xmrig | c96e6598ad2948b20abd2bcc187b83f4c76eb54231489eb578703a16f2f35321

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
Size

3.1MB
MD5

41a51ade978ff76a1a749a6bcab39d00
SHA1

dc29efc01cba0252cac216b5a12aa184ede41741
SHA256

c96e6598ad2948b20abd2bcc187b83f4c76eb54231489eb578703a16f2f35321
SHA512

fe3822aa8d6435f67ee497f0426bc2889a069f23f0047d066fc9962be03288f195cd637f47ac5ccf09e0b0fa12047167d8fdbdec52627a9cc0c6b1d684efd71f
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWU:7bBeSFkg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 55 IoCs

miner

resource	yara_rule
behavioral1/memory/2232-0-0x000000013FDB0000-0x00000001401A6000-memory.dmp	xmrig
behavioral1/files/0x000d00000001269e-3.dat	xmrig
behavioral1/files/0x003200000001471d-16.dat	xmrig
behavioral1/files/0x0008000000014b27-25.dat	xmrig
behavioral1/files/0x0007000000014b63-32.dat	xmrig
behavioral1/files/0x0007000000015ce1-47.dat	xmrig
behavioral1/files/0x0006000000015d07-57.dat	xmrig
behavioral1/files/0x0006000000015d28-62.dat	xmrig
behavioral1/files/0x0006000000015d6f-92.dat	xmrig
behavioral1/files/0x0006000000015d8f-108.dat	xmrig
behavioral1/files/0x0006000000015d79-97.dat	xmrig
behavioral1/files/0x000600000001630b-169.dat	xmrig
behavioral1/files/0x0006000000016843-180.dat	xmrig
behavioral1/files/0x0006000000016572-189.dat	xmrig
behavioral1/files/0x0006000000016c4a-186.dat	xmrig
behavioral1/files/0x0006000000016117-162.dat	xmrig
behavioral1/files/0x0006000000015f6d-153.dat	xmrig
behavioral1/memory/2772-138-0x000000013FF10000-0x0000000140306000-memory.dmp	xmrig
behavioral1/memory/1708-136-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig
behavioral1/memory/2980-134-0x000000013F140000-0x000000013F536000-memory.dmp	xmrig
behavioral1/memory/2516-132-0x000000013F6D0000-0x000000013FAC6000-memory.dmp	xmrig
behavioral1/memory/2232-131-0x000000013F6D0000-0x000000013FAC6000-memory.dmp	xmrig
behavioral1/memory/2452-130-0x000000013F540000-0x000000013F936000-memory.dmp	xmrig
behavioral1/memory/2552-128-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/2976-126-0x000000013FBA0000-0x000000013FF96000-memory.dmp	xmrig
behavioral1/memory/1468-124-0x000000013FEF0000-0x00000001402E6000-memory.dmp	xmrig
behavioral1/memory/2660-122-0x000000013F8A0000-0x000000013FC96000-memory.dmp	xmrig
behavioral1/memory/2712-120-0x000000013FB20000-0x000000013FF16000-memory.dmp	xmrig
behavioral1/memory/2024-118-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig
behavioral1/files/0x0006000000015e3a-144.dat	xmrig
behavioral1/files/0x0006000000015d9b-115.dat	xmrig
behavioral1/files/0x0006000000015d87-113.dat	xmrig
behavioral1/files/0x0032000000014726-87.dat	xmrig
behavioral1/files/0x0006000000015d67-83.dat	xmrig
behavioral1/files/0x0006000000015d5e-77.dat	xmrig
behavioral1/files/0x0006000000015d56-72.dat	xmrig
behavioral1/files/0x0006000000015d4a-67.dat	xmrig
behavioral1/files/0x0006000000015ceb-52.dat	xmrig
behavioral1/files/0x0008000000014e51-43.dat	xmrig
behavioral1/files/0x0007000000014baa-37.dat	xmrig
behavioral1/files/0x0007000000004e76-23.dat	xmrig
behavioral1/memory/3060-13-0x000000013F8F0000-0x000000013FCE6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015fe9-156.dat	xmrig
behavioral1/files/0x0006000000015eaf-146.dat	xmrig
behavioral1/files/0x0006000000016c63-191.dat	xmrig
behavioral1/files/0x0006000000016a9a-183.dat	xmrig
behavioral1/files/0x000600000001661c-177.dat	xmrig
behavioral1/files/0x00060000000164b2-171.dat	xmrig
behavioral1/files/0x00060000000161e7-164.dat	xmrig
behavioral1/memory/2232-2336-0x000000013FDB0000-0x00000001401A6000-memory.dmp	xmrig
behavioral1/memory/3060-2662-0x000000013F8F0000-0x000000013FCE6000-memory.dmp	xmrig
behavioral1/memory/2024-2841-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig
behavioral1/memory/2552-4363-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/2980-4386-0x000000013F140000-0x000000013F536000-memory.dmp	xmrig
behavioral1/memory/2772-4387-0x000000013FF10000-0x0000000140306000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2100	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3060	JPBjTkZ.exe
2024	vBfBzbg.exe
2712	NhUFfsF.exe
2660	tIMzacx.exe
1468	yaPpOeh.exe
2976	IJEIBpy.exe
2552	DSFHuFa.exe
2452	zIagler.exe
2516	cEcrnIK.exe
2980	fyxGEcs.exe
1708	fFjFfOy.exe
2772	bwusVmD.exe
2892	sRrrbce.exe
2948	Mrhwofu.exe
2068	doriSSH.exe
2000	ZfjiinB.exe
1048	fDPAGZv.exe
1280	GRdTumL.exe
1516	czbuXdg.exe
916	xCbCoes.exe
2428	KcXGXmr.exe
1812	tzZOvAE.exe
2292	rXPECjX.exe
784	FGKdalZ.exe
1180	yhpeoim.exe
1352	sYdGDfw.exe
1684	eTBAdNp.exe
1816	KeWoPdy.exe
2200	qPzjYNc.exe
920	jYlyKQZ.exe
1616	SYFmZEc.exe
756	TmEuytj.exe
620	oQPkxoe.exe
772	LQJEtFZ.exe
2824	dxWLIWJ.exe
2376	gvwbvhX.exe
2164	vgRHRsb.exe
2860	QWbaLld.exe
892	AAOekcj.exe
1820	pvjeGuU.exe
1588	IxWjMZu.exe
3004	GYlFvST.exe
2672	dxCSmqX.exe
2476	nSUVReV.exe
2484	ErJqhDO.exe
2240	HJrXOKl.exe
2540	EoVTkmy.exe
3040	WDMbHXc.exe
2692	QdVLTRb.exe
1832	kWSlMZE.exe
2848	pkwjebO.exe
912	qcTyPbI.exe
1656	DhjrBqI.exe
3044	cJiPyLd.exe
880	eXzfAkX.exe
2592	rCNGDxz.exe
2796	HaZeKiO.exe
3080	rNUYHNK.exe
3112	JhAQsXu.exe
3144	SuNDYpK.exe
3176	BIaNfWD.exe
3208	sqlazyi.exe
3240	ZYAHLHf.exe
3272	hErHRLB.exe

Loads dropped DLL 64 IoCs

pid	Process
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-0-0x000000013FDB0000-0x00000001401A6000-memory.dmp	upx
behavioral1/files/0x000d00000001269e-3.dat	upx
behavioral1/files/0x003200000001471d-16.dat	upx
behavioral1/files/0x0008000000014b27-25.dat	upx
behavioral1/files/0x0007000000014b63-32.dat	upx
behavioral1/files/0x0007000000015ce1-47.dat	upx
behavioral1/files/0x0006000000015d07-57.dat	upx
behavioral1/files/0x0006000000015d28-62.dat	upx
behavioral1/files/0x0006000000015d6f-92.dat	upx
behavioral1/files/0x0006000000015d8f-108.dat	upx
behavioral1/files/0x0006000000015d79-97.dat	upx
behavioral1/files/0x000600000001630b-169.dat	upx
behavioral1/files/0x0006000000016843-180.dat	upx
behavioral1/files/0x0006000000016572-189.dat	upx
behavioral1/files/0x0006000000016c4a-186.dat	upx
behavioral1/files/0x0006000000016117-162.dat	upx
behavioral1/files/0x0006000000015f6d-153.dat	upx
behavioral1/memory/2772-138-0x000000013FF10000-0x0000000140306000-memory.dmp	upx
behavioral1/memory/1708-136-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	upx
behavioral1/memory/2980-134-0x000000013F140000-0x000000013F536000-memory.dmp	upx
behavioral1/memory/2516-132-0x000000013F6D0000-0x000000013FAC6000-memory.dmp	upx
behavioral1/memory/2452-130-0x000000013F540000-0x000000013F936000-memory.dmp	upx
behavioral1/memory/2552-128-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/2976-126-0x000000013FBA0000-0x000000013FF96000-memory.dmp	upx
behavioral1/memory/1468-124-0x000000013FEF0000-0x00000001402E6000-memory.dmp	upx
behavioral1/memory/2660-122-0x000000013F8A0000-0x000000013FC96000-memory.dmp	upx
behavioral1/memory/2712-120-0x000000013FB20000-0x000000013FF16000-memory.dmp	upx
behavioral1/memory/2024-118-0x000000013F780000-0x000000013FB76000-memory.dmp	upx
behavioral1/files/0x0006000000015e3a-144.dat	upx
behavioral1/files/0x0006000000015d9b-115.dat	upx
behavioral1/files/0x0006000000015d87-113.dat	upx
behavioral1/files/0x0032000000014726-87.dat	upx
behavioral1/files/0x0006000000015d67-83.dat	upx
behavioral1/files/0x0006000000015d5e-77.dat	upx
behavioral1/files/0x0006000000015d56-72.dat	upx
behavioral1/files/0x0006000000015d4a-67.dat	upx
behavioral1/files/0x0006000000015ceb-52.dat	upx
behavioral1/files/0x0008000000014e51-43.dat	upx
behavioral1/files/0x0007000000014baa-37.dat	upx
behavioral1/files/0x0007000000004e76-23.dat	upx
behavioral1/memory/3060-13-0x000000013F8F0000-0x000000013FCE6000-memory.dmp	upx
behavioral1/files/0x0006000000015fe9-156.dat	upx
behavioral1/files/0x0006000000015eaf-146.dat	upx
behavioral1/files/0x0006000000016c63-191.dat	upx
behavioral1/files/0x0006000000016a9a-183.dat	upx
behavioral1/files/0x000600000001661c-177.dat	upx
behavioral1/files/0x00060000000164b2-171.dat	upx
behavioral1/files/0x00060000000161e7-164.dat	upx
behavioral1/memory/2232-2336-0x000000013FDB0000-0x00000001401A6000-memory.dmp	upx
behavioral1/memory/3060-2662-0x000000013F8F0000-0x000000013FCE6000-memory.dmp	upx
behavioral1/memory/2024-2841-0x000000013F780000-0x000000013FB76000-memory.dmp	upx
behavioral1/memory/2552-4363-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/2980-4386-0x000000013F140000-0x000000013F536000-memory.dmp	upx
behavioral1/memory/2772-4387-0x000000013FF10000-0x0000000140306000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yEvWbRa.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\kcpHwOD.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\zxbQIPW.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\CPiNmIh.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\wIamGwi.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\aFPdySI.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\VLgkUXX.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\ivIIyCC.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\qLXCfYP.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\rcPztOz.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\ljzWePE.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\lLYrkje.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\LzRoIGq.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\kKHLrPj.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\EhxVyjM.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\sZdaBqe.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\KvMusPb.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\rcTOMTG.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\hQhgCOK.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\JhmKDQG.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\KoKFxNi.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\hCzUNae.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\pMKejnD.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\zCevRtV.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\VUgLgSh.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\NMWsXib.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\kKAvbMI.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\YUcEiOF.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\lvSZzzD.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\WoBaFNd.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\XJZhywH.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\jfhojZf.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\UuvfbhL.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\XHOBIYw.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\wTCiHMi.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\rQNhNdM.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\VBHbXbD.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\zISaVFF.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\UiGhWXM.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\yvlulHU.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\ZHjmWGv.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\DbwgApz.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\JaLvpeF.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\IhfyPIf.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\eiRpDvv.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\aeLBWjm.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\zouLVAZ.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\OeOeVDf.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\ebkIHve.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\UjDLKRx.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\gPwReUb.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\EJkgceR.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\SxJungj.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\efqCfSz.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\jNucnyG.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\lFiwAzD.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\TxNBsHv.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\JBMWlkw.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\GuWaYUh.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\INlukHm.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\BIaNfWD.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\mBnrTLK.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\feKBSSJ.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
File created	C:\Windows\System\dBGWjts.exe	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2100	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
Token: SeDebugPrivilege	2100	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2100	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	29
PID 2232 wrote to memory of 2100	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	29
PID 2232 wrote to memory of 2100	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	29
PID 2232 wrote to memory of 3060	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	30
PID 2232 wrote to memory of 3060	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	30
PID 2232 wrote to memory of 3060	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	30
PID 2232 wrote to memory of 2024	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	31
PID 2232 wrote to memory of 2024	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	31
PID 2232 wrote to memory of 2024	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	31
PID 2232 wrote to memory of 2712	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	32
PID 2232 wrote to memory of 2712	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	32
PID 2232 wrote to memory of 2712	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	32
PID 2232 wrote to memory of 2660	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	33
PID 2232 wrote to memory of 2660	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	33
PID 2232 wrote to memory of 2660	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	33
PID 2232 wrote to memory of 1468	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	34
PID 2232 wrote to memory of 1468	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	34
PID 2232 wrote to memory of 1468	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	34
PID 2232 wrote to memory of 2976	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	35
PID 2232 wrote to memory of 2976	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	35
PID 2232 wrote to memory of 2976	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	35
PID 2232 wrote to memory of 2552	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	36
PID 2232 wrote to memory of 2552	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	36
PID 2232 wrote to memory of 2552	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	36
PID 2232 wrote to memory of 2452	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	37
PID 2232 wrote to memory of 2452	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	37
PID 2232 wrote to memory of 2452	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	37
PID 2232 wrote to memory of 2516	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	38
PID 2232 wrote to memory of 2516	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	38
PID 2232 wrote to memory of 2516	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	38
PID 2232 wrote to memory of 2980	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	39
PID 2232 wrote to memory of 2980	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	39
PID 2232 wrote to memory of 2980	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	39
PID 2232 wrote to memory of 1708	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	40
PID 2232 wrote to memory of 1708	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	40
PID 2232 wrote to memory of 1708	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	40
PID 2232 wrote to memory of 2772	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	41
PID 2232 wrote to memory of 2772	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	41
PID 2232 wrote to memory of 2772	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	41
PID 2232 wrote to memory of 2892	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	42
PID 2232 wrote to memory of 2892	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	42
PID 2232 wrote to memory of 2892	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	42
PID 2232 wrote to memory of 2948	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	43
PID 2232 wrote to memory of 2948	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	43
PID 2232 wrote to memory of 2948	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	43
PID 2232 wrote to memory of 2068	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	44
PID 2232 wrote to memory of 2068	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	44
PID 2232 wrote to memory of 2068	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	44
PID 2232 wrote to memory of 2000	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	45
PID 2232 wrote to memory of 2000	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	45
PID 2232 wrote to memory of 2000	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	45
PID 2232 wrote to memory of 1048	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	46
PID 2232 wrote to memory of 1048	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	46
PID 2232 wrote to memory of 1048	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	46
PID 2232 wrote to memory of 1280	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	47
PID 2232 wrote to memory of 1280	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	47
PID 2232 wrote to memory of 1280	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	47
PID 2232 wrote to memory of 916	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	48
PID 2232 wrote to memory of 916	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	48
PID 2232 wrote to memory of 916	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	48
PID 2232 wrote to memory of 1516	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	49
PID 2232 wrote to memory of 1516	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	49
PID 2232 wrote to memory of 1516	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	49
PID 2232 wrote to memory of 2428	2232	41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\41a51ade978ff76a1a749a6bcab39d00_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\System\JPBjTkZ.exe
  C:\Windows\System\JPBjTkZ.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\vBfBzbg.exe
  C:\Windows\System\vBfBzbg.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\NhUFfsF.exe
  C:\Windows\System\NhUFfsF.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\tIMzacx.exe
  C:\Windows\System\tIMzacx.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\yaPpOeh.exe
  C:\Windows\System\yaPpOeh.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\IJEIBpy.exe
  C:\Windows\System\IJEIBpy.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\DSFHuFa.exe
  C:\Windows\System\DSFHuFa.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\zIagler.exe
  C:\Windows\System\zIagler.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\cEcrnIK.exe
  C:\Windows\System\cEcrnIK.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\fyxGEcs.exe
  C:\Windows\System\fyxGEcs.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\fFjFfOy.exe
  C:\Windows\System\fFjFfOy.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\bwusVmD.exe
  C:\Windows\System\bwusVmD.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\sRrrbce.exe
  C:\Windows\System\sRrrbce.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\Mrhwofu.exe
  C:\Windows\System\Mrhwofu.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\doriSSH.exe
  C:\Windows\System\doriSSH.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\ZfjiinB.exe
  C:\Windows\System\ZfjiinB.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\fDPAGZv.exe
  C:\Windows\System\fDPAGZv.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\GRdTumL.exe
  C:\Windows\System\GRdTumL.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\xCbCoes.exe
  C:\Windows\System\xCbCoes.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\czbuXdg.exe
  C:\Windows\System\czbuXdg.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\KcXGXmr.exe
  C:\Windows\System\KcXGXmr.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\tzZOvAE.exe
  C:\Windows\System\tzZOvAE.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\rXPECjX.exe
  C:\Windows\System\rXPECjX.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\FGKdalZ.exe
  C:\Windows\System\FGKdalZ.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\yhpeoim.exe
  C:\Windows\System\yhpeoim.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\sYdGDfw.exe
  C:\Windows\System\sYdGDfw.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\jVFBRvr.exe
  C:\Windows\System\jVFBRvr.exe
  2⤵
  PID:2168
- C:\Windows\System\eTBAdNp.exe
  C:\Windows\System\eTBAdNp.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\GDmEOwd.exe
  C:\Windows\System\GDmEOwd.exe
  2⤵
  PID:1892
- C:\Windows\System\KeWoPdy.exe
  C:\Windows\System\KeWoPdy.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\FmlJEHr.exe
  C:\Windows\System\FmlJEHr.exe
  2⤵
  PID:420
- C:\Windows\System\qPzjYNc.exe
  C:\Windows\System\qPzjYNc.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\FxAMOJz.exe
  C:\Windows\System\FxAMOJz.exe
  2⤵
  PID:2148
- C:\Windows\System\jYlyKQZ.exe
  C:\Windows\System\jYlyKQZ.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\XyyDyGC.exe
  C:\Windows\System\XyyDyGC.exe
  2⤵
  PID:1540
- C:\Windows\System\SYFmZEc.exe
  C:\Windows\System\SYFmZEc.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\IrjjZpC.exe
  C:\Windows\System\IrjjZpC.exe
  2⤵
  PID:960
- C:\Windows\System\TmEuytj.exe
  C:\Windows\System\TmEuytj.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\ZhQeLdi.exe
  C:\Windows\System\ZhQeLdi.exe
  2⤵
  PID:1900
- C:\Windows\System\oQPkxoe.exe
  C:\Windows\System\oQPkxoe.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\wZUdWvO.exe
  C:\Windows\System\wZUdWvO.exe
  2⤵
  PID:556
- C:\Windows\System\LQJEtFZ.exe
  C:\Windows\System\LQJEtFZ.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\VeJzExG.exe
  C:\Windows\System\VeJzExG.exe
  2⤵
  PID:964
- C:\Windows\System\dxWLIWJ.exe
  C:\Windows\System\dxWLIWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\jdAgswv.exe
  C:\Windows\System\jdAgswv.exe
  2⤵
  PID:664
- C:\Windows\System\gvwbvhX.exe
  C:\Windows\System\gvwbvhX.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ZZIdVCf.exe
  C:\Windows\System\ZZIdVCf.exe
  2⤵
  PID:2204
- C:\Windows\System\vgRHRsb.exe
  C:\Windows\System\vgRHRsb.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\osvyicF.exe
  C:\Windows\System\osvyicF.exe
  2⤵
  PID:1152
- C:\Windows\System\QWbaLld.exe
  C:\Windows\System\QWbaLld.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\STBmybP.exe
  C:\Windows\System\STBmybP.exe
  2⤵
  PID:3048
- C:\Windows\System\AAOekcj.exe
  C:\Windows\System\AAOekcj.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\oUTCBvX.exe
  C:\Windows\System\oUTCBvX.exe
  2⤵
  PID:1636
- C:\Windows\System\pvjeGuU.exe
  C:\Windows\System\pvjeGuU.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\xSJFHOs.exe
  C:\Windows\System\xSJFHOs.exe
  2⤵
  PID:1844
- C:\Windows\System\IxWjMZu.exe
  C:\Windows\System\IxWjMZu.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\wguchji.exe
  C:\Windows\System\wguchji.exe
  2⤵
  PID:2968
- C:\Windows\System\GYlFvST.exe
  C:\Windows\System\GYlFvST.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\GkjYYjl.exe
  C:\Windows\System\GkjYYjl.exe
  2⤵
  PID:2652
- C:\Windows\System\dxCSmqX.exe
  C:\Windows\System\dxCSmqX.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\DFBYumX.exe
  C:\Windows\System\DFBYumX.exe
  2⤵
  PID:2572
- C:\Windows\System\nSUVReV.exe
  C:\Windows\System\nSUVReV.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\qHoMlOy.exe
  C:\Windows\System\qHoMlOy.exe
  2⤵
  PID:2800
- C:\Windows\System\ErJqhDO.exe
  C:\Windows\System\ErJqhDO.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\QezLZUJ.exe
  C:\Windows\System\QezLZUJ.exe
  2⤵
  PID:2512
- C:\Windows\System\HJrXOKl.exe
  C:\Windows\System\HJrXOKl.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\Zdkphpn.exe
  C:\Windows\System\Zdkphpn.exe
  2⤵
  PID:2092
- C:\Windows\System\EoVTkmy.exe
  C:\Windows\System\EoVTkmy.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\GmBVApj.exe
  C:\Windows\System\GmBVApj.exe
  2⤵
  PID:2788
- C:\Windows\System\WDMbHXc.exe
  C:\Windows\System\WDMbHXc.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\LcRbjGA.exe
  C:\Windows\System\LcRbjGA.exe
  2⤵
  PID:844
- C:\Windows\System\QdVLTRb.exe
  C:\Windows\System\QdVLTRb.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\NIUraHL.exe
  C:\Windows\System\NIUraHL.exe
  2⤵
  PID:1432
- C:\Windows\System\kWSlMZE.exe
  C:\Windows\System\kWSlMZE.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\exBBlwt.exe
  C:\Windows\System\exBBlwt.exe
  2⤵
  PID:2760
- C:\Windows\System\pkwjebO.exe
  C:\Windows\System\pkwjebO.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\mXAmDcI.exe
  C:\Windows\System\mXAmDcI.exe
  2⤵
  PID:1164
- C:\Windows\System\qcTyPbI.exe
  C:\Windows\System\qcTyPbI.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\rVTsnQU.exe
  C:\Windows\System\rVTsnQU.exe
  2⤵
  PID:1368
- C:\Windows\System\DhjrBqI.exe
  C:\Windows\System\DhjrBqI.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\PnJkFcY.exe
  C:\Windows\System\PnJkFcY.exe
  2⤵
  PID:2408
- C:\Windows\System\cJiPyLd.exe
  C:\Windows\System\cJiPyLd.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\RxlGSvh.exe
  C:\Windows\System\RxlGSvh.exe
  2⤵
  PID:2124
- C:\Windows\System\eXzfAkX.exe
  C:\Windows\System\eXzfAkX.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\jbRwuuF.exe
  C:\Windows\System\jbRwuuF.exe
  2⤵
  PID:1596
- C:\Windows\System\rCNGDxz.exe
  C:\Windows\System\rCNGDxz.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\dvgNaYy.exe
  C:\Windows\System\dvgNaYy.exe
  2⤵
  PID:2436
- C:\Windows\System\HaZeKiO.exe
  C:\Windows\System\HaZeKiO.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\kuqudaV.exe
  C:\Windows\System\kuqudaV.exe
  2⤵
  PID:2272
- C:\Windows\System\rNUYHNK.exe
  C:\Windows\System\rNUYHNK.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\cCiRSlc.exe
  C:\Windows\System\cCiRSlc.exe
  2⤵
  PID:3096
- C:\Windows\System\JhAQsXu.exe
  C:\Windows\System\JhAQsXu.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\axbucST.exe
  C:\Windows\System\axbucST.exe
  2⤵
  PID:3128
- C:\Windows\System\SuNDYpK.exe
  C:\Windows\System\SuNDYpK.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\ooqWeQd.exe
  C:\Windows\System\ooqWeQd.exe
  2⤵
  PID:3160
- C:\Windows\System\BIaNfWD.exe
  C:\Windows\System\BIaNfWD.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\IgsdkCP.exe
  C:\Windows\System\IgsdkCP.exe
  2⤵
  PID:3192
- C:\Windows\System\sqlazyi.exe
  C:\Windows\System\sqlazyi.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\zIulSlM.exe
  C:\Windows\System\zIulSlM.exe
  2⤵
  PID:3224
- C:\Windows\System\ZYAHLHf.exe
  C:\Windows\System\ZYAHLHf.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\zaTbPta.exe
  C:\Windows\System\zaTbPta.exe
  2⤵
  PID:3256
- C:\Windows\System\hErHRLB.exe
  C:\Windows\System\hErHRLB.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\vKUBjAh.exe
  C:\Windows\System\vKUBjAh.exe
  2⤵
  PID:3288
- C:\Windows\System\iDVRMKj.exe
  C:\Windows\System\iDVRMKj.exe
  2⤵
  PID:3304
- C:\Windows\System\ejMYYGp.exe
  C:\Windows\System\ejMYYGp.exe
  2⤵
  PID:3320
- C:\Windows\System\PEQbFkk.exe
  C:\Windows\System\PEQbFkk.exe
  2⤵
  PID:3336
- C:\Windows\System\aihzScz.exe
  C:\Windows\System\aihzScz.exe
  2⤵
  PID:3352
- C:\Windows\System\gzoVjKh.exe
  C:\Windows\System\gzoVjKh.exe
  2⤵
  PID:3368
- C:\Windows\System\WwTpySB.exe
  C:\Windows\System\WwTpySB.exe
  2⤵
  PID:3384
- C:\Windows\System\cyiBMQv.exe
  C:\Windows\System\cyiBMQv.exe
  2⤵
  PID:3400
- C:\Windows\System\EWAsLKL.exe
  C:\Windows\System\EWAsLKL.exe
  2⤵
  PID:3416
- C:\Windows\System\QelEHUl.exe
  C:\Windows\System\QelEHUl.exe
  2⤵
  PID:3432
- C:\Windows\System\ktzLqxN.exe
  C:\Windows\System\ktzLqxN.exe
  2⤵
  PID:3448
- C:\Windows\System\CATcddD.exe
  C:\Windows\System\CATcddD.exe
  2⤵
  PID:3464
- C:\Windows\System\KzPdqKh.exe
  C:\Windows\System\KzPdqKh.exe
  2⤵
  PID:3480
- C:\Windows\System\twAJLFB.exe
  C:\Windows\System\twAJLFB.exe
  2⤵
  PID:3496
- C:\Windows\System\LqDHIAw.exe
  C:\Windows\System\LqDHIAw.exe
  2⤵
  PID:3512
- C:\Windows\System\cLFyyEf.exe
  C:\Windows\System\cLFyyEf.exe
  2⤵
  PID:3528
- C:\Windows\System\dBzRWLF.exe
  C:\Windows\System\dBzRWLF.exe
  2⤵
  PID:3544
- C:\Windows\System\zrxGBxP.exe
  C:\Windows\System\zrxGBxP.exe
  2⤵
  PID:3560
- C:\Windows\System\oEQHZXi.exe
  C:\Windows\System\oEQHZXi.exe
  2⤵
  PID:3576
- C:\Windows\System\QACjzrk.exe
  C:\Windows\System\QACjzrk.exe
  2⤵
  PID:3592
- C:\Windows\System\vYhvxFE.exe
  C:\Windows\System\vYhvxFE.exe
  2⤵
  PID:3608
- C:\Windows\System\qOlJYbN.exe
  C:\Windows\System\qOlJYbN.exe
  2⤵
  PID:3624
- C:\Windows\System\vdaXhne.exe
  C:\Windows\System\vdaXhne.exe
  2⤵
  PID:3640
- C:\Windows\System\hwQiFCa.exe
  C:\Windows\System\hwQiFCa.exe
  2⤵
  PID:3656
- C:\Windows\System\etPzwxH.exe
  C:\Windows\System\etPzwxH.exe
  2⤵
  PID:3672
- C:\Windows\System\FjRshFk.exe
  C:\Windows\System\FjRshFk.exe
  2⤵
  PID:3688
- C:\Windows\System\TWxJQiY.exe
  C:\Windows\System\TWxJQiY.exe
  2⤵
  PID:3704
- C:\Windows\System\oNiGwCy.exe
  C:\Windows\System\oNiGwCy.exe
  2⤵
  PID:3720
- C:\Windows\System\CtfJAGt.exe
  C:\Windows\System\CtfJAGt.exe
  2⤵
  PID:3736
- C:\Windows\System\SprtrfZ.exe
  C:\Windows\System\SprtrfZ.exe
  2⤵
  PID:3752
- C:\Windows\System\MtjaJxV.exe
  C:\Windows\System\MtjaJxV.exe
  2⤵
  PID:3768
- C:\Windows\System\QSttXrh.exe
  C:\Windows\System\QSttXrh.exe
  2⤵
  PID:3784
- C:\Windows\System\abStuhN.exe
  C:\Windows\System\abStuhN.exe
  2⤵
  PID:3800
- C:\Windows\System\vpTaUpQ.exe
  C:\Windows\System\vpTaUpQ.exe
  2⤵
  PID:3816
- C:\Windows\System\RAJMzpv.exe
  C:\Windows\System\RAJMzpv.exe
  2⤵
  PID:3832
- C:\Windows\System\LFzgdMJ.exe
  C:\Windows\System\LFzgdMJ.exe
  2⤵
  PID:3848
- C:\Windows\System\uMrZnUM.exe
  C:\Windows\System\uMrZnUM.exe
  2⤵
  PID:3864
- C:\Windows\System\lFiwAzD.exe
  C:\Windows\System\lFiwAzD.exe
  2⤵
  PID:3880
- C:\Windows\System\qwXSSWS.exe
  C:\Windows\System\qwXSSWS.exe
  2⤵
  PID:3896
- C:\Windows\System\cmRvPyV.exe
  C:\Windows\System\cmRvPyV.exe
  2⤵
  PID:3912
- C:\Windows\System\KaloRFk.exe
  C:\Windows\System\KaloRFk.exe
  2⤵
  PID:3928
- C:\Windows\System\aGxIDPr.exe
  C:\Windows\System\aGxIDPr.exe
  2⤵
  PID:3944
- C:\Windows\System\rZbKuqX.exe
  C:\Windows\System\rZbKuqX.exe
  2⤵
  PID:3960
- C:\Windows\System\OEGIvaL.exe
  C:\Windows\System\OEGIvaL.exe
  2⤵
  PID:3976
- C:\Windows\System\KivudgC.exe
  C:\Windows\System\KivudgC.exe
  2⤵
  PID:3992
- C:\Windows\System\HfvDzHB.exe
  C:\Windows\System\HfvDzHB.exe
  2⤵
  PID:4008
- C:\Windows\System\dduxcnX.exe
  C:\Windows\System\dduxcnX.exe
  2⤵
  PID:4024
- C:\Windows\System\CCijEdg.exe
  C:\Windows\System\CCijEdg.exe
  2⤵
  PID:4040
- C:\Windows\System\aBqckBI.exe
  C:\Windows\System\aBqckBI.exe
  2⤵
  PID:4056
- C:\Windows\System\vqIShVA.exe
  C:\Windows\System\vqIShVA.exe
  2⤵
  PID:4072
- C:\Windows\System\eJYJklK.exe
  C:\Windows\System\eJYJklK.exe
  2⤵
  PID:4088
- C:\Windows\System\pJCyuvh.exe
  C:\Windows\System\pJCyuvh.exe
  2⤵
  PID:540
- C:\Windows\System\nulwGAF.exe
  C:\Windows\System\nulwGAF.exe
  2⤵
  PID:956
- C:\Windows\System\wZrtxQJ.exe
  C:\Windows\System\wZrtxQJ.exe
  2⤵
  PID:1064
- C:\Windows\System\HWabqKP.exe
  C:\Windows\System\HWabqKP.exe
  2⤵
  PID:1740
- C:\Windows\System\myoEaNV.exe
  C:\Windows\System\myoEaNV.exe
  2⤵
  PID:3124
- C:\Windows\System\bfUquRx.exe
  C:\Windows\System\bfUquRx.exe
  2⤵
  PID:3188
- C:\Windows\System\cUYXKIP.exe
  C:\Windows\System\cUYXKIP.exe
  2⤵
  PID:3252
- C:\Windows\System\edBIFCh.exe
  C:\Windows\System\edBIFCh.exe
  2⤵
  PID:3316
- C:\Windows\System\qLXCfYP.exe
  C:\Windows\System\qLXCfYP.exe
  2⤵
  PID:3380
- C:\Windows\System\yloHmBC.exe
  C:\Windows\System\yloHmBC.exe
  2⤵
  PID:3444
- C:\Windows\System\rCRWAle.exe
  C:\Windows\System\rCRWAle.exe
  2⤵
  PID:3508
- C:\Windows\System\cJhkEZL.exe
  C:\Windows\System\cJhkEZL.exe
  2⤵
  PID:3572
- C:\Windows\System\KcySxJN.exe
  C:\Windows\System\KcySxJN.exe
  2⤵
  PID:3636
- C:\Windows\System\EgFLZjL.exe
  C:\Windows\System\EgFLZjL.exe
  2⤵
  PID:3700
- C:\Windows\System\BICKjMk.exe
  C:\Windows\System\BICKjMk.exe
  2⤵
  PID:3764
- C:\Windows\System\ILlRkIm.exe
  C:\Windows\System\ILlRkIm.exe
  2⤵
  PID:3828
- C:\Windows\System\QLiLRfb.exe
  C:\Windows\System\QLiLRfb.exe
  2⤵
  PID:3892
- C:\Windows\System\aoIfEsg.exe
  C:\Windows\System\aoIfEsg.exe
  2⤵
  PID:3956
- C:\Windows\System\SHulVGM.exe
  C:\Windows\System\SHulVGM.exe
  2⤵
  PID:4020
- C:\Windows\System\bbGLkOU.exe
  C:\Windows\System\bbGLkOU.exe
  2⤵
  PID:2724
- C:\Windows\System\QTJsfHV.exe
  C:\Windows\System\QTJsfHV.exe
  2⤵
  PID:1860
- C:\Windows\System\mNzVygy.exe
  C:\Windows\System\mNzVygy.exe
  2⤵
  PID:3184
- C:\Windows\System\GGBGhFP.exe
  C:\Windows\System\GGBGhFP.exe
  2⤵
  PID:3412
- C:\Windows\System\ULcBApk.exe
  C:\Windows\System\ULcBApk.exe
  2⤵
  PID:4100
- C:\Windows\System\lleODCq.exe
  C:\Windows\System\lleODCq.exe
  2⤵
  PID:4116
- C:\Windows\System\ASUfOaX.exe
  C:\Windows\System\ASUfOaX.exe
  2⤵
  PID:4132
- C:\Windows\System\WJmVute.exe
  C:\Windows\System\WJmVute.exe
  2⤵
  PID:4148
- C:\Windows\System\ETpNyJM.exe
  C:\Windows\System\ETpNyJM.exe
  2⤵
  PID:4164
- C:\Windows\System\WwItgiY.exe
  C:\Windows\System\WwItgiY.exe
  2⤵
  PID:4180
- C:\Windows\System\LxdHGqI.exe
  C:\Windows\System\LxdHGqI.exe
  2⤵
  PID:4196
- C:\Windows\System\cEiUGam.exe
  C:\Windows\System\cEiUGam.exe
  2⤵
  PID:4212
- C:\Windows\System\ghmgztp.exe
  C:\Windows\System\ghmgztp.exe
  2⤵
  PID:4228
- C:\Windows\System\MzRldel.exe
  C:\Windows\System\MzRldel.exe
  2⤵
  PID:4244
- C:\Windows\System\gLJHdpj.exe
  C:\Windows\System\gLJHdpj.exe
  2⤵
  PID:4260
- C:\Windows\System\SstJgcC.exe
  C:\Windows\System\SstJgcC.exe
  2⤵
  PID:4276
- C:\Windows\System\VTxrJpi.exe
  C:\Windows\System\VTxrJpi.exe
  2⤵
  PID:4292
- C:\Windows\System\ysrWXui.exe
  C:\Windows\System\ysrWXui.exe
  2⤵
  PID:4308
- C:\Windows\System\RFnrlwD.exe
  C:\Windows\System\RFnrlwD.exe
  2⤵
  PID:4324
- C:\Windows\System\UDMSITS.exe
  C:\Windows\System\UDMSITS.exe
  2⤵
  PID:4340
- C:\Windows\System\OIPSRUu.exe
  C:\Windows\System\OIPSRUu.exe
  2⤵
  PID:4356
- C:\Windows\System\TTsQTjA.exe
  C:\Windows\System\TTsQTjA.exe
  2⤵
  PID:4372
- C:\Windows\System\lMBBSkE.exe
  C:\Windows\System\lMBBSkE.exe
  2⤵
  PID:4388
- C:\Windows\System\PflZpXK.exe
  C:\Windows\System\PflZpXK.exe
  2⤵
  PID:4404
- C:\Windows\System\jfLyHaE.exe
  C:\Windows\System\jfLyHaE.exe
  2⤵
  PID:4420
- C:\Windows\System\xqWBUet.exe
  C:\Windows\System\xqWBUet.exe
  2⤵
  PID:4436
- C:\Windows\System\YDjyrDo.exe
  C:\Windows\System\YDjyrDo.exe
  2⤵
  PID:4452
- C:\Windows\System\zojNZbN.exe
  C:\Windows\System\zojNZbN.exe
  2⤵
  PID:4468
- C:\Windows\System\ISuRROq.exe
  C:\Windows\System\ISuRROq.exe
  2⤵
  PID:4484
- C:\Windows\System\PwBngcG.exe
  C:\Windows\System\PwBngcG.exe
  2⤵
  PID:4500
- C:\Windows\System\gezxQVE.exe
  C:\Windows\System\gezxQVE.exe
  2⤵
  PID:4516
- C:\Windows\System\OohDsqf.exe
  C:\Windows\System\OohDsqf.exe
  2⤵
  PID:4532
- C:\Windows\System\MtYxaIV.exe
  C:\Windows\System\MtYxaIV.exe
  2⤵
  PID:4548
- C:\Windows\System\JisxhcV.exe
  C:\Windows\System\JisxhcV.exe
  2⤵
  PID:4564
- C:\Windows\System\QBzWtRm.exe
  C:\Windows\System\QBzWtRm.exe
  2⤵
  PID:4580
- C:\Windows\System\IGuFNRY.exe
  C:\Windows\System\IGuFNRY.exe
  2⤵
  PID:4596
- C:\Windows\System\WjqWIsW.exe
  C:\Windows\System\WjqWIsW.exe
  2⤵
  PID:4616
- C:\Windows\System\PzQIblG.exe
  C:\Windows\System\PzQIblG.exe
  2⤵
  PID:4632
- C:\Windows\System\QHHGPbd.exe
  C:\Windows\System\QHHGPbd.exe
  2⤵
  PID:4648
- C:\Windows\System\DVTQkxp.exe
  C:\Windows\System\DVTQkxp.exe
  2⤵
  PID:4664
- C:\Windows\System\pmeKGWz.exe
  C:\Windows\System\pmeKGWz.exe
  2⤵
  PID:4680
- C:\Windows\System\QobzLEd.exe
  C:\Windows\System\QobzLEd.exe
  2⤵
  PID:4696
- C:\Windows\System\ujgJPMp.exe
  C:\Windows\System\ujgJPMp.exe
  2⤵
  PID:4712
- C:\Windows\System\dRgPjYH.exe
  C:\Windows\System\dRgPjYH.exe
  2⤵
  PID:4728
- C:\Windows\System\UBTZNza.exe
  C:\Windows\System\UBTZNza.exe
  2⤵
  PID:4744
- C:\Windows\System\bEqdtaA.exe
  C:\Windows\System\bEqdtaA.exe
  2⤵
  PID:4760
- C:\Windows\System\DxuHKAP.exe
  C:\Windows\System\DxuHKAP.exe
  2⤵
  PID:4776
- C:\Windows\System\GBbVwEL.exe
  C:\Windows\System\GBbVwEL.exe
  2⤵
  PID:4792
- C:\Windows\System\eiRpDvv.exe
  C:\Windows\System\eiRpDvv.exe
  2⤵
  PID:4808
- C:\Windows\System\FUIPiMu.exe
  C:\Windows\System\FUIPiMu.exe
  2⤵
  PID:4824
- C:\Windows\System\eTGIItY.exe
  C:\Windows\System\eTGIItY.exe
  2⤵
  PID:4840
- C:\Windows\System\WzEhFDo.exe
  C:\Windows\System\WzEhFDo.exe
  2⤵
  PID:4856
- C:\Windows\System\FnKKOpq.exe
  C:\Windows\System\FnKKOpq.exe
  2⤵
  PID:4872
- C:\Windows\System\xrYHvoC.exe
  C:\Windows\System\xrYHvoC.exe
  2⤵
  PID:4888
- C:\Windows\System\auZRGam.exe
  C:\Windows\System\auZRGam.exe
  2⤵
  PID:4904
- C:\Windows\System\gdlrKvj.exe
  C:\Windows\System\gdlrKvj.exe
  2⤵
  PID:4920
- C:\Windows\System\KDLANXs.exe
  C:\Windows\System\KDLANXs.exe
  2⤵
  PID:4936
- C:\Windows\System\TohDMWY.exe
  C:\Windows\System\TohDMWY.exe
  2⤵
  PID:4952
- C:\Windows\System\oCrTEFn.exe
  C:\Windows\System\oCrTEFn.exe
  2⤵
  PID:4968
- C:\Windows\System\CJOvFIt.exe
  C:\Windows\System\CJOvFIt.exe
  2⤵
  PID:4984
- C:\Windows\System\BzDAlsy.exe
  C:\Windows\System\BzDAlsy.exe
  2⤵
  PID:5000
- C:\Windows\System\DUGadIm.exe
  C:\Windows\System\DUGadIm.exe
  2⤵
  PID:5016
- C:\Windows\System\uihoFSz.exe
  C:\Windows\System\uihoFSz.exe
  2⤵
  PID:5032
- C:\Windows\System\kEtfwkO.exe
  C:\Windows\System\kEtfwkO.exe
  2⤵
  PID:5048
- C:\Windows\System\ZtORtUD.exe
  C:\Windows\System\ZtORtUD.exe
  2⤵
  PID:5064
- C:\Windows\System\nVECscO.exe
  C:\Windows\System\nVECscO.exe
  2⤵
  PID:5080
- C:\Windows\System\rkkgbSQ.exe
  C:\Windows\System\rkkgbSQ.exe
  2⤵
  PID:5096
- C:\Windows\System\GePfrnB.exe
  C:\Windows\System\GePfrnB.exe
  2⤵
  PID:5112
- C:\Windows\System\jKZffMR.exe
  C:\Windows\System\jKZffMR.exe
  2⤵
  PID:3796
- C:\Windows\System\qtYZJMt.exe
  C:\Windows\System\qtYZJMt.exe
  2⤵
  PID:2544
- C:\Windows\System\LNQRmjB.exe
  C:\Windows\System\LNQRmjB.exe
  2⤵
  PID:3156
- C:\Windows\System\HbdoEdR.exe
  C:\Windows\System\HbdoEdR.exe
  2⤵
  PID:4124
- C:\Windows\System\PsmWcAO.exe
  C:\Windows\System\PsmWcAO.exe
  2⤵
  PID:4188
- C:\Windows\System\IiUpcaH.exe
  C:\Windows\System\IiUpcaH.exe
  2⤵
  PID:4252
- C:\Windows\System\mfAjYJS.exe
  C:\Windows\System\mfAjYJS.exe
  2⤵
  PID:4316
- C:\Windows\System\aJyvikh.exe
  C:\Windows\System\aJyvikh.exe
  2⤵
  PID:4380
- C:\Windows\System\vMlcjbf.exe
  C:\Windows\System\vMlcjbf.exe
  2⤵
  PID:4416
- C:\Windows\System\SCuQwCP.exe
  C:\Windows\System\SCuQwCP.exe
  2⤵
  PID:4476
- C:\Windows\System\UeYeVSE.exe
  C:\Windows\System\UeYeVSE.exe
  2⤵
  PID:4544
- C:\Windows\System\bTtUBDp.exe
  C:\Windows\System\bTtUBDp.exe
  2⤵
  PID:4640
- C:\Windows\System\ZBWvgUG.exe
  C:\Windows\System\ZBWvgUG.exe
  2⤵
  PID:4672
- C:\Windows\System\XUQRWEt.exe
  C:\Windows\System\XUQRWEt.exe
  2⤵
  PID:2236
- C:\Windows\System\fyoaHVh.exe
  C:\Windows\System\fyoaHVh.exe
  2⤵
  PID:2256
- C:\Windows\System\MRqoGHd.exe
  C:\Windows\System\MRqoGHd.exe
  2⤵
  PID:2780
- C:\Windows\System\EmjwwhO.exe
  C:\Windows\System\EmjwwhO.exe
  2⤵
  PID:2944
- C:\Windows\System\kdkbUiP.exe
  C:\Windows\System\kdkbUiP.exe
  2⤵
  PID:4868
- C:\Windows\System\CmJWjgY.exe
  C:\Windows\System\CmJWjgY.exe
  2⤵
  PID:2508
- C:\Windows\System\FfEHnGH.exe
  C:\Windows\System\FfEHnGH.exe
  2⤵
  PID:2500
- C:\Windows\System\IsZvvcY.exe
  C:\Windows\System\IsZvvcY.exe
  2⤵
  PID:4964
- C:\Windows\System\iHfTfID.exe
  C:\Windows\System\iHfTfID.exe
  2⤵
  PID:5028
- C:\Windows\System\ztRhJNi.exe
  C:\Windows\System\ztRhJNi.exe
  2⤵
  PID:5092
- C:\Windows\System\YGKMJNs.exe
  C:\Windows\System\YGKMJNs.exe
  2⤵
  PID:2632
- C:\Windows\System\TBQThXD.exe
  C:\Windows\System\TBQThXD.exe
  2⤵
  PID:4156
- C:\Windows\System\JJzzcmY.exe
  C:\Windows\System\JJzzcmY.exe
  2⤵
  PID:4284
- C:\Windows\System\oYuKhHE.exe
  C:\Windows\System\oYuKhHE.exe
  2⤵
  PID:2856
- C:\Windows\System\CPgkaAa.exe
  C:\Windows\System\CPgkaAa.exe
  2⤵
  PID:4412
- C:\Windows\System\fEMtJAx.exe
  C:\Windows\System\fEMtJAx.exe
  2⤵
  PID:2128
- C:\Windows\System\iysCIdH.exe
  C:\Windows\System\iysCIdH.exe
  2⤵
  PID:4740
- C:\Windows\System\ldOffUH.exe
  C:\Windows\System\ldOffUH.exe
  2⤵
  PID:1544
- C:\Windows\System\uKpjzkM.exe
  C:\Windows\System\uKpjzkM.exe
  2⤵
  PID:596
- C:\Windows\System\VzpUcIC.exe
  C:\Windows\System\VzpUcIC.exe
  2⤵
  PID:1488
- C:\Windows\System\dkpRfeS.exe
  C:\Windows\System\dkpRfeS.exe
  2⤵
  PID:1536
- C:\Windows\System\krSbsPY.exe
  C:\Windows\System\krSbsPY.exe
  2⤵
  PID:1204
- C:\Windows\System\IookGtQ.exe
  C:\Windows\System\IookGtQ.exe
  2⤵
  PID:4832
- C:\Windows\System\euckglG.exe
  C:\Windows\System\euckglG.exe
  2⤵
  PID:5136
- C:\Windows\System\BOpcziv.exe
  C:\Windows\System\BOpcziv.exe
  2⤵
  PID:5152
- C:\Windows\System\mfvNzSI.exe
  C:\Windows\System\mfvNzSI.exe
  2⤵
  PID:5168
- C:\Windows\System\UjYYypS.exe
  C:\Windows\System\UjYYypS.exe
  2⤵
  PID:5184
- C:\Windows\System\xeqsEcd.exe
  C:\Windows\System\xeqsEcd.exe
  2⤵
  PID:5200
- C:\Windows\System\ISJPrjw.exe
  C:\Windows\System\ISJPrjw.exe
  2⤵
  PID:5216
- C:\Windows\System\tPrXCtu.exe
  C:\Windows\System\tPrXCtu.exe
  2⤵
  PID:5236
- C:\Windows\System\oLTjozP.exe
  C:\Windows\System\oLTjozP.exe
  2⤵
  PID:5252
- C:\Windows\System\axpPItL.exe
  C:\Windows\System\axpPItL.exe
  2⤵
  PID:5268
- C:\Windows\System\UjtMAme.exe
  C:\Windows\System\UjtMAme.exe
  2⤵
  PID:5284
- C:\Windows\System\BstHTUJ.exe
  C:\Windows\System\BstHTUJ.exe
  2⤵
  PID:5300
- C:\Windows\System\FBfLQzV.exe
  C:\Windows\System\FBfLQzV.exe
  2⤵
  PID:5316
- C:\Windows\System\SKrmind.exe
  C:\Windows\System\SKrmind.exe
  2⤵
  PID:5332
- C:\Windows\System\HKIgThR.exe
  C:\Windows\System\HKIgThR.exe
  2⤵
  PID:5348
- C:\Windows\System\besfOcm.exe
  C:\Windows\System\besfOcm.exe
  2⤵
  PID:5364
- C:\Windows\System\FdnqBny.exe
  C:\Windows\System\FdnqBny.exe
  2⤵
  PID:5380
- C:\Windows\System\qPfhNOG.exe
  C:\Windows\System\qPfhNOG.exe
  2⤵
  PID:5396
- C:\Windows\System\ACpKbGZ.exe
  C:\Windows\System\ACpKbGZ.exe
  2⤵
  PID:5412
- C:\Windows\System\QHJEKGe.exe
  C:\Windows\System\QHJEKGe.exe
  2⤵
  PID:5428
- C:\Windows\System\RdcMMpE.exe
  C:\Windows\System\RdcMMpE.exe
  2⤵
  PID:5444
- C:\Windows\System\aoNxUUY.exe
  C:\Windows\System\aoNxUUY.exe
  2⤵
  PID:5460
- C:\Windows\System\EtYNcKz.exe
  C:\Windows\System\EtYNcKz.exe
  2⤵
  PID:5476
- C:\Windows\System\lLRMBkR.exe
  C:\Windows\System\lLRMBkR.exe
  2⤵
  PID:5492
- C:\Windows\System\aSNPcya.exe
  C:\Windows\System\aSNPcya.exe
  2⤵
  PID:5508
- C:\Windows\System\ReqPuOK.exe
  C:\Windows\System\ReqPuOK.exe
  2⤵
  PID:5524
- C:\Windows\System\eJwFSpu.exe
  C:\Windows\System\eJwFSpu.exe
  2⤵
  PID:5540
- C:\Windows\System\VANGmrs.exe
  C:\Windows\System\VANGmrs.exe
  2⤵
  PID:5556
- C:\Windows\System\EJkgceR.exe
  C:\Windows\System\EJkgceR.exe
  2⤵
  PID:5572
- C:\Windows\System\qWXGLux.exe
  C:\Windows\System\qWXGLux.exe
  2⤵
  PID:5588
- C:\Windows\System\lggwHPJ.exe
  C:\Windows\System\lggwHPJ.exe
  2⤵
  PID:5604
- C:\Windows\System\MquvxKk.exe
  C:\Windows\System\MquvxKk.exe
  2⤵
  PID:5620
- C:\Windows\System\juBhjPg.exe
  C:\Windows\System\juBhjPg.exe
  2⤵
  PID:5636
- C:\Windows\System\bPugxpM.exe
  C:\Windows\System\bPugxpM.exe
  2⤵
  PID:5652
- C:\Windows\System\FxwIteN.exe
  C:\Windows\System\FxwIteN.exe
  2⤵
  PID:5668
- C:\Windows\System\UVfaArT.exe
  C:\Windows\System\UVfaArT.exe
  2⤵
  PID:5684
- C:\Windows\System\GQtvOTU.exe
  C:\Windows\System\GQtvOTU.exe
  2⤵
  PID:5700
- C:\Windows\System\aQNSYgn.exe
  C:\Windows\System\aQNSYgn.exe
  2⤵
  PID:5716
- C:\Windows\System\BsLiCbx.exe
  C:\Windows\System\BsLiCbx.exe
  2⤵
  PID:5732
- C:\Windows\System\hTOCRvp.exe
  C:\Windows\System\hTOCRvp.exe
  2⤵
  PID:5748
- C:\Windows\System\qbOtYaj.exe
  C:\Windows\System\qbOtYaj.exe
  2⤵
  PID:5764
- C:\Windows\System\mmOfPRT.exe
  C:\Windows\System\mmOfPRT.exe
  2⤵
  PID:5780
- C:\Windows\System\ghFpONO.exe
  C:\Windows\System\ghFpONO.exe
  2⤵
  PID:5796
- C:\Windows\System\aTRDHqV.exe
  C:\Windows\System\aTRDHqV.exe
  2⤵
  PID:5812
- C:\Windows\System\GPzXxjs.exe
  C:\Windows\System\GPzXxjs.exe
  2⤵
  PID:5828
- C:\Windows\System\hmLVAxZ.exe
  C:\Windows\System\hmLVAxZ.exe
  2⤵
  PID:5844
- C:\Windows\System\OKjxORW.exe
  C:\Windows\System\OKjxORW.exe
  2⤵
  PID:5860
- C:\Windows\System\pkbCdBo.exe
  C:\Windows\System\pkbCdBo.exe
  2⤵
  PID:5876
- C:\Windows\System\eHockYt.exe
  C:\Windows\System\eHockYt.exe
  2⤵
  PID:5892
- C:\Windows\System\rQXLwwc.exe
  C:\Windows\System\rQXLwwc.exe
  2⤵
  PID:5908
- C:\Windows\System\eJuMEGc.exe
  C:\Windows\System\eJuMEGc.exe
  2⤵
  PID:5924
- C:\Windows\System\VIwGVCW.exe
  C:\Windows\System\VIwGVCW.exe
  2⤵
  PID:5940
- C:\Windows\System\MQzLFNC.exe
  C:\Windows\System\MQzLFNC.exe
  2⤵
  PID:5956
- C:\Windows\System\GtDfzWr.exe
  C:\Windows\System\GtDfzWr.exe
  2⤵
  PID:5972
- C:\Windows\System\Jlfyfsv.exe
  C:\Windows\System\Jlfyfsv.exe
  2⤵
  PID:5988
- C:\Windows\System\FcHftqy.exe
  C:\Windows\System\FcHftqy.exe
  2⤵
  PID:6004
- C:\Windows\System\msMkmGk.exe
  C:\Windows\System\msMkmGk.exe
  2⤵
  PID:6020
- C:\Windows\System\rjHxTxx.exe
  C:\Windows\System\rjHxTxx.exe
  2⤵
  PID:6036
- C:\Windows\System\WkYBdVU.exe
  C:\Windows\System\WkYBdVU.exe
  2⤵
  PID:6052
- C:\Windows\System\OiNlHiG.exe
  C:\Windows\System\OiNlHiG.exe
  2⤵
  PID:6068
- C:\Windows\System\jEjQYUi.exe
  C:\Windows\System\jEjQYUi.exe
  2⤵
  PID:6084
- C:\Windows\System\wUVMZAq.exe
  C:\Windows\System\wUVMZAq.exe
  2⤵
  PID:6100
- C:\Windows\System\ANxhyHq.exe
  C:\Windows\System\ANxhyHq.exe
  2⤵
  PID:6116
- C:\Windows\System\GOPXJQD.exe
  C:\Windows\System\GOPXJQD.exe
  2⤵
  PID:6132
- C:\Windows\System\IXaOCBx.exe
  C:\Windows\System\IXaOCBx.exe
  2⤵
  PID:5132
- C:\Windows\System\xFRWhWn.exe
  C:\Windows\System\xFRWhWn.exe
  2⤵
  PID:5164
- C:\Windows\System\vqIYpfx.exe
  C:\Windows\System\vqIYpfx.exe
  2⤵
  PID:2420
- C:\Windows\System\yQXmCMC.exe
  C:\Windows\System\yQXmCMC.exe
  2⤵
  PID:5228
- C:\Windows\System\BceGUvC.exe
  C:\Windows\System\BceGUvC.exe
  2⤵
  PID:676
- C:\Windows\System\yECJsxT.exe
  C:\Windows\System\yECJsxT.exe
  2⤵
  PID:5356
- C:\Windows\System\SPzltEl.exe
  C:\Windows\System\SPzltEl.exe
  2⤵
  PID:5420
- C:\Windows\System\pcqXBoZ.exe
  C:\Windows\System\pcqXBoZ.exe
  2⤵
  PID:5452
- C:\Windows\System\GJhLKVu.exe
  C:\Windows\System\GJhLKVu.exe
  2⤵
  PID:5516
- C:\Windows\System\MHtRsEg.exe
  C:\Windows\System\MHtRsEg.exe
  2⤵
  PID:5580
- C:\Windows\System\uzvzwbR.exe
  C:\Windows\System\uzvzwbR.exe
  2⤵
  PID:5612
- C:\Windows\System\DrsNESV.exe
  C:\Windows\System\DrsNESV.exe
  2⤵
  PID:5676
- C:\Windows\System\KaJOWcS.exe
  C:\Windows\System\KaJOWcS.exe
  2⤵
  PID:5740
- C:\Windows\System\setPjxP.exe
  C:\Windows\System\setPjxP.exe
  2⤵
  PID:5804
- C:\Windows\System\mVmYSfg.exe
  C:\Windows\System\mVmYSfg.exe
  2⤵
  PID:5868
- C:\Windows\System\Sgmudbz.exe
  C:\Windows\System\Sgmudbz.exe
  2⤵
  PID:5932
- C:\Windows\System\OOtgrnI.exe
  C:\Windows\System\OOtgrnI.exe
  2⤵
  PID:5996
- C:\Windows\System\rHdGWWh.exe
  C:\Windows\System\rHdGWWh.exe
  2⤵
  PID:6060
- C:\Windows\System\MZOwFVW.exe
  C:\Windows\System\MZOwFVW.exe
  2⤵
  PID:6124
- C:\Windows\System\AgMUwDo.exe
  C:\Windows\System\AgMUwDo.exe
  2⤵
  PID:5196
- C:\Windows\System\ZrthhnP.exe
  C:\Windows\System\ZrthhnP.exe
  2⤵
  PID:1084
- C:\Windows\System\PLRAMYu.exe
  C:\Windows\System\PLRAMYu.exe
  2⤵
  PID:2912
- C:\Windows\System\rNSZjEc.exe
  C:\Windows\System\rNSZjEc.exe
  2⤵
  PID:6156
- C:\Windows\System\hvrlmQZ.exe
  C:\Windows\System\hvrlmQZ.exe
  2⤵
  PID:6172
- C:\Windows\System\gRJqifA.exe
  C:\Windows\System\gRJqifA.exe
  2⤵
  PID:6188
- C:\Windows\System\umUhKRr.exe
  C:\Windows\System\umUhKRr.exe
  2⤵
  PID:6204
- C:\Windows\System\YtJrGxE.exe
  C:\Windows\System\YtJrGxE.exe
  2⤵
  PID:6220
- C:\Windows\System\aeLBWjm.exe
  C:\Windows\System\aeLBWjm.exe
  2⤵
  PID:6240
- C:\Windows\System\LLnmlvc.exe
  C:\Windows\System\LLnmlvc.exe
  2⤵
  PID:6256
- C:\Windows\System\MExXenM.exe
  C:\Windows\System\MExXenM.exe
  2⤵
  PID:6272
- C:\Windows\System\muLqoLi.exe
  C:\Windows\System\muLqoLi.exe
  2⤵
  PID:6288
- C:\Windows\System\LPiWABQ.exe
  C:\Windows\System\LPiWABQ.exe
  2⤵
  PID:6304
- C:\Windows\System\GvxonhQ.exe
  C:\Windows\System\GvxonhQ.exe
  2⤵
  PID:6320
- C:\Windows\System\ZaAeuef.exe
  C:\Windows\System\ZaAeuef.exe
  2⤵
  PID:6336
- C:\Windows\System\yJtVwdS.exe
  C:\Windows\System\yJtVwdS.exe
  2⤵
  PID:6352
- C:\Windows\System\aYXSNgS.exe
  C:\Windows\System\aYXSNgS.exe
  2⤵
  PID:6368
- C:\Windows\System\UrCGuow.exe
  C:\Windows\System\UrCGuow.exe
  2⤵
  PID:6384
- C:\Windows\System\YgZOTrG.exe
  C:\Windows\System\YgZOTrG.exe
  2⤵
  PID:6400
- C:\Windows\System\epypcdw.exe
  C:\Windows\System\epypcdw.exe
  2⤵
  PID:6416
- C:\Windows\System\rsmWMCb.exe
  C:\Windows\System\rsmWMCb.exe
  2⤵
  PID:6432
- C:\Windows\System\CNLgVnX.exe
  C:\Windows\System\CNLgVnX.exe
  2⤵
  PID:6448
- C:\Windows\System\daZDFXo.exe
  C:\Windows\System\daZDFXo.exe
  2⤵
  PID:6464
- C:\Windows\System\QsLTFSO.exe
  C:\Windows\System\QsLTFSO.exe
  2⤵
  PID:6480
- C:\Windows\System\fefyRpB.exe
  C:\Windows\System\fefyRpB.exe
  2⤵
  PID:6496
- C:\Windows\System\pQWZHhQ.exe
  C:\Windows\System\pQWZHhQ.exe
  2⤵
  PID:6512
- C:\Windows\System\TyHIuMW.exe
  C:\Windows\System\TyHIuMW.exe
  2⤵
  PID:6528
- C:\Windows\System\uexkjSe.exe
  C:\Windows\System\uexkjSe.exe
  2⤵
  PID:6544
- C:\Windows\System\JEBvqvR.exe
  C:\Windows\System\JEBvqvR.exe
  2⤵
  PID:6560
- C:\Windows\System\KZNOmJT.exe
  C:\Windows\System\KZNOmJT.exe
  2⤵
  PID:6580
- C:\Windows\System\HQjsskd.exe
  C:\Windows\System\HQjsskd.exe
  2⤵
  PID:6596
- C:\Windows\System\WxheGrb.exe
  C:\Windows\System\WxheGrb.exe
  2⤵
  PID:6772
- C:\Windows\System\qTPRvBd.exe
  C:\Windows\System\qTPRvBd.exe
  2⤵
  PID:6300
- C:\Windows\System\VQjadhG.exe
  C:\Windows\System\VQjadhG.exe
  2⤵
  PID:6588
- C:\Windows\System\xOqlCxl.exe
  C:\Windows\System\xOqlCxl.exe
  2⤵
  PID:6812
- C:\Windows\System\uphSmHa.exe
  C:\Windows\System\uphSmHa.exe
  2⤵
  PID:6856
- C:\Windows\System\IvrkOan.exe
  C:\Windows\System\IvrkOan.exe
  2⤵
  PID:6936
- C:\Windows\System\lBlZjqM.exe
  C:\Windows\System\lBlZjqM.exe
  2⤵
  PID:7032
- C:\Windows\System\hIpBdvF.exe
  C:\Windows\System\hIpBdvF.exe
  2⤵
  PID:7088
- C:\Windows\System\PHZmMYU.exe
  C:\Windows\System\PHZmMYU.exe
  2⤵
  PID:7128
- C:\Windows\System\DItaMII.exe
  C:\Windows\System\DItaMII.exe
  2⤵
  PID:1904
- C:\Windows\System\BiwKNBc.exe
  C:\Windows\System\BiwKNBc.exe
  2⤵
  PID:3888
- C:\Windows\System\CSajVPQ.exe
  C:\Windows\System\CSajVPQ.exe
  2⤵
  PID:4176
- C:\Windows\System\KNjWFuI.exe
  C:\Windows\System\KNjWFuI.exe
  2⤵
  PID:4272
- C:\Windows\System\GsnEyKL.exe
  C:\Windows\System\GsnEyKL.exe
  2⤵
  PID:4400
- C:\Windows\System\XMleDtl.exe
  C:\Windows\System\XMleDtl.exe
  2⤵
  PID:4492
- C:\Windows\System\eLMEiwE.exe
  C:\Windows\System\eLMEiwE.exe
  2⤵
  PID:4556
- C:\Windows\System\QTDCVMh.exe
  C:\Windows\System\QTDCVMh.exe
  2⤵
  PID:4656
- C:\Windows\System\OGPRyAP.exe
  C:\Windows\System\OGPRyAP.exe
  2⤵
  PID:4752
- C:\Windows\System\rcPztOz.exe
  C:\Windows\System\rcPztOz.exe
  2⤵
  PID:4820
- C:\Windows\System\KcesZUL.exe
  C:\Windows\System\KcesZUL.exe
  2⤵
  PID:2668
- C:\Windows\System\mMbkfHH.exe
  C:\Windows\System\mMbkfHH.exe
  2⤵
  PID:2936
- C:\Windows\System\DkHignN.exe
  C:\Windows\System\DkHignN.exe
  2⤵
  PID:1400
- C:\Windows\System\nVKBNGo.exe
  C:\Windows\System\nVKBNGo.exe
  2⤵
  PID:1748
- C:\Windows\System\wtHTMwu.exe
  C:\Windows\System\wtHTMwu.exe
  2⤵
  PID:4916
- C:\Windows\System\VoddBru.exe
  C:\Windows\System\VoddBru.exe
  2⤵
  PID:3172
- C:\Windows\System\YqNhGrw.exe
  C:\Windows\System\YqNhGrw.exe
  2⤵
  PID:3332
- C:\Windows\System\gDRsDzh.exe
  C:\Windows\System\gDRsDzh.exe
  2⤵
  PID:3492
- C:\Windows\System\tXMrZZk.exe
  C:\Windows\System\tXMrZZk.exe
  2⤵
  PID:4944
- C:\Windows\System\POPhAKw.exe
  C:\Windows\System\POPhAKw.exe
  2⤵
  PID:3748
- C:\Windows\System\febMfvo.exe
  C:\Windows\System\febMfvo.exe
  2⤵
  PID:3908
- C:\Windows\System\yojDeqV.exe
  C:\Windows\System\yojDeqV.exe
  2⤵
  PID:4068
- C:\Windows\System\ueGXpzM.exe
  C:\Windows\System\ueGXpzM.exe
  2⤵
  PID:3120
- C:\Windows\System\EdzDsDo.exe
  C:\Windows\System\EdzDsDo.exe
  2⤵
  PID:3760
- C:\Windows\System\PuYqBiI.exe
  C:\Windows\System\PuYqBiI.exe
  2⤵
  PID:5072
- C:\Windows\System\DKIezDP.exe
  C:\Windows\System\DKIezDP.exe
  2⤵
  PID:3952
- C:\Windows\System\fmsKKup.exe
  C:\Windows\System\fmsKKup.exe
  2⤵
  PID:4224
- C:\Windows\System\rxSoeIB.exe
  C:\Windows\System\rxSoeIB.exe
  2⤵
  PID:4576
- C:\Windows\System\TWpmZZl.exe
  C:\Windows\System\TWpmZZl.exe
  2⤵
  PID:4772
- C:\Windows\System\xxiiuzS.exe
  C:\Windows\System\xxiiuzS.exe
  2⤵
  PID:1604
- C:\Windows\System\FhljGms.exe
  C:\Windows\System\FhljGms.exe
  2⤵
  PID:3668
- C:\Windows\System\imKTMkN.exe
  C:\Windows\System\imKTMkN.exe
  2⤵
  PID:2384
- C:\Windows\System\illnQyY.exe
  C:\Windows\System\illnQyY.exe
  2⤵
  PID:2112
- C:\Windows\System\UYdbGFJ.exe
  C:\Windows\System\UYdbGFJ.exe
  2⤵
  PID:564
- C:\Windows\System\yykrKzl.exe
  C:\Windows\System\yykrKzl.exe
  2⤵
  PID:5176
- C:\Windows\System\wYMJQpD.exe
  C:\Windows\System\wYMJQpD.exe
  2⤵
  PID:5212
- C:\Windows\System\DmSwLmJ.exe
  C:\Windows\System\DmSwLmJ.exe
  2⤵
  PID:5308
- C:\Windows\System\yIaNSVc.exe
  C:\Windows\System\yIaNSVc.exe
  2⤵
  PID:5376
- C:\Windows\System\hMlwLUS.exe
  C:\Windows\System\hMlwLUS.exe
  2⤵
  PID:5468
- C:\Windows\System\zSSskHC.exe
  C:\Windows\System\zSSskHC.exe
  2⤵
  PID:5536
- C:\Windows\System\TBMlYAc.exe
  C:\Windows\System\TBMlYAc.exe
  2⤵
  PID:5628
- C:\Windows\System\nRfhtdt.exe
  C:\Windows\System\nRfhtdt.exe
  2⤵
  PID:5696
- C:\Windows\System\HauQDyX.exe
  C:\Windows\System\HauQDyX.exe
  2⤵
  PID:5788
- C:\Windows\System\FYXjNxo.exe
  C:\Windows\System\FYXjNxo.exe
  2⤵
  PID:5856
- C:\Windows\System\zgJFziR.exe
  C:\Windows\System\zgJFziR.exe
  2⤵
  PID:5952
- C:\Windows\System\hDKNTwC.exe
  C:\Windows\System\hDKNTwC.exe
  2⤵
  PID:6016
- C:\Windows\System\pFHfHJi.exe
  C:\Windows\System\pFHfHJi.exe
  2⤵
  PID:6112
- C:\Windows\System\wsdQhVJ.exe
  C:\Windows\System\wsdQhVJ.exe
  2⤵
  PID:1320
- C:\Windows\System\BGNDQsr.exe
  C:\Windows\System\BGNDQsr.exe
  2⤵
  PID:5388
- C:\Windows\System\qMrosQN.exe
  C:\Windows\System\qMrosQN.exe
  2⤵
  PID:5712
- C:\Windows\System\PIcBxue.exe
  C:\Windows\System\PIcBxue.exe
  2⤵
  PID:6092
- C:\Windows\System\glZvDbD.exe
  C:\Windows\System\glZvDbD.exe
  2⤵
  PID:6152
- C:\Windows\System\akFPSan.exe
  C:\Windows\System\akFPSan.exe
  2⤵
  PID:6248
- C:\Windows\System\mcWDGyj.exe
  C:\Windows\System\mcWDGyj.exe
  2⤵
  PID:6316
- C:\Windows\System\BblFjeW.exe
  C:\Windows\System\BblFjeW.exe
  2⤵
  PID:6408
- C:\Windows\System\KJBrmGR.exe
  C:\Windows\System\KJBrmGR.exe
  2⤵
  PID:6476
- C:\Windows\System\nsLWiQm.exe
  C:\Windows\System\nsLWiQm.exe
  2⤵
  PID:6568
- C:\Windows\System\PEGVYbi.exe
  C:\Windows\System\PEGVYbi.exe
  2⤵
  PID:6612
- C:\Windows\System\noGiTbq.exe
  C:\Windows\System\noGiTbq.exe
  2⤵
  PID:6632
- C:\Windows\System\RsPdwoy.exe
  C:\Windows\System\RsPdwoy.exe
  2⤵
  PID:6652
- C:\Windows\System\dCNgZcK.exe
  C:\Windows\System\dCNgZcK.exe
  2⤵
  PID:6672
- C:\Windows\System\gsOpliy.exe
  C:\Windows\System\gsOpliy.exe
  2⤵
  PID:6692
- C:\Windows\System\lZJyTWD.exe
  C:\Windows\System\lZJyTWD.exe
  2⤵
  PID:6708
- C:\Windows\System\bLfpdnm.exe
  C:\Windows\System\bLfpdnm.exe
  2⤵
  PID:6732
- C:\Windows\System\gwqIaAR.exe
  C:\Windows\System\gwqIaAR.exe
  2⤵
  PID:6752
- C:\Windows\System\guHzpPH.exe
  C:\Windows\System\guHzpPH.exe
  2⤵
  PID:324
- C:\Windows\System\clfzaNQ.exe
  C:\Windows\System\clfzaNQ.exe
  2⤵
  PID:828
- C:\Windows\System\kHMvLSN.exe
  C:\Windows\System\kHMvLSN.exe
  2⤵
  PID:3064
- C:\Windows\System\Ptusrxw.exe
  C:\Windows\System\Ptusrxw.exe
  2⤵
  PID:2612
- C:\Windows\System\eXAcuzw.exe
  C:\Windows\System\eXAcuzw.exe
  2⤵
  PID:1512
- C:\Windows\System\NdvKKzl.exe
  C:\Windows\System\NdvKKzl.exe
  2⤵
  PID:2108
- C:\Windows\System\YFDqKvw.exe
  C:\Windows\System\YFDqKvw.exe
  2⤵
  PID:3136
- C:\Windows\System\dhEzrsS.exe
  C:\Windows\System\dhEzrsS.exe
  2⤵
  PID:3296
- C:\Windows\System\LweAyGs.exe
  C:\Windows\System\LweAyGs.exe
  2⤵
  PID:3456
- C:\Windows\System\isApRzu.exe
  C:\Windows\System\isApRzu.exe
  2⤵
  PID:3616
- C:\Windows\System\zLijoPB.exe
  C:\Windows\System\zLijoPB.exe
  2⤵
  PID:3776
- C:\Windows\System\GkrinQi.exe
  C:\Windows\System\GkrinQi.exe
  2⤵
  PID:3936
- C:\Windows\System\UmphGSR.exe
  C:\Windows\System\UmphGSR.exe
  2⤵
  PID:1628
- C:\Windows\System\pJolUGJ.exe
  C:\Windows\System\pJolUGJ.exe
  2⤵
  PID:3476
- C:\Windows\System\CHTwcuy.exe
  C:\Windows\System\CHTwcuy.exe
  2⤵
  PID:4084
- C:\Windows\System\ubZruEt.exe
  C:\Windows\System\ubZruEt.exe
  2⤵
  PID:4204
- C:\Windows\System\EaIvpeA.exe
  C:\Windows\System\EaIvpeA.exe
  2⤵
  PID:1036
- C:\Windows\System\qRQlCdv.exe
  C:\Windows\System\qRQlCdv.exe
  2⤵
  PID:6332
- C:\Windows\System\tzDmfCd.exe
  C:\Windows\System\tzDmfCd.exe
  2⤵
  PID:1652
- C:\Windows\System\GcCLyde.exe
  C:\Windows\System\GcCLyde.exe
  2⤵
  PID:6424
- C:\Windows\System\yAPVKUJ.exe
  C:\Windows\System\yAPVKUJ.exe
  2⤵
  PID:6488
- C:\Windows\System\DNiIZdY.exe
  C:\Windows\System\DNiIZdY.exe
  2⤵
  PID:6788
- C:\Windows\System\vChVBYa.exe
  C:\Windows\System\vChVBYa.exe
  2⤵
  PID:6552
- C:\Windows\System\KaoyHBj.exe
  C:\Windows\System\KaoyHBj.exe
  2⤵
  PID:6824
- C:\Windows\System\OrKMgzT.exe
  C:\Windows\System\OrKMgzT.exe
  2⤵
  PID:6868
- C:\Windows\System\DrpJGLo.exe
  C:\Windows\System\DrpJGLo.exe
  2⤵
  PID:6888
- C:\Windows\System\NfgEgOP.exe
  C:\Windows\System\NfgEgOP.exe
  2⤵
  PID:6844
- C:\Windows\System\qsFvlLK.exe
  C:\Windows\System\qsFvlLK.exe
  2⤵
  PID:6908
- C:\Windows\System\imgNsiK.exe
  C:\Windows\System\imgNsiK.exe
  2⤵
  PID:6928
- C:\Windows\System\mUUhujt.exe
  C:\Windows\System\mUUhujt.exe
  2⤵
  PID:7048
- C:\Windows\System\sFkNLKw.exe
  C:\Windows\System\sFkNLKw.exe
  2⤵
  PID:7076
- C:\Windows\System\HNkKvMk.exe
  C:\Windows\System\HNkKvMk.exe
  2⤵
  PID:6956
- C:\Windows\System\epWFGzC.exe
  C:\Windows\System\epWFGzC.exe
  2⤵
  PID:6976
- C:\Windows\System\cWkgkft.exe
  C:\Windows\System\cWkgkft.exe
  2⤵
  PID:7000
- C:\Windows\System\XQskZnl.exe
  C:\Windows\System\XQskZnl.exe
  2⤵
  PID:7024
- C:\Windows\System\FBXXpoy.exe
  C:\Windows\System\FBXXpoy.exe
  2⤵
  PID:4604
- C:\Windows\System\BPPUyti.exe
  C:\Windows\System\BPPUyti.exe
  2⤵
  PID:7152
- C:\Windows\System\mxlWTIm.exe
  C:\Windows\System\mxlWTIm.exe
  2⤵
  PID:7112
- C:\Windows\System\TxIVKgk.exe
  C:\Windows\System\TxIVKgk.exe
  2⤵
  PID:7116
- C:\Windows\System\AnBxcYF.exe
  C:\Windows\System\AnBxcYF.exe
  2⤵
  PID:5552
- C:\Windows\System\AyxFEse.exe
  C:\Windows\System\AyxFEse.exe
  2⤵
  PID:5900
- C:\Windows\System\hVjchVT.exe
  C:\Windows\System\hVjchVT.exe
  2⤵
  PID:4368
- C:\Windows\System\VMTiiFc.exe
  C:\Windows\System\VMTiiFc.exe
  2⤵
  PID:4524
- C:\Windows\System\tbWxtwg.exe
  C:\Windows\System\tbWxtwg.exe
  2⤵
  PID:4688
- C:\Windows\System\zvgYXwI.exe
  C:\Windows\System\zvgYXwI.exe
  2⤵
  PID:4628
- C:\Windows\System\QbHTopB.exe
  C:\Windows\System\QbHTopB.exe
  2⤵
  PID:4816
- C:\Windows\System\kZImyQu.exe
  C:\Windows\System\kZImyQu.exe
  2⤵
  PID:240
- C:\Windows\System\SjZWdGH.exe
  C:\Windows\System\SjZWdGH.exe
  2⤵
  PID:2056
- C:\Windows\System\dXbHdIa.exe
  C:\Windows\System\dXbHdIa.exe
  2⤵
  PID:2060
- C:\Windows\System\QbGMebZ.exe
  C:\Windows\System\QbGMebZ.exe
  2⤵
  PID:3108
- C:\Windows\System\nPQeXGk.exe
  C:\Windows\System\nPQeXGk.exe
  2⤵
  PID:3428
- C:\Windows\System\CWDACOR.exe
  C:\Windows\System\CWDACOR.exe
  2⤵
  PID:3876
- C:\Windows\System\mUbBvJi.exe
  C:\Windows\System\mUbBvJi.exe
  2⤵
  PID:4036
- C:\Windows\System\dEqmCJI.exe
  C:\Windows\System\dEqmCJI.exe
  2⤵
  PID:4976
- C:\Windows\System\dzNloZu.exe
  C:\Windows\System\dzNloZu.exe
  2⤵
  PID:3632
- C:\Windows\System\saDhLjr.exe
  C:\Windows\System\saDhLjr.exe
  2⤵
  PID:4612
- C:\Windows\System\sqTNTCy.exe
  C:\Windows\System\sqTNTCy.exe
  2⤵
  PID:4608
- C:\Windows\System\dfPVurq.exe
  C:\Windows\System\dfPVurq.exe
  2⤵
  PID:4864
- C:\Windows\System\OuylyOK.exe
  C:\Windows\System\OuylyOK.exe
  2⤵
  PID:4736
- C:\Windows\System\boKlZGJ.exe
  C:\Windows\System\boKlZGJ.exe
  2⤵
  PID:5148
- C:\Windows\System\OYEupcw.exe
  C:\Windows\System\OYEupcw.exe
  2⤵
  PID:1752
- C:\Windows\System\DBzOJGp.exe
  C:\Windows\System\DBzOJGp.exe
  2⤵
  PID:5280
- C:\Windows\System\eINanMr.exe
  C:\Windows\System\eINanMr.exe
  2⤵
  PID:5600
- C:\Windows\System\AsLROAY.exe
  C:\Windows\System\AsLROAY.exe
  2⤵
  PID:5504
- C:\Windows\System\FSZtVqu.exe
  C:\Windows\System\FSZtVqu.exe
  2⤵
  PID:5660
- C:\Windows\System\dRRWEiU.exe
  C:\Windows\System\dRRWEiU.exe
  2⤵
  PID:5820
- C:\Windows\System\xZbApvY.exe
  C:\Windows\System\xZbApvY.exe
  2⤵
  PID:6012
- C:\Windows\System\tKPdPGB.exe
  C:\Windows\System\tKPdPGB.exe
  2⤵
  PID:5264
- C:\Windows\System\lisknsK.exe
  C:\Windows\System\lisknsK.exe
  2⤵
  PID:5840
- C:\Windows\System\cpTQajk.exe
  C:\Windows\System\cpTQajk.exe
  2⤵
  PID:2228
- C:\Windows\System\ggXshCZ.exe
  C:\Windows\System\ggXshCZ.exe
  2⤵
  PID:6184
- C:\Windows\System\wiCrmzw.exe
  C:\Windows\System\wiCrmzw.exe
  2⤵
  PID:6348
- C:\Windows\System\JGMqrnR.exe
  C:\Windows\System\JGMqrnR.exe
  2⤵
  PID:6284
- C:\Windows\System\KelECgP.exe
  C:\Windows\System\KelECgP.exe
  2⤵
  PID:6472
- C:\Windows\System\WKEOlcj.exe
  C:\Windows\System\WKEOlcj.exe
  2⤵
  PID:6628
- C:\Windows\System\ueuPVWr.exe
  C:\Windows\System\ueuPVWr.exe
  2⤵
  PID:6660
- C:\Windows\System\cYMvpeM.exe
  C:\Windows\System\cYMvpeM.exe
  2⤵
  PID:6680
- C:\Windows\System\wdjUXcA.exe
  C:\Windows\System\wdjUXcA.exe
  2⤵
  PID:6720
- C:\Windows\System\QyjKEsI.exe
  C:\Windows\System\QyjKEsI.exe
  2⤵
  PID:6724
- C:\Windows\System\DwfoEDl.exe
  C:\Windows\System\DwfoEDl.exe
  2⤵
  PID:6768
- C:\Windows\System\WRFSqnD.exe
  C:\Windows\System\WRFSqnD.exe
  2⤵
  PID:2656
- C:\Windows\System\mpMWbkN.exe
  C:\Windows\System\mpMWbkN.exe
  2⤵
  PID:2488
- C:\Windows\System\BHhPxzb.exe
  C:\Windows\System\BHhPxzb.exe
  2⤵
  PID:3104
- C:\Windows\System\SQUigkk.exe
  C:\Windows\System\SQUigkk.exe
  2⤵
  PID:3360
- C:\Windows\System\ukvRQxv.exe
  C:\Windows\System\ukvRQxv.exe
  2⤵
  PID:1600
- C:\Windows\System\mGNZQpM.exe
  C:\Windows\System\mGNZQpM.exe
  2⤵
  PID:3744
- C:\Windows\System\mAkcLtq.exe
  C:\Windows\System\mAkcLtq.exe
  2⤵
  PID:3872
- C:\Windows\System\leAJiSB.exe
  C:\Windows\System\leAJiSB.exe
  2⤵
  PID:3220
- C:\Windows\System\ffjBwxM.exe
  C:\Windows\System\ffjBwxM.exe
  2⤵
  PID:4172
- C:\Windows\System\bhRzbAR.exe
  C:\Windows\System\bhRzbAR.exe
  2⤵
  PID:3036
- C:\Windows\System\QUZQyEq.exe
  C:\Windows\System\QUZQyEq.exe
  2⤵
  PID:6364
- C:\Windows\System\HxDccuL.exe
  C:\Windows\System\HxDccuL.exe
  2⤵
  PID:6396
- C:\Windows\System\WRyqfkA.exe
  C:\Windows\System\WRyqfkA.exe
  2⤵
  PID:6456
- C:\Windows\System\QxmUlSo.exe
  C:\Windows\System\QxmUlSo.exe
  2⤵
  PID:6520
- C:\Windows\System\pxKWQnC.exe
  C:\Windows\System\pxKWQnC.exe
  2⤵
  PID:6796
- C:\Windows\System\yOPcYRu.exe
  C:\Windows\System\yOPcYRu.exe
  2⤵
  PID:6876
- C:\Windows\System\GMJLWbc.exe
  C:\Windows\System\GMJLWbc.exe
  2⤵
  PID:6864
- C:\Windows\System\VHUovOA.exe
  C:\Windows\System\VHUovOA.exe
  2⤵
  PID:2104
- C:\Windows\System\psnABrM.exe
  C:\Windows\System\psnABrM.exe
  2⤵
  PID:7044
- C:\Windows\System\ozEifXb.exe
  C:\Windows\System\ozEifXb.exe
  2⤵
  PID:6948
- C:\Windows\System\bXVFbcr.exe
  C:\Windows\System\bXVFbcr.exe
  2⤵
  PID:6992
- C:\Windows\System\VNTMHcS.exe
  C:\Windows\System\VNTMHcS.exe
  2⤵
  PID:6968
- C:\Windows\System\LkHIORQ.exe
  C:\Windows\System\LkHIORQ.exe
  2⤵
  PID:7100
- C:\Windows\System\cGbImCw.exe
  C:\Windows\System\cGbImCw.exe
  2⤵
  PID:7144
- C:\Windows\System\CSqEbAJ.exe
  C:\Windows\System\CSqEbAJ.exe
  2⤵
  PID:5772
- C:\Windows\System\KZOyVuO.exe
  C:\Windows\System\KZOyVuO.exe
  2⤵
  PID:7120
- C:\Windows\System\eOWhXfR.exe
  C:\Windows\System\eOWhXfR.exe
  2⤵
  PID:4692
- C:\Windows\System\BxiOXaP.exe
  C:\Windows\System\BxiOXaP.exe
  2⤵
  PID:4304
- C:\Windows\System\SbEuETY.exe
  C:\Windows\System\SbEuETY.exe
  2⤵
  PID:4592
- C:\Windows\System\jUJcRex.exe
  C:\Windows\System\jUJcRex.exe
  2⤵
  PID:3020
- C:\Windows\System\rDfbVCe.exe
  C:\Windows\System\rDfbVCe.exe
  2⤵
  PID:2280
- C:\Windows\System\LmQcjzL.exe
  C:\Windows\System\LmQcjzL.exe
  2⤵
  PID:3684
- C:\Windows\System\CxqWuuA.exe
  C:\Windows\System\CxqWuuA.exe
  2⤵
  PID:2928
- C:\Windows\System\MXBiFvi.exe
  C:\Windows\System\MXBiFvi.exe
  2⤵
  PID:5040
- C:\Windows\System\LhNJrua.exe
  C:\Windows\System\LhNJrua.exe
  2⤵
  PID:2264
- C:\Windows\System\fAUFiLM.exe
  C:\Windows\System\fAUFiLM.exe
  2⤵
  PID:1888
- C:\Windows\System\GhxeGMz.exe
  C:\Windows\System\GhxeGMz.exe
  2⤵
  PID:5532
- C:\Windows\System\eFevdBP.exe
  C:\Windows\System\eFevdBP.exe
  2⤵
  PID:4540
- C:\Windows\System\wWKODjR.exe
  C:\Windows\System\wWKODjR.exe
  2⤵
  PID:5920
- C:\Windows\System\ZNQupMa.exe
  C:\Windows\System\ZNQupMa.exe
  2⤵
  PID:2300
- C:\Windows\System\GITJpyH.exe
  C:\Windows\System\GITJpyH.exe
  2⤵
  PID:6148
- C:\Windows\System\KAYFuAE.exe
  C:\Windows\System\KAYFuAE.exe
  2⤵
  PID:5852
- C:\Windows\System\MztRjcH.exe
  C:\Windows\System\MztRjcH.exe
  2⤵
  PID:6508
- C:\Windows\System\bRyvwix.exe
  C:\Windows\System\bRyvwix.exe
  2⤵
  PID:1056
- C:\Windows\System\NdGCTKU.exe
  C:\Windows\System\NdGCTKU.exe
  2⤵
  PID:6700
- C:\Windows\System\WElaKjP.exe
  C:\Windows\System\WElaKjP.exe
  2⤵
  PID:5128
- C:\Windows\System\RCHVCli.exe
  C:\Windows\System\RCHVCli.exe
  2⤵
  PID:6760
- C:\Windows\System\PWxcADq.exe
  C:\Windows\System\PWxcADq.exe
  2⤵
  PID:2924
- C:\Windows\System\gRJLJjy.exe
  C:\Windows\System\gRJLJjy.exe
  2⤵
  PID:3264
- C:\Windows\System\KKAzsOC.exe
  C:\Windows\System\KKAzsOC.exe
  2⤵
  PID:3348
- C:\Windows\System\LjRWvJC.exe
  C:\Windows\System\LjRWvJC.exe
  2⤵
  PID:1632
- C:\Windows\System\SRPeqPD.exe
  C:\Windows\System\SRPeqPD.exe
  2⤵
  PID:6460
- C:\Windows\System\HCobOpu.exe
  C:\Windows\System\HCobOpu.exe
  2⤵
  PID:1964
- C:\Windows\System\uVvimYK.exe
  C:\Windows\System\uVvimYK.exe
  2⤵
  PID:6900
- C:\Windows\System\kkQhqIN.exe
  C:\Windows\System\kkQhqIN.exe
  2⤵
  PID:6952
- C:\Windows\System\GbQlfJJ.exe
  C:\Windows\System\GbQlfJJ.exe
  2⤵
  PID:7016
- C:\Windows\System\AUtAnOM.exe
  C:\Windows\System\AUtAnOM.exe
  2⤵
  PID:2820
- C:\Windows\System\doMRcNr.exe
  C:\Windows\System\doMRcNr.exe
  2⤵
  PID:6312
- C:\Windows\System\WIYNBOG.exe
  C:\Windows\System\WIYNBOG.exe
  2⤵
  PID:6644
- C:\Windows\System\cMYHrZh.exe
  C:\Windows\System\cMYHrZh.exe
  2⤵
  PID:4240
- C:\Windows\System\AQIDJdR.exe
  C:\Windows\System\AQIDJdR.exe
  2⤵
  PID:3076
- C:\Windows\System\BwxSGwQ.exe
  C:\Windows\System\BwxSGwQ.exe
  2⤵
  PID:3588
- C:\Windows\System\RzaiGet.exe
  C:\Windows\System\RzaiGet.exe
  2⤵
  PID:6728
- C:\Windows\System\XbtenqI.exe
  C:\Windows\System\XbtenqI.exe
  2⤵
  PID:2556
- C:\Windows\System\ZnuhWZT.exe
  C:\Windows\System\ZnuhWZT.exe
  2⤵
  PID:3860
- C:\Windows\System\itAQjua.exe
  C:\Windows\System\itAQjua.exe
  2⤵
  PID:1396
- C:\Windows\System\SaFtzWZ.exe
  C:\Windows\System\SaFtzWZ.exe
  2⤵
  PID:3068
- C:\Windows\System\snxBpvQ.exe
  C:\Windows\System\snxBpvQ.exe
  2⤵
  PID:7040
- C:\Windows\System\NybXoaH.exe
  C:\Windows\System\NybXoaH.exe
  2⤵
  PID:7008
- C:\Windows\System\miuyHxt.exe
  C:\Windows\System\miuyHxt.exe
  2⤵
  PID:4112
- C:\Windows\System\pAbKLFJ.exe
  C:\Windows\System\pAbKLFJ.exe
  2⤵
  PID:4784
- C:\Windows\System\jYOxIbx.exe
  C:\Windows\System\jYOxIbx.exe
  2⤵
  PID:2008
- C:\Windows\System\CeOjxbN.exe
  C:\Windows\System\CeOjxbN.exe
  2⤵
  PID:5108
- C:\Windows\System\KILbaXQ.exe
  C:\Windows\System\KILbaXQ.exe
  2⤵
  PID:5208
- C:\Windows\System\thFYjvV.exe
  C:\Windows\System\thFYjvV.exe
  2⤵
  PID:6076
- C:\Windows\System\yOAlTyh.exe
  C:\Windows\System\yOAlTyh.exe
  2⤵
  PID:5980
- C:\Windows\System\SoNtbKG.exe
  C:\Windows\System\SoNtbKG.exe
  2⤵
  PID:2032
- C:\Windows\System\UGzGIif.exe
  C:\Windows\System\UGzGIif.exe
  2⤵
  PID:6984
- C:\Windows\System\CRNQWHH.exe
  C:\Windows\System\CRNQWHH.exe
  2⤵
  PID:7084
- C:\Windows\System\GkQYLeQ.exe
  C:\Windows\System\GkQYLeQ.exe
  2⤵
  PID:6664
- C:\Windows\System\oLvZCcO.exe
  C:\Windows\System\oLvZCcO.exe
  2⤵
  PID:2388
- C:\Windows\System\modqkrJ.exe
  C:\Windows\System\modqkrJ.exe
  2⤵
  PID:6800
- C:\Windows\System\EqprYTv.exe
  C:\Windows\System\EqprYTv.exe
  2⤵
  PID:4016
- C:\Windows\System\qcnBUzW.exe
  C:\Windows\System\qcnBUzW.exe
  2⤵
  PID:5012
- C:\Windows\System\NwENKaC.exe
  C:\Windows\System\NwENKaC.exe
  2⤵
  PID:5728
- C:\Windows\System\ZAzqfaM.exe
  C:\Windows\System\ZAzqfaM.exe
  2⤵
  PID:6376
- C:\Windows\System\XluGQgA.exe
  C:\Windows\System\XluGQgA.exe
  2⤵
  PID:5044
- C:\Windows\System\cOthiIu.exe
  C:\Windows\System\cOthiIu.exe
  2⤵
  PID:7188
- C:\Windows\System\XJWUhZT.exe
  C:\Windows\System\XJWUhZT.exe
  2⤵
  PID:7208
- C:\Windows\System\PvICDKb.exe
  C:\Windows\System\PvICDKb.exe
  2⤵
  PID:7228
- C:\Windows\System\KTQAnRL.exe
  C:\Windows\System\KTQAnRL.exe
  2⤵
  PID:7244
- C:\Windows\System\eqdaJZf.exe
  C:\Windows\System\eqdaJZf.exe
  2⤵
  PID:7264
- C:\Windows\System\AJolzCH.exe
  C:\Windows\System\AJolzCH.exe
  2⤵
  PID:7280
- C:\Windows\System\lErwiwB.exe
  C:\Windows\System\lErwiwB.exe
  2⤵
  PID:7300
- C:\Windows\System\VqgCunA.exe
  C:\Windows\System\VqgCunA.exe
  2⤵
  PID:7316
- C:\Windows\System\DtxbbbB.exe
  C:\Windows\System\DtxbbbB.exe
  2⤵
  PID:7336
- C:\Windows\System\sSMJKES.exe
  C:\Windows\System\sSMJKES.exe
  2⤵
  PID:7352
- C:\Windows\System\sIklJzO.exe
  C:\Windows\System\sIklJzO.exe
  2⤵
  PID:7368
- C:\Windows\System\SBBhnzQ.exe
  C:\Windows\System\SBBhnzQ.exe
  2⤵
  PID:7384
- C:\Windows\System\VpEGldf.exe
  C:\Windows\System\VpEGldf.exe
  2⤵
  PID:7400
- C:\Windows\System\ZLstWKH.exe
  C:\Windows\System\ZLstWKH.exe
  2⤵
  PID:7416
- C:\Windows\System\pdsNgOm.exe
  C:\Windows\System\pdsNgOm.exe
  2⤵
  PID:7432
- C:\Windows\System\iKntIZP.exe
  C:\Windows\System\iKntIZP.exe
  2⤵
  PID:7448
- C:\Windows\System\FGKaFcP.exe
  C:\Windows\System\FGKaFcP.exe
  2⤵
  PID:7468
- C:\Windows\System\hZqtDAN.exe
  C:\Windows\System\hZqtDAN.exe
  2⤵
  PID:7500
- C:\Windows\System\XtegojN.exe
  C:\Windows\System\XtegojN.exe
  2⤵
  PID:7524
- C:\Windows\System\cnyNVMB.exe
  C:\Windows\System\cnyNVMB.exe
  2⤵
  PID:7548
- C:\Windows\System\hBtEOGN.exe
  C:\Windows\System\hBtEOGN.exe
  2⤵
  PID:7564
- C:\Windows\System\yHSMzLO.exe
  C:\Windows\System\yHSMzLO.exe
  2⤵
  PID:7580
- C:\Windows\System\fuxvWOC.exe
  C:\Windows\System\fuxvWOC.exe
  2⤵
  PID:7596
- C:\Windows\System\wKXmTFQ.exe
  C:\Windows\System\wKXmTFQ.exe
  2⤵
  PID:7612
- C:\Windows\System\XIjZAdv.exe
  C:\Windows\System\XIjZAdv.exe
  2⤵
  PID:7628
- C:\Windows\System\dfRlIIf.exe
  C:\Windows\System\dfRlIIf.exe
  2⤵
  PID:7644
- C:\Windows\System\Ttreulm.exe
  C:\Windows\System\Ttreulm.exe
  2⤵
  PID:7660
- C:\Windows\System\vrOPdta.exe
  C:\Windows\System\vrOPdta.exe
  2⤵
  PID:7676
- C:\Windows\System\gYBPiim.exe
  C:\Windows\System\gYBPiim.exe
  2⤵
  PID:7692
- C:\Windows\System\poBbNEE.exe
  C:\Windows\System\poBbNEE.exe
  2⤵
  PID:7712
- C:\Windows\System\hQhgCOK.exe
  C:\Windows\System\hQhgCOK.exe
  2⤵
  PID:7728
- C:\Windows\System\YlyrAdY.exe
  C:\Windows\System\YlyrAdY.exe
  2⤵
  PID:7744
- C:\Windows\System\MqjlKOg.exe
  C:\Windows\System\MqjlKOg.exe
  2⤵
  PID:7760
- C:\Windows\System\JdQCLZT.exe
  C:\Windows\System\JdQCLZT.exe
  2⤵
  PID:7776
- C:\Windows\System\McXpQpK.exe
  C:\Windows\System\McXpQpK.exe
  2⤵
  PID:7792
- C:\Windows\System\BoTYlxK.exe
  C:\Windows\System\BoTYlxK.exe
  2⤵
  PID:7808
- C:\Windows\System\kBwjVNT.exe
  C:\Windows\System\kBwjVNT.exe
  2⤵
  PID:7824
- C:\Windows\System\gEAinCx.exe
  C:\Windows\System\gEAinCx.exe
  2⤵
  PID:7840
- C:\Windows\System\DWWRBkU.exe
  C:\Windows\System\DWWRBkU.exe
  2⤵
  PID:7856
- C:\Windows\System\xIDQGqN.exe
  C:\Windows\System\xIDQGqN.exe
  2⤵
  PID:7872
- C:\Windows\System\bLIrAop.exe
  C:\Windows\System\bLIrAop.exe
  2⤵
  PID:7888
- C:\Windows\System\KUkcyjY.exe
  C:\Windows\System\KUkcyjY.exe
  2⤵
  PID:7904
- C:\Windows\System\OrOcIjJ.exe
  C:\Windows\System\OrOcIjJ.exe
  2⤵
  PID:7920
- C:\Windows\System\xgpmcNP.exe
  C:\Windows\System\xgpmcNP.exe
  2⤵
  PID:7936
- C:\Windows\System\DhowaUL.exe
  C:\Windows\System\DhowaUL.exe
  2⤵
  PID:7952
- C:\Windows\System\QNIPxZP.exe
  C:\Windows\System\QNIPxZP.exe
  2⤵
  PID:7968
- C:\Windows\System\DOWrdjf.exe
  C:\Windows\System\DOWrdjf.exe
  2⤵
  PID:7984
- C:\Windows\System\fAXOhfy.exe
  C:\Windows\System\fAXOhfy.exe
  2⤵
  PID:8000
- C:\Windows\System\pnEEqrs.exe
  C:\Windows\System\pnEEqrs.exe
  2⤵
  PID:8016
- C:\Windows\System\ShYRhbf.exe
  C:\Windows\System\ShYRhbf.exe
  2⤵
  PID:8032
- C:\Windows\System\tcNpLqT.exe
  C:\Windows\System\tcNpLqT.exe
  2⤵
  PID:8048
- C:\Windows\System\AVgcwwp.exe
  C:\Windows\System\AVgcwwp.exe
  2⤵
  PID:8064
- C:\Windows\System\iKMjtnY.exe
  C:\Windows\System\iKMjtnY.exe
  2⤵
  PID:8080
- C:\Windows\System\mlQuqSm.exe
  C:\Windows\System\mlQuqSm.exe
  2⤵
  PID:8100
- C:\Windows\System\OdKVaHO.exe
  C:\Windows\System\OdKVaHO.exe
  2⤵
  PID:8116
- C:\Windows\System\SDpYaeq.exe
  C:\Windows\System\SDpYaeq.exe
  2⤵
  PID:8132
- C:\Windows\System\ZvEmTNT.exe
  C:\Windows\System\ZvEmTNT.exe
  2⤵
  PID:8148
- C:\Windows\System\nILbdbN.exe
  C:\Windows\System\nILbdbN.exe
  2⤵
  PID:8164
- C:\Windows\System\KDeuakZ.exe
  C:\Windows\System\KDeuakZ.exe
  2⤵
  PID:8180
- C:\Windows\System\oUZWYtv.exe
  C:\Windows\System\oUZWYtv.exe
  2⤵
  PID:7176
- C:\Windows\System\wtNQKQB.exe
  C:\Windows\System\wtNQKQB.exe
  2⤵
  PID:7104
- C:\Windows\System\vmHmjHE.exe
  C:\Windows\System\vmHmjHE.exe
  2⤵
  PID:4220
- C:\Windows\System\TznJOVC.exe
  C:\Windows\System\TznJOVC.exe
  2⤵
  PID:7224
- C:\Windows\System\ybqpHeC.exe
  C:\Windows\System\ybqpHeC.exe
  2⤵
  PID:7256
- C:\Windows\System\AHwUTge.exe
  C:\Windows\System\AHwUTge.exe
  2⤵
  PID:7324
- C:\Windows\System\AnVAbrn.exe
  C:\Windows\System\AnVAbrn.exe
  2⤵
  PID:7360
- C:\Windows\System\MZkpiGX.exe
  C:\Windows\System\MZkpiGX.exe
  2⤵
  PID:6944
- C:\Windows\System\zsUHjxp.exe
  C:\Windows\System\zsUHjxp.exe
  2⤵
  PID:7392
- C:\Windows\System\EzzeyKI.exe
  C:\Windows\System\EzzeyKI.exe
  2⤵
  PID:7460
- C:\Windows\System\pIsfcDo.exe
  C:\Windows\System\pIsfcDo.exe
  2⤵
  PID:312
- C:\Windows\System\gMjNjcF.exe
  C:\Windows\System\gMjNjcF.exe
  2⤵
  PID:7588
- C:\Windows\System\UaoXVTt.exe
  C:\Windows\System\UaoXVTt.exe
  2⤵
  PID:7464
- C:\Windows\System\LJGhNXZ.exe
  C:\Windows\System\LJGhNXZ.exe
  2⤵
  PID:7516
- C:\Windows\System\XbUwmzd.exe
  C:\Windows\System\XbUwmzd.exe
  2⤵
  PID:4352
- C:\Windows\System\funWDCY.exe
  C:\Windows\System\funWDCY.exe
  2⤵
  PID:5372
- C:\Windows\System\eBIQSpr.exe
  C:\Windows\System\eBIQSpr.exe
  2⤵
  PID:5568
- C:\Windows\System\BNXvkFX.exe
  C:\Windows\System\BNXvkFX.exe
  2⤵
  PID:5484
- C:\Windows\System\cXcyxPC.exe
  C:\Windows\System\cXcyxPC.exe
  2⤵
  PID:1580
- C:\Windows\System\pdtemYq.exe
  C:\Windows\System\pdtemYq.exe
  2⤵
  PID:1676
- C:\Windows\System\Ynhemdg.exe
  C:\Windows\System\Ynhemdg.exe
  2⤵
  PID:6872
- C:\Windows\System\ZfszLMX.exe
  C:\Windows\System\ZfszLMX.exe
  2⤵
  PID:6640
- C:\Windows\System\exTYRuQ.exe
  C:\Windows\System\exTYRuQ.exe
  2⤵
  PID:2900
- C:\Windows\System\vYBNXph.exe
  C:\Windows\System\vYBNXph.exe
  2⤵
  PID:3840
- C:\Windows\System\daWihlP.exe
  C:\Windows\System\daWihlP.exe
  2⤵
  PID:7072
- C:\Windows\System\sIKFEkC.exe
  C:\Windows\System\sIKFEkC.exe
  2⤵
  PID:4460
- C:\Windows\System\wuZkczj.exe
  C:\Windows\System\wuZkczj.exe
  2⤵
  PID:588
- C:\Windows\System\xvDADNi.exe
  C:\Windows\System\xvDADNi.exe
  2⤵
  PID:1244
- C:\Windows\System\SmTqiwx.exe
  C:\Windows\System\SmTqiwx.exe
  2⤵
  PID:4788
- C:\Windows\System\BgzYFaS.exe
  C:\Windows\System\BgzYFaS.exe
  2⤵
  PID:6604
- C:\Windows\System\zRuvvTc.exe
  C:\Windows\System\zRuvvTc.exe
  2⤵
  PID:7196
- C:\Windows\System\TsDLpgZ.exe
  C:\Windows\System\TsDLpgZ.exe
  2⤵
  PID:7236
- C:\Windows\System\sqppqRy.exe
  C:\Windows\System\sqppqRy.exe
  2⤵
  PID:7724
- C:\Windows\System\jCakFuV.exe
  C:\Windows\System\jCakFuV.exe
  2⤵
  PID:7788
- C:\Windows\System\fynmHfx.exe
  C:\Windows\System\fynmHfx.exe
  2⤵
  PID:7852
- C:\Windows\System\GyyPRya.exe
  C:\Windows\System\GyyPRya.exe
  2⤵
  PID:7376
- C:\Windows\System\zbAsAtd.exe
  C:\Windows\System\zbAsAtd.exe
  2⤵
  PID:7476
- C:\Windows\System\mpGHOON.exe
  C:\Windows\System\mpGHOON.exe
  2⤵
  PID:7488
- C:\Windows\System\olqMXSW.exe
  C:\Windows\System\olqMXSW.exe
  2⤵
  PID:7540
- C:\Windows\System\upmGKcj.exe
  C:\Windows\System\upmGKcj.exe
  2⤵
  PID:7976
- C:\Windows\System\UkIXNBn.exe
  C:\Windows\System\UkIXNBn.exe
  2⤵
  PID:8040
- C:\Windows\System\StOQueW.exe
  C:\Windows\System\StOQueW.exe
  2⤵
  PID:7928
- C:\Windows\System\vSBfbLA.exe
  C:\Windows\System\vSBfbLA.exe
  2⤵
  PID:8044
- C:\Windows\System\TrZIDep.exe
  C:\Windows\System\TrZIDep.exe
  2⤵
  PID:8028
- C:\Windows\System\JzMUbaT.exe
  C:\Windows\System\JzMUbaT.exe
  2⤵
  PID:8076
- C:\Windows\System\fMXdLtB.exe
  C:\Windows\System\fMXdLtB.exe
  2⤵
  PID:3460
- C:\Windows\System\YICLuDi.exe
  C:\Windows\System\YICLuDi.exe
  2⤵
  PID:7288
- C:\Windows\System\heMDnXb.exe
  C:\Windows\System\heMDnXb.exe
  2⤵
  PID:2644
- C:\Windows\System\elXMNab.exe
  C:\Windows\System\elXMNab.exe
  2⤵
  PID:5060
- C:\Windows\System\wXpXrKg.exe
  C:\Windows\System\wXpXrKg.exe
  2⤵
  PID:3232
- C:\Windows\System\TtOhYnR.exe
  C:\Windows\System\TtOhYnR.exe
  2⤵
  PID:3652
- C:\Windows\System\jNgBDhZ.exe
  C:\Windows\System\jNgBDhZ.exe
  2⤵
  PID:6140
- C:\Windows\System\NSjcoBK.exe
  C:\Windows\System\NSjcoBK.exe
  2⤵
  PID:7684
- C:\Windows\System\vzCsnuB.exe
  C:\Windows\System\vzCsnuB.exe
  2⤵
  PID:7912
- C:\Windows\System\wDMbwMW.exe
  C:\Windows\System\wDMbwMW.exe
  2⤵
  PID:7900
- C:\Windows\System\jhEdRAE.exe
  C:\Windows\System\jhEdRAE.exe
  2⤵
  PID:8096
- C:\Windows\System\UfddZhy.exe
  C:\Windows\System\UfddZhy.exe
  2⤵
  PID:8156
- C:\Windows\System\kYmMHST.exe
  C:\Windows\System\kYmMHST.exe
  2⤵
  PID:7180
- C:\Windows\System\lnJNyyE.exe
  C:\Windows\System\lnJNyyE.exe
  2⤵
  PID:8060
- C:\Windows\System\FwkQwta.exe
  C:\Windows\System\FwkQwta.exe
  2⤵
  PID:7216
- C:\Windows\System\jiZzYhI.exe
  C:\Windows\System\jiZzYhI.exe
  2⤵
  PID:1624
- C:\Windows\System\AneiBgC.exe
  C:\Windows\System\AneiBgC.exe
  2⤵
  PID:7328
- C:\Windows\System\ohiZfOl.exe
  C:\Windows\System\ohiZfOl.exe
  2⤵
  PID:2320
- C:\Windows\System\OUtcrUv.exe
  C:\Windows\System\OUtcrUv.exe
  2⤵
  PID:2496
- C:\Windows\System\WxTKCIT.exe
  C:\Windows\System\WxTKCIT.exe
  2⤵
  PID:7456
- C:\Windows\System\dghfOuk.exe
  C:\Windows\System\dghfOuk.exe
  2⤵
  PID:7784
- C:\Windows\System\BtnOtMB.exe
  C:\Windows\System\BtnOtMB.exe
  2⤵
  PID:2188
- C:\Windows\System\bkBfBdM.exe
  C:\Windows\System\bkBfBdM.exe
  2⤵
  PID:7272
- C:\Windows\System\VyTzHEC.exe
  C:\Windows\System\VyTzHEC.exe
  2⤵
  PID:7344
- C:\Windows\System\QxkRKYd.exe
  C:\Windows\System\QxkRKYd.exe
  2⤵
  PID:7520
- C:\Windows\System\wpWUESa.exe
  C:\Windows\System\wpWUESa.exe
  2⤵
  PID:812
- C:\Windows\System\ENQaqMC.exe
  C:\Windows\System\ENQaqMC.exe
  2⤵
  PID:1980
- C:\Windows\System\KLDDbys.exe
  C:\Windows\System\KLDDbys.exe
  2⤵
  PID:2536
- C:\Windows\System\lGPvPYu.exe
  C:\Windows\System\lGPvPYu.exe
  2⤵
  PID:1976
- C:\Windows\System\qUaODDR.exe
  C:\Windows\System\qUaODDR.exe
  2⤵
  PID:2080
- C:\Windows\System\oDBKPYn.exe
  C:\Windows\System\oDBKPYn.exe
  2⤵
  PID:7704
- C:\Windows\System\arKudHh.exe
  C:\Windows\System\arKudHh.exe
  2⤵
  PID:7740
- C:\Windows\System\rvjYIlg.exe
  C:\Windows\System\rvjYIlg.exe
  2⤵
  PID:4444
- C:\Windows\System\NKnviod.exe
  C:\Windows\System\NKnviod.exe
  2⤵
  PID:2628
- C:\Windows\System\COYGLjR.exe
  C:\Windows\System\COYGLjR.exe
  2⤵
  PID:3904
- C:\Windows\System\vMJolMX.exe
  C:\Windows\System\vMJolMX.exe
  2⤵
  PID:7832
- C:\Windows\System\DcIgrhY.exe
  C:\Windows\System\DcIgrhY.exe
  2⤵
  PID:1124
- C:\Windows\System\avoWoff.exe
  C:\Windows\System\avoWoff.exe
  2⤵
  PID:7496
- C:\Windows\System\Tndwofv.exe
  C:\Windows\System\Tndwofv.exe
  2⤵
  PID:7836
- C:\Windows\System\GNYNCgn.exe
  C:\Windows\System\GNYNCgn.exe
  2⤵
  PID:8124
- C:\Windows\System\MaLPKuq.exe
  C:\Windows\System\MaLPKuq.exe
  2⤵
  PID:8160
- C:\Windows\System\xhjdiBr.exe
  C:\Windows\System\xhjdiBr.exe
  2⤵
  PID:1324
- C:\Windows\System\AMQwUOH.exe
  C:\Windows\System\AMQwUOH.exe
  2⤵
  PID:6620
- C:\Windows\System\gQoyebm.exe
  C:\Windows\System\gQoyebm.exe
  2⤵
  PID:7380
- C:\Windows\System\EqpbazD.exe
  C:\Windows\System\EqpbazD.exe
  2⤵
  PID:1944
- C:\Windows\System\RKyHbzH.exe
  C:\Windows\System\RKyHbzH.exe
  2⤵
  PID:4032
- C:\Windows\System\BoBlrir.exe
  C:\Windows\System\BoBlrir.exe
  2⤵
  PID:7800
- C:\Windows\System\YIDQjeA.exe
  C:\Windows\System\YIDQjeA.exe
  2⤵
  PID:7164
- C:\Windows\System\ApqhIus.exe
  C:\Windows\System\ApqhIus.exe
  2⤵
  PID:2296
- C:\Windows\System\eNXKmPi.exe
  C:\Windows\System\eNXKmPi.exe
  2⤵
  PID:7668
- C:\Windows\System\fdjaWFj.exe
  C:\Windows\System\fdjaWFj.exe
  2⤵
  PID:7772
- C:\Windows\System\zBbiKLP.exe
  C:\Windows\System\zBbiKLP.exe
  2⤵
  PID:6748
- C:\Windows\System\gHWGvmR.exe
  C:\Windows\System\gHWGvmR.exe
  2⤵
  PID:1484
- C:\Windows\System\USFTaJZ.exe
  C:\Windows\System\USFTaJZ.exe
  2⤵
  PID:4140
- C:\Windows\System\JPNdTfr.exe
  C:\Windows\System\JPNdTfr.exe
  2⤵
  PID:7412
- C:\Windows\System\trfyxsF.exe
  C:\Windows\System\trfyxsF.exe
  2⤵
  PID:6884
- C:\Windows\System\DqOzPSC.exe
  C:\Windows\System\DqOzPSC.exe
  2⤵
  PID:8008
- C:\Windows\System\QkGeqcT.exe
  C:\Windows\System\QkGeqcT.exe
  2⤵
  PID:1136
- C:\Windows\System\ZHjmWGv.exe
  C:\Windows\System\ZHjmWGv.exe
  2⤵
  PID:7184
- C:\Windows\System\eUMSQnI.exe
  C:\Windows\System\eUMSQnI.exe
  2⤵
  PID:1556
- C:\Windows\System\xogUqIi.exe
  C:\Windows\System\xogUqIi.exe
  2⤵
  PID:7312
- C:\Windows\System\ygfNcTe.exe
  C:\Windows\System\ygfNcTe.exe
  2⤵
  PID:7636
- C:\Windows\System\krDTZlX.exe
  C:\Windows\System\krDTZlX.exe
  2⤵
  PID:7536
- C:\Windows\System\lDuSitc.exe
  C:\Windows\System\lDuSitc.exe
  2⤵
  PID:7572
- C:\Windows\System\bGPGzRr.exe
  C:\Windows\System\bGPGzRr.exe
  2⤵
  PID:3268
- C:\Windows\System\VLuHmdE.exe
  C:\Windows\System\VLuHmdE.exe
  2⤵
  PID:6848
- C:\Windows\System\MCysnej.exe
  C:\Windows\System\MCysnej.exe
  2⤵
  PID:7964
- C:\Windows\System\BVTNZkj.exe
  C:\Windows\System\BVTNZkj.exe
  2⤵
  PID:8024
- C:\Windows\System\vsyrINB.exe
  C:\Windows\System\vsyrINB.exe
  2⤵
  PID:2324
- C:\Windows\System\lWwVZRd.exe
  C:\Windows\System\lWwVZRd.exe
  2⤵
  PID:4432
- C:\Windows\System\HHpXARs.exe
  C:\Windows\System\HHpXARs.exe
  2⤵
  PID:7204
- C:\Windows\System\zZMtNGw.exe
  C:\Windows\System\zZMtNGw.exe
  2⤵
  PID:8208
- C:\Windows\System\MMmHBQl.exe
  C:\Windows\System\MMmHBQl.exe
  2⤵
  PID:8224
- C:\Windows\System\IjPNvei.exe
  C:\Windows\System\IjPNvei.exe
  2⤵
  PID:8248
- C:\Windows\System\tAXbpNb.exe
  C:\Windows\System\tAXbpNb.exe
  2⤵
  PID:8268
- C:\Windows\System\iFwlBsH.exe
  C:\Windows\System\iFwlBsH.exe
  2⤵
  PID:8288
- C:\Windows\System\oGjWtpv.exe
  C:\Windows\System\oGjWtpv.exe
  2⤵
  PID:8308
- C:\Windows\System\EadeTxt.exe
  C:\Windows\System\EadeTxt.exe
  2⤵
  PID:8324
- C:\Windows\System\GeBviEr.exe
  C:\Windows\System\GeBviEr.exe
  2⤵
  PID:8340
- C:\Windows\System\ezqQvOp.exe
  C:\Windows\System\ezqQvOp.exe
  2⤵
  PID:8360
- C:\Windows\System\qdANxCP.exe
  C:\Windows\System\qdANxCP.exe
  2⤵
  PID:8384
- C:\Windows\System\ahosWyl.exe
  C:\Windows\System\ahosWyl.exe
  2⤵
  PID:8408
- C:\Windows\System\eFbgsHJ.exe
  C:\Windows\System\eFbgsHJ.exe
  2⤵
  PID:8424
- C:\Windows\System\SdlOlwR.exe
  C:\Windows\System\SdlOlwR.exe
  2⤵
  PID:8440
- C:\Windows\System\zusXLyA.exe
  C:\Windows\System\zusXLyA.exe
  2⤵
  PID:8456
- C:\Windows\System\KJUINjE.exe
  C:\Windows\System\KJUINjE.exe
  2⤵
  PID:8480
- C:\Windows\System\MhFqHSH.exe
  C:\Windows\System\MhFqHSH.exe
  2⤵
  PID:8500
- C:\Windows\System\TKoqdFm.exe
  C:\Windows\System\TKoqdFm.exe
  2⤵
  PID:8532
- C:\Windows\System\HUdFmPX.exe
  C:\Windows\System\HUdFmPX.exe
  2⤵
  PID:8548
- C:\Windows\System\pFCkRGP.exe
  C:\Windows\System\pFCkRGP.exe
  2⤵
  PID:8568
- C:\Windows\System\olwcUmD.exe
  C:\Windows\System\olwcUmD.exe
  2⤵
  PID:8596
- C:\Windows\System\eOUSKor.exe
  C:\Windows\System\eOUSKor.exe
  2⤵
  PID:8620
- C:\Windows\System\bBtzoKM.exe
  C:\Windows\System\bBtzoKM.exe
  2⤵
  PID:8636
- C:\Windows\System\bCQwjTz.exe
  C:\Windows\System\bCQwjTz.exe
  2⤵
  PID:8656
- C:\Windows\System\TkGXCOd.exe
  C:\Windows\System\TkGXCOd.exe
  2⤵
  PID:8676
- C:\Windows\System\ciQfTVz.exe
  C:\Windows\System\ciQfTVz.exe
  2⤵
  PID:8696
- C:\Windows\System\CKNCpzu.exe
  C:\Windows\System\CKNCpzu.exe
  2⤵
  PID:8720
- C:\Windows\System\ghkaNyN.exe
  C:\Windows\System\ghkaNyN.exe
  2⤵
  PID:8764
- C:\Windows\System\NKQAYwh.exe
  C:\Windows\System\NKQAYwh.exe
  2⤵
  PID:8784
- C:\Windows\System\qFRsrRj.exe
  C:\Windows\System\qFRsrRj.exe
  2⤵
  PID:8800
- C:\Windows\System\KCLCVva.exe
  C:\Windows\System\KCLCVva.exe
  2⤵
  PID:8832
- C:\Windows\System\IxQXqeT.exe
  C:\Windows\System\IxQXqeT.exe
  2⤵
  PID:8848
- C:\Windows\System\XwfWJoU.exe
  C:\Windows\System\XwfWJoU.exe
  2⤵
  PID:8868
- C:\Windows\System\rhomQzN.exe
  C:\Windows\System\rhomQzN.exe
  2⤵
  PID:8888
- C:\Windows\System\rFXtrgj.exe
  C:\Windows\System\rFXtrgj.exe
  2⤵
  PID:8904
- C:\Windows\System\ZbtxHmn.exe
  C:\Windows\System\ZbtxHmn.exe
  2⤵
  PID:8920
- C:\Windows\System\MFPGPLI.exe
  C:\Windows\System\MFPGPLI.exe
  2⤵
  PID:8936
- C:\Windows\System\pOtOery.exe
  C:\Windows\System\pOtOery.exe
  2⤵
  PID:8952
- C:\Windows\System\Dwcpovq.exe
  C:\Windows\System\Dwcpovq.exe
  2⤵
  PID:8972
- C:\Windows\System\FgnPnFa.exe
  C:\Windows\System\FgnPnFa.exe
  2⤵
  PID:8988
- C:\Windows\System\zfMGqcQ.exe
  C:\Windows\System\zfMGqcQ.exe
  2⤵
  PID:9004
- C:\Windows\System\ijhHBTa.exe
  C:\Windows\System\ijhHBTa.exe
  2⤵
  PID:9020
- C:\Windows\System\qzjVQSk.exe
  C:\Windows\System\qzjVQSk.exe
  2⤵
  PID:9036
- C:\Windows\System\kFuYosp.exe
  C:\Windows\System\kFuYosp.exe
  2⤵
  PID:9056
- C:\Windows\System\zTkHBqE.exe
  C:\Windows\System\zTkHBqE.exe
  2⤵
  PID:9076
- C:\Windows\System\QuoIihY.exe
  C:\Windows\System\QuoIihY.exe
  2⤵
  PID:9100
- C:\Windows\System\zboHNcu.exe
  C:\Windows\System\zboHNcu.exe
  2⤵
  PID:9116
- C:\Windows\System\lnsObyY.exe
  C:\Windows\System\lnsObyY.exe
  2⤵
  PID:9132
- C:\Windows\System\BzjUmsw.exe
  C:\Windows\System\BzjUmsw.exe
  2⤵
  PID:9148
- C:\Windows\System\PUTLQmw.exe
  C:\Windows\System\PUTLQmw.exe
  2⤵
  PID:4144
- C:\Windows\System\kYzSnUx.exe
  C:\Windows\System\kYzSnUx.exe
  2⤵
  PID:8232
- C:\Windows\System\aGxUBiI.exe
  C:\Windows\System\aGxUBiI.exe
  2⤵
  PID:8204
- C:\Windows\System\eSUIPAZ.exe
  C:\Windows\System\eSUIPAZ.exe
  2⤵
  PID:8284
- C:\Windows\System\BSbiLtG.exe
  C:\Windows\System\BSbiLtG.exe
  2⤵
  PID:8348
- C:\Windows\System\CWgpjfW.exe
  C:\Windows\System\CWgpjfW.exe
  2⤵
  PID:8392
- C:\Windows\System\hYlWfqK.exe
  C:\Windows\System\hYlWfqK.exe
  2⤵
  PID:8400
- C:\Windows\System\PKPiiRF.exe
  C:\Windows\System\PKPiiRF.exe
  2⤵
  PID:8468
- C:\Windows\System\NYYKanU.exe
  C:\Windows\System\NYYKanU.exe
  2⤵
  PID:8520
- C:\Windows\System\emTREsg.exe
  C:\Windows\System\emTREsg.exe
  2⤵
  PID:8516
- C:\Windows\System\qRZedbq.exe
  C:\Windows\System\qRZedbq.exe
  2⤵
  PID:8608
- C:\Windows\System\WzSrdRr.exe
  C:\Windows\System\WzSrdRr.exe
  2⤵
  PID:8648
- C:\Windows\System\dcvDmnH.exe
  C:\Windows\System\dcvDmnH.exe
  2⤵
  PID:8216
- C:\Windows\System\fwBCMmP.exe
  C:\Windows\System\fwBCMmP.exe
  2⤵
  PID:8416
- C:\Windows\System\HMMDDuY.exe
  C:\Windows\System\HMMDDuY.exe
  2⤵
  PID:7804
- C:\Windows\System\ugwAyWc.exe
  C:\Windows\System\ugwAyWc.exe
  2⤵
  PID:7444
- C:\Windows\System\chCXDWC.exe
  C:\Windows\System\chCXDWC.exe
  2⤵
  PID:2248
- C:\Windows\System\RiGklhE.exe
  C:\Windows\System\RiGklhE.exe
  2⤵
  PID:8488
- C:\Windows\System\ljNniNK.exe
  C:\Windows\System\ljNniNK.exe
  2⤵
  PID:8632
- C:\Windows\System\LfXQCRN.exe
  C:\Windows\System\LfXQCRN.exe
  2⤵
  PID:8336
- C:\Windows\System\ReXqJcJ.exe
  C:\Windows\System\ReXqJcJ.exe
  2⤵
  PID:8448
- C:\Windows\System\dTfkaOf.exe
  C:\Windows\System\dTfkaOf.exe
  2⤵
  PID:2608
- C:\Windows\System\eGPqSfN.exe
  C:\Windows\System\eGPqSfN.exe
  2⤵
  PID:8592
- C:\Windows\System\UzMGXNA.exe
  C:\Windows\System\UzMGXNA.exe
  2⤵
  PID:8668
- C:\Windows\System\uQHPYjY.exe
  C:\Windows\System\uQHPYjY.exe
  2⤵
  PID:8736
- C:\Windows\System\sfjNCvv.exe
  C:\Windows\System\sfjNCvv.exe
  2⤵
  PID:8708
- C:\Windows\System\XkAmkAW.exe
  C:\Windows\System\XkAmkAW.exe
  2⤵
  PID:8760
- C:\Windows\System\RXnbsSs.exe
  C:\Windows\System\RXnbsSs.exe
  2⤵
  PID:1316
- C:\Windows\System\wUspbiW.exe
  C:\Windows\System\wUspbiW.exe
  2⤵
  PID:8824
- C:\Windows\System\OQiqPel.exe
  C:\Windows\System\OQiqPel.exe
  2⤵
  PID:8828
- C:\Windows\System\ebpEbWO.exe
  C:\Windows\System\ebpEbWO.exe
  2⤵
  PID:8916
- C:\Windows\System\XJZhywH.exe
  C:\Windows\System\XJZhywH.exe
  2⤵
  PID:9048
- C:\Windows\System\RzSIZFr.exe
  C:\Windows\System\RzSIZFr.exe
  2⤵
  PID:9044
- C:\Windows\System\dZSSRtX.exe
  C:\Windows\System\dZSSRtX.exe
  2⤵
  PID:9064
- C:\Windows\System\bFkpyQw.exe
  C:\Windows\System\bFkpyQw.exe
  2⤵
  PID:9068
- C:\Windows\System\YfhNYLv.exe
  C:\Windows\System\YfhNYLv.exe
  2⤵
  PID:9160
- C:\Windows\System\wYoSVjT.exe
  C:\Windows\System\wYoSVjT.exe
  2⤵
  PID:9164
- C:\Windows\System\KzOAcKq.exe
  C:\Windows\System\KzOAcKq.exe
  2⤵
  PID:9200
- C:\Windows\System\vUSgYih.exe
  C:\Windows\System\vUSgYih.exe
  2⤵
  PID:9196
- C:\Windows\System\iNCMaAb.exe
  C:\Windows\System\iNCMaAb.exe
  2⤵
  PID:7560
- C:\Windows\System\FVLLyKE.exe
  C:\Windows\System\FVLLyKE.exe
  2⤵
  PID:8380
- C:\Windows\System\lmUuAAy.exe
  C:\Windows\System\lmUuAAy.exe
  2⤵
  PID:8528
- C:\Windows\System\UHIyIES.exe
  C:\Windows\System\UHIyIES.exe
  2⤵
  PID:8684
- C:\Windows\System\jYakTME.exe
  C:\Windows\System\jYakTME.exe
  2⤵
  PID:7948
- C:\Windows\System\rCsPRew.exe
  C:\Windows\System\rCsPRew.exe
  2⤵
  PID:8512
- C:\Windows\System\nkKnLiw.exe
  C:\Windows\System\nkKnLiw.exe
  2⤵
  PID:7656
- C:\Windows\System\BbuWFQB.exe
  C:\Windows\System\BbuWFQB.exe
  2⤵
  PID:8732
- C:\Windows\System\cRkfmhO.exe
  C:\Windows\System\cRkfmhO.exe
  2⤵
  PID:8756
- C:\Windows\System\UFkqvwW.exe
  C:\Windows\System\UFkqvwW.exe
  2⤵
  PID:8476
- C:\Windows\System\dirVSFv.exe
  C:\Windows\System\dirVSFv.exe
  2⤵
  PID:8376
- C:\Windows\System\XUalgMT.exe
  C:\Windows\System\XUalgMT.exe
  2⤵
  PID:9096
- C:\Windows\System\fbQdDLT.exe
  C:\Windows\System\fbQdDLT.exe
  2⤵
  PID:9156
- C:\Windows\System\vLNzanG.exe
  C:\Windows\System\vLNzanG.exe
  2⤵
  PID:8236
- C:\Windows\System\TQUatBk.exe
  C:\Windows\System\TQUatBk.exe
  2⤵
  PID:9084
- C:\Windows\System\eLluJqL.exe
  C:\Windows\System\eLluJqL.exe
  2⤵
  PID:8320
- C:\Windows\System\GCXzNnl.exe
  C:\Windows\System\GCXzNnl.exe
  2⤵
  PID:8948
- C:\Windows\System\njeNJnn.exe
  C:\Windows\System\njeNJnn.exe
  2⤵
  PID:9000
- C:\Windows\System\oGkiGgP.exe
  C:\Windows\System\oGkiGgP.exe
  2⤵
  PID:8776
- C:\Windows\System\nXjHymc.exe
  C:\Windows\System\nXjHymc.exe
  2⤵
  PID:8984
- C:\Windows\System\iSeXJWb.exe
  C:\Windows\System\iSeXJWb.exe
  2⤵
  PID:8220
- C:\Windows\System\OPbiWtK.exe
  C:\Windows\System\OPbiWtK.exe
  2⤵
  PID:8688
- C:\Windows\System\caFJnsr.exe
  C:\Windows\System\caFJnsr.exe
  2⤵
  PID:9184
- C:\Windows\System\KBvbmSZ.exe
  C:\Windows\System\KBvbmSZ.exe
  2⤵
  PID:8240
- C:\Windows\System\OyDbLTG.exe
  C:\Windows\System\OyDbLTG.exe
  2⤵
  PID:8172
- C:\Windows\System\BxjyFMV.exe
  C:\Windows\System\BxjyFMV.exe
  2⤵
  PID:8840
- C:\Windows\System\wPUiwKm.exe
  C:\Windows\System\wPUiwKm.exe
  2⤵
  PID:9032
- C:\Windows\System\hTricGp.exe
  C:\Windows\System\hTricGp.exe
  2⤵
  PID:9140
- C:\Windows\System\EvJIxQy.exe
  C:\Windows\System\EvJIxQy.exe
  2⤵
  PID:8704
- C:\Windows\System\mbUeKlA.exe
  C:\Windows\System\mbUeKlA.exe
  2⤵
  PID:8860
- C:\Windows\System\EfaqjMX.exe
  C:\Windows\System\EfaqjMX.exe
  2⤵
  PID:8964
- C:\Windows\System\npcJjVc.exe
  C:\Windows\System\npcJjVc.exe
  2⤵
  PID:9172
- C:\Windows\System\kJnxwfI.exe
  C:\Windows\System\kJnxwfI.exe
  2⤵
  PID:8960
- C:\Windows\System\IurRxIm.exe
  C:\Windows\System\IurRxIm.exe
  2⤵
  PID:7620
- C:\Windows\System\giwOYOM.exe
  C:\Windows\System\giwOYOM.exe
  2⤵
  PID:8816
- C:\Windows\System\uSWOUWa.exe
  C:\Windows\System\uSWOUWa.exe
  2⤵
  PID:9220
- C:\Windows\System\oBRcNvs.exe
  C:\Windows\System\oBRcNvs.exe
  2⤵
  PID:9236
- C:\Windows\System\qbBBJrJ.exe
  C:\Windows\System\qbBBJrJ.exe
  2⤵
  PID:9252
- C:\Windows\System\JPWGorh.exe
  C:\Windows\System\JPWGorh.exe
  2⤵
  PID:9268
- C:\Windows\System\kzrkXGW.exe
  C:\Windows\System\kzrkXGW.exe
  2⤵
  PID:9284
- C:\Windows\System\mwraeEY.exe
  C:\Windows\System\mwraeEY.exe
  2⤵
  PID:9300
- C:\Windows\System\JKoDThF.exe
  C:\Windows\System\JKoDThF.exe
  2⤵
  PID:9316
- C:\Windows\System\VdmHOWJ.exe
  C:\Windows\System\VdmHOWJ.exe
  2⤵
  PID:9332
- C:\Windows\System\wedWQCm.exe
  C:\Windows\System\wedWQCm.exe
  2⤵
  PID:9352
- C:\Windows\System\AkgOxsO.exe
  C:\Windows\System\AkgOxsO.exe
  2⤵
  PID:9372
- C:\Windows\System\urQaYdA.exe
  C:\Windows\System\urQaYdA.exe
  2⤵
  PID:9392
- C:\Windows\System\gzZxfIB.exe
  C:\Windows\System\gzZxfIB.exe
  2⤵
  PID:9416
- C:\Windows\System\EvtDnkj.exe
  C:\Windows\System\EvtDnkj.exe
  2⤵
  PID:9432
- C:\Windows\System\YMqdAmC.exe
  C:\Windows\System\YMqdAmC.exe
  2⤵
  PID:9452
- C:\Windows\System\tGqAffS.exe
  C:\Windows\System\tGqAffS.exe
  2⤵
  PID:9472
- C:\Windows\System\GHyQpjd.exe
  C:\Windows\System\GHyQpjd.exe
  2⤵
  PID:9488
- C:\Windows\System\ASbJNbD.exe
  C:\Windows\System\ASbJNbD.exe
  2⤵
  PID:9508
- C:\Windows\System\ojPnxvv.exe
  C:\Windows\System\ojPnxvv.exe
  2⤵
  PID:9524
- C:\Windows\System\HzvdRYV.exe
  C:\Windows\System\HzvdRYV.exe
  2⤵
  PID:9544
- C:\Windows\System\gVKuuEv.exe
  C:\Windows\System\gVKuuEv.exe
  2⤵
  PID:9564
- C:\Windows\System\fFLSunW.exe
  C:\Windows\System\fFLSunW.exe
  2⤵
  PID:9584
- C:\Windows\System\bQTorMX.exe
  C:\Windows\System\bQTorMX.exe
  2⤵
  PID:9600
- C:\Windows\System\fOtoPAo.exe
  C:\Windows\System\fOtoPAo.exe
  2⤵
  PID:9620
- C:\Windows\System\saziUem.exe
  C:\Windows\System\saziUem.exe
  2⤵
  PID:9644
- C:\Windows\System\bgdheay.exe
  C:\Windows\System\bgdheay.exe
  2⤵
  PID:9664
- C:\Windows\System\jOHkqjh.exe
  C:\Windows\System\jOHkqjh.exe
  2⤵
  PID:9684
- C:\Windows\System\jZzevjg.exe
  C:\Windows\System\jZzevjg.exe
  2⤵
  PID:9700
- C:\Windows\System\rUeNEIi.exe
  C:\Windows\System\rUeNEIi.exe
  2⤵
  PID:9720
- C:\Windows\System\DvJuLTN.exe
  C:\Windows\System\DvJuLTN.exe
  2⤵
  PID:9736
- C:\Windows\System\IdxpEoK.exe
  C:\Windows\System\IdxpEoK.exe
  2⤵
  PID:9756
- C:\Windows\System\aeukLjP.exe
  C:\Windows\System\aeukLjP.exe
  2⤵
  PID:9772
- C:\Windows\System\jXkgQrJ.exe
  C:\Windows\System\jXkgQrJ.exe
  2⤵
  PID:9792
- C:\Windows\System\CEnuPUc.exe
  C:\Windows\System\CEnuPUc.exe
  2⤵
  PID:9808
- C:\Windows\System\JjsqLYh.exe
  C:\Windows\System\JjsqLYh.exe
  2⤵
  PID:9824
- C:\Windows\System\GOpfDFF.exe
  C:\Windows\System\GOpfDFF.exe
  2⤵
  PID:9840
- C:\Windows\System\GQfhduW.exe
  C:\Windows\System\GQfhduW.exe
  2⤵
  PID:9860
- C:\Windows\System\rzQsFOK.exe
  C:\Windows\System\rzQsFOK.exe
  2⤵
  PID:9876
- C:\Windows\System\jkYJTAd.exe
  C:\Windows\System\jkYJTAd.exe
  2⤵
  PID:9892
- C:\Windows\System\tLgvglR.exe
  C:\Windows\System\tLgvglR.exe
  2⤵
  PID:9908
- C:\Windows\System\YkTzCBy.exe
  C:\Windows\System\YkTzCBy.exe
  2⤵
  PID:9924
- C:\Windows\System\DxadgrU.exe
  C:\Windows\System\DxadgrU.exe
  2⤵
  PID:9940
- C:\Windows\System\WqNHRJp.exe
  C:\Windows\System\WqNHRJp.exe
  2⤵
  PID:9956
- C:\Windows\System\nyPYVNr.exe
  C:\Windows\System\nyPYVNr.exe
  2⤵
  PID:10108
- C:\Windows\System\kUwoubE.exe
  C:\Windows\System\kUwoubE.exe
  2⤵
  PID:10132
- C:\Windows\System\OaXKdfm.exe
  C:\Windows\System\OaXKdfm.exe
  2⤵
  PID:10148
- C:\Windows\System\TocMsvw.exe
  C:\Windows\System\TocMsvw.exe
  2⤵
  PID:10164
- C:\Windows\System\AktJejO.exe
  C:\Windows\System\AktJejO.exe
  2⤵
  PID:10180
- C:\Windows\System\JGZOGGh.exe
  C:\Windows\System\JGZOGGh.exe
  2⤵
  PID:10200
- C:\Windows\System\bdUxTVE.exe
  C:\Windows\System\bdUxTVE.exe
  2⤵
  PID:10216
- C:\Windows\System\ZmMoDVs.exe
  C:\Windows\System\ZmMoDVs.exe
  2⤵
  PID:10236
- C:\Windows\System\efpIGqJ.exe
  C:\Windows\System\efpIGqJ.exe
  2⤵
  PID:8900
- C:\Windows\System\iQFOMsN.exe
  C:\Windows\System\iQFOMsN.exe
  2⤵
  PID:8576
- C:\Windows\System\GUrimJN.exe
  C:\Windows\System\GUrimJN.exe
  2⤵
  PID:9092
- C:\Windows\System\qpaWBTp.exe
  C:\Windows\System\qpaWBTp.exe
  2⤵
  PID:8200
- C:\Windows\System\LgIrHgF.exe
  C:\Windows\System\LgIrHgF.exe
  2⤵
  PID:9312
- C:\Windows\System\wbCFyXz.exe
  C:\Windows\System\wbCFyXz.exe
  2⤵
  PID:9384
- C:\Windows\System\uDTxiUL.exe
  C:\Windows\System\uDTxiUL.exe
  2⤵
  PID:9460
- C:\Windows\System\tMHOiMm.exe
  C:\Windows\System\tMHOiMm.exe
  2⤵
  PID:9500
- C:\Windows\System\AMQBUyD.exe
  C:\Windows\System\AMQBUyD.exe
  2⤵
  PID:9576
- C:\Windows\System\AoTvqdh.exe
  C:\Windows\System\AoTvqdh.exe
  2⤵
  PID:9616
- C:\Windows\System\FHbrBOG.exe
  C:\Windows\System\FHbrBOG.exe
  2⤵
  PID:9692
- C:\Windows\System\eSIoMVz.exe
  C:\Windows\System\eSIoMVz.exe
  2⤵
  PID:9764
- C:\Windows\System\zBPREcT.exe
  C:\Windows\System\zBPREcT.exe
  2⤵
  PID:9868
- C:\Windows\System\TcqNVLe.exe
  C:\Windows\System\TcqNVLe.exe
  2⤵
  PID:9900
- C:\Windows\System\vDmZaje.exe
  C:\Windows\System\vDmZaje.exe
  2⤵
  PID:8420
- C:\Windows\System\ehefODl.exe
  C:\Windows\System\ehefODl.exe
  2⤵
  PID:9992
- C:\Windows\System\qptPBoi.exe
  C:\Windows\System\qptPBoi.exe
  2⤵
  PID:8616
- C:\Windows\System\EZzhvqo.exe
  C:\Windows\System\EZzhvqo.exe
  2⤵
  PID:9232
- C:\Windows\System\FIvHQdb.exe
  C:\Windows\System\FIvHQdb.exe
  2⤵
  PID:9296
- C:\Windows\System\UnLUTcN.exe
  C:\Windows\System\UnLUTcN.exe
  2⤵
  PID:9364
- C:\Windows\System\ZkLWJwA.exe
  C:\Windows\System\ZkLWJwA.exe
  2⤵
  PID:9412
- C:\Windows\System\dWfIhpd.exe
  C:\Windows\System\dWfIhpd.exe
  2⤵
  PID:8752
- C:\Windows\System\cNYomXk.exe
  C:\Windows\System\cNYomXk.exe
  2⤵
  PID:9520
- C:\Windows\System\phxXWfe.exe
  C:\Windows\System\phxXWfe.exe
  2⤵
  PID:9592
- C:\Windows\System\VyDjLbP.exe
  C:\Windows\System\VyDjLbP.exe
  2⤵
  PID:9636
- C:\Windows\System\gGuPgTK.exe
  C:\Windows\System\gGuPgTK.exe
  2⤵
  PID:9680
- C:\Windows\System\yBjPqcw.exe
  C:\Windows\System\yBjPqcw.exe
  2⤵
  PID:9744
- C:\Windows\System\KPWQZlZ.exe
  C:\Windows\System\KPWQZlZ.exe
  2⤵
  PID:9784
- C:\Windows\System\rKkLfyT.exe
  C:\Windows\System\rKkLfyT.exe
  2⤵
  PID:9852
- C:\Windows\System\DUmEhiC.exe
  C:\Windows\System\DUmEhiC.exe
  2⤵
  PID:9916
- C:\Windows\System\YrdsfWl.exe
  C:\Windows\System\YrdsfWl.exe
  2⤵
  PID:9112
- C:\Windows\System\DbDWznE.exe
  C:\Windows\System\DbDWznE.exe
  2⤵
  PID:8604
- C:\Windows\System\vcwZuow.exe
  C:\Windows\System\vcwZuow.exe
  2⤵
  PID:10036
- C:\Windows\System\CVVWBPZ.exe
  C:\Windows\System\CVVWBPZ.exe
  2⤵
  PID:10056
- C:\Windows\System\HpRmrYR.exe
  C:\Windows\System\HpRmrYR.exe
  2⤵
  PID:10072
- C:\Windows\System\CGrntUE.exe
  C:\Windows\System\CGrntUE.exe
  2⤵
  PID:10088
- C:\Windows\System\ZVQyeCr.exe
  C:\Windows\System\ZVQyeCr.exe
  2⤵
  PID:10004
- C:\Windows\System\KNZPqHU.exe
  C:\Windows\System\KNZPqHU.exe
  2⤵
  PID:10144
- C:\Windows\System\heJxieA.exe
  C:\Windows\System\heJxieA.exe
  2⤵
  PID:10176
- C:\Windows\System\KyWtNGW.exe
  C:\Windows\System\KyWtNGW.exe
  2⤵
  PID:9540
- C:\Windows\System\gNoFNBt.exe
  C:\Windows\System\gNoFNBt.exe
  2⤵
  PID:9660
- C:\Windows\System\yYtqvOS.exe
  C:\Windows\System\yYtqvOS.exe
  2⤵
  PID:9404
- C:\Windows\System\vgZSEEH.exe
  C:\Windows\System\vgZSEEH.exe
  2⤵
  PID:9632
- C:\Windows\System\LcSSPJa.exe
  C:\Windows\System\LcSSPJa.exe
  2⤵
  PID:9948
- C:\Windows\System\KUGgpXa.exe
  C:\Windows\System\KUGgpXa.exe
  2⤵
  PID:9532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DSFHuFa.exe

Filesize
3.1MB

MD5
5e4c77e83f29c6de3a7eb86f5c5e9135

SHA1
a452013cf7cac05e707cb06aa79bc03d75469b36

SHA256
574c7c9e69ff611f0294a74b734ce8a24ae8c306fdea242bf630572232e3f534

SHA512
e504bf7ac87816312ad0aad5e1d485da0acf61a828029cc64f6328db6083d12c98a063c25d29ecb22e1587c3f70d62876cc5589a05babd912f04a3ab77c4add8

Download Submit
C:\Windows\system\FGKdalZ.exe

Filesize
3.1MB

MD5
a49ac4f5cdfdf4408ee5af225c79086d

SHA1
591587706b0c54c8fb0dce91865b10091e63fae2

SHA256
1385df3bf7d4df8aaf81173f5e8753c8240f8a2a5bab972899a84c8862b562ba

SHA512
ab8f18a1f10531063ded915ee6e21a19269f9c86f8d45529ab090ea31e31f80b841b3e80cfc463d10f29d799b3d781c2c84c72486f35ade227f78fe2e4d4c778

Download Submit
C:\Windows\system\GRdTumL.exe

Filesize
3.1MB

MD5
5519340504e120a6d3c66c991ded75a2

SHA1
97a254ec6af91b63a04f2275def05125d9f6b2d4

SHA256
bb6eb05d11ce879931083b835509d662fcc1275037df5282495d5b447fa2e9a1

SHA512
01f5feb9ee4dff1b32cd57a1bd0ccf38f750b55f079624ec2476072ebb0ebd0ac52037e1a5f700f414c1abb5f46c05620527a4d9697e9ee82ab56e1adcb3a87b

Download Submit
C:\Windows\system\IJEIBpy.exe

Filesize
3.1MB

MD5
f230080c402a97007019e960955f386a

SHA1
6b38fe3d440b7e52645c05c6fe0c613748eadfce

SHA256
023642aba88a90c041e482a8914aab1a8c186575576f3e607c86d3bfab200b5c

SHA512
0d3a8ce824c2855fc34d51235b0278e1f60abc70aae8bf6ba43d7b201e7f0e7022624d886810da189ec2f4d41023bc369d81fcdb97e3be033abc8a766096fc39

Download Submit
C:\Windows\system\KcXGXmr.exe

Filesize
3.1MB

MD5
90c18b6d0bb1c4c22d39496b926abce6

SHA1
c778354e39054b9ec648495fe39834b4a37f2696

SHA256
d78e3336e7732f32bde718ee973a712e331962b88a6e65c1db46fc3663d5e6bb

SHA512
ab4d93cbffb7ec593d54b40515417a85f8a454005789ad9c814422b85c2256f161747b50287c2e2c333add9c9859274c2b76c1a15b3b2470f7f5f5f304f565a2

Download Submit
C:\Windows\system\KeWoPdy.exe

Filesize
3.1MB

MD5
97a4479ad9550c0eb451ef4f1a5a7bdb

SHA1
3c55a8b1280fc630e1524512893fe46558de4e80

SHA256
8ffacd4ebd90d05f31c4f54e3c5ad4f9fd90ea76bc58d6411e4a8def95e9dd87

SHA512
6d4dde6246b8a7e48539511d69fc2a2b623ed53be3a71fe933ca93cba459b96e93effaa0b6f0eaa78fa46ec042fb78e13dc28e584ea460fc83c485eeb85ab82a

Download Submit
C:\Windows\system\Mrhwofu.exe

Filesize
3.1MB

MD5
d700407c87f34df4ab935d8c5af6a8af

SHA1
4964c5d1ab99f1fea1cec567bb6a4087c42a4226

SHA256
36b494ea2309f5c4440b156503818265a9700f126b60d76a2daffc2813b14839

SHA512
c219c57bfa964b76d70261f2bd8cee19ce5419d8366585e424fbd86d3f4597bca137a73ebcaecb1cdc7978cdf90f5642eb0d5989ce55d5671782138c69bbfe52

Download Submit
C:\Windows\system\NhUFfsF.exe

Filesize
3.1MB

MD5
589412fc9567d15586b9212198cb7209

SHA1
730fb4b0bf8d185fee2bd0a1e8ab28420f51d91d

SHA256
21cd0c359a4826f2ead2e70119e6e66dd78bd6e557ac44eae70ed9662994504b

SHA512
6958dc3faee17c922460a147f37194377e140fd92262161efa31b29c217355cc7e5ece7317298d0e13b69a06a3b6f023910ee1fe3b2d37aedf2413b77c5710ea

Download Submit
C:\Windows\system\ZfjiinB.exe

Filesize
3.1MB

MD5
4ff4f2a77f0e47bc394b871f4d8c301c

SHA1
c355c4b7818b9cf7c23cda58514d2e0035f462f9

SHA256
84f9793df02fe5e2bfec9ecbc11350092973ee7b80f6af38a55a8d4b8d8ed356

SHA512
98c3569ad0bb134b69a2e8f521734ffc20d5cbeeb026431edda06d92d17a96ae9dfacd09a73cd5264a72a6f489148206148d626f05bd2eb0a41a145366353ad9

Download Submit
C:\Windows\system\bwusVmD.exe

Filesize
3.1MB

MD5
ba96ad87beb2b4cf0b66df0eb1712611

SHA1
8591948c6245959b25376dfa517e689b09b04b0d

SHA256
fa9f8063d2204623a4ca625ae21a9bf9fa72620c3d528c4959a77068ef9a94bb

SHA512
1514e5ec6dff1b6b515ee933113e8d56332e047a856ca173c7d318a17c59b0a80704b3de37c20fcd2367bcbbcfcd9a65ef49b6c8e26eb4c15a8fe69a17afc1d3

Download Submit
C:\Windows\system\cEcrnIK.exe

Filesize
3.1MB

MD5
1efadb927fded177ae1493bd53a944ee

SHA1
d5e8cb59369721c447de2d59107007700cc0d7c3

SHA256
efb71230f6f6f915f23119899922b3e6a2cb090ade4dab7ca5f75de261b9a582

SHA512
d5928b44f08714606daaf4a462fd58786859421cdfc7024c3a19bb549d285eeeb82074fec950e7f2c0c6b2dcfc1ab3b01317707edf4f9283e2d9981b73ab37e4

Download Submit
C:\Windows\system\czbuXdg.exe

Filesize
3.1MB

MD5
bc89b16ecf79506a689443ec19261697

SHA1
593ea50ebf6e25e5ffaf7a92bf1e59f085237f0f

SHA256
95f5b40168e2f2576e69c216500df5ac8c39452cda1776a028b34af261ed834a

SHA512
75147c1d63f5da7537b113d2c875198a96f6889ade93e23e4aa4740d53eb15366e50fe3b77b42d4d61c681e610d9748e66797b67ca0065a8ce455b36cc93022a

Download Submit
C:\Windows\system\doriSSH.exe

Filesize
3.1MB

MD5
c1b4bcf3a36aa2ef8c75d345d84cd24d

SHA1
63b528ed8d5a3f21408e8af40a1836623f8b7ef2

SHA256
3af1c998aa66b695f19249d6fe7e99a9ac33c6d43fc10736322793fbf5ec3f3a

SHA512
4d7dd36929a992270399ea555b36b4dc52488ac21c35e27b0ff92a35691c75d37f7dcb8e1c8b1d8b36d80a8410db2d2c3a470af7434ee26faa38a3065abd9792

Download Submit
C:\Windows\system\eTBAdNp.exe

Filesize
3.1MB

MD5
51d6db76ad3957e899ab09b2e982bc26

SHA1
9571a29c1796bf3a97385f5b18edcc41607fd22d

SHA256
c7208a331828ebb0fa5fa2924e36a0f6121edf4551c3900da0ec5a9c611e758f

SHA512
1c95fb4bb1053c190ce62c0f589a1860706386b6c00be6a710e096e402cd0c06699d599ace751906232bb38542e65864dd8b65811a324bdd792162469589c0c8

Download Submit
C:\Windows\system\fDPAGZv.exe

Filesize
3.1MB

MD5
fb580f17014ebe6a5c006db69cc40c37

SHA1
260633c3a789dea5c99b446df5c9ed57e8ceddb8

SHA256
576e3cf3b07f6e1bb7d7c9ecfe488f21061a4e329555d89769f284786ae58520

SHA512
971eaa7a81717a20932ca1e22f65c246900a523272c6fbb28c8ad6a065e0b562cc0da7e3b98e4e5c4c922d16cde2c6230d9de0c234678eb641906279c8d85ba5

Download Submit
C:\Windows\system\fFjFfOy.exe

Filesize
3.1MB

MD5
f5d5984016911fd0888e50a3d7359cc3

SHA1
dd57f8381f7dec0f7b9f0b70339e907c1e530557

SHA256
6c985b7a38fc74f0a9f684da7275f72dd7524a142cb35f1816afbe18d20cd708

SHA512
be5b0061f594de9804ae5091a03f5057a64385c1525da4d29c8a337b18cb0e21bdb1084f316e68be4fddfcb90320709436379f2cc5d48600511e65d3a317a760

Download Submit
C:\Windows\system\fyxGEcs.exe

Filesize
3.1MB

MD5
6ab1c96fd0d322c58a7d610ae931f90a

SHA1
950a87308aea45b8516573935f7319feac177958

SHA256
3e442674942f8cdcd498cbd041272866e628240b8e004672128227c5f3bdae1d

SHA512
195e4b222bccbf7f98b77c7ffad0d5d1daae48084e6856dfb446027f7e706a963fd4bf7448908b90a790e3cdd8f94fb38ba36cc3bee008e5ccfb38320f7d0fd8

Download Submit
C:\Windows\system\sRrrbce.exe

Filesize
3.1MB

MD5
492b8dc8cf936dcccee30c9d5980f474

SHA1
472091505a42d3694d45a346fe605092e15700b4

SHA256
72d6838ea8835f490c2774f74def72bd197fac5842d5b8e76630d281f9a04b04

SHA512
76e445eebb021fe7ca2e6c306b9aa295c4d5da35dc38104965a0f6aa46ced59b8b6277a392ce703764c665efd13fd531ca5686a23711b9103fe7949bb364d6e6

Download Submit
C:\Windows\system\sYdGDfw.exe

Filesize
3.1MB

MD5
e0a9c1d9d5f659dab61cffbdc79484bb

SHA1
870872d3402ad0edb4b16dac63166142cb71a0c9

SHA256
c121f172eb0a5145fa72661b41c6184b3f59f065e1b667083dd6ef284a38e2df

SHA512
e29826eea7c3b9f28762688b63852085ab6316b4049c62fb83dea746f5c53db6225edff3cd3c016685cea79790dfc69d5bfa40d832a7999406e512d2d00facf6

Download Submit
C:\Windows\system\tzZOvAE.exe

Filesize
3.1MB

MD5
480f28db99b54bae0105b518170482a4

SHA1
35de936b0a863deabe30c30265bfa3bbd09710eb

SHA256
bb006cf912a55beb66ae4df5a2f7b8a533185761a60d88ea3570da752b8eef1f

SHA512
5d7c1aad7465395d061e5de69af1aa7e9575a07d2c8063587e860c8415ddce28764df81101159d4b6df664affc7ccda95ba37a12ecf60fc474e78ceb3f949f4a

Download Submit
C:\Windows\system\xCbCoes.exe

Filesize
3.1MB

MD5
ded7500a2f6d41c7d17cfeb5c52ceeae

SHA1
fadc9f770beb4bb9d21cf5c3f51d9729e8bdcb0a

SHA256
c220e27492217134ce41bf3aaf3b6fec134dec225befa0224a6bdde0e9cdf865

SHA512
8da4ecd70565bb6699f559fb7b6d349a938ce6d08312aba4991a42fd8dbc39a14ba98eab9168ba6c8f504a7439d3f8b7c769225525a990fccade2166e1f4577f

Download Submit
C:\Windows\system\yaPpOeh.exe

Filesize
3.1MB

MD5
08a6bb23d5b21e576824a0fbc7e29a3c

SHA1
df59e46c4b5ae9f3c73d8aa1d20c9ab1ee34d167

SHA256
084f7f14b0fbe8e3acdc8f9608f411a42bd8ad2835fc4a1dbe7c48aac7bcef11

SHA512
2f43f0f702505516343968a5370d619da86433e29d25b9514ff1a4c5f4af7e77f9c474882f7be5b9ebaccab6acd44cb432fd860198ee14d86166c8ba577e39c8

Download Submit
C:\Windows\system\zIagler.exe

Filesize
3.1MB

MD5
3d9ce3e1329587ff3e73ac9dff2e052c

SHA1
285a4e6210f093cae5fd834e44291f89a2ef07aa

SHA256
df069aa8aaa9cc6e0fe4f140a149165a3167df59e5464e55ef81caa8248cc997

SHA512
b0df42ef8bd4e98ffa529a48746b56c4a922d7d44687bcbdda58c8c7cf41678aa049310cc5dbcd7bea81ba8afa897c925fccfed58d0c1f065f013009193c0d76

Download Submit
\Windows\system\FmlJEHr.exe

Filesize
3.1MB

MD5
43ff8ec5f36f04b17260defb49ecda6f

SHA1
77ad1ff3127986accadc30b7b065a5b17de1d048

SHA256
b63656914b4e115d6e262745a99d6b11a041e0d9bca9e66f3ae2274ec0bcce1a

SHA512
ecc24dbc80da8f7bf10001029eefe9fa43c1efdb380ebbfe4e668dece0ecdbf62107fd90f6c7c3258096b7313663a1da76faebc95d9cbd22dda9e051162d0449

Download Submit
\Windows\system\FxAMOJz.exe

Filesize
3.1MB

MD5
8349fb5307ad1a9d0c733c22705137c5

SHA1
79bdf5e7149943cae857f78636b4a0ad01563d63

SHA256
79770fc7c6b3c78fe946765d36a94d33271244c66f4623c809ec6a8c0d2fe6fd

SHA512
6dc51bb7f50b45ad5ab06765f0af6ea19e74f2b1036d9d5167f067df3b6895f8f168ec1dfde88d031a164bf1e72c0b9ded001232543e78cdd4ca0c5390429900

Download Submit
\Windows\system\GDmEOwd.exe

Filesize
3.1MB

MD5
fffb3d09c9604d721064d87cd4f83610

SHA1
28149d4322ea49d5ad50d0d648618b9fec7b91d1

SHA256
fdab54a2c8e8457d8ed2250a49f2a8057b3cdf9bb6a889bf441c54e546183706

SHA512
b6d8c0280a555aec5e82fae28b9d79a2a3f7cf3780f8c49e028913f0ab54eaac5eba027fdadf4d6f117dda33449a9b976cb55fe65b5e003ab58f30b77b542e79

Download Submit
\Windows\system\JPBjTkZ.exe

Filesize
3.1MB

MD5
77e0ed0187835f05752a38b48500615e

SHA1
75068a19a92962b5a421efbb0b886ecc15b5d1f7

SHA256
67898864d5969d5cd82a9ca4b2dc371cc4a4665035a46f6a95cc8a8bb0cfba72

SHA512
cfd6e1d5ad0f25ea3e6fddc4a21da8e445aee4376f684add5b6b965649d2717da67e8176e257135ab64e6b284f70688c0020d0ec9c45b269b634e69952056fc9

Download Submit
\Windows\system\XyyDyGC.exe

Filesize
3.1MB

MD5
81aa93ddce5981823167723a0bb9d823

SHA1
5d4e8acadb11bb38c86d9fd0948567700cb592bc

SHA256
6471a058c557d60850184bd3ef2176587b7bb42f2f1515be35f8d2805897591f

SHA512
60d3f640a85357df1d3c33eb64aa1e134847e6ec7089fdcc5b131cef4b7ca233c89d5680a951952d864297184b4b04657068e1f332d68b10b09a812c85aeb8e5

Download Submit
\Windows\system\jVFBRvr.exe

Filesize
3.1MB

MD5
cc6e7fb9c37e4908505badf292f37534

SHA1
273740e7575c36ba55a7926d1db16606cc5a95c8

SHA256
4397f718549fdc63acc292c2512e198bf97c3555c327ebd11947c1d1ee71924a

SHA512
fca30548a952ea85fa373d53633224597286cf2eb3b500a959b63ae744229b7534316deba8fcbb8fd90175c7d1bc8ed8886bf36e986e366a8122ab6af657e188

Download Submit
\Windows\system\jYlyKQZ.exe

Filesize
3.1MB

MD5
d3c5a985645baa56cc0ac093b5acb821

SHA1
d25477ef64d055fed6be374b23836704e242d2bd

SHA256
0e2cfbdcd4e6242abb59f815ca5133d418014d37e9f2aa30d588b4ed6ed8c445

SHA512
eec748599ff24443a6f44bb8c10a73aa27a8a0ad5a7d97ba8cbcbaa58dc86c2d621e4484ea6d8dc07658fbb39b25b491404fd842c0f9afde0cd57588efd9f4b8

Download Submit
\Windows\system\qPzjYNc.exe

Filesize
3.1MB

MD5
601f1b2d876730963d53702d35cce626

SHA1
a7ab4355a503f223c6ac3c59df5aece26c8c652b

SHA256
332751975239401b630435996d30b43e62f52b5c4c545c9ab99e94a8360c62b7

SHA512
bc819de40a77b9ac0b57a55e78e2bfd6401cba249a552b368ae6845a9b75ffc7d87b98d6d07d13cd892fc324eb6f5b1a7f9d54f8074f1af69b8de08d7601ad0d

Download Submit
\Windows\system\rXPECjX.exe

Filesize
3.1MB

MD5
b521272aa8af5034f8c102c085725eed

SHA1
a5b6cf21ab6f6cf0e6fe3f4afc752a6af4d94a71

SHA256
81fae93de259aae95927576997b92e05ad8f162d6ec1fc984e4ec1104a84ecf0

SHA512
ab6e6c354cfc3f501c62d6a1dc2192f9fc1b4f4a52e53358002b4aa17a53c91fadcc19215782b7b28a0f07486581b8347e13c67ee6bbd0832b73095c48593bd7

Download Submit
\Windows\system\tIMzacx.exe

Filesize
3.1MB

MD5
90b59d0cd70498eeefc125ff10ef4be0

SHA1
aeb6e23b4f955203c1ff3be8a61dd14f71973ccd

SHA256
983fb2307d9ca476a7af0be1529c5933f9e42bfd9eceb620c1dbb01394a59445

SHA512
656953bbd858c91098179f38c40221cf0146159733b6fada6829e4f9752fa16f1850025818eb9123e5dd632fc180f37aca09677e33af2cefc1649d3969090cde

Download Submit
\Windows\system\vBfBzbg.exe

Filesize
3.1MB

MD5
76e48fe37f018a9401e3a469a574606f

SHA1
95d5ff6741a0043011aed20fe4ac1dbb4a77091a

SHA256
93166abb266384e703b5f1d0d9ec6cb1ed7713807f1292b74bdcff13a798e61c

SHA512
c7c333b571a46533d5f22ac3f57762391b60360ccca759ff78128dd02f16f51fa24844fd55b7719875c90d64189275200f720cd0ec6feb4512b5becbb12afae1

Download Submit
\Windows\system\yhpeoim.exe

Filesize
3.1MB

MD5
095b3a8ab23e48a5648b5451635a39de

SHA1
8af90dfcc7b781dec0b06c05916568b2bf6e7af5

SHA256
a4df09a46b5caa467d2b2640d91a4f7f75fdd81e48d80bc5524b3c03004e3732

SHA512
9a1a9667494c6c8e2a8478acdab0298de678a036c02e28a7f9e6bb05052073f40d172afd34c69eb00163db3b47cb00cbe52f9af6727187ab1aa3bbadef86d913

Download Submit
memory/1468-124-0x000000013FEF0000-0x00000001402E6000-memory.dmp

Filesize
4.0MB

Download
memory/1708-136-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/2024-2841-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/2024-118-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/2100-15-0x000007FEF5D3E000-0x000007FEF5D3F000-memory.dmp

Filesize
4KB

Download
memory/2100-14-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2100-100-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2100-1301-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/2100-104-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2100-117-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/2100-139-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

Filesize
9.6MB

Download
memory/2232-131-0x000000013F6D0000-0x000000013FAC6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-125-0x0000000003180000-0x0000000003576000-memory.dmp

Filesize
4.0MB

Download
memory/2232-119-0x0000000003180000-0x0000000003576000-memory.dmp

Filesize
4.0MB

Download
memory/2232-2986-0x0000000003580000-0x0000000003976000-memory.dmp

Filesize
4.0MB

Download
memory/2232-121-0x000000013F8A0000-0x000000013FC96000-memory.dmp

Filesize
4.0MB

Download
memory/2232-0-0x000000013FDB0000-0x00000001401A6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-123-0x0000000003180000-0x0000000003576000-memory.dmp

Filesize
4.0MB

Download
memory/2232-133-0x000000013F140000-0x000000013F536000-memory.dmp

Filesize
4.0MB

Download
memory/2232-2336-0x000000013FDB0000-0x00000001401A6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-127-0x0000000003180000-0x0000000003576000-memory.dmp

Filesize
4.0MB

Download
memory/2232-6-0x000000013F8F0000-0x000000013FCE6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-137-0x0000000003580000-0x0000000003976000-memory.dmp

Filesize
4.0MB

Download
memory/2232-1-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2232-135-0x0000000003180000-0x0000000003576000-memory.dmp

Filesize
4.0MB

Download
memory/2232-129-0x000000013F540000-0x000000013F936000-memory.dmp

Filesize
4.0MB

Download
memory/2232-143-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/2452-130-0x000000013F540000-0x000000013F936000-memory.dmp

Filesize
4.0MB

Download
memory/2516-132-0x000000013F6D0000-0x000000013FAC6000-memory.dmp

Filesize
4.0MB

Download
memory/2552-128-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2552-4363-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2660-122-0x000000013F8A0000-0x000000013FC96000-memory.dmp

Filesize
4.0MB

Download
memory/2712-120-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/2772-138-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/2772-4387-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/2976-126-0x000000013FBA0000-0x000000013FF96000-memory.dmp

Filesize
4.0MB

Download
memory/2980-134-0x000000013F140000-0x000000013F536000-memory.dmp

Filesize
4.0MB

Download
memory/2980-4386-0x000000013F140000-0x000000013F536000-memory.dmp

Filesize
4.0MB

Download
memory/3060-13-0x000000013F8F0000-0x000000013FCE6000-memory.dmp

Filesize
4.0MB

Download
memory/3060-2662-0x000000013F8F0000-0x000000013FCE6000-memory.dmp

Filesize
4.0MB

Download