xmrig | 50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
Size

1.9MB
MD5

07c428c9e735b1fa22effd49200e8a10
SHA1

caa14924570962e1fa0f85a9c04f2ed4657edf3b
SHA256

50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e
SHA512

bad66ebb2ccb66b691b1f976ff578d2e9d2a8e65302db9cbd96645b87bd9676eb79728fbceb687adea5ba9d0ea472bf984bf656a2e5835d124fbf1541fcb1f0b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapbU4w2DyA7lO1eANsT4Z8+8KYECFj1oqZoc1j:Lz071uv4BPm6lgVJUwD+83FhZ35wgHT9

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/4888-73-0x00007FF6D8D10000-0x00007FF6D9102000-memory.dmp	xmrig
behavioral2/memory/1460-81-0x00007FF63EB50000-0x00007FF63EF42000-memory.dmp	xmrig
behavioral2/memory/2908-118-0x00007FF6A1010000-0x00007FF6A1402000-memory.dmp	xmrig
behavioral2/memory/2752-117-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp	xmrig
behavioral2/memory/4916-116-0x00007FF743370000-0x00007FF743762000-memory.dmp	xmrig
behavioral2/memory/4524-111-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp	xmrig
behavioral2/memory/3644-103-0x00007FF7148B0000-0x00007FF714CA2000-memory.dmp	xmrig
behavioral2/memory/3384-80-0x00007FF6EB910000-0x00007FF6EBD02000-memory.dmp	xmrig
behavioral2/memory/2864-74-0x00007FF722450000-0x00007FF722842000-memory.dmp	xmrig
behavioral2/memory/2756-35-0x00007FF637CE0000-0x00007FF6380D2000-memory.dmp	xmrig
behavioral2/memory/3964-325-0x00007FF63D330000-0x00007FF63D722000-memory.dmp	xmrig
behavioral2/memory/3044-381-0x00007FF7111A0000-0x00007FF711592000-memory.dmp	xmrig
behavioral2/memory/2780-347-0x00007FF7427C0000-0x00007FF742BB2000-memory.dmp	xmrig
behavioral2/memory/1232-323-0x00007FF69E3D0000-0x00007FF69E7C2000-memory.dmp	xmrig
behavioral2/memory/464-320-0x00007FF7D6240000-0x00007FF7D6632000-memory.dmp	xmrig
behavioral2/memory/3012-318-0x00007FF748BE0000-0x00007FF748FD2000-memory.dmp	xmrig
behavioral2/memory/4864-321-0x00007FF7041D0000-0x00007FF7045C2000-memory.dmp	xmrig
behavioral2/memory/3012-2187-0x00007FF748BE0000-0x00007FF748FD2000-memory.dmp	xmrig
behavioral2/memory/2388-2192-0x00007FF6815E0000-0x00007FF6819D2000-memory.dmp	xmrig
behavioral2/memory/2792-2193-0x00007FF602BE0000-0x00007FF602FD2000-memory.dmp	xmrig
behavioral2/memory/3116-2194-0x00007FF7F3DD0000-0x00007FF7F41C2000-memory.dmp	xmrig
behavioral2/memory/4244-2195-0x00007FF66B270000-0x00007FF66B662000-memory.dmp	xmrig
behavioral2/memory/464-2197-0x00007FF7D6240000-0x00007FF7D6632000-memory.dmp	xmrig
behavioral2/memory/4864-2200-0x00007FF7041D0000-0x00007FF7045C2000-memory.dmp	xmrig
behavioral2/memory/2756-2215-0x00007FF637CE0000-0x00007FF6380D2000-memory.dmp	xmrig
behavioral2/memory/4888-2217-0x00007FF6D8D10000-0x00007FF6D9102000-memory.dmp	xmrig
behavioral2/memory/2864-2235-0x00007FF722450000-0x00007FF722842000-memory.dmp	xmrig
behavioral2/memory/3964-2243-0x00007FF63D330000-0x00007FF63D722000-memory.dmp	xmrig
behavioral2/memory/3636-2256-0x00007FF6F4A80000-0x00007FF6F4E72000-memory.dmp	xmrig
behavioral2/memory/888-2253-0x00007FF74F8F0000-0x00007FF74FCE2000-memory.dmp	xmrig
behavioral2/memory/3384-2260-0x00007FF6EB910000-0x00007FF6EBD02000-memory.dmp	xmrig
behavioral2/memory/1460-2264-0x00007FF63EB50000-0x00007FF63EF42000-memory.dmp	xmrig
behavioral2/memory/4524-2268-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp	xmrig
behavioral2/memory/2752-2270-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp	xmrig
behavioral2/memory/3644-2266-0x00007FF7148B0000-0x00007FF714CA2000-memory.dmp	xmrig
behavioral2/memory/4916-2262-0x00007FF743370000-0x00007FF743762000-memory.dmp	xmrig
behavioral2/memory/1232-2259-0x00007FF69E3D0000-0x00007FF69E7C2000-memory.dmp	xmrig
behavioral2/memory/2908-2275-0x00007FF6A1010000-0x00007FF6A1402000-memory.dmp	xmrig
behavioral2/memory/888-2285-0x00007FF74F8F0000-0x00007FF74FCE2000-memory.dmp	xmrig
behavioral2/memory/2388-2282-0x00007FF6815E0000-0x00007FF6819D2000-memory.dmp	xmrig
behavioral2/memory/2792-2278-0x00007FF602BE0000-0x00007FF602FD2000-memory.dmp	xmrig
behavioral2/memory/4244-2274-0x00007FF66B270000-0x00007FF66B662000-memory.dmp	xmrig
behavioral2/memory/3116-2280-0x00007FF7F3DD0000-0x00007FF7F41C2000-memory.dmp	xmrig
behavioral2/memory/2776-3165-0x00007FF740180000-0x00007FF740572000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
10	400	powershell.exe
12	400	powershell.exe
14	400	powershell.exe
15	400	powershell.exe
17	400	powershell.exe
21	400	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
400	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
464	MQTguNt.exe
4864	khYiwfH.exe
2756	pLPNgwi.exe
1232	rWaKXaR.exe
4888	Mcjhjql.exe
3964	FxoIUwn.exe
2864	xQZuCIV.exe
3384	CCVslqt.exe
4916	RbkxTzr.exe
1460	FecuraY.exe
3644	wNLoGJU.exe
4524	UZEvQrv.exe
2752	fwnRSlL.exe
2908	GsMxtDZ.exe
888	YwwYMtB.exe
2388	rXrTKlP.exe
2792	lmvUzpE.exe
3116	aXiHvDC.exe
4244	TpBWNpk.exe
2780	MGBtzGd.exe
2088	HSMfxnW.exe
3044	DiPejju.exe
3636	nKeHbBr.exe
2776	eQMHPbB.exe
960	sWpKISf.exe
4372	DGeBqsh.exe
1560	YmtGvJQ.exe
1260	dZaWBav.exe
3504	xKfQSYw.exe
3732	SNusQjb.exe
3740	IDxkufC.exe
1288	DynSduz.exe
1516	godwhwU.exe
4444	SANhOhV.exe
2804	WAKqVkI.exe
1916	CglQszt.exe
4156	smuPwRW.exe
3796	kKZkroR.exe
2568	rQrwydJ.exe
4380	MBSGhiN.exe
3532	piJuviZ.exe
512	UsDEimt.exe
1456	gpkRVHQ.exe
2096	tcCSrqJ.exe
3848	DDIVmLp.exe
5068	cEGSXOW.exe
1184	cJVgLzd.exe
1224	piiyyeS.exe
2544	QtlmvWk.exe
1972	uzcjKHy.exe
1000	nUCVccc.exe
1384	EUJaTJn.exe
2452	yxiagIJ.exe
4144	TQgcEUJ.exe
3892	iceffdp.exe
4944	NSXmBMd.exe
5152	TfoBFXq.exe
5188	VjDGeBD.exe
5216	jJjSvXC.exe
5248	baxNEQO.exe
5276	ftFxzVQ.exe
5300	mJreDPr.exe
5328	QgqWbKj.exe
5356	VZcpTRp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3012-0-0x00007FF748BE0000-0x00007FF748FD2000-memory.dmp	upx
behavioral2/memory/464-6-0x00007FF7D6240000-0x00007FF7D6632000-memory.dmp	upx
behavioral2/files/0x0007000000023478-11.dat	upx
behavioral2/files/0x0008000000023474-10.dat	upx
behavioral2/files/0x0007000000023479-9.dat	upx
behavioral2/files/0x000700000002347c-34.dat	upx
behavioral2/memory/4864-23-0x00007FF7041D0000-0x00007FF7045C2000-memory.dmp	upx
behavioral2/files/0x000700000002347a-49.dat	upx
behavioral2/files/0x0007000000023480-53.dat	upx
behavioral2/memory/4888-73-0x00007FF6D8D10000-0x00007FF6D9102000-memory.dmp	upx
behavioral2/memory/1460-81-0x00007FF63EB50000-0x00007FF63EF42000-memory.dmp	upx
behavioral2/files/0x0007000000023483-91.dat	upx
behavioral2/memory/2792-113-0x00007FF602BE0000-0x00007FF602FD2000-memory.dmp	upx
behavioral2/memory/2908-118-0x00007FF6A1010000-0x00007FF6A1402000-memory.dmp	upx
behavioral2/files/0x000700000002348a-128.dat	upx
behavioral2/files/0x0007000000023489-126.dat	upx
behavioral2/files/0x0007000000023488-124.dat	upx
behavioral2/files/0x0007000000023487-122.dat	upx
behavioral2/files/0x0007000000023485-120.dat	upx
behavioral2/memory/888-119-0x00007FF74F8F0000-0x00007FF74FCE2000-memory.dmp	upx
behavioral2/memory/2752-117-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp	upx
behavioral2/memory/4916-116-0x00007FF743370000-0x00007FF743762000-memory.dmp	upx
behavioral2/memory/4244-115-0x00007FF66B270000-0x00007FF66B662000-memory.dmp	upx
behavioral2/memory/3116-114-0x00007FF7F3DD0000-0x00007FF7F41C2000-memory.dmp	upx
behavioral2/memory/2388-112-0x00007FF6815E0000-0x00007FF6819D2000-memory.dmp	upx
behavioral2/memory/4524-111-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp	upx
behavioral2/files/0x0007000000023484-105.dat	upx
behavioral2/memory/3644-103-0x00007FF7148B0000-0x00007FF714CA2000-memory.dmp	upx
behavioral2/memory/3384-80-0x00007FF6EB910000-0x00007FF6EBD02000-memory.dmp	upx
behavioral2/files/0x0007000000023481-78.dat	upx
behavioral2/files/0x0007000000023482-75.dat	upx
behavioral2/memory/2864-74-0x00007FF722450000-0x00007FF722842000-memory.dmp	upx
behavioral2/files/0x000700000002347f-66.dat	upx
behavioral2/files/0x000700000002347e-58.dat	upx
behavioral2/memory/1232-50-0x00007FF69E3D0000-0x00007FF69E7C2000-memory.dmp	upx
behavioral2/memory/3964-41-0x00007FF63D330000-0x00007FF63D722000-memory.dmp	upx
behavioral2/files/0x000700000002347d-37.dat	upx
behavioral2/memory/2756-35-0x00007FF637CE0000-0x00007FF6380D2000-memory.dmp	upx
behavioral2/files/0x000700000002347b-28.dat	upx
behavioral2/memory/3964-325-0x00007FF63D330000-0x00007FF63D722000-memory.dmp	upx
behavioral2/files/0x00070000000234c9-358.dat	upx
behavioral2/files/0x00070000000234cb-374.dat	upx
behavioral2/files/0x00070000000234d4-395.dat	upx
behavioral2/files/0x00070000000234db-412.dat	upx
behavioral2/files/0x00070000000234dd-419.dat	upx
behavioral2/files/0x00070000000234d9-417.dat	upx
behavioral2/files/0x00070000000234d7-410.dat	upx
behavioral2/files/0x00070000000234d1-398.dat	upx
behavioral2/files/0x00070000000234cc-387.dat	upx
behavioral2/files/0x00070000000234ca-386.dat	upx
behavioral2/memory/2776-384-0x00007FF740180000-0x00007FF740572000-memory.dmp	upx
behavioral2/memory/3044-381-0x00007FF7111A0000-0x00007FF711592000-memory.dmp	upx
behavioral2/memory/3636-368-0x00007FF6F4A80000-0x00007FF6F4E72000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-367.dat	upx
behavioral2/files/0x00070000000234c5-362.dat	upx
behavioral2/memory/2088-356-0x00007FF687FD0000-0x00007FF6883C2000-memory.dmp	upx
behavioral2/memory/2780-347-0x00007FF7427C0000-0x00007FF742BB2000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-339.dat	upx
behavioral2/memory/1232-323-0x00007FF69E3D0000-0x00007FF69E7C2000-memory.dmp	upx
behavioral2/memory/464-320-0x00007FF7D6240000-0x00007FF7D6632000-memory.dmp	upx
behavioral2/memory/3012-318-0x00007FF748BE0000-0x00007FF748FD2000-memory.dmp	upx
behavioral2/memory/4864-321-0x00007FF7041D0000-0x00007FF7045C2000-memory.dmp	upx
behavioral2/files/0x000700000002348b-312.dat	upx
behavioral2/memory/3012-2187-0x00007FF748BE0000-0x00007FF748FD2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tDsqksJ.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\bNnGvvQ.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\NJJzMnB.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\wAwiJPz.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\NyYmMXa.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\alGHDVK.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\oNNPJxY.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\yCoxZsY.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\OjsaYNh.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\DlYeQXO.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\wxPdBnr.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\uEFlRRU.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\HnAjVWB.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\igPUolO.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\UojaryO.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\ZUNDmhf.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\VrIAhVR.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\ZYWjYgT.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\XkkMwBl.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\djRMOiU.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\KqxewpF.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\RBDDESq.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\KahMqDD.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\UcbtdBW.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\jjAOMmK.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\TuqTXdg.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\prWsfEC.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\uFaODkJ.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\SBdneFq.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\HwMcWJU.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\kJapbBn.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\daFIoUF.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\hZYlYPH.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\fJPcumX.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\ECNJMQN.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\pRZQvxJ.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\yFRVqka.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\nSblayo.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\kOEibWf.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\BmcHgWJ.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\KtLuxet.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\ByTHFvx.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\fimuQdH.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\uCeHLdx.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\BUlbAhe.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\vywkUnW.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\HAEWDui.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\jMhstqm.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\btkvNYx.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\mENlRUb.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\pPvlaTS.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\LlJHsUn.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\mtIIOAw.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\lGPQWAr.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\xWUtUFN.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\RjPaVIf.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\xPsmJYP.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\TJFgrjI.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\neZOmxw.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\AJgYzNV.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\zWuMAEw.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\WPlMNts.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\VdfZlXd.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\rDdbUyu.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
400	powershell.exe
400	powershell.exe
400	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	powershell.exe
Token: SeLockMemoryPrivilege	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 400	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	84
PID 3012 wrote to memory of 400	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	84
PID 3012 wrote to memory of 464	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	85
PID 3012 wrote to memory of 464	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	85
PID 3012 wrote to memory of 4864	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	86
PID 3012 wrote to memory of 4864	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	86
PID 3012 wrote to memory of 2756	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	87
PID 3012 wrote to memory of 2756	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	87
PID 3012 wrote to memory of 1232	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	88
PID 3012 wrote to memory of 1232	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	88
PID 3012 wrote to memory of 4888	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	89
PID 3012 wrote to memory of 4888	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	89
PID 3012 wrote to memory of 3964	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	90
PID 3012 wrote to memory of 3964	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	90
PID 3012 wrote to memory of 2864	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	91
PID 3012 wrote to memory of 2864	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	91
PID 3012 wrote to memory of 3384	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	92
PID 3012 wrote to memory of 3384	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	92
PID 3012 wrote to memory of 4916	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	93
PID 3012 wrote to memory of 4916	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	93
PID 3012 wrote to memory of 1460	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	94
PID 3012 wrote to memory of 1460	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	94
PID 3012 wrote to memory of 3644	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	95
PID 3012 wrote to memory of 3644	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	95
PID 3012 wrote to memory of 4524	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	96
PID 3012 wrote to memory of 4524	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	96
PID 3012 wrote to memory of 2752	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	97
PID 3012 wrote to memory of 2752	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	97
PID 3012 wrote to memory of 2908	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	98
PID 3012 wrote to memory of 2908	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	98
PID 3012 wrote to memory of 888	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	99
PID 3012 wrote to memory of 888	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	99
PID 3012 wrote to memory of 2388	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	100
PID 3012 wrote to memory of 2388	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	100
PID 3012 wrote to memory of 2792	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	101
PID 3012 wrote to memory of 2792	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	101
PID 3012 wrote to memory of 3116	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	102
PID 3012 wrote to memory of 3116	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	102
PID 3012 wrote to memory of 4244	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	103
PID 3012 wrote to memory of 4244	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	103
PID 3012 wrote to memory of 2780	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	104
PID 3012 wrote to memory of 2780	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	104
PID 3012 wrote to memory of 2088	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	105
PID 3012 wrote to memory of 2088	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	105
PID 3012 wrote to memory of 3044	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	106
PID 3012 wrote to memory of 3044	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	106
PID 3012 wrote to memory of 2776	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	107
PID 3012 wrote to memory of 2776	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	107
PID 3012 wrote to memory of 960	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	108
PID 3012 wrote to memory of 960	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	108
PID 3012 wrote to memory of 3636	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	109
PID 3012 wrote to memory of 3636	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	109
PID 3012 wrote to memory of 4372	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	110
PID 3012 wrote to memory of 4372	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	110
PID 3012 wrote to memory of 1560	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	111
PID 3012 wrote to memory of 1560	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	111
PID 3012 wrote to memory of 1260	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	112
PID 3012 wrote to memory of 1260	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	112
PID 3012 wrote to memory of 3504	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	113
PID 3012 wrote to memory of 3504	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	113
PID 3012 wrote to memory of 3732	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	114
PID 3012 wrote to memory of 3732	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	114
PID 3012 wrote to memory of 3740	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	115
PID 3012 wrote to memory of 3740	3012	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\System\MQTguNt.exe
  C:\Windows\System\MQTguNt.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\khYiwfH.exe
  C:\Windows\System\khYiwfH.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\pLPNgwi.exe
  C:\Windows\System\pLPNgwi.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\rWaKXaR.exe
  C:\Windows\System\rWaKXaR.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\Mcjhjql.exe
  C:\Windows\System\Mcjhjql.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\FxoIUwn.exe
  C:\Windows\System\FxoIUwn.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\xQZuCIV.exe
  C:\Windows\System\xQZuCIV.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\CCVslqt.exe
  C:\Windows\System\CCVslqt.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\RbkxTzr.exe
  C:\Windows\System\RbkxTzr.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\FecuraY.exe
  C:\Windows\System\FecuraY.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\wNLoGJU.exe
  C:\Windows\System\wNLoGJU.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\UZEvQrv.exe
  C:\Windows\System\UZEvQrv.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\fwnRSlL.exe
  C:\Windows\System\fwnRSlL.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\GsMxtDZ.exe
  C:\Windows\System\GsMxtDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\YwwYMtB.exe
  C:\Windows\System\YwwYMtB.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\rXrTKlP.exe
  C:\Windows\System\rXrTKlP.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\lmvUzpE.exe
  C:\Windows\System\lmvUzpE.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\aXiHvDC.exe
  C:\Windows\System\aXiHvDC.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\TpBWNpk.exe
  C:\Windows\System\TpBWNpk.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\MGBtzGd.exe
  C:\Windows\System\MGBtzGd.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\HSMfxnW.exe
  C:\Windows\System\HSMfxnW.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\DiPejju.exe
  C:\Windows\System\DiPejju.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\eQMHPbB.exe
  C:\Windows\System\eQMHPbB.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\sWpKISf.exe
  C:\Windows\System\sWpKISf.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\nKeHbBr.exe
  C:\Windows\System\nKeHbBr.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\DGeBqsh.exe
  C:\Windows\System\DGeBqsh.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\YmtGvJQ.exe
  C:\Windows\System\YmtGvJQ.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\dZaWBav.exe
  C:\Windows\System\dZaWBav.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\xKfQSYw.exe
  C:\Windows\System\xKfQSYw.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\SNusQjb.exe
  C:\Windows\System\SNusQjb.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\IDxkufC.exe
  C:\Windows\System\IDxkufC.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\DynSduz.exe
  C:\Windows\System\DynSduz.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\godwhwU.exe
  C:\Windows\System\godwhwU.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\SANhOhV.exe
  C:\Windows\System\SANhOhV.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\WAKqVkI.exe
  C:\Windows\System\WAKqVkI.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\CglQszt.exe
  C:\Windows\System\CglQszt.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\smuPwRW.exe
  C:\Windows\System\smuPwRW.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\kKZkroR.exe
  C:\Windows\System\kKZkroR.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\rQrwydJ.exe
  C:\Windows\System\rQrwydJ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\MBSGhiN.exe
  C:\Windows\System\MBSGhiN.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\piJuviZ.exe
  C:\Windows\System\piJuviZ.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\UsDEimt.exe
  C:\Windows\System\UsDEimt.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\gpkRVHQ.exe
  C:\Windows\System\gpkRVHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\tcCSrqJ.exe
  C:\Windows\System\tcCSrqJ.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\DDIVmLp.exe
  C:\Windows\System\DDIVmLp.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\cEGSXOW.exe
  C:\Windows\System\cEGSXOW.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\cJVgLzd.exe
  C:\Windows\System\cJVgLzd.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\piiyyeS.exe
  C:\Windows\System\piiyyeS.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\QtlmvWk.exe
  C:\Windows\System\QtlmvWk.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\uzcjKHy.exe
  C:\Windows\System\uzcjKHy.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\nUCVccc.exe
  C:\Windows\System\nUCVccc.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\EUJaTJn.exe
  C:\Windows\System\EUJaTJn.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\yxiagIJ.exe
  C:\Windows\System\yxiagIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\TQgcEUJ.exe
  C:\Windows\System\TQgcEUJ.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\iceffdp.exe
  C:\Windows\System\iceffdp.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\NSXmBMd.exe
  C:\Windows\System\NSXmBMd.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\TfoBFXq.exe
  C:\Windows\System\TfoBFXq.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\VjDGeBD.exe
  C:\Windows\System\VjDGeBD.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\jJjSvXC.exe
  C:\Windows\System\jJjSvXC.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\baxNEQO.exe
  C:\Windows\System\baxNEQO.exe
  2⤵
  - Executes dropped EXE
  PID:5248
- C:\Windows\System\ftFxzVQ.exe
  C:\Windows\System\ftFxzVQ.exe
  2⤵
  - Executes dropped EXE
  PID:5276
- C:\Windows\System\mJreDPr.exe
  C:\Windows\System\mJreDPr.exe
  2⤵
  - Executes dropped EXE
  PID:5300
- C:\Windows\System\QgqWbKj.exe
  C:\Windows\System\QgqWbKj.exe
  2⤵
  - Executes dropped EXE
  PID:5328
- C:\Windows\System\VZcpTRp.exe
  C:\Windows\System\VZcpTRp.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\IwIZVmD.exe
  C:\Windows\System\IwIZVmD.exe
  2⤵
  PID:5388
- C:\Windows\System\xpJrOhf.exe
  C:\Windows\System\xpJrOhf.exe
  2⤵
  PID:5416
- C:\Windows\System\xpEvEeh.exe
  C:\Windows\System\xpEvEeh.exe
  2⤵
  PID:5444
- C:\Windows\System\CaReyrI.exe
  C:\Windows\System\CaReyrI.exe
  2⤵
  PID:5476
- C:\Windows\System\NKIvyJY.exe
  C:\Windows\System\NKIvyJY.exe
  2⤵
  PID:5508
- C:\Windows\System\JokdHvR.exe
  C:\Windows\System\JokdHvR.exe
  2⤵
  PID:5556
- C:\Windows\System\QocdmsL.exe
  C:\Windows\System\QocdmsL.exe
  2⤵
  PID:5576
- C:\Windows\System\myDyqBC.exe
  C:\Windows\System\myDyqBC.exe
  2⤵
  PID:5608
- C:\Windows\System\DudNZkm.exe
  C:\Windows\System\DudNZkm.exe
  2⤵
  PID:5624
- C:\Windows\System\SSpJclW.exe
  C:\Windows\System\SSpJclW.exe
  2⤵
  PID:5652
- C:\Windows\System\daesqUS.exe
  C:\Windows\System\daesqUS.exe
  2⤵
  PID:5684
- C:\Windows\System\qDtNQvA.exe
  C:\Windows\System\qDtNQvA.exe
  2⤵
  PID:5716
- C:\Windows\System\colwUHX.exe
  C:\Windows\System\colwUHX.exe
  2⤵
  PID:5740
- C:\Windows\System\fdjAPwj.exe
  C:\Windows\System\fdjAPwj.exe
  2⤵
  PID:5784
- C:\Windows\System\PFiMayy.exe
  C:\Windows\System\PFiMayy.exe
  2⤵
  PID:5804
- C:\Windows\System\eddNmyp.exe
  C:\Windows\System\eddNmyp.exe
  2⤵
  PID:5832
- C:\Windows\System\nQELoHK.exe
  C:\Windows\System\nQELoHK.exe
  2⤵
  PID:5860
- C:\Windows\System\SYTREHD.exe
  C:\Windows\System\SYTREHD.exe
  2⤵
  PID:5892
- C:\Windows\System\bxsmDsm.exe
  C:\Windows\System\bxsmDsm.exe
  2⤵
  PID:5920
- C:\Windows\System\LllJWtS.exe
  C:\Windows\System\LllJWtS.exe
  2⤵
  PID:5952
- C:\Windows\System\lPQNKnw.exe
  C:\Windows\System\lPQNKnw.exe
  2⤵
  PID:5980
- C:\Windows\System\mfqpViY.exe
  C:\Windows\System\mfqpViY.exe
  2⤵
  PID:6008
- C:\Windows\System\AibBvIF.exe
  C:\Windows\System\AibBvIF.exe
  2⤵
  PID:6040
- C:\Windows\System\LqvtMzF.exe
  C:\Windows\System\LqvtMzF.exe
  2⤵
  PID:6072
- C:\Windows\System\EkAWpbn.exe
  C:\Windows\System\EkAWpbn.exe
  2⤵
  PID:6100
- C:\Windows\System\vLpKWOH.exe
  C:\Windows\System\vLpKWOH.exe
  2⤵
  PID:6132
- C:\Windows\System\dUxeXzv.exe
  C:\Windows\System\dUxeXzv.exe
  2⤵
  PID:5344
- C:\Windows\System\mRTuJXZ.exe
  C:\Windows\System\mRTuJXZ.exe
  2⤵
  PID:5284
- C:\Windows\System\RKkjfRd.exe
  C:\Windows\System\RKkjfRd.exe
  2⤵
  PID:5196
- C:\Windows\System\qNNJSdG.exe
  C:\Windows\System\qNNJSdG.exe
  2⤵
  PID:5136
- C:\Windows\System\VRembtz.exe
  C:\Windows\System\VRembtz.exe
  2⤵
  PID:688
- C:\Windows\System\kyTXWNx.exe
  C:\Windows\System\kyTXWNx.exe
  2⤵
  PID:3996
- C:\Windows\System\GJSzCIU.exe
  C:\Windows\System\GJSzCIU.exe
  2⤵
  PID:4924
- C:\Windows\System\DesZMmM.exe
  C:\Windows\System\DesZMmM.exe
  2⤵
  PID:4552
- C:\Windows\System\JEJPWdO.exe
  C:\Windows\System\JEJPWdO.exe
  2⤵
  PID:1572
- C:\Windows\System\XdsRpiC.exe
  C:\Windows\System\XdsRpiC.exe
  2⤵
  PID:1528
- C:\Windows\System\DsbCGtx.exe
  C:\Windows\System\DsbCGtx.exe
  2⤵
  PID:2152
- C:\Windows\System\ajpCZgt.exe
  C:\Windows\System\ajpCZgt.exe
  2⤵
  PID:4248
- C:\Windows\System\qTVnDto.exe
  C:\Windows\System\qTVnDto.exe
  2⤵
  PID:2360
- C:\Windows\System\HbZgbnZ.exe
  C:\Windows\System\HbZgbnZ.exe
  2⤵
  PID:1712
- C:\Windows\System\LQZJmPk.exe
  C:\Windows\System\LQZJmPk.exe
  2⤵
  PID:4992
- C:\Windows\System\PxsbsyT.exe
  C:\Windows\System\PxsbsyT.exe
  2⤵
  PID:4008
- C:\Windows\System\LGTdkaT.exe
  C:\Windows\System\LGTdkaT.exe
  2⤵
  PID:2904
- C:\Windows\System\ftxYZme.exe
  C:\Windows\System\ftxYZme.exe
  2⤵
  PID:4124
- C:\Windows\System\LNgCYUc.exe
  C:\Windows\System\LNgCYUc.exe
  2⤵
  PID:1132
- C:\Windows\System\RzjQWbU.exe
  C:\Windows\System\RzjQWbU.exe
  2⤵
  PID:5428
- C:\Windows\System\lvPCBTA.exe
  C:\Windows\System\lvPCBTA.exe
  2⤵
  PID:5504
- C:\Windows\System\yPbJAUo.exe
  C:\Windows\System\yPbJAUo.exe
  2⤵
  PID:5596
- C:\Windows\System\lZrTUJQ.exe
  C:\Windows\System\lZrTUJQ.exe
  2⤵
  PID:5680
- C:\Windows\System\xxPPHzS.exe
  C:\Windows\System\xxPPHzS.exe
  2⤵
  PID:5800
- C:\Windows\System\zyKMuOl.exe
  C:\Windows\System\zyKMuOl.exe
  2⤵
  PID:5852
- C:\Windows\System\BRKfhmS.exe
  C:\Windows\System\BRKfhmS.exe
  2⤵
  PID:3392
- C:\Windows\System\eeNgolQ.exe
  C:\Windows\System\eeNgolQ.exe
  2⤵
  PID:5968
- C:\Windows\System\jtoQRpo.exe
  C:\Windows\System\jtoQRpo.exe
  2⤵
  PID:6000
- C:\Windows\System\lBEJIWE.exe
  C:\Windows\System\lBEJIWE.exe
  2⤵
  PID:6056
- C:\Windows\System\iUifuAd.exe
  C:\Windows\System\iUifuAd.exe
  2⤵
  PID:6124
- C:\Windows\System\okpHxRG.exe
  C:\Windows\System\okpHxRG.exe
  2⤵
  PID:5296
- C:\Windows\System\zEtbEMO.exe
  C:\Windows\System\zEtbEMO.exe
  2⤵
  PID:5224
- C:\Windows\System\dbvzGiC.exe
  C:\Windows\System\dbvzGiC.exe
  2⤵
  PID:4592
- C:\Windows\System\kJhthVA.exe
  C:\Windows\System\kJhthVA.exe
  2⤵
  PID:2484
- C:\Windows\System\jIpLMYD.exe
  C:\Windows\System\jIpLMYD.exe
  2⤵
  PID:1576
- C:\Windows\System\DMlnCBa.exe
  C:\Windows\System\DMlnCBa.exe
  2⤵
  PID:1112
- C:\Windows\System\DbAikyu.exe
  C:\Windows\System\DbAikyu.exe
  2⤵
  PID:1828
- C:\Windows\System\rVpjbBL.exe
  C:\Windows\System\rVpjbBL.exe
  2⤵
  PID:596
- C:\Windows\System\lHHGykl.exe
  C:\Windows\System\lHHGykl.exe
  2⤵
  PID:2968
- C:\Windows\System\FSCqEBB.exe
  C:\Windows\System\FSCqEBB.exe
  2⤵
  PID:1988
- C:\Windows\System\fnleqqC.exe
  C:\Windows\System\fnleqqC.exe
  2⤵
  PID:4540
- C:\Windows\System\tctRuAH.exe
  C:\Windows\System\tctRuAH.exe
  2⤵
  PID:812
- C:\Windows\System\hQEfiJd.exe
  C:\Windows\System\hQEfiJd.exe
  2⤵
  PID:2592
- C:\Windows\System\xCJhNJD.exe
  C:\Windows\System\xCJhNJD.exe
  2⤵
  PID:2236
- C:\Windows\System\QicQtdm.exe
  C:\Windows\System\QicQtdm.exe
  2⤵
  PID:5492
- C:\Windows\System\guoCweZ.exe
  C:\Windows\System\guoCweZ.exe
  2⤵
  PID:3596
- C:\Windows\System\FcVYmet.exe
  C:\Windows\System\FcVYmet.exe
  2⤵
  PID:5084
- C:\Windows\System\yviSoeA.exe
  C:\Windows\System\yviSoeA.exe
  2⤵
  PID:5640
- C:\Windows\System\ZMNwvdW.exe
  C:\Windows\System\ZMNwvdW.exe
  2⤵
  PID:2340
- C:\Windows\System\cCHKOTy.exe
  C:\Windows\System\cCHKOTy.exe
  2⤵
  PID:5796
- C:\Windows\System\wleofTp.exe
  C:\Windows\System\wleofTp.exe
  2⤵
  PID:5940
- C:\Windows\System\xgjhMqF.exe
  C:\Windows\System\xgjhMqF.exe
  2⤵
  PID:5376
- C:\Windows\System\OfZbLgT.exe
  C:\Windows\System\OfZbLgT.exe
  2⤵
  PID:5232
- C:\Windows\System\MyiguVN.exe
  C:\Windows\System\MyiguVN.exe
  2⤵
  PID:4832
- C:\Windows\System\mwyZfgw.exe
  C:\Windows\System\mwyZfgw.exe
  2⤵
  PID:2304
- C:\Windows\System\AwvniGd.exe
  C:\Windows\System\AwvniGd.exe
  2⤵
  PID:3356
- C:\Windows\System\CdmjeRF.exe
  C:\Windows\System\CdmjeRF.exe
  2⤵
  PID:1780
- C:\Windows\System\GOPrroz.exe
  C:\Windows\System\GOPrroz.exe
  2⤵
  PID:748
- C:\Windows\System\ukDURhg.exe
  C:\Windows\System\ukDURhg.exe
  2⤵
  PID:2384
- C:\Windows\System\kqmupQy.exe
  C:\Windows\System\kqmupQy.exe
  2⤵
  PID:5588
- C:\Windows\System\LyZahdI.exe
  C:\Windows\System\LyZahdI.exe
  2⤵
  PID:4076
- C:\Windows\System\cmohCmN.exe
  C:\Windows\System\cmohCmN.exe
  2⤵
  PID:1468
- C:\Windows\System\dQLoOxj.exe
  C:\Windows\System\dQLoOxj.exe
  2⤵
  PID:3520
- C:\Windows\System\jEvPXnc.exe
  C:\Windows\System\jEvPXnc.exe
  2⤵
  PID:4596
- C:\Windows\System\UysstQM.exe
  C:\Windows\System\UysstQM.exe
  2⤵
  PID:920
- C:\Windows\System\ovOOTAj.exe
  C:\Windows\System\ovOOTAj.exe
  2⤵
  PID:4828
- C:\Windows\System\suuclfT.exe
  C:\Windows\System\suuclfT.exe
  2⤵
  PID:3616
- C:\Windows\System\PqOlCbM.exe
  C:\Windows\System\PqOlCbM.exe
  2⤵
  PID:6160
- C:\Windows\System\OJdvSrU.exe
  C:\Windows\System\OJdvSrU.exe
  2⤵
  PID:6196
- C:\Windows\System\AnoqMmk.exe
  C:\Windows\System\AnoqMmk.exe
  2⤵
  PID:6212
- C:\Windows\System\NpmVnLo.exe
  C:\Windows\System\NpmVnLo.exe
  2⤵
  PID:6240
- C:\Windows\System\WtOirpd.exe
  C:\Windows\System\WtOirpd.exe
  2⤵
  PID:6260
- C:\Windows\System\uEPggFG.exe
  C:\Windows\System\uEPggFG.exe
  2⤵
  PID:6284
- C:\Windows\System\FgZqFxH.exe
  C:\Windows\System\FgZqFxH.exe
  2⤵
  PID:6300
- C:\Windows\System\bCbCcab.exe
  C:\Windows\System\bCbCcab.exe
  2⤵
  PID:6320
- C:\Windows\System\JZHQKtN.exe
  C:\Windows\System\JZHQKtN.exe
  2⤵
  PID:6396
- C:\Windows\System\SIpdEei.exe
  C:\Windows\System\SIpdEei.exe
  2⤵
  PID:6428
- C:\Windows\System\xFcKmXT.exe
  C:\Windows\System\xFcKmXT.exe
  2⤵
  PID:6500
- C:\Windows\System\OsrMlsO.exe
  C:\Windows\System\OsrMlsO.exe
  2⤵
  PID:6528
- C:\Windows\System\gJFAUsG.exe
  C:\Windows\System\gJFAUsG.exe
  2⤵
  PID:6548
- C:\Windows\System\MLpKIhb.exe
  C:\Windows\System\MLpKIhb.exe
  2⤵
  PID:6580
- C:\Windows\System\asWAIWn.exe
  C:\Windows\System\asWAIWn.exe
  2⤵
  PID:6616
- C:\Windows\System\ffAdoYV.exe
  C:\Windows\System\ffAdoYV.exe
  2⤵
  PID:6632
- C:\Windows\System\DxbJYoh.exe
  C:\Windows\System\DxbJYoh.exe
  2⤵
  PID:6664
- C:\Windows\System\PafPVvr.exe
  C:\Windows\System\PafPVvr.exe
  2⤵
  PID:6692
- C:\Windows\System\pRZQvxJ.exe
  C:\Windows\System\pRZQvxJ.exe
  2⤵
  PID:6716
- C:\Windows\System\GOdjfpU.exe
  C:\Windows\System\GOdjfpU.exe
  2⤵
  PID:6736
- C:\Windows\System\bohNJwH.exe
  C:\Windows\System\bohNJwH.exe
  2⤵
  PID:6756
- C:\Windows\System\VEHktvT.exe
  C:\Windows\System\VEHktvT.exe
  2⤵
  PID:6792
- C:\Windows\System\SXgjquB.exe
  C:\Windows\System\SXgjquB.exe
  2⤵
  PID:6812
- C:\Windows\System\RXhwgUB.exe
  C:\Windows\System\RXhwgUB.exe
  2⤵
  PID:6856
- C:\Windows\System\ZRBzURs.exe
  C:\Windows\System\ZRBzURs.exe
  2⤵
  PID:6876
- C:\Windows\System\olgecMH.exe
  C:\Windows\System\olgecMH.exe
  2⤵
  PID:6896
- C:\Windows\System\bGtaEiI.exe
  C:\Windows\System\bGtaEiI.exe
  2⤵
  PID:6948
- C:\Windows\System\yzXVHPZ.exe
  C:\Windows\System\yzXVHPZ.exe
  2⤵
  PID:6968
- C:\Windows\System\DqTpMaP.exe
  C:\Windows\System\DqTpMaP.exe
  2⤵
  PID:6984
- C:\Windows\System\uyydykH.exe
  C:\Windows\System\uyydykH.exe
  2⤵
  PID:7016
- C:\Windows\System\CXCpYmC.exe
  C:\Windows\System\CXCpYmC.exe
  2⤵
  PID:7048
- C:\Windows\System\NqUKmeM.exe
  C:\Windows\System\NqUKmeM.exe
  2⤵
  PID:7072
- C:\Windows\System\owBfPfg.exe
  C:\Windows\System\owBfPfg.exe
  2⤵
  PID:7104
- C:\Windows\System\jEfMGWg.exe
  C:\Windows\System\jEfMGWg.exe
  2⤵
  PID:7124
- C:\Windows\System\IKJGPPP.exe
  C:\Windows\System\IKJGPPP.exe
  2⤵
  PID:7144
- C:\Windows\System\OXnKhuC.exe
  C:\Windows\System\OXnKhuC.exe
  2⤵
  PID:7164
- C:\Windows\System\QSuRrHB.exe
  C:\Windows\System\QSuRrHB.exe
  2⤵
  PID:6156
- C:\Windows\System\QpxiYxt.exe
  C:\Windows\System\QpxiYxt.exe
  2⤵
  PID:6232
- C:\Windows\System\ZYjnmdC.exe
  C:\Windows\System\ZYjnmdC.exe
  2⤵
  PID:6296
- C:\Windows\System\HqIPXsP.exe
  C:\Windows\System\HqIPXsP.exe
  2⤵
  PID:6372
- C:\Windows\System\LNoQpAJ.exe
  C:\Windows\System\LNoQpAJ.exe
  2⤵
  PID:6480
- C:\Windows\System\giryDxs.exe
  C:\Windows\System\giryDxs.exe
  2⤵
  PID:6572
- C:\Windows\System\pyNLnIi.exe
  C:\Windows\System\pyNLnIi.exe
  2⤵
  PID:6688
- C:\Windows\System\NrdqOzf.exe
  C:\Windows\System\NrdqOzf.exe
  2⤵
  PID:6732
- C:\Windows\System\QnPLmtp.exe
  C:\Windows\System\QnPLmtp.exe
  2⤵
  PID:6848
- C:\Windows\System\zBrmhYj.exe
  C:\Windows\System\zBrmhYj.exe
  2⤵
  PID:6836
- C:\Windows\System\HYLaffX.exe
  C:\Windows\System\HYLaffX.exe
  2⤵
  PID:6964
- C:\Windows\System\fxoBOtV.exe
  C:\Windows\System\fxoBOtV.exe
  2⤵
  PID:7004
- C:\Windows\System\jtemjbS.exe
  C:\Windows\System\jtemjbS.exe
  2⤵
  PID:7060
- C:\Windows\System\WgGRCSY.exe
  C:\Windows\System\WgGRCSY.exe
  2⤵
  PID:7120
- C:\Windows\System\JXjtKHG.exe
  C:\Windows\System\JXjtKHG.exe
  2⤵
  PID:7136
- C:\Windows\System\heCLeuF.exe
  C:\Windows\System\heCLeuF.exe
  2⤵
  PID:6292
- C:\Windows\System\VRvfEqB.exe
  C:\Windows\System\VRvfEqB.exe
  2⤵
  PID:6360
- C:\Windows\System\QJIedEC.exe
  C:\Windows\System\QJIedEC.exe
  2⤵
  PID:6524
- C:\Windows\System\SGehgGM.exe
  C:\Windows\System\SGehgGM.exe
  2⤵
  PID:6708
- C:\Windows\System\WVWcLte.exe
  C:\Windows\System\WVWcLte.exe
  2⤵
  PID:6868
- C:\Windows\System\szsnMLT.exe
  C:\Windows\System\szsnMLT.exe
  2⤵
  PID:6908
- C:\Windows\System\uJfzqmK.exe
  C:\Windows\System\uJfzqmK.exe
  2⤵
  PID:7012
- C:\Windows\System\DyNqwoa.exe
  C:\Windows\System\DyNqwoa.exe
  2⤵
  PID:7088
- C:\Windows\System\PNUNZwm.exe
  C:\Windows\System\PNUNZwm.exe
  2⤵
  PID:6724
- C:\Windows\System\lZIqVxW.exe
  C:\Windows\System\lZIqVxW.exe
  2⤵
  PID:6992
- C:\Windows\System\OJEnPij.exe
  C:\Windows\System\OJEnPij.exe
  2⤵
  PID:7188
- C:\Windows\System\uEGtkhh.exe
  C:\Windows\System\uEGtkhh.exe
  2⤵
  PID:7220
- C:\Windows\System\BjHRMMT.exe
  C:\Windows\System\BjHRMMT.exe
  2⤵
  PID:7240
- C:\Windows\System\kKZlZmG.exe
  C:\Windows\System\kKZlZmG.exe
  2⤵
  PID:7268
- C:\Windows\System\InhPstM.exe
  C:\Windows\System\InhPstM.exe
  2⤵
  PID:7312
- C:\Windows\System\azcVrlB.exe
  C:\Windows\System\azcVrlB.exe
  2⤵
  PID:7332
- C:\Windows\System\BbHjCTL.exe
  C:\Windows\System\BbHjCTL.exe
  2⤵
  PID:7360
- C:\Windows\System\jPskSCT.exe
  C:\Windows\System\jPskSCT.exe
  2⤵
  PID:7376
- C:\Windows\System\vopXSXn.exe
  C:\Windows\System\vopXSXn.exe
  2⤵
  PID:7400
- C:\Windows\System\jFkRIsk.exe
  C:\Windows\System\jFkRIsk.exe
  2⤵
  PID:7436
- C:\Windows\System\fArTDWe.exe
  C:\Windows\System\fArTDWe.exe
  2⤵
  PID:7456
- C:\Windows\System\tezhuak.exe
  C:\Windows\System\tezhuak.exe
  2⤵
  PID:7504
- C:\Windows\System\eHWSGKr.exe
  C:\Windows\System\eHWSGKr.exe
  2⤵
  PID:7548
- C:\Windows\System\xwDNNRf.exe
  C:\Windows\System\xwDNNRf.exe
  2⤵
  PID:7572
- C:\Windows\System\pHbGOOg.exe
  C:\Windows\System\pHbGOOg.exe
  2⤵
  PID:7612
- C:\Windows\System\EpBunUQ.exe
  C:\Windows\System\EpBunUQ.exe
  2⤵
  PID:7632
- C:\Windows\System\IdIYElt.exe
  C:\Windows\System\IdIYElt.exe
  2⤵
  PID:7652
- C:\Windows\System\RFdwvaw.exe
  C:\Windows\System\RFdwvaw.exe
  2⤵
  PID:7668
- C:\Windows\System\huOQfxI.exe
  C:\Windows\System\huOQfxI.exe
  2⤵
  PID:7712
- C:\Windows\System\dmYVVWm.exe
  C:\Windows\System\dmYVVWm.exe
  2⤵
  PID:7736
- C:\Windows\System\ZspecnB.exe
  C:\Windows\System\ZspecnB.exe
  2⤵
  PID:7756
- C:\Windows\System\DeydqPP.exe
  C:\Windows\System\DeydqPP.exe
  2⤵
  PID:7784
- C:\Windows\System\bpiOAYb.exe
  C:\Windows\System\bpiOAYb.exe
  2⤵
  PID:7804
- C:\Windows\System\nGSXEAh.exe
  C:\Windows\System\nGSXEAh.exe
  2⤵
  PID:7840
- C:\Windows\System\SjmtMxP.exe
  C:\Windows\System\SjmtMxP.exe
  2⤵
  PID:7868
- C:\Windows\System\xPsmJYP.exe
  C:\Windows\System\xPsmJYP.exe
  2⤵
  PID:7892
- C:\Windows\System\iIDUBhj.exe
  C:\Windows\System\iIDUBhj.exe
  2⤵
  PID:7908
- C:\Windows\System\GwwyzKL.exe
  C:\Windows\System\GwwyzKL.exe
  2⤵
  PID:7936
- C:\Windows\System\rzeSXZu.exe
  C:\Windows\System\rzeSXZu.exe
  2⤵
  PID:7956
- C:\Windows\System\itTyqHA.exe
  C:\Windows\System\itTyqHA.exe
  2⤵
  PID:7980
- C:\Windows\System\FsrVkCo.exe
  C:\Windows\System\FsrVkCo.exe
  2⤵
  PID:8020
- C:\Windows\System\vXAYAte.exe
  C:\Windows\System\vXAYAte.exe
  2⤵
  PID:8048
- C:\Windows\System\ZoNZifb.exe
  C:\Windows\System\ZoNZifb.exe
  2⤵
  PID:8064
- C:\Windows\System\RGRHOIE.exe
  C:\Windows\System\RGRHOIE.exe
  2⤵
  PID:8096
- C:\Windows\System\JNDlten.exe
  C:\Windows\System\JNDlten.exe
  2⤵
  PID:8120
- C:\Windows\System\NbHywma.exe
  C:\Windows\System\NbHywma.exe
  2⤵
  PID:8140
- C:\Windows\System\nXgagWD.exe
  C:\Windows\System\nXgagWD.exe
  2⤵
  PID:8160
- C:\Windows\System\oetutTx.exe
  C:\Windows\System\oetutTx.exe
  2⤵
  PID:6872
- C:\Windows\System\kqZMsPT.exe
  C:\Windows\System\kqZMsPT.exe
  2⤵
  PID:7184
- C:\Windows\System\kbJWbTG.exe
  C:\Windows\System\kbJWbTG.exe
  2⤵
  PID:7292
- C:\Windows\System\HnZDOyt.exe
  C:\Windows\System\HnZDOyt.exe
  2⤵
  PID:7408
- C:\Windows\System\eyLcoWQ.exe
  C:\Windows\System\eyLcoWQ.exe
  2⤵
  PID:7420
- C:\Windows\System\HIUJotn.exe
  C:\Windows\System\HIUJotn.exe
  2⤵
  PID:7604
- C:\Windows\System\hLsGYfC.exe
  C:\Windows\System\hLsGYfC.exe
  2⤵
  PID:7624
- C:\Windows\System\RYCazFh.exe
  C:\Windows\System\RYCazFh.exe
  2⤵
  PID:7688
- C:\Windows\System\BSuFriJ.exe
  C:\Windows\System\BSuFriJ.exe
  2⤵
  PID:7704
- C:\Windows\System\sEIksFJ.exe
  C:\Windows\System\sEIksFJ.exe
  2⤵
  PID:7776
- C:\Windows\System\xXfBsaT.exe
  C:\Windows\System\xXfBsaT.exe
  2⤵
  PID:7880
- C:\Windows\System\kaBAEeZ.exe
  C:\Windows\System\kaBAEeZ.exe
  2⤵
  PID:7876
- C:\Windows\System\HwEyPwb.exe
  C:\Windows\System\HwEyPwb.exe
  2⤵
  PID:8008
- C:\Windows\System\gqEHOWe.exe
  C:\Windows\System\gqEHOWe.exe
  2⤵
  PID:8072
- C:\Windows\System\ysumdJn.exe
  C:\Windows\System\ysumdJn.exe
  2⤵
  PID:8088
- C:\Windows\System\jScPZwM.exe
  C:\Windows\System\jScPZwM.exe
  2⤵
  PID:8188
- C:\Windows\System\choWoSt.exe
  C:\Windows\System\choWoSt.exe
  2⤵
  PID:448
- C:\Windows\System\xLjfKgW.exe
  C:\Windows\System\xLjfKgW.exe
  2⤵
  PID:7392
- C:\Windows\System\hVnAPFf.exe
  C:\Windows\System\hVnAPFf.exe
  2⤵
  PID:7524
- C:\Windows\System\UNidgpd.exe
  C:\Windows\System\UNidgpd.exe
  2⤵
  PID:7860
- C:\Windows\System\XzjaGKc.exe
  C:\Windows\System\XzjaGKc.exe
  2⤵
  PID:7748
- C:\Windows\System\gzgRboB.exe
  C:\Windows\System\gzgRboB.exe
  2⤵
  PID:7948
- C:\Windows\System\USgHBiU.exe
  C:\Windows\System\USgHBiU.exe
  2⤵
  PID:8056
- C:\Windows\System\iGYGCEN.exe
  C:\Windows\System\iGYGCEN.exe
  2⤵
  PID:8184
- C:\Windows\System\OGhZbfp.exe
  C:\Windows\System\OGhZbfp.exe
  2⤵
  PID:7444
- C:\Windows\System\SlTJfGI.exe
  C:\Windows\System\SlTJfGI.exe
  2⤵
  PID:7724
- C:\Windows\System\qjexTCt.exe
  C:\Windows\System\qjexTCt.exe
  2⤵
  PID:8204
- C:\Windows\System\vfKjdvT.exe
  C:\Windows\System\vfKjdvT.exe
  2⤵
  PID:8252
- C:\Windows\System\NykHbKv.exe
  C:\Windows\System\NykHbKv.exe
  2⤵
  PID:8268
- C:\Windows\System\xforTrl.exe
  C:\Windows\System\xforTrl.exe
  2⤵
  PID:8320
- C:\Windows\System\KMFPHsQ.exe
  C:\Windows\System\KMFPHsQ.exe
  2⤵
  PID:8364
- C:\Windows\System\vvmeFXs.exe
  C:\Windows\System\vvmeFXs.exe
  2⤵
  PID:8384
- C:\Windows\System\zMnSjKH.exe
  C:\Windows\System\zMnSjKH.exe
  2⤵
  PID:8400
- C:\Windows\System\xiObbvG.exe
  C:\Windows\System\xiObbvG.exe
  2⤵
  PID:8424
- C:\Windows\System\vqhLyZf.exe
  C:\Windows\System\vqhLyZf.exe
  2⤵
  PID:8444
- C:\Windows\System\hdjzdKq.exe
  C:\Windows\System\hdjzdKq.exe
  2⤵
  PID:8472
- C:\Windows\System\iEwAiXw.exe
  C:\Windows\System\iEwAiXw.exe
  2⤵
  PID:8496
- C:\Windows\System\ReiaKsL.exe
  C:\Windows\System\ReiaKsL.exe
  2⤵
  PID:8512
- C:\Windows\System\hdogsLX.exe
  C:\Windows\System\hdogsLX.exe
  2⤵
  PID:8560
- C:\Windows\System\vZAHYKh.exe
  C:\Windows\System\vZAHYKh.exe
  2⤵
  PID:8576
- C:\Windows\System\MGtGBBs.exe
  C:\Windows\System\MGtGBBs.exe
  2⤵
  PID:8600
- C:\Windows\System\FDwDJTi.exe
  C:\Windows\System\FDwDJTi.exe
  2⤵
  PID:8624
- C:\Windows\System\uqNFEuj.exe
  C:\Windows\System\uqNFEuj.exe
  2⤵
  PID:8656
- C:\Windows\System\WKhHYvc.exe
  C:\Windows\System\WKhHYvc.exe
  2⤵
  PID:8680
- C:\Windows\System\tchrUzQ.exe
  C:\Windows\System\tchrUzQ.exe
  2⤵
  PID:8700
- C:\Windows\System\BsBZccY.exe
  C:\Windows\System\BsBZccY.exe
  2⤵
  PID:8752
- C:\Windows\System\gITJMbv.exe
  C:\Windows\System\gITJMbv.exe
  2⤵
  PID:8776
- C:\Windows\System\wAwiJPz.exe
  C:\Windows\System\wAwiJPz.exe
  2⤵
  PID:8804
- C:\Windows\System\woSbNkn.exe
  C:\Windows\System\woSbNkn.exe
  2⤵
  PID:8824
- C:\Windows\System\eLIYEEm.exe
  C:\Windows\System\eLIYEEm.exe
  2⤵
  PID:8880
- C:\Windows\System\aBYSXRG.exe
  C:\Windows\System\aBYSXRG.exe
  2⤵
  PID:8908
- C:\Windows\System\NNmbglA.exe
  C:\Windows\System\NNmbglA.exe
  2⤵
  PID:8956
- C:\Windows\System\QaiRjNF.exe
  C:\Windows\System\QaiRjNF.exe
  2⤵
  PID:8980
- C:\Windows\System\VJlyDRk.exe
  C:\Windows\System\VJlyDRk.exe
  2⤵
  PID:9004
- C:\Windows\System\FUtLQne.exe
  C:\Windows\System\FUtLQne.exe
  2⤵
  PID:9028
- C:\Windows\System\QuRJsOU.exe
  C:\Windows\System\QuRJsOU.exe
  2⤵
  PID:9064
- C:\Windows\System\ILifdBG.exe
  C:\Windows\System\ILifdBG.exe
  2⤵
  PID:9104
- C:\Windows\System\oCdhvxv.exe
  C:\Windows\System\oCdhvxv.exe
  2⤵
  PID:9120
- C:\Windows\System\NshFsvq.exe
  C:\Windows\System\NshFsvq.exe
  2⤵
  PID:9148
- C:\Windows\System\TfwpzJv.exe
  C:\Windows\System\TfwpzJv.exe
  2⤵
  PID:9168
- C:\Windows\System\YYWFfVR.exe
  C:\Windows\System\YYWFfVR.exe
  2⤵
  PID:7916
- C:\Windows\System\ZTVqVsY.exe
  C:\Windows\System\ZTVqVsY.exe
  2⤵
  PID:7368
- C:\Windows\System\AMWAHpg.exe
  C:\Windows\System\AMWAHpg.exe
  2⤵
  PID:8264
- C:\Windows\System\IAnbkSJ.exe
  C:\Windows\System\IAnbkSJ.exe
  2⤵
  PID:8300
- C:\Windows\System\yDkUuFk.exe
  C:\Windows\System\yDkUuFk.exe
  2⤵
  PID:8360
- C:\Windows\System\Hfdacdc.exe
  C:\Windows\System\Hfdacdc.exe
  2⤵
  PID:8376
- C:\Windows\System\IQozQlp.exe
  C:\Windows\System\IQozQlp.exe
  2⤵
  PID:8416
- C:\Windows\System\RVoOBxn.exe
  C:\Windows\System\RVoOBxn.exe
  2⤵
  PID:8488
- C:\Windows\System\fqgcxbi.exe
  C:\Windows\System\fqgcxbi.exe
  2⤵
  PID:8468
- C:\Windows\System\LrLUGEt.exe
  C:\Windows\System\LrLUGEt.exe
  2⤵
  PID:8616
- C:\Windows\System\zDqvlFe.exe
  C:\Windows\System\zDqvlFe.exe
  2⤵
  PID:8816
- C:\Windows\System\GdEeNSu.exe
  C:\Windows\System\GdEeNSu.exe
  2⤵
  PID:8760
- C:\Windows\System\PvGcDlF.exe
  C:\Windows\System\PvGcDlF.exe
  2⤵
  PID:8872
- C:\Windows\System\ZkgAFWu.exe
  C:\Windows\System\ZkgAFWu.exe
  2⤵
  PID:9016
- C:\Windows\System\xIPVXJr.exe
  C:\Windows\System\xIPVXJr.exe
  2⤵
  PID:9044
- C:\Windows\System\owPMHVa.exe
  C:\Windows\System\owPMHVa.exe
  2⤵
  PID:9060
- C:\Windows\System\sHrAZUj.exe
  C:\Windows\System\sHrAZUj.exe
  2⤵
  PID:9164
- C:\Windows\System\YSlqzYh.exe
  C:\Windows\System\YSlqzYh.exe
  2⤵
  PID:9136
- C:\Windows\System\tJfVuaf.exe
  C:\Windows\System\tJfVuaf.exe
  2⤵
  PID:8280
- C:\Windows\System\knQPdbE.exe
  C:\Windows\System\knQPdbE.exe
  2⤵
  PID:8408
- C:\Windows\System\aPwdusl.exe
  C:\Windows\System\aPwdusl.exe
  2⤵
  PID:8536
- C:\Windows\System\ORiDSGL.exe
  C:\Windows\System\ORiDSGL.exe
  2⤵
  PID:8988
- C:\Windows\System\feemnde.exe
  C:\Windows\System\feemnde.exe
  2⤵
  PID:9096
- C:\Windows\System\iOLWdFl.exe
  C:\Windows\System\iOLWdFl.exe
  2⤵
  PID:9144
- C:\Windows\System\cvCucFQ.exe
  C:\Windows\System\cvCucFQ.exe
  2⤵
  PID:9220
- C:\Windows\System\toLzLQq.exe
  C:\Windows\System\toLzLQq.exe
  2⤵
  PID:9252
- C:\Windows\System\tUaylNd.exe
  C:\Windows\System\tUaylNd.exe
  2⤵
  PID:9272
- C:\Windows\System\DpNFQRH.exe
  C:\Windows\System\DpNFQRH.exe
  2⤵
  PID:9292
- C:\Windows\System\zbdgyxK.exe
  C:\Windows\System\zbdgyxK.exe
  2⤵
  PID:9308
- C:\Windows\System\WPcJTlv.exe
  C:\Windows\System\WPcJTlv.exe
  2⤵
  PID:9492
- C:\Windows\System\lYLqmxC.exe
  C:\Windows\System\lYLqmxC.exe
  2⤵
  PID:9508
- C:\Windows\System\OmFMsSs.exe
  C:\Windows\System\OmFMsSs.exe
  2⤵
  PID:9532
- C:\Windows\System\tPzwBkM.exe
  C:\Windows\System\tPzwBkM.exe
  2⤵
  PID:9552
- C:\Windows\System\wwMnfcY.exe
  C:\Windows\System\wwMnfcY.exe
  2⤵
  PID:9568
- C:\Windows\System\Vfjhvrt.exe
  C:\Windows\System\Vfjhvrt.exe
  2⤵
  PID:9588
- C:\Windows\System\fmagxtM.exe
  C:\Windows\System\fmagxtM.exe
  2⤵
  PID:9640
- C:\Windows\System\eRjgDNn.exe
  C:\Windows\System\eRjgDNn.exe
  2⤵
  PID:9656
- C:\Windows\System\itSyzDx.exe
  C:\Windows\System\itSyzDx.exe
  2⤵
  PID:9680
- C:\Windows\System\upiDjrN.exe
  C:\Windows\System\upiDjrN.exe
  2⤵
  PID:9700
- C:\Windows\System\zFIYYQD.exe
  C:\Windows\System\zFIYYQD.exe
  2⤵
  PID:9720
- C:\Windows\System\ZlmOeeH.exe
  C:\Windows\System\ZlmOeeH.exe
  2⤵
  PID:9764
- C:\Windows\System\xttJegx.exe
  C:\Windows\System\xttJegx.exe
  2⤵
  PID:9788
- C:\Windows\System\iWHbBDV.exe
  C:\Windows\System\iWHbBDV.exe
  2⤵
  PID:9808
- C:\Windows\System\hcVqovW.exe
  C:\Windows\System\hcVqovW.exe
  2⤵
  PID:9860
- C:\Windows\System\eVHIRQn.exe
  C:\Windows\System\eVHIRQn.exe
  2⤵
  PID:9880
- C:\Windows\System\GCPrcZT.exe
  C:\Windows\System\GCPrcZT.exe
  2⤵
  PID:9896
- C:\Windows\System\PaBxVzL.exe
  C:\Windows\System\PaBxVzL.exe
  2⤵
  PID:9932
- C:\Windows\System\DczMKsR.exe
  C:\Windows\System\DczMKsR.exe
  2⤵
  PID:9976
- C:\Windows\System\iRjBTPo.exe
  C:\Windows\System\iRjBTPo.exe
  2⤵
  PID:9996
- C:\Windows\System\tHjHZSu.exe
  C:\Windows\System\tHjHZSu.exe
  2⤵
  PID:10036
- C:\Windows\System\YEDjSVL.exe
  C:\Windows\System\YEDjSVL.exe
  2⤵
  PID:10052
- C:\Windows\System\TVggBfF.exe
  C:\Windows\System\TVggBfF.exe
  2⤵
  PID:10080
- C:\Windows\System\vWmCZuw.exe
  C:\Windows\System\vWmCZuw.exe
  2⤵
  PID:10128
- C:\Windows\System\ReAtDcc.exe
  C:\Windows\System\ReAtDcc.exe
  2⤵
  PID:10152
- C:\Windows\System\owdznlc.exe
  C:\Windows\System\owdznlc.exe
  2⤵
  PID:10172
- C:\Windows\System\zLBCZsr.exe
  C:\Windows\System\zLBCZsr.exe
  2⤵
  PID:10192
- C:\Windows\System\vzJGUmv.exe
  C:\Windows\System\vzJGUmv.exe
  2⤵
  PID:10208
- C:\Windows\System\krbZhmB.exe
  C:\Windows\System\krbZhmB.exe
  2⤵
  PID:8432
- C:\Windows\System\gSLgnwQ.exe
  C:\Windows\System\gSLgnwQ.exe
  2⤵
  PID:7924
- C:\Windows\System\sgGbHEO.exe
  C:\Windows\System\sgGbHEO.exe
  2⤵
  PID:8504
- C:\Windows\System\YiXpBqx.exe
  C:\Windows\System\YiXpBqx.exe
  2⤵
  PID:8744
- C:\Windows\System\osYkdbR.exe
  C:\Windows\System\osYkdbR.exe
  2⤵
  PID:9000
- C:\Windows\System\lueOhHo.exe
  C:\Windows\System\lueOhHo.exe
  2⤵
  PID:9232
- C:\Windows\System\EJSztxe.exe
  C:\Windows\System\EJSztxe.exe
  2⤵
  PID:9340
- C:\Windows\System\AAUZWje.exe
  C:\Windows\System\AAUZWje.exe
  2⤵
  PID:9268
- C:\Windows\System\nWLJhwK.exe
  C:\Windows\System\nWLJhwK.exe
  2⤵
  PID:9408
- C:\Windows\System\SDGKcbp.exe
  C:\Windows\System\SDGKcbp.exe
  2⤵
  PID:9480
- C:\Windows\System\ucbLzHq.exe
  C:\Windows\System\ucbLzHq.exe
  2⤵
  PID:9540
- C:\Windows\System\fUPutlU.exe
  C:\Windows\System\fUPutlU.exe
  2⤵
  PID:9608
- C:\Windows\System\CGKbYLE.exe
  C:\Windows\System\CGKbYLE.exe
  2⤵
  PID:9712
- C:\Windows\System\iJrGJCF.exe
  C:\Windows\System\iJrGJCF.exe
  2⤵
  PID:9756
- C:\Windows\System\ycTxxqO.exe
  C:\Windows\System\ycTxxqO.exe
  2⤵
  PID:9772
- C:\Windows\System\gUWAQYQ.exe
  C:\Windows\System\gUWAQYQ.exe
  2⤵
  PID:9852
- C:\Windows\System\hNewcdQ.exe
  C:\Windows\System\hNewcdQ.exe
  2⤵
  PID:9904
- C:\Windows\System\iRKkFFD.exe
  C:\Windows\System\iRKkFFD.exe
  2⤵
  PID:9948
- C:\Windows\System\gDvxPab.exe
  C:\Windows\System\gDvxPab.exe
  2⤵
  PID:9992
- C:\Windows\System\AfxQYeH.exe
  C:\Windows\System\AfxQYeH.exe
  2⤵
  PID:10124
- C:\Windows\System\yZRkdkf.exe
  C:\Windows\System\yZRkdkf.exe
  2⤵
  PID:10228
- C:\Windows\System\rIPSKvo.exe
  C:\Windows\System\rIPSKvo.exe
  2⤵
  PID:9228
- C:\Windows\System\SiQNeLo.exe
  C:\Windows\System\SiQNeLo.exe
  2⤵
  PID:8832
- C:\Windows\System\lboNGJL.exe
  C:\Windows\System\lboNGJL.exe
  2⤵
  PID:9384
- C:\Windows\System\rfxbsZq.exe
  C:\Windows\System\rfxbsZq.exe
  2⤵
  PID:9472
- C:\Windows\System\NtOjNcD.exe
  C:\Windows\System\NtOjNcD.exe
  2⤵
  PID:9560
- C:\Windows\System\yqFfZpL.exe
  C:\Windows\System\yqFfZpL.exe
  2⤵
  PID:9736
- C:\Windows\System\rtwMEkv.exe
  C:\Windows\System\rtwMEkv.exe
  2⤵
  PID:9876
- C:\Windows\System\zmWyIov.exe
  C:\Windows\System\zmWyIov.exe
  2⤵
  PID:10096
- C:\Windows\System\MThlnsr.exe
  C:\Windows\System\MThlnsr.exe
  2⤵
  PID:10204
- C:\Windows\System\EOMoieL.exe
  C:\Windows\System\EOMoieL.exe
  2⤵
  PID:8868
- C:\Windows\System\yZalIof.exe
  C:\Windows\System\yZalIof.exe
  2⤵
  PID:9364
- C:\Windows\System\FKIirTF.exe
  C:\Windows\System\FKIirTF.exe
  2⤵
  PID:9600
- C:\Windows\System\KLZZQUV.exe
  C:\Windows\System\KLZZQUV.exe
  2⤵
  PID:10032
- C:\Windows\System\MiFLxTV.exe
  C:\Windows\System\MiFLxTV.exe
  2⤵
  PID:9240
- C:\Windows\System\WnNAqBM.exe
  C:\Windows\System\WnNAqBM.exe
  2⤵
  PID:10272
- C:\Windows\System\qHKjXMx.exe
  C:\Windows\System\qHKjXMx.exe
  2⤵
  PID:10292
- C:\Windows\System\DuvsOet.exe
  C:\Windows\System\DuvsOet.exe
  2⤵
  PID:10316
- C:\Windows\System\gxTesns.exe
  C:\Windows\System\gxTesns.exe
  2⤵
  PID:10332
- C:\Windows\System\RCMMKZw.exe
  C:\Windows\System\RCMMKZw.exe
  2⤵
  PID:10380
- C:\Windows\System\ZdEAvrN.exe
  C:\Windows\System\ZdEAvrN.exe
  2⤵
  PID:10400
- C:\Windows\System\Adziayu.exe
  C:\Windows\System\Adziayu.exe
  2⤵
  PID:10420
- C:\Windows\System\vqTCXLv.exe
  C:\Windows\System\vqTCXLv.exe
  2⤵
  PID:10448
- C:\Windows\System\thxHkWs.exe
  C:\Windows\System\thxHkWs.exe
  2⤵
  PID:10464
- C:\Windows\System\vNIZqjb.exe
  C:\Windows\System\vNIZqjb.exe
  2⤵
  PID:10488
- C:\Windows\System\UwzgQio.exe
  C:\Windows\System\UwzgQio.exe
  2⤵
  PID:10508
- C:\Windows\System\vOpKkJp.exe
  C:\Windows\System\vOpKkJp.exe
  2⤵
  PID:10524
- C:\Windows\System\NEZnMBD.exe
  C:\Windows\System\NEZnMBD.exe
  2⤵
  PID:10572
- C:\Windows\System\ZTYejGR.exe
  C:\Windows\System\ZTYejGR.exe
  2⤵
  PID:10596
- C:\Windows\System\sNENMVj.exe
  C:\Windows\System\sNENMVj.exe
  2⤵
  PID:10660
- C:\Windows\System\jGHZObK.exe
  C:\Windows\System\jGHZObK.exe
  2⤵
  PID:10684
- C:\Windows\System\yfhKSgg.exe
  C:\Windows\System\yfhKSgg.exe
  2⤵
  PID:10708
- C:\Windows\System\vqDKlXQ.exe
  C:\Windows\System\vqDKlXQ.exe
  2⤵
  PID:10744
- C:\Windows\System\aTRGrBd.exe
  C:\Windows\System\aTRGrBd.exe
  2⤵
  PID:10788
- C:\Windows\System\SyUNwqE.exe
  C:\Windows\System\SyUNwqE.exe
  2⤵
  PID:10808
- C:\Windows\System\LUuGaAI.exe
  C:\Windows\System\LUuGaAI.exe
  2⤵
  PID:10824
- C:\Windows\System\uuBGWCl.exe
  C:\Windows\System\uuBGWCl.exe
  2⤵
  PID:10864
- C:\Windows\System\szxBvfv.exe
  C:\Windows\System\szxBvfv.exe
  2⤵
  PID:10892
- C:\Windows\System\IxTxsku.exe
  C:\Windows\System\IxTxsku.exe
  2⤵
  PID:10932
- C:\Windows\System\hgOWqjb.exe
  C:\Windows\System\hgOWqjb.exe
  2⤵
  PID:10952
- C:\Windows\System\AElRJle.exe
  C:\Windows\System\AElRJle.exe
  2⤵
  PID:10984
- C:\Windows\System\EnRVHLj.exe
  C:\Windows\System\EnRVHLj.exe
  2⤵
  PID:11004
- C:\Windows\System\cCIzGMA.exe
  C:\Windows\System\cCIzGMA.exe
  2⤵
  PID:11024
- C:\Windows\System\MSyjjXE.exe
  C:\Windows\System\MSyjjXE.exe
  2⤵
  PID:11040
- C:\Windows\System\FlVUgmJ.exe
  C:\Windows\System\FlVUgmJ.exe
  2⤵
  PID:11064
- C:\Windows\System\rDLoxtq.exe
  C:\Windows\System\rDLoxtq.exe
  2⤵
  PID:11080
- C:\Windows\System\OkIsSeH.exe
  C:\Windows\System\OkIsSeH.exe
  2⤵
  PID:11100
- C:\Windows\System\nQBkNxG.exe
  C:\Windows\System\nQBkNxG.exe
  2⤵
  PID:11120
- C:\Windows\System\QbhulmD.exe
  C:\Windows\System\QbhulmD.exe
  2⤵
  PID:11204
- C:\Windows\System\xcKtTBk.exe
  C:\Windows\System\xcKtTBk.exe
  2⤵
  PID:11224
- C:\Windows\System\XEkmDnW.exe
  C:\Windows\System\XEkmDnW.exe
  2⤵
  PID:11248
- C:\Windows\System\ZaERMUa.exe
  C:\Windows\System\ZaERMUa.exe
  2⤵
  PID:9848
- C:\Windows\System\fJBYGuy.exe
  C:\Windows\System\fJBYGuy.exe
  2⤵
  PID:10264
- C:\Windows\System\KkJWUiC.exe
  C:\Windows\System\KkJWUiC.exe
  2⤵
  PID:10312
- C:\Windows\System\QJZOUfj.exe
  C:\Windows\System\QJZOUfj.exe
  2⤵
  PID:10416
- C:\Windows\System\DdexUgL.exe
  C:\Windows\System\DdexUgL.exe
  2⤵
  PID:10500
- C:\Windows\System\ZgdTatY.exe
  C:\Windows\System\ZgdTatY.exe
  2⤵
  PID:10556
- C:\Windows\System\fuuqiUb.exe
  C:\Windows\System\fuuqiUb.exe
  2⤵
  PID:10632
- C:\Windows\System\FLeCiNk.exe
  C:\Windows\System\FLeCiNk.exe
  2⤵
  PID:10656
- C:\Windows\System\nBfmmat.exe
  C:\Windows\System\nBfmmat.exe
  2⤵
  PID:10756
- C:\Windows\System\VochPsw.exe
  C:\Windows\System\VochPsw.exe
  2⤵
  PID:10820
- C:\Windows\System\GFvLooL.exe
  C:\Windows\System\GFvLooL.exe
  2⤵
  PID:10880
- C:\Windows\System\TcosTbz.exe
  C:\Windows\System\TcosTbz.exe
  2⤵
  PID:10924
- C:\Windows\System\oAhidxy.exe
  C:\Windows\System\oAhidxy.exe
  2⤵
  PID:10992
- C:\Windows\System\nldTvGk.exe
  C:\Windows\System\nldTvGk.exe
  2⤵
  PID:11056
- C:\Windows\System\UdqUGqP.exe
  C:\Windows\System\UdqUGqP.exe
  2⤵
  PID:11088
- C:\Windows\System\fsFHLyn.exe
  C:\Windows\System\fsFHLyn.exe
  2⤵
  PID:11196
- C:\Windows\System\ihuuyBC.exe
  C:\Windows\System\ihuuyBC.exe
  2⤵
  PID:11256
- C:\Windows\System\EQsomQI.exe
  C:\Windows\System\EQsomQI.exe
  2⤵
  PID:10288
- C:\Windows\System\CmXMDar.exe
  C:\Windows\System\CmXMDar.exe
  2⤵
  PID:10440
- C:\Windows\System\QLZuXTu.exe
  C:\Windows\System\QLZuXTu.exe
  2⤵
  PID:10548
- C:\Windows\System\WbkdgRX.exe
  C:\Windows\System\WbkdgRX.exe
  2⤵
  PID:10816
- C:\Windows\System\RoNcVmn.exe
  C:\Windows\System\RoNcVmn.exe
  2⤵
  PID:10912
- C:\Windows\System\AgvhYZR.exe
  C:\Windows\System\AgvhYZR.exe
  2⤵
  PID:11032
- C:\Windows\System\cTknLSq.exe
  C:\Windows\System\cTknLSq.exe
  2⤵
  PID:11212
- C:\Windows\System\gdHIfMu.exe
  C:\Windows\System\gdHIfMu.exe
  2⤵
  PID:11260
- C:\Windows\System\ffiXtoZ.exe
  C:\Windows\System\ffiXtoZ.exe
  2⤵
  PID:10520
- C:\Windows\System\oxuKCjJ.exe
  C:\Windows\System\oxuKCjJ.exe
  2⤵
  PID:10860
- C:\Windows\System\eZKMhtu.exe
  C:\Windows\System\eZKMhtu.exe
  2⤵
  PID:10356
- C:\Windows\System\FkwaGbL.exe
  C:\Windows\System\FkwaGbL.exe
  2⤵
  PID:11292
- C:\Windows\System\rmJlQjq.exe
  C:\Windows\System\rmJlQjq.exe
  2⤵
  PID:11316
- C:\Windows\System\fMfnuJJ.exe
  C:\Windows\System\fMfnuJJ.exe
  2⤵
  PID:11348
- C:\Windows\System\ogdOFuV.exe
  C:\Windows\System\ogdOFuV.exe
  2⤵
  PID:11388
- C:\Windows\System\mPTohnd.exe
  C:\Windows\System\mPTohnd.exe
  2⤵
  PID:11416
- C:\Windows\System\tWbFctw.exe
  C:\Windows\System\tWbFctw.exe
  2⤵
  PID:11432
- C:\Windows\System\gFEGzxX.exe
  C:\Windows\System\gFEGzxX.exe
  2⤵
  PID:11452
- C:\Windows\System\ntxePOm.exe
  C:\Windows\System\ntxePOm.exe
  2⤵
  PID:11472
- C:\Windows\System\lOoXRyw.exe
  C:\Windows\System\lOoXRyw.exe
  2⤵
  PID:11496
- C:\Windows\System\hPcLszV.exe
  C:\Windows\System\hPcLszV.exe
  2⤵
  PID:11516
- C:\Windows\System\ILIrewt.exe
  C:\Windows\System\ILIrewt.exe
  2⤵
  PID:11560
- C:\Windows\System\diZBRPp.exe
  C:\Windows\System\diZBRPp.exe
  2⤵
  PID:11632
- C:\Windows\System\SmqveJK.exe
  C:\Windows\System\SmqveJK.exe
  2⤵
  PID:11652
- C:\Windows\System\fKeXBXi.exe
  C:\Windows\System\fKeXBXi.exe
  2⤵
  PID:11676
- C:\Windows\System\uieyWuB.exe
  C:\Windows\System\uieyWuB.exe
  2⤵
  PID:11692
- C:\Windows\System\CZuKUsS.exe
  C:\Windows\System\CZuKUsS.exe
  2⤵
  PID:11720
- C:\Windows\System\FWWKQyq.exe
  C:\Windows\System\FWWKQyq.exe
  2⤵
  PID:11736
- C:\Windows\System\JhpNsdM.exe
  C:\Windows\System\JhpNsdM.exe
  2⤵
  PID:11776
- C:\Windows\System\ZgElFOV.exe
  C:\Windows\System\ZgElFOV.exe
  2⤵
  PID:11816
- C:\Windows\System\IEMkSTU.exe
  C:\Windows\System\IEMkSTU.exe
  2⤵
  PID:11844
- C:\Windows\System\degGHNT.exe
  C:\Windows\System\degGHNT.exe
  2⤵
  PID:11864
- C:\Windows\System\rtzKEbW.exe
  C:\Windows\System\rtzKEbW.exe
  2⤵
  PID:11880
- C:\Windows\System\tHUCqJm.exe
  C:\Windows\System\tHUCqJm.exe
  2⤵
  PID:11908
- C:\Windows\System\QkPdlMH.exe
  C:\Windows\System\QkPdlMH.exe
  2⤵
  PID:11928
- C:\Windows\System\lCxMEqM.exe
  C:\Windows\System\lCxMEqM.exe
  2⤵
  PID:11948
- C:\Windows\System\RYsJVBI.exe
  C:\Windows\System\RYsJVBI.exe
  2⤵
  PID:11972
- C:\Windows\System\HeGLEDl.exe
  C:\Windows\System\HeGLEDl.exe
  2⤵
  PID:12004
- C:\Windows\System\nJewszi.exe
  C:\Windows\System\nJewszi.exe
  2⤵
  PID:12040
- C:\Windows\System\QTpTllt.exe
  C:\Windows\System\QTpTllt.exe
  2⤵
  PID:12084
- C:\Windows\System\oqCVcsm.exe
  C:\Windows\System\oqCVcsm.exe
  2⤵
  PID:12108
- C:\Windows\System\kmgXeyY.exe
  C:\Windows\System\kmgXeyY.exe
  2⤵
  PID:12132
- C:\Windows\System\ULUNaHo.exe
  C:\Windows\System\ULUNaHo.exe
  2⤵
  PID:12156
- C:\Windows\System\MTCcKmA.exe
  C:\Windows\System\MTCcKmA.exe
  2⤵
  PID:12180
- C:\Windows\System\FIjLoxI.exe
  C:\Windows\System\FIjLoxI.exe
  2⤵
  PID:12228
- C:\Windows\System\TWiUCBB.exe
  C:\Windows\System\TWiUCBB.exe
  2⤵
  PID:12256
- C:\Windows\System\drlGKEc.exe
  C:\Windows\System\drlGKEc.exe
  2⤵
  PID:12280
- C:\Windows\System\SStIxGb.exe
  C:\Windows\System\SStIxGb.exe
  2⤵
  PID:10780
- C:\Windows\System\mUTEnrb.exe
  C:\Windows\System\mUTEnrb.exe
  2⤵
  PID:11308
- C:\Windows\System\mTZGzta.exe
  C:\Windows\System\mTZGzta.exe
  2⤵
  PID:10516
- C:\Windows\System\nhAkcQg.exe
  C:\Windows\System\nhAkcQg.exe
  2⤵
  PID:11400
- C:\Windows\System\hKwWzsn.exe
  C:\Windows\System\hKwWzsn.exe
  2⤵
  PID:11448
- C:\Windows\System\mTBHPok.exe
  C:\Windows\System\mTBHPok.exe
  2⤵
  PID:11628
- C:\Windows\System\zjEPhdr.exe
  C:\Windows\System\zjEPhdr.exe
  2⤵
  PID:11672
- C:\Windows\System\TNgADyW.exe
  C:\Windows\System\TNgADyW.exe
  2⤵
  PID:11732
- C:\Windows\System\aLFALXu.exe
  C:\Windows\System\aLFALXu.exe
  2⤵
  PID:11804
- C:\Windows\System\pbqMbSL.exe
  C:\Windows\System\pbqMbSL.exe
  2⤵
  PID:11856
- C:\Windows\System\PbCWGfi.exe
  C:\Windows\System\PbCWGfi.exe
  2⤵
  PID:11964
- C:\Windows\System\qmSpdIv.exe
  C:\Windows\System\qmSpdIv.exe
  2⤵
  PID:11996
- C:\Windows\System\CpMAXvD.exe
  C:\Windows\System\CpMAXvD.exe
  2⤵
  PID:12036
- C:\Windows\System\ZDtwIUQ.exe
  C:\Windows\System\ZDtwIUQ.exe
  2⤵
  PID:12116
- C:\Windows\System\kGZzLkM.exe
  C:\Windows\System\kGZzLkM.exe
  2⤵
  PID:12152
- C:\Windows\System\TaBLfIc.exe
  C:\Windows\System\TaBLfIc.exe
  2⤵
  PID:12248
- C:\Windows\System\xSeKcqx.exe
  C:\Windows\System\xSeKcqx.exe
  2⤵
  PID:10888
- C:\Windows\System\khcftVk.exe
  C:\Windows\System\khcftVk.exe
  2⤵
  PID:11600
- C:\Windows\System\vWZxoAC.exe
  C:\Windows\System\vWZxoAC.exe
  2⤵
  PID:11444
- C:\Windows\System\nmaQPuR.exe
  C:\Windows\System\nmaQPuR.exe
  2⤵
  PID:4228
- C:\Windows\System\AlfLDlR.exe
  C:\Windows\System\AlfLDlR.exe
  2⤵
  PID:1720
- C:\Windows\System\XpYVsFa.exe
  C:\Windows\System\XpYVsFa.exe
  2⤵
  PID:11792
- C:\Windows\System\axRnRkh.exe
  C:\Windows\System\axRnRkh.exe
  2⤵
  PID:11888
- C:\Windows\System\qUcPOoD.exe
  C:\Windows\System\qUcPOoD.exe
  2⤵
  PID:12024
- C:\Windows\System\gPXhwLd.exe
  C:\Windows\System\gPXhwLd.exe
  2⤵
  PID:12128
- C:\Windows\System\wFXYeTf.exe
  C:\Windows\System\wFXYeTf.exe
  2⤵
  PID:12220
- C:\Windows\System\DRcOWnM.exe
  C:\Windows\System\DRcOWnM.exe
  2⤵
  PID:4128
- C:\Windows\System\MiZkrmr.exe
  C:\Windows\System\MiZkrmr.exe
  2⤵
  PID:9916
- C:\Windows\System\GZfVvTB.exe
  C:\Windows\System\GZfVvTB.exe
  2⤵
  PID:11428
- C:\Windows\System\MmLdVOf.exe
  C:\Windows\System\MmLdVOf.exe
  2⤵
  PID:11944
- C:\Windows\System\TOrYben.exe
  C:\Windows\System\TOrYben.exe
  2⤵
  PID:12316
- C:\Windows\System\AfGuWYT.exe
  C:\Windows\System\AfGuWYT.exe
  2⤵
  PID:12336
- C:\Windows\System\YCTKXVY.exe
  C:\Windows\System\YCTKXVY.exe
  2⤵
  PID:12360
- C:\Windows\System\THXcGoA.exe
  C:\Windows\System\THXcGoA.exe
  2⤵
  PID:12380
- C:\Windows\System\gEvtokz.exe
  C:\Windows\System\gEvtokz.exe
  2⤵
  PID:12404
- C:\Windows\System\kOWKHZN.exe
  C:\Windows\System\kOWKHZN.exe
  2⤵
  PID:12432
- C:\Windows\System\RYmAPvU.exe
  C:\Windows\System\RYmAPvU.exe
  2⤵
  PID:12484
- C:\Windows\System\cbtrEUC.exe
  C:\Windows\System\cbtrEUC.exe
  2⤵
  PID:12504
- C:\Windows\System\jGvrBbI.exe
  C:\Windows\System\jGvrBbI.exe
  2⤵
  PID:12524
- C:\Windows\System\SDFtyzv.exe
  C:\Windows\System\SDFtyzv.exe
  2⤵
  PID:12560
- C:\Windows\System\XdNmqps.exe
  C:\Windows\System\XdNmqps.exe
  2⤵
  PID:12584
- C:\Windows\System\DdIaLxG.exe
  C:\Windows\System\DdIaLxG.exe
  2⤵
  PID:12624
- C:\Windows\System\cppjHfC.exe
  C:\Windows\System\cppjHfC.exe
  2⤵
  PID:12648
- C:\Windows\System\avwPzRW.exe
  C:\Windows\System\avwPzRW.exe
  2⤵
  PID:12672
- C:\Windows\System\XVvzazd.exe
  C:\Windows\System\XVvzazd.exe
  2⤵
  PID:12696
- C:\Windows\System\gylGyvY.exe
  C:\Windows\System\gylGyvY.exe
  2⤵
  PID:12732
- C:\Windows\System\GZOIAkD.exe
  C:\Windows\System\GZOIAkD.exe
  2⤵
  PID:12748
- C:\Windows\System\ZuYACeq.exe
  C:\Windows\System\ZuYACeq.exe
  2⤵
  PID:12764
- C:\Windows\System\QhGZqWu.exe
  C:\Windows\System\QhGZqWu.exe
  2⤵
  PID:12780
- C:\Windows\System\uoMLjvx.exe
  C:\Windows\System\uoMLjvx.exe
  2⤵
  PID:12800
- C:\Windows\System\bGydwXa.exe
  C:\Windows\System\bGydwXa.exe
  2⤵
  PID:12852
- C:\Windows\System\kiEvxLt.exe
  C:\Windows\System\kiEvxLt.exe
  2⤵
  PID:12972
- C:\Windows\System\iIvYjDY.exe
  C:\Windows\System\iIvYjDY.exe
  2⤵
  PID:12996
- C:\Windows\System\sDEuATA.exe
  C:\Windows\System\sDEuATA.exe
  2⤵
  PID:13088
- C:\Windows\System\JHuyHdA.exe
  C:\Windows\System\JHuyHdA.exe
  2⤵
  PID:13104
- C:\Windows\System\stjnMcd.exe
  C:\Windows\System\stjnMcd.exe
  2⤵
  PID:13124
- C:\Windows\System\DIQTols.exe
  C:\Windows\System\DIQTols.exe
  2⤵
  PID:12328
- C:\Windows\System\kRgEcLv.exe
  C:\Windows\System\kRgEcLv.exe
  2⤵
  PID:12372
- C:\Windows\System\HpfxAhl.exe
  C:\Windows\System\HpfxAhl.exe
  2⤵
  PID:12400
- C:\Windows\System\ZyMPztL.exe
  C:\Windows\System\ZyMPztL.exe
  2⤵
  PID:12480
- C:\Windows\System\JDkRXzO.exe
  C:\Windows\System\JDkRXzO.exe
  2⤵
  PID:12552
- C:\Windows\System\zybTNJu.exe
  C:\Windows\System\zybTNJu.exe
  2⤵
  PID:12544
- C:\Windows\System\vurCLdq.exe
  C:\Windows\System\vurCLdq.exe
  2⤵
  PID:12448
- C:\Windows\System\XfSIYoi.exe
  C:\Windows\System\XfSIYoi.exe
  2⤵
  PID:1076
- C:\Windows\System\ZPdexxA.exe
  C:\Windows\System\ZPdexxA.exe
  2⤵
  PID:460
- C:\Windows\System\OqrohCQ.exe
  C:\Windows\System\OqrohCQ.exe
  2⤵
  PID:3716
- C:\Windows\System\VixFtCF.exe
  C:\Windows\System\VixFtCF.exe
  2⤵
  PID:12664
- C:\Windows\System\siRlcEI.exe
  C:\Windows\System\siRlcEI.exe
  2⤵
  PID:12688
- C:\Windows\System\cYKsArt.exe
  C:\Windows\System\cYKsArt.exe
  2⤵
  PID:12760
- C:\Windows\System\OamhAfR.exe
  C:\Windows\System\OamhAfR.exe
  2⤵
  PID:4604
- C:\Windows\System\ZHtQAfO.exe
  C:\Windows\System\ZHtQAfO.exe
  2⤵
  PID:12708
- C:\Windows\System\myTjwnd.exe
  C:\Windows\System\myTjwnd.exe
  2⤵
  PID:12728
- C:\Windows\System\cGVLeft.exe
  C:\Windows\System\cGVLeft.exe
  2⤵
  PID:12820
- C:\Windows\System\Xotzhpi.exe
  C:\Windows\System\Xotzhpi.exe
  2⤵
  PID:12744
- C:\Windows\System\FrgXDRp.exe
  C:\Windows\System\FrgXDRp.exe
  2⤵
  PID:12868
- C:\Windows\System\fimuQdH.exe
  C:\Windows\System\fimuQdH.exe
  2⤵
  PID:4468
- C:\Windows\System\DQNQiWA.exe
  C:\Windows\System\DQNQiWA.exe
  2⤵
  PID:12872
- C:\Windows\System\MECSWph.exe
  C:\Windows\System\MECSWph.exe
  2⤵
  PID:972
- C:\Windows\System\cKdBMSK.exe
  C:\Windows\System\cKdBMSK.exe
  2⤵
  PID:13040
- C:\Windows\System\wXcZjXT.exe
  C:\Windows\System\wXcZjXT.exe
  2⤵
  PID:1812
- C:\Windows\System\SfayMBK.exe
  C:\Windows\System\SfayMBK.exe
  2⤵
  PID:12948
- C:\Windows\System\DpPeLHl.exe
  C:\Windows\System\DpPeLHl.exe
  2⤵
  PID:13016
- C:\Windows\System\CyautjQ.exe
  C:\Windows\System\CyautjQ.exe
  2⤵
  PID:13048
- C:\Windows\System\fCPRBXX.exe
  C:\Windows\System\fCPRBXX.exe
  2⤵
  PID:13012
- C:\Windows\System\PzIYncx.exe
  C:\Windows\System\PzIYncx.exe
  2⤵
  PID:4220
- C:\Windows\System\sMUpHbn.exe
  C:\Windows\System\sMUpHbn.exe
  2⤵
  PID:4600
- C:\Windows\System\jAKLBtk.exe
  C:\Windows\System\jAKLBtk.exe
  2⤵
  PID:13200
- C:\Windows\System\aUoLZJp.exe
  C:\Windows\System\aUoLZJp.exe
  2⤵
  PID:3284
- C:\Windows\System\zmYrKGg.exe
  C:\Windows\System\zmYrKGg.exe
  2⤵
  PID:4016
- C:\Windows\System\jQHfiDd.exe
  C:\Windows\System\jQHfiDd.exe
  2⤵
  PID:13188
- C:\Windows\System\CMESRpT.exe
  C:\Windows\System\CMESRpT.exe
  2⤵
  PID:13260
- C:\Windows\System\QGBcgyb.exe
  C:\Windows\System\QGBcgyb.exe
  2⤵
  PID:5500
- C:\Windows\System\TaeaUzg.exe
  C:\Windows\System\TaeaUzg.exe
  2⤵
  PID:5748
- C:\Windows\System\NZoAmdz.exe
  C:\Windows\System\NZoAmdz.exe
  2⤵
  PID:5828
- C:\Windows\System\xHKOZQp.exe
  C:\Windows\System\xHKOZQp.exe
  2⤵
  PID:5928
- C:\Windows\System\TQQbLNv.exe
  C:\Windows\System\TQQbLNv.exe
  2⤵
  PID:4024
- C:\Windows\System\pyBiMYf.exe
  C:\Windows\System\pyBiMYf.exe
  2⤵
  PID:12292
- C:\Windows\System\cOPjYYB.exe
  C:\Windows\System\cOPjYYB.exe
  2⤵
  PID:5240
- C:\Windows\System\qOhPZRj.exe
  C:\Windows\System\qOhPZRj.exe
  2⤵
  PID:12300
- C:\Windows\System\yoczOVz.exe
  C:\Windows\System\yoczOVz.exe
  2⤵
  PID:12516
- C:\Windows\System\nWHEFWI.exe
  C:\Windows\System\nWHEFWI.exe
  2⤵
  PID:12452
- C:\Windows\System\ofFsoho.exe
  C:\Windows\System\ofFsoho.exe
  2⤵
  PID:12720
- C:\Windows\System\ygoEPdE.exe
  C:\Windows\System\ygoEPdE.exe
  2⤵
  PID:540
- C:\Windows\System\ZpJeeKz.exe
  C:\Windows\System\ZpJeeKz.exe
  2⤵
  PID:4920
- C:\Windows\System\jHiAvGL.exe
  C:\Windows\System\jHiAvGL.exe
  2⤵
  PID:3080
- C:\Windows\System\EACylZR.exe
  C:\Windows\System\EACylZR.exe
  2⤵
  PID:212
- C:\Windows\System\RTablmC.exe
  C:\Windows\System\RTablmC.exe
  2⤵
  PID:3832
- C:\Windows\System\dJDnIKh.exe
  C:\Windows\System\dJDnIKh.exe
  2⤵
  PID:3428
- C:\Windows\System\CUIvrmV.exe
  C:\Windows\System\CUIvrmV.exe
  2⤵
  PID:12060
- C:\Windows\System\XRnyMHj.exe
  C:\Windows\System\XRnyMHj.exe
  2⤵
  PID:2576
- C:\Windows\System\RwoxtSH.exe
  C:\Windows\System\RwoxtSH.exe
  2⤵
  PID:1840
- C:\Windows\System\QZRTphq.exe
  C:\Windows\System\QZRTphq.exe
  2⤵
  PID:12900
- C:\Windows\System\auXjgkE.exe
  C:\Windows\System\auXjgkE.exe
  2⤵
  PID:2852
- C:\Windows\System\asoaCqP.exe
  C:\Windows\System\asoaCqP.exe
  2⤵
  PID:12344
- C:\Windows\System\cZePxLs.exe
  C:\Windows\System\cZePxLs.exe
  2⤵
  PID:1736
- C:\Windows\System\iUsucEQ.exe
  C:\Windows\System\iUsucEQ.exe
  2⤵
  PID:1900
- C:\Windows\System\dbQzjbl.exe
  C:\Windows\System\dbQzjbl.exe
  2⤵
  PID:13120
- C:\Windows\System\snCYEsO.exe
  C:\Windows\System\snCYEsO.exe
  2⤵
  PID:5916
- C:\Windows\System\TQLjoDf.exe
  C:\Windows\System\TQLjoDf.exe
  2⤵
  PID:13192
- C:\Windows\System\hDVoMKb.exe
  C:\Windows\System\hDVoMKb.exe
  2⤵
  PID:5792
- C:\Windows\System\fxABVex.exe
  C:\Windows\System\fxABVex.exe
  2⤵
  PID:9048
- C:\Windows\System\KFLEbDt.exe
  C:\Windows\System\KFLEbDt.exe
  2⤵
  PID:5568
- C:\Windows\System\CJwBsZo.exe
  C:\Windows\System\CJwBsZo.exe
  2⤵
  PID:3464
- C:\Windows\System\BUBwDVu.exe
  C:\Windows\System\BUBwDVu.exe
  2⤵
  PID:2276
- C:\Windows\System\gPwIzan.exe
  C:\Windows\System\gPwIzan.exe
  2⤵
  PID:5208
- C:\Windows\System\wiFymhQ.exe
  C:\Windows\System\wiFymhQ.exe
  2⤵
  PID:8248
- C:\Windows\System\IpKadzN.exe
  C:\Windows\System\IpKadzN.exe
  2⤵
  PID:1012
- C:\Windows\System\AHLDING.exe
  C:\Windows\System\AHLDING.exe
  2⤵
  PID:7156
- C:\Windows\System\JNXwxOE.exe
  C:\Windows\System\JNXwxOE.exe
  2⤵
  PID:7720
- C:\Windows\System\hhyYmRj.exe
  C:\Windows\System\hhyYmRj.exe
  2⤵
  PID:3104
- C:\Windows\System\tFhTXwr.exe
  C:\Windows\System\tFhTXwr.exe
  2⤵
  PID:8948
- C:\Windows\System\uvwtmzr.exe
  C:\Windows\System\uvwtmzr.exe
  2⤵
  PID:1440
- C:\Windows\System\ymQwyCc.exe
  C:\Windows\System\ymQwyCc.exe
  2⤵
  PID:6520
- C:\Windows\System\PDkJzrG.exe
  C:\Windows\System\PDkJzrG.exe
  2⤵
  PID:6192
- C:\Windows\System\PrnWCkA.exe
  C:\Windows\System\PrnWCkA.exe
  2⤵
  PID:6576
- C:\Windows\System\FIBVwId.exe
  C:\Windows\System\FIBVwId.exe
  2⤵
  PID:7648
- C:\Windows\System\zMQnxoo.exe
  C:\Windows\System\zMQnxoo.exe
  2⤵
  PID:9516
- C:\Windows\System\JDaBxve.exe
  C:\Windows\System\JDaBxve.exe
  2⤵
  PID:12880
- C:\Windows\System\THLStSJ.exe
  C:\Windows\System\THLStSJ.exe
  2⤵
  PID:8240
- C:\Windows\System\IVVnlYd.exe
  C:\Windows\System\IVVnlYd.exe
  2⤵
  PID:6800
- C:\Windows\System\qSMqyVX.exe
  C:\Windows\System\qSMqyVX.exe
  2⤵
  PID:8296
- C:\Windows\System\XhDgZoV.exe
  C:\Windows\System\XhDgZoV.exe
  2⤵
  PID:9816
- C:\Windows\System\lPnaMZS.exe
  C:\Windows\System\lPnaMZS.exe
  2⤵
  PID:6844
- C:\Windows\System\BryuMSW.exe
  C:\Windows\System\BryuMSW.exe
  2⤵
  PID:3748
- C:\Windows\System\fslzxlm.exe
  C:\Windows\System\fslzxlm.exe
  2⤵
  PID:9940
- C:\Windows\System\HuptxgJ.exe
  C:\Windows\System\HuptxgJ.exe
  2⤵
  PID:9944
- C:\Windows\System\nDySXRF.exe
  C:\Windows\System\nDySXRF.exe
  2⤵
  PID:10020
- C:\Windows\System\TPUDgWK.exe
  C:\Windows\System\TPUDgWK.exe
  2⤵
  PID:2976
- C:\Windows\System\ROQeFbM.exe
  C:\Windows\System\ROQeFbM.exe
  2⤵
  PID:7676
- C:\Windows\System\ZvZhEBE.exe
  C:\Windows\System\ZvZhEBE.exe
  2⤵
  PID:7152
- C:\Windows\System\yMLIEZt.exe
  C:\Windows\System\yMLIEZt.exe
  2⤵
  PID:5584
- C:\Windows\System\uVRPGxX.exe
  C:\Windows\System\uVRPGxX.exe
  2⤵
  PID:3484
- C:\Windows\System\ksaZUnc.exe
  C:\Windows\System\ksaZUnc.exe
  2⤵
  PID:6272
- C:\Windows\System\dTPdksb.exe
  C:\Windows\System\dTPdksb.exe
  2⤵
  PID:2444
- C:\Windows\System\AXBrDeG.exe
  C:\Windows\System\AXBrDeG.exe
  2⤵
  PID:5840
- C:\Windows\System\XMwAbZV.exe
  C:\Windows\System\XMwAbZV.exe
  2⤵
  PID:5056
- C:\Windows\System\EulsiBK.exe
  C:\Windows\System\EulsiBK.exe
  2⤵
  PID:2288
- C:\Windows\System\FBfleTY.exe
  C:\Windows\System\FBfleTY.exe
  2⤵
  PID:8112
- C:\Windows\System\RqBOdZd.exe
  C:\Windows\System\RqBOdZd.exe
  2⤵
  PID:9332
- C:\Windows\System\cFIyKDr.exe
  C:\Windows\System\cFIyKDr.exe
  2⤵
  PID:9544
- C:\Windows\System\dLHTnZl.exe
  C:\Windows\System\dLHTnZl.exe
  2⤵
  PID:8380
- C:\Windows\System\GiMmEvq.exe
  C:\Windows\System\GiMmEvq.exe
  2⤵
  PID:4616
- C:\Windows\System\yCHSznw.exe
  C:\Windows\System\yCHSznw.exe
  2⤵
  PID:4348
- C:\Windows\System\mYcLQyK.exe
  C:\Windows\System\mYcLQyK.exe
  2⤵
  PID:8896
- C:\Windows\System\ZYlYQNG.exe
  C:\Windows\System\ZYlYQNG.exe
  2⤵
  PID:6368
- C:\Windows\System\UoLrlCg.exe
  C:\Windows\System\UoLrlCg.exe
  2⤵
  PID:4576
- C:\Windows\System\CwawvXI.exe
  C:\Windows\System\CwawvXI.exe
  2⤵
  PID:7208
- C:\Windows\System\cwSAJWj.exe
  C:\Windows\System\cwSAJWj.exe
  2⤵
  PID:3168
- C:\Windows\System\YWNnxXR.exe
  C:\Windows\System\YWNnxXR.exe
  2⤵
  PID:5312
- C:\Windows\System\veBxorP.exe
  C:\Windows\System\veBxorP.exe
  2⤵
  PID:12988
- C:\Windows\System\iXMsuKk.exe
  C:\Windows\System\iXMsuKk.exe
  2⤵
  PID:10004
- C:\Windows\System\SMNKYwp.exe
  C:\Windows\System\SMNKYwp.exe
  2⤵
  PID:10068
- C:\Windows\System\ELKTXfJ.exe
  C:\Windows\System\ELKTXfJ.exe
  2⤵
  PID:6936
- C:\Windows\System\stJbhYc.exe
  C:\Windows\System\stJbhYc.exe
  2⤵
  PID:9320
- C:\Windows\System\ckhcsGF.exe
  C:\Windows\System\ckhcsGF.exe
  2⤵
  PID:848
- C:\Windows\System\puxqEHH.exe
  C:\Windows\System\puxqEHH.exe
  2⤵
  PID:13284
- C:\Windows\System\LlBcGYo.exe
  C:\Windows\System\LlBcGYo.exe
  2⤵
  PID:3956
- C:\Windows\System\FdAnNKU.exe
  C:\Windows\System\FdAnNKU.exe
  2⤵
  PID:10160
- C:\Windows\System\nqovbcz.exe
  C:\Windows\System\nqovbcz.exe
  2⤵
  PID:10764
- C:\Windows\System\TGyRUkR.exe
  C:\Windows\System\TGyRUkR.exe
  2⤵
  PID:12424
- C:\Windows\System\ujNFwbN.exe
  C:\Windows\System\ujNFwbN.exe
  2⤵
  PID:4392
- C:\Windows\System\AWfGusG.exe
  C:\Windows\System\AWfGusG.exe
  2⤵
  PID:7664
- C:\Windows\System\gIMmxfy.exe
  C:\Windows\System\gIMmxfy.exe
  2⤵
  PID:10224
- C:\Windows\System\eCYkGWp.exe
  C:\Windows\System\eCYkGWp.exe
  2⤵
  PID:2156
- C:\Windows\System\bExXwVG.exe
  C:\Windows\System\bExXwVG.exe
  2⤵
  PID:6536
- C:\Windows\System\eUDSSOZ.exe
  C:\Windows\System\eUDSSOZ.exe
  2⤵
  PID:6640
- C:\Windows\System\fymtyfY.exe
  C:\Windows\System\fymtyfY.exe
  2⤵
  PID:11892
- C:\Windows\System\NnCEyHx.exe
  C:\Windows\System\NnCEyHx.exe
  2⤵
  PID:5228
- C:\Windows\System\DHIaWfD.exe
  C:\Windows\System\DHIaWfD.exe
  2⤵
  PID:11552
- C:\Windows\System\oWfFjyz.exe
  C:\Windows\System\oWfFjyz.exe
  2⤵
  PID:5660
- C:\Windows\System\nOJpTPF.exe
  C:\Windows\System\nOJpTPF.exe
  2⤵
  PID:12192
- C:\Windows\System\QCzAmBd.exe
  C:\Windows\System\QCzAmBd.exe
  2⤵
  PID:11300
- C:\Windows\System\bIPrCZF.exe
  C:\Windows\System\bIPrCZF.exe
  2⤵
  PID:10060
- C:\Windows\System\hAlsKOF.exe
  C:\Windows\System\hAlsKOF.exe
  2⤵
  PID:12076
- C:\Windows\System\IXCpySx.exe
  C:\Windows\System\IXCpySx.exe
  2⤵
  PID:11076
- C:\Windows\System\DUdBClS.exe
  C:\Windows\System\DUdBClS.exe
  2⤵
  PID:3320
- C:\Windows\System\PczyiMZ.exe
  C:\Windows\System\PczyiMZ.exe
  2⤵
  PID:10588
- C:\Windows\System\YNGPLbi.exe
  C:\Windows\System\YNGPLbi.exe
  2⤵
  PID:11304
- C:\Windows\System\GGhXmbg.exe
  C:\Windows\System\GGhXmbg.exe
  2⤵
  PID:9084
- C:\Windows\System\IdtUJAn.exe
  C:\Windows\System\IdtUJAn.exe
  2⤵
  PID:12660
- C:\Windows\System\acxGKts.exe
  C:\Windows\System\acxGKts.exe
  2⤵
  PID:10784
- C:\Windows\System\GNXSMcv.exe
  C:\Windows\System\GNXSMcv.exe
  2⤵
  PID:6140
- C:\Windows\System\fxioCYu.exe
  C:\Windows\System\fxioCYu.exe
  2⤵
  PID:12120
- C:\Windows\System\ACMdKSl.exe
  C:\Windows\System\ACMdKSl.exe
  2⤵
  PID:2084
- C:\Windows\System\ORjurrh.exe
  C:\Windows\System\ORjurrh.exe
  2⤵
  PID:13136
- C:\Windows\System\GJhvewy.exe
  C:\Windows\System\GJhvewy.exe
  2⤵
  PID:10960
- C:\Windows\System\GrnfmeC.exe
  C:\Windows\System\GrnfmeC.exe
  2⤵
  PID:8308
- C:\Windows\System\aPbcvUo.exe
  C:\Windows\System\aPbcvUo.exe
  2⤵
  PID:1908
- C:\Windows\System\wOPPOau.exe
  C:\Windows\System\wOPPOau.exe
  2⤵
  PID:3652
- C:\Windows\System\OkPWYrP.exe
  C:\Windows\System\OkPWYrP.exe
  2⤵
  PID:8332
- C:\Windows\System\dSYLTsG.exe
  C:\Windows\System\dSYLTsG.exe
  2⤵
  PID:3820
- C:\Windows\System\XQoRTNn.exe
  C:\Windows\System\XQoRTNn.exe
  2⤵
  PID:7280
- C:\Windows\System\jXmTvGT.exe
  C:\Windows\System\jXmTvGT.exe
  2⤵
  PID:3164
- C:\Windows\System\TnOZijm.exe
  C:\Windows\System\TnOZijm.exe
  2⤵
  PID:12568
- C:\Windows\System\QBYlbMU.exe
  C:\Windows\System\QBYlbMU.exe
  2⤵
  PID:10184
- C:\Windows\System\zTwnwue.exe
  C:\Windows\System\zTwnwue.exe
  2⤵
  PID:10100
- C:\Windows\System\lujAJVE.exe
  C:\Windows\System\lujAJVE.exe
  2⤵
  PID:6928
- C:\Windows\System\EcYaTUx.exe
  C:\Windows\System\EcYaTUx.exe
  2⤵
  PID:12964
- C:\Windows\System\UPDmWtH.exe
  C:\Windows\System\UPDmWtH.exe
  2⤵
  PID:7080
- C:\Windows\System\YEJRhxt.exe
  C:\Windows\System\YEJRhxt.exe
  2⤵
  PID:5020
- C:\Windows\System\NSmowFG.exe
  C:\Windows\System\NSmowFG.exe
  2⤵
  PID:10800
- C:\Windows\System\GtAJGZk.exe
  C:\Windows\System\GtAJGZk.exe
  2⤵
  PID:2040
- C:\Windows\System\siySCEz.exe
  C:\Windows\System\siySCEz.exe
  2⤵
  PID:10948
- C:\Windows\System\SnIzRlr.exe
  C:\Windows\System\SnIzRlr.exe
  2⤵
  PID:11152
- C:\Windows\System\EsGAfEh.exe
  C:\Windows\System\EsGAfEh.exe
  2⤵
  PID:8992
- C:\Windows\System\NEJygXK.exe
  C:\Windows\System\NEJygXK.exe
  2⤵
  PID:9664
- C:\Windows\System\eLHzqSq.exe
  C:\Windows\System\eLHzqSq.exe
  2⤵
  PID:7988
- C:\Windows\System\TWcFESH.exe
  C:\Windows\System\TWcFESH.exe
  2⤵
  PID:13280
- C:\Windows\System\RBdCaQR.exe
  C:\Windows\System\RBdCaQR.exe
  2⤵
  PID:3488
- C:\Windows\System\EvqWISS.exe
  C:\Windows\System\EvqWISS.exe
  2⤵
  PID:11920
- C:\Windows\System\uOicNSC.exe
  C:\Windows\System\uOicNSC.exe
  2⤵
  PID:6780
- C:\Windows\System\HUnfzTo.exe
  C:\Windows\System\HUnfzTo.exe
  2⤵
  PID:8044
- C:\Windows\System\hiozkuI.exe
  C:\Windows\System\hiozkuI.exe
  2⤵
  PID:11836
- C:\Windows\System\pUeyIRO.exe
  C:\Windows\System\pUeyIRO.exe
  2⤵
  PID:2092
- C:\Windows\System\JhZXdcM.exe
  C:\Windows\System\JhZXdcM.exe
  2⤵
  PID:13184
- C:\Windows\System\kuWlqIl.exe
  C:\Windows\System\kuWlqIl.exe
  2⤵
  PID:4328
- C:\Windows\System\eenVbkt.exe
  C:\Windows\System\eenVbkt.exe
  2⤵
  PID:10348
- C:\Windows\System\UDhtxKk.exe
  C:\Windows\System\UDhtxKk.exe
  2⤵
  PID:1444
- C:\Windows\System\AYuWJOB.exe
  C:\Windows\System\AYuWJOB.exe
  2⤵
  PID:6744
- C:\Windows\System\gcAxLhl.exe
  C:\Windows\System\gcAxLhl.exe
  2⤵
  PID:10772
- C:\Windows\System\UkQxsCk.exe
  C:\Windows\System\UkQxsCk.exe
  2⤵
  PID:3780
- C:\Windows\System\bEluVId.exe
  C:\Windows\System\bEluVId.exe
  2⤵
  PID:6344
- C:\Windows\System\XZxdGQY.exe
  C:\Windows\System\XZxdGQY.exe
  2⤵
  PID:6440
- C:\Windows\System\cFYRzqJ.exe
  C:\Windows\System\cFYRzqJ.exe
  2⤵
  PID:1080
- C:\Windows\System\ZzZDrnc.exe
  C:\Windows\System\ZzZDrnc.exe
  2⤵
  PID:7424
- C:\Windows\System\SYAFVWw.exe
  C:\Windows\System\SYAFVWw.exe
  2⤵
  PID:6472
- C:\Windows\System\fKRgDNM.exe
  C:\Windows\System\fKRgDNM.exe
  2⤵
  PID:6268
- C:\Windows\System\uOfQxQf.exe
  C:\Windows\System\uOfQxQf.exe
  2⤵
  PID:12788
- C:\Windows\System\vEtXqdd.exe
  C:\Windows\System\vEtXqdd.exe
  2⤵
  PID:11748
- C:\Windows\System\UNedzeq.exe
  C:\Windows\System\UNedzeq.exe
  2⤵
  PID:12512
- C:\Windows\System\cdrXkHc.exe
  C:\Windows\System\cdrXkHc.exe
  2⤵
  PID:5732
- C:\Windows\System\AfudPuN.exe
  C:\Windows\System\AfudPuN.exe
  2⤵
  PID:12908
- C:\Windows\System\UUHaTDI.exe
  C:\Windows\System\UUHaTDI.exe
  2⤵
  PID:5844
- C:\Windows\System\PTJORwj.exe
  C:\Windows\System\PTJORwj.exe
  2⤵
  PID:6032
- C:\Windows\System\FxTaLog.exe
  C:\Windows\System\FxTaLog.exe
  2⤵
  PID:3628
- C:\Windows\System\QkgNYLA.exe
  C:\Windows\System\QkgNYLA.exe
  2⤵
  PID:6120
- C:\Windows\System\gDvhuvd.exe
  C:\Windows\System\gDvhuvd.exe
  2⤵
  PID:6188
- C:\Windows\System\SYmqvuP.exe
  C:\Windows\System\SYmqvuP.exe
  2⤵
  PID:5472
- C:\Windows\System\JZjRcEV.exe
  C:\Windows\System\JZjRcEV.exe
  2⤵
  PID:6328
- C:\Windows\System\yZYaidw.exe
  C:\Windows\System\yZYaidw.exe
  2⤵
  PID:1740
- C:\Windows\System\GTMJXRl.exe
  C:\Windows\System\GTMJXRl.exe
  2⤵
  PID:12968
- C:\Windows\System\swtCVer.exe
  C:\Windows\System\swtCVer.exe
  2⤵
  PID:11756
- C:\Windows\System\jyYCzqu.exe
  C:\Windows\System\jyYCzqu.exe
  2⤵
  PID:12924
- C:\Windows\System\QknRAQz.exe
  C:\Windows\System\QknRAQz.exe
  2⤵
  PID:620
- C:\Windows\System\egGsDGR.exe
  C:\Windows\System\egGsDGR.exe
  2⤵
  PID:628
- C:\Windows\System\JRflnqV.exe
  C:\Windows\System\JRflnqV.exe
  2⤵
  PID:3220
- C:\Windows\System\btOUHuD.exe
  C:\Windows\System\btOUHuD.exe
  2⤵
  PID:7744
- C:\Windows\System\CiEFgFT.exe
  C:\Windows\System\CiEFgFT.exe
  2⤵
  PID:12896
- C:\Windows\System\thcShAo.exe
  C:\Windows\System\thcShAo.exe
  2⤵
  PID:7512
- C:\Windows\System\ZhriVDt.exe
  C:\Windows\System\ZhriVDt.exe
  2⤵
  PID:4528
- C:\Windows\System\FnPpAhW.exe
  C:\Windows\System\FnPpAhW.exe
  2⤵
  PID:7112
- C:\Windows\System\EJNNHho.exe
  C:\Windows\System\EJNNHho.exe
  2⤵
  PID:7852
- C:\Windows\System\krNBWuL.exe
  C:\Windows\System\krNBWuL.exe
  2⤵
  PID:7964
- C:\Windows\System\ThhQtYI.exe
  C:\Windows\System\ThhQtYI.exe
  2⤵
  PID:9652
- C:\Windows\System\soMwkCp.exe
  C:\Windows\System\soMwkCp.exe
  2⤵
  PID:10940
- C:\Windows\System\DwMiXdE.exe
  C:\Windows\System\DwMiXdE.exe
  2⤵
  PID:7588
- C:\Windows\System\jdDUIGU.exe
  C:\Windows\System\jdDUIGU.exe
  2⤵
  PID:2840
- C:\Windows\System\giitSkg.exe
  C:\Windows\System\giitSkg.exe
  2⤵
  PID:7024
- C:\Windows\System\XyIqzVs.exe
  C:\Windows\System\XyIqzVs.exe
  2⤵
  PID:10768
- C:\Windows\System\vQrgPDP.exe
  C:\Windows\System\vQrgPDP.exe
  2⤵
  PID:10604
- C:\Windows\System\iQbCxBc.exe
  C:\Windows\System\iQbCxBc.exe
  2⤵
  PID:6276
- C:\Windows\System\UsOleZh.exe
  C:\Windows\System\UsOleZh.exe
  2⤵
  PID:1192
- C:\Windows\System\tzOxMej.exe
  C:\Windows\System\tzOxMej.exe
  2⤵
  PID:11876
- C:\Windows\System\JxUMynO.exe
  C:\Windows\System\JxUMynO.exe
  2⤵
  PID:11640
- C:\Windows\System\nzfzAEK.exe
  C:\Windows\System\nzfzAEK.exe
  2⤵
  PID:11700
- C:\Windows\System\gGGIaqi.exe
  C:\Windows\System\gGGIaqi.exe
  2⤵
  PID:7968
- C:\Windows\System\ZXBYFOD.exe
  C:\Windows\System\ZXBYFOD.exe
  2⤵
  PID:8076
- C:\Windows\System\wuUfLdP.exe
  C:\Windows\System\wuUfLdP.exe
  2⤵
  PID:13380
- C:\Windows\System\joiWMmi.exe
  C:\Windows\System\joiWMmi.exe
  2⤵
  PID:13400
- C:\Windows\System\mUpxtHW.exe
  C:\Windows\System\mUpxtHW.exe
  2⤵
  PID:13428
- C:\Windows\System\bgZSFWQ.exe
  C:\Windows\System\bgZSFWQ.exe
  2⤵
  PID:13464
- C:\Windows\System\KSWBXfD.exe
  C:\Windows\System\KSWBXfD.exe
  2⤵
  PID:13540
- C:\Windows\System\giEBZyE.exe
  C:\Windows\System\giEBZyE.exe
  2⤵
  PID:13560
- C:\Windows\System\MfOajlh.exe
  C:\Windows\System\MfOajlh.exe
  2⤵
  PID:13600
- C:\Windows\System\nsNMAuN.exe
  C:\Windows\System\nsNMAuN.exe
  2⤵
  PID:13716
- C:\Windows\System\ApCApAt.exe
  C:\Windows\System\ApCApAt.exe
  2⤵
  PID:13732
- C:\Windows\System\llhWnIx.exe
  C:\Windows\System\llhWnIx.exe
  2⤵
  PID:13748
- C:\Windows\System\tRUHttg.exe
  C:\Windows\System\tRUHttg.exe
  2⤵
  PID:13776
- C:\Windows\System\TBBpNCw.exe
  C:\Windows\System\TBBpNCw.exe
  2⤵
  PID:13796
- C:\Windows\System\GbhhKja.exe
  C:\Windows\System\GbhhKja.exe
  2⤵
  PID:13824
- C:\Windows\System\ecpzYaw.exe
  C:\Windows\System\ecpzYaw.exe
  2⤵
  PID:13848
- C:\Windows\System\bAVcwhl.exe
  C:\Windows\System\bAVcwhl.exe
  2⤵
  PID:13872
- C:\Windows\System\eqreDTq.exe
  C:\Windows\System\eqreDTq.exe
  2⤵
  PID:13896
- C:\Windows\System\BzunRIa.exe
  C:\Windows\System\BzunRIa.exe
  2⤵
  PID:14144
- C:\Windows\System\ZLxxYYh.exe
  C:\Windows\System\ZLxxYYh.exe
  2⤵
  PID:14172
- C:\Windows\System\gqQUXqb.exe
  C:\Windows\System\gqQUXqb.exe
  2⤵
  PID:14272
- C:\Windows\System\NjPHLCt.exe
  C:\Windows\System\NjPHLCt.exe
  2⤵
  PID:14300
- C:\Windows\System\DvazGwK.exe
  C:\Windows\System\DvazGwK.exe
  2⤵
  PID:8168
- C:\Windows\System\NsQRQhr.exe
  C:\Windows\System\NsQRQhr.exe
  2⤵
  PID:8224
- C:\Windows\System\IeuMHxH.exe
  C:\Windows\System\IeuMHxH.exe
  2⤵
  PID:7996
- C:\Windows\System\aUSqsJT.exe
  C:\Windows\System\aUSqsJT.exe
  2⤵
  PID:6560
- C:\Windows\System\WSTmQOe.exe
  C:\Windows\System\WSTmQOe.exe
  2⤵
  PID:6644
- C:\Windows\System\wAiqEZA.exe
  C:\Windows\System\wAiqEZA.exe
  2⤵
  PID:6336
- C:\Windows\System\TmHMYnC.exe
  C:\Windows\System\TmHMYnC.exe
  2⤵
  PID:7464
- C:\Windows\System\QKZolNA.exe
  C:\Windows\System\QKZolNA.exe
  2⤵
  PID:6628
- C:\Windows\System\mJTvApn.exe
  C:\Windows\System\mJTvApn.exe
  2⤵
  PID:7308
- C:\Windows\System\cTBrSYb.exe
  C:\Windows\System\cTBrSYb.exe
  2⤵
  PID:6804
- C:\Windows\System\RJXpzrv.exe
  C:\Windows\System\RJXpzrv.exe
  2⤵
  PID:7232
- C:\Windows\System\XjhLVpI.exe
  C:\Windows\System\XjhLVpI.exe
  2⤵
  PID:4068
- C:\Windows\System\pStiDvK.exe
  C:\Windows\System\pStiDvK.exe
  2⤵
  PID:452
- C:\Windows\System\wPGtDOA.exe
  C:\Windows\System\wPGtDOA.exe
  2⤵
  PID:7176
- C:\Windows\System\agjdXEV.exe
  C:\Windows\System\agjdXEV.exe
  2⤵
  PID:8836
- C:\Windows\System\wFpBMvy.exe
  C:\Windows\System\wFpBMvy.exe
  2⤵
  PID:13320
- C:\Windows\System\pgsxdHT.exe
  C:\Windows\System\pgsxdHT.exe
  2⤵
  PID:13340
- C:\Windows\System\GecSTyh.exe
  C:\Windows\System\GecSTyh.exe
  2⤵
  PID:13348
- C:\Windows\System\oDnHJOl.exe
  C:\Windows\System\oDnHJOl.exe
  2⤵
  PID:8540
- C:\Windows\System\fkhRsip.exe
  C:\Windows\System\fkhRsip.exe
  2⤵
  PID:7608
- C:\Windows\System\kkFCUbi.exe
  C:\Windows\System\kkFCUbi.exe
  2⤵
  PID:13452
- C:\Windows\System\AdltvOf.exe
  C:\Windows\System\AdltvOf.exe
  2⤵
  PID:7516
- C:\Windows\System\aTKkyHJ.exe
  C:\Windows\System\aTKkyHJ.exe
  2⤵
  PID:7812
- C:\Windows\System\RywhaWJ.exe
  C:\Windows\System\RywhaWJ.exe
  2⤵
  PID:8952
- C:\Windows\System\QVPkOJB.exe
  C:\Windows\System\QVPkOJB.exe
  2⤵
  PID:13608
- C:\Windows\System\SYUecca.exe
  C:\Windows\System\SYUecca.exe
  2⤵
  PID:7488
- C:\Windows\System\etXysnW.exe
  C:\Windows\System\etXysnW.exe
  2⤵
  PID:7532
- C:\Windows\System\wRajadi.exe
  C:\Windows\System\wRajadi.exe
  2⤵
  PID:9212
- C:\Windows\System\jjUfGiK.exe
  C:\Windows\System\jjUfGiK.exe
  2⤵
  PID:14160
- C:\Windows\System\FuzBCqd.exe
  C:\Windows\System\FuzBCqd.exe
  2⤵
  PID:14204
- C:\Windows\System\ScThTOh.exe
  C:\Windows\System\ScThTOh.exe
  2⤵
  PID:13652
- C:\Windows\System\rUJueKp.exe
  C:\Windows\System\rUJueKp.exe
  2⤵
  PID:8652
- C:\Windows\System\yDkGEOu.exe
  C:\Windows\System\yDkGEOu.exe
  2⤵
  PID:14320
- C:\Windows\System\zRuGvai.exe
  C:\Windows\System\zRuGvai.exe
  2⤵
  PID:1176
- C:\Windows\System\qsERASs.exe
  C:\Windows\System\qsERASs.exe
  2⤵
  PID:13768
- C:\Windows\System\MfggByQ.exe
  C:\Windows\System\MfggByQ.exe
  2⤵
  PID:13596
- C:\Windows\System\PuhVjBo.exe
  C:\Windows\System\PuhVjBo.exe
  2⤵
  PID:14264
- C:\Windows\System\fkjLdyV.exe
  C:\Windows\System\fkjLdyV.exe
  2⤵
  PID:12724
- C:\Windows\System\WMWJAZt.exe
  C:\Windows\System\WMWJAZt.exe
  2⤵
  PID:8116
- C:\Windows\System\sEShyor.exe
  C:\Windows\System\sEShyor.exe
  2⤵
  PID:14044
- C:\Windows\System\pEDVyPP.exe
  C:\Windows\System\pEDVyPP.exe
  2⤵
  PID:8220
- C:\Windows\System\XEsChUZ.exe
  C:\Windows\System\XEsChUZ.exe
  2⤵
  PID:8852
- C:\Windows\System\OKMxUwZ.exe
  C:\Windows\System\OKMxUwZ.exe
  2⤵
  PID:8548
- C:\Windows\System\yQfeTmX.exe
  C:\Windows\System\yQfeTmX.exe
  2⤵
  PID:6256
- C:\Windows\System\JCgcgZF.exe
  C:\Windows\System\JCgcgZF.exe
  2⤵
  PID:7276
- C:\Windows\System\HPZEIWB.exe
  C:\Windows\System\HPZEIWB.exe
  2⤵
  PID:10200
- C:\Windows\System\atejfJq.exe
  C:\Windows\System\atejfJq.exe
  2⤵
  PID:7356
- C:\Windows\System\mtptaZn.exe
  C:\Windows\System\mtptaZn.exe
  2⤵
  PID:7800
- C:\Windows\System\tYgIVMi.exe
  C:\Windows\System\tYgIVMi.exe
  2⤵
  PID:8924
- C:\Windows\System\CNUBRtR.exe
  C:\Windows\System\CNUBRtR.exe
  2⤵
  PID:13904
- C:\Windows\System\IOkldSd.exe
  C:\Windows\System\IOkldSd.exe
  2⤵
  PID:9908
- C:\Windows\System\ugQNCww.exe
  C:\Windows\System\ugQNCww.exe
  2⤵
  PID:13684
- C:\Windows\System\JcPXFPj.exe
  C:\Windows\System\JcPXFPj.exe
  2⤵
  PID:8736
- C:\Windows\System\btkvNYx.exe
  C:\Windows\System\btkvNYx.exe
  2⤵
  PID:10088
- C:\Windows\System\PqaRBnw.exe
  C:\Windows\System\PqaRBnw.exe
  2⤵
  PID:9888
- C:\Windows\System\BuMAEMi.exe
  C:\Windows\System\BuMAEMi.exe
  2⤵
  PID:14088
- C:\Windows\System\gaaTwag.exe
  C:\Windows\System\gaaTwag.exe
  2⤵
  PID:8640
- C:\Windows\System\kxZtDxb.exe
  C:\Windows\System\kxZtDxb.exe
  2⤵
  PID:9752
- C:\Windows\System\NpUmUvn.exe
  C:\Windows\System\NpUmUvn.exe
  2⤵
  PID:13644
- C:\Windows\System\yEVelIO.exe
  C:\Windows\System\yEVelIO.exe
  2⤵
  PID:8344
- C:\Windows\System\zTwMfjg.exe
  C:\Windows\System\zTwMfjg.exe
  2⤵
  PID:13988
- C:\Windows\System\SkqSrnx.exe
  C:\Windows\System\SkqSrnx.exe
  2⤵
  PID:8712
- C:\Windows\System\pytJbCB.exe
  C:\Windows\System\pytJbCB.exe
  2⤵
  PID:9264
- C:\Windows\System\ZfqZaeC.exe
  C:\Windows\System\ZfqZaeC.exe
  2⤵
  PID:8728
- C:\Windows\System\NlKpdqV.exe
  C:\Windows\System\NlKpdqV.exe
  2⤵
  PID:10220
- C:\Windows\System\tjtDtYk.exe
  C:\Windows\System\tjtDtYk.exe
  2⤵
  PID:9392
- C:\Windows\System\YgqOIwr.exe
  C:\Windows\System\YgqOIwr.exe
  2⤵
  PID:9612
- C:\Windows\System\GWYwHHO.exe
  C:\Windows\System\GWYwHHO.exe
  2⤵
  PID:9528
- C:\Windows\System\YvrQMzN.exe
  C:\Windows\System\YvrQMzN.exe
  2⤵
  PID:13584
- C:\Windows\System\ailNuOl.exe
  C:\Windows\System\ailNuOl.exe
  2⤵
  PID:8740
- C:\Windows\System\BBpoDvl.exe
  C:\Windows\System\BBpoDvl.exe
  2⤵
  PID:8464
- C:\Windows\System\iiBuXER.exe
  C:\Windows\System\iiBuXER.exe
  2⤵
  PID:8592
- C:\Windows\System\eLxbinw.exe
  C:\Windows\System\eLxbinw.exe
  2⤵
  PID:13920
- C:\Windows\System\YOtTMzt.exe
  C:\Windows\System\YOtTMzt.exe
  2⤵
  PID:10536
- C:\Windows\System\omamAEG.exe
  C:\Windows\System\omamAEG.exe
  2⤵
  PID:13396
- C:\Windows\System\XhfARzr.exe
  C:\Windows\System\XhfARzr.exe
  2⤵
  PID:10628
- C:\Windows\System\jRzAWNy.exe
  C:\Windows\System\jRzAWNy.exe
  2⤵
  PID:696
- C:\Windows\System\wzheeKJ.exe
  C:\Windows\System\wzheeKJ.exe
  2⤵
  PID:6672
- C:\Windows\System\GSRFZnn.exe
  C:\Windows\System\GSRFZnn.exe
  2⤵
  PID:5976
- C:\Windows\System\oyGVWrC.exe
  C:\Windows\System\oyGVWrC.exe
  2⤵
  PID:11548
- C:\Windows\System\qjTWpio.exe
  C:\Windows\System\qjTWpio.exe
  2⤵
  PID:7396
- C:\Windows\System\cmUmdLL.exe
  C:\Windows\System\cmUmdLL.exe
  2⤵
  PID:10636
- C:\Windows\System\kMjPVLd.exe
  C:\Windows\System\kMjPVLd.exe
  2⤵
  PID:10368
- C:\Windows\System\NqcqDot.exe
  C:\Windows\System\NqcqDot.exe
  2⤵
  PID:13948
- C:\Windows\System\QtgSmbK.exe
  C:\Windows\System\QtgSmbK.exe
  2⤵
  PID:11188
- C:\Windows\System\xSuewLJ.exe
  C:\Windows\System\xSuewLJ.exe
  2⤵
  PID:10848
- C:\Windows\System\xCsvLAf.exe
  C:\Windows\System\xCsvLAf.exe
  2⤵
  PID:10900
- C:\Windows\System\LaImTpN.exe
  C:\Windows\System\LaImTpN.exe
  2⤵
  PID:9668
- C:\Windows\System\lSnrEzW.exe
  C:\Windows\System\lSnrEzW.exe
  2⤵
  PID:13756
- C:\Windows\System\ZuOZoTi.exe
  C:\Windows\System\ZuOZoTi.exe
  2⤵
  PID:13332
- C:\Windows\System\mSYKRYx.exe
  C:\Windows\System\mSYKRYx.exe
  2⤵
  PID:9388
- C:\Windows\System\gdMemVI.exe
  C:\Windows\System\gdMemVI.exe
  2⤵
  PID:14196
- C:\Windows\System\wIVSZWv.exe
  C:\Windows\System\wIVSZWv.exe
  2⤵
  PID:8648
- C:\Windows\System\rTBpyqP.exe
  C:\Windows\System\rTBpyqP.exe
  2⤵
  PID:9632
- C:\Windows\System\nvmuYze.exe
  C:\Windows\System\nvmuYze.exe
  2⤵
  PID:11096
- C:\Windows\System\SwJVOdP.exe
  C:\Windows\System\SwJVOdP.exe
  2⤵
  PID:14084
- C:\Windows\System\kQjcANf.exe
  C:\Windows\System\kQjcANf.exe
  2⤵
  PID:13944
- C:\Windows\System\ddOBnvr.exe
  C:\Windows\System\ddOBnvr.exe
  2⤵
  PID:13620
- C:\Windows\System\NGTIdEs.exe
  C:\Windows\System\NGTIdEs.exe
  2⤵
  PID:7904
- C:\Windows\System\dijZaZO.exe
  C:\Windows\System\dijZaZO.exe
  2⤵
  PID:4996
- C:\Windows\System\FwdCsWk.exe
  C:\Windows\System\FwdCsWk.exe
  2⤵
  PID:9576
- C:\Windows\System\fDngNhV.exe
  C:\Windows\System\fDngNhV.exe
  2⤵
  PID:14032
- C:\Windows\System\KVLdfsb.exe
  C:\Windows\System\KVLdfsb.exe
  2⤵
  PID:10544
- C:\Windows\System\wCpHUxz.exe
  C:\Windows\System\wCpHUxz.exe
  2⤵
  PID:14268
- C:\Windows\System\qGuBLrq.exe
  C:\Windows\System\qGuBLrq.exe
  2⤵
  PID:10328
- C:\Windows\System\PjoxohN.exe
  C:\Windows\System\PjoxohN.exe
  2⤵
  PID:13496
- C:\Windows\System\adYxHcK.exe
  C:\Windows\System\adYxHcK.exe
  2⤵
  PID:10776
- C:\Windows\System\hZYlYPH.exe
  C:\Windows\System\hZYlYPH.exe
  2⤵
  PID:5048
- C:\Windows\System\lbmmRmh.exe
  C:\Windows\System\lbmmRmh.exe
  2⤵
  PID:14340
- C:\Windows\System\KWsOkiK.exe
  C:\Windows\System\KWsOkiK.exe
  2⤵
  PID:14380
- C:\Windows\System\CDUSaVm.exe
  C:\Windows\System\CDUSaVm.exe
  2⤵
  PID:14424
- C:\Windows\System\KnrpleJ.exe
  C:\Windows\System\KnrpleJ.exe
  2⤵
  PID:14448
- C:\Windows\System\JWbOOYT.exe
  C:\Windows\System\JWbOOYT.exe
  2⤵
  PID:14472
- C:\Windows\System\KDrpOxi.exe
  C:\Windows\System\KDrpOxi.exe
  2⤵
  PID:14496
- C:\Windows\System\rqgLKTd.exe
  C:\Windows\System\rqgLKTd.exe
  2⤵
  PID:14516
- C:\Windows\System\dqpEDDC.exe
  C:\Windows\System\dqpEDDC.exe
  2⤵
  PID:14532
- C:\Windows\System\qEfeAwx.exe
  C:\Windows\System\qEfeAwx.exe
  2⤵
  PID:14548
- C:\Windows\System\ZPyXtDt.exe
  C:\Windows\System\ZPyXtDt.exe
  2⤵
  PID:14564
- C:\Windows\System\nvTdFax.exe
  C:\Windows\System\nvTdFax.exe
  2⤵
  PID:14580
- C:\Windows\System\VorJAZh.exe
  C:\Windows\System\VorJAZh.exe
  2⤵
  PID:14600
- C:\Windows\System\TtzFweE.exe
  C:\Windows\System\TtzFweE.exe
  2⤵
  PID:14616
- C:\Windows\System\PXMTYFJ.exe
  C:\Windows\System\PXMTYFJ.exe
  2⤵
  PID:14632
- C:\Windows\System\mzWlgOg.exe
  C:\Windows\System\mzWlgOg.exe
  2⤵
  PID:14652
- C:\Windows\System\mkrycJk.exe
  C:\Windows\System\mkrycJk.exe
  2⤵
  PID:14668
- C:\Windows\System\plbgBzt.exe
  C:\Windows\System\plbgBzt.exe
  2⤵
  PID:14684
- C:\Windows\System\vjYcQAg.exe
  C:\Windows\System\vjYcQAg.exe
  2⤵
  PID:14700
- C:\Windows\System\aNlcuDY.exe
  C:\Windows\System\aNlcuDY.exe
  2⤵
  PID:14716
- C:\Windows\System\hfequHu.exe
  C:\Windows\System\hfequHu.exe
  2⤵
  PID:14732
- C:\Windows\System\CxNBJRa.exe
  C:\Windows\System\CxNBJRa.exe
  2⤵
  PID:14828
- C:\Windows\System\FZQiJYF.exe
  C:\Windows\System\FZQiJYF.exe
  2⤵
  PID:14972
- C:\Windows\System\RQxjRCo.exe
  C:\Windows\System\RQxjRCo.exe
  2⤵
  PID:15052
- C:\Windows\System\oqpNWQX.exe
  C:\Windows\System\oqpNWQX.exe
  2⤵
  PID:15100
- C:\Windows\System\JkrfHhq.exe
  C:\Windows\System\JkrfHhq.exe
  2⤵
  PID:15116
- C:\Windows\System\TmSCkLL.exe
  C:\Windows\System\TmSCkLL.exe
  2⤵
  PID:15136
- C:\Windows\System\DAoZMZX.exe
  C:\Windows\System\DAoZMZX.exe
  2⤵
  PID:10180
- C:\Windows\System\suWNMgF.exe
  C:\Windows\System\suWNMgF.exe
  2⤵
  PID:7580
- C:\Windows\System\EOyKBtO.exe
  C:\Windows\System\EOyKBtO.exe
  2⤵
  PID:13168
- C:\Windows\System\EdFdFYG.exe
  C:\Windows\System\EdFdFYG.exe
  2⤵
  PID:10444
- C:\Windows\System\cJMWdGG.exe
  C:\Windows\System\cJMWdGG.exe
  2⤵
  PID:10568
- C:\Windows\System\pxnFKsL.exe
  C:\Windows\System\pxnFKsL.exe
  2⤵
  PID:5932
- C:\Windows\System\qPjaumR.exe
  C:\Windows\System\qPjaumR.exe
  2⤵
  PID:10704
- C:\Windows\System\tpsxCWQ.exe
  C:\Windows\System\tpsxCWQ.exe
  2⤵
  PID:9828
- C:\Windows\System\SvIWlcQ.exe
  C:\Windows\System\SvIWlcQ.exe
  2⤵
  PID:10700
- C:\Windows\System\hTAHStS.exe
  C:\Windows\System\hTAHStS.exe
  2⤵
  PID:14376
- C:\Windows\System\dsBRGJn.exe
  C:\Windows\System\dsBRGJn.exe
  2⤵
  PID:11412
- C:\Windows\System\yGZSptc.exe
  C:\Windows\System\yGZSptc.exe
  2⤵
  PID:9504
- C:\Windows\System\HXLFyUR.exe
  C:\Windows\System\HXLFyUR.exe
  2⤵
  PID:10144
- C:\Windows\System\thfReZC.exe
  C:\Windows\System\thfReZC.exe
  2⤵
  PID:528
- C:\Windows\System\xwUzCsg.exe
  C:\Windows\System\xwUzCsg.exe
  2⤵
  PID:14188
- C:\Windows\System\LlBZyEX.exe
  C:\Windows\System\LlBZyEX.exe
  2⤵
  PID:9564
- C:\Windows\System\fpvDXWf.exe
  C:\Windows\System\fpvDXWf.exe
  2⤵
  PID:10968
- C:\Windows\System\FBaHbhr.exe
  C:\Windows\System\FBaHbhr.exe
  2⤵
  PID:6932
- C:\Windows\System\BtpJDRM.exe
  C:\Windows\System\BtpJDRM.exe
  2⤵
  PID:14612
- C:\Windows\System\YwOIerS.exe
  C:\Windows\System\YwOIerS.exe
  2⤵
  PID:14360
- C:\Windows\System\ksnwLOd.exe
  C:\Windows\System\ksnwLOd.exe
  2⤵
  PID:14692
- C:\Windows\System\voyLJCn.exe
  C:\Windows\System\voyLJCn.exe
  2⤵
  PID:14708
- C:\Windows\System\IMzZiVb.exe
  C:\Windows\System\IMzZiVb.exe
  2⤵
  PID:14728
- C:\Windows\System\PVzrPvv.exe
  C:\Windows\System\PVzrPvv.exe
  2⤵
  PID:14796
- C:\Windows\System\wlWzwZL.exe
  C:\Windows\System\wlWzwZL.exe
  2⤵
  PID:11784
- C:\Windows\System\eEOUQiZ.exe
  C:\Windows\System\eEOUQiZ.exe
  2⤵
  PID:14440
- C:\Windows\System\LvKBIvU.exe
  C:\Windows\System\LvKBIvU.exe
  2⤵
  PID:14524
- C:\Windows\System\fJPcumX.exe
  C:\Windows\System\fJPcumX.exe
  2⤵
  PID:10616
- C:\Windows\System\JFKSmWO.exe
  C:\Windows\System\JFKSmWO.exe
  2⤵
  PID:13520
- C:\Windows\System\drBczAN.exe
  C:\Windows\System\drBczAN.exe
  2⤵
  PID:14356
- C:\Windows\System\GoSfoNO.exe
  C:\Windows\System\GoSfoNO.exe
  2⤵
  PID:11404
- C:\Windows\System\NznkpMx.exe
  C:\Windows\System\NznkpMx.exe
  2⤵
  PID:14856
- C:\Windows\System\nmsmfho.exe
  C:\Windows\System\nmsmfho.exe
  2⤵
  PID:15048
- C:\Windows\System\FLhmUgv.exe
  C:\Windows\System\FLhmUgv.exe
  2⤵
  PID:12032
- C:\Windows\System\JbZrDHD.exe
  C:\Windows\System\JbZrDHD.exe
  2⤵
  PID:11288
- C:\Windows\System\fdpdqio.exe
  C:\Windows\System\fdpdqio.exe
  2⤵
  PID:15224
- C:\Windows\System\gZoIjfA.exe
  C:\Windows\System\gZoIjfA.exe
  2⤵
  PID:15276
- C:\Windows\System\SQcbEZP.exe
  C:\Windows\System\SQcbEZP.exe
  2⤵
  PID:15340
- C:\Windows\System\xbURRVI.exe
  C:\Windows\System\xbURRVI.exe
  2⤵
  PID:14648
- C:\Windows\System\mPKusFV.exe
  C:\Windows\System\mPKusFV.exe
  2⤵
  PID:14744
- C:\Windows\System\ugjCjvQ.exe
  C:\Windows\System\ugjCjvQ.exe
  2⤵
  PID:14776
- C:\Windows\System\nLNcOUO.exe
  C:\Windows\System\nLNcOUO.exe
  2⤵
  PID:15040
- C:\Windows\System\rJkXGja.exe
  C:\Windows\System\rJkXGja.exe
  2⤵
  PID:15072
- C:\Windows\System\OlKFFmb.exe
  C:\Windows\System\OlKFFmb.exe
  2⤵
  PID:12200
- C:\Windows\System\YDkWqoW.exe
  C:\Windows\System\YDkWqoW.exe
  2⤵
  PID:15108
- C:\Windows\System\xidfEiN.exe
  C:\Windows\System\xidfEiN.exe
  2⤵
  PID:11532
- C:\Windows\System\WrUmRCp.exe
  C:\Windows\System\WrUmRCp.exe
  2⤵
  PID:12836
- C:\Windows\System\kPjmpJD.exe
  C:\Windows\System\kPjmpJD.exe
  2⤵
  PID:12196
- C:\Windows\System\PogBsTd.exe
  C:\Windows\System\PogBsTd.exe
  2⤵
  PID:15236
- C:\Windows\System\pOoXbNr.exe
  C:\Windows\System\pOoXbNr.exe
  2⤵
  PID:10736
- C:\Windows\System\rcoaxyY.exe
  C:\Windows\System\rcoaxyY.exe
  2⤵
  PID:15272
- C:\Windows\System\CVYEzCR.exe
  C:\Windows\System\CVYEzCR.exe
  2⤵
  PID:10740
- C:\Windows\System\ZyvevVD.exe
  C:\Windows\System\ZyvevVD.exe
  2⤵
  PID:14000
- C:\Windows\System\UdEZsZk.exe
  C:\Windows\System\UdEZsZk.exe
  2⤵
  PID:11268
- C:\Windows\System\EcUXRwt.exe
  C:\Windows\System\EcUXRwt.exe
  2⤵
  PID:14696
- C:\Windows\System\XNFkJog.exe
  C:\Windows\System\XNFkJog.exe
  2⤵
  PID:12420
- C:\Windows\System\TnBgnCD.exe
  C:\Windows\System\TnBgnCD.exe
  2⤵
  PID:15092
- C:\Windows\System\IzooFpt.exe
  C:\Windows\System\IzooFpt.exe
  2⤵
  PID:15144
- C:\Windows\System\ozPrVOo.exe
  C:\Windows\System\ozPrVOo.exe
  2⤵
  PID:15168
- C:\Windows\System\SecOqRw.exe
  C:\Windows\System\SecOqRw.exe
  2⤵
  PID:15188
- C:\Windows\System\RqLuioH.exe
  C:\Windows\System\RqLuioH.exe
  2⤵
  PID:15320
- C:\Windows\System\UwQEhRN.exe
  C:\Windows\System\UwQEhRN.exe
  2⤵
  PID:11492
- C:\Windows\System\TctPfJm.exe
  C:\Windows\System\TctPfJm.exe
  2⤵
  PID:11896
- C:\Windows\System\fDDpCnX.exe
  C:\Windows\System\fDDpCnX.exe
  2⤵
  PID:14444
- C:\Windows\System\ZKAeHYs.exe
  C:\Windows\System\ZKAeHYs.exe
  2⤵
  PID:10648
- C:\Windows\System\CqBwTaU.exe
  C:\Windows\System\CqBwTaU.exe
  2⤵
  PID:7480
- C:\Windows\System\kAOYTCZ.exe
  C:\Windows\System\kAOYTCZ.exe
  2⤵
  PID:10496
- C:\Windows\System\sPLbbDH.exe
  C:\Windows\System\sPLbbDH.exe
  2⤵
  PID:14780
- C:\Windows\System\bGZsrfG.exe
  C:\Windows\System\bGZsrfG.exe
  2⤵
  PID:14764
- C:\Windows\System\RCjXiBE.exe
  C:\Windows\System\RCjXiBE.exe
  2⤵
  PID:15020
- C:\Windows\System\cyUlhLg.exe
  C:\Windows\System\cyUlhLg.exe
  2⤵
  PID:11356
- C:\Windows\System\tVluehX.exe
  C:\Windows\System\tVluehX.exe
  2⤵
  PID:12860
- C:\Windows\System\GpUUbas.exe
  C:\Windows\System\GpUUbas.exe
  2⤵
  PID:15084
- C:\Windows\System\pcWBhQZ.exe
  C:\Windows\System\pcWBhQZ.exe
  2⤵
  PID:10668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mmfyadaq.qeq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AMLboGa.exe

Filesize
8B

MD5
d7e4f68a14401998a381c79b252ac865

SHA1
0d36cfcd4ce02bb829224d174fc9b962665fc946

SHA256
d162feff80c284766b8daa77b7869376d055a9ec10b9d79e9bd887f398dea139

SHA512
dd66f7ef866b80dc7dda9ff6a3f3688be07e38ffefbe09aa1363275eee46c3fcef42436eb020d0a843fe0f82bd2346800644f7a92f1d40d401e8f6253e470406

Download Submit
C:\Windows\System\CCVslqt.exe

Filesize
1.9MB

MD5
82349774fd45f1ca5e0a3c30827a0072

SHA1
04edf8122d72c60e82f2b57c1406ea209e9c74a7

SHA256
076636ef9e83622721514b0a4fbdb4dbd6289f7711a35b0d7a0e482612c7fe16

SHA512
ce1bcee18907dc67b3e1a502f03c8b9a43b3783e0ff5cc3b2d88a2d669ba9c6b6611d2cc7f253790ecb6e4e3d6fcb5eb02cbd055ac2e511e87ed4ba739015d93

Download Submit
C:\Windows\System\DGeBqsh.exe

Filesize
1.9MB

MD5
9e605702d124907c90143f6105f32556

SHA1
b08567498291871db02675c18f0120f51759674c

SHA256
882d4a629ab59662c65513d9fecd95195286ef43f92b36c7fa91e9f09e2a6087

SHA512
81b5a077d6d3f3c90ce149ceba38c15784b80f7d0210d8214df53b1a951d1bdb0f15e52ae8d588c0e6c1f6f2acebfa4e482e61dbdfa03b9d067d52cfc8c7a04e

Download Submit
C:\Windows\System\DiPejju.exe

Filesize
1.9MB

MD5
ba1bf89a472579edc23e251bc0708773

SHA1
7ae5af8957c0ea13d3b6de646e976040b5be57c2

SHA256
143a72dbed818583716c8d2ea7c7ad65d965d30cbd17aaac70e95947cd632725

SHA512
2b162503911ced842f479604c32907d83bd24a48c49fd98ef877ec704da497592703157b421f33b945f88253061b960fa5499059dd11efbe39b6bdaed9ff3e00

Download Submit
C:\Windows\System\DynSduz.exe

Filesize
1.9MB

MD5
2596c0ecc76e71c4c49cff76de459053

SHA1
167188188bcf6e4a837f13a921ed5aa84b5c1d5e

SHA256
3e1868b95cf1a13713caacdbc89d0ba1c0b0e66c15d33ee205865854b4fcd749

SHA512
13a64cde8ca37bfe23d6d9817ec5e23309e4c776fc42db1372ebce513b233c6a06bcc62177e8b9c191fa99aaf7db165a0c4e6bbc691a4323b15869b01b5f8b56

Download Submit
C:\Windows\System\FecuraY.exe

Filesize
1.9MB

MD5
3273300b41e7d0c0717d63e8e2dfcdbd

SHA1
f6dd2e1b62281bf4a82628ee11fb9aaac64b8e77

SHA256
291d475057df087a09ba2d42a1977a51f2a5551dc11a60998ff3f66a2e435dcb

SHA512
df42df0b53e37400bb0445f721963515d137087b2e71ddd16f249b68e337793d6b675f404683ed8a38e4856500bbfbb38d82a8c69964bb4bfd231ab9f1e55265

Download Submit
C:\Windows\System\FxoIUwn.exe

Filesize
1.9MB

MD5
2d87cfb73efbb656123f0e961c5cfaa9

SHA1
f3fd84b8a917a07292b996b1f961fecbec3e4fd0

SHA256
daf8be72eb91c228d06bf445d23e90539e8bef403ef53e18545ae13f003ec3a8

SHA512
bc3410dd972f30440730d7608ce5a18b90f10e02a94849f5c7ee46aa43a700fd01ee7e37cf01c7b404f11693eabfd239e0f3bb678b7f0692bc4175ab69eadf22

Download Submit
C:\Windows\System\GsMxtDZ.exe

Filesize
1.9MB

MD5
514cf65f7a82ef384a5bf65327a042be

SHA1
9c6f56fa92baacfae57266b13c949759d8fbb04c

SHA256
bb02d7a3b15450c1d9f3e45cd204768a0110d05fb49517b9758bc7cbfbb26791

SHA512
b7f63c83f926b5bdf30a3e99203a0b6497054a3c5fd3d5bb3212dc546829691cb45a26840bda88a001fd78db716889ca9439c46041135a52d2b53c725628f130

Download Submit
C:\Windows\System\HSMfxnW.exe

Filesize
1.9MB

MD5
678560df300246cc3ba85608de03f724

SHA1
4f8ebbfbd989455527850ae9e508dc4d33fc8be1

SHA256
40ad5d8ad5fad00c0de08af346d7a98cfd6da48cb3a5515d1b837a84a6337249

SHA512
cf40bb95d9d0fe21851e08c1c8a279da79b65a7c33b33a8ff55da2c940f6d53e6ba25749b3e18549ee488b5e4deff361d4b35d538ce978f2d701f652489f77b4

Download Submit
C:\Windows\System\IDxkufC.exe

Filesize
1.9MB

MD5
8273125a7823e693086295321109b903

SHA1
5ee34154563b02284b23204c767ea3765e65aff8

SHA256
1022f3a29f550d00fc4bf8321b95ef3c7845c9fac85f6f9bd37d8a9486273392

SHA512
6cc76aec56a7fc856b9334e1d03ff3837511a52ce82e44da88519774cf488ffa2679444028b64ae977762c00e88c4a293fdc5814359bcb8b2cd21f759eb20dcd

Download Submit
C:\Windows\System\MGBtzGd.exe

Filesize
1.9MB

MD5
d0028ea13ac1def5bcaf939677b47a4f

SHA1
4e9dfc09dbc9fc0a5538b665351fda47e4cd50cc

SHA256
8d42e8366037d10fc0d7780810bc92cbc3a45a17012ae0b021b07fb77699cfaf

SHA512
c330f83e95c4ecc2954f5cd5af83a540fcd2ee38324309c46bb1dfa850094d5d8dc8d0c9465f9896ce94f3947a899cdc8642949be358516d62c95f5383e4e5f0

Download Submit
C:\Windows\System\MQTguNt.exe

Filesize
1.9MB

MD5
9408d307366c8266459f5173abb440f6

SHA1
71f312b9375df2b6037dae9137788ff29d5f923e

SHA256
3e7c2e9d70ceba10d62426d11568f282afc3691a89393c8d9cc2591df43a592c

SHA512
7737b4fbc51100df37b17cfe9ec33a115c849899790bad264e1f1aaaf729a31ebe69a8c75c2b39760016b5bc7b3a75034413b88028b21fe76d1cfba51b8cf968

Download Submit
C:\Windows\System\Mcjhjql.exe

Filesize
1.9MB

MD5
1a65aa8b0b45830241332382b53a94d1

SHA1
65c4fb5f44b18240523b418d00c26d00edb46a09

SHA256
f5c97c91b068083f038d62b9d601ed0fe7980c6d32327c03a03ac41c9398d2a2

SHA512
9744fda2c4f2c832d7e3f540eae88fa18e315aed3366b052988345c7fffc721fae061c2415ca7ee98f51de130553517ec2e0bbb26db83e11d74a600856b317c1

Download Submit
C:\Windows\System\RbkxTzr.exe

Filesize
1.9MB

MD5
84efc846423685352ec3199d35da5f0d

SHA1
b9fa154815935f943ea47c32da924465bf04f08f

SHA256
ca282950e2dfc9b876f78f767149107750bc5c4c7e05afee704fe456d8f26927

SHA512
8f560f93005083e44494bd81c45ac819b124ae04b85fa75b2dca894f00c7760b90e2a981768b13cd136f8f9d9683aa1fa5e54fa979e7c390a2e64d4a6cd629c2

Download Submit
C:\Windows\System\SNusQjb.exe

Filesize
1.9MB

MD5
395dcca203b51bc68b79a0ee3b2608cf

SHA1
57abf1daaf63f028248aa897704617a8aacfa7ca

SHA256
eb50cfe95359eaf2da6572e2612a002c0d543899471c3751b86e997099817cf2

SHA512
68517844f3a102bc155d1ca0c47acbe4a7c98d868fd9177a5188c1cd1effcfd0e5a97c5b0afb972859e0a09d2534e1683c29d3e0653cd885062dedeeb37c4d80

Download Submit
C:\Windows\System\TpBWNpk.exe

Filesize
1.9MB

MD5
b34cdf279cb4d768cb0dff98fc6da4ed

SHA1
faf16bb5525a8f230b92bd1f45f6562a65832962

SHA256
01fffb2a5432275bd67c9347e3a7ed8f52cecabd300a884488cbda00677d5d76

SHA512
a25d1647a92581341bc23ff6d344673a732edea971a3666060057c09f280c08e7e3a6db84033a4d10d992c6a033e90f1c7f32172e6bb7e9ba6848c728ede7347

Download Submit
C:\Windows\System\UZEvQrv.exe

Filesize
1.9MB

MD5
af5985d06406e6164e41e52637b0aad1

SHA1
2cbe6e741669bc79c84ca3980a30a13cb29bc8fc

SHA256
3e68f1012871ba9385834930b347e4b23a36381377b581cd1a5a228eec7420ca

SHA512
37521b9d298c0a7e44efbde352f832d1971fee008c535e68ed75e1cdb97b8e220bb776ae94f90673760bb56314dcaaef699b2cd1c8b063090edf84336e92c9ef

Download Submit
C:\Windows\System\YmtGvJQ.exe

Filesize
1.9MB

MD5
417cc2e5269fcd8aec8f1f54d4352360

SHA1
a795022d25817a460a1be4d99e9c301693df766e

SHA256
ebdcc057d36bb287e09c7649545e4c5211326c2e79596ea9df1553b35b4b50d4

SHA512
bcc7171f430f2054509e18184a5f4bb27b092aca6d1f3e77f108b6420e88ecce9375a34dcf15ceea1b7497d1dfae328da5e0ec1be561fde8832fa1ea9221382a

Download Submit
C:\Windows\System\YwwYMtB.exe

Filesize
1.9MB

MD5
c1149aaa9bcb327cb822472c725f8499

SHA1
ddaffb25e8c6037ae81fc6af49de71db80c93821

SHA256
656b78eccab7ab2e688d1d93f11c07cfc8e3968a168f5af8586262b5e49d7199

SHA512
5f462fc04bb7932919d62892fa8dc5fa08f03e7bb38db9c2a20008bdc9b7500b3f3783e34dfc316e4e8fe1ee07adcf6ffa96748dcc2937a5f08ad34c49e91600

Download Submit
C:\Windows\System\aXiHvDC.exe

Filesize
1.9MB

MD5
43f553d91dbd7b502afea05597317c4b

SHA1
ac226bbe18e9a84bbb028beb84b29c04d5b2b691

SHA256
637adc50072dc395cb31d76550a338611bbfcebe518a877e92690bc312d38a09

SHA512
8ca0c49a99a6d4c6b6507324aa8388405a6482eb6b3fe8b2b8c7247feb21e8a209d11aee6819a51c216b6f97bbf7ee3c45ab9544a5c8081de5cff2e30057306b

Download Submit
C:\Windows\System\dZaWBav.exe

Filesize
1.9MB

MD5
34576166a5d069574210391290e59e94

SHA1
e2b1610010be790d1f954dcb71dc4344cb96f270

SHA256
917d95411fa78e3d92833176bf16ebe5779406459c92e40514659e5779513d30

SHA512
e8f8dd61e52d931758c09257e6114172ff904fcc2913b1e66d1365fe700157a6855bea2fec196245087cbb50d1d49819c4074f57c608921be3ddc8d1d8c19990

Download Submit
C:\Windows\System\eQMHPbB.exe

Filesize
1.9MB

MD5
ce8d59d43ec668121256ec3e14836c59

SHA1
75d8df9be974941ce743fde797ea714835b8b655

SHA256
48ce85297d102a299a4e170e89264a249d50462d89189e739ffc73d86ea58799

SHA512
5e15f1177e0336ac537fc63f8b77db01ddb8baf174df015cd145d7a7a206ccb57039eb3bc97c01c224f275416fd5103bb8ce1d1f0d115d69ff5be4b4012e9cc7

Download Submit
C:\Windows\System\fwnRSlL.exe

Filesize
1.9MB

MD5
02aa7b63f7ddb12132406e89050c901d

SHA1
fef64586aa79df69db48df7fcae140c3da15fa2e

SHA256
18ede2fca882cfee4ce94d53438e2e07ac3d4720bba9700943f5360c48e5ac13

SHA512
74fe60b63ed724e9825528809c8d3d35c76871fe47de28a1fdee9d058e2b0cef1e602980b8052286a49f5344cec982817026fdc4cd18a8e5c901c3e29054fd0e

Download Submit
C:\Windows\System\godwhwU.exe

Filesize
1.9MB

MD5
f6cccbeea3669a999fda2cdf3ca0bd94

SHA1
49e71bc66b63fbd7834e64f4bfed2c6dfac5b095

SHA256
11c1e4d70b92201d41f3bc1e5d6d13a8dc20f1744cfa367ff0f697497a007d0f

SHA512
cd63e41c9e264b273e908ca2979d6c1df61c96c7d73eeafb66a18e9d238a8e9c865d6c59ab0396e0754169ca562c50d53fe5a70e992ea4f3aa1c82f964ac6f4f

Download Submit
C:\Windows\System\hNthzuj.exe

Filesize
18B

MD5
2db9657d24129ae9a779c582ac4ba667

SHA1
2f52adf173d6b164ed58f47086a54d6c436ab1a3

SHA256
d032a9984b0b195bcf12841d87dba3b28f5043623fcda89105e1d63c47a14848

SHA512
4c2b916e44ecb31236003a07798f59710d324080900e9ea35a4d30c04909d198b0632bb20ac6b8f1a7a262f3edd4e0befe0f27e5d0db0854e043e886946b31c3

Download Submit
C:\Windows\System\khYiwfH.exe

Filesize
1.9MB

MD5
49fd57bbb40726a6c4d622db7dfc0f0c

SHA1
28ce636e004fb49b6cdbcfc655c8ab744863665e

SHA256
9d95af18f95b9feff2cbcb0db10279cd3ab7c4db7728b0a39acb509dd20eb329

SHA512
a242b169e5868e91303ed864a0239e225e588fcf882c5ebb18ae2dfee09e2d01ed87f4c5cfc57ddcdc3757c77394532abd8eb57dda63e971bdef8cebadf61167

Download Submit
C:\Windows\System\lmvUzpE.exe

Filesize
1.9MB

MD5
245c4dd8d410672eba816c4ddf6f479c

SHA1
ae2d5a7175fabcfa0dc09c99ab7204e311db647f

SHA256
3e65d185af2fd2dd7732664c399753edc14a02e5d9215687bbce728490a602f8

SHA512
1d2acb16d5d1ebee3e93830db1ffc08bdcca0b4280aca229eb101b4ffe3c9a9bb86b55fbf010b26eb6f13032aab3382c5576c6bde8b5a08e77dace264175fe94

Download Submit
C:\Windows\System\nKeHbBr.exe

Filesize
1.9MB

MD5
d744e7b1ca6b8e7ec25f9df27e444e30

SHA1
123fa61cea199697461f45415c2f9c84eaeb840c

SHA256
ba3d783094e5631af4307f9961ee9b5217bb51554c6ca0a1ce4979c15a33c87e

SHA512
1daf15b745bb130c882c86bbcba52557c9a0998cf1edd7bce0e6fe1445a79aceba14ea236678bfdbc042656b1caee9ff0dd25132a007ed3c4f4f31b122593dde

Download Submit
C:\Windows\System\pLPNgwi.exe

Filesize
1.9MB

MD5
cae7fb31bd3e5360b48e51ba26cb9943

SHA1
64eb6dd7c94b552054bb862cafb24bb774f212a2

SHA256
42785701dacd472235308972abcaf7f0669e46cf93a4186e1cf2eb0b91020c10

SHA512
bdfd42256f53954084421fccf9757f013f7215679ba669bb015bf2c63e4d6d1aa0949142df7356585e7380985a17d106fa8d11907960901fb0741bbcc81aa2cb

Download Submit
C:\Windows\System\rWaKXaR.exe

Filesize
1.9MB

MD5
17ffb49b074886e8eb1fe8a523eaaacb

SHA1
7337f59f1b14887325c09ed5e155828f310c5e44

SHA256
317e26df40d0c7c428b71d1927e809012e814c667e9d60f91b1a8fe98a0145a6

SHA512
833ef506e456b630186164a07fcb7bb5dcdaee30b67c058da05321334b8243fabb829b5af141615b8364a66bfe419d49e5a122f737cd1cf1147968e7636f96db

Download Submit
C:\Windows\System\rXrTKlP.exe

Filesize
1.9MB

MD5
39f3f5b3163d7ea9ba9fb36888281631

SHA1
63e26cb11a1d603a0c7d490bdd0088c42361a491

SHA256
8fc3a50bc27013c623e482a8221c568368799e56cff09798f9f596c5ece023fa

SHA512
88aa54e86036501bd88de70a9d7d5a53ff78f907b165fc96265328d2df0fe2210ac9b596b8f0ededec0489148800aa7205aa21c6b2c1ea582c3ee924d08ff4dc

Download Submit
C:\Windows\System\sWpKISf.exe

Filesize
1.9MB

MD5
d0b11969c70957ba5e43668a35cd1934

SHA1
2195bc42fe7e618c5082b2be72a8c4d1ef680189

SHA256
0bc882f4c651eb20ddf1042ec40e5d13db73fd68c366464198f0c5306e9fb37d

SHA512
895c9ad09c6864284380010ff2be7bba730e82b70c82f9eb4d139a92791e460efd7cbb351d1836030e0d9d495613504444d7c05a3f84cd063f16ec11fe17d4b9

Download Submit
C:\Windows\System\wNLoGJU.exe

Filesize
1.9MB

MD5
f647bc498cee25d1220dcaca79aab1c3

SHA1
07b947b9bde1a81f28a006a06b496618b409a28a

SHA256
74c035b7c93ac059a02f935c3bebbdb22ec0c7a1def731870f48e43abf932a4e

SHA512
ab8da4ddba12394aa36ee4224c6c3a6cc3ef25c7675c7ea717479c0189b0b2109385e072b9f1d4f3bfd2d0b17c5e2592deedecba7648e52c37ee9d2857d576a2

Download Submit
C:\Windows\System\xKfQSYw.exe

Filesize
1.9MB

MD5
2ad81292a73c3e2d85314057b132cfcd

SHA1
6d22dd68b87108ad35cbeff013da6f84d85ccc06

SHA256
735af03a9bcd7c26476721a1da105b5b7d7dc12e3e02e0be09c4b2b56cc19331

SHA512
2d2ea88474620d0ea7be50937836afd7df63e60b8cfef631b7a330e4a5b8a1459dbc7599a8f0fdd6c09d2f0231aa8c5c6e6f7a456b0c4ccc37aca67c9d8d7cce

Download Submit
C:\Windows\System\xQZuCIV.exe

Filesize
1.9MB

MD5
25abf936a942762c68067fbad33b163f

SHA1
a1de09166c96e301b0f8d15ee0dbc7568eda28c3

SHA256
aefec59fd133db9c158021101a79ab77cf0ed5dfbb4d6748512ffe0489debfe6

SHA512
b400b37f79aa69e80a14e63c22ba9c2b5b106506752d89caec1b5a46b372022eb898bd4895583b72369b290d503d9568876908e4a3ee06b43bbeeee9930c8e0f

Download Submit
memory/400-2191-0x00007FFE0AE13000-0x00007FFE0AE15000-memory.dmp

Filesize
8KB

Download
memory/400-2190-0x00007FFE0AE10000-0x00007FFE0B8D1000-memory.dmp

Filesize
10.8MB

Download
memory/400-7-0x00007FFE0AE13000-0x00007FFE0AE15000-memory.dmp

Filesize
8KB

Download
memory/400-130-0x0000021B6BBF0000-0x0000021B6C396000-memory.dmp

Filesize
7.6MB

Download
memory/400-65-0x00007FFE0AE10000-0x00007FFE0B8D1000-memory.dmp

Filesize
10.8MB

Download
memory/400-51-0x0000021B6AF60000-0x0000021B6AF82000-memory.dmp

Filesize
136KB

Download
memory/400-16-0x00007FFE0AE10000-0x00007FFE0B8D1000-memory.dmp

Filesize
10.8MB

Download
memory/464-2197-0x00007FF7D6240000-0x00007FF7D6632000-memory.dmp

Filesize
3.9MB

Download
memory/464-320-0x00007FF7D6240000-0x00007FF7D6632000-memory.dmp

Filesize
3.9MB

Download
memory/464-6-0x00007FF7D6240000-0x00007FF7D6632000-memory.dmp

Filesize
3.9MB

Download
memory/888-119-0x00007FF74F8F0000-0x00007FF74FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/888-2253-0x00007FF74F8F0000-0x00007FF74FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/888-2285-0x00007FF74F8F0000-0x00007FF74FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-2259-0x00007FF69E3D0000-0x00007FF69E7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-50-0x00007FF69E3D0000-0x00007FF69E7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-323-0x00007FF69E3D0000-0x00007FF69E7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-2264-0x00007FF63EB50000-0x00007FF63EF42000-memory.dmp

Filesize
3.9MB

Download
memory/1460-81-0x00007FF63EB50000-0x00007FF63EF42000-memory.dmp

Filesize
3.9MB

Download
memory/2088-356-0x00007FF687FD0000-0x00007FF6883C2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2282-0x00007FF6815E0000-0x00007FF6819D2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-112-0x00007FF6815E0000-0x00007FF6819D2000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2192-0x00007FF6815E0000-0x00007FF6819D2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-2270-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp

Filesize
3.9MB

Download
memory/2752-117-0x00007FF70A7A0000-0x00007FF70AB92000-memory.dmp

Filesize
3.9MB

Download
memory/2756-35-0x00007FF637CE0000-0x00007FF6380D2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-2215-0x00007FF637CE0000-0x00007FF6380D2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-384-0x00007FF740180000-0x00007FF740572000-memory.dmp

Filesize
3.9MB

Download
memory/2776-3165-0x00007FF740180000-0x00007FF740572000-memory.dmp

Filesize
3.9MB

Download
memory/2780-347-0x00007FF7427C0000-0x00007FF742BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-2278-0x00007FF602BE0000-0x00007FF602FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-2193-0x00007FF602BE0000-0x00007FF602FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-113-0x00007FF602BE0000-0x00007FF602FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-74-0x00007FF722450000-0x00007FF722842000-memory.dmp

Filesize
3.9MB

Download
memory/2864-2235-0x00007FF722450000-0x00007FF722842000-memory.dmp

Filesize
3.9MB

Download
memory/2908-118-0x00007FF6A1010000-0x00007FF6A1402000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2275-0x00007FF6A1010000-0x00007FF6A1402000-memory.dmp

Filesize
3.9MB

Download
memory/3012-2187-0x00007FF748BE0000-0x00007FF748FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-1-0x00000235F7220000-0x00000235F7230000-memory.dmp

Filesize
64KB

Download
memory/3012-318-0x00007FF748BE0000-0x00007FF748FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-0-0x00007FF748BE0000-0x00007FF748FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3044-381-0x00007FF7111A0000-0x00007FF711592000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2194-0x00007FF7F3DD0000-0x00007FF7F41C2000-memory.dmp

Filesize
3.9MB

Download
memory/3116-2280-0x00007FF7F3DD0000-0x00007FF7F41C2000-memory.dmp

Filesize
3.9MB

Download
memory/3116-114-0x00007FF7F3DD0000-0x00007FF7F41C2000-memory.dmp

Filesize
3.9MB

Download
memory/3384-80-0x00007FF6EB910000-0x00007FF6EBD02000-memory.dmp

Filesize
3.9MB

Download
memory/3384-2260-0x00007FF6EB910000-0x00007FF6EBD02000-memory.dmp

Filesize
3.9MB

Download
memory/3636-2256-0x00007FF6F4A80000-0x00007FF6F4E72000-memory.dmp

Filesize
3.9MB

Download
memory/3636-368-0x00007FF6F4A80000-0x00007FF6F4E72000-memory.dmp

Filesize
3.9MB

Download
memory/3644-2266-0x00007FF7148B0000-0x00007FF714CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3644-103-0x00007FF7148B0000-0x00007FF714CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-41-0x00007FF63D330000-0x00007FF63D722000-memory.dmp

Filesize
3.9MB

Download
memory/3964-325-0x00007FF63D330000-0x00007FF63D722000-memory.dmp

Filesize
3.9MB

Download
memory/3964-2243-0x00007FF63D330000-0x00007FF63D722000-memory.dmp

Filesize
3.9MB

Download
memory/4244-115-0x00007FF66B270000-0x00007FF66B662000-memory.dmp

Filesize
3.9MB

Download
memory/4244-2195-0x00007FF66B270000-0x00007FF66B662000-memory.dmp

Filesize
3.9MB

Download
memory/4244-2274-0x00007FF66B270000-0x00007FF66B662000-memory.dmp

Filesize
3.9MB

Download
memory/4524-111-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp

Filesize
3.9MB

Download
memory/4524-2268-0x00007FF6DAFF0000-0x00007FF6DB3E2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-321-0x00007FF7041D0000-0x00007FF7045C2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-2200-0x00007FF7041D0000-0x00007FF7045C2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-23-0x00007FF7041D0000-0x00007FF7045C2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-2217-0x00007FF6D8D10000-0x00007FF6D9102000-memory.dmp

Filesize
3.9MB

Download
memory/4888-73-0x00007FF6D8D10000-0x00007FF6D9102000-memory.dmp

Filesize
3.9MB

Download
memory/4916-2262-0x00007FF743370000-0x00007FF743762000-memory.dmp

Filesize
3.9MB

Download
memory/4916-116-0x00007FF743370000-0x00007FF743762000-memory.dmp

Filesize
3.9MB

Download