xmrig | 4970a9cd7aa7623a0288159fe7977db62b0d74906dccd611d6e1a4d72b21a436

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
Size

3.0MB
MD5

6783db08b54cca5303164e90af8fefb0
SHA1

11fb0849a9bb7553b658ee51b0b7355db32612f7
SHA256

4970a9cd7aa7623a0288159fe7977db62b0d74906dccd611d6e1a4d72b21a436
SHA512

fccdf49788f5a01a25163d29efd4ef931024b8d4be5d6c0464f99604ae606619d022aaa5b4f20ed5ff44b75aa5884decf479a16eef1acc787c87ba7b0f6ee868
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a2yKmkUwV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral1/memory/2988-1-0x000000013F390000-0x000000013F786000-memory.dmp	xmrig
behavioral1/files/0x000b0000000155e2-3.dat	xmrig
behavioral1/memory/2504-9-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/files/0x0025000000015c2f-13.dat	xmrig
behavioral1/files/0x0024000000015c3c-24.dat	xmrig
behavioral1/memory/1900-27-0x000000013F050000-0x000000013F446000-memory.dmp	xmrig
behavioral1/memory/2764-20-0x000000013F2A0000-0x000000013F696000-memory.dmp	xmrig
behavioral1/files/0x000f0000000006fd-32.dat	xmrig
behavioral1/files/0x0007000000015cb9-34.dat	xmrig
behavioral1/files/0x0014000000015c52-41.dat	xmrig
behavioral1/files/0x0008000000015e02-46.dat	xmrig
behavioral1/files/0x00070000000165ae-49.dat	xmrig
behavioral1/memory/2372-83-0x000000013F660000-0x000000013FA56000-memory.dmp	xmrig
behavioral1/memory/2420-85-0x000000013F090000-0x000000013F486000-memory.dmp	xmrig
behavioral1/memory/1488-113-0x000000013F300000-0x000000013F6F6000-memory.dmp	xmrig
behavioral1/memory/1960-115-0x000000013F380000-0x000000013F776000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b96-123.dat	xmrig
behavioral1/files/0x0005000000019333-147.dat	xmrig
behavioral1/files/0x0005000000019410-167.dat	xmrig
behavioral1/files/0x000500000001946b-171.dat	xmrig
behavioral1/files/0x00050000000193b0-163.dat	xmrig
behavioral1/files/0x000500000001939b-159.dat	xmrig
behavioral1/files/0x0005000000019377-155.dat	xmrig
behavioral1/files/0x0005000000019368-151.dat	xmrig
behavioral1/files/0x000500000001931b-143.dat	xmrig
behavioral1/files/0x00050000000192f4-139.dat	xmrig
behavioral1/files/0x00050000000192c9-135.dat	xmrig
behavioral1/files/0x0006000000018d06-131.dat	xmrig
behavioral1/files/0x0006000000018ba2-127.dat	xmrig
behavioral1/files/0x0006000000018b73-119.dat	xmrig
behavioral1/files/0x0006000000018b6a-112.dat	xmrig
behavioral1/memory/1664-110-0x000000013FDC0000-0x00000001401B6000-memory.dmp	xmrig
behavioral1/memory/776-99-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b42-97.dat	xmrig
behavioral1/memory/344-105-0x000000013F390000-0x000000013F786000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b4a-103.dat	xmrig
behavioral1/memory/3068-93-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	xmrig
behavioral1/memory/2820-90-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b37-89.dat	xmrig
behavioral1/files/0x0006000000018b33-82.dat	xmrig
behavioral1/files/0x0006000000018b15-74.dat	xmrig
behavioral1/files/0x0006000000018ae8-70.dat	xmrig
behavioral1/files/0x00050000000186a0-63.dat	xmrig
behavioral1/files/0x0006000000018ae2-66.dat	xmrig
behavioral1/files/0x0005000000018698-54.dat	xmrig
behavioral1/memory/2988-1709-0x000000013F390000-0x000000013F786000-memory.dmp	xmrig
behavioral1/memory/2504-2379-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/memory/2764-2380-0x000000013F2A0000-0x000000013F696000-memory.dmp	xmrig
behavioral1/memory/1900-2382-0x000000013F050000-0x000000013F446000-memory.dmp	xmrig
behavioral1/memory/2372-2383-0x000000013F660000-0x000000013FA56000-memory.dmp	xmrig
behavioral1/memory/2420-2396-0x000000013F090000-0x000000013F486000-memory.dmp	xmrig
behavioral1/memory/344-2397-0x000000013F390000-0x000000013F786000-memory.dmp	xmrig
behavioral1/memory/776-2386-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig
behavioral1/memory/2820-2405-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/memory/1664-2443-0x000000013FDC0000-0x00000001401B6000-memory.dmp	xmrig
behavioral1/memory/1960-2445-0x000000013F380000-0x000000013F776000-memory.dmp	xmrig
behavioral1/memory/3068-2440-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	xmrig
behavioral1/memory/1488-2439-0x000000013F300000-0x000000013F6F6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2940	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2504	oZRNexh.exe
2764	LArTqKs.exe
1900	rrnyzMF.exe
2372	cnJuNBM.exe
2420	twtvgAf.exe
2820	lWsqlBQ.exe
3068	gPBibuV.exe
776	MfFZwpe.exe
344	GWhejyw.exe
1664	yBjcsBI.exe
1488	yuZZDMJ.exe
1960	JEQzZlK.exe
2144	mmmXuFl.exe
760	fKAoCae.exe
2664	ZKatkqp.exe
2184	GSSbkTP.exe
1696	kXpWsdZ.exe
1824	gVAkTIs.exe
1592	UIXcKZe.exe
1748	AJQlAPx.exe
1740	emTkHuM.exe
1300	NANqxRg.exe
2644	yFcluVn.exe
1180	mDMyHhA.exe
2980	rpCthlm.exe
2704	yZPehld.exe
2920	icYubGG.exe
1932	sWXhrsf.exe
816	fHYhbXq.exe
588	TTbbaTd.exe
600	nlSFnwK.exe
1928	UHoONYi.exe
3052	ZHLURhZ.exe
2916	HWdudHE.exe
1536	acuuMId.exe
1144	xcRtUYa.exe
2948	XQaohcZ.exe
1736	VnjYuHd.exe
488	bQVvyvs.exe
1064	fDEKsMc.exe
616	HWAErRI.exe
3060	DaFQdKh.exe
1720	kKBDxUD.exe
1956	BPpYUvk.exe
2040	XFueiuP.exe
2072	KTnPNMX.exe
644	GXgIzMv.exe
1892	HyTTeIV.exe
2904	JvdSVMt.exe
2996	hOPLhMY.exe
892	VtfdTce.exe
1888	PVGoNWo.exe
1920	NuXbayo.exe
1196	hHkvIJM.exe
2252	iHVvMfz.exe
1516	HiDKOLC.exe
2340	mAINiLl.exe
2576	QFLjASV.exe
2532	FOiRnlx.exe
2492	jdXpWFT.exe
2428	ppvpWmL.exe
2404	qBifqOi.exe
2496	cltqYUI.exe
2836	KzcsuGK.exe

Loads dropped DLL 64 IoCs

pid	Process
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2988-1-0x000000013F390000-0x000000013F786000-memory.dmp	upx
behavioral1/files/0x000b0000000155e2-3.dat	upx
behavioral1/memory/2504-9-0x000000013F890000-0x000000013FC86000-memory.dmp	upx
behavioral1/files/0x0025000000015c2f-13.dat	upx
behavioral1/files/0x0024000000015c3c-24.dat	upx
behavioral1/memory/1900-27-0x000000013F050000-0x000000013F446000-memory.dmp	upx
behavioral1/memory/2764-20-0x000000013F2A0000-0x000000013F696000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-32.dat	upx
behavioral1/files/0x0007000000015cb9-34.dat	upx
behavioral1/files/0x0014000000015c52-41.dat	upx
behavioral1/files/0x0008000000015e02-46.dat	upx
behavioral1/files/0x00070000000165ae-49.dat	upx
behavioral1/memory/2372-83-0x000000013F660000-0x000000013FA56000-memory.dmp	upx
behavioral1/memory/2420-85-0x000000013F090000-0x000000013F486000-memory.dmp	upx
behavioral1/memory/1488-113-0x000000013F300000-0x000000013F6F6000-memory.dmp	upx
behavioral1/memory/1960-115-0x000000013F380000-0x000000013F776000-memory.dmp	upx
behavioral1/files/0x0006000000018b96-123.dat	upx
behavioral1/files/0x0005000000019333-147.dat	upx
behavioral1/files/0x0005000000019410-167.dat	upx
behavioral1/files/0x000500000001946b-171.dat	upx
behavioral1/files/0x00050000000193b0-163.dat	upx
behavioral1/files/0x000500000001939b-159.dat	upx
behavioral1/files/0x0005000000019377-155.dat	upx
behavioral1/files/0x0005000000019368-151.dat	upx
behavioral1/files/0x000500000001931b-143.dat	upx
behavioral1/files/0x00050000000192f4-139.dat	upx
behavioral1/files/0x00050000000192c9-135.dat	upx
behavioral1/files/0x0006000000018d06-131.dat	upx
behavioral1/files/0x0006000000018ba2-127.dat	upx
behavioral1/files/0x0006000000018b73-119.dat	upx
behavioral1/files/0x0006000000018b6a-112.dat	upx
behavioral1/memory/1664-110-0x000000013FDC0000-0x00000001401B6000-memory.dmp	upx
behavioral1/memory/776-99-0x000000013F780000-0x000000013FB76000-memory.dmp	upx
behavioral1/files/0x0006000000018b42-97.dat	upx
behavioral1/memory/344-105-0x000000013F390000-0x000000013F786000-memory.dmp	upx
behavioral1/files/0x0006000000018b4a-103.dat	upx
behavioral1/memory/3068-93-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	upx
behavioral1/memory/2820-90-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/files/0x0006000000018b37-89.dat	upx
behavioral1/files/0x0006000000018b33-82.dat	upx
behavioral1/files/0x0006000000018b15-74.dat	upx
behavioral1/files/0x0006000000018ae8-70.dat	upx
behavioral1/files/0x00050000000186a0-63.dat	upx
behavioral1/files/0x0006000000018ae2-66.dat	upx
behavioral1/files/0x0005000000018698-54.dat	upx
behavioral1/memory/2988-1709-0x000000013F390000-0x000000013F786000-memory.dmp	upx
behavioral1/memory/2504-2379-0x000000013F890000-0x000000013FC86000-memory.dmp	upx
behavioral1/memory/2764-2380-0x000000013F2A0000-0x000000013F696000-memory.dmp	upx
behavioral1/memory/1900-2382-0x000000013F050000-0x000000013F446000-memory.dmp	upx
behavioral1/memory/2372-2383-0x000000013F660000-0x000000013FA56000-memory.dmp	upx
behavioral1/memory/2420-2396-0x000000013F090000-0x000000013F486000-memory.dmp	upx
behavioral1/memory/344-2397-0x000000013F390000-0x000000013F786000-memory.dmp	upx
behavioral1/memory/776-2386-0x000000013F780000-0x000000013FB76000-memory.dmp	upx
behavioral1/memory/2820-2405-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/memory/1664-2443-0x000000013FDC0000-0x00000001401B6000-memory.dmp	upx
behavioral1/memory/1960-2445-0x000000013F380000-0x000000013F776000-memory.dmp	upx
behavioral1/memory/3068-2440-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	upx
behavioral1/memory/1488-2439-0x000000013F300000-0x000000013F6F6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QtEBPKr.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\dXxayJV.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\lvvRNFo.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\ggXhShn.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\KTnPNMX.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\yzGDZWT.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\bsUpqeq.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\SIQBAFI.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\ijeduax.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\kWwkjna.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\cImMmPH.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\HCzjOic.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\EFWLBYe.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\XZbQgyL.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\gVzAgOy.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\tRlxLlX.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\SowebDW.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\XyWIoXB.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\jiurclI.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\aHEOfEG.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\BkWtLqi.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\gsFkcZv.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\FtwyRqU.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\SyeYTEd.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\WakreiD.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\eaIkxWh.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\ojYLtYf.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\bnxNqeN.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\TaXdbYc.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\wrKeSVq.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\rfPHcLb.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\iTWIwdi.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\jnBoaKv.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\kvcTCZP.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\gpvCUpM.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\OAwjiOD.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\hxYWrPj.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\tHevYtJ.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\EtaahDS.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZYNrgxC.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\oxnacRL.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\jJdqRAR.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\pEQfZVV.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\oiWqhTZ.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\BigXItW.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\pVVzHlw.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\BUSyVzK.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZWciKsr.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\MqNVixn.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\QttsYpC.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\heHFoKs.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\FcJiDSV.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\LnMeIDU.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\kfPfBFX.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\aEwIzvf.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\awxXDkE.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\eSmnlVY.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\hworonr.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\ipsdnAo.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\SJwuZlc.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\ElOZqoZ.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\jfUDFtq.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\hZDyWAl.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\FdQHrGm.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2940	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2940	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2940	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2940	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2504	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	30
PID 2988 wrote to memory of 2504	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	30
PID 2988 wrote to memory of 2504	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	30
PID 2988 wrote to memory of 2764	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	31
PID 2988 wrote to memory of 2764	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	31
PID 2988 wrote to memory of 2764	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	31
PID 2988 wrote to memory of 1900	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	32
PID 2988 wrote to memory of 1900	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	32
PID 2988 wrote to memory of 1900	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	32
PID 2988 wrote to memory of 2372	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	33
PID 2988 wrote to memory of 2372	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	33
PID 2988 wrote to memory of 2372	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	33
PID 2988 wrote to memory of 2420	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	34
PID 2988 wrote to memory of 2420	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	34
PID 2988 wrote to memory of 2420	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	34
PID 2988 wrote to memory of 2820	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	35
PID 2988 wrote to memory of 2820	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	35
PID 2988 wrote to memory of 2820	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	35
PID 2988 wrote to memory of 3068	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	36
PID 2988 wrote to memory of 3068	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	36
PID 2988 wrote to memory of 3068	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	36
PID 2988 wrote to memory of 776	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	37
PID 2988 wrote to memory of 776	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	37
PID 2988 wrote to memory of 776	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	37
PID 2988 wrote to memory of 344	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	38
PID 2988 wrote to memory of 344	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	38
PID 2988 wrote to memory of 344	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	38
PID 2988 wrote to memory of 1664	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	39
PID 2988 wrote to memory of 1664	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	39
PID 2988 wrote to memory of 1664	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	39
PID 2988 wrote to memory of 1488	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	40
PID 2988 wrote to memory of 1488	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	40
PID 2988 wrote to memory of 1488	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	40
PID 2988 wrote to memory of 1960	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	41
PID 2988 wrote to memory of 1960	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	41
PID 2988 wrote to memory of 1960	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	41
PID 2988 wrote to memory of 2144	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	42
PID 2988 wrote to memory of 2144	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	42
PID 2988 wrote to memory of 2144	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	42
PID 2988 wrote to memory of 760	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	43
PID 2988 wrote to memory of 760	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	43
PID 2988 wrote to memory of 760	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	43
PID 2988 wrote to memory of 2664	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	44
PID 2988 wrote to memory of 2664	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	44
PID 2988 wrote to memory of 2664	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	44
PID 2988 wrote to memory of 2184	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	45
PID 2988 wrote to memory of 2184	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	45
PID 2988 wrote to memory of 2184	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	45
PID 2988 wrote to memory of 1696	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	46
PID 2988 wrote to memory of 1696	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	46
PID 2988 wrote to memory of 1696	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	46
PID 2988 wrote to memory of 1824	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	47
PID 2988 wrote to memory of 1824	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	47
PID 2988 wrote to memory of 1824	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	47
PID 2988 wrote to memory of 1592	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	48
PID 2988 wrote to memory of 1592	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	48
PID 2988 wrote to memory of 1592	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	48
PID 2988 wrote to memory of 1748	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	49
PID 2988 wrote to memory of 1748	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	49
PID 2988 wrote to memory of 1748	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	49
PID 2988 wrote to memory of 1740	2988	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\System\oZRNexh.exe
  C:\Windows\System\oZRNexh.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\LArTqKs.exe
  C:\Windows\System\LArTqKs.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\rrnyzMF.exe
  C:\Windows\System\rrnyzMF.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\cnJuNBM.exe
  C:\Windows\System\cnJuNBM.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\twtvgAf.exe
  C:\Windows\System\twtvgAf.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\lWsqlBQ.exe
  C:\Windows\System\lWsqlBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\gPBibuV.exe
  C:\Windows\System\gPBibuV.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\MfFZwpe.exe
  C:\Windows\System\MfFZwpe.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\GWhejyw.exe
  C:\Windows\System\GWhejyw.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\yBjcsBI.exe
  C:\Windows\System\yBjcsBI.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\yuZZDMJ.exe
  C:\Windows\System\yuZZDMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\JEQzZlK.exe
  C:\Windows\System\JEQzZlK.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\mmmXuFl.exe
  C:\Windows\System\mmmXuFl.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\fKAoCae.exe
  C:\Windows\System\fKAoCae.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ZKatkqp.exe
  C:\Windows\System\ZKatkqp.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\GSSbkTP.exe
  C:\Windows\System\GSSbkTP.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\kXpWsdZ.exe
  C:\Windows\System\kXpWsdZ.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\gVAkTIs.exe
  C:\Windows\System\gVAkTIs.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\UIXcKZe.exe
  C:\Windows\System\UIXcKZe.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\AJQlAPx.exe
  C:\Windows\System\AJQlAPx.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\emTkHuM.exe
  C:\Windows\System\emTkHuM.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\NANqxRg.exe
  C:\Windows\System\NANqxRg.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\yFcluVn.exe
  C:\Windows\System\yFcluVn.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\mDMyHhA.exe
  C:\Windows\System\mDMyHhA.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\rpCthlm.exe
  C:\Windows\System\rpCthlm.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\yZPehld.exe
  C:\Windows\System\yZPehld.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\icYubGG.exe
  C:\Windows\System\icYubGG.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\sWXhrsf.exe
  C:\Windows\System\sWXhrsf.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\fHYhbXq.exe
  C:\Windows\System\fHYhbXq.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\TTbbaTd.exe
  C:\Windows\System\TTbbaTd.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\nlSFnwK.exe
  C:\Windows\System\nlSFnwK.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\UHoONYi.exe
  C:\Windows\System\UHoONYi.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\ZHLURhZ.exe
  C:\Windows\System\ZHLURhZ.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\HWdudHE.exe
  C:\Windows\System\HWdudHE.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\acuuMId.exe
  C:\Windows\System\acuuMId.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\xcRtUYa.exe
  C:\Windows\System\xcRtUYa.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\XQaohcZ.exe
  C:\Windows\System\XQaohcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\VnjYuHd.exe
  C:\Windows\System\VnjYuHd.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\bQVvyvs.exe
  C:\Windows\System\bQVvyvs.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\fDEKsMc.exe
  C:\Windows\System\fDEKsMc.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\HWAErRI.exe
  C:\Windows\System\HWAErRI.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\DaFQdKh.exe
  C:\Windows\System\DaFQdKh.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\kKBDxUD.exe
  C:\Windows\System\kKBDxUD.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\BPpYUvk.exe
  C:\Windows\System\BPpYUvk.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\XFueiuP.exe
  C:\Windows\System\XFueiuP.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\KTnPNMX.exe
  C:\Windows\System\KTnPNMX.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\GXgIzMv.exe
  C:\Windows\System\GXgIzMv.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\HyTTeIV.exe
  C:\Windows\System\HyTTeIV.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\JvdSVMt.exe
  C:\Windows\System\JvdSVMt.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\hOPLhMY.exe
  C:\Windows\System\hOPLhMY.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\VtfdTce.exe
  C:\Windows\System\VtfdTce.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\PVGoNWo.exe
  C:\Windows\System\PVGoNWo.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\NuXbayo.exe
  C:\Windows\System\NuXbayo.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\hHkvIJM.exe
  C:\Windows\System\hHkvIJM.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\iHVvMfz.exe
  C:\Windows\System\iHVvMfz.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\HiDKOLC.exe
  C:\Windows\System\HiDKOLC.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\mAINiLl.exe
  C:\Windows\System\mAINiLl.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\QFLjASV.exe
  C:\Windows\System\QFLjASV.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\FOiRnlx.exe
  C:\Windows\System\FOiRnlx.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\jdXpWFT.exe
  C:\Windows\System\jdXpWFT.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\ppvpWmL.exe
  C:\Windows\System\ppvpWmL.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\qBifqOi.exe
  C:\Windows\System\qBifqOi.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\cltqYUI.exe
  C:\Windows\System\cltqYUI.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\KzcsuGK.exe
  C:\Windows\System\KzcsuGK.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\ALtXYvu.exe
  C:\Windows\System\ALtXYvu.exe
  2⤵
  PID:568
- C:\Windows\System\PzJCris.exe
  C:\Windows\System\PzJCris.exe
  2⤵
  PID:2352
- C:\Windows\System\wsybdCk.exe
  C:\Windows\System\wsybdCk.exe
  2⤵
  PID:1508
- C:\Windows\System\NXnaXqA.exe
  C:\Windows\System\NXnaXqA.exe
  2⤵
  PID:2360
- C:\Windows\System\FRyFIpM.exe
  C:\Windows\System\FRyFIpM.exe
  2⤵
  PID:2648
- C:\Windows\System\PqczMHb.exe
  C:\Windows\System\PqczMHb.exe
  2⤵
  PID:2584
- C:\Windows\System\QmWFVRk.exe
  C:\Windows\System\QmWFVRk.exe
  2⤵
  PID:2524
- C:\Windows\System\BodKBgs.exe
  C:\Windows\System\BodKBgs.exe
  2⤵
  PID:1676
- C:\Windows\System\adrAKbR.exe
  C:\Windows\System\adrAKbR.exe
  2⤵
  PID:1288
- C:\Windows\System\iytuyfw.exe
  C:\Windows\System\iytuyfw.exe
  2⤵
  PID:2724
- C:\Windows\System\TfQpZOg.exe
  C:\Windows\System\TfQpZOg.exe
  2⤵
  PID:552
- C:\Windows\System\yMAVKam.exe
  C:\Windows\System\yMAVKam.exe
  2⤵
  PID:784
- C:\Windows\System\AmjDNhY.exe
  C:\Windows\System\AmjDNhY.exe
  2⤵
  PID:2772
- C:\Windows\System\zfJURlZ.exe
  C:\Windows\System\zfJURlZ.exe
  2⤵
  PID:1896
- C:\Windows\System\uYyvhef.exe
  C:\Windows\System\uYyvhef.exe
  2⤵
  PID:2556
- C:\Windows\System\ulBZMRf.exe
  C:\Windows\System\ulBZMRf.exe
  2⤵
  PID:1140
- C:\Windows\System\LnMeIDU.exe
  C:\Windows\System\LnMeIDU.exe
  2⤵
  PID:2596
- C:\Windows\System\hDgaUwk.exe
  C:\Windows\System\hDgaUwk.exe
  2⤵
  PID:2448
- C:\Windows\System\UCaCdcH.exe
  C:\Windows\System\UCaCdcH.exe
  2⤵
  PID:1656
- C:\Windows\System\PWcepqF.exe
  C:\Windows\System\PWcepqF.exe
  2⤵
  PID:1404
- C:\Windows\System\FulENqk.exe
  C:\Windows\System\FulENqk.exe
  2⤵
  PID:2016
- C:\Windows\System\ePEORSU.exe
  C:\Windows\System\ePEORSU.exe
  2⤵
  PID:1808
- C:\Windows\System\OMVEHFd.exe
  C:\Windows\System\OMVEHFd.exe
  2⤵
  PID:1700
- C:\Windows\System\ZDyZUwn.exe
  C:\Windows\System\ZDyZUwn.exe
  2⤵
  PID:2884
- C:\Windows\System\CwAWPLH.exe
  C:\Windows\System\CwAWPLH.exe
  2⤵
  PID:2896
- C:\Windows\System\BTYwpcu.exe
  C:\Windows\System\BTYwpcu.exe
  2⤵
  PID:1448
- C:\Windows\System\xcCWvZh.exe
  C:\Windows\System\xcCWvZh.exe
  2⤵
  PID:1160
- C:\Windows\System\lmTKrZe.exe
  C:\Windows\System\lmTKrZe.exe
  2⤵
  PID:1236
- C:\Windows\System\KWmUeLd.exe
  C:\Windows\System\KWmUeLd.exe
  2⤵
  PID:2316
- C:\Windows\System\joTfyie.exe
  C:\Windows\System\joTfyie.exe
  2⤵
  PID:1460
- C:\Windows\System\PiSlxba.exe
  C:\Windows\System\PiSlxba.exe
  2⤵
  PID:1312
- C:\Windows\System\gpvCUpM.exe
  C:\Windows\System\gpvCUpM.exe
  2⤵
  PID:2624
- C:\Windows\System\GIAQAUD.exe
  C:\Windows\System\GIAQAUD.exe
  2⤵
  PID:476
- C:\Windows\System\PGFccAm.exe
  C:\Windows\System\PGFccAm.exe
  2⤵
  PID:1032
- C:\Windows\System\DyPSUEz.exe
  C:\Windows\System\DyPSUEz.exe
  2⤵
  PID:1560
- C:\Windows\System\DEQsKiP.exe
  C:\Windows\System\DEQsKiP.exe
  2⤵
  PID:1084
- C:\Windows\System\hYrTAhG.exe
  C:\Windows\System\hYrTAhG.exe
  2⤵
  PID:1464
- C:\Windows\System\rbjIuVW.exe
  C:\Windows\System\rbjIuVW.exe
  2⤵
  PID:2204
- C:\Windows\System\xxlLcVA.exe
  C:\Windows\System\xxlLcVA.exe
  2⤵
  PID:1632
- C:\Windows\System\WdOmPtA.exe
  C:\Windows\System\WdOmPtA.exe
  2⤵
  PID:2240
- C:\Windows\System\oQEGyJR.exe
  C:\Windows\System\oQEGyJR.exe
  2⤵
  PID:2020
- C:\Windows\System\uiPXAwC.exe
  C:\Windows\System\uiPXAwC.exe
  2⤵
  PID:2060
- C:\Windows\System\khUpcqW.exe
  C:\Windows\System\khUpcqW.exe
  2⤵
  PID:2484
- C:\Windows\System\kFQmcnc.exe
  C:\Windows\System\kFQmcnc.exe
  2⤵
  PID:2136
- C:\Windows\System\CKgGwEV.exe
  C:\Windows\System\CKgGwEV.exe
  2⤵
  PID:1596
- C:\Windows\System\QyeQSCR.exe
  C:\Windows\System\QyeQSCR.exe
  2⤵
  PID:2700
- C:\Windows\System\LWVIVAP.exe
  C:\Windows\System\LWVIVAP.exe
  2⤵
  PID:2568
- C:\Windows\System\KMdjHZx.exe
  C:\Windows\System\KMdjHZx.exe
  2⤵
  PID:2452
- C:\Windows\System\lXZBSWl.exe
  C:\Windows\System\lXZBSWl.exe
  2⤵
  PID:1324
- C:\Windows\System\bFowcBK.exe
  C:\Windows\System\bFowcBK.exe
  2⤵
  PID:1800
- C:\Windows\System\aMwikhu.exe
  C:\Windows\System\aMwikhu.exe
  2⤵
  PID:2320
- C:\Windows\System\KSjPvmZ.exe
  C:\Windows\System\KSjPvmZ.exe
  2⤵
  PID:812
- C:\Windows\System\LYdvECx.exe
  C:\Windows\System\LYdvECx.exe
  2⤵
  PID:2176
- C:\Windows\System\iyYtVDi.exe
  C:\Windows\System\iyYtVDi.exe
  2⤵
  PID:868
- C:\Windows\System\Abtuwld.exe
  C:\Windows\System\Abtuwld.exe
  2⤵
  PID:680
- C:\Windows\System\LTKFlUP.exe
  C:\Windows\System\LTKFlUP.exe
  2⤵
  PID:852
- C:\Windows\System\oJVfzbd.exe
  C:\Windows\System\oJVfzbd.exe
  2⤵
  PID:440
- C:\Windows\System\uekavJG.exe
  C:\Windows\System\uekavJG.exe
  2⤵
  PID:2672
- C:\Windows\System\jasiXsu.exe
  C:\Windows\System\jasiXsu.exe
  2⤵
  PID:1724
- C:\Windows\System\uiaiRFC.exe
  C:\Windows\System\uiaiRFC.exe
  2⤵
  PID:572
- C:\Windows\System\SpwLsQt.exe
  C:\Windows\System\SpwLsQt.exe
  2⤵
  PID:1280
- C:\Windows\System\cMOjmAK.exe
  C:\Windows\System\cMOjmAK.exe
  2⤵
  PID:940
- C:\Windows\System\YelYjMu.exe
  C:\Windows\System\YelYjMu.exe
  2⤵
  PID:2084
- C:\Windows\System\RzeNBGp.exe
  C:\Windows\System\RzeNBGp.exe
  2⤵
  PID:1232
- C:\Windows\System\FIOmhDi.exe
  C:\Windows\System\FIOmhDi.exe
  2⤵
  PID:924
- C:\Windows\System\wnaEwuJ.exe
  C:\Windows\System\wnaEwuJ.exe
  2⤵
  PID:2120
- C:\Windows\System\HCsPukF.exe
  C:\Windows\System\HCsPukF.exe
  2⤵
  PID:1484
- C:\Windows\System\bbAvytf.exe
  C:\Windows\System\bbAvytf.exe
  2⤵
  PID:2500
- C:\Windows\System\SMfNzOD.exe
  C:\Windows\System\SMfNzOD.exe
  2⤵
  PID:2384
- C:\Windows\System\ZBhmxWR.exe
  C:\Windows\System\ZBhmxWR.exe
  2⤵
  PID:2160
- C:\Windows\System\UwQZGiT.exe
  C:\Windows\System\UwQZGiT.exe
  2⤵
  PID:840
- C:\Windows\System\dyFaKzr.exe
  C:\Windows\System\dyFaKzr.exe
  2⤵
  PID:2464
- C:\Windows\System\qVpufqi.exe
  C:\Windows\System\qVpufqi.exe
  2⤵
  PID:704
- C:\Windows\System\siHWFJJ.exe
  C:\Windows\System\siHWFJJ.exe
  2⤵
  PID:1608
- C:\Windows\System\ZNPdMkz.exe
  C:\Windows\System\ZNPdMkz.exe
  2⤵
  PID:1112
- C:\Windows\System\WzhkipG.exe
  C:\Windows\System\WzhkipG.exe
  2⤵
  PID:2012
- C:\Windows\System\NsHWRhV.exe
  C:\Windows\System\NsHWRhV.exe
  2⤵
  PID:1684
- C:\Windows\System\PAaNtyG.exe
  C:\Windows\System\PAaNtyG.exe
  2⤵
  PID:2000
- C:\Windows\System\cTAwgPB.exe
  C:\Windows\System\cTAwgPB.exe
  2⤵
  PID:2196
- C:\Windows\System\kyqitOn.exe
  C:\Windows\System\kyqitOn.exe
  2⤵
  PID:1472
- C:\Windows\System\ezZvaaW.exe
  C:\Windows\System\ezZvaaW.exe
  2⤵
  PID:1768
- C:\Windows\System\IXLjMAu.exe
  C:\Windows\System\IXLjMAu.exe
  2⤵
  PID:2460
- C:\Windows\System\KqwGZgi.exe
  C:\Windows\System\KqwGZgi.exe
  2⤵
  PID:2788
- C:\Windows\System\eCarcmw.exe
  C:\Windows\System\eCarcmw.exe
  2⤵
  PID:2228
- C:\Windows\System\bPjWTam.exe
  C:\Windows\System\bPjWTam.exe
  2⤵
  PID:1028
- C:\Windows\System\DJpzPEz.exe
  C:\Windows\System\DJpzPEz.exe
  2⤵
  PID:3076
- C:\Windows\System\aqAXnaj.exe
  C:\Windows\System\aqAXnaj.exe
  2⤵
  PID:3096
- C:\Windows\System\KeXHNPm.exe
  C:\Windows\System\KeXHNPm.exe
  2⤵
  PID:3112
- C:\Windows\System\WEHLfyy.exe
  C:\Windows\System\WEHLfyy.exe
  2⤵
  PID:3136
- C:\Windows\System\GTUQgHF.exe
  C:\Windows\System\GTUQgHF.exe
  2⤵
  PID:3168
- C:\Windows\System\inzJDfW.exe
  C:\Windows\System\inzJDfW.exe
  2⤵
  PID:3224
- C:\Windows\System\aygwNIY.exe
  C:\Windows\System\aygwNIY.exe
  2⤵
  PID:3244
- C:\Windows\System\IXcqqPS.exe
  C:\Windows\System\IXcqqPS.exe
  2⤵
  PID:3264
- C:\Windows\System\jNVHNvO.exe
  C:\Windows\System\jNVHNvO.exe
  2⤵
  PID:3296
- C:\Windows\System\ksKsmDC.exe
  C:\Windows\System\ksKsmDC.exe
  2⤵
  PID:3316
- C:\Windows\System\aUFtTNI.exe
  C:\Windows\System\aUFtTNI.exe
  2⤵
  PID:3368
- C:\Windows\System\mJihGxV.exe
  C:\Windows\System\mJihGxV.exe
  2⤵
  PID:3388
- C:\Windows\System\ycQavOC.exe
  C:\Windows\System\ycQavOC.exe
  2⤵
  PID:3472
- C:\Windows\System\fFbZYne.exe
  C:\Windows\System\fFbZYne.exe
  2⤵
  PID:3488
- C:\Windows\System\pHZwTiE.exe
  C:\Windows\System\pHZwTiE.exe
  2⤵
  PID:3504
- C:\Windows\System\StPJXBB.exe
  C:\Windows\System\StPJXBB.exe
  2⤵
  PID:3524
- C:\Windows\System\RyZYsKB.exe
  C:\Windows\System\RyZYsKB.exe
  2⤵
  PID:3560
- C:\Windows\System\DItjsIO.exe
  C:\Windows\System\DItjsIO.exe
  2⤵
  PID:3584
- C:\Windows\System\HcTBqyK.exe
  C:\Windows\System\HcTBqyK.exe
  2⤵
  PID:3600
- C:\Windows\System\CtitCOp.exe
  C:\Windows\System\CtitCOp.exe
  2⤵
  PID:3620
- C:\Windows\System\nQFwOin.exe
  C:\Windows\System\nQFwOin.exe
  2⤵
  PID:3644
- C:\Windows\System\ueKJHMe.exe
  C:\Windows\System\ueKJHMe.exe
  2⤵
  PID:3660
- C:\Windows\System\umPhLBb.exe
  C:\Windows\System\umPhLBb.exe
  2⤵
  PID:3676
- C:\Windows\System\gcykBKQ.exe
  C:\Windows\System\gcykBKQ.exe
  2⤵
  PID:3696
- C:\Windows\System\ywaRZJm.exe
  C:\Windows\System\ywaRZJm.exe
  2⤵
  PID:3716
- C:\Windows\System\RgLgOSa.exe
  C:\Windows\System\RgLgOSa.exe
  2⤵
  PID:3732
- C:\Windows\System\Lketjqm.exe
  C:\Windows\System\Lketjqm.exe
  2⤵
  PID:3752
- C:\Windows\System\IDKgJfV.exe
  C:\Windows\System\IDKgJfV.exe
  2⤵
  PID:3772
- C:\Windows\System\vuFJKzy.exe
  C:\Windows\System\vuFJKzy.exe
  2⤵
  PID:3788
- C:\Windows\System\xYDKOTb.exe
  C:\Windows\System\xYDKOTb.exe
  2⤵
  PID:3808
- C:\Windows\System\ZftjnDC.exe
  C:\Windows\System\ZftjnDC.exe
  2⤵
  PID:3824
- C:\Windows\System\MUGPeZP.exe
  C:\Windows\System\MUGPeZP.exe
  2⤵
  PID:3844
- C:\Windows\System\PctksmP.exe
  C:\Windows\System\PctksmP.exe
  2⤵
  PID:3876
- C:\Windows\System\yjCWGRS.exe
  C:\Windows\System\yjCWGRS.exe
  2⤵
  PID:3900
- C:\Windows\System\VuRDUMU.exe
  C:\Windows\System\VuRDUMU.exe
  2⤵
  PID:3924
- C:\Windows\System\SGOAaNg.exe
  C:\Windows\System\SGOAaNg.exe
  2⤵
  PID:3944
- C:\Windows\System\RxcDTkB.exe
  C:\Windows\System\RxcDTkB.exe
  2⤵
  PID:3960
- C:\Windows\System\nXFifWb.exe
  C:\Windows\System\nXFifWb.exe
  2⤵
  PID:3976
- C:\Windows\System\cImMmPH.exe
  C:\Windows\System\cImMmPH.exe
  2⤵
  PID:3992
- C:\Windows\System\pbbEJqF.exe
  C:\Windows\System\pbbEJqF.exe
  2⤵
  PID:4012
- C:\Windows\System\rTWgQwa.exe
  C:\Windows\System\rTWgQwa.exe
  2⤵
  PID:4040
- C:\Windows\System\BfWWldG.exe
  C:\Windows\System\BfWWldG.exe
  2⤵
  PID:4056
- C:\Windows\System\PBQJExF.exe
  C:\Windows\System\PBQJExF.exe
  2⤵
  PID:4076
- C:\Windows\System\NYwpARl.exe
  C:\Windows\System\NYwpARl.exe
  2⤵
  PID:984
- C:\Windows\System\oySZIlj.exe
  C:\Windows\System\oySZIlj.exe
  2⤵
  PID:2760
- C:\Windows\System\UGmZopW.exe
  C:\Windows\System\UGmZopW.exe
  2⤵
  PID:1652
- C:\Windows\System\tOthEVi.exe
  C:\Windows\System\tOthEVi.exe
  2⤵
  PID:2508
- C:\Windows\System\lYjwKaG.exe
  C:\Windows\System\lYjwKaG.exe
  2⤵
  PID:1944
- C:\Windows\System\bkrYTrq.exe
  C:\Windows\System\bkrYTrq.exe
  2⤵
  PID:3160
- C:\Windows\System\YKwmBwp.exe
  C:\Windows\System\YKwmBwp.exe
  2⤵
  PID:2332
- C:\Windows\System\fnLMHmL.exe
  C:\Windows\System\fnLMHmL.exe
  2⤵
  PID:3236
- C:\Windows\System\RgdRayi.exe
  C:\Windows\System\RgdRayi.exe
  2⤵
  PID:2824
- C:\Windows\System\IaktrLH.exe
  C:\Windows\System\IaktrLH.exe
  2⤵
  PID:2304
- C:\Windows\System\mMkKkNg.exe
  C:\Windows\System\mMkKkNg.exe
  2⤵
  PID:3280
- C:\Windows\System\rXTvfds.exe
  C:\Windows\System\rXTvfds.exe
  2⤵
  PID:3328
- C:\Windows\System\jfSYYda.exe
  C:\Windows\System\jfSYYda.exe
  2⤵
  PID:3348
- C:\Windows\System\MkVzrQz.exe
  C:\Windows\System\MkVzrQz.exe
  2⤵
  PID:3332
- C:\Windows\System\RFGfaVJ.exe
  C:\Windows\System\RFGfaVJ.exe
  2⤵
  PID:3124
- C:\Windows\System\XEfmBat.exe
  C:\Windows\System\XEfmBat.exe
  2⤵
  PID:3176
- C:\Windows\System\qzLMHbT.exe
  C:\Windows\System\qzLMHbT.exe
  2⤵
  PID:3196
- C:\Windows\System\JdNmpXE.exe
  C:\Windows\System\JdNmpXE.exe
  2⤵
  PID:3216
- C:\Windows\System\DHVltzC.exe
  C:\Windows\System\DHVltzC.exe
  2⤵
  PID:3260
- C:\Windows\System\xrIVJoG.exe
  C:\Windows\System\xrIVJoG.exe
  2⤵
  PID:108
- C:\Windows\System\DRUeahk.exe
  C:\Windows\System\DRUeahk.exe
  2⤵
  PID:3384
- C:\Windows\System\kzCAAFe.exe
  C:\Windows\System\kzCAAFe.exe
  2⤵
  PID:3432
- C:\Windows\System\qIUPAwH.exe
  C:\Windows\System\qIUPAwH.exe
  2⤵
  PID:3448
- C:\Windows\System\BBrgCJy.exe
  C:\Windows\System\BBrgCJy.exe
  2⤵
  PID:3460
- C:\Windows\System\OifileN.exe
  C:\Windows\System\OifileN.exe
  2⤵
  PID:3540
- C:\Windows\System\sQUyQCk.exe
  C:\Windows\System\sQUyQCk.exe
  2⤵
  PID:3552
- C:\Windows\System\ivkynaM.exe
  C:\Windows\System\ivkynaM.exe
  2⤵
  PID:3484
- C:\Windows\System\CtbLdNR.exe
  C:\Windows\System\CtbLdNR.exe
  2⤵
  PID:1400
- C:\Windows\System\AiAaBmY.exe
  C:\Windows\System\AiAaBmY.exe
  2⤵
  PID:1780
- C:\Windows\System\gFIoOWq.exe
  C:\Windows\System\gFIoOWq.exe
  2⤵
  PID:1264
- C:\Windows\System\gIslFGk.exe
  C:\Windows\System\gIslFGk.exe
  2⤵
  PID:288
- C:\Windows\System\CoPuvEN.exe
  C:\Windows\System\CoPuvEN.exe
  2⤵
  PID:2732
- C:\Windows\System\vWtDywS.exe
  C:\Windows\System\vWtDywS.exe
  2⤵
  PID:1620
- C:\Windows\System\XjlyRjP.exe
  C:\Windows\System\XjlyRjP.exe
  2⤵
  PID:3580
- C:\Windows\System\BJmXAee.exe
  C:\Windows\System\BJmXAee.exe
  2⤵
  PID:3004
- C:\Windows\System\HLzYWbc.exe
  C:\Windows\System\HLzYWbc.exe
  2⤵
  PID:1712
- C:\Windows\System\wULlzJd.exe
  C:\Windows\System\wULlzJd.exe
  2⤵
  PID:3668
- C:\Windows\System\nlEiYHH.exe
  C:\Windows\System\nlEiYHH.exe
  2⤵
  PID:3656
- C:\Windows\System\SMDkZND.exe
  C:\Windows\System\SMDkZND.exe
  2⤵
  PID:3684
- C:\Windows\System\VxnjxiJ.exe
  C:\Windows\System\VxnjxiJ.exe
  2⤵
  PID:3740
- C:\Windows\System\otwYYpJ.exe
  C:\Windows\System\otwYYpJ.exe
  2⤵
  PID:3748
- C:\Windows\System\aoZxBEO.exe
  C:\Windows\System\aoZxBEO.exe
  2⤵
  PID:3804
- C:\Windows\System\CkHUGhU.exe
  C:\Windows\System\CkHUGhU.exe
  2⤵
  PID:3864
- C:\Windows\System\dzsZgYJ.exe
  C:\Windows\System\dzsZgYJ.exe
  2⤵
  PID:3764
- C:\Windows\System\joGBvPk.exe
  C:\Windows\System\joGBvPk.exe
  2⤵
  PID:3884
- C:\Windows\System\VbrXvWq.exe
  C:\Windows\System\VbrXvWq.exe
  2⤵
  PID:3912
- C:\Windows\System\GeSlMpw.exe
  C:\Windows\System\GeSlMpw.exe
  2⤵
  PID:3956
- C:\Windows\System\xpiqvbY.exe
  C:\Windows\System\xpiqvbY.exe
  2⤵
  PID:3972
- C:\Windows\System\kbMnTdn.exe
  C:\Windows\System\kbMnTdn.exe
  2⤵
  PID:4036
- C:\Windows\System\qtEUlXM.exe
  C:\Windows\System\qtEUlXM.exe
  2⤵
  PID:4052
- C:\Windows\System\XyWIoXB.exe
  C:\Windows\System\XyWIoXB.exe
  2⤵
  PID:4092
- C:\Windows\System\cLcHeJC.exe
  C:\Windows\System\cLcHeJC.exe
  2⤵
  PID:1528
- C:\Windows\System\DSaRZMG.exe
  C:\Windows\System\DSaRZMG.exe
  2⤵
  PID:2680
- C:\Windows\System\AufPKzU.exe
  C:\Windows\System\AufPKzU.exe
  2⤵
  PID:528
- C:\Windows\System\FzEevfe.exe
  C:\Windows\System\FzEevfe.exe
  2⤵
  PID:3164
- C:\Windows\System\pLLTnlo.exe
  C:\Windows\System\pLLTnlo.exe
  2⤵
  PID:3232
- C:\Windows\System\IHlzzhe.exe
  C:\Windows\System\IHlzzhe.exe
  2⤵
  PID:3576
- C:\Windows\System\jhcfzyR.exe
  C:\Windows\System\jhcfzyR.exe
  2⤵
  PID:3292
- C:\Windows\System\OqFtXcK.exe
  C:\Windows\System\OqFtXcK.exe
  2⤵
  PID:3364
- C:\Windows\System\nIbrWDo.exe
  C:\Windows\System\nIbrWDo.exe
  2⤵
  PID:3120
- C:\Windows\System\mqloPfN.exe
  C:\Windows\System\mqloPfN.exe
  2⤵
  PID:3092
- C:\Windows\System\NhvtMhV.exe
  C:\Windows\System\NhvtMhV.exe
  2⤵
  PID:3312
- C:\Windows\System\RkVxNAu.exe
  C:\Windows\System\RkVxNAu.exe
  2⤵
  PID:3380
- C:\Windows\System\uZZwbVf.exe
  C:\Windows\System\uZZwbVf.exe
  2⤵
  PID:3436
- C:\Windows\System\qlMZVII.exe
  C:\Windows\System\qlMZVII.exe
  2⤵
  PID:1868
- C:\Windows\System\eOxBJLW.exe
  C:\Windows\System\eOxBJLW.exe
  2⤵
  PID:2628
- C:\Windows\System\fzOSqdk.exe
  C:\Windows\System\fzOSqdk.exe
  2⤵
  PID:764
- C:\Windows\System\fxjMcnv.exe
  C:\Windows\System\fxjMcnv.exe
  2⤵
  PID:2572
- C:\Windows\System\fumSmme.exe
  C:\Windows\System\fumSmme.exe
  2⤵
  PID:2056
- C:\Windows\System\mPnAwyy.exe
  C:\Windows\System\mPnAwyy.exe
  2⤵
  PID:3516
- C:\Windows\System\VjoTagy.exe
  C:\Windows\System\VjoTagy.exe
  2⤵
  PID:2432
- C:\Windows\System\uFxpkQg.exe
  C:\Windows\System\uFxpkQg.exe
  2⤵
  PID:3612
- C:\Windows\System\JSWlowh.exe
  C:\Windows\System\JSWlowh.exe
  2⤵
  PID:3672
- C:\Windows\System\iZYvGwO.exe
  C:\Windows\System\iZYvGwO.exe
  2⤵
  PID:3692
- C:\Windows\System\NOtvLSK.exe
  C:\Windows\System\NOtvLSK.exe
  2⤵
  PID:3836
- C:\Windows\System\wZivXTS.exe
  C:\Windows\System\wZivXTS.exe
  2⤵
  PID:3916
- C:\Windows\System\gQsYQYt.exe
  C:\Windows\System\gQsYQYt.exe
  2⤵
  PID:3820
- C:\Windows\System\QsMFoAS.exe
  C:\Windows\System\QsMFoAS.exe
  2⤵
  PID:3988
- C:\Windows\System\XCSeZmN.exe
  C:\Windows\System\XCSeZmN.exe
  2⤵
  PID:3936
- C:\Windows\System\ZUXxZrv.exe
  C:\Windows\System\ZUXxZrv.exe
  2⤵
  PID:4068
- C:\Windows\System\qGWiBiP.exe
  C:\Windows\System\qGWiBiP.exe
  2⤵
  PID:2112
- C:\Windows\System\BJOFChU.exe
  C:\Windows\System\BJOFChU.exe
  2⤵
  PID:2740
- C:\Windows\System\pWCKRlm.exe
  C:\Windows\System\pWCKRlm.exe
  2⤵
  PID:3272
- C:\Windows\System\UvosFbM.exe
  C:\Windows\System\UvosFbM.exe
  2⤵
  PID:2096
- C:\Windows\System\JmnyQss.exe
  C:\Windows\System\JmnyQss.exe
  2⤵
  PID:3360
- C:\Windows\System\tlthaTE.exe
  C:\Windows\System\tlthaTE.exe
  2⤵
  PID:3192
- C:\Windows\System\OVUrDsb.exe
  C:\Windows\System\OVUrDsb.exe
  2⤵
  PID:3556
- C:\Windows\System\SbvYLrU.exe
  C:\Windows\System\SbvYLrU.exe
  2⤵
  PID:2212
- C:\Windows\System\ylkEREz.exe
  C:\Windows\System\ylkEREz.exe
  2⤵
  PID:1756
- C:\Windows\System\JPHQQkh.exe
  C:\Windows\System\JPHQQkh.exe
  2⤵
  PID:3592
- C:\Windows\System\olvTMnD.exe
  C:\Windows\System\olvTMnD.exe
  2⤵
  PID:3856
- C:\Windows\System\rHCekoF.exe
  C:\Windows\System\rHCekoF.exe
  2⤵
  PID:3800
- C:\Windows\System\WOYFZVz.exe
  C:\Windows\System\WOYFZVz.exe
  2⤵
  PID:3852
- C:\Windows\System\EZIWhGA.exe
  C:\Windows\System\EZIWhGA.exe
  2⤵
  PID:3968
- C:\Windows\System\JVQuuJB.exe
  C:\Windows\System\JVQuuJB.exe
  2⤵
  PID:4064
- C:\Windows\System\VjvjKzf.exe
  C:\Windows\System\VjvjKzf.exe
  2⤵
  PID:584
- C:\Windows\System\MmlBwQe.exe
  C:\Windows\System\MmlBwQe.exe
  2⤵
  PID:3156
- C:\Windows\System\yoWRQXZ.exe
  C:\Windows\System\yoWRQXZ.exe
  2⤵
  PID:3256
- C:\Windows\System\dbADIUH.exe
  C:\Windows\System\dbADIUH.exe
  2⤵
  PID:3308
- C:\Windows\System\lVqhvOD.exe
  C:\Windows\System\lVqhvOD.exe
  2⤵
  PID:1200
- C:\Windows\System\hhRgOVS.exe
  C:\Windows\System\hhRgOVS.exe
  2⤵
  PID:2272
- C:\Windows\System\KDEPSrV.exe
  C:\Windows\System\KDEPSrV.exe
  2⤵
  PID:3628
- C:\Windows\System\QTCOJAs.exe
  C:\Windows\System\QTCOJAs.exe
  2⤵
  PID:4024
- C:\Windows\System\GkSHsmF.exe
  C:\Windows\System\GkSHsmF.exe
  2⤵
  PID:2708
- C:\Windows\System\WiHsNCY.exe
  C:\Windows\System\WiHsNCY.exe
  2⤵
  PID:3896
- C:\Windows\System\QttsYpC.exe
  C:\Windows\System\QttsYpC.exe
  2⤵
  PID:3468
- C:\Windows\System\UIbmBpK.exe
  C:\Windows\System\UIbmBpK.exe
  2⤵
  PID:1252
- C:\Windows\System\cYCJWNm.exe
  C:\Windows\System\cYCJWNm.exe
  2⤵
  PID:4020
- C:\Windows\System\xGWshgm.exe
  C:\Windows\System\xGWshgm.exe
  2⤵
  PID:4028
- C:\Windows\System\zwRaeBZ.exe
  C:\Windows\System\zwRaeBZ.exe
  2⤵
  PID:1444
- C:\Windows\System\ULrawuh.exe
  C:\Windows\System\ULrawuh.exe
  2⤵
  PID:4072
- C:\Windows\System\ujVOMXX.exe
  C:\Windows\System\ujVOMXX.exe
  2⤵
  PID:2676
- C:\Windows\System\sqfMWsZ.exe
  C:\Windows\System\sqfMWsZ.exe
  2⤵
  PID:1648
- C:\Windows\System\GJzVYYS.exe
  C:\Windows\System\GJzVYYS.exe
  2⤵
  PID:2348
- C:\Windows\System\qagVSQp.exe
  C:\Windows\System\qagVSQp.exe
  2⤵
  PID:3636
- C:\Windows\System\IPoMGtw.exe
  C:\Windows\System\IPoMGtw.exe
  2⤵
  PID:2308
- C:\Windows\System\ZBKFrPa.exe
  C:\Windows\System\ZBKFrPa.exe
  2⤵
  PID:3400
- C:\Windows\System\yzGDZWT.exe
  C:\Windows\System\yzGDZWT.exe
  2⤵
  PID:4100
- C:\Windows\System\PanCtiG.exe
  C:\Windows\System\PanCtiG.exe
  2⤵
  PID:4116
- C:\Windows\System\kZLuyAs.exe
  C:\Windows\System\kZLuyAs.exe
  2⤵
  PID:4136
- C:\Windows\System\GnNOWWQ.exe
  C:\Windows\System\GnNOWWQ.exe
  2⤵
  PID:4152
- C:\Windows\System\LnGJSki.exe
  C:\Windows\System\LnGJSki.exe
  2⤵
  PID:4180
- C:\Windows\System\XfkzEal.exe
  C:\Windows\System\XfkzEal.exe
  2⤵
  PID:4200
- C:\Windows\System\qVpKvgk.exe
  C:\Windows\System\qVpKvgk.exe
  2⤵
  PID:4216
- C:\Windows\System\pzeKNMH.exe
  C:\Windows\System\pzeKNMH.exe
  2⤵
  PID:4240
- C:\Windows\System\YOKPmhb.exe
  C:\Windows\System\YOKPmhb.exe
  2⤵
  PID:4272
- C:\Windows\System\WYhZbtx.exe
  C:\Windows\System\WYhZbtx.exe
  2⤵
  PID:4296
- C:\Windows\System\PiZOzER.exe
  C:\Windows\System\PiZOzER.exe
  2⤵
  PID:4312
- C:\Windows\System\jxNdgVV.exe
  C:\Windows\System\jxNdgVV.exe
  2⤵
  PID:4332
- C:\Windows\System\OAwjiOD.exe
  C:\Windows\System\OAwjiOD.exe
  2⤵
  PID:4356
- C:\Windows\System\ISWZUas.exe
  C:\Windows\System\ISWZUas.exe
  2⤵
  PID:4380
- C:\Windows\System\qIGPevs.exe
  C:\Windows\System\qIGPevs.exe
  2⤵
  PID:4396
- C:\Windows\System\LNUiRyE.exe
  C:\Windows\System\LNUiRyE.exe
  2⤵
  PID:4416
- C:\Windows\System\MNrQwWZ.exe
  C:\Windows\System\MNrQwWZ.exe
  2⤵
  PID:4432
- C:\Windows\System\tUWtBRC.exe
  C:\Windows\System\tUWtBRC.exe
  2⤵
  PID:4452
- C:\Windows\System\EYZwthf.exe
  C:\Windows\System\EYZwthf.exe
  2⤵
  PID:4468
- C:\Windows\System\KoUtcPg.exe
  C:\Windows\System\KoUtcPg.exe
  2⤵
  PID:4500
- C:\Windows\System\fdfLRJO.exe
  C:\Windows\System\fdfLRJO.exe
  2⤵
  PID:4520
- C:\Windows\System\bVtiqPp.exe
  C:\Windows\System\bVtiqPp.exe
  2⤵
  PID:4540
- C:\Windows\System\psTLhPH.exe
  C:\Windows\System\psTLhPH.exe
  2⤵
  PID:4560
- C:\Windows\System\iGlHovR.exe
  C:\Windows\System\iGlHovR.exe
  2⤵
  PID:4576
- C:\Windows\System\JQtEmGR.exe
  C:\Windows\System\JQtEmGR.exe
  2⤵
  PID:4592
- C:\Windows\System\lfXZuks.exe
  C:\Windows\System\lfXZuks.exe
  2⤵
  PID:4612
- C:\Windows\System\daBtOHH.exe
  C:\Windows\System\daBtOHH.exe
  2⤵
  PID:4628
- C:\Windows\System\OJipOGi.exe
  C:\Windows\System\OJipOGi.exe
  2⤵
  PID:4648
- C:\Windows\System\eyCpXTF.exe
  C:\Windows\System\eyCpXTF.exe
  2⤵
  PID:4664
- C:\Windows\System\WKFLVzw.exe
  C:\Windows\System\WKFLVzw.exe
  2⤵
  PID:4684
- C:\Windows\System\bqBrKYo.exe
  C:\Windows\System\bqBrKYo.exe
  2⤵
  PID:4720
- C:\Windows\System\pfiYjuV.exe
  C:\Windows\System\pfiYjuV.exe
  2⤵
  PID:4736
- C:\Windows\System\LCMAvWl.exe
  C:\Windows\System\LCMAvWl.exe
  2⤵
  PID:4760
- C:\Windows\System\jemcJya.exe
  C:\Windows\System\jemcJya.exe
  2⤵
  PID:4776
- C:\Windows\System\meZyoZj.exe
  C:\Windows\System\meZyoZj.exe
  2⤵
  PID:4796
- C:\Windows\System\qXWkXAs.exe
  C:\Windows\System\qXWkXAs.exe
  2⤵
  PID:4816
- C:\Windows\System\ocdMbaC.exe
  C:\Windows\System\ocdMbaC.exe
  2⤵
  PID:4836
- C:\Windows\System\foitspY.exe
  C:\Windows\System\foitspY.exe
  2⤵
  PID:4856
- C:\Windows\System\cSbtwkl.exe
  C:\Windows\System\cSbtwkl.exe
  2⤵
  PID:4876
- C:\Windows\System\zsfrlAU.exe
  C:\Windows\System\zsfrlAU.exe
  2⤵
  PID:4892
- C:\Windows\System\xUVUCYq.exe
  C:\Windows\System\xUVUCYq.exe
  2⤵
  PID:4908
- C:\Windows\System\qJcElrm.exe
  C:\Windows\System\qJcElrm.exe
  2⤵
  PID:4928
- C:\Windows\System\dbvxqGe.exe
  C:\Windows\System\dbvxqGe.exe
  2⤵
  PID:4944
- C:\Windows\System\MFWHJqh.exe
  C:\Windows\System\MFWHJqh.exe
  2⤵
  PID:4964
- C:\Windows\System\niebHDk.exe
  C:\Windows\System\niebHDk.exe
  2⤵
  PID:4980
- C:\Windows\System\wLNSMiF.exe
  C:\Windows\System\wLNSMiF.exe
  2⤵
  PID:5004
- C:\Windows\System\MAqmuWB.exe
  C:\Windows\System\MAqmuWB.exe
  2⤵
  PID:5020
- C:\Windows\System\kLzCShY.exe
  C:\Windows\System\kLzCShY.exe
  2⤵
  PID:5040
- C:\Windows\System\EZNaiDC.exe
  C:\Windows\System\EZNaiDC.exe
  2⤵
  PID:5060
- C:\Windows\System\vSmQHAg.exe
  C:\Windows\System\vSmQHAg.exe
  2⤵
  PID:5076
- C:\Windows\System\ZRcZwyu.exe
  C:\Windows\System\ZRcZwyu.exe
  2⤵
  PID:5104
- C:\Windows\System\UCMoQwF.exe
  C:\Windows\System\UCMoQwF.exe
  2⤵
  PID:2444
- C:\Windows\System\XwHJGSX.exe
  C:\Windows\System\XwHJGSX.exe
  2⤵
  PID:4164
- C:\Windows\System\QiSCBWy.exe
  C:\Windows\System\QiSCBWy.exe
  2⤵
  PID:4208
- C:\Windows\System\fUxaXDf.exe
  C:\Windows\System\fUxaXDf.exe
  2⤵
  PID:3688
- C:\Windows\System\pVVzHlw.exe
  C:\Windows\System\pVVzHlw.exe
  2⤵
  PID:4148
- C:\Windows\System\myFNMtz.exe
  C:\Windows\System\myFNMtz.exe
  2⤵
  PID:4224
- C:\Windows\System\WwUsrBh.exe
  C:\Windows\System\WwUsrBh.exe
  2⤵
  PID:4352
- C:\Windows\System\RoncAec.exe
  C:\Windows\System\RoncAec.exe
  2⤵
  PID:4328
- C:\Windows\System\YYsNANO.exe
  C:\Windows\System\YYsNANO.exe
  2⤵
  PID:2656
- C:\Windows\System\ZLVlHwt.exe
  C:\Windows\System\ZLVlHwt.exe
  2⤵
  PID:4460
- C:\Windows\System\EHhEYUN.exe
  C:\Windows\System\EHhEYUN.exe
  2⤵
  PID:4440
- C:\Windows\System\LyNylzK.exe
  C:\Windows\System\LyNylzK.exe
  2⤵
  PID:4492
- C:\Windows\System\wmEFORg.exe
  C:\Windows\System\wmEFORg.exe
  2⤵
  PID:4512
- C:\Windows\System\bsfnTiN.exe
  C:\Windows\System\bsfnTiN.exe
  2⤵
  PID:4536
- C:\Windows\System\CIIYuao.exe
  C:\Windows\System\CIIYuao.exe
  2⤵
  PID:4568
- C:\Windows\System\kRTHJsl.exe
  C:\Windows\System\kRTHJsl.exe
  2⤵
  PID:4660
- C:\Windows\System\wvSqPoY.exe
  C:\Windows\System\wvSqPoY.exe
  2⤵
  PID:4604
- C:\Windows\System\dejveit.exe
  C:\Windows\System\dejveit.exe
  2⤵
  PID:4708
- C:\Windows\System\xlabQDS.exe
  C:\Windows\System\xlabQDS.exe
  2⤵
  PID:4712
- C:\Windows\System\hxYWrPj.exe
  C:\Windows\System\hxYWrPj.exe
  2⤵
  PID:4752
- C:\Windows\System\PiHjfJO.exe
  C:\Windows\System\PiHjfJO.exe
  2⤵
  PID:4784
- C:\Windows\System\rMaJGZY.exe
  C:\Windows\System\rMaJGZY.exe
  2⤵
  PID:4812
- C:\Windows\System\TkNxHnL.exe
  C:\Windows\System\TkNxHnL.exe
  2⤵
  PID:4844
- C:\Windows\System\LJExPah.exe
  C:\Windows\System\LJExPah.exe
  2⤵
  PID:4904
- C:\Windows\System\kQDbRAy.exe
  C:\Windows\System\kQDbRAy.exe
  2⤵
  PID:4852
- C:\Windows\System\kbVYYYc.exe
  C:\Windows\System\kbVYYYc.exe
  2⤵
  PID:5056
- C:\Windows\System\DbhACqJ.exe
  C:\Windows\System\DbhACqJ.exe
  2⤵
  PID:5088
- C:\Windows\System\QCLHiEf.exe
  C:\Windows\System\QCLHiEf.exe
  2⤵
  PID:4952
- C:\Windows\System\YTtlZtf.exe
  C:\Windows\System\YTtlZtf.exe
  2⤵
  PID:3424
- C:\Windows\System\yvRtJAz.exe
  C:\Windows\System\yvRtJAz.exe
  2⤵
  PID:4884
- C:\Windows\System\CRQfOcZ.exe
  C:\Windows\System\CRQfOcZ.exe
  2⤵
  PID:4252
- C:\Windows\System\RKlyDzW.exe
  C:\Windows\System\RKlyDzW.exe
  2⤵
  PID:5028
- C:\Windows\System\WWXGaEJ.exe
  C:\Windows\System\WWXGaEJ.exe
  2⤵
  PID:5068
- C:\Windows\System\hbZKIKc.exe
  C:\Windows\System\hbZKIKc.exe
  2⤵
  PID:4236
- C:\Windows\System\GRQHiHt.exe
  C:\Windows\System\GRQHiHt.exe
  2⤵
  PID:4308
- C:\Windows\System\mCQQVQG.exe
  C:\Windows\System\mCQQVQG.exe
  2⤵
  PID:4348
- C:\Windows\System\XGRcwNa.exe
  C:\Windows\System\XGRcwNa.exe
  2⤵
  PID:4368
- C:\Windows\System\iLfsLVX.exe
  C:\Windows\System\iLfsLVX.exe
  2⤵
  PID:4428
- C:\Windows\System\nUJWufK.exe
  C:\Windows\System\nUJWufK.exe
  2⤵
  PID:4444
- C:\Windows\System\jpHdriM.exe
  C:\Windows\System\jpHdriM.exe
  2⤵
  PID:4484
- C:\Windows\System\iYXQlUx.exe
  C:\Windows\System\iYXQlUx.exe
  2⤵
  PID:4584
- C:\Windows\System\ydCxxtD.exe
  C:\Windows\System\ydCxxtD.exe
  2⤵
  PID:4680
- C:\Windows\System\NUQZhdj.exe
  C:\Windows\System\NUQZhdj.exe
  2⤵
  PID:4700
- C:\Windows\System\Laqjmrz.exe
  C:\Windows\System\Laqjmrz.exe
  2⤵
  PID:4732
- C:\Windows\System\EPUwFtz.exe
  C:\Windows\System\EPUwFtz.exe
  2⤵
  PID:4768
- C:\Windows\System\szNCSjt.exe
  C:\Windows\System\szNCSjt.exe
  2⤵
  PID:4828
- C:\Windows\System\sitSxOM.exe
  C:\Windows\System\sitSxOM.exe
  2⤵
  PID:4848
- C:\Windows\System\bmLGBOX.exe
  C:\Windows\System\bmLGBOX.exe
  2⤵
  PID:5048
- C:\Windows\System\DYigPyc.exe
  C:\Windows\System\DYigPyc.exe
  2⤵
  PID:5096
- C:\Windows\System\RqGiTQh.exe
  C:\Windows\System\RqGiTQh.exe
  2⤵
  PID:4132
- C:\Windows\System\FpnvYCB.exe
  C:\Windows\System\FpnvYCB.exe
  2⤵
  PID:4924
- C:\Windows\System\iDYeDxX.exe
  C:\Windows\System\iDYeDxX.exe
  2⤵
  PID:4260
- C:\Windows\System\tMdfpHF.exe
  C:\Windows\System\tMdfpHF.exe
  2⤵
  PID:4340
- C:\Windows\System\ukDWugy.exe
  C:\Windows\System\ukDWugy.exe
  2⤵
  PID:4232
- C:\Windows\System\SFJDmNx.exe
  C:\Windows\System\SFJDmNx.exe
  2⤵
  PID:4508
- C:\Windows\System\EEyKpxG.exe
  C:\Windows\System\EEyKpxG.exe
  2⤵
  PID:4624
- C:\Windows\System\ORxLfBD.exe
  C:\Windows\System\ORxLfBD.exe
  2⤵
  PID:4744
- C:\Windows\System\aGtnvXs.exe
  C:\Windows\System\aGtnvXs.exe
  2⤵
  PID:4288
- C:\Windows\System\EEhrIEc.exe
  C:\Windows\System\EEhrIEc.exe
  2⤵
  PID:5036
- C:\Windows\System\qmjlvxq.exe
  C:\Windows\System\qmjlvxq.exe
  2⤵
  PID:5000
- C:\Windows\System\tvnaeED.exe
  C:\Windows\System\tvnaeED.exe
  2⤵
  PID:4608
- C:\Windows\System\fPHdoOt.exe
  C:\Windows\System\fPHdoOt.exe
  2⤵
  PID:5084
- C:\Windows\System\mMkjsuP.exe
  C:\Windows\System\mMkjsuP.exe
  2⤵
  PID:5136
- C:\Windows\System\CrpjjBM.exe
  C:\Windows\System\CrpjjBM.exe
  2⤵
  PID:5156
- C:\Windows\System\GpyqRMG.exe
  C:\Windows\System\GpyqRMG.exe
  2⤵
  PID:5172
- C:\Windows\System\JJhZluV.exe
  C:\Windows\System\JJhZluV.exe
  2⤵
  PID:5188
- C:\Windows\System\zBRJcOi.exe
  C:\Windows\System\zBRJcOi.exe
  2⤵
  PID:5204
- C:\Windows\System\eQRHjjq.exe
  C:\Windows\System\eQRHjjq.exe
  2⤵
  PID:5220
- C:\Windows\System\eSmnlVY.exe
  C:\Windows\System\eSmnlVY.exe
  2⤵
  PID:5236
- C:\Windows\System\hbRVEvt.exe
  C:\Windows\System\hbRVEvt.exe
  2⤵
  PID:5300
- C:\Windows\System\wZHjQVN.exe
  C:\Windows\System\wZHjQVN.exe
  2⤵
  PID:5320
- C:\Windows\System\XyJBBud.exe
  C:\Windows\System\XyJBBud.exe
  2⤵
  PID:5336
- C:\Windows\System\oXSSIES.exe
  C:\Windows\System\oXSSIES.exe
  2⤵
  PID:5364
- C:\Windows\System\drZInsy.exe
  C:\Windows\System\drZInsy.exe
  2⤵
  PID:5380
- C:\Windows\System\ABBeLLf.exe
  C:\Windows\System\ABBeLLf.exe
  2⤵
  PID:5400
- C:\Windows\System\uxEoNfr.exe
  C:\Windows\System\uxEoNfr.exe
  2⤵
  PID:5416
- C:\Windows\System\BUSyVzK.exe
  C:\Windows\System\BUSyVzK.exe
  2⤵
  PID:5432
- C:\Windows\System\RBEhbAz.exe
  C:\Windows\System\RBEhbAz.exe
  2⤵
  PID:5452
- C:\Windows\System\BvpahJK.exe
  C:\Windows\System\BvpahJK.exe
  2⤵
  PID:5480
- C:\Windows\System\ziDXVLT.exe
  C:\Windows\System\ziDXVLT.exe
  2⤵
  PID:5504
- C:\Windows\System\CLMWHFg.exe
  C:\Windows\System\CLMWHFg.exe
  2⤵
  PID:5524
- C:\Windows\System\hDoaKUI.exe
  C:\Windows\System\hDoaKUI.exe
  2⤵
  PID:5540
- C:\Windows\System\qIjlJEU.exe
  C:\Windows\System\qIjlJEU.exe
  2⤵
  PID:5556
- C:\Windows\System\FFQDcDR.exe
  C:\Windows\System\FFQDcDR.exe
  2⤵
  PID:5588
- C:\Windows\System\qCHmdly.exe
  C:\Windows\System\qCHmdly.exe
  2⤵
  PID:5604
- C:\Windows\System\eEaEkMQ.exe
  C:\Windows\System\eEaEkMQ.exe
  2⤵
  PID:5628
- C:\Windows\System\gbDZxro.exe
  C:\Windows\System\gbDZxro.exe
  2⤵
  PID:5644
- C:\Windows\System\ZhTsuNW.exe
  C:\Windows\System\ZhTsuNW.exe
  2⤵
  PID:5668
- C:\Windows\System\pjlktkO.exe
  C:\Windows\System\pjlktkO.exe
  2⤵
  PID:5684
- C:\Windows\System\kIibNJH.exe
  C:\Windows\System\kIibNJH.exe
  2⤵
  PID:5708
- C:\Windows\System\ZBfQpZj.exe
  C:\Windows\System\ZBfQpZj.exe
  2⤵
  PID:5724
- C:\Windows\System\LAZjkva.exe
  C:\Windows\System\LAZjkva.exe
  2⤵
  PID:5748
- C:\Windows\System\YVhnpEe.exe
  C:\Windows\System\YVhnpEe.exe
  2⤵
  PID:5764
- C:\Windows\System\tdfaorM.exe
  C:\Windows\System\tdfaorM.exe
  2⤵
  PID:5788
- C:\Windows\System\SJwuZlc.exe
  C:\Windows\System\SJwuZlc.exe
  2⤵
  PID:5804
- C:\Windows\System\LgcHosL.exe
  C:\Windows\System\LgcHosL.exe
  2⤵
  PID:5820
- C:\Windows\System\enYEZjB.exe
  C:\Windows\System\enYEZjB.exe
  2⤵
  PID:5836
- C:\Windows\System\yKDLfab.exe
  C:\Windows\System\yKDLfab.exe
  2⤵
  PID:5856
- C:\Windows\System\HracZDW.exe
  C:\Windows\System\HracZDW.exe
  2⤵
  PID:5880
- C:\Windows\System\ArbivXd.exe
  C:\Windows\System\ArbivXd.exe
  2⤵
  PID:5908
- C:\Windows\System\yERQEzF.exe
  C:\Windows\System\yERQEzF.exe
  2⤵
  PID:5924
- C:\Windows\System\PWKkuaM.exe
  C:\Windows\System\PWKkuaM.exe
  2⤵
  PID:5940
- C:\Windows\System\JpgjUYb.exe
  C:\Windows\System\JpgjUYb.exe
  2⤵
  PID:5964
- C:\Windows\System\HiQDzVy.exe
  C:\Windows\System\HiQDzVy.exe
  2⤵
  PID:5992
- C:\Windows\System\qaRoyQW.exe
  C:\Windows\System\qaRoyQW.exe
  2⤵
  PID:6012
- C:\Windows\System\jJwPufa.exe
  C:\Windows\System\jJwPufa.exe
  2⤵
  PID:6028
- C:\Windows\System\KkurJXf.exe
  C:\Windows\System\KkurJXf.exe
  2⤵
  PID:6052
- C:\Windows\System\CMdsHjy.exe
  C:\Windows\System\CMdsHjy.exe
  2⤵
  PID:6072
- C:\Windows\System\okhLIWq.exe
  C:\Windows\System\okhLIWq.exe
  2⤵
  PID:6088
- C:\Windows\System\KDjeTic.exe
  C:\Windows\System\KDjeTic.exe
  2⤵
  PID:6104
- C:\Windows\System\YSVUinZ.exe
  C:\Windows\System\YSVUinZ.exe
  2⤵
  PID:6128
- C:\Windows\System\PJvajDv.exe
  C:\Windows\System\PJvajDv.exe
  2⤵
  PID:4960
- C:\Windows\System\LGvYeNX.exe
  C:\Windows\System\LGvYeNX.exe
  2⤵
  PID:5144
- C:\Windows\System\BhSTTRJ.exe
  C:\Windows\System\BhSTTRJ.exe
  2⤵
  PID:4404
- C:\Windows\System\RnsrVuM.exe
  C:\Windows\System\RnsrVuM.exe
  2⤵
  PID:4488
- C:\Windows\System\bZnWMIN.exe
  C:\Windows\System\bZnWMIN.exe
  2⤵
  PID:5252
- C:\Windows\System\hlnuxNP.exe
  C:\Windows\System\hlnuxNP.exe
  2⤵
  PID:5212
- C:\Windows\System\TCDOntu.exe
  C:\Windows\System\TCDOntu.exe
  2⤵
  PID:5272
- C:\Windows\System\EYkSpeQ.exe
  C:\Windows\System\EYkSpeQ.exe
  2⤵
  PID:5284
- C:\Windows\System\hQQyNTQ.exe
  C:\Windows\System\hQQyNTQ.exe
  2⤵
  PID:5132
- C:\Windows\System\bkIfLWN.exe
  C:\Windows\System\bkIfLWN.exe
  2⤵
  PID:5296
- C:\Windows\System\bsUpqeq.exe
  C:\Windows\System\bsUpqeq.exe
  2⤵
  PID:4344
- C:\Windows\System\aDVTAVF.exe
  C:\Windows\System\aDVTAVF.exe
  2⤵
  PID:3456
- C:\Windows\System\BoxXmMj.exe
  C:\Windows\System\BoxXmMj.exe
  2⤵
  PID:5332
- C:\Windows\System\DVbhaec.exe
  C:\Windows\System\DVbhaec.exe
  2⤵
  PID:5316
- C:\Windows\System\xZGdpio.exe
  C:\Windows\System\xZGdpio.exe
  2⤵
  PID:5308
- C:\Windows\System\IqWyGiM.exe
  C:\Windows\System\IqWyGiM.exe
  2⤵
  PID:5412
- C:\Windows\System\CSSrrYv.exe
  C:\Windows\System\CSSrrYv.exe
  2⤵
  PID:5396
- C:\Windows\System\lUNgExa.exe
  C:\Windows\System\lUNgExa.exe
  2⤵
  PID:5496
- C:\Windows\System\dfmktqU.exe
  C:\Windows\System\dfmktqU.exe
  2⤵
  PID:5568
- C:\Windows\System\jiurclI.exe
  C:\Windows\System\jiurclI.exe
  2⤵
  PID:5464
- C:\Windows\System\qLypUdQ.exe
  C:\Windows\System\qLypUdQ.exe
  2⤵
  PID:5520
- C:\Windows\System\ecbXPBF.exe
  C:\Windows\System\ecbXPBF.exe
  2⤵
  PID:5596
- C:\Windows\System\YLDWenp.exe
  C:\Windows\System\YLDWenp.exe
  2⤵
  PID:5652
- C:\Windows\System\yxeiXHD.exe
  C:\Windows\System\yxeiXHD.exe
  2⤵
  PID:5656
- C:\Windows\System\SxewixE.exe
  C:\Windows\System\SxewixE.exe
  2⤵
  PID:5676
- C:\Windows\System\wtgcClN.exe
  C:\Windows\System\wtgcClN.exe
  2⤵
  PID:5716
- C:\Windows\System\owhdejf.exe
  C:\Windows\System\owhdejf.exe
  2⤵
  PID:5740
- C:\Windows\System\aWdfhrB.exe
  C:\Windows\System\aWdfhrB.exe
  2⤵
  PID:5772
- C:\Windows\System\WIXPQgP.exe
  C:\Windows\System\WIXPQgP.exe
  2⤵
  PID:5816
- C:\Windows\System\xguzclG.exe
  C:\Windows\System\xguzclG.exe
  2⤵
  PID:5828
- C:\Windows\System\jBjyJEY.exe
  C:\Windows\System\jBjyJEY.exe
  2⤵
  PID:5868
- C:\Windows\System\HJcYuJr.exe
  C:\Windows\System\HJcYuJr.exe
  2⤵
  PID:5948
- C:\Windows\System\AlxOgWn.exe
  C:\Windows\System\AlxOgWn.exe
  2⤵
  PID:5988
- C:\Windows\System\tSTrUWP.exe
  C:\Windows\System\tSTrUWP.exe
  2⤵
  PID:6008
- C:\Windows\System\zBUhDRJ.exe
  C:\Windows\System\zBUhDRJ.exe
  2⤵
  PID:6040
- C:\Windows\System\ZuDiFRr.exe
  C:\Windows\System\ZuDiFRr.exe
  2⤵
  PID:6068
- C:\Windows\System\wkOEUtH.exe
  C:\Windows\System\wkOEUtH.exe
  2⤵
  PID:6100
- C:\Windows\System\LcNQnxf.exe
  C:\Windows\System\LcNQnxf.exe
  2⤵
  PID:4940
- C:\Windows\System\BpEAVQo.exe
  C:\Windows\System\BpEAVQo.exe
  2⤵
  PID:6124
- C:\Windows\System\JfGDKEh.exe
  C:\Windows\System\JfGDKEh.exe
  2⤵
  PID:4600
- C:\Windows\System\gfgZaXU.exe
  C:\Windows\System\gfgZaXU.exe
  2⤵
  PID:5012
- C:\Windows\System\SyujeSp.exe
  C:\Windows\System\SyujeSp.exe
  2⤵
  PID:5256
- C:\Windows\System\eqOdGLX.exe
  C:\Windows\System\eqOdGLX.exe
  2⤵
  PID:5280
- C:\Windows\System\sRkMvYW.exe
  C:\Windows\System\sRkMvYW.exe
  2⤵
  PID:5168
- C:\Windows\System\BygQlMc.exe
  C:\Windows\System\BygQlMc.exe
  2⤵
  PID:5352
- C:\Windows\System\yGxTlbf.exe
  C:\Windows\System\yGxTlbf.exe
  2⤵
  PID:5408
- C:\Windows\System\gCjcaUh.exe
  C:\Windows\System\gCjcaUh.exe
  2⤵
  PID:5388
- C:\Windows\System\LpJyWzV.exe
  C:\Windows\System\LpJyWzV.exe
  2⤵
  PID:5392
- C:\Windows\System\nBaaOMV.exe
  C:\Windows\System\nBaaOMV.exe
  2⤵
  PID:5472
- C:\Windows\System\XwxiwjB.exe
  C:\Windows\System\XwxiwjB.exe
  2⤵
  PID:5552
- C:\Windows\System\BDfUGua.exe
  C:\Windows\System\BDfUGua.exe
  2⤵
  PID:5616
- C:\Windows\System\HPrLNql.exe
  C:\Windows\System\HPrLNql.exe
  2⤵
  PID:5680
- C:\Windows\System\NNaZEQL.exe
  C:\Windows\System\NNaZEQL.exe
  2⤵
  PID:5692
- C:\Windows\System\brLHsdk.exe
  C:\Windows\System\brLHsdk.exe
  2⤵
  PID:5784
- C:\Windows\System\sQWVjQs.exe
  C:\Windows\System\sQWVjQs.exe
  2⤵
  PID:5900
- C:\Windows\System\jFpgYfj.exe
  C:\Windows\System\jFpgYfj.exe
  2⤵
  PID:5972
- C:\Windows\System\qoBIwUm.exe
  C:\Windows\System\qoBIwUm.exe
  2⤵
  PID:5984
- C:\Windows\System\mvUQdFf.exe
  C:\Windows\System\mvUQdFf.exe
  2⤵
  PID:4972
- C:\Windows\System\nPivjYu.exe
  C:\Windows\System\nPivjYu.exe
  2⤵
  PID:4656
- C:\Windows\System\ZVGjaEt.exe
  C:\Windows\System\ZVGjaEt.exe
  2⤵
  PID:6048
- C:\Windows\System\WfRNrRw.exe
  C:\Windows\System\WfRNrRw.exe
  2⤵
  PID:4556
- C:\Windows\System\vvlFLYK.exe
  C:\Windows\System\vvlFLYK.exe
  2⤵
  PID:5292
- C:\Windows\System\ArKOmWC.exe
  C:\Windows\System\ArKOmWC.exe
  2⤵
  PID:5228
- C:\Windows\System\JSOPWyK.exe
  C:\Windows\System\JSOPWyK.exe
  2⤵
  PID:4188
- C:\Windows\System\pgfkdfm.exe
  C:\Windows\System\pgfkdfm.exe
  2⤵
  PID:5360
- C:\Windows\System\bnQiKWq.exe
  C:\Windows\System\bnQiKWq.exe
  2⤵
  PID:5428
- C:\Windows\System\eLhzkOy.exe
  C:\Windows\System\eLhzkOy.exe
  2⤵
  PID:5636
- C:\Windows\System\rMcVOLX.exe
  C:\Windows\System\rMcVOLX.exe
  2⤵
  PID:5852
- C:\Windows\System\AqLcuJW.exe
  C:\Windows\System\AqLcuJW.exe
  2⤵
  PID:5704
- C:\Windows\System\EvHTyef.exe
  C:\Windows\System\EvHTyef.exe
  2⤵
  PID:6004
- C:\Windows\System\cRXqSUF.exe
  C:\Windows\System\cRXqSUF.exe
  2⤵
  PID:6116
- C:\Windows\System\VXnxjAW.exe
  C:\Windows\System\VXnxjAW.exe
  2⤵
  PID:5920
- C:\Windows\System\wcJRxge.exe
  C:\Windows\System\wcJRxge.exe
  2⤵
  PID:5936
- C:\Windows\System\AKtPyVV.exe
  C:\Windows\System\AKtPyVV.exe
  2⤵
  PID:4160
- C:\Windows\System\GPdXuVw.exe
  C:\Windows\System\GPdXuVw.exe
  2⤵
  PID:5548
- C:\Windows\System\rAYSRuW.exe
  C:\Windows\System\rAYSRuW.exe
  2⤵
  PID:5492
- C:\Windows\System\spYrgmS.exe
  C:\Windows\System\spYrgmS.exe
  2⤵
  PID:5448
- C:\Windows\System\NcuuKBd.exe
  C:\Windows\System\NcuuKBd.exe
  2⤵
  PID:5896
- C:\Windows\System\oCbRrgC.exe
  C:\Windows\System\oCbRrgC.exe
  2⤵
  PID:6140
- C:\Windows\System\ncVuSfu.exe
  C:\Windows\System\ncVuSfu.exe
  2⤵
  PID:5184
- C:\Windows\System\TURhWeX.exe
  C:\Windows\System\TURhWeX.exe
  2⤵
  PID:5488
- C:\Windows\System\Hrlaxgx.exe
  C:\Windows\System\Hrlaxgx.exe
  2⤵
  PID:284
- C:\Windows\System\PXaKsOp.exe
  C:\Windows\System\PXaKsOp.exe
  2⤵
  PID:5164
- C:\Windows\System\uVTbEMv.exe
  C:\Windows\System\uVTbEMv.exe
  2⤵
  PID:5904
- C:\Windows\System\hHYoHUK.exe
  C:\Windows\System\hHYoHUK.exe
  2⤵
  PID:6164
- C:\Windows\System\BhopJYy.exe
  C:\Windows\System\BhopJYy.exe
  2⤵
  PID:6180
- C:\Windows\System\zAdjOsV.exe
  C:\Windows\System\zAdjOsV.exe
  2⤵
  PID:6204
- C:\Windows\System\spfOcXt.exe
  C:\Windows\System\spfOcXt.exe
  2⤵
  PID:6220
- C:\Windows\System\LDhfjPo.exe
  C:\Windows\System\LDhfjPo.exe
  2⤵
  PID:6236
- C:\Windows\System\MOgzuLw.exe
  C:\Windows\System\MOgzuLw.exe
  2⤵
  PID:6256
- C:\Windows\System\NKRheOu.exe
  C:\Windows\System\NKRheOu.exe
  2⤵
  PID:6272
- C:\Windows\System\yITaQeJ.exe
  C:\Windows\System\yITaQeJ.exe
  2⤵
  PID:6288
- C:\Windows\System\amAnpnP.exe
  C:\Windows\System\amAnpnP.exe
  2⤵
  PID:6328
- C:\Windows\System\GFeuzuH.exe
  C:\Windows\System\GFeuzuH.exe
  2⤵
  PID:6344
- C:\Windows\System\xdCtFlM.exe
  C:\Windows\System\xdCtFlM.exe
  2⤵
  PID:6372
- C:\Windows\System\KukfQKC.exe
  C:\Windows\System\KukfQKC.exe
  2⤵
  PID:6392
- C:\Windows\System\naGjcMU.exe
  C:\Windows\System\naGjcMU.exe
  2⤵
  PID:6408
- C:\Windows\System\rUTJIqd.exe
  C:\Windows\System\rUTJIqd.exe
  2⤵
  PID:6428
- C:\Windows\System\IGaKPtC.exe
  C:\Windows\System\IGaKPtC.exe
  2⤵
  PID:6448
- C:\Windows\System\nVfWuRw.exe
  C:\Windows\System\nVfWuRw.exe
  2⤵
  PID:6472
- C:\Windows\System\sroqWZT.exe
  C:\Windows\System\sroqWZT.exe
  2⤵
  PID:6496
- C:\Windows\System\rzzBdEJ.exe
  C:\Windows\System\rzzBdEJ.exe
  2⤵
  PID:6512
- C:\Windows\System\IhTIIdi.exe
  C:\Windows\System\IhTIIdi.exe
  2⤵
  PID:6532
- C:\Windows\System\OBiZgbg.exe
  C:\Windows\System\OBiZgbg.exe
  2⤵
  PID:6552
- C:\Windows\System\CXxZOUf.exe
  C:\Windows\System\CXxZOUf.exe
  2⤵
  PID:6568
- C:\Windows\System\IhXNqKb.exe
  C:\Windows\System\IhXNqKb.exe
  2⤵
  PID:6588
- C:\Windows\System\zjdOcfo.exe
  C:\Windows\System\zjdOcfo.exe
  2⤵
  PID:6608
- C:\Windows\System\GKMuKfu.exe
  C:\Windows\System\GKMuKfu.exe
  2⤵
  PID:6624
- C:\Windows\System\UvzunWt.exe
  C:\Windows\System\UvzunWt.exe
  2⤵
  PID:6660
- C:\Windows\System\eQXWVNF.exe
  C:\Windows\System\eQXWVNF.exe
  2⤵
  PID:6676
- C:\Windows\System\nbkTJjV.exe
  C:\Windows\System\nbkTJjV.exe
  2⤵
  PID:6692
- C:\Windows\System\McXiyTy.exe
  C:\Windows\System\McXiyTy.exe
  2⤵
  PID:6708
- C:\Windows\System\GTTMwYo.exe
  C:\Windows\System\GTTMwYo.exe
  2⤵
  PID:6732
- C:\Windows\System\LhgMoNI.exe
  C:\Windows\System\LhgMoNI.exe
  2⤵
  PID:6752
- C:\Windows\System\mazmZuf.exe
  C:\Windows\System\mazmZuf.exe
  2⤵
  PID:6776
- C:\Windows\System\FIvkRVA.exe
  C:\Windows\System\FIvkRVA.exe
  2⤵
  PID:6792
- C:\Windows\System\fhrsmiJ.exe
  C:\Windows\System\fhrsmiJ.exe
  2⤵
  PID:6816
- C:\Windows\System\GEJEdnc.exe
  C:\Windows\System\GEJEdnc.exe
  2⤵
  PID:6832
- C:\Windows\System\ZeAyaQn.exe
  C:\Windows\System\ZeAyaQn.exe
  2⤵
  PID:6848
- C:\Windows\System\RUKyizq.exe
  C:\Windows\System\RUKyizq.exe
  2⤵
  PID:6864
- C:\Windows\System\yYYARKW.exe
  C:\Windows\System\yYYARKW.exe
  2⤵
  PID:6880
- C:\Windows\System\rRBlGcX.exe
  C:\Windows\System\rRBlGcX.exe
  2⤵
  PID:6908
- C:\Windows\System\JGiPZhD.exe
  C:\Windows\System\JGiPZhD.exe
  2⤵
  PID:6936
- C:\Windows\System\SECZaAr.exe
  C:\Windows\System\SECZaAr.exe
  2⤵
  PID:6952
- C:\Windows\System\ipvPhho.exe
  C:\Windows\System\ipvPhho.exe
  2⤵
  PID:6968
- C:\Windows\System\fnBeTNU.exe
  C:\Windows\System\fnBeTNU.exe
  2⤵
  PID:6984
- C:\Windows\System\ljTnnEs.exe
  C:\Windows\System\ljTnnEs.exe
  2⤵
  PID:7004
- C:\Windows\System\GJBuQWd.exe
  C:\Windows\System\GJBuQWd.exe
  2⤵
  PID:7024
- C:\Windows\System\Vuqsbjx.exe
  C:\Windows\System\Vuqsbjx.exe
  2⤵
  PID:7044
- C:\Windows\System\kzzMBMH.exe
  C:\Windows\System\kzzMBMH.exe
  2⤵
  PID:7080
- C:\Windows\System\heHFoKs.exe
  C:\Windows\System\heHFoKs.exe
  2⤵
  PID:7096
- C:\Windows\System\oRLCzTo.exe
  C:\Windows\System\oRLCzTo.exe
  2⤵
  PID:7112
- C:\Windows\System\aHEOfEG.exe
  C:\Windows\System\aHEOfEG.exe
  2⤵
  PID:7132
- C:\Windows\System\dojrmbk.exe
  C:\Windows\System\dojrmbk.exe
  2⤵
  PID:7152
- C:\Windows\System\FvpWMIv.exe
  C:\Windows\System\FvpWMIv.exe
  2⤵
  PID:4532
- C:\Windows\System\aSgOqIj.exe
  C:\Windows\System\aSgOqIj.exe
  2⤵
  PID:4320
- C:\Windows\System\JrRmpGS.exe
  C:\Windows\System\JrRmpGS.exe
  2⤵
  PID:5476
- C:\Windows\System\hpjBTBZ.exe
  C:\Windows\System\hpjBTBZ.exe
  2⤵
  PID:6156
- C:\Windows\System\MAyXpoA.exe
  C:\Windows\System\MAyXpoA.exe
  2⤵
  PID:6192
- C:\Windows\System\OSFHFjx.exe
  C:\Windows\System\OSFHFjx.exe
  2⤵
  PID:6228
- C:\Windows\System\SORTzZx.exe
  C:\Windows\System\SORTzZx.exe
  2⤵
  PID:6308
- C:\Windows\System\kJMiKjE.exe
  C:\Windows\System\kJMiKjE.exe
  2⤵
  PID:6324
- C:\Windows\System\DyYigDg.exe
  C:\Windows\System\DyYigDg.exe
  2⤵
  PID:6248
- C:\Windows\System\iBqvJlC.exe
  C:\Windows\System\iBqvJlC.exe
  2⤵
  PID:6352
- C:\Windows\System\XHkDesR.exe
  C:\Windows\System\XHkDesR.exe
  2⤵
  PID:6364
- C:\Windows\System\iKipclY.exe
  C:\Windows\System\iKipclY.exe
  2⤵
  PID:6388
- C:\Windows\System\bUNunJy.exe
  C:\Windows\System\bUNunJy.exe
  2⤵
  PID:6424
- C:\Windows\System\jBHyAvj.exe
  C:\Windows\System\jBHyAvj.exe
  2⤵
  PID:6488
- C:\Windows\System\dNPTNNL.exe
  C:\Windows\System\dNPTNNL.exe
  2⤵
  PID:6524
- C:\Windows\System\havaccC.exe
  C:\Windows\System\havaccC.exe
  2⤵
  PID:6600
- C:\Windows\System\uzJYcrI.exe
  C:\Windows\System\uzJYcrI.exe
  2⤵
  PID:6604
- C:\Windows\System\eoBuHwK.exe
  C:\Windows\System\eoBuHwK.exe
  2⤵
  PID:6640
- C:\Windows\System\nWQjkZk.exe
  C:\Windows\System\nWQjkZk.exe
  2⤵
  PID:6644
- C:\Windows\System\tnleMul.exe
  C:\Windows\System\tnleMul.exe
  2⤵
  PID:6672
- C:\Windows\System\gPzExEe.exe
  C:\Windows\System\gPzExEe.exe
  2⤵
  PID:6760
- C:\Windows\System\FIIsaIS.exe
  C:\Windows\System\FIIsaIS.exe
  2⤵
  PID:6740
- C:\Windows\System\ukqbEbp.exe
  C:\Windows\System\ukqbEbp.exe
  2⤵
  PID:6784
- C:\Windows\System\OVJUunZ.exe
  C:\Windows\System\OVJUunZ.exe
  2⤵
  PID:6808
- C:\Windows\System\KlTQHEH.exe
  C:\Windows\System\KlTQHEH.exe
  2⤵
  PID:6856
- C:\Windows\System\lUtDyhF.exe
  C:\Windows\System\lUtDyhF.exe
  2⤵
  PID:6928
- C:\Windows\System\MsPfkmR.exe
  C:\Windows\System\MsPfkmR.exe
  2⤵
  PID:6904
- C:\Windows\System\CrkLmvq.exe
  C:\Windows\System\CrkLmvq.exe
  2⤵
  PID:7000
- C:\Windows\System\OIMKbJJ.exe
  C:\Windows\System\OIMKbJJ.exe
  2⤵
  PID:6976
- C:\Windows\System\iReNfkN.exe
  C:\Windows\System\iReNfkN.exe
  2⤵
  PID:7016
- C:\Windows\System\HGQsqmL.exe
  C:\Windows\System\HGQsqmL.exe
  2⤵
  PID:7072
- C:\Windows\System\ZUkVQjw.exe
  C:\Windows\System\ZUkVQjw.exe
  2⤵
  PID:7140
- C:\Windows\System\DVQdoBI.exe
  C:\Windows\System\DVQdoBI.exe
  2⤵
  PID:6152
- C:\Windows\System\UkkLNAT.exe
  C:\Windows\System\UkkLNAT.exe
  2⤵
  PID:6196
- C:\Windows\System\GYYsmtX.exe
  C:\Windows\System\GYYsmtX.exe
  2⤵
  PID:6176
- C:\Windows\System\dbtporg.exe
  C:\Windows\System\dbtporg.exe
  2⤵
  PID:7160
- C:\Windows\System\yQnRCkS.exe
  C:\Windows\System\yQnRCkS.exe
  2⤵
  PID:6148
- C:\Windows\System\qFDukiL.exe
  C:\Windows\System\qFDukiL.exe
  2⤵
  PID:6336
- C:\Windows\System\rUtUcOJ.exe
  C:\Windows\System\rUtUcOJ.exe
  2⤵
  PID:6296
- C:\Windows\System\pXVzJzJ.exe
  C:\Windows\System\pXVzJzJ.exe
  2⤵
  PID:6280
- C:\Windows\System\ucGODrj.exe
  C:\Windows\System\ucGODrj.exe
  2⤵
  PID:6420
- C:\Windows\System\tHevYtJ.exe
  C:\Windows\System\tHevYtJ.exe
  2⤵
  PID:6436
- C:\Windows\System\GjcJiII.exe
  C:\Windows\System\GjcJiII.exe
  2⤵
  PID:6576
- C:\Windows\System\cZrUipF.exe
  C:\Windows\System\cZrUipF.exe
  2⤵
  PID:6540
- C:\Windows\System\RypMFpl.exe
  C:\Windows\System\RypMFpl.exe
  2⤵
  PID:6596
- C:\Windows\System\AjLkdYh.exe
  C:\Windows\System\AjLkdYh.exe
  2⤵
  PID:6584
- C:\Windows\System\kGBnjBB.exe
  C:\Windows\System\kGBnjBB.exe
  2⤵
  PID:6728
- C:\Windows\System\gXGEhwq.exe
  C:\Windows\System\gXGEhwq.exe
  2⤵
  PID:6916
- C:\Windows\System\mgOBniu.exe
  C:\Windows\System\mgOBniu.exe
  2⤵
  PID:6840
- C:\Windows\System\gAhpqJU.exe
  C:\Windows\System\gAhpqJU.exe
  2⤵
  PID:6748
- C:\Windows\System\JayyCgz.exe
  C:\Windows\System\JayyCgz.exe
  2⤵
  PID:7032
- C:\Windows\System\LGyftZG.exe
  C:\Windows\System\LGyftZG.exe
  2⤵
  PID:7036
- C:\Windows\System\tkytXBe.exe
  C:\Windows\System\tkytXBe.exe
  2⤵
  PID:7060
- C:\Windows\System\ysBXHlH.exe
  C:\Windows\System\ysBXHlH.exe
  2⤵
  PID:7092
- C:\Windows\System\yzBapSQ.exe
  C:\Windows\System\yzBapSQ.exe
  2⤵
  PID:7144
- C:\Windows\System\CxbhqdC.exe
  C:\Windows\System\CxbhqdC.exe
  2⤵
  PID:7148
- C:\Windows\System\orYMWsI.exe
  C:\Windows\System\orYMWsI.exe
  2⤵
  PID:5780
- C:\Windows\System\sEYyYkQ.exe
  C:\Windows\System\sEYyYkQ.exe
  2⤵
  PID:6188
- C:\Windows\System\vJsTEjd.exe
  C:\Windows\System\vJsTEjd.exe
  2⤵
  PID:6360
- C:\Windows\System\JPXCSIU.exe
  C:\Windows\System\JPXCSIU.exe
  2⤵
  PID:6700
- C:\Windows\System\vDBCNaw.exe
  C:\Windows\System\vDBCNaw.exe
  2⤵
  PID:6724
- C:\Windows\System\OlySwuS.exe
  C:\Windows\System\OlySwuS.exe
  2⤵
  PID:6896
- C:\Windows\System\sfvZGgZ.exe
  C:\Windows\System\sfvZGgZ.exe
  2⤵
  PID:6900
- C:\Windows\System\cqZCDMm.exe
  C:\Windows\System\cqZCDMm.exe
  2⤵
  PID:6304
- C:\Windows\System\iAogIvg.exe
  C:\Windows\System\iAogIvg.exe
  2⤵
  PID:6960
- C:\Windows\System\fIWfwNn.exe
  C:\Windows\System\fIWfwNn.exe
  2⤵
  PID:5976
- C:\Windows\System\gPAmeHP.exe
  C:\Windows\System\gPAmeHP.exe
  2⤵
  PID:6656
- C:\Windows\System\XDCjufk.exe
  C:\Windows\System\XDCjufk.exe
  2⤵
  PID:6828
- C:\Windows\System\MzxFRGA.exe
  C:\Windows\System\MzxFRGA.exe
  2⤵
  PID:5848
- C:\Windows\System\TauzirF.exe
  C:\Windows\System\TauzirF.exe
  2⤵
  PID:6356
- C:\Windows\System\VrnbxFK.exe
  C:\Windows\System\VrnbxFK.exe
  2⤵
  PID:6264
- C:\Windows\System\JLuJWgg.exe
  C:\Windows\System\JLuJWgg.exe
  2⤵
  PID:7124
- C:\Windows\System\SrvLLwc.exe
  C:\Windows\System\SrvLLwc.exe
  2⤵
  PID:6504
- C:\Windows\System\umkMmuB.exe
  C:\Windows\System\umkMmuB.exe
  2⤵
  PID:5260
- C:\Windows\System\kzWKaKo.exe
  C:\Windows\System\kzWKaKo.exe
  2⤵
  PID:5756
- C:\Windows\System\pwcdxjN.exe
  C:\Windows\System\pwcdxjN.exe
  2⤵
  PID:6924
- C:\Windows\System\dTjcHUN.exe
  C:\Windows\System\dTjcHUN.exe
  2⤵
  PID:6520
- C:\Windows\System\mLGUsus.exe
  C:\Windows\System\mLGUsus.exe
  2⤵
  PID:6876
- C:\Windows\System\hworonr.exe
  C:\Windows\System\hworonr.exe
  2⤵
  PID:6668
- C:\Windows\System\LChpqui.exe
  C:\Windows\System\LChpqui.exe
  2⤵
  PID:7184
- C:\Windows\System\djGvAAG.exe
  C:\Windows\System\djGvAAG.exe
  2⤵
  PID:7204
- C:\Windows\System\NTozgbm.exe
  C:\Windows\System\NTozgbm.exe
  2⤵
  PID:7220
- C:\Windows\System\pyOXhjm.exe
  C:\Windows\System\pyOXhjm.exe
  2⤵
  PID:7236
- C:\Windows\System\FYjWJQO.exe
  C:\Windows\System\FYjWJQO.exe
  2⤵
  PID:7256
- C:\Windows\System\hlANFTj.exe
  C:\Windows\System\hlANFTj.exe
  2⤵
  PID:7280
- C:\Windows\System\BxdlVao.exe
  C:\Windows\System\BxdlVao.exe
  2⤵
  PID:7296
- C:\Windows\System\OxhXhdj.exe
  C:\Windows\System\OxhXhdj.exe
  2⤵
  PID:7324
- C:\Windows\System\kxLsVYw.exe
  C:\Windows\System\kxLsVYw.exe
  2⤵
  PID:7340
- C:\Windows\System\ZspUjBR.exe
  C:\Windows\System\ZspUjBR.exe
  2⤵
  PID:7364
- C:\Windows\System\NwrEVKP.exe
  C:\Windows\System\NwrEVKP.exe
  2⤵
  PID:7380
- C:\Windows\System\HMvJgXk.exe
  C:\Windows\System\HMvJgXk.exe
  2⤵
  PID:7396
- C:\Windows\System\ZhzuCqG.exe
  C:\Windows\System\ZhzuCqG.exe
  2⤵
  PID:7416
- C:\Windows\System\HPJUkRJ.exe
  C:\Windows\System\HPJUkRJ.exe
  2⤵
  PID:7444
- C:\Windows\System\nEbewcr.exe
  C:\Windows\System\nEbewcr.exe
  2⤵
  PID:7460
- C:\Windows\System\TUBIYtx.exe
  C:\Windows\System\TUBIYtx.exe
  2⤵
  PID:7480
- C:\Windows\System\tbtaCCU.exe
  C:\Windows\System\tbtaCCU.exe
  2⤵
  PID:7496
- C:\Windows\System\KEpHjSB.exe
  C:\Windows\System\KEpHjSB.exe
  2⤵
  PID:7512
- C:\Windows\System\pmKrYSh.exe
  C:\Windows\System\pmKrYSh.exe
  2⤵
  PID:7536
- C:\Windows\System\xrrFfGc.exe
  C:\Windows\System\xrrFfGc.exe
  2⤵
  PID:7552
- C:\Windows\System\fkgtQVo.exe
  C:\Windows\System\fkgtQVo.exe
  2⤵
  PID:7568
- C:\Windows\System\uowzHUG.exe
  C:\Windows\System\uowzHUG.exe
  2⤵
  PID:7592
- C:\Windows\System\YimFzAh.exe
  C:\Windows\System\YimFzAh.exe
  2⤵
  PID:7620
- C:\Windows\System\igfPanQ.exe
  C:\Windows\System\igfPanQ.exe
  2⤵
  PID:7636
- C:\Windows\System\JISHucF.exe
  C:\Windows\System\JISHucF.exe
  2⤵
  PID:7652
- C:\Windows\System\JwtSDdp.exe
  C:\Windows\System\JwtSDdp.exe
  2⤵
  PID:7680
- C:\Windows\System\TaXdbYc.exe
  C:\Windows\System\TaXdbYc.exe
  2⤵
  PID:7696
- C:\Windows\System\pcPwkkR.exe
  C:\Windows\System\pcPwkkR.exe
  2⤵
  PID:7724
- C:\Windows\System\ZpsMWKG.exe
  C:\Windows\System\ZpsMWKG.exe
  2⤵
  PID:7740
- C:\Windows\System\KkrgQIs.exe
  C:\Windows\System\KkrgQIs.exe
  2⤵
  PID:7756
- C:\Windows\System\iANHFar.exe
  C:\Windows\System\iANHFar.exe
  2⤵
  PID:7772
- C:\Windows\System\uyILebM.exe
  C:\Windows\System\uyILebM.exe
  2⤵
  PID:7800
- C:\Windows\System\zLajygd.exe
  C:\Windows\System\zLajygd.exe
  2⤵
  PID:7816
- C:\Windows\System\cpmLzpP.exe
  C:\Windows\System\cpmLzpP.exe
  2⤵
  PID:7836
- C:\Windows\System\SbkoUBa.exe
  C:\Windows\System\SbkoUBa.exe
  2⤵
  PID:7852
- C:\Windows\System\GhgrgCm.exe
  C:\Windows\System\GhgrgCm.exe
  2⤵
  PID:7884
- C:\Windows\System\saZRzXI.exe
  C:\Windows\System\saZRzXI.exe
  2⤵
  PID:7916
- C:\Windows\System\nvhNYRl.exe
  C:\Windows\System\nvhNYRl.exe
  2⤵
  PID:7936
- C:\Windows\System\fyUjMdD.exe
  C:\Windows\System\fyUjMdD.exe
  2⤵
  PID:7952
- C:\Windows\System\SIQBAFI.exe
  C:\Windows\System\SIQBAFI.exe
  2⤵
  PID:7968
- C:\Windows\System\DFRChSG.exe
  C:\Windows\System\DFRChSG.exe
  2⤵
  PID:7988
- C:\Windows\System\CaGSTZM.exe
  C:\Windows\System\CaGSTZM.exe
  2⤵
  PID:8008
- C:\Windows\System\VfpnXsd.exe
  C:\Windows\System\VfpnXsd.exe
  2⤵
  PID:8040
- C:\Windows\System\vKSJaOj.exe
  C:\Windows\System\vKSJaOj.exe
  2⤵
  PID:8056
- C:\Windows\System\aLEdtlg.exe
  C:\Windows\System\aLEdtlg.exe
  2⤵
  PID:8072
- C:\Windows\System\nNSGRig.exe
  C:\Windows\System\nNSGRig.exe
  2⤵
  PID:8088
- C:\Windows\System\GiTFxtB.exe
  C:\Windows\System\GiTFxtB.exe
  2⤵
  PID:8104
- C:\Windows\System\pnCYcqr.exe
  C:\Windows\System\pnCYcqr.exe
  2⤵
  PID:8120
- C:\Windows\System\FdDbbdN.exe
  C:\Windows\System\FdDbbdN.exe
  2⤵
  PID:8136
- C:\Windows\System\sJkmGWB.exe
  C:\Windows\System\sJkmGWB.exe
  2⤵
  PID:8152
- C:\Windows\System\RmZcMZj.exe
  C:\Windows\System\RmZcMZj.exe
  2⤵
  PID:8168
- C:\Windows\System\ZVikerg.exe
  C:\Windows\System\ZVikerg.exe
  2⤵
  PID:8184
- C:\Windows\System\BkWtLqi.exe
  C:\Windows\System\BkWtLqi.exe
  2⤵
  PID:6824
- C:\Windows\System\ZnIuNAi.exe
  C:\Windows\System\ZnIuNAi.exe
  2⤵
  PID:6764
- C:\Windows\System\qEmyXjK.exe
  C:\Windows\System\qEmyXjK.exe
  2⤵
  PID:6384
- C:\Windows\System\EzxFoHn.exe
  C:\Windows\System\EzxFoHn.exe
  2⤵
  PID:7232
- C:\Windows\System\tPKWrqp.exe
  C:\Windows\System\tPKWrqp.exe
  2⤵
  PID:7244
- C:\Windows\System\OPmawPL.exe
  C:\Windows\System\OPmawPL.exe
  2⤵
  PID:7312
- C:\Windows\System\pbXCNwn.exe
  C:\Windows\System\pbXCNwn.exe
  2⤵
  PID:7252
- C:\Windows\System\MZPFyrv.exe
  C:\Windows\System\MZPFyrv.exe
  2⤵
  PID:7308
- C:\Windows\System\YtkBZnK.exe
  C:\Windows\System\YtkBZnK.exe
  2⤵
  PID:7388
- C:\Windows\System\JEBGabQ.exe
  C:\Windows\System\JEBGabQ.exe
  2⤵
  PID:7408
- C:\Windows\System\fnYAUMT.exe
  C:\Windows\System\fnYAUMT.exe
  2⤵
  PID:7436
- C:\Windows\System\kOKMuQi.exe
  C:\Windows\System\kOKMuQi.exe
  2⤵
  PID:7456
- C:\Windows\System\kfPfBFX.exe
  C:\Windows\System\kfPfBFX.exe
  2⤵
  PID:7548
- C:\Windows\System\RKZGbar.exe
  C:\Windows\System\RKZGbar.exe
  2⤵
  PID:7564
- C:\Windows\System\PCphHsZ.exe
  C:\Windows\System\PCphHsZ.exe
  2⤵
  PID:7584
- C:\Windows\System\sorRqRS.exe
  C:\Windows\System\sorRqRS.exe
  2⤵
  PID:7632
- C:\Windows\System\SUfnLbp.exe
  C:\Windows\System\SUfnLbp.exe
  2⤵
  PID:7672
- C:\Windows\System\UxRlBMV.exe
  C:\Windows\System\UxRlBMV.exe
  2⤵
  PID:7616
- C:\Windows\System\MAJIoYU.exe
  C:\Windows\System\MAJIoYU.exe
  2⤵
  PID:7704
- C:\Windows\System\OHxtkRP.exe
  C:\Windows\System\OHxtkRP.exe
  2⤵
  PID:7808
- C:\Windows\System\EwsDVAc.exe
  C:\Windows\System\EwsDVAc.exe
  2⤵
  PID:7832
- C:\Windows\System\fDEgaje.exe
  C:\Windows\System\fDEgaje.exe
  2⤵
  PID:7872
- C:\Windows\System\ElOZqoZ.exe
  C:\Windows\System\ElOZqoZ.exe
  2⤵
  PID:7896
- C:\Windows\System\QehykME.exe
  C:\Windows\System\QehykME.exe
  2⤵
  PID:7948
- C:\Windows\System\ECvVwqN.exe
  C:\Windows\System\ECvVwqN.exe
  2⤵
  PID:8016
- C:\Windows\System\SMShQRK.exe
  C:\Windows\System\SMShQRK.exe
  2⤵
  PID:8032
- C:\Windows\System\vDsStHD.exe
  C:\Windows\System\vDsStHD.exe
  2⤵
  PID:8064
- C:\Windows\System\ruTLxif.exe
  C:\Windows\System\ruTLxif.exe
  2⤵
  PID:8132
- C:\Windows\System\rQczFQi.exe
  C:\Windows\System\rQczFQi.exe
  2⤵
  PID:8112
- C:\Windows\System\mHDdoMI.exe
  C:\Windows\System\mHDdoMI.exe
  2⤵
  PID:6652
- C:\Windows\System\nzqnIGS.exe
  C:\Windows\System\nzqnIGS.exe
  2⤵
  PID:7196
- C:\Windows\System\tQtILiP.exe
  C:\Windows\System\tQtILiP.exe
  2⤵
  PID:7276
- C:\Windows\System\oyteKSA.exe
  C:\Windows\System\oyteKSA.exe
  2⤵
  PID:7272
- C:\Windows\System\pZNotsK.exe
  C:\Windows\System\pZNotsK.exe
  2⤵
  PID:7404
- C:\Windows\System\EcjjuFp.exe
  C:\Windows\System\EcjjuFp.exe
  2⤵
  PID:7360
- C:\Windows\System\FoyLbWj.exe
  C:\Windows\System\FoyLbWj.exe
  2⤵
  PID:7580
- C:\Windows\System\wrKeSVq.exe
  C:\Windows\System\wrKeSVq.exe
  2⤵
  PID:7488
- C:\Windows\System\ILieBsS.exe
  C:\Windows\System\ILieBsS.exe
  2⤵
  PID:7520
- C:\Windows\System\wIgLRdy.exe
  C:\Windows\System\wIgLRdy.exe
  2⤵
  PID:7644
- C:\Windows\System\iDuOiHz.exe
  C:\Windows\System\iDuOiHz.exe
  2⤵
  PID:7720
- C:\Windows\System\KFuUlZm.exe
  C:\Windows\System\KFuUlZm.exe
  2⤵
  PID:7780
- C:\Windows\System\akgiIyV.exe
  C:\Windows\System\akgiIyV.exe
  2⤵
  PID:7824
- C:\Windows\System\GKrVVAR.exe
  C:\Windows\System\GKrVVAR.exe
  2⤵
  PID:3188
- C:\Windows\System\AWgsuuX.exe
  C:\Windows\System\AWgsuuX.exe
  2⤵
  PID:3208
- C:\Windows\System\ZZpcbkE.exe
  C:\Windows\System\ZZpcbkE.exe
  2⤵
  PID:7960
- C:\Windows\System\BCrvoms.exe
  C:\Windows\System\BCrvoms.exe
  2⤵
  PID:8144
- C:\Windows\System\xxZddCT.exe
  C:\Windows\System\xxZddCT.exe
  2⤵
  PID:8084
- C:\Windows\System\RONmNzu.exe
  C:\Windows\System\RONmNzu.exe
  2⤵
  PID:7996
- C:\Windows\System\kyBYiDl.exe
  C:\Windows\System\kyBYiDl.exe
  2⤵
  PID:7984
- C:\Windows\System\EfPoqRq.exe
  C:\Windows\System\EfPoqRq.exe
  2⤵
  PID:7216
- C:\Windows\System\vWNRZUR.exe
  C:\Windows\System\vWNRZUR.exe
  2⤵
  PID:7452
- C:\Windows\System\uVVQslm.exe
  C:\Windows\System\uVVQslm.exe
  2⤵
  PID:7432
- C:\Windows\System\aiGPZGW.exe
  C:\Windows\System\aiGPZGW.exe
  2⤵
  PID:7980
- C:\Windows\System\sgOJLgD.exe
  C:\Windows\System\sgOJLgD.exe
  2⤵
  PID:8160
- C:\Windows\System\qhOcHVi.exe
  C:\Windows\System\qhOcHVi.exe
  2⤵
  PID:7712
- C:\Windows\System\awmeRhx.exe
  C:\Windows\System\awmeRhx.exe
  2⤵
  PID:7736
- C:\Windows\System\zjqFmJe.exe
  C:\Windows\System\zjqFmJe.exe
  2⤵
  PID:7748
- C:\Windows\System\RJtgeRq.exe
  C:\Windows\System\RJtgeRq.exe
  2⤵
  PID:7880
- C:\Windows\System\VZzKCkt.exe
  C:\Windows\System\VZzKCkt.exe
  2⤵
  PID:7356
- C:\Windows\System\DbOszBt.exe
  C:\Windows\System\DbOszBt.exe
  2⤵
  PID:7844
- C:\Windows\System\kSEjgNV.exe
  C:\Windows\System\kSEjgNV.exe
  2⤵
  PID:7192
- C:\Windows\System\tSRwiYY.exe
  C:\Windows\System\tSRwiYY.exe
  2⤵
  PID:7352
- C:\Windows\System\rndGKld.exe
  C:\Windows\System\rndGKld.exe
  2⤵
  PID:7376
- C:\Windows\System\sUUFWzD.exe
  C:\Windows\System\sUUFWzD.exe
  2⤵
  PID:7528
- C:\Windows\System\uNzsioP.exe
  C:\Windows\System\uNzsioP.exe
  2⤵
  PID:7472
- C:\Windows\System\BBOGhmt.exe
  C:\Windows\System\BBOGhmt.exe
  2⤵
  PID:7904
- C:\Windows\System\DzFHcqI.exe
  C:\Windows\System\DzFHcqI.exe
  2⤵
  PID:7876
- C:\Windows\System\orBiGzD.exe
  C:\Windows\System\orBiGzD.exe
  2⤵
  PID:7792
- C:\Windows\System\uxCeHmH.exe
  C:\Windows\System\uxCeHmH.exe
  2⤵
  PID:7228
- C:\Windows\System\NCrAXni.exe
  C:\Windows\System\NCrAXni.exe
  2⤵
  PID:7600
- C:\Windows\System\szXcZTB.exe
  C:\Windows\System\szXcZTB.exe
  2⤵
  PID:8176
- C:\Windows\System\ixramYs.exe
  C:\Windows\System\ixramYs.exe
  2⤵
  PID:7796
- C:\Windows\System\vfMuLBJ.exe
  C:\Windows\System\vfMuLBJ.exe
  2⤵
  PID:7424
- C:\Windows\System\fqVKCVd.exe
  C:\Windows\System\fqVKCVd.exe
  2⤵
  PID:7716
- C:\Windows\System\esJuEpy.exe
  C:\Windows\System\esJuEpy.exe
  2⤵
  PID:7544
- C:\Windows\System\AbcVadA.exe
  C:\Windows\System\AbcVadA.exe
  2⤵
  PID:7604
- C:\Windows\System\ipTfsfx.exe
  C:\Windows\System\ipTfsfx.exe
  2⤵
  PID:8096
- C:\Windows\System\QtEBPKr.exe
  C:\Windows\System\QtEBPKr.exe
  2⤵
  PID:8128
- C:\Windows\System\moGzlSv.exe
  C:\Windows\System\moGzlSv.exe
  2⤵
  PID:7860
- C:\Windows\System\SUUCkSK.exe
  C:\Windows\System\SUUCkSK.exe
  2⤵
  PID:8208
- C:\Windows\System\DQvcsHg.exe
  C:\Windows\System\DQvcsHg.exe
  2⤵
  PID:8224
- C:\Windows\System\eCFcJqU.exe
  C:\Windows\System\eCFcJqU.exe
  2⤵
  PID:8244
- C:\Windows\System\YIcGrZY.exe
  C:\Windows\System\YIcGrZY.exe
  2⤵
  PID:8280
- C:\Windows\System\GnKTeuT.exe
  C:\Windows\System\GnKTeuT.exe
  2⤵
  PID:8304
- C:\Windows\System\GcpBdIZ.exe
  C:\Windows\System\GcpBdIZ.exe
  2⤵
  PID:8320
- C:\Windows\System\RNYhfOi.exe
  C:\Windows\System\RNYhfOi.exe
  2⤵
  PID:8340
- C:\Windows\System\MBeCChl.exe
  C:\Windows\System\MBeCChl.exe
  2⤵
  PID:8356
- C:\Windows\System\YFzCQVt.exe
  C:\Windows\System\YFzCQVt.exe
  2⤵
  PID:8380
- C:\Windows\System\bkDxQYH.exe
  C:\Windows\System\bkDxQYH.exe
  2⤵
  PID:8396
- C:\Windows\System\PHxUxww.exe
  C:\Windows\System\PHxUxww.exe
  2⤵
  PID:8428
- C:\Windows\System\dNAAflk.exe
  C:\Windows\System\dNAAflk.exe
  2⤵
  PID:8444
- C:\Windows\System\PLKozMk.exe
  C:\Windows\System\PLKozMk.exe
  2⤵
  PID:8460
- C:\Windows\System\vGmiwWV.exe
  C:\Windows\System\vGmiwWV.exe
  2⤵
  PID:8476
- C:\Windows\System\tWPXDUH.exe
  C:\Windows\System\tWPXDUH.exe
  2⤵
  PID:8492
- C:\Windows\System\tBOTbja.exe
  C:\Windows\System\tBOTbja.exe
  2⤵
  PID:8508
- C:\Windows\System\bGCLIay.exe
  C:\Windows\System\bGCLIay.exe
  2⤵
  PID:8536
- C:\Windows\System\qHDXWMq.exe
  C:\Windows\System\qHDXWMq.exe
  2⤵
  PID:8564
- C:\Windows\System\asMnbjH.exe
  C:\Windows\System\asMnbjH.exe
  2⤵
  PID:8580
- C:\Windows\System\Oswodbi.exe
  C:\Windows\System\Oswodbi.exe
  2⤵
  PID:8596
- C:\Windows\System\QUCjeDw.exe
  C:\Windows\System\QUCjeDw.exe
  2⤵
  PID:8616
- C:\Windows\System\QkJrfKJ.exe
  C:\Windows\System\QkJrfKJ.exe
  2⤵
  PID:8632
- C:\Windows\System\grrohNO.exe
  C:\Windows\System\grrohNO.exe
  2⤵
  PID:8648
- C:\Windows\System\uCnOVHj.exe
  C:\Windows\System\uCnOVHj.exe
  2⤵
  PID:8688
- C:\Windows\System\NQXmQhf.exe
  C:\Windows\System\NQXmQhf.exe
  2⤵
  PID:8704
- C:\Windows\System\vgtiuZS.exe
  C:\Windows\System\vgtiuZS.exe
  2⤵
  PID:8720
- C:\Windows\System\jlUzwQe.exe
  C:\Windows\System\jlUzwQe.exe
  2⤵
  PID:8736
- C:\Windows\System\hGUNVBJ.exe
  C:\Windows\System\hGUNVBJ.exe
  2⤵
  PID:8752
- C:\Windows\System\KtSWBqp.exe
  C:\Windows\System\KtSWBqp.exe
  2⤵
  PID:8768
- C:\Windows\System\EwzQYwt.exe
  C:\Windows\System\EwzQYwt.exe
  2⤵
  PID:8792
- C:\Windows\System\DmQfIhU.exe
  C:\Windows\System\DmQfIhU.exe
  2⤵
  PID:8808
- C:\Windows\System\snjZzpa.exe
  C:\Windows\System\snjZzpa.exe
  2⤵
  PID:8832
- C:\Windows\System\RNhUjYW.exe
  C:\Windows\System\RNhUjYW.exe
  2⤵
  PID:8868
- C:\Windows\System\NuaIwQK.exe
  C:\Windows\System\NuaIwQK.exe
  2⤵
  PID:8884
- C:\Windows\System\qVxWlUM.exe
  C:\Windows\System\qVxWlUM.exe
  2⤵
  PID:8900
- C:\Windows\System\ozJGafU.exe
  C:\Windows\System\ozJGafU.exe
  2⤵
  PID:8916
- C:\Windows\System\OKnBKPr.exe
  C:\Windows\System\OKnBKPr.exe
  2⤵
  PID:8932
- C:\Windows\System\olpCMdY.exe
  C:\Windows\System\olpCMdY.exe
  2⤵
  PID:8952
- C:\Windows\System\CGHcpBh.exe
  C:\Windows\System\CGHcpBh.exe
  2⤵
  PID:8968
- C:\Windows\System\wPRuCIi.exe
  C:\Windows\System\wPRuCIi.exe
  2⤵
  PID:8984
- C:\Windows\System\isRxfwR.exe
  C:\Windows\System\isRxfwR.exe
  2⤵
  PID:9000
- C:\Windows\System\AqumJpM.exe
  C:\Windows\System\AqumJpM.exe
  2⤵
  PID:9016
- C:\Windows\System\FWQNrcc.exe
  C:\Windows\System\FWQNrcc.exe
  2⤵
  PID:9032
- C:\Windows\System\qJLpjyL.exe
  C:\Windows\System\qJLpjyL.exe
  2⤵
  PID:9048
- C:\Windows\System\NKAdtuV.exe
  C:\Windows\System\NKAdtuV.exe
  2⤵
  PID:9064
- C:\Windows\System\xhAxZVO.exe
  C:\Windows\System\xhAxZVO.exe
  2⤵
  PID:9080
- C:\Windows\System\rfPHcLb.exe
  C:\Windows\System\rfPHcLb.exe
  2⤵
  PID:9100
- C:\Windows\System\gwexaQb.exe
  C:\Windows\System\gwexaQb.exe
  2⤵
  PID:9168
- C:\Windows\System\aJQpXrM.exe
  C:\Windows\System\aJQpXrM.exe
  2⤵
  PID:9188
- C:\Windows\System\kCtIzuD.exe
  C:\Windows\System\kCtIzuD.exe
  2⤵
  PID:9204
- C:\Windows\System\XtjxRrp.exe
  C:\Windows\System\XtjxRrp.exe
  2⤵
  PID:8004
- C:\Windows\System\mkTGhGD.exe
  C:\Windows\System\mkTGhGD.exe
  2⤵
  PID:8256
- C:\Windows\System\DSmxGxm.exe
  C:\Windows\System\DSmxGxm.exe
  2⤵
  PID:8200
- C:\Windows\System\msgVQXy.exe
  C:\Windows\System\msgVQXy.exe
  2⤵
  PID:8240
- C:\Windows\System\cJBwAhs.exe
  C:\Windows\System\cJBwAhs.exe
  2⤵
  PID:8272
- C:\Windows\System\MrAfpxS.exe
  C:\Windows\System\MrAfpxS.exe
  2⤵
  PID:8332
- C:\Windows\System\OjjKnEe.exe
  C:\Windows\System\OjjKnEe.exe
  2⤵
  PID:8264
- C:\Windows\System\ukuIqgo.exe
  C:\Windows\System\ukuIqgo.exe
  2⤵
  PID:8364
- C:\Windows\System\MyBEaTP.exe
  C:\Windows\System\MyBEaTP.exe
  2⤵
  PID:8408
- C:\Windows\System\PyuAATL.exe
  C:\Windows\System\PyuAATL.exe
  2⤵
  PID:8420
- C:\Windows\System\FYAbQtJ.exe
  C:\Windows\System\FYAbQtJ.exe
  2⤵
  PID:8436
- C:\Windows\System\PFDLXsZ.exe
  C:\Windows\System\PFDLXsZ.exe
  2⤵
  PID:8472
- C:\Windows\System\oTEKOTe.exe
  C:\Windows\System\oTEKOTe.exe
  2⤵
  PID:8484
- C:\Windows\System\xmhyURw.exe
  C:\Windows\System\xmhyURw.exe
  2⤵
  PID:8592
- C:\Windows\System\qxTxdin.exe
  C:\Windows\System\qxTxdin.exe
  2⤵
  PID:8660
- C:\Windows\System\QAVyXtS.exe
  C:\Windows\System\QAVyXtS.exe
  2⤵
  PID:8532
- C:\Windows\System\JJzxBTw.exe
  C:\Windows\System\JJzxBTw.exe
  2⤵
  PID:8744
- C:\Windows\System\HOmaGGd.exe
  C:\Windows\System\HOmaGGd.exe
  2⤵
  PID:8788
- C:\Windows\System\ycsuRRO.exe
  C:\Windows\System\ycsuRRO.exe
  2⤵
  PID:8820
- C:\Windows\System\SuAFkrk.exe
  C:\Windows\System\SuAFkrk.exe
  2⤵
  PID:8804
- C:\Windows\System\YLaHhkG.exe
  C:\Windows\System\YLaHhkG.exe
  2⤵
  PID:8732
- C:\Windows\System\LdERzqh.exe
  C:\Windows\System\LdERzqh.exe
  2⤵
  PID:8864
- C:\Windows\System\pSkVVWw.exe
  C:\Windows\System\pSkVVWw.exe
  2⤵
  PID:8908
- C:\Windows\System\elBKeIN.exe
  C:\Windows\System\elBKeIN.exe
  2⤵
  PID:8948
- C:\Windows\System\avfTmrH.exe
  C:\Windows\System\avfTmrH.exe
  2⤵
  PID:8940
- C:\Windows\System\IgktkzC.exe
  C:\Windows\System\IgktkzC.exe
  2⤵
  PID:9108
- C:\Windows\System\LciFQkU.exe
  C:\Windows\System\LciFQkU.exe
  2⤵
  PID:9072
- C:\Windows\System\hRUorgp.exe
  C:\Windows\System\hRUorgp.exe
  2⤵
  PID:8928
- C:\Windows\System\NEYTMCa.exe
  C:\Windows\System\NEYTMCa.exe
  2⤵
  PID:9028
- C:\Windows\System\eaIkxWh.exe
  C:\Windows\System\eaIkxWh.exe
  2⤵
  PID:8960
- C:\Windows\System\AhCgYqb.exe
  C:\Windows\System\AhCgYqb.exe
  2⤵
  PID:9196
- C:\Windows\System\oXCKYbw.exe
  C:\Windows\System\oXCKYbw.exe
  2⤵
  PID:8232
- C:\Windows\System\xQrIKeC.exe
  C:\Windows\System\xQrIKeC.exe
  2⤵
  PID:8312
- C:\Windows\System\qqAvgDv.exe
  C:\Windows\System\qqAvgDv.exe
  2⤵
  PID:8516
- C:\Windows\System\MjgELFJ.exe
  C:\Windows\System\MjgELFJ.exe
  2⤵
  PID:9176
- C:\Windows\System\LmvjzGp.exe
  C:\Windows\System\LmvjzGp.exe
  2⤵
  PID:8528
- C:\Windows\System\rGedbQO.exe
  C:\Windows\System\rGedbQO.exe
  2⤵
  PID:8148
- C:\Windows\System\fESJjPU.exe
  C:\Windows\System\fESJjPU.exe
  2⤵
  PID:8424
- C:\Windows\System\GGodOMT.exe
  C:\Windows\System\GGodOMT.exe
  2⤵
  PID:8628
- C:\Windows\System\QbBMdrs.exe
  C:\Windows\System\QbBMdrs.exe
  2⤵
  PID:8612
- C:\Windows\System\LvovUCN.exe
  C:\Windows\System\LvovUCN.exe
  2⤵
  PID:8680
- C:\Windows\System\BcgDaCv.exe
  C:\Windows\System\BcgDaCv.exe
  2⤵
  PID:8696
- C:\Windows\System\cYMIHld.exe
  C:\Windows\System\cYMIHld.exe
  2⤵
  PID:8844
- C:\Windows\System\uFczRow.exe
  C:\Windows\System\uFczRow.exe
  2⤵
  PID:8700
- C:\Windows\System\cbXPSJL.exe
  C:\Windows\System\cbXPSJL.exe
  2⤵
  PID:8976
- C:\Windows\System\KpqCYax.exe
  C:\Windows\System\KpqCYax.exe
  2⤵
  PID:8292
- C:\Windows\System\NdgdopA.exe
  C:\Windows\System\NdgdopA.exe
  2⤵
  PID:9112
- C:\Windows\System\aqUsUDN.exe
  C:\Windows\System\aqUsUDN.exe
  2⤵
  PID:8876
- C:\Windows\System\HBhbzHe.exe
  C:\Windows\System\HBhbzHe.exe
  2⤵
  PID:9056
- C:\Windows\System\oShunCs.exe
  C:\Windows\System\oShunCs.exe
  2⤵
  PID:9156
- C:\Windows\System\PiaaTfY.exe
  C:\Windows\System\PiaaTfY.exe
  2⤵
  PID:8328
- C:\Windows\System\byEbUAn.exe
  C:\Windows\System\byEbUAn.exe
  2⤵
  PID:9212
- C:\Windows\System\dwVsIzW.exe
  C:\Windows\System\dwVsIzW.exe
  2⤵
  PID:8676
- C:\Windows\System\hZlhaIh.exe
  C:\Windows\System\hZlhaIh.exe
  2⤵
  PID:8880
- C:\Windows\System\ReISVKK.exe
  C:\Windows\System\ReISVKK.exe
  2⤵
  PID:9012
- C:\Windows\System\VgCjKYt.exe
  C:\Windows\System\VgCjKYt.exe
  2⤵
  PID:9180
- C:\Windows\System\zeSRcbg.exe
  C:\Windows\System\zeSRcbg.exe
  2⤵
  PID:8220
- C:\Windows\System\lDaUxMt.exe
  C:\Windows\System\lDaUxMt.exe
  2⤵
  PID:9128
- C:\Windows\System\ghrqsdJ.exe
  C:\Windows\System\ghrqsdJ.exe
  2⤵
  PID:8780
- C:\Windows\System\ASLTeEs.exe
  C:\Windows\System\ASLTeEs.exe
  2⤵
  PID:8404
- C:\Windows\System\RjWbwLA.exe
  C:\Windows\System\RjWbwLA.exe
  2⤵
  PID:8716
- C:\Windows\System\SpMtccP.exe
  C:\Windows\System\SpMtccP.exe
  2⤵
  PID:9140
- C:\Windows\System\KnMHoex.exe
  C:\Windows\System\KnMHoex.exe
  2⤵
  PID:9132
- C:\Windows\System\aSMwiLW.exe
  C:\Windows\System\aSMwiLW.exe
  2⤵
  PID:9096
- C:\Windows\System\LyzStIy.exe
  C:\Windows\System\LyzStIy.exe
  2⤵
  PID:8816
- C:\Windows\System\niFBOIv.exe
  C:\Windows\System\niFBOIv.exe
  2⤵
  PID:8276
- C:\Windows\System\SukoMAp.exe
  C:\Windows\System\SukoMAp.exe
  2⤵
  PID:8260
- C:\Windows\System\EtaahDS.exe
  C:\Windows\System\EtaahDS.exe
  2⤵
  PID:8712
- C:\Windows\System\MERgDtt.exe
  C:\Windows\System\MERgDtt.exe
  2⤵
  PID:8452
- C:\Windows\System\AuGziAe.exe
  C:\Windows\System\AuGziAe.exe
  2⤵
  PID:9164
- C:\Windows\System\UmJcHIt.exe
  C:\Windows\System\UmJcHIt.exe
  2⤵
  PID:9236
- C:\Windows\System\hIoGMFu.exe
  C:\Windows\System\hIoGMFu.exe
  2⤵
  PID:9260
- C:\Windows\System\LIoVaxi.exe
  C:\Windows\System\LIoVaxi.exe
  2⤵
  PID:9280
- C:\Windows\System\aLBMlQR.exe
  C:\Windows\System\aLBMlQR.exe
  2⤵
  PID:9296
- C:\Windows\System\lxNlMKS.exe
  C:\Windows\System\lxNlMKS.exe
  2⤵
  PID:9312
- C:\Windows\System\SXWYKqy.exe
  C:\Windows\System\SXWYKqy.exe
  2⤵
  PID:9336
- C:\Windows\System\gtiTPmd.exe
  C:\Windows\System\gtiTPmd.exe
  2⤵
  PID:9352
- C:\Windows\System\UEQOyPx.exe
  C:\Windows\System\UEQOyPx.exe
  2⤵
  PID:9372
- C:\Windows\System\YQmjXHG.exe
  C:\Windows\System\YQmjXHG.exe
  2⤵
  PID:9388
- C:\Windows\System\NHThYxf.exe
  C:\Windows\System\NHThYxf.exe
  2⤵
  PID:9420
- C:\Windows\System\bdxkpTe.exe
  C:\Windows\System\bdxkpTe.exe
  2⤵
  PID:9440
- C:\Windows\System\ouLxRjg.exe
  C:\Windows\System\ouLxRjg.exe
  2⤵
  PID:9460
- C:\Windows\System\TgDxjxE.exe
  C:\Windows\System\TgDxjxE.exe
  2⤵
  PID:9476
- C:\Windows\System\JhfUUWP.exe
  C:\Windows\System\JhfUUWP.exe
  2⤵
  PID:9496
- C:\Windows\System\SlsNOHY.exe
  C:\Windows\System\SlsNOHY.exe
  2⤵
  PID:9516
- C:\Windows\System\jYSwHyn.exe
  C:\Windows\System\jYSwHyn.exe
  2⤵
  PID:9536
- C:\Windows\System\tIUuBaX.exe
  C:\Windows\System\tIUuBaX.exe
  2⤵
  PID:9552
- C:\Windows\System\xJwvaJa.exe
  C:\Windows\System\xJwvaJa.exe
  2⤵
  PID:9568
- C:\Windows\System\zlRbHhH.exe
  C:\Windows\System\zlRbHhH.exe
  2⤵
  PID:9588
- C:\Windows\System\qVOdetR.exe
  C:\Windows\System\qVOdetR.exe
  2⤵
  PID:9604
- C:\Windows\System\DFXaCFv.exe
  C:\Windows\System\DFXaCFv.exe
  2⤵
  PID:9620
- C:\Windows\System\GXZxqNZ.exe
  C:\Windows\System\GXZxqNZ.exe
  2⤵
  PID:9648
- C:\Windows\System\BiCXMWT.exe
  C:\Windows\System\BiCXMWT.exe
  2⤵
  PID:9684
- C:\Windows\System\QiryYnT.exe
  C:\Windows\System\QiryYnT.exe
  2⤵
  PID:9700
- C:\Windows\System\vvCfVRx.exe
  C:\Windows\System\vvCfVRx.exe
  2⤵
  PID:9724
- C:\Windows\System\SjxwlRd.exe
  C:\Windows\System\SjxwlRd.exe
  2⤵
  PID:9740
- C:\Windows\System\mygpoQC.exe
  C:\Windows\System\mygpoQC.exe
  2⤵
  PID:9760
- C:\Windows\System\xlbpIIC.exe
  C:\Windows\System\xlbpIIC.exe
  2⤵
  PID:9776
- C:\Windows\System\rGXVWxx.exe
  C:\Windows\System\rGXVWxx.exe
  2⤵
  PID:9804
- C:\Windows\System\oGhOMWh.exe
  C:\Windows\System\oGhOMWh.exe
  2⤵
  PID:9824
- C:\Windows\System\TIagIUI.exe
  C:\Windows\System\TIagIUI.exe
  2⤵
  PID:9844
- C:\Windows\System\ZBjRIdv.exe
  C:\Windows\System\ZBjRIdv.exe
  2⤵
  PID:9864
- C:\Windows\System\hSsTBih.exe
  C:\Windows\System\hSsTBih.exe
  2⤵
  PID:9880
- C:\Windows\System\KZrihHa.exe
  C:\Windows\System\KZrihHa.exe
  2⤵
  PID:9896
- C:\Windows\System\QwWmYDM.exe
  C:\Windows\System\QwWmYDM.exe
  2⤵
  PID:9920
- C:\Windows\System\HHfJCzN.exe
  C:\Windows\System\HHfJCzN.exe
  2⤵
  PID:9936
- C:\Windows\System\SvEvOIx.exe
  C:\Windows\System\SvEvOIx.exe
  2⤵
  PID:9956
- C:\Windows\System\OQREqXr.exe
  C:\Windows\System\OQREqXr.exe
  2⤵
  PID:9972
- C:\Windows\System\qGEEOTF.exe
  C:\Windows\System\qGEEOTF.exe
  2⤵
  PID:10008
- C:\Windows\System\NDSYXcP.exe
  C:\Windows\System\NDSYXcP.exe
  2⤵
  PID:10024
- C:\Windows\System\ejikqBX.exe
  C:\Windows\System\ejikqBX.exe
  2⤵
  PID:10044
- C:\Windows\System\fJzBuwI.exe
  C:\Windows\System\fJzBuwI.exe
  2⤵
  PID:10064
- C:\Windows\System\amIeFhL.exe
  C:\Windows\System\amIeFhL.exe
  2⤵
  PID:10088
- C:\Windows\System\mXoQRRN.exe
  C:\Windows\System\mXoQRRN.exe
  2⤵
  PID:10104
- C:\Windows\System\fmqHuQv.exe
  C:\Windows\System\fmqHuQv.exe
  2⤵
  PID:10120
- C:\Windows\System\IwOMcvf.exe
  C:\Windows\System\IwOMcvf.exe
  2⤵
  PID:10136
- C:\Windows\System\AaMZyHa.exe
  C:\Windows\System\AaMZyHa.exe
  2⤵
  PID:10164
- C:\Windows\System\fGespCP.exe
  C:\Windows\System\fGespCP.exe
  2⤵
  PID:10180
- C:\Windows\System\SZiPskA.exe
  C:\Windows\System\SZiPskA.exe
  2⤵
  PID:10204
- C:\Windows\System\PvMguEO.exe
  C:\Windows\System\PvMguEO.exe
  2⤵
  PID:10224
- C:\Windows\System\DunLJNt.exe
  C:\Windows\System\DunLJNt.exe
  2⤵
  PID:9224
- C:\Windows\System\mSkVuaN.exe
  C:\Windows\System\mSkVuaN.exe
  2⤵
  PID:8992
- C:\Windows\System\mojYuVb.exe
  C:\Windows\System\mojYuVb.exe
  2⤵
  PID:8572
- C:\Windows\System\ScByvPw.exe
  C:\Windows\System\ScByvPw.exe
  2⤵
  PID:9248
- C:\Windows\System\uaybblV.exe
  C:\Windows\System\uaybblV.exe
  2⤵
  PID:9304
- C:\Windows\System\YdUBwVn.exe
  C:\Windows\System\YdUBwVn.exe
  2⤵
  PID:9384
- C:\Windows\System\jAroMOT.exe
  C:\Windows\System\jAroMOT.exe
  2⤵
  PID:9436
- C:\Windows\System\pOpZgps.exe
  C:\Windows\System\pOpZgps.exe
  2⤵
  PID:9396
- C:\Windows\System\mEKKCoZ.exe
  C:\Windows\System\mEKKCoZ.exe
  2⤵
  PID:9288
- C:\Windows\System\bKVGobN.exe
  C:\Windows\System\bKVGobN.exe
  2⤵
  PID:9448
- C:\Windows\System\yAkABca.exe
  C:\Windows\System\yAkABca.exe
  2⤵
  PID:9508
- C:\Windows\System\oYnmuLP.exe
  C:\Windows\System\oYnmuLP.exe
  2⤵
  PID:9548
- C:\Windows\System\gqpphWQ.exe
  C:\Windows\System\gqpphWQ.exe
  2⤵
  PID:9612
- C:\Windows\System\LBBctgs.exe
  C:\Windows\System\LBBctgs.exe
  2⤵
  PID:9676
- C:\Windows\System\gKiNcQO.exe
  C:\Windows\System\gKiNcQO.exe
  2⤵
  PID:9632
- C:\Windows\System\RNglQsX.exe
  C:\Windows\System\RNglQsX.exe
  2⤵
  PID:9564
- C:\Windows\System\jzWJOGm.exe
  C:\Windows\System\jzWJOGm.exe
  2⤵
  PID:9692
- C:\Windows\System\otgKCUv.exe
  C:\Windows\System\otgKCUv.exe
  2⤵
  PID:9748
- C:\Windows\System\NaHwjwR.exe
  C:\Windows\System\NaHwjwR.exe
  2⤵
  PID:9756
- C:\Windows\System\jTQVxrj.exe
  C:\Windows\System\jTQVxrj.exe
  2⤵
  PID:9792
- C:\Windows\System\knBMmra.exe
  C:\Windows\System\knBMmra.exe
  2⤵
  PID:9772
- C:\Windows\System\TRhaOKI.exe
  C:\Windows\System\TRhaOKI.exe
  2⤵
  PID:9832
- C:\Windows\System\NdfLZXd.exe
  C:\Windows\System\NdfLZXd.exe
  2⤵
  PID:9908
- C:\Windows\System\qqXYrzj.exe
  C:\Windows\System\qqXYrzj.exe
  2⤵
  PID:9980
- C:\Windows\System\TnWvmkw.exe
  C:\Windows\System\TnWvmkw.exe
  2⤵
  PID:9988
- C:\Windows\System\TAjDxTw.exe
  C:\Windows\System\TAjDxTw.exe
  2⤵
  PID:10032
- C:\Windows\System\rHsxbXt.exe
  C:\Windows\System\rHsxbXt.exe
  2⤵
  PID:9964
- C:\Windows\System\FqUmAgw.exe
  C:\Windows\System\FqUmAgw.exe
  2⤵
  PID:10076
- C:\Windows\System\VKAUpHm.exe
  C:\Windows\System\VKAUpHm.exe
  2⤵
  PID:10112
- C:\Windows\System\fHCTBGx.exe
  C:\Windows\System\fHCTBGx.exe
  2⤵
  PID:10052
- C:\Windows\System\nIsVGlQ.exe
  C:\Windows\System\nIsVGlQ.exe
  2⤵
  PID:10192
- C:\Windows\System\pJJtRcu.exe
  C:\Windows\System\pJJtRcu.exe
  2⤵
  PID:10020
- C:\Windows\System\KRqXEnh.exe
  C:\Windows\System\KRqXEnh.exe
  2⤵
  PID:8764
- C:\Windows\System\CPDDPLh.exe
  C:\Windows\System\CPDDPLh.exe
  2⤵
  PID:9088
- C:\Windows\System\sqFMfYq.exe
  C:\Windows\System\sqFMfYq.exe
  2⤵
  PID:10176
- C:\Windows\System\cdYAJKc.exe
  C:\Windows\System\cdYAJKc.exe
  2⤵
  PID:9040
- C:\Windows\System\VIEMBvb.exe
  C:\Windows\System\VIEMBvb.exe
  2⤵
  PID:9348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AJQlAPx.exe

Filesize
3.0MB

MD5
bd56d0cb129466f6cf6b06aef45c2f72

SHA1
105e25e3fd7a8c34ba8d2f571074aefdbcb3f44f

SHA256
d12fa495eebf5121ac1b371626c36321970229a553e872606c37af86a3d14fc0

SHA512
79089cf7c69584f51ba136e3a0798ef1e19368ddaee8dba81f47d42e18cb59cf29f828cee4365fc34f43bb4f8959d27d08faa372d9856174ddcdbabacda82970

Download Submit
C:\Windows\system\GSSbkTP.exe

Filesize
3.0MB

MD5
4b550b50901b5cd265ca0eba3f334f1e

SHA1
7a0f8d76423ef7c53bf14b9a7ddc7b3c40a39abf

SHA256
c8a2fc880573ce3a83f202196120b283f1d74976fd8c4bb3b76503f89c0a9fb0

SHA512
99b3d43add15346deaf4b1ac0a2f7bb9259efce640a9ef7c56143154899dc323cb004bf3084bd5f3b749f512e48e678fc93c67df202bb6f3edcd547ce4b5b998

Download Submit
C:\Windows\system\GWhejyw.exe

Filesize
3.0MB

MD5
441dcc93e4af04658b4368f94bf867ef

SHA1
d970b9605c323fa4e1c4bc6b4b45fb754397073c

SHA256
a933ff29a1f2d02e95c1fb0d71b87e537174a4b7ed2294b88bd0dc355ec67a74

SHA512
89b0fc9d56b2f6d537603e1b4321fab6443cdea90b957e659a960e1772fcb9d74d044536392d0efb0409aae42230a211226909cb1b882361d54532152c4d6457

Download Submit
C:\Windows\system\JEQzZlK.exe

Filesize
3.0MB

MD5
c1c7989fdccb4e03ea07c0b5f7155884

SHA1
7b1fe42a56eea15ad630c602e6e2e5446e7e5910

SHA256
17d672bbc5116547a2a985da704b4810e98febcbf8c0c8aa38a9819993b5a8ad

SHA512
a486566a57d66a151d43025d4d3b968768d31dfbe244b1374be62a6226a1584a7b2a7eff30de0e844c57e1daabaff6c55f71b27916b82462fe07771e53f5c3c7

Download Submit
C:\Windows\system\LArTqKs.exe

Filesize
3.0MB

MD5
629caa8a5e361d5d9849d77bb68dfa65

SHA1
066da8dd76ae7a88a55ed520cec4bdbe747e2389

SHA256
cfe1113c57504dbd1880315151b91f5cfb4385868777ea2367ecf15373b8308f

SHA512
4703af13be42c0003205f94af71663fc21ec9d2286140e20c86cddb6cde6a118d01d0d30c60195efe01b9212c4e17603cdc294679b62b4e3141570c687f8d7af

Download Submit
C:\Windows\system\MfFZwpe.exe

Filesize
3.0MB

MD5
c72893351fdd7183ddf923902ef20d95

SHA1
ea59ff951d10713ab8fef5065bfe1a75bd405b4b

SHA256
4251fb5bca2931a6fdce523aaaf749cb4aa96543fe000c14a762bce66eb30b54

SHA512
45a7f2fb58ac74c7aacab937a5332d1b42407b0a2acea2dcd69b0dc98cf7fb5d5b49620019f07c0335fec7da2f5bd690a56cf8a50b24f740fc68c1f5ff81905d

Download Submit
C:\Windows\system\NANqxRg.exe

Filesize
3.0MB

MD5
e6291d45a3f5258b97aa317ce5134069

SHA1
cba3153f9cb9252dc972dd4fbda139ad2d73d698

SHA256
794c558e60a57fff2754bc3d83bd359e8a1118fa9f29f1f778a8b6a093f3d7cf

SHA512
9f12fe8b10a95c7deb9cab70dcc9c7833461cd1d39c9110ace5e489fe98986264fc4c072f289c49c800c33dea90e95204c56ce945b039e2ab4ac98a0f5207b83

Download Submit
C:\Windows\system\TTbbaTd.exe

Filesize
3.0MB

MD5
b8dc64dcfa7b8f230a54025df2370c83

SHA1
7da290cc78172da9f88b03f54e74e5c0b765b6f9

SHA256
589d9bf6163df673406f68ce2e7d9d1c2ec83ddddd3d96864975e4ad027a36fe

SHA512
01f75a0f047984fcf98704aaa1ccc0d6e44729a11d5ee40df7de58667a13e10ceb0f5e517377c56182f7d3f04bc60d1bfcf85ff8313a5e00e1c3f5f9f3e882a6

Download Submit
C:\Windows\system\UHoONYi.exe

Filesize
3.0MB

MD5
0018332259c672735bfde0de1557a232

SHA1
cc3eb9972b27230ab8c519f42e52447607ef4d95

SHA256
ed61ce828a2a85a623a594b6e9c22b64c88e9fd83e6745d1f1ec7922853e9cf2

SHA512
86fff4b03b5a9ecbf3365749d7acbbcf1dafb60a963d309de5fe3cc8fade258ceffbcd4230bf4af704f67407ea07ec27c1716bc2074a055141ece765c53dd95c

Download Submit
C:\Windows\system\UIXcKZe.exe

Filesize
3.0MB

MD5
c236ac9e5df9006ae9401472f54610c3

SHA1
e6a96ec2b62f23b01c34748f2bd1a0a6d10d58c6

SHA256
bbc20f2406fd7b5e1a19eb89dfc94d078ea7bca22438dec5499f57fb495c507a

SHA512
1ba2ec18e5a8a4635c3e5ce75bd407a8a5ed5f43ce3050aff279df6197bf8437d24cc6eac2090a2ae725a610fab99ccf3f7f900e99022199d0a3a1bf1a2b9bb3

Download Submit
C:\Windows\system\ZKatkqp.exe

Filesize
3.0MB

MD5
e6c35b59cb4bfa0dbf1943d96b685407

SHA1
ddde3e7db61f845d0c5f8a621d61ff7bdd967e88

SHA256
3b1312a06651b50c337f9e85565d9a2557ce5020424593d601afd8bf422cced3

SHA512
a4811d242d52f88907f1a8c129858c50c675a23997943f51582687fcc53d165cf25678752d10a0436dbc8c225ef10a02bf7ecf2246a1b1fba708e7e7d48afd28

Download Submit
C:\Windows\system\cnJuNBM.exe

Filesize
3.0MB

MD5
9d3124902b0cd42a799a803425f1f63b

SHA1
5c82b164817e5620783f6bc39356b2bb9145c256

SHA256
ade07185f1f64d3e73159273cf8fa619e1677f0266e58df8624be51abd32b580

SHA512
30aee33c52ba63149d6ccf858782ce4918fc96bb52cfac0db3922ab6ab1f98df4175dad0bf2d3498da5cbb3c85720d78905e72d04188758a175adf1390893a44

Download Submit
C:\Windows\system\emTkHuM.exe

Filesize
3.0MB

MD5
c810bbd12747f2330b6737f2a90105bd

SHA1
57295f6d5b992a4f96eec7429cad553e7dd785dd

SHA256
a162bcbb8372c0ff7a44b4145507b16b67c2ec82b8bea9f1b02c4f7134f06484

SHA512
9ec68be1196f6fe6d626146ef85d68c94c4ae0707edd7639f44cd1e1c9b781e953c262b4682b58852840c2e465bd6f6d502ee593a88d6562cbceb0b9bfa03bec

Download Submit
C:\Windows\system\fHYhbXq.exe

Filesize
3.0MB

MD5
706bd90eb0e1fa0437e6f04775433b3d

SHA1
a96ddcfbc0f1fe47c7fcb3705037e0a790771d7d

SHA256
5f5c10b19a9df1715a3d0829abe649eb07b5f98e55c5e7e3ae2fc20bdea4bdcd

SHA512
1221794e9e43ba10677bd81092a94581c1976e419bb1b11dccb0af5c689667123f6afa06e6f26fd342545e6ee704612abbff7c0f73f5dcc4413e99351134f0bc

Download Submit
C:\Windows\system\fKAoCae.exe

Filesize
3.0MB

MD5
88ad6296370af3ee4ec9af6d88521fdd

SHA1
ffd52f89d6ea74d501d4163492fd1c2da06aaa78

SHA256
471264ea657c9f138fccfd9cfa0d5913b5e6eb16836264ba74c638c9bd34d80d

SHA512
e89507cca4067eb2a0bfc25c595e854e8512a444f7f4739e89941f6a724c6cf1973f9ca6e906641a9adb14acccd384b9d94eb1acc904a4e3d0b2bd696f4951a7

Download Submit
C:\Windows\system\gPBibuV.exe

Filesize
3.0MB

MD5
3b7a00a43f3c9e4722f84c9eccfdaa70

SHA1
d4965611e5000c63c987a5e1e256874d6014489e

SHA256
83a4af6f96e29a0ce5ed4d50513714aaf1a05a7aafa43df5d8d19aeef21b684f

SHA512
2faafc95fd16cefc061e43342f0881459d2410780ae5bf168298e38abf6bb18a0d38c3aa28a883810cc684a354ecf4fcff1cd4bafa1d7d38afe82984ed9da325

Download Submit
C:\Windows\system\gVAkTIs.exe

Filesize
3.0MB

MD5
4e140ba1999500a2f34df30d73611fbe

SHA1
8ff580e2745e34561c2f22475c024c10e3274b14

SHA256
fac13d9cbda806ac4696978754b6aa72b683ed3e04c2db998758869501a1a2dc

SHA512
82aa6a6f9cb7452f5a5bf7f76fda5526e28cef7b477e11e09f194ad5fb5f57ee16ae1232155eafb925f1f3e37314c2c75222fe5b49bcbd74e7cab7ec69af77f8

Download Submit
C:\Windows\system\icYubGG.exe

Filesize
3.0MB

MD5
90e8e308698ab86726182337be532e66

SHA1
308e1a7965a4d67e6498ec413bcb1c5680f3c6b2

SHA256
644a5989a93f0a8dcfe844b31c634206e45ef4820c5031a664bd938f10a4f85a

SHA512
02e35de941efb4e5e4c5bce7647cfc8424e2619c1c6f8bc40eae82df24ece045d959e0fd3f7c985180f123bb5e6726b56569439eda1acc850cd2b4cb7d5572df

Download Submit
C:\Windows\system\kXpWsdZ.exe

Filesize
3.0MB

MD5
c83103dd2f4a2c71942bf24772ae574d

SHA1
b7a529054dc10bc2d0201d79c2c2bfb04bb351f8

SHA256
321308e0210a2516cd54ac8cc014333b9c7aab097b64d460ac78118ca0777e09

SHA512
51390076b44e2d40548f9fc1d8504ef4533ded53086f8f4319954a2eb76ddd04de2e90c6ca92e80e956d42b850236e7576c6efd9bdb9924170a3ad0f4b8f2808

Download Submit
C:\Windows\system\lWsqlBQ.exe

Filesize
3.0MB

MD5
2da815c4f572c92b7a081d2330aa777b

SHA1
bd764d2bbd69b33156b9466bb2787eb82e3879ae

SHA256
0614e89ce07325dc94cc252f9a62b8879fa33cec136e85640afe3edbdcf52aa5

SHA512
be57968be7e6cfd9f41f3c9dc5f2a6254a7886e76bece2f6a354e3e44c9d9c32ff277fc33eeb353eb1ed25ed486758c409e2a1abc46f2af006a0d3b55ba43997

Download Submit
C:\Windows\system\mDMyHhA.exe

Filesize
3.0MB

MD5
1e30409d93283a9bb33ec64a25fe4970

SHA1
25e3a3cb0b92ea55d973306e20dc7d9e9484b30d

SHA256
4e168d1ac522caffcd651ad1eb80cfb7a2b103998681fd2990fa747a88bd8906

SHA512
6f12511df225aeaf15e3a85bee065d2b7e94dbb6c04a5320abdecfa688a99fefe93ce1fa8425f4996e16c7ea2b4ea4ea8747cd8f72c727696ebafe0fde20c21b

Download Submit
C:\Windows\system\mmmXuFl.exe

Filesize
3.0MB

MD5
4d255ca9180d724e4193d48149a13848

SHA1
cb60d556ffdfaf7942dc235adbdad98db91e9c71

SHA256
6353c533e5ff3cee17c787d94ff75f0a092dcfbc6cf63552bf941a1bc8a55847

SHA512
a09dc12a25c49ad3b98ce00bc68589fcbff4579bc4e0b74aea6fcb1f3b9869df8f0afa393f18c21d846adae867086c55e487206f02b1d11828704f2c43e72fe3

Download Submit
C:\Windows\system\nlSFnwK.exe

Filesize
3.0MB

MD5
975d5f60307c08b2488e99ec8743d905

SHA1
c1fb68a672e57f72ae99d5cf99bb5c7ed5eb8a6c

SHA256
d8f3d9703786ec511a8ee4270da8300a8c6aaa5e429cb5c583100424e221c76e

SHA512
2a85a38ea194792f701fa3b6caf1e2f177be4f083b8e51369ddd457ecee4558c3c177a8d177fc52f1df8ef9a4c92acb902542134dd30e3108299ea3344f0fc90

Download Submit
C:\Windows\system\rpCthlm.exe

Filesize
3.0MB

MD5
d97d98d14b835ee27eb1824c6b83f4f1

SHA1
6db7b4490a37a70602324d865116e610b1a24ae8

SHA256
f6c186af89670ed2a21c24a82dfc8a2e3237f84be31f7df665af1ba86bbb12b0

SHA512
e8baa25e8dffd3f1acb27e949b3275720d1bbd967d2b1f22ba362cb85449d85c2096343f06cf9faa95f6821f5370ce0477f07e569f391077c46e335213b26710

Download Submit
C:\Windows\system\rrnyzMF.exe

Filesize
3.0MB

MD5
f078715f2a122bba694f12227aad7892

SHA1
64f96cd5e0eff0ebe80f50f7340c5fa86ed13661

SHA256
84a8172c9d8c38a14367a60e74632267f0148787b44d96cfdf3a2feb8808e325

SHA512
9ac303bc7305f7d0eb5ce9b4aedfbb3abce7569345c02a7af4de7fe63cff0e51cb9788233bc1e1f0aae886cfef4e91360c1fbd639119f19250fb93883e345249

Download Submit
C:\Windows\system\sWXhrsf.exe

Filesize
3.0MB

MD5
52bfa4d3abb0f6b549f26a4460d0fe98

SHA1
e9d62947d53fdabb85525452804d75705daae99d

SHA256
ab042cf84d8ab068b837b2c5e8d5e6c83fca30915a176c1d0b6de93dabd86230

SHA512
365691db6fef2d57a79c244a30c253077168ce2ea7c247c29f7f518287ee19bf8f58481eab853d71ad7f31e7074964214aa1cc2607285bc6f97c8ea020289ed5

Download Submit
C:\Windows\system\yBjcsBI.exe

Filesize
3.0MB

MD5
9d4630e29276a83f1e2066f85d0dc7bf

SHA1
1c5a1e398fc5627ec0b9c4a9aea101d6e761bcc9

SHA256
3f1ad385de654de10dfee8d4943e7a0f4a36c1e5dccf8b7e9fb49574bfd66508

SHA512
41028960e3ed78ce0eba128fcc675b8f114f39a39c86f859c45246fcee94658faa35d360f7d134fefcd2fd8cdbe3221dbdda6b5b02f0553fcca017b3c9702695

Download Submit
C:\Windows\system\yFcluVn.exe

Filesize
3.0MB

MD5
6ef741d0c42bd04afeaf64dc7ecaf251

SHA1
2896919136bbe9f5d05f881dd6ba1a92bb559e16

SHA256
459de2ecf88b32b7118549f422739986fe1577acbcd20ce196163ce49570f971

SHA512
0a440dab9592456f4cc0d477254dccc192e0edecfcb0b47fbbf02aede664b4c0034c36c722b1d00d21d46daa2a7b834efa15e1bfc21322e427d581434d6474c9

Download Submit
C:\Windows\system\yZPehld.exe

Filesize
3.0MB

MD5
1dad0217dfa0d65837420264f4053d32

SHA1
4500590dd9da12b78856409484ef17ddd0e01c6b

SHA256
d62b1bad8b64cd44f5d26de50f77cf987f25c7ce2c24ae02a2bfb202be199c5d

SHA512
d5a8a2d12761720bb9210915836298ddf8c64f4131aa7b2dccfb8b5ccc3921c78293b5d36e6c48e3bfaa43941fd9a7c6e6b41061c57c8f2bd24266e3407eed30

Download Submit
C:\Windows\system\yuZZDMJ.exe

Filesize
3.0MB

MD5
35d17115d257a7a37d6243a28c41271d

SHA1
543f209b4b47f3713afbb0cb9390020c18feab99

SHA256
1133c001fdda911aa4c8e157b7d0e2fdb6fdedf9d9643f7956dcc9103200e590

SHA512
11fbbfd6a190ddb4957ab358ec36064449817589a3b232a6b6757733eefe405d26699729ef92291345d880dcd71f44d1f06eebf3717805de28a4bd87212f6b8a

Download Submit
\Windows\system\oZRNexh.exe

Filesize
3.0MB

MD5
4ebb813f1e0d04a4295604754a9dcef2

SHA1
a70a280cf91eca9e04df347b399950f81dbd8a7f

SHA256
bcfa1fbec6d1f1643f0b23cdaeea2ca20e527095fafc8489a0acf702ede3c780

SHA512
cfbd683d94fbc06c51e8a9baa9a2b09e293395f14a055c90f26dfc772f6d7d633398634e31cfdbd5fa3531f1477da0146f0df121dd3ce37261006bdc9dd464d4

Download Submit
\Windows\system\twtvgAf.exe

Filesize
3.0MB

MD5
bf29258aeef37f5bd5e1245ce584b466

SHA1
da201cf0f500db3819feeceb27013a8a62108884

SHA256
1d89453b7586082fc942b7b103ef9a3bf9a53c4aded1252a3a8cea33c78bb4a8

SHA512
35eae60f32dd8e9f859231bb212e5824fc01391c081492aa0ba05473d47011fca0220541dfac7aa0456b263bab0efeed3e7579ff18db1e09f93f65cc9814c63b

Download Submit
memory/344-2397-0x000000013F390000-0x000000013F786000-memory.dmp

Filesize
4.0MB

Download
memory/344-105-0x000000013F390000-0x000000013F786000-memory.dmp

Filesize
4.0MB

Download
memory/776-2386-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/776-99-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/1488-113-0x000000013F300000-0x000000013F6F6000-memory.dmp

Filesize
4.0MB

Download
memory/1488-2439-0x000000013F300000-0x000000013F6F6000-memory.dmp

Filesize
4.0MB

Download
memory/1664-110-0x000000013FDC0000-0x00000001401B6000-memory.dmp

Filesize
4.0MB

Download
memory/1664-2443-0x000000013FDC0000-0x00000001401B6000-memory.dmp

Filesize
4.0MB

Download
memory/1900-2382-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/1900-27-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/1960-115-0x000000013F380000-0x000000013F776000-memory.dmp

Filesize
4.0MB

Download
memory/1960-2445-0x000000013F380000-0x000000013F776000-memory.dmp

Filesize
4.0MB

Download
memory/2372-2383-0x000000013F660000-0x000000013FA56000-memory.dmp

Filesize
4.0MB

Download
memory/2372-83-0x000000013F660000-0x000000013FA56000-memory.dmp

Filesize
4.0MB

Download
memory/2420-85-0x000000013F090000-0x000000013F486000-memory.dmp

Filesize
4.0MB

Download
memory/2420-2396-0x000000013F090000-0x000000013F486000-memory.dmp

Filesize
4.0MB

Download
memory/2504-2379-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2504-9-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2764-2380-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2764-20-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2820-90-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2820-2405-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2940-76-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2940-60-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2940-116-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2940-28-0x000007FEF632E000-0x000007FEF632F000-memory.dmp

Filesize
4KB

Download
memory/2940-78-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2940-57-0x000000001B290000-0x000000001B572000-memory.dmp

Filesize
2.9MB

Download
memory/2940-582-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2988-26-0x0000000002E50000-0x0000000003246000-memory.dmp

Filesize
4.0MB

Download
memory/2988-94-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-8-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2988-1-0x000000013F390000-0x000000013F786000-memory.dmp

Filesize
4.0MB

Download
memory/2988-1709-0x000000013F390000-0x000000013F786000-memory.dmp

Filesize
4.0MB

Download
memory/2988-2260-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2988-79-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-84-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-86-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-91-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-2804-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2988-111-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-114-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-15-0x0000000002E50000-0x0000000003246000-memory.dmp

Filesize
4.0MB

Download
memory/2988-100-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-2810-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/2988-106-0x000000013FDC0000-0x00000001401B6000-memory.dmp

Filesize
4.0MB

Download
memory/2988-2808-0x0000000002F80000-0x0000000003376000-memory.dmp

Filesize
4.0MB

Download
memory/3068-2440-0x000000013F1E0000-0x000000013F5D6000-memory.dmp

Filesize
4.0MB

Download
memory/3068-93-0x000000013F1E0000-0x000000013F5D6000-memory.dmp

Filesize
4.0MB

Download