xmrig | aabfdd5a7a0ca3c821ebdbe0c6eb7eeb1ea22e5c8b57a80b10489d14979b3e6e

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
Size

1.6MB
MD5

aaeb8a13c7cc58cb6b55919f6b035ac0
SHA1

b6b1a6859610ddf8355e8c45ecb593b33bf0351e
SHA256

aabfdd5a7a0ca3c821ebdbe0c6eb7eeb1ea22e5c8b57a80b10489d14979b3e6e
SHA512

dc044b99515850db1a283afaeb93b3fb3e1d4f0a29dbed3ea98757ce2136b281849d869c6ecac759b138377d01b3eff425af97cc73c3519a22483ed3bcd3de5d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupQF4g6FNGzM2XNJSX:Lz071uv4BPMki8CnfZFZzMuNEX

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2380-40-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2696-42-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2416-46-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2644-44-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2916-63-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/1608-77-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2100-88-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2100-89-0x0000000003470000-0x0000000003862000-memory.dmp	xmrig
behavioral1/memory/2556-96-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/1836-69-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2996-66-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2380-4321-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2696-4351-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2644-4339-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2556-4407-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2996-4420-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2916-4408-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/1836-4429-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2416-4447-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2028-4536-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2256-5314-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/1608-5318-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2984	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2556	XNOiiwp.exe
2380	NnXNnqv.exe
2696	BnZYVNH.exe
2644	WCCBhBD.exe
2416	sSFQjZF.exe
2916	bExchrl.exe
2996	gIJYYLa.exe
1836	GBjrEKO.exe
1608	BrsDTog.exe
2028	nPZHNsv.exe
2256	BTgrFoO.exe
2284	FAwoYlY.exe
2300	YngPtMe.exe
2440	ozPsCXu.exe
2760	tOAupvW.exe
2784	KFdTYTi.exe
1748	xuSgFxy.exe
2412	DlpQMKn.exe
2808	ZDompfk.exe
2240	QfbxoLb.exe
2212	VNXltiH.exe
2848	LSTIkTz.exe
3028	XPMqlWe.exe
384	WiLPjay.exe
992	wcOGytW.exe
1588	WORpsZc.exe
1788	fcsMIam.exe
1728	jcbkNsE.exe
1880	yfugHuO.exe
3012	FaIhHGP.exe
2336	kIhAckh.exe
1216	kbWGNeG.exe
684	AhmYLXt.exe
1704	tQlQxxg.exe
1920	Eaxbxts.exe
1796	VFToesn.exe
1292	LtzearJ.exe
1916	kaIkRUg.exe
1888	jhvidWZ.exe
2156	VxHwuHV.exe
1048	xYVjibS.exe
1752	qLNmCXG.exe
2112	yFZEwJy.exe
1544	QgMpIJJ.exe
1644	IeHaZxL.exe
1232	DkxuNRN.exe
276	LLkZPNF.exe
2064	gPeVsTe.exe
1876	IwfqnRi.exe
2248	iUKIcJr.exe
1572	bJBjGtI.exe
1504	woHXprZ.exe
1628	lZDRQJR.exe
2576	OqPjqmL.exe
2832	LnuUGkj.exe
2680	vHvxMDb.exe
2560	SeNrgkV.exe
2368	ncADoQV.exe
2384	TlBQyyd.exe
2488	HkIbdzW.exe
2400	EIqiIAO.exe
2672	HLhxIRg.exe
2548	NWwoLrQ.exe
2704	NzgJxjl.exe

Loads dropped DLL 64 IoCs

pid	Process
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2100-2-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x000b000000013420-3.dat	upx
behavioral1/memory/2556-13-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-18.dat	upx
behavioral1/files/0x000c000000014175-20.dat	upx
behavioral1/files/0x0007000000014186-28.dat	upx
behavioral1/files/0x0007000000014207-29.dat	upx
behavioral1/memory/2380-40-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2696-42-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/files/0x0007000000014228-50.dat	upx
behavioral1/files/0x0038000000013acb-55.dat	upx
behavioral1/files/0x0007000000014246-59.dat	upx
behavioral1/memory/2416-46-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2644-44-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2916-63-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/files/0x000800000001471a-71.dat	upx
behavioral1/memory/1608-77-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2100-88-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x0006000000014b18-86.dat	upx
behavioral1/memory/2256-90-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/files/0x0006000000014b4c-93.dat	upx
behavioral1/memory/2284-97-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x0006000000014bbc-98.dat	upx
behavioral1/memory/2556-96-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2028-82-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0006000000014a9a-80.dat	upx
behavioral1/files/0x0006000000014fa2-108.dat	upx
behavioral1/files/0x0006000000014e71-102.dat	upx
behavioral1/files/0x000600000001535e-116.dat	upx
behavioral1/files/0x0006000000015684-137.dat	upx
behavioral1/files/0x0006000000015c9e-150.dat	upx
behavioral1/files/0x0006000000015cff-179.dat	upx
behavioral1/files/0x0006000000015d20-183.dat	upx
behavioral1/files/0x0006000000015d4e-195.dat	upx
behavioral1/files/0x0006000000015d42-190.dat	upx
behavioral1/files/0x0006000000015ce3-176.dat	upx
behavioral1/files/0x0006000000015ccd-165.dat	upx
behavioral1/files/0x0006000000015cd9-169.dat	upx
behavioral1/files/0x0006000000015cae-156.dat	upx
behavioral1/files/0x0006000000015cb6-160.dat	upx
behavioral1/files/0x0006000000015c87-146.dat	upx
behavioral1/files/0x0006000000015677-135.dat	upx
behavioral1/files/0x000600000001565d-130.dat	upx
behavioral1/files/0x0006000000015653-125.dat	upx
behavioral1/files/0x000600000001564f-119.dat	upx
behavioral1/memory/1836-69-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2996-66-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2380-4321-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2696-4351-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2644-4339-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2556-4407-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2996-4420-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2916-4408-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/1836-4429-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2416-4447-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2028-4536-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2256-5314-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/1608-5318-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SgxzZYS.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\rSjfLYV.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\oWIbCaZ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\JhJdeWQ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\vyonWjo.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MeKXzfT.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ohJCcBy.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\XxRJQUz.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\nOzilJx.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\alopTLx.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\zjxTgQx.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\HzRNXWG.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\aXVsSyd.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MdQYTqt.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\UEkBgEi.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ZZEcGDa.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\Uzhinnc.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\xdPzsOt.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\pQkVKqb.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\OQzEiaE.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\qKpVlLC.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\pwSbMSD.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\VaPvTzp.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\CGcPGcA.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\XQTbDtD.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ZdIinYV.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ggEgNxe.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MzkJluH.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\KYzrAbS.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\gNOFWVR.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\VFPhnFQ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\wgUYlsA.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\WoZfVxV.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\NhDAGKc.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\fcJQmoS.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\JCsoVWF.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\DbpXQlW.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\eCdPNBc.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\jRCyhyd.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\pxRRAVi.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\DcIbiSB.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\JbXLAeI.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\qxerBOf.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\rTFIRhv.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\EJvJxiS.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MPZldSH.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ZdKyLUS.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\AbWcPcB.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\dSLvYBu.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\wvVbxsw.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MzYAgTN.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ZhmnLhD.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\OGFUYwu.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\HRzblzO.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\mjlczIc.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ADnkMOy.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\CKUPATC.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\CSaCklx.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\flYpEMP.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\gvFbbkS.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\SrcALtQ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\xEselAd.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\MQAqBGm.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\PCNFpKG.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2984	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2984	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2984	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	29
PID 2100 wrote to memory of 2984	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	29
PID 2100 wrote to memory of 2984	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	29
PID 2100 wrote to memory of 2556	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	30
PID 2100 wrote to memory of 2556	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	30
PID 2100 wrote to memory of 2556	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	30
PID 2100 wrote to memory of 2380	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	31
PID 2100 wrote to memory of 2380	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	31
PID 2100 wrote to memory of 2380	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	31
PID 2100 wrote to memory of 2696	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	32
PID 2100 wrote to memory of 2696	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	32
PID 2100 wrote to memory of 2696	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	32
PID 2100 wrote to memory of 2644	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	33
PID 2100 wrote to memory of 2644	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	33
PID 2100 wrote to memory of 2644	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	33
PID 2100 wrote to memory of 2416	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	34
PID 2100 wrote to memory of 2416	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	34
PID 2100 wrote to memory of 2416	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	34
PID 2100 wrote to memory of 2916	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	35
PID 2100 wrote to memory of 2916	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	35
PID 2100 wrote to memory of 2916	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	35
PID 2100 wrote to memory of 2996	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	36
PID 2100 wrote to memory of 2996	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	36
PID 2100 wrote to memory of 2996	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	36
PID 2100 wrote to memory of 1836	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	37
PID 2100 wrote to memory of 1836	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	37
PID 2100 wrote to memory of 1836	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	37
PID 2100 wrote to memory of 1608	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	38
PID 2100 wrote to memory of 1608	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	38
PID 2100 wrote to memory of 1608	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	38
PID 2100 wrote to memory of 2028	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	39
PID 2100 wrote to memory of 2028	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	39
PID 2100 wrote to memory of 2028	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	39
PID 2100 wrote to memory of 2256	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	40
PID 2100 wrote to memory of 2256	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	40
PID 2100 wrote to memory of 2256	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	40
PID 2100 wrote to memory of 2284	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	41
PID 2100 wrote to memory of 2284	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	41
PID 2100 wrote to memory of 2284	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	41
PID 2100 wrote to memory of 2300	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	42
PID 2100 wrote to memory of 2300	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	42
PID 2100 wrote to memory of 2300	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	42
PID 2100 wrote to memory of 2760	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	43
PID 2100 wrote to memory of 2760	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	43
PID 2100 wrote to memory of 2760	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	43
PID 2100 wrote to memory of 2440	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	44
PID 2100 wrote to memory of 2440	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	44
PID 2100 wrote to memory of 2440	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	44
PID 2100 wrote to memory of 2784	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	45
PID 2100 wrote to memory of 2784	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	45
PID 2100 wrote to memory of 2784	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	45
PID 2100 wrote to memory of 1748	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	46
PID 2100 wrote to memory of 1748	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	46
PID 2100 wrote to memory of 1748	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	46
PID 2100 wrote to memory of 2412	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	47
PID 2100 wrote to memory of 2412	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	47
PID 2100 wrote to memory of 2412	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	47
PID 2100 wrote to memory of 2808	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	48
PID 2100 wrote to memory of 2808	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	48
PID 2100 wrote to memory of 2808	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	48
PID 2100 wrote to memory of 2240	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	49
PID 2100 wrote to memory of 2240	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	49
PID 2100 wrote to memory of 2240	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	49
PID 2100 wrote to memory of 2212	2100	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\System\XNOiiwp.exe
  C:\Windows\System\XNOiiwp.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\NnXNnqv.exe
  C:\Windows\System\NnXNnqv.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\BnZYVNH.exe
  C:\Windows\System\BnZYVNH.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\WCCBhBD.exe
  C:\Windows\System\WCCBhBD.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\sSFQjZF.exe
  C:\Windows\System\sSFQjZF.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\bExchrl.exe
  C:\Windows\System\bExchrl.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\gIJYYLa.exe
  C:\Windows\System\gIJYYLa.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\GBjrEKO.exe
  C:\Windows\System\GBjrEKO.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\BrsDTog.exe
  C:\Windows\System\BrsDTog.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\nPZHNsv.exe
  C:\Windows\System\nPZHNsv.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\BTgrFoO.exe
  C:\Windows\System\BTgrFoO.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\FAwoYlY.exe
  C:\Windows\System\FAwoYlY.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\YngPtMe.exe
  C:\Windows\System\YngPtMe.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\tOAupvW.exe
  C:\Windows\System\tOAupvW.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\ozPsCXu.exe
  C:\Windows\System\ozPsCXu.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\KFdTYTi.exe
  C:\Windows\System\KFdTYTi.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\xuSgFxy.exe
  C:\Windows\System\xuSgFxy.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\DlpQMKn.exe
  C:\Windows\System\DlpQMKn.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ZDompfk.exe
  C:\Windows\System\ZDompfk.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\QfbxoLb.exe
  C:\Windows\System\QfbxoLb.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\VNXltiH.exe
  C:\Windows\System\VNXltiH.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\LSTIkTz.exe
  C:\Windows\System\LSTIkTz.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\XPMqlWe.exe
  C:\Windows\System\XPMqlWe.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\WiLPjay.exe
  C:\Windows\System\WiLPjay.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\wcOGytW.exe
  C:\Windows\System\wcOGytW.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\WORpsZc.exe
  C:\Windows\System\WORpsZc.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\fcsMIam.exe
  C:\Windows\System\fcsMIam.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\jcbkNsE.exe
  C:\Windows\System\jcbkNsE.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\yfugHuO.exe
  C:\Windows\System\yfugHuO.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\FaIhHGP.exe
  C:\Windows\System\FaIhHGP.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\kIhAckh.exe
  C:\Windows\System\kIhAckh.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\kbWGNeG.exe
  C:\Windows\System\kbWGNeG.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\AhmYLXt.exe
  C:\Windows\System\AhmYLXt.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\tQlQxxg.exe
  C:\Windows\System\tQlQxxg.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\Eaxbxts.exe
  C:\Windows\System\Eaxbxts.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\LtzearJ.exe
  C:\Windows\System\LtzearJ.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\VFToesn.exe
  C:\Windows\System\VFToesn.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\kaIkRUg.exe
  C:\Windows\System\kaIkRUg.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\jhvidWZ.exe
  C:\Windows\System\jhvidWZ.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\VxHwuHV.exe
  C:\Windows\System\VxHwuHV.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\xYVjibS.exe
  C:\Windows\System\xYVjibS.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\yFZEwJy.exe
  C:\Windows\System\yFZEwJy.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\qLNmCXG.exe
  C:\Windows\System\qLNmCXG.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\QgMpIJJ.exe
  C:\Windows\System\QgMpIJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\IeHaZxL.exe
  C:\Windows\System\IeHaZxL.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\DkxuNRN.exe
  C:\Windows\System\DkxuNRN.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\LLkZPNF.exe
  C:\Windows\System\LLkZPNF.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\gPeVsTe.exe
  C:\Windows\System\gPeVsTe.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\IwfqnRi.exe
  C:\Windows\System\IwfqnRi.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\iUKIcJr.exe
  C:\Windows\System\iUKIcJr.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\bJBjGtI.exe
  C:\Windows\System\bJBjGtI.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\woHXprZ.exe
  C:\Windows\System\woHXprZ.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\lZDRQJR.exe
  C:\Windows\System\lZDRQJR.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\OqPjqmL.exe
  C:\Windows\System\OqPjqmL.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\LnuUGkj.exe
  C:\Windows\System\LnuUGkj.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\vHvxMDb.exe
  C:\Windows\System\vHvxMDb.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\SeNrgkV.exe
  C:\Windows\System\SeNrgkV.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\TlBQyyd.exe
  C:\Windows\System\TlBQyyd.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ncADoQV.exe
  C:\Windows\System\ncADoQV.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\EIqiIAO.exe
  C:\Windows\System\EIqiIAO.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\HkIbdzW.exe
  C:\Windows\System\HkIbdzW.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\HLhxIRg.exe
  C:\Windows\System\HLhxIRg.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\NWwoLrQ.exe
  C:\Windows\System\NWwoLrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\NzgJxjl.exe
  C:\Windows\System\NzgJxjl.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\TWmrxxO.exe
  C:\Windows\System\TWmrxxO.exe
  2⤵
  PID:1320
- C:\Windows\System\vqzaFDq.exe
  C:\Windows\System\vqzaFDq.exe
  2⤵
  PID:1984
- C:\Windows\System\PJKBIPu.exe
  C:\Windows\System\PJKBIPu.exe
  2⤵
  PID:2004
- C:\Windows\System\cFZMyWn.exe
  C:\Windows\System\cFZMyWn.exe
  2⤵
  PID:2732
- C:\Windows\System\tLMmWhV.exe
  C:\Windows\System\tLMmWhV.exe
  2⤵
  PID:1952
- C:\Windows\System\aBOoLBE.exe
  C:\Windows\System\aBOoLBE.exe
  2⤵
  PID:1224
- C:\Windows\System\iaEvGNf.exe
  C:\Windows\System\iaEvGNf.exe
  2⤵
  PID:2176
- C:\Windows\System\LTFiRsr.exe
  C:\Windows\System\LTFiRsr.exe
  2⤵
  PID:2352
- C:\Windows\System\PHrDvDm.exe
  C:\Windows\System\PHrDvDm.exe
  2⤵
  PID:2196
- C:\Windows\System\qxerBOf.exe
  C:\Windows\System\qxerBOf.exe
  2⤵
  PID:540
- C:\Windows\System\jWECIHC.exe
  C:\Windows\System\jWECIHC.exe
  2⤵
  PID:908
- C:\Windows\System\OUUMYUW.exe
  C:\Windows\System\OUUMYUW.exe
  2⤵
  PID:1028
- C:\Windows\System\AMGHnbS.exe
  C:\Windows\System\AMGHnbS.exe
  2⤵
  PID:1404
- C:\Windows\System\KYzrAbS.exe
  C:\Windows\System\KYzrAbS.exe
  2⤵
  PID:3024
- C:\Windows\System\RusTItr.exe
  C:\Windows\System\RusTItr.exe
  2⤵
  PID:832
- C:\Windows\System\kjpDnTD.exe
  C:\Windows\System\kjpDnTD.exe
  2⤵
  PID:1640
- C:\Windows\System\DhPuOvI.exe
  C:\Windows\System\DhPuOvI.exe
  2⤵
  PID:1924
- C:\Windows\System\bVecBuh.exe
  C:\Windows\System\bVecBuh.exe
  2⤵
  PID:2272
- C:\Windows\System\IgdUOfo.exe
  C:\Windows\System\IgdUOfo.exe
  2⤵
  PID:1696
- C:\Windows\System\mplrRie.exe
  C:\Windows\System\mplrRie.exe
  2⤵
  PID:1148
- C:\Windows\System\zqrdKwJ.exe
  C:\Windows\System\zqrdKwJ.exe
  2⤵
  PID:1908
- C:\Windows\System\ZhGYcOl.exe
  C:\Windows\System\ZhGYcOl.exe
  2⤵
  PID:2976
- C:\Windows\System\MVliyyG.exe
  C:\Windows\System\MVliyyG.exe
  2⤵
  PID:1736
- C:\Windows\System\RJgFbSK.exe
  C:\Windows\System\RJgFbSK.exe
  2⤵
  PID:1412
- C:\Windows\System\ooLvSyL.exe
  C:\Windows\System\ooLvSyL.exe
  2⤵
  PID:1592
- C:\Windows\System\pGhNcna.exe
  C:\Windows\System\pGhNcna.exe
  2⤵
  PID:2932
- C:\Windows\System\tlHICmq.exe
  C:\Windows\System\tlHICmq.exe
  2⤵
  PID:1432
- C:\Windows\System\rHdJtgJ.exe
  C:\Windows\System\rHdJtgJ.exe
  2⤵
  PID:2720
- C:\Windows\System\sShrcQB.exe
  C:\Windows\System\sShrcQB.exe
  2⤵
  PID:2568
- C:\Windows\System\cQxfhrC.exe
  C:\Windows\System\cQxfhrC.exe
  2⤵
  PID:1668
- C:\Windows\System\jpDTMXQ.exe
  C:\Windows\System\jpDTMXQ.exe
  2⤵
  PID:2676
- C:\Windows\System\fFWkipU.exe
  C:\Windows\System\fFWkipU.exe
  2⤵
  PID:2928
- C:\Windows\System\GdGVYHD.exe
  C:\Windows\System\GdGVYHD.exe
  2⤵
  PID:1460
- C:\Windows\System\OHldPHa.exe
  C:\Windows\System\OHldPHa.exe
  2⤵
  PID:2536
- C:\Windows\System\hUvhIsW.exe
  C:\Windows\System\hUvhIsW.exe
  2⤵
  PID:2524
- C:\Windows\System\KmrcSkO.exe
  C:\Windows\System\KmrcSkO.exe
  2⤵
  PID:856
- C:\Windows\System\HoRlXaQ.exe
  C:\Windows\System\HoRlXaQ.exe
  2⤵
  PID:2072
- C:\Windows\System\GtFLmlx.exe
  C:\Windows\System\GtFLmlx.exe
  2⤵
  PID:2792
- C:\Windows\System\BsxaAmV.exe
  C:\Windows\System\BsxaAmV.exe
  2⤵
  PID:2000
- C:\Windows\System\onLfLZl.exe
  C:\Windows\System\onLfLZl.exe
  2⤵
  PID:1212
- C:\Windows\System\SgOzfzI.exe
  C:\Windows\System\SgOzfzI.exe
  2⤵
  PID:2776
- C:\Windows\System\aYZWKGC.exe
  C:\Windows\System\aYZWKGC.exe
  2⤵
  PID:2164
- C:\Windows\System\hIQwPFe.exe
  C:\Windows\System\hIQwPFe.exe
  2⤵
  PID:1844
- C:\Windows\System\VxbSZNv.exe
  C:\Windows\System\VxbSZNv.exe
  2⤵
  PID:2172
- C:\Windows\System\yfpyvwL.exe
  C:\Windows\System\yfpyvwL.exe
  2⤵
  PID:2372
- C:\Windows\System\zTjQRtM.exe
  C:\Windows\System\zTjQRtM.exe
  2⤵
  PID:1832
- C:\Windows\System\vpJrISb.exe
  C:\Windows\System\vpJrISb.exe
  2⤵
  PID:1860
- C:\Windows\System\WHhbgaj.exe
  C:\Windows\System\WHhbgaj.exe
  2⤵
  PID:1936
- C:\Windows\System\gFIfDWh.exe
  C:\Windows\System\gFIfDWh.exe
  2⤵
  PID:1912
- C:\Windows\System\sksVhmr.exe
  C:\Windows\System\sksVhmr.exe
  2⤵
  PID:2420
- C:\Windows\System\UNvZGBu.exe
  C:\Windows\System\UNvZGBu.exe
  2⤵
  PID:1620
- C:\Windows\System\jlCotmS.exe
  C:\Windows\System\jlCotmS.exe
  2⤵
  PID:1892
- C:\Windows\System\YkeUjqL.exe
  C:\Windows\System\YkeUjqL.exe
  2⤵
  PID:2392
- C:\Windows\System\iDGjZIJ.exe
  C:\Windows\System\iDGjZIJ.exe
  2⤵
  PID:2936
- C:\Windows\System\slKZhZS.exe
  C:\Windows\System\slKZhZS.exe
  2⤵
  PID:2020
- C:\Windows\System\IOFjMYd.exe
  C:\Windows\System\IOFjMYd.exe
  2⤵
  PID:2232
- C:\Windows\System\mKwdNOx.exe
  C:\Windows\System\mKwdNOx.exe
  2⤵
  PID:1864
- C:\Windows\System\nVwnkHk.exe
  C:\Windows\System\nVwnkHk.exe
  2⤵
  PID:1408
- C:\Windows\System\xDSBYfx.exe
  C:\Windows\System\xDSBYfx.exe
  2⤵
  PID:2744
- C:\Windows\System\ApqVBtW.exe
  C:\Windows\System\ApqVBtW.exe
  2⤵
  PID:688
- C:\Windows\System\QKoTuaj.exe
  C:\Windows\System\QKoTuaj.exe
  2⤵
  PID:588
- C:\Windows\System\yBxsbUO.exe
  C:\Windows\System\yBxsbUO.exe
  2⤵
  PID:2424
- C:\Windows\System\qOqmrqk.exe
  C:\Windows\System\qOqmrqk.exe
  2⤵
  PID:356
- C:\Windows\System\dGQJjcw.exe
  C:\Windows\System\dGQJjcw.exe
  2⤵
  PID:2684
- C:\Windows\System\ysyeZhx.exe
  C:\Windows\System\ysyeZhx.exe
  2⤵
  PID:1260
- C:\Windows\System\CUpzPhO.exe
  C:\Windows\System\CUpzPhO.exe
  2⤵
  PID:2500
- C:\Windows\System\DmuCPDC.exe
  C:\Windows\System\DmuCPDC.exe
  2⤵
  PID:2296
- C:\Windows\System\OMgxwtF.exe
  C:\Windows\System\OMgxwtF.exe
  2⤵
  PID:1012
- C:\Windows\System\sXydFpn.exe
  C:\Windows\System\sXydFpn.exe
  2⤵
  PID:1872
- C:\Windows\System\ymIuSWW.exe
  C:\Windows\System\ymIuSWW.exe
  2⤵
  PID:2188
- C:\Windows\System\kKIsmxb.exe
  C:\Windows\System\kKIsmxb.exe
  2⤵
  PID:2340
- C:\Windows\System\xsXhFqC.exe
  C:\Windows\System\xsXhFqC.exe
  2⤵
  PID:472
- C:\Windows\System\gEvsWEz.exe
  C:\Windows\System\gEvsWEz.exe
  2⤵
  PID:3040
- C:\Windows\System\nBeUlNH.exe
  C:\Windows\System\nBeUlNH.exe
  2⤵
  PID:3056
- C:\Windows\System\WlHSLzT.exe
  C:\Windows\System\WlHSLzT.exe
  2⤵
  PID:788
- C:\Windows\System\DGcGaBg.exe
  C:\Windows\System\DGcGaBg.exe
  2⤵
  PID:956
- C:\Windows\System\htaHtYk.exe
  C:\Windows\System\htaHtYk.exe
  2⤵
  PID:1256
- C:\Windows\System\ecgWMZk.exe
  C:\Windows\System\ecgWMZk.exe
  2⤵
  PID:1884
- C:\Windows\System\nuhIAim.exe
  C:\Windows\System\nuhIAim.exe
  2⤵
  PID:760
- C:\Windows\System\zELWhEZ.exe
  C:\Windows\System\zELWhEZ.exe
  2⤵
  PID:2436
- C:\Windows\System\INEeULl.exe
  C:\Windows\System\INEeULl.exe
  2⤵
  PID:1020
- C:\Windows\System\VNhlaPP.exe
  C:\Windows\System\VNhlaPP.exe
  2⤵
  PID:2012
- C:\Windows\System\wHMTRMU.exe
  C:\Windows\System\wHMTRMU.exe
  2⤵
  PID:1944
- C:\Windows\System\zdEGMIw.exe
  C:\Windows\System\zdEGMIw.exe
  2⤵
  PID:2828
- C:\Windows\System\zaSWyXH.exe
  C:\Windows\System\zaSWyXH.exe
  2⤵
  PID:724
- C:\Windows\System\eglvKUM.exe
  C:\Windows\System\eglvKUM.exe
  2⤵
  PID:344
- C:\Windows\System\BjbsOlI.exe
  C:\Windows\System\BjbsOlI.exe
  2⤵
  PID:2476
- C:\Windows\System\BzbfucG.exe
  C:\Windows\System\BzbfucG.exe
  2⤵
  PID:1240
- C:\Windows\System\YUlGIyv.exe
  C:\Windows\System\YUlGIyv.exe
  2⤵
  PID:1472
- C:\Windows\System\dcLdkbp.exe
  C:\Windows\System\dcLdkbp.exe
  2⤵
  PID:1852
- C:\Windows\System\PiQYBje.exe
  C:\Windows\System\PiQYBje.exe
  2⤵
  PID:1512
- C:\Windows\System\fUsVvPR.exe
  C:\Windows\System\fUsVvPR.exe
  2⤵
  PID:1128
- C:\Windows\System\LTKWAkV.exe
  C:\Windows\System\LTKWAkV.exe
  2⤵
  PID:1800
- C:\Windows\System\YisopjH.exe
  C:\Windows\System\YisopjH.exe
  2⤵
  PID:1492
- C:\Windows\System\zANtfsZ.exe
  C:\Windows\System\zANtfsZ.exe
  2⤵
  PID:1300
- C:\Windows\System\gimGaEP.exe
  C:\Windows\System\gimGaEP.exe
  2⤵
  PID:2492
- C:\Windows\System\jFaXXWM.exe
  C:\Windows\System\jFaXXWM.exe
  2⤵
  PID:1400
- C:\Windows\System\XFdixBA.exe
  C:\Windows\System\XFdixBA.exe
  2⤵
  PID:108
- C:\Windows\System\nIhSTws.exe
  C:\Windows\System\nIhSTws.exe
  2⤵
  PID:2756
- C:\Windows\System\uEiIQPJ.exe
  C:\Windows\System\uEiIQPJ.exe
  2⤵
  PID:1272
- C:\Windows\System\yWzRbtJ.exe
  C:\Windows\System\yWzRbtJ.exe
  2⤵
  PID:2904
- C:\Windows\System\rYjsoOQ.exe
  C:\Windows\System\rYjsoOQ.exe
  2⤵
  PID:2260
- C:\Windows\System\KoDsIAR.exe
  C:\Windows\System\KoDsIAR.exe
  2⤵
  PID:2800
- C:\Windows\System\VbSajry.exe
  C:\Windows\System\VbSajry.exe
  2⤵
  PID:1008
- C:\Windows\System\TWcGSKs.exe
  C:\Windows\System\TWcGSKs.exe
  2⤵
  PID:2008
- C:\Windows\System\jfUVQUO.exe
  C:\Windows\System\jfUVQUO.exe
  2⤵
  PID:1928
- C:\Windows\System\BsCKgMk.exe
  C:\Windows\System\BsCKgMk.exe
  2⤵
  PID:348
- C:\Windows\System\lTlCAMs.exe
  C:\Windows\System\lTlCAMs.exe
  2⤵
  PID:836
- C:\Windows\System\mDbKYJG.exe
  C:\Windows\System\mDbKYJG.exe
  2⤵
  PID:1680
- C:\Windows\System\vvhwmNK.exe
  C:\Windows\System\vvhwmNK.exe
  2⤵
  PID:628
- C:\Windows\System\WUXDPno.exe
  C:\Windows\System\WUXDPno.exe
  2⤵
  PID:2084
- C:\Windows\System\rBDVUix.exe
  C:\Windows\System\rBDVUix.exe
  2⤵
  PID:2876
- C:\Windows\System\jkCSxCs.exe
  C:\Windows\System\jkCSxCs.exe
  2⤵
  PID:2656
- C:\Windows\System\UvdBWUr.exe
  C:\Windows\System\UvdBWUr.exe
  2⤵
  PID:1900
- C:\Windows\System\rsgwJbU.exe
  C:\Windows\System\rsgwJbU.exe
  2⤵
  PID:3088
- C:\Windows\System\mgJSzsy.exe
  C:\Windows\System\mgJSzsy.exe
  2⤵
  PID:3104
- C:\Windows\System\VJcDdjy.exe
  C:\Windows\System\VJcDdjy.exe
  2⤵
  PID:3120
- C:\Windows\System\ZhhIOKG.exe
  C:\Windows\System\ZhhIOKG.exe
  2⤵
  PID:3136
- C:\Windows\System\cgqYhdM.exe
  C:\Windows\System\cgqYhdM.exe
  2⤵
  PID:3152
- C:\Windows\System\QkmFrqM.exe
  C:\Windows\System\QkmFrqM.exe
  2⤵
  PID:3168
- C:\Windows\System\KWcJTow.exe
  C:\Windows\System\KWcJTow.exe
  2⤵
  PID:3184
- C:\Windows\System\cdydKpD.exe
  C:\Windows\System\cdydKpD.exe
  2⤵
  PID:3200
- C:\Windows\System\cFLHtqt.exe
  C:\Windows\System\cFLHtqt.exe
  2⤵
  PID:3216
- C:\Windows\System\rmDajGW.exe
  C:\Windows\System\rmDajGW.exe
  2⤵
  PID:3232
- C:\Windows\System\ynHmKaN.exe
  C:\Windows\System\ynHmKaN.exe
  2⤵
  PID:3248
- C:\Windows\System\VgtCEpT.exe
  C:\Windows\System\VgtCEpT.exe
  2⤵
  PID:3268
- C:\Windows\System\gPhfkDz.exe
  C:\Windows\System\gPhfkDz.exe
  2⤵
  PID:3296
- C:\Windows\System\bsTstOT.exe
  C:\Windows\System\bsTstOT.exe
  2⤵
  PID:3316
- C:\Windows\System\tPPUPMD.exe
  C:\Windows\System\tPPUPMD.exe
  2⤵
  PID:3332
- C:\Windows\System\qKKgYXj.exe
  C:\Windows\System\qKKgYXj.exe
  2⤵
  PID:3348
- C:\Windows\System\hugUpnu.exe
  C:\Windows\System\hugUpnu.exe
  2⤵
  PID:3368
- C:\Windows\System\HcNIUIG.exe
  C:\Windows\System\HcNIUIG.exe
  2⤵
  PID:3384
- C:\Windows\System\JLzbDqw.exe
  C:\Windows\System\JLzbDqw.exe
  2⤵
  PID:3408
- C:\Windows\System\BYvGfer.exe
  C:\Windows\System\BYvGfer.exe
  2⤵
  PID:3432
- C:\Windows\System\pahfvBS.exe
  C:\Windows\System\pahfvBS.exe
  2⤵
  PID:3448
- C:\Windows\System\FVXkVNB.exe
  C:\Windows\System\FVXkVNB.exe
  2⤵
  PID:3464
- C:\Windows\System\BKjMdFP.exe
  C:\Windows\System\BKjMdFP.exe
  2⤵
  PID:3480
- C:\Windows\System\edoYVOj.exe
  C:\Windows\System\edoYVOj.exe
  2⤵
  PID:3504
- C:\Windows\System\XXJqJBt.exe
  C:\Windows\System\XXJqJBt.exe
  2⤵
  PID:3520
- C:\Windows\System\jBZrGZA.exe
  C:\Windows\System\jBZrGZA.exe
  2⤵
  PID:3536
- C:\Windows\System\UlYsuxG.exe
  C:\Windows\System\UlYsuxG.exe
  2⤵
  PID:3552
- C:\Windows\System\ikwHymG.exe
  C:\Windows\System\ikwHymG.exe
  2⤵
  PID:3568
- C:\Windows\System\gUbHhOw.exe
  C:\Windows\System\gUbHhOw.exe
  2⤵
  PID:3584
- C:\Windows\System\oYwSfbc.exe
  C:\Windows\System\oYwSfbc.exe
  2⤵
  PID:3600
- C:\Windows\System\pLuUNTh.exe
  C:\Windows\System\pLuUNTh.exe
  2⤵
  PID:3616
- C:\Windows\System\QHABqNS.exe
  C:\Windows\System\QHABqNS.exe
  2⤵
  PID:3632
- C:\Windows\System\qWydpOI.exe
  C:\Windows\System\qWydpOI.exe
  2⤵
  PID:3648
- C:\Windows\System\gmzANSd.exe
  C:\Windows\System\gmzANSd.exe
  2⤵
  PID:3664
- C:\Windows\System\NZDSmGa.exe
  C:\Windows\System\NZDSmGa.exe
  2⤵
  PID:3680
- C:\Windows\System\PZIcJVT.exe
  C:\Windows\System\PZIcJVT.exe
  2⤵
  PID:3696
- C:\Windows\System\FridbGx.exe
  C:\Windows\System\FridbGx.exe
  2⤵
  PID:3712
- C:\Windows\System\PUJppHM.exe
  C:\Windows\System\PUJppHM.exe
  2⤵
  PID:3728
- C:\Windows\System\YRPzvct.exe
  C:\Windows\System\YRPzvct.exe
  2⤵
  PID:3744
- C:\Windows\System\rOcucnd.exe
  C:\Windows\System\rOcucnd.exe
  2⤵
  PID:3760
- C:\Windows\System\kVgIHlr.exe
  C:\Windows\System\kVgIHlr.exe
  2⤵
  PID:3776
- C:\Windows\System\iLDkWJI.exe
  C:\Windows\System\iLDkWJI.exe
  2⤵
  PID:3792
- C:\Windows\System\ogvSoBp.exe
  C:\Windows\System\ogvSoBp.exe
  2⤵
  PID:3808
- C:\Windows\System\CeyevSb.exe
  C:\Windows\System\CeyevSb.exe
  2⤵
  PID:3824
- C:\Windows\System\NQUoSdJ.exe
  C:\Windows\System\NQUoSdJ.exe
  2⤵
  PID:3840
- C:\Windows\System\mKHUNBf.exe
  C:\Windows\System\mKHUNBf.exe
  2⤵
  PID:3856
- C:\Windows\System\ofUYYJj.exe
  C:\Windows\System\ofUYYJj.exe
  2⤵
  PID:3872
- C:\Windows\System\rePEqAr.exe
  C:\Windows\System\rePEqAr.exe
  2⤵
  PID:3888
- C:\Windows\System\okcnuFm.exe
  C:\Windows\System\okcnuFm.exe
  2⤵
  PID:3904
- C:\Windows\System\dHPqvBA.exe
  C:\Windows\System\dHPqvBA.exe
  2⤵
  PID:3920
- C:\Windows\System\XeaSgFk.exe
  C:\Windows\System\XeaSgFk.exe
  2⤵
  PID:3936
- C:\Windows\System\YluroyO.exe
  C:\Windows\System\YluroyO.exe
  2⤵
  PID:3952
- C:\Windows\System\UpGgzyq.exe
  C:\Windows\System\UpGgzyq.exe
  2⤵
  PID:3968
- C:\Windows\System\zMnGHnz.exe
  C:\Windows\System\zMnGHnz.exe
  2⤵
  PID:3984
- C:\Windows\System\kgLGDNj.exe
  C:\Windows\System\kgLGDNj.exe
  2⤵
  PID:4004
- C:\Windows\System\zEarVXn.exe
  C:\Windows\System\zEarVXn.exe
  2⤵
  PID:4040
- C:\Windows\System\mAboQMy.exe
  C:\Windows\System\mAboQMy.exe
  2⤵
  PID:3240
- C:\Windows\System\hbsjcyI.exe
  C:\Windows\System\hbsjcyI.exe
  2⤵
  PID:3488
- C:\Windows\System\MLfntzn.exe
  C:\Windows\System\MLfntzn.exe
  2⤵
  PID:3224
- C:\Windows\System\TvMqhkP.exe
  C:\Windows\System\TvMqhkP.exe
  2⤵
  PID:3512
- C:\Windows\System\UslhbPn.exe
  C:\Windows\System\UslhbPn.exe
  2⤵
  PID:3308
- C:\Windows\System\hDHzIHI.exe
  C:\Windows\System\hDHzIHI.exe
  2⤵
  PID:3376
- C:\Windows\System\KAdPchZ.exe
  C:\Windows\System\KAdPchZ.exe
  2⤵
  PID:3580
- C:\Windows\System\yZdRSOp.exe
  C:\Windows\System\yZdRSOp.exe
  2⤵
  PID:3644
- C:\Windows\System\UGLGVJX.exe
  C:\Windows\System\UGLGVJX.exe
  2⤵
  PID:3128
- C:\Windows\System\NHwnfVs.exe
  C:\Windows\System\NHwnfVs.exe
  2⤵
  PID:1600
- C:\Windows\System\cikRXBF.exe
  C:\Windows\System\cikRXBF.exe
  2⤵
  PID:3500
- C:\Windows\System\kcVEwuW.exe
  C:\Windows\System\kcVEwuW.exe
  2⤵
  PID:3720
- C:\Windows\System\MhDGTcE.exe
  C:\Windows\System\MhDGTcE.exe
  2⤵
  PID:3896
- C:\Windows\System\IIpbetc.exe
  C:\Windows\System\IIpbetc.exe
  2⤵
  PID:3960
- C:\Windows\System\mItjPku.exe
  C:\Windows\System\mItjPku.exe
  2⤵
  PID:3628
- C:\Windows\System\jZWULgX.exe
  C:\Windows\System\jZWULgX.exe
  2⤵
  PID:3752
- C:\Windows\System\xSzVVmv.exe
  C:\Windows\System\xSzVVmv.exe
  2⤵
  PID:3816
- C:\Windows\System\OlodzaA.exe
  C:\Windows\System\OlodzaA.exe
  2⤵
  PID:3880
- C:\Windows\System\KXJOKkc.exe
  C:\Windows\System\KXJOKkc.exe
  2⤵
  PID:3944
- C:\Windows\System\XUfmmeS.exe
  C:\Windows\System\XUfmmeS.exe
  2⤵
  PID:4000
- C:\Windows\System\kyoRzPg.exe
  C:\Windows\System\kyoRzPg.exe
  2⤵
  PID:4028
- C:\Windows\System\OeQkKBD.exe
  C:\Windows\System\OeQkKBD.exe
  2⤵
  PID:4056
- C:\Windows\System\wwgvTRs.exe
  C:\Windows\System\wwgvTRs.exe
  2⤵
  PID:4076
- C:\Windows\System\BnJGCbN.exe
  C:\Windows\System\BnJGCbN.exe
  2⤵
  PID:2528
- C:\Windows\System\cBphEBX.exe
  C:\Windows\System\cBphEBX.exe
  2⤵
  PID:1776
- C:\Windows\System\TqFheWG.exe
  C:\Windows\System\TqFheWG.exe
  2⤵
  PID:3144
- C:\Windows\System\bVaeRlv.exe
  C:\Windows\System\bVaeRlv.exe
  2⤵
  PID:3112
- C:\Windows\System\soWcShe.exe
  C:\Windows\System\soWcShe.exe
  2⤵
  PID:3288
- C:\Windows\System\KwaAeRD.exe
  C:\Windows\System\KwaAeRD.exe
  2⤵
  PID:3364
- C:\Windows\System\OEiHdqZ.exe
  C:\Windows\System\OEiHdqZ.exe
  2⤵
  PID:3440
- C:\Windows\System\lZoBXlV.exe
  C:\Windows\System\lZoBXlV.exe
  2⤵
  PID:2136
- C:\Windows\System\CoBFFXp.exe
  C:\Windows\System\CoBFFXp.exe
  2⤵
  PID:3192
- C:\Windows\System\GvhjfYr.exe
  C:\Windows\System\GvhjfYr.exe
  2⤵
  PID:3476
- C:\Windows\System\DhPyvpD.exe
  C:\Windows\System\DhPyvpD.exe
  2⤵
  PID:3516
- C:\Windows\System\VIiQGkx.exe
  C:\Windows\System\VIiQGkx.exe
  2⤵
  PID:3576
- C:\Windows\System\VtOiaze.exe
  C:\Windows\System\VtOiaze.exe
  2⤵
  PID:3560
- C:\Windows\System\ADpgIFR.exe
  C:\Windows\System\ADpgIFR.exe
  2⤵
  PID:3704
- C:\Windows\System\fHoSsOX.exe
  C:\Windows\System\fHoSsOX.exe
  2⤵
  PID:2348
- C:\Windows\System\WBBMrmb.exe
  C:\Windows\System\WBBMrmb.exe
  2⤵
  PID:3532
- C:\Windows\System\AAFKCse.exe
  C:\Windows\System\AAFKCse.exe
  2⤵
  PID:3676
- C:\Windows\System\NQDTgZt.exe
  C:\Windows\System\NQDTgZt.exe
  2⤵
  PID:3592
- C:\Windows\System\VbHsPbx.exe
  C:\Windows\System\VbHsPbx.exe
  2⤵
  PID:3724
- C:\Windows\System\pHnjaHG.exe
  C:\Windows\System\pHnjaHG.exe
  2⤵
  PID:3916
- C:\Windows\System\wTASeRo.exe
  C:\Windows\System\wTASeRo.exe
  2⤵
  PID:4024
- C:\Windows\System\RUBYFjZ.exe
  C:\Windows\System\RUBYFjZ.exe
  2⤵
  PID:4064
- C:\Windows\System\DgBzwGa.exe
  C:\Windows\System\DgBzwGa.exe
  2⤵
  PID:4068
- C:\Windows\System\QUyycGa.exe
  C:\Windows\System\QUyycGa.exe
  2⤵
  PID:616
- C:\Windows\System\ravzTli.exe
  C:\Windows\System\ravzTli.exe
  2⤵
  PID:2068
- C:\Windows\System\CIXxNAA.exe
  C:\Windows\System\CIXxNAA.exe
  2⤵
  PID:1576
- C:\Windows\System\NCqMufW.exe
  C:\Windows\System\NCqMufW.exe
  2⤵
  PID:3356
- C:\Windows\System\jIORjTO.exe
  C:\Windows\System\jIORjTO.exe
  2⤵
  PID:3404
- C:\Windows\System\kiyvuBJ.exe
  C:\Windows\System\kiyvuBJ.exe
  2⤵
  PID:3212
- C:\Windows\System\YZwyopH.exe
  C:\Windows\System\YZwyopH.exe
  2⤵
  PID:3244
- C:\Windows\System\XRMuATD.exe
  C:\Windows\System\XRMuATD.exe
  2⤵
  PID:3548
- C:\Windows\System\tiqTeKB.exe
  C:\Windows\System\tiqTeKB.exe
  2⤵
  PID:3800
- C:\Windows\System\kbAVXBn.exe
  C:\Windows\System\kbAVXBn.exe
  2⤵
  PID:3624
- C:\Windows\System\Vbjdcoy.exe
  C:\Windows\System\Vbjdcoy.exe
  2⤵
  PID:2304
- C:\Windows\System\vrEHDPl.exe
  C:\Windows\System\vrEHDPl.exe
  2⤵
  PID:4012
- C:\Windows\System\WutPvqa.exe
  C:\Windows\System\WutPvqa.exe
  2⤵
  PID:1996
- C:\Windows\System\cnChJlH.exe
  C:\Windows\System\cnChJlH.exe
  2⤵
  PID:3328
- C:\Windows\System\cnVenKH.exe
  C:\Windows\System\cnVenKH.exe
  2⤵
  PID:3160
- C:\Windows\System\crDtaNC.exe
  C:\Windows\System\crDtaNC.exe
  2⤵
  PID:3256
- C:\Windows\System\UAqJVDd.exe
  C:\Windows\System\UAqJVDd.exe
  2⤵
  PID:1192
- C:\Windows\System\oEiuDzx.exe
  C:\Windows\System\oEiuDzx.exe
  2⤵
  PID:2636
- C:\Windows\System\aaaSQBg.exe
  C:\Windows\System\aaaSQBg.exe
  2⤵
  PID:3400
- C:\Windows\System\RrULqXO.exe
  C:\Windows\System\RrULqXO.exe
  2⤵
  PID:3196
- C:\Windows\System\rZVsdec.exe
  C:\Windows\System\rZVsdec.exe
  2⤵
  PID:3868
- C:\Windows\System\OlEnRmu.exe
  C:\Windows\System\OlEnRmu.exe
  2⤵
  PID:3736
- C:\Windows\System\XBsltNu.exe
  C:\Windows\System\XBsltNu.exe
  2⤵
  PID:4088
- C:\Windows\System\UcvdDRv.exe
  C:\Windows\System\UcvdDRv.exe
  2⤵
  PID:3992
- C:\Windows\System\keYfdYN.exe
  C:\Windows\System\keYfdYN.exe
  2⤵
  PID:3848
- C:\Windows\System\KKvGyOX.exe
  C:\Windows\System\KKvGyOX.exe
  2⤵
  PID:3612
- C:\Windows\System\ugxVEFa.exe
  C:\Windows\System\ugxVEFa.exe
  2⤵
  PID:3692
- C:\Windows\System\DTZmIGk.exe
  C:\Windows\System\DTZmIGk.exe
  2⤵
  PID:4112
- C:\Windows\System\YBwgthx.exe
  C:\Windows\System\YBwgthx.exe
  2⤵
  PID:4128
- C:\Windows\System\mMCyQaU.exe
  C:\Windows\System\mMCyQaU.exe
  2⤵
  PID:4148
- C:\Windows\System\AyBmmLQ.exe
  C:\Windows\System\AyBmmLQ.exe
  2⤵
  PID:4164
- C:\Windows\System\vUahwuI.exe
  C:\Windows\System\vUahwuI.exe
  2⤵
  PID:4180
- C:\Windows\System\BvqrNHi.exe
  C:\Windows\System\BvqrNHi.exe
  2⤵
  PID:4200
- C:\Windows\System\fHhrYso.exe
  C:\Windows\System\fHhrYso.exe
  2⤵
  PID:4216
- C:\Windows\System\omBzYkE.exe
  C:\Windows\System\omBzYkE.exe
  2⤵
  PID:4232
- C:\Windows\System\xNSPABN.exe
  C:\Windows\System\xNSPABN.exe
  2⤵
  PID:4248
- C:\Windows\System\MPZldSH.exe
  C:\Windows\System\MPZldSH.exe
  2⤵
  PID:4264
- C:\Windows\System\FlRLymo.exe
  C:\Windows\System\FlRLymo.exe
  2⤵
  PID:4280
- C:\Windows\System\ZdUSTzj.exe
  C:\Windows\System\ZdUSTzj.exe
  2⤵
  PID:4300
- C:\Windows\System\PWcZPWv.exe
  C:\Windows\System\PWcZPWv.exe
  2⤵
  PID:4316
- C:\Windows\System\SBTRouH.exe
  C:\Windows\System\SBTRouH.exe
  2⤵
  PID:4332
- C:\Windows\System\hbDXGtD.exe
  C:\Windows\System\hbDXGtD.exe
  2⤵
  PID:4348
- C:\Windows\System\NMhGxst.exe
  C:\Windows\System\NMhGxst.exe
  2⤵
  PID:4364
- C:\Windows\System\ANvcyXA.exe
  C:\Windows\System\ANvcyXA.exe
  2⤵
  PID:4380
- C:\Windows\System\uvAJLlO.exe
  C:\Windows\System\uvAJLlO.exe
  2⤵
  PID:4396
- C:\Windows\System\OgdZiwQ.exe
  C:\Windows\System\OgdZiwQ.exe
  2⤵
  PID:4412
- C:\Windows\System\qbsHDfH.exe
  C:\Windows\System\qbsHDfH.exe
  2⤵
  PID:4432
- C:\Windows\System\tTffYQZ.exe
  C:\Windows\System\tTffYQZ.exe
  2⤵
  PID:4448
- C:\Windows\System\xRWlaBK.exe
  C:\Windows\System\xRWlaBK.exe
  2⤵
  PID:4464
- C:\Windows\System\AeJejSX.exe
  C:\Windows\System\AeJejSX.exe
  2⤵
  PID:4480
- C:\Windows\System\OrYvxou.exe
  C:\Windows\System\OrYvxou.exe
  2⤵
  PID:4520
- C:\Windows\System\SaZnCgM.exe
  C:\Windows\System\SaZnCgM.exe
  2⤵
  PID:4544
- C:\Windows\System\ryixmXQ.exe
  C:\Windows\System\ryixmXQ.exe
  2⤵
  PID:4568
- C:\Windows\System\IEEkjmU.exe
  C:\Windows\System\IEEkjmU.exe
  2⤵
  PID:4656
- C:\Windows\System\MKIPZEx.exe
  C:\Windows\System\MKIPZEx.exe
  2⤵
  PID:4672
- C:\Windows\System\ohPzpLW.exe
  C:\Windows\System\ohPzpLW.exe
  2⤵
  PID:4688
- C:\Windows\System\KVdbaHQ.exe
  C:\Windows\System\KVdbaHQ.exe
  2⤵
  PID:4704
- C:\Windows\System\jdhSmVm.exe
  C:\Windows\System\jdhSmVm.exe
  2⤵
  PID:4720
- C:\Windows\System\yJSqXlr.exe
  C:\Windows\System\yJSqXlr.exe
  2⤵
  PID:4736
- C:\Windows\System\hSMhDPG.exe
  C:\Windows\System\hSMhDPG.exe
  2⤵
  PID:4752
- C:\Windows\System\aRqAmVa.exe
  C:\Windows\System\aRqAmVa.exe
  2⤵
  PID:4768
- C:\Windows\System\ElNDppD.exe
  C:\Windows\System\ElNDppD.exe
  2⤵
  PID:4788
- C:\Windows\System\AjBYpXs.exe
  C:\Windows\System\AjBYpXs.exe
  2⤵
  PID:4804
- C:\Windows\System\cccmufI.exe
  C:\Windows\System\cccmufI.exe
  2⤵
  PID:4820
- C:\Windows\System\SzeXDDO.exe
  C:\Windows\System\SzeXDDO.exe
  2⤵
  PID:4836
- C:\Windows\System\YCyoOYf.exe
  C:\Windows\System\YCyoOYf.exe
  2⤵
  PID:4852
- C:\Windows\System\NVANzkW.exe
  C:\Windows\System\NVANzkW.exe
  2⤵
  PID:4868
- C:\Windows\System\rSfuhzq.exe
  C:\Windows\System\rSfuhzq.exe
  2⤵
  PID:4884
- C:\Windows\System\kXjJWeQ.exe
  C:\Windows\System\kXjJWeQ.exe
  2⤵
  PID:4904
- C:\Windows\System\ScKqSqC.exe
  C:\Windows\System\ScKqSqC.exe
  2⤵
  PID:4920
- C:\Windows\System\iHcKXpM.exe
  C:\Windows\System\iHcKXpM.exe
  2⤵
  PID:4936
- C:\Windows\System\YDvInKU.exe
  C:\Windows\System\YDvInKU.exe
  2⤵
  PID:4952
- C:\Windows\System\FGQruLK.exe
  C:\Windows\System\FGQruLK.exe
  2⤵
  PID:4968
- C:\Windows\System\PSnvYbA.exe
  C:\Windows\System\PSnvYbA.exe
  2⤵
  PID:4984
- C:\Windows\System\dwIWhTZ.exe
  C:\Windows\System\dwIWhTZ.exe
  2⤵
  PID:5000
- C:\Windows\System\JoeBqfA.exe
  C:\Windows\System\JoeBqfA.exe
  2⤵
  PID:5020
- C:\Windows\System\veCkjVC.exe
  C:\Windows\System\veCkjVC.exe
  2⤵
  PID:5044
- C:\Windows\System\UeSMATW.exe
  C:\Windows\System\UeSMATW.exe
  2⤵
  PID:5064
- C:\Windows\System\ljRXMuO.exe
  C:\Windows\System\ljRXMuO.exe
  2⤵
  PID:5080
- C:\Windows\System\RpyEebk.exe
  C:\Windows\System\RpyEebk.exe
  2⤵
  PID:5096
- C:\Windows\System\EJyChLR.exe
  C:\Windows\System\EJyChLR.exe
  2⤵
  PID:5112
- C:\Windows\System\TsdRjEf.exe
  C:\Windows\System\TsdRjEf.exe
  2⤵
  PID:3428
- C:\Windows\System\fAYhfgT.exe
  C:\Windows\System\fAYhfgT.exe
  2⤵
  PID:4188
- C:\Windows\System\wpFZOLG.exe
  C:\Windows\System\wpFZOLG.exe
  2⤵
  PID:4212
- C:\Windows\System\MbLcJHC.exe
  C:\Windows\System\MbLcJHC.exe
  2⤵
  PID:4508
- C:\Windows\System\tEMdjbs.exe
  C:\Windows\System\tEMdjbs.exe
  2⤵
  PID:4500
- C:\Windows\System\JTnjIzW.exe
  C:\Windows\System\JTnjIzW.exe
  2⤵
  PID:4140
- C:\Windows\System\tEUnmUg.exe
  C:\Windows\System\tEUnmUg.exe
  2⤵
  PID:4176
- C:\Windows\System\yEcITpH.exe
  C:\Windows\System\yEcITpH.exe
  2⤵
  PID:4244
- C:\Windows\System\PWUmWnx.exe
  C:\Windows\System\PWUmWnx.exe
  2⤵
  PID:4408
- C:\Windows\System\ekmzeCK.exe
  C:\Windows\System\ekmzeCK.exe
  2⤵
  PID:4356
- C:\Windows\System\pthrCJj.exe
  C:\Windows\System\pthrCJj.exe
  2⤵
  PID:4652
- C:\Windows\System\ycBfKlh.exe
  C:\Windows\System\ycBfKlh.exe
  2⤵
  PID:4668
- C:\Windows\System\wSTatdh.exe
  C:\Windows\System\wSTatdh.exe
  2⤵
  PID:4744
- C:\Windows\System\ntrArpZ.exe
  C:\Windows\System\ntrArpZ.exe
  2⤵
  PID:4760
- C:\Windows\System\rbjQSPR.exe
  C:\Windows\System\rbjQSPR.exe
  2⤵
  PID:5032
- C:\Windows\System\kLFSYad.exe
  C:\Windows\System\kLFSYad.exe
  2⤵
  PID:4696
- C:\Windows\System\xgKGNpZ.exe
  C:\Windows\System\xgKGNpZ.exe
  2⤵
  PID:5016
- C:\Windows\System\xVGiELz.exe
  C:\Windows\System\xVGiELz.exe
  2⤵
  PID:2728
- C:\Windows\System\Hmpyjrk.exe
  C:\Windows\System\Hmpyjrk.exe
  2⤵
  PID:5060
- C:\Windows\System\vlolouD.exe
  C:\Windows\System\vlolouD.exe
  2⤵
  PID:5056
- C:\Windows\System\jnLTTJo.exe
  C:\Windows\System\jnLTTJo.exe
  2⤵
  PID:4196
- C:\Windows\System\lSdNtma.exe
  C:\Windows\System\lSdNtma.exe
  2⤵
  PID:4916
- C:\Windows\System\qqSZgfl.exe
  C:\Windows\System\qqSZgfl.exe
  2⤵
  PID:4492
- C:\Windows\System\woutqTN.exe
  C:\Windows\System\woutqTN.exe
  2⤵
  PID:4880
- C:\Windows\System\yijpjLR.exe
  C:\Windows\System\yijpjLR.exe
  2⤵
  PID:4424
- C:\Windows\System\jxvELgH.exe
  C:\Windows\System\jxvELgH.exe
  2⤵
  PID:4960
- C:\Windows\System\HRJSTLB.exe
  C:\Windows\System\HRJSTLB.exe
  2⤵
  PID:4276
- C:\Windows\System\fXIgIym.exe
  C:\Windows\System\fXIgIym.exe
  2⤵
  PID:4312
- C:\Windows\System\IqWXoCs.exe
  C:\Windows\System\IqWXoCs.exe
  2⤵
  PID:4472
- C:\Windows\System\frKhpYV.exe
  C:\Windows\System\frKhpYV.exe
  2⤵
  PID:4428
- C:\Windows\System\VRfCTKK.exe
  C:\Windows\System\VRfCTKK.exe
  2⤵
  PID:4388
- C:\Windows\System\VXAjPnR.exe
  C:\Windows\System\VXAjPnR.exe
  2⤵
  PID:4552
- C:\Windows\System\DzLrudJ.exe
  C:\Windows\System\DzLrudJ.exe
  2⤵
  PID:4556
- C:\Windows\System\AeFrexJ.exe
  C:\Windows\System\AeFrexJ.exe
  2⤵
  PID:4600
- C:\Windows\System\GsESmZw.exe
  C:\Windows\System\GsESmZw.exe
  2⤵
  PID:4608
- C:\Windows\System\mksqioY.exe
  C:\Windows\System\mksqioY.exe
  2⤵
  PID:4624
- C:\Windows\System\fPajaRV.exe
  C:\Windows\System\fPajaRV.exe
  2⤵
  PID:4576
- C:\Windows\System\wPoVTJb.exe
  C:\Windows\System\wPoVTJb.exe
  2⤵
  PID:2540
- C:\Windows\System\uXcfWgr.exe
  C:\Windows\System\uXcfWgr.exe
  2⤵
  PID:4732
- C:\Windows\System\iKdjLQU.exe
  C:\Windows\System\iKdjLQU.exe
  2⤵
  PID:4712
- C:\Windows\System\DhnjxuH.exe
  C:\Windows\System\DhnjxuH.exe
  2⤵
  PID:5012
- C:\Windows\System\NhIlpvZ.exe
  C:\Windows\System\NhIlpvZ.exe
  2⤵
  PID:4876
- C:\Windows\System\tftRhiD.exe
  C:\Windows\System\tftRhiD.exe
  2⤵
  PID:5036
- C:\Windows\System\QxnxthH.exe
  C:\Windows\System\QxnxthH.exe
  2⤵
  PID:1596
- C:\Windows\System\MpzmtTp.exe
  C:\Windows\System\MpzmtTp.exe
  2⤵
  PID:4512
- C:\Windows\System\ryODjql.exe
  C:\Windows\System\ryODjql.exe
  2⤵
  PID:4860
- C:\Windows\System\fLqIIGz.exe
  C:\Windows\System\fLqIIGz.exe
  2⤵
  PID:5136
- C:\Windows\System\FoKXPXQ.exe
  C:\Windows\System\FoKXPXQ.exe
  2⤵
  PID:5152
- C:\Windows\System\jVihNsw.exe
  C:\Windows\System\jVihNsw.exe
  2⤵
  PID:5168
- C:\Windows\System\uOMJsBV.exe
  C:\Windows\System\uOMJsBV.exe
  2⤵
  PID:5184
- C:\Windows\System\VYgvdLc.exe
  C:\Windows\System\VYgvdLc.exe
  2⤵
  PID:5200
- C:\Windows\System\WlXRpWO.exe
  C:\Windows\System\WlXRpWO.exe
  2⤵
  PID:5324
- C:\Windows\System\EXfvZjq.exe
  C:\Windows\System\EXfvZjq.exe
  2⤵
  PID:5344
- C:\Windows\System\waBEYjo.exe
  C:\Windows\System\waBEYjo.exe
  2⤵
  PID:5372
- C:\Windows\System\wkJfuGp.exe
  C:\Windows\System\wkJfuGp.exe
  2⤵
  PID:5388
- C:\Windows\System\lXfaUel.exe
  C:\Windows\System\lXfaUel.exe
  2⤵
  PID:5408
- C:\Windows\System\nxRFMBh.exe
  C:\Windows\System\nxRFMBh.exe
  2⤵
  PID:5424
- C:\Windows\System\qNrcXMC.exe
  C:\Windows\System\qNrcXMC.exe
  2⤵
  PID:5448
- C:\Windows\System\bugyyLL.exe
  C:\Windows\System\bugyyLL.exe
  2⤵
  PID:5472
- C:\Windows\System\pouFuoe.exe
  C:\Windows\System\pouFuoe.exe
  2⤵
  PID:5488
- C:\Windows\System\krOKVgI.exe
  C:\Windows\System\krOKVgI.exe
  2⤵
  PID:5508
- C:\Windows\System\dXKNfVY.exe
  C:\Windows\System\dXKNfVY.exe
  2⤵
  PID:5528
- C:\Windows\System\RyrEkmA.exe
  C:\Windows\System\RyrEkmA.exe
  2⤵
  PID:5552
- C:\Windows\System\fPXtDjI.exe
  C:\Windows\System\fPXtDjI.exe
  2⤵
  PID:5568
- C:\Windows\System\bPLwUSS.exe
  C:\Windows\System\bPLwUSS.exe
  2⤵
  PID:5588
- C:\Windows\System\lQRbyrH.exe
  C:\Windows\System\lQRbyrH.exe
  2⤵
  PID:5608
- C:\Windows\System\TkuxTzG.exe
  C:\Windows\System\TkuxTzG.exe
  2⤵
  PID:5632
- C:\Windows\System\OYyxZkY.exe
  C:\Windows\System\OYyxZkY.exe
  2⤵
  PID:5648
- C:\Windows\System\vdJyrUM.exe
  C:\Windows\System\vdJyrUM.exe
  2⤵
  PID:5664
- C:\Windows\System\DjHIycy.exe
  C:\Windows\System\DjHIycy.exe
  2⤵
  PID:5680
- C:\Windows\System\cjFuUwY.exe
  C:\Windows\System\cjFuUwY.exe
  2⤵
  PID:5696
- C:\Windows\System\ILYsPNw.exe
  C:\Windows\System\ILYsPNw.exe
  2⤵
  PID:5716
- C:\Windows\System\mdEvptw.exe
  C:\Windows\System\mdEvptw.exe
  2⤵
  PID:5732
- C:\Windows\System\QUZGwcj.exe
  C:\Windows\System\QUZGwcj.exe
  2⤵
  PID:5748
- C:\Windows\System\vsDKTsx.exe
  C:\Windows\System\vsDKTsx.exe
  2⤵
  PID:5764
- C:\Windows\System\FiiTPff.exe
  C:\Windows\System\FiiTPff.exe
  2⤵
  PID:5780
- C:\Windows\System\mUlIRLY.exe
  C:\Windows\System\mUlIRLY.exe
  2⤵
  PID:5796
- C:\Windows\System\OBmAOhe.exe
  C:\Windows\System\OBmAOhe.exe
  2⤵
  PID:5812
- C:\Windows\System\JGeToSL.exe
  C:\Windows\System\JGeToSL.exe
  2⤵
  PID:5828
- C:\Windows\System\ChTqNzL.exe
  C:\Windows\System\ChTqNzL.exe
  2⤵
  PID:5844
- C:\Windows\System\dkyhFQD.exe
  C:\Windows\System\dkyhFQD.exe
  2⤵
  PID:5860
- C:\Windows\System\nMhYGLq.exe
  C:\Windows\System\nMhYGLq.exe
  2⤵
  PID:5928
- C:\Windows\System\VUMIsMK.exe
  C:\Windows\System\VUMIsMK.exe
  2⤵
  PID:5944
- C:\Windows\System\UXOlHek.exe
  C:\Windows\System\UXOlHek.exe
  2⤵
  PID:5964
- C:\Windows\System\BjCeObg.exe
  C:\Windows\System\BjCeObg.exe
  2⤵
  PID:5980
- C:\Windows\System\YbOSIYr.exe
  C:\Windows\System\YbOSIYr.exe
  2⤵
  PID:5996
- C:\Windows\System\udnBcCO.exe
  C:\Windows\System\udnBcCO.exe
  2⤵
  PID:6012
- C:\Windows\System\aPJbTSq.exe
  C:\Windows\System\aPJbTSq.exe
  2⤵
  PID:6032
- C:\Windows\System\tcfDbCd.exe
  C:\Windows\System\tcfDbCd.exe
  2⤵
  PID:6048
- C:\Windows\System\PekCsyq.exe
  C:\Windows\System\PekCsyq.exe
  2⤵
  PID:6064
- C:\Windows\System\fiLlKDd.exe
  C:\Windows\System\fiLlKDd.exe
  2⤵
  PID:6080
- C:\Windows\System\efTcVUa.exe
  C:\Windows\System\efTcVUa.exe
  2⤵
  PID:6096
- C:\Windows\System\ZhTcYSs.exe
  C:\Windows\System\ZhTcYSs.exe
  2⤵
  PID:6112
- C:\Windows\System\OchQxBK.exe
  C:\Windows\System\OchQxBK.exe
  2⤵
  PID:2444
- C:\Windows\System\vyiyZCQ.exe
  C:\Windows\System\vyiyZCQ.exe
  2⤵
  PID:4612
- C:\Windows\System\wBjLBMI.exe
  C:\Windows\System\wBjLBMI.exe
  2⤵
  PID:4360
- C:\Windows\System\pTUoQWM.exe
  C:\Windows\System\pTUoQWM.exe
  2⤵
  PID:4420
- C:\Windows\System\HZJwjLt.exe
  C:\Windows\System\HZJwjLt.exe
  2⤵
  PID:4136
- C:\Windows\System\UETjFGT.exe
  C:\Windows\System\UETjFGT.exe
  2⤵
  PID:4644
- C:\Windows\System\UYRrGyR.exe
  C:\Windows\System\UYRrGyR.exe
  2⤵
  PID:4780
- C:\Windows\System\lAChzLp.exe
  C:\Windows\System\lAChzLp.exe
  2⤵
  PID:5144
- C:\Windows\System\MNsMPOD.exe
  C:\Windows\System\MNsMPOD.exe
  2⤵
  PID:5208
- C:\Windows\System\lobXeLg.exe
  C:\Windows\System\lobXeLg.exe
  2⤵
  PID:4104
- C:\Windows\System\loVqGgO.exe
  C:\Windows\System\loVqGgO.exe
  2⤵
  PID:2388
- C:\Windows\System\AcsMwlF.exe
  C:\Windows\System\AcsMwlF.exe
  2⤵
  PID:4648
- C:\Windows\System\ilBjXpI.exe
  C:\Windows\System\ilBjXpI.exe
  2⤵
  PID:4592
- C:\Windows\System\AIbYwwm.exe
  C:\Windows\System\AIbYwwm.exe
  2⤵
  PID:4992
- C:\Windows\System\hBDjQdI.exe
  C:\Windows\System\hBDjQdI.exe
  2⤵
  PID:5160
- C:\Windows\System\TrBjfZG.exe
  C:\Windows\System\TrBjfZG.exe
  2⤵
  PID:5272
- C:\Windows\System\aCPwSZs.exe
  C:\Windows\System\aCPwSZs.exe
  2⤵
  PID:5232
- C:\Windows\System\MAmbFVz.exe
  C:\Windows\System\MAmbFVz.exe
  2⤵
  PID:5260
- C:\Windows\System\LuXsAal.exe
  C:\Windows\System\LuXsAal.exe
  2⤵
  PID:5288
- C:\Windows\System\EPSGvdL.exe
  C:\Windows\System\EPSGvdL.exe
  2⤵
  PID:5304
- C:\Windows\System\VuTqYfw.exe
  C:\Windows\System\VuTqYfw.exe
  2⤵
  PID:5212
- C:\Windows\System\DixhWWF.exe
  C:\Windows\System\DixhWWF.exe
  2⤵
  PID:5352
- C:\Windows\System\WqeFUXd.exe
  C:\Windows\System\WqeFUXd.exe
  2⤵
  PID:5368
- C:\Windows\System\ZDECkiF.exe
  C:\Windows\System\ZDECkiF.exe
  2⤵
  PID:4476
- C:\Windows\System\BGWYGQO.exe
  C:\Windows\System\BGWYGQO.exe
  2⤵
  PID:5432
- C:\Windows\System\REtVAnw.exe
  C:\Windows\System\REtVAnw.exe
  2⤵
  PID:5436
- C:\Windows\System\QJrDntP.exe
  C:\Windows\System\QJrDntP.exe
  2⤵
  PID:5460
- C:\Windows\System\tCRrEpG.exe
  C:\Windows\System\tCRrEpG.exe
  2⤵
  PID:5504
- C:\Windows\System\ltdqLeX.exe
  C:\Windows\System\ltdqLeX.exe
  2⤵
  PID:5580
- C:\Windows\System\EabcPCT.exe
  C:\Windows\System\EabcPCT.exe
  2⤵
  PID:5628
- C:\Windows\System\AVAfcBy.exe
  C:\Windows\System\AVAfcBy.exe
  2⤵
  PID:5676
- C:\Windows\System\HUnpEEc.exe
  C:\Windows\System\HUnpEEc.exe
  2⤵
  PID:5712
- C:\Windows\System\otLyArU.exe
  C:\Windows\System\otLyArU.exe
  2⤵
  PID:5688
- C:\Windows\System\mjHAfTf.exe
  C:\Windows\System\mjHAfTf.exe
  2⤵
  PID:5264
- C:\Windows\System\LqAOimR.exe
  C:\Windows\System\LqAOimR.exe
  2⤵
  PID:5808
- C:\Windows\System\dcrvIZZ.exe
  C:\Windows\System\dcrvIZZ.exe
  2⤵
  PID:5788
- C:\Windows\System\uUESxgA.exe
  C:\Windows\System\uUESxgA.exe
  2⤵
  PID:5824
- C:\Windows\System\dkgHSFo.exe
  C:\Windows\System\dkgHSFo.exe
  2⤵
  PID:5924
- C:\Windows\System\fEdyIrH.exe
  C:\Windows\System\fEdyIrH.exe
  2⤵
  PID:5904
- C:\Windows\System\RazNInn.exe
  C:\Windows\System\RazNInn.exe
  2⤵
  PID:5884
- C:\Windows\System\UzoWEJP.exe
  C:\Windows\System\UzoWEJP.exe
  2⤵
  PID:5936
- C:\Windows\System\hxAEOGx.exe
  C:\Windows\System\hxAEOGx.exe
  2⤵
  PID:5960
- C:\Windows\System\hMpVRRL.exe
  C:\Windows\System\hMpVRRL.exe
  2⤵
  PID:5972
- C:\Windows\System\egWYUxc.exe
  C:\Windows\System\egWYUxc.exe
  2⤵
  PID:6056
- C:\Windows\System\jbHZmHM.exe
  C:\Windows\System\jbHZmHM.exe
  2⤵
  PID:6104
- C:\Windows\System\wvhDNBm.exe
  C:\Windows\System\wvhDNBm.exe
  2⤵
  PID:6092
- C:\Windows\System\mgNOfKM.exe
  C:\Windows\System\mgNOfKM.exe
  2⤵
  PID:6132
- C:\Windows\System\HgPEpwi.exe
  C:\Windows\System\HgPEpwi.exe
  2⤵
  PID:4900
- C:\Windows\System\IWNKyxt.exe
  C:\Windows\System\IWNKyxt.exe
  2⤵
  PID:4864
- C:\Windows\System\APXJNCZ.exe
  C:\Windows\System\APXJNCZ.exe
  2⤵
  PID:4632
- C:\Windows\System\gLqhAcr.exe
  C:\Windows\System\gLqhAcr.exe
  2⤵
  PID:4272
- C:\Windows\System\CMFURfG.exe
  C:\Windows\System\CMFURfG.exe
  2⤵
  PID:5192
- C:\Windows\System\OxLTpIR.exe
  C:\Windows\System\OxLTpIR.exe
  2⤵
  PID:5196
- C:\Windows\System\qPQznwD.exe
  C:\Windows\System\qPQznwD.exe
  2⤵
  PID:5028
- C:\Windows\System\HEeJtcx.exe
  C:\Windows\System\HEeJtcx.exe
  2⤵
  PID:5284
- C:\Windows\System\hbiOjIN.exe
  C:\Windows\System\hbiOjIN.exe
  2⤵
  PID:5364
- C:\Windows\System\TqPBhdq.exe
  C:\Windows\System\TqPBhdq.exe
  2⤵
  PID:5256
- C:\Windows\System\MfHOQVt.exe
  C:\Windows\System\MfHOQVt.exe
  2⤵
  PID:5500
- C:\Windows\System\XIlLpAd.exe
  C:\Windows\System\XIlLpAd.exe
  2⤵
  PID:5544
- C:\Windows\System\ixhJWDp.exe
  C:\Windows\System\ixhJWDp.exe
  2⤵
  PID:5564
- C:\Windows\System\lRfUZIl.exe
  C:\Windows\System\lRfUZIl.exe
  2⤵
  PID:5600
- C:\Windows\System\yAbHuxf.exe
  C:\Windows\System\yAbHuxf.exe
  2⤵
  PID:5660
- C:\Windows\System\vyNnJjL.exe
  C:\Windows\System\vyNnJjL.exe
  2⤵
  PID:5820
- C:\Windows\System\ihIDpOp.exe
  C:\Windows\System\ihIDpOp.exe
  2⤵
  PID:5876
- C:\Windows\System\Siderwu.exe
  C:\Windows\System\Siderwu.exe
  2⤵
  PID:5340
- C:\Windows\System\rKHCArK.exe
  C:\Windows\System\rKHCArK.exe
  2⤵
  PID:6020
- C:\Windows\System\XRedRNM.exe
  C:\Windows\System\XRedRNM.exe
  2⤵
  PID:6088
- C:\Windows\System\XabFSYQ.exe
  C:\Windows\System\XabFSYQ.exe
  2⤵
  PID:5624
- C:\Windows\System\YSAFfSy.exe
  C:\Windows\System\YSAFfSy.exe
  2⤵
  PID:5704
- C:\Windows\System\TEzCMuc.exe
  C:\Windows\System\TEzCMuc.exe
  2⤵
  PID:5744
- C:\Windows\System\HclgpdC.exe
  C:\Windows\System\HclgpdC.exe
  2⤵
  PID:5856
- C:\Windows\System\LyKNZQv.exe
  C:\Windows\System\LyKNZQv.exe
  2⤵
  PID:5940
- C:\Windows\System\nZdiBFu.exe
  C:\Windows\System\nZdiBFu.exe
  2⤵
  PID:6076
- C:\Windows\System\inyoKzd.exe
  C:\Windows\System\inyoKzd.exe
  2⤵
  PID:4812
- C:\Windows\System\UTXKnIH.exe
  C:\Windows\System\UTXKnIH.exe
  2⤵
  PID:4460
- C:\Windows\System\HenFXJn.exe
  C:\Windows\System\HenFXJn.exe
  2⤵
  PID:4896
- C:\Windows\System\IvoaRVk.exe
  C:\Windows\System\IvoaRVk.exe
  2⤵
  PID:4620
- C:\Windows\System\TydEpFI.exe
  C:\Windows\System\TydEpFI.exe
  2⤵
  PID:5224
- C:\Windows\System\HHdQWfq.exe
  C:\Windows\System\HHdQWfq.exe
  2⤵
  PID:5888
- C:\Windows\System\qhIfnZe.exe
  C:\Windows\System\qhIfnZe.exe
  2⤵
  PID:4976
- C:\Windows\System\cYNIYmr.exe
  C:\Windows\System\cYNIYmr.exe
  2⤵
  PID:5216
- C:\Windows\System\uthaGBr.exe
  C:\Windows\System\uthaGBr.exe
  2⤵
  PID:5240
- C:\Windows\System\Nhtsstc.exe
  C:\Windows\System\Nhtsstc.exe
  2⤵
  PID:4392
- C:\Windows\System\WIkbFbi.exe
  C:\Windows\System\WIkbFbi.exe
  2⤵
  PID:5596
- C:\Windows\System\aNsbFPA.exe
  C:\Windows\System\aNsbFPA.exe
  2⤵
  PID:5308
- C:\Windows\System\cygCNQh.exe
  C:\Windows\System\cygCNQh.exe
  2⤵
  PID:6040
- C:\Windows\System\TzIxOVY.exe
  C:\Windows\System\TzIxOVY.exe
  2⤵
  PID:5332
- C:\Windows\System\aEPYKRG.exe
  C:\Windows\System\aEPYKRG.exe
  2⤵
  PID:5852
- C:\Windows\System\eANOCZD.exe
  C:\Windows\System\eANOCZD.exe
  2⤵
  PID:4160
- C:\Windows\System\cMosmdu.exe
  C:\Windows\System\cMosmdu.exe
  2⤵
  PID:5316
- C:\Windows\System\DYfjgPw.exe
  C:\Windows\System\DYfjgPw.exe
  2⤵
  PID:5108
- C:\Windows\System\oXUdLGM.exe
  C:\Windows\System\oXUdLGM.exe
  2⤵
  PID:4376
- C:\Windows\System\dNCsMIV.exe
  C:\Windows\System\dNCsMIV.exe
  2⤵
  PID:5908
- C:\Windows\System\hLKFOIP.exe
  C:\Windows\System\hLKFOIP.exe
  2⤵
  PID:5540
- C:\Windows\System\qSlcfXg.exe
  C:\Windows\System\qSlcfXg.exe
  2⤵
  PID:5804
- C:\Windows\System\OrpTsEP.exe
  C:\Windows\System\OrpTsEP.exe
  2⤵
  PID:5220
- C:\Windows\System\LINEfsH.exe
  C:\Windows\System\LINEfsH.exe
  2⤵
  PID:4504
- C:\Windows\System\wHKkVUA.exe
  C:\Windows\System\wHKkVUA.exe
  2⤵
  PID:5396
- C:\Windows\System\RCZhTsp.exe
  C:\Windows\System\RCZhTsp.exe
  2⤵
  PID:6152
- C:\Windows\System\wByGvmR.exe
  C:\Windows\System\wByGvmR.exe
  2⤵
  PID:6168
- C:\Windows\System\YHKZPWB.exe
  C:\Windows\System\YHKZPWB.exe
  2⤵
  PID:6184
- C:\Windows\System\UpqTHzM.exe
  C:\Windows\System\UpqTHzM.exe
  2⤵
  PID:6200
- C:\Windows\System\ovKMven.exe
  C:\Windows\System\ovKMven.exe
  2⤵
  PID:6216
- C:\Windows\System\nwRtjKB.exe
  C:\Windows\System\nwRtjKB.exe
  2⤵
  PID:6236
- C:\Windows\System\Jttvpck.exe
  C:\Windows\System\Jttvpck.exe
  2⤵
  PID:6252
- C:\Windows\System\beZbEcD.exe
  C:\Windows\System\beZbEcD.exe
  2⤵
  PID:6348
- C:\Windows\System\iZiNkIV.exe
  C:\Windows\System\iZiNkIV.exe
  2⤵
  PID:6364
- C:\Windows\System\AlDlyBE.exe
  C:\Windows\System\AlDlyBE.exe
  2⤵
  PID:6380
- C:\Windows\System\MJIEIPm.exe
  C:\Windows\System\MJIEIPm.exe
  2⤵
  PID:6400
- C:\Windows\System\xYomcqx.exe
  C:\Windows\System\xYomcqx.exe
  2⤵
  PID:6416
- C:\Windows\System\dcTdfav.exe
  C:\Windows\System\dcTdfav.exe
  2⤵
  PID:6440
- C:\Windows\System\IJWbkQf.exe
  C:\Windows\System\IJWbkQf.exe
  2⤵
  PID:6456
- C:\Windows\System\CUJWUIO.exe
  C:\Windows\System\CUJWUIO.exe
  2⤵
  PID:6484
- C:\Windows\System\trMYyXb.exe
  C:\Windows\System\trMYyXb.exe
  2⤵
  PID:6500
- C:\Windows\System\aTCGwoi.exe
  C:\Windows\System\aTCGwoi.exe
  2⤵
  PID:6516
- C:\Windows\System\FffrBYh.exe
  C:\Windows\System\FffrBYh.exe
  2⤵
  PID:6532
- C:\Windows\System\MSnijWh.exe
  C:\Windows\System\MSnijWh.exe
  2⤵
  PID:6552
- C:\Windows\System\jbxdPou.exe
  C:\Windows\System\jbxdPou.exe
  2⤵
  PID:6568
- C:\Windows\System\DrUFLXq.exe
  C:\Windows\System\DrUFLXq.exe
  2⤵
  PID:6584
- C:\Windows\System\OFiQtxi.exe
  C:\Windows\System\OFiQtxi.exe
  2⤵
  PID:6600
- C:\Windows\System\CSaCklx.exe
  C:\Windows\System\CSaCklx.exe
  2⤵
  PID:6620
- C:\Windows\System\HwxKECM.exe
  C:\Windows\System\HwxKECM.exe
  2⤵
  PID:6636
- C:\Windows\System\cSOqdiD.exe
  C:\Windows\System\cSOqdiD.exe
  2⤵
  PID:6652
- C:\Windows\System\cBJjGYR.exe
  C:\Windows\System\cBJjGYR.exe
  2⤵
  PID:6668
- C:\Windows\System\EsOmZnN.exe
  C:\Windows\System\EsOmZnN.exe
  2⤵
  PID:6684
- C:\Windows\System\Vbzjong.exe
  C:\Windows\System\Vbzjong.exe
  2⤵
  PID:6704
- C:\Windows\System\VgheRnk.exe
  C:\Windows\System\VgheRnk.exe
  2⤵
  PID:6720
- C:\Windows\System\LCDzMZC.exe
  C:\Windows\System\LCDzMZC.exe
  2⤵
  PID:6736
- C:\Windows\System\dqNCeLo.exe
  C:\Windows\System\dqNCeLo.exe
  2⤵
  PID:6752
- C:\Windows\System\pljeByB.exe
  C:\Windows\System\pljeByB.exe
  2⤵
  PID:6768
- C:\Windows\System\yeKeDpc.exe
  C:\Windows\System\yeKeDpc.exe
  2⤵
  PID:6784
- C:\Windows\System\YltaYXQ.exe
  C:\Windows\System\YltaYXQ.exe
  2⤵
  PID:6800
- C:\Windows\System\TeltDKY.exe
  C:\Windows\System\TeltDKY.exe
  2⤵
  PID:6820
- C:\Windows\System\dGAvmCo.exe
  C:\Windows\System\dGAvmCo.exe
  2⤵
  PID:6836
- C:\Windows\System\PuUFUes.exe
  C:\Windows\System\PuUFUes.exe
  2⤵
  PID:6852
- C:\Windows\System\oVWztIg.exe
  C:\Windows\System\oVWztIg.exe
  2⤵
  PID:6868
- C:\Windows\System\KpjmkQc.exe
  C:\Windows\System\KpjmkQc.exe
  2⤵
  PID:6884
- C:\Windows\System\NSvYBIg.exe
  C:\Windows\System\NSvYBIg.exe
  2⤵
  PID:6900
- C:\Windows\System\TLgxBWP.exe
  C:\Windows\System\TLgxBWP.exe
  2⤵
  PID:6916
- C:\Windows\System\APtqlON.exe
  C:\Windows\System\APtqlON.exe
  2⤵
  PID:6932
- C:\Windows\System\rBylCFU.exe
  C:\Windows\System\rBylCFU.exe
  2⤵
  PID:6948
- C:\Windows\System\qyUOfBY.exe
  C:\Windows\System\qyUOfBY.exe
  2⤵
  PID:6964
- C:\Windows\System\GtqCwRJ.exe
  C:\Windows\System\GtqCwRJ.exe
  2⤵
  PID:6980
- C:\Windows\System\NMvcMlA.exe
  C:\Windows\System\NMvcMlA.exe
  2⤵
  PID:6996
- C:\Windows\System\ifTRWDE.exe
  C:\Windows\System\ifTRWDE.exe
  2⤵
  PID:7012
- C:\Windows\System\SBnRDPB.exe
  C:\Windows\System\SBnRDPB.exe
  2⤵
  PID:7028
- C:\Windows\System\jBPuReS.exe
  C:\Windows\System\jBPuReS.exe
  2⤵
  PID:7044
- C:\Windows\System\BItQWuh.exe
  C:\Windows\System\BItQWuh.exe
  2⤵
  PID:7060
- C:\Windows\System\IPoQtoZ.exe
  C:\Windows\System\IPoQtoZ.exe
  2⤵
  PID:7076
- C:\Windows\System\lDnZmkM.exe
  C:\Windows\System\lDnZmkM.exe
  2⤵
  PID:7092
- C:\Windows\System\OmwuHVs.exe
  C:\Windows\System\OmwuHVs.exe
  2⤵
  PID:7108
- C:\Windows\System\WqxvxbZ.exe
  C:\Windows\System\WqxvxbZ.exe
  2⤵
  PID:7124
- C:\Windows\System\TGjWUET.exe
  C:\Windows\System\TGjWUET.exe
  2⤵
  PID:7140
- C:\Windows\System\kTKiHQG.exe
  C:\Windows\System\kTKiHQG.exe
  2⤵
  PID:7156
- C:\Windows\System\SttcWwT.exe
  C:\Windows\System\SttcWwT.exe
  2⤵
  PID:5728
- C:\Windows\System\yzyfqtn.exe
  C:\Windows\System\yzyfqtn.exe
  2⤵
  PID:6136
- C:\Windows\System\nziKAZH.exe
  C:\Windows\System\nziKAZH.exe
  2⤵
  PID:4832
- C:\Windows\System\OQXMfZZ.exe
  C:\Windows\System\OQXMfZZ.exe
  2⤵
  PID:6208
- C:\Windows\System\BhtmgGF.exe
  C:\Windows\System\BhtmgGF.exe
  2⤵
  PID:5520
- C:\Windows\System\RiQXVqh.exe
  C:\Windows\System\RiQXVqh.exe
  2⤵
  PID:5268
- C:\Windows\System\yIUZbxN.exe
  C:\Windows\System\yIUZbxN.exe
  2⤵
  PID:5956
- C:\Windows\System\FhDIeXh.exe
  C:\Windows\System\FhDIeXh.exe
  2⤵
  PID:5468
- C:\Windows\System\IsgnFSg.exe
  C:\Windows\System\IsgnFSg.exe
  2⤵
  PID:6164
- C:\Windows\System\hpzebrK.exe
  C:\Windows\System\hpzebrK.exe
  2⤵
  PID:6224
- C:\Windows\System\HNrXVhr.exe
  C:\Windows\System\HNrXVhr.exe
  2⤵
  PID:6268
- C:\Windows\System\JrpCJrz.exe
  C:\Windows\System\JrpCJrz.exe
  2⤵
  PID:6284
- C:\Windows\System\EdCRmTj.exe
  C:\Windows\System\EdCRmTj.exe
  2⤵
  PID:6304
- C:\Windows\System\YYYMgwt.exe
  C:\Windows\System\YYYMgwt.exe
  2⤵
  PID:6324
- C:\Windows\System\dIDiPiz.exe
  C:\Windows\System\dIDiPiz.exe
  2⤵
  PID:6344
- C:\Windows\System\KDSBFwm.exe
  C:\Windows\System\KDSBFwm.exe
  2⤵
  PID:6388
- C:\Windows\System\LElztuC.exe
  C:\Windows\System\LElztuC.exe
  2⤵
  PID:6432
- C:\Windows\System\EyOeMuV.exe
  C:\Windows\System\EyOeMuV.exe
  2⤵
  PID:6472
- C:\Windows\System\uyHThIJ.exe
  C:\Windows\System\uyHThIJ.exe
  2⤵
  PID:6548
- C:\Windows\System\WyzIRqP.exe
  C:\Windows\System\WyzIRqP.exe
  2⤵
  PID:6540
- C:\Windows\System\BTDtjfG.exe
  C:\Windows\System\BTDtjfG.exe
  2⤵
  PID:6608
- C:\Windows\System\pTKTAYv.exe
  C:\Windows\System\pTKTAYv.exe
  2⤵
  PID:6648
- C:\Windows\System\MzSwzez.exe
  C:\Windows\System\MzSwzez.exe
  2⤵
  PID:6716
- C:\Windows\System\EDKHWNr.exe
  C:\Windows\System\EDKHWNr.exe
  2⤵
  PID:6776
- C:\Windows\System\rrzRSnT.exe
  C:\Windows\System\rrzRSnT.exe
  2⤵
  PID:6448
- C:\Windows\System\ClzXAex.exe
  C:\Windows\System\ClzXAex.exe
  2⤵
  PID:6560
- C:\Windows\System\KynBZNa.exe
  C:\Windows\System\KynBZNa.exe
  2⤵
  PID:6660
- C:\Windows\System\cBalYWg.exe
  C:\Windows\System\cBalYWg.exe
  2⤵
  PID:6496
- C:\Windows\System\NuOqsTt.exe
  C:\Windows\System\NuOqsTt.exe
  2⤵
  PID:6732
- C:\Windows\System\WEvVtAZ.exe
  C:\Windows\System\WEvVtAZ.exe
  2⤵
  PID:6628
- C:\Windows\System\NgRmtMB.exe
  C:\Windows\System\NgRmtMB.exe
  2⤵
  PID:6696
- C:\Windows\System\pAKrjYc.exe
  C:\Windows\System\pAKrjYc.exe
  2⤵
  PID:6764
- C:\Windows\System\xdnuiXr.exe
  C:\Windows\System\xdnuiXr.exe
  2⤵
  PID:6832
- C:\Windows\System\sZgVBfy.exe
  C:\Windows\System\sZgVBfy.exe
  2⤵
  PID:5180
- C:\Windows\System\BqGUJUq.exe
  C:\Windows\System\BqGUJUq.exe
  2⤵
  PID:6972
- C:\Windows\System\jTrpMPD.exe
  C:\Windows\System\jTrpMPD.exe
  2⤵
  PID:7036
- C:\Windows\System\hBECtBT.exe
  C:\Windows\System\hBECtBT.exe
  2⤵
  PID:7100
- C:\Windows\System\cARHcXx.exe
  C:\Windows\System\cARHcXx.exe
  2⤵
  PID:5244
- C:\Windows\System\vuObntx.exe
  C:\Windows\System\vuObntx.exe
  2⤵
  PID:6072
- C:\Windows\System\APVyLdx.exe
  C:\Windows\System\APVyLdx.exe
  2⤵
  PID:7148
- C:\Windows\System\YkvQWXe.exe
  C:\Windows\System\YkvQWXe.exe
  2⤵
  PID:6148
- C:\Windows\System\qjiQBzh.exe
  C:\Windows\System\qjiQBzh.exe
  2⤵
  PID:6248
- C:\Windows\System\XqhizYm.exe
  C:\Windows\System\XqhizYm.exe
  2⤵
  PID:5868
- C:\Windows\System\SgxzZYS.exe
  C:\Windows\System\SgxzZYS.exe
  2⤵
  PID:6160
- C:\Windows\System\ColnKDj.exe
  C:\Windows\System\ColnKDj.exe
  2⤵
  PID:6264
- C:\Windows\System\qBrPaAQ.exe
  C:\Windows\System\qBrPaAQ.exe
  2⤵
  PID:7120
- C:\Windows\System\sCBTpGZ.exe
  C:\Windows\System\sCBTpGZ.exe
  2⤵
  PID:5560
- C:\Windows\System\icihYuW.exe
  C:\Windows\System\icihYuW.exe
  2⤵
  PID:6356
- C:\Windows\System\mcvmUTh.exe
  C:\Windows\System\mcvmUTh.exe
  2⤵
  PID:6176
- C:\Windows\System\nXeLDch.exe
  C:\Windows\System\nXeLDch.exe
  2⤵
  PID:6372
- C:\Windows\System\sJylbTx.exe
  C:\Windows\System\sJylbTx.exe
  2⤵
  PID:6276
- C:\Windows\System\UuAzHNY.exe
  C:\Windows\System\UuAzHNY.exe
  2⤵
  PID:6464
- C:\Windows\System\DiGjWlF.exe
  C:\Windows\System\DiGjWlF.exe
  2⤵
  PID:5464
- C:\Windows\System\jNnATQY.exe
  C:\Windows\System\jNnATQY.exe
  2⤵
  PID:6316
- C:\Windows\System\oeqQuSr.exe
  C:\Windows\System\oeqQuSr.exe
  2⤵
  PID:6508
- C:\Windows\System\zEHcLdy.exe
  C:\Windows\System\zEHcLdy.exe
  2⤵
  PID:6848
- C:\Windows\System\gKmqbPP.exe
  C:\Windows\System\gKmqbPP.exe
  2⤵
  PID:6692
- C:\Windows\System\bcUOPTx.exe
  C:\Windows\System\bcUOPTx.exe
  2⤵
  PID:6860
- C:\Windows\System\ohPhAZC.exe
  C:\Windows\System\ohPhAZC.exe
  2⤵
  PID:6988
- C:\Windows\System\NNyWRRp.exe
  C:\Windows\System\NNyWRRp.exe
  2⤵
  PID:7116
- C:\Windows\System\flnuBtF.exe
  C:\Windows\System\flnuBtF.exe
  2⤵
  PID:6396
- C:\Windows\System\CKVNycQ.exe
  C:\Windows\System\CKVNycQ.exe
  2⤵
  PID:6808
- C:\Windows\System\jWfZnLB.exe
  C:\Windows\System\jWfZnLB.exe
  2⤵
  PID:6644
- C:\Windows\System\moGpYdC.exe
  C:\Windows\System\moGpYdC.exe
  2⤵
  PID:6596
- C:\Windows\System\wvqzvJN.exe
  C:\Windows\System\wvqzvJN.exe
  2⤵
  PID:7072
- C:\Windows\System\MmTRhMr.exe
  C:\Windows\System\MmTRhMr.exe
  2⤵
  PID:6328
- C:\Windows\System\fIEkouC.exe
  C:\Windows\System\fIEkouC.exe
  2⤵
  PID:6728
- C:\Windows\System\SzwZZZG.exe
  C:\Windows\System\SzwZZZG.exe
  2⤵
  PID:6228
- C:\Windows\System\hkTDKKY.exe
  C:\Windows\System\hkTDKKY.exe
  2⤵
  PID:6908
- C:\Windows\System\zDzhRsp.exe
  C:\Windows\System\zDzhRsp.exe
  2⤵
  PID:7136
- C:\Windows\System\VBHYQMJ.exe
  C:\Windows\System\VBHYQMJ.exe
  2⤵
  PID:6296
- C:\Windows\System\aPqwvDv.exe
  C:\Windows\System\aPqwvDv.exe
  2⤵
  PID:6140
- C:\Windows\System\uKTqdSR.exe
  C:\Windows\System\uKTqdSR.exe
  2⤵
  PID:6844
- C:\Windows\System\Itzleqn.exe
  C:\Windows\System\Itzleqn.exe
  2⤵
  PID:5760
- C:\Windows\System\IOyyWhR.exe
  C:\Windows\System\IOyyWhR.exe
  2⤵
  PID:5892
- C:\Windows\System\nyRGBfZ.exe
  C:\Windows\System\nyRGBfZ.exe
  2⤵
  PID:6512
- C:\Windows\System\BPMuEhU.exe
  C:\Windows\System\BPMuEhU.exe
  2⤵
  PID:6880
- C:\Windows\System\NsoNSoY.exe
  C:\Windows\System\NsoNSoY.exe
  2⤵
  PID:6280
- C:\Windows\System\eIdrGAx.exe
  C:\Windows\System\eIdrGAx.exe
  2⤵
  PID:6956
- C:\Windows\System\sWMgidl.exe
  C:\Windows\System\sWMgidl.exe
  2⤵
  PID:7180
- C:\Windows\System\zEjrrbG.exe
  C:\Windows\System\zEjrrbG.exe
  2⤵
  PID:7200
- C:\Windows\System\RycAydb.exe
  C:\Windows\System\RycAydb.exe
  2⤵
  PID:7220
- C:\Windows\System\emUWlPc.exe
  C:\Windows\System\emUWlPc.exe
  2⤵
  PID:7236
- C:\Windows\System\CKXzwxf.exe
  C:\Windows\System\CKXzwxf.exe
  2⤵
  PID:7252
- C:\Windows\System\vGaVvuZ.exe
  C:\Windows\System\vGaVvuZ.exe
  2⤵
  PID:7272
- C:\Windows\System\lieqxKN.exe
  C:\Windows\System\lieqxKN.exe
  2⤵
  PID:7288
- C:\Windows\System\BIvBwfV.exe
  C:\Windows\System\BIvBwfV.exe
  2⤵
  PID:7308
- C:\Windows\System\wewmeED.exe
  C:\Windows\System\wewmeED.exe
  2⤵
  PID:7324
- C:\Windows\System\QlsmNFP.exe
  C:\Windows\System\QlsmNFP.exe
  2⤵
  PID:7340
- C:\Windows\System\MeFObRu.exe
  C:\Windows\System\MeFObRu.exe
  2⤵
  PID:7360
- C:\Windows\System\DBoEiNU.exe
  C:\Windows\System\DBoEiNU.exe
  2⤵
  PID:7376
- C:\Windows\System\gTkbsYg.exe
  C:\Windows\System\gTkbsYg.exe
  2⤵
  PID:7392
- C:\Windows\System\khqyxAA.exe
  C:\Windows\System\khqyxAA.exe
  2⤵
  PID:7412
- C:\Windows\System\iIdrbba.exe
  C:\Windows\System\iIdrbba.exe
  2⤵
  PID:7428
- C:\Windows\System\zSRnDWd.exe
  C:\Windows\System\zSRnDWd.exe
  2⤵
  PID:7444
- C:\Windows\System\LLdACjA.exe
  C:\Windows\System\LLdACjA.exe
  2⤵
  PID:7460
- C:\Windows\System\JBtBRSD.exe
  C:\Windows\System\JBtBRSD.exe
  2⤵
  PID:7480
- C:\Windows\System\SvSbbfs.exe
  C:\Windows\System\SvSbbfs.exe
  2⤵
  PID:7500
- C:\Windows\System\DXaOxSf.exe
  C:\Windows\System\DXaOxSf.exe
  2⤵
  PID:7516
- C:\Windows\System\tBgdlPt.exe
  C:\Windows\System\tBgdlPt.exe
  2⤵
  PID:7532
- C:\Windows\System\KOCqcvx.exe
  C:\Windows\System\KOCqcvx.exe
  2⤵
  PID:7728
- C:\Windows\System\sjNMKpb.exe
  C:\Windows\System\sjNMKpb.exe
  2⤵
  PID:7744
- C:\Windows\System\CQnnSqM.exe
  C:\Windows\System\CQnnSqM.exe
  2⤵
  PID:7760
- C:\Windows\System\sZuKgVB.exe
  C:\Windows\System\sZuKgVB.exe
  2⤵
  PID:7776
- C:\Windows\System\CXwZDxu.exe
  C:\Windows\System\CXwZDxu.exe
  2⤵
  PID:7936
- C:\Windows\System\dPxOuYv.exe
  C:\Windows\System\dPxOuYv.exe
  2⤵
  PID:7952
- C:\Windows\System\xtPwKno.exe
  C:\Windows\System\xtPwKno.exe
  2⤵
  PID:7968
- C:\Windows\System\vkjIyWT.exe
  C:\Windows\System\vkjIyWT.exe
  2⤵
  PID:7988
- C:\Windows\System\xlQAIty.exe
  C:\Windows\System\xlQAIty.exe
  2⤵
  PID:8004
- C:\Windows\System\iatlhGS.exe
  C:\Windows\System\iatlhGS.exe
  2⤵
  PID:8020
- C:\Windows\System\WdUPPLg.exe
  C:\Windows\System\WdUPPLg.exe
  2⤵
  PID:8036
- C:\Windows\System\QxEuLGO.exe
  C:\Windows\System\QxEuLGO.exe
  2⤵
  PID:8052
- C:\Windows\System\gPKZOwF.exe
  C:\Windows\System\gPKZOwF.exe
  2⤵
  PID:8068
- C:\Windows\System\vaFwMfl.exe
  C:\Windows\System\vaFwMfl.exe
  2⤵
  PID:8084
- C:\Windows\System\jFRgfaC.exe
  C:\Windows\System\jFRgfaC.exe
  2⤵
  PID:8100
- C:\Windows\System\eMMFVfZ.exe
  C:\Windows\System\eMMFVfZ.exe
  2⤵
  PID:8116
- C:\Windows\System\umwFLSN.exe
  C:\Windows\System\umwFLSN.exe
  2⤵
  PID:8132
- C:\Windows\System\pWTxnuk.exe
  C:\Windows\System\pWTxnuk.exe
  2⤵
  PID:8148
- C:\Windows\System\dfSSsld.exe
  C:\Windows\System\dfSSsld.exe
  2⤵
  PID:8164
- C:\Windows\System\SHGDDtE.exe
  C:\Windows\System\SHGDDtE.exe
  2⤵
  PID:8180
- C:\Windows\System\IkpwEXi.exe
  C:\Windows\System\IkpwEXi.exe
  2⤵
  PID:6528
- C:\Windows\System\eSqgAtq.exe
  C:\Windows\System\eSqgAtq.exe
  2⤵
  PID:7228
- C:\Windows\System\RpIGToU.exe
  C:\Windows\System\RpIGToU.exe
  2⤵
  PID:6376
- C:\Windows\System\pwCFZUB.exe
  C:\Windows\System\pwCFZUB.exe
  2⤵
  PID:6564
- C:\Windows\System\NmIGuDa.exe
  C:\Windows\System\NmIGuDa.exe
  2⤵
  PID:7244
- C:\Windows\System\SyUIwAc.exe
  C:\Windows\System\SyUIwAc.exe
  2⤵
  PID:7300
- C:\Windows\System\rjvpstO.exe
  C:\Windows\System\rjvpstO.exe
  2⤵
  PID:6896
- C:\Windows\System\dVRIlCy.exe
  C:\Windows\System\dVRIlCy.exe
  2⤵
  PID:7280
- C:\Windows\System\GxJpwYF.exe
  C:\Windows\System\GxJpwYF.exe
  2⤵
  PID:7332
- C:\Windows\System\pQurbsn.exe
  C:\Windows\System\pQurbsn.exe
  2⤵
  PID:7400
- C:\Windows\System\kBULvQS.exe
  C:\Windows\System\kBULvQS.exe
  2⤵
  PID:7388
- C:\Windows\System\mDRQFxB.exe
  C:\Windows\System\mDRQFxB.exe
  2⤵
  PID:7420
- C:\Windows\System\YGkRzXv.exe
  C:\Windows\System\YGkRzXv.exe
  2⤵
  PID:7468
- C:\Windows\System\JRPWxBk.exe
  C:\Windows\System\JRPWxBk.exe
  2⤵
  PID:7492
- C:\Windows\System\vvPRsrQ.exe
  C:\Windows\System\vvPRsrQ.exe
  2⤵
  PID:7524
- C:\Windows\System\iERkgUe.exe
  C:\Windows\System\iERkgUe.exe
  2⤵
  PID:7548
- C:\Windows\System\PqiIzmF.exe
  C:\Windows\System\PqiIzmF.exe
  2⤵
  PID:7564
- C:\Windows\System\tDKZouJ.exe
  C:\Windows\System\tDKZouJ.exe
  2⤵
  PID:7580
- C:\Windows\System\DigifuA.exe
  C:\Windows\System\DigifuA.exe
  2⤵
  PID:6300
- C:\Windows\System\EXRlnKN.exe
  C:\Windows\System\EXRlnKN.exe
  2⤵
  PID:7608
- C:\Windows\System\fTtECwt.exe
  C:\Windows\System\fTtECwt.exe
  2⤵
  PID:7616
- C:\Windows\System\OCsFWEK.exe
  C:\Windows\System\OCsFWEK.exe
  2⤵
  PID:7648
- C:\Windows\System\tZVGEJN.exe
  C:\Windows\System\tZVGEJN.exe
  2⤵
  PID:7664
- C:\Windows\System\vBurrqt.exe
  C:\Windows\System\vBurrqt.exe
  2⤵
  PID:7680
- C:\Windows\System\LdzFHvw.exe
  C:\Windows\System\LdzFHvw.exe
  2⤵
  PID:7692
- C:\Windows\System\clthbNF.exe
  C:\Windows\System\clthbNF.exe
  2⤵
  PID:7712
- C:\Windows\System\weVCuGM.exe
  C:\Windows\System\weVCuGM.exe
  2⤵
  PID:7724
- C:\Windows\System\BegJJja.exe
  C:\Windows\System\BegJJja.exe
  2⤵
  PID:7752
- C:\Windows\System\HTjoOFa.exe
  C:\Windows\System\HTjoOFa.exe
  2⤵
  PID:7768
- C:\Windows\System\gOLTFUZ.exe
  C:\Windows\System\gOLTFUZ.exe
  2⤵
  PID:7800
- C:\Windows\System\mddrbgP.exe
  C:\Windows\System\mddrbgP.exe
  2⤵
  PID:7820
- C:\Windows\System\CvYKuof.exe
  C:\Windows\System\CvYKuof.exe
  2⤵
  PID:7836
- C:\Windows\System\JoSxmzC.exe
  C:\Windows\System\JoSxmzC.exe
  2⤵
  PID:7852
- C:\Windows\System\keamFhX.exe
  C:\Windows\System\keamFhX.exe
  2⤵
  PID:7864
- C:\Windows\System\NHJnfzK.exe
  C:\Windows\System\NHJnfzK.exe
  2⤵
  PID:7880
- C:\Windows\System\MTiUQNn.exe
  C:\Windows\System\MTiUQNn.exe
  2⤵
  PID:7896
- C:\Windows\System\xmBnGqT.exe
  C:\Windows\System\xmBnGqT.exe
  2⤵
  PID:7916
- C:\Windows\System\ChrwaVG.exe
  C:\Windows\System\ChrwaVG.exe
  2⤵
  PID:7960
- C:\Windows\System\sphDSMn.exe
  C:\Windows\System\sphDSMn.exe
  2⤵
  PID:7980
- C:\Windows\System\UScNwfd.exe
  C:\Windows\System\UScNwfd.exe
  2⤵
  PID:7976
- C:\Windows\System\AXQpZFI.exe
  C:\Windows\System\AXQpZFI.exe
  2⤵
  PID:7948
- C:\Windows\System\BpWipcP.exe
  C:\Windows\System\BpWipcP.exe
  2⤵
  PID:8044
- C:\Windows\System\jTspoZB.exe
  C:\Windows\System\jTspoZB.exe
  2⤵
  PID:8080
- C:\Windows\System\jzarkyu.exe
  C:\Windows\System\jzarkyu.exe
  2⤵
  PID:8156
- C:\Windows\System\dBqePjR.exe
  C:\Windows\System\dBqePjR.exe
  2⤵
  PID:6928
- C:\Windows\System\TkhHSVj.exe
  C:\Windows\System\TkhHSVj.exe
  2⤵
  PID:6892
- C:\Windows\System\wXhSCyn.exe
  C:\Windows\System\wXhSCyn.exe
  2⤵
  PID:8108
- C:\Windows\System\LVmioLt.exe
  C:\Windows\System\LVmioLt.exe
  2⤵
  PID:8144
- C:\Windows\System\jnyrxei.exe
  C:\Windows\System\jnyrxei.exe
  2⤵
  PID:7316
- C:\Windows\System\enrPGzJ.exe
  C:\Windows\System\enrPGzJ.exe
  2⤵
  PID:7296
- C:\Windows\System\JWApJKA.exe
  C:\Windows\System\JWApJKA.exe
  2⤵
  PID:7372
- C:\Windows\System\ExKUkqT.exe
  C:\Windows\System\ExKUkqT.exe
  2⤵
  PID:7436
- C:\Windows\System\XZvKKxG.exe
  C:\Windows\System\XZvKKxG.exe
  2⤵
  PID:7508
- C:\Windows\System\fZPJaAz.exe
  C:\Windows\System\fZPJaAz.exe
  2⤵
  PID:7592
- C:\Windows\System\gdHuTgW.exe
  C:\Windows\System\gdHuTgW.exe
  2⤵
  PID:7540
- C:\Windows\System\ANFrNSu.exe
  C:\Windows\System\ANFrNSu.exe
  2⤵
  PID:7604
- C:\Windows\System\lSCuAsd.exe
  C:\Windows\System\lSCuAsd.exe
  2⤵
  PID:7640
- C:\Windows\System\QtjOdXB.exe
  C:\Windows\System\QtjOdXB.exe
  2⤵
  PID:7720
- C:\Windows\System\QUHnMuc.exe
  C:\Windows\System\QUHnMuc.exe
  2⤵
  PID:7676
- C:\Windows\System\MfJyMhy.exe
  C:\Windows\System\MfJyMhy.exe
  2⤵
  PID:7740
- C:\Windows\System\iVhrcsd.exe
  C:\Windows\System\iVhrcsd.exe
  2⤵
  PID:7808
- C:\Windows\System\HJphejm.exe
  C:\Windows\System\HJphejm.exe
  2⤵
  PID:7872
- C:\Windows\System\qdqJQHC.exe
  C:\Windows\System\qdqJQHC.exe
  2⤵
  PID:7876
- C:\Windows\System\XQTyrOX.exe
  C:\Windows\System\XQTyrOX.exe
  2⤵
  PID:7912
- C:\Windows\System\dcFoqhE.exe
  C:\Windows\System\dcFoqhE.exe
  2⤵
  PID:7924
- C:\Windows\System\GgjBozk.exe
  C:\Windows\System\GgjBozk.exe
  2⤵
  PID:8092
- C:\Windows\System\oZcjmIu.exe
  C:\Windows\System\oZcjmIu.exe
  2⤵
  PID:8016
- C:\Windows\System\RgLiXWv.exe
  C:\Windows\System\RgLiXWv.exe
  2⤵
  PID:7268
- C:\Windows\System\JzozaiE.exe
  C:\Windows\System\JzozaiE.exe
  2⤵
  PID:7196
- C:\Windows\System\pcZGVsY.exe
  C:\Windows\System\pcZGVsY.exe
  2⤵
  PID:7248
- C:\Windows\System\HdXQyCp.exe
  C:\Windows\System\HdXQyCp.exe
  2⤵
  PID:7264
- C:\Windows\System\WFWDtZY.exe
  C:\Windows\System\WFWDtZY.exe
  2⤵
  PID:7632
- C:\Windows\System\YdDxAuQ.exe
  C:\Windows\System\YdDxAuQ.exe
  2⤵
  PID:7560
- C:\Windows\System\HlbyNeA.exe
  C:\Windows\System\HlbyNeA.exe
  2⤵
  PID:7660
- C:\Windows\System\TlsRCvO.exe
  C:\Windows\System\TlsRCvO.exe
  2⤵
  PID:7832
- C:\Windows\System\lszNfHH.exe
  C:\Windows\System\lszNfHH.exe
  2⤵
  PID:7996
- C:\Windows\System\vXcPAdb.exe
  C:\Windows\System\vXcPAdb.exe
  2⤵
  PID:7756
- C:\Windows\System\rcvAUJe.exe
  C:\Windows\System\rcvAUJe.exe
  2⤵
  PID:7908
- C:\Windows\System\MDLYpoN.exe
  C:\Windows\System\MDLYpoN.exe
  2⤵
  PID:8188
- C:\Windows\System\foGsViN.exe
  C:\Windows\System\foGsViN.exe
  2⤵
  PID:7496
- C:\Windows\System\djPjWgw.exe
  C:\Windows\System\djPjWgw.exe
  2⤵
  PID:7556
- C:\Windows\System\LYTxOrQ.exe
  C:\Windows\System\LYTxOrQ.exe
  2⤵
  PID:7844
- C:\Windows\System\flYpEMP.exe
  C:\Windows\System\flYpEMP.exe
  2⤵
  PID:7408
- C:\Windows\System\lEKiald.exe
  C:\Windows\System\lEKiald.exe
  2⤵
  PID:7624
- C:\Windows\System\ADVarUL.exe
  C:\Windows\System\ADVarUL.exe
  2⤵
  PID:7848
- C:\Windows\System\idMOgYK.exe
  C:\Windows\System\idMOgYK.exe
  2⤵
  PID:8000
- C:\Windows\System\JDYXTVU.exe
  C:\Windows\System\JDYXTVU.exe
  2⤵
  PID:7544
- C:\Windows\System\fvKSjBl.exe
  C:\Windows\System\fvKSjBl.exe
  2⤵
  PID:8128
- C:\Windows\System\CzHtdmE.exe
  C:\Windows\System\CzHtdmE.exe
  2⤵
  PID:8112
- C:\Windows\System\MPULcCs.exe
  C:\Windows\System\MPULcCs.exe
  2⤵
  PID:8200
- C:\Windows\System\jMAJSzw.exe
  C:\Windows\System\jMAJSzw.exe
  2⤵
  PID:8216
- C:\Windows\System\tfNNPZQ.exe
  C:\Windows\System\tfNNPZQ.exe
  2⤵
  PID:8232
- C:\Windows\System\UskgEib.exe
  C:\Windows\System\UskgEib.exe
  2⤵
  PID:8248
- C:\Windows\System\EnpxaBJ.exe
  C:\Windows\System\EnpxaBJ.exe
  2⤵
  PID:8264
- C:\Windows\System\DEQovXL.exe
  C:\Windows\System\DEQovXL.exe
  2⤵
  PID:8280
- C:\Windows\System\qszVdiF.exe
  C:\Windows\System\qszVdiF.exe
  2⤵
  PID:8376
- C:\Windows\System\lYgqNHL.exe
  C:\Windows\System\lYgqNHL.exe
  2⤵
  PID:8396
- C:\Windows\System\phWiUSQ.exe
  C:\Windows\System\phWiUSQ.exe
  2⤵
  PID:8416
- C:\Windows\System\JIUWgxF.exe
  C:\Windows\System\JIUWgxF.exe
  2⤵
  PID:8432
- C:\Windows\System\UYlKDJJ.exe
  C:\Windows\System\UYlKDJJ.exe
  2⤵
  PID:8448
- C:\Windows\System\oGOkySs.exe
  C:\Windows\System\oGOkySs.exe
  2⤵
  PID:8464
- C:\Windows\System\pPKLLux.exe
  C:\Windows\System\pPKLLux.exe
  2⤵
  PID:8480
- C:\Windows\System\uqqxsAw.exe
  C:\Windows\System\uqqxsAw.exe
  2⤵
  PID:8496
- C:\Windows\System\GXUOmdS.exe
  C:\Windows\System\GXUOmdS.exe
  2⤵
  PID:8512
- C:\Windows\System\glTQHbp.exe
  C:\Windows\System\glTQHbp.exe
  2⤵
  PID:8528
- C:\Windows\System\qqpkDKW.exe
  C:\Windows\System\qqpkDKW.exe
  2⤵
  PID:8544
- C:\Windows\System\VWAfvds.exe
  C:\Windows\System\VWAfvds.exe
  2⤵
  PID:8560
- C:\Windows\System\gfwTkIZ.exe
  C:\Windows\System\gfwTkIZ.exe
  2⤵
  PID:8576
- C:\Windows\System\qcpCCgJ.exe
  C:\Windows\System\qcpCCgJ.exe
  2⤵
  PID:8604
- C:\Windows\System\vGmwPde.exe
  C:\Windows\System\vGmwPde.exe
  2⤵
  PID:8620
- C:\Windows\System\VXEWMtz.exe
  C:\Windows\System\VXEWMtz.exe
  2⤵
  PID:8636
- C:\Windows\System\bZEmNub.exe
  C:\Windows\System\bZEmNub.exe
  2⤵
  PID:8656
- C:\Windows\System\kMRwZvg.exe
  C:\Windows\System\kMRwZvg.exe
  2⤵
  PID:8672
- C:\Windows\System\pmMpeGE.exe
  C:\Windows\System\pmMpeGE.exe
  2⤵
  PID:8736
- C:\Windows\System\KzISgTf.exe
  C:\Windows\System\KzISgTf.exe
  2⤵
  PID:8816
- C:\Windows\System\FbFWoOu.exe
  C:\Windows\System\FbFWoOu.exe
  2⤵
  PID:8832
- C:\Windows\System\mojXrqK.exe
  C:\Windows\System\mojXrqK.exe
  2⤵
  PID:8852
- C:\Windows\System\bUGsIUW.exe
  C:\Windows\System\bUGsIUW.exe
  2⤵
  PID:8868
- C:\Windows\System\FxvulXa.exe
  C:\Windows\System\FxvulXa.exe
  2⤵
  PID:8884
- C:\Windows\System\pxRwLcP.exe
  C:\Windows\System\pxRwLcP.exe
  2⤵
  PID:8904
- C:\Windows\System\WTOOpvr.exe
  C:\Windows\System\WTOOpvr.exe
  2⤵
  PID:8920
- C:\Windows\System\MnEPqoO.exe
  C:\Windows\System\MnEPqoO.exe
  2⤵
  PID:8936
- C:\Windows\System\KiPvTQb.exe
  C:\Windows\System\KiPvTQb.exe
  2⤵
  PID:8952
- C:\Windows\System\dHXZFWs.exe
  C:\Windows\System\dHXZFWs.exe
  2⤵
  PID:8968
- C:\Windows\System\VgsdYTS.exe
  C:\Windows\System\VgsdYTS.exe
  2⤵
  PID:8984
- C:\Windows\System\MBDbFMq.exe
  C:\Windows\System\MBDbFMq.exe
  2⤵
  PID:9000
- C:\Windows\System\WdrblIW.exe
  C:\Windows\System\WdrblIW.exe
  2⤵
  PID:9016
- C:\Windows\System\WkzCegT.exe
  C:\Windows\System\WkzCegT.exe
  2⤵
  PID:9032
- C:\Windows\System\hEKipvp.exe
  C:\Windows\System\hEKipvp.exe
  2⤵
  PID:9048
- C:\Windows\System\NtKLoXi.exe
  C:\Windows\System\NtKLoXi.exe
  2⤵
  PID:9064
- C:\Windows\System\oAmsxVp.exe
  C:\Windows\System\oAmsxVp.exe
  2⤵
  PID:9080
- C:\Windows\System\cuIKWkg.exe
  C:\Windows\System\cuIKWkg.exe
  2⤵
  PID:9096
- C:\Windows\System\KrmgGuT.exe
  C:\Windows\System\KrmgGuT.exe
  2⤵
  PID:9116
- C:\Windows\System\MDeeKme.exe
  C:\Windows\System\MDeeKme.exe
  2⤵
  PID:9132
- C:\Windows\System\eottiCL.exe
  C:\Windows\System\eottiCL.exe
  2⤵
  PID:9152
- C:\Windows\System\JYGOdtN.exe
  C:\Windows\System\JYGOdtN.exe
  2⤵
  PID:9168
- C:\Windows\System\lqrLpEC.exe
  C:\Windows\System\lqrLpEC.exe
  2⤵
  PID:9184
- C:\Windows\System\XSQJLpN.exe
  C:\Windows\System\XSQJLpN.exe
  2⤵
  PID:9200
- C:\Windows\System\Uwaslkf.exe
  C:\Windows\System\Uwaslkf.exe
  2⤵
  PID:8208
- C:\Windows\System\YvahudM.exe
  C:\Windows\System\YvahudM.exe
  2⤵
  PID:8244
- C:\Windows\System\ljyNsQz.exe
  C:\Windows\System\ljyNsQz.exe
  2⤵
  PID:7792
- C:\Windows\System\IoIgIMu.exe
  C:\Windows\System\IoIgIMu.exe
  2⤵
  PID:8288
- C:\Windows\System\iTciTpp.exe
  C:\Windows\System\iTciTpp.exe
  2⤵
  PID:8304
- C:\Windows\System\CMOpxKY.exe
  C:\Windows\System\CMOpxKY.exe
  2⤵
  PID:8320
- C:\Windows\System\JAgdnel.exe
  C:\Windows\System\JAgdnel.exe
  2⤵
  PID:8336
- C:\Windows\System\WVXhgpb.exe
  C:\Windows\System\WVXhgpb.exe
  2⤵
  PID:8352
- C:\Windows\System\JkLogoc.exe
  C:\Windows\System\JkLogoc.exe
  2⤵
  PID:8368
- C:\Windows\System\dHolWea.exe
  C:\Windows\System\dHolWea.exe
  2⤵
  PID:8404
- C:\Windows\System\yKzzBNS.exe
  C:\Windows\System\yKzzBNS.exe
  2⤵
  PID:8440
- C:\Windows\System\OVWKHqd.exe
  C:\Windows\System\OVWKHqd.exe
  2⤵
  PID:8568
- C:\Windows\System\APxOXTm.exe
  C:\Windows\System\APxOXTm.exe
  2⤵
  PID:8388
- C:\Windows\System\JEBmvOm.exe
  C:\Windows\System\JEBmvOm.exe
  2⤵
  PID:8460
- C:\Windows\System\ROIIEtI.exe
  C:\Windows\System\ROIIEtI.exe
  2⤵
  PID:8524
- C:\Windows\System\CgGAEoQ.exe
  C:\Windows\System\CgGAEoQ.exe
  2⤵
  PID:8680
- C:\Windows\System\IuRVNVB.exe
  C:\Windows\System\IuRVNVB.exe
  2⤵
  PID:8584
- C:\Windows\System\UWXbuZU.exe
  C:\Windows\System\UWXbuZU.exe
  2⤵
  PID:8600
- C:\Windows\System\LAyMbzo.exe
  C:\Windows\System\LAyMbzo.exe
  2⤵
  PID:8628
- C:\Windows\System\XiDuMAO.exe
  C:\Windows\System\XiDuMAO.exe
  2⤵
  PID:8696
- C:\Windows\System\HALPpOW.exe
  C:\Windows\System\HALPpOW.exe
  2⤵
  PID:8712
- C:\Windows\System\foQRQEi.exe
  C:\Windows\System\foQRQEi.exe
  2⤵
  PID:8732
- C:\Windows\System\pdHFpfT.exe
  C:\Windows\System\pdHFpfT.exe
  2⤵
  PID:8752
- C:\Windows\System\EDVKBtD.exe
  C:\Windows\System\EDVKBtD.exe
  2⤵
  PID:8768
- C:\Windows\System\qQORoRM.exe
  C:\Windows\System\qQORoRM.exe
  2⤵
  PID:8784
- C:\Windows\System\PGxKfQR.exe
  C:\Windows\System\PGxKfQR.exe
  2⤵
  PID:8812
- C:\Windows\System\oiaQmmR.exe
  C:\Windows\System\oiaQmmR.exe
  2⤵
  PID:8824
- C:\Windows\System\jmeQaiv.exe
  C:\Windows\System\jmeQaiv.exe
  2⤵
  PID:8840
- C:\Windows\System\vDjMHIH.exe
  C:\Windows\System\vDjMHIH.exe
  2⤵
  PID:8880
- C:\Windows\System\NkkYQHF.exe
  C:\Windows\System\NkkYQHF.exe
  2⤵
  PID:8976
- C:\Windows\System\rUjtrRY.exe
  C:\Windows\System\rUjtrRY.exe
  2⤵
  PID:9072
- C:\Windows\System\NCbLRWF.exe
  C:\Windows\System\NCbLRWF.exe
  2⤵
  PID:9112
- C:\Windows\System\EJIeBCz.exe
  C:\Windows\System\EJIeBCz.exe
  2⤵
  PID:9160
- C:\Windows\System\ZUTuapH.exe
  C:\Windows\System\ZUTuapH.exe
  2⤵
  PID:9192
- C:\Windows\System\gJmeoqG.exe
  C:\Windows\System\gJmeoqG.exe
  2⤵
  PID:9176
- C:\Windows\System\aQLkKTr.exe
  C:\Windows\System\aQLkKTr.exe
  2⤵
  PID:8196
- C:\Windows\System\aorkXUf.exe
  C:\Windows\System\aorkXUf.exe
  2⤵
  PID:8332
- C:\Windows\System\MApjRqJ.exe
  C:\Windows\System\MApjRqJ.exe
  2⤵
  PID:8444
- C:\Windows\System\tLQDfmU.exe
  C:\Windows\System\tLQDfmU.exe
  2⤵
  PID:8032
- C:\Windows\System\egvXufU.exe
  C:\Windows\System\egvXufU.exe
  2⤵
  PID:8412
- C:\Windows\System\trejiJA.exe
  C:\Windows\System\trejiJA.exe
  2⤵
  PID:8616
- C:\Windows\System\dDZCpdv.exe
  C:\Windows\System\dDZCpdv.exe
  2⤵
  PID:8492
- C:\Windows\System\rvfxoLj.exe
  C:\Windows\System\rvfxoLj.exe
  2⤵
  PID:8704
- C:\Windows\System\iZGccUZ.exe
  C:\Windows\System\iZGccUZ.exe
  2⤵
  PID:8776
- C:\Windows\System\OPwIJiB.exe
  C:\Windows\System\OPwIJiB.exe
  2⤵
  PID:8720
- C:\Windows\System\MbXqlDs.exe
  C:\Windows\System\MbXqlDs.exe
  2⤵
  PID:8684
- C:\Windows\System\vpDPfkD.exe
  C:\Windows\System\vpDPfkD.exe
  2⤵
  PID:8800
- C:\Windows\System\YPLliTs.exe
  C:\Windows\System\YPLliTs.exe
  2⤵
  PID:8860
- C:\Windows\System\mfCPLKq.exe
  C:\Windows\System\mfCPLKq.exe
  2⤵
  PID:8896
- C:\Windows\System\CIlifaK.exe
  C:\Windows\System\CIlifaK.exe
  2⤵
  PID:8996
- C:\Windows\System\oRubAbQ.exe
  C:\Windows\System\oRubAbQ.exe
  2⤵
  PID:8948
- C:\Windows\System\RqZnTLl.exe
  C:\Windows\System\RqZnTLl.exe
  2⤵
  PID:8932
- C:\Windows\System\axxDYcY.exe
  C:\Windows\System\axxDYcY.exe
  2⤵
  PID:9092
- C:\Windows\System\JAGBZrb.exe
  C:\Windows\System\JAGBZrb.exe
  2⤵
  PID:9228
- C:\Windows\System\oCgbylA.exe
  C:\Windows\System\oCgbylA.exe
  2⤵
  PID:9244
- C:\Windows\System\lIwxnQA.exe
  C:\Windows\System\lIwxnQA.exe
  2⤵
  PID:9264
- C:\Windows\System\HRfaXsh.exe
  C:\Windows\System\HRfaXsh.exe
  2⤵
  PID:9284
- C:\Windows\System\TECbfME.exe
  C:\Windows\System\TECbfME.exe
  2⤵
  PID:9300
- C:\Windows\System\KWYFqHy.exe
  C:\Windows\System\KWYFqHy.exe
  2⤵
  PID:9320
- C:\Windows\System\rTwoWEr.exe
  C:\Windows\System\rTwoWEr.exe
  2⤵
  PID:9336
- C:\Windows\System\AYiswqE.exe
  C:\Windows\System\AYiswqE.exe
  2⤵
  PID:9356
- C:\Windows\System\yDxysmk.exe
  C:\Windows\System\yDxysmk.exe
  2⤵
  PID:9376
- C:\Windows\System\SoLHjZm.exe
  C:\Windows\System\SoLHjZm.exe
  2⤵
  PID:9392
- C:\Windows\System\wpvXIFj.exe
  C:\Windows\System\wpvXIFj.exe
  2⤵
  PID:9416
- C:\Windows\System\GeWGLeE.exe
  C:\Windows\System\GeWGLeE.exe
  2⤵
  PID:9432
- C:\Windows\System\buhSvar.exe
  C:\Windows\System\buhSvar.exe
  2⤵
  PID:9452
- C:\Windows\System\EKvrIFI.exe
  C:\Windows\System\EKvrIFI.exe
  2⤵
  PID:9468
- C:\Windows\System\wmGXuql.exe
  C:\Windows\System\wmGXuql.exe
  2⤵
  PID:9488
- C:\Windows\System\nVSRHtM.exe
  C:\Windows\System\nVSRHtM.exe
  2⤵
  PID:9508
- C:\Windows\System\amwtsuJ.exe
  C:\Windows\System\amwtsuJ.exe
  2⤵
  PID:9524
- C:\Windows\System\yTZdSXd.exe
  C:\Windows\System\yTZdSXd.exe
  2⤵
  PID:9544
- C:\Windows\System\UctdqQb.exe
  C:\Windows\System\UctdqQb.exe
  2⤵
  PID:9560
- C:\Windows\System\VaNcMMk.exe
  C:\Windows\System\VaNcMMk.exe
  2⤵
  PID:9576
- C:\Windows\System\prCORWP.exe
  C:\Windows\System\prCORWP.exe
  2⤵
  PID:9596
- C:\Windows\System\VrsddMN.exe
  C:\Windows\System\VrsddMN.exe
  2⤵
  PID:9612
- C:\Windows\System\VuYjvbG.exe
  C:\Windows\System\VuYjvbG.exe
  2⤵
  PID:9628
- C:\Windows\System\ezOQVqe.exe
  C:\Windows\System\ezOQVqe.exe
  2⤵
  PID:9644
- C:\Windows\System\RQKBiTM.exe
  C:\Windows\System\RQKBiTM.exe
  2⤵
  PID:9672
- C:\Windows\System\QvhkNiK.exe
  C:\Windows\System\QvhkNiK.exe
  2⤵
  PID:9688
- C:\Windows\System\CknqYPk.exe
  C:\Windows\System\CknqYPk.exe
  2⤵
  PID:9708
- C:\Windows\System\HXWRkIn.exe
  C:\Windows\System\HXWRkIn.exe
  2⤵
  PID:9724
- C:\Windows\System\GRljsJH.exe
  C:\Windows\System\GRljsJH.exe
  2⤵
  PID:9740
- C:\Windows\System\ETUNpSO.exe
  C:\Windows\System\ETUNpSO.exe
  2⤵
  PID:9756
- C:\Windows\System\xVWtcHX.exe
  C:\Windows\System\xVWtcHX.exe
  2⤵
  PID:9784
- C:\Windows\System\jFPkJjT.exe
  C:\Windows\System\jFPkJjT.exe
  2⤵
  PID:9800
- C:\Windows\System\OAcUrEd.exe
  C:\Windows\System\OAcUrEd.exe
  2⤵
  PID:9816
- C:\Windows\System\gLjTfRB.exe
  C:\Windows\System\gLjTfRB.exe
  2⤵
  PID:9832
- C:\Windows\System\ZdKyLUS.exe
  C:\Windows\System\ZdKyLUS.exe
  2⤵
  PID:9848
- C:\Windows\System\dTypMWE.exe
  C:\Windows\System\dTypMWE.exe
  2⤵
  PID:9868
- C:\Windows\System\OZVtBeA.exe
  C:\Windows\System\OZVtBeA.exe
  2⤵
  PID:9888
- C:\Windows\System\CxsRGcO.exe
  C:\Windows\System\CxsRGcO.exe
  2⤵
  PID:9904
- C:\Windows\System\yjqjWdX.exe
  C:\Windows\System\yjqjWdX.exe
  2⤵
  PID:9920
- C:\Windows\System\DuSuzzd.exe
  C:\Windows\System\DuSuzzd.exe
  2⤵
  PID:9944
- C:\Windows\System\yISBhDT.exe
  C:\Windows\System\yISBhDT.exe
  2⤵
  PID:9960
- C:\Windows\System\lFHcJld.exe
  C:\Windows\System\lFHcJld.exe
  2⤵
  PID:9980
- C:\Windows\System\xhLeSeS.exe
  C:\Windows\System\xhLeSeS.exe
  2⤵
  PID:10000
- C:\Windows\System\NKGJvgT.exe
  C:\Windows\System\NKGJvgT.exe
  2⤵
  PID:10016
- C:\Windows\System\OuTGWGP.exe
  C:\Windows\System\OuTGWGP.exe
  2⤵
  PID:10032
- C:\Windows\System\UmHWKFf.exe
  C:\Windows\System\UmHWKFf.exe
  2⤵
  PID:10048
- C:\Windows\System\oIdxvdz.exe
  C:\Windows\System\oIdxvdz.exe
  2⤵
  PID:10068
- C:\Windows\System\vCXxoZN.exe
  C:\Windows\System\vCXxoZN.exe
  2⤵
  PID:10088
- C:\Windows\System\Pmhkgfo.exe
  C:\Windows\System\Pmhkgfo.exe
  2⤵
  PID:10104
- C:\Windows\System\xGIYOgL.exe
  C:\Windows\System\xGIYOgL.exe
  2⤵
  PID:10120
- C:\Windows\System\klRVBhM.exe
  C:\Windows\System\klRVBhM.exe
  2⤵
  PID:10136
- C:\Windows\System\FbbRcwV.exe
  C:\Windows\System\FbbRcwV.exe
  2⤵
  PID:10156
- C:\Windows\System\IjekZzK.exe
  C:\Windows\System\IjekZzK.exe
  2⤵
  PID:10172
- C:\Windows\System\tMZTIOF.exe
  C:\Windows\System\tMZTIOF.exe
  2⤵
  PID:10188
- C:\Windows\System\qOqLVbJ.exe
  C:\Windows\System\qOqLVbJ.exe
  2⤵
  PID:10204
- C:\Windows\System\aeRdNPP.exe
  C:\Windows\System\aeRdNPP.exe
  2⤵
  PID:10220
- C:\Windows\System\RBzfGSS.exe
  C:\Windows\System\RBzfGSS.exe
  2⤵
  PID:10236
- C:\Windows\System\QUBzjeD.exe
  C:\Windows\System\QUBzjeD.exe
  2⤵
  PID:8240
- C:\Windows\System\jTtLeTP.exe
  C:\Windows\System\jTtLeTP.exe
  2⤵
  PID:8300
- C:\Windows\System\LAIPWqK.exe
  C:\Windows\System\LAIPWqK.exe
  2⤵
  PID:8384
- C:\Windows\System\qiUVHpu.exe
  C:\Windows\System\qiUVHpu.exe
  2⤵
  PID:8804
- C:\Windows\System\WSPNIIT.exe
  C:\Windows\System\WSPNIIT.exe
  2⤵
  PID:9028
- C:\Windows\System\pQkVKqb.exe
  C:\Windows\System\pQkVKqb.exe
  2⤵
  PID:9040
- C:\Windows\System\iefNcDs.exe
  C:\Windows\System\iefNcDs.exe
  2⤵
  PID:9276
- C:\Windows\System\jznlLPA.exe
  C:\Windows\System\jznlLPA.exe
  2⤵
  PID:9316
- C:\Windows\System\MRKZtBm.exe
  C:\Windows\System\MRKZtBm.exe
  2⤵
  PID:9424
- C:\Windows\System\WjgjnCM.exe
  C:\Windows\System\WjgjnCM.exe
  2⤵
  PID:9464
- C:\Windows\System\buPfozR.exe
  C:\Windows\System\buPfozR.exe
  2⤵
  PID:9504
- C:\Windows\System\yYJfhsC.exe
  C:\Windows\System\yYJfhsC.exe
  2⤵
  PID:9620
- C:\Windows\System\WtzymZu.exe
  C:\Windows\System\WtzymZu.exe
  2⤵
  PID:9696
- C:\Windows\System\NEyoeQe.exe
  C:\Windows\System\NEyoeQe.exe
  2⤵
  PID:9572
- C:\Windows\System\XxRJQUz.exe
  C:\Windows\System\XxRJQUz.exe
  2⤵
  PID:9636
- C:\Windows\System\MYKVjEX.exe
  C:\Windows\System\MYKVjEX.exe
  2⤵
  PID:8472
- C:\Windows\System\CLQJzdB.exe
  C:\Windows\System\CLQJzdB.exe
  2⤵
  PID:9668
- C:\Windows\System\PUAKBiy.exe
  C:\Windows\System\PUAKBiy.exe
  2⤵
  PID:9540
- C:\Windows\System\KHGlhAj.exe
  C:\Windows\System\KHGlhAj.exe
  2⤵
  PID:7020
- C:\Windows\System\hjxmayZ.exe
  C:\Windows\System\hjxmayZ.exe
  2⤵
  PID:8348
- C:\Windows\System\JtuKQSy.exe
  C:\Windows\System\JtuKQSy.exe
  2⤵
  PID:8424
- C:\Windows\System\hMEQpgD.exe
  C:\Windows\System\hMEQpgD.exe
  2⤵
  PID:8596
- C:\Windows\System\HXovJYR.exe
  C:\Windows\System\HXovJYR.exe
  2⤵
  PID:8992
- C:\Windows\System\YApuofq.exe
  C:\Windows\System\YApuofq.exe
  2⤵
  PID:9220
- C:\Windows\System\CInTGfj.exe
  C:\Windows\System\CInTGfj.exe
  2⤵
  PID:9260
- C:\Windows\System\GHeBDJj.exe
  C:\Windows\System\GHeBDJj.exe
  2⤵
  PID:9332
- C:\Windows\System\SWNTUaG.exe
  C:\Windows\System\SWNTUaG.exe
  2⤵
  PID:9400
- C:\Windows\System\wjZNxuZ.exe
  C:\Windows\System\wjZNxuZ.exe
  2⤵
  PID:9444
- C:\Windows\System\usnDqTR.exe
  C:\Windows\System\usnDqTR.exe
  2⤵
  PID:9520
- C:\Windows\System\YZSvWYy.exe
  C:\Windows\System\YZSvWYy.exe
  2⤵
  PID:9700
- C:\Windows\System\hRPvdHJ.exe
  C:\Windows\System\hRPvdHJ.exe
  2⤵
  PID:9720
- C:\Windows\System\DHaYNVW.exe
  C:\Windows\System\DHaYNVW.exe
  2⤵
  PID:9856
- C:\Windows\System\XQDDAbC.exe
  C:\Windows\System\XQDDAbC.exe
  2⤵
  PID:9900
- C:\Windows\System\bwqMgTV.exe
  C:\Windows\System\bwqMgTV.exe
  2⤵
  PID:9940
- C:\Windows\System\PHpdjkZ.exe
  C:\Windows\System\PHpdjkZ.exe
  2⤵
  PID:10044
- C:\Windows\System\dSMdbLM.exe
  C:\Windows\System\dSMdbLM.exe
  2⤵
  PID:10116
- C:\Windows\System\WxQpGeJ.exe
  C:\Windows\System\WxQpGeJ.exe
  2⤵
  PID:10180
- C:\Windows\System\kSJrKGq.exe
  C:\Windows\System\kSJrKGq.exe
  2⤵
  PID:9060
- C:\Windows\System\LPgLegz.exe
  C:\Windows\System\LPgLegz.exe
  2⤵
  PID:9496
- C:\Windows\System\OeHUlBU.exe
  C:\Windows\System\OeHUlBU.exe
  2⤵
  PID:8260
- C:\Windows\System\zvPCXjK.exe
  C:\Windows\System\zvPCXjK.exe
  2⤵
  PID:9348
- C:\Windows\System\rtSmQpN.exe
  C:\Windows\System\rtSmQpN.exe
  2⤵
  PID:9556
- C:\Windows\System\OaRFoQh.exe
  C:\Windows\System\OaRFoQh.exe
  2⤵
  PID:8744
- C:\Windows\System\glqWgLW.exe
  C:\Windows\System\glqWgLW.exe
  2⤵
  PID:9384
- C:\Windows\System\OStqFXM.exe
  C:\Windows\System\OStqFXM.exe
  2⤵
  PID:9764
- C:\Windows\System\MoqkUvR.exe
  C:\Windows\System\MoqkUvR.exe
  2⤵
  PID:9088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BTgrFoO.exe

Filesize
1.6MB

MD5
821f8bc5c49770de0ff9d14300edcedd

SHA1
86c33e4cd761bb2b2a5a4bd6011d2328af54059e

SHA256
3fcc7ba522f8a45a4b6a85134edce9d27fa6ab8dc63e29c64e4cfa3acb724478

SHA512
f872bd9157c03b76cb8c31098636dab4b13cb41f5c72bd2e6d13f7a089cb925fae96de8206f938d5faa1ae81d6cb349b1be728d04b9ff654f8f29bee24b91a7b

Download Submit
C:\Windows\system\DlpQMKn.exe

Filesize
1.6MB

MD5
298c5b606894d2dcb23f56fcff5d5688

SHA1
ad81215025479644ac226011c0d742c9ad395277

SHA256
05178874d7f6e6da5a08a9b7d76685feef583d1c383f41299a09c8f3219adb59

SHA512
3544da041fd23e9f21dc375ea4d9b155b32eab866aeac996599537f762536ee256573ec0b9b860ac44225766f4ee10973d96fccda308d95f8f59326f735c2ea8

Download Submit
C:\Windows\system\FAwoYlY.exe

Filesize
1.6MB

MD5
0e6f6109686d1ec9e46609da436cf399

SHA1
c269cc1cdf9fc3b888ed559f64f85b2032e0bd09

SHA256
1cd693b1846ff5692d840f21247672bb7559920cdd60a902cbf2b5ba347abf3d

SHA512
64dd3a35ef9b70b052119d48df7e73f4e46bf3d8b8c22f0921325d49bd164ac3ef59157b50e7dd9c46cfff628ad6ce2283400ca0d4574586acb9fbc8a3c63708

Download Submit
C:\Windows\system\KFdTYTi.exe

Filesize
1.6MB

MD5
94689a427f5491ff49055cb086326704

SHA1
91f21877a69408cf14db6369e7960d5bc3bc2cfd

SHA256
0df38a9e3f84998360a5ed7acca518c1eb73933593fb09e55cf57915816b3b3c

SHA512
ec62968e495ffdd1cdcfe72a36af2ae32cfb4829faa4f3249a1557b424422a224d2a8184d9739fda277738e8c0bb855e1b24ed695f8bac8e96c0890e9f0ff2df

Download Submit
C:\Windows\system\LSTIkTz.exe

Filesize
1.6MB

MD5
ac03f99da00345e34c9699595d068ea3

SHA1
18e5f8a79ac5bea9fa99fe102212d0c0c947bec0

SHA256
7beba7784886448772d45fac99a101e3cf07bf4ffc1f416dacdf6b207cedea3c

SHA512
88905365e530f835e1303f0e227ff2c63b38706b0806cebafc7ec41f2ba0cfab66ccfe15d7f9716dc4aa5543afb7d5d547b44e674b97e8d5e91f90e48f920b47

Download Submit
C:\Windows\system\NnXNnqv.exe

Filesize
1.6MB

MD5
1b70da39ba95f6b27e999eb14aeb3e54

SHA1
12ea013024e0b358a20bc66d50faccb8fbb8b2c7

SHA256
062985fe4be2ea3db6f15030ac29203e1ba32427b62d072c622da451c7a8ad5b

SHA512
2551742134c52b05f1c0979ea62f90d3cb1fff77a2b6a2b51ff906516d4832bbf6b76763492e10316f81e391faec3ebdef9fa8259183761085498a526a7a8afa

Download Submit
C:\Windows\system\QfbxoLb.exe

Filesize
1.6MB

MD5
6124362040b56ef4545ebc3a29eab0a8

SHA1
fd6f9991d4f1aa080fb9b467ba34b9aebcd0c420

SHA256
f582d8b7827885218da8c2ab227cfdabc03e47d55fabcaa86b8b6d049efc5ab1

SHA512
a58a9f79d63b87948d9fc2247339c16070218807860b049c16fb403ce1d62c62a477e7cf1bb1cd455875fd503b0e846f87c83eee0678aca5e9c828b602e03aae

Download Submit
C:\Windows\system\WCCBhBD.exe

Filesize
1.6MB

MD5
ea6e2fed3fa249cf91859b44cf7fffcc

SHA1
7a72bb1c78be8fe697be1097577baa14bf44325a

SHA256
dd7b177958eb959db3567043360553096fecb85d5fb328abbc8ccc5400ccf598

SHA512
e2b8ea842f9b997aa74efd56a5c7399d9f83fef9090f7e00cf661140fd11e71d0ade6a3e12824c278fcaf52c9896dab53f7d5086f5289c72e86427f1a085522a

Download Submit
C:\Windows\system\WORpsZc.exe

Filesize
1.6MB

MD5
30a65dd63e5c4b14d4cfd82921e68331

SHA1
d5cd7c8fb01d1c9f58a0b3597d05b966c7bcb05e

SHA256
039409bfb23270adf9846b739e66f24ca93c2decfb02f15c9f2c37c483e2ec2b

SHA512
dc1fdbc65775386ed286d683f3b581b97d8a89143e6faec5cebacfe811408c0db98ba2780a671f92e71839bf179bc4b35c2155e0107cbd484340470b47846e51

Download Submit
C:\Windows\system\WiLPjay.exe

Filesize
1.6MB

MD5
b2c7ad2b8405117f6e84c1eb515145b6

SHA1
b8ccb7fd9882367afe084e81ad12b68cdb1fa2d4

SHA256
916ef09df3b7370c335787c0d8d324156c0d9b9e9687495dce2e876882db1f22

SHA512
067357a71eb669ae339a3c9b324a65c10aeba099202f14853a398fecee8bbae42586daddb97c61adad2051bf44f88e627c16a9a3f5bd102ae73f2c85ba23c36a

Download Submit
C:\Windows\system\XPMqlWe.exe

Filesize
1.6MB

MD5
5adb576ded73c89dcd4c26dedfcf603c

SHA1
a2bccad5866f34fc889ff282557b0cdc80358377

SHA256
a52b568d21e56c48e279f1366041d3a99ce91785e0a736379f5cf30fcd688351

SHA512
01aea66b32610aa11fd1df72eb4a5f653c6a39850378252a62f62028929c6ec1225d451878a144a860a688de46004da11c6b04ee9436ff1cb7a42a13d3177456

Download Submit
C:\Windows\system\ZDompfk.exe

Filesize
1.6MB

MD5
5b89959e339a89a1b7b158d02dc27b78

SHA1
d4925626f825116481b2af5a4be6c6521488c227

SHA256
0726ef25fb142449c11cd5d9bde4246c35977e428624b3369bab46c190d60bf6

SHA512
839c2be3e13abb026b1c5689a7b5ebe434db6c9b69107b81f8578189efbad843fb099d6d7ff7c968741b3667e54df6c34a6297cb285e70ae3dac37ef719139c9

Download Submit
C:\Windows\system\bExchrl.exe

Filesize
1.6MB

MD5
4a5f3c7223e30714accc3c34ccf7d1ed

SHA1
8905db5b64a0d7a323156100b33fc53e85796e49

SHA256
72515c8f11bc422b4092b5cba6d8a82cc674f7155009e47939ec759085dfce79

SHA512
0c0ab3e4e737e6e9635e6b21b8cf52fad01ef1f1ff044f3728cfa762886e278fe398a94ccb490bb59ce37c80ca6382100fe086da8fde58d6c709f7fa62e0d7e0

Download Submit
C:\Windows\system\fcsMIam.exe

Filesize
1.6MB

MD5
c52a03cbfe9f5600d1adc3de03f60055

SHA1
bced1083645372f5ee69e6c7912813a0fffb5c36

SHA256
9d3a63c5706fa5d049b84f71a75934b996c7a2015dde5c3a390421f2514c2bd2

SHA512
3d15e66660816a08cbf55ec1226c143efef9bc4827dec58bcf2324ce2287e07cbef1f03da9f05650de0499bcc2d21db6e002043d61041279a95338cc0d4aa00c

Download Submit
C:\Windows\system\gIJYYLa.exe

Filesize
1.6MB

MD5
038bacda07ba939c4facda14a8a0d338

SHA1
8d542068278dea3fc3fcdc9fdecc8a1b94f7949d

SHA256
993887b0c820b07aac43bb12bea9d11d92818e6476e85a860013c359cf051741

SHA512
aac3e0f3668c765f7b462d18da170236bcd0daad1ea5fef7c108a03e8bfa25da9d6b5f942df3ae826ed0e963fda2e0a8d003b4da5bcd4b5376eb2f62d6f47a19

Download Submit
C:\Windows\system\jcbkNsE.exe

Filesize
1.6MB

MD5
f15f63ecc1bbea9f56acc86f76665822

SHA1
fc9128e2b6e474f527be05af65403c166fcf5c80

SHA256
9c6251662f579506f1af11db7b0a128ceee14032e6038635f5772abd9535b3c9

SHA512
8dce1e8024a1a220a5c644dcc5df01f56c22f5859bac0d40d3bbb87213cbed3aad7fae6f8607ed3fea4eaaba09bf66e75b96c39a6934e9ce2c3bedcdae3c32ab

Download Submit
C:\Windows\system\kIhAckh.exe

Filesize
1.6MB

MD5
3587bd90767fd75bb1377d568f38ab0d

SHA1
2497a518dfc49dcc3232497b63c7b424b634924e

SHA256
727aa15d9aa82252369b00ff84bbc1e5055f9954730f5988c5d6d4c601ad2bd7

SHA512
88efe6559d24a3c64cfc59ed6091dd7f782e1a0e429ce3640ff71153bf5764938d9ce2a45756a33b522613bf653dcebdc7097641f58b527f71e4f8ede37dc927

Download Submit
C:\Windows\system\kbWGNeG.exe

Filesize
1.6MB

MD5
e226c62a174ead07544626765a1c9887

SHA1
ff2b299a608dcd45493640ab1035a5d2b657558c

SHA256
46cfc8c68434817ff8ea1e7cc58f32daa76f2405646038e52ce1ee2040bbc67b

SHA512
89ebd4f4a3be21d23b28766f47de6c27ea8cbf95d04e344fd9698fa65d6a383dc27e4ce428fb9f15f4761212f62f4ed5c3e66d1d68a0064ec042e86e932f8623

Download Submit
C:\Windows\system\lKPseEk.exe

Filesize
8B

MD5
73d2a6f98ec11a363ba40d9285f31146

SHA1
f412571986c937c29e7d1df48abd9ea9b810fb79

SHA256
9599521a11e3ac1412a598ac34375377cf195a57228d724684ce7cd2fc0f8bb0

SHA512
85230fa9f6b5cc93b67c122ee0f2a6b41f611e7c892a179490ce36def0b7cf39dd4e008408c7b0ba49dd6453338ebd04122a1a20b23e1ea00da2f3cdeed0b74f

Download Submit
C:\Windows\system\nPZHNsv.exe

Filesize
1.6MB

MD5
ba8d83471efc43ba48f956e10e1a553b

SHA1
3c21f5090a69950259d86806d0c3edadee3c85c7

SHA256
5cfcb92eb1ec7a72e204113831cba2e0c7ae582127f99b4f47bbef9f2934ed28

SHA512
6720ac90ed6ab46045c06d08dfb1341aaca5decc817143dc40c71a117c0ca1e4abc85886425c0f8ef0c7ecf6a59bb74152d16926a2c7aaf117c64a8edf5fe38e

Download Submit
C:\Windows\system\ozPsCXu.exe

Filesize
1.6MB

MD5
329084adef3c523ccc4123309a0db74c

SHA1
b2379dfc8bbd5556d9f71bb0e21bbb606fd7340e

SHA256
75c4b250997fd7f811270c6f4c8e94dcdfe9fe672aad5e0355dfef9ca2a4d709

SHA512
2734af78ceeea527d5b64a85b42dfe936b7c30d6d78888984efdbe5edc33b060dd2e189b16dc7f0208b3f89b13f0e2ce80b0899f95dcc6c1794a92fed51e445b

Download Submit
C:\Windows\system\wcOGytW.exe

Filesize
1.6MB

MD5
3239934b6b48ec5137bc49d26f3098ed

SHA1
b6c096ca4830de0dd674ab0895f995a5a00a7388

SHA256
6363d179780b4a0313a104badb751ff72e9c7bfb1bd49d09a188cbd534e88bea

SHA512
7e302d03efd1b26d413fea72bf77c79b7013a85e24438ea8e29caf55debed19794642121cb7e6f91c65eb07f97e41bd1a8c4f04ea2ef3ea4995f38d986214121

Download Submit
C:\Windows\system\xuSgFxy.exe

Filesize
1.6MB

MD5
ae1a9ed19a1c8662f9cc9cd5a2b11c3c

SHA1
3d0f0b580cd18bc5302caf0050452c11217290ba

SHA256
2da12dcaff1ea26c409c2d3e7e717280bacc58c69ae9c050fd86cf0f0609ef90

SHA512
db6ede143eb28849e5bbd13dd987a1ecc64882d5b957df3a77ca6b552b30f913fe5087269759cec7dfb11417c0eaa8bd643379f0312949403dfee2b9fd089a67

Download Submit
C:\Windows\system\yfugHuO.exe

Filesize
1.6MB

MD5
ef2c105960f12267bb2c1341b8cd7db9

SHA1
5095846b1f50f29874501c792dde78c772edeb64

SHA256
6e7c18eecfeb50b5943f7c999bd5f50f248a003661826b1ea60ba4c68a03a1c7

SHA512
a6d07a9fcf757fe30bcf019fd5298a59df208e5523e6cebf62b7a1c85aa136a98a2719b1621a6d80f287497d7c893d2c70d02b2a05c6628b8fd62b910d025998

Download Submit
\Windows\system\BnZYVNH.exe

Filesize
1.6MB

MD5
75112f7cc6e08fab8c98651df0318506

SHA1
cfe7c5c8bcbf8cabcc559e5f145fbcc0061b9ea4

SHA256
0af6993e2c93f8cd750ff23cd2ac31b1cf426a549ec7f0966e2b2e2d2f8bb826

SHA512
93ed04d615229f0d13e9eecab88b7a4cd7df4ef697672107e06688a84c2f4989211749048bd932baa916e1c3c7e17b2d3cd03433942575084d1ea29931596be2

Download Submit
\Windows\system\BrsDTog.exe

Filesize
1.6MB

MD5
d66ae73247a7a3f711a70dc82f692558

SHA1
527f240504506f89901252bfe6948914fe4cd5f7

SHA256
1ef635766d3ea98b044166e32d5316effca9e5cfa7df7619cf701df7ec589099

SHA512
446d7ddbb49327bad533d908d9cbb7eabdd6f55c7e480dfbd4937f57756bb851b264bb0e8d3f70ee925b8157a7e63933df2f14e814a3180a9eb2245477742bf7

Download Submit
\Windows\system\FaIhHGP.exe

Filesize
1.6MB

MD5
576c9a22b14239455f98445a998773c0

SHA1
2b3d6ada9b27b89ea8ebe95b1552b16d8b064bf8

SHA256
a1c6fd93c1a04b36a3a9c797808e19ef019985470b0461ef74b601f8a0504aa0

SHA512
e23ee7a3c6ae23c09d4010789447bc3e9c9a980a19b479b630f9146135fc539335238331ad1e8746ebd5c16a6cc88fcb4fe868badc27de2039c248edd4ae5e6b

Download Submit
\Windows\system\GBjrEKO.exe

Filesize
1.6MB

MD5
cc0eeb34c41ab909ac5507f237450c29

SHA1
c3e6ea76829f27ae3afbbce72ddeded85dc8c4d1

SHA256
85d462b81a92b51d8ddfed4831f1c81dfb637e017ae5d756382afc0c2c80d20a

SHA512
94314ccf7eb03c19a2c8f185d05faafa1040fa9f7dab9af9014984158d45f6704b0045438c5518a5097208ccf93e0d2d81d3b9cf0ac1d6bec7d20699200feea1

Download Submit
\Windows\system\VNXltiH.exe

Filesize
1.6MB

MD5
85c58bfc25c3599747ef342eecca94bb

SHA1
1c7abfed1a73dd793aed95783b9bf0af155b3750

SHA256
be75dd1b53e18324e647c126532e2217235f216c12f1881a195a1dfa0a787686

SHA512
5b0656d6b30c81f1a930a2784a58e4c4edf48eb5899abc4450e5d70fdf67fcee33860bdf092528877e1c14be905c48edbc3370a50eb44d333be236155856147b

Download Submit
\Windows\system\XNOiiwp.exe

Filesize
1.6MB

MD5
9fffeec1c197b60e238942472e8009d7

SHA1
29d39170a57f44a25d55ae2b52dc4a966f6885ee

SHA256
971fc04baa7fced02c84783b67e49d8a0464246f199494baf6d0b482b23d78ef

SHA512
579d3a828099cf64bb5457630587460be54076b23a7336e786acfb67060d3b6e01237db1ff2186654658b3fd3dbb8a3971d67cef1d80c02a94e28117f7b97ded

Download Submit
\Windows\system\YngPtMe.exe

Filesize
1.6MB

MD5
4ea6218793ff952327bf26813b7e1bdd

SHA1
09b9d915d00a77330cb44d834e2254b551fb5587

SHA256
aa08571c174cc8a2d89dc0faeded4ae796f3b8436192a44812e7f7daf7a737d3

SHA512
2310c0603047043ba732f3af9f15a4873be06e0f59a066e55fa1dfba3fc3012c26ffe01340cf96deca3769168784f0ae1a13965441e537d8ec0fc491bd782be0

Download Submit
\Windows\system\sSFQjZF.exe

Filesize
1.6MB

MD5
e36a7ddbf7346f053ceb9e462025a692

SHA1
f8e6a6261247459a4eb3c52586fabad6350bc852

SHA256
d4e792815e92c60d25695a0f5c80bf73a89b86e894bb1741f654534c39bbb80e

SHA512
37cfa630747218536fa88ac96f7f84920cb0e70f3c154c65d54fa3ed16d731bff76927bbeeafebc674878dd5b8fe925e819a7b68a480c535040fa28b19e96905

Download Submit
\Windows\system\tOAupvW.exe

Filesize
1.6MB

MD5
64710fa774e2d58d3165646ba765eb71

SHA1
20d14f300c49b2e9a5eca916dfd9e8ed47d5a0f7

SHA256
e6500791cb612af1699fde7ab36fef1e55d10c4460f955d4dbae6f0327e84714

SHA512
298752b819ea1ad9e81dca8fadc4bbf9e29d8a06749e5b4211b81392ec17f7e87c92e6133f78b0d80749dfec234afca7c9d1faaaf89aeb9d36ebffb2b705138f

Download Submit
memory/1608-77-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/1608-5318-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-4429-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-69-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-82-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2028-4536-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2100-41-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-45-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2100-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2100-65-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2100-43-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2100-76-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2100-14247-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2100-67-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2100-13225-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2100-5482-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2100-2-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2100-39-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2100-68-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-1623-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2100-88-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2100-9-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2100-1001-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2100-89-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/2256-5314-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2256-90-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2284-97-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2380-40-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2380-4321-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2416-4447-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2416-46-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2556-4407-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2556-13-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2556-96-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2644-4339-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2644-44-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2696-4351-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-42-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-4408-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-63-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-15-0x000007FEF600E000-0x000007FEF600F000-memory.dmp

Filesize
4KB

Download
memory/2984-34-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2984-47-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2984-57-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2984-14-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2984-38-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2984-36-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/2984-70-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/2996-4420-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2996-66-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download