:952
- C:\Windows\System\gyWxalM.exe
  C:\Windows\System\gyWxalM.exe
  2⤵
  PID:1440
- C:\Windows\System\pkUWyvt.exe
  C:\Windows\System\pkUWyvt.exe
  2⤵
  PID:2460
- C:\Windows\System\PMUgCzg.exe
  C:\Windows\System\PMUgCzg.exe
  2⤵
  PID:2432
- C:\Windows\System\cikdObl.exe
  C:\Windows\System\cikdObl.exe
  2⤵
  PID:3088
- C:\Windows\System\Pzwqzvf.exe
  C:\Windows\System\Pzwqzvf.exe
  2⤵
  PID:3108
- C:\Windows\System\PkwCGxY.exe
  C:\Windows\System\PkwCGxY.exe
  2⤵
  PID:3128
- C:\Windows\System\mlqxMuZ.exe
  C:\Windows\System\mlqxMuZ.exe
  2⤵
  PID:3148
- C:\Windows\System\CGtaxTn.exe
  C:\Windows\System\CGtaxTn.exe
  2⤵
  PID:3168
- C:\Windows\System\qRQLrMZ.exe
  C:\Windows\System\qRQLrMZ.exe
  2⤵
  PID:3188
- C:\Windows\System\ErDEvLn.exe
  C:\Windows\System\ErDEvLn.exe
  2⤵
  PID:3208
- C:\Windows\System\lGENMPb.exe
  C:\Windows\System\lGENMPb.exe
  2⤵
  PID:3228
- C:\Windows\System\ItxhQtI.exe
  C:\Windows\System\ItxhQtI.exe
  2⤵
  PID:3248
- C:\Windows\System\zZHHwcY.exe
  C:\Windows\System\zZHHwcY.exe
  2⤵
  PID:3268
- C:\Windows\System\WLEHBdm.exe
  C:\Windows\System\WLEHBdm.exe
  2⤵
  PID:3284
- C:\Windows\System\aTxLpeq.exe
  C:\Windows\System\aTxLpeq.exe
  2⤵
  PID:3300
- C:\Windows\System\bqNVsGr.exe
  C:\Windows\System\bqNVsGr.exe
  2⤵
  PID:3316
- C:\Windows\System\kPgUaRu.exe
  C:\Windows\System\kPgUaRu.exe
  2⤵
  PID:3340
- C:\Windows\System\sLKfLRO.exe
  C:\Windows\System\sLKfLRO.exe
  2⤵
  PID:3356
- C:\Windows\System\IKVzsTZ.exe
  C:\Windows\System\IKVzsTZ.exe
  2⤵
  PID:3372
- C:\Windows\System\DFWvhqG.exe
  C:\Windows\System\DFWvhqG.exe
  2⤵
  PID:3404
- C:\Windows\System\hmPyfAO.exe
  C:\Windows\System\hmPyfAO.exe
  2⤵
  PID:3420
- C:\Windows\System\ESRxxiq.exe
  C:\Windows\System\ESRxxiq.exe
  2⤵
  PID:3440
- C:\Windows\System\XyahkAj.exe
  C:\Windows\System\XyahkAj.exe
  2⤵
  PID:3460
- C:\Windows\System\yMqFaIW.exe
  C:\Windows\System\yMqFaIW.exe
  2⤵
  PID:3476
- C:\Windows\System\stnyder.exe
  C:\Windows\System\stnyder.exe
  2⤵
  PID:3492
- C:\Windows\System\BJJLCYu.exe
  C:\Windows\System\BJJLCYu.exe
  2⤵
  PID:3508
- C:\Windows\System\cSTuyEq.exe
  C:\Windows\System\cSTuyEq.exe
  2⤵
  PID:3548
- C:\Windows\System\OYjFlaz.exe
  C:\Windows\System\OYjFlaz.exe
  2⤵
  PID:3576
- C:\Windows\System\kmOVrWS.exe
  C:\Windows\System\kmOVrWS.exe
  2⤵
  PID:3592
- C:\Windows\System\cXbLyAE.exe
  C:\Windows\System\cXbLyAE.exe
  2⤵
  PID:3608
- C:\Windows\System\ZwvGUwf.exe
  C:\Windows\System\ZwvGUwf.exe
  2⤵
  PID:3624
- C:\Windows\System\fESRdqp.exe
  C:\Windows\System\fESRdqp.exe
  2⤵
  PID:3652
- C:\Windows\System\YKsNkgD.exe
  C:\Windows\System\YKsNkgD.exe
  2⤵
  PID:3680
- C:\Windows\System\YLxwsfU.exe
  C:\Windows\System\YLxwsfU.exe
  2⤵
  PID:3700
- C:\Windows\System\WhGnUbl.exe
  C:\Windows\System\WhGnUbl.exe
  2⤵
  PID:3716
- C:\Windows\System\hfyLipk.exe
  C:\Windows\System\hfyLipk.exe
  2⤵
  PID:3732
- C:\Windows\System\QWcwVdU.exe
  C:\Windows\System\QWcwVdU.exe
  2⤵
  PID:3752
- C:\Windows\System\KmppAmw.exe
  C:\Windows\System\KmppAmw.exe
  2⤵
  PID:3768
- C:\Windows\System\DWVqrMP.exe
  C:\Windows\System\DWVqrMP.exe
  2⤵
  PID:3788
- C:\Windows\System\JyZIHFz.exe
  C:\Windows\System\JyZIHFz.exe
  2⤵
  PID:3820
- C:\Windows\System\lyVKofY.exe
  C:\Windows\System\lyVKofY.exe
  2⤵
  PID:3836
- C:\Windows\System\wmPnSpk.exe
  C:\Windows\System\wmPnSpk.exe
  2⤵
  PID:3852
- C:\Windows\System\CaGNSAz.exe
  C:\Windows\System\CaGNSAz.exe
  2⤵
  PID:3872
- C:\Windows\System\HZKQmaz.exe
  C:\Windows\System\HZKQmaz.exe
  2⤵
  PID:3888
- C:\Windows\System\PjVfFrP.exe
  C:\Windows\System\PjVfFrP.exe
  2⤵
  PID:3912
- C:\Windows\System\qxmacSM.exe
  C:\Windows\System\qxmacSM.exe
  2⤵
  PID:3928
- C:\Windows\System\XQaQMoE.exe
  C:\Windows\System\XQaQMoE.exe
  2⤵
  PID:3952
- C:\Windows\System\tmFhPhD.exe
  C:\Windows\System\tmFhPhD.exe
  2⤵
  PID:3980
- C:\Windows\System\FMTmVUs.exe
  C:\Windows\System\FMTmVUs.exe
  2⤵
  PID:3996
- C:\Windows\System\xbylyld.exe
  C:\Windows\System\xbylyld.exe
  2⤵
  PID:4012
- C:\Windows\System\BoGvUYc.exe
  C:\Windows\System\BoGvUYc.exe
  2⤵
  PID:4032
- C:\Windows\System\SYGszBV.exe
  C:\Windows\System\SYGszBV.exe
  2⤵
  PID:4048
- C:\Windows\System\QRAAkVO.exe
  C:\Windows\System\QRAAkVO.exe
  2⤵
  PID:4068
- C:\Windows\System\vNzLQne.exe
  C:\Windows\System\vNzLQne.exe
  2⤵
  PID:4084
- C:\Windows\System\KQjCzOO.exe
  C:\Windows\System\KQjCzOO.exe
  2⤵
  PID:1040
- C:\Windows\System\nZtvuWi.exe
  C:\Windows\System\nZtvuWi.exe
  2⤵
  PID:1636
- C:\Windows\System\pltWoPK.exe
  C:\Windows\System\pltWoPK.exe
  2⤵
  PID:1276
- C:\Windows\System\vzVccgR.exe
  C:\Windows\System\vzVccgR.exe
  2⤵
  PID:3076
- C:\Windows\System\qNfNmSA.exe
  C:\Windows\System\qNfNmSA.exe
  2⤵
  PID:3116
- C:\Windows\System\iINtVGZ.exe
  C:\Windows\System\iINtVGZ.exe
  2⤵
  PID:3240
- C:\Windows\System\WAvMhAm.exe
  C:\Windows\System\WAvMhAm.exe
  2⤵
  PID:3140
- C:\Windows\System\QuchNNv.exe
  C:\Windows\System\QuchNNv.exe
  2⤵
  PID:3180
- C:\Windows\System\SeVOUWD.exe
  C:\Windows\System\SeVOUWD.exe
  2⤵
  PID:3216
- C:\Windows\System\MMfgvVb.exe
  C:\Windows\System\MMfgvVb.exe
  2⤵
  PID:3312
- C:\Windows\System\XCUSpEp.exe
  C:\Windows\System\XCUSpEp.exe
  2⤵
  PID:3324
- C:\Windows\System\HYAbuLt.exe
  C:\Windows\System\HYAbuLt.exe
  2⤵
  PID:3400
- C:\Windows\System\NwOmesh.exe
  C:\Windows\System\NwOmesh.exe
  2⤵
  PID:3264
- C:\Windows\System\tfDKqdu.exe
  C:\Windows\System\tfDKqdu.exe
  2⤵
  PID:3436
- C:\Windows\System\DxGSOqf.exe
  C:\Windows\System\DxGSOqf.exe
  2⤵
  PID:3332
- C:\Windows\System\onhyBgz.exe
  C:\Windows\System\onhyBgz.exe
  2⤵
  PID:3452
- C:\Windows\System\tWwoIar.exe
  C:\Windows\System\tWwoIar.exe
  2⤵
  PID:3568
- C:\Windows\System\rKWrftP.exe
  C:\Windows\System\rKWrftP.exe
  2⤵
  PID:3520
- C:\Windows\System\ZXFRbEr.exe
  C:\Windows\System\ZXFRbEr.exe
  2⤵
  PID:3536
- C:\Windows\System\EYbPbMi.exe
  C:\Windows\System\EYbPbMi.exe
  2⤵
  PID:1476
- C:\Windows\System\JvJRuvB.exe
  C:\Windows\System\JvJRuvB.exe
  2⤵
  PID:3600
- C:\Windows\System\TvMzrgv.exe
  C:\Windows\System\TvMzrgv.exe
  2⤵
  PID:3640
- C:\Windows\System\sfePRnE.exe
  C:\Windows\System\sfePRnE.exe
  2⤵
  PID:3620
- C:\Windows\System\KrqAENB.exe
  C:\Windows\System\KrqAENB.exe
  2⤵
  PID:3672
- C:\Windows\System\sbbtwdy.exe
  C:\Windows\System\sbbtwdy.exe
  2⤵
  PID:1700
- C:\Windows\System\IhOSrSy.exe
  C:\Windows\System\IhOSrSy.exe
  2⤵
  PID:1080
- C:\Windows\System\XzGMSee.exe
  C:\Windows\System\XzGMSee.exe
  2⤵
  PID:3572
- C:\Windows\System\rzKRzvm.exe
  C:\Windows\System\rzKRzvm.exe
  2⤵
  PID:872
- C:\Windows\System\Tfsgznp.exe
  C:\Windows\System\Tfsgznp.exe
  2⤵
  PID:3692
- C:\Windows\System\louxMgk.exe
  C:\Windows\System\louxMgk.exe
  2⤵
  PID:3760
- C:\Windows\System\MSASaLm.exe
  C:\Windows\System\MSASaLm.exe
  2⤵
  PID:3776
- C:\Windows\System\saZxkYm.exe
  C:\Windows\System\saZxkYm.exe
  2⤵
  PID:3784
- C:\Windows\System\Gzbcanh.exe
  C:\Windows\System\Gzbcanh.exe
  2⤵
  PID:3808
- C:\Windows\System\AkjsVbe.exe
  C:\Windows\System\AkjsVbe.exe
  2⤵
  PID:3848
- C:\Windows\System\cswDaCK.exe
  C:\Windows\System\cswDaCK.exe
  2⤵
  PID:3920
- C:\Windows\System\SiiwMgS.exe
  C:\Windows\System\SiiwMgS.exe
  2⤵
  PID:3908
- C:\Windows\System\hrLcHOh.exe
  C:\Windows\System\hrLcHOh.exe
  2⤵
  PID:3940
- C:\Windows\System\mLGTJIG.exe
  C:\Windows\System\mLGTJIG.exe
  2⤵
  PID:4008
- C:\Windows\System\NiwmZBy.exe
  C:\Windows\System\NiwmZBy.exe
  2⤵
  PID:3988
- C:\Windows\System\ZcyMGXM.exe
  C:\Windows\System\ZcyMGXM.exe
  2⤵
  PID:2836
- C:\Windows\System\yoZHcla.exe
  C:\Windows\System\yoZHcla.exe
  2⤵
  PID:3096
- C:\Windows\System\ktBSbaX.exe
  C:\Windows\System\ktBSbaX.exe
  2⤵
  PID:4024
- C:\Windows\System\lFPFyTa.exe
  C:\Windows\System\lFPFyTa.exe
  2⤵
  PID:2508
- C:\Windows\System\OHGVMYK.exe
  C:\Windows\System\OHGVMYK.exe
  2⤵
  PID:4056
- C:\Windows\System\GRGNAcZ.exe
  C:\Windows\System\GRGNAcZ.exe
  2⤵
  PID:3204
- C:\Windows\System\caefufC.exe
  C:\Windows\System\caefufC.exe
  2⤵
  PID:3104
- C:\Windows\System\opNqSnl.exe
  C:\Windows\System\opNqSnl.exe
  2⤵
  PID:3392
- C:\Windows\System\AznltkR.exe
  C:\Windows\System\AznltkR.exe
  2⤵
  PID:3260
- C:\Windows\System\BvlngYw.exe
  C:\Windows\System\BvlngYw.exe
  2⤵
  PID:3364
- C:\Windows\System\hKjBxnh.exe
  C:\Windows\System\hKjBxnh.exe
  2⤵
  PID:3136
- C:\Windows\System\FYUmpYJ.exe
  C:\Windows\System\FYUmpYJ.exe
  2⤵
  PID:2776
- C:\Windows\System\cqyAlck.exe
  C:\Windows\System\cqyAlck.exe
  2⤵
  PID:3488
- C:\Windows\System\rMBHeOJ.exe
  C:\Windows\System\rMBHeOJ.exe
  2⤵
  PID:2380
- C:\Windows\System\tQcfCih.exe
  C:\Windows\System\tQcfCih.exe
  2⤵
  PID:440
- C:\Windows\System\PkVApCd.exe
  C:\Windows\System\PkVApCd.exe
  2⤵
  PID:3588
- C:\Windows\System\iJSksPC.exe
  C:\Windows\System\iJSksPC.exe
  2⤵
  PID:1908
- C:\Windows\System\GbUmaxp.exe
  C:\Windows\System\GbUmaxp.exe
  2⤵
  PID:2580
- C:\Windows\System\PGaoADi.exe
  C:\Windows\System\PGaoADi.exe
  2⤵
  PID:3884
- C:\Windows\System\CXZFXBK.exe
  C:\Windows\System\CXZFXBK.exe
  2⤵
  PID:3780
- C:\Windows\System\yOCTqjw.exe
  C:\Windows\System\yOCTqjw.exe
  2⤵
  PID:3664
- C:\Windows\System\rpLgvIC.exe
  C:\Windows\System\rpLgvIC.exe
  2⤵
  PID:3744
- C:\Windows\System\mRDVlDA.exe
  C:\Windows\System\mRDVlDA.exe
  2⤵
  PID:3924
- C:\Windows\System\QWrJJbK.exe
  C:\Windows\System\QWrJJbK.exe
  2⤵
  PID:3964
- C:\Windows\System\dXjyWRi.exe
  C:\Windows\System\dXjyWRi.exe
  2⤵
  PID:3160
- C:\Windows\System\OfXaWTn.exe
  C:\Windows\System\OfXaWTn.exe
  2⤵
  PID:2356
- C:\Windows\System\bUPZgxZ.exe
  C:\Windows\System\bUPZgxZ.exe
  2⤵
  PID:3900
- C:\Windows\System\ZtsxzBj.exe
  C:\Windows\System\ZtsxzBj.exe
  2⤵
  PID:3184
- C:\Windows\System\QCFrQqV.exe
  C:\Windows\System\QCFrQqV.exe
  2⤵
  PID:2420
- C:\Windows\System\cLLNhnr.exe
  C:\Windows\System\cLLNhnr.exe
  2⤵
  PID:3200
- C:\Windows\System\egDAWdk.exe
  C:\Windows\System\egDAWdk.exe
  2⤵
  PID:3176
- C:\Windows\System\mgKKfEw.exe
  C:\Windows\System\mgKKfEw.exe
  2⤵
  PID:3256
- C:\Windows\System\QkFLyaS.exe
  C:\Windows\System\QkFLyaS.exe
  2⤵
  PID:3560
- C:\Windows\System\ZxSSbmc.exe
  C:\Windows\System\ZxSSbmc.exe
  2⤵
  PID:3544
- C:\Windows\System\aiurbvh.exe
  C:\Windows\System\aiurbvh.exe
  2⤵
  PID:3388
- C:\Windows\System\FznxiDd.exe
  C:\Windows\System\FznxiDd.exe
  2⤵
  PID:3636
- C:\Windows\System\fMSLRxy.exe
  C:\Windows\System\fMSLRxy.exe
  2⤵
  PID:2672
- C:\Windows\System\kPXcGVH.exe
  C:\Windows\System\kPXcGVH.exe
  2⤵
  PID:2124
- C:\Windows\System\GhnWoWd.exe
  C:\Windows\System\GhnWoWd.exe
  2⤵
  PID:3724
- C:\Windows\System\QeSqBfY.exe
  C:\Windows\System\QeSqBfY.exe
  2⤵
  PID:3944
- C:\Windows\System\jXaOlXZ.exe
  C:\Windows\System\jXaOlXZ.exe
  2⤵
  PID:3860
- C:\Windows\System\HzeGKQH.exe
  C:\Windows\System\HzeGKQH.exe
  2⤵
  PID:2336
- C:\Windows\System\pahNoXM.exe
  C:\Windows\System\pahNoXM.exe
  2⤵
  PID:3196
- C:\Windows\System\ouupgUH.exe
  C:\Windows\System\ouupgUH.exe
  2⤵
  PID:2268
- C:\Windows\System\ppGmsWR.exe
  C:\Windows\System\ppGmsWR.exe
  2⤵
  PID:3676
- C:\Windows\System\bCnpNtc.exe
  C:\Windows\System\bCnpNtc.exe
  2⤵
  PID:3448
- C:\Windows\System\yecoMVM.exe
  C:\Windows\System\yecoMVM.exe
  2⤵
  PID:3880
- C:\Windows\System\aHLwqyA.exe
  C:\Windows\System\aHLwqyA.exe
  2⤵
  PID:3532
- C:\Windows\System\NcNPIbz.exe
  C:\Windows\System\NcNPIbz.exe
  2⤵
  PID:3968
- C:\Windows\System\NwmyZeI.exe
  C:\Windows\System\NwmyZeI.exe
  2⤵
  PID:3224
- C:\Windows\System\LjVHxjl.exe
  C:\Windows\System\LjVHxjl.exe
  2⤵
  PID:3156
- C:\Windows\System\pEEqTQy.exe
  C:\Windows\System\pEEqTQy.exe
  2⤵
  PID:4028
- C:\Windows\System\TRTrwND.exe
  C:\Windows\System\TRTrwND.exe
  2⤵
  PID:3644
- C:\Windows\System\pTrtdjB.exe
  C:\Windows\System\pTrtdjB.exe
  2⤵
  PID:3528
- C:\Windows\System\MozxUKR.exe
  C:\Windows\System\MozxUKR.exe
  2⤵
  PID:944
- C:\Windows\System\oYzCtsy.exe
  C:\Windows\System\oYzCtsy.exe
  2⤵
  PID:3164
- C:\Windows\System\XqJellf.exe
  C:\Windows\System\XqJellf.exe
  2⤵
  PID:2628
- C:\Windows\System\JOuFmlJ.exe
  C:\Windows\System\JOuFmlJ.exe
  2⤵
  PID:3328
- C:\Windows\System\LqSSMfH.exe
  C:\Windows\System\LqSSMfH.exe
  2⤵
  PID:2388
- C:\Windows\System\UQJPdVn.exe
  C:\Windows\System\UQJPdVn.exe
  2⤵
  PID:1284
- C:\Windows\System\YrGJPsn.exe
  C:\Windows\System\YrGJPsn.exe
  2⤵
  PID:1948
- C:\Windows\System\AWXabih.exe
  C:\Windows\System\AWXabih.exe
  2⤵
  PID:3696
- C:\Windows\System\KgmvoZc.exe
  C:\Windows\System\KgmvoZc.exe
  2⤵
  PID:4076
- C:\Windows\System\QBdAqCX.exe
  C:\Windows\System\QBdAqCX.exe
  2⤵
  PID:4104
- C:\Windows\System\pepWclG.exe
  C:\Windows\System\pepWclG.exe
  2⤵
  PID:4128
- C:\Windows\System\nyKWZBZ.exe
  C:\Windows\System\nyKWZBZ.exe
  2⤵
  PID:4144
- C:\Windows\System\zdcDabJ.exe
  C:\Windows\System\zdcDabJ.exe
  2⤵
  PID:4168
- C:\Windows\System\FkWHJUX.exe
  C:\Windows\System\FkWHJUX.exe
  2⤵
  PID:4188
- C:\Windows\System\ETRKHyl.exe
  C:\Windows\System\ETRKHyl.exe
  2⤵
  PID:4208
- C:\Windows\System\IDsjPuh.exe
  C:\Windows\System\IDsjPuh.exe
  2⤵
  PID:4224
- C:\Windows\System\qXaazvb.exe
  C:\Windows\System\qXaazvb.exe
  2⤵
  PID:4240
- C:\Windows\System\GHVwSqW.exe
  C:\Windows\System\GHVwSqW.exe
  2⤵
  PID:4260
- C:\Windows\System\OGULouU.exe
  C:\Windows\System\OGULouU.exe
  2⤵
  PID:4280
- C:\Windows\System\nBxlHwP.exe
  C:\Windows\System\nBxlHwP.exe
  2⤵
  PID:4296
- C:\Windows\System\HdMimCR.exe
  C:\Windows\System\HdMimCR.exe
  2⤵
  PID:4316
- C:\Windows\System\ckIrIhx.exe
  C:\Windows\System\ckIrIhx.exe
  2⤵
  PID:4336
- C:\Windows\System\OckRYdA.exe
  C:\Windows\System\OckRYdA.exe
  2⤵
  PID:4360
- C:\Windows\System\ReHNOSU.exe
  C:\Windows\System\ReHNOSU.exe
  2⤵
  PID:4384
- C:\Windows\System\IgaxMpt.exe
  C:\Windows\System\IgaxMpt.exe
  2⤵
  PID:4400
- C:\Windows\System\xEIkGGT.exe
  C:\Windows\System\xEIkGGT.exe
  2⤵
  PID:4424
- C:\Windows\System\dXPsZTb.exe
  C:\Windows\System\dXPsZTb.exe
  2⤵
  PID:4444
- C:\Windows\System\tbjxuCF.exe
  C:\Windows\System\tbjxuCF.exe
  2⤵
  PID:4460
- C:\Windows\System\PKkncvJ.exe
  C:\Windows\System\PKkncvJ.exe
  2⤵
  PID:4476
- C:\Windows\System\mvoSfme.exe
  C:\Windows\System\mvoSfme.exe
  2⤵
  PID:4492
- C:\Windows\System\NEJBKqv.exe
  C:\Windows\System\NEJBKqv.exe
  2⤵
  PID:4512
- C:\Windows\System\oIPJxZJ.exe
  C:\Windows\System\oIPJxZJ.exe
  2⤵
  PID:4528
- C:\Windows\System\GYMdBAn.exe
  C:\Windows\System\GYMdBAn.exe
  2⤵
  PID:4544
- C:\Windows\System\dulQCLC.exe
  C:\Windows\System\dulQCLC.exe
  2⤵
  PID:4560
- C:\Windows\System\rugvdFh.exe
  C:\Windows\System\rugvdFh.exe
  2⤵
  PID:4580
- C:\Windows\System\VikcGOz.exe
  C:\Windows\System\VikcGOz.exe
  2⤵
  PID:4628
- C:\Windows\System\hRHfvGE.exe
  C:\Windows\System\hRHfvGE.exe
  2⤵
  PID:4648
- C:\Windows\System\hqYemSk.exe
  C:\Windows\System\hqYemSk.exe
  2⤵
  PID:4664
- C:\Windows\System\rJUOQVe.exe
  C:\Windows\System\rJUOQVe.exe
  2⤵
  PID:4680
- C:\Windows\System\AweRLKf.exe
  C:\Windows\System\AweRLKf.exe
  2⤵
  PID:4704
- C:\Windows\System\iZJYFoV.exe
  C:\Windows\System\iZJYFoV.exe
  2⤵
  PID:4728
- C:\Windows\System\AKEAUar.exe
  C:\Windows\System\AKEAUar.exe
  2⤵
  PID:4744
- C:\Windows\System\cPWuEKU.exe
  C:\Windows\System\cPWuEKU.exe
  2⤵
  PID:4760
- C:\Windows\System\ctlwbiA.exe
  C:\Windows\System\ctlwbiA.exe
  2⤵
  PID:4780
- C:\Windows\System\BAnuHbM.exe
  C:\Windows\System\BAnuHbM.exe
  2⤵
  PID:4804
- C:\Windows\System\nBHXYMz.exe
  C:\Windows\System\nBHXYMz.exe
  2⤵
  PID:4820
- C:\Windows\System\lbfYMHQ.exe
  C:\Windows\System\lbfYMHQ.exe
  2⤵
  PID:4836
- C:\Windows\System\YJbDxMe.exe
  C:\Windows\System\YJbDxMe.exe
  2⤵
  PID:4864
- C:\Windows\System\egnwkmT.exe
  C:\Windows\System\egnwkmT.exe
  2⤵
  PID:4892
- C:\Windows\System\DGVOXFK.exe
  C:\Windows\System\DGVOXFK.exe
  2⤵
  PID:4908
- C:\Windows\System\DcAzTEO.exe
  C:\Windows\System\DcAzTEO.exe
  2⤵
  PID:4924
- C:\Windows\System\pSZZCVt.exe
  C:\Windows\System\pSZZCVt.exe
  2⤵
  PID:4944
- C:\Windows\System\KEbmZrS.exe
  C:\Windows\System\KEbmZrS.exe
  2⤵
  PID:4960
- C:\Windows\System\byoPYmy.exe
  C:\Windows\System\byoPYmy.exe
  2⤵
  PID:4988
- C:\Windows\System\fJrxUde.exe
  C:\Windows\System\fJrxUde.exe
  2⤵
  PID:5004
- C:\Windows\System\qBJlfnr.exe
  C:\Windows\System\qBJlfnr.exe
  2⤵
  PID:5028
- C:\Windows\System\ULBCCyY.exe
  C:\Windows\System\ULBCCyY.exe
  2⤵
  PID:5044
- C:\Windows\System\XXjVuXx.exe
  C:\Windows\System\XXjVuXx.exe
  2⤵
  PID:5064
- C:\Windows\System\YaxQuhH.exe
  C:\Windows\System\YaxQuhH.exe
  2⤵
  PID:5088
- C:\Windows\System\anloIyx.exe
  C:\Windows\System\anloIyx.exe
  2⤵
  PID:5104
- C:\Windows\System\AczsHoJ.exe
  C:\Windows\System\AczsHoJ.exe
  2⤵
  PID:3816
- C:\Windows\System\jDzCFkU.exe
  C:\Windows\System\jDzCFkU.exe
  2⤵
  PID:4100
- C:\Windows\System\RvwZfdF.exe
  C:\Windows\System\RvwZfdF.exe
  2⤵
  PID:4140
- C:\Windows\System\AiAbLtW.exe
  C:\Windows\System\AiAbLtW.exe
  2⤵
  PID:4176
- C:\Windows\System\ClZojGx.exe
  C:\Windows\System\ClZojGx.exe
  2⤵
  PID:4196
- C:\Windows\System\vGkqLWu.exe
  C:\Windows\System\vGkqLWu.exe
  2⤵
  PID:4276
- C:\Windows\System\LbfardQ.exe
  C:\Windows\System\LbfardQ.exe
  2⤵
  PID:4312
- C:\Windows\System\YqBUTeZ.exe
  C:\Windows\System\YqBUTeZ.exe
  2⤵
  PID:4356
- C:\Windows\System\rrfRKRh.exe
  C:\Windows\System\rrfRKRh.exe
  2⤵
  PID:4372
- C:\Windows\System\AhUpmDG.exe
  C:\Windows\System\AhUpmDG.exe
  2⤵
  PID:4248
- C:\Windows\System\cXkGBZI.exe
  C:\Windows\System\cXkGBZI.exe
  2⤵
  PID:4436
- C:\Windows\System\IhpYfTB.exe
  C:\Windows\System\IhpYfTB.exe
  2⤵
  PID:4452
- C:\Windows\System\dKDNrFZ.exe
  C:\Windows\System\dKDNrFZ.exe
  2⤵
  PID:4508
- C:\Windows\System\ZHJqDwg.exe
  C:\Windows\System\ZHJqDwg.exe
  2⤵
  PID:4572
- C:\Windows\System\dGAzfrn.exe
  C:\Windows\System\dGAzfrn.exe
  2⤵
  PID:4588
- C:\Windows\System\EEdTEtd.exe
  C:\Windows\System\EEdTEtd.exe
  2⤵
  PID:4556
- C:\Windows\System\roUMLNs.exe
  C:\Windows\System\roUMLNs.exe
  2⤵
  PID:4640
- C:\Windows\System\lhKYyxm.exe
  C:\Windows\System\lhKYyxm.exe
  2⤵
  PID:4656
- C:\Windows\System\BxrXqNV.exe
  C:\Windows\System\BxrXqNV.exe
  2⤵
  PID:4676
- C:\Windows\System\oVIOmtS.exe
  C:\Windows\System\oVIOmtS.exe
  2⤵
  PID:4724
- C:\Windows\System\AMvjRya.exe
  C:\Windows\System\AMvjRya.exe
  2⤵
  PID:4696
- C:\Windows\System\idnGeus.exe
  C:\Windows\System\idnGeus.exe
  2⤵
  PID:4756
- C:\Windows\System\juPEpcf.exe
  C:\Windows\System\juPEpcf.exe
  2⤵
  PID:4796
- C:\Windows\System\dgrugzV.exe
  C:\Windows\System\dgrugzV.exe
  2⤵
  PID:4876
- C:\Windows\System\WfDorvQ.exe
  C:\Windows\System\WfDorvQ.exe
  2⤵
  PID:4880
- C:\Windows\System\eAcqEeT.exe
  C:\Windows\System\eAcqEeT.exe
  2⤵
  PID:4812
- C:\Windows\System\VihyFOg.exe
  C:\Windows\System\VihyFOg.exe
  2⤵
  PID:4888
- C:\Windows\System\NeYHeDn.exe
  C:\Windows\System\NeYHeDn.exe
  2⤵
  PID:4936
- C:\Windows\System\WwFUXfZ.exe
  C:\Windows\System\WwFUXfZ.exe
  2⤵
  PID:5024
- C:\Windows\System\EnJFBzO.exe
  C:\Windows\System\EnJFBzO.exe
  2⤵
  PID:4996
- C:\Windows\System\YFNuUGD.exe
  C:\Windows\System\YFNuUGD.exe
  2⤵
  PID:5036
- C:\Windows\System\HYnTHeP.exe
  C:\Windows\System\HYnTHeP.exe
  2⤵
  PID:4004
- C:\Windows\System\ZFmXvHR.exe
  C:\Windows\System\ZFmXvHR.exe
  2⤵
  PID:4160
- C:\Windows\System\CwrxFhq.exe
  C:\Windows\System\CwrxFhq.exe
  2⤵
  PID:4164
- C:\Windows\System\mxPzCvb.exe
  C:\Windows\System\mxPzCvb.exe
  2⤵
  PID:4272
- C:\Windows\System\yvFnvws.exe
  C:\Windows\System\yvFnvws.exe
  2⤵
  PID:4348
- C:\Windows\System\eAuSiEg.exe
  C:\Windows\System\eAuSiEg.exe
  2⤵
  PID:4308
- C:\Windows\System\IVyCufj.exe
  C:\Windows\System\IVyCufj.exe
  2⤵
  PID:4420
- C:\Windows\System\syhBaRj.exe
  C:\Windows\System\syhBaRj.exe
  2⤵
  PID:4500
- C:\Windows\System\cmJIURG.exe
  C:\Windows\System\cmJIURG.exe
  2⤵
  PID:4616
- C:\Windows\System\JCOqdwE.exe
  C:\Windows\System\JCOqdwE.exe
  2⤵
  PID:4472
- C:\Windows\System\NAENkSy.exe
  C:\Windows\System\NAENkSy.exe
  2⤵
  PID:4396
- C:\Windows\System\cutBENA.exe
  C:\Windows\System\cutBENA.exe
  2⤵
  PID:4720
- C:\Windows\System\pZQZhlX.exe
  C:\Windows\System\pZQZhlX.exe
  2⤵
  PID:4872
- C:\Windows\System\RjwnWet.exe
  C:\Windows\System\RjwnWet.exe
  2⤵
  PID:4952
- C:\Windows\System\MURONEO.exe
  C:\Windows\System\MURONEO.exe
  2⤵
  PID:4816
- C:\Windows\System\kPAYIJM.exe
  C:\Windows\System\kPAYIJM.exe
  2⤵
  PID:5020
- C:\Windows\System\XHXERtG.exe
  C:\Windows\System\XHXERtG.exe
  2⤵
  PID:5080
- C:\Windows\System\KUfhDvX.exe
  C:\Windows\System\KUfhDvX.exe
  2⤵
  PID:5100
- C:\Windows\System\NFvOkxs.exe
  C:\Windows\System\NFvOkxs.exe
  2⤵
  PID:4352
- C:\Windows\System\EhuhXXS.exe
  C:\Windows\System\EhuhXXS.exe
  2⤵
  PID:4236
- C:\Windows\System\XbNlAje.exe
  C:\Windows\System\XbNlAje.exe
  2⤵
  PID:4540
- C:\Windows\System\mclkyhD.exe
  C:\Windows\System\mclkyhD.exe
  2⤵
  PID:4332
- C:\Windows\System\vZuSdTI.exe
  C:\Windows\System\vZuSdTI.exe
  2⤵
  PID:4392
- C:\Windows\System\OiLujBW.exe
  C:\Windows\System\OiLujBW.exe
  2⤵
  PID:4688
- C:\Windows\System\XdxjMaG.exe
  C:\Windows\System\XdxjMaG.exe
  2⤵
  PID:4832
- C:\Windows\System\QGgIShw.exe
  C:\Windows\System\QGgIShw.exe
  2⤵
  PID:4932
- C:\Windows\System\pHjotgL.exe
  C:\Windows\System\pHjotgL.exe
  2⤵
  PID:4976
- C:\Windows\System\zxrYgNX.exe
  C:\Windows\System\zxrYgNX.exe
  2⤵
  PID:4204
- C:\Windows\System\LsVpgzq.exe
  C:\Windows\System\LsVpgzq.exe
  2⤵
  PID:4596
- C:\Windows\System\aUmbuFb.exe
  C:\Windows\System\aUmbuFb.exe
  2⤵
  PID:4304
- C:\Windows\System\dlOGNgj.exe
  C:\Windows\System\dlOGNgj.exe
  2⤵
  PID:4672
- C:\Windows\System\rZdvSOm.exe
  C:\Windows\System\rZdvSOm.exe
  2⤵
  PID:4432
- C:\Windows\System\CONVwKx.exe
  C:\Windows\System\CONVwKx.exe
  2⤵
  PID:4900
- C:\Windows\System\eokmZHS.exe
  C:\Windows\System\eokmZHS.exe
  2⤵
  PID:4488
- C:\Windows\System\dTnwaXs.exe
  C:\Windows\System\dTnwaXs.exe
  2⤵
  PID:4712
- C:\Windows\System\RUrbnKb.exe
  C:\Windows\System\RUrbnKb.exe
  2⤵
  PID:4256
- C:\Windows\System\lAnUpEw.exe
  C:\Windows\System\lAnUpEw.exe
  2⤵
  PID:4112
- C:\Windows\System\AoQcTWP.exe
  C:\Windows\System\AoQcTWP.exe
  2⤵
  PID:5132
- C:\Windows\System\rnsOFlc.exe
  C:\Windows\System\rnsOFlc.exe
  2⤵
  PID:5152
- C:\Windows\System\GCEcDZv.exe
  C:\Windows\System\GCEcDZv.exe
  2⤵
  PID:5284
- C:\Windows\System\rftaWiS.exe
  C:\Windows\System\rftaWiS.exe
  2⤵
  PID:5300
- C:\Windows\System\KfErnrL.exe
  C:\Windows\System\KfErnrL.exe
  2⤵
  PID:5320
- C:\Windows\System\fEiNsxU.exe
  C:\Windows\System\fEiNsxU.exe
  2⤵
  PID:5336
- C:\Windows\System\yWRLDMS.exe
  C:\Windows\System\yWRLDMS.exe
  2⤵
  PID:5356
- C:\Windows\System\DPunTRO.exe
  C:\Windows\System\DPunTRO.exe
  2⤵
  PID:5372
- C:\Windows\System\QIoJtBY.exe
  C:\Windows\System\QIoJtBY.exe
  2⤵
  PID:5388
- C:\Windows\System\AxbEgTl.exe
  C:\Windows\System\AxbEgTl.exe
  2⤵
  PID:5404
- C:\Windows\System\VqNWcMT.exe
  C:\Windows\System\VqNWcMT.exe
  2⤵
  PID:5420
- C:\Windows\System\kEYfJzN.exe
  C:\Windows\System\kEYfJzN.exe
  2⤵
  PID:5436
- C:\Windows\System\ZSkyxJU.exe
  C:\Windows\System\ZSkyxJU.exe
  2⤵
  PID:5456
- C:\Windows\System\AHzChdN.exe
  C:\Windows\System\AHzChdN.exe
  2⤵
  PID:5480
- C:\Windows\System\vDAwcVG.exe
  C:\Windows\System\vDAwcVG.exe
  2⤵
  PID:5500
- C:\Windows\System\RGYUVaU.exe
  C:\Windows\System\RGYUVaU.exe
  2⤵
  PID:5516
- C:\Windows\System\efsGuJg.exe
  C:\Windows\System\efsGuJg.exe
  2⤵
  PID:5540
- C:\Windows\System\PtYFOUO.exe
  C:\Windows\System\PtYFOUO.exe
  2⤵
  PID:5556
- C:\Windows\System\EbuuksX.exe
  C:\Windows\System\EbuuksX.exe
  2⤵
  PID:5576
- C:\Windows\System\PQUpeRd.exe
  C:\Windows\System\PQUpeRd.exe
  2⤵
  PID:5656
- C:\Windows\System\fMJKrgZ.exe
  C:\Windows\System\fMJKrgZ.exe
  2⤵
  PID:5672
- C:\Windows\System\IitoClo.exe
  C:\Windows\System\IitoClo.exe
  2⤵
  PID:5688
- C:\Windows\System\mqxDLtd.exe
  C:\Windows\System\mqxDLtd.exe
  2⤵
  PID:5720
- C:\Windows\System\DuXaGyr.exe
  C:\Windows\System\DuXaGyr.exe
  2⤵
  PID:5744
- C:\Windows\System\wjsOMgb.exe
  C:\Windows\System\wjsOMgb.exe
  2⤵
  PID:5768
- C:\Windows\System\ldVWNKm.exe
  C:\Windows\System\ldVWNKm.exe
  2⤵
  PID:5784
- C:\Windows\System\rtkXQcp.exe
  C:\Windows\System\rtkXQcp.exe
  2⤵
  PID:5800
- C:\Windows\System\VyvLCGA.exe
  C:\Windows\System\VyvLCGA.exe
  2⤵
  PID:5820
- C:\Windows\System\wWyqPtu.exe
  C:\Windows\System\wWyqPtu.exe
  2⤵
  PID:5840
- C:\Windows\System\RynqMEo.exe
  C:\Windows\System\RynqMEo.exe
  2⤵
  PID:5856
- C:\Windows\System\lmwRREY.exe
  C:\Windows\System\lmwRREY.exe
  2⤵
  PID:5884
- C:\Windows\System\ZNywprA.exe
  C:\Windows\System\ZNywprA.exe
  2⤵
  PID:5900
- C:\Windows\System\mNNapkv.exe
  C:\Windows\System\mNNapkv.exe
  2⤵
  PID:5920
- C:\Windows\System\BzqMppd.exe
  C:\Windows\System\BzqMppd.exe
  2⤵
  PID:5940
- C:\Windows\System\hLcKJkX.exe
  C:\Windows\System\hLcKJkX.exe
  2⤵
  PID:5960
- C:\Windows\System\eMHuwrv.exe
  C:\Windows\System\eMHuwrv.exe
  2⤵
  PID:5976
- C:\Windows\System\KqgIuvx.exe
  C:\Windows\System\KqgIuvx.exe
  2⤵
  PID:5992
- C:\Windows\System\UfiyXxw.exe
  C:\Windows\System\UfiyXxw.exe
  2⤵
  PID:6008
- C:\Windows\System\yeCsgub.exe
  C:\Windows\System\yeCsgub.exe
  2⤵
  PID:6024
- C:\Windows\System\AIAKyVp.exe
  C:\Windows\System\AIAKyVp.exe
  2⤵
  PID:6056
- C:\Windows\System\XCbRYHf.exe
  C:\Windows\System\XCbRYHf.exe
  2⤵
  PID:6092
- C:\Windows\System\dVRElEC.exe
  C:\Windows\System\dVRElEC.exe
  2⤵
  PID:6116
- C:\Windows\System\gouUGLj.exe
  C:\Windows\System\gouUGLj.exe
  2⤵
  PID:6136
- C:\Windows\System\VxvGkvi.exe
  C:\Windows\System\VxvGkvi.exe
  2⤵
  PID:5124
- C:\Windows\System\dEKNWtP.exe
  C:\Windows\System\dEKNWtP.exe
  2⤵
  PID:4968
- C:\Windows\System\SxYsCYM.exe
  C:\Windows\System\SxYsCYM.exe
  2⤵
  PID:4752
- C:\Windows\System\FudmdsN.exe
  C:\Windows\System\FudmdsN.exe
  2⤵
  PID:5180
- C:\Windows\System\zwhIyEO.exe
  C:\Windows\System\zwhIyEO.exe
  2⤵
  PID:5196
- C:\Windows\System\hpaGBXL.exe
  C:\Windows\System\hpaGBXL.exe
  2⤵
  PID:5216
- C:\Windows\System\pvaqKzP.exe
  C:\Windows\System\pvaqKzP.exe
  2⤵
  PID:5240
- C:\Windows\System\JSzzgtw.exe
  C:\Windows\System\JSzzgtw.exe
  2⤵
  PID:5260
- C:\Windows\System\IaJrGdu.exe
  C:\Windows\System\IaJrGdu.exe
  2⤵
  PID:5276
- C:\Windows\System\HrTJzLT.exe
  C:\Windows\System\HrTJzLT.exe
  2⤵
  PID:5308
- C:\Windows\System\bWyfDZT.exe
  C:\Windows\System\bWyfDZT.exe
  2⤵
  PID:5332
- C:\Windows\System\RLGfDuk.exe
  C:\Windows\System\RLGfDuk.exe
  2⤵
  PID:5380
- C:\Windows\System\ZtgeaEH.exe
  C:\Windows\System\ZtgeaEH.exe
  2⤵
  PID:5432
- C:\Windows\System\cPXpDUg.exe
  C:\Windows\System\cPXpDUg.exe
  2⤵
  PID:5488
- C:\Windows\System\EPbXMvh.exe
  C:\Windows\System\EPbXMvh.exe
  2⤵
  PID:5528
- C:\Windows\System\mVRBHeI.exe
  C:\Windows\System\mVRBHeI.exe
  2⤵
  PID:5572
- C:\Windows\System\aPKwaRD.exe
  C:\Windows\System\aPKwaRD.exe
  2⤵
  PID:5476
- C:\Windows\System\DcXLSQD.exe
  C:\Windows\System\DcXLSQD.exe
  2⤵
  PID:5512
- C:\Windows\System\eXXgshc.exe
  C:\Windows\System\eXXgshc.exe
  2⤵
  PID:5604
- C:\Windows\System\mQdxiFC.exe
  C:\Windows\System\mQdxiFC.exe
  2⤵
  PID:5608
- C:\Windows\System\DKiufoG.exe
  C:\Windows\System\DKiufoG.exe
  2⤵
  PID:5664
- C:\Windows\System\hDOzglM.exe
  C:\Windows\System\hDOzglM.exe
  2⤵
  PID:5728
- C:\Windows\System\oLjLyFe.exe
  C:\Windows\System\oLjLyFe.exe
  2⤵
  PID:5740
- C:\Windows\System\YRzcFvx.exe
  C:\Windows\System\YRzcFvx.exe
  2⤵
  PID:5792
- C:\Windows\System\VddFmWj.exe
  C:\Windows\System\VddFmWj.exe
  2⤵
  PID:5836
- C:\Windows\System\enzGNeu.exe
  C:\Windows\System\enzGNeu.exe
  2⤵
  PID:5880
- C:\Windows\System\WkqHApx.exe
  C:\Windows\System\WkqHApx.exe
  2⤵
  PID:5848
- C:\Windows\System\lQQFEHN.exe
  C:\Windows\System\lQQFEHN.exe
  2⤵
  PID:5912
- C:\Windows\System\KYJhGAX.exe
  C:\Windows\System\KYJhGAX.exe
  2⤵
  PID:5896
- C:\Windows\System\boSnALS.exe
  C:\Windows\System\boSnALS.exe
  2⤵
  PID:5988
- C:\Windows\System\wFMeYrc.exe
  C:\Windows\System\wFMeYrc.exe
  2⤵
  PID:6032
- C:\Windows\System\EkZrfTh.exe
  C:\Windows\System\EkZrfTh.exe
  2⤵
  PID:5968
- C:\Windows\System\kJEMPRP.exe
  C:\Windows\System\kJEMPRP.exe
  2⤵
  PID:6112
- C:\Windows\System\ovuHaZM.exe
  C:\Windows\System\ovuHaZM.exe
  2⤵
  PID:4860
- C:\Windows\System\bqYbmZO.exe
  C:\Windows\System\bqYbmZO.exe
  2⤵
  PID:5128
- C:\Windows\System\iTYVODP.exe
  C:\Windows\System\iTYVODP.exe
  2⤵
  PID:5140
- C:\Windows\System\YbFLvze.exe
  C:\Windows\System\YbFLvze.exe
  2⤵
  PID:5204
- C:\Windows\System\rTHHweA.exe
  C:\Windows\System\rTHHweA.exe
  2⤵
  PID:5232
- C:\Windows\System\qJDbReN.exe
  C:\Windows\System\qJDbReN.exe
  2⤵
  PID:5224
- C:\Windows\System\cclKMrX.exe
  C:\Windows\System\cclKMrX.exe
  2⤵
  PID:5096
- C:\Windows\System\YmDSOWQ.exe
  C:\Windows\System\YmDSOWQ.exe
  2⤵
  PID:5352
- C:\Windows\System\BtyfkzK.exe
  C:\Windows\System\BtyfkzK.exe
  2⤵
  PID:5756
- C:\Windows\System\elvsBbT.exe
  C:\Windows\System\elvsBbT.exe
  2⤵
  PID:5368
- C:\Windows\System\waXFstb.exe
  C:\Windows\System\waXFstb.exe
  2⤵
  PID:5524
- C:\Windows\System\yZpItxQ.exe
  C:\Windows\System\yZpItxQ.exe
  2⤵
  PID:5776
- C:\Windows\System\lCMhScb.exe
  C:\Windows\System\lCMhScb.exe
  2⤵
  PID:5984
- C:\Windows\System\Prznchn.exe
  C:\Windows\System\Prznchn.exe
  2⤵
  PID:6072
- C:\Windows\System\VCzRmiq.exe
  C:\Windows\System\VCzRmiq.exe
  2⤵
  PID:6080
- C:\Windows\System\HFUEToE.exe
  C:\Windows\System\HFUEToE.exe
  2⤵
  PID:5364
- C:\Windows\System\JDIeenA.exe
  C:\Windows\System\JDIeenA.exe
  2⤵
  PID:5696
- C:\Windows\System\MKnNRaA.exe
  C:\Windows\System\MKnNRaA.exe
  2⤵
  PID:6124
- C:\Windows\System\FJrjAnV.exe
  C:\Windows\System\FJrjAnV.exe
  2⤵
  PID:5952
- C:\Windows\System\uaSqigV.exe
  C:\Windows\System\uaSqigV.exe
  2⤵
  PID:6100
- C:\Windows\System\dLIvFmx.exe
  C:\Windows\System\dLIvFmx.exe
  2⤵
  PID:5212
- C:\Windows\System\zlAOAnP.exe
  C:\Windows\System\zlAOAnP.exe
  2⤵
  PID:5328
- C:\Windows\System\RxqpKCb.exe
  C:\Windows\System\RxqpKCb.exe
  2⤵
  PID:5268
- C:\Windows\System\IGSLdcu.exe
  C:\Windows\System\IGSLdcu.exe
  2⤵
  PID:5416
- C:\Windows\System\VlIDTDK.exe
  C:\Windows\System\VlIDTDK.exe
  2⤵
  PID:5344
- C:\Windows\System\ynHRkvo.exe
  C:\Windows\System\ynHRkvo.exe
  2⤵
  PID:5760
- C:\Windows\System\WuAUzEi.exe
  C:\Windows\System\WuAUzEi.exe
  2⤵
  PID:5472
- C:\Windows\System\ZHGuLHW.exe
  C:\Windows\System\ZHGuLHW.exe
  2⤵
  PID:6064
- C:\Windows\System\WDTIIfp.exe
  C:\Windows\System\WDTIIfp.exe
  2⤵
  PID:6044
- C:\Windows\System\YdPuFYe.exe
  C:\Windows\System\YdPuFYe.exe
  2⤵
  PID:6076
- C:\Windows\System\ryOCBEx.exe
  C:\Windows\System\ryOCBEx.exe
  2⤵
  PID:5596
- C:\Windows\System\CkXDOEC.exe
  C:\Windows\System\CkXDOEC.exe
  2⤵
  PID:5016
- C:\Windows\System\FvbMJEc.exe
  C:\Windows\System\FvbMJEc.exe
  2⤵
  PID:4856
- C:\Windows\System\rTiXtHi.exe
  C:\Windows\System\rTiXtHi.exe
  2⤵
  PID:5448
- C:\Windows\System\vSdnPeA.exe
  C:\Windows\System\vSdnPeA.exe
  2⤵
  PID:5496
- C:\Windows\System\wLYWgeG.exe
  C:\Windows\System\wLYWgeG.exe
  2⤵
  PID:5464
- C:\Windows\System\UEVuCYg.exe
  C:\Windows\System\UEVuCYg.exe
  2⤵
  PID:5828
- C:\Windows\System\pkZHAkW.exe
  C:\Windows\System\pkZHAkW.exe
  2⤵
  PID:6000
- C:\Windows\System\zOLznsc.exe
  C:\Windows\System\zOLznsc.exe
  2⤵
  PID:5972
- C:\Windows\System\dAShrwE.exe
  C:\Windows\System\dAShrwE.exe
  2⤵
  PID:5252
- C:\Windows\System\YKxbnCe.exe
  C:\Windows\System\YKxbnCe.exe
  2⤵
  PID:5256
- C:\Windows\System\VxibjYq.exe
  C:\Windows\System\VxibjYq.exe
  2⤵
  PID:5592
- C:\Windows\System\ocTzCtq.exe
  C:\Windows\System\ocTzCtq.exe
  2⤵
  PID:5568
- C:\Windows\System\ZlpiXJc.exe
  C:\Windows\System\ZlpiXJc.exe
  2⤵
  PID:6004
- C:\Windows\System\xDBWzCg.exe
  C:\Windows\System\xDBWzCg.exe
  2⤵
  PID:5892
- C:\Windows\System\twTYnHM.exe
  C:\Windows\System\twTYnHM.exe
  2⤵
  PID:6040
- C:\Windows\System\AjzceBA.exe
  C:\Windows\System\AjzceBA.exe
  2⤵
  PID:6016
- C:\Windows\System\tBrJWPo.exe
  C:\Windows\System\tBrJWPo.exe
  2⤵
  PID:5272
- C:\Windows\System\ECtVulx.exe
  C:\Windows\System\ECtVulx.exe
  2⤵
  PID:6156
- C:\Windows\System\zJPykTt.exe
  C:\Windows\System\zJPykTt.exe
  2⤵
  PID:6176
- C:\Windows\System\RHhvlMS.exe
  C:\Windows\System\RHhvlMS.exe
  2⤵
  PID:6192
- C:\Windows\System\fSvgAyx.exe
  C:\Windows\System\fSvgAyx.exe
  2⤵
  PID:6208
- C:\Windows\System\OYOEbjH.exe
  C:\Windows\System\OYOEbjH.exe
  2⤵
  PID:6236
- C:\Windows\System\vqoDHvE.exe
  C:\Windows\System\vqoDHvE.exe
  2⤵
  PID:6252
- C:\Windows\System\zuKqYVt.exe
  C:\Windows\System\zuKqYVt.exe
  2⤵
  PID:6268
- C:\Windows\System\Xgmvswq.exe
  C:\Windows\System\Xgmvswq.exe
  2⤵
  PID:6284
- C:\Windows\System\nOcVWPC.exe
  C:\Windows\System\nOcVWPC.exe
  2⤵
  PID:6300
- C:\Windows\System\hleLaVY.exe
  C:\Windows\System\hleLaVY.exe
  2⤵
  PID:6316
- C:\Windows\System\eZqydsI.exe
  C:\Windows\System\eZqydsI.exe
  2⤵
  PID:6332
- C:\Windows\System\EozEFMm.exe
  C:\Windows\System\EozEFMm.exe
  2⤵
  PID:6352
- C:\Windows\System\lVMPYdP.exe
  C:\Windows\System\lVMPYdP.exe
  2⤵
  PID:6400
- C:\Windows\System\NVzwYcu.exe
  C:\Windows\System\NVzwYcu.exe
  2⤵
  PID:6416
- C:\Windows\System\vKDabii.exe
  C:\Windows\System\vKDabii.exe
  2⤵
  PID:6432
- C:\Windows\System\sTAzHNb.exe
  C:\Windows\System\sTAzHNb.exe
  2⤵
  PID:6452
- C:\Windows\System\tbiFWDV.exe
  C:\Windows\System\tbiFWDV.exe
  2⤵
  PID:6472
- C:\Windows\System\iOqeQfV.exe
  C:\Windows\System\iOqeQfV.exe
  2⤵
  PID:6488
- C:\Windows\System\zzWOQRw.exe
  C:\Windows\System\zzWOQRw.exe
  2⤵
  PID:6508
- C:\Windows\System\sySmRxd.exe
  C:\Windows\System\sySmRxd.exe
  2⤵
  PID:6528
- C:\Windows\System\QodPzHv.exe
  C:\Windows\System\QodPzHv.exe
  2⤵
  PID:6544
- C:\Windows\System\uARigWN.exe
  C:\Windows\System\uARigWN.exe
  2⤵
  PID:6580
- C:\Windows\System\okGNBqh.exe
  C:\Windows\System\okGNBqh.exe
  2⤵
  PID:6600
- C:\Windows\System\oEmtveG.exe
  C:\Windows\System\oEmtveG.exe
  2⤵
  PID:6616
- C:\Windows\System\loJVErw.exe
  C:\Windows\System\loJVErw.exe
  2⤵
  PID:6632
- C:\Windows\System\cVdyGJN.exe
  C:\Windows\System\cVdyGJN.exe
  2⤵
  PID:6648
- C:\Windows\System\htjqlmu.exe
  C:\Windows\System\htjqlmu.exe
  2⤵
  PID:6664
- C:\Windows\System\PnSvHBl.exe
  C:\Windows\System\PnSvHBl.exe
  2⤵
  PID:6680
- C:\Windows\System\HOITGoK.exe
  C:\Windows\System\HOITGoK.exe
  2⤵
  PID:6716
- C:\Windows\System\vDwZblc.exe
  C:\Windows\System\vDwZblc.exe
  2⤵
  PID:6732
- C:\Windows\System\rMWayTG.exe
  C:\Windows\System\rMWayTG.exe
  2⤵
  PID:6748
- C:\Windows\System\ZxKdeBy.exe
  C:\Windows\System\ZxKdeBy.exe
  2⤵
  PID:6764
- C:\Windows\System\ofaVcva.exe
  C:\Windows\System\ofaVcva.exe
  2⤵
  PID:6780
- C:\Windows\System\XmUnXfD.exe
  C:\Windows\System\XmUnXfD.exe
  2⤵
  PID:6800
- C:\Windows\System\uoplfzf.exe
  C:\Windows\System\uoplfzf.exe
  2⤵
  PID:6852
- C:\Windows\System\FqUgLma.exe
  C:\Windows\System\FqUgLma.exe
  2⤵
  PID:6872
- C:\Windows\System\QCYPbYG.exe
  C:\Windows\System\QCYPbYG.exe
  2⤵
  PID:6888
- C:\Windows\System\DVAlLHW.exe
  C:\Windows\System\DVAlLHW.exe
  2⤵
  PID:6912
- C:\Windows\System\ZhOqIkU.exe
  C:\Windows\System\ZhOqIkU.exe
  2⤵
  PID:6928
- C:\Windows\System\mWtVAcB.exe
  C:\Windows\System\mWtVAcB.exe
  2⤵
  PID:6948
- C:\Windows\System\hwvGMYY.exe
  C:\Windows\System\hwvGMYY.exe
  2⤵
  PID:6968
- C:\Windows\System\tYmCaIz.exe
  C:\Windows\System\tYmCaIz.exe
  2⤵
  PID:6988
- C:\Windows\System\QZNHKzx.exe
  C:\Windows\System\QZNHKzx.exe
  2⤵
  PID:7004
- C:\Windows\System\PgAjAmp.exe
  C:\Windows\System\PgAjAmp.exe
  2⤵
  PID:7020
- C:\Windows\System\ssQtRqB.exe
  C:\Windows\System\ssQtRqB.exe
  2⤵
  PID:7040
- C:\Windows\System\sNsIUuY.exe
  C:\Windows\System\sNsIUuY.exe
  2⤵
  PID:7056
- C:\Windows\System\mVJqyJJ.exe
  C:\Windows\System\mVJqyJJ.exe
  2⤵
  PID:7072
- C:\Windows\System\AdTpYAM.exe
  C:\Windows\System\AdTpYAM.exe
  2⤵
  PID:7108
- C:\Windows\System\PpHITAx.exe
  C:\Windows\System\PpHITAx.exe
  2⤵
  PID:7128
- C:\Windows\System\UpwBypH.exe
  C:\Windows\System\UpwBypH.exe
  2⤵
  PID:7144
- C:\Windows\System\XyZJEVY.exe
  C:\Windows\System\XyZJEVY.exe
  2⤵
  PID:6148
- C:\Windows\System\cqeFSVs.exe
  C:\Windows\System\cqeFSVs.exe
  2⤵
  PID:6216
- C:\Windows\System\znUNMMJ.exe
  C:\Windows\System\znUNMMJ.exe
  2⤵
  PID:6232
- C:\Windows\System\WxOfcuO.exe
  C:\Windows\System\WxOfcuO.exe
  2⤵
  PID:6204
- C:\Windows\System\NgfhfKs.exe
  C:\Windows\System\NgfhfKs.exe
  2⤵
  PID:6172
- C:\Windows\System\GLbtVSd.exe
  C:\Windows\System\GLbtVSd.exe
  2⤵
  PID:6348
- C:\Windows\System\TtKdKTC.exe
  C:\Windows\System\TtKdKTC.exe
  2⤵
  PID:6484
- C:\Windows\System\qevalvw.exe
  C:\Windows\System\qevalvw.exe
  2⤵
  PID:6444
- C:\Windows\System\VdXSpgl.exe
  C:\Windows\System\VdXSpgl.exe
  2⤵
  PID:6516
- C:\Windows\System\jVZbXIJ.exe
  C:\Windows\System\jVZbXIJ.exe
  2⤵
  PID:6564
- C:\Windows\System\CAIlcfT.exe
  C:\Windows\System\CAIlcfT.exe
  2⤵
  PID:6640
- C:\Windows\System\ogFFWcr.exe
  C:\Windows\System\ogFFWcr.exe
  2⤵
  PID:6728
- C:\Windows\System\lFVuGbr.exe
  C:\Windows\System\lFVuGbr.exe
  2⤵
  PID:6368
- C:\Windows\System\ZkJADMA.exe
  C:\Windows\System\ZkJADMA.exe
  2⤵
  PID:6388
- C:\Windows\System\jQifHPf.exe
  C:\Windows\System\jQifHPf.exe
  2⤵
  PID:6496
- C:\Windows\System\MshHxkG.exe
  C:\Windows\System\MshHxkG.exe
  2⤵
  PID:6792
- C:\Windows\System\JJwBvIa.exe
  C:\Windows\System\JJwBvIa.exe
  2⤵
  PID:6468
- C:\Windows\System\JSeuYcs.exe
  C:\Windows\System\JSeuYcs.exe
  2⤵
  PID:6588
- C:\Windows\System\LGeDAYh.exe
  C:\Windows\System\LGeDAYh.exe
  2⤵
  PID:6704
- C:\Windows\System\UMkIsZL.exe
  C:\Windows\System\UMkIsZL.exe
  2⤵
  PID:6772
- C:\Windows\System\YIuylSE.exe
  C:\Windows\System\YIuylSE.exe
  2⤵
  PID:6824
- C:\Windows\System\gIMiYen.exe
  C:\Windows\System\gIMiYen.exe
  2⤵
  PID:6836
- C:\Windows\System\zPwQSNy.exe
  C:\Windows\System\zPwQSNy.exe
  2⤵
  PID:6860
- C:\Windows\System\nuTyBUX.exe
  C:\Windows\System\nuTyBUX.exe
  2⤵
  PID:6896
- C:\Windows\System\UdHUBCA.exe
  C:\Windows\System\UdHUBCA.exe
  2⤵
  PID:6924
- C:\Windows\System\DDgXvxc.exe
  C:\Windows\System\DDgXvxc.exe
  2⤵
  PID:7028
- C:\Windows\System\nATmDCC.exe
  C:\Windows\System\nATmDCC.exe
  2⤵
  PID:7000
- C:\Windows\System\AcBfjiS.exe
  C:\Windows\System\AcBfjiS.exe
  2⤵
  PID:6940
- C:\Windows\System\aOZzNIp.exe
  C:\Windows\System\aOZzNIp.exe
  2⤵
  PID:7124
- C:\Windows\System\nixRFhv.exe
  C:\Windows\System\nixRFhv.exe
  2⤵
  PID:7104
- C:\Windows\System\crGmbxr.exe
  C:\Windows\System\crGmbxr.exe
  2⤵
  PID:7084
- C:\Windows\System\kIZzjAv.exe
  C:\Windows\System\kIZzjAv.exe
  2⤵
  PID:6184
- C:\Windows\System\KKaMNhf.exe
  C:\Windows\System\KKaMNhf.exe
  2⤵
  PID:6224
- C:\Windows\System\qkNlbdB.exe
  C:\Windows\System\qkNlbdB.exe
  2⤵
  PID:6164
- C:\Windows\System\oStAIvd.exe
  C:\Windows\System\oStAIvd.exe
  2⤵
  PID:6200
- C:\Windows\System\FyWsHuu.exe
  C:\Windows\System\FyWsHuu.exe
  2⤵
  PID:6408
- C:\Windows\System\AcHadTZ.exe
  C:\Windows\System\AcHadTZ.exe
  2⤵
  PID:6676
- C:\Windows\System\xoauemK.exe
  C:\Windows\System\xoauemK.exe
  2⤵
  PID:5652
- C:\Windows\System\zTHPToq.exe
  C:\Windows\System\zTHPToq.exe
  2⤵
  PID:6380
- C:\Windows\System\xTMyxhW.exe
  C:\Windows\System\xTMyxhW.exe
  2⤵
  PID:6788
- C:\Windows\System\aPbIWwR.exe
  C:\Windows\System\aPbIWwR.exe
  2⤵
  PID:6504
- C:\Windows\System\FgxaqfX.exe
  C:\Windows\System\FgxaqfX.exe
  2⤵
  PID:6700
- C:\Windows\System\rzVLwSs.exe
  C:\Windows\System\rzVLwSs.exe
  2⤵
  PID:6744
- C:\Windows\System\ZfsKdDJ.exe
  C:\Windows\System\ZfsKdDJ.exe
  2⤵
  PID:6628
- C:\Windows\System\ELOkfeg.exe
  C:\Windows\System\ELOkfeg.exe
  2⤵
  PID:6844
- C:\Windows\System\eTEzyiL.exe
  C:\Windows\System\eTEzyiL.exe
  2⤵
  PID:6880
- C:\Windows\System\AnStCAY.exe
  C:\Windows\System\AnStCAY.exe
  2⤵
  PID:7036
- C:\Windows\System\hgGWMkd.exe
  C:\Windows\System\hgGWMkd.exe
  2⤵
  PID:108
- C:\Windows\System\dSlAtgV.exe
  C:\Windows\System\dSlAtgV.exe
  2⤵
  PID:7080
- C:\Windows\System\adNSEsw.exe
  C:\Windows\System\adNSEsw.exe
  2⤵
  PID:7156
- C:\Windows\System\uPFFjYh.exe
  C:\Windows\System\uPFFjYh.exe
  2⤵
  PID:6340
- C:\Windows\System\lBEomYt.exe
  C:\Windows\System\lBEomYt.exe
  2⤵
  PID:6448
- C:\Windows\System\xByeTcY.exe
  C:\Windows\System\xByeTcY.exe
  2⤵
  PID:6440
- C:\Windows\System\DDtuYLS.exe
  C:\Windows\System\DDtuYLS.exe
  2⤵
  PID:6104
- C:\Windows\System\LhodcGb.exe
  C:\Windows\System\LhodcGb.exe
  2⤵
  PID:6376
- C:\Windows\System\XftmSsU.exe
  C:\Windows\System\XftmSsU.exe
  2⤵
  PID:6556
- C:\Windows\System\DnpzIAx.exe
  C:\Windows\System\DnpzIAx.exe
  2⤵
  PID:6816
- C:\Windows\System\PxnDQpE.exe
  C:\Windows\System\PxnDQpE.exe
  2⤵
  PID:6656
- C:\Windows\System\lHRBcQv.exe
  C:\Windows\System\lHRBcQv.exe
  2⤵
  PID:6688
- C:\Windows\System\OHrTstt.exe
  C:\Windows\System\OHrTstt.exe
  2⤵
  PID:6976
- C:\Windows\System\kNSsdAg.exe
  C:\Windows\System\kNSsdAg.exe
  2⤵
  PID:7140
- C:\Windows\System\BbxGhfo.exe
  C:\Windows\System\BbxGhfo.exe
  2⤵
  PID:6480
- C:\Windows\System\ndykdKT.exe
  C:\Windows\System\ndykdKT.exe
  2⤵
  PID:6296
- C:\Windows\System\MlvtQWi.exe
  C:\Windows\System\MlvtQWi.exe
  2⤵
  PID:6500
- C:\Windows\System\tcHCCah.exe
  C:\Windows\System\tcHCCah.exe
  2⤵
  PID:6596
- C:\Windows\System\QQPAwJl.exe
  C:\Windows\System\QQPAwJl.exe
  2⤵
  PID:6536
- C:\Windows\System\FMQlUwY.exe
  C:\Windows\System\FMQlUwY.exe
  2⤵
  PID:6996
- C:\Windows\System\BoukNCf.exe
  C:\Windows\System\BoukNCf.exe
  2⤵
  PID:7152
- C:\Windows\System\mrowdve.exe
  C:\Windows\System\mrowdve.exe
  2⤵
  PID:7048
- C:\Windows\System\WDWPxvx.exe
  C:\Windows\System\WDWPxvx.exe
  2⤵
  PID:6524
- C:\Windows\System\UkdjSIP.exe
  C:\Windows\System\UkdjSIP.exe
  2⤵
  PID:6364
- C:\Windows\System\jIIPNqs.exe
  C:\Windows\System\jIIPNqs.exe
  2⤵
  PID:6848
- C:\Windows\System\UcmWHtV.exe
  C:\Windows\System\UcmWHtV.exe
  2⤵
  PID:5780
- C:\Windows\System\uXjLXcU.exe
  C:\Windows\System\uXjLXcU.exe
  2⤵
  PID:7052
- C:\Windows\System\uiICCPY.exe
  C:\Windows\System\uiICCPY.exe
  2⤵
  PID:7184
- C:\Windows\System\NHeXoif.exe
  C:\Windows\System\NHeXoif.exe
  2⤵
  PID:7208
- C:\Windows\System\XtzewIp.exe
  C:\Windows\System\XtzewIp.exe
  2⤵
  PID:7232
- C:\Windows\System\PYDtyke.exe
  C:\Windows\System\PYDtyke.exe
  2⤵
  PID:7248
- C:\Windows\System\AUBUrbe.exe
  C:\Windows\System\AUBUrbe.exe
  2⤵
  PID:7268
- C:\Windows\System\gJXJMjZ.exe
  C:\Windows\System\gJXJMjZ.exe
  2⤵
  PID:7284
- C:\Windows\System\fqOcZqC.exe
  C:\Windows\System\fqOcZqC.exe
  2⤵
  PID:7304
- C:\Windows\System\sFooFPI.exe
  C:\Windows\System\sFooFPI.exe
  2⤵
  PID:7328
- C:\Windows\System\jtroupC.exe
  C:\Windows\System\jtroupC.exe
  2⤵
  PID:7368
- C:\Windows\System\aRzgIlz.exe
  C:\Windows\System\aRzgIlz.exe
  2⤵
  PID:7384
- C:\Windows\System\iTiNTeC.exe
  C:\Windows\System\iTiNTeC.exe
  2⤵
  PID:7404
- C:\Windows\System\RKqcxvQ.exe
  C:\Windows\System\RKqcxvQ.exe
  2⤵
  PID:7424
- C:\Windows\System\XkzDmsH.exe
  C:\Windows\System\XkzDmsH.exe
  2⤵
  PID:7444
- C:\Windows\System\JukOySz.exe
  C:\Windows\System\JukOySz.exe
  2⤵
  PID:7464
- C:\Windows\System\wdGRixp.exe
  C:\Windows\System\wdGRixp.exe
  2⤵
  PID:7480
- C:\Windows\System\YmLFZLc.exe
  C:\Windows\System\YmLFZLc.exe
  2⤵
  PID:7504
- C:\Windows\System\YXPSmSk.exe
  C:\Windows\System\YXPSmSk.exe
  2⤵
  PID:7520
- C:\Windows\System\hyqtmWa.exe
  C:\Windows\System\hyqtmWa.exe
  2⤵
  PID:7536
- C:\Windows\System\sPEictc.exe
  C:\Windows\System\sPEictc.exe
  2⤵
  PID:7552
- C:\Windows\System\tTqlUYw.exe
  C:\Windows\System\tTqlUYw.exe
  2⤵
  PID:7576
- C:\Windows\System\ctrMLtN.exe
  C:\Windows\System\ctrMLtN.exe
  2⤵
  PID:7592
- C:\Windows\System\aeUGdhA.exe
  C:\Windows\System\aeUGdhA.exe
  2⤵
  PID:7608
- C:\Windows\System\jASVyWO.exe
  C:\Windows\System\jASVyWO.exe
  2⤵
  PID:7628
- C:\Windows\System\OmnUUup.exe
  C:\Windows\System\OmnUUup.exe
  2⤵
  PID:7652
- C:\Windows\System\dRRMDia.exe
  C:\Windows\System\dRRMDia.exe
  2⤵
  PID:7692
- C:\Windows\System\kfBTJoT.exe
  C:\Windows\System\kfBTJoT.exe
  2⤵
  PID:7708
- C:\Windows\System\IdoFGQp.exe
  C:\Windows\System\IdoFGQp.exe
  2⤵
  PID:7724
- C:\Windows\System\JoyhvMd.exe
  C:\Windows\System\JoyhvMd.exe
  2⤵
  PID:7740
- C:\Windows\System\OoTJCax.exe
  C:\Windows\System\OoTJCax.exe
  2⤵
  PID:7756
- C:\Windows\System\WRnQhFt.exe
  C:\Windows\System\WRnQhFt.exe
  2⤵
  PID:7776
- C:\Windows\System\usQySzN.exe
  C:\Windows\System\usQySzN.exe
  2⤵
  PID:7792
- C:\Windows\System\VwHAAtm.exe
  C:\Windows\System\VwHAAtm.exe
  2⤵
  PID:7816
- C:\Windows\System\wWTBrcN.exe
  C:\Windows\System\wWTBrcN.exe
  2⤵
  PID:7836
- C:\Windows\System\spTsDmU.exe
  C:\Windows\System\spTsDmU.exe
  2⤵
  PID:7856
- C:\Windows\System\hTbpitJ.exe
  C:\Windows\System\hTbpitJ.exe
  2⤵
  PID:7876
- C:\Windows\System\WJKrrBG.exe
  C:\Windows\System\WJKrrBG.exe
  2⤵
  PID:7912
- C:\Windows\System\ZZoRYKE.exe
  C:\Windows\System\ZZoRYKE.exe
  2⤵
  PID:7932
- C:\Windows\System\HjEoxXi.exe
  C:\Windows\System\HjEoxXi.exe
  2⤵
  PID:7948
- C:\Windows\System\GyEyTiE.exe
  C:\Windows\System\GyEyTiE.exe
  2⤵
  PID:7972
- C:\Windows\System\kEosMNy.exe
  C:\Windows\System\kEosMNy.exe
  2⤵
  PID:7988
- C:\Windows\System\QwalEkU.exe
  C:\Windows\System\QwalEkU.exe
  2⤵
  PID:8004
- C:\Windows\System\cUVaAiN.exe
  C:\Windows\System\cUVaAiN.exe
  2⤵
  PID:8024
- C:\Windows\System\UbTzRcj.exe
  C:\Windows\System\UbTzRcj.exe
  2⤵
  PID:8040
- C:\Windows\System\QpWlStR.exe
  C:\Windows\System\QpWlStR.exe
  2⤵
  PID:8056
- C:\Windows\System\DVFsQim.exe
  C:\Windows\System\DVFsQim.exe
  2⤵
  PID:8072
- C:\Windows\System\giQnMoE.exe
  C:\Windows\System\giQnMoE.exe
  2⤵
  PID:8088
- C:\Windows\System\YYgveJC.exe
  C:\Windows\System\YYgveJC.exe
  2⤵
  PID:8132
- C:\Windows\System\xNWoYqk.exe
  C:\Windows\System\xNWoYqk.exe
  2⤵
  PID:8148
- C:\Windows\System\fDDudqc.exe
  C:\Windows\System\fDDudqc.exe
  2⤵
  PID:8164
- C:\Windows\System\GgRxSBI.exe
  C:\Windows\System\GgRxSBI.exe
  2⤵
  PID:8184
- C:\Windows\System\yrrBVfx.exe
  C:\Windows\System\yrrBVfx.exe
  2⤵
  PID:6464
- C:\Windows\System\daytDGb.exe
  C:\Windows\System\daytDGb.exe
  2⤵
  PID:6276
- C:\Windows\System\sezEngB.exe
  C:\Windows\System\sezEngB.exe
  2⤵
  PID:7224
- C:\Windows\System\seiXQuI.exe
  C:\Windows\System\seiXQuI.exe
  2⤵
  PID:7200
- C:\Windows\System\wqDYWDC.exe
  C:\Windows\System\wqDYWDC.exe
  2⤵
  PID:7348
- C:\Windows\System\vtOYVDQ.exe
  C:\Windows\System\vtOYVDQ.exe
  2⤵
  PID:7196
- C:\Windows\System\jlowiCO.exe
  C:\Windows\System\jlowiCO.exe
  2⤵
  PID:7324
- C:\Windows\System\mHVNpSs.exe
  C:\Windows\System\mHVNpSs.exe
  2⤵
  PID:7340
- C:\Windows\System\AjWeBzy.exe
  C:\Windows\System\AjWeBzy.exe
  2⤵
  PID:7400
- C:\Windows\System\agwILHn.exe
  C:\Windows\System\agwILHn.exe
  2⤵
  PID:7436
- C:\Windows\System\CFiFRjU.exe
  C:\Windows\System\CFiFRjU.exe
  2⤵
  PID:7452
- C:\Windows\System\AbiaKzm.exe
  C:\Windows\System\AbiaKzm.exe
  2⤵
  PID:7488
- C:\Windows\System\InfWJHR.exe
  C:\Windows\System\InfWJHR.exe
  2⤵
  PID:7548
- C:\Windows\System\HphQPae.exe
  C:\Windows\System\HphQPae.exe
  2⤵
  PID:7624
- C:\Windows\System\PJYNKCb.exe
  C:\Windows\System\PJYNKCb.exe
  2⤵
  PID:7572
- C:\Windows\System\LJuwiec.exe
  C:\Windows\System\LJuwiec.exe
  2⤵
  PID:7564
- C:\Windows\System\MNKMYhF.exe
  C:\Windows\System\MNKMYhF.exe
  2⤵
  PID:7672
- C:\Windows\System\SZKUKXX.exe
  C:\Windows\System\SZKUKXX.exe
  2⤵
  PID:7644
- C:\Windows\System\HAfyuzG.exe
  C:\Windows\System\HAfyuzG.exe
  2⤵
  PID:7664
- C:\Windows\System\TGZWwqr.exe
  C:\Windows\System\TGZWwqr.exe
  2⤵
  PID:7716
- C:\Windows\System\brCbzhw.exe
  C:\Windows\System\brCbzhw.exe
  2⤵
  PID:7784
- C:\Windows\System\ZnVSBoR.exe
  C:\Windows\System\ZnVSBoR.exe
  2⤵
  PID:7804
- C:\Windows\System\XxxPmQO.exe
  C:\Windows\System\XxxPmQO.exe
  2⤵
  PID:7884
- C:\Windows\System\aaMpopI.exe
  C:\Windows\System\aaMpopI.exe
  2⤵
  PID:7928
- C:\Windows\System\vnLlTVq.exe
  C:\Windows\System\vnLlTVq.exe
  2⤵
  PID:7956
- C:\Windows\System\qklwcCX.exe
  C:\Windows\System\qklwcCX.exe
  2⤵
  PID:7996
- C:\Windows\System\aYpyeUY.exe
  C:\Windows\System\aYpyeUY.exe
  2⤵
  PID:8068
- C:\Windows\System\SemloXS.exe
  C:\Windows\System\SemloXS.exe
  2⤵
  PID:8112
- C:\Windows\System\ejwzhJG.exe
  C:\Windows\System\ejwzhJG.exe
  2⤵
  PID:8020
- C:\Windows\System\KTpMzfU.exe
  C:\Windows\System\KTpMzfU.exe
  2⤵
  PID:8052
- C:\Windows\System\FLTpMlQ.exe
  C:\Windows\System\FLTpMlQ.exe
  2⤵
  PID:8180
- C:\Windows\System\EvZwJij.exe
  C:\Windows\System\EvZwJij.exe
  2⤵
  PID:6908
- C:\Windows\System\OZvsBFc.exe
  C:\Windows\System\OZvsBFc.exe
  2⤵
  PID:8172
- C:\Windows\System\cclrFSx.exe
  C:\Windows\System\cclrFSx.exe
  2⤵
  PID:6396
- C:\Windows\System\ObsCmmU.exe
  C:\Windows\System\ObsCmmU.exe
  2⤵
  PID:7336
- C:\Windows\System\gCfHzFr.exe
  C:\Windows\System\gCfHzFr.exe
  2⤵
  PID:7392
- C:\Windows\System\BRcPKIZ.exe
  C:\Windows\System\BRcPKIZ.exe
  2⤵
  PID:7360
- C:\Windows\System\jDvrpsu.exe
  C:\Windows\System\jDvrpsu.exe
  2⤵
  PID:7276
- C:\Windows\System\QpdFMst.exe
  C:\Windows\System\QpdFMst.exe
  2⤵
  PID:7496
- C:\Windows\System\SLDWjnw.exe
  C:\Windows\System\SLDWjnw.exe
  2⤵
  PID:7668
- C:\Windows\System\PryysQT.exe
  C:\Windows\System\PryysQT.exe
  2⤵
  PID:7528
- C:\Windows\System\cWLPxyH.exe
  C:\Windows\System\cWLPxyH.exe
  2⤵
  PID:7812
- C:\Windows\System\rxygVSN.exe
  C:\Windows\System\rxygVSN.exe
  2⤵
  PID:7456
- C:\Windows\System\qEHkfEL.exe
  C:\Windows\System\qEHkfEL.exe
  2⤵
  PID:7832
- C:\Windows\System\zVhnFkd.exe
  C:\Windows\System\zVhnFkd.exe
  2⤵
  PID:7772
- C:\Windows\System\rTYHpBh.exe
  C:\Windows\System\rTYHpBh.exe
  2⤵
  PID:7908
- C:\Windows\System\bCKNIVA.exe
  C:\Windows\System\bCKNIVA.exe
  2⤵
  PID:7940
- C:\Windows\System\tbHJAuz.exe
  C:\Windows\System\tbHJAuz.exe
  2⤵
  PID:7900
- C:\Windows\System\icxIOvE.exe
  C:\Windows\System\icxIOvE.exe
  2⤵
  PID:8100
- C:\Windows\System\mJCFScw.exe
  C:\Windows\System\mJCFScw.exe
  2⤵
  PID:8120
- C:\Windows\System\BahBWSQ.exe
  C:\Windows\System\BahBWSQ.exe
  2⤵
  PID:8140
- C:\Windows\System\VeLXtWV.exe
  C:\Windows\System\VeLXtWV.exe
  2⤵
  PID:7216
- C:\Windows\System\lGRFEuk.exe
  C:\Windows\System\lGRFEuk.exe
  2⤵
  PID:7264
- C:\Windows\System\vpqusax.exe
  C:\Windows\System\vpqusax.exe
  2⤵
  PID:8104
- C:\Windows\System\yTDgrnY.exe
  C:\Windows\System\yTDgrnY.exe
  2⤵
  PID:7316
- C:\Windows\System\piSJiqO.exe
  C:\Windows\System\piSJiqO.exe
  2⤵
  PID:7440
- C:\Windows\System\DpcrAKl.exe
  C:\Windows\System\DpcrAKl.exe
  2⤵
  PID:7688
- C:\Windows\System\oAbuKTM.exe
  C:\Windows\System\oAbuKTM.exe
  2⤵
  PID:7680
- C:\Windows\System\ERjocmK.exe
  C:\Windows\System\ERjocmK.exe
  2⤵
  PID:7736
- C:\Windows\System\OTZHLuH.exe
  C:\Windows\System\OTZHLuH.exe
  2⤵
  PID:7828
- C:\Windows\System\qgdTokI.exe
  C:\Windows\System\qgdTokI.exe
  2⤵
  PID:7800
- C:\Windows\System\EwHFHIk.exe
  C:\Windows\System\EwHFHIk.exe
  2⤵
  PID:8084
- C:\Windows\System\vsWuTqw.exe
  C:\Windows\System\vsWuTqw.exe
  2⤵
  PID:8160
- C:\Windows\System\rFywRuP.exe
  C:\Windows\System\rFywRuP.exe
  2⤵
  PID:7240
- C:\Windows\System\QKsTPNN.exe
  C:\Windows\System\QKsTPNN.exe
  2⤵
  PID:7684
- C:\Windows\System\pOlOuMd.exe
  C:\Windows\System\pOlOuMd.exe
  2⤵
  PID:7648
- C:\Windows\System\rZvkMTU.exe
  C:\Windows\System\rZvkMTU.exe
  2⤵
  PID:7420
- C:\Windows\System\DUfweld.exe
  C:\Windows\System\DUfweld.exe
  2⤵
  PID:7768
- C:\Windows\System\RirGTBM.exe
  C:\Windows\System\RirGTBM.exe
  2⤵
  PID:7852
- C:\Windows\System\zeUvxVX.exe
  C:\Windows\System\zeUvxVX.exe
  2⤵
  PID:7904
- C:\Windows\System\BIVdNQG.exe
  C:\Windows\System\BIVdNQG.exe
  2⤵
  PID:7180
- C:\Windows\System\QcuesAW.exe
  C:\Windows\System\QcuesAW.exe
  2⤵
  PID:7220
- C:\Windows\System\hUdiuDh.exe
  C:\Windows\System\hUdiuDh.exe
  2⤵
  PID:7344
- C:\Windows\System\pPoyyuY.exe
  C:\Windows\System\pPoyyuY.exe
  2⤵
  PID:8108
- C:\Windows\System\ppvoDXq.exe
  C:\Windows\System\ppvoDXq.exe
  2⤵
  PID:7416
- C:\Windows\System\QvgQkHU.exe
  C:\Windows\System\QvgQkHU.exe
  2⤵
  PID:7636
- C:\Windows\System\mVnqfmh.exe
  C:\Windows\System\mVnqfmh.exe
  2⤵
  PID:7500
- C:\Windows\System\yWsReYq.exe
  C:\Windows\System\yWsReYq.exe
  2⤵
  PID:7844
- C:\Windows\System\axRewxi.exe
  C:\Windows\System\axRewxi.exe
  2⤵
  PID:8196
- C:\Windows\System\eDQSDql.exe
  C:\Windows\System\eDQSDql.exe
  2⤵
  PID:8212
- C:\Windows\System\ATWkVEw.exe
  C:\Windows\System\ATWkVEw.exe
  2⤵
  PID:8236
- C:\Windows\System\QLWGkFG.exe
  C:\Windows\System\QLWGkFG.exe
  2⤵
  PID:8252
- C:\Windows\System\rDLouta.exe
  C:\Windows\System\rDLouta.exe
  2⤵
  PID:8268
- C:\Windows\System\PMlpWsz.exe
  C:\Windows\System\PMlpWsz.exe
  2⤵
  PID:8308
- C:\Windows\System\wSphgBK.exe
  C:\Windows\System\wSphgBK.exe
  2⤵
  PID:8336
- C:\Windows\System\zYFgAaa.exe
  C:\Windows\System\zYFgAaa.exe
  2⤵
  PID:8372
- C:\Windows\System\qSfIYmr.exe
  C:\Windows\System\qSfIYmr.exe
  2⤵
  PID:8388
- C:\Windows\System\olQakPZ.exe
  C:\Windows\System\olQakPZ.exe
  2⤵
  PID:8412
- C:\Windows\System\oZJkFfV.exe
  C:\Windows\System\oZJkFfV.exe
  2⤵
  PID:8432
- C:\Windows\System\WQUCYRY.exe
  C:\Windows\System\WQUCYRY.exe
  2⤵
  PID:8460
- C:\Windows\System\GzppKxC.exe
  C:\Windows\System\GzppKxC.exe
  2⤵
  PID:8480
- C:\Windows\System\rXEKRHY.exe
  C:\Windows\System\rXEKRHY.exe
  2⤵
  PID:8496
- C:\Windows\System\xtEFtek.exe
  C:\Windows\System\xtEFtek.exe
  2⤵
  PID:8520
- C:\Windows\System\WAJHIXU.exe
  C:\Windows\System\WAJHIXU.exe
  2⤵
  PID:8544
- C:\Windows\System\GVEmPrv.exe
  C:\Windows\System\GVEmPrv.exe
  2⤵
  PID:8560
- C:\Windows\System\krzujQU.exe
  C:\Windows\System\krzujQU.exe
  2⤵
  PID:8580
- C:\Windows\System\nQHTIRs.exe
  C:\Windows\System\nQHTIRs.exe
  2⤵
  PID:8604
- C:\Windows\System\KHMfXDg.exe
  C:\Windows\System\KHMfXDg.exe
  2⤵
  PID:8620
- C:\Windows\System\OALQhwn.exe
  C:\Windows\System\OALQhwn.exe
  2⤵
  PID:8636
- C:\Windows\System\RisOYAV.exe
  C:\Windows\System\RisOYAV.exe
  2⤵
  PID:8656
- C:\Windows\System\BqUhLLp.exe
  C:\Windows\System\BqUhLLp.exe
  2⤵
  PID:8672
- C:\Windows\System\qmLKKfr.exe
  C:\Windows\System\qmLKKfr.exe
  2⤵
  PID:8692
- C:\Windows\System\sjiluOG.exe
  C:\Windows\System\sjiluOG.exe
  2⤵
  PID:8708
- C:\Windows\System\xDzhlXe.exe
  C:\Windows\System\xDzhlXe.exe
  2⤵
  PID:8724
- C:\Windows\System\JfdtwDz.exe
  C:\Windows\System\JfdtwDz.exe
  2⤵
  PID:8744
- C:\Windows\System\XJVyRfD.exe
  C:\Windows\System\XJVyRfD.exe
  2⤵
  PID:8784
- C:\Windows\System\ltwKbit.exe
  C:\Windows\System\ltwKbit.exe
  2⤵
  PID:8804
- C:\Windows\System\uxIWeeE.exe
  C:\Windows\System\uxIWeeE.exe
  2⤵
  PID:8820
- C:\Windows\System\qocuhZi.exe
  C:\Windows\System\qocuhZi.exe
  2⤵
  PID:8844
- C:\Windows\System\SuHvimN.exe
  C:\Windows\System\SuHvimN.exe
  2⤵
  PID:8860
- C:\Windows\System\rflQelq.exe
  C:\Windows\System\rflQelq.exe
  2⤵
  PID:8876
- C:\Windows\System\rsXblvm.exe
  C:\Windows\System\rsXblvm.exe
  2⤵
  PID:8896
- C:\Windows\System\ynLVQsL.exe
  C:\Windows\System\ynLVQsL.exe
  2⤵
  PID:8924
- C:\Windows\System\ayGKTSp.exe
  C:\Windows\System\ayGKTSp.exe
  2⤵
  PID:8944
- C:\Windows\System\ybxBDWE.exe
  C:\Windows\System\ybxBDWE.exe
  2⤵
  PID:8968
- C:\Windows\System\qDfhuPC.exe
  C:\Windows\System\qDfhuPC.exe
  2⤵
  PID:8984
- C:\Windows\System\BpGQdeI.exe
  C:\Windows\System\BpGQdeI.exe
  2⤵
  PID:9000
- C:\Windows\System\RqLNPgB.exe
  C:\Windows\System\RqLNPgB.exe
  2⤵
  PID:9020
- C:\Windows\System\nGasjFL.exe
  C:\Windows\System\nGasjFL.exe
  2⤵
  PID:9036
- C:\Windows\System\zjNcTKH.exe
  C:\Windows\System\zjNcTKH.exe
  2⤵
  PID:9052
- C:\Windows\System\adawkMt.exe
  C:\Windows\System\adawkMt.exe
  2⤵
  PID:9084
- C:\Windows\System\YUpNvfA.exe
  C:\Windows\System\YUpNvfA.exe
  2⤵
  PID:9100
- C:\Windows\System\rgpvrAi.exe
  C:\Windows\System\rgpvrAi.exe
  2⤵
  PID:9116
- C:\Windows\System\LFlNwso.exe
  C:\Windows\System\LFlNwso.exe
  2⤵
  PID:9140
- C:\Windows\System\mfJHdMi.exe
  C:\Windows\System\mfJHdMi.exe
  2⤵
  PID:9160
- C:\Windows\System\BnXaaEB.exe
  C:\Windows\System\BnXaaEB.exe
  2⤵
  PID:9180
- C:\Windows\System\AapIree.exe
  C:\Windows\System\AapIree.exe
  2⤵
  PID:9204
- C:\Windows\System\WZtHDYT.exe
  C:\Windows\System\WZtHDYT.exe
  2⤵
  PID:8220
- C:\Windows\System\FFLcbuM.exe
  C:\Windows\System\FFLcbuM.exe
  2⤵
  PID:7892
- C:\Windows\System\BbcFsEe.exe
  C:\Windows\System\BbcFsEe.exe
  2⤵
  PID:8300
- C:\Windows\System\rXhQhog.exe
  C:\Windows\System\rXhQhog.exe
  2⤵
  PID:8316
- C:\Windows\System\WYTeVYM.exe
  C:\Windows\System\WYTeVYM.exe
  2⤵
  PID:8352
- C:\Windows\System\sygHqlm.exe
  C:\Windows\System\sygHqlm.exe
  2⤵
  PID:8420
- C:\Windows\System\BZQOyBr.exe
  C:\Windows\System\BZQOyBr.exe
  2⤵
  PID:8404
- C:\Windows\System\qYevWFN.exe
  C:\Windows\System\qYevWFN.exe
  2⤵
  PID:8444
- C:\Windows\System\sxuTwmV.exe
  C:\Windows\System\sxuTwmV.exe
  2⤵
  PID:8504
- C:\Windows\System\VicJVJj.exe
  C:\Windows\System\VicJVJj.exe
  2⤵
  PID:8364
- C:\Windows\System\QmMviYQ.exe
  C:\Windows\System\QmMviYQ.exe
  2⤵
  PID:8536
- C:\Windows\System\HpauhUN.exe
  C:\Windows\System\HpauhUN.exe
  2⤵
  PID:8600
- C:\Windows\System\MAfftzr.exe
  C:\Windows\System\MAfftzr.exe
  2⤵
  PID:8700
- C:\Windows\System\eaxmAqT.exe
  C:\Windows\System\eaxmAqT.exe
  2⤵
  PID:8704
- C:\Windows\System\aCfXtTm.exe
  C:\Windows\System\aCfXtTm.exe
  2⤵
  PID:7256
- C:\Windows\System\qaGmbmb.exe
  C:\Windows\System\qaGmbmb.exe
  2⤵
  PID:8684
- C:\Windows\System\EXlIgcn.exe
  C:\Windows\System\EXlIgcn.exe
  2⤵
  PID:8760
- C:\Windows\System\sWzaobB.exe
  C:\Windows\System\sWzaobB.exe
  2⤵
  PID:8772
- C:\Windows\System\uCqGcvF.exe
  C:\Windows\System\uCqGcvF.exe
  2⤵
  PID:8812
- C:\Windows\System\hpHjZon.exe
  C:\Windows\System\hpHjZon.exe
  2⤵
  PID:8832
- C:\Windows\System\aEhFSOm.exe
  C:\Windows\System\aEhFSOm.exe
  2⤵
  PID:8332
- C:\Windows\System\nFnUpKo.exe
  C:\Windows\System\nFnUpKo.exe
  2⤵
  PID:8816
- C:\Windows\System\vAffoFc.exe
  C:\Windows\System\vAffoFc.exe
  2⤵
  PID:8892
- C:\Windows\System\RIZrDQY.exe
  C:\Windows\System\RIZrDQY.exe
  2⤵
  PID:8964
- C:\Windows\System\jomfbOq.exe
  C:\Windows\System\jomfbOq.exe
  2⤵
  PID:8980
- C:\Windows\System\QTDkRxe.exe
  C:\Windows\System\QTDkRxe.exe
  2⤵
  PID:9060
- C:\Windows\System\yxFKyAE.exe
  C:\Windows\System\yxFKyAE.exe
  2⤵
  PID:9016
- C:\Windows\System\MGrBBTt.exe
  C:\Windows\System\MGrBBTt.exe
  2⤵
  PID:9108
- C:\Windows\System\ApMFyOR.exe
  C:\Windows\System\ApMFyOR.exe
  2⤵
  PID:9128
- C:\Windows\System\OGPoUkq.exe
  C:\Windows\System\OGPoUkq.exe
  2⤵
  PID:9200
- C:\Windows\System\EIMflde.exe
  C:\Windows\System\EIMflde.exe
  2⤵
  PID:8260
- C:\Windows\System\CHdpEwZ.exe
  C:\Windows\System\CHdpEwZ.exe
  2⤵
  PID:8532
- C:\Windows\System\CqTpVDW.exe
  C:\Windows\System\CqTpVDW.exe
  2⤵
  PID:8384
- C:\Windows\System\JpkZMXq.exe
  C:\Windows\System\JpkZMXq.exe
  2⤵
  PID:8244
- C:\Windows\System\ryXJTzy.exe
  C:\Windows\System\ryXJTzy.exe
  2⤵
  PID:8396
- C:\Windows\System\zklvgDz.exe
  C:\Windows\System\zklvgDz.exe
  2⤵
  PID:8452
- C:\Windows\System\iQFcqqK.exe
  C:\Windows\System\iQFcqqK.exe
  2⤵
  PID:8512
- C:\Windows\System\yNLaWbW.exe
  C:\Windows\System\yNLaWbW.exe
  2⤵
  PID:8568
- C:\Windows\System\jFUSOTK.exe
  C:\Windows\System\jFUSOTK.exe
  2⤵
  PID:8472
- C:\Windows\System\ntAnhKC.exe
  C:\Windows\System\ntAnhKC.exe
  2⤵
  PID:8616
- C:\Windows\System\eFaMqNR.exe
  C:\Windows\System\eFaMqNR.exe
  2⤵
  PID:8720
- C:\Windows\System\wsJqSda.exe
  C:\Windows\System\wsJqSda.exe
  2⤵
  PID:8836
- C:\Windows\System\qNPYSni.exe
  C:\Windows\System\qNPYSni.exe
  2⤵
  PID:8884
- C:\Windows\System\qIMQhYK.exe
  C:\Windows\System\qIMQhYK.exe
  2⤵
  PID:8956
- C:\Windows\System\eTdvfHH.exe
  C:\Windows\System\eTdvfHH.exe
  2⤵
  PID:9032
- C:\Windows\System\evGEMwQ.exe
  C:\Windows\System\evGEMwQ.exe
  2⤵
  PID:8904
- C:\Windows\System\PfdWTwR.exe
  C:\Windows\System\PfdWTwR.exe
  2⤵
  PID:8936
- C:\Windows\System\mUsgKMC.exe
  C:\Windows\System\mUsgKMC.exe
  2⤵
  PID:9168
- C:\Windows\System\kYlhyRq.exe
  C:\Windows\System\kYlhyRq.exe
  2⤵
  PID:9068
- C:\Windows\System\OWOdgRb.exe
  C:\Windows\System\OWOdgRb.exe
  2⤵
  PID:9156
- C:\Windows\System\GoCtCfZ.exe
  C:\Windows\System\GoCtCfZ.exe
  2⤵
  PID:8368
- C:\Windows\System\AvgdnjJ.exe
  C:\Windows\System\AvgdnjJ.exe
  2⤵
  PID:8284
- C:\Windows\System\HSDtIgO.exe
  C:\Windows\System\HSDtIgO.exe
  2⤵
  PID:8516
- C:\Windows\System\DEVrqXN.exe
  C:\Windows\System\DEVrqXN.exe
  2⤵
  PID:8632
- C:\Windows\System\AJTHurB.exe
  C:\Windows\System\AJTHurB.exe
  2⤵
  PID:8428
- C:\Windows\System\sfhWJvt.exe
  C:\Windows\System\sfhWJvt.exe
  2⤵
  PID:8448
- C:\Windows\System\AXbcMMR.exe
  C:\Windows\System\AXbcMMR.exe
  2⤵
  PID:8680
- C:\Windows\System\wWBsGFc.exe
  C:\Windows\System\wWBsGFc.exe
  2⤵
  PID:8960
- C:\Windows\System\MNLeebo.exe
  C:\Windows\System\MNLeebo.exe
  2⤵
  PID:9076
- C:\Windows\System\ABBfqbb.exe
  C:\Windows\System\ABBfqbb.exe
  2⤵
  PID:9136
- C:\Windows\System\DUTxbJA.exe
  C:\Windows\System\DUTxbJA.exe
  2⤵
  PID:8996
- C:\Windows\System\MJPfylJ.exe
  C:\Windows\System\MJPfylJ.exe
  2⤵
  PID:8292
- C:\Windows\System\zcRwpkf.exe
  C:\Windows\System\zcRwpkf.exe
  2⤵
  PID:8344
- C:\Windows\System\UNdotZr.exe
  C:\Windows\System\UNdotZr.exe
  2⤵
  PID:9124
- C:\Windows\System\GIXudIH.exe
  C:\Windows\System\GIXudIH.exe
  2⤵
  PID:8736
- C:\Windows\System\qWGbMmR.exe
  C:\Windows\System\qWGbMmR.exe
  2⤵
  PID:8400
- C:\Windows\System\VpUSDIR.exe
  C:\Windows\System\VpUSDIR.exe
  2⤵
  PID:8920
- C:\Windows\System\tBiQCew.exe
  C:\Windows\System\tBiQCew.exe
  2⤵
  PID:8648
- C:\Windows\System\dYRHShm.exe
  C:\Windows\System\dYRHShm.exe
  2⤵
  PID:9044
- C:\Windows\System\kllleSh.exe
  C:\Windows\System\kllleSh.exe
  2⤵
  PID:8796
- C:\Windows\System\EffGyJr.exe
  C:\Windows\System\EffGyJr.exe
  2⤵
  PID:9176
- C:\Windows\System\HdsEAxr.exe
  C:\Windows\System\HdsEAxr.exe
  2⤵
  PID:8264
- C:\Windows\System\ulMgnmM.exe
  C:\Windows\System\ulMgnmM.exe
  2⤵
  PID:8576
- C:\Windows\System\NJUNSXw.exe
  C:\Windows\System\NJUNSXw.exe
  2⤵
  PID:8360
- C:\Windows\System\vXspxKe.exe
  C:\Windows\System\vXspxKe.exe
  2⤵
  PID:8792
- C:\Windows\System\qfgNXKw.exe
  C:\Windows\System\qfgNXKw.exe
  2⤵
  PID:8488
- C:\Windows\System\TCvFvKS.exe
  C:\Windows\System\TCvFvKS.exe
  2⤵
  PID:9188
- C:\Windows\System\DuWOMnZ.exe
  C:\Windows\System\DuWOMnZ.exe
  2⤵
  PID:9248
- C:\Windows\System\cdEUoQT.exe
  C:\Windows\System\cdEUoQT.exe
  2⤵
  PID:9264
- C:\Windows\System\NdUfADH.exe
  C:\Windows\System\NdUfADH.exe
  2⤵
  PID:9284
- C:\Windows\System\jbYqFeZ.exe
  C:\Windows\System\jbYqFeZ.exe
  2⤵
  PID:9304
- C:\Windows\System\cHgONBN.exe
  C:\Windows\System\cHgONBN.exe
  2⤵
  PID:9320
- C:\Windows\System\fDLjhLl.exe
  C:\Windows\System\fDLjhLl.exe
  2⤵
  PID:9344
- C:\Windows\System\czMpjMw.exe
  C:\Windows\System\czMpjMw.exe
  2⤵
  PID:9368
- C:\Windows\System\cBpsMas.exe
  C:\Windows\System\cBpsMas.exe
  2⤵
  PID:9384
- C:\Windows\System\cyHvxYY.exe
  C:\Windows\System\cyHvxYY.exe
  2⤵
  PID:9404
- C:\Windows\System\dzbdKdf.exe
  C:\Windows\System\dzbdKdf.exe
  2⤵
  PID:9420
- C:\Windows\System\onpJMVz.exe
  C:\Windows\System\onpJMVz.exe
  2⤵
  PID:9436
- C:\Windows\System\caHpuyF.exe
  C:\Windows\System\caHpuyF.exe
  2⤵
  PID:9456
- C:\Windows\System\wDCzGFa.exe
  C:\Windows\System\wDCzGFa.exe
  2⤵
  PID:9472
- C:\Windows\System\Srpoipf.exe
  C:\Windows\System\Srpoipf.exe
  2⤵
  PID:9496
- C:\Windows\System\XnRwPfY.exe
  C:\Windows\System\XnRwPfY.exe
  2⤵
  PID:9512
- C:\Windows\System\QxjKaJo.exe
  C:\Windows\System\QxjKaJo.exe
  2⤵
  PID:9532
- C:\Windows\System\cyNKmIR.exe
  C:\Windows\System\cyNKmIR.exe
  2⤵
  PID:9568
- C:\Windows\System\jXaieEY.exe
  C:\Windows\System\jXaieEY.exe
  2⤵
  PID:9588
- C:\Windows\System\ODwSWNZ.exe
  C:\Windows\System\ODwSWNZ.exe
  2⤵
  PID:9608
- C:\Windows\System\xlbYiTx.exe
  C:\Windows\System\xlbYiTx.exe
  2⤵
  PID:9628
- C:\Windows\System\JiNpWBP.exe
  C:\Windows\System\JiNpWBP.exe
  2⤵
  PID:9652
- C:\Windows\System\ZDTlhjC.exe
  C:\Windows\System\ZDTlhjC.exe
  2⤵
  PID:9692
- C:\Windows\System\WjRFzLE.exe
  C:\Windows\System\WjRFzLE.exe
  2⤵
  PID:9712
- C:\Windows\System\PrizWzV.exe
  C:\Windows\System\PrizWzV.exe
  2⤵
  PID:9728
- C:\Windows\System\hMJoONn.exe
  C:\Windows\System\hMJoONn.exe
  2⤵
  PID:9752
- C:\Windows\System\lHFCSUQ.exe
  C:\Windows\System\lHFCSUQ.exe
  2⤵
  PID:9768
- C:\Windows\System\lRXzTql.exe
  C:\Windows\System\lRXzTql.exe
  2⤵
  PID:9792
- C:\Windows\System\MXcjqXx.exe
  C:\Windows\System\MXcjqXx.exe
  2⤵
  PID:9812
- C:\Windows\System\pmZRpOM.exe
  C:\Windows\System\pmZRpOM.exe
  2⤵
  PID:9832
- C:\Windows\System\VuuciKv.exe
  C:\Windows\System\VuuciKv.exe
  2⤵
  PID:9856
- C:\Windows\System\TizPPGz.exe
  C:\Windows\System\TizPPGz.exe
  2⤵
  PID:9872
- C:\Windows\System\lanNSzZ.exe
  C:\Windows\System\lanNSzZ.exe
  2⤵
  PID:9888
- C:\Windows\System\IweWqMW.exe
  C:\Windows\System\IweWqMW.exe
  2⤵
  PID:9904
- C:\Windows\System\KMhhwLi.exe
  C:\Windows\System\KMhhwLi.exe
  2⤵
  PID:9924
- C:\Windows\System\BENPYmJ.exe
  C:\Windows\System\BENPYmJ.exe
  2⤵
  PID:9944
- C:\Windows\System\RQqjrEv.exe
  C:\Windows\System\RQqjrEv.exe
  2⤵
  PID:9964
- C:\Windows\System\mTZOtMf.exe
  C:\Windows\System\mTZOtMf.exe
  2⤵
  PID:9980
- C:\Windows\System\FHwxuTz.exe
  C:\Windows\System\FHwxuTz.exe
  2⤵
  PID:9996
- C:\Windows\System\JSxOYGX.exe
  C:\Windows\System\JSxOYGX.exe
  2⤵
  PID:10016
- C:\Windows\System\bxPzMgN.exe
  C:\Windows\System\bxPzMgN.exe
  2⤵
  PID:10040
- C:\Windows\System\ClKaeuv.exe
  C:\Windows\System\ClKaeuv.exe
  2⤵
  PID:10084
- C:\Windows\System\wEoOlEq.exe
  C:\Windows\System\wEoOlEq.exe
  2⤵
  PID:10100
- C:\Windows\System\xtwPtnS.exe
  C:\Windows\System\xtwPtnS.exe
  2⤵
  PID:10116
- C:\Windows\System\FTXnlek.exe
  C:\Windows\System\FTXnlek.exe
  2⤵
  PID:10132
- C:\Windows\System\OIEKGNt.exe
  C:\Windows\System\OIEKGNt.exe
  2⤵
  PID:10156
- C:\Windows\System\LwyZzaK.exe
  C:\Windows\System\LwyZzaK.exe
  2⤵
  PID:10172
- C:\Windows\System\CqDqBvR.exe
  C:\Windows\System\CqDqBvR.exe
  2⤵
  PID:10192
- C:\Windows\System\PIlPDJy.exe
  C:\Windows\System\PIlPDJy.exe
  2⤵
  PID:10208
- C:\Windows\System\fjIISng.exe
  C:\Windows\System\fjIISng.exe
  2⤵
  PID:10228
- C:\Windows\System\HAClPJB.exe
  C:\Windows\System\HAClPJB.exe
  2⤵
  PID:8872
- C:\Windows\System\AhBWYfn.exe
  C:\Windows\System\AhBWYfn.exe
  2⤵
  PID:8668
- C:\Windows\System\teHlWoQ.exe
  C:\Windows\System\teHlWoQ.exe
  2⤵
  PID:9236
- C:\Windows\System\SAlUnBF.exe
  C:\Windows\System\SAlUnBF.exe
  2⤵
  PID:9256
- C:\Windows\System\gUgWDLK.exe
  C:\Windows\System\gUgWDLK.exe
  2⤵
  PID:9332
- C:\Windows\System\ttiRqZV.exe
  C:\Windows\System\ttiRqZV.exe
  2⤵
  PID:9340
- C:\Windows\System\XODlRab.exe
  C:\Windows\System\XODlRab.exe
  2⤵
  PID:9376
- C:\Windows\System\SjIwJQR.exe
  C:\Windows\System\SjIwJQR.exe
  2⤵
  PID:9468
- C:\Windows\System\RZpFBPk.exe
  C:\Windows\System\RZpFBPk.exe
  2⤵
  PID:9544
- C:\Windows\System\PEDckoP.exe
  C:\Windows\System\PEDckoP.exe
  2⤵
  PID:9416
- C:\Windows\System\NRdeNno.exe
  C:\Windows\System\NRdeNno.exe
  2⤵
  PID:9484
- C:\Windows\System\ZdQbYkf.exe
  C:\Windows\System\ZdQbYkf.exe
  2⤵
  PID:9524
- C:\Windows\System\dspKFWD.exe
  C:\Windows\System\dspKFWD.exe
  2⤵
  PID:9644
- C:\Windows\System\SFEXJJQ.exe
  C:\Windows\System\SFEXJJQ.exe
  2⤵
  PID:9648
- C:\Windows\System\yFzMqzD.exe
  C:\Windows\System\yFzMqzD.exe
  2⤵
  PID:9360
- C:\Windows\System\hZOTZJj.exe
  C:\Windows\System\hZOTZJj.exe
  2⤵
  PID:9744
- C:\Windows\System\LQMxKGU.exe
  C:\Windows\System\LQMxKGU.exe
  2⤵
  PID:9748
- C:\Windows\System\zIXnPaZ.exe
  C:\Windows\System\zIXnPaZ.exe
  2⤵
  PID:9764
- C:\Windows\System\TKCglqQ.exe
  C:\Windows\System\TKCglqQ.exe
  2⤵
  PID:9896
- C:\Windows\System\jYhJbaU.exe
  C:\Windows\System\jYhJbaU.exe
  2⤵
  PID:9804
- C:\Windows\System\AxVbgLZ.exe
  C:\Windows\System\AxVbgLZ.exe
  2⤵
  PID:10004
- C:\Windows\System\lbVjFli.exe
  C:\Windows\System\lbVjFli.exe
  2⤵
  PID:9912
- C:\Windows\System\bOauXlc.exe
  C:\Windows\System\bOauXlc.exe
  2⤵
  PID:10056
- C:\Windows\System\uHuOprA.exe
  C:\Windows\System\uHuOprA.exe
  2⤵
  PID:9844
- C:\Windows\System\gNCglOS.exe
  C:\Windows\System\gNCglOS.exe
  2⤵
  PID:9916
- C:\Windows\System\eUxRnNJ.exe
  C:\Windows\System\eUxRnNJ.exe
  2⤵
  PID:10036
- C:\Windows\System\rTruIHM.exe
  C:\Windows\System\rTruIHM.exe
  2⤵
  PID:9820
- C:\Windows\System\cfSkEhh.exe
  C:\Windows\System\cfSkEhh.exe
  2⤵
  PID:10144
- C:\Windows\System\ZqnJgdN.exe
  C:\Windows\System\ZqnJgdN.exe
  2⤵
  PID:10188
- C:\Windows\System\YwdcWHo.exe
  C:\Windows\System\YwdcWHo.exe
  2⤵
  PID:9224
- C:\Windows\System\wCkVnaO.exe
  C:\Windows\System\wCkVnaO.exe
  2⤵
  PID:9276
- C:\Windows\System\JRRMtxp.exe
  C:\Windows\System\JRRMtxp.exe
  2⤵
  PID:10200
- C:\Windows\System\sJatGUm.exe
  C:\Windows\System\sJatGUm.exe
  2⤵
  PID:10236
- C:\Windows\System\dISBycA.exe
  C:\Windows\System\dISBycA.exe
  2⤵
  PID:9316
- C:\Windows\System\KOofUow.exe
  C:\Windows\System\KOofUow.exe
  2⤵
  PID:9400
- C:\Windows\System\iJfPCWK.exe
  C:\Windows\System\iJfPCWK.exe
  2⤵
  PID:9564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GLlCRSJ.exe

Filesize
2.8MB

MD5
cdd3fa2af013cf18e4c6153b2559a2b0

SHA1
847d28a6c7430d4da0c6f6bfeaca87b1c33c850d

SHA256
d9db5b9cdcc3a45195343fb754617d8d5d6cea0937e2a18009fa77429d073934

SHA512
3cbc8c0e0770f534a6a785549a2fd98b7dde2232e312bc833f9510ec6dfcfd50a11cadb54452c2930daf36f68577fb16486bf5e92729a023810ac4e12ecfcc2c

Download Submit
C:\Windows\system\HCjBXkP.exe

Filesize
2.8MB

MD5
1b62daef24ea7424c56775989154484c

SHA1
3bfed15004bfb7f402514f50ba1b2e1172e0c293

SHA256
8267db2c8324226ef3ab024ae4155c96f018a1a7bfe355d60a521af36d4eaeb3

SHA512
2ea0c54b0c6b0aa648f5080f61c3ea548dfad5ae090acc99e85e37a0036eeb78dba3f2feac10ff73e7280c8998ee57ba5e3710d1f3eb64daf8821cd2d95c2938

Download Submit
C:\Windows\system\JVOhZWt.exe

Filesize
2.8MB

MD5
1e520d1c1430f65cef812fd5028b6a90

SHA1
c0ea099b5d7b6467bd44c4402f87de540f9685d0

SHA256
08b28af765b97cb2b4ce890a926baba3a35810619e85ffbbef230468fb89d424

SHA512
c76c932465b67e8cf9b47724d3db995ee7ab32ab7d26a99444988d512710d4c8001a239653ff7baf9d39b33963e8c60bef468bab2619d75b29529183dd0e21ac

Download Submit
C:\Windows\system\JeYlHGY.exe

Filesize
2.8MB

MD5
ebb3e5f15c5c6a6d5095c32185287db7

SHA1
80ee827097446aec1356a8b30053b40252b3832f

SHA256
7ff2d4fe4baa416ed962999b4ffed26dd1cdd333214e99c157846ecdc7d3a126

SHA512
ad9241b4c7ec3b2ea27700e677f36685d426552a86374743bb7b6eee05259672abd54460024a4974552dd502dea7fc7506c52482de4eef8e97eb9a1d154b9fb3

Download Submit
C:\Windows\system\KSHMCWw.exe

Filesize
2.8MB

MD5
bbae91dd471af92d26bc7f4d6a07c1fd

SHA1
e89c468f36b44cdfe50c7fe536f8ab384b256c68

SHA256
6ffc836126404beb2fc5f0a14bf595458a7fcff93c30735190ead17252e1cb5e

SHA512
7fc07d1bba0a533d287057b6a0819cc1ee6d589a4cab0fc58c092861bf37ac5706a8129ff454288d3e9ce182802144a1762f867e05b778c63b9e35b9ab759935

Download Submit
C:\Windows\system\KwNzENi.exe

Filesize
2.8MB

MD5
31f0359224a90c54c39b2afeed198101

SHA1
341b635af346a103f59e59a6e6519f0b3bef0b44

SHA256
246509fdecf7feafec2895c0f989ffa11afc51ac79d7b8815d8baacd7c9f6a54

SHA512
33feb3ed1256a910a1b4d14fb648cfa2970d51be1c915e61a12701d4ba234b3b079d0eb745a2fe6d1261608fd3328394cf94e8cd131eaac8bedb6e4861dc5d5f

Download Submit
C:\Windows\system\NhfuIkp.exe

Filesize
2.8MB

MD5
c2de6a8ed9a40213bb586705213cdd6c

SHA1
09b327381f4ed1b28d076f5d89131395f7592238

SHA256
6c3231ae256a2596d592b8b7b6a5201b98036b4b94655c646f9452bc4f000d6a

SHA512
a90cfe8d1cb57add486d35c2589278041d2dd3fc043c5de55ee4c38301232709c6f4692c486ca75fbc46e24c0dbc133f506c21c47cfa0d675b743f2f1310727d

Download Submit
C:\Windows\system\PUrdOhu.exe

Filesize
2.8MB

MD5
d94bd4c27234e4e5b5962ac432b293c8

SHA1
15c883ead67b819db7772cdbb45fa6b1cf3d1c5f

SHA256
2d9de4453b5446fceec056a762df8210cbd47cbdd4bdac9fa29e12a9fc061a4a

SHA512
e9d9042fbcf41883d601dad36588da0454bdc97ab7c68fa5a76b7cb1fbfd0c5369d96b8bfe2d97a320f51dde0ec56840d291bd984b1887f5af17d8f8f9c88f77

Download Submit
C:\Windows\system\PYyBYdN.exe

Filesize
2.8MB

MD5
8b6eb29220a22f2681183a32fc674678

SHA1
b02003854782af85bc8a70bdd2afb7199048ef9a

SHA256
33b4cbe54b53eec7bc64875876953d331072042d478be31394a77cb82f1b163b

SHA512
48a5a337d575635f734321aa89bd0115148411718042988cf8f34d87d09935c528d058ef4dd184bb9d1c40ad1e4946980af79884a503e9b51be57ea16e02c627

Download Submit
C:\Windows\system\TNkhmzR.exe

Filesize
2.8MB

MD5
2e058deaeeebea1a5f6501aafef075e1

SHA1
07c156d0cdb1892770d2036b9079e2d0d98e65f4

SHA256
2a6d8d354fb324d618233ff6eecca3a1b80807f805bd8476ac97fbc26729625c

SHA512
5ad3713f2f34a65d60d7afda87d5d5cca24c078fa3cbc0a599b51401f423af1a6375c86d81651ec833f07fe098c29e51c94f595f558447914ea8aec0f8836787

Download Submit
C:\Windows\system\TXbFzxU.exe

Filesize
2.8MB

MD5
431134498633aff4825011a08dea5dbb

SHA1
876eb7baf53c3502fa6a3eef6083c035306f118b

SHA256
85ae83dd594981b634bf529b611e113e9466ccb2f028dd4bf14d7ea583851e2c

SHA512
f1f9b45309436958ebe4a8609e29b687bb1e83d5a7dd731a370c29cfbdfc9505929100505f9c06f31982b92248ff1fdc3fe32dfb21a14bc0529a7519c66075f3

Download Submit
C:\Windows\system\WiDseWG.exe

Filesize
2.8MB

MD5
7381d77d32bbaaefa28be53469f93df2

SHA1
981b7c07aabc8be3cf275410120637221ef96a30

SHA256
d1229a885cf3deca6ce9b4989e0bd17fb3a620aaafa70ba955a9dcceab6c1573

SHA512
4cf29efdb71d2b9ce66266a46badcb63292a369514a6f70966592b8760d4ada6050534069f89c2cac482b0778c38d360fe17ad068faf9cb69373f71d818a2174

Download Submit
C:\Windows\system\ZCkhsCW.exe

Filesize
2.8MB

MD5
129029b5dc3b2f3d3ab4eb30bc8a7072

SHA1
184a2ab8095245c1cd49cb1bb6f89ff4f7946583

SHA256
f32f205f7f7384782fa9aca81460c33bc35d2ad602dfdaa19b71b06212ae85a8

SHA512
a85277b333a9aa43f645751d1d73526e70ffecf21ce44e474ed8719fd8ff4479ce87bdcf2609bce8e355efc88b41f530dd2caf9f787d75a5e7f85919cc2a42dd

Download Submit
C:\Windows\system\bYAQjzv.exe

Filesize
2.8MB

MD5
97362cfef7591ca2408320567b1e8eab

SHA1
28002393f773bd2e004be1e43199a4353ff05d33

SHA256
ccfb6050b25518f4851a39cfa820ab4639a30658f2f24cab0a36d3c8ace0b33f

SHA512
a82904be56c4fb89261fa0af42d3003d4006249d858d0a3b68607f75d72f1702688a3e93a0f9ff0b65b56dae0ceb10eb48903a6ad6c1d98cce3c3206f128bea8

Download Submit
C:\Windows\system\cLKkgeG.exe

Filesize
2.8MB

MD5
7c633b427cac4e5a7c05eb3c84b5a430

SHA1
9b43de9ab63ac213a44156e3202b20fefde9fbcd

SHA256
8745a0be4f49b334a7655a7d9c53b6c56899033f105840ec1549a0b30a2b16e1

SHA512
f220e90256d89cab84e6659bf08c51b493e29c25b70419fbd5b78b012a87dd7867ccafe85b9d49fc79f21a82457870f5262dda8569cb406cbf7795381208576c

Download Submit
C:\Windows\system\ctkUziX.exe

Filesize
2.8MB

MD5
826f33abaeaf9a69e335eed314fccdc2

SHA1
f3c7c8b1391726a449b224ebef1ff1857704a569

SHA256
da12d4a10d2ad5c1c11ce2d2f1046028d8260c6b0a5d9dc177db157f62aeda5f

SHA512
186d400ca24e990e8e231c6991d2e2d2d3239ec0d7bb5ba1efbedeb52c7bb9569dcf0835e799569f2cdb75241aef379c1318398416fd8f87077e2213126694a3

Download Submit
C:\Windows\system\dYODrsJ.exe

Filesize
2.8MB

MD5
b29b1fba38c21b090cc0e603bd33d2e6

SHA1
e29a51273575cf988fdd9e78100b4ed8ff31fe66

SHA256
b2d8cd7dc476f7f6325d8a1d1acab81031b5e1c354d42de05a468d4d611126b3

SHA512
83c85b84d88eaffc39b0fa2b194e129e99bd980d259fb822c528bf52e5068241a87301053248eaded82526aacaa3334b79f665cef34f1266bcdcc4699a311710

Download Submit
C:\Windows\system\dvcaZIJ.exe

Filesize
2.8MB

MD5
ec6f8107e2af05f6c0311e1d6336eab6

SHA1
af6a9a21dadd8e179e9be60cc43dd6c28bcd1282

SHA256
df6aa500c0e3922dd73453f40e87b15f3b4b253df33f2c332795c59bca652ca1

SHA512
d8eb3622fd4c8e4c8eeed2e9ef499080498b5af875c1e106420de31c14dce8f5fe03198c8116d5d15dbe56a006e4689d93c5c81dd24d6de3e07beec0d7f6f308

Download Submit
C:\Windows\system\iNUhrBR.exe

Filesize
2.8MB

MD5
6399a308d95c097b7a86c20aa14ade6d

SHA1
4023cb982e7dac400b3490462665ce0d0c260f99

SHA256
46a5b5236869c8bc892c00da4ea6fea1edff3d68183c14f9dbb7db79923b79cd

SHA512
0e259f97366a462104b40659951a0a722ebaa97b85de2be4f5cf19adc3db5b94be08492deb23769bc4ec12d349a23614fa830514ee92264514d6757fcc6fbdc8

Download Submit
C:\Windows\system\jBenMmY.exe

Filesize
2.8MB

MD5
ce0ed9542f213657b08ba4352b1de4e5

SHA1
cb18e9f3e0e50dd19daae81c9540a21d7805292d

SHA256
625ada718a1e7f63c92d39af567be363443c0bfb61a2d84d652e6bcc5c2708f0

SHA512
95dbc4b4842b6aa8f33a44f0393882b0f0ecb76ab5596e642d73592b3d96e34559377e6909e4c6fa3c1a1e277ff46677e348708f5bb2ba95027839c3fbc878da

Download Submit
C:\Windows\system\lvUBgpC.exe

Filesize
2.8MB

MD5
91877299839e1e0d4e8c6ddd05c05ad4

SHA1
890ca01b4a5a4bc4f80c492b43a41b0a8aa4b28a

SHA256
a36e04d68eae4331c8fe7960590c77417de65039db03d53d02e0a7c2961f5717

SHA512
df1fecd4431ee241c30b360ee9e532bb4a3943c1f61caf8bb3f8cc44b158fe3f3166a70c04a4f174ca63868260436c9e380200d889601172a424c33621c9baf4

Download Submit
C:\Windows\system\mJKfpwu.exe

Filesize
2.8MB

MD5
ae29da3889cd76b9724b87b77ee61830

SHA1
9b91fa2fd4acd6031d152fe46122461759f03c46

SHA256
b7063a39cbcb4b590a89341deafce32c3c882886a4e82a6bd34aab80db523d3f

SHA512
4a9f7020c391e4a6370e5ad799e651b08d35cd4ae626c59f6e53bfb565b1d7459d52b7ba5a2b8df3c0d9695c5090144fe78f7eaeba0c6e195b8fc3a989017d00

Download Submit
C:\Windows\system\nwinsGI.exe

Filesize
2.8MB

MD5
990847e55b7d6fae59331ea756adfe27

SHA1
736e4858898e7fcd0a7e4dcc41f9bc75dc173ea5

SHA256
fae2cc7e1473ff0790a5dfd27280323782df1edd9c165517aaee90c852a93657

SHA512
98f3028cc548ea5671782ca5f399f1a15681aa5ab9a07f498fbee8f1282f3130b6eb2a172146e87c13e652682ed176a1b6ee50c94778f21c8e1183607b38ca98

Download Submit
C:\Windows\system\rXZtfJU.exe

Filesize
2.8MB

MD5
0bb6403aa31cab85e643625bcf373221

SHA1
90f00ff978bf67fd8fc41c143e79022ac263de3c

SHA256
fb8c17c214cd293de407d58395e6fce3d59339eeeb5140462a8a5ce175f26ce1

SHA512
84a7cfee1349e1b4979bee3d31ad96d14477a68df313f9c61c9a1489910b993b5c855f6c22914c17832edf43ddb63bac7d0f46ce2fd1319f77b0ccc5748bb256

Download Submit
C:\Windows\system\rkgDmvd.exe

Filesize
2.8MB

MD5
cc360378d77e760205187646271d253e

SHA1
0ce9312c67acc6f3f44d0492a35a59f9cd03126d

SHA256
14d8e4ac73088706589f82c96fdd9c825eeb5bc11c879c37adc6df53785c3a3f

SHA512
25fa6c8d9f6ecdebbb0f207f224ae71979faec835292523e60f220dbc80d190fb5423d1308df190da2b55328d972576bbd05668de3f09d0e269914845fbc8c2d

Download Submit
C:\Windows\system\uAPjXlt.exe

Filesize
2.8MB

MD5
4e24ece9e5a29ade5f1a94873b516be1

SHA1
a32da54c32418c812a49770706ce7c29ce5347ad

SHA256
9b6e3da59e22c389acb5cda3079b822ca71de17973e33f5a71a1927faba2f849

SHA512
8a1140a34d06ba642491090d1df740c36d913685412f3c9d31439706bbd8107a91f65910279c3bbbd1b0cca1e230464e5ebfd1cfce226080f5ab7b7f66132826

Download Submit
C:\Windows\system\wKcVHBk.exe

Filesize
2.8MB

MD5
91924a9102979e8b210d266fb0c48c81

SHA1
c1a0f3d1b9614573702f581651a79b71a3819684

SHA256
855a087bfa755eff408e86c2eab325d1803014630c951ec8e91f6272dd584974

SHA512
5082d738cd776bf4eacce9c39aedc1e203827bc46e64ba9628e80f7818ba23fa7c8d14e0fff6d59bbe366de626cbb8dc7d536f0bc60f8e943adf3da1563710bf

Download Submit
C:\Windows\system\wMIIoam.exe

Filesize
2.8MB

MD5
b76763ffcbd096ed29e4fb81f815d19a

SHA1
a315bd4bff5f6e4375724a6289501a30c66d90e0

SHA256
0cb79a32f48af0da5debf5672bc79d3e33ed3255e79c6bf690e23ce59ad5ba5f

SHA512
af8be6d50299fafadd50a24019f632160fb7cfa1bbfe26f8dde2d6ecd3171aa29ab0c04eebda31e8a39dae2f31a67d56b792ceee0d1dd6efdeb934d12f06cf95

Download Submit
C:\Windows\system\wjpdUFe.exe

Filesize
2.8MB

MD5
9d31b658deb82ac62ec06f8d2ef1971c

SHA1
811a5d94af323a6be0673eb199f843d5d96ed2cf

SHA256
535794688485062b8925ea5416fe5d99b6369c44fba874dc8f302570cc33dba1

SHA512
99fed05025492f70ff5ac5766d8357a8c576ceeb45887926a6f0411cfc74ab5bf06b7cee7f7ad813baf089789ff6e9f032c75f6beb218efb3be92df230f8b110

Download Submit
C:\Windows\system\xCZvcyJ.exe

Filesize
2.8MB

MD5
d294ed0e3d13720acb6e0cd7bee74877

SHA1
d61ac675d5eafadd27954004779b247a3a7da420

SHA256
6009764777573977603e071f9c132d9d4c2208ac8f3b46ff7ec75e6707a8e960

SHA512
ba1d63aba609c5706e86de9872fff700387d6589bc11312bcf96f01a712e629c5360070654e4f1c74dd5529604447cc2328444effe4e1bfb45e9cb8d3246d664

Download Submit
\Windows\system\GQeCFUt.exe

Filesize
2.8MB

MD5
dea6657d197cdf0ff4f5a0f07e986c4e

SHA1
ace58f47439aa15fce5bf471efb5fcb69f00bdc7

SHA256
724e6b4a70555784b6967598e1f08e06f3bad043c91c620ca9e828de91f531b6

SHA512
8618563bc1a38b8e9c872634fa5b98f1251da290e4e6069435000d493ef9ee8c1f7284e4e3b441fc4ed8c4981f0fa5f6074abf62b8bc3292691a1a59469bca89

Download Submit
\Windows\system\IdHpsWg.exe

Filesize
2.8MB

MD5
b9d84608f846f0178d4591a5d40fa0a5

SHA1
0acd262c6e00bc129f67ebb5334dd1363f2088fe

SHA256
8e773c59bed9838a26dad9334f9a04dd5644e395d7f98146b34e922f5b39c878

SHA512
b7bce672e8f37a4dbe0270f3711c967a94107d46010d82b62a977a3fe3200403f9390e1bb0cb3c35441d8fad8bec16fe2625bea2e7b2d6db9c0273915d4cadc6

Download Submit
memory/1156-235-0x000000013FA00000-0x000000013FDF6000-memory.dmp

Filesize
4.0MB

Download
memory/1156-2557-0x000000013FA00000-0x000000013FDF6000-memory.dmp

Filesize
4.0MB

Download
memory/1708-191-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/1708-52-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/1708-190-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

Filesize
2.9MB

Download
memory/1960-22-0x000000013FB50000-0x000000013FF46000-memory.dmp

Filesize
4.0MB

Download
memory/1960-2529-0x000000013FB50000-0x000000013FF46000-memory.dmp

Filesize
4.0MB

Download
memory/2004-247-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2004-64-0x000000013F210000-0x000000013F606000-memory.dmp

Filesize
4.0MB

Download
memory/2004-21-0x0000000002D40000-0x0000000003136000-memory.dmp

Filesize
4.0MB

Download
memory/2004-563-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2004-273-0x00000000032B0000-0x00000000036A6000-memory.dmp

Filesize
4.0MB

Download
memory/2004-3556-0x00000000032B0000-0x00000000036A6000-memory.dmp

Filesize
4.0MB

Download
memory/2004-264-0x000000013FF50000-0x0000000140346000-memory.dmp

Filesize
4.0MB

Download
memory/2004-59-0x000000013F3F0000-0x000000013F7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2004-2-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2004-15-0x0000000002D40000-0x0000000003136000-memory.dmp

Filesize
4.0MB

Download
memory/2004-0-0x0000000001B20000-0x0000000001B30000-memory.dmp

Filesize
64KB

Download
memory/2004-8-0x0000000002D40000-0x0000000003136000-memory.dmp

Filesize
4.0MB

Download
memory/2004-50-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2004-31-0x0000000002D40000-0x0000000003136000-memory.dmp

Filesize
4.0MB

Download
memory/2256-2528-0x000000013F790000-0x000000013FB86000-memory.dmp

Filesize
4.0MB

Download
memory/2256-9-0x000000013F790000-0x000000013FB86000-memory.dmp

Filesize
4.0MB

Download
memory/2360-2562-0x000000013F2C0000-0x000000013F6B6000-memory.dmp

Filesize
4.0MB

Download
memory/2360-244-0x000000013F2C0000-0x000000013F6B6000-memory.dmp

Filesize
4.0MB

Download
memory/2428-2558-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2428-263-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2436-30-0x000000013FBC0000-0x000000013FFB6000-memory.dmp

Filesize
4.0MB

Download
memory/2436-2530-0x000000013FBC0000-0x000000013FFB6000-memory.dmp

Filesize
4.0MB

Download
memory/2496-2551-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2496-51-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2536-55-0x000000013F3F0000-0x000000013F7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2536-2544-0x000000013F3F0000-0x000000013F7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-2535-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-49-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/2620-228-0x000000013F210000-0x000000013F606000-memory.dmp

Filesize
4.0MB

Download
memory/2620-2902-0x000000013F210000-0x000000013F606000-memory.dmp

Filesize
4.0MB

Download
memory/2620-2987-0x000000013F210000-0x000000013F606000-memory.dmp

Filesize
4.0MB

Download
memory/2696-2552-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2696-58-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2768-2570-0x000000013FF50000-0x0000000140346000-memory.dmp

Filesize
4.0MB

Download
memory/2768-271-0x000000013FF50000-0x0000000140346000-memory.dmp

Filesize
4.0MB

Download