xmrig | 9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b

Analysis

max time kernel
82s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
Size

1.4MB
MD5

bbd24a22d4645ef1c45cb627a0712190
SHA1

519eb21743e87dbae3d978bb862b117c9559864e
SHA256

9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b
SHA512

c7c6ce2ba701375f812716dd47ce633a3559ede3da002829ef61a3a2ea851f662a747bbd8efdce32da267df748a2425782a735c1c3e185e91eafd12b1b679415
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRJpsHEm7qUutk:Lz071uv4BPMkHC0IlnASEx/RHpK7/

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/2264-91-0x00007FF606EE0000-0x00007FF6072D2000-memory.dmp	xmrig
behavioral2/memory/5036-87-0x00007FF7F5100000-0x00007FF7F54F2000-memory.dmp	xmrig
behavioral2/memory/4164-341-0x00007FF619610000-0x00007FF619A02000-memory.dmp	xmrig
behavioral2/memory/4692-339-0x00007FF7E8510000-0x00007FF7E8902000-memory.dmp	xmrig
behavioral2/memory/3900-342-0x00007FF7F1860000-0x00007FF7F1C52000-memory.dmp	xmrig
behavioral2/memory/4008-343-0x00007FF7A0EE0000-0x00007FF7A12D2000-memory.dmp	xmrig
behavioral2/memory/4332-344-0x00007FF6490C0000-0x00007FF6494B2000-memory.dmp	xmrig
behavioral2/memory/748-351-0x00007FF719F80000-0x00007FF71A372000-memory.dmp	xmrig
behavioral2/memory/5012-357-0x00007FF7931A0000-0x00007FF793592000-memory.dmp	xmrig
behavioral2/memory/4468-372-0x00007FF6F9E80000-0x00007FF6FA272000-memory.dmp	xmrig
behavioral2/memory/740-382-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp	xmrig
behavioral2/memory/1396-403-0x00007FF72A2E0000-0x00007FF72A6D2000-memory.dmp	xmrig
behavioral2/memory/1628-380-0x00007FF7F0780000-0x00007FF7F0B72000-memory.dmp	xmrig
behavioral2/memory/3640-363-0x00007FF739EE0000-0x00007FF73A2D2000-memory.dmp	xmrig
behavioral2/memory/4924-360-0x00007FF7FB7A0000-0x00007FF7FBB92000-memory.dmp	xmrig
behavioral2/memory/3704-355-0x00007FF75F620000-0x00007FF75FA12000-memory.dmp	xmrig
behavioral2/memory/5052-102-0x00007FF7335B0000-0x00007FF7339A2000-memory.dmp	xmrig
behavioral2/memory/2908-97-0x00007FF685BA0000-0x00007FF685F92000-memory.dmp	xmrig
behavioral2/memory/1204-83-0x00007FF62F0A0000-0x00007FF62F492000-memory.dmp	xmrig
behavioral2/memory/4420-80-0x00007FF699DD0000-0x00007FF69A1C2000-memory.dmp	xmrig
behavioral2/memory/864-74-0x00007FF7D2870000-0x00007FF7D2C62000-memory.dmp	xmrig
behavioral2/memory/2480-64-0x00007FF7EB230000-0x00007FF7EB622000-memory.dmp	xmrig
behavioral2/memory/1384-58-0x00007FF62D690000-0x00007FF62DA82000-memory.dmp	xmrig
behavioral2/memory/4692-2572-0x00007FF7E8510000-0x00007FF7E8902000-memory.dmp	xmrig
behavioral2/memory/5036-2580-0x00007FF7F5100000-0x00007FF7F54F2000-memory.dmp	xmrig
behavioral2/memory/4924-2589-0x00007FF7FB7A0000-0x00007FF7FBB92000-memory.dmp	xmrig
behavioral2/memory/4468-2591-0x00007FF6F9E80000-0x00007FF6FA272000-memory.dmp	xmrig
behavioral2/memory/4008-2638-0x00007FF7A0EE0000-0x00007FF7A12D2000-memory.dmp	xmrig
behavioral2/memory/4036-2700-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp	xmrig
behavioral2/memory/740-2696-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp	xmrig
behavioral2/memory/3640-2681-0x00007FF739EE0000-0x00007FF73A2D2000-memory.dmp	xmrig
behavioral2/memory/4164-2680-0x00007FF619610000-0x00007FF619A02000-memory.dmp	xmrig
behavioral2/memory/748-2677-0x00007FF719F80000-0x00007FF71A372000-memory.dmp	xmrig
behavioral2/memory/5012-2671-0x00007FF7931A0000-0x00007FF793592000-memory.dmp	xmrig
behavioral2/memory/2264-2670-0x00007FF606EE0000-0x00007FF6072D2000-memory.dmp	xmrig
behavioral2/memory/1628-2668-0x00007FF7F0780000-0x00007FF7F0B72000-memory.dmp	xmrig
behavioral2/memory/4332-2667-0x00007FF6490C0000-0x00007FF6494B2000-memory.dmp	xmrig
behavioral2/memory/3704-2679-0x00007FF75F620000-0x00007FF75FA12000-memory.dmp	xmrig
behavioral2/memory/1396-2672-0x00007FF72A2E0000-0x00007FF72A6D2000-memory.dmp	xmrig
behavioral2/memory/3900-2637-0x00007FF7F1860000-0x00007FF7F1C52000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	3220	powershell.exe
9	3220	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3220	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2908	aysjbMT.exe
1384	iNEzXmS.exe
2480	cXwcRxq.exe
864	BmGtTfN.exe
5052	JnUPbgt.exe
4420	ZLUtvKB.exe
1204	KSiiKLA.exe
5036	XvosbRr.exe
4692	MbmfEWN.exe
2264	WhnMGiI.exe
4164	ekTVWVb.exe
3900	dHLOHgh.exe
4008	ZBgTsmq.exe
4036	BqUWSiK.exe
4332	LwUzfEU.exe
1396	REDKauv.exe
748	YwptNyk.exe
3704	uECwNle.exe
5012	pnSOKwZ.exe
4924	ExnKxMN.exe
3640	fTCHvxb.exe
4468	wjanGlp.exe
1628	LxQtMWK.exe
740	fwKOntG.exe
2088	YvKssLX.exe
3332	GWDfvPl.exe
3364	GGcKrVg.exe
1956	STmcnan.exe
4412	CaZwEGe.exe
4416	ZVLMFMH.exe
676	ijqIMXu.exe
5096	SrYVxud.exe
4112	tOokGBK.exe
5004	ObmmBnM.exe
3528	aCKcYCM.exe
452	WfkJCjn.exe
4312	ROlIQsY.exe
1800	muRGvka.exe
4904	AormROv.exe
3992	xdbLSYn.exe
3356	bdUkeWB.exe
4636	QRjelyE.exe
836	XXSsDTl.exe
1744	EZrpdUL.exe
4908	vtwnSTR.exe
4476	yassokQ.exe
3548	MXaVWsi.exe
3300	aXhgQfy.exe
1788	FVXQCbX.exe
5044	iJFbzXm.exe
1188	NSrnlkW.exe
5128	DBqIZoS.exe
5160	unkajts.exe
5188	ekvjWXn.exe
5220	LriRAzu.exe
5256	iKeVqyV.exe
5292	SUTOcCT.exe
5316	fuuKdNJ.exe
5332	ZhequVj.exe
5360	rTJzAah.exe
5388	fhWFNxH.exe
5412	gBjnXAP.exe
5472	bUMSMmh.exe
5500	kHptvLR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3488-0-0x00007FF6176E0000-0x00007FF617AD2000-memory.dmp	upx
behavioral2/files/0x000900000002326d-6.dat	upx
behavioral2/files/0x0008000000023273-10.dat	upx
behavioral2/files/0x0007000000023274-9.dat	upx
behavioral2/files/0x0008000000023271-39.dat	upx
behavioral2/files/0x0007000000023278-49.dat	upx
behavioral2/files/0x0008000000023276-44.dat	upx
behavioral2/files/0x0007000000023279-59.dat	upx
behavioral2/files/0x000700000002327a-62.dat	upx
behavioral2/files/0x000700000002327b-68.dat	upx
behavioral2/files/0x000700000002327e-86.dat	upx
behavioral2/memory/2264-91-0x00007FF606EE0000-0x00007FF6072D2000-memory.dmp	upx
behavioral2/files/0x000700000002327f-92.dat	upx
behavioral2/memory/5036-87-0x00007FF7F5100000-0x00007FF7F54F2000-memory.dmp	upx
behavioral2/files/0x0007000000023281-108.dat	upx
behavioral2/files/0x0007000000023282-114.dat	upx
behavioral2/files/0x0007000000023283-122.dat	upx
behavioral2/files/0x0007000000023285-129.dat	upx
behavioral2/files/0x0007000000023286-135.dat	upx
behavioral2/files/0x0007000000023288-142.dat	upx
behavioral2/files/0x000700000002328a-152.dat	upx
behavioral2/files/0x000700000002328d-169.dat	upx
behavioral2/memory/4164-341-0x00007FF619610000-0x00007FF619A02000-memory.dmp	upx
behavioral2/memory/4692-339-0x00007FF7E8510000-0x00007FF7E8902000-memory.dmp	upx
behavioral2/memory/3900-342-0x00007FF7F1860000-0x00007FF7F1C52000-memory.dmp	upx
behavioral2/memory/4008-343-0x00007FF7A0EE0000-0x00007FF7A12D2000-memory.dmp	upx
behavioral2/files/0x0007000000023291-187.dat	upx
behavioral2/files/0x000700000002328f-185.dat	upx
behavioral2/files/0x0007000000023290-182.dat	upx
behavioral2/files/0x000700000002328e-180.dat	upx
behavioral2/memory/4332-344-0x00007FF6490C0000-0x00007FF6494B2000-memory.dmp	upx
behavioral2/files/0x000700000002328c-167.dat	upx
behavioral2/files/0x000700000002328b-163.dat	upx
behavioral2/memory/748-351-0x00007FF719F80000-0x00007FF71A372000-memory.dmp	upx
behavioral2/memory/5012-357-0x00007FF7931A0000-0x00007FF793592000-memory.dmp	upx
behavioral2/memory/4468-372-0x00007FF6F9E80000-0x00007FF6FA272000-memory.dmp	upx
behavioral2/memory/740-382-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp	upx
behavioral2/memory/1396-403-0x00007FF72A2E0000-0x00007FF72A6D2000-memory.dmp	upx
behavioral2/memory/1628-380-0x00007FF7F0780000-0x00007FF7F0B72000-memory.dmp	upx
behavioral2/memory/3640-363-0x00007FF739EE0000-0x00007FF73A2D2000-memory.dmp	upx
behavioral2/memory/4924-360-0x00007FF7FB7A0000-0x00007FF7FBB92000-memory.dmp	upx
behavioral2/memory/3704-355-0x00007FF75F620000-0x00007FF75FA12000-memory.dmp	upx
behavioral2/files/0x0007000000023289-153.dat	upx
behavioral2/files/0x0007000000023287-145.dat	upx
behavioral2/files/0x0007000000023284-125.dat	upx
behavioral2/files/0x0007000000023280-112.dat	upx
behavioral2/memory/5052-102-0x00007FF7335B0000-0x00007FF7339A2000-memory.dmp	upx
behavioral2/memory/2908-97-0x00007FF685BA0000-0x00007FF685F92000-memory.dmp	upx
behavioral2/files/0x000700000002327d-94.dat	upx
behavioral2/memory/4036-93-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp	upx
behavioral2/memory/1204-83-0x00007FF62F0A0000-0x00007FF62F492000-memory.dmp	upx
behavioral2/files/0x000700000002327c-84.dat	upx
behavioral2/memory/4420-80-0x00007FF699DD0000-0x00007FF69A1C2000-memory.dmp	upx
behavioral2/memory/864-74-0x00007FF7D2870000-0x00007FF7D2C62000-memory.dmp	upx
behavioral2/memory/2480-64-0x00007FF7EB230000-0x00007FF7EB622000-memory.dmp	upx
behavioral2/memory/1384-58-0x00007FF62D690000-0x00007FF62DA82000-memory.dmp	upx
behavioral2/files/0x0007000000023277-52.dat	upx
behavioral2/files/0x0008000000023275-33.dat	upx
behavioral2/memory/4692-2572-0x00007FF7E8510000-0x00007FF7E8902000-memory.dmp	upx
behavioral2/memory/5036-2580-0x00007FF7F5100000-0x00007FF7F54F2000-memory.dmp	upx
behavioral2/memory/4924-2589-0x00007FF7FB7A0000-0x00007FF7FBB92000-memory.dmp	upx
behavioral2/memory/4468-2591-0x00007FF6F9E80000-0x00007FF6FA272000-memory.dmp	upx
behavioral2/memory/4008-2638-0x00007FF7A0EE0000-0x00007FF7A12D2000-memory.dmp	upx
behavioral2/memory/4036-2700-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CVXLxFb.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\OOCNauF.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\UiRVpdm.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\VowKwRZ.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\MSHjWZz.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\GScjBUS.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\BtKcVjT.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\LsBgkPQ.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\udEnlyE.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\soatLyf.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\TYTJtnV.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\oFdRnxN.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\eBHuHqk.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\EEPzhQE.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\zoXVnGp.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\wyHLTNt.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\zNluleu.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\lRNzgVz.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\KjhifmD.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\nyTnjuz.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\MVOpmDw.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\xWHFcjn.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\dPnMhLA.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\ldJOWSj.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\UfEBJjS.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\rTJzAah.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\VQFnBAp.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\muRGvka.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\BEIvrjS.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\ETPnNKr.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\TXjpvgh.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\facPWcp.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\brbRYEV.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\fTCHvxb.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\Nfpbjkd.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\TNPfuvm.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\zptbmiy.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\IilYrbD.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\MbzoafM.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\FXtIjNj.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\SmKieKg.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\VRzzcqS.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\roMlNSL.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\PGFAoKb.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\OWQhVlu.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\ojHGtdB.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\TOBINzx.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\AwCgEUU.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\thtYGnh.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\WPcpJNO.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\RCEeuRo.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\qNovgLh.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\uDwDbbK.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\hdZcXAN.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\iaDbgaN.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\KVyfXkH.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\ugWqEcv.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\hclFwjw.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\SWDdjYl.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\NhEfcJb.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\DeyQJMz.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\JPyLraG.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\nWjiwBh.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\XiRoVrd.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3220	powershell.exe
3220	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeLockMemoryPrivilege	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3220	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	92
PID 3488 wrote to memory of 3220	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	92
PID 3488 wrote to memory of 2908	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	93
PID 3488 wrote to memory of 2908	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	93
PID 3488 wrote to memory of 1384	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	94
PID 3488 wrote to memory of 1384	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	94
PID 3488 wrote to memory of 2480	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	95
PID 3488 wrote to memory of 2480	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	95
PID 3488 wrote to memory of 864	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	96
PID 3488 wrote to memory of 864	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	96
PID 3488 wrote to memory of 5052	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	97
PID 3488 wrote to memory of 5052	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	97
PID 3488 wrote to memory of 4420	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	98
PID 3488 wrote to memory of 4420	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	98
PID 3488 wrote to memory of 1204	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	99
PID 3488 wrote to memory of 1204	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	99
PID 3488 wrote to memory of 5036	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	100
PID 3488 wrote to memory of 5036	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	100
PID 3488 wrote to memory of 4692	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	101
PID 3488 wrote to memory of 4692	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	101
PID 3488 wrote to memory of 2264	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	102
PID 3488 wrote to memory of 2264	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	102
PID 3488 wrote to memory of 4164	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	103
PID 3488 wrote to memory of 4164	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	103
PID 3488 wrote to memory of 3900	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	104
PID 3488 wrote to memory of 3900	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	104
PID 3488 wrote to memory of 4008	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	105
PID 3488 wrote to memory of 4008	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	105
PID 3488 wrote to memory of 4036	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	106
PID 3488 wrote to memory of 4036	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	106
PID 3488 wrote to memory of 4332	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	107
PID 3488 wrote to memory of 4332	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	107
PID 3488 wrote to memory of 748	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	108
PID 3488 wrote to memory of 748	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	108
PID 3488 wrote to memory of 1396	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	109
PID 3488 wrote to memory of 1396	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	109
PID 3488 wrote to memory of 3704	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	110
PID 3488 wrote to memory of 3704	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	110
PID 3488 wrote to memory of 5012	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	111
PID 3488 wrote to memory of 5012	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	111
PID 3488 wrote to memory of 4924	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	112
PID 3488 wrote to memory of 4924	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	112
PID 3488 wrote to memory of 3640	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	113
PID 3488 wrote to memory of 3640	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	113
PID 3488 wrote to memory of 4468	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	114
PID 3488 wrote to memory of 4468	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	114
PID 3488 wrote to memory of 1628	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	115
PID 3488 wrote to memory of 1628	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	115
PID 3488 wrote to memory of 740	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	116
PID 3488 wrote to memory of 740	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	116
PID 3488 wrote to memory of 2088	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	117
PID 3488 wrote to memory of 2088	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	117
PID 3488 wrote to memory of 3332	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	118
PID 3488 wrote to memory of 3332	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	118
PID 3488 wrote to memory of 3364	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	119
PID 3488 wrote to memory of 3364	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	119
PID 3488 wrote to memory of 1956	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	120
PID 3488 wrote to memory of 1956	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	120
PID 3488 wrote to memory of 4412	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	121
PID 3488 wrote to memory of 4412	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	121
PID 3488 wrote to memory of 4416	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	122
PID 3488 wrote to memory of 4416	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	122
PID 3488 wrote to memory of 676	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	123
PID 3488 wrote to memory of 676	3488	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3220
- C:\Windows\System\aysjbMT.exe
  C:\Windows\System\aysjbMT.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\iNEzXmS.exe
  C:\Windows\System\iNEzXmS.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\cXwcRxq.exe
  C:\Windows\System\cXwcRxq.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\BmGtTfN.exe
  C:\Windows\System\BmGtTfN.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\JnUPbgt.exe
  C:\Windows\System\JnUPbgt.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\ZLUtvKB.exe
  C:\Windows\System\ZLUtvKB.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\KSiiKLA.exe
  C:\Windows\System\KSiiKLA.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\XvosbRr.exe
  C:\Windows\System\XvosbRr.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\MbmfEWN.exe
  C:\Windows\System\MbmfEWN.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\WhnMGiI.exe
  C:\Windows\System\WhnMGiI.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\ekTVWVb.exe
  C:\Windows\System\ekTVWVb.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\dHLOHgh.exe
  C:\Windows\System\dHLOHgh.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\ZBgTsmq.exe
  C:\Windows\System\ZBgTsmq.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\BqUWSiK.exe
  C:\Windows\System\BqUWSiK.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\LwUzfEU.exe
  C:\Windows\System\LwUzfEU.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\YwptNyk.exe
  C:\Windows\System\YwptNyk.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\REDKauv.exe
  C:\Windows\System\REDKauv.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\uECwNle.exe
  C:\Windows\System\uECwNle.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\pnSOKwZ.exe
  C:\Windows\System\pnSOKwZ.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\ExnKxMN.exe
  C:\Windows\System\ExnKxMN.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\fTCHvxb.exe
  C:\Windows\System\fTCHvxb.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\wjanGlp.exe
  C:\Windows\System\wjanGlp.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\LxQtMWK.exe
  C:\Windows\System\LxQtMWK.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\fwKOntG.exe
  C:\Windows\System\fwKOntG.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\YvKssLX.exe
  C:\Windows\System\YvKssLX.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\GWDfvPl.exe
  C:\Windows\System\GWDfvPl.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\GGcKrVg.exe
  C:\Windows\System\GGcKrVg.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\STmcnan.exe
  C:\Windows\System\STmcnan.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\CaZwEGe.exe
  C:\Windows\System\CaZwEGe.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\ZVLMFMH.exe
  C:\Windows\System\ZVLMFMH.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\ijqIMXu.exe
  C:\Windows\System\ijqIMXu.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\SrYVxud.exe
  C:\Windows\System\SrYVxud.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\tOokGBK.exe
  C:\Windows\System\tOokGBK.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\ObmmBnM.exe
  C:\Windows\System\ObmmBnM.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\aCKcYCM.exe
  C:\Windows\System\aCKcYCM.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\WfkJCjn.exe
  C:\Windows\System\WfkJCjn.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ROlIQsY.exe
  C:\Windows\System\ROlIQsY.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\muRGvka.exe
  C:\Windows\System\muRGvka.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\AormROv.exe
  C:\Windows\System\AormROv.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\xdbLSYn.exe
  C:\Windows\System\xdbLSYn.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\bdUkeWB.exe
  C:\Windows\System\bdUkeWB.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\QRjelyE.exe
  C:\Windows\System\QRjelyE.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\XXSsDTl.exe
  C:\Windows\System\XXSsDTl.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\EZrpdUL.exe
  C:\Windows\System\EZrpdUL.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\vtwnSTR.exe
  C:\Windows\System\vtwnSTR.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\yassokQ.exe
  C:\Windows\System\yassokQ.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\MXaVWsi.exe
  C:\Windows\System\MXaVWsi.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\aXhgQfy.exe
  C:\Windows\System\aXhgQfy.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\FVXQCbX.exe
  C:\Windows\System\FVXQCbX.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\iJFbzXm.exe
  C:\Windows\System\iJFbzXm.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\NSrnlkW.exe
  C:\Windows\System\NSrnlkW.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\DBqIZoS.exe
  C:\Windows\System\DBqIZoS.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\unkajts.exe
  C:\Windows\System\unkajts.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\ekvjWXn.exe
  C:\Windows\System\ekvjWXn.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\LriRAzu.exe
  C:\Windows\System\LriRAzu.exe
  2⤵
  - Executes dropped EXE
  PID:5220
- C:\Windows\System\iKeVqyV.exe
  C:\Windows\System\iKeVqyV.exe
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Windows\System\SUTOcCT.exe
  C:\Windows\System\SUTOcCT.exe
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Windows\System\fuuKdNJ.exe
  C:\Windows\System\fuuKdNJ.exe
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Windows\System\ZhequVj.exe
  C:\Windows\System\ZhequVj.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\rTJzAah.exe
  C:\Windows\System\rTJzAah.exe
  2⤵
  - Executes dropped EXE
  PID:5360
- C:\Windows\System\fhWFNxH.exe
  C:\Windows\System\fhWFNxH.exe
  2⤵
  - Executes dropped EXE
  PID:5388
- C:\Windows\System\gBjnXAP.exe
  C:\Windows\System\gBjnXAP.exe
  2⤵
  - Executes dropped EXE
  PID:5412
- C:\Windows\System\bUMSMmh.exe
  C:\Windows\System\bUMSMmh.exe
  2⤵
  - Executes dropped EXE
  PID:5472
- C:\Windows\System\kHptvLR.exe
  C:\Windows\System\kHptvLR.exe
  2⤵
  - Executes dropped EXE
  PID:5500
- C:\Windows\System\uZlzjvs.exe
  C:\Windows\System\uZlzjvs.exe
  2⤵
  PID:5524
- C:\Windows\System\IlguvYT.exe
  C:\Windows\System\IlguvYT.exe
  2⤵
  PID:5552
- C:\Windows\System\ZFctyTw.exe
  C:\Windows\System\ZFctyTw.exe
  2⤵
  PID:5572
- C:\Windows\System\WoXfirU.exe
  C:\Windows\System\WoXfirU.exe
  2⤵
  PID:5608
- C:\Windows\System\hclFwjw.exe
  C:\Windows\System\hclFwjw.exe
  2⤵
  PID:5628
- C:\Windows\System\iRYDtvK.exe
  C:\Windows\System\iRYDtvK.exe
  2⤵
  PID:5652
- C:\Windows\System\wxrjtJQ.exe
  C:\Windows\System\wxrjtJQ.exe
  2⤵
  PID:5676
- C:\Windows\System\qWfRfmQ.exe
  C:\Windows\System\qWfRfmQ.exe
  2⤵
  PID:5700
- C:\Windows\System\qFxjpuu.exe
  C:\Windows\System\qFxjpuu.exe
  2⤵
  PID:5732
- C:\Windows\System\hWjzekS.exe
  C:\Windows\System\hWjzekS.exe
  2⤵
  PID:5772
- C:\Windows\System\curojNJ.exe
  C:\Windows\System\curojNJ.exe
  2⤵
  PID:5800
- C:\Windows\System\USTsfHU.exe
  C:\Windows\System\USTsfHU.exe
  2⤵
  PID:5820
- C:\Windows\System\VowKwRZ.exe
  C:\Windows\System\VowKwRZ.exe
  2⤵
  PID:5848
- C:\Windows\System\yfazbzO.exe
  C:\Windows\System\yfazbzO.exe
  2⤵
  PID:5872
- C:\Windows\System\xxrPslF.exe
  C:\Windows\System\xxrPslF.exe
  2⤵
  PID:5904
- C:\Windows\System\aEllnWj.exe
  C:\Windows\System\aEllnWj.exe
  2⤵
  PID:5932
- C:\Windows\System\ZrGklmB.exe
  C:\Windows\System\ZrGklmB.exe
  2⤵
  PID:5960
- C:\Windows\System\ehqJipW.exe
  C:\Windows\System\ehqJipW.exe
  2⤵
  PID:5984
- C:\Windows\System\vohYuav.exe
  C:\Windows\System\vohYuav.exe
  2⤵
  PID:6012
- C:\Windows\System\nCMgsbv.exe
  C:\Windows\System\nCMgsbv.exe
  2⤵
  PID:6044
- C:\Windows\System\wgDTrJA.exe
  C:\Windows\System\wgDTrJA.exe
  2⤵
  PID:6132
- C:\Windows\System\ReAGOPK.exe
  C:\Windows\System\ReAGOPK.exe
  2⤵
  PID:3068
- C:\Windows\System\GGtqCCX.exe
  C:\Windows\System\GGtqCCX.exe
  2⤵
  PID:3408
- C:\Windows\System\FEdtAMZ.exe
  C:\Windows\System\FEdtAMZ.exe
  2⤵
  PID:5148
- C:\Windows\System\mHEPYJK.exe
  C:\Windows\System\mHEPYJK.exe
  2⤵
  PID:5180
- C:\Windows\System\MBgxRXb.exe
  C:\Windows\System\MBgxRXb.exe
  2⤵
  PID:5232
- C:\Windows\System\XiRoVrd.exe
  C:\Windows\System\XiRoVrd.exe
  2⤵
  PID:5276
- C:\Windows\System\NnVdGLA.exe
  C:\Windows\System\NnVdGLA.exe
  2⤵
  PID:4884
- C:\Windows\System\siRNQvo.exe
  C:\Windows\System\siRNQvo.exe
  2⤵
  PID:5348
- C:\Windows\System\wUzreHx.exe
  C:\Windows\System\wUzreHx.exe
  2⤵
  PID:5380
- C:\Windows\System\PNTSZVc.exe
  C:\Windows\System\PNTSZVc.exe
  2⤵
  PID:4336
- C:\Windows\System\uDwDbbK.exe
  C:\Windows\System\uDwDbbK.exe
  2⤵
  PID:5564
- C:\Windows\System\WwPWlgy.exe
  C:\Windows\System\WwPWlgy.exe
  2⤵
  PID:5664
- C:\Windows\System\qTJrcuh.exe
  C:\Windows\System\qTJrcuh.exe
  2⤵
  PID:5692
- C:\Windows\System\qdSIJlF.exe
  C:\Windows\System\qdSIJlF.exe
  2⤵
  PID:5744
- C:\Windows\System\dATpEoh.exe
  C:\Windows\System\dATpEoh.exe
  2⤵
  PID:2832
- C:\Windows\System\eljffDO.exe
  C:\Windows\System\eljffDO.exe
  2⤵
  PID:3448
- C:\Windows\System\JwTOXFG.exe
  C:\Windows\System\JwTOXFG.exe
  2⤵
  PID:5888
- C:\Windows\System\mJgwBeQ.exe
  C:\Windows\System\mJgwBeQ.exe
  2⤵
  PID:3816
- C:\Windows\System\bkdfmbY.exe
  C:\Windows\System\bkdfmbY.exe
  2⤵
  PID:5952
- C:\Windows\System\YMkkLEH.exe
  C:\Windows\System\YMkkLEH.exe
  2⤵
  PID:3520
- C:\Windows\System\khnqPrE.exe
  C:\Windows\System\khnqPrE.exe
  2⤵
  PID:2616
- C:\Windows\System\BnjwFKd.exe
  C:\Windows\System\BnjwFKd.exe
  2⤵
  PID:4404
- C:\Windows\System\JVfHpBj.exe
  C:\Windows\System\JVfHpBj.exe
  2⤵
  PID:2968
- C:\Windows\System\lAbBJAX.exe
  C:\Windows\System\lAbBJAX.exe
  2⤵
  PID:2128
- C:\Windows\System\TYiICvN.exe
  C:\Windows\System\TYiICvN.exe
  2⤵
  PID:6120
- C:\Windows\System\zTKXKxz.exe
  C:\Windows\System\zTKXKxz.exe
  2⤵
  PID:5252
- C:\Windows\System\oNSRPav.exe
  C:\Windows\System\oNSRPav.exe
  2⤵
  PID:5548
- C:\Windows\System\iMwcLnA.exe
  C:\Windows\System\iMwcLnA.exe
  2⤵
  PID:4064
- C:\Windows\System\FjsbjRK.exe
  C:\Windows\System\FjsbjRK.exe
  2⤵
  PID:5596
- C:\Windows\System\dVZLpjw.exe
  C:\Windows\System\dVZLpjw.exe
  2⤵
  PID:5684
- C:\Windows\System\TRVTroa.exe
  C:\Windows\System\TRVTroa.exe
  2⤵
  PID:5924
- C:\Windows\System\tqiGpkr.exe
  C:\Windows\System\tqiGpkr.exe
  2⤵
  PID:5864
- C:\Windows\System\tOzJQRT.exe
  C:\Windows\System\tOzJQRT.exe
  2⤵
  PID:6084
- C:\Windows\System\RuqBilQ.exe
  C:\Windows\System\RuqBilQ.exe
  2⤵
  PID:5100
- C:\Windows\System\SyUjOOE.exe
  C:\Windows\System\SyUjOOE.exe
  2⤵
  PID:752
- C:\Windows\System\cQRsEqL.exe
  C:\Windows\System\cQRsEqL.exe
  2⤵
  PID:6124
- C:\Windows\System\NHdIgRC.exe
  C:\Windows\System\NHdIgRC.exe
  2⤵
  PID:5272
- C:\Windows\System\PnRVaLz.exe
  C:\Windows\System\PnRVaLz.exe
  2⤵
  PID:3808
- C:\Windows\System\uZjhfBX.exe
  C:\Windows\System\uZjhfBX.exe
  2⤵
  PID:5760
- C:\Windows\System\QJKtBIF.exe
  C:\Windows\System\QJKtBIF.exe
  2⤵
  PID:4948
- C:\Windows\System\mtUftZp.exe
  C:\Windows\System\mtUftZp.exe
  2⤵
  PID:6056
- C:\Windows\System\edCOnkX.exe
  C:\Windows\System\edCOnkX.exe
  2⤵
  PID:6092
- C:\Windows\System\EiBIKzs.exe
  C:\Windows\System\EiBIKzs.exe
  2⤵
  PID:5720
- C:\Windows\System\VKSHcWH.exe
  C:\Windows\System\VKSHcWH.exe
  2⤵
  PID:6104
- C:\Windows\System\XehqKJw.exe
  C:\Windows\System\XehqKJw.exe
  2⤵
  PID:6032
- C:\Windows\System\wFTUzYd.exe
  C:\Windows\System\wFTUzYd.exe
  2⤵
  PID:3280
- C:\Windows\System\iEtcyYe.exe
  C:\Windows\System\iEtcyYe.exe
  2⤵
  PID:6160
- C:\Windows\System\zxwBwhk.exe
  C:\Windows\System\zxwBwhk.exe
  2⤵
  PID:6180
- C:\Windows\System\SWDdjYl.exe
  C:\Windows\System\SWDdjYl.exe
  2⤵
  PID:6216
- C:\Windows\System\lIJJxXu.exe
  C:\Windows\System\lIJJxXu.exe
  2⤵
  PID:6236
- C:\Windows\System\HBUofuE.exe
  C:\Windows\System\HBUofuE.exe
  2⤵
  PID:6256
- C:\Windows\System\WhdXXPJ.exe
  C:\Windows\System\WhdXXPJ.exe
  2⤵
  PID:6276
- C:\Windows\System\VIxnpYp.exe
  C:\Windows\System\VIxnpYp.exe
  2⤵
  PID:6296
- C:\Windows\System\vglELzL.exe
  C:\Windows\System\vglELzL.exe
  2⤵
  PID:6348
- C:\Windows\System\ZDPfUWV.exe
  C:\Windows\System\ZDPfUWV.exe
  2⤵
  PID:6388
- C:\Windows\System\uAeWvvs.exe
  C:\Windows\System\uAeWvvs.exe
  2⤵
  PID:6412
- C:\Windows\System\vKsLGJg.exe
  C:\Windows\System\vKsLGJg.exe
  2⤵
  PID:6436
- C:\Windows\System\CABybnd.exe
  C:\Windows\System\CABybnd.exe
  2⤵
  PID:6456
- C:\Windows\System\ZonLcda.exe
  C:\Windows\System\ZonLcda.exe
  2⤵
  PID:6472
- C:\Windows\System\YllmAOo.exe
  C:\Windows\System\YllmAOo.exe
  2⤵
  PID:6508
- C:\Windows\System\bnccuTm.exe
  C:\Windows\System\bnccuTm.exe
  2⤵
  PID:6532
- C:\Windows\System\eTCbRLu.exe
  C:\Windows\System\eTCbRLu.exe
  2⤵
  PID:6548
- C:\Windows\System\lZaRBHv.exe
  C:\Windows\System\lZaRBHv.exe
  2⤵
  PID:6568
- C:\Windows\System\buqAsMZ.exe
  C:\Windows\System\buqAsMZ.exe
  2⤵
  PID:6596
- C:\Windows\System\FcCKbyK.exe
  C:\Windows\System\FcCKbyK.exe
  2⤵
  PID:6616
- C:\Windows\System\IOOGlCu.exe
  C:\Windows\System\IOOGlCu.exe
  2⤵
  PID:6632
- C:\Windows\System\IZOCQtZ.exe
  C:\Windows\System\IZOCQtZ.exe
  2⤵
  PID:6700
- C:\Windows\System\UdbGxje.exe
  C:\Windows\System\UdbGxje.exe
  2⤵
  PID:6720
- C:\Windows\System\TNcAmyt.exe
  C:\Windows\System\TNcAmyt.exe
  2⤵
  PID:6736
- C:\Windows\System\hWNknEv.exe
  C:\Windows\System\hWNknEv.exe
  2⤵
  PID:6760
- C:\Windows\System\HqoGGNe.exe
  C:\Windows\System\HqoGGNe.exe
  2⤵
  PID:6776
- C:\Windows\System\DHMQYTG.exe
  C:\Windows\System\DHMQYTG.exe
  2⤵
  PID:6812
- C:\Windows\System\RcwCcnw.exe
  C:\Windows\System\RcwCcnw.exe
  2⤵
  PID:6832
- C:\Windows\System\cRPbyEN.exe
  C:\Windows\System\cRPbyEN.exe
  2⤵
  PID:6900
- C:\Windows\System\mPmawTH.exe
  C:\Windows\System\mPmawTH.exe
  2⤵
  PID:6932
- C:\Windows\System\fYOIUos.exe
  C:\Windows\System\fYOIUos.exe
  2⤵
  PID:6992
- C:\Windows\System\gYqiTdW.exe
  C:\Windows\System\gYqiTdW.exe
  2⤵
  PID:7008
- C:\Windows\System\HJTNtkC.exe
  C:\Windows\System\HJTNtkC.exe
  2⤵
  PID:7032
- C:\Windows\System\PsXYqNO.exe
  C:\Windows\System\PsXYqNO.exe
  2⤵
  PID:7048
- C:\Windows\System\YFsEZoL.exe
  C:\Windows\System\YFsEZoL.exe
  2⤵
  PID:7112
- C:\Windows\System\fwdxlXw.exe
  C:\Windows\System\fwdxlXw.exe
  2⤵
  PID:7136
- C:\Windows\System\HRmdtLv.exe
  C:\Windows\System\HRmdtLv.exe
  2⤵
  PID:7152
- C:\Windows\System\OMBdVcA.exe
  C:\Windows\System\OMBdVcA.exe
  2⤵
  PID:6156
- C:\Windows\System\gyETebf.exe
  C:\Windows\System\gyETebf.exe
  2⤵
  PID:6172
- C:\Windows\System\sxuHzHw.exe
  C:\Windows\System\sxuHzHw.exe
  2⤵
  PID:6316
- C:\Windows\System\NYGNnnh.exe
  C:\Windows\System\NYGNnnh.exe
  2⤵
  PID:6344
- C:\Windows\System\CEjOCPF.exe
  C:\Windows\System\CEjOCPF.exe
  2⤵
  PID:6452
- C:\Windows\System\FMcNcje.exe
  C:\Windows\System\FMcNcje.exe
  2⤵
  PID:6624
- C:\Windows\System\nRsMtUU.exe
  C:\Windows\System\nRsMtUU.exe
  2⤵
  PID:6580
- C:\Windows\System\WqjoEHS.exe
  C:\Windows\System\WqjoEHS.exe
  2⤵
  PID:6716
- C:\Windows\System\YQNcyMh.exe
  C:\Windows\System\YQNcyMh.exe
  2⤵
  PID:6684
- C:\Windows\System\CdBztoi.exe
  C:\Windows\System\CdBztoi.exe
  2⤵
  PID:6752
- C:\Windows\System\lRGwioT.exe
  C:\Windows\System\lRGwioT.exe
  2⤵
  PID:6928
- C:\Windows\System\ezFpAFT.exe
  C:\Windows\System\ezFpAFT.exe
  2⤵
  PID:6772
- C:\Windows\System\zLBGykF.exe
  C:\Windows\System\zLBGykF.exe
  2⤵
  PID:6896
- C:\Windows\System\gfSlrZC.exe
  C:\Windows\System\gfSlrZC.exe
  2⤵
  PID:1984
- C:\Windows\System\iojKIIW.exe
  C:\Windows\System\iojKIIW.exe
  2⤵
  PID:7044
- C:\Windows\System\PLjtCop.exe
  C:\Windows\System\PLjtCop.exe
  2⤵
  PID:6976
- C:\Windows\System\bbQnSls.exe
  C:\Windows\System\bbQnSls.exe
  2⤵
  PID:6176
- C:\Windows\System\NoUbSnA.exe
  C:\Windows\System\NoUbSnA.exe
  2⤵
  PID:7148
- C:\Windows\System\tKJlGri.exe
  C:\Windows\System\tKJlGri.exe
  2⤵
  PID:6268
- C:\Windows\System\WmpVlTf.exe
  C:\Windows\System\WmpVlTf.exe
  2⤵
  PID:6408
- C:\Windows\System\cNWygRK.exe
  C:\Windows\System\cNWygRK.exe
  2⤵
  PID:6428
- C:\Windows\System\yuTbZIf.exe
  C:\Windows\System\yuTbZIf.exe
  2⤵
  PID:6560
- C:\Windows\System\LPxmXkq.exe
  C:\Windows\System\LPxmXkq.exe
  2⤵
  PID:4860
- C:\Windows\System\dclBSLe.exe
  C:\Windows\System\dclBSLe.exe
  2⤵
  PID:6608
- C:\Windows\System\IwUdsuE.exe
  C:\Windows\System\IwUdsuE.exe
  2⤵
  PID:6696
- C:\Windows\System\fGPamKs.exe
  C:\Windows\System\fGPamKs.exe
  2⤵
  PID:6712
- C:\Windows\System\jbdcQZN.exe
  C:\Windows\System\jbdcQZN.exe
  2⤵
  PID:7020
- C:\Windows\System\zVowqAC.exe
  C:\Windows\System\zVowqAC.exe
  2⤵
  PID:1032
- C:\Windows\System\CwOgsZd.exe
  C:\Windows\System\CwOgsZd.exe
  2⤵
  PID:464
- C:\Windows\System\GEWzAur.exe
  C:\Windows\System\GEWzAur.exe
  2⤵
  PID:7184
- C:\Windows\System\qyAaDeC.exe
  C:\Windows\System\qyAaDeC.exe
  2⤵
  PID:7208
- C:\Windows\System\aEnqiGe.exe
  C:\Windows\System\aEnqiGe.exe
  2⤵
  PID:7224
- C:\Windows\System\txPxBUJ.exe
  C:\Windows\System\txPxBUJ.exe
  2⤵
  PID:7240
- C:\Windows\System\OYZyecC.exe
  C:\Windows\System\OYZyecC.exe
  2⤵
  PID:7256
- C:\Windows\System\KfkRfDb.exe
  C:\Windows\System\KfkRfDb.exe
  2⤵
  PID:7276
- C:\Windows\System\nzqCWEl.exe
  C:\Windows\System\nzqCWEl.exe
  2⤵
  PID:7296
- C:\Windows\System\urjMhqk.exe
  C:\Windows\System\urjMhqk.exe
  2⤵
  PID:7320
- C:\Windows\System\koCYZsb.exe
  C:\Windows\System\koCYZsb.exe
  2⤵
  PID:7340
- C:\Windows\System\vceXSXQ.exe
  C:\Windows\System\vceXSXQ.exe
  2⤵
  PID:7360
- C:\Windows\System\qyQFvJD.exe
  C:\Windows\System\qyQFvJD.exe
  2⤵
  PID:7376
- C:\Windows\System\pRonkWG.exe
  C:\Windows\System\pRonkWG.exe
  2⤵
  PID:7396
- C:\Windows\System\SuwzNfu.exe
  C:\Windows\System\SuwzNfu.exe
  2⤵
  PID:7412
- C:\Windows\System\edtMIEf.exe
  C:\Windows\System\edtMIEf.exe
  2⤵
  PID:7436
- C:\Windows\System\mmabIWY.exe
  C:\Windows\System\mmabIWY.exe
  2⤵
  PID:7452
- C:\Windows\System\SXTFPTl.exe
  C:\Windows\System\SXTFPTl.exe
  2⤵
  PID:7472
- C:\Windows\System\vorPPBb.exe
  C:\Windows\System\vorPPBb.exe
  2⤵
  PID:7492
- C:\Windows\System\EpUdRBP.exe
  C:\Windows\System\EpUdRBP.exe
  2⤵
  PID:7512
- C:\Windows\System\hxTGefo.exe
  C:\Windows\System\hxTGefo.exe
  2⤵
  PID:7532
- C:\Windows\System\kKKlTJR.exe
  C:\Windows\System\kKKlTJR.exe
  2⤵
  PID:7556
- C:\Windows\System\otaUvvl.exe
  C:\Windows\System\otaUvvl.exe
  2⤵
  PID:7620
- C:\Windows\System\XGBtiEo.exe
  C:\Windows\System\XGBtiEo.exe
  2⤵
  PID:7748
- C:\Windows\System\wPPNEva.exe
  C:\Windows\System\wPPNEva.exe
  2⤵
  PID:7772
- C:\Windows\System\MInHzLz.exe
  C:\Windows\System\MInHzLz.exe
  2⤵
  PID:7788
- C:\Windows\System\ncgxfhg.exe
  C:\Windows\System\ncgxfhg.exe
  2⤵
  PID:7816
- C:\Windows\System\KMhhvgK.exe
  C:\Windows\System\KMhhvgK.exe
  2⤵
  PID:7840
- C:\Windows\System\ojgbEPb.exe
  C:\Windows\System\ojgbEPb.exe
  2⤵
  PID:7860
- C:\Windows\System\vdivjVh.exe
  C:\Windows\System\vdivjVh.exe
  2⤵
  PID:7876
- C:\Windows\System\jPddRks.exe
  C:\Windows\System\jPddRks.exe
  2⤵
  PID:7896
- C:\Windows\System\XKZDAln.exe
  C:\Windows\System\XKZDAln.exe
  2⤵
  PID:7912
- C:\Windows\System\pRzwshI.exe
  C:\Windows\System\pRzwshI.exe
  2⤵
  PID:7944
- C:\Windows\System\InXmiOA.exe
  C:\Windows\System\InXmiOA.exe
  2⤵
  PID:7960
- C:\Windows\System\cNziyTE.exe
  C:\Windows\System\cNziyTE.exe
  2⤵
  PID:7976
- C:\Windows\System\XAXsrqw.exe
  C:\Windows\System\XAXsrqw.exe
  2⤵
  PID:7996
- C:\Windows\System\jvUGrAs.exe
  C:\Windows\System\jvUGrAs.exe
  2⤵
  PID:8016
- C:\Windows\System\rFTwLvV.exe
  C:\Windows\System\rFTwLvV.exe
  2⤵
  PID:8036
- C:\Windows\System\sKsSdCh.exe
  C:\Windows\System\sKsSdCh.exe
  2⤵
  PID:8052
- C:\Windows\System\yqnxzZB.exe
  C:\Windows\System\yqnxzZB.exe
  2⤵
  PID:8072
- C:\Windows\System\lVUjILp.exe
  C:\Windows\System\lVUjILp.exe
  2⤵
  PID:8092
- C:\Windows\System\rJPPNdx.exe
  C:\Windows\System\rJPPNdx.exe
  2⤵
  PID:8108
- C:\Windows\System\ZYkCVNt.exe
  C:\Windows\System\ZYkCVNt.exe
  2⤵
  PID:8128
- C:\Windows\System\TEFsZgl.exe
  C:\Windows\System\TEFsZgl.exe
  2⤵
  PID:8148
- C:\Windows\System\gnrYqpf.exe
  C:\Windows\System\gnrYqpf.exe
  2⤵
  PID:8172
- C:\Windows\System\dvTpDVi.exe
  C:\Windows\System\dvTpDVi.exe
  2⤵
  PID:8188
- C:\Windows\System\GhOWsRb.exe
  C:\Windows\System\GhOWsRb.exe
  2⤵
  PID:6464
- C:\Windows\System\GAhDsrb.exe
  C:\Windows\System\GAhDsrb.exe
  2⤵
  PID:6272
- C:\Windows\System\AzEFqmt.exe
  C:\Windows\System\AzEFqmt.exe
  2⤵
  PID:6312
- C:\Windows\System\KEwomRr.exe
  C:\Windows\System\KEwomRr.exe
  2⤵
  PID:5452
- C:\Windows\System\hXsFLei.exe
  C:\Windows\System\hXsFLei.exe
  2⤵
  PID:7236
- C:\Windows\System\TrMDdYG.exe
  C:\Windows\System\TrMDdYG.exe
  2⤵
  PID:7328
- C:\Windows\System\MvENrDg.exe
  C:\Windows\System\MvENrDg.exe
  2⤵
  PID:7356
- C:\Windows\System\GZzZJmT.exe
  C:\Windows\System\GZzZJmT.exe
  2⤵
  PID:7220
- C:\Windows\System\llTAJdo.exe
  C:\Windows\System\llTAJdo.exe
  2⤵
  PID:7336
- C:\Windows\System\CprrMAb.exe
  C:\Windows\System\CprrMAb.exe
  2⤵
  PID:7368
- C:\Windows\System\NhEfcJb.exe
  C:\Windows\System\NhEfcJb.exe
  2⤵
  PID:7304
- C:\Windows\System\YMBmJms.exe
  C:\Windows\System\YMBmJms.exe
  2⤵
  PID:7616
- C:\Windows\System\REzyfYh.exe
  C:\Windows\System\REzyfYh.exe
  2⤵
  PID:7408
- C:\Windows\System\jchBvvQ.exe
  C:\Windows\System\jchBvvQ.exe
  2⤵
  PID:7448
- C:\Windows\System\CWsPPHY.exe
  C:\Windows\System\CWsPPHY.exe
  2⤵
  PID:7484
- C:\Windows\System\egizaLj.exe
  C:\Windows\System\egizaLj.exe
  2⤵
  PID:7528
- C:\Windows\System\VAAdNeD.exe
  C:\Windows\System\VAAdNeD.exe
  2⤵
  PID:7636
- C:\Windows\System\cZjntnX.exe
  C:\Windows\System\cZjntnX.exe
  2⤵
  PID:7780
- C:\Windows\System\gBeWBWA.exe
  C:\Windows\System\gBeWBWA.exe
  2⤵
  PID:7856
- C:\Windows\System\sicBSLH.exe
  C:\Windows\System\sicBSLH.exe
  2⤵
  PID:7904
- C:\Windows\System\uDiaqJm.exe
  C:\Windows\System\uDiaqJm.exe
  2⤵
  PID:7956
- C:\Windows\System\sJMfgJl.exe
  C:\Windows\System\sJMfgJl.exe
  2⤵
  PID:7612
- C:\Windows\System\CkhrIpY.exe
  C:\Windows\System\CkhrIpY.exe
  2⤵
  PID:8024
- C:\Windows\System\AyknrdN.exe
  C:\Windows\System\AyknrdN.exe
  2⤵
  PID:8044
- C:\Windows\System\BJtNnad.exe
  C:\Windows\System\BJtNnad.exe
  2⤵
  PID:8100
- C:\Windows\System\sCCMENm.exe
  C:\Windows\System\sCCMENm.exe
  2⤵
  PID:8124
- C:\Windows\System\cmIFobj.exe
  C:\Windows\System\cmIFobj.exe
  2⤵
  PID:8200
- C:\Windows\System\laHqwXl.exe
  C:\Windows\System\laHqwXl.exe
  2⤵
  PID:8216
- C:\Windows\System\kcVQqfK.exe
  C:\Windows\System\kcVQqfK.exe
  2⤵
  PID:8232
- C:\Windows\System\SsvbibO.exe
  C:\Windows\System\SsvbibO.exe
  2⤵
  PID:8256
- C:\Windows\System\WfKXdwA.exe
  C:\Windows\System\WfKXdwA.exe
  2⤵
  PID:8272
- C:\Windows\System\WyDhvKV.exe
  C:\Windows\System\WyDhvKV.exe
  2⤵
  PID:8296
- C:\Windows\System\TFDQyhp.exe
  C:\Windows\System\TFDQyhp.exe
  2⤵
  PID:8316
- C:\Windows\System\VoLGiIT.exe
  C:\Windows\System\VoLGiIT.exe
  2⤵
  PID:8332
- C:\Windows\System\aubipsb.exe
  C:\Windows\System\aubipsb.exe
  2⤵
  PID:8360
- C:\Windows\System\uMRyZQl.exe
  C:\Windows\System\uMRyZQl.exe
  2⤵
  PID:8376
- C:\Windows\System\AXaklsg.exe
  C:\Windows\System\AXaklsg.exe
  2⤵
  PID:8396
- C:\Windows\System\KIeUwVf.exe
  C:\Windows\System\KIeUwVf.exe
  2⤵
  PID:8412
- C:\Windows\System\COUOjxI.exe
  C:\Windows\System\COUOjxI.exe
  2⤵
  PID:8432
- C:\Windows\System\lEAFaEU.exe
  C:\Windows\System\lEAFaEU.exe
  2⤵
  PID:8452
- C:\Windows\System\AUNtjOu.exe
  C:\Windows\System\AUNtjOu.exe
  2⤵
  PID:8472
- C:\Windows\System\YbNItsT.exe
  C:\Windows\System\YbNItsT.exe
  2⤵
  PID:8492
- C:\Windows\System\FFecshg.exe
  C:\Windows\System\FFecshg.exe
  2⤵
  PID:8508
- C:\Windows\System\VQaMZGd.exe
  C:\Windows\System\VQaMZGd.exe
  2⤵
  PID:8532
- C:\Windows\System\xWXHBWi.exe
  C:\Windows\System\xWXHBWi.exe
  2⤵
  PID:8552
- C:\Windows\System\uuaAfBS.exe
  C:\Windows\System\uuaAfBS.exe
  2⤵
  PID:8568
- C:\Windows\System\LsBgkPQ.exe
  C:\Windows\System\LsBgkPQ.exe
  2⤵
  PID:8596
- C:\Windows\System\aCAKiZO.exe
  C:\Windows\System\aCAKiZO.exe
  2⤵
  PID:8612
- C:\Windows\System\pFMKjVO.exe
  C:\Windows\System\pFMKjVO.exe
  2⤵
  PID:8636
- C:\Windows\System\mgadFNF.exe
  C:\Windows\System\mgadFNF.exe
  2⤵
  PID:8652
- C:\Windows\System\wutRaxN.exe
  C:\Windows\System\wutRaxN.exe
  2⤵
  PID:8676
- C:\Windows\System\EsaUzBp.exe
  C:\Windows\System\EsaUzBp.exe
  2⤵
  PID:8696
- C:\Windows\System\wzrLOaC.exe
  C:\Windows\System\wzrLOaC.exe
  2⤵
  PID:8716
- C:\Windows\System\LhhrOhS.exe
  C:\Windows\System\LhhrOhS.exe
  2⤵
  PID:8732
- C:\Windows\System\mUuLqez.exe
  C:\Windows\System\mUuLqez.exe
  2⤵
  PID:8748
- C:\Windows\System\EmTBUOC.exe
  C:\Windows\System\EmTBUOC.exe
  2⤵
  PID:8772
- C:\Windows\System\qtchaGy.exe
  C:\Windows\System\qtchaGy.exe
  2⤵
  PID:8796
- C:\Windows\System\cfSVOqS.exe
  C:\Windows\System\cfSVOqS.exe
  2⤵
  PID:8816
- C:\Windows\System\PWDXkOm.exe
  C:\Windows\System\PWDXkOm.exe
  2⤵
  PID:8840
- C:\Windows\System\adXxYEY.exe
  C:\Windows\System\adXxYEY.exe
  2⤵
  PID:8856
- C:\Windows\System\HdZIuFR.exe
  C:\Windows\System\HdZIuFR.exe
  2⤵
  PID:8876
- C:\Windows\System\BqcEqqY.exe
  C:\Windows\System\BqcEqqY.exe
  2⤵
  PID:8896
- C:\Windows\System\UnAhiMq.exe
  C:\Windows\System\UnAhiMq.exe
  2⤵
  PID:8916
- C:\Windows\System\SbbbsII.exe
  C:\Windows\System\SbbbsII.exe
  2⤵
  PID:8936
- C:\Windows\System\BXPBUHO.exe
  C:\Windows\System\BXPBUHO.exe
  2⤵
  PID:8956
- C:\Windows\System\QLTYWQH.exe
  C:\Windows\System\QLTYWQH.exe
  2⤵
  PID:8976
- C:\Windows\System\gnwaLtc.exe
  C:\Windows\System\gnwaLtc.exe
  2⤵
  PID:8996
- C:\Windows\System\AQEycme.exe
  C:\Windows\System\AQEycme.exe
  2⤵
  PID:9016
- C:\Windows\System\qRkeTFN.exe
  C:\Windows\System\qRkeTFN.exe
  2⤵
  PID:9032
- C:\Windows\System\qGMMmkV.exe
  C:\Windows\System\qGMMmkV.exe
  2⤵
  PID:9052
- C:\Windows\System\EZhlSjQ.exe
  C:\Windows\System\EZhlSjQ.exe
  2⤵
  PID:9080
- C:\Windows\System\Cjsgbuf.exe
  C:\Windows\System\Cjsgbuf.exe
  2⤵
  PID:9100
- C:\Windows\System\Rqeaxny.exe
  C:\Windows\System\Rqeaxny.exe
  2⤵
  PID:9120
- C:\Windows\System\owYOoEE.exe
  C:\Windows\System\owYOoEE.exe
  2⤵
  PID:9144
- C:\Windows\System\yFlTuPM.exe
  C:\Windows\System\yFlTuPM.exe
  2⤵
  PID:9160
- C:\Windows\System\wpkrAHM.exe
  C:\Windows\System\wpkrAHM.exe
  2⤵
  PID:9180
- C:\Windows\System\pyVHsSQ.exe
  C:\Windows\System\pyVHsSQ.exe
  2⤵
  PID:9196
- C:\Windows\System\innfzuN.exe
  C:\Windows\System\innfzuN.exe
  2⤵
  PID:8356
- C:\Windows\System\bLmRmDU.exe
  C:\Windows\System\bLmRmDU.exe
  2⤵
  PID:8392
- C:\Windows\System\WkFuSDj.exe
  C:\Windows\System\WkFuSDj.exe
  2⤵
  PID:8428
- C:\Windows\System\thtYGnh.exe
  C:\Windows\System\thtYGnh.exe
  2⤵
  PID:8520
- C:\Windows\System\qrfFhPQ.exe
  C:\Windows\System\qrfFhPQ.exe
  2⤵
  PID:7696
- C:\Windows\System\uOrWHDJ.exe
  C:\Windows\System\uOrWHDJ.exe
  2⤵
  PID:8764
- C:\Windows\System\GqeNmGf.exe
  C:\Windows\System\GqeNmGf.exe
  2⤵
  PID:8788
- C:\Windows\System\DucPQGa.exe
  C:\Windows\System\DucPQGa.exe
  2⤵
  PID:8848
- C:\Windows\System\JKIbGoq.exe
  C:\Windows\System\JKIbGoq.exe
  2⤵
  PID:8964
- C:\Windows\System\cyHXglt.exe
  C:\Windows\System\cyHXglt.exe
  2⤵
  PID:9028
- C:\Windows\System\IcHCLZC.exe
  C:\Windows\System\IcHCLZC.exe
  2⤵
  PID:9108
- C:\Windows\System\LlRzQsD.exe
  C:\Windows\System\LlRzQsD.exe
  2⤵
  PID:9152
- C:\Windows\System\fivFdZN.exe
  C:\Windows\System\fivFdZN.exe
  2⤵
  PID:3196
- C:\Windows\System\qqgaOJx.exe
  C:\Windows\System\qqgaOJx.exe
  2⤵
  PID:4048
- C:\Windows\System\ADTrUNJ.exe
  C:\Windows\System\ADTrUNJ.exe
  2⤵
  PID:9232
- C:\Windows\System\oCFGOYJ.exe
  C:\Windows\System\oCFGOYJ.exe
  2⤵
  PID:9260
- C:\Windows\System\MoiOMyb.exe
  C:\Windows\System\MoiOMyb.exe
  2⤵
  PID:9284
- C:\Windows\System\gmxNbTW.exe
  C:\Windows\System\gmxNbTW.exe
  2⤵
  PID:9304
- C:\Windows\System\pZYIytJ.exe
  C:\Windows\System\pZYIytJ.exe
  2⤵
  PID:9332
- C:\Windows\System\fPKZdLX.exe
  C:\Windows\System\fPKZdLX.exe
  2⤵
  PID:9348
- C:\Windows\System\iwkhTKo.exe
  C:\Windows\System\iwkhTKo.exe
  2⤵
  PID:9396
- C:\Windows\System\Ruraidt.exe
  C:\Windows\System\Ruraidt.exe
  2⤵
  PID:9412
- C:\Windows\System\OnveJCU.exe
  C:\Windows\System\OnveJCU.exe
  2⤵
  PID:9440
- C:\Windows\System\vvvLKzC.exe
  C:\Windows\System\vvvLKzC.exe
  2⤵
  PID:9456
- C:\Windows\System\TtJyUGd.exe
  C:\Windows\System\TtJyUGd.exe
  2⤵
  PID:9480
- C:\Windows\System\VaxdenS.exe
  C:\Windows\System\VaxdenS.exe
  2⤵
  PID:9504
- C:\Windows\System\Azvnnlw.exe
  C:\Windows\System\Azvnnlw.exe
  2⤵
  PID:9524
- C:\Windows\System\XuoGsDJ.exe
  C:\Windows\System\XuoGsDJ.exe
  2⤵
  PID:9544
- C:\Windows\System\PJSxjjl.exe
  C:\Windows\System\PJSxjjl.exe
  2⤵
  PID:9560
- C:\Windows\System\GrokwCC.exe
  C:\Windows\System\GrokwCC.exe
  2⤵
  PID:9588
- C:\Windows\System\AzhENaq.exe
  C:\Windows\System\AzhENaq.exe
  2⤵
  PID:9604
- C:\Windows\System\kJIDqJh.exe
  C:\Windows\System\kJIDqJh.exe
  2⤵
  PID:9624
- C:\Windows\System\hTfeIjD.exe
  C:\Windows\System\hTfeIjD.exe
  2⤵
  PID:9648
- C:\Windows\System\BIFIgvn.exe
  C:\Windows\System\BIFIgvn.exe
  2⤵
  PID:9664
- C:\Windows\System\CFMzwds.exe
  C:\Windows\System\CFMzwds.exe
  2⤵
  PID:9688
- C:\Windows\System\kBzaOuy.exe
  C:\Windows\System\kBzaOuy.exe
  2⤵
  PID:9716
- C:\Windows\System\vrZlhrS.exe
  C:\Windows\System\vrZlhrS.exe
  2⤵
  PID:9752
- C:\Windows\System\wrZcvrb.exe
  C:\Windows\System\wrZcvrb.exe
  2⤵
  PID:9772
- C:\Windows\System\PUCuWkA.exe
  C:\Windows\System\PUCuWkA.exe
  2⤵
  PID:9792
- C:\Windows\System\BtKcVjT.exe
  C:\Windows\System\BtKcVjT.exe
  2⤵
  PID:9816
- C:\Windows\System\WaQdPAq.exe
  C:\Windows\System\WaQdPAq.exe
  2⤵
  PID:9832
- C:\Windows\System\kzUjKwN.exe
  C:\Windows\System\kzUjKwN.exe
  2⤵
  PID:9848
- C:\Windows\System\LIRfEuf.exe
  C:\Windows\System\LIRfEuf.exe
  2⤵
  PID:9864
- C:\Windows\System\ECYPkHQ.exe
  C:\Windows\System\ECYPkHQ.exe
  2⤵
  PID:9884
- C:\Windows\System\kVHPoVT.exe
  C:\Windows\System\kVHPoVT.exe
  2⤵
  PID:9904
- C:\Windows\System\qdxxrMm.exe
  C:\Windows\System\qdxxrMm.exe
  2⤵
  PID:9928
- C:\Windows\System\EjveJIQ.exe
  C:\Windows\System\EjveJIQ.exe
  2⤵
  PID:9944
- C:\Windows\System\SDoYaso.exe
  C:\Windows\System\SDoYaso.exe
  2⤵
  PID:9964
- C:\Windows\System\XaWbdIm.exe
  C:\Windows\System\XaWbdIm.exe
  2⤵
  PID:9988
- C:\Windows\System\oqJsXUv.exe
  C:\Windows\System\oqJsXUv.exe
  2⤵
  PID:10008
- C:\Windows\System\tMlTYmh.exe
  C:\Windows\System\tMlTYmh.exe
  2⤵
  PID:10024
- C:\Windows\System\vAhPJmr.exe
  C:\Windows\System\vAhPJmr.exe
  2⤵
  PID:10044
- C:\Windows\System\rrbynnI.exe
  C:\Windows\System\rrbynnI.exe
  2⤵
  PID:10060
- C:\Windows\System\cjTBXrf.exe
  C:\Windows\System\cjTBXrf.exe
  2⤵
  PID:10084
- C:\Windows\System\VDgIKID.exe
  C:\Windows\System\VDgIKID.exe
  2⤵
  PID:10104
- C:\Windows\System\tjrpOGB.exe
  C:\Windows\System\tjrpOGB.exe
  2⤵
  PID:10124
- C:\Windows\System\RrkcVFO.exe
  C:\Windows\System\RrkcVFO.exe
  2⤵
  PID:10144
- C:\Windows\System\DeyQJMz.exe
  C:\Windows\System\DeyQJMz.exe
  2⤵
  PID:10172
- C:\Windows\System\vCbhEFn.exe
  C:\Windows\System\vCbhEFn.exe
  2⤵
  PID:10188
- C:\Windows\System\zptbmiy.exe
  C:\Windows\System\zptbmiy.exe
  2⤵
  PID:10212
- C:\Windows\System\HpXokGM.exe
  C:\Windows\System\HpXokGM.exe
  2⤵
  PID:10232
- C:\Windows\System\UKcYiPo.exe
  C:\Windows\System\UKcYiPo.exe
  2⤵
  PID:4380
- C:\Windows\System\YxovgZN.exe
  C:\Windows\System\YxovgZN.exe
  2⤵
  PID:8284
- C:\Windows\System\yRJepbG.exe
  C:\Windows\System\yRJepbG.exe
  2⤵
  PID:8648
- C:\Windows\System\dJAJBSc.exe
  C:\Windows\System\dJAJBSc.exe
  2⤵
  PID:8464
- C:\Windows\System\viFTZwh.exe
  C:\Windows\System\viFTZwh.exe
  2⤵
  PID:9088
- C:\Windows\System\OFCsKSm.exe
  C:\Windows\System\OFCsKSm.exe
  2⤵
  PID:4564
- C:\Windows\System\xNveHBg.exe
  C:\Windows\System\xNveHBg.exe
  2⤵
  PID:9312
- C:\Windows\System\qaqnJvu.exe
  C:\Windows\System\qaqnJvu.exe
  2⤵
  PID:9448
- C:\Windows\System\gcPLgLz.exe
  C:\Windows\System\gcPLgLz.exe
  2⤵
  PID:9476
- C:\Windows\System\jlwcvVB.exe
  C:\Windows\System\jlwcvVB.exe
  2⤵
  PID:10252
- C:\Windows\System\Jikalzi.exe
  C:\Windows\System\Jikalzi.exe
  2⤵
  PID:10272
- C:\Windows\System\GFdHhIi.exe
  C:\Windows\System\GFdHhIi.exe
  2⤵
  PID:10296
- C:\Windows\System\KrpDomf.exe
  C:\Windows\System\KrpDomf.exe
  2⤵
  PID:10320
- C:\Windows\System\luBTrTD.exe
  C:\Windows\System\luBTrTD.exe
  2⤵
  PID:10336
- C:\Windows\System\lodxTDu.exe
  C:\Windows\System\lodxTDu.exe
  2⤵
  PID:10360
- C:\Windows\System\vmpQAUc.exe
  C:\Windows\System\vmpQAUc.exe
  2⤵
  PID:10376
- C:\Windows\System\pzndWCI.exe
  C:\Windows\System\pzndWCI.exe
  2⤵
  PID:10400
- C:\Windows\System\eGbwOXa.exe
  C:\Windows\System\eGbwOXa.exe
  2⤵
  PID:10420
- C:\Windows\System\ZYfZSdB.exe
  C:\Windows\System\ZYfZSdB.exe
  2⤵
  PID:10444
- C:\Windows\System\dZwVzTV.exe
  C:\Windows\System\dZwVzTV.exe
  2⤵
  PID:10460
- C:\Windows\System\icszrXq.exe
  C:\Windows\System\icszrXq.exe
  2⤵
  PID:10488
- C:\Windows\System\csaEbSJ.exe
  C:\Windows\System\csaEbSJ.exe
  2⤵
  PID:10508
- C:\Windows\System\rrKZdCP.exe
  C:\Windows\System\rrKZdCP.exe
  2⤵
  PID:10524
- C:\Windows\System\YczrMjE.exe
  C:\Windows\System\YczrMjE.exe
  2⤵
  PID:10540
- C:\Windows\System\EPUviwI.exe
  C:\Windows\System\EPUviwI.exe
  2⤵
  PID:10564
- C:\Windows\System\UNlVmUo.exe
  C:\Windows\System\UNlVmUo.exe
  2⤵
  PID:10580
- C:\Windows\System\KoPuPor.exe
  C:\Windows\System\KoPuPor.exe
  2⤵
  PID:10604
- C:\Windows\System\AanQmft.exe
  C:\Windows\System\AanQmft.exe
  2⤵
  PID:10624
- C:\Windows\System\IYCQiGm.exe
  C:\Windows\System\IYCQiGm.exe
  2⤵
  PID:10640
- C:\Windows\System\TaZjYFk.exe
  C:\Windows\System\TaZjYFk.exe
  2⤵
  PID:10660
- C:\Windows\System\tXzbNYO.exe
  C:\Windows\System\tXzbNYO.exe
  2⤵
  PID:10676
- C:\Windows\System\jsybwRo.exe
  C:\Windows\System\jsybwRo.exe
  2⤵
  PID:10696
- C:\Windows\System\duFqaNl.exe
  C:\Windows\System\duFqaNl.exe
  2⤵
  PID:10712
- C:\Windows\System\HYkntqh.exe
  C:\Windows\System\HYkntqh.exe
  2⤵
  PID:10732
- C:\Windows\System\jMDQqbn.exe
  C:\Windows\System\jMDQqbn.exe
  2⤵
  PID:10752
- C:\Windows\System\XykImVv.exe
  C:\Windows\System\XykImVv.exe
  2⤵
  PID:10768
- C:\Windows\System\TraTKFk.exe
  C:\Windows\System\TraTKFk.exe
  2⤵
  PID:10784
- C:\Windows\System\WsjxSSy.exe
  C:\Windows\System\WsjxSSy.exe
  2⤵
  PID:10804
- C:\Windows\System\ZcXrGwF.exe
  C:\Windows\System\ZcXrGwF.exe
  2⤵
  PID:10820
- C:\Windows\System\BCinIzo.exe
  C:\Windows\System\BCinIzo.exe
  2⤵
  PID:10840
- C:\Windows\System\elXcMcV.exe
  C:\Windows\System\elXcMcV.exe
  2⤵
  PID:10860
- C:\Windows\System\dWCnRDF.exe
  C:\Windows\System\dWCnRDF.exe
  2⤵
  PID:10880
- C:\Windows\System\knbAXeN.exe
  C:\Windows\System\knbAXeN.exe
  2⤵
  PID:10904
- C:\Windows\System\JNqfxxp.exe
  C:\Windows\System\JNqfxxp.exe
  2⤵
  PID:10920
- C:\Windows\System\eJOjrLU.exe
  C:\Windows\System\eJOjrLU.exe
  2⤵
  PID:10940
- C:\Windows\System\yemfoKg.exe
  C:\Windows\System\yemfoKg.exe
  2⤵
  PID:10956
- C:\Windows\System\JfcxPQV.exe
  C:\Windows\System\JfcxPQV.exe
  2⤵
  PID:10980
- C:\Windows\System\lYffFwc.exe
  C:\Windows\System\lYffFwc.exe
  2⤵
  PID:11000
- C:\Windows\System\dIwxtff.exe
  C:\Windows\System\dIwxtff.exe
  2⤵
  PID:11020
- C:\Windows\System\OIrSrEe.exe
  C:\Windows\System\OIrSrEe.exe
  2⤵
  PID:11036
- C:\Windows\System\utqStqM.exe
  C:\Windows\System\utqStqM.exe
  2⤵
  PID:11056
- C:\Windows\System\MhgFsSJ.exe
  C:\Windows\System\MhgFsSJ.exe
  2⤵
  PID:11080
- C:\Windows\System\njGwBMf.exe
  C:\Windows\System\njGwBMf.exe
  2⤵
  PID:11096
- C:\Windows\System\GpRErDr.exe
  C:\Windows\System\GpRErDr.exe
  2⤵
  PID:11116
- C:\Windows\System\XEmJQNW.exe
  C:\Windows\System\XEmJQNW.exe
  2⤵
  PID:11136
- C:\Windows\System\XDYyWmF.exe
  C:\Windows\System\XDYyWmF.exe
  2⤵
  PID:11156
- C:\Windows\System\aBzBGgV.exe
  C:\Windows\System\aBzBGgV.exe
  2⤵
  PID:11176
- C:\Windows\System\NoAlqXD.exe
  C:\Windows\System\NoAlqXD.exe
  2⤵
  PID:11192
- C:\Windows\System\ttPaYPx.exe
  C:\Windows\System\ttPaYPx.exe
  2⤵
  PID:11212
- C:\Windows\System\TOBINzx.exe
  C:\Windows\System\TOBINzx.exe
  2⤵
  PID:11232
- C:\Windows\System\dePyFpo.exe
  C:\Windows\System\dePyFpo.exe
  2⤵
  PID:11248
- C:\Windows\System\hSAnQif.exe
  C:\Windows\System\hSAnQif.exe
  2⤵
  PID:9488
- C:\Windows\System\pvUQptE.exe
  C:\Windows\System\pvUQptE.exe
  2⤵
  PID:9556
- C:\Windows\System\vigmPvN.exe
  C:\Windows\System\vigmPvN.exe
  2⤵
  PID:9596
- C:\Windows\System\nDlHeCN.exe
  C:\Windows\System\nDlHeCN.exe
  2⤵
  PID:9632
- C:\Windows\System\OAPedQR.exe
  C:\Windows\System\OAPedQR.exe
  2⤵
  PID:9724
- C:\Windows\System\wgrOtmQ.exe
  C:\Windows\System\wgrOtmQ.exe
  2⤵
  PID:3500
- C:\Windows\System\SqVOUDt.exe
  C:\Windows\System\SqVOUDt.exe
  2⤵
  PID:9008
- C:\Windows\System\BQkgZRS.exe
  C:\Windows\System\BQkgZRS.exe
  2⤵
  PID:8372
- C:\Windows\System\vmaCETW.exe
  C:\Windows\System\vmaCETW.exe
  2⤵
  PID:9840
- C:\Windows\System\bbYkSHu.exe
  C:\Windows\System\bbYkSHu.exe
  2⤵
  PID:9872
- C:\Windows\System\SeyMjRo.exe
  C:\Windows\System\SeyMjRo.exe
  2⤵
  PID:8948
- C:\Windows\System\MrUKYBx.exe
  C:\Windows\System\MrUKYBx.exe
  2⤵
  PID:9956
- C:\Windows\System\bjKLoRp.exe
  C:\Windows\System\bjKLoRp.exe
  2⤵
  PID:10040
- C:\Windows\System\AjemZqF.exe
  C:\Windows\System\AjemZqF.exe
  2⤵
  PID:10116
- C:\Windows\System\WwlrmVD.exe
  C:\Windows\System\WwlrmVD.exe
  2⤵
  PID:8308
- C:\Windows\System\jibPWvo.exe
  C:\Windows\System\jibPWvo.exe
  2⤵
  PID:10180
- C:\Windows\System\HEcKuEs.exe
  C:\Windows\System\HEcKuEs.exe
  2⤵
  PID:9276
- C:\Windows\System\dCJfOfw.exe
  C:\Windows\System\dCJfOfw.exe
  2⤵
  PID:9316
- C:\Windows\System\FXtIjNj.exe
  C:\Windows\System\FXtIjNj.exe
  2⤵
  PID:9404
- C:\Windows\System\qkQJuhC.exe
  C:\Windows\System\qkQJuhC.exe
  2⤵
  PID:9536
- C:\Windows\System\zZHMEdq.exe
  C:\Windows\System\zZHMEdq.exe
  2⤵
  PID:10368
- C:\Windows\System\IeERowU.exe
  C:\Windows\System\IeERowU.exe
  2⤵
  PID:8344
- C:\Windows\System\OSGfQAm.exe
  C:\Windows\System\OSGfQAm.exe
  2⤵
  PID:9128
- C:\Windows\System\KknMXMd.exe
  C:\Windows\System\KknMXMd.exe
  2⤵
  PID:9812
- C:\Windows\System\pfwjEOl.exe
  C:\Windows\System\pfwjEOl.exe
  2⤵
  PID:11284
- C:\Windows\System\pOpBCeN.exe
  C:\Windows\System\pOpBCeN.exe
  2⤵
  PID:11304
- C:\Windows\System\SBgxjLx.exe
  C:\Windows\System\SBgxjLx.exe
  2⤵
  PID:11320
- C:\Windows\System\EBsSFur.exe
  C:\Windows\System\EBsSFur.exe
  2⤵
  PID:11340
- C:\Windows\System\KFjwdLv.exe
  C:\Windows\System\KFjwdLv.exe
  2⤵
  PID:11356
- C:\Windows\System\HYUseLN.exe
  C:\Windows\System\HYUseLN.exe
  2⤵
  PID:11372
- C:\Windows\System\vhKWwlX.exe
  C:\Windows\System\vhKWwlX.exe
  2⤵
  PID:11388
- C:\Windows\System\qNvTTNc.exe
  C:\Windows\System\qNvTTNc.exe
  2⤵
  PID:11404
- C:\Windows\System\QyqIbHg.exe
  C:\Windows\System\QyqIbHg.exe
  2⤵
  PID:11428
- C:\Windows\System\KGmsUSx.exe
  C:\Windows\System\KGmsUSx.exe
  2⤵
  PID:11452
- C:\Windows\System\DfAidlv.exe
  C:\Windows\System\DfAidlv.exe
  2⤵
  PID:11472
- C:\Windows\System\AFfOMXI.exe
  C:\Windows\System\AFfOMXI.exe
  2⤵
  PID:11488
- C:\Windows\System\BEIvrjS.exe
  C:\Windows\System\BEIvrjS.exe
  2⤵
  PID:11520
- C:\Windows\System\kXoIpsW.exe
  C:\Windows\System\kXoIpsW.exe
  2⤵
  PID:11540
- C:\Windows\System\QUKRaoa.exe
  C:\Windows\System\QUKRaoa.exe
  2⤵
  PID:11556
- C:\Windows\System\rAfSZKL.exe
  C:\Windows\System\rAfSZKL.exe
  2⤵
  PID:11580
- C:\Windows\System\MbzoafM.exe
  C:\Windows\System\MbzoafM.exe
  2⤵
  PID:11600
- C:\Windows\System\lOGSfGu.exe
  C:\Windows\System\lOGSfGu.exe
  2⤵
  PID:11620
- C:\Windows\System\cuOKeGC.exe
  C:\Windows\System\cuOKeGC.exe
  2⤵
  PID:11648
- C:\Windows\System\kcAFIHj.exe
  C:\Windows\System\kcAFIHj.exe
  2⤵
  PID:11668
- C:\Windows\System\jjnUJHQ.exe
  C:\Windows\System\jjnUJHQ.exe
  2⤵
  PID:11692
- C:\Windows\System\ImOZxkr.exe
  C:\Windows\System\ImOZxkr.exe
  2⤵
  PID:11716
- C:\Windows\System\eCFYECS.exe
  C:\Windows\System\eCFYECS.exe
  2⤵
  PID:11752
- C:\Windows\System\jmtKJzy.exe
  C:\Windows\System\jmtKJzy.exe
  2⤵
  PID:11768
- C:\Windows\System\bZcdOEZ.exe
  C:\Windows\System\bZcdOEZ.exe
  2⤵
  PID:11792
- C:\Windows\System\RRwmPiT.exe
  C:\Windows\System\RRwmPiT.exe
  2⤵
  PID:11808
- C:\Windows\System\zrwwNgF.exe
  C:\Windows\System\zrwwNgF.exe
  2⤵
  PID:11832
- C:\Windows\System\KvmyCOL.exe
  C:\Windows\System\KvmyCOL.exe
  2⤵
  PID:11852
- C:\Windows\System\eMrWBhr.exe
  C:\Windows\System\eMrWBhr.exe
  2⤵
  PID:11868
- C:\Windows\System\vQqOjSv.exe
  C:\Windows\System\vQqOjSv.exe
  2⤵
  PID:11896
- C:\Windows\System\ILSHJaj.exe
  C:\Windows\System\ILSHJaj.exe
  2⤵
  PID:11916
- C:\Windows\System\WTfXstd.exe
  C:\Windows\System\WTfXstd.exe
  2⤵
  PID:11940
- C:\Windows\System\XbDDFOF.exe
  C:\Windows\System\XbDDFOF.exe
  2⤵
  PID:11956
- C:\Windows\System\UWczHIr.exe
  C:\Windows\System\UWczHIr.exe
  2⤵
  PID:11976
- C:\Windows\System\hZkQxei.exe
  C:\Windows\System\hZkQxei.exe
  2⤵
  PID:12004
- C:\Windows\System\VrGbFLA.exe
  C:\Windows\System\VrGbFLA.exe
  2⤵
  PID:12036
- C:\Windows\System\cMVWvCw.exe
  C:\Windows\System\cMVWvCw.exe
  2⤵
  PID:12056
- C:\Windows\System\aRKFhmJ.exe
  C:\Windows\System\aRKFhmJ.exe
  2⤵
  PID:12092
- C:\Windows\System\sViDeNS.exe
  C:\Windows\System\sViDeNS.exe
  2⤵
  PID:12112
- C:\Windows\System\fpJhbbU.exe
  C:\Windows\System\fpJhbbU.exe
  2⤵
  PID:12140
- C:\Windows\System\UefbvNL.exe
  C:\Windows\System\UefbvNL.exe
  2⤵
  PID:12160
- C:\Windows\System\JjUAAKc.exe
  C:\Windows\System\JjUAAKc.exe
  2⤵
  PID:12176
- C:\Windows\System\ETPnNKr.exe
  C:\Windows\System\ETPnNKr.exe
  2⤵
  PID:12200
- C:\Windows\System\UgBbtzR.exe
  C:\Windows\System\UgBbtzR.exe
  2⤵
  PID:12224
- C:\Windows\System\XlyJTPw.exe
  C:\Windows\System\XlyJTPw.exe
  2⤵
  PID:12240
- C:\Windows\System\kVPcAIr.exe
  C:\Windows\System\kVPcAIr.exe
  2⤵
  PID:12256
- C:\Windows\System\jNjXYlo.exe
  C:\Windows\System\jNjXYlo.exe
  2⤵
  PID:12276
- C:\Windows\System\PwsJjDU.exe
  C:\Windows\System\PwsJjDU.exe
  2⤵
  PID:9896
- C:\Windows\System\iYfjKTy.exe
  C:\Windows\System\iYfjKTy.exe
  2⤵
  PID:9936
- C:\Windows\System\NQOpyKB.exe
  C:\Windows\System\NQOpyKB.exe
  2⤵
  PID:10432
- C:\Windows\System\UiRVpdm.exe
  C:\Windows\System\UiRVpdm.exe
  2⤵
  PID:7892
- C:\Windows\System\iarqDSL.exe
  C:\Windows\System\iarqDSL.exe
  2⤵
  PID:10304
- C:\Windows\System\agoyIlH.exe
  C:\Windows\System\agoyIlH.exe
  2⤵
  PID:10204
- C:\Windows\System\gEiwkvx.exe
  C:\Windows\System\gEiwkvx.exe
  2⤵
  PID:11780
- C:\Windows\System\JVCzTGH.exe
  C:\Windows\System\JVCzTGH.exe
  2⤵
  PID:11828
- C:\Windows\System\oMySFFq.exe
  C:\Windows\System\oMySFFq.exe
  2⤵
  PID:11860
- C:\Windows\System\bYyzUXS.exe
  C:\Windows\System\bYyzUXS.exe
  2⤵
  PID:12016
- C:\Windows\System\IilYrbD.exe
  C:\Windows\System\IilYrbD.exe
  2⤵
  PID:12048
- C:\Windows\System\LRIetVu.exe
  C:\Windows\System\LRIetVu.exe
  2⤵
  PID:12120
- C:\Windows\System\zWfbprt.exe
  C:\Windows\System\zWfbprt.exe
  2⤵
  PID:9616
- C:\Windows\System\viEYThb.exe
  C:\Windows\System\viEYThb.exe
  2⤵
  PID:12296
- C:\Windows\System\YyHEmdA.exe
  C:\Windows\System\YyHEmdA.exe
  2⤵
  PID:12316
- C:\Windows\System\FNBVVNp.exe
  C:\Windows\System\FNBVVNp.exe
  2⤵
  PID:12336
- C:\Windows\System\yTuhRRC.exe
  C:\Windows\System\yTuhRRC.exe
  2⤵
  PID:12364
- C:\Windows\System\DbDXzYN.exe
  C:\Windows\System\DbDXzYN.exe
  2⤵
  PID:12380
- C:\Windows\System\PwlIEeK.exe
  C:\Windows\System\PwlIEeK.exe
  2⤵
  PID:12404
- C:\Windows\System\OmDOlFG.exe
  C:\Windows\System\OmDOlFG.exe
  2⤵
  PID:12424
- C:\Windows\System\JPyLraG.exe
  C:\Windows\System\JPyLraG.exe
  2⤵
  PID:12444
- C:\Windows\System\XYFrArj.exe
  C:\Windows\System\XYFrArj.exe
  2⤵
  PID:12468
- C:\Windows\System\kuQXZBD.exe
  C:\Windows\System\kuQXZBD.exe
  2⤵
  PID:12484
- C:\Windows\System\GGsPYDv.exe
  C:\Windows\System\GGsPYDv.exe
  2⤵
  PID:12512
- C:\Windows\System\bdRdJFE.exe
  C:\Windows\System\bdRdJFE.exe
  2⤵
  PID:12528
- C:\Windows\System\RuwzqIh.exe
  C:\Windows\System\RuwzqIh.exe
  2⤵
  PID:12552
- C:\Windows\System\SDiEwsC.exe
  C:\Windows\System\SDiEwsC.exe
  2⤵
  PID:12576
- C:\Windows\System\BbAMAYH.exe
  C:\Windows\System\BbAMAYH.exe
  2⤵
  PID:12596
- C:\Windows\System\xlXHEoC.exe
  C:\Windows\System\xlXHEoC.exe
  2⤵
  PID:12620
- C:\Windows\System\unjKNQd.exe
  C:\Windows\System\unjKNQd.exe
  2⤵
  PID:12648
- C:\Windows\System\WEPEgLV.exe
  C:\Windows\System\WEPEgLV.exe
  2⤵
  PID:12668
- C:\Windows\System\AhXeKYi.exe
  C:\Windows\System\AhXeKYi.exe
  2⤵
  PID:12696
- C:\Windows\System\TgZtdtY.exe
  C:\Windows\System\TgZtdtY.exe
  2⤵
  PID:12712
- C:\Windows\System\vwaiFSq.exe
  C:\Windows\System\vwaiFSq.exe
  2⤵
  PID:12736
- C:\Windows\System\EeaCeCY.exe
  C:\Windows\System\EeaCeCY.exe
  2⤵
  PID:12752
- C:\Windows\System\BPHbLwI.exe
  C:\Windows\System\BPHbLwI.exe
  2⤵
  PID:12776
- C:\Windows\System\ITSomVl.exe
  C:\Windows\System\ITSomVl.exe
  2⤵
  PID:12800
- C:\Windows\System\TXjpvgh.exe
  C:\Windows\System\TXjpvgh.exe
  2⤵
  PID:12820
- C:\Windows\System\xeovhJp.exe
  C:\Windows\System\xeovhJp.exe
  2⤵
  PID:12836
- C:\Windows\System\iXYWsPU.exe
  C:\Windows\System\iXYWsPU.exe
  2⤵
  PID:12852
- C:\Windows\System\epfxdbS.exe
  C:\Windows\System\epfxdbS.exe
  2⤵
  PID:12868
- C:\Windows\System\sLaFjcC.exe
  C:\Windows\System\sLaFjcC.exe
  2⤵
  PID:11272
- C:\Windows\System\niblePV.exe
  C:\Windows\System\niblePV.exe
  2⤵
  PID:3920
- C:\Windows\System\nqaygDa.exe
  C:\Windows\System\nqaygDa.exe
  2⤵
  PID:11348
- C:\Windows\System\facPWcp.exe
  C:\Windows\System\facPWcp.exe
  2⤵
  PID:11676
- C:\Windows\System\mlkOqZl.exe
  C:\Windows\System\mlkOqZl.exe
  2⤵
  PID:11936
- C:\Windows\System\gZRMSuC.exe
  C:\Windows\System\gZRMSuC.exe
  2⤵
  PID:12304
- C:\Windows\System\KSXHEeN.exe
  C:\Windows\System\KSXHEeN.exe
  2⤵
  PID:12476
- C:\Windows\System\seHelWY.exe
  C:\Windows\System\seHelWY.exe
  2⤵
  PID:12524
- C:\Windows\System\nRmsziz.exe
  C:\Windows\System\nRmsziz.exe
  2⤵
  PID:12612
- C:\Windows\System\goVWTsC.exe
  C:\Windows\System\goVWTsC.exe
  2⤵
  PID:12688
- C:\Windows\System\VrDwnve.exe
  C:\Windows\System\VrDwnve.exe
  2⤵
  PID:12864
- C:\Windows\System\BZzyUbM.exe
  C:\Windows\System\BZzyUbM.exe
  2⤵
  PID:12916
- C:\Windows\System\lhNnzmm.exe
  C:\Windows\System\lhNnzmm.exe
  2⤵
  PID:10876
- C:\Windows\System\gWSfODV.exe
  C:\Windows\System\gWSfODV.exe
  2⤵
  PID:10484
- C:\Windows\System\qxIgXDJ.exe
  C:\Windows\System\qxIgXDJ.exe
  2⤵
  PID:12996
- C:\Windows\System\redqatB.exe
  C:\Windows\System\redqatB.exe
  2⤵
  PID:13024
- C:\Windows\System\kHOtPtn.exe
  C:\Windows\System\kHOtPtn.exe
  2⤵
  PID:13240
- C:\Windows\System\quWzPoE.exe
  C:\Windows\System\quWzPoE.exe
  2⤵
  PID:13288
- C:\Windows\System\XLBtOJp.exe
  C:\Windows\System\XLBtOJp.exe
  2⤵
  PID:12964
- C:\Windows\System\gWqthtK.exe
  C:\Windows\System\gWqthtK.exe
  2⤵
  PID:13068
- C:\Windows\System\zLwYnNI.exe
  C:\Windows\System\zLwYnNI.exe
  2⤵
  PID:12308
- C:\Windows\System\UVknFxE.exe
  C:\Windows\System\UVknFxE.exe
  2⤵
  PID:13156
- C:\Windows\System\cTVppwx.exe
  C:\Windows\System\cTVppwx.exe
  2⤵
  PID:608
- C:\Windows\System\gmSItcI.exe
  C:\Windows\System\gmSItcI.exe
  2⤵
  PID:376
- C:\Windows\System\jhraPfR.exe
  C:\Windows\System\jhraPfR.exe
  2⤵
  PID:12812
- C:\Windows\System\SIadscB.exe
  C:\Windows\System\SIadscB.exe
  2⤵
  PID:12684
- C:\Windows\System\mmFkAAx.exe
  C:\Windows\System\mmFkAAx.exe
  2⤵
  PID:12708
- C:\Windows\System\zNZSSEL.exe
  C:\Windows\System\zNZSSEL.exe
  2⤵
  PID:13048
- C:\Windows\System\xgMAalq.exe
  C:\Windows\System\xgMAalq.exe
  2⤵
  PID:12816
- C:\Windows\System\osrWfQN.exe
  C:\Windows\System\osrWfQN.exe
  2⤵
  PID:12908
- C:\Windows\System\GFpMjeT.exe
  C:\Windows\System\GFpMjeT.exe
  2⤵
  PID:12592
- C:\Windows\System\jWHPHcO.exe
  C:\Windows\System\jWHPHcO.exe
  2⤵
  PID:3692
- C:\Windows\System\AFpxwbz.exe
  C:\Windows\System\AFpxwbz.exe
  2⤵
  PID:13284
- C:\Windows\System\dPnMhLA.exe
  C:\Windows\System\dPnMhLA.exe
  2⤵
  PID:10556
- C:\Windows\System\RVJujof.exe
  C:\Windows\System\RVJujof.exe
  2⤵
  PID:12880
- C:\Windows\System\jxHGviK.exe
  C:\Windows\System\jxHGviK.exe
  2⤵
  PID:12704
- C:\Windows\System\SaPYxlv.exe
  C:\Windows\System\SaPYxlv.exe
  2⤵
  PID:12944
- C:\Windows\System\pKlMUpE.exe
  C:\Windows\System\pKlMUpE.exe
  2⤵
  PID:2720
- C:\Windows\System\ebwEvjJ.exe
  C:\Windows\System\ebwEvjJ.exe
  2⤵
  PID:12372
- C:\Windows\System\VnTyVXG.exe
  C:\Windows\System\VnTyVXG.exe
  2⤵
  PID:11844
- C:\Windows\System\hdeVslY.exe
  C:\Windows\System\hdeVslY.exe
  2⤵
  PID:13104
- C:\Windows\System\VtxaeHH.exe
  C:\Windows\System\VtxaeHH.exe
  2⤵
  PID:13136
- C:\Windows\System\EWlTrbu.exe
  C:\Windows\System\EWlTrbu.exe
  2⤵
  PID:13196
- C:\Windows\System\pISGpGS.exe
  C:\Windows\System\pISGpGS.exe
  2⤵
  PID:10056
- C:\Windows\System\PXlScZY.exe
  C:\Windows\System\PXlScZY.exe
  2⤵
  PID:12808
- C:\Windows\System\CWOJiPL.exe
  C:\Windows\System\CWOJiPL.exe
  2⤵
  PID:12608
- C:\Windows\System\cNXmqcV.exe
  C:\Windows\System\cNXmqcV.exe
  2⤵
  PID:8644
- C:\Windows\System\poMAHGv.exe
  C:\Windows\System\poMAHGv.exe
  2⤵
  PID:9660
- C:\Windows\System\DhtxkHv.exe
  C:\Windows\System\DhtxkHv.exe
  2⤵
  PID:2472
- C:\Windows\System\itsYkPu.exe
  C:\Windows\System\itsYkPu.exe
  2⤵
  PID:13088
- C:\Windows\System\XLYSsgO.exe
  C:\Windows\System\XLYSsgO.exe
  2⤵
  PID:1064
- C:\Windows\System\FkxjsUq.exe
  C:\Windows\System\FkxjsUq.exe
  2⤵
  PID:12388
- C:\Windows\System\NYfFpoD.exe
  C:\Windows\System\NYfFpoD.exe
  2⤵
  PID:10168
- C:\Windows\System\wrpJbLx.exe
  C:\Windows\System\wrpJbLx.exe
  2⤵
  PID:9640
- C:\Windows\System\MfWGYnL.exe
  C:\Windows\System\MfWGYnL.exe
  2⤵
  PID:12900
- C:\Windows\System\wHzyULs.exe
  C:\Windows\System\wHzyULs.exe
  2⤵
  PID:2872
- C:\Windows\System\OfTnXLl.exe
  C:\Windows\System\OfTnXLl.exe
  2⤵
  PID:11884
- C:\Windows\System\VQFnBAp.exe
  C:\Windows\System\VQFnBAp.exe
  2⤵
  PID:10032
- C:\Windows\System\kYqqgTF.exe
  C:\Windows\System\kYqqgTF.exe
  2⤵
  PID:13296
- C:\Windows\System\ZppdbGy.exe
  C:\Windows\System\ZppdbGy.exe
  2⤵
  PID:12568
- C:\Windows\System\qclCTNf.exe
  C:\Windows\System\qclCTNf.exe
  2⤵
  PID:5140
- C:\Windows\System\XoHqaTS.exe
  C:\Windows\System\XoHqaTS.exe
  2⤵
  PID:5212
- C:\Windows\System\rASBCmF.exe
  C:\Windows\System\rASBCmF.exe
  2⤵
  PID:12312
- C:\Windows\System\AUOPZLs.exe
  C:\Windows\System\AUOPZLs.exe
  2⤵
  PID:13292
- C:\Windows\System\ApGaSLh.exe
  C:\Windows\System\ApGaSLh.exe
  2⤵
  PID:11292
- C:\Windows\System\wDTUVPz.exe
  C:\Windows\System\wDTUVPz.exe
  2⤵
  PID:636
- C:\Windows\System\ShwXKET.exe
  C:\Windows\System\ShwXKET.exe
  2⤵
  PID:13124
- C:\Windows\System\JIEILeF.exe
  C:\Windows\System\JIEILeF.exe
  2⤵
  PID:2748
- C:\Windows\System\jJeOrxO.exe
  C:\Windows\System\jJeOrxO.exe
  2⤵
  PID:12788
- C:\Windows\System\KBvbgTE.exe
  C:\Windows\System\KBvbgTE.exe
  2⤵
  PID:5032
- C:\Windows\System\ftuQHqq.exe
  C:\Windows\System\ftuQHqq.exe
  2⤵
  PID:3876
- C:\Windows\System\XMHclIj.exe
  C:\Windows\System\XMHclIj.exe
  2⤵
  PID:11312
- C:\Windows\System\cTGrNLU.exe
  C:\Windows\System\cTGrNLU.exe
  2⤵
  PID:4668
- C:\Windows\System\oaXZMey.exe
  C:\Windows\System\oaXZMey.exe
  2⤵
  PID:2516
- C:\Windows\System\gITwuSx.exe
  C:\Windows\System\gITwuSx.exe
  2⤵
  PID:1976
- C:\Windows\System\nctUdWB.exe
  C:\Windows\System\nctUdWB.exe
  2⤵
  PID:4720
- C:\Windows\System\npeyOCE.exe
  C:\Windows\System\npeyOCE.exe
  2⤵
  PID:13200
- C:\Windows\System\wyHLTNt.exe
  C:\Windows\System\wyHLTNt.exe
  2⤵
  PID:3956
- C:\Windows\System\HPUKBsl.exe
  C:\Windows\System\HPUKBsl.exe
  2⤵
  PID:4168
- C:\Windows\System\kvbFwPt.exe
  C:\Windows\System\kvbFwPt.exe
  2⤵
  PID:4612
- C:\Windows\System\nmCTEfI.exe
  C:\Windows\System\nmCTEfI.exe
  2⤵
  PID:12236
- C:\Windows\System\PVHTWfw.exe
  C:\Windows\System\PVHTWfw.exe
  2⤵
  PID:4452
- C:\Windows\System\vyORcDu.exe
  C:\Windows\System\vyORcDu.exe
  2⤵
  PID:4596
- C:\Windows\System\JoNMsgO.exe
  C:\Windows\System\JoNMsgO.exe
  2⤵
  PID:13004
- C:\Windows\System\SphtvhR.exe
  C:\Windows\System\SphtvhR.exe
  2⤵
  PID:11964
- C:\Windows\System\EHRxHtA.exe
  C:\Windows\System\EHRxHtA.exe
  2⤵
  PID:13128
- C:\Windows\System\DqqidKL.exe
  C:\Windows\System\DqqidKL.exe
  2⤵
  PID:13008
- C:\Windows\System\wwfjLiZ.exe
  C:\Windows\System\wwfjLiZ.exe
  2⤵
  PID:13116
- C:\Windows\System\csQBLNN.exe
  C:\Windows\System\csQBLNN.exe
  2⤵
  PID:5172
- C:\Windows\System\hAQEZll.exe
  C:\Windows\System\hAQEZll.exe
  2⤵
  PID:12420
- C:\Windows\System\KygYNqn.exe
  C:\Windows\System\KygYNqn.exe
  2⤵
  PID:12456
- C:\Windows\System\pZurgfm.exe
  C:\Windows\System\pZurgfm.exe
  2⤵
  PID:12416
- C:\Windows\System\gbGCLqO.exe
  C:\Windows\System\gbGCLqO.exe
  2⤵
  PID:12572
- C:\Windows\System\gYAcqFv.exe
  C:\Windows\System\gYAcqFv.exe
  2⤵
  PID:2272
- C:\Windows\System\SxYfsaI.exe
  C:\Windows\System\SxYfsaI.exe
  2⤵
  PID:908
- C:\Windows\System\wASoiaI.exe
  C:\Windows\System\wASoiaI.exe
  2⤵
  PID:7604
- C:\Windows\System\chIPbEu.exe
  C:\Windows\System\chIPbEu.exe
  2⤵
  PID:2620
- C:\Windows\System\GkmTjBG.exe
  C:\Windows\System\GkmTjBG.exe
  2⤵
  PID:3400
- C:\Windows\System\tRlUugd.exe
  C:\Windows\System\tRlUugd.exe
  2⤵
  PID:3664
- C:\Windows\System\KurDRUM.exe
  C:\Windows\System\KurDRUM.exe
  2⤵
  PID:2756
- C:\Windows\System\HtXoEAf.exe
  C:\Windows\System\HtXoEAf.exe
  2⤵
  PID:12976
- C:\Windows\System\jsomyWI.exe
  C:\Windows\System\jsomyWI.exe
  2⤵
  PID:5560
- C:\Windows\System\aHveGcz.exe
  C:\Windows\System\aHveGcz.exe
  2⤵
  PID:5592
- C:\Windows\System\GdoDyhi.exe
  C:\Windows\System\GdoDyhi.exe
  2⤵
  PID:4856
- C:\Windows\System\KtkaeYQ.exe
  C:\Windows\System\KtkaeYQ.exe
  2⤵
  PID:3476
- C:\Windows\System\QmQnnoy.exe
  C:\Windows\System\QmQnnoy.exe
  2⤵
  PID:2884
- C:\Windows\System\lPewVuV.exe
  C:\Windows\System\lPewVuV.exe
  2⤵
  PID:408
- C:\Windows\System\ttVDzxa.exe
  C:\Windows\System\ttVDzxa.exe
  2⤵
  PID:4656
- C:\Windows\System\Wenlrbg.exe
  C:\Windows\System\Wenlrbg.exe
  2⤵
  PID:4928
- C:\Windows\System\WDlmQYl.exe
  C:\Windows\System\WDlmQYl.exe
  2⤵
  PID:5672
- C:\Windows\System\VxPqLuW.exe
  C:\Windows\System\VxPqLuW.exe
  2⤵
  PID:13152
- C:\Windows\System\eeFXqXu.exe
  C:\Windows\System\eeFXqXu.exe
  2⤵
  PID:5828
- C:\Windows\System\dDXUUQL.exe
  C:\Windows\System\dDXUUQL.exe
  2⤵
  PID:7384
- C:\Windows\System\AVrGzLZ.exe
  C:\Windows\System\AVrGzLZ.exe
  2⤵
  PID:4012
- C:\Windows\System\HAQSPSe.exe
  C:\Windows\System\HAQSPSe.exe
  2⤵
  PID:5928
- C:\Windows\System\BFESKns.exe
  C:\Windows\System\BFESKns.exe
  2⤵
  PID:4276
- C:\Windows\System\RCKBsHu.exe
  C:\Windows\System\RCKBsHu.exe
  2⤵
  PID:2556
- C:\Windows\System\KVyfXkH.exe
  C:\Windows\System\KVyfXkH.exe
  2⤵
  PID:4568
- C:\Windows\System\WfrjEVk.exe
  C:\Windows\System\WfrjEVk.exe
  2⤵
  PID:6020
- C:\Windows\System\akTwuRt.exe
  C:\Windows\System\akTwuRt.exe
  2⤵
  PID:4840
- C:\Windows\System\umStTKe.exe
  C:\Windows\System\umStTKe.exe
  2⤵
  PID:13016
- C:\Windows\System\OATCVyv.exe
  C:\Windows\System\OATCVyv.exe
  2⤵
  PID:13332
- C:\Windows\System\TKGOUby.exe
  C:\Windows\System\TKGOUby.exe
  2⤵
  PID:13348
- C:\Windows\System\WnVjAZG.exe
  C:\Windows\System\WnVjAZG.exe
  2⤵
  PID:13368
- C:\Windows\System\nWjiwBh.exe
  C:\Windows\System\nWjiwBh.exe
  2⤵
  PID:13388
- C:\Windows\System\hmisnhA.exe
  C:\Windows\System\hmisnhA.exe
  2⤵
  PID:13404
- C:\Windows\System\YApmFiO.exe
  C:\Windows\System\YApmFiO.exe
  2⤵
  PID:13424
- C:\Windows\System\bIdqEwd.exe
  C:\Windows\System\bIdqEwd.exe
  2⤵
  PID:13440
- C:\Windows\System\kCiuWqM.exe
  C:\Windows\System\kCiuWqM.exe
  2⤵
  PID:13476
- C:\Windows\System\ntfNbEB.exe
  C:\Windows\System\ntfNbEB.exe
  2⤵
  PID:13508
- C:\Windows\System\cYtrIUZ.exe
  C:\Windows\System\cYtrIUZ.exe
  2⤵
  PID:13528
- C:\Windows\System\JIZmyNa.exe
  C:\Windows\System\JIZmyNa.exe
  2⤵
  PID:13544
- C:\Windows\System\mQSVxjP.exe
  C:\Windows\System\mQSVxjP.exe
  2⤵
  PID:13568
- C:\Windows\System\TMtfjjh.exe
  C:\Windows\System\TMtfjjh.exe
  2⤵
  PID:13592
- C:\Windows\System\lmNHtUL.exe
  C:\Windows\System\lmNHtUL.exe
  2⤵
  PID:13616
- C:\Windows\System\KjhifmD.exe
  C:\Windows\System\KjhifmD.exe
  2⤵
  PID:13636
- C:\Windows\System\GKziSQl.exe
  C:\Windows\System\GKziSQl.exe
  2⤵
  PID:13656
- C:\Windows\System\vAKFLaB.exe
  C:\Windows\System\vAKFLaB.exe
  2⤵
  PID:13676
- C:\Windows\System\iBxnNVh.exe
  C:\Windows\System\iBxnNVh.exe
  2⤵
  PID:13700
- C:\Windows\System\RJDDMCz.exe
  C:\Windows\System\RJDDMCz.exe
  2⤵
  PID:13716
- C:\Windows\System\XHRVotx.exe
  C:\Windows\System\XHRVotx.exe
  2⤵
  PID:13740
- C:\Windows\System\Idrhugw.exe
  C:\Windows\System\Idrhugw.exe
  2⤵
  PID:13764
- C:\Windows\System\FhiMVMe.exe
  C:\Windows\System\FhiMVMe.exe
  2⤵
  PID:13780
- C:\Windows\System\ENGVYpI.exe
  C:\Windows\System\ENGVYpI.exe
  2⤵
  PID:13800
- C:\Windows\System\VDmlPKy.exe
  C:\Windows\System\VDmlPKy.exe
  2⤵
  PID:13820
- C:\Windows\System\gBsSfAg.exe
  C:\Windows\System\gBsSfAg.exe
  2⤵
  PID:14172
- C:\Windows\System\nHYSpdO.exe
  C:\Windows\System\nHYSpdO.exe
  2⤵
  PID:3612
- C:\Windows\System\zOGHJLU.exe
  C:\Windows\System\zOGHJLU.exe
  2⤵
  PID:13520
- C:\Windows\System\xngODIF.exe
  C:\Windows\System\xngODIF.exe
  2⤵
  PID:5616
- C:\Windows\System\PkerSbK.exe
  C:\Windows\System\PkerSbK.exe
  2⤵
  PID:2776
- C:\Windows\System\rxUbFIU.exe
  C:\Windows\System\rxUbFIU.exe
  2⤵
  PID:13276
- C:\Windows\System\qNovgLh.exe
  C:\Windows\System\qNovgLh.exe
  2⤵
  PID:2680
- C:\Windows\System\NWjmizl.exe
  C:\Windows\System\NWjmizl.exe
  2⤵
  PID:14008
- C:\Windows\System\hFFeVbA.exe
  C:\Windows\System\hFFeVbA.exe
  2⤵
  PID:13564
- C:\Windows\System\AZrChXQ.exe
  C:\Windows\System\AZrChXQ.exe
  2⤵
  PID:13880
- C:\Windows\System\tCuvfHT.exe
  C:\Windows\System\tCuvfHT.exe
  2⤵
  PID:14256
- C:\Windows\System\dDaiBbn.exe
  C:\Windows\System\dDaiBbn.exe
  2⤵
  PID:13460
- C:\Windows\System\ooyzYYp.exe
  C:\Windows\System\ooyzYYp.exe
  2⤵
  PID:14196
- C:\Windows\System\FHsoQli.exe
  C:\Windows\System\FHsoQli.exe
  2⤵
  PID:2696
- C:\Windows\System\ywOwLgA.exe
  C:\Windows\System\ywOwLgA.exe
  2⤵
  PID:5620
- C:\Windows\System\MUJrGoV.exe
  C:\Windows\System\MUJrGoV.exe
  2⤵
  PID:540
- C:\Windows\System\zXXAzZQ.exe
  C:\Windows\System\zXXAzZQ.exe
  2⤵
  PID:6072
- C:\Windows\System\QqCqQXt.exe
  C:\Windows\System\QqCqQXt.exe
  2⤵
  PID:14280
- C:\Windows\System\lRNzgVz.exe
  C:\Windows\System\lRNzgVz.exe
  2⤵
  PID:14304
- C:\Windows\System\mwKIcFz.exe
  C:\Windows\System\mwKIcFz.exe
  2⤵
  PID:14324
- C:\Windows\System\KtdxOkv.exe
  C:\Windows\System\KtdxOkv.exe
  2⤵
  PID:13324
- C:\Windows\System\ABGZSve.exe
  C:\Windows\System\ABGZSve.exe
  2⤵
  PID:1364
- C:\Windows\System\EEPzhQE.exe
  C:\Windows\System\EEPzhQE.exe
  2⤵
  PID:2212
- C:\Windows\System\wIeCINm.exe
  C:\Windows\System\wIeCINm.exe
  2⤵
  PID:2100
- C:\Windows\System\YeSADyA.exe
  C:\Windows\System\YeSADyA.exe
  2⤵
  PID:4804
- C:\Windows\System\iCBRdgk.exe
  C:\Windows\System\iCBRdgk.exe
  2⤵
  PID:5708
- C:\Windows\System\EOApyfF.exe
  C:\Windows\System\EOApyfF.exe
  2⤵
  PID:4520
- C:\Windows\System\IjrhoNa.exe
  C:\Windows\System\IjrhoNa.exe
  2⤵
  PID:8384
- C:\Windows\System\IWKILce.exe
  C:\Windows\System\IWKILce.exe
  2⤵
  PID:2036
- C:\Windows\System\ErCkSnI.exe
  C:\Windows\System\ErCkSnI.exe
  2⤵
  PID:13416
- C:\Windows\System\TVoIwRz.exe
  C:\Windows\System\TVoIwRz.exe
  2⤵
  PID:6060
- C:\Windows\System\TFmvnEH.exe
  C:\Windows\System\TFmvnEH.exe
  2⤵
  PID:13980
- C:\Windows\System\QBUICBu.exe
  C:\Windows\System\QBUICBu.exe
  2⤵
  PID:14244
- C:\Windows\System\BjLwCgk.exe
  C:\Windows\System\BjLwCgk.exe
  2⤵
  PID:13828
- C:\Windows\System\mVbHJMw.exe
  C:\Windows\System\mVbHJMw.exe
  2⤵
  PID:13728
- C:\Windows\System\YsMASYl.exe
  C:\Windows\System\YsMASYl.exe
  2⤵
  PID:6040
- C:\Windows\System\mJNQicg.exe
  C:\Windows\System\mJNQicg.exe
  2⤵
  PID:6112
- C:\Windows\System\vsBJIIf.exe
  C:\Windows\System\vsBJIIf.exe
  2⤵
  PID:14208
- C:\Windows\System\bzpMyrV.exe
  C:\Windows\System\bzpMyrV.exe
  2⤵
  PID:13936
- C:\Windows\System\gXFjaQk.exe
  C:\Windows\System\gXFjaQk.exe
  2⤵
  PID:4472
- C:\Windows\System\oAtilXM.exe
  C:\Windows\System\oAtilXM.exe
  2⤵
  PID:13400
- C:\Windows\System\fspjYfr.exe
  C:\Windows\System\fspjYfr.exe
  2⤵
  PID:6064
- C:\Windows\System\BvqQLcy.exe
  C:\Windows\System\BvqQLcy.exe
  2⤵
  PID:2448
- C:\Windows\System\hQHnJkr.exe
  C:\Windows\System\hQHnJkr.exe
  2⤵
  PID:6680
- C:\Windows\System\vdeFeEk.exe
  C:\Windows\System\vdeFeEk.exe
  2⤵
  PID:6372
- C:\Windows\System\pxqhnyC.exe
  C:\Windows\System\pxqhnyC.exe
  2⤵
  PID:13380
- C:\Windows\System\LdBjbbF.exe
  C:\Windows\System\LdBjbbF.exe
  2⤵
  PID:6192
- C:\Windows\System\PHnszIz.exe
  C:\Windows\System\PHnszIz.exe
  2⤵
  PID:5204
- C:\Windows\System\sFZvPcP.exe
  C:\Windows\System\sFZvPcP.exe
  2⤵
  PID:13560
- C:\Windows\System\iNWrEnX.exe
  C:\Windows\System\iNWrEnX.exe
  2⤵
  PID:5400
- C:\Windows\System\elULTHM.exe
  C:\Windows\System\elULTHM.exe
  2⤵
  PID:14284
- C:\Windows\System\XCxCtTH.exe
  C:\Windows\System\XCxCtTH.exe
  2⤵
  PID:14316
- C:\Windows\System\rsRnGjY.exe
  C:\Windows\System\rsRnGjY.exe
  2⤵
  PID:5764
- C:\Windows\System\jkbsdWO.exe
  C:\Windows\System\jkbsdWO.exe
  2⤵
  PID:14124
- C:\Windows\System\PuiDcTV.exe
  C:\Windows\System\PuiDcTV.exe
  2⤵
  PID:6944
- C:\Windows\System\ugWqEcv.exe
  C:\Windows\System\ugWqEcv.exe
  2⤵
  PID:12400
- C:\Windows\System\YSeMOOl.exe
  C:\Windows\System\YSeMOOl.exe
  2⤵
  PID:14264
- C:\Windows\System\VoSkvBL.exe
  C:\Windows\System\VoSkvBL.exe
  2⤵
  PID:14300
- C:\Windows\System\wplpEFR.exe
  C:\Windows\System\wplpEFR.exe
  2⤵
  PID:6592
- C:\Windows\System\ZHNVMrs.exe
  C:\Windows\System\ZHNVMrs.exe
  2⤵
  PID:14156
- C:\Windows\System\QNosNkk.exe
  C:\Windows\System\QNosNkk.exe
  2⤵
  PID:7108
- C:\Windows\System\jWpffMe.exe
  C:\Windows\System\jWpffMe.exe
  2⤵
  PID:13776
- C:\Windows\System\dhuwvsq.exe
  C:\Windows\System\dhuwvsq.exe
  2⤵
  PID:4736
- C:\Windows\System\ODdQHGn.exe
  C:\Windows\System\ODdQHGn.exe
  2⤵
  PID:6128
- C:\Windows\System\fHTSzaX.exe
  C:\Windows\System\fHTSzaX.exe
  2⤵
  PID:3112
- C:\Windows\System\PGFAoKb.exe
  C:\Windows\System\PGFAoKb.exe
  2⤵
  PID:12356
- C:\Windows\System\NdFEHkH.exe
  C:\Windows\System\NdFEHkH.exe
  2⤵
  PID:6656
- C:\Windows\System\IbVFTJx.exe
  C:\Windows\System\IbVFTJx.exe
  2⤵
  PID:10672
- C:\Windows\System\iSBZtwK.exe
  C:\Windows\System\iSBZtwK.exe
  2⤵
  PID:5604
- C:\Windows\System\ozUdjGj.exe
  C:\Windows\System\ozUdjGj.exe
  2⤵
  PID:13892
- C:\Windows\System\ADmRjaQ.exe
  C:\Windows\System\ADmRjaQ.exe
  2⤵
  PID:3124
- C:\Windows\System\jOvSaYk.exe
  C:\Windows\System\jOvSaYk.exe
  2⤵
  PID:1400
- C:\Windows\System\Cafeqbn.exe
  C:\Windows\System\Cafeqbn.exe
  2⤵
  PID:508
- C:\Windows\System\ShpqtNq.exe
  C:\Windows\System\ShpqtNq.exe
  2⤵
  PID:2300
- C:\Windows\System\arejPeW.exe
  C:\Windows\System\arejPeW.exe
  2⤵
  PID:13320
- C:\Windows\System\EhuPyis.exe
  C:\Windows\System\EhuPyis.exe
  2⤵
  PID:5536
- C:\Windows\System\MgakBCn.exe
  C:\Windows\System\MgakBCn.exe
  2⤵
  PID:6096
- C:\Windows\System\HwlgftO.exe
  C:\Windows\System\HwlgftO.exe
  2⤵
  PID:6404
- C:\Windows\System\snFLUfM.exe
  C:\Windows\System\snFLUfM.exe
  2⤵
  PID:7480
- C:\Windows\System\fGbXXNa.exe
  C:\Windows\System\fGbXXNa.exe
  2⤵
  PID:5600
- C:\Windows\System\xAZMCzr.exe
  C:\Windows\System\xAZMCzr.exe
  2⤵
  PID:13384
- C:\Windows\System\LPqIsKZ.exe
  C:\Windows\System\LPqIsKZ.exe
  2⤵
  PID:14080
- C:\Windows\System\WQcfusq.exe
  C:\Windows\System\WQcfusq.exe
  2⤵
  PID:6320
- C:\Windows\System\ADSPWYV.exe
  C:\Windows\System\ADSPWYV.exe
  2⤵
  PID:6252
- C:\Windows\System\slOEQgM.exe
  C:\Windows\System\slOEQgM.exe
  2⤵
  PID:13844
- C:\Windows\System\UqsQzps.exe
  C:\Windows\System\UqsQzps.exe
  2⤵
  PID:6052
- C:\Windows\System\mUfpBKC.exe
  C:\Windows\System\mUfpBKC.exe
  2⤵
  PID:6664
- C:\Windows\System\OKzpkVq.exe
  C:\Windows\System\OKzpkVq.exe
  2⤵
  PID:6188
- C:\Windows\System\QLeqJnv.exe
  C:\Windows\System\QLeqJnv.exe
  2⤵
  PID:7332
- C:\Windows\System\jVYuaKJ.exe
  C:\Windows\System\jVYuaKJ.exe
  2⤵
  PID:7352
- C:\Windows\System\OWQhVlu.exe
  C:\Windows\System\OWQhVlu.exe
  2⤵
  PID:6584
- C:\Windows\System\PSDNYFQ.exe
  C:\Windows\System\PSDNYFQ.exe
  2⤵
  PID:6796
- C:\Windows\System\kPQweAw.exe
  C:\Windows\System\kPQweAw.exe
  2⤵
  PID:5244
- C:\Windows\System\fEiOIMp.exe
  C:\Windows\System\fEiOIMp.exe
  2⤵
  PID:7692
- C:\Windows\System\hbhxCXr.exe
  C:\Windows\System\hbhxCXr.exe
  2⤵
  PID:14344
- C:\Windows\System\IkFhxfu.exe
  C:\Windows\System\IkFhxfu.exe
  2⤵
  PID:14364
- C:\Windows\System\zPVvLqL.exe
  C:\Windows\System\zPVvLqL.exe
  2⤵
  PID:14388
- C:\Windows\System\envTiWf.exe
  C:\Windows\System\envTiWf.exe
  2⤵
  PID:14416
- C:\Windows\System\KSXrOag.exe
  C:\Windows\System\KSXrOag.exe
  2⤵
  PID:14436
- C:\Windows\System\fRbrRix.exe
  C:\Windows\System\fRbrRix.exe
  2⤵
  PID:14452
- C:\Windows\System\soatLyf.exe
  C:\Windows\System\soatLyf.exe
  2⤵
  PID:14672
- C:\Windows\System\zWJNijF.exe
  C:\Windows\System\zWJNijF.exe
  2⤵
  PID:14704
- C:\Windows\System\GYopBfR.exe
  C:\Windows\System\GYopBfR.exe
  2⤵
  PID:14724
- C:\Windows\System\ugRTATp.exe
  C:\Windows\System\ugRTATp.exe
  2⤵
  PID:14748
- C:\Windows\System\tlfHwsR.exe
  C:\Windows\System\tlfHwsR.exe
  2⤵
  PID:14764
- C:\Windows\System\hwCXGUd.exe
  C:\Windows\System\hwCXGUd.exe
  2⤵
  PID:14784
- C:\Windows\System\LaYMWBR.exe
  C:\Windows\System\LaYMWBR.exe
  2⤵
  PID:14804
- C:\Windows\System\ojHGtdB.exe
  C:\Windows\System\ojHGtdB.exe
  2⤵
  PID:14820
- C:\Windows\System\vAUOHqw.exe
  C:\Windows\System\vAUOHqw.exe
  2⤵
  PID:14840
- C:\Windows\System\BOsiUYS.exe
  C:\Windows\System\BOsiUYS.exe
  2⤵
  PID:14860
- C:\Windows\System\QhkPUPH.exe
  C:\Windows\System\QhkPUPH.exe
  2⤵
  PID:14880
- C:\Windows\System\LLuriho.exe
  C:\Windows\System\LLuriho.exe
  2⤵
  PID:14900
- C:\Windows\System\resTiST.exe
  C:\Windows\System\resTiST.exe
  2⤵
  PID:14920
- C:\Windows\System\zmIwDVt.exe
  C:\Windows\System\zmIwDVt.exe
  2⤵
  PID:14936
- C:\Windows\System\pVeDjCo.exe
  C:\Windows\System\pVeDjCo.exe
  2⤵
  PID:14956
- C:\Windows\System\fQxVzss.exe
  C:\Windows\System\fQxVzss.exe
  2⤵
  PID:14972
- C:\Windows\System\HRVpEpJ.exe
  C:\Windows\System\HRVpEpJ.exe
  2⤵
  PID:14988
- C:\Windows\System\fxFKLdG.exe
  C:\Windows\System\fxFKLdG.exe
  2⤵
  PID:15004
- C:\Windows\System\tFISWzN.exe
  C:\Windows\System\tFISWzN.exe
  2⤵
  PID:15028
- C:\Windows\System\FrcnczL.exe
  C:\Windows\System\FrcnczL.exe
  2⤵
  PID:15052
- C:\Windows\System\exyRBul.exe
  C:\Windows\System\exyRBul.exe
  2⤵
  PID:15076
- C:\Windows\System\whrsWla.exe
  C:\Windows\System\whrsWla.exe
  2⤵
  PID:15096
- C:\Windows\System\UgpZFqj.exe
  C:\Windows\System\UgpZFqj.exe
  2⤵
  PID:13468
- C:\Windows\System\FlTpKQd.exe
  C:\Windows\System\FlTpKQd.exe
  2⤵
  PID:4492
- C:\Windows\System\jOWOvIB.exe
  C:\Windows\System\jOWOvIB.exe
  2⤵
  PID:13188
- C:\Windows\System\CcfxWpy.exe
  C:\Windows\System\CcfxWpy.exe
  2⤵
  PID:10184
- C:\Windows\System\mvPpxiu.exe
  C:\Windows\System\mvPpxiu.exe
  2⤵
  PID:8304
- C:\Windows\System\WSjBtlh.exe
  C:\Windows\System\WSjBtlh.exe
  2⤵
  PID:7936
- C:\Windows\System\BePFPoR.exe
  C:\Windows\System\BePFPoR.exe
  2⤵
  PID:14372
- C:\Windows\System\eEutZNQ.exe
  C:\Windows\System\eEutZNQ.exe
  2⤵
  PID:3120
- C:\Windows\System\IQbqgzI.exe
  C:\Windows\System\IQbqgzI.exe
  2⤵
  PID:14664
- C:\Windows\System\LhzoNIj.exe
  C:\Windows\System\LhzoNIj.exe
  2⤵
  PID:5268
- C:\Windows\System\znJHhhG.exe
  C:\Windows\System\znJHhhG.exe
  2⤵
  PID:7832
- C:\Windows\System\uhMwpzs.exe
  C:\Windows\System\uhMwpzs.exe
  2⤵
  PID:14776
- C:\Windows\System\GNTcyya.exe
  C:\Windows\System\GNTcyya.exe
  2⤵
  PID:5420
- C:\Windows\System\ZVJNXIv.exe
  C:\Windows\System\ZVJNXIv.exe
  2⤵
  PID:6212
- C:\Windows\System\ETwSaod.exe
  C:\Windows\System\ETwSaod.exe
  2⤵
  PID:7672
- C:\Windows\System\BZFxSHO.exe
  C:\Windows\System\BZFxSHO.exe
  2⤵
  PID:14600
- C:\Windows\System\CVXLxFb.exe
  C:\Windows\System\CVXLxFb.exe
  2⤵
  PID:14616
- C:\Windows\System\iYUXOyR.exe
  C:\Windows\System\iYUXOyR.exe
  2⤵
  PID:14488
- C:\Windows\System\hCTTwgR.exe
  C:\Windows\System\hCTTwgR.exe
  2⤵
  PID:14816
- C:\Windows\System\uhxKryW.exe
  C:\Windows\System\uhxKryW.exe
  2⤵
  PID:14516
- C:\Windows\System\PVYwYNW.exe
  C:\Windows\System\PVYwYNW.exe
  2⤵
  PID:14556
- C:\Windows\System\UzmARTN.exe
  C:\Windows\System\UzmARTN.exe
  2⤵
  PID:14588
- C:\Windows\System\RjebFdU.exe
  C:\Windows\System\RjebFdU.exe
  2⤵
  PID:15188
- C:\Windows\System\wvZNrdC.exe
  C:\Windows\System\wvZNrdC.exe
  2⤵
  PID:7428
- C:\Windows\System\AQOeubI.exe
  C:\Windows\System\AQOeubI.exe
  2⤵
  PID:14636
- C:\Windows\System\zpJJBPM.exe
  C:\Windows\System\zpJJBPM.exe
  2⤵
  PID:14720
- C:\Windows\System\OLBMyiL.exe
  C:\Windows\System\OLBMyiL.exe
  2⤵
  PID:14668
- C:\Windows\System\jGjVuUe.exe
  C:\Windows\System\jGjVuUe.exe
  2⤵
  PID:15248
- C:\Windows\System\qBSlALH.exe
  C:\Windows\System\qBSlALH.exe
  2⤵
  PID:9976
- C:\Windows\System\jPiHBSw.exe
  C:\Windows\System\jPiHBSw.exe
  2⤵
  PID:15296
- C:\Windows\System\TTjTkRs.exe
  C:\Windows\System\TTjTkRs.exe
  2⤵
  PID:6972
- C:\Windows\System\JbNbmKv.exe
  C:\Windows\System\JbNbmKv.exe
  2⤵
  PID:15344
- C:\Windows\System\WIjRufd.exe
  C:\Windows\System\WIjRufd.exe
  2⤵
  PID:7288
- C:\Windows\System\FKQmJnr.exe
  C:\Windows\System\FKQmJnr.exe
  2⤵
  PID:9780
- C:\Windows\System\rGsalgr.exe
  C:\Windows\System\rGsalgr.exe
  2⤵
  PID:8792
- C:\Windows\System\lcdpeGo.exe
  C:\Windows\System\lcdpeGo.exe
  2⤵
  PID:8608
- C:\Windows\System\KUKVXwy.exe
  C:\Windows\System\KUKVXwy.exe
  2⤵
  PID:8592
- C:\Windows\System\WQWmuXy.exe
  C:\Windows\System\WQWmuXy.exe
  2⤵
  PID:6924
- C:\Windows\System\VyDBvlM.exe
  C:\Windows\System\VyDBvlM.exe
  2⤵
  PID:6304
- C:\Windows\System\gDqNdyX.exe
  C:\Windows\System\gDqNdyX.exe
  2⤵
  PID:7232
- C:\Windows\System\hZDeFUv.exe
  C:\Windows\System\hZDeFUv.exe
  2⤵
  PID:12520
- C:\Windows\System\XzCRnCn.exe
  C:\Windows\System\XzCRnCn.exe
  2⤵
  PID:7576
- C:\Windows\System\yUBFpGq.exe
  C:\Windows\System\yUBFpGq.exe
  2⤵
  PID:7660
- C:\Windows\System\CfCJgts.exe
  C:\Windows\System\CfCJgts.exe
  2⤵
  PID:4744
- C:\Windows\System\hdZcXAN.exe
  C:\Windows\System\hdZcXAN.exe
  2⤵
  PID:1256
- C:\Windows\System\HGJUUxB.exe
  C:\Windows\System\HGJUUxB.exe
  2⤵
  PID:7884
- C:\Windows\System\StWHWpa.exe
  C:\Windows\System\StWHWpa.exe
  2⤵
  PID:6168
- C:\Windows\System\SKYQpXx.exe
  C:\Windows\System\SKYQpXx.exe
  2⤵
  PID:5156
- C:\Windows\System\VsEhNyN.exe
  C:\Windows\System\VsEhNyN.exe
  2⤵
  PID:13340
- C:\Windows\System\GKGVTtF.exe
  C:\Windows\System\GKGVTtF.exe
  2⤵
  PID:7928
- C:\Windows\System\acQmBoG.exe
  C:\Windows\System\acQmBoG.exe
  2⤵
  PID:8004
- C:\Windows\System\GEbtzRC.exe
  C:\Windows\System\GEbtzRC.exe
  2⤵
  PID:7796
- C:\Windows\System\fQrLUsX.exe
  C:\Windows\System\fQrLUsX.exe
  2⤵
  PID:6444
- C:\Windows\System\ALkbyeu.exe
  C:\Windows\System\ALkbyeu.exe
  2⤵
  PID:8252
- C:\Windows\System\zpyYWVY.exe
  C:\Windows\System\zpyYWVY.exe
  2⤵
  PID:8888
- C:\Windows\System\ecKTSZP.exe
  C:\Windows\System\ecKTSZP.exe
  2⤵
  PID:8180
- C:\Windows\System\HekUpdK.exe
  C:\Windows\System\HekUpdK.exe
  2⤵
  PID:6756
- C:\Windows\System\ZYSpAgs.exe
  C:\Windows\System\ZYSpAgs.exe
  2⤵
  PID:9280
- C:\Windows\System\bOVNXLE.exe
  C:\Windows\System\bOVNXLE.exe
  2⤵
  PID:10592
- C:\Windows\System\NTPVuUN.exe
  C:\Windows\System\NTPVuUN.exe
  2⤵
  PID:10288
- C:\Windows\System\lqFrYdw.exe
  C:\Windows\System\lqFrYdw.exe
  2⤵
  PID:9736
- C:\Windows\System\GyemGij.exe
  C:\Windows\System\GyemGij.exe
  2⤵
  PID:1476
- C:\Windows\System\agJFEYJ.exe
  C:\Windows\System\agJFEYJ.exe
  2⤵
  PID:10264
- C:\Windows\System\SewRHbn.exe
  C:\Windows\System\SewRHbn.exe
  2⤵
  PID:13796
- C:\Windows\System\ffIdXSd.exe
  C:\Windows\System\ffIdXSd.exe
  2⤵
  PID:10848
- C:\Windows\System\KaQfCuq.exe
  C:\Windows\System\KaQfCuq.exe
  2⤵
  PID:9192
- C:\Windows\System\byVbNnp.exe
  C:\Windows\System\byVbNnp.exe
  2⤵
  PID:9248
- C:\Windows\System\NLHFanV.exe
  C:\Windows\System\NLHFanV.exe
  2⤵
  PID:11012
- C:\Windows\System\mDHvPNl.exe
  C:\Windows\System\mDHvPNl.exe
  2⤵
  PID:8224
- C:\Windows\System\IhgnYdJ.exe
  C:\Windows\System\IhgnYdJ.exe
  2⤵
  PID:5436
- C:\Windows\System\zkVxvjN.exe
  C:\Windows\System\zkVxvjN.exe
  2⤵
  PID:9092
- C:\Windows\System\EQabdgW.exe
  C:\Windows\System\EQabdgW.exe
  2⤵
  PID:4516
- C:\Windows\System\MvZTfpV.exe
  C:\Windows\System\MvZTfpV.exe
  2⤵
  PID:3688
- C:\Windows\System\tRMElYc.exe
  C:\Windows\System\tRMElYc.exe
  2⤵
  PID:6848
- C:\Windows\System\QvjjDim.exe
  C:\Windows\System\QvjjDim.exe
  2⤵
  PID:7392
- C:\Windows\System\GWKapJa.exe
  C:\Windows\System\GWKapJa.exe
  2⤵
  PID:8632
- C:\Windows\System\dopVSSt.exe
  C:\Windows\System\dopVSSt.exe
  2⤵
  PID:8268
- C:\Windows\System\YfDEOqG.exe
  C:\Windows\System\YfDEOqG.exe
  2⤵
  PID:10720
- C:\Windows\System\QLWKocz.exe
  C:\Windows\System\QLWKocz.exe
  2⤵
  PID:15092
- C:\Windows\System\NvywsjK.exe
  C:\Windows\System\NvywsjK.exe
  2⤵
  PID:8008
- C:\Windows\System\EzgEIps.exe
  C:\Windows\System\EzgEIps.exe
  2⤵
  PID:8740
- C:\Windows\System\xNJTJVU.exe
  C:\Windows\System\xNJTJVU.exe
  2⤵
  PID:9492
- C:\Windows\System\JUwbAmx.exe
  C:\Windows\System\JUwbAmx.exe
  2⤵
  PID:14832
- C:\Windows\System\aJoJmxa.exe
  C:\Windows\System\aJoJmxa.exe
  2⤵
  PID:9684
- C:\Windows\System\EwGvQQz.exe
  C:\Windows\System\EwGvQQz.exe
  2⤵
  PID:13900
- C:\Windows\System\BZowGfk.exe
  C:\Windows\System\BZowGfk.exe
  2⤵
  PID:10964
- C:\Windows\System\LOyZLZk.exe
  C:\Windows\System\LOyZLZk.exe
  2⤵
  PID:8704
- C:\Windows\System\HblVsFh.exe
  C:\Windows\System\HblVsFh.exe
  2⤵
  PID:7952
- C:\Windows\System\vEuFHGG.exe
  C:\Windows\System\vEuFHGG.exe
  2⤵
  PID:9760
- C:\Windows\System\jiOMlUU.exe
  C:\Windows\System\jiOMlUU.exe
  2⤵
  PID:7444
- C:\Windows\System\RtsGUBu.exe
  C:\Windows\System\RtsGUBu.exe
  2⤵
  PID:11996
- C:\Windows\System\bcQuoPs.exe
  C:\Windows\System\bcQuoPs.exe
  2⤵
  PID:14356
- C:\Windows\System\LlojoJA.exe
  C:\Windows\System\LlojoJA.exe
  2⤵
  PID:9328
- C:\Windows\System\KuuQqQQ.exe
  C:\Windows\System\KuuQqQQ.exe
  2⤵
  PID:1540
- C:\Windows\System\mHzzQxN.exe
  C:\Windows\System\mHzzQxN.exe
  2⤵
  PID:5512
- C:\Windows\System\RMgTXaL.exe
  C:\Windows\System\RMgTXaL.exe
  2⤵
  PID:14964
- C:\Windows\System\AcqwhhL.exe
  C:\Windows\System\AcqwhhL.exe
  2⤵
  PID:12108
- C:\Windows\System\XZulSpN.exe
  C:\Windows\System\XZulSpN.exe
  2⤵
  PID:14596
- C:\Windows\System\UdxIRuM.exe
  C:\Windows\System\UdxIRuM.exe
  2⤵
  PID:9368
- C:\Windows\System\AACIuCw.exe
  C:\Windows\System\AACIuCw.exe
  2⤵
  PID:10572
- C:\Windows\System\esxeUJx.exe
  C:\Windows\System\esxeUJx.exe
  2⤵
  PID:10472
- C:\Windows\System\owjduxz.exe
  C:\Windows\System\owjduxz.exe
  2⤵
  PID:8620
- C:\Windows\System\gzXfCgn.exe
  C:\Windows\System\gzXfCgn.exe
  2⤵
  PID:14916
- C:\Windows\System\KubAXUz.exe
  C:\Windows\System\KubAXUz.exe
  2⤵
  PID:14004
- C:\Windows\System\qkjoqvT.exe
  C:\Windows\System\qkjoqvT.exe
  2⤵
  PID:10164
- C:\Windows\System\gTpcauI.exe
  C:\Windows\System\gTpcauI.exe
  2⤵
  PID:8164
- C:\Windows\System\VlmsXhG.exe
  C:\Windows\System\VlmsXhG.exe
  2⤵
  PID:9728
- C:\Windows\System\TOKaWrl.exe
  C:\Windows\System\TOKaWrl.exe
  2⤵
  PID:14260
- C:\Windows\System\KvQqIMS.exe
  C:\Windows\System\KvQqIMS.exe
  2⤵
  PID:8588
- C:\Windows\System\PHCxBrr.exe
  C:\Windows\System\PHCxBrr.exe
  2⤵
  PID:9972
- C:\Windows\System\OXcStTM.exe
  C:\Windows\System\OXcStTM.exe
  2⤵
  PID:8120
- C:\Windows\System\ZFYOiER.exe
  C:\Windows\System\ZFYOiER.exe
  2⤵
  PID:9360
- C:\Windows\System\WAxBeEf.exe
  C:\Windows\System\WAxBeEf.exe
  2⤵
  PID:14760
- C:\Windows\System\GBgKofC.exe
  C:\Windows\System\GBgKofC.exe
  2⤵
  PID:6968
- C:\Windows\System\DxZujBv.exe
  C:\Windows\System\DxZujBv.exe
  2⤵
  PID:11204
- C:\Windows\System\mtbTbbX.exe
  C:\Windows\System\mtbTbbX.exe
  2⤵
  PID:10632
- C:\Windows\System\KoRcMEI.exe
  C:\Windows\System\KoRcMEI.exe
  2⤵
  PID:7808
- C:\Windows\System\lbuPfwb.exe
  C:\Windows\System\lbuPfwb.exe
  2⤵
  PID:12000
- C:\Windows\System\xTMfeic.exe
  C:\Windows\System\xTMfeic.exe
  2⤵
  PID:9076
- C:\Windows\System\FKunMBw.exe
  C:\Windows\System\FKunMBw.exe
  2⤵
  PID:7684
- C:\Windows\System\YVmQsBv.exe
  C:\Windows\System\YVmQsBv.exe
  2⤵
  PID:9804
- C:\Windows\System\kWzSwqV.exe
  C:\Windows\System\kWzSwqV.exe
  2⤵
  PID:4120
- C:\Windows\System\EMGphkj.exe
  C:\Windows\System\EMGphkj.exe
  2⤵
  PID:12148
- C:\Windows\System\HkNLDff.exe
  C:\Windows\System\HkNLDff.exe
  2⤵
  PID:7552
- C:\Windows\System\LcjJsaL.exe
  C:\Windows\System\LcjJsaL.exe
  2⤵
  PID:6940
- C:\Windows\System\WLtNtpV.exe
  C:\Windows\System\WLtNtpV.exe
  2⤵
  PID:6100
- C:\Windows\System\lpEFUmP.exe
  C:\Windows\System\lpEFUmP.exe
  2⤵
  PID:400
- C:\Windows\System\AwCgEUU.exe
  C:\Windows\System\AwCgEUU.exe
  2⤵
  PID:4820
- C:\Windows\System\owAQnaA.exe
  C:\Windows\System\owAQnaA.exe
  2⤵
  PID:12188
- C:\Windows\System\BzXABTi.exe
  C:\Windows\System\BzXABTi.exe
  2⤵
  PID:9252
- C:\Windows\System\RbDpTxx.exe
  C:\Windows\System\RbDpTxx.exe
  2⤵
  PID:14424
- C:\Windows\System\czYIrdW.exe
  C:\Windows\System\czYIrdW.exe
  2⤵
  PID:12212
- C:\Windows\System\QAJUjbF.exe
  C:\Windows\System\QAJUjbF.exe
  2⤵
  PID:12784
- C:\Windows\System\SydCEVX.exe
  C:\Windows\System\SydCEVX.exe
  2⤵
  PID:11800
- C:\Windows\System\rdvJwSv.exe
  C:\Windows\System\rdvJwSv.exe
  2⤵
  PID:13972
- C:\Windows\System\bkIHxSH.exe
  C:\Windows\System\bkIHxSH.exe
  2⤵
  PID:12028
- C:\Windows\System\ntzbbgp.exe
  C:\Windows\System\ntzbbgp.exe
  2⤵
  PID:15260
- C:\Windows\System\sdKhzqu.exe
  C:\Windows\System\sdKhzqu.exe
  2⤵
  PID:12560
- C:\Windows\System\mVfcMCq.exe
  C:\Windows\System\mVfcMCq.exe
  2⤵
  PID:8692
- C:\Windows\System\eBJwKoR.exe
  C:\Windows\System\eBJwKoR.exe
  2⤵
  PID:10988
- C:\Windows\System\eBJXoqo.exe
  C:\Windows\System\eBJXoqo.exe
  2⤵
  PID:11028
- C:\Windows\System\lvtTqYL.exe
  C:\Windows\System\lvtTqYL.exe
  2⤵
  PID:6672
- C:\Windows\System\kjUtgAr.exe
  C:\Windows\System\kjUtgAr.exe
  2⤵
  PID:9680
- C:\Windows\System\qOlhNVi.exe
  C:\Windows\System\qOlhNVi.exe
  2⤵
  PID:13224
- C:\Windows\System\QIxUFFT.exe
  C:\Windows\System\QIxUFFT.exe
  2⤵
  PID:11484
- C:\Windows\System\VXjEIDb.exe
  C:\Windows\System\VXjEIDb.exe
  2⤵
  PID:12076
- C:\Windows\System\zoXVnGp.exe
  C:\Windows\System\zoXVnGp.exe
  2⤵
  PID:10344
- C:\Windows\System\CfMAmGk.exe
  C:\Windows\System\CfMAmGk.exe
  2⤵
  PID:12724
- C:\Windows\System\iwzHvpf.exe
  C:\Windows\System\iwzHvpf.exe
  2⤵
  PID:10932
- C:\Windows\System\dRCrTPK.exe
  C:\Windows\System\dRCrTPK.exe
  2⤵
  PID:14408
- C:\Windows\System\PYjbHer.exe
  C:\Windows\System\PYjbHer.exe
  2⤵
  PID:8604
- C:\Windows\System\wYiiwsx.exe
  C:\Windows\System\wYiiwsx.exe
  2⤵
  PID:14544
- C:\Windows\System\mbSzdnZ.exe
  C:\Windows\System\mbSzdnZ.exe
  2⤵
  PID:14656
- C:\Windows\System\AftAonR.exe
  C:\Windows\System\AftAonR.exe
  2⤵
  PID:14400
- C:\Windows\System\ZktSaXd.exe
  C:\Windows\System\ZktSaXd.exe
  2⤵
  PID:14828
- C:\Windows\System\OzkmLfp.exe
  C:\Windows\System\OzkmLfp.exe
  2⤵
  PID:13176
- C:\Windows\System\NNgOmFV.exe
  C:\Windows\System\NNgOmFV.exe
  2⤵
  PID:6484
- C:\Windows\System\TrWQwkx.exe
  C:\Windows\System\TrWQwkx.exe
  2⤵
  PID:7024
- C:\Windows\System\VmurNWo.exe
  C:\Windows\System\VmurNWo.exe
  2⤵
  PID:10868
- C:\Windows\System\CSJkKAU.exe
  C:\Windows\System\CSJkKAU.exe
  2⤵
  PID:8060
- C:\Windows\System\aferlPM.exe
  C:\Windows\System\aferlPM.exe
  2⤵
  PID:10576
- C:\Windows\System\vVSGmpA.exe
  C:\Windows\System\vVSGmpA.exe
  2⤵
  PID:4284
- C:\Windows\System\rkjvUvq.exe
  C:\Windows\System\rkjvUvq.exe
  2⤵
  PID:12764
- C:\Windows\System\eamQcTq.exe
  C:\Windows\System\eamQcTq.exe
  2⤵
  PID:10248
- C:\Windows\System\mRGtkoJ.exe
  C:\Windows\System\mRGtkoJ.exe
  2⤵
  PID:9344
- C:\Windows\System\ZegrbUK.exe
  C:\Windows\System\ZegrbUK.exe
  2⤵
  PID:2500
- C:\Windows\System\TYTJtnV.exe
  C:\Windows\System\TYTJtnV.exe
  2⤵
  PID:12012
- C:\Windows\System\yYuUoxv.exe
  C:\Windows\System\yYuUoxv.exe
  2⤵
  PID:10560
- C:\Windows\System\qawmomB.exe
  C:\Windows\System\qawmomB.exe
  2⤵
  PID:11256
- C:\Windows\System\BXvEkeW.exe
  C:\Windows\System\BXvEkeW.exe
  2⤵
  PID:12636
- C:\Windows\System\VPeEfiH.exe
  C:\Windows\System\VPeEfiH.exe
  2⤵
  PID:11416
- C:\Windows\System\ddfKWSU.exe
  C:\Windows\System\ddfKWSU.exe
  2⤵
  PID:11228
- C:\Windows\System\TJZQgvH.exe
  C:\Windows\System\TJZQgvH.exe
  2⤵
  PID:10536
- C:\Windows\System\GfaGLZG.exe
  C:\Windows\System\GfaGLZG.exe
  2⤵
  PID:12156
- C:\Windows\System\RDbRhOt.exe
  C:\Windows\System\RDbRhOt.exe
  2⤵
  PID:12760
- C:\Windows\System\wkVZXMF.exe
  C:\Windows\System\wkVZXMF.exe
  2⤵
  PID:10456
- C:\Windows\System\iOusPff.exe
  C:\Windows\System\iOusPff.exe
  2⤵
  PID:12100
- C:\Windows\System\apoFIsj.exe
  C:\Windows\System\apoFIsj.exe
  2⤵
  PID:11464
- C:\Windows\System\NzRZsxx.exe
  C:\Windows\System\NzRZsxx.exe
  2⤵
  PID:12192
- C:\Windows\System\FxnaYma.exe
  C:\Windows\System\FxnaYma.exe
  2⤵
  PID:12616
- C:\Windows\System\HspcSDo.exe
  C:\Windows\System\HspcSDo.exe
  2⤵
  PID:12496
- C:\Windows\System\pMcGejS.exe
  C:\Windows\System\pMcGejS.exe
  2⤵
  PID:11984
- C:\Windows\System\TguTIqu.exe
  C:\Windows\System\TguTIqu.exe
  2⤵
  PID:7812
- C:\Windows\System\ilppJza.exe
  C:\Windows\System\ilppJza.exe
  2⤵
  PID:11380
- C:\Windows\System\gvEIlGF.exe
  C:\Windows\System\gvEIlGF.exe
  2⤵
  PID:11864
- C:\Windows\System\UnJhvzV.exe
  C:\Windows\System\UnJhvzV.exe
  2⤵
  PID:12324
- C:\Windows\System\nnKsSHq.exe
  C:\Windows\System\nnKsSHq.exe
  2⤵
  PID:4484
- C:\Windows\System\UfEBJjS.exe
  C:\Windows\System\UfEBJjS.exe
  2⤵
  PID:11296
- C:\Windows\System\iPwWIdy.exe
  C:\Windows\System\iPwWIdy.exe
  2⤵
  PID:11552
- C:\Windows\System\lADjeVq.exe
  C:\Windows\System\lADjeVq.exe
  2⤵
  PID:13168
- C:\Windows\System\DiINBpb.exe
  C:\Windows\System\DiINBpb.exe
  2⤵
  PID:12588
- C:\Windows\System\sSiUXbV.exe
  C:\Windows\System\sSiUXbV.exe
  2⤵
  PID:11572
- C:\Windows\System\RgIyzLK.exe
  C:\Windows\System\RgIyzLK.exe
  2⤵
  PID:7584
- C:\Windows\System\hyMNPbr.exe
  C:\Windows\System\hyMNPbr.exe
  2⤵
  PID:10016
- C:\Windows\System\kdetQZZ.exe
  C:\Windows\System\kdetQZZ.exe
  2⤵
  PID:13212
- C:\Windows\System\KzVfRMF.exe
  C:\Windows\System\KzVfRMF.exe
  2⤵
  PID:13888
- C:\Windows\System\LNJlunF.exe
  C:\Windows\System\LNJlunF.exe
  2⤵
  PID:13112
- C:\Windows\System\bVCYSeU.exe
  C:\Windows\System\bVCYSeU.exe
  2⤵
  PID:7216
- C:\Windows\System\XQqwOCY.exe
  C:\Windows\System\XQqwOCY.exe
  2⤵
  PID:12072
- C:\Windows\System\HqUsETt.exe
  C:\Windows\System\HqUsETt.exe
  2⤵
  PID:6876
- C:\Windows\System\NuZXQUW.exe
  C:\Windows\System\NuZXQUW.exe
  2⤵
  PID:9856
- C:\Windows\System\MmbJFaT.exe
  C:\Windows\System\MmbJFaT.exe
  2⤵
  PID:10588
- C:\Windows\System\RzqvMpj.exe
  C:\Windows\System\RzqvMpj.exe
  2⤵
  PID:4640
- C:\Windows\System\oyzCMfb.exe
  C:\Windows\System\oyzCMfb.exe
  2⤵
  PID:11516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mlzz5w5.xap.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BmGtTfN.exe

Filesize
1.4MB

MD5
d243aa3a65556dd198a58dff2e83060a

SHA1
fabb97ac6a2586c1d9038eb29108ce619501a6f2

SHA256
0d7faeb927f7f713c73ae3e46be37538ce7c92aa2020b02f659e57b46a15e1db

SHA512
d21abaddcee6c9ff9ff291d74ea201f815e6c2ca4692e976e059caa6b60e54f7b1461f637b85ce1dd29778ffe33199de744275c040c28eff3606fb019f353a96

Download Submit
C:\Windows\System\BqUWSiK.exe

Filesize
1.4MB

MD5
50386f7527e34e8fd5ba9c7f490f9342

SHA1
a6334179428dadf2eda126a6fdb444844a181a78

SHA256
8e7d01a9ae63ec22b4a5982d4b48ae6c221f8fc2e5b44d5a13f51980442ddf53

SHA512
1004f48cacef584778078aceb5f547d0d5ae2bd5b5a48e091c686a17b43e190f292f0110d0e1b2ef05544c21bfd96a4cde85d9acbce520862d2b011bfa1ba44e

Download Submit
C:\Windows\System\CaZwEGe.exe

Filesize
1.4MB

MD5
d91a854849b37cab10f8618348f96042

SHA1
d471a0f91d05cfaa42897b2b79f46405630a75ed

SHA256
ff8d42796e9efe40fb04d763eea7963c0b0ec03eb19173da4e7b82e635ca1bc2

SHA512
58b20ec75ed9da50e3db99739b742cfd74eaf813a7581f512af90a4202af64e7deb079ba3d17a84434736b1d765e80c3545a72689f88a0e5d97215d4c6a894a5

Download Submit
C:\Windows\System\ExnKxMN.exe

Filesize
1.4MB

MD5
e0c7909c6c0f356965b24c603bfd4386

SHA1
cc2b5aea7e06a3c3ab1b8652021d273c360b8fd4

SHA256
aae98d3332bfdeb9d52a754459294060e25ecfd6122a49810efe407c23e7a9ed

SHA512
7ddf0574ace536ea0aaa5983456a69945218fb0b697b969144f2501a67ba280989c390aa689e3eb6e011e910af00fdc7cdd4d41b4dff72ca9c29d811b1277fc1

Download Submit
C:\Windows\System\GGcKrVg.exe

Filesize
1.4MB

MD5
7cff8568b2de0e2908c7c00136a7cdec

SHA1
e889bf006a9f39ad458af8475b492c9e34bcc0d0

SHA256
189aa8bbe21d48f0a59ff62f726a9fd37329453104810abb4347b8f561053f3d

SHA512
e9a4634407292d6d239b6fa9efa2c65657800dea4b05e2d15544e2a030c2fa3fa18ec52cd3a0f483537cee1d9f1cf8fdbb527493a277496f1db9ed99e3323c76

Download Submit
C:\Windows\System\GWDfvPl.exe

Filesize
1.4MB

MD5
f5d7462cfaa459952cb27e14a940c2bc

SHA1
ac07155911e907e3e0564b9e559db098d69a50c3

SHA256
497ba40f1cad0e0501e542b074a20ec58d9718b19f0c99d65aa922b268a35283

SHA512
eb62272d191c6cef8de3da4fc602ee0a8beb41d41853a45e9ad545876f0e47354b955851bdd16181594aef6f916eb0380b53f7e86906fc2ec0c9a0fcbc25e517

Download Submit
C:\Windows\System\JnUPbgt.exe

Filesize
1.4MB

MD5
f5dfd2c47183c9999c74dcc1c4f01b1d

SHA1
247f737e872877afc926a845a6aedfa7349b70fe

SHA256
d33ce6607f5cc6b9c6e8245753711d066183c995f4b1347237a41c14f4ab5aa0

SHA512
213076669a108c6574f0b53bffd1190326dc633ffa563ca653333d2780e255d81aa9b3e2025c6bf6aeed2d45a1dc5188bd7022a47e0e1e352e995cea84d17c79

Download Submit
C:\Windows\System\KSiiKLA.exe

Filesize
1.4MB

MD5
3c3423d5abf52c7fdbfcb2880ade191c

SHA1
69a794e390a3ab30aa71ff3f0ee6fd3d8ef7015f

SHA256
a4dc7bebb3addcdc47806bec25b57525161481888d6ff33200ecb23b9e4bca2e

SHA512
c0c805ae3aae1f92f169763b63ae5db728b45bcf5dcda9f9572654ea895d638d82c79c02ac8c06a08f8c844643edadd9420ddfe3872465c9f9a77368d713dd9e

Download Submit
C:\Windows\System\LwUzfEU.exe

Filesize
1.4MB

MD5
8383519544df2806b2946f1da67eb9cc

SHA1
187d4b66dc2478fc67e4a1e52b8363741c7deacc

SHA256
8f8019a3d7c7d8cd0bbd68e0a090af0efbdc02102162d8ec6357af2a4fd257dc

SHA512
e132caa18b68279b9866636d348153a62fe84f58712520deec329cfd09c4e383f1091a8412fe4dfbf5880f46dc2455c8c7e0cc94ccd00e8e07d8b52ed131d3bf

Download Submit
C:\Windows\System\LxQtMWK.exe

Filesize
1.4MB

MD5
dded86677d90b00a0e25afe18e38614f

SHA1
3c29b804f4cff1b4e3aa7484d7c6fd4062494f45

SHA256
0841b8ac5793239f1dd2239ff49f499003d4fe6ee591da0a57fedbcb37ba255f

SHA512
774d3dbf67b62de7a86fc42260510309cc5970c589f54fd1646c25f48ddbcf27f7871b16ccff8bd5205c67ccb8fda02ce9e778340460db112d35a9689e14b6e6

Download Submit
C:\Windows\System\MbmfEWN.exe

Filesize
1.4MB

MD5
c7e85c7ef5459826f245c8a85f43d18d

SHA1
dd006dc436543b24900ff098ffacaccda72e049c

SHA256
804a7b14d9b769f5f94eab9f6f1ae33ea4cedbf92448158a1ecc6fa789447cb0

SHA512
28b9dcb2739f0d5d0dd2af8f04b283db53409b026c39166a3bf8542ababcab25b017c8537fadb0c7d498524b90bff3d4c3f417d069486233b61902c362c1df5c

Download Submit
C:\Windows\System\REDKauv.exe

Filesize
1.4MB

MD5
59c5f2a8589f66bf631ba7dff1d63793

SHA1
5c90185609f93f676f0967dc751f25707f925d93

SHA256
de582619003bbc3c75c5b5ee41f92adc2552bcf85e7c36e44daf56f16d3652b0

SHA512
c795dc99880946aa6c8a0dc871b98c754a7b54dbf85329302268952dd3011f49493622037bb34e48566fb74091c795346aaef6733f5e58848fc8df1f49999eda

Download Submit
C:\Windows\System\STmcnan.exe

Filesize
1.4MB

MD5
0df297b6e2652fb7c024f148e36d5633

SHA1
c5aae5564148b1b38349dfeb3c2d278232307e03

SHA256
45311fcafc070283441eb0ac426283ffbbecaff9a11a68ab6be56515c24ecfb6

SHA512
085f8ab0442fa0f8d9e2811c84b3724b18e3de3f5a32bccc689241add8bf05bfe824fdf863394081700998c73f38065b7e2ea1b416e97373a09f473ccbde5cd4

Download Submit
C:\Windows\System\SrYVxud.exe

Filesize
1.4MB

MD5
ae17b87161b00f1c700c5d368f71fdf5

SHA1
2df881a6e60752ec72baa48169814241ebf2a9d7

SHA256
47954e28dff7db0cfbab9995a95ceefb47a4aa64b4cc65031a723fe043f4bf88

SHA512
8576ba91f86158bff4e13bed439551c6bc060d0a4dafb6b7ae93f6c61322b64cd22a3a3c575b07f264f207fe0595e246a5446665610e2f41488a989a2c4ccacc

Download Submit
C:\Windows\System\VThyTNG.exe

Filesize
8B

MD5
f5de367e14d93143ef1faedf842e5b6d

SHA1
53c34a3e3da8f1f6c2e9e53890e9edf2ff008d74

SHA256
36e55333ae3d5576ba03b741cb1c838f247aac6b1cd7cdcee267d53cebe8decc

SHA512
0b231b233512c747cdbb209c99fd8472d55d97087002ae2f0851082cba32457ea0555a830f41369229ad1917eed68b9237ee47ec40ef110da72ae97f30abe677

Download Submit
C:\Windows\System\WhnMGiI.exe

Filesize
1.4MB

MD5
044299fcfbae887fe773a48b2c6810d7

SHA1
ac3fe8674cb2b3cf770b8b1ae71c812e1a438352

SHA256
8a9f83181acd8d74dc51b11885ef918e839139e6296485132a039c47aec5852e

SHA512
2a7ff33f48b2d0e5e989ac62a8e0757ce0e00c60d0a279deb3e9ca927b0d9a7e721c356245d7d6dd7dc8c8adaedebf4aa9d27c48c6ec0f9fb7f45a67b4967e16

Download Submit
C:\Windows\System\XvosbRr.exe

Filesize
1.4MB

MD5
b99bf25ed9ba1b1de928e6e70973be8e

SHA1
6e644d34e54d28d6e84e54574de76c9551b21f79

SHA256
be72577c360f5a3d7adb4099412affa3b1a3d700187f10a4f4fcdb78ab64c5b4

SHA512
5c177b659918e63a8296a1b95dd152ccb7cf630409d362bc728b7e5e8aa59ff9e08bdb6f92f6b375b9a76c08aef6e6a9310afd8a6af710480a29839050f4985d

Download Submit
C:\Windows\System\YvKssLX.exe

Filesize
1.4MB

MD5
0720e43ce39cb470577c488e39127d71

SHA1
25340d5df06f59dfcdaabb5e69c62e70ed40af4b

SHA256
2b494904c8d7d9fdefae1ece3c72c9f7d9f29bfde22654b4b58fa679473ee90a

SHA512
b0ce5cd98922218df0a0032fdb98f768062b514209ab232bf9fdd76f6b551266e7b5395c314fe7c07972fb9ced0fbc14a59cfe2e2700bb340e9b68defae6196d

Download Submit
C:\Windows\System\YwptNyk.exe

Filesize
1.4MB

MD5
3e1d3a1be33e31fb8180af45cb229d85

SHA1
afe251d9478b0d41c321ae86685df921b4200465

SHA256
3ecd093270e4184f50f84e5e52ff446a5ae36eca38f2e9eb2ae024b7ad758526

SHA512
bb8cc7b251f2b93207e016ed4fbed6eeec251485fc23bbb0941f79dd13082ca2976cd8f0ccf68de3a145e8c9677ff6abdd5b3ccd7e5cd0cac67c5d8b27ed767c

Download Submit
C:\Windows\System\ZBgTsmq.exe

Filesize
1.4MB

MD5
1fa0c1e6674e26867624ad71ac527b96

SHA1
aee2f5a79d200eabf3690d6fbcc56c5f6aeb4bee

SHA256
03f11ace6ede2168f7adad29422eca21fef959fdc940a720e7bcbb1b32a58f9c

SHA512
a3aa392c960eeafe88153cb22c76e7399882bd01687e2419e292103a22b7b4641d3bf7cda2e6f9f95ea6213037498fbbae3031b430130b0b75736744fdf5e7b2

Download Submit
C:\Windows\System\ZLUtvKB.exe

Filesize
1.4MB

MD5
598d0a08fed934a9825c02eb1e8a1c5c

SHA1
356dcf8dd2bf0ac3c4fa6f82bf6b61cd26322634

SHA256
e3c11b7d71201c7f40e5619b4f3c232b21457c79ecdbcb13ae57aa345435163b

SHA512
b799c91b8c79273997ffd8417124e905d1d1fe960914937b6b215ca020612cb5f711ff6b0e192d652fc84a34aaaf0585658241424b81b969b0690fc95b1c2dff

Download Submit
C:\Windows\System\ZVLMFMH.exe

Filesize
1.4MB

MD5
e45f999afab5c00cbff3cb8c7f744fb8

SHA1
f9943776a755aaa11ab635fbd6374b8aa582c7f2

SHA256
e977cc99973562c3d067b69abbe3aa54860b3aa44f4ee8bd77f4826f40914ac0

SHA512
1f2970a5f4315dcb27cba0a39bfa816a092e0f1ae50756229b24428eb52c067446edf97f6385ead58795142ff6ecc4f77953787b89e5a8fefc6d35013cf28fce

Download Submit
C:\Windows\System\aysjbMT.exe

Filesize
1.4MB

MD5
84567b5de3f511139f226553f4e1bd27

SHA1
2d13cad9968bdda947894ca2e328cb3d496a689c

SHA256
e1e4694beecce74b652ea867c5fa2f97dbb5fdd7399fb07cc6fff4c8d389baac

SHA512
6519fad738e78c3d1f3570f378d47a62d42924c7703f1526f97b0680e0d41650de652b00023153e1f7e36b49a4bce56c6cc9f79d63d1431676de1e2b3ca04e74

Download Submit
C:\Windows\System\cXwcRxq.exe

Filesize
1.4MB

MD5
418b57a7e881a9fbf7b523c9d5422eb2

SHA1
b5b1c3c56d37bd1409894740313ee82e3c006fa1

SHA256
d03f82d24c623590bf11886778829a26d10425f1d56bfb6c693523941532b294

SHA512
e2273c4d6c119ffbe2107e4d7db8a2f8675a2dc46e5f8f25c1367b0c21629a349727fe7d5b05d6aa423dce72ea33c9bec5897daa4d26d7b07210cb0c8974b587

Download Submit
C:\Windows\System\dHLOHgh.exe

Filesize
1.4MB

MD5
b857cf861b960c8fc4d98e588df9c244

SHA1
f620b2c6566d48462d3884cb17159fff84b62ae0

SHA256
60beefc9c8746f06bea6036bc8d467cf155e81602660504ebc3d1dc2343d3feb

SHA512
b609d6f3e23d68790eaad3209f49abe11fdb775e0e504779c1486b35b5c69cf51f07f21931f52fd79f97c717d90baaac8343ca40060c1925cf0c314025ce43f9

Download Submit
C:\Windows\System\ekTVWVb.exe

Filesize
1.4MB

MD5
8081f0fe0f9abd82c668d42c0d07f42a

SHA1
e3241e0ab9434fe774b8be52d5d37285cbaa5b7e

SHA256
8edf621341ab21ca7b8f2d90c2472c7e4de37eeae2661c4923925f7aa0e5c2a1

SHA512
e65c142bb85b36337d122ece9b99af5b17af1ae1ec64f98104fd1f90392d0c93a3570b34e7b2fd6c0e57c81067234f08cd53854e2963fb256baa171079c7c3a4

Download Submit
C:\Windows\System\fTCHvxb.exe

Filesize
1.4MB

MD5
0d52d3de6c0f1a2b428ccc1ff5e79691

SHA1
69a3cd405663842d1b1652cf5bf6c4fc2ac14df0

SHA256
e142b23e1945cbd8cb88cc0a3b5b18ccdfaed8b27c91e680d5cbb6459d34fa64

SHA512
7dff9d797eca7e2f965f55f6aa4b08a74a5a600efd00292441c097c2186056a6a404e9b1da78b71698f8f3216dbb7d223838b404242a466c6baa10a7cecc26b2

Download Submit
C:\Windows\System\fwKOntG.exe

Filesize
1.4MB

MD5
d976a2009390ebbbbf8305ccbb960954

SHA1
47f0d37cd00209feb337172d5fb1d35c64192e9b

SHA256
5790d5c666a23a283769cbbcfb6ba957dd1a6c4b48fc9fff4b5a1c05fd71d83d

SHA512
9763048e6ee2f33aee204ca11fea30face9b15986214ba4b98b6c1e9e191b09dd81cadd638778a4fbd7c21736237dea6f167e73f2b5b72f8ae479bca2362ecc6

Download Submit
C:\Windows\System\iNEzXmS.exe

Filesize
1.4MB

MD5
1e36a8233e26a8993970118e07ccbf07

SHA1
08a39b8b0c46ba89ebc20c493ef8e056a7e3bd4d

SHA256
a3ac88eae56d209242577028f7ae1953935637ec6a33bf5a47022ac9a3d3ac57

SHA512
0ecd037ace81e50550ddd4fe22173eb988b20a1d5c7ed53a2794df73a5411e9c7c42b53f9d36d6f70c93781ebb9cdfec575d7edac58ad106558f832b001f7ef6

Download Submit
C:\Windows\System\ijqIMXu.exe

Filesize
1.4MB

MD5
e51c6e073652cd0ca79265bcf47879f8

SHA1
4dd08b891d2e5a05afd1630d88abb260ded05528

SHA256
429b78515053977ad2eb9ffb2d9c64e25142dd53c1c851d6380c40e0dfa2f9c4

SHA512
305490b710c665baf82c3523d525391288769f6edbe9ff151236d09d44c3f327293d86aa0d86043b63f5ca479d1e2ff8b0cd9898f0842cb652d154a19b725e59

Download Submit
C:\Windows\System\pnSOKwZ.exe

Filesize
1.4MB

MD5
7312a4ca4b3771e48462977b6e34f9a9

SHA1
d18da26af4c28b00e531838893f6e26630d3118f

SHA256
26e71e67227abfc8b23beeb571e7da924e8b73d5676e194165c38992d594fb27

SHA512
5aa5c78bacf959b1d11b648d87f8a1384bc4c019f423495aebfe310ac51c45ad9dbfec6a4e686beb1208a4c8ceb17bc3f8b2794789bc498bfb7eee94592b5f6c

Download Submit
C:\Windows\System\tOokGBK.exe

Filesize
1.4MB

MD5
25287c1c6b4827f9b5bc62ecac006203

SHA1
d6b048aa7da83608d10342e8d4aae2f860348dc9

SHA256
8210f5c3f5a7a4d185a09d09d97a3262aa9f0315fbd9f4e32950f5fb66136dfb

SHA512
f22d51e58931da5ae97b4cb05744b780a36ed96f1052606dc47501aa5b06f24353a281935130dd54b82fcf7069a9e2823ff14059e7c3d30a006a660cdcef6049

Download Submit
C:\Windows\System\uECwNle.exe

Filesize
1.4MB

MD5
2d34bb72aded45bc6d3bc9ee8f01ab2f

SHA1
e07c9065bc7b05bb24dd317e2f9b957ea508f015

SHA256
46640d3c198ac86b36e1a94b08065e43bc71c614b51befcbb8689cfbcc2ee70a

SHA512
1811505f6758eccee2ca54eccc60bfa75e03b943a300ecf7e38d27a2b2908e1706f9156fd651d2e38e3453bf5a0249020e448d0c8b0f1b1d683b749d7b76bc8e

Download Submit
C:\Windows\System\wjanGlp.exe

Filesize
1.4MB

MD5
7bdfe277001b83eb544dab22dc17c184

SHA1
d5f0385c91de0aa5f8521d29c53023959a166e56

SHA256
e29fb502ab5b634af21c2ca9486822c3c0b4d3160dde4a92ec8ae228228f5553

SHA512
b3c93f8475744c88e5c1b96d47ff301971ed6e5fe68f7241aeb42b5f8b023b3eea578630d43f4df0b63d2e9e27e82223a8b62af1383d9e907fa9baa3ac1a0cc9

Download Submit
memory/740-382-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp

Filesize
3.9MB

Download
memory/740-2696-0x00007FF7EE0A0000-0x00007FF7EE492000-memory.dmp

Filesize
3.9MB

Download
memory/748-351-0x00007FF719F80000-0x00007FF71A372000-memory.dmp

Filesize
3.9MB

Download
memory/748-2677-0x00007FF719F80000-0x00007FF71A372000-memory.dmp

Filesize
3.9MB

Download
memory/864-74-0x00007FF7D2870000-0x00007FF7D2C62000-memory.dmp

Filesize
3.9MB

Download
memory/1204-83-0x00007FF62F0A0000-0x00007FF62F492000-memory.dmp

Filesize
3.9MB

Download
memory/1384-58-0x00007FF62D690000-0x00007FF62DA82000-memory.dmp

Filesize
3.9MB

Download
memory/1396-403-0x00007FF72A2E0000-0x00007FF72A6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1396-2672-0x00007FF72A2E0000-0x00007FF72A6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1628-2668-0x00007FF7F0780000-0x00007FF7F0B72000-memory.dmp

Filesize
3.9MB

Download
memory/1628-380-0x00007FF7F0780000-0x00007FF7F0B72000-memory.dmp

Filesize
3.9MB

Download
memory/2264-91-0x00007FF606EE0000-0x00007FF6072D2000-memory.dmp

Filesize
3.9MB

Download
memory/2264-2670-0x00007FF606EE0000-0x00007FF6072D2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-64-0x00007FF7EB230000-0x00007FF7EB622000-memory.dmp

Filesize
3.9MB

Download
memory/2908-97-0x00007FF685BA0000-0x00007FF685F92000-memory.dmp

Filesize
3.9MB

Download
memory/3220-271-0x00000248EEBD0000-0x00000248EF376000-memory.dmp

Filesize
7.6MB

Download
memory/3220-71-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/3220-35-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/3220-50-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/3220-16-0x00000248EDEB0000-0x00000248EDED2000-memory.dmp

Filesize
136KB

Download
memory/3220-3-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp

Filesize
8KB

Download
memory/3488-1-0x00000214A5E40000-0x00000214A5E50000-memory.dmp

Filesize
64KB

Download
memory/3488-0-0x00007FF6176E0000-0x00007FF617AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3640-2681-0x00007FF739EE0000-0x00007FF73A2D2000-memory.dmp

Filesize
3.9MB

Download
memory/3640-363-0x00007FF739EE0000-0x00007FF73A2D2000-memory.dmp

Filesize
3.9MB

Download
memory/3704-355-0x00007FF75F620000-0x00007FF75FA12000-memory.dmp

Filesize
3.9MB

Download
memory/3704-2679-0x00007FF75F620000-0x00007FF75FA12000-memory.dmp

Filesize
3.9MB

Download
memory/3900-342-0x00007FF7F1860000-0x00007FF7F1C52000-memory.dmp

Filesize
3.9MB

Download
memory/3900-2637-0x00007FF7F1860000-0x00007FF7F1C52000-memory.dmp

Filesize
3.9MB

Download
memory/4008-2638-0x00007FF7A0EE0000-0x00007FF7A12D2000-memory.dmp

Filesize
3.9MB

Download
memory/4008-343-0x00007FF7A0EE0000-0x00007FF7A12D2000-memory.dmp

Filesize
3.9MB

Download
memory/4036-2700-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp

Filesize
3.9MB

Download
memory/4036-93-0x00007FF6B1B50000-0x00007FF6B1F42000-memory.dmp

Filesize
3.9MB

Download
memory/4164-2680-0x00007FF619610000-0x00007FF619A02000-memory.dmp

Filesize
3.9MB

Download
memory/4164-341-0x00007FF619610000-0x00007FF619A02000-memory.dmp

Filesize
3.9MB

Download
memory/4332-2667-0x00007FF6490C0000-0x00007FF6494B2000-memory.dmp

Filesize
3.9MB

Download
memory/4332-344-0x00007FF6490C0000-0x00007FF6494B2000-memory.dmp

Filesize
3.9MB

Download
memory/4420-80-0x00007FF699DD0000-0x00007FF69A1C2000-memory.dmp

Filesize
3.9MB

Download
memory/4468-2591-0x00007FF6F9E80000-0x00007FF6FA272000-memory.dmp

Filesize
3.9MB

Download
memory/4468-372-0x00007FF6F9E80000-0x00007FF6FA272000-memory.dmp

Filesize
3.9MB

Download
memory/4692-2572-0x00007FF7E8510000-0x00007FF7E8902000-memory.dmp

Filesize
3.9MB

Download
memory/4692-339-0x00007FF7E8510000-0x00007FF7E8902000-memory.dmp

Filesize
3.9MB

Download
memory/4924-2589-0x00007FF7FB7A0000-0x00007FF7FBB92000-memory.dmp

Filesize
3.9MB

Download
memory/4924-360-0x00007FF7FB7A0000-0x00007FF7FBB92000-memory.dmp

Filesize
3.9MB

Download
memory/5012-2671-0x00007FF7931A0000-0x00007FF793592000-memory.dmp

Filesize
3.9MB

Download
memory/5012-357-0x00007FF7931A0000-0x00007FF793592000-memory.dmp

Filesize
3.9MB

Download
memory/5036-87-0x00007FF7F5100000-0x00007FF7F54F2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-2580-0x00007FF7F5100000-0x00007FF7F54F2000-memory.dmp

Filesize
3.9MB

Download
memory/5052-102-0x00007FF7335B0000-0x00007FF7339A2000-memory.dmp

Filesize
3.9MB

Download