xmrig | 29fa3d619899c30d01b83d5c24955ada28e6420645672b1fcf31c94f886d706d

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
Size

2.8MB
MD5

a7e86fb65bb3a5a014350918cfcca8a0
SHA1

e0b97a4883bf4535b26a1251042355efd8b4af07
SHA256

29fa3d619899c30d01b83d5c24955ada28e6420645672b1fcf31c94f886d706d
SHA512

a7acc5fe8df8431f3a167f0c77f2030131aaa57796f8ed3e15e5b4e96cd9b40937b324bce9a3f866cb054729df38a319679f1f9c1b86ab4ff88713930c236590
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cU:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral1/memory/2232-1-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	xmrig
behavioral1/files/0x000c0000000155f7-3.dat	xmrig
behavioral1/files/0x0008000000015c6b-10.dat	xmrig
behavioral1/files/0x0008000000015c9f-11.dat	xmrig
behavioral1/files/0x0007000000015cce-22.dat	xmrig
behavioral1/files/0x000a000000015cee-25.dat	xmrig
behavioral1/files/0x000a000000015cf6-30.dat	xmrig
behavioral1/files/0x0006000000015f01-61.dat	xmrig
behavioral1/files/0x00060000000160af-69.dat	xmrig
behavioral1/files/0x0006000000016287-77.dat	xmrig
behavioral1/files/0x0006000000016a29-97.dat	xmrig
behavioral1/files/0x0006000000016c7c-117.dat	xmrig
behavioral1/memory/1756-1004-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2232-985-0x000000013FD50000-0x0000000140146000-memory.dmp	xmrig
behavioral1/memory/2764-931-0x000000013FA10000-0x000000013FE06000-memory.dmp	xmrig
behavioral1/memory/2468-986-0x000000013FD50000-0x0000000140146000-memory.dmp	xmrig
behavioral1/memory/2748-882-0x000000013FF40000-0x0000000140336000-memory.dmp	xmrig
behavioral1/memory/2232-879-0x000000013FF40000-0x0000000140336000-memory.dmp	xmrig
behavioral1/memory/2756-878-0x000000013F730000-0x000000013FB26000-memory.dmp	xmrig
behavioral1/memory/2892-877-0x000000013FE50000-0x0000000140246000-memory.dmp	xmrig
behavioral1/memory/2896-875-0x000000013FF10000-0x0000000140306000-memory.dmp	xmrig
behavioral1/memory/2736-873-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig
behavioral1/memory/2688-871-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/2616-869-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/memory/2380-867-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	xmrig
behavioral1/files/0x0008000000015c78-129.dat	xmrig
behavioral1/files/0x0006000000016cb6-126.dat	xmrig
behavioral1/files/0x0006000000016ca5-121.dat	xmrig
behavioral1/files/0x0006000000016c51-113.dat	xmrig
behavioral1/files/0x0006000000016c04-109.dat	xmrig
behavioral1/files/0x0006000000016bfb-105.dat	xmrig
behavioral1/files/0x0006000000016be2-101.dat	xmrig
behavioral1/files/0x00060000000167d5-93.dat	xmrig
behavioral1/files/0x00060000000165ae-89.dat	xmrig
behavioral1/files/0x000600000001650c-85.dat	xmrig
behavioral1/files/0x0006000000016448-81.dat	xmrig
behavioral1/files/0x0006000000016176-73.dat	xmrig
behavioral1/files/0x0006000000015f7a-65.dat	xmrig
behavioral1/files/0x0006000000015df1-57.dat	xmrig
behavioral1/files/0x0006000000015d98-53.dat	xmrig
behavioral1/files/0x0006000000015d31-49.dat	xmrig
behavioral1/files/0x0007000000015d27-45.dat	xmrig
behavioral1/files/0x0007000000015d1a-42.dat	xmrig
behavioral1/files/0x0007000000015d0f-38.dat	xmrig
behavioral1/files/0x0009000000015d07-34.dat	xmrig
behavioral1/files/0x0007000000015cb6-18.dat	xmrig
behavioral1/memory/2688-8870-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/2468-8875-0x000000013FD50000-0x0000000140146000-memory.dmp	xmrig
behavioral1/memory/2608-8909-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/2896-8915-0x000000013FF10000-0x0000000140306000-memory.dmp	xmrig
behavioral1/memory/2756-8916-0x000000013F730000-0x000000013FB26000-memory.dmp	xmrig
behavioral1/memory/2380-8914-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	xmrig
behavioral1/memory/2736-8924-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig
behavioral1/memory/2748-8925-0x000000013FF40000-0x0000000140336000-memory.dmp	xmrig
behavioral1/memory/2892-8926-0x000000013FE50000-0x0000000140246000-memory.dmp	xmrig
behavioral1/memory/2616-8927-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/memory/2764-8928-0x000000013FA10000-0x000000013FE06000-memory.dmp	xmrig
behavioral1/memory/2232-8937-0x000000013FF40000-0x0000000140336000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2396	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1756	VkYlrlx.exe
2380	OpfyTBQ.exe
2616	XRsoudj.exe
2688	diqlirr.exe
2736	siFickr.exe
2896	gpslDAs.exe
2892	YlLuItX.exe
2756	nouhKjd.exe
2748	BZUxDer.exe
2608	rvvKKRp.exe
2764	wCHkwMn.exe
2468	FONxqdZ.exe
2536	wafOuYJ.exe
2872	QVLSVop.exe
3056	sCpTRUi.exe
2088	xQeWNmF.exe
1924	zyPaRJY.exe
1424	FFwdhnX.exe
2832	voyBSOY.exe
856	RoUWmzX.exe
1980	koykOiI.exe
1700	qLqRnWb.exe
2532	wJwVsWT.exe
1668	fYQBvXA.exe
1564	ziePhye.exe
2988	uPoCxig.exe
2860	LmpfeZD.exe
2828	jUBNiti.exe
2012	rFzKFHo.exe
2456	rVnIdCP.exe
2024	KwFQrHl.exe
2916	UnqUUSo.exe
684	jqFXYXo.exe
1164	ZoCcnOL.exe
1020	iCgWMzs.exe
580	XvvsyYi.exe
1448	Abgiqtj.exe
1168	YmSDGPu.exe
2908	Tqyrumu.exe
2964	anbvHds.exe
1892	ORQBeml.exe
860	QQFadMU.exe
2400	mYeRjLx.exe
1044	EIlMWDI.exe
840	rehRZce.exe
2440	ncOmIjZ.exe
2140	VQxczQP.exe
2160	BwsAiAv.exe
3060	cookQGq.exe
2436	rqjGXOy.exe
1556	ykfQmYC.exe
1888	PeOrXoA.exe
1828	gSaNMJO.exe
1208	KgBHJem.exe
1836	XbiTcFN.exe
1112	YkGviIc.exe
1088	BcXiJug.exe
1080	rwzIimp.exe
296	ivVlMpC.exe
2296	tZODGzi.exe
2120	yOhwreS.exe
1344	RkZVaOd.exe
2424	wKBBNlm.exe
2144	wwtpjYv.exe

Loads dropped DLL 64 IoCs

pid	Process
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-1-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	upx
behavioral1/files/0x000c0000000155f7-3.dat	upx
behavioral1/files/0x0008000000015c6b-10.dat	upx
behavioral1/files/0x0008000000015c9f-11.dat	upx
behavioral1/files/0x0007000000015cce-22.dat	upx
behavioral1/files/0x000a000000015cee-25.dat	upx
behavioral1/files/0x000a000000015cf6-30.dat	upx
behavioral1/files/0x0006000000015f01-61.dat	upx
behavioral1/files/0x00060000000160af-69.dat	upx
behavioral1/files/0x0006000000016287-77.dat	upx
behavioral1/files/0x0006000000016a29-97.dat	upx
behavioral1/files/0x0006000000016c7c-117.dat	upx
behavioral1/memory/1756-1004-0x000000013FDE0000-0x00000001401D6000-memory.dmp	upx
behavioral1/memory/2764-931-0x000000013FA10000-0x000000013FE06000-memory.dmp	upx
behavioral1/memory/2468-986-0x000000013FD50000-0x0000000140146000-memory.dmp	upx
behavioral1/memory/2748-882-0x000000013FF40000-0x0000000140336000-memory.dmp	upx
behavioral1/memory/2756-878-0x000000013F730000-0x000000013FB26000-memory.dmp	upx
behavioral1/memory/2892-877-0x000000013FE50000-0x0000000140246000-memory.dmp	upx
behavioral1/memory/2896-875-0x000000013FF10000-0x0000000140306000-memory.dmp	upx
behavioral1/memory/2736-873-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	upx
behavioral1/memory/2688-871-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/2616-869-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/memory/2380-867-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	upx
behavioral1/files/0x0008000000015c78-129.dat	upx
behavioral1/files/0x0006000000016cb6-126.dat	upx
behavioral1/files/0x0006000000016ca5-121.dat	upx
behavioral1/files/0x0006000000016c51-113.dat	upx
behavioral1/files/0x0006000000016c04-109.dat	upx
behavioral1/files/0x0006000000016bfb-105.dat	upx
behavioral1/files/0x0006000000016be2-101.dat	upx
behavioral1/files/0x00060000000167d5-93.dat	upx
behavioral1/files/0x00060000000165ae-89.dat	upx
behavioral1/files/0x000600000001650c-85.dat	upx
behavioral1/files/0x0006000000016448-81.dat	upx
behavioral1/files/0x0006000000016176-73.dat	upx
behavioral1/files/0x0006000000015f7a-65.dat	upx
behavioral1/files/0x0006000000015df1-57.dat	upx
behavioral1/files/0x0006000000015d98-53.dat	upx
behavioral1/files/0x0006000000015d31-49.dat	upx
behavioral1/files/0x0007000000015d27-45.dat	upx
behavioral1/files/0x0007000000015d1a-42.dat	upx
behavioral1/files/0x0007000000015d0f-38.dat	upx
behavioral1/files/0x0009000000015d07-34.dat	upx
behavioral1/files/0x0007000000015cb6-18.dat	upx
behavioral1/memory/2688-8870-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/2468-8875-0x000000013FD50000-0x0000000140146000-memory.dmp	upx
behavioral1/memory/2608-8909-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/2896-8915-0x000000013FF10000-0x0000000140306000-memory.dmp	upx
behavioral1/memory/2756-8916-0x000000013F730000-0x000000013FB26000-memory.dmp	upx
behavioral1/memory/2380-8914-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	upx
behavioral1/memory/2736-8924-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	upx
behavioral1/memory/2748-8925-0x000000013FF40000-0x0000000140336000-memory.dmp	upx
behavioral1/memory/2892-8926-0x000000013FE50000-0x0000000140246000-memory.dmp	upx
behavioral1/memory/2616-8927-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/memory/2764-8928-0x000000013FA10000-0x000000013FE06000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eNvqpWT.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\DskHBdg.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\XzbuWPz.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\IygIhIi.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\CnFpcIk.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\jXmMdjB.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\VGCuJqN.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\TlsMoUb.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\CnrUcGL.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\JTgjmDm.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\ijOxaXL.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\xTnQkja.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\WeTFWJd.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\Ubldnjk.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\ixHMTyS.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\bYGdbsb.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\fLQFSPi.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\AZkFhoh.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\FhEVTBd.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\BXYTruZ.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\CPboaJd.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\cdsKxfN.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\nQDdJmv.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\gJbnwml.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\AbyMYYy.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\HJeWFGU.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\zPBUqHS.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\PLvZEOD.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\ChewrPF.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\VSwhufp.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\eBeDSjS.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\UwZONeH.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\XreSktp.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\MZPIwdE.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\YSsNxzQ.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\zHRQpkj.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\udnKDAT.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\kygEFVu.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\LWIRYdB.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\uGRRwoO.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\TnamDIq.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\ANGfehS.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\EJpbwGz.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\SfTJOfy.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\fgYCCjV.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\UpoQBGO.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\wksjibI.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\evECFQQ.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\LVEYfFS.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZLwsrli.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\zKLEIVt.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\cEVuMVm.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\pQNEJZr.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\VffOOas.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\xmoGDcv.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\aaSiVXH.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\CJddIfY.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\iHBwBuS.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\wFdmIbI.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\rOJSjQD.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\VtQMbQG.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\wQuDDfy.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\NykwmIy.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
File created	C:\Windows\System\iGaNwKU.exe	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	powershell.exe
2396	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2396	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	29
PID 2232 wrote to memory of 2396	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	29
PID 2232 wrote to memory of 2396	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	29
PID 2232 wrote to memory of 1756	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	30
PID 2232 wrote to memory of 1756	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	30
PID 2232 wrote to memory of 1756	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	30
PID 2232 wrote to memory of 2380	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	31
PID 2232 wrote to memory of 2380	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	31
PID 2232 wrote to memory of 2380	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	31
PID 2232 wrote to memory of 2616	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	32
PID 2232 wrote to memory of 2616	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	32
PID 2232 wrote to memory of 2616	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	32
PID 2232 wrote to memory of 2688	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	33
PID 2232 wrote to memory of 2688	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	33
PID 2232 wrote to memory of 2688	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	33
PID 2232 wrote to memory of 2736	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	34
PID 2232 wrote to memory of 2736	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	34
PID 2232 wrote to memory of 2736	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	34
PID 2232 wrote to memory of 2896	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	35
PID 2232 wrote to memory of 2896	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	35
PID 2232 wrote to memory of 2896	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	35
PID 2232 wrote to memory of 2892	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	36
PID 2232 wrote to memory of 2892	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	36
PID 2232 wrote to memory of 2892	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	36
PID 2232 wrote to memory of 2756	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	37
PID 2232 wrote to memory of 2756	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	37
PID 2232 wrote to memory of 2756	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	37
PID 2232 wrote to memory of 2748	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	38
PID 2232 wrote to memory of 2748	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	38
PID 2232 wrote to memory of 2748	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	38
PID 2232 wrote to memory of 2608	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	39
PID 2232 wrote to memory of 2608	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	39
PID 2232 wrote to memory of 2608	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	39
PID 2232 wrote to memory of 2764	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	40
PID 2232 wrote to memory of 2764	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	40
PID 2232 wrote to memory of 2764	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	40
PID 2232 wrote to memory of 2468	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	41
PID 2232 wrote to memory of 2468	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	41
PID 2232 wrote to memory of 2468	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	41
PID 2232 wrote to memory of 2536	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	42
PID 2232 wrote to memory of 2536	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	42
PID 2232 wrote to memory of 2536	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	42
PID 2232 wrote to memory of 2872	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	43
PID 2232 wrote to memory of 2872	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	43
PID 2232 wrote to memory of 2872	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	43
PID 2232 wrote to memory of 3056	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	44
PID 2232 wrote to memory of 3056	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	44
PID 2232 wrote to memory of 3056	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	44
PID 2232 wrote to memory of 2088	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	45
PID 2232 wrote to memory of 2088	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	45
PID 2232 wrote to memory of 2088	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	45
PID 2232 wrote to memory of 1924	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	46
PID 2232 wrote to memory of 1924	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	46
PID 2232 wrote to memory of 1924	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	46
PID 2232 wrote to memory of 1424	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	47
PID 2232 wrote to memory of 1424	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	47
PID 2232 wrote to memory of 1424	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	47
PID 2232 wrote to memory of 2832	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	48
PID 2232 wrote to memory of 2832	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	48
PID 2232 wrote to memory of 2832	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	48
PID 2232 wrote to memory of 856	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	49
PID 2232 wrote to memory of 856	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	49
PID 2232 wrote to memory of 856	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	49
PID 2232 wrote to memory of 1980	2232	a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a7e86fb65bb3a5a014350918cfcca8a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\System\VkYlrlx.exe
  C:\Windows\System\VkYlrlx.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\OpfyTBQ.exe
  C:\Windows\System\OpfyTBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\XRsoudj.exe
  C:\Windows\System\XRsoudj.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\diqlirr.exe
  C:\Windows\System\diqlirr.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\siFickr.exe
  C:\Windows\System\siFickr.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\gpslDAs.exe
  C:\Windows\System\gpslDAs.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\YlLuItX.exe
  C:\Windows\System\YlLuItX.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\nouhKjd.exe
  C:\Windows\System\nouhKjd.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\BZUxDer.exe
  C:\Windows\System\BZUxDer.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\rvvKKRp.exe
  C:\Windows\System\rvvKKRp.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\wCHkwMn.exe
  C:\Windows\System\wCHkwMn.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\FONxqdZ.exe
  C:\Windows\System\FONxqdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\wafOuYJ.exe
  C:\Windows\System\wafOuYJ.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\QVLSVop.exe
  C:\Windows\System\QVLSVop.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\sCpTRUi.exe
  C:\Windows\System\sCpTRUi.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\xQeWNmF.exe
  C:\Windows\System\xQeWNmF.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\zyPaRJY.exe
  C:\Windows\System\zyPaRJY.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\FFwdhnX.exe
  C:\Windows\System\FFwdhnX.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\voyBSOY.exe
  C:\Windows\System\voyBSOY.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\RoUWmzX.exe
  C:\Windows\System\RoUWmzX.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\koykOiI.exe
  C:\Windows\System\koykOiI.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\qLqRnWb.exe
  C:\Windows\System\qLqRnWb.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\wJwVsWT.exe
  C:\Windows\System\wJwVsWT.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\fYQBvXA.exe
  C:\Windows\System\fYQBvXA.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\ziePhye.exe
  C:\Windows\System\ziePhye.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\uPoCxig.exe
  C:\Windows\System\uPoCxig.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\LmpfeZD.exe
  C:\Windows\System\LmpfeZD.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\jUBNiti.exe
  C:\Windows\System\jUBNiti.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\rFzKFHo.exe
  C:\Windows\System\rFzKFHo.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\rVnIdCP.exe
  C:\Windows\System\rVnIdCP.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\KwFQrHl.exe
  C:\Windows\System\KwFQrHl.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\UnqUUSo.exe
  C:\Windows\System\UnqUUSo.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\jqFXYXo.exe
  C:\Windows\System\jqFXYXo.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\ZoCcnOL.exe
  C:\Windows\System\ZoCcnOL.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\iCgWMzs.exe
  C:\Windows\System\iCgWMzs.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\Abgiqtj.exe
  C:\Windows\System\Abgiqtj.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\XvvsyYi.exe
  C:\Windows\System\XvvsyYi.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\Tqyrumu.exe
  C:\Windows\System\Tqyrumu.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\YmSDGPu.exe
  C:\Windows\System\YmSDGPu.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\anbvHds.exe
  C:\Windows\System\anbvHds.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\ORQBeml.exe
  C:\Windows\System\ORQBeml.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\QQFadMU.exe
  C:\Windows\System\QQFadMU.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\mYeRjLx.exe
  C:\Windows\System\mYeRjLx.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\EIlMWDI.exe
  C:\Windows\System\EIlMWDI.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\rehRZce.exe
  C:\Windows\System\rehRZce.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\ncOmIjZ.exe
  C:\Windows\System\ncOmIjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\VQxczQP.exe
  C:\Windows\System\VQxczQP.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\cookQGq.exe
  C:\Windows\System\cookQGq.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\BwsAiAv.exe
  C:\Windows\System\BwsAiAv.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\rqjGXOy.exe
  C:\Windows\System\rqjGXOy.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\ykfQmYC.exe
  C:\Windows\System\ykfQmYC.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\PeOrXoA.exe
  C:\Windows\System\PeOrXoA.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\gSaNMJO.exe
  C:\Windows\System\gSaNMJO.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\KgBHJem.exe
  C:\Windows\System\KgBHJem.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\XbiTcFN.exe
  C:\Windows\System\XbiTcFN.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\YkGviIc.exe
  C:\Windows\System\YkGviIc.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\BcXiJug.exe
  C:\Windows\System\BcXiJug.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\rwzIimp.exe
  C:\Windows\System\rwzIimp.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\ivVlMpC.exe
  C:\Windows\System\ivVlMpC.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\tZODGzi.exe
  C:\Windows\System\tZODGzi.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\yOhwreS.exe
  C:\Windows\System\yOhwreS.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\RkZVaOd.exe
  C:\Windows\System\RkZVaOd.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\wKBBNlm.exe
  C:\Windows\System\wKBBNlm.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\wwtpjYv.exe
  C:\Windows\System\wwtpjYv.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\sIqCuFf.exe
  C:\Windows\System\sIqCuFf.exe
  2⤵
  PID:3036
- C:\Windows\System\DrdHrVT.exe
  C:\Windows\System\DrdHrVT.exe
  2⤵
  PID:2900
- C:\Windows\System\outUHcT.exe
  C:\Windows\System\outUHcT.exe
  2⤵
  PID:1280
- C:\Windows\System\nAyjSTU.exe
  C:\Windows\System\nAyjSTU.exe
  2⤵
  PID:3020
- C:\Windows\System\FreRgiv.exe
  C:\Windows\System\FreRgiv.exe
  2⤵
  PID:892
- C:\Windows\System\hPiPJHy.exe
  C:\Windows\System\hPiPJHy.exe
  2⤵
  PID:1936
- C:\Windows\System\CnFFLGC.exe
  C:\Windows\System\CnFFLGC.exe
  2⤵
  PID:2956
- C:\Windows\System\KQREnQr.exe
  C:\Windows\System\KQREnQr.exe
  2⤵
  PID:2392
- C:\Windows\System\zYWDrSJ.exe
  C:\Windows\System\zYWDrSJ.exe
  2⤵
  PID:1132
- C:\Windows\System\SFSneOf.exe
  C:\Windows\System\SFSneOf.exe
  2⤵
  PID:1620
- C:\Windows\System\sXdIGbc.exe
  C:\Windows\System\sXdIGbc.exe
  2⤵
  PID:1048
- C:\Windows\System\jqRzlYU.exe
  C:\Windows\System\jqRzlYU.exe
  2⤵
  PID:2388
- C:\Windows\System\rxIzFGB.exe
  C:\Windows\System\rxIzFGB.exe
  2⤵
  PID:2720
- C:\Windows\System\alosYzj.exe
  C:\Windows\System\alosYzj.exe
  2⤵
  PID:2148
- C:\Windows\System\zFJAgzT.exe
  C:\Windows\System\zFJAgzT.exe
  2⤵
  PID:2080
- C:\Windows\System\sZBjMNT.exe
  C:\Windows\System\sZBjMNT.exe
  2⤵
  PID:2644
- C:\Windows\System\isjCxFN.exe
  C:\Windows\System\isjCxFN.exe
  2⤵
  PID:2492
- C:\Windows\System\ocNWfmM.exe
  C:\Windows\System\ocNWfmM.exe
  2⤵
  PID:2984
- C:\Windows\System\zNgAGiQ.exe
  C:\Windows\System\zNgAGiQ.exe
  2⤵
  PID:2364
- C:\Windows\System\ySvQJCR.exe
  C:\Windows\System\ySvQJCR.exe
  2⤵
  PID:2648
- C:\Windows\System\aIQGPSa.exe
  C:\Windows\System\aIQGPSa.exe
  2⤵
  PID:956
- C:\Windows\System\TDOpmOU.exe
  C:\Windows\System\TDOpmOU.exe
  2⤵
  PID:2704
- C:\Windows\System\brxWyNt.exe
  C:\Windows\System\brxWyNt.exe
  2⤵
  PID:1652
- C:\Windows\System\CAWoBvy.exe
  C:\Windows\System\CAWoBvy.exe
  2⤵
  PID:2784
- C:\Windows\System\KjDJPQb.exe
  C:\Windows\System\KjDJPQb.exe
  2⤵
  PID:2796
- C:\Windows\System\jrOkrfG.exe
  C:\Windows\System\jrOkrfG.exe
  2⤵
  PID:2072
- C:\Windows\System\VxIFDcU.exe
  C:\Windows\System\VxIFDcU.exe
  2⤵
  PID:2116
- C:\Windows\System\jfsnniM.exe
  C:\Windows\System\jfsnniM.exe
  2⤵
  PID:600
- C:\Windows\System\rMqsWoo.exe
  C:\Windows\System\rMqsWoo.exe
  2⤵
  PID:1436
- C:\Windows\System\jQbWCOM.exe
  C:\Windows\System\jQbWCOM.exe
  2⤵
  PID:844
- C:\Windows\System\WOjnbjV.exe
  C:\Windows\System\WOjnbjV.exe
  2⤵
  PID:1508
- C:\Windows\System\ULRUVUw.exe
  C:\Windows\System\ULRUVUw.exe
  2⤵
  PID:1992
- C:\Windows\System\FMxvHCl.exe
  C:\Windows\System\FMxvHCl.exe
  2⤵
  PID:2096
- C:\Windows\System\XerNguh.exe
  C:\Windows\System\XerNguh.exe
  2⤵
  PID:448
- C:\Windows\System\LqQOaWv.exe
  C:\Windows\System\LqQOaWv.exe
  2⤵
  PID:1140
- C:\Windows\System\JTZWyoH.exe
  C:\Windows\System\JTZWyoH.exe
  2⤵
  PID:2184
- C:\Windows\System\StBgZxU.exe
  C:\Windows\System\StBgZxU.exe
  2⤵
  PID:1964
- C:\Windows\System\SuCkpVU.exe
  C:\Windows\System\SuCkpVU.exe
  2⤵
  PID:1824
- C:\Windows\System\nhkuUVG.exe
  C:\Windows\System\nhkuUVG.exe
  2⤵
  PID:112
- C:\Windows\System\ZCVChyO.exe
  C:\Windows\System\ZCVChyO.exe
  2⤵
  PID:1764
- C:\Windows\System\xkKkxrw.exe
  C:\Windows\System\xkKkxrw.exe
  2⤵
  PID:912
- C:\Windows\System\lbYRgnp.exe
  C:\Windows\System\lbYRgnp.exe
  2⤵
  PID:328
- C:\Windows\System\EqRuosw.exe
  C:\Windows\System\EqRuosw.exe
  2⤵
  PID:3008
- C:\Windows\System\wIZHnwA.exe
  C:\Windows\System\wIZHnwA.exe
  2⤵
  PID:1472
- C:\Windows\System\foxJmGq.exe
  C:\Windows\System\foxJmGq.exe
  2⤵
  PID:1772
- C:\Windows\System\fsjEZfw.exe
  C:\Windows\System\fsjEZfw.exe
  2⤵
  PID:2948
- C:\Windows\System\DGTILXD.exe
  C:\Windows\System\DGTILXD.exe
  2⤵
  PID:1996
- C:\Windows\System\imrOfUm.exe
  C:\Windows\System\imrOfUm.exe
  2⤵
  PID:2260
- C:\Windows\System\coeSWkG.exe
  C:\Windows\System\coeSWkG.exe
  2⤵
  PID:1720
- C:\Windows\System\yYCTyFL.exe
  C:\Windows\System\yYCTyFL.exe
  2⤵
  PID:2904
- C:\Windows\System\SrwrwDu.exe
  C:\Windows\System\SrwrwDu.exe
  2⤵
  PID:2672
- C:\Windows\System\qCPEOdt.exe
  C:\Windows\System\qCPEOdt.exe
  2⤵
  PID:2744
- C:\Windows\System\knoxnLl.exe
  C:\Windows\System\knoxnLl.exe
  2⤵
  PID:2980
- C:\Windows\System\iWGuBhC.exe
  C:\Windows\System\iWGuBhC.exe
  2⤵
  PID:1900
- C:\Windows\System\YJGFNlo.exe
  C:\Windows\System\YJGFNlo.exe
  2⤵
  PID:1884
- C:\Windows\System\ETGCaYl.exe
  C:\Windows\System\ETGCaYl.exe
  2⤵
  PID:2044
- C:\Windows\System\WOEgtgP.exe
  C:\Windows\System\WOEgtgP.exe
  2⤵
  PID:480
- C:\Windows\System\jdZkrpt.exe
  C:\Windows\System\jdZkrpt.exe
  2⤵
  PID:1920
- C:\Windows\System\urgRrvF.exe
  C:\Windows\System\urgRrvF.exe
  2⤵
  PID:1008
- C:\Windows\System\yothJFp.exe
  C:\Windows\System\yothJFp.exe
  2⤵
  PID:3084
- C:\Windows\System\KgbOxXp.exe
  C:\Windows\System\KgbOxXp.exe
  2⤵
  PID:3100
- C:\Windows\System\LksXJwr.exe
  C:\Windows\System\LksXJwr.exe
  2⤵
  PID:3116
- C:\Windows\System\vaVjicF.exe
  C:\Windows\System\vaVjicF.exe
  2⤵
  PID:3132
- C:\Windows\System\OOOrCER.exe
  C:\Windows\System\OOOrCER.exe
  2⤵
  PID:3148
- C:\Windows\System\upkFBDn.exe
  C:\Windows\System\upkFBDn.exe
  2⤵
  PID:3164
- C:\Windows\System\SkJGyoE.exe
  C:\Windows\System\SkJGyoE.exe
  2⤵
  PID:3180
- C:\Windows\System\iGsMuie.exe
  C:\Windows\System\iGsMuie.exe
  2⤵
  PID:3196
- C:\Windows\System\vrsSidv.exe
  C:\Windows\System\vrsSidv.exe
  2⤵
  PID:3212
- C:\Windows\System\nlMWykW.exe
  C:\Windows\System\nlMWykW.exe
  2⤵
  PID:3228
- C:\Windows\System\cerqphv.exe
  C:\Windows\System\cerqphv.exe
  2⤵
  PID:3244
- C:\Windows\System\OWfMUSr.exe
  C:\Windows\System\OWfMUSr.exe
  2⤵
  PID:3260
- C:\Windows\System\ZKBKeZB.exe
  C:\Windows\System\ZKBKeZB.exe
  2⤵
  PID:3276
- C:\Windows\System\sLAWrMp.exe
  C:\Windows\System\sLAWrMp.exe
  2⤵
  PID:3292
- C:\Windows\System\WGuHEfx.exe
  C:\Windows\System\WGuHEfx.exe
  2⤵
  PID:3308
- C:\Windows\System\ErSECfJ.exe
  C:\Windows\System\ErSECfJ.exe
  2⤵
  PID:3324
- C:\Windows\System\InduISh.exe
  C:\Windows\System\InduISh.exe
  2⤵
  PID:3340
- C:\Windows\System\vjTLvVJ.exe
  C:\Windows\System\vjTLvVJ.exe
  2⤵
  PID:3356
- C:\Windows\System\TmoHLrj.exe
  C:\Windows\System\TmoHLrj.exe
  2⤵
  PID:3372
- C:\Windows\System\ZJwOQQm.exe
  C:\Windows\System\ZJwOQQm.exe
  2⤵
  PID:3392
- C:\Windows\System\YgcjjJY.exe
  C:\Windows\System\YgcjjJY.exe
  2⤵
  PID:3408
- C:\Windows\System\kOjySwr.exe
  C:\Windows\System\kOjySwr.exe
  2⤵
  PID:3424
- C:\Windows\System\DRHKXUh.exe
  C:\Windows\System\DRHKXUh.exe
  2⤵
  PID:3440
- C:\Windows\System\jrLHJxE.exe
  C:\Windows\System\jrLHJxE.exe
  2⤵
  PID:3456
- C:\Windows\System\hYWTRzo.exe
  C:\Windows\System\hYWTRzo.exe
  2⤵
  PID:3472
- C:\Windows\System\sqwgdXb.exe
  C:\Windows\System\sqwgdXb.exe
  2⤵
  PID:3488
- C:\Windows\System\bUNHbdj.exe
  C:\Windows\System\bUNHbdj.exe
  2⤵
  PID:3504
- C:\Windows\System\WNWRhFO.exe
  C:\Windows\System\WNWRhFO.exe
  2⤵
  PID:3520
- C:\Windows\System\DWpjTTu.exe
  C:\Windows\System\DWpjTTu.exe
  2⤵
  PID:3536
- C:\Windows\System\MNYziUm.exe
  C:\Windows\System\MNYziUm.exe
  2⤵
  PID:3552
- C:\Windows\System\dhxusIA.exe
  C:\Windows\System\dhxusIA.exe
  2⤵
  PID:3568
- C:\Windows\System\oJbuCgB.exe
  C:\Windows\System\oJbuCgB.exe
  2⤵
  PID:3584
- C:\Windows\System\WbbyxlA.exe
  C:\Windows\System\WbbyxlA.exe
  2⤵
  PID:3600
- C:\Windows\System\guTdiay.exe
  C:\Windows\System\guTdiay.exe
  2⤵
  PID:3616
- C:\Windows\System\hkWUUoj.exe
  C:\Windows\System\hkWUUoj.exe
  2⤵
  PID:3632
- C:\Windows\System\kboQAdq.exe
  C:\Windows\System\kboQAdq.exe
  2⤵
  PID:3648
- C:\Windows\System\wSbAYmv.exe
  C:\Windows\System\wSbAYmv.exe
  2⤵
  PID:3664
- C:\Windows\System\aCdcHnH.exe
  C:\Windows\System\aCdcHnH.exe
  2⤵
  PID:3680
- C:\Windows\System\FVJEUlG.exe
  C:\Windows\System\FVJEUlG.exe
  2⤵
  PID:3696
- C:\Windows\System\lNeubkS.exe
  C:\Windows\System\lNeubkS.exe
  2⤵
  PID:3712
- C:\Windows\System\xXNMDRx.exe
  C:\Windows\System\xXNMDRx.exe
  2⤵
  PID:3728
- C:\Windows\System\TxwTmhR.exe
  C:\Windows\System\TxwTmhR.exe
  2⤵
  PID:3744
- C:\Windows\System\pvpughv.exe
  C:\Windows\System\pvpughv.exe
  2⤵
  PID:3760
- C:\Windows\System\ZwOKLlM.exe
  C:\Windows\System\ZwOKLlM.exe
  2⤵
  PID:3776
- C:\Windows\System\EXgUGwk.exe
  C:\Windows\System\EXgUGwk.exe
  2⤵
  PID:3792
- C:\Windows\System\zvPTwGp.exe
  C:\Windows\System\zvPTwGp.exe
  2⤵
  PID:3808
- C:\Windows\System\HhlmliJ.exe
  C:\Windows\System\HhlmliJ.exe
  2⤵
  PID:3824
- C:\Windows\System\DWDzQmj.exe
  C:\Windows\System\DWDzQmj.exe
  2⤵
  PID:3840
- C:\Windows\System\SdZTEuZ.exe
  C:\Windows\System\SdZTEuZ.exe
  2⤵
  PID:3856
- C:\Windows\System\rtqduRS.exe
  C:\Windows\System\rtqduRS.exe
  2⤵
  PID:3872
- C:\Windows\System\ldzEPgI.exe
  C:\Windows\System\ldzEPgI.exe
  2⤵
  PID:3888
- C:\Windows\System\sbAkrTU.exe
  C:\Windows\System\sbAkrTU.exe
  2⤵
  PID:3904
- C:\Windows\System\YCQoxWt.exe
  C:\Windows\System\YCQoxWt.exe
  2⤵
  PID:3920
- C:\Windows\System\KEPuHGL.exe
  C:\Windows\System\KEPuHGL.exe
  2⤵
  PID:3936
- C:\Windows\System\ucrLPMz.exe
  C:\Windows\System\ucrLPMz.exe
  2⤵
  PID:3952
- C:\Windows\System\PVuJIfS.exe
  C:\Windows\System\PVuJIfS.exe
  2⤵
  PID:3968
- C:\Windows\System\NuAauxn.exe
  C:\Windows\System\NuAauxn.exe
  2⤵
  PID:3984
- C:\Windows\System\USdDpGE.exe
  C:\Windows\System\USdDpGE.exe
  2⤵
  PID:4000
- C:\Windows\System\VJzvmar.exe
  C:\Windows\System\VJzvmar.exe
  2⤵
  PID:4016
- C:\Windows\System\svnAuqe.exe
  C:\Windows\System\svnAuqe.exe
  2⤵
  PID:4032
- C:\Windows\System\NBwYAsO.exe
  C:\Windows\System\NBwYAsO.exe
  2⤵
  PID:4048
- C:\Windows\System\RokDexz.exe
  C:\Windows\System\RokDexz.exe
  2⤵
  PID:4064
- C:\Windows\System\HwtvDUh.exe
  C:\Windows\System\HwtvDUh.exe
  2⤵
  PID:4080
- C:\Windows\System\TtFkqcM.exe
  C:\Windows\System\TtFkqcM.exe
  2⤵
  PID:884
- C:\Windows\System\mwEQllq.exe
  C:\Windows\System\mwEQllq.exe
  2⤵
  PID:1428
- C:\Windows\System\glrOSQE.exe
  C:\Windows\System\glrOSQE.exe
  2⤵
  PID:1520
- C:\Windows\System\rUXGdbH.exe
  C:\Windows\System\rUXGdbH.exe
  2⤵
  PID:1528
- C:\Windows\System\kigOfZZ.exe
  C:\Windows\System\kigOfZZ.exe
  2⤵
  PID:2292
- C:\Windows\System\VRMQRsO.exe
  C:\Windows\System\VRMQRsO.exe
  2⤵
  PID:1732
- C:\Windows\System\uRGwdbt.exe
  C:\Windows\System\uRGwdbt.exe
  2⤵
  PID:1332
- C:\Windows\System\tyXlvIi.exe
  C:\Windows\System\tyXlvIi.exe
  2⤵
  PID:2940
- C:\Windows\System\sQdzABM.exe
  C:\Windows\System\sQdzABM.exe
  2⤵
  PID:2932
- C:\Windows\System\CFTCbpM.exe
  C:\Windows\System\CFTCbpM.exe
  2⤵
  PID:2372
- C:\Windows\System\pSMzKnd.exe
  C:\Windows\System\pSMzKnd.exe
  2⤵
  PID:1588
- C:\Windows\System\tBQDoth.exe
  C:\Windows\System\tBQDoth.exe
  2⤵
  PID:3080
- C:\Windows\System\OJIopPq.exe
  C:\Windows\System\OJIopPq.exe
  2⤵
  PID:3144
- C:\Windows\System\FBrfcyT.exe
  C:\Windows\System\FBrfcyT.exe
  2⤵
  PID:3208
- C:\Windows\System\jmNrdpL.exe
  C:\Windows\System\jmNrdpL.exe
  2⤵
  PID:3272
- C:\Windows\System\msLydhn.exe
  C:\Windows\System\msLydhn.exe
  2⤵
  PID:3336
- C:\Windows\System\pAEmZmV.exe
  C:\Windows\System\pAEmZmV.exe
  2⤵
  PID:3404
- C:\Windows\System\krpDcyv.exe
  C:\Windows\System\krpDcyv.exe
  2⤵
  PID:3468
- C:\Windows\System\PKbXQrF.exe
  C:\Windows\System\PKbXQrF.exe
  2⤵
  PID:3532
- C:\Windows\System\nSfkTaz.exe
  C:\Windows\System\nSfkTaz.exe
  2⤵
  PID:2592
- C:\Windows\System\FZbuQvC.exe
  C:\Windows\System\FZbuQvC.exe
  2⤵
  PID:1220
- C:\Windows\System\BhqNcqV.exe
  C:\Windows\System\BhqNcqV.exe
  2⤵
  PID:1256
- C:\Windows\System\RlTELFT.exe
  C:\Windows\System\RlTELFT.exe
  2⤵
  PID:3592
- C:\Windows\System\nsneKfZ.exe
  C:\Windows\System\nsneKfZ.exe
  2⤵
  PID:3656
- C:\Windows\System\pEgEzpH.exe
  C:\Windows\System\pEgEzpH.exe
  2⤵
  PID:3720
- C:\Windows\System\evgclZt.exe
  C:\Windows\System\evgclZt.exe
  2⤵
  PID:3096
- C:\Windows\System\WvNQjTc.exe
  C:\Windows\System\WvNQjTc.exe
  2⤵
  PID:3724
- C:\Windows\System\tVAuAlr.exe
  C:\Windows\System\tVAuAlr.exe
  2⤵
  PID:3756
- C:\Windows\System\STCREII.exe
  C:\Windows\System\STCREII.exe
  2⤵
  PID:3288
- C:\Windows\System\YTNJKHf.exe
  C:\Windows\System\YTNJKHf.exe
  2⤵
  PID:3352
- C:\Windows\System\lfEfGZH.exe
  C:\Windows\System\lfEfGZH.exe
  2⤵
  PID:3820
- C:\Windows\System\ISeLXNa.exe
  C:\Windows\System\ISeLXNa.exe
  2⤵
  PID:3880
- C:\Windows\System\TNByTnB.exe
  C:\Windows\System\TNByTnB.exe
  2⤵
  PID:3416
- C:\Windows\System\vzKBTWa.exe
  C:\Windows\System\vzKBTWa.exe
  2⤵
  PID:3740
- C:\Windows\System\muWptnd.exe
  C:\Windows\System\muWptnd.exe
  2⤵
  PID:3676
- C:\Windows\System\jnYwKcP.exe
  C:\Windows\System\jnYwKcP.exe
  2⤵
  PID:3612
- C:\Windows\System\thBxScN.exe
  C:\Windows\System\thBxScN.exe
  2⤵
  PID:3544
- C:\Windows\System\hjeaqUu.exe
  C:\Windows\System\hjeaqUu.exe
  2⤵
  PID:3480
- C:\Windows\System\JRsWfTf.exe
  C:\Windows\System\JRsWfTf.exe
  2⤵
  PID:3832
- C:\Windows\System\ELauzuI.exe
  C:\Windows\System\ELauzuI.exe
  2⤵
  PID:3896
- C:\Windows\System\LOVIuHF.exe
  C:\Windows\System\LOVIuHF.exe
  2⤵
  PID:3948
- C:\Windows\System\bUVCIBo.exe
  C:\Windows\System\bUVCIBo.exe
  2⤵
  PID:4012
- C:\Windows\System\cHxZmOK.exe
  C:\Windows\System\cHxZmOK.exe
  2⤵
  PID:3928
- C:\Windows\System\hsYRlkc.exe
  C:\Windows\System\hsYRlkc.exe
  2⤵
  PID:984
- C:\Windows\System\FnPjaXv.exe
  C:\Windows\System\FnPjaXv.exe
  2⤵
  PID:1452
- C:\Windows\System\YSNYBBh.exe
  C:\Windows\System\YSNYBBh.exe
  2⤵
  PID:4028
- C:\Windows\System\viBYDoX.exe
  C:\Windows\System\viBYDoX.exe
  2⤵
  PID:3992
- C:\Windows\System\SUAqtms.exe
  C:\Windows\System\SUAqtms.exe
  2⤵
  PID:4088
- C:\Windows\System\eFpTqfh.exe
  C:\Windows\System\eFpTqfh.exe
  2⤵
  PID:2344
- C:\Windows\System\bawwXLg.exe
  C:\Windows\System\bawwXLg.exe
  2⤵
  PID:2628
- C:\Windows\System\wfpkkvN.exe
  C:\Windows\System\wfpkkvN.exe
  2⤵
  PID:764
- C:\Windows\System\KOKltcy.exe
  C:\Windows\System\KOKltcy.exe
  2⤵
  PID:3304
- C:\Windows\System\zNlCQdc.exe
  C:\Windows\System\zNlCQdc.exe
  2⤵
  PID:1156
- C:\Windows\System\bpqctIA.exe
  C:\Windows\System\bpqctIA.exe
  2⤵
  PID:3140
- C:\Windows\System\eIlaxOS.exe
  C:\Windows\System\eIlaxOS.exe
  2⤵
  PID:1636
- C:\Windows\System\DeOiTvX.exe
  C:\Windows\System\DeOiTvX.exe
  2⤵
  PID:3628
- C:\Windows\System\dUtKHfx.exe
  C:\Windows\System\dUtKHfx.exe
  2⤵
  PID:3320
- C:\Windows\System\mDstGbD.exe
  C:\Windows\System\mDstGbD.exe
  2⤵
  PID:2000
- C:\Windows\System\RwnlKUL.exe
  C:\Windows\System\RwnlKUL.exe
  2⤵
  PID:3240
- C:\Windows\System\LIskoJD.exe
  C:\Windows\System\LIskoJD.exe
  2⤵
  PID:3688
- C:\Windows\System\OZzAHqw.exe
  C:\Windows\System\OZzAHqw.exe
  2⤵
  PID:3772
- C:\Windows\System\TQnOVxO.exe
  C:\Windows\System\TQnOVxO.exe
  2⤵
  PID:3692
- C:\Windows\System\AiQnwgk.exe
  C:\Windows\System\AiQnwgk.exe
  2⤵
  PID:3640
- C:\Windows\System\otLBafc.exe
  C:\Windows\System\otLBafc.exe
  2⤵
  PID:3868
- C:\Windows\System\UBrNzpC.exe
  C:\Windows\System\UBrNzpC.exe
  2⤵
  PID:3816
- C:\Windows\System\ZPOtxUk.exe
  C:\Windows\System\ZPOtxUk.exe
  2⤵
  PID:3548
- C:\Windows\System\OQFmmaS.exe
  C:\Windows\System\OQFmmaS.exe
  2⤵
  PID:3944
- C:\Windows\System\RjZieIc.exe
  C:\Windows\System\RjZieIc.exe
  2⤵
  PID:1776
- C:\Windows\System\ZSPedAG.exe
  C:\Windows\System\ZSPedAG.exe
  2⤵
  PID:4100
- C:\Windows\System\krYoGkH.exe
  C:\Windows\System\krYoGkH.exe
  2⤵
  PID:4116
- C:\Windows\System\NBnhyyQ.exe
  C:\Windows\System\NBnhyyQ.exe
  2⤵
  PID:4132
- C:\Windows\System\gviLTtz.exe
  C:\Windows\System\gviLTtz.exe
  2⤵
  PID:4148
- C:\Windows\System\nUjNszP.exe
  C:\Windows\System\nUjNszP.exe
  2⤵
  PID:4164
- C:\Windows\System\QnlwJMu.exe
  C:\Windows\System\QnlwJMu.exe
  2⤵
  PID:4180
- C:\Windows\System\hNuXKyD.exe
  C:\Windows\System\hNuXKyD.exe
  2⤵
  PID:4196
- C:\Windows\System\pkBdtPQ.exe
  C:\Windows\System\pkBdtPQ.exe
  2⤵
  PID:4212
- C:\Windows\System\HtVyzqy.exe
  C:\Windows\System\HtVyzqy.exe
  2⤵
  PID:4228
- C:\Windows\System\unnHdkU.exe
  C:\Windows\System\unnHdkU.exe
  2⤵
  PID:4244
- C:\Windows\System\ZxGsPXC.exe
  C:\Windows\System\ZxGsPXC.exe
  2⤵
  PID:4260
- C:\Windows\System\bZyUsGU.exe
  C:\Windows\System\bZyUsGU.exe
  2⤵
  PID:4276
- C:\Windows\System\rIHsrtN.exe
  C:\Windows\System\rIHsrtN.exe
  2⤵
  PID:4292
- C:\Windows\System\KowNwAO.exe
  C:\Windows\System\KowNwAO.exe
  2⤵
  PID:4308
- C:\Windows\System\MUdJIRk.exe
  C:\Windows\System\MUdJIRk.exe
  2⤵
  PID:4324
- C:\Windows\System\NLDlAjW.exe
  C:\Windows\System\NLDlAjW.exe
  2⤵
  PID:4340
- C:\Windows\System\kxiqRVh.exe
  C:\Windows\System\kxiqRVh.exe
  2⤵
  PID:4356
- C:\Windows\System\jotTMqi.exe
  C:\Windows\System\jotTMqi.exe
  2⤵
  PID:4372
- C:\Windows\System\MLCHtQk.exe
  C:\Windows\System\MLCHtQk.exe
  2⤵
  PID:4388
- C:\Windows\System\watFrrd.exe
  C:\Windows\System\watFrrd.exe
  2⤵
  PID:4404
- C:\Windows\System\DeCxrhb.exe
  C:\Windows\System\DeCxrhb.exe
  2⤵
  PID:4420
- C:\Windows\System\DRmNCCk.exe
  C:\Windows\System\DRmNCCk.exe
  2⤵
  PID:4436
- C:\Windows\System\aBkAGYQ.exe
  C:\Windows\System\aBkAGYQ.exe
  2⤵
  PID:4452
- C:\Windows\System\CSLKJnd.exe
  C:\Windows\System\CSLKJnd.exe
  2⤵
  PID:4468
- C:\Windows\System\OKCmAlr.exe
  C:\Windows\System\OKCmAlr.exe
  2⤵
  PID:4484
- C:\Windows\System\SlHqdcX.exe
  C:\Windows\System\SlHqdcX.exe
  2⤵
  PID:4500
- C:\Windows\System\JmQMKei.exe
  C:\Windows\System\JmQMKei.exe
  2⤵
  PID:4516
- C:\Windows\System\vkMjxGX.exe
  C:\Windows\System\vkMjxGX.exe
  2⤵
  PID:4536
- C:\Windows\System\zSoCYLl.exe
  C:\Windows\System\zSoCYLl.exe
  2⤵
  PID:4556
- C:\Windows\System\nCEihGZ.exe
  C:\Windows\System\nCEihGZ.exe
  2⤵
  PID:4576
- C:\Windows\System\ownYaQz.exe
  C:\Windows\System\ownYaQz.exe
  2⤵
  PID:4592
- C:\Windows\System\OPaBBPR.exe
  C:\Windows\System\OPaBBPR.exe
  2⤵
  PID:4608
- C:\Windows\System\MTuocSl.exe
  C:\Windows\System\MTuocSl.exe
  2⤵
  PID:4624
- C:\Windows\System\qWCACSR.exe
  C:\Windows\System\qWCACSR.exe
  2⤵
  PID:4640
- C:\Windows\System\nDPxQcR.exe
  C:\Windows\System\nDPxQcR.exe
  2⤵
  PID:4656
- C:\Windows\System\cTwsYCU.exe
  C:\Windows\System\cTwsYCU.exe
  2⤵
  PID:4672
- C:\Windows\System\yiSmwar.exe
  C:\Windows\System\yiSmwar.exe
  2⤵
  PID:4688
- C:\Windows\System\gkFayiB.exe
  C:\Windows\System\gkFayiB.exe
  2⤵
  PID:4704
- C:\Windows\System\dHbHJua.exe
  C:\Windows\System\dHbHJua.exe
  2⤵
  PID:4720
- C:\Windows\System\llaBeda.exe
  C:\Windows\System\llaBeda.exe
  2⤵
  PID:4736
- C:\Windows\System\QqQZycQ.exe
  C:\Windows\System\QqQZycQ.exe
  2⤵
  PID:4752
- C:\Windows\System\JncIDLq.exe
  C:\Windows\System\JncIDLq.exe
  2⤵
  PID:4768
- C:\Windows\System\eFVawbf.exe
  C:\Windows\System\eFVawbf.exe
  2⤵
  PID:4784
- C:\Windows\System\ZmTaYtD.exe
  C:\Windows\System\ZmTaYtD.exe
  2⤵
  PID:4800
- C:\Windows\System\mCWbDVL.exe
  C:\Windows\System\mCWbDVL.exe
  2⤵
  PID:4816
- C:\Windows\System\rKnadKV.exe
  C:\Windows\System\rKnadKV.exe
  2⤵
  PID:4832
- C:\Windows\System\NYuOoGI.exe
  C:\Windows\System\NYuOoGI.exe
  2⤵
  PID:4848
- C:\Windows\System\BqRPYqV.exe
  C:\Windows\System\BqRPYqV.exe
  2⤵
  PID:4864
- C:\Windows\System\yzaZBql.exe
  C:\Windows\System\yzaZBql.exe
  2⤵
  PID:4880
- C:\Windows\System\DBuogiH.exe
  C:\Windows\System\DBuogiH.exe
  2⤵
  PID:4896
- C:\Windows\System\ItCrXMC.exe
  C:\Windows\System\ItCrXMC.exe
  2⤵
  PID:4912
- C:\Windows\System\UPipqqj.exe
  C:\Windows\System\UPipqqj.exe
  2⤵
  PID:4928
- C:\Windows\System\fOTSVnI.exe
  C:\Windows\System\fOTSVnI.exe
  2⤵
  PID:4944
- C:\Windows\System\BrchAXE.exe
  C:\Windows\System\BrchAXE.exe
  2⤵
  PID:4960
- C:\Windows\System\TXXjVPp.exe
  C:\Windows\System\TXXjVPp.exe
  2⤵
  PID:4976
- C:\Windows\System\HnMnijn.exe
  C:\Windows\System\HnMnijn.exe
  2⤵
  PID:4992
- C:\Windows\System\aorCZsR.exe
  C:\Windows\System\aorCZsR.exe
  2⤵
  PID:5008
- C:\Windows\System\ZyAGJdx.exe
  C:\Windows\System\ZyAGJdx.exe
  2⤵
  PID:5024
- C:\Windows\System\ohABbZk.exe
  C:\Windows\System\ohABbZk.exe
  2⤵
  PID:5040
- C:\Windows\System\pNCjIzr.exe
  C:\Windows\System\pNCjIzr.exe
  2⤵
  PID:5056
- C:\Windows\System\ivPieLE.exe
  C:\Windows\System\ivPieLE.exe
  2⤵
  PID:5072
- C:\Windows\System\iLsKeQs.exe
  C:\Windows\System\iLsKeQs.exe
  2⤵
  PID:5088
- C:\Windows\System\gtgAQfM.exe
  C:\Windows\System\gtgAQfM.exe
  2⤵
  PID:5104
- C:\Windows\System\yDvQDAn.exe
  C:\Windows\System\yDvQDAn.exe
  2⤵
  PID:528
- C:\Windows\System\HqlLDpO.exe
  C:\Windows\System\HqlLDpO.exe
  2⤵
  PID:2476
- C:\Windows\System\wzhzKVg.exe
  C:\Windows\System\wzhzKVg.exe
  2⤵
  PID:3500
- C:\Windows\System\qakOPOA.exe
  C:\Windows\System\qakOPOA.exe
  2⤵
  PID:3644
- C:\Windows\System\xujkJhE.exe
  C:\Windows\System\xujkJhE.exe
  2⤵
  PID:3704
- C:\Windows\System\OWzSAmJ.exe
  C:\Windows\System\OWzSAmJ.exe
  2⤵
  PID:4108
- C:\Windows\System\oqTWQwa.exe
  C:\Windows\System\oqTWQwa.exe
  2⤵
  PID:4176
- C:\Windows\System\AeNizgC.exe
  C:\Windows\System\AeNizgC.exe
  2⤵
  PID:4236
- C:\Windows\System\cLdHiLy.exe
  C:\Windows\System\cLdHiLy.exe
  2⤵
  PID:4272
- C:\Windows\System\skKlNYI.exe
  C:\Windows\System\skKlNYI.exe
  2⤵
  PID:4300
- C:\Windows\System\DrcHMNU.exe
  C:\Windows\System\DrcHMNU.exe
  2⤵
  PID:4024
- C:\Windows\System\xkLbFYO.exe
  C:\Windows\System\xkLbFYO.exe
  2⤵
  PID:4044
- C:\Windows\System\QIjpiQx.exe
  C:\Windows\System\QIjpiQx.exe
  2⤵
  PID:4364
- C:\Windows\System\tulIzpZ.exe
  C:\Windows\System\tulIzpZ.exe
  2⤵
  PID:2200
- C:\Windows\System\ntfvSwE.exe
  C:\Windows\System\ntfvSwE.exe
  2⤵
  PID:3852
- C:\Windows\System\qvleKkL.exe
  C:\Windows\System\qvleKkL.exe
  2⤵
  PID:3224
- C:\Windows\System\ykKgaOu.exe
  C:\Windows\System\ykKgaOu.exe
  2⤵
  PID:4396
- C:\Windows\System\tNQcPYY.exe
  C:\Windows\System\tNQcPYY.exe
  2⤵
  PID:4060
- C:\Windows\System\NiGsSCj.exe
  C:\Windows\System\NiGsSCj.exe
  2⤵
  PID:4432
- C:\Windows\System\OytXvlD.exe
  C:\Windows\System\OytXvlD.exe
  2⤵
  PID:4496
- C:\Windows\System\tlISDyN.exe
  C:\Windows\System\tlISDyN.exe
  2⤵
  PID:4572
- C:\Windows\System\hzDRSVN.exe
  C:\Windows\System\hzDRSVN.exe
  2⤵
  PID:4604
- C:\Windows\System\CEEYnlE.exe
  C:\Windows\System\CEEYnlE.exe
  2⤵
  PID:4156
- C:\Windows\System\iSZiFRw.exe
  C:\Windows\System\iSZiFRw.exe
  2⤵
  PID:4348
- C:\Windows\System\JThTIwJ.exe
  C:\Windows\System\JThTIwJ.exe
  2⤵
  PID:4284
- C:\Windows\System\QUhkokh.exe
  C:\Windows\System\QUhkokh.exe
  2⤵
  PID:4220
- C:\Windows\System\Qavmakq.exe
  C:\Windows\System\Qavmakq.exe
  2⤵
  PID:4480
- C:\Windows\System\zAwWnoG.exe
  C:\Windows\System\zAwWnoG.exe
  2⤵
  PID:4512
- C:\Windows\System\yENRSoY.exe
  C:\Windows\System\yENRSoY.exe
  2⤵
  PID:4636
- C:\Windows\System\bRAsriB.exe
  C:\Windows\System\bRAsriB.exe
  2⤵
  PID:4700
- C:\Windows\System\WOGcdPy.exe
  C:\Windows\System\WOGcdPy.exe
  2⤵
  PID:4764
- C:\Windows\System\DctuVSt.exe
  C:\Windows\System\DctuVSt.exe
  2⤵
  PID:4620
- C:\Windows\System\NHcXRwJ.exe
  C:\Windows\System\NHcXRwJ.exe
  2⤵
  PID:4684
- C:\Windows\System\KViUjSk.exe
  C:\Windows\System\KViUjSk.exe
  2⤵
  PID:4748
- C:\Windows\System\JHFRZIz.exe
  C:\Windows\System\JHFRZIz.exe
  2⤵
  PID:4828
- C:\Windows\System\gmetqoF.exe
  C:\Windows\System\gmetqoF.exe
  2⤵
  PID:4892
- C:\Windows\System\ZVLsPCJ.exe
  C:\Windows\System\ZVLsPCJ.exe
  2⤵
  PID:4780
- C:\Windows\System\efFewtY.exe
  C:\Windows\System\efFewtY.exe
  2⤵
  PID:4984
- C:\Windows\System\wNdPRmA.exe
  C:\Windows\System\wNdPRmA.exe
  2⤵
  PID:4872
- C:\Windows\System\HhfTqDe.exe
  C:\Windows\System\HhfTqDe.exe
  2⤵
  PID:4808
- C:\Windows\System\bWAjDEe.exe
  C:\Windows\System\bWAjDEe.exe
  2⤵
  PID:2280
- C:\Windows\System\OuUwTrr.exe
  C:\Windows\System\OuUwTrr.exe
  2⤵
  PID:5084
- C:\Windows\System\zmIbYwT.exe
  C:\Windows\System\zmIbYwT.exe
  2⤵
  PID:4940
- C:\Windows\System\QZSmpFs.exe
  C:\Windows\System\QZSmpFs.exe
  2⤵
  PID:4972
- C:\Windows\System\lulFRJq.exe
  C:\Windows\System\lulFRJq.exe
  2⤵
  PID:5112
- C:\Windows\System\HUkxzKc.exe
  C:\Windows\System\HUkxzKc.exe
  2⤵
  PID:3156
- C:\Windows\System\Rbypdnn.exe
  C:\Windows\System\Rbypdnn.exe
  2⤵
  PID:4140
- C:\Windows\System\HKlDssn.exe
  C:\Windows\System\HKlDssn.exe
  2⤵
  PID:648
- C:\Windows\System\IvMHMPO.exe
  C:\Windows\System\IvMHMPO.exe
  2⤵
  PID:3252
- C:\Windows\System\aJCirQz.exe
  C:\Windows\System\aJCirQz.exe
  2⤵
  PID:4128
- C:\Windows\System\LcwqSVp.exe
  C:\Windows\System\LcwqSVp.exe
  2⤵
  PID:4160
- C:\Windows\System\aiuCGcE.exe
  C:\Windows\System\aiuCGcE.exe
  2⤵
  PID:4188
- C:\Windows\System\ZFMmbqr.exe
  C:\Windows\System\ZFMmbqr.exe
  2⤵
  PID:4732
- C:\Windows\System\eGeOtLb.exe
  C:\Windows\System\eGeOtLb.exe
  2⤵
  PID:5100
- C:\Windows\System\EIPWxRb.exe
  C:\Windows\System\EIPWxRb.exe
  2⤵
  PID:3160
- C:\Windows\System\tFQzDKH.exe
  C:\Windows\System\tFQzDKH.exe
  2⤵
  PID:4204
- C:\Windows\System\yKEaknm.exe
  C:\Windows\System\yKEaknm.exe
  2⤵
  PID:4936
- C:\Windows\System\yymoIFv.exe
  C:\Windows\System\yymoIFv.exe
  2⤵
  PID:3900
- C:\Windows\System\XBTiXuR.exe
  C:\Windows\System\XBTiXuR.exe
  2⤵
  PID:3368
- C:\Windows\System\kPbHedc.exe
  C:\Windows\System\kPbHedc.exe
  2⤵
  PID:4464
- C:\Windows\System\fiHrPay.exe
  C:\Windows\System\fiHrPay.exe
  2⤵
  PID:2680
- C:\Windows\System\tHAHRZp.exe
  C:\Windows\System\tHAHRZp.exe
  2⤵
  PID:2632
- C:\Windows\System\SnypovS.exe
  C:\Windows\System\SnypovS.exe
  2⤵
  PID:4252
- C:\Windows\System\bItulxh.exe
  C:\Windows\System\bItulxh.exe
  2⤵
  PID:5068
- C:\Windows\System\uLRuFer.exe
  C:\Windows\System\uLRuFer.exe
  2⤵
  PID:4696
- C:\Windows\System\VaDeWgH.exe
  C:\Windows\System\VaDeWgH.exe
  2⤵
  PID:4956
- C:\Windows\System\cRoCElU.exe
  C:\Windows\System\cRoCElU.exe
  2⤵
  PID:4744
- C:\Windows\System\miNpxZr.exe
  C:\Windows\System\miNpxZr.exe
  2⤵
  PID:5000
- C:\Windows\System\xvhEudU.exe
  C:\Windows\System\xvhEudU.exe
  2⤵
  PID:3624
- C:\Windows\System\CzsySVG.exe
  C:\Windows\System\CzsySVG.exe
  2⤵
  PID:3916
- C:\Windows\System\LdYOuvb.exe
  C:\Windows\System\LdYOuvb.exe
  2⤵
  PID:4532
- C:\Windows\System\NeWEULj.exe
  C:\Windows\System\NeWEULj.exe
  2⤵
  PID:2580
- C:\Windows\System\WGljktU.exe
  C:\Windows\System\WGljktU.exe
  2⤵
  PID:2976
- C:\Windows\System\LPGtUIn.exe
  C:\Windows\System\LPGtUIn.exe
  2⤵
  PID:2692
- C:\Windows\System\xWjxOHd.exe
  C:\Windows\System\xWjxOHd.exe
  2⤵
  PID:1104
- C:\Windows\System\kfTXFzp.exe
  C:\Windows\System\kfTXFzp.exe
  2⤵
  PID:4288
- C:\Windows\System\vBhFLla.exe
  C:\Windows\System\vBhFLla.exe
  2⤵
  PID:4824
- C:\Windows\System\wyQQmJY.exe
  C:\Windows\System\wyQQmJY.exe
  2⤵
  PID:2480
- C:\Windows\System\CqhzvOj.exe
  C:\Windows\System\CqhzvOj.exe
  2⤵
  PID:3980
- C:\Windows\System\sJivCyB.exe
  C:\Windows\System\sJivCyB.exe
  2⤵
  PID:5004
- C:\Windows\System\aJYEYDA.exe
  C:\Windows\System\aJYEYDA.exe
  2⤵
  PID:5136
- C:\Windows\System\JFCzlam.exe
  C:\Windows\System\JFCzlam.exe
  2⤵
  PID:5156
- C:\Windows\System\jCMJDLj.exe
  C:\Windows\System\jCMJDLj.exe
  2⤵
  PID:5172
- C:\Windows\System\vsnYOME.exe
  C:\Windows\System\vsnYOME.exe
  2⤵
  PID:5672
- C:\Windows\System\TjNrWNQ.exe
  C:\Windows\System\TjNrWNQ.exe
  2⤵
  PID:5900
- C:\Windows\System\sScMThE.exe
  C:\Windows\System\sScMThE.exe
  2⤵
  PID:5996
- C:\Windows\System\rbhYSze.exe
  C:\Windows\System\rbhYSze.exe
  2⤵
  PID:6100
- C:\Windows\System\mtPoCqw.exe
  C:\Windows\System\mtPoCqw.exe
  2⤵
  PID:6124
- C:\Windows\System\DArJXPK.exe
  C:\Windows\System\DArJXPK.exe
  2⤵
  PID:4796
- C:\Windows\System\lCwzplj.exe
  C:\Windows\System\lCwzplj.exe
  2⤵
  PID:5096
- C:\Windows\System\DYYKFht.exe
  C:\Windows\System\DYYKFht.exe
  2⤵
  PID:2472
- C:\Windows\System\fyTNUAn.exe
  C:\Windows\System\fyTNUAn.exe
  2⤵
  PID:3436
- C:\Windows\System\TviAZCc.exe
  C:\Windows\System\TviAZCc.exe
  2⤵
  PID:5016
- C:\Windows\System\gCfWkOg.exe
  C:\Windows\System\gCfWkOg.exe
  2⤵
  PID:852
- C:\Windows\System\HWPMRzg.exe
  C:\Windows\System\HWPMRzg.exe
  2⤵
  PID:5128
- C:\Windows\System\GGJkzQW.exe
  C:\Windows\System\GGJkzQW.exe
  2⤵
  PID:5696
- C:\Windows\System\GzOyJWC.exe
  C:\Windows\System\GzOyJWC.exe
  2⤵
  PID:5712
- C:\Windows\System\DIaZORr.exe
  C:\Windows\System\DIaZORr.exe
  2⤵
  PID:5728
- C:\Windows\System\PCAdbjx.exe
  C:\Windows\System\PCAdbjx.exe
  2⤵
  PID:5744
- C:\Windows\System\rIgzQWW.exe
  C:\Windows\System\rIgzQWW.exe
  2⤵
  PID:4812
- C:\Windows\System\ChdUGCV.exe
  C:\Windows\System\ChdUGCV.exe
  2⤵
  PID:2596
- C:\Windows\System\GqtyLoW.exe
  C:\Windows\System\GqtyLoW.exe
  2⤵
  PID:820
- C:\Windows\System\mWcVEgc.exe
  C:\Windows\System\mWcVEgc.exe
  2⤵
  PID:2696
- C:\Windows\System\CRlDGkB.exe
  C:\Windows\System\CRlDGkB.exe
  2⤵
  PID:2732
- C:\Windows\System\kfGlFKU.exe
  C:\Windows\System\kfGlFKU.exe
  2⤵
  PID:5524
- C:\Windows\System\KVoxEzH.exe
  C:\Windows\System\KVoxEzH.exe
  2⤵
  PID:5540
- C:\Windows\System\RjGNjyL.exe
  C:\Windows\System\RjGNjyL.exe
  2⤵
  PID:5556
- C:\Windows\System\kEqaqFb.exe
  C:\Windows\System\kEqaqFb.exe
  2⤵
  PID:5572
- C:\Windows\System\RkErlpA.exe
  C:\Windows\System\RkErlpA.exe
  2⤵
  PID:5588
- C:\Windows\System\MtQuZsl.exe
  C:\Windows\System\MtQuZsl.exe
  2⤵
  PID:5604
- C:\Windows\System\CMEapnr.exe
  C:\Windows\System\CMEapnr.exe
  2⤵
  PID:5620
- C:\Windows\System\dHBvhfd.exe
  C:\Windows\System\dHBvhfd.exe
  2⤵
  PID:5644
- C:\Windows\System\MAWfFBB.exe
  C:\Windows\System\MAWfFBB.exe
  2⤵
  PID:5660
- C:\Windows\System\qIRPxRX.exe
  C:\Windows\System\qIRPxRX.exe
  2⤵
  PID:2052
- C:\Windows\System\swDcKzP.exe
  C:\Windows\System\swDcKzP.exe
  2⤵
  PID:5780
- C:\Windows\System\yuzeJif.exe
  C:\Windows\System\yuzeJif.exe
  2⤵
  PID:5796
- C:\Windows\System\kqIirRq.exe
  C:\Windows\System\kqIirRq.exe
  2⤵
  PID:5812
- C:\Windows\System\xQSQwnJ.exe
  C:\Windows\System\xQSQwnJ.exe
  2⤵
  PID:5828
- C:\Windows\System\Ntetotg.exe
  C:\Windows\System\Ntetotg.exe
  2⤵
  PID:5844
- C:\Windows\System\YBUijBA.exe
  C:\Windows\System\YBUijBA.exe
  2⤵
  PID:5860
- C:\Windows\System\faQDzAC.exe
  C:\Windows\System\faQDzAC.exe
  2⤵
  PID:5876
- C:\Windows\System\UtdMgvi.exe
  C:\Windows\System\UtdMgvi.exe
  2⤵
  PID:5892
- C:\Windows\System\GDzdYvU.exe
  C:\Windows\System\GDzdYvU.exe
  2⤵
  PID:324
- C:\Windows\System\mmmHhaf.exe
  C:\Windows\System\mmmHhaf.exe
  2⤵
  PID:5144
- C:\Windows\System\yuKvqSA.exe
  C:\Windows\System\yuKvqSA.exe
  2⤵
  PID:5248
- C:\Windows\System\lGPeGLO.exe
  C:\Windows\System\lGPeGLO.exe
  2⤵
  PID:5276
- C:\Windows\System\pDnNyER.exe
  C:\Windows\System\pDnNyER.exe
  2⤵
  PID:5296
- C:\Windows\System\LSfXprH.exe
  C:\Windows\System\LSfXprH.exe
  2⤵
  PID:5976
- C:\Windows\System\JLSWEpB.exe
  C:\Windows\System\JLSWEpB.exe
  2⤵
  PID:6060
- C:\Windows\System\tepBupR.exe
  C:\Windows\System\tepBupR.exe
  2⤵
  PID:6088
- C:\Windows\System\FipbJyE.exe
  C:\Windows\System\FipbJyE.exe
  2⤵
  PID:4336
- C:\Windows\System\wjNxYSn.exe
  C:\Windows\System\wjNxYSn.exe
  2⤵
  PID:3960
- C:\Windows\System\TGFbCCw.exe
  C:\Windows\System\TGFbCCw.exe
  2⤵
  PID:1416
- C:\Windows\System\ztfCGgz.exe
  C:\Windows\System\ztfCGgz.exe
  2⤵
  PID:3268
- C:\Windows\System\ZsVWWwL.exe
  C:\Windows\System\ZsVWWwL.exe
  2⤵
  PID:1592
- C:\Windows\System\evoxLet.exe
  C:\Windows\System\evoxLet.exe
  2⤵
  PID:1768
- C:\Windows\System\CpoEeuJ.exe
  C:\Windows\System\CpoEeuJ.exe
  2⤵
  PID:1908
- C:\Windows\System\krmOblY.exe
  C:\Windows\System\krmOblY.exe
  2⤵
  PID:5688
- C:\Windows\System\jqsDnxp.exe
  C:\Windows\System\jqsDnxp.exe
  2⤵
  PID:5736
- C:\Windows\System\iTzYNEJ.exe
  C:\Windows\System\iTzYNEJ.exe
  2⤵
  PID:4224
- C:\Windows\System\hYWRCDa.exe
  C:\Windows\System\hYWRCDa.exe
  2⤵
  PID:2216
- C:\Windows\System\Lowzstr.exe
  C:\Windows\System\Lowzstr.exe
  2⤵
  PID:5548
- C:\Windows\System\ofsoOSf.exe
  C:\Windows\System\ofsoOSf.exe
  2⤵
  PID:1656
- C:\Windows\System\LdNXVpH.exe
  C:\Windows\System\LdNXVpH.exe
  2⤵
  PID:5584
- C:\Windows\System\EyidPfU.exe
  C:\Windows\System\EyidPfU.exe
  2⤵
  PID:5536
- C:\Windows\System\wNkKoWN.exe
  C:\Windows\System\wNkKoWN.exe
  2⤵
  PID:5568
- C:\Windows\System\ekdsDjC.exe
  C:\Windows\System\ekdsDjC.exe
  2⤵
  PID:5776
- C:\Windows\System\ufZSKKW.exe
  C:\Windows\System\ufZSKKW.exe
  2⤵
  PID:5804
- C:\Windows\System\eOrffxz.exe
  C:\Windows\System\eOrffxz.exe
  2⤵
  PID:1692
- C:\Windows\System\ITwuTtm.exe
  C:\Windows\System\ITwuTtm.exe
  2⤵
  PID:4652
- C:\Windows\System\gOadseO.exe
  C:\Windows\System\gOadseO.exe
  2⤵
  PID:2876
- C:\Windows\System\XWPJmDP.exe
  C:\Windows\System\XWPJmDP.exe
  2⤵
  PID:5244
- C:\Windows\System\MSUsikR.exe
  C:\Windows\System\MSUsikR.exe
  2⤵
  PID:1644
- C:\Windows\System\IRzrzFA.exe
  C:\Windows\System\IRzrzFA.exe
  2⤵
  PID:604
- C:\Windows\System\yhTsDCw.exe
  C:\Windows\System\yhTsDCw.exe
  2⤵
  PID:5320
- C:\Windows\System\DdSpuqb.exe
  C:\Windows\System\DdSpuqb.exe
  2⤵
  PID:5336
- C:\Windows\System\UYapTUQ.exe
  C:\Windows\System\UYapTUQ.exe
  2⤵
  PID:6020
- C:\Windows\System\uyHmQSX.exe
  C:\Windows\System\uyHmQSX.exe
  2⤵
  PID:4860
- C:\Windows\System\fuIMpFc.exe
  C:\Windows\System\fuIMpFc.exe
  2⤵
  PID:5708
- C:\Windows\System\mLGAkSL.exe
  C:\Windows\System\mLGAkSL.exe
  2⤵
  PID:2936
- C:\Windows\System\SfDqmrt.exe
  C:\Windows\System\SfDqmrt.exe
  2⤵
  PID:1640
- C:\Windows\System\DKdnONJ.exe
  C:\Windows\System\DKdnONJ.exe
  2⤵
  PID:5800
- C:\Windows\System\jEWEvGn.exe
  C:\Windows\System\jEWEvGn.exe
  2⤵
  PID:5856
- C:\Windows\System\VrCBjit.exe
  C:\Windows\System\VrCBjit.exe
  2⤵
  PID:5268
- C:\Windows\System\ELUPTjV.exe
  C:\Windows\System\ELUPTjV.exe
  2⤵
  PID:5388
- C:\Windows\System\vgLRhvP.exe
  C:\Windows\System\vgLRhvP.exe
  2⤵
  PID:5420
- C:\Windows\System\zKvkIXu.exe
  C:\Windows\System\zKvkIXu.exe
  2⤵
  PID:5436
- C:\Windows\System\NXkpgBp.exe
  C:\Windows\System\NXkpgBp.exe
  2⤵
  PID:5456
- C:\Windows\System\XNXpsZr.exe
  C:\Windows\System\XNXpsZr.exe
  2⤵
  PID:5472
- C:\Windows\System\VxEmeqp.exe
  C:\Windows\System\VxEmeqp.exe
  2⤵
  PID:5488
- C:\Windows\System\gytOdIy.exe
  C:\Windows\System\gytOdIy.exe
  2⤵
  PID:5504
- C:\Windows\System\bsefELA.exe
  C:\Windows\System\bsefELA.exe
  2⤵
  PID:5272
- C:\Windows\System\LJtoAMa.exe
  C:\Windows\System\LJtoAMa.exe
  2⤵
  PID:4316
- C:\Windows\System\qMlrKSW.exe
  C:\Windows\System\qMlrKSW.exe
  2⤵
  PID:2728
- C:\Windows\System\hJCrqwo.exe
  C:\Windows\System\hJCrqwo.exe
  2⤵
  PID:2040
- C:\Windows\System\penyGOn.exe
  C:\Windows\System\penyGOn.exe
  2⤵
  PID:5968
- C:\Windows\System\wdYwmZV.exe
  C:\Windows\System\wdYwmZV.exe
  2⤵
  PID:5344
- C:\Windows\System\gGZFNQl.exe
  C:\Windows\System\gGZFNQl.exe
  2⤵
  PID:6012
- C:\Windows\System\KjYJNCN.exe
  C:\Windows\System\KjYJNCN.exe
  2⤵
  PID:5912
- C:\Windows\System\UnbeJPZ.exe
  C:\Windows\System\UnbeJPZ.exe
  2⤵
  PID:2236
- C:\Windows\System\PBRaKBY.exe
  C:\Windows\System\PBRaKBY.exe
  2⤵
  PID:4876
- C:\Windows\System\lMFeZPT.exe
  C:\Windows\System\lMFeZPT.exe
  2⤵
  PID:2360
- C:\Windows\System\UWdwjUy.exe
  C:\Windows\System\UWdwjUy.exe
  2⤵
  PID:5724
- C:\Windows\System\IDwxKsZ.exe
  C:\Windows\System\IDwxKsZ.exe
  2⤵
  PID:5580
- C:\Windows\System\LhHRrIs.exe
  C:\Windows\System\LhHRrIs.exe
  2⤵
  PID:5552
- C:\Windows\System\sXHdovY.exe
  C:\Windows\System\sXHdovY.exe
  2⤵
  PID:5376
- C:\Windows\System\OHRHHYv.exe
  C:\Windows\System\OHRHHYv.exe
  2⤵
  PID:5464
- C:\Windows\System\aMtPuRv.exe
  C:\Windows\System\aMtPuRv.exe
  2⤵
  PID:5500
- C:\Windows\System\FASaTOq.exe
  C:\Windows\System\FASaTOq.exe
  2⤵
  PID:2952
- C:\Windows\System\kaUYJdq.exe
  C:\Windows\System\kaUYJdq.exe
  2⤵
  PID:5152
- C:\Windows\System\iEQCFDS.exe
  C:\Windows\System\iEQCFDS.exe
  2⤵
  PID:5520
- C:\Windows\System\HlUHvML.exe
  C:\Windows\System\HlUHvML.exe
  2⤵
  PID:592
- C:\Windows\System\SbfTnHF.exe
  C:\Windows\System\SbfTnHF.exe
  2⤵
  PID:5908
- C:\Windows\System\UXeuWZq.exe
  C:\Windows\System\UXeuWZq.exe
  2⤵
  PID:6080
- C:\Windows\System\bQPMpuP.exe
  C:\Windows\System\bQPMpuP.exe
  2⤵
  PID:5328
- C:\Windows\System\SohKHdc.exe
  C:\Windows\System\SohKHdc.exe
  2⤵
  PID:5988
- C:\Windows\System\BHDWICA.exe
  C:\Windows\System\BHDWICA.exe
  2⤵
  PID:6096
- C:\Windows\System\kWgkdgk.exe
  C:\Windows\System\kWgkdgk.exe
  2⤵
  PID:6040
- C:\Windows\System\Fyygijf.exe
  C:\Windows\System\Fyygijf.exe
  2⤵
  PID:5332
- C:\Windows\System\wyQVBmm.exe
  C:\Windows\System\wyQVBmm.exe
  2⤵
  PID:2516
- C:\Windows\System\MlLzVkz.exe
  C:\Windows\System\MlLzVkz.exe
  2⤵
  PID:5772
- C:\Windows\System\BaKcYtj.exe
  C:\Windows\System\BaKcYtj.exe
  2⤵
  PID:5396
- C:\Windows\System\aQOUejQ.exe
  C:\Windows\System\aQOUejQ.exe
  2⤵
  PID:5416
- C:\Windows\System\mXieNmu.exe
  C:\Windows\System\mXieNmu.exe
  2⤵
  PID:2768
- C:\Windows\System\RVrPMhS.exe
  C:\Windows\System\RVrPMhS.exe
  2⤵
  PID:5184
- C:\Windows\System\XIKNwty.exe
  C:\Windows\System\XIKNwty.exe
  2⤵
  PID:5840
- C:\Windows\System\NgNmRMu.exe
  C:\Windows\System\NgNmRMu.exe
  2⤵
  PID:6084
- C:\Windows\System\iPqqTgt.exe
  C:\Windows\System\iPqqTgt.exe
  2⤵
  PID:5312
- C:\Windows\System\VnETOMR.exe
  C:\Windows\System\VnETOMR.exe
  2⤵
  PID:5896
- C:\Windows\System\ZmhnzEl.exe
  C:\Windows\System\ZmhnzEl.exe
  2⤵
  PID:2840
- C:\Windows\System\qDiaxAq.exe
  C:\Windows\System\qDiaxAq.exe
  2⤵
  PID:5220
- C:\Windows\System\IGDGaRq.exe
  C:\Windows\System\IGDGaRq.exe
  2⤵
  PID:6148
- C:\Windows\System\xwLvbJW.exe
  C:\Windows\System\xwLvbJW.exe
  2⤵
  PID:6168
- C:\Windows\System\NepDCdw.exe
  C:\Windows\System\NepDCdw.exe
  2⤵
  PID:6184
- C:\Windows\System\mFWvkjH.exe
  C:\Windows\System\mFWvkjH.exe
  2⤵
  PID:6200
- C:\Windows\System\NBMBMwC.exe
  C:\Windows\System\NBMBMwC.exe
  2⤵
  PID:6220
- C:\Windows\System\XjNhabW.exe
  C:\Windows\System\XjNhabW.exe
  2⤵
  PID:6236
- C:\Windows\System\eMeZtCO.exe
  C:\Windows\System\eMeZtCO.exe
  2⤵
  PID:6252
- C:\Windows\System\jIQqEvn.exe
  C:\Windows\System\jIQqEvn.exe
  2⤵
  PID:6268
- C:\Windows\System\NggGBHU.exe
  C:\Windows\System\NggGBHU.exe
  2⤵
  PID:6292
- C:\Windows\System\dujxjts.exe
  C:\Windows\System\dujxjts.exe
  2⤵
  PID:6312
- C:\Windows\System\YAgWvil.exe
  C:\Windows\System\YAgWvil.exe
  2⤵
  PID:6332
- C:\Windows\System\RHpxypm.exe
  C:\Windows\System\RHpxypm.exe
  2⤵
  PID:6352
- C:\Windows\System\LllIcXM.exe
  C:\Windows\System\LllIcXM.exe
  2⤵
  PID:6368
- C:\Windows\System\AzgzDud.exe
  C:\Windows\System\AzgzDud.exe
  2⤵
  PID:6392
- C:\Windows\System\tckSvUM.exe
  C:\Windows\System\tckSvUM.exe
  2⤵
  PID:6412
- C:\Windows\System\zHlyyIU.exe
  C:\Windows\System\zHlyyIU.exe
  2⤵
  PID:6480
- C:\Windows\System\aOUZbst.exe
  C:\Windows\System\aOUZbst.exe
  2⤵
  PID:6504
- C:\Windows\System\GDUxSIE.exe
  C:\Windows\System\GDUxSIE.exe
  2⤵
  PID:6540
- C:\Windows\System\lPuzSmH.exe
  C:\Windows\System\lPuzSmH.exe
  2⤵
  PID:6560
- C:\Windows\System\WMRBZZi.exe
  C:\Windows\System\WMRBZZi.exe
  2⤵
  PID:6576
- C:\Windows\System\hUVfVrL.exe
  C:\Windows\System\hUVfVrL.exe
  2⤵
  PID:6592
- C:\Windows\System\NOYGfrM.exe
  C:\Windows\System\NOYGfrM.exe
  2⤵
  PID:6608
- C:\Windows\System\jkLtEPJ.exe
  C:\Windows\System\jkLtEPJ.exe
  2⤵
  PID:6624
- C:\Windows\System\nUSraGC.exe
  C:\Windows\System\nUSraGC.exe
  2⤵
  PID:6640
- C:\Windows\System\hoFyjXS.exe
  C:\Windows\System\hoFyjXS.exe
  2⤵
  PID:6656
- C:\Windows\System\AvsEVYw.exe
  C:\Windows\System\AvsEVYw.exe
  2⤵
  PID:6672
- C:\Windows\System\IOQXdAm.exe
  C:\Windows\System\IOQXdAm.exe
  2⤵
  PID:6688
- C:\Windows\System\vzAKvzT.exe
  C:\Windows\System\vzAKvzT.exe
  2⤵
  PID:6708
- C:\Windows\System\MbmxhJx.exe
  C:\Windows\System\MbmxhJx.exe
  2⤵
  PID:6728
- C:\Windows\System\ermrDcX.exe
  C:\Windows\System\ermrDcX.exe
  2⤵
  PID:6752
- C:\Windows\System\pQIpQpd.exe
  C:\Windows\System\pQIpQpd.exe
  2⤵
  PID:6772
- C:\Windows\System\kUDNzlu.exe
  C:\Windows\System\kUDNzlu.exe
  2⤵
  PID:6788
- C:\Windows\System\NYWEylf.exe
  C:\Windows\System\NYWEylf.exe
  2⤵
  PID:6804
- C:\Windows\System\mdQtvEP.exe
  C:\Windows\System\mdQtvEP.exe
  2⤵
  PID:6820
- C:\Windows\System\CKhTZvM.exe
  C:\Windows\System\CKhTZvM.exe
  2⤵
  PID:6836
- C:\Windows\System\arHxDUe.exe
  C:\Windows\System\arHxDUe.exe
  2⤵
  PID:6852
- C:\Windows\System\Qveawfy.exe
  C:\Windows\System\Qveawfy.exe
  2⤵
  PID:6868
- C:\Windows\System\ucCQAOv.exe
  C:\Windows\System\ucCQAOv.exe
  2⤵
  PID:6892
- C:\Windows\System\kyabgGX.exe
  C:\Windows\System\kyabgGX.exe
  2⤵
  PID:6924
- C:\Windows\System\LRZgSNh.exe
  C:\Windows\System\LRZgSNh.exe
  2⤵
  PID:6944
- C:\Windows\System\OvjJPHV.exe
  C:\Windows\System\OvjJPHV.exe
  2⤵
  PID:6960
- C:\Windows\System\hkInjSf.exe
  C:\Windows\System\hkInjSf.exe
  2⤵
  PID:6976
- C:\Windows\System\xBXZfvb.exe
  C:\Windows\System\xBXZfvb.exe
  2⤵
  PID:6996
- C:\Windows\System\FgMIFQY.exe
  C:\Windows\System\FgMIFQY.exe
  2⤵
  PID:7020
- C:\Windows\System\QXdDcLw.exe
  C:\Windows\System\QXdDcLw.exe
  2⤵
  PID:7040
- C:\Windows\System\SQUoTXy.exe
  C:\Windows\System\SQUoTXy.exe
  2⤵
  PID:7056
- C:\Windows\System\FTPIHOQ.exe
  C:\Windows\System\FTPIHOQ.exe
  2⤵
  PID:7072
- C:\Windows\System\VFrfvbO.exe
  C:\Windows\System\VFrfvbO.exe
  2⤵
  PID:7092
- C:\Windows\System\JRIRXmk.exe
  C:\Windows\System\JRIRXmk.exe
  2⤵
  PID:7116
- C:\Windows\System\gvWzZfr.exe
  C:\Windows\System\gvWzZfr.exe
  2⤵
  PID:7140
- C:\Windows\System\aFmqHfE.exe
  C:\Windows\System\aFmqHfE.exe
  2⤵
  PID:7156
- C:\Windows\System\UKObbou.exe
  C:\Windows\System\UKObbou.exe
  2⤵
  PID:6032
- C:\Windows\System\msakNZu.exe
  C:\Windows\System\msakNZu.exe
  2⤵
  PID:5304
- C:\Windows\System\ylSuZdT.exe
  C:\Windows\System\ylSuZdT.exe
  2⤵
  PID:6056
- C:\Windows\System\YGJHsjf.exe
  C:\Windows\System\YGJHsjf.exe
  2⤵
  PID:6192
- C:\Windows\System\upOMYhT.exe
  C:\Windows\System\upOMYhT.exe
  2⤵
  PID:6260
- C:\Windows\System\hudpegR.exe
  C:\Windows\System\hudpegR.exe
  2⤵
  PID:6448
- C:\Windows\System\dtypQLB.exe
  C:\Windows\System\dtypQLB.exe
  2⤵
  PID:6464
- C:\Windows\System\kyWnXxI.exe
  C:\Windows\System\kyWnXxI.exe
  2⤵
  PID:6512
- C:\Windows\System\MlPCYFp.exe
  C:\Windows\System\MlPCYFp.exe
  2⤵
  PID:6528
- C:\Windows\System\bPMIkvy.exe
  C:\Windows\System\bPMIkvy.exe
  2⤵
  PID:6572
- C:\Windows\System\kESmaQX.exe
  C:\Windows\System\kESmaQX.exe
  2⤵
  PID:6636
- C:\Windows\System\BSGikAs.exe
  C:\Windows\System\BSGikAs.exe
  2⤵
  PID:6748
- C:\Windows\System\XaSEKVp.exe
  C:\Windows\System\XaSEKVp.exe
  2⤵
  PID:6780
- C:\Windows\System\UhkuLbc.exe
  C:\Windows\System\UhkuLbc.exe
  2⤵
  PID:6816
- C:\Windows\System\hAZluUk.exe
  C:\Windows\System\hAZluUk.exe
  2⤵
  PID:6884
- C:\Windows\System\OXMoTBx.exe
  C:\Windows\System\OXMoTBx.exe
  2⤵
  PID:6932
- C:\Windows\System\YIPqcvu.exe
  C:\Windows\System\YIPqcvu.exe
  2⤵
  PID:5872
- C:\Windows\System\QSfsdWp.exe
  C:\Windows\System\QSfsdWp.exe
  2⤵
  PID:6972
- C:\Windows\System\pBKaPAU.exe
  C:\Windows\System\pBKaPAU.exe
  2⤵
  PID:5228
- C:\Windows\System\SbQLgKS.exe
  C:\Windows\System\SbQLgKS.exe
  2⤵
  PID:6072
- C:\Windows\System\PBOmggd.exe
  C:\Windows\System\PBOmggd.exe
  2⤵
  PID:6044
- C:\Windows\System\VOqBgJu.exe
  C:\Windows\System\VOqBgJu.exe
  2⤵
  PID:7124
- C:\Windows\System\vHudHgv.exe
  C:\Windows\System\vHudHgv.exe
  2⤵
  PID:7164
- C:\Windows\System\zvLFNeL.exe
  C:\Windows\System\zvLFNeL.exe
  2⤵
  PID:5632
- C:\Windows\System\iTJYQbB.exe
  C:\Windows\System\iTJYQbB.exe
  2⤵
  PID:5200
- C:\Windows\System\UuJruao.exe
  C:\Windows\System\UuJruao.exe
  2⤵
  PID:6208
- C:\Windows\System\VsACtLD.exe
  C:\Windows\System\VsACtLD.exe
  2⤵
  PID:6276
- C:\Windows\System\lfvnoot.exe
  C:\Windows\System\lfvnoot.exe
  2⤵
  PID:6320
- C:\Windows\System\PRGHLnJ.exe
  C:\Windows\System\PRGHLnJ.exe
  2⤵
  PID:6548
- C:\Windows\System\thJyPcn.exe
  C:\Windows\System\thJyPcn.exe
  2⤵
  PID:5256
- C:\Windows\System\BWCqMtz.exe
  C:\Windows\System\BWCqMtz.exe
  2⤵
  PID:6760
- C:\Windows\System\zhXItmP.exe
  C:\Windows\System\zhXItmP.exe
  2⤵
  PID:6916
- C:\Windows\System\YRfeGtj.exe
  C:\Windows\System\YRfeGtj.exe
  2⤵
  PID:5240
- C:\Windows\System\GLPgxkC.exe
  C:\Windows\System\GLPgxkC.exe
  2⤵
  PID:6304
- C:\Windows\System\CQBDTOD.exe
  C:\Windows\System\CQBDTOD.exe
  2⤵
  PID:6340
- C:\Windows\System\zAyJoWK.exe
  C:\Windows\System\zAyJoWK.exe
  2⤵
  PID:5400
- C:\Windows\System\THhixsN.exe
  C:\Windows\System\THhixsN.exe
  2⤵
  PID:6420
- C:\Windows\System\NPwiPJC.exe
  C:\Windows\System\NPwiPJC.exe
  2⤵
  PID:6436
- C:\Windows\System\njUftwp.exe
  C:\Windows\System\njUftwp.exe
  2⤵
  PID:6440
- C:\Windows\System\fJUxDeS.exe
  C:\Windows\System\fJUxDeS.exe
  2⤵
  PID:6212
- C:\Windows\System\gsZidNU.exe
  C:\Windows\System\gsZidNU.exe
  2⤵
  PID:6404
- C:\Windows\System\NGjynoC.exe
  C:\Windows\System\NGjynoC.exe
  2⤵
  PID:6500
- C:\Windows\System\jAffaUm.exe
  C:\Windows\System\jAffaUm.exe
  2⤵
  PID:6652
- C:\Windows\System\gneStIe.exe
  C:\Windows\System\gneStIe.exe
  2⤵
  PID:6720
- C:\Windows\System\TLvkLIO.exe
  C:\Windows\System\TLvkLIO.exe
  2⤵
  PID:6832
- C:\Windows\System\BtlvrCQ.exe
  C:\Windows\System\BtlvrCQ.exe
  2⤵
  PID:6904
- C:\Windows\System\mAJvPEp.exe
  C:\Windows\System\mAJvPEp.exe
  2⤵
  PID:6988
- C:\Windows\System\YSWbkgd.exe
  C:\Windows\System\YSWbkgd.exe
  2⤵
  PID:7064
- C:\Windows\System\LENvvDk.exe
  C:\Windows\System\LENvvDk.exe
  2⤵
  PID:7108
- C:\Windows\System\tNWPtDG.exe
  C:\Windows\System\tNWPtDG.exe
  2⤵
  PID:6568
- C:\Windows\System\XkwAZHk.exe
  C:\Windows\System\XkwAZHk.exe
  2⤵
  PID:6164
- C:\Windows\System\yZHCyCr.exe
  C:\Windows\System\yZHCyCr.exe
  2⤵
  PID:5408
- C:\Windows\System\wdiYeiz.exe
  C:\Windows\System\wdiYeiz.exe
  2⤵
  PID:6444
- C:\Windows\System\vuJwovU.exe
  C:\Windows\System\vuJwovU.exe
  2⤵
  PID:6520
- C:\Windows\System\RynUOyo.exe
  C:\Windows\System\RynUOyo.exe
  2⤵
  PID:6812
- C:\Windows\System\qObWQZu.exe
  C:\Windows\System\qObWQZu.exe
  2⤵
  PID:6736
- C:\Windows\System\YQUvxvs.exe
  C:\Windows\System\YQUvxvs.exe
  2⤵
  PID:5232
- C:\Windows\System\OSJBHdA.exe
  C:\Windows\System\OSJBHdA.exe
  2⤵
  PID:5300
- C:\Windows\System\kYAfTaV.exe
  C:\Windows\System\kYAfTaV.exe
  2⤵
  PID:7088
- C:\Windows\System\dAEnlyP.exe
  C:\Windows\System\dAEnlyP.exe
  2⤵
  PID:7016
- C:\Windows\System\IfxOoIN.exe
  C:\Windows\System\IfxOoIN.exe
  2⤵
  PID:7136
- C:\Windows\System\QWTYPNs.exe
  C:\Windows\System\QWTYPNs.exe
  2⤵
  PID:5192
- C:\Windows\System\rwTUxYu.exe
  C:\Windows\System\rwTUxYu.exe
  2⤵
  PID:6556
- C:\Windows\System\tFCWvWg.exe
  C:\Windows\System\tFCWvWg.exe
  2⤵
  PID:6232
- C:\Windows\System\Fpeblnm.exe
  C:\Windows\System\Fpeblnm.exe
  2⤵
  PID:6956
- C:\Windows\System\dgxrEcH.exe
  C:\Windows\System\dgxrEcH.exe
  2⤵
  PID:6428
- C:\Windows\System\dQQKlbc.exe
  C:\Windows\System\dQQKlbc.exe
  2⤵
  PID:6176
- C:\Windows\System\dqLfSIZ.exe
  C:\Windows\System\dqLfSIZ.exe
  2⤵
  PID:5252
- C:\Windows\System\OMALory.exe
  C:\Windows\System\OMALory.exe
  2⤵
  PID:6488
- C:\Windows\System\aKEpIbu.exe
  C:\Windows\System\aKEpIbu.exe
  2⤵
  PID:6680
- C:\Windows\System\OajGvlY.exe
  C:\Windows\System\OajGvlY.exe
  2⤵
  PID:6860
- C:\Windows\System\SiDHsJZ.exe
  C:\Windows\System\SiDHsJZ.exe
  2⤵
  PID:5664
- C:\Windows\System\qroqFsH.exe
  C:\Windows\System\qroqFsH.exe
  2⤵
  PID:6476
- C:\Windows\System\XhXxvGb.exe
  C:\Windows\System\XhXxvGb.exe
  2⤵
  PID:6764
- C:\Windows\System\qOXmyyo.exe
  C:\Windows\System\qOXmyyo.exe
  2⤵
  PID:5820
- C:\Windows\System\YnaRgyI.exe
  C:\Windows\System\YnaRgyI.exe
  2⤵
  PID:5984
- C:\Windows\System\EGrtJyv.exe
  C:\Windows\System\EGrtJyv.exe
  2⤵
  PID:6620
- C:\Windows\System\PwBchLv.exe
  C:\Windows\System\PwBchLv.exe
  2⤵
  PID:5260
- C:\Windows\System\aawufwx.exe
  C:\Windows\System\aawufwx.exe
  2⤵
  PID:6668
- C:\Windows\System\vfcTvKK.exe
  C:\Windows\System\vfcTvKK.exe
  2⤵
  PID:5468
- C:\Windows\System\QTOyUxm.exe
  C:\Windows\System\QTOyUxm.exe
  2⤵
  PID:6940
- C:\Windows\System\HpEiFDn.exe
  C:\Windows\System\HpEiFDn.exe
  2⤵
  PID:6228
- C:\Windows\System\uPqpNzE.exe
  C:\Windows\System\uPqpNzE.exe
  2⤵
  PID:6716
- C:\Windows\System\Nppnwsn.exe
  C:\Windows\System\Nppnwsn.exe
  2⤵
  PID:7148
- C:\Windows\System\xwmWGuf.exe
  C:\Windows\System\xwmWGuf.exe
  2⤵
  PID:7104
- C:\Windows\System\wVYEcey.exe
  C:\Windows\System\wVYEcey.exe
  2⤵
  PID:5372
- C:\Windows\System\qGmfwOO.exe
  C:\Windows\System\qGmfwOO.exe
  2⤵
  PID:6308
- C:\Windows\System\PloQFbJ.exe
  C:\Windows\System\PloQFbJ.exe
  2⤵
  PID:7048
- C:\Windows\System\aoJsOPS.exe
  C:\Windows\System\aoJsOPS.exe
  2⤵
  PID:7184
- C:\Windows\System\uZYhbIQ.exe
  C:\Windows\System\uZYhbIQ.exe
  2⤵
  PID:7200
- C:\Windows\System\hMgtETr.exe
  C:\Windows\System\hMgtETr.exe
  2⤵
  PID:7216
- C:\Windows\System\AGlAGfX.exe
  C:\Windows\System\AGlAGfX.exe
  2⤵
  PID:7232
- C:\Windows\System\FMoUoGd.exe
  C:\Windows\System\FMoUoGd.exe
  2⤵
  PID:7248
- C:\Windows\System\HAmgDyf.exe
  C:\Windows\System\HAmgDyf.exe
  2⤵
  PID:7264
- C:\Windows\System\BqemRSK.exe
  C:\Windows\System\BqemRSK.exe
  2⤵
  PID:7280
- C:\Windows\System\etKoKpr.exe
  C:\Windows\System\etKoKpr.exe
  2⤵
  PID:7296
- C:\Windows\System\NOlFDMa.exe
  C:\Windows\System\NOlFDMa.exe
  2⤵
  PID:7312
- C:\Windows\System\jHfcvlM.exe
  C:\Windows\System\jHfcvlM.exe
  2⤵
  PID:7328
- C:\Windows\System\xiVaYgf.exe
  C:\Windows\System\xiVaYgf.exe
  2⤵
  PID:7348
- C:\Windows\System\GkxGjAV.exe
  C:\Windows\System\GkxGjAV.exe
  2⤵
  PID:7364
- C:\Windows\System\rtNBCSo.exe
  C:\Windows\System\rtNBCSo.exe
  2⤵
  PID:7380
- C:\Windows\System\sXWOvVg.exe
  C:\Windows\System\sXWOvVg.exe
  2⤵
  PID:7396
- C:\Windows\System\qmxFXBe.exe
  C:\Windows\System\qmxFXBe.exe
  2⤵
  PID:7412
- C:\Windows\System\HiLzAJe.exe
  C:\Windows\System\HiLzAJe.exe
  2⤵
  PID:7428
- C:\Windows\System\HWePkFi.exe
  C:\Windows\System\HWePkFi.exe
  2⤵
  PID:7444
- C:\Windows\System\mTtHnLG.exe
  C:\Windows\System\mTtHnLG.exe
  2⤵
  PID:7460
- C:\Windows\System\WGQcgrQ.exe
  C:\Windows\System\WGQcgrQ.exe
  2⤵
  PID:7476
- C:\Windows\System\yyBTSmN.exe
  C:\Windows\System\yyBTSmN.exe
  2⤵
  PID:7492
- C:\Windows\System\OZVuarX.exe
  C:\Windows\System\OZVuarX.exe
  2⤵
  PID:7508
- C:\Windows\System\wvgwVVW.exe
  C:\Windows\System\wvgwVVW.exe
  2⤵
  PID:7524
- C:\Windows\System\fZPkSse.exe
  C:\Windows\System\fZPkSse.exe
  2⤵
  PID:7540
- C:\Windows\System\ypRGlUK.exe
  C:\Windows\System\ypRGlUK.exe
  2⤵
  PID:7556
- C:\Windows\System\elnhkYv.exe
  C:\Windows\System\elnhkYv.exe
  2⤵
  PID:7572
- C:\Windows\System\qhAjwaW.exe
  C:\Windows\System\qhAjwaW.exe
  2⤵
  PID:7588
- C:\Windows\System\jwGtndD.exe
  C:\Windows\System\jwGtndD.exe
  2⤵
  PID:7604
- C:\Windows\System\asZinZZ.exe
  C:\Windows\System\asZinZZ.exe
  2⤵
  PID:7620
- C:\Windows\System\CXMYqTg.exe
  C:\Windows\System\CXMYqTg.exe
  2⤵
  PID:7636
- C:\Windows\System\gxDwPUN.exe
  C:\Windows\System\gxDwPUN.exe
  2⤵
  PID:7652
- C:\Windows\System\qyxBbqN.exe
  C:\Windows\System\qyxBbqN.exe
  2⤵
  PID:7668
- C:\Windows\System\UlQunzK.exe
  C:\Windows\System\UlQunzK.exe
  2⤵
  PID:7684
- C:\Windows\System\htIXRAa.exe
  C:\Windows\System\htIXRAa.exe
  2⤵
  PID:7700
- C:\Windows\System\YgiyhrE.exe
  C:\Windows\System\YgiyhrE.exe
  2⤵
  PID:7716
- C:\Windows\System\thgkAuu.exe
  C:\Windows\System\thgkAuu.exe
  2⤵
  PID:7732
- C:\Windows\System\oNInDUE.exe
  C:\Windows\System\oNInDUE.exe
  2⤵
  PID:7748
- C:\Windows\System\AgwEHpL.exe
  C:\Windows\System\AgwEHpL.exe
  2⤵
  PID:7764
- C:\Windows\System\tYywgPz.exe
  C:\Windows\System\tYywgPz.exe
  2⤵
  PID:7780
- C:\Windows\System\voaInVM.exe
  C:\Windows\System\voaInVM.exe
  2⤵
  PID:7796
- C:\Windows\System\okTKKWs.exe
  C:\Windows\System\okTKKWs.exe
  2⤵
  PID:7812
- C:\Windows\System\JcFILoU.exe
  C:\Windows\System\JcFILoU.exe
  2⤵
  PID:7828
- C:\Windows\System\QaWUKgq.exe
  C:\Windows\System\QaWUKgq.exe
  2⤵
  PID:7844
- C:\Windows\System\ksqwGon.exe
  C:\Windows\System\ksqwGon.exe
  2⤵
  PID:7860
- C:\Windows\System\JGmJQyN.exe
  C:\Windows\System\JGmJQyN.exe
  2⤵
  PID:7876
- C:\Windows\System\fQLJPGd.exe
  C:\Windows\System\fQLJPGd.exe
  2⤵
  PID:7892
- C:\Windows\System\KWrOCwc.exe
  C:\Windows\System\KWrOCwc.exe
  2⤵
  PID:7908
- C:\Windows\System\vyCOxbj.exe
  C:\Windows\System\vyCOxbj.exe
  2⤵
  PID:7924
- C:\Windows\System\YBiyAZj.exe
  C:\Windows\System\YBiyAZj.exe
  2⤵
  PID:7940
- C:\Windows\System\LpswiQi.exe
  C:\Windows\System\LpswiQi.exe
  2⤵
  PID:7956
- C:\Windows\System\dVJldOw.exe
  C:\Windows\System\dVJldOw.exe
  2⤵
  PID:7972
- C:\Windows\System\LXjMoVO.exe
  C:\Windows\System\LXjMoVO.exe
  2⤵
  PID:8088
- C:\Windows\System\pUuNqOB.exe
  C:\Windows\System\pUuNqOB.exe
  2⤵
  PID:8128
- C:\Windows\System\mExwIfx.exe
  C:\Windows\System\mExwIfx.exe
  2⤵
  PID:8152
- C:\Windows\System\RwSnrEI.exe
  C:\Windows\System\RwSnrEI.exe
  2⤵
  PID:8168
- C:\Windows\System\TuZTfAr.exe
  C:\Windows\System\TuZTfAr.exe
  2⤵
  PID:7208
- C:\Windows\System\uoqqSPy.exe
  C:\Windows\System\uoqqSPy.exe
  2⤵
  PID:2660
- C:\Windows\System\XOaUtUs.exe
  C:\Windows\System\XOaUtUs.exe
  2⤵
  PID:7324
- C:\Windows\System\TCKcfVJ.exe
  C:\Windows\System\TCKcfVJ.exe
  2⤵
  PID:7388
- C:\Windows\System\pwWFTQN.exe
  C:\Windows\System\pwWFTQN.exe
  2⤵
  PID:7452
- C:\Windows\System\bFiHgTK.exe
  C:\Windows\System\bFiHgTK.exe
  2⤵
  PID:7488
- C:\Windows\System\bmYxyDA.exe
  C:\Windows\System\bmYxyDA.exe
  2⤵
  PID:7580
- C:\Windows\System\qApFoVg.exe
  C:\Windows\System\qApFoVg.exe
  2⤵
  PID:7644
- C:\Windows\System\GcghhkV.exe
  C:\Windows\System\GcghhkV.exe
  2⤵
  PID:7708
- C:\Windows\System\bxPNMPm.exe
  C:\Windows\System\bxPNMPm.exe
  2⤵
  PID:7772
- C:\Windows\System\gMlAWVQ.exe
  C:\Windows\System\gMlAWVQ.exe
  2⤵
  PID:7836
- C:\Windows\System\YVLaeOD.exe
  C:\Windows\System\YVLaeOD.exe
  2⤵
  PID:7900
- C:\Windows\System\TJTyLkg.exe
  C:\Windows\System\TJTyLkg.exe
  2⤵
  PID:7964
- C:\Windows\System\iNrTxMT.exe
  C:\Windows\System\iNrTxMT.exe
  2⤵
  PID:7596
- C:\Windows\System\CSsnmRx.exe
  C:\Windows\System\CSsnmRx.exe
  2⤵
  PID:7724
- C:\Windows\System\rcDnVrY.exe
  C:\Windows\System\rcDnVrY.exe
  2⤵
  PID:7856
- C:\Windows\System\hFPNRvw.exe
  C:\Windows\System\hFPNRvw.exe
  2⤵
  PID:7920
- C:\Windows\System\FbikfZf.exe
  C:\Windows\System\FbikfZf.exe
  2⤵
  PID:7536
- C:\Windows\System\hPSoSUm.exe
  C:\Windows\System\hPSoSUm.exe
  2⤵
  PID:7276
- C:\Windows\System\RyFjUvW.exe
  C:\Windows\System\RyFjUvW.exe
  2⤵
  PID:7344
- C:\Windows\System\nUZnFcB.exe
  C:\Windows\System\nUZnFcB.exe
  2⤵
  PID:7436
- C:\Windows\System\XAXYcHN.exe
  C:\Windows\System\XAXYcHN.exe
  2⤵
  PID:7564
- C:\Windows\System\dRDCDRu.exe
  C:\Windows\System\dRDCDRu.exe
  2⤵
  PID:7692
- C:\Windows\System\uTxIjUH.exe
  C:\Windows\System\uTxIjUH.exe
  2⤵
  PID:7824
- C:\Windows\System\lfZLEFi.exe
  C:\Windows\System\lfZLEFi.exe
  2⤵
  PID:6876
- C:\Windows\System\neeUTfx.exe
  C:\Windows\System\neeUTfx.exe
  2⤵
  PID:8000
- C:\Windows\System\lnfJTzO.exe
  C:\Windows\System\lnfJTzO.exe
  2⤵
  PID:8016
- C:\Windows\System\oryfyqD.exe
  C:\Windows\System\oryfyqD.exe
  2⤵
  PID:8032
- C:\Windows\System\IzhmkkG.exe
  C:\Windows\System\IzhmkkG.exe
  2⤵
  PID:8048
- C:\Windows\System\qJSiQZt.exe
  C:\Windows\System\qJSiQZt.exe
  2⤵
  PID:8064
- C:\Windows\System\KIUPXOb.exe
  C:\Windows\System\KIUPXOb.exe
  2⤵
  PID:8080
- C:\Windows\System\RMupomC.exe
  C:\Windows\System\RMupomC.exe
  2⤵
  PID:8100
- C:\Windows\System\sZzAncn.exe
  C:\Windows\System\sZzAncn.exe
  2⤵
  PID:8104
- C:\Windows\System\EVqYJdn.exe
  C:\Windows\System\EVqYJdn.exe
  2⤵
  PID:8140
- C:\Windows\System\cDItBfc.exe
  C:\Windows\System\cDItBfc.exe
  2⤵
  PID:8180
- C:\Windows\System\sQPWlmC.exe
  C:\Windows\System\sQPWlmC.exe
  2⤵
  PID:6588
- C:\Windows\System\xYEcRpf.exe
  C:\Windows\System\xYEcRpf.exe
  2⤵
  PID:5224
- C:\Windows\System\VvCLSep.exe
  C:\Windows\System\VvCLSep.exe
  2⤵
  PID:4072
- C:\Windows\System\YoleQZe.exe
  C:\Windows\System\YoleQZe.exe
  2⤵
  PID:6328
- C:\Windows\System\DgwmJYw.exe
  C:\Windows\System\DgwmJYw.exe
  2⤵
  PID:6364
- C:\Windows\System\UYzwiLe.exe
  C:\Windows\System\UYzwiLe.exe
  2⤵
  PID:6864
- C:\Windows\System\feflBeh.exe
  C:\Windows\System\feflBeh.exe
  2⤵
  PID:6800
- C:\Windows\System\sWPQnjZ.exe
  C:\Windows\System\sWPQnjZ.exe
  2⤵
  PID:6920
- C:\Windows\System\DownOBb.exe
  C:\Windows\System\DownOBb.exe
  2⤵
  PID:6848
- C:\Windows\System\EFDtGYI.exe
  C:\Windows\System\EFDtGYI.exe
  2⤵
  PID:7244
- C:\Windows\System\xSLcenH.exe
  C:\Windows\System\xSLcenH.exe
  2⤵
  PID:7320
- C:\Windows\System\cfFhtWZ.exe
  C:\Windows\System\cfFhtWZ.exe
  2⤵
  PID:7616
- C:\Windows\System\ZtECWKj.exe
  C:\Windows\System\ZtECWKj.exe
  2⤵
  PID:7292
- C:\Windows\System\DmaTsyu.exe
  C:\Windows\System\DmaTsyu.exe
  2⤵
  PID:7552
- C:\Windows\System\bmbhouL.exe
  C:\Windows\System\bmbhouL.exe
  2⤵
  PID:7804
- C:\Windows\System\soAaBDz.exe
  C:\Windows\System\soAaBDz.exe
  2⤵
  PID:7532
- C:\Windows\System\ROpVKDa.exe
  C:\Windows\System\ROpVKDa.exe
  2⤵
  PID:7756
- C:\Windows\System\VgAqYzE.exe
  C:\Windows\System\VgAqYzE.exe
  2⤵
  PID:7336
- C:\Windows\System\cyUrLSy.exe
  C:\Windows\System\cyUrLSy.exe
  2⤵
  PID:7820
- C:\Windows\System\FfHmBYf.exe
  C:\Windows\System\FfHmBYf.exe
  2⤵
  PID:8056
- C:\Windows\System\pPNhpEQ.exe
  C:\Windows\System\pPNhpEQ.exe
  2⤵
  PID:7984
- C:\Windows\System\pAOBRSN.exe
  C:\Windows\System\pAOBRSN.exe
  2⤵
  PID:7916
- C:\Windows\System\qVjlTCE.exe
  C:\Windows\System\qVjlTCE.exe
  2⤵
  PID:7404
- C:\Windows\System\OSBSPHb.exe
  C:\Windows\System\OSBSPHb.exe
  2⤵
  PID:7952
- C:\Windows\System\PwwNNZA.exe
  C:\Windows\System\PwwNNZA.exe
  2⤵
  PID:8044
- C:\Windows\System\WBoKePF.exe
  C:\Windows\System\WBoKePF.exe
  2⤵
  PID:8120
- C:\Windows\System\pxSbIZk.exe
  C:\Windows\System\pxSbIZk.exe
  2⤵
  PID:8188
- C:\Windows\System\ocdrMcP.exe
  C:\Windows\System\ocdrMcP.exe
  2⤵
  PID:7196
- C:\Windows\System\qDCDugT.exe
  C:\Windows\System\qDCDugT.exe
  2⤵
  PID:7028
- C:\Windows\System\MhIOpIA.exe
  C:\Windows\System\MhIOpIA.exe
  2⤵
  PID:5432
- C:\Windows\System\tcCEDzT.exe
  C:\Windows\System\tcCEDzT.exe
  2⤵
  PID:6288
- C:\Windows\System\Yqhmviw.exe
  C:\Windows\System\Yqhmviw.exe
  2⤵
  PID:2504
- C:\Windows\System\fSqgUqm.exe
  C:\Windows\System\fSqgUqm.exe
  2⤵
  PID:7676
- C:\Windows\System\TGZStwA.exe
  C:\Windows\System\TGZStwA.exe
  2⤵
  PID:7308
- C:\Windows\System\YQDJplD.exe
  C:\Windows\System\YQDJplD.exe
  2⤵
  PID:8028
- C:\Windows\System\JFrDGUp.exe
  C:\Windows\System\JFrDGUp.exe
  2⤵
  PID:7272
- C:\Windows\System\TQWTGyk.exe
  C:\Windows\System\TQWTGyk.exe
  2⤵
  PID:7180
- C:\Windows\System\mLHeQSD.exe
  C:\Windows\System\mLHeQSD.exe
  2⤵
  PID:7472
- C:\Windows\System\kDHNNbH.exe
  C:\Windows\System\kDHNNbH.exe
  2⤵
  PID:8060
- C:\Windows\System\VhMuFOh.exe
  C:\Windows\System\VhMuFOh.exe
  2⤵
  PID:7632
- C:\Windows\System\kYRuYVO.exe
  C:\Windows\System\kYRuYVO.exe
  2⤵
  PID:7084
- C:\Windows\System\UiTcvjf.exe
  C:\Windows\System\UiTcvjf.exe
  2⤵
  PID:6376
- C:\Windows\System\vcZTYfs.exe
  C:\Windows\System\vcZTYfs.exe
  2⤵
  PID:7240
- C:\Windows\System\VGyOsJV.exe
  C:\Windows\System\VGyOsJV.exe
  2⤵
  PID:7612
- C:\Windows\System\iHTTrdL.exe
  C:\Windows\System\iHTTrdL.exe
  2⤵
  PID:7628
- C:\Windows\System\GeWILAy.exe
  C:\Windows\System\GeWILAy.exe
  2⤵
  PID:8164
- C:\Windows\System\WfkmdRi.exe
  C:\Windows\System\WfkmdRi.exe
  2⤵
  PID:8012
- C:\Windows\System\TBXtNGd.exe
  C:\Windows\System\TBXtNGd.exe
  2⤵
  PID:5668
- C:\Windows\System\HfpyIBT.exe
  C:\Windows\System\HfpyIBT.exe
  2⤵
  PID:7872
- C:\Windows\System\HOwEfWQ.exe
  C:\Windows\System\HOwEfWQ.exe
  2⤵
  PID:7520
- C:\Windows\System\XdpPNAz.exe
  C:\Windows\System\XdpPNAz.exe
  2⤵
  PID:8096
- C:\Windows\System\zHjzufU.exe
  C:\Windows\System\zHjzufU.exe
  2⤵
  PID:8204
- C:\Windows\System\GoOvdoE.exe
  C:\Windows\System\GoOvdoE.exe
  2⤵
  PID:8220
- C:\Windows\System\tOWfEZv.exe
  C:\Windows\System\tOWfEZv.exe
  2⤵
  PID:8236
- C:\Windows\System\QcYlRWo.exe
  C:\Windows\System\QcYlRWo.exe
  2⤵
  PID:8252
- C:\Windows\System\iBToXrI.exe
  C:\Windows\System\iBToXrI.exe
  2⤵
  PID:8268
- C:\Windows\System\SQIGYWb.exe
  C:\Windows\System\SQIGYWb.exe
  2⤵
  PID:8284
- C:\Windows\System\YVpVAbD.exe
  C:\Windows\System\YVpVAbD.exe
  2⤵
  PID:8304
- C:\Windows\System\dckemif.exe
  C:\Windows\System\dckemif.exe
  2⤵
  PID:8320
- C:\Windows\System\PxJYDZq.exe
  C:\Windows\System\PxJYDZq.exe
  2⤵
  PID:8336
- C:\Windows\System\whsDPtf.exe
  C:\Windows\System\whsDPtf.exe
  2⤵
  PID:8352
- C:\Windows\System\bCozjpY.exe
  C:\Windows\System\bCozjpY.exe
  2⤵
  PID:8368
- C:\Windows\System\TEMtUun.exe
  C:\Windows\System\TEMtUun.exe
  2⤵
  PID:8384
- C:\Windows\System\xANXjUr.exe
  C:\Windows\System\xANXjUr.exe
  2⤵
  PID:8400
- C:\Windows\System\noIgxCR.exe
  C:\Windows\System\noIgxCR.exe
  2⤵
  PID:8416
- C:\Windows\System\uoFbAgt.exe
  C:\Windows\System\uoFbAgt.exe
  2⤵
  PID:8432
- C:\Windows\System\vODmVBz.exe
  C:\Windows\System\vODmVBz.exe
  2⤵
  PID:8448
- C:\Windows\System\fGDgYSG.exe
  C:\Windows\System\fGDgYSG.exe
  2⤵
  PID:8464
- C:\Windows\System\BjEsZWs.exe
  C:\Windows\System\BjEsZWs.exe
  2⤵
  PID:8480
- C:\Windows\System\ScUqxXm.exe
  C:\Windows\System\ScUqxXm.exe
  2⤵
  PID:8496
- C:\Windows\System\SNErOkA.exe
  C:\Windows\System\SNErOkA.exe
  2⤵
  PID:8512
- C:\Windows\System\aaqbxhG.exe
  C:\Windows\System\aaqbxhG.exe
  2⤵
  PID:8532
- C:\Windows\System\WapjBMu.exe
  C:\Windows\System\WapjBMu.exe
  2⤵
  PID:8548
- C:\Windows\System\ryafoZU.exe
  C:\Windows\System\ryafoZU.exe
  2⤵
  PID:8564
- C:\Windows\System\pPjzmeX.exe
  C:\Windows\System\pPjzmeX.exe
  2⤵
  PID:8580
- C:\Windows\System\hILiaoa.exe
  C:\Windows\System\hILiaoa.exe
  2⤵
  PID:8596
- C:\Windows\System\vKChUAp.exe
  C:\Windows\System\vKChUAp.exe
  2⤵
  PID:8612
- C:\Windows\System\tGsZjjg.exe
  C:\Windows\System\tGsZjjg.exe
  2⤵
  PID:8628
- C:\Windows\System\ARzHwCy.exe
  C:\Windows\System\ARzHwCy.exe
  2⤵
  PID:8644
- C:\Windows\System\xvjixpc.exe
  C:\Windows\System\xvjixpc.exe
  2⤵
  PID:8660
- C:\Windows\System\dcdJVzJ.exe
  C:\Windows\System\dcdJVzJ.exe
  2⤵
  PID:8676
- C:\Windows\System\BAdSOMW.exe
  C:\Windows\System\BAdSOMW.exe
  2⤵
  PID:8692
- C:\Windows\System\aTNnyZF.exe
  C:\Windows\System\aTNnyZF.exe
  2⤵
  PID:8708
- C:\Windows\System\fgKeRXQ.exe
  C:\Windows\System\fgKeRXQ.exe
  2⤵
  PID:8724
- C:\Windows\System\LrmMNdG.exe
  C:\Windows\System\LrmMNdG.exe
  2⤵
  PID:8740
- C:\Windows\System\LkIzcQn.exe
  C:\Windows\System\LkIzcQn.exe
  2⤵
  PID:8756
- C:\Windows\System\ZMhTojw.exe
  C:\Windows\System\ZMhTojw.exe
  2⤵
  PID:8772
- C:\Windows\System\QoZixkh.exe
  C:\Windows\System\QoZixkh.exe
  2⤵
  PID:8788
- C:\Windows\System\RxJXAhw.exe
  C:\Windows\System\RxJXAhw.exe
  2⤵
  PID:8804
- C:\Windows\System\EXkGAnz.exe
  C:\Windows\System\EXkGAnz.exe
  2⤵
  PID:8820
- C:\Windows\System\ISZhKhN.exe
  C:\Windows\System\ISZhKhN.exe
  2⤵
  PID:8836
- C:\Windows\System\rDPpYOY.exe
  C:\Windows\System\rDPpYOY.exe
  2⤵
  PID:8852
- C:\Windows\System\pXusZvb.exe
  C:\Windows\System\pXusZvb.exe
  2⤵
  PID:8868
- C:\Windows\System\jFUpqFU.exe
  C:\Windows\System\jFUpqFU.exe
  2⤵
  PID:8884
- C:\Windows\System\EezBfQS.exe
  C:\Windows\System\EezBfQS.exe
  2⤵
  PID:8900
- C:\Windows\System\ASTmeCJ.exe
  C:\Windows\System\ASTmeCJ.exe
  2⤵
  PID:8916
- C:\Windows\System\EwUUskf.exe
  C:\Windows\System\EwUUskf.exe
  2⤵
  PID:8932
- C:\Windows\System\kxIEhFd.exe
  C:\Windows\System\kxIEhFd.exe
  2⤵
  PID:8948
- C:\Windows\System\HLQMWBN.exe
  C:\Windows\System\HLQMWBN.exe
  2⤵
  PID:8964
- C:\Windows\System\ZPMssqm.exe
  C:\Windows\System\ZPMssqm.exe
  2⤵
  PID:8980
- C:\Windows\System\KPLSfJF.exe
  C:\Windows\System\KPLSfJF.exe
  2⤵
  PID:8996
- C:\Windows\System\SYNuJlF.exe
  C:\Windows\System\SYNuJlF.exe
  2⤵
  PID:9012
- C:\Windows\System\hcIZhcD.exe
  C:\Windows\System\hcIZhcD.exe
  2⤵
  PID:9028
- C:\Windows\System\dmXFKJS.exe
  C:\Windows\System\dmXFKJS.exe
  2⤵
  PID:9044
- C:\Windows\System\vGElFvx.exe
  C:\Windows\System\vGElFvx.exe
  2⤵
  PID:9060
- C:\Windows\System\kfKPMJM.exe
  C:\Windows\System\kfKPMJM.exe
  2⤵
  PID:9076
- C:\Windows\System\SvKIcIs.exe
  C:\Windows\System\SvKIcIs.exe
  2⤵
  PID:9092
- C:\Windows\System\oAJIQMw.exe
  C:\Windows\System\oAJIQMw.exe
  2⤵
  PID:9108
- C:\Windows\System\oTeYhmk.exe
  C:\Windows\System\oTeYhmk.exe
  2⤵
  PID:9124
- C:\Windows\System\btjNklM.exe
  C:\Windows\System\btjNklM.exe
  2⤵
  PID:9140
- C:\Windows\System\KeUkbhV.exe
  C:\Windows\System\KeUkbhV.exe
  2⤵
  PID:9156
- C:\Windows\System\LTPPlrI.exe
  C:\Windows\System\LTPPlrI.exe
  2⤵
  PID:9176
- C:\Windows\System\XaaTCDQ.exe
  C:\Windows\System\XaaTCDQ.exe
  2⤵
  PID:9192
- C:\Windows\System\CgfuJKR.exe
  C:\Windows\System\CgfuJKR.exe
  2⤵
  PID:9208
- C:\Windows\System\qBGraUL.exe
  C:\Windows\System\qBGraUL.exe
  2⤵
  PID:7176
- C:\Windows\System\pfUbjmh.exe
  C:\Windows\System\pfUbjmh.exe
  2⤵
  PID:8216
- C:\Windows\System\ogksXLX.exe
  C:\Windows\System\ogksXLX.exe
  2⤵
  PID:8280
- C:\Windows\System\SCMTSCi.exe
  C:\Windows\System\SCMTSCi.exe
  2⤵
  PID:7468
- C:\Windows\System\qzjUuEO.exe
  C:\Windows\System\qzjUuEO.exe
  2⤵
  PID:8200
- C:\Windows\System\FHyInhH.exe
  C:\Windows\System\FHyInhH.exe
  2⤵
  PID:8264
- C:\Windows\System\BUrUsuO.exe
  C:\Windows\System\BUrUsuO.exe
  2⤵
  PID:8344
- C:\Windows\System\cHUFhox.exe
  C:\Windows\System\cHUFhox.exe
  2⤵
  PID:8364
- C:\Windows\System\Lvhctue.exe
  C:\Windows\System\Lvhctue.exe
  2⤵
  PID:8408
- C:\Windows\System\oBMLmJN.exe
  C:\Windows\System\oBMLmJN.exe
  2⤵
  PID:8440
- C:\Windows\System\DbCPiey.exe
  C:\Windows\System\DbCPiey.exe
  2⤵
  PID:8472
- C:\Windows\System\pWjtZZx.exe
  C:\Windows\System\pWjtZZx.exe
  2⤵
  PID:8544
- C:\Windows\System\DRpGhva.exe
  C:\Windows\System\DRpGhva.exe
  2⤵
  PID:8608
- C:\Windows\System\gWJtaTb.exe
  C:\Windows\System\gWJtaTb.exe
  2⤵
  PID:8672
- C:\Windows\System\qrSlIeM.exe
  C:\Windows\System\qrSlIeM.exe
  2⤵
  PID:8736
- C:\Windows\System\mAKEktA.exe
  C:\Windows\System\mAKEktA.exe
  2⤵
  PID:8800
- C:\Windows\System\DWnxNeW.exe
  C:\Windows\System\DWnxNeW.exe
  2⤵
  PID:8492
- C:\Windows\System\zrSVcET.exe
  C:\Windows\System\zrSVcET.exe
  2⤵
  PID:8488
- C:\Windows\System\NjxTRze.exe
  C:\Windows\System\NjxTRze.exe
  2⤵
  PID:8520
- C:\Windows\System\BnygOgV.exe
  C:\Windows\System\BnygOgV.exe
  2⤵
  PID:8620
- C:\Windows\System\VnLAxPi.exe
  C:\Windows\System\VnLAxPi.exe
  2⤵
  PID:8652
- C:\Windows\System\fPNerhV.exe
  C:\Windows\System\fPNerhV.exe
  2⤵
  PID:8892
- C:\Windows\System\iTDeXrA.exe
  C:\Windows\System\iTDeXrA.exe
  2⤵
  PID:8956
- C:\Windows\System\sHRbjcl.exe
  C:\Windows\System\sHRbjcl.exe
  2⤵
  PID:8752
- C:\Windows\System\LomSCyJ.exe
  C:\Windows\System\LomSCyJ.exe
  2⤵
  PID:9020
- C:\Windows\System\aPbVphL.exe
  C:\Windows\System\aPbVphL.exe
  2⤵
  PID:9056
- C:\Windows\System\UYMVzXU.exe
  C:\Windows\System\UYMVzXU.exe
  2⤵
  PID:8816
- C:\Windows\System\uADSJlN.exe
  C:\Windows\System\uADSJlN.exe
  2⤵
  PID:9120
- C:\Windows\System\ByORjqF.exe
  C:\Windows\System\ByORjqF.exe
  2⤵
  PID:9184
- C:\Windows\System\hrRqBty.exe
  C:\Windows\System\hrRqBty.exe
  2⤵
  PID:8908
- C:\Windows\System\HEDUbvY.exe
  C:\Windows\System\HEDUbvY.exe
  2⤵
  PID:9004
- C:\Windows\System\noCnJju.exe
  C:\Windows\System\noCnJju.exe
  2⤵
  PID:9008
- C:\Windows\System\yHWkuSl.exe
  C:\Windows\System\yHWkuSl.exe
  2⤵
  PID:9104
- C:\Windows\System\pvKuAVq.exe
  C:\Windows\System\pvKuAVq.exe
  2⤵
  PID:9200
- C:\Windows\System\zfDRlJt.exe
  C:\Windows\System\zfDRlJt.exe
  2⤵
  PID:8276
- C:\Windows\System\SmvsCDx.exe
  C:\Windows\System\SmvsCDx.exe
  2⤵
  PID:8328
- C:\Windows\System\pZdYErJ.exe
  C:\Windows\System\pZdYErJ.exe
  2⤵
  PID:8476
- C:\Windows\System\hiArsoF.exe
  C:\Windows\System\hiArsoF.exe
  2⤵
  PID:8732
- C:\Windows\System\FDTxBcP.exe
  C:\Windows\System\FDTxBcP.exe
  2⤵
  PID:8812
- C:\Windows\System\UBPvXKV.exe
  C:\Windows\System\UBPvXKV.exe
  2⤵
  PID:8928
- C:\Windows\System\JDEReon.exe
  C:\Windows\System\JDEReon.exe
  2⤵
  PID:9088
- C:\Windows\System\KovCebp.exe
  C:\Windows\System\KovCebp.exe
  2⤵
  PID:8944
- C:\Windows\System\qmJqSDQ.exe
  C:\Windows\System\qmJqSDQ.exe
  2⤵
  PID:8040
- C:\Windows\System\CUCrepF.exe
  C:\Windows\System\CUCrepF.exe
  2⤵
  PID:8312
- C:\Windows\System\ptSNude.exe
  C:\Windows\System\ptSNude.exe
  2⤵
  PID:8504
- C:\Windows\System\ORhfdhM.exe
  C:\Windows\System\ORhfdhM.exe
  2⤵
  PID:8796
- C:\Windows\System\BjrrKOM.exe
  C:\Windows\System\BjrrKOM.exe
  2⤵
  PID:8360
- C:\Windows\System\fzfrNlb.exe
  C:\Windows\System\fzfrNlb.exe
  2⤵
  PID:8260
- C:\Windows\System\krcBZIJ.exe
  C:\Windows\System\krcBZIJ.exe
  2⤵
  PID:8748
- C:\Windows\System\RqqZscu.exe
  C:\Windows\System\RqqZscu.exe
  2⤵
  PID:8720
- C:\Windows\System\LCTCinI.exe
  C:\Windows\System\LCTCinI.exe
  2⤵
  PID:9148
- C:\Windows\System\woLxKQG.exe
  C:\Windows\System\woLxKQG.exe
  2⤵
  PID:8592
- C:\Windows\System\neQrblf.exe
  C:\Windows\System\neQrblf.exe
  2⤵
  PID:8540
- C:\Windows\System\TDVOyRO.exe
  C:\Windows\System\TDVOyRO.exe
  2⤵
  PID:8780
- C:\Windows\System\YhVAouD.exe
  C:\Windows\System\YhVAouD.exe
  2⤵
  PID:8560
- C:\Windows\System\OQoDhdi.exe
  C:\Windows\System\OQoDhdi.exe
  2⤵
  PID:9024
- C:\Windows\System\EaDCwXc.exe
  C:\Windows\System\EaDCwXc.exe
  2⤵
  PID:8844
- C:\Windows\System\AImxfQj.exe
  C:\Windows\System\AImxfQj.exe
  2⤵
  PID:9172
- C:\Windows\System\QGWvZpa.exe
  C:\Windows\System\QGWvZpa.exe
  2⤵
  PID:8396
- C:\Windows\System\qKFOHHJ.exe
  C:\Windows\System\qKFOHHJ.exe
  2⤵
  PID:8248
- C:\Windows\System\YuttbdX.exe
  C:\Windows\System\YuttbdX.exe
  2⤵
  PID:8212
- C:\Windows\System\egoyFqq.exe
  C:\Windows\System\egoyFqq.exe
  2⤵
  PID:8924
- C:\Windows\System\uQkIPRg.exe
  C:\Windows\System\uQkIPRg.exe
  2⤵
  PID:9164
- C:\Windows\System\kiCGkkw.exe
  C:\Windows\System\kiCGkkw.exe
  2⤵
  PID:8316
- C:\Windows\System\cFfFhmU.exe
  C:\Windows\System\cFfFhmU.exe
  2⤵
  PID:8576
- C:\Windows\System\UJfmsNK.exe
  C:\Windows\System\UJfmsNK.exe
  2⤵
  PID:8864
- C:\Windows\System\eJxFtcH.exe
  C:\Windows\System\eJxFtcH.exe
  2⤵
  PID:9228
- C:\Windows\System\UuNyDrq.exe
  C:\Windows\System\UuNyDrq.exe
  2⤵
  PID:9244
- C:\Windows\System\YJselTQ.exe
  C:\Windows\System\YJselTQ.exe
  2⤵
  PID:9260
- C:\Windows\System\rpuaoZg.exe
  C:\Windows\System\rpuaoZg.exe
  2⤵
  PID:9276
- C:\Windows\System\kOkRXBq.exe
  C:\Windows\System\kOkRXBq.exe
  2⤵
  PID:9292
- C:\Windows\System\plEyWwQ.exe
  C:\Windows\System\plEyWwQ.exe
  2⤵
  PID:9308
- C:\Windows\System\sSyqlQk.exe
  C:\Windows\System\sSyqlQk.exe
  2⤵
  PID:9328
- C:\Windows\System\WnoqTsM.exe
  C:\Windows\System\WnoqTsM.exe
  2⤵
  PID:9344
- C:\Windows\System\zRLUvNa.exe
  C:\Windows\System\zRLUvNa.exe
  2⤵
  PID:9360
- C:\Windows\System\UHwnmRt.exe
  C:\Windows\System\UHwnmRt.exe
  2⤵
  PID:9376
- C:\Windows\System\cgiFxsd.exe
  C:\Windows\System\cgiFxsd.exe
  2⤵
  PID:9392
- C:\Windows\System\KUZUuQx.exe
  C:\Windows\System\KUZUuQx.exe
  2⤵
  PID:9408
- C:\Windows\System\usyxyie.exe
  C:\Windows\System\usyxyie.exe
  2⤵
  PID:9424
- C:\Windows\System\xMjRALd.exe
  C:\Windows\System\xMjRALd.exe
  2⤵
  PID:9440
- C:\Windows\System\yBLixeu.exe
  C:\Windows\System\yBLixeu.exe
  2⤵
  PID:9456
- C:\Windows\System\vKjMaWT.exe
  C:\Windows\System\vKjMaWT.exe
  2⤵
  PID:9472
- C:\Windows\System\smlkKFB.exe
  C:\Windows\System\smlkKFB.exe
  2⤵
  PID:9488
- C:\Windows\System\VnJglFh.exe
  C:\Windows\System\VnJglFh.exe
  2⤵
  PID:9504
- C:\Windows\System\OCLELeo.exe
  C:\Windows\System\OCLELeo.exe
  2⤵
  PID:9520
- C:\Windows\System\XkTLzKd.exe
  C:\Windows\System\XkTLzKd.exe
  2⤵
  PID:9536
- C:\Windows\System\ndOgYRa.exe
  C:\Windows\System\ndOgYRa.exe
  2⤵
  PID:9552
- C:\Windows\System\PobrfhQ.exe
  C:\Windows\System\PobrfhQ.exe
  2⤵
  PID:9568
- C:\Windows\System\ElZPjQR.exe
  C:\Windows\System\ElZPjQR.exe
  2⤵
  PID:9584
- C:\Windows\System\gIdQnXQ.exe
  C:\Windows\System\gIdQnXQ.exe
  2⤵
  PID:9600
- C:\Windows\System\fmFaHdV.exe
  C:\Windows\System\fmFaHdV.exe
  2⤵
  PID:9616
- C:\Windows\System\VYRCqiW.exe
  C:\Windows\System\VYRCqiW.exe
  2⤵
  PID:9632
- C:\Windows\System\HWmBQCr.exe
  C:\Windows\System\HWmBQCr.exe
  2⤵
  PID:9648
- C:\Windows\System\TrXghyC.exe
  C:\Windows\System\TrXghyC.exe
  2⤵
  PID:9664
- C:\Windows\System\RKmSPvq.exe
  C:\Windows\System\RKmSPvq.exe
  2⤵
  PID:9680
- C:\Windows\System\JFzlkRo.exe
  C:\Windows\System\JFzlkRo.exe
  2⤵
  PID:9696
- C:\Windows\System\QMzeuAz.exe
  C:\Windows\System\QMzeuAz.exe
  2⤵
  PID:9712
- C:\Windows\System\hVfJawL.exe
  C:\Windows\System\hVfJawL.exe
  2⤵
  PID:9728
- C:\Windows\System\hMszyTy.exe
  C:\Windows\System\hMszyTy.exe
  2⤵
  PID:9744
- C:\Windows\System\KqsAWSu.exe
  C:\Windows\System\KqsAWSu.exe
  2⤵
  PID:9760
- C:\Windows\System\iQbYGYQ.exe
  C:\Windows\System\iQbYGYQ.exe
  2⤵
  PID:9776
- C:\Windows\System\QMvxbdn.exe
  C:\Windows\System\QMvxbdn.exe
  2⤵
  PID:9792
- C:\Windows\System\sYfZOEu.exe
  C:\Windows\System\sYfZOEu.exe
  2⤵
  PID:9808
- C:\Windows\System\bHygbaO.exe
  C:\Windows\System\bHygbaO.exe
  2⤵
  PID:9828
- C:\Windows\System\cEuuqBH.exe
  C:\Windows\System\cEuuqBH.exe
  2⤵
  PID:9844
- C:\Windows\System\zvYLape.exe
  C:\Windows\System\zvYLape.exe
  2⤵
  PID:9860
- C:\Windows\System\WuYlCRc.exe
  C:\Windows\System\WuYlCRc.exe
  2⤵
  PID:9876
- C:\Windows\System\BoVsMKl.exe
  C:\Windows\System\BoVsMKl.exe
  2⤵
  PID:9892
- C:\Windows\System\ZLeMzaB.exe
  C:\Windows\System\ZLeMzaB.exe
  2⤵
  PID:9908
- C:\Windows\System\ItXttdp.exe
  C:\Windows\System\ItXttdp.exe
  2⤵
  PID:9924
- C:\Windows\System\glEVXYc.exe
  C:\Windows\System\glEVXYc.exe
  2⤵
  PID:9940
- C:\Windows\System\kVqndjb.exe
  C:\Windows\System\kVqndjb.exe
  2⤵
  PID:9956
- C:\Windows\System\xSYiPAm.exe
  C:\Windows\System\xSYiPAm.exe
  2⤵
  PID:9972
- C:\Windows\System\lwukMaS.exe
  C:\Windows\System\lwukMaS.exe
  2⤵
  PID:9988
- C:\Windows\System\IGanpmc.exe
  C:\Windows\System\IGanpmc.exe
  2⤵
  PID:10004
- C:\Windows\System\KKsHFSs.exe
  C:\Windows\System\KKsHFSs.exe
  2⤵
  PID:10020
- C:\Windows\System\mfcFFOX.exe
  C:\Windows\System\mfcFFOX.exe
  2⤵
  PID:10084
- C:\Windows\System\QUvjMoD.exe
  C:\Windows\System\QUvjMoD.exe
  2⤵
  PID:10100
- C:\Windows\System\JaDRClN.exe
  C:\Windows\System\JaDRClN.exe
  2⤵
  PID:10120
- C:\Windows\System\zpeALPu.exe
  C:\Windows\System\zpeALPu.exe
  2⤵
  PID:10184
- C:\Windows\System\UBPpJkn.exe
  C:\Windows\System\UBPpJkn.exe
  2⤵
  PID:10200
- C:\Windows\System\QfgVczG.exe
  C:\Windows\System\QfgVczG.exe
  2⤵
  PID:9256
- C:\Windows\System\bqlSNxG.exe
  C:\Windows\System\bqlSNxG.exe
  2⤵
  PID:8456
- C:\Windows\System\AxVGNom.exe
  C:\Windows\System\AxVGNom.exe
  2⤵
  PID:9340
- C:\Windows\System\uhopiRZ.exe
  C:\Windows\System\uhopiRZ.exe
  2⤵
  PID:9484
- C:\Windows\System\AmfzifZ.exe
  C:\Windows\System\AmfzifZ.exe
  2⤵
  PID:9400
- C:\Windows\System\Dftrarh.exe
  C:\Windows\System\Dftrarh.exe
  2⤵
  PID:9468
- C:\Windows\System\dQgmwZg.exe
  C:\Windows\System\dQgmwZg.exe
  2⤵
  PID:9436
- C:\Windows\System\bGELHCH.exe
  C:\Windows\System\bGELHCH.exe
  2⤵
  PID:9544
- C:\Windows\System\UubJOUD.exe
  C:\Windows\System\UubJOUD.exe
  2⤵
  PID:9528
- C:\Windows\System\aVursvo.exe
  C:\Windows\System\aVursvo.exe
  2⤵
  PID:9564
- C:\Windows\System\ujucrox.exe
  C:\Windows\System\ujucrox.exe
  2⤵
  PID:9624
- C:\Windows\System\PpSsTCG.exe
  C:\Windows\System\PpSsTCG.exe
  2⤵
  PID:8524
- C:\Windows\System\vvpVOva.exe
  C:\Windows\System\vvpVOva.exe
  2⤵
  PID:9676
- C:\Windows\System\VSnRpVJ.exe
  C:\Windows\System\VSnRpVJ.exe
  2⤵
  PID:9692
- C:\Windows\System\OTXJQJu.exe
  C:\Windows\System\OTXJQJu.exe
  2⤵
  PID:9720
- C:\Windows\System\PRGlBIm.exe
  C:\Windows\System\PRGlBIm.exe
  2⤵
  PID:9772
- C:\Windows\System\VzuMHEP.exe
  C:\Windows\System\VzuMHEP.exe
  2⤵
  PID:9840
- C:\Windows\System\zHkuojl.exe
  C:\Windows\System\zHkuojl.exe
  2⤵
  PID:9756
- C:\Windows\System\kLSnGmI.exe
  C:\Windows\System\kLSnGmI.exe
  2⤵
  PID:9752
- C:\Windows\System\tltsXto.exe
  C:\Windows\System\tltsXto.exe
  2⤵
  PID:9788
- C:\Windows\System\XOFVOfo.exe
  C:\Windows\System\XOFVOfo.exe
  2⤵
  PID:9856
- C:\Windows\System\ufEBCyV.exe
  C:\Windows\System\ufEBCyV.exe
  2⤵
  PID:9952
- C:\Windows\System\WVDYdQU.exe
  C:\Windows\System\WVDYdQU.exe
  2⤵
  PID:9996
- C:\Windows\System\EBCEqzZ.exe
  C:\Windows\System\EBCEqzZ.exe
  2⤵
  PID:10028
- C:\Windows\System\caWraQi.exe
  C:\Windows\System\caWraQi.exe
  2⤵
  PID:10032
- C:\Windows\System\aOcezRr.exe
  C:\Windows\System\aOcezRr.exe
  2⤵
  PID:10036
- C:\Windows\System\RmfkDVP.exe
  C:\Windows\System\RmfkDVP.exe
  2⤵
  PID:10056
- C:\Windows\System\bodPcFd.exe
  C:\Windows\System\bodPcFd.exe
  2⤵
  PID:10072
- C:\Windows\System\puRZTqL.exe
  C:\Windows\System\puRZTqL.exe
  2⤵
  PID:10144
- C:\Windows\System\UZDJTUs.exe
  C:\Windows\System\UZDJTUs.exe
  2⤵
  PID:9132
- C:\Windows\System\xFRxDzR.exe
  C:\Windows\System\xFRxDzR.exe
  2⤵
  PID:10232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BZUxDer.exe

Filesize
2.8MB

MD5
7c3776afa559ed70df74e693b097a468

SHA1
9dc6eb37036a763de1b8c6d597f7f99acea5818a

SHA256
f4fc36512c37492f5087abd53733c2905d600d7b0b531959bc61d00b81fbbe25

SHA512
2157c74376f3797a4f8262da2796f0269f63ab7cbdc877670e12ec3d0c82cceddf9f03d347e1dd4f6088191c964ba2a98b422b197a9c3a4ed2d0bad48b742661

Download Submit
C:\Windows\system\FFwdhnX.exe

Filesize
2.8MB

MD5
1c410fd7265d6e588568b3eb2c443611

SHA1
e392652632004ddd2f11b3a1a964daeda6e08932

SHA256
d5114648e2b8cba9e74ca505af1e9caed5f4440d1615fb065d351a4c4a60edeb

SHA512
9cffb84d403caf5c9083e01498ac03fbc47822b0ae6f4a89f4f7011f88e731b4512ada92d996dede8f9d80f809beba2e741e8ecdc47519b84166c0b67ab3a0c4

Download Submit
C:\Windows\system\FONxqdZ.exe

Filesize
2.8MB

MD5
45fd123597acea9c4f17ce958d5ea57c

SHA1
ee0e9bb4fa5e212b532a47fadcd74edcfe57e319

SHA256
d681a9ebea1a29f4634157f972bfc4a237290c8238029ec6e5ec7a782c16c412

SHA512
14cd796321c7a519cca2e2ff679174376f8f515227c35adcfdd729cf79c201c5b5cf85d421be1bd1e554d14b2ac2240a9d56e8b9a978e552593ca3d086d209f5

Download Submit
C:\Windows\system\KwFQrHl.exe

Filesize
2.8MB

MD5
b96702b7030dc8bd6f41ac6be5d9f5de

SHA1
afee419e3cc8127d103f0372b188ab898b9377f2

SHA256
275a6c2d5994aea8092dbfaa21d264ad7dbf85fa4bf366246091198498e19854

SHA512
e90ad4963cf0c9cbc3c757bc3608583d264ebba508e659db9e76e8714be6a869f9440a592d10b77bc1cbaa47db3803c09f0e9cda308ff783913d9729672babb7

Download Submit
C:\Windows\system\LmpfeZD.exe

Filesize
2.8MB

MD5
a2eda416472df276f1639936ccec280e

SHA1
73fc79da095ae77b614be990562e1481a509c484

SHA256
6a6b48c35732e92d268a84910853b72d2dd75fcc9d099bbf57fe5bb645576d7a

SHA512
c5403e3cf83e26e42c7341f1fd280e3eb799273c6faac0e0f90ebeaaacf8edbfe8ce697455256d957eea303babad81f46221cc699f161ad01b8b154681d9204a

Download Submit
C:\Windows\system\OpfyTBQ.exe

Filesize
2.8MB

MD5
25b0576916722e73f9e214651599275e

SHA1
d8109b332e9432311a9accb83c3cc1ca76081c52

SHA256
c96e838fad74c72d852d55c7c9ab2663e7dac577267615bf1b6018ddc4311bfd

SHA512
7663b08f98ffbd580c49d203b97e23fccaefb3aea21882e1fb176f0779d82e9ea9919644141a94f81b35349f0070a24035bc25f904754958c098cc01cbbcf9ed

Download Submit
C:\Windows\system\QVLSVop.exe

Filesize
2.8MB

MD5
cda7761f3659df8083b850a6b108b59a

SHA1
7103aa3428995d2c124af289223f712f93f2890e

SHA256
054b90caef3a3784c561a3b64a1e9ffcf5f3209d090b2a55b45a2b06506983b2

SHA512
fde8973e35d017249072309fdc558c42d3bb8fa1b0ea13d7ecc3826ceefe3a55f84017febd4dc46daf4238bb6fa1b3996de764b26627190e57ab97ccfe870475

Download Submit
C:\Windows\system\RoUWmzX.exe

Filesize
2.8MB

MD5
8bdb28b0b3d899b3093889f33bff9fc7

SHA1
771db2d655f1c120a4417ab24174503608af0d69

SHA256
7c88a19eda9dc577798f17153994b9f1f1e3663628aba75e20abe57866bfd8dd

SHA512
dd6557879be725559d953f0d96206ae6f440f4f140586142c5e181adb8205d42a8980840457ea52308f73e8bd378a107001ffccba25f6562ddaebc75aeb8dd21

Download Submit
C:\Windows\system\UnqUUSo.exe

Filesize
2.8MB

MD5
ec8a95934c434bcf974bc247e05c6835

SHA1
f8c446b0f86453efb8899294e8f9cccc65189eca

SHA256
5e374b0333a8a81ace91591a448b4999a18cd2af11df015cb13007719fc1f9e6

SHA512
33057ebc6da21b69dc5c83b5117ca1c96c82611d7deb2de49c6fe76e69870fc1e6e63fc3b16e8f8f39587d6c9a0ffc08f9c6e2b8e037ce8f597758d593c8dcc7

Download Submit
C:\Windows\system\YlLuItX.exe

Filesize
2.8MB

MD5
5b542298112a46e6947b39e4804fe9b7

SHA1
22a7d1b655bb559ea08feb5f317d02ef51782c16

SHA256
0d9c9cf54a8a4d1d3520471066fd94aab1db57fd3bc22e5273bd8f8703f7903b

SHA512
bda500b99a90c1b264159d24938ed46cda3443e5c4a4bbe359fb33f96d9de568f4a7ae1341e96f21af34a93318d18c7add3a723d3c60527283247fb5b6b8eb46

Download Submit
C:\Windows\system\diqlirr.exe

Filesize
2.8MB

MD5
49ffc04530720f6efc843255d1cbc41b

SHA1
a304874c539354e4e63a1208e9ed847383fcb28b

SHA256
4f64439f11597fc7c10bac6503037933b1729d661e72095299b0f35e4f655763

SHA512
6ca0f38e7f87f0f4f61bcf05974981ec02f3b868ad4fa3d8709a46a5a735d2b12f8cc56d425128ce09b77968b8d9df239d533058eb179dcb328d817c6e64bcf0

Download Submit
C:\Windows\system\fYQBvXA.exe

Filesize
2.8MB

MD5
1edadcc6573e419a1a75e58ffe91ed45

SHA1
8cf8fc4b26cac7061a7b0971556b218715897341

SHA256
3510bab224e5cd6b8614fbdf9c5356b5b6a3054555c9885d50d0739105459c81

SHA512
a5840db086ffe7cb79a54fa2e02f1babee9b68f32d7165e2990b3c016e65b7e0cb330da2a570879bbbbb18e5d57cf55401fed281b189c93bed2c93b25d44a0ba

Download Submit
C:\Windows\system\gpslDAs.exe

Filesize
2.8MB

MD5
ccf82cc53dbe95a4092750448996e1d0

SHA1
8274870b84761339b5474b725060ccc78cf2b9c0

SHA256
70146a338a2a5a8f40b6191d17dd0855aabd8442d1f82b330bf0e590fdb3b3fb

SHA512
1e4755debab7cd2c28b2dac5a07bfc25a953c1768db5c9fa813e1603f7c855a0cfa8995c3284a0e1bc26c161cba37fa481fdba8e5c5ba75a2f2f18c0117aa223

Download Submit
C:\Windows\system\jUBNiti.exe

Filesize
2.8MB

MD5
e6dba2703af9429dc952624cd929391c

SHA1
c741cfd4b2c44aee8ab93baeddc6b22df3a9c08b

SHA256
dcae7469ac5f4c64aa1400d1dac28700d925a51215bdb65c63a2728206fa77e1

SHA512
83b86cb0bcabc4f5d172eb2ff1442d3e3e1eb308a2dce168865c8b9d50b633c9e8f765839c1df67cee1af19161667d575506998b033b1c08823d4c92a4c1783e

Download Submit
C:\Windows\system\koykOiI.exe

Filesize
2.8MB

MD5
ff19fbc5ee0e2afc2c08f8fe5a57d9bf

SHA1
f94ff9dea9a4c86b5ea6c2f40370a05ed17147a8

SHA256
8de5149b35ad92d347e01162204fc9366c92e3546eb91499b3dc69f8589ca3ad

SHA512
c90edf663f80f01427da282e55c0a411b37dea499e4392bc4e3f3f40101ceefc4ce7d4b594538641b72b0e609fb08fe70ce2ee927c6318ffd7164c2d394c849e

Download Submit
C:\Windows\system\nouhKjd.exe

Filesize
2.8MB

MD5
4c83bd124616dd7d80857ddc52ca10e9

SHA1
b413db96ca26cd3f1e83a056451388d1733dc573

SHA256
b3975b505fda3b14b3f6a566d9d86dcc7154e0e2cd41a6987a0aad7c7913307e

SHA512
bf72a668e6880b7827b31da78d9ae2f8b039a5dac636f82c10a8b4eb05f6092994457847574c506cba60b493e38ad03dab5dcd3475f5452f295c3779aac74934

Download Submit
C:\Windows\system\qLqRnWb.exe

Filesize
2.8MB

MD5
3770eef318448b69937b80ceaa03a1ef

SHA1
dc52bdfbc56d440305d9d9ca6e3462155dae7adc

SHA256
2adc416b27da7859a49ab4beeeebb61bc8680acb26c605c386ccf8f76f675387

SHA512
fc0f6b0afc5ed28eca6ddf5e5ffa3b7f70e483beb16e1531f5aaa5c50f2ca57d06f7d224565b856ae82639a149be4a698088608b35fcf757071d4bd3377b3dd0

Download Submit
C:\Windows\system\rFzKFHo.exe

Filesize
2.8MB

MD5
678578dd8436d459caa983fcd91de698

SHA1
0b769d6dece8946f89fd94862e84bfe5811ad51f

SHA256
db5db33818a0a8c0e22fe80d44530486adeeef5b0d8ea963e2039e29fbb75613

SHA512
c994dcef6cda056a002d96b8bc84e880be64b15b4ea1ac5c438f79b288ada6e4362effa91c196c7dbbe406c37d0e1df2af1512a8c9ae8856ec376895efe4e49d

Download Submit
C:\Windows\system\rVnIdCP.exe

Filesize
2.8MB

MD5
c44ca24b350a64596d7a6e3fc70654e9

SHA1
9556bcc530d57b99a8a8a4f9cec59a8b3212aa93

SHA256
18c88e4e9d67e81d0e31e1e7f75e3ab250338cd23de3b04c33c741666db78b3a

SHA512
d53e49fb7678ee7234ae40f1a868e326dedd8505b9970a16abdd3b286299250cc735273bde87d4b93ac18bfc1400c3a5a30b516755b79fdc7ce9c551308db0d0

Download Submit
C:\Windows\system\rvvKKRp.exe

Filesize
2.8MB

MD5
7d46f6a96133122a7a5f3a747958ff0b

SHA1
b3acf8f29f5f19903d4870a5ec29d62ee5427de4

SHA256
4a170df2b5f53fdacc5a9cf3f2bac403928ffe887d63df7254e76e77e2846f4b

SHA512
67ad6e260c42fe1fd684a5ff690fbbb7a6c7ddb9726888d0f477e0c074c2217b25c34bfc88d052bbc41fa2e578e49f6c5580767933344f609d3cd5b91ddd0e65

Download Submit
C:\Windows\system\sCpTRUi.exe

Filesize
2.8MB

MD5
b7be0c98541d564dcbcea0590cd7c15e

SHA1
260537bf8abfb179d4d499e6037f6821875d4fa7

SHA256
a9d1e5d1f69c1f7bff76c10754b84ce901e591c2753f478b94294c04936f638f

SHA512
b44e75b34baae0c0ed5a99808b5a57a1c07ae4e9ee2b3aebcaf641bd4f0052dba4767bcacd68e9f509dffc94cdb2d12ef85e4213851b12c3117b39cf19921593

Download Submit
C:\Windows\system\siFickr.exe

Filesize
2.8MB

MD5
5d8ef991878ba2fe5e13e34dde1a4af1

SHA1
1fab9dd0f8cded6792236b8ceaf3b20fe722316f

SHA256
d1dbc0840b07e0363125a9a3e89216c3f3d24eaa2b6ab5518ef9dbc6cb415588

SHA512
4d8f5af271a37e09ddabb6c029a617fcdceba5fa032499adee91a45e1cee3b46e357212c4a6799929a27f52b8ce4547c23155887fc513fb7a8680390a165c045

Download Submit
C:\Windows\system\uPoCxig.exe

Filesize
2.8MB

MD5
ed349592eb31ac03d2b40cabb49a5cf5

SHA1
d8cf4764d5c4ad02016c6819edff82963576a9f4

SHA256
746af7c37405d58c8850140d6cdc4423cb38b67de819876e404918a7d3921586

SHA512
089c19d6010733086b943c2a65b53470b2e1a3730c5af64d5ecbaaa738ae44daba7ff402bcaf47c775e2332e31c06f4787b58931801ce341209efc352e0926b8

Download Submit
C:\Windows\system\voyBSOY.exe

Filesize
2.8MB

MD5
9ff8f043f5cce6478823ed3b5a9ca3d7

SHA1
eedfbf692210b439d8ce9d7c81d0e6106fc69e50

SHA256
a2c06c578c3ec7ee128edfc4458dc6ae8424aeb9f53b942855a092752c818248

SHA512
4de9bd081ee329da18ed33943225f87d1ca25754bd5c27ef61f4ac746311076af0c757c5d45f953e1d6f02a8cc04bfc14992401da7ec02f888b9e4e0886a0b37

Download Submit
C:\Windows\system\wCHkwMn.exe

Filesize
2.8MB

MD5
233c535370c7c5da243455b0a2627254

SHA1
f440484b188d4367e3ffdd854655295444487068

SHA256
db59e4e15e44eb7c00a3ce100a5f600a3ecc2069645370ba900c65057eee55b8

SHA512
dbb6dda85ea3d6d5708a3b057bae47ca314146a4807a18bb7d82a2f78fa199b16a972a63899129bd871a6d69537510743c2c5d4b002aee7917461fbdcc42d216

Download Submit
C:\Windows\system\wJwVsWT.exe

Filesize
2.8MB

MD5
5df8579d317a6816b1f11f4d7fd5dd80

SHA1
d70995ec21cb68d0a39ac4301c149f8b7316b9c1

SHA256
471bd2564256773cf29e57afe13efc5b9dee8c2d1e542e4701ccb0508c9da811

SHA512
393717dc9f340201d4d89857f4eedfbb474d7d6304c60ab1f5db20140fe3ad64448e9f52267b2e850ba6dd65544f6478f10612f1842bfca35a84ffa65a07663a

Download Submit
C:\Windows\system\wafOuYJ.exe

Filesize
2.8MB

MD5
42d329c85e8a73f39dd11e3ee0dc8432

SHA1
75b71698d06a88718441e91c0bf56a0f678ff871

SHA256
4bbb2e038cdc6c214c02b0b307009ab2f76287ae9178eeae774e54b3a480a777

SHA512
8653fcc15332092e528ce891157e386c6436d3bcfb79ce54593eba1565655fe64a4618ff35bbeed956b1917c4c6e1629b4c57d35232f881fe35737c2f4fe4623

Download Submit
C:\Windows\system\xQeWNmF.exe

Filesize
2.8MB

MD5
34bd5d72efbec3f7a597e2b371b421b7

SHA1
29a4c770683a346fdafdeffcf387d1d52afa9dea

SHA256
6283e7dd2a42f459938c1e0979c39eabae6b4cb2d8081b7f0a297aa61548a1e9

SHA512
d37b12a454ae539af7c17006cbcf52bfe290abd91dfc6ca73c10178fdab2efb6250f1f93ee69d68a3940c8cccfe64fce979bc4655316719cc22e2d3090d00ca6

Download Submit
C:\Windows\system\ziePhye.exe

Filesize
2.8MB

MD5
fdabf5a53c1634e869700c87b807fa1c

SHA1
f11995bbe601d75809bd801d92e91b2cae2c27ec

SHA256
d669bdb8a9cdad862c5d7455cb86020b2860d11dd32190c92361881ffc8ba25e

SHA512
28fc1e6d765642d5acd8d219b608fa4e30233021427aefc1f83d9b2b997985190b5050fb1633d08e5c4d1a812689738120922c00a2088fccf57a048ea98f03a7

Download Submit
C:\Windows\system\zyPaRJY.exe

Filesize
2.8MB

MD5
9f14cc4d8f20be2adf1cde428959671c

SHA1
033c363e93069a064436cf6fca4184dec7eaaa5b

SHA256
3cf3c0dd709fb381f92cba6a99e8a1817f644aa4e357d89042e17ce901533b3e

SHA512
20bd81ec230a52ce65806b0bb1bceb82fc88c323d6be621188e091ce06f421ef1a825665bc673221d6663156db29bf6bd377fe62a275c65f3af2a1ee0a2208a6

Download Submit
\Windows\system\VkYlrlx.exe

Filesize
2.8MB

MD5
f686fe22c6d4a64f80b6186dd3ed4642

SHA1
6134fa2e32a435dafe09d1e9604004fabf9f9a6b

SHA256
607d7793f0192521cdb235ca2c5ec869658b6f635311f7f95161038a874eb5bf

SHA512
a1831f58b1efe35bb4ddaaab4cb2150b40b3befb39ad671395c1a48d8d1d0c8855dd2d66ef868c18c3f48142a4e37e96145dc4636bc3b4dec0c9df287f0dc432

Download Submit
\Windows\system\XRsoudj.exe

Filesize
2.8MB

MD5
b5acc7b995d20814b2f6ec19897fc535

SHA1
380f844f00142c015894b144fa8e34fd51693ab2

SHA256
2c868d767caa7bf0ee5bc00a3036c12b66a4f902b9c79e674386ec200d7489b2

SHA512
0ecd9dbbfe4cbc6755ca6e1a77409c98eb3fb26e918ee0c81ad1075632d362caffd9262b72b149831164628f42fb1113712de2288dae3a41c6f69d819f65c339

Download Submit
memory/1756-1004-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-868-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2232-872-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-1-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-884-0x0000000003000000-0x00000000033F6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-985-0x000000013FD50000-0x0000000140146000-memory.dmp

Filesize
4.0MB

Download
memory/2232-862-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-8933-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-1005-0x0000000003000000-0x00000000033F6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-8936-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/2232-870-0x0000000003000000-0x00000000033F6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-8937-0x000000013FF40000-0x0000000140336000-memory.dmp

Filesize
4.0MB

Download
memory/2232-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2232-8938-0x000000013FD50000-0x0000000140146000-memory.dmp

Filesize
4.0MB

Download
memory/2232-874-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/2232-8934-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/2232-876-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/2232-8930-0x0000000003000000-0x00000000033F6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-8929-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2232-879-0x000000013FF40000-0x0000000140336000-memory.dmp

Filesize
4.0MB

Download
memory/2232-883-0x0000000003000000-0x00000000033F6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-8914-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2380-867-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2396-1866-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/2396-1785-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/2468-986-0x000000013FD50000-0x0000000140146000-memory.dmp

Filesize
4.0MB

Download
memory/2468-8875-0x000000013FD50000-0x0000000140146000-memory.dmp

Filesize
4.0MB

Download
memory/2608-8909-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2616-869-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2616-8927-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2688-8870-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2688-871-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2736-8924-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2736-873-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2748-8925-0x000000013FF40000-0x0000000140336000-memory.dmp

Filesize
4.0MB

Download
memory/2748-882-0x000000013FF40000-0x0000000140336000-memory.dmp

Filesize
4.0MB

Download
memory/2756-878-0x000000013F730000-0x000000013FB26000-memory.dmp

Filesize
4.0MB

Download
memory/2756-8916-0x000000013F730000-0x000000013FB26000-memory.dmp

Filesize
4.0MB

Download
memory/2764-8928-0x000000013FA10000-0x000000013FE06000-memory.dmp

Filesize
4.0MB

Download
memory/2764-931-0x000000013FA10000-0x000000013FE06000-memory.dmp

Filesize
4.0MB

Download
memory/2892-8926-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/2892-877-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/2896-875-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/2896-8915-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download