xmrig | 46d5c28cb9d61d21f0e1dfee8bfae80f250f6aa7fa467499e5d06b07db183535

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
Size

1.2MB
MD5

5a00d107948bec6234ad53bbe517fc40
SHA1

2d7dbe962c534b905e74f818d57807808295751b
SHA256

46d5c28cb9d61d21f0e1dfee8bfae80f250f6aa7fa467499e5d06b07db183535
SHA512

9ede28efcc0057b728313d62afabbc618ec24797a704ca41818940cab63f813c1807093fdc4153acb6e833e96f30753dad1cde0f4783b1be4d8e65f2313aec09
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMk+AWe9qyCApCPRlfQ:Lz071uv4BPMk+QqPlo

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/608-409-0x00007FF7EB6E0000-0x00007FF7EBAD2000-memory.dmp	xmrig
behavioral2/memory/2168-412-0x00007FF65DBC0000-0x00007FF65DFB2000-memory.dmp	xmrig
behavioral2/memory/1832-413-0x00007FF6ECB00000-0x00007FF6ECEF2000-memory.dmp	xmrig
behavioral2/memory/4644-414-0x00007FF753030000-0x00007FF753422000-memory.dmp	xmrig
behavioral2/memory/4288-415-0x00007FF629C40000-0x00007FF62A032000-memory.dmp	xmrig
behavioral2/memory/4744-416-0x00007FF79FE50000-0x00007FF7A0242000-memory.dmp	xmrig
behavioral2/memory/372-417-0x00007FF7775A0000-0x00007FF777992000-memory.dmp	xmrig
behavioral2/memory/1668-418-0x00007FF78A290000-0x00007FF78A682000-memory.dmp	xmrig
behavioral2/memory/4808-419-0x00007FF701EE0000-0x00007FF7022D2000-memory.dmp	xmrig
behavioral2/memory/5104-411-0x00007FF6E21A0000-0x00007FF6E2592000-memory.dmp	xmrig
behavioral2/memory/1476-84-0x00007FF6F42E0000-0x00007FF6F46D2000-memory.dmp	xmrig
behavioral2/memory/1856-83-0x00007FF79D580000-0x00007FF79D972000-memory.dmp	xmrig
behavioral2/memory/1992-80-0x00007FF6F7330000-0x00007FF6F7722000-memory.dmp	xmrig
behavioral2/memory/4800-79-0x00007FF79EB40000-0x00007FF79EF32000-memory.dmp	xmrig
behavioral2/memory/4536-76-0x00007FF76EB80000-0x00007FF76EF72000-memory.dmp	xmrig
behavioral2/memory/3696-58-0x00007FF722360000-0x00007FF722752000-memory.dmp	xmrig
behavioral2/memory/3932-3616-0x00007FF7A9040000-0x00007FF7A9432000-memory.dmp	xmrig
behavioral2/memory/2084-3625-0x00007FF716940000-0x00007FF716D32000-memory.dmp	xmrig
behavioral2/memory/3932-5331-0x00007FF7A9040000-0x00007FF7A9432000-memory.dmp	xmrig
behavioral2/memory/4800-5340-0x00007FF79EB40000-0x00007FF79EF32000-memory.dmp	xmrig
behavioral2/memory/4592-5344-0x00007FF63EE00000-0x00007FF63F1F2000-memory.dmp	xmrig
behavioral2/memory/4644-5368-0x00007FF753030000-0x00007FF753422000-memory.dmp	xmrig
behavioral2/memory/4288-5372-0x00007FF629C40000-0x00007FF62A032000-memory.dmp	xmrig
behavioral2/memory/1832-5366-0x00007FF6ECB00000-0x00007FF6ECEF2000-memory.dmp	xmrig
behavioral2/memory/2168-5362-0x00007FF65DBC0000-0x00007FF65DFB2000-memory.dmp	xmrig
behavioral2/memory/608-5360-0x00007FF7EB6E0000-0x00007FF7EBAD2000-memory.dmp	xmrig
behavioral2/memory/5104-5358-0x00007FF6E21A0000-0x00007FF6E2592000-memory.dmp	xmrig
behavioral2/memory/1476-5352-0x00007FF6F42E0000-0x00007FF6F46D2000-memory.dmp	xmrig
behavioral2/memory/1856-5350-0x00007FF79D580000-0x00007FF79D972000-memory.dmp	xmrig
behavioral2/memory/1992-5342-0x00007FF6F7330000-0x00007FF6F7722000-memory.dmp	xmrig
behavioral2/memory/4056-5337-0x00007FF6E5F80000-0x00007FF6E6372000-memory.dmp	xmrig
behavioral2/memory/4536-5330-0x00007FF76EB80000-0x00007FF76EF72000-memory.dmp	xmrig
behavioral2/memory/3696-5333-0x00007FF722360000-0x00007FF722752000-memory.dmp	xmrig
behavioral2/memory/764-5327-0x00007FF66F4A0000-0x00007FF66F892000-memory.dmp	xmrig
behavioral2/memory/3300-5317-0x00007FF7E3F70000-0x00007FF7E4362000-memory.dmp	xmrig
behavioral2/memory/2476-5316-0x00007FF7A93F0000-0x00007FF7A97E2000-memory.dmp	xmrig
behavioral2/memory/5044-5314-0x00007FF76A310000-0x00007FF76A702000-memory.dmp	xmrig
behavioral2/memory/372-5947-0x00007FF7775A0000-0x00007FF777992000-memory.dmp	xmrig
behavioral2/memory/4744-5382-0x00007FF79FE50000-0x00007FF7A0242000-memory.dmp	xmrig
behavioral2/memory/2084-6020-0x00007FF716940000-0x00007FF716D32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	3628	powershell.exe
10	3628	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3628	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3300	pMmVssC.exe
2476	ybnlpRv.exe
5044	jxTpRpv.exe
764	XLodkRW.exe
4536	LEBNkJs.exe
3932	TiDchIC.exe
3696	InzDjYn.exe
4800	yPUNAET.exe
1992	HINShDU.exe
4056	YKdeVQN.exe
4592	ovbCJsM.exe
2084	jiDuZtw.exe
1856	YCVevtn.exe
1476	jDhWBmW.exe
608	taxYzsZ.exe
5104	QtvLZZb.exe
2168	iLMdfFS.exe
1832	nxOdrWE.exe
4644	eRoSsSj.exe
4288	pgREbXE.exe
4744	bxmHcSR.exe
372	jHwzJIE.exe
1668	fGNfWrL.exe
4808	uvyaeNt.exe
1952	SyzGIyE.exe
4040	kaSrFkq.exe
4344	qeEMAoo.exe
4120	grkfYdZ.exe
4700	LdWAcAl.exe
5032	mpjIaMK.exe
1956	eTYuCWu.exe
2788	TIAwIAf.exe
4828	iVFDIjF.exe
4508	dtlXJKj.exe
2076	ebwhKzg.exe
5112	HXnxVGg.exe
264	ICDOTEo.exe
3720	XyvizLw.exe
4324	hDeehId.exe
1204	itkVqGM.exe
4520	uAnZXJj.exe
1188	VmRFtFv.exe
5132	eIRYXWe.exe
5160	OsaFhRc.exe
5216	WzUWCkz.exe
5236	GqIHDSw.exe
5260	bVaOPlW.exe
5284	MYKpiDe.exe
5308	XRxkwLS.exe
5340	GmXvERH.exe
5364	MgVrFRr.exe
5392	QZksgdO.exe
5416	KJmGnLi.exe
5448	ZQojqIA.exe
5476	GVMDfKw.exe
5504	AedyBMP.exe
5532	VTWbrpw.exe
5560	xYjSvfI.exe
5588	RIjfIuP.exe
5616	rRxpcaa.exe
5644	IHIYjnO.exe
5672	HHjpbDL.exe
5708	iTBOJoC.exe
5732	pBiZwxw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4696-0-0x00007FF78C420000-0x00007FF78C812000-memory.dmp	upx
behavioral2/files/0x0007000000023524-6.dat	upx
behavioral2/files/0x0007000000023523-7.dat	upx
behavioral2/memory/5044-17-0x00007FF76A310000-0x00007FF76A702000-memory.dmp	upx
behavioral2/files/0x0007000000023525-27.dat	upx
behavioral2/files/0x0007000000023528-35.dat	upx
behavioral2/memory/3932-51-0x00007FF7A9040000-0x00007FF7A9432000-memory.dmp	upx
behavioral2/files/0x0007000000023529-59.dat	upx
behavioral2/files/0x000700000002352c-68.dat	upx
behavioral2/files/0x000700000002352e-71.dat	upx
behavioral2/files/0x0007000000023531-101.dat	upx
behavioral2/files/0x0007000000023535-133.dat	upx
behavioral2/files/0x0007000000023539-148.dat	upx
behavioral2/files/0x000700000002353e-165.dat	upx
behavioral2/files/0x0007000000023541-188.dat	upx
behavioral2/memory/608-409-0x00007FF7EB6E0000-0x00007FF7EBAD2000-memory.dmp	upx
behavioral2/memory/2168-412-0x00007FF65DBC0000-0x00007FF65DFB2000-memory.dmp	upx
behavioral2/memory/1832-413-0x00007FF6ECB00000-0x00007FF6ECEF2000-memory.dmp	upx
behavioral2/memory/4644-414-0x00007FF753030000-0x00007FF753422000-memory.dmp	upx
behavioral2/memory/4288-415-0x00007FF629C40000-0x00007FF62A032000-memory.dmp	upx
behavioral2/memory/4744-416-0x00007FF79FE50000-0x00007FF7A0242000-memory.dmp	upx
behavioral2/memory/372-417-0x00007FF7775A0000-0x00007FF777992000-memory.dmp	upx
behavioral2/memory/1668-418-0x00007FF78A290000-0x00007FF78A682000-memory.dmp	upx
behavioral2/memory/4808-419-0x00007FF701EE0000-0x00007FF7022D2000-memory.dmp	upx
behavioral2/memory/5104-411-0x00007FF6E21A0000-0x00007FF6E2592000-memory.dmp	upx
behavioral2/files/0x0007000000023542-185.dat	upx
behavioral2/files/0x0007000000023540-183.dat	upx
behavioral2/files/0x000700000002353f-178.dat	upx
behavioral2/files/0x000700000002353d-168.dat	upx
behavioral2/files/0x000700000002353c-163.dat	upx
behavioral2/files/0x000700000002353b-158.dat	upx
behavioral2/files/0x000700000002353a-153.dat	upx
behavioral2/files/0x0008000000023538-143.dat	upx
behavioral2/files/0x0007000000023536-138.dat	upx
behavioral2/files/0x0007000000023534-126.dat	upx
behavioral2/files/0x0007000000023533-111.dat	upx
behavioral2/files/0x0007000000023532-106.dat	upx
behavioral2/files/0x0007000000023530-96.dat	upx
behavioral2/files/0x0008000000023520-91.dat	upx
behavioral2/memory/1476-84-0x00007FF6F42E0000-0x00007FF6F46D2000-memory.dmp	upx
behavioral2/memory/1856-83-0x00007FF79D580000-0x00007FF79D972000-memory.dmp	upx
behavioral2/files/0x000700000002352f-81.dat	upx
behavioral2/memory/1992-80-0x00007FF6F7330000-0x00007FF6F7722000-memory.dmp	upx
behavioral2/memory/4800-79-0x00007FF79EB40000-0x00007FF79EF32000-memory.dmp	upx
behavioral2/memory/4536-76-0x00007FF76EB80000-0x00007FF76EF72000-memory.dmp	upx
behavioral2/memory/2084-74-0x00007FF716940000-0x00007FF716D32000-memory.dmp	upx
behavioral2/memory/4592-70-0x00007FF63EE00000-0x00007FF63F1F2000-memory.dmp	upx
behavioral2/memory/4056-65-0x00007FF6E5F80000-0x00007FF6E6372000-memory.dmp	upx
behavioral2/files/0x000700000002352b-62.dat	upx
behavioral2/files/0x000700000002352a-60.dat	upx
behavioral2/memory/3696-58-0x00007FF722360000-0x00007FF722752000-memory.dmp	upx
behavioral2/files/0x000700000002352d-57.dat	upx
behavioral2/files/0x0007000000023527-39.dat	upx
behavioral2/memory/764-38-0x00007FF66F4A0000-0x00007FF66F892000-memory.dmp	upx
behavioral2/files/0x0007000000023526-34.dat	upx
behavioral2/files/0x000800000002351f-19.dat	upx
behavioral2/memory/2476-13-0x00007FF7A93F0000-0x00007FF7A97E2000-memory.dmp	upx
behavioral2/memory/3300-11-0x00007FF7E3F70000-0x00007FF7E4362000-memory.dmp	upx
behavioral2/memory/3932-3616-0x00007FF7A9040000-0x00007FF7A9432000-memory.dmp	upx
behavioral2/memory/2084-3625-0x00007FF716940000-0x00007FF716D32000-memory.dmp	upx
behavioral2/memory/3932-5331-0x00007FF7A9040000-0x00007FF7A9432000-memory.dmp	upx
behavioral2/memory/4800-5340-0x00007FF79EB40000-0x00007FF79EF32000-memory.dmp	upx
behavioral2/memory/4592-5344-0x00007FF63EE00000-0x00007FF63F1F2000-memory.dmp	upx
behavioral2/memory/4644-5368-0x00007FF753030000-0x00007FF753422000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NpqmYRV.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\dHcdNzy.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\wWhTGCx.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\wFOVvyR.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\nyDDKRJ.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\DQqNAAZ.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\HridsGJ.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\SsobQFk.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\eAWKSZj.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\bmwShHq.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\dKvbnfg.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\TqBWIeP.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\ptDjwIH.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\RGZUEPC.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\AyHThWt.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\UbAdUfX.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\XbDCwPJ.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\oPWbxxZ.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\PYpTyMt.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\sIYMaAl.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\mNMcgLK.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\IHIYjnO.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\goTZgrs.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\jXwMBgh.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\CPbWEax.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\tMOQUZd.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\HonhBgW.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\sCSyoHM.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\NjWwyeK.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\UNacxAF.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\YdqGnry.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\SBrznMS.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\oaFuAeX.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\yaShUHt.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\kRaFZip.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\TRbaUzo.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\ZxzJgwO.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\LJwTQeJ.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\JznPbfT.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\SgaGhZD.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\dWIkPGc.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\iDaEDfN.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\YUMwDPt.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\DICdYvq.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\plLrDTW.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\UATDOjS.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\NZqMTma.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\haOoZlk.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\BzmeFNi.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\oCpsapY.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\UTFqHkz.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\FDLsRRJ.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\SrhyyxX.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\tBUsWFJ.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\BhMlFPL.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\SCoHlXY.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\WYpZGks.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\sHLReYs.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\mYLSmeO.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\VePwuvH.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\EAsBrHa.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\Estpduz.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\stkSLjI.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
File created	C:\Windows\System\IOtETyj.exe	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeCreateGlobalPrivilege	14152	dwm.exe
Token: SeChangeNotifyPrivilege	14152	dwm.exe
Token: 33	14152	dwm.exe
Token: SeIncBasePriorityPrivilege	14152	dwm.exe
Token: SeShutdownPrivilege	14152	dwm.exe
Token: SeCreatePagefilePrivilege	14152	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3628	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	92
PID 4696 wrote to memory of 3628	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	92
PID 4696 wrote to memory of 2476	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	93
PID 4696 wrote to memory of 2476	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	93
PID 4696 wrote to memory of 3300	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	94
PID 4696 wrote to memory of 3300	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	94
PID 4696 wrote to memory of 5044	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	95
PID 4696 wrote to memory of 5044	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	95
PID 4696 wrote to memory of 764	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	96
PID 4696 wrote to memory of 764	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	96
PID 4696 wrote to memory of 4536	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	97
PID 4696 wrote to memory of 4536	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	97
PID 4696 wrote to memory of 3932	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	98
PID 4696 wrote to memory of 3932	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	98
PID 4696 wrote to memory of 3696	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	99
PID 4696 wrote to memory of 3696	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	99
PID 4696 wrote to memory of 4800	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	100
PID 4696 wrote to memory of 4800	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	100
PID 4696 wrote to memory of 1992	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	101
PID 4696 wrote to memory of 1992	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	101
PID 4696 wrote to memory of 4056	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	102
PID 4696 wrote to memory of 4056	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	102
PID 4696 wrote to memory of 4592	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	103
PID 4696 wrote to memory of 4592	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	103
PID 4696 wrote to memory of 2084	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	104
PID 4696 wrote to memory of 2084	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	104
PID 4696 wrote to memory of 1856	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	105
PID 4696 wrote to memory of 1856	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	105
PID 4696 wrote to memory of 1476	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	106
PID 4696 wrote to memory of 1476	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	106
PID 4696 wrote to memory of 608	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	107
PID 4696 wrote to memory of 608	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	107
PID 4696 wrote to memory of 5104	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	108
PID 4696 wrote to memory of 5104	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	108
PID 4696 wrote to memory of 2168	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	109
PID 4696 wrote to memory of 2168	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	109
PID 4696 wrote to memory of 1832	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	110
PID 4696 wrote to memory of 1832	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	110
PID 4696 wrote to memory of 4644	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	111
PID 4696 wrote to memory of 4644	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	111
PID 4696 wrote to memory of 4288	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	112
PID 4696 wrote to memory of 4288	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	112
PID 4696 wrote to memory of 4744	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	113
PID 4696 wrote to memory of 4744	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	113
PID 4696 wrote to memory of 372	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	114
PID 4696 wrote to memory of 372	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	114
PID 4696 wrote to memory of 1668	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	115
PID 4696 wrote to memory of 1668	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	115
PID 4696 wrote to memory of 4808	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	116
PID 4696 wrote to memory of 4808	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	116
PID 4696 wrote to memory of 1952	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	117
PID 4696 wrote to memory of 1952	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	117
PID 4696 wrote to memory of 4040	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	118
PID 4696 wrote to memory of 4040	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	118
PID 4696 wrote to memory of 4344	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	119
PID 4696 wrote to memory of 4344	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	119
PID 4696 wrote to memory of 4120	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	120
PID 4696 wrote to memory of 4120	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	120
PID 4696 wrote to memory of 4700	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	121
PID 4696 wrote to memory of 4700	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	121
PID 4696 wrote to memory of 5032	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	122
PID 4696 wrote to memory of 5032	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	122
PID 4696 wrote to memory of 1956	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	123
PID 4696 wrote to memory of 1956	4696	5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5a00d107948bec6234ad53bbe517fc40_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3628" "2940" "2876" "2944" "0" "0" "2948" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3360
- C:\Windows\System\ybnlpRv.exe
  C:\Windows\System\ybnlpRv.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\pMmVssC.exe
  C:\Windows\System\pMmVssC.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\jxTpRpv.exe
  C:\Windows\System\jxTpRpv.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\XLodkRW.exe
  C:\Windows\System\XLodkRW.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\LEBNkJs.exe
  C:\Windows\System\LEBNkJs.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\TiDchIC.exe
  C:\Windows\System\TiDchIC.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\InzDjYn.exe
  C:\Windows\System\InzDjYn.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\yPUNAET.exe
  C:\Windows\System\yPUNAET.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\HINShDU.exe
  C:\Windows\System\HINShDU.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\YKdeVQN.exe
  C:\Windows\System\YKdeVQN.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\ovbCJsM.exe
  C:\Windows\System\ovbCJsM.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\jiDuZtw.exe
  C:\Windows\System\jiDuZtw.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\YCVevtn.exe
  C:\Windows\System\YCVevtn.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\jDhWBmW.exe
  C:\Windows\System\jDhWBmW.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\taxYzsZ.exe
  C:\Windows\System\taxYzsZ.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\QtvLZZb.exe
  C:\Windows\System\QtvLZZb.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\iLMdfFS.exe
  C:\Windows\System\iLMdfFS.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\nxOdrWE.exe
  C:\Windows\System\nxOdrWE.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\eRoSsSj.exe
  C:\Windows\System\eRoSsSj.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\pgREbXE.exe
  C:\Windows\System\pgREbXE.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\bxmHcSR.exe
  C:\Windows\System\bxmHcSR.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\jHwzJIE.exe
  C:\Windows\System\jHwzJIE.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\fGNfWrL.exe
  C:\Windows\System\fGNfWrL.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\uvyaeNt.exe
  C:\Windows\System\uvyaeNt.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\SyzGIyE.exe
  C:\Windows\System\SyzGIyE.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\kaSrFkq.exe
  C:\Windows\System\kaSrFkq.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\qeEMAoo.exe
  C:\Windows\System\qeEMAoo.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\grkfYdZ.exe
  C:\Windows\System\grkfYdZ.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\LdWAcAl.exe
  C:\Windows\System\LdWAcAl.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\mpjIaMK.exe
  C:\Windows\System\mpjIaMK.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\eTYuCWu.exe
  C:\Windows\System\eTYuCWu.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\TIAwIAf.exe
  C:\Windows\System\TIAwIAf.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\iVFDIjF.exe
  C:\Windows\System\iVFDIjF.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\dtlXJKj.exe
  C:\Windows\System\dtlXJKj.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\ebwhKzg.exe
  C:\Windows\System\ebwhKzg.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\HXnxVGg.exe
  C:\Windows\System\HXnxVGg.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\ICDOTEo.exe
  C:\Windows\System\ICDOTEo.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\XyvizLw.exe
  C:\Windows\System\XyvizLw.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\hDeehId.exe
  C:\Windows\System\hDeehId.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\itkVqGM.exe
  C:\Windows\System\itkVqGM.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\uAnZXJj.exe
  C:\Windows\System\uAnZXJj.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\VmRFtFv.exe
  C:\Windows\System\VmRFtFv.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\eIRYXWe.exe
  C:\Windows\System\eIRYXWe.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\OsaFhRc.exe
  C:\Windows\System\OsaFhRc.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\WzUWCkz.exe
  C:\Windows\System\WzUWCkz.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\GqIHDSw.exe
  C:\Windows\System\GqIHDSw.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\bVaOPlW.exe
  C:\Windows\System\bVaOPlW.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\MYKpiDe.exe
  C:\Windows\System\MYKpiDe.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\XRxkwLS.exe
  C:\Windows\System\XRxkwLS.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\GmXvERH.exe
  C:\Windows\System\GmXvERH.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\MgVrFRr.exe
  C:\Windows\System\MgVrFRr.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\QZksgdO.exe
  C:\Windows\System\QZksgdO.exe
  2⤵
  - Executes dropped EXE
  PID:5392
- C:\Windows\System\KJmGnLi.exe
  C:\Windows\System\KJmGnLi.exe
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Windows\System\ZQojqIA.exe
  C:\Windows\System\ZQojqIA.exe
  2⤵
  - Executes dropped EXE
  PID:5448
- C:\Windows\System\GVMDfKw.exe
  C:\Windows\System\GVMDfKw.exe
  2⤵
  - Executes dropped EXE
  PID:5476
- C:\Windows\System\AedyBMP.exe
  C:\Windows\System\AedyBMP.exe
  2⤵
  - Executes dropped EXE
  PID:5504
- C:\Windows\System\VTWbrpw.exe
  C:\Windows\System\VTWbrpw.exe
  2⤵
  - Executes dropped EXE
  PID:5532
- C:\Windows\System\xYjSvfI.exe
  C:\Windows\System\xYjSvfI.exe
  2⤵
  - Executes dropped EXE
  PID:5560
- C:\Windows\System\RIjfIuP.exe
  C:\Windows\System\RIjfIuP.exe
  2⤵
  - Executes dropped EXE
  PID:5588
- C:\Windows\System\rRxpcaa.exe
  C:\Windows\System\rRxpcaa.exe
  2⤵
  - Executes dropped EXE
  PID:5616
- C:\Windows\System\IHIYjnO.exe
  C:\Windows\System\IHIYjnO.exe
  2⤵
  - Executes dropped EXE
  PID:5644
- C:\Windows\System\HHjpbDL.exe
  C:\Windows\System\HHjpbDL.exe
  2⤵
  - Executes dropped EXE
  PID:5672
- C:\Windows\System\iTBOJoC.exe
  C:\Windows\System\iTBOJoC.exe
  2⤵
  - Executes dropped EXE
  PID:5708
- C:\Windows\System\pBiZwxw.exe
  C:\Windows\System\pBiZwxw.exe
  2⤵
  - Executes dropped EXE
  PID:5732
- C:\Windows\System\ZlnJIIw.exe
  C:\Windows\System\ZlnJIIw.exe
  2⤵
  PID:5760
- C:\Windows\System\fEqDPqo.exe
  C:\Windows\System\fEqDPqo.exe
  2⤵
  PID:5784
- C:\Windows\System\nfiSTHp.exe
  C:\Windows\System\nfiSTHp.exe
  2⤵
  PID:5816
- C:\Windows\System\QJySwlA.exe
  C:\Windows\System\QJySwlA.exe
  2⤵
  PID:5844
- C:\Windows\System\mdabCYb.exe
  C:\Windows\System\mdabCYb.exe
  2⤵
  PID:5868
- C:\Windows\System\Tgrlvvk.exe
  C:\Windows\System\Tgrlvvk.exe
  2⤵
  PID:5900
- C:\Windows\System\pjUFdVY.exe
  C:\Windows\System\pjUFdVY.exe
  2⤵
  PID:5932
- C:\Windows\System\ysFYIxQ.exe
  C:\Windows\System\ysFYIxQ.exe
  2⤵
  PID:5960
- C:\Windows\System\uqpZFyo.exe
  C:\Windows\System\uqpZFyo.exe
  2⤵
  PID:5988
- C:\Windows\System\gWwhbCK.exe
  C:\Windows\System\gWwhbCK.exe
  2⤵
  PID:6016
- C:\Windows\System\tSZOMEk.exe
  C:\Windows\System\tSZOMEk.exe
  2⤵
  PID:6044
- C:\Windows\System\LKMsVeN.exe
  C:\Windows\System\LKMsVeN.exe
  2⤵
  PID:6072
- C:\Windows\System\vXQTiJs.exe
  C:\Windows\System\vXQTiJs.exe
  2⤵
  PID:6104
- C:\Windows\System\ScBdMAe.exe
  C:\Windows\System\ScBdMAe.exe
  2⤵
  PID:6132
- C:\Windows\System\AMlkgTM.exe
  C:\Windows\System\AMlkgTM.exe
  2⤵
  PID:4224
- C:\Windows\System\bSYmxmb.exe
  C:\Windows\System\bSYmxmb.exe
  2⤵
  PID:4348
- C:\Windows\System\yHxiRCb.exe
  C:\Windows\System\yHxiRCb.exe
  2⤵
  PID:1040
- C:\Windows\System\ooRxHvg.exe
  C:\Windows\System\ooRxHvg.exe
  2⤵
  PID:5124
- C:\Windows\System\bLtLVhC.exe
  C:\Windows\System\bLtLVhC.exe
  2⤵
  PID:5228
- C:\Windows\System\FOJJUTY.exe
  C:\Windows\System\FOJJUTY.exe
  2⤵
  PID:5276
- C:\Windows\System\gYOTPsN.exe
  C:\Windows\System\gYOTPsN.exe
  2⤵
  PID:5356
- C:\Windows\System\jAtpTfV.exe
  C:\Windows\System\jAtpTfV.exe
  2⤵
  PID:5408
- C:\Windows\System\mZUgMgo.exe
  C:\Windows\System\mZUgMgo.exe
  2⤵
  PID:5464
- C:\Windows\System\NqWWQlv.exe
  C:\Windows\System\NqWWQlv.exe
  2⤵
  PID:5544
- C:\Windows\System\ijxzEpx.exe
  C:\Windows\System\ijxzEpx.exe
  2⤵
  PID:5580
- C:\Windows\System\QSqlZzK.exe
  C:\Windows\System\QSqlZzK.exe
  2⤵
  PID:5636
- C:\Windows\System\TZKfisT.exe
  C:\Windows\System\TZKfisT.exe
  2⤵
  PID:5716
- C:\Windows\System\SmfUkiL.exe
  C:\Windows\System\SmfUkiL.exe
  2⤵
  PID:5772
- C:\Windows\System\pVJTJTj.exe
  C:\Windows\System\pVJTJTj.exe
  2⤵
  PID:2800
- C:\Windows\System\qaRWYeS.exe
  C:\Windows\System\qaRWYeS.exe
  2⤵
  PID:5912
- C:\Windows\System\tQhHOUM.exe
  C:\Windows\System\tQhHOUM.exe
  2⤵
  PID:5976
- C:\Windows\System\AKAlFIh.exe
  C:\Windows\System\AKAlFIh.exe
  2⤵
  PID:6032
- C:\Windows\System\wKUHrmi.exe
  C:\Windows\System\wKUHrmi.exe
  2⤵
  PID:6084
- C:\Windows\System\rhVnhoP.exe
  C:\Windows\System\rhVnhoP.exe
  2⤵
  PID:4164
- C:\Windows\System\yUXsYGw.exe
  C:\Windows\System\yUXsYGw.exe
  2⤵
  PID:4300
- C:\Windows\System\kQUQkhb.exe
  C:\Windows\System\kQUQkhb.exe
  2⤵
  PID:2220
- C:\Windows\System\pEjcFeb.exe
  C:\Windows\System\pEjcFeb.exe
  2⤵
  PID:5204
- C:\Windows\System\GDTwimW.exe
  C:\Windows\System\GDTwimW.exe
  2⤵
  PID:5380
- C:\Windows\System\brxcFzZ.exe
  C:\Windows\System\brxcFzZ.exe
  2⤵
  PID:5516
- C:\Windows\System\uyaOsQK.exe
  C:\Windows\System\uyaOsQK.exe
  2⤵
  PID:5628
- C:\Windows\System\qOAHBhN.exe
  C:\Windows\System\qOAHBhN.exe
  2⤵
  PID:3964
- C:\Windows\System\asrAGKj.exe
  C:\Windows\System\asrAGKj.exe
  2⤵
  PID:5836
- C:\Windows\System\ZBqslcq.exe
  C:\Windows\System\ZBqslcq.exe
  2⤵
  PID:6008
- C:\Windows\System\nElPfDL.exe
  C:\Windows\System\nElPfDL.exe
  2⤵
  PID:6116
- C:\Windows\System\NxgRnNx.exe
  C:\Windows\System\NxgRnNx.exe
  2⤵
  PID:5692
- C:\Windows\System\elahTCv.exe
  C:\Windows\System\elahTCv.exe
  2⤵
  PID:3636
- C:\Windows\System\JmxQsEV.exe
  C:\Windows\System\JmxQsEV.exe
  2⤵
  PID:5952
- C:\Windows\System\pGyFpXS.exe
  C:\Windows\System\pGyFpXS.exe
  2⤵
  PID:5800
- C:\Windows\System\KUdDiFP.exe
  C:\Windows\System\KUdDiFP.exe
  2⤵
  PID:1588
- C:\Windows\System\HZjFZSp.exe
  C:\Windows\System\HZjFZSp.exe
  2⤵
  PID:840
- C:\Windows\System\ObeeTin.exe
  C:\Windows\System\ObeeTin.exe
  2⤵
  PID:4992
- C:\Windows\System\fbTuIJa.exe
  C:\Windows\System\fbTuIJa.exe
  2⤵
  PID:2020
- C:\Windows\System\lqBZJQe.exe
  C:\Windows\System\lqBZJQe.exe
  2⤵
  PID:2644
- C:\Windows\System\AfUWnuC.exe
  C:\Windows\System\AfUWnuC.exe
  2⤵
  PID:2624
- C:\Windows\System\qJRXHdU.exe
  C:\Windows\System\qJRXHdU.exe
  2⤵
  PID:2128
- C:\Windows\System\Ddlckpr.exe
  C:\Windows\System\Ddlckpr.exe
  2⤵
  PID:5808
- C:\Windows\System\esCfRdL.exe
  C:\Windows\System\esCfRdL.exe
  2⤵
  PID:4616
- C:\Windows\System\nmZJuIA.exe
  C:\Windows\System\nmZJuIA.exe
  2⤵
  PID:1332
- C:\Windows\System\ApUmRKl.exe
  C:\Windows\System\ApUmRKl.exe
  2⤵
  PID:4424
- C:\Windows\System\WFxRKMC.exe
  C:\Windows\System\WFxRKMC.exe
  2⤵
  PID:3452
- C:\Windows\System\CXTJpPG.exe
  C:\Windows\System\CXTJpPG.exe
  2⤵
  PID:6168
- C:\Windows\System\YdqGnry.exe
  C:\Windows\System\YdqGnry.exe
  2⤵
  PID:6272
- C:\Windows\System\pGhBZOx.exe
  C:\Windows\System\pGhBZOx.exe
  2⤵
  PID:6320
- C:\Windows\System\YhwOoXt.exe
  C:\Windows\System\YhwOoXt.exe
  2⤵
  PID:6340
- C:\Windows\System\mYVLnyy.exe
  C:\Windows\System\mYVLnyy.exe
  2⤵
  PID:6388
- C:\Windows\System\xfXxglK.exe
  C:\Windows\System\xfXxglK.exe
  2⤵
  PID:6432
- C:\Windows\System\YsPLWXr.exe
  C:\Windows\System\YsPLWXr.exe
  2⤵
  PID:6460
- C:\Windows\System\LgWmjHA.exe
  C:\Windows\System\LgWmjHA.exe
  2⤵
  PID:6476
- C:\Windows\System\OVdurxW.exe
  C:\Windows\System\OVdurxW.exe
  2⤵
  PID:6496
- C:\Windows\System\cIvAKub.exe
  C:\Windows\System\cIvAKub.exe
  2⤵
  PID:6512
- C:\Windows\System\cgZmver.exe
  C:\Windows\System\cgZmver.exe
  2⤵
  PID:6544
- C:\Windows\System\ywTfqQP.exe
  C:\Windows\System\ywTfqQP.exe
  2⤵
  PID:6564
- C:\Windows\System\vFcXVcS.exe
  C:\Windows\System\vFcXVcS.exe
  2⤵
  PID:6580
- C:\Windows\System\LhVWGuX.exe
  C:\Windows\System\LhVWGuX.exe
  2⤵
  PID:6604
- C:\Windows\System\idIHeGA.exe
  C:\Windows\System\idIHeGA.exe
  2⤵
  PID:6620
- C:\Windows\System\mDYtuGf.exe
  C:\Windows\System\mDYtuGf.exe
  2⤵
  PID:6636
- C:\Windows\System\KxVIYDs.exe
  C:\Windows\System\KxVIYDs.exe
  2⤵
  PID:6660
- C:\Windows\System\PzTDGuf.exe
  C:\Windows\System\PzTDGuf.exe
  2⤵
  PID:6676
- C:\Windows\System\JXwCNyX.exe
  C:\Windows\System\JXwCNyX.exe
  2⤵
  PID:6700
- C:\Windows\System\qaIjroL.exe
  C:\Windows\System\qaIjroL.exe
  2⤵
  PID:6720
- C:\Windows\System\nsUSbHM.exe
  C:\Windows\System\nsUSbHM.exe
  2⤵
  PID:6736
- C:\Windows\System\tuhlNqA.exe
  C:\Windows\System\tuhlNqA.exe
  2⤵
  PID:6760
- C:\Windows\System\sWqlIGX.exe
  C:\Windows\System\sWqlIGX.exe
  2⤵
  PID:6780
- C:\Windows\System\jaAVxio.exe
  C:\Windows\System\jaAVxio.exe
  2⤵
  PID:6800
- C:\Windows\System\pnnuxfB.exe
  C:\Windows\System\pnnuxfB.exe
  2⤵
  PID:6816
- C:\Windows\System\GSdewID.exe
  C:\Windows\System\GSdewID.exe
  2⤵
  PID:6840
- C:\Windows\System\SSjAaZz.exe
  C:\Windows\System\SSjAaZz.exe
  2⤵
  PID:6896
- C:\Windows\System\cGDQkPo.exe
  C:\Windows\System\cGDQkPo.exe
  2⤵
  PID:6916
- C:\Windows\System\FaNDszr.exe
  C:\Windows\System\FaNDszr.exe
  2⤵
  PID:6968
- C:\Windows\System\rqCpWTF.exe
  C:\Windows\System\rqCpWTF.exe
  2⤵
  PID:6988
- C:\Windows\System\wApMuuq.exe
  C:\Windows\System\wApMuuq.exe
  2⤵
  PID:7120
- C:\Windows\System\PnZYwCB.exe
  C:\Windows\System\PnZYwCB.exe
  2⤵
  PID:552
- C:\Windows\System\DZZWQQw.exe
  C:\Windows\System\DZZWQQw.exe
  2⤵
  PID:2236
- C:\Windows\System\ZgxmXYH.exe
  C:\Windows\System\ZgxmXYH.exe
  2⤵
  PID:5176
- C:\Windows\System\vZonWCr.exe
  C:\Windows\System\vZonWCr.exe
  2⤵
  PID:6160
- C:\Windows\System\tounDRl.exe
  C:\Windows\System\tounDRl.exe
  2⤵
  PID:6316
- C:\Windows\System\wIqrFkB.exe
  C:\Windows\System\wIqrFkB.exe
  2⤵
  PID:6268
- C:\Windows\System\BkfQrUu.exe
  C:\Windows\System\BkfQrUu.exe
  2⤵
  PID:5324
- C:\Windows\System\LaAwxuL.exe
  C:\Windows\System\LaAwxuL.exe
  2⤵
  PID:3012
- C:\Windows\System\yyQRMMD.exe
  C:\Windows\System\yyQRMMD.exe
  2⤵
  PID:6380
- C:\Windows\System\zfsfFWF.exe
  C:\Windows\System\zfsfFWF.exe
  2⤵
  PID:6468
- C:\Windows\System\PWGwcdZ.exe
  C:\Windows\System\PWGwcdZ.exe
  2⤵
  PID:6540
- C:\Windows\System\TeTgZWS.exe
  C:\Windows\System\TeTgZWS.exe
  2⤵
  PID:3372
- C:\Windows\System\vSIfrkH.exe
  C:\Windows\System\vSIfrkH.exe
  2⤵
  PID:6768
- C:\Windows\System\kixcnNW.exe
  C:\Windows\System\kixcnNW.exe
  2⤵
  PID:6808
- C:\Windows\System\bqyNchr.exe
  C:\Windows\System\bqyNchr.exe
  2⤵
  PID:6836
- C:\Windows\System\cSjqWFq.exe
  C:\Windows\System\cSjqWFq.exe
  2⤵
  PID:6692
- C:\Windows\System\LOPLZGo.exe
  C:\Windows\System\LOPLZGo.exe
  2⤵
  PID:6728
- C:\Windows\System\kelUBrj.exe
  C:\Windows\System\kelUBrj.exe
  2⤵
  PID:6944
- C:\Windows\System\AUSqACO.exe
  C:\Windows\System\AUSqACO.exe
  2⤵
  PID:6928
- C:\Windows\System\NAgDOvq.exe
  C:\Windows\System\NAgDOvq.exe
  2⤵
  PID:7056
- C:\Windows\System\OcAybtx.exe
  C:\Windows\System\OcAybtx.exe
  2⤵
  PID:7032
- C:\Windows\System\esZEIGN.exe
  C:\Windows\System\esZEIGN.exe
  2⤵
  PID:7148
- C:\Windows\System\IjwIMuO.exe
  C:\Windows\System\IjwIMuO.exe
  2⤵
  PID:4384
- C:\Windows\System\DBwGIXC.exe
  C:\Windows\System\DBwGIXC.exe
  2⤵
  PID:6156
- C:\Windows\System\caiXVEP.exe
  C:\Windows\System\caiXVEP.exe
  2⤵
  PID:6180
- C:\Windows\System\tmUhNGt.exe
  C:\Windows\System\tmUhNGt.exe
  2⤵
  PID:6264
- C:\Windows\System\lhQIIPA.exe
  C:\Windows\System\lhQIIPA.exe
  2⤵
  PID:6420
- C:\Windows\System\DalOzId.exe
  C:\Windows\System\DalOzId.exe
  2⤵
  PID:3868
- C:\Windows\System\nInMRYq.exe
  C:\Windows\System\nInMRYq.exe
  2⤵
  PID:7140
- C:\Windows\System\KgQnbmL.exe
  C:\Windows\System\KgQnbmL.exe
  2⤵
  PID:4844
- C:\Windows\System\cztxnju.exe
  C:\Windows\System\cztxnju.exe
  2⤵
  PID:6748
- C:\Windows\System\nmCblaA.exe
  C:\Windows\System\nmCblaA.exe
  2⤵
  PID:5460
- C:\Windows\System\IeNoFrH.exe
  C:\Windows\System\IeNoFrH.exe
  2⤵
  PID:7204
- C:\Windows\System\gfvKyBp.exe
  C:\Windows\System\gfvKyBp.exe
  2⤵
  PID:7224
- C:\Windows\System\YELSUHq.exe
  C:\Windows\System\YELSUHq.exe
  2⤵
  PID:7244
- C:\Windows\System\JWsyVAU.exe
  C:\Windows\System\JWsyVAU.exe
  2⤵
  PID:7272
- C:\Windows\System\jRkkmLp.exe
  C:\Windows\System\jRkkmLp.exe
  2⤵
  PID:7304
- C:\Windows\System\eNvLeDK.exe
  C:\Windows\System\eNvLeDK.exe
  2⤵
  PID:7328
- C:\Windows\System\zWZYuKn.exe
  C:\Windows\System\zWZYuKn.exe
  2⤵
  PID:7344
- C:\Windows\System\wBUmMkU.exe
  C:\Windows\System\wBUmMkU.exe
  2⤵
  PID:7368
- C:\Windows\System\EOmVfqY.exe
  C:\Windows\System\EOmVfqY.exe
  2⤵
  PID:7384
- C:\Windows\System\RNtNWLP.exe
  C:\Windows\System\RNtNWLP.exe
  2⤵
  PID:7400
- C:\Windows\System\YCyeUJa.exe
  C:\Windows\System\YCyeUJa.exe
  2⤵
  PID:7420
- C:\Windows\System\dzphRKD.exe
  C:\Windows\System\dzphRKD.exe
  2⤵
  PID:7476
- C:\Windows\System\PIeWSoS.exe
  C:\Windows\System\PIeWSoS.exe
  2⤵
  PID:7508
- C:\Windows\System\SmiXpmR.exe
  C:\Windows\System\SmiXpmR.exe
  2⤵
  PID:7532
- C:\Windows\System\KNyaXrW.exe
  C:\Windows\System\KNyaXrW.exe
  2⤵
  PID:7560
- C:\Windows\System\HkIhWRr.exe
  C:\Windows\System\HkIhWRr.exe
  2⤵
  PID:7576
- C:\Windows\System\jtUZaCS.exe
  C:\Windows\System\jtUZaCS.exe
  2⤵
  PID:7600
- C:\Windows\System\Bevdoqy.exe
  C:\Windows\System\Bevdoqy.exe
  2⤵
  PID:7640
- C:\Windows\System\OwxDVQF.exe
  C:\Windows\System\OwxDVQF.exe
  2⤵
  PID:7684
- C:\Windows\System\AsefyUQ.exe
  C:\Windows\System\AsefyUQ.exe
  2⤵
  PID:7732
- C:\Windows\System\VtQoLAC.exe
  C:\Windows\System\VtQoLAC.exe
  2⤵
  PID:7752
- C:\Windows\System\HYrMpEP.exe
  C:\Windows\System\HYrMpEP.exe
  2⤵
  PID:7784
- C:\Windows\System\aYzyGGG.exe
  C:\Windows\System\aYzyGGG.exe
  2⤵
  PID:7804
- C:\Windows\System\OkRHCxr.exe
  C:\Windows\System\OkRHCxr.exe
  2⤵
  PID:7844
- C:\Windows\System\nEaXROy.exe
  C:\Windows\System\nEaXROy.exe
  2⤵
  PID:7876
- C:\Windows\System\rllHooX.exe
  C:\Windows\System\rllHooX.exe
  2⤵
  PID:7896
- C:\Windows\System\SOthdqe.exe
  C:\Windows\System\SOthdqe.exe
  2⤵
  PID:7916
- C:\Windows\System\ZtUuUFb.exe
  C:\Windows\System\ZtUuUFb.exe
  2⤵
  PID:7936
- C:\Windows\System\YVqZejw.exe
  C:\Windows\System\YVqZejw.exe
  2⤵
  PID:7952
- C:\Windows\System\OydmkRh.exe
  C:\Windows\System\OydmkRh.exe
  2⤵
  PID:7976
- C:\Windows\System\adgtKkX.exe
  C:\Windows\System\adgtKkX.exe
  2⤵
  PID:8004
- C:\Windows\System\pDWUgyj.exe
  C:\Windows\System\pDWUgyj.exe
  2⤵
  PID:8056
- C:\Windows\System\RFmGVqZ.exe
  C:\Windows\System\RFmGVqZ.exe
  2⤵
  PID:8092
- C:\Windows\System\FNSOSjt.exe
  C:\Windows\System\FNSOSjt.exe
  2⤵
  PID:8112
- C:\Windows\System\RQVdRii.exe
  C:\Windows\System\RQVdRii.exe
  2⤵
  PID:8136
- C:\Windows\System\zwTaDbU.exe
  C:\Windows\System\zwTaDbU.exe
  2⤵
  PID:8152
- C:\Windows\System\SeIBUPd.exe
  C:\Windows\System\SeIBUPd.exe
  2⤵
  PID:8172
- C:\Windows\System\DvQUYRB.exe
  C:\Windows\System\DvQUYRB.exe
  2⤵
  PID:6632
- C:\Windows\System\bXmFXmp.exe
  C:\Windows\System\bXmFXmp.exe
  2⤵
  PID:7212
- C:\Windows\System\HyaBwsl.exe
  C:\Windows\System\HyaBwsl.exe
  2⤵
  PID:7256
- C:\Windows\System\GyzpMiQ.exe
  C:\Windows\System\GyzpMiQ.exe
  2⤵
  PID:7356
- C:\Windows\System\kVPzObK.exe
  C:\Windows\System\kVPzObK.exe
  2⤵
  PID:7468
- C:\Windows\System\inUPKDO.exe
  C:\Windows\System\inUPKDO.exe
  2⤵
  PID:7412
- C:\Windows\System\NxNDNwg.exe
  C:\Windows\System\NxNDNwg.exe
  2⤵
  PID:7524
- C:\Windows\System\zGwlglD.exe
  C:\Windows\System\zGwlglD.exe
  2⤵
  PID:7552
- C:\Windows\System\lEJDxpH.exe
  C:\Windows\System\lEJDxpH.exe
  2⤵
  PID:7572
- C:\Windows\System\dTWuwty.exe
  C:\Windows\System\dTWuwty.exe
  2⤵
  PID:7668
- C:\Windows\System\oHiUlnY.exe
  C:\Windows\System\oHiUlnY.exe
  2⤵
  PID:7772
- C:\Windows\System\dVzugcq.exe
  C:\Windows\System\dVzugcq.exe
  2⤵
  PID:7912
- C:\Windows\System\fjHYOzb.exe
  C:\Windows\System\fjHYOzb.exe
  2⤵
  PID:7908
- C:\Windows\System\oOVKsRD.exe
  C:\Windows\System\oOVKsRD.exe
  2⤵
  PID:7992
- C:\Windows\System\EPtiTpn.exe
  C:\Windows\System\EPtiTpn.exe
  2⤵
  PID:8036
- C:\Windows\System\HKXMWkg.exe
  C:\Windows\System\HKXMWkg.exe
  2⤵
  PID:8168
- C:\Windows\System\FabPaKc.exe
  C:\Windows\System\FabPaKc.exe
  2⤵
  PID:7240
- C:\Windows\System\txuzGHK.exe
  C:\Windows\System\txuzGHK.exe
  2⤵
  PID:7464
- C:\Windows\System\lTnvSXA.exe
  C:\Windows\System\lTnvSXA.exe
  2⤵
  PID:7460
- C:\Windows\System\PCkmOrN.exe
  C:\Windows\System\PCkmOrN.exe
  2⤵
  PID:7592
- C:\Windows\System\oylKYxn.exe
  C:\Windows\System\oylKYxn.exe
  2⤵
  PID:7840
- C:\Windows\System\VEvZaIo.exe
  C:\Windows\System\VEvZaIo.exe
  2⤵
  PID:7872
- C:\Windows\System\zNcDjWE.exe
  C:\Windows\System\zNcDjWE.exe
  2⤵
  PID:8016
- C:\Windows\System\CrzMsZI.exe
  C:\Windows\System\CrzMsZI.exe
  2⤵
  PID:6868
- C:\Windows\System\IxBZuNx.exe
  C:\Windows\System\IxBZuNx.exe
  2⤵
  PID:7652
- C:\Windows\System\uQttOPs.exe
  C:\Windows\System\uQttOPs.exe
  2⤵
  PID:7944
- C:\Windows\System\SqBQOFp.exe
  C:\Windows\System\SqBQOFp.exe
  2⤵
  PID:7632
- C:\Windows\System\TJwejsV.exe
  C:\Windows\System\TJwejsV.exe
  2⤵
  PID:8196
- C:\Windows\System\ObZAYdP.exe
  C:\Windows\System\ObZAYdP.exe
  2⤵
  PID:8236
- C:\Windows\System\ZlFQQGf.exe
  C:\Windows\System\ZlFQQGf.exe
  2⤵
  PID:8272
- C:\Windows\System\sECKWFN.exe
  C:\Windows\System\sECKWFN.exe
  2⤵
  PID:8292
- C:\Windows\System\uAZKORw.exe
  C:\Windows\System\uAZKORw.exe
  2⤵
  PID:8316
- C:\Windows\System\nDcudVm.exe
  C:\Windows\System\nDcudVm.exe
  2⤵
  PID:8332
- C:\Windows\System\pFoXrYn.exe
  C:\Windows\System\pFoXrYn.exe
  2⤵
  PID:8348
- C:\Windows\System\leDdUPb.exe
  C:\Windows\System\leDdUPb.exe
  2⤵
  PID:8388
- C:\Windows\System\gtxSLMG.exe
  C:\Windows\System\gtxSLMG.exe
  2⤵
  PID:8408
- C:\Windows\System\dZCpnDM.exe
  C:\Windows\System\dZCpnDM.exe
  2⤵
  PID:8436
- C:\Windows\System\atPyaXj.exe
  C:\Windows\System\atPyaXj.exe
  2⤵
  PID:8464
- C:\Windows\System\UAznzyr.exe
  C:\Windows\System\UAznzyr.exe
  2⤵
  PID:8480
- C:\Windows\System\TwaPVef.exe
  C:\Windows\System\TwaPVef.exe
  2⤵
  PID:8516
- C:\Windows\System\AEgdFrY.exe
  C:\Windows\System\AEgdFrY.exe
  2⤵
  PID:8540
- C:\Windows\System\qctoTaN.exe
  C:\Windows\System\qctoTaN.exe
  2⤵
  PID:8560
- C:\Windows\System\ZeaTbCV.exe
  C:\Windows\System\ZeaTbCV.exe
  2⤵
  PID:8576
- C:\Windows\System\GemzHOD.exe
  C:\Windows\System\GemzHOD.exe
  2⤵
  PID:8600
- C:\Windows\System\EWhYBbY.exe
  C:\Windows\System\EWhYBbY.exe
  2⤵
  PID:8616
- C:\Windows\System\fueazBZ.exe
  C:\Windows\System\fueazBZ.exe
  2⤵
  PID:8644
- C:\Windows\System\hWuDcOz.exe
  C:\Windows\System\hWuDcOz.exe
  2⤵
  PID:8660
- C:\Windows\System\tRtZmGL.exe
  C:\Windows\System\tRtZmGL.exe
  2⤵
  PID:8680
- C:\Windows\System\xNRFrMy.exe
  C:\Windows\System\xNRFrMy.exe
  2⤵
  PID:8704
- C:\Windows\System\gCFgoAI.exe
  C:\Windows\System\gCFgoAI.exe
  2⤵
  PID:8724
- C:\Windows\System\ntpGhZj.exe
  C:\Windows\System\ntpGhZj.exe
  2⤵
  PID:8792
- C:\Windows\System\tPYgyph.exe
  C:\Windows\System\tPYgyph.exe
  2⤵
  PID:8820
- C:\Windows\System\oXQgdiJ.exe
  C:\Windows\System\oXQgdiJ.exe
  2⤵
  PID:8888
- C:\Windows\System\twLnTPi.exe
  C:\Windows\System\twLnTPi.exe
  2⤵
  PID:8908
- C:\Windows\System\SdtvWlw.exe
  C:\Windows\System\SdtvWlw.exe
  2⤵
  PID:8972
- C:\Windows\System\rzagyIY.exe
  C:\Windows\System\rzagyIY.exe
  2⤵
  PID:8996
- C:\Windows\System\sYYPoCS.exe
  C:\Windows\System\sYYPoCS.exe
  2⤵
  PID:9020
- C:\Windows\System\aozNEgV.exe
  C:\Windows\System\aozNEgV.exe
  2⤵
  PID:9048
- C:\Windows\System\CtoWFDI.exe
  C:\Windows\System\CtoWFDI.exe
  2⤵
  PID:9076
- C:\Windows\System\awOzxqp.exe
  C:\Windows\System\awOzxqp.exe
  2⤵
  PID:9100
- C:\Windows\System\HhYupzx.exe
  C:\Windows\System\HhYupzx.exe
  2⤵
  PID:9120
- C:\Windows\System\cWzzYDO.exe
  C:\Windows\System\cWzzYDO.exe
  2⤵
  PID:9160
- C:\Windows\System\RRRvjBt.exe
  C:\Windows\System\RRRvjBt.exe
  2⤵
  PID:9176
- C:\Windows\System\sXkYTQf.exe
  C:\Windows\System\sXkYTQf.exe
  2⤵
  PID:9212
- C:\Windows\System\XtFpHai.exe
  C:\Windows\System\XtFpHai.exe
  2⤵
  PID:7452
- C:\Windows\System\hVVLBlq.exe
  C:\Windows\System\hVVLBlq.exe
  2⤵
  PID:8288
- C:\Windows\System\EbxqBYv.exe
  C:\Windows\System\EbxqBYv.exe
  2⤵
  PID:8368
- C:\Windows\System\VgWLUMi.exe
  C:\Windows\System\VgWLUMi.exe
  2⤵
  PID:8364
- C:\Windows\System\qHKDmpu.exe
  C:\Windows\System\qHKDmpu.exe
  2⤵
  PID:8456
- C:\Windows\System\rdWtVZf.exe
  C:\Windows\System\rdWtVZf.exe
  2⤵
  PID:8548
- C:\Windows\System\CTlkOyM.exe
  C:\Windows\System\CTlkOyM.exe
  2⤵
  PID:8552
- C:\Windows\System\IZhEUbn.exe
  C:\Windows\System\IZhEUbn.exe
  2⤵
  PID:8656
- C:\Windows\System\TTcNIVN.exe
  C:\Windows\System\TTcNIVN.exe
  2⤵
  PID:8672
- C:\Windows\System\yTIrLPd.exe
  C:\Windows\System\yTIrLPd.exe
  2⤵
  PID:8812
- C:\Windows\System\fHmyCWa.exe
  C:\Windows\System\fHmyCWa.exe
  2⤵
  PID:8876
- C:\Windows\System\RPPYDxh.exe
  C:\Windows\System\RPPYDxh.exe
  2⤵
  PID:8900
- C:\Windows\System\TDmMBli.exe
  C:\Windows\System\TDmMBli.exe
  2⤵
  PID:9004
- C:\Windows\System\GtTwBol.exe
  C:\Windows\System\GtTwBol.exe
  2⤵
  PID:9028
- C:\Windows\System\gNubVTC.exe
  C:\Windows\System\gNubVTC.exe
  2⤵
  PID:9040
- C:\Windows\System\tHDpgoV.exe
  C:\Windows\System\tHDpgoV.exe
  2⤵
  PID:9132
- C:\Windows\System\yKBtkmx.exe
  C:\Windows\System\yKBtkmx.exe
  2⤵
  PID:8372
- C:\Windows\System\Wyhrhyd.exe
  C:\Windows\System\Wyhrhyd.exe
  2⤵
  PID:8496
- C:\Windows\System\ecLNCUp.exe
  C:\Windows\System\ecLNCUp.exe
  2⤵
  PID:8628
- C:\Windows\System\cIpJziA.exe
  C:\Windows\System\cIpJziA.exe
  2⤵
  PID:8852
- C:\Windows\System\QOmsMWU.exe
  C:\Windows\System\QOmsMWU.exe
  2⤵
  PID:8764
- C:\Windows\System\KYdofFt.exe
  C:\Windows\System\KYdofFt.exe
  2⤵
  PID:8948
- C:\Windows\System\NOezYbA.exe
  C:\Windows\System\NOezYbA.exe
  2⤵
  PID:9136
- C:\Windows\System\iiXtBDN.exe
  C:\Windows\System\iiXtBDN.exe
  2⤵
  PID:9112
- C:\Windows\System\oriywVD.exe
  C:\Windows\System\oriywVD.exe
  2⤵
  PID:8532
- C:\Windows\System\Ddrdbqp.exe
  C:\Windows\System\Ddrdbqp.exe
  2⤵
  PID:9092
- C:\Windows\System\mOVSpdV.exe
  C:\Windows\System\mOVSpdV.exe
  2⤵
  PID:9220
- C:\Windows\System\VqBaaKJ.exe
  C:\Windows\System\VqBaaKJ.exe
  2⤵
  PID:9264
- C:\Windows\System\hGjfoGV.exe
  C:\Windows\System\hGjfoGV.exe
  2⤵
  PID:9296
- C:\Windows\System\RzlhVRF.exe
  C:\Windows\System\RzlhVRF.exe
  2⤵
  PID:9316
- C:\Windows\System\tsTliej.exe
  C:\Windows\System\tsTliej.exe
  2⤵
  PID:9332
- C:\Windows\System\mXTicQy.exe
  C:\Windows\System\mXTicQy.exe
  2⤵
  PID:9376
- C:\Windows\System\qHJMUuY.exe
  C:\Windows\System\qHJMUuY.exe
  2⤵
  PID:9424
- C:\Windows\System\XvxAXsO.exe
  C:\Windows\System\XvxAXsO.exe
  2⤵
  PID:9444
- C:\Windows\System\tiKkKne.exe
  C:\Windows\System\tiKkKne.exe
  2⤵
  PID:9468
- C:\Windows\System\WlfarZs.exe
  C:\Windows\System\WlfarZs.exe
  2⤵
  PID:9500
- C:\Windows\System\shYZmtk.exe
  C:\Windows\System\shYZmtk.exe
  2⤵
  PID:9544
- C:\Windows\System\HGkBNZa.exe
  C:\Windows\System\HGkBNZa.exe
  2⤵
  PID:9564
- C:\Windows\System\xKVIlyR.exe
  C:\Windows\System\xKVIlyR.exe
  2⤵
  PID:9584
- C:\Windows\System\EnUAuVY.exe
  C:\Windows\System\EnUAuVY.exe
  2⤵
  PID:9608
- C:\Windows\System\zwMzytl.exe
  C:\Windows\System\zwMzytl.exe
  2⤵
  PID:9628
- C:\Windows\System\lelCAnG.exe
  C:\Windows\System\lelCAnG.exe
  2⤵
  PID:9648
- C:\Windows\System\OwMKvIS.exe
  C:\Windows\System\OwMKvIS.exe
  2⤵
  PID:9712
- C:\Windows\System\DkrkEFo.exe
  C:\Windows\System\DkrkEFo.exe
  2⤵
  PID:9728
- C:\Windows\System\oadCdGx.exe
  C:\Windows\System\oadCdGx.exe
  2⤵
  PID:9760
- C:\Windows\System\iyGMSGV.exe
  C:\Windows\System\iyGMSGV.exe
  2⤵
  PID:9800
- C:\Windows\System\hnbRZoK.exe
  C:\Windows\System\hnbRZoK.exe
  2⤵
  PID:9832
- C:\Windows\System\csvkPyg.exe
  C:\Windows\System\csvkPyg.exe
  2⤵
  PID:9848
- C:\Windows\System\pDyINwv.exe
  C:\Windows\System\pDyINwv.exe
  2⤵
  PID:9872
- C:\Windows\System\dXNWhQx.exe
  C:\Windows\System\dXNWhQx.exe
  2⤵
  PID:9892
- C:\Windows\System\FGiaSnS.exe
  C:\Windows\System\FGiaSnS.exe
  2⤵
  PID:9920
- C:\Windows\System\NsNcznV.exe
  C:\Windows\System\NsNcznV.exe
  2⤵
  PID:9984
- C:\Windows\System\WYwhhCl.exe
  C:\Windows\System\WYwhhCl.exe
  2⤵
  PID:10004
- C:\Windows\System\SvNwoMI.exe
  C:\Windows\System\SvNwoMI.exe
  2⤵
  PID:10020
- C:\Windows\System\lWsucki.exe
  C:\Windows\System\lWsucki.exe
  2⤵
  PID:10044
- C:\Windows\System\TWejkbb.exe
  C:\Windows\System\TWejkbb.exe
  2⤵
  PID:10060
- C:\Windows\System\ZHmntkr.exe
  C:\Windows\System\ZHmntkr.exe
  2⤵
  PID:10088
- C:\Windows\System\iyHypJx.exe
  C:\Windows\System\iyHypJx.exe
  2⤵
  PID:10128
- C:\Windows\System\gDGQHyY.exe
  C:\Windows\System\gDGQHyY.exe
  2⤵
  PID:10148
- C:\Windows\System\UqJPKtb.exe
  C:\Windows\System\UqJPKtb.exe
  2⤵
  PID:10172
- C:\Windows\System\yAjrvlL.exe
  C:\Windows\System\yAjrvlL.exe
  2⤵
  PID:10216
- C:\Windows\System\QhJPjQi.exe
  C:\Windows\System\QhJPjQi.exe
  2⤵
  PID:9168
- C:\Windows\System\tMtXEJg.exe
  C:\Windows\System\tMtXEJg.exe
  2⤵
  PID:9256
- C:\Windows\System\dkArJlF.exe
  C:\Windows\System\dkArJlF.exe
  2⤵
  PID:9272
- C:\Windows\System\BMFUffE.exe
  C:\Windows\System\BMFUffE.exe
  2⤵
  PID:9328
- C:\Windows\System\cbCJlCn.exe
  C:\Windows\System\cbCJlCn.exe
  2⤵
  PID:9368
- C:\Windows\System\pzeQsNv.exe
  C:\Windows\System\pzeQsNv.exe
  2⤵
  PID:9440
- C:\Windows\System\qwDZghR.exe
  C:\Windows\System\qwDZghR.exe
  2⤵
  PID:9528
- C:\Windows\System\IUXsMim.exe
  C:\Windows\System\IUXsMim.exe
  2⤵
  PID:9576
- C:\Windows\System\yFCFfve.exe
  C:\Windows\System\yFCFfve.exe
  2⤵
  PID:9580
- C:\Windows\System\cuxoejc.exe
  C:\Windows\System\cuxoejc.exe
  2⤵
  PID:9724
- C:\Windows\System\lRDniwB.exe
  C:\Windows\System\lRDniwB.exe
  2⤵
  PID:9752
- C:\Windows\System\swRyaIh.exe
  C:\Windows\System\swRyaIh.exe
  2⤵
  PID:9856
- C:\Windows\System\gIeSYuy.exe
  C:\Windows\System\gIeSYuy.exe
  2⤵
  PID:9888
- C:\Windows\System\rDjRJcG.exe
  C:\Windows\System\rDjRJcG.exe
  2⤵
  PID:9972
- C:\Windows\System\IhispSd.exe
  C:\Windows\System\IhispSd.exe
  2⤵
  PID:10036
- C:\Windows\System\aXbaKQt.exe
  C:\Windows\System\aXbaKQt.exe
  2⤵
  PID:10164
- C:\Windows\System\CNVlSvI.exe
  C:\Windows\System\CNVlSvI.exe
  2⤵
  PID:10200
- C:\Windows\System\zYxmqxW.exe
  C:\Windows\System\zYxmqxW.exe
  2⤵
  PID:10208
- C:\Windows\System\WozITPe.exe
  C:\Windows\System\WozITPe.exe
  2⤵
  PID:8108
- C:\Windows\System\hPhyiOm.exe
  C:\Windows\System\hPhyiOm.exe
  2⤵
  PID:9280
- C:\Windows\System\YLZALWo.exe
  C:\Windows\System\YLZALWo.exe
  2⤵
  PID:9736
- C:\Windows\System\MZVGZjZ.exe
  C:\Windows\System\MZVGZjZ.exe
  2⤵
  PID:9620
- C:\Windows\System\HEydYAR.exe
  C:\Windows\System\HEydYAR.exe
  2⤵
  PID:9840
- C:\Windows\System\zFJyvZk.exe
  C:\Windows\System\zFJyvZk.exe
  2⤵
  PID:9952
- C:\Windows\System\yuGKduf.exe
  C:\Windows\System\yuGKduf.exe
  2⤵
  PID:10040
- C:\Windows\System\VFXOMxU.exe
  C:\Windows\System\VFXOMxU.exe
  2⤵
  PID:10144
- C:\Windows\System\GsIiYCl.exe
  C:\Windows\System\GsIiYCl.exe
  2⤵
  PID:9536
- C:\Windows\System\yMyxPDf.exe
  C:\Windows\System\yMyxPDf.exe
  2⤵
  PID:10108
- C:\Windows\System\VhNPmRB.exe
  C:\Windows\System\VhNPmRB.exe
  2⤵
  PID:10260
- C:\Windows\System\NqbULPR.exe
  C:\Windows\System\NqbULPR.exe
  2⤵
  PID:10276
- C:\Windows\System\YESxdDV.exe
  C:\Windows\System\YESxdDV.exe
  2⤵
  PID:10336
- C:\Windows\System\nxTKDwh.exe
  C:\Windows\System\nxTKDwh.exe
  2⤵
  PID:10352
- C:\Windows\System\HvAlKoF.exe
  C:\Windows\System\HvAlKoF.exe
  2⤵
  PID:10376
- C:\Windows\System\kBIObGG.exe
  C:\Windows\System\kBIObGG.exe
  2⤵
  PID:10392
- C:\Windows\System\tSnNkdc.exe
  C:\Windows\System\tSnNkdc.exe
  2⤵
  PID:10416
- C:\Windows\System\MVYlraK.exe
  C:\Windows\System\MVYlraK.exe
  2⤵
  PID:10448
- C:\Windows\System\iNOQkWE.exe
  C:\Windows\System\iNOQkWE.exe
  2⤵
  PID:10468
- C:\Windows\System\WercKBF.exe
  C:\Windows\System\WercKBF.exe
  2⤵
  PID:10516
- C:\Windows\System\ljQYjvw.exe
  C:\Windows\System\ljQYjvw.exe
  2⤵
  PID:10564
- C:\Windows\System\sUXHPAv.exe
  C:\Windows\System\sUXHPAv.exe
  2⤵
  PID:10604
- C:\Windows\System\BFEzcid.exe
  C:\Windows\System\BFEzcid.exe
  2⤵
  PID:10656
- C:\Windows\System\ViaYQdA.exe
  C:\Windows\System\ViaYQdA.exe
  2⤵
  PID:10680
- C:\Windows\System\lSjpUzE.exe
  C:\Windows\System\lSjpUzE.exe
  2⤵
  PID:10708
- C:\Windows\System\hykbKdj.exe
  C:\Windows\System\hykbKdj.exe
  2⤵
  PID:10732
- C:\Windows\System\pMqYcJL.exe
  C:\Windows\System\pMqYcJL.exe
  2⤵
  PID:10764
- C:\Windows\System\YOQNWIi.exe
  C:\Windows\System\YOQNWIi.exe
  2⤵
  PID:10784
- C:\Windows\System\fXQcIEv.exe
  C:\Windows\System\fXQcIEv.exe
  2⤵
  PID:10808
- C:\Windows\System\PiiykGx.exe
  C:\Windows\System\PiiykGx.exe
  2⤵
  PID:10824
- C:\Windows\System\bjJIRLv.exe
  C:\Windows\System\bjJIRLv.exe
  2⤵
  PID:10848
- C:\Windows\System\eIGqLZK.exe
  C:\Windows\System\eIGqLZK.exe
  2⤵
  PID:10884
- C:\Windows\System\UTvXJzR.exe
  C:\Windows\System\UTvXJzR.exe
  2⤵
  PID:10916
- C:\Windows\System\jbSiHIN.exe
  C:\Windows\System\jbSiHIN.exe
  2⤵
  PID:10936
- C:\Windows\System\CgyJsBV.exe
  C:\Windows\System\CgyJsBV.exe
  2⤵
  PID:10960
- C:\Windows\System\vrEeuzw.exe
  C:\Windows\System\vrEeuzw.exe
  2⤵
  PID:10980
- C:\Windows\System\PjwOAdC.exe
  C:\Windows\System\PjwOAdC.exe
  2⤵
  PID:11000
- C:\Windows\System\cFWMOXN.exe
  C:\Windows\System\cFWMOXN.exe
  2⤵
  PID:11032
- C:\Windows\System\IcKniMi.exe
  C:\Windows\System\IcKniMi.exe
  2⤵
  PID:11060
- C:\Windows\System\eBPQDQJ.exe
  C:\Windows\System\eBPQDQJ.exe
  2⤵
  PID:11084
- C:\Windows\System\PvgTYks.exe
  C:\Windows\System\PvgTYks.exe
  2⤵
  PID:11108
- C:\Windows\System\VIsCxMd.exe
  C:\Windows\System\VIsCxMd.exe
  2⤵
  PID:11124
- C:\Windows\System\tYZkLHJ.exe
  C:\Windows\System\tYZkLHJ.exe
  2⤵
  PID:11140
- C:\Windows\System\KAiuobb.exe
  C:\Windows\System\KAiuobb.exe
  2⤵
  PID:11164
- C:\Windows\System\BFUFHwm.exe
  C:\Windows\System\BFUFHwm.exe
  2⤵
  PID:11220
- C:\Windows\System\RDDReYt.exe
  C:\Windows\System\RDDReYt.exe
  2⤵
  PID:11252
- C:\Windows\System\fqKOuRs.exe
  C:\Windows\System\fqKOuRs.exe
  2⤵
  PID:9324
- C:\Windows\System\fAVSMtT.exe
  C:\Windows\System\fAVSMtT.exe
  2⤵
  PID:10256
- C:\Windows\System\fxqPwlC.exe
  C:\Windows\System\fxqPwlC.exe
  2⤵
  PID:10400
- C:\Windows\System\qQDumUr.exe
  C:\Windows\System\qQDumUr.exe
  2⤵
  PID:10348
- C:\Windows\System\GhVEHJL.exe
  C:\Windows\System\GhVEHJL.exe
  2⤵
  PID:10640
- C:\Windows\System\ufXmxMz.exe
  C:\Windows\System\ufXmxMz.exe
  2⤵
  PID:10716
- C:\Windows\System\FUYUYiN.exe
  C:\Windows\System\FUYUYiN.exe
  2⤵
  PID:10728
- C:\Windows\System\VFgJcwY.exe
  C:\Windows\System\VFgJcwY.exe
  2⤵
  PID:10760
- C:\Windows\System\nmeUSMG.exe
  C:\Windows\System\nmeUSMG.exe
  2⤵
  PID:10780
- C:\Windows\System\tmrrHEy.exe
  C:\Windows\System\tmrrHEy.exe
  2⤵
  PID:10796
- C:\Windows\System\hfKryGj.exe
  C:\Windows\System\hfKryGj.exe
  2⤵
  PID:10868
- C:\Windows\System\SSHhpOh.exe
  C:\Windows\System\SSHhpOh.exe
  2⤵
  PID:10844
- C:\Windows\System\iMVtanX.exe
  C:\Windows\System\iMVtanX.exe
  2⤵
  PID:10908
- C:\Windows\System\iaGlKjy.exe
  C:\Windows\System\iaGlKjy.exe
  2⤵
  PID:11008
- C:\Windows\System\EKdrwrW.exe
  C:\Windows\System\EKdrwrW.exe
  2⤵
  PID:10988
- C:\Windows\System\yPkrJdz.exe
  C:\Windows\System\yPkrJdz.exe
  2⤵
  PID:11072
- C:\Windows\System\FkWUbeY.exe
  C:\Windows\System\FkWUbeY.exe
  2⤵
  PID:11092
- C:\Windows\System\XUURoiH.exe
  C:\Windows\System\XUURoiH.exe
  2⤵
  PID:10372
- C:\Windows\System\IomHRjd.exe
  C:\Windows\System\IomHRjd.exe
  2⤵
  PID:10324
- C:\Windows\System\CmFRMNE.exe
  C:\Windows\System\CmFRMNE.exe
  2⤵
  PID:10484
- C:\Windows\System\dEPdPEd.exe
  C:\Windows\System\dEPdPEd.exe
  2⤵
  PID:10580
- C:\Windows\System\ytDlqvt.exe
  C:\Windows\System\ytDlqvt.exe
  2⤵
  PID:10616
- C:\Windows\System\ZdBNxej.exe
  C:\Windows\System\ZdBNxej.exe
  2⤵
  PID:10832
- C:\Windows\System\rsJInhM.exe
  C:\Windows\System\rsJInhM.exe
  2⤵
  PID:10440
- C:\Windows\System\Quvzrym.exe
  C:\Windows\System\Quvzrym.exe
  2⤵
  PID:10560
- C:\Windows\System\TdsvlhO.exe
  C:\Windows\System\TdsvlhO.exe
  2⤵
  PID:11216
- C:\Windows\System\qxTIxwo.exe
  C:\Windows\System\qxTIxwo.exe
  2⤵
  PID:11056
- C:\Windows\System\WtFLJWE.exe
  C:\Windows\System\WtFLJWE.exe
  2⤵
  PID:11120
- C:\Windows\System\bxdhnbc.exe
  C:\Windows\System\bxdhnbc.exe
  2⤵
  PID:11152
- C:\Windows\System\hRJTXGv.exe
  C:\Windows\System\hRJTXGv.exe
  2⤵
  PID:11376
- C:\Windows\System\mcifMEX.exe
  C:\Windows\System\mcifMEX.exe
  2⤵
  PID:11436
- C:\Windows\System\OksOYBo.exe
  C:\Windows\System\OksOYBo.exe
  2⤵
  PID:11476
- C:\Windows\System\HBLPXix.exe
  C:\Windows\System\HBLPXix.exe
  2⤵
  PID:11492
- C:\Windows\System\JMHugej.exe
  C:\Windows\System\JMHugej.exe
  2⤵
  PID:11516
- C:\Windows\System\pcDyfjY.exe
  C:\Windows\System\pcDyfjY.exe
  2⤵
  PID:11564
- C:\Windows\System\EAXMXri.exe
  C:\Windows\System\EAXMXri.exe
  2⤵
  PID:11580
- C:\Windows\System\MzhijKS.exe
  C:\Windows\System\MzhijKS.exe
  2⤵
  PID:11600
- C:\Windows\System\TBhpghG.exe
  C:\Windows\System\TBhpghG.exe
  2⤵
  PID:11620
- C:\Windows\System\HbQpDzF.exe
  C:\Windows\System\HbQpDzF.exe
  2⤵
  PID:11664
- C:\Windows\System\YLLYupl.exe
  C:\Windows\System\YLLYupl.exe
  2⤵
  PID:11680
- C:\Windows\System\dxjjrnV.exe
  C:\Windows\System\dxjjrnV.exe
  2⤵
  PID:11700
- C:\Windows\System\fPLuusg.exe
  C:\Windows\System\fPLuusg.exe
  2⤵
  PID:11728
- C:\Windows\System\yBerlls.exe
  C:\Windows\System\yBerlls.exe
  2⤵
  PID:11744
- C:\Windows\System\gtihzey.exe
  C:\Windows\System\gtihzey.exe
  2⤵
  PID:11796
- C:\Windows\System\heMfKJD.exe
  C:\Windows\System\heMfKJD.exe
  2⤵
  PID:11828
- C:\Windows\System\eXdNSaW.exe
  C:\Windows\System\eXdNSaW.exe
  2⤵
  PID:11848
- C:\Windows\System\UZImdHb.exe
  C:\Windows\System\UZImdHb.exe
  2⤵
  PID:11868
- C:\Windows\System\vScSEjh.exe
  C:\Windows\System\vScSEjh.exe
  2⤵
  PID:11908
- C:\Windows\System\TybjAfN.exe
  C:\Windows\System\TybjAfN.exe
  2⤵
  PID:11924
- C:\Windows\System\yMcyRWc.exe
  C:\Windows\System\yMcyRWc.exe
  2⤵
  PID:11948
- C:\Windows\System\fZESuqI.exe
  C:\Windows\System\fZESuqI.exe
  2⤵
  PID:11964
- C:\Windows\System\ndNvqHQ.exe
  C:\Windows\System\ndNvqHQ.exe
  2⤵
  PID:11984
- C:\Windows\System\wccQdUQ.exe
  C:\Windows\System\wccQdUQ.exe
  2⤵
  PID:12008
- C:\Windows\System\lQHbMst.exe
  C:\Windows\System\lQHbMst.exe
  2⤵
  PID:12024
- C:\Windows\System\gDHLJjs.exe
  C:\Windows\System\gDHLJjs.exe
  2⤵
  PID:12096
- C:\Windows\System\eakniHQ.exe
  C:\Windows\System\eakniHQ.exe
  2⤵
  PID:12128
- C:\Windows\System\prWxEgq.exe
  C:\Windows\System\prWxEgq.exe
  2⤵
  PID:12144
- C:\Windows\System\puBdhOO.exe
  C:\Windows\System\puBdhOO.exe
  2⤵
  PID:12164
- C:\Windows\System\PhDPjCZ.exe
  C:\Windows\System\PhDPjCZ.exe
  2⤵
  PID:12184
- C:\Windows\System\ufoLqtI.exe
  C:\Windows\System\ufoLqtI.exe
  2⤵
  PID:12200
- C:\Windows\System\FCDyHQc.exe
  C:\Windows\System\FCDyHQc.exe
  2⤵
  PID:12220
- C:\Windows\System\floRfZZ.exe
  C:\Windows\System\floRfZZ.exe
  2⤵
  PID:10892
- C:\Windows\System\cxZmEOS.exe
  C:\Windows\System\cxZmEOS.exe
  2⤵
  PID:10360
- C:\Windows\System\zhhbMKy.exe
  C:\Windows\System\zhhbMKy.exe
  2⤵
  PID:11304
- C:\Windows\System\UYOntVX.exe
  C:\Windows\System\UYOntVX.exe
  2⤵
  PID:11028
- C:\Windows\System\TSEDdhE.exe
  C:\Windows\System\TSEDdhE.exe
  2⤵
  PID:11324
- C:\Windows\System\AVBEJei.exe
  C:\Windows\System\AVBEJei.exe
  2⤵
  PID:11408
- C:\Windows\System\NqiyeAf.exe
  C:\Windows\System\NqiyeAf.exe
  2⤵
  PID:11464
- C:\Windows\System\ZDwsEZu.exe
  C:\Windows\System\ZDwsEZu.exe
  2⤵
  PID:11652
- C:\Windows\System\DKdpsZm.exe
  C:\Windows\System\DKdpsZm.exe
  2⤵
  PID:11736
- C:\Windows\System\FbnfcvL.exe
  C:\Windows\System\FbnfcvL.exe
  2⤵
  PID:11772
- C:\Windows\System\zxfXXvS.exe
  C:\Windows\System\zxfXXvS.exe
  2⤵
  PID:11768
- C:\Windows\System\HdYStVX.exe
  C:\Windows\System\HdYStVX.exe
  2⤵
  PID:11860
- C:\Windows\System\zlZofYo.exe
  C:\Windows\System\zlZofYo.exe
  2⤵
  PID:11932
- C:\Windows\System\aqjHzRD.exe
  C:\Windows\System\aqjHzRD.exe
  2⤵
  PID:11892
- C:\Windows\System\fivnQhz.exe
  C:\Windows\System\fivnQhz.exe
  2⤵
  PID:12016
- C:\Windows\System\kveQLmy.exe
  C:\Windows\System\kveQLmy.exe
  2⤵
  PID:12048
- C:\Windows\System\atVlxvB.exe
  C:\Windows\System\atVlxvB.exe
  2⤵
  PID:12120
- C:\Windows\System\eYqoHPU.exe
  C:\Windows\System\eYqoHPU.exe
  2⤵
  PID:12116
- C:\Windows\System\Gunqncg.exe
  C:\Windows\System\Gunqncg.exe
  2⤵
  PID:12216
- C:\Windows\System\RMBKIIS.exe
  C:\Windows\System\RMBKIIS.exe
  2⤵
  PID:11276
- C:\Windows\System\CLeJSbJ.exe
  C:\Windows\System\CLeJSbJ.exe
  2⤵
  PID:1096
- C:\Windows\System\mYpHpsg.exe
  C:\Windows\System\mYpHpsg.exe
  2⤵
  PID:11612
- C:\Windows\System\CbMDLkA.exe
  C:\Windows\System\CbMDLkA.exe
  2⤵
  PID:11816
- C:\Windows\System\PANrBcG.exe
  C:\Windows\System\PANrBcG.exe
  2⤵
  PID:11956
- C:\Windows\System\waDAJRv.exe
  C:\Windows\System\waDAJRv.exe
  2⤵
  PID:12240
- C:\Windows\System\UgrjewJ.exe
  C:\Windows\System\UgrjewJ.exe
  2⤵
  PID:12084
- C:\Windows\System\vuWPqfu.exe
  C:\Windows\System\vuWPqfu.exe
  2⤵
  PID:752
- C:\Windows\System\cTaOVaK.exe
  C:\Windows\System\cTaOVaK.exe
  2⤵
  PID:1120
- C:\Windows\System\HCHrNap.exe
  C:\Windows\System\HCHrNap.exe
  2⤵
  PID:5020
- C:\Windows\System\yPmbxHn.exe
  C:\Windows\System\yPmbxHn.exe
  2⤵
  PID:10408
- C:\Windows\System\wZLrgAm.exe
  C:\Windows\System\wZLrgAm.exe
  2⤵
  PID:11364
- C:\Windows\System\pECMnCP.exe
  C:\Windows\System\pECMnCP.exe
  2⤵
  PID:12000
- C:\Windows\System\tUJShXx.exe
  C:\Windows\System\tUJShXx.exe
  2⤵
  PID:11560
- C:\Windows\System\GVtPLMF.exe
  C:\Windows\System\GVtPLMF.exe
  2⤵
  PID:11692
- C:\Windows\System\xySHjTD.exe
  C:\Windows\System\xySHjTD.exe
  2⤵
  PID:12300
- C:\Windows\System\dksQQkT.exe
  C:\Windows\System\dksQQkT.exe
  2⤵
  PID:12348
- C:\Windows\System\chmBNSM.exe
  C:\Windows\System\chmBNSM.exe
  2⤵
  PID:12364
- C:\Windows\System\JScnDrE.exe
  C:\Windows\System\JScnDrE.exe
  2⤵
  PID:12388
- C:\Windows\System\qBYBSXT.exe
  C:\Windows\System\qBYBSXT.exe
  2⤵
  PID:12436
- C:\Windows\System\bQhwBvW.exe
  C:\Windows\System\bQhwBvW.exe
  2⤵
  PID:12456
- C:\Windows\System\IYUqJTy.exe
  C:\Windows\System\IYUqJTy.exe
  2⤵
  PID:12492
- C:\Windows\System\ntDtfAP.exe
  C:\Windows\System\ntDtfAP.exe
  2⤵
  PID:12508
- C:\Windows\System\klovPTL.exe
  C:\Windows\System\klovPTL.exe
  2⤵
  PID:12532
- C:\Windows\System\cqRmpcX.exe
  C:\Windows\System\cqRmpcX.exe
  2⤵
  PID:12552
- C:\Windows\System\fKuOZeW.exe
  C:\Windows\System\fKuOZeW.exe
  2⤵
  PID:12568
- C:\Windows\System\rjzOIOO.exe
  C:\Windows\System\rjzOIOO.exe
  2⤵
  PID:12604
- C:\Windows\System\OWAXAuv.exe
  C:\Windows\System\OWAXAuv.exe
  2⤵
  PID:12624
- C:\Windows\System\BIDHCKv.exe
  C:\Windows\System\BIDHCKv.exe
  2⤵
  PID:12684
- C:\Windows\System\AUbKYBc.exe
  C:\Windows\System\AUbKYBc.exe
  2⤵
  PID:12720
- C:\Windows\System\LorralM.exe
  C:\Windows\System\LorralM.exe
  2⤵
  PID:12740
- C:\Windows\System\jZgPmrL.exe
  C:\Windows\System\jZgPmrL.exe
  2⤵
  PID:12780
- C:\Windows\System\AfMcrvV.exe
  C:\Windows\System\AfMcrvV.exe
  2⤵
  PID:12800
- C:\Windows\System\ARFQrnu.exe
  C:\Windows\System\ARFQrnu.exe
  2⤵
  PID:12824
- C:\Windows\System\zfFOtam.exe
  C:\Windows\System\zfFOtam.exe
  2⤵
  PID:12852
- C:\Windows\System\mkQuYhw.exe
  C:\Windows\System\mkQuYhw.exe
  2⤵
  PID:12884
- C:\Windows\System\yAjZUkD.exe
  C:\Windows\System\yAjZUkD.exe
  2⤵
  PID:12908
- C:\Windows\System\DgotAHl.exe
  C:\Windows\System\DgotAHl.exe
  2⤵
  PID:12924
- C:\Windows\System\eBxCzwH.exe
  C:\Windows\System\eBxCzwH.exe
  2⤵
  PID:12956
- C:\Windows\System\segigMu.exe
  C:\Windows\System\segigMu.exe
  2⤵
  PID:12992
- C:\Windows\System\VDhpqjz.exe
  C:\Windows\System\VDhpqjz.exe
  2⤵
  PID:13008
- C:\Windows\System\yVuMMlP.exe
  C:\Windows\System\yVuMMlP.exe
  2⤵
  PID:13056
- C:\Windows\System\PWPwrWt.exe
  C:\Windows\System\PWPwrWt.exe
  2⤵
  PID:13072
- C:\Windows\System\BLArrhx.exe
  C:\Windows\System\BLArrhx.exe
  2⤵
  PID:13108
- C:\Windows\System\dzehqpu.exe
  C:\Windows\System\dzehqpu.exe
  2⤵
  PID:13132
- C:\Windows\System\JeCJMwC.exe
  C:\Windows\System\JeCJMwC.exe
  2⤵
  PID:13160
- C:\Windows\System\ZMGtlYH.exe
  C:\Windows\System\ZMGtlYH.exe
  2⤵
  PID:13176
- C:\Windows\System\OLzGQMS.exe
  C:\Windows\System\OLzGQMS.exe
  2⤵
  PID:13212
- C:\Windows\System\btNcYBU.exe
  C:\Windows\System\btNcYBU.exe
  2⤵
  PID:13228
- C:\Windows\System\pJDLyJO.exe
  C:\Windows\System\pJDLyJO.exe
  2⤵
  PID:13252
- C:\Windows\System\eRhpxxx.exe
  C:\Windows\System\eRhpxxx.exe
  2⤵
  PID:13296
- C:\Windows\System\KyXVtzx.exe
  C:\Windows\System\KyXVtzx.exe
  2⤵
  PID:10956
- C:\Windows\System\IYYceXs.exe
  C:\Windows\System\IYYceXs.exe
  2⤵
  PID:12292
- C:\Windows\System\klhlWHX.exe
  C:\Windows\System\klhlWHX.exe
  2⤵
  PID:12320
- C:\Windows\System\ZfiAUvF.exe
  C:\Windows\System\ZfiAUvF.exe
  2⤵
  PID:12328
- C:\Windows\System\OarqLFz.exe
  C:\Windows\System\OarqLFz.exe
  2⤵
  PID:12444
- C:\Windows\System\NpqmYRV.exe
  C:\Windows\System\NpqmYRV.exe
  2⤵
  PID:12448
- C:\Windows\System\wlWskdI.exe
  C:\Windows\System\wlWskdI.exe
  2⤵
  PID:12504
- C:\Windows\System\YkccInb.exe
  C:\Windows\System\YkccInb.exe
  2⤵
  PID:12596
- C:\Windows\System\qcSkjmu.exe
  C:\Windows\System\qcSkjmu.exe
  2⤵
  PID:12588
- C:\Windows\System\qPsAKeV.exe
  C:\Windows\System\qPsAKeV.exe
  2⤵
  PID:5004
- C:\Windows\System\KYqGHtz.exe
  C:\Windows\System\KYqGHtz.exe
  2⤵
  PID:12648
- C:\Windows\System\vwulDfY.exe
  C:\Windows\System\vwulDfY.exe
  2⤵
  PID:12772
- C:\Windows\System\ChPRqog.exe
  C:\Windows\System\ChPRqog.exe
  2⤵
  PID:12848
- C:\Windows\System\UhwzeBg.exe
  C:\Windows\System\UhwzeBg.exe
  2⤵
  PID:12952
- C:\Windows\System\HKnJQrM.exe
  C:\Windows\System\HKnJQrM.exe
  2⤵
  PID:13092
- C:\Windows\System\QQxYvTu.exe
  C:\Windows\System\QQxYvTu.exe
  2⤵
  PID:13140
- C:\Windows\System\jBesyrh.exe
  C:\Windows\System\jBesyrh.exe
  2⤵
  PID:13188
- C:\Windows\System\tElFRZq.exe
  C:\Windows\System\tElFRZq.exe
  2⤵
  PID:13224
- C:\Windows\System\KmEkCFJ.exe
  C:\Windows\System\KmEkCFJ.exe
  2⤵
  PID:12312
- C:\Windows\System\qpNooRR.exe
  C:\Windows\System\qpNooRR.exe
  2⤵
  PID:13308
- C:\Windows\System\oNpnDjU.exe
  C:\Windows\System\oNpnDjU.exe
  2⤵
  PID:12236
- C:\Windows\System\aeJAbpM.exe
  C:\Windows\System\aeJAbpM.exe
  2⤵
  PID:12416
- C:\Windows\System\gUnpNeI.exe
  C:\Windows\System\gUnpNeI.exe
  2⤵
  PID:12776
- C:\Windows\System\JBeZoJB.exe
  C:\Windows\System\JBeZoJB.exe
  2⤵
  PID:12544
- C:\Windows\System\MkJOHUi.exe
  C:\Windows\System\MkJOHUi.exe
  2⤵
  PID:13124
- C:\Windows\System\FXrvBsK.exe
  C:\Windows\System\FXrvBsK.exe
  2⤵
  PID:13068
- C:\Windows\System\wYKOhvw.exe
  C:\Windows\System\wYKOhvw.exe
  2⤵
  PID:12272
- C:\Windows\System\VgmGWSB.exe
  C:\Windows\System\VgmGWSB.exe
  2⤵
  PID:12408
- C:\Windows\System\jHVGeNU.exe
  C:\Windows\System\jHVGeNU.exe
  2⤵
  PID:13100
- C:\Windows\System\xVLbkAN.exe
  C:\Windows\System\xVLbkAN.exe
  2⤵
  PID:5196
- C:\Windows\System\yjxWuLC.exe
  C:\Windows\System\yjxWuLC.exe
  2⤵
  PID:2416
- C:\Windows\System\sYForwt.exe
  C:\Windows\System\sYForwt.exe
  2⤵
  PID:2368
- C:\Windows\System\oPWbxxZ.exe
  C:\Windows\System\oPWbxxZ.exe
  2⤵
  PID:13004
- C:\Windows\System\OaZSsBg.exe
  C:\Windows\System\OaZSsBg.exe
  2⤵
  PID:12476
- C:\Windows\System\jjxarRA.exe
  C:\Windows\System\jjxarRA.exe
  2⤵
  PID:5428
- C:\Windows\System\CvqfliB.exe
  C:\Windows\System\CvqfliB.exe
  2⤵
  PID:1384
- C:\Windows\System\VpasPvb.exe
  C:\Windows\System\VpasPvb.exe
  2⤵
  PID:5884
- C:\Windows\System\ORpkVBa.exe
  C:\Windows\System\ORpkVBa.exe
  2⤵
  PID:1736
- C:\Windows\System\ssuSknT.exe
  C:\Windows\System\ssuSknT.exe
  2⤵
  PID:384
- C:\Windows\System\BdrSlGp.exe
  C:\Windows\System\BdrSlGp.exe
  2⤵
  PID:2904
- C:\Windows\System\TdepQZD.exe
  C:\Windows\System\TdepQZD.exe
  2⤵
  PID:13236
- C:\Windows\System\QQhiUGy.exe
  C:\Windows\System\QQhiUGy.exe
  2⤵
  PID:12136
- C:\Windows\System\VjhrueQ.exe
  C:\Windows\System\VjhrueQ.exe
  2⤵
  PID:3328
- C:\Windows\System\XYpbsAt.exe
  C:\Windows\System\XYpbsAt.exe
  2⤵
  PID:13248
- C:\Windows\System\EGAKigD.exe
  C:\Windows\System\EGAKigD.exe
  2⤵
  PID:1072
- C:\Windows\System\QlErZKm.exe
  C:\Windows\System\QlErZKm.exe
  2⤵
  PID:3116
- C:\Windows\System\KoDLWLq.exe
  C:\Windows\System\KoDLWLq.exe
  2⤵
  PID:532
- C:\Windows\System\KthrJrD.exe
  C:\Windows\System\KthrJrD.exe
  2⤵
  PID:1848
- C:\Windows\System\dOTDiYS.exe
  C:\Windows\System\dOTDiYS.exe
  2⤵
  PID:12468
- C:\Windows\System\mGfcqQw.exe
  C:\Windows\System\mGfcqQw.exe
  2⤵
  PID:13344
- C:\Windows\System\bAIIrUX.exe
  C:\Windows\System\bAIIrUX.exe
  2⤵
  PID:13372
- C:\Windows\System\MFgKYnB.exe
  C:\Windows\System\MFgKYnB.exe
  2⤵
  PID:13392
- C:\Windows\System\TXbovtE.exe
  C:\Windows\System\TXbovtE.exe
  2⤵
  PID:13416
- C:\Windows\System\REmDbHP.exe
  C:\Windows\System\REmDbHP.exe
  2⤵
  PID:13444
- C:\Windows\System\XQvsnRy.exe
  C:\Windows\System\XQvsnRy.exe
  2⤵
  PID:13476
- C:\Windows\System\rlQMjWH.exe
  C:\Windows\System\rlQMjWH.exe
  2⤵
  PID:13508
- C:\Windows\System\qNVMKDJ.exe
  C:\Windows\System\qNVMKDJ.exe
  2⤵
  PID:13536
- C:\Windows\System\gDTrvuL.exe
  C:\Windows\System\gDTrvuL.exe
  2⤵
  PID:13552
- C:\Windows\System\FZMRMOo.exe
  C:\Windows\System\FZMRMOo.exe
  2⤵
  PID:13576
- C:\Windows\System\JiprnSM.exe
  C:\Windows\System\JiprnSM.exe
  2⤵
  PID:13592
- C:\Windows\System\fIXrwGn.exe
  C:\Windows\System\fIXrwGn.exe
  2⤵
  PID:13620
- C:\Windows\System\TMOdZEs.exe
  C:\Windows\System\TMOdZEs.exe
  2⤵
  PID:13636
- C:\Windows\System\JQUvnvH.exe
  C:\Windows\System\JQUvnvH.exe
  2⤵
  PID:13652
- C:\Windows\System\ixxMegb.exe
  C:\Windows\System\ixxMegb.exe
  2⤵
  PID:13668
- C:\Windows\System\ZCTVJbF.exe
  C:\Windows\System\ZCTVJbF.exe
  2⤵
  PID:13684
- C:\Windows\System\QdoPfFg.exe
  C:\Windows\System\QdoPfFg.exe
  2⤵
  PID:13700
- C:\Windows\System\dqlAdcy.exe
  C:\Windows\System\dqlAdcy.exe
  2⤵
  PID:13716
- C:\Windows\System\wGlNVRv.exe
  C:\Windows\System\wGlNVRv.exe
  2⤵
  PID:13736
- C:\Windows\System\pseKUpc.exe
  C:\Windows\System\pseKUpc.exe
  2⤵
  PID:13752
- C:\Windows\System\pTwGQJa.exe
  C:\Windows\System\pTwGQJa.exe
  2⤵
  PID:13768
- C:\Windows\System\EigQSwg.exe
  C:\Windows\System\EigQSwg.exe
  2⤵
  PID:13784
- C:\Windows\System\nPuVuEI.exe
  C:\Windows\System\nPuVuEI.exe
  2⤵
  PID:13800
- C:\Windows\System\fnXhAKp.exe
  C:\Windows\System\fnXhAKp.exe
  2⤵
  PID:13832
- C:\Windows\System\dWsjFtT.exe
  C:\Windows\System\dWsjFtT.exe
  2⤵
  PID:13852
- C:\Windows\System\bwpoHHE.exe
  C:\Windows\System\bwpoHHE.exe
  2⤵
  PID:13876
- C:\Windows\System\ZkVyrVX.exe
  C:\Windows\System\ZkVyrVX.exe
  2⤵
  PID:13892
- C:\Windows\System\ebCefph.exe
  C:\Windows\System\ebCefph.exe
  2⤵
  PID:13908
- C:\Windows\System\eQfsLeP.exe
  C:\Windows\System\eQfsLeP.exe
  2⤵
  PID:13924
- C:\Windows\System\LxDQQCW.exe
  C:\Windows\System\LxDQQCW.exe
  2⤵
  PID:13944
- C:\Windows\System\QxeEDgV.exe
  C:\Windows\System\QxeEDgV.exe
  2⤵
  PID:13960
- C:\Windows\System\YhVXYyV.exe
  C:\Windows\System\YhVXYyV.exe
  2⤵
  PID:13976
- C:\Windows\System\eARTsNK.exe
  C:\Windows\System\eARTsNK.exe
  2⤵
  PID:13992
- C:\Windows\System\dgmDebp.exe
  C:\Windows\System\dgmDebp.exe
  2⤵
  PID:14008
- C:\Windows\System\ltmvQct.exe
  C:\Windows\System\ltmvQct.exe
  2⤵
  PID:14024
- C:\Windows\System\ozpCSuG.exe
  C:\Windows\System\ozpCSuG.exe
  2⤵
  PID:14040
- C:\Windows\System\zVAEoLZ.exe
  C:\Windows\System\zVAEoLZ.exe
  2⤵
  PID:14060
- C:\Windows\System\eZkqEZd.exe
  C:\Windows\System\eZkqEZd.exe
  2⤵
  PID:14076
- C:\Windows\System\OZgcxBP.exe
  C:\Windows\System\OZgcxBP.exe
  2⤵
  PID:14092
- C:\Windows\System\VdDHQRi.exe
  C:\Windows\System\VdDHQRi.exe
  2⤵
  PID:14108
- C:\Windows\System\gxDkuSt.exe
  C:\Windows\System\gxDkuSt.exe
  2⤵
  PID:14124
- C:\Windows\System\KsAboxn.exe
  C:\Windows\System\KsAboxn.exe
  2⤵
  PID:14140
- C:\Windows\System\BlkXmBz.exe
  C:\Windows\System\BlkXmBz.exe
  2⤵
  PID:14156
- C:\Windows\System\GNCnaXx.exe
  C:\Windows\System\GNCnaXx.exe
  2⤵
  PID:14172
- C:\Windows\System\PiXudSt.exe
  C:\Windows\System\PiXudSt.exe
  2⤵
  PID:14188
- C:\Windows\System\KDDEGQi.exe
  C:\Windows\System\KDDEGQi.exe
  2⤵
  PID:14204
- C:\Windows\System\iSCmiRX.exe
  C:\Windows\System\iSCmiRX.exe
  2⤵
  PID:14220
- C:\Windows\System\zKQXioR.exe
  C:\Windows\System\zKQXioR.exe
  2⤵
  PID:14236
- C:\Windows\System\LrKIbqw.exe
  C:\Windows\System\LrKIbqw.exe
  2⤵
  PID:14252
- C:\Windows\System\OyLazpm.exe
  C:\Windows\System\OyLazpm.exe
  2⤵
  PID:14268
- C:\Windows\System\ouMojpr.exe
  C:\Windows\System\ouMojpr.exe
  2⤵
  PID:14284
- C:\Windows\System\QahJZzN.exe
  C:\Windows\System\QahJZzN.exe
  2⤵
  PID:14300
- C:\Windows\System\DCazKPp.exe
  C:\Windows\System\DCazKPp.exe
  2⤵
  PID:14316
- C:\Windows\System\UyuVtFv.exe
  C:\Windows\System\UyuVtFv.exe
  2⤵
  PID:14332
- C:\Windows\System\JIfOAjD.exe
  C:\Windows\System\JIfOAjD.exe
  2⤵
  PID:13336
- C:\Windows\System\tygvlyj.exe
  C:\Windows\System\tygvlyj.exe
  2⤵
  PID:13384
- C:\Windows\System\wmkrcPI.exe
  C:\Windows\System\wmkrcPI.exe
  2⤵
  PID:13320
- C:\Windows\System\ygqntzC.exe
  C:\Windows\System\ygqntzC.exe
  2⤵
  PID:13456
- C:\Windows\System\HBSKsql.exe
  C:\Windows\System\HBSKsql.exe
  2⤵
  PID:13464
- C:\Windows\System\xuQTJeQ.exe
  C:\Windows\System\xuQTJeQ.exe
  2⤵
  PID:12936
- C:\Windows\System\xxDMSjl.exe
  C:\Windows\System\xxDMSjl.exe
  2⤵
  PID:1660
- C:\Windows\System\nqBJvwm.exe
  C:\Windows\System\nqBJvwm.exe
  2⤵
  PID:13428
- C:\Windows\System\AWuKalS.exe
  C:\Windows\System\AWuKalS.exe
  2⤵
  PID:13504
- C:\Windows\System\ZehXhAX.exe
  C:\Windows\System\ZehXhAX.exe
  2⤵
  PID:2868
- C:\Windows\System\dOwwgyO.exe
  C:\Windows\System\dOwwgyO.exe
  2⤵
  PID:400
- C:\Windows\System\QfDHtbT.exe
  C:\Windows\System\QfDHtbT.exe
  2⤵
  PID:3232
- C:\Windows\System\ypuHQHc.exe
  C:\Windows\System\ypuHQHc.exe
  2⤵
  PID:5224
- C:\Windows\System\HTVLmut.exe
  C:\Windows\System\HTVLmut.exe
  2⤵
  PID:6088
- C:\Windows\System\ObHCRYP.exe
  C:\Windows\System\ObHCRYP.exe
  2⤵
  PID:13544
- C:\Windows\System\vqfGsOe.exe
  C:\Windows\System\vqfGsOe.exe
  2⤵
  PID:13608
- C:\Windows\System\bGKbpAB.exe
  C:\Windows\System\bGKbpAB.exe
  2⤵
  PID:13644
- C:\Windows\System\WkIjWJS.exe
  C:\Windows\System\WkIjWJS.exe
  2⤵
  PID:13676
- C:\Windows\System\DKdiZWi.exe
  C:\Windows\System\DKdiZWi.exe
  2⤵
  PID:13708
- C:\Windows\System\LQjKnxW.exe
  C:\Windows\System\LQjKnxW.exe
  2⤵
  PID:13744
- C:\Windows\System\QsqZIGE.exe
  C:\Windows\System\QsqZIGE.exe
  2⤵
  PID:13776
- C:\Windows\System\OTAymeC.exe
  C:\Windows\System\OTAymeC.exe
  2⤵
  PID:13612
- C:\Windows\System\ZjrjYCx.exe
  C:\Windows\System\ZjrjYCx.exe
  2⤵
  PID:13728
- C:\Windows\System\NxEyTyO.exe
  C:\Windows\System\NxEyTyO.exe
  2⤵
  PID:13792
- C:\Windows\System\nzUiJFE.exe
  C:\Windows\System\nzUiJFE.exe
  2⤵
  PID:3440
- C:\Windows\System\wefPgwl.exe
  C:\Windows\System\wefPgwl.exe
  2⤵
  PID:3656
- C:\Windows\System\GPTfYod.exe
  C:\Windows\System\GPTfYod.exe
  2⤵
  PID:13036
- C:\Windows\System\tWrTPuE.exe
  C:\Windows\System\tWrTPuE.exe
  2⤵
  PID:4936
- C:\Windows\System\iBxPUCN.exe
  C:\Windows\System\iBxPUCN.exe
  2⤵
  PID:13828
- C:\Windows\System\PJWUNic.exe
  C:\Windows\System\PJWUNic.exe
  2⤵
  PID:4108
- C:\Windows\System\VJUGFhI.exe
  C:\Windows\System\VJUGFhI.exe
  2⤵
  PID:13884
- C:\Windows\System\evhGeia.exe
  C:\Windows\System\evhGeia.exe
  2⤵
  PID:13916
- C:\Windows\System\fQFTWkr.exe
  C:\Windows\System\fQFTWkr.exe
  2⤵
  PID:13952
- C:\Windows\System\fbGlcGx.exe
  C:\Windows\System\fbGlcGx.exe
  2⤵
  PID:13984
- C:\Windows\System\kXJAQDf.exe
  C:\Windows\System\kXJAQDf.exe
  2⤵
  PID:14020
- C:\Windows\System\aIvtXmF.exe
  C:\Windows\System\aIvtXmF.exe
  2⤵
  PID:14072
- C:\Windows\System\RtgwdJx.exe
  C:\Windows\System\RtgwdJx.exe
  2⤵
  PID:14196
- C:\Windows\System\BOMVGZg.exe
  C:\Windows\System\BOMVGZg.exe
  2⤵
  PID:14276
- C:\Windows\System\EcEUtkO.exe
  C:\Windows\System\EcEUtkO.exe
  2⤵
  PID:14308
- C:\Windows\System\KlkdwQh.exe
  C:\Windows\System\KlkdwQh.exe
  2⤵
  PID:14324
- C:\Windows\System\gDNEROE.exe
  C:\Windows\System\gDNEROE.exe
  2⤵
  PID:13368
- C:\Windows\System\ThtbivB.exe
  C:\Windows\System\ThtbivB.exe
  2⤵
  PID:6216
- C:\Windows\System\VUHtpIN.exe
  C:\Windows\System\VUHtpIN.exe
  2⤵
  PID:13352
- C:\Windows\System\soKpXFh.exe
  C:\Windows\System\soKpXFh.exe
  2⤵
  PID:6448
- C:\Windows\System\LBidXom.exe
  C:\Windows\System\LBidXom.exe
  2⤵
  PID:13528
- C:\Windows\System\bcxjEoO.exe
  C:\Windows\System\bcxjEoO.exe
  2⤵
  PID:13808
- C:\Windows\System\Daheygy.exe
  C:\Windows\System\Daheygy.exe
  2⤵
  PID:6860
- C:\Windows\System\cNJNWsx.exe
  C:\Windows\System\cNJNWsx.exe
  2⤵
  PID:14100
- C:\Windows\System\TjJsMPm.exe
  C:\Windows\System\TjJsMPm.exe
  2⤵
  PID:14132
- C:\Windows\System\fVYdTTj.exe
  C:\Windows\System\fVYdTTj.exe
  2⤵
  PID:1232
- C:\Windows\System\WoNepPh.exe
  C:\Windows\System\WoNepPh.exe
  2⤵
  PID:7180
- C:\Windows\System\avuDKUW.exe
  C:\Windows\System\avuDKUW.exe
  2⤵
  PID:14248
- C:\Windows\System\Jlkxgtt.exe
  C:\Windows\System\Jlkxgtt.exe
  2⤵
  PID:14212
- C:\Windows\System\eIdENlZ.exe
  C:\Windows\System\eIdENlZ.exe
  2⤵
  PID:7548
- C:\Windows\System\ctHyzWf.exe
  C:\Windows\System\ctHyzWf.exe
  2⤵
  PID:1488
- C:\Windows\System\eBtgzxJ.exe
  C:\Windows\System\eBtgzxJ.exe
  2⤵
  PID:1152
- C:\Windows\System\TcUCVVg.exe
  C:\Windows\System\TcUCVVg.exe
  2⤵
  PID:14180
- C:\Windows\System\QqEaVQn.exe
  C:\Windows\System\QqEaVQn.exe
  2⤵
  PID:9200
- C:\Windows\System\QkyXkbt.exe
  C:\Windows\System\QkyXkbt.exe
  2⤵
  PID:8248
- C:\Windows\System\gYvvGHY.exe
  C:\Windows\System\gYvvGHY.exe
  2⤵
  PID:8308
- C:\Windows\System\vLlDjgm.exe
  C:\Windows\System\vLlDjgm.exe
  2⤵
  PID:8568
- C:\Windows\System\KdLqzIc.exe
  C:\Windows\System\KdLqzIc.exe
  2⤵
  PID:8712
- C:\Windows\System\Uwxvips.exe
  C:\Windows\System\Uwxvips.exe
  2⤵
  PID:9172
- C:\Windows\System\GWqrdfp.exe
  C:\Windows\System\GWqrdfp.exe
  2⤵
  PID:9156
- C:\Windows\System\jabBlAJ.exe
  C:\Windows\System\jabBlAJ.exe
  2⤵
  PID:8416
- C:\Windows\System\dsScRuX.exe
  C:\Windows\System\dsScRuX.exe
  2⤵
  PID:8476
- C:\Windows\System\sMAJHgk.exe
  C:\Windows\System\sMAJHgk.exe
  2⤵
  PID:8584
- C:\Windows\System\zwplaao.exe
  C:\Windows\System\zwplaao.exe
  2⤵
  PID:9284
- C:\Windows\System\BNPpPOB.exe
  C:\Windows\System\BNPpPOB.exe
  2⤵
  PID:9360
- C:\Windows\System\ZsjQPPj.exe
  C:\Windows\System\ZsjQPPj.exe
  2⤵
  PID:9396
- C:\Windows\System\zQuWmIx.exe
  C:\Windows\System\zQuWmIx.exe
  2⤵
  PID:4136
- C:\Windows\System\ZiaKcnx.exe
  C:\Windows\System\ZiaKcnx.exe
  2⤵
  PID:1904
- C:\Windows\System\shafJGl.exe
  C:\Windows\System\shafJGl.exe
  2⤵
  PID:9432
- C:\Windows\System\NRRjQtl.exe
  C:\Windows\System\NRRjQtl.exe
  2⤵
  PID:9540
- C:\Windows\System\dBiXyWb.exe
  C:\Windows\System\dBiXyWb.exe
  2⤵
  PID:9592
- C:\Windows\System\EqyDUaP.exe
  C:\Windows\System\EqyDUaP.exe
  2⤵
  PID:9664
- C:\Windows\System\JbXBaFz.exe
  C:\Windows\System\JbXBaFz.exe
  2⤵
  PID:9672
- C:\Windows\System\bvpFLKj.exe
  C:\Windows\System\bvpFLKj.exe
  2⤵
  PID:8508
- C:\Windows\System\NFKKLHK.exe
  C:\Windows\System\NFKKLHK.exe
  2⤵
  PID:9572
- C:\Windows\System\GrRIpYt.exe
  C:\Windows\System\GrRIpYt.exe
  2⤵
  PID:9452
- C:\Windows\System\METKSzp.exe
  C:\Windows\System\METKSzp.exe
  2⤵
  PID:7260
- C:\Windows\System\dojOoXB.exe
  C:\Windows\System\dojOoXB.exe
  2⤵
  PID:7316
- C:\Windows\System\QgbNeiB.exe
  C:\Windows\System\QgbNeiB.exe
  2⤵
  PID:14384
- C:\Windows\System\qsCOMyf.exe
  C:\Windows\System\qsCOMyf.exe
  2⤵
  PID:15188
- C:\Windows\System\cXsWEja.exe
  C:\Windows\System\cXsWEja.exe
  2⤵
  PID:15204
- C:\Windows\System\fjpgMti.exe
  C:\Windows\System\fjpgMti.exe
  2⤵
  PID:15220
- C:\Windows\System\qoOiykP.exe
  C:\Windows\System\qoOiykP.exe
  2⤵
  PID:15248
- C:\Windows\System\GAreqHR.exe
  C:\Windows\System\GAreqHR.exe
  2⤵
  PID:15276
- C:\Windows\System\HZoWtaw.exe
  C:\Windows\System\HZoWtaw.exe
  2⤵
  PID:15292
- C:\Windows\System\BJNUTYF.exe
  C:\Windows\System\BJNUTYF.exe
  2⤵
  PID:15308
- C:\Windows\System\wdKQrEc.exe
  C:\Windows\System\wdKQrEc.exe
  2⤵
  PID:15328
- C:\Windows\System\QobBZsl.exe
  C:\Windows\System\QobBZsl.exe
  2⤵
  PID:15344
- C:\Windows\System\aNAPiap.exe
  C:\Windows\System\aNAPiap.exe
  2⤵
  PID:13436
- C:\Windows\System\idjaFZx.exe
  C:\Windows\System\idjaFZx.exe
  2⤵
  PID:6560
- C:\Windows\System\fCsBswz.exe
  C:\Windows\System\fCsBswz.exe
  2⤵
  PID:4544
- C:\Windows\System\RMJlETg.exe
  C:\Windows\System\RMJlETg.exe
  2⤵
  PID:5840
- C:\Windows\System\PRxZtYs.exe
  C:\Windows\System\PRxZtYs.exe
  2⤵
  PID:7232
- C:\Windows\System\sdiawxS.exe
  C:\Windows\System\sdiawxS.exe
  2⤵
  PID:8940
- C:\Windows\System\LtOISvF.exe
  C:\Windows\System\LtOISvF.exe
  2⤵
  PID:4824
- C:\Windows\System\ZEnZSpu.exe
  C:\Windows\System\ZEnZSpu.exe
  2⤵
  PID:14184
- C:\Windows\System\dWIkPGc.exe
  C:\Windows\System\dWIkPGc.exe
  2⤵
  PID:6080
- C:\Windows\System\mVVqOEc.exe
  C:\Windows\System\mVVqOEc.exe
  2⤵
  PID:2936
- C:\Windows\System\ErjzndS.exe
  C:\Windows\System\ErjzndS.exe
  2⤵
  PID:2556
- C:\Windows\System\JQZqWiX.exe
  C:\Windows\System\JQZqWiX.exe
  2⤵
  PID:11452
- C:\Windows\System\wHRdogV.exe
  C:\Windows\System\wHRdogV.exe
  2⤵
  PID:11508
- C:\Windows\System\yZlSGiW.exe
  C:\Windows\System\yZlSGiW.exe
  2⤵
  PID:9152
- C:\Windows\System\SUzzuPk.exe
  C:\Windows\System\SUzzuPk.exe
  2⤵
  PID:8264
- C:\Windows\System\jAjhQnB.exe
  C:\Windows\System\jAjhQnB.exe
  2⤵
  PID:9188
- C:\Windows\System\xOVeSYU.exe
  C:\Windows\System\xOVeSYU.exe
  2⤵
  PID:11764
- C:\Windows\System\qQbthSI.exe
  C:\Windows\System\qQbthSI.exe
  2⤵
  PID:11804
- C:\Windows\System\OOKkhfC.exe
  C:\Windows\System\OOKkhfC.exe
  2⤵
  PID:5996
- C:\Windows\System\FjkzZeZ.exe
  C:\Windows\System\FjkzZeZ.exe
  2⤵
  PID:12112
- C:\Windows\System\JNqDMHs.exe
  C:\Windows\System\JNqDMHs.exe
  2⤵
  PID:9688
- C:\Windows\System\lnRPlja.exe
  C:\Windows\System\lnRPlja.exe
  2⤵
  PID:12248
- C:\Windows\System\PkhZapN.exe
  C:\Windows\System\PkhZapN.exe
  2⤵
  PID:10840
- C:\Windows\System\evZrwbN.exe
  C:\Windows\System\evZrwbN.exe
  2⤵
  PID:9860
- C:\Windows\System\TeztFvK.exe
  C:\Windows\System\TeztFvK.exe
  2⤵
  PID:9912
- C:\Windows\System\LJfLrvI.exe
  C:\Windows\System\LJfLrvI.exe
  2⤵
  PID:10896
- C:\Windows\System\FBNgKLF.exe
  C:\Windows\System\FBNgKLF.exe
  2⤵
  PID:4364
- C:\Windows\System\VYEdWKt.exe
  C:\Windows\System\VYEdWKt.exe
  2⤵
  PID:10224
- C:\Windows\System\cHQYHCv.exe
  C:\Windows\System\cHQYHCv.exe
  2⤵
  PID:9708
- C:\Windows\System\buiUjHG.exe
  C:\Windows\System\buiUjHG.exe
  2⤵
  PID:9616
- C:\Windows\System\abSKPTG.exe
  C:\Windows\System\abSKPTG.exe
  2⤵
  PID:9884
- C:\Windows\System\oHaBOsK.exe
  C:\Windows\System\oHaBOsK.exe
  2⤵
  PID:6040
- C:\Windows\System\TRbaUzo.exe
  C:\Windows\System\TRbaUzo.exe
  2⤵
  PID:4352
- C:\Windows\System\djMzdCH.exe
  C:\Windows\System\djMzdCH.exe
  2⤵
  PID:9828
- C:\Windows\System\zffDSyP.exe
  C:\Windows\System\zffDSyP.exe
  2⤵
  PID:9228
- C:\Windows\System\fZozHRj.exe
  C:\Windows\System\fZozHRj.exe
  2⤵
  PID:10316
- C:\Windows\System\RypRTrU.exe
  C:\Windows\System\RypRTrU.exe
  2⤵
  PID:10312
- C:\Windows\System\qeYxbkr.exe
  C:\Windows\System\qeYxbkr.exe
  2⤵
  PID:10436
- C:\Windows\System\bBnjpSj.exe
  C:\Windows\System\bBnjpSj.exe
  2⤵
  PID:2708
- C:\Windows\System\SmfmPCx.exe
  C:\Windows\System\SmfmPCx.exe
  2⤵
  PID:10476
- C:\Windows\System\mCixqLs.exe
  C:\Windows\System\mCixqLs.exe
  2⤵
  PID:10628
- C:\Windows\System\dFyjfRn.exe
  C:\Windows\System\dFyjfRn.exe
  2⤵
  PID:10576
- C:\Windows\System\JsmuHMg.exe
  C:\Windows\System\JsmuHMg.exe
  2⤵
  PID:1900
- C:\Windows\System\oCDWIlp.exe
  C:\Windows\System\oCDWIlp.exe
  2⤵
  PID:5280
- C:\Windows\System\igCXdQD.exe
  C:\Windows\System\igCXdQD.exe
  2⤵
  PID:8740
- C:\Windows\System\TLlePAo.exe
  C:\Windows\System\TLlePAo.exe
  2⤵
  PID:9252
- C:\Windows\System\FwEYiOo.exe
  C:\Windows\System\FwEYiOo.exe
  2⤵
  PID:5568
- C:\Windows\System\HwSPUov.exe
  C:\Windows\System\HwSPUov.exe
  2⤵
  PID:5640
- C:\Windows\System\llznXqf.exe
  C:\Windows\System\llznXqf.exe
  2⤵
  PID:5720
- C:\Windows\System\RqdnIGZ.exe
  C:\Windows\System\RqdnIGZ.exe
  2⤵
  PID:5144
- C:\Windows\System\MTwOoXT.exe
  C:\Windows\System\MTwOoXT.exe
  2⤵
  PID:4032
- C:\Windows\System\orKEcZh.exe
  C:\Windows\System\orKEcZh.exe
  2⤵
  PID:12752
- C:\Windows\System\XUHpRnj.exe
  C:\Windows\System\XUHpRnj.exe
  2⤵
  PID:12788
- C:\Windows\System\nstGTkj.exe
  C:\Windows\System\nstGTkj.exe
  2⤵
  PID:4888
- C:\Windows\System\sNbLlQw.exe
  C:\Windows\System\sNbLlQw.exe
  2⤵
  PID:3644
- C:\Windows\System\JscTiZM.exe
  C:\Windows\System\JscTiZM.exe
  2⤵
  PID:8960
- C:\Windows\System\DkfdDry.exe
  C:\Windows\System\DkfdDry.exe
  2⤵
  PID:13080
- C:\Windows\System\jsxLjxF.exe
  C:\Windows\System\jsxLjxF.exe
  2⤵
  PID:1196
- C:\Windows\System\XLvtSNC.exe
  C:\Windows\System\XLvtSNC.exe
  2⤵
  PID:8328
- C:\Windows\System\IjdpPLn.exe
  C:\Windows\System\IjdpPLn.exe
  2⤵
  PID:9292
- C:\Windows\System\umpSazP.exe
  C:\Windows\System\umpSazP.exe
  2⤵
  PID:9476
- C:\Windows\System\DhXkBsK.exe
  C:\Windows\System\DhXkBsK.exe
  2⤵
  PID:5300
- C:\Windows\System\bsQKgxR.exe
  C:\Windows\System\bsQKgxR.exe
  2⤵
  PID:1708
- C:\Windows\System\baCNQiX.exe
  C:\Windows\System\baCNQiX.exe
  2⤵
  PID:5740
- C:\Windows\System\DUHKgFj.exe
  C:\Windows\System\DUHKgFj.exe
  2⤵
  PID:10076
- C:\Windows\System\RZMzRNn.exe
  C:\Windows\System\RZMzRNn.exe
  2⤵
  PID:11232
- C:\Windows\System\FmWUdjv.exe
  C:\Windows\System\FmWUdjv.exe
  2⤵
  PID:1012
- C:\Windows\System\CPxopQH.exe
  C:\Windows\System\CPxopQH.exe
  2⤵
  PID:3944
- C:\Windows\System\NQIvVtL.exe
  C:\Windows\System\NQIvVtL.exe
  2⤵
  PID:5376
- C:\Windows\System\FkRUlMJ.exe
  C:\Windows\System\FkRUlMJ.exe
  2⤵
  PID:5432
- C:\Windows\System\pigskPP.exe
  C:\Windows\System\pigskPP.exe
  2⤵
  PID:5660
- C:\Windows\System\SEgJtwc.exe
  C:\Windows\System\SEgJtwc.exe
  2⤵
  PID:5892
- C:\Windows\System\yDODURh.exe
  C:\Windows\System\yDODURh.exe
  2⤵
  PID:7188
- C:\Windows\System\DcTAMBB.exe
  C:\Windows\System\DcTAMBB.exe
  2⤵
  PID:6056
- C:\Windows\System\IiOEeAB.exe
  C:\Windows\System\IiOEeAB.exe
  2⤵
  PID:4532
- C:\Windows\System\yVKIfca.exe
  C:\Windows\System\yVKIfca.exe
  2⤵
  PID:1452
- C:\Windows\System\MuJJoWq.exe
  C:\Windows\System\MuJJoWq.exe
  2⤵
  PID:1176
- C:\Windows\System\rHdfTJk.exe
  C:\Windows\System\rHdfTJk.exe
  2⤵
  PID:1800
- C:\Windows\System\ENHvwxp.exe
  C:\Windows\System\ENHvwxp.exe
  2⤵
  PID:11176
- C:\Windows\System\IFxFIBE.exe
  C:\Windows\System\IFxFIBE.exe
  2⤵
  PID:10552
- C:\Windows\System\aWjwmbL.exe
  C:\Windows\System\aWjwmbL.exe
  2⤵
  PID:4740
- C:\Windows\System\LChQGcl.exe
  C:\Windows\System\LChQGcl.exe
  2⤵
  PID:14116
- C:\Windows\System\xjMZmSJ.exe
  C:\Windows\System\xjMZmSJ.exe
  2⤵
  PID:5156
- C:\Windows\System\tRZwUXw.exe
  C:\Windows\System\tRZwUXw.exe
  2⤵
  PID:5484
- C:\Windows\System\SGyoher.exe
  C:\Windows\System\SGyoher.exe
  2⤵
  PID:5172
- C:\Windows\System\jBjKblL.exe
  C:\Windows\System\jBjKblL.exe
  2⤵
  PID:3756
- C:\Windows\System\YdiKifH.exe
  C:\Windows\System\YdiKifH.exe
  2⤵
  PID:9108
- C:\Windows\System\cUWArbg.exe
  C:\Windows\System\cUWArbg.exe
  2⤵
  PID:14340
- C:\Windows\System\qtvKtPg.exe
  C:\Windows\System\qtvKtPg.exe
  2⤵
  PID:14356
- C:\Windows\System\LuvgyyI.exe
  C:\Windows\System\LuvgyyI.exe
  2⤵
  PID:14376
- C:\Windows\System\pcfJMCY.exe
  C:\Windows\System\pcfJMCY.exe
  2⤵
  PID:14400
- C:\Windows\System\ozhbjDu.exe
  C:\Windows\System\ozhbjDu.exe
  2⤵
  PID:14412
- C:\Windows\System\QqqNdAt.exe
  C:\Windows\System\QqqNdAt.exe
  2⤵
  PID:14424
- C:\Windows\System\PfrNZWL.exe
  C:\Windows\System\PfrNZWL.exe
  2⤵
  PID:14440
- C:\Windows\System\KTXuJCO.exe
  C:\Windows\System\KTXuJCO.exe
  2⤵
  PID:14460
- C:\Windows\System\OkTJRnT.exe
  C:\Windows\System\OkTJRnT.exe
  2⤵
  PID:14476
- C:\Windows\System\GbZAMid.exe
  C:\Windows\System\GbZAMid.exe
  2⤵
  PID:14492
- C:\Windows\System\igQXZkq.exe
  C:\Windows\System\igQXZkq.exe
  2⤵
  PID:14508
- C:\Windows\System\mqWMtkN.exe
  C:\Windows\System\mqWMtkN.exe
  2⤵
  PID:14524
- C:\Windows\System\QVXXFEI.exe
  C:\Windows\System\QVXXFEI.exe
  2⤵
  PID:14544
- C:\Windows\System\AcdLPvx.exe
  C:\Windows\System\AcdLPvx.exe
  2⤵
  PID:14552
- C:\Windows\System\QQtNCLJ.exe
  C:\Windows\System\QQtNCLJ.exe
  2⤵
  PID:14572
- C:\Windows\System\bNwQCXw.exe
  C:\Windows\System\bNwQCXw.exe
  2⤵
  PID:14584
- C:\Windows\System\fISXMZV.exe
  C:\Windows\System\fISXMZV.exe
  2⤵
  PID:14604
- C:\Windows\System\jILngUO.exe
  C:\Windows\System\jILngUO.exe
  2⤵
  PID:14624
- C:\Windows\System\vXxeuGu.exe
  C:\Windows\System\vXxeuGu.exe
  2⤵
  PID:14640
- C:\Windows\System\owZGpln.exe
  C:\Windows\System\owZGpln.exe
  2⤵
  PID:14656
- C:\Windows\System\jjyqwnq.exe
  C:\Windows\System\jjyqwnq.exe
  2⤵
  PID:14668
- C:\Windows\System\czBOszw.exe
  C:\Windows\System\czBOszw.exe
  2⤵
  PID:14680
- C:\Windows\System\sFZnglP.exe
  C:\Windows\System\sFZnglP.exe
  2⤵
  PID:14696
- C:\Windows\System\uCwjgXq.exe
  C:\Windows\System\uCwjgXq.exe
  2⤵
  PID:14716
- C:\Windows\System\rjHGHEC.exe
  C:\Windows\System\rjHGHEC.exe
  2⤵
  PID:14728
- C:\Windows\System\QwqzZaY.exe
  C:\Windows\System\QwqzZaY.exe
  2⤵
  PID:14748
- C:\Windows\System\ZcyNNhG.exe
  C:\Windows\System\ZcyNNhG.exe
  2⤵
  PID:14764
- C:\Windows\System\LmvgTRX.exe
  C:\Windows\System\LmvgTRX.exe
  2⤵
  PID:14780
- C:\Windows\System\EvTAEIN.exe
  C:\Windows\System\EvTAEIN.exe
  2⤵
  PID:14792
- C:\Windows\System\qLoPEmA.exe
  C:\Windows\System\qLoPEmA.exe
  2⤵
  PID:14812
- C:\Windows\System\LpWSfPH.exe
  C:\Windows\System\LpWSfPH.exe
  2⤵
  PID:14828
- C:\Windows\System\HdRzQCt.exe
  C:\Windows\System\HdRzQCt.exe
  2⤵
  PID:14848
- C:\Windows\System\zHrmbEi.exe
  C:\Windows\System\zHrmbEi.exe
  2⤵
  PID:14864
- C:\Windows\System\KccGAiF.exe
  C:\Windows\System\KccGAiF.exe
  2⤵
  PID:14880
- C:\Windows\System\IXqGAsE.exe
  C:\Windows\System\IXqGAsE.exe
  2⤵
  PID:14896
- C:\Windows\System\WaIdHFy.exe
  C:\Windows\System\WaIdHFy.exe
  2⤵
  PID:14912
- C:\Windows\System\ZSctHUr.exe
  C:\Windows\System\ZSctHUr.exe
  2⤵
  PID:14924
- C:\Windows\System\wtmhgeF.exe
  C:\Windows\System\wtmhgeF.exe
  2⤵
  PID:14940
- C:\Windows\System\bPQxUBd.exe
  C:\Windows\System\bPQxUBd.exe
  2⤵
  PID:14956
- C:\Windows\System\LdtPXiO.exe
  C:\Windows\System\LdtPXiO.exe
  2⤵
  PID:14972
- C:\Windows\System\fwFguSj.exe
  C:\Windows\System\fwFguSj.exe
  2⤵
  PID:14988
- C:\Windows\System\faDaqrn.exe
  C:\Windows\System\faDaqrn.exe
  2⤵
  PID:15000
- C:\Windows\System\pvsZpoe.exe
  C:\Windows\System\pvsZpoe.exe
  2⤵
  PID:15024
- C:\Windows\System\AcniREv.exe
  C:\Windows\System\AcniREv.exe
  2⤵
  PID:15052
- C:\Windows\System\SksXcut.exe
  C:\Windows\System\SksXcut.exe
  2⤵
  PID:15068
- C:\Windows\System\pIJWbAi.exe
  C:\Windows\System\pIJWbAi.exe
  2⤵
  PID:15080
- C:\Windows\System\AqLCLAu.exe
  C:\Windows\System\AqLCLAu.exe
  2⤵
  PID:15104
- C:\Windows\System\mdePLtX.exe
  C:\Windows\System\mdePLtX.exe
  2⤵
  PID:5604
- C:\Windows\System\rmcXgau.exe
  C:\Windows\System\rmcXgau.exe
  2⤵
  PID:15116
- C:\Windows\System\viTpnkg.exe
  C:\Windows\System\viTpnkg.exe
  2⤵
  PID:15132
- C:\Windows\System\hzsngcG.exe
  C:\Windows\System\hzsngcG.exe
  2⤵
  PID:15148
- C:\Windows\System\NGfqnmT.exe
  C:\Windows\System\NGfqnmT.exe
  2⤵
  PID:15168
- C:\Windows\System\rAMKeib.exe
  C:\Windows\System\rAMKeib.exe
  2⤵
  PID:15184
- C:\Windows\System\ZmWPzrv.exe
  C:\Windows\System\ZmWPzrv.exe
  2⤵
  PID:15216
- C:\Windows\System\AOBXBVo.exe
  C:\Windows\System\AOBXBVo.exe
  2⤵
  PID:3956
- C:\Windows\System\tnaaGZj.exe
  C:\Windows\System\tnaaGZj.exe
  2⤵
  PID:15264
- C:\Windows\System\HAhPWjH.exe
  C:\Windows\System\HAhPWjH.exe
  2⤵
  PID:11648
- C:\Windows\System\msRpLvX.exe
  C:\Windows\System\msRpLvX.exe
  2⤵
  PID:15304
- C:\Windows\System\hYxlGpH.exe
  C:\Windows\System\hYxlGpH.exe
  2⤵
  PID:5780
- C:\Windows\System\OMkseUz.exe
  C:\Windows\System\OMkseUz.exe
  2⤵
  PID:15352
- C:\Windows\System\wmVYIJh.exe
  C:\Windows\System\wmVYIJh.exe
  2⤵
  PID:10600
- C:\Windows\System\ZMRfZQC.exe
  C:\Windows\System\ZMRfZQC.exe
  2⤵
  PID:12656
- C:\Windows\System\pFODRgn.exe
  C:\Windows\System\pFODRgn.exe
  2⤵
  PID:4680
- C:\Windows\System\NRCQTBP.exe
  C:\Windows\System\NRCQTBP.exe
  2⤵
  PID:3648
- C:\Windows\System\HhCraxJ.exe
  C:\Windows\System\HhCraxJ.exe
  2⤵
  PID:7020
- C:\Windows\System\TakPfxt.exe
  C:\Windows\System\TakPfxt.exe
  2⤵
  PID:7012
- C:\Windows\System\ZkpHJQh.exe
  C:\Windows\System\ZkpHJQh.exe
  2⤵
  PID:10248
- C:\Windows\System\SeLwQQw.exe
  C:\Windows\System\SeLwQQw.exe
  2⤵
  PID:6976
- C:\Windows\System\vpKdSgq.exe
  C:\Windows\System\vpKdSgq.exe
  2⤵
  PID:9796
- C:\Windows\System\SQODPta.exe
  C:\Windows\System\SQODPta.exe
  2⤵
  PID:6876
- C:\Windows\System\HLYXASX.exe
  C:\Windows\System\HLYXASX.exe
  2⤵
  PID:6940
- C:\Windows\System\CWLTNJs.exe
  C:\Windows\System\CWLTNJs.exe
  2⤵
  PID:6708
- C:\Windows\System\QVhTKsP.exe
  C:\Windows\System\QVhTKsP.exe
  2⤵
  PID:7128
- C:\Windows\System\kUKlhhI.exe
  C:\Windows\System\kUKlhhI.exe
  2⤵
  PID:6208
- C:\Windows\System\NlnhAAE.exe
  C:\Windows\System\NlnhAAE.exe
  2⤵
  PID:8216
- C:\Windows\System\BOEKLpg.exe
  C:\Windows\System\BOEKLpg.exe
  2⤵
  PID:10904
- C:\Windows\System\AsHJENn.exe
  C:\Windows\System\AsHJENn.exe
  2⤵
  PID:6672
- C:\Windows\System\EijHHCW.exe
  C:\Windows\System\EijHHCW.exe
  2⤵
  PID:11020
- C:\Windows\System\CNFdzbV.exe
  C:\Windows\System\CNFdzbV.exe
  2⤵
  PID:11608
- C:\Windows\System\lzstDpT.exe
  C:\Windows\System\lzstDpT.exe
  2⤵
  PID:6888
- C:\Windows\System\NAbRQiN.exe
  C:\Windows\System\NAbRQiN.exe
  2⤵
  PID:9288
- C:\Windows\System\YVpFzBy.exe
  C:\Windows\System\YVpFzBy.exe
  2⤵
  PID:6576
- C:\Windows\System\JtfLwtp.exe
  C:\Windows\System\JtfLwtp.exe
  2⤵
  PID:5492
- C:\Windows\System\PYpTyMt.exe
  C:\Windows\System\PYpTyMt.exe
  2⤵
  PID:13096
- C:\Windows\System\mFumBhu.exe
  C:\Windows\System\mFumBhu.exe
  2⤵
  PID:2596
- C:\Windows\System\czanzKV.exe
  C:\Windows\System\czanzKV.exe
  2⤵
  PID:7516
- C:\Windows\System\VydDykw.exe
  C:\Windows\System\VydDykw.exe
  2⤵
  PID:15032
- C:\Windows\System\TmznHUx.exe
  C:\Windows\System\TmznHUx.exe
  2⤵
  PID:3396
- C:\Windows\System\QhWuhOq.exe
  C:\Windows\System\QhWuhOq.exe
  2⤵
  PID:7740
- C:\Windows\System\qGuSwCY.exe
  C:\Windows\System\qGuSwCY.exe
  2⤵
  PID:3516
- C:\Windows\System\uPVVRzI.exe
  C:\Windows\System\uPVVRzI.exe
  2⤵
  PID:8012
- C:\Windows\System\MyowYbP.exe
  C:\Windows\System\MyowYbP.exe
  2⤵
  PID:9312
- C:\Windows\System\eNzrwVY.exe
  C:\Windows\System\eNzrwVY.exe
  2⤵
  PID:6112
- C:\Windows\System\lIYryrp.exe
  C:\Windows\System\lIYryrp.exe
  2⤵
  PID:7320
- C:\Windows\System\GpySkqO.exe
  C:\Windows\System\GpySkqO.exe
  2⤵
  PID:2364
- C:\Windows\System\GpQVcBZ.exe
  C:\Windows\System\GpQVcBZ.exe
  2⤵
  PID:5268
- C:\Windows\System\jDPCzic.exe
  C:\Windows\System\jDPCzic.exe
  2⤵
  PID:7616
- C:\Windows\System\DfkryWP.exe
  C:\Windows\System\DfkryWP.exe
  2⤵
  PID:5768
- C:\Windows\System\KHKVkVH.exe
  C:\Windows\System\KHKVkVH.exe
  2⤵
  PID:3688
- C:\Windows\System\CVbXDQy.exe
  C:\Windows\System\CVbXDQy.exe
  2⤵
  PID:4624
- C:\Windows\System\lHngYyS.exe
  C:\Windows\System\lHngYyS.exe
  2⤵
  PID:8260
- C:\Windows\System\gopqqVa.exe
  C:\Windows\System\gopqqVa.exe
  2⤵
  PID:10016
- C:\Windows\System\aPmLXgV.exe
  C:\Windows\System\aPmLXgV.exe
  2⤵
  PID:14352
- C:\Windows\System\jNirbkB.exe
  C:\Windows\System\jNirbkB.exe
  2⤵
  PID:14452
- C:\Windows\System\wqLNLIX.exe
  C:\Windows\System\wqLNLIX.exe
  2⤵
  PID:14496
- C:\Windows\System\zCXdWzh.exe
  C:\Windows\System\zCXdWzh.exe
  2⤵
  PID:14760
- C:\Windows\System\KQaeTWE.exe
  C:\Windows\System\KQaeTWE.exe
  2⤵
  PID:15012
- C:\Windows\System\IKNpBUr.exe
  C:\Windows\System\IKNpBUr.exe
  2⤵
  PID:3132
- C:\Windows\System\lAsSbwB.exe
  C:\Windows\System\lAsSbwB.exe
  2⤵
  PID:5200
- C:\Windows\System\JhlnBFt.exe
  C:\Windows\System\JhlnBFt.exe
  2⤵
  PID:3888
- C:\Windows\System\sySvKkq.exe
  C:\Windows\System\sySvKkq.exe
  2⤵
  PID:2480
- C:\Windows\System\mHVyLDJ.exe
  C:\Windows\System\mHVyLDJ.exe
  2⤵
  PID:6176
- C:\Windows\System\WXCaCvY.exe
  C:\Windows\System\WXCaCvY.exe
  2⤵
  PID:6280
- C:\Windows\System\bhBCSgR.exe
  C:\Windows\System\bhBCSgR.exe
  2⤵
  PID:6204
- C:\Windows\System\MLzssvb.exe
  C:\Windows\System\MLzssvb.exe
  2⤵
  PID:6304
- C:\Windows\System\HufOoHq.exe
  C:\Windows\System\HufOoHq.exe
  2⤵
  PID:8884
- C:\Windows\System\bOhfFta.exe
  C:\Windows\System\bOhfFta.exe
  2⤵
  PID:9936
- C:\Windows\System\zKmPpTD.exe
  C:\Windows\System\zKmPpTD.exe
  2⤵
  PID:3692
- C:\Windows\System\PxufsBn.exe
  C:\Windows\System\PxufsBn.exe
  2⤵
  PID:15084
- C:\Windows\System\RpeRCNc.exe
  C:\Windows\System\RpeRCNc.exe
  2⤵
  PID:9128
- C:\Windows\System\eXPGIbK.exe
  C:\Windows\System\eXPGIbK.exe
  2⤵
  PID:15112
- C:\Windows\System\KxXyJAq.exe
  C:\Windows\System\KxXyJAq.exe
  2⤵
  PID:15140
- C:\Windows\System\hfXMKMB.exe
  C:\Windows\System\hfXMKMB.exe
  2⤵
  PID:9036
- C:\Windows\System\bmGEdpx.exe
  C:\Windows\System\bmGEdpx.exe
  2⤵
  PID:15180
- C:\Windows\System\uyWjlUN.exe
  C:\Windows\System\uyWjlUN.exe
  2⤵
  PID:9240
- C:\Windows\System\ZzVPdtt.exe
  C:\Windows\System\ZzVPdtt.exe
  2⤵
  PID:8872
- C:\Windows\System\uIIBQfJ.exe
  C:\Windows\System\uIIBQfJ.exe
  2⤵
  PID:10456
- C:\Windows\System\lMDgdVu.exe
  C:\Windows\System\lMDgdVu.exe
  2⤵
  PID:15340
- C:\Windows\System\bTDsHWt.exe
  C:\Windows\System\bTDsHWt.exe
  2⤵
  PID:14004
- C:\Windows\System\ouVTmfM.exe
  C:\Windows\System\ouVTmfM.exe
  2⤵
  PID:9356
- C:\Windows\System\nOJgmNy.exe
  C:\Windows\System\nOJgmNy.exe
  2⤵
  PID:10664
- C:\Windows\System\kmNozwH.exe
  C:\Windows\System\kmNozwH.exe
  2⤵
  PID:8500
- C:\Windows\System\oCYqSWf.exe
  C:\Windows\System\oCYqSWf.exe
  2⤵
  PID:6936
- C:\Windows\System\oEcLEJQ.exe
  C:\Windows\System\oEcLEJQ.exe
  2⤵
  PID:8536
- C:\Windows\System\hxCAJjw.exe
  C:\Windows\System\hxCAJjw.exe
  2⤵
  PID:9700
- C:\Windows\System\VXADaNE.exe
  C:\Windows\System\VXADaNE.exe
  2⤵
  PID:10052
- C:\Windows\System\wMufXrL.exe
  C:\Windows\System\wMufXrL.exe
  2⤵
  PID:8848
- C:\Windows\System\FIwlQdV.exe
  C:\Windows\System\FIwlQdV.exe
  2⤵
  PID:8744
- C:\Windows\System\tcQMKnn.exe
  C:\Windows\System\tcQMKnn.exe
  2⤵
  PID:9244
- C:\Windows\System\SiHCApa.exe
  C:\Windows\System\SiHCApa.exe
  2⤵
  PID:8860
- C:\Windows\System\yZbEFFk.exe
  C:\Windows\System\yZbEFFk.exe
  2⤵
  PID:4500
- C:\Windows\System\ldnRXrj.exe
  C:\Windows\System\ldnRXrj.exe
  2⤵
  PID:8780
- C:\Windows\System\atOgkvf.exe
  C:\Windows\System\atOgkvf.exe
  2⤵
  PID:3280
- C:\Windows\System\LBBGqzo.exe
  C:\Windows\System\LBBGqzo.exe
  2⤵
  PID:3588
- C:\Windows\System\pUSRgZK.exe
  C:\Windows\System\pUSRgZK.exe
  2⤵
  PID:10924
- C:\Windows\System\fBXavfx.exe
  C:\Windows\System\fBXavfx.exe
  2⤵
  PID:11396
- C:\Windows\System\pjvNReg.exe
  C:\Windows\System\pjvNReg.exe
  2⤵
  PID:11448
- C:\Windows\System\EYUCGmM.exe
  C:\Windows\System\EYUCGmM.exe
  2⤵
  PID:9060
- C:\Windows\System\DHBBfEV.exe
  C:\Windows\System\DHBBfEV.exe
  2⤵
  PID:7088
- C:\Windows\System\dwUBhXy.exe
  C:\Windows\System\dwUBhXy.exe
  2⤵
  PID:8256
- C:\Windows\System\gaKXiSz.exe
  C:\Windows\System\gaKXiSz.exe
  2⤵
  PID:8472
- C:\Windows\System\DljNXWP.exe
  C:\Windows\System\DljNXWP.exe
  2⤵
  PID:8632
- C:\Windows\System\SJTwLMt.exe
  C:\Windows\System\SJTwLMt.exe
  2⤵
  PID:5612
- C:\Windows\System\COWEtra.exe
  C:\Windows\System\COWEtra.exe
  2⤵
  PID:4876
- C:\Windows\System\siSSoMB.exe
  C:\Windows\System\siSSoMB.exe
  2⤵
  PID:14380
- C:\Windows\System\WuDNBbA.exe
  C:\Windows\System\WuDNBbA.exe
  2⤵
  PID:9928
- C:\Windows\System\wiEfZOl.exe
  C:\Windows\System\wiEfZOl.exe
  2⤵
  PID:14456
- C:\Windows\System\idOIrGe.exe
  C:\Windows\System\idOIrGe.exe
  2⤵
  PID:9088
- C:\Windows\System\RDrFuJf.exe
  C:\Windows\System\RDrFuJf.exe
  2⤵
  PID:14556
- C:\Windows\System\LDvQlVL.exe
  C:\Windows\System\LDvQlVL.exe
  2⤵
  PID:14580
- C:\Windows\System\DXyjKCa.exe
  C:\Windows\System\DXyjKCa.exe
  2⤵
  PID:14628
- C:\Windows\System\PEprmGr.exe
  C:\Windows\System\PEprmGr.exe
  2⤵
  PID:14652
- C:\Windows\System\tIrnfdG.exe
  C:\Windows\System\tIrnfdG.exe
  2⤵
  PID:14700
- C:\Windows\System\OxYGGSd.exe
  C:\Windows\System\OxYGGSd.exe
  2⤵
  PID:14744
- C:\Windows\System\grTTvQb.exe
  C:\Windows\System\grTTvQb.exe
  2⤵
  PID:14796
- C:\Windows\System\JEnFGpU.exe
  C:\Windows\System\JEnFGpU.exe
  2⤵
  PID:14856
- C:\Windows\System\ADPfIHI.exe
  C:\Windows\System\ADPfIHI.exe
  2⤵
  PID:14900
- C:\Windows\System\CQPOVWe.exe
  C:\Windows\System\CQPOVWe.exe
  2⤵
  PID:14944
- C:\Windows\System\PIKMkhU.exe
  C:\Windows\System\PIKMkhU.exe
  2⤵
  PID:14984
- C:\Windows\System\hZjvrjN.exe
  C:\Windows\System\hZjvrjN.exe
  2⤵
  PID:10528
- C:\Windows\System\IftvRav.exe
  C:\Windows\System\IftvRav.exe
  2⤵
  PID:7084
- C:\Windows\System\mwyFXLY.exe
  C:\Windows\System\mwyFXLY.exe
  2⤵
  PID:10188
- C:\Windows\System\HPAAMUM.exe
  C:\Windows\System\HPAAMUM.exe
  2⤵
  PID:10948
- C:\Windows\System\nGmypCJ.exe
  C:\Windows\System\nGmypCJ.exe
  2⤵
  PID:6552
- C:\Windows\System\qllcigH.exe
  C:\Windows\System\qllcigH.exe
  2⤵
  PID:6456
- C:\Windows\System\VwgMkCF.exe
  C:\Windows\System\VwgMkCF.exe
  2⤵
  PID:7076
- C:\Windows\System\tenzqGG.exe
  C:\Windows\System\tenzqGG.exe
  2⤵
  PID:6384
- C:\Windows\System\DtaQLkp.exe
  C:\Windows\System\DtaQLkp.exe
  2⤵
  PID:6960
- C:\Windows\System\kwoDnTA.exe
  C:\Windows\System\kwoDnTA.exe
  2⤵
  PID:11460
- C:\Windows\System\uXkrwaU.exe
  C:\Windows\System\uXkrwaU.exe
  2⤵
  PID:8492
- C:\Windows\System\ifycmsP.exe
  C:\Windows\System\ifycmsP.exe
  2⤵
  PID:9660
- C:\Windows\System\CjkMeKI.exe
  C:\Windows\System\CjkMeKI.exe
  2⤵
  PID:10512
- C:\Windows\System\WaKbIOX.exe
  C:\Windows\System\WaKbIOX.exe
  2⤵
  PID:4160
- C:\Windows\System\hlmsmRa.exe
  C:\Windows\System\hlmsmRa.exe
  2⤵
  PID:6012
- C:\Windows\System\DjbjJJa.exe
  C:\Windows\System\DjbjJJa.exe
  2⤵
  PID:9792
- C:\Windows\System\IxxaMVH.exe
  C:\Windows\System\IxxaMVH.exe
  2⤵
  PID:11184
- C:\Windows\System\uTLIICq.exe
  C:\Windows\System\uTLIICq.exe
  2⤵
  PID:5168
- C:\Windows\System\qlKukko.exe
  C:\Windows\System\qlKukko.exe
  2⤵
  PID:396
- C:\Windows\System\DQnGLvn.exe
  C:\Windows\System\DQnGLvn.exe
  2⤵
  PID:11052
- C:\Windows\System\yakZnMY.exe
  C:\Windows\System\yakZnMY.exe
  2⤵
  PID:11296
- C:\Windows\System\KSfKRPA.exe
  C:\Windows\System\KSfKRPA.exe
  2⤵
  PID:11260
- C:\Windows\System\spLVRND.exe
  C:\Windows\System\spLVRND.exe
  2⤵
  PID:6788
- C:\Windows\System\smvqkuh.exe
  C:\Windows\System\smvqkuh.exe
  2⤵
  PID:10692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
1⤵
PID:5572

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y3sgdrnf.bdk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\HINShDU.exe

Filesize
1.2MB

MD5
a920c77b443230b350b61d2200407b89

SHA1
9997943eb5e3f80cc4fed8e5a782815cd1aae6b8

SHA256
0acc6ab7176be0852dd8532d264d72e050390ffe6a55796b10c85e5161fc57b6

SHA512
7a9c18206c93a5b76bd51f5f6375f95a67d03dc412474f96bfcd08ae654d8fba5f491781a2a4c0aad91c9417d9da0f8b6f8bd8256001ac52f044eb294567cc7c

Download Submit
C:\Windows\System\HePXqbu.exe

Filesize
8B

MD5
fa28085745e76a2db3f8ea4da13043e3

SHA1
a98650dbadb99f3a658cf782bcf0380df8184a61

SHA256
1e23f4a52a1b271c8a7555bdee76f6219b7a8f4eff50d897f5ec2f4e897342eb

SHA512
3ba62d00545d01cf5b69345a7ab2d1dcf069a6c252be5bd56368b7c42b036c31ccffe883a65a9ea1e4c952efaac4727c23159f2e94ab045958e7961d00b699d1

Download Submit
C:\Windows\System\InzDjYn.exe

Filesize
1.2MB

MD5
fe958a465f4a7db194f333593b2123ab

SHA1
88d8f713c6d5b5f0e554395d8cb9c7cebf4593d0

SHA256
e683e26dc4ff08e59d3b21f18ea24e49e54bad697b8e9585431da7829844e23e

SHA512
969612b81e7066134f1959ab9f42f616b5335a762fb64a180f95ddc7b066d73a05d3398c30671300daac26c30efff495fbcb997e664fe6c3653c3912973490f9

Download Submit
C:\Windows\System\LEBNkJs.exe

Filesize
1.2MB

MD5
2e5bd942bc5ba8e6c472d926bcf25817

SHA1
85909d7dc431f07afd0b56e4b32412edc95100a3

SHA256
140dc1c559d0ffa84caa89719abc52fc2392672e7200aa92969b30ab0039e2ea

SHA512
d8517cffb429832e81503f6d1a1078d27025011e628ddacdfb77af063affcfa87812972f8dc0b881b53f64480a56cc99b96727e443eb7aa89e9b51191e8cb9ab

Download Submit
C:\Windows\System\LdWAcAl.exe

Filesize
1.2MB

MD5
a9f461671e7959917b5c1b5bdfacdd42

SHA1
bd30823d11e6dc70b98f061ec11accb038530687

SHA256
c8f864410eefce301e959cd3f25a16696988ef917a6cc8a55ee0938eccbb99af

SHA512
73b3b8c62fa75a90a76904dce4aef77188d6d4befd991588808f89caa0f55a00121d570222185b2e5e132fa38971c4f42d91ad0bd7aed446ef39346299d6050d

Download Submit
C:\Windows\System\QtvLZZb.exe

Filesize
1.2MB

MD5
5a0c18501e094b7f04501ed0ee9c19e8

SHA1
19fd4c6d87bdd27993f88498973edba1f8b21637

SHA256
29e371f83b5d72494f57c6ad6974de4c4c8d062b7ebf9e3a6ce11b527c912b5d

SHA512
3c9e5d35088748c6bdf0cd39f789d87295c417a15653bc6ac128db60ab0ccd05964b965329a2e545284d2db57131cd5ae653e58cb596eea0409422ed068ea405

Download Submit
C:\Windows\System\SyzGIyE.exe

Filesize
1.2MB

MD5
6df94c4a615764614a7630e1edfade6f

SHA1
54fefb7947051cb99b0d98a5a776285f09d29146

SHA256
a7027a297c05d2e91532ebcfce3a41dc3be646cd666380b8e32a5fa5cf9a622c

SHA512
0bc30fb068dac8a413730a682e3da0a475da49ceb574690a3fb5822bba864d5d022785d779fdb4f2ade1b88a45ece9b7cbaca3fedbcf11712fda99ef402a993f

Download Submit
C:\Windows\System\TIAwIAf.exe

Filesize
1.2MB

MD5
f15fb7d0a5c6f8709daf1409bccc563b

SHA1
a4a656498fe5528a3547d4e51c5e2a8d9f746119

SHA256
b34416cee0acc174af4cd0680eec584fbb62ab671f590d2e4eadbdf205c82f9c

SHA512
e4d80f84868c082eb5e4ac2fa14e822df22a327f4f3efe38f8553d14cc2003d5ccaecbae1ba9c989156935f042c8ba65503639fc96bfc847ba87f415af652620

Download Submit
C:\Windows\System\TiDchIC.exe

Filesize
1.2MB

MD5
557db1df4693a1ce35670805d19d536b

SHA1
fdbe269df65e4e9c0ba25fedfe50f2c2845f5be3

SHA256
ed1dfbbfa0feca659fb6c39810ad7f72681c2ec13462a2d86a65ace7f5729867

SHA512
5fa763d6819f849750828260a384239d430c2e5e34ac80ad3960e9ada7e08cdd10225ba8dbc1d77eeb7f5aad97f5ad03b50dfbccd0b2e0e69330817ed503f577

Download Submit
C:\Windows\System\XLodkRW.exe

Filesize
1.2MB

MD5
7afdfc90f34ec2249412e7bc4cf14241

SHA1
5a02680d50872e2ab1551be5d999c48bc883bbf5

SHA256
26e040ddbb7e5b64d0c778decbb83cbe68e4d02d3c2789aacc97a88e64e9916d

SHA512
e1a0997e9e7866054e4cdd685410084fb94d891ad218cdeb0823a55ef826fae44106d53df97e7fbfe745e8eedcf46b00b3c6b1174716d03dd070d7d00671824a

Download Submit
C:\Windows\System\YCVevtn.exe

Filesize
1.2MB

MD5
93066c40da54ba40e874dc97e387c43f

SHA1
7c8b42c98c3e7878f0804b0c70eaa1f83f995fff

SHA256
193b14c70268f0871784ba17c0aaa91f73d0787c414146aa744eb981786af0ed

SHA512
5091efe642b30c38faf64b679d1d44c4a4a0877aa49f39838fe069a2cdd9ceb894d31dc8c0370f4c0d872e094e2a75ad14b499c1fa25b4ce04be13fb54e9a8d5

Download Submit
C:\Windows\System\YKdeVQN.exe

Filesize
1.2MB

MD5
05b592d3b81a6f693577e2f014b2296a

SHA1
aec60a0b85092ac472405a4e18d2af2dbabb40af

SHA256
ea8ff31810c86b61a435d09048d1a4a00ed93352aaea5d17c58a54fae87feecc

SHA512
65826ecef2a1be622541fddd4686b4d433c650bfc2233e773b5d393ba8b47ec3ab8bad276185648539eaf58673f05d188105ac9c4c6eec8c70d77674c24ed7e5

Download Submit
C:\Windows\System\bxmHcSR.exe

Filesize
1.2MB

MD5
e64ee5d43cfb3d1a152221eae703f7e0

SHA1
952430a4fab079d6181e3694827f92e86114d07b

SHA256
1cd84f4c6b38329bd985721ab60580c6862bf945d291bd3208c34fd43a4d7442

SHA512
d624fe389b6749f5211cff2b8f109003cd6286b95e39cc8f02c5289698d298f8fe203ce50dbf7bc591a5624084833b5d39d3a76aa0b6fae7888c9b2366898066

Download Submit
C:\Windows\System\eRoSsSj.exe

Filesize
1.2MB

MD5
d845ebed1c78e1210a3f74a826223703

SHA1
d8b74273b51936215b0de7eb48c707a459af38e3

SHA256
875658d98301794e865168d73a5c554df30a69177334ec70e0c9aaa6b96be56f

SHA512
3ec905e3b81aefdb71c744f9664298d45bc2532eae53a86c65ef9197fc9d5bb2c3b4702737832239617c636714ab12494088e665cff6c55b073b36ca28c5da92

Download Submit
C:\Windows\System\eTYuCWu.exe

Filesize
1.2MB

MD5
477c24f793394c504d939f574a62ec09

SHA1
08e3dd1f4a5db5eb2a8009b3141accbecbba1eec

SHA256
f9bcbc3f89ecadbab5144f02e1e45280ce0672e6ca0c5a487cad779c1981e5df

SHA512
c2ee7dbb278dda1db9364c0001e475a85abbc385ae2c271c51a00d3fa0322f1e09cd46b98d17149b6e869c42c7c6c25f4f634f72c304d8628b0e553aba1aa7c7

Download Submit
C:\Windows\System\fGNfWrL.exe

Filesize
1.2MB

MD5
521fb5501f0605bf7b0a88f59d33b76b

SHA1
31ce1d714ead059b51c08a2bbfed2375fa493e0a

SHA256
838bfaf83353fd96571b86421991e3f50ad4fc2d626d85ed138bed7a62a1d000

SHA512
49e647e63d38022c1f907644e6fd60a261c292a29db7c785133ba4a8939c1893c2db8a537de0f2d7fd286234b01f1a7acff142ffc4aa1d972817534df00041c1

Download Submit
C:\Windows\System\grkfYdZ.exe

Filesize
1.2MB

MD5
72f3bd7ebb28ee8e154d8bdff6673b7f

SHA1
723494d88223014d66c8462967ba21191ad45fac

SHA256
4d1f923f705fab837cd21319c2b25daefd641658201be20b935e407d54d1f45f

SHA512
d68999c89188d3cd8c585bdc59c241f631551f4fad29951e371e062e29532eef79ebafb56aeb92c0553e9322b760e69719808a73ae2f8f121693b0b694fdb888

Download Submit
C:\Windows\System\iLMdfFS.exe

Filesize
1.2MB

MD5
f046dfd25357ba84cd80b9767554ebf9

SHA1
f486c89a8a29152ff15af07b7c5a9c8a397ae244

SHA256
154b9ae04d7f13b8631d710b075d72af7c5d9428e910593e5faf27f6b5945714

SHA512
abc1d1a24031b372b47969b38ba361b4437585675d49f49cf03af4dabd1d8cc6c1c6f32ca017ac8fbfc2ce936a0017a22012d69bc0eed855fae06e0ddc0c26fa

Download Submit
C:\Windows\System\iVFDIjF.exe

Filesize
1.2MB

MD5
a49c43a850e7af7dfac9ccbdc8f76592

SHA1
31d8f63db20d6e64778037d2709ddcb13c37ffae

SHA256
f748e6db7098e28dc5cd4874c3949a3da844c8ddcdc91d34341b696874b1d7f2

SHA512
32459dc97768a0a787a474df554c3f7dc0df4918f3a8a98d90f3308aa2a43f03c57edbe50b537c8739ad5e168b3e7eb144febd79c1c2710a4b367d4608fb89df

Download Submit
C:\Windows\System\jDhWBmW.exe

Filesize
1.2MB

MD5
5507a51dc621a9e28ae31ba047b63c37

SHA1
5f238ae242025a1645b01b2bcdd4cc7ff1ce76e6

SHA256
935e7bc662fa0b241ab4f83cb13b1bb6dd3e96ce297184773bab8203d49d04d7

SHA512
16f95ce0ec5c8d8203b2b376abd8f321eef536732ba839f3438508cb9e05eb28f0e049f09674ed1843b366247601dd587a5a9676cbbb8584d9e2b6669d85c94d

Download Submit
C:\Windows\System\jHwzJIE.exe

Filesize
1.2MB

MD5
0dc8c035c9acc7ee6cd6a5ce82041054

SHA1
e9b7fb1dd8d46a1657a3e01d26295cc9cce10aac

SHA256
cd6a2fa777b1eeb359e132ce5c027c276c8205cc90700d27c06c9bef8a68cc93

SHA512
9a91d1bdc61c7241d91d2661f715374ec100780c181fa6b2820a4fcc410f500ef62b6ccbd61f15c9253730ddf43359c0cc1ac96b71385ac40f5c0c72eb658722

Download Submit
C:\Windows\System\jiDuZtw.exe

Filesize
1.2MB

MD5
e742a15b248a3f8af0511235eac0130d

SHA1
9a48f54ba7ebc8b6a17c55dfe7d4679f00833c3b

SHA256
82a05467f6aae9e48226841d9a70b5b0679a168aeda25ab5ab19b839739bea7e

SHA512
d4878384d4d0593ab3f1f775db1cdb06e34e2c4f9194f0ada3f320702e35d739346790162628c4c85c9a58d5d1b2ed67d27b22aab523bdd645a3df6b4a02ac6b

Download Submit
C:\Windows\System\jxTpRpv.exe

Filesize
1.2MB

MD5
e9fadd070cd71abce080d0d8a5635654

SHA1
255f41d51d68154269d172cc9c946d572270744a

SHA256
d4b56e1a9ddcfe19f1e14ee795fbbd078510ea4155987be7e1d81ee906aa91f9

SHA512
96c75aeccb59136ca93c5a0bda73e574b939c43536cfd090c16fe34c9a116ddd68e77751cd38aa9a41eb67718d681056564cb6a6a7462ce5a01e613f3eeb844c

Download Submit
C:\Windows\System\kaSrFkq.exe

Filesize
1.2MB

MD5
99c4b03a354d31cf3b9ad5ec229da8ae

SHA1
dd8ba3abdf564539c4e8dc1cbf7e2221c015e25c

SHA256
4300ba8fa783d43cc0a8a8e6a93a2ee28e6882c55ee03e9aff987fcb2645a822

SHA512
9b66f14f23a367a17c35c8635f3085023f8c1f002e9e5b8d906a48d8ade8d23e697602857b893791f77b28db5f2e167b758b80bc3c0588ec63ceb074a0146c11

Download Submit
C:\Windows\System\mpjIaMK.exe

Filesize
1.2MB

MD5
2b563f6eef9e683ef5b2bf725528c1d5

SHA1
19870823092bab2e415aca1cb885504876148d13

SHA256
1eb37e9ae452b0c7584c4e6f990adeb48ac92e88f028c98f3ddb7655fcc8e61b

SHA512
e10c0902cb7b75dced0501217edf85f25036c6e065fe31a7affed08e8a76eb5c78dd58f3c9c9b48baa7760ed29fee3c69aa7d8cc9ef2d536eaf6a3c5407b9bb5

Download Submit
C:\Windows\System\nxOdrWE.exe

Filesize
1.2MB

MD5
fdfa7bcde73330d9de34475b8894c2a5

SHA1
87d921647567e77e58593f7e36f74ed28b64926d

SHA256
ee24d1869cda455f8996448a3ec5d4090f244e71bd44fa5c05c941792ea5a96a

SHA512
f8e4fce38c8d20b3d6a7089271bc32ad1a99949d482891507d6fdb779d6a67a5a2c9e768e32be11262d78553257f7a151589d2dcd1d09ab0dbf1a25711565bce

Download Submit
C:\Windows\System\ovbCJsM.exe

Filesize
1.2MB

MD5
2fa32d4c3dd44eee906b3cb8ae6f4646

SHA1
2c5f2ac5c902537708a45ea221e59b72740e1d8f

SHA256
5c6e78793b6a31bfabacc3ae27b6dcce38e1f6b3a01a798ef0aec69f8a0853b1

SHA512
f72202fa4d60bfc85dc0e05697dd0263c9949c0a7c6b4633c1700cf3480e161fee205f82a9374ee216cfef42035d4849d18b9ef70163ff4860a8d5eea324623a

Download Submit
C:\Windows\System\pMmVssC.exe

Filesize
1.2MB

MD5
42e134758282f8cb8f0412e3a969fb46

SHA1
41b7d8632dacebde75a5864608c67fd92e7eaaf5

SHA256
62087f3544fd81e48b4a731d736fb1e509a9d724dbadbd0bbf32c31ede4ac6a3

SHA512
593e95c261c5245619393d5c03de0bb89ad7b74d482847b9b99d9aab39ebdc1b04c92aa8e6f7e42a1b7a31a9fc673bf4bf3bbfa4e0deebb19ccf96925e7983ff

Download Submit
C:\Windows\System\pgREbXE.exe

Filesize
1.2MB

MD5
1d7a42615cbe8ccb0a37f00c6d1f334c

SHA1
5e72cdfbeeb9eb84dec692e9b4b215ae566136fa

SHA256
4e8097549718729883aa26473187357ab44975df3a539eb6c651e936d4dd575f

SHA512
7fc9d375c54c95d1fc707aee174a9eb372ea972434695b00a0c774cb91e9e08cf4c790f39a59636ea785554d7b63bf71ab7a019dead3cac0b95e251d6389e9b4

Download Submit
C:\Windows\System\qeEMAoo.exe

Filesize
1.2MB

MD5
098fb3bf782e4983c9fe3926ebb3f4c2

SHA1
491e6fdcd5bb19244f776663b40826fb0e01cd3d

SHA256
bae21211a5f189354d53d93f3a69e284aa1cf4ddf830a8edeca2d29d467d2a67

SHA512
21927ab5d329fe1ecb89911b3a1d7688681b6546f6b386edc47d6bdda60b9448e940cac03c6cc3b8d9c04ded9034546492d97b09d99d1ed4ce2435ba7adeae3c

Download Submit
C:\Windows\System\qjtKIXO.exe

Filesize
18B

MD5
51c54756dc999e1b3d5a32be7e202f71

SHA1
3c216e0b07bf4bad80b52d9cfa0cad96f103bafb

SHA256
b32ae8d7c7b7bbd08c3407b9320fb40b2f27b5dd1bea587fa647c971761499b5

SHA512
7f3c7dd36053a00b7dea5b34ef0be776dbb3c44fe53fa11989fcd3237227f14369ae39acce4fe1ab9d3e76f75837ca35b0b2ccaab1831390a784ecdad4449b47

Download Submit
C:\Windows\System\taxYzsZ.exe

Filesize
1.2MB

MD5
37ae547ac23387fefe68724ab695bbe6

SHA1
93b3a2f2e35b189203572f2e52bc42075cda4a89

SHA256
cf1699a880e6e176833fab0e01482ef3947b587f458ad0630823e017fa581728

SHA512
6d12714caa16570f2171fb3b54d61747859ffd2f6e3fda56a536a2ec04e9bc33c0bf7b9a1555b856e1de4e7efa6c2d0084184897b19f7f217d64938156cb7070

Download Submit
C:\Windows\System\uvyaeNt.exe

Filesize
1.2MB

MD5
c9b98008303db4f355656eb17f0c5d0c

SHA1
f7b5953019d4a032c553f5608a513dc014f81f38

SHA256
260e640df2d36d9d764d2706c229dc9e19b4e2bf5fefe37665d0139af9074f02

SHA512
3c136fd448b016393a3b5970a82d0f72de7191315522ad82555b3801d94171d35ee69af08350d37daa99e56f984df02b6bf8ad28e8304d12c7e96680fd3f8382

Download Submit
C:\Windows\System\yPUNAET.exe

Filesize
1.2MB

MD5
0b68cef9a549f0dd01cef3555e05e4ed

SHA1
e8f9e9650a0c5b4f37d0af5440bb0d97b8bc0cbb

SHA256
865399be017e27bf52cfc9ddbcbdd5e5d8b0f091d4590ff0db0314a3ba6c1727

SHA512
de37e9a82a4d405df5f8e9b13d92e0fd7eb39d7d637101560567de091961bd142068acd89e50ec46e4a244eac8935123ce5b0304f4f352ebdb7afbbdc6144901

Download Submit
C:\Windows\System\ybnlpRv.exe

Filesize
1.2MB

MD5
de33e691cb303d2dbcac2dd18115743e

SHA1
2438c84e567d177b86bb5a0eeebfe13449ccdc2e

SHA256
cbfdb851f3bac96230e4e23f89d92082e5bc0386f78549f5fb4b6ae609a26591

SHA512
d9e51583bf4aac7a766de01526ee30e4bf4c8cfc60624c4fd9d3af9dd1803b4257225c575993de2e6ecdcd11a28bfd81e34cfcb9048395316ad0c9fd434ab71d

Download Submit
memory/372-5947-0x00007FF7775A0000-0x00007FF777992000-memory.dmp

Filesize
3.9MB

Download
memory/372-417-0x00007FF7775A0000-0x00007FF777992000-memory.dmp

Filesize
3.9MB

Download
memory/608-409-0x00007FF7EB6E0000-0x00007FF7EBAD2000-memory.dmp

Filesize
3.9MB

Download
memory/608-5360-0x00007FF7EB6E0000-0x00007FF7EBAD2000-memory.dmp

Filesize
3.9MB

Download
memory/764-5327-0x00007FF66F4A0000-0x00007FF66F892000-memory.dmp

Filesize
3.9MB

Download
memory/764-38-0x00007FF66F4A0000-0x00007FF66F892000-memory.dmp

Filesize
3.9MB

Download
memory/1476-5352-0x00007FF6F42E0000-0x00007FF6F46D2000-memory.dmp

Filesize
3.9MB

Download
memory/1476-84-0x00007FF6F42E0000-0x00007FF6F46D2000-memory.dmp

Filesize
3.9MB

Download
memory/1668-418-0x00007FF78A290000-0x00007FF78A682000-memory.dmp

Filesize
3.9MB

Download
memory/1832-413-0x00007FF6ECB00000-0x00007FF6ECEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1832-5366-0x00007FF6ECB00000-0x00007FF6ECEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-83-0x00007FF79D580000-0x00007FF79D972000-memory.dmp

Filesize
3.9MB

Download
memory/1856-5350-0x00007FF79D580000-0x00007FF79D972000-memory.dmp

Filesize
3.9MB

Download
memory/1992-5342-0x00007FF6F7330000-0x00007FF6F7722000-memory.dmp

Filesize
3.9MB

Download
memory/1992-80-0x00007FF6F7330000-0x00007FF6F7722000-memory.dmp

Filesize
3.9MB

Download
memory/2084-74-0x00007FF716940000-0x00007FF716D32000-memory.dmp

Filesize
3.9MB

Download
memory/2084-3625-0x00007FF716940000-0x00007FF716D32000-memory.dmp

Filesize
3.9MB

Download
memory/2084-6020-0x00007FF716940000-0x00007FF716D32000-memory.dmp

Filesize
3.9MB

Download
memory/2168-412-0x00007FF65DBC0000-0x00007FF65DFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-5362-0x00007FF65DBC0000-0x00007FF65DFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-13-0x00007FF7A93F0000-0x00007FF7A97E2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-5316-0x00007FF7A93F0000-0x00007FF7A97E2000-memory.dmp

Filesize
3.9MB

Download
memory/3300-5317-0x00007FF7E3F70000-0x00007FF7E4362000-memory.dmp

Filesize
3.9MB

Download
memory/3300-11-0x00007FF7E3F70000-0x00007FF7E4362000-memory.dmp

Filesize
3.9MB

Download
memory/3628-124-0x00000241DA1D0000-0x00000241DA1F2000-memory.dmp

Filesize
136KB

Download
memory/3628-408-0x00000241DAE30000-0x00000241DB5D6000-memory.dmp

Filesize
7.6MB

Download
memory/3696-58-0x00007FF722360000-0x00007FF722752000-memory.dmp

Filesize
3.9MB

Download
memory/3696-5333-0x00007FF722360000-0x00007FF722752000-memory.dmp

Filesize
3.9MB

Download
memory/3932-51-0x00007FF7A9040000-0x00007FF7A9432000-memory.dmp

Filesize
3.9MB

Download
memory/3932-3616-0x00007FF7A9040000-0x00007FF7A9432000-memory.dmp

Filesize
3.9MB

Download
memory/3932-5331-0x00007FF7A9040000-0x00007FF7A9432000-memory.dmp

Filesize
3.9MB

Download
memory/4056-65-0x00007FF6E5F80000-0x00007FF6E6372000-memory.dmp

Filesize
3.9MB

Download
memory/4056-5337-0x00007FF6E5F80000-0x00007FF6E6372000-memory.dmp

Filesize
3.9MB

Download
memory/4288-5372-0x00007FF629C40000-0x00007FF62A032000-memory.dmp

Filesize
3.9MB

Download
memory/4288-415-0x00007FF629C40000-0x00007FF62A032000-memory.dmp

Filesize
3.9MB

Download
memory/4536-5330-0x00007FF76EB80000-0x00007FF76EF72000-memory.dmp

Filesize
3.9MB

Download
memory/4536-76-0x00007FF76EB80000-0x00007FF76EF72000-memory.dmp

Filesize
3.9MB

Download
memory/4592-70-0x00007FF63EE00000-0x00007FF63F1F2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-5344-0x00007FF63EE00000-0x00007FF63F1F2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-5368-0x00007FF753030000-0x00007FF753422000-memory.dmp

Filesize
3.9MB

Download
memory/4644-414-0x00007FF753030000-0x00007FF753422000-memory.dmp

Filesize
3.9MB

Download
memory/4696-0-0x00007FF78C420000-0x00007FF78C812000-memory.dmp

Filesize
3.9MB

Download
memory/4696-1-0x00000295893A0000-0x00000295893B0000-memory.dmp

Filesize
64KB

Download
memory/4744-5382-0x00007FF79FE50000-0x00007FF7A0242000-memory.dmp

Filesize
3.9MB

Download
memory/4744-416-0x00007FF79FE50000-0x00007FF7A0242000-memory.dmp

Filesize
3.9MB

Download
memory/4800-5340-0x00007FF79EB40000-0x00007FF79EF32000-memory.dmp

Filesize
3.9MB

Download
memory/4800-79-0x00007FF79EB40000-0x00007FF79EF32000-memory.dmp

Filesize
3.9MB

Download
memory/4808-419-0x00007FF701EE0000-0x00007FF7022D2000-memory.dmp

Filesize
3.9MB

Download
memory/5044-17-0x00007FF76A310000-0x00007FF76A702000-memory.dmp

Filesize
3.9MB

Download
memory/5044-5314-0x00007FF76A310000-0x00007FF76A702000-memory.dmp

Filesize
3.9MB

Download
memory/5104-5358-0x00007FF6E21A0000-0x00007FF6E2592000-memory.dmp

Filesize
3.9MB

Download
memory/5104-411-0x00007FF6E21A0000-0x00007FF6E2592000-memory.dmp

Filesize
3.9MB

Download