xmrig | 6fc7d019b318275d9c6812a8bbeced34bdeacbef059b7720da5af2f6b9892c5c

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
Size

3.3MB
MD5

832d1f144cfe1650fd41dd130b84a790
SHA1

109e95b692ea6ebd22dee457dce2dc961dd83fe7
SHA256

6fc7d019b318275d9c6812a8bbeced34bdeacbef059b7720da5af2f6b9892c5c
SHA512

19a3639fb1821697db5f813f4e59237e5c27ab290297e591a1cc080d25c1664e75bb8bde5f785378ad9c1c0e9800fe230e0e301aa67ee0df40e5c792691c4dfd
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWn:7bBeSFk7

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 62 IoCs

miner

resource	yara_rule
behavioral1/memory/2952-1-0x000000013F970000-0x000000013FD66000-memory.dmp	xmrig
behavioral1/files/0x000b0000000122ec-5.dat	xmrig
behavioral1/memory/2704-13-0x000000013F880000-0x000000013FC76000-memory.dmp	xmrig
behavioral1/files/0x003400000001562a-16.dat	xmrig
behavioral1/files/0x0007000000004e76-21.dat	xmrig
behavioral1/files/0x0007000000015cb8-34.dat	xmrig
behavioral1/files/0x0007000000015cc7-38.dat	xmrig
behavioral1/files/0x0006000000016103-51.dat	xmrig
behavioral1/files/0x00060000000165a8-73.dat	xmrig
behavioral1/files/0x000600000001686d-83.dat	xmrig
behavioral1/files/0x000600000001663f-78.dat	xmrig
behavioral1/files/0x00060000000164a9-68.dat	xmrig
behavioral1/files/0x0006000000016255-58.dat	xmrig
behavioral1/files/0x0006000000016310-63.dat	xmrig
behavioral1/files/0x0007000000015ff4-48.dat	xmrig
behavioral1/files/0x0009000000015ccf-44.dat	xmrig
behavioral1/files/0x0008000000015ca2-29.dat	xmrig
behavioral1/files/0x0006000000016d61-161.dat	xmrig
behavioral1/files/0x0006000000017042-189.dat	xmrig
behavioral1/files/0x0006000000016de7-182.dat	xmrig
behavioral1/files/0x0006000000016dda-175.dat	xmrig
behavioral1/files/0x0006000000016d69-168.dat	xmrig
behavioral1/files/0x0006000000016d45-154.dat	xmrig
behavioral1/files/0x0006000000016d34-147.dat	xmrig
behavioral1/files/0x0006000000016d1b-140.dat	xmrig
behavioral1/files/0x0006000000016cc3-133.dat	xmrig
behavioral1/files/0x0006000000016c71-126.dat	xmrig
behavioral1/files/0x0006000000016c56-120.dat	xmrig
behavioral1/memory/2736-94-0x000000013F640000-0x000000013FA36000-memory.dmp	xmrig
behavioral1/files/0x0006000000016abb-88.dat	xmrig
behavioral1/memory/2800-96-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/memory/2964-98-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	xmrig
behavioral1/memory/1316-104-0x000000013F410000-0x000000013F806000-memory.dmp	xmrig
behavioral1/memory/2732-102-0x000000013F1C0000-0x000000013F5B6000-memory.dmp	xmrig
behavioral1/memory/2684-100-0x000000013F200000-0x000000013F5F6000-memory.dmp	xmrig
behavioral1/memory/2692-106-0x000000013FC20000-0x0000000140016000-memory.dmp	xmrig
behavioral1/memory/2952-107-0x000000013F1C0000-0x000000013F5B6000-memory.dmp	xmrig
behavioral1/memory/2528-108-0x000000013F1C0000-0x000000013F5B6000-memory.dmp	xmrig
behavioral1/memory/1360-112-0x000000013FC00000-0x000000013FFF6000-memory.dmp	xmrig
behavioral1/memory/2588-110-0x000000013FCF0000-0x00000001400E6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016c7a-128.dat	xmrig
behavioral1/files/0x0006000000016d2c-142.dat	xmrig
behavioral1/files/0x0006000000016eb9-184.dat	xmrig
behavioral1/files/0x0006000000016dde-177.dat	xmrig
behavioral1/files/0x0006000000016d71-170.dat	xmrig
behavioral1/files/0x0006000000016d65-163.dat	xmrig
behavioral1/files/0x0006000000016d3d-149.dat	xmrig
behavioral1/files/0x0006000000016d4e-156.dat	xmrig
behavioral1/files/0x0032000000015678-121.dat	xmrig
behavioral1/files/0x0006000000016ce7-135.dat	xmrig
behavioral1/memory/2276-114-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	xmrig
behavioral1/memory/2736-5727-0x000000013F640000-0x000000013FA36000-memory.dmp	xmrig
behavioral1/memory/2704-5729-0x000000013F880000-0x000000013FC76000-memory.dmp	xmrig
behavioral1/memory/2684-5731-0x000000013F200000-0x000000013F5F6000-memory.dmp	xmrig
behavioral1/memory/2964-5732-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	xmrig
behavioral1/memory/2732-5737-0x000000013F1C0000-0x000000013F5B6000-memory.dmp	xmrig
behavioral1/memory/2692-5736-0x000000013FC20000-0x0000000140016000-memory.dmp	xmrig
behavioral1/memory/1360-5735-0x000000013FC00000-0x000000013FFF6000-memory.dmp	xmrig
behavioral1/memory/2528-5734-0x000000013F1C0000-0x000000013F5B6000-memory.dmp	xmrig
behavioral1/memory/1316-5730-0x000000013F410000-0x000000013F806000-memory.dmp	xmrig
behavioral1/memory/2588-5739-0x000000013FCF0000-0x00000001400E6000-memory.dmp	xmrig
behavioral1/memory/2276-5741-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2364	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2704	mJAbxes.exe
2736	sSVyTnM.exe
2800	SfpBiXu.exe
2964	WXGCVfB.exe
2684	RWZlFQU.exe
2732	whUdhmp.exe
1316	vVDlkBF.exe
2692	OStvDMt.exe
2528	blUSHEC.exe
2588	nfvjnzy.exe
1360	iigyOWo.exe
2276	ncQmeoo.exe
2184	McxYRDq.exe
2880	UbdQaOy.exe
2708	TGyZlwz.exe
3032	egSEWJx.exe
2848	qfENeka.exe
1632	fLoCfSJ.exe
1772	nexYcjG.exe
1064	MssgiqJ.exe
1904	wtzdDQy.exe
2016	eZuyTcJ.exe
780	peZIYSH.exe
284	UONqZGa.exe
2400	eEOQfso.exe
1396	XLyKfai.exe
2352	JTqtKDl.exe
2492	uMWxGTB.exe
1908	gcPfQBO.exe
1256	CiGZjQj.exe
2436	xmCyAoI.exe
1652	JDDulkt.exe
1140	qLPrFDP.exe
2240	LubPFcy.exe
396	dZupAVW.exe
2108	sjtnWsq.exe
2420	JGFeJnp.exe
2452	iHDsJba.exe
1724	pACGjhM.exe
1596	bFIzPEs.exe
2652	UnDkdtW.exe
2680	qTyZYpP.exe
2924	KqXXmQQ.exe
2540	LGUtIMp.exe
2404	svlWkPB.exe
2904	WxdJywh.exe
2196	ACMrPhJ.exe
2328	gWeGgJy.exe
1044	IxXyMzb.exe
1648	jCiclPJ.exe
2504	lKNhNDD.exe
2140	oyiktKh.exe
872	PAlpjgh.exe
2720	lxjihrY.exe
1880	wUOUzBT.exe
1540	huqWedU.exe
3084	NoEaSBe.exe
3116	eOPUKAs.exe
3148	bQavdVP.exe
3180	BqgvbPC.exe
3212	laQpjpX.exe
3244	TWtLJrK.exe
3276	YXbjuBL.exe
3308	UBSajNj.exe

Loads dropped DLL 64 IoCs

pid	Process
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2952-1-0x000000013F970000-0x000000013FD66000-memory.dmp	upx
behavioral1/files/0x000b0000000122ec-5.dat	upx
behavioral1/memory/2704-13-0x000000013F880000-0x000000013FC76000-memory.dmp	upx
behavioral1/files/0x003400000001562a-16.dat	upx
behavioral1/files/0x0007000000004e76-21.dat	upx
behavioral1/files/0x0007000000015cb8-34.dat	upx
behavioral1/files/0x0007000000015cc7-38.dat	upx
behavioral1/files/0x0006000000016103-51.dat	upx
behavioral1/files/0x00060000000165a8-73.dat	upx
behavioral1/files/0x000600000001686d-83.dat	upx
behavioral1/files/0x000600000001663f-78.dat	upx
behavioral1/files/0x00060000000164a9-68.dat	upx
behavioral1/files/0x0006000000016255-58.dat	upx
behavioral1/files/0x0006000000016310-63.dat	upx
behavioral1/files/0x0007000000015ff4-48.dat	upx
behavioral1/files/0x0009000000015ccf-44.dat	upx
behavioral1/files/0x0008000000015ca2-29.dat	upx
behavioral1/files/0x0006000000016d61-161.dat	upx
behavioral1/files/0x0006000000017042-189.dat	upx
behavioral1/files/0x0006000000016de7-182.dat	upx
behavioral1/files/0x0006000000016dda-175.dat	upx
behavioral1/files/0x0006000000016d69-168.dat	upx
behavioral1/files/0x0006000000016d45-154.dat	upx
behavioral1/files/0x0006000000016d34-147.dat	upx
behavioral1/files/0x0006000000016d1b-140.dat	upx
behavioral1/files/0x0006000000016cc3-133.dat	upx
behavioral1/files/0x0006000000016c71-126.dat	upx
behavioral1/files/0x0006000000016c56-120.dat	upx
behavioral1/memory/2736-94-0x000000013F640000-0x000000013FA36000-memory.dmp	upx
behavioral1/files/0x0006000000016abb-88.dat	upx
behavioral1/memory/2800-96-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/memory/2964-98-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	upx
behavioral1/memory/1316-104-0x000000013F410000-0x000000013F806000-memory.dmp	upx
behavioral1/memory/2732-102-0x000000013F1C0000-0x000000013F5B6000-memory.dmp	upx
behavioral1/memory/2684-100-0x000000013F200000-0x000000013F5F6000-memory.dmp	upx
behavioral1/memory/2692-106-0x000000013FC20000-0x0000000140016000-memory.dmp	upx
behavioral1/memory/2528-108-0x000000013F1C0000-0x000000013F5B6000-memory.dmp	upx
behavioral1/memory/1360-112-0x000000013FC00000-0x000000013FFF6000-memory.dmp	upx
behavioral1/memory/2588-110-0x000000013FCF0000-0x00000001400E6000-memory.dmp	upx
behavioral1/files/0x0006000000016c7a-128.dat	upx
behavioral1/files/0x0006000000016d2c-142.dat	upx
behavioral1/files/0x0006000000016eb9-184.dat	upx
behavioral1/files/0x0006000000016dde-177.dat	upx
behavioral1/files/0x0006000000016d71-170.dat	upx
behavioral1/files/0x0006000000016d65-163.dat	upx
behavioral1/files/0x0006000000016d3d-149.dat	upx
behavioral1/files/0x0006000000016d4e-156.dat	upx
behavioral1/files/0x0032000000015678-121.dat	upx
behavioral1/files/0x0006000000016ce7-135.dat	upx
behavioral1/memory/2276-114-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	upx
behavioral1/memory/2736-5727-0x000000013F640000-0x000000013FA36000-memory.dmp	upx
behavioral1/memory/2704-5729-0x000000013F880000-0x000000013FC76000-memory.dmp	upx
behavioral1/memory/2684-5731-0x000000013F200000-0x000000013F5F6000-memory.dmp	upx
behavioral1/memory/2964-5732-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	upx
behavioral1/memory/2732-5737-0x000000013F1C0000-0x000000013F5B6000-memory.dmp	upx
behavioral1/memory/2692-5736-0x000000013FC20000-0x0000000140016000-memory.dmp	upx
behavioral1/memory/1360-5735-0x000000013FC00000-0x000000013FFF6000-memory.dmp	upx
behavioral1/memory/2528-5734-0x000000013F1C0000-0x000000013F5B6000-memory.dmp	upx
behavioral1/memory/1316-5730-0x000000013F410000-0x000000013F806000-memory.dmp	upx
behavioral1/memory/2588-5739-0x000000013FCF0000-0x00000001400E6000-memory.dmp	upx
behavioral1/memory/2276-5741-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yzVNvvy.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\okmqVtQ.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\Gjjkscy.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\SAtVcxu.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\RfgRjwY.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\xTLMIvf.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\DFoewJF.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\zVAgdIP.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\elBKKes.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\RZvORMA.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\rxpbrOz.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\ZpIAosF.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\qrrCfzd.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\SBCbogx.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\RaqYrko.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\bkbYpZD.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\OsMCGKp.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\CuHstmJ.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\tjTxjQP.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\fROlQvD.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\vLlLqKQ.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\yJuIEgH.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\tLpEotP.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\PmOLRWd.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\vaLrtOy.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\XkvNBKd.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\HWHjZlQ.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\JEbvSbo.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\jYfgybo.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\EFJpMyd.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\EHFbaVK.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\qUMKwss.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\IaVcrvM.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\fGwAvcy.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\LLDnjRH.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\wlBYzgT.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\pAQixLX.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\wPwJbVj.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\hOSfpAK.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\eoxqpID.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\WLgoVcf.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\oBOJnFs.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\zIRnwUS.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\gJIyNxg.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\JWRsWBj.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\itIAgpa.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\hHmKZqE.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\QGwvaKu.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\OgrTCTs.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\YRZjWWn.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\LlsdWDF.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\mMHVUKp.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\RAcvZai.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\YzXiklM.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\LUSFEeX.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\OPcchVg.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\nmnmJyk.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\aNQFNIf.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\lskAaSy.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\matpbKg.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\aVjKLFH.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\RgOIjlt.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\VcHjZLL.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
File created	C:\Windows\System\slkxScq.exe	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2364	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeLockMemoryPrivilege	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2364	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	29
PID 2952 wrote to memory of 2364	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	29
PID 2952 wrote to memory of 2364	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	29
PID 2952 wrote to memory of 2704	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	30
PID 2952 wrote to memory of 2704	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	30
PID 2952 wrote to memory of 2704	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	30
PID 2952 wrote to memory of 2736	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	31
PID 2952 wrote to memory of 2736	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	31
PID 2952 wrote to memory of 2736	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	31
PID 2952 wrote to memory of 2800	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	32
PID 2952 wrote to memory of 2800	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	32
PID 2952 wrote to memory of 2800	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	32
PID 2952 wrote to memory of 2964	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	33
PID 2952 wrote to memory of 2964	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	33
PID 2952 wrote to memory of 2964	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	33
PID 2952 wrote to memory of 2684	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	34
PID 2952 wrote to memory of 2684	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	34
PID 2952 wrote to memory of 2684	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	34
PID 2952 wrote to memory of 2732	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	35
PID 2952 wrote to memory of 2732	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	35
PID 2952 wrote to memory of 2732	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	35
PID 2952 wrote to memory of 1316	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	36
PID 2952 wrote to memory of 1316	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	36
PID 2952 wrote to memory of 1316	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	36
PID 2952 wrote to memory of 2692	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	37
PID 2952 wrote to memory of 2692	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	37
PID 2952 wrote to memory of 2692	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	37
PID 2952 wrote to memory of 2528	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	38
PID 2952 wrote to memory of 2528	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	38
PID 2952 wrote to memory of 2528	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	38
PID 2952 wrote to memory of 2588	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	39
PID 2952 wrote to memory of 2588	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	39
PID 2952 wrote to memory of 2588	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	39
PID 2952 wrote to memory of 1360	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	40
PID 2952 wrote to memory of 1360	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	40
PID 2952 wrote to memory of 1360	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	40
PID 2952 wrote to memory of 2276	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	41
PID 2952 wrote to memory of 2276	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	41
PID 2952 wrote to memory of 2276	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	41
PID 2952 wrote to memory of 2184	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	42
PID 2952 wrote to memory of 2184	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	42
PID 2952 wrote to memory of 2184	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	42
PID 2952 wrote to memory of 2880	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	43
PID 2952 wrote to memory of 2880	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	43
PID 2952 wrote to memory of 2880	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	43
PID 2952 wrote to memory of 2708	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	44
PID 2952 wrote to memory of 2708	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	44
PID 2952 wrote to memory of 2708	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	44
PID 2952 wrote to memory of 3032	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	45
PID 2952 wrote to memory of 3032	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	45
PID 2952 wrote to memory of 3032	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	45
PID 2952 wrote to memory of 2848	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	46
PID 2952 wrote to memory of 2848	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	46
PID 2952 wrote to memory of 2848	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	46
PID 2952 wrote to memory of 1084	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	47
PID 2952 wrote to memory of 1084	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	47
PID 2952 wrote to memory of 1084	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	47
PID 2952 wrote to memory of 1632	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	48
PID 2952 wrote to memory of 1632	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	48
PID 2952 wrote to memory of 1632	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	48
PID 2952 wrote to memory of 624	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	49
PID 2952 wrote to memory of 624	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	49
PID 2952 wrote to memory of 624	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	49
PID 2952 wrote to memory of 1772	2952	832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\832d1f144cfe1650fd41dd130b84a790_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\System\mJAbxes.exe
  C:\Windows\System\mJAbxes.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\sSVyTnM.exe
  C:\Windows\System\sSVyTnM.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\SfpBiXu.exe
  C:\Windows\System\SfpBiXu.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\WXGCVfB.exe
  C:\Windows\System\WXGCVfB.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\RWZlFQU.exe
  C:\Windows\System\RWZlFQU.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\whUdhmp.exe
  C:\Windows\System\whUdhmp.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\vVDlkBF.exe
  C:\Windows\System\vVDlkBF.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\OStvDMt.exe
  C:\Windows\System\OStvDMt.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\blUSHEC.exe
  C:\Windows\System\blUSHEC.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\nfvjnzy.exe
  C:\Windows\System\nfvjnzy.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\iigyOWo.exe
  C:\Windows\System\iigyOWo.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ncQmeoo.exe
  C:\Windows\System\ncQmeoo.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\McxYRDq.exe
  C:\Windows\System\McxYRDq.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\UbdQaOy.exe
  C:\Windows\System\UbdQaOy.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\TGyZlwz.exe
  C:\Windows\System\TGyZlwz.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\egSEWJx.exe
  C:\Windows\System\egSEWJx.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\qfENeka.exe
  C:\Windows\System\qfENeka.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ORPLfnL.exe
  C:\Windows\System\ORPLfnL.exe
  2⤵
  PID:1084
- C:\Windows\System\fLoCfSJ.exe
  C:\Windows\System\fLoCfSJ.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\RGmyEZV.exe
  C:\Windows\System\RGmyEZV.exe
  2⤵
  PID:624
- C:\Windows\System\nexYcjG.exe
  C:\Windows\System\nexYcjG.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\kECjknf.exe
  C:\Windows\System\kECjknf.exe
  2⤵
  PID:1152
- C:\Windows\System\MssgiqJ.exe
  C:\Windows\System\MssgiqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\bsyzoZp.exe
  C:\Windows\System\bsyzoZp.exe
  2⤵
  PID:2980
- C:\Windows\System\wtzdDQy.exe
  C:\Windows\System\wtzdDQy.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\VAgdhKI.exe
  C:\Windows\System\VAgdhKI.exe
  2⤵
  PID:2992
- C:\Windows\System\eZuyTcJ.exe
  C:\Windows\System\eZuyTcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\xQiLwgz.exe
  C:\Windows\System\xQiLwgz.exe
  2⤵
  PID:536
- C:\Windows\System\peZIYSH.exe
  C:\Windows\System\peZIYSH.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\OmGqgPf.exe
  C:\Windows\System\OmGqgPf.exe
  2⤵
  PID:996
- C:\Windows\System\UONqZGa.exe
  C:\Windows\System\UONqZGa.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\ClbTWAa.exe
  C:\Windows\System\ClbTWAa.exe
  2⤵
  PID:1620
- C:\Windows\System\eEOQfso.exe
  C:\Windows\System\eEOQfso.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\VaCUSZR.exe
  C:\Windows\System\VaCUSZR.exe
  2⤵
  PID:1916
- C:\Windows\System\XLyKfai.exe
  C:\Windows\System\XLyKfai.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\LHcrSrg.exe
  C:\Windows\System\LHcrSrg.exe
  2⤵
  PID:2080
- C:\Windows\System\JTqtKDl.exe
  C:\Windows\System\JTqtKDl.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\UxhlTks.exe
  C:\Windows\System\UxhlTks.exe
  2⤵
  PID:1040
- C:\Windows\System\uMWxGTB.exe
  C:\Windows\System\uMWxGTB.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\fHcYeSG.exe
  C:\Windows\System\fHcYeSG.exe
  2⤵
  PID:268
- C:\Windows\System\gcPfQBO.exe
  C:\Windows\System\gcPfQBO.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\UXsOMih.exe
  C:\Windows\System\UXsOMih.exe
  2⤵
  PID:1536
- C:\Windows\System\CiGZjQj.exe
  C:\Windows\System\CiGZjQj.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\kYUEmPM.exe
  C:\Windows\System\kYUEmPM.exe
  2⤵
  PID:772
- C:\Windows\System\xmCyAoI.exe
  C:\Windows\System\xmCyAoI.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\twhQrWk.exe
  C:\Windows\System\twhQrWk.exe
  2⤵
  PID:1660
- C:\Windows\System\JDDulkt.exe
  C:\Windows\System\JDDulkt.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\qWsnhql.exe
  C:\Windows\System\qWsnhql.exe
  2⤵
  PID:1068
- C:\Windows\System\qLPrFDP.exe
  C:\Windows\System\qLPrFDP.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\yftxGCo.exe
  C:\Windows\System\yftxGCo.exe
  2⤵
  PID:2288
- C:\Windows\System\LubPFcy.exe
  C:\Windows\System\LubPFcy.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\zkLlYCp.exe
  C:\Windows\System\zkLlYCp.exe
  2⤵
  PID:2216
- C:\Windows\System\dZupAVW.exe
  C:\Windows\System\dZupAVW.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\iJYIFLK.exe
  C:\Windows\System\iJYIFLK.exe
  2⤵
  PID:2316
- C:\Windows\System\sjtnWsq.exe
  C:\Windows\System\sjtnWsq.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\qzKvzcx.exe
  C:\Windows\System\qzKvzcx.exe
  2⤵
  PID:2480
- C:\Windows\System\JGFeJnp.exe
  C:\Windows\System\JGFeJnp.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\TecjXrd.exe
  C:\Windows\System\TecjXrd.exe
  2⤵
  PID:1940
- C:\Windows\System\iHDsJba.exe
  C:\Windows\System\iHDsJba.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\SSROwFO.exe
  C:\Windows\System\SSROwFO.exe
  2⤵
  PID:3004
- C:\Windows\System\pACGjhM.exe
  C:\Windows\System\pACGjhM.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\pjBKUDC.exe
  C:\Windows\System\pjBKUDC.exe
  2⤵
  PID:1600
- C:\Windows\System\bFIzPEs.exe
  C:\Windows\System\bFIzPEs.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\cmALUEV.exe
  C:\Windows\System\cmALUEV.exe
  2⤵
  PID:2252
- C:\Windows\System\UnDkdtW.exe
  C:\Windows\System\UnDkdtW.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\YWRiCSL.exe
  C:\Windows\System\YWRiCSL.exe
  2⤵
  PID:2748
- C:\Windows\System\qTyZYpP.exe
  C:\Windows\System\qTyZYpP.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\SfKfFxo.exe
  C:\Windows\System\SfKfFxo.exe
  2⤵
  PID:2560
- C:\Windows\System\KqXXmQQ.exe
  C:\Windows\System\KqXXmQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\LspMXqU.exe
  C:\Windows\System\LspMXqU.exe
  2⤵
  PID:2784
- C:\Windows\System\LGUtIMp.exe
  C:\Windows\System\LGUtIMp.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\DawpHzZ.exe
  C:\Windows\System\DawpHzZ.exe
  2⤵
  PID:2148
- C:\Windows\System\svlWkPB.exe
  C:\Windows\System\svlWkPB.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\NUMcljd.exe
  C:\Windows\System\NUMcljd.exe
  2⤵
  PID:1168
- C:\Windows\System\WxdJywh.exe
  C:\Windows\System\WxdJywh.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\bONjzUM.exe
  C:\Windows\System\bONjzUM.exe
  2⤵
  PID:2928
- C:\Windows\System\ACMrPhJ.exe
  C:\Windows\System\ACMrPhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\KmicYmx.exe
  C:\Windows\System\KmicYmx.exe
  2⤵
  PID:3068
- C:\Windows\System\gWeGgJy.exe
  C:\Windows\System\gWeGgJy.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\xIdnlYW.exe
  C:\Windows\System\xIdnlYW.exe
  2⤵
  PID:1948
- C:\Windows\System\IxXyMzb.exe
  C:\Windows\System\IxXyMzb.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\hBfTvfL.exe
  C:\Windows\System\hBfTvfL.exe
  2⤵
  PID:3000
- C:\Windows\System\jCiclPJ.exe
  C:\Windows\System\jCiclPJ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\rYZZEdd.exe
  C:\Windows\System\rYZZEdd.exe
  2⤵
  PID:1624
- C:\Windows\System\lKNhNDD.exe
  C:\Windows\System\lKNhNDD.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\InDFNfN.exe
  C:\Windows\System\InDFNfN.exe
  2⤵
  PID:2424
- C:\Windows\System\oyiktKh.exe
  C:\Windows\System\oyiktKh.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\OZMOZAN.exe
  C:\Windows\System\OZMOZAN.exe
  2⤵
  PID:840
- C:\Windows\System\PAlpjgh.exe
  C:\Windows\System\PAlpjgh.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\aOdTdUZ.exe
  C:\Windows\System\aOdTdUZ.exe
  2⤵
  PID:2716
- C:\Windows\System\lxjihrY.exe
  C:\Windows\System\lxjihrY.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\WHwoICX.exe
  C:\Windows\System\WHwoICX.exe
  2⤵
  PID:2556
- C:\Windows\System\wUOUzBT.exe
  C:\Windows\System\wUOUzBT.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\heJfBVW.exe
  C:\Windows\System\heJfBVW.exe
  2⤵
  PID:2948
- C:\Windows\System\huqWedU.exe
  C:\Windows\System\huqWedU.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\LtXFqPH.exe
  C:\Windows\System\LtXFqPH.exe
  2⤵
  PID:564
- C:\Windows\System\NoEaSBe.exe
  C:\Windows\System\NoEaSBe.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\xJaSKks.exe
  C:\Windows\System\xJaSKks.exe
  2⤵
  PID:3100
- C:\Windows\System\eOPUKAs.exe
  C:\Windows\System\eOPUKAs.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\Flrttzv.exe
  C:\Windows\System\Flrttzv.exe
  2⤵
  PID:3132
- C:\Windows\System\bQavdVP.exe
  C:\Windows\System\bQavdVP.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ROYFkPa.exe
  C:\Windows\System\ROYFkPa.exe
  2⤵
  PID:3164
- C:\Windows\System\BqgvbPC.exe
  C:\Windows\System\BqgvbPC.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\GWIfOVu.exe
  C:\Windows\System\GWIfOVu.exe
  2⤵
  PID:3196
- C:\Windows\System\laQpjpX.exe
  C:\Windows\System\laQpjpX.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\fZnCrom.exe
  C:\Windows\System\fZnCrom.exe
  2⤵
  PID:3228
- C:\Windows\System\TWtLJrK.exe
  C:\Windows\System\TWtLJrK.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\wmmHgYd.exe
  C:\Windows\System\wmmHgYd.exe
  2⤵
  PID:3260
- C:\Windows\System\YXbjuBL.exe
  C:\Windows\System\YXbjuBL.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\InUvCHp.exe
  C:\Windows\System\InUvCHp.exe
  2⤵
  PID:3292
- C:\Windows\System\UBSajNj.exe
  C:\Windows\System\UBSajNj.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\STUlfbc.exe
  C:\Windows\System\STUlfbc.exe
  2⤵
  PID:3324
- C:\Windows\System\KztgTML.exe
  C:\Windows\System\KztgTML.exe
  2⤵
  PID:3340
- C:\Windows\System\IeoSPeY.exe
  C:\Windows\System\IeoSPeY.exe
  2⤵
  PID:3356
- C:\Windows\System\yDQOqRT.exe
  C:\Windows\System\yDQOqRT.exe
  2⤵
  PID:3372
- C:\Windows\System\UMAEIBV.exe
  C:\Windows\System\UMAEIBV.exe
  2⤵
  PID:3388
- C:\Windows\System\UCsJXWJ.exe
  C:\Windows\System\UCsJXWJ.exe
  2⤵
  PID:3404
- C:\Windows\System\nmjTcqn.exe
  C:\Windows\System\nmjTcqn.exe
  2⤵
  PID:3420
- C:\Windows\System\QJjdfFb.exe
  C:\Windows\System\QJjdfFb.exe
  2⤵
  PID:3436
- C:\Windows\System\IGoXzEy.exe
  C:\Windows\System\IGoXzEy.exe
  2⤵
  PID:3452
- C:\Windows\System\DdDpesO.exe
  C:\Windows\System\DdDpesO.exe
  2⤵
  PID:3468
- C:\Windows\System\thzwxvl.exe
  C:\Windows\System\thzwxvl.exe
  2⤵
  PID:3484
- C:\Windows\System\TISbuMP.exe
  C:\Windows\System\TISbuMP.exe
  2⤵
  PID:3500
- C:\Windows\System\fUExOny.exe
  C:\Windows\System\fUExOny.exe
  2⤵
  PID:3516
- C:\Windows\System\beiSpDt.exe
  C:\Windows\System\beiSpDt.exe
  2⤵
  PID:3532
- C:\Windows\System\oLUlSdX.exe
  C:\Windows\System\oLUlSdX.exe
  2⤵
  PID:3548
- C:\Windows\System\iukTvVx.exe
  C:\Windows\System\iukTvVx.exe
  2⤵
  PID:3564
- C:\Windows\System\iWKQWNh.exe
  C:\Windows\System\iWKQWNh.exe
  2⤵
  PID:3580
- C:\Windows\System\qkTqokM.exe
  C:\Windows\System\qkTqokM.exe
  2⤵
  PID:3596
- C:\Windows\System\XDdkutW.exe
  C:\Windows\System\XDdkutW.exe
  2⤵
  PID:3612
- C:\Windows\System\vNNtXXF.exe
  C:\Windows\System\vNNtXXF.exe
  2⤵
  PID:3628
- C:\Windows\System\bePkDwW.exe
  C:\Windows\System\bePkDwW.exe
  2⤵
  PID:3644
- C:\Windows\System\cENszci.exe
  C:\Windows\System\cENszci.exe
  2⤵
  PID:3660
- C:\Windows\System\njjAHYK.exe
  C:\Windows\System\njjAHYK.exe
  2⤵
  PID:3676
- C:\Windows\System\ineSWwk.exe
  C:\Windows\System\ineSWwk.exe
  2⤵
  PID:3692
- C:\Windows\System\dAzePNd.exe
  C:\Windows\System\dAzePNd.exe
  2⤵
  PID:3708
- C:\Windows\System\OqbvLPU.exe
  C:\Windows\System\OqbvLPU.exe
  2⤵
  PID:3724
- C:\Windows\System\ceRXjPp.exe
  C:\Windows\System\ceRXjPp.exe
  2⤵
  PID:3740
- C:\Windows\System\ttWWvFy.exe
  C:\Windows\System\ttWWvFy.exe
  2⤵
  PID:3756
- C:\Windows\System\HEgshWf.exe
  C:\Windows\System\HEgshWf.exe
  2⤵
  PID:3772
- C:\Windows\System\eqxiFiW.exe
  C:\Windows\System\eqxiFiW.exe
  2⤵
  PID:3788
- C:\Windows\System\hhtCUEI.exe
  C:\Windows\System\hhtCUEI.exe
  2⤵
  PID:3804
- C:\Windows\System\VhUDBhU.exe
  C:\Windows\System\VhUDBhU.exe
  2⤵
  PID:3820
- C:\Windows\System\aCmcJzg.exe
  C:\Windows\System\aCmcJzg.exe
  2⤵
  PID:3836
- C:\Windows\System\BKILtbD.exe
  C:\Windows\System\BKILtbD.exe
  2⤵
  PID:3852
- C:\Windows\System\TDdtwbL.exe
  C:\Windows\System\TDdtwbL.exe
  2⤵
  PID:3868
- C:\Windows\System\JZSRepu.exe
  C:\Windows\System\JZSRepu.exe
  2⤵
  PID:3884
- C:\Windows\System\yFIETeg.exe
  C:\Windows\System\yFIETeg.exe
  2⤵
  PID:3900
- C:\Windows\System\ePxlOHd.exe
  C:\Windows\System\ePxlOHd.exe
  2⤵
  PID:3916
- C:\Windows\System\zuNYHSS.exe
  C:\Windows\System\zuNYHSS.exe
  2⤵
  PID:3932
- C:\Windows\System\AgNRbAP.exe
  C:\Windows\System\AgNRbAP.exe
  2⤵
  PID:3948
- C:\Windows\System\fzaKaYf.exe
  C:\Windows\System\fzaKaYf.exe
  2⤵
  PID:3964
- C:\Windows\System\hTQROeo.exe
  C:\Windows\System\hTQROeo.exe
  2⤵
  PID:3980
- C:\Windows\System\xaGelSr.exe
  C:\Windows\System\xaGelSr.exe
  2⤵
  PID:3996
- C:\Windows\System\DDHsYKM.exe
  C:\Windows\System\DDHsYKM.exe
  2⤵
  PID:4012
- C:\Windows\System\jSkOSxt.exe
  C:\Windows\System\jSkOSxt.exe
  2⤵
  PID:4028
- C:\Windows\System\tUmuGzR.exe
  C:\Windows\System\tUmuGzR.exe
  2⤵
  PID:4044
- C:\Windows\System\wyRNMot.exe
  C:\Windows\System\wyRNMot.exe
  2⤵
  PID:4060
- C:\Windows\System\yqIGCxk.exe
  C:\Windows\System\yqIGCxk.exe
  2⤵
  PID:4076
- C:\Windows\System\BOaxpae.exe
  C:\Windows\System\BOaxpae.exe
  2⤵
  PID:4092
- C:\Windows\System\pTWFXTL.exe
  C:\Windows\System\pTWFXTL.exe
  2⤵
  PID:692
- C:\Windows\System\zltqOSo.exe
  C:\Windows\System\zltqOSo.exe
  2⤵
  PID:2060
- C:\Windows\System\OragwCu.exe
  C:\Windows\System\OragwCu.exe
  2⤵
  PID:2908
- C:\Windows\System\QGnLWNE.exe
  C:\Windows\System\QGnLWNE.exe
  2⤵
  PID:2752
- C:\Windows\System\PTpLYuw.exe
  C:\Windows\System\PTpLYuw.exe
  2⤵
  PID:3096
- C:\Windows\System\bvVZnAY.exe
  C:\Windows\System\bvVZnAY.exe
  2⤵
  PID:3156
- C:\Windows\System\EKSmWoG.exe
  C:\Windows\System\EKSmWoG.exe
  2⤵
  PID:2912
- C:\Windows\System\AmeWqnC.exe
  C:\Windows\System\AmeWqnC.exe
  2⤵
  PID:3252
- C:\Windows\System\qUbsjiP.exe
  C:\Windows\System\qUbsjiP.exe
  2⤵
  PID:3316
- C:\Windows\System\gIuwPyp.exe
  C:\Windows\System\gIuwPyp.exe
  2⤵
  PID:3380
- C:\Windows\System\yCjoMRC.exe
  C:\Windows\System\yCjoMRC.exe
  2⤵
  PID:3444
- C:\Windows\System\UMhfjaZ.exe
  C:\Windows\System\UMhfjaZ.exe
  2⤵
  PID:3508
- C:\Windows\System\RpUHXXQ.exe
  C:\Windows\System\RpUHXXQ.exe
  2⤵
  PID:3572
- C:\Windows\System\quzbbhN.exe
  C:\Windows\System\quzbbhN.exe
  2⤵
  PID:3636
- C:\Windows\System\rXrMLzs.exe
  C:\Windows\System\rXrMLzs.exe
  2⤵
  PID:3700
- C:\Windows\System\JOvucoV.exe
  C:\Windows\System\JOvucoV.exe
  2⤵
  PID:3764
- C:\Windows\System\iGQuPvH.exe
  C:\Windows\System\iGQuPvH.exe
  2⤵
  PID:3828
- C:\Windows\System\FeudzRN.exe
  C:\Windows\System\FeudzRN.exe
  2⤵
  PID:3892
- C:\Windows\System\XeUoEGQ.exe
  C:\Windows\System\XeUoEGQ.exe
  2⤵
  PID:3956
- C:\Windows\System\JbOHilz.exe
  C:\Windows\System\JbOHilz.exe
  2⤵
  PID:4020
- C:\Windows\System\yBVUSYZ.exe
  C:\Windows\System\yBVUSYZ.exe
  2⤵
  PID:4084
- C:\Windows\System\IzgyeHI.exe
  C:\Windows\System\IzgyeHI.exe
  2⤵
  PID:2940
- C:\Windows\System\kGPZRgH.exe
  C:\Windows\System\kGPZRgH.exe
  2⤵
  PID:3220
- C:\Windows\System\obdFELg.exe
  C:\Windows\System\obdFELg.exe
  2⤵
  PID:3476
- C:\Windows\System\iwfDave.exe
  C:\Windows\System\iwfDave.exe
  2⤵
  PID:3732
- C:\Windows\System\dBxfDbR.exe
  C:\Windows\System\dBxfDbR.exe
  2⤵
  PID:4108
- C:\Windows\System\CWgMGFW.exe
  C:\Windows\System\CWgMGFW.exe
  2⤵
  PID:4124
- C:\Windows\System\UvZlRjH.exe
  C:\Windows\System\UvZlRjH.exe
  2⤵
  PID:4140
- C:\Windows\System\eFOBUlT.exe
  C:\Windows\System\eFOBUlT.exe
  2⤵
  PID:4156
- C:\Windows\System\LCRtLBH.exe
  C:\Windows\System\LCRtLBH.exe
  2⤵
  PID:4172
- C:\Windows\System\FMwQKQl.exe
  C:\Windows\System\FMwQKQl.exe
  2⤵
  PID:4188
- C:\Windows\System\GkPnHaa.exe
  C:\Windows\System\GkPnHaa.exe
  2⤵
  PID:4204
- C:\Windows\System\XZVVoWk.exe
  C:\Windows\System\XZVVoWk.exe
  2⤵
  PID:4220
- C:\Windows\System\MeEilnb.exe
  C:\Windows\System\MeEilnb.exe
  2⤵
  PID:4236
- C:\Windows\System\rkIzONs.exe
  C:\Windows\System\rkIzONs.exe
  2⤵
  PID:4252
- C:\Windows\System\EpqDbdU.exe
  C:\Windows\System\EpqDbdU.exe
  2⤵
  PID:4268
- C:\Windows\System\ZoSQAHx.exe
  C:\Windows\System\ZoSQAHx.exe
  2⤵
  PID:4284
- C:\Windows\System\muWkRHw.exe
  C:\Windows\System\muWkRHw.exe
  2⤵
  PID:4300
- C:\Windows\System\VzloqSO.exe
  C:\Windows\System\VzloqSO.exe
  2⤵
  PID:4316
- C:\Windows\System\OvNOGju.exe
  C:\Windows\System\OvNOGju.exe
  2⤵
  PID:4332
- C:\Windows\System\jfeMRKp.exe
  C:\Windows\System\jfeMRKp.exe
  2⤵
  PID:4348
- C:\Windows\System\OGZlBiC.exe
  C:\Windows\System\OGZlBiC.exe
  2⤵
  PID:4364
- C:\Windows\System\BjZKfZJ.exe
  C:\Windows\System\BjZKfZJ.exe
  2⤵
  PID:4380
- C:\Windows\System\HFYTOBN.exe
  C:\Windows\System\HFYTOBN.exe
  2⤵
  PID:4396
- C:\Windows\System\GLGKWTb.exe
  C:\Windows\System\GLGKWTb.exe
  2⤵
  PID:4412
- C:\Windows\System\DDZnmzd.exe
  C:\Windows\System\DDZnmzd.exe
  2⤵
  PID:4428
- C:\Windows\System\WFnZomV.exe
  C:\Windows\System\WFnZomV.exe
  2⤵
  PID:4444
- C:\Windows\System\ySfckCT.exe
  C:\Windows\System\ySfckCT.exe
  2⤵
  PID:4460
- C:\Windows\System\PftNwxz.exe
  C:\Windows\System\PftNwxz.exe
  2⤵
  PID:4476
- C:\Windows\System\yuPOxyZ.exe
  C:\Windows\System\yuPOxyZ.exe
  2⤵
  PID:4492
- C:\Windows\System\FfqQctd.exe
  C:\Windows\System\FfqQctd.exe
  2⤵
  PID:4508
- C:\Windows\System\ZWhvgpi.exe
  C:\Windows\System\ZWhvgpi.exe
  2⤵
  PID:4524
- C:\Windows\System\QLQPnKs.exe
  C:\Windows\System\QLQPnKs.exe
  2⤵
  PID:4540
- C:\Windows\System\rtoYUFe.exe
  C:\Windows\System\rtoYUFe.exe
  2⤵
  PID:4556
- C:\Windows\System\UFxnWoN.exe
  C:\Windows\System\UFxnWoN.exe
  2⤵
  PID:4572
- C:\Windows\System\jWiGaja.exe
  C:\Windows\System\jWiGaja.exe
  2⤵
  PID:4588
- C:\Windows\System\ASZDLap.exe
  C:\Windows\System\ASZDLap.exe
  2⤵
  PID:4604
- C:\Windows\System\qrlBFTH.exe
  C:\Windows\System\qrlBFTH.exe
  2⤵
  PID:4620
- C:\Windows\System\fiHwGYx.exe
  C:\Windows\System\fiHwGYx.exe
  2⤵
  PID:4636
- C:\Windows\System\EshkGZr.exe
  C:\Windows\System\EshkGZr.exe
  2⤵
  PID:4652
- C:\Windows\System\wqmepRw.exe
  C:\Windows\System\wqmepRw.exe
  2⤵
  PID:4668
- C:\Windows\System\IxaTCda.exe
  C:\Windows\System\IxaTCda.exe
  2⤵
  PID:4684
- C:\Windows\System\TZITDCo.exe
  C:\Windows\System\TZITDCo.exe
  2⤵
  PID:4700
- C:\Windows\System\GRUTlFZ.exe
  C:\Windows\System\GRUTlFZ.exe
  2⤵
  PID:4716
- C:\Windows\System\FGSMjMD.exe
  C:\Windows\System\FGSMjMD.exe
  2⤵
  PID:4732
- C:\Windows\System\XqUwhcR.exe
  C:\Windows\System\XqUwhcR.exe
  2⤵
  PID:4748
- C:\Windows\System\ZtwzPMW.exe
  C:\Windows\System\ZtwzPMW.exe
  2⤵
  PID:4764
- C:\Windows\System\PjklyAR.exe
  C:\Windows\System\PjklyAR.exe
  2⤵
  PID:4780
- C:\Windows\System\BkcKrnd.exe
  C:\Windows\System\BkcKrnd.exe
  2⤵
  PID:4796
- C:\Windows\System\hQyWsuh.exe
  C:\Windows\System\hQyWsuh.exe
  2⤵
  PID:4812
- C:\Windows\System\wLyiLDm.exe
  C:\Windows\System\wLyiLDm.exe
  2⤵
  PID:4828
- C:\Windows\System\YMzbZJw.exe
  C:\Windows\System\YMzbZJw.exe
  2⤵
  PID:4844
- C:\Windows\System\wGGPNSa.exe
  C:\Windows\System\wGGPNSa.exe
  2⤵
  PID:4860
- C:\Windows\System\rQXNjfk.exe
  C:\Windows\System\rQXNjfk.exe
  2⤵
  PID:4876
- C:\Windows\System\AxInSos.exe
  C:\Windows\System\AxInSos.exe
  2⤵
  PID:4892
- C:\Windows\System\QFNXxKV.exe
  C:\Windows\System\QFNXxKV.exe
  2⤵
  PID:4908
- C:\Windows\System\FdxVNLr.exe
  C:\Windows\System\FdxVNLr.exe
  2⤵
  PID:4924
- C:\Windows\System\oUrfypE.exe
  C:\Windows\System\oUrfypE.exe
  2⤵
  PID:4940
- C:\Windows\System\GYAWtXx.exe
  C:\Windows\System\GYAWtXx.exe
  2⤵
  PID:4956
- C:\Windows\System\huRBupX.exe
  C:\Windows\System\huRBupX.exe
  2⤵
  PID:4972
- C:\Windows\System\apAQtsy.exe
  C:\Windows\System\apAQtsy.exe
  2⤵
  PID:4988
- C:\Windows\System\rwrDYxr.exe
  C:\Windows\System\rwrDYxr.exe
  2⤵
  PID:5004
- C:\Windows\System\PabxmGP.exe
  C:\Windows\System\PabxmGP.exe
  2⤵
  PID:5020
- C:\Windows\System\mmlDJnB.exe
  C:\Windows\System\mmlDJnB.exe
  2⤵
  PID:5036
- C:\Windows\System\VRdmxBD.exe
  C:\Windows\System\VRdmxBD.exe
  2⤵
  PID:5052
- C:\Windows\System\mIeSdFY.exe
  C:\Windows\System\mIeSdFY.exe
  2⤵
  PID:5068
- C:\Windows\System\JEwQeom.exe
  C:\Windows\System\JEwQeom.exe
  2⤵
  PID:5084
- C:\Windows\System\LBVGVOn.exe
  C:\Windows\System\LBVGVOn.exe
  2⤵
  PID:5100
- C:\Windows\System\QeAvgPd.exe
  C:\Windows\System\QeAvgPd.exe
  2⤵
  PID:5116
- C:\Windows\System\EEqRxiv.exe
  C:\Windows\System\EEqRxiv.exe
  2⤵
  PID:3992
- C:\Windows\System\nmgcTRC.exe
  C:\Windows\System\nmgcTRC.exe
  2⤵
  PID:3352
- C:\Windows\System\ZJWauoO.exe
  C:\Windows\System\ZJWauoO.exe
  2⤵
  PID:4136
- C:\Windows\System\EJJzbba.exe
  C:\Windows\System\EJJzbba.exe
  2⤵
  PID:4200
- C:\Windows\System\juOVSfK.exe
  C:\Windows\System\juOVSfK.exe
  2⤵
  PID:4264
- C:\Windows\System\RluRCQJ.exe
  C:\Windows\System\RluRCQJ.exe
  2⤵
  PID:4804
- C:\Windows\System\LoLlpus.exe
  C:\Windows\System\LoLlpus.exe
  2⤵
  PID:5136
- C:\Windows\System\dGHQfBY.exe
  C:\Windows\System\dGHQfBY.exe
  2⤵
  PID:5184
- C:\Windows\System\vuZmlVQ.exe
  C:\Windows\System\vuZmlVQ.exe
  2⤵
  PID:5312
- C:\Windows\System\hFyPRfo.exe
  C:\Windows\System\hFyPRfo.exe
  2⤵
  PID:5608
- C:\Windows\System\FQxaGfU.exe
  C:\Windows\System\FQxaGfU.exe
  2⤵
  PID:5624
- C:\Windows\System\UaafhuY.exe
  C:\Windows\System\UaafhuY.exe
  2⤵
  PID:5640
- C:\Windows\System\aVexBkc.exe
  C:\Windows\System\aVexBkc.exe
  2⤵
  PID:5660
- C:\Windows\System\RMJSkWX.exe
  C:\Windows\System\RMJSkWX.exe
  2⤵
  PID:5676
- C:\Windows\System\ZICxqBt.exe
  C:\Windows\System\ZICxqBt.exe
  2⤵
  PID:5692
- C:\Windows\System\FxDJEyy.exe
  C:\Windows\System\FxDJEyy.exe
  2⤵
  PID:5712
- C:\Windows\System\uzsRXBE.exe
  C:\Windows\System\uzsRXBE.exe
  2⤵
  PID:5732
- C:\Windows\System\zaYVEVe.exe
  C:\Windows\System\zaYVEVe.exe
  2⤵
  PID:5748
- C:\Windows\System\PSlxpmO.exe
  C:\Windows\System\PSlxpmO.exe
  2⤵
  PID:5764
- C:\Windows\System\ZGpCsYO.exe
  C:\Windows\System\ZGpCsYO.exe
  2⤵
  PID:5784
- C:\Windows\System\xtiKiYq.exe
  C:\Windows\System\xtiKiYq.exe
  2⤵
  PID:5800
- C:\Windows\System\MfDPFNF.exe
  C:\Windows\System\MfDPFNF.exe
  2⤵
  PID:5820
- C:\Windows\System\HzWCYoX.exe
  C:\Windows\System\HzWCYoX.exe
  2⤵
  PID:5836
- C:\Windows\System\ZEAfZcR.exe
  C:\Windows\System\ZEAfZcR.exe
  2⤵
  PID:5856
- C:\Windows\System\kvnZytg.exe
  C:\Windows\System\kvnZytg.exe
  2⤵
  PID:5872
- C:\Windows\System\MaRnaGM.exe
  C:\Windows\System\MaRnaGM.exe
  2⤵
  PID:5892
- C:\Windows\System\UDnXXaf.exe
  C:\Windows\System\UDnXXaf.exe
  2⤵
  PID:5912
- C:\Windows\System\ZzlsNBE.exe
  C:\Windows\System\ZzlsNBE.exe
  2⤵
  PID:5928
- C:\Windows\System\GnxIKnN.exe
  C:\Windows\System\GnxIKnN.exe
  2⤵
  PID:5948
- C:\Windows\System\pCLNQBK.exe
  C:\Windows\System\pCLNQBK.exe
  2⤵
  PID:5964
- C:\Windows\System\wvuQrxB.exe
  C:\Windows\System\wvuQrxB.exe
  2⤵
  PID:5988
- C:\Windows\System\XAWwSTd.exe
  C:\Windows\System\XAWwSTd.exe
  2⤵
  PID:6004
- C:\Windows\System\GmMOtAD.exe
  C:\Windows\System\GmMOtAD.exe
  2⤵
  PID:6024
- C:\Windows\System\paZzpWf.exe
  C:\Windows\System\paZzpWf.exe
  2⤵
  PID:6052
- C:\Windows\System\aiEDBwQ.exe
  C:\Windows\System\aiEDBwQ.exe
  2⤵
  PID:6084
- C:\Windows\System\Nispwzg.exe
  C:\Windows\System\Nispwzg.exe
  2⤵
  PID:6112
- C:\Windows\System\LANByLW.exe
  C:\Windows\System\LANByLW.exe
  2⤵
  PID:6128
- C:\Windows\System\hjwNXBr.exe
  C:\Windows\System\hjwNXBr.exe
  2⤵
  PID:560
- C:\Windows\System\BmCFQbK.exe
  C:\Windows\System\BmCFQbK.exe
  2⤵
  PID:1876
- C:\Windows\System\BprvMFi.exe
  C:\Windows\System\BprvMFi.exe
  2⤵
  PID:2256
- C:\Windows\System\VqhClyz.exe
  C:\Windows\System\VqhClyz.exe
  2⤵
  PID:2508
- C:\Windows\System\yAWtSFH.exe
  C:\Windows\System\yAWtSFH.exe
  2⤵
  PID:352
- C:\Windows\System\moKVHKB.exe
  C:\Windows\System\moKVHKB.exe
  2⤵
  PID:2384
- C:\Windows\System\heBAOkH.exe
  C:\Windows\System\heBAOkH.exe
  2⤵
  PID:5200
- C:\Windows\System\mMJnjuN.exe
  C:\Windows\System\mMJnjuN.exe
  2⤵
  PID:5220
- C:\Windows\System\nGCKuEw.exe
  C:\Windows\System\nGCKuEw.exe
  2⤵
  PID:5236
- C:\Windows\System\eEknxWf.exe
  C:\Windows\System\eEknxWf.exe
  2⤵
  PID:5256
- C:\Windows\System\erbXGWg.exe
  C:\Windows\System\erbXGWg.exe
  2⤵
  PID:5276
- C:\Windows\System\UzMBQYx.exe
  C:\Windows\System\UzMBQYx.exe
  2⤵
  PID:5296
- C:\Windows\System\DdMFlOv.exe
  C:\Windows\System\DdMFlOv.exe
  2⤵
  PID:5620
- C:\Windows\System\IdfBpsT.exe
  C:\Windows\System\IdfBpsT.exe
  2⤵
  PID:5684
- C:\Windows\System\aTkijUK.exe
  C:\Windows\System\aTkijUK.exe
  2⤵
  PID:5728
- C:\Windows\System\buZEAPK.exe
  C:\Windows\System\buZEAPK.exe
  2⤵
  PID:5796
- C:\Windows\System\GMvVVBp.exe
  C:\Windows\System\GMvVVBp.exe
  2⤵
  PID:5864
- C:\Windows\System\XgqHHNC.exe
  C:\Windows\System\XgqHHNC.exe
  2⤵
  PID:5908
- C:\Windows\System\ebJXlmk.exe
  C:\Windows\System\ebJXlmk.exe
  2⤵
  PID:5976
- C:\Windows\System\UwfkxvD.exe
  C:\Windows\System\UwfkxvD.exe
  2⤵
  PID:6020
- C:\Windows\System\wkehYbT.exe
  C:\Windows\System\wkehYbT.exe
  2⤵
  PID:6120
- C:\Windows\System\LEKoXHl.exe
  C:\Windows\System\LEKoXHl.exe
  2⤵
  PID:4232
- C:\Windows\System\zCESlpa.exe
  C:\Windows\System\zCESlpa.exe
  2⤵
  PID:4260
- C:\Windows\System\UYBzniT.exe
  C:\Windows\System\UYBzniT.exe
  2⤵
  PID:5244
- C:\Windows\System\VUWVhGI.exe
  C:\Windows\System\VUWVhGI.exe
  2⤵
  PID:5292
- C:\Windows\System\bNZVqkU.exe
  C:\Windows\System\bNZVqkU.exe
  2⤵
  PID:5792
- C:\Windows\System\rAerMpL.exe
  C:\Windows\System\rAerMpL.exe
  2⤵
  PID:5980
- C:\Windows\System\BzDdExy.exe
  C:\Windows\System\BzDdExy.exe
  2⤵
  PID:5216
- C:\Windows\System\SHkaEFq.exe
  C:\Windows\System\SHkaEFq.exe
  2⤵
  PID:5972
- C:\Windows\System\OuBjODM.exe
  C:\Windows\System\OuBjODM.exe
  2⤵
  PID:6148
- C:\Windows\System\wDHIyQj.exe
  C:\Windows\System\wDHIyQj.exe
  2⤵
  PID:6164
- C:\Windows\System\elBKKes.exe
  C:\Windows\System\elBKKes.exe
  2⤵
  PID:6180
- C:\Windows\System\IpBTZiP.exe
  C:\Windows\System\IpBTZiP.exe
  2⤵
  PID:6196
- C:\Windows\System\zqGuDOX.exe
  C:\Windows\System\zqGuDOX.exe
  2⤵
  PID:6212
- C:\Windows\System\fGOAPdq.exe
  C:\Windows\System\fGOAPdq.exe
  2⤵
  PID:6228
- C:\Windows\System\kJOIhzD.exe
  C:\Windows\System\kJOIhzD.exe
  2⤵
  PID:6244
- C:\Windows\System\dnniosK.exe
  C:\Windows\System\dnniosK.exe
  2⤵
  PID:6260
- C:\Windows\System\eGyKujM.exe
  C:\Windows\System\eGyKujM.exe
  2⤵
  PID:6276
- C:\Windows\System\RlBkWVh.exe
  C:\Windows\System\RlBkWVh.exe
  2⤵
  PID:6292
- C:\Windows\System\ujfPfzk.exe
  C:\Windows\System\ujfPfzk.exe
  2⤵
  PID:6308
- C:\Windows\System\sjyURMX.exe
  C:\Windows\System\sjyURMX.exe
  2⤵
  PID:6324
- C:\Windows\System\KmWSrSU.exe
  C:\Windows\System\KmWSrSU.exe
  2⤵
  PID:6340
- C:\Windows\System\PqEIqHN.exe
  C:\Windows\System\PqEIqHN.exe
  2⤵
  PID:6356
- C:\Windows\System\YOqYpcn.exe
  C:\Windows\System\YOqYpcn.exe
  2⤵
  PID:6372
- C:\Windows\System\YHliRVz.exe
  C:\Windows\System\YHliRVz.exe
  2⤵
  PID:6388
- C:\Windows\System\XWPJuYC.exe
  C:\Windows\System\XWPJuYC.exe
  2⤵
  PID:6404
- C:\Windows\System\xjMwWEi.exe
  C:\Windows\System\xjMwWEi.exe
  2⤵
  PID:6420
- C:\Windows\System\gvgtcLq.exe
  C:\Windows\System\gvgtcLq.exe
  2⤵
  PID:6436
- C:\Windows\System\FSoKhBk.exe
  C:\Windows\System\FSoKhBk.exe
  2⤵
  PID:6452
- C:\Windows\System\PipMEGN.exe
  C:\Windows\System\PipMEGN.exe
  2⤵
  PID:6468
- C:\Windows\System\HoEOstq.exe
  C:\Windows\System\HoEOstq.exe
  2⤵
  PID:6484
- C:\Windows\System\jGrwnLE.exe
  C:\Windows\System\jGrwnLE.exe
  2⤵
  PID:6500
- C:\Windows\System\ADfbVGx.exe
  C:\Windows\System\ADfbVGx.exe
  2⤵
  PID:6516
- C:\Windows\System\zHSgMND.exe
  C:\Windows\System\zHSgMND.exe
  2⤵
  PID:6532
- C:\Windows\System\fmSQmLR.exe
  C:\Windows\System\fmSQmLR.exe
  2⤵
  PID:6548
- C:\Windows\System\OxiNbGA.exe
  C:\Windows\System\OxiNbGA.exe
  2⤵
  PID:6564
- C:\Windows\System\OnNoEIx.exe
  C:\Windows\System\OnNoEIx.exe
  2⤵
  PID:6580
- C:\Windows\System\UWxBtDu.exe
  C:\Windows\System\UWxBtDu.exe
  2⤵
  PID:6596
- C:\Windows\System\xSVHfeF.exe
  C:\Windows\System\xSVHfeF.exe
  2⤵
  PID:6616
- C:\Windows\System\svmyhNI.exe
  C:\Windows\System\svmyhNI.exe
  2⤵
  PID:6632
- C:\Windows\System\NZzNcgX.exe
  C:\Windows\System\NZzNcgX.exe
  2⤵
  PID:6652
- C:\Windows\System\rzjrRQr.exe
  C:\Windows\System\rzjrRQr.exe
  2⤵
  PID:6668
- C:\Windows\System\sDSTHwJ.exe
  C:\Windows\System\sDSTHwJ.exe
  2⤵
  PID:6712
- C:\Windows\System\XLckcvS.exe
  C:\Windows\System\XLckcvS.exe
  2⤵
  PID:6732
- C:\Windows\System\imFvtKx.exe
  C:\Windows\System\imFvtKx.exe
  2⤵
  PID:6748
- C:\Windows\System\KgyZwlw.exe
  C:\Windows\System\KgyZwlw.exe
  2⤵
  PID:6764
- C:\Windows\System\JTtgopE.exe
  C:\Windows\System\JTtgopE.exe
  2⤵
  PID:6780
- C:\Windows\System\VDiFRTn.exe
  C:\Windows\System\VDiFRTn.exe
  2⤵
  PID:6796
- C:\Windows\System\VGvCCyx.exe
  C:\Windows\System\VGvCCyx.exe
  2⤵
  PID:6812
- C:\Windows\System\pYBlnoQ.exe
  C:\Windows\System\pYBlnoQ.exe
  2⤵
  PID:6828
- C:\Windows\System\TGqZesL.exe
  C:\Windows\System\TGqZesL.exe
  2⤵
  PID:6844
- C:\Windows\System\YQRVhft.exe
  C:\Windows\System\YQRVhft.exe
  2⤵
  PID:6868
- C:\Windows\System\DWsXQeW.exe
  C:\Windows\System\DWsXQeW.exe
  2⤵
  PID:6884
- C:\Windows\System\mZkSSwD.exe
  C:\Windows\System\mZkSSwD.exe
  2⤵
  PID:6908
- C:\Windows\System\oMFXtNC.exe
  C:\Windows\System\oMFXtNC.exe
  2⤵
  PID:6936
- C:\Windows\System\HzDLAxT.exe
  C:\Windows\System\HzDLAxT.exe
  2⤵
  PID:6968
- C:\Windows\System\xXYFofu.exe
  C:\Windows\System\xXYFofu.exe
  2⤵
  PID:6992
- C:\Windows\System\dORmTHZ.exe
  C:\Windows\System\dORmTHZ.exe
  2⤵
  PID:7008
- C:\Windows\System\imaVGMa.exe
  C:\Windows\System\imaVGMa.exe
  2⤵
  PID:7024
- C:\Windows\System\lAExnrk.exe
  C:\Windows\System\lAExnrk.exe
  2⤵
  PID:7048
- C:\Windows\System\RgjkIwH.exe
  C:\Windows\System\RgjkIwH.exe
  2⤵
  PID:7068
- C:\Windows\System\AQrEdJC.exe
  C:\Windows\System\AQrEdJC.exe
  2⤵
  PID:7092
- C:\Windows\System\uFbebyx.exe
  C:\Windows\System\uFbebyx.exe
  2⤵
  PID:7136
- C:\Windows\System\mNfoelM.exe
  C:\Windows\System\mNfoelM.exe
  2⤵
  PID:6332
- C:\Windows\System\YMDrfKx.exe
  C:\Windows\System\YMDrfKx.exe
  2⤵
  PID:6556
- C:\Windows\System\saTBTUN.exe
  C:\Windows\System\saTBTUN.exe
  2⤵
  PID:2488
- C:\Windows\System\aebtUGR.exe
  C:\Windows\System\aebtUGR.exe
  2⤵
  PID:6720
- C:\Windows\System\OsBEXbV.exe
  C:\Windows\System\OsBEXbV.exe
  2⤵
  PID:7208
- C:\Windows\System\CRFeuCV.exe
  C:\Windows\System\CRFeuCV.exe
  2⤵
  PID:7240
- C:\Windows\System\qPPzjet.exe
  C:\Windows\System\qPPzjet.exe
  2⤵
  PID:7264
- C:\Windows\System\OCaUnVk.exe
  C:\Windows\System\OCaUnVk.exe
  2⤵
  PID:7292
- C:\Windows\System\vpSouDe.exe
  C:\Windows\System\vpSouDe.exe
  2⤵
  PID:7316
- C:\Windows\System\bicERQl.exe
  C:\Windows\System\bicERQl.exe
  2⤵
  PID:7352
- C:\Windows\System\oItFLEW.exe
  C:\Windows\System\oItFLEW.exe
  2⤵
  PID:7380
- C:\Windows\System\LzAzZhR.exe
  C:\Windows\System\LzAzZhR.exe
  2⤵
  PID:7428
- C:\Windows\System\WLhspGp.exe
  C:\Windows\System\WLhspGp.exe
  2⤵
  PID:7452
- C:\Windows\System\rFFZSWd.exe
  C:\Windows\System\rFFZSWd.exe
  2⤵
  PID:7468
- C:\Windows\System\OFUBJiI.exe
  C:\Windows\System\OFUBJiI.exe
  2⤵
  PID:7508
- C:\Windows\System\ayjNmkE.exe
  C:\Windows\System\ayjNmkE.exe
  2⤵
  PID:7540
- C:\Windows\System\fszlFsb.exe
  C:\Windows\System\fszlFsb.exe
  2⤵
  PID:7564
- C:\Windows\System\HnIwDMo.exe
  C:\Windows\System\HnIwDMo.exe
  2⤵
  PID:7584
- C:\Windows\System\HwLCBRi.exe
  C:\Windows\System\HwLCBRi.exe
  2⤵
  PID:7608
- C:\Windows\System\NaUzEDf.exe
  C:\Windows\System\NaUzEDf.exe
  2⤵
  PID:7624
- C:\Windows\System\yQqJAjP.exe
  C:\Windows\System\yQqJAjP.exe
  2⤵
  PID:7648
- C:\Windows\System\gvVQzbG.exe
  C:\Windows\System\gvVQzbG.exe
  2⤵
  PID:7664
- C:\Windows\System\lSdKHLl.exe
  C:\Windows\System\lSdKHLl.exe
  2⤵
  PID:7680
- C:\Windows\System\ZOzqeiw.exe
  C:\Windows\System\ZOzqeiw.exe
  2⤵
  PID:7696
- C:\Windows\System\Vbrqkrf.exe
  C:\Windows\System\Vbrqkrf.exe
  2⤵
  PID:7716
- C:\Windows\System\mdeOGgx.exe
  C:\Windows\System\mdeOGgx.exe
  2⤵
  PID:7736
- C:\Windows\System\EHqtBcZ.exe
  C:\Windows\System\EHqtBcZ.exe
  2⤵
  PID:7756
- C:\Windows\System\MBaBdcX.exe
  C:\Windows\System\MBaBdcX.exe
  2⤵
  PID:7776
- C:\Windows\System\flHVRfp.exe
  C:\Windows\System\flHVRfp.exe
  2⤵
  PID:7792
- C:\Windows\System\aIuGSTe.exe
  C:\Windows\System\aIuGSTe.exe
  2⤵
  PID:7812
- C:\Windows\System\wCrAsYM.exe
  C:\Windows\System\wCrAsYM.exe
  2⤵
  PID:7828
- C:\Windows\System\JcBexsb.exe
  C:\Windows\System\JcBexsb.exe
  2⤵
  PID:7844
- C:\Windows\System\VWeQcxx.exe
  C:\Windows\System\VWeQcxx.exe
  2⤵
  PID:7864
- C:\Windows\System\rOkfnVb.exe
  C:\Windows\System\rOkfnVb.exe
  2⤵
  PID:7908
- C:\Windows\System\GDqaHVj.exe
  C:\Windows\System\GDqaHVj.exe
  2⤵
  PID:7948
- C:\Windows\System\UGOufZX.exe
  C:\Windows\System\UGOufZX.exe
  2⤵
  PID:7976
- C:\Windows\System\aDBTSud.exe
  C:\Windows\System\aDBTSud.exe
  2⤵
  PID:7996
- C:\Windows\System\ebJQmUk.exe
  C:\Windows\System\ebJQmUk.exe
  2⤵
  PID:8012
- C:\Windows\System\tzjIONk.exe
  C:\Windows\System\tzjIONk.exe
  2⤵
  PID:8032
- C:\Windows\System\IMZejDE.exe
  C:\Windows\System\IMZejDE.exe
  2⤵
  PID:8052
- C:\Windows\System\fprESJL.exe
  C:\Windows\System\fprESJL.exe
  2⤵
  PID:8068
- C:\Windows\System\TJLaXRL.exe
  C:\Windows\System\TJLaXRL.exe
  2⤵
  PID:8084
- C:\Windows\System\ogHDQZq.exe
  C:\Windows\System\ogHDQZq.exe
  2⤵
  PID:8100
- C:\Windows\System\NhiLSAf.exe
  C:\Windows\System\NhiLSAf.exe
  2⤵
  PID:8116
- C:\Windows\System\rBlgMYF.exe
  C:\Windows\System\rBlgMYF.exe
  2⤵
  PID:8136
- C:\Windows\System\AEEyddq.exe
  C:\Windows\System\AEEyddq.exe
  2⤵
  PID:8156
- C:\Windows\System\JoiHcmr.exe
  C:\Windows\System\JoiHcmr.exe
  2⤵
  PID:8172
- C:\Windows\System\FVsUSeu.exe
  C:\Windows\System\FVsUSeu.exe
  2⤵
  PID:3064
- C:\Windows\System\PthIRQz.exe
  C:\Windows\System\PthIRQz.exe
  2⤵
  PID:6788
- C:\Windows\System\SgiFRuQ.exe
  C:\Windows\System\SgiFRuQ.exe
  2⤵
  PID:6852
- C:\Windows\System\kDdVIJe.exe
  C:\Windows\System\kDdVIJe.exe
  2⤵
  PID:6944
- C:\Windows\System\HUCsJkj.exe
  C:\Windows\System\HUCsJkj.exe
  2⤵
  PID:7032
- C:\Windows\System\SsCUkqv.exe
  C:\Windows\System\SsCUkqv.exe
  2⤵
  PID:7148
- C:\Windows\System\rFnxTaD.exe
  C:\Windows\System\rFnxTaD.exe
  2⤵
  PID:6172
- C:\Windows\System\kMGDaYF.exe
  C:\Windows\System\kMGDaYF.exe
  2⤵
  PID:6208
- C:\Windows\System\eVgVtJG.exe
  C:\Windows\System\eVgVtJG.exe
  2⤵
  PID:6300
- C:\Windows\System\AAicUJl.exe
  C:\Windows\System\AAicUJl.exe
  2⤵
  PID:7176
- C:\Windows\System\tuKMHYn.exe
  C:\Windows\System\tuKMHYn.exe
  2⤵
  PID:7248
- C:\Windows\System\xaJlnsi.exe
  C:\Windows\System\xaJlnsi.exe
  2⤵
  PID:7364
- C:\Windows\System\QLgfYME.exe
  C:\Windows\System\QLgfYME.exe
  2⤵
  PID:7476
- C:\Windows\System\oZwHpow.exe
  C:\Windows\System\oZwHpow.exe
  2⤵
  PID:7596
- C:\Windows\System\VYnIoFZ.exe
  C:\Windows\System\VYnIoFZ.exe
  2⤵
  PID:7636
- C:\Windows\System\rxSnTAD.exe
  C:\Windows\System\rxSnTAD.exe
  2⤵
  PID:7704
- C:\Windows\System\qrrCfzd.exe
  C:\Windows\System\qrrCfzd.exe
  2⤵
  PID:7748
- C:\Windows\System\bUNybXp.exe
  C:\Windows\System\bUNybXp.exe
  2⤵
  PID:7824
- C:\Windows\System\VhobBSr.exe
  C:\Windows\System\VhobBSr.exe
  2⤵
  PID:7916
- C:\Windows\System\RAyTqPA.exe
  C:\Windows\System\RAyTqPA.exe
  2⤵
  PID:7992
- C:\Windows\System\EfRLYVm.exe
  C:\Windows\System\EfRLYVm.exe
  2⤵
  PID:8064
- C:\Windows\System\ELqaZLm.exe
  C:\Windows\System\ELqaZLm.exe
  2⤵
  PID:8132
- C:\Windows\System\jFNsNfG.exe
  C:\Windows\System\jFNsNfG.exe
  2⤵
  PID:6760
- C:\Windows\System\qKlUsIU.exe
  C:\Windows\System\qKlUsIU.exe
  2⤵
  PID:7076
- C:\Windows\System\xLmNPTc.exe
  C:\Windows\System\xLmNPTc.exe
  2⤵
  PID:6204
- C:\Windows\System\YcxOwiT.exe
  C:\Windows\System\YcxOwiT.exe
  2⤵
  PID:7300
- C:\Windows\System\eTKzaHs.exe
  C:\Windows\System\eTKzaHs.exe
  2⤵
  PID:7548
- C:\Windows\System\ZceoHeS.exe
  C:\Windows\System\ZceoHeS.exe
  2⤵
  PID:7676
- C:\Windows\System\bhkRlyz.exe
  C:\Windows\System\bhkRlyz.exe
  2⤵
  PID:7944
- C:\Windows\System\WhiCaFJ.exe
  C:\Windows\System\WhiCaFJ.exe
  2⤵
  PID:8124
- C:\Windows\System\zpSQdjt.exe
  C:\Windows\System\zpSQdjt.exe
  2⤵
  PID:6588
- C:\Windows\System\mWdPThN.exe
  C:\Windows\System\mWdPThN.exe
  2⤵
  PID:7984
- C:\Windows\System\MytGTTN.exe
  C:\Windows\System\MytGTTN.exe
  2⤵
  PID:8200
- C:\Windows\System\ZqqZqlU.exe
  C:\Windows\System\ZqqZqlU.exe
  2⤵
  PID:8216
- C:\Windows\System\TxXwzJg.exe
  C:\Windows\System\TxXwzJg.exe
  2⤵
  PID:8232
- C:\Windows\System\gyajGwA.exe
  C:\Windows\System\gyajGwA.exe
  2⤵
  PID:8248
- C:\Windows\System\KUdexde.exe
  C:\Windows\System\KUdexde.exe
  2⤵
  PID:8264
- C:\Windows\System\SiFkKRV.exe
  C:\Windows\System\SiFkKRV.exe
  2⤵
  PID:8280
- C:\Windows\System\AywMcoY.exe
  C:\Windows\System\AywMcoY.exe
  2⤵
  PID:8296
- C:\Windows\System\eYTsDYH.exe
  C:\Windows\System\eYTsDYH.exe
  2⤵
  PID:8312
- C:\Windows\System\XPeKMrS.exe
  C:\Windows\System\XPeKMrS.exe
  2⤵
  PID:8328
- C:\Windows\System\baMKedd.exe
  C:\Windows\System\baMKedd.exe
  2⤵
  PID:8344
- C:\Windows\System\zVukLPF.exe
  C:\Windows\System\zVukLPF.exe
  2⤵
  PID:8360
- C:\Windows\System\kGCKmqb.exe
  C:\Windows\System\kGCKmqb.exe
  2⤵
  PID:8376
- C:\Windows\System\BVjQPnt.exe
  C:\Windows\System\BVjQPnt.exe
  2⤵
  PID:8392
- C:\Windows\System\ZiMtHRf.exe
  C:\Windows\System\ZiMtHRf.exe
  2⤵
  PID:8408
- C:\Windows\System\keiOaPw.exe
  C:\Windows\System\keiOaPw.exe
  2⤵
  PID:8424
- C:\Windows\System\IpoGoJf.exe
  C:\Windows\System\IpoGoJf.exe
  2⤵
  PID:8440
- C:\Windows\System\QHLOhoT.exe
  C:\Windows\System\QHLOhoT.exe
  2⤵
  PID:8456
- C:\Windows\System\RsAgVfQ.exe
  C:\Windows\System\RsAgVfQ.exe
  2⤵
  PID:8472
- C:\Windows\System\cSEVdQd.exe
  C:\Windows\System\cSEVdQd.exe
  2⤵
  PID:8488
- C:\Windows\System\xurwcOB.exe
  C:\Windows\System\xurwcOB.exe
  2⤵
  PID:8504
- C:\Windows\System\vQafFTL.exe
  C:\Windows\System\vQafFTL.exe
  2⤵
  PID:8520
- C:\Windows\System\GAVJLha.exe
  C:\Windows\System\GAVJLha.exe
  2⤵
  PID:8536
- C:\Windows\System\fTyYGqK.exe
  C:\Windows\System\fTyYGqK.exe
  2⤵
  PID:8552
- C:\Windows\System\dBcmnvH.exe
  C:\Windows\System\dBcmnvH.exe
  2⤵
  PID:8568
- C:\Windows\System\wdmKIhR.exe
  C:\Windows\System\wdmKIhR.exe
  2⤵
  PID:8584
- C:\Windows\System\JxbFKxT.exe
  C:\Windows\System\JxbFKxT.exe
  2⤵
  PID:8600
- C:\Windows\System\binhuGh.exe
  C:\Windows\System\binhuGh.exe
  2⤵
  PID:8616
- C:\Windows\System\ytBANIp.exe
  C:\Windows\System\ytBANIp.exe
  2⤵
  PID:8632
- C:\Windows\System\RJuytli.exe
  C:\Windows\System\RJuytli.exe
  2⤵
  PID:8648
- C:\Windows\System\enKRKEz.exe
  C:\Windows\System\enKRKEz.exe
  2⤵
  PID:8664
- C:\Windows\System\BlwdXNe.exe
  C:\Windows\System\BlwdXNe.exe
  2⤵
  PID:8680
- C:\Windows\System\riRwggz.exe
  C:\Windows\System\riRwggz.exe
  2⤵
  PID:8696
- C:\Windows\System\yiZaGQi.exe
  C:\Windows\System\yiZaGQi.exe
  2⤵
  PID:8712
- C:\Windows\System\cKUJiNR.exe
  C:\Windows\System\cKUJiNR.exe
  2⤵
  PID:8728
- C:\Windows\System\WxlywDw.exe
  C:\Windows\System\WxlywDw.exe
  2⤵
  PID:8744
- C:\Windows\System\gHnnsXT.exe
  C:\Windows\System\gHnnsXT.exe
  2⤵
  PID:8760
- C:\Windows\System\evFVVAp.exe
  C:\Windows\System\evFVVAp.exe
  2⤵
  PID:8776
- C:\Windows\System\wPkXCzU.exe
  C:\Windows\System\wPkXCzU.exe
  2⤵
  PID:8792
- C:\Windows\System\PQXztIz.exe
  C:\Windows\System\PQXztIz.exe
  2⤵
  PID:8808
- C:\Windows\System\MJUmmxb.exe
  C:\Windows\System\MJUmmxb.exe
  2⤵
  PID:8824
- C:\Windows\System\kZIaYWy.exe
  C:\Windows\System\kZIaYWy.exe
  2⤵
  PID:8840
- C:\Windows\System\oXYkVdx.exe
  C:\Windows\System\oXYkVdx.exe
  2⤵
  PID:8856
- C:\Windows\System\aroqCJx.exe
  C:\Windows\System\aroqCJx.exe
  2⤵
  PID:8872
- C:\Windows\System\ypiQieq.exe
  C:\Windows\System\ypiQieq.exe
  2⤵
  PID:8888
- C:\Windows\System\wyssqnq.exe
  C:\Windows\System\wyssqnq.exe
  2⤵
  PID:8904
- C:\Windows\System\rapKAiw.exe
  C:\Windows\System\rapKAiw.exe
  2⤵
  PID:8920
- C:\Windows\System\gQdBTXK.exe
  C:\Windows\System\gQdBTXK.exe
  2⤵
  PID:8936
- C:\Windows\System\kItJiTN.exe
  C:\Windows\System\kItJiTN.exe
  2⤵
  PID:8952
- C:\Windows\System\acQvazk.exe
  C:\Windows\System\acQvazk.exe
  2⤵
  PID:8968
- C:\Windows\System\idnXNVQ.exe
  C:\Windows\System\idnXNVQ.exe
  2⤵
  PID:8984
- C:\Windows\System\RsbzcdC.exe
  C:\Windows\System\RsbzcdC.exe
  2⤵
  PID:9000
- C:\Windows\System\fVBZSzS.exe
  C:\Windows\System\fVBZSzS.exe
  2⤵
  PID:9016
- C:\Windows\System\EltDLpw.exe
  C:\Windows\System\EltDLpw.exe
  2⤵
  PID:9032
- C:\Windows\System\KSxQFYy.exe
  C:\Windows\System\KSxQFYy.exe
  2⤵
  PID:9048
- C:\Windows\System\khrmCuu.exe
  C:\Windows\System\khrmCuu.exe
  2⤵
  PID:9064
- C:\Windows\System\ZjFTeFb.exe
  C:\Windows\System\ZjFTeFb.exe
  2⤵
  PID:9096
- C:\Windows\System\EAPvxmQ.exe
  C:\Windows\System\EAPvxmQ.exe
  2⤵
  PID:9116
- C:\Windows\System\jofKXDC.exe
  C:\Windows\System\jofKXDC.exe
  2⤵
  PID:9132
- C:\Windows\System\XGHKHKM.exe
  C:\Windows\System\XGHKHKM.exe
  2⤵
  PID:9164
- C:\Windows\System\XpozFuO.exe
  C:\Windows\System\XpozFuO.exe
  2⤵
  PID:8436
- C:\Windows\System\aIgNEej.exe
  C:\Windows\System\aIgNEej.exe
  2⤵
  PID:8532
- C:\Windows\System\hTpxxZR.exe
  C:\Windows\System\hTpxxZR.exe
  2⤵
  PID:8592
- C:\Windows\System\XtQEPaZ.exe
  C:\Windows\System\XtQEPaZ.exe
  2⤵
  PID:8660
- C:\Windows\System\EcdbVAg.exe
  C:\Windows\System\EcdbVAg.exe
  2⤵
  PID:8784
- C:\Windows\System\ehcIuBR.exe
  C:\Windows\System\ehcIuBR.exe
  2⤵
  PID:8912
- C:\Windows\System\wZwLGhS.exe
  C:\Windows\System\wZwLGhS.exe
  2⤵
  PID:9044
- C:\Windows\System\uMBDeFQ.exe
  C:\Windows\System\uMBDeFQ.exe
  2⤵
  PID:9224
- C:\Windows\System\aTuoZxl.exe
  C:\Windows\System\aTuoZxl.exe
  2⤵
  PID:9292
- C:\Windows\System\iEBfXuP.exe
  C:\Windows\System\iEBfXuP.exe
  2⤵
  PID:9356
- C:\Windows\System\CrCQfYu.exe
  C:\Windows\System\CrCQfYu.exe
  2⤵
  PID:9384
- C:\Windows\System\EgpoKmq.exe
  C:\Windows\System\EgpoKmq.exe
  2⤵
  PID:9420
- C:\Windows\System\irdFPcu.exe
  C:\Windows\System\irdFPcu.exe
  2⤵
  PID:9444
- C:\Windows\System\VjvecCg.exe
  C:\Windows\System\VjvecCg.exe
  2⤵
  PID:9460
- C:\Windows\System\zmTRtif.exe
  C:\Windows\System\zmTRtif.exe
  2⤵
  PID:9488
- C:\Windows\System\OTCFBWN.exe
  C:\Windows\System\OTCFBWN.exe
  2⤵
  PID:9520
- C:\Windows\System\JaPnSJp.exe
  C:\Windows\System\JaPnSJp.exe
  2⤵
  PID:9572
- C:\Windows\System\smTeVqc.exe
  C:\Windows\System\smTeVqc.exe
  2⤵
  PID:9600
- C:\Windows\System\gGVWUYE.exe
  C:\Windows\System\gGVWUYE.exe
  2⤵
  PID:9648
- C:\Windows\System\OXyPsoJ.exe
  C:\Windows\System\OXyPsoJ.exe
  2⤵
  PID:9676
- C:\Windows\System\SQYfAOs.exe
  C:\Windows\System\SQYfAOs.exe
  2⤵
  PID:9704
- C:\Windows\System\yueXqKd.exe
  C:\Windows\System\yueXqKd.exe
  2⤵
  PID:9720
- C:\Windows\System\jHNmaxX.exe
  C:\Windows\System\jHNmaxX.exe
  2⤵
  PID:9736
- C:\Windows\System\jgXdADt.exe
  C:\Windows\System\jgXdADt.exe
  2⤵
  PID:9752
- C:\Windows\System\thhmPuX.exe
  C:\Windows\System\thhmPuX.exe
  2⤵
  PID:9772
- C:\Windows\System\cfoHvIP.exe
  C:\Windows\System\cfoHvIP.exe
  2⤵
  PID:9788
- C:\Windows\System\zdisuda.exe
  C:\Windows\System\zdisuda.exe
  2⤵
  PID:9812
- C:\Windows\System\kGgEIaU.exe
  C:\Windows\System\kGgEIaU.exe
  2⤵
  PID:9832
- C:\Windows\System\rJEXdAc.exe
  C:\Windows\System\rJEXdAc.exe
  2⤵
  PID:9848
- C:\Windows\System\jqoqoBO.exe
  C:\Windows\System\jqoqoBO.exe
  2⤵
  PID:9864
- C:\Windows\System\xSvBLJI.exe
  C:\Windows\System\xSvBLJI.exe
  2⤵
  PID:9884
- C:\Windows\System\ediPKzM.exe
  C:\Windows\System\ediPKzM.exe
  2⤵
  PID:9900
- C:\Windows\System\ExrJMNq.exe
  C:\Windows\System\ExrJMNq.exe
  2⤵
  PID:9920
- C:\Windows\System\WLBYRxD.exe
  C:\Windows\System\WLBYRxD.exe
  2⤵
  PID:9936
- C:\Windows\System\ClVKyUY.exe
  C:\Windows\System\ClVKyUY.exe
  2⤵
  PID:9952
- C:\Windows\System\bzYJTym.exe
  C:\Windows\System\bzYJTym.exe
  2⤵
  PID:9972
- C:\Windows\System\apPEtIE.exe
  C:\Windows\System\apPEtIE.exe
  2⤵
  PID:9996
- C:\Windows\System\WHOgIpi.exe
  C:\Windows\System\WHOgIpi.exe
  2⤵
  PID:10012
- C:\Windows\System\mPCduVo.exe
  C:\Windows\System\mPCduVo.exe
  2⤵
  PID:10028
- C:\Windows\System\nbrHIaR.exe
  C:\Windows\System\nbrHIaR.exe
  2⤵
  PID:10044
- C:\Windows\System\XCJUCXw.exe
  C:\Windows\System\XCJUCXw.exe
  2⤵
  PID:10064
- C:\Windows\System\eAjZkHI.exe
  C:\Windows\System\eAjZkHI.exe
  2⤵
  PID:10080
- C:\Windows\System\jiTHmdd.exe
  C:\Windows\System\jiTHmdd.exe
  2⤵
  PID:10104
- C:\Windows\System\TCdOhHi.exe
  C:\Windows\System\TCdOhHi.exe
  2⤵
  PID:10120
- C:\Windows\System\HHppnxr.exe
  C:\Windows\System\HHppnxr.exe
  2⤵
  PID:10140
- C:\Windows\System\KISJCKY.exe
  C:\Windows\System\KISJCKY.exe
  2⤵
  PID:10160
- C:\Windows\System\pQpSewf.exe
  C:\Windows\System\pQpSewf.exe
  2⤵
  PID:10176
- C:\Windows\System\ueYzCWs.exe
  C:\Windows\System\ueYzCWs.exe
  2⤵
  PID:10192
- C:\Windows\System\OoIMqDd.exe
  C:\Windows\System\OoIMqDd.exe
  2⤵
  PID:10216
- C:\Windows\System\OGsbNme.exe
  C:\Windows\System\OGsbNme.exe
  2⤵
  PID:10236
- C:\Windows\System\KbnlWmr.exe
  C:\Windows\System\KbnlWmr.exe
  2⤵
  PID:8560
- C:\Windows\System\ErIyMDi.exe
  C:\Windows\System\ErIyMDi.exe
  2⤵
  PID:8724
- C:\Windows\System\zduRYap.exe
  C:\Windows\System\zduRYap.exe
  2⤵
  PID:9008
- C:\Windows\System\vBtUKHK.exe
  C:\Windows\System\vBtUKHK.exe
  2⤵
  PID:9236
- C:\Windows\System\TDfWqic.exe
  C:\Windows\System\TDfWqic.exe
  2⤵
  PID:9256
- C:\Windows\System\jFKtqbT.exe
  C:\Windows\System\jFKtqbT.exe
  2⤵
  PID:9272
- C:\Windows\System\QKykUBj.exe
  C:\Windows\System\QKykUBj.exe
  2⤵
  PID:9364
- C:\Windows\System\mGZizQL.exe
  C:\Windows\System\mGZizQL.exe
  2⤵
  PID:9440
- C:\Windows\System\otkTnXC.exe
  C:\Windows\System\otkTnXC.exe
  2⤵
  PID:9536
- C:\Windows\System\RARGFrF.exe
  C:\Windows\System\RARGFrF.exe
  2⤵
  PID:9544
- C:\Windows\System\emJNTeY.exe
  C:\Windows\System\emJNTeY.exe
  2⤵
  PID:9688
- C:\Windows\System\btuymai.exe
  C:\Windows\System\btuymai.exe
  2⤵
  PID:9764
- C:\Windows\System\AOQVeRx.exe
  C:\Windows\System\AOQVeRx.exe
  2⤵
  PID:5164
- C:\Windows\System\LiEPlAh.exe
  C:\Windows\System\LiEPlAh.exe
  2⤵
  PID:5348
- C:\Windows\System\VxnrJkV.exe
  C:\Windows\System\VxnrJkV.exe
  2⤵
  PID:5372
- C:\Windows\System\eQaUomg.exe
  C:\Windows\System\eQaUomg.exe
  2⤵
  PID:5396
- C:\Windows\System\NwYMPzH.exe
  C:\Windows\System\NwYMPzH.exe
  2⤵
  PID:5424
- C:\Windows\System\eYQhiSE.exe
  C:\Windows\System\eYQhiSE.exe
  2⤵
  PID:5452
- C:\Windows\System\tQFqjHD.exe
  C:\Windows\System\tQFqjHD.exe
  2⤵
  PID:5476
- C:\Windows\System\NoEKfMA.exe
  C:\Windows\System\NoEKfMA.exe
  2⤵
  PID:5500
- C:\Windows\System\uNKcSRB.exe
  C:\Windows\System\uNKcSRB.exe
  2⤵
  PID:5528
- C:\Windows\System\GRrBWce.exe
  C:\Windows\System\GRrBWce.exe
  2⤵
  PID:5564
- C:\Windows\System\HsrDVMF.exe
  C:\Windows\System\HsrDVMF.exe
  2⤵
  PID:5588
- C:\Windows\System\TmRepLg.exe
  C:\Windows\System\TmRepLg.exe
  2⤵
  PID:5192
- C:\Windows\System\GHswWRe.exe
  C:\Windows\System\GHswWRe.exe
  2⤵
  PID:7064
- C:\Windows\System\QyLyXmC.exe
  C:\Windows\System\QyLyXmC.exe
  2⤵
  PID:7124
- C:\Windows\System\nkmFkEy.exe
  C:\Windows\System\nkmFkEy.exe
  2⤵
  PID:6400
- C:\Windows\System\TyhnCaY.exe
  C:\Windows\System\TyhnCaY.exe
  2⤵
  PID:6628
- C:\Windows\System\WbCfDUX.exe
  C:\Windows\System\WbCfDUX.exe
  2⤵
  PID:7408
- C:\Windows\System\bngpSgH.exe
  C:\Windows\System\bngpSgH.exe
  2⤵
  PID:7580
- C:\Windows\System\KtCZvOt.exe
  C:\Windows\System\KtCZvOt.exe
  2⤵
  PID:7896
- C:\Windows\System\VuaHsdk.exe
  C:\Windows\System\VuaHsdk.exe
  2⤵
  PID:7752
- C:\Windows\System\kTQHHVs.exe
  C:\Windows\System\kTQHHVs.exe
  2⤵
  PID:8880
- C:\Windows\System\sIcdTTg.exe
  C:\Windows\System\sIcdTTg.exe
  2⤵
  PID:9308
- C:\Windows\System\OmzzVDe.exe
  C:\Windows\System\OmzzVDe.exe
  2⤵
  PID:9324
- C:\Windows\System\thmRKaf.exe
  C:\Windows\System\thmRKaf.exe
  2⤵
  PID:9508
- C:\Windows\System\rtFzkRo.exe
  C:\Windows\System\rtFzkRo.exe
  2⤵
  PID:9968
- C:\Windows\System\sjJtrii.exe
  C:\Windows\System\sjJtrii.exe
  2⤵
  PID:9268
- C:\Windows\System\sAQORXM.exe
  C:\Windows\System\sAQORXM.exe
  2⤵
  PID:9560
- C:\Windows\System\TgpNpJR.exe
  C:\Windows\System\TgpNpJR.exe
  2⤵
  PID:9728
- C:\Windows\System\zSEfkSl.exe
  C:\Windows\System\zSEfkSl.exe
  2⤵
  PID:2768
- C:\Windows\System\hqfqRMg.exe
  C:\Windows\System\hqfqRMg.exe
  2⤵
  PID:9948
- C:\Windows\System\TGgKucx.exe
  C:\Windows\System\TGgKucx.exe
  2⤵
  PID:9992
- C:\Windows\System\qibzpqe.exe
  C:\Windows\System\qibzpqe.exe
  2⤵
  PID:10092
- C:\Windows\System\YNtzMka.exe
  C:\Windows\System\YNtzMka.exe
  2⤵
  PID:2188
- C:\Windows\System\yykDRHw.exe
  C:\Windows\System\yykDRHw.exe
  2⤵
  PID:2432
- C:\Windows\System\GFzoxDy.exe
  C:\Windows\System\GFzoxDy.exe
  2⤵
  PID:3112
- C:\Windows\System\WPHwkgE.exe
  C:\Windows\System\WPHwkgE.exe
  2⤵
  PID:3416
- C:\Windows\System\TSVfAHg.exe
  C:\Windows\System\TSVfAHg.exe
  2⤵
  PID:4056
- C:\Windows\System\RjuSueA.exe
  C:\Windows\System\RjuSueA.exe
  2⤵
  PID:4152
- C:\Windows\System\wmoiVtC.exe
  C:\Windows\System\wmoiVtC.exe
  2⤵
  PID:4280
- C:\Windows\System\TkZnQfY.exe
  C:\Windows\System\TkZnQfY.exe
  2⤵
  PID:4408
- C:\Windows\System\zjzzfxs.exe
  C:\Windows\System\zjzzfxs.exe
  2⤵
  PID:4536
- C:\Windows\System\fHxuwij.exe
  C:\Windows\System\fHxuwij.exe
  2⤵
  PID:4664
- C:\Windows\System\LohDuAf.exe
  C:\Windows\System\LohDuAf.exe
  2⤵
  PID:4696
- C:\Windows\System\ZqAAEak.exe
  C:\Windows\System\ZqAAEak.exe
  2⤵
  PID:1584
- C:\Windows\System\lELoMtJ.exe
  C:\Windows\System\lELoMtJ.exe
  2⤵
  PID:10200
- C:\Windows\System\vsLqfvY.exe
  C:\Windows\System\vsLqfvY.exe
  2⤵
  PID:8404
- C:\Windows\System\rPOGLUj.exe
  C:\Windows\System\rPOGLUj.exe
  2⤵
  PID:2988
- C:\Windows\System\RsEcdOm.exe
  C:\Windows\System\RsEcdOm.exe
  2⤵
  PID:8756
- C:\Windows\System\xLBnWUB.exe
  C:\Windows\System\xLBnWUB.exe
  2⤵
  PID:9248
- C:\Windows\System\ImMmxSB.exe
  C:\Windows\System\ImMmxSB.exe
  2⤵
  PID:1900
- C:\Windows\System\TnDgFYb.exe
  C:\Windows\System\TnDgFYb.exe
  2⤵
  PID:1160
- C:\Windows\System\aoXtDIz.exe
  C:\Windows\System\aoXtDIz.exe
  2⤵
  PID:948
- C:\Windows\System\xjaVuEN.exe
  C:\Windows\System\xjaVuEN.exe
  2⤵
  PID:912
- C:\Windows\System\IWVgLVu.exe
  C:\Windows\System\IWVgLVu.exe
  2⤵
  PID:9504
- C:\Windows\System\YbfIWoZ.exe
  C:\Windows\System\YbfIWoZ.exe
  2⤵
  PID:9328
- C:\Windows\System\suQCxOo.exe
  C:\Windows\System\suQCxOo.exe
  2⤵
  PID:3620
- C:\Windows\System\KrfogDx.exe
  C:\Windows\System\KrfogDx.exe
  2⤵
  PID:5156
- C:\Windows\System\nrUlluU.exe
  C:\Windows\System\nrUlluU.exe
  2⤵
  PID:5352
- C:\Windows\System\GzAgNZE.exe
  C:\Windows\System\GzAgNZE.exe
  2⤵
  PID:5436
- C:\Windows\System\HzMgfrc.exe
  C:\Windows\System\HzMgfrc.exe
  2⤵
  PID:5516
- C:\Windows\System\jLVPQXA.exe
  C:\Windows\System\jLVPQXA.exe
  2⤵
  PID:5556
- C:\Windows\System\urRBTRO.exe
  C:\Windows\System\urRBTRO.exe
  2⤵
  PID:5580
- C:\Windows\System\VyseRnq.exe
  C:\Windows\System\VyseRnq.exe
  2⤵
  PID:2740
- C:\Windows\System\DlChdNs.exe
  C:\Windows\System\DlChdNs.exe
  2⤵
  PID:2564
- C:\Windows\System\TmQDYyV.exe
  C:\Windows\System\TmQDYyV.exe
  2⤵
  PID:8420
- C:\Windows\System\FbLnSKk.exe
  C:\Windows\System\FbLnSKk.exe
  2⤵
  PID:8224
- C:\Windows\System\Tpsbznj.exe
  C:\Windows\System\Tpsbznj.exe
  2⤵
  PID:7500
- C:\Windows\System\NfYmLha.exe
  C:\Windows\System\NfYmLha.exe
  2⤵
  PID:8024
- C:\Windows\System\qNJoCyt.exe
  C:\Windows\System\qNJoCyt.exe
  2⤵
  PID:7708
- C:\Windows\System\KWQKPRi.exe
  C:\Windows\System\KWQKPRi.exe
  2⤵
  PID:7436
- C:\Windows\System\XOfQaVI.exe
  C:\Windows\System\XOfQaVI.exe
  2⤵
  PID:4824
- C:\Windows\System\AiVNCJW.exe
  C:\Windows\System\AiVNCJW.exe
  2⤵
  PID:4196
- C:\Windows\System\eYqwzVe.exe
  C:\Windows\System\eYqwzVe.exe
  2⤵
  PID:4984
- C:\Windows\System\ZssBibp.exe
  C:\Windows\System\ZssBibp.exe
  2⤵
  PID:484
- C:\Windows\System\BoOhhIY.exe
  C:\Windows\System\BoOhhIY.exe
  2⤵
  PID:2512
- C:\Windows\System\rFogvoX.exe
  C:\Windows\System\rFogvoX.exe
  2⤵
  PID:7800
- C:\Windows\System\bgyNbQp.exe
  C:\Windows\System\bgyNbQp.exe
  2⤵
  PID:6384
- C:\Windows\System\MgJTyvO.exe
  C:\Windows\System\MgJTyvO.exe
  2⤵
  PID:6188
- C:\Windows\System\HPNDprP.exe
  C:\Windows\System\HPNDprP.exe
  2⤵
  PID:5340
- C:\Windows\System\mxQEabz.exe
  C:\Windows\System\mxQEabz.exe
  2⤵
  PID:4068
- C:\Windows\System\fGcTmIA.exe
  C:\Windows\System\fGcTmIA.exe
  2⤵
  PID:3976
- C:\Windows\System\WwpYMmS.exe
  C:\Windows\System\WwpYMmS.exe
  2⤵
  PID:3880
- C:\Windows\System\PLegXxd.exe
  C:\Windows\System\PLegXxd.exe
  2⤵
  PID:3816
- C:\Windows\System\xaNGLja.exe
  C:\Windows\System\xaNGLja.exe
  2⤵
  PID:3940
- C:\Windows\System\XfkusMc.exe
  C:\Windows\System\XfkusMc.exe
  2⤵
  PID:1744
- C:\Windows\System\aELDpor.exe
  C:\Windows\System\aELDpor.exe
  2⤵
  PID:2388
- C:\Windows\System\kVudhHx.exe
  C:\Windows\System\kVudhHx.exe
  2⤵
  PID:8692
- C:\Windows\System\zPoDErU.exe
  C:\Windows\System\zPoDErU.exe
  2⤵
  PID:10184
- C:\Windows\System\hXZytGJ.exe
  C:\Windows\System\hXZytGJ.exe
  2⤵
  PID:10156
- C:\Windows\System\rkfPxQZ.exe
  C:\Windows\System\rkfPxQZ.exe
  2⤵
  PID:10036
- C:\Windows\System\ImNWhdT.exe
  C:\Windows\System\ImNWhdT.exe
  2⤵
  PID:9932
- C:\Windows\System\AnKWHSc.exe
  C:\Windows\System\AnKWHSc.exe
  2⤵
  PID:9860
- C:\Windows\System\vqXnHpP.exe
  C:\Windows\System\vqXnHpP.exe
  2⤵
  PID:9784
- C:\Windows\System\fMrsHnw.exe
  C:\Windows\System\fMrsHnw.exe
  2⤵
  PID:9716
- C:\Windows\System\lxaIsZs.exe
  C:\Windows\System\lxaIsZs.exe
  2⤵
  PID:9588
- C:\Windows\System\aKXIRZS.exe
  C:\Windows\System\aKXIRZS.exe
  2⤵
  PID:9452
- C:\Windows\System\kaXcsyd.exe
  C:\Windows\System\kaXcsyd.exe
  2⤵
  PID:9072
- C:\Windows\System\RtVWFfl.exe
  C:\Windows\System\RtVWFfl.exe
  2⤵
  PID:8624
- C:\Windows\System\oYUCQPS.exe
  C:\Windows\System\oYUCQPS.exe
  2⤵
  PID:9140
- C:\Windows\System\McoHYYX.exe
  C:\Windows\System\McoHYYX.exe
  2⤵
  PID:9056
- C:\Windows\System\nbKKpjz.exe
  C:\Windows\System\nbKKpjz.exe
  2⤵
  PID:8992
- C:\Windows\System\zcxTmfi.exe
  C:\Windows\System\zcxTmfi.exe
  2⤵
  PID:8928
- C:\Windows\System\PgYbhZW.exe
  C:\Windows\System\PgYbhZW.exe
  2⤵
  PID:8864
- C:\Windows\System\sEISKOu.exe
  C:\Windows\System\sEISKOu.exe
  2⤵
  PID:8800
- C:\Windows\System\iQPIzFZ.exe
  C:\Windows\System\iQPIzFZ.exe
  2⤵
  PID:8708
- C:\Windows\System\BMljQlH.exe
  C:\Windows\System\BMljQlH.exe
  2⤵
  PID:8644
- C:\Windows\System\abeSQLS.exe
  C:\Windows\System\abeSQLS.exe
  2⤵
  PID:8580
- C:\Windows\System\mGgmcEt.exe
  C:\Windows\System\mGgmcEt.exe
  2⤵
  PID:8516
- C:\Windows\System\HeVtkvE.exe
  C:\Windows\System\HeVtkvE.exe
  2⤵
  PID:8388
- C:\Windows\System\PmaybSR.exe
  C:\Windows\System\PmaybSR.exe
  2⤵
  PID:8320
- C:\Windows\System\ycxlkMN.exe
  C:\Windows\System\ycxlkMN.exe
  2⤵
  PID:8228
- C:\Windows\System\zrswGZT.exe
  C:\Windows\System\zrswGZT.exe
  2⤵
  PID:7200
- C:\Windows\System\LrVXzes.exe
  C:\Windows\System\LrVXzes.exe
  2⤵
  PID:7164
- C:\Windows\System\VIHDFKe.exe
  C:\Windows\System\VIHDFKe.exe
  2⤵
  PID:8184
- C:\Windows\System\EePFhQI.exe
  C:\Windows\System\EePFhQI.exe
  2⤵
  PID:8112
- C:\Windows\System\EAxSSLl.exe
  C:\Windows\System\EAxSSLl.exe
  2⤵
  PID:8040
- C:\Windows\System\kqmNQoO.exe
  C:\Windows\System\kqmNQoO.exe
  2⤵
  PID:7884
- C:\Windows\System\cQWyMEA.exe
  C:\Windows\System\cQWyMEA.exe
  2⤵
  PID:7804
- C:\Windows\System\vfLGZSb.exe
  C:\Windows\System\vfLGZSb.exe
  2⤵
  PID:7688
- C:\Windows\System\MqMteiN.exe
  C:\Windows\System\MqMteiN.exe
  2⤵
  PID:7616
- C:\Windows\System\QtusZLE.exe
  C:\Windows\System\QtusZLE.exe
  2⤵
  PID:7464
- C:\Windows\System\aPVhMsj.exe
  C:\Windows\System\aPVhMsj.exe
  2⤵
  PID:7340
- C:\Windows\System\cPLAIaf.exe
  C:\Windows\System\cPLAIaf.exe
  2⤵
  PID:7228
- C:\Windows\System\tfOETJd.exe
  C:\Windows\System\tfOETJd.exe
  2⤵
  PID:3876
- C:\Windows\System\NBqnOZu.exe
  C:\Windows\System\NBqnOZu.exe
  2⤵
  PID:6432
- C:\Windows\System\LupaWtP.exe
  C:\Windows\System\LupaWtP.exe
  2⤵
  PID:7060
- C:\Windows\System\XsqVbjN.exe
  C:\Windows\System\XsqVbjN.exe
  2⤵
  PID:6980
- C:\Windows\System\ipXJqBE.exe
  C:\Windows\System\ipXJqBE.exe
  2⤵
  PID:6880
- C:\Windows\System\tYTrvin.exe
  C:\Windows\System\tYTrvin.exe
  2⤵
  PID:6744
- C:\Windows\System\MSCtQIM.exe
  C:\Windows\System\MSCtQIM.exe
  2⤵
  PID:6684
- C:\Windows\System\pQJYfkA.exe
  C:\Windows\System\pQJYfkA.exe
  2⤵
  PID:6604
- C:\Windows\System\qaxSXIW.exe
  C:\Windows\System\qaxSXIW.exe
  2⤵
  PID:6540
- C:\Windows\System\SWyhsPC.exe
  C:\Windows\System\SWyhsPC.exe
  2⤵
  PID:6448
- C:\Windows\System\OZGXHcT.exe
  C:\Windows\System\OZGXHcT.exe
  2⤵
  PID:5720
- C:\Windows\System\ElZAwzm.exe
  C:\Windows\System\ElZAwzm.exe
  2⤵
  PID:5232
- C:\Windows\System\CADNETk.exe
  C:\Windows\System\CADNETk.exe
  2⤵
  PID:804
- C:\Windows\System\TQWigUb.exe
  C:\Windows\System\TQWigUb.exe
  2⤵
  PID:6136
- C:\Windows\System\SQwYOWd.exe
  C:\Windows\System\SQwYOWd.exe
  2⤵
  PID:5996
- C:\Windows\System\DQRBeRi.exe
  C:\Windows\System\DQRBeRi.exe
  2⤵
  PID:5920
- C:\Windows\System\RqettQu.exe
  C:\Windows\System\RqettQu.exe
  2⤵
  PID:5844
- C:\Windows\System\DnWbuJg.exe
  C:\Windows\System\DnWbuJg.exe
  2⤵
  PID:5772
- C:\Windows\System\MSduXfB.exe
  C:\Windows\System\MSduXfB.exe
  2⤵
  PID:5740
- C:\Windows\System\JfwwWam.exe
  C:\Windows\System\JfwwWam.exe
  2⤵
  PID:3812
- C:\Windows\System\IgYyRzi.exe
  C:\Windows\System\IgYyRzi.exe
  2⤵
  PID:3720
- C:\Windows\System\mrNCZFO.exe
  C:\Windows\System\mrNCZFO.exe
  2⤵
  PID:3652
- C:\Windows\System\ACiExcC.exe
  C:\Windows\System\ACiExcC.exe
  2⤵
  PID:3556
- C:\Windows\System\kqurJFA.exe
  C:\Windows\System\kqurJFA.exe
  2⤵
  PID:3496
- C:\Windows\System\aNiQGZA.exe
  C:\Windows\System\aNiQGZA.exe
  2⤵
  PID:3432
- C:\Windows\System\aeRUvkS.exe
  C:\Windows\System\aeRUvkS.exe
  2⤵
  PID:3368
- C:\Windows\System\YZXudiB.exe
  C:\Windows\System\YZXudiB.exe
  2⤵
  PID:3272
- C:\Windows\System\cKvyOne.exe
  C:\Windows\System\cKvyOne.exe
  2⤵
  PID:1568
- C:\Windows\System\mZyaAKU.exe
  C:\Windows\System\mZyaAKU.exe
  2⤵
  PID:1612
- C:\Windows\System\OYvIjaQ.exe
  C:\Windows\System\OYvIjaQ.exe
  2⤵
  PID:984
- C:\Windows\System\czsPodY.exe
  C:\Windows\System\czsPodY.exe
  2⤵
  PID:1956
- C:\Windows\System\YgDGaFu.exe
  C:\Windows\System\YgDGaFu.exe
  2⤵
  PID:3040
- C:\Windows\System\kbJSduM.exe
  C:\Windows\System\kbJSduM.exe
  2⤵
  PID:2548
- C:\Windows\System\YNbUROY.exe
  C:\Windows\System\YNbUROY.exe
  2⤵
  PID:1768
- C:\Windows\System\ojcaArG.exe
  C:\Windows\System\ojcaArG.exe
  2⤵
  PID:3140
- C:\Windows\System\OywBidz.exe
  C:\Windows\System\OywBidz.exe
  2⤵
  PID:3092
- C:\Windows\System\NCtrjeg.exe
  C:\Windows\System\NCtrjeg.exe
  2⤵
  PID:3540
- C:\Windows\System\GIrbBlJ.exe
  C:\Windows\System\GIrbBlJ.exe
  2⤵
  PID:4052
- C:\Windows\System\WJCjcyz.exe
  C:\Windows\System\WJCjcyz.exe
  2⤵
  PID:4436
- C:\Windows\System\moOytBk.exe
  C:\Windows\System\moOytBk.exe
  2⤵
  PID:4564
- C:\Windows\System\EPtpYPH.exe
  C:\Windows\System\EPtpYPH.exe
  2⤵
  PID:4692
- C:\Windows\System\rDwhjlN.exe
  C:\Windows\System\rDwhjlN.exe
  2⤵
  PID:6876
- C:\Windows\System\FcGhNdL.exe
  C:\Windows\System\FcGhNdL.exe
  2⤵
  PID:4916
- C:\Windows\System\tgXDeMq.exe
  C:\Windows\System\tgXDeMq.exe
  2⤵
  PID:1936
- C:\Windows\System\sglKbLL.exe
  C:\Windows\System\sglKbLL.exe
  2⤵
  PID:4980
- C:\Windows\System\fbzzckj.exe
  C:\Windows\System\fbzzckj.exe
  2⤵
  PID:4168
- C:\Windows\System\AXUjknE.exe
  C:\Windows\System\AXUjknE.exe
  2⤵
  PID:6032
- C:\Windows\System\CQouRDE.exe
  C:\Windows\System\CQouRDE.exe
  2⤵
  PID:2224
- C:\Windows\System\pAQixLX.exe
  C:\Windows\System\pAQixLX.exe
  2⤵
  PID:4820
- C:\Windows\System\usTnSqG.exe
  C:\Windows\System\usTnSqG.exe
  2⤵
  PID:2676
- C:\Windows\System\gDzfNuN.exe
  C:\Windows\System\gDzfNuN.exe
  2⤵
  PID:4340
- C:\Windows\System\jrXHtWw.exe
  C:\Windows\System\jrXHtWw.exe
  2⤵
  PID:5160
- C:\Windows\System\GFFwVdH.exe
  C:\Windows\System\GFFwVdH.exe
  2⤵
  PID:5368
- C:\Windows\System\vwnZkJx.exe
  C:\Windows\System\vwnZkJx.exe
  2⤵
  PID:5472
- C:\Windows\System\bftbFxd.exe
  C:\Windows\System\bftbFxd.exe
  2⤵
  PID:5576
- C:\Windows\System\WAMWAVp.exe
  C:\Windows\System\WAMWAVp.exe
  2⤵
  PID:2180
- C:\Windows\System\JJuhNQM.exe
  C:\Windows\System\JJuhNQM.exe
  2⤵
  PID:10100
- C:\Windows\System\gOwiAdG.exe
  C:\Windows\System\gOwiAdG.exe
  2⤵
  PID:7328
- C:\Windows\System\UekJDly.exe
  C:\Windows\System\UekJDly.exe
  2⤵
  PID:8656
- C:\Windows\System\EwmuLMG.exe
  C:\Windows\System\EwmuLMG.exe
  2⤵
  PID:9316
- C:\Windows\System\hCNYBbs.exe
  C:\Windows\System\hCNYBbs.exe
  2⤵
  PID:2020
- C:\Windows\System\zEAwXHr.exe
  C:\Windows\System\zEAwXHr.exe
  2⤵
  PID:9984
- C:\Windows\System\Wgqqztf.exe
  C:\Windows\System\Wgqqztf.exe
  2⤵
  PID:288
- C:\Windows\System\lKTNVpS.exe
  C:\Windows\System\lKTNVpS.exe
  2⤵
  PID:2312
- C:\Windows\System\tgLPHHD.exe
  C:\Windows\System\tgLPHHD.exe
  2⤵
  PID:8188
- C:\Windows\System\AXJEzkT.exe
  C:\Windows\System\AXJEzkT.exe
  2⤵
  PID:9340
- C:\Windows\System\VYLysKg.exe
  C:\Windows\System\VYLysKg.exe
  2⤵
  PID:5540
- C:\Windows\System\yncDtfy.exe
  C:\Windows\System\yncDtfy.exe
  2⤵
  PID:7120
- C:\Windows\System\iNZdNyg.exe
  C:\Windows\System\iNZdNyg.exe
  2⤵
  PID:9696
- C:\Windows\System\IjpOqaC.exe
  C:\Windows\System\IjpOqaC.exe
  2⤵
  PID:4472
- C:\Windows\System\ibcyaRR.exe
  C:\Windows\System\ibcyaRR.exe
  2⤵
  PID:9916
- C:\Windows\System\TnoyCCQ.exe
  C:\Windows\System\TnoyCCQ.exe
  2⤵
  PID:4760
- C:\Windows\System\FgsJXPu.exe
  C:\Windows\System\FgsJXPu.exe
  2⤵
  PID:2260
- C:\Windows\System\SSFyHti.exe
  C:\Windows\System\SSFyHti.exe
  2⤵
  PID:10136
- C:\Windows\System\LOxCliQ.exe
  C:\Windows\System\LOxCliQ.exe
  2⤵
  PID:1516
- C:\Windows\System\zOKzPBt.exe
  C:\Windows\System\zOKzPBt.exe
  2⤵
  PID:4344
- C:\Windows\System\terFDXg.exe
  C:\Windows\System\terFDXg.exe
  2⤵
  PID:10132
- C:\Windows\System\fhtLpfi.exe
  C:\Windows\System\fhtLpfi.exe
  2⤵
  PID:1124
- C:\Windows\System\lCrNCNu.exe
  C:\Windows\System\lCrNCNu.exe
  2⤵
  PID:1668
- C:\Windows\System\NohFhpb.exe
  C:\Windows\System\NohFhpb.exe
  2⤵
  PID:9400
- C:\Windows\System\JUvIXcr.exe
  C:\Windows\System\JUvIXcr.exe
  2⤵
  PID:5404
- C:\Windows\System\InQxPOp.exe
  C:\Windows\System\InQxPOp.exe
  2⤵
  PID:9840
- C:\Windows\System\hXHhTgX.exe
  C:\Windows\System\hXHhTgX.exe
  2⤵
  PID:2816
- C:\Windows\System\Nxisipt.exe
  C:\Windows\System\Nxisipt.exe
  2⤵
  PID:1504
- C:\Windows\System\fqZNhwU.exe
  C:\Windows\System\fqZNhwU.exe
  2⤵
  PID:5532
- C:\Windows\System\jWVcoZV.exe
  C:\Windows\System\jWVcoZV.exe
  2⤵
  PID:8484
- C:\Windows\System\TTxUnVv.exe
  C:\Windows\System\TTxUnVv.exe
  2⤵
  PID:7860
- C:\Windows\System\FTsPgja.exe
  C:\Windows\System\FTsPgja.exe
  2⤵
  PID:7744
- C:\Windows\System\RkfRtnM.exe
  C:\Windows\System\RkfRtnM.exe
  2⤵
  PID:1576
- C:\Windows\System\VVnccms.exe
  C:\Windows\System\VVnccms.exe
  2⤵
  PID:576
- C:\Windows\System\CVkJIOC.exe
  C:\Windows\System\CVkJIOC.exe
  2⤵
  PID:3844
- C:\Windows\System\XMgOGWP.exe
  C:\Windows\System\XMgOGWP.exe
  2⤵
  PID:6192
- C:\Windows\System\xDGeGiM.exe
  C:\Windows\System\xDGeGiM.exe
  2⤵
  PID:5080
- C:\Windows\System\YBpkZis.exe
  C:\Windows\System\YBpkZis.exe
  2⤵
  PID:588
- C:\Windows\System\jTHeHLZ.exe
  C:\Windows\System\jTHeHLZ.exe
  2⤵
  PID:1252
- C:\Windows\System\cCxDynp.exe
  C:\Windows\System\cCxDynp.exe
  2⤵
  PID:10224
- C:\Windows\System\BhMwHah.exe
  C:\Windows\System\BhMwHah.exe
  2⤵
  PID:10004
- C:\Windows\System\BttBdcR.exe
  C:\Windows\System\BttBdcR.exe
  2⤵
  PID:10040
- C:\Windows\System\NpHCKis.exe
  C:\Windows\System\NpHCKis.exe
  2⤵
  PID:9748
- C:\Windows\System\EQZAwIU.exe
  C:\Windows\System\EQZAwIU.exe
  2⤵
  PID:9496
- C:\Windows\System\pJbBvBp.exe
  C:\Windows\System\pJbBvBp.exe
  2⤵
  PID:9024
- C:\Windows\System\ToHhrvG.exe
  C:\Windows\System\ToHhrvG.exe
  2⤵
  PID:1692
- C:\Windows\System\xmRAEFr.exe
  C:\Windows\System\xmRAEFr.exe
  2⤵
  PID:8868
- C:\Windows\System\MmleMcq.exe
  C:\Windows\System\MmleMcq.exe
  2⤵
  PID:8608
- C:\Windows\System\KXwVcdU.exe
  C:\Windows\System\KXwVcdU.exe
  2⤵
  PID:8256
- C:\Windows\System\wHMMYIX.exe
  C:\Windows\System\wHMMYIX.exe
  2⤵
  PID:8144
- C:\Windows\System\zwDQimb.exe
  C:\Windows\System\zwDQimb.exe
  2⤵
  PID:8676
- C:\Windows\System\diVJPkY.exe
  C:\Windows\System\diVJPkY.exe
  2⤵
  PID:6756
- C:\Windows\System\BHnbtuL.exe
  C:\Windows\System\BHnbtuL.exe
  2⤵
  PID:7956
- C:\Windows\System\yzdCVbG.exe
  C:\Windows\System\yzdCVbG.exe
  2⤵
  PID:7516
- C:\Windows\System\WgvCwex.exe
  C:\Windows\System\WgvCwex.exe
  2⤵
  PID:7016
- C:\Windows\System\GqDejet.exe
  C:\Windows\System\GqDejet.exe
  2⤵
  PID:6608
- C:\Windows\System\izeZNgW.exe
  C:\Windows\System\izeZNgW.exe
  2⤵
  PID:8832
- C:\Windows\System\xdLRyXf.exe
  C:\Windows\System\xdLRyXf.exe
  2⤵
  PID:6924
- C:\Windows\System\OkhQydk.exe
  C:\Windows\System\OkhQydk.exe
  2⤵
  PID:8352
- C:\Windows\System\YgypTTb.exe
  C:\Windows\System\YgypTTb.exe
  2⤵
  PID:5944
- C:\Windows\System\Nwxyarq.exe
  C:\Windows\System\Nwxyarq.exe
  2⤵
  PID:2572
- C:\Windows\System\DgOGAkI.exe
  C:\Windows\System\DgOGAkI.exe
  2⤵
  PID:3604
- C:\Windows\System\nRjtZzc.exe
  C:\Windows\System\nRjtZzc.exe
  2⤵
  PID:5360
- C:\Windows\System\oYeHUWw.exe
  C:\Windows\System\oYeHUWw.exe
  2⤵
  PID:6648
- C:\Windows\System\DVagyMh.exe
  C:\Windows\System\DVagyMh.exe
  2⤵
  PID:4180
- C:\Windows\System\RYApcQa.exe
  C:\Windows\System\RYApcQa.exe
  2⤵
  PID:4628
- C:\Windows\System\gkMtqBO.exe
  C:\Windows\System\gkMtqBO.exe
  2⤵
  PID:1868
- C:\Windows\System\SBjYyyz.exe
  C:\Windows\System\SBjYyyz.exe
  2⤵
  PID:8152
- C:\Windows\System\JtBKpHs.exe
  C:\Windows\System\JtBKpHs.exe
  2⤵
  PID:9264
- C:\Windows\System\wvpLCCY.exe
  C:\Windows\System\wvpLCCY.exe
  2⤵
  PID:3208
- C:\Windows\System\vKNuoeD.exe
  C:\Windows\System\vKNuoeD.exe
  2⤵
  PID:9284
- C:\Windows\System\oDwIPJf.exe
  C:\Windows\System\oDwIPJf.exe
  2⤵
  PID:5332
- C:\Windows\System\nYBiuyC.exe
  C:\Windows\System\nYBiuyC.exe
  2⤵
  PID:7820
- C:\Windows\System\CKaIAhr.exe
  C:\Windows\System\CKaIAhr.exe
  2⤵
  PID:3800
- C:\Windows\System\HEUEHmX.exe
  C:\Windows\System\HEUEHmX.exe
  2⤵
  PID:4120
- C:\Windows\System\mYUrOpT.exe
  C:\Windows\System\mYUrOpT.exe
  2⤵
  PID:2916
- C:\Windows\System\ybiDeKC.exe
  C:\Windows\System\ybiDeKC.exe
  2⤵
  PID:6840
- C:\Windows\System\yCxJgam.exe
  C:\Windows\System\yCxJgam.exe
  2⤵
  PID:2068
- C:\Windows\System\dmXtSCL.exe
  C:\Windows\System\dmXtSCL.exe
  2⤵
  PID:9964
- C:\Windows\System\WvLKDRk.exe
  C:\Windows\System\WvLKDRk.exe
  2⤵
  PID:1144
- C:\Windows\System\biVUZVt.exe
  C:\Windows\System\biVUZVt.exe
  2⤵
  PID:5144
- C:\Windows\System\DcIocxb.exe
  C:\Windows\System\DcIocxb.exe
  2⤵
  PID:7620
- C:\Windows\System\EsqlKWW.exe
  C:\Windows\System\EsqlKWW.exe
  2⤵
  PID:2552
- C:\Windows\System\crnultY.exe
  C:\Windows\System\crnultY.exe
  2⤵
  PID:3124
- C:\Windows\System\WcTnmOO.exe
  C:\Windows\System\WcTnmOO.exe
  2⤵
  PID:6320
- C:\Windows\System\eNBiCfJ.exe
  C:\Windows\System\eNBiCfJ.exe
  2⤵
  PID:6252
- C:\Windows\System\rvTNruw.exe
  C:\Windows\System\rvTNruw.exe
  2⤵
  PID:3864
- C:\Windows\System\TcbnVQV.exe
  C:\Windows\System\TcbnVQV.exe
  2⤵
  PID:6416
- C:\Windows\System\tyiPSGu.exe
  C:\Windows\System\tyiPSGu.exe
  2⤵
  PID:6256
- C:\Windows\System\NcZBcGc.exe
  C:\Windows\System\NcZBcGc.exe
  2⤵
  PID:5288
- C:\Windows\System\XwnaErW.exe
  C:\Windows\System\XwnaErW.exe
  2⤵
  PID:6072
- C:\Windows\System\eJgMkqQ.exe
  C:\Windows\System\eJgMkqQ.exe
  2⤵
  PID:2820
- C:\Windows\System\WCQwkNB.exe
  C:\Windows\System\WCQwkNB.exe
  2⤵
  PID:5816
- C:\Windows\System\IkIuVil.exe
  C:\Windows\System\IkIuVil.exe
  2⤵
  PID:3688
- C:\Windows\System\ypfPeST.exe
  C:\Windows\System\ypfPeST.exe
  2⤵
  PID:3400
- C:\Windows\System\TybIEcp.exe
  C:\Windows\System\TybIEcp.exe
  2⤵
  PID:844
- C:\Windows\System\NkyYLyB.exe
  C:\Windows\System\NkyYLyB.exe
  2⤵
  PID:2648
- C:\Windows\System\goKdwrK.exe
  C:\Windows\System\goKdwrK.exe
  2⤵
  PID:3796
- C:\Windows\System\rAIkXdd.exe
  C:\Windows\System\rAIkXdd.exe
  2⤵
  PID:1592
- C:\Windows\System\sELCqsC.exe
  C:\Windows\System\sELCqsC.exe
  2⤵
  PID:2536
- C:\Windows\System\BFmfzal.exe
  C:\Windows\System\BFmfzal.exe
  2⤵
  PID:6036
- C:\Windows\System\xRGgvEu.exe
  C:\Windows\System\xRGgvEu.exe
  2⤵
  PID:5704
- C:\Windows\System\EDNpAGe.exe
  C:\Windows\System\EDNpAGe.exe
  2⤵
  PID:1532
- C:\Windows\System\ZVegRJv.exe
  C:\Windows\System\ZVegRJv.exe
  2⤵
  PID:3464
- C:\Windows\System\KoHnicU.exe
  C:\Windows\System\KoHnicU.exe
  2⤵
  PID:2460
- C:\Windows\System\LyCWfxB.exe
  C:\Windows\System\LyCWfxB.exe
  2⤵
  PID:2636
- C:\Windows\System\UwZOeHq.exe
  C:\Windows\System\UwZOeHq.exe
  2⤵
  PID:2456
- C:\Windows\System\JcHJlMa.exe
  C:\Windows\System\JcHJlMa.exe
  2⤵
  PID:5464
- C:\Windows\System\hxSOopt.exe
  C:\Windows\System\hxSOopt.exe
  2⤵
  PID:1196
- C:\Windows\System\eSQbcgT.exe
  C:\Windows\System\eSQbcgT.exe
  2⤵
  PID:8816
- C:\Windows\System\GBSWqtP.exe
  C:\Windows\System\GBSWqtP.exe
  2⤵
  PID:4884
- C:\Windows\System\aNHokfK.exe
  C:\Windows\System\aNHokfK.exe
  2⤵
  PID:3076
- C:\Windows\System\EHsNndP.exe
  C:\Windows\System\EHsNndP.exe
  2⤵
  PID:6464
- C:\Windows\System\uTRXBPC.exe
  C:\Windows\System\uTRXBPC.exe
  2⤵
  PID:3608
- C:\Windows\System\fprKYbj.exe
  C:\Windows\System\fprKYbj.exe
  2⤵
  PID:9684
- C:\Windows\System\DeKkSHu.exe
  C:\Windows\System\DeKkSHu.exe
  2⤵
  PID:4728
- C:\Windows\System\LBPCSVe.exe
  C:\Windows\System\LBPCSVe.exe
  2⤵
  PID:8384
- C:\Windows\System\maxQQTo.exe
  C:\Windows\System\maxQQTo.exe
  2⤵
  PID:5600
- C:\Windows\System\OrDHwpJ.exe
  C:\Windows\System\OrDHwpJ.exe
  2⤵
  PID:7448
- C:\Windows\System\ZwwitWf.exe
  C:\Windows\System\ZwwitWf.exe
  2⤵
  PID:8048
- C:\Windows\System\sOIYcZH.exe
  C:\Windows\System\sOIYcZH.exe
  2⤵
  PID:10188
- C:\Windows\System\lxvebbv.exe
  C:\Windows\System\lxvebbv.exe
  2⤵
  PID:2756
- C:\Windows\System\fqGcDLh.exe
  C:\Windows\System\fqGcDLh.exe
  2⤵
  PID:2632
- C:\Windows\System\rNxvTqp.exe
  C:\Windows\System\rNxvTqp.exe
  2⤵
  PID:5940
- C:\Windows\System\JxCpfsN.exe
  C:\Windows\System\JxCpfsN.exe
  2⤵
  PID:3592
- C:\Windows\System\uTrMMyB.exe
  C:\Windows\System\uTrMMyB.exe
  2⤵
  PID:5432
- C:\Windows\System\EXKDIsf.exe
  C:\Windows\System\EXKDIsf.exe
  2⤵
  PID:10172
- C:\Windows\System\ssFPnfF.exe
  C:\Windows\System\ssFPnfF.exe
  2⤵
  PID:1884
- C:\Windows\System\jDeLzUj.exe
  C:\Windows\System\jDeLzUj.exe
  2⤵
  PID:7000
- C:\Windows\System\httGoQC.exe
  C:\Windows\System\httGoQC.exe
  2⤵
  PID:8448
- C:\Windows\System\hYeTlyL.exe
  C:\Windows\System\hYeTlyL.exe
  2⤵
  PID:7388
- C:\Windows\System\vgrwBHJ.exe
  C:\Windows\System\vgrwBHJ.exe
  2⤵
  PID:1460
- C:\Windows\System\oHOenex.exe
  C:\Windows\System\oHOenex.exe
  2⤵
  PID:8628
- C:\Windows\System\JAbuhTO.exe
  C:\Windows\System\JAbuhTO.exe
  2⤵
  PID:7692
- C:\Windows\System\OpXENQM.exe
  C:\Windows\System\OpXENQM.exe
  2⤵
  PID:6364
- C:\Windows\System\BjHksio.exe
  C:\Windows\System\BjHksio.exe
  2⤵
  PID:8076
- C:\Windows\System\BVSgDwl.exe
  C:\Windows\System\BVSgDwl.exe
  2⤵
  PID:6572
- C:\Windows\System\ALeiaaB.exe
  C:\Windows\System\ALeiaaB.exe
  2⤵
  PID:6444
- C:\Windows\System\zrrrFNt.exe
  C:\Windows\System\zrrrFNt.exe
  2⤵
  PID:5636
- C:\Windows\System\CjMcRWF.exe
  C:\Windows\System\CjMcRWF.exe
  2⤵
  PID:2524
- C:\Windows\System\uOTfBKn.exe
  C:\Windows\System\uOTfBKn.exe
  2⤵
  PID:5924
- C:\Windows\System\EGtbizJ.exe
  C:\Windows\System\EGtbizJ.exe
  2⤵
  PID:3524
- C:\Windows\System\gUwUVAK.exe
  C:\Windows\System\gUwUVAK.exe
  2⤵
  PID:4788
- C:\Windows\System\hsyirbK.exe
  C:\Windows\System\hsyirbK.exe
  2⤵
  PID:3752
- C:\Windows\System\oGumpjf.exe
  C:\Windows\System\oGumpjf.exe
  2⤵
  PID:3412
- C:\Windows\System\rRhsydO.exe
  C:\Windows\System\rRhsydO.exe
  2⤵
  PID:2764
- C:\Windows\System\PkJJpOz.exe
  C:\Windows\System\PkJJpOz.exe
  2⤵
  PID:3304
- C:\Windows\System\UoRowIP.exe
  C:\Windows\System\UoRowIP.exe
  2⤵
  PID:2320
- C:\Windows\System\mlcxncD.exe
  C:\Windows\System\mlcxncD.exe
  2⤵
  PID:6096
- C:\Windows\System\tqCMiYA.exe
  C:\Windows\System\tqCMiYA.exe
  2⤵
  PID:4632
- C:\Windows\System\RqqvaUj.exe
  C:\Windows\System\RqqvaUj.exe
  2⤵
  PID:9828
- C:\Windows\System\DGWvUnk.exe
  C:\Windows\System\DGWvUnk.exe
  2⤵
  PID:4036
- C:\Windows\System\CpBzgfC.exe
  C:\Windows\System\CpBzgfC.exe
  2⤵
  PID:10060
- C:\Windows\System\igIRriE.exe
  C:\Windows\System\igIRriE.exe
  2⤵
  PID:5456
- C:\Windows\System\rZIqdFb.exe
  C:\Windows\System\rZIqdFb.exe
  2⤵
  PID:5492
- C:\Windows\System\BODkYro.exe
  C:\Windows\System\BODkYro.exe
  2⤵
  PID:1684
- C:\Windows\System\PQaGfMu.exe
  C:\Windows\System\PQaGfMu.exe
  2⤵
  PID:4004
- C:\Windows\System\oAazvao.exe
  C:\Windows\System\oAazvao.exe
  2⤵
  PID:6644
- C:\Windows\System\IebwfbP.exe
  C:\Windows\System\IebwfbP.exe
  2⤵
  PID:8960
- C:\Windows\System\bdOBfVb.exe
  C:\Windows\System\bdOBfVb.exe
  2⤵
  PID:8028
- C:\Windows\System\ZuythHJ.exe
  C:\Windows\System\ZuythHJ.exe
  2⤵
  PID:1380
- C:\Windows\System\fbZeHeG.exe
  C:\Windows\System\fbZeHeG.exe
  2⤵
  PID:3684
- C:\Windows\System\CdCNYop.exe
  C:\Windows\System\CdCNYop.exe
  2⤵
  PID:8324
- C:\Windows\System\sJkHogI.exe
  C:\Windows\System\sJkHogI.exe
  2⤵
  PID:6624
- C:\Windows\System\YymtRtU.exe
  C:\Windows\System\YymtRtU.exe
  2⤵
  PID:5652
- C:\Windows\System\hwwoyQR.exe
  C:\Windows\System\hwwoyQR.exe
  2⤵
  PID:6140
- C:\Windows\System\kYuwILG.exe
  C:\Windows\System\kYuwILG.exe
  2⤵
  PID:2780
- C:\Windows\System\bmLYoEi.exe
  C:\Windows\System\bmLYoEi.exe
  2⤵
  PID:6396
- C:\Windows\System\yqTxemb.exe
  C:\Windows\System\yqTxemb.exe
  2⤵
  PID:684
- C:\Windows\System\JQHemnB.exe
  C:\Windows\System\JQHemnB.exe
  2⤵
  PID:3108
- C:\Windows\System\HdUqMap.exe
  C:\Windows\System\HdUqMap.exe
  2⤵
  PID:7528
- C:\Windows\System\FLIFBqq.exe
  C:\Windows\System\FLIFBqq.exe
  2⤵
  PID:9320
- C:\Windows\System\aVIqBiM.exe
  C:\Windows\System\aVIqBiM.exe
  2⤵
  PID:6804
- C:\Windows\System\ZTBwECR.exe
  C:\Windows\System\ZTBwECR.exe
  2⤵
  PID:2336
- C:\Windows\System\JPvcmvn.exe
  C:\Windows\System\JPvcmvn.exe
  2⤵
  PID:884
- C:\Windows\System\gMABYpZ.exe
  C:\Windows\System\gMABYpZ.exe
  2⤵
  PID:8976
- C:\Windows\System\VmChwkX.exe
  C:\Windows\System\VmChwkX.exe
  2⤵
  PID:2584
- C:\Windows\System\AGpnqjU.exe
  C:\Windows\System\AGpnqjU.exe
  2⤵
  PID:5480
- C:\Windows\System\fWMiRRj.exe
  C:\Windows\System\fWMiRRj.exe
  2⤵
  PID:9892
- C:\Windows\System\kNquVRd.exe
  C:\Windows\System\kNquVRd.exe
  2⤵
  PID:8932
- C:\Windows\System\WtPOfjk.exe
  C:\Windows\System\WtPOfjk.exe
  2⤵
  PID:8720
- C:\Windows\System\taBgYJU.exe
  C:\Windows\System\taBgYJU.exe
  2⤵
  PID:6896
- C:\Windows\System\joYNiDo.exe
  C:\Windows\System\joYNiDo.exe
  2⤵
  PID:6348
- C:\Windows\System\GHVSSHY.exe
  C:\Windows\System\GHVSSHY.exe
  2⤵
  PID:6476
- C:\Windows\System\baCUhpy.exe
  C:\Windows\System\baCUhpy.exe
  2⤵
  PID:5012
- C:\Windows\System\xxzdkIB.exe
  C:\Windows\System\xxzdkIB.exe
  2⤵
  PID:4500
- C:\Windows\System\qSNKUBg.exe
  C:\Windows\System\qSNKUBg.exe
  2⤵
  PID:4952
- C:\Windows\System\KvlNBjW.exe
  C:\Windows\System\KvlNBjW.exe
  2⤵
  PID:9220
- C:\Windows\System\bbZnUhN.exe
  C:\Windows\System\bbZnUhN.exe
  2⤵
  PID:1720
- C:\Windows\System\HLyMhlz.exe
  C:\Windows\System\HLyMhlz.exe
  2⤵
  PID:1656
- C:\Windows\System\SUnDtyp.exe
  C:\Windows\System\SUnDtyp.exe
  2⤵
  PID:8468
- C:\Windows\System\zOQOrjs.exe
  C:\Windows\System\zOQOrjs.exe
  2⤵
  PID:9144
- C:\Windows\System\nhbOpqJ.exe
  C:\Windows\System\nhbOpqJ.exe
  2⤵
  PID:9456
- C:\Windows\System\ZWjDhml.exe
  C:\Windows\System\ZWjDhml.exe
  2⤵
  PID:5344
- C:\Windows\System\prSbMWZ.exe
  C:\Windows\System\prSbMWZ.exe
  2⤵
  PID:6284
- C:\Windows\System\ZDrVfeS.exe
  C:\Windows\System\ZDrVfeS.exe
  2⤵
  PID:3908
- C:\Windows\System\aHNBVpE.exe
  C:\Windows\System\aHNBVpE.exe
  2⤵
  PID:5584
- C:\Windows\System\gatYZoW.exe
  C:\Windows\System\gatYZoW.exe
  2⤵
  PID:7788
- C:\Windows\System\kUnPYco.exe
  C:\Windows\System\kUnPYco.exe
  2⤵
  PID:7840
- C:\Windows\System\MxGPIHy.exe
  C:\Windows\System\MxGPIHy.exe
  2⤵
  PID:10252
- C:\Windows\System\ZpZDeRY.exe
  C:\Windows\System\ZpZDeRY.exe
  2⤵
  PID:10272
- C:\Windows\System\asQlCEn.exe
  C:\Windows\System\asQlCEn.exe
  2⤵
  PID:10288
- C:\Windows\System\ZHyoLYZ.exe
  C:\Windows\System\ZHyoLYZ.exe
  2⤵
  PID:10308
- C:\Windows\System\ytFragn.exe
  C:\Windows\System\ytFragn.exe
  2⤵
  PID:10344
- C:\Windows\System\TmmGZRt.exe
  C:\Windows\System\TmmGZRt.exe
  2⤵
  PID:10368
- C:\Windows\System\dwYAEbC.exe
  C:\Windows\System\dwYAEbC.exe
  2⤵
  PID:10404
- C:\Windows\System\iOCPxDr.exe
  C:\Windows\System\iOCPxDr.exe
  2⤵
  PID:10424
- C:\Windows\System\OKnhgpe.exe
  C:\Windows\System\OKnhgpe.exe
  2⤵
  PID:10440
- C:\Windows\System\sBASTfw.exe
  C:\Windows\System\sBASTfw.exe
  2⤵
  PID:10484
- C:\Windows\System\ECcwGcj.exe
  C:\Windows\System\ECcwGcj.exe
  2⤵
  PID:10500
- C:\Windows\System\caTYMzF.exe
  C:\Windows\System\caTYMzF.exe
  2⤵
  PID:10516
- C:\Windows\System\HJPeWFZ.exe
  C:\Windows\System\HJPeWFZ.exe
  2⤵
  PID:10536
- C:\Windows\System\YwcGsax.exe
  C:\Windows\System\YwcGsax.exe
  2⤵
  PID:10552
- C:\Windows\System\SFPqmad.exe
  C:\Windows\System\SFPqmad.exe
  2⤵
  PID:10572
- C:\Windows\System\jIiJUhC.exe
  C:\Windows\System\jIiJUhC.exe
  2⤵
  PID:10596
- C:\Windows\System\qlVbipA.exe
  C:\Windows\System\qlVbipA.exe
  2⤵
  PID:10612
- C:\Windows\System\bvOHPKF.exe
  C:\Windows\System\bvOHPKF.exe
  2⤵
  PID:10628
- C:\Windows\System\HsladEP.exe
  C:\Windows\System\HsladEP.exe
  2⤵
  PID:10644
- C:\Windows\System\JArGKam.exe
  C:\Windows\System\JArGKam.exe
  2⤵
  PID:10660
- C:\Windows\System\AbgdDsL.exe
  C:\Windows\System\AbgdDsL.exe
  2⤵
  PID:10676
- C:\Windows\System\CnLoDDd.exe
  C:\Windows\System\CnLoDDd.exe
  2⤵
  PID:10696
- C:\Windows\System\OpDSpGp.exe
  C:\Windows\System\OpDSpGp.exe
  2⤵
  PID:10712
- C:\Windows\System\qjZGFGX.exe
  C:\Windows\System\qjZGFGX.exe
  2⤵
  PID:10728
- C:\Windows\System\VSIemuu.exe
  C:\Windows\System\VSIemuu.exe
  2⤵
  PID:10744
- C:\Windows\System\FgcuAWo.exe
  C:\Windows\System\FgcuAWo.exe
  2⤵
  PID:10760
- C:\Windows\System\FWFHvXc.exe
  C:\Windows\System\FWFHvXc.exe
  2⤵
  PID:10828
- C:\Windows\System\LIQYNaO.exe
  C:\Windows\System\LIQYNaO.exe
  2⤵
  PID:10844
- C:\Windows\System\zafsFZU.exe
  C:\Windows\System\zafsFZU.exe
  2⤵
  PID:10860
- C:\Windows\System\QVRisbr.exe
  C:\Windows\System\QVRisbr.exe
  2⤵
  PID:10876
- C:\Windows\System\KZpDxZZ.exe
  C:\Windows\System\KZpDxZZ.exe
  2⤵
  PID:10892
- C:\Windows\System\hoAnfmq.exe
  C:\Windows\System\hoAnfmq.exe
  2⤵
  PID:10908
- C:\Windows\System\XNDauHm.exe
  C:\Windows\System\XNDauHm.exe
  2⤵
  PID:10924
- C:\Windows\System\wBQUolQ.exe
  C:\Windows\System\wBQUolQ.exe
  2⤵
  PID:10948
- C:\Windows\System\LtZLDSM.exe
  C:\Windows\System\LtZLDSM.exe
  2⤵
  PID:10964
- C:\Windows\System\EEulStF.exe
  C:\Windows\System\EEulStF.exe
  2⤵
  PID:10984
- C:\Windows\System\JlWiMFI.exe
  C:\Windows\System\JlWiMFI.exe
  2⤵
  PID:11000
- C:\Windows\System\pNRQvXZ.exe
  C:\Windows\System\pNRQvXZ.exe
  2⤵
  PID:11016
- C:\Windows\System\yNeUQUg.exe
  C:\Windows\System\yNeUQUg.exe
  2⤵
  PID:11036
- C:\Windows\System\voCCTQS.exe
  C:\Windows\System\voCCTQS.exe
  2⤵
  PID:11052
- C:\Windows\System\YOlVNSF.exe
  C:\Windows\System\YOlVNSF.exe
  2⤵
  PID:11072
- C:\Windows\System\CZgjDgO.exe
  C:\Windows\System\CZgjDgO.exe
  2⤵
  PID:11128
- C:\Windows\System\bNKHdYh.exe
  C:\Windows\System\bNKHdYh.exe
  2⤵
  PID:11144
- C:\Windows\System\KlvYifQ.exe
  C:\Windows\System\KlvYifQ.exe
  2⤵
  PID:11164
- C:\Windows\System\tQMFGEK.exe
  C:\Windows\System\tQMFGEK.exe
  2⤵
  PID:11184
- C:\Windows\System\saXYdtq.exe
  C:\Windows\System\saXYdtq.exe
  2⤵
  PID:11204
- C:\Windows\System\tMFaJSF.exe
  C:\Windows\System\tMFaJSF.exe
  2⤵
  PID:11224
- C:\Windows\System\TMXDPSG.exe
  C:\Windows\System\TMXDPSG.exe
  2⤵
  PID:11240
- C:\Windows\System\WDRVKXb.exe
  C:\Windows\System\WDRVKXb.exe
  2⤵
  PID:11260
- C:\Windows\System\OSBgznR.exe
  C:\Windows\System\OSBgznR.exe
  2⤵
  PID:2984
- C:\Windows\System\uRIoTqq.exe
  C:\Windows\System\uRIoTqq.exe
  2⤵
  PID:3176
- C:\Windows\System\nvUjCKT.exe
  C:\Windows\System\nvUjCKT.exe
  2⤵
  PID:10328
- C:\Windows\System\hwXkdqX.exe
  C:\Windows\System\hwXkdqX.exe
  2⤵
  PID:10264
- C:\Windows\System\ATkgCSK.exe
  C:\Windows\System\ATkgCSK.exe
  2⤵
  PID:4008
- C:\Windows\System\mRNTJOe.exe
  C:\Windows\System\mRNTJOe.exe
  2⤵
  PID:6240
- C:\Windows\System\bopHlly.exe
  C:\Windows\System\bopHlly.exe
  2⤵
  PID:9800
- C:\Windows\System\AiNIOcA.exe
  C:\Windows\System\AiNIOcA.exe
  2⤵
  PID:10388
- C:\Windows\System\rrBVOad.exe
  C:\Windows\System\rrBVOad.exe
  2⤵
  PID:10412
- C:\Windows\System\auWgBeL.exe
  C:\Windows\System\auWgBeL.exe
  2⤵
  PID:10432
- C:\Windows\System\vrGebyI.exe
  C:\Windows\System\vrGebyI.exe
  2⤵
  PID:10468
- C:\Windows\System\ONtvyae.exe
  C:\Windows\System\ONtvyae.exe
  2⤵
  PID:10508
- C:\Windows\System\KJEfQAs.exe
  C:\Windows\System\KJEfQAs.exe
  2⤵
  PID:10532
- C:\Windows\System\BOuccwS.exe
  C:\Windows\System\BOuccwS.exe
  2⤵
  PID:10548
- C:\Windows\System\uePPxij.exe
  C:\Windows\System\uePPxij.exe
  2⤵
  PID:10640
- C:\Windows\System\UVYIZXJ.exe
  C:\Windows\System\UVYIZXJ.exe
  2⤵
  PID:10688
- C:\Windows\System\EpIyPbh.exe
  C:\Windows\System\EpIyPbh.exe
  2⤵
  PID:10668
- C:\Windows\System\QxSgQMs.exe
  C:\Windows\System\QxSgQMs.exe
  2⤵
  PID:10768
- C:\Windows\System\ZpoZGyy.exe
  C:\Windows\System\ZpoZGyy.exe
  2⤵
  PID:10776
- C:\Windows\System\ivwmqpn.exe
  C:\Windows\System\ivwmqpn.exe
  2⤵
  PID:10788
- C:\Windows\System\jbZjMwA.exe
  C:\Windows\System\jbZjMwA.exe
  2⤵
  PID:10804
- C:\Windows\System\nDHAiqL.exe
  C:\Windows\System\nDHAiqL.exe
  2⤵
  PID:10852
- C:\Windows\System\xPBPUII.exe
  C:\Windows\System\xPBPUII.exe
  2⤵
  PID:10872
- C:\Windows\System\CuTGoqL.exe
  C:\Windows\System\CuTGoqL.exe
  2⤵
  PID:10940
- C:\Windows\System\hzrlvUF.exe
  C:\Windows\System\hzrlvUF.exe
  2⤵
  PID:10960
- C:\Windows\System\tmftVkw.exe
  C:\Windows\System\tmftVkw.exe
  2⤵
  PID:11012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\JTqtKDl.exe

Filesize
3.4MB

MD5
598fdb7d4be8f5b064baa27b4c2068bd

SHA1
5f043f79276ba4a14af5049d2abf9963230072fd

SHA256
8f8a0e7be53761b0e4bafdc07236b8a692fcbceba2adb515a80bfe50cb01c37d

SHA512
c91675695e3a42f847459b2e3aa6dad9059eb976e58a417b28e2f6d58876b719d5b79a7301865436af109e561f33d08827c46cfeb2b1176fb31369971ebde5de

Download Submit
C:\Windows\system\McxYRDq.exe

Filesize
3.4MB

MD5
4ccb9c18c20a1db17ee738587798f114

SHA1
e5192787598bb123b63712dee89241896ef53ba4

SHA256
249733418937c1709775b9bf9af10fff78c4450832b063c86c5646eb01bcd522

SHA512
cf2acae25cebb42bd07a1b0a13fbc770875668acc42aa37c063ba15cb5913b9fd598ec2a1e8ebc5a7a7e93b3072f64e0a98581c257461ac5128ece3dcbb2393e

Download Submit
C:\Windows\system\MssgiqJ.exe

Filesize
3.4MB

MD5
2e08a8831ef24a84495364b23a2958d4

SHA1
018eb103ef263ad2631513bab3e672684540f26d

SHA256
db9e72cbe33ad310cfa09755041fcf007fc7c9f2f7ee9e5c09f2d424378554cd

SHA512
d566ce6e1e1a5f6ad501def5248873d9e9b00dce936ba3f1afc063b6669c73455bb98f5a5f57775b1d2c63874f2841417669c7e95642de46c6907b4f23f2e249

Download Submit
C:\Windows\system\OStvDMt.exe

Filesize
3.3MB

MD5
d01ea3f3a9f6592299570d5a922d16b5

SHA1
a8dd33e77484eff997d14ff021d387d6b7d2cd9c

SHA256
a97c3171403e1c234078fce68ed600a92ebf7d339961590a164b3a54f2474fe1

SHA512
45e17f092d099a0b56aa7fbfec79e3a6dc154aa443d600ccb42531a8d892b36b99c7d4720b6fe0d15346f97028fe50ba6669389ae96e2159fca4da628829d159

Download Submit
C:\Windows\system\RWZlFQU.exe

Filesize
3.3MB

MD5
a16ea19691126b4b057c333f59008942

SHA1
4d0ae59260bf09c2b6b3e081e58750401472c9d8

SHA256
27aeabadb29c2e83a18768dca6c19655d7e638a566fa7de46c7ad30248c53516

SHA512
365419d84fc005982cdc9055891166c05c366d949d47a93118b6ce81a6b7d893f0d70b413b8420fd279390beb58996cc0ff07b308e657fa41947282a9d00e0dc

Download Submit
C:\Windows\system\TGyZlwz.exe

Filesize
3.4MB

MD5
d753c95dbff0996f1b6653da0417c3d6

SHA1
ac1b9e44dfd64f2a1649bc9fa8d9243b4c4af90d

SHA256
641a867d4f66514a61619d0ef87b4bca8e4ccd07a67a03a29e38c4a1414e6391

SHA512
804997b3e637de8233e7abcb45d07d81c5bd672f7b2fd7cd72e3db0832187c6be3e23a137f59805b1361a1897abe62c77246934f365be317d3dc0478d2f05376

Download Submit
C:\Windows\system\UONqZGa.exe

Filesize
3.4MB

MD5
a874f07c04c4651265dbdd504db1c7b2

SHA1
29934927e2ab5ea256fa20d39bf98058d72cd572

SHA256
d08866b5905292a5b163bff61bae334d957c6dfac2c1294259b5d7ba9305f6ed

SHA512
ab3b85ea249c88443198bda16df65d1f83c012b5f37b1f2276fc6ca2ba957d3eac476a7232964de746bfd1d0c535ef3f35c7915b757b061ba01169f232b0eca1

Download Submit
C:\Windows\system\UbdQaOy.exe

Filesize
3.4MB

MD5
36f53c921862b8500e03593378d17ef1

SHA1
dfd924f625935e3963d2308e51ddcade0a03e022

SHA256
754addeae309fe04c3930ca9de480e6e3e014394c6bce9b8dc8bb23f06f88d67

SHA512
4893eb2781cc6cd04819ce5b915857834aba14d56ef82be3c4254338115b8a411ceb035f89eae53217775829a21c5d6eb65acce5cb1c5737d12e7299375509cf

Download Submit
C:\Windows\system\WXGCVfB.exe

Filesize
3.3MB

MD5
939ebe1a015056530995b80906141162

SHA1
a552d28f04712bbef3897744341a0a856c418423

SHA256
923b81d91cc67099b1f748f684f2acc757e450eff60c6ed6c61d14680e7e1294

SHA512
803d2468d4c8f4b54768f238b23119f3029d0224a0c07ceac6862ff1f73dc7ae60dd4b6266496c234c704ce194bcc0abe5634bb8e388d2b551d373c866db400a

Download Submit
C:\Windows\system\XLyKfai.exe

Filesize
3.4MB

MD5
f806a8ed1ac454d1b07e3e053f2e5baa

SHA1
ccc914391c2d22220008558aa0d9970e7bab1b97

SHA256
f480d621601dd723c27fb25c66f2eaa8908d2c7663db069ee424e35c6505962b

SHA512
5b52224f89fd8b0217c54a465605858eb08c6590e57ce562e03afa39b9abe5a454cfaa363f70b8ed5ce372cad9286a8ad72ea0bc6d2bc6be7c435cb16f51057a

Download Submit
C:\Windows\system\eEOQfso.exe

Filesize
3.4MB

MD5
4039c3197d266cd0ff71adcd53ce3177

SHA1
718fb7532be601a627a6ce2234f8430ec518cc26

SHA256
cd2df64aa3e6a5482ed279ae6b914f13a79b882656fc64a0ebb5df279cec3c39

SHA512
bab146444a4819d5b903b72a200d635d150844c06f00db47333ed9496af07b2fd19c375c82271182f22ccf463891347297c85470bb0ef89c8361347b6e8d656b

Download Submit
C:\Windows\system\eZuyTcJ.exe

Filesize
3.4MB

MD5
8ee88ef5b0a6eb96ea3262927b1498fd

SHA1
3719a7136b5439eb500eee4f8a53d1f5d0dd3192

SHA256
34547168cb8ada5daf8fa6e6db785aa455fc63f8dab1947196865ced6cf28dc5

SHA512
8b241eed869dbcfed6f05f3d84d06a42c3d813628984099868a3c57095fe54924e6617b69c5d607be35a08cd601ada4916587e0fde295702b4b865c69257b5fa

Download Submit
C:\Windows\system\fLoCfSJ.exe

Filesize
3.4MB

MD5
55ff1ad4fad9444182fe0594af6f604e

SHA1
ac34fa0de914c6e3f0ef26269069eaba7ebd1587

SHA256
e6513aa38c10bf8f62ba5fb816ee71733d2f3dc970cb5e66f4b855361d5d62eb

SHA512
e1064359c5c169f0939143b3f66ed4f0735bf8c5d892b28ca789738c3128713a729f093f675549ad021b0f01139be490ba4f7971174ddbe6c9ce39250f427448

Download Submit
C:\Windows\system\iigyOWo.exe

Filesize
3.3MB

MD5
c13a34618ab4196642433bc35151b588

SHA1
bed3f3d8289f1b03ed15e3d4f68c94e435fef689

SHA256
266c9920282cbf10a4732b813216666625efa2a7f973099ab2038a1ca4277bdd

SHA512
e2017ecdd8f43b521ecbbb986d8c90061569973376ed3614e9d56f49937bb50af5fd1441751db2345a019d0f5f82e420ed2e05f88b9301cc26d849912d181f4d

Download Submit
C:\Windows\system\mJAbxes.exe

Filesize
3.3MB

MD5
eea0fd75e57bb8218b71c5476fa2b50e

SHA1
d2d3ddf8b79fb273ee009422fdfb5e5e4792838a

SHA256
95bb5f2a079cf068c250a25e420d1f45783368fa49e1db16917c34a82af25e1d

SHA512
55aabfa9d775da36bc4f93683a35e37f9cc5f899253dbd86aee2943a14e244491593da5b67e9ce0c761cdd5c557db6c84e855a15058c168ad510ac2397a54581

Download Submit
C:\Windows\system\ncQmeoo.exe

Filesize
3.3MB

MD5
ed1794d7b53d919d2cc084504b424d18

SHA1
8b246669700bbeed62d4d9f9eaa6d850f1fe8f06

SHA256
f38846737a038a5927410943d4ea950c5cf4050cdb2a2fcd9ddaa211292080c7

SHA512
466becc4e797fb7ee0b92707541a8ed5582f935c1baae26303d6925934d7cef7166c7fc591985da5df6c768ac54f6f194438c6073319c303dfc6c5ecd7316f32

Download Submit
C:\Windows\system\nexYcjG.exe

Filesize
3.4MB

MD5
cda575d25357580f346cf63155658a48

SHA1
1984834953a8a841f285b2fa4b00d31d602d6f2d

SHA256
b64473eec9d6c8309db6f8268166abf3ae2462cc04b842fd3339a19ad4e15c89

SHA512
48076f17a37a14257e634312799f8dd413b18b0e7f68fb9e39debe5e57b65f92e43e09b96f8e24389790f8693f9e1ec6a53fd5fcc037396951c69b51fdd5568b

Download Submit
C:\Windows\system\nfvjnzy.exe

Filesize
3.3MB

MD5
3bd5273e23aafe8fdd88ce7133ab1ce1

SHA1
74744fb0166b2f7ad0b34d7732ba44ebc09b627b

SHA256
4f64945bc6d82b4c18a4509a56134442c7bf00b6000ae1aff8f570a3f8748121

SHA512
1cc0eec04446e0b5abb141b1ca2a26ec81214a8f31ed43cbf323a9e2c8bd2adaa1254cb4e0097ff556bac38572c4c9460cac8e8b4cce66559badfeb786765b7d

Download Submit
C:\Windows\system\peZIYSH.exe

Filesize
3.4MB

MD5
302e625faaa5c1492b4f2594afe5bb8d

SHA1
a9c167764b094f5b80ef387fafef43249196777a

SHA256
76c3d0d9f73f73cb355e0886b05f3d11a2b59a1a15585e9a8c79b2905f818b60

SHA512
31c5223a66a52f61064a33db60acdf1ea370de70e8e52217c9d87a59a2c6076dc6c52225cd6f52f54e5ca3bcac63730ff7bb563f11436eb5cb181330ac67ffef

Download Submit
C:\Windows\system\qfENeka.exe

Filesize
3.4MB

MD5
211baa97ef73f38f53674b782e9e01aa

SHA1
8e653eb078177310fce834bb97ca98cd49c9f814

SHA256
6fc3a3e05c5830a11e356b013957a441097cfc31b9fcdc37912d805fe598d429

SHA512
9c0f22d11fa2a240ad39aa3cffad7fbbb371c105bed62eff74f2bbcce764583f72cf083ea7680433f7a6e309f6a6c2d5710d5324f478632034b30d84d34a65b6

Download Submit
C:\Windows\system\vVDlkBF.exe

Filesize
3.3MB

MD5
602d0eba94027ebf1ac5790896945e2f

SHA1
5b659f3f4592ccd2111dbd5697e2c8046a877ab1

SHA256
f9658d21d00a13f467a5ca12b51f2419485201e05ad387765f10d219df5a6bf6

SHA512
ce48e4a8432ad38346c9e7b9748b71647d69a4bb0d55b5ea5c5a90670f3164240a92c1962c4a7ce6eb6590a150754cbeb9cbef586e7d42a9d848c55da6fe0955

Download Submit
C:\Windows\system\whUdhmp.exe

Filesize
3.3MB

MD5
b306069e5a5aa8d4652a5611f881362f

SHA1
0cf8ca3f74f52776aca07b35e6b64f578135328e

SHA256
9755dcc1e7894004d5fe3f2b66ce08df2e8203d2e14afb2b4a293637281f4100

SHA512
c9700f959ccc293e74c498ed3545e882cf76256ee70979a54c54abd5da78da666e6c42639434a171e255254116f36e405f55dde6416cf378b36428326ba6ec22

Download Submit
C:\Windows\system\wtzdDQy.exe

Filesize
3.4MB

MD5
9d2f9a5dcfe746db449efbc605faa9ca

SHA1
469579f5add2afe8f21a41bfa0dd8e3cde95d54e

SHA256
f26053450e61a6c78fa80e1a0b0c320d8081e89a0eaadcd74de68bdb523517ea

SHA512
c9cf6b04cdada55fe9848da1b715d92e38d2b09be470d7220647a7c19d65a0858f805632d2ec610570337fdff872763e83d86d59e28fe587973ad2e0ac721c09

Download Submit
\Windows\system\ClbTWAa.exe

Filesize
3.4MB

MD5
114f53956ceabab648519c2e44e797ca

SHA1
4a533693bdf4de4669b2b368a53c4ca1d8168b63

SHA256
a67654fdc298ab1820ac6db9f999f55858bca6c41fbe9dfb0023b993e57e3fda

SHA512
00b121eb6f7cffea32bbe773d69d36c78bc01377144119775a306ddc75f186378199f8abb6347c237283a4c79656a072ade8f82facac0ccc338b5cf325b948ac

Download Submit
\Windows\system\LHcrSrg.exe

Filesize
3.4MB

MD5
3c696d797f95faffbf18841b4f8efdfb

SHA1
6fad08024f3039af17bdca80315f59ef5d696608

SHA256
f3061438c94a17f3b8550d34c26c1ff63fc015c63ddb732ecffc5836b7acfa1f

SHA512
8cfbfce73aa62594391b3e00e027824c63ecb403e16b9010d2005f8610c0a5f3c94063e7907a559235e76f8f7f7b02a7a9db3d0740d1bef6382cc9c1fc3fb9e9

Download Submit
\Windows\system\ORPLfnL.exe

Filesize
3.4MB

MD5
b85f786af9d8a652e0c41fea66ab8cd9

SHA1
71382185d8c2d755f46bb546ba436aa5834b21f8

SHA256
90e274b96b8cd42cd71cb685b75f555ac963fdb071a0f43853bc52d7c6d5dc70

SHA512
2bb55f6b523d439fc6dfdea11e34d4c77792743032ac14346d31c19fddb5405bdb52e09ee9cce3385c364395250685606f504a1dd992e00f841656df38a1bd9d

Download Submit
\Windows\system\OmGqgPf.exe

Filesize
3.4MB

MD5
34abba89f6688edca804ab735852a382

SHA1
e5c4c09e803c74d010bd9b9f1283dff49215e68d

SHA256
ae481f5b4c3d0912aab6863dee24d1e511fbe1477f85ed552554c256fe702164

SHA512
e6bacfdd7008d22d918c4b1cb68fc1094292ef4618f712f83a2168c9d8866786557c7304c7fd15466d56e8e1cd4722238bbb71e4b53215c895f0f3580f249cff

Download Submit
\Windows\system\RGmyEZV.exe

Filesize
3.4MB

MD5
9b7a64190dd179dabc8c7393293ee3ce

SHA1
95ddb93e10fb50faed26f450662436eee5d03aa3

SHA256
bac3b4ce324a12ca726ccf54286c46ed5eb43f6cc2df0c161667e608bceaadd9

SHA512
9802453a4b89114e12e1014ea328418a41d7fe6408c798030101de39696f4acc317e15eee8030d77f033a14cd32fcef5d09b885fecfec2c4d38bbb4d1587bc4f

Download Submit
\Windows\system\SfpBiXu.exe

Filesize
3.3MB

MD5
457e170a1db1c76b3fa75c6f8a5e5c32

SHA1
5f1c2184eeb2a2fa43fea385ef14dcd0033e4067

SHA256
a601cfdd05805fc94f417576abb4d26a19b379f8ccb2c5defd48729871e713d3

SHA512
65d8d5812b561f6d06615ab6810e0f47f5e9f8f3ddd30e81369f704572ba1c4956fbcef7652f8c6ca2c299f569d33c22e9d83198d7523d07f5004ee7d51bb712

Download Submit
\Windows\system\VAgdhKI.exe

Filesize
3.4MB

MD5
366aa3074a451a67ba99b722c91de564

SHA1
69924c6bd2c3f8fbcd14a04a8b1b1ccbbc85d23e

SHA256
ea6c203d4d70d9f3547d34eeac92feb234f786347cd9846eb3c99325bc7e5a5c

SHA512
0359ebfa786d28cb6558026207b1aa188937c093d8b5c422529e3dfb4e0440b721d65bb5ef7311c6e81966dc1874eccfcc37a0b5885e6494b4747c1f6fe47fb4

Download Submit
\Windows\system\VaCUSZR.exe

Filesize
3.4MB

MD5
3bd65bad023efbcae2db52f2af395a13

SHA1
84fe3da6c66bb7a546057cca2998a9a6f8a8095e

SHA256
9cc0a57c82b7e3e923d480a20b7aa4e0a1086e4da21b04ee2d176ff0dc84cb41

SHA512
28dd29d2f9374888ed57281db7f1613c9a202bad347dd6bb95d3f85e00b18473229df822712c362ac99612aa05fab57b3dfcca19bd8c892cd8b4ab54836ee9cd

Download Submit
\Windows\system\blUSHEC.exe

Filesize
3.3MB

MD5
7be8557ffc850bf0755240048d159a50

SHA1
6fd98c0603c3266b87d389987a2de1fdd76cf528

SHA256
e82a5ba515e860177b2c11140a0311a13879ae88f54a34e87cd0b09b26903582

SHA512
fbbe03c74d461b4b74ff6de66a3787c7cf833a088ae8bb08d5cc42e49b121b076637850148a9495f0cf1ac2509c4db4d7c359e382affcc94b6d9e899ef2fb8f2

Download Submit
\Windows\system\bsyzoZp.exe

Filesize
3.4MB

MD5
539b57586a43f347d83838d2c0ceaa7f

SHA1
1bf714e72bdd8eb2f621514cd35c5a0a3e67264b

SHA256
b7265f1f7952e86c7147fe5c81ba41c288c00290e7a734621fa75d2b85cfa7f1

SHA512
295ce402adcf0881fcc7e4ee526e0360c7f75e1e441252632ebe4ba7941a02f3dc40e36cebbd03628fc447b06748c1b059da40c6c09d512128f911c8f2eee5e9

Download Submit
\Windows\system\egSEWJx.exe

Filesize
3.4MB

MD5
d968d77a600d86ab448fe425eff17e61

SHA1
d439b3752819c14d972f1594a2dc4249b0091d76

SHA256
c9cf6eaf5b7a34e8fd38c60a47633376d5ffe0ec6b4f529b77f279975ab80031

SHA512
97e8f160c26f49c7816a341a980cff2d762b7fab97c62e114780794b58fc64ac80418f9cc13211cba64ac22fe53583750d98e657c55a609616964cb7e3daab18

Download Submit
\Windows\system\kECjknf.exe

Filesize
3.4MB

MD5
d7acf92bf1c38a2dbca4f94e714f972c

SHA1
5a6f8cdd8bd53a0f6a9779d82180ddb46ab92a08

SHA256
886c5f165ef628cd3b356b54f494f45a41a493f3c2fd0d26a3ac77292679a343

SHA512
a2f54ec9439ff2955d031a2bf64d31dcfc41a10f0cc979bab1b71eea10abae8c5bd2010872da66e6534879b020bf07ea84bca4bf784f2f9164fd27083580963e

Download Submit
\Windows\system\sSVyTnM.exe

Filesize
3.3MB

MD5
52520596a1941031fae5834d43dcb50b

SHA1
0c436aaee9bfee0b93e9c39b3d298b8f94a005a0

SHA256
b1d93b9aef1a6988ceecc3b39e3731e7af424645b54dfcb308be00c634011794

SHA512
be51cfb3d0446530adccfba365fc2377f1f2c7a8cda70d4fbb6543d4236a943b0bc514c636c0d8bfade1491d3898bf43fd648de1902c884272c584fde50a03b3

Download Submit
\Windows\system\xQiLwgz.exe

Filesize
3.4MB

MD5
f3cf8baad32bf35f6ab00a166ff6aaeb

SHA1
ecdb2688f6d64c643084c014279ad71f247acab8

SHA256
ae2cc710cb290a352eb5207350d2cfe72a65e6632b2bd56595d550ceef83db58

SHA512
e13a1ee3d9c4cdf58992be372bec5fd4ffad42ae283a1fc5f505e319914fe31a4265fbb812ede2382ae2b9c9e523e43a3c9c7d1f0a4b2eae91645343593ced43

Download Submit
memory/1316-5730-0x000000013F410000-0x000000013F806000-memory.dmp

Filesize
4.0MB

Download
memory/1316-104-0x000000013F410000-0x000000013F806000-memory.dmp

Filesize
4.0MB

Download
memory/1360-112-0x000000013FC00000-0x000000013FFF6000-memory.dmp

Filesize
4.0MB

Download
memory/1360-5735-0x000000013FC00000-0x000000013FFF6000-memory.dmp

Filesize
4.0MB

Download
memory/2276-5741-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

Filesize
4.0MB

Download
memory/2276-114-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

Filesize
4.0MB

Download
memory/2364-1760-0x000007FEF50A0000-0x000007FEF5A3D000-memory.dmp

Filesize
9.6MB

Download
memory/2364-14-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2364-87-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/2364-86-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2364-115-0x000007FEF50A0000-0x000007FEF5A3D000-memory.dmp

Filesize
9.6MB

Download
memory/2364-93-0x000007FEF50A0000-0x000007FEF5A3D000-memory.dmp

Filesize
9.6MB

Download
memory/2364-15-0x000007FEF535E000-0x000007FEF535F000-memory.dmp

Filesize
4KB

Download
memory/2528-108-0x000000013F1C0000-0x000000013F5B6000-memory.dmp

Filesize
4.0MB

Download
memory/2528-5734-0x000000013F1C0000-0x000000013F5B6000-memory.dmp

Filesize
4.0MB

Download
memory/2588-5739-0x000000013FCF0000-0x00000001400E6000-memory.dmp

Filesize
4.0MB

Download
memory/2588-110-0x000000013FCF0000-0x00000001400E6000-memory.dmp

Filesize
4.0MB

Download
memory/2684-100-0x000000013F200000-0x000000013F5F6000-memory.dmp

Filesize
4.0MB

Download
memory/2684-5731-0x000000013F200000-0x000000013F5F6000-memory.dmp

Filesize
4.0MB

Download
memory/2692-5736-0x000000013FC20000-0x0000000140016000-memory.dmp

Filesize
4.0MB

Download
memory/2692-106-0x000000013FC20000-0x0000000140016000-memory.dmp

Filesize
4.0MB

Download
memory/2704-13-0x000000013F880000-0x000000013FC76000-memory.dmp

Filesize
4.0MB

Download
memory/2704-5729-0x000000013F880000-0x000000013FC76000-memory.dmp

Filesize
4.0MB

Download
memory/2732-102-0x000000013F1C0000-0x000000013F5B6000-memory.dmp

Filesize
4.0MB

Download
memory/2732-5737-0x000000013F1C0000-0x000000013F5B6000-memory.dmp

Filesize
4.0MB

Download
memory/2736-94-0x000000013F640000-0x000000013FA36000-memory.dmp

Filesize
4.0MB

Download
memory/2736-5727-0x000000013F640000-0x000000013FA36000-memory.dmp

Filesize
4.0MB

Download
memory/2800-96-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2952-4763-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2952-0-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download
memory/2952-101-0x000000013F1C0000-0x000000013F5B6000-memory.dmp

Filesize
4.0MB

Download
memory/2952-107-0x000000013F1C0000-0x000000013F5B6000-memory.dmp

Filesize
4.0MB

Download
memory/2952-103-0x000000013F410000-0x000000013F806000-memory.dmp

Filesize
4.0MB

Download
memory/2952-4225-0x0000000003060000-0x0000000003456000-memory.dmp

Filesize
4.0MB

Download
memory/2952-113-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

Filesize
4.0MB

Download
memory/2952-4773-0x0000000003060000-0x0000000003456000-memory.dmp

Filesize
4.0MB

Download
memory/2952-5168-0x0000000003060000-0x0000000003456000-memory.dmp

Filesize
4.0MB

Download
memory/2952-116-0x0000000003060000-0x0000000003456000-memory.dmp

Filesize
4.0MB

Download
memory/2952-111-0x0000000003060000-0x0000000003456000-memory.dmp

Filesize
4.0MB

Download
memory/2952-105-0x0000000003060000-0x0000000003456000-memory.dmp

Filesize
4.0MB

Download
memory/2952-109-0x0000000003060000-0x0000000003456000-memory.dmp

Filesize
4.0MB

Download
memory/2952-1-0x000000013F970000-0x000000013FD66000-memory.dmp

Filesize
4.0MB

Download
memory/2952-99-0x000000013F200000-0x000000013F5F6000-memory.dmp

Filesize
4.0MB

Download
memory/2952-95-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2952-97-0x000000013F3B0000-0x000000013F7A6000-memory.dmp

Filesize
4.0MB

Download
memory/2952-12-0x0000000003060000-0x0000000003456000-memory.dmp

Filesize
4.0MB

Download
memory/2964-98-0x000000013F3B0000-0x000000013F7A6000-memory.dmp

Filesize
4.0MB

Download
memory/2964-5732-0x000000013F3B0000-0x000000013F7A6000-memory.dmp

Filesize
4.0MB

Download