xmrig | 9ff10226f6a2857c101b288c0064766b0804ce806e76dfe5c11ef4693c058120

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
Size

3.1MB
MD5

876413258b4a9d6a7d79513d28a5afb0
SHA1

8d39d9d631c7a9c4d36d55a376587014fa1ea28e
SHA256

9ff10226f6a2857c101b288c0064766b0804ce806e76dfe5c11ef4693c058120
SHA512

ade03804659cb0676f026566a7bb278467fdd243a614cf22983f0994b7d6ede1020885a20e1bbb072472d0dbd6f430ef8b5f17615353f63a3b4ef9079aa99bae
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFkE

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral1/files/0x00050000000186e2-67.dat	xmrig
behavioral1/memory/2552-83-0x000000013F740000-0x000000013FB36000-memory.dmp	xmrig
behavioral1/files/0x000500000001872a-85.dat	xmrig
behavioral1/files/0x0006000000018b21-103.dat	xmrig
behavioral1/files/0x000500000001934b-159.dat	xmrig
behavioral1/files/0x000500000001942d-174.dat	xmrig
behavioral1/files/0x0005000000019450-184.dat	xmrig
behavioral1/memory/2248-820-0x000000013FC30000-0x0000000140026000-memory.dmp	xmrig
behavioral1/files/0x0005000000019487-194.dat	xmrig
behavioral1/files/0x000500000001945e-189.dat	xmrig
behavioral1/files/0x0005000000019442-179.dat	xmrig
behavioral1/files/0x0005000000019375-164.dat	xmrig
behavioral1/files/0x00050000000193fb-169.dat	xmrig
behavioral1/files/0x000500000001933f-154.dat	xmrig
behavioral1/files/0x0005000000019309-149.dat	xmrig
behavioral1/files/0x00050000000192f9-144.dat	xmrig
behavioral1/files/0x00050000000192d3-139.dat	xmrig
behavioral1/files/0x000500000001921d-134.dat	xmrig
behavioral1/files/0x0005000000019215-129.dat	xmrig
behavioral1/files/0x0006000000018bf9-124.dat	xmrig
behavioral1/files/0x0006000000018b79-113.dat	xmrig
behavioral1/files/0x0006000000018b7d-118.dat	xmrig
behavioral1/files/0x0006000000018b63-108.dat	xmrig
behavioral1/memory/2400-100-0x000000013FE10000-0x0000000140206000-memory.dmp	xmrig
behavioral1/memory/2976-97-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig
behavioral1/memory/884-88-0x000000013F2B0000-0x000000013F6A6000-memory.dmp	xmrig
behavioral1/files/0x0005000000018735-94.dat	xmrig
behavioral1/memory/1508-87-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	xmrig
behavioral1/memory/2512-74-0x000000013F8B0000-0x000000013FCA6000-memory.dmp	xmrig
behavioral1/memory/2608-72-0x000000013FF60000-0x0000000140356000-memory.dmp	xmrig
behavioral1/memory/2504-63-0x000000013F740000-0x000000013FB36000-memory.dmp	xmrig
behavioral1/memory/2524-70-0x000000013FB60000-0x000000013FF56000-memory.dmp	xmrig
behavioral1/files/0x00050000000186e0-60.dat	xmrig
behavioral1/files/0x0009000000016d0a-51.dat	xmrig
behavioral1/files/0x0009000000016d0f-57.dat	xmrig
behavioral1/files/0x0007000000016cfe-46.dat	xmrig
behavioral1/files/0x000b000000016c76-41.dat	xmrig
behavioral1/files/0x0008000000016cf8-38.dat	xmrig
behavioral1/memory/2736-31-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/files/0x000b000000003d5f-29.dat	xmrig
behavioral1/memory/2256-19-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig
behavioral1/files/0x0009000000016cdc-10.dat	xmrig
behavioral1/memory/2340-18-0x000000013F410000-0x000000013F806000-memory.dmp	xmrig
behavioral1/files/0x002c000000016c2a-12.dat	xmrig
behavioral1/files/0x000c00000001227e-6.dat	xmrig
behavioral1/memory/2248-1-0x000000013FC30000-0x0000000140026000-memory.dmp	xmrig
behavioral1/memory/2256-1553-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig
behavioral1/memory/2340-1552-0x000000013F410000-0x000000013F806000-memory.dmp	xmrig
behavioral1/memory/2736-1559-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/memory/2504-1566-0x000000013F740000-0x000000013FB36000-memory.dmp	xmrig
behavioral1/memory/2608-1779-0x000000013FF60000-0x0000000140356000-memory.dmp	xmrig
behavioral1/memory/2524-1782-0x000000013FB60000-0x000000013FF56000-memory.dmp	xmrig
behavioral1/memory/2512-1783-0x000000013F8B0000-0x000000013FCA6000-memory.dmp	xmrig
behavioral1/memory/1508-1813-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	xmrig
behavioral1/memory/2400-1829-0x000000013FE10000-0x0000000140206000-memory.dmp	xmrig
behavioral1/memory/884-1849-0x000000013F2B0000-0x000000013F6A6000-memory.dmp	xmrig
behavioral1/memory/2976-1817-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig
behavioral1/memory/2552-1812-0x000000013F740000-0x000000013FB36000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2200	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2340	ANLgPjG.exe
2256	dNdqppm.exe
2736	GlEtpjw.exe
2504	jTWksMX.exe
2524	ZIPgabw.exe
2608	nuQreZA.exe
2512	uMVXfxd.exe
2552	xnCVNit.exe
2976	IqjPtGl.exe
1508	cIiTExn.exe
884	XzNZCsF.exe
2400	jfjxMup.exe
2776	QmxEBDe.exe
804	ymvNvWo.exe
1860	eHyetLN.exe
1032	tylehQD.exe
1684	wJPUCJB.exe
2192	KsQmcxH.exe
2596	PIGmqOF.exe
2804	IUZrUlS.exe
960	eLQLGUx.exe
956	QYRSRPO.exe
2592	qRmkeBd.exe
1940	NwCIkjP.exe
2068	XhOYunJ.exe
592	flOPEKx.exe
2936	saXnbBj.exe
1700	uuXDfBD.exe
2092	fdHfSzU.exe
992	EtooPgP.exe
2144	XGtNBBg.exe
1116	JDDzemL.exe
1976	jmogfyY.exe
3056	hyctPzv.exe
984	uvYXQHe.exe
2272	cqJSMcZ.exe
1880	JIboIWc.exe
688	kLyOlxv.exe
1796	QjYAlMn.exe
1800	ifJngsJ.exe
860	gkxKxWz.exe
2344	UKFWbfJ.exe
1828	LxgbQfX.exe
2472	MoSifSk.exe
2948	QVvOdnI.exe
580	FYYggeB.exe
1592	GXeVsLo.exe
1360	UFmeLFN.exe
1260	PHIiYki.exe
2424	xjjPsmJ.exe
2108	RWGKzyn.exe
1924	ciBEeWM.exe
1624	JjMOPTc.exe
1628	TTrcWss.exe
2624	AgfwHcR.exe
2648	IdzwBcQ.exe
2756	CyiOgxC.exe
2980	hmxiqYD.exe
844	huAZNpg.exe
2556	smfhUMS.exe
2496	RxcAsfT.exe
2988	WAJhfEJ.exe
640	xkdKWqm.exe
2884	fNkSMig.exe

Loads dropped DLL 64 IoCs

pid	Process
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000186e2-67.dat	upx
behavioral1/memory/2552-83-0x000000013F740000-0x000000013FB36000-memory.dmp	upx
behavioral1/files/0x000500000001872a-85.dat	upx
behavioral1/files/0x0006000000018b21-103.dat	upx
behavioral1/files/0x000500000001934b-159.dat	upx
behavioral1/files/0x000500000001942d-174.dat	upx
behavioral1/files/0x0005000000019450-184.dat	upx
behavioral1/memory/2248-820-0x000000013FC30000-0x0000000140026000-memory.dmp	upx
behavioral1/files/0x0005000000019487-194.dat	upx
behavioral1/files/0x000500000001945e-189.dat	upx
behavioral1/files/0x0005000000019442-179.dat	upx
behavioral1/files/0x0005000000019375-164.dat	upx
behavioral1/files/0x00050000000193fb-169.dat	upx
behavioral1/files/0x000500000001933f-154.dat	upx
behavioral1/files/0x0005000000019309-149.dat	upx
behavioral1/files/0x00050000000192f9-144.dat	upx
behavioral1/files/0x00050000000192d3-139.dat	upx
behavioral1/files/0x000500000001921d-134.dat	upx
behavioral1/files/0x0005000000019215-129.dat	upx
behavioral1/files/0x0006000000018bf9-124.dat	upx
behavioral1/files/0x0006000000018b79-113.dat	upx
behavioral1/files/0x0006000000018b7d-118.dat	upx
behavioral1/files/0x0006000000018b63-108.dat	upx
behavioral1/memory/2400-100-0x000000013FE10000-0x0000000140206000-memory.dmp	upx
behavioral1/memory/2976-97-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx
behavioral1/memory/884-88-0x000000013F2B0000-0x000000013F6A6000-memory.dmp	upx
behavioral1/files/0x0005000000018735-94.dat	upx
behavioral1/memory/1508-87-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	upx
behavioral1/memory/2512-74-0x000000013F8B0000-0x000000013FCA6000-memory.dmp	upx
behavioral1/memory/2608-72-0x000000013FF60000-0x0000000140356000-memory.dmp	upx
behavioral1/memory/2504-63-0x000000013F740000-0x000000013FB36000-memory.dmp	upx
behavioral1/memory/2524-70-0x000000013FB60000-0x000000013FF56000-memory.dmp	upx
behavioral1/files/0x00050000000186e0-60.dat	upx
behavioral1/files/0x0009000000016d0a-51.dat	upx
behavioral1/files/0x0009000000016d0f-57.dat	upx
behavioral1/files/0x0007000000016cfe-46.dat	upx
behavioral1/files/0x000b000000016c76-41.dat	upx
behavioral1/files/0x0008000000016cf8-38.dat	upx
behavioral1/memory/2736-31-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/files/0x000b000000003d5f-29.dat	upx
behavioral1/memory/2256-19-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	upx
behavioral1/files/0x0009000000016cdc-10.dat	upx
behavioral1/memory/2340-18-0x000000013F410000-0x000000013F806000-memory.dmp	upx
behavioral1/files/0x002c000000016c2a-12.dat	upx
behavioral1/files/0x000c00000001227e-6.dat	upx
behavioral1/memory/2248-1-0x000000013FC30000-0x0000000140026000-memory.dmp	upx
behavioral1/memory/2256-1553-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	upx
behavioral1/memory/2340-1552-0x000000013F410000-0x000000013F806000-memory.dmp	upx
behavioral1/memory/2736-1559-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/memory/2504-1566-0x000000013F740000-0x000000013FB36000-memory.dmp	upx
behavioral1/memory/2608-1779-0x000000013FF60000-0x0000000140356000-memory.dmp	upx
behavioral1/memory/2524-1782-0x000000013FB60000-0x000000013FF56000-memory.dmp	upx
behavioral1/memory/2512-1783-0x000000013F8B0000-0x000000013FCA6000-memory.dmp	upx
behavioral1/memory/1508-1813-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	upx
behavioral1/memory/2400-1829-0x000000013FE10000-0x0000000140206000-memory.dmp	upx
behavioral1/memory/884-1849-0x000000013F2B0000-0x000000013F6A6000-memory.dmp	upx
behavioral1/memory/2976-1817-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx
behavioral1/memory/2552-1812-0x000000013F740000-0x000000013FB36000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tobtccE.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\CQsPCDj.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ORQrvEb.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\rKVBgoI.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\XUMiVRs.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\EuDGXxm.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\JaPxMzC.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\EjhldCN.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\wDGfAXX.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\AQsWeMP.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\DMWjBcJ.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\zsgJGxM.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\MxbfCtn.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\McVsMbx.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\CWiVNAS.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\lwfMUmY.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\dYkDKZF.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\MjlYGvC.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\bANXqyQ.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\CiKGehk.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\eGGsGSK.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ThniywS.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\vmPEeHX.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\hzjRDAr.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\DdmJZPv.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\exxoDQX.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\gRhFNwN.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\mveayqE.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\jfjxMup.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZtJUyyn.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\TnlndSr.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ubfyHtP.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\NeGKmtE.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\fryXnEq.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\UXKBpBn.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\UAlNCye.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\NCRxvfF.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\CYmiRsI.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\kHGaofM.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\FDJMmpj.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\BTMdkLv.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ioVRjAy.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\uWigexE.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\CtobyMq.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\FdoViYu.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\jsnZjqY.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\tgIuXPH.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\LUmGLfo.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\TuqMXWy.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\EQnONkN.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZuwgmUn.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\QYRSRPO.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\hmxiqYD.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\tdhoawl.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\xzOKLzx.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZBUTeJz.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\gGtHEKg.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\uvulRlJ.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ViwtREf.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\rgPnNgl.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\GbYfKDE.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\JRHCDYf.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\dsxnHRs.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\xdAmAap.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeLockMemoryPrivilege	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2200	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	29
PID 2248 wrote to memory of 2200	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	29
PID 2248 wrote to memory of 2200	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	29
PID 2248 wrote to memory of 2340	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	30
PID 2248 wrote to memory of 2340	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	30
PID 2248 wrote to memory of 2340	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	30
PID 2248 wrote to memory of 2256	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	31
PID 2248 wrote to memory of 2256	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	31
PID 2248 wrote to memory of 2256	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	31
PID 2248 wrote to memory of 2736	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	32
PID 2248 wrote to memory of 2736	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	32
PID 2248 wrote to memory of 2736	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	32
PID 2248 wrote to memory of 2504	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	33
PID 2248 wrote to memory of 2504	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	33
PID 2248 wrote to memory of 2504	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	33
PID 2248 wrote to memory of 2524	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	34
PID 2248 wrote to memory of 2524	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	34
PID 2248 wrote to memory of 2524	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	34
PID 2248 wrote to memory of 2608	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	35
PID 2248 wrote to memory of 2608	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	35
PID 2248 wrote to memory of 2608	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	35
PID 2248 wrote to memory of 2512	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	36
PID 2248 wrote to memory of 2512	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	36
PID 2248 wrote to memory of 2512	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	36
PID 2248 wrote to memory of 2976	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	37
PID 2248 wrote to memory of 2976	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	37
PID 2248 wrote to memory of 2976	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	37
PID 2248 wrote to memory of 2552	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	38
PID 2248 wrote to memory of 2552	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	38
PID 2248 wrote to memory of 2552	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	38
PID 2248 wrote to memory of 884	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	39
PID 2248 wrote to memory of 884	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	39
PID 2248 wrote to memory of 884	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	39
PID 2248 wrote to memory of 1508	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	40
PID 2248 wrote to memory of 1508	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	40
PID 2248 wrote to memory of 1508	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	40
PID 2248 wrote to memory of 2400	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	41
PID 2248 wrote to memory of 2400	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	41
PID 2248 wrote to memory of 2400	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	41
PID 2248 wrote to memory of 2776	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	42
PID 2248 wrote to memory of 2776	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	42
PID 2248 wrote to memory of 2776	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	42
PID 2248 wrote to memory of 804	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	43
PID 2248 wrote to memory of 804	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	43
PID 2248 wrote to memory of 804	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	43
PID 2248 wrote to memory of 1860	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	44
PID 2248 wrote to memory of 1860	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	44
PID 2248 wrote to memory of 1860	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	44
PID 2248 wrote to memory of 1032	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	45
PID 2248 wrote to memory of 1032	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	45
PID 2248 wrote to memory of 1032	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	45
PID 2248 wrote to memory of 1684	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	46
PID 2248 wrote to memory of 1684	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	46
PID 2248 wrote to memory of 1684	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	46
PID 2248 wrote to memory of 2192	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	47
PID 2248 wrote to memory of 2192	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	47
PID 2248 wrote to memory of 2192	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	47
PID 2248 wrote to memory of 2596	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	48
PID 2248 wrote to memory of 2596	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	48
PID 2248 wrote to memory of 2596	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	48
PID 2248 wrote to memory of 2804	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	49
PID 2248 wrote to memory of 2804	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	49
PID 2248 wrote to memory of 2804	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	49
PID 2248 wrote to memory of 960	2248	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	50

C:\Windows\System32\sj0mxx.exe
"C:\Windows\System32\sj0mxx.exe"
1⤵
PID:1596
- C:\Users\Admin\AppData\Local\Temp\3942292029\zmstage.exe
  C:\Users\Admin\AppData\Local\Temp\3942292029\zmstage.exe
  2⤵
  PID:3064

C:\Users\Admin\AppData\Local\Temp\876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System\ANLgPjG.exe
  C:\Windows\System\ANLgPjG.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\dNdqppm.exe
  C:\Windows\System\dNdqppm.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\GlEtpjw.exe
  C:\Windows\System\GlEtpjw.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\jTWksMX.exe
  C:\Windows\System\jTWksMX.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ZIPgabw.exe
  C:\Windows\System\ZIPgabw.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\nuQreZA.exe
  C:\Windows\System\nuQreZA.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\uMVXfxd.exe
  C:\Windows\System\uMVXfxd.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\IqjPtGl.exe
  C:\Windows\System\IqjPtGl.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\xnCVNit.exe
  C:\Windows\System\xnCVNit.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\XzNZCsF.exe
  C:\Windows\System\XzNZCsF.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\cIiTExn.exe
  C:\Windows\System\cIiTExn.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\jfjxMup.exe
  C:\Windows\System\jfjxMup.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\QmxEBDe.exe
  C:\Windows\System\QmxEBDe.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\ymvNvWo.exe
  C:\Windows\System\ymvNvWo.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\eHyetLN.exe
  C:\Windows\System\eHyetLN.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\tylehQD.exe
  C:\Windows\System\tylehQD.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\wJPUCJB.exe
  C:\Windows\System\wJPUCJB.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\KsQmcxH.exe
  C:\Windows\System\KsQmcxH.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\PIGmqOF.exe
  C:\Windows\System\PIGmqOF.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\IUZrUlS.exe
  C:\Windows\System\IUZrUlS.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\eLQLGUx.exe
  C:\Windows\System\eLQLGUx.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\QYRSRPO.exe
  C:\Windows\System\QYRSRPO.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\qRmkeBd.exe
  C:\Windows\System\qRmkeBd.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\NwCIkjP.exe
  C:\Windows\System\NwCIkjP.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\XhOYunJ.exe
  C:\Windows\System\XhOYunJ.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\flOPEKx.exe
  C:\Windows\System\flOPEKx.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\saXnbBj.exe
  C:\Windows\System\saXnbBj.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\uuXDfBD.exe
  C:\Windows\System\uuXDfBD.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\fdHfSzU.exe
  C:\Windows\System\fdHfSzU.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\EtooPgP.exe
  C:\Windows\System\EtooPgP.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\XGtNBBg.exe
  C:\Windows\System\XGtNBBg.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\JDDzemL.exe
  C:\Windows\System\JDDzemL.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\jmogfyY.exe
  C:\Windows\System\jmogfyY.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\uvYXQHe.exe
  C:\Windows\System\uvYXQHe.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\hyctPzv.exe
  C:\Windows\System\hyctPzv.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\cqJSMcZ.exe
  C:\Windows\System\cqJSMcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\JIboIWc.exe
  C:\Windows\System\JIboIWc.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\kLyOlxv.exe
  C:\Windows\System\kLyOlxv.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\QjYAlMn.exe
  C:\Windows\System\QjYAlMn.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\ifJngsJ.exe
  C:\Windows\System\ifJngsJ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\gkxKxWz.exe
  C:\Windows\System\gkxKxWz.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\UKFWbfJ.exe
  C:\Windows\System\UKFWbfJ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\LxgbQfX.exe
  C:\Windows\System\LxgbQfX.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\MoSifSk.exe
  C:\Windows\System\MoSifSk.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\QVvOdnI.exe
  C:\Windows\System\QVvOdnI.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\FYYggeB.exe
  C:\Windows\System\FYYggeB.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\GXeVsLo.exe
  C:\Windows\System\GXeVsLo.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\UFmeLFN.exe
  C:\Windows\System\UFmeLFN.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\PHIiYki.exe
  C:\Windows\System\PHIiYki.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\xjjPsmJ.exe
  C:\Windows\System\xjjPsmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\RWGKzyn.exe
  C:\Windows\System\RWGKzyn.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\ciBEeWM.exe
  C:\Windows\System\ciBEeWM.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\JjMOPTc.exe
  C:\Windows\System\JjMOPTc.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\TTrcWss.exe
  C:\Windows\System\TTrcWss.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\AgfwHcR.exe
  C:\Windows\System\AgfwHcR.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\IdzwBcQ.exe
  C:\Windows\System\IdzwBcQ.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\CyiOgxC.exe
  C:\Windows\System\CyiOgxC.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\hmxiqYD.exe
  C:\Windows\System\hmxiqYD.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\huAZNpg.exe
  C:\Windows\System\huAZNpg.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\smfhUMS.exe
  C:\Windows\System\smfhUMS.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\RxcAsfT.exe
  C:\Windows\System\RxcAsfT.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\WAJhfEJ.exe
  C:\Windows\System\WAJhfEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\xkdKWqm.exe
  C:\Windows\System\xkdKWqm.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\fNkSMig.exe
  C:\Windows\System\fNkSMig.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\YGLmDnB.exe
  C:\Windows\System\YGLmDnB.exe
  2⤵
  PID:1396
- C:\Windows\System\aAfzjeK.exe
  C:\Windows\System\aAfzjeK.exe
  2⤵
  PID:2000
- C:\Windows\System\MoiJlWe.exe
  C:\Windows\System\MoiJlWe.exe
  2⤵
  PID:1136
- C:\Windows\System\AtRODJi.exe
  C:\Windows\System\AtRODJi.exe
  2⤵
  PID:1720
- C:\Windows\System\Dscbktb.exe
  C:\Windows\System\Dscbktb.exe
  2⤵
  PID:2792
- C:\Windows\System\IoJeouy.exe
  C:\Windows\System\IoJeouy.exe
  2⤵
  PID:1040
- C:\Windows\System\BTMdkLv.exe
  C:\Windows\System\BTMdkLv.exe
  2⤵
  PID:1692
- C:\Windows\System\mXHNSwT.exe
  C:\Windows\System\mXHNSwT.exe
  2⤵
  PID:684
- C:\Windows\System\qiDYykk.exe
  C:\Windows\System\qiDYykk.exe
  2⤵
  PID:1476
- C:\Windows\System\drQAYYd.exe
  C:\Windows\System\drQAYYd.exe
  2⤵
  PID:2120
- C:\Windows\System\kLzljUN.exe
  C:\Windows\System\kLzljUN.exe
  2⤵
  PID:780
- C:\Windows\System\DXOzOvJ.exe
  C:\Windows\System\DXOzOvJ.exe
  2⤵
  PID:2376
- C:\Windows\System\MmjMJkJ.exe
  C:\Windows\System\MmjMJkJ.exe
  2⤵
  PID:1364
- C:\Windows\System\PeBFhcV.exe
  C:\Windows\System\PeBFhcV.exe
  2⤵
  PID:852
- C:\Windows\System\DlhTlkZ.exe
  C:\Windows\System\DlhTlkZ.exe
  2⤵
  PID:1732
- C:\Windows\System\wiiPuXj.exe
  C:\Windows\System\wiiPuXj.exe
  2⤵
  PID:772
- C:\Windows\System\wuaonoX.exe
  C:\Windows\System\wuaonoX.exe
  2⤵
  PID:908
- C:\Windows\System\sJmxuaU.exe
  C:\Windows\System\sJmxuaU.exe
  2⤵
  PID:1304
- C:\Windows\System\ETKlxEC.exe
  C:\Windows\System\ETKlxEC.exe
  2⤵
  PID:1064
- C:\Windows\System\IRWJyif.exe
  C:\Windows\System\IRWJyif.exe
  2⤵
  PID:2780
- C:\Windows\System\MCbecLb.exe
  C:\Windows\System\MCbecLb.exe
  2⤵
  PID:112
- C:\Windows\System\yLpwcrI.exe
  C:\Windows\System\yLpwcrI.exe
  2⤵
  PID:1556
- C:\Windows\System\eVIuESQ.exe
  C:\Windows\System\eVIuESQ.exe
  2⤵
  PID:3068
- C:\Windows\System\PwuTWBd.exe
  C:\Windows\System\PwuTWBd.exe
  2⤵
  PID:1148
- C:\Windows\System\gdQDNgQ.exe
  C:\Windows\System\gdQDNgQ.exe
  2⤵
  PID:2360
- C:\Windows\System\HYJlMdW.exe
  C:\Windows\System\HYJlMdW.exe
  2⤵
  PID:2040
- C:\Windows\System\axNjUqS.exe
  C:\Windows\System\axNjUqS.exe
  2⤵
  PID:2720
- C:\Windows\System\TueJmWg.exe
  C:\Windows\System\TueJmWg.exe
  2⤵
  PID:1208
- C:\Windows\System\wIZQrNn.exe
  C:\Windows\System\wIZQrNn.exe
  2⤵
  PID:2632
- C:\Windows\System\KZjHyxN.exe
  C:\Windows\System\KZjHyxN.exe
  2⤵
  PID:2404
- C:\Windows\System\FFyVudE.exe
  C:\Windows\System\FFyVudE.exe
  2⤵
  PID:2836
- C:\Windows\System\XJbMgVD.exe
  C:\Windows\System\XJbMgVD.exe
  2⤵
  PID:2696
- C:\Windows\System\NuYZeCA.exe
  C:\Windows\System\NuYZeCA.exe
  2⤵
  PID:2160
- C:\Windows\System\uxEQdYJ.exe
  C:\Windows\System\uxEQdYJ.exe
  2⤵
  PID:2216
- C:\Windows\System\agsqASc.exe
  C:\Windows\System\agsqASc.exe
  2⤵
  PID:816
- C:\Windows\System\gvULegh.exe
  C:\Windows\System\gvULegh.exe
  2⤵
  PID:1712
- C:\Windows\System\QmnxrrY.exe
  C:\Windows\System\QmnxrrY.exe
  2⤵
  PID:320
- C:\Windows\System\bxTBCKX.exe
  C:\Windows\System\bxTBCKX.exe
  2⤵
  PID:1332
- C:\Windows\System\rWIvSHY.exe
  C:\Windows\System\rWIvSHY.exe
  2⤵
  PID:2960
- C:\Windows\System\nQzEVmO.exe
  C:\Windows\System\nQzEVmO.exe
  2⤵
  PID:612
- C:\Windows\System\IQVOXlR.exe
  C:\Windows\System\IQVOXlR.exe
  2⤵
  PID:1584
- C:\Windows\System\bjbwXLB.exe
  C:\Windows\System\bjbwXLB.exe
  2⤵
  PID:1060
- C:\Windows\System\IGADFEd.exe
  C:\Windows\System\IGADFEd.exe
  2⤵
  PID:968
- C:\Windows\System\soYJSVw.exe
  C:\Windows\System\soYJSVw.exe
  2⤵
  PID:2912
- C:\Windows\System\vNqKJFp.exe
  C:\Windows\System\vNqKJFp.exe
  2⤵
  PID:2952
- C:\Windows\System\ioVRjAy.exe
  C:\Windows\System\ioVRjAy.exe
  2⤵
  PID:1392
- C:\Windows\System\KsBxTMC.exe
  C:\Windows\System\KsBxTMC.exe
  2⤵
  PID:1536
- C:\Windows\System\vLWVHum.exe
  C:\Windows\System\vLWVHum.exe
  2⤵
  PID:2888
- C:\Windows\System\xaLCfnp.exe
  C:\Windows\System\xaLCfnp.exe
  2⤵
  PID:2588
- C:\Windows\System\GQWNewY.exe
  C:\Windows\System\GQWNewY.exe
  2⤵
  PID:2800
- C:\Windows\System\sNgWiwG.exe
  C:\Windows\System\sNgWiwG.exe
  2⤵
  PID:2600
- C:\Windows\System\pFmqXTW.exe
  C:\Windows\System\pFmqXTW.exe
  2⤵
  PID:2852
- C:\Windows\System\UTOjfYf.exe
  C:\Windows\System\UTOjfYf.exe
  2⤵
  PID:2644
- C:\Windows\System\GoslnrP.exe
  C:\Windows\System\GoslnrP.exe
  2⤵
  PID:2672
- C:\Windows\System\otMyWLm.exe
  C:\Windows\System\otMyWLm.exe
  2⤵
  PID:2640
- C:\Windows\System\KZEGKHd.exe
  C:\Windows\System\KZEGKHd.exe
  2⤵
  PID:1752
- C:\Windows\System\MDuhXvM.exe
  C:\Windows\System\MDuhXvM.exe
  2⤵
  PID:2656
- C:\Windows\System\yzrCACr.exe
  C:\Windows\System\yzrCACr.exe
  2⤵
  PID:2740
- C:\Windows\System\fvNHock.exe
  C:\Windows\System\fvNHock.exe
  2⤵
  PID:2372
- C:\Windows\System\RvIoczm.exe
  C:\Windows\System\RvIoczm.exe
  2⤵
  PID:3084
- C:\Windows\System\gEypgKI.exe
  C:\Windows\System\gEypgKI.exe
  2⤵
  PID:3104
- C:\Windows\System\olCeczz.exe
  C:\Windows\System\olCeczz.exe
  2⤵
  PID:3124
- C:\Windows\System\pBXRhBw.exe
  C:\Windows\System\pBXRhBw.exe
  2⤵
  PID:3144
- C:\Windows\System\dxvZfYc.exe
  C:\Windows\System\dxvZfYc.exe
  2⤵
  PID:3164
- C:\Windows\System\YQriRXl.exe
  C:\Windows\System\YQriRXl.exe
  2⤵
  PID:3184
- C:\Windows\System\FdXlzfc.exe
  C:\Windows\System\FdXlzfc.exe
  2⤵
  PID:3204
- C:\Windows\System\TKQaSeZ.exe
  C:\Windows\System\TKQaSeZ.exe
  2⤵
  PID:3224
- C:\Windows\System\iAZCsVj.exe
  C:\Windows\System\iAZCsVj.exe
  2⤵
  PID:3244
- C:\Windows\System\TkjyedD.exe
  C:\Windows\System\TkjyedD.exe
  2⤵
  PID:3260
- C:\Windows\System\aozQovi.exe
  C:\Windows\System\aozQovi.exe
  2⤵
  PID:3284
- C:\Windows\System\gDyZHsX.exe
  C:\Windows\System\gDyZHsX.exe
  2⤵
  PID:3300
- C:\Windows\System\eQzqCuC.exe
  C:\Windows\System\eQzqCuC.exe
  2⤵
  PID:3324
- C:\Windows\System\uuyqpUR.exe
  C:\Windows\System\uuyqpUR.exe
  2⤵
  PID:3344
- C:\Windows\System\ieZAyaB.exe
  C:\Windows\System\ieZAyaB.exe
  2⤵
  PID:3364
- C:\Windows\System\iaWEWLA.exe
  C:\Windows\System\iaWEWLA.exe
  2⤵
  PID:3380
- C:\Windows\System\vbCQlId.exe
  C:\Windows\System\vbCQlId.exe
  2⤵
  PID:3404
- C:\Windows\System\SerwJKA.exe
  C:\Windows\System\SerwJKA.exe
  2⤵
  PID:3428
- C:\Windows\System\cTQfFAq.exe
  C:\Windows\System\cTQfFAq.exe
  2⤵
  PID:3452
- C:\Windows\System\pFQuask.exe
  C:\Windows\System\pFQuask.exe
  2⤵
  PID:3472
- C:\Windows\System\QappALQ.exe
  C:\Windows\System\QappALQ.exe
  2⤵
  PID:3492
- C:\Windows\System\zkpDhOr.exe
  C:\Windows\System\zkpDhOr.exe
  2⤵
  PID:3508
- C:\Windows\System\oWqkkpC.exe
  C:\Windows\System\oWqkkpC.exe
  2⤵
  PID:3532
- C:\Windows\System\WidtAHK.exe
  C:\Windows\System\WidtAHK.exe
  2⤵
  PID:3552
- C:\Windows\System\nyPuNve.exe
  C:\Windows\System\nyPuNve.exe
  2⤵
  PID:3572
- C:\Windows\System\ETtBGbq.exe
  C:\Windows\System\ETtBGbq.exe
  2⤵
  PID:3588
- C:\Windows\System\bDepcLo.exe
  C:\Windows\System\bDepcLo.exe
  2⤵
  PID:3612
- C:\Windows\System\GOvRsDV.exe
  C:\Windows\System\GOvRsDV.exe
  2⤵
  PID:3628
- C:\Windows\System\HzVOPpY.exe
  C:\Windows\System\HzVOPpY.exe
  2⤵
  PID:3652
- C:\Windows\System\VTOgxcW.exe
  C:\Windows\System\VTOgxcW.exe
  2⤵
  PID:3668
- C:\Windows\System\oznzYlf.exe
  C:\Windows\System\oznzYlf.exe
  2⤵
  PID:3688
- C:\Windows\System\hDhogAu.exe
  C:\Windows\System\hDhogAu.exe
  2⤵
  PID:3708
- C:\Windows\System\noeVLzk.exe
  C:\Windows\System\noeVLzk.exe
  2⤵
  PID:3732
- C:\Windows\System\KrFsrxa.exe
  C:\Windows\System\KrFsrxa.exe
  2⤵
  PID:3748
- C:\Windows\System\EouRfCK.exe
  C:\Windows\System\EouRfCK.exe
  2⤵
  PID:3772
- C:\Windows\System\LZByvgy.exe
  C:\Windows\System\LZByvgy.exe
  2⤵
  PID:3788
- C:\Windows\System\ymJdJyH.exe
  C:\Windows\System\ymJdJyH.exe
  2⤵
  PID:3808
- C:\Windows\System\KSUxrBe.exe
  C:\Windows\System\KSUxrBe.exe
  2⤵
  PID:3828
- C:\Windows\System\sPKyhuF.exe
  C:\Windows\System\sPKyhuF.exe
  2⤵
  PID:3852
- C:\Windows\System\olafgmR.exe
  C:\Windows\System\olafgmR.exe
  2⤵
  PID:3872
- C:\Windows\System\rVgCGAP.exe
  C:\Windows\System\rVgCGAP.exe
  2⤵
  PID:3892
- C:\Windows\System\VLZGHJE.exe
  C:\Windows\System\VLZGHJE.exe
  2⤵
  PID:3912
- C:\Windows\System\zTiedxU.exe
  C:\Windows\System\zTiedxU.exe
  2⤵
  PID:3936
- C:\Windows\System\uWigexE.exe
  C:\Windows\System\uWigexE.exe
  2⤵
  PID:3956
- C:\Windows\System\yUnilkL.exe
  C:\Windows\System\yUnilkL.exe
  2⤵
  PID:3976
- C:\Windows\System\AhKAuzR.exe
  C:\Windows\System\AhKAuzR.exe
  2⤵
  PID:3996
- C:\Windows\System\QbPevbJ.exe
  C:\Windows\System\QbPevbJ.exe
  2⤵
  PID:4016
- C:\Windows\System\bSWoRix.exe
  C:\Windows\System\bSWoRix.exe
  2⤵
  PID:4032
- C:\Windows\System\LJevjTH.exe
  C:\Windows\System\LJevjTH.exe
  2⤵
  PID:4056
- C:\Windows\System\EkvSIQG.exe
  C:\Windows\System\EkvSIQG.exe
  2⤵
  PID:4072
- C:\Windows\System\uqHoMyd.exe
  C:\Windows\System\uqHoMyd.exe
  2⤵
  PID:2024
- C:\Windows\System\RTMzzjW.exe
  C:\Windows\System\RTMzzjW.exe
  2⤵
  PID:2236
- C:\Windows\System\EgUdCpb.exe
  C:\Windows\System\EgUdCpb.exe
  2⤵
  PID:1120
- C:\Windows\System\ObXQIQy.exe
  C:\Windows\System\ObXQIQy.exe
  2⤵
  PID:2716
- C:\Windows\System\cUQQvwI.exe
  C:\Windows\System\cUQQvwI.exe
  2⤵
  PID:1580
- C:\Windows\System\hfoClQZ.exe
  C:\Windows\System\hfoClQZ.exe
  2⤵
  PID:1656
- C:\Windows\System\OprOxrm.exe
  C:\Windows\System\OprOxrm.exe
  2⤵
  PID:1316
- C:\Windows\System\IyMQSve.exe
  C:\Windows\System\IyMQSve.exe
  2⤵
  PID:964
- C:\Windows\System\BrpEmCh.exe
  C:\Windows\System\BrpEmCh.exe
  2⤵
  PID:3032
- C:\Windows\System\UfdfrFz.exe
  C:\Windows\System\UfdfrFz.exe
  2⤵
  PID:2368
- C:\Windows\System\MsQFcTq.exe
  C:\Windows\System\MsQFcTq.exe
  2⤵
  PID:560
- C:\Windows\System\ldrbUtq.exe
  C:\Windows\System\ldrbUtq.exe
  2⤵
  PID:3120
- C:\Windows\System\ZLUaKAB.exe
  C:\Windows\System\ZLUaKAB.exe
  2⤵
  PID:3100
- C:\Windows\System\ICwyeVJ.exe
  C:\Windows\System\ICwyeVJ.exe
  2⤵
  PID:3156
- C:\Windows\System\hWfpGZK.exe
  C:\Windows\System\hWfpGZK.exe
  2⤵
  PID:3176
- C:\Windows\System\xdAmAap.exe
  C:\Windows\System\xdAmAap.exe
  2⤵
  PID:3240
- C:\Windows\System\psHcOZP.exe
  C:\Windows\System\psHcOZP.exe
  2⤵
  PID:3212
- C:\Windows\System\gkdRaQs.exe
  C:\Windows\System\gkdRaQs.exe
  2⤵
  PID:3308
- C:\Windows\System\pcshKjk.exe
  C:\Windows\System\pcshKjk.exe
  2⤵
  PID:3336
- C:\Windows\System\vsXZUBM.exe
  C:\Windows\System\vsXZUBM.exe
  2⤵
  PID:3360
- C:\Windows\System\SiLrECt.exe
  C:\Windows\System\SiLrECt.exe
  2⤵
  PID:3340
- C:\Windows\System\IfzvhTs.exe
  C:\Windows\System\IfzvhTs.exe
  2⤵
  PID:3416
- C:\Windows\System\rRVcLJn.exe
  C:\Windows\System\rRVcLJn.exe
  2⤵
  PID:3480
- C:\Windows\System\FzFZPpo.exe
  C:\Windows\System\FzFZPpo.exe
  2⤵
  PID:3520
- C:\Windows\System\iVOgluJ.exe
  C:\Windows\System\iVOgluJ.exe
  2⤵
  PID:3500
- C:\Windows\System\CUGTPYS.exe
  C:\Windows\System\CUGTPYS.exe
  2⤵
  PID:3540
- C:\Windows\System\ngcQGpV.exe
  C:\Windows\System\ngcQGpV.exe
  2⤵
  PID:3600
- C:\Windows\System\WDRdJYt.exe
  C:\Windows\System\WDRdJYt.exe
  2⤵
  PID:3636
- C:\Windows\System\MsFAsZx.exe
  C:\Windows\System\MsFAsZx.exe
  2⤵
  PID:3584
- C:\Windows\System\KPgikcg.exe
  C:\Windows\System\KPgikcg.exe
  2⤵
  PID:3660
- C:\Windows\System\apWnWse.exe
  C:\Windows\System\apWnWse.exe
  2⤵
  PID:3696
- C:\Windows\System\BECsMGE.exe
  C:\Windows\System\BECsMGE.exe
  2⤵
  PID:3768
- C:\Windows\System\tNQrGIY.exe
  C:\Windows\System\tNQrGIY.exe
  2⤵
  PID:3800
- C:\Windows\System\CqIjCzS.exe
  C:\Windows\System\CqIjCzS.exe
  2⤵
  PID:3848
- C:\Windows\System\pILioQm.exe
  C:\Windows\System\pILioQm.exe
  2⤵
  PID:3816
- C:\Windows\System\qQdsZTO.exe
  C:\Windows\System\qQdsZTO.exe
  2⤵
  PID:3868
- C:\Windows\System\VphiVBE.exe
  C:\Windows\System\VphiVBE.exe
  2⤵
  PID:3900
- C:\Windows\System\JEPpDHY.exe
  C:\Windows\System\JEPpDHY.exe
  2⤵
  PID:3964
- C:\Windows\System\SRwZiLb.exe
  C:\Windows\System\SRwZiLb.exe
  2⤵
  PID:3984
- C:\Windows\System\lsyUHMO.exe
  C:\Windows\System\lsyUHMO.exe
  2⤵
  PID:3060
- C:\Windows\System\UAsESxf.exe
  C:\Windows\System\UAsESxf.exe
  2⤵
  PID:4028
- C:\Windows\System\BoDLWSY.exe
  C:\Windows\System\BoDLWSY.exe
  2⤵
  PID:4088
- C:\Windows\System\lSLBQFs.exe
  C:\Windows\System\lSLBQFs.exe
  2⤵
  PID:2336
- C:\Windows\System\KVBTeTv.exe
  C:\Windows\System\KVBTeTv.exe
  2⤵
  PID:2872
- C:\Windows\System\MtopLeR.exe
  C:\Windows\System\MtopLeR.exe
  2⤵
  PID:3064
- C:\Windows\System\OIHJNvn.exe
  C:\Windows\System\OIHJNvn.exe
  2⤵
  PID:1152
- C:\Windows\System\rzqEKan.exe
  C:\Windows\System\rzqEKan.exe
  2⤵
  PID:3024
- C:\Windows\System\xULZfOy.exe
  C:\Windows\System\xULZfOy.exe
  2⤵
  PID:1748
- C:\Windows\System\xDKEqZy.exe
  C:\Windows\System\xDKEqZy.exe
  2⤵
  PID:108
- C:\Windows\System\kOQCPpY.exe
  C:\Windows\System\kOQCPpY.exe
  2⤵
  PID:3112
- C:\Windows\System\HWZXdfs.exe
  C:\Windows\System\HWZXdfs.exe
  2⤵
  PID:3132
- C:\Windows\System\fIdWZne.exe
  C:\Windows\System\fIdWZne.exe
  2⤵
  PID:3196
- C:\Windows\System\ArGgqhx.exe
  C:\Windows\System\ArGgqhx.exe
  2⤵
  PID:3272
- C:\Windows\System\YOXcvIq.exe
  C:\Windows\System\YOXcvIq.exe
  2⤵
  PID:3396
- C:\Windows\System\akdvEbZ.exe
  C:\Windows\System\akdvEbZ.exe
  2⤵
  PID:3252
- C:\Windows\System\gIqLOJl.exe
  C:\Windows\System\gIqLOJl.exe
  2⤵
  PID:3376
- C:\Windows\System\ZTsVBIR.exe
  C:\Windows\System\ZTsVBIR.exe
  2⤵
  PID:3524
- C:\Windows\System\wIjvfnW.exe
  C:\Windows\System\wIjvfnW.exe
  2⤵
  PID:3544
- C:\Windows\System\GUqEhEV.exe
  C:\Windows\System\GUqEhEV.exe
  2⤵
  PID:3648
- C:\Windows\System\DSHRAwN.exe
  C:\Windows\System\DSHRAwN.exe
  2⤵
  PID:3676
- C:\Windows\System\PPeEGZC.exe
  C:\Windows\System\PPeEGZC.exe
  2⤵
  PID:3624
- C:\Windows\System\HtUAGGF.exe
  C:\Windows\System\HtUAGGF.exe
  2⤵
  PID:3744
- C:\Windows\System\KQszhZA.exe
  C:\Windows\System\KQszhZA.exe
  2⤵
  PID:3880
- C:\Windows\System\eSjWDgl.exe
  C:\Windows\System\eSjWDgl.exe
  2⤵
  PID:3780
- C:\Windows\System\vwxtWgf.exe
  C:\Windows\System\vwxtWgf.exe
  2⤵
  PID:3920
- C:\Windows\System\cSgLNWB.exe
  C:\Windows\System\cSgLNWB.exe
  2⤵
  PID:4008
- C:\Windows\System\zEelIhl.exe
  C:\Windows\System\zEelIhl.exe
  2⤵
  PID:4040
- C:\Windows\System\XWbIvtr.exe
  C:\Windows\System\XWbIvtr.exe
  2⤵
  PID:2708
- C:\Windows\System\wjQbYcE.exe
  C:\Windows\System\wjQbYcE.exe
  2⤵
  PID:572
- C:\Windows\System\nMnOTNk.exe
  C:\Windows\System\nMnOTNk.exe
  2⤵
  PID:432
- C:\Windows\System\zWZbdjR.exe
  C:\Windows\System\zWZbdjR.exe
  2⤵
  PID:3152
- C:\Windows\System\GRjFxSG.exe
  C:\Windows\System\GRjFxSG.exe
  2⤵
  PID:944
- C:\Windows\System\PbTqPkh.exe
  C:\Windows\System\PbTqPkh.exe
  2⤵
  PID:2828
- C:\Windows\System\bCXttOC.exe
  C:\Windows\System\bCXttOC.exe
  2⤵
  PID:2820
- C:\Windows\System\ZaTkAow.exe
  C:\Windows\System\ZaTkAow.exe
  2⤵
  PID:3280
- C:\Windows\System\loNXbyd.exe
  C:\Windows\System\loNXbyd.exe
  2⤵
  PID:2468
- C:\Windows\System\pbEKLUj.exe
  C:\Windows\System\pbEKLUj.exe
  2⤵
  PID:3388
- C:\Windows\System\WNONUbW.exe
  C:\Windows\System\WNONUbW.exe
  2⤵
  PID:2916
- C:\Windows\System\NZhYdGg.exe
  C:\Windows\System\NZhYdGg.exe
  2⤵
  PID:472
- C:\Windows\System\nWPfMIs.exe
  C:\Windows\System\nWPfMIs.exe
  2⤵
  PID:3796
- C:\Windows\System\TkOhFiK.exe
  C:\Windows\System\TkOhFiK.exe
  2⤵
  PID:3944
- C:\Windows\System\DsYkUZW.exe
  C:\Windows\System\DsYkUZW.exe
  2⤵
  PID:1960
- C:\Windows\System\rWUgcHO.exe
  C:\Windows\System\rWUgcHO.exe
  2⤵
  PID:3484
- C:\Windows\System\akFJNPS.exe
  C:\Windows\System\akFJNPS.exe
  2⤵
  PID:3988
- C:\Windows\System\ZuMxQBA.exe
  C:\Windows\System\ZuMxQBA.exe
  2⤵
  PID:3756
- C:\Windows\System\jzuUdJo.exe
  C:\Windows\System\jzuUdJo.exe
  2⤵
  PID:3840
- C:\Windows\System\fKOEwLp.exe
  C:\Windows\System\fKOEwLp.exe
  2⤵
  PID:2636
- C:\Windows\System\dpNEQDV.exe
  C:\Windows\System\dpNEQDV.exe
  2⤵
  PID:2080
- C:\Windows\System\fTpaQRn.exe
  C:\Windows\System\fTpaQRn.exe
  2⤵
  PID:2324
- C:\Windows\System\suCDxzI.exe
  C:\Windows\System\suCDxzI.exe
  2⤵
  PID:3004
- C:\Windows\System\KrVaiSV.exe
  C:\Windows\System\KrVaiSV.exe
  2⤵
  PID:1736
- C:\Windows\System\taMzPWM.exe
  C:\Windows\System\taMzPWM.exe
  2⤵
  PID:2676
- C:\Windows\System\zZQkBtL.exe
  C:\Windows\System\zZQkBtL.exe
  2⤵
  PID:2860
- C:\Windows\System\nYZZGqU.exe
  C:\Windows\System\nYZZGqU.exe
  2⤵
  PID:3516
- C:\Windows\System\dIrwNTn.exe
  C:\Windows\System\dIrwNTn.exe
  2⤵
  PID:4084
- C:\Windows\System\GScECjQ.exe
  C:\Windows\System\GScECjQ.exe
  2⤵
  PID:4012
- C:\Windows\System\xkpZdOm.exe
  C:\Windows\System\xkpZdOm.exe
  2⤵
  PID:872
- C:\Windows\System\rUwGmBy.exe
  C:\Windows\System\rUwGmBy.exe
  2⤵
  PID:3276
- C:\Windows\System\hOUctTg.exe
  C:\Windows\System\hOUctTg.exe
  2⤵
  PID:2824
- C:\Windows\System\JNZLOPg.exe
  C:\Windows\System\JNZLOPg.exe
  2⤵
  PID:3560
- C:\Windows\System\AInJyGK.exe
  C:\Windows\System\AInJyGK.exe
  2⤵
  PID:2532
- C:\Windows\System\iwfFhlK.exe
  C:\Windows\System\iwfFhlK.exe
  2⤵
  PID:1884
- C:\Windows\System\lEymRqj.exe
  C:\Windows\System\lEymRqj.exe
  2⤵
  PID:1596
- C:\Windows\System\EcxTEqO.exe
  C:\Windows\System\EcxTEqO.exe
  2⤵
  PID:2052
- C:\Windows\System\gTaIFSA.exe
  C:\Windows\System\gTaIFSA.exe
  2⤵
  PID:1488
- C:\Windows\System\orvDhxv.exe
  C:\Windows\System\orvDhxv.exe
  2⤵
  PID:3684
- C:\Windows\System\UIPQpnM.exe
  C:\Windows\System\UIPQpnM.exe
  2⤵
  PID:3604
- C:\Windows\System\uxdYCWW.exe
  C:\Windows\System\uxdYCWW.exe
  2⤵
  PID:3836
- C:\Windows\System\MxbfCtn.exe
  C:\Windows\System\MxbfCtn.exe
  2⤵
  PID:1928
- C:\Windows\System\BptKBUV.exe
  C:\Windows\System\BptKBUV.exe
  2⤵
  PID:1756
- C:\Windows\System\fTvAClU.exe
  C:\Windows\System\fTvAClU.exe
  2⤵
  PID:1472
- C:\Windows\System\vAsGLUr.exe
  C:\Windows\System\vAsGLUr.exe
  2⤵
  PID:3172
- C:\Windows\System\WfyGfrA.exe
  C:\Windows\System\WfyGfrA.exe
  2⤵
  PID:3116
- C:\Windows\System\BovbYKn.exe
  C:\Windows\System\BovbYKn.exe
  2⤵
  PID:1264
- C:\Windows\System\aKZRyqx.exe
  C:\Windows\System\aKZRyqx.exe
  2⤵
  PID:1480
- C:\Windows\System\bXrSFQl.exe
  C:\Windows\System\bXrSFQl.exe
  2⤵
  PID:3704
- C:\Windows\System\FaRSVSC.exe
  C:\Windows\System\FaRSVSC.exe
  2⤵
  PID:1612
- C:\Windows\System\SxDdOfg.exe
  C:\Windows\System\SxDdOfg.exe
  2⤵
  PID:4068
- C:\Windows\System\QAajTJE.exe
  C:\Windows\System\QAajTJE.exe
  2⤵
  PID:564
- C:\Windows\System\UXKBpBn.exe
  C:\Windows\System\UXKBpBn.exe
  2⤵
  PID:1056
- C:\Windows\System\zfQubDM.exe
  C:\Windows\System\zfQubDM.exe
  2⤵
  PID:2296
- C:\Windows\System\OLGMJfP.exe
  C:\Windows\System\OLGMJfP.exe
  2⤵
  PID:1768
- C:\Windows\System\jSQqoFf.exe
  C:\Windows\System\jSQqoFf.exe
  2⤵
  PID:3720
- C:\Windows\System\blNvSEW.exe
  C:\Windows\System\blNvSEW.exe
  2⤵
  PID:1680
- C:\Windows\System\vVUGBbU.exe
  C:\Windows\System\vVUGBbU.exe
  2⤵
  PID:2968
- C:\Windows\System\ZzvFGeN.exe
  C:\Windows\System\ZzvFGeN.exe
  2⤵
  PID:3824
- C:\Windows\System\JjXhMxQ.exe
  C:\Windows\System\JjXhMxQ.exe
  2⤵
  PID:280
- C:\Windows\System\CQmalhf.exe
  C:\Windows\System\CQmalhf.exe
  2⤵
  PID:2616
- C:\Windows\System\Pkospkw.exe
  C:\Windows\System\Pkospkw.exe
  2⤵
  PID:396
- C:\Windows\System\rrZVdPb.exe
  C:\Windows\System\rrZVdPb.exe
  2⤵
  PID:2732
- C:\Windows\System\zvyECiE.exe
  C:\Windows\System\zvyECiE.exe
  2⤵
  PID:4116
- C:\Windows\System\HtsSTtO.exe
  C:\Windows\System\HtsSTtO.exe
  2⤵
  PID:4132
- C:\Windows\System\KtvWpSF.exe
  C:\Windows\System\KtvWpSF.exe
  2⤵
  PID:4156
- C:\Windows\System\DRUGpPB.exe
  C:\Windows\System\DRUGpPB.exe
  2⤵
  PID:4172
- C:\Windows\System\PAQnXuy.exe
  C:\Windows\System\PAQnXuy.exe
  2⤵
  PID:4188
- C:\Windows\System\SKSbMXb.exe
  C:\Windows\System\SKSbMXb.exe
  2⤵
  PID:4208
- C:\Windows\System\CYmiRsI.exe
  C:\Windows\System\CYmiRsI.exe
  2⤵
  PID:4228
- C:\Windows\System\OKSqFXj.exe
  C:\Windows\System\OKSqFXj.exe
  2⤵
  PID:4244
- C:\Windows\System\TnlndSr.exe
  C:\Windows\System\TnlndSr.exe
  2⤵
  PID:4268
- C:\Windows\System\BsLJfCk.exe
  C:\Windows\System\BsLJfCk.exe
  2⤵
  PID:4292
- C:\Windows\System\jRbWAJW.exe
  C:\Windows\System\jRbWAJW.exe
  2⤵
  PID:4312
- C:\Windows\System\ZrTgCej.exe
  C:\Windows\System\ZrTgCej.exe
  2⤵
  PID:4328
- C:\Windows\System\lutqLDo.exe
  C:\Windows\System\lutqLDo.exe
  2⤵
  PID:4344
- C:\Windows\System\QeGYbir.exe
  C:\Windows\System\QeGYbir.exe
  2⤵
  PID:4364
- C:\Windows\System\PJMfSmz.exe
  C:\Windows\System\PJMfSmz.exe
  2⤵
  PID:4392
- C:\Windows\System\lwwtUdT.exe
  C:\Windows\System\lwwtUdT.exe
  2⤵
  PID:4408
- C:\Windows\System\rfLcKgv.exe
  C:\Windows\System\rfLcKgv.exe
  2⤵
  PID:4428
- C:\Windows\System\ouTkATz.exe
  C:\Windows\System\ouTkATz.exe
  2⤵
  PID:4444
- C:\Windows\System\JlpLziv.exe
  C:\Windows\System\JlpLziv.exe
  2⤵
  PID:4472
- C:\Windows\System\UezhEJA.exe
  C:\Windows\System\UezhEJA.exe
  2⤵
  PID:4492
- C:\Windows\System\QtwnWQa.exe
  C:\Windows\System\QtwnWQa.exe
  2⤵
  PID:4508
- C:\Windows\System\aygYkuH.exe
  C:\Windows\System\aygYkuH.exe
  2⤵
  PID:4528
- C:\Windows\System\fjFLVaQ.exe
  C:\Windows\System\fjFLVaQ.exe
  2⤵
  PID:4544
- C:\Windows\System\edTSQhk.exe
  C:\Windows\System\edTSQhk.exe
  2⤵
  PID:4560
- C:\Windows\System\mBAUdza.exe
  C:\Windows\System\mBAUdza.exe
  2⤵
  PID:4584
- C:\Windows\System\MRhaqsV.exe
  C:\Windows\System\MRhaqsV.exe
  2⤵
  PID:4608
- C:\Windows\System\AtFpiqh.exe
  C:\Windows\System\AtFpiqh.exe
  2⤵
  PID:4624
- C:\Windows\System\ywYkwKh.exe
  C:\Windows\System\ywYkwKh.exe
  2⤵
  PID:4644
- C:\Windows\System\zkZrGpa.exe
  C:\Windows\System\zkZrGpa.exe
  2⤵
  PID:4664
- C:\Windows\System\hvMIwkh.exe
  C:\Windows\System\hvMIwkh.exe
  2⤵
  PID:4696
- C:\Windows\System\hYOOOYi.exe
  C:\Windows\System\hYOOOYi.exe
  2⤵
  PID:4712
- C:\Windows\System\QzZspCt.exe
  C:\Windows\System\QzZspCt.exe
  2⤵
  PID:4728
- C:\Windows\System\RLHmtCr.exe
  C:\Windows\System\RLHmtCr.exe
  2⤵
  PID:4756
- C:\Windows\System\DmOYlfk.exe
  C:\Windows\System\DmOYlfk.exe
  2⤵
  PID:4772
- C:\Windows\System\lSDISMF.exe
  C:\Windows\System\lSDISMF.exe
  2⤵
  PID:4788
- C:\Windows\System\lgWBbPh.exe
  C:\Windows\System\lgWBbPh.exe
  2⤵
  PID:4808
- C:\Windows\System\zFJtFJC.exe
  C:\Windows\System\zFJtFJC.exe
  2⤵
  PID:4824
- C:\Windows\System\MvKrIBn.exe
  C:\Windows\System\MvKrIBn.exe
  2⤵
  PID:4844
- C:\Windows\System\QuNbSLQ.exe
  C:\Windows\System\QuNbSLQ.exe
  2⤵
  PID:4860
- C:\Windows\System\jUcgWjA.exe
  C:\Windows\System\jUcgWjA.exe
  2⤵
  PID:4880
- C:\Windows\System\ttCrhWF.exe
  C:\Windows\System\ttCrhWF.exe
  2⤵
  PID:4896
- C:\Windows\System\qRKrzTI.exe
  C:\Windows\System\qRKrzTI.exe
  2⤵
  PID:4916
- C:\Windows\System\TRwBpMW.exe
  C:\Windows\System\TRwBpMW.exe
  2⤵
  PID:4932
- C:\Windows\System\tAsmJxz.exe
  C:\Windows\System\tAsmJxz.exe
  2⤵
  PID:4948
- C:\Windows\System\OhtKcHI.exe
  C:\Windows\System\OhtKcHI.exe
  2⤵
  PID:4964
- C:\Windows\System\acAbaLA.exe
  C:\Windows\System\acAbaLA.exe
  2⤵
  PID:4984
- C:\Windows\System\XUMiVRs.exe
  C:\Windows\System\XUMiVRs.exe
  2⤵
  PID:5000
- C:\Windows\System\hYsznCC.exe
  C:\Windows\System\hYsznCC.exe
  2⤵
  PID:5016
- C:\Windows\System\SUKreqw.exe
  C:\Windows\System\SUKreqw.exe
  2⤵
  PID:5044
- C:\Windows\System\jnpHOEP.exe
  C:\Windows\System\jnpHOEP.exe
  2⤵
  PID:5060
- C:\Windows\System\cJjIdzT.exe
  C:\Windows\System\cJjIdzT.exe
  2⤵
  PID:5080
- C:\Windows\System\xAyuBrj.exe
  C:\Windows\System\xAyuBrj.exe
  2⤵
  PID:5096
- C:\Windows\System\utYgsSX.exe
  C:\Windows\System\utYgsSX.exe
  2⤵
  PID:4108
- C:\Windows\System\aKYGzGh.exe
  C:\Windows\System\aKYGzGh.exe
  2⤵
  PID:4184
- C:\Windows\System\FdoViYu.exe
  C:\Windows\System\FdoViYu.exe
  2⤵
  PID:4264
- C:\Windows\System\MjlYGvC.exe
  C:\Windows\System\MjlYGvC.exe
  2⤵
  PID:4236
- C:\Windows\System\XcRkcfi.exe
  C:\Windows\System\XcRkcfi.exe
  2⤵
  PID:4336
- C:\Windows\System\JpIUXzf.exe
  C:\Windows\System\JpIUXzf.exe
  2⤵
  PID:4376
- C:\Windows\System\dDtksbG.exe
  C:\Windows\System\dDtksbG.exe
  2⤵
  PID:4424
- C:\Windows\System\xlKSVoq.exe
  C:\Windows\System\xlKSVoq.exe
  2⤵
  PID:4360
- C:\Windows\System\vQrBata.exe
  C:\Windows\System\vQrBata.exe
  2⤵
  PID:4452
- C:\Windows\System\zkYGXYz.exe
  C:\Windows\System\zkYGXYz.exe
  2⤵
  PID:4504
- C:\Windows\System\qwfWLfP.exe
  C:\Windows\System\qwfWLfP.exe
  2⤵
  PID:4488
- C:\Windows\System\JxKuGor.exe
  C:\Windows\System\JxKuGor.exe
  2⤵
  PID:4524
- C:\Windows\System\glMUssn.exe
  C:\Windows\System\glMUssn.exe
  2⤵
  PID:4592
- C:\Windows\System\HxtWNYT.exe
  C:\Windows\System\HxtWNYT.exe
  2⤵
  PID:4652
- C:\Windows\System\ViwtREf.exe
  C:\Windows\System\ViwtREf.exe
  2⤵
  PID:4632
- C:\Windows\System\ZwsCDai.exe
  C:\Windows\System\ZwsCDai.exe
  2⤵
  PID:4684
- C:\Windows\System\zEblGrO.exe
  C:\Windows\System\zEblGrO.exe
  2⤵
  PID:4688
- C:\Windows\System\LWPYadQ.exe
  C:\Windows\System\LWPYadQ.exe
  2⤵
  PID:4692
- C:\Windows\System\HmFwZcF.exe
  C:\Windows\System\HmFwZcF.exe
  2⤵
  PID:4820
- C:\Windows\System\ILpxfug.exe
  C:\Windows\System\ILpxfug.exe
  2⤵
  PID:4892
- C:\Windows\System\rsZGpiG.exe
  C:\Windows\System\rsZGpiG.exe
  2⤵
  PID:4956
- C:\Windows\System\RFOhhFR.exe
  C:\Windows\System\RFOhhFR.exe
  2⤵
  PID:4800
- C:\Windows\System\WiIPwXR.exe
  C:\Windows\System\WiIPwXR.exe
  2⤵
  PID:5028
- C:\Windows\System\qYOroaK.exe
  C:\Windows\System\qYOroaK.exe
  2⤵
  PID:5108
- C:\Windows\System\EMpedSL.exe
  C:\Windows\System\EMpedSL.exe
  2⤵
  PID:5104
- C:\Windows\System\hJfpuaS.exe
  C:\Windows\System\hJfpuaS.exe
  2⤵
  PID:5052
- C:\Windows\System\ILsQtVP.exe
  C:\Windows\System\ILsQtVP.exe
  2⤵
  PID:4908
- C:\Windows\System\nuRUmJz.exe
  C:\Windows\System\nuRUmJz.exe
  2⤵
  PID:5088
- C:\Windows\System\wPMwQyW.exe
  C:\Windows\System\wPMwQyW.exe
  2⤵
  PID:4764
- C:\Windows\System\SEltEXa.exe
  C:\Windows\System\SEltEXa.exe
  2⤵
  PID:4128
- C:\Windows\System\TrglCkf.exe
  C:\Windows\System\TrglCkf.exe
  2⤵
  PID:4152
- C:\Windows\System\SQHPzBR.exe
  C:\Windows\System\SQHPzBR.exe
  2⤵
  PID:4256
- C:\Windows\System\YNOrdNK.exe
  C:\Windows\System\YNOrdNK.exe
  2⤵
  PID:4200
- C:\Windows\System\BfOPlOJ.exe
  C:\Windows\System\BfOPlOJ.exe
  2⤵
  PID:4280
- C:\Windows\System\XLZpzTv.exe
  C:\Windows\System\XLZpzTv.exe
  2⤵
  PID:4404
- C:\Windows\System\QeIquOv.exe
  C:\Windows\System\QeIquOv.exe
  2⤵
  PID:4288
- C:\Windows\System\UKSOUOD.exe
  C:\Windows\System\UKSOUOD.exe
  2⤵
  PID:4468
- C:\Windows\System\fdSEcFF.exe
  C:\Windows\System\fdSEcFF.exe
  2⤵
  PID:4552
- C:\Windows\System\zoQtalv.exe
  C:\Windows\System\zoQtalv.exe
  2⤵
  PID:4576
- C:\Windows\System\zOuvVea.exe
  C:\Windows\System\zOuvVea.exe
  2⤵
  PID:4516
- C:\Windows\System\NJLoIKo.exe
  C:\Windows\System\NJLoIKo.exe
  2⤵
  PID:4604
- C:\Windows\System\BLWQCbn.exe
  C:\Windows\System\BLWQCbn.exe
  2⤵
  PID:4740
- C:\Windows\System\YhDwYFc.exe
  C:\Windows\System\YhDwYFc.exe
  2⤵
  PID:4752
- C:\Windows\System\IDnrJuO.exe
  C:\Windows\System\IDnrJuO.exe
  2⤵
  PID:4836
- C:\Windows\System\wGtkQjr.exe
  C:\Windows\System\wGtkQjr.exe
  2⤵
  PID:5076
- C:\Windows\System\ZBUTeJz.exe
  C:\Windows\System\ZBUTeJz.exe
  2⤵
  PID:4972
- C:\Windows\System\fXaTafZ.exe
  C:\Windows\System\fXaTafZ.exe
  2⤵
  PID:4796
- C:\Windows\System\SjjqxPI.exe
  C:\Windows\System\SjjqxPI.exe
  2⤵
  PID:4164
- C:\Windows\System\VvxSECf.exe
  C:\Windows\System\VvxSECf.exe
  2⤵
  PID:4372
- C:\Windows\System\DtjGYBt.exe
  C:\Windows\System\DtjGYBt.exe
  2⤵
  PID:1804
- C:\Windows\System\UzdgxGX.exe
  C:\Windows\System\UzdgxGX.exe
  2⤵
  PID:4784
- C:\Windows\System\BqpURkr.exe
  C:\Windows\System\BqpURkr.exe
  2⤵
  PID:2484
- C:\Windows\System\XhTWxCm.exe
  C:\Windows\System\XhTWxCm.exe
  2⤵
  PID:4940
- C:\Windows\System\ijjslEA.exe
  C:\Windows\System\ijjslEA.exe
  2⤵
  PID:4656
- C:\Windows\System\LgBsrJS.exe
  C:\Windows\System\LgBsrJS.exe
  2⤵
  PID:5140
- C:\Windows\System\PHDwYEZ.exe
  C:\Windows\System\PHDwYEZ.exe
  2⤵
  PID:5156
- C:\Windows\System\pfDTzYO.exe
  C:\Windows\System\pfDTzYO.exe
  2⤵
  PID:5172
- C:\Windows\System\uHnRQfi.exe
  C:\Windows\System\uHnRQfi.exe
  2⤵
  PID:5196
- C:\Windows\System\PvRgEqs.exe
  C:\Windows\System\PvRgEqs.exe
  2⤵
  PID:5212
- C:\Windows\System\tcAxQtD.exe
  C:\Windows\System\tcAxQtD.exe
  2⤵
  PID:5232
- C:\Windows\System\IiPFhvO.exe
  C:\Windows\System\IiPFhvO.exe
  2⤵
  PID:5248
- C:\Windows\System\fFcLhYo.exe
  C:\Windows\System\fFcLhYo.exe
  2⤵
  PID:5264
- C:\Windows\System\RLICgpN.exe
  C:\Windows\System\RLICgpN.exe
  2⤵
  PID:5288
- C:\Windows\System\umDLMYf.exe
  C:\Windows\System\umDLMYf.exe
  2⤵
  PID:5304
- C:\Windows\System\ADjgKuM.exe
  C:\Windows\System\ADjgKuM.exe
  2⤵
  PID:5324
- C:\Windows\System\SkdIRNr.exe
  C:\Windows\System\SkdIRNr.exe
  2⤵
  PID:5416
- C:\Windows\System\HAEHLMO.exe
  C:\Windows\System\HAEHLMO.exe
  2⤵
  PID:5436
- C:\Windows\System\NDQRQaJ.exe
  C:\Windows\System\NDQRQaJ.exe
  2⤵
  PID:5452
- C:\Windows\System\fdYLejy.exe
  C:\Windows\System\fdYLejy.exe
  2⤵
  PID:5476
- C:\Windows\System\sifPheK.exe
  C:\Windows\System\sifPheK.exe
  2⤵
  PID:5492
- C:\Windows\System\NgkfCUd.exe
  C:\Windows\System\NgkfCUd.exe
  2⤵
  PID:5512
- C:\Windows\System\qFjblfk.exe
  C:\Windows\System\qFjblfk.exe
  2⤵
  PID:5532
- C:\Windows\System\dlMDJIz.exe
  C:\Windows\System\dlMDJIz.exe
  2⤵
  PID:5552
- C:\Windows\System\qfwStLj.exe
  C:\Windows\System\qfwStLj.exe
  2⤵
  PID:5568
- C:\Windows\System\GWTNCeF.exe
  C:\Windows\System\GWTNCeF.exe
  2⤵
  PID:5584
- C:\Windows\System\PPwIloi.exe
  C:\Windows\System\PPwIloi.exe
  2⤵
  PID:5616
- C:\Windows\System\ULRcCzP.exe
  C:\Windows\System\ULRcCzP.exe
  2⤵
  PID:5632
- C:\Windows\System\nDDAkqz.exe
  C:\Windows\System\nDDAkqz.exe
  2⤵
  PID:5652
- C:\Windows\System\aTUIREV.exe
  C:\Windows\System\aTUIREV.exe
  2⤵
  PID:5668
- C:\Windows\System\szjjBuz.exe
  C:\Windows\System\szjjBuz.exe
  2⤵
  PID:5684
- C:\Windows\System\TAbGTUx.exe
  C:\Windows\System\TAbGTUx.exe
  2⤵
  PID:5712
- C:\Windows\System\mSyOEHe.exe
  C:\Windows\System\mSyOEHe.exe
  2⤵
  PID:5728
- C:\Windows\System\tdhoawl.exe
  C:\Windows\System\tdhoawl.exe
  2⤵
  PID:5744
- C:\Windows\System\GdNSmxm.exe
  C:\Windows\System\GdNSmxm.exe
  2⤵
  PID:5760
- C:\Windows\System\EEECEiK.exe
  C:\Windows\System\EEECEiK.exe
  2⤵
  PID:5776
- C:\Windows\System\ITdQIrN.exe
  C:\Windows\System\ITdQIrN.exe
  2⤵
  PID:5792
- C:\Windows\System\zfHjhil.exe
  C:\Windows\System\zfHjhil.exe
  2⤵
  PID:5812
- C:\Windows\System\REoeNfB.exe
  C:\Windows\System\REoeNfB.exe
  2⤵
  PID:5832
- C:\Windows\System\rXlnNlZ.exe
  C:\Windows\System\rXlnNlZ.exe
  2⤵
  PID:5852
- C:\Windows\System\hsvaZuX.exe
  C:\Windows\System\hsvaZuX.exe
  2⤵
  PID:5872
- C:\Windows\System\YagHyjy.exe
  C:\Windows\System\YagHyjy.exe
  2⤵
  PID:5900
- C:\Windows\System\ZiyJZEi.exe
  C:\Windows\System\ZiyJZEi.exe
  2⤵
  PID:5936
- C:\Windows\System\nSgkZqF.exe
  C:\Windows\System\nSgkZqF.exe
  2⤵
  PID:5952
- C:\Windows\System\bANXqyQ.exe
  C:\Windows\System\bANXqyQ.exe
  2⤵
  PID:5972
- C:\Windows\System\mIyrpPT.exe
  C:\Windows\System\mIyrpPT.exe
  2⤵
  PID:5996
- C:\Windows\System\WJJExHT.exe
  C:\Windows\System\WJJExHT.exe
  2⤵
  PID:6012
- C:\Windows\System\zdNyWhI.exe
  C:\Windows\System\zdNyWhI.exe
  2⤵
  PID:6028
- C:\Windows\System\ZCWrsXY.exe
  C:\Windows\System\ZCWrsXY.exe
  2⤵
  PID:6056
- C:\Windows\System\WhSGXzA.exe
  C:\Windows\System\WhSGXzA.exe
  2⤵
  PID:6072
- C:\Windows\System\FbWJcmw.exe
  C:\Windows\System\FbWJcmw.exe
  2⤵
  PID:6092
- C:\Windows\System\YHiJHah.exe
  C:\Windows\System\YHiJHah.exe
  2⤵
  PID:6132
- C:\Windows\System\tbbcmNn.exe
  C:\Windows\System\tbbcmNn.exe
  2⤵
  PID:5056
- C:\Windows\System\bSreWYm.exe
  C:\Windows\System\bSreWYm.exe
  2⤵
  PID:5164
- C:\Windows\System\NcSCiDs.exe
  C:\Windows\System\NcSCiDs.exe
  2⤵
  PID:5240
- C:\Windows\System\TvJPUSE.exe
  C:\Windows\System\TvJPUSE.exe
  2⤵
  PID:5280
- C:\Windows\System\LysYQHS.exe
  C:\Windows\System\LysYQHS.exe
  2⤵
  PID:4300
- C:\Windows\System\rEWZsdK.exe
  C:\Windows\System\rEWZsdK.exe
  2⤵
  PID:4540
- C:\Windows\System\LNpJLWS.exe
  C:\Windows\System\LNpJLWS.exe
  2⤵
  PID:4888
- C:\Windows\System\cFJOYhn.exe
  C:\Windows\System\cFJOYhn.exe
  2⤵
  PID:5184
- C:\Windows\System\CRWFYXc.exe
  C:\Windows\System\CRWFYXc.exe
  2⤵
  PID:4464
- C:\Windows\System\TfHbGHm.exe
  C:\Windows\System\TfHbGHm.exe
  2⤵
  PID:4928
- C:\Windows\System\wGrmaws.exe
  C:\Windows\System\wGrmaws.exe
  2⤵
  PID:4704
- C:\Windows\System\KmpNrvr.exe
  C:\Windows\System\KmpNrvr.exe
  2⤵
  PID:4868
- C:\Windows\System\aOSqsXf.exe
  C:\Windows\System\aOSqsXf.exe
  2⤵
  PID:5344
- C:\Windows\System\vtNjVpU.exe
  C:\Windows\System\vtNjVpU.exe
  2⤵
  PID:4480
- C:\Windows\System\rgPnNgl.exe
  C:\Windows\System\rgPnNgl.exe
  2⤵
  PID:4976
- C:\Windows\System\IoXZwzU.exe
  C:\Windows\System\IoXZwzU.exe
  2⤵
  PID:5388
- C:\Windows\System\ZuwgmUn.exe
  C:\Windows\System\ZuwgmUn.exe
  2⤵
  PID:5432
- C:\Windows\System\JjEWtHn.exe
  C:\Windows\System\JjEWtHn.exe
  2⤵
  PID:5364
- C:\Windows\System\btMVPww.exe
  C:\Windows\System\btMVPww.exe
  2⤵
  PID:5400
- C:\Windows\System\IreaowD.exe
  C:\Windows\System\IreaowD.exe
  2⤵
  PID:5464
- C:\Windows\System\RscGHYg.exe
  C:\Windows\System\RscGHYg.exe
  2⤵
  PID:1188
- C:\Windows\System\ffAkhmK.exe
  C:\Windows\System\ffAkhmK.exe
  2⤵
  PID:5524
- C:\Windows\System\BWGCysr.exe
  C:\Windows\System\BWGCysr.exe
  2⤵
  PID:5580
- C:\Windows\System\kTeHstG.exe
  C:\Windows\System\kTeHstG.exe
  2⤵
  PID:5604
- C:\Windows\System\LjHVmKD.exe
  C:\Windows\System\LjHVmKD.exe
  2⤵
  PID:5624
- C:\Windows\System\bTfguVc.exe
  C:\Windows\System\bTfguVc.exe
  2⤵
  PID:5676
- C:\Windows\System\drGdKKH.exe
  C:\Windows\System\drGdKKH.exe
  2⤵
  PID:5692
- C:\Windows\System\tbKqCJr.exe
  C:\Windows\System\tbKqCJr.exe
  2⤵
  PID:5820
- C:\Windows\System\fJVVfxn.exe
  C:\Windows\System\fJVVfxn.exe
  2⤵
  PID:5720
- C:\Windows\System\MAKKiIB.exe
  C:\Windows\System\MAKKiIB.exe
  2⤵
  PID:5804
- C:\Windows\System\CONhLjt.exe
  C:\Windows\System\CONhLjt.exe
  2⤵
  PID:5848
- C:\Windows\System\uptJNjW.exe
  C:\Windows\System\uptJNjW.exe
  2⤵
  PID:5892
- C:\Windows\System\qUjoALc.exe
  C:\Windows\System\qUjoALc.exe
  2⤵
  PID:5928
- C:\Windows\System\KkVtcmg.exe
  C:\Windows\System\KkVtcmg.exe
  2⤵
  PID:5968
- C:\Windows\System\JpzkHTr.exe
  C:\Windows\System\JpzkHTr.exe
  2⤵
  PID:5992
- C:\Windows\System\jolvlmP.exe
  C:\Windows\System\jolvlmP.exe
  2⤵
  PID:6004
- C:\Windows\System\ruPyusf.exe
  C:\Windows\System\ruPyusf.exe
  2⤵
  PID:6048
- C:\Windows\System\QhoPaXy.exe
  C:\Windows\System\QhoPaXy.exe
  2⤵
  PID:6068
- C:\Windows\System\tzXZmLX.exe
  C:\Windows\System\tzXZmLX.exe
  2⤵
  PID:5384
- C:\Windows\System\NzdoDvY.exe
  C:\Windows\System\NzdoDvY.exe
  2⤵
  PID:5116
- C:\Windows\System\ixCJBvq.exe
  C:\Windows\System\ixCJBvq.exe
  2⤵
  PID:5272
- C:\Windows\System\dOHnxdo.exe
  C:\Windows\System\dOHnxdo.exe
  2⤵
  PID:5312
- C:\Windows\System\pgkDeQG.exe
  C:\Windows\System\pgkDeQG.exe
  2⤵
  PID:5276
- C:\Windows\System\qazkRxS.exe
  C:\Windows\System\qazkRxS.exe
  2⤵
  PID:4616
- C:\Windows\System\DJVTJXg.exe
  C:\Windows\System\DJVTJXg.exe
  2⤵
  PID:4876
- C:\Windows\System\iiNyBWY.exe
  C:\Windows\System\iiNyBWY.exe
  2⤵
  PID:5392
- C:\Windows\System\cIpJfSQ.exe
  C:\Windows\System\cIpJfSQ.exe
  2⤵
  PID:4356
- C:\Windows\System\zSlRIQW.exe
  C:\Windows\System\zSlRIQW.exe
  2⤵
  PID:5360
- C:\Windows\System\HrNMppr.exe
  C:\Windows\System\HrNMppr.exe
  2⤵
  PID:5188
- C:\Windows\System\BviIgSS.exe
  C:\Windows\System\BviIgSS.exe
  2⤵
  PID:5444
- C:\Windows\System\lYgdWdw.exe
  C:\Windows\System\lYgdWdw.exe
  2⤵
  PID:5520
- C:\Windows\System\xjyrfTt.exe
  C:\Windows\System\xjyrfTt.exe
  2⤵
  PID:5376
- C:\Windows\System\exxoDQX.exe
  C:\Windows\System\exxoDQX.exe
  2⤵
  PID:5544
- C:\Windows\System\gmttIBn.exe
  C:\Windows\System\gmttIBn.exe
  2⤵
  PID:5596
- C:\Windows\System\LKEkmhr.exe
  C:\Windows\System\LKEkmhr.exe
  2⤵
  PID:5640
- C:\Windows\System\jUCMSLp.exe
  C:\Windows\System\jUCMSLp.exe
  2⤵
  PID:5708
- C:\Windows\System\tJosNYs.exe
  C:\Windows\System\tJosNYs.exe
  2⤵
  PID:5664
- C:\Windows\System\nIONATo.exe
  C:\Windows\System\nIONATo.exe
  2⤵
  PID:5800
- C:\Windows\System\beaFPhm.exe
  C:\Windows\System\beaFPhm.exe
  2⤵
  PID:5920
- C:\Windows\System\SnVPhYJ.exe
  C:\Windows\System\SnVPhYJ.exe
  2⤵
  PID:6024
- C:\Windows\System\fNxXIFQ.exe
  C:\Windows\System\fNxXIFQ.exe
  2⤵
  PID:5984
- C:\Windows\System\lPksISd.exe
  C:\Windows\System\lPksISd.exe
  2⤵
  PID:6084
- C:\Windows\System\JaFapiM.exe
  C:\Windows\System\JaFapiM.exe
  2⤵
  PID:6008
- C:\Windows\System\dqlvxnU.exe
  C:\Windows\System\dqlvxnU.exe
  2⤵
  PID:2876
- C:\Windows\System\vuRiHUQ.exe
  C:\Windows\System\vuRiHUQ.exe
  2⤵
  PID:4180
- C:\Windows\System\JsIOuFS.exe
  C:\Windows\System\JsIOuFS.exe
  2⤵
  PID:4216
- C:\Windows\System\YyBajSj.exe
  C:\Windows\System\YyBajSj.exe
  2⤵
  PID:4736
- C:\Windows\System\NbBkdKz.exe
  C:\Windows\System\NbBkdKz.exe
  2⤵
  PID:5012
- C:\Windows\System\WQclpkB.exe
  C:\Windows\System\WQclpkB.exe
  2⤵
  PID:5356
- C:\Windows\System\OfhnhIm.exe
  C:\Windows\System\OfhnhIm.exe
  2⤵
  PID:5228
- C:\Windows\System\DvcoWEt.exe
  C:\Windows\System\DvcoWEt.exe
  2⤵
  PID:5504
- C:\Windows\System\yIwgWvQ.exe
  C:\Windows\System\yIwgWvQ.exe
  2⤵
  PID:5548
- C:\Windows\System\LWhEwII.exe
  C:\Windows\System\LWhEwII.exe
  2⤵
  PID:5592
- C:\Windows\System\wqfOhJL.exe
  C:\Windows\System\wqfOhJL.exe
  2⤵
  PID:5700
- C:\Windows\System\QvijHKp.exe
  C:\Windows\System\QvijHKp.exe
  2⤵
  PID:5884
- C:\Windows\System\TPleECq.exe
  C:\Windows\System\TPleECq.exe
  2⤵
  PID:5908
- C:\Windows\System\EuDGXxm.exe
  C:\Windows\System\EuDGXxm.exe
  2⤵
  PID:6140
- C:\Windows\System\SUSYHnE.exe
  C:\Windows\System\SUSYHnE.exe
  2⤵
  PID:4352
- C:\Windows\System\FICvOjW.exe
  C:\Windows\System\FICvOjW.exe
  2⤵
  PID:5152
- C:\Windows\System\JyqVvdz.exe
  C:\Windows\System\JyqVvdz.exe
  2⤵
  PID:4816
- C:\Windows\System\YmrRTrh.exe
  C:\Windows\System\YmrRTrh.exe
  2⤵
  PID:6088
- C:\Windows\System\MsNZzZX.exe
  C:\Windows\System\MsNZzZX.exe
  2⤵
  PID:5208
- C:\Windows\System\sOICZcQ.exe
  C:\Windows\System\sOICZcQ.exe
  2⤵
  PID:5404
- C:\Windows\System\CjybroT.exe
  C:\Windows\System\CjybroT.exe
  2⤵
  PID:5332
- C:\Windows\System\ItLMtTI.exe
  C:\Windows\System\ItLMtTI.exe
  2⤵
  PID:5508
- C:\Windows\System\jjPeolC.exe
  C:\Windows\System\jjPeolC.exe
  2⤵
  PID:4420
- C:\Windows\System\EpEUddx.exe
  C:\Windows\System\EpEUddx.exe
  2⤵
  PID:5036
- C:\Windows\System\ZbgxLke.exe
  C:\Windows\System\ZbgxLke.exe
  2⤵
  PID:5980
- C:\Windows\System\aSYpgMN.exe
  C:\Windows\System\aSYpgMN.exe
  2⤵
  PID:6052
- C:\Windows\System\PbkiFGn.exe
  C:\Windows\System\PbkiFGn.exe
  2⤵
  PID:5600
- C:\Windows\System\NbhucNo.exe
  C:\Windows\System\NbhucNo.exe
  2⤵
  PID:5576
- C:\Windows\System\uHWesgO.exe
  C:\Windows\System\uHWesgO.exe
  2⤵
  PID:5948
- C:\Windows\System\GhbDsiH.exe
  C:\Windows\System\GhbDsiH.exe
  2⤵
  PID:5768
- C:\Windows\System\txgkOij.exe
  C:\Windows\System\txgkOij.exe
  2⤵
  PID:5484
- C:\Windows\System\mNuDYFZ.exe
  C:\Windows\System\mNuDYFZ.exe
  2⤵
  PID:6156
- C:\Windows\System\GMyXjVL.exe
  C:\Windows\System\GMyXjVL.exe
  2⤵
  PID:6184
- C:\Windows\System\EgLLmAk.exe
  C:\Windows\System\EgLLmAk.exe
  2⤵
  PID:6200
- C:\Windows\System\VfuYhVY.exe
  C:\Windows\System\VfuYhVY.exe
  2⤵
  PID:6216
- C:\Windows\System\CfpWeoy.exe
  C:\Windows\System\CfpWeoy.exe
  2⤵
  PID:6232
- C:\Windows\System\sUWCzLF.exe
  C:\Windows\System\sUWCzLF.exe
  2⤵
  PID:6252
- C:\Windows\System\RYcLLRF.exe
  C:\Windows\System\RYcLLRF.exe
  2⤵
  PID:6272
- C:\Windows\System\vpVrJcF.exe
  C:\Windows\System\vpVrJcF.exe
  2⤵
  PID:6288
- C:\Windows\System\WUuIgpf.exe
  C:\Windows\System\WUuIgpf.exe
  2⤵
  PID:6336
- C:\Windows\System\XXXBPNV.exe
  C:\Windows\System\XXXBPNV.exe
  2⤵
  PID:6356
- C:\Windows\System\ptZTYgX.exe
  C:\Windows\System\ptZTYgX.exe
  2⤵
  PID:6372
- C:\Windows\System\lpknEnn.exe
  C:\Windows\System\lpknEnn.exe
  2⤵
  PID:6388
- C:\Windows\System\kNIgOih.exe
  C:\Windows\System\kNIgOih.exe
  2⤵
  PID:6408
- C:\Windows\System\NhMsdcq.exe
  C:\Windows\System\NhMsdcq.exe
  2⤵
  PID:6428
- C:\Windows\System\hbqxmhH.exe
  C:\Windows\System\hbqxmhH.exe
  2⤵
  PID:6452
- C:\Windows\System\HHiWCzl.exe
  C:\Windows\System\HHiWCzl.exe
  2⤵
  PID:6468
- C:\Windows\System\tVWPybw.exe
  C:\Windows\System\tVWPybw.exe
  2⤵
  PID:6484
- C:\Windows\System\LkFxHXP.exe
  C:\Windows\System\LkFxHXP.exe
  2⤵
  PID:6500
- C:\Windows\System\OzyHkhQ.exe
  C:\Windows\System\OzyHkhQ.exe
  2⤵
  PID:6516
- C:\Windows\System\SWjlwMb.exe
  C:\Windows\System\SWjlwMb.exe
  2⤵
  PID:6564
- C:\Windows\System\nyXoqZt.exe
  C:\Windows\System\nyXoqZt.exe
  2⤵
  PID:6580
- C:\Windows\System\bkQBPTk.exe
  C:\Windows\System\bkQBPTk.exe
  2⤵
  PID:6596
- C:\Windows\System\wNKtVbJ.exe
  C:\Windows\System\wNKtVbJ.exe
  2⤵
  PID:6612
- C:\Windows\System\rLyQPZD.exe
  C:\Windows\System\rLyQPZD.exe
  2⤵
  PID:6632
- C:\Windows\System\oLqpwOW.exe
  C:\Windows\System\oLqpwOW.exe
  2⤵
  PID:6652
- C:\Windows\System\xOfJXoN.exe
  C:\Windows\System\xOfJXoN.exe
  2⤵
  PID:6672
- C:\Windows\System\xjlcSFX.exe
  C:\Windows\System\xjlcSFX.exe
  2⤵
  PID:6692
- C:\Windows\System\qkRIKJi.exe
  C:\Windows\System\qkRIKJi.exe
  2⤵
  PID:6708
- C:\Windows\System\SVyvUlt.exe
  C:\Windows\System\SVyvUlt.exe
  2⤵
  PID:6728
- C:\Windows\System\NPNOKaR.exe
  C:\Windows\System\NPNOKaR.exe
  2⤵
  PID:6744
- C:\Windows\System\rWraDJE.exe
  C:\Windows\System\rWraDJE.exe
  2⤵
  PID:6808
- C:\Windows\System\XvupjIk.exe
  C:\Windows\System\XvupjIk.exe
  2⤵
  PID:6828
- C:\Windows\System\JCAcnYj.exe
  C:\Windows\System\JCAcnYj.exe
  2⤵
  PID:6848
- C:\Windows\System\ElbSfJP.exe
  C:\Windows\System\ElbSfJP.exe
  2⤵
  PID:6864
- C:\Windows\System\MakGZfk.exe
  C:\Windows\System\MakGZfk.exe
  2⤵
  PID:6884
- C:\Windows\System\VJjLdOP.exe
  C:\Windows\System\VJjLdOP.exe
  2⤵
  PID:6904
- C:\Windows\System\GyDpTGi.exe
  C:\Windows\System\GyDpTGi.exe
  2⤵
  PID:6920
- C:\Windows\System\iXhEQJp.exe
  C:\Windows\System\iXhEQJp.exe
  2⤵
  PID:6940
- C:\Windows\System\LZipSXo.exe
  C:\Windows\System\LZipSXo.exe
  2⤵
  PID:6960
- C:\Windows\System\scocELo.exe
  C:\Windows\System\scocELo.exe
  2⤵
  PID:6976
- C:\Windows\System\KfEarSy.exe
  C:\Windows\System\KfEarSy.exe
  2⤵
  PID:6992
- C:\Windows\System\xRieVnO.exe
  C:\Windows\System\xRieVnO.exe
  2⤵
  PID:7008
- C:\Windows\System\kVNSuEj.exe
  C:\Windows\System\kVNSuEj.exe
  2⤵
  PID:7028
- C:\Windows\System\sIaqoLB.exe
  C:\Windows\System\sIaqoLB.exe
  2⤵
  PID:7044
- C:\Windows\System\dHfjHxe.exe
  C:\Windows\System\dHfjHxe.exe
  2⤵
  PID:7064
- C:\Windows\System\YgDOLpf.exe
  C:\Windows\System\YgDOLpf.exe
  2⤵
  PID:7080
- C:\Windows\System\LmgFuBl.exe
  C:\Windows\System\LmgFuBl.exe
  2⤵
  PID:7100
- C:\Windows\System\YsbgTAL.exe
  C:\Windows\System\YsbgTAL.exe
  2⤵
  PID:7116
- C:\Windows\System\ilSBaGy.exe
  C:\Windows\System\ilSBaGy.exe
  2⤵
  PID:5756
- C:\Windows\System\pcLcmBq.exe
  C:\Windows\System\pcLcmBq.exe
  2⤵
  PID:5740
- C:\Windows\System\WzCRXhh.exe
  C:\Windows\System\WzCRXhh.exe
  2⤵
  PID:6148
- C:\Windows\System\poePkBV.exe
  C:\Windows\System\poePkBV.exe
  2⤵
  PID:6164
- C:\Windows\System\jyWIYCR.exe
  C:\Windows\System\jyWIYCR.exe
  2⤵
  PID:6180
- C:\Windows\System\MdaOfCN.exe
  C:\Windows\System\MdaOfCN.exe
  2⤵
  PID:6208
- C:\Windows\System\qFCxWmT.exe
  C:\Windows\System\qFCxWmT.exe
  2⤵
  PID:6244
- C:\Windows\System\advuJbJ.exe
  C:\Windows\System\advuJbJ.exe
  2⤵
  PID:6268
- C:\Windows\System\vpHErhq.exe
  C:\Windows\System\vpHErhq.exe
  2⤵
  PID:6260
- C:\Windows\System\wSIbBIi.exe
  C:\Windows\System\wSIbBIi.exe
  2⤵
  PID:6284
- C:\Windows\System\IDYTYgJ.exe
  C:\Windows\System\IDYTYgJ.exe
  2⤵
  PID:6352
- C:\Windows\System\USBduIv.exe
  C:\Windows\System\USBduIv.exe
  2⤵
  PID:6384
- C:\Windows\System\COuYVWh.exe
  C:\Windows\System\COuYVWh.exe
  2⤵
  PID:6400
- C:\Windows\System\TdiEHNq.exe
  C:\Windows\System\TdiEHNq.exe
  2⤵
  PID:6404
- C:\Windows\System\KAYVpQP.exe
  C:\Windows\System\KAYVpQP.exe
  2⤵
  PID:6464
- C:\Windows\System\BsiwcAr.exe
  C:\Windows\System\BsiwcAr.exe
  2⤵
  PID:6532
- C:\Windows\System\CpbzLhv.exe
  C:\Windows\System\CpbzLhv.exe
  2⤵
  PID:6588
- C:\Windows\System\YOJmwbs.exe
  C:\Windows\System\YOJmwbs.exe
  2⤵
  PID:6628
- C:\Windows\System\dEwghkv.exe
  C:\Windows\System\dEwghkv.exe
  2⤵
  PID:6700
- C:\Windows\System\hlITGZd.exe
  C:\Windows\System\hlITGZd.exe
  2⤵
  PID:6476
- C:\Windows\System\YFejILB.exe
  C:\Windows\System\YFejILB.exe
  2⤵
  PID:6608
- C:\Windows\System\dNFGDDC.exe
  C:\Windows\System\dNFGDDC.exe
  2⤵
  PID:6680
- C:\Windows\System\FlYUMIP.exe
  C:\Windows\System\FlYUMIP.exe
  2⤵
  PID:6752
- C:\Windows\System\BXbMwYj.exe
  C:\Windows\System\BXbMwYj.exe
  2⤵
  PID:6604
- C:\Windows\System\aDmsHSW.exe
  C:\Windows\System\aDmsHSW.exe
  2⤵
  PID:6796
- C:\Windows\System\MuNBILj.exe
  C:\Windows\System\MuNBILj.exe
  2⤵
  PID:6332
- C:\Windows\System\gOhcwnb.exe
  C:\Windows\System\gOhcwnb.exe
  2⤵
  PID:6540
- C:\Windows\System\Ljgiviv.exe
  C:\Windows\System\Ljgiviv.exe
  2⤵
  PID:6776
- C:\Windows\System\IhnRfWg.exe
  C:\Windows\System\IhnRfWg.exe
  2⤵
  PID:6820
- C:\Windows\System\Ahenzmh.exe
  C:\Windows\System\Ahenzmh.exe
  2⤵
  PID:6856
- C:\Windows\System\dIpznXT.exe
  C:\Windows\System\dIpznXT.exe
  2⤵
  PID:6876
- C:\Windows\System\DKgtAAh.exe
  C:\Windows\System\DKgtAAh.exe
  2⤵
  PID:6932
- C:\Windows\System\SyUmmrj.exe
  C:\Windows\System\SyUmmrj.exe
  2⤵
  PID:6956
- C:\Windows\System\etUUZjh.exe
  C:\Windows\System\etUUZjh.exe
  2⤵
  PID:6972
- C:\Windows\System\Mlvwkhs.exe
  C:\Windows\System\Mlvwkhs.exe
  2⤵
  PID:7024
- C:\Windows\System\PcShvWV.exe
  C:\Windows\System\PcShvWV.exe
  2⤵
  PID:7096
- C:\Windows\System\HstkCpV.exe
  C:\Windows\System\HstkCpV.exe
  2⤵
  PID:7060
- C:\Windows\System\JaPxMzC.exe
  C:\Windows\System\JaPxMzC.exe
  2⤵
  PID:7160
- C:\Windows\System\RByXCrn.exe
  C:\Windows\System\RByXCrn.exe
  2⤵
  PID:7148
- C:\Windows\System\KewREBR.exe
  C:\Windows\System\KewREBR.exe
  2⤵
  PID:5844
- C:\Windows\System\IKFNAOZ.exe
  C:\Windows\System\IKFNAOZ.exe
  2⤵
  PID:5864
- C:\Windows\System\NWnVznO.exe
  C:\Windows\System\NWnVznO.exe
  2⤵
  PID:5372
- C:\Windows\System\OKiBxVB.exe
  C:\Windows\System\OKiBxVB.exe
  2⤵
  PID:6248
- C:\Windows\System\KzfqPbk.exe
  C:\Windows\System\KzfqPbk.exe
  2⤵
  PID:6312
- C:\Windows\System\asYZmWo.exe
  C:\Windows\System\asYZmWo.exe
  2⤵
  PID:6420
- C:\Windows\System\wDGfAXX.exe
  C:\Windows\System\wDGfAXX.exe
  2⤵
  PID:6344
- C:\Windows\System\QLjySRt.exe
  C:\Windows\System\QLjySRt.exe
  2⤵
  PID:6524
- C:\Windows\System\iQZUEuJ.exe
  C:\Windows\System\iQZUEuJ.exe
  2⤵
  PID:6624
- C:\Windows\System\BjwJCuV.exe
  C:\Windows\System\BjwJCuV.exe
  2⤵
  PID:6448
- C:\Windows\System\NbfIAkf.exe
  C:\Windows\System\NbfIAkf.exe
  2⤵
  PID:6512
- C:\Windows\System\inkcVgW.exe
  C:\Windows\System\inkcVgW.exe
  2⤵
  PID:6792
- C:\Windows\System\WgxUYpo.exe
  C:\Windows\System\WgxUYpo.exe
  2⤵
  PID:6756
- C:\Windows\System\VlHNPza.exe
  C:\Windows\System\VlHNPza.exe
  2⤵
  PID:6800
- C:\Windows\System\OtVmYuh.exe
  C:\Windows\System\OtVmYuh.exe
  2⤵
  PID:6788
- C:\Windows\System\eiMKiiI.exe
  C:\Windows\System\eiMKiiI.exe
  2⤵
  PID:6760
- C:\Windows\System\qiUHNgt.exe
  C:\Windows\System\qiUHNgt.exe
  2⤵
  PID:6928
- C:\Windows\System\sIcKxXy.exe
  C:\Windows\System\sIcKxXy.exe
  2⤵
  PID:6872
- C:\Windows\System\SJrBPtw.exe
  C:\Windows\System\SJrBPtw.exe
  2⤵
  PID:7108
- C:\Windows\System\lkNSxHo.exe
  C:\Windows\System\lkNSxHo.exe
  2⤵
  PID:7072
- C:\Windows\System\cyHdjLT.exe
  C:\Windows\System\cyHdjLT.exe
  2⤵
  PID:6948
- C:\Windows\System\cfrUgVI.exe
  C:\Windows\System\cfrUgVI.exe
  2⤵
  PID:7144
- C:\Windows\System\crdAsPv.exe
  C:\Windows\System\crdAsPv.exe
  2⤵
  PID:7152
- C:\Windows\System\XEGBpKV.exe
  C:\Windows\System\XEGBpKV.exe
  2⤵
  PID:6192
- C:\Windows\System\eBZZQIM.exe
  C:\Windows\System\eBZZQIM.exe
  2⤵
  PID:6172
- C:\Windows\System\LUmGLfo.exe
  C:\Windows\System\LUmGLfo.exe
  2⤵
  PID:6348
- C:\Windows\System\KczkQpO.exe
  C:\Windows\System\KczkQpO.exe
  2⤵
  PID:6496
- C:\Windows\System\gGtHEKg.exe
  C:\Windows\System\gGtHEKg.exe
  2⤵
  PID:6528
- C:\Windows\System\cgkKhLz.exe
  C:\Windows\System\cgkKhLz.exe
  2⤵
  PID:6444
- C:\Windows\System\zhTRBWS.exe
  C:\Windows\System\zhTRBWS.exe
  2⤵
  PID:6576
- C:\Windows\System\ucTrhsi.exe
  C:\Windows\System\ucTrhsi.exe
  2⤵
  PID:6716
- C:\Windows\System\dFeXkHQ.exe
  C:\Windows\System\dFeXkHQ.exe
  2⤵
  PID:7040
- C:\Windows\System\VoXxTsf.exe
  C:\Windows\System\VoXxTsf.exe
  2⤵
  PID:7020
- C:\Windows\System\RCuTeRC.exe
  C:\Windows\System\RCuTeRC.exe
  2⤵
  PID:6916
- C:\Windows\System\AADWLpI.exe
  C:\Windows\System\AADWLpI.exe
  2⤵
  PID:6152
- C:\Windows\System\GJioWkk.exe
  C:\Windows\System\GJioWkk.exe
  2⤵
  PID:6380
- C:\Windows\System\cpEAsXU.exe
  C:\Windows\System\cpEAsXU.exe
  2⤵
  PID:6460
- C:\Windows\System\GERCOLv.exe
  C:\Windows\System\GERCOLv.exe
  2⤵
  PID:6736
- C:\Windows\System\HUDEkaW.exe
  C:\Windows\System\HUDEkaW.exe
  2⤵
  PID:6784
- C:\Windows\System\oykPdTF.exe
  C:\Windows\System\oykPdTF.exe
  2⤵
  PID:6556
- C:\Windows\System\djtSgBe.exe
  C:\Windows\System\djtSgBe.exe
  2⤵
  PID:7016
- C:\Windows\System\qrVlokI.exe
  C:\Windows\System\qrVlokI.exe
  2⤵
  PID:6840
- C:\Windows\System\jfylNDO.exe
  C:\Windows\System\jfylNDO.exe
  2⤵
  PID:6668
- C:\Windows\System\mWODpDt.exe
  C:\Windows\System\mWODpDt.exe
  2⤵
  PID:7140
- C:\Windows\System\fyyejvu.exe
  C:\Windows\System\fyyejvu.exe
  2⤵
  PID:6240
- C:\Windows\System\AmupGqS.exe
  C:\Windows\System\AmupGqS.exe
  2⤵
  PID:7176
- C:\Windows\System\RXghUuW.exe
  C:\Windows\System\RXghUuW.exe
  2⤵
  PID:7196
- C:\Windows\System\SNacEQx.exe
  C:\Windows\System\SNacEQx.exe
  2⤵
  PID:7212
- C:\Windows\System\jVlguPn.exe
  C:\Windows\System\jVlguPn.exe
  2⤵
  PID:7232
- C:\Windows\System\TWqsFLz.exe
  C:\Windows\System\TWqsFLz.exe
  2⤵
  PID:7248
- C:\Windows\System\xcMeYXR.exe
  C:\Windows\System\xcMeYXR.exe
  2⤵
  PID:7268
- C:\Windows\System\GwqjOuG.exe
  C:\Windows\System\GwqjOuG.exe
  2⤵
  PID:7284
- C:\Windows\System\vEXCBOA.exe
  C:\Windows\System\vEXCBOA.exe
  2⤵
  PID:7300
- C:\Windows\System\GMcKKXk.exe
  C:\Windows\System\GMcKKXk.exe
  2⤵
  PID:7316
- C:\Windows\System\mWMwCPm.exe
  C:\Windows\System\mWMwCPm.exe
  2⤵
  PID:7332
- C:\Windows\System\KMLhLmg.exe
  C:\Windows\System\KMLhLmg.exe
  2⤵
  PID:7352
- C:\Windows\System\ntiZErI.exe
  C:\Windows\System\ntiZErI.exe
  2⤵
  PID:7368
- C:\Windows\System\HlascWs.exe
  C:\Windows\System\HlascWs.exe
  2⤵
  PID:7384
- C:\Windows\System\ZdBYjkj.exe
  C:\Windows\System\ZdBYjkj.exe
  2⤵
  PID:7400
- C:\Windows\System\iMZXWsm.exe
  C:\Windows\System\iMZXWsm.exe
  2⤵
  PID:7416
- C:\Windows\System\bBEeVGI.exe
  C:\Windows\System\bBEeVGI.exe
  2⤵
  PID:7432
- C:\Windows\System\ItJLaTL.exe
  C:\Windows\System\ItJLaTL.exe
  2⤵
  PID:7452
- C:\Windows\System\mOGjvyG.exe
  C:\Windows\System\mOGjvyG.exe
  2⤵
  PID:7468
- C:\Windows\System\PUIJble.exe
  C:\Windows\System\PUIJble.exe
  2⤵
  PID:7484
- C:\Windows\System\xlHVvQi.exe
  C:\Windows\System\xlHVvQi.exe
  2⤵
  PID:7504
- C:\Windows\System\xlpyWqu.exe
  C:\Windows\System\xlpyWqu.exe
  2⤵
  PID:7520
- C:\Windows\System\COBmPzc.exe
  C:\Windows\System\COBmPzc.exe
  2⤵
  PID:7536
- C:\Windows\System\KawAeNZ.exe
  C:\Windows\System\KawAeNZ.exe
  2⤵
  PID:7552
- C:\Windows\System\AQTJlHP.exe
  C:\Windows\System\AQTJlHP.exe
  2⤵
  PID:7572
- C:\Windows\System\VWdHKcp.exe
  C:\Windows\System\VWdHKcp.exe
  2⤵
  PID:7588
- C:\Windows\System\yUPmIfE.exe
  C:\Windows\System\yUPmIfE.exe
  2⤵
  PID:7608
- C:\Windows\System\XbGeMLy.exe
  C:\Windows\System\XbGeMLy.exe
  2⤵
  PID:7624
- C:\Windows\System\IyUBWOB.exe
  C:\Windows\System\IyUBWOB.exe
  2⤵
  PID:7640
- C:\Windows\System\RdUYbzF.exe
  C:\Windows\System\RdUYbzF.exe
  2⤵
  PID:7656
- C:\Windows\System\LbmvlBv.exe
  C:\Windows\System\LbmvlBv.exe
  2⤵
  PID:7672
- C:\Windows\System\WZsReNT.exe
  C:\Windows\System\WZsReNT.exe
  2⤵
  PID:7688
- C:\Windows\System\NfKxHFl.exe
  C:\Windows\System\NfKxHFl.exe
  2⤵
  PID:7704
- C:\Windows\System\iYWQTFn.exe
  C:\Windows\System\iYWQTFn.exe
  2⤵
  PID:7720
- C:\Windows\System\ioDNPrg.exe
  C:\Windows\System\ioDNPrg.exe
  2⤵
  PID:7736
- C:\Windows\System\qlQrKXF.exe
  C:\Windows\System\qlQrKXF.exe
  2⤵
  PID:7752
- C:\Windows\System\vsdMDRh.exe
  C:\Windows\System\vsdMDRh.exe
  2⤵
  PID:7768
- C:\Windows\System\OCBQavt.exe
  C:\Windows\System\OCBQavt.exe
  2⤵
  PID:7784
- C:\Windows\System\lZufBHz.exe
  C:\Windows\System\lZufBHz.exe
  2⤵
  PID:7808
- C:\Windows\System\dNqIphw.exe
  C:\Windows\System\dNqIphw.exe
  2⤵
  PID:7828
- C:\Windows\System\fKHpdoC.exe
  C:\Windows\System\fKHpdoC.exe
  2⤵
  PID:7844
- C:\Windows\System\BFqRDvy.exe
  C:\Windows\System\BFqRDvy.exe
  2⤵
  PID:7864
- C:\Windows\System\wqXjyUl.exe
  C:\Windows\System\wqXjyUl.exe
  2⤵
  PID:7880
- C:\Windows\System\Cagibgu.exe
  C:\Windows\System\Cagibgu.exe
  2⤵
  PID:7896
- C:\Windows\System\ArYBKHA.exe
  C:\Windows\System\ArYBKHA.exe
  2⤵
  PID:7916
- C:\Windows\System\PLSEZYk.exe
  C:\Windows\System\PLSEZYk.exe
  2⤵
  PID:7932
- C:\Windows\System\kQxMWbP.exe
  C:\Windows\System\kQxMWbP.exe
  2⤵
  PID:7948
- C:\Windows\System\atpnHmK.exe
  C:\Windows\System\atpnHmK.exe
  2⤵
  PID:7964
- C:\Windows\System\keSFJdG.exe
  C:\Windows\System\keSFJdG.exe
  2⤵
  PID:7984
- C:\Windows\System\ejPrzCE.exe
  C:\Windows\System\ejPrzCE.exe
  2⤵
  PID:8000
- C:\Windows\System\zsgeJwG.exe
  C:\Windows\System\zsgeJwG.exe
  2⤵
  PID:8020
- C:\Windows\System\uvulRlJ.exe
  C:\Windows\System\uvulRlJ.exe
  2⤵
  PID:8036
- C:\Windows\System\TpYFuUn.exe
  C:\Windows\System\TpYFuUn.exe
  2⤵
  PID:8052
- C:\Windows\System\LYWDCIs.exe
  C:\Windows\System\LYWDCIs.exe
  2⤵
  PID:8068
- C:\Windows\System\SxtZtEy.exe
  C:\Windows\System\SxtZtEy.exe
  2⤵
  PID:8084
- C:\Windows\System\knoiVLW.exe
  C:\Windows\System\knoiVLW.exe
  2⤵
  PID:8100
- C:\Windows\System\QqFyZPl.exe
  C:\Windows\System\QqFyZPl.exe
  2⤵
  PID:8116
- C:\Windows\System\TCHIjKu.exe
  C:\Windows\System\TCHIjKu.exe
  2⤵
  PID:8136
- C:\Windows\System\XENmzyI.exe
  C:\Windows\System\XENmzyI.exe
  2⤵
  PID:8152
- C:\Windows\System\oQatJnG.exe
  C:\Windows\System\oQatJnG.exe
  2⤵
  PID:8168
- C:\Windows\System\JMNmRVM.exe
  C:\Windows\System\JMNmRVM.exe
  2⤵
  PID:8184
- C:\Windows\System\VdUdGGz.exe
  C:\Windows\System\VdUdGGz.exe
  2⤵
  PID:7184
- C:\Windows\System\AInoCch.exe
  C:\Windows\System\AInoCch.exe
  2⤵
  PID:7128
- C:\Windows\System\fwIVbll.exe
  C:\Windows\System\fwIVbll.exe
  2⤵
  PID:6772
- C:\Windows\System\vrKdLRg.exe
  C:\Windows\System\vrKdLRg.exe
  2⤵
  PID:7244
- C:\Windows\System\WisLPeb.exe
  C:\Windows\System\WisLPeb.exe
  2⤵
  PID:7308
- C:\Windows\System\FvXyzBY.exe
  C:\Windows\System\FvXyzBY.exe
  2⤵
  PID:7380
- C:\Windows\System\aYstcxA.exe
  C:\Windows\System\aYstcxA.exe
  2⤵
  PID:7440
- C:\Windows\System\kAEXxFS.exe
  C:\Windows\System\kAEXxFS.exe
  2⤵
  PID:7448
- C:\Windows\System\DiXVgyX.exe
  C:\Windows\System\DiXVgyX.exe
  2⤵
  PID:7260
- C:\Windows\System\hdOOjsk.exe
  C:\Windows\System\hdOOjsk.exe
  2⤵
  PID:7428
- C:\Windows\System\EfHkKkn.exe
  C:\Windows\System\EfHkKkn.exe
  2⤵
  PID:7424
- C:\Windows\System\ckcuzMp.exe
  C:\Windows\System\ckcuzMp.exe
  2⤵
  PID:7360
- C:\Windows\System\tewrGhR.exe
  C:\Windows\System\tewrGhR.exe
  2⤵
  PID:7500
- C:\Windows\System\cEPLPIK.exe
  C:\Windows\System\cEPLPIK.exe
  2⤵
  PID:7548
- C:\Windows\System\FjonPXl.exe
  C:\Windows\System\FjonPXl.exe
  2⤵
  PID:7600
- C:\Windows\System\SOVMGqN.exe
  C:\Windows\System\SOVMGqN.exe
  2⤵
  PID:7664
- C:\Windows\System\HNNfzYM.exe
  C:\Windows\System\HNNfzYM.exe
  2⤵
  PID:7684
- C:\Windows\System\TUpUNyK.exe
  C:\Windows\System\TUpUNyK.exe
  2⤵
  PID:7728
- C:\Windows\System\kUbHKhX.exe
  C:\Windows\System\kUbHKhX.exe
  2⤵
  PID:7616
- C:\Windows\System\EJtXUjv.exe
  C:\Windows\System\EJtXUjv.exe
  2⤵
  PID:7796
- C:\Windows\System\bscfROV.exe
  C:\Windows\System\bscfROV.exe
  2⤵
  PID:7840
- C:\Windows\System\fHFUzFZ.exe
  C:\Windows\System\fHFUzFZ.exe
  2⤵
  PID:7712
- C:\Windows\System\SedLAzt.exe
  C:\Windows\System\SedLAzt.exe
  2⤵
  PID:7780
- C:\Windows\System\jCOyIKa.exe
  C:\Windows\System\jCOyIKa.exe
  2⤵
  PID:7892
- C:\Windows\System\FCZSioR.exe
  C:\Windows\System\FCZSioR.exe
  2⤵
  PID:7908
- C:\Windows\System\pFqWacy.exe
  C:\Windows\System\pFqWacy.exe
  2⤵
  PID:7972
- C:\Windows\System\GsmCQjk.exe
  C:\Windows\System\GsmCQjk.exe
  2⤵
  PID:7996
- C:\Windows\System\MlOYmfi.exe
  C:\Windows\System\MlOYmfi.exe
  2⤵
  PID:7976
- C:\Windows\System\YTQZzvC.exe
  C:\Windows\System\YTQZzvC.exe
  2⤵
  PID:8124
- C:\Windows\System\vfBwZqr.exe
  C:\Windows\System\vfBwZqr.exe
  2⤵
  PID:8008
- C:\Windows\System\HarfGKF.exe
  C:\Windows\System\HarfGKF.exe
  2⤵
  PID:8048
- C:\Windows\System\hpYoqWc.exe
  C:\Windows\System\hpYoqWc.exe
  2⤵
  PID:8112
- C:\Windows\System\UQtKavn.exe
  C:\Windows\System\UQtKavn.exe
  2⤵
  PID:8180
- C:\Windows\System\zrMqOuE.exe
  C:\Windows\System\zrMqOuE.exe
  2⤵
  PID:7172
- C:\Windows\System\rgIfNEq.exe
  C:\Windows\System\rgIfNEq.exe
  2⤵
  PID:8164
- C:\Windows\System\yRailuM.exe
  C:\Windows\System\yRailuM.exe
  2⤵
  PID:7276
- C:\Windows\System\wNggqIg.exe
  C:\Windows\System\wNggqIg.exe
  2⤵
  PID:7228
- C:\Windows\System\OQVrKzq.exe
  C:\Windows\System\OQVrKzq.exe
  2⤵
  PID:7960
- C:\Windows\System\kUSsWgv.exe
  C:\Windows\System\kUSsWgv.exe
  2⤵
  PID:8160
- C:\Windows\System\FkzvPAP.exe
  C:\Windows\System\FkzvPAP.exe
  2⤵
  PID:7188
- C:\Windows\System\ktaJbeq.exe
  C:\Windows\System\ktaJbeq.exe
  2⤵
  PID:8044
- C:\Windows\System\JfDeGOS.exe
  C:\Windows\System\JfDeGOS.exe
  2⤵
  PID:7532
- C:\Windows\System\EKcUkKn.exe
  C:\Windows\System\EKcUkKn.exe
  2⤵
  PID:7344
- C:\Windows\System\zOiVnOG.exe
  C:\Windows\System\zOiVnOG.exe
  2⤵
  PID:7480
- C:\Windows\System\LnTKXNp.exe
  C:\Windows\System\LnTKXNp.exe
  2⤵
  PID:7364
- C:\Windows\System\QbylyEi.exe
  C:\Windows\System\QbylyEi.exe
  2⤵
  PID:7544
- C:\Windows\System\yHIuhjn.exe
  C:\Windows\System\yHIuhjn.exe
  2⤵
  PID:7324
- C:\Windows\System\JbXajta.exe
  C:\Windows\System\JbXajta.exe
  2⤵
  PID:7700
- C:\Windows\System\XvXVaHw.exe
  C:\Windows\System\XvXVaHw.exe
  2⤵
  PID:7568
- C:\Windows\System\ZnDwgSY.exe
  C:\Windows\System\ZnDwgSY.exe
  2⤵
  PID:7804
- C:\Windows\System\vOCNbSy.exe
  C:\Windows\System\vOCNbSy.exe
  2⤵
  PID:7904
- C:\Windows\System\ioSNpIC.exe
  C:\Windows\System\ioSNpIC.exe
  2⤵
  PID:7764
- C:\Windows\System\VdZtIze.exe
  C:\Windows\System\VdZtIze.exe
  2⤵
  PID:7376
- C:\Windows\System\IVCQSEQ.exe
  C:\Windows\System\IVCQSEQ.exe
  2⤵
  PID:6264
- C:\Windows\System\coQfhkW.exe
  C:\Windows\System\coQfhkW.exe
  2⤵
  PID:7560
- C:\Windows\System\xKOIsIj.exe
  C:\Windows\System\xKOIsIj.exe
  2⤵
  PID:7876
- C:\Windows\System\FPuuoGV.exe
  C:\Windows\System\FPuuoGV.exe
  2⤵
  PID:7444
- C:\Windows\System\eKRvico.exe
  C:\Windows\System\eKRvico.exe
  2⤵
  PID:8060
- C:\Windows\System\enubCZq.exe
  C:\Windows\System\enubCZq.exe
  2⤵
  PID:7208
- C:\Windows\System\PGRhuwz.exe
  C:\Windows\System\PGRhuwz.exe
  2⤵
  PID:7632
- C:\Windows\System\RCQiLFd.exe
  C:\Windows\System\RCQiLFd.exe
  2⤵
  PID:7816
- C:\Windows\System\npQrrdV.exe
  C:\Windows\System\npQrrdV.exe
  2⤵
  PID:7680
- C:\Windows\System\tdzjdIJ.exe
  C:\Windows\System\tdzjdIJ.exe
  2⤵
  PID:7944
- C:\Windows\System\kVKQkYs.exe
  C:\Windows\System\kVKQkYs.exe
  2⤵
  PID:7928
- C:\Windows\System\UtTfNwF.exe
  C:\Windows\System\UtTfNwF.exe
  2⤵
  PID:7924
- C:\Windows\System\jnVHPyp.exe
  C:\Windows\System\jnVHPyp.exe
  2⤵
  PID:8080
- C:\Windows\System\DwTMrWo.exe
  C:\Windows\System\DwTMrWo.exe
  2⤵
  PID:7760
- C:\Windows\System\wiFEHRX.exe
  C:\Windows\System\wiFEHRX.exe
  2⤵
  PID:8032
- C:\Windows\System\NVlAowk.exe
  C:\Windows\System\NVlAowk.exe
  2⤵
  PID:7092
- C:\Windows\System\RjPVwed.exe
  C:\Windows\System\RjPVwed.exe
  2⤵
  PID:8200
- C:\Windows\System\iiTyTgA.exe
  C:\Windows\System\iiTyTgA.exe
  2⤵
  PID:8216
- C:\Windows\System\FtoTuuE.exe
  C:\Windows\System\FtoTuuE.exe
  2⤵
  PID:8232
- C:\Windows\System\qsJkQle.exe
  C:\Windows\System\qsJkQle.exe
  2⤵
  PID:8248
- C:\Windows\System\mlnXOuY.exe
  C:\Windows\System\mlnXOuY.exe
  2⤵
  PID:8268
- C:\Windows\System\NPlPfNP.exe
  C:\Windows\System\NPlPfNP.exe
  2⤵
  PID:8284
- C:\Windows\System\rXsydOT.exe
  C:\Windows\System\rXsydOT.exe
  2⤵
  PID:8304
- C:\Windows\System\agaQdgy.exe
  C:\Windows\System\agaQdgy.exe
  2⤵
  PID:8328
- C:\Windows\System\dLesqUs.exe
  C:\Windows\System\dLesqUs.exe
  2⤵
  PID:8344
- C:\Windows\System\WJwBLwC.exe
  C:\Windows\System\WJwBLwC.exe
  2⤵
  PID:8368
- C:\Windows\System\JwxxFMl.exe
  C:\Windows\System\JwxxFMl.exe
  2⤵
  PID:8384
- C:\Windows\System\jSZxUlz.exe
  C:\Windows\System\jSZxUlz.exe
  2⤵
  PID:8400
- C:\Windows\System\WfLomlB.exe
  C:\Windows\System\WfLomlB.exe
  2⤵
  PID:8424
- C:\Windows\System\BxCXryC.exe
  C:\Windows\System\BxCXryC.exe
  2⤵
  PID:8452
- C:\Windows\System\PEFphlK.exe
  C:\Windows\System\PEFphlK.exe
  2⤵
  PID:8468
- C:\Windows\System\MvNjgGY.exe
  C:\Windows\System\MvNjgGY.exe
  2⤵
  PID:8488
- C:\Windows\System\cwOGdGO.exe
  C:\Windows\System\cwOGdGO.exe
  2⤵
  PID:8504
- C:\Windows\System\bfYNEPZ.exe
  C:\Windows\System\bfYNEPZ.exe
  2⤵
  PID:8520
- C:\Windows\System\RMOeCHp.exe
  C:\Windows\System\RMOeCHp.exe
  2⤵
  PID:8540
- C:\Windows\System\scuErFf.exe
  C:\Windows\System\scuErFf.exe
  2⤵
  PID:8556
- C:\Windows\System\dHePdOZ.exe
  C:\Windows\System\dHePdOZ.exe
  2⤵
  PID:8576
- C:\Windows\System\ByRpHda.exe
  C:\Windows\System\ByRpHda.exe
  2⤵
  PID:8592
- C:\Windows\System\FVALeVS.exe
  C:\Windows\System\FVALeVS.exe
  2⤵
  PID:8612
- C:\Windows\System\yjjfrwL.exe
  C:\Windows\System\yjjfrwL.exe
  2⤵
  PID:8628
- C:\Windows\System\JGUXUxJ.exe
  C:\Windows\System\JGUXUxJ.exe
  2⤵
  PID:8644
- C:\Windows\System\NMnXzeH.exe
  C:\Windows\System\NMnXzeH.exe
  2⤵
  PID:8660
- C:\Windows\System\ytBOssW.exe
  C:\Windows\System\ytBOssW.exe
  2⤵
  PID:8680
- C:\Windows\System\jsnZjqY.exe
  C:\Windows\System\jsnZjqY.exe
  2⤵
  PID:8700
- C:\Windows\System\IvYNGti.exe
  C:\Windows\System\IvYNGti.exe
  2⤵
  PID:8728
- C:\Windows\System\DlyglPU.exe
  C:\Windows\System\DlyglPU.exe
  2⤵
  PID:8744
- C:\Windows\System\cywfqEL.exe
  C:\Windows\System\cywfqEL.exe
  2⤵
  PID:8760
- C:\Windows\System\EyEcFwS.exe
  C:\Windows\System\EyEcFwS.exe
  2⤵
  PID:8780
- C:\Windows\System\OJDnMiC.exe
  C:\Windows\System\OJDnMiC.exe
  2⤵
  PID:8796
- C:\Windows\System\QeLllzx.exe
  C:\Windows\System\QeLllzx.exe
  2⤵
  PID:8812
- C:\Windows\System\NCxhljQ.exe
  C:\Windows\System\NCxhljQ.exe
  2⤵
  PID:8828
- C:\Windows\System\CdoXfgS.exe
  C:\Windows\System\CdoXfgS.exe
  2⤵
  PID:8844
- C:\Windows\System\TBXpPfa.exe
  C:\Windows\System\TBXpPfa.exe
  2⤵
  PID:8864
- C:\Windows\System\jJSGMzQ.exe
  C:\Windows\System\jJSGMzQ.exe
  2⤵
  PID:8880
- C:\Windows\System\EhrNsxC.exe
  C:\Windows\System\EhrNsxC.exe
  2⤵
  PID:8896
- C:\Windows\System\vgaPOlp.exe
  C:\Windows\System\vgaPOlp.exe
  2⤵
  PID:8916
- C:\Windows\System\ndGdXLK.exe
  C:\Windows\System\ndGdXLK.exe
  2⤵
  PID:8932
- C:\Windows\System\bTvSGDt.exe
  C:\Windows\System\bTvSGDt.exe
  2⤵
  PID:8948
- C:\Windows\System\yvvypLH.exe
  C:\Windows\System\yvvypLH.exe
  2⤵
  PID:8964
- C:\Windows\System\DZJEkey.exe
  C:\Windows\System\DZJEkey.exe
  2⤵
  PID:8988
- C:\Windows\System\OkmUdtK.exe
  C:\Windows\System\OkmUdtK.exe
  2⤵
  PID:9004
- C:\Windows\System\MfsRdwZ.exe
  C:\Windows\System\MfsRdwZ.exe
  2⤵
  PID:9020
- C:\Windows\System\KJxIlRK.exe
  C:\Windows\System\KJxIlRK.exe
  2⤵
  PID:9052
- C:\Windows\System\zNyXAeV.exe
  C:\Windows\System\zNyXAeV.exe
  2⤵
  PID:9072
- C:\Windows\System\IAZDBvV.exe
  C:\Windows\System\IAZDBvV.exe
  2⤵
  PID:9088
- C:\Windows\System\gRhFNwN.exe
  C:\Windows\System\gRhFNwN.exe
  2⤵
  PID:9104
- C:\Windows\System\zgElfeY.exe
  C:\Windows\System\zgElfeY.exe
  2⤵
  PID:9120
- C:\Windows\System\SMcnsbw.exe
  C:\Windows\System\SMcnsbw.exe
  2⤵
  PID:9136
- C:\Windows\System\nJwOPYj.exe
  C:\Windows\System\nJwOPYj.exe
  2⤵
  PID:9152
- C:\Windows\System\rwedIiN.exe
  C:\Windows\System\rwedIiN.exe
  2⤵
  PID:9168
- C:\Windows\System\fqAEeed.exe
  C:\Windows\System\fqAEeed.exe
  2⤵
  PID:9184
- C:\Windows\System\yyksHiZ.exe
  C:\Windows\System\yyksHiZ.exe
  2⤵
  PID:9200
- C:\Windows\System\CrvtJLA.exe
  C:\Windows\System\CrvtJLA.exe
  2⤵
  PID:7240
- C:\Windows\System\oAKWgbo.exe
  C:\Windows\System\oAKWgbo.exe
  2⤵
  PID:8208
- C:\Windows\System\jYTpcyO.exe
  C:\Windows\System\jYTpcyO.exe
  2⤵
  PID:8228
- C:\Windows\System\zmMgLcq.exe
  C:\Windows\System\zmMgLcq.exe
  2⤵
  PID:8264
- C:\Windows\System\bmPSXNg.exe
  C:\Windows\System\bmPSXNg.exe
  2⤵
  PID:8300
- C:\Windows\System\LdXOwLx.exe
  C:\Windows\System\LdXOwLx.exe
  2⤵
  PID:8340
- C:\Windows\System\zlWTnaS.exe
  C:\Windows\System\zlWTnaS.exe
  2⤵
  PID:8376
- C:\Windows\System\poQmUHK.exe
  C:\Windows\System\poQmUHK.exe
  2⤵
  PID:8356
- C:\Windows\System\kdUCGnc.exe
  C:\Windows\System\kdUCGnc.exe
  2⤵
  PID:8352
- C:\Windows\System\tvuziPh.exe
  C:\Windows\System\tvuziPh.exe
  2⤵
  PID:8436
- C:\Windows\System\WvcZIjg.exe
  C:\Windows\System\WvcZIjg.exe
  2⤵
  PID:8464
- C:\Windows\System\OTIxLrL.exe
  C:\Windows\System\OTIxLrL.exe
  2⤵
  PID:8532
- C:\Windows\System\BArURRs.exe
  C:\Windows\System\BArURRs.exe
  2⤵
  PID:8572
- C:\Windows\System\ahPwaFu.exe
  C:\Windows\System\ahPwaFu.exe
  2⤵
  PID:8516
- C:\Windows\System\LiWCGGK.exe
  C:\Windows\System\LiWCGGK.exe
  2⤵
  PID:8636
- C:\Windows\System\tobtccE.exe
  C:\Windows\System\tobtccE.exe
  2⤵
  PID:8696
- C:\Windows\System\qgGbKXV.exe
  C:\Windows\System\qgGbKXV.exe
  2⤵
  PID:8724
- C:\Windows\System\gTyAujE.exe
  C:\Windows\System\gTyAujE.exe
  2⤵
  PID:8740
- C:\Windows\System\ErdzmlL.exe
  C:\Windows\System\ErdzmlL.exe
  2⤵
  PID:8768
- C:\Windows\System\uMhhLOc.exe
  C:\Windows\System\uMhhLOc.exe
  2⤵
  PID:8836
- C:\Windows\System\yoMMrOl.exe
  C:\Windows\System\yoMMrOl.exe
  2⤵
  PID:8808
- C:\Windows\System\lXioWnw.exe
  C:\Windows\System\lXioWnw.exe
  2⤵
  PID:8944
- C:\Windows\System\LzPWrML.exe
  C:\Windows\System\LzPWrML.exe
  2⤵
  PID:8996
- C:\Windows\System\SyKHivb.exe
  C:\Windows\System\SyKHivb.exe
  2⤵
  PID:9064
- C:\Windows\System\kLjXFaj.exe
  C:\Windows\System\kLjXFaj.exe
  2⤵
  PID:9100
- C:\Windows\System\GLyPUHV.exe
  C:\Windows\System\GLyPUHV.exe
  2⤵
  PID:9132
- C:\Windows\System\bXjQanK.exe
  C:\Windows\System\bXjQanK.exe
  2⤵
  PID:9160
- C:\Windows\System\fDYYNaE.exe
  C:\Windows\System\fDYYNaE.exe
  2⤵
  PID:9212
- C:\Windows\System\XMAQMiw.exe
  C:\Windows\System\XMAQMiw.exe
  2⤵
  PID:8108
- C:\Windows\System\oiVDgiK.exe
  C:\Windows\System\oiVDgiK.exe
  2⤵
  PID:8296
- C:\Windows\System\AQsWeMP.exe
  C:\Windows\System\AQsWeMP.exe
  2⤵
  PID:8280
- C:\Windows\System\tKbtfRB.exe
  C:\Windows\System\tKbtfRB.exe
  2⤵
  PID:8364
- C:\Windows\System\arvNhaS.exe
  C:\Windows\System\arvNhaS.exe
  2⤵
  PID:8444
- C:\Windows\System\pdSfAfn.exe
  C:\Windows\System\pdSfAfn.exe
  2⤵
  PID:8600
- C:\Windows\System\LnWtXWy.exe
  C:\Windows\System\LnWtXWy.exe
  2⤵
  PID:8484
- C:\Windows\System\hVBfBgc.exe
  C:\Windows\System\hVBfBgc.exe
  2⤵
  PID:8512
- C:\Windows\System\AZTgeMM.exe
  C:\Windows\System\AZTgeMM.exe
  2⤵
  PID:8620
- C:\Windows\System\HqjbAhJ.exe
  C:\Windows\System\HqjbAhJ.exe
  2⤵
  PID:8652
- C:\Windows\System\nLMtgIO.exe
  C:\Windows\System\nLMtgIO.exe
  2⤵
  PID:8672
- C:\Windows\System\JGTgXtR.exe
  C:\Windows\System\JGTgXtR.exe
  2⤵
  PID:8776
- C:\Windows\System\BLytfBB.exe
  C:\Windows\System\BLytfBB.exe
  2⤵
  PID:8876
- C:\Windows\System\BjXeYLY.exe
  C:\Windows\System\BjXeYLY.exe
  2⤵
  PID:8912
- C:\Windows\System\uArMoZg.exe
  C:\Windows\System\uArMoZg.exe
  2⤵
  PID:9016
- C:\Windows\System\LqTDgZY.exe
  C:\Windows\System\LqTDgZY.exe
  2⤵
  PID:9012
- C:\Windows\System\LyKIsoP.exe
  C:\Windows\System\LyKIsoP.exe
  2⤵
  PID:8960
- C:\Windows\System\iJZSWOA.exe
  C:\Windows\System\iJZSWOA.exe
  2⤵
  PID:9176
- C:\Windows\System\fObZCVX.exe
  C:\Windows\System\fObZCVX.exe
  2⤵
  PID:9164
- C:\Windows\System\IUNxAtF.exe
  C:\Windows\System\IUNxAtF.exe
  2⤵
  PID:8408
- C:\Windows\System\ucLYmKc.exe
  C:\Windows\System\ucLYmKc.exe
  2⤵
  PID:8420
- C:\Windows\System\aKsbXsg.exe
  C:\Windows\System\aKsbXsg.exe
  2⤵
  PID:8396
- C:\Windows\System\TJjQAHv.exe
  C:\Windows\System\TJjQAHv.exe
  2⤵
  PID:8640
- C:\Windows\System\KLQZTAy.exe
  C:\Windows\System\KLQZTAy.exe
  2⤵
  PID:8692
- C:\Windows\System\KqtUOrk.exe
  C:\Windows\System\KqtUOrk.exe
  2⤵
  PID:8736
- C:\Windows\System\FCunpGG.exe
  C:\Windows\System\FCunpGG.exe
  2⤵
  PID:8668
- C:\Windows\System\jRijoCS.exe
  C:\Windows\System\jRijoCS.exe
  2⤵
  PID:8856
- C:\Windows\System\xRdlNJh.exe
  C:\Windows\System\xRdlNJh.exe
  2⤵
  PID:8984
- C:\Windows\System\UToRetA.exe
  C:\Windows\System\UToRetA.exe
  2⤵
  PID:8804
- C:\Windows\System\qpsnVZs.exe
  C:\Windows\System\qpsnVZs.exe
  2⤵
  PID:8316
- C:\Windows\System\AYDQDwd.exe
  C:\Windows\System\AYDQDwd.exe
  2⤵
  PID:9060
- C:\Windows\System\TNKqSHG.exe
  C:\Windows\System\TNKqSHG.exe
  2⤵
  PID:8212
- C:\Windows\System\WYBpMiX.exe
  C:\Windows\System\WYBpMiX.exe
  2⤵
  PID:8244
- C:\Windows\System\oDqOALG.exe
  C:\Windows\System\oDqOALG.exe
  2⤵
  PID:8708
- C:\Windows\System\gJmUKWU.exe
  C:\Windows\System\gJmUKWU.exe
  2⤵
  PID:8904
- C:\Windows\System\oJOSekZ.exe
  C:\Windows\System\oJOSekZ.exe
  2⤵
  PID:8460
- C:\Windows\System\cKmSgMG.exe
  C:\Windows\System\cKmSgMG.exe
  2⤵
  PID:9032
- C:\Windows\System\xDIgDSA.exe
  C:\Windows\System\xDIgDSA.exe
  2⤵
  PID:8412
- C:\Windows\System\ZUAjOsY.exe
  C:\Windows\System\ZUAjOsY.exe
  2⤵
  PID:8892
- C:\Windows\System\NgcmZwx.exe
  C:\Windows\System\NgcmZwx.exe
  2⤵
  PID:9128
- C:\Windows\System\lonJHWh.exe
  C:\Windows\System\lonJHWh.exe
  2⤵
  PID:8888
- C:\Windows\System\eHTyHiR.exe
  C:\Windows\System\eHTyHiR.exe
  2⤵
  PID:8480
- C:\Windows\System\YPGzeHu.exe
  C:\Windows\System\YPGzeHu.exe
  2⤵
  PID:9224
- C:\Windows\System\YtDxpLB.exe
  C:\Windows\System\YtDxpLB.exe
  2⤵
  PID:9240
- C:\Windows\System\PzuBOTW.exe
  C:\Windows\System\PzuBOTW.exe
  2⤵
  PID:9256
- C:\Windows\System\BMDxVUS.exe
  C:\Windows\System\BMDxVUS.exe
  2⤵
  PID:9280
- C:\Windows\System\ChdWcCn.exe
  C:\Windows\System\ChdWcCn.exe
  2⤵
  PID:9296
- C:\Windows\System\ZfXpWIy.exe
  C:\Windows\System\ZfXpWIy.exe
  2⤵
  PID:9312
- C:\Windows\System\VvpdMBJ.exe
  C:\Windows\System\VvpdMBJ.exe
  2⤵
  PID:9328
- C:\Windows\System\DfmAmIP.exe
  C:\Windows\System\DfmAmIP.exe
  2⤵
  PID:9344
- C:\Windows\System\VzUKrrl.exe
  C:\Windows\System\VzUKrrl.exe
  2⤵
  PID:9364
- C:\Windows\System\dwfKGRb.exe
  C:\Windows\System\dwfKGRb.exe
  2⤵
  PID:9384
- C:\Windows\System\blLAAxR.exe
  C:\Windows\System\blLAAxR.exe
  2⤵
  PID:9400
- C:\Windows\System\goWKtLr.exe
  C:\Windows\System\goWKtLr.exe
  2⤵
  PID:9416
- C:\Windows\System\LQSYchM.exe
  C:\Windows\System\LQSYchM.exe
  2⤵
  PID:9440
- C:\Windows\System\yPybfhw.exe
  C:\Windows\System\yPybfhw.exe
  2⤵
  PID:9460
- C:\Windows\System\BlocAbu.exe
  C:\Windows\System\BlocAbu.exe
  2⤵
  PID:9480
- C:\Windows\System\qjeLGWF.exe
  C:\Windows\System\qjeLGWF.exe
  2⤵
  PID:9496
- C:\Windows\System\lsbbYwI.exe
  C:\Windows\System\lsbbYwI.exe
  2⤵
  PID:9512
- C:\Windows\System\CrQXMBn.exe
  C:\Windows\System\CrQXMBn.exe
  2⤵
  PID:9548
- C:\Windows\System\QrEOWmd.exe
  C:\Windows\System\QrEOWmd.exe
  2⤵
  PID:9564
- C:\Windows\System\DOzlQdf.exe
  C:\Windows\System\DOzlQdf.exe
  2⤵
  PID:9580
- C:\Windows\System\cHMInOh.exe
  C:\Windows\System\cHMInOh.exe
  2⤵
  PID:9600
- C:\Windows\System\mveayqE.exe
  C:\Windows\System\mveayqE.exe
  2⤵
  PID:9616
- C:\Windows\System\HYppSaU.exe
  C:\Windows\System\HYppSaU.exe
  2⤵
  PID:9632
- C:\Windows\System\fjNjrSd.exe
  C:\Windows\System\fjNjrSd.exe
  2⤵
  PID:9656
- C:\Windows\System\sPiNasc.exe
  C:\Windows\System\sPiNasc.exe
  2⤵
  PID:9820
- C:\Windows\System\OJbAmQY.exe
  C:\Windows\System\OJbAmQY.exe
  2⤵
  PID:9872
- C:\Windows\System\mBnZTvd.exe
  C:\Windows\System\mBnZTvd.exe
  2⤵
  PID:9900
- C:\Windows\System\KynsxFf.exe
  C:\Windows\System\KynsxFf.exe
  2⤵
  PID:9916
- C:\Windows\System\LVIHEXc.exe
  C:\Windows\System\LVIHEXc.exe
  2⤵
  PID:9936
- C:\Windows\System\zcwWxNX.exe
  C:\Windows\System\zcwWxNX.exe
  2⤵
  PID:9952
- C:\Windows\System\cmccdVr.exe
  C:\Windows\System\cmccdVr.exe
  2⤵
  PID:9980
- C:\Windows\System\CBeMXyV.exe
  C:\Windows\System\CBeMXyV.exe
  2⤵
  PID:10000
- C:\Windows\System\JOMWtwC.exe
  C:\Windows\System\JOMWtwC.exe
  2⤵
  PID:10020
- C:\Windows\System\gpAAtUQ.exe
  C:\Windows\System\gpAAtUQ.exe
  2⤵
  PID:10072
- C:\Windows\System\YGCaMeK.exe
  C:\Windows\System\YGCaMeK.exe
  2⤵
  PID:10088
- C:\Windows\System\APRXKwn.exe
  C:\Windows\System\APRXKwn.exe
  2⤵
  PID:10104
- C:\Windows\System\OLHqFKC.exe
  C:\Windows\System\OLHqFKC.exe
  2⤵
  PID:10124
- C:\Windows\System\rQKSjWd.exe
  C:\Windows\System\rQKSjWd.exe
  2⤵
  PID:10156
- C:\Windows\System\wesnMro.exe
  C:\Windows\System\wesnMro.exe
  2⤵
  PID:10176
- C:\Windows\System\JSotRNb.exe
  C:\Windows\System\JSotRNb.exe
  2⤵
  PID:10196
- C:\Windows\System\godVmKw.exe
  C:\Windows\System\godVmKw.exe
  2⤵
  PID:10212
- C:\Windows\System\XfGKCfC.exe
  C:\Windows\System\XfGKCfC.exe
  2⤵
  PID:10228
- C:\Windows\System\UwskLbV.exe
  C:\Windows\System\UwskLbV.exe
  2⤵
  PID:9232
- C:\Windows\System\bcEzUvX.exe
  C:\Windows\System\bcEzUvX.exe
  2⤵
  PID:9272
- C:\Windows\System\LoMAGju.exe
  C:\Windows\System\LoMAGju.exe
  2⤵
  PID:8980
- C:\Windows\System\FvjEkxt.exe
  C:\Windows\System\FvjEkxt.exe
  2⤵
  PID:9320
- C:\Windows\System\nuSVSpX.exe
  C:\Windows\System\nuSVSpX.exe
  2⤵
  PID:9336
- C:\Windows\System\ReYUmru.exe
  C:\Windows\System\ReYUmru.exe
  2⤵
  PID:9432
- C:\Windows\System\eIWXDFQ.exe
  C:\Windows\System\eIWXDFQ.exe
  2⤵
  PID:9436
- C:\Windows\System\qMPztCB.exe
  C:\Windows\System\qMPztCB.exe
  2⤵
  PID:9448
- C:\Windows\System\UzERYGC.exe
  C:\Windows\System\UzERYGC.exe
  2⤵
  PID:9504
- C:\Windows\System\xPaxQDr.exe
  C:\Windows\System\xPaxQDr.exe
  2⤵
  PID:9528
- C:\Windows\System\dVGtCFD.exe
  C:\Windows\System\dVGtCFD.exe
  2⤵
  PID:9596
- C:\Windows\System\MkYDZuD.exe
  C:\Windows\System\MkYDZuD.exe
  2⤵
  PID:9624
- C:\Windows\System\famUMVL.exe
  C:\Windows\System\famUMVL.exe
  2⤵
  PID:9576
- C:\Windows\System\UmClSyW.exe
  C:\Windows\System\UmClSyW.exe
  2⤵
  PID:9644
- C:\Windows\System\LmmDOOU.exe
  C:\Windows\System\LmmDOOU.exe
  2⤵
  PID:9676
- C:\Windows\System\vfeFhrO.exe
  C:\Windows\System\vfeFhrO.exe
  2⤵
  PID:9708
- C:\Windows\System\DnyhBUj.exe
  C:\Windows\System\DnyhBUj.exe
  2⤵
  PID:9720
- C:\Windows\System\jlVbWPg.exe
  C:\Windows\System\jlVbWPg.exe
  2⤵
  PID:9748
- C:\Windows\System\ctTwmoM.exe
  C:\Windows\System\ctTwmoM.exe
  2⤵
  PID:9772
- C:\Windows\System\fPlbiPT.exe
  C:\Windows\System\fPlbiPT.exe
  2⤵
  PID:9788
- C:\Windows\System\BBCkevi.exe
  C:\Windows\System\BBCkevi.exe
  2⤵
  PID:2680
- C:\Windows\System\tLQkgpY.exe
  C:\Windows\System\tLQkgpY.exe
  2⤵
  PID:2044
- C:\Windows\System\CMxmpan.exe
  C:\Windows\System\CMxmpan.exe
  2⤵
  PID:9808
- C:\Windows\System\MOHDQsJ.exe
  C:\Windows\System\MOHDQsJ.exe
  2⤵
  PID:9832
- C:\Windows\System\mnMrEOr.exe
  C:\Windows\System\mnMrEOr.exe
  2⤵
  PID:2896
- C:\Windows\System\ubfyHtP.exe
  C:\Windows\System\ubfyHtP.exe
  2⤵
  PID:9928
- C:\Windows\System\ixHAKhl.exe
  C:\Windows\System\ixHAKhl.exe
  2⤵
  PID:1512
- C:\Windows\System\vcKDssV.exe
  C:\Windows\System\vcKDssV.exe
  2⤵
  PID:9968
- C:\Windows\System\fEmyieP.exe
  C:\Windows\System\fEmyieP.exe
  2⤵
  PID:10016
- C:\Windows\System\jTeFNiP.exe
  C:\Windows\System\jTeFNiP.exe
  2⤵
  PID:9992
- C:\Windows\System\dcXOnBV.exe
  C:\Windows\System\dcXOnBV.exe
  2⤵
  PID:10044
- C:\Windows\System\PrZYsoe.exe
  C:\Windows\System\PrZYsoe.exe
  2⤵
  PID:10056
- C:\Windows\System\zsgrfSL.exe
  C:\Windows\System\zsgrfSL.exe
  2⤵
  PID:10100
- C:\Windows\System\ajxJIkj.exe
  C:\Windows\System\ajxJIkj.exe
  2⤵
  PID:10116
- C:\Windows\System\FFHMMdQ.exe
  C:\Windows\System\FFHMMdQ.exe
  2⤵
  PID:10172
- C:\Windows\System\IcnrdcO.exe
  C:\Windows\System\IcnrdcO.exe
  2⤵
  PID:10204
- C:\Windows\System\JkSBAqk.exe
  C:\Windows\System\JkSBAqk.exe
  2⤵
  PID:10184
- C:\Windows\System\OjnxwwU.exe
  C:\Windows\System\OjnxwwU.exe
  2⤵
  PID:10220
- C:\Windows\System\ldDVldu.exe
  C:\Windows\System\ldDVldu.exe
  2⤵
  PID:9248
- C:\Windows\System\DDSTCwr.exe
  C:\Windows\System\DDSTCwr.exe
  2⤵
  PID:9356
- C:\Windows\System\QQLGxFv.exe
  C:\Windows\System\QQLGxFv.exe
  2⤵
  PID:9380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ANLgPjG.exe

Filesize
3.1MB

MD5
92fa8da1f8554cab04bb91b2925ca295

SHA1
43b3bdc27e801025ad26f457fa36e0f40fcadc13

SHA256
a70b9229ae319c5356a1363115b3a586a6218124454e264e576a0770ffcb1f50

SHA512
374aef757744c8cae872e65eb7b4a0a65ca64b0d7f367086785a463d586d5d6818bdaed7bb3ec80a3dc1ff9d44484249d77beee70b2e24bcd2f519688689c264

Download Submit
C:\Windows\system\EtooPgP.exe

Filesize
3.1MB

MD5
897976040c987f24bae0d4da17b826bd

SHA1
60411fd35a84a51b994db48f14256432563b7cbd

SHA256
c43942af61e51205a8abb901f5657378fbc9e2ad092c44689f0e40dc8df89c63

SHA512
3ddaeb04bce148a65b160af596e8b0bc9c600c40fcc701efc39d8a75d101d58fd2f8b93538aefc8364a3b6867ccaf7d818767156dd4c88e59adf2cdce16f796a

Download Submit
C:\Windows\system\GlEtpjw.exe

Filesize
3.1MB

MD5
d612631f1eafe999ec7125e71aa1b262

SHA1
248002b02d9715d8ecf694c223cf5ce892f32828

SHA256
bf17e1e99fdfbc595221f1e476a98d6c16fe80b8f10dd561eeb133b5a1b85b58

SHA512
8a1ef23525f91ec05eef7fc8c30a9fc57a2abd7696ca76180ca66f8f4639a24f83aeceb9e7dcc94048d762da07946282f75c6cbe51338c704ce1d50a5fbf789b

Download Submit
C:\Windows\system\IUZrUlS.exe

Filesize
3.1MB

MD5
2c142438daa4484eafc11fc7395f5ada

SHA1
8893ea08f3f2a19f4e83cc72354bc659d2dcc38c

SHA256
e01723f934efe2ac0e3ba0a0c82e4beb3209ff871487b0c981570528d21ba7bb

SHA512
bd3cd4a23c621d0f9afe93646b4cfb90360956aa196538042c886e478c75fefe297c730346e6cc714876020619a7b1f9e9e3bb4fbc9103fba95041c2e16746de

Download Submit
C:\Windows\system\JDDzemL.exe

Filesize
3.1MB

MD5
737ba8a7a2b4580186c6dfc840c39744

SHA1
bf9df9e08c666cc40e366489b75d6846b1a5f2f0

SHA256
7e8165383ab97ab966c166fe1ac01c80fb5855f3a2e2c2f587301c7f49f8d51c

SHA512
1401541f3f6d1dc488944daa93537dcef01e566bac79c71da5db6f7ab3993a647653afb64f114780daca9ea5fba58e9e922a88487d0fed1ea29ac25ec9ecbb10

Download Submit
C:\Windows\system\KsQmcxH.exe

Filesize
3.1MB

MD5
2002f4860c25f2f4c4faf987578bcf5e

SHA1
0d243bfb664dea9db0e6f9dc3a8b3bbda3ebbdbc

SHA256
21e77dc82c20cbd7303f5113835f4a6777f88ee82a1a73300e5b62f3e58d7164

SHA512
91aced00aca233ca643d694f1959e30e50f35c7c57d45240c8c7da8fbc2ab4e63e6fb9e27cdad00985c64c4d4cf18ea58169d4ea65fc2accfecd2d7560e8a8fc

Download Submit
C:\Windows\system\NwCIkjP.exe

Filesize
3.1MB

MD5
cf3dd1930669bcb4c9f9d947c4fc9611

SHA1
089a1697be4f70975ee628dc9520f8772db177bf

SHA256
550dad2735ac549bc72e833ba26446b41eea5812cfe2b6277ece9df493bc823d

SHA512
ef6c0c7d51a2c1f6ad273321904cbdbd0b78e3c0b8142a8519efb286b96a64c21d3459e4f70a0e98e261be0f1f5a116a01543f6963a76d6f8e583dc69a0ef758

Download Submit
C:\Windows\system\PIGmqOF.exe

Filesize
3.1MB

MD5
ae4b8f330577fddaf84167d0c50f7adf

SHA1
c8e0b5b942f8837a57630d8b04bf6a088d91dd24

SHA256
237bc9f248abb1a805a773f231968617e7f14e05fff80f8fb239a97b481235d2

SHA512
41f7771dee67ba907bdf550c79a6324848707e59a79870ba5ba48abfb67c2daea7f56a43f4a89d54c04f1489a18f0a2df10c1d3dbbfa2d7bdba349a0c2ac6860

Download Submit
C:\Windows\system\QYRSRPO.exe

Filesize
3.1MB

MD5
4163bd4d430635bd4ba3b0e9f1c41e13

SHA1
aceb65b8c90f4cd70844c121423a7aecb775abaa

SHA256
a1aed9f7bb313f6c33ead768608a0546423acc02d5873fa654e9a0812025cb90

SHA512
73716d2ff5d794aa5b384924f2424ef60349c5e19f46d738c4783973d6bbb07285de5124d3a534d98f906f1d31a35b1176852626f643675afb3c5f743470752d

Download Submit
C:\Windows\system\QmxEBDe.exe

Filesize
3.1MB

MD5
c289871db1c49442b5ed2f27fe5ab7c3

SHA1
4b0ba28c9eca887f69d057e3c075c4853236cd14

SHA256
a18c29be99f46e28447adde68ed25ba2cd61f0d95c232a0b4a3bc0e3680e4539

SHA512
4ce756ba9d50969212ed3b89e18c94d13bd9ecf78f0cb4f280417dec8d30a7742986f48f280635cc3ae157139ada70e4ab2d4cffbd72c9209ac8d7f21f40ca89

Download Submit
C:\Windows\system\XGtNBBg.exe

Filesize
3.1MB

MD5
f1f2ecd5be7ed3ffdaf14f0ddb44c589

SHA1
2961343d9910efbc42180dc38fb740c37d325744

SHA256
a514449d5aea1e1f6a0ea85250e86582c02e19df5ba75286cf75557248096c47

SHA512
a9e7e5f36113a9b967ae01c77b90b51dcfe96b12235e03aaf7cfb53ff4ecd189591faf9d32b2d561b9c54b375b202e87343d635a1c9a5d2028f9d6801fd1f8cb

Download Submit
C:\Windows\system\XhOYunJ.exe

Filesize
3.1MB

MD5
049e778112171ba639ef89c9139303dc

SHA1
659259a0cba8ad8eaff95b95b9421cb828b8de71

SHA256
1355a662914111f03529c239f5b220f1d7e73df9a5dc92734777c888aebc9bfa

SHA512
0debe90b3faa76c2b1424a8a5db28c189ed2a5634745b6ffaa1120380fe283bcc509649602d38a2acc761e8cb5eb9f9f0fead4852c57a447490eba4ea9dc6e55

Download Submit
C:\Windows\system\ZIPgabw.exe

Filesize
3.1MB

MD5
31ee67a196edd1c10bd6ca96e9b0a8a5

SHA1
0e1060be9939c7172e2f766945119aca48a87800

SHA256
99044fe175c7f0d45102cddbda61071a691b66f7d91234595917e68519b29c9d

SHA512
1d0f7119f0dc3b26cdfa1524115dcd458d0888b5faf99478876e6297b29d13aec23bad9c732bccb907fbfdae75715b9d093de0d4e6e0daf50c0c74020efba4dd

Download Submit
C:\Windows\system\cIiTExn.exe

Filesize
3.1MB

MD5
d35f8aceb38b1777ed1b6032092ba222

SHA1
38a28175f012918a5a2e9bf0efa2164155d1d8a7

SHA256
98e649ca41e982d15567a0ab0e6f1b7e80867a963f845ca5a784f264440c7a16

SHA512
ea48ec7f259dc1af466281a6ae9e20975815198b2b1d22f9ac0c5d0b9b8a4f55e551ac438da4ef1de9465133e189403b76a77e063c1329cf9d468de82efaf2bc

Download Submit
C:\Windows\system\dNdqppm.exe

Filesize
3.1MB

MD5
391df70356c29b8731f93b555aaaa027

SHA1
c4ba531b239893b84477b0f3e8ccd62c8e60fb83

SHA256
6ab18ebc8846efdf2f120e415cec356af7492455b9d41dceacd462c095c93a23

SHA512
95e3a5ff166427c3e5f72f0605da2ddca012c74d77188ddd7303121a077105216d448633bb9244e46fbced04167fce11ef025602e0d0b420e05d6106b9f77f41

Download Submit
C:\Windows\system\eHyetLN.exe

Filesize
3.1MB

MD5
9efbfaa7d6b6921df9c2ef1c4d69546c

SHA1
268f0c7e2ed72bb50a50872558d9d1813a0cd49a

SHA256
dafbc628d160d92f427e2e24b6a21a3f5a09926a5f1342c75515b0a5c7500603

SHA512
3b9e6ef8efa8bcb492fb20b1a6a2d5ee319d0217e3c068c3a6b39cf4eee1459da843806bc2bb58f7dfdf36014eae189805db9159ac22c351aff6141189fb6d8a

Download Submit
C:\Windows\system\eLQLGUx.exe

Filesize
3.1MB

MD5
9063e44ed1505706ee466df04026c22f

SHA1
f46744e65f97c00b37b83fb2c2da1d3ad11e6405

SHA256
c37d321db5f7e89fef9cf31d74e3954aa9d4853b1e7ce73ac0335f48ab70fac6

SHA512
e5754e1b73a97b5fcf15bd28875a4e8e20bfb42d396dad51a3001ef6444bcd717bf786a12796bf05a20f7e6007113d27127618f04724b912f5ca8c1f6fe9b757

Download Submit
C:\Windows\system\fdHfSzU.exe

Filesize
3.1MB

MD5
1f09fb4cd1323467fa9b3189eab5290c

SHA1
2b448db3d7824cf833b66c44fded05351ffc4405

SHA256
b22e30757488d83e4105e2a279f4a610e91954ad51afaccd8fe8e98641de7263

SHA512
cabf88765439b4e4864a45fcf6ba0c64a04f811e9dd072a042ad2c7d73740880ed8eee57c16cf6a04b91e839a3e4c18addd5f3e438118f3c8755df36306ea5bf

Download Submit
C:\Windows\system\flOPEKx.exe

Filesize
3.1MB

MD5
c246fda7abeb621b7d1c8c4780feda35

SHA1
c16d3baebbc537a1632171d54c2c01fdf446d201

SHA256
de4760ef65c50eb902db924c42717eb0998249902cc5d3c11a5425131422165c

SHA512
23170ae8981b9663fc154427e2dc76a14cad0c870783a5fe0d8df9766e976cf4582b0d1304554c28805896f56944d50d5f4577926c5eafee769db8fca1ba53e5

Download Submit
C:\Windows\system\jTWksMX.exe

Filesize
3.1MB

MD5
f9f1554f93d416cc45446d6952284f84

SHA1
eccb42653ea027da1b93cc297722b00dd174fe13

SHA256
37b144fe9a57974344c8be959468f0a48d2a80e211b7859621ed996925054070

SHA512
9d8a79e12ea560a3cf8c2d98489c9b7dea62ba73515921347b144cb2878ea117053d9aa71e68d5dbbc8d4d0163dd918e7797af09537e44c5297f5a0549624786

Download Submit
C:\Windows\system\jfjxMup.exe

Filesize
3.1MB

MD5
a5d592753f605ddaca6888c396b29d1c

SHA1
b66d72875f0cafe63386cc7f5137b877cecfa87d

SHA256
5d3fc361aca91d3f5d6bc9d6308801fe1565c5ed285160df5e4956ba2084bb5a

SHA512
b214d96217a3d46adcbdb7ee64186c782a6de29566724accf1318adcec6c4eec4b0b6f71ad7580218fc9ea010b613529b7a7a01c30c6a8e103a0fe0809fe2e1d

Download Submit
C:\Windows\system\nuQreZA.exe

Filesize
3.1MB

MD5
bf10264721f3044c44d94c71e159b8f0

SHA1
6200c2b2c14bf0f1072d58cef3936fae5f302821

SHA256
4a78b2b71d15ff4e5c0d4adaab3bb948ba9027963a43dae161ccc0b9b82357e7

SHA512
e742dc0686e476594ee6a8bdbe55d768fef84f7051e4f4a6d7416faf8e13396ce5d1ec9277ac08545f6844db26fc3d9e9011c6230b999aeba879b24212dd9c06

Download Submit
C:\Windows\system\qRmkeBd.exe

Filesize
3.1MB

MD5
d5d6890544ba273e254e241a020faf23

SHA1
38362f58ae3a055951cc85743aed95df633e08d0

SHA256
bfee105edd961de139b406eac9e17aef6a5d4134ac183bfc6d874f16993841d2

SHA512
40bd8ad7fefa68e7cdbbca67cd495e2d3356621ad46d2ce862b735ccde34e8e730ef62c13d5f17e3f641968ab2874999107b40f8bd29ac32f23294a234387f3f

Download Submit
C:\Windows\system\saXnbBj.exe

Filesize
3.1MB

MD5
a0aae5a60188e5d42a8a5cbb171adf79

SHA1
30c2f61b821b016a6cb4eae30f102cae2c0bf3f0

SHA256
99af22263f76fccd061194e99556e50e37cf47fe64d21fb49715c07093d05443

SHA512
66875734db1dfa2890542318ce35490dee555d6414eaf4d960e248856ee1f471d524d2737553ee94121fe3cdeaf1a7e92ff7e6ee8fd041cfbe4f11f26bf9756a

Download Submit
C:\Windows\system\tylehQD.exe

Filesize
3.1MB

MD5
0e212ff07d0f8ce2bfbe212267301268

SHA1
8bacf97d1afdf1d39d7b01a663c0ef644fa4c075

SHA256
c305978f35d27be052ead300ef851c475a0c2e939864682b88e38a19ebf3bb9d

SHA512
3711f24d902bd4902728c6b442f71e58993cfdfbd3fed6c7959b36647461df29699a39e00fbce4fb660433b9417ecf4157b792281f2cb0cb6997247ff6531c75

Download Submit
C:\Windows\system\uMVXfxd.exe

Filesize
3.1MB

MD5
d5769feeab5b4e04fbe7c6a024cf3adc

SHA1
f977f044a699f61da3e0d5af9671d28ebfcf6a74

SHA256
950203869fa4ab6ab2b5c0d5f5a3fc77252c678adb727fafa565171649591756

SHA512
de098c79fbe9143e20d56155bbbe18e176f9a6f7099d95470bfd69fed8140a98cec8755487f5d6d9d49e91ac7090c7f9907cb0fed596545f7ff86cac08ca4812

Download Submit
C:\Windows\system\uuXDfBD.exe

Filesize
3.1MB

MD5
53f8dde708a95b65d01ed6e071d77025

SHA1
19c25b3d01225fd86eb7fa0179670b8ac047f066

SHA256
3596409460ac77e96414f27ce51866ba5898bb92774c28fbc6389daf29b88658

SHA512
7976bd36f265cc4c66cec24fabc5c212771a84d17f63c56f67aa309f4a0fefa5f54c561636174fec0d88adc797b7bb610c574dbd9a03f0ca5809c28a5c70ffc9

Download Submit
C:\Windows\system\wJPUCJB.exe

Filesize
3.1MB

MD5
4f98fccec7fa3875057560415040f7a3

SHA1
44c5436ff51e02ecf1cbd6d2ea60409c54a82d8c

SHA256
fafedb5e500319dc72cc7e7fc0a8f5c668120d18035a3bccee4962f714e5dc53

SHA512
0edc70a755ff31c14395852eedc00169ed35f4513ade4621ba9a9d542c9594c26279e4c480e1b82b8468a73ba18ae90cee86bcc48f846e00af89506792721120

Download Submit
C:\Windows\system\xnCVNit.exe

Filesize
3.1MB

MD5
b16d43ad9d860bda677ccc53958d0277

SHA1
d4ecd2f9a8eef310637c469a0be90ae91826f53f

SHA256
db74c4bd979e0a37b92e58608e19e2078b72489e0cab077dfe99a007f09bf057

SHA512
1af22f4829aec70664c6e7b4c4d5b9aec8d4751911802bf47395da13979cded02638a7153cf5180a1ac7d06f20be80483710ca7e5a9513bcfc18e6e04a7ad7bb

Download Submit
C:\Windows\system\ymvNvWo.exe

Filesize
3.1MB

MD5
8173abf75a1e9a4f430163a44c12d76a

SHA1
a6730c903a9bf4b9397f1ae4c0d116eff41ef3df

SHA256
75cbe4d9f30ca7dc9cec67e8fdc5381f0fe2e597892ec66a0271548079c08e2c

SHA512
4dccf78246bb4be1829451d9bf5b7977a15c703988fad3c2fea9cf0f5444764da4a694ba9a4e6dc8e52e3e8cbad47bc82fb82f80c9fb1d7a6cd0d8d8cab036b2

Download Submit
\Windows\system\IqjPtGl.exe

Filesize
3.1MB

MD5
e0b12e0905e00715ab818d3f2c840e59

SHA1
c51c184207982ba2d0e9a118f869d10274559fbc

SHA256
9e8deab99221601344caf666773c80cef78e93ee0da27f5b95c6e49fb65f163c

SHA512
4d74741534a708093d79142e29791eff9ef870227082fd4c23bba685483255a36ac39c3c85fe82c809ad1aefc034cbafa6d600c0adc510626c1751d0886c9aac

Download Submit
\Windows\system\XzNZCsF.exe

Filesize
3.1MB

MD5
f259194eac2edf022f32c0d1eafe7fb1

SHA1
e658cd75b856336a7f0ff3f218f105779f868318

SHA256
98d38340e655a85c1cf82d2b95dc64b6ba0a5cdecff6e100867333dcf6a5bd92

SHA512
efa4188843bc069c7655e2f55df585d12efb82864ef058046a87314952ecaeb746c2db6932b0a1176aebe8b765437add5ba0f1cfa4333529746a43b505f3bd0c

Download Submit
memory/884-88-0x000000013F2B0000-0x000000013F6A6000-memory.dmp

Filesize
4.0MB

Download
memory/884-1849-0x000000013F2B0000-0x000000013F6A6000-memory.dmp

Filesize
4.0MB

Download
memory/1508-1813-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/1508-87-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/2200-49-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-90-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-25-0x0000000002A00000-0x0000000002A80000-memory.dmp

Filesize
512KB

Download
memory/2200-33-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/2200-26-0x000007FEF566E000-0x000007FEF566F000-memory.dmp

Filesize
4KB

Download
memory/2200-32-0x000000001B340000-0x000000001B622000-memory.dmp

Filesize
2.9MB

Download
memory/2200-121-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-58-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2248-98-0x00000000034E0000-0x00000000038D6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-99-0x00000000034E0000-0x00000000038D6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-89-0x000000013F740000-0x000000013FB36000-memory.dmp

Filesize
4.0MB

Download
memory/2248-64-0x00000000034E0000-0x00000000038D6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-2984-0x00000000034E0000-0x00000000038D6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-73-0x00000000034E0000-0x00000000038D6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-1470-0x00000000034E0000-0x00000000038D6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-2689-0x00000000034E0000-0x00000000038D6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-91-0x00000000034E0000-0x00000000038D6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-820-0x000000013FC30000-0x0000000140026000-memory.dmp

Filesize
4.0MB

Download
memory/2248-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2248-821-0x0000000002C50000-0x0000000003046000-memory.dmp

Filesize
4.0MB

Download
memory/2248-1-0x000000013FC30000-0x0000000140026000-memory.dmp

Filesize
4.0MB

Download
memory/2248-71-0x00000000034E0000-0x00000000038D6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-11-0x000000013F410000-0x000000013F806000-memory.dmp

Filesize
4.0MB

Download
memory/2248-75-0x000000013F740000-0x000000013FB36000-memory.dmp

Filesize
4.0MB

Download
memory/2248-84-0x000000013F2B0000-0x000000013F6A6000-memory.dmp

Filesize
4.0MB

Download
memory/2256-19-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/2256-1553-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/2340-18-0x000000013F410000-0x000000013F806000-memory.dmp

Filesize
4.0MB

Download
memory/2340-1552-0x000000013F410000-0x000000013F806000-memory.dmp

Filesize
4.0MB

Download
memory/2400-100-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/2400-1829-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/2504-63-0x000000013F740000-0x000000013FB36000-memory.dmp

Filesize
4.0MB

Download
memory/2504-1566-0x000000013F740000-0x000000013FB36000-memory.dmp

Filesize
4.0MB

Download
memory/2512-1783-0x000000013F8B0000-0x000000013FCA6000-memory.dmp

Filesize
4.0MB

Download
memory/2512-74-0x000000013F8B0000-0x000000013FCA6000-memory.dmp

Filesize
4.0MB

Download
memory/2524-1782-0x000000013FB60000-0x000000013FF56000-memory.dmp

Filesize
4.0MB

Download
memory/2524-70-0x000000013FB60000-0x000000013FF56000-memory.dmp

Filesize
4.0MB

Download
memory/2552-1812-0x000000013F740000-0x000000013FB36000-memory.dmp

Filesize
4.0MB

Download
memory/2552-83-0x000000013F740000-0x000000013FB36000-memory.dmp

Filesize
4.0MB

Download
memory/2608-1779-0x000000013FF60000-0x0000000140356000-memory.dmp

Filesize
4.0MB

Download
memory/2608-72-0x000000013FF60000-0x0000000140356000-memory.dmp

Filesize
4.0MB

Download
memory/2736-1559-0x000000013FE60000-0x0000000140256000-memory.dmp

Filesize
4.0MB

Download
memory/2736-31-0x000000013FE60000-0x0000000140256000-memory.dmp

Filesize
4.0MB

Download
memory/2976-97-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2976-1817-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download