xmrig | 71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
Size

3.3MB
MD5

41c0c3b14b92b3dec290853c80aebd60
SHA1

8668ee14d212cd24daa454dee7e2d90c6b53cf86
SHA256

71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d
SHA512

29e6aaa5d76b6c622e65d6faac6d7bd5dde013bdc8e33d5b200902b0fe47e3ffe7ab734ada9b393752e0acfe90fd75b9526a9d093e88c5dddd62aad1c8e6d7c1
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWB:7bBeSFk9

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5088-0-0x00007FF6F4580000-0x00007FF6F4976000-memory.dmp	xmrig
behavioral2/files/0x000800000002325a-5.dat	xmrig
behavioral2/files/0x000800000002325d-12.dat	xmrig
behavioral2/memory/2036-8-0x00007FF640120000-0x00007FF640516000-memory.dmp	xmrig
behavioral2/files/0x0008000000023260-11.dat	xmrig
behavioral2/memory/4260-17-0x00007FF6D25B0000-0x00007FF6D29A6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023262-23.dat	xmrig
behavioral2/files/0x000800000002325e-28.dat	xmrig
behavioral2/files/0x0007000000023263-32.dat	xmrig
behavioral2/memory/3504-36-0x00007FF63F020000-0x00007FF63F416000-memory.dmp	xmrig
behavioral2/memory/116-37-0x00007FF76AA70000-0x00007FF76AE66000-memory.dmp	xmrig
behavioral2/memory/1288-38-0x00007FF6789E0000-0x00007FF678DD6000-memory.dmp	xmrig
behavioral2/memory/1976-40-0x00007FF6151B0000-0x00007FF6155A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023264-49.dat	xmrig
behavioral2/memory/4360-56-0x00007FF7E1E60000-0x00007FF7E2256000-memory.dmp	xmrig
behavioral2/files/0x0007000000023265-60.dat	xmrig
behavioral2/memory/3156-62-0x00007FF7B8DB0000-0x00007FF7B91A6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023266-67.dat	xmrig
behavioral2/memory/1112-69-0x00007FF799A50000-0x00007FF799E46000-memory.dmp	xmrig
behavioral2/files/0x0008000000023267-71.dat	xmrig
behavioral2/memory/5088-75-0x00007FF6F4580000-0x00007FF6F4976000-memory.dmp	xmrig
behavioral2/memory/2180-76-0x00007FF6D1030000-0x00007FF6D1426000-memory.dmp	xmrig
behavioral2/files/0x0007000000023268-79.dat	xmrig
behavioral2/memory/2036-82-0x00007FF640120000-0x00007FF640516000-memory.dmp	xmrig
behavioral2/memory/3876-83-0x00007FF6D9CF0000-0x00007FF6DA0E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023269-86.dat	xmrig
behavioral2/files/0x000700000002326b-92.dat	xmrig
behavioral2/memory/3624-94-0x00007FF6466F0000-0x00007FF646AE6000-memory.dmp	xmrig
behavioral2/memory/4260-96-0x00007FF6D25B0000-0x00007FF6D29A6000-memory.dmp	xmrig
behavioral2/files/0x000700000002326c-99.dat	xmrig
behavioral2/memory/4432-100-0x00007FF7CCFA0000-0x00007FF7CD396000-memory.dmp	xmrig
behavioral2/files/0x000700000002326d-103.dat	xmrig
behavioral2/files/0x000700000002326e-110.dat	xmrig
behavioral2/memory/4068-114-0x00007FF623170000-0x00007FF623566000-memory.dmp	xmrig
behavioral2/memory/4768-115-0x00007FF7485D0000-0x00007FF7489C6000-memory.dmp	xmrig
behavioral2/memory/1288-119-0x00007FF6789E0000-0x00007FF678DD6000-memory.dmp	xmrig
behavioral2/files/0x000700000002326f-121.dat	xmrig
behavioral2/memory/492-120-0x00007FF78F230000-0x00007FF78F626000-memory.dmp	xmrig
behavioral2/files/0x0007000000023270-125.dat	xmrig
behavioral2/memory/1124-130-0x00007FF763F40000-0x00007FF764336000-memory.dmp	xmrig
behavioral2/files/0x0007000000023271-131.dat	xmrig
behavioral2/memory/3900-132-0x00007FF6EC130000-0x00007FF6EC526000-memory.dmp	xmrig
behavioral2/files/0x0007000000023272-138.dat	xmrig
behavioral2/files/0x0007000000023274-147.dat	xmrig
behavioral2/files/0x0007000000023278-168.dat	xmrig
behavioral2/files/0x0007000000023279-173.dat	xmrig
behavioral2/files/0x000700000002327a-178.dat	xmrig
behavioral2/files/0x000700000002327c-188.dat	xmrig
behavioral2/files/0x000700000002327e-198.dat	xmrig
behavioral2/files/0x000700000002327d-196.dat	xmrig
behavioral2/memory/4360-361-0x00007FF7E1E60000-0x00007FF7E2256000-memory.dmp	xmrig
behavioral2/memory/2316-379-0x00007FF7ED440000-0x00007FF7ED836000-memory.dmp	xmrig
behavioral2/memory/4476-380-0x00007FF73D260000-0x00007FF73D656000-memory.dmp	xmrig
behavioral2/memory/1992-390-0x00007FF7DAA60000-0x00007FF7DAE56000-memory.dmp	xmrig
behavioral2/memory/2020-398-0x00007FF781140000-0x00007FF781536000-memory.dmp	xmrig
behavioral2/memory/3052-402-0x00007FF74E7A0000-0x00007FF74EB96000-memory.dmp	xmrig
behavioral2/memory/2376-394-0x00007FF703F90000-0x00007FF704386000-memory.dmp	xmrig
behavioral2/files/0x000700000002327b-186.dat	xmrig
behavioral2/files/0x0007000000023277-163.dat	xmrig
behavioral2/files/0x0007000000023276-158.dat	xmrig
behavioral2/files/0x0007000000023275-156.dat	xmrig
behavioral2/files/0x0007000000023273-145.dat	xmrig
behavioral2/memory/2036-1181-0x00007FF640120000-0x00007FF640516000-memory.dmp	xmrig
behavioral2/memory/4260-1182-0x00007FF6D25B0000-0x00007FF6D29A6000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
10	1892	powershell.exe
12	1892	powershell.exe
64	1892	powershell.exe
65	1892	powershell.exe
66	1892	powershell.exe
74	1892	powershell.exe
75	1892	powershell.exe
76	1892	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1892	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2036	aTMVCaN.exe
4260	hBfqjTC.exe
1976	blaonQo.exe
3504	pYrQQxu.exe
116	yXtwexW.exe
1288	EXgxKDO.exe
4360	cEFCieO.exe
3156	XdKYKNc.exe
1112	QEkQhgm.exe
2180	lxYSBoM.exe
3876	YFtOZCC.exe
3624	QNLNdaB.exe
4432	tQwrhQe.exe
4068	gLwgOjh.exe
4768	JhgfYbN.exe
492	oBGKHQa.exe
1124	AjkIBkj.exe
3900	RuUvbBg.exe
2020	jEbyIMp.exe
3052	shNiNsu.exe
2316	indLhkQ.exe
4476	uOAdcDG.exe
1992	QbiIMZV.exe
2376	efOxJdQ.exe
3552	ZgHoKdh.exe
4072	rTuPJaj.exe
3744	AqiEdDJ.exe
1548	hwEdPcF.exe
4264	egQdbTj.exe
1556	gwsEudb.exe
548	aZFIDyG.exe
928	UBXDipP.exe
3084	dFxTREs.exe
4512	CbtouhL.exe
1984	wwKnhxf.exe
4428	hbbeMlZ.exe
2040	bpxokkF.exe
4016	vGguOdY.exe
3808	kncHtyA.exe
2164	xDkBodS.exe
4272	GsdpWdz.exe
4224	wjHmJJr.exe
4924	GDFBXSk.exe
208	tZQAKlj.exe
3660	OlBQFLS.exe
1600	tNQVcuQ.exe
4124	dcFZLcr.exe
4500	sDNdWxG.exe
4344	qVywjqC.exe
2504	GJOUfnp.exe
1380	dIwRIfl.exe
5144	YgrWmBu.exe
5172	LOYMHxC.exe
5200	ANWHkNj.exe
5228	fRHRfMs.exe
5244	cMFmMyR.exe
5272	wIjHOKY.exe
5300	lJELpEM.exe
5336	aZAPngd.exe
5364	jooiPDi.exe
5384	cdRFxCy.exe
5420	goqlgeD.exe
5448	UQLPmXI.exe
5468	ckxyqzq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5088-0-0x00007FF6F4580000-0x00007FF6F4976000-memory.dmp	upx
behavioral2/files/0x000800000002325a-5.dat	upx
behavioral2/files/0x000800000002325d-12.dat	upx
behavioral2/memory/2036-8-0x00007FF640120000-0x00007FF640516000-memory.dmp	upx
behavioral2/files/0x0008000000023260-11.dat	upx
behavioral2/memory/4260-17-0x00007FF6D25B0000-0x00007FF6D29A6000-memory.dmp	upx
behavioral2/files/0x0008000000023262-23.dat	upx
behavioral2/files/0x000800000002325e-28.dat	upx
behavioral2/files/0x0007000000023263-32.dat	upx
behavioral2/memory/3504-36-0x00007FF63F020000-0x00007FF63F416000-memory.dmp	upx
behavioral2/memory/116-37-0x00007FF76AA70000-0x00007FF76AE66000-memory.dmp	upx
behavioral2/memory/1288-38-0x00007FF6789E0000-0x00007FF678DD6000-memory.dmp	upx
behavioral2/memory/1976-40-0x00007FF6151B0000-0x00007FF6155A6000-memory.dmp	upx
behavioral2/files/0x0007000000023264-49.dat	upx
behavioral2/memory/4360-56-0x00007FF7E1E60000-0x00007FF7E2256000-memory.dmp	upx
behavioral2/files/0x0007000000023265-60.dat	upx
behavioral2/memory/3156-62-0x00007FF7B8DB0000-0x00007FF7B91A6000-memory.dmp	upx
behavioral2/files/0x0008000000023266-67.dat	upx
behavioral2/memory/1112-69-0x00007FF799A50000-0x00007FF799E46000-memory.dmp	upx
behavioral2/files/0x0008000000023267-71.dat	upx
behavioral2/memory/5088-75-0x00007FF6F4580000-0x00007FF6F4976000-memory.dmp	upx
behavioral2/memory/2180-76-0x00007FF6D1030000-0x00007FF6D1426000-memory.dmp	upx
behavioral2/files/0x0007000000023268-79.dat	upx
behavioral2/memory/2036-82-0x00007FF640120000-0x00007FF640516000-memory.dmp	upx
behavioral2/memory/3876-83-0x00007FF6D9CF0000-0x00007FF6DA0E6000-memory.dmp	upx
behavioral2/files/0x0007000000023269-86.dat	upx
behavioral2/files/0x000700000002326b-92.dat	upx
behavioral2/memory/3624-94-0x00007FF6466F0000-0x00007FF646AE6000-memory.dmp	upx
behavioral2/memory/4260-96-0x00007FF6D25B0000-0x00007FF6D29A6000-memory.dmp	upx
behavioral2/files/0x000700000002326c-99.dat	upx
behavioral2/memory/4432-100-0x00007FF7CCFA0000-0x00007FF7CD396000-memory.dmp	upx
behavioral2/files/0x000700000002326d-103.dat	upx
behavioral2/files/0x000700000002326e-110.dat	upx
behavioral2/memory/4068-114-0x00007FF623170000-0x00007FF623566000-memory.dmp	upx
behavioral2/memory/4768-115-0x00007FF7485D0000-0x00007FF7489C6000-memory.dmp	upx
behavioral2/memory/1288-119-0x00007FF6789E0000-0x00007FF678DD6000-memory.dmp	upx
behavioral2/files/0x000700000002326f-121.dat	upx
behavioral2/memory/492-120-0x00007FF78F230000-0x00007FF78F626000-memory.dmp	upx
behavioral2/files/0x0007000000023270-125.dat	upx
behavioral2/memory/1124-130-0x00007FF763F40000-0x00007FF764336000-memory.dmp	upx
behavioral2/files/0x0007000000023271-131.dat	upx
behavioral2/memory/3900-132-0x00007FF6EC130000-0x00007FF6EC526000-memory.dmp	upx
behavioral2/files/0x0007000000023272-138.dat	upx
behavioral2/files/0x0007000000023274-147.dat	upx
behavioral2/files/0x0007000000023278-168.dat	upx
behavioral2/files/0x0007000000023279-173.dat	upx
behavioral2/files/0x000700000002327a-178.dat	upx
behavioral2/files/0x000700000002327c-188.dat	upx
behavioral2/files/0x000700000002327e-198.dat	upx
behavioral2/files/0x000700000002327d-196.dat	upx
behavioral2/memory/4360-361-0x00007FF7E1E60000-0x00007FF7E2256000-memory.dmp	upx
behavioral2/memory/2316-379-0x00007FF7ED440000-0x00007FF7ED836000-memory.dmp	upx
behavioral2/memory/4476-380-0x00007FF73D260000-0x00007FF73D656000-memory.dmp	upx
behavioral2/memory/1992-390-0x00007FF7DAA60000-0x00007FF7DAE56000-memory.dmp	upx
behavioral2/memory/2020-398-0x00007FF781140000-0x00007FF781536000-memory.dmp	upx
behavioral2/memory/3052-402-0x00007FF74E7A0000-0x00007FF74EB96000-memory.dmp	upx
behavioral2/memory/2376-394-0x00007FF703F90000-0x00007FF704386000-memory.dmp	upx
behavioral2/files/0x000700000002327b-186.dat	upx
behavioral2/files/0x0007000000023277-163.dat	upx
behavioral2/files/0x0007000000023276-158.dat	upx
behavioral2/files/0x0007000000023275-156.dat	upx
behavioral2/files/0x0007000000023273-145.dat	upx
behavioral2/memory/2036-1181-0x00007FF640120000-0x00007FF640516000-memory.dmp	upx
behavioral2/memory/4260-1182-0x00007FF6D25B0000-0x00007FF6D29A6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bTAdeSz.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\vnsNdAh.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\oRNrXcG.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\HYpWCvO.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\rDOFqzl.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\hGGsowZ.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\VfhYnLV.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\Jgkqned.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\nbyVPKc.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\aZFIDyG.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\ZVmWQHZ.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\XXzpvRn.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\cZvKDsl.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\apTywTF.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\DSArcaK.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\YdQEBeE.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\ipxpfoy.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\XKXJSqc.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\zQrMvVI.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\rIOOSli.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\suuGETj.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\ygDMGkg.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\SGriZyX.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\FSSOtzJ.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\wLxTMIo.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\TyiyHlZ.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\KZEvLff.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\GKgFLdG.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\mWJsrfN.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\NFQPBtC.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\hwEdPcF.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\zjFmcKM.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\WQYwvrT.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\ShNICnm.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\Brtuhgx.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\GeEUOiR.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\CwYHTtB.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\EOSfOyo.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\PQiIewk.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\nSKktka.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\ngSpfiM.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\SSCdzYD.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\ApzHinR.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\ywIFUpG.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\XaOFWCa.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\cCMuZft.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\EEdZNYv.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\yXkccSl.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\JjWuucV.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\ZgcnRkR.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\bVvIRPH.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\xeWGRVo.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\PxZwXiT.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\kWBtqDp.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\NXYuUiP.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\AfPhUWm.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\xVBeiAf.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\zUQMNbu.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\amIwsuu.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\luunczT.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\CFwNxoJ.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\OCDxyEE.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\YZbGbfN.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
File created	C:\Windows\System\viFCfHa.exe	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1892	powershell.exe
1892	powershell.exe
1892	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeLockMemoryPrivilege	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1892	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	93
PID 5088 wrote to memory of 1892	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	93
PID 5088 wrote to memory of 2036	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	94
PID 5088 wrote to memory of 2036	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	94
PID 5088 wrote to memory of 4260	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	95
PID 5088 wrote to memory of 4260	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	95
PID 5088 wrote to memory of 1976	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	96
PID 5088 wrote to memory of 1976	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	96
PID 5088 wrote to memory of 3504	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	97
PID 5088 wrote to memory of 3504	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	97
PID 5088 wrote to memory of 116	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	98
PID 5088 wrote to memory of 116	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	98
PID 5088 wrote to memory of 1288	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	99
PID 5088 wrote to memory of 1288	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	99
PID 5088 wrote to memory of 4360	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	100
PID 5088 wrote to memory of 4360	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	100
PID 5088 wrote to memory of 3156	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	101
PID 5088 wrote to memory of 3156	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	101
PID 5088 wrote to memory of 1112	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	102
PID 5088 wrote to memory of 1112	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	102
PID 5088 wrote to memory of 2180	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	103
PID 5088 wrote to memory of 2180	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	103
PID 5088 wrote to memory of 3876	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	104
PID 5088 wrote to memory of 3876	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	104
PID 5088 wrote to memory of 3624	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	105
PID 5088 wrote to memory of 3624	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	105
PID 5088 wrote to memory of 4432	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	106
PID 5088 wrote to memory of 4432	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	106
PID 5088 wrote to memory of 4068	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	107
PID 5088 wrote to memory of 4068	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	107
PID 5088 wrote to memory of 4768	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	108
PID 5088 wrote to memory of 4768	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	108
PID 5088 wrote to memory of 492	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	109
PID 5088 wrote to memory of 492	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	109
PID 5088 wrote to memory of 1124	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	110
PID 5088 wrote to memory of 1124	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	110
PID 5088 wrote to memory of 3900	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	111
PID 5088 wrote to memory of 3900	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	111
PID 5088 wrote to memory of 2020	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	112
PID 5088 wrote to memory of 2020	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	112
PID 5088 wrote to memory of 3052	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	113
PID 5088 wrote to memory of 3052	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	113
PID 5088 wrote to memory of 2316	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	114
PID 5088 wrote to memory of 2316	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	114
PID 5088 wrote to memory of 4476	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	115
PID 5088 wrote to memory of 4476	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	115
PID 5088 wrote to memory of 1992	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	116
PID 5088 wrote to memory of 1992	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	116
PID 5088 wrote to memory of 2376	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	117
PID 5088 wrote to memory of 2376	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	117
PID 5088 wrote to memory of 3552	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	118
PID 5088 wrote to memory of 3552	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	118
PID 5088 wrote to memory of 4072	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	119
PID 5088 wrote to memory of 4072	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	119
PID 5088 wrote to memory of 3744	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	120
PID 5088 wrote to memory of 3744	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	120
PID 5088 wrote to memory of 1548	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	121
PID 5088 wrote to memory of 1548	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	121
PID 5088 wrote to memory of 4264	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	122
PID 5088 wrote to memory of 4264	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	122
PID 5088 wrote to memory of 1556	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	123
PID 5088 wrote to memory of 1556	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	123
PID 5088 wrote to memory of 548	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	124
PID 5088 wrote to memory of 548	5088	71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\71a4a84b0706530ac764883ca4d97b6ee26397f88ccd00163eac0aca7751a55d_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\System\aTMVCaN.exe
  C:\Windows\System\aTMVCaN.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\hBfqjTC.exe
  C:\Windows\System\hBfqjTC.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\blaonQo.exe
  C:\Windows\System\blaonQo.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\pYrQQxu.exe
  C:\Windows\System\pYrQQxu.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\yXtwexW.exe
  C:\Windows\System\yXtwexW.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\EXgxKDO.exe
  C:\Windows\System\EXgxKDO.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\cEFCieO.exe
  C:\Windows\System\cEFCieO.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\XdKYKNc.exe
  C:\Windows\System\XdKYKNc.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\QEkQhgm.exe
  C:\Windows\System\QEkQhgm.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\lxYSBoM.exe
  C:\Windows\System\lxYSBoM.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\YFtOZCC.exe
  C:\Windows\System\YFtOZCC.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\QNLNdaB.exe
  C:\Windows\System\QNLNdaB.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\tQwrhQe.exe
  C:\Windows\System\tQwrhQe.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\gLwgOjh.exe
  C:\Windows\System\gLwgOjh.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\JhgfYbN.exe
  C:\Windows\System\JhgfYbN.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\oBGKHQa.exe
  C:\Windows\System\oBGKHQa.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\AjkIBkj.exe
  C:\Windows\System\AjkIBkj.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\RuUvbBg.exe
  C:\Windows\System\RuUvbBg.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\jEbyIMp.exe
  C:\Windows\System\jEbyIMp.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\shNiNsu.exe
  C:\Windows\System\shNiNsu.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\indLhkQ.exe
  C:\Windows\System\indLhkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\uOAdcDG.exe
  C:\Windows\System\uOAdcDG.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\QbiIMZV.exe
  C:\Windows\System\QbiIMZV.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\efOxJdQ.exe
  C:\Windows\System\efOxJdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ZgHoKdh.exe
  C:\Windows\System\ZgHoKdh.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\rTuPJaj.exe
  C:\Windows\System\rTuPJaj.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\AqiEdDJ.exe
  C:\Windows\System\AqiEdDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\hwEdPcF.exe
  C:\Windows\System\hwEdPcF.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\egQdbTj.exe
  C:\Windows\System\egQdbTj.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\gwsEudb.exe
  C:\Windows\System\gwsEudb.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\aZFIDyG.exe
  C:\Windows\System\aZFIDyG.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\UBXDipP.exe
  C:\Windows\System\UBXDipP.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\dFxTREs.exe
  C:\Windows\System\dFxTREs.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\CbtouhL.exe
  C:\Windows\System\CbtouhL.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\wwKnhxf.exe
  C:\Windows\System\wwKnhxf.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\hbbeMlZ.exe
  C:\Windows\System\hbbeMlZ.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\bpxokkF.exe
  C:\Windows\System\bpxokkF.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\vGguOdY.exe
  C:\Windows\System\vGguOdY.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\kncHtyA.exe
  C:\Windows\System\kncHtyA.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\xDkBodS.exe
  C:\Windows\System\xDkBodS.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\GsdpWdz.exe
  C:\Windows\System\GsdpWdz.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\wjHmJJr.exe
  C:\Windows\System\wjHmJJr.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\GDFBXSk.exe
  C:\Windows\System\GDFBXSk.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\tZQAKlj.exe
  C:\Windows\System\tZQAKlj.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\OlBQFLS.exe
  C:\Windows\System\OlBQFLS.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\tNQVcuQ.exe
  C:\Windows\System\tNQVcuQ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\dcFZLcr.exe
  C:\Windows\System\dcFZLcr.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\sDNdWxG.exe
  C:\Windows\System\sDNdWxG.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\qVywjqC.exe
  C:\Windows\System\qVywjqC.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\GJOUfnp.exe
  C:\Windows\System\GJOUfnp.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\dIwRIfl.exe
  C:\Windows\System\dIwRIfl.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\YgrWmBu.exe
  C:\Windows\System\YgrWmBu.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\LOYMHxC.exe
  C:\Windows\System\LOYMHxC.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\ANWHkNj.exe
  C:\Windows\System\ANWHkNj.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\fRHRfMs.exe
  C:\Windows\System\fRHRfMs.exe
  2⤵
  - Executes dropped EXE
  PID:5228
- C:\Windows\System\cMFmMyR.exe
  C:\Windows\System\cMFmMyR.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\wIjHOKY.exe
  C:\Windows\System\wIjHOKY.exe
  2⤵
  - Executes dropped EXE
  PID:5272
- C:\Windows\System\lJELpEM.exe
  C:\Windows\System\lJELpEM.exe
  2⤵
  - Executes dropped EXE
  PID:5300
- C:\Windows\System\aZAPngd.exe
  C:\Windows\System\aZAPngd.exe
  2⤵
  - Executes dropped EXE
  PID:5336
- C:\Windows\System\jooiPDi.exe
  C:\Windows\System\jooiPDi.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\cdRFxCy.exe
  C:\Windows\System\cdRFxCy.exe
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\System\goqlgeD.exe
  C:\Windows\System\goqlgeD.exe
  2⤵
  - Executes dropped EXE
  PID:5420
- C:\Windows\System\UQLPmXI.exe
  C:\Windows\System\UQLPmXI.exe
  2⤵
  - Executes dropped EXE
  PID:5448
- C:\Windows\System\ckxyqzq.exe
  C:\Windows\System\ckxyqzq.exe
  2⤵
  - Executes dropped EXE
  PID:5468
- C:\Windows\System\rQQCwnB.exe
  C:\Windows\System\rQQCwnB.exe
  2⤵
  PID:5496
- C:\Windows\System\wPYusng.exe
  C:\Windows\System\wPYusng.exe
  2⤵
  PID:5524
- C:\Windows\System\eIcXTHq.exe
  C:\Windows\System\eIcXTHq.exe
  2⤵
  PID:5552
- C:\Windows\System\gCBUsCC.exe
  C:\Windows\System\gCBUsCC.exe
  2⤵
  PID:5576
- C:\Windows\System\dqhvNcK.exe
  C:\Windows\System\dqhvNcK.exe
  2⤵
  PID:5608
- C:\Windows\System\lmsLHrf.exe
  C:\Windows\System\lmsLHrf.exe
  2⤵
  PID:5636
- C:\Windows\System\lDMurGa.exe
  C:\Windows\System\lDMurGa.exe
  2⤵
  PID:5664
- C:\Windows\System\BXKlQax.exe
  C:\Windows\System\BXKlQax.exe
  2⤵
  PID:5688
- C:\Windows\System\Txpcika.exe
  C:\Windows\System\Txpcika.exe
  2⤵
  PID:5716
- C:\Windows\System\WjJPJVT.exe
  C:\Windows\System\WjJPJVT.exe
  2⤵
  PID:5756
- C:\Windows\System\uaUHwfA.exe
  C:\Windows\System\uaUHwfA.exe
  2⤵
  PID:5784
- C:\Windows\System\oYmlEUd.exe
  C:\Windows\System\oYmlEUd.exe
  2⤵
  PID:5812
- C:\Windows\System\dzjcift.exe
  C:\Windows\System\dzjcift.exe
  2⤵
  PID:5832
- C:\Windows\System\NcgYkaR.exe
  C:\Windows\System\NcgYkaR.exe
  2⤵
  PID:5860
- C:\Windows\System\JSTkdJo.exe
  C:\Windows\System\JSTkdJo.exe
  2⤵
  PID:5888
- C:\Windows\System\jGxISQM.exe
  C:\Windows\System\jGxISQM.exe
  2⤵
  PID:5912
- C:\Windows\System\FyfeVmB.exe
  C:\Windows\System\FyfeVmB.exe
  2⤵
  PID:5952
- C:\Windows\System\JLTUggH.exe
  C:\Windows\System\JLTUggH.exe
  2⤵
  PID:5984
- C:\Windows\System\nzdEqAf.exe
  C:\Windows\System\nzdEqAf.exe
  2⤵
  PID:6016
- C:\Windows\System\YqxZmdy.exe
  C:\Windows\System\YqxZmdy.exe
  2⤵
  PID:6040
- C:\Windows\System\WWGiLEE.exe
  C:\Windows\System\WWGiLEE.exe
  2⤵
  PID:6056
- C:\Windows\System\fKkwmNc.exe
  C:\Windows\System\fKkwmNc.exe
  2⤵
  PID:6084
- C:\Windows\System\VgXWkgx.exe
  C:\Windows\System\VgXWkgx.exe
  2⤵
  PID:6108
- C:\Windows\System\DvRrnEl.exe
  C:\Windows\System\DvRrnEl.exe
  2⤵
  PID:5128
- C:\Windows\System\QoVhGkQ.exe
  C:\Windows\System\QoVhGkQ.exe
  2⤵
  PID:5164
- C:\Windows\System\bMXmjmf.exe
  C:\Windows\System\bMXmjmf.exe
  2⤵
  PID:5212
- C:\Windows\System\NKcUKHp.exe
  C:\Windows\System\NKcUKHp.exe
  2⤵
  PID:5284
- C:\Windows\System\FdwnMlZ.exe
  C:\Windows\System\FdwnMlZ.exe
  2⤵
  PID:5360
- C:\Windows\System\wFdnZgq.exe
  C:\Windows\System\wFdnZgq.exe
  2⤵
  PID:5408
- C:\Windows\System\WItCjOK.exe
  C:\Windows\System\WItCjOK.exe
  2⤵
  PID:5464
- C:\Windows\System\WbExWhw.exe
  C:\Windows\System\WbExWhw.exe
  2⤵
  PID:5516
- C:\Windows\System\nYDxwup.exe
  C:\Windows\System\nYDxwup.exe
  2⤵
  PID:5572
- C:\Windows\System\EQhotmC.exe
  C:\Windows\System\EQhotmC.exe
  2⤵
  PID:5628
- C:\Windows\System\vPkgFot.exe
  C:\Windows\System\vPkgFot.exe
  2⤵
  PID:5748
- C:\Windows\System\apTywTF.exe
  C:\Windows\System\apTywTF.exe
  2⤵
  PID:5800
- C:\Windows\System\Jmedqgv.exe
  C:\Windows\System\Jmedqgv.exe
  2⤵
  PID:4332
- C:\Windows\System\eDVhogj.exe
  C:\Windows\System\eDVhogj.exe
  2⤵
  PID:5900
- C:\Windows\System\ZyCwRiT.exe
  C:\Windows\System\ZyCwRiT.exe
  2⤵
  PID:5944
- C:\Windows\System\IpDEuax.exe
  C:\Windows\System\IpDEuax.exe
  2⤵
  PID:4184
- C:\Windows\System\hfTSJFe.exe
  C:\Windows\System\hfTSJFe.exe
  2⤵
  PID:6068
- C:\Windows\System\AEZDDNP.exe
  C:\Windows\System\AEZDDNP.exe
  2⤵
  PID:4424
- C:\Windows\System\aJpmCKz.exe
  C:\Windows\System\aJpmCKz.exe
  2⤵
  PID:6104
- C:\Windows\System\dMcVoog.exe
  C:\Windows\System\dMcVoog.exe
  2⤵
  PID:1128
- C:\Windows\System\MPqxRzI.exe
  C:\Windows\System\MPqxRzI.exe
  2⤵
  PID:5240
- C:\Windows\System\QiTZJJs.exe
  C:\Windows\System\QiTZJJs.exe
  2⤵
  PID:5460
- C:\Windows\System\NtwTDQt.exe
  C:\Windows\System\NtwTDQt.exe
  2⤵
  PID:2304
- C:\Windows\System\vKaxrct.exe
  C:\Windows\System\vKaxrct.exe
  2⤵
  PID:5656
- C:\Windows\System\nAMkOuz.exe
  C:\Windows\System\nAMkOuz.exe
  2⤵
  PID:5780
- C:\Windows\System\kBOBpSe.exe
  C:\Windows\System\kBOBpSe.exe
  2⤵
  PID:4796
- C:\Windows\System\obYBzNb.exe
  C:\Windows\System\obYBzNb.exe
  2⤵
  PID:2900
- C:\Windows\System\HNeglBK.exe
  C:\Windows\System\HNeglBK.exe
  2⤵
  PID:5980
- C:\Windows\System\dSEAcct.exe
  C:\Windows\System\dSEAcct.exe
  2⤵
  PID:5876
- C:\Windows\System\TZaqPms.exe
  C:\Windows\System\TZaqPms.exe
  2⤵
  PID:3632
- C:\Windows\System\aRTOQMF.exe
  C:\Windows\System\aRTOQMF.exe
  2⤵
  PID:4772
- C:\Windows\System\LNbQzfw.exe
  C:\Windows\System\LNbQzfw.exe
  2⤵
  PID:3232
- C:\Windows\System\qvyMWYa.exe
  C:\Windows\System\qvyMWYa.exe
  2⤵
  PID:2436
- C:\Windows\System\TPgWCBI.exe
  C:\Windows\System\TPgWCBI.exe
  2⤵
  PID:5060
- C:\Windows\System\SKVgQcm.exe
  C:\Windows\System\SKVgQcm.exe
  2⤵
  PID:5620
- C:\Windows\System\zILhptC.exe
  C:\Windows\System\zILhptC.exe
  2⤵
  PID:3656
- C:\Windows\System\ywIFUpG.exe
  C:\Windows\System\ywIFUpG.exe
  2⤵
  PID:4956
- C:\Windows\System\sABLiKx.exe
  C:\Windows\System\sABLiKx.exe
  2⤵
  PID:4784
- C:\Windows\System\pvyxiXP.exe
  C:\Windows\System\pvyxiXP.exe
  2⤵
  PID:1796
- C:\Windows\System\CmPgoIg.exe
  C:\Windows\System\CmPgoIg.exe
  2⤵
  PID:1188
- C:\Windows\System\fDVOdSK.exe
  C:\Windows\System\fDVOdSK.exe
  2⤵
  PID:2720
- C:\Windows\System\HIKpSjN.exe
  C:\Windows\System\HIKpSjN.exe
  2⤵
  PID:1696
- C:\Windows\System\StuiWpi.exe
  C:\Windows\System\StuiWpi.exe
  2⤵
  PID:5880
- C:\Windows\System\ezkWdoc.exe
  C:\Windows\System\ezkWdoc.exe
  2⤵
  PID:4252
- C:\Windows\System\suuGETj.exe
  C:\Windows\System\suuGETj.exe
  2⤵
  PID:2536
- C:\Windows\System\PByXRUy.exe
  C:\Windows\System\PByXRUy.exe
  2⤵
  PID:2976
- C:\Windows\System\siqEoHg.exe
  C:\Windows\System\siqEoHg.exe
  2⤵
  PID:6152
- C:\Windows\System\ZTTBgak.exe
  C:\Windows\System\ZTTBgak.exe
  2⤵
  PID:6184
- C:\Windows\System\gdTCTkJ.exe
  C:\Windows\System\gdTCTkJ.exe
  2⤵
  PID:6216
- C:\Windows\System\kEhOnrb.exe
  C:\Windows\System\kEhOnrb.exe
  2⤵
  PID:6264
- C:\Windows\System\TdoxcCs.exe
  C:\Windows\System\TdoxcCs.exe
  2⤵
  PID:6292
- C:\Windows\System\caIaKVy.exe
  C:\Windows\System\caIaKVy.exe
  2⤵
  PID:6320
- C:\Windows\System\hxIUOqP.exe
  C:\Windows\System\hxIUOqP.exe
  2⤵
  PID:6348
- C:\Windows\System\RBDadUH.exe
  C:\Windows\System\RBDadUH.exe
  2⤵
  PID:6376
- C:\Windows\System\JTnfzIj.exe
  C:\Windows\System\JTnfzIj.exe
  2⤵
  PID:6404
- C:\Windows\System\MkBsniA.exe
  C:\Windows\System\MkBsniA.exe
  2⤵
  PID:6436
- C:\Windows\System\twdyLKG.exe
  C:\Windows\System\twdyLKG.exe
  2⤵
  PID:6464
- C:\Windows\System\IXqCdkj.exe
  C:\Windows\System\IXqCdkj.exe
  2⤵
  PID:6492
- C:\Windows\System\GXrlbhm.exe
  C:\Windows\System\GXrlbhm.exe
  2⤵
  PID:6520
- C:\Windows\System\WKJKCVr.exe
  C:\Windows\System\WKJKCVr.exe
  2⤵
  PID:6548
- C:\Windows\System\udsuqmP.exe
  C:\Windows\System\udsuqmP.exe
  2⤵
  PID:6576
- C:\Windows\System\CGQifqQ.exe
  C:\Windows\System\CGQifqQ.exe
  2⤵
  PID:6604
- C:\Windows\System\hTLlZGw.exe
  C:\Windows\System\hTLlZGw.exe
  2⤵
  PID:6632
- C:\Windows\System\hnWmEfC.exe
  C:\Windows\System\hnWmEfC.exe
  2⤵
  PID:6660
- C:\Windows\System\PvZRzlm.exe
  C:\Windows\System\PvZRzlm.exe
  2⤵
  PID:6676
- C:\Windows\System\qdRquGx.exe
  C:\Windows\System\qdRquGx.exe
  2⤵
  PID:6716
- C:\Windows\System\MoNePDX.exe
  C:\Windows\System\MoNePDX.exe
  2⤵
  PID:6744
- C:\Windows\System\KlMINtM.exe
  C:\Windows\System\KlMINtM.exe
  2⤵
  PID:6772
- C:\Windows\System\zEfQCGd.exe
  C:\Windows\System\zEfQCGd.exe
  2⤵
  PID:6800
- C:\Windows\System\qqAytXZ.exe
  C:\Windows\System\qqAytXZ.exe
  2⤵
  PID:6828
- C:\Windows\System\WtJmETX.exe
  C:\Windows\System\WtJmETX.exe
  2⤵
  PID:6856
- C:\Windows\System\kuSayJm.exe
  C:\Windows\System\kuSayJm.exe
  2⤵
  PID:6884
- C:\Windows\System\zyQTVWW.exe
  C:\Windows\System\zyQTVWW.exe
  2⤵
  PID:6900
- C:\Windows\System\xYJiBoR.exe
  C:\Windows\System\xYJiBoR.exe
  2⤵
  PID:6916
- C:\Windows\System\DbxVzRr.exe
  C:\Windows\System\DbxVzRr.exe
  2⤵
  PID:6944
- C:\Windows\System\cCaSpLi.exe
  C:\Windows\System\cCaSpLi.exe
  2⤵
  PID:6960
- C:\Windows\System\KedrAvP.exe
  C:\Windows\System\KedrAvP.exe
  2⤵
  PID:7008
- C:\Windows\System\VOngqxw.exe
  C:\Windows\System\VOngqxw.exe
  2⤵
  PID:7044
- C:\Windows\System\ZnuELob.exe
  C:\Windows\System\ZnuELob.exe
  2⤵
  PID:7072
- C:\Windows\System\PxZwXiT.exe
  C:\Windows\System\PxZwXiT.exe
  2⤵
  PID:7112
- C:\Windows\System\KbDUHya.exe
  C:\Windows\System\KbDUHya.exe
  2⤵
  PID:7140
- C:\Windows\System\IhlOkcZ.exe
  C:\Windows\System\IhlOkcZ.exe
  2⤵
  PID:5544
- C:\Windows\System\jnEmitG.exe
  C:\Windows\System\jnEmitG.exe
  2⤵
  PID:6180
- C:\Windows\System\HYpWCvO.exe
  C:\Windows\System\HYpWCvO.exe
  2⤵
  PID:6204
- C:\Windows\System\EKQyzty.exe
  C:\Windows\System\EKQyzty.exe
  2⤵
  PID:6336
- C:\Windows\System\Oetvwdi.exe
  C:\Windows\System\Oetvwdi.exe
  2⤵
  PID:6400
- C:\Windows\System\UqTDFuv.exe
  C:\Windows\System\UqTDFuv.exe
  2⤵
  PID:6448
- C:\Windows\System\uJWwyvo.exe
  C:\Windows\System\uJWwyvo.exe
  2⤵
  PID:6544
- C:\Windows\System\OFwlJJy.exe
  C:\Windows\System\OFwlJJy.exe
  2⤵
  PID:6596
- C:\Windows\System\VvGpXRT.exe
  C:\Windows\System\VvGpXRT.exe
  2⤵
  PID:6656
- C:\Windows\System\jxWTdAh.exe
  C:\Windows\System\jxWTdAh.exe
  2⤵
  PID:6728
- C:\Windows\System\piMbRpy.exe
  C:\Windows\System\piMbRpy.exe
  2⤵
  PID:6840
- C:\Windows\System\kWBtqDp.exe
  C:\Windows\System\kWBtqDp.exe
  2⤵
  PID:6912
- C:\Windows\System\LlUQoFR.exe
  C:\Windows\System\LlUQoFR.exe
  2⤵
  PID:6956
- C:\Windows\System\dAHaNPb.exe
  C:\Windows\System\dAHaNPb.exe
  2⤵
  PID:7024
- C:\Windows\System\uHGNnZJ.exe
  C:\Windows\System\uHGNnZJ.exe
  2⤵
  PID:7104
- C:\Windows\System\NQgSJgO.exe
  C:\Windows\System\NQgSJgO.exe
  2⤵
  PID:7164
- C:\Windows\System\bPosmUZ.exe
  C:\Windows\System\bPosmUZ.exe
  2⤵
  PID:6256
- C:\Windows\System\eqYyVyP.exe
  C:\Windows\System\eqYyVyP.exe
  2⤵
  PID:6344
- C:\Windows\System\QnPkhQb.exe
  C:\Windows\System\QnPkhQb.exe
  2⤵
  PID:6568
- C:\Windows\System\sheriJb.exe
  C:\Windows\System\sheriJb.exe
  2⤵
  PID:6764
- C:\Windows\System\MDGetoD.exe
  C:\Windows\System\MDGetoD.exe
  2⤵
  PID:6952
- C:\Windows\System\JbCbjEQ.exe
  C:\Windows\System\JbCbjEQ.exe
  2⤵
  PID:5772
- C:\Windows\System\FnfXlCG.exe
  C:\Windows\System\FnfXlCG.exe
  2⤵
  PID:6396
- C:\Windows\System\vRLTvKV.exe
  C:\Windows\System\vRLTvKV.exe
  2⤵
  PID:6928
- C:\Windows\System\FdTDpeL.exe
  C:\Windows\System\FdTDpeL.exe
  2⤵
  PID:1852
- C:\Windows\System\dShnLJv.exe
  C:\Windows\System\dShnLJv.exe
  2⤵
  PID:6172
- C:\Windows\System\SKtGZzZ.exe
  C:\Windows\System\SKtGZzZ.exe
  2⤵
  PID:6768
- C:\Windows\System\fPSUBXd.exe
  C:\Windows\System\fPSUBXd.exe
  2⤵
  PID:7196
- C:\Windows\System\yXkccSl.exe
  C:\Windows\System\yXkccSl.exe
  2⤵
  PID:7240
- C:\Windows\System\JIsowKP.exe
  C:\Windows\System\JIsowKP.exe
  2⤵
  PID:7276
- C:\Windows\System\CNJihRW.exe
  C:\Windows\System\CNJihRW.exe
  2⤵
  PID:7304
- C:\Windows\System\fTWgZAY.exe
  C:\Windows\System\fTWgZAY.exe
  2⤵
  PID:7324
- C:\Windows\System\YsIfone.exe
  C:\Windows\System\YsIfone.exe
  2⤵
  PID:7376
- C:\Windows\System\dunrhGJ.exe
  C:\Windows\System\dunrhGJ.exe
  2⤵
  PID:7416
- C:\Windows\System\GuBJxxC.exe
  C:\Windows\System\GuBJxxC.exe
  2⤵
  PID:7496
- C:\Windows\System\Brtuhgx.exe
  C:\Windows\System\Brtuhgx.exe
  2⤵
  PID:7536
- C:\Windows\System\ZgpsCys.exe
  C:\Windows\System\ZgpsCys.exe
  2⤵
  PID:7556
- C:\Windows\System\vPatRCN.exe
  C:\Windows\System\vPatRCN.exe
  2⤵
  PID:7580
- C:\Windows\System\JIbadPa.exe
  C:\Windows\System\JIbadPa.exe
  2⤵
  PID:7608
- C:\Windows\System\QEWlrmz.exe
  C:\Windows\System\QEWlrmz.exe
  2⤵
  PID:7644
- C:\Windows\System\WRPhxqf.exe
  C:\Windows\System\WRPhxqf.exe
  2⤵
  PID:7672
- C:\Windows\System\zOAbxDb.exe
  C:\Windows\System\zOAbxDb.exe
  2⤵
  PID:7704
- C:\Windows\System\CEuqtgb.exe
  C:\Windows\System\CEuqtgb.exe
  2⤵
  PID:7736
- C:\Windows\System\XaOFWCa.exe
  C:\Windows\System\XaOFWCa.exe
  2⤵
  PID:7764
- C:\Windows\System\aFvDNCO.exe
  C:\Windows\System\aFvDNCO.exe
  2⤵
  PID:7792
- C:\Windows\System\eHExYTh.exe
  C:\Windows\System\eHExYTh.exe
  2⤵
  PID:7828
- C:\Windows\System\zstdQFT.exe
  C:\Windows\System\zstdQFT.exe
  2⤵
  PID:7868
- C:\Windows\System\ArlIaYq.exe
  C:\Windows\System\ArlIaYq.exe
  2⤵
  PID:7896
- C:\Windows\System\igNIWJS.exe
  C:\Windows\System\igNIWJS.exe
  2⤵
  PID:7912
- C:\Windows\System\IMIyRqy.exe
  C:\Windows\System\IMIyRqy.exe
  2⤵
  PID:7944
- C:\Windows\System\wUIBGhb.exe
  C:\Windows\System\wUIBGhb.exe
  2⤵
  PID:7972
- C:\Windows\System\EUlLsvT.exe
  C:\Windows\System\EUlLsvT.exe
  2⤵
  PID:8000
- C:\Windows\System\AaodLoz.exe
  C:\Windows\System\AaodLoz.exe
  2⤵
  PID:8028
- C:\Windows\System\RERyaAN.exe
  C:\Windows\System\RERyaAN.exe
  2⤵
  PID:8056
- C:\Windows\System\ZrDRmPu.exe
  C:\Windows\System\ZrDRmPu.exe
  2⤵
  PID:8084
- C:\Windows\System\DgyGonb.exe
  C:\Windows\System\DgyGonb.exe
  2⤵
  PID:8112
- C:\Windows\System\DygUtqF.exe
  C:\Windows\System\DygUtqF.exe
  2⤵
  PID:8140
- C:\Windows\System\keOWnrb.exe
  C:\Windows\System\keOWnrb.exe
  2⤵
  PID:8168
- C:\Windows\System\ebFzkgb.exe
  C:\Windows\System\ebFzkgb.exe
  2⤵
  PID:7184
- C:\Windows\System\agnQGBo.exe
  C:\Windows\System\agnQGBo.exe
  2⤵
  PID:7272
- C:\Windows\System\AcVvhQw.exe
  C:\Windows\System\AcVvhQw.exe
  2⤵
  PID:7336
- C:\Windows\System\HpuLeEA.exe
  C:\Windows\System\HpuLeEA.exe
  2⤵
  PID:7444
- C:\Windows\System\XOSWshq.exe
  C:\Windows\System\XOSWshq.exe
  2⤵
  PID:7436
- C:\Windows\System\amQWcxh.exe
  C:\Windows\System\amQWcxh.exe
  2⤵
  PID:7532
- C:\Windows\System\vtAtBjE.exe
  C:\Windows\System\vtAtBjE.exe
  2⤵
  PID:7592
- C:\Windows\System\hoViYZZ.exe
  C:\Windows\System\hoViYZZ.exe
  2⤵
  PID:7664
- C:\Windows\System\lvaHDsw.exe
  C:\Windows\System\lvaHDsw.exe
  2⤵
  PID:7696
- C:\Windows\System\zPBYSfx.exe
  C:\Windows\System\zPBYSfx.exe
  2⤵
  PID:7760
- C:\Windows\System\kixmwuT.exe
  C:\Windows\System\kixmwuT.exe
  2⤵
  PID:7804
- C:\Windows\System\VlFmYve.exe
  C:\Windows\System\VlFmYve.exe
  2⤵
  PID:7512
- C:\Windows\System\wVJGqqb.exe
  C:\Windows\System\wVJGqqb.exe
  2⤵
  PID:7932
- C:\Windows\System\xeWGRVo.exe
  C:\Windows\System\xeWGRVo.exe
  2⤵
  PID:8020
- C:\Windows\System\jOdrORS.exe
  C:\Windows\System\jOdrORS.exe
  2⤵
  PID:8080
- C:\Windows\System\teuKtNr.exe
  C:\Windows\System\teuKtNr.exe
  2⤵
  PID:8160
- C:\Windows\System\vKkjOXt.exe
  C:\Windows\System\vKkjOXt.exe
  2⤵
  PID:7236
- C:\Windows\System\mPsYxBe.exe
  C:\Windows\System\mPsYxBe.exe
  2⤵
  PID:7412
- C:\Windows\System\aXUDfZB.exe
  C:\Windows\System\aXUDfZB.exe
  2⤵
  PID:7548
- C:\Windows\System\DgKCiqq.exe
  C:\Windows\System\DgKCiqq.exe
  2⤵
  PID:7748
- C:\Windows\System\vuYtjLU.exe
  C:\Windows\System\vuYtjLU.exe
  2⤵
  PID:7864
- C:\Windows\System\MuYiSZu.exe
  C:\Windows\System\MuYiSZu.exe
  2⤵
  PID:7992
- C:\Windows\System\CEooGGw.exe
  C:\Windows\System\CEooGGw.exe
  2⤵
  PID:8132
- C:\Windows\System\GaoZYyP.exe
  C:\Windows\System\GaoZYyP.exe
  2⤵
  PID:7408
- C:\Windows\System\laUIXgD.exe
  C:\Windows\System\laUIXgD.exe
  2⤵
  PID:7788
- C:\Windows\System\zxsIQOq.exe
  C:\Windows\System\zxsIQOq.exe
  2⤵
  PID:8076
- C:\Windows\System\AZAOKIx.exe
  C:\Windows\System\AZAOKIx.exe
  2⤵
  PID:8048
- C:\Windows\System\agBfZUC.exe
  C:\Windows\System\agBfZUC.exe
  2⤵
  PID:4616
- C:\Windows\System\ngSpfiM.exe
  C:\Windows\System\ngSpfiM.exe
  2⤵
  PID:8232
- C:\Windows\System\vaCgTwH.exe
  C:\Windows\System\vaCgTwH.exe
  2⤵
  PID:8260
- C:\Windows\System\lDkUnKN.exe
  C:\Windows\System\lDkUnKN.exe
  2⤵
  PID:8288
- C:\Windows\System\UnhJOaT.exe
  C:\Windows\System\UnhJOaT.exe
  2⤵
  PID:8316
- C:\Windows\System\iESfvXd.exe
  C:\Windows\System\iESfvXd.exe
  2⤵
  PID:8344
- C:\Windows\System\IqqXlrc.exe
  C:\Windows\System\IqqXlrc.exe
  2⤵
  PID:8360
- C:\Windows\System\ZhndJum.exe
  C:\Windows\System\ZhndJum.exe
  2⤵
  PID:8412
- C:\Windows\System\gnVudoO.exe
  C:\Windows\System\gnVudoO.exe
  2⤵
  PID:8432
- C:\Windows\System\ONahuEa.exe
  C:\Windows\System\ONahuEa.exe
  2⤵
  PID:8460
- C:\Windows\System\lwGfxOD.exe
  C:\Windows\System\lwGfxOD.exe
  2⤵
  PID:8488
- C:\Windows\System\diHLhix.exe
  C:\Windows\System\diHLhix.exe
  2⤵
  PID:8516
- C:\Windows\System\GfMaPjh.exe
  C:\Windows\System\GfMaPjh.exe
  2⤵
  PID:8544
- C:\Windows\System\EBcYLfy.exe
  C:\Windows\System\EBcYLfy.exe
  2⤵
  PID:8572
- C:\Windows\System\TyiyHlZ.exe
  C:\Windows\System\TyiyHlZ.exe
  2⤵
  PID:8600
- C:\Windows\System\dCvzyWV.exe
  C:\Windows\System\dCvzyWV.exe
  2⤵
  PID:8632
- C:\Windows\System\eFIlovR.exe
  C:\Windows\System\eFIlovR.exe
  2⤵
  PID:8660
- C:\Windows\System\MlTrfoM.exe
  C:\Windows\System\MlTrfoM.exe
  2⤵
  PID:8688
- C:\Windows\System\XxgkwrC.exe
  C:\Windows\System\XxgkwrC.exe
  2⤵
  PID:8716
- C:\Windows\System\hVTCqLM.exe
  C:\Windows\System\hVTCqLM.exe
  2⤵
  PID:8744
- C:\Windows\System\TRDmMyo.exe
  C:\Windows\System\TRDmMyo.exe
  2⤵
  PID:8776
- C:\Windows\System\LzEaldd.exe
  C:\Windows\System\LzEaldd.exe
  2⤵
  PID:8804
- C:\Windows\System\hQbcHWR.exe
  C:\Windows\System\hQbcHWR.exe
  2⤵
  PID:8832
- C:\Windows\System\ZIgwiPg.exe
  C:\Windows\System\ZIgwiPg.exe
  2⤵
  PID:8860
- C:\Windows\System\xgtAPMz.exe
  C:\Windows\System\xgtAPMz.exe
  2⤵
  PID:8888
- C:\Windows\System\TiOycLy.exe
  C:\Windows\System\TiOycLy.exe
  2⤵
  PID:8920
- C:\Windows\System\VKzsCQh.exe
  C:\Windows\System\VKzsCQh.exe
  2⤵
  PID:8948
- C:\Windows\System\gwQGKDp.exe
  C:\Windows\System\gwQGKDp.exe
  2⤵
  PID:8976
- C:\Windows\System\hwUjujs.exe
  C:\Windows\System\hwUjujs.exe
  2⤵
  PID:9004
- C:\Windows\System\VGmLleA.exe
  C:\Windows\System\VGmLleA.exe
  2⤵
  PID:9032
- C:\Windows\System\aGupNPm.exe
  C:\Windows\System\aGupNPm.exe
  2⤵
  PID:9060
- C:\Windows\System\iOwJTDc.exe
  C:\Windows\System\iOwJTDc.exe
  2⤵
  PID:9088
- C:\Windows\System\ZwXUcAg.exe
  C:\Windows\System\ZwXUcAg.exe
  2⤵
  PID:9116
- C:\Windows\System\PezCCSz.exe
  C:\Windows\System\PezCCSz.exe
  2⤵
  PID:9144
- C:\Windows\System\bpKRVNr.exe
  C:\Windows\System\bpKRVNr.exe
  2⤵
  PID:9172
- C:\Windows\System\RtLkOPO.exe
  C:\Windows\System\RtLkOPO.exe
  2⤵
  PID:9200
- C:\Windows\System\NpEAQHi.exe
  C:\Windows\System\NpEAQHi.exe
  2⤵
  PID:8108
- C:\Windows\System\IXFgljG.exe
  C:\Windows\System\IXFgljG.exe
  2⤵
  PID:8272
- C:\Windows\System\gcHztzi.exe
  C:\Windows\System\gcHztzi.exe
  2⤵
  PID:8336
- C:\Windows\System\uxhCIAr.exe
  C:\Windows\System\uxhCIAr.exe
  2⤵
  PID:8404
- C:\Windows\System\ExcNxVa.exe
  C:\Windows\System\ExcNxVa.exe
  2⤵
  PID:8448
- C:\Windows\System\WQzzZze.exe
  C:\Windows\System\WQzzZze.exe
  2⤵
  PID:8508
- C:\Windows\System\bZOlvWi.exe
  C:\Windows\System\bZOlvWi.exe
  2⤵
  PID:8568
- C:\Windows\System\vVFySug.exe
  C:\Windows\System\vVFySug.exe
  2⤵
  PID:8652
- C:\Windows\System\qsKbczy.exe
  C:\Windows\System\qsKbczy.exe
  2⤵
  PID:8708
- C:\Windows\System\nihZJee.exe
  C:\Windows\System\nihZJee.exe
  2⤵
  PID:8772
- C:\Windows\System\ktBWpwF.exe
  C:\Windows\System\ktBWpwF.exe
  2⤵
  PID:8844
- C:\Windows\System\nKudzRH.exe
  C:\Windows\System\nKudzRH.exe
  2⤵
  PID:8896
- C:\Windows\System\ECmUzEC.exe
  C:\Windows\System\ECmUzEC.exe
  2⤵
  PID:9028
- C:\Windows\System\FHLamFJ.exe
  C:\Windows\System\FHLamFJ.exe
  2⤵
  PID:9056
- C:\Windows\System\QqMrbzm.exe
  C:\Windows\System\QqMrbzm.exe
  2⤵
  PID:9128
- C:\Windows\System\sPzvoch.exe
  C:\Windows\System\sPzvoch.exe
  2⤵
  PID:9196
- C:\Windows\System\UTLNgPr.exe
  C:\Windows\System\UTLNgPr.exe
  2⤵
  PID:8284
- C:\Windows\System\JqZrmWb.exe
  C:\Windows\System\JqZrmWb.exe
  2⤵
  PID:8392
- C:\Windows\System\lSjVnPA.exe
  C:\Windows\System\lSjVnPA.exe
  2⤵
  PID:8596
- C:\Windows\System\ueZDNXU.exe
  C:\Windows\System\ueZDNXU.exe
  2⤵
  PID:8684
- C:\Windows\System\nGZcvAP.exe
  C:\Windows\System\nGZcvAP.exe
  2⤵
  PID:8916
- C:\Windows\System\yHNwXxn.exe
  C:\Windows\System\yHNwXxn.exe
  2⤵
  PID:2296
- C:\Windows\System\PXwuSgA.exe
  C:\Windows\System\PXwuSgA.exe
  2⤵
  PID:8968
- C:\Windows\System\joWOmHv.exe
  C:\Windows\System\joWOmHv.exe
  2⤵
  PID:9184
- C:\Windows\System\PGMlyUT.exe
  C:\Windows\System\PGMlyUT.exe
  2⤵
  PID:8424
- C:\Windows\System\TkCsbei.exe
  C:\Windows\System\TkCsbei.exe
  2⤵
  PID:8800
- C:\Windows\System\dtFjhyt.exe
  C:\Windows\System\dtFjhyt.exe
  2⤵
  PID:8628
- C:\Windows\System\YaYnNhW.exe
  C:\Windows\System\YaYnNhW.exe
  2⤵
  PID:8428
- C:\Windows\System\xTDWTYB.exe
  C:\Windows\System\xTDWTYB.exe
  2⤵
  PID:8960
- C:\Windows\System\ukMeRTn.exe
  C:\Windows\System\ukMeRTn.exe
  2⤵
  PID:9228
- C:\Windows\System\LMKGRbB.exe
  C:\Windows\System\LMKGRbB.exe
  2⤵
  PID:9256
- C:\Windows\System\LQYXeVB.exe
  C:\Windows\System\LQYXeVB.exe
  2⤵
  PID:9284
- C:\Windows\System\LseLPZO.exe
  C:\Windows\System\LseLPZO.exe
  2⤵
  PID:9312
- C:\Windows\System\OSBgDxE.exe
  C:\Windows\System\OSBgDxE.exe
  2⤵
  PID:9348
- C:\Windows\System\PSYGmrE.exe
  C:\Windows\System\PSYGmrE.exe
  2⤵
  PID:9368
- C:\Windows\System\guzGgnD.exe
  C:\Windows\System\guzGgnD.exe
  2⤵
  PID:9396
- C:\Windows\System\SMWTGaH.exe
  C:\Windows\System\SMWTGaH.exe
  2⤵
  PID:9424
- C:\Windows\System\zXqwgDP.exe
  C:\Windows\System\zXqwgDP.exe
  2⤵
  PID:9452
- C:\Windows\System\ExGuTFk.exe
  C:\Windows\System\ExGuTFk.exe
  2⤵
  PID:9480
- C:\Windows\System\tiIWSQO.exe
  C:\Windows\System\tiIWSQO.exe
  2⤵
  PID:9508
- C:\Windows\System\AcCucyY.exe
  C:\Windows\System\AcCucyY.exe
  2⤵
  PID:9536
- C:\Windows\System\fUHxvqo.exe
  C:\Windows\System\fUHxvqo.exe
  2⤵
  PID:9572
- C:\Windows\System\XIddGeq.exe
  C:\Windows\System\XIddGeq.exe
  2⤵
  PID:9600
- C:\Windows\System\dvHbrkM.exe
  C:\Windows\System\dvHbrkM.exe
  2⤵
  PID:9628
- C:\Windows\System\MwhcPkF.exe
  C:\Windows\System\MwhcPkF.exe
  2⤵
  PID:9656
- C:\Windows\System\JcPPtEs.exe
  C:\Windows\System\JcPPtEs.exe
  2⤵
  PID:9684
- C:\Windows\System\mFXgoCm.exe
  C:\Windows\System\mFXgoCm.exe
  2⤵
  PID:9712
- C:\Windows\System\DbDOyES.exe
  C:\Windows\System\DbDOyES.exe
  2⤵
  PID:9740
- C:\Windows\System\Ekqxlvc.exe
  C:\Windows\System\Ekqxlvc.exe
  2⤵
  PID:9768
- C:\Windows\System\zoMmEDf.exe
  C:\Windows\System\zoMmEDf.exe
  2⤵
  PID:9792
- C:\Windows\System\acXBbae.exe
  C:\Windows\System\acXBbae.exe
  2⤵
  PID:9816
- C:\Windows\System\milCoZY.exe
  C:\Windows\System\milCoZY.exe
  2⤵
  PID:9832
- C:\Windows\System\SilWWoy.exe
  C:\Windows\System\SilWWoy.exe
  2⤵
  PID:9852
- C:\Windows\System\NqbGQZG.exe
  C:\Windows\System\NqbGQZG.exe
  2⤵
  PID:9892
- C:\Windows\System\CJOUptD.exe
  C:\Windows\System\CJOUptD.exe
  2⤵
  PID:9916
- C:\Windows\System\UXqCGsh.exe
  C:\Windows\System\UXqCGsh.exe
  2⤵
  PID:9948
- C:\Windows\System\hwVtAhg.exe
  C:\Windows\System\hwVtAhg.exe
  2⤵
  PID:10000
- C:\Windows\System\bIIRmop.exe
  C:\Windows\System\bIIRmop.exe
  2⤵
  PID:10032
- C:\Windows\System\nGPxHDS.exe
  C:\Windows\System\nGPxHDS.exe
  2⤵
  PID:10060
- C:\Windows\System\FSSOtzJ.exe
  C:\Windows\System\FSSOtzJ.exe
  2⤵
  PID:10088
- C:\Windows\System\jGtwKUI.exe
  C:\Windows\System\jGtwKUI.exe
  2⤵
  PID:10116
- C:\Windows\System\UKfCKgx.exe
  C:\Windows\System\UKfCKgx.exe
  2⤵
  PID:10148
- C:\Windows\System\XKmukGi.exe
  C:\Windows\System\XKmukGi.exe
  2⤵
  PID:10176
- C:\Windows\System\saAqyDp.exe
  C:\Windows\System\saAqyDp.exe
  2⤵
  PID:10204
- C:\Windows\System\qMsOkRR.exe
  C:\Windows\System\qMsOkRR.exe
  2⤵
  PID:10232
- C:\Windows\System\OiHZEkZ.exe
  C:\Windows\System\OiHZEkZ.exe
  2⤵
  PID:9248
- C:\Windows\System\IhvUMsx.exe
  C:\Windows\System\IhvUMsx.exe
  2⤵
  PID:9308
- C:\Windows\System\ynmusOm.exe
  C:\Windows\System\ynmusOm.exe
  2⤵
  PID:9420
- C:\Windows\System\WLCdVJJ.exe
  C:\Windows\System\WLCdVJJ.exe
  2⤵
  PID:9448
- C:\Windows\System\qJrvWiz.exe
  C:\Windows\System\qJrvWiz.exe
  2⤵
  PID:9520
- C:\Windows\System\AYmZoEz.exe
  C:\Windows\System\AYmZoEz.exe
  2⤵
  PID:9564
- C:\Windows\System\akaeoBR.exe
  C:\Windows\System\akaeoBR.exe
  2⤵
  PID:9648
- C:\Windows\System\QNRhOTn.exe
  C:\Windows\System\QNRhOTn.exe
  2⤵
  PID:9732
- C:\Windows\System\mNhMOmK.exe
  C:\Windows\System\mNhMOmK.exe
  2⤵
  PID:9804
- C:\Windows\System\XiwasAq.exe
  C:\Windows\System\XiwasAq.exe
  2⤵
  PID:9868
- C:\Windows\System\xWpJTRm.exe
  C:\Windows\System\xWpJTRm.exe
  2⤵
  PID:9884
- C:\Windows\System\RELoBVv.exe
  C:\Windows\System\RELoBVv.exe
  2⤵
  PID:9928
- C:\Windows\System\bPgJaff.exe
  C:\Windows\System\bPgJaff.exe
  2⤵
  PID:10016
- C:\Windows\System\naAasXm.exe
  C:\Windows\System\naAasXm.exe
  2⤵
  PID:3640
- C:\Windows\System\ShAHfeK.exe
  C:\Windows\System\ShAHfeK.exe
  2⤵
  PID:4540
- C:\Windows\System\vPdIEbW.exe
  C:\Windows\System\vPdIEbW.exe
  2⤵
  PID:10200
- C:\Windows\System\wtGAErF.exe
  C:\Windows\System\wtGAErF.exe
  2⤵
  PID:9304
- C:\Windows\System\DjcqSwT.exe
  C:\Windows\System\DjcqSwT.exe
  2⤵
  PID:3104
- C:\Windows\System\zcfjlSa.exe
  C:\Windows\System\zcfjlSa.exe
  2⤵
  PID:9444
- C:\Windows\System\FVCZEyc.exe
  C:\Windows\System\FVCZEyc.exe
  2⤵
  PID:8756
- C:\Windows\System\YaZpXyk.exe
  C:\Windows\System\YaZpXyk.exe
  2⤵
  PID:9676
- C:\Windows\System\iPWKrsW.exe
  C:\Windows\System\iPWKrsW.exe
  2⤵
  PID:2096
- C:\Windows\System\ntwULVn.exe
  C:\Windows\System\ntwULVn.exe
  2⤵
  PID:9828
- C:\Windows\System\MVKdBzR.exe
  C:\Windows\System\MVKdBzR.exe
  2⤵
  PID:9944
- C:\Windows\System\cOloqls.exe
  C:\Windows\System\cOloqls.exe
  2⤵
  PID:9992
- C:\Windows\System\gwwJvlK.exe
  C:\Windows\System\gwwJvlK.exe
  2⤵
  PID:10144
- C:\Windows\System\oksAiki.exe
  C:\Windows\System\oksAiki.exe
  2⤵
  PID:9240
- C:\Windows\System\nQwAZoq.exe
  C:\Windows\System\nQwAZoq.exe
  2⤵
  PID:9776
- C:\Windows\System\gxNajfo.exe
  C:\Windows\System\gxNajfo.exe
  2⤵
  PID:4584
- C:\Windows\System\HcnABIN.exe
  C:\Windows\System\HcnABIN.exe
  2⤵
  PID:9844
- C:\Windows\System\fGbdQbm.exe
  C:\Windows\System\fGbdQbm.exe
  2⤵
  PID:1332
- C:\Windows\System\atACqNc.exe
  C:\Windows\System\atACqNc.exe
  2⤵
  PID:3960
- C:\Windows\System\XziPRsO.exe
  C:\Windows\System\XziPRsO.exe
  2⤵
  PID:4048
- C:\Windows\System\IUGeqmu.exe
  C:\Windows\System\IUGeqmu.exe
  2⤵
  PID:10112
- C:\Windows\System\bTAdeSz.exe
  C:\Windows\System\bTAdeSz.exe
  2⤵
  PID:3036
- C:\Windows\System\RjNSYIJ.exe
  C:\Windows\System\RjNSYIJ.exe
  2⤵
  PID:4404
- C:\Windows\System\zulZNFQ.exe
  C:\Windows\System\zulZNFQ.exe
  2⤵
  PID:10256
- C:\Windows\System\HGwFLWp.exe
  C:\Windows\System\HGwFLWp.exe
  2⤵
  PID:10288
- C:\Windows\System\zzsTcPb.exe
  C:\Windows\System\zzsTcPb.exe
  2⤵
  PID:10312
- C:\Windows\System\ygJazWf.exe
  C:\Windows\System\ygJazWf.exe
  2⤵
  PID:10340
- C:\Windows\System\lLQOgji.exe
  C:\Windows\System\lLQOgji.exe
  2⤵
  PID:10368
- C:\Windows\System\FzcaxDL.exe
  C:\Windows\System\FzcaxDL.exe
  2⤵
  PID:10396
- C:\Windows\System\KZEvLff.exe
  C:\Windows\System\KZEvLff.exe
  2⤵
  PID:10424
- C:\Windows\System\NyRpyAf.exe
  C:\Windows\System\NyRpyAf.exe
  2⤵
  PID:10452
- C:\Windows\System\BgWdvwx.exe
  C:\Windows\System\BgWdvwx.exe
  2⤵
  PID:10488
- C:\Windows\System\ahjdpCw.exe
  C:\Windows\System\ahjdpCw.exe
  2⤵
  PID:10504
- C:\Windows\System\qKBhbYx.exe
  C:\Windows\System\qKBhbYx.exe
  2⤵
  PID:10528
- C:\Windows\System\Zyaplaj.exe
  C:\Windows\System\Zyaplaj.exe
  2⤵
  PID:10556
- C:\Windows\System\XqIrJng.exe
  C:\Windows\System\XqIrJng.exe
  2⤵
  PID:10620
- C:\Windows\System\MxKkAFc.exe
  C:\Windows\System\MxKkAFc.exe
  2⤵
  PID:10660
- C:\Windows\System\eAYVxpI.exe
  C:\Windows\System\eAYVxpI.exe
  2⤵
  PID:10676
- C:\Windows\System\pGoOVUi.exe
  C:\Windows\System\pGoOVUi.exe
  2⤵
  PID:10692
- C:\Windows\System\anLNtin.exe
  C:\Windows\System\anLNtin.exe
  2⤵
  PID:10708
- C:\Windows\System\HTDFSNZ.exe
  C:\Windows\System\HTDFSNZ.exe
  2⤵
  PID:10760
- C:\Windows\System\GKgFLdG.exe
  C:\Windows\System\GKgFLdG.exe
  2⤵
  PID:10796
- C:\Windows\System\GTLbdxx.exe
  C:\Windows\System\GTLbdxx.exe
  2⤵
  PID:10824
- C:\Windows\System\AVoISFs.exe
  C:\Windows\System\AVoISFs.exe
  2⤵
  PID:10856
- C:\Windows\System\ZfSxFan.exe
  C:\Windows\System\ZfSxFan.exe
  2⤵
  PID:10888
- C:\Windows\System\XVxEFEo.exe
  C:\Windows\System\XVxEFEo.exe
  2⤵
  PID:10916
- C:\Windows\System\wZirAjx.exe
  C:\Windows\System\wZirAjx.exe
  2⤵
  PID:10944
- C:\Windows\System\ngVhyWQ.exe
  C:\Windows\System\ngVhyWQ.exe
  2⤵
  PID:10972
- C:\Windows\System\czQSton.exe
  C:\Windows\System\czQSton.exe
  2⤵
  PID:11000
- C:\Windows\System\RlYsjoc.exe
  C:\Windows\System\RlYsjoc.exe
  2⤵
  PID:11028
- C:\Windows\System\fulNuMH.exe
  C:\Windows\System\fulNuMH.exe
  2⤵
  PID:11056
- C:\Windows\System\dyuMaWr.exe
  C:\Windows\System\dyuMaWr.exe
  2⤵
  PID:11084
- C:\Windows\System\LMDAOmh.exe
  C:\Windows\System\LMDAOmh.exe
  2⤵
  PID:11112
- C:\Windows\System\NfoDOKf.exe
  C:\Windows\System\NfoDOKf.exe
  2⤵
  PID:11140
- C:\Windows\System\XfrgcBC.exe
  C:\Windows\System\XfrgcBC.exe
  2⤵
  PID:11168
- C:\Windows\System\tvpdIAy.exe
  C:\Windows\System\tvpdIAy.exe
  2⤵
  PID:11196
- C:\Windows\System\daydUwH.exe
  C:\Windows\System\daydUwH.exe
  2⤵
  PID:11228
- C:\Windows\System\fAiYlvY.exe
  C:\Windows\System\fAiYlvY.exe
  2⤵
  PID:11256
- C:\Windows\System\CNIISUL.exe
  C:\Windows\System\CNIISUL.exe
  2⤵
  PID:10280
- C:\Windows\System\BoSrRIl.exe
  C:\Windows\System\BoSrRIl.exe
  2⤵
  PID:10352
- C:\Windows\System\djqxnVx.exe
  C:\Windows\System\djqxnVx.exe
  2⤵
  PID:10392
- C:\Windows\System\rdoWmTc.exe
  C:\Windows\System\rdoWmTc.exe
  2⤵
  PID:10448
- C:\Windows\System\sIKndON.exe
  C:\Windows\System\sIKndON.exe
  2⤵
  PID:10524
- C:\Windows\System\LwoOHAe.exe
  C:\Windows\System\LwoOHAe.exe
  2⤵
  PID:10596
- C:\Windows\System\ipxpfoy.exe
  C:\Windows\System\ipxpfoy.exe
  2⤵
  PID:10668
- C:\Windows\System\vdkIGJs.exe
  C:\Windows\System\vdkIGJs.exe
  2⤵
  PID:10688
- C:\Windows\System\KsENLpR.exe
  C:\Windows\System\KsENLpR.exe
  2⤵
  PID:10780
- C:\Windows\System\WtxhMyd.exe
  C:\Windows\System\WtxhMyd.exe
  2⤵
  PID:10816
- C:\Windows\System\blNsVdQ.exe
  C:\Windows\System\blNsVdQ.exe
  2⤵
  PID:10868
- C:\Windows\System\LGWMGLj.exe
  C:\Windows\System\LGWMGLj.exe
  2⤵
  PID:1180
- C:\Windows\System\pOfoawL.exe
  C:\Windows\System\pOfoawL.exe
  2⤵
  PID:10984
- C:\Windows\System\bepNIXR.exe
  C:\Windows\System\bepNIXR.exe
  2⤵
  PID:11024
- C:\Windows\System\VEpInDb.exe
  C:\Windows\System\VEpInDb.exe
  2⤵
  PID:9552
- C:\Windows\System\svFUneZ.exe
  C:\Windows\System\svFUneZ.exe
  2⤵
  PID:11136
- C:\Windows\System\BYBNnPf.exe
  C:\Windows\System\BYBNnPf.exe
  2⤵
  PID:11212
- C:\Windows\System\mLeSaKd.exe
  C:\Windows\System\mLeSaKd.exe
  2⤵
  PID:11252
- C:\Windows\System\SMbBNNT.exe
  C:\Windows\System\SMbBNNT.exe
  2⤵
  PID:3636
- C:\Windows\System\ptaytER.exe
  C:\Windows\System\ptaytER.exe
  2⤵
  PID:10520
- C:\Windows\System\jGddfLU.exe
  C:\Windows\System\jGddfLU.exe
  2⤵
  PID:10684
- C:\Windows\System\gwBYaKF.exe
  C:\Windows\System\gwBYaKF.exe
  2⤵
  PID:10752
- C:\Windows\System\sdJrkHJ.exe
  C:\Windows\System\sdJrkHJ.exe
  2⤵
  PID:10912
- C:\Windows\System\ZJlSPVA.exe
  C:\Windows\System\ZJlSPVA.exe
  2⤵
  PID:9560
- C:\Windows\System\ddTRXMR.exe
  C:\Windows\System\ddTRXMR.exe
  2⤵
  PID:10268
- C:\Windows\System\jdrBmhb.exe
  C:\Windows\System\jdrBmhb.exe
  2⤵
  PID:10640
- C:\Windows\System\MYqOjpF.exe
  C:\Windows\System\MYqOjpF.exe
  2⤵
  PID:1580
- C:\Windows\System\yQLUlCm.exe
  C:\Windows\System\yQLUlCm.exe
  2⤵
  PID:11104
- C:\Windows\System\bjgohKA.exe
  C:\Windows\System\bjgohKA.exe
  2⤵
  PID:3308
- C:\Windows\System\ljPxzbn.exe
  C:\Windows\System\ljPxzbn.exe
  2⤵
  PID:4220
- C:\Windows\System\ievOiRY.exe
  C:\Windows\System\ievOiRY.exe
  2⤵
  PID:11052
- C:\Windows\System\mmcGlFu.exe
  C:\Windows\System\mmcGlFu.exe
  2⤵
  PID:10992
- C:\Windows\System\kbOPVQQ.exe
  C:\Windows\System\kbOPVQQ.exe
  2⤵
  PID:10544
- C:\Windows\System\spNHwRf.exe
  C:\Windows\System\spNHwRf.exe
  2⤵
  PID:11280
- C:\Windows\System\FzKaETb.exe
  C:\Windows\System\FzKaETb.exe
  2⤵
  PID:11308
- C:\Windows\System\aOFcZAR.exe
  C:\Windows\System\aOFcZAR.exe
  2⤵
  PID:11336
- C:\Windows\System\vgoVFhy.exe
  C:\Windows\System\vgoVFhy.exe
  2⤵
  PID:11364
- C:\Windows\System\yrMpRsv.exe
  C:\Windows\System\yrMpRsv.exe
  2⤵
  PID:11392
- C:\Windows\System\BoRGpAt.exe
  C:\Windows\System\BoRGpAt.exe
  2⤵
  PID:11408
- C:\Windows\System\IDHuIAZ.exe
  C:\Windows\System\IDHuIAZ.exe
  2⤵
  PID:11452
- C:\Windows\System\zEoePXt.exe
  C:\Windows\System\zEoePXt.exe
  2⤵
  PID:11480
- C:\Windows\System\YzGpcQs.exe
  C:\Windows\System\YzGpcQs.exe
  2⤵
  PID:11508
- C:\Windows\System\BURSlYb.exe
  C:\Windows\System\BURSlYb.exe
  2⤵
  PID:11536
- C:\Windows\System\WSPMsDj.exe
  C:\Windows\System\WSPMsDj.exe
  2⤵
  PID:11564
- C:\Windows\System\qAHwZjH.exe
  C:\Windows\System\qAHwZjH.exe
  2⤵
  PID:11592
- C:\Windows\System\QPqCJyi.exe
  C:\Windows\System\QPqCJyi.exe
  2⤵
  PID:11624
- C:\Windows\System\YNAvsqd.exe
  C:\Windows\System\YNAvsqd.exe
  2⤵
  PID:11652
- C:\Windows\System\TEcuDKY.exe
  C:\Windows\System\TEcuDKY.exe
  2⤵
  PID:11676
- C:\Windows\System\rJLiTeg.exe
  C:\Windows\System\rJLiTeg.exe
  2⤵
  PID:11712
- C:\Windows\System\aHlArOD.exe
  C:\Windows\System\aHlArOD.exe
  2⤵
  PID:11740
- C:\Windows\System\KKNybta.exe
  C:\Windows\System\KKNybta.exe
  2⤵
  PID:11768
- C:\Windows\System\eYWaXcL.exe
  C:\Windows\System\eYWaXcL.exe
  2⤵
  PID:11796
- C:\Windows\System\nfmlmfD.exe
  C:\Windows\System\nfmlmfD.exe
  2⤵
  PID:11824
- C:\Windows\System\cYHeWgo.exe
  C:\Windows\System\cYHeWgo.exe
  2⤵
  PID:11856
- C:\Windows\System\kXSEtrl.exe
  C:\Windows\System\kXSEtrl.exe
  2⤵
  PID:11884
- C:\Windows\System\EVswsQJ.exe
  C:\Windows\System\EVswsQJ.exe
  2⤵
  PID:11912
- C:\Windows\System\QkvhLhf.exe
  C:\Windows\System\QkvhLhf.exe
  2⤵
  PID:11944
- C:\Windows\System\XsNXFeg.exe
  C:\Windows\System\XsNXFeg.exe
  2⤵
  PID:11964
- C:\Windows\System\DcFXJWW.exe
  C:\Windows\System\DcFXJWW.exe
  2⤵
  PID:11996
- C:\Windows\System\YcfsyvM.exe
  C:\Windows\System\YcfsyvM.exe
  2⤵
  PID:12016
- C:\Windows\System\CorFLcA.exe
  C:\Windows\System\CorFLcA.exe
  2⤵
  PID:12064
- C:\Windows\System\yOPqBid.exe
  C:\Windows\System\yOPqBid.exe
  2⤵
  PID:12088
- C:\Windows\System\qMYhxdv.exe
  C:\Windows\System\qMYhxdv.exe
  2⤵
  PID:12116
- C:\Windows\System\SSCdzYD.exe
  C:\Windows\System\SSCdzYD.exe
  2⤵
  PID:12144
- C:\Windows\System\swZDwvO.exe
  C:\Windows\System\swZDwvO.exe
  2⤵
  PID:12176
- C:\Windows\System\zeBDyHg.exe
  C:\Windows\System\zeBDyHg.exe
  2⤵
  PID:12200
- C:\Windows\System\MPHSCtc.exe
  C:\Windows\System\MPHSCtc.exe
  2⤵
  PID:12240
- C:\Windows\System\yPgbTzJ.exe
  C:\Windows\System\yPgbTzJ.exe
  2⤵
  PID:12268
- C:\Windows\System\BGNwcSZ.exe
  C:\Windows\System\BGNwcSZ.exe
  2⤵
  PID:11276
- C:\Windows\System\yjUWHmi.exe
  C:\Windows\System\yjUWHmi.exe
  2⤵
  PID:11328
- C:\Windows\System\GhjgkPZ.exe
  C:\Windows\System\GhjgkPZ.exe
  2⤵
  PID:11384
- C:\Windows\System\OLblZru.exe
  C:\Windows\System\OLblZru.exe
  2⤵
  PID:11432
- C:\Windows\System\urkpgIm.exe
  C:\Windows\System\urkpgIm.exe
  2⤵
  PID:11500
- C:\Windows\System\pHFnCmd.exe
  C:\Windows\System\pHFnCmd.exe
  2⤵
  PID:11576
- C:\Windows\System\YJdWkup.exe
  C:\Windows\System\YJdWkup.exe
  2⤵
  PID:11608
- C:\Windows\System\nTnJSSk.exe
  C:\Windows\System\nTnJSSk.exe
  2⤵
  PID:11684
- C:\Windows\System\wgHmrhz.exe
  C:\Windows\System\wgHmrhz.exe
  2⤵
  PID:11808
- C:\Windows\System\RsLMtwk.exe
  C:\Windows\System\RsLMtwk.exe
  2⤵
  PID:11920
- C:\Windows\System\YjNqhyn.exe
  C:\Windows\System\YjNqhyn.exe
  2⤵
  PID:6036
- C:\Windows\System\zjFmcKM.exe
  C:\Windows\System\zjFmcKM.exe
  2⤵
  PID:11976
- C:\Windows\System\uCFeDhw.exe
  C:\Windows\System\uCFeDhw.exe
  2⤵
  PID:12044
- C:\Windows\System\IYXwRVG.exe
  C:\Windows\System\IYXwRVG.exe
  2⤵
  PID:12124
- C:\Windows\System\iuCwYDm.exe
  C:\Windows\System\iuCwYDm.exe
  2⤵
  PID:12196
- C:\Windows\System\iZJMnKX.exe
  C:\Windows\System\iZJMnKX.exe
  2⤵
  PID:12212
- C:\Windows\System\taQoRGi.exe
  C:\Windows\System\taQoRGi.exe
  2⤵
  PID:404
- C:\Windows\System\egItQSg.exe
  C:\Windows\System\egItQSg.exe
  2⤵
  PID:11376
- C:\Windows\System\YFEjErH.exe
  C:\Windows\System\YFEjErH.exe
  2⤵
  PID:11532
- C:\Windows\System\CyWBOHX.exe
  C:\Windows\System\CyWBOHX.exe
  2⤵
  PID:11588
- C:\Windows\System\QIsxabS.exe
  C:\Windows\System\QIsxabS.exe
  2⤵
  PID:11732
- C:\Windows\System\AlVgVMs.exe
  C:\Windows\System\AlVgVMs.exe
  2⤵
  PID:1228
- C:\Windows\System\RxuIYgM.exe
  C:\Windows\System\RxuIYgM.exe
  2⤵
  PID:11840
- C:\Windows\System\ygDMGkg.exe
  C:\Windows\System\ygDMGkg.exe
  2⤵
  PID:4804
- C:\Windows\System\LBZhODM.exe
  C:\Windows\System\LBZhODM.exe
  2⤵
  PID:4588
- C:\Windows\System\BlNjIsw.exe
  C:\Windows\System\BlNjIsw.exe
  2⤵
  PID:4752
- C:\Windows\System\yyMXiZz.exe
  C:\Windows\System\yyMXiZz.exe
  2⤵
  PID:3824
- C:\Windows\System\YLThTSa.exe
  C:\Windows\System\YLThTSa.exe
  2⤵
  PID:3956
- C:\Windows\System\unvAQoB.exe
  C:\Windows\System\unvAQoB.exe
  2⤵
  PID:4580
- C:\Windows\System\TLopTtj.exe
  C:\Windows\System\TLopTtj.exe
  2⤵
  PID:11852
- C:\Windows\System\QeHBYrr.exe
  C:\Windows\System\QeHBYrr.exe
  2⤵
  PID:6364
- C:\Windows\System\TGcalTi.exe
  C:\Windows\System\TGcalTi.exe
  2⤵
  PID:12012
- C:\Windows\System\bhqkcsi.exe
  C:\Windows\System\bhqkcsi.exe
  2⤵
  PID:12096
- C:\Windows\System\yipdYbO.exe
  C:\Windows\System\yipdYbO.exe
  2⤵
  PID:6480
- C:\Windows\System\JbzALcJ.exe
  C:\Windows\System\JbzALcJ.exe
  2⤵
  PID:12236
- C:\Windows\System\wVMOhcr.exe
  C:\Windows\System\wVMOhcr.exe
  2⤵
  PID:10484
- C:\Windows\System\sKPXStm.exe
  C:\Windows\System\sKPXStm.exe
  2⤵
  PID:1588
- C:\Windows\System\IrAwBEw.exe
  C:\Windows\System\IrAwBEw.exe
  2⤵
  PID:6760
- C:\Windows\System\QVinuCr.exe
  C:\Windows\System\QVinuCr.exe
  2⤵
  PID:11520
- C:\Windows\System\ajQQZDB.exe
  C:\Windows\System\ajQQZDB.exe
  2⤵
  PID:1076
- C:\Windows\System\CbkKgeq.exe
  C:\Windows\System\CbkKgeq.exe
  2⤵
  PID:5712
- C:\Windows\System\JbUGODh.exe
  C:\Windows\System\JbUGODh.exe
  2⤵
  PID:6972
- C:\Windows\System\NLelZFd.exe
  C:\Windows\System\NLelZFd.exe
  2⤵
  PID:7088
- C:\Windows\System\NXYuUiP.exe
  C:\Windows\System\NXYuUiP.exe
  2⤵
  PID:7120
- C:\Windows\System\QwIOwRS.exe
  C:\Windows\System\QwIOwRS.exe
  2⤵
  PID:7148
- C:\Windows\System\cXnYHKJ.exe
  C:\Windows\System\cXnYHKJ.exe
  2⤵
  PID:6300
- C:\Windows\System\NnGvKMh.exe
  C:\Windows\System\NnGvKMh.exe
  2⤵
  PID:3076
- C:\Windows\System\YOTAshE.exe
  C:\Windows\System\YOTAshE.exe
  2⤵
  PID:4172
- C:\Windows\System\EyxhkRK.exe
  C:\Windows\System\EyxhkRK.exe
  2⤵
  PID:11188
- C:\Windows\System\jZYKXZZ.exe
  C:\Windows\System\jZYKXZZ.exe
  2⤵
  PID:6640
- C:\Windows\System\JjWuucV.exe
  C:\Windows\System\JjWuucV.exe
  2⤵
  PID:11404
- C:\Windows\System\KLOKtLO.exe
  C:\Windows\System\KLOKtLO.exe
  2⤵
  PID:6724
- C:\Windows\System\NKSWdvP.exe
  C:\Windows\System\NKSWdvP.exe
  2⤵
  PID:6844
- C:\Windows\System\azumTvI.exe
  C:\Windows\System\azumTvI.exe
  2⤵
  PID:7064
- C:\Windows\System\pSmpcTI.exe
  C:\Windows\System\pSmpcTI.exe
  2⤵
  PID:5064
- C:\Windows\System\cAzqJGI.exe
  C:\Windows\System\cAzqJGI.exe
  2⤵
  PID:4388
- C:\Windows\System\LHWJjvG.exe
  C:\Windows\System\LHWJjvG.exe
  2⤵
  PID:6304
- C:\Windows\System\VDsuPbi.exe
  C:\Windows\System\VDsuPbi.exe
  2⤵
  PID:3580
- C:\Windows\System\MWDzUYp.exe
  C:\Windows\System\MWDzUYp.exe
  2⤵
  PID:6224
- C:\Windows\System\jxoNdKw.exe
  C:\Windows\System\jxoNdKw.exe
  2⤵
  PID:5168
- C:\Windows\System\mPPCQTM.exe
  C:\Windows\System\mPPCQTM.exe
  2⤵
  PID:6500
- C:\Windows\System\aQwDxMm.exe
  C:\Windows\System\aQwDxMm.exe
  2⤵
  PID:1452
- C:\Windows\System\ZgcnRkR.exe
  C:\Windows\System\ZgcnRkR.exe
  2⤵
  PID:3100
- C:\Windows\System\daSFOcK.exe
  C:\Windows\System\daSFOcK.exe
  2⤵
  PID:7152
- C:\Windows\System\ZxjkbJN.exe
  C:\Windows\System\ZxjkbJN.exe
  2⤵
  PID:7016
- C:\Windows\System\SQfRXPU.exe
  C:\Windows\System\SQfRXPU.exe
  2⤵
  PID:11788
- C:\Windows\System\tXywPnH.exe
  C:\Windows\System\tXywPnH.exe
  2⤵
  PID:4544
- C:\Windows\System\TeOMoAS.exe
  C:\Windows\System\TeOMoAS.exe
  2⤵
  PID:2252
- C:\Windows\System\BXJPzJH.exe
  C:\Windows\System\BXJPzJH.exe
  2⤵
  PID:5488
- C:\Windows\System\DKraSAk.exe
  C:\Windows\System\DKraSAk.exe
  2⤵
  PID:6540
- C:\Windows\System\wHEivWI.exe
  C:\Windows\System\wHEivWI.exe
  2⤵
  PID:5404
- C:\Windows\System\okEnMaj.exe
  C:\Windows\System\okEnMaj.exe
  2⤵
  PID:6516
- C:\Windows\System\EpyPJuM.exe
  C:\Windows\System\EpyPJuM.exe
  2⤵
  PID:4064
- C:\Windows\System\EQlRpcs.exe
  C:\Windows\System\EQlRpcs.exe
  2⤵
  PID:5296
- C:\Windows\System\nbaQNUa.exe
  C:\Windows\System\nbaQNUa.exe
  2⤵
  PID:5548
- C:\Windows\System\hJIcpmr.exe
  C:\Windows\System\hJIcpmr.exe
  2⤵
  PID:2640
- C:\Windows\System\LxeggVX.exe
  C:\Windows\System\LxeggVX.exe
  2⤵
  PID:6880
- C:\Windows\System\KdqKyRJ.exe
  C:\Windows\System\KdqKyRJ.exe
  2⤵
  PID:5632
- C:\Windows\System\MhXuSSW.exe
  C:\Windows\System\MhXuSSW.exe
  2⤵
  PID:6444
- C:\Windows\System\CuQzumM.exe
  C:\Windows\System\CuQzumM.exe
  2⤵
  PID:5764
- C:\Windows\System\AsDOTwy.exe
  C:\Windows\System\AsDOTwy.exe
  2⤵
  PID:5392
- C:\Windows\System\GWCQftg.exe
  C:\Windows\System\GWCQftg.exe
  2⤵
  PID:5476
- C:\Windows\System\JBgzXJB.exe
  C:\Windows\System\JBgzXJB.exe
  2⤵
  PID:5920
- C:\Windows\System\cxajNJb.exe
  C:\Windows\System\cxajNJb.exe
  2⤵
  PID:1640
- C:\Windows\System\IkFmDNJ.exe
  C:\Windows\System\IkFmDNJ.exe
  2⤵
  PID:6572
- C:\Windows\System\lmRUFwE.exe
  C:\Windows\System\lmRUFwE.exe
  2⤵
  PID:11880
- C:\Windows\System\wINNliB.exe
  C:\Windows\System\wINNliB.exe
  2⤵
  PID:7520
- C:\Windows\System\hAnkCwu.exe
  C:\Windows\System\hAnkCwu.exe
  2⤵
  PID:6908
- C:\Windows\System\VBKMUoO.exe
  C:\Windows\System\VBKMUoO.exe
  2⤵
  PID:7552
- C:\Windows\System\rRNQWFV.exe
  C:\Windows\System\rRNQWFV.exe
  2⤵
  PID:6004
- C:\Windows\System\hRxddvJ.exe
  C:\Windows\System\hRxddvJ.exe
  2⤵
  PID:7616
- C:\Windows\System\clhllDD.exe
  C:\Windows\System\clhllDD.exe
  2⤵
  PID:5428
- C:\Windows\System\sqyWNtw.exe
  C:\Windows\System\sqyWNtw.exe
  2⤵
  PID:6064
- C:\Windows\System\WQYwvrT.exe
  C:\Windows\System\WQYwvrT.exe
  2⤵
  PID:6116
- C:\Windows\System\sBjbLeQ.exe
  C:\Windows\System\sBjbLeQ.exe
  2⤵
  PID:7660
- C:\Windows\System\kKxwzPG.exe
  C:\Windows\System\kKxwzPG.exe
  2⤵
  PID:7752
- C:\Windows\System\KHvVkIn.exe
  C:\Windows\System\KHvVkIn.exe
  2⤵
  PID:7628
- C:\Windows\System\HkRjiKu.exe
  C:\Windows\System\HkRjiKu.exe
  2⤵
  PID:5096
- C:\Windows\System\MmTOTVx.exe
  C:\Windows\System\MmTOTVx.exe
  2⤵
  PID:7808
- C:\Windows\System\uaUAifN.exe
  C:\Windows\System\uaUAifN.exe
  2⤵
  PID:5960
- C:\Windows\System\FDXlgJu.exe
  C:\Windows\System\FDXlgJu.exe
  2⤵
  PID:7780
- C:\Windows\System\tPcvoMG.exe
  C:\Windows\System\tPcvoMG.exe
  2⤵
  PID:12304
- C:\Windows\System\FnvPbtg.exe
  C:\Windows\System\FnvPbtg.exe
  2⤵
  PID:12336
- C:\Windows\System\voKgccu.exe
  C:\Windows\System\voKgccu.exe
  2⤵
  PID:12368
- C:\Windows\System\ncBOABZ.exe
  C:\Windows\System\ncBOABZ.exe
  2⤵
  PID:12432
- C:\Windows\System\DaiZDjN.exe
  C:\Windows\System\DaiZDjN.exe
  2⤵
  PID:12464
- C:\Windows\System\GoKMENz.exe
  C:\Windows\System\GoKMENz.exe
  2⤵
  PID:12480
- C:\Windows\System\uLCYpGs.exe
  C:\Windows\System\uLCYpGs.exe
  2⤵
  PID:12512
- C:\Windows\System\VRBCruw.exe
  C:\Windows\System\VRBCruw.exe
  2⤵
  PID:12528
- C:\Windows\System\SortJPi.exe
  C:\Windows\System\SortJPi.exe
  2⤵
  PID:12568
- C:\Windows\System\qpjSsum.exe
  C:\Windows\System\qpjSsum.exe
  2⤵
  PID:12596
- C:\Windows\System\bYJIrPx.exe
  C:\Windows\System\bYJIrPx.exe
  2⤵
  PID:12628
- C:\Windows\System\DqzoPYb.exe
  C:\Windows\System\DqzoPYb.exe
  2⤵
  PID:12656
- C:\Windows\System\YQAVMVE.exe
  C:\Windows\System\YQAVMVE.exe
  2⤵
  PID:12688
- C:\Windows\System\lmrkWPw.exe
  C:\Windows\System\lmrkWPw.exe
  2⤵
  PID:12720
- C:\Windows\System\prcHCfR.exe
  C:\Windows\System\prcHCfR.exe
  2⤵
  PID:12760
- C:\Windows\System\fPKrBrj.exe
  C:\Windows\System\fPKrBrj.exe
  2⤵
  PID:12776
- C:\Windows\System\wdpXvyj.exe
  C:\Windows\System\wdpXvyj.exe
  2⤵
  PID:12816
- C:\Windows\System\WGjdMXM.exe
  C:\Windows\System\WGjdMXM.exe
  2⤵
  PID:12832
- C:\Windows\System\jgglyer.exe
  C:\Windows\System\jgglyer.exe
  2⤵
  PID:12860
- C:\Windows\System\aLAoaNq.exe
  C:\Windows\System\aLAoaNq.exe
  2⤵
  PID:12888
- C:\Windows\System\vKogVMo.exe
  C:\Windows\System\vKogVMo.exe
  2⤵
  PID:12916
- C:\Windows\System\pHKlqJW.exe
  C:\Windows\System\pHKlqJW.exe
  2⤵
  PID:12944
- C:\Windows\System\OetLKfx.exe
  C:\Windows\System\OetLKfx.exe
  2⤵
  PID:12976
- C:\Windows\System\IOqzXSh.exe
  C:\Windows\System\IOqzXSh.exe
  2⤵
  PID:13004
- C:\Windows\System\dJMIbfO.exe
  C:\Windows\System\dJMIbfO.exe
  2⤵
  PID:13032
- C:\Windows\System\VeHRJYD.exe
  C:\Windows\System\VeHRJYD.exe
  2⤵
  PID:13060
- C:\Windows\System\kEdzfvl.exe
  C:\Windows\System\kEdzfvl.exe
  2⤵
  PID:13088
- C:\Windows\System\aiwbesv.exe
  C:\Windows\System\aiwbesv.exe
  2⤵
  PID:13116
- C:\Windows\System\VGkuMDL.exe
  C:\Windows\System\VGkuMDL.exe
  2⤵
  PID:13156
- C:\Windows\System\RGGVkNU.exe
  C:\Windows\System\RGGVkNU.exe
  2⤵
  PID:13188
- C:\Windows\System\yvLaHlL.exe
  C:\Windows\System\yvLaHlL.exe
  2⤵
  PID:13208
- C:\Windows\System\ZSUdzvb.exe
  C:\Windows\System\ZSUdzvb.exe
  2⤵
  PID:13236
- C:\Windows\System\yoleoca.exe
  C:\Windows\System\yoleoca.exe
  2⤵
  PID:13268
- C:\Windows\System\XKXJSqc.exe
  C:\Windows\System\XKXJSqc.exe
  2⤵
  PID:13300
- C:\Windows\System\cFneJoG.exe
  C:\Windows\System\cFneJoG.exe
  2⤵
  PID:12316
- C:\Windows\System\zKkWyWO.exe
  C:\Windows\System\zKkWyWO.exe
  2⤵
  PID:5260
- C:\Windows\System\OFORukV.exe
  C:\Windows\System\OFORukV.exe
  2⤵
  PID:12408
- C:\Windows\System\Legjbbw.exe
  C:\Windows\System\Legjbbw.exe
  2⤵
  PID:5292
- C:\Windows\System\RxGAZSI.exe
  C:\Windows\System\RxGAZSI.exe
  2⤵
  PID:5328
- C:\Windows\System\QWZrYnm.exe
  C:\Windows\System\QWZrYnm.exe
  2⤵
  PID:7208
- C:\Windows\System\kNOGALk.exe
  C:\Windows\System\kNOGALk.exe
  2⤵
  PID:5624
- C:\Windows\System\kaXacUn.exe
  C:\Windows\System\kaXacUn.exe
  2⤵
  PID:7544
- C:\Windows\System\jVdXAcc.exe
  C:\Windows\System\jVdXAcc.exe
  2⤵
  PID:5804
- C:\Windows\System\vTxmWrz.exe
  C:\Windows\System\vTxmWrz.exe
  2⤵
  PID:8124
- C:\Windows\System\cCMuZft.exe
  C:\Windows\System\cCMuZft.exe
  2⤵
  PID:7312
- C:\Windows\System\iwWQLBm.exe
  C:\Windows\System\iwWQLBm.exe
  2⤵
  PID:7132
- C:\Windows\System\dRRPkak.exe
  C:\Windows\System\dRRPkak.exe
  2⤵
  PID:1552
- C:\Windows\System\fbgDbMQ.exe
  C:\Windows\System\fbgDbMQ.exe
  2⤵
  PID:7732
- C:\Windows\System\lVZhgiW.exe
  C:\Windows\System\lVZhgiW.exe
  2⤵
  PID:7528
- C:\Windows\System\WoTIXIr.exe
  C:\Windows\System\WoTIXIr.exe
  2⤵
  PID:12548
- C:\Windows\System\JQRBsBS.exe
  C:\Windows\System\JQRBsBS.exe
  2⤵
  PID:12588
- C:\Windows\System\RWqeKYo.exe
  C:\Windows\System\RWqeKYo.exe
  2⤵
  PID:12648
- C:\Windows\System\ffpvEqf.exe
  C:\Windows\System\ffpvEqf.exe
  2⤵
  PID:8208
- C:\Windows\System\cwLfBCO.exe
  C:\Windows\System\cwLfBCO.exe
  2⤵
  PID:12716
- C:\Windows\System\PZSFKgW.exe
  C:\Windows\System\PZSFKgW.exe
  2⤵
  PID:4216
- C:\Windows\System\CsJZNYD.exe
  C:\Windows\System\CsJZNYD.exe
  2⤵
  PID:8248
- C:\Windows\System\ZtdPJHh.exe
  C:\Windows\System\ZtdPJHh.exe
  2⤵
  PID:8276
- C:\Windows\System\PTODPtW.exe
  C:\Windows\System\PTODPtW.exe
  2⤵
  PID:12900
- C:\Windows\System\tWGbbth.exe
  C:\Windows\System\tWGbbth.exe
  2⤵
  PID:12940
- C:\Windows\System\yisVzrh.exe
  C:\Windows\System\yisVzrh.exe
  2⤵
  PID:8368
- C:\Windows\System\vfcbJwD.exe
  C:\Windows\System\vfcbJwD.exe
  2⤵
  PID:13056
- C:\Windows\System\oIotdIQ.exe
  C:\Windows\System\oIotdIQ.exe
  2⤵
  PID:13080
- C:\Windows\System\DLXxTqR.exe
  C:\Windows\System\DLXxTqR.exe
  2⤵
  PID:8532
- C:\Windows\System\rkAMESm.exe
  C:\Windows\System\rkAMESm.exe
  2⤵
  PID:13140
- C:\Windows\System\SnNeWPk.exe
  C:\Windows\System\SnNeWPk.exe
  2⤵
  PID:8620
- C:\Windows\System\AfPhUWm.exe
  C:\Windows\System\AfPhUWm.exe
  2⤵
  PID:8732
- C:\Windows\System\ksKtlnG.exe
  C:\Windows\System\ksKtlnG.exe
  2⤵
  PID:13200
- C:\Windows\System\TPMgcXa.exe
  C:\Windows\System\TPMgcXa.exe
  2⤵
  PID:13232
- C:\Windows\System\MaGWIWz.exe
  C:\Windows\System\MaGWIWz.exe
  2⤵
  PID:8848
- C:\Windows\System\ApzHinR.exe
  C:\Windows\System\ApzHinR.exe
  2⤵
  PID:13308
- C:\Windows\System\FecCqed.exe
  C:\Windows\System\FecCqed.exe
  2⤵
  PID:12352
- C:\Windows\System\HzMjQAQ.exe
  C:\Windows\System\HzMjQAQ.exe
  2⤵
  PID:8936
- C:\Windows\System\UwnThyK.exe
  C:\Windows\System\UwnThyK.exe
  2⤵
  PID:8036
- C:\Windows\System\yFvXrUj.exe
  C:\Windows\System\yFvXrUj.exe
  2⤵
  PID:8176
- C:\Windows\System\mWJsrfN.exe
  C:\Windows\System\mWJsrfN.exe
  2⤵
  PID:7300
- C:\Windows\System\EUQSVCQ.exe
  C:\Windows\System\EUQSVCQ.exe
  2⤵
  PID:5732
- C:\Windows\System\DUTmseX.exe
  C:\Windows\System\DUTmseX.exe
  2⤵
  PID:6160
- C:\Windows\System\ORpITDu.exe
  C:\Windows\System\ORpITDu.exe
  2⤵
  PID:6200
- C:\Windows\System\jgxjfSZ.exe
  C:\Windows\System\jgxjfSZ.exe
  2⤵
  PID:12440
- C:\Windows\System\UTjkQRl.exe
  C:\Windows\System\UTjkQRl.exe
  2⤵
  PID:6028
- C:\Windows\System\vDsjNDF.exe
  C:\Windows\System\vDsjNDF.exe
  2⤵
  PID:9212
- C:\Windows\System\dvGQzqA.exe
  C:\Windows\System\dvGQzqA.exe
  2⤵
  PID:12508
- C:\Windows\System\rfPIkxx.exe
  C:\Windows\System\rfPIkxx.exe
  2⤵
  PID:12556
- C:\Windows\System\zVeBenD.exe
  C:\Windows\System\zVeBenD.exe
  2⤵
  PID:12608
- C:\Windows\System\iqDhLcj.exe
  C:\Windows\System\iqDhLcj.exe
  2⤵
  PID:6392
- C:\Windows\System\zofbyLD.exe
  C:\Windows\System\zofbyLD.exe
  2⤵
  PID:12736
- C:\Windows\System\DxaoQvo.exe
  C:\Windows\System\DxaoQvo.exe
  2⤵
  PID:6532
- C:\Windows\System\eVGUjFu.exe
  C:\Windows\System\eVGUjFu.exe
  2⤵
  PID:12852
- C:\Windows\System\xaKSSXm.exe
  C:\Windows\System\xaKSSXm.exe
  2⤵
  PID:8876
- C:\Windows\System\jzWDkKG.exe
  C:\Windows\System\jzWDkKG.exe
  2⤵
  PID:5512
- C:\Windows\System\fRgmDUA.exe
  C:\Windows\System\fRgmDUA.exe
  2⤵
  PID:13028
- C:\Windows\System\KgEgufm.exe
  C:\Windows\System\KgEgufm.exe
  2⤵
  PID:6780
- C:\Windows\System\ueZKJAO.exe
  C:\Windows\System\ueZKJAO.exe
  2⤵
  PID:13136
- C:\Windows\System\pswPLRw.exe
  C:\Windows\System\pswPLRw.exe
  2⤵
  PID:8752
- C:\Windows\System\sisOKaS.exe
  C:\Windows\System\sisOKaS.exe
  2⤵
  PID:8996
- C:\Windows\System\wcrgjoO.exe
  C:\Windows\System\wcrgjoO.exe
  2⤵
  PID:13292
- C:\Windows\System\huFiNBL.exe
  C:\Windows\System\huFiNBL.exe
  2⤵
  PID:9080
- C:\Windows\System\rKweWCg.exe
  C:\Windows\System\rKweWCg.exe
  2⤵
  PID:8992
- C:\Windows\System\ptzGzks.exe
  C:\Windows\System\ptzGzks.exe
  2⤵
  PID:12424
- C:\Windows\System\rKdgEeN.exe
  C:\Windows\System\rKdgEeN.exe
  2⤵
  PID:6368
- C:\Windows\System\uUeMHDL.exe
  C:\Windows\System\uUeMHDL.exe
  2⤵
  PID:6512
- C:\Windows\System\OdHbTMG.exe
  C:\Windows\System\OdHbTMG.exe
  2⤵
  PID:13044
- C:\Windows\System\auMqWmf.exe
  C:\Windows\System\auMqWmf.exe
  2⤵
  PID:8616
- C:\Windows\System\Jgkqned.exe
  C:\Windows\System\Jgkqned.exe
  2⤵
  PID:6700
- C:\Windows\System\qpKlFfN.exe
  C:\Windows\System\qpKlFfN.exe
  2⤵
  PID:6168
- C:\Windows\System\mtvVvWm.exe
  C:\Windows\System\mtvVvWm.exe
  2⤵
  PID:9096
- C:\Windows\System\wRvTwDY.exe
  C:\Windows\System\wRvTwDY.exe
  2⤵
  PID:12396
- C:\Windows\System\rINhgEF.exe
  C:\Windows\System\rINhgEF.exe
  2⤵
  PID:9328
- C:\Windows\System\VjVmcNP.exe
  C:\Windows\System\VjVmcNP.exe
  2⤵
  PID:8068
- C:\Windows\System\mXJuSay.exe
  C:\Windows\System\mXJuSay.exe
  2⤵
  PID:9440
- C:\Windows\System\cTACXKP.exe
  C:\Windows\System\cTACXKP.exe
  2⤵
  PID:9460
- C:\Windows\System\rJkZlMO.exe
  C:\Windows\System\rJkZlMO.exe
  2⤵
  PID:8624
- C:\Windows\System\qNfqhOE.exe
  C:\Windows\System\qNfqhOE.exe
  2⤵
  PID:12772
- C:\Windows\System\GSUGkCS.exe
  C:\Windows\System\GSUGkCS.exe
  2⤵
  PID:12800
- C:\Windows\System\VHAeQUq.exe
  C:\Windows\System\VHAeQUq.exe
  2⤵
  PID:5156
- C:\Windows\System\fFVrIYv.exe
  C:\Windows\System\fFVrIYv.exe
  2⤵
  PID:9700
- C:\Windows\System\KiIxaaD.exe
  C:\Windows\System\KiIxaaD.exe
  2⤵
  PID:8332
- C:\Windows\System\Ifrqwci.exe
  C:\Windows\System\Ifrqwci.exe
  2⤵
  PID:6692
- C:\Windows\System\fGaDgwN.exe
  C:\Windows\System\fGaDgwN.exe
  2⤵
  PID:7284
- C:\Windows\System\VzSQeRV.exe
  C:\Windows\System\VzSQeRV.exe
  2⤵
  PID:7316
- C:\Windows\System\QeHPyQe.exe
  C:\Windows\System\QeHPyQe.exe
  2⤵
  PID:7400
- C:\Windows\System\oyMJSQu.exe
  C:\Windows\System\oyMJSQu.exe
  2⤵
  PID:7884
- C:\Windows\System\idASqon.exe
  C:\Windows\System\idASqon.exe
  2⤵
  PID:9988
- C:\Windows\System\lwkYXmt.exe
  C:\Windows\System\lwkYXmt.exe
  2⤵
  PID:10076
- C:\Windows\System\JgPjAGd.exe
  C:\Windows\System\JgPjAGd.exe
  2⤵
  PID:10164
- C:\Windows\System\gmmZpJZ.exe
  C:\Windows\System\gmmZpJZ.exe
  2⤵
  PID:9388
- C:\Windows\System\dDRdIJC.exe
  C:\Windows\System\dDRdIJC.exe
  2⤵
  PID:9136
- C:\Windows\System\xcqzChQ.exe
  C:\Windows\System\xcqzChQ.exe
  2⤵
  PID:8472
- C:\Windows\System\rjvrtHc.exe
  C:\Windows\System\rjvrtHc.exe
  2⤵
  PID:6588
- C:\Windows\System\WgCpSMC.exe
  C:\Windows\System\WgCpSMC.exe
  2⤵
  PID:9100
- C:\Windows\System\hIirFTG.exe
  C:\Windows\System\hIirFTG.exe
  2⤵
  PID:8356
- C:\Windows\System\xzTSrJY.exe
  C:\Windows\System\xzTSrJY.exe
  2⤵
  PID:9188
- C:\Windows\System\fLOSNyW.exe
  C:\Windows\System\fLOSNyW.exe
  2⤵
  PID:6536
- C:\Windows\System\KmADlSW.exe
  C:\Windows\System\KmADlSW.exe
  2⤵
  PID:9556
- C:\Windows\System\itZdXFE.exe
  C:\Windows\System\itZdXFE.exe
  2⤵
  PID:9580
- C:\Windows\System\MIsUvwM.exe
  C:\Windows\System\MIsUvwM.exe
  2⤵
  PID:12828
- C:\Windows\System\asopLat.exe
  C:\Windows\System\asopLat.exe
  2⤵
  PID:9708
- C:\Windows\System\bjSgJqW.exe
  C:\Windows\System\bjSgJqW.exe
  2⤵
  PID:8184
- C:\Windows\System\RjdkyNM.exe
  C:\Windows\System\RjdkyNM.exe
  2⤵
  PID:9924
- C:\Windows\System\bwlKcPT.exe
  C:\Windows\System\bwlKcPT.exe
  2⤵
  PID:9956
- C:\Windows\System\dnpqRKs.exe
  C:\Windows\System\dnpqRKs.exe
  2⤵
  PID:10124
- C:\Windows\System\XYIvTBc.exe
  C:\Windows\System\XYIvTBc.exe
  2⤵
  PID:9936
- C:\Windows\System\rDZRVAC.exe
  C:\Windows\System\rDZRVAC.exe
  2⤵
  PID:8940
- C:\Windows\System\moCHFAq.exe
  C:\Windows\System\moCHFAq.exe
  2⤵
  PID:10108
- C:\Windows\System\eUAxhdX.exe
  C:\Windows\System\eUAxhdX.exe
  2⤵
  PID:9208
- C:\Windows\System\KyZZCCC.exe
  C:\Windows\System\KyZZCCC.exe
  2⤵
  PID:9588
- C:\Windows\System\nSKktka.exe
  C:\Windows\System\nSKktka.exe
  2⤵
  PID:7600
- C:\Windows\System\ixmtONt.exe
  C:\Windows\System\ixmtONt.exe
  2⤵
  PID:7852
- C:\Windows\System\PdyYpgr.exe
  C:\Windows\System\PdyYpgr.exe
  2⤵
  PID:8212
- C:\Windows\System\ogFagHr.exe
  C:\Windows\System\ogFagHr.exe
  2⤵
  PID:4672
- C:\Windows\System\OdKLrfA.exe
  C:\Windows\System\OdKLrfA.exe
  2⤵
  PID:8148
- C:\Windows\System\VfUhOnx.exe
  C:\Windows\System\VfUhOnx.exe
  2⤵
  PID:4912
- C:\Windows\System\kaNwYpF.exe
  C:\Windows\System\kaNwYpF.exe
  2⤵
  PID:9516
- C:\Windows\System\DZcmQNG.exe
  C:\Windows\System\DZcmQNG.exe
  2⤵
  PID:9544
- C:\Windows\System\KqJGgmu.exe
  C:\Windows\System\KqJGgmu.exe
  2⤵
  PID:9640
- C:\Windows\System\gtLIGSi.exe
  C:\Windows\System\gtLIGSi.exe
  2⤵
  PID:2000
- C:\Windows\System\tIZlCPj.exe
  C:\Windows\System\tIZlCPj.exe
  2⤵
  PID:10220
- C:\Windows\System\JySRAjL.exe
  C:\Windows\System\JySRAjL.exe
  2⤵
  PID:9044
- C:\Windows\System\PiIFFON.exe
  C:\Windows\System\PiIFFON.exe
  2⤵
  PID:7908
- C:\Windows\System\kPIPoBA.exe
  C:\Windows\System\kPIPoBA.exe
  2⤵
  PID:10196
- C:\Windows\System\MfRebwX.exe
  C:\Windows\System\MfRebwX.exe
  2⤵
  PID:7964
- C:\Windows\System\JNkWNRO.exe
  C:\Windows\System\JNkWNRO.exe
  2⤵
  PID:7940
- C:\Windows\System\SZDmnpJ.exe
  C:\Windows\System\SZDmnpJ.exe
  2⤵
  PID:10104
- C:\Windows\System\WDydmqO.exe
  C:\Windows\System\WDydmqO.exe
  2⤵
  PID:10404
- C:\Windows\System\gANxEuj.exe
  C:\Windows\System\gANxEuj.exe
  2⤵
  PID:13324
- C:\Windows\System\WLTnOam.exe
  C:\Windows\System\WLTnOam.exe
  2⤵
  PID:13348
- C:\Windows\System\WIAPYRy.exe
  C:\Windows\System\WIAPYRy.exe
  2⤵
  PID:13388
- C:\Windows\System\nBtCTDC.exe
  C:\Windows\System\nBtCTDC.exe
  2⤵
  PID:13416
- C:\Windows\System\JokGQUe.exe
  C:\Windows\System\JokGQUe.exe
  2⤵
  PID:13440
- C:\Windows\System\bhZreDJ.exe
  C:\Windows\System\bhZreDJ.exe
  2⤵
  PID:13476
- C:\Windows\System\ZgjoiDa.exe
  C:\Windows\System\ZgjoiDa.exe
  2⤵
  PID:13504
- C:\Windows\System\ZPFLPmR.exe
  C:\Windows\System\ZPFLPmR.exe
  2⤵
  PID:13528
- C:\Windows\System\XmIOTDm.exe
  C:\Windows\System\XmIOTDm.exe
  2⤵
  PID:13556
- C:\Windows\System\rxQQHFh.exe
  C:\Windows\System\rxQQHFh.exe
  2⤵
  PID:13580
- C:\Windows\System\lDtMrDP.exe
  C:\Windows\System\lDtMrDP.exe
  2⤵
  PID:13608
- C:\Windows\System\yvtMgyO.exe
  C:\Windows\System\yvtMgyO.exe
  2⤵
  PID:13640
- C:\Windows\System\soCosbJ.exe
  C:\Windows\System\soCosbJ.exe
  2⤵
  PID:13692
- C:\Windows\System\EKgTRfb.exe
  C:\Windows\System\EKgTRfb.exe
  2⤵
  PID:13768
- C:\Windows\System\BpgdSNF.exe
  C:\Windows\System\BpgdSNF.exe
  2⤵
  PID:13812
- C:\Windows\System\wZbSeQA.exe
  C:\Windows\System\wZbSeQA.exe
  2⤵
  PID:13836
- C:\Windows\System\yrWCYeX.exe
  C:\Windows\System\yrWCYeX.exe
  2⤵
  PID:13868
- C:\Windows\System\QJXFpWN.exe
  C:\Windows\System\QJXFpWN.exe
  2⤵
  PID:13900
- C:\Windows\System\hphUzIp.exe
  C:\Windows\System\hphUzIp.exe
  2⤵
  PID:13916
- C:\Windows\System\PhIkSzu.exe
  C:\Windows\System\PhIkSzu.exe
  2⤵
  PID:13940
- C:\Windows\System\ADbcQqz.exe
  C:\Windows\System\ADbcQqz.exe
  2⤵
  PID:13972
- C:\Windows\System\bPOWKCb.exe
  C:\Windows\System\bPOWKCb.exe
  2⤵
  PID:14000
- C:\Windows\System\zAoumdw.exe
  C:\Windows\System\zAoumdw.exe
  2⤵
  PID:14028
- C:\Windows\System\GXyxWAl.exe
  C:\Windows\System\GXyxWAl.exe
  2⤵
  PID:14132
- C:\Windows\System\NqIIzcR.exe
  C:\Windows\System\NqIIzcR.exe
  2⤵
  PID:14148
- C:\Windows\System\YTVhEnC.exe
  C:\Windows\System\YTVhEnC.exe
  2⤵
  PID:14168
- C:\Windows\System\NUXXSTn.exe
  C:\Windows\System\NUXXSTn.exe
  2⤵
  PID:14196
- C:\Windows\System\yQVqPdy.exe
  C:\Windows\System\yQVqPdy.exe
  2⤵
  PID:14232
- C:\Windows\System\AOiAjgs.exe
  C:\Windows\System\AOiAjgs.exe
  2⤵
  PID:14260
- C:\Windows\System\pncVzdK.exe
  C:\Windows\System\pncVzdK.exe
  2⤵
  PID:14284
- C:\Windows\System\RcTZSVc.exe
  C:\Windows\System\RcTZSVc.exe
  2⤵
  PID:14312
- C:\Windows\System\plJVfqX.exe
  C:\Windows\System\plJVfqX.exe
  2⤵
  PID:13332
- C:\Windows\System\AjUceNS.exe
  C:\Windows\System\AjUceNS.exe
  2⤵
  PID:13412
- C:\Windows\System\PKHIyXO.exe
  C:\Windows\System\PKHIyXO.exe
  2⤵
  PID:13472
- C:\Windows\System\dTxMEQs.exe
  C:\Windows\System\dTxMEQs.exe
  2⤵
  PID:13524
- C:\Windows\System\SNtuZOf.exe
  C:\Windows\System\SNtuZOf.exe
  2⤵
  PID:13588
- C:\Windows\System\xTjIbIQ.exe
  C:\Windows\System\xTjIbIQ.exe
  2⤵
  PID:13576
- C:\Windows\System\eCcDoXm.exe
  C:\Windows\System\eCcDoXm.exe
  2⤵
  PID:10988
- C:\Windows\System\lETNrFK.exe
  C:\Windows\System\lETNrFK.exe
  2⤵
  PID:13724
- C:\Windows\System\VJExKsD.exe
  C:\Windows\System\VJExKsD.exe
  2⤵
  PID:13688
- C:\Windows\System\cqqRCpx.exe
  C:\Windows\System\cqqRCpx.exe
  2⤵
  PID:11092
- C:\Windows\System\sPJEtFl.exe
  C:\Windows\System\sPJEtFl.exe
  2⤵
  PID:13992
- C:\Windows\System\lHYiSOI.exe
  C:\Windows\System\lHYiSOI.exe
  2⤵
  PID:14128
- C:\Windows\System\QsNhspf.exe
  C:\Windows\System\QsNhspf.exe
  2⤵
  PID:10084
- C:\Windows\System\elGvLhL.exe
  C:\Windows\System\elGvLhL.exe
  2⤵
  PID:14164
- C:\Windows\System\hWrVuIV.exe
  C:\Windows\System\hWrVuIV.exe
  2⤵
  PID:14224
- C:\Windows\System\LBrMcOu.exe
  C:\Windows\System\LBrMcOu.exe
  2⤵
  PID:14240
- C:\Windows\System\MuGzafA.exe
  C:\Windows\System\MuGzafA.exe
  2⤵
  PID:14296
- C:\Windows\System\bkTnfEQ.exe
  C:\Windows\System\bkTnfEQ.exe
  2⤵
  PID:14308
- C:\Windows\System\udNOMlq.exe
  C:\Windows\System\udNOMlq.exe
  2⤵
  PID:11180
- C:\Windows\System\UTwZhTF.exe
  C:\Windows\System\UTwZhTF.exe
  2⤵
  PID:2500
- C:\Windows\System\HwyQjWk.exe
  C:\Windows\System\HwyQjWk.exe
  2⤵
  PID:10848
- C:\Windows\System\vDlfPco.exe
  C:\Windows\System\vDlfPco.exe
  2⤵
  PID:11204
- C:\Windows\System\xoZFAPH.exe
  C:\Windows\System\xoZFAPH.exe
  2⤵
  PID:9876
- C:\Windows\System\NvXyAuP.exe
  C:\Windows\System\NvXyAuP.exe
  2⤵
  PID:11352
- C:\Windows\System\wOJDRQD.exe
  C:\Windows\System\wOJDRQD.exe
  2⤵
  PID:11372
- C:\Windows\System\ujEqfvh.exe
  C:\Windows\System\ujEqfvh.exe
  2⤵
  PID:11420
- C:\Windows\System\pvmTgmi.exe
  C:\Windows\System\pvmTgmi.exe
  2⤵
  PID:10416
- C:\Windows\System\EQPrBuZ.exe
  C:\Windows\System\EQPrBuZ.exe
  2⤵
  PID:9972
- C:\Windows\System\kVaXDNl.exe
  C:\Windows\System\kVaXDNl.exe
  2⤵
  PID:13760
- C:\Windows\System\jQLfYYu.exe
  C:\Windows\System\jQLfYYu.exe
  2⤵
  PID:11160
- C:\Windows\System\CFwNxoJ.exe
  C:\Windows\System\CFwNxoJ.exe
  2⤵
  PID:10380
- C:\Windows\System\vBFSukh.exe
  C:\Windows\System\vBFSukh.exe
  2⤵
  PID:13776
- C:\Windows\System\nilsUVL.exe
  C:\Windows\System\nilsUVL.exe
  2⤵
  PID:8872
- C:\Windows\System\oavIqdT.exe
  C:\Windows\System\oavIqdT.exe
  2⤵
  PID:11208
- C:\Windows\System\OZtwyiu.exe
  C:\Windows\System\OZtwyiu.exe
  2⤵
  PID:10408
- C:\Windows\System\EZUnBga.exe
  C:\Windows\System\EZUnBga.exe
  2⤵
  PID:10512
- C:\Windows\System\FVqqNxC.exe
  C:\Windows\System\FVqqNxC.exe
  2⤵
  PID:10840
- C:\Windows\System\jHMLCHm.exe
  C:\Windows\System\jHMLCHm.exe
  2⤵
  PID:11544
- C:\Windows\System\dzXXpYy.exe
  C:\Windows\System\dzXXpYy.exe
  2⤵
  PID:13924
- C:\Windows\System\PHjJeqQ.exe
  C:\Windows\System\PHjJeqQ.exe
  2⤵
  PID:11012
- C:\Windows\System\qrlniXx.exe
  C:\Windows\System\qrlniXx.exe
  2⤵
  PID:13984
- C:\Windows\System\IzHzecm.exe
  C:\Windows\System\IzHzecm.exe
  2⤵
  PID:14012
- C:\Windows\System\gkVPCVz.exe
  C:\Windows\System\gkVPCVz.exe
  2⤵
  PID:14080
- C:\Windows\System\EEmoKDj.exe
  C:\Windows\System\EEmoKDj.exe
  2⤵
  PID:11640
- C:\Windows\System\yxLTmCi.exe
  C:\Windows\System\yxLTmCi.exe
  2⤵
  PID:11672
- C:\Windows\System\ZnWiFyh.exe
  C:\Windows\System\ZnWiFyh.exe
  2⤵
  PID:10336
- C:\Windows\System\IXEeXbc.exe
  C:\Windows\System\IXEeXbc.exe
  2⤵
  PID:14256
- C:\Windows\System\lkhnePj.exe
  C:\Windows\System\lkhnePj.exe
  2⤵
  PID:11244
- C:\Windows\System\qXAYsri.exe
  C:\Windows\System\qXAYsri.exe
  2⤵
  PID:4412
- C:\Windows\System\NdzafGF.exe
  C:\Windows\System\NdzafGF.exe
  2⤵
  PID:10604
- C:\Windows\System\kXtZAXY.exe
  C:\Windows\System\kXtZAXY.exe
  2⤵
  PID:10964
- C:\Windows\System\CCXHJsf.exe
  C:\Windows\System\CCXHJsf.exe
  2⤵
  PID:11932
- C:\Windows\System\WOzogLG.exe
  C:\Windows\System\WOzogLG.exe
  2⤵
  PID:13660
- C:\Windows\System\vjjNpDr.exe
  C:\Windows\System\vjjNpDr.exe
  2⤵
  PID:11072
- C:\Windows\System\cRiOKYI.exe
  C:\Windows\System\cRiOKYI.exe
  2⤵
  PID:8456
- C:\Windows\System\gfsrFkV.exe
  C:\Windows\System\gfsrFkV.exe
  2⤵
  PID:11220
- C:\Windows\System\xfUZeST.exe
  C:\Windows\System\xfUZeST.exe
  2⤵
  PID:11488
- C:\Windows\System\rWpdCFB.exe
  C:\Windows\System\rWpdCFB.exe
  2⤵
  PID:11236
- C:\Windows\System\UwlyMLu.exe
  C:\Windows\System\UwlyMLu.exe
  2⤵
  PID:10732
- C:\Windows\System\QXbUjBC.exe
  C:\Windows\System\QXbUjBC.exe
  2⤵
  PID:13896
- C:\Windows\System\gQePlMb.exe
  C:\Windows\System\gQePlMb.exe
  2⤵
  PID:13964
- C:\Windows\System\tlDhbjz.exe
  C:\Windows\System\tlDhbjz.exe
  2⤵
  PID:4008
- C:\Windows\System\LItLBpw.exe
  C:\Windows\System\LItLBpw.exe
  2⤵
  PID:6196
- C:\Windows\System\mPmseZS.exe
  C:\Windows\System\mPmseZS.exe
  2⤵
  PID:13764
- C:\Windows\System\fUewULr.exe
  C:\Windows\System\fUewULr.exe
  2⤵
  PID:10608
- C:\Windows\System\rcmFvvX.exe
  C:\Windows\System\rcmFvvX.exe
  2⤵
  PID:9492
- C:\Windows\System\ZOXxqeV.exe
  C:\Windows\System\ZOXxqeV.exe
  2⤵
  PID:11748
- C:\Windows\System\GuQpenR.exe
  C:\Windows\System\GuQpenR.exe
  2⤵
  PID:11848
- C:\Windows\System\zNsNQNl.exe
  C:\Windows\System\zNsNQNl.exe
  2⤵
  PID:11008
- C:\Windows\System\XyXPBwJ.exe
  C:\Windows\System\XyXPBwJ.exe
  2⤵
  PID:10364
- C:\Windows\System\syugLQb.exe
  C:\Windows\System\syugLQb.exe
  2⤵
  PID:9984
- C:\Windows\System\EEivCeE.exe
  C:\Windows\System\EEivCeE.exe
  2⤵
  PID:11176
- C:\Windows\System\cUzPhpo.exe
  C:\Windows\System\cUzPhpo.exe
  2⤵
  PID:5440
- C:\Windows\System\KYHWDoo.exe
  C:\Windows\System\KYHWDoo.exe
  2⤵
  PID:10160
- C:\Windows\System\plaNBuh.exe
  C:\Windows\System\plaNBuh.exe
  2⤵
  PID:9392
- C:\Windows\System\BNviYgk.exe
  C:\Windows\System\BNviYgk.exe
  2⤵
  PID:4268
- C:\Windows\System\yfCBQkS.exe
  C:\Windows\System\yfCBQkS.exe
  2⤵
  PID:9356
- C:\Windows\System\xicmPTT.exe
  C:\Windows\System\xicmPTT.exe
  2⤵
  PID:9860
- C:\Windows\System\eBMIlTB.exe
  C:\Windows\System\eBMIlTB.exe
  2⤵
  PID:2248
- C:\Windows\System\rnFeRpq.exe
  C:\Windows\System\rnFeRpq.exe
  2⤵
  PID:12104
- C:\Windows\System\nJpAOYN.exe
  C:\Windows\System\nJpAOYN.exe
  2⤵
  PID:3752
- C:\Windows\System\tNsjqoa.exe
  C:\Windows\System\tNsjqoa.exe
  2⤵
  PID:3816
- C:\Windows\System\QQBjWUI.exe
  C:\Windows\System\QQBjWUI.exe
  2⤵
  PID:3144
- C:\Windows\System\wTGqTnL.exe
  C:\Windows\System\wTGqTnL.exe
  2⤵
  PID:5056
- C:\Windows\System\aCqWuCS.exe
  C:\Windows\System\aCqWuCS.exe
  2⤵
  PID:13344
- C:\Windows\System\XDyDRVR.exe
  C:\Windows\System\XDyDRVR.exe
  2⤵
  PID:9612
- C:\Windows\System\xRxmkdi.exe
  C:\Windows\System\xRxmkdi.exe
  2⤵
  PID:12164
- C:\Windows\System\cofHdTD.exe
  C:\Windows\System\cofHdTD.exe
  2⤵
  PID:2552
- C:\Windows\System\amzIlyZ.exe
  C:\Windows\System\amzIlyZ.exe
  2⤵
  PID:11036
- C:\Windows\System\ZPWSEWl.exe
  C:\Windows\System\ZPWSEWl.exe
  2⤵
  PID:10172
- C:\Windows\System\NYuHKyM.exe
  C:\Windows\System\NYuHKyM.exe
  2⤵
  PID:14364
- C:\Windows\System\wUNfguX.exe
  C:\Windows\System\wUNfguX.exe
  2⤵
  PID:14392
- C:\Windows\System\kqNQxeG.exe
  C:\Windows\System\kqNQxeG.exe
  2⤵
  PID:14432
- C:\Windows\System\DwCNnOp.exe
  C:\Windows\System\DwCNnOp.exe
  2⤵
  PID:14460
- C:\Windows\System\IunKYKm.exe
  C:\Windows\System\IunKYKm.exe
  2⤵
  PID:14476
- C:\Windows\System\skoQfkU.exe
  C:\Windows\System\skoQfkU.exe
  2⤵
  PID:14496
- C:\Windows\System\uyAeCcy.exe
  C:\Windows\System\uyAeCcy.exe
  2⤵
  PID:14544
- C:\Windows\System\qmxTXPZ.exe
  C:\Windows\System\qmxTXPZ.exe
  2⤵
  PID:14580
- C:\Windows\System\qXDOpYM.exe
  C:\Windows\System\qXDOpYM.exe
  2⤵
  PID:14600
- C:\Windows\System\dfmxayg.exe
  C:\Windows\System\dfmxayg.exe
  2⤵
  PID:14624
- C:\Windows\System\mhpXqhS.exe
  C:\Windows\System\mhpXqhS.exe
  2⤵
  PID:14656
- C:\Windows\System\WKYhNQZ.exe
  C:\Windows\System\WKYhNQZ.exe
  2⤵
  PID:14676
- C:\Windows\System\mXQGHJX.exe
  C:\Windows\System\mXQGHJX.exe
  2⤵
  PID:14712
- C:\Windows\System\kZELUZV.exe
  C:\Windows\System\kZELUZV.exe
  2⤵
  PID:14736
- C:\Windows\System\MVfSZEv.exe
  C:\Windows\System\MVfSZEv.exe
  2⤵
  PID:14776
- C:\Windows\System\LpNANFg.exe
  C:\Windows\System\LpNANFg.exe
  2⤵
  PID:14804
- C:\Windows\System\apXCTrh.exe
  C:\Windows\System\apXCTrh.exe
  2⤵
  PID:14828
- C:\Windows\System\tjqLuWZ.exe
  C:\Windows\System\tjqLuWZ.exe
  2⤵
  PID:14852
- C:\Windows\System\CTCzqkO.exe
  C:\Windows\System\CTCzqkO.exe
  2⤵
  PID:14880
- C:\Windows\System\uGnBRCU.exe
  C:\Windows\System\uGnBRCU.exe
  2⤵
  PID:14920
- C:\Windows\System\eauwNgT.exe
  C:\Windows\System\eauwNgT.exe
  2⤵
  PID:14936
- C:\Windows\System\BKEPozM.exe
  C:\Windows\System\BKEPozM.exe
  2⤵
  PID:14952
- C:\Windows\System\vzYEmeN.exe
  C:\Windows\System\vzYEmeN.exe
  2⤵
  PID:14992
- C:\Windows\System\StjwFRo.exe
  C:\Windows\System\StjwFRo.exe
  2⤵
  PID:15028
- C:\Windows\System\IsQqNNl.exe
  C:\Windows\System\IsQqNNl.exe
  2⤵
  PID:15064
- C:\Windows\System\pZhtvvu.exe
  C:\Windows\System\pZhtvvu.exe
  2⤵
  PID:15092
- C:\Windows\System\pvPegEq.exe
  C:\Windows\System\pvPegEq.exe
  2⤵
  PID:15108
- C:\Windows\System\TeVncAa.exe
  C:\Windows\System\TeVncAa.exe
  2⤵
  PID:15148
- C:\Windows\System\fhyJyRT.exe
  C:\Windows\System\fhyJyRT.exe
  2⤵
  PID:15164
- C:\Windows\System\SRGcBgQ.exe
  C:\Windows\System\SRGcBgQ.exe
  2⤵
  PID:15192
- C:\Windows\System\ShNICnm.exe
  C:\Windows\System\ShNICnm.exe
  2⤵
  PID:15220
- C:\Windows\System\ATVQheT.exe
  C:\Windows\System\ATVQheT.exe
  2⤵
  PID:15244
- C:\Windows\System\EVyYPQm.exe
  C:\Windows\System\EVyYPQm.exe
  2⤵
  PID:15284
- C:\Windows\System\xTbwZeP.exe
  C:\Windows\System\xTbwZeP.exe
  2⤵
  PID:15316
- C:\Windows\System\anXouID.exe
  C:\Windows\System\anXouID.exe
  2⤵
  PID:15344
- C:\Windows\System\XDAsNAB.exe
  C:\Windows\System\XDAsNAB.exe
  2⤵
  PID:10264
- C:\Windows\System\qrpXXuX.exe
  C:\Windows\System\qrpXXuX.exe
  2⤵
  PID:14380
- C:\Windows\System\ImJcsCD.exe
  C:\Windows\System\ImJcsCD.exe
  2⤵
  PID:14428
- C:\Windows\System\HGOVgsI.exe
  C:\Windows\System\HGOVgsI.exe
  2⤵
  PID:14468
- C:\Windows\System\JKTBFhF.exe
  C:\Windows\System\JKTBFhF.exe
  2⤵
  PID:14484
- C:\Windows\System\DJRLofj.exe
  C:\Windows\System\DJRLofj.exe
  2⤵
  PID:6132
- C:\Windows\System\tfSQzFb.exe
  C:\Windows\System\tfSQzFb.exe
  2⤵
  PID:14560
- C:\Windows\System\lNrkumG.exe
  C:\Windows\System\lNrkumG.exe
  2⤵
  PID:6096
- C:\Windows\System\mYfvhlu.exe
  C:\Windows\System\mYfvhlu.exe
  2⤵
  PID:5928
- C:\Windows\System\gpmQKIF.exe
  C:\Windows\System\gpmQKIF.exe
  2⤵
  PID:14720
- C:\Windows\System\bZOxwQs.exe
  C:\Windows\System\bZOxwQs.exe
  2⤵
  PID:14764
- C:\Windows\System\CtNrIuS.exe
  C:\Windows\System\CtNrIuS.exe
  2⤵
  PID:10720
- C:\Windows\System\ejKacTo.exe
  C:\Windows\System\ejKacTo.exe
  2⤵
  PID:14824
- C:\Windows\System\eqpfPxI.exe
  C:\Windows\System\eqpfPxI.exe
  2⤵
  PID:14908
- C:\Windows\System\MJYwJBY.exe
  C:\Windows\System\MJYwJBY.exe
  2⤵
  PID:14948
- C:\Windows\System\AzYZQYJ.exe
  C:\Windows\System\AzYZQYJ.exe
  2⤵
  PID:14988
- C:\Windows\System\MSExaeK.exe
  C:\Windows\System\MSExaeK.exe
  2⤵
  PID:6732
- C:\Windows\System\BogxlRG.exe
  C:\Windows\System\BogxlRG.exe
  2⤵
  PID:15080
- C:\Windows\System\vJPLtdg.exe
  C:\Windows\System\vJPLtdg.exe
  2⤵
  PID:11784
- C:\Windows\System\lmHYzUO.exe
  C:\Windows\System\lmHYzUO.exe
  2⤵
  PID:15160
- C:\Windows\System\pUbnoze.exe
  C:\Windows\System\pUbnoze.exe
  2⤵
  PID:15188
- C:\Windows\System\eIKwKFZ.exe
  C:\Windows\System\eIKwKFZ.exe
  2⤵
  PID:15236
- C:\Windows\System\tEPByKj.exe
  C:\Windows\System\tEPByKj.exe
  2⤵
  PID:15276
- C:\Windows\System\pHSOjga.exe
  C:\Windows\System\pHSOjga.exe
  2⤵
  PID:15332
- C:\Windows\System\XCgHxIx.exe
  C:\Windows\System\XCgHxIx.exe
  2⤵
  PID:15352
- C:\Windows\System\PQwGMSN.exe
  C:\Windows\System\PQwGMSN.exe
  2⤵
  PID:1772
- C:\Windows\System\cUjNlnq.exe
  C:\Windows\System\cUjNlnq.exe
  2⤵
  PID:5332
- C:\Windows\System\ezvMVLx.exe
  C:\Windows\System\ezvMVLx.exe
  2⤵
  PID:11708
- C:\Windows\System\PucUBhB.exe
  C:\Windows\System\PucUBhB.exe
  2⤵
  PID:14536
- C:\Windows\System\lsADNZI.exe
  C:\Windows\System\lsADNZI.exe
  2⤵
  PID:11836
- C:\Windows\System\eBuuUZa.exe
  C:\Windows\System\eBuuUZa.exe
  2⤵
  PID:10616
- C:\Windows\System\MDRdoph.exe
  C:\Windows\System\MDRdoph.exe
  2⤵
  PID:5152
- C:\Windows\System\utaoAGu.exe
  C:\Windows\System\utaoAGu.exe
  2⤵
  PID:11928
- C:\Windows\System\NllOYYf.exe
  C:\Windows\System\NllOYYf.exe
  2⤵
  PID:6756
- C:\Windows\System\taBFxui.exe
  C:\Windows\System\taBFxui.exe
  2⤵
  PID:5208
- C:\Windows\System\vAdKETS.exe
  C:\Windows\System\vAdKETS.exe
  2⤵
  PID:5252
- C:\Windows\System\HEdEltD.exe
  C:\Windows\System\HEdEltD.exe
  2⤵
  PID:7212
- C:\Windows\System\KgnUuzG.exe
  C:\Windows\System\KgnUuzG.exe
  2⤵
  PID:15076
- C:\Windows\System\rGcOcYS.exe
  C:\Windows\System\rGcOcYS.exe
  2⤵
  PID:6432
- C:\Windows\System\UldpAvc.exe
  C:\Windows\System\UldpAvc.exe
  2⤵
  PID:15180
- C:\Windows\System\UtZzyWT.exe
  C:\Windows\System\UtZzyWT.exe
  2⤵
  PID:6416
- C:\Windows\System\VwQHPpa.exe
  C:\Windows\System\VwQHPpa.exe
  2⤵
  PID:2836
- C:\Windows\System\ivHSRHN.exe
  C:\Windows\System\ivHSRHN.exe
  2⤵
  PID:11348
- C:\Windows\System\howroIF.exe
  C:\Windows\System\howroIF.exe
  2⤵
  PID:14664
- C:\Windows\System\cpCzpiG.exe
  C:\Windows\System\cpCzpiG.exe
  2⤵
  PID:14728
- C:\Windows\System\bfiSGnp.exe
  C:\Windows\System\bfiSGnp.exe
  2⤵
  PID:5520
- C:\Windows\System\gAlpqFU.exe
  C:\Windows\System\gAlpqFU.exe
  2⤵
  PID:14892
- C:\Windows\System\nEvHUTI.exe
  C:\Windows\System\nEvHUTI.exe
  2⤵
  PID:15016
- C:\Windows\System\kQmtGIz.exe
  C:\Windows\System\kQmtGIz.exe
  2⤵
  PID:15104
- C:\Windows\System\urotjYu.exe
  C:\Windows\System\urotjYu.exe
  2⤵
  PID:5840
- C:\Windows\System\RIDfUoo.exe
  C:\Windows\System\RIDfUoo.exe
  2⤵
  PID:15296
- C:\Windows\System\RpMLUMJ.exe
  C:\Windows\System\RpMLUMJ.exe
  2⤵
  PID:5372
- C:\Windows\System\RfaALQU.exe
  C:\Windows\System\RfaALQU.exe
  2⤵
  PID:5936
- C:\Windows\System\UyUsYIO.exe
  C:\Windows\System\UyUsYIO.exe
  2⤵
  PID:5796
- C:\Windows\System\SUVGqam.exe
  C:\Windows\System\SUVGqam.exe
  2⤵
  PID:11464
- C:\Windows\System\AIMLiDA.exe
  C:\Windows\System\AIMLiDA.exe
  2⤵
  PID:5768
- C:\Windows\System\KKPqdwg.exe
  C:\Windows\System\KKPqdwg.exe
  2⤵
  PID:5992
- C:\Windows\System\cqJmWzj.exe
  C:\Windows\System\cqJmWzj.exe
  2⤵
  PID:5696
- C:\Windows\System\XrlSAWv.exe
  C:\Windows\System\XrlSAWv.exe
  2⤵
  PID:5504
- C:\Windows\System\JhJNShK.exe
  C:\Windows\System\JhJNShK.exe
  2⤵
  PID:7160
- C:\Windows\System\uPcygeS.exe
  C:\Windows\System\uPcygeS.exe
  2⤵
  PID:10552
- C:\Windows\System\hNpiYHs.exe
  C:\Windows\System\hNpiYHs.exe
  2⤵
  PID:14612
- C:\Windows\System\IBSeLPk.exe
  C:\Windows\System\IBSeLPk.exe
  2⤵
  PID:12320
- C:\Windows\System\wqWpohC.exe
  C:\Windows\System\wqWpohC.exe
  2⤵
  PID:7440
- C:\Windows\System\gRjyhDW.exe
  C:\Windows\System\gRjyhDW.exe
  2⤵
  PID:5700
- C:\Windows\System\cbNjopX.exe
  C:\Windows\System\cbNjopX.exe
  2⤵
  PID:3992
- C:\Windows\System\txqIERX.exe
  C:\Windows\System\txqIERX.exe
  2⤵
  PID:12292
- C:\Windows\System\JYhhQVm.exe
  C:\Windows\System\JYhhQVm.exe
  2⤵
  PID:6852
- C:\Windows\System\ASHLano.exe
  C:\Windows\System\ASHLano.exe
  2⤵
  PID:5456
- C:\Windows\System\BEjWvxJ.exe
  C:\Windows\System\BEjWvxJ.exe
  2⤵
  PID:12380
- C:\Windows\System\yFIDJje.exe
  C:\Windows\System\yFIDJje.exe
  2⤵
  PID:15376
- C:\Windows\System\jNIIVwC.exe
  C:\Windows\System\jNIIVwC.exe
  2⤵
  PID:15408
- C:\Windows\System\hvFUwUm.exe
  C:\Windows\System\hvFUwUm.exe
  2⤵
  PID:15444
- C:\Windows\System\mJSfJox.exe
  C:\Windows\System\mJSfJox.exe
  2⤵
  PID:15460
- C:\Windows\System\zQrMvVI.exe
  C:\Windows\System\zQrMvVI.exe
  2⤵
  PID:15504
- C:\Windows\System\RTBqfWN.exe
  C:\Windows\System\RTBqfWN.exe
  2⤵
  PID:15528
- C:\Windows\System\gPZcSae.exe
  C:\Windows\System\gPZcSae.exe
  2⤵
  PID:15552
- C:\Windows\System\UHkBcFm.exe
  C:\Windows\System\UHkBcFm.exe
  2⤵
  PID:15584
- C:\Windows\System\cnJNDCK.exe
  C:\Windows\System\cnJNDCK.exe
  2⤵
  PID:15608
- C:\Windows\System\SGriZyX.exe
  C:\Windows\System\SGriZyX.exe
  2⤵
  PID:15640
- C:\Windows\System\QGtVuvU.exe
  C:\Windows\System\QGtVuvU.exe
  2⤵
  PID:15668
- C:\Windows\System\aCfhhHI.exe
  C:\Windows\System\aCfhhHI.exe
  2⤵
  PID:15696
- C:\Windows\System\vSTeWMm.exe
  C:\Windows\System\vSTeWMm.exe
  2⤵
  PID:15728
- C:\Windows\System\pAQqjpZ.exe
  C:\Windows\System\pAQqjpZ.exe
  2⤵
  PID:15760
- C:\Windows\System\PxWtzdS.exe
  C:\Windows\System\PxWtzdS.exe
  2⤵
  PID:15788
- C:\Windows\System\MHhaAbZ.exe
  C:\Windows\System\MHhaAbZ.exe
  2⤵
  PID:15816
- C:\Windows\System\JPrrckX.exe
  C:\Windows\System\JPrrckX.exe
  2⤵
  PID:15844
- C:\Windows\System\gTQeGgu.exe
  C:\Windows\System\gTQeGgu.exe
  2⤵
  PID:15872
- C:\Windows\System\KxzETAB.exe
  C:\Windows\System\KxzETAB.exe
  2⤵
  PID:15888
- C:\Windows\System\HEzgcjO.exe
  C:\Windows\System\HEzgcjO.exe
  2⤵
  PID:15944
- C:\Windows\System\brcfrXE.exe
  C:\Windows\System\brcfrXE.exe
  2⤵
  PID:15960
- C:\Windows\System\INvySUt.exe
  C:\Windows\System\INvySUt.exe
  2⤵
  PID:15988
- C:\Windows\System\eGYpmHm.exe
  C:\Windows\System\eGYpmHm.exe
  2⤵
  PID:16024
- C:\Windows\System\SYfXLYI.exe
  C:\Windows\System\SYfXLYI.exe
  2⤵
  PID:16060
- C:\Windows\System\WPmoccl.exe
  C:\Windows\System\WPmoccl.exe
  2⤵
  PID:16088
- C:\Windows\System\AECfmJw.exe
  C:\Windows\System\AECfmJw.exe
  2⤵
  PID:16116
- C:\Windows\System\KMLDbHD.exe
  C:\Windows\System\KMLDbHD.exe
  2⤵
  PID:16152
- C:\Windows\System\giylwSm.exe
  C:\Windows\System\giylwSm.exe
  2⤵
  PID:16180
- C:\Windows\System\LRSAeaQ.exe
  C:\Windows\System\LRSAeaQ.exe
  2⤵
  PID:16212
- C:\Windows\System\jHKpHdb.exe
  C:\Windows\System\jHKpHdb.exe
  2⤵
  PID:16240
- C:\Windows\System\hupXibT.exe
  C:\Windows\System\hupXibT.exe
  2⤵
  PID:16260
- C:\Windows\System\WRMHdED.exe
  C:\Windows\System\WRMHdED.exe
  2⤵
  PID:16300
- C:\Windows\System\bnBOJdi.exe
  C:\Windows\System\bnBOJdi.exe
  2⤵
  PID:16328
- C:\Windows\System\SRGrBOC.exe
  C:\Windows\System\SRGrBOC.exe
  2⤵
  PID:16344
- C:\Windows\System\XrEmyZF.exe
  C:\Windows\System\XrEmyZF.exe
  2⤵
  PID:15364
- C:\Windows\System\GfTQKhK.exe
  C:\Windows\System\GfTQKhK.exe
  2⤵
  PID:15456
- C:\Windows\System\DRPFfKo.exe
  C:\Windows\System\DRPFfKo.exe
  2⤵
  PID:15512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:10472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s4ka1e0o.2mc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AjkIBkj.exe

Filesize
3.3MB

MD5
1344b752b7d7ccafb67944727f675622

SHA1
0d5ae0f462e7b58fe3702e8dcbcc4efbcba94509

SHA256
1b5f3b4600d9ce70e7a037f1e8f760bbe429aeb4819190fd9eba0f037546a6e9

SHA512
92afec5890edec926644fdc281f4ecdcde5ee20b868d5a61ee51443a05dce8540c0da4b1cd2440597080526e865733679b96acac078675116220517cbdee6033

Download Submit
C:\Windows\System\AqiEdDJ.exe

Filesize
3.3MB

MD5
a47ebf01eb9dec89814741f31c168a3f

SHA1
937716e6a68256b2df92b4c91ad3d9e381cfa23a

SHA256
94690143599b880f88871e6bfbf1afe738d0619643e182531e45dc3708acb931

SHA512
70d250d462dbd1a74d1e4c6991f29ad362d2e6af2e351a5e6fd1a1e2078c16214d89131752b7ab28135b04b8a5e41b03ab929c96870c9d2fd0c48003c22a71be

Download Submit
C:\Windows\System\EXgxKDO.exe

Filesize
3.3MB

MD5
5fea7cc352fc5e38dc1c2d917ec1608e

SHA1
a5cbaa0209326db3b5085eaef8a19d78318b8f59

SHA256
6be58bdcd1ee228f26de7e22548f144ed355beae64d59ab1a691a514774a895f

SHA512
642ad57833765f8c8eff86cc87a170c7752bc903a2ce9ac6e85d0479d70ce74c12f5b39c29146095d86742a8ccd1e0b382b727cfcc6ffd3dc5296f13b5a3ab62

Download Submit
C:\Windows\System\JhgfYbN.exe

Filesize
3.3MB

MD5
c602e99b1c6b8bb2b8af1236eceec9fa

SHA1
47f7671cd4056c8b9de1838b3d65cdb2cdb6501a

SHA256
72326f320a1aab7ee7ca3d2defe45a229d30f2afbe10dc89bf387735c1c56b20

SHA512
8be628e524e681278acaaee485e1e8d16e999236197b8cd1a43c51dc9d3e04ed1232f00694e851198a76ef7a15798c7586fe462e2165685dda17ff8223ab0074

Download Submit
C:\Windows\System\QEkQhgm.exe

Filesize
3.3MB

MD5
0b0f84f3ab8d3c7e19b5493b56871db4

SHA1
8296299aa8c996a011a4e2dad327c7afc5357506

SHA256
501b6cb7be165e7fe75008be0e6197d3b53a6e1b2dc1ad6b7057d6bdf00ed68e

SHA512
31dc8abe141b3abf4fc0a1e7b15d5fa51e4b61c253e50e58f2c57dcbf5e29306717d43b08d52aaeceaab2236bd1063c89b52ce17151f95f0e8240bd3bba1d9c9

Download Submit
C:\Windows\System\QNLNdaB.exe

Filesize
3.3MB

MD5
a09a50e8a7ec0918c93ccf3f93629995

SHA1
b7f9b5718bddb7b186ab9d1fcbe85d3d38c30766

SHA256
d6e7e64cc9885f3b35cb93866aa3920834b2ebabcf648cb4f22aef59e907769e

SHA512
c197973bf399e1a6e26dd25bf2fdc2d1b1a6d0088babb8c51fab5e3bf634da6c3ab1a86b94f98128f19d2173f5640f9d537972d829d5e6868568400887d28ffe

Download Submit
C:\Windows\System\QbiIMZV.exe

Filesize
3.3MB

MD5
3dbb7fc6641bb756a04a75cac3dccfd0

SHA1
0afb23ecd479b915b2815b19e8a5a8bfb95accad

SHA256
907e2061ad472f8cd4788c363460e1a04dbfb929eb9bb02a37d2e1870d8163e6

SHA512
88a2a5de622d61cf659ef0623de5a6477b1be459f1757084f96712b14a066b92db8a4137ea2dc86fa577e2020d6b6b7488eea7a53c2c8cbc47b07c2af0c3713b

Download Submit
C:\Windows\System\RuUvbBg.exe

Filesize
3.3MB

MD5
e6a57bdb61d77c7d78ae5d3753e2737b

SHA1
75e84cbf44de980cfd8fb2e5f9a395c28001c964

SHA256
7930846cb4a25ee078cce0ae3668fe63435eace8b22ee5df9131a6943d3b721a

SHA512
7b43da68282af2bb517ce326937cd2bb9c7360400420047e8083c42bb97db05ebcd53e4c0698e06f56dedc2f1fd6d1055f051b5a720e0814ac23b994f28ed5a6

Download Submit
C:\Windows\System\UBXDipP.exe

Filesize
3.3MB

MD5
16766b06577198458252b27ee464347b

SHA1
545189b6999e147f27927112cd8b436033f59d9c

SHA256
8c01c63b18e46878f975b63e52315f7f9bec8e7d72a7d12953db8e51499c3084

SHA512
a3e5d54e03c8c89335a45822fee74b37528151c3d9a1dd29ea023fe3f3b2446627464ab55a41dc74cb9f63ddb0d64ad9a8c4f343209e621f6ab4b42dee8a38ba

Download Submit
C:\Windows\System\XdKYKNc.exe

Filesize
3.3MB

MD5
decb72b972b2e624e5ddf131bf5cd901

SHA1
3d164e3979e0c0406eae12c9a7aa66c265d67e69

SHA256
219a8b58425989ee19c2c147aef775145725a738c3e40bdc7fcafc3d7271b90c

SHA512
44155716661043d9aa500b1dc3e095251da7532bbd93cfada08100429d6fb59a9f5de65c827ed699133a72c1c7a8ed00648787ae6f3dc0a543622e8221ab955f

Download Submit
C:\Windows\System\YFtOZCC.exe

Filesize
3.3MB

MD5
39822f7c36a950a0f22be9d207c47f9a

SHA1
8648f4e21673b3baa00a92729692f1a949977682

SHA256
3d9e0a7dd17fe0e14a56514418c109195fd7040aca4d31d56c5c4fc1e09ac8bc

SHA512
57e71a4ca0ca454777f55bbabb2d2bca0d5b83a608df67d34b12f4c3b4146556b409db2a6eb19c347ee418cacf19542d1332dbd1873aa1ed31b74e432de1c6ed

Download Submit
C:\Windows\System\ZgHoKdh.exe

Filesize
3.3MB

MD5
be99fa17874946d710291a9b9b467252

SHA1
f10645dab2fdd43784aa69c9fef09fdbd6165b4f

SHA256
9a9d3c56e2d564989f48ba3db0c7447ea34de9fcc7129a4fa167c847511d2651

SHA512
6baa4ab16f4f7f371eae35ccc9c33fe9aac3ae40221462bdb8d5cc8786cce8fe03b4e9d3bab04c15ffeed93950117fae86303c1f825fdb56b9a8c48b498eebe7

Download Submit
C:\Windows\System\aTMVCaN.exe

Filesize
3.3MB

MD5
c8085ca3d9e64e6e3e03921b7c28d104

SHA1
40f57d1523eb22cd3e2d29e89f62888991e5609f

SHA256
426eed79960d06f180374998c0ac741be821ffa1074aef4e2de2a0c99815d2d1

SHA512
831725e5ef19aed3b1fc1f3570717071254a96c23bae1b6978ccfcf85da8bf523d42948e1e04f570154cea7b562cec768cf4ab70b3d077e8b4e0157005d41016

Download Submit
C:\Windows\System\aZFIDyG.exe

Filesize
3.3MB

MD5
fc9e1270c3eea98025bb77406896cd57

SHA1
9c1eb499d9ef0cb1f88583814572b66a5e7e9adf

SHA256
e86fe62060ca6c33ce440a7ff2ee598ff32462e4eba879d294a313eb0ac6e7d7

SHA512
617dcc60679871febd66db8e123197a77ada45d42f83251e4230dcb999e33eb7aea0b16f2f4b165d0f8d40e232a070b58afb8a1c8caac6d489294187b12d2d8c

Download Submit
C:\Windows\System\blaonQo.exe

Filesize
3.3MB

MD5
3e9195f205ebfda8b63d40cbebbe8eb9

SHA1
cd7cecb427f66a1cfcd830516fbfafa275e4217c

SHA256
0dd96a3918222e9badb5566f206c108feadd6cd56037276fa915f637144020b6

SHA512
9977b203858d197f57fb0adbf1b7a22ead6ff83e48cbdd206ec8391b1f31e1be8f926eb2260117ecd4b48922c38e6ec84235a6c1aba3ed2a53c6ff959f153aeb

Download Submit
C:\Windows\System\cEFCieO.exe

Filesize
3.3MB

MD5
229f1b948c1b1fd199981b00c9307223

SHA1
49835842f9b21e2d9cd5e038dfaf81f2803da24c

SHA256
18f3a563891761b882df7162eaa21885bfe89efe0a3c15cbdfa567d1f4cf011e

SHA512
7607095e7498b4220763551a4cb02c81861a1aa6bb985dc118f28bb1f1d9935236f03243d1b9b32a3f5e018346488ac55b25337ee5c31b525aa24eb1e4a08154

Download Submit
C:\Windows\System\efOxJdQ.exe

Filesize
3.3MB

MD5
76083a5430463ae711500a95f272a2b3

SHA1
6de1fdf8905972dc7dc1f974414bc98a67acabe7

SHA256
8920cf371dcd95b469b9b2e00ed90f3e46541d7b1fb612fc5f69e648e328544a

SHA512
86015a3a4618199c6e9dd9aaf04fd230a98a712af1a41214b7fc127f9a700b458a06b145d7d863236ca5fd6d7570ca3b5757a93034f553e0a2ac13767b832f9e

Download Submit
C:\Windows\System\egQdbTj.exe

Filesize
3.3MB

MD5
a51c317df1342fb8305e478ccb8b5a72

SHA1
90b34c605759c487ac63125a348663b4355109f5

SHA256
063c9b2d17fc9042d35bc7c5118f08ca174d80c154c1ade6657ba1129568eed0

SHA512
013daf0b915f9bee1e33a2ee646cd793491546f163db012ae1ab386c3977ca74ec9e0de32f4fa196cded4376fc616a088043e03e473036f1fe6521f12027acb7

Download Submit
C:\Windows\System\gLwgOjh.exe

Filesize
3.3MB

MD5
04748e7736087a2972465b7b9ff8959e

SHA1
7589607e988e61b87f5472a341bf3f732c7806df

SHA256
cec7d49589b31d284239450e46409bb2a7a725b5527ae21b61db0989dc5b3591

SHA512
19318f54854b024da20a8e9c1a55c2811d9e0f15bdb30533b17c279d098c4070875b58d03b5e79c0030c8392ad8b7b9033d22509aed1277bb994fe3afcffddf9

Download Submit
C:\Windows\System\gwsEudb.exe

Filesize
3.3MB

MD5
206cccfff13cdd3c95b582de9a43e5b8

SHA1
b47ad072926008bb5ecb79862d896063050a07f5

SHA256
af68306a8de19b7057b89b58dc8373c435bc7181e9c105ab7a052874a3db704e

SHA512
32c7c08e60aa059c162baa481a6d8d873e72f203545f717fd773350f6ceb05015927f20176238d124c2120d099d976e9ba977618597edb45f6f258e6cb80bced

Download Submit
C:\Windows\System\hBfqjTC.exe

Filesize
3.3MB

MD5
b868852eaf960569a2c3d3f18bd62b4c

SHA1
4619d736b6a6a9b0a3da6bc9c9d6d16589f6bcd3

SHA256
5c46ad69fcd8eee2c410b19af8a6d01f0df19743e6469e645f99bc6f6bd80874

SHA512
e5334809997f0dcb097f1da195ef262443349f7e1c1ffcb1188c41b1bec5be11d060831bd210aef9ec6625ad6ed884fc26158abffe65bf22b863aade364cfd9d

Download Submit
C:\Windows\System\hwEdPcF.exe

Filesize
3.3MB

MD5
0ae2dc1712c45c391011876bf0602631

SHA1
854398027f7179d52a83dcc83556c90a4f4e76a3

SHA256
f710dbf7ff40a2b85cb836e2a36b545ae1522fb6bc18e28624117e01d59d43a9

SHA512
224c4e96432712030ea2e2b8bd27a207442cd65b2497d2aa05942e189fc938cb940d3dc2934af8412451104a80667768809115ee56d61e45be45fcae41481dd8

Download Submit
C:\Windows\System\indLhkQ.exe

Filesize
3.3MB

MD5
6608898b9b0aa24687bbc606cb0924d2

SHA1
946cc8969d78bb2b224e1d1d5fa832dd4bb9af59

SHA256
46702d3a8fe51d210bfdc5f8ae9541455a9f7f2a6497ecf32026c3ed43d384f4

SHA512
0b8064b40b025bc746e46bb21d1d57892772fb5c2f8dfa8be7c576aa444ac5772934e5d13357226172ea0ce15c345ac15a85ee4162dcf459a1aed274a27463b3

Download Submit
C:\Windows\System\jEbyIMp.exe

Filesize
3.3MB

MD5
b7c75cdb5f668fb17b39c7bd4188def4

SHA1
97e5ba796b375c63fbc98cd3d429ae9332299888

SHA256
c367ac49d2cea247c20b03ea279991500ee0f704e502848b529e86b984625b19

SHA512
cb1aa6fff03dae5abae5021453ce038a4912f93ffa08f1fde8394d6f26ae925f6104278277f3412496478df7262d0e6860a054404076d15f6f5ab754c762223e

Download Submit
C:\Windows\System\lxYSBoM.exe

Filesize
3.3MB

MD5
070371acc6ecdb1260d92e2e8f9a1326

SHA1
2ce0ee8120688523ef3d35b796435ac6d04b031c

SHA256
05a406a3b416dfcc61cde23e98b6d21663df030e87196d6b9d1de4055f1bca1c

SHA512
6a9ae8047e6e82717bbd91545a3b81557a572be8edf26fb6996498fa3c39c2adcca0e07dc091bb2c2ca9d344c096ec36e075f0f3d3b22370e507c11f2de1b6d8

Download Submit
C:\Windows\System\oBGKHQa.exe

Filesize
3.3MB

MD5
60c6aa382dd6d0a98d396a0cbbcec913

SHA1
7033ac1e5ad1cec7f5b75e146b788ad3cd385df9

SHA256
22688d34e0cfa2d79373cbb336038af6a396e8c1ab7c0405b7a06fab908a523e

SHA512
691fd54701ef4a32735ba4642f88e34b325e2941a9a2428881bddcc367247e8f5b6a66b92e1c086f65c8ea20cf7cf1774321e4acb5cefddf62b15c82940288e7

Download Submit
C:\Windows\System\pYrQQxu.exe

Filesize
3.3MB

MD5
fa17242402864a42f54a953c44d8c5c4

SHA1
bbe33d84ccfa3cca9f25650f2cbff08a566f9b04

SHA256
a0554ed7d31e70ca9418b46021596ffdceb64c5eb770d0b75141a84e444ef9c7

SHA512
fe5ab8a32821d0cf639550aa8edff86dda8d8268af16a51d9a88c3306a5cee7d6f58dd585d4fee07d55154fe608d44910b3db09dc5f84c4496c3c49e7d401ef3

Download Submit
C:\Windows\System\rTuPJaj.exe

Filesize
3.3MB

MD5
751acf8cf63a0ca141c1cb9464c1f264

SHA1
23650a47668416f02b2d16793801eecc8340e5cc

SHA256
dd6604ad50982ae29442aeb3c6c6ee23a2c62133db70ae1b8f26a1e3f5069c6f

SHA512
a779bb77baf92fadd69bb2326f208d80beede14edc058f0896f35e0f259adc5e6b6aecbfad22f3ed974f6561bcb9e9f1b82ba805cfc54dc7efb1b3893fc4570b

Download Submit
C:\Windows\System\shNiNsu.exe

Filesize
3.3MB

MD5
feef36c90df82290f1f72801cc739e79

SHA1
dcfbffe736cc7eb9898dcf5e9f0669bebe290081

SHA256
50018ef977656f8efd9aed2fb3fb764598cde2a14fd54f148696dba9457ba7d0

SHA512
6eeb4e277a76d08a78967cdd0a2a695d91a3ed8869454c6353d23f7fb1c1e065e23c417f691d6a295108aaa721ab2bcd19309791dcd5d2927aa574106f9faf20

Download Submit
C:\Windows\System\tQwrhQe.exe

Filesize
3.3MB

MD5
c149e03f0df7c1bd16ddc02d20202c32

SHA1
f33f6d9c33a2b3c97c21eaf45f86c4a53449c4f9

SHA256
52951b7299baec22551ee2282880a06435fdad06968ce9b5ace4f7a3e6d3cdef

SHA512
c298722d98793aa129a5010997bd324e6f0a753ddf21aa2244d4f02b65e074e8654f2491604a33a1ed1763578e606b1406f3b60e9810f450c88ba022f950922a

Download Submit
C:\Windows\System\uOAdcDG.exe

Filesize
3.3MB

MD5
fdc0da1502afa7f8f2160bffc1058957

SHA1
1558d16e5103f350137332d59dd1ca50cb22815d

SHA256
3d081bcc82f2023d3587b84b996fde6552e9e828a37de6a9541b73e2ac80f252

SHA512
b767cecb7d2ff4ebffc0f24ae456431f365acf309516aaa57f1b77a7bc1cff4e68ab713017e0ad1966edb2a0d58d6244ba48e4001796553194d8a550267fb665

Download Submit
C:\Windows\System\yXtwexW.exe

Filesize
3.3MB

MD5
3b494ad0b8e35006b78e7dec98acdf0f

SHA1
d5874bd323aaa61cc910f0bde0c9fffaa6ae5b7b

SHA256
0f3e3b662128bad717a08ea5e0f8409c61a6e928626a03c31f3e7e3355950adb

SHA512
d77d4ed63885b434f9c9a56ad05146734d4a488b98d2cd3b7a1ea50f494fa3cccc70250aed2278ff631848f7e0f330f1e031a7ade2349bfda72d62fe7d286aee

Download Submit
memory/116-37-0x00007FF76AA70000-0x00007FF76AE66000-memory.dmp

Filesize
4.0MB

Download
memory/116-1216-0x00007FF76AA70000-0x00007FF76AE66000-memory.dmp

Filesize
4.0MB

Download
memory/492-120-0x00007FF78F230000-0x00007FF78F626000-memory.dmp

Filesize
4.0MB

Download
memory/492-1576-0x00007FF78F230000-0x00007FF78F626000-memory.dmp

Filesize
4.0MB

Download
memory/1112-1465-0x00007FF799A50000-0x00007FF799E46000-memory.dmp

Filesize
4.0MB

Download
memory/1112-69-0x00007FF799A50000-0x00007FF799E46000-memory.dmp

Filesize
4.0MB

Download
memory/1124-1611-0x00007FF763F40000-0x00007FF764336000-memory.dmp

Filesize
4.0MB

Download
memory/1124-130-0x00007FF763F40000-0x00007FF764336000-memory.dmp

Filesize
4.0MB

Download
memory/1288-1458-0x00007FF6789E0000-0x00007FF678DD6000-memory.dmp

Filesize
4.0MB

Download
memory/1288-38-0x00007FF6789E0000-0x00007FF678DD6000-memory.dmp

Filesize
4.0MB

Download
memory/1288-119-0x00007FF6789E0000-0x00007FF678DD6000-memory.dmp

Filesize
4.0MB

Download
memory/1892-113-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Filesize
10.8MB

Download
memory/1892-386-0x000001C8644B0000-0x000001C864C56000-memory.dmp

Filesize
7.6MB

Download
memory/1892-10-0x00007FFCE8BB3000-0x00007FFCE8BB5000-memory.dmp

Filesize
8KB

Download
memory/1892-39-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Filesize
10.8MB

Download
memory/1892-35-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Filesize
10.8MB

Download
memory/1892-63-0x000001C8637D0000-0x000001C8637F2000-memory.dmp

Filesize
136KB

Download
memory/1892-95-0x00007FFCE8BB3000-0x00007FFCE8BB5000-memory.dmp

Filesize
8KB

Download
memory/1976-1189-0x00007FF6151B0000-0x00007FF6155A6000-memory.dmp

Filesize
4.0MB

Download
memory/1976-40-0x00007FF6151B0000-0x00007FF6155A6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-390-0x00007FF7DAA60000-0x00007FF7DAE56000-memory.dmp

Filesize
4.0MB

Download
memory/1992-1642-0x00007FF7DAA60000-0x00007FF7DAE56000-memory.dmp

Filesize
4.0MB

Download
memory/2020-1633-0x00007FF781140000-0x00007FF781536000-memory.dmp

Filesize
4.0MB

Download
memory/2020-398-0x00007FF781140000-0x00007FF781536000-memory.dmp

Filesize
4.0MB

Download
memory/2036-82-0x00007FF640120000-0x00007FF640516000-memory.dmp

Filesize
4.0MB

Download
memory/2036-1181-0x00007FF640120000-0x00007FF640516000-memory.dmp

Filesize
4.0MB

Download
memory/2036-8-0x00007FF640120000-0x00007FF640516000-memory.dmp

Filesize
4.0MB

Download
memory/2180-1467-0x00007FF6D1030000-0x00007FF6D1426000-memory.dmp

Filesize
4.0MB

Download
memory/2180-76-0x00007FF6D1030000-0x00007FF6D1426000-memory.dmp

Filesize
4.0MB

Download
memory/2316-379-0x00007FF7ED440000-0x00007FF7ED836000-memory.dmp

Filesize
4.0MB

Download
memory/2316-1639-0x00007FF7ED440000-0x00007FF7ED836000-memory.dmp

Filesize
4.0MB

Download
memory/2376-394-0x00007FF703F90000-0x00007FF704386000-memory.dmp

Filesize
4.0MB

Download
memory/2376-1643-0x00007FF703F90000-0x00007FF704386000-memory.dmp

Filesize
4.0MB

Download
memory/3052-402-0x00007FF74E7A0000-0x00007FF74EB96000-memory.dmp

Filesize
4.0MB

Download
memory/3052-1636-0x00007FF74E7A0000-0x00007FF74EB96000-memory.dmp

Filesize
4.0MB

Download
memory/3156-1464-0x00007FF7B8DB0000-0x00007FF7B91A6000-memory.dmp

Filesize
4.0MB

Download
memory/3156-62-0x00007FF7B8DB0000-0x00007FF7B91A6000-memory.dmp

Filesize
4.0MB

Download
memory/3504-1199-0x00007FF63F020000-0x00007FF63F416000-memory.dmp

Filesize
4.0MB

Download
memory/3504-36-0x00007FF63F020000-0x00007FF63F416000-memory.dmp

Filesize
4.0MB

Download
memory/3624-94-0x00007FF6466F0000-0x00007FF646AE6000-memory.dmp

Filesize
4.0MB

Download
memory/3624-1535-0x00007FF6466F0000-0x00007FF646AE6000-memory.dmp

Filesize
4.0MB

Download
memory/3876-1511-0x00007FF6D9CF0000-0x00007FF6DA0E6000-memory.dmp

Filesize
4.0MB

Download
memory/3876-83-0x00007FF6D9CF0000-0x00007FF6DA0E6000-memory.dmp

Filesize
4.0MB

Download
memory/3900-1626-0x00007FF6EC130000-0x00007FF6EC526000-memory.dmp

Filesize
4.0MB

Download
memory/3900-132-0x00007FF6EC130000-0x00007FF6EC526000-memory.dmp

Filesize
4.0MB

Download
memory/4068-114-0x00007FF623170000-0x00007FF623566000-memory.dmp

Filesize
4.0MB

Download
memory/4068-1570-0x00007FF623170000-0x00007FF623566000-memory.dmp

Filesize
4.0MB

Download
memory/4260-1182-0x00007FF6D25B0000-0x00007FF6D29A6000-memory.dmp

Filesize
4.0MB

Download
memory/4260-96-0x00007FF6D25B0000-0x00007FF6D29A6000-memory.dmp

Filesize
4.0MB

Download
memory/4260-17-0x00007FF6D25B0000-0x00007FF6D29A6000-memory.dmp

Filesize
4.0MB

Download
memory/4360-1461-0x00007FF7E1E60000-0x00007FF7E2256000-memory.dmp

Filesize
4.0MB

Download
memory/4360-56-0x00007FF7E1E60000-0x00007FF7E2256000-memory.dmp

Filesize
4.0MB

Download
memory/4360-361-0x00007FF7E1E60000-0x00007FF7E2256000-memory.dmp

Filesize
4.0MB

Download
memory/4432-1538-0x00007FF7CCFA0000-0x00007FF7CD396000-memory.dmp

Filesize
4.0MB

Download
memory/4432-100-0x00007FF7CCFA0000-0x00007FF7CD396000-memory.dmp

Filesize
4.0MB

Download
memory/4476-380-0x00007FF73D260000-0x00007FF73D656000-memory.dmp

Filesize
4.0MB

Download
memory/4476-1641-0x00007FF73D260000-0x00007FF73D656000-memory.dmp

Filesize
4.0MB

Download
memory/4768-1564-0x00007FF7485D0000-0x00007FF7489C6000-memory.dmp

Filesize
4.0MB

Download
memory/4768-115-0x00007FF7485D0000-0x00007FF7489C6000-memory.dmp

Filesize
4.0MB

Download
memory/5088-1-0x000002A83DF20000-0x000002A83DF30000-memory.dmp

Filesize
64KB

Download
memory/5088-0-0x00007FF6F4580000-0x00007FF6F4976000-memory.dmp

Filesize
4.0MB

Download
memory/5088-75-0x00007FF6F4580000-0x00007FF6F4976000-memory.dmp

Filesize
4.0MB

Download