xmrig | 387cef2dcfc8a0d5083d9cd24a78f9ce204280f8eeb7a26b29d5f3b416f8400d

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
Size

3.2MB
MD5

bfb98b8d439c638a7e1aa903552bdec0
SHA1

0696f5956717dad9daa742bc3aa95737bd4c5983
SHA256

387cef2dcfc8a0d5083d9cd24a78f9ce204280f8eeb7a26b29d5f3b416f8400d
SHA512

b69d01c5b3555aed6ccdd97d1adae69fe7abe464c31ed6e7313a7579b170e911c5bee71eb390ec0486f38a254a79d2ebf09886a6d6f6908b8330ac406cb0e279
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWA:7bBeSFk8

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral1/memory/2180-0-0x000000013FA00000-0x000000013FDF6000-memory.dmp	xmrig
behavioral1/files/0x000d0000000122b8-6.dat	xmrig
behavioral1/files/0x0009000000014aec-8.dat	xmrig
behavioral1/files/0x0009000000014ec4-20.dat	xmrig
behavioral1/memory/2396-16-0x000000013FF30000-0x0000000140326000-memory.dmp	xmrig
behavioral1/files/0x000f0000000006fd-25.dat	xmrig
behavioral1/files/0x00070000000155d4-42.dat	xmrig
behavioral1/files/0x0006000000016cf0-45.dat	xmrig
behavioral1/files/0x0006000000016d11-57.dat	xmrig
behavioral1/files/0x0006000000016d4a-78.dat	xmrig
behavioral1/files/0x0006000000016d84-92.dat	xmrig
behavioral1/files/0x0006000000016e56-102.dat	xmrig
behavioral1/files/0x000500000001868c-117.dat	xmrig
behavioral1/files/0x0006000000018b37-151.dat	xmrig
behavioral1/files/0x0006000000018ae8-148.dat	xmrig
behavioral1/files/0x0006000000018b6a-169.dat	xmrig
behavioral1/files/0x0006000000018b42-159.dat	xmrig
behavioral1/memory/2656-197-0x000000013F200000-0x000000013F5F6000-memory.dmp	xmrig
behavioral1/memory/1008-202-0x000000013F300000-0x000000013F6F6000-memory.dmp	xmrig
behavioral1/memory/2420-201-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/memory/2560-199-0x000000013FA00000-0x000000013FDF6000-memory.dmp	xmrig
behavioral1/memory/2180-196-0x000000013F200000-0x000000013F5F6000-memory.dmp	xmrig
behavioral1/memory/2564-195-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/memory/2900-193-0x000000013F370000-0x000000013F766000-memory.dmp	xmrig
behavioral1/memory/2496-191-0x000000013F920000-0x000000013FD16000-memory.dmp	xmrig
behavioral1/memory/1360-189-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/memory/2824-187-0x000000013F620000-0x000000013FA16000-memory.dmp	xmrig
behavioral1/memory/3012-185-0x000000013FCD0000-0x00000001400C6000-memory.dmp	xmrig
behavioral1/memory/2816-183-0x000000013F770000-0x000000013FB66000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b4a-164.dat	xmrig
behavioral1/files/0x0006000000018b33-145.dat	xmrig
behavioral1/files/0x00050000000186a0-127.dat	xmrig
behavioral1/files/0x0006000000018b15-142.dat	xmrig
behavioral1/files/0x0006000000018ae2-132.dat	xmrig
behavioral1/files/0x0005000000018698-122.dat	xmrig
behavioral1/files/0x0006000000017090-112.dat	xmrig
behavioral1/files/0x000600000001704f-107.dat	xmrig
behavioral1/files/0x0006000000016d89-97.dat	xmrig
behavioral1/files/0x0006000000016d55-87.dat	xmrig
behavioral1/files/0x0006000000016d4f-82.dat	xmrig
behavioral1/files/0x0006000000016d41-72.dat	xmrig
behavioral1/files/0x0006000000016d36-67.dat	xmrig
behavioral1/files/0x0006000000016d24-62.dat	xmrig
behavioral1/files/0x0006000000016d01-52.dat	xmrig
behavioral1/files/0x0007000000015364-37.dat	xmrig
behavioral1/files/0x0008000000015264-33.dat	xmrig
behavioral1/memory/2180-1947-0x000000013FA00000-0x000000013FDF6000-memory.dmp	xmrig
behavioral1/memory/2396-2369-0x000000013FF30000-0x0000000140326000-memory.dmp	xmrig
behavioral1/memory/1008-2370-0x000000013F300000-0x000000013F6F6000-memory.dmp	xmrig
behavioral1/memory/2816-2371-0x000000013F770000-0x000000013FB66000-memory.dmp	xmrig
behavioral1/memory/1360-2375-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/memory/2496-2380-0x000000013F920000-0x000000013FD16000-memory.dmp	xmrig
behavioral1/memory/2656-2426-0x000000013F200000-0x000000013F5F6000-memory.dmp	xmrig
behavioral1/memory/2560-2402-0x000000013FA00000-0x000000013FDF6000-memory.dmp	xmrig
behavioral1/memory/2564-2393-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/memory/2420-2408-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/memory/2900-2381-0x000000013F370000-0x000000013F766000-memory.dmp	xmrig
behavioral1/memory/2824-2374-0x000000013F620000-0x000000013FA16000-memory.dmp	xmrig
behavioral1/memory/3012-2372-0x000000013FCD0000-0x00000001400C6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
324	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2396	DuHKriI.exe
1008	gSYZLTx.exe
2816	HRUZgBB.exe
3012	BKIwGGS.exe
2824	bWyjcoe.exe
1360	AaUGCZq.exe
2496	XwlNmlW.exe
2900	PHADMFB.exe
2564	YYsBvez.exe
2656	mejVaCu.exe
2560	AOUsnRi.exe
2420	IbAFRZB.exe
2684	nFDqfsK.exe
2596	HHIQzmG.exe
2584	bBxEXul.exe
2476	zBXOVAj.exe
2424	lYYRDit.exe
2492	oLpJVPk.exe
2964	hLDBxGq.exe
1704	bOisElY.exe
1260	hkhSnvv.exe
2208	WcjJcoe.exe
844	zfbbixo.exe
2372	PxwOSNU.exe
1216	VkVVbbT.exe
1976	HInewvm.exe
1064	WTHmJHk.exe
1756	EeYZnzi.exe
924	tuLFUvY.exe
1340	bJABsTt.exe
1660	cOfghWO.exe
2160	lXTPLWV.exe
1424	kzMeXzd.exe
2368	UAgUTyI.exe
632	NdegRIz.exe
440	oKKhcrP.exe
1232	irDBhEs.exe
1796	MdMVpqG.exe
2700	hVHyLMf.exe
2112	tYmcdbt.exe
1304	BgoRUBU.exe
1768	XRrYmUB.exe
2004	OTetZlM.exe
1748	qumRGDP.exe
2484	MsIfZiL.exe
1288	CLaVyGx.exe
1984	DInwPsA.exe
3032	yLrXNUp.exe
592	QtTSPzX.exe
284	sASdziV.exe
2744	baLVgUD.exe
2736	vQxXKPf.exe
1108	abngLDj.exe
588	kHAtHsS.exe
3004	kvaUEqS.exe
2556	tyODcYI.exe
2572	PUgfCiq.exe
2440	HBRmeAr.exe
2416	ZwZZada.exe
2576	FzFxtBc.exe
2588	MtQTYNJ.exe
2456	tXHGXdJ.exe
2196	nkyyiQB.exe
2260	DrfQZIC.exe

Loads dropped DLL 64 IoCs

pid	Process
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-0-0x000000013FA00000-0x000000013FDF6000-memory.dmp	upx
behavioral1/files/0x000d0000000122b8-6.dat	upx
behavioral1/files/0x0009000000014aec-8.dat	upx
behavioral1/files/0x0009000000014ec4-20.dat	upx
behavioral1/memory/2396-16-0x000000013FF30000-0x0000000140326000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-25.dat	upx
behavioral1/files/0x00070000000155d4-42.dat	upx
behavioral1/files/0x0006000000016cf0-45.dat	upx
behavioral1/files/0x0006000000016d11-57.dat	upx
behavioral1/files/0x0006000000016d4a-78.dat	upx
behavioral1/files/0x0006000000016d84-92.dat	upx
behavioral1/files/0x0006000000016e56-102.dat	upx
behavioral1/files/0x000500000001868c-117.dat	upx
behavioral1/files/0x0006000000018b37-151.dat	upx
behavioral1/files/0x0006000000018ae8-148.dat	upx
behavioral1/files/0x0006000000018b6a-169.dat	upx
behavioral1/files/0x0006000000018b42-159.dat	upx
behavioral1/memory/2656-197-0x000000013F200000-0x000000013F5F6000-memory.dmp	upx
behavioral1/memory/1008-202-0x000000013F300000-0x000000013F6F6000-memory.dmp	upx
behavioral1/memory/2420-201-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/memory/2560-199-0x000000013FA00000-0x000000013FDF6000-memory.dmp	upx
behavioral1/memory/2564-195-0x000000013FD00000-0x00000001400F6000-memory.dmp	upx
behavioral1/memory/2900-193-0x000000013F370000-0x000000013F766000-memory.dmp	upx
behavioral1/memory/2496-191-0x000000013F920000-0x000000013FD16000-memory.dmp	upx
behavioral1/memory/1360-189-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/memory/2824-187-0x000000013F620000-0x000000013FA16000-memory.dmp	upx
behavioral1/memory/3012-185-0x000000013FCD0000-0x00000001400C6000-memory.dmp	upx
behavioral1/memory/2816-183-0x000000013F770000-0x000000013FB66000-memory.dmp	upx
behavioral1/files/0x0006000000018b4a-164.dat	upx
behavioral1/files/0x0006000000018b33-145.dat	upx
behavioral1/files/0x00050000000186a0-127.dat	upx
behavioral1/files/0x0006000000018b15-142.dat	upx
behavioral1/files/0x0006000000018ae2-132.dat	upx
behavioral1/files/0x0005000000018698-122.dat	upx
behavioral1/files/0x0006000000017090-112.dat	upx
behavioral1/files/0x000600000001704f-107.dat	upx
behavioral1/files/0x0006000000016d89-97.dat	upx
behavioral1/files/0x0006000000016d55-87.dat	upx
behavioral1/files/0x0006000000016d4f-82.dat	upx
behavioral1/files/0x0006000000016d41-72.dat	upx
behavioral1/files/0x0006000000016d36-67.dat	upx
behavioral1/files/0x0006000000016d24-62.dat	upx
behavioral1/files/0x0006000000016d01-52.dat	upx
behavioral1/files/0x0007000000015364-37.dat	upx
behavioral1/files/0x0008000000015264-33.dat	upx
behavioral1/memory/2180-1947-0x000000013FA00000-0x000000013FDF6000-memory.dmp	upx
behavioral1/memory/2396-2369-0x000000013FF30000-0x0000000140326000-memory.dmp	upx
behavioral1/memory/1008-2370-0x000000013F300000-0x000000013F6F6000-memory.dmp	upx
behavioral1/memory/2816-2371-0x000000013F770000-0x000000013FB66000-memory.dmp	upx
behavioral1/memory/1360-2375-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/memory/2496-2380-0x000000013F920000-0x000000013FD16000-memory.dmp	upx
behavioral1/memory/2656-2426-0x000000013F200000-0x000000013F5F6000-memory.dmp	upx
behavioral1/memory/2560-2402-0x000000013FA00000-0x000000013FDF6000-memory.dmp	upx
behavioral1/memory/2564-2393-0x000000013FD00000-0x00000001400F6000-memory.dmp	upx
behavioral1/memory/2420-2408-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/memory/2900-2381-0x000000013F370000-0x000000013F766000-memory.dmp	upx
behavioral1/memory/2824-2374-0x000000013F620000-0x000000013FA16000-memory.dmp	upx
behavioral1/memory/3012-2372-0x000000013FCD0000-0x00000001400C6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TynIGkr.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\CZZbxse.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\qCDmZcc.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\oLpJVPk.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\OZgDHHU.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\sPcoSTF.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\CUBVFvx.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\fXudfnp.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\tqifEZr.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\GvtaewS.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\ZXAiUVf.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\VBeSTwO.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\OyXwPqf.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\wFgtVQI.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\xWeqaPu.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\kMkvAmS.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\sASdziV.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\tyODcYI.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\abYRBAs.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\taMjIdP.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\VSrmEXc.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\WcIgaja.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\pVExxTM.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\ieVrZQF.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\XZtZoGq.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\pMWTKsm.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\EVLITnS.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\klHFCXo.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\NrYfkoe.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\lYYRDit.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\hVHyLMf.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\yLrXNUp.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\wJDvPjL.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\VsPXaqC.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\hIEPavl.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\zBXOVAj.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\IklGIfg.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\hnXFBTK.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\WDtokOZ.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\RdaRNAe.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\dSyfWgj.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\NLSXQrI.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\gKnEgro.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\IYtBseV.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\JggMppn.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\ldTkLBn.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\EeVzjxS.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\DinlGJq.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\SvtdkrI.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\iLASmKL.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\RrIAVSf.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\BSNNzfl.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\YCRKmbr.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\TBjifxk.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\HJVmUlR.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\VlZRKMD.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\iAhyWFe.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\YbJfPbS.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\AmklYeO.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\luHfYEu.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\TzwUYtO.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\gNOOffa.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\DlcfNiT.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\hqZXXSe.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
324	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
Token: SeDebugPrivilege	324	powershell.exe
Token: SeLockMemoryPrivilege	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 324	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 324	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 324	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2396	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	30
PID 2180 wrote to memory of 2396	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	30
PID 2180 wrote to memory of 2396	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	30
PID 2180 wrote to memory of 1008	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	31
PID 2180 wrote to memory of 1008	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	31
PID 2180 wrote to memory of 1008	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	31
PID 2180 wrote to memory of 2816	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	32
PID 2180 wrote to memory of 2816	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	32
PID 2180 wrote to memory of 2816	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	32
PID 2180 wrote to memory of 3012	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	33
PID 2180 wrote to memory of 3012	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	33
PID 2180 wrote to memory of 3012	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	33
PID 2180 wrote to memory of 2824	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	34
PID 2180 wrote to memory of 2824	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	34
PID 2180 wrote to memory of 2824	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	34
PID 2180 wrote to memory of 1360	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	35
PID 2180 wrote to memory of 1360	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	35
PID 2180 wrote to memory of 1360	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	35
PID 2180 wrote to memory of 2496	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	36
PID 2180 wrote to memory of 2496	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	36
PID 2180 wrote to memory of 2496	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	36
PID 2180 wrote to memory of 2900	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	37
PID 2180 wrote to memory of 2900	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	37
PID 2180 wrote to memory of 2900	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	37
PID 2180 wrote to memory of 2564	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	38
PID 2180 wrote to memory of 2564	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	38
PID 2180 wrote to memory of 2564	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	38
PID 2180 wrote to memory of 2656	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	39
PID 2180 wrote to memory of 2656	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	39
PID 2180 wrote to memory of 2656	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	39
PID 2180 wrote to memory of 2560	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	40
PID 2180 wrote to memory of 2560	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	40
PID 2180 wrote to memory of 2560	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	40
PID 2180 wrote to memory of 2420	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	41
PID 2180 wrote to memory of 2420	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	41
PID 2180 wrote to memory of 2420	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	41
PID 2180 wrote to memory of 2684	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	42
PID 2180 wrote to memory of 2684	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	42
PID 2180 wrote to memory of 2684	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	42
PID 2180 wrote to memory of 2596	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	43
PID 2180 wrote to memory of 2596	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	43
PID 2180 wrote to memory of 2596	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	43
PID 2180 wrote to memory of 2584	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	44
PID 2180 wrote to memory of 2584	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	44
PID 2180 wrote to memory of 2584	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	44
PID 2180 wrote to memory of 2476	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	45
PID 2180 wrote to memory of 2476	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	45
PID 2180 wrote to memory of 2476	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	45
PID 2180 wrote to memory of 2424	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	46
PID 2180 wrote to memory of 2424	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	46
PID 2180 wrote to memory of 2424	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	46
PID 2180 wrote to memory of 2492	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	47
PID 2180 wrote to memory of 2492	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	47
PID 2180 wrote to memory of 2492	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	47
PID 2180 wrote to memory of 2964	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	48
PID 2180 wrote to memory of 2964	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	48
PID 2180 wrote to memory of 2964	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	48
PID 2180 wrote to memory of 1704	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	49
PID 2180 wrote to memory of 1704	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	49
PID 2180 wrote to memory of 1704	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	49
PID 2180 wrote to memory of 1260	2180	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:324
- C:\Windows\System\DuHKriI.exe
  C:\Windows\System\DuHKriI.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\gSYZLTx.exe
  C:\Windows\System\gSYZLTx.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\HRUZgBB.exe
  C:\Windows\System\HRUZgBB.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\BKIwGGS.exe
  C:\Windows\System\BKIwGGS.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\bWyjcoe.exe
  C:\Windows\System\bWyjcoe.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\AaUGCZq.exe
  C:\Windows\System\AaUGCZq.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\XwlNmlW.exe
  C:\Windows\System\XwlNmlW.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\PHADMFB.exe
  C:\Windows\System\PHADMFB.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\YYsBvez.exe
  C:\Windows\System\YYsBvez.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\mejVaCu.exe
  C:\Windows\System\mejVaCu.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\AOUsnRi.exe
  C:\Windows\System\AOUsnRi.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\IbAFRZB.exe
  C:\Windows\System\IbAFRZB.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\nFDqfsK.exe
  C:\Windows\System\nFDqfsK.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\HHIQzmG.exe
  C:\Windows\System\HHIQzmG.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\bBxEXul.exe
  C:\Windows\System\bBxEXul.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\zBXOVAj.exe
  C:\Windows\System\zBXOVAj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\lYYRDit.exe
  C:\Windows\System\lYYRDit.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\oLpJVPk.exe
  C:\Windows\System\oLpJVPk.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\hLDBxGq.exe
  C:\Windows\System\hLDBxGq.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\bOisElY.exe
  C:\Windows\System\bOisElY.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\hkhSnvv.exe
  C:\Windows\System\hkhSnvv.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\WcjJcoe.exe
  C:\Windows\System\WcjJcoe.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\zfbbixo.exe
  C:\Windows\System\zfbbixo.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\PxwOSNU.exe
  C:\Windows\System\PxwOSNU.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\VkVVbbT.exe
  C:\Windows\System\VkVVbbT.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\WTHmJHk.exe
  C:\Windows\System\WTHmJHk.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\HInewvm.exe
  C:\Windows\System\HInewvm.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\tuLFUvY.exe
  C:\Windows\System\tuLFUvY.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\EeYZnzi.exe
  C:\Windows\System\EeYZnzi.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\bJABsTt.exe
  C:\Windows\System\bJABsTt.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\cOfghWO.exe
  C:\Windows\System\cOfghWO.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\lXTPLWV.exe
  C:\Windows\System\lXTPLWV.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\kzMeXzd.exe
  C:\Windows\System\kzMeXzd.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\UAgUTyI.exe
  C:\Windows\System\UAgUTyI.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\NdegRIz.exe
  C:\Windows\System\NdegRIz.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\oKKhcrP.exe
  C:\Windows\System\oKKhcrP.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\irDBhEs.exe
  C:\Windows\System\irDBhEs.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\MdMVpqG.exe
  C:\Windows\System\MdMVpqG.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\hVHyLMf.exe
  C:\Windows\System\hVHyLMf.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\tYmcdbt.exe
  C:\Windows\System\tYmcdbt.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\BgoRUBU.exe
  C:\Windows\System\BgoRUBU.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\XRrYmUB.exe
  C:\Windows\System\XRrYmUB.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\OTetZlM.exe
  C:\Windows\System\OTetZlM.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\qumRGDP.exe
  C:\Windows\System\qumRGDP.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\MsIfZiL.exe
  C:\Windows\System\MsIfZiL.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\CLaVyGx.exe
  C:\Windows\System\CLaVyGx.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\DInwPsA.exe
  C:\Windows\System\DInwPsA.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\yLrXNUp.exe
  C:\Windows\System\yLrXNUp.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\QtTSPzX.exe
  C:\Windows\System\QtTSPzX.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\vQxXKPf.exe
  C:\Windows\System\vQxXKPf.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\sASdziV.exe
  C:\Windows\System\sASdziV.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\abngLDj.exe
  C:\Windows\System\abngLDj.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\baLVgUD.exe
  C:\Windows\System\baLVgUD.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\kHAtHsS.exe
  C:\Windows\System\kHAtHsS.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\kvaUEqS.exe
  C:\Windows\System\kvaUEqS.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\tyODcYI.exe
  C:\Windows\System\tyODcYI.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\PUgfCiq.exe
  C:\Windows\System\PUgfCiq.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\FzFxtBc.exe
  C:\Windows\System\FzFxtBc.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\HBRmeAr.exe
  C:\Windows\System\HBRmeAr.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\MtQTYNJ.exe
  C:\Windows\System\MtQTYNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ZwZZada.exe
  C:\Windows\System\ZwZZada.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\tXHGXdJ.exe
  C:\Windows\System\tXHGXdJ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\nkyyiQB.exe
  C:\Windows\System\nkyyiQB.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\DrfQZIC.exe
  C:\Windows\System\DrfQZIC.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\CRYlsBT.exe
  C:\Windows\System\CRYlsBT.exe
  2⤵
  PID:1496
- C:\Windows\System\YbJfPbS.exe
  C:\Windows\System\YbJfPbS.exe
  2⤵
  PID:2192
- C:\Windows\System\NKiWEEM.exe
  C:\Windows\System\NKiWEEM.exe
  2⤵
  PID:1764
- C:\Windows\System\GTAaDZC.exe
  C:\Windows\System\GTAaDZC.exe
  2⤵
  PID:1096
- C:\Windows\System\IklGIfg.exe
  C:\Windows\System\IklGIfg.exe
  2⤵
  PID:2940
- C:\Windows\System\lljDgbX.exe
  C:\Windows\System\lljDgbX.exe
  2⤵
  PID:2288
- C:\Windows\System\geaiJHR.exe
  C:\Windows\System\geaiJHR.exe
  2⤵
  PID:2316
- C:\Windows\System\GfkQotr.exe
  C:\Windows\System\GfkQotr.exe
  2⤵
  PID:2448
- C:\Windows\System\JavCLRb.exe
  C:\Windows\System\JavCLRb.exe
  2⤵
  PID:1204
- C:\Windows\System\ZaxHCfk.exe
  C:\Windows\System\ZaxHCfk.exe
  2⤵
  PID:1616
- C:\Windows\System\oQqUqZt.exe
  C:\Windows\System\oQqUqZt.exe
  2⤵
  PID:2432
- C:\Windows\System\KxFkYxZ.exe
  C:\Windows\System\KxFkYxZ.exe
  2⤵
  PID:3060
- C:\Windows\System\ajmLSob.exe
  C:\Windows\System\ajmLSob.exe
  2⤵
  PID:1132
- C:\Windows\System\wJDvPjL.exe
  C:\Windows\System\wJDvPjL.exe
  2⤵
  PID:2068
- C:\Windows\System\HFmyLVj.exe
  C:\Windows\System\HFmyLVj.exe
  2⤵
  PID:1676
- C:\Windows\System\fIlInvD.exe
  C:\Windows\System\fIlInvD.exe
  2⤵
  PID:2340
- C:\Windows\System\PcioirL.exe
  C:\Windows\System\PcioirL.exe
  2⤵
  PID:1296
- C:\Windows\System\GBtclGn.exe
  C:\Windows\System\GBtclGn.exe
  2⤵
  PID:1876
- C:\Windows\System\XctyHdN.exe
  C:\Windows\System\XctyHdN.exe
  2⤵
  PID:900
- C:\Windows\System\abYRBAs.exe
  C:\Windows\System\abYRBAs.exe
  2⤵
  PID:2044
- C:\Windows\System\UDeZqXB.exe
  C:\Windows\System\UDeZqXB.exe
  2⤵
  PID:2128
- C:\Windows\System\WkWHsEJ.exe
  C:\Windows\System\WkWHsEJ.exe
  2⤵
  PID:2680
- C:\Windows\System\UEFdUGS.exe
  C:\Windows\System\UEFdUGS.exe
  2⤵
  PID:2188
- C:\Windows\System\kHOticU.exe
  C:\Windows\System\kHOticU.exe
  2⤵
  PID:1668
- C:\Windows\System\eolUiNW.exe
  C:\Windows\System\eolUiNW.exe
  2⤵
  PID:2040
- C:\Windows\System\UyQObQk.exe
  C:\Windows\System\UyQObQk.exe
  2⤵
  PID:2276
- C:\Windows\System\udpUJTL.exe
  C:\Windows\System\udpUJTL.exe
  2⤵
  PID:768
- C:\Windows\System\IeFCSmU.exe
  C:\Windows\System\IeFCSmU.exe
  2⤵
  PID:1060
- C:\Windows\System\kaODSVE.exe
  C:\Windows\System\kaODSVE.exe
  2⤵
  PID:2028
- C:\Windows\System\hJUqHbd.exe
  C:\Windows\System\hJUqHbd.exe
  2⤵
  PID:1336
- C:\Windows\System\FLMnPHm.exe
  C:\Windows\System\FLMnPHm.exe
  2⤵
  PID:876
- C:\Windows\System\hnXFBTK.exe
  C:\Windows\System\hnXFBTK.exe
  2⤵
  PID:1140
- C:\Windows\System\TynIGkr.exe
  C:\Windows\System\TynIGkr.exe
  2⤵
  PID:1776
- C:\Windows\System\WmUNOKR.exe
  C:\Windows\System\WmUNOKR.exe
  2⤵
  PID:1520
- C:\Windows\System\lDbJfOi.exe
  C:\Windows\System\lDbJfOi.exe
  2⤵
  PID:2604
- C:\Windows\System\TYoTvoK.exe
  C:\Windows\System\TYoTvoK.exe
  2⤵
  PID:2236
- C:\Windows\System\nMMTdAY.exe
  C:\Windows\System\nMMTdAY.exe
  2⤵
  PID:1588
- C:\Windows\System\xtseJKO.exe
  C:\Windows\System\xtseJKO.exe
  2⤵
  PID:364
- C:\Windows\System\BfTAaSj.exe
  C:\Windows\System\BfTAaSj.exe
  2⤵
  PID:2812
- C:\Windows\System\KFNhteL.exe
  C:\Windows\System\KFNhteL.exe
  2⤵
  PID:2872
- C:\Windows\System\khfkYrt.exe
  C:\Windows\System\khfkYrt.exe
  2⤵
  PID:2888
- C:\Windows\System\GdKMvhQ.exe
  C:\Windows\System\GdKMvhQ.exe
  2⤵
  PID:2508
- C:\Windows\System\KpdjauV.exe
  C:\Windows\System\KpdjauV.exe
  2⤵
  PID:2548
- C:\Windows\System\wjOVqec.exe
  C:\Windows\System\wjOVqec.exe
  2⤵
  PID:2480
- C:\Windows\System\tfKwOEP.exe
  C:\Windows\System\tfKwOEP.exe
  2⤵
  PID:2524
- C:\Windows\System\iLASmKL.exe
  C:\Windows\System\iLASmKL.exe
  2⤵
  PID:2280
- C:\Windows\System\dNJVRSJ.exe
  C:\Windows\System\dNJVRSJ.exe
  2⤵
  PID:1952
- C:\Windows\System\tqifEZr.exe
  C:\Windows\System\tqifEZr.exe
  2⤵
  PID:1960
- C:\Windows\System\vClYkiD.exe
  C:\Windows\System\vClYkiD.exe
  2⤵
  PID:2308
- C:\Windows\System\ghgempM.exe
  C:\Windows\System\ghgempM.exe
  2⤵
  PID:1448
- C:\Windows\System\QefeRsD.exe
  C:\Windows\System\QefeRsD.exe
  2⤵
  PID:1164
- C:\Windows\System\qVaQCXR.exe
  C:\Windows\System\qVaQCXR.exe
  2⤵
  PID:2652
- C:\Windows\System\SdcXwxP.exe
  C:\Windows\System\SdcXwxP.exe
  2⤵
  PID:280
- C:\Windows\System\FwUjZyI.exe
  C:\Windows\System\FwUjZyI.exe
  2⤵
  PID:2580
- C:\Windows\System\ZSzHWLV.exe
  C:\Windows\System\ZSzHWLV.exe
  2⤵
  PID:2240
- C:\Windows\System\FdrKgBD.exe
  C:\Windows\System\FdrKgBD.exe
  2⤵
  PID:824
- C:\Windows\System\fnQURXO.exe
  C:\Windows\System\fnQURXO.exe
  2⤵
  PID:2020
- C:\Windows\System\buLnkWZ.exe
  C:\Windows\System\buLnkWZ.exe
  2⤵
  PID:2820
- C:\Windows\System\jmXDoUN.exe
  C:\Windows\System\jmXDoUN.exe
  2⤵
  PID:2752
- C:\Windows\System\qJxRScJ.exe
  C:\Windows\System\qJxRScJ.exe
  2⤵
  PID:1264
- C:\Windows\System\ACGPcOA.exe
  C:\Windows\System\ACGPcOA.exe
  2⤵
  PID:2828
- C:\Windows\System\aSHVLxW.exe
  C:\Windows\System\aSHVLxW.exe
  2⤵
  PID:1964
- C:\Windows\System\lCYjGbl.exe
  C:\Windows\System\lCYjGbl.exe
  2⤵
  PID:948
- C:\Windows\System\IekRHew.exe
  C:\Windows\System\IekRHew.exe
  2⤵
  PID:796
- C:\Windows\System\HplWRAI.exe
  C:\Windows\System\HplWRAI.exe
  2⤵
  PID:880
- C:\Windows\System\RrIAVSf.exe
  C:\Windows\System\RrIAVSf.exe
  2⤵
  PID:2344
- C:\Windows\System\LiFViRP.exe
  C:\Windows\System\LiFViRP.exe
  2⤵
  PID:1516
- C:\Windows\System\eKSvtvL.exe
  C:\Windows\System\eKSvtvL.exe
  2⤵
  PID:1324
- C:\Windows\System\WBqGCAe.exe
  C:\Windows\System\WBqGCAe.exe
  2⤵
  PID:1580
- C:\Windows\System\kWUMfBK.exe
  C:\Windows\System\kWUMfBK.exe
  2⤵
  PID:1724
- C:\Windows\System\krGxsgq.exe
  C:\Windows\System\krGxsgq.exe
  2⤵
  PID:968
- C:\Windows\System\BSNNzfl.exe
  C:\Windows\System\BSNNzfl.exe
  2⤵
  PID:2748
- C:\Windows\System\PRSWfTA.exe
  C:\Windows\System\PRSWfTA.exe
  2⤵
  PID:2436
- C:\Windows\System\hyhGpxd.exe
  C:\Windows\System\hyhGpxd.exe
  2⤵
  PID:2256
- C:\Windows\System\wCFVcLI.exe
  C:\Windows\System\wCFVcLI.exe
  2⤵
  PID:2460
- C:\Windows\System\zBFFXIm.exe
  C:\Windows\System\zBFFXIm.exe
  2⤵
  PID:2500
- C:\Windows\System\hBvlmmL.exe
  C:\Windows\System\hBvlmmL.exe
  2⤵
  PID:1628
- C:\Windows\System\cwVSPbB.exe
  C:\Windows\System\cwVSPbB.exe
  2⤵
  PID:552
- C:\Windows\System\GvtaewS.exe
  C:\Windows\System\GvtaewS.exe
  2⤵
  PID:1656
- C:\Windows\System\aGRLPNH.exe
  C:\Windows\System\aGRLPNH.exe
  2⤵
  PID:1600
- C:\Windows\System\MmieFQm.exe
  C:\Windows\System\MmieFQm.exe
  2⤵
  PID:2388
- C:\Windows\System\NLSXQrI.exe
  C:\Windows\System\NLSXQrI.exe
  2⤵
  PID:3052
- C:\Windows\System\NEEngea.exe
  C:\Windows\System\NEEngea.exe
  2⤵
  PID:2636
- C:\Windows\System\LNdAmWN.exe
  C:\Windows\System\LNdAmWN.exe
  2⤵
  PID:2380
- C:\Windows\System\qRVFDSG.exe
  C:\Windows\System\qRVFDSG.exe
  2⤵
  PID:1948
- C:\Windows\System\ZOPMxre.exe
  C:\Windows\System\ZOPMxre.exe
  2⤵
  PID:1672
- C:\Windows\System\EKJWCOu.exe
  C:\Windows\System\EKJWCOu.exe
  2⤵
  PID:1584
- C:\Windows\System\aQKHmkr.exe
  C:\Windows\System\aQKHmkr.exe
  2⤵
  PID:2968
- C:\Windows\System\JeIqVKr.exe
  C:\Windows\System\JeIqVKr.exe
  2⤵
  PID:1508
- C:\Windows\System\WtHwflO.exe
  C:\Windows\System\WtHwflO.exe
  2⤵
  PID:2060
- C:\Windows\System\VqTDEco.exe
  C:\Windows\System\VqTDEco.exe
  2⤵
  PID:1504
- C:\Windows\System\NAiZkgE.exe
  C:\Windows\System\NAiZkgE.exe
  2⤵
  PID:2644
- C:\Windows\System\ixoJPlh.exe
  C:\Windows\System\ixoJPlh.exe
  2⤵
  PID:2764
- C:\Windows\System\pqXeuuP.exe
  C:\Windows\System\pqXeuuP.exe
  2⤵
  PID:1624
- C:\Windows\System\vuPoxsE.exe
  C:\Windows\System\vuPoxsE.exe
  2⤵
  PID:2120
- C:\Windows\System\CWEsQVZ.exe
  C:\Windows\System\CWEsQVZ.exe
  2⤵
  PID:1332
- C:\Windows\System\FzlwJQq.exe
  C:\Windows\System\FzlwJQq.exe
  2⤵
  PID:1684
- C:\Windows\System\YsxXQvl.exe
  C:\Windows\System\YsxXQvl.exe
  2⤵
  PID:2216
- C:\Windows\System\BOQcQFs.exe
  C:\Windows\System\BOQcQFs.exe
  2⤵
  PID:320
- C:\Windows\System\jscfLIJ.exe
  C:\Windows\System\jscfLIJ.exe
  2⤵
  PID:2024
- C:\Windows\System\tJhoEZP.exe
  C:\Windows\System\tJhoEZP.exe
  2⤵
  PID:1572
- C:\Windows\System\ZyTRuJH.exe
  C:\Windows\System\ZyTRuJH.exe
  2⤵
  PID:2172
- C:\Windows\System\YeeBtPE.exe
  C:\Windows\System\YeeBtPE.exe
  2⤵
  PID:2836
- C:\Windows\System\Mqljijl.exe
  C:\Windows\System\Mqljijl.exe
  2⤵
  PID:1692
- C:\Windows\System\ZXAiUVf.exe
  C:\Windows\System\ZXAiUVf.exe
  2⤵
  PID:1252
- C:\Windows\System\VBeSTwO.exe
  C:\Windows\System\VBeSTwO.exe
  2⤵
  PID:1272
- C:\Windows\System\evVTQZl.exe
  C:\Windows\System\evVTQZl.exe
  2⤵
  PID:1680
- C:\Windows\System\rSqMhKt.exe
  C:\Windows\System\rSqMhKt.exe
  2⤵
  PID:2760
- C:\Windows\System\KHRKxIr.exe
  C:\Windows\System\KHRKxIr.exe
  2⤵
  PID:2008
- C:\Windows\System\RheOTSq.exe
  C:\Windows\System\RheOTSq.exe
  2⤵
  PID:2176
- C:\Windows\System\xviorSn.exe
  C:\Windows\System\xviorSn.exe
  2⤵
  PID:1536
- C:\Windows\System\RBqDtXw.exe
  C:\Windows\System\RBqDtXw.exe
  2⤵
  PID:780
- C:\Windows\System\tAHaOwQ.exe
  C:\Windows\System\tAHaOwQ.exe
  2⤵
  PID:836
- C:\Windows\System\wNbJYgx.exe
  C:\Windows\System\wNbJYgx.exe
  2⤵
  PID:1608
- C:\Windows\System\MZQnkks.exe
  C:\Windows\System\MZQnkks.exe
  2⤵
  PID:2100
- C:\Windows\System\UwQPpvJ.exe
  C:\Windows\System\UwQPpvJ.exe
  2⤵
  PID:1664
- C:\Windows\System\ZLXtPwS.exe
  C:\Windows\System\ZLXtPwS.exe
  2⤵
  PID:3092
- C:\Windows\System\BPbjsXn.exe
  C:\Windows\System\BPbjsXn.exe
  2⤵
  PID:3108
- C:\Windows\System\UcTZUfN.exe
  C:\Windows\System\UcTZUfN.exe
  2⤵
  PID:3124
- C:\Windows\System\IklReQa.exe
  C:\Windows\System\IklReQa.exe
  2⤵
  PID:3140
- C:\Windows\System\VsiTZIQ.exe
  C:\Windows\System\VsiTZIQ.exe
  2⤵
  PID:3160
- C:\Windows\System\awHzNVB.exe
  C:\Windows\System\awHzNVB.exe
  2⤵
  PID:3176
- C:\Windows\System\eXatIHL.exe
  C:\Windows\System\eXatIHL.exe
  2⤵
  PID:3200
- C:\Windows\System\zWyNxmK.exe
  C:\Windows\System\zWyNxmK.exe
  2⤵
  PID:3216
- C:\Windows\System\jfXmEMA.exe
  C:\Windows\System\jfXmEMA.exe
  2⤵
  PID:3236
- C:\Windows\System\FuRyegk.exe
  C:\Windows\System\FuRyegk.exe
  2⤵
  PID:3252
- C:\Windows\System\MiUEmKh.exe
  C:\Windows\System\MiUEmKh.exe
  2⤵
  PID:3268
- C:\Windows\System\ICVaoRV.exe
  C:\Windows\System\ICVaoRV.exe
  2⤵
  PID:3288
- C:\Windows\System\yqcGPmp.exe
  C:\Windows\System\yqcGPmp.exe
  2⤵
  PID:3304
- C:\Windows\System\hnAfmZa.exe
  C:\Windows\System\hnAfmZa.exe
  2⤵
  PID:3360
- C:\Windows\System\hupvqzR.exe
  C:\Windows\System\hupvqzR.exe
  2⤵
  PID:3380
- C:\Windows\System\wWxGitx.exe
  C:\Windows\System\wWxGitx.exe
  2⤵
  PID:3396
- C:\Windows\System\YCRKmbr.exe
  C:\Windows\System\YCRKmbr.exe
  2⤵
  PID:3416
- C:\Windows\System\tkNiSWx.exe
  C:\Windows\System\tkNiSWx.exe
  2⤵
  PID:3444
- C:\Windows\System\BgdjbNv.exe
  C:\Windows\System\BgdjbNv.exe
  2⤵
  PID:3460
- C:\Windows\System\VxAIDOC.exe
  C:\Windows\System\VxAIDOC.exe
  2⤵
  PID:3480
- C:\Windows\System\TSfFfVX.exe
  C:\Windows\System\TSfFfVX.exe
  2⤵
  PID:3496
- C:\Windows\System\cyqGRto.exe
  C:\Windows\System\cyqGRto.exe
  2⤵
  PID:3524
- C:\Windows\System\EjdbEXN.exe
  C:\Windows\System\EjdbEXN.exe
  2⤵
  PID:3540
- C:\Windows\System\CSdVbPJ.exe
  C:\Windows\System\CSdVbPJ.exe
  2⤵
  PID:3556
- C:\Windows\System\taMjIdP.exe
  C:\Windows\System\taMjIdP.exe
  2⤵
  PID:3576
- C:\Windows\System\tkLrQDc.exe
  C:\Windows\System\tkLrQDc.exe
  2⤵
  PID:3592
- C:\Windows\System\naoNOvD.exe
  C:\Windows\System\naoNOvD.exe
  2⤵
  PID:3612
- C:\Windows\System\qVuqVwZ.exe
  C:\Windows\System\qVuqVwZ.exe
  2⤵
  PID:3632
- C:\Windows\System\CZZbxse.exe
  C:\Windows\System\CZZbxse.exe
  2⤵
  PID:3652
- C:\Windows\System\rtUSNVQ.exe
  C:\Windows\System\rtUSNVQ.exe
  2⤵
  PID:3668
- C:\Windows\System\bMIhqpv.exe
  C:\Windows\System\bMIhqpv.exe
  2⤵
  PID:3684
- C:\Windows\System\edknfzM.exe
  C:\Windows\System\edknfzM.exe
  2⤵
  PID:3704
- C:\Windows\System\JSEdTmn.exe
  C:\Windows\System\JSEdTmn.exe
  2⤵
  PID:3720
- C:\Windows\System\FiEAmHA.exe
  C:\Windows\System\FiEAmHA.exe
  2⤵
  PID:3756
- C:\Windows\System\KDZlsmb.exe
  C:\Windows\System\KDZlsmb.exe
  2⤵
  PID:3784
- C:\Windows\System\jZqPfKY.exe
  C:\Windows\System\jZqPfKY.exe
  2⤵
  PID:3800
- C:\Windows\System\uVeXcvx.exe
  C:\Windows\System\uVeXcvx.exe
  2⤵
  PID:3816
- C:\Windows\System\RIrpVNo.exe
  C:\Windows\System\RIrpVNo.exe
  2⤵
  PID:3832
- C:\Windows\System\taPPJPj.exe
  C:\Windows\System\taPPJPj.exe
  2⤵
  PID:3848
- C:\Windows\System\csGCvue.exe
  C:\Windows\System\csGCvue.exe
  2⤵
  PID:3884
- C:\Windows\System\nEUoGTZ.exe
  C:\Windows\System\nEUoGTZ.exe
  2⤵
  PID:3904
- C:\Windows\System\LpdpKJV.exe
  C:\Windows\System\LpdpKJV.exe
  2⤵
  PID:3928
- C:\Windows\System\YzNbXhv.exe
  C:\Windows\System\YzNbXhv.exe
  2⤵
  PID:3944
- C:\Windows\System\LRanGGn.exe
  C:\Windows\System\LRanGGn.exe
  2⤵
  PID:3972
- C:\Windows\System\RGCDNYO.exe
  C:\Windows\System\RGCDNYO.exe
  2⤵
  PID:3988
- C:\Windows\System\DGsavCQ.exe
  C:\Windows\System\DGsavCQ.exe
  2⤵
  PID:4004
- C:\Windows\System\CgWLMmO.exe
  C:\Windows\System\CgWLMmO.exe
  2⤵
  PID:4020
- C:\Windows\System\yhItSTu.exe
  C:\Windows\System\yhItSTu.exe
  2⤵
  PID:4040
- C:\Windows\System\DqQXVdV.exe
  C:\Windows\System\DqQXVdV.exe
  2⤵
  PID:4056
- C:\Windows\System\odCDDMR.exe
  C:\Windows\System\odCDDMR.exe
  2⤵
  PID:4072
- C:\Windows\System\ouhwMEy.exe
  C:\Windows\System\ouhwMEy.exe
  2⤵
  PID:4092
- C:\Windows\System\hrGGyRJ.exe
  C:\Windows\System\hrGGyRJ.exe
  2⤵
  PID:3132
- C:\Windows\System\VDZOUjS.exe
  C:\Windows\System\VDZOUjS.exe
  2⤵
  PID:3172
- C:\Windows\System\lonoExb.exe
  C:\Windows\System\lonoExb.exe
  2⤵
  PID:3116
- C:\Windows\System\KsyXZBk.exe
  C:\Windows\System\KsyXZBk.exe
  2⤵
  PID:3284
- C:\Windows\System\tWJtMcE.exe
  C:\Windows\System\tWJtMcE.exe
  2⤵
  PID:3332
- C:\Windows\System\oVJYHGy.exe
  C:\Windows\System\oVJYHGy.exe
  2⤵
  PID:3352
- C:\Windows\System\dZfwzyN.exe
  C:\Windows\System\dZfwzyN.exe
  2⤵
  PID:1636
- C:\Windows\System\bAGnxbC.exe
  C:\Windows\System\bAGnxbC.exe
  2⤵
  PID:3148
- C:\Windows\System\hbstBrE.exe
  C:\Windows\System\hbstBrE.exe
  2⤵
  PID:3316
- C:\Windows\System\gUcVzuj.exe
  C:\Windows\System\gUcVzuj.exe
  2⤵
  PID:3188
- C:\Windows\System\xsENgBx.exe
  C:\Windows\System\xsENgBx.exe
  2⤵
  PID:1344
- C:\Windows\System\ZHPCmBY.exe
  C:\Windows\System\ZHPCmBY.exe
  2⤵
  PID:3408
- C:\Windows\System\stuQJTm.exe
  C:\Windows\System\stuQJTm.exe
  2⤵
  PID:3476
- C:\Windows\System\ocrjjhQ.exe
  C:\Windows\System\ocrjjhQ.exe
  2⤵
  PID:3456
- C:\Windows\System\TbVuvUb.exe
  C:\Windows\System\TbVuvUb.exe
  2⤵
  PID:3520
- C:\Windows\System\JraCCmz.exe
  C:\Windows\System\JraCCmz.exe
  2⤵
  PID:3552
- C:\Windows\System\MLwRvtP.exe
  C:\Windows\System\MLwRvtP.exe
  2⤵
  PID:2696
- C:\Windows\System\dWcRgRS.exe
  C:\Windows\System\dWcRgRS.exe
  2⤵
  PID:3664
- C:\Windows\System\EHDbEVx.exe
  C:\Windows\System\EHDbEVx.exe
  2⤵
  PID:3732
- C:\Windows\System\trGfDjw.exe
  C:\Windows\System\trGfDjw.exe
  2⤵
  PID:3752
- C:\Windows\System\NwNYLsg.exe
  C:\Windows\System\NwNYLsg.exe
  2⤵
  PID:3600
- C:\Windows\System\iMVNOkA.exe
  C:\Windows\System\iMVNOkA.exe
  2⤵
  PID:3536
- C:\Windows\System\qQXqKDP.exe
  C:\Windows\System\qQXqKDP.exe
  2⤵
  PID:3716
- C:\Windows\System\qYYmqde.exe
  C:\Windows\System\qYYmqde.exe
  2⤵
  PID:3840
- C:\Windows\System\RZgzbWJ.exe
  C:\Windows\System\RZgzbWJ.exe
  2⤵
  PID:3864
- C:\Windows\System\bJrsoAU.exe
  C:\Windows\System\bJrsoAU.exe
  2⤵
  PID:3880
- C:\Windows\System\SatCAjp.exe
  C:\Windows\System\SatCAjp.exe
  2⤵
  PID:3876
- C:\Windows\System\XyibNLe.exe
  C:\Windows\System\XyibNLe.exe
  2⤵
  PID:3896
- C:\Windows\System\nFeMHDc.exe
  C:\Windows\System\nFeMHDc.exe
  2⤵
  PID:3964
- C:\Windows\System\eyAPQrj.exe
  C:\Windows\System\eyAPQrj.exe
  2⤵
  PID:1020
- C:\Windows\System\lsdERLa.exe
  C:\Windows\System\lsdERLa.exe
  2⤵
  PID:4032
- C:\Windows\System\VsPXaqC.exe
  C:\Windows\System\VsPXaqC.exe
  2⤵
  PID:2640
- C:\Windows\System\woHHyky.exe
  C:\Windows\System\woHHyky.exe
  2⤵
  PID:3320
- C:\Windows\System\CBHzjvr.exe
  C:\Windows\System\CBHzjvr.exe
  2⤵
  PID:3024
- C:\Windows\System\LhnSEzv.exe
  C:\Windows\System\LhnSEzv.exe
  2⤵
  PID:3228
- C:\Windows\System\dMStRIC.exe
  C:\Windows\System\dMStRIC.exe
  2⤵
  PID:3368
- C:\Windows\System\GVzkyuQ.exe
  C:\Windows\System\GVzkyuQ.exe
  2⤵
  PID:3404
- C:\Windows\System\MGDJtdp.exe
  C:\Windows\System\MGDJtdp.exe
  2⤵
  PID:3184
- C:\Windows\System\xTAKQfd.exe
  C:\Windows\System\xTAKQfd.exe
  2⤵
  PID:3472
- C:\Windows\System\vbVaihN.exe
  C:\Windows\System\vbVaihN.exe
  2⤵
  PID:3624
- C:\Windows\System\uXEtpwb.exe
  C:\Windows\System\uXEtpwb.exe
  2⤵
  PID:3572
- C:\Windows\System\PNkiEID.exe
  C:\Windows\System\PNkiEID.exe
  2⤵
  PID:3768
- C:\Windows\System\mHHWptA.exe
  C:\Windows\System\mHHWptA.exe
  2⤵
  PID:3508
- C:\Windows\System\ZEZsblz.exe
  C:\Windows\System\ZEZsblz.exe
  2⤵
  PID:3956
- C:\Windows\System\fnrLpVr.exe
  C:\Windows\System\fnrLpVr.exe
  2⤵
  PID:1092
- C:\Windows\System\sYlSdDL.exe
  C:\Windows\System\sYlSdDL.exe
  2⤵
  PID:3376
- C:\Windows\System\Mrsujdq.exe
  C:\Windows\System\Mrsujdq.exe
  2⤵
  PID:1792
- C:\Windows\System\HRYfmJd.exe
  C:\Windows\System\HRYfmJd.exe
  2⤵
  PID:3412
- C:\Windows\System\FqAzahZ.exe
  C:\Windows\System\FqAzahZ.exe
  2⤵
  PID:3324
- C:\Windows\System\VSrmEXc.exe
  C:\Windows\System\VSrmEXc.exe
  2⤵
  PID:3280
- C:\Windows\System\faQYNpc.exe
  C:\Windows\System\faQYNpc.exe
  2⤵
  PID:3700
- C:\Windows\System\UurYBEy.exe
  C:\Windows\System\UurYBEy.exe
  2⤵
  PID:3436
- C:\Windows\System\RCVbBcZ.exe
  C:\Windows\System\RCVbBcZ.exe
  2⤵
  PID:3940
- C:\Windows\System\IStIvaM.exe
  C:\Windows\System\IStIvaM.exe
  2⤵
  PID:3608
- C:\Windows\System\zSHaSwZ.exe
  C:\Windows\System\zSHaSwZ.exe
  2⤵
  PID:3792
- C:\Windows\System\KJKNVVf.exe
  C:\Windows\System\KJKNVVf.exe
  2⤵
  PID:3808
- C:\Windows\System\QARXOol.exe
  C:\Windows\System\QARXOol.exe
  2⤵
  PID:3104
- C:\Windows\System\HiLVUsr.exe
  C:\Windows\System\HiLVUsr.exe
  2⤵
  PID:3488
- C:\Windows\System\SUjdtyK.exe
  C:\Windows\System\SUjdtyK.exe
  2⤵
  PID:3276
- C:\Windows\System\mhyDJly.exe
  C:\Windows\System\mhyDJly.exe
  2⤵
  PID:3856
- C:\Windows\System\LkSbJfD.exe
  C:\Windows\System\LkSbJfD.exe
  2⤵
  PID:3356
- C:\Windows\System\tWACxCD.exe
  C:\Windows\System\tWACxCD.exe
  2⤵
  PID:4088
- C:\Windows\System\gKnEgro.exe
  C:\Windows\System\gKnEgro.exe
  2⤵
  PID:3224
- C:\Windows\System\TdflQcG.exe
  C:\Windows\System\TdflQcG.exe
  2⤵
  PID:3640
- C:\Windows\System\zIMFwVx.exe
  C:\Windows\System\zIMFwVx.exe
  2⤵
  PID:3564
- C:\Windows\System\LdJwJNa.exe
  C:\Windows\System\LdJwJNa.exe
  2⤵
  PID:3388
- C:\Windows\System\QkmacXc.exe
  C:\Windows\System\QkmacXc.exe
  2⤵
  PID:3468
- C:\Windows\System\jZwfIsz.exe
  C:\Windows\System\jZwfIsz.exe
  2⤵
  PID:2868
- C:\Windows\System\FcnBYvA.exe
  C:\Windows\System\FcnBYvA.exe
  2⤵
  PID:3924
- C:\Windows\System\pQuTzSM.exe
  C:\Windows\System\pQuTzSM.exe
  2⤵
  PID:3748
- C:\Windows\System\AmklYeO.exe
  C:\Windows\System\AmklYeO.exe
  2⤵
  PID:3584
- C:\Windows\System\jthLrHi.exe
  C:\Windows\System\jthLrHi.exe
  2⤵
  PID:3764
- C:\Windows\System\xQmTKAL.exe
  C:\Windows\System\xQmTKAL.exe
  2⤵
  PID:3168
- C:\Windows\System\WBUUFQy.exe
  C:\Windows\System\WBUUFQy.exe
  2⤵
  PID:3080
- C:\Windows\System\eglFekk.exe
  C:\Windows\System\eglFekk.exe
  2⤵
  PID:4012
- C:\Windows\System\JYzZagg.exe
  C:\Windows\System\JYzZagg.exe
  2⤵
  PID:3392
- C:\Windows\System\PLuggqw.exe
  C:\Windows\System\PLuggqw.exe
  2⤵
  PID:3728
- C:\Windows\System\jFEXqcu.exe
  C:\Windows\System\jFEXqcu.exe
  2⤵
  PID:3872
- C:\Windows\System\udLkmVB.exe
  C:\Windows\System\udLkmVB.exe
  2⤵
  PID:3644
- C:\Windows\System\IYtBseV.exe
  C:\Windows\System\IYtBseV.exe
  2⤵
  PID:3900
- C:\Windows\System\rlVNVjX.exe
  C:\Windows\System\rlVNVjX.exe
  2⤵
  PID:4100
- C:\Windows\System\jSZJjdx.exe
  C:\Windows\System\jSZJjdx.exe
  2⤵
  PID:4116
- C:\Windows\System\qBRIVrT.exe
  C:\Windows\System\qBRIVrT.exe
  2⤵
  PID:4136
- C:\Windows\System\BTHdjwA.exe
  C:\Windows\System\BTHdjwA.exe
  2⤵
  PID:4160
- C:\Windows\System\dNESqlr.exe
  C:\Windows\System\dNESqlr.exe
  2⤵
  PID:4176
- C:\Windows\System\hEJBGaD.exe
  C:\Windows\System\hEJBGaD.exe
  2⤵
  PID:4192
- C:\Windows\System\SHsVttP.exe
  C:\Windows\System\SHsVttP.exe
  2⤵
  PID:4212
- C:\Windows\System\OnzEKLF.exe
  C:\Windows\System\OnzEKLF.exe
  2⤵
  PID:4232
- C:\Windows\System\WHLJwBg.exe
  C:\Windows\System\WHLJwBg.exe
  2⤵
  PID:4248
- C:\Windows\System\OKpliVM.exe
  C:\Windows\System\OKpliVM.exe
  2⤵
  PID:4264
- C:\Windows\System\jeHJJOT.exe
  C:\Windows\System\jeHJJOT.exe
  2⤵
  PID:4284
- C:\Windows\System\CuAvZMy.exe
  C:\Windows\System\CuAvZMy.exe
  2⤵
  PID:4300
- C:\Windows\System\pcqhhcE.exe
  C:\Windows\System\pcqhhcE.exe
  2⤵
  PID:4320
- C:\Windows\System\wawUQVK.exe
  C:\Windows\System\wawUQVK.exe
  2⤵
  PID:4336
- C:\Windows\System\KZYMcUD.exe
  C:\Windows\System\KZYMcUD.exe
  2⤵
  PID:4352
- C:\Windows\System\zJUixKC.exe
  C:\Windows\System\zJUixKC.exe
  2⤵
  PID:4368
- C:\Windows\System\AqkmvmW.exe
  C:\Windows\System\AqkmvmW.exe
  2⤵
  PID:4384
- C:\Windows\System\LRjfMAz.exe
  C:\Windows\System\LRjfMAz.exe
  2⤵
  PID:4400
- C:\Windows\System\jsKPlCB.exe
  C:\Windows\System\jsKPlCB.exe
  2⤵
  PID:4416
- C:\Windows\System\dhdEFHC.exe
  C:\Windows\System\dhdEFHC.exe
  2⤵
  PID:4484
- C:\Windows\System\hWopmsF.exe
  C:\Windows\System\hWopmsF.exe
  2⤵
  PID:4508
- C:\Windows\System\PLXVwkP.exe
  C:\Windows\System\PLXVwkP.exe
  2⤵
  PID:4524
- C:\Windows\System\zvbldWq.exe
  C:\Windows\System\zvbldWq.exe
  2⤵
  PID:4540
- C:\Windows\System\geqKDfz.exe
  C:\Windows\System\geqKDfz.exe
  2⤵
  PID:4560
- C:\Windows\System\agbekqU.exe
  C:\Windows\System\agbekqU.exe
  2⤵
  PID:4584
- C:\Windows\System\JIxTwnB.exe
  C:\Windows\System\JIxTwnB.exe
  2⤵
  PID:4600
- C:\Windows\System\NozrOXj.exe
  C:\Windows\System\NozrOXj.exe
  2⤵
  PID:4620
- C:\Windows\System\UPIzOTy.exe
  C:\Windows\System\UPIzOTy.exe
  2⤵
  PID:4648
- C:\Windows\System\vyNvKmI.exe
  C:\Windows\System\vyNvKmI.exe
  2⤵
  PID:4668
- C:\Windows\System\odOwQPt.exe
  C:\Windows\System\odOwQPt.exe
  2⤵
  PID:4684
- C:\Windows\System\luHfYEu.exe
  C:\Windows\System\luHfYEu.exe
  2⤵
  PID:4704
- C:\Windows\System\xwGUdQE.exe
  C:\Windows\System\xwGUdQE.exe
  2⤵
  PID:4720
- C:\Windows\System\nmvQUGR.exe
  C:\Windows\System\nmvQUGR.exe
  2⤵
  PID:4744
- C:\Windows\System\OZgDHHU.exe
  C:\Windows\System\OZgDHHU.exe
  2⤵
  PID:4764
- C:\Windows\System\OkevnMM.exe
  C:\Windows\System\OkevnMM.exe
  2⤵
  PID:4784
- C:\Windows\System\gxVhCeH.exe
  C:\Windows\System\gxVhCeH.exe
  2⤵
  PID:4800
- C:\Windows\System\tJXNkpx.exe
  C:\Windows\System\tJXNkpx.exe
  2⤵
  PID:4816
- C:\Windows\System\ecnteCP.exe
  C:\Windows\System\ecnteCP.exe
  2⤵
  PID:4836
- C:\Windows\System\GAHCdKq.exe
  C:\Windows\System\GAHCdKq.exe
  2⤵
  PID:4856
- C:\Windows\System\TBjifxk.exe
  C:\Windows\System\TBjifxk.exe
  2⤵
  PID:4872
- C:\Windows\System\BmyDorq.exe
  C:\Windows\System\BmyDorq.exe
  2⤵
  PID:4892
- C:\Windows\System\cfqlMcq.exe
  C:\Windows\System\cfqlMcq.exe
  2⤵
  PID:4912
- C:\Windows\System\wFgtVQI.exe
  C:\Windows\System\wFgtVQI.exe
  2⤵
  PID:4940
- C:\Windows\System\urHzsRO.exe
  C:\Windows\System\urHzsRO.exe
  2⤵
  PID:4960
- C:\Windows\System\SNojRiK.exe
  C:\Windows\System\SNojRiK.exe
  2⤵
  PID:4976
- C:\Windows\System\DiVaulz.exe
  C:\Windows\System\DiVaulz.exe
  2⤵
  PID:4996
- C:\Windows\System\mUUYZGI.exe
  C:\Windows\System\mUUYZGI.exe
  2⤵
  PID:5020
- C:\Windows\System\QNTKvMO.exe
  C:\Windows\System\QNTKvMO.exe
  2⤵
  PID:5044
- C:\Windows\System\RwXBcLk.exe
  C:\Windows\System\RwXBcLk.exe
  2⤵
  PID:5068
- C:\Windows\System\mkEapab.exe
  C:\Windows\System\mkEapab.exe
  2⤵
  PID:5084
- C:\Windows\System\cqtNirs.exe
  C:\Windows\System\cqtNirs.exe
  2⤵
  PID:5104
- C:\Windows\System\UxLoJPs.exe
  C:\Windows\System\UxLoJPs.exe
  2⤵
  PID:3088
- C:\Windows\System\TzwUYtO.exe
  C:\Windows\System\TzwUYtO.exe
  2⤵
  PID:4128
- C:\Windows\System\TOxCQjF.exe
  C:\Windows\System\TOxCQjF.exe
  2⤵
  PID:4240
- C:\Windows\System\hVzxNdB.exe
  C:\Windows\System\hVzxNdB.exe
  2⤵
  PID:4308
- C:\Windows\System\JNYXdrA.exe
  C:\Windows\System\JNYXdrA.exe
  2⤵
  PID:4376
- C:\Windows\System\xWeqaPu.exe
  C:\Windows\System\xWeqaPu.exe
  2⤵
  PID:4028
- C:\Windows\System\uszIeBL.exe
  C:\Windows\System\uszIeBL.exe
  2⤵
  PID:4424
- C:\Windows\System\bLYuvNT.exe
  C:\Windows\System\bLYuvNT.exe
  2⤵
  PID:4188
- C:\Windows\System\NpEsMZm.exe
  C:\Windows\System\NpEsMZm.exe
  2⤵
  PID:4440
- C:\Windows\System\HjmncFz.exe
  C:\Windows\System\HjmncFz.exe
  2⤵
  PID:4328
- C:\Windows\System\KmambIy.exe
  C:\Windows\System\KmambIy.exe
  2⤵
  PID:4364
- C:\Windows\System\IdrYxOb.exe
  C:\Windows\System\IdrYxOb.exe
  2⤵
  PID:4468
- C:\Windows\System\BiCPTld.exe
  C:\Windows\System\BiCPTld.exe
  2⤵
  PID:4492
- C:\Windows\System\HjqKGDL.exe
  C:\Windows\System\HjqKGDL.exe
  2⤵
  PID:4500
- C:\Windows\System\PYAAzBy.exe
  C:\Windows\System\PYAAzBy.exe
  2⤵
  PID:4576
- C:\Windows\System\teghMas.exe
  C:\Windows\System\teghMas.exe
  2⤵
  PID:4552
- C:\Windows\System\pCpFNDn.exe
  C:\Windows\System\pCpFNDn.exe
  2⤵
  PID:4520
- C:\Windows\System\YfuGdyo.exe
  C:\Windows\System\YfuGdyo.exe
  2⤵
  PID:4660
- C:\Windows\System\RkROgSB.exe
  C:\Windows\System\RkROgSB.exe
  2⤵
  PID:4680
- C:\Windows\System\XgkOlLh.exe
  C:\Windows\System\XgkOlLh.exe
  2⤵
  PID:4728
- C:\Windows\System\jQWcqEs.exe
  C:\Windows\System\jQWcqEs.exe
  2⤵
  PID:4752
- C:\Windows\System\bVEkHCe.exe
  C:\Windows\System\bVEkHCe.exe
  2⤵
  PID:4772
- C:\Windows\System\oFGsbzh.exe
  C:\Windows\System\oFGsbzh.exe
  2⤵
  PID:4796
- C:\Windows\System\PkWVgzU.exe
  C:\Windows\System\PkWVgzU.exe
  2⤵
  PID:4924
- C:\Windows\System\EVLITnS.exe
  C:\Windows\System\EVLITnS.exe
  2⤵
  PID:4936
- C:\Windows\System\RCBkKol.exe
  C:\Windows\System\RCBkKol.exe
  2⤵
  PID:4972
- C:\Windows\System\biOaqBM.exe
  C:\Windows\System\biOaqBM.exe
  2⤵
  PID:4984
- C:\Windows\System\VEDjLUS.exe
  C:\Windows\System\VEDjLUS.exe
  2⤵
  PID:5036
- C:\Windows\System\zIwgZuD.exe
  C:\Windows\System\zIwgZuD.exe
  2⤵
  PID:4952
- C:\Windows\System\kcuKazM.exe
  C:\Windows\System\kcuKazM.exe
  2⤵
  PID:4992
- C:\Windows\System\ibhFcxp.exe
  C:\Windows\System\ibhFcxp.exe
  2⤵
  PID:5064
- C:\Windows\System\bWStUDH.exe
  C:\Windows\System\bWStUDH.exe
  2⤵
  PID:4132
- C:\Windows\System\alhQvMZ.exe
  C:\Windows\System\alhQvMZ.exe
  2⤵
  PID:4408
- C:\Windows\System\uYZdiiv.exe
  C:\Windows\System\uYZdiiv.exe
  2⤵
  PID:4348
- C:\Windows\System\zCkINsk.exe
  C:\Windows\System\zCkINsk.exe
  2⤵
  PID:4428
- C:\Windows\System\vIOuStt.exe
  C:\Windows\System\vIOuStt.exe
  2⤵
  PID:4200
- C:\Windows\System\TyuZfNb.exe
  C:\Windows\System\TyuZfNb.exe
  2⤵
  PID:4224
- C:\Windows\System\eRvPYuQ.exe
  C:\Windows\System\eRvPYuQ.exe
  2⤵
  PID:4360
- C:\Windows\System\GTSjEWQ.exe
  C:\Windows\System\GTSjEWQ.exe
  2⤵
  PID:4476
- C:\Windows\System\QgVktes.exe
  C:\Windows\System\QgVktes.exe
  2⤵
  PID:4608
- C:\Windows\System\SKnHPOI.exe
  C:\Windows\System\SKnHPOI.exe
  2⤵
  PID:4640
- C:\Windows\System\IzfdkGN.exe
  C:\Windows\System\IzfdkGN.exe
  2⤵
  PID:4516
- C:\Windows\System\HdlaSfD.exe
  C:\Windows\System\HdlaSfD.exe
  2⤵
  PID:4696
- C:\Windows\System\UaFGJGj.exe
  C:\Windows\System\UaFGJGj.exe
  2⤵
  PID:4712
- C:\Windows\System\xxjfzjI.exe
  C:\Windows\System\xxjfzjI.exe
  2⤵
  PID:4808
- C:\Windows\System\RSndzJt.exe
  C:\Windows\System\RSndzJt.exe
  2⤵
  PID:4848
- C:\Windows\System\CqHkXzN.exe
  C:\Windows\System\CqHkXzN.exe
  2⤵
  PID:5012
- C:\Windows\System\IFBjYsP.exe
  C:\Windows\System\IFBjYsP.exe
  2⤵
  PID:4868
- C:\Windows\System\YxECVOs.exe
  C:\Windows\System\YxECVOs.exe
  2⤵
  PID:5096
- C:\Windows\System\GiIrzWy.exe
  C:\Windows\System\GiIrzWy.exe
  2⤵
  PID:4900
- C:\Windows\System\LCKyUNM.exe
  C:\Windows\System\LCKyUNM.exe
  2⤵
  PID:4280
- C:\Windows\System\WsDYxMc.exe
  C:\Windows\System\WsDYxMc.exe
  2⤵
  PID:4344
- C:\Windows\System\CvLZmIm.exe
  C:\Windows\System\CvLZmIm.exe
  2⤵
  PID:5112
- C:\Windows\System\SIbAQMV.exe
  C:\Windows\System\SIbAQMV.exe
  2⤵
  PID:4260
- C:\Windows\System\WDtokOZ.exe
  C:\Windows\System\WDtokOZ.exe
  2⤵
  PID:4448
- C:\Windows\System\XxRyvYI.exe
  C:\Windows\System\XxRyvYI.exe
  2⤵
  PID:4452
- C:\Windows\System\PUxkWXt.exe
  C:\Windows\System\PUxkWXt.exe
  2⤵
  PID:4572
- C:\Windows\System\LndNZwm.exe
  C:\Windows\System\LndNZwm.exe
  2⤵
  PID:4692
- C:\Windows\System\utHGRJf.exe
  C:\Windows\System\utHGRJf.exe
  2⤵
  PID:4716
- C:\Windows\System\vUoSSEB.exe
  C:\Windows\System\vUoSSEB.exe
  2⤵
  PID:4740
- C:\Windows\System\fSTJbss.exe
  C:\Windows\System\fSTJbss.exe
  2⤵
  PID:4920
- C:\Windows\System\uYMaiCm.exe
  C:\Windows\System\uYMaiCm.exe
  2⤵
  PID:5028
- C:\Windows\System\oYSyiiK.exe
  C:\Windows\System\oYSyiiK.exe
  2⤵
  PID:4932
- C:\Windows\System\zlyViVa.exe
  C:\Windows\System\zlyViVa.exe
  2⤵
  PID:4460
- C:\Windows\System\lZzKYVA.exe
  C:\Windows\System\lZzKYVA.exe
  2⤵
  PID:4292
- C:\Windows\System\XQEFoXc.exe
  C:\Windows\System\XQEFoXc.exe
  2⤵
  PID:4316
- C:\Windows\System\kMkvAmS.exe
  C:\Windows\System\kMkvAmS.exe
  2⤵
  PID:4536
- C:\Windows\System\AtlzxsE.exe
  C:\Windows\System\AtlzxsE.exe
  2⤵
  PID:4928
- C:\Windows\System\SalRwWe.exe
  C:\Windows\System\SalRwWe.exe
  2⤵
  PID:3960
- C:\Windows\System\ZvLJPQj.exe
  C:\Windows\System\ZvLJPQj.exe
  2⤵
  PID:4124
- C:\Windows\System\vhqsUmN.exe
  C:\Windows\System\vhqsUmN.exe
  2⤵
  PID:4156
- C:\Windows\System\opkgBLA.exe
  C:\Windows\System\opkgBLA.exe
  2⤵
  PID:4888
- C:\Windows\System\SCiEwLI.exe
  C:\Windows\System\SCiEwLI.exe
  2⤵
  PID:4592
- C:\Windows\System\CtoUbPb.exe
  C:\Windows\System\CtoUbPb.exe
  2⤵
  PID:4828
- C:\Windows\System\KeaDudF.exe
  C:\Windows\System\KeaDudF.exe
  2⤵
  PID:4612
- C:\Windows\System\kqTOMVT.exe
  C:\Windows\System\kqTOMVT.exe
  2⤵
  PID:5060
- C:\Windows\System\lKrwyXm.exe
  C:\Windows\System\lKrwyXm.exe
  2⤵
  PID:4968
- C:\Windows\System\TRpAkZm.exe
  C:\Windows\System\TRpAkZm.exe
  2⤵
  PID:5144
- C:\Windows\System\mLjqGFM.exe
  C:\Windows\System\mLjqGFM.exe
  2⤵
  PID:5160
- C:\Windows\System\cgHXKrB.exe
  C:\Windows\System\cgHXKrB.exe
  2⤵
  PID:5180
- C:\Windows\System\MBtJikO.exe
  C:\Windows\System\MBtJikO.exe
  2⤵
  PID:5200
- C:\Windows\System\kWvpwLi.exe
  C:\Windows\System\kWvpwLi.exe
  2⤵
  PID:5216
- C:\Windows\System\MHDfxzy.exe
  C:\Windows\System\MHDfxzy.exe
  2⤵
  PID:5236
- C:\Windows\System\PzwKZFH.exe
  C:\Windows\System\PzwKZFH.exe
  2⤵
  PID:5252
- C:\Windows\System\jOrDOpt.exe
  C:\Windows\System\jOrDOpt.exe
  2⤵
  PID:5268
- C:\Windows\System\NHqAcMk.exe
  C:\Windows\System\NHqAcMk.exe
  2⤵
  PID:5284
- C:\Windows\System\PxuHpnD.exe
  C:\Windows\System\PxuHpnD.exe
  2⤵
  PID:5308
- C:\Windows\System\MvKGBmk.exe
  C:\Windows\System\MvKGBmk.exe
  2⤵
  PID:5344
- C:\Windows\System\vLLhUAM.exe
  C:\Windows\System\vLLhUAM.exe
  2⤵
  PID:5360
- C:\Windows\System\fNgWspE.exe
  C:\Windows\System\fNgWspE.exe
  2⤵
  PID:5376
- C:\Windows\System\RlwVfel.exe
  C:\Windows\System\RlwVfel.exe
  2⤵
  PID:5392
- C:\Windows\System\zFMkyES.exe
  C:\Windows\System\zFMkyES.exe
  2⤵
  PID:5408
- C:\Windows\System\ZYYcBRV.exe
  C:\Windows\System\ZYYcBRV.exe
  2⤵
  PID:5424
- C:\Windows\System\EeVzjxS.exe
  C:\Windows\System\EeVzjxS.exe
  2⤵
  PID:5456
- C:\Windows\System\yTnrVqo.exe
  C:\Windows\System\yTnrVqo.exe
  2⤵
  PID:5476
- C:\Windows\System\ixjTVhL.exe
  C:\Windows\System\ixjTVhL.exe
  2⤵
  PID:5492
- C:\Windows\System\DNtcfCT.exe
  C:\Windows\System\DNtcfCT.exe
  2⤵
  PID:5512
- C:\Windows\System\WcIgaja.exe
  C:\Windows\System\WcIgaja.exe
  2⤵
  PID:5532
- C:\Windows\System\aCeVodj.exe
  C:\Windows\System\aCeVodj.exe
  2⤵
  PID:5548
- C:\Windows\System\dbYZzEN.exe
  C:\Windows\System\dbYZzEN.exe
  2⤵
  PID:5584
- C:\Windows\System\BIdOTOk.exe
  C:\Windows\System\BIdOTOk.exe
  2⤵
  PID:5604
- C:\Windows\System\uWMULEH.exe
  C:\Windows\System\uWMULEH.exe
  2⤵
  PID:5624
- C:\Windows\System\txOmoBg.exe
  C:\Windows\System\txOmoBg.exe
  2⤵
  PID:5644
- C:\Windows\System\zRTunDZ.exe
  C:\Windows\System\zRTunDZ.exe
  2⤵
  PID:5664
- C:\Windows\System\VZsvuPV.exe
  C:\Windows\System\VZsvuPV.exe
  2⤵
  PID:5680
- C:\Windows\System\klHFCXo.exe
  C:\Windows\System\klHFCXo.exe
  2⤵
  PID:5700
- C:\Windows\System\etlBumc.exe
  C:\Windows\System\etlBumc.exe
  2⤵
  PID:5728
- C:\Windows\System\BxmkeIa.exe
  C:\Windows\System\BxmkeIa.exe
  2⤵
  PID:5744
- C:\Windows\System\kYvtipa.exe
  C:\Windows\System\kYvtipa.exe
  2⤵
  PID:5764
- C:\Windows\System\DlcfNiT.exe
  C:\Windows\System\DlcfNiT.exe
  2⤵
  PID:5780
- C:\Windows\System\nAyvGnv.exe
  C:\Windows\System\nAyvGnv.exe
  2⤵
  PID:5796
- C:\Windows\System\vCWPWax.exe
  C:\Windows\System\vCWPWax.exe
  2⤵
  PID:5812
- C:\Windows\System\PbIxTMM.exe
  C:\Windows\System\PbIxTMM.exe
  2⤵
  PID:5828
- C:\Windows\System\KsJTeWc.exe
  C:\Windows\System\KsJTeWc.exe
  2⤵
  PID:5844
- C:\Windows\System\xMXvnZJ.exe
  C:\Windows\System\xMXvnZJ.exe
  2⤵
  PID:5872
- C:\Windows\System\lGSapOX.exe
  C:\Windows\System\lGSapOX.exe
  2⤵
  PID:5892
- C:\Windows\System\LSyfkLZ.exe
  C:\Windows\System\LSyfkLZ.exe
  2⤵
  PID:5916
- C:\Windows\System\zSyCODk.exe
  C:\Windows\System\zSyCODk.exe
  2⤵
  PID:5932
- C:\Windows\System\jgyFwxK.exe
  C:\Windows\System\jgyFwxK.exe
  2⤵
  PID:5948
- C:\Windows\System\HFYTbdQ.exe
  C:\Windows\System\HFYTbdQ.exe
  2⤵
  PID:5968
- C:\Windows\System\HQDyauz.exe
  C:\Windows\System\HQDyauz.exe
  2⤵
  PID:5984
- C:\Windows\System\eDBbEmH.exe
  C:\Windows\System\eDBbEmH.exe
  2⤵
  PID:6004
- C:\Windows\System\wgWfDrK.exe
  C:\Windows\System\wgWfDrK.exe
  2⤵
  PID:6028
- C:\Windows\System\eWbTvdA.exe
  C:\Windows\System\eWbTvdA.exe
  2⤵
  PID:6044
- C:\Windows\System\gNOOffa.exe
  C:\Windows\System\gNOOffa.exe
  2⤵
  PID:6060
- C:\Windows\System\hrpjyrz.exe
  C:\Windows\System\hrpjyrz.exe
  2⤵
  PID:6080
- C:\Windows\System\sPcoSTF.exe
  C:\Windows\System\sPcoSTF.exe
  2⤵
  PID:6096
- C:\Windows\System\DyPiEMs.exe
  C:\Windows\System\DyPiEMs.exe
  2⤵
  PID:6112
- C:\Windows\System\pVExxTM.exe
  C:\Windows\System\pVExxTM.exe
  2⤵
  PID:6132
- C:\Windows\System\BXPxUIA.exe
  C:\Windows\System\BXPxUIA.exe
  2⤵
  PID:4436
- C:\Windows\System\mVxbCqN.exe
  C:\Windows\System\mVxbCqN.exe
  2⤵
  PID:5276
- C:\Windows\System\trzsHiE.exe
  C:\Windows\System\trzsHiE.exe
  2⤵
  PID:5316
- C:\Windows\System\ssepeNy.exe
  C:\Windows\System\ssepeNy.exe
  2⤵
  PID:5192
- C:\Windows\System\NjUJTiI.exe
  C:\Windows\System\NjUJTiI.exe
  2⤵
  PID:5260
- C:\Windows\System\cLziKvg.exe
  C:\Windows\System\cLziKvg.exe
  2⤵
  PID:5300
- C:\Windows\System\ZPJyOKc.exe
  C:\Windows\System\ZPJyOKc.exe
  2⤵
  PID:5340
- C:\Windows\System\PDRpeLV.exe
  C:\Windows\System\PDRpeLV.exe
  2⤵
  PID:5372
- C:\Windows\System\PMWAbtg.exe
  C:\Windows\System\PMWAbtg.exe
  2⤵
  PID:5420
- C:\Windows\System\ZWSgnhw.exe
  C:\Windows\System\ZWSgnhw.exe
  2⤵
  PID:5384
- C:\Windows\System\rhBcrJQ.exe
  C:\Windows\System\rhBcrJQ.exe
  2⤵
  PID:5524
- C:\Windows\System\jAvnMdA.exe
  C:\Windows\System\jAvnMdA.exe
  2⤵
  PID:5544
- C:\Windows\System\TKtKtIo.exe
  C:\Windows\System\TKtKtIo.exe
  2⤵
  PID:5504
- C:\Windows\System\SEleqkH.exe
  C:\Windows\System\SEleqkH.exe
  2⤵
  PID:5596
- C:\Windows\System\fMcueiQ.exe
  C:\Windows\System\fMcueiQ.exe
  2⤵
  PID:5688
- C:\Windows\System\MkKhlqX.exe
  C:\Windows\System\MkKhlqX.exe
  2⤵
  PID:5632
- C:\Windows\System\TPPSPzM.exe
  C:\Windows\System\TPPSPzM.exe
  2⤵
  PID:5640
- C:\Windows\System\oXiRfmW.exe
  C:\Windows\System\oXiRfmW.exe
  2⤵
  PID:5716
- C:\Windows\System\kIyUJir.exe
  C:\Windows\System\kIyUJir.exe
  2⤵
  PID:5772
- C:\Windows\System\OyXwPqf.exe
  C:\Windows\System\OyXwPqf.exe
  2⤵
  PID:5752
- C:\Windows\System\SRqIjXo.exe
  C:\Windows\System\SRqIjXo.exe
  2⤵
  PID:5964
- C:\Windows\System\FDZPTUS.exe
  C:\Windows\System\FDZPTUS.exe
  2⤵
  PID:6072
- C:\Windows\System\yFzkcKL.exe
  C:\Windows\System\yFzkcKL.exe
  2⤵
  PID:6140
- C:\Windows\System\hqZXXSe.exe
  C:\Windows\System\hqZXXSe.exe
  2⤵
  PID:5760
- C:\Windows\System\gJyPapQ.exe
  C:\Windows\System\gJyPapQ.exe
  2⤵
  PID:5788
- C:\Windows\System\EIwclYR.exe
  C:\Windows\System\EIwclYR.exe
  2⤵
  PID:4628
- C:\Windows\System\vLssxIb.exe
  C:\Windows\System\vLssxIb.exe
  2⤵
  PID:6012
- C:\Windows\System\hKOPNIQ.exe
  C:\Windows\System\hKOPNIQ.exe
  2⤵
  PID:5824
- C:\Windows\System\UrtgDoO.exe
  C:\Windows\System\UrtgDoO.exe
  2⤵
  PID:6052
- C:\Windows\System\aAsSyeQ.exe
  C:\Windows\System\aAsSyeQ.exe
  2⤵
  PID:6124
- C:\Windows\System\aKJOcZK.exe
  C:\Windows\System\aKJOcZK.exe
  2⤵
  PID:5140
- C:\Windows\System\cZTpSqM.exe
  C:\Windows\System\cZTpSqM.exe
  2⤵
  PID:5152
- C:\Windows\System\DinlGJq.exe
  C:\Windows\System\DinlGJq.exe
  2⤵
  PID:5196
- C:\Windows\System\aVNeFkW.exe
  C:\Windows\System\aVNeFkW.exe
  2⤵
  PID:5452
- C:\Windows\System\pkZDkuO.exe
  C:\Windows\System\pkZDkuO.exe
  2⤵
  PID:5368
- C:\Windows\System\EPTWIzK.exe
  C:\Windows\System\EPTWIzK.exe
  2⤵
  PID:5436
- C:\Windows\System\nSDvsHy.exe
  C:\Windows\System\nSDvsHy.exe
  2⤵
  PID:112
- C:\Windows\System\qcxQALi.exe
  C:\Windows\System\qcxQALi.exe
  2⤵
  PID:5520
- C:\Windows\System\iVfFilJ.exe
  C:\Windows\System\iVfFilJ.exe
  2⤵
  PID:5500
- C:\Windows\System\PHipLay.exe
  C:\Windows\System\PHipLay.exe
  2⤵
  PID:5660
- C:\Windows\System\CtuEEmo.exe
  C:\Windows\System\CtuEEmo.exe
  2⤵
  PID:5620
- C:\Windows\System\uJmgYqg.exe
  C:\Windows\System\uJmgYqg.exe
  2⤵
  PID:5636
- C:\Windows\System\wEiZLZd.exe
  C:\Windows\System\wEiZLZd.exe
  2⤵
  PID:5776
- C:\Windows\System\VEqGBDw.exe
  C:\Windows\System\VEqGBDw.exe
  2⤵
  PID:5840
- C:\Windows\System\psTRhcM.exe
  C:\Windows\System\psTRhcM.exe
  2⤵
  PID:6000
- C:\Windows\System\HrPkOSi.exe
  C:\Windows\System\HrPkOSi.exe
  2⤵
  PID:4596
- C:\Windows\System\eDLIrRW.exe
  C:\Windows\System\eDLIrRW.exe
  2⤵
  PID:6020
- C:\Windows\System\ziRDrvj.exe
  C:\Windows\System\ziRDrvj.exe
  2⤵
  PID:5944
- C:\Windows\System\wEwCdCb.exe
  C:\Windows\System\wEwCdCb.exe
  2⤵
  PID:6092
- C:\Windows\System\rVgWpuV.exe
  C:\Windows\System\rVgWpuV.exe
  2⤵
  PID:5432
- C:\Windows\System\OlMBxDD.exe
  C:\Windows\System\OlMBxDD.exe
  2⤵
  PID:5740
- C:\Windows\System\fHcIPCO.exe
  C:\Windows\System\fHcIPCO.exe
  2⤵
  PID:5444
- C:\Windows\System\RbWZKIu.exe
  C:\Windows\System\RbWZKIu.exe
  2⤵
  PID:5076
- C:\Windows\System\BOHVkvE.exe
  C:\Windows\System\BOHVkvE.exe
  2⤵
  PID:5592
- C:\Windows\System\ixQRVcb.exe
  C:\Windows\System\ixQRVcb.exe
  2⤵
  PID:6108
- C:\Windows\System\IkgIzDU.exe
  C:\Windows\System\IkgIzDU.exe
  2⤵
  PID:5248
- C:\Windows\System\AcYycMV.exe
  C:\Windows\System\AcYycMV.exe
  2⤵
  PID:5956
- C:\Windows\System\zXuByKs.exe
  C:\Windows\System\zXuByKs.exe
  2⤵
  PID:5940
- C:\Windows\System\OdFaYfU.exe
  C:\Windows\System\OdFaYfU.exe
  2⤵
  PID:6016
- C:\Windows\System\XScvaCe.exe
  C:\Windows\System\XScvaCe.exe
  2⤵
  PID:5156
- C:\Windows\System\fOYwtFv.exe
  C:\Windows\System\fOYwtFv.exe
  2⤵
  PID:5564
- C:\Windows\System\OngtHPe.exe
  C:\Windows\System\OngtHPe.exe
  2⤵
  PID:5836
- C:\Windows\System\zQOLwZt.exe
  C:\Windows\System\zQOLwZt.exe
  2⤵
  PID:5724
- C:\Windows\System\rYfoswr.exe
  C:\Windows\System\rYfoswr.exe
  2⤵
  PID:5296
- C:\Windows\System\msZjkRI.exe
  C:\Windows\System\msZjkRI.exe
  2⤵
  PID:6024
- C:\Windows\System\EKuxzQY.exe
  C:\Windows\System\EKuxzQY.exe
  2⤵
  PID:5580
- C:\Windows\System\NrYfkoe.exe
  C:\Windows\System\NrYfkoe.exe
  2⤵
  PID:5696
- C:\Windows\System\RdaRNAe.exe
  C:\Windows\System\RdaRNAe.exe
  2⤵
  PID:5228
- C:\Windows\System\iHztxeY.exe
  C:\Windows\System\iHztxeY.exe
  2⤵
  PID:5888
- C:\Windows\System\ircnYzs.exe
  C:\Windows\System\ircnYzs.exe
  2⤵
  PID:5864
- C:\Windows\System\OtvhdYA.exe
  C:\Windows\System\OtvhdYA.exe
  2⤵
  PID:5856
- C:\Windows\System\XXiOyoF.exe
  C:\Windows\System\XXiOyoF.exe
  2⤵
  PID:6160
- C:\Windows\System\ZRnCrTn.exe
  C:\Windows\System\ZRnCrTn.exe
  2⤵
  PID:6176
- C:\Windows\System\pKsaKqa.exe
  C:\Windows\System\pKsaKqa.exe
  2⤵
  PID:6192
- C:\Windows\System\jKrsLAe.exe
  C:\Windows\System\jKrsLAe.exe
  2⤵
  PID:6220
- C:\Windows\System\erqVnDH.exe
  C:\Windows\System\erqVnDH.exe
  2⤵
  PID:6236
- C:\Windows\System\TPidQRR.exe
  C:\Windows\System\TPidQRR.exe
  2⤵
  PID:6256
- C:\Windows\System\RmTxqrv.exe
  C:\Windows\System\RmTxqrv.exe
  2⤵
  PID:6272
- C:\Windows\System\ypadfeP.exe
  C:\Windows\System\ypadfeP.exe
  2⤵
  PID:6288
- C:\Windows\System\ZSPjuCg.exe
  C:\Windows\System\ZSPjuCg.exe
  2⤵
  PID:6308
- C:\Windows\System\EeqWGTI.exe
  C:\Windows\System\EeqWGTI.exe
  2⤵
  PID:6340
- C:\Windows\System\IdqkIGB.exe
  C:\Windows\System\IdqkIGB.exe
  2⤵
  PID:6360
- C:\Windows\System\oKLtJns.exe
  C:\Windows\System\oKLtJns.exe
  2⤵
  PID:6376
- C:\Windows\System\aUzwEfy.exe
  C:\Windows\System\aUzwEfy.exe
  2⤵
  PID:6392
- C:\Windows\System\zeaMENI.exe
  C:\Windows\System\zeaMENI.exe
  2⤵
  PID:6412
- C:\Windows\System\YyszKAq.exe
  C:\Windows\System\YyszKAq.exe
  2⤵
  PID:6432
- C:\Windows\System\DzmSqjW.exe
  C:\Windows\System\DzmSqjW.exe
  2⤵
  PID:6452
- C:\Windows\System\MskRYeb.exe
  C:\Windows\System\MskRYeb.exe
  2⤵
  PID:6476
- C:\Windows\System\eoqCAUU.exe
  C:\Windows\System\eoqCAUU.exe
  2⤵
  PID:6492
- C:\Windows\System\OStgqdt.exe
  C:\Windows\System\OStgqdt.exe
  2⤵
  PID:6508
- C:\Windows\System\UvYPdfh.exe
  C:\Windows\System\UvYPdfh.exe
  2⤵
  PID:6528
- C:\Windows\System\zeMFUTk.exe
  C:\Windows\System\zeMFUTk.exe
  2⤵
  PID:6544
- C:\Windows\System\EAGaMGa.exe
  C:\Windows\System\EAGaMGa.exe
  2⤵
  PID:6560
- C:\Windows\System\zrghrpG.exe
  C:\Windows\System\zrghrpG.exe
  2⤵
  PID:6608
- C:\Windows\System\mQpBtLd.exe
  C:\Windows\System\mQpBtLd.exe
  2⤵
  PID:6624
- C:\Windows\System\NACmeHR.exe
  C:\Windows\System\NACmeHR.exe
  2⤵
  PID:6640
- C:\Windows\System\udZoqdn.exe
  C:\Windows\System\udZoqdn.exe
  2⤵
  PID:6656
- C:\Windows\System\mAJcsVZ.exe
  C:\Windows\System\mAJcsVZ.exe
  2⤵
  PID:6688
- C:\Windows\System\LCKMFQw.exe
  C:\Windows\System\LCKMFQw.exe
  2⤵
  PID:6704
- C:\Windows\System\CUBVFvx.exe
  C:\Windows\System\CUBVFvx.exe
  2⤵
  PID:6728
- C:\Windows\System\neKhHfX.exe
  C:\Windows\System\neKhHfX.exe
  2⤵
  PID:6748
- C:\Windows\System\WNPIAhp.exe
  C:\Windows\System\WNPIAhp.exe
  2⤵
  PID:6764
- C:\Windows\System\RQbssRR.exe
  C:\Windows\System\RQbssRR.exe
  2⤵
  PID:6780
- C:\Windows\System\idhKDmV.exe
  C:\Windows\System\idhKDmV.exe
  2⤵
  PID:6796
- C:\Windows\System\KzBSyaV.exe
  C:\Windows\System\KzBSyaV.exe
  2⤵
  PID:6816
- C:\Windows\System\qxYIRAo.exe
  C:\Windows\System\qxYIRAo.exe
  2⤵
  PID:6832
- C:\Windows\System\yCNUheN.exe
  C:\Windows\System\yCNUheN.exe
  2⤵
  PID:6864
- C:\Windows\System\ceFpYlE.exe
  C:\Windows\System\ceFpYlE.exe
  2⤵
  PID:6880
- C:\Windows\System\fXudfnp.exe
  C:\Windows\System\fXudfnp.exe
  2⤵
  PID:6904
- C:\Windows\System\hgMsKQj.exe
  C:\Windows\System\hgMsKQj.exe
  2⤵
  PID:6920
- C:\Windows\System\VzyRqeD.exe
  C:\Windows\System\VzyRqeD.exe
  2⤵
  PID:6940
- C:\Windows\System\cskDpMF.exe
  C:\Windows\System\cskDpMF.exe
  2⤵
  PID:6960
- C:\Windows\System\wSvfpKg.exe
  C:\Windows\System\wSvfpKg.exe
  2⤵
  PID:6976
- C:\Windows\System\NdjlhpA.exe
  C:\Windows\System\NdjlhpA.exe
  2⤵
  PID:7008
- C:\Windows\System\FeFgKbh.exe
  C:\Windows\System\FeFgKbh.exe
  2⤵
  PID:7028
- C:\Windows\System\MZljJgP.exe
  C:\Windows\System\MZljJgP.exe
  2⤵
  PID:7044
- C:\Windows\System\mcakhas.exe
  C:\Windows\System\mcakhas.exe
  2⤵
  PID:7060
- C:\Windows\System\ueDkApr.exe
  C:\Windows\System\ueDkApr.exe
  2⤵
  PID:7076
- C:\Windows\System\BZlnJkx.exe
  C:\Windows\System\BZlnJkx.exe
  2⤵
  PID:7092
- C:\Windows\System\hctvHyh.exe
  C:\Windows\System\hctvHyh.exe
  2⤵
  PID:7120
- C:\Windows\System\nzvZAhd.exe
  C:\Windows\System\nzvZAhd.exe
  2⤵
  PID:7140
- C:\Windows\System\iGgrkPd.exe
  C:\Windows\System\iGgrkPd.exe
  2⤵
  PID:7164
- C:\Windows\System\xuuMakM.exe
  C:\Windows\System\xuuMakM.exe
  2⤵
  PID:5484
- C:\Windows\System\VlZRKMD.exe
  C:\Windows\System\VlZRKMD.exe
  2⤵
  PID:5756
- C:\Windows\System\dYHLtVP.exe
  C:\Windows\System\dYHLtVP.exe
  2⤵
  PID:5884
- C:\Windows\System\XRzZYqE.exe
  C:\Windows\System\XRzZYqE.exe
  2⤵
  PID:6244
- C:\Windows\System\nlyJbLZ.exe
  C:\Windows\System\nlyJbLZ.exe
  2⤵
  PID:6200
- C:\Windows\System\kjifCyh.exe
  C:\Windows\System\kjifCyh.exe
  2⤵
  PID:6212
- C:\Windows\System\wKnsUWC.exe
  C:\Windows\System\wKnsUWC.exe
  2⤵
  PID:6280
- C:\Windows\System\ieVrZQF.exe
  C:\Windows\System\ieVrZQF.exe
  2⤵
  PID:6336
- C:\Windows\System\yEPFNGE.exe
  C:\Windows\System\yEPFNGE.exe
  2⤵
  PID:6304
- C:\Windows\System\USczcaM.exe
  C:\Windows\System\USczcaM.exe
  2⤵
  PID:6408
- C:\Windows\System\KHPfZnz.exe
  C:\Windows\System\KHPfZnz.exe
  2⤵
  PID:6384
- C:\Windows\System\yVfyvSZ.exe
  C:\Windows\System\yVfyvSZ.exe
  2⤵
  PID:6484
- C:\Windows\System\bGXJFPf.exe
  C:\Windows\System\bGXJFPf.exe
  2⤵
  PID:6468
- C:\Windows\System\ICHslPk.exe
  C:\Windows\System\ICHslPk.exe
  2⤵
  PID:6552
- C:\Windows\System\SLboDIb.exe
  C:\Windows\System\SLboDIb.exe
  2⤵
  PID:6500
- C:\Windows\System\hNyAQcW.exe
  C:\Windows\System\hNyAQcW.exe
  2⤵
  PID:6672
- C:\Windows\System\hIEPavl.exe
  C:\Windows\System\hIEPavl.exe
  2⤵
  PID:6652
- C:\Windows\System\cYsdKNH.exe
  C:\Windows\System\cYsdKNH.exe
  2⤵
  PID:6684
- C:\Windows\System\gYEMFrt.exe
  C:\Windows\System\gYEMFrt.exe
  2⤵
  PID:6744
- C:\Windows\System\WyjSaKE.exe
  C:\Windows\System\WyjSaKE.exe
  2⤵
  PID:6772
- C:\Windows\System\JFOZrQB.exe
  C:\Windows\System\JFOZrQB.exe
  2⤵
  PID:6824
- C:\Windows\System\NEqoNgH.exe
  C:\Windows\System\NEqoNgH.exe
  2⤵
  PID:6828
- C:\Windows\System\fugFZyR.exe
  C:\Windows\System\fugFZyR.exe
  2⤵
  PID:6888
- C:\Windows\System\gIznPcQ.exe
  C:\Windows\System\gIznPcQ.exe
  2⤵
  PID:6928
- C:\Windows\System\qlUBGEG.exe
  C:\Windows\System\qlUBGEG.exe
  2⤵
  PID:6912
- C:\Windows\System\QjVuMPK.exe
  C:\Windows\System\QjVuMPK.exe
  2⤵
  PID:6972
- C:\Windows\System\xyHeAwa.exe
  C:\Windows\System\xyHeAwa.exe
  2⤵
  PID:6992
- C:\Windows\System\SvtdkrI.exe
  C:\Windows\System\SvtdkrI.exe
  2⤵
  PID:7004
- C:\Windows\System\wslIVnH.exe
  C:\Windows\System\wslIVnH.exe
  2⤵
  PID:7036
- C:\Windows\System\DRfMzEm.exe
  C:\Windows\System\DRfMzEm.exe
  2⤵
  PID:7136
- C:\Windows\System\THWgGfa.exe
  C:\Windows\System\THWgGfa.exe
  2⤵
  PID:7116
- C:\Windows\System\hlXlhHT.exe
  C:\Windows\System\hlXlhHT.exe
  2⤵
  PID:7160
- C:\Windows\System\ElrEcxx.exe
  C:\Windows\System\ElrEcxx.exe
  2⤵
  PID:6152
- C:\Windows\System\gzdRFFW.exe
  C:\Windows\System\gzdRFFW.exe
  2⤵
  PID:6252
- C:\Windows\System\FwgFUkd.exe
  C:\Windows\System\FwgFUkd.exe
  2⤵
  PID:6356
- C:\Windows\System\yfPSAVE.exe
  C:\Windows\System\yfPSAVE.exe
  2⤵
  PID:6504
- C:\Windows\System\apVZEKO.exe
  C:\Windows\System\apVZEKO.exe
  2⤵
  PID:6184
- C:\Windows\System\OLvEcyw.exe
  C:\Windows\System\OLvEcyw.exe
  2⤵
  PID:6372
- C:\Windows\System\omGjzWh.exe
  C:\Windows\System\omGjzWh.exe
  2⤵
  PID:6668
- C:\Windows\System\yiuSZXy.exe
  C:\Windows\System\yiuSZXy.exe
  2⤵
  PID:6604
- C:\Windows\System\IqBDTBX.exe
  C:\Windows\System\IqBDTBX.exe
  2⤵
  PID:6352
- C:\Windows\System\uXhuVLW.exe
  C:\Windows\System\uXhuVLW.exe
  2⤵
  PID:6580
- C:\Windows\System\UKvlASE.exe
  C:\Windows\System\UKvlASE.exe
  2⤵
  PID:6648
- C:\Windows\System\fTMjovc.exe
  C:\Windows\System\fTMjovc.exe
  2⤵
  PID:6720
- C:\Windows\System\JQhAkfX.exe
  C:\Windows\System\JQhAkfX.exe
  2⤵
  PID:5176
- C:\Windows\System\BepZYYY.exe
  C:\Windows\System\BepZYYY.exe
  2⤵
  PID:6896
- C:\Windows\System\cabDUdf.exe
  C:\Windows\System\cabDUdf.exe
  2⤵
  PID:7000
- C:\Windows\System\hYDNLLy.exe
  C:\Windows\System\hYDNLLy.exe
  2⤵
  PID:7088
- C:\Windows\System\tlgyXHH.exe
  C:\Windows\System\tlgyXHH.exe
  2⤵
  PID:6956
- C:\Windows\System\omKrLid.exe
  C:\Windows\System\omKrLid.exe
  2⤵
  PID:6988
- C:\Windows\System\lNDwXxF.exe
  C:\Windows\System\lNDwXxF.exe
  2⤵
  PID:7112
- C:\Windows\System\gLsPaDV.exe
  C:\Windows\System\gLsPaDV.exe
  2⤵
  PID:6156
- C:\Windows\System\oDWMrVK.exe
  C:\Windows\System\oDWMrVK.exe
  2⤵
  PID:6444
- C:\Windows\System\cmjrNuq.exe
  C:\Windows\System\cmjrNuq.exe
  2⤵
  PID:6348
- C:\Windows\System\ulVPkBJ.exe
  C:\Windows\System\ulVPkBJ.exe
  2⤵
  PID:6368
- C:\Windows\System\HaOEDqq.exe
  C:\Windows\System\HaOEDqq.exe
  2⤵
  PID:6572
- C:\Windows\System\yQptGQz.exe
  C:\Windows\System\yQptGQz.exe
  2⤵
  PID:6792
- C:\Windows\System\XZtZoGq.exe
  C:\Windows\System\XZtZoGq.exe
  2⤵
  PID:6724
- C:\Windows\System\oNwnZWQ.exe
  C:\Windows\System\oNwnZWQ.exe
  2⤵
  PID:6948
- C:\Windows\System\lACOJfP.exe
  C:\Windows\System\lACOJfP.exe
  2⤵
  PID:6844
- C:\Windows\System\dwPmEay.exe
  C:\Windows\System\dwPmEay.exe
  2⤵
  PID:7084
- C:\Windows\System\eXbypbE.exe
  C:\Windows\System\eXbypbE.exe
  2⤵
  PID:7072
- C:\Windows\System\VEISket.exe
  C:\Windows\System\VEISket.exe
  2⤵
  PID:6148
- C:\Windows\System\MweuseV.exe
  C:\Windows\System\MweuseV.exe
  2⤵
  PID:7100
- C:\Windows\System\CAGFMUy.exe
  C:\Windows\System\CAGFMUy.exe
  2⤵
  PID:6636
- C:\Windows\System\AVCzPPJ.exe
  C:\Windows\System\AVCzPPJ.exe
  2⤵
  PID:6812
- C:\Windows\System\HPsqcvx.exe
  C:\Windows\System\HPsqcvx.exe
  2⤵
  PID:6848
- C:\Windows\System\RMKQNVf.exe
  C:\Windows\System\RMKQNVf.exe
  2⤵
  PID:6936
- C:\Windows\System\kmjvnHQ.exe
  C:\Windows\System\kmjvnHQ.exe
  2⤵
  PID:6700
- C:\Windows\System\ZiPohum.exe
  C:\Windows\System\ZiPohum.exe
  2⤵
  PID:6556
- C:\Windows\System\xVbAdqt.exe
  C:\Windows\System\xVbAdqt.exe
  2⤵
  PID:6420
- C:\Windows\System\EDtGhha.exe
  C:\Windows\System\EDtGhha.exe
  2⤵
  PID:6876
- C:\Windows\System\pjqyaPg.exe
  C:\Windows\System\pjqyaPg.exe
  2⤵
  PID:7056
- C:\Windows\System\dSyfWgj.exe
  C:\Windows\System\dSyfWgj.exe
  2⤵
  PID:6664
- C:\Windows\System\zztQDTd.exe
  C:\Windows\System\zztQDTd.exe
  2⤵
  PID:7156
- C:\Windows\System\Uwmwpqn.exe
  C:\Windows\System\Uwmwpqn.exe
  2⤵
  PID:6296
- C:\Windows\System\RDjNoXV.exe
  C:\Windows\System\RDjNoXV.exe
  2⤵
  PID:6788
- C:\Windows\System\tCGHZwu.exe
  C:\Windows\System\tCGHZwu.exe
  2⤵
  PID:7172
- C:\Windows\System\SLrTTdL.exe
  C:\Windows\System\SLrTTdL.exe
  2⤵
  PID:7196
- C:\Windows\System\UQijHoi.exe
  C:\Windows\System\UQijHoi.exe
  2⤵
  PID:7212
- C:\Windows\System\aUMYyCl.exe
  C:\Windows\System\aUMYyCl.exe
  2⤵
  PID:7228
- C:\Windows\System\IKZdtyc.exe
  C:\Windows\System\IKZdtyc.exe
  2⤵
  PID:7244
- C:\Windows\System\QoXwwrM.exe
  C:\Windows\System\QoXwwrM.exe
  2⤵
  PID:7264
- C:\Windows\System\pMWTKsm.exe
  C:\Windows\System\pMWTKsm.exe
  2⤵
  PID:7280
- C:\Windows\System\Ehmhxfq.exe
  C:\Windows\System\Ehmhxfq.exe
  2⤵
  PID:7296
- C:\Windows\System\Rdujuzy.exe
  C:\Windows\System\Rdujuzy.exe
  2⤵
  PID:7312
- C:\Windows\System\MxBedaL.exe
  C:\Windows\System\MxBedaL.exe
  2⤵
  PID:7360
- C:\Windows\System\EGFTMkd.exe
  C:\Windows\System\EGFTMkd.exe
  2⤵
  PID:7380
- C:\Windows\System\aiYbOQd.exe
  C:\Windows\System\aiYbOQd.exe
  2⤵
  PID:7396
- C:\Windows\System\lkTYpDr.exe
  C:\Windows\System\lkTYpDr.exe
  2⤵
  PID:7412
- C:\Windows\System\DfukawA.exe
  C:\Windows\System\DfukawA.exe
  2⤵
  PID:7428
- C:\Windows\System\WCKmqjD.exe
  C:\Windows\System\WCKmqjD.exe
  2⤵
  PID:7448
- C:\Windows\System\qVaomkY.exe
  C:\Windows\System\qVaomkY.exe
  2⤵
  PID:7468
- C:\Windows\System\iiAEAPt.exe
  C:\Windows\System\iiAEAPt.exe
  2⤵
  PID:7484
- C:\Windows\System\lJVkEiZ.exe
  C:\Windows\System\lJVkEiZ.exe
  2⤵
  PID:7520
- C:\Windows\System\cCOeSah.exe
  C:\Windows\System\cCOeSah.exe
  2⤵
  PID:7540
- C:\Windows\System\PoNwEgh.exe
  C:\Windows\System\PoNwEgh.exe
  2⤵
  PID:7556
- C:\Windows\System\qCJEZTY.exe
  C:\Windows\System\qCJEZTY.exe
  2⤵
  PID:7580
- C:\Windows\System\JggMppn.exe
  C:\Windows\System\JggMppn.exe
  2⤵
  PID:7612
- C:\Windows\System\UidCpkX.exe
  C:\Windows\System\UidCpkX.exe
  2⤵
  PID:7632
- C:\Windows\System\zdnyKfX.exe
  C:\Windows\System\zdnyKfX.exe
  2⤵
  PID:7652
- C:\Windows\System\kNQbJXn.exe
  C:\Windows\System\kNQbJXn.exe
  2⤵
  PID:7668
- C:\Windows\System\YAGwLOF.exe
  C:\Windows\System\YAGwLOF.exe
  2⤵
  PID:7684
- C:\Windows\System\iQJhRgq.exe
  C:\Windows\System\iQJhRgq.exe
  2⤵
  PID:7704
- C:\Windows\System\PwPlAWv.exe
  C:\Windows\System\PwPlAWv.exe
  2⤵
  PID:7728
- C:\Windows\System\APlCKHr.exe
  C:\Windows\System\APlCKHr.exe
  2⤵
  PID:7752
- C:\Windows\System\gdldDab.exe
  C:\Windows\System\gdldDab.exe
  2⤵
  PID:7768
- C:\Windows\System\inVcxEt.exe
  C:\Windows\System\inVcxEt.exe
  2⤵
  PID:7784
- C:\Windows\System\gaIYuys.exe
  C:\Windows\System\gaIYuys.exe
  2⤵
  PID:7800
- C:\Windows\System\EQaoAUa.exe
  C:\Windows\System\EQaoAUa.exe
  2⤵
  PID:7820
- C:\Windows\System\wnLqaQT.exe
  C:\Windows\System\wnLqaQT.exe
  2⤵
  PID:7852
- C:\Windows\System\trwabcc.exe
  C:\Windows\System\trwabcc.exe
  2⤵
  PID:7868
- C:\Windows\System\PldHYXa.exe
  C:\Windows\System\PldHYXa.exe
  2⤵
  PID:7888
- C:\Windows\System\UbvvOzX.exe
  C:\Windows\System\UbvvOzX.exe
  2⤵
  PID:7908
- C:\Windows\System\UvMtZfH.exe
  C:\Windows\System\UvMtZfH.exe
  2⤵
  PID:7924
- C:\Windows\System\eUndKRz.exe
  C:\Windows\System\eUndKRz.exe
  2⤵
  PID:7944
- C:\Windows\System\IyDeOlF.exe
  C:\Windows\System\IyDeOlF.exe
  2⤵
  PID:7960
- C:\Windows\System\wbIsTGL.exe
  C:\Windows\System\wbIsTGL.exe
  2⤵
  PID:7976
- C:\Windows\System\Oyeisow.exe
  C:\Windows\System\Oyeisow.exe
  2⤵
  PID:8000
- C:\Windows\System\ldTkLBn.exe
  C:\Windows\System\ldTkLBn.exe
  2⤵
  PID:8016
- C:\Windows\System\ZkYAfIn.exe
  C:\Windows\System\ZkYAfIn.exe
  2⤵
  PID:8032
- C:\Windows\System\xfcirAq.exe
  C:\Windows\System\xfcirAq.exe
  2⤵
  PID:8060
- C:\Windows\System\aVXrAbH.exe
  C:\Windows\System\aVXrAbH.exe
  2⤵
  PID:8076
- C:\Windows\System\ucYKBkY.exe
  C:\Windows\System\ucYKBkY.exe
  2⤵
  PID:8100
- C:\Windows\System\kzqCYyS.exe
  C:\Windows\System\kzqCYyS.exe
  2⤵
  PID:8136
- C:\Windows\System\DyrGyUT.exe
  C:\Windows\System\DyrGyUT.exe
  2⤵
  PID:8152
- C:\Windows\System\xaxKZTn.exe
  C:\Windows\System\xaxKZTn.exe
  2⤵
  PID:8172
- C:\Windows\System\LxmFmrE.exe
  C:\Windows\System\LxmFmrE.exe
  2⤵
  PID:8188
- C:\Windows\System\NsqclEF.exe
  C:\Windows\System\NsqclEF.exe
  2⤵
  PID:6208
- C:\Windows\System\SSlrzEA.exe
  C:\Windows\System\SSlrzEA.exe
  2⤵
  PID:7236
- C:\Windows\System\yZaFgmb.exe
  C:\Windows\System\yZaFgmb.exe
  2⤵
  PID:7252
- C:\Windows\System\KVgRjEP.exe
  C:\Windows\System\KVgRjEP.exe
  2⤵
  PID:7320
- C:\Windows\System\UaxSWBL.exe
  C:\Windows\System\UaxSWBL.exe
  2⤵
  PID:7340
- C:\Windows\System\WEdBHXW.exe
  C:\Windows\System\WEdBHXW.exe
  2⤵
  PID:7308
- C:\Windows\System\AGnWlWR.exe
  C:\Windows\System\AGnWlWR.exe
  2⤵
  PID:7240
- C:\Windows\System\aKGpAoK.exe
  C:\Windows\System\aKGpAoK.exe
  2⤵
  PID:7424
- C:\Windows\System\LrwBUoh.exe
  C:\Windows\System\LrwBUoh.exe
  2⤵
  PID:7500
- C:\Windows\System\EPoGhdP.exe
  C:\Windows\System\EPoGhdP.exe
  2⤵
  PID:7516
- C:\Windows\System\UGrzrTG.exe
  C:\Windows\System\UGrzrTG.exe
  2⤵
  PID:7436
- C:\Windows\System\Jhwlbxn.exe
  C:\Windows\System\Jhwlbxn.exe
  2⤵
  PID:7548
- C:\Windows\System\iAhyWFe.exe
  C:\Windows\System\iAhyWFe.exe
  2⤵
  PID:7536
- C:\Windows\System\bEmqcfP.exe
  C:\Windows\System\bEmqcfP.exe
  2⤵
  PID:7592
- C:\Windows\System\HJVmUlR.exe
  C:\Windows\System\HJVmUlR.exe
  2⤵
  PID:7628
- C:\Windows\System\YbPfhmK.exe
  C:\Windows\System\YbPfhmK.exe
  2⤵
  PID:7692
- C:\Windows\System\FdTQKEu.exe
  C:\Windows\System\FdTQKEu.exe
  2⤵
  PID:7748
- C:\Windows\System\OaZmFSr.exe
  C:\Windows\System\OaZmFSr.exe
  2⤵
  PID:7792
- C:\Windows\System\NsrddxW.exe
  C:\Windows\System\NsrddxW.exe
  2⤵
  PID:7816
- C:\Windows\System\uTdZOxp.exe
  C:\Windows\System\uTdZOxp.exe
  2⤵
  PID:7848
- C:\Windows\System\IYnLNsK.exe
  C:\Windows\System\IYnLNsK.exe
  2⤵
  PID:7916
- C:\Windows\System\qCDmZcc.exe
  C:\Windows\System\qCDmZcc.exe
  2⤵
  PID:7896
- C:\Windows\System\wEKeMIz.exe
  C:\Windows\System\wEKeMIz.exe
  2⤵
  PID:7932
- C:\Windows\System\gsocTBK.exe
  C:\Windows\System\gsocTBK.exe
  2⤵
  PID:7992
- C:\Windows\System\FJnQvAt.exe
  C:\Windows\System\FJnQvAt.exe
  2⤵
  PID:8072
- C:\Windows\System\vzYPyCt.exe
  C:\Windows\System\vzYPyCt.exe
  2⤵
  PID:8012
- C:\Windows\System\pHhaZSl.exe
  C:\Windows\System\pHhaZSl.exe
  2⤵
  PID:8112
- C:\Windows\System\YStRliS.exe
  C:\Windows\System\YStRliS.exe
  2⤵
  PID:8128
- C:\Windows\System\rxYMSes.exe
  C:\Windows\System\rxYMSes.exe
  2⤵
  PID:8168
- C:\Windows\System\CreJjYj.exe
  C:\Windows\System\CreJjYj.exe
  2⤵
  PID:8184
- C:\Windows\System\KwrziZB.exe
  C:\Windows\System\KwrziZB.exe
  2⤵
  PID:7324
- C:\Windows\System\DUWwlve.exe
  C:\Windows\System\DUWwlve.exe
  2⤵
  PID:7204
- C:\Windows\System\LRGDsGD.exe
  C:\Windows\System\LRGDsGD.exe
  2⤵
  PID:7348
- C:\Windows\System\PiYdpJI.exe
  C:\Windows\System\PiYdpJI.exe
  2⤵
  PID:7392
- C:\Windows\System\aAUQhDA.exe
  C:\Windows\System\aAUQhDA.exe
  2⤵
  PID:7496
- C:\Windows\System\XRjImSI.exe
  C:\Windows\System\XRjImSI.exe
  2⤵
  PID:7508
- C:\Windows\System\LKSHKaj.exe
  C:\Windows\System\LKSHKaj.exe
  2⤵
  PID:7552
- C:\Windows\System\ZDSeYhA.exe
  C:\Windows\System\ZDSeYhA.exe
  2⤵
  PID:7444
- C:\Windows\System\hQOHQVV.exe
  C:\Windows\System\hQOHQVV.exe
  2⤵
  PID:7640
- C:\Windows\System\PWUViNS.exe
  C:\Windows\System\PWUViNS.exe
  2⤵
  PID:7476
- C:\Windows\System\bfFWqLt.exe
  C:\Windows\System\bfFWqLt.exe
  2⤵
  PID:7776
- C:\Windows\System\IhHcQSu.exe
  C:\Windows\System\IhHcQSu.exe
  2⤵
  PID:7836
- C:\Windows\System\hccCgbG.exe
  C:\Windows\System\hccCgbG.exe
  2⤵
  PID:7968
- C:\Windows\System\kZcEJdz.exe
  C:\Windows\System\kZcEJdz.exe
  2⤵
  PID:8028
- C:\Windows\System\EBQxmrN.exe
  C:\Windows\System\EBQxmrN.exe
  2⤵
  PID:8144
- C:\Windows\System\sUELSxP.exe
  C:\Windows\System\sUELSxP.exe
  2⤵
  PID:7840
- C:\Windows\System\GpbbUCz.exe
  C:\Windows\System\GpbbUCz.exe
  2⤵
  PID:7996
- C:\Windows\System\hNtgmbA.exe
  C:\Windows\System\hNtgmbA.exe
  2⤵
  PID:7332
- C:\Windows\System\vkOOGDp.exe
  C:\Windows\System\vkOOGDp.exe
  2⤵
  PID:7184
- C:\Windows\System\xezyhYG.exe
  C:\Windows\System\xezyhYG.exe
  2⤵
  PID:7180
- C:\Windows\System\LhDytYt.exe
  C:\Windows\System\LhDytYt.exe
  2⤵
  PID:7828
- C:\Windows\System\nmBJnyH.exe
  C:\Windows\System\nmBJnyH.exe
  2⤵
  PID:7664
- C:\Windows\System\bidSLbK.exe
  C:\Windows\System\bidSLbK.exe
  2⤵
  PID:7376
- C:\Windows\System\hkJdvQS.exe
  C:\Windows\System\hkJdvQS.exe
  2⤵
  PID:8088
- C:\Windows\System\REebbjE.exe
  C:\Windows\System\REebbjE.exe
  2⤵
  PID:7192
- C:\Windows\System\ftRpNxT.exe
  C:\Windows\System\ftRpNxT.exe
  2⤵
  PID:8124
- C:\Windows\System\auvjjLT.exe
  C:\Windows\System\auvjjLT.exe
  2⤵
  PID:7608
- C:\Windows\System\xnnBCpO.exe
  C:\Windows\System\xnnBCpO.exe
  2⤵
  PID:7904
- C:\Windows\System\spQoFKy.exe
  C:\Windows\System\spQoFKy.exe
  2⤵
  PID:7288
- C:\Windows\System\lBBcuJe.exe
  C:\Windows\System\lBBcuJe.exe
  2⤵
  PID:7588
- C:\Windows\System\sVzeLcV.exe
  C:\Windows\System\sVzeLcV.exe
  2⤵
  PID:7388
- C:\Windows\System\JtDzEUg.exe
  C:\Windows\System\JtDzEUg.exe
  2⤵
  PID:7900
- C:\Windows\System\muFMNDB.exe
  C:\Windows\System\muFMNDB.exe
  2⤵
  PID:7408
- C:\Windows\System\uevVipD.exe
  C:\Windows\System\uevVipD.exe
  2⤵
  PID:7676
- C:\Windows\System\zuMqHQp.exe
  C:\Windows\System\zuMqHQp.exe
  2⤵
  PID:7716
- C:\Windows\System\uKwqreE.exe
  C:\Windows\System\uKwqreE.exe
  2⤵
  PID:7220
- C:\Windows\System\JSZRbHj.exe
  C:\Windows\System\JSZRbHj.exe
  2⤵
  PID:7564
- C:\Windows\System\sHZtgLA.exe
  C:\Windows\System\sHZtgLA.exe
  2⤵
  PID:8096
- C:\Windows\System\ojsFKUc.exe
  C:\Windows\System\ojsFKUc.exe
  2⤵
  PID:7352
- C:\Windows\System\ceEiPDd.exe
  C:\Windows\System\ceEiPDd.exe
  2⤵
  PID:7724
- C:\Windows\System\FBmPaVS.exe
  C:\Windows\System\FBmPaVS.exe
  2⤵
  PID:7532
- C:\Windows\System\Uywdpsh.exe
  C:\Windows\System\Uywdpsh.exe
  2⤵
  PID:7764
- C:\Windows\System\nhmfqAv.exe
  C:\Windows\System\nhmfqAv.exe
  2⤵
  PID:8196
- C:\Windows\System\NigMpuw.exe
  C:\Windows\System\NigMpuw.exe
  2⤵
  PID:8232
- C:\Windows\System\RYfKemr.exe
  C:\Windows\System\RYfKemr.exe
  2⤵
  PID:8248
- C:\Windows\System\wgdUyAb.exe
  C:\Windows\System\wgdUyAb.exe
  2⤵
  PID:8264
- C:\Windows\System\kgHjRti.exe
  C:\Windows\System\kgHjRti.exe
  2⤵
  PID:8280
- C:\Windows\System\ILKCJHk.exe
  C:\Windows\System\ILKCJHk.exe
  2⤵
  PID:8296
- C:\Windows\System\eAvzYuk.exe
  C:\Windows\System\eAvzYuk.exe
  2⤵
  PID:8312
- C:\Windows\System\pRhLcWw.exe
  C:\Windows\System\pRhLcWw.exe
  2⤵
  PID:8348
- C:\Windows\System\NUmiSBk.exe
  C:\Windows\System\NUmiSBk.exe
  2⤵
  PID:8364
- C:\Windows\System\zkUPMzm.exe
  C:\Windows\System\zkUPMzm.exe
  2⤵
  PID:8380
- C:\Windows\System\ZTEPNwI.exe
  C:\Windows\System\ZTEPNwI.exe
  2⤵
  PID:8404
- C:\Windows\System\lIjnfLK.exe
  C:\Windows\System\lIjnfLK.exe
  2⤵
  PID:8420
- C:\Windows\System\bLmsMDd.exe
  C:\Windows\System\bLmsMDd.exe
  2⤵
  PID:8436
- C:\Windows\System\KvOKuON.exe
  C:\Windows\System\KvOKuON.exe
  2⤵
  PID:8452
- C:\Windows\System\RFGFEfD.exe
  C:\Windows\System\RFGFEfD.exe
  2⤵
  PID:8472
- C:\Windows\System\tlhtgAC.exe
  C:\Windows\System\tlhtgAC.exe
  2⤵
  PID:8508
- C:\Windows\System\JCIEMTm.exe
  C:\Windows\System\JCIEMTm.exe
  2⤵
  PID:8532
- C:\Windows\System\sTwmUxh.exe
  C:\Windows\System\sTwmUxh.exe
  2⤵
  PID:8548
- C:\Windows\System\rmWaDWh.exe
  C:\Windows\System\rmWaDWh.exe
  2⤵
  PID:8564
- C:\Windows\System\QoEzzQf.exe
  C:\Windows\System\QoEzzQf.exe
  2⤵
  PID:8580
- C:\Windows\System\RWnIMWP.exe
  C:\Windows\System\RWnIMWP.exe
  2⤵
  PID:8596
- C:\Windows\System\ZwVyoWd.exe
  C:\Windows\System\ZwVyoWd.exe
  2⤵
  PID:8628
- C:\Windows\System\NttpxLj.exe
  C:\Windows\System\NttpxLj.exe
  2⤵
  PID:8648
- C:\Windows\System\WhcyeOS.exe
  C:\Windows\System\WhcyeOS.exe
  2⤵
  PID:8664
- C:\Windows\System\xLisYbB.exe
  C:\Windows\System\xLisYbB.exe
  2⤵
  PID:8684
- C:\Windows\System\GoWVpCN.exe
  C:\Windows\System\GoWVpCN.exe
  2⤵
  PID:8700
- C:\Windows\System\bjCxDbY.exe
  C:\Windows\System\bjCxDbY.exe
  2⤵
  PID:8716
- C:\Windows\System\hvjBQZO.exe
  C:\Windows\System\hvjBQZO.exe
  2⤵
  PID:8736
- C:\Windows\System\YpGtrKy.exe
  C:\Windows\System\YpGtrKy.exe
  2⤵
  PID:8756
- C:\Windows\System\ThCKNVJ.exe
  C:\Windows\System\ThCKNVJ.exe
  2⤵
  PID:8776
- C:\Windows\System\pWAyUtv.exe
  C:\Windows\System\pWAyUtv.exe
  2⤵
  PID:8792
- C:\Windows\System\rbVtiMA.exe
  C:\Windows\System\rbVtiMA.exe
  2⤵
  PID:8808
- C:\Windows\System\SoyBDnP.exe
  C:\Windows\System\SoyBDnP.exe
  2⤵
  PID:8828
- C:\Windows\System\jBZGVxe.exe
  C:\Windows\System\jBZGVxe.exe
  2⤵
  PID:8844
- C:\Windows\System\WywLITM.exe
  C:\Windows\System\WywLITM.exe
  2⤵
  PID:8860
- C:\Windows\System\MsPeOZy.exe
  C:\Windows\System\MsPeOZy.exe
  2⤵
  PID:8904
- C:\Windows\System\gbGTtSR.exe
  C:\Windows\System\gbGTtSR.exe
  2⤵
  PID:8920
- C:\Windows\System\nZsbGcz.exe
  C:\Windows\System\nZsbGcz.exe
  2⤵
  PID:8936
- C:\Windows\System\HtOgLoZ.exe
  C:\Windows\System\HtOgLoZ.exe
  2⤵
  PID:8952
- C:\Windows\System\GXAbfzk.exe
  C:\Windows\System\GXAbfzk.exe
  2⤵
  PID:8968
- C:\Windows\System\pTasYrq.exe
  C:\Windows\System\pTasYrq.exe
  2⤵
  PID:8984
- C:\Windows\System\QDGkNsm.exe
  C:\Windows\System\QDGkNsm.exe
  2⤵
  PID:9000
- C:\Windows\System\NyfMQiq.exe
  C:\Windows\System\NyfMQiq.exe
  2⤵
  PID:9016
- C:\Windows\System\xGyfzbk.exe
  C:\Windows\System\xGyfzbk.exe
  2⤵
  PID:9032
- C:\Windows\System\HgsWiXL.exe
  C:\Windows\System\HgsWiXL.exe
  2⤵
  PID:9060
- C:\Windows\System\hQUzWDl.exe
  C:\Windows\System\hQUzWDl.exe
  2⤵
  PID:9120
- C:\Windows\System\RIFDHtt.exe
  C:\Windows\System\RIFDHtt.exe
  2⤵
  PID:9136
- C:\Windows\System\mcoqRGH.exe
  C:\Windows\System\mcoqRGH.exe
  2⤵
  PID:9156
- C:\Windows\System\Nhsgsyx.exe
  C:\Windows\System\Nhsgsyx.exe
  2⤵
  PID:9176
- C:\Windows\System\mTojGas.exe
  C:\Windows\System\mTojGas.exe
  2⤵
  PID:9192
- C:\Windows\System\uYxakzQ.exe
  C:\Windows\System\uYxakzQ.exe
  2⤵
  PID:6596
- C:\Windows\System\qvGtqBS.exe
  C:\Windows\System\qvGtqBS.exe
  2⤵
  PID:8092
- C:\Windows\System\UvkrQns.exe
  C:\Windows\System\UvkrQns.exe
  2⤵
  PID:8008
- C:\Windows\System\WLVkwBN.exe
  C:\Windows\System\WLVkwBN.exe
  2⤵
  PID:8212
- C:\Windows\System\ScztuvN.exe
  C:\Windows\System\ScztuvN.exe
  2⤵
  PID:8260
- C:\Windows\System\GrtipQI.exe
  C:\Windows\System\GrtipQI.exe
  2⤵
  PID:8344
- C:\Windows\System\alCCBAi.exe
  C:\Windows\System\alCCBAi.exe
  2⤵
  PID:8240
- C:\Windows\System\XrqDsLO.exe
  C:\Windows\System\XrqDsLO.exe
  2⤵
  PID:7208
- C:\Windows\System\LXdiAuD.exe
  C:\Windows\System\LXdiAuD.exe
  2⤵
  PID:8308
- C:\Windows\System\FHljhdm.exe
  C:\Windows\System\FHljhdm.exe
  2⤵
  PID:8448
- C:\Windows\System\NSByxlp.exe
  C:\Windows\System\NSByxlp.exe
  2⤵
  PID:8392
- C:\Windows\System\GLkAZrc.exe
  C:\Windows\System\GLkAZrc.exe
  2⤵
  PID:8432
- C:\Windows\System\QawrXYY.exe
  C:\Windows\System\QawrXYY.exe
  2⤵
  PID:8492
- C:\Windows\System\vBrZnyL.exe
  C:\Windows\System\vBrZnyL.exe
  2⤵
  PID:8500
- C:\Windows\System\ZdmEXQS.exe
  C:\Windows\System\ZdmEXQS.exe
  2⤵
  PID:8604
- C:\Windows\System\FKPVQHn.exe
  C:\Windows\System\FKPVQHn.exe
  2⤵
  PID:8624
- C:\Windows\System\mXzxOiy.exe
  C:\Windows\System\mXzxOiy.exe
  2⤵
  PID:8560
- C:\Windows\System\ksBiJSJ.exe
  C:\Windows\System\ksBiJSJ.exe
  2⤵
  PID:8640
- C:\Windows\System\uMzRemV.exe
  C:\Windows\System\uMzRemV.exe
  2⤵
  PID:8784
- C:\Windows\System\pZQrkYf.exe
  C:\Windows\System\pZQrkYf.exe
  2⤵
  PID:8724
- C:\Windows\System\MZfeNZg.exe
  C:\Windows\System\MZfeNZg.exe
  2⤵
  PID:8868
- C:\Windows\System\djxUSjl.exe
  C:\Windows\System\djxUSjl.exe
  2⤵
  PID:8728
- C:\Windows\System\YFHfyPc.exe
  C:\Windows\System\YFHfyPc.exe
  2⤵
  PID:8772
- C:\Windows\System\JnfWobL.exe
  C:\Windows\System\JnfWobL.exe
  2⤵
  PID:8872
- C:\Windows\System\quzFuBN.exe
  C:\Windows\System\quzFuBN.exe
  2⤵
  PID:8928
- C:\Windows\System\WbcPTsr.exe
  C:\Windows\System\WbcPTsr.exe
  2⤵
  PID:9072
- C:\Windows\System\faWHonU.exe
  C:\Windows\System\faWHonU.exe
  2⤵
  PID:9040
- C:\Windows\System\vvpWWOR.exe
  C:\Windows\System\vvpWWOR.exe
  2⤵
  PID:8816
- C:\Windows\System\xsgeIpY.exe
  C:\Windows\System\xsgeIpY.exe
  2⤵
  PID:9100
- C:\Windows\System\dCiyMsR.exe
  C:\Windows\System\dCiyMsR.exe
  2⤵
  PID:8944
- C:\Windows\System\XUieMqg.exe
  C:\Windows\System\XUieMqg.exe
  2⤵
  PID:9008
- C:\Windows\System\rFXHRgt.exe
  C:\Windows\System\rFXHRgt.exe
  2⤵
  PID:9164
- C:\Windows\System\RuARzrB.exe
  C:\Windows\System\RuARzrB.exe
  2⤵
  PID:9152
- C:\Windows\System\HDOQaet.exe
  C:\Windows\System\HDOQaet.exe
  2⤵
  PID:7864
- C:\Windows\System\fNLJsQB.exe
  C:\Windows\System\fNLJsQB.exe
  2⤵
  PID:7696
- C:\Windows\System\ogGvEWt.exe
  C:\Windows\System\ogGvEWt.exe
  2⤵
  PID:7832
- C:\Windows\System\WrFtEMF.exe
  C:\Windows\System\WrFtEMF.exe
  2⤵
  PID:8256
- C:\Windows\System\leSROnB.exe
  C:\Windows\System\leSROnB.exe
  2⤵
  PID:8376
- C:\Windows\System\ajdwcFh.exe
  C:\Windows\System\ajdwcFh.exe
  2⤵
  PID:8356
- C:\Windows\System\nkDsirz.exe
  C:\Windows\System\nkDsirz.exe
  2⤵
  PID:8464
- C:\Windows\System\bKlOfQE.exe
  C:\Windows\System\bKlOfQE.exe
  2⤵
  PID:8516
- C:\Windows\System\BSjlVTN.exe
  C:\Windows\System\BSjlVTN.exe
  2⤵
  PID:8572
- C:\Windows\System\wxnATPc.exe
  C:\Windows\System\wxnATPc.exe
  2⤵
  PID:8524
- C:\Windows\System\pmLuAKF.exe
  C:\Windows\System\pmLuAKF.exe
  2⤵
  PID:8592
- C:\Windows\System\HBiPVsd.exe
  C:\Windows\System\HBiPVsd.exe
  2⤵
  PID:8708
- C:\Windows\System\gIfiIli.exe
  C:\Windows\System\gIfiIli.exe
  2⤵
  PID:8768
- C:\Windows\System\XDWHJHb.exe
  C:\Windows\System\XDWHJHb.exe
  2⤵
  PID:8840
- C:\Windows\System\nyGFWgv.exe
  C:\Windows\System\nyGFWgv.exe
  2⤵
  PID:8964
- C:\Windows\System\jhRtpLl.exe
  C:\Windows\System\jhRtpLl.exe
  2⤵
  PID:9024
- C:\Windows\System\CBhIXdf.exe
  C:\Windows\System\CBhIXdf.exe
  2⤵
  PID:8820
- C:\Windows\System\wFUqJmT.exe
  C:\Windows\System\wFUqJmT.exe
  2⤵
  PID:8912
- C:\Windows\System\fNAkYIi.exe
  C:\Windows\System\fNAkYIi.exe
  2⤵
  PID:9168
- C:\Windows\System\NrtneCz.exe
  C:\Windows\System\NrtneCz.exe
  2⤵
  PID:9144
- C:\Windows\System\OUQquVr.exe
  C:\Windows\System\OUQquVr.exe
  2⤵
  PID:8228
- C:\Windows\System\lplMKWw.exe
  C:\Windows\System\lplMKWw.exe
  2⤵
  PID:8388
- C:\Windows\System\uxIUknH.exe
  C:\Windows\System\uxIUknH.exe
  2⤵
  PID:8400
- C:\Windows\System\IvQuwam.exe
  C:\Windows\System\IvQuwam.exe
  2⤵
  PID:8328
- C:\Windows\System\VXTRwYj.exe
  C:\Windows\System\VXTRwYj.exe
  2⤵
  PID:8220
- C:\Windows\System\njkPYAb.exe
  C:\Windows\System\njkPYAb.exe
  2⤵
  PID:8616
- C:\Windows\System\iNoeywz.exe
  C:\Windows\System\iNoeywz.exe
  2⤵
  PID:8636
- C:\Windows\System\UOHCjDT.exe
  C:\Windows\System\UOHCjDT.exe
  2⤵
  PID:8556
- C:\Windows\System\UnwEQKd.exe
  C:\Windows\System\UnwEQKd.exe
  2⤵
  PID:8804
- C:\Windows\System\TqdHVls.exe
  C:\Windows\System\TqdHVls.exe
  2⤵
  PID:7720
- C:\Windows\System\SyVHhqQ.exe
  C:\Windows\System\SyVHhqQ.exe
  2⤵
  PID:9092
- C:\Windows\System\UPXYNVR.exe
  C:\Windows\System\UPXYNVR.exe
  2⤵
  PID:9108
- C:\Windows\System\ikVJHxq.exe
  C:\Windows\System\ikVJHxq.exe
  2⤵
  PID:9148
- C:\Windows\System\AxfUTvV.exe
  C:\Windows\System\AxfUTvV.exe
  2⤵
  PID:8048
- C:\Windows\System\kZomvgB.exe
  C:\Windows\System\kZomvgB.exe
  2⤵
  PID:9208
- C:\Windows\System\szBpiny.exe
  C:\Windows\System\szBpiny.exe
  2⤵
  PID:8680
- C:\Windows\System\tcAEVOd.exe
  C:\Windows\System\tcAEVOd.exe
  2⤵
  PID:8324
- C:\Windows\System\kaHJPTZ.exe
  C:\Windows\System\kaHJPTZ.exe
  2⤵
  PID:8852
- C:\Windows\System\zdyvIfI.exe
  C:\Windows\System\zdyvIfI.exe
  2⤵
  PID:7956
- C:\Windows\System\WAHEzqe.exe
  C:\Windows\System\WAHEzqe.exe
  2⤵
  PID:9080
- C:\Windows\System\YZMsbOC.exe
  C:\Windows\System\YZMsbOC.exe
  2⤵
  PID:8992
- C:\Windows\System\iSyriUN.exe
  C:\Windows\System\iSyriUN.exe
  2⤵
  PID:8612
- C:\Windows\System\XQpDVuh.exe
  C:\Windows\System\XQpDVuh.exe
  2⤵
  PID:8888
- C:\Windows\System\JspFsTf.exe
  C:\Windows\System\JspFsTf.exe
  2⤵
  PID:9056
- C:\Windows\System\BEgDsax.exe
  C:\Windows\System\BEgDsax.exe
  2⤵
  PID:8204
- C:\Windows\System\tapnlki.exe
  C:\Windows\System\tapnlki.exe
  2⤵
  PID:8948
- C:\Windows\System\iEeQnDK.exe
  C:\Windows\System\iEeQnDK.exe
  2⤵
  PID:8320
- C:\Windows\System\LsFSNLV.exe
  C:\Windows\System\LsFSNLV.exe
  2⤵
  PID:9224
- C:\Windows\System\rtlrAQQ.exe
  C:\Windows\System\rtlrAQQ.exe
  2⤵
  PID:9240
- C:\Windows\System\IwoAGBX.exe
  C:\Windows\System\IwoAGBX.exe
  2⤵
  PID:9260
- C:\Windows\System\HvDkBAO.exe
  C:\Windows\System\HvDkBAO.exe
  2⤵
  PID:9284
- C:\Windows\System\vQzRFty.exe
  C:\Windows\System\vQzRFty.exe
  2⤵
  PID:9316
- C:\Windows\System\tghKqFu.exe
  C:\Windows\System\tghKqFu.exe
  2⤵
  PID:9332
- C:\Windows\System\RDYjikg.exe
  C:\Windows\System\RDYjikg.exe
  2⤵
  PID:9356
- C:\Windows\System\ecMzPip.exe
  C:\Windows\System\ecMzPip.exe
  2⤵
  PID:9380
- C:\Windows\System\jVCnGEE.exe
  C:\Windows\System\jVCnGEE.exe
  2⤵
  PID:9404
- C:\Windows\System\ezQtQIK.exe
  C:\Windows\System\ezQtQIK.exe
  2⤵
  PID:9424
- C:\Windows\System\WgzuOpZ.exe
  C:\Windows\System\WgzuOpZ.exe
  2⤵
  PID:9444
- C:\Windows\System\cXKjrMN.exe
  C:\Windows\System\cXKjrMN.exe
  2⤵
  PID:9464
- C:\Windows\System\eBOykyT.exe
  C:\Windows\System\eBOykyT.exe
  2⤵
  PID:9488
- C:\Windows\System\KzhVxrv.exe
  C:\Windows\System\KzhVxrv.exe
  2⤵
  PID:9504
- C:\Windows\System\YMCDpds.exe
  C:\Windows\System\YMCDpds.exe
  2⤵
  PID:9524
- C:\Windows\System\MktrKej.exe
  C:\Windows\System\MktrKej.exe
  2⤵
  PID:9540
- C:\Windows\System\jAnOlnL.exe
  C:\Windows\System\jAnOlnL.exe
  2⤵
  PID:9560
- C:\Windows\System\fxvblYc.exe
  C:\Windows\System\fxvblYc.exe
  2⤵
  PID:9580
- C:\Windows\System\BFMfyoq.exe
  C:\Windows\System\BFMfyoq.exe
  2⤵
  PID:9624
- C:\Windows\System\AbjKNIo.exe
  C:\Windows\System\AbjKNIo.exe
  2⤵
  PID:9644
- C:\Windows\System\BvJsGad.exe
  C:\Windows\System\BvJsGad.exe
  2⤵
  PID:9672
- C:\Windows\System\lWKJvtP.exe
  C:\Windows\System\lWKJvtP.exe
  2⤵
  PID:9688
- C:\Windows\System\UxPqgli.exe
  C:\Windows\System\UxPqgli.exe
  2⤵
  PID:9704
- C:\Windows\System\CBXtvwu.exe
  C:\Windows\System\CBXtvwu.exe
  2⤵
  PID:9724
- C:\Windows\System\UFAcVba.exe
  C:\Windows\System\UFAcVba.exe
  2⤵
  PID:9740
- C:\Windows\System\viVfLAt.exe
  C:\Windows\System\viVfLAt.exe
  2⤵
  PID:9756
- C:\Windows\System\xoFnBjS.exe
  C:\Windows\System\xoFnBjS.exe
  2⤵
  PID:9772
- C:\Windows\System\iDgfhtI.exe
  C:\Windows\System\iDgfhtI.exe
  2⤵
  PID:9792
- C:\Windows\System\AaKaKOV.exe
  C:\Windows\System\AaKaKOV.exe
  2⤵
  PID:9812
- C:\Windows\System\YQyvAAv.exe
  C:\Windows\System\YQyvAAv.exe
  2⤵
  PID:9836
- C:\Windows\System\uDhoLfQ.exe
  C:\Windows\System\uDhoLfQ.exe
  2⤵
  PID:9860
- C:\Windows\System\idCMjyp.exe
  C:\Windows\System\idCMjyp.exe
  2⤵
  PID:9876
- C:\Windows\System\NWHAtyp.exe
  C:\Windows\System\NWHAtyp.exe
  2⤵
  PID:9900
- C:\Windows\System\qEKkABg.exe
  C:\Windows\System\qEKkABg.exe
  2⤵
  PID:9936
- C:\Windows\System\QOEJEAV.exe
  C:\Windows\System\QOEJEAV.exe
  2⤵
  PID:9956
- C:\Windows\System\mAiWgCc.exe
  C:\Windows\System\mAiWgCc.exe
  2⤵
  PID:9972
- C:\Windows\System\CbawgXL.exe
  C:\Windows\System\CbawgXL.exe
  2⤵
  PID:9992
- C:\Windows\System\ymUSnMV.exe
  C:\Windows\System\ymUSnMV.exe
  2⤵
  PID:10008
- C:\Windows\System\bUfYJEk.exe
  C:\Windows\System\bUfYJEk.exe
  2⤵
  PID:10028
- C:\Windows\System\VFNfsjV.exe
  C:\Windows\System\VFNfsjV.exe
  2⤵
  PID:10044
- C:\Windows\System\bnOBXvC.exe
  C:\Windows\System\bnOBXvC.exe
  2⤵
  PID:10060
- C:\Windows\System\kaSFMUW.exe
  C:\Windows\System\kaSFMUW.exe
  2⤵
  PID:10076
- C:\Windows\System\ClpULrW.exe
  C:\Windows\System\ClpULrW.exe
  2⤵
  PID:10092
- C:\Windows\System\HkdRlvE.exe
  C:\Windows\System\HkdRlvE.exe
  2⤵
  PID:10112
- C:\Windows\System\YVFTLIS.exe
  C:\Windows\System\YVFTLIS.exe
  2⤵
  PID:10128
- C:\Windows\System\LFFjAPz.exe
  C:\Windows\System\LFFjAPz.exe
  2⤵
  PID:10144
- C:\Windows\System\ilBBOQw.exe
  C:\Windows\System\ilBBOQw.exe
  2⤵
  PID:10164
- C:\Windows\System\BitSoPA.exe
  C:\Windows\System\BitSoPA.exe
  2⤵
  PID:10192
- C:\Windows\System\qyzbcFN.exe
  C:\Windows\System\qyzbcFN.exe
  2⤵
  PID:10212
- C:\Windows\System\bukwwcU.exe
  C:\Windows\System\bukwwcU.exe
  2⤵
  PID:10236
- C:\Windows\System\ImbWYNm.exe
  C:\Windows\System\ImbWYNm.exe
  2⤵
  PID:8336
- C:\Windows\System\VnEFTdw.exe
  C:\Windows\System\VnEFTdw.exe
  2⤵
  PID:9248
- C:\Windows\System\xseHPOU.exe
  C:\Windows\System\xseHPOU.exe
  2⤵
  PID:9300
- C:\Windows\System\IQoWEgh.exe
  C:\Windows\System\IQoWEgh.exe
  2⤵
  PID:9268
- C:\Windows\System\vVvDeJQ.exe
  C:\Windows\System\vVvDeJQ.exe
  2⤵
  PID:9344
- C:\Windows\System\NluJlMU.exe
  C:\Windows\System\NluJlMU.exe
  2⤵
  PID:9388
- C:\Windows\System\ZIZSFok.exe
  C:\Windows\System\ZIZSFok.exe
  2⤵
  PID:9324
- C:\Windows\System\lROvpoW.exe
  C:\Windows\System\lROvpoW.exe
  2⤵
  PID:9368
- C:\Windows\System\zBFkNUz.exe
  C:\Windows\System\zBFkNUz.exe
  2⤵
  PID:9512
- C:\Windows\System\pNsznau.exe
  C:\Windows\System\pNsznau.exe
  2⤵
  PID:9556
- C:\Windows\System\gUBaplc.exe
  C:\Windows\System\gUBaplc.exe
  2⤵
  PID:9496
- C:\Windows\System\wOZgzzt.exe
  C:\Windows\System\wOZgzzt.exe
  2⤵
  PID:9576
- C:\Windows\System\nFclDgs.exe
  C:\Windows\System\nFclDgs.exe
  2⤵
  PID:9636
- C:\Windows\System\WgjFDvL.exe
  C:\Windows\System\WgjFDvL.exe
  2⤵
  PID:9660
- C:\Windows\System\cWYHhnO.exe
  C:\Windows\System\cWYHhnO.exe
  2⤵
  PID:9684
- C:\Windows\System\MprCTdc.exe
  C:\Windows\System\MprCTdc.exe
  2⤵
  PID:9748
- C:\Windows\System\CruXXOJ.exe
  C:\Windows\System\CruXXOJ.exe
  2⤵
  PID:9800
- C:\Windows\System\hcIKEYI.exe
  C:\Windows\System\hcIKEYI.exe
  2⤵
  PID:9852
- C:\Windows\System\lkSmCEU.exe
  C:\Windows\System\lkSmCEU.exe
  2⤵
  PID:9784
- C:\Windows\System\KBiEMSN.exe
  C:\Windows\System\KBiEMSN.exe
  2⤵
  PID:9908
- C:\Windows\System\NbYauYq.exe
  C:\Windows\System\NbYauYq.exe
  2⤵
  PID:9832
- C:\Windows\System\sThoDhA.exe
  C:\Windows\System\sThoDhA.exe
  2⤵
  PID:9944
- C:\Windows\System\krvuswT.exe
  C:\Windows\System\krvuswT.exe
  2⤵
  PID:9984
- C:\Windows\System\XpPvJAu.exe
  C:\Windows\System\XpPvJAu.exe
  2⤵
  PID:10052
- C:\Windows\System\CKERPFy.exe
  C:\Windows\System\CKERPFy.exe
  2⤵
  PID:10036
- C:\Windows\System\drbdLvb.exe
  C:\Windows\System\drbdLvb.exe
  2⤵
  PID:10100
- C:\Windows\System\WLvQQof.exe
  C:\Windows\System\WLvQQof.exe
  2⤵
  PID:10156
- C:\Windows\System\DfVMVmM.exe
  C:\Windows\System\DfVMVmM.exe
  2⤵
  PID:10204
- C:\Windows\System\jttyaTh.exe
  C:\Windows\System\jttyaTh.exe
  2⤵
  PID:8744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AOUsnRi.exe

Filesize
3.2MB

MD5
3506619375cdd45d8da0d962be612272

SHA1
881df62f0606653f6cac9e50176a92aa92d5c495

SHA256
9712e4e20cb5a925cd37b13b76499e9274da7fd135c6559ab1855182152e25bb

SHA512
ac643704ad06aeefaf628b8c35815556c7a8c8ffaaf36395ebe220aa2eed3c7ec7555e95868b3333a9180978e3d103e9284275c28efc8e600615f7cd9a3ebcae

Download Submit
C:\Windows\system\AaUGCZq.exe

Filesize
3.2MB

MD5
c616972821f2befee0e4031f6723c50c

SHA1
b548f6c81b03ba7a6aca6848abfd63c4bbf2ac7b

SHA256
8edb2254eca860478b7557cad8af91e3c7b83a390edb78566461fc33ed236067

SHA512
e26eab8120a9f32d83f187fe4d0357daf089ffdc73c035a2eae2cce83bc8e4b9e70372b76182842c2ed21d0e31bd542246029177890f59a933875d61ae6b6ae2

Download Submit
C:\Windows\system\DuHKriI.exe

Filesize
3.2MB

MD5
de2e66631f9818f5755f2cef027bd6df

SHA1
3d4a36ea9b6c567c9e798a9683e737092b173ba5

SHA256
4aa8e9b696b127755f5c84ac6f4d920d28bbb2d1d3ded4e52eb886eeef5cd6a4

SHA512
fbeb0187bea9c520f6ddf3d015c6f13aea3e7052ffce9d2597230de2e3b2a598047ba33285f5129efc3077209ce1e9668cb5bed5492577dbdb61ed8b35d42c7c

Download Submit
C:\Windows\system\EeYZnzi.exe

Filesize
3.2MB

MD5
5fcf28d3973ffb84dd2ab9ea7150a722

SHA1
66422cf3476ccaaeb14759a04094e118bc8a82d1

SHA256
ca5c5a7dff22abbd0d9825aac8aa7da0fd7928735e789795f636f962b6eea97f

SHA512
bef3ed5b5a92a84942f0a908b050f2f9e326303ed60d40b06404cd842ac6dc661e813a5ed25643ff1c196a06f8d1778371ba2e76b366caae93d662e8880143a3

Download Submit
C:\Windows\system\HHIQzmG.exe

Filesize
3.2MB

MD5
92139af815668016084dc06011741c77

SHA1
88a393d69117475392ee709e22cc15dd29f8e778

SHA256
9a342dc8f7d42a6ae9b5d1c8262c0ca96f2239b5ea82d3c3cb508dfa53a42f4e

SHA512
0c06b3a78e37599f1e922d4a21acf17b93f0178003cc1b279de94df221414344b598a8bd2c99db50cf1779373381864641a789bdc791f6e6b068c037fc379fbe

Download Submit
C:\Windows\system\HInewvm.exe

Filesize
3.2MB

MD5
bf96d09688f6df047a63c5d507ca8c7c

SHA1
99331976248bc0be1806c4786df0b7c2649f65c7

SHA256
22b50803c5aaa0b19c24395b13bd53bbcb89f72f567770524f64de9246bf3662

SHA512
c4a1fad7547b7b8f95a13fced7f3b72da29b35ee7b053fe365cc3914d8bb87029d173ad96b5d426277e0af3e66651e0694f76fb2cdf360587406d00c5bddd1b0

Download Submit
C:\Windows\system\IbAFRZB.exe

Filesize
3.2MB

MD5
cd9b603542771eec4acfc6856575ee2b

SHA1
1a5b2d121e93c270f90c03d746db04d024ab7bf8

SHA256
59d0b21537a8f964935ef582e61368716330f53d53bd011c6aa90f901eef9aab

SHA512
56880b46fc0deabe71bb821f22e79adc5eedf835de40e471158f8380e02c8bd664022b91de04370aaa20d427333406096f2291cfecfc7a6d356220eff767b6a5

Download Submit
C:\Windows\system\PxwOSNU.exe

Filesize
3.2MB

MD5
4585416bd6776ef5ab7be22ae612613f

SHA1
ed8f02554d9f1a5faf0742b0398299b2307663f3

SHA256
2b00257f808fc2e93afee61e7a848edba56713736b3e71905d047fe24eca53cd

SHA512
dfb0623657420f984261984abf10872ff5ab5b051a6a6ec85a6d00f49ac677446953de03bccc65c1dcf710613fb6db1b4419e67fe3f1c5affb16cb9c61e80712

Download Submit
C:\Windows\system\VkVVbbT.exe

Filesize
3.2MB

MD5
50d60e604e6d623ff855776d639e9422

SHA1
7a7ba84af8e5f2745b64f213c364d6c4c8b7b988

SHA256
0ba488fc8c5da7d2dde89800a395dfdb122f0e24e5a10b112a2d389c0f73065b

SHA512
271d17d0ef65ebd71cf0a53a4afb5e3a26a5ba20db29ff4c338268e03c53caa2aea6652b80aae3723b27715c36f387ef1371440c53565530120b0dbe82cd6038

Download Submit
C:\Windows\system\WTHmJHk.exe

Filesize
3.2MB

MD5
e64a6162684db2634093723701899f33

SHA1
e0fd4228e3a08e77c67d042cf918ef6d7ba13fe8

SHA256
d983497824f950e8f90f88345dd8f8e2b1ba6bcc982fc552f372a5dbfa77b866

SHA512
55ec77dbf9d65b2815c3f0b4cc0962d2166555c9d4e00d0cee4940c4a5548a1352999342925d77f325acf753c67817e82657641bf18131a7515d4da08b283ea8

Download Submit
C:\Windows\system\WcjJcoe.exe

Filesize
3.2MB

MD5
3e9678286ab0f838a88fe0ae93e99c51

SHA1
b561f7875eea5720052fe5b0a54958912382d1aa

SHA256
e7d4c50584b30f624259d02c37c86ef0337d679192b8c2ef1c178aa2cc742c41

SHA512
0fb52c9f052e171b806d9cd2b69124dcbad49fa4c2bc90d9d1fad5cccc549035791b2888d0bbec47fe919cc07a0403e5471cf6e6bb0754553c2605b08350c7dd

Download Submit
C:\Windows\system\XwlNmlW.exe

Filesize
3.2MB

MD5
2efc525033c5c8c422a724e98a58927f

SHA1
0e0ce09878ca905565d6ec7dee5c9fae7169316c

SHA256
e7c5630f217085a715fc051c0356bb85d041eba4b6d504e4c1e2c2576e28a2e2

SHA512
63de79770645343de23b7778914d320f9966c2f318aebe45db89089686b15c5ab54d03cbaed9e6f1e237adf8b5968c4e6d101e7b0e6dd86bfefe47788704f590

Download Submit
C:\Windows\system\YYsBvez.exe

Filesize
3.2MB

MD5
cc5db6e36c4d5a028391614eabafed7b

SHA1
15ba852eeac0a41c888a1fc11776bf76e09e1f28

SHA256
b9e3c7db87482884caba45f5f7bf12d3de8d7b1b69d62ac967466171cd6ce4d0

SHA512
86c5088924f4c643975bd7828ad09f8b78a565d186c8a73b3117c6636ff220f591ff1fc94f5d7c5cec8c498c3e7b8da88f994f58aaebb70fff96cabddc427c14

Download Submit
C:\Windows\system\bBxEXul.exe

Filesize
3.2MB

MD5
2d14d33cf410734512760b3558157649

SHA1
d8e9423abd4947afb79cd3f5fbc64c0451427b09

SHA256
3d83cd1ecc4aea893a59083b2c789e9a6652fe795b72af01d9315264c0b83c6d

SHA512
76bddd74c67bdb6da408d037660ce3c251610777448787414d19fac288e77fa5c75b3edecd5262441bf503f407f3fd7870c789587c53e1c83e935ce47cbdfc3d

Download Submit
C:\Windows\system\bJABsTt.exe

Filesize
3.2MB

MD5
ba368626878751788c1d254b7daf7128

SHA1
955434ed721f04ee4118d1bf5d5503a3627a208a

SHA256
b14287466b5aac402d6506108e758510a26b4c22b71928b7ea11a5b2e75cab42

SHA512
4e3432323a769905ad6d3d887e4cc4f0cfd29a3c1d9aea41fa687a241a55143372a41826af0f64e74b616f82a2ffb9e2bf696e915a3a2cae44d642f5591b6112

Download Submit
C:\Windows\system\bOisElY.exe

Filesize
3.2MB

MD5
0c684b6ea38ace3ad59d52bad3c54521

SHA1
62e4024859cb0e28b762e67888fdfd4c03f28d24

SHA256
7b6a9a1ba7ef36f13c8bb3aa9965fc0d2c1cd038f3ca9e0ee9e24889a21b7443

SHA512
ee102512ddb7522decf07f078cdeee2c365f3b474de51997968836daf904464f990119852450d308cbc454fe6e012d86926a5a5029e538944584ee1d1d57ab21

Download Submit
C:\Windows\system\bWyjcoe.exe

Filesize
3.2MB

MD5
98dad564ebbca9dc64842cd2967d2ea7

SHA1
20089f18c04cfc71e9512cfa7ab77419f89133e4

SHA256
5f838533f4919813deaf17dc960c5fa59636653a6e08ebc04a3cb287d82ae9e7

SHA512
86c7da125001e4f920ec5f4416a3e1b7b56a714aa5d1f87ffbda961382eeea9e27ea70dc826a6cfdfa8258479cd7e84bca03b398290e0bffb290c51ad0339708

Download Submit
C:\Windows\system\cOfghWO.exe

Filesize
3.2MB

MD5
120e20ada16a705062d271828a1436eb

SHA1
5b118fd5cd484ac6df6239c6f8f68bb8d972ab97

SHA256
2e04a0c8c43230f27cffafe316af7ffeb43ccca2c46ed471d480e45e5b6ccb9e

SHA512
ee8e357e08d2c8d3e110692c93474a8f7960668bc73afba383060556fd94b26d73347da40e0c9a117edb3b24a742953b44ac9d389d5a935352a94538e25d7597

Download Submit
C:\Windows\system\hLDBxGq.exe

Filesize
3.2MB

MD5
49c9004382413b7e39ed348ac4462ed1

SHA1
084f53b374dab69ee949cc2069b08b423d0c238e

SHA256
9aaae2edd542519cdf6cce4e3c2d7c9411484885e8b4e0d5d9b8648e18394d88

SHA512
6c1dfa35ac04d3d2ce363d4fb330952979cbdfbfcabfdb2e39907a754459eb3b2c76b57bfb72e0860c3fa189ab6cba7b4c902f2c5d933f0320a4ea2f348ca56a

Download Submit
C:\Windows\system\hkhSnvv.exe

Filesize
3.2MB

MD5
f7a62af10c1aeb9267f120f7888f23aa

SHA1
047f6eb5edd555a7c636b9dc046bc9e2019331a4

SHA256
5facda30ac27357449baf0c453464ddd5612e6aacc37736db3ffe7b15cb3acce

SHA512
91593dcf43f7355794409fb2283a6a1d88a7e3091670b493bfcc9a0b5105e7fa68da0776293c5e0ad2149b54644183b2785cf8368d0032917adde204f95497de

Download Submit
C:\Windows\system\lXTPLWV.exe

Filesize
3.2MB

MD5
7160d7473e5653e9cbfd27f2879fde3b

SHA1
9fdfa9430e8f58386a04dce1d1deb39cd15929ac

SHA256
451a2789b5fa47a42d45c631631f5835ae6055c7944ef6324721efb8cf4d4838

SHA512
dcbdc322398ae90cc80d64587f207a165dc39c622c4ad0ba0b9ba514b48088c80ffc26a1c49706ea4a6acc2d4abc7108df009070d9d07966d988c80af8217b1a

Download Submit
C:\Windows\system\lYYRDit.exe

Filesize
3.2MB

MD5
23cfbf3c3a2a734e18e5fe68d304eb2a

SHA1
602f93b3c94b27c6bafc937f10375dac75a29d3c

SHA256
411df2494243160335df31717986661437a5f39d6f8ca6bb448d8dcfbcf35d81

SHA512
9a623429f8418659c6f4a067b96031feb6673db71405bc3ef40606266e3b4957129905c9e53c1e09d070a8ac970d7e2b9a82858a9dda69c2cdefccd97d6a57ab

Download Submit
C:\Windows\system\mejVaCu.exe

Filesize
3.2MB

MD5
0ced445d5c0da6a70b5417e71a456853

SHA1
4617ca794f1c994098db0bfa3139930d0176467c

SHA256
3d39510fb77ef6dff37348a6f0ff880af4c10ac08fee087d7296526f9d136dc2

SHA512
52189a6bc2d6aeed0bc64b6aa2aaa6c546fb7be32fd5be73f2f14816677efe4ffaa02e2d1efac968645e0a5b86ffd4e88641c559f3df48fe3a3301f0b69910d0

Download Submit
C:\Windows\system\nFDqfsK.exe

Filesize
3.2MB

MD5
54e475b85ed9dc90efc6638df0bbbc88

SHA1
edc8f6ae859308d64ea91e62cfa19ae6e8d80507

SHA256
636aefad8740009a573bf9898a1e67f5060c0df313eceea74982d24cb4527d4f

SHA512
57fe7f03d9b91d225e60fa38cc5e8fe2773f995e5a33172a91e84ad3c8f1d9ee68172b5b93ea26ffc2f8acf378c265e9a70417f21b78aab1be2613a623c46230

Download Submit
C:\Windows\system\oLpJVPk.exe

Filesize
3.2MB

MD5
bf130337cf9f12edd55983ebf956c9d6

SHA1
fa8eeef6c03c34a1ce367158f03d7032783c8870

SHA256
20ec5c2079d08db1649ee66fed62a26e9bb8c59ff7548393329e1917cf230f6f

SHA512
f89e6d236c9bc2e83717304403ab2e87073ed59d71d9109a00dc149a74627989da15231fa75a0784cebd4159049501b8bccce0238be66e269477b8d6ad3b8a10

Download Submit
C:\Windows\system\zBXOVAj.exe

Filesize
3.2MB

MD5
e787250e7e860fa470d658b414d6d3a1

SHA1
106fb9287ef67c61cc9e6eadbc7dc93026dfffba

SHA256
4b643193e3cd80406f1863324070a28c29036fc5a2399d50d65188bdba5dc835

SHA512
f32196888bb2cb49850a08aae240a37a1c10958845c6921bd07323e6ab8e6a97cc506a76d31bdfd8d5a579d424c4fb7835b9c3bf0d19692baab746d4b151e799

Download Submit
C:\Windows\system\zfbbixo.exe

Filesize
3.2MB

MD5
502feda351ae2bb46d311bc031266bb3

SHA1
59ef81dc070c94dcd43ddb7b1dfeb860b25e9029

SHA256
5d8bd0f8f5aa6357b397ed3b852c21de40e9ca0dc5108850e758ef4aed9a49d8

SHA512
aed3b88452ef742f641196c533c1dbab9891b153bfc0cbc0b59e2f0f8ed6152406d10893d974ff3bc596b929b3f58863bceb320c01f5edb86b875002ed5b9388

Download Submit
\Windows\system\BKIwGGS.exe

Filesize
3.2MB

MD5
84441bd9bc19558e5ce5852417e360a9

SHA1
54b032c1a0ce6341daecce5df29b516506a8b1ba

SHA256
04531bf2adcd40c10f475da2690b025a6dcc6e2c21c04f85413119072724937a

SHA512
86f14bb212bfc3a32ffc77b975e19802795c6fd6d9fcb7f85799220007a379c1ad82338ddf6e4d450496c24ed480be1f0b88a3ab1e0dd4e283f85950189c4360

Download Submit
\Windows\system\HRUZgBB.exe

Filesize
3.2MB

MD5
3be4a2513f26a6d77faae818058b92d7

SHA1
6fb7c5d02c4078e4ad049c7068ac7bcd2b6d62f1

SHA256
8578d2172a1df6d97794855bfcad4b95bd4cc01f0a3e2cca5a22bf6382ce966d

SHA512
456bef7b718103f70b55ff840aaf0c778da452005550a14fcb459318eae78dee4b6674471ca1490abc8f279e538b322d507dbc6950827fdb21d026bab85e8c11

Download Submit
\Windows\system\PHADMFB.exe

Filesize
3.2MB

MD5
ae9a3bd616ec073dcdbaa9558c247355

SHA1
e4555afa673258fa3a096222294dc86d11222a59

SHA256
b41bcd8a6956a3a138ccc08922d773ea71504668fcde9ff54444504ee262189b

SHA512
4c8af6145d8df1a8ccca15620f893062bf47be9b6b49adbd8e2a0d8278cd04f2bada7f915c36f4e4a4b7994478edb671b67be07bc002a8588e2536e9f719c88d

Download Submit
\Windows\system\gSYZLTx.exe

Filesize
3.2MB

MD5
454a9f759dbb6b02a6396655727461f8

SHA1
1a882528c99b55f47f69756f85aaa61bd358268f

SHA256
b6c2c466fa4399e8570e24b2f573b59e3aa1b28b2f5f1a0205cf0ce7118746da

SHA512
1a26fac313eacb424c1ff8fd5414a1924f161785f6035170ec1fa6c92d7c7f9532605eccd786f71fcb4211cde8d2c137cde97b6421d4a1e0ba173bd587685210

Download Submit
\Windows\system\tuLFUvY.exe

Filesize
3.2MB

MD5
8687c236c51815921bbc65995f49775c

SHA1
2929febead8504ecca0fdf3ca3692f2bebbf1b71

SHA256
6db1bc1efd22634238e2ec15be8fec690c639c8490608eda7b220a7c84f86ca2

SHA512
643b90ac939dae74e34dd07c0f90f1b6ac6a72ffdc16b7fe1ca7e98764e363f4801f3e1087f4e0f4e61bb1401514b116428d5b1151de64e46947802a32f31f5b

Download Submit
memory/324-182-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/324-19-0x000007FEF565E000-0x000007FEF565F000-memory.dmp

Filesize
4KB

Download
memory/324-135-0x000000001B3A0000-0x000000001B682000-memory.dmp

Filesize
2.9MB

Download
memory/324-203-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/324-139-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/324-205-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/324-181-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/1008-202-0x000000013F300000-0x000000013F6F6000-memory.dmp

Filesize
4.0MB

Download
memory/1008-2370-0x000000013F300000-0x000000013F6F6000-memory.dmp

Filesize
4.0MB

Download
memory/1360-189-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/1360-2375-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/2180-184-0x0000000002C30000-0x0000000003026000-memory.dmp

Filesize
4.0MB

Download
memory/2180-190-0x0000000002C30000-0x0000000003026000-memory.dmp

Filesize
4.0MB

Download
memory/2180-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2180-186-0x0000000002C30000-0x0000000003026000-memory.dmp

Filesize
4.0MB

Download
memory/2180-2233-0x000000013FF30000-0x0000000140326000-memory.dmp

Filesize
4.0MB

Download
memory/2180-1947-0x000000013FA00000-0x000000013FDF6000-memory.dmp

Filesize
4.0MB

Download
memory/2180-192-0x000000013F370000-0x000000013F766000-memory.dmp

Filesize
4.0MB

Download
memory/2180-18-0x000000013F300000-0x000000013F6F6000-memory.dmp

Filesize
4.0MB

Download
memory/2180-0-0x000000013FA00000-0x000000013FDF6000-memory.dmp

Filesize
4.0MB

Download
memory/2180-196-0x000000013F200000-0x000000013F5F6000-memory.dmp

Filesize
4.0MB

Download
memory/2180-198-0x0000000002C30000-0x0000000003026000-memory.dmp

Filesize
4.0MB

Download
memory/2180-188-0x0000000002C30000-0x0000000003026000-memory.dmp

Filesize
4.0MB

Download
memory/2180-200-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/2180-194-0x0000000002C30000-0x0000000003026000-memory.dmp

Filesize
4.0MB

Download
memory/2180-204-0x0000000002C30000-0x0000000003026000-memory.dmp

Filesize
4.0MB

Download
memory/2396-2369-0x000000013FF30000-0x0000000140326000-memory.dmp

Filesize
4.0MB

Download
memory/2396-16-0x000000013FF30000-0x0000000140326000-memory.dmp

Filesize
4.0MB

Download
memory/2420-201-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/2420-2408-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/2496-2380-0x000000013F920000-0x000000013FD16000-memory.dmp

Filesize
4.0MB

Download
memory/2496-191-0x000000013F920000-0x000000013FD16000-memory.dmp

Filesize
4.0MB

Download
memory/2560-199-0x000000013FA00000-0x000000013FDF6000-memory.dmp

Filesize
4.0MB

Download
memory/2560-2402-0x000000013FA00000-0x000000013FDF6000-memory.dmp

Filesize
4.0MB

Download
memory/2564-195-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2564-2393-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2656-197-0x000000013F200000-0x000000013F5F6000-memory.dmp

Filesize
4.0MB

Download
memory/2656-2426-0x000000013F200000-0x000000013F5F6000-memory.dmp

Filesize
4.0MB

Download
memory/2816-2371-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2816-183-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2824-187-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2824-2374-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2900-193-0x000000013F370000-0x000000013F766000-memory.dmp

Filesize
4.0MB

Download
memory/2900-2381-0x000000013F370000-0x000000013F766000-memory.dmp

Filesize
4.0MB

Download
memory/3012-185-0x000000013FCD0000-0x00000001400C6000-memory.dmp

Filesize
4.0MB

Download
memory/3012-2372-0x000000013FCD0000-0x00000001400C6000-memory.dmp

Filesize
4.0MB

Download