xmrig | 932978ac1ef440c143a1df3364a058fb0f626360b53c0a2661cc270d8aff3785

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 08:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
Size

1.8MB
MD5

1725e4b23ea8832d23e88fdce51749f0
SHA1

3573e56d18b286dd85d3976208f874aa411af11e
SHA256

932978ac1ef440c143a1df3364a058fb0f626360b53c0a2661cc270d8aff3785
SHA512

7e0d43742112a71a8f35abd1a01a099a220327f6722d2bdb81c5c67889f411d79cfebd9b201f00bbd45f2ef13bc9b36c94a9acf66b4563146336285623032a4a
SSDEEP

49152:Lz071uv4BPMkHC0IlnASEx/mi1D+F1E8W:NABX

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral2/memory/1296-22-0x00007FF601ED0000-0x00007FF6022C2000-memory.dmp	xmrig
behavioral2/memory/1448-103-0x00007FF7ABE00000-0x00007FF7AC1F2000-memory.dmp	xmrig
behavioral2/memory/4984-400-0x00007FF7AB630000-0x00007FF7ABA22000-memory.dmp	xmrig
behavioral2/memory/3376-402-0x00007FF690AF0000-0x00007FF690EE2000-memory.dmp	xmrig
behavioral2/memory/1284-401-0x00007FF72A800000-0x00007FF72ABF2000-memory.dmp	xmrig
behavioral2/memory/3956-399-0x00007FF6523D0000-0x00007FF6527C2000-memory.dmp	xmrig
behavioral2/memory/872-398-0x00007FF73E6B0000-0x00007FF73EAA2000-memory.dmp	xmrig
behavioral2/memory/2900-1578-0x00007FF71FD60000-0x00007FF720152000-memory.dmp	xmrig
behavioral2/memory/2276-1575-0x00007FF79B220000-0x00007FF79B612000-memory.dmp	xmrig
behavioral2/memory/1188-1556-0x00007FF7F39C0000-0x00007FF7F3DB2000-memory.dmp	xmrig
behavioral2/memory/916-2029-0x00007FF609ED0000-0x00007FF60A2C2000-memory.dmp	xmrig
behavioral2/memory/2304-104-0x00007FF763230000-0x00007FF763622000-memory.dmp	xmrig
behavioral2/memory/1692-99-0x00007FF6E1500000-0x00007FF6E18F2000-memory.dmp	xmrig
behavioral2/memory/1852-87-0x00007FF71B170000-0x00007FF71B562000-memory.dmp	xmrig
behavioral2/memory/2880-86-0x00007FF70FAA0000-0x00007FF70FE92000-memory.dmp	xmrig
behavioral2/memory/916-82-0x00007FF609ED0000-0x00007FF60A2C2000-memory.dmp	xmrig
behavioral2/memory/3640-66-0x00007FF630880000-0x00007FF630C72000-memory.dmp	xmrig
behavioral2/memory/3920-54-0x00007FF6C47F0000-0x00007FF6C4BE2000-memory.dmp	xmrig
behavioral2/memory/1480-13-0x00007FF7D9CE0000-0x00007FF7DA0D2000-memory.dmp	xmrig
behavioral2/memory/3640-2405-0x00007FF630880000-0x00007FF630C72000-memory.dmp	xmrig
behavioral2/memory/4368-2935-0x00007FF6E1820000-0x00007FF6E1C12000-memory.dmp	xmrig
behavioral2/memory/4576-3322-0x00007FF683650000-0x00007FF683A42000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	772	powershell.exe
11	772	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
772	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1480	RURBtCQ.exe
1296	iFEFofz.exe
1188	utJFSKW.exe
2076	yLpOMAI.exe
2276	XFYjdMM.exe
3920	mIAmkba.exe
2880	yevjmYz.exe
1492	rBYMfRd.exe
3640	dPDEtbD.exe
1852	GkjyUob.exe
2900	mECoWYK.exe
916	KWzimLL.exe
5068	DUsZSTf.exe
1692	mQpSsPQ.exe
1448	SCuBGNg.exe
2304	UicalPn.exe
4368	ipXnQIS.exe
1964	OvrgllW.exe
4576	tGgovYn.exe
4596	WzfberX.exe
3956	yutGOrW.exe
4984	YPSOcfM.exe
1284	rNaPWVT.exe
3376	GVYdZuO.exe
3924	xKEaLXF.exe
1040	asleGXZ.exe
2280	ryMZrcY.exe
1276	dLlOltA.exe
2328	foiLvBU.exe
4588	HiZccvI.exe
3508	SMqwuht.exe
988	qgAHAxk.exe
4504	iVYEsRH.exe
2144	hDYbtbj.exe
4892	prQgZaG.exe
388	nwEpgwM.exe
3400	mTAYonS.exe
4908	IrzRZMA.exe
4832	arZFgJr.exe
5040	rJYbpqF.exe
5140	lbUfdba.exe
5168	izudNnM.exe
5196	QjdjdPU.exe
5224	tJTAhaO.exe
5252	ngLxfgL.exe
5284	JiQAwEv.exe
5312	XmGjlbX.exe
5340	VVSYOfs.exe
5368	iXSOcCG.exe
5396	jMTNXJU.exe
5424	Huchxun.exe
5476	bpUJQOY.exe
5496	KGeYaDo.exe
5524	uEuFSKa.exe
5540	HZRbLDv.exe
5568	lHKXLko.exe
5596	diZbVXF.exe
5624	xgJuMwb.exe
5652	DazmCRc.exe
5680	Udumutg.exe
5712	dehFTuZ.exe
5740	oWKuQLS.exe
5772	qFeufNU.exe
5800	WhobXpM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/872-0-0x00007FF73E6B0000-0x00007FF73EAA2000-memory.dmp	upx
behavioral2/files/0x000a0000000232fb-6.dat	upx
behavioral2/memory/1296-22-0x00007FF601ED0000-0x00007FF6022C2000-memory.dmp	upx
behavioral2/memory/1188-28-0x00007FF7F39C0000-0x00007FF7F3DB2000-memory.dmp	upx
behavioral2/files/0x0008000000023314-34.dat	upx
behavioral2/files/0x0008000000023311-45.dat	upx
behavioral2/files/0x000800000002331a-57.dat	upx
behavioral2/memory/1492-60-0x00007FF6C5260000-0x00007FF6C5652000-memory.dmp	upx
behavioral2/memory/2900-74-0x00007FF71FD60000-0x00007FF720152000-memory.dmp	upx
behavioral2/files/0x00070000000235e8-78.dat	upx
behavioral2/files/0x00070000000235e9-83.dat	upx
behavioral2/files/0x00080000000235e7-89.dat	upx
behavioral2/memory/1448-103-0x00007FF7ABE00000-0x00007FF7AC1F2000-memory.dmp	upx
behavioral2/memory/4368-106-0x00007FF6E1820000-0x00007FF6E1C12000-memory.dmp	upx
behavioral2/files/0x00070000000235ed-111.dat	upx
behavioral2/files/0x00070000000235f2-153.dat	upx
behavioral2/files/0x00070000000235f4-165.dat	upx
behavioral2/files/0x00070000000235fa-192.dat	upx
behavioral2/memory/4984-400-0x00007FF7AB630000-0x00007FF7ABA22000-memory.dmp	upx
behavioral2/memory/3376-402-0x00007FF690AF0000-0x00007FF690EE2000-memory.dmp	upx
behavioral2/memory/1284-401-0x00007FF72A800000-0x00007FF72ABF2000-memory.dmp	upx
behavioral2/memory/3956-399-0x00007FF6523D0000-0x00007FF6527C2000-memory.dmp	upx
behavioral2/memory/872-398-0x00007FF73E6B0000-0x00007FF73EAA2000-memory.dmp	upx
behavioral2/memory/2900-1578-0x00007FF71FD60000-0x00007FF720152000-memory.dmp	upx
behavioral2/memory/2276-1575-0x00007FF79B220000-0x00007FF79B612000-memory.dmp	upx
behavioral2/memory/1188-1556-0x00007FF7F39C0000-0x00007FF7F3DB2000-memory.dmp	upx
behavioral2/memory/916-2029-0x00007FF609ED0000-0x00007FF60A2C2000-memory.dmp	upx
behavioral2/files/0x00070000000235f8-190.dat	upx
behavioral2/files/0x00070000000235f9-187.dat	upx
behavioral2/files/0x00070000000235f7-185.dat	upx
behavioral2/files/0x00070000000235f6-180.dat	upx
behavioral2/files/0x00080000000235ef-175.dat	upx
behavioral2/files/0x00070000000235f5-170.dat	upx
behavioral2/files/0x00070000000235f3-158.dat	upx
behavioral2/files/0x00070000000235f1-148.dat	upx
behavioral2/files/0x00080000000235f0-143.dat	upx
behavioral2/files/0x00070000000235ee-138.dat	upx
behavioral2/files/0x000a0000000232fe-130.dat	upx
behavioral2/memory/4596-129-0x00007FF7D2900000-0x00007FF7D2CF2000-memory.dmp	upx
behavioral2/memory/4576-116-0x00007FF683650000-0x00007FF683A42000-memory.dmp	upx
behavioral2/memory/1964-110-0x00007FF6E2450000-0x00007FF6E2842000-memory.dmp	upx
behavioral2/files/0x00070000000235ec-109.dat	upx
behavioral2/files/0x00070000000235eb-105.dat	upx
behavioral2/memory/2304-104-0x00007FF763230000-0x00007FF763622000-memory.dmp	upx
behavioral2/files/0x00070000000235ea-100.dat	upx
behavioral2/memory/1692-99-0x00007FF6E1500000-0x00007FF6E18F2000-memory.dmp	upx
behavioral2/memory/5068-92-0x00007FF6B6200000-0x00007FF6B65F2000-memory.dmp	upx
behavioral2/memory/1852-87-0x00007FF71B170000-0x00007FF71B562000-memory.dmp	upx
behavioral2/memory/2880-86-0x00007FF70FAA0000-0x00007FF70FE92000-memory.dmp	upx
behavioral2/memory/916-82-0x00007FF609ED0000-0x00007FF60A2C2000-memory.dmp	upx
behavioral2/files/0x000800000002331d-69.dat	upx
behavioral2/files/0x000800000002331c-68.dat	upx
behavioral2/memory/3640-66-0x00007FF630880000-0x00007FF630C72000-memory.dmp	upx
behavioral2/files/0x0009000000023318-63.dat	upx
behavioral2/files/0x0008000000023316-56.dat	upx
behavioral2/memory/3920-54-0x00007FF6C47F0000-0x00007FF6C4BE2000-memory.dmp	upx
behavioral2/memory/2076-50-0x00007FF650050000-0x00007FF650442000-memory.dmp	upx
behavioral2/files/0x0008000000023317-41.dat	upx
behavioral2/memory/2276-39-0x00007FF79B220000-0x00007FF79B612000-memory.dmp	upx
behavioral2/files/0x0008000000023310-37.dat	upx
behavioral2/files/0x0008000000023313-21.dat	upx
behavioral2/files/0x000800000002330f-14.dat	upx
behavioral2/memory/1480-13-0x00007FF7D9CE0000-0x00007FF7DA0D2000-memory.dmp	upx
behavioral2/memory/3640-2405-0x00007FF630880000-0x00007FF630C72000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oHfGjWm.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\qyyoVVE.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\FamOHKu.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\WvRQiWQ.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\etEpixR.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZcGsuSD.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\oYLTCjv.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\bUNvbdD.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\oADGxhn.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\GNtEhQS.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\IToqGlS.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\QcnbcOo.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\xuQGfnZ.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\VTammJI.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\qagKVYt.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\hVBNKoR.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\RZweByp.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\IEHRoPM.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\SkTXAJx.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZVSKPzo.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\OxGUXcV.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\MOOLIJl.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\OaFenZp.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\dNqYeQS.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\JbmPLmU.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\PCwSgQy.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\hsluHzx.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\DxJseEN.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\butupXn.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\oopYVhy.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\vpAvzTb.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\XLzbUhp.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\GvqFdVC.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\NqpSjNT.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\kEyDNgD.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\TVtAKQy.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\cdaghJr.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\hMJqTHd.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\Ebqwwvi.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\UlkSkoZ.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\NBTBtdn.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\eqhPRDW.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\EUhbHmm.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\UsJiKZI.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\SPQCloi.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\UQqoYEm.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\gjcDoAe.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\xvSBefO.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\kBLfhpM.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\rQmASvZ.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\VqnUDTz.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\IikzBuB.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZPIlUOM.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\KzDmEGa.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\ghTRYdR.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\ksZfQMV.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\DHTlAWs.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\ynpUGBu.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\jslvzVn.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\OJYgSxX.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\tbhMCUn.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\yRjUJOv.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\vAaSEcg.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
File created	C:\Windows\System\GgrypgE.exe	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
772	powershell.exe
772	powershell.exe
772	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeCreateGlobalPrivilege	13584	dwm.exe
Token: SeChangeNotifyPrivilege	13584	dwm.exe
Token: 33	13584	dwm.exe
Token: SeIncBasePriorityPrivilege	13584	dwm.exe
Token: SeCreateGlobalPrivilege	13328	dwm.exe
Token: SeChangeNotifyPrivilege	13328	dwm.exe
Token: 33	13328	dwm.exe
Token: SeIncBasePriorityPrivilege	13328	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 772	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	91
PID 872 wrote to memory of 772	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	91
PID 872 wrote to memory of 1480	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	92
PID 872 wrote to memory of 1480	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	92
PID 872 wrote to memory of 1296	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	93
PID 872 wrote to memory of 1296	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	93
PID 872 wrote to memory of 2076	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	94
PID 872 wrote to memory of 2076	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	94
PID 872 wrote to memory of 2276	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	95
PID 872 wrote to memory of 2276	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	95
PID 872 wrote to memory of 1188	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	96
PID 872 wrote to memory of 1188	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	96
PID 872 wrote to memory of 3920	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	97
PID 872 wrote to memory of 3920	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	97
PID 872 wrote to memory of 1492	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	98
PID 872 wrote to memory of 1492	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	98
PID 872 wrote to memory of 2880	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	99
PID 872 wrote to memory of 2880	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	99
PID 872 wrote to memory of 3640	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	100
PID 872 wrote to memory of 3640	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	100
PID 872 wrote to memory of 1852	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	101
PID 872 wrote to memory of 1852	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	101
PID 872 wrote to memory of 2900	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	102
PID 872 wrote to memory of 2900	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	102
PID 872 wrote to memory of 916	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	103
PID 872 wrote to memory of 916	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	103
PID 872 wrote to memory of 5068	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	104
PID 872 wrote to memory of 5068	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	104
PID 872 wrote to memory of 1692	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	105
PID 872 wrote to memory of 1692	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	105
PID 872 wrote to memory of 1448	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	106
PID 872 wrote to memory of 1448	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	106
PID 872 wrote to memory of 2304	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	107
PID 872 wrote to memory of 2304	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	107
PID 872 wrote to memory of 4368	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	108
PID 872 wrote to memory of 4368	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	108
PID 872 wrote to memory of 1964	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	109
PID 872 wrote to memory of 1964	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	109
PID 872 wrote to memory of 4576	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	110
PID 872 wrote to memory of 4576	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	110
PID 872 wrote to memory of 4596	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	111
PID 872 wrote to memory of 4596	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	111
PID 872 wrote to memory of 3956	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	112
PID 872 wrote to memory of 3956	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	112
PID 872 wrote to memory of 4984	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	113
PID 872 wrote to memory of 4984	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	113
PID 872 wrote to memory of 1284	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	114
PID 872 wrote to memory of 1284	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	114
PID 872 wrote to memory of 3376	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	115
PID 872 wrote to memory of 3376	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	115
PID 872 wrote to memory of 3924	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	116
PID 872 wrote to memory of 3924	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	116
PID 872 wrote to memory of 1040	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	117
PID 872 wrote to memory of 1040	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	117
PID 872 wrote to memory of 2280	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	118
PID 872 wrote to memory of 2280	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	118
PID 872 wrote to memory of 1276	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	119
PID 872 wrote to memory of 1276	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	119
PID 872 wrote to memory of 2328	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	120
PID 872 wrote to memory of 2328	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	120
PID 872 wrote to memory of 4588	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	121
PID 872 wrote to memory of 4588	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	121
PID 872 wrote to memory of 3508	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	122
PID 872 wrote to memory of 3508	872	1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1725e4b23ea8832d23e88fdce51749f0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\System\RURBtCQ.exe
  C:\Windows\System\RURBtCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\iFEFofz.exe
  C:\Windows\System\iFEFofz.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\yLpOMAI.exe
  C:\Windows\System\yLpOMAI.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\XFYjdMM.exe
  C:\Windows\System\XFYjdMM.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\utJFSKW.exe
  C:\Windows\System\utJFSKW.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\mIAmkba.exe
  C:\Windows\System\mIAmkba.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\rBYMfRd.exe
  C:\Windows\System\rBYMfRd.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\yevjmYz.exe
  C:\Windows\System\yevjmYz.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\dPDEtbD.exe
  C:\Windows\System\dPDEtbD.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\GkjyUob.exe
  C:\Windows\System\GkjyUob.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\mECoWYK.exe
  C:\Windows\System\mECoWYK.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\KWzimLL.exe
  C:\Windows\System\KWzimLL.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\DUsZSTf.exe
  C:\Windows\System\DUsZSTf.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\mQpSsPQ.exe
  C:\Windows\System\mQpSsPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\SCuBGNg.exe
  C:\Windows\System\SCuBGNg.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\UicalPn.exe
  C:\Windows\System\UicalPn.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\ipXnQIS.exe
  C:\Windows\System\ipXnQIS.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\OvrgllW.exe
  C:\Windows\System\OvrgllW.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\tGgovYn.exe
  C:\Windows\System\tGgovYn.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\WzfberX.exe
  C:\Windows\System\WzfberX.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\yutGOrW.exe
  C:\Windows\System\yutGOrW.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\YPSOcfM.exe
  C:\Windows\System\YPSOcfM.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\rNaPWVT.exe
  C:\Windows\System\rNaPWVT.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\GVYdZuO.exe
  C:\Windows\System\GVYdZuO.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\xKEaLXF.exe
  C:\Windows\System\xKEaLXF.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\asleGXZ.exe
  C:\Windows\System\asleGXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\ryMZrcY.exe
  C:\Windows\System\ryMZrcY.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\dLlOltA.exe
  C:\Windows\System\dLlOltA.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\foiLvBU.exe
  C:\Windows\System\foiLvBU.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\HiZccvI.exe
  C:\Windows\System\HiZccvI.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\SMqwuht.exe
  C:\Windows\System\SMqwuht.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\qgAHAxk.exe
  C:\Windows\System\qgAHAxk.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\iVYEsRH.exe
  C:\Windows\System\iVYEsRH.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\hDYbtbj.exe
  C:\Windows\System\hDYbtbj.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\prQgZaG.exe
  C:\Windows\System\prQgZaG.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\nwEpgwM.exe
  C:\Windows\System\nwEpgwM.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\mTAYonS.exe
  C:\Windows\System\mTAYonS.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\IrzRZMA.exe
  C:\Windows\System\IrzRZMA.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\arZFgJr.exe
  C:\Windows\System\arZFgJr.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\rJYbpqF.exe
  C:\Windows\System\rJYbpqF.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\lbUfdba.exe
  C:\Windows\System\lbUfdba.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\izudNnM.exe
  C:\Windows\System\izudNnM.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\QjdjdPU.exe
  C:\Windows\System\QjdjdPU.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\tJTAhaO.exe
  C:\Windows\System\tJTAhaO.exe
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Windows\System\ngLxfgL.exe
  C:\Windows\System\ngLxfgL.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\JiQAwEv.exe
  C:\Windows\System\JiQAwEv.exe
  2⤵
  - Executes dropped EXE
  PID:5284
- C:\Windows\System\XmGjlbX.exe
  C:\Windows\System\XmGjlbX.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\VVSYOfs.exe
  C:\Windows\System\VVSYOfs.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\iXSOcCG.exe
  C:\Windows\System\iXSOcCG.exe
  2⤵
  - Executes dropped EXE
  PID:5368
- C:\Windows\System\jMTNXJU.exe
  C:\Windows\System\jMTNXJU.exe
  2⤵
  - Executes dropped EXE
  PID:5396
- C:\Windows\System\Huchxun.exe
  C:\Windows\System\Huchxun.exe
  2⤵
  - Executes dropped EXE
  PID:5424
- C:\Windows\System\bpUJQOY.exe
  C:\Windows\System\bpUJQOY.exe
  2⤵
  - Executes dropped EXE
  PID:5476
- C:\Windows\System\KGeYaDo.exe
  C:\Windows\System\KGeYaDo.exe
  2⤵
  - Executes dropped EXE
  PID:5496
- C:\Windows\System\uEuFSKa.exe
  C:\Windows\System\uEuFSKa.exe
  2⤵
  - Executes dropped EXE
  PID:5524
- C:\Windows\System\HZRbLDv.exe
  C:\Windows\System\HZRbLDv.exe
  2⤵
  - Executes dropped EXE
  PID:5540
- C:\Windows\System\lHKXLko.exe
  C:\Windows\System\lHKXLko.exe
  2⤵
  - Executes dropped EXE
  PID:5568
- C:\Windows\System\diZbVXF.exe
  C:\Windows\System\diZbVXF.exe
  2⤵
  - Executes dropped EXE
  PID:5596
- C:\Windows\System\xgJuMwb.exe
  C:\Windows\System\xgJuMwb.exe
  2⤵
  - Executes dropped EXE
  PID:5624
- C:\Windows\System\DazmCRc.exe
  C:\Windows\System\DazmCRc.exe
  2⤵
  - Executes dropped EXE
  PID:5652
- C:\Windows\System\Udumutg.exe
  C:\Windows\System\Udumutg.exe
  2⤵
  - Executes dropped EXE
  PID:5680
- C:\Windows\System\dehFTuZ.exe
  C:\Windows\System\dehFTuZ.exe
  2⤵
  - Executes dropped EXE
  PID:5712
- C:\Windows\System\oWKuQLS.exe
  C:\Windows\System\oWKuQLS.exe
  2⤵
  - Executes dropped EXE
  PID:5740
- C:\Windows\System\qFeufNU.exe
  C:\Windows\System\qFeufNU.exe
  2⤵
  - Executes dropped EXE
  PID:5772
- C:\Windows\System\WhobXpM.exe
  C:\Windows\System\WhobXpM.exe
  2⤵
  - Executes dropped EXE
  PID:5800
- C:\Windows\System\eJBXPKt.exe
  C:\Windows\System\eJBXPKt.exe
  2⤵
  PID:5828
- C:\Windows\System\wUavwgi.exe
  C:\Windows\System\wUavwgi.exe
  2⤵
  PID:5860
- C:\Windows\System\cpxTrko.exe
  C:\Windows\System\cpxTrko.exe
  2⤵
  PID:5888
- C:\Windows\System\IsROcSq.exe
  C:\Windows\System\IsROcSq.exe
  2⤵
  PID:5916
- C:\Windows\System\SzgIGDv.exe
  C:\Windows\System\SzgIGDv.exe
  2⤵
  PID:5944
- C:\Windows\System\GtUEyjr.exe
  C:\Windows\System\GtUEyjr.exe
  2⤵
  PID:5972
- C:\Windows\System\TQqUQdt.exe
  C:\Windows\System\TQqUQdt.exe
  2⤵
  PID:6000
- C:\Windows\System\OAmajmC.exe
  C:\Windows\System\OAmajmC.exe
  2⤵
  PID:6028
- C:\Windows\System\HcTeaRM.exe
  C:\Windows\System\HcTeaRM.exe
  2⤵
  PID:6064
- C:\Windows\System\UdBHVMQ.exe
  C:\Windows\System\UdBHVMQ.exe
  2⤵
  PID:6084
- C:\Windows\System\dDEkwyc.exe
  C:\Windows\System\dDEkwyc.exe
  2⤵
  PID:6112
- C:\Windows\System\fNMBDlJ.exe
  C:\Windows\System\fNMBDlJ.exe
  2⤵
  PID:6140
- C:\Windows\System\fRojlpF.exe
  C:\Windows\System\fRojlpF.exe
  2⤵
  PID:1152
- C:\Windows\System\VIJvxrB.exe
  C:\Windows\System\VIJvxrB.exe
  2⤵
  PID:4940
- C:\Windows\System\VjiiIMZ.exe
  C:\Windows\System\VjiiIMZ.exe
  2⤵
  PID:2884
- C:\Windows\System\QXGqaNK.exe
  C:\Windows\System\QXGqaNK.exe
  2⤵
  PID:5160
- C:\Windows\System\tqZmjge.exe
  C:\Windows\System\tqZmjge.exe
  2⤵
  PID:5236
- C:\Windows\System\TJohvkN.exe
  C:\Windows\System\TJohvkN.exe
  2⤵
  PID:5296
- C:\Windows\System\DpsSmLU.exe
  C:\Windows\System\DpsSmLU.exe
  2⤵
  PID:5356
- C:\Windows\System\PEUVpqd.exe
  C:\Windows\System\PEUVpqd.exe
  2⤵
  PID:5412
- C:\Windows\System\LpOgUox.exe
  C:\Windows\System\LpOgUox.exe
  2⤵
  PID:5492
- C:\Windows\System\RSVioOo.exe
  C:\Windows\System\RSVioOo.exe
  2⤵
  PID:5556
- C:\Windows\System\oNfoVEu.exe
  C:\Windows\System\oNfoVEu.exe
  2⤵
  PID:5616
- C:\Windows\System\YCOHTuY.exe
  C:\Windows\System\YCOHTuY.exe
  2⤵
  PID:5676
- C:\Windows\System\tNvCnNW.exe
  C:\Windows\System\tNvCnNW.exe
  2⤵
  PID:5756
- C:\Windows\System\vtvsHtx.exe
  C:\Windows\System\vtvsHtx.exe
  2⤵
  PID:5812
- C:\Windows\System\BBBqUcv.exe
  C:\Windows\System\BBBqUcv.exe
  2⤵
  PID:5876
- C:\Windows\System\Icmnwzr.exe
  C:\Windows\System\Icmnwzr.exe
  2⤵
  PID:5936
- C:\Windows\System\tgkYHUV.exe
  C:\Windows\System\tgkYHUV.exe
  2⤵
  PID:5996
- C:\Windows\System\pMYLssV.exe
  C:\Windows\System\pMYLssV.exe
  2⤵
  PID:6080
- C:\Windows\System\qVQnRDx.exe
  C:\Windows\System\qVQnRDx.exe
  2⤵
  PID:6132
- C:\Windows\System\yrtZbsx.exe
  C:\Windows\System\yrtZbsx.exe
  2⤵
  PID:1320
- C:\Windows\System\fNiCSCc.exe
  C:\Windows\System\fNiCSCc.exe
  2⤵
  PID:5208
- C:\Windows\System\ZnWxjNo.exe
  C:\Windows\System\ZnWxjNo.exe
  2⤵
  PID:5384
- C:\Windows\System\whIpeGz.exe
  C:\Windows\System\whIpeGz.exe
  2⤵
  PID:4552
- C:\Windows\System\xjnMZKd.exe
  C:\Windows\System\xjnMZKd.exe
  2⤵
  PID:2100
- C:\Windows\System\pXNOAeG.exe
  C:\Windows\System\pXNOAeG.exe
  2⤵
  PID:5732
- C:\Windows\System\EbeXItl.exe
  C:\Windows\System\EbeXItl.exe
  2⤵
  PID:5872
- C:\Windows\System\nPvBHiL.exe
  C:\Windows\System\nPvBHiL.exe
  2⤵
  PID:5328
- C:\Windows\System\ZzbSQBl.exe
  C:\Windows\System\ZzbSQBl.exe
  2⤵
  PID:5588
- C:\Windows\System\yxgeVLV.exe
  C:\Windows\System\yxgeVLV.exe
  2⤵
  PID:1120
- C:\Windows\System\oeOVjdL.exe
  C:\Windows\System\oeOVjdL.exe
  2⤵
  PID:5844
- C:\Windows\System\WIEukIV.exe
  C:\Windows\System\WIEukIV.exe
  2⤵
  PID:2540
- C:\Windows\System\EslEoWa.exe
  C:\Windows\System\EslEoWa.exe
  2⤵
  PID:1268
- C:\Windows\System\IBXXTqW.exe
  C:\Windows\System\IBXXTqW.exe
  2⤵
  PID:4692
- C:\Windows\System\zIcPMaK.exe
  C:\Windows\System\zIcPMaK.exe
  2⤵
  PID:6172
- C:\Windows\System\NGJIEWA.exe
  C:\Windows\System\NGJIEWA.exe
  2⤵
  PID:6232
- C:\Windows\System\AAOjUgW.exe
  C:\Windows\System\AAOjUgW.exe
  2⤵
  PID:6252
- C:\Windows\System\VPbYcip.exe
  C:\Windows\System\VPbYcip.exe
  2⤵
  PID:6288
- C:\Windows\System\BbwabRQ.exe
  C:\Windows\System\BbwabRQ.exe
  2⤵
  PID:6336
- C:\Windows\System\ihYMfOy.exe
  C:\Windows\System\ihYMfOy.exe
  2⤵
  PID:6356
- C:\Windows\System\cOTDcxy.exe
  C:\Windows\System\cOTDcxy.exe
  2⤵
  PID:6372
- C:\Windows\System\hvNUPvm.exe
  C:\Windows\System\hvNUPvm.exe
  2⤵
  PID:6396
- C:\Windows\System\uBUQwiC.exe
  C:\Windows\System\uBUQwiC.exe
  2⤵
  PID:6436
- C:\Windows\System\LuPuNFI.exe
  C:\Windows\System\LuPuNFI.exe
  2⤵
  PID:6452
- C:\Windows\System\AcsuogT.exe
  C:\Windows\System\AcsuogT.exe
  2⤵
  PID:6476
- C:\Windows\System\MaZUEbn.exe
  C:\Windows\System\MaZUEbn.exe
  2⤵
  PID:6504
- C:\Windows\System\xTBHhVK.exe
  C:\Windows\System\xTBHhVK.exe
  2⤵
  PID:6520
- C:\Windows\System\MHqBwMB.exe
  C:\Windows\System\MHqBwMB.exe
  2⤵
  PID:6536
- C:\Windows\System\kfUUcJN.exe
  C:\Windows\System\kfUUcJN.exe
  2⤵
  PID:6556
- C:\Windows\System\gurmCqD.exe
  C:\Windows\System\gurmCqD.exe
  2⤵
  PID:6580
- C:\Windows\System\oBefXFw.exe
  C:\Windows\System\oBefXFw.exe
  2⤵
  PID:6596
- C:\Windows\System\WNzUsrg.exe
  C:\Windows\System\WNzUsrg.exe
  2⤵
  PID:6620
- C:\Windows\System\hWWgfvg.exe
  C:\Windows\System\hWWgfvg.exe
  2⤵
  PID:6656
- C:\Windows\System\YYGAvvp.exe
  C:\Windows\System\YYGAvvp.exe
  2⤵
  PID:6764
- C:\Windows\System\JMsGYLU.exe
  C:\Windows\System\JMsGYLU.exe
  2⤵
  PID:6788
- C:\Windows\System\tswquFV.exe
  C:\Windows\System\tswquFV.exe
  2⤵
  PID:6812
- C:\Windows\System\GVapeHi.exe
  C:\Windows\System\GVapeHi.exe
  2⤵
  PID:6836
- C:\Windows\System\kgvtuNW.exe
  C:\Windows\System\kgvtuNW.exe
  2⤵
  PID:6872
- C:\Windows\System\iVSCrsg.exe
  C:\Windows\System\iVSCrsg.exe
  2⤵
  PID:6892
- C:\Windows\System\qVxuWRj.exe
  C:\Windows\System\qVxuWRj.exe
  2⤵
  PID:6912
- C:\Windows\System\mmYecSL.exe
  C:\Windows\System\mmYecSL.exe
  2⤵
  PID:6956
- C:\Windows\System\enEraLU.exe
  C:\Windows\System\enEraLU.exe
  2⤵
  PID:6976
- C:\Windows\System\tHiaThB.exe
  C:\Windows\System\tHiaThB.exe
  2⤵
  PID:6996
- C:\Windows\System\PGJdrhU.exe
  C:\Windows\System\PGJdrhU.exe
  2⤵
  PID:7036
- C:\Windows\System\kuXrqkY.exe
  C:\Windows\System\kuXrqkY.exe
  2⤵
  PID:7064
- C:\Windows\System\heHBUwx.exe
  C:\Windows\System\heHBUwx.exe
  2⤵
  PID:7104
- C:\Windows\System\mHWAxYh.exe
  C:\Windows\System\mHWAxYh.exe
  2⤵
  PID:7128
- C:\Windows\System\kyfDEUq.exe
  C:\Windows\System\kyfDEUq.exe
  2⤵
  PID:7152
- C:\Windows\System\GMlPpNW.exe
  C:\Windows\System\GMlPpNW.exe
  2⤵
  PID:5932
- C:\Windows\System\IGJDUkR.exe
  C:\Windows\System\IGJDUkR.exe
  2⤵
  PID:5444
- C:\Windows\System\FkMoiQe.exe
  C:\Windows\System\FkMoiQe.exe
  2⤵
  PID:6148
- C:\Windows\System\rtxiKIz.exe
  C:\Windows\System\rtxiKIz.exe
  2⤵
  PID:6196
- C:\Windows\System\AMeeegX.exe
  C:\Windows\System\AMeeegX.exe
  2⤵
  PID:4980
- C:\Windows\System\OAnPtEe.exe
  C:\Windows\System\OAnPtEe.exe
  2⤵
  PID:4188
- C:\Windows\System\umyEnZk.exe
  C:\Windows\System\umyEnZk.exe
  2⤵
  PID:3668
- C:\Windows\System\OYGEXQp.exe
  C:\Windows\System\OYGEXQp.exe
  2⤵
  PID:748
- C:\Windows\System\VozCKMU.exe
  C:\Windows\System\VozCKMU.exe
  2⤵
  PID:5096
- C:\Windows\System\qGfRBHm.exe
  C:\Windows\System\qGfRBHm.exe
  2⤵
  PID:1776
- C:\Windows\System\buIHEhU.exe
  C:\Windows\System\buIHEhU.exe
  2⤵
  PID:6304
- C:\Windows\System\pQuTOuz.exe
  C:\Windows\System\pQuTOuz.exe
  2⤵
  PID:6316
- C:\Windows\System\PepvyaV.exe
  C:\Windows\System\PepvyaV.exe
  2⤵
  PID:6416
- C:\Windows\System\FYLFUFw.exe
  C:\Windows\System\FYLFUFw.exe
  2⤵
  PID:6424
- C:\Windows\System\bFwFuAJ.exe
  C:\Windows\System\bFwFuAJ.exe
  2⤵
  PID:6532
- C:\Windows\System\iFEInVx.exe
  C:\Windows\System\iFEInVx.exe
  2⤵
  PID:6604
- C:\Windows\System\VatgaVw.exe
  C:\Windows\System\VatgaVw.exe
  2⤵
  PID:6676
- C:\Windows\System\RnvenbM.exe
  C:\Windows\System\RnvenbM.exe
  2⤵
  PID:6796
- C:\Windows\System\njDlCla.exe
  C:\Windows\System\njDlCla.exe
  2⤵
  PID:6848
- C:\Windows\System\iYfIAxW.exe
  C:\Windows\System\iYfIAxW.exe
  2⤵
  PID:6904
- C:\Windows\System\XvLWYrS.exe
  C:\Windows\System\XvLWYrS.exe
  2⤵
  PID:6948
- C:\Windows\System\TOVVxQv.exe
  C:\Windows\System\TOVVxQv.exe
  2⤵
  PID:7016
- C:\Windows\System\waPYLly.exe
  C:\Windows\System\waPYLly.exe
  2⤵
  PID:7124
- C:\Windows\System\NdMeZQU.exe
  C:\Windows\System\NdMeZQU.exe
  2⤵
  PID:5028
- C:\Windows\System\hlVvPme.exe
  C:\Windows\System\hlVvPme.exe
  2⤵
  PID:6164
- C:\Windows\System\suCpszv.exe
  C:\Windows\System\suCpszv.exe
  2⤵
  PID:4848
- C:\Windows\System\cSqyaST.exe
  C:\Windows\System\cSqyaST.exe
  2⤵
  PID:972
- C:\Windows\System\UtbGXSs.exe
  C:\Windows\System\UtbGXSs.exe
  2⤵
  PID:516
- C:\Windows\System\DSpETba.exe
  C:\Windows\System\DSpETba.exe
  2⤵
  PID:6240
- C:\Windows\System\kaWiJXW.exe
  C:\Windows\System\kaWiJXW.exe
  2⤵
  PID:6324
- C:\Windows\System\pPShfRD.exe
  C:\Windows\System\pPShfRD.exe
  2⤵
  PID:6576
- C:\Windows\System\JsRQaZM.exe
  C:\Windows\System\JsRQaZM.exe
  2⤵
  PID:6668
- C:\Windows\System\pvOuHru.exe
  C:\Windows\System\pvOuHru.exe
  2⤵
  PID:6832
- C:\Windows\System\gWyVrJI.exe
  C:\Windows\System\gWyVrJI.exe
  2⤵
  PID:6964
- C:\Windows\System\JyIhXSh.exe
  C:\Windows\System\JyIhXSh.exe
  2⤵
  PID:7056
- C:\Windows\System\gYdAJAO.exe
  C:\Windows\System\gYdAJAO.exe
  2⤵
  PID:7144
- C:\Windows\System\OJIsDoI.exe
  C:\Windows\System\OJIsDoI.exe
  2⤵
  PID:2316
- C:\Windows\System\gkjRxJO.exe
  C:\Windows\System\gkjRxJO.exe
  2⤵
  PID:228
- C:\Windows\System\AxfOMta.exe
  C:\Windows\System\AxfOMta.exe
  2⤵
  PID:4776
- C:\Windows\System\vefwebo.exe
  C:\Windows\System\vefwebo.exe
  2⤵
  PID:6652
- C:\Windows\System\atRCeLs.exe
  C:\Windows\System\atRCeLs.exe
  2⤵
  PID:6928
- C:\Windows\System\gQaYJTF.exe
  C:\Windows\System\gQaYJTF.exe
  2⤵
  PID:4268
- C:\Windows\System\ISRsDcj.exe
  C:\Windows\System\ISRsDcj.exe
  2⤵
  PID:6448
- C:\Windows\System\gNFBjxM.exe
  C:\Windows\System\gNFBjxM.exe
  2⤵
  PID:4796
- C:\Windows\System\WODepqB.exe
  C:\Windows\System\WODepqB.exe
  2⤵
  PID:7176
- C:\Windows\System\BSGlKYf.exe
  C:\Windows\System\BSGlKYf.exe
  2⤵
  PID:7204
- C:\Windows\System\tzrzBga.exe
  C:\Windows\System\tzrzBga.exe
  2⤵
  PID:7228
- C:\Windows\System\voqxvJQ.exe
  C:\Windows\System\voqxvJQ.exe
  2⤵
  PID:7248
- C:\Windows\System\szoyWvG.exe
  C:\Windows\System\szoyWvG.exe
  2⤵
  PID:7288
- C:\Windows\System\nGxAFIE.exe
  C:\Windows\System\nGxAFIE.exe
  2⤵
  PID:7316
- C:\Windows\System\dFtupYe.exe
  C:\Windows\System\dFtupYe.exe
  2⤵
  PID:7348
- C:\Windows\System\IODdfxp.exe
  C:\Windows\System\IODdfxp.exe
  2⤵
  PID:7408
- C:\Windows\System\pclXaVH.exe
  C:\Windows\System\pclXaVH.exe
  2⤵
  PID:7428
- C:\Windows\System\ttZnoCm.exe
  C:\Windows\System\ttZnoCm.exe
  2⤵
  PID:7448
- C:\Windows\System\ufaevEF.exe
  C:\Windows\System\ufaevEF.exe
  2⤵
  PID:7476
- C:\Windows\System\TgOAcdV.exe
  C:\Windows\System\TgOAcdV.exe
  2⤵
  PID:7500
- C:\Windows\System\TxuoGVd.exe
  C:\Windows\System\TxuoGVd.exe
  2⤵
  PID:7528
- C:\Windows\System\yNDrMVg.exe
  C:\Windows\System\yNDrMVg.exe
  2⤵
  PID:7556
- C:\Windows\System\IYAtWkl.exe
  C:\Windows\System\IYAtWkl.exe
  2⤵
  PID:7596
- C:\Windows\System\AyicvHV.exe
  C:\Windows\System\AyicvHV.exe
  2⤵
  PID:7620
- C:\Windows\System\NhksAKW.exe
  C:\Windows\System\NhksAKW.exe
  2⤵
  PID:7640
- C:\Windows\System\qTChjWm.exe
  C:\Windows\System\qTChjWm.exe
  2⤵
  PID:7660
- C:\Windows\System\WsEszcF.exe
  C:\Windows\System\WsEszcF.exe
  2⤵
  PID:7712
- C:\Windows\System\UjujjDb.exe
  C:\Windows\System\UjujjDb.exe
  2⤵
  PID:7736
- C:\Windows\System\TtqJQbl.exe
  C:\Windows\System\TtqJQbl.exe
  2⤵
  PID:7756
- C:\Windows\System\jfmkwHP.exe
  C:\Windows\System\jfmkwHP.exe
  2⤵
  PID:7788
- C:\Windows\System\PwcLtKw.exe
  C:\Windows\System\PwcLtKw.exe
  2⤵
  PID:7816
- C:\Windows\System\SQZjnns.exe
  C:\Windows\System\SQZjnns.exe
  2⤵
  PID:7832
- C:\Windows\System\SaxnjnA.exe
  C:\Windows\System\SaxnjnA.exe
  2⤵
  PID:7856
- C:\Windows\System\fQLTQhR.exe
  C:\Windows\System\fQLTQhR.exe
  2⤵
  PID:7876
- C:\Windows\System\cdolgFD.exe
  C:\Windows\System\cdolgFD.exe
  2⤵
  PID:7928
- C:\Windows\System\psCMTcn.exe
  C:\Windows\System\psCMTcn.exe
  2⤵
  PID:7948
- C:\Windows\System\MVovawC.exe
  C:\Windows\System\MVovawC.exe
  2⤵
  PID:7972
- C:\Windows\System\gctHeRK.exe
  C:\Windows\System\gctHeRK.exe
  2⤵
  PID:8012
- C:\Windows\System\FXuSWHf.exe
  C:\Windows\System\FXuSWHf.exe
  2⤵
  PID:8036
- C:\Windows\System\UIXKpSw.exe
  C:\Windows\System\UIXKpSw.exe
  2⤵
  PID:8056
- C:\Windows\System\iexqGQb.exe
  C:\Windows\System\iexqGQb.exe
  2⤵
  PID:8100
- C:\Windows\System\kcwYOdh.exe
  C:\Windows\System\kcwYOdh.exe
  2⤵
  PID:8120
- C:\Windows\System\ermTrRk.exe
  C:\Windows\System\ermTrRk.exe
  2⤵
  PID:8136
- C:\Windows\System\jXxZEcI.exe
  C:\Windows\System\jXxZEcI.exe
  2⤵
  PID:8180
- C:\Windows\System\CtMxbEd.exe
  C:\Windows\System\CtMxbEd.exe
  2⤵
  PID:7196
- C:\Windows\System\MAoirUr.exe
  C:\Windows\System\MAoirUr.exe
  2⤵
  PID:7184
- C:\Windows\System\kEYmZHB.exe
  C:\Windows\System\kEYmZHB.exe
  2⤵
  PID:7212
- C:\Windows\System\HWyQPyy.exe
  C:\Windows\System\HWyQPyy.exe
  2⤵
  PID:7280
- C:\Windows\System\CpdjaNS.exe
  C:\Windows\System\CpdjaNS.exe
  2⤵
  PID:7340
- C:\Windows\System\LmJBeAy.exe
  C:\Windows\System\LmJBeAy.exe
  2⤵
  PID:7400
- C:\Windows\System\pPpQMhO.exe
  C:\Windows\System\pPpQMhO.exe
  2⤵
  PID:7396
- C:\Windows\System\gNFxeXM.exe
  C:\Windows\System\gNFxeXM.exe
  2⤵
  PID:7492
- C:\Windows\System\Qkvdbyl.exe
  C:\Windows\System\Qkvdbyl.exe
  2⤵
  PID:7584
- C:\Windows\System\CoObpng.exe
  C:\Windows\System\CoObpng.exe
  2⤵
  PID:7768
- C:\Windows\System\PJVopkR.exe
  C:\Windows\System\PJVopkR.exe
  2⤵
  PID:7840
- C:\Windows\System\DHtjvvM.exe
  C:\Windows\System\DHtjvvM.exe
  2⤵
  PID:7904
- C:\Windows\System\bOffUDK.exe
  C:\Windows\System\bOffUDK.exe
  2⤵
  PID:7936
- C:\Windows\System\efdSPmo.exe
  C:\Windows\System\efdSPmo.exe
  2⤵
  PID:8028
- C:\Windows\System\NpVftnd.exe
  C:\Windows\System\NpVftnd.exe
  2⤵
  PID:8024
- C:\Windows\System\BwLkbdx.exe
  C:\Windows\System\BwLkbdx.exe
  2⤵
  PID:8164
- C:\Windows\System\BOqXTBf.exe
  C:\Windows\System\BOqXTBf.exe
  2⤵
  PID:7240
- C:\Windows\System\wXOxElr.exe
  C:\Windows\System\wXOxElr.exe
  2⤵
  PID:7276
- C:\Windows\System\cVsZRRQ.exe
  C:\Windows\System\cVsZRRQ.exe
  2⤵
  PID:7468
- C:\Windows\System\EQkVAtj.exe
  C:\Windows\System\EQkVAtj.exe
  2⤵
  PID:7696
- C:\Windows\System\wiSspKd.exe
  C:\Windows\System\wiSspKd.exe
  2⤵
  PID:7872
- C:\Windows\System\ValQESj.exe
  C:\Windows\System\ValQESj.exe
  2⤵
  PID:7868
- C:\Windows\System\GWoTXQp.exe
  C:\Windows\System\GWoTXQp.exe
  2⤵
  PID:8088
- C:\Windows\System\YgMxNJc.exe
  C:\Windows\System\YgMxNJc.exe
  2⤵
  PID:7364
- C:\Windows\System\jrWTkMW.exe
  C:\Windows\System\jrWTkMW.exe
  2⤵
  PID:7516
- C:\Windows\System\gYJUegz.exe
  C:\Windows\System\gYJUegz.exe
  2⤵
  PID:7748
- C:\Windows\System\tOsGdFF.exe
  C:\Windows\System\tOsGdFF.exe
  2⤵
  PID:7220
- C:\Windows\System\OWzeSps.exe
  C:\Windows\System\OWzeSps.exe
  2⤵
  PID:7464
- C:\Windows\System\gPwixal.exe
  C:\Windows\System\gPwixal.exe
  2⤵
  PID:8216
- C:\Windows\System\NubkOQA.exe
  C:\Windows\System\NubkOQA.exe
  2⤵
  PID:8240
- C:\Windows\System\mqySBTv.exe
  C:\Windows\System\mqySBTv.exe
  2⤵
  PID:8268
- C:\Windows\System\UBqxuwn.exe
  C:\Windows\System\UBqxuwn.exe
  2⤵
  PID:8288
- C:\Windows\System\QxGlXFx.exe
  C:\Windows\System\QxGlXFx.exe
  2⤵
  PID:8316
- C:\Windows\System\ilpXelQ.exe
  C:\Windows\System\ilpXelQ.exe
  2⤵
  PID:8348
- C:\Windows\System\ktxnWLT.exe
  C:\Windows\System\ktxnWLT.exe
  2⤵
  PID:8368
- C:\Windows\System\StGuwrF.exe
  C:\Windows\System\StGuwrF.exe
  2⤵
  PID:8392
- C:\Windows\System\oGmnSbv.exe
  C:\Windows\System\oGmnSbv.exe
  2⤵
  PID:8428
- C:\Windows\System\ZbvdJJQ.exe
  C:\Windows\System\ZbvdJJQ.exe
  2⤵
  PID:8452
- C:\Windows\System\HbXuFcp.exe
  C:\Windows\System\HbXuFcp.exe
  2⤵
  PID:8476
- C:\Windows\System\gRRVENX.exe
  C:\Windows\System\gRRVENX.exe
  2⤵
  PID:8496
- C:\Windows\System\zvEaApB.exe
  C:\Windows\System\zvEaApB.exe
  2⤵
  PID:8512
- C:\Windows\System\CojLpoM.exe
  C:\Windows\System\CojLpoM.exe
  2⤵
  PID:8552
- C:\Windows\System\ehRaByy.exe
  C:\Windows\System\ehRaByy.exe
  2⤵
  PID:8596
- C:\Windows\System\ztCvzzg.exe
  C:\Windows\System\ztCvzzg.exe
  2⤵
  PID:8640
- C:\Windows\System\vWWkYpI.exe
  C:\Windows\System\vWWkYpI.exe
  2⤵
  PID:8660
- C:\Windows\System\GldZXmF.exe
  C:\Windows\System\GldZXmF.exe
  2⤵
  PID:8680
- C:\Windows\System\YXdGIJQ.exe
  C:\Windows\System\YXdGIJQ.exe
  2⤵
  PID:8712
- C:\Windows\System\IyvGpWn.exe
  C:\Windows\System\IyvGpWn.exe
  2⤵
  PID:8752
- C:\Windows\System\yeYUbkk.exe
  C:\Windows\System\yeYUbkk.exe
  2⤵
  PID:8784
- C:\Windows\System\LPRADcm.exe
  C:\Windows\System\LPRADcm.exe
  2⤵
  PID:8804
- C:\Windows\System\vvMAYno.exe
  C:\Windows\System\vvMAYno.exe
  2⤵
  PID:8824
- C:\Windows\System\gQAgkpK.exe
  C:\Windows\System\gQAgkpK.exe
  2⤵
  PID:8892
- C:\Windows\System\smrGiGl.exe
  C:\Windows\System\smrGiGl.exe
  2⤵
  PID:8908
- C:\Windows\System\onvIvgp.exe
  C:\Windows\System\onvIvgp.exe
  2⤵
  PID:8932
- C:\Windows\System\CNPuAIi.exe
  C:\Windows\System\CNPuAIi.exe
  2⤵
  PID:8956
- C:\Windows\System\AjMaOJB.exe
  C:\Windows\System\AjMaOJB.exe
  2⤵
  PID:8980
- C:\Windows\System\Cjdlvyl.exe
  C:\Windows\System\Cjdlvyl.exe
  2⤵
  PID:9028
- C:\Windows\System\PFxEdrp.exe
  C:\Windows\System\PFxEdrp.exe
  2⤵
  PID:9056
- C:\Windows\System\FViXILN.exe
  C:\Windows\System\FViXILN.exe
  2⤵
  PID:9072
- C:\Windows\System\eXTRMZv.exe
  C:\Windows\System\eXTRMZv.exe
  2⤵
  PID:9096
- C:\Windows\System\PVScJXR.exe
  C:\Windows\System\PVScJXR.exe
  2⤵
  PID:9116
- C:\Windows\System\tYaoMGD.exe
  C:\Windows\System\tYaoMGD.exe
  2⤵
  PID:9156
- C:\Windows\System\GYmHLFo.exe
  C:\Windows\System\GYmHLFo.exe
  2⤵
  PID:9196
- C:\Windows\System\FqgYcyf.exe
  C:\Windows\System\FqgYcyf.exe
  2⤵
  PID:8276
- C:\Windows\System\ChImDBD.exe
  C:\Windows\System\ChImDBD.exe
  2⤵
  PID:8388
- C:\Windows\System\MGjgSla.exe
  C:\Windows\System\MGjgSla.exe
  2⤵
  PID:8440
- C:\Windows\System\sMhrVTz.exe
  C:\Windows\System\sMhrVTz.exe
  2⤵
  PID:2888
- C:\Windows\System\CVYNehv.exe
  C:\Windows\System\CVYNehv.exe
  2⤵
  PID:8572
- C:\Windows\System\iedXGzm.exe
  C:\Windows\System\iedXGzm.exe
  2⤵
  PID:8588
- C:\Windows\System\KxJDlev.exe
  C:\Windows\System\KxJDlev.exe
  2⤵
  PID:8672
- C:\Windows\System\aiacvOu.exe
  C:\Windows\System\aiacvOu.exe
  2⤵
  PID:8748
- C:\Windows\System\DspPuto.exe
  C:\Windows\System\DspPuto.exe
  2⤵
  PID:8848
- C:\Windows\System\eLVIkrm.exe
  C:\Windows\System\eLVIkrm.exe
  2⤵
  PID:8952
- C:\Windows\System\IAHDFfm.exe
  C:\Windows\System\IAHDFfm.exe
  2⤵
  PID:9048
- C:\Windows\System\ApfnglJ.exe
  C:\Windows\System\ApfnglJ.exe
  2⤵
  PID:9112
- C:\Windows\System\qMgNPGR.exe
  C:\Windows\System\qMgNPGR.exe
  2⤵
  PID:8264
- C:\Windows\System\fQKFrIK.exe
  C:\Windows\System\fQKFrIK.exe
  2⤵
  PID:8384
- C:\Windows\System\vkLvFLg.exe
  C:\Windows\System\vkLvFLg.exe
  2⤵
  PID:9192
- C:\Windows\System\QOqzJeS.exe
  C:\Windows\System\QOqzJeS.exe
  2⤵
  PID:8232
- C:\Windows\System\OamOOcl.exe
  C:\Windows\System\OamOOcl.exe
  2⤵
  PID:8336
- C:\Windows\System\IlFVrFV.exe
  C:\Windows\System\IlFVrFV.exe
  2⤵
  PID:8548
- C:\Windows\System\NmfVBOR.exe
  C:\Windows\System\NmfVBOR.exe
  2⤵
  PID:8608
- C:\Windows\System\RBjzLbZ.exe
  C:\Windows\System\RBjzLbZ.exe
  2⤵
  PID:8904
- C:\Windows\System\zcwITvq.exe
  C:\Windows\System\zcwITvq.exe
  2⤵
  PID:9080
- C:\Windows\System\vFGbVpN.exe
  C:\Windows\System\vFGbVpN.exe
  2⤵
  PID:9092
- C:\Windows\System\EHHwkkW.exe
  C:\Windows\System\EHHwkkW.exe
  2⤵
  PID:3256
- C:\Windows\System\cGuzUkc.exe
  C:\Windows\System\cGuzUkc.exe
  2⤵
  PID:8424
- C:\Windows\System\djDVnPg.exe
  C:\Windows\System\djDVnPg.exe
  2⤵
  PID:8468
- C:\Windows\System\iVuxfnb.exe
  C:\Windows\System\iVuxfnb.exe
  2⤵
  PID:8656
- C:\Windows\System\ZqCuMwE.exe
  C:\Windows\System\ZqCuMwE.exe
  2⤵
  PID:9180
- C:\Windows\System\JFuOMsN.exe
  C:\Windows\System\JFuOMsN.exe
  2⤵
  PID:9224
- C:\Windows\System\HXdYJKC.exe
  C:\Windows\System\HXdYJKC.exe
  2⤵
  PID:9284
- C:\Windows\System\arnevbs.exe
  C:\Windows\System\arnevbs.exe
  2⤵
  PID:9312
- C:\Windows\System\IXARGbD.exe
  C:\Windows\System\IXARGbD.exe
  2⤵
  PID:9328
- C:\Windows\System\kAiAEpJ.exe
  C:\Windows\System\kAiAEpJ.exe
  2⤵
  PID:9348
- C:\Windows\System\icokmCy.exe
  C:\Windows\System\icokmCy.exe
  2⤵
  PID:9368
- C:\Windows\System\wWjJYhK.exe
  C:\Windows\System\wWjJYhK.exe
  2⤵
  PID:9428
- C:\Windows\System\dzvRSOn.exe
  C:\Windows\System\dzvRSOn.exe
  2⤵
  PID:9460
- C:\Windows\System\tpeawIB.exe
  C:\Windows\System\tpeawIB.exe
  2⤵
  PID:9488
- C:\Windows\System\TPwjVTU.exe
  C:\Windows\System\TPwjVTU.exe
  2⤵
  PID:9520
- C:\Windows\System\Ymtjzpm.exe
  C:\Windows\System\Ymtjzpm.exe
  2⤵
  PID:9548
- C:\Windows\System\vYUVcms.exe
  C:\Windows\System\vYUVcms.exe
  2⤵
  PID:9564
- C:\Windows\System\ZZadmxp.exe
  C:\Windows\System\ZZadmxp.exe
  2⤵
  PID:9584
- C:\Windows\System\WRJdnOJ.exe
  C:\Windows\System\WRJdnOJ.exe
  2⤵
  PID:9612
- C:\Windows\System\WydSnQP.exe
  C:\Windows\System\WydSnQP.exe
  2⤵
  PID:9632
- C:\Windows\System\TBVhAun.exe
  C:\Windows\System\TBVhAun.exe
  2⤵
  PID:9660
- C:\Windows\System\rLtQldg.exe
  C:\Windows\System\rLtQldg.exe
  2⤵
  PID:9724
- C:\Windows\System\sYagMdU.exe
  C:\Windows\System\sYagMdU.exe
  2⤵
  PID:9760
- C:\Windows\System\ClisrMp.exe
  C:\Windows\System\ClisrMp.exe
  2⤵
  PID:9784
- C:\Windows\System\EqbbMsN.exe
  C:\Windows\System\EqbbMsN.exe
  2⤵
  PID:9804
- C:\Windows\System\OhCsIyD.exe
  C:\Windows\System\OhCsIyD.exe
  2⤵
  PID:9848
- C:\Windows\System\tMhYJiG.exe
  C:\Windows\System\tMhYJiG.exe
  2⤵
  PID:9872
- C:\Windows\System\wgZJQbG.exe
  C:\Windows\System\wgZJQbG.exe
  2⤵
  PID:9900
- C:\Windows\System\ApZnlYE.exe
  C:\Windows\System\ApZnlYE.exe
  2⤵
  PID:9928
- C:\Windows\System\WuzGcSq.exe
  C:\Windows\System\WuzGcSq.exe
  2⤵
  PID:9948
- C:\Windows\System\YAHrRoS.exe
  C:\Windows\System\YAHrRoS.exe
  2⤵
  PID:9968
- C:\Windows\System\DsmhzBW.exe
  C:\Windows\System\DsmhzBW.exe
  2⤵
  PID:10008
- C:\Windows\System\zHSnOqf.exe
  C:\Windows\System\zHSnOqf.exe
  2⤵
  PID:10036
- C:\Windows\System\hktJDsF.exe
  C:\Windows\System\hktJDsF.exe
  2⤵
  PID:10060
- C:\Windows\System\MsMsbFG.exe
  C:\Windows\System\MsMsbFG.exe
  2⤵
  PID:10080
- C:\Windows\System\nMNvUuu.exe
  C:\Windows\System\nMNvUuu.exe
  2⤵
  PID:10128
- C:\Windows\System\WMPwHuQ.exe
  C:\Windows\System\WMPwHuQ.exe
  2⤵
  PID:10148
- C:\Windows\System\YDnWHBc.exe
  C:\Windows\System\YDnWHBc.exe
  2⤵
  PID:10172
- C:\Windows\System\eXrmghU.exe
  C:\Windows\System\eXrmghU.exe
  2⤵
  PID:10196
- C:\Windows\System\XquJDia.exe
  C:\Windows\System\XquJDia.exe
  2⤵
  PID:10212
- C:\Windows\System\phXSjur.exe
  C:\Windows\System\phXSjur.exe
  2⤵
  PID:3196
- C:\Windows\System\minDtCO.exe
  C:\Windows\System\minDtCO.exe
  2⤵
  PID:9248
- C:\Windows\System\TIhblRO.exe
  C:\Windows\System\TIhblRO.exe
  2⤵
  PID:9324
- C:\Windows\System\xsnNhcz.exe
  C:\Windows\System\xsnNhcz.exe
  2⤵
  PID:9404
- C:\Windows\System\QTkGjGR.exe
  C:\Windows\System\QTkGjGR.exe
  2⤵
  PID:9452
- C:\Windows\System\WgZDRVC.exe
  C:\Windows\System\WgZDRVC.exe
  2⤵
  PID:9508
- C:\Windows\System\cQOkeur.exe
  C:\Windows\System\cQOkeur.exe
  2⤵
  PID:9560
- C:\Windows\System\aFCfJxJ.exe
  C:\Windows\System\aFCfJxJ.exe
  2⤵
  PID:9652
- C:\Windows\System\shAJvGV.exe
  C:\Windows\System\shAJvGV.exe
  2⤵
  PID:9700
- C:\Windows\System\UovqCKt.exe
  C:\Windows\System\UovqCKt.exe
  2⤵
  PID:9820
- C:\Windows\System\nkaFsHP.exe
  C:\Windows\System\nkaFsHP.exe
  2⤵
  PID:9844
- C:\Windows\System\KFeYZDw.exe
  C:\Windows\System\KFeYZDw.exe
  2⤵
  PID:9896
- C:\Windows\System\UvCPYkX.exe
  C:\Windows\System\UvCPYkX.exe
  2⤵
  PID:9680
- C:\Windows\System\kkCUEPD.exe
  C:\Windows\System\kkCUEPD.exe
  2⤵
  PID:10052
- C:\Windows\System\LqlgsDs.exe
  C:\Windows\System\LqlgsDs.exe
  2⤵
  PID:10144
- C:\Windows\System\gEvKawR.exe
  C:\Windows\System\gEvKawR.exe
  2⤵
  PID:10184
- C:\Windows\System\jSNicqN.exe
  C:\Windows\System\jSNicqN.exe
  2⤵
  PID:8692
- C:\Windows\System\RAxzwpf.exe
  C:\Windows\System\RAxzwpf.exe
  2⤵
  PID:9276
- C:\Windows\System\vTLEzUk.exe
  C:\Windows\System\vTLEzUk.exe
  2⤵
  PID:9448
- C:\Windows\System\JVUYXaa.exe
  C:\Windows\System\JVUYXaa.exe
  2⤵
  PID:9576
- C:\Windows\System\qPTXDCK.exe
  C:\Windows\System\qPTXDCK.exe
  2⤵
  PID:9744
- C:\Windows\System\xEyllfL.exe
  C:\Windows\System\xEyllfL.exe
  2⤵
  PID:9792
- C:\Windows\System\wsXnfcT.exe
  C:\Windows\System\wsXnfcT.exe
  2⤵
  PID:9880
- C:\Windows\System\KqUdYYu.exe
  C:\Windows\System\KqUdYYu.exe
  2⤵
  PID:9980
- C:\Windows\System\XJUlctv.exe
  C:\Windows\System\XJUlctv.exe
  2⤵
  PID:10140
- C:\Windows\System\oEuyEMa.exe
  C:\Windows\System\oEuyEMa.exe
  2⤵
  PID:9528
- C:\Windows\System\XZfcQSH.exe
  C:\Windows\System\XZfcQSH.exe
  2⤵
  PID:9380
- C:\Windows\System\AGyoqVE.exe
  C:\Windows\System\AGyoqVE.exe
  2⤵
  PID:9936
- C:\Windows\System\uWQQGhB.exe
  C:\Windows\System\uWQQGhB.exe
  2⤵
  PID:10192
- C:\Windows\System\cJpHrZP.exe
  C:\Windows\System\cJpHrZP.exe
  2⤵
  PID:1912
- C:\Windows\System\PtjAWGK.exe
  C:\Windows\System\PtjAWGK.exe
  2⤵
  PID:9624
- C:\Windows\System\aNrNwIz.exe
  C:\Windows\System\aNrNwIz.exe
  2⤵
  PID:10276
- C:\Windows\System\ZvxPIbQ.exe
  C:\Windows\System\ZvxPIbQ.exe
  2⤵
  PID:10296
- C:\Windows\System\HsolVAp.exe
  C:\Windows\System\HsolVAp.exe
  2⤵
  PID:10320
- C:\Windows\System\cZzSVxg.exe
  C:\Windows\System\cZzSVxg.exe
  2⤵
  PID:10348
- C:\Windows\System\KoHKmrt.exe
  C:\Windows\System\KoHKmrt.exe
  2⤵
  PID:10364
- C:\Windows\System\SKnbkot.exe
  C:\Windows\System\SKnbkot.exe
  2⤵
  PID:10420
- C:\Windows\System\MWGVLfp.exe
  C:\Windows\System\MWGVLfp.exe
  2⤵
  PID:10444
- C:\Windows\System\yOyyvhM.exe
  C:\Windows\System\yOyyvhM.exe
  2⤵
  PID:10472
- C:\Windows\System\NfpOEfy.exe
  C:\Windows\System\NfpOEfy.exe
  2⤵
  PID:10492
- C:\Windows\System\cSFvDhd.exe
  C:\Windows\System\cSFvDhd.exe
  2⤵
  PID:10516
- C:\Windows\System\DqOrmCI.exe
  C:\Windows\System\DqOrmCI.exe
  2⤵
  PID:10544
- C:\Windows\System\UKLwsKq.exe
  C:\Windows\System\UKLwsKq.exe
  2⤵
  PID:10572
- C:\Windows\System\EFKWelK.exe
  C:\Windows\System\EFKWelK.exe
  2⤵
  PID:10588
- C:\Windows\System\hxVXuZe.exe
  C:\Windows\System\hxVXuZe.exe
  2⤵
  PID:10612
- C:\Windows\System\SRRzazI.exe
  C:\Windows\System\SRRzazI.exe
  2⤵
  PID:10668
- C:\Windows\System\FkOdxJW.exe
  C:\Windows\System\FkOdxJW.exe
  2⤵
  PID:10696
- C:\Windows\System\hGQnsmm.exe
  C:\Windows\System\hGQnsmm.exe
  2⤵
  PID:10712
- C:\Windows\System\pExmSMg.exe
  C:\Windows\System\pExmSMg.exe
  2⤵
  PID:10760
- C:\Windows\System\hIyaCXG.exe
  C:\Windows\System\hIyaCXG.exe
  2⤵
  PID:10784
- C:\Windows\System\nLRNcqG.exe
  C:\Windows\System\nLRNcqG.exe
  2⤵
  PID:10812
- C:\Windows\System\xBhqtXl.exe
  C:\Windows\System\xBhqtXl.exe
  2⤵
  PID:10832
- C:\Windows\System\GxXllIR.exe
  C:\Windows\System\GxXllIR.exe
  2⤵
  PID:10860
- C:\Windows\System\zeCZVqJ.exe
  C:\Windows\System\zeCZVqJ.exe
  2⤵
  PID:10884
- C:\Windows\System\ffygsOE.exe
  C:\Windows\System\ffygsOE.exe
  2⤵
  PID:10916
- C:\Windows\System\PNubnUK.exe
  C:\Windows\System\PNubnUK.exe
  2⤵
  PID:10944
- C:\Windows\System\cDdGPBH.exe
  C:\Windows\System\cDdGPBH.exe
  2⤵
  PID:10972
- C:\Windows\System\gNvsUXr.exe
  C:\Windows\System\gNvsUXr.exe
  2⤵
  PID:10992
- C:\Windows\System\sLtJviz.exe
  C:\Windows\System\sLtJviz.exe
  2⤵
  PID:11016
- C:\Windows\System\iaVDacx.exe
  C:\Windows\System\iaVDacx.exe
  2⤵
  PID:11036
- C:\Windows\System\qZerEAT.exe
  C:\Windows\System\qZerEAT.exe
  2⤵
  PID:11064
- C:\Windows\System\ikPhLBo.exe
  C:\Windows\System\ikPhLBo.exe
  2⤵
  PID:11088
- C:\Windows\System\JaSMxQb.exe
  C:\Windows\System\JaSMxQb.exe
  2⤵
  PID:11108
- C:\Windows\System\FYXSXhz.exe
  C:\Windows\System\FYXSXhz.exe
  2⤵
  PID:11148
- C:\Windows\System\QZIMbLV.exe
  C:\Windows\System\QZIMbLV.exe
  2⤵
  PID:11180
- C:\Windows\System\HviKubd.exe
  C:\Windows\System\HviKubd.exe
  2⤵
  PID:11232
- C:\Windows\System\CZTJunk.exe
  C:\Windows\System\CZTJunk.exe
  2⤵
  PID:11256
- C:\Windows\System\qYhJLhJ.exe
  C:\Windows\System\qYhJLhJ.exe
  2⤵
  PID:10264
- C:\Windows\System\INPLTLM.exe
  C:\Windows\System\INPLTLM.exe
  2⤵
  PID:10312
- C:\Windows\System\LlVzKlq.exe
  C:\Windows\System\LlVzKlq.exe
  2⤵
  PID:10380
- C:\Windows\System\BDoDiFs.exe
  C:\Windows\System\BDoDiFs.exe
  2⤵
  PID:10416
- C:\Windows\System\XOdFTro.exe
  C:\Windows\System\XOdFTro.exe
  2⤵
  PID:10536
- C:\Windows\System\oRnZnMB.exe
  C:\Windows\System\oRnZnMB.exe
  2⤵
  PID:10584
- C:\Windows\System\zHPYrzB.exe
  C:\Windows\System\zHPYrzB.exe
  2⤵
  PID:10680
- C:\Windows\System\YDQxgmG.exe
  C:\Windows\System\YDQxgmG.exe
  2⤵
  PID:10740
- C:\Windows\System\RceZjBs.exe
  C:\Windows\System\RceZjBs.exe
  2⤵
  PID:10792
- C:\Windows\System\wUmKZFc.exe
  C:\Windows\System\wUmKZFc.exe
  2⤵
  PID:10876
- C:\Windows\System\iUERhYC.exe
  C:\Windows\System\iUERhYC.exe
  2⤵
  PID:10940
- C:\Windows\System\WLjUSaF.exe
  C:\Windows\System\WLjUSaF.exe
  2⤵
  PID:11000
- C:\Windows\System\qztKXJI.exe
  C:\Windows\System\qztKXJI.exe
  2⤵
  PID:11032
- C:\Windows\System\lnrFEDQ.exe
  C:\Windows\System\lnrFEDQ.exe
  2⤵
  PID:11100
- C:\Windows\System\qsBJNET.exe
  C:\Windows\System\qsBJNET.exe
  2⤵
  PID:11140
- C:\Windows\System\NOOAjoL.exe
  C:\Windows\System\NOOAjoL.exe
  2⤵
  PID:11252
- C:\Windows\System\RJaMouQ.exe
  C:\Windows\System\RJaMouQ.exe
  2⤵
  PID:10360
- C:\Windows\System\QSAxJWw.exe
  C:\Windows\System\QSAxJWw.exe
  2⤵
  PID:10480
- C:\Windows\System\IkVMhsv.exe
  C:\Windows\System\IkVMhsv.exe
  2⤵
  PID:10644
- C:\Windows\System\lThkkeZ.exe
  C:\Windows\System\lThkkeZ.exe
  2⤵
  PID:10824
- C:\Windows\System\GtEGVIG.exe
  C:\Windows\System\GtEGVIG.exe
  2⤵
  PID:10872
- C:\Windows\System\wXtPkjK.exe
  C:\Windows\System\wXtPkjK.exe
  2⤵
  PID:11004
- C:\Windows\System\XbQofLA.exe
  C:\Windows\System\XbQofLA.exe
  2⤵
  PID:11240
- C:\Windows\System\iqdOnYW.exe
  C:\Windows\System\iqdOnYW.exe
  2⤵
  PID:10608
- C:\Windows\System\YEaFeoI.exe
  C:\Windows\System\YEaFeoI.exe
  2⤵
  PID:10756
- C:\Windows\System\sIoxhFq.exe
  C:\Windows\System\sIoxhFq.exe
  2⤵
  PID:10956
- C:\Windows\System\NdSgHdr.exe
  C:\Windows\System\NdSgHdr.exe
  2⤵
  PID:10248
- C:\Windows\System\JbwAiof.exe
  C:\Windows\System\JbwAiof.exe
  2⤵
  PID:11196
- C:\Windows\System\mVJfkRe.exe
  C:\Windows\System\mVJfkRe.exe
  2⤵
  PID:11296
- C:\Windows\System\lESBpKm.exe
  C:\Windows\System\lESBpKm.exe
  2⤵
  PID:11316
- C:\Windows\System\KusuivS.exe
  C:\Windows\System\KusuivS.exe
  2⤵
  PID:11332
- C:\Windows\System\AkwkXMW.exe
  C:\Windows\System\AkwkXMW.exe
  2⤵
  PID:11376
- C:\Windows\System\WxMFQjG.exe
  C:\Windows\System\WxMFQjG.exe
  2⤵
  PID:11404
- C:\Windows\System\Poojtdw.exe
  C:\Windows\System\Poojtdw.exe
  2⤵
  PID:11432
- C:\Windows\System\jmVKjQi.exe
  C:\Windows\System\jmVKjQi.exe
  2⤵
  PID:11460
- C:\Windows\System\gpwWita.exe
  C:\Windows\System\gpwWita.exe
  2⤵
  PID:11500
- C:\Windows\System\yLfgzxM.exe
  C:\Windows\System\yLfgzxM.exe
  2⤵
  PID:11524
- C:\Windows\System\swCFLSf.exe
  C:\Windows\System\swCFLSf.exe
  2⤵
  PID:11552
- C:\Windows\System\iUooEXr.exe
  C:\Windows\System\iUooEXr.exe
  2⤵
  PID:11580
- C:\Windows\System\nSKOgbX.exe
  C:\Windows\System\nSKOgbX.exe
  2⤵
  PID:11604
- C:\Windows\System\cIXIrXL.exe
  C:\Windows\System\cIXIrXL.exe
  2⤵
  PID:11636
- C:\Windows\System\HnCHLzA.exe
  C:\Windows\System\HnCHLzA.exe
  2⤵
  PID:11656
- C:\Windows\System\sXpLLHO.exe
  C:\Windows\System\sXpLLHO.exe
  2⤵
  PID:11680
- C:\Windows\System\kwBgjry.exe
  C:\Windows\System\kwBgjry.exe
  2⤵
  PID:11716
- C:\Windows\System\WaHcopL.exe
  C:\Windows\System\WaHcopL.exe
  2⤵
  PID:11748
- C:\Windows\System\VdOfwfX.exe
  C:\Windows\System\VdOfwfX.exe
  2⤵
  PID:11768
- C:\Windows\System\chLqDsw.exe
  C:\Windows\System\chLqDsw.exe
  2⤵
  PID:11808
- C:\Windows\System\hNaRJad.exe
  C:\Windows\System\hNaRJad.exe
  2⤵
  PID:11832
- C:\Windows\System\MDudayq.exe
  C:\Windows\System\MDudayq.exe
  2⤵
  PID:11852
- C:\Windows\System\kMjrnwe.exe
  C:\Windows\System\kMjrnwe.exe
  2⤵
  PID:11876
- C:\Windows\System\XGEtzZG.exe
  C:\Windows\System\XGEtzZG.exe
  2⤵
  PID:11908
- C:\Windows\System\VUEBDOT.exe
  C:\Windows\System\VUEBDOT.exe
  2⤵
  PID:11932
- C:\Windows\System\rjYcKva.exe
  C:\Windows\System\rjYcKva.exe
  2⤵
  PID:11964
- C:\Windows\System\QPASIvw.exe
  C:\Windows\System\QPASIvw.exe
  2⤵
  PID:11984
- C:\Windows\System\NUgGknR.exe
  C:\Windows\System\NUgGknR.exe
  2⤵
  PID:12008
- C:\Windows\System\thkJqSk.exe
  C:\Windows\System\thkJqSk.exe
  2⤵
  PID:12048
- C:\Windows\System\IsBgsZx.exe
  C:\Windows\System\IsBgsZx.exe
  2⤵
  PID:12076
- C:\Windows\System\qJLGXzh.exe
  C:\Windows\System\qJLGXzh.exe
  2⤵
  PID:12096
- C:\Windows\System\jeTlLYK.exe
  C:\Windows\System\jeTlLYK.exe
  2⤵
  PID:12120
- C:\Windows\System\zqNDChn.exe
  C:\Windows\System\zqNDChn.exe
  2⤵
  PID:12140
- C:\Windows\System\HlSFusw.exe
  C:\Windows\System\HlSFusw.exe
  2⤵
  PID:12216
- C:\Windows\System\ZqEzLvs.exe
  C:\Windows\System\ZqEzLvs.exe
  2⤵
  PID:12232
- C:\Windows\System\MaiwxkT.exe
  C:\Windows\System\MaiwxkT.exe
  2⤵
  PID:12248
- C:\Windows\System\xPbORae.exe
  C:\Windows\System\xPbORae.exe
  2⤵
  PID:12264
- C:\Windows\System\ysDeSJE.exe
  C:\Windows\System\ysDeSJE.exe
  2⤵
  PID:12280
- C:\Windows\System\VmPLVRK.exe
  C:\Windows\System\VmPLVRK.exe
  2⤵
  PID:10684
- C:\Windows\System\XCAEMUc.exe
  C:\Windows\System\XCAEMUc.exe
  2⤵
  PID:11284
- C:\Windows\System\QuZrTqC.exe
  C:\Windows\System\QuZrTqC.exe
  2⤵
  PID:11328
- C:\Windows\System\ZpezgNz.exe
  C:\Windows\System\ZpezgNz.exe
  2⤵
  PID:11356
- C:\Windows\System\XdqSXUL.exe
  C:\Windows\System\XdqSXUL.exe
  2⤵
  PID:11416
- C:\Windows\System\utkwecc.exe
  C:\Windows\System\utkwecc.exe
  2⤵
  PID:11448
- C:\Windows\System\RLBxkYx.exe
  C:\Windows\System\RLBxkYx.exe
  2⤵
  PID:11692
- C:\Windows\System\CTvbVVm.exe
  C:\Windows\System\CTvbVVm.exe
  2⤵
  PID:11760
- C:\Windows\System\IWMhZpY.exe
  C:\Windows\System\IWMhZpY.exe
  2⤵
  PID:11804
- C:\Windows\System\QIBkDLy.exe
  C:\Windows\System\QIBkDLy.exe
  2⤵
  PID:11928
- C:\Windows\System\gtsFlQY.exe
  C:\Windows\System\gtsFlQY.exe
  2⤵
  PID:12004
- C:\Windows\System\EzRNCmO.exe
  C:\Windows\System\EzRNCmO.exe
  2⤵
  PID:12112
- C:\Windows\System\itsyMeB.exe
  C:\Windows\System\itsyMeB.exe
  2⤵
  PID:12188
- C:\Windows\System\DfzjNDb.exe
  C:\Windows\System\DfzjNDb.exe
  2⤵
  PID:12272
- C:\Windows\System\sKCIODW.exe
  C:\Windows\System\sKCIODW.exe
  2⤵
  PID:10852
- C:\Windows\System\URYVuUn.exe
  C:\Windows\System\URYVuUn.exe
  2⤵
  PID:11392
- C:\Windows\System\mnyWNbR.exe
  C:\Windows\System\mnyWNbR.exe
  2⤵
  PID:12196
- C:\Windows\System\tvHxMYR.exe
  C:\Windows\System\tvHxMYR.exe
  2⤵
  PID:11352
- C:\Windows\System\nYYGRTt.exe
  C:\Windows\System\nYYGRTt.exe
  2⤵
  PID:11844
- C:\Windows\System\PXRvdXR.exe
  C:\Windows\System\PXRvdXR.exe
  2⤵
  PID:11892
- C:\Windows\System\fRFutgG.exe
  C:\Windows\System\fRFutgG.exe
  2⤵
  PID:12092
- C:\Windows\System\cZDuUjS.exe
  C:\Windows\System\cZDuUjS.exe
  2⤵
  PID:12244
- C:\Windows\System\ioJotvJ.exe
  C:\Windows\System\ioJotvJ.exe
  2⤵
  PID:11512
- C:\Windows\System\TGZWbKR.exe
  C:\Windows\System\TGZWbKR.exe
  2⤵
  PID:12028
- C:\Windows\System\rgxVUSG.exe
  C:\Windows\System\rgxVUSG.exe
  2⤵
  PID:12184
- C:\Windows\System\hJMLwSc.exe
  C:\Windows\System\hJMLwSc.exe
  2⤵
  PID:11996
- C:\Windows\System\mNROssK.exe
  C:\Windows\System\mNROssK.exe
  2⤵
  PID:12296
- C:\Windows\System\STcEKSo.exe
  C:\Windows\System\STcEKSo.exe
  2⤵
  PID:12332
- C:\Windows\System\sdSpMbS.exe
  C:\Windows\System\sdSpMbS.exe
  2⤵
  PID:12360
- C:\Windows\System\qmdBIrK.exe
  C:\Windows\System\qmdBIrK.exe
  2⤵
  PID:12380
- C:\Windows\System\blDpgTE.exe
  C:\Windows\System\blDpgTE.exe
  2⤵
  PID:12420
- C:\Windows\System\xrEMneL.exe
  C:\Windows\System\xrEMneL.exe
  2⤵
  PID:12452
- C:\Windows\System\ssTbhzi.exe
  C:\Windows\System\ssTbhzi.exe
  2⤵
  PID:12472
- C:\Windows\System\AvdoLUN.exe
  C:\Windows\System\AvdoLUN.exe
  2⤵
  PID:12492
- C:\Windows\System\wgxjRMZ.exe
  C:\Windows\System\wgxjRMZ.exe
  2⤵
  PID:12516
- C:\Windows\System\EpmKVwr.exe
  C:\Windows\System\EpmKVwr.exe
  2⤵
  PID:12552
- C:\Windows\System\aazIrSQ.exe
  C:\Windows\System\aazIrSQ.exe
  2⤵
  PID:12604
- C:\Windows\System\OBIMdkW.exe
  C:\Windows\System\OBIMdkW.exe
  2⤵
  PID:12620
- C:\Windows\System\zALzLvz.exe
  C:\Windows\System\zALzLvz.exe
  2⤵
  PID:12640
- C:\Windows\System\zrnTXIp.exe
  C:\Windows\System\zrnTXIp.exe
  2⤵
  PID:12680
- C:\Windows\System\KDFfeyu.exe
  C:\Windows\System\KDFfeyu.exe
  2⤵
  PID:12704
- C:\Windows\System\BBpoVNG.exe
  C:\Windows\System\BBpoVNG.exe
  2⤵
  PID:12724
- C:\Windows\System\pssYWYb.exe
  C:\Windows\System\pssYWYb.exe
  2⤵
  PID:12744
- C:\Windows\System\qnAlPpb.exe
  C:\Windows\System\qnAlPpb.exe
  2⤵
  PID:12776
- C:\Windows\System\fbPgSLh.exe
  C:\Windows\System\fbPgSLh.exe
  2⤵
  PID:12792
- C:\Windows\System\oZmBqhy.exe
  C:\Windows\System\oZmBqhy.exe
  2⤵
  PID:12820
- C:\Windows\System\YtNtStf.exe
  C:\Windows\System\YtNtStf.exe
  2⤵
  PID:12840
- C:\Windows\System\qZeNMTo.exe
  C:\Windows\System\qZeNMTo.exe
  2⤵
  PID:12860
- C:\Windows\System\usBbZtn.exe
  C:\Windows\System\usBbZtn.exe
  2⤵
  PID:12904
- C:\Windows\System\hhuidGg.exe
  C:\Windows\System\hhuidGg.exe
  2⤵
  PID:12920
- C:\Windows\System\lsPzyTs.exe
  C:\Windows\System\lsPzyTs.exe
  2⤵
  PID:12940
- C:\Windows\System\gkQQHTZ.exe
  C:\Windows\System\gkQQHTZ.exe
  2⤵
  PID:12960
- C:\Windows\System\TzOIhzr.exe
  C:\Windows\System\TzOIhzr.exe
  2⤵
  PID:12984
- C:\Windows\System\RFyzObv.exe
  C:\Windows\System\RFyzObv.exe
  2⤵
  PID:13000
- C:\Windows\System\jkokbXQ.exe
  C:\Windows\System\jkokbXQ.exe
  2⤵
  PID:13028
- C:\Windows\System\QrUrvvn.exe
  C:\Windows\System\QrUrvvn.exe
  2⤵
  PID:13100
- C:\Windows\System\rCpLhab.exe
  C:\Windows\System\rCpLhab.exe
  2⤵
  PID:13136
- C:\Windows\System\GEyzcUq.exe
  C:\Windows\System\GEyzcUq.exe
  2⤵
  PID:13172
- C:\Windows\System\faQPokZ.exe
  C:\Windows\System\faQPokZ.exe
  2⤵
  PID:13204
- C:\Windows\System\WNmokrQ.exe
  C:\Windows\System\WNmokrQ.exe
  2⤵
  PID:13228
- C:\Windows\System\xLMcYBd.exe
  C:\Windows\System\xLMcYBd.exe
  2⤵
  PID:13244
- C:\Windows\System\OrZFzmJ.exe
  C:\Windows\System\OrZFzmJ.exe
  2⤵
  PID:13288
- C:\Windows\System\JrAPzhY.exe
  C:\Windows\System\JrAPzhY.exe
  2⤵
  PID:11868
- C:\Windows\System\xYNIZyR.exe
  C:\Windows\System\xYNIZyR.exe
  2⤵
  PID:12344
- C:\Windows\System\zRpuGKv.exe
  C:\Windows\System\zRpuGKv.exe
  2⤵
  PID:12356
- C:\Windows\System\tjzCKQc.exe
  C:\Windows\System\tjzCKQc.exe
  2⤵
  PID:12468
- C:\Windows\System\ahaVFuW.exe
  C:\Windows\System\ahaVFuW.exe
  2⤵
  PID:12528
- C:\Windows\System\veMobYJ.exe
  C:\Windows\System\veMobYJ.exe
  2⤵
  PID:12588
- C:\Windows\System\ElIcYLW.exe
  C:\Windows\System\ElIcYLW.exe
  2⤵
  PID:12616
- C:\Windows\System\CMKIkZu.exe
  C:\Windows\System\CMKIkZu.exe
  2⤵
  PID:12764
- C:\Windows\System\zeqgdDv.exe
  C:\Windows\System\zeqgdDv.exe
  2⤵
  PID:12832
- C:\Windows\System\OPPPFfd.exe
  C:\Windows\System\OPPPFfd.exe
  2⤵
  PID:12760
- C:\Windows\System\hzwysmg.exe
  C:\Windows\System\hzwysmg.exe
  2⤵
  PID:12900
- C:\Windows\System\fMHExsg.exe
  C:\Windows\System\fMHExsg.exe
  2⤵
  PID:12916
- C:\Windows\System\xndsUPM.exe
  C:\Windows\System\xndsUPM.exe
  2⤵
  PID:13052
- C:\Windows\System\PSncIMc.exe
  C:\Windows\System\PSncIMc.exe
  2⤵
  PID:13096
- C:\Windows\System\xDFgNQn.exe
  C:\Windows\System\xDFgNQn.exe
  2⤵
  PID:13200
- C:\Windows\System\acnswCP.exe
  C:\Windows\System\acnswCP.exe
  2⤵
  PID:13220
- C:\Windows\System\bFAfYEJ.exe
  C:\Windows\System\bFAfYEJ.exe
  2⤵
  PID:13296
- C:\Windows\System\RUCftYU.exe
  C:\Windows\System\RUCftYU.exe
  2⤵
  PID:12464
- C:\Windows\System\dXaWrjx.exe
  C:\Windows\System\dXaWrjx.exe
  2⤵
  PID:12596
- C:\Windows\System\JXNHBbA.exe
  C:\Windows\System\JXNHBbA.exe
  2⤵
  PID:12732
- C:\Windows\System\dANNjaT.exe
  C:\Windows\System\dANNjaT.exe
  2⤵
  PID:12972
- C:\Windows\System\oyTmIOB.exe
  C:\Windows\System\oyTmIOB.exe
  2⤵
  PID:12996
- C:\Windows\System\dLxqXLz.exe
  C:\Windows\System\dLxqXLz.exe
  2⤵
  PID:13212
- C:\Windows\System\FyMSwzs.exe
  C:\Windows\System\FyMSwzs.exe
  2⤵
  PID:12416
- C:\Windows\System\OoylqOT.exe
  C:\Windows\System\OoylqOT.exe
  2⤵
  PID:12508
- C:\Windows\System\VtUlQNj.exe
  C:\Windows\System\VtUlQNj.exe
  2⤵
  PID:12992
- C:\Windows\System\jCJmppt.exe
  C:\Windows\System\jCJmppt.exe
  2⤵
  PID:12712
- C:\Windows\System\YNdDnwK.exe
  C:\Windows\System\YNdDnwK.exe
  2⤵
  PID:1432
- C:\Windows\System\LfJKNrq.exe
  C:\Windows\System\LfJKNrq.exe
  2⤵
  PID:13576
- C:\Windows\System\jfSdILS.exe
  C:\Windows\System\jfSdILS.exe
  2⤵
  PID:13748
- C:\Windows\System\MCYsoDM.exe
  C:\Windows\System\MCYsoDM.exe
  2⤵
  PID:13764
- C:\Windows\System\MEzJdPH.exe
  C:\Windows\System\MEzJdPH.exe
  2⤵
  PID:13788
- C:\Windows\System\OCaqSre.exe
  C:\Windows\System\OCaqSre.exe
  2⤵
  PID:13808
- C:\Windows\System\ofGsTTr.exe
  C:\Windows\System\ofGsTTr.exe
  2⤵
  PID:13860
- C:\Windows\System\xdoQKDG.exe
  C:\Windows\System\xdoQKDG.exe
  2⤵
  PID:13920
- C:\Windows\System\eAgLbyS.exe
  C:\Windows\System\eAgLbyS.exe
  2⤵
  PID:14000
- C:\Windows\System\FRCECeE.exe
  C:\Windows\System\FRCECeE.exe
  2⤵
  PID:14028
- C:\Windows\System\BsbGuHb.exe
  C:\Windows\System\BsbGuHb.exe
  2⤵
  PID:14052
- C:\Windows\System\DVHZvRF.exe
  C:\Windows\System\DVHZvRF.exe
  2⤵
  PID:13536
- C:\Windows\System\PQeyows.exe
  C:\Windows\System\PQeyows.exe
  2⤵
  PID:584
- C:\Windows\System\fQoHmhj.exe
  C:\Windows\System\fQoHmhj.exe
  2⤵
  PID:3768
- C:\Windows\System\liIGdOZ.exe
  C:\Windows\System\liIGdOZ.exe
  2⤵
  PID:13356
- C:\Windows\System\UXgjtGk.exe
  C:\Windows\System\UXgjtGk.exe
  2⤵
  PID:13444
- C:\Windows\System\cRJbzjQ.exe
  C:\Windows\System\cRJbzjQ.exe
  2⤵
  PID:13464
- C:\Windows\System\kVDPWZX.exe
  C:\Windows\System\kVDPWZX.exe
  2⤵
  PID:13336
- C:\Windows\System\RrPRUgx.exe
  C:\Windows\System\RrPRUgx.exe
  2⤵
  PID:3868
- C:\Windows\System\GKvcKgU.exe
  C:\Windows\System\GKvcKgU.exe
  2⤵
  PID:1140
- C:\Windows\System\zSSgDQX.exe
  C:\Windows\System\zSSgDQX.exe
  2⤵
  PID:13632
- C:\Windows\System\NEQlEiK.exe
  C:\Windows\System\NEQlEiK.exe
  2⤵
  PID:5000
- C:\Windows\System\iyzosBj.exe
  C:\Windows\System\iyzosBj.exe
  2⤵
  PID:1316
- C:\Windows\System\yOpsJhp.exe
  C:\Windows\System\yOpsJhp.exe
  2⤵
  PID:5660
- C:\Windows\System\FbUEgeE.exe
  C:\Windows\System\FbUEgeE.exe
  2⤵
  PID:13744
- C:\Windows\System\jqUeSAK.exe
  C:\Windows\System\jqUeSAK.exe
  2⤵
  PID:13348
- C:\Windows\System\DLIqKOh.exe
  C:\Windows\System\DLIqKOh.exe
  2⤵
  PID:13368
- C:\Windows\System\jtrQGgQ.exe
  C:\Windows\System\jtrQGgQ.exe
  2⤵
  PID:3520
- C:\Windows\System\GXlsyWI.exe
  C:\Windows\System\GXlsyWI.exe
  2⤵
  PID:4216
- C:\Windows\System\yDlKuur.exe
  C:\Windows\System\yDlKuur.exe
  2⤵
  PID:13400
- C:\Windows\System\QxDHQKf.exe
  C:\Windows\System\QxDHQKf.exe
  2⤵
  PID:13592
- C:\Windows\System\LdTppFa.exe
  C:\Windows\System\LdTppFa.exe
  2⤵
  PID:13552
- C:\Windows\System\LmVNwWl.exe
  C:\Windows\System\LmVNwWl.exe
  2⤵
  PID:2796
- C:\Windows\System\UJcrekY.exe
  C:\Windows\System\UJcrekY.exe
  2⤵
  PID:13688
- C:\Windows\System\FUXpyJA.exe
  C:\Windows\System\FUXpyJA.exe
  2⤵
  PID:7548
- C:\Windows\System\hGchnfN.exe
  C:\Windows\System\hGchnfN.exe
  2⤵
  PID:7628
- C:\Windows\System\GnLyJMO.exe
  C:\Windows\System\GnLyJMO.exe
  2⤵
  PID:6856
- C:\Windows\System\YJsthVd.exe
  C:\Windows\System\YJsthVd.exe
  2⤵
  PID:8416
- C:\Windows\System\RUWjEJn.exe
  C:\Windows\System\RUWjEJn.exe
  2⤵
  PID:14080
- C:\Windows\System\HMIQMFj.exe
  C:\Windows\System\HMIQMFj.exe
  2⤵
  PID:4764
- C:\Windows\System\hAWXiYg.exe
  C:\Windows\System\hAWXiYg.exe
  2⤵
  PID:4132
- C:\Windows\System\fMbJogD.exe
  C:\Windows\System\fMbJogD.exe
  2⤵
  PID:2172
- C:\Windows\System\FThywKG.exe
  C:\Windows\System\FThywKG.exe
  2⤵
  PID:3780
- C:\Windows\System\yLTbAXB.exe
  C:\Windows\System\yLTbAXB.exe
  2⤵
  PID:9504
- C:\Windows\System\atSZcUE.exe
  C:\Windows\System\atSZcUE.exe
  2⤵
  PID:7968
- C:\Windows\System\OjtaTOs.exe
  C:\Windows\System\OjtaTOs.exe
  2⤵
  PID:13672
- C:\Windows\System\sqaTsid.exe
  C:\Windows\System\sqaTsid.exe
  2⤵
  PID:5088
- C:\Windows\System\tzKhgyD.exe
  C:\Windows\System\tzKhgyD.exe
  2⤵
  PID:14152
- C:\Windows\System\sduKWWD.exe
  C:\Windows\System\sduKWWD.exe
  2⤵
  PID:1752
- C:\Windows\System\XTiclKz.exe
  C:\Windows\System\XTiclKz.exe
  2⤵
  PID:9812
- C:\Windows\System\HXVcwua.exe
  C:\Windows\System\HXVcwua.exe
  2⤵
  PID:14176
- C:\Windows\System\nSGkdKl.exe
  C:\Windows\System\nSGkdKl.exe
  2⤵
  PID:9924
- C:\Windows\System\FbcDMZI.exe
  C:\Windows\System\FbcDMZI.exe
  2⤵
  PID:14132
- C:\Windows\System\qbdnQKt.exe
  C:\Windows\System\qbdnQKt.exe
  2⤵
  PID:7544
- C:\Windows\System\qEDicJP.exe
  C:\Windows\System\qEDicJP.exe
  2⤵
  PID:14144
- C:\Windows\System\eAxpnUb.exe
  C:\Windows\System\eAxpnUb.exe
  2⤵
  PID:14240
- C:\Windows\System\KGUaMoO.exe
  C:\Windows\System\KGUaMoO.exe
  2⤵
  PID:14236
- C:\Windows\System\tLAtBIz.exe
  C:\Windows\System\tLAtBIz.exe
  2⤵
  PID:7704
- C:\Windows\System\bwEEpyz.exe
  C:\Windows\System\bwEEpyz.exe
  2⤵
  PID:8540
- C:\Windows\System\nuSMCoc.exe
  C:\Windows\System\nuSMCoc.exe
  2⤵
  PID:10228
- C:\Windows\System\uHRgAYY.exe
  C:\Windows\System\uHRgAYY.exe
  2⤵
  PID:7764
- C:\Windows\System\aIXjWdL.exe
  C:\Windows\System\aIXjWdL.exe
  2⤵
  PID:7812
- C:\Windows\System\AMiBqYS.exe
  C:\Windows\System\AMiBqYS.exe
  2⤵
  PID:8688
- C:\Windows\System\wKPbLfH.exe
  C:\Windows\System\wKPbLfH.exe
  2⤵
  PID:5112
- C:\Windows\System\gxIadtI.exe
  C:\Windows\System\gxIadtI.exe
  2⤵
  PID:13816
- C:\Windows\System\XSwYvRW.exe
  C:\Windows\System\XSwYvRW.exe
  2⤵
  PID:13868
- C:\Windows\System\PhHwYuB.exe
  C:\Windows\System\PhHwYuB.exe
  2⤵
  PID:8760
- C:\Windows\System\MdHjAtp.exe
  C:\Windows\System\MdHjAtp.exe
  2⤵
  PID:8044
- C:\Windows\System\uMHUylR.exe
  C:\Windows\System\uMHUylR.exe
  2⤵
  PID:6408
- C:\Windows\System\iHOFzBc.exe
  C:\Windows\System\iHOFzBc.exe
  2⤵
  PID:13492
- C:\Windows\System\mnaptrf.exe
  C:\Windows\System\mnaptrf.exe
  2⤵
  PID:13556
- C:\Windows\System\RFndtIP.exe
  C:\Windows\System\RFndtIP.exe
  2⤵
  PID:4756
- C:\Windows\System\bzOPRrU.exe
  C:\Windows\System\bzOPRrU.exe
  2⤵
  PID:984
- C:\Windows\System\GYPETeQ.exe
  C:\Windows\System\GYPETeQ.exe
  2⤵
  PID:512
- C:\Windows\System\cgfIaWe.exe
  C:\Windows\System\cgfIaWe.exe
  2⤵
  PID:9256
- C:\Windows\System\GhmTcUb.exe
  C:\Windows\System\GhmTcUb.exe
  2⤵
  PID:2748
- C:\Windows\System\fPwQdxH.exe
  C:\Windows\System\fPwQdxH.exe
  2⤵
  PID:9692
- C:\Windows\System\ClvLhLX.exe
  C:\Windows\System\ClvLhLX.exe
  2⤵
  PID:3396
- C:\Windows\System\QwKkcRT.exe
  C:\Windows\System\QwKkcRT.exe
  2⤵
  PID:5780
- C:\Windows\System\YscQJdc.exe
  C:\Windows\System\YscQJdc.exe
  2⤵
  PID:5836
- C:\Windows\System\Tmslroa.exe
  C:\Windows\System\Tmslroa.exe
  2⤵
  PID:10156
- C:\Windows\System\GkqEVGG.exe
  C:\Windows\System\GkqEVGG.exe
  2⤵
  PID:11536
- C:\Windows\System\AvIoxcY.exe
  C:\Windows\System\AvIoxcY.exe
  2⤵
  PID:4336
- C:\Windows\System\dSTTYHl.exe
  C:\Windows\System\dSTTYHl.exe
  2⤵
  PID:6120
- C:\Windows\System\WOhVnEo.exe
  C:\Windows\System\WOhVnEo.exe
  2⤵
  PID:13604
- C:\Windows\System\JlFbUNR.exe
  C:\Windows\System\JlFbUNR.exe
  2⤵
  PID:13820
- C:\Windows\System\fSRsZbw.exe
  C:\Windows\System\fSRsZbw.exe
  2⤵
  PID:11884
- C:\Windows\System\IeTROZM.exe
  C:\Windows\System\IeTROZM.exe
  2⤵
  PID:10372
- C:\Windows\System\fGWyCdj.exe
  C:\Windows\System\fGWyCdj.exe
  2⤵
  PID:12428
- C:\Windows\System\EKxWtjk.exe
  C:\Windows\System\EKxWtjk.exe
  2⤵
  PID:12548
- C:\Windows\System\bnGbSer.exe
  C:\Windows\System\bnGbSer.exe
  2⤵
  PID:12584
- C:\Windows\System\LsveCip.exe
  C:\Windows\System\LsveCip.exe
  2⤵
  PID:5320
- C:\Windows\System\QSZNxeH.exe
  C:\Windows\System\QSZNxeH.exe
  2⤵
  PID:5232
- C:\Windows\System\qSqydOv.exe
  C:\Windows\System\qSqydOv.exe
  2⤵
  PID:3408
- C:\Windows\System\zJdhAdf.exe
  C:\Windows\System\zJdhAdf.exe
  2⤵
  PID:12700
- C:\Windows\System\ELEFkfm.exe
  C:\Windows\System\ELEFkfm.exe
  2⤵
  PID:11156
- C:\Windows\System\jNvunFR.exe
  C:\Windows\System\jNvunFR.exe
  2⤵
  PID:14060
- C:\Windows\System\LDuJXiR.exe
  C:\Windows\System\LDuJXiR.exe
  2⤵
  PID:11220
- C:\Windows\System\iJcekAO.exe
  C:\Windows\System\iJcekAO.exe
  2⤵
  PID:14100
- C:\Windows\System\AvMYVte.exe
  C:\Windows\System\AvMYVte.exe
  2⤵
  PID:9688
- C:\Windows\System\viiQXbo.exe
  C:\Windows\System\viiQXbo.exe
  2⤵
  PID:9748
- C:\Windows\System\lcILhhI.exe
  C:\Windows\System\lcILhhI.exe
  2⤵
  PID:14312
- C:\Windows\System\KyJHzHZ.exe
  C:\Windows\System\KyJHzHZ.exe
  2⤵
  PID:10804
- C:\Windows\System\YMQVUet.exe
  C:\Windows\System\YMQVUet.exe
  2⤵
  PID:14184
- C:\Windows\System\dhIHNmK.exe
  C:\Windows\System\dhIHNmK.exe
  2⤵
  PID:7496
- C:\Windows\System\iFkEdJX.exe
  C:\Windows\System\iFkEdJX.exe
  2⤵
  PID:11168
- C:\Windows\System\UbcOhZm.exe
  C:\Windows\System\UbcOhZm.exe
  2⤵
  PID:10308
- C:\Windows\System\xJKVtEj.exe
  C:\Windows\System\xJKVtEj.exe
  2⤵
  PID:10412
- C:\Windows\System\vxIfZmj.exe
  C:\Windows\System\vxIfZmj.exe
  2⤵
  PID:14196
- C:\Windows\System\Ybssxei.exe
  C:\Windows\System\Ybssxei.exe
  2⤵
  PID:10908
- C:\Windows\System\Ctpzmct.exe
  C:\Windows\System\Ctpzmct.exe
  2⤵
  PID:2832
- C:\Windows\System\IFeNJXQ.exe
  C:\Windows\System\IFeNJXQ.exe
  2⤵
  PID:14220
- C:\Windows\System\dAXvTvh.exe
  C:\Windows\System\dAXvTvh.exe
  2⤵
  PID:5912
- C:\Windows\System\yMVbvHE.exe
  C:\Windows\System\yMVbvHE.exe
  2⤵
  PID:13544
- C:\Windows\System\cFBubdL.exe
  C:\Windows\System\cFBubdL.exe
  2⤵
  PID:13784
- C:\Windows\System\bjnTgjc.exe
  C:\Windows\System\bjnTgjc.exe
  2⤵
  PID:13508
- C:\Windows\System\SrBBmkP.exe
  C:\Windows\System\SrBBmkP.exe
  2⤵
  PID:14248
- C:\Windows\System\eIczSxR.exe
  C:\Windows\System\eIczSxR.exe
  2⤵
  PID:7780
- C:\Windows\System\fuvTQhC.exe
  C:\Windows\System\fuvTQhC.exe
  2⤵
  PID:2468
- C:\Windows\System\GfbBlwZ.exe
  C:\Windows\System\GfbBlwZ.exe
  2⤵
  PID:6056
- C:\Windows\System\BmXCfPY.exe
  C:\Windows\System\BmXCfPY.exe
  2⤵
  PID:6160
- C:\Windows\System\dLVkNLa.exe
  C:\Windows\System\dLVkNLa.exe
  2⤵
  PID:13332
- C:\Windows\System\GMMqYxT.exe
  C:\Windows\System\GMMqYxT.exe
  2⤵
  PID:14112
- C:\Windows\System\pCKbCHj.exe
  C:\Windows\System\pCKbCHj.exe
  2⤵
  PID:5276
- C:\Windows\System\EagNoVM.exe
  C:\Windows\System\EagNoVM.exe
  2⤵
  PID:7892
- C:\Windows\System\pQWnjXo.exe
  C:\Windows\System\pQWnjXo.exe
  2⤵
  PID:11796
- C:\Windows\System\RNpAkpA.exe
  C:\Windows\System\RNpAkpA.exe
  2⤵
  PID:13408
- C:\Windows\System\CYXUBTV.exe
  C:\Windows\System\CYXUBTV.exe
  2⤵
  PID:5352
- C:\Windows\System\nxnmJcf.exe
  C:\Windows\System\nxnmJcf.exe
  2⤵
  PID:4484
- C:\Windows\System\KjIyZCY.exe
  C:\Windows\System\KjIyZCY.exe
  2⤵
  PID:5436
- C:\Windows\System\MvQQndS.exe
  C:\Windows\System\MvQQndS.exe
  2⤵
  PID:13460
- C:\Windows\System\ppKufyJ.exe
  C:\Windows\System\ppKufyJ.exe
  2⤵
  PID:5440
- C:\Windows\System\NAeWXWw.exe
  C:\Windows\System\NAeWXWw.exe
  2⤵
  PID:3844
- C:\Windows\System\CWzEagt.exe
  C:\Windows\System\CWzEagt.exe
  2⤵
  PID:13112
- C:\Windows\System\kbrFhXV.exe
  C:\Windows\System\kbrFhXV.exe
  2⤵
  PID:3612
- C:\Windows\System\oMmrgLV.exe
  C:\Windows\System\oMmrgLV.exe
  2⤵
  PID:2644
- C:\Windows\System\gJXdxAY.exe
  C:\Windows\System\gJXdxAY.exe
  2⤵
  PID:5764
- C:\Windows\System\ATPwOgq.exe
  C:\Windows\System\ATPwOgq.exe
  2⤵
  PID:7444
- C:\Windows\System\ZGvRBWj.exe
  C:\Windows\System\ZGvRBWj.exe
  2⤵
  PID:2992
- C:\Windows\System\njItzIq.exe
  C:\Windows\System\njItzIq.exe
  2⤵
  PID:6244
- C:\Windows\System\ZWQKZzV.exe
  C:\Windows\System\ZWQKZzV.exe
  2⤵
  PID:6076
- C:\Windows\System\OdxyPeT.exe
  C:\Windows\System\OdxyPeT.exe
  2⤵
  PID:4124
- C:\Windows\System\OlWmBbM.exe
  C:\Windows\System\OlWmBbM.exe
  2⤵
  PID:10000
- C:\Windows\System\HyUPvoC.exe
  C:\Windows\System\HyUPvoC.exe
  2⤵
  PID:3144
- C:\Windows\System\pczuzQr.exe
  C:\Windows\System\pczuzQr.exe
  2⤵
  PID:2312
- C:\Windows\System\xgNsTwj.exe
  C:\Windows\System\xgNsTwj.exe
  2⤵
  PID:6380
- C:\Windows\System\LJQkhVG.exe
  C:\Windows\System\LJQkhVG.exe
  2⤵
  PID:848
- C:\Windows\System\PgsziLt.exe
  C:\Windows\System\PgsziLt.exe
  2⤵
  PID:6496
- C:\Windows\System\lwrpGDd.exe
  C:\Windows\System\lwrpGDd.exe
  2⤵
  PID:11540
- C:\Windows\System\HdNdxLb.exe
  C:\Windows\System\HdNdxLb.exe
  2⤵
  PID:10272
- C:\Windows\System\ACkkCIc.exe
  C:\Windows\System\ACkkCIc.exe
  2⤵
  PID:1856
- C:\Windows\System\dSAQUVo.exe
  C:\Windows\System\dSAQUVo.exe
  2⤵
  PID:1644
- C:\Windows\System\gczoRbG.exe
  C:\Windows\System\gczoRbG.exe
  2⤵
  PID:8884
- C:\Windows\System\sQJejsd.exe
  C:\Windows\System\sQJejsd.exe
  2⤵
  PID:11308
- C:\Windows\System\JHyjCWz.exe
  C:\Windows\System\JHyjCWz.exe
  2⤵
  PID:6276
- C:\Windows\System\FAdmjfK.exe
  C:\Windows\System\FAdmjfK.exe
  2⤵
  PID:6300
- C:\Windows\System\JwNNMSz.exe
  C:\Windows\System\JwNNMSz.exe
  2⤵
  PID:6320
- C:\Windows\System\lJfFIaV.exe
  C:\Windows\System\lJfFIaV.exe
  2⤵
  PID:9168
- C:\Windows\System\ZHKpESf.exe
  C:\Windows\System\ZHKpESf.exe
  2⤵
  PID:5532
- C:\Windows\System\biKMnGf.exe
  C:\Windows\System\biKMnGf.exe
  2⤵
  PID:5668
- C:\Windows\System\RwhgfoO.exe
  C:\Windows\System\RwhgfoO.exe
  2⤵
  PID:1848
- C:\Windows\System\NYNiHjf.exe
  C:\Windows\System\NYNiHjf.exe
  2⤵
  PID:12436
- C:\Windows\System\kMiCXDj.exe
  C:\Windows\System\kMiCXDj.exe
  2⤵
  PID:12532
- C:\Windows\System\JiPWGSV.exe
  C:\Windows\System\JiPWGSV.exe
  2⤵
  PID:5928
- C:\Windows\System\pZoMuVV.exe
  C:\Windows\System\pZoMuVV.exe
  2⤵
  PID:13796
- C:\Windows\System\QyiWSRQ.exe
  C:\Windows\System\QyiWSRQ.exe
  2⤵
  PID:13892
- C:\Windows\System\XICcfkV.exe
  C:\Windows\System\XICcfkV.exe
  2⤵
  PID:6572
- C:\Windows\System\ZmErHAE.exe
  C:\Windows\System\ZmErHAE.exe
  2⤵
  PID:5336
- C:\Windows\System\JVBYlGg.exe
  C:\Windows\System\JVBYlGg.exe
  2⤵
  PID:8628
- C:\Windows\System\WGajcXs.exe
  C:\Windows\System\WGajcXs.exe
  2⤵
  PID:5260
- C:\Windows\System\cQUfcmR.exe
  C:\Windows\System\cQUfcmR.exe
  2⤵
  PID:6488
- C:\Windows\System\iRjIrJI.exe
  C:\Windows\System\iRjIrJI.exe
  2⤵
  PID:5432
- C:\Windows\System\iFLQaFd.exe
  C:\Windows\System\iFLQaFd.exe
  2⤵
  PID:12652
- C:\Windows\System\SrRnaAl.exe
  C:\Windows\System\SrRnaAl.exe
  2⤵
  PID:6680
- C:\Windows\System\aMjvSzl.exe
  C:\Windows\System\aMjvSzl.exe
  2⤵
  PID:5364
- C:\Windows\System\HOnCuts.exe
  C:\Windows\System\HOnCuts.exe
  2⤵
  PID:4044
- C:\Windows\System\mXPYpts.exe
  C:\Windows\System\mXPYpts.exe
  2⤵
  PID:3964
- C:\Windows\System\IYwIeRA.exe
  C:\Windows\System\IYwIeRA.exe
  2⤵
  PID:6688
- C:\Windows\System\rMwZKhg.exe
  C:\Windows\System\rMwZKhg.exe
  2⤵
  PID:5484
- C:\Windows\System\IiGErAO.exe
  C:\Windows\System\IiGErAO.exe
  2⤵
  PID:9476
- C:\Windows\System\jKyRhzV.exe
  C:\Windows\System\jKyRhzV.exe
  2⤵
  PID:9532
- C:\Windows\System\TiAFgyO.exe
  C:\Windows\System\TiAFgyO.exe
  2⤵
  PID:5592
- C:\Windows\System\YQxzibE.exe
  C:\Windows\System\YQxzibE.exe
  2⤵
  PID:5648
- C:\Windows\System\FIZmUOg.exe
  C:\Windows\System\FIZmUOg.exe
  2⤵
  PID:4400
- C:\Windows\System\JPsWyUo.exe
  C:\Windows\System\JPsWyUo.exe
  2⤵
  PID:7088
- C:\Windows\System\QzTtqIo.exe
  C:\Windows\System\QzTtqIo.exe
  2⤵
  PID:9884
- C:\Windows\System\PYkFxZW.exe
  C:\Windows\System\PYkFxZW.exe
  2⤵
  PID:5692
- C:\Windows\System\fbQWjaD.exe
  C:\Windows\System\fbQWjaD.exe
  2⤵
  PID:11228
- C:\Windows\System\TgeuvaI.exe
  C:\Windows\System\TgeuvaI.exe
  2⤵
  PID:2204
- C:\Windows\System\VEtZBEw.exe
  C:\Windows\System\VEtZBEw.exe
  2⤵
  PID:6248
- C:\Windows\System\knmqpHK.exe
  C:\Windows\System\knmqpHK.exe
  2⤵
  PID:14276
- C:\Windows\System\XZEBTiD.exe
  C:\Windows\System\XZEBTiD.exe
  2⤵
  PID:10488
- C:\Windows\System\lFdzPMS.exe
  C:\Windows\System\lFdzPMS.exe
  2⤵
  PID:7776
- C:\Windows\System\KhCjZBl.exe
  C:\Windows\System\KhCjZBl.exe
  2⤵
  PID:12444
- C:\Windows\System\fPrEYKu.exe
  C:\Windows\System\fPrEYKu.exe
  2⤵
  PID:3836
- C:\Windows\System\ciYcOtE.exe
  C:\Windows\System\ciYcOtE.exe
  2⤵
  PID:6040
- C:\Windows\System\WmwIVwW.exe
  C:\Windows\System\WmwIVwW.exe
  2⤵
  PID:5468
- C:\Windows\System\QooknMK.exe
  C:\Windows\System\QooknMK.exe
  2⤵
  PID:6136
- C:\Windows\System\reLbQvZ.exe
  C:\Windows\System\reLbQvZ.exe
  2⤵
  PID:6200
- C:\Windows\System\nOcodff.exe
  C:\Windows\System\nOcodff.exe
  2⤵
  PID:7900
- C:\Windows\System\mAXCQYd.exe
  C:\Windows\System\mAXCQYd.exe
  2⤵
  PID:7328
- C:\Windows\System\jgeuCuI.exe
  C:\Windows\System\jgeuCuI.exe
  2⤵
  PID:13776
- C:\Windows\System\QuigTXv.exe
  C:\Windows\System\QuigTXv.exe
  2⤵
  PID:7384
- C:\Windows\System\AXRXBfc.exe
  C:\Windows\System\AXRXBfc.exe
  2⤵
  PID:7164
- C:\Windows\System\FnMiAEN.exe
  C:\Windows\System\FnMiAEN.exe
  2⤵
  PID:5184
- C:\Windows\System\NhLNXWN.exe
  C:\Windows\System\NhLNXWN.exe
  2⤵
  PID:3248
- C:\Windows\System\iwVwVPt.exe
  C:\Windows\System\iwVwVPt.exe
  2⤵
  PID:12568
- C:\Windows\System\xONRxxe.exe
  C:\Windows\System\xONRxxe.exe
  2⤵
  PID:3904
- C:\Windows\System\qSMlynk.exe
  C:\Windows\System\qSMlynk.exe
  2⤵
  PID:1280
- C:\Windows\System\hjzNxVf.exe
  C:\Windows\System\hjzNxVf.exe
  2⤵
  PID:8076
- C:\Windows\System\wlRayKG.exe
  C:\Windows\System\wlRayKG.exe
  2⤵
  PID:8144
- C:\Windows\System\ilOAgPr.exe
  C:\Windows\System\ilOAgPr.exe
  2⤵
  PID:5552
- C:\Windows\System\IOXeyeb.exe
  C:\Windows\System\IOXeyeb.exe
  2⤵
  PID:7688
- C:\Windows\System\sbBgjQC.exe
  C:\Windows\System\sbBgjQC.exe
  2⤵
  PID:6444
- C:\Windows\System\nNRgQhy.exe
  C:\Windows\System\nNRgQhy.exe
  2⤵
  PID:13608
- C:\Windows\System\xnMctYi.exe
  C:\Windows\System\xnMctYi.exe
  2⤵
  PID:7804
- C:\Windows\System\byDdWPV.exe
  C:\Windows\System\byDdWPV.exe
  2⤵
  PID:7728
- C:\Windows\System\CsrJtyU.exe
  C:\Windows\System\CsrJtyU.exe
  2⤵
  PID:7732
- C:\Windows\System\FOycbXa.exe
  C:\Windows\System\FOycbXa.exe
  2⤵
  PID:8072
- C:\Windows\System\PEcYdLE.exe
  C:\Windows\System\PEcYdLE.exe
  2⤵
  PID:5820
- C:\Windows\System\dWFuRlF.exe
  C:\Windows\System\dWFuRlF.exe
  2⤵
  PID:7552
- C:\Windows\System\WVDPAKL.exe
  C:\Windows\System\WVDPAKL.exe
  2⤵
  PID:12260
- C:\Windows\System\IlkdaxN.exe
  C:\Windows\System\IlkdaxN.exe
  2⤵
  PID:6016
- C:\Windows\System\AOmWusR.exe
  C:\Windows\System\AOmWusR.exe
  2⤵
  PID:6748
- C:\Windows\System\fnLTCRr.exe
  C:\Windows\System\fnLTCRr.exe
  2⤵
  PID:10236
- C:\Windows\System\AAFkilo.exe
  C:\Windows\System\AAFkilo.exe
  2⤵
  PID:7896
- C:\Windows\System\QhThWGq.exe
  C:\Windows\System\QhThWGq.exe
  2⤵
  PID:7852
- C:\Windows\System\alwkxQg.exe
  C:\Windows\System\alwkxQg.exe
  2⤵
  PID:7192
- C:\Windows\System\lCVjobX.exe
  C:\Windows\System\lCVjobX.exe
  2⤵
  PID:3492
- C:\Windows\System\EGWzLYq.exe
  C:\Windows\System\EGWzLYq.exe
  2⤵
  PID:5128
- C:\Windows\System\QKhxpjE.exe
  C:\Windows\System\QKhxpjE.exe
  2⤵
  PID:12320
- C:\Windows\System\FFcAedE.exe
  C:\Windows\System\FFcAedE.exe
  2⤵
  PID:12372
- C:\Windows\System\KyoGYpc.exe
  C:\Windows\System\KyoGYpc.exe
  2⤵
  PID:8888
- C:\Windows\System\xWaLRyT.exe
  C:\Windows\System\xWaLRyT.exe
  2⤵
  PID:8564
- C:\Windows\System\WjXfTYd.exe
  C:\Windows\System\WjXfTYd.exe
  2⤵
  PID:8296
- C:\Windows\System\zhRAXUf.exe
  C:\Windows\System\zhRAXUf.exe
  2⤵
  PID:8592
- C:\Windows\System\jTVsXUb.exe
  C:\Windows\System\jTVsXUb.exe
  2⤵
  PID:5388
- C:\Windows\System\CchuQZS.exe
  C:\Windows\System\CchuQZS.exe
  2⤵
  PID:5204
- C:\Windows\System\ZjKokvX.exe
  C:\Windows\System\ZjKokvX.exe
  2⤵
  PID:10456
- C:\Windows\System\ddQagKB.exe
  C:\Windows\System\ddQagKB.exe
  2⤵
  PID:6728
- C:\Windows\System\zBkxuCf.exe
  C:\Windows\System\zBkxuCf.exe
  2⤵
  PID:3460
- C:\Windows\System\aQBdPck.exe
  C:\Windows\System\aQBdPck.exe
  2⤵
  PID:5248
- C:\Windows\System\JEHOmLX.exe
  C:\Windows\System\JEHOmLX.exe
  2⤵
  PID:5164
- C:\Windows\System\BVjtYzj.exe
  C:\Windows\System\BVjtYzj.exe
  2⤵
  PID:9000
- C:\Windows\System\BoxEFKo.exe
  C:\Windows\System\BoxEFKo.exe
  2⤵
  PID:3120
- C:\Windows\System\unrWqWR.exe
  C:\Windows\System\unrWqWR.exe
  2⤵
  PID:2040
- C:\Windows\System\yVAcnyC.exe
  C:\Windows\System\yVAcnyC.exe
  2⤵
  PID:3908
- C:\Windows\System\LTKRjrB.exe
  C:\Windows\System\LTKRjrB.exe
  2⤵
  PID:3420
- C:\Windows\System\xbnrjvn.exe
  C:\Windows\System\xbnrjvn.exe
  2⤵
  PID:6632
- C:\Windows\System\emSzhqh.exe
  C:\Windows\System\emSzhqh.exe
  2⤵
  PID:6900
- C:\Windows\System\WRIvXGN.exe
  C:\Windows\System\WRIvXGN.exe
  2⤵
  PID:14024
- C:\Windows\System\VHfPXuS.exe
  C:\Windows\System\VHfPXuS.exe
  2⤵
  PID:6664
- C:\Windows\System\czobmXh.exe
  C:\Windows\System\czobmXh.exe
  2⤵
  PID:11216
- C:\Windows\System\vRTCiad.exe
  C:\Windows\System\vRTCiad.exe
  2⤵
  PID:10088
- C:\Windows\System\qhUhoeC.exe
  C:\Windows\System\qhUhoeC.exe
  2⤵
  PID:10692
- C:\Windows\System\fMfcKwB.exe
  C:\Windows\System\fMfcKwB.exe
  2⤵
  PID:6824
- C:\Windows\System\HwrIrZh.exe
  C:\Windows\System\HwrIrZh.exe
  2⤵
  PID:8364
- C:\Windows\System\yXxqari.exe
  C:\Windows\System\yXxqari.exe
  2⤵
  PID:7648
- C:\Windows\System\EQaOaHr.exe
  C:\Windows\System\EQaOaHr.exe
  2⤵
  PID:6212
- C:\Windows\System\YXLKAqC.exe
  C:\Windows\System\YXLKAqC.exe
  2⤵
  PID:5452
- C:\Windows\System\WGUMQSQ.exe
  C:\Windows\System\WGUMQSQ.exe
  2⤵
  PID:9716
- C:\Windows\System\MKYbwHo.exe
  C:\Windows\System\MKYbwHo.exe
  2⤵
  PID:6888
- C:\Windows\System\TScRikH.exe
  C:\Windows\System\TScRikH.exe
  2⤵
  PID:13276
- C:\Windows\System\kGEkeiB.exe
  C:\Windows\System\kGEkeiB.exe
  2⤵
  PID:12484
- C:\Windows\System\gKsohhZ.exe
  C:\Windows\System\gKsohhZ.exe
  2⤵
  PID:7472
- C:\Windows\System\HECYomJ.exe
  C:\Windows\System\HECYomJ.exe
  2⤵
  PID:7224
- C:\Windows\System\dMtqKkL.exe
  C:\Windows\System\dMtqKkL.exe
  2⤵
  PID:14316
- C:\Windows\System\lKMVCuR.exe
  C:\Windows\System\lKMVCuR.exe
  2⤵
  PID:9436
- C:\Windows\System\nGYVrJC.exe
  C:\Windows\System\nGYVrJC.exe
  2⤵
  PID:4140
- C:\Windows\System\SMxGSxw.exe
  C:\Windows\System\SMxGSxw.exe
  2⤵
  PID:8156
- C:\Windows\System\VHQTUcJ.exe
  C:\Windows\System\VHQTUcJ.exe
  2⤵
  PID:7692
- C:\Windows\System\aXGuHms.exe
  C:\Windows\System\aXGuHms.exe
  2⤵
  PID:5736
- C:\Windows\System\jwqYMgQ.exe
  C:\Windows\System\jwqYMgQ.exe
  2⤵
  PID:7336
- C:\Windows\System\uVSjqyG.exe
  C:\Windows\System\uVSjqyG.exe
  2⤵
  PID:9640
- C:\Windows\System\HaFnYnw.exe
  C:\Windows\System\HaFnYnw.exe
  2⤵
  PID:4724
- C:\Windows\System\CKRpQsX.exe
  C:\Windows\System\CKRpQsX.exe
  2⤵
  PID:7380
- C:\Windows\System\GGfaKkf.exe
  C:\Windows\System\GGfaKkf.exe
  2⤵
  PID:5640
- C:\Windows\System\OiQKZsF.exe
  C:\Windows\System\OiQKZsF.exe
  2⤵
  PID:2196
- C:\Windows\System\rZmFonI.exe
  C:\Windows\System\rZmFonI.exe
  2⤵
  PID:7172
- C:\Windows\System\nPKWunx.exe
  C:\Windows\System\nPKWunx.exe
  2⤵
  PID:5080
- C:\Windows\System\twlSOUU.exe
  C:\Windows\System\twlSOUU.exe
  2⤵
  PID:7668
- C:\Windows\System\kbbaVVb.exe
  C:\Windows\System\kbbaVVb.exe
  2⤵
  PID:2220
- C:\Windows\System\qOSrhSa.exe
  C:\Windows\System\qOSrhSa.exe
  2⤵
  PID:8856
- C:\Windows\System\NskjdId.exe
  C:\Windows\System\NskjdId.exe
  2⤵
  PID:9964
- C:\Windows\System\LqMdyQM.exe
  C:\Windows\System\LqMdyQM.exe
  2⤵
  PID:10096
- C:\Windows\System\hHHjcVK.exe
  C:\Windows\System\hHHjcVK.exe
  2⤵
  PID:8444
- C:\Windows\System\WCHSHiD.exe
  C:\Windows\System\WCHSHiD.exe
  2⤵
  PID:10028
- C:\Windows\System\CHZHdKn.exe
  C:\Windows\System\CHZHdKn.exe
  2⤵
  PID:8112
- C:\Windows\System\aeGufQf.exe
  C:\Windows\System\aeGufQf.exe
  2⤵
  PID:10408
- C:\Windows\System\OcOPqSk.exe
  C:\Windows\System\OcOPqSk.exe
  2⤵
  PID:8464
- C:\Windows\System\CoLKiMu.exe
  C:\Windows\System\CoLKiMu.exe
  2⤵
  PID:2216
- C:\Windows\System\wHNWCbd.exe
  C:\Windows\System\wHNWCbd.exe
  2⤵
  PID:11076
- C:\Windows\System\XNxxzsC.exe
  C:\Windows\System\XNxxzsC.exe
  2⤵
  PID:12668
- C:\Windows\System\fEqvUwV.exe
  C:\Windows\System\fEqvUwV.exe
  2⤵
  PID:4784
- C:\Windows\System\SbhkOby.exe
  C:\Windows\System\SbhkOby.exe
  2⤵
  PID:14256
- C:\Windows\System\XJKrFOd.exe
  C:\Windows\System\XJKrFOd.exe
  2⤵
  PID:7080
- C:\Windows\System\OtAksBQ.exe
  C:\Windows\System\OtAksBQ.exe
  2⤵
  PID:9468
- C:\Windows\System\Zuaotnp.exe
  C:\Windows\System\Zuaotnp.exe
  2⤵
  PID:8132
- C:\Windows\System\SUhuaoi.exe
  C:\Windows\System\SUhuaoi.exe
  2⤵
  PID:11248
- C:\Windows\System\oAclktO.exe
  C:\Windows\System\oAclktO.exe
  2⤵
  PID:7028
- C:\Windows\System\iOiiozH.exe
  C:\Windows\System\iOiiozH.exe
  2⤵
  PID:7004
- C:\Windows\System\tLwSyaz.exe
  C:\Windows\System\tLwSyaz.exe
  2⤵
  PID:13360
- C:\Windows\System\BWqhHVR.exe
  C:\Windows\System\BWqhHVR.exe
  2⤵
  PID:9088
- C:\Windows\System\YlwAOvP.exe
  C:\Windows\System\YlwAOvP.exe
  2⤵
  PID:13668
- C:\Windows\System\EGTDYkV.exe
  C:\Windows\System\EGTDYkV.exe
  2⤵
  PID:8328
- C:\Windows\System\kgqGGIL.exe
  C:\Windows\System\kgqGGIL.exe
  2⤵
  PID:4440
- C:\Windows\System\BWFKFCD.exe
  C:\Windows\System\BWFKFCD.exe
  2⤵
  PID:11732
- C:\Windows\System\LDASkPP.exe
  C:\Windows\System\LDASkPP.exe
  2⤵
  PID:9580
- C:\Windows\System\qXIphst.exe
  C:\Windows\System\qXIphst.exe
  2⤵
  PID:8108
- C:\Windows\System\kRqRgyd.exe
  C:\Windows\System\kRqRgyd.exe
  2⤵
  PID:4480
- C:\Windows\System\LLMBqTf.exe
  C:\Windows\System\LLMBqTf.exe
  2⤵
  PID:3188
- C:\Windows\System\aPyXeEq.exe
  C:\Windows\System\aPyXeEq.exe
  2⤵
  PID:7308
- C:\Windows\System\mvvNCrd.exe
  C:\Windows\System\mvvNCrd.exe
  2⤵
  PID:9920
- C:\Windows\System\lBOJNeG.exe
  C:\Windows\System\lBOJNeG.exe
  2⤵
  PID:11312
- C:\Windows\System\vYDzdRJ.exe
  C:\Windows\System\vYDzdRJ.exe
  2⤵
  PID:11700
- C:\Windows\System\XfkMEod.exe
  C:\Windows\System\XfkMEod.exe
  2⤵
  PID:7888
- C:\Windows\System\fQZltgz.exe
  C:\Windows\System\fQZltgz.exe
  2⤵
  PID:8008
- C:\Windows\System\PjcSIuX.exe
  C:\Windows\System\PjcSIuX.exe
  2⤵
  PID:1948
- C:\Windows\System\pOztuQF.exe
  C:\Windows\System\pOztuQF.exe
  2⤵
  PID:12020
- C:\Windows\System\BECOtyY.exe
  C:\Windows\System\BECOtyY.exe
  2⤵
  PID:10868
- C:\Windows\System\aGDeBBW.exe
  C:\Windows\System\aGDeBBW.exe
  2⤵
  PID:11820
- C:\Windows\System\CBNxaqF.exe
  C:\Windows\System\CBNxaqF.exe
  2⤵
  PID:10724
- C:\Windows\System\PoPCTva.exe
  C:\Windows\System\PoPCTva.exe
  2⤵
  PID:10932
- C:\Windows\System\zDjVcYv.exe
  C:\Windows\System\zDjVcYv.exe
  2⤵
  PID:13652
- C:\Windows\System\LTsTGvg.exe
  C:\Windows\System\LTsTGvg.exe
  2⤵
  PID:11952
- C:\Windows\System\WXjchmD.exe
  C:\Windows\System\WXjchmD.exe
  2⤵
  PID:1272
- C:\Windows\System\iFenFcd.exe
  C:\Windows\System\iFenFcd.exe
  2⤵
  PID:12024
- C:\Windows\System\bXkHvdx.exe
  C:\Windows\System\bXkHvdx.exe
  2⤵
  PID:12172
- C:\Windows\System\rIaThIY.exe
  C:\Windows\System\rIaThIY.exe
  2⤵
  PID:12304
- C:\Windows\System\CwbPMTJ.exe
  C:\Windows\System\CwbPMTJ.exe
  2⤵
  PID:6392
- C:\Windows\System\VDHKhdZ.exe
  C:\Windows\System\VDHKhdZ.exe
  2⤵
  PID:12884
- C:\Windows\System\vhEkxwt.exe
  C:\Windows\System\vhEkxwt.exe
  2⤵
  PID:8708
- C:\Windows\System\IenGSFh.exe
  C:\Windows\System\IenGSFh.exe
  2⤵
  PID:13040
- C:\Windows\System\unqKmEQ.exe
  C:\Windows\System\unqKmEQ.exe
  2⤵
  PID:11052
- C:\Windows\System\RRReVvg.exe
  C:\Windows\System\RRReVvg.exe
  2⤵
  PID:10388
- C:\Windows\System\cWtdpHm.exe
  C:\Windows\System\cWtdpHm.exe
  2⤵
  PID:12948
- C:\Windows\System\xhBcXHQ.exe
  C:\Windows\System\xhBcXHQ.exe
  2⤵
  PID:4592
- C:\Windows\System\uumFwup.exe
  C:\Windows\System\uumFwup.exe
  2⤵
  PID:10856
- C:\Windows\System\MUlWODG.exe
  C:\Windows\System\MUlWODG.exe
  2⤵
  PID:8744
- C:\Windows\System\lKlDTDP.exe
  C:\Windows\System\lKlDTDP.exe
  2⤵
  PID:6984
- C:\Windows\System\ucBFZSF.exe
  C:\Windows\System\ucBFZSF.exe
  2⤵
  PID:5968
- C:\Windows\System\LrhjjQq.exe
  C:\Windows\System\LrhjjQq.exe
  2⤵
  PID:6700
- C:\Windows\System\WEBbWao.exe
  C:\Windows\System\WEBbWao.exe
  2⤵
  PID:11200
- C:\Windows\System\AvsTHaJ.exe
  C:\Windows\System\AvsTHaJ.exe
  2⤵
  PID:12676
- C:\Windows\System\YGnYpja.exe
  C:\Windows\System\YGnYpja.exe
  2⤵
  PID:2460
- C:\Windows\System\vlfSTKB.exe
  C:\Windows\System\vlfSTKB.exe
  2⤵
  PID:7632
- C:\Windows\System\CwwtXqP.exe
  C:\Windows\System\CwwtXqP.exe
  2⤵
  PID:13692
- C:\Windows\System\PwJqQvl.exe
  C:\Windows\System\PwJqQvl.exe
  2⤵
  PID:11728
- C:\Windows\System\XIHjrGh.exe
  C:\Windows\System\XIHjrGh.exe
  2⤵
  PID:12788
- C:\Windows\System\KShikbX.exe
  C:\Windows\System\KShikbX.exe
  2⤵
  PID:9484
- C:\Windows\System\lIGIdYQ.exe
  C:\Windows\System\lIGIdYQ.exe
  2⤵
  PID:5488
- C:\Windows\System\EzbSgrb.exe
  C:\Windows\System\EzbSgrb.exe
  2⤵
  PID:12400
- C:\Windows\System\UUzmaQq.exe
  C:\Windows\System\UUzmaQq.exe
  2⤵
  PID:12388
- C:\Windows\System\oDFSZvn.exe
  C:\Windows\System\oDFSZvn.exe
  2⤵
  PID:11896
- C:\Windows\System\XgaKKjP.exe
  C:\Windows\System\XgaKKjP.exe
  2⤵
  PID:11848
- C:\Windows\System\FlDdpBO.exe
  C:\Windows\System\FlDdpBO.exe
  2⤵
  PID:8508
- C:\Windows\System\cpslyJX.exe
  C:\Windows\System\cpslyJX.exe
  2⤵
  PID:7284
- C:\Windows\System\kHAtBzE.exe
  C:\Windows\System\kHAtBzE.exe
  2⤵
  PID:8168
- C:\Windows\System\HQCnoVD.exe
  C:\Windows\System\HQCnoVD.exe
  2⤵
  PID:9064
- C:\Windows\System\DokQEvQ.exe
  C:\Windows\System\DokQEvQ.exe
  2⤵
  PID:3044
- C:\Windows\System\jRgXbyy.exe
  C:\Windows\System\jRgXbyy.exe
  2⤵
  PID:10776
- C:\Windows\System\gqkJCVT.exe
  C:\Windows\System\gqkJCVT.exe
  2⤵
  PID:9944
- C:\Windows\System\ZqWstZw.exe
  C:\Windows\System\ZqWstZw.exe
  2⤵
  PID:11348
- C:\Windows\System\RDELVfE.exe
  C:\Windows\System\RDELVfE.exe
  2⤵
  PID:12440
- C:\Windows\System\QXeTxRY.exe
  C:\Windows\System\QXeTxRY.exe
  2⤵
  PID:5940
- C:\Windows\System\VseeUXi.exe
  C:\Windows\System\VseeUXi.exe
  2⤵
  PID:2124
- C:\Windows\System\REcnVRm.exe
  C:\Windows\System\REcnVRm.exe
  2⤵
  PID:12168
- C:\Windows\System\yrMdwnC.exe
  C:\Windows\System\yrMdwnC.exe
  2⤵
  PID:5900
- C:\Windows\System\aAvtFjt.exe
  C:\Windows\System\aAvtFjt.exe
  2⤵
  PID:13180
- C:\Windows\System\LThpTrw.exe
  C:\Windows\System\LThpTrw.exe
  2⤵
  PID:12408
- C:\Windows\System\bJuQJEZ.exe
  C:\Windows\System\bJuQJEZ.exe
  2⤵
  PID:13684
- C:\Windows\System\kZPZWAv.exe
  C:\Windows\System\kZPZWAv.exe
  2⤵
  PID:3944
- C:\Windows\System\VXGlUij.exe
  C:\Windows\System\VXGlUij.exe
  2⤵
  PID:13160
- C:\Windows\System\nNDMSmX.exe
  C:\Windows\System\nNDMSmX.exe
  2⤵
  PID:7048
- C:\Windows\System\lDRLfhf.exe
  C:\Windows\System\lDRLfhf.exe
  2⤵
  PID:14088
- C:\Windows\System\ohJbRNp.exe
  C:\Windows\System\ohJbRNp.exe
  2⤵
  PID:9544
- C:\Windows\System\HmMfPtz.exe
  C:\Windows\System\HmMfPtz.exe
  2⤵
  PID:13956
- C:\Windows\System\DEHlokR.exe
  C:\Windows\System\DEHlokR.exe
  2⤵
  PID:13944
- C:\Windows\System\ugxLHcH.exe
  C:\Windows\System\ugxLHcH.exe
  2⤵
  PID:8472
- C:\Windows\System\JHJBoYi.exe
  C:\Windows\System\JHJBoYi.exe
  2⤵
  PID:12448
- C:\Windows\System\sadzosC.exe
  C:\Windows\System\sadzosC.exe
  2⤵
  PID:13996
- C:\Windows\System\tjEsafG.exe
  C:\Windows\System\tjEsafG.exe
  2⤵
  PID:13976
- C:\Windows\System\QrsZVzY.exe
  C:\Windows\System\QrsZVzY.exe
  2⤵
  PID:11940
- C:\Windows\System\FmAfIbR.exe
  C:\Windows\System\FmAfIbR.exe
  2⤵
  PID:10124
- C:\Windows\System\McgYppL.exe
  C:\Windows\System\McgYppL.exe
  2⤵
  PID:8048
- C:\Windows\System\jOSIgTo.exe
  C:\Windows\System\jOSIgTo.exe
  2⤵
  PID:14356
- C:\Windows\System\NlApZnN.exe
  C:\Windows\System\NlApZnN.exe
  2⤵
  PID:14400
- C:\Windows\System\TjUguYv.exe
  C:\Windows\System\TjUguYv.exe
  2⤵
  PID:14428
- C:\Windows\System\WaidhEN.exe
  C:\Windows\System\WaidhEN.exe
  2⤵
  PID:14484
- C:\Windows\System\ONNfbtw.exe
  C:\Windows\System\ONNfbtw.exe
  2⤵
  PID:14520
- C:\Windows\System\ucGLncm.exe
  C:\Windows\System\ucGLncm.exe
  2⤵
  PID:14540
- C:\Windows\System\siQAYEa.exe
  C:\Windows\System\siQAYEa.exe
  2⤵
  PID:14576
- C:\Windows\System\OxOSbAf.exe
  C:\Windows\System\OxOSbAf.exe
  2⤵
  PID:14616
- C:\Windows\System\GzJOnLI.exe
  C:\Windows\System\GzJOnLI.exe
  2⤵
  PID:14652
- C:\Windows\System\GoslkBQ.exe
  C:\Windows\System\GoslkBQ.exe
  2⤵
  PID:14700
- C:\Windows\System\gspUSLR.exe
  C:\Windows\System\gspUSLR.exe
  2⤵
  PID:14728
- C:\Windows\System\OIMDVqA.exe
  C:\Windows\System\OIMDVqA.exe
  2⤵
  PID:14776
- C:\Windows\System\YxCFmiR.exe
  C:\Windows\System\YxCFmiR.exe
  2⤵
  PID:14804
- C:\Windows\System\xnnzsLS.exe
  C:\Windows\System\xnnzsLS.exe
  2⤵
  PID:14832
- C:\Windows\System\tnsLfzG.exe
  C:\Windows\System\tnsLfzG.exe
  2⤵
  PID:14848
- C:\Windows\System\amRNVLS.exe
  C:\Windows\System\amRNVLS.exe
  2⤵
  PID:14876
- C:\Windows\System\qDzXFvy.exe
  C:\Windows\System\qDzXFvy.exe
  2⤵
  PID:14912
- C:\Windows\System\fVTEUHG.exe
  C:\Windows\System\fVTEUHG.exe
  2⤵
  PID:14932
- C:\Windows\System\dVSqYfG.exe
  C:\Windows\System\dVSqYfG.exe
  2⤵
  PID:14964
- C:\Windows\System\EbCeBwL.exe
  C:\Windows\System\EbCeBwL.exe
  2⤵
  PID:15000
- C:\Windows\System\BCGzFwA.exe
  C:\Windows\System\BCGzFwA.exe
  2⤵
  PID:15028
- C:\Windows\System\KGgmKYk.exe
  C:\Windows\System\KGgmKYk.exe
  2⤵
  PID:15044
- C:\Windows\System\KelzIpa.exe
  C:\Windows\System\KelzIpa.exe
  2⤵
  PID:15060
- C:\Windows\System\mXjOpIj.exe
  C:\Windows\System\mXjOpIj.exe
  2⤵
  PID:15076
- C:\Windows\System\aIxoLgW.exe
  C:\Windows\System\aIxoLgW.exe
  2⤵
  PID:15092
- C:\Windows\System\IPiRBld.exe
  C:\Windows\System\IPiRBld.exe
  2⤵
  PID:15108
- C:\Windows\System\mQniBzg.exe
  C:\Windows\System\mQniBzg.exe
  2⤵
  PID:15144
- C:\Windows\System\tvIooYe.exe
  C:\Windows\System\tvIooYe.exe
  2⤵
  PID:15172
- C:\Windows\System\djHDcCc.exe
  C:\Windows\System\djHDcCc.exe
  2⤵
  PID:15208
- C:\Windows\System\YEQyaoJ.exe
  C:\Windows\System\YEQyaoJ.exe
  2⤵
  PID:15228
- C:\Windows\System\XoJYLwY.exe
  C:\Windows\System\XoJYLwY.exe
  2⤵
  PID:15252
- C:\Windows\System\CeAjwOB.exe
  C:\Windows\System\CeAjwOB.exe
  2⤵
  PID:15288
- C:\Windows\System\rWgeOjV.exe
  C:\Windows\System\rWgeOjV.exe
  2⤵
  PID:15324
- C:\Windows\System\VKREuMF.exe
  C:\Windows\System\VKREuMF.exe
  2⤵
  PID:15352
- C:\Windows\System\rHLhaQx.exe
  C:\Windows\System\rHLhaQx.exe
  2⤵
  PID:10484
- C:\Windows\System\yOWAZKk.exe
  C:\Windows\System\yOWAZKk.exe
  2⤵
  PID:9296
- C:\Windows\System\kUqeSJd.exe
  C:\Windows\System\kUqeSJd.exe
  2⤵
  PID:14412
- C:\Windows\System\VEkTtdc.exe
  C:\Windows\System\VEkTtdc.exe
  2⤵
  PID:14584
- C:\Windows\System\FYUZPnj.exe
  C:\Windows\System\FYUZPnj.exe
  2⤵
  PID:14648
- C:\Windows\System\AgCDIFE.exe
  C:\Windows\System\AgCDIFE.exe
  2⤵
  PID:14708
- C:\Windows\System\ctTCepo.exe
  C:\Windows\System\ctTCepo.exe
  2⤵
  PID:14800
- C:\Windows\System\xhnckRg.exe
  C:\Windows\System\xhnckRg.exe
  2⤵
  PID:14896
- C:\Windows\System\bRutvTo.exe
  C:\Windows\System\bRutvTo.exe
  2⤵
  PID:14952
- C:\Windows\System\nOJGmbq.exe
  C:\Windows\System\nOJGmbq.exe
  2⤵
  PID:15024
- C:\Windows\System\gaUMqXm.exe
  C:\Windows\System\gaUMqXm.exe
  2⤵
  PID:15008
- C:\Windows\System\diiFOie.exe
  C:\Windows\System\diiFOie.exe
  2⤵
  PID:15104
- C:\Windows\System\pWeAazW.exe
  C:\Windows\System\pWeAazW.exe
  2⤵
  PID:15152
- C:\Windows\System\flwMckK.exe
  C:\Windows\System\flwMckK.exe
  2⤵
  PID:15180
- C:\Windows\System\RGdovWl.exe
  C:\Windows\System\RGdovWl.exe
  2⤵
  PID:15216
- C:\Windows\System\HXSSxiP.exe
  C:\Windows\System\HXSSxiP.exe
  2⤵
  PID:15280
- C:\Windows\System\eLroZYV.exe
  C:\Windows\System\eLroZYV.exe
  2⤵
  PID:15300
- C:\Windows\System\iNnMskF.exe
  C:\Windows\System\iNnMskF.exe
  2⤵
  PID:15272
- C:\Windows\System\lWYIBSp.exe
  C:\Windows\System\lWYIBSp.exe
  2⤵
  PID:14440
- C:\Windows\System\ewHmKqO.exe
  C:\Windows\System\ewHmKqO.exe
  2⤵
  PID:14536
- C:\Windows\System\oMsiwlo.exe
  C:\Windows\System\oMsiwlo.exe
  2⤵
  PID:14528
- C:\Windows\System\zRXmStE.exe
  C:\Windows\System\zRXmStE.exe
  2⤵
  PID:14768
- C:\Windows\System\mWhURLE.exe
  C:\Windows\System\mWhURLE.exe
  2⤵
  PID:14772
- C:\Windows\System\fLrwRDy.exe
  C:\Windows\System\fLrwRDy.exe
  2⤵
  PID:14480
- C:\Windows\System\cKEgWBb.exe
  C:\Windows\System\cKEgWBb.exe
  2⤵
  PID:14560
- C:\Windows\System\TPcXbMK.exe
  C:\Windows\System\TPcXbMK.exe
  2⤵
  PID:13264
- C:\Windows\System\FRDRALq.exe
  C:\Windows\System\FRDRALq.exe
  2⤵
  PID:14792
- C:\Windows\System\HQdhHTK.exe
  C:\Windows\System\HQdhHTK.exe
  2⤵
  PID:15160
- C:\Windows\System\MKSmHIu.exe
  C:\Windows\System\MKSmHIu.exe
  2⤵
  PID:13660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3240,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
1⤵
PID:1832

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13584

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3360

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13328

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:8976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_myeeokag.2gd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DUsZSTf.exe

Filesize
1.8MB

MD5
f3fc9ee0d03ba9f8c92d4f9ff70cfebd

SHA1
5e5c2f8b66dd35e0f2054c9a5ffa001c4a182460

SHA256
972214315af259b6a05e6ecab56643b46f4645c12f931e7324268ac92e7ffe02

SHA512
548a465ed3d888e64aa23d91db4bd737fb6569e0d1053d7b18c76c7b6edc4eba1e2333a63f94a3e0fafef68160243769ea967e3c86f2bb1d987daedc6119b016

Download Submit
C:\Windows\System\GVYdZuO.exe

Filesize
1.8MB

MD5
64bf13a73bfc3449f896a26fd61ddc3a

SHA1
ec148e729b49ef9c3c0777887b3242925fb33f5c

SHA256
42bd83aab73250a7de16c6ff2d321ef7dda495ddddeb03e4724601374c40ae02

SHA512
0b4f734bcb84c05783dfdec37dbc427a8bf4051ab3164decfad9b42b924114f43a59c5870466240afa19bd0aca499df6b8ff8440835d4d589273c17c54e4b338

Download Submit
C:\Windows\System\GkjyUob.exe

Filesize
1.8MB

MD5
80f3fc0ced633dfda00fa171b075e162

SHA1
d7f44460872f4af3e8523d1459ee18d9bca80b63

SHA256
6133145ca2d2416f5f6cd906533be935f63944e8acfa61973a63fa73d6c25675

SHA512
37dce124fb1b13063c7f25efbff4937bab4601e2b378b42f760dc32ecd75dc1b75784c061a15c4bc5f3a1d5cfdae50757285935496c5aa07261d420425891aa8

Download Submit
C:\Windows\System\HiZccvI.exe

Filesize
1.8MB

MD5
3dbeb6dd5cc6588b8b659da7640aea89

SHA1
71c8f19e01357c13b010879936c6f957815629fc

SHA256
5fb770b759ac3fc580371f81e889400a8e84229c2314d62e91c281635c4ba8f6

SHA512
4e8235e4e458033b0e38d642d7681583170ba7e395544937eaf766722bb396098f03080e1bd8c1ebe894bca82b70da2babc14437d9a993fc591ab64bd9574067

Download Submit
C:\Windows\System\KWzimLL.exe

Filesize
1.8MB

MD5
bcf0652ed86c6d04b73d73c2f8066c09

SHA1
46cd1934a6b13cf249b8181285d370eaee9f6711

SHA256
9a0816c3324c6582e6962b2bb5c254fb0c764f6f346129e8b881fd5c28feb2e9

SHA512
909179289f4a4fe63204fca4e60fafb0897527f61f344323421d0ccaa614b34ac5008f9c6b64c0b6c48a5528155a351ef3fb8c4941465a63df2015de09f059f2

Download Submit
C:\Windows\System\OvrgllW.exe

Filesize
1.8MB

MD5
bfa350dedd1134ba32c2fe29eaea9d43

SHA1
b3a4cb3f57fbfad99e7778b0b1598d08c37e7d59

SHA256
1e595e0727cc4b20ab8811b465433b54922da535739b99ddcd52832f81e5bd23

SHA512
bdb0b27e1112549a4e52349c33ff23da969cebe9c64be825c7435a0931ce632f9f18f4eacdb66feb5825db417977b05e2288d96ff0361324a885539a910d978f

Download Submit
C:\Windows\System\QRuZCPL.exe

Filesize
8B

MD5
910de5e4823f1b594342aaa45a243c27

SHA1
e685fe344492ae089d7952151010d07f38420dbc

SHA256
35ac8b6a943f09a1cde24cd02afff8a0c7d652f165d54e16f6413276f4896cb0

SHA512
734b56228ae9283d7a41492191ea523ba29a1fabe1bd71428c57f89031a65c2affd92f940176ff946aa90efb62794a49b666566dba8320bb35feeeb83e9c2a4f

Download Submit
C:\Windows\System\RURBtCQ.exe

Filesize
1.8MB

MD5
3e6780e29c511e4f60e0a522301f6ecb

SHA1
a00c9825138a39551ee0d221fa96817fcc106ffa

SHA256
ec7bcff6716390f97564dc09bd1600d262d2c7352b0084d6b7e8fa6abe8c0698

SHA512
affd10f13c83baa91733669c01f4180ff265f170d3b0056f9878928c3fc4d3ddc8235d6f7ef9ac0ad1ed5b2778e1a6e09b388f57c395455dc52ac5c76468e6e4

Download Submit
C:\Windows\System\SCuBGNg.exe

Filesize
1.8MB

MD5
816e02a6aca5c9a14c7baeeb1305a51e

SHA1
a69361050a02792df6be2b99f1e5ff1bbf85f62c

SHA256
19e1153f85fe8bfa71251f9329ba2fb44f6990aea8880466aca0c12be724829f

SHA512
5462c4c42f1da55653d3e8899076431a1573b5be84406a4c940ea9604a7a6c75c8a3935c1c4ac4e551c7b7442ade0d315f12367cc7533c9116a854bc74e8c648

Download Submit
C:\Windows\System\SMqwuht.exe

Filesize
1.8MB

MD5
bb76658629118b51c5adb35dfe3d5b33

SHA1
fec808abb04b97b2bd46f4249851c5140604772e

SHA256
1f3f3a7fbaa354b991f13b6b36ae9e37be065fa0f69ea9562f0370c7c2298cfc

SHA512
0084c542eaf0f12472a80871aa84e01aa395f8f666adb9c3720335e0c1135115f45ef6c9821fc56d8b7c7b3da987f21a4039341eace6280ac7005f03674f566b

Download Submit
C:\Windows\System\UicalPn.exe

Filesize
1.8MB

MD5
f08f7549fe9a5eaf6a44f58fd5345224

SHA1
78f78d9c8646eefdfe7741525790630c74f85cff

SHA256
17abadbeecd7f668f82d17ac820989baa4f457397f92f3d8c8704f38ede3c77c

SHA512
03cd703df58bec19d836109cc7d854ab63e6a1f94e5f8836cf6d12a4cfd3b8e915bbdd69585600b55e49d605f5cad59e16d323ae30d54d84ff8987c8a8ca82bd

Download Submit
C:\Windows\System\WzfberX.exe

Filesize
1.8MB

MD5
badf11a8b108431957f6dc754d0d5702

SHA1
68f3f39d4a8b50b164acebcb31504d9f29a38882

SHA256
325631b5baf965992c1c6f43270e9263e636b00effaeb74beacb2c68350f24e0

SHA512
66a39b9b1d90dc2828f337c9ae95bdb48b2043c47971123b67d773458b9340f8cbb8f0562f94eef46e4dca6b448c2222a06fa6b7819214d98dc193c7de5364ec

Download Submit
C:\Windows\System\XFYjdMM.exe

Filesize
1.8MB

MD5
cd3dd038a33efe7c4b4f63f8041f8111

SHA1
873a49f6523074b92bf710f9f123263c377a6049

SHA256
545a635c4c6e55ca57b161de5b848c9b279868dfd4489b2e2ab1bfb6bff544c8

SHA512
efbd3a9632a7017ed503d80b900dda97a495a9b95fdc0bb0bf46c1092a20374deb3b443eee7af4be739a4a0df11e1707f356a75fbcad1876bcc6ad1272b80bfc

Download Submit
C:\Windows\System\YPSOcfM.exe

Filesize
1.8MB

MD5
8cc9ab6f03326d5b45c46832d2c990f1

SHA1
d25a42125dcbc499539b90435bc7390a9efae65e

SHA256
a0d91899ecbf95bd07ae63f3fb1df67bfa7824fc642968b9a8927c74415a4b7b

SHA512
bada7c1311cf20728286002b5deba4f1d166a31eeea527f0e3be65828f86dd783fd321b6ba1be1fdd23998bfdc3ff5ba143d36aeecfa53fe3f1796fe9bbac919

Download Submit
C:\Windows\System\asleGXZ.exe

Filesize
1.8MB

MD5
e8a4d880a7c00c57fdc3e2acc115feeb

SHA1
8f552c0cfda1e5ee57d60e2dcd554b51c7ae6073

SHA256
4a6398914efc2c647bc04b43c76355d272b3707548b349fa84e9b35d533702d5

SHA512
0bd47b4322d87d1438ce8d354c47d0fbd49a05d087982f94549c1bc28bb23db7adc0081cb751939b39df5b7b3a9774889a19749ec9a6940914b7840080543d65

Download Submit
C:\Windows\System\dLlOltA.exe

Filesize
1.8MB

MD5
1f9ff35b9fa26a22fbefdb3403fb7333

SHA1
0d5e95f5df1c89b9c76cf33a49c8cf115b0c9f95

SHA256
3b47ebe7af8494a04e9d0851f59a2b00c79f84bd8cf7f0b86117d813781124d8

SHA512
65c6a3996cd3396323b915c13d58a573b3d382adf460fff67f88b484eac68d5a1da8441c8d6ef044aeca20127d053315bf5fa2b5c1f80fb7e73d6730645bee59

Download Submit
C:\Windows\System\dPDEtbD.exe

Filesize
1.8MB

MD5
26c6c7a7f6001c42f626c5693ea496a7

SHA1
cf249907d1c1c49b46e17e31feb1291f5e670268

SHA256
1a149a70ca8b15f96645498b7d1b819cacfb9e550f46ca5e8af8288c27b50782

SHA512
fb7000a437a7ae1d64f7837c8ebcdb88819cb9d931ad3e7ed6f7be9ae2fe7e2bf06d7b176fe5655be526dd7f84584e4c9a426dabeee080137ffacc5ff65c74f7

Download Submit
C:\Windows\System\foiLvBU.exe

Filesize
1.8MB

MD5
95fb8fe7958d4c8fda9edb536c3536af

SHA1
d8efd6ef0d4df0a14d3109916f6a4936796e3263

SHA256
bb4b220d0b157f200025fd4323caa491487bc9889c1b96be955fc19fa7cdae37

SHA512
e57795cc486b6dfef841bd63fa6fc6a7dea5451432ce5c02e7cac24a674261a1e8bdcfc3a473362266e817b8148ea0c5cab928e67825c89cbd3104992b644d94

Download Submit
C:\Windows\System\iFEFofz.exe

Filesize
1.8MB

MD5
44d19e970dfd4071abe945bdc42064d5

SHA1
0ef5dc65f12ed6dce3aff4516bab2fa338c3602d

SHA256
f00f3febd1440e7dafe1ccb655b6b84c2dbf796f31540a47be1e61eef6de5da9

SHA512
62099fc66611c2444f855006dd56a65016ae0db59d1d9e48d046a27c57107a5ff341c1817d86eed0c139faece36f7656feea18e93a49b58b60df5b33d3dd6296

Download Submit
C:\Windows\System\iVYEsRH.exe

Filesize
1.8MB

MD5
c86d1747937c0f5ae49e314a4469950e

SHA1
36d1fab6259fbbb6b5134a99680807c1c73ded2d

SHA256
56617807d0266127f1f94a479f698a4e4c88f09205d709af23eb0290236461c6

SHA512
b4a06ed339728fd9923f00e989e5087f0b4526abb1039107ccd0c16420962c0f182550ca47fda7c98f991f76466d84e9e48d844420959aa90327eb2be284ceda

Download Submit
C:\Windows\System\ipXnQIS.exe

Filesize
1.8MB

MD5
2a6c33e3936cd637e8c311d7a50c450b

SHA1
f00e4df6dd0258b76394a5cad2d6b64a9347fce1

SHA256
317d560e3ac971afc6950bb5be2f2462cdf90a7d43edffb3af3a4cd18285945b

SHA512
3e2f518c4b3a917ff17705027ccc51e63dfbd92922772ee6daf6a2e9dea834146bf6592aa4b5c4596e1792b985d614e3c0d84de51638c15504cfe49f7c5585c2

Download Submit
C:\Windows\System\mECoWYK.exe

Filesize
1.8MB

MD5
1147bd1b9c2e710acd2499052b83e5d0

SHA1
ba681a32d81d09b3c7e22f0c24c21ae89785642b

SHA256
224404ba663de0b518cd280e118688da08e74b2c6fb2660ec96f1f50e966bd22

SHA512
95d2074058614e1aa2c867114368e133953f50e0462be86c294a3e1ca2fc16f27c01294d256a590c48e497e383ced3078e68faef9b1313501de2464819937312

Download Submit
C:\Windows\System\mIAmkba.exe

Filesize
1.8MB

MD5
1c6f341564b4f64c4ecb93a70822c24b

SHA1
366d616e76ac776a760074de1251dc90a0668cae

SHA256
d65613ec3bf294d3b24e5d80c70403481c3eb4845cda02cc895dc23c12f56508

SHA512
4cdc4e1c12a16b6d75619a234a2c1408e20fa7f992881996b189d5afc2b8eb86467ae456ac9eed802a0e267732486fa7dbcb91a11551263961c369490210ce7c

Download Submit
C:\Windows\System\mQpSsPQ.exe

Filesize
1.8MB

MD5
d75571de6803988982f6f5d3c9ee65d2

SHA1
b546c37e97b3e55fcb148f84a7ee186d6ac65a77

SHA256
cd364a048c9ba7f7cf90adec0fbf1717866e1fa5c2e640f153c2941c86a58763

SHA512
4f704b3930426ada0cb47e6dfd0bab6cb08571c746d272ef689b32a05453b3a3cba83f78c5a4a43777bd548e6483a729c587c2a969f0c28c9642fd7f4863fe77

Download Submit
C:\Windows\System\qQliYsi.exe

Filesize
18B

MD5
b02e9d05e686e129bef05d00ff5203c3

SHA1
e698aa4adc847d754b01445cc92d3a936eccd81f

SHA256
2919f5d8dd5986d9f526c9a7657a6044cc4722033b9b179436129a1b2c29a7ef

SHA512
497cfb1093b4d57bd1ca17f696a7734788d13484dbf26768c2397dc958c254adf1d920ff41694a8e8f487ef695df48cfa4dee2cc40c4be8b8dc4c01a0c0839c3

Download Submit
C:\Windows\System\qgAHAxk.exe

Filesize
1.8MB

MD5
d70a0ce4f90dffff13c641421aae16df

SHA1
1d6b212b5e7d8c98429ed35998011217c49407e8

SHA256
98bafd106b03fcbf39c920b8cb7d336c6d52f5b4ef21a074e447bbe4fc98f0df

SHA512
2d7cf133ac513ac73417be6ba7ff12e40614d5665a6c52e9fcda9849039c0f8e41e053a41c1db67ff0179ae07e9e43fefaa1e8adc0efa87d8822404839deca02

Download Submit
C:\Windows\System\rBYMfRd.exe

Filesize
1.8MB

MD5
82d143a79d3a885f962d6404ae295595

SHA1
c8f77b3e156eb10fc9c69cef2ad8f52c19db5b53

SHA256
6a5f5462d0712f5981b8e088a980a907cfed001f930c778d2c28714ddb8ab1e5

SHA512
0ac57816c579bd69c8c521cc1607087a3cf878f19ebcd8692aecad2ce5edd0a55fb1f283fb10f6fa9c34e18cb9ac792f26096dc21b61432ab8bc80588a938941

Download Submit
C:\Windows\System\rNaPWVT.exe

Filesize
1.8MB

MD5
b58d37507e9f66299ca784b59ddcda4f

SHA1
b82c716925a1be43dee63f2335036046e0296934

SHA256
d138bcaf9055e3d39f0f26f332295c7683a998e7f71344cf37e5ba63c46e2087

SHA512
0c0ccdea95c072ee585bb53e7883ac7dec347041d48e9f862d3a913474dcbfe14bcc0a21061b9e705f19de34173bcdf68e4c8ee9dd0977888f7f772d28fc7004

Download Submit
C:\Windows\System\ryMZrcY.exe

Filesize
1.8MB

MD5
438fb17f2a6314027b4bb63268bd88e8

SHA1
3bee9dd9996380375f26f2e14544bf6af2577184

SHA256
1431a11f8848c590760e53506f0231da9f4014f0786874e1a119bcdabe28c11a

SHA512
21e7327bd9b521a85540bf75417cd46920e13108c90eb1bfd82456a295105509050d6b6beef3ea8472a28e1e1bf2da48eb5cb4cffe8bde636cbb5f5ccb54aaf0

Download Submit
C:\Windows\System\tGgovYn.exe

Filesize
1.8MB

MD5
27fdd2f63fffe78da05e7af4100fb7a8

SHA1
ccd6c2be1f5141232068f133f46bd63b9d5063e7

SHA256
bc1c017d5b34b0dff4e4adbf2d5b73b935e32532ba8a979b6a35e8df01a9f23b

SHA512
73de9014fae356dd3c99c2e608ea6d9464daa7df0d74235af2a7f526d75f98b9ccb3686f838c711a67cd8eaed89b47d19b200be18e91a3abaeb5b4d550edc03e

Download Submit
C:\Windows\System\utJFSKW.exe

Filesize
1.8MB

MD5
ab823e18ed36b9fd60a71c450eac47f5

SHA1
59e5de8af1fae2c857c783344785139908445773

SHA256
7a821dd2eb8ffa90fd98c093ff8c020eecf14d1b293880c4b2baee9b1b69709f

SHA512
c49637a5e80a5a62dce33b027e264e005d852c96590bd7628e5d56611c2207dbd61e6adbb5da82d40290debd1ec357350eea3b1ad27794674a9b528a26197765

Download Submit
C:\Windows\System\xKEaLXF.exe

Filesize
1.8MB

MD5
b1a2a663414adc2f334c9fe257b3ee0d

SHA1
e536b907b4d63afa567f10d0c17f7030b309abc6

SHA256
7765725a25aa4bd6dc9f3f9300cc8bf6a84b07d17c755041664931ff36e939f3

SHA512
952cf0150c865a7da1a75f99e441123511de64670d40d64dc6f8cf02918fe6166a47ff3b4e28e72ea337f04f6371c85519398611269d17a72d9d7b4e3346bb73

Download Submit
C:\Windows\System\yLpOMAI.exe

Filesize
1.8MB

MD5
a5930d0ab594ce57f6f2b163a3b1183f

SHA1
9cfa6fe76789a7f8e87d74d75e3c54c0f1adc91d

SHA256
89586106b2aa587fe164c559f2ff23f4508584851acfc58ab01b2b506ffd0124

SHA512
a771185c6550f595165149244c6345c090549c1f154410576b1cae004628780eca1b0257c73f063656e2512caaa90938ffafaa4aa439a73f0973300e4c4d881a

Download Submit
C:\Windows\System\yevjmYz.exe

Filesize
1.8MB

MD5
7ea2b96a974932ab9f2656553b82de67

SHA1
7434a398e0a09278622db245070a6574c77fa905

SHA256
68c06c69d37754defc91d35cf33afa8298a2f2b53a0f04c9ceafb698936d9bb3

SHA512
895af5ef826b9e63232815ecf41b9df13cf5f5f75cc6516d8c6fe0a604851557ee26aa6f652bae7fe1943db1f15f44ed98dc5ba7289313daa0b7ac9961db929e

Download Submit
C:\Windows\System\yutGOrW.exe

Filesize
1.8MB

MD5
784cf6645bbc673d632889a200f118ab

SHA1
a2e10c17b875c13196015131488e5c5b54935f9e

SHA256
c1284e99c61561ad038786ad45be379b748c4a56fdd80b3b0084cdb3befb0a6f

SHA512
7109e174de2602f051654950d4e240a4673016f495bc1db14b99e8de08d8cb36b54e94711ff02afd361e64ca935a621ecfc5104bd7d2dca2357d1aac8c808da5

Download Submit
memory/772-128-0x00000250193E0000-0x0000025019402000-memory.dmp

Filesize
136KB

Download
memory/772-397-0x0000025034270000-0x0000025034A16000-memory.dmp

Filesize
7.6MB

Download
memory/872-0-0x00007FF73E6B0000-0x00007FF73EAA2000-memory.dmp

Filesize
3.9MB

Download
memory/872-398-0x00007FF73E6B0000-0x00007FF73EAA2000-memory.dmp

Filesize
3.9MB

Download
memory/872-1-0x00000189FF810000-0x00000189FF820000-memory.dmp

Filesize
64KB

Download
memory/916-82-0x00007FF609ED0000-0x00007FF60A2C2000-memory.dmp

Filesize
3.9MB

Download
memory/916-2029-0x00007FF609ED0000-0x00007FF60A2C2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-28-0x00007FF7F39C0000-0x00007FF7F3DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1188-1556-0x00007FF7F39C0000-0x00007FF7F3DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-401-0x00007FF72A800000-0x00007FF72ABF2000-memory.dmp

Filesize
3.9MB

Download
memory/1296-22-0x00007FF601ED0000-0x00007FF6022C2000-memory.dmp

Filesize
3.9MB

Download
memory/1448-103-0x00007FF7ABE00000-0x00007FF7AC1F2000-memory.dmp

Filesize
3.9MB

Download
memory/1480-13-0x00007FF7D9CE0000-0x00007FF7DA0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1492-60-0x00007FF6C5260000-0x00007FF6C5652000-memory.dmp

Filesize
3.9MB

Download
memory/1692-99-0x00007FF6E1500000-0x00007FF6E18F2000-memory.dmp

Filesize
3.9MB

Download
memory/1852-87-0x00007FF71B170000-0x00007FF71B562000-memory.dmp

Filesize
3.9MB

Download
memory/1964-110-0x00007FF6E2450000-0x00007FF6E2842000-memory.dmp

Filesize
3.9MB

Download
memory/2076-50-0x00007FF650050000-0x00007FF650442000-memory.dmp

Filesize
3.9MB

Download
memory/2276-1575-0x00007FF79B220000-0x00007FF79B612000-memory.dmp

Filesize
3.9MB

Download
memory/2276-39-0x00007FF79B220000-0x00007FF79B612000-memory.dmp

Filesize
3.9MB

Download
memory/2304-104-0x00007FF763230000-0x00007FF763622000-memory.dmp

Filesize
3.9MB

Download
memory/2880-86-0x00007FF70FAA0000-0x00007FF70FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2900-74-0x00007FF71FD60000-0x00007FF720152000-memory.dmp

Filesize
3.9MB

Download
memory/2900-1578-0x00007FF71FD60000-0x00007FF720152000-memory.dmp

Filesize
3.9MB

Download
memory/3376-402-0x00007FF690AF0000-0x00007FF690EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3640-66-0x00007FF630880000-0x00007FF630C72000-memory.dmp

Filesize
3.9MB

Download
memory/3640-2405-0x00007FF630880000-0x00007FF630C72000-memory.dmp

Filesize
3.9MB

Download
memory/3920-54-0x00007FF6C47F0000-0x00007FF6C4BE2000-memory.dmp

Filesize
3.9MB

Download
memory/3956-399-0x00007FF6523D0000-0x00007FF6527C2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-106-0x00007FF6E1820000-0x00007FF6E1C12000-memory.dmp

Filesize
3.9MB

Download
memory/4368-2935-0x00007FF6E1820000-0x00007FF6E1C12000-memory.dmp

Filesize
3.9MB

Download
memory/4576-116-0x00007FF683650000-0x00007FF683A42000-memory.dmp

Filesize
3.9MB

Download
memory/4576-3322-0x00007FF683650000-0x00007FF683A42000-memory.dmp

Filesize
3.9MB

Download
memory/4596-129-0x00007FF7D2900000-0x00007FF7D2CF2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-400-0x00007FF7AB630000-0x00007FF7ABA22000-memory.dmp

Filesize
3.9MB

Download
memory/5068-92-0x00007FF6B6200000-0x00007FF6B65F2000-memory.dmp

Filesize
3.9MB

Download