xmrig | 0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4

Analysis

max time kernel
127s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
Size

1.5MB
MD5

01650525020dd5639d05adbbc11d4900
SHA1

e39c4fff351e37c59089c509aa949f3570ffb1e3
SHA256

0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4
SHA512

6b15cade2fb15109248c427c5038d7ddafcb1e880fceabdaf8c1e0362dce820363f89880a10b2104b6576830874fb1edb07e9a07e03264fcb40eb8326c4f2c36
SSDEEP

49152:Lz071uv4BPMkyW10/w16BWgac2xGvhHWW:NABg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/1100-20-0x00007FF640CA0000-0x00007FF641092000-memory.dmp	xmrig
behavioral2/memory/4892-94-0x00007FF749D10000-0x00007FF74A102000-memory.dmp	xmrig
behavioral2/memory/4400-116-0x00007FF7B0A30000-0x00007FF7B0E22000-memory.dmp	xmrig
behavioral2/memory/800-151-0x00007FF741B50000-0x00007FF741F42000-memory.dmp	xmrig
behavioral2/memory/3976-157-0x00007FF6C4D70000-0x00007FF6C5162000-memory.dmp	xmrig
behavioral2/memory/4428-161-0x00007FF64E4F0000-0x00007FF64E8E2000-memory.dmp	xmrig
behavioral2/memory/5048-158-0x00007FF7E6B20000-0x00007FF7E6F12000-memory.dmp	xmrig
behavioral2/memory/2644-152-0x00007FF775BC0000-0x00007FF775FB2000-memory.dmp	xmrig
behavioral2/memory/3564-142-0x00007FF69D330000-0x00007FF69D722000-memory.dmp	xmrig
behavioral2/memory/4588-136-0x00007FF673FA0000-0x00007FF674392000-memory.dmp	xmrig
behavioral2/memory/3480-127-0x00007FF6DF120000-0x00007FF6DF512000-memory.dmp	xmrig
behavioral2/memory/3456-121-0x00007FF64E330000-0x00007FF64E722000-memory.dmp	xmrig
behavioral2/memory/2260-107-0x00007FF7657B0000-0x00007FF765BA2000-memory.dmp	xmrig
behavioral2/memory/4708-103-0x00007FF669910000-0x00007FF669D02000-memory.dmp	xmrig
behavioral2/memory/1808-99-0x00007FF7F65D0000-0x00007FF7F69C2000-memory.dmp	xmrig
behavioral2/memory/1460-93-0x00007FF629FE0000-0x00007FF62A3D2000-memory.dmp	xmrig
behavioral2/memory/1480-66-0x00007FF7D90E0000-0x00007FF7D94D2000-memory.dmp	xmrig
behavioral2/memory/4980-65-0x00007FF77EC30000-0x00007FF77F022000-memory.dmp	xmrig
behavioral2/memory/4692-48-0x00007FF72ACE0000-0x00007FF72B0D2000-memory.dmp	xmrig
behavioral2/memory/1640-2156-0x00007FF780510000-0x00007FF780902000-memory.dmp	xmrig
behavioral2/memory/4692-2184-0x00007FF72ACE0000-0x00007FF72B0D2000-memory.dmp	xmrig
behavioral2/memory/2000-2181-0x00007FF709EF0000-0x00007FF70A2E2000-memory.dmp	xmrig
behavioral2/memory/1808-2269-0x00007FF7F65D0000-0x00007FF7F69C2000-memory.dmp	xmrig
behavioral2/memory/3456-2282-0x00007FF64E330000-0x00007FF64E722000-memory.dmp	xmrig
behavioral2/memory/4588-2453-0x00007FF673FA0000-0x00007FF674392000-memory.dmp	xmrig
behavioral2/memory/5048-2495-0x00007FF7E6B20000-0x00007FF7E6F12000-memory.dmp	xmrig
behavioral2/memory/3364-2907-0x00007FF695420000-0x00007FF695812000-memory.dmp	xmrig
behavioral2/memory/2644-2413-0x00007FF775BC0000-0x00007FF775FB2000-memory.dmp	xmrig
behavioral2/memory/3564-2402-0x00007FF69D330000-0x00007FF69D722000-memory.dmp	xmrig
behavioral2/memory/800-2395-0x00007FF741B50000-0x00007FF741F42000-memory.dmp	xmrig
behavioral2/memory/3976-2378-0x00007FF6C4D70000-0x00007FF6C5162000-memory.dmp	xmrig
behavioral2/memory/4708-2297-0x00007FF669910000-0x00007FF669D02000-memory.dmp	xmrig
behavioral2/memory/4400-2304-0x00007FF7B0A30000-0x00007FF7B0E22000-memory.dmp	xmrig
behavioral2/memory/2260-2272-0x00007FF7657B0000-0x00007FF765BA2000-memory.dmp	xmrig
behavioral2/memory/928-2186-0x00007FF62BC60000-0x00007FF62C052000-memory.dmp	xmrig
behavioral2/memory/1460-2185-0x00007FF629FE0000-0x00007FF62A3D2000-memory.dmp	xmrig
behavioral2/memory/2112-2179-0x00007FF637580000-0x00007FF637972000-memory.dmp	xmrig
behavioral2/memory/4892-2189-0x00007FF749D10000-0x00007FF74A102000-memory.dmp	xmrig
behavioral2/memory/1264-2130-0x00007FF688840000-0x00007FF688C32000-memory.dmp	xmrig
behavioral2/memory/1100-2136-0x00007FF640CA0000-0x00007FF641092000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	4268	powershell.exe
9	4268	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4268	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1264	YwTlKBy.exe
1100	LkynZYK.exe
1640	XVoqxPV.exe
2112	ObrwQTK.exe
928	bTiTJVT.exe
4692	OAaohNu.exe
2000	GXMDDdq.exe
4980	GmwJPEQ.exe
1460	RjsGpHb.exe
1480	GGDZNlB.exe
4892	BdCDGhp.exe
4708	DNIdSIT.exe
2260	pYDKQas.exe
1808	IlIZqEC.exe
4400	ZGvtxfo.exe
3456	vXcVjwc.exe
3480	lWwfHFA.exe
4588	jenhBxa.exe
3564	jvGOApI.exe
800	FuoBwmj.exe
2644	yMuGqAt.exe
3976	iwyJzpr.exe
5048	xJuGIZb.exe
4428	UsaUchA.exe
1880	lwXkeaS.exe
4560	ibJfjav.exe
1160	hrpyGLh.exe
112	eDwmFEq.exe
1832	cAiLOFr.exe
5084	OgHzbGG.exe
3592	ikjxkiS.exe
1236	NWXHIEk.exe
3596	AuZOvpL.exe
1772	CAOyVjn.exe
2132	sktlUDz.exe
4212	sHThsdV.exe
2084	aqQIfFq.exe
3380	LPKCqBx.exe
4084	cdvLdws.exe
1144	ivSunaK.exe
1332	UcUUnea.exe
4000	TlczYZh.exe
4308	jzpAeWT.exe
912	fQyyTCF.exe
1920	fDihaZh.exe
3900	PVanYVa.exe
3064	YCOYunV.exe
740	FUhdhYX.exe
956	ZgjDxAF.exe
2672	gFLlodd.exe
1644	SvLQCDq.exe
5144	ovFmuyX.exe
5168	WJzrfDu.exe
5220	XbHLiRG.exe
5236	vueUbCF.exe
5264	elTIvrF.exe
5296	WmhegVv.exe
5324	LiFDzYI.exe
5352	fSOZqpg.exe
5376	pyyTBrO.exe
5428	XoUkrgf.exe
5456	NqSbEJq.exe
5488	YEmhWqf.exe
5520	cIASkGZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3364-0-0x00007FF695420000-0x00007FF695812000-memory.dmp	upx
behavioral2/files/0x000900000002326c-4.dat	upx
behavioral2/memory/1264-7-0x00007FF688840000-0x00007FF688C32000-memory.dmp	upx
behavioral2/files/0x0008000000023272-11.dat	upx
behavioral2/files/0x0007000000023273-18.dat	upx
behavioral2/memory/1100-20-0x00007FF640CA0000-0x00007FF641092000-memory.dmp	upx
behavioral2/files/0x0007000000023275-25.dat	upx
behavioral2/files/0x0007000000023276-39.dat	upx
behavioral2/memory/928-43-0x00007FF62BC60000-0x00007FF62C052000-memory.dmp	upx
behavioral2/files/0x0007000000023279-50.dat	upx
behavioral2/files/0x000700000002327a-62.dat	upx
behavioral2/files/0x000700000002327b-71.dat	upx
behavioral2/files/0x000700000002327c-85.dat	upx
behavioral2/memory/4892-94-0x00007FF749D10000-0x00007FF74A102000-memory.dmp	upx
behavioral2/files/0x000800000002327f-108.dat	upx
behavioral2/memory/4400-116-0x00007FF7B0A30000-0x00007FF7B0E22000-memory.dmp	upx
behavioral2/files/0x0007000000023281-125.dat	upx
behavioral2/files/0x0007000000023282-131.dat	upx
behavioral2/files/0x0007000000023285-139.dat	upx
behavioral2/memory/800-151-0x00007FF741B50000-0x00007FF741F42000-memory.dmp	upx
behavioral2/memory/3976-157-0x00007FF6C4D70000-0x00007FF6C5162000-memory.dmp	upx
behavioral2/files/0x000700000002328d-185.dat	upx
behavioral2/files/0x000700000002328f-201.dat	upx
behavioral2/files/0x0007000000023290-198.dat	upx
behavioral2/files/0x000700000002328e-196.dat	upx
behavioral2/files/0x000700000002328c-183.dat	upx
behavioral2/files/0x000700000002328b-177.dat	upx
behavioral2/files/0x000700000002328a-175.dat	upx
behavioral2/files/0x0007000000023289-168.dat	upx
behavioral2/files/0x0007000000023288-166.dat	upx
behavioral2/memory/4428-161-0x00007FF64E4F0000-0x00007FF64E8E2000-memory.dmp	upx
behavioral2/memory/5048-158-0x00007FF7E6B20000-0x00007FF7E6F12000-memory.dmp	upx
behavioral2/files/0x0007000000023287-155.dat	upx
behavioral2/memory/2644-152-0x00007FF775BC0000-0x00007FF775FB2000-memory.dmp	upx
behavioral2/files/0x0007000000023286-153.dat	upx
behavioral2/files/0x0007000000023284-143.dat	upx
behavioral2/memory/3564-142-0x00007FF69D330000-0x00007FF69D722000-memory.dmp	upx
behavioral2/files/0x0007000000023283-137.dat	upx
behavioral2/memory/4588-136-0x00007FF673FA0000-0x00007FF674392000-memory.dmp	upx
behavioral2/memory/3480-127-0x00007FF6DF120000-0x00007FF6DF512000-memory.dmp	upx
behavioral2/memory/3456-121-0x00007FF64E330000-0x00007FF64E722000-memory.dmp	upx
behavioral2/files/0x000800000002327e-119.dat	upx
behavioral2/files/0x0007000000023280-113.dat	upx
behavioral2/memory/2260-107-0x00007FF7657B0000-0x00007FF765BA2000-memory.dmp	upx
behavioral2/memory/4708-103-0x00007FF669910000-0x00007FF669D02000-memory.dmp	upx
behavioral2/memory/1808-99-0x00007FF7F65D0000-0x00007FF7F69C2000-memory.dmp	upx
behavioral2/files/0x000700000002327d-97.dat	upx
behavioral2/memory/1460-93-0x00007FF629FE0000-0x00007FF62A3D2000-memory.dmp	upx
behavioral2/memory/1480-66-0x00007FF7D90E0000-0x00007FF7D94D2000-memory.dmp	upx
behavioral2/memory/4980-65-0x00007FF77EC30000-0x00007FF77F022000-memory.dmp	upx
behavioral2/files/0x0008000000023270-61.dat	upx
behavioral2/memory/2000-60-0x00007FF709EF0000-0x00007FF70A2E2000-memory.dmp	upx
behavioral2/files/0x0007000000023277-56.dat	upx
behavioral2/memory/4692-48-0x00007FF72ACE0000-0x00007FF72B0D2000-memory.dmp	upx
behavioral2/files/0x0007000000023278-42.dat	upx
behavioral2/files/0x0007000000023274-33.dat	upx
behavioral2/memory/1640-31-0x00007FF780510000-0x00007FF780902000-memory.dmp	upx
behavioral2/memory/2112-26-0x00007FF637580000-0x00007FF637972000-memory.dmp	upx
behavioral2/memory/1640-2156-0x00007FF780510000-0x00007FF780902000-memory.dmp	upx
behavioral2/memory/4692-2184-0x00007FF72ACE0000-0x00007FF72B0D2000-memory.dmp	upx
behavioral2/memory/2000-2181-0x00007FF709EF0000-0x00007FF70A2E2000-memory.dmp	upx
behavioral2/memory/1808-2269-0x00007FF7F65D0000-0x00007FF7F69C2000-memory.dmp	upx
behavioral2/memory/3456-2282-0x00007FF64E330000-0x00007FF64E722000-memory.dmp	upx
behavioral2/memory/4588-2453-0x00007FF673FA0000-0x00007FF674392000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UKZMmgW.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\cNqiOQI.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\irlIFcB.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\HaBUgaA.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\YNScjJb.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\GZOdypt.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\zKDMbYV.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\gOgcUDP.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\nxfxGDc.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\udlpHCl.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\qCVSKbk.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\nVZIEOu.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\fmqakAX.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\akfwnDK.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\BLwsYIT.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\UUisIyT.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\SXiFlXo.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\qvnVqHZ.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\LWucNBd.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\nkVQCoW.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\TnVajXJ.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\ZSTKapQ.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\PSAXZYU.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\HflKWnC.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\xCBgXSa.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\LncTynN.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\yAisuXQ.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\FPbDBmC.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\uOgvvSI.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\ULLNofw.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\WxMMiRt.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\KkxBOLz.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\HkMtPZe.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\uIhSLFt.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\JvVaZlU.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\BKMFLre.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\hvgAUwS.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\oWrRnYh.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\NIAoCav.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\zlrbAtm.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\JgUymTg.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\oJFAHhS.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\SBbzxkZ.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\jOZCnXH.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\lYzWycE.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\pkxeRhb.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\LGMQAsj.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\pgNdXjq.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\gmiHxpE.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\zbnHKeU.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\YDKtWQZ.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\WjczrWj.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\Qxzncay.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\ipKlpSi.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\IhZfrtP.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\eLcgnMx.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\AaVBIAe.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\yZATwgb.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\grdwfQo.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\iFAmjRP.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\xQUxmwy.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\qXaPgOh.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\YEmhWqf.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
File created	C:\Windows\System\HVYMBgD.exe	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4268	powershell.exe
4268	powershell.exe
4268	powershell.exe
4268	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
Token: SeDebugPrivilege	4268	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4268	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	90
PID 3364 wrote to memory of 4268	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	90
PID 3364 wrote to memory of 1264	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	91
PID 3364 wrote to memory of 1264	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	91
PID 3364 wrote to memory of 1100	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	92
PID 3364 wrote to memory of 1100	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	92
PID 3364 wrote to memory of 1640	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	93
PID 3364 wrote to memory of 1640	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	93
PID 3364 wrote to memory of 2112	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	94
PID 3364 wrote to memory of 2112	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	94
PID 3364 wrote to memory of 928	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	95
PID 3364 wrote to memory of 928	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	95
PID 3364 wrote to memory of 4692	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	96
PID 3364 wrote to memory of 4692	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	96
PID 3364 wrote to memory of 2000	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	97
PID 3364 wrote to memory of 2000	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	97
PID 3364 wrote to memory of 4980	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	98
PID 3364 wrote to memory of 4980	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	98
PID 3364 wrote to memory of 1460	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	99
PID 3364 wrote to memory of 1460	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	99
PID 3364 wrote to memory of 1480	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	100
PID 3364 wrote to memory of 1480	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	100
PID 3364 wrote to memory of 4892	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	101
PID 3364 wrote to memory of 4892	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	101
PID 3364 wrote to memory of 4708	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	102
PID 3364 wrote to memory of 4708	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	102
PID 3364 wrote to memory of 2260	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	103
PID 3364 wrote to memory of 2260	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	103
PID 3364 wrote to memory of 1808	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	104
PID 3364 wrote to memory of 1808	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	104
PID 3364 wrote to memory of 4400	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	105
PID 3364 wrote to memory of 4400	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	105
PID 3364 wrote to memory of 3456	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	106
PID 3364 wrote to memory of 3456	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	106
PID 3364 wrote to memory of 3480	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	107
PID 3364 wrote to memory of 3480	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	107
PID 3364 wrote to memory of 4588	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	108
PID 3364 wrote to memory of 4588	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	108
PID 3364 wrote to memory of 3564	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	109
PID 3364 wrote to memory of 3564	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	109
PID 3364 wrote to memory of 800	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	110
PID 3364 wrote to memory of 800	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	110
PID 3364 wrote to memory of 2644	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	111
PID 3364 wrote to memory of 2644	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	111
PID 3364 wrote to memory of 3976	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	112
PID 3364 wrote to memory of 3976	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	112
PID 3364 wrote to memory of 5048	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	113
PID 3364 wrote to memory of 5048	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	113
PID 3364 wrote to memory of 4428	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	114
PID 3364 wrote to memory of 4428	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	114
PID 3364 wrote to memory of 1880	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	115
PID 3364 wrote to memory of 1880	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	115
PID 3364 wrote to memory of 4560	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	116
PID 3364 wrote to memory of 4560	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	116
PID 3364 wrote to memory of 1160	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	117
PID 3364 wrote to memory of 1160	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	117
PID 3364 wrote to memory of 112	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	118
PID 3364 wrote to memory of 112	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	118
PID 3364 wrote to memory of 1832	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	119
PID 3364 wrote to memory of 1832	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	119
PID 3364 wrote to memory of 5084	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	120
PID 3364 wrote to memory of 5084	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	120
PID 3364 wrote to memory of 3592	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	121
PID 3364 wrote to memory of 3592	3364	0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b70b19d125383ec58b51674d1ba89310a473428e80d0deb2621dfaec14399e4_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4268
- C:\Windows\System\YwTlKBy.exe
  C:\Windows\System\YwTlKBy.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\LkynZYK.exe
  C:\Windows\System\LkynZYK.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\XVoqxPV.exe
  C:\Windows\System\XVoqxPV.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ObrwQTK.exe
  C:\Windows\System\ObrwQTK.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\bTiTJVT.exe
  C:\Windows\System\bTiTJVT.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\OAaohNu.exe
  C:\Windows\System\OAaohNu.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\GXMDDdq.exe
  C:\Windows\System\GXMDDdq.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\GmwJPEQ.exe
  C:\Windows\System\GmwJPEQ.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\RjsGpHb.exe
  C:\Windows\System\RjsGpHb.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\GGDZNlB.exe
  C:\Windows\System\GGDZNlB.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\BdCDGhp.exe
  C:\Windows\System\BdCDGhp.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\DNIdSIT.exe
  C:\Windows\System\DNIdSIT.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\pYDKQas.exe
  C:\Windows\System\pYDKQas.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\IlIZqEC.exe
  C:\Windows\System\IlIZqEC.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\ZGvtxfo.exe
  C:\Windows\System\ZGvtxfo.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\vXcVjwc.exe
  C:\Windows\System\vXcVjwc.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\lWwfHFA.exe
  C:\Windows\System\lWwfHFA.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\jenhBxa.exe
  C:\Windows\System\jenhBxa.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\jvGOApI.exe
  C:\Windows\System\jvGOApI.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\FuoBwmj.exe
  C:\Windows\System\FuoBwmj.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\yMuGqAt.exe
  C:\Windows\System\yMuGqAt.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\iwyJzpr.exe
  C:\Windows\System\iwyJzpr.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\xJuGIZb.exe
  C:\Windows\System\xJuGIZb.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\UsaUchA.exe
  C:\Windows\System\UsaUchA.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\lwXkeaS.exe
  C:\Windows\System\lwXkeaS.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\ibJfjav.exe
  C:\Windows\System\ibJfjav.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\hrpyGLh.exe
  C:\Windows\System\hrpyGLh.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\eDwmFEq.exe
  C:\Windows\System\eDwmFEq.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\cAiLOFr.exe
  C:\Windows\System\cAiLOFr.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\OgHzbGG.exe
  C:\Windows\System\OgHzbGG.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\ikjxkiS.exe
  C:\Windows\System\ikjxkiS.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\NWXHIEk.exe
  C:\Windows\System\NWXHIEk.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\AuZOvpL.exe
  C:\Windows\System\AuZOvpL.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\CAOyVjn.exe
  C:\Windows\System\CAOyVjn.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\sktlUDz.exe
  C:\Windows\System\sktlUDz.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\sHThsdV.exe
  C:\Windows\System\sHThsdV.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\aqQIfFq.exe
  C:\Windows\System\aqQIfFq.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\LPKCqBx.exe
  C:\Windows\System\LPKCqBx.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\cdvLdws.exe
  C:\Windows\System\cdvLdws.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\ivSunaK.exe
  C:\Windows\System\ivSunaK.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\UcUUnea.exe
  C:\Windows\System\UcUUnea.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\TlczYZh.exe
  C:\Windows\System\TlczYZh.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\jzpAeWT.exe
  C:\Windows\System\jzpAeWT.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\fQyyTCF.exe
  C:\Windows\System\fQyyTCF.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\fDihaZh.exe
  C:\Windows\System\fDihaZh.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\PVanYVa.exe
  C:\Windows\System\PVanYVa.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\YCOYunV.exe
  C:\Windows\System\YCOYunV.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\FUhdhYX.exe
  C:\Windows\System\FUhdhYX.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\ZgjDxAF.exe
  C:\Windows\System\ZgjDxAF.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\gFLlodd.exe
  C:\Windows\System\gFLlodd.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\SvLQCDq.exe
  C:\Windows\System\SvLQCDq.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ovFmuyX.exe
  C:\Windows\System\ovFmuyX.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\WJzrfDu.exe
  C:\Windows\System\WJzrfDu.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\XbHLiRG.exe
  C:\Windows\System\XbHLiRG.exe
  2⤵
  - Executes dropped EXE
  PID:5220
- C:\Windows\System\vueUbCF.exe
  C:\Windows\System\vueUbCF.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\elTIvrF.exe
  C:\Windows\System\elTIvrF.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\WmhegVv.exe
  C:\Windows\System\WmhegVv.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Windows\System\LiFDzYI.exe
  C:\Windows\System\LiFDzYI.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\fSOZqpg.exe
  C:\Windows\System\fSOZqpg.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\pyyTBrO.exe
  C:\Windows\System\pyyTBrO.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System\XoUkrgf.exe
  C:\Windows\System\XoUkrgf.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\NqSbEJq.exe
  C:\Windows\System\NqSbEJq.exe
  2⤵
  - Executes dropped EXE
  PID:5456
- C:\Windows\System\YEmhWqf.exe
  C:\Windows\System\YEmhWqf.exe
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Windows\System\cIASkGZ.exe
  C:\Windows\System\cIASkGZ.exe
  2⤵
  - Executes dropped EXE
  PID:5520
- C:\Windows\System\JJJCnCY.exe
  C:\Windows\System\JJJCnCY.exe
  2⤵
  PID:5544
- C:\Windows\System\FoiJgQS.exe
  C:\Windows\System\FoiJgQS.exe
  2⤵
  PID:5568
- C:\Windows\System\BZxFgNs.exe
  C:\Windows\System\BZxFgNs.exe
  2⤵
  PID:5592
- C:\Windows\System\wIRScmI.exe
  C:\Windows\System\wIRScmI.exe
  2⤵
  PID:5616
- C:\Windows\System\gCFBvjl.exe
  C:\Windows\System\gCFBvjl.exe
  2⤵
  PID:5640
- C:\Windows\System\APosgSE.exe
  C:\Windows\System\APosgSE.exe
  2⤵
  PID:5664
- C:\Windows\System\ZPftRXl.exe
  C:\Windows\System\ZPftRXl.exe
  2⤵
  PID:5696
- C:\Windows\System\ReSTjoY.exe
  C:\Windows\System\ReSTjoY.exe
  2⤵
  PID:5724
- C:\Windows\System\gfTsOXB.exe
  C:\Windows\System\gfTsOXB.exe
  2⤵
  PID:5764
- C:\Windows\System\UarOKNo.exe
  C:\Windows\System\UarOKNo.exe
  2⤵
  PID:5816
- C:\Windows\System\HSSnOlr.exe
  C:\Windows\System\HSSnOlr.exe
  2⤵
  PID:5832
- C:\Windows\System\DXJKBcN.exe
  C:\Windows\System\DXJKBcN.exe
  2⤵
  PID:5860
- C:\Windows\System\cHRUqxo.exe
  C:\Windows\System\cHRUqxo.exe
  2⤵
  PID:5896
- C:\Windows\System\cziSUkU.exe
  C:\Windows\System\cziSUkU.exe
  2⤵
  PID:5928
- C:\Windows\System\VhhicLx.exe
  C:\Windows\System\VhhicLx.exe
  2⤵
  PID:5952
- C:\Windows\System\EnYPvfR.exe
  C:\Windows\System\EnYPvfR.exe
  2⤵
  PID:5976
- C:\Windows\System\opcCoob.exe
  C:\Windows\System\opcCoob.exe
  2⤵
  PID:6000
- C:\Windows\System\eQckbcl.exe
  C:\Windows\System\eQckbcl.exe
  2⤵
  PID:6016
- C:\Windows\System\XzilEIY.exe
  C:\Windows\System\XzilEIY.exe
  2⤵
  PID:6048
- C:\Windows\System\eDllulx.exe
  C:\Windows\System\eDllulx.exe
  2⤵
  PID:6100
- C:\Windows\System\ztsVvVu.exe
  C:\Windows\System\ztsVvVu.exe
  2⤵
  PID:6120
- C:\Windows\System\KSPKuUL.exe
  C:\Windows\System\KSPKuUL.exe
  2⤵
  PID:548
- C:\Windows\System\fNQvLWL.exe
  C:\Windows\System\fNQvLWL.exe
  2⤵
  PID:1184
- C:\Windows\System\grdwfQo.exe
  C:\Windows\System\grdwfQo.exe
  2⤵
  PID:3532
- C:\Windows\System\nUhUAee.exe
  C:\Windows\System\nUhUAee.exe
  2⤵
  PID:672
- C:\Windows\System\SOXeMiX.exe
  C:\Windows\System\SOXeMiX.exe
  2⤵
  PID:5136
- C:\Windows\System\ccYRFOf.exe
  C:\Windows\System\ccYRFOf.exe
  2⤵
  PID:5180
- C:\Windows\System\doFIiIe.exe
  C:\Windows\System\doFIiIe.exe
  2⤵
  PID:5228
- C:\Windows\System\AiQTvSm.exe
  C:\Windows\System\AiQTvSm.exe
  2⤵
  PID:5280
- C:\Windows\System\NcgVbJV.exe
  C:\Windows\System\NcgVbJV.exe
  2⤵
  PID:5340
- C:\Windows\System\IoLIIgM.exe
  C:\Windows\System\IoLIIgM.exe
  2⤵
  PID:5392
- C:\Windows\System\NrnhKFc.exe
  C:\Windows\System\NrnhKFc.exe
  2⤵
  PID:5436
- C:\Windows\System\eBpfiEV.exe
  C:\Windows\System\eBpfiEV.exe
  2⤵
  PID:4092
- C:\Windows\System\jeysxHc.exe
  C:\Windows\System\jeysxHc.exe
  2⤵
  PID:5564
- C:\Windows\System\RzFyDRb.exe
  C:\Windows\System\RzFyDRb.exe
  2⤵
  PID:1996
- C:\Windows\System\IVnPzLD.exe
  C:\Windows\System\IVnPzLD.exe
  2⤵
  PID:1616
- C:\Windows\System\wSghkhm.exe
  C:\Windows\System\wSghkhm.exe
  2⤵
  PID:5720
- C:\Windows\System\DkeexwH.exe
  C:\Windows\System\DkeexwH.exe
  2⤵
  PID:5804
- C:\Windows\System\nCmHvDt.exe
  C:\Windows\System\nCmHvDt.exe
  2⤵
  PID:1924
- C:\Windows\System\FOoaUyj.exe
  C:\Windows\System\FOoaUyj.exe
  2⤵
  PID:5912
- C:\Windows\System\HpTFtTq.exe
  C:\Windows\System\HpTFtTq.exe
  2⤵
  PID:5984
- C:\Windows\System\yxGbenL.exe
  C:\Windows\System\yxGbenL.exe
  2⤵
  PID:6032
- C:\Windows\System\ChfHTgw.exe
  C:\Windows\System\ChfHTgw.exe
  2⤵
  PID:6112
- C:\Windows\System\zWZAHvR.exe
  C:\Windows\System\zWZAHvR.exe
  2⤵
  PID:1096
- C:\Windows\System\pBfYpLF.exe
  C:\Windows\System\pBfYpLF.exe
  2⤵
  PID:1552
- C:\Windows\System\DzgGERy.exe
  C:\Windows\System\DzgGERy.exe
  2⤵
  PID:864
- C:\Windows\System\OWmucWK.exe
  C:\Windows\System\OWmucWK.exe
  2⤵
  PID:1608
- C:\Windows\System\TFfGDFD.exe
  C:\Windows\System\TFfGDFD.exe
  2⤵
  PID:1700
- C:\Windows\System\OhZaBeH.exe
  C:\Windows\System\OhZaBeH.exe
  2⤵
  PID:5500
- C:\Windows\System\diLZyfN.exe
  C:\Windows\System\diLZyfN.exe
  2⤵
  PID:5624
- C:\Windows\System\iWGAaVz.exe
  C:\Windows\System\iWGAaVz.exe
  2⤵
  PID:5708
- C:\Windows\System\olprXcg.exe
  C:\Windows\System\olprXcg.exe
  2⤵
  PID:5792
- C:\Windows\System\ointitp.exe
  C:\Windows\System\ointitp.exe
  2⤵
  PID:804
- C:\Windows\System\FWiYBah.exe
  C:\Windows\System\FWiYBah.exe
  2⤵
  PID:4584
- C:\Windows\System\itgrrob.exe
  C:\Windows\System\itgrrob.exe
  2⤵
  PID:4988
- C:\Windows\System\RGaBaad.exe
  C:\Windows\System\RGaBaad.exe
  2⤵
  PID:1592
- C:\Windows\System\wVkKXmg.exe
  C:\Windows\System\wVkKXmg.exe
  2⤵
  PID:2328
- C:\Windows\System\HqgSyGf.exe
  C:\Windows\System\HqgSyGf.exe
  2⤵
  PID:4272
- C:\Windows\System\jcWLgCR.exe
  C:\Windows\System\jcWLgCR.exe
  2⤵
  PID:5608
- C:\Windows\System\DvPzbTs.exe
  C:\Windows\System\DvPzbTs.exe
  2⤵
  PID:456
- C:\Windows\System\fkSFQxm.exe
  C:\Windows\System\fkSFQxm.exe
  2⤵
  PID:4424
- C:\Windows\System\ITzMcRH.exe
  C:\Windows\System\ITzMcRH.exe
  2⤵
  PID:4944
- C:\Windows\System\RqZUqnt.exe
  C:\Windows\System\RqZUqnt.exe
  2⤵
  PID:3248
- C:\Windows\System\pSNgQBT.exe
  C:\Windows\System\pSNgQBT.exe
  2⤵
  PID:2924
- C:\Windows\System\NWIYVMy.exe
  C:\Windows\System\NWIYVMy.exe
  2⤵
  PID:6068
- C:\Windows\System\RuZNgHH.exe
  C:\Windows\System\RuZNgHH.exe
  2⤵
  PID:6028
- C:\Windows\System\xuZDHDM.exe
  C:\Windows\System\xuZDHDM.exe
  2⤵
  PID:1148
- C:\Windows\System\NsPcxOi.exe
  C:\Windows\System\NsPcxOi.exe
  2⤵
  PID:5484
- C:\Windows\System\LfLNyAJ.exe
  C:\Windows\System\LfLNyAJ.exe
  2⤵
  PID:5680
- C:\Windows\System\iKSZlbO.exe
  C:\Windows\System\iKSZlbO.exe
  2⤵
  PID:4880
- C:\Windows\System\pcuEQDf.exe
  C:\Windows\System\pcuEQDf.exe
  2⤵
  PID:1116
- C:\Windows\System\ygkUsDi.exe
  C:\Windows\System\ygkUsDi.exe
  2⤵
  PID:5604
- C:\Windows\System\UUisIyT.exe
  C:\Windows\System\UUisIyT.exe
  2⤵
  PID:6160
- C:\Windows\System\YDKtWQZ.exe
  C:\Windows\System\YDKtWQZ.exe
  2⤵
  PID:6176
- C:\Windows\System\zBaCWwy.exe
  C:\Windows\System\zBaCWwy.exe
  2⤵
  PID:6196
- C:\Windows\System\vkEyfqT.exe
  C:\Windows\System\vkEyfqT.exe
  2⤵
  PID:6236
- C:\Windows\System\CpuFBMZ.exe
  C:\Windows\System\CpuFBMZ.exe
  2⤵
  PID:6260
- C:\Windows\System\gJBnogt.exe
  C:\Windows\System\gJBnogt.exe
  2⤵
  PID:6280
- C:\Windows\System\xizkOEh.exe
  C:\Windows\System\xizkOEh.exe
  2⤵
  PID:6312
- C:\Windows\System\WIzbKCj.exe
  C:\Windows\System\WIzbKCj.exe
  2⤵
  PID:6328
- C:\Windows\System\GntpbsV.exe
  C:\Windows\System\GntpbsV.exe
  2⤵
  PID:6348
- C:\Windows\System\ucgRxWC.exe
  C:\Windows\System\ucgRxWC.exe
  2⤵
  PID:6368
- C:\Windows\System\KthvkKp.exe
  C:\Windows\System\KthvkKp.exe
  2⤵
  PID:6388
- C:\Windows\System\YzEuuGF.exe
  C:\Windows\System\YzEuuGF.exe
  2⤵
  PID:6408
- C:\Windows\System\VziqIgD.exe
  C:\Windows\System\VziqIgD.exe
  2⤵
  PID:6452
- C:\Windows\System\uKcYMEJ.exe
  C:\Windows\System\uKcYMEJ.exe
  2⤵
  PID:6504
- C:\Windows\System\yAnIcVn.exe
  C:\Windows\System\yAnIcVn.exe
  2⤵
  PID:6520
- C:\Windows\System\FXfbbGU.exe
  C:\Windows\System\FXfbbGU.exe
  2⤵
  PID:6544
- C:\Windows\System\eXsKBTu.exe
  C:\Windows\System\eXsKBTu.exe
  2⤵
  PID:6604
- C:\Windows\System\HjUNVmI.exe
  C:\Windows\System\HjUNVmI.exe
  2⤵
  PID:6640
- C:\Windows\System\mOyzxlu.exe
  C:\Windows\System\mOyzxlu.exe
  2⤵
  PID:6684
- C:\Windows\System\IkfntVO.exe
  C:\Windows\System\IkfntVO.exe
  2⤵
  PID:6708
- C:\Windows\System\GChtFYX.exe
  C:\Windows\System\GChtFYX.exe
  2⤵
  PID:6740
- C:\Windows\System\EJeFhZo.exe
  C:\Windows\System\EJeFhZo.exe
  2⤵
  PID:6764
- C:\Windows\System\ikQIjcR.exe
  C:\Windows\System\ikQIjcR.exe
  2⤵
  PID:6784
- C:\Windows\System\YKqOriI.exe
  C:\Windows\System\YKqOriI.exe
  2⤵
  PID:6828
- C:\Windows\System\dYzKIJi.exe
  C:\Windows\System\dYzKIJi.exe
  2⤵
  PID:6848
- C:\Windows\System\yTcmoCi.exe
  C:\Windows\System\yTcmoCi.exe
  2⤵
  PID:6868
- C:\Windows\System\xzBtaKv.exe
  C:\Windows\System\xzBtaKv.exe
  2⤵
  PID:6900
- C:\Windows\System\IssFUah.exe
  C:\Windows\System\IssFUah.exe
  2⤵
  PID:6928
- C:\Windows\System\ZQMFJxI.exe
  C:\Windows\System\ZQMFJxI.exe
  2⤵
  PID:6956
- C:\Windows\System\fNwTREZ.exe
  C:\Windows\System\fNwTREZ.exe
  2⤵
  PID:6972
- C:\Windows\System\fWrAIbV.exe
  C:\Windows\System\fWrAIbV.exe
  2⤵
  PID:6996
- C:\Windows\System\ZyBclJF.exe
  C:\Windows\System\ZyBclJF.exe
  2⤵
  PID:7016
- C:\Windows\System\rRsTlqR.exe
  C:\Windows\System\rRsTlqR.exe
  2⤵
  PID:7036
- C:\Windows\System\jDzuFwD.exe
  C:\Windows\System\jDzuFwD.exe
  2⤵
  PID:7056
- C:\Windows\System\LtMNlxR.exe
  C:\Windows\System\LtMNlxR.exe
  2⤵
  PID:7120
- C:\Windows\System\HXMQtuQ.exe
  C:\Windows\System\HXMQtuQ.exe
  2⤵
  PID:7140
- C:\Windows\System\OhEKbmn.exe
  C:\Windows\System\OhEKbmn.exe
  2⤵
  PID:7156
- C:\Windows\System\rsrtBKw.exe
  C:\Windows\System\rsrtBKw.exe
  2⤵
  PID:1860
- C:\Windows\System\MqERtSe.exe
  C:\Windows\System\MqERtSe.exe
  2⤵
  PID:1732
- C:\Windows\System\XHMNAir.exe
  C:\Windows\System\XHMNAir.exe
  2⤵
  PID:6152
- C:\Windows\System\udlpHCl.exe
  C:\Windows\System\udlpHCl.exe
  2⤵
  PID:6232
- C:\Windows\System\pJfkFxf.exe
  C:\Windows\System\pJfkFxf.exe
  2⤵
  PID:6364
- C:\Windows\System\ITdfGEc.exe
  C:\Windows\System\ITdfGEc.exe
  2⤵
  PID:6448
- C:\Windows\System\oDjcSMU.exe
  C:\Windows\System\oDjcSMU.exe
  2⤵
  PID:6444
- C:\Windows\System\siiJViB.exe
  C:\Windows\System\siiJViB.exe
  2⤵
  PID:6528
- C:\Windows\System\XpNOFpH.exe
  C:\Windows\System\XpNOFpH.exe
  2⤵
  PID:6596
- C:\Windows\System\YIMSGAx.exe
  C:\Windows\System\YIMSGAx.exe
  2⤵
  PID:6704
- C:\Windows\System\iqAhGwm.exe
  C:\Windows\System\iqAhGwm.exe
  2⤵
  PID:6780
- C:\Windows\System\jkLNpZh.exe
  C:\Windows\System\jkLNpZh.exe
  2⤵
  PID:6836
- C:\Windows\System\mcDzcDe.exe
  C:\Windows\System\mcDzcDe.exe
  2⤵
  PID:6908
- C:\Windows\System\BLGAVLK.exe
  C:\Windows\System\BLGAVLK.exe
  2⤵
  PID:6964
- C:\Windows\System\LfyFbek.exe
  C:\Windows\System\LfyFbek.exe
  2⤵
  PID:4820
- C:\Windows\System\UrTQCqX.exe
  C:\Windows\System\UrTQCqX.exe
  2⤵
  PID:7008
- C:\Windows\System\UvWxvuc.exe
  C:\Windows\System\UvWxvuc.exe
  2⤵
  PID:2352
- C:\Windows\System\BvsovCN.exe
  C:\Windows\System\BvsovCN.exe
  2⤵
  PID:7164
- C:\Windows\System\tiBoPwr.exe
  C:\Windows\System\tiBoPwr.exe
  2⤵
  PID:1464
- C:\Windows\System\SicfOYz.exe
  C:\Windows\System\SicfOYz.exe
  2⤵
  PID:6600
- C:\Windows\System\jtoznqW.exe
  C:\Windows\System\jtoznqW.exe
  2⤵
  PID:6628
- C:\Windows\System\UVxLmQl.exe
  C:\Windows\System\UVxLmQl.exe
  2⤵
  PID:6752
- C:\Windows\System\HgnexAj.exe
  C:\Windows\System\HgnexAj.exe
  2⤵
  PID:6896
- C:\Windows\System\RBAkxWp.exe
  C:\Windows\System\RBAkxWp.exe
  2⤵
  PID:6892
- C:\Windows\System\pwTmsjz.exe
  C:\Windows\System\pwTmsjz.exe
  2⤵
  PID:7096
- C:\Windows\System\gffAycR.exe
  C:\Windows\System\gffAycR.exe
  2⤵
  PID:6172
- C:\Windows\System\xcBvBKR.exe
  C:\Windows\System\xcBvBKR.exe
  2⤵
  PID:6460
- C:\Windows\System\vsLTJRM.exe
  C:\Windows\System\vsLTJRM.exe
  2⤵
  PID:6512
- C:\Windows\System\uahQzjb.exe
  C:\Windows\System\uahQzjb.exe
  2⤵
  PID:6980
- C:\Windows\System\VRhYuLW.exe
  C:\Windows\System\VRhYuLW.exe
  2⤵
  PID:7188
- C:\Windows\System\Lewkiqv.exe
  C:\Windows\System\Lewkiqv.exe
  2⤵
  PID:7228
- C:\Windows\System\yjRQISX.exe
  C:\Windows\System\yjRQISX.exe
  2⤵
  PID:7244
- C:\Windows\System\QSRdOrV.exe
  C:\Windows\System\QSRdOrV.exe
  2⤵
  PID:7264
- C:\Windows\System\iMjfKrQ.exe
  C:\Windows\System\iMjfKrQ.exe
  2⤵
  PID:7312
- C:\Windows\System\LYppmVn.exe
  C:\Windows\System\LYppmVn.exe
  2⤵
  PID:7332
- C:\Windows\System\xNcklrP.exe
  C:\Windows\System\xNcklrP.exe
  2⤵
  PID:7352
- C:\Windows\System\tFregYo.exe
  C:\Windows\System\tFregYo.exe
  2⤵
  PID:7400
- C:\Windows\System\vcDPJII.exe
  C:\Windows\System\vcDPJII.exe
  2⤵
  PID:7424
- C:\Windows\System\KrYwYBB.exe
  C:\Windows\System\KrYwYBB.exe
  2⤵
  PID:7444
- C:\Windows\System\uDPutji.exe
  C:\Windows\System\uDPutji.exe
  2⤵
  PID:7460
- C:\Windows\System\HnWLYaH.exe
  C:\Windows\System\HnWLYaH.exe
  2⤵
  PID:7496
- C:\Windows\System\oHvpgBW.exe
  C:\Windows\System\oHvpgBW.exe
  2⤵
  PID:7528
- C:\Windows\System\xldgnAm.exe
  C:\Windows\System\xldgnAm.exe
  2⤵
  PID:7544
- C:\Windows\System\kVYYfzs.exe
  C:\Windows\System\kVYYfzs.exe
  2⤵
  PID:7564
- C:\Windows\System\bhoeVhq.exe
  C:\Windows\System\bhoeVhq.exe
  2⤵
  PID:7580
- C:\Windows\System\xOmnVgG.exe
  C:\Windows\System\xOmnVgG.exe
  2⤵
  PID:7608
- C:\Windows\System\TkHTycc.exe
  C:\Windows\System\TkHTycc.exe
  2⤵
  PID:7628
- C:\Windows\System\ffqqXlE.exe
  C:\Windows\System\ffqqXlE.exe
  2⤵
  PID:7648
- C:\Windows\System\zpuptXO.exe
  C:\Windows\System\zpuptXO.exe
  2⤵
  PID:7696
- C:\Windows\System\UTWIrtd.exe
  C:\Windows\System\UTWIrtd.exe
  2⤵
  PID:7716
- C:\Windows\System\kLEdFfG.exe
  C:\Windows\System\kLEdFfG.exe
  2⤵
  PID:7768
- C:\Windows\System\QOFYIoe.exe
  C:\Windows\System\QOFYIoe.exe
  2⤵
  PID:7788
- C:\Windows\System\rUSisll.exe
  C:\Windows\System\rUSisll.exe
  2⤵
  PID:7804
- C:\Windows\System\eBsDBXN.exe
  C:\Windows\System\eBsDBXN.exe
  2⤵
  PID:7840
- C:\Windows\System\IZiISPl.exe
  C:\Windows\System\IZiISPl.exe
  2⤵
  PID:7864
- C:\Windows\System\rrajeUn.exe
  C:\Windows\System\rrajeUn.exe
  2⤵
  PID:7880
- C:\Windows\System\gBOdvnV.exe
  C:\Windows\System\gBOdvnV.exe
  2⤵
  PID:7896
- C:\Windows\System\iFAmjRP.exe
  C:\Windows\System\iFAmjRP.exe
  2⤵
  PID:7916
- C:\Windows\System\jxahycA.exe
  C:\Windows\System\jxahycA.exe
  2⤵
  PID:7932
- C:\Windows\System\qsBdGTn.exe
  C:\Windows\System\qsBdGTn.exe
  2⤵
  PID:7952
- C:\Windows\System\OLbDIZT.exe
  C:\Windows\System\OLbDIZT.exe
  2⤵
  PID:7968
- C:\Windows\System\OmZOLBM.exe
  C:\Windows\System\OmZOLBM.exe
  2⤵
  PID:7984
- C:\Windows\System\LoFHpWW.exe
  C:\Windows\System\LoFHpWW.exe
  2⤵
  PID:8004
- C:\Windows\System\xvPmigu.exe
  C:\Windows\System\xvPmigu.exe
  2⤵
  PID:8028
- C:\Windows\System\jlAJUqS.exe
  C:\Windows\System\jlAJUqS.exe
  2⤵
  PID:8056
- C:\Windows\System\SReUoEV.exe
  C:\Windows\System\SReUoEV.exe
  2⤵
  PID:8092
- C:\Windows\System\MfnrWaW.exe
  C:\Windows\System\MfnrWaW.exe
  2⤵
  PID:8116
- C:\Windows\System\PFGpALS.exe
  C:\Windows\System\PFGpALS.exe
  2⤵
  PID:8136
- C:\Windows\System\HRtGDnZ.exe
  C:\Windows\System\HRtGDnZ.exe
  2⤵
  PID:8156
- C:\Windows\System\QNvRndX.exe
  C:\Windows\System\QNvRndX.exe
  2⤵
  PID:8180
- C:\Windows\System\zlZesxc.exe
  C:\Windows\System\zlZesxc.exe
  2⤵
  PID:7152
- C:\Windows\System\qKFYEzq.exe
  C:\Windows\System\qKFYEzq.exe
  2⤵
  PID:7208
- C:\Windows\System\aPGFMeN.exe
  C:\Windows\System\aPGFMeN.exe
  2⤵
  PID:7240
- C:\Windows\System\HDBKOlx.exe
  C:\Windows\System\HDBKOlx.exe
  2⤵
  PID:7256
- C:\Windows\System\MipLKlt.exe
  C:\Windows\System\MipLKlt.exe
  2⤵
  PID:7304
- C:\Windows\System\WnkOMxO.exe
  C:\Windows\System\WnkOMxO.exe
  2⤵
  PID:7344
- C:\Windows\System\bnhIrYf.exe
  C:\Windows\System\bnhIrYf.exe
  2⤵
  PID:7372
- C:\Windows\System\qMEjfEV.exe
  C:\Windows\System\qMEjfEV.exe
  2⤵
  PID:7504
- C:\Windows\System\WfCeBtc.exe
  C:\Windows\System\WfCeBtc.exe
  2⤵
  PID:7540
- C:\Windows\System\nrLCoTy.exe
  C:\Windows\System\nrLCoTy.exe
  2⤵
  PID:7536
- C:\Windows\System\bjefEUb.exe
  C:\Windows\System\bjefEUb.exe
  2⤵
  PID:7556
- C:\Windows\System\dBZMCKZ.exe
  C:\Windows\System\dBZMCKZ.exe
  2⤵
  PID:7596
- C:\Windows\System\ynJCXLr.exe
  C:\Windows\System\ynJCXLr.exe
  2⤵
  PID:7644
- C:\Windows\System\rmdmZWC.exe
  C:\Windows\System\rmdmZWC.exe
  2⤵
  PID:7712
- C:\Windows\System\DJpNDdO.exe
  C:\Windows\System\DJpNDdO.exe
  2⤵
  PID:7780
- C:\Windows\System\MmvOFVP.exe
  C:\Windows\System\MmvOFVP.exe
  2⤵
  PID:7760
- C:\Windows\System\pkQVrYn.exe
  C:\Windows\System\pkQVrYn.exe
  2⤵
  PID:7832
- C:\Windows\System\gxEuYjm.exe
  C:\Windows\System\gxEuYjm.exe
  2⤵
  PID:7944
- C:\Windows\System\POIIyMD.exe
  C:\Windows\System\POIIyMD.exe
  2⤵
  PID:7848
- C:\Windows\System\szZIymR.exe
  C:\Windows\System\szZIymR.exe
  2⤵
  PID:8012
- C:\Windows\System\fZkKiBU.exe
  C:\Windows\System\fZkKiBU.exe
  2⤵
  PID:8020
- C:\Windows\System\HThwYLY.exe
  C:\Windows\System\HThwYLY.exe
  2⤵
  PID:7928
- C:\Windows\System\KXWVgCq.exe
  C:\Windows\System\KXWVgCq.exe
  2⤵
  PID:3628
- C:\Windows\System\lUPwWlj.exe
  C:\Windows\System\lUPwWlj.exe
  2⤵
  PID:8132
- C:\Windows\System\jOZCnXH.exe
  C:\Windows\System\jOZCnXH.exe
  2⤵
  PID:8212
- C:\Windows\System\IwUCXTi.exe
  C:\Windows\System\IwUCXTi.exe
  2⤵
  PID:8232
- C:\Windows\System\wPKjnLw.exe
  C:\Windows\System\wPKjnLw.exe
  2⤵
  PID:8252
- C:\Windows\System\yZATwgb.exe
  C:\Windows\System\yZATwgb.exe
  2⤵
  PID:8272
- C:\Windows\System\Kcqrazo.exe
  C:\Windows\System\Kcqrazo.exe
  2⤵
  PID:8296
- C:\Windows\System\ovzFkTn.exe
  C:\Windows\System\ovzFkTn.exe
  2⤵
  PID:8312
- C:\Windows\System\CElFjOv.exe
  C:\Windows\System\CElFjOv.exe
  2⤵
  PID:8336
- C:\Windows\System\vxsZxCb.exe
  C:\Windows\System\vxsZxCb.exe
  2⤵
  PID:8352
- C:\Windows\System\YKpjxZU.exe
  C:\Windows\System\YKpjxZU.exe
  2⤵
  PID:8372
- C:\Windows\System\VAjsiSS.exe
  C:\Windows\System\VAjsiSS.exe
  2⤵
  PID:8396
- C:\Windows\System\rjyOmZo.exe
  C:\Windows\System\rjyOmZo.exe
  2⤵
  PID:8412
- C:\Windows\System\TlgQNYJ.exe
  C:\Windows\System\TlgQNYJ.exe
  2⤵
  PID:8436
- C:\Windows\System\XZRUXBp.exe
  C:\Windows\System\XZRUXBp.exe
  2⤵
  PID:8456
- C:\Windows\System\HcJfIQi.exe
  C:\Windows\System\HcJfIQi.exe
  2⤵
  PID:8472
- C:\Windows\System\dFYJSbV.exe
  C:\Windows\System\dFYJSbV.exe
  2⤵
  PID:8492
- C:\Windows\System\nkCCtHA.exe
  C:\Windows\System\nkCCtHA.exe
  2⤵
  PID:8508
- C:\Windows\System\yQbfcJG.exe
  C:\Windows\System\yQbfcJG.exe
  2⤵
  PID:8524
- C:\Windows\System\NWCpVVP.exe
  C:\Windows\System\NWCpVVP.exe
  2⤵
  PID:8544
- C:\Windows\System\mFqtnWD.exe
  C:\Windows\System\mFqtnWD.exe
  2⤵
  PID:8564
- C:\Windows\System\jHBIRoR.exe
  C:\Windows\System\jHBIRoR.exe
  2⤵
  PID:8584
- C:\Windows\System\SFZPjTJ.exe
  C:\Windows\System\SFZPjTJ.exe
  2⤵
  PID:8600
- C:\Windows\System\bXNUSxi.exe
  C:\Windows\System\bXNUSxi.exe
  2⤵
  PID:8624
- C:\Windows\System\bsLMsjF.exe
  C:\Windows\System\bsLMsjF.exe
  2⤵
  PID:8640
- C:\Windows\System\KZuzUEH.exe
  C:\Windows\System\KZuzUEH.exe
  2⤵
  PID:8664
- C:\Windows\System\kvizviF.exe
  C:\Windows\System\kvizviF.exe
  2⤵
  PID:8680
- C:\Windows\System\sUYoYzH.exe
  C:\Windows\System\sUYoYzH.exe
  2⤵
  PID:8704
- C:\Windows\System\gxKbsrt.exe
  C:\Windows\System\gxKbsrt.exe
  2⤵
  PID:8720
- C:\Windows\System\KZXBMIJ.exe
  C:\Windows\System\KZXBMIJ.exe
  2⤵
  PID:8744
- C:\Windows\System\MVBZXut.exe
  C:\Windows\System\MVBZXut.exe
  2⤵
  PID:8760
- C:\Windows\System\WAYUuVp.exe
  C:\Windows\System\WAYUuVp.exe
  2⤵
  PID:8780
- C:\Windows\System\rhKgziZ.exe
  C:\Windows\System\rhKgziZ.exe
  2⤵
  PID:8800
- C:\Windows\System\fxgepGn.exe
  C:\Windows\System\fxgepGn.exe
  2⤵
  PID:8820
- C:\Windows\System\fJuQEwn.exe
  C:\Windows\System\fJuQEwn.exe
  2⤵
  PID:8836
- C:\Windows\System\WixWVpO.exe
  C:\Windows\System\WixWVpO.exe
  2⤵
  PID:8852
- C:\Windows\System\XuWeSDf.exe
  C:\Windows\System\XuWeSDf.exe
  2⤵
  PID:8876
- C:\Windows\System\JAGQdjH.exe
  C:\Windows\System\JAGQdjH.exe
  2⤵
  PID:8892
- C:\Windows\System\scawEDB.exe
  C:\Windows\System\scawEDB.exe
  2⤵
  PID:8916
- C:\Windows\System\sgIyiqm.exe
  C:\Windows\System\sgIyiqm.exe
  2⤵
  PID:8932
- C:\Windows\System\PPPSewl.exe
  C:\Windows\System\PPPSewl.exe
  2⤵
  PID:8952
- C:\Windows\System\WVElvbP.exe
  C:\Windows\System\WVElvbP.exe
  2⤵
  PID:8972
- C:\Windows\System\QCJpfIi.exe
  C:\Windows\System\QCJpfIi.exe
  2⤵
  PID:8992
- C:\Windows\System\OUSiDkJ.exe
  C:\Windows\System\OUSiDkJ.exe
  2⤵
  PID:9016
- C:\Windows\System\EBEZFYt.exe
  C:\Windows\System\EBEZFYt.exe
  2⤵
  PID:9032
- C:\Windows\System\SBbzxkZ.exe
  C:\Windows\System\SBbzxkZ.exe
  2⤵
  PID:9052
- C:\Windows\System\hNlEunQ.exe
  C:\Windows\System\hNlEunQ.exe
  2⤵
  PID:9076
- C:\Windows\System\cpmziLp.exe
  C:\Windows\System\cpmziLp.exe
  2⤵
  PID:9092
- C:\Windows\System\iAqqikZ.exe
  C:\Windows\System\iAqqikZ.exe
  2⤵
  PID:9112
- C:\Windows\System\hCJqdAR.exe
  C:\Windows\System\hCJqdAR.exe
  2⤵
  PID:9132
- C:\Windows\System\JGHhFjw.exe
  C:\Windows\System\JGHhFjw.exe
  2⤵
  PID:9152
- C:\Windows\System\JBebiLd.exe
  C:\Windows\System\JBebiLd.exe
  2⤵
  PID:9176
- C:\Windows\System\CWjSTFG.exe
  C:\Windows\System\CWjSTFG.exe
  2⤵
  PID:9192
- C:\Windows\System\CFHRwAQ.exe
  C:\Windows\System\CFHRwAQ.exe
  2⤵
  PID:8188
- C:\Windows\System\iSIojVo.exe
  C:\Windows\System\iSIojVo.exe
  2⤵
  PID:7588
- C:\Windows\System\IVzqOlt.exe
  C:\Windows\System\IVzqOlt.exe
  2⤵
  PID:8048
- C:\Windows\System\KkxBOLz.exe
  C:\Windows\System\KkxBOLz.exe
  2⤵
  PID:7908
- C:\Windows\System\fYlYxZK.exe
  C:\Windows\System\fYlYxZK.exe
  2⤵
  PID:7412
- C:\Windows\System\njptbFv.exe
  C:\Windows\System\njptbFv.exe
  2⤵
  PID:7492
- C:\Windows\System\yzzakjx.exe
  C:\Windows\System\yzzakjx.exe
  2⤵
  PID:7288
- C:\Windows\System\qIebBDb.exe
  C:\Windows\System\qIebBDb.exe
  2⤵
  PID:8208
- C:\Windows\System\kqFlsTF.exe
  C:\Windows\System\kqFlsTF.exe
  2⤵
  PID:6564
- C:\Windows\System\awbabLl.exe
  C:\Windows\System\awbabLl.exe
  2⤵
  PID:8332
- C:\Windows\System\vGMVVmX.exe
  C:\Windows\System\vGMVVmX.exe
  2⤵
  PID:8392
- C:\Windows\System\tdzclBb.exe
  C:\Windows\System\tdzclBb.exe
  2⤵
  PID:8420
- C:\Windows\System\LncTynN.exe
  C:\Windows\System\LncTynN.exe
  2⤵
  PID:7220
- C:\Windows\System\vHksruy.exe
  C:\Windows\System\vHksruy.exe
  2⤵
  PID:8500
- C:\Windows\System\QeCCaVH.exe
  C:\Windows\System\QeCCaVH.exe
  2⤵
  PID:8536
- C:\Windows\System\RDYixly.exe
  C:\Windows\System\RDYixly.exe
  2⤵
  PID:8616
- C:\Windows\System\vGOfYep.exe
  C:\Windows\System\vGOfYep.exe
  2⤵
  PID:2392
- C:\Windows\System\PzDuBNV.exe
  C:\Windows\System\PzDuBNV.exe
  2⤵
  PID:9232
- C:\Windows\System\XdzWGsX.exe
  C:\Windows\System\XdzWGsX.exe
  2⤵
  PID:9248
- C:\Windows\System\tJveBjb.exe
  C:\Windows\System\tJveBjb.exe
  2⤵
  PID:9264
- C:\Windows\System\owpjNDs.exe
  C:\Windows\System\owpjNDs.exe
  2⤵
  PID:9280
- C:\Windows\System\uBbOrTm.exe
  C:\Windows\System\uBbOrTm.exe
  2⤵
  PID:9304
- C:\Windows\System\WbqSbBn.exe
  C:\Windows\System\WbqSbBn.exe
  2⤵
  PID:9328
- C:\Windows\System\QuWmGDc.exe
  C:\Windows\System\QuWmGDc.exe
  2⤵
  PID:9348
- C:\Windows\System\OPTHlHS.exe
  C:\Windows\System\OPTHlHS.exe
  2⤵
  PID:9364
- C:\Windows\System\Liduvuh.exe
  C:\Windows\System\Liduvuh.exe
  2⤵
  PID:9392
- C:\Windows\System\qCTuiCH.exe
  C:\Windows\System\qCTuiCH.exe
  2⤵
  PID:9408
- C:\Windows\System\JjivLKi.exe
  C:\Windows\System\JjivLKi.exe
  2⤵
  PID:9424
- C:\Windows\System\jXpTJBW.exe
  C:\Windows\System\jXpTJBW.exe
  2⤵
  PID:9444
- C:\Windows\System\iHhcmXS.exe
  C:\Windows\System\iHhcmXS.exe
  2⤵
  PID:9468
- C:\Windows\System\anQkPan.exe
  C:\Windows\System\anQkPan.exe
  2⤵
  PID:9484
- C:\Windows\System\SMriTzr.exe
  C:\Windows\System\SMriTzr.exe
  2⤵
  PID:9504
- C:\Windows\System\iFKOeNP.exe
  C:\Windows\System\iFKOeNP.exe
  2⤵
  PID:9524
- C:\Windows\System\jIBQUnJ.exe
  C:\Windows\System\jIBQUnJ.exe
  2⤵
  PID:9544
- C:\Windows\System\yAisuXQ.exe
  C:\Windows\System\yAisuXQ.exe
  2⤵
  PID:9568
- C:\Windows\System\khLGXNK.exe
  C:\Windows\System\khLGXNK.exe
  2⤵
  PID:9588
- C:\Windows\System\AKzyksX.exe
  C:\Windows\System\AKzyksX.exe
  2⤵
  PID:9620
- C:\Windows\System\ggaXaCc.exe
  C:\Windows\System\ggaXaCc.exe
  2⤵
  PID:9636
- C:\Windows\System\KSRgtlU.exe
  C:\Windows\System\KSRgtlU.exe
  2⤵
  PID:9668
- C:\Windows\System\lYzWycE.exe
  C:\Windows\System\lYzWycE.exe
  2⤵
  PID:9696
- C:\Windows\System\GfPoztz.exe
  C:\Windows\System\GfPoztz.exe
  2⤵
  PID:9720
- C:\Windows\System\avjHEUK.exe
  C:\Windows\System\avjHEUK.exe
  2⤵
  PID:9740
- C:\Windows\System\CLbztdF.exe
  C:\Windows\System\CLbztdF.exe
  2⤵
  PID:9760
- C:\Windows\System\fAYCyGM.exe
  C:\Windows\System\fAYCyGM.exe
  2⤵
  PID:9776
- C:\Windows\System\ueTobag.exe
  C:\Windows\System\ueTobag.exe
  2⤵
  PID:9792
- C:\Windows\System\shZdwgE.exe
  C:\Windows\System\shZdwgE.exe
  2⤵
  PID:9812
- C:\Windows\System\JTrLUiv.exe
  C:\Windows\System\JTrLUiv.exe
  2⤵
  PID:9832
- C:\Windows\System\Umcvmlb.exe
  C:\Windows\System\Umcvmlb.exe
  2⤵
  PID:9848
- C:\Windows\System\ATWwwUk.exe
  C:\Windows\System\ATWwwUk.exe
  2⤵
  PID:9864
- C:\Windows\System\DbszuOF.exe
  C:\Windows\System\DbszuOF.exe
  2⤵
  PID:9888
- C:\Windows\System\BYXvjex.exe
  C:\Windows\System\BYXvjex.exe
  2⤵
  PID:9912
- C:\Windows\System\dOIRhpF.exe
  C:\Windows\System\dOIRhpF.exe
  2⤵
  PID:9936
- C:\Windows\System\fDTrvIY.exe
  C:\Windows\System\fDTrvIY.exe
  2⤵
  PID:9952
- C:\Windows\System\wXtodtc.exe
  C:\Windows\System\wXtodtc.exe
  2⤵
  PID:9968
- C:\Windows\System\MojnnVg.exe
  C:\Windows\System\MojnnVg.exe
  2⤵
  PID:9988
- C:\Windows\System\HTDlhkd.exe
  C:\Windows\System\HTDlhkd.exe
  2⤵
  PID:10004
- C:\Windows\System\RDyMFxU.exe
  C:\Windows\System\RDyMFxU.exe
  2⤵
  PID:10020
- C:\Windows\System\FVMcSUt.exe
  C:\Windows\System\FVMcSUt.exe
  2⤵
  PID:10044
- C:\Windows\System\jHZYJCv.exe
  C:\Windows\System\jHZYJCv.exe
  2⤵
  PID:10060
- C:\Windows\System\fKuQlMY.exe
  C:\Windows\System\fKuQlMY.exe
  2⤵
  PID:10084
- C:\Windows\System\OKWeQgu.exe
  C:\Windows\System\OKWeQgu.exe
  2⤵
  PID:10108
- C:\Windows\System\VitEPeS.exe
  C:\Windows\System\VitEPeS.exe
  2⤵
  PID:10128
- C:\Windows\System\VcwLQQJ.exe
  C:\Windows\System\VcwLQQJ.exe
  2⤵
  PID:10148
- C:\Windows\System\xydqALf.exe
  C:\Windows\System\xydqALf.exe
  2⤵
  PID:10168
- C:\Windows\System\uyCagsi.exe
  C:\Windows\System\uyCagsi.exe
  2⤵
  PID:10184
- C:\Windows\System\HfSnfaj.exe
  C:\Windows\System\HfSnfaj.exe
  2⤵
  PID:10204
- C:\Windows\System\VQCSZqj.exe
  C:\Windows\System\VQCSZqj.exe
  2⤵
  PID:10220
- C:\Windows\System\mcBjiVM.exe
  C:\Windows\System\mcBjiVM.exe
  2⤵
  PID:10236
- C:\Windows\System\AAtAspD.exe
  C:\Windows\System\AAtAspD.exe
  2⤵
  PID:8728
- C:\Windows\System\xeUGBcZ.exe
  C:\Windows\System\xeUGBcZ.exe
  2⤵
  PID:8816
- C:\Windows\System\BSSlvAN.exe
  C:\Windows\System\BSSlvAN.exe
  2⤵
  PID:8864
- C:\Windows\System\ttpSPzp.exe
  C:\Windows\System\ttpSPzp.exe
  2⤵
  PID:8292
- C:\Windows\System\oNpecNr.exe
  C:\Windows\System\oNpecNr.exe
  2⤵
  PID:8264
- C:\Windows\System\QxluMVL.exe
  C:\Windows\System\QxluMVL.exe
  2⤵
  PID:9024
- C:\Windows\System\jNRDRXt.exe
  C:\Windows\System\jNRDRXt.exe
  2⤵
  PID:9044
- C:\Windows\System\RBLOiHA.exe
  C:\Windows\System\RBLOiHA.exe
  2⤵
  PID:9104
- C:\Windows\System\AdtsKRk.exe
  C:\Windows\System\AdtsKRk.exe
  2⤵
  PID:9148
- C:\Windows\System\QrHIwGQ.exe
  C:\Windows\System\QrHIwGQ.exe
  2⤵
  PID:9168
- C:\Windows\System\iSrxVyV.exe
  C:\Windows\System\iSrxVyV.exe
  2⤵
  PID:8100
- C:\Windows\System\VPjqaEk.exe
  C:\Windows\System\VPjqaEk.exe
  2⤵
  PID:8128
- C:\Windows\System\HqGsCmG.exe
  C:\Windows\System\HqGsCmG.exe
  2⤵
  PID:8908
- C:\Windows\System\OWrhReY.exe
  C:\Windows\System\OWrhReY.exe
  2⤵
  PID:8964
- C:\Windows\System\uVtnmoS.exe
  C:\Windows\System\uVtnmoS.exe
  2⤵
  PID:9520
- C:\Windows\System\irjuoHM.exe
  C:\Windows\System\irjuoHM.exe
  2⤵
  PID:9516
- C:\Windows\System\nEczaod.exe
  C:\Windows\System\nEczaod.exe
  2⤵
  PID:10252
- C:\Windows\System\sAHZQKn.exe
  C:\Windows\System\sAHZQKn.exe
  2⤵
  PID:10384
- C:\Windows\System\yIIRxDV.exe
  C:\Windows\System\yIIRxDV.exe
  2⤵
  PID:10404
- C:\Windows\System\FqgGktv.exe
  C:\Windows\System\FqgGktv.exe
  2⤵
  PID:10420
- C:\Windows\System\VpvWmFa.exe
  C:\Windows\System\VpvWmFa.exe
  2⤵
  PID:10436
- C:\Windows\System\dBInznX.exe
  C:\Windows\System\dBInznX.exe
  2⤵
  PID:10452
- C:\Windows\System\tEzavmO.exe
  C:\Windows\System\tEzavmO.exe
  2⤵
  PID:10484
- C:\Windows\System\LOAotIQ.exe
  C:\Windows\System\LOAotIQ.exe
  2⤵
  PID:10500
- C:\Windows\System\dkHHBOK.exe
  C:\Windows\System\dkHHBOK.exe
  2⤵
  PID:10520
- C:\Windows\System\RazNhvq.exe
  C:\Windows\System\RazNhvq.exe
  2⤵
  PID:10540
- C:\Windows\System\tFmkdtw.exe
  C:\Windows\System\tFmkdtw.exe
  2⤵
  PID:10560
- C:\Windows\System\RfmUtuS.exe
  C:\Windows\System\RfmUtuS.exe
  2⤵
  PID:10580
- C:\Windows\System\UoXIRPZ.exe
  C:\Windows\System\UoXIRPZ.exe
  2⤵
  PID:10608
- C:\Windows\System\CehHyyW.exe
  C:\Windows\System\CehHyyW.exe
  2⤵
  PID:10624
- C:\Windows\System\Rtolgqu.exe
  C:\Windows\System\Rtolgqu.exe
  2⤵
  PID:10640
- C:\Windows\System\cgjJHrR.exe
  C:\Windows\System\cgjJHrR.exe
  2⤵
  PID:10660
- C:\Windows\System\kEjIXAk.exe
  C:\Windows\System\kEjIXAk.exe
  2⤵
  PID:10676
- C:\Windows\System\YMUkUYK.exe
  C:\Windows\System\YMUkUYK.exe
  2⤵
  PID:11204
- C:\Windows\System\XqpKCLz.exe
  C:\Windows\System\XqpKCLz.exe
  2⤵
  PID:11228
- C:\Windows\System\ZThCTUu.exe
  C:\Windows\System\ZThCTUu.exe
  2⤵
  PID:11252
- C:\Windows\System\CegEQAv.exe
  C:\Windows\System\CegEQAv.exe
  2⤵
  PID:7996
- C:\Windows\System\vmJERqB.exe
  C:\Windows\System\vmJERqB.exe
  2⤵
  PID:7912
- C:\Windows\System\qBYrhPp.exe
  C:\Windows\System\qBYrhPp.exe
  2⤵
  PID:8268
- C:\Windows\System\MdmoZGH.exe
  C:\Windows\System\MdmoZGH.exe
  2⤵
  PID:8368
- C:\Windows\System\QsppOFW.exe
  C:\Windows\System\QsppOFW.exe
  2⤵
  PID:7752
- C:\Windows\System\IlFWvhP.exe
  C:\Windows\System\IlFWvhP.exe
  2⤵
  PID:7980
- C:\Windows\System\jqgocLd.exe
  C:\Windows\System\jqgocLd.exe
  2⤵
  PID:9340
- C:\Windows\System\cOgNfdy.exe
  C:\Windows\System\cOgNfdy.exe
  2⤵
  PID:8812
- C:\Windows\System\OFYhhrB.exe
  C:\Windows\System\OFYhhrB.exe
  2⤵
  PID:10032
- C:\Windows\System\PkqtIKv.exe
  C:\Windows\System\PkqtIKv.exe
  2⤵
  PID:10216
- C:\Windows\System\bWzBqsU.exe
  C:\Windows\System\bWzBqsU.exe
  2⤵
  PID:8228
- C:\Windows\System\dYQbsOv.exe
  C:\Windows\System\dYQbsOv.exe
  2⤵
  PID:8944
- C:\Windows\System\BSTNUFb.exe
  C:\Windows\System\BSTNUFb.exe
  2⤵
  PID:9084
- C:\Windows\System\UULQwrR.exe
  C:\Windows\System\UULQwrR.exe
  2⤵
  PID:9356
- C:\Windows\System\caTmCUt.exe
  C:\Windows\System\caTmCUt.exe
  2⤵
  PID:9536
- C:\Windows\System\iEkmWuH.exe
  C:\Windows\System\iEkmWuH.exe
  2⤵
  PID:7592
- C:\Windows\System\AYayIPC.exe
  C:\Windows\System\AYayIPC.exe
  2⤵
  PID:7640
- C:\Windows\System\GHDrPEv.exe
  C:\Windows\System\GHDrPEv.exe
  2⤵
  PID:8172
- C:\Windows\System\CoxeLfp.exe
  C:\Windows\System\CoxeLfp.exe
  2⤵
  PID:9660
- C:\Windows\System\GvFIRII.exe
  C:\Windows\System\GvFIRII.exe
  2⤵
  PID:9228
- C:\Windows\System\xAOOqzE.exe
  C:\Windows\System\xAOOqzE.exe
  2⤵
  PID:9256
- C:\Windows\System\UssMDLn.exe
  C:\Windows\System\UssMDLn.exe
  2⤵
  PID:9336
- C:\Windows\System\WhaNuHz.exe
  C:\Windows\System\WhaNuHz.exe
  2⤵
  PID:9772
- C:\Windows\System\BsMqUGo.exe
  C:\Windows\System\BsMqUGo.exe
  2⤵
  PID:9808
- C:\Windows\System\XOmtNZf.exe
  C:\Windows\System\XOmtNZf.exe
  2⤵
  PID:10344
- C:\Windows\System\jNDyrzX.exe
  C:\Windows\System\jNDyrzX.exe
  2⤵
  PID:9964
- C:\Windows\System\uzLLvMk.exe
  C:\Windows\System\uzLLvMk.exe
  2⤵
  PID:10068
- C:\Windows\System\JxIoezQ.exe
  C:\Windows\System\JxIoezQ.exe
  2⤵
  PID:10176
- C:\Windows\System\PyZHIJA.exe
  C:\Windows\System\PyZHIJA.exe
  2⤵
  PID:10212
- C:\Windows\System\ggxPGBn.exe
  C:\Windows\System\ggxPGBn.exe
  2⤵
  PID:9580
- C:\Windows\System\DXTrzYG.exe
  C:\Windows\System\DXTrzYG.exe
  2⤵
  PID:10264
- C:\Windows\System\rCWyjlq.exe
  C:\Windows\System\rCWyjlq.exe
  2⤵
  PID:9736
- C:\Windows\System\EPnwDoF.exe
  C:\Windows\System\EPnwDoF.exe
  2⤵
  PID:10688
- C:\Windows\System\sXeMOSW.exe
  C:\Windows\System\sXeMOSW.exe
  2⤵
  PID:9884
- C:\Windows\System\PHCdGFG.exe
  C:\Windows\System\PHCdGFG.exe
  2⤵
  PID:10076
- C:\Windows\System\UDGHHka.exe
  C:\Windows\System\UDGHHka.exe
  2⤵
  PID:10120
- C:\Windows\System\WEwsqeJ.exe
  C:\Windows\System\WEwsqeJ.exe
  2⤵
  PID:10412
- C:\Windows\System\JmIkkxx.exe
  C:\Windows\System\JmIkkxx.exe
  2⤵
  PID:11284
- C:\Windows\System\fDYPgKX.exe
  C:\Windows\System\fDYPgKX.exe
  2⤵
  PID:11308
- C:\Windows\System\qnHyFpU.exe
  C:\Windows\System\qnHyFpU.exe
  2⤵
  PID:11328
- C:\Windows\System\IWCdWwp.exe
  C:\Windows\System\IWCdWwp.exe
  2⤵
  PID:11356
- C:\Windows\System\oEpGZEg.exe
  C:\Windows\System\oEpGZEg.exe
  2⤵
  PID:11372
- C:\Windows\System\GqgRsxw.exe
  C:\Windows\System\GqgRsxw.exe
  2⤵
  PID:11392
- C:\Windows\System\BvPVfoD.exe
  C:\Windows\System\BvPVfoD.exe
  2⤵
  PID:11416
- C:\Windows\System\NyjlKNk.exe
  C:\Windows\System\NyjlKNk.exe
  2⤵
  PID:11440
- C:\Windows\System\bLDNPvs.exe
  C:\Windows\System\bLDNPvs.exe
  2⤵
  PID:11456
- C:\Windows\System\zKWMmJg.exe
  C:\Windows\System\zKWMmJg.exe
  2⤵
  PID:11476
- C:\Windows\System\OBnLZqp.exe
  C:\Windows\System\OBnLZqp.exe
  2⤵
  PID:11496
- C:\Windows\System\MGPiKQi.exe
  C:\Windows\System\MGPiKQi.exe
  2⤵
  PID:11516
- C:\Windows\System\qyGPcnx.exe
  C:\Windows\System\qyGPcnx.exe
  2⤵
  PID:11532
- C:\Windows\System\EBMKeAy.exe
  C:\Windows\System\EBMKeAy.exe
  2⤵
  PID:11564
- C:\Windows\System\rnpXuRi.exe
  C:\Windows\System\rnpXuRi.exe
  2⤵
  PID:11580
- C:\Windows\System\BKxOKjy.exe
  C:\Windows\System\BKxOKjy.exe
  2⤵
  PID:11596
- C:\Windows\System\NhzfapV.exe
  C:\Windows\System\NhzfapV.exe
  2⤵
  PID:11612
- C:\Windows\System\exrQMNK.exe
  C:\Windows\System\exrQMNK.exe
  2⤵
  PID:11632
- C:\Windows\System\ZmCSpbd.exe
  C:\Windows\System\ZmCSpbd.exe
  2⤵
  PID:11656
- C:\Windows\System\bGaOevR.exe
  C:\Windows\System\bGaOevR.exe
  2⤵
  PID:11672
- C:\Windows\System\LNzdpdZ.exe
  C:\Windows\System\LNzdpdZ.exe
  2⤵
  PID:11696
- C:\Windows\System\NSTiVga.exe
  C:\Windows\System\NSTiVga.exe
  2⤵
  PID:11712
- C:\Windows\System\RUVgbMJ.exe
  C:\Windows\System\RUVgbMJ.exe
  2⤵
  PID:11736
- C:\Windows\System\WBfcTHS.exe
  C:\Windows\System\WBfcTHS.exe
  2⤵
  PID:11760
- C:\Windows\System\wpHKrAj.exe
  C:\Windows\System\wpHKrAj.exe
  2⤵
  PID:11788
- C:\Windows\System\yYoLElq.exe
  C:\Windows\System\yYoLElq.exe
  2⤵
  PID:11804
- C:\Windows\System\iqwSaEH.exe
  C:\Windows\System\iqwSaEH.exe
  2⤵
  PID:11828
- C:\Windows\System\SQakIxa.exe
  C:\Windows\System\SQakIxa.exe
  2⤵
  PID:11844
- C:\Windows\System\aLWPSvk.exe
  C:\Windows\System\aLWPSvk.exe
  2⤵
  PID:11868
- C:\Windows\System\aTKkfyU.exe
  C:\Windows\System\aTKkfyU.exe
  2⤵
  PID:11888
- C:\Windows\System\obuQtSV.exe
  C:\Windows\System\obuQtSV.exe
  2⤵
  PID:11908
- C:\Windows\System\PkaUAoR.exe
  C:\Windows\System\PkaUAoR.exe
  2⤵
  PID:11932
- C:\Windows\System\xIOYoAK.exe
  C:\Windows\System\xIOYoAK.exe
  2⤵
  PID:11952
- C:\Windows\System\KKnrXXg.exe
  C:\Windows\System\KKnrXXg.exe
  2⤵
  PID:11976
- C:\Windows\System\xltQfvc.exe
  C:\Windows\System\xltQfvc.exe
  2⤵
  PID:11996
- C:\Windows\System\dDnzRDw.exe
  C:\Windows\System\dDnzRDw.exe
  2⤵
  PID:12016
- C:\Windows\System\RSGZalV.exe
  C:\Windows\System\RSGZalV.exe
  2⤵
  PID:12044
- C:\Windows\System\IFMsPAN.exe
  C:\Windows\System\IFMsPAN.exe
  2⤵
  PID:12060
- C:\Windows\System\TezTbCu.exe
  C:\Windows\System\TezTbCu.exe
  2⤵
  PID:12084
- C:\Windows\System\WKFdNFm.exe
  C:\Windows\System\WKFdNFm.exe
  2⤵
  PID:12100
- C:\Windows\System\osSZaHg.exe
  C:\Windows\System\osSZaHg.exe
  2⤵
  PID:12128
- C:\Windows\System\TlKTCEi.exe
  C:\Windows\System\TlKTCEi.exe
  2⤵
  PID:12148
- C:\Windows\System\oURzJhh.exe
  C:\Windows\System\oURzJhh.exe
  2⤵
  PID:12168
- C:\Windows\System\LpPMdDD.exe
  C:\Windows\System\LpPMdDD.exe
  2⤵
  PID:12204
- C:\Windows\System\hCgkjYm.exe
  C:\Windows\System\hCgkjYm.exe
  2⤵
  PID:10448
- C:\Windows\System\xNWBDyx.exe
  C:\Windows\System\xNWBDyx.exe
  2⤵
  PID:10508
- C:\Windows\System\XUDbMYW.exe
  C:\Windows\System\XUDbMYW.exe
  2⤵
  PID:10552
- C:\Windows\System\KjQEBWg.exe
  C:\Windows\System\KjQEBWg.exe
  2⤵
  PID:10588
- C:\Windows\System\EzVQGxk.exe
  C:\Windows\System\EzVQGxk.exe
  2⤵
  PID:10672
- C:\Windows\System\uUeldPd.exe
  C:\Windows\System\uUeldPd.exe
  2⤵
  PID:11900
- C:\Windows\System\BfIqZXc.exe
  C:\Windows\System\BfIqZXc.exe
  2⤵
  PID:11944
- C:\Windows\System\gKTcljr.exe
  C:\Windows\System\gKTcljr.exe
  2⤵
  PID:10752
- C:\Windows\System\JFTHjYw.exe
  C:\Windows\System\JFTHjYw.exe
  2⤵
  PID:12232
- C:\Windows\System\MZMFKwI.exe
  C:\Windows\System\MZMFKwI.exe
  2⤵
  PID:11220
- C:\Windows\System\yUmAmMg.exe
  C:\Windows\System\yUmAmMg.exe
  2⤵
  PID:8520
- C:\Windows\System\oNshEkH.exe
  C:\Windows\System\oNshEkH.exe
  2⤵
  PID:6396
- C:\Windows\System\SmyIYXL.exe
  C:\Windows\System\SmyIYXL.exe
  2⤵
  PID:8364
- C:\Windows\System\feUDKvU.exe
  C:\Windows\System\feUDKvU.exe
  2⤵
  PID:8672
- C:\Windows\System\SHEmRpj.exe
  C:\Windows\System\SHEmRpj.exe
  2⤵
  PID:10916
- C:\Windows\System\AhVTvRW.exe
  C:\Windows\System\AhVTvRW.exe
  2⤵
  PID:10964
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 10964 -s 240
    3⤵
    PID:10948
- C:\Windows\System\eOLRfHH.exe
  C:\Windows\System\eOLRfHH.exe
  2⤵
  PID:8348
- C:\Windows\System\DNNwhJG.exe
  C:\Windows\System\DNNwhJG.exe
  2⤵
  PID:9480
- C:\Windows\System\dyUSpyC.exe
  C:\Windows\System\dyUSpyC.exe
  2⤵
  PID:9208
- C:\Windows\System\vwrHzLq.exe
  C:\Windows\System\vwrHzLq.exe
  2⤵
  PID:8112
- C:\Windows\System\dKBMCwR.exe
  C:\Windows\System\dKBMCwR.exe
  2⤵
  PID:8592
- C:\Windows\System\ZKPPwHT.exe
  C:\Windows\System\ZKPPwHT.exe
  2⤵
  PID:12040
- C:\Windows\System\SeRzGIU.exe
  C:\Windows\System\SeRzGIU.exe
  2⤵
  PID:12068
- C:\Windows\System\VKYzhzZ.exe
  C:\Windows\System\VKYzhzZ.exe
  2⤵
  PID:11184
- C:\Windows\System\TbPWKAh.exe
  C:\Windows\System\TbPWKAh.exe
  2⤵
  PID:10532
- C:\Windows\System\VCcsEvJ.exe
  C:\Windows\System\VCcsEvJ.exe
  2⤵
  PID:9716
- C:\Windows\System\SVxTSsS.exe
  C:\Windows\System\SVxTSsS.exe
  2⤵
  PID:8796
- C:\Windows\System\MCpnjlQ.exe
  C:\Windows\System\MCpnjlQ.exe
  2⤵
  PID:9244
- C:\Windows\System\xVRygqv.exe
  C:\Windows\System\xVRygqv.exe
  2⤵
  PID:9756
- C:\Windows\System\TyCYwqo.exe
  C:\Windows\System\TyCYwqo.exe
  2⤵
  PID:9860
- C:\Windows\System\HXLdrMn.exe
  C:\Windows\System\HXLdrMn.exe
  2⤵
  PID:8320
- C:\Windows\System\XDxTYgN.exe
  C:\Windows\System\XDxTYgN.exe
  2⤵
  PID:12308
- C:\Windows\System\oITlcrJ.exe
  C:\Windows\System\oITlcrJ.exe
  2⤵
  PID:12324
- C:\Windows\System\rOBLfAk.exe
  C:\Windows\System\rOBLfAk.exe
  2⤵
  PID:12344
- C:\Windows\System\BKMFLre.exe
  C:\Windows\System\BKMFLre.exe
  2⤵
  PID:12368
- C:\Windows\System\raxHOgQ.exe
  C:\Windows\System\raxHOgQ.exe
  2⤵
  PID:12384
- C:\Windows\System\lnAWCwb.exe
  C:\Windows\System\lnAWCwb.exe
  2⤵
  PID:12408
- C:\Windows\System\tObaWYt.exe
  C:\Windows\System\tObaWYt.exe
  2⤵
  PID:12424
- C:\Windows\System\xQPZUhi.exe
  C:\Windows\System\xQPZUhi.exe
  2⤵
  PID:12444
- C:\Windows\System\SzaZlhp.exe
  C:\Windows\System\SzaZlhp.exe
  2⤵
  PID:12460
- C:\Windows\System\WNlBDUQ.exe
  C:\Windows\System\WNlBDUQ.exe
  2⤵
  PID:12480
- C:\Windows\System\wWDIfWC.exe
  C:\Windows\System\wWDIfWC.exe
  2⤵
  PID:12504
- C:\Windows\System\BqytcVF.exe
  C:\Windows\System\BqytcVF.exe
  2⤵
  PID:12524
- C:\Windows\System\afdPviW.exe
  C:\Windows\System\afdPviW.exe
  2⤵
  PID:12540
- C:\Windows\System\xpWIEFH.exe
  C:\Windows\System\xpWIEFH.exe
  2⤵
  PID:12556
- C:\Windows\System\HgrveGL.exe
  C:\Windows\System\HgrveGL.exe
  2⤵
  PID:12572
- C:\Windows\System\XNEHLHX.exe
  C:\Windows\System\XNEHLHX.exe
  2⤵
  PID:12588
- C:\Windows\System\WmhlZLp.exe
  C:\Windows\System\WmhlZLp.exe
  2⤵
  PID:12604
- C:\Windows\System\bFqtQEx.exe
  C:\Windows\System\bFqtQEx.exe
  2⤵
  PID:12620
- C:\Windows\System\OdZxEbq.exe
  C:\Windows\System\OdZxEbq.exe
  2⤵
  PID:12640
- C:\Windows\System\yzOecVP.exe
  C:\Windows\System\yzOecVP.exe
  2⤵
  PID:12656
- C:\Windows\System\hRCmLXJ.exe
  C:\Windows\System\hRCmLXJ.exe
  2⤵
  PID:12672
- C:\Windows\System\GXNHTpM.exe
  C:\Windows\System\GXNHTpM.exe
  2⤵
  PID:12696
- C:\Windows\System\wwiNWjt.exe
  C:\Windows\System\wwiNWjt.exe
  2⤵
  PID:12712
- C:\Windows\System\GpHzVLJ.exe
  C:\Windows\System\GpHzVLJ.exe
  2⤵
  PID:12736
- C:\Windows\System\QQztqlz.exe
  C:\Windows\System\QQztqlz.exe
  2⤵
  PID:12760
- C:\Windows\System\iOqoEfl.exe
  C:\Windows\System\iOqoEfl.exe
  2⤵
  PID:12780
- C:\Windows\System\RDDveVi.exe
  C:\Windows\System\RDDveVi.exe
  2⤵
  PID:12804
- C:\Windows\System\bjpJCeC.exe
  C:\Windows\System\bjpJCeC.exe
  2⤵
  PID:12820
- C:\Windows\System\ohuzmZH.exe
  C:\Windows\System\ohuzmZH.exe
  2⤵
  PID:12840
- C:\Windows\System\RweyiRP.exe
  C:\Windows\System\RweyiRP.exe
  2⤵
  PID:12860
- C:\Windows\System\TKAzibB.exe
  C:\Windows\System\TKAzibB.exe
  2⤵
  PID:12880
- C:\Windows\System\hByMqNf.exe
  C:\Windows\System\hByMqNf.exe
  2⤵
  PID:8928
- C:\Windows\System\GeSKRgi.exe
  C:\Windows\System\GeSKRgi.exe
  2⤵
  PID:8556
- C:\Windows\System\toaHlML.exe
  C:\Windows\System\toaHlML.exe
  2⤵
  PID:13284
- C:\Windows\System\qCVSKbk.exe
  C:\Windows\System\qCVSKbk.exe
  2⤵
  PID:8408
- C:\Windows\System\fshxDCM.exe
  C:\Windows\System\fshxDCM.exe
  2⤵
  PID:12120
- C:\Windows\System\TVMCzKT.exe
  C:\Windows\System\TVMCzKT.exe
  2⤵
  PID:11876
- C:\Windows\System\RbrpMYR.exe
  C:\Windows\System\RbrpMYR.exe
  2⤵
  PID:11728
- C:\Windows\System\ubnaPZG.exe
  C:\Windows\System\ubnaPZG.exe
  2⤵
  PID:11684
- C:\Windows\System\RsUVHou.exe
  C:\Windows\System\RsUVHou.exe
  2⤵
  PID:11608
- C:\Windows\System\qKnBrcB.exe
  C:\Windows\System\qKnBrcB.exe
  2⤵
  PID:13088
- C:\Windows\System\LGMQAsj.exe
  C:\Windows\System\LGMQAsj.exe
  2⤵
  PID:13184
- C:\Windows\System\KZRTTkn.exe
  C:\Windows\System\KZRTTkn.exe
  2⤵
  PID:8552
- C:\Windows\System\iXZDFXw.exe
  C:\Windows\System\iXZDFXw.exe
  2⤵
  PID:5944
- C:\Windows\System\ZgSbuvW.exe
  C:\Windows\System\ZgSbuvW.exe
  2⤵
  PID:9124
- C:\Windows\System\HIKajqw.exe
  C:\Windows\System\HIKajqw.exe
  2⤵
  PID:11688
- C:\Windows\System\WlgthTi.exe
  C:\Windows\System\WlgthTi.exe
  2⤵
  PID:11920
- C:\Windows\System\xBvbDTU.exe
  C:\Windows\System\xBvbDTU.exe
  2⤵
  PID:12456
- C:\Windows\System\wLqszry.exe
  C:\Windows\System\wLqszry.exe
  2⤵
  PID:13188
- C:\Windows\System\uBRrdUx.exe
  C:\Windows\System\uBRrdUx.exe
  2⤵
  PID:5508
- C:\Windows\System\ZEyjXUn.exe
  C:\Windows\System\ZEyjXUn.exe
  2⤵
  PID:11524
- C:\Windows\System\hGXrgeq.exe
  C:\Windows\System\hGXrgeq.exe
  2⤵
  PID:11972
- C:\Windows\System\BAsWnxY.exe
  C:\Windows\System\BAsWnxY.exe
  2⤵
  PID:13000
- C:\Windows\System\uyEJATl.exe
  C:\Windows\System\uyEJATl.exe
  2⤵
  PID:13016
- C:\Windows\System\GsFdMxa.exe
  C:\Windows\System\GsFdMxa.exe
  2⤵
  PID:13224
- C:\Windows\System\PMvXaFN.exe
  C:\Windows\System\PMvXaFN.exe
  2⤵
  PID:13232
- C:\Windows\System\VNSQyWF.exe
  C:\Windows\System\VNSQyWF.exe
  2⤵
  PID:12400
- C:\Windows\System\pEEabjE.exe
  C:\Windows\System\pEEabjE.exe
  2⤵
  PID:4640
- C:\Windows\System\EWjFtRS.exe
  C:\Windows\System\EWjFtRS.exe
  2⤵
  PID:12720
- C:\Windows\System\pMWpdQA.exe
  C:\Windows\System\pMWpdQA.exe
  2⤵
  PID:13004
- C:\Windows\System\zKVOhYK.exe
  C:\Windows\System\zKVOhYK.exe
  2⤵
  PID:11588
- C:\Windows\System\xBLCugH.exe
  C:\Windows\System\xBLCugH.exe
  2⤵
  PID:4348
- C:\Windows\System\iOluKkU.exe
  C:\Windows\System\iOluKkU.exe
  2⤵
  PID:2140
- C:\Windows\System\volKtfG.exe
  C:\Windows\System\volKtfG.exe
  2⤵
  PID:13120
- C:\Windows\System\deHpCsz.exe
  C:\Windows\System\deHpCsz.exe
  2⤵
  PID:1844
- C:\Windows\System\bjDeyWm.exe
  C:\Windows\System\bjDeyWm.exe
  2⤵
  PID:1308
- C:\Windows\System\itCnjKP.exe
  C:\Windows\System\itCnjKP.exe
  2⤵
  PID:5888
- C:\Windows\System\ZjINKWo.exe
  C:\Windows\System\ZjINKWo.exe
  2⤵
  PID:4396
- C:\Windows\System\cJZiArQ.exe
  C:\Windows\System\cJZiArQ.exe
  2⤵
  PID:2772
- C:\Windows\System\mxjLxxR.exe
  C:\Windows\System\mxjLxxR.exe
  2⤵
  PID:4652
- C:\Windows\System\oCeEpCB.exe
  C:\Windows\System\oCeEpCB.exe
  2⤵
  PID:3568
- C:\Windows\System\fDgTzCN.exe
  C:\Windows\System\fDgTzCN.exe
  2⤵
  PID:13332
- C:\Windows\System\QYFBALc.exe
  C:\Windows\System\QYFBALc.exe
  2⤵
  PID:13392
- C:\Windows\System\tjLnoFs.exe
  C:\Windows\System\tjLnoFs.exe
  2⤵
  PID:13476
- C:\Windows\System\QsjpdKy.exe
  C:\Windows\System\QsjpdKy.exe
  2⤵
  PID:13560
- C:\Windows\System\VUHXIFq.exe
  C:\Windows\System\VUHXIFq.exe
  2⤵
  PID:13772
- C:\Windows\System\AfPwfmK.exe
  C:\Windows\System\AfPwfmK.exe
  2⤵
  PID:13796
- C:\Windows\System\rIpZqec.exe
  C:\Windows\System\rIpZqec.exe
  2⤵
  PID:13840
- C:\Windows\System\dQDMQJR.exe
  C:\Windows\System\dQDMQJR.exe
  2⤵
  PID:13984
- C:\Windows\System\sSJuuyp.exe
  C:\Windows\System\sSJuuyp.exe
  2⤵
  PID:14160
- C:\Windows\System\CNAHnlD.exe
  C:\Windows\System\CNAHnlD.exe
  2⤵
  PID:14240
- C:\Windows\System\FyatAfq.exe
  C:\Windows\System\FyatAfq.exe
  2⤵
  PID:14256
- C:\Windows\System\VxLucGc.exe
  C:\Windows\System\VxLucGc.exe
  2⤵
  PID:14280
- C:\Windows\System\aAqYaJV.exe
  C:\Windows\System\aAqYaJV.exe
  2⤵
  PID:14300
- C:\Windows\System\NlSVoqv.exe
  C:\Windows\System\NlSVoqv.exe
  2⤵
  PID:10948
- C:\Windows\System\VOrWxRX.exe
  C:\Windows\System\VOrWxRX.exe
  2⤵
  PID:1712
- C:\Windows\System\FIjjqms.exe
  C:\Windows\System\FIjjqms.exe
  2⤵
  PID:13304
- C:\Windows\System\tyRXhug.exe
  C:\Windows\System\tyRXhug.exe
  2⤵
  PID:4528
- C:\Windows\System\pYGyjvj.exe
  C:\Windows\System\pYGyjvj.exe
  2⤵
  PID:11664
- C:\Windows\System\MAbDtSz.exe
  C:\Windows\System\MAbDtSz.exe
  2⤵
  PID:4048
- C:\Windows\System\SjtcPiW.exe
  C:\Windows\System\SjtcPiW.exe
  2⤵
  PID:4100
- C:\Windows\System\icMeCpx.exe
  C:\Windows\System\icMeCpx.exe
  2⤵
  PID:1456
- C:\Windows\System\akfwnDK.exe
  C:\Windows\System\akfwnDK.exe
  2⤵
  PID:13580
- C:\Windows\System\pnILFqz.exe
  C:\Windows\System\pnILFqz.exe
  2⤵
  PID:13608
- C:\Windows\System\HaBUgaA.exe
  C:\Windows\System\HaBUgaA.exe
  2⤵
  PID:14084
- C:\Windows\System\qIrrchL.exe
  C:\Windows\System\qIrrchL.exe
  2⤵
  PID:1792
- C:\Windows\System\HbbHHUD.exe
  C:\Windows\System\HbbHHUD.exe
  2⤵
  PID:13092
- C:\Windows\System\dxzyCuG.exe
  C:\Windows\System\dxzyCuG.exe
  2⤵
  PID:13720
- C:\Windows\System\YhhueoK.exe
  C:\Windows\System\YhhueoK.exe
  2⤵
  PID:13740
- C:\Windows\System\Fuderwh.exe
  C:\Windows\System\Fuderwh.exe
  2⤵
  PID:732
- C:\Windows\System\RwGnPBe.exe
  C:\Windows\System\RwGnPBe.exe
  2⤵
  PID:13756
- C:\Windows\System\qBfEQIC.exe
  C:\Windows\System\qBfEQIC.exe
  2⤵
  PID:13836
- C:\Windows\System\uCNxfiu.exe
  C:\Windows\System\uCNxfiu.exe
  2⤵
  PID:14296
- C:\Windows\System\LJgVrik.exe
  C:\Windows\System\LJgVrik.exe
  2⤵
  PID:14308
- C:\Windows\System\DIvPKSQ.exe
  C:\Windows\System\DIvPKSQ.exe
  2⤵
  PID:13872
- C:\Windows\System\rPsWpFZ.exe
  C:\Windows\System\rPsWpFZ.exe
  2⤵
  PID:6772
- C:\Windows\System\YmtQmWR.exe
  C:\Windows\System\YmtQmWR.exe
  2⤵
  PID:2852
- C:\Windows\System\mdquOqQ.exe
  C:\Windows\System\mdquOqQ.exe
  2⤵
  PID:12192
- C:\Windows\System\dCqbJYi.exe
  C:\Windows\System\dCqbJYi.exe
  2⤵
  PID:13892
- C:\Windows\System\DLvsSOL.exe
  C:\Windows\System\DLvsSOL.exe
  2⤵
  PID:12968
- C:\Windows\System\SYoaOjk.exe
  C:\Windows\System\SYoaOjk.exe
  2⤵
  PID:1628
- C:\Windows\System\pLbxPUc.exe
  C:\Windows\System\pLbxPUc.exe
  2⤵
  PID:9928
- C:\Windows\System\ohzcjHB.exe
  C:\Windows\System\ohzcjHB.exe
  2⤵
  PID:2716
- C:\Windows\System\AvUqXDx.exe
  C:\Windows\System\AvUqXDx.exe
  2⤵
  PID:4208
- C:\Windows\System\HgglGAN.exe
  C:\Windows\System\HgglGAN.exe
  2⤵
  PID:14048
- C:\Windows\System\tuKVMJc.exe
  C:\Windows\System\tuKVMJc.exe
  2⤵
  PID:10904
- C:\Windows\System\gfsATbL.exe
  C:\Windows\System\gfsATbL.exe
  2⤵
  PID:3676
- C:\Windows\System\IPNsHgz.exe
  C:\Windows\System\IPNsHgz.exe
  2⤵
  PID:14316
- C:\Windows\System\SbxoWKP.exe
  C:\Windows\System\SbxoWKP.exe
  2⤵
  PID:14092
- C:\Windows\System\pCmYnko.exe
  C:\Windows\System\pCmYnko.exe
  2⤵
  PID:5276
- C:\Windows\System\GwghKFH.exe
  C:\Windows\System\GwghKFH.exe
  2⤵
  PID:4500
- C:\Windows\System\WAwLyJM.exe
  C:\Windows\System\WAwLyJM.exe
  2⤵
  PID:14144
- C:\Windows\System\DsmoTop.exe
  C:\Windows\System\DsmoTop.exe
  2⤵
  PID:3972
- C:\Windows\System\jPxqUVf.exe
  C:\Windows\System\jPxqUVf.exe
  2⤵
  PID:3024
- C:\Windows\System\JLdattW.exe
  C:\Windows\System\JLdattW.exe
  2⤵
  PID:14184
- C:\Windows\System\EdwBCXY.exe
  C:\Windows\System\EdwBCXY.exe
  2⤵
  PID:14220
- C:\Windows\System\BvcSIcQ.exe
  C:\Windows\System\BvcSIcQ.exe
  2⤵
  PID:5272
- C:\Windows\System\YSvfyzm.exe
  C:\Windows\System\YSvfyzm.exe
  2⤵
  PID:14248
- C:\Windows\System\fpDUMVV.exe
  C:\Windows\System\fpDUMVV.exe
  2⤵
  PID:4828
- C:\Windows\System\crpoBJn.exe
  C:\Windows\System\crpoBJn.exe
  2⤵
  PID:11368
- C:\Windows\System\xogWNZs.exe
  C:\Windows\System\xogWNZs.exe
  2⤵
  PID:14328
- C:\Windows\System\XIcHPpQ.exe
  C:\Windows\System\XIcHPpQ.exe
  2⤵
  PID:216
- C:\Windows\System\RCUSSXb.exe
  C:\Windows\System\RCUSSXb.exe
  2⤵
  PID:2596
- C:\Windows\System\TITZUwB.exe
  C:\Windows\System\TITZUwB.exe
  2⤵
  PID:5176
- C:\Windows\System\cmPsYyM.exe
  C:\Windows\System\cmPsYyM.exe
  2⤵
  PID:4908
- C:\Windows\System\uIMKKUZ.exe
  C:\Windows\System\uIMKKUZ.exe
  2⤵
  PID:3920
- C:\Windows\System\hZcnVdh.exe
  C:\Windows\System\hZcnVdh.exe
  2⤵
  PID:5204
- C:\Windows\System\eFdPTBA.exe
  C:\Windows\System\eFdPTBA.exe
  2⤵
  PID:13132
- C:\Windows\System\sKWrFZn.exe
  C:\Windows\System\sKWrFZn.exe
  2⤵
  PID:2208
- C:\Windows\System\ZiBNteK.exe
  C:\Windows\System\ZiBNteK.exe
  2⤵
  PID:13408
- C:\Windows\System\SjSlfwl.exe
  C:\Windows\System\SjSlfwl.exe
  2⤵
  PID:12748
- C:\Windows\System\oLjcPYv.exe
  C:\Windows\System\oLjcPYv.exe
  2⤵
  PID:7636
- C:\Windows\System\TQtdZbV.exe
  C:\Windows\System\TQtdZbV.exe
  2⤵
  PID:5580
- C:\Windows\System\ImVEoLG.exe
  C:\Windows\System\ImVEoLG.exe
  2⤵
  PID:13272
- C:\Windows\System\aivKDMt.exe
  C:\Windows\System\aivKDMt.exe
  2⤵
  PID:13508
- C:\Windows\System\OVQcTbI.exe
  C:\Windows\System\OVQcTbI.exe
  2⤵
  PID:2556
- C:\Windows\System\fMUbyZB.exe
  C:\Windows\System\fMUbyZB.exe
  2⤵
  PID:5528
- C:\Windows\System\ABqPCbv.exe
  C:\Windows\System\ABqPCbv.exe
  2⤵
  PID:5736
- C:\Windows\System\VzkMRCd.exe
  C:\Windows\System\VzkMRCd.exe
  2⤵
  PID:5800
- C:\Windows\System\lXCnbNn.exe
  C:\Windows\System\lXCnbNn.exe
  2⤵
  PID:13548
- C:\Windows\System\fTNWQaT.exe
  C:\Windows\System\fTNWQaT.exe
  2⤵
  PID:5600
- C:\Windows\System\ZTSWuVh.exe
  C:\Windows\System\ZTSWuVh.exe
  2⤵
  PID:5672
- C:\Windows\System\JOlscFP.exe
  C:\Windows\System\JOlscFP.exe
  2⤵
  PID:13708
- C:\Windows\System\ekLJMMw.exe
  C:\Windows\System\ekLJMMw.exe
  2⤵
  PID:5040
- C:\Windows\System\NJPGtNC.exe
  C:\Windows\System\NJPGtNC.exe
  2⤵
  PID:260
- C:\Windows\System\dizeQPM.exe
  C:\Windows\System\dizeQPM.exe
  2⤵
  PID:5880
- C:\Windows\System\UYgkTOO.exe
  C:\Windows\System\UYgkTOO.exe
  2⤵
  PID:5360
- C:\Windows\System\KJzfwCH.exe
  C:\Windows\System\KJzfwCH.exe
  2⤵
  PID:12856
- C:\Windows\System\hGkoren.exe
  C:\Windows\System\hGkoren.exe
  2⤵
  PID:5308
- C:\Windows\System\eqmsSXD.exe
  C:\Windows\System\eqmsSXD.exe
  2⤵
  PID:5444
- C:\Windows\System\qDatCbY.exe
  C:\Windows\System\qDatCbY.exe
  2⤵
  PID:13432
- C:\Windows\System\rVcBkNu.exe
  C:\Windows\System\rVcBkNu.exe
  2⤵
  PID:5396
- C:\Windows\System\uKnTnwy.exe
  C:\Windows\System\uKnTnwy.exe
  2⤵
  PID:13924
- C:\Windows\System\QVSXMVd.exe
  C:\Windows\System\QVSXMVd.exe
  2⤵
  PID:13592
- C:\Windows\System\PWfCdKw.exe
  C:\Windows\System\PWfCdKw.exe
  2⤵
  PID:2192
- C:\Windows\System\mheZstJ.exe
  C:\Windows\System\mheZstJ.exe
  2⤵
  PID:14060
- C:\Windows\System\MvWMfkj.exe
  C:\Windows\System\MvWMfkj.exe
  2⤵
  PID:13860
- C:\Windows\System\mBlBVUm.exe
  C:\Windows\System\mBlBVUm.exe
  2⤵
  PID:908
- C:\Windows\System\Uygewgu.exe
  C:\Windows\System\Uygewgu.exe
  2⤵
  PID:13320
- C:\Windows\System\IelaXFF.exe
  C:\Windows\System\IelaXFF.exe
  2⤵
  PID:2620
- C:\Windows\System\iJMkoFV.exe
  C:\Windows\System\iJMkoFV.exe
  2⤵
  PID:13752
- C:\Windows\System\XHkDCuT.exe
  C:\Windows\System\XHkDCuT.exe
  2⤵
  PID:13956
- C:\Windows\System\PsKCMMK.exe
  C:\Windows\System\PsKCMMK.exe
  2⤵
  PID:5368
- C:\Windows\System\SGNgfvw.exe
  C:\Windows\System\SGNgfvw.exe
  2⤵
  PID:4712
- C:\Windows\System\yeVvOuc.exe
  C:\Windows\System\yeVvOuc.exe
  2⤵
  PID:5844
- C:\Windows\System\ZraJsZw.exe
  C:\Windows\System\ZraJsZw.exe
  2⤵
  PID:6732
- C:\Windows\System\hpkRCHK.exe
  C:\Windows\System\hpkRCHK.exe
  2⤵
  PID:14216
- C:\Windows\System\Vqsvbeb.exe
  C:\Windows\System\Vqsvbeb.exe
  2⤵
  PID:13980
- C:\Windows\System\uYANbQm.exe
  C:\Windows\System\uYANbQm.exe
  2⤵
  PID:13828
- C:\Windows\System\MpsBImK.exe
  C:\Windows\System\MpsBImK.exe
  2⤵
  PID:13672
- C:\Windows\System\xhGmUps.exe
  C:\Windows\System\xhGmUps.exe
  2⤵
  PID:13208
- C:\Windows\System\iGxwPKG.exe
  C:\Windows\System\iGxwPKG.exe
  2⤵
  PID:7940
- C:\Windows\System\bbZIATh.exe
  C:\Windows\System\bbZIATh.exe
  2⤵
  PID:8144
- C:\Windows\System\ZOpLuqL.exe
  C:\Windows\System\ZOpLuqL.exe
  2⤵
  PID:11436
- C:\Windows\System\MJijnSp.exe
  C:\Windows\System\MJijnSp.exe
  2⤵
  PID:14072
- C:\Windows\System\YZIcBjx.exe
  C:\Windows\System\YZIcBjx.exe
  2⤵
  PID:14076
- C:\Windows\System\gUInSwi.exe
  C:\Windows\System\gUInSwi.exe
  2⤵
  PID:5796
- C:\Windows\System\JKPTMvK.exe
  C:\Windows\System\JKPTMvK.exe
  2⤵
  PID:7860
- C:\Windows\System\GTVnedT.exe
  C:\Windows\System\GTVnedT.exe
  2⤵
  PID:6128
- C:\Windows\System\cTjuBDQ.exe
  C:\Windows\System\cTjuBDQ.exe
  2⤵
  PID:6096
- C:\Windows\System\thqPufm.exe
  C:\Windows\System\thqPufm.exe
  2⤵
  PID:5856
- C:\Windows\System\PvVSMmm.exe
  C:\Windows\System\PvVSMmm.exe
  2⤵
  PID:5332
- C:\Windows\System\buPNcLc.exe
  C:\Windows\System\buPNcLc.exe
  2⤵
  PID:13512
- C:\Windows\System\mnayAuQ.exe
  C:\Windows\System\mnayAuQ.exe
  2⤵
  PID:5652
- C:\Windows\System\gOPqAnH.exe
  C:\Windows\System\gOPqAnH.exe
  2⤵
  PID:5132
- C:\Windows\System\YFYUXdf.exe
  C:\Windows\System\YFYUXdf.exe
  2⤵
  PID:5404
- C:\Windows\System\tjAdvjt.exe
  C:\Windows\System\tjAdvjt.exe
  2⤵
  PID:13700
- C:\Windows\System\EhvROHH.exe
  C:\Windows\System\EhvROHH.exe
  2⤵
  PID:13908
- C:\Windows\System\qfYFeAy.exe
  C:\Windows\System\qfYFeAy.exe
  2⤵
  PID:4456
- C:\Windows\System\ihjWfrK.exe
  C:\Windows\System\ihjWfrK.exe
  2⤵
  PID:5320
- C:\Windows\System\RKdAfDA.exe
  C:\Windows\System\RKdAfDA.exe
  2⤵
  PID:2044
- C:\Windows\System\pGlgYoA.exe
  C:\Windows\System\pGlgYoA.exe
  2⤵
  PID:6220
- C:\Windows\System\iUEbIIP.exe
  C:\Windows\System\iUEbIIP.exe
  2⤵
  PID:5884
- C:\Windows\System\eDjQyfy.exe
  C:\Windows\System\eDjQyfy.exe
  2⤵
  PID:1620
- C:\Windows\System\YMrGoNC.exe
  C:\Windows\System\YMrGoNC.exe
  2⤵
  PID:5424
- C:\Windows\System\uNMNLFJ.exe
  C:\Windows\System\uNMNLFJ.exe
  2⤵
  PID:4316
- C:\Windows\System\FUpvMRJ.exe
  C:\Windows\System\FUpvMRJ.exe
  2⤵
  PID:13452
- C:\Windows\System\EpQZJYC.exe
  C:\Windows\System\EpQZJYC.exe
  2⤵
  PID:1840
- C:\Windows\System\InxCXil.exe
  C:\Windows\System\InxCXil.exe
  2⤵
  PID:13468
- C:\Windows\System\LoJcjDv.exe
  C:\Windows\System\LoJcjDv.exe
  2⤵
  PID:636
- C:\Windows\System\gNayFLw.exe
  C:\Windows\System\gNayFLw.exe
  2⤵
  PID:14168
- C:\Windows\System\ZSnfRPJ.exe
  C:\Windows\System\ZSnfRPJ.exe
  2⤵
  PID:14232
- C:\Windows\System\tvURQOl.exe
  C:\Windows\System\tvURQOl.exe
  2⤵
  PID:1556
- C:\Windows\System\cEVGZhl.exe
  C:\Windows\System\cEVGZhl.exe
  2⤵
  PID:14052
- C:\Windows\System\obqGHwX.exe
  C:\Windows\System\obqGHwX.exe
  2⤵
  PID:6416
- C:\Windows\System\vUbQjEy.exe
  C:\Windows\System\vUbQjEy.exe
  2⤵
  PID:404
- C:\Windows\System\ueiOkVl.exe
  C:\Windows\System\ueiOkVl.exe
  2⤵
  PID:6672
- C:\Windows\System\TTKHRZl.exe
  C:\Windows\System\TTKHRZl.exe
  2⤵
  PID:6428
- C:\Windows\System\FIIGBMM.exe
  C:\Windows\System\FIIGBMM.exe
  2⤵
  PID:6468
- C:\Windows\System\XtWtVhE.exe
  C:\Windows\System\XtWtVhE.exe
  2⤵
  PID:3180
- C:\Windows\System\BIkoBbp.exe
  C:\Windows\System\BIkoBbp.exe
  2⤵
  PID:6592
- C:\Windows\System\BmuSAWY.exe
  C:\Windows\System\BmuSAWY.exe
  2⤵
  PID:10740
- C:\Windows\System\LGxxBJq.exe
  C:\Windows\System\LGxxBJq.exe
  2⤵
  PID:13912
- C:\Windows\System\ghLVJaQ.exe
  C:\Windows\System\ghLVJaQ.exe
  2⤵
  PID:1104
- C:\Windows\System\vlPRofq.exe
  C:\Windows\System\vlPRofq.exe
  2⤵
  PID:13656
- C:\Windows\System\FEVFYPh.exe
  C:\Windows\System\FEVFYPh.exe
  2⤵
  PID:11408
- C:\Windows\System\WIgLgcI.exe
  C:\Windows\System\WIgLgcI.exe
  2⤵
  PID:3424
- C:\Windows\System\ssZYMYM.exe
  C:\Windows\System\ssZYMYM.exe
  2⤵
  PID:7524
- C:\Windows\System\QACsFBt.exe
  C:\Windows\System\QACsFBt.exe
  2⤵
  PID:13968
- C:\Windows\System\NnMxETt.exe
  C:\Windows\System\NnMxETt.exe
  2⤵
  PID:13268
- C:\Windows\System\KsxbFfu.exe
  C:\Windows\System\KsxbFfu.exe
  2⤵
  PID:3316
- C:\Windows\System\fHuEgxR.exe
  C:\Windows\System\fHuEgxR.exe
  2⤵
  PID:6748
- C:\Windows\System\suotxaq.exe
  C:\Windows\System\suotxaq.exe
  2⤵
  PID:7812
- C:\Windows\System\xVIrzOd.exe
  C:\Windows\System\xVIrzOd.exe
  2⤵
  PID:5440
- C:\Windows\System\AAWEhMk.exe
  C:\Windows\System\AAWEhMk.exe
  2⤵
  PID:3916
- C:\Windows\System\CINRLbv.exe
  C:\Windows\System\CINRLbv.exe
  2⤵
  PID:14356
- C:\Windows\System\JFgJyYK.exe
  C:\Windows\System\JFgJyYK.exe
  2⤵
  PID:14468
- C:\Windows\System\cMqaaZB.exe
  C:\Windows\System\cMqaaZB.exe
  2⤵
  PID:14556
- C:\Windows\System\bxIrKkc.exe
  C:\Windows\System\bxIrKkc.exe
  2⤵
  PID:14656
- C:\Windows\System\fQmRton.exe
  C:\Windows\System\fQmRton.exe
  2⤵
  PID:14676
- C:\Windows\System\SZTAdpn.exe
  C:\Windows\System\SZTAdpn.exe
  2⤵
  PID:14692
- C:\Windows\System\jnTgmhE.exe
  C:\Windows\System\jnTgmhE.exe
  2⤵
  PID:14828
- C:\Windows\System\VVxrBxt.exe
  C:\Windows\System\VVxrBxt.exe
  2⤵
  PID:14864
- C:\Windows\System\gmAgcSV.exe
  C:\Windows\System\gmAgcSV.exe
  2⤵
  PID:6556
- C:\Windows\System\aSBViaV.exe
  C:\Windows\System\aSBViaV.exe
  2⤵
  PID:12752
- C:\Windows\System\eIRHEoE.exe
  C:\Windows\System\eIRHEoE.exe
  2⤵
  PID:2340
- C:\Windows\System\CumjTht.exe
  C:\Windows\System\CumjTht.exe
  2⤵
  PID:14496
- C:\Windows\System\DxcCQjJ.exe
  C:\Windows\System\DxcCQjJ.exe
  2⤵
  PID:6436
- C:\Windows\System\EmyLMAj.exe
  C:\Windows\System\EmyLMAj.exe
  2⤵
  PID:14596
- C:\Windows\System\IlJdEap.exe
  C:\Windows\System\IlJdEap.exe
  2⤵
  PID:14604
- C:\Windows\System\ktiucDs.exe
  C:\Windows\System\ktiucDs.exe
  2⤵
  PID:6336
- C:\Windows\System\nhTXzBF.exe
  C:\Windows\System\nhTXzBF.exe
  2⤵
  PID:6884
- C:\Windows\System\eQZYNZE.exe
  C:\Windows\System\eQZYNZE.exe
  2⤵
  PID:14700
- C:\Windows\System\kegGKgO.exe
  C:\Windows\System\kegGKgO.exe
  2⤵
  PID:13896
- C:\Windows\System\pRSVcnM.exe
  C:\Windows\System\pRSVcnM.exe
  2⤵
  PID:14756
- C:\Windows\System\JQCWMxy.exe
  C:\Windows\System\JQCWMxy.exe
  2⤵
  PID:14764
- C:\Windows\System\yYOELeg.exe
  C:\Windows\System\yYOELeg.exe
  2⤵
  PID:6716
- C:\Windows\System\nnlkFMd.exe
  C:\Windows\System\nnlkFMd.exe
  2⤵
  PID:14788
- C:\Windows\System\lDJonsc.exe
  C:\Windows\System\lDJonsc.exe
  2⤵
  PID:6588
- C:\Windows\System\cULqqUT.exe
  C:\Windows\System\cULqqUT.exe
  2⤵
  PID:1536
- C:\Windows\System\UzTiyQt.exe
  C:\Windows\System\UzTiyQt.exe
  2⤵
  PID:5412
- C:\Windows\System\HTwCJDs.exe
  C:\Windows\System\HTwCJDs.exe
  2⤵
  PID:7092
- C:\Windows\System\qjetgSo.exe
  C:\Windows\System\qjetgSo.exe
  2⤵
  PID:3852
- C:\Windows\System\ZaxrdZM.exe
  C:\Windows\System\ZaxrdZM.exe
  2⤵
  PID:14960
- C:\Windows\System\oklHCRi.exe
  C:\Windows\System\oklHCRi.exe
  2⤵
  PID:5540
- C:\Windows\System\NFxzcWf.exe
  C:\Windows\System\NFxzcWf.exe
  2⤵
  PID:14416
- C:\Windows\System\ohROYXk.exe
  C:\Windows\System\ohROYXk.exe
  2⤵
  PID:14436
- C:\Windows\System\IRJkGVW.exe
  C:\Windows\System\IRJkGVW.exe
  2⤵
  PID:14444
- C:\Windows\System\kvLOogp.exe
  C:\Windows\System\kvLOogp.exe
  2⤵
  PID:6376
- C:\Windows\System\lMBsaqz.exe
  C:\Windows\System\lMBsaqz.exe
  2⤵
  PID:14540
- C:\Windows\System\QkNgNwJ.exe
  C:\Windows\System\QkNgNwJ.exe
  2⤵
  PID:14544
- C:\Windows\System\xvRqGIT.exe
  C:\Windows\System\xvRqGIT.exe
  2⤵
  PID:14668
- C:\Windows\System\srUPpfq.exe
  C:\Windows\System\srUPpfq.exe
  2⤵
  PID:14704
- C:\Windows\System\LtJgnxc.exe
  C:\Windows\System\LtJgnxc.exe
  2⤵
  PID:7052
- C:\Windows\System\PxvpUlI.exe
  C:\Windows\System\PxvpUlI.exe
  2⤵
  PID:6760
- C:\Windows\System\giUnSnG.exe
  C:\Windows\System\giUnSnG.exe
  2⤵
  PID:6720
- C:\Windows\System\rlGUBpr.exe
  C:\Windows\System\rlGUBpr.exe
  2⤵
  PID:6516
- C:\Windows\System\CAHUwAO.exe
  C:\Windows\System\CAHUwAO.exe
  2⤵
  PID:14844
- C:\Windows\System\mszBPPI.exe
  C:\Windows\System\mszBPPI.exe
  2⤵
  PID:700
- C:\Windows\System\VzszUrv.exe
  C:\Windows\System\VzszUrv.exe
  2⤵
  PID:14928
- C:\Windows\System\fwcDJdf.exe
  C:\Windows\System\fwcDJdf.exe
  2⤵
  PID:6652
- C:\Windows\System\RSXKcFi.exe
  C:\Windows\System\RSXKcFi.exe
  2⤵
  PID:15052
- C:\Windows\System\NQzBHeR.exe
  C:\Windows\System\NQzBHeR.exe
  2⤵
  PID:14448
- C:\Windows\System\jRdXNmt.exe
  C:\Windows\System\jRdXNmt.exe
  2⤵
  PID:14624
- C:\Windows\System\nsvYntJ.exe
  C:\Windows\System\nsvYntJ.exe
  2⤵
  PID:14652
- C:\Windows\System\hxAeIpo.exe
  C:\Windows\System\hxAeIpo.exe
  2⤵
  PID:14752
- C:\Windows\System\ywUVMAE.exe
  C:\Windows\System\ywUVMAE.exe
  2⤵
  PID:14776
- C:\Windows\System\KJHUBaM.exe
  C:\Windows\System\KJHUBaM.exe
  2⤵
  PID:14780
- C:\Windows\System\sOgWxml.exe
  C:\Windows\System\sOgWxml.exe
  2⤵
  PID:14808
- C:\Windows\System\iovpaOE.exe
  C:\Windows\System\iovpaOE.exe
  2⤵
  PID:14940
- C:\Windows\System\fFcocLP.exe
  C:\Windows\System\fFcocLP.exe
  2⤵
  PID:6692
- C:\Windows\System\TnVajXJ.exe
  C:\Windows\System\TnVajXJ.exe
  2⤵
  PID:15040
- C:\Windows\System\gdBTJYy.exe
  C:\Windows\System\gdBTJYy.exe
  2⤵
  PID:7224
- C:\Windows\System\tHxjSeH.exe
  C:\Windows\System\tHxjSeH.exe
  2⤵
  PID:7184
- C:\Windows\System\HKfxYxq.exe
  C:\Windows\System\HKfxYxq.exe
  2⤵
  PID:14592
- C:\Windows\System\SgOvsUN.exe
  C:\Windows\System\SgOvsUN.exe
  2⤵
  PID:13652
- C:\Windows\System\MsAlNOZ.exe
  C:\Windows\System\MsAlNOZ.exe
  2⤵
  PID:14936
- C:\Windows\System\wFIQcbj.exe
  C:\Windows\System\wFIQcbj.exe
  2⤵
  PID:14432
- C:\Windows\System\EVtZmSs.exe
  C:\Windows\System\EVtZmSs.exe
  2⤵
  PID:6420
- C:\Windows\System\wPnLkWJ.exe
  C:\Windows\System\wPnLkWJ.exe
  2⤵
  PID:9500
- C:\Windows\System\ZXmqJdO.exe
  C:\Windows\System\ZXmqJdO.exe
  2⤵
  PID:7488
- C:\Windows\System\HBXwhMi.exe
  C:\Windows\System\HBXwhMi.exe
  2⤵
  PID:9000
- C:\Windows\System\ZtfYdnY.exe
  C:\Windows\System\ZtfYdnY.exe
  2⤵
  PID:9692
- C:\Windows\System\AwZitsn.exe
  C:\Windows\System\AwZitsn.exe
  2⤵
  PID:7516
- C:\Windows\System\evFoOkI.exe
  C:\Windows\System\evFoOkI.exe
  2⤵
  PID:12184
- C:\Windows\System\AUKAyAH.exe
  C:\Windows\System\AUKAyAH.exe
  2⤵
  PID:9344
- C:\Windows\System\xQUxmwy.exe
  C:\Windows\System\xQUxmwy.exe
  2⤵
  PID:376
- C:\Windows\System\ndGMgOC.exe
  C:\Windows\System\ndGMgOC.exe
  2⤵
  PID:1856
- C:\Windows\System\gmiHxpE.exe
  C:\Windows\System\gmiHxpE.exe
  2⤵
  PID:9920
- C:\Windows\System\FHajNaQ.exe
  C:\Windows\System\FHajNaQ.exe
  2⤵
  PID:14456
- C:\Windows\System\PMAvbcT.exe
  C:\Windows\System\PMAvbcT.exe
  2⤵
  PID:10888
- C:\Windows\System\lqXSDGj.exe
  C:\Windows\System\lqXSDGj.exe
  2⤵
  PID:5496
- C:\Windows\System\UKZMmgW.exe
  C:\Windows\System\UKZMmgW.exe
  2⤵
  PID:6580
- C:\Windows\System\fjhSoeL.exe
  C:\Windows\System\fjhSoeL.exe
  2⤵
  PID:13264
- C:\Windows\System\nYrryIa.exe
  C:\Windows\System\nYrryIa.exe
  2⤵
  PID:13248
- C:\Windows\System\TmjFUua.exe
  C:\Windows\System\TmjFUua.exe
  2⤵
  PID:10376
- C:\Windows\System\AysYFDq.exe
  C:\Windows\System\AysYFDq.exe
  2⤵
  PID:10340
- C:\Windows\System\GboeXgL.exe
  C:\Windows\System\GboeXgL.exe
  2⤵
  PID:10656
- C:\Windows\System\iCtToYZ.exe
  C:\Windows\System\iCtToYZ.exe
  2⤵
  PID:8360
- C:\Windows\System\TTUhSOq.exe
  C:\Windows\System\TTUhSOq.exe
  2⤵
  PID:8700
- C:\Windows\System\jEBLcgF.exe
  C:\Windows\System\jEBLcgF.exe
  2⤵
  PID:14912
- C:\Windows\System\MVsPDOt.exe
  C:\Windows\System\MVsPDOt.exe
  2⤵
  PID:10332
- C:\Windows\System\QzJIxCM.exe
  C:\Windows\System\QzJIxCM.exe
  2⤵
  PID:14180
- C:\Windows\System\HcjCKuH.exe
  C:\Windows\System\HcjCKuH.exe
  2⤵
  PID:10472
- C:\Windows\System\NuMtCzE.exe
  C:\Windows\System\NuMtCzE.exe
  2⤵
  PID:9628
- C:\Windows\System\HMUwLKA.exe
  C:\Windows\System\HMUwLKA.exe
  2⤵
  PID:6300
- C:\Windows\System\ctHAole.exe
  C:\Windows\System\ctHAole.exe
  2⤵
  PID:6404
- C:\Windows\System\zlrbAtm.exe
  C:\Windows\System\zlrbAtm.exe
  2⤵
  PID:14856
- C:\Windows\System\QtACNbw.exe
  C:\Windows\System\QtACNbw.exe
  2⤵
  PID:13848
- C:\Windows\System\AfTVrsY.exe
  C:\Windows\System\AfTVrsY.exe
  2⤵
  PID:6576
- C:\Windows\System\JYbGtfp.exe
  C:\Windows\System\JYbGtfp.exe
  2⤵
  PID:15044
- C:\Windows\System\JvVaZlU.exe
  C:\Windows\System\JvVaZlU.exe
  2⤵
  PID:3984
- C:\Windows\System\YEWUytw.exe
  C:\Windows\System\YEWUytw.exe
  2⤵
  PID:11000
- C:\Windows\System\XDYXiZj.exe
  C:\Windows\System\XDYXiZj.exe
  2⤵
  PID:15016
- C:\Windows\System\zMeUYDt.exe
  C:\Windows\System\zMeUYDt.exe
  2⤵
  PID:10800
- C:\Windows\System\ENiBmCv.exe
  C:\Windows\System\ENiBmCv.exe
  2⤵
  PID:15156
- C:\Windows\System\KcbZfFX.exe
  C:\Windows\System\KcbZfFX.exe
  2⤵
  PID:10892
- C:\Windows\System\SsOXfgW.exe
  C:\Windows\System\SsOXfgW.exe
  2⤵
  PID:7180
- C:\Windows\System\XJsaoRR.exe
  C:\Windows\System\XJsaoRR.exe
  2⤵
  PID:11040
- C:\Windows\System\lEJvtKA.exe
  C:\Windows\System\lEJvtKA.exe
  2⤵
  PID:9372
- C:\Windows\System\rVNqkEI.exe
  C:\Windows\System\rVNqkEI.exe
  2⤵
  PID:11056
- C:\Windows\System\keGZIPw.exe
  C:\Windows\System\keGZIPw.exe
  2⤵
  PID:7004
- C:\Windows\System\qdqhtCL.exe
  C:\Windows\System\qdqhtCL.exe
  2⤵
  PID:9556
- C:\Windows\System\QSetNNG.exe
  C:\Windows\System\QSetNNG.exe
  2⤵
  PID:9416
- C:\Windows\System\AQMDbEb.exe
  C:\Windows\System\AQMDbEb.exe
  2⤵
  PID:6384
- C:\Windows\System\FpWAxOY.exe
  C:\Windows\System\FpWAxOY.exe
  2⤵
  PID:8848
- C:\Windows\System\XShSdPr.exe
  C:\Windows\System\XShSdPr.exe
  2⤵
  PID:3516
- C:\Windows\System\jTveEsO.exe
  C:\Windows\System\jTveEsO.exe
  2⤵
  PID:11072
- C:\Windows\System\GykOprX.exe
  C:\Windows\System\GykOprX.exe
  2⤵
  PID:10780
- C:\Windows\System\osUrCTC.exe
  C:\Windows\System\osUrCTC.exe
  2⤵
  PID:10716
- C:\Windows\System\WlxoQTR.exe
  C:\Windows\System\WlxoQTR.exe
  2⤵
  PID:10980
- C:\Windows\System\XPLGnjf.exe
  C:\Windows\System\XPLGnjf.exe
  2⤵
  PID:8468
- C:\Windows\System\NSFerJA.exe
  C:\Windows\System\NSFerJA.exe
  2⤵
  PID:4564
- C:\Windows\System\hEHXbHV.exe
  C:\Windows\System\hEHXbHV.exe
  2⤵
  PID:1216
- C:\Windows\System\rjTewrg.exe
  C:\Windows\System\rjTewrg.exe
  2⤵
  PID:10820
- C:\Windows\System\YNScjJb.exe
  C:\Windows\System\YNScjJb.exe
  2⤵
  PID:9664
- C:\Windows\System\ozwylEP.exe
  C:\Windows\System\ozwylEP.exe
  2⤵
  PID:10756
- C:\Windows\System\AMDtrfB.exe
  C:\Windows\System\AMDtrfB.exe
  2⤵
  PID:8940
- C:\Windows\System\LIRfkfd.exe
  C:\Windows\System\LIRfkfd.exe
  2⤵
  PID:8860
- C:\Windows\System\xMDlhLv.exe
  C:\Windows\System\xMDlhLv.exe
  2⤵
  PID:8732
- C:\Windows\System\pUDDnwA.exe
  C:\Windows\System\pUDDnwA.exe
  2⤵
  PID:13344
- C:\Windows\System\KvUjleD.exe
  C:\Windows\System\KvUjleD.exe
  2⤵
  PID:7236
- C:\Windows\System\oYhtrOf.exe
  C:\Windows\System\oYhtrOf.exe
  2⤵
  PID:736
- C:\Windows\System\AaVBIAe.exe
  C:\Windows\System\AaVBIAe.exe
  2⤵
  PID:11840
- C:\Windows\System\NlAGtol.exe
  C:\Windows\System\NlAGtol.exe
  2⤵
  PID:14536
- C:\Windows\System\yROtnuX.exe
  C:\Windows\System\yROtnuX.exe
  2⤵
  PID:10984
- C:\Windows\System\sdroZAP.exe
  C:\Windows\System\sdroZAP.exe
  2⤵
  PID:13216
- C:\Windows\System\ZlQOEDx.exe
  C:\Windows\System\ZlQOEDx.exe
  2⤵
  PID:12144
- C:\Windows\System\UcmHJvk.exe
  C:\Windows\System\UcmHJvk.exe
  2⤵
  PID:15036
- C:\Windows\System\ZOuaZHS.exe
  C:\Windows\System\ZOuaZHS.exe
  2⤵
  PID:12248
- C:\Windows\System\quTFfLc.exe
  C:\Windows\System\quTFfLc.exe
  2⤵
  PID:12264
- C:\Windows\System\KhvfSgV.exe
  C:\Windows\System\KhvfSgV.exe
  2⤵
  PID:11024
- C:\Windows\System\qJfZkAb.exe
  C:\Windows\System\qJfZkAb.exe
  2⤵
  PID:10844
- C:\Windows\System\qpGMedI.exe
  C:\Windows\System\qpGMedI.exe
  2⤵
  PID:10852
- C:\Windows\System\xgrKZjA.exe
  C:\Windows\System\xgrKZjA.exe
  2⤵
  PID:9380
- C:\Windows\System\ZCUeVIz.exe
  C:\Windows\System\ZCUeVIz.exe
  2⤵
  PID:14872
- C:\Windows\System\ToNPCiL.exe
  C:\Windows\System\ToNPCiL.exe
  2⤵
  PID:9576
- C:\Windows\System\qCSFWtc.exe
  C:\Windows\System\qCSFWtc.exe
  2⤵
  PID:15000
- C:\Windows\System\PGaswCC.exe
  C:\Windows\System\PGaswCC.exe
  2⤵
  PID:6168
- C:\Windows\System\fwPljxu.exe
  C:\Windows\System\fwPljxu.exe
  2⤵
  PID:1692
- C:\Windows\System\USJFNfY.exe
  C:\Windows\System\USJFNfY.exe
  2⤵
  PID:8288
- C:\Windows\System\OfzlvIN.exe
  C:\Windows\System\OfzlvIN.exe
  2⤵
  PID:10704
- C:\Windows\System\fYJDRZx.exe
  C:\Windows\System\fYJDRZx.exe
  2⤵
  PID:8280
- C:\Windows\System\OVsUYEH.exe
  C:\Windows\System\OVsUYEH.exe
  2⤵
  PID:14800
- C:\Windows\System\cFMQyto.exe
  C:\Windows\System\cFMQyto.exe
  2⤵
  PID:10620
- C:\Windows\System\pHMsiTs.exe
  C:\Windows\System\pHMsiTs.exe
  2⤵
  PID:15064
- C:\Windows\System\ojvoyht.exe
  C:\Windows\System\ojvoyht.exe
  2⤵
  PID:11484
- C:\Windows\System\WYlzRzv.exe
  C:\Windows\System\WYlzRzv.exe
  2⤵
  PID:8872
- C:\Windows\System\tUEAmIX.exe
  C:\Windows\System\tUEAmIX.exe
  2⤵
  PID:10324
- C:\Windows\System\wtIuwDF.exe
  C:\Windows\System\wtIuwDF.exe
  2⤵
  PID:6620
- C:\Windows\System\hxZNybr.exe
  C:\Windows\System\hxZNybr.exe
  2⤵
  PID:8752
- C:\Windows\System\zbnHKeU.exe
  C:\Windows\System\zbnHKeU.exe
  2⤵
  PID:11940
- C:\Windows\System\zfTEKpZ.exe
  C:\Windows\System\zfTEKpZ.exe
  2⤵
  PID:9856
- C:\Windows\System\WZKuFVc.exe
  C:\Windows\System\WZKuFVc.exe
  2⤵
  PID:9824
- C:\Windows\System\ATMqiQu.exe
  C:\Windows\System\ATMqiQu.exe
  2⤵
  PID:6080
- C:\Windows\System\ZWVdREp.exe
  C:\Windows\System\ZWVdREp.exe
  2⤵
  PID:8480
- C:\Windows\System\poULQnA.exe
  C:\Windows\System\poULQnA.exe
  2⤵
  PID:9172
- C:\Windows\System\ToNzipc.exe
  C:\Windows\System\ToNzipc.exe
  2⤵
  PID:12916
- C:\Windows\System\HFYtAxz.exe
  C:\Windows\System\HFYtAxz.exe
  2⤵
  PID:6912
- C:\Windows\System\vaXhtig.exe
  C:\Windows\System\vaXhtig.exe
  2⤵
  PID:9880
- C:\Windows\System\Muvaidj.exe
  C:\Windows\System\Muvaidj.exe
  2⤵
  PID:10100
- C:\Windows\System\xVLtlyO.exe
  C:\Windows\System\xVLtlyO.exe
  2⤵
  PID:14716
- C:\Windows\System\cVnkwyj.exe
  C:\Windows\System\cVnkwyj.exe
  2⤵
  PID:10868
- C:\Windows\System\uaMJOoZ.exe
  C:\Windows\System\uaMJOoZ.exe
  2⤵
  PID:4296
- C:\Windows\System\NXXwbUO.exe
  C:\Windows\System\NXXwbUO.exe
  2⤵
  PID:5244
- C:\Windows\System\IMDVxrK.exe
  C:\Windows\System\IMDVxrK.exe
  2⤵
  PID:10356
- C:\Windows\System\xHNjWYq.exe
  C:\Windows\System\xHNjWYq.exe
  2⤵
  PID:10652
- C:\Windows\System\ZcbjNxx.exe
  C:\Windows\System\ZcbjNxx.exe
  2⤵
  PID:6552
- C:\Windows\System\lINhmuC.exe
  C:\Windows\System\lINhmuC.exe
  2⤵
  PID:10228
- C:\Windows\System\sYtIEvI.exe
  C:\Windows\System\sYtIEvI.exe
  2⤵
  PID:10840
- C:\Windows\System\WIebyKQ.exe
  C:\Windows\System\WIebyKQ.exe
  2⤵
  PID:9404
- C:\Windows\System\qRymndm.exe
  C:\Windows\System\qRymndm.exe
  2⤵
  PID:11620
- C:\Windows\System\HkMtPZe.exe
  C:\Windows\System\HkMtPZe.exe
  2⤵
  PID:8220
- C:\Windows\System\RBWtsao.exe
  C:\Windows\System\RBWtsao.exe
  2⤵
  PID:11492
- C:\Windows\System\zXrtuRM.exe
  C:\Windows\System\zXrtuRM.exe
  2⤵
  PID:12360
- C:\Windows\System\pdkFZOG.exe
  C:\Windows\System\pdkFZOG.exe
  2⤵
  PID:11124
- C:\Windows\System\qnLYmPS.exe
  C:\Windows\System\qnLYmPS.exe
  2⤵
  PID:13044
- C:\Windows\System\gRTfxEt.exe
  C:\Windows\System\gRTfxEt.exe
  2⤵
  PID:10432
- C:\Windows\System\zkVoXZN.exe
  C:\Windows\System\zkVoXZN.exe
  2⤵
  PID:8652
- C:\Windows\System\tMHRAmX.exe
  C:\Windows\System\tMHRAmX.exe
  2⤵
  PID:10760
- C:\Windows\System\ygBlBNR.exe
  C:\Windows\System\ygBlBNR.exe
  2⤵
  PID:14572
- C:\Windows\System\QdsfFYY.exe
  C:\Windows\System\QdsfFYY.exe
  2⤵
  PID:13536
- C:\Windows\System\GyowUMj.exe
  C:\Windows\System\GyowUMj.exe
  2⤵
  PID:10784
- C:\Windows\System\pEyTRHu.exe
  C:\Windows\System\pEyTRHu.exe
  2⤵
  PID:8984
- C:\Windows\System\qcPUaJz.exe
  C:\Windows\System\qcPUaJz.exe
  2⤵
  PID:12256
- C:\Windows\System\rydZjNu.exe
  C:\Windows\System\rydZjNu.exe
  2⤵
  PID:10632
- C:\Windows\System\uasVHkL.exe
  C:\Windows\System\uasVHkL.exe
  2⤵
  PID:13820
- C:\Windows\System\oSzlRhq.exe
  C:\Windows\System\oSzlRhq.exe
  2⤵
  PID:10604
- C:\Windows\System\XLBTpxd.exe
  C:\Windows\System\XLBTpxd.exe
  2⤵
  PID:9712
- C:\Windows\System\WAfTpBM.exe
  C:\Windows\System\WAfTpBM.exe
  2⤵
  PID:14412
- C:\Windows\System\nDfLiAR.exe
  C:\Windows\System\nDfLiAR.exe
  2⤵
  PID:10316
- C:\Windows\System\kyyyzvQ.exe
  C:\Windows\System\kyyyzvQ.exe
  2⤵
  PID:9188
- C:\Windows\System\CrwZKhX.exe
  C:\Windows\System\CrwZKhX.exe
  2⤵
  PID:11964
- C:\Windows\System\qZkveET.exe
  C:\Windows\System\qZkveET.exe
  2⤵
  PID:11188
- C:\Windows\System\IzqhxXi.exe
  C:\Windows\System\IzqhxXi.exe
  2⤵
  PID:11752
- C:\Windows\System\VDmUSlX.exe
  C:\Windows\System\VDmUSlX.exe
  2⤵
  PID:15376
- C:\Windows\System\vjuviMz.exe
  C:\Windows\System\vjuviMz.exe
  2⤵
  PID:15396
- C:\Windows\System\AvQdGqF.exe
  C:\Windows\System\AvQdGqF.exe
  2⤵
  PID:15412
- C:\Windows\System\CgHvMFU.exe
  C:\Windows\System\CgHvMFU.exe
  2⤵
  PID:15432
- C:\Windows\System\feUWDya.exe
  C:\Windows\System\feUWDya.exe
  2⤵
  PID:15452
- C:\Windows\System\mjekQAj.exe
  C:\Windows\System\mjekQAj.exe
  2⤵
  PID:15476
- C:\Windows\System\BfbmuQw.exe
  C:\Windows\System\BfbmuQw.exe
  2⤵
  PID:15492
- C:\Windows\System\NTAulJm.exe
  C:\Windows\System\NTAulJm.exe
  2⤵
  PID:15512
- C:\Windows\System\GHwLkgt.exe
  C:\Windows\System\GHwLkgt.exe
  2⤵
  PID:15536
- C:\Windows\System\dRgetAX.exe
  C:\Windows\System\dRgetAX.exe
  2⤵
  PID:15556
- C:\Windows\System\IOhRWZz.exe
  C:\Windows\System\IOhRWZz.exe
  2⤵
  PID:15572
- C:\Windows\System\vrdejVP.exe
  C:\Windows\System\vrdejVP.exe
  2⤵
  PID:15600
- C:\Windows\System\reHHOvg.exe
  C:\Windows\System\reHHOvg.exe
  2⤵
  PID:15756
- C:\Windows\System\geInilh.exe
  C:\Windows\System\geInilh.exe
  2⤵
  PID:15928
- C:\Windows\System\umUTobV.exe
  C:\Windows\System\umUTobV.exe
  2⤵
  PID:15948
- C:\Windows\System\JiVEXdG.exe
  C:\Windows\System\JiVEXdG.exe
  2⤵
  PID:15972
- C:\Windows\System\ImaOpgI.exe
  C:\Windows\System\ImaOpgI.exe
  2⤵
  PID:16008
- C:\Windows\System\ttfQpxc.exe
  C:\Windows\System\ttfQpxc.exe
  2⤵
  PID:16032
- C:\Windows\System\XWyABtW.exe
  C:\Windows\System\XWyABtW.exe
  2⤵
  PID:16072
- C:\Windows\System\qOQweXe.exe
  C:\Windows\System\qOQweXe.exe
  2⤵
  PID:16108
- C:\Windows\System\kMaQUxj.exe
  C:\Windows\System\kMaQUxj.exe
  2⤵
  PID:16128
- C:\Windows\System\OvLwQdN.exe
  C:\Windows\System\OvLwQdN.exe
  2⤵
  PID:16148
- C:\Windows\System\DRRMztK.exe
  C:\Windows\System\DRRMztK.exe
  2⤵
  PID:16168
- C:\Windows\System\ZZAWPvN.exe
  C:\Windows\System\ZZAWPvN.exe
  2⤵
  PID:16208
- C:\Windows\System\FHSynfx.exe
  C:\Windows\System\FHSynfx.exe
  2⤵
  PID:16224
- C:\Windows\System\UXIKtSs.exe
  C:\Windows\System\UXIKtSs.exe
  2⤵
  PID:16244
- C:\Windows\System\oxyKuvm.exe
  C:\Windows\System\oxyKuvm.exe
  2⤵
  PID:16268
- C:\Windows\System\qvnVqHZ.exe
  C:\Windows\System\qvnVqHZ.exe
  2⤵
  PID:16288
- C:\Windows\System\VByRHOB.exe
  C:\Windows\System\VByRHOB.exe
  2⤵
  PID:16304
- C:\Windows\System\OJbBTZx.exe
  C:\Windows\System\OJbBTZx.exe
  2⤵
  PID:16320
- C:\Windows\System\HeNoRbd.exe
  C:\Windows\System\HeNoRbd.exe
  2⤵
  PID:16340
- C:\Windows\System\vfJPfUF.exe
  C:\Windows\System\vfJPfUF.exe
  2⤵
  PID:16364
- C:\Windows\System\GieVppg.exe
  C:\Windows\System\GieVppg.exe
  2⤵
  PID:10308
- C:\Windows\System\IRfbBZQ.exe
  C:\Windows\System\IRfbBZQ.exe
  2⤵
  PID:11852
- C:\Windows\System\RtfOsIi.exe
  C:\Windows\System\RtfOsIi.exe
  2⤵
  PID:8424
- C:\Windows\System\vHRXcqS.exe
  C:\Windows\System\vHRXcqS.exe
  2⤵
  PID:9632
- C:\Windows\System\cZnZdaW.exe
  C:\Windows\System\cZnZdaW.exe
  2⤵
  PID:9272
- C:\Windows\System\KZaVisP.exe
  C:\Windows\System\KZaVisP.exe
  2⤵
  PID:9896
- C:\Windows\System\aRUWcbL.exe
  C:\Windows\System\aRUWcbL.exe
  2⤵
  PID:12664
- C:\Windows\System\PVpkohf.exe
  C:\Windows\System\PVpkohf.exe
  2⤵
  PID:320
- C:\Windows\System\lJVNdBg.exe
  C:\Windows\System\lJVNdBg.exe
  2⤵
  PID:10328
- C:\Windows\System\JtnrsUh.exe
  C:\Windows\System\JtnrsUh.exe
  2⤵
  PID:10416
- C:\Windows\System\UafSCme.exe
  C:\Windows\System\UafSCme.exe
  2⤵
  PID:15588
- C:\Windows\System\jLaZNPm.exe
  C:\Windows\System\jLaZNPm.exe
  2⤵
  PID:4020
- C:\Windows\System\xiJsHdF.exe
  C:\Windows\System\xiJsHdF.exe
  2⤵
  PID:9512
- C:\Windows\System\XCVAfdD.exe
  C:\Windows\System\XCVAfdD.exe
  2⤵
  PID:10728
- C:\Windows\System\GjQlyUM.exe
  C:\Windows\System\GjQlyUM.exe
  2⤵
  PID:12920
- C:\Windows\System\eAyHmQe.exe
  C:\Windows\System\eAyHmQe.exe
  2⤵
  PID:7416
- C:\Windows\System\tsNDnBi.exe
  C:\Windows\System\tsNDnBi.exe
  2⤵
  PID:9436
- C:\Windows\System\KZBtwkk.exe
  C:\Windows\System\KZBtwkk.exe
  2⤵
  PID:9560

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 688 -p 12168 -ip 12168
1⤵
PID:12192

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 12588 -ip 12588
1⤵
PID:13092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_doxirkgt.ii2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AuZOvpL.exe

Filesize
1.5MB

MD5
ae0996668388481256864f01d3dedf14

SHA1
d4fea5336c54f4302d1bac586967dfaa4e143c5e

SHA256
89345f2514d95da6406baa431d3fc72f8f98c86dbc0a615299ca1c21adbe779e

SHA512
432b46e8fb4728eda381a19b1ba447dc65729f0dd4f0aa4545cba48d17f7839ecd0352ee108fa598386e1c8cf33f4d9d179fb43b4d5d87a0f124c6250b623821

Download Submit
C:\Windows\System\BdCDGhp.exe

Filesize
1.5MB

MD5
18532e568186af5fc1533a732e55c1f6

SHA1
bf063dc35741b7d01dfe8fa31edfcaaf070b574b

SHA256
b99391e753d5e0286e4a55c3473bc490347225270436673825cbc1ec2bb941ad

SHA512
a2876923a1d57e547141c4c160b0c0d251393357f8e7db5fb8ef8c696e405071753f9666d00e42d967ebcb4fd8f2551206e73bbe7b98dcbf4cee0ce7ec38c0c9

Download Submit
C:\Windows\System\DNIdSIT.exe

Filesize
1.5MB

MD5
2ecfe4d0e7447fa53c108decdc6bdf44

SHA1
d21bee13e6a164b0f9ce43986478d14f74aead70

SHA256
5ffe1e411fb10708ecb3af7143f2410528c405a0f259dfdd456ddad89a672949

SHA512
700945541730d6a9e2b1c110c9af6e3c875217c2c538d55318e3120a3e5ff0cd3c8ca7c242e368e55554e95d22a0177a315ff22b00cedb66f2da2bf538933ac8

Download Submit
C:\Windows\System\FuoBwmj.exe

Filesize
1.5MB

MD5
0b5dd61503034318f5c0cbde27eaeceb

SHA1
b8e1f5c50cf68a482cee62cde966649b4a6a518d

SHA256
a12a61fe7294cca225b1a12c37ee0d1b2d1b60a1b078acbaf96543eacb37635d

SHA512
b177946265478bdb184c759cfae949c699eddd63bb79f834f3f1085f55730ae6cd855c86d9d1d7ddfc4c0f252c01432a1612e517f5ed6f20ba68e9b431e3efba

Download Submit
C:\Windows\System\GGDZNlB.exe

Filesize
1.5MB

MD5
b4f446a180c91b0a88e175c5cced101b

SHA1
1fc0d0f1887ea91edcb99295c7804a33680d493b

SHA256
4ea97fd06f1b46865d4e00b18e529dbca5af9f9048a0d13bc758d99e8df44b61

SHA512
523e700ff810833cab61627a2813171e93c6de0fdf802f3528e6431d8203f2dc8ce040cb285e93480d766dfe2039ea964e99d674d0652316028d212b63b7c084

Download Submit
C:\Windows\System\GXMDDdq.exe

Filesize
1.5MB

MD5
86ec75e43f06ec46ca13e8fe236fede8

SHA1
8fa27c5be9bfdde2f21a98b3b524981cb1710cd3

SHA256
28be511b5c166e391208ebbbf7ba9867ddfc6bfa15202283be1f682dcc4e5a76

SHA512
98d55c212fba0f9d1b239c03552dc04a6e968cf5df0ec5ec11a32d3ea0810a53a03c3f4b3cd09cd9833b4473d1f94d0d33130113c9cb95ab31c4b0be809f40d2

Download Submit
C:\Windows\System\GmwJPEQ.exe

Filesize
1.5MB

MD5
9addd983c0b5050320543e1c95fcf481

SHA1
8ec1d96886ba5958db0c1f6021e6e4e6efaa73b6

SHA256
5902dd400c42d812c6870673e0b272932f7829e2c4cff7be63e4340e72428819

SHA512
eb0f54d85be7ee9dd436f699f4eebbb04d8630fd47c2f308886180afddf2c094702e4755019d123615bbc8a1e3eb4a3da5986a88e160f903f7be37ff2892d321

Download Submit
C:\Windows\System\IlIZqEC.exe

Filesize
1.5MB

MD5
7d5f4c693107bcbfb950ac641b24d4cf

SHA1
442191dc9512c105f9459e9e4446b7f896c44b9c

SHA256
1876f4bdcf3b543ea2c555b8d890d876f8a69d2f28f776534393527fdc4ff6d8

SHA512
088ce7c65cc054b8068b83888b991c00ad8a4fe89826acb9f8fdd8d67d1c41bef602185d475d9608519557e37067917e4fdebf11ee4c98cdb50e6be21ebd534a

Download Submit
C:\Windows\System\LkynZYK.exe

Filesize
1.5MB

MD5
10898024b6e6e4d3c30170932bbc58d2

SHA1
b56cadad04c44a6f90db4d841a2876a3cd6ad359

SHA256
d45c9d884602b4f0e45e36c3c07ec26cabda2f2b7ddd53c52482a78a46425f81

SHA512
28d5e9d60a777d01b093bee7572b15d518c977af75e916265d900a980d2b4e7a644c83303bced65ea765240937bf0ca94de8a7d605e09262e17888f38e674965

Download Submit
C:\Windows\System\NWXHIEk.exe

Filesize
1.5MB

MD5
bee450d31de64a9ff601e1315cb31a42

SHA1
bce8e55cb100b413d9fbf715573a125dbb32b914

SHA256
ceaaa676f0d0fd4ee6d163e3a999242cf0d93022796b1f9e4f8b465245346d7d

SHA512
406e6f2aac73bcedfc0d5cf159f2d79fe26d0808cb6be55a0387f0dbca0d7cc985808d168260f7959983922125b1d311384a9c44c5007ee5e3524d7aa64fd69f

Download Submit
C:\Windows\System\OAaohNu.exe

Filesize
1.5MB

MD5
01cc6b931188003091651166fd628039

SHA1
6357712319099b3e80fddbd1fa081fb4bac586c4

SHA256
45f4c5f26be4eb391b0f15917b68faa2aa8c99d3ac47a49d5d54675e6fb48834

SHA512
8fa71ad369d4554eaf1955037a021b572e09e07bfd615107c21739fdbf414716783d133b3645fe29facca7798514e85eef736af192f2181ed11b49b464d1f32e

Download Submit
C:\Windows\System\ObrwQTK.exe

Filesize
1.5MB

MD5
d18e3ba95212dc96dd0c83178455adc1

SHA1
8a003224ae8e598e675c302521c21fde1945dcb4

SHA256
586b0f57749640982fe2658bc8c8d2599a1602cfc1593aa3a3716865ba2a8678

SHA512
3cd23ece52ea03802ff63b5b55c467f476aa80b232df8852698791e5ca337090025ea7ed4efdfd72ad82239535e6028f65565484b8dafab412478acc1627e57b

Download Submit
C:\Windows\System\OgHzbGG.exe

Filesize
1.5MB

MD5
8af9fbfe56850611425a944bab0b89b3

SHA1
fd764f73db979ed8b7bb08b925e8cf7a2ffbf3ff

SHA256
f80456a85900e4f5d1d47616728e7b2d611d5229f7a78e046f2353ec7c45fc7d

SHA512
1a4eb7ef6525a1a9b1e2f13426ee0f8b999648e5f542260e73e134b6208ea7e1ac86c4ff003922e792ff1717237d06aafdefb9eaf682b8d96e311f09b0a45198

Download Submit
C:\Windows\System\RjsGpHb.exe

Filesize
1.5MB

MD5
a26151c469a4c732f37ecb70cd99496a

SHA1
8ffc6cb4ceb87edb91913f7bdc7d8e272f6f48e0

SHA256
ebee49c9960b8875b46eac8f5051d7e1df7243fb5d2962571aeac9e9d1eb2e1a

SHA512
2d4686ae2ef0543926859897ee167e63e6bc03ec6509674c73389a0e7014dad60f5085c9ad0b4b498ae12dea971714c98cc2e779b427a2cf445874b9b02bfda1

Download Submit
C:\Windows\System\UsaUchA.exe

Filesize
1.5MB

MD5
2f48b7d8b3c0dabd3ae01d98c1ead895

SHA1
47c9f80e97dc3c7c0253d415ceedc3f40cef951c

SHA256
ef2899f1fdfc933d8f69c851369ecade6b1d230f59207402f08e7982d8c6a62b

SHA512
caab3fe5c4cf6bdee90ae42706e6aad9bc4014c8a162759124158efc12ccdb034a52e35e9405ebc739af67624794427a81b95289052c1ca490d171c8dc3ef21c

Download Submit
C:\Windows\System\XVoqxPV.exe

Filesize
1.5MB

MD5
fe7c934350d36d2e5f1a70e17db189fe

SHA1
1658159f5cf2e73a58319498d88e8bf0a0600ae4

SHA256
6f3a3563495d89ee95d94f87341d86ba573f173fa0f8d356ba7b2f35d6831ca0

SHA512
aa6a0f89b3ffaf747c5601110ec526d1ea2df340be136c250054423edce74ceb07df48f25c5c66c88270f383389084f725e2005c5009097bf852891dc9a717a0

Download Submit
C:\Windows\System\YwTlKBy.exe

Filesize
1.5MB

MD5
bccd4c6bda0e59f265ee194db9ca017f

SHA1
1941385208ef204ea6fc3b6775703d2c9738730d

SHA256
aa390d775203697e9f307caf3acffe9b206c1fae029713d982f5aba1a3188e79

SHA512
35ea17dc2d149e4f66a3a0678845348e1bb7d1f23258e3e1c579079759b4e8743348bd10907dc08375a051d58e78f8c664c83c4540cfce604ebdbe1db97ae96f

Download Submit
C:\Windows\System\ZGvtxfo.exe

Filesize
1.5MB

MD5
3fae872cbe5c4158f3fc13f1f4fd8fd5

SHA1
ef0db3ac1e7d428f785b5fe209580fb9918d6ee8

SHA256
ebbadb4c0f2d9b3a01a253af2f22e9cce9e3daae5692a545a3ce192c0d7b9fe4

SHA512
c041bff28c1417ff2c824f4f9c66d6ec9c43d529006533fca7d51f2da0c76ada9ed855f7b34b3970e49d4dc0a20aa39c8f8205baac9c0bab1d53aa43cf70b849

Download Submit
C:\Windows\System\bTiTJVT.exe

Filesize
1.5MB

MD5
8bd96f8f7ecde1c298cc95823200be34

SHA1
23eace465fa41a42d3dfe2fa750dd56f94fd2678

SHA256
4c570872e85d43f8bdfb62024fc731c6729399f8a879edb2f66de07d4be46e51

SHA512
c80fcc5b4dcf5eed894897a91bd83ea4f7dd59b41cb75e477514660eedb74cf61d18f274a0a797e96aef898da410a93ef09437da1136f7b91b4df097998e2435

Download Submit
C:\Windows\System\cAiLOFr.exe

Filesize
1.5MB

MD5
6db3732e4323fc26bc8efc3e87de9413

SHA1
b564c18cab2c970866d5da4696a17ddd74cb5d93

SHA256
d4fb4e03b7fdd0118a594ed013463e54e83479d86ca739a15794956cc09f9c8e

SHA512
37aad3ca277a2a5e8036e7e1d72b24b9308f75549375ccaf1935a1aaf665be3923eb02fae1d1795b4209c031111459afb3fda310e43a0ce909845946de6af9fb

Download Submit
C:\Windows\System\eDwmFEq.exe

Filesize
1.5MB

MD5
e1cba67be5ed61a9c2605fe6b2c805ea

SHA1
1000dc7fd5b574fa2cb7c8094e4ce8e1827eefad

SHA256
811a27fa71ddee2aa35f5c802372a85acfd24e07449f5b3b1decb0b7239716c1

SHA512
7f595579339646379550f9ba19bc36405395874af85e9d9d7be1a1ad903cc2ed278df6bb00256d76f6aedf27029dec322fba97c4259105a2a527419d0c179030

Download Submit
C:\Windows\System\hrpyGLh.exe

Filesize
1.5MB

MD5
5462afc3150b1eff4c743300b142dca9

SHA1
085dc0b8b7bb3a0e9f3514780a84371ab439ccc8

SHA256
bc94f6941f269124a425cef14bebe7468ec1820c0cfa393e0c20f288d91e7c5a

SHA512
8dc51edda59ed4a83244d9c6c98c752c3bae89f935f522764f59f637d5db8768d620851af107bbd5a26d48fee9a8870a25b2205d949e9f3753b349513ca0d276

Download Submit
C:\Windows\System\ibJfjav.exe

Filesize
1.5MB

MD5
c04da97805adc64fdc9d0b1936d9976f

SHA1
28b84230fa61acb843cbd3ff869a5d320db2256b

SHA256
1f5166b1e3c782fb2789c49c8487dfa53c54283624186d56ed0b34c007e51d6d

SHA512
1581ca6722df316940f009c3b64bedea6694ff5ea16a2344fd12b685dd487d96593c97acd7782a8353faf57729e986fed61f2db069420d40a92d247d41028b03

Download Submit
C:\Windows\System\ikjxkiS.exe

Filesize
1.5MB

MD5
b9df9c749a4eda603a11e0721b745666

SHA1
dd212e890e104657180d0ed5d2aad840b18528ab

SHA256
8e35220babc2c352fd78f94e9599ea957aa21a16d5983cb4bbf5b2c1dba69b7a

SHA512
4a70780820faa7a99c4c20a31d43376eddba5c15325ee2fff38cceb61949769a566b37f354b042d6575454a41005558c704aee0f8f9e4682bb6b14100ec431fa

Download Submit
C:\Windows\System\iwyJzpr.exe

Filesize
1.5MB

MD5
ce56267dee764b9cfdc55ee457d09ca2

SHA1
6a97f11bdac3cd302f8505c5114fc5d9b229e06e

SHA256
9193a738c55cdb4243a92ead4824c80e69772a7a9970c0618665134eb8a9db57

SHA512
92e325692e38c2b78d32979420ec5e2c568f5e9cdf0abfc276dc4c48688deda3b75345550c517214d84adc9297af909e3daa97cf96827db99be4dd2af538e375

Download Submit
C:\Windows\System\jenhBxa.exe

Filesize
1.5MB

MD5
c1c76b36cd3a64f3ab9a4d6987e3ec7f

SHA1
bc68f4ba1bea8cc7e9d41d1dd7b58a1be8b063ff

SHA256
2945041156d009b4299f0a98696a8431ebf428fe56d60ca6fd8757932b464867

SHA512
0a414720f0eaa15a38b356be1d72a102fddd24687456affff101943d6a03dc1afffbcb8b42f89e823d09ec95952e4c1196015665576aaebff8210dae7cc071ab

Download Submit
C:\Windows\System\jvGOApI.exe

Filesize
1.5MB

MD5
3f656a5a606b17ba4cd0a8f024950b95

SHA1
c9a04bed30e734349b7fab918fad9d2d7b03a2f3

SHA256
27e0eed0c8a934e579f9df15a28dd457048f3c5603b6036643a086767d066cda

SHA512
6d9fe08881cc8af3e66de9a17bd06e8ab0d907bd648eeec60a8102631a0f5fcb14a21eb71d2c76cc0f98f47d4b98a666ea0477952f33c3003f13ba39811d4374

Download Submit
C:\Windows\System\lWwfHFA.exe

Filesize
1.5MB

MD5
49125569f0fd5ed7e747d9d870aa8249

SHA1
951a7ee202559ece6eea28ef015210ca613db71c

SHA256
88d4a63ee1e2127804ccc0d49890fb63ca4581ef529e223b069fc4198132cbcc

SHA512
323eca0ef37468d5456ef9de7ceb942b1e1ad12dfc6a835bdcad60320e22220a4072db7c9140e46f26730d0f5055a2d6fb0ff0ad100d25b3c13c67f3b2174c3c

Download Submit
C:\Windows\System\lwXkeaS.exe

Filesize
1.5MB

MD5
3609cbad37eaa28d82b539b636754643

SHA1
14110ff20ca6b0f55080e6d9d59bc125d83e6ab4

SHA256
6b397d7e6c2f06fb30524d53b6624588835901ef565459c315d9f75c7028c787

SHA512
c98f626e975729a65e44169fd76d6a38cacd03a41a3100bb3cc086a8728e9897a9da5802130893b786258558270e5b271e548d0ca98fa3c4447a4f4f40909ebd

Download Submit
C:\Windows\System\pYDKQas.exe

Filesize
1.5MB

MD5
1bc9391e2060605fa06ec5e423947b34

SHA1
be597933140353b0f2a92cb532dccdf7fed46643

SHA256
cd666d748ab9f7e4bf02662e55625349090380da38579247d79d39ebbceb57c9

SHA512
dca65dc800f507cd7e915bc44917e76cf8826df9d0123bcff5df69d0f6bce1b26236598bcc8e5eb3e527479cb4a338c93fcfce169768e85e9b38ab8e7b01b6fa

Download Submit
C:\Windows\System\vXcVjwc.exe

Filesize
1.5MB

MD5
77fb12dc078b425270fd810e0d2d3b49

SHA1
64447405eecfdec2e4266e747a5ed6df073ef658

SHA256
ffd2835f3ac4e44ee32e6506fd52fc41b5fd2d2a33f1339065adf6e0727f85b4

SHA512
d7865c25e1e0dab4555a14158b7dedc86e3eb859b6be03e69c7158f8ac9a86502e5c575e58c3559f26d98c864fa4c618b018a3d11e73ef75b9e4d92fabebd823

Download Submit
C:\Windows\System\xJuGIZb.exe

Filesize
1.5MB

MD5
305b439b1c1b181413be81d7cd5278a9

SHA1
7efa9e27e0432e50961e59ccdde8605b2af47acf

SHA256
c30d1f2ecff35a0d517c7d0fbb18ef2f016910485469c93a2e9cdeecd59466bb

SHA512
ae76bf909a25803c62c07cf9023c0d27c70ec34c6a21a6c28f80e3434cbb31abb61c7accddc8c8b3de73558dcf34c7cac61c4707c7aa754ea7eb2ca4cc38a80b

Download Submit
C:\Windows\System\yMuGqAt.exe

Filesize
1.5MB

MD5
25e2f4e36ccebfe3faf1b9f320e2b4ba

SHA1
c357e0b32ee2bfba75b4ed21c51106fe54b09e50

SHA256
46488dc4636ddfb23e4aeef8d28cc234863f0e0323efe54501831abdb38430ae

SHA512
0ceca646a04970fa29f8d9d10483d32358c84c1d0708aeeaea8fd2e57eeced79e8bffbb03c26e5f1b10af0360d00da02b76cc65e0235a7a52f46072ba03dfb50

Download Submit
memory/800-151-0x00007FF741B50000-0x00007FF741F42000-memory.dmp

Filesize
3.9MB

Download
memory/800-2395-0x00007FF741B50000-0x00007FF741F42000-memory.dmp

Filesize
3.9MB

Download
memory/928-43-0x00007FF62BC60000-0x00007FF62C052000-memory.dmp

Filesize
3.9MB

Download
memory/928-2186-0x00007FF62BC60000-0x00007FF62C052000-memory.dmp

Filesize
3.9MB

Download
memory/1100-20-0x00007FF640CA0000-0x00007FF641092000-memory.dmp

Filesize
3.9MB

Download
memory/1100-2136-0x00007FF640CA0000-0x00007FF641092000-memory.dmp

Filesize
3.9MB

Download
memory/1264-7-0x00007FF688840000-0x00007FF688C32000-memory.dmp

Filesize
3.9MB

Download
memory/1264-2130-0x00007FF688840000-0x00007FF688C32000-memory.dmp

Filesize
3.9MB

Download
memory/1460-93-0x00007FF629FE0000-0x00007FF62A3D2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-2185-0x00007FF629FE0000-0x00007FF62A3D2000-memory.dmp

Filesize
3.9MB

Download
memory/1480-66-0x00007FF7D90E0000-0x00007FF7D94D2000-memory.dmp

Filesize
3.9MB

Download
memory/1640-31-0x00007FF780510000-0x00007FF780902000-memory.dmp

Filesize
3.9MB

Download
memory/1640-2156-0x00007FF780510000-0x00007FF780902000-memory.dmp

Filesize
3.9MB

Download
memory/1808-99-0x00007FF7F65D0000-0x00007FF7F69C2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-2269-0x00007FF7F65D0000-0x00007FF7F69C2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-60-0x00007FF709EF0000-0x00007FF70A2E2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-2181-0x00007FF709EF0000-0x00007FF70A2E2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-26-0x00007FF637580000-0x00007FF637972000-memory.dmp

Filesize
3.9MB

Download
memory/2112-2179-0x00007FF637580000-0x00007FF637972000-memory.dmp

Filesize
3.9MB

Download
memory/2260-107-0x00007FF7657B0000-0x00007FF765BA2000-memory.dmp

Filesize
3.9MB

Download
memory/2260-2272-0x00007FF7657B0000-0x00007FF765BA2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-2413-0x00007FF775BC0000-0x00007FF775FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-152-0x00007FF775BC0000-0x00007FF775FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-1-0x000001DCA6D80000-0x000001DCA6D90000-memory.dmp

Filesize
64KB

Download
memory/3364-2907-0x00007FF695420000-0x00007FF695812000-memory.dmp

Filesize
3.9MB

Download
memory/3364-0-0x00007FF695420000-0x00007FF695812000-memory.dmp

Filesize
3.9MB

Download
memory/3456-2282-0x00007FF64E330000-0x00007FF64E722000-memory.dmp

Filesize
3.9MB

Download
memory/3456-121-0x00007FF64E330000-0x00007FF64E722000-memory.dmp

Filesize
3.9MB

Download
memory/3480-127-0x00007FF6DF120000-0x00007FF6DF512000-memory.dmp

Filesize
3.9MB

Download
memory/3564-142-0x00007FF69D330000-0x00007FF69D722000-memory.dmp

Filesize
3.9MB

Download
memory/3564-2402-0x00007FF69D330000-0x00007FF69D722000-memory.dmp

Filesize
3.9MB

Download
memory/3976-2378-0x00007FF6C4D70000-0x00007FF6C5162000-memory.dmp

Filesize
3.9MB

Download
memory/3976-157-0x00007FF6C4D70000-0x00007FF6C5162000-memory.dmp

Filesize
3.9MB

Download
memory/4268-416-0x0000022155BE0000-0x0000022156386000-memory.dmp

Filesize
7.6MB

Download
memory/4268-6004-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download
memory/4268-92-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download
memory/4268-49-0x0000022152F10000-0x0000022152F20000-memory.dmp

Filesize
64KB

Download
memory/4268-84-0x0000022152E70000-0x0000022152E92000-memory.dmp

Filesize
136KB

Download
memory/4268-68-0x00007FF8A2363000-0x00007FF8A2365000-memory.dmp

Filesize
8KB

Download
memory/4400-116-0x00007FF7B0A30000-0x00007FF7B0E22000-memory.dmp

Filesize
3.9MB

Download
memory/4400-2304-0x00007FF7B0A30000-0x00007FF7B0E22000-memory.dmp

Filesize
3.9MB

Download
memory/4428-161-0x00007FF64E4F0000-0x00007FF64E8E2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-2453-0x00007FF673FA0000-0x00007FF674392000-memory.dmp

Filesize
3.9MB

Download
memory/4588-136-0x00007FF673FA0000-0x00007FF674392000-memory.dmp

Filesize
3.9MB

Download
memory/4692-48-0x00007FF72ACE0000-0x00007FF72B0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4692-2184-0x00007FF72ACE0000-0x00007FF72B0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4708-103-0x00007FF669910000-0x00007FF669D02000-memory.dmp

Filesize
3.9MB

Download
memory/4708-2297-0x00007FF669910000-0x00007FF669D02000-memory.dmp

Filesize
3.9MB

Download
memory/4892-2189-0x00007FF749D10000-0x00007FF74A102000-memory.dmp

Filesize
3.9MB

Download
memory/4892-94-0x00007FF749D10000-0x00007FF74A102000-memory.dmp

Filesize
3.9MB

Download
memory/4980-65-0x00007FF77EC30000-0x00007FF77F022000-memory.dmp

Filesize
3.9MB

Download
memory/5048-2495-0x00007FF7E6B20000-0x00007FF7E6F12000-memory.dmp

Filesize
3.9MB

Download
memory/5048-158-0x00007FF7E6B20000-0x00007FF7E6F12000-memory.dmp

Filesize
3.9MB

Download