xmrig | c322ac9dcb6385b208020f0887f32cea5a2cd514d7b6e1f3d3195f588778efbf

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
Size

1.6MB
MD5

4bb0de84d1a866bc340b00c69a0b7fd0
SHA1

32d296de985df4fcebcb765ea25a63084a2e2317
SHA256

c322ac9dcb6385b208020f0887f32cea5a2cd514d7b6e1f3d3195f588778efbf
SHA512

e6b68a0ba269e44c4337c86f671d606e67a8751b96ab969433e83ccea7077e9f1cb25a264eb8fa42f50237a99218241154c8db1ddc0d1fd10603f201bc80dd5d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbkj:Lz071uv4BPMkHC0I6Gz3N1pHP7c

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/2512-177-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp	xmrig
behavioral2/memory/1912-205-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp	xmrig
behavioral2/memory/1388-204-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp	xmrig
behavioral2/memory/1772-195-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp	xmrig
behavioral2/memory/4004-189-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp	xmrig
behavioral2/memory/4392-183-0x00007FF662760000-0x00007FF662B52000-memory.dmp	xmrig
behavioral2/memory/1372-171-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp	xmrig
behavioral2/memory/4632-160-0x00007FF718870000-0x00007FF718C62000-memory.dmp	xmrig
behavioral2/memory/3564-154-0x00007FF747470000-0x00007FF747862000-memory.dmp	xmrig
behavioral2/memory/3160-148-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp	xmrig
behavioral2/memory/456-142-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp	xmrig
behavioral2/memory/1176-136-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp	xmrig
behavioral2/memory/5004-130-0x00007FF659880000-0x00007FF659C72000-memory.dmp	xmrig
behavioral2/memory/2560-124-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp	xmrig
behavioral2/memory/2264-113-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp	xmrig
behavioral2/memory/1500-107-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp	xmrig
behavioral2/memory/2144-101-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp	xmrig
behavioral2/memory/808-97-0x00007FF764600000-0x00007FF7649F2000-memory.dmp	xmrig
behavioral2/memory/3432-89-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp	xmrig
behavioral2/memory/3968-86-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp	xmrig
behavioral2/memory/2464-82-0x00007FF724850000-0x00007FF724C42000-memory.dmp	xmrig
behavioral2/memory/3992-75-0x00007FF653020000-0x00007FF653412000-memory.dmp	xmrig
behavioral2/memory/4244-70-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp	xmrig
behavioral2/memory/1488-2748-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp	xmrig
behavioral2/memory/1448-2760-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	xmrig
behavioral2/memory/1448-2766-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	xmrig
behavioral2/memory/2464-2770-0x00007FF724850000-0x00007FF724C42000-memory.dmp	xmrig
behavioral2/memory/2264-2769-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp	xmrig
behavioral2/memory/3992-2776-0x00007FF653020000-0x00007FF653412000-memory.dmp	xmrig
behavioral2/memory/3432-2778-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp	xmrig
behavioral2/memory/3968-2774-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp	xmrig
behavioral2/memory/4244-2773-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp	xmrig
behavioral2/memory/1176-2787-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp	xmrig
behavioral2/memory/1500-2790-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp	xmrig
behavioral2/memory/456-2792-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp	xmrig
behavioral2/memory/4632-2802-0x00007FF718870000-0x00007FF718C62000-memory.dmp	xmrig
behavioral2/memory/3564-2800-0x00007FF747470000-0x00007FF747862000-memory.dmp	xmrig
behavioral2/memory/3160-2796-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp	xmrig
behavioral2/memory/5004-2788-0x00007FF659880000-0x00007FF659C72000-memory.dmp	xmrig
behavioral2/memory/2144-2785-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp	xmrig
behavioral2/memory/2560-2783-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp	xmrig
behavioral2/memory/808-2781-0x00007FF764600000-0x00007FF7649F2000-memory.dmp	xmrig
behavioral2/memory/4004-2818-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp	xmrig
behavioral2/memory/1388-2814-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp	xmrig
behavioral2/memory/1912-2810-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp	xmrig
behavioral2/memory/4392-2809-0x00007FF662760000-0x00007FF662B52000-memory.dmp	xmrig
behavioral2/memory/1772-2817-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp	xmrig
behavioral2/memory/2512-2813-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp	xmrig
behavioral2/memory/1372-2806-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

10 1588 powershell.exe
12 1588 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1588 powershell.exe

flow	pid	process
10	1588	powershell.exe
12	1588	powershell.exe

pid	process
1588	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

mPwMbXS.exeYLWwwJh.exePhdjnIF.exewlGPxho.exeXltZrLH.exeJBzuxOT.exeAoXDPLJ.exeJKSaWdU.exeMJvhwPG.exeYCqmKKH.exeXozXZGy.exevQoqsLx.execUBpDWq.exeCpnqRKU.exeJhJZryC.exekyDOnvt.exeFzPxsNQ.exeKHbbkQi.exeruXDCUN.exeLLSeDXl.exeGsxlstI.exeaJyyNlY.exewhaMVIT.exeAdGVmFR.exeqrSaZgQ.exeiZEdpQi.exeHzqdzIZ.execXVKlFk.exeQcQynjJ.exenONkfmh.exeMxDBSof.exeIrVHgak.exeKiJMIgz.exeXFaEnmJ.exeAcgIUFg.exegqgpFQq.exelzMHFpZ.exeoGPfoyq.exediJgaYv.execlcilUZ.exeIiJJYqZ.exemxstCZD.exeTvRyuVh.exepcDgrfL.exekjgCqDS.exeEZUwAqF.exesKCUHbI.exeIuvxNaT.exetLRrXsP.exeIHxmBGC.exezdALgHy.exeFyWyqUJ.exeGbubQKZ.exeBTncAIx.exelXVFvmn.exeuzywXBd.exeQlvsWKc.exeywSnGBE.exeRGhjNxu.exeYQHOJcm.exefipFTlk.exeJFTvJjo.exeHjxuJcn.exebHieTUg.exe

pid	process
1448	mPwMbXS.exe
2264	YLWwwJh.exe
4244	PhdjnIF.exe
3992	wlGPxho.exe
2464	XltZrLH.exe
3968	JBzuxOT.exe
3432	AoXDPLJ.exe
2560	JKSaWdU.exe
808	MJvhwPG.exe
2144	YCqmKKH.exe
1500	XozXZGy.exe
5004	vQoqsLx.exe
1176	cUBpDWq.exe
456	CpnqRKU.exe
3160	JhJZryC.exe
3564	kyDOnvt.exe
4632	FzPxsNQ.exe
1372	KHbbkQi.exe
4392	ruXDCUN.exe
4004	LLSeDXl.exe
1772	GsxlstI.exe
1388	aJyyNlY.exe
2512	whaMVIT.exe
1912	AdGVmFR.exe
2176	qrSaZgQ.exe
3440	iZEdpQi.exe
2984	HzqdzIZ.exe
4452	cXVKlFk.exe
4528	QcQynjJ.exe
4076	nONkfmh.exe
2320	MxDBSof.exe
2332	IrVHgak.exe
3144	KiJMIgz.exe
824	XFaEnmJ.exe
2964	AcgIUFg.exe
4300	gqgpFQq.exe
1484	lzMHFpZ.exe
4136	oGPfoyq.exe
1104	diJgaYv.exe
4436	clcilUZ.exe
3292	IiJJYqZ.exe
1440	mxstCZD.exe
512	TvRyuVh.exe
4364	pcDgrfL.exe
3368	kjgCqDS.exe
4636	EZUwAqF.exe
3504	sKCUHbI.exe
3224	IuvxNaT.exe
3580	tLRrXsP.exe
3920	IHxmBGC.exe
2184	zdALgHy.exe
388	FyWyqUJ.exe
4772	GbubQKZ.exe
3352	BTncAIx.exe
2152	lXVFvmn.exe
4748	uzywXBd.exe
5072	QlvsWKc.exe
4132	ywSnGBE.exe
372	RGhjNxu.exe
4840	YQHOJcm.exe
4320	fipFTlk.exe
3204	JFTvJjo.exe
3092	HjxuJcn.exe
4852	bHieTUg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1488-0-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp	upx
C:\Windows\System\mPwMbXS.exe	upx
C:\Windows\System\YLWwwJh.exe	upx
C:\Windows\System\PhdjnIF.exe	upx
behavioral2/memory/1448-8-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	upx
C:\Windows\System\wlGPxho.exe	upx
C:\Windows\System\XltZrLH.exe	upx
C:\Windows\System\AoXDPLJ.exe	upx
C:\Windows\System\JKSaWdU.exe	upx
C:\Windows\System\YCqmKKH.exe	upx
C:\Windows\System\vQoqsLx.exe	upx
C:\Windows\System\XozXZGy.exe	upx
C:\Windows\System\CpnqRKU.exe	upx
C:\Windows\System\FzPxsNQ.exe	upx
C:\Windows\System\KHbbkQi.exe	upx
C:\Windows\System\LLSeDXl.exe	upx
C:\Windows\System\GsxlstI.exe	upx
C:\Windows\System\AdGVmFR.exe	upx
C:\Windows\System\iZEdpQi.exe	upx
behavioral2/memory/2512-177-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp	upx
C:\Windows\System\KiJMIgz.exe	upx
behavioral2/memory/1912-205-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp	upx
behavioral2/memory/1388-204-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp	upx
C:\Windows\System\MxDBSof.exe	upx
behavioral2/memory/1772-195-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp	upx
C:\Windows\System\IrVHgak.exe	upx
C:\Windows\System\nONkfmh.exe	upx
behavioral2/memory/4004-189-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp	upx
C:\Windows\System\QcQynjJ.exe	upx
behavioral2/memory/4392-183-0x00007FF662760000-0x00007FF662B52000-memory.dmp	upx
C:\Windows\System\cXVKlFk.exe	upx
C:\Windows\System\HzqdzIZ.exe	upx
behavioral2/memory/1372-171-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp	upx
C:\Windows\System\qrSaZgQ.exe	upx
behavioral2/memory/4632-160-0x00007FF718870000-0x00007FF718C62000-memory.dmp	upx
behavioral2/memory/3564-154-0x00007FF747470000-0x00007FF747862000-memory.dmp	upx
C:\Windows\System\whaMVIT.exe	upx
behavioral2/memory/3160-148-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp	upx
C:\Windows\System\aJyyNlY.exe	upx
behavioral2/memory/456-142-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp	upx
behavioral2/memory/1176-136-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp	upx
behavioral2/memory/5004-130-0x00007FF659880000-0x00007FF659C72000-memory.dmp	upx
C:\Windows\System\ruXDCUN.exe	upx
behavioral2/memory/2560-124-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp	upx
behavioral2/memory/2264-113-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp	upx
C:\Windows\System\kyDOnvt.exe	upx
behavioral2/memory/1500-107-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp	upx
C:\Windows\System\JhJZryC.exe	upx
behavioral2/memory/2144-101-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp	upx
behavioral2/memory/808-97-0x00007FF764600000-0x00007FF7649F2000-memory.dmp	upx
C:\Windows\System\cUBpDWq.exe	upx
behavioral2/memory/3432-89-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp	upx
behavioral2/memory/3968-86-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp	upx
behavioral2/memory/2464-82-0x00007FF724850000-0x00007FF724C42000-memory.dmp	upx
behavioral2/memory/3992-75-0x00007FF653020000-0x00007FF653412000-memory.dmp	upx
behavioral2/memory/4244-70-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp	upx
C:\Windows\System\MJvhwPG.exe	upx
C:\Windows\System\JBzuxOT.exe	upx
behavioral2/memory/1488-2748-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp	upx
behavioral2/memory/1448-2760-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	upx
behavioral2/memory/1448-2766-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	upx
behavioral2/memory/2464-2770-0x00007FF724850000-0x00007FF724C42000-memory.dmp	upx
behavioral2/memory/2264-2769-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp	upx
behavioral2/memory/3992-2776-0x00007FF653020000-0x00007FF653412000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

9 raw.githubusercontent.com
10 raw.githubusercontent.com

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\System\hbteSgD.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\FlpPGlQ.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\TmFEEAB.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\UmnzYiU.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\zABZmBU.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\CWVmbXC.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ardRuGW.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ongzYFE.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\CKgHGLy.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ipaYjQH.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GmgVDiw.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\XQmodPK.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\IUzQSiv.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\QNkEdLf.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\VkKfIvB.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\SmifRma.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\gBqGKFm.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\BBqpkct.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\WXsgsqx.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\uFpkgix.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\XVIzaVW.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\VeauHQD.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\lTqlQml.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\TWhFLzn.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\wpIJLmB.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\IlhNVtu.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\NvwsIWC.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\cTlcdQe.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\tXiebcR.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\bnZpjsb.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\mRqHBBT.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DASwPKu.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DvgkQuY.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\EXmCyAO.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\YArzlJF.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\SRhdpaq.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\gCQuZjk.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\iKRyYCk.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GpMhIMn.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\icCAeQm.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\WUDxhId.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZNICscT.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\IpGmPgB.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\dxHGTQw.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\BlfzrtS.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\UDUbBqa.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DSpdrfm.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\XbcXwTL.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\LysRbXH.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\wdJYejm.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\XzOSieY.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\esWiLYZ.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GnwRtcn.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\AXoRsOj.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\xJpEiuA.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\sYifYYu.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\vuSdZgY.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\SQLlTAN.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\sddmxeZ.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\pKUHOlX.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\YAMSFnW.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\PXIinNL.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\FaAWlZn.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\lPRfNVe.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wermgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

wermgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1588 powershell.exe
1588 powershell.exe
1588 powershell.exe

pid	process
1588	powershell.exe
1588	powershell.exe
1588	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1588	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe

description	pid	process	target process
PID 1488 wrote to memory of 1588	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	powershell.exe
PID 1488 wrote to memory of 1588	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	powershell.exe
PID 1488 wrote to memory of 1448	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	mPwMbXS.exe
PID 1488 wrote to memory of 1448	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	mPwMbXS.exe
PID 1488 wrote to memory of 2264	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	YLWwwJh.exe
PID 1488 wrote to memory of 2264	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	YLWwwJh.exe
PID 1488 wrote to memory of 3992	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	wlGPxho.exe
PID 1488 wrote to memory of 3992	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	wlGPxho.exe
PID 1488 wrote to memory of 4244	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	PhdjnIF.exe
PID 1488 wrote to memory of 4244	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	PhdjnIF.exe
PID 1488 wrote to memory of 2464	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	XltZrLH.exe
PID 1488 wrote to memory of 2464	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	XltZrLH.exe
PID 1488 wrote to memory of 3968	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	JBzuxOT.exe
PID 1488 wrote to memory of 3968	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	JBzuxOT.exe
PID 1488 wrote to memory of 3432	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	AoXDPLJ.exe
PID 1488 wrote to memory of 3432	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	AoXDPLJ.exe
PID 1488 wrote to memory of 2560	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	JKSaWdU.exe
PID 1488 wrote to memory of 2560	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	JKSaWdU.exe
PID 1488 wrote to memory of 808	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	MJvhwPG.exe
PID 1488 wrote to memory of 808	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	MJvhwPG.exe
PID 1488 wrote to memory of 2144	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	YCqmKKH.exe
PID 1488 wrote to memory of 2144	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	YCqmKKH.exe
PID 1488 wrote to memory of 1500	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	XozXZGy.exe
PID 1488 wrote to memory of 1500	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	XozXZGy.exe
PID 1488 wrote to memory of 5004	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	vQoqsLx.exe
PID 1488 wrote to memory of 5004	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	vQoqsLx.exe
PID 1488 wrote to memory of 1176	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	cUBpDWq.exe
PID 1488 wrote to memory of 1176	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	cUBpDWq.exe
PID 1488 wrote to memory of 456	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	CpnqRKU.exe
PID 1488 wrote to memory of 456	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	CpnqRKU.exe
PID 1488 wrote to memory of 3160	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	JhJZryC.exe
PID 1488 wrote to memory of 3160	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	JhJZryC.exe
PID 1488 wrote to memory of 3564	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	kyDOnvt.exe
PID 1488 wrote to memory of 3564	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	kyDOnvt.exe
PID 1488 wrote to memory of 4632	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	FzPxsNQ.exe
PID 1488 wrote to memory of 4632	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	FzPxsNQ.exe
PID 1488 wrote to memory of 1372	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	KHbbkQi.exe
PID 1488 wrote to memory of 1372	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	KHbbkQi.exe
PID 1488 wrote to memory of 4392	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	ruXDCUN.exe
PID 1488 wrote to memory of 4392	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	ruXDCUN.exe
PID 1488 wrote to memory of 4004	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	LLSeDXl.exe
PID 1488 wrote to memory of 4004	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	LLSeDXl.exe
PID 1488 wrote to memory of 1772	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	GsxlstI.exe
PID 1488 wrote to memory of 1772	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	GsxlstI.exe
PID 1488 wrote to memory of 1388	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	aJyyNlY.exe
PID 1488 wrote to memory of 1388	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	aJyyNlY.exe
PID 1488 wrote to memory of 2512	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	whaMVIT.exe
PID 1488 wrote to memory of 2512	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	whaMVIT.exe
PID 1488 wrote to memory of 1912	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	AdGVmFR.exe
PID 1488 wrote to memory of 1912	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	AdGVmFR.exe
PID 1488 wrote to memory of 2176	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	qrSaZgQ.exe
PID 1488 wrote to memory of 2176	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	qrSaZgQ.exe
PID 1488 wrote to memory of 3440	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	iZEdpQi.exe
PID 1488 wrote to memory of 3440	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	iZEdpQi.exe
PID 1488 wrote to memory of 2984	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	HzqdzIZ.exe
PID 1488 wrote to memory of 2984	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	HzqdzIZ.exe
PID 1488 wrote to memory of 4452	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	cXVKlFk.exe
PID 1488 wrote to memory of 4452	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	cXVKlFk.exe
PID 1488 wrote to memory of 4528	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	QcQynjJ.exe
PID 1488 wrote to memory of 4528	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	QcQynjJ.exe
PID 1488 wrote to memory of 4076	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	nONkfmh.exe
PID 1488 wrote to memory of 4076	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	nONkfmh.exe
PID 1488 wrote to memory of 2320	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	MxDBSof.exe
PID 1488 wrote to memory of 2320	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	MxDBSof.exe

C:\Users\Admin\AppData\Local\Temp\4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1588" "3008" "2940" "3012" "0" "0" "3016" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13008
- C:\Windows\System\mPwMbXS.exe
  C:\Windows\System\mPwMbXS.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\YLWwwJh.exe
  C:\Windows\System\YLWwwJh.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\wlGPxho.exe
  C:\Windows\System\wlGPxho.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\PhdjnIF.exe
  C:\Windows\System\PhdjnIF.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\XltZrLH.exe
  C:\Windows\System\XltZrLH.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\JBzuxOT.exe
  C:\Windows\System\JBzuxOT.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\AoXDPLJ.exe
  C:\Windows\System\AoXDPLJ.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\JKSaWdU.exe
  C:\Windows\System\JKSaWdU.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\MJvhwPG.exe
  C:\Windows\System\MJvhwPG.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\YCqmKKH.exe
  C:\Windows\System\YCqmKKH.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\XozXZGy.exe
  C:\Windows\System\XozXZGy.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\vQoqsLx.exe
  C:\Windows\System\vQoqsLx.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\cUBpDWq.exe
  C:\Windows\System\cUBpDWq.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\CpnqRKU.exe
  C:\Windows\System\CpnqRKU.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\JhJZryC.exe
  C:\Windows\System\JhJZryC.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\kyDOnvt.exe
  C:\Windows\System\kyDOnvt.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\FzPxsNQ.exe
  C:\Windows\System\FzPxsNQ.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\KHbbkQi.exe
  C:\Windows\System\KHbbkQi.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ruXDCUN.exe
  C:\Windows\System\ruXDCUN.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\LLSeDXl.exe
  C:\Windows\System\LLSeDXl.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\GsxlstI.exe
  C:\Windows\System\GsxlstI.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\aJyyNlY.exe
  C:\Windows\System\aJyyNlY.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\whaMVIT.exe
  C:\Windows\System\whaMVIT.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\AdGVmFR.exe
  C:\Windows\System\AdGVmFR.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\qrSaZgQ.exe
  C:\Windows\System\qrSaZgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\iZEdpQi.exe
  C:\Windows\System\iZEdpQi.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\HzqdzIZ.exe
  C:\Windows\System\HzqdzIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\cXVKlFk.exe
  C:\Windows\System\cXVKlFk.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\QcQynjJ.exe
  C:\Windows\System\QcQynjJ.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\nONkfmh.exe
  C:\Windows\System\nONkfmh.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\MxDBSof.exe
  C:\Windows\System\MxDBSof.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\IrVHgak.exe
  C:\Windows\System\IrVHgak.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\KiJMIgz.exe
  C:\Windows\System\KiJMIgz.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\XFaEnmJ.exe
  C:\Windows\System\XFaEnmJ.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\AcgIUFg.exe
  C:\Windows\System\AcgIUFg.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\gqgpFQq.exe
  C:\Windows\System\gqgpFQq.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\lzMHFpZ.exe
  C:\Windows\System\lzMHFpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\oGPfoyq.exe
  C:\Windows\System\oGPfoyq.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\diJgaYv.exe
  C:\Windows\System\diJgaYv.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\clcilUZ.exe
  C:\Windows\System\clcilUZ.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\IiJJYqZ.exe
  C:\Windows\System\IiJJYqZ.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\mxstCZD.exe
  C:\Windows\System\mxstCZD.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\TvRyuVh.exe
  C:\Windows\System\TvRyuVh.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\pcDgrfL.exe
  C:\Windows\System\pcDgrfL.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\kjgCqDS.exe
  C:\Windows\System\kjgCqDS.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\EZUwAqF.exe
  C:\Windows\System\EZUwAqF.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\sKCUHbI.exe
  C:\Windows\System\sKCUHbI.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\IuvxNaT.exe
  C:\Windows\System\IuvxNaT.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\tLRrXsP.exe
  C:\Windows\System\tLRrXsP.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\IHxmBGC.exe
  C:\Windows\System\IHxmBGC.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\zdALgHy.exe
  C:\Windows\System\zdALgHy.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\FyWyqUJ.exe
  C:\Windows\System\FyWyqUJ.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\GbubQKZ.exe
  C:\Windows\System\GbubQKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\BTncAIx.exe
  C:\Windows\System\BTncAIx.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\lXVFvmn.exe
  C:\Windows\System\lXVFvmn.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\uzywXBd.exe
  C:\Windows\System\uzywXBd.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\QlvsWKc.exe
  C:\Windows\System\QlvsWKc.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\ywSnGBE.exe
  C:\Windows\System\ywSnGBE.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\RGhjNxu.exe
  C:\Windows\System\RGhjNxu.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\YQHOJcm.exe
  C:\Windows\System\YQHOJcm.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\fipFTlk.exe
  C:\Windows\System\fipFTlk.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\JFTvJjo.exe
  C:\Windows\System\JFTvJjo.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\HjxuJcn.exe
  C:\Windows\System\HjxuJcn.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\bHieTUg.exe
  C:\Windows\System\bHieTUg.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\ycsgPQZ.exe
  C:\Windows\System\ycsgPQZ.exe
  2⤵
  PID:3904
- C:\Windows\System\FGrSXzJ.exe
  C:\Windows\System\FGrSXzJ.exe
  2⤵
  PID:3104
- C:\Windows\System\QHzKcxw.exe
  C:\Windows\System\QHzKcxw.exe
  2⤵
  PID:4800
- C:\Windows\System\hepjngo.exe
  C:\Windows\System\hepjngo.exe
  2⤵
  PID:4536
- C:\Windows\System\oEQVDld.exe
  C:\Windows\System\oEQVDld.exe
  2⤵
  PID:1944
- C:\Windows\System\EztYTWO.exe
  C:\Windows\System\EztYTWO.exe
  2⤵
  PID:412
- C:\Windows\System\RPAtzXV.exe
  C:\Windows\System\RPAtzXV.exe
  2⤵
  PID:5156
- C:\Windows\System\gFhtYdX.exe
  C:\Windows\System\gFhtYdX.exe
  2⤵
  PID:5180
- C:\Windows\System\JOCmIBy.exe
  C:\Windows\System\JOCmIBy.exe
  2⤵
  PID:5208
- C:\Windows\System\NNfLNcR.exe
  C:\Windows\System\NNfLNcR.exe
  2⤵
  PID:5240
- C:\Windows\System\ylwxnfk.exe
  C:\Windows\System\ylwxnfk.exe
  2⤵
  PID:5268
- C:\Windows\System\mtIZPCd.exe
  C:\Windows\System\mtIZPCd.exe
  2⤵
  PID:5300
- C:\Windows\System\DpQXtQx.exe
  C:\Windows\System\DpQXtQx.exe
  2⤵
  PID:5328
- C:\Windows\System\UtMsaaT.exe
  C:\Windows\System\UtMsaaT.exe
  2⤵
  PID:5364
- C:\Windows\System\pYAKgBN.exe
  C:\Windows\System\pYAKgBN.exe
  2⤵
  PID:5388
- C:\Windows\System\BWdSxSw.exe
  C:\Windows\System\BWdSxSw.exe
  2⤵
  PID:5420
- C:\Windows\System\DJanQyV.exe
  C:\Windows\System\DJanQyV.exe
  2⤵
  PID:5444
- C:\Windows\System\TOawqPL.exe
  C:\Windows\System\TOawqPL.exe
  2⤵
  PID:5464
- C:\Windows\System\tjgSNvA.exe
  C:\Windows\System\tjgSNvA.exe
  2⤵
  PID:5492
- C:\Windows\System\JCQFBqA.exe
  C:\Windows\System\JCQFBqA.exe
  2⤵
  PID:5520
- C:\Windows\System\WOFaiku.exe
  C:\Windows\System\WOFaiku.exe
  2⤵
  PID:5544
- C:\Windows\System\eagtHiJ.exe
  C:\Windows\System\eagtHiJ.exe
  2⤵
  PID:5576
- C:\Windows\System\fpEwhmC.exe
  C:\Windows\System\fpEwhmC.exe
  2⤵
  PID:5600
- C:\Windows\System\TAvjqml.exe
  C:\Windows\System\TAvjqml.exe
  2⤵
  PID:5632
- C:\Windows\System\RIuKaXn.exe
  C:\Windows\System\RIuKaXn.exe
  2⤵
  PID:5656
- C:\Windows\System\YaEArIN.exe
  C:\Windows\System\YaEArIN.exe
  2⤵
  PID:5692
- C:\Windows\System\zqaWULQ.exe
  C:\Windows\System\zqaWULQ.exe
  2⤵
  PID:5720
- C:\Windows\System\FZNvZlu.exe
  C:\Windows\System\FZNvZlu.exe
  2⤵
  PID:5748
- C:\Windows\System\HdEWOKI.exe
  C:\Windows\System\HdEWOKI.exe
  2⤵
  PID:5776
- C:\Windows\System\brfBQfH.exe
  C:\Windows\System\brfBQfH.exe
  2⤵
  PID:5800
- C:\Windows\System\dAZArkc.exe
  C:\Windows\System\dAZArkc.exe
  2⤵
  PID:5828
- C:\Windows\System\zpMtzJG.exe
  C:\Windows\System\zpMtzJG.exe
  2⤵
  PID:5856
- C:\Windows\System\zutRaoY.exe
  C:\Windows\System\zutRaoY.exe
  2⤵
  PID:5888
- C:\Windows\System\mSJdZFY.exe
  C:\Windows\System\mSJdZFY.exe
  2⤵
  PID:5912
- C:\Windows\System\GqHtmCz.exe
  C:\Windows\System\GqHtmCz.exe
  2⤵
  PID:5944
- C:\Windows\System\TitZLIP.exe
  C:\Windows\System\TitZLIP.exe
  2⤵
  PID:5968
- C:\Windows\System\dLInydY.exe
  C:\Windows\System\dLInydY.exe
  2⤵
  PID:5996
- C:\Windows\System\fGSJYpT.exe
  C:\Windows\System\fGSJYpT.exe
  2⤵
  PID:6028
- C:\Windows\System\hlxxZpX.exe
  C:\Windows\System\hlxxZpX.exe
  2⤵
  PID:6056
- C:\Windows\System\dnmXOMH.exe
  C:\Windows\System\dnmXOMH.exe
  2⤵
  PID:6080
- C:\Windows\System\vaPZoRR.exe
  C:\Windows\System\vaPZoRR.exe
  2⤵
  PID:6108
- C:\Windows\System\bBdSVBj.exe
  C:\Windows\System\bBdSVBj.exe
  2⤵
  PID:6140
- C:\Windows\System\WKrUwAk.exe
  C:\Windows\System\WKrUwAk.exe
  2⤵
  PID:3324
- C:\Windows\System\uFOVWvS.exe
  C:\Windows\System\uFOVWvS.exe
  2⤵
  PID:688
- C:\Windows\System\dfpqmZo.exe
  C:\Windows\System\dfpqmZo.exe
  2⤵
  PID:2228
- C:\Windows\System\ZYUdgfY.exe
  C:\Windows\System\ZYUdgfY.exe
  2⤵
  PID:1968
- C:\Windows\System\IPGeeFV.exe
  C:\Windows\System\IPGeeFV.exe
  2⤵
  PID:5148
- C:\Windows\System\NCENQvL.exe
  C:\Windows\System\NCENQvL.exe
  2⤵
  PID:5200
- C:\Windows\System\nfpJNZO.exe
  C:\Windows\System\nfpJNZO.exe
  2⤵
  PID:5260
- C:\Windows\System\zeWwCah.exe
  C:\Windows\System\zeWwCah.exe
  2⤵
  PID:5324
- C:\Windows\System\XCLUqaw.exe
  C:\Windows\System\XCLUqaw.exe
  2⤵
  PID:4184
- C:\Windows\System\LHuuFqr.exe
  C:\Windows\System\LHuuFqr.exe
  2⤵
  PID:5456
- C:\Windows\System\pHbsqSQ.exe
  C:\Windows\System\pHbsqSQ.exe
  2⤵
  PID:5512
- C:\Windows\System\qPKZjhJ.exe
  C:\Windows\System\qPKZjhJ.exe
  2⤵
  PID:5568
- C:\Windows\System\TvKYLWP.exe
  C:\Windows\System\TvKYLWP.exe
  2⤵
  PID:5644
- C:\Windows\System\DtCnqLE.exe
  C:\Windows\System\DtCnqLE.exe
  2⤵
  PID:5712
- C:\Windows\System\xLGHfbv.exe
  C:\Windows\System\xLGHfbv.exe
  2⤵
  PID:3100
- C:\Windows\System\veHeErR.exe
  C:\Windows\System\veHeErR.exe
  2⤵
  PID:5820
- C:\Windows\System\MmikuHb.exe
  C:\Windows\System\MmikuHb.exe
  2⤵
  PID:5880
- C:\Windows\System\cvqyNGg.exe
  C:\Windows\System\cvqyNGg.exe
  2⤵
  PID:5932
- C:\Windows\System\IKjfVEq.exe
  C:\Windows\System\IKjfVEq.exe
  2⤵
  PID:5984
- C:\Windows\System\sComCGa.exe
  C:\Windows\System\sComCGa.exe
  2⤵
  PID:6048
- C:\Windows\System\stMNnva.exe
  C:\Windows\System\stMNnva.exe
  2⤵
  PID:6124
- C:\Windows\System\KfFjPdP.exe
  C:\Windows\System\KfFjPdP.exe
  2⤵
  PID:1892
- C:\Windows\System\IrFibzg.exe
  C:\Windows\System\IrFibzg.exe
  2⤵
  PID:3012
- C:\Windows\System\KicMMnr.exe
  C:\Windows\System\KicMMnr.exe
  2⤵
  PID:5248
- C:\Windows\System\DwQZpSe.exe
  C:\Windows\System\DwQZpSe.exe
  2⤵
  PID:5380
- C:\Windows\System\ZEEMPTX.exe
  C:\Windows\System\ZEEMPTX.exe
  2⤵
  PID:5504
- C:\Windows\System\kpMZhMi.exe
  C:\Windows\System\kpMZhMi.exe
  2⤵
  PID:468
- C:\Windows\System\HFKbocR.exe
  C:\Windows\System\HFKbocR.exe
  2⤵
  PID:1080
- C:\Windows\System\kusQtud.exe
  C:\Windows\System\kusQtud.exe
  2⤵
  PID:5852
- C:\Windows\System\TyJcvFh.exe
  C:\Windows\System\TyJcvFh.exe
  2⤵
  PID:1852
- C:\Windows\System\vjTpbla.exe
  C:\Windows\System\vjTpbla.exe
  2⤵
  PID:6040
- C:\Windows\System\lHRLMDl.exe
  C:\Windows\System\lHRLMDl.exe
  2⤵
  PID:1576
- C:\Windows\System\YdeDuIf.exe
  C:\Windows\System\YdeDuIf.exe
  2⤵
  PID:2524
- C:\Windows\System\WrWxOLE.exe
  C:\Windows\System\WrWxOLE.exe
  2⤵
  PID:2676
- C:\Windows\System\GsjVonq.exe
  C:\Windows\System\GsjVonq.exe
  2⤵
  PID:5616
- C:\Windows\System\PpPclJS.exe
  C:\Windows\System\PpPclJS.exe
  2⤵
  PID:5032
- C:\Windows\System\yAZhYzo.exe
  C:\Windows\System\yAZhYzo.exe
  2⤵
  PID:4028
- C:\Windows\System\oHSuwdi.exe
  C:\Windows\System\oHSuwdi.exe
  2⤵
  PID:1124
- C:\Windows\System\Brkyglm.exe
  C:\Windows\System\Brkyglm.exe
  2⤵
  PID:3752
- C:\Windows\System\DTxodoJ.exe
  C:\Windows\System\DTxodoJ.exe
  2⤵
  PID:540
- C:\Windows\System\aqhZarB.exe
  C:\Windows\System\aqhZarB.exe
  2⤵
  PID:6156
- C:\Windows\System\QqQFLHo.exe
  C:\Windows\System\QqQFLHo.exe
  2⤵
  PID:6180
- C:\Windows\System\RwarMii.exe
  C:\Windows\System\RwarMii.exe
  2⤵
  PID:6212
- C:\Windows\System\LFAegtn.exe
  C:\Windows\System\LFAegtn.exe
  2⤵
  PID:6236
- C:\Windows\System\gtMxhqp.exe
  C:\Windows\System\gtMxhqp.exe
  2⤵
  PID:6264
- C:\Windows\System\mqZbjkP.exe
  C:\Windows\System\mqZbjkP.exe
  2⤵
  PID:6296
- C:\Windows\System\ZjDHGVq.exe
  C:\Windows\System\ZjDHGVq.exe
  2⤵
  PID:6324
- C:\Windows\System\wZFDiBD.exe
  C:\Windows\System\wZFDiBD.exe
  2⤵
  PID:6352
- C:\Windows\System\WDLnnvK.exe
  C:\Windows\System\WDLnnvK.exe
  2⤵
  PID:6376
- C:\Windows\System\bUDGlQJ.exe
  C:\Windows\System\bUDGlQJ.exe
  2⤵
  PID:6408
- C:\Windows\System\dNFunpO.exe
  C:\Windows\System\dNFunpO.exe
  2⤵
  PID:6436
- C:\Windows\System\JYbzpgt.exe
  C:\Windows\System\JYbzpgt.exe
  2⤵
  PID:6464
- C:\Windows\System\DAGcjSl.exe
  C:\Windows\System\DAGcjSl.exe
  2⤵
  PID:6492
- C:\Windows\System\SPOSgRv.exe
  C:\Windows\System\SPOSgRv.exe
  2⤵
  PID:6520
- C:\Windows\System\xHYrTeZ.exe
  C:\Windows\System\xHYrTeZ.exe
  2⤵
  PID:6548
- C:\Windows\System\IqQhcMd.exe
  C:\Windows\System\IqQhcMd.exe
  2⤵
  PID:6576
- C:\Windows\System\neyGJzA.exe
  C:\Windows\System\neyGJzA.exe
  2⤵
  PID:6604
- C:\Windows\System\MpNXJWM.exe
  C:\Windows\System\MpNXJWM.exe
  2⤵
  PID:6628
- C:\Windows\System\hCwPIGO.exe
  C:\Windows\System\hCwPIGO.exe
  2⤵
  PID:6660
- C:\Windows\System\AvcuiTs.exe
  C:\Windows\System\AvcuiTs.exe
  2⤵
  PID:6688
- C:\Windows\System\ekEfrpQ.exe
  C:\Windows\System\ekEfrpQ.exe
  2⤵
  PID:6712
- C:\Windows\System\ucHonFs.exe
  C:\Windows\System\ucHonFs.exe
  2⤵
  PID:6740
- C:\Windows\System\cEjXvOR.exe
  C:\Windows\System\cEjXvOR.exe
  2⤵
  PID:6772
- C:\Windows\System\qZrdamE.exe
  C:\Windows\System\qZrdamE.exe
  2⤵
  PID:6796
- C:\Windows\System\sedWcIt.exe
  C:\Windows\System\sedWcIt.exe
  2⤵
  PID:6828
- C:\Windows\System\wvbEYWK.exe
  C:\Windows\System\wvbEYWK.exe
  2⤵
  PID:6852
- C:\Windows\System\ZpeGTww.exe
  C:\Windows\System\ZpeGTww.exe
  2⤵
  PID:6880
- C:\Windows\System\jdyofTD.exe
  C:\Windows\System\jdyofTD.exe
  2⤵
  PID:6916
- C:\Windows\System\uytmIOq.exe
  C:\Windows\System\uytmIOq.exe
  2⤵
  PID:6940
- C:\Windows\System\UdOhrAh.exe
  C:\Windows\System\UdOhrAh.exe
  2⤵
  PID:6968
- C:\Windows\System\SQLlTAN.exe
  C:\Windows\System\SQLlTAN.exe
  2⤵
  PID:6996
- C:\Windows\System\oSzevzD.exe
  C:\Windows\System\oSzevzD.exe
  2⤵
  PID:7020
- C:\Windows\System\JBnsduo.exe
  C:\Windows\System\JBnsduo.exe
  2⤵
  PID:7052
- C:\Windows\System\fVnjsHg.exe
  C:\Windows\System\fVnjsHg.exe
  2⤵
  PID:7076
- C:\Windows\System\klbklrJ.exe
  C:\Windows\System\klbklrJ.exe
  2⤵
  PID:7108
- C:\Windows\System\rAraJjY.exe
  C:\Windows\System\rAraJjY.exe
  2⤵
  PID:7132
- C:\Windows\System\WraIiDq.exe
  C:\Windows\System\WraIiDq.exe
  2⤵
  PID:7160
- C:\Windows\System\rndJBlK.exe
  C:\Windows\System\rndJBlK.exe
  2⤵
  PID:1620
- C:\Windows\System\ApebDiK.exe
  C:\Windows\System\ApebDiK.exe
  2⤵
  PID:2428
- C:\Windows\System\DvgkQuY.exe
  C:\Windows\System\DvgkQuY.exe
  2⤵
  PID:4308
- C:\Windows\System\rJWQlRR.exe
  C:\Windows\System\rJWQlRR.exe
  2⤵
  PID:6172
- C:\Windows\System\EmcTACj.exe
  C:\Windows\System\EmcTACj.exe
  2⤵
  PID:6228
- C:\Windows\System\gVWkFwz.exe
  C:\Windows\System\gVWkFwz.exe
  2⤵
  PID:6284
- C:\Windows\System\IcnfCQE.exe
  C:\Windows\System\IcnfCQE.exe
  2⤵
  PID:6364
- C:\Windows\System\ffSexdp.exe
  C:\Windows\System\ffSexdp.exe
  2⤵
  PID:6424
- C:\Windows\System\QSEwhbN.exe
  C:\Windows\System\QSEwhbN.exe
  2⤵
  PID:6484
- C:\Windows\System\SCddqhz.exe
  C:\Windows\System\SCddqhz.exe
  2⤵
  PID:6560
- C:\Windows\System\NWhuyqj.exe
  C:\Windows\System\NWhuyqj.exe
  2⤵
  PID:6620
- C:\Windows\System\RcGfPcK.exe
  C:\Windows\System\RcGfPcK.exe
  2⤵
  PID:6676
- C:\Windows\System\WehPNYi.exe
  C:\Windows\System\WehPNYi.exe
  2⤵
  PID:6736
- C:\Windows\System\QGvofvp.exe
  C:\Windows\System\QGvofvp.exe
  2⤵
  PID:6812
- C:\Windows\System\EwBgkaY.exe
  C:\Windows\System\EwBgkaY.exe
  2⤵
  PID:6872
- C:\Windows\System\DdapfPK.exe
  C:\Windows\System\DdapfPK.exe
  2⤵
  PID:6936
- C:\Windows\System\VuNrjDR.exe
  C:\Windows\System\VuNrjDR.exe
  2⤵
  PID:7008
- C:\Windows\System\KxSuOIK.exe
  C:\Windows\System\KxSuOIK.exe
  2⤵
  PID:7124
- C:\Windows\System\sjXGlSz.exe
  C:\Windows\System\sjXGlSz.exe
  2⤵
  PID:4660
- C:\Windows\System\GfHQuPx.exe
  C:\Windows\System\GfHQuPx.exe
  2⤵
  PID:4940
- C:\Windows\System\rOZPUjA.exe
  C:\Windows\System\rOZPUjA.exe
  2⤵
  PID:6280
- C:\Windows\System\jGqjXSC.exe
  C:\Windows\System\jGqjXSC.exe
  2⤵
  PID:6400
- C:\Windows\System\DxcpUCh.exe
  C:\Windows\System\DxcpUCh.exe
  2⤵
  PID:6588
- C:\Windows\System\UgVZUPf.exe
  C:\Windows\System\UgVZUPf.exe
  2⤵
  PID:6652
- C:\Windows\System\zIIepZB.exe
  C:\Windows\System\zIIepZB.exe
  2⤵
  PID:6728
- C:\Windows\System\diTCKQn.exe
  C:\Windows\System\diTCKQn.exe
  2⤵
  PID:6840
- C:\Windows\System\GDhIBBy.exe
  C:\Windows\System\GDhIBBy.exe
  2⤵
  PID:6980
- C:\Windows\System\CJbfAAI.exe
  C:\Windows\System\CJbfAAI.exe
  2⤵
  PID:2300
- C:\Windows\System\ZqiAfzX.exe
  C:\Windows\System\ZqiAfzX.exe
  2⤵
  PID:904
- C:\Windows\System\zAvXYqI.exe
  C:\Windows\System\zAvXYqI.exe
  2⤵
  PID:5376
- C:\Windows\System\xsjlATo.exe
  C:\Windows\System\xsjlATo.exe
  2⤵
  PID:3552
- C:\Windows\System\quPFTVJ.exe
  C:\Windows\System\quPFTVJ.exe
  2⤵
  PID:6340
- C:\Windows\System\kTPEFqQ.exe
  C:\Windows\System\kTPEFqQ.exe
  2⤵
  PID:6708
- C:\Windows\System\KeDKxyB.exe
  C:\Windows\System\KeDKxyB.exe
  2⤵
  PID:740
- C:\Windows\System\csqZGWb.exe
  C:\Windows\System\csqZGWb.exe
  2⤵
  PID:7068
- C:\Windows\System\wPkQKfd.exe
  C:\Windows\System\wPkQKfd.exe
  2⤵
  PID:3864
- C:\Windows\System\bcQiziT.exe
  C:\Windows\System\bcQiziT.exe
  2⤵
  PID:7180
- C:\Windows\System\bsudNtm.exe
  C:\Windows\System\bsudNtm.exe
  2⤵
  PID:7212
- C:\Windows\System\jWNvwrI.exe
  C:\Windows\System\jWNvwrI.exe
  2⤵
  PID:7228
- C:\Windows\System\jVBtqIy.exe
  C:\Windows\System\jVBtqIy.exe
  2⤵
  PID:7244
- C:\Windows\System\YntCCdi.exe
  C:\Windows\System\YntCCdi.exe
  2⤵
  PID:7264
- C:\Windows\System\sYJbInO.exe
  C:\Windows\System\sYJbInO.exe
  2⤵
  PID:7284
- C:\Windows\System\FFbpFcc.exe
  C:\Windows\System\FFbpFcc.exe
  2⤵
  PID:7304
- C:\Windows\System\ChCiVoA.exe
  C:\Windows\System\ChCiVoA.exe
  2⤵
  PID:7348
- C:\Windows\System\xejHpOO.exe
  C:\Windows\System\xejHpOO.exe
  2⤵
  PID:7376
- C:\Windows\System\MUfSTsO.exe
  C:\Windows\System\MUfSTsO.exe
  2⤵
  PID:7396
- C:\Windows\System\xUQAssy.exe
  C:\Windows\System\xUQAssy.exe
  2⤵
  PID:7452
- C:\Windows\System\QElzIwc.exe
  C:\Windows\System\QElzIwc.exe
  2⤵
  PID:7484
- C:\Windows\System\xDpESqD.exe
  C:\Windows\System\xDpESqD.exe
  2⤵
  PID:7520
- C:\Windows\System\JyVvpGR.exe
  C:\Windows\System\JyVvpGR.exe
  2⤵
  PID:7540
- C:\Windows\System\NjFZrXD.exe
  C:\Windows\System\NjFZrXD.exe
  2⤵
  PID:7560
- C:\Windows\System\NySjxsw.exe
  C:\Windows\System\NySjxsw.exe
  2⤵
  PID:7588
- C:\Windows\System\kympmbm.exe
  C:\Windows\System\kympmbm.exe
  2⤵
  PID:7636
- C:\Windows\System\oevlRMz.exe
  C:\Windows\System\oevlRMz.exe
  2⤵
  PID:7672
- C:\Windows\System\ZGaYJSu.exe
  C:\Windows\System\ZGaYJSu.exe
  2⤵
  PID:7692
- C:\Windows\System\lodvFGH.exe
  C:\Windows\System\lodvFGH.exe
  2⤵
  PID:7708
- C:\Windows\System\HPoBFDR.exe
  C:\Windows\System\HPoBFDR.exe
  2⤵
  PID:7736
- C:\Windows\System\TlbeHis.exe
  C:\Windows\System\TlbeHis.exe
  2⤵
  PID:7752
- C:\Windows\System\xSBwysj.exe
  C:\Windows\System\xSBwysj.exe
  2⤵
  PID:7776
- C:\Windows\System\neSEuTC.exe
  C:\Windows\System\neSEuTC.exe
  2⤵
  PID:7796
- C:\Windows\System\EweHGWR.exe
  C:\Windows\System\EweHGWR.exe
  2⤵
  PID:7816
- C:\Windows\System\abEExlg.exe
  C:\Windows\System\abEExlg.exe
  2⤵
  PID:7836
- C:\Windows\System\GpXSTND.exe
  C:\Windows\System\GpXSTND.exe
  2⤵
  PID:7868
- C:\Windows\System\PUbjcUW.exe
  C:\Windows\System\PUbjcUW.exe
  2⤵
  PID:7892
- C:\Windows\System\nWlfWvR.exe
  C:\Windows\System\nWlfWvR.exe
  2⤵
  PID:7956
- C:\Windows\System\QohRewh.exe
  C:\Windows\System\QohRewh.exe
  2⤵
  PID:7976
- C:\Windows\System\zPhPhiA.exe
  C:\Windows\System\zPhPhiA.exe
  2⤵
  PID:8016
- C:\Windows\System\hyLVdXC.exe
  C:\Windows\System\hyLVdXC.exe
  2⤵
  PID:8044
- C:\Windows\System\eGbGCNy.exe
  C:\Windows\System\eGbGCNy.exe
  2⤵
  PID:8064
- C:\Windows\System\KXBSRZS.exe
  C:\Windows\System\KXBSRZS.exe
  2⤵
  PID:8100
- C:\Windows\System\ZyIaNtr.exe
  C:\Windows\System\ZyIaNtr.exe
  2⤵
  PID:8140
- C:\Windows\System\vumtlKE.exe
  C:\Windows\System\vumtlKE.exe
  2⤵
  PID:8160
- C:\Windows\System\JjPIrKh.exe
  C:\Windows\System\JjPIrKh.exe
  2⤵
  PID:8188
- C:\Windows\System\aVbqQRy.exe
  C:\Windows\System\aVbqQRy.exe
  2⤵
  PID:7172
- C:\Windows\System\vwqEFDN.exe
  C:\Windows\System\vwqEFDN.exe
  2⤵
  PID:7220
- C:\Windows\System\XabpBiF.exe
  C:\Windows\System\XabpBiF.exe
  2⤵
  PID:7240
- C:\Windows\System\xlQYvsS.exe
  C:\Windows\System\xlQYvsS.exe
  2⤵
  PID:7332
- C:\Windows\System\yoDfXnu.exe
  C:\Windows\System\yoDfXnu.exe
  2⤵
  PID:7344
- C:\Windows\System\iTZHjeA.exe
  C:\Windows\System\iTZHjeA.exe
  2⤵
  PID:7476
- C:\Windows\System\wVCUgjn.exe
  C:\Windows\System\wVCUgjn.exe
  2⤵
  PID:7536
- C:\Windows\System\GpMhIMn.exe
  C:\Windows\System\GpMhIMn.exe
  2⤵
  PID:7648
- C:\Windows\System\GPMIYFG.exe
  C:\Windows\System\GPMIYFG.exe
  2⤵
  PID:7688
- C:\Windows\System\CWVVvBH.exe
  C:\Windows\System\CWVVvBH.exe
  2⤵
  PID:7744
- C:\Windows\System\yspurBB.exe
  C:\Windows\System\yspurBB.exe
  2⤵
  PID:7828
- C:\Windows\System\RVTjdGs.exe
  C:\Windows\System\RVTjdGs.exe
  2⤵
  PID:7876
- C:\Windows\System\sbZAohz.exe
  C:\Windows\System\sbZAohz.exe
  2⤵
  PID:7860
- C:\Windows\System\ZTkVKDx.exe
  C:\Windows\System\ZTkVKDx.exe
  2⤵
  PID:7988
- C:\Windows\System\vReDSqH.exe
  C:\Windows\System\vReDSqH.exe
  2⤵
  PID:8008
- C:\Windows\System\WHKVqOW.exe
  C:\Windows\System\WHKVqOW.exe
  2⤵
  PID:8096
- C:\Windows\System\CCQtMZt.exe
  C:\Windows\System\CCQtMZt.exe
  2⤵
  PID:8152
- C:\Windows\System\YysnGCt.exe
  C:\Windows\System\YysnGCt.exe
  2⤵
  PID:6600
- C:\Windows\System\VuchrZV.exe
  C:\Windows\System\VuchrZV.exe
  2⤵
  PID:7300
- C:\Windows\System\qDXcLiX.exe
  C:\Windows\System\qDXcLiX.exe
  2⤵
  PID:7428
- C:\Windows\System\QmkXdiF.exe
  C:\Windows\System\QmkXdiF.exe
  2⤵
  PID:7632
- C:\Windows\System\pYDVTcW.exe
  C:\Windows\System\pYDVTcW.exe
  2⤵
  PID:7968
- C:\Windows\System\pfDyJXw.exe
  C:\Windows\System\pfDyJXw.exe
  2⤵
  PID:8112
- C:\Windows\System\MOIsplW.exe
  C:\Windows\System\MOIsplW.exe
  2⤵
  PID:8168
- C:\Windows\System\MlpfYdk.exe
  C:\Windows\System\MlpfYdk.exe
  2⤵
  PID:7280
- C:\Windows\System\fgLsvUB.exe
  C:\Windows\System\fgLsvUB.exe
  2⤵
  PID:7808
- C:\Windows\System\pJgYPYj.exe
  C:\Windows\System\pJgYPYj.exe
  2⤵
  PID:7916
- C:\Windows\System\fAioRqG.exe
  C:\Windows\System\fAioRqG.exe
  2⤵
  PID:8200
- C:\Windows\System\jNPVVqY.exe
  C:\Windows\System\jNPVVqY.exe
  2⤵
  PID:8220
- C:\Windows\System\HMVFzdG.exe
  C:\Windows\System\HMVFzdG.exe
  2⤵
  PID:8244
- C:\Windows\System\LGSpYLk.exe
  C:\Windows\System\LGSpYLk.exe
  2⤵
  PID:8284
- C:\Windows\System\JCgKReb.exe
  C:\Windows\System\JCgKReb.exe
  2⤵
  PID:8308
- C:\Windows\System\oykdLrs.exe
  C:\Windows\System\oykdLrs.exe
  2⤵
  PID:8324
- C:\Windows\System\taecjdy.exe
  C:\Windows\System\taecjdy.exe
  2⤵
  PID:8344
- C:\Windows\System\BvlRDPm.exe
  C:\Windows\System\BvlRDPm.exe
  2⤵
  PID:8368
- C:\Windows\System\svDsMuP.exe
  C:\Windows\System\svDsMuP.exe
  2⤵
  PID:8400
- C:\Windows\System\ecHJLmM.exe
  C:\Windows\System\ecHJLmM.exe
  2⤵
  PID:8416
- C:\Windows\System\cmarxPf.exe
  C:\Windows\System\cmarxPf.exe
  2⤵
  PID:8436
- C:\Windows\System\jdskdVJ.exe
  C:\Windows\System\jdskdVJ.exe
  2⤵
  PID:8492
- C:\Windows\System\QBTQypo.exe
  C:\Windows\System\QBTQypo.exe
  2⤵
  PID:8516
- C:\Windows\System\MhugiNh.exe
  C:\Windows\System\MhugiNh.exe
  2⤵
  PID:8572
- C:\Windows\System\GnHEJls.exe
  C:\Windows\System\GnHEJls.exe
  2⤵
  PID:8588
- C:\Windows\System\hoEICap.exe
  C:\Windows\System\hoEICap.exe
  2⤵
  PID:8624
- C:\Windows\System\ZujHqvC.exe
  C:\Windows\System\ZujHqvC.exe
  2⤵
  PID:8664
- C:\Windows\System\yiAMBwn.exe
  C:\Windows\System\yiAMBwn.exe
  2⤵
  PID:8692
- C:\Windows\System\RoRWasB.exe
  C:\Windows\System\RoRWasB.exe
  2⤵
  PID:8712
- C:\Windows\System\oQwehYV.exe
  C:\Windows\System\oQwehYV.exe
  2⤵
  PID:8728
- C:\Windows\System\YgmQbqQ.exe
  C:\Windows\System\YgmQbqQ.exe
  2⤵
  PID:8756
- C:\Windows\System\szSRymU.exe
  C:\Windows\System\szSRymU.exe
  2⤵
  PID:8772
- C:\Windows\System\VoiNOqx.exe
  C:\Windows\System\VoiNOqx.exe
  2⤵
  PID:8796
- C:\Windows\System\cbmggJC.exe
  C:\Windows\System\cbmggJC.exe
  2⤵
  PID:8836
- C:\Windows\System\azArsEr.exe
  C:\Windows\System\azArsEr.exe
  2⤵
  PID:8864
- C:\Windows\System\bGBIXzK.exe
  C:\Windows\System\bGBIXzK.exe
  2⤵
  PID:8880
- C:\Windows\System\iDILTBv.exe
  C:\Windows\System\iDILTBv.exe
  2⤵
  PID:8912
- C:\Windows\System\ZqnmJqt.exe
  C:\Windows\System\ZqnmJqt.exe
  2⤵
  PID:8936
- C:\Windows\System\pRpVwzz.exe
  C:\Windows\System\pRpVwzz.exe
  2⤵
  PID:8952
- C:\Windows\System\kMilYEo.exe
  C:\Windows\System\kMilYEo.exe
  2⤵
  PID:8996
- C:\Windows\System\dpqwOmX.exe
  C:\Windows\System\dpqwOmX.exe
  2⤵
  PID:9060
- C:\Windows\System\NassKzo.exe
  C:\Windows\System\NassKzo.exe
  2⤵
  PID:9080
- C:\Windows\System\pjhDUzh.exe
  C:\Windows\System\pjhDUzh.exe
  2⤵
  PID:9100
- C:\Windows\System\NcluzSX.exe
  C:\Windows\System\NcluzSX.exe
  2⤵
  PID:9140
- C:\Windows\System\rhTnLYV.exe
  C:\Windows\System\rhTnLYV.exe
  2⤵
  PID:9160
- C:\Windows\System\YZkxdlk.exe
  C:\Windows\System\YZkxdlk.exe
  2⤵
  PID:9188
- C:\Windows\System\SHqsiRf.exe
  C:\Windows\System\SHqsiRf.exe
  2⤵
  PID:9208
- C:\Windows\System\TRjMRsK.exe
  C:\Windows\System\TRjMRsK.exe
  2⤵
  PID:7260
- C:\Windows\System\hdMFFcO.exe
  C:\Windows\System\hdMFFcO.exe
  2⤵
  PID:8272
- C:\Windows\System\vzJTdMK.exe
  C:\Windows\System\vzJTdMK.exe
  2⤵
  PID:8336
- C:\Windows\System\AUlOsDC.exe
  C:\Windows\System\AUlOsDC.exe
  2⤵
  PID:8364
- C:\Windows\System\gqrOnUJ.exe
  C:\Windows\System\gqrOnUJ.exe
  2⤵
  PID:8480
- C:\Windows\System\ZcBQBgg.exe
  C:\Windows\System\ZcBQBgg.exe
  2⤵
  PID:8472
- C:\Windows\System\uOgAIaL.exe
  C:\Windows\System\uOgAIaL.exe
  2⤵
  PID:8616
- C:\Windows\System\KqsKjXP.exe
  C:\Windows\System\KqsKjXP.exe
  2⤵
  PID:8684
- C:\Windows\System\PuPYsxW.exe
  C:\Windows\System\PuPYsxW.exe
  2⤵
  PID:8700
- C:\Windows\System\DUIIOui.exe
  C:\Windows\System\DUIIOui.exe
  2⤵
  PID:8788
- C:\Windows\System\yHjGulA.exe
  C:\Windows\System\yHjGulA.exe
  2⤵
  PID:8820
- C:\Windows\System\QNkEdLf.exe
  C:\Windows\System\QNkEdLf.exe
  2⤵
  PID:8888
- C:\Windows\System\YiwRqmX.exe
  C:\Windows\System\YiwRqmX.exe
  2⤵
  PID:8988
- C:\Windows\System\PxpyXlA.exe
  C:\Windows\System\PxpyXlA.exe
  2⤵
  PID:9020
- C:\Windows\System\AveDIcG.exe
  C:\Windows\System\AveDIcG.exe
  2⤵
  PID:9116
- C:\Windows\System\vBdAZzu.exe
  C:\Windows\System\vBdAZzu.exe
  2⤵
  PID:9172
- C:\Windows\System\kOMoRRa.exe
  C:\Windows\System\kOMoRRa.exe
  2⤵
  PID:7716
- C:\Windows\System\CvHSlsu.exe
  C:\Windows\System\CvHSlsu.exe
  2⤵
  PID:8476
- C:\Windows\System\jZaePTM.exe
  C:\Windows\System\jZaePTM.exe
  2⤵
  PID:8648
- C:\Windows\System\BZadtvu.exe
  C:\Windows\System\BZadtvu.exe
  2⤵
  PID:8748
- C:\Windows\System\JfRDnyr.exe
  C:\Windows\System\JfRDnyr.exe
  2⤵
  PID:8904
- C:\Windows\System\RkCzpjL.exe
  C:\Windows\System\RkCzpjL.exe
  2⤵
  PID:9016
- C:\Windows\System\RVqAqvk.exe
  C:\Windows\System\RVqAqvk.exe
  2⤵
  PID:9156
- C:\Windows\System\scebZtn.exe
  C:\Windows\System\scebZtn.exe
  2⤵
  PID:8408
- C:\Windows\System\UFxpFzT.exe
  C:\Windows\System\UFxpFzT.exe
  2⤵
  PID:8780
- C:\Windows\System\xMxdizx.exe
  C:\Windows\System\xMxdizx.exe
  2⤵
  PID:8872
- C:\Windows\System\ezlbgeu.exe
  C:\Windows\System\ezlbgeu.exe
  2⤵
  PID:8376
- C:\Windows\System\JxfLSRp.exe
  C:\Windows\System\JxfLSRp.exe
  2⤵
  PID:9228
- C:\Windows\System\jgdDNgM.exe
  C:\Windows\System\jgdDNgM.exe
  2⤵
  PID:9252
- C:\Windows\System\XczkhVs.exe
  C:\Windows\System\XczkhVs.exe
  2⤵
  PID:9284
- C:\Windows\System\dYxKRiZ.exe
  C:\Windows\System\dYxKRiZ.exe
  2⤵
  PID:9308
- C:\Windows\System\lbUStDa.exe
  C:\Windows\System\lbUStDa.exe
  2⤵
  PID:9332
- C:\Windows\System\JgFYqdV.exe
  C:\Windows\System\JgFYqdV.exe
  2⤵
  PID:9352
- C:\Windows\System\YSeDJqh.exe
  C:\Windows\System\YSeDJqh.exe
  2⤵
  PID:9368
- C:\Windows\System\oHtpFCN.exe
  C:\Windows\System\oHtpFCN.exe
  2⤵
  PID:9412
- C:\Windows\System\EJljDrR.exe
  C:\Windows\System\EJljDrR.exe
  2⤵
  PID:9448
- C:\Windows\System\kbPXwYM.exe
  C:\Windows\System\kbPXwYM.exe
  2⤵
  PID:9468
- C:\Windows\System\TkakYdF.exe
  C:\Windows\System\TkakYdF.exe
  2⤵
  PID:9528
- C:\Windows\System\MOFzENC.exe
  C:\Windows\System\MOFzENC.exe
  2⤵
  PID:9572
- C:\Windows\System\VJFIXff.exe
  C:\Windows\System\VJFIXff.exe
  2⤵
  PID:9592
- C:\Windows\System\kYkSHDx.exe
  C:\Windows\System\kYkSHDx.exe
  2⤵
  PID:9608
- C:\Windows\System\jOKilwA.exe
  C:\Windows\System\jOKilwA.exe
  2⤵
  PID:9624
- C:\Windows\System\UVaRBfI.exe
  C:\Windows\System\UVaRBfI.exe
  2⤵
  PID:9676
- C:\Windows\System\umOData.exe
  C:\Windows\System\umOData.exe
  2⤵
  PID:9696
- C:\Windows\System\UppvBoG.exe
  C:\Windows\System\UppvBoG.exe
  2⤵
  PID:9728
- C:\Windows\System\iCFyvEV.exe
  C:\Windows\System\iCFyvEV.exe
  2⤵
  PID:9744
- C:\Windows\System\ljAyYVG.exe
  C:\Windows\System\ljAyYVG.exe
  2⤵
  PID:9776
- C:\Windows\System\pzhSidx.exe
  C:\Windows\System\pzhSidx.exe
  2⤵
  PID:9796
- C:\Windows\System\LGOKxdH.exe
  C:\Windows\System\LGOKxdH.exe
  2⤵
  PID:9824
- C:\Windows\System\gsMintJ.exe
  C:\Windows\System\gsMintJ.exe
  2⤵
  PID:9848
- C:\Windows\System\kWtvbjk.exe
  C:\Windows\System\kWtvbjk.exe
  2⤵
  PID:9884
- C:\Windows\System\dbMSgpt.exe
  C:\Windows\System\dbMSgpt.exe
  2⤵
  PID:9912
- C:\Windows\System\HlCjRKF.exe
  C:\Windows\System\HlCjRKF.exe
  2⤵
  PID:9936
- C:\Windows\System\LysRbXH.exe
  C:\Windows\System\LysRbXH.exe
  2⤵
  PID:9956
- C:\Windows\System\rEAcioB.exe
  C:\Windows\System\rEAcioB.exe
  2⤵
  PID:9976
- C:\Windows\System\KChnkLy.exe
  C:\Windows\System\KChnkLy.exe
  2⤵
  PID:9996
- C:\Windows\System\eNxeJUj.exe
  C:\Windows\System\eNxeJUj.exe
  2⤵
  PID:10020
- C:\Windows\System\zZnidfc.exe
  C:\Windows\System\zZnidfc.exe
  2⤵
  PID:10036
- C:\Windows\System\JIZscSB.exe
  C:\Windows\System\JIZscSB.exe
  2⤵
  PID:10064
- C:\Windows\System\tQwlIDg.exe
  C:\Windows\System\tQwlIDg.exe
  2⤵
  PID:10096
- C:\Windows\System\qnATSsO.exe
  C:\Windows\System\qnATSsO.exe
  2⤵
  PID:10152
- C:\Windows\System\jYsRoNo.exe
  C:\Windows\System\jYsRoNo.exe
  2⤵
  PID:10176
- C:\Windows\System\WZZTMSc.exe
  C:\Windows\System\WZZTMSc.exe
  2⤵
  PID:10200
- C:\Windows\System\VadgfpP.exe
  C:\Windows\System\VadgfpP.exe
  2⤵
  PID:9220
- C:\Windows\System\tytMSCJ.exe
  C:\Windows\System\tytMSCJ.exe
  2⤵
  PID:9236
- C:\Windows\System\qUJWTxc.exe
  C:\Windows\System\qUJWTxc.exe
  2⤵
  PID:9360
- C:\Windows\System\LTHMrrs.exe
  C:\Windows\System\LTHMrrs.exe
  2⤵
  PID:9400
- C:\Windows\System\MRkqsot.exe
  C:\Windows\System\MRkqsot.exe
  2⤵
  PID:9316
- C:\Windows\System\penUtdW.exe
  C:\Windows\System\penUtdW.exe
  2⤵
  PID:9508
- C:\Windows\System\yIqKSiL.exe
  C:\Windows\System\yIqKSiL.exe
  2⤵
  PID:9588
- C:\Windows\System\twEWvXA.exe
  C:\Windows\System\twEWvXA.exe
  2⤵
  PID:9688
- C:\Windows\System\dSgweyt.exe
  C:\Windows\System\dSgweyt.exe
  2⤵
  PID:9736
- C:\Windows\System\BKJmMUK.exe
  C:\Windows\System\BKJmMUK.exe
  2⤵
  PID:4892
- C:\Windows\System\DFuLiDW.exe
  C:\Windows\System\DFuLiDW.exe
  2⤵
  PID:9844
- C:\Windows\System\xSVnRpY.exe
  C:\Windows\System\xSVnRpY.exe
  2⤵
  PID:9948
- C:\Windows\System\QhOesfk.exe
  C:\Windows\System\QhOesfk.exe
  2⤵
  PID:9920
- C:\Windows\System\PvvBOvs.exe
  C:\Windows\System\PvvBOvs.exe
  2⤵
  PID:9972
- C:\Windows\System\vjZwXjP.exe
  C:\Windows\System\vjZwXjP.exe
  2⤵
  PID:10076
- C:\Windows\System\NBHIMIC.exe
  C:\Windows\System\NBHIMIC.exe
  2⤵
  PID:10136
- C:\Windows\System\nFXjhto.exe
  C:\Windows\System\nFXjhto.exe
  2⤵
  PID:10220
- C:\Windows\System\nreGJjo.exe
  C:\Windows\System\nreGJjo.exe
  2⤵
  PID:8972
- C:\Windows\System\SbnRIrp.exe
  C:\Windows\System\SbnRIrp.exe
  2⤵
  PID:9484
- C:\Windows\System\BkYLFtm.exe
  C:\Windows\System\BkYLFtm.exe
  2⤵
  PID:9752
- C:\Windows\System\grmoHTK.exe
  C:\Windows\System\grmoHTK.exe
  2⤵
  PID:10008
- C:\Windows\System\QHuOyEg.exe
  C:\Windows\System\QHuOyEg.exe
  2⤵
  PID:5112
- C:\Windows\System\TFqeGlF.exe
  C:\Windows\System\TFqeGlF.exe
  2⤵
  PID:9968
- C:\Windows\System\bEGVJWA.exe
  C:\Windows\System\bEGVJWA.exe
  2⤵
  PID:8352
- C:\Windows\System\TUNXPpS.exe
  C:\Windows\System\TUNXPpS.exe
  2⤵
  PID:9460
- C:\Windows\System\ECXpKfv.exe
  C:\Windows\System\ECXpKfv.exe
  2⤵
  PID:8640
- C:\Windows\System\SeCvpuH.exe
  C:\Windows\System\SeCvpuH.exe
  2⤵
  PID:2916
- C:\Windows\System\RCWCbgw.exe
  C:\Windows\System\RCWCbgw.exe
  2⤵
  PID:10252
- C:\Windows\System\XbStmCk.exe
  C:\Windows\System\XbStmCk.exe
  2⤵
  PID:10284
- C:\Windows\System\tTuWyOi.exe
  C:\Windows\System\tTuWyOi.exe
  2⤵
  PID:10320
- C:\Windows\System\BHLVBMH.exe
  C:\Windows\System\BHLVBMH.exe
  2⤵
  PID:10340
- C:\Windows\System\HKudWXb.exe
  C:\Windows\System\HKudWXb.exe
  2⤵
  PID:10412
- C:\Windows\System\orXKyRX.exe
  C:\Windows\System\orXKyRX.exe
  2⤵
  PID:10480
- C:\Windows\System\AXoRsOj.exe
  C:\Windows\System\AXoRsOj.exe
  2⤵
  PID:10516
- C:\Windows\System\OpSBpMD.exe
  C:\Windows\System\OpSBpMD.exe
  2⤵
  PID:10540
- C:\Windows\System\VyhcFdH.exe
  C:\Windows\System\VyhcFdH.exe
  2⤵
  PID:10568
- C:\Windows\System\xvukEMH.exe
  C:\Windows\System\xvukEMH.exe
  2⤵
  PID:10588
- C:\Windows\System\gErtGYC.exe
  C:\Windows\System\gErtGYC.exe
  2⤵
  PID:10616
- C:\Windows\System\IQonHWP.exe
  C:\Windows\System\IQonHWP.exe
  2⤵
  PID:10696
- C:\Windows\System\WYNYXcT.exe
  C:\Windows\System\WYNYXcT.exe
  2⤵
  PID:10716
- C:\Windows\System\icrPdzN.exe
  C:\Windows\System\icrPdzN.exe
  2⤵
  PID:10740
- C:\Windows\System\oAVbqTl.exe
  C:\Windows\System\oAVbqTl.exe
  2⤵
  PID:10772
- C:\Windows\System\rgYpyXi.exe
  C:\Windows\System\rgYpyXi.exe
  2⤵
  PID:10820
- C:\Windows\System\PtMdVeu.exe
  C:\Windows\System\PtMdVeu.exe
  2⤵
  PID:10884
- C:\Windows\System\xnbFVfu.exe
  C:\Windows\System\xnbFVfu.exe
  2⤵
  PID:10912
- C:\Windows\System\MmvVfhe.exe
  C:\Windows\System\MmvVfhe.exe
  2⤵
  PID:10944
- C:\Windows\System\xFMjyus.exe
  C:\Windows\System\xFMjyus.exe
  2⤵
  PID:10964
- C:\Windows\System\XAPUmRE.exe
  C:\Windows\System\XAPUmRE.exe
  2⤵
  PID:10984
- C:\Windows\System\pUHBSuX.exe
  C:\Windows\System\pUHBSuX.exe
  2⤵
  PID:11036
- C:\Windows\System\aJZAODH.exe
  C:\Windows\System\aJZAODH.exe
  2⤵
  PID:11056
- C:\Windows\System\ykJyNkP.exe
  C:\Windows\System\ykJyNkP.exe
  2⤵
  PID:11092
- C:\Windows\System\DDpCupp.exe
  C:\Windows\System\DDpCupp.exe
  2⤵
  PID:11112
- C:\Windows\System\ywmCDkz.exe
  C:\Windows\System\ywmCDkz.exe
  2⤵
  PID:11132
- C:\Windows\System\aqrOtOv.exe
  C:\Windows\System\aqrOtOv.exe
  2⤵
  PID:11176
- C:\Windows\System\lNNhmMX.exe
  C:\Windows\System\lNNhmMX.exe
  2⤵
  PID:11196
- C:\Windows\System\zHcTBMV.exe
  C:\Windows\System\zHcTBMV.exe
  2⤵
  PID:11212
- C:\Windows\System\zWVwgrg.exe
  C:\Windows\System\zWVwgrg.exe
  2⤵
  PID:11240
- C:\Windows\System\SinklBf.exe
  C:\Windows\System\SinklBf.exe
  2⤵
  PID:9764
- C:\Windows\System\DRVLhcM.exe
  C:\Windows\System\DRVLhcM.exe
  2⤵
  PID:2356
- C:\Windows\System\xBGjQDA.exe
  C:\Windows\System\xBGjQDA.exe
  2⤵
  PID:8384
- C:\Windows\System\yeGVUSf.exe
  C:\Windows\System\yeGVUSf.exe
  2⤵
  PID:10276
- C:\Windows\System\eMHnOKM.exe
  C:\Windows\System\eMHnOKM.exe
  2⤵
  PID:10392
- C:\Windows\System\XYnEUiS.exe
  C:\Windows\System\XYnEUiS.exe
  2⤵
  PID:9892
- C:\Windows\System\VqHHymb.exe
  C:\Windows\System\VqHHymb.exe
  2⤵
  PID:10304
- C:\Windows\System\IUxTFNW.exe
  C:\Windows\System\IUxTFNW.exe
  2⤵
  PID:10464
- C:\Windows\System\QQaOBWV.exe
  C:\Windows\System\QQaOBWV.exe
  2⤵
  PID:10396
- C:\Windows\System\aiXCxMB.exe
  C:\Windows\System\aiXCxMB.exe
  2⤵
  PID:10500
- C:\Windows\System\ZZYchzh.exe
  C:\Windows\System\ZZYchzh.exe
  2⤵
  PID:10420
- C:\Windows\System\SJebbgV.exe
  C:\Windows\System\SJebbgV.exe
  2⤵
  PID:10532
- C:\Windows\System\ptkCEiN.exe
  C:\Windows\System\ptkCEiN.exe
  2⤵
  PID:10684
- C:\Windows\System\fKBtftP.exe
  C:\Windows\System\fKBtftP.exe
  2⤵
  PID:10708
- C:\Windows\System\dubVVrB.exe
  C:\Windows\System\dubVVrB.exe
  2⤵
  PID:10800
- C:\Windows\System\wQpFvau.exe
  C:\Windows\System\wQpFvau.exe
  2⤵
  PID:3576
- C:\Windows\System\xitVTWz.exe
  C:\Windows\System\xitVTWz.exe
  2⤵
  PID:10816
- C:\Windows\System\fogpQAV.exe
  C:\Windows\System\fogpQAV.exe
  2⤵
  PID:10904
- C:\Windows\System\eGLHGma.exe
  C:\Windows\System\eGLHGma.exe
  2⤵
  PID:10960
- C:\Windows\System\OKWjDlw.exe
  C:\Windows\System\OKWjDlw.exe
  2⤵
  PID:11024
- C:\Windows\System\BcLxCAA.exe
  C:\Windows\System\BcLxCAA.exe
  2⤵
  PID:11124
- C:\Windows\System\QLXgyOb.exe
  C:\Windows\System\QLXgyOb.exe
  2⤵
  PID:11108
- C:\Windows\System\EYPvYby.exe
  C:\Windows\System\EYPvYby.exe
  2⤵
  PID:11172
- C:\Windows\System\bExxuvQ.exe
  C:\Windows\System\bExxuvQ.exe
  2⤵
  PID:11248
- C:\Windows\System\QpdJMMh.exe
  C:\Windows\System\QpdJMMh.exe
  2⤵
  PID:9836
- C:\Windows\System\GajHVHq.exe
  C:\Windows\System\GajHVHq.exe
  2⤵
  PID:10032
- C:\Windows\System\hAyEzwp.exe
  C:\Windows\System\hAyEzwp.exe
  2⤵
  PID:10448
- C:\Windows\System\RiBpkeC.exe
  C:\Windows\System\RiBpkeC.exe
  2⤵
  PID:10556
- C:\Windows\System\PdrFeir.exe
  C:\Windows\System\PdrFeir.exe
  2⤵
  PID:10728
- C:\Windows\System\FGJLKZL.exe
  C:\Windows\System\FGJLKZL.exe
  2⤵
  PID:10864
- C:\Windows\System\trtWkrw.exe
  C:\Windows\System\trtWkrw.exe
  2⤵
  PID:10932
- C:\Windows\System\xfHByWG.exe
  C:\Windows\System\xfHByWG.exe
  2⤵
  PID:11168
- C:\Windows\System\qXkreya.exe
  C:\Windows\System\qXkreya.exe
  2⤵
  PID:9900
- C:\Windows\System\GegsmKv.exe
  C:\Windows\System\GegsmKv.exe
  2⤵
  PID:11236
- C:\Windows\System\ERMBjrE.exe
  C:\Windows\System\ERMBjrE.exe
  2⤵
  PID:10548
- C:\Windows\System\bJSDZOM.exe
  C:\Windows\System\bJSDZOM.exe
  2⤵
  PID:10608
- C:\Windows\System\nksERsb.exe
  C:\Windows\System\nksERsb.exe
  2⤵
  PID:10952
- C:\Windows\System\sMtTZiG.exe
  C:\Windows\System\sMtTZiG.exe
  2⤵
  PID:10656
- C:\Windows\System\fRqZCat.exe
  C:\Windows\System\fRqZCat.exe
  2⤵
  PID:9832
- C:\Windows\System\qqaBIkb.exe
  C:\Windows\System\qqaBIkb.exe
  2⤵
  PID:11288
- C:\Windows\System\cvZYdSl.exe
  C:\Windows\System\cvZYdSl.exe
  2⤵
  PID:11304
- C:\Windows\System\oidIKLr.exe
  C:\Windows\System\oidIKLr.exe
  2⤵
  PID:11348
- C:\Windows\System\FrZmyVD.exe
  C:\Windows\System\FrZmyVD.exe
  2⤵
  PID:11372
- C:\Windows\System\HGMutfl.exe
  C:\Windows\System\HGMutfl.exe
  2⤵
  PID:11444
- C:\Windows\System\TsMvmsP.exe
  C:\Windows\System\TsMvmsP.exe
  2⤵
  PID:11460
- C:\Windows\System\WHYkxdF.exe
  C:\Windows\System\WHYkxdF.exe
  2⤵
  PID:11476
- C:\Windows\System\kGyuxNQ.exe
  C:\Windows\System\kGyuxNQ.exe
  2⤵
  PID:11500
- C:\Windows\System\CyZmcfs.exe
  C:\Windows\System\CyZmcfs.exe
  2⤵
  PID:11528
- C:\Windows\System\uEIZhZC.exe
  C:\Windows\System\uEIZhZC.exe
  2⤵
  PID:11544
- C:\Windows\System\mIPCAbF.exe
  C:\Windows\System\mIPCAbF.exe
  2⤵
  PID:11588
- C:\Windows\System\YbaYypx.exe
  C:\Windows\System\YbaYypx.exe
  2⤵
  PID:11608
- C:\Windows\System\pYbYjye.exe
  C:\Windows\System\pYbYjye.exe
  2⤵
  PID:11624
- C:\Windows\System\ktMXmDt.exe
  C:\Windows\System\ktMXmDt.exe
  2⤵
  PID:11648
- C:\Windows\System\MIRmpLo.exe
  C:\Windows\System\MIRmpLo.exe
  2⤵
  PID:11688
- C:\Windows\System\SdgYnHm.exe
  C:\Windows\System\SdgYnHm.exe
  2⤵
  PID:11704
- C:\Windows\System\kNOXkTc.exe
  C:\Windows\System\kNOXkTc.exe
  2⤵
  PID:11724
- C:\Windows\System\jxewnPb.exe
  C:\Windows\System\jxewnPb.exe
  2⤵
  PID:11748
- C:\Windows\System\bKnOYsj.exe
  C:\Windows\System\bKnOYsj.exe
  2⤵
  PID:11772
- C:\Windows\System\tnNJoJz.exe
  C:\Windows\System\tnNJoJz.exe
  2⤵
  PID:11792
- C:\Windows\System\DddLqOh.exe
  C:\Windows\System\DddLqOh.exe
  2⤵
  PID:11816
- C:\Windows\System\cCFpuib.exe
  C:\Windows\System\cCFpuib.exe
  2⤵
  PID:11856
- C:\Windows\System\cxtLLcn.exe
  C:\Windows\System\cxtLLcn.exe
  2⤵
  PID:11876
- C:\Windows\System\UrGTIXx.exe
  C:\Windows\System\UrGTIXx.exe
  2⤵
  PID:11916
- C:\Windows\System\DQZsVgg.exe
  C:\Windows\System\DQZsVgg.exe
  2⤵
  PID:11936
- C:\Windows\System\iHuFMCG.exe
  C:\Windows\System\iHuFMCG.exe
  2⤵
  PID:11980
- C:\Windows\System\vTWIWmB.exe
  C:\Windows\System\vTWIWmB.exe
  2⤵
  PID:12000
- C:\Windows\System\XRzKkUF.exe
  C:\Windows\System\XRzKkUF.exe
  2⤵
  PID:12040
- C:\Windows\System\FIyXuXa.exe
  C:\Windows\System\FIyXuXa.exe
  2⤵
  PID:12060
- C:\Windows\System\hlTbvZH.exe
  C:\Windows\System\hlTbvZH.exe
  2⤵
  PID:12080
- C:\Windows\System\NlZuUYt.exe
  C:\Windows\System\NlZuUYt.exe
  2⤵
  PID:12140
- C:\Windows\System\SUbQQNr.exe
  C:\Windows\System\SUbQQNr.exe
  2⤵
  PID:12168
- C:\Windows\System\KHcqQCq.exe
  C:\Windows\System\KHcqQCq.exe
  2⤵
  PID:12188
- C:\Windows\System\QOchchp.exe
  C:\Windows\System\QOchchp.exe
  2⤵
  PID:12208
- C:\Windows\System\BGFOIPI.exe
  C:\Windows\System\BGFOIPI.exe
  2⤵
  PID:12252
- C:\Windows\System\fWSxswU.exe
  C:\Windows\System\fWSxswU.exe
  2⤵
  PID:12276
- C:\Windows\System\ZPBOSmh.exe
  C:\Windows\System\ZPBOSmh.exe
  2⤵
  PID:11272
- C:\Windows\System\AyIfUxX.exe
  C:\Windows\System\AyIfUxX.exe
  2⤵
  PID:11344
- C:\Windows\System\WoSXzYj.exe
  C:\Windows\System\WoSXzYj.exe
  2⤵
  PID:11404
- C:\Windows\System\iwTeyBG.exe
  C:\Windows\System\iwTeyBG.exe
  2⤵
  PID:11432
- C:\Windows\System\lBdlcyw.exe
  C:\Windows\System\lBdlcyw.exe
  2⤵
  PID:11496
- C:\Windows\System\ZbHaeaj.exe
  C:\Windows\System\ZbHaeaj.exe
  2⤵
  PID:11656
- C:\Windows\System\dpLeqmG.exe
  C:\Windows\System\dpLeqmG.exe
  2⤵
  PID:11632
- C:\Windows\System\buKizjj.exe
  C:\Windows\System\buKizjj.exe
  2⤵
  PID:11740
- C:\Windows\System\MsdJIiU.exe
  C:\Windows\System\MsdJIiU.exe
  2⤵
  PID:11716
- C:\Windows\System\yrWFrWa.exe
  C:\Windows\System\yrWFrWa.exe
  2⤵
  PID:11884
- C:\Windows\System\auDacBn.exe
  C:\Windows\System\auDacBn.exe
  2⤵
  PID:11812
- C:\Windows\System\jgljDtN.exe
  C:\Windows\System\jgljDtN.exe
  2⤵
  PID:11976
- C:\Windows\System\ZucLorm.exe
  C:\Windows\System\ZucLorm.exe
  2⤵
  PID:12028
- C:\Windows\System\FDTSLfL.exe
  C:\Windows\System\FDTSLfL.exe
  2⤵
  PID:12076
- C:\Windows\System\pHDBfrK.exe
  C:\Windows\System\pHDBfrK.exe
  2⤵
  PID:12216
- C:\Windows\System\ZscwfQH.exe
  C:\Windows\System\ZscwfQH.exe
  2⤵
  PID:12260
- C:\Windows\System\TxqowLa.exe
  C:\Windows\System\TxqowLa.exe
  2⤵
  PID:12268
- C:\Windows\System\lTYHvYU.exe
  C:\Windows\System\lTYHvYU.exe
  2⤵
  PID:11300
- C:\Windows\System\xBOmiFV.exe
  C:\Windows\System\xBOmiFV.exe
  2⤵
  PID:11468
- C:\Windows\System\drWGbXE.exe
  C:\Windows\System\drWGbXE.exe
  2⤵
  PID:11696
- C:\Windows\System\zZpEWTB.exe
  C:\Windows\System\zZpEWTB.exe
  2⤵
  PID:11700
- C:\Windows\System\ddOiVMK.exe
  C:\Windows\System\ddOiVMK.exe
  2⤵
  PID:2364
- C:\Windows\System\OCRgbGB.exe
  C:\Windows\System\OCRgbGB.exe
  2⤵
  PID:11780
- C:\Windows\System\auJckWa.exe
  C:\Windows\System\auJckWa.exe
  2⤵
  PID:11988
- C:\Windows\System\gAdYXhb.exe
  C:\Windows\System\gAdYXhb.exe
  2⤵
  PID:12248
- C:\Windows\System\cnZhRAx.exe
  C:\Windows\System\cnZhRAx.exe
  2⤵
  PID:10476
- C:\Windows\System\NJGPESI.exe
  C:\Windows\System\NJGPESI.exe
  2⤵
  PID:3180
- C:\Windows\System\AhTfwkf.exe
  C:\Windows\System\AhTfwkf.exe
  2⤵
  PID:4012
- C:\Windows\System\cHegfTE.exe
  C:\Windows\System\cHegfTE.exe
  2⤵
  PID:11828
- C:\Windows\System\MnhkdAu.exe
  C:\Windows\System\MnhkdAu.exe
  2⤵
  PID:2232
- C:\Windows\System\EGthYiB.exe
  C:\Windows\System\EGthYiB.exe
  2⤵
  PID:12300
- C:\Windows\System\FEZwAiJ.exe
  C:\Windows\System\FEZwAiJ.exe
  2⤵
  PID:12316
- C:\Windows\System\rWtyhpT.exe
  C:\Windows\System\rWtyhpT.exe
  2⤵
  PID:12336
- C:\Windows\System\OjEACZl.exe
  C:\Windows\System\OjEACZl.exe
  2⤵
  PID:12356
- C:\Windows\System\ZgzijHH.exe
  C:\Windows\System\ZgzijHH.exe
  2⤵
  PID:12384
- C:\Windows\System\YRKmmll.exe
  C:\Windows\System\YRKmmll.exe
  2⤵
  PID:12424
- C:\Windows\System\hKYEIvO.exe
  C:\Windows\System\hKYEIvO.exe
  2⤵
  PID:12476
- C:\Windows\System\VuBkmCL.exe
  C:\Windows\System\VuBkmCL.exe
  2⤵
  PID:12508
- C:\Windows\System\EPZUrLz.exe
  C:\Windows\System\EPZUrLz.exe
  2⤵
  PID:12532
- C:\Windows\System\ZDBIJIP.exe
  C:\Windows\System\ZDBIJIP.exe
  2⤵
  PID:12564
- C:\Windows\System\XCEpgVu.exe
  C:\Windows\System\XCEpgVu.exe
  2⤵
  PID:12584
- C:\Windows\System\boOgiGK.exe
  C:\Windows\System\boOgiGK.exe
  2⤵
  PID:12628
- C:\Windows\System\gFEffnE.exe
  C:\Windows\System\gFEffnE.exe
  2⤵
  PID:12648
- C:\Windows\System\GPDhgEY.exe
  C:\Windows\System\GPDhgEY.exe
  2⤵
  PID:12668
- C:\Windows\System\uYskrgH.exe
  C:\Windows\System\uYskrgH.exe
  2⤵
  PID:12692
- C:\Windows\System\hyNeHqr.exe
  C:\Windows\System\hyNeHqr.exe
  2⤵
  PID:12724
- C:\Windows\System\fORGRkC.exe
  C:\Windows\System\fORGRkC.exe
  2⤵
  PID:12756
- C:\Windows\System\myRLuts.exe
  C:\Windows\System\myRLuts.exe
  2⤵
  PID:12784
- C:\Windows\System\GfwvAmL.exe
  C:\Windows\System\GfwvAmL.exe
  2⤵
  PID:12828
- C:\Windows\System\VkKfIvB.exe
  C:\Windows\System\VkKfIvB.exe
  2⤵
  PID:12860
- C:\Windows\System\cxTrcvL.exe
  C:\Windows\System\cxTrcvL.exe
  2⤵
  PID:12876
- C:\Windows\System\WnWWtMZ.exe
  C:\Windows\System\WnWWtMZ.exe
  2⤵
  PID:12896
- C:\Windows\System\xJmRsWq.exe
  C:\Windows\System\xJmRsWq.exe
  2⤵
  PID:12912
- C:\Windows\System\PSYzfcq.exe
  C:\Windows\System\PSYzfcq.exe
  2⤵
  PID:12944
- C:\Windows\System\yLkwtRo.exe
  C:\Windows\System\yLkwtRo.exe
  2⤵
  PID:12968
- C:\Windows\System\AjJsSKk.exe
  C:\Windows\System\AjJsSKk.exe
  2⤵
  PID:12988
- C:\Windows\System\UTsKUzm.exe
  C:\Windows\System\UTsKUzm.exe
  2⤵
  PID:13012
- C:\Windows\System\cEnmqlE.exe
  C:\Windows\System\cEnmqlE.exe
  2⤵
  PID:13028
- C:\Windows\System\YmoVzqU.exe
  C:\Windows\System\YmoVzqU.exe
  2⤵
  PID:13052
- C:\Windows\System\yerhDDm.exe
  C:\Windows\System\yerhDDm.exe
  2⤵
  PID:12856
- C:\Windows\System\txsMDpc.exe
  C:\Windows\System\txsMDpc.exe
  2⤵
  PID:12908
- C:\Windows\System\XPRlzxa.exe
  C:\Windows\System\XPRlzxa.exe
  2⤵
  PID:1524
- C:\Windows\System\ktZRIYQ.exe
  C:\Windows\System\ktZRIYQ.exe
  2⤵
  PID:2528
- C:\Windows\System\maNYjyR.exe
  C:\Windows\System\maNYjyR.exe
  2⤵
  PID:3236
- C:\Windows\System\GpcUCnm.exe
  C:\Windows\System\GpcUCnm.exe
  2⤵
  PID:6656
- C:\Windows\System\XqYbTaf.exe
  C:\Windows\System\XqYbTaf.exe
  2⤵
  PID:6696
- C:\Windows\System\tyRynEn.exe
  C:\Windows\System\tyRynEn.exe
  2⤵
  PID:6780
- C:\Windows\System\ardRuGW.exe
  C:\Windows\System\ardRuGW.exe
  2⤵
  PID:6836
- C:\Windows\System\afUlSdt.exe
  C:\Windows\System\afUlSdt.exe
  2⤵
  PID:6948
- C:\Windows\System\oOpiyZj.exe
  C:\Windows\System\oOpiyZj.exe
  2⤵
  PID:2088
- C:\Windows\System\yLqoWsr.exe
  C:\Windows\System\yLqoWsr.exe
  2⤵
  PID:13128
- C:\Windows\System\MdLFIiQ.exe
  C:\Windows\System\MdLFIiQ.exe
  2⤵
  PID:4428
- C:\Windows\System\RHMIeii.exe
  C:\Windows\System\RHMIeii.exe
  2⤵
  PID:13156
- C:\Windows\System\zwGpbVa.exe
  C:\Windows\System\zwGpbVa.exe
  2⤵
  PID:13220
- C:\Windows\System\MFNsaEj.exe
  C:\Windows\System\MFNsaEj.exe
  2⤵
  PID:1192
- C:\Windows\System\MqTAOde.exe
  C:\Windows\System\MqTAOde.exe
  2⤵
  PID:7116
- C:\Windows\System\pWfyKSL.exe
  C:\Windows\System\pWfyKSL.exe
  2⤵
  PID:2372
- C:\Windows\System\axwsJJa.exe
  C:\Windows\System\axwsJJa.exe
  2⤵
  PID:13200
- C:\Windows\System\hakPRhX.exe
  C:\Windows\System\hakPRhX.exe
  2⤵
  PID:12892
- C:\Windows\System\sIbRabt.exe
  C:\Windows\System\sIbRabt.exe
  2⤵
  PID:13144
- C:\Windows\System\VeGNIPS.exe
  C:\Windows\System\VeGNIPS.exe
  2⤵
  PID:13164
- C:\Windows\System\cUVltrF.exe
  C:\Windows\System\cUVltrF.exe
  2⤵
  PID:6252
- C:\Windows\System\IFmaYWu.exe
  C:\Windows\System\IFmaYWu.exe
  2⤵
  PID:6372
- C:\Windows\System\KjpGimz.exe
  C:\Windows\System\KjpGimz.exe
  2⤵
  PID:6732
- C:\Windows\System\EbcEJgH.exe
  C:\Windows\System\EbcEJgH.exe
  2⤵
  PID:6932
- C:\Windows\System\SDfnNof.exe
  C:\Windows\System\SDfnNof.exe
  2⤵
  PID:3976
- C:\Windows\System\TFTRlJc.exe
  C:\Windows\System\TFTRlJc.exe
  2⤵
  PID:7148
- C:\Windows\System\vYKRIeH.exe
  C:\Windows\System\vYKRIeH.exe
  2⤵
  PID:2196
- C:\Windows\System\OoSOLDi.exe
  C:\Windows\System\OoSOLDi.exe
  2⤵
  PID:4164
- C:\Windows\System\kDgONjX.exe
  C:\Windows\System\kDgONjX.exe
  2⤵
  PID:6644
- C:\Windows\System\cqVTzvL.exe
  C:\Windows\System\cqVTzvL.exe
  2⤵
  PID:3024
- C:\Windows\System\RxWkCMw.exe
  C:\Windows\System\RxWkCMw.exe
  2⤵
  PID:876
- C:\Windows\System\vrYCBLW.exe
  C:\Windows\System\vrYCBLW.exe
  2⤵
  PID:772
- C:\Windows\System\GeEHTHg.exe
  C:\Windows\System\GeEHTHg.exe
  2⤵
  PID:3624
- C:\Windows\System\hNFxeCt.exe
  C:\Windows\System\hNFxeCt.exe
  2⤵
  PID:1904
- C:\Windows\System\GzdgsuQ.exe
  C:\Windows\System\GzdgsuQ.exe
  2⤵
  PID:3156
- C:\Windows\System\AZMePrV.exe
  C:\Windows\System\AZMePrV.exe
  2⤵
  PID:13148
- C:\Windows\System\KSsCVbU.exe
  C:\Windows\System\KSsCVbU.exe
  2⤵
  PID:12400
- C:\Windows\System\csgPTZQ.exe
  C:\Windows\System\csgPTZQ.exe
  2⤵
  PID:4860
- C:\Windows\System\ewQieAM.exe
  C:\Windows\System\ewQieAM.exe
  2⤵
  PID:4128
- C:\Windows\System\MFWyuRo.exe
  C:\Windows\System\MFWyuRo.exe
  2⤵
  PID:4572
- C:\Windows\System\BwQLNds.exe
  C:\Windows\System\BwQLNds.exe
  2⤵
  PID:4332
- C:\Windows\System\SCTGwpm.exe
  C:\Windows\System\SCTGwpm.exe
  2⤵
  PID:2556
- C:\Windows\System\jUbuirG.exe
  C:\Windows\System\jUbuirG.exe
  2⤵
  PID:4844
- C:\Windows\System\oxynXNw.exe
  C:\Windows\System\oxynXNw.exe
  2⤵
  PID:13216
- C:\Windows\System\SxKBtzv.exe
  C:\Windows\System\SxKBtzv.exe
  2⤵
  PID:12444
- C:\Windows\System\OUdGSVL.exe
  C:\Windows\System\OUdGSVL.exe
  2⤵
  PID:12464
- C:\Windows\System\YHISFeD.exe
  C:\Windows\System\YHISFeD.exe
  2⤵
  PID:12368
- C:\Windows\System\EjnAYcQ.exe
  C:\Windows\System\EjnAYcQ.exe
  2⤵
  PID:12548
- C:\Windows\System\xrffUIp.exe
  C:\Windows\System\xrffUIp.exe
  2⤵
  PID:7432
- C:\Windows\System\YEJHygG.exe
  C:\Windows\System\YEJHygG.exe
  2⤵
  PID:5108
- C:\Windows\System\EAfPDcN.exe
  C:\Windows\System\EAfPDcN.exe
  2⤵
  PID:7492
- C:\Windows\System\LzCILTU.exe
  C:\Windows\System\LzCILTU.exe
  2⤵
  PID:12556
- C:\Windows\System\svovwNO.exe
  C:\Windows\System\svovwNO.exe
  2⤵
  PID:12624
- C:\Windows\System\aoineiq.exe
  C:\Windows\System\aoineiq.exe
  2⤵
  PID:12688
- C:\Windows\System\gEKNTrc.exe
  C:\Windows\System\gEKNTrc.exe
  2⤵
  PID:7652
- C:\Windows\System\oJocezG.exe
  C:\Windows\System\oJocezG.exe
  2⤵
  PID:7732
- C:\Windows\System\nVOvLex.exe
  C:\Windows\System\nVOvLex.exe
  2⤵
  PID:7852
- C:\Windows\System\NvooAUo.exe
  C:\Windows\System\NvooAUo.exe
  2⤵
  PID:7928
- C:\Windows\System\MbAsMJw.exe
  C:\Windows\System\MbAsMJw.exe
  2⤵
  PID:8088
- C:\Windows\System\fHTUCaM.exe
  C:\Windows\System\fHTUCaM.exe
  2⤵
  PID:12708
- C:\Windows\System\OGcBNaG.exe
  C:\Windows\System\OGcBNaG.exe
  2⤵
  PID:8124
- C:\Windows\System\OVokeOn.exe
  C:\Windows\System\OVokeOn.exe
  2⤵
  PID:5016
- C:\Windows\System\SsqimHm.exe
  C:\Windows\System\SsqimHm.exe
  2⤵
  PID:12732
- C:\Windows\System\pQvWujq.exe
  C:\Windows\System\pQvWujq.exe
  2⤵
  PID:7312
- C:\Windows\System\BiprxWS.exe
  C:\Windows\System\BiprxWS.exe
  2⤵
  PID:4880
- C:\Windows\System\iumHVEF.exe
  C:\Windows\System\iumHVEF.exe
  2⤵
  PID:3108
- C:\Windows\System\XiGkCgO.exe
  C:\Windows\System\XiGkCgO.exe
  2⤵
  PID:12844
- C:\Windows\System\LUaIGPt.exe
  C:\Windows\System\LUaIGPt.exe
  2⤵
  PID:12872
- C:\Windows\System\rbBHZec.exe
  C:\Windows\System\rbBHZec.exe
  2⤵
  PID:1720
- C:\Windows\System\sPlahux.exe
  C:\Windows\System\sPlahux.exe
  2⤵
  PID:1284
- C:\Windows\System\OwYTRka.exe
  C:\Windows\System\OwYTRka.exe
  2⤵
  PID:1088
- C:\Windows\System\zhNTycr.exe
  C:\Windows\System\zhNTycr.exe
  2⤵
  PID:7552
- C:\Windows\System\BVVtphE.exe
  C:\Windows\System\BVVtphE.exe
  2⤵
  PID:7848
- C:\Windows\System\lYPYEFa.exe
  C:\Windows\System\lYPYEFa.exe
  2⤵
  PID:1172
- C:\Windows\System\AnITFlP.exe
  C:\Windows\System\AnITFlP.exe
  2⤵
  PID:696
- C:\Windows\System\ongzYFE.exe
  C:\Windows\System\ongzYFE.exe
  2⤵
  PID:2388
- C:\Windows\System\KhdjwiH.exe
  C:\Windows\System\KhdjwiH.exe
  2⤵
  PID:1580
- C:\Windows\System\LvaWTlD.exe
  C:\Windows\System\LvaWTlD.exe
  2⤵
  PID:2832
- C:\Windows\System\IOPMHki.exe
  C:\Windows\System\IOPMHki.exe
  2⤵
  PID:3268
- C:\Windows\System\ywlHQXk.exe
  C:\Windows\System\ywlHQXk.exe
  2⤵
  PID:12380
- C:\Windows\System\THZfAPO.exe
  C:\Windows\System\THZfAPO.exe
  2⤵
  PID:6924
- C:\Windows\System\POsWgdp.exe
  C:\Windows\System\POsWgdp.exe
  2⤵
  PID:7608
- C:\Windows\System\bAxKSCV.exe
  C:\Windows\System\bAxKSCV.exe
  2⤵
  PID:4680
- C:\Windows\System\DNnOYcU.exe
  C:\Windows\System\DNnOYcU.exe
  2⤵
  PID:6612
- C:\Windows\System\tBOWbfU.exe
  C:\Windows\System\tBOWbfU.exe
  2⤵
  PID:4868
- C:\Windows\System\dmjjcYs.exe
  C:\Windows\System\dmjjcYs.exe
  2⤵
  PID:3712
- C:\Windows\System\jqTILbQ.exe
  C:\Windows\System\jqTILbQ.exe
  2⤵
  PID:4000
- C:\Windows\System\wVLOKXd.exe
  C:\Windows\System\wVLOKXd.exe
  2⤵
  PID:6892
- C:\Windows\System\dsXqdrI.exe
  C:\Windows\System\dsXqdrI.exe
  2⤵
  PID:6752
- C:\Windows\System\RHGasVL.exe
  C:\Windows\System\RHGasVL.exe
  2⤵
  PID:6904
- C:\Windows\System\HnFmsqe.exe
  C:\Windows\System\HnFmsqe.exe
  2⤵
  PID:12404
- C:\Windows\System\XRRgOEn.exe
  C:\Windows\System\XRRgOEn.exe
  2⤵
  PID:8292
- C:\Windows\System\XzOUwsh.exe
  C:\Windows\System\XzOUwsh.exe
  2⤵
  PID:8444
- C:\Windows\System\caixpAt.exe
  C:\Windows\System\caixpAt.exe
  2⤵
  PID:8500
- C:\Windows\System\qBbGXgy.exe
  C:\Windows\System\qBbGXgy.exe
  2⤵
  PID:8556
- C:\Windows\System\MSphGdn.exe
  C:\Windows\System\MSphGdn.exe
  2⤵
  PID:8604
- C:\Windows\System\gCwdxeO.exe
  C:\Windows\System\gCwdxeO.exe
  2⤵
  PID:8644
- C:\Windows\System\xPGqDGv.exe
  C:\Windows\System\xPGqDGv.exe
  2⤵
  PID:8676
- C:\Windows\System\uUerfKK.exe
  C:\Windows\System\uUerfKK.exe
  2⤵
  PID:8744
- C:\Windows\System\WCbqtrS.exe
  C:\Windows\System\WCbqtrS.exe
  2⤵
  PID:5232
- C:\Windows\System\nNqGZaT.exe
  C:\Windows\System\nNqGZaT.exe
  2⤵
  PID:6908
- C:\Windows\System\rjgPWRf.exe
  C:\Windows\System\rjgPWRf.exe
  2⤵
  PID:864
- C:\Windows\System\idqDVOE.exe
  C:\Windows\System\idqDVOE.exe
  2⤵
  PID:5084
- C:\Windows\System\NYInKPs.exe
  C:\Windows\System\NYInKPs.exe
  2⤵
  PID:4652
- C:\Windows\System\EOGsPdV.exe
  C:\Windows\System\EOGsPdV.exe
  2⤵
  PID:1492
- C:\Windows\System\hBGvCST.exe
  C:\Windows\System\hBGvCST.exe
  2⤵
  PID:3044
- C:\Windows\System\YWnWZXT.exe
  C:\Windows\System\YWnWZXT.exe
  2⤵
  PID:6928
- C:\Windows\System\hadxoiK.exe
  C:\Windows\System\hadxoiK.exe
  2⤵
  PID:13264
- C:\Windows\System\QxglpWQ.exe
  C:\Windows\System\QxglpWQ.exe
  2⤵
  PID:8848
- C:\Windows\System\Gpwmuuy.exe
  C:\Windows\System\Gpwmuuy.exe
  2⤵
  PID:2724
- C:\Windows\System\EteTgFd.exe
  C:\Windows\System\EteTgFd.exe
  2⤵
  PID:1368
- C:\Windows\System\LcUoCJT.exe
  C:\Windows\System\LcUoCJT.exe
  2⤵
  PID:376
- C:\Windows\System\GjsusUa.exe
  C:\Windows\System\GjsusUa.exe
  2⤵
  PID:13076
- C:\Windows\System\FJoMhAU.exe
  C:\Windows\System\FJoMhAU.exe
  2⤵
  PID:5336
- C:\Windows\System\LcZzzlm.exe
  C:\Windows\System\LcZzzlm.exe
  2⤵
  PID:9040
- C:\Windows\System\uVxSFDL.exe
  C:\Windows\System\uVxSFDL.exe
  2⤵
  PID:13140
- C:\Windows\System\zSChExg.exe
  C:\Windows\System\zSChExg.exe
  2⤵
  PID:13024
- C:\Windows\System\zakMnmJ.exe
  C:\Windows\System\zakMnmJ.exe
  2⤵
  PID:13132
- C:\Windows\System\ExHKApW.exe
  C:\Windows\System\ExHKApW.exe
  2⤵
  PID:5340
- C:\Windows\System\sYjWYol.exe
  C:\Windows\System\sYjWYol.exe
  2⤵
  PID:13196
- C:\Windows\System\fmIsmZI.exe
  C:\Windows\System\fmIsmZI.exe
  2⤵
  PID:5396
- C:\Windows\System\ksUZJXJ.exe
  C:\Windows\System\ksUZJXJ.exe
  2⤵
  PID:13304
- C:\Windows\System\ixBOKeC.exe
  C:\Windows\System\ixBOKeC.exe
  2⤵
  PID:9196
- C:\Windows\System\jRyswEJ.exe
  C:\Windows\System\jRyswEJ.exe
  2⤵
  PID:8208
- C:\Windows\System\siBOkFA.exe
  C:\Windows\System\siBOkFA.exe
  2⤵
  PID:6480
- C:\Windows\System\QhLYmDB.exe
  C:\Windows\System\QhLYmDB.exe
  2⤵
  PID:8396
- C:\Windows\System\cCgsduF.exe
  C:\Windows\System\cCgsduF.exe
  2⤵
  PID:8512
- C:\Windows\System\rtmXiFW.exe
  C:\Windows\System\rtmXiFW.exe
  2⤵
  PID:5488
- C:\Windows\System\HXRhcct.exe
  C:\Windows\System\HXRhcct.exe
  2⤵
  PID:5528
- C:\Windows\System\BHFLMyC.exe
  C:\Windows\System\BHFLMyC.exe
  2⤵
  PID:6896
- C:\Windows\System\TIPvdQl.exe
  C:\Windows\System\TIPvdQl.exe
  2⤵
  PID:8724
- C:\Windows\System\FwihGaB.exe
  C:\Windows\System\FwihGaB.exe
  2⤵
  PID:5556
- C:\Windows\System\ttswyMl.exe
  C:\Windows\System\ttswyMl.exe
  2⤵
  PID:7016
- C:\Windows\System\aHZqxBF.exe
  C:\Windows\System\aHZqxBF.exe
  2⤵
  PID:3988
- C:\Windows\System\sJRuzIr.exe
  C:\Windows\System\sJRuzIr.exe
  2⤵
  PID:6316
- C:\Windows\System\UGSsasT.exe
  C:\Windows\System\UGSsasT.exe
  2⤵
  PID:5612
- C:\Windows\System\FnFAeZM.exe
  C:\Windows\System\FnFAeZM.exe
  2⤵
  PID:8260
- C:\Windows\System\ddvTUKB.exe
  C:\Windows\System\ddvTUKB.exe
  2⤵
  PID:4972
- C:\Windows\System\jwalnZv.exe
  C:\Windows\System\jwalnZv.exe
  2⤵
  PID:8432
- C:\Windows\System\okhIRfW.exe
  C:\Windows\System\okhIRfW.exe
  2⤵
  PID:8660
- C:\Windows\System\TSCWzuf.exe
  C:\Windows\System\TSCWzuf.exe
  2⤵
  PID:13252
- C:\Windows\System\UofbuPN.exe
  C:\Windows\System\UofbuPN.exe
  2⤵
  PID:2284
- C:\Windows\System\IPvqbNK.exe
  C:\Windows\System\IPvqbNK.exe
  2⤵
  PID:5688
- C:\Windows\System\XAQpggm.exe
  C:\Windows\System\XAQpggm.exe
  2⤵
  PID:8240
- C:\Windows\System\PAmiwxF.exe
  C:\Windows\System\PAmiwxF.exe
  2⤵
  PID:3208
- C:\Windows\System\amuyvun.exe
  C:\Windows\System\amuyvun.exe
  2⤵
  PID:5756
- C:\Windows\System\OmQlDRY.exe
  C:\Windows\System\OmQlDRY.exe
  2⤵
  PID:6200
- C:\Windows\System\LBDlXHt.exe
  C:\Windows\System\LBDlXHt.exe
  2⤵
  PID:12976
- C:\Windows\System\IDowYuQ.exe
  C:\Windows\System\IDowYuQ.exe
  2⤵
  PID:1984
- C:\Windows\System\apBEVTo.exe
  C:\Windows\System\apBEVTo.exe
  2⤵
  PID:1240
- C:\Windows\System\ZneIcjN.exe
  C:\Windows\System\ZneIcjN.exe
  2⤵
  PID:5864
- C:\Windows\System\Xxhoczd.exe
  C:\Windows\System\Xxhoczd.exe
  2⤵
  PID:4216
- C:\Windows\System\PYTwqmW.exe
  C:\Windows\System\PYTwqmW.exe
  2⤵
  PID:5884
- C:\Windows\System\MHLbaEq.exe
  C:\Windows\System\MHLbaEq.exe
  2⤵
  PID:7292
- C:\Windows\System\yhpWojP.exe
  C:\Windows\System\yhpWojP.exe
  2⤵
  PID:4764
- C:\Windows\System\evobQTw.exe
  C:\Windows\System\evobQTw.exe
  2⤵
  PID:5940
- C:\Windows\System\YfJHqMD.exe
  C:\Windows\System\YfJHqMD.exe
  2⤵
  PID:5976
- C:\Windows\System\gKoOzIq.exe
  C:\Windows\System\gKoOzIq.exe
  2⤵
  PID:9644
- C:\Windows\System\klNELWM.exe
  C:\Windows\System\klNELWM.exe
  2⤵
  PID:9684
- C:\Windows\System\smKAQof.exe
  C:\Windows\System\smKAQof.exe
  2⤵
  PID:3652
- C:\Windows\System\BVEPxqu.exe
  C:\Windows\System\BVEPxqu.exe
  2⤵
  PID:2476
- C:\Windows\System\GMgBqKM.exe
  C:\Windows\System\GMgBqKM.exe
  2⤵
  PID:6508
- C:\Windows\System\OwkWAsm.exe
  C:\Windows\System\OwkWAsm.exe
  2⤵
  PID:2660
- C:\Windows\System\QoUkytE.exe
  C:\Windows\System\QoUkytE.exe
  2⤵
  PID:6064
- C:\Windows\System\JCagIAn.exe
  C:\Windows\System\JCagIAn.exe
  2⤵
  PID:7548
- C:\Windows\System\YYtXKSc.exe
  C:\Windows\System\YYtXKSc.exe
  2⤵
  PID:7604
- C:\Windows\System\mHKNPAt.exe
  C:\Windows\System\mHKNPAt.exe
  2⤵
  PID:7644
- C:\Windows\System\BGpUbdl.exe
  C:\Windows\System\BGpUbdl.exe
  2⤵
  PID:1784
- C:\Windows\System\uDoAadU.exe
  C:\Windows\System\uDoAadU.exe
  2⤵
  PID:7964
- C:\Windows\System\mJfPJdU.exe
  C:\Windows\System\mJfPJdU.exe
  2⤵
  PID:1076
- C:\Windows\System\VGuSSnn.exe
  C:\Windows\System\VGuSSnn.exe
  2⤵
  PID:3328
- C:\Windows\System\gbJUNdM.exe
  C:\Windows\System\gbJUNdM.exe
  2⤵
  PID:10084
- C:\Windows\System\TnsLUfZ.exe
  C:\Windows\System\TnsLUfZ.exe
  2⤵
  PID:10112
- C:\Windows\System\dxHGTQw.exe
  C:\Windows\System\dxHGTQw.exe
  2⤵
  PID:10164
- C:\Windows\System\dfCNGdj.exe
  C:\Windows\System\dfCNGdj.exe
  2⤵
  PID:9280
- C:\Windows\System\FIdGMPh.exe
  C:\Windows\System\FIdGMPh.exe
  2⤵
  PID:8000
- C:\Windows\System\qRVVooG.exe
  C:\Windows\System\qRVVooG.exe
  2⤵
  PID:10680
- C:\Windows\System\mqlDvXe.exe
  C:\Windows\System\mqlDvXe.exe
  2⤵
  PID:1152
- C:\Windows\System\hkYWdWK.exe
  C:\Windows\System\hkYWdWK.exe
  2⤵
  PID:9504
- C:\Windows\System\KreyGqi.exe
  C:\Windows\System\KreyGqi.exe
  2⤵
  PID:7512
- C:\Windows\System\qLtczfd.exe
  C:\Windows\System\qLtczfd.exe
  2⤵
  PID:7584
- C:\Windows\System\XrdQsLd.exe
  C:\Windows\System\XrdQsLd.exe
  2⤵
  PID:4884
- C:\Windows\System\YpRkFWL.exe
  C:\Windows\System\YpRkFWL.exe
  2⤵
  PID:3420
- C:\Windows\System\GuRQyaF.exe
  C:\Windows\System\GuRQyaF.exe
  2⤵
  PID:9604
- C:\Windows\System\fpuYxda.exe
  C:\Windows\System\fpuYxda.exe
  2⤵
  PID:9640
- C:\Windows\System\sCzsYKW.exe
  C:\Windows\System\sCzsYKW.exe
  2⤵
  PID:12820
- C:\Windows\System\KejMxLG.exe
  C:\Windows\System\KejMxLG.exe
  2⤵
  PID:12780
- C:\Windows\System\gDHSCla.exe
  C:\Windows\System\gDHSCla.exe
  2⤵
  PID:3340
- C:\Windows\System\brXMSVy.exe
  C:\Windows\System\brXMSVy.exe
  2⤵
  PID:5284
- C:\Windows\System\hsLjcYN.exe
  C:\Windows\System\hsLjcYN.exe
  2⤵
  PID:8092
- C:\Windows\System\exDzioV.exe
  C:\Windows\System\exDzioV.exe
  2⤵
  PID:2816
- C:\Windows\System\dNFEuYN.exe
  C:\Windows\System\dNFEuYN.exe
  2⤵
  PID:3364
- C:\Windows\System\oTmrMuK.exe
  C:\Windows\System\oTmrMuK.exe
  2⤵
  PID:7296
- C:\Windows\System\YBqJLeo.exe
  C:\Windows\System\YBqJLeo.exe
  2⤵
  PID:712
- C:\Windows\System\SpotaTq.exe
  C:\Windows\System\SpotaTq.exe
  2⤵
  PID:10132
- C:\Windows\System\UMQwdMw.exe
  C:\Windows\System\UMQwdMw.exe
  2⤵
  PID:10108
- C:\Windows\System\rvhajRP.exe
  C:\Windows\System\rvhajRP.exe
  2⤵
  PID:4876
- C:\Windows\System\vVCeqkH.exe
  C:\Windows\System\vVCeqkH.exe
  2⤵
  PID:5564
- C:\Windows\System\rfUbQKj.exe
  C:\Windows\System\rfUbQKj.exe
  2⤵
  PID:7580
- C:\Windows\System\LNkUclN.exe
  C:\Windows\System\LNkUclN.exe
  2⤵
  PID:3320
- C:\Windows\System\hLxGEaO.exe
  C:\Windows\System\hLxGEaO.exe
  2⤵
  PID:9616
- C:\Windows\System\rHxnwYU.exe
  C:\Windows\System\rHxnwYU.exe
  2⤵
  PID:12952
- C:\Windows\System\CMfzmWy.exe
  C:\Windows\System\CMfzmWy.exe
  2⤵
  PID:5732
- C:\Windows\System\yhpSNXo.exe
  C:\Windows\System\yhpSNXo.exe
  2⤵
  PID:5816
- C:\Windows\System\AQyeaJI.exe
  C:\Windows\System\AQyeaJI.exe
  2⤵
  PID:8340
- C:\Windows\System\VrdRpiV.exe
  C:\Windows\System\VrdRpiV.exe
  2⤵
  PID:8452
- C:\Windows\System\KEclHBF.exe
  C:\Windows\System\KEclHBF.exe
  2⤵
  PID:8600
- C:\Windows\System\eznJRaL.exe
  C:\Windows\System\eznJRaL.exe
  2⤵
  PID:8636
- C:\Windows\System\LUssdXZ.exe
  C:\Windows\System\LUssdXZ.exe
  2⤵
  PID:5956
- C:\Windows\System\uvGEpjl.exe
  C:\Windows\System\uvGEpjl.exe
  2⤵
  PID:5152
- C:\Windows\System\cDWllZQ.exe
  C:\Windows\System\cDWllZQ.exe
  2⤵
  PID:1804
- C:\Windows\System\rChBWZO.exe
  C:\Windows\System\rChBWZO.exe
  2⤵
  PID:2360
- C:\Windows\System\UBZUoUE.exe
  C:\Windows\System\UBZUoUE.exe
  2⤵
  PID:6072
- C:\Windows\System\ajeZjaO.exe
  C:\Windows\System\ajeZjaO.exe
  2⤵
  PID:4856
- C:\Windows\System\hwgGsJP.exe
  C:\Windows\System\hwgGsJP.exe
  2⤵
  PID:6076
- C:\Windows\System\pkcODzj.exe
  C:\Windows\System\pkcODzj.exe
  2⤵
  PID:8960
- C:\Windows\System\YrTmYCT.exe
  C:\Windows\System\YrTmYCT.exe
  2⤵
  PID:5308
- C:\Windows\System\NnvrodN.exe
  C:\Windows\System\NnvrodN.exe
  2⤵
  PID:12720
- C:\Windows\System\AVIByJe.exe
  C:\Windows\System\AVIByJe.exe
  2⤵
  PID:1380
- C:\Windows\System\yhkspGF.exe
  C:\Windows\System\yhkspGF.exe
  2⤵
  PID:9044
- C:\Windows\System\CsXgfaJ.exe
  C:\Windows\System\CsXgfaJ.exe
  2⤵
  PID:5280
- C:\Windows\System\WMBbjuJ.exe
  C:\Windows\System\WMBbjuJ.exe
  2⤵
  PID:13224
- C:\Windows\System\TXaNSPq.exe
  C:\Windows\System\TXaNSPq.exe
  2⤵
  PID:5352
- C:\Windows\System\nOenIns.exe
  C:\Windows\System\nOenIns.exe
  2⤵
  PID:13172
- C:\Windows\System\imRERvk.exe
  C:\Windows\System\imRERvk.exe
  2⤵
  PID:5400
- C:\Windows\System\EjgNAIp.exe
  C:\Windows\System\EjgNAIp.exe
  2⤵
  PID:6312
- C:\Windows\System\wipQtWs.exe
  C:\Windows\System\wipQtWs.exe
  2⤵
  PID:5676
- C:\Windows\System\IXLQmyp.exe
  C:\Windows\System\IXLQmyp.exe
  2⤵
  PID:1416
- C:\Windows\System\QyJXCAS.exe
  C:\Windows\System\QyJXCAS.exe
  2⤵
  PID:6568
- C:\Windows\System\FPxeErr.exe
  C:\Windows\System\FPxeErr.exe
  2⤵
  PID:5552
- C:\Windows\System\zRYFAwV.exe
  C:\Windows\System\zRYFAwV.exe
  2⤵
  PID:6868
- C:\Windows\System\EbDBZjE.exe
  C:\Windows\System\EbDBZjE.exe
  2⤵
  PID:5796
- C:\Windows\System\nqyYXex.exe
  C:\Windows\System\nqyYXex.exe
  2⤵
  PID:10936
- C:\Windows\System\UlpriLZ.exe
  C:\Windows\System\UlpriLZ.exe
  2⤵
  PID:13284
- C:\Windows\System\BBqpkct.exe
  C:\Windows\System\BBqpkct.exe
  2⤵
  PID:11004
- C:\Windows\System\MMgKhLC.exe
  C:\Windows\System\MMgKhLC.exe
  2⤵
  PID:7096
- C:\Windows\System\bdPfPTe.exe
  C:\Windows\System\bdPfPTe.exe
  2⤵
  PID:5964
- C:\Windows\System\kMLhVjX.exe
  C:\Windows\System\kMLhVjX.exe
  2⤵
  PID:11120
- C:\Windows\System\PjQBjZN.exe
  C:\Windows\System\PjQBjZN.exe
  2⤵
  PID:12748
- C:\Windows\System\KGGNgCZ.exe
  C:\Windows\System\KGGNgCZ.exe
  2⤵
  PID:5640
- C:\Windows\System\pCyTKxH.exe
  C:\Windows\System\pCyTKxH.exe
  2⤵
  PID:5668
- C:\Windows\System\VLocsJp.exe
  C:\Windows\System\VLocsJp.exe
  2⤵
  PID:3760
- C:\Windows\System\bGuZoJT.exe
  C:\Windows\System\bGuZoJT.exe
  2⤵
  PID:10280
- C:\Windows\System\jugLCrR.exe
  C:\Windows\System\jugLCrR.exe
  2⤵
  PID:10292
- C:\Windows\System\PnTlAgr.exe
  C:\Windows\System\PnTlAgr.exe
  2⤵
  PID:3200
- C:\Windows\System\PWTFHEE.exe
  C:\Windows\System\PWTFHEE.exe
  2⤵
  PID:5728
- C:\Windows\System\CySdISV.exe
  C:\Windows\System\CySdISV.exe
  2⤵
  PID:5772
- C:\Windows\System\wasRaNg.exe
  C:\Windows\System\wasRaNg.exe
  2⤵
  PID:5784
- C:\Windows\System\KbEciJm.exe
  C:\Windows\System\KbEciJm.exe
  2⤵
  PID:3584
- C:\Windows\System\ZZDkTyT.exe
  C:\Windows\System\ZZDkTyT.exe
  2⤵
  PID:10368
- C:\Windows\System\WigyRpI.exe
  C:\Windows\System\WigyRpI.exe
  2⤵
  PID:4980
- C:\Windows\System\iZONqpT.exe
  C:\Windows\System\iZONqpT.exe
  2⤵
  PID:13008
- C:\Windows\System\kccUHVU.exe
  C:\Windows\System\kccUHVU.exe
  2⤵
  PID:1568
- C:\Windows\System\dJSeuWP.exe
  C:\Windows\System\dJSeuWP.exe
  2⤵
  PID:10440
- C:\Windows\System\iVllXEZ.exe
  C:\Windows\System\iVllXEZ.exe
  2⤵
  PID:12460
- C:\Windows\System\SsTxQUt.exe
  C:\Windows\System\SsTxQUt.exe
  2⤵
  PID:2124
- C:\Windows\System\UCyExtK.exe
  C:\Windows\System\UCyExtK.exe
  2⤵
  PID:452
- C:\Windows\System\JoyMNqB.exe
  C:\Windows\System\JoyMNqB.exe
  2⤵
  PID:12436
- C:\Windows\System\whmTQUd.exe
  C:\Windows\System\whmTQUd.exe
  2⤵
  PID:3596
- C:\Windows\System\MJNVSIr.exe
  C:\Windows\System\MJNVSIr.exe
  2⤵
  PID:12576
- C:\Windows\System\PCVfGBN.exe
  C:\Windows\System\PCVfGBN.exe
  2⤵
  PID:4664
- C:\Windows\System\zSjRkPw.exe
  C:\Windows\System\zSjRkPw.exe
  2⤵
  PID:7576
- C:\Windows\System\XJlmJMw.exe
  C:\Windows\System\XJlmJMw.exe
  2⤵
  PID:6092
- C:\Windows\System\STGVLyG.exe
  C:\Windows\System\STGVLyG.exe
  2⤵
  PID:7720
- C:\Windows\System\HhFAzDT.exe
  C:\Windows\System\HhFAzDT.exe
  2⤵
  PID:2784
- C:\Windows\System\taFwOOD.exe
  C:\Windows\System\taFwOOD.exe
  2⤵
  PID:10444
- C:\Windows\System\TWhFLzn.exe
  C:\Windows\System\TWhFLzn.exe
  2⤵
  PID:10668
- C:\Windows\System\YXfCtqa.exe
  C:\Windows\System\YXfCtqa.exe
  2⤵
  PID:10104
- C:\Windows\System\DCPxwOZ.exe
  C:\Windows\System\DCPxwOZ.exe
  2⤵
  PID:9248
- C:\Windows\System\BdypWVo.exe
  C:\Windows\System\BdypWVo.exe
  2⤵
  PID:4676
- C:\Windows\System\xBPVVYB.exe
  C:\Windows\System\xBPVVYB.exe
  2⤵
  PID:11044
- C:\Windows\System\FxiashS.exe
  C:\Windows\System\FxiashS.exe
  2⤵
  PID:1824
- C:\Windows\System\uSBmAvo.exe
  C:\Windows\System\uSBmAvo.exe
  2⤵
  PID:9740
- C:\Windows\System\zJEgZeg.exe
  C:\Windows\System\zJEgZeg.exe
  2⤵
  PID:11128
- C:\Windows\System\RSMUECL.exe
  C:\Windows\System\RSMUECL.exe
  2⤵
  PID:10300
- C:\Windows\System\QjVvviM.exe
  C:\Windows\System\QjVvviM.exe
  2⤵
  PID:11320
- C:\Windows\System\JBAKgQb.exe
  C:\Windows\System\JBAKgQb.exe
  2⤵
  PID:10228
- C:\Windows\System\FMUpTOm.exe
  C:\Windows\System\FMUpTOm.exe
  2⤵
  PID:9388
- C:\Windows\System\VRQVoOt.exe
  C:\Windows\System\VRQVoOt.exe
  2⤵
  PID:6320
- C:\Windows\System\XFbjfsX.exe
  C:\Windows\System\XFbjfsX.exe
  2⤵
  PID:9568
- C:\Windows\System\oRjMvjy.exe
  C:\Windows\System\oRjMvjy.exe
  2⤵
  PID:636
- C:\Windows\System\GnssQFE.exe
  C:\Windows\System\GnssQFE.exe
  2⤵
  PID:3272
- C:\Windows\System\VsctUXc.exe
  C:\Windows\System\VsctUXc.exe
  2⤵
  PID:2680
- C:\Windows\System\mcOCBWG.exe
  C:\Windows\System\mcOCBWG.exe
  2⤵
  PID:11428
- C:\Windows\System\tiXbojX.exe
  C:\Windows\System\tiXbojX.exe
  2⤵
  PID:11436
- C:\Windows\System\UkzMEES.exe
  C:\Windows\System\UkzMEES.exe
  2⤵
  PID:6348
- C:\Windows\System\PxprJfQ.exe
  C:\Windows\System\PxprJfQ.exe
  2⤵
  PID:9944
- C:\Windows\System\CYYhEjI.exe
  C:\Windows\System\CYYhEjI.exe
  2⤵
  PID:1336
- C:\Windows\System\FKJlrds.exe
  C:\Windows\System\FKJlrds.exe
  2⤵
  PID:6416
- C:\Windows\System\kKHHCgD.exe
  C:\Windows\System\kKHHCgD.exe
  2⤵
  PID:11516
- C:\Windows\System\ezuSodV.exe
  C:\Windows\System\ezuSodV.exe
  2⤵
  PID:9816
- C:\Windows\System\wiRFuJf.exe
  C:\Windows\System\wiRFuJf.exe
  2⤵
  PID:6472
- C:\Windows\System\UUlEXTa.exe
  C:\Windows\System\UUlEXTa.exe
  2⤵
  PID:13100
- C:\Windows\System\xluZGNZ.exe
  C:\Windows\System\xluZGNZ.exe
  2⤵
  PID:6544
- C:\Windows\System\SboWkKu.exe
  C:\Windows\System\SboWkKu.exe
  2⤵
  PID:7704
- C:\Windows\System\uiZxZrC.exe
  C:\Windows\System\uiZxZrC.exe
  2⤵
  PID:5700
- C:\Windows\System\HkpIgcY.exe
  C:\Windows\System\HkpIgcY.exe
  2⤵
  PID:9292
- C:\Windows\System\POfKCYf.exe
  C:\Windows\System\POfKCYf.exe
  2⤵
  PID:6596
- C:\Windows\System\cqFFzWE.exe
  C:\Windows\System\cqFFzWE.exe
  2⤵
  PID:2532
- C:\Windows\System\NiVQMbU.exe
  C:\Windows\System\NiVQMbU.exe
  2⤵
  PID:2412
- C:\Windows\System\gwDsgdr.exe
  C:\Windows\System\gwDsgdr.exe
  2⤵
  PID:5760
- C:\Windows\System\RJbfhWI.exe
  C:\Windows\System\RJbfhWI.exe
  2⤵
  PID:12352
- C:\Windows\System\XnwmPPH.exe
  C:\Windows\System\XnwmPPH.exe
  2⤵
  PID:8424
- C:\Windows\System\PrXfdhj.exe
  C:\Windows\System\PrXfdhj.exe
  2⤵
  PID:6684
- C:\Windows\System\YOoxFXz.exe
  C:\Windows\System\YOoxFXz.exe
  2⤵
  PID:8656
- C:\Windows\System\RhBDRZn.exe
  C:\Windows\System\RhBDRZn.exe
  2⤵
  PID:3708
- C:\Windows\System\zrxcHUH.exe
  C:\Windows\System\zrxcHUH.exe
  2⤵
  PID:5076
- C:\Windows\System\dSFyZvJ.exe
  C:\Windows\System\dSFyZvJ.exe
  2⤵
  PID:956
- C:\Windows\System\IRDbFMN.exe
  C:\Windows\System\IRDbFMN.exe
  2⤵
  PID:5080
- C:\Windows\System\dQFtbWl.exe
  C:\Windows\System\dQFtbWl.exe
  2⤵
  PID:7768
- C:\Windows\System\pQhqPUP.exe
  C:\Windows\System\pQhqPUP.exe
  2⤵
  PID:12980
- C:\Windows\System\BtrqGBW.exe
  C:\Windows\System\BtrqGBW.exe
  2⤵
  PID:4296
- C:\Windows\System\AEmvUST.exe
  C:\Windows\System\AEmvUST.exe
  2⤵
  PID:12840
- C:\Windows\System\zAmKpWY.exe
  C:\Windows\System\zAmKpWY.exe
  2⤵
  PID:11364
- C:\Windows\System\dASTLEZ.exe
  C:\Windows\System\dASTLEZ.exe
  2⤵
  PID:13152
- C:\Windows\System\mpcfqLV.exe
  C:\Windows\System\mpcfqLV.exe
  2⤵
  PID:11520
- C:\Windows\System\RebpTrW.exe
  C:\Windows\System\RebpTrW.exe
  2⤵
  PID:6992
- C:\Windows\System\sNqJmAv.exe
  C:\Windows\System\sNqJmAv.exe
  2⤵
  PID:8456
- C:\Windows\System\jFVbDDJ.exe
  C:\Windows\System\jFVbDDJ.exe
  2⤵
  PID:5680
- C:\Windows\System\CyzpTwo.exe
  C:\Windows\System\CyzpTwo.exe
  2⤵
  PID:7048
- C:\Windows\System\nrfNnpv.exe
  C:\Windows\System\nrfNnpv.exe
  2⤵
  PID:7464
- C:\Windows\System\brHhDkP.exe
  C:\Windows\System\brHhDkP.exe
  2⤵
  PID:8944
- C:\Windows\System\iTzpEBz.exe
  C:\Windows\System\iTzpEBz.exe
  2⤵
  PID:12180
- C:\Windows\System\BHbzbaX.exe
  C:\Windows\System\BHbzbaX.exe
  2⤵
  PID:9076
- C:\Windows\System\IauZxrT.exe
  C:\Windows\System\IauZxrT.exe
  2⤵
  PID:11100
- C:\Windows\System\ahQkXku.exe
  C:\Windows\System\ahQkXku.exe
  2⤵
  PID:1072
- C:\Windows\System\QkNCkPN.exe
  C:\Windows\System\QkNCkPN.exe
  2⤵
  PID:4384
- C:\Windows\System\TUUEjLg.exe
  C:\Windows\System\TUUEjLg.exe
  2⤵
  PID:8812
- C:\Windows\System\RjVVHZV.exe
  C:\Windows\System\RjVVHZV.exe
  2⤵
  PID:5708
- C:\Windows\System\AlDskuL.exe
  C:\Windows\System\AlDskuL.exe
  2⤵
  PID:2440
- C:\Windows\System\APzxwNm.exe
  C:\Windows\System\APzxwNm.exe
  2⤵
  PID:11104
- C:\Windows\System\AaXgHsY.exe
  C:\Windows\System\AaXgHsY.exe
  2⤵
  PID:5484
- C:\Windows\System\bxDkMqW.exe
  C:\Windows\System\bxDkMqW.exe
  2⤵
  PID:5848
- C:\Windows\System\UecKUAB.exe
  C:\Windows\System\UecKUAB.exe
  2⤵
  PID:13268
- C:\Windows\System\tIEzvel.exe
  C:\Windows\System\tIEzvel.exe
  2⤵
  PID:692
- C:\Windows\System\rtluHpn.exe
  C:\Windows\System\rtluHpn.exe
  2⤵
  PID:9536
- C:\Windows\System\AXTAXOF.exe
  C:\Windows\System\AXTAXOF.exe
  2⤵
  PID:4948
- C:\Windows\System\GQEJhrT.exe
  C:\Windows\System\GQEJhrT.exe
  2⤵
  PID:6152
- C:\Windows\System\hwXPpzI.exe
  C:\Windows\System\hwXPpzI.exe
  2⤵
  PID:6008
- C:\Windows\System\XpPbAVx.exe
  C:\Windows\System\XpPbAVx.exe
  2⤵
  PID:7568
- C:\Windows\System\sMhZSLj.exe
  C:\Windows\System\sMhZSLj.exe
  2⤵
  PID:12596
- C:\Windows\System\TfOAfaY.exe
  C:\Windows\System\TfOAfaY.exe
  2⤵
  PID:4548
- C:\Windows\System\ibqiCWX.exe
  C:\Windows\System\ibqiCWX.exe
  2⤵
  PID:10724
- C:\Windows\System\XWKcwCZ.exe
  C:\Windows\System\XWKcwCZ.exe
  2⤵
  PID:7936
- C:\Windows\System\EVotcsn.exe
  C:\Windows\System\EVotcsn.exe
  2⤵
  PID:10120
- C:\Windows\System\BZsuYcL.exe
  C:\Windows\System\BZsuYcL.exe
  2⤵
  PID:12812
- C:\Windows\System\xBcAgGX.exe
  C:\Windows\System\xBcAgGX.exe
  2⤵
  PID:9340
- C:\Windows\System\IoTyxST.exe
  C:\Windows\System\IoTyxST.exe
  2⤵
  PID:11324
- C:\Windows\System\BglPYGx.exe
  C:\Windows\System\BglPYGx.exe
  2⤵
  PID:2052
- C:\Windows\System\BwwgrHR.exe
  C:\Windows\System\BwwgrHR.exe
  2⤵
  PID:12808
- C:\Windows\System\kLqDilS.exe
  C:\Windows\System\kLqDilS.exe
  2⤵
  PID:3252
- C:\Windows\System\XFhPGrZ.exe
  C:\Windows\System\XFhPGrZ.exe
  2⤵
  PID:4668
- C:\Windows\System\YtCaKbS.exe
  C:\Windows\System\YtCaKbS.exe
  2⤵
  PID:13092
- C:\Windows\System\cpzzvQZ.exe
  C:\Windows\System\cpzzvQZ.exe
  2⤵
  PID:13072
- C:\Windows\System\XXwMcAP.exe
  C:\Windows\System\XXwMcAP.exe
  2⤵
  PID:11072
- C:\Windows\System\eKcAsLg.exe
  C:\Windows\System\eKcAsLg.exe
  2⤵
  PID:11152
- C:\Windows\System\SWArYxO.exe
  C:\Windows\System\SWArYxO.exe
  2⤵
  PID:10408
- C:\Windows\System\fOHQOsl.exe
  C:\Windows\System\fOHQOsl.exe
  2⤵
  PID:6388
- C:\Windows\System\ijrlHDj.exe
  C:\Windows\System\ijrlHDj.exe
  2⤵
  PID:13096
- C:\Windows\System\fkTQJTK.exe
  C:\Windows\System\fkTQJTK.exe
  2⤵
  PID:6384
- C:\Windows\System\GFrjLGu.exe
  C:\Windows\System\GFrjLGu.exe
  2⤵
  PID:4604
- C:\Windows\System\DPaONPw.exe
  C:\Windows\System\DPaONPw.exe
  2⤵
  PID:5408
- C:\Windows\System\KrZHLom.exe
  C:\Windows\System\KrZHLom.exe
  2⤵
  PID:5348
- C:\Windows\System\AtEdmuK.exe
  C:\Windows\System\AtEdmuK.exe
  2⤵
  PID:10196
- C:\Windows\System\PniupmI.exe
  C:\Windows\System\PniupmI.exe
  2⤵
  PID:5624
- C:\Windows\System\lxCCRqQ.exe
  C:\Windows\System\lxCCRqQ.exe
  2⤵
  PID:8488
- C:\Windows\System\vgbJuMl.exe
  C:\Windows\System\vgbJuMl.exe
  2⤵
  PID:4172
- C:\Windows\System\euAtLpr.exe
  C:\Windows\System\euAtLpr.exe
  2⤵
  PID:3076
- C:\Windows\System\JEOvFtV.exe
  C:\Windows\System\JEOvFtV.exe
  2⤵
  PID:1196
- C:\Windows\System\CcMPEwm.exe
  C:\Windows\System\CcMPEwm.exe
  2⤵
  PID:2892
- C:\Windows\System\nqbbcXx.exe
  C:\Windows\System\nqbbcXx.exe
  2⤵
  PID:3260
- C:\Windows\System\YiQyIGd.exe
  C:\Windows\System\YiQyIGd.exe
  2⤵
  PID:5432
- C:\Windows\System\XnpgeqH.exe
  C:\Windows\System\XnpgeqH.exe
  2⤵
  PID:5428
- C:\Windows\System\rpLALBV.exe
  C:\Windows\System\rpLALBV.exe
  2⤵
  PID:8300
- C:\Windows\System\xnWulpJ.exe
  C:\Windows\System\xnWulpJ.exe
  2⤵
  PID:5908
- C:\Windows\System\ZnGvctt.exe
  C:\Windows\System\ZnGvctt.exe
  2⤵
  PID:11008
- C:\Windows\System\FTFvjAr.exe
  C:\Windows\System\FTFvjAr.exe
  2⤵
  PID:12132
- C:\Windows\System\iLKFnUe.exe
  C:\Windows\System\iLKFnUe.exe
  2⤵
  PID:6392
- C:\Windows\System\zFwPdrn.exe
  C:\Windows\System\zFwPdrn.exe
  2⤵
  PID:7316
- C:\Windows\System\ihvWFDy.exe
  C:\Windows\System\ihvWFDy.exe
  2⤵
  PID:7320
- C:\Windows\System\QscgKIM.exe
  C:\Windows\System\QscgKIM.exe
  2⤵
  PID:2380
- C:\Windows\System\aYSfzgR.exe
  C:\Windows\System\aYSfzgR.exe
  2⤵
  PID:8652
- C:\Windows\System\AiTAmgB.exe
  C:\Windows\System\AiTAmgB.exe
  2⤵
  PID:7424
- C:\Windows\System\xqKwcVI.exe
  C:\Windows\System\xqKwcVI.exe
  2⤵
  PID:9812
- C:\Windows\System\FTTdblq.exe
  C:\Windows\System\FTTdblq.exe
  2⤵
  PID:380
- C:\Windows\System\bfPbvsl.exe
  C:\Windows\System\bfPbvsl.exe
  2⤵
  PID:9296
- C:\Windows\System\usVSEeW.exe
  C:\Windows\System\usVSEeW.exe
  2⤵
  PID:12332
- C:\Windows\System\cxsvosf.exe
  C:\Windows\System\cxsvosf.exe
  2⤵
  PID:10488
- C:\Windows\System\mKucHgN.exe
  C:\Windows\System\mKucHgN.exe
  2⤵
  PID:9708
- C:\Windows\System\FQFaDlv.exe
  C:\Windows\System\FQFaDlv.exe
  2⤵
  PID:11016
- C:\Windows\System\TYekPGK.exe
  C:\Windows\System\TYekPGK.exe
  2⤵
  PID:3264
- C:\Windows\System\ozqcAJB.exe
  C:\Windows\System\ozqcAJB.exe
  2⤵
  PID:7856
- C:\Windows\System\azOqsAC.exe
  C:\Windows\System\azOqsAC.exe
  2⤵
  PID:6120
- C:\Windows\System\JtbsZUi.exe
  C:\Windows\System\JtbsZUi.exe
  2⤵
  PID:12920
- C:\Windows\System\TKZGfnD.exe
  C:\Windows\System\TKZGfnD.exe
  2⤵
  PID:7952
- C:\Windows\System\BBJLZcj.exe
  C:\Windows\System\BBJLZcj.exe
  2⤵
  PID:6276
- C:\Windows\System\MxsKUMg.exe
  C:\Windows\System\MxsKUMg.exe
  2⤵
  PID:4600
- C:\Windows\System\qNeqzcv.exe
  C:\Windows\System\qNeqzcv.exe
  2⤵
  PID:3372
- C:\Windows\System\iHAboOq.exe
  C:\Windows\System\iHAboOq.exe
  2⤵
  PID:13040
- C:\Windows\System\UkgREBP.exe
  C:\Windows\System\UkgREBP.exe
  2⤵
  PID:8132
- C:\Windows\System\NPlBgjs.exe
  C:\Windows\System\NPlBgjs.exe
  2⤵
  PID:13080
- C:\Windows\System\xPSsRgt.exe
  C:\Windows\System\xPSsRgt.exe
  2⤵
  PID:7200
- C:\Windows\System\JUSdWpT.exe
  C:\Windows\System\JUSdWpT.exe
  2⤵
  PID:7276
- C:\Windows\System\bgPEAbH.exe
  C:\Windows\System\bgPEAbH.exe
  2⤵
  PID:6232
- C:\Windows\System\LpgKEAQ.exe
  C:\Windows\System\LpgKEAQ.exe
  2⤵
  PID:7440
- C:\Windows\System\cdEUMjA.exe
  C:\Windows\System\cdEUMjA.exe
  2⤵
  PID:7388
- C:\Windows\System\lGqYzYl.exe
  C:\Windows\System\lGqYzYl.exe
  2⤵
  PID:11424
- C:\Windows\System\vgxgqFh.exe
  C:\Windows\System\vgxgqFh.exe
  2⤵
  PID:7760
- C:\Windows\System\afoaJKi.exe
  C:\Windows\System\afoaJKi.exe
  2⤵
  PID:4656
- C:\Windows\System\dnNnmBX.exe
  C:\Windows\System\dnNnmBX.exe
  2⤵
  PID:8012
- C:\Windows\System\ZSISZOx.exe
  C:\Windows\System\ZSISZOx.exe
  2⤵
  PID:4512
- C:\Windows\System\HAlwPAZ.exe
  C:\Windows\System\HAlwPAZ.exe
  2⤵
  PID:6584
- C:\Windows\System\yTthTcT.exe
  C:\Windows\System\yTthTcT.exe
  2⤵
  PID:4316
- C:\Windows\System\cCyAyeK.exe
  C:\Windows\System\cCyAyeK.exe
  2⤵
  PID:8608
- C:\Windows\System\vGxwHFU.exe
  C:\Windows\System\vGxwHFU.exe
  2⤵
  PID:5608
- C:\Windows\System\ksKtRxN.exe
  C:\Windows\System\ksKtRxN.exe
  2⤵
  PID:5052
- C:\Windows\System\GOLuChX.exe
  C:\Windows\System\GOLuChX.exe
  2⤵
  PID:6100
- C:\Windows\System\CumATeS.exe
  C:\Windows\System\CumATeS.exe
  2⤵
  PID:6256
- C:\Windows\System\vJWdkgE.exe
  C:\Windows\System\vJWdkgE.exe
  2⤵
  PID:12124
- C:\Windows\System\lLyBOQu.exe
  C:\Windows\System\lLyBOQu.exe
  2⤵
  PID:7572
- C:\Windows\System\toQszNW.exe
  C:\Windows\System\toQszNW.exe
  2⤵
  PID:7728
- C:\Windows\System\dOwKXbK.exe
  C:\Windows\System\dOwKXbK.exe
  2⤵
  PID:8076
- C:\Windows\System\TffeJfg.exe
  C:\Windows\System\TffeJfg.exe
  2⤵
  PID:7084
- C:\Windows\System\PABQPHD.exe
  C:\Windows\System\PABQPHD.exe
  2⤵
  PID:3980
- C:\Windows\System\osiSbxR.exe
  C:\Windows\System\osiSbxR.exe
  2⤵
  PID:4460
- C:\Windows\System\MtvnAZO.exe
  C:\Windows\System\MtvnAZO.exe
  2⤵
  PID:7088
- C:\Windows\System\TRdmsHu.exe
  C:\Windows\System\TRdmsHu.exe
  2⤵
  PID:8256
- C:\Windows\System\rNpXMwt.exe
  C:\Windows\System\rNpXMwt.exe
  2⤵
  PID:5196
- C:\Windows\System\GXrPsWy.exe
  C:\Windows\System\GXrPsWy.exe
  2⤵
  PID:3032
- C:\Windows\System\FkmIjnK.exe
  C:\Windows\System\FkmIjnK.exe
  2⤵
  PID:11208
- C:\Windows\System\dtHuADT.exe
  C:\Windows\System\dtHuADT.exe
  2⤵
  PID:3780
- C:\Windows\System\gcFDCVS.exe
  C:\Windows\System\gcFDCVS.exe
  2⤵
  PID:8
- C:\Windows\System\GhPcGQN.exe
  C:\Windows\System\GhPcGQN.exe
  2⤵
  PID:6224
- C:\Windows\System\YntUrmZ.exe
  C:\Windows\System\YntUrmZ.exe
  2⤵
  PID:7472
- C:\Windows\System\iAiVTnJ.exe
  C:\Windows\System\iAiVTnJ.exe
  2⤵
  PID:6164
- C:\Windows\System\wOJopLQ.exe
  C:\Windows\System\wOJopLQ.exe
  2⤵
  PID:10208
- C:\Windows\System\TKehxXN.exe
  C:\Windows\System\TKehxXN.exe
  2⤵
  PID:12960
- C:\Windows\System\AglvCVa.exe
  C:\Windows\System\AglvCVa.exe
  2⤵
  PID:8176
- C:\Windows\System\CmRvuQn.exe
  C:\Windows\System\CmRvuQn.exe
  2⤵
  PID:8832
- C:\Windows\System\krNXvSW.exe
  C:\Windows\System\krNXvSW.exe
  2⤵
  PID:5140
- C:\Windows\System\lFnZbqd.exe
  C:\Windows\System\lFnZbqd.exe
  2⤵
  PID:8976
- C:\Windows\System\unVaPMb.exe
  C:\Windows\System\unVaPMb.exe
  2⤵
  PID:9032
- C:\Windows\System\wMqQgzQ.exe
  C:\Windows\System\wMqQgzQ.exe
  2⤵
  PID:7372
- C:\Windows\System\klZezHI.exe
  C:\Windows\System\klZezHI.exe
  2⤵
  PID:5704
- C:\Windows\System\AjExdjW.exe
  C:\Windows\System\AjExdjW.exe
  2⤵
  PID:7812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_445rhdvg.enh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AdGVmFR.exe

Filesize
1.6MB

MD5
7dce32e64a55aa9f0d4ef9b44e2daf58

SHA1
671e4319cf3c2fb3bdb546fe1115e3acc89fe064

SHA256
6fbfadaad82b139eac4700b17c063ea4e425fca7c2c0c41c3fa90ec718d3a13b

SHA512
0e59b6e1292e5d04b907405f7c4284437870c1334a5ed7815e597a600b3116e882d6eb8fc83e88cfd776352cdff21772e12822a997e8de93997d7bead9f7d0f0

Download Submit
C:\Windows\System\AoXDPLJ.exe

Filesize
1.6MB

MD5
5498e2e149435f78790b62a168b243a5

SHA1
415d71ea00ceb66d716d7c7d12939d6df1d2b16f

SHA256
f152f699e9bce81c54dfbfa50f0c7ab462604035c684a2db835b4e95d84225f4

SHA512
1f7df3d4db2d5e26bc8f38e36b9117e47b2dfe145b51e4316d71eb62589d8d45edf5e127e082d4561e3493f530b8bdee6659355b95ea798e28109b51cba34287

Download Submit
C:\Windows\System\CpnqRKU.exe

Filesize
1.6MB

MD5
d7744e95c7a88aa61c8c832f3989c396

SHA1
8acd3de18e2818eb2cb2c3787ba27c90a7b60958

SHA256
b4ad4b3563310ea450f2eb1c64bd2a30f0a1fa4ffd4e40aed71aee9ee3f514a8

SHA512
136c92f16376d1e7bfdd3eb8d13fb425b960d2cf849ffdff9765aa31dc4e032b25697b5e37b2401810c16607f886860ef2376944bbfc82d02629dfce5338144c

Download Submit
C:\Windows\System\FzPxsNQ.exe

Filesize
1.6MB

MD5
5fe9d0a5451d8f0f0df9af9942cda6ea

SHA1
60ba2bd666ae5f30a922539da0b84e86bdf4563a

SHA256
bddf1061d5777eb4f6deaef243ca0bcb5cc817274c6b215bb9dae768d89b5a93

SHA512
de532cb9b914fe7e0d4193600286c764fc869538722d790116f2b720bb5b3a22604f31727058704cc88a068e689e064e49992316ebd82c8db60c1dcdd775773d

Download Submit
C:\Windows\System\GsxlstI.exe

Filesize
1.6MB

MD5
2a67c937bbaccf499bfdbca16af10bb9

SHA1
38b89e7f8dc791cf51c7e75d08dc4eef74ffd89b

SHA256
c47393ab0d1cc45e3c9d6932586ad86e5e56e60a743c950a0108bc10b7da1326

SHA512
770d5e2897f34431c65517769813bd0433131bea04a1365b8da463bd954447d8b2c1e7a887bd95fcfbc16b0e87955aefb8a6e8f9df307eea477c7b90819272bd

Download Submit
C:\Windows\System\HzqdzIZ.exe

Filesize
1.6MB

MD5
551719907176d4845b76a3ce2220a273

SHA1
baa8e0a183d9d590aa94b7c087610f16082d2c56

SHA256
66ec409dec3c015b5480514e7d55d11433309fa61136ac1abd70e7f7187f5662

SHA512
11e0129f8f2d2a8a381f156ca3d87d6d03cc9639591ff87b6ce86751a5637d9844ddaca1f6fe85559e3fbd521cbf5156839907319fcdfdfe3fe698d8a5f26fc5

Download Submit
C:\Windows\System\IrVHgak.exe

Filesize
1.6MB

MD5
72caffc8486e7d3733aca61e1dc857b2

SHA1
16f78027ba290799b1167ee4467a9fe39a31ae74

SHA256
27e8da09a103fbbaa0c8d4915a1d0e8a657165146ad9a445b6f7d86513312718

SHA512
003ee46ad9d27c1d9939d5934adb416ac5d63e5c7115bd3bfb75552046de1fed4eaff33ccbdfc700fe2bd3b3d0f32359aa8389ead749189ce4ec90450e40f599

Download Submit
C:\Windows\System\JBzuxOT.exe

Filesize
1.6MB

MD5
fb924d991a3256e25149e23e4ed094fd

SHA1
a9de4865fd448e5f0f1a56e049091bab69b35588

SHA256
7ff83135541a0e830d730aead95a5c86442a0dd0754121c7afadcaedc93d261b

SHA512
7da144efea141d5a69c033436a237c67240a301b71475788d9c840e105535e6263f94d252aa23604efd3a682a78ece409dd56624e4dda68a84658a10dd128a3d

Download Submit
C:\Windows\System\JKSaWdU.exe

Filesize
1.6MB

MD5
ed177cbd8ae38988ff3f433f140f1114

SHA1
65d49c2fd445a8c5e685e31eb3b7f743301a918f

SHA256
f3d57d29149a62b13c590263486d0d4309890e11ef99a8166a2fd18613a0b207

SHA512
d36d69f9c4e0f7e87508eb360689431f1dcdccd59af9fa2cb0449a4e983b443aeed8916d595d8ea4d4167000e5720721bd8d3df2d5a006ab06fdb4d2dd3e40dd

Download Submit
C:\Windows\System\JhJZryC.exe

Filesize
1.6MB

MD5
4b1d115bdb5202f350b16815aa80b701

SHA1
141a06186325dba63ebd603ffdce99a6756ba863

SHA256
8c82804dc89eef668034a6f42dff66f831165cbcf24dc66db9901fdafa57fa6a

SHA512
6dcdcefee17f08bf63c142c072f8c98ca013dc6a5affce988fde7c47277d89334dd6784e2f84c627a101b83aef7b0cde0c95cb5b8e171113ab21ab51b4d2159c

Download Submit
C:\Windows\System\KHbbkQi.exe

Filesize
1.6MB

MD5
3079f78adaacd93fa2549a0956e14490

SHA1
db76db847527ace6d14ad7686943e37e646fc1c0

SHA256
1cb0cde1f6882a5627e2ecb006ffd47f63fa366d182f618ab8a015df073e7831

SHA512
0042a2b83621be2dbd04993b3d63127f5903e058a42fab1c04b59794d270f3f430eb5caef6705759f2656158a654435e2ae66fe92073bc4fafce0a6520268f5b

Download Submit
C:\Windows\System\KiJMIgz.exe

Filesize
1.6MB

MD5
08a82e1ddb23255aee1c3845c24d99a2

SHA1
d80ffb9a40556a9331680b05f054f5102d9b3d76

SHA256
6b153c6e80a1c2d03f419c6ff3b516693996330fff359835f87f7990266ab15c

SHA512
948f0a7d901734128155dfb8543e3f34444af273c179c4867f7b18607f47912d7ab3ed1ea74816bca1e67f0e7e61da233e5f89f2804d3947ea1a5a0f48cf440b

Download Submit
C:\Windows\System\LLSeDXl.exe

Filesize
1.6MB

MD5
e453b78c1e977fccf20e1ce5abf9e0a1

SHA1
ce683cd1704589e2491a6f8c74fee81920944a5f

SHA256
89632b680fee38b3a1f1684b1b6313a04732cc1ec7f603f02ef82f980951b333

SHA512
607b7186019f792505ebacaf165a43853b6656a78156bc29fb995028f0837f2e6eb1a1b576e4534ff8081f0ed54ce37c24c289d9980c7d83c6a626ac57043c47

Download Submit
C:\Windows\System\MJvhwPG.exe

Filesize
1.6MB

MD5
2f641ae27128f3c475ed784a90ee0ac0

SHA1
b8aefbba67a091ee435ee5031e133441108af314

SHA256
b98d112bb1351a2d5701b13d98d979cb3436791ff3935c8c3b3a830fbdda6c9a

SHA512
c324701cfe7ce6f436fbd80eb8e32c7385d75b401cbe85fb6b849cbb507c2cbaf9e6045493e698eb7e9936f01f6f8e51e2f90cc657a53b94e8a49b45db7d18d7

Download Submit
C:\Windows\System\MxDBSof.exe

Filesize
1.6MB

MD5
feb4c41fd87b6ed41a7fee86448905b7

SHA1
fecc3022421297bd014839469120c8d444b7ff1c

SHA256
0e0d7718719562023301e1e2d113421c79a7ce956c63cf368c368195f7a7a8a7

SHA512
a0dbcf4426cc578ffc17009973e55bdfbfeafe094fe84006b8c03e1f71f9f0c4c462460d3e421eaa7a09718a44e3475bea482fbdfceae7b268a2ae523093e317

Download Submit
C:\Windows\System\PhdjnIF.exe

Filesize
1.6MB

MD5
f633ff367b533568ac446910075a3de8

SHA1
d0a11f722b97dff16a34fe46479e1e3365a9c5fa

SHA256
9d4667b7c0deba79769d7529517fbcc796534a49adebcb74ab1a374b1b5d3702

SHA512
81b92fb56c86f0038a8c53724613cd898c82668721b6a5e51a327b550607fd564ab80e30505124ae2525c72c03419a768887ce3a93f0e3b678ac834c43a729e3

Download Submit
C:\Windows\System\QcQynjJ.exe

Filesize
1.6MB

MD5
815c8f94a280e901cb35d02af63639fa

SHA1
ffe5796284a9039ce24108696d193f214b185ba2

SHA256
1981d800b5a1f406b943fab64b47197d9b7a6d053a6812edf186b537b4710c89

SHA512
3b7d39f58d88e7b9d2ef2e1ae63a99b9f6f20728d6302ba7537c30fbe58489cc76633cfe5cd0f686e2678a2a1502d5779b206e41cf0cc8e49bdefc61af00ba09

Download Submit
C:\Windows\System\XltZrLH.exe

Filesize
1.6MB

MD5
e456c64538d069203531f24104d98194

SHA1
64a148cdb70662bcac8a427ef4a6ebff51049fe7

SHA256
11f7b66a0c02d54c9944cd915b9de09ab8508215ed9d8c6eeed7a52b5453f9fd

SHA512
5576f77fdcee8ca8304708278c49f945da280d54112594b68d6f8751a7f43939beaaa0d53b6b72cbeefc6b0cdaa749c40bda8dc0fd3f13f02b5b50ff033283fa

Download Submit
C:\Windows\System\XozXZGy.exe

Filesize
1.6MB

MD5
3908c7d96012e47599c6614697182bf7

SHA1
0ea2508fead394e4a70e12c31af273a05c0a2b7d

SHA256
25ae14b4eec4b9aa9b3137973b1e5fd8d1c48a7939aa3817e6aaf7b286a71549

SHA512
3b93810a8c18ad0f99baafc4fd5dd1219b5bace8de14053c08afb91761d52b5c644125a3ac25bf92e2899afc7f227a36faa4d6ab2644c6e5c277f172bf114f64

Download Submit
C:\Windows\System\YCqmKKH.exe

Filesize
1.6MB

MD5
f55d0e54f2a316e4138c8b926923121f

SHA1
949a2ca751cc4fc42d1566280c72c6256c63e75e

SHA256
bff7b2f01ff2b1ee2188d330cfb9c9d7111da0990277d1ca22fc767cb2d94c58

SHA512
723ea0b584a366399c0b96bcc83be3a2f40d00b66ba2a92cb25207bffbf8dede6ec1284aa607873cf09bc94119e0d88a2d8df263069fc90a1ff2ce99c60e37f9

Download Submit
C:\Windows\System\YLWwwJh.exe

Filesize
1.6MB

MD5
68eaa6ab03400c8c69fece7685ae94ee

SHA1
37191796f66974a7702e8a1f9ee760cb7431ed58

SHA256
dd92d9c8cfdcdf7149a3a244cb8287d469bf677fe2b04b2d3ea165806e8a2a1f

SHA512
fdef8ed804e77dc0500240266e95f2896faac9aaff62737544db9064981b0f42a2a177338729e0cb7179b4e7744cc9c06a9118609166079bccdb5058c50d7b51

Download Submit
C:\Windows\System\aJyyNlY.exe

Filesize
1.6MB

MD5
ba0d7b85a0f4a1a045d41b462c91c354

SHA1
cd42d3345fd5e0e859b973b7e8cd0ba242bcedaf

SHA256
8686f0c8851dc2e7de247fa613dc0d612f77d37fb8c14a45f80bd582186e2608

SHA512
e5790400dbe0a3ac16010f05e81877f01f635c81edd49da255728349d12b1630f1e577d12a12c0d44545067c84588a8f58d9962904dcc62809dbe2d6047ac928

Download Submit
C:\Windows\System\cUBpDWq.exe

Filesize
1.6MB

MD5
766785e8e1c1cb84cf08fb314a10455f

SHA1
d11062a6f0d50cc96c57d051b1f0575046f883cd

SHA256
cebce47da11d65c2c1cb14d8fe98f51e5493b37a24f5291aa370aefb4aaa0694

SHA512
9b88a5939d37bfb3cc947a059fdaf533c1522060ab9f0ac9bd8c0defb05ba54d4b7403474d2d6e087aaa734167c46afd80311f3d77cc507b90eb37fde2e1d075

Download Submit
C:\Windows\System\cXVKlFk.exe

Filesize
1.6MB

MD5
2124ad19aae4230b164a08e800e2c7cd

SHA1
554f6602f4b3ed28c602078a6313c36ec63bb6a1

SHA256
0c378aee5d33a68e1e59fdfce8239223cd1a0130f9561413d2e8dfb120e6644c

SHA512
e66807b86d02014d6804f22f25e03f0573889014d7a2c2234835d6065bc127931e0576136b09b72d7a149eb08d053e1ebe025ca8e3d0c9d682d7f9d2dd365a29

Download Submit
C:\Windows\System\iZEdpQi.exe

Filesize
1.6MB

MD5
7966255ee7b8715b2ba458c22835e494

SHA1
17c5fc301f6e8a841a98eb5ec59c56aee00070ad

SHA256
f7a06cd45d6ca427b3c91387d941076fcfdb023256185168dd863ee16a9f5356

SHA512
49b7fd32f335ff901f55c2a417b5b203006bc2fdc13df0c07040519c04f00ebb88bb1ef92942664a3ce382822c735b754b9dca054e98694023c22f6c6e46415a

Download Submit
C:\Windows\System\kyDOnvt.exe

Filesize
1.6MB

MD5
310d38bb737a8097a420cad18b892fac

SHA1
3e3f46278f88fca3dcb96cde5df6dc07540c21bb

SHA256
2455ce2105b2d9e470bcdeb64dcd86b37ea866006b03cb79daeb12df09ca6333

SHA512
9ddeb7afdf3cf6e0955cc9bbe495b1460af221f226aadd83d844b0f37d2824ccc5374a6e65d37d67a914dbb2bdd645cd26a3d15797b23b05b748ed2224a2aef3

Download Submit
C:\Windows\System\mPwMbXS.exe

Filesize
1.6MB

MD5
3d3f652d1490a07648c3934b3ead912b

SHA1
b931be6de48c2f3570675cb4a36f1540fd294020

SHA256
c9f2fba874a07349fb5280aa1e05b858c315fbe3e06dba55f13e37b4c6e4542c

SHA512
fffd68bbd42dee844b9ccf4bc02e9af95c6efb1d50c099bf104c4277b9a942a88edfcbb64e5259745a7ce859cc37cd7c23ca74f7b3115467a1230e8f027ea60d

Download Submit
C:\Windows\System\nONkfmh.exe

Filesize
1.6MB

MD5
90248b09c618695ae2a91f46fd470f60

SHA1
c4e0a6507dbd730e65b089ba0371e471c94b13bc

SHA256
e436c997b9ee91e3ca252981c34ed4eba2152ad0f6c5e3259bfb61116767302f

SHA512
0ce8868eacbca5b2e402a7965e8e72b6b17003092bebba1560cd35c6e6ac91b15c1c2661753d561e93aa4b1ce4142b1b036161355d88cd1ffd25774ba432dbc7

Download Submit
C:\Windows\System\oiKRrFO.exe

Filesize
8B

MD5
e216125f6ec8a71ed511fce858ed30eb

SHA1
050cc8d12c9a1af3716df8cd26567943726d3366

SHA256
2097394cabc160a9df2f746df2b02abe3caad35caebdb855f94e869ef6004673

SHA512
1ac9f8982e0ad73ffc5075b337a3e3f491f85f11a7d1a7e27a4798e5b39f52143905d90909f5a0732fa6e625f6b0719a56e5ded5ac563b3a5f32c20c4c30e446

Download Submit
C:\Windows\System\qrSaZgQ.exe

Filesize
1.6MB

MD5
bad992ec1b4b68f54d3e5c078318f216

SHA1
f284f7adc318918c83a79efb0c0e7f78c01eed83

SHA256
d3af40f3a137f44e0e5010173e9757aaf565ed07c06647a6205f0779ee265c26

SHA512
2eb5ab06bdf73c5877ee4790da80f8520bddbbada064c9e2f35238f109ff5e7ddf945f4e0feae1a1eaa44615de16c4c26d771326959bc28b2b8d2467b05587ca

Download Submit
C:\Windows\System\ruXDCUN.exe

Filesize
1.6MB

MD5
c63ecca6d8684c3670a372ea2255ce44

SHA1
0653a36ac091183db4255f160473d3b174c3b70b

SHA256
7834d00d9426b51753ec75022d0a4b1a267eb96025d9035966fc7e0b75946c4d

SHA512
7ca17b3d3b8f1fa46daf20410185ae1325b28bca2b851745f9626aa7fb1b8a2ce88ac50e5a5cf91099fbd9a9bf514b1322c9a48f4a59a30585ac07155d9b0d29

Download Submit
C:\Windows\System\vQoqsLx.exe

Filesize
1.6MB

MD5
8c78a4407b6159b3af2b64bde8fdb97f

SHA1
c3ba1db2e227ce8e493007bad9fd09ed338671f4

SHA256
ec28b5a6a4d9b3bd036ee13f8e680ee174de3de5aa8793f412311a44d84d75b5

SHA512
683cb624a3e5d65923ca6321dfc44fa57cb7a4e8ffdf7fd8085a23ef053d6a318b12f0947fc1deac42b6122f094917dcf0c702466f3307736746f5598d37339c

Download Submit
C:\Windows\System\whaMVIT.exe

Filesize
1.6MB

MD5
d180dcafda656613ffa5388e55ec5968

SHA1
c971121846e1851b6bce3559f795e9af9d3991f9

SHA256
7efca35e43e638210811bdde78ec691fc86b25919e8bd9ff26c7fd4b8c2091f3

SHA512
617a0d0a73cf25fec123aa9967162fa8f5912a4ad81d083cf90a16e06f69a83ad8047192e8cdd3d9f569ca4d3121393a802149f56a7d7992fc745164e21401f4

Download Submit
C:\Windows\System\wlGPxho.exe

Filesize
1.6MB

MD5
4869b7dcd38c8e4e02a0a536d7d2d368

SHA1
167a50e4e576e78b9f9759862ebab1f948375585

SHA256
bbb53a295342e90fd84d19ea4de7ed6944aad14034a780931ca20ef67b80da99

SHA512
02ffca77bc5f64223d644bc347d082b791c04e597659d87f127251b75b044620416b09993411f341d964e3d1fffb79810df5fbd112304d00dcae58bdc215bf70

Download Submit
memory/456-142-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp

Filesize
3.9MB

Download
memory/456-2792-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp

Filesize
3.9MB

Download
memory/808-97-0x00007FF764600000-0x00007FF7649F2000-memory.dmp

Filesize
3.9MB

Download
memory/808-2781-0x00007FF764600000-0x00007FF7649F2000-memory.dmp

Filesize
3.9MB

Download
memory/1176-136-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp

Filesize
3.9MB

Download
memory/1176-2787-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp

Filesize
3.9MB

Download
memory/1372-171-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp

Filesize
3.9MB

Download
memory/1372-2806-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp

Filesize
3.9MB

Download
memory/1388-2814-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp

Filesize
3.9MB

Download
memory/1388-204-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp

Filesize
3.9MB

Download
memory/1448-8-0x00007FF664A10000-0x00007FF664E02000-memory.dmp

Filesize
3.9MB

Download
memory/1448-2760-0x00007FF664A10000-0x00007FF664E02000-memory.dmp

Filesize
3.9MB

Download
memory/1448-2766-0x00007FF664A10000-0x00007FF664E02000-memory.dmp

Filesize
3.9MB

Download
memory/1488-2748-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp

Filesize
3.9MB

Download
memory/1488-0-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp

Filesize
3.9MB

Download
memory/1488-1-0x000001E472E80000-0x000001E472E90000-memory.dmp

Filesize
64KB

Download
memory/1500-2790-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1500-107-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1588-474-0x000001A07C660000-0x000001A07CE06000-memory.dmp

Filesize
7.6MB

Download
memory/1588-62-0x00007FFB43780000-0x00007FFB44241000-memory.dmp

Filesize
10.8MB

Download
memory/1588-2763-0x00007FFB43783000-0x00007FFB43785000-memory.dmp

Filesize
8KB

Download
memory/1588-9-0x00007FFB43783000-0x00007FFB43785000-memory.dmp

Filesize
8KB

Download
memory/1588-78-0x000001A07BB40000-0x000001A07BB62000-memory.dmp

Filesize
136KB

Download
memory/1588-2840-0x00007FFB43780000-0x00007FFB44241000-memory.dmp

Filesize
10.8MB

Download
memory/1588-41-0x00007FFB43780000-0x00007FFB44241000-memory.dmp

Filesize
10.8MB

Download
memory/1772-195-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-2817-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-205-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2810-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp

Filesize
3.9MB

Download
memory/2144-2785-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp

Filesize
3.9MB

Download
memory/2144-101-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp

Filesize
3.9MB

Download
memory/2264-2769-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp

Filesize
3.9MB

Download
memory/2264-113-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp

Filesize
3.9MB

Download
memory/2464-2770-0x00007FF724850000-0x00007FF724C42000-memory.dmp

Filesize
3.9MB

Download
memory/2464-82-0x00007FF724850000-0x00007FF724C42000-memory.dmp

Filesize
3.9MB

Download
memory/2512-177-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-2813-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-2783-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp

Filesize
3.9MB

Download
memory/2560-124-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp

Filesize
3.9MB

Download
memory/3160-2796-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp

Filesize
3.9MB

Download
memory/3160-148-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp

Filesize
3.9MB

Download
memory/3432-2778-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-89-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp

Filesize
3.9MB

Download
memory/3564-154-0x00007FF747470000-0x00007FF747862000-memory.dmp

Filesize
3.9MB

Download
memory/3564-2800-0x00007FF747470000-0x00007FF747862000-memory.dmp

Filesize
3.9MB

Download
memory/3968-86-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp

Filesize
3.9MB

Download
memory/3968-2774-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp

Filesize
3.9MB

Download
memory/3992-2776-0x00007FF653020000-0x00007FF653412000-memory.dmp

Filesize
3.9MB

Download
memory/3992-75-0x00007FF653020000-0x00007FF653412000-memory.dmp

Filesize
3.9MB

Download
memory/4004-2818-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp

Filesize
3.9MB

Download
memory/4004-189-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp

Filesize
3.9MB

Download
memory/4244-2773-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4244-70-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4392-2809-0x00007FF662760000-0x00007FF662B52000-memory.dmp

Filesize
3.9MB

Download
memory/4392-183-0x00007FF662760000-0x00007FF662B52000-memory.dmp

Filesize
3.9MB

Download
memory/4632-2802-0x00007FF718870000-0x00007FF718C62000-memory.dmp

Filesize
3.9MB

Download
memory/4632-160-0x00007FF718870000-0x00007FF718C62000-memory.dmp

Filesize
3.9MB

Download
memory/5004-130-0x00007FF659880000-0x00007FF659C72000-memory.dmp

Filesize
3.9MB

Download
memory/5004-2788-0x00007FF659880000-0x00007FF659C72000-memory.dmp

Filesize
3.9MB

Download