xmrig | fd02c63fcd38a0fc1587781314c12c7b6cd67fa0603deb5f907bd61ee8357457

Analysis

max time kernel
130s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
Size

3.2MB
MD5

73923baafabb32f52d3dc1709665e3b0
SHA1

57f339496fbeaabc84f2d9860d9d80b26ab306a4
SHA256

fd02c63fcd38a0fc1587781314c12c7b6cd67fa0603deb5f907bd61ee8357457
SHA512

42aa3dd6b49cfbda689352c40d876bcdc402fde14fe20b2e52c9e4c31db92a469f1ed26daf48328938b07e627b445322375771af39045c3162401961fa9a686d
SSDEEP

98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWb:SbBeSFkn

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral1/memory/2860-2-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/files/0x000c00000001269e-6.dat	xmrig
behavioral1/files/0x003800000001566b-9.dat	xmrig
behavioral1/files/0x0007000000004e76-25.dat	xmrig
behavioral1/files/0x0008000000015ce1-30.dat	xmrig
behavioral1/files/0x0007000000015ceb-34.dat	xmrig
behavioral1/files/0x0007000000015d07-40.dat	xmrig
behavioral1/files/0x0008000000016117-44.dat	xmrig
behavioral1/files/0x000600000001630b-54.dat	xmrig
behavioral1/files/0x00060000000164b2-59.dat	xmrig
behavioral1/files/0x0006000000016572-64.dat	xmrig
behavioral1/files/0x000600000001661c-69.dat	xmrig
behavioral1/files/0x0006000000016c6b-94.dat	xmrig
behavioral1/files/0x0006000000016d1e-120.dat	xmrig
behavioral1/files/0x0006000000016eb2-160.dat	xmrig
behavioral1/files/0x0006000000017052-162.dat	xmrig
behavioral1/memory/2860-779-0x000000013F1A0000-0x000000013F596000-memory.dmp	xmrig
behavioral1/memory/112-772-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig
behavioral1/memory/2860-3161-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/memory/2860-3448-0x000000013FCA0000-0x0000000140096000-memory.dmp	xmrig
behavioral1/memory/2860-3449-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig
behavioral1/memory/2908-754-0x000000013FCA0000-0x0000000140096000-memory.dmp	xmrig
behavioral1/memory/2444-739-0x000000013F5B0000-0x000000013F9A6000-memory.dmp	xmrig
behavioral1/memory/2400-683-0x000000013F690000-0x000000013FA86000-memory.dmp	xmrig
behavioral1/memory/2488-622-0x000000013F740000-0x000000013FB36000-memory.dmp	xmrig
behavioral1/memory/1652-608-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	xmrig
behavioral1/memory/2528-525-0x000000013F400000-0x000000013F7F6000-memory.dmp	xmrig
behavioral1/memory/2860-760-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig
behavioral1/memory/2384-719-0x000000013F5E0000-0x000000013F9D6000-memory.dmp	xmrig
behavioral1/memory/2428-716-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig
behavioral1/memory/2508-699-0x000000013FFF0000-0x00000001403E6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016e94-153.dat	xmrig
behavioral1/files/0x0006000000016d90-135.dat	xmrig
behavioral1/files/0x0006000000016dbf-148.dat	xmrig
behavioral1/files/0x0006000000016da7-140.dat	xmrig
behavioral1/files/0x0006000000016da7-138.dat	xmrig
behavioral1/memory/2564-132-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d3a-130.dat	xmrig
behavioral1/files/0x0006000000016d1e-110.dat	xmrig
behavioral1/files/0x0006000000016ce4-105.dat	xmrig
behavioral1/files/0x0006000000016d26-117.dat	xmrig
behavioral1/files/0x0006000000016d0d-107.dat	xmrig
behavioral1/files/0x0006000000016c6b-92.dat	xmrig
behavioral1/files/0x0006000000016cb7-99.dat	xmrig
behavioral1/files/0x0006000000016cb7-97.dat	xmrig
behavioral1/files/0x0006000000016c63-89.dat	xmrig
behavioral1/files/0x0006000000016c4a-84.dat	xmrig
behavioral1/files/0x0006000000016c4a-82.dat	xmrig
behavioral1/files/0x0006000000016a9a-79.dat	xmrig
behavioral1/files/0x0006000000016843-72.dat	xmrig
behavioral1/files/0x00060000000161e7-49.dat	xmrig
behavioral1/files/0x0007000000015d07-37.dat	xmrig
behavioral1/files/0x0008000000015ca6-20.dat	xmrig
behavioral1/memory/2528-4258-0x000000013F400000-0x000000013F7F6000-memory.dmp	xmrig
behavioral1/memory/2508-4268-0x000000013FFF0000-0x00000001403E6000-memory.dmp	xmrig
behavioral1/memory/2400-4270-0x000000013F690000-0x000000013FA86000-memory.dmp	xmrig
behavioral1/memory/2428-4274-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig
behavioral1/memory/2384-4273-0x000000013F5E0000-0x000000013F9D6000-memory.dmp	xmrig
behavioral1/memory/2908-4278-0x000000013FCA0000-0x0000000140096000-memory.dmp	xmrig
behavioral1/memory/112-4280-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1636	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2564	glQZrfz.exe
2512	XIjHKtn.exe
2528	sTCAjcJ.exe
1652	hsoerGZ.exe
2488	RFrlDwJ.exe
2400	eqiZCoc.exe
2508	aLTQNYp.exe
2428	kLiZOAT.exe
2384	UJFOQoK.exe
2444	FINhpsS.exe
2908	IEKyKCN.exe
112	hScdSal.exe
2472	KFiBamG.exe
2736	WeuUmnZ.exe
2780	LLVGyTi.exe
1936	CuHuVOM.exe
1488	WYInhHn.exe
1876	AajAxSO.exe
2264	MYMiNYg.exe
2620	rgwQuFL.exe
612	BImmILJ.exe
1240	pVchSrg.exe
2900	JBNJmGc.exe
2412	MIQcRCo.exe
2932	ErCBYMk.exe
2024	ihyKPFt.exe
1212	OvdXdda.exe
2352	qHDYuRy.exe
2100	EGymjUf.exe
2208	jusWjAl.exe
1404	LnsaQoZ.exe
1156	XyXPMfb.exe
3020	bMitauz.exe
2328	VqnBzsx.exe
2304	XmFDInZ.exe
2816	LgodYAT.exe
1676	iPcIJBY.exe
1496	CwQTZxs.exe
1580	EJilPuW.exe
1276	LIpBqmN.exe
2800	RSJvVDR.exe
1220	ouYPttl.exe
756	SvKXuBK.exe
1052	POuNarh.exe
3024	PYBYUxy.exe
1712	NVXqXsh.exe
2844	BOROkns.exe
2072	lXVFaoI.exe
2348	odIxyuC.exe
1992	ALBTveT.exe
976	yTSbOxE.exe
1520	xijCyCY.exe
884	FcumzYs.exe
2028	EGoFWCf.exe
2848	tCshYRK.exe
1512	Zhhuxot.exe
2284	FEFjHhx.exe
2588	ZyUAfvR.exe
2820	yRFykEd.exe
2672	VaBfqGf.exe
2396	xancLxg.exe
2540	oldrtsy.exe
2052	EDxrRMm.exe
2092	xfkivFn.exe

Loads dropped DLL 64 IoCs

pid	Process
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-2-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/files/0x000c00000001269e-6.dat	upx
behavioral1/files/0x003800000001566b-9.dat	upx
behavioral1/files/0x0007000000004e76-25.dat	upx
behavioral1/files/0x0008000000015ce1-30.dat	upx
behavioral1/files/0x0007000000015ceb-34.dat	upx
behavioral1/files/0x0007000000015d07-40.dat	upx
behavioral1/files/0x0008000000016117-44.dat	upx
behavioral1/files/0x000600000001630b-54.dat	upx
behavioral1/files/0x00060000000164b2-59.dat	upx
behavioral1/files/0x0006000000016572-64.dat	upx
behavioral1/files/0x000600000001661c-69.dat	upx
behavioral1/files/0x0006000000016c6b-94.dat	upx
behavioral1/files/0x0006000000016d1e-120.dat	upx
behavioral1/files/0x0006000000016eb2-160.dat	upx
behavioral1/files/0x0006000000017052-162.dat	upx
behavioral1/memory/112-772-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	upx
behavioral1/memory/2860-3161-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/memory/2908-754-0x000000013FCA0000-0x0000000140096000-memory.dmp	upx
behavioral1/memory/2444-739-0x000000013F5B0000-0x000000013F9A6000-memory.dmp	upx
behavioral1/memory/2400-683-0x000000013F690000-0x000000013FA86000-memory.dmp	upx
behavioral1/memory/2488-622-0x000000013F740000-0x000000013FB36000-memory.dmp	upx
behavioral1/memory/1652-608-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	upx
behavioral1/memory/2528-525-0x000000013F400000-0x000000013F7F6000-memory.dmp	upx
behavioral1/memory/2384-719-0x000000013F5E0000-0x000000013F9D6000-memory.dmp	upx
behavioral1/memory/2428-716-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx
behavioral1/memory/2508-699-0x000000013FFF0000-0x00000001403E6000-memory.dmp	upx
behavioral1/files/0x0006000000017052-170.dat	upx
behavioral1/files/0x0006000000016e94-168.dat	upx
behavioral1/files/0x0006000000016e94-153.dat	upx
behavioral1/files/0x0006000000016dbb-145.dat	upx
behavioral1/files/0x0006000000016d90-135.dat	upx
behavioral1/files/0x0006000000016dbf-148.dat	upx
behavioral1/memory/2512-143-0x000000013F1A0000-0x000000013F596000-memory.dmp	upx
behavioral1/files/0x0006000000016da7-140.dat	upx
behavioral1/files/0x0006000000016da7-138.dat	upx
behavioral1/memory/2564-132-0x000000013F1E0000-0x000000013F5D6000-memory.dmp	upx
behavioral1/files/0x0006000000016d3a-130.dat	upx
behavioral1/files/0x0006000000016d1e-110.dat	upx
behavioral1/files/0x0006000000016ce4-105.dat	upx
behavioral1/files/0x0006000000016d26-117.dat	upx
behavioral1/files/0x0006000000016d0d-107.dat	upx
behavioral1/files/0x0006000000016c6b-92.dat	upx
behavioral1/files/0x0006000000016cb7-99.dat	upx
behavioral1/files/0x0006000000016cb7-97.dat	upx
behavioral1/files/0x0006000000016c63-89.dat	upx
behavioral1/files/0x0006000000016c4a-84.dat	upx
behavioral1/files/0x0006000000016c4a-82.dat	upx
behavioral1/files/0x0006000000016a9a-79.dat	upx
behavioral1/files/0x0006000000016843-72.dat	upx
behavioral1/files/0x00060000000161e7-49.dat	upx
behavioral1/files/0x0007000000015d07-37.dat	upx
behavioral1/files/0x0008000000015ca6-20.dat	upx
behavioral1/memory/2528-4258-0x000000013F400000-0x000000013F7F6000-memory.dmp	upx
behavioral1/memory/2508-4268-0x000000013FFF0000-0x00000001403E6000-memory.dmp	upx
behavioral1/memory/2400-4270-0x000000013F690000-0x000000013FA86000-memory.dmp	upx
behavioral1/memory/2428-4274-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx
behavioral1/memory/2384-4273-0x000000013F5E0000-0x000000013F9D6000-memory.dmp	upx
behavioral1/memory/2908-4278-0x000000013FCA0000-0x0000000140096000-memory.dmp	upx
behavioral1/memory/112-4280-0x000000013F0F0000-0x000000013F4E6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bUjRbek.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\dfuWpSA.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\GISGoay.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\axJsYFP.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\dHRYEsN.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\zpMjbhP.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\BSRDEqF.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\dKtGZDn.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\wwoxnfr.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\vFoHxkY.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\ngxdokp.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\jWaICAJ.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\IvNkZUc.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\NdUrjYF.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\VBJiRLZ.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\DTcbZTF.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\ePqiYgI.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\dEKwtKk.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\QqVoJnW.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\OQcVydK.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\KRkBljF.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\WUisuBU.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\DouRoxl.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\mwpbftc.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\EIVjKlV.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\YtuxVXj.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\BvTsSOj.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\UDjkReS.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\sOsZYJf.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\aqlYBht.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\fcrGrlB.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\svIAIjf.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\XaFcGOQ.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\AEhILEW.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\FGBZOui.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\EarseDT.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\fWeQRiR.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\rGuOPFU.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\ibnMFrd.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\mVDLcMc.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\HuPokPN.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\qHDYuRy.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\wiaaNzb.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\FLNrHJu.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\xTXCMyp.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\KYeMMOK.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\dWaDBde.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\ErCBYMk.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\eVUUfKw.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\ZJmqjLg.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\XUkFXvw.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\jCjqsIe.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\EaAXLac.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\JvjIVvK.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\uRYapNa.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\YqLHhaC.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\nTagvqJ.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\PpHoSbV.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\AjmHQZk.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\kwCmRfT.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\dHkPbtQ.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\PMVVBrP.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\goLuhsj.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
File created	C:\Windows\System\skrATNf.exe	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1636	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
Token: SeLockMemoryPrivilege	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
Token: SeDebugPrivilege	1636	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1636	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	29
PID 2860 wrote to memory of 1636	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	29
PID 2860 wrote to memory of 1636	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	29
PID 2860 wrote to memory of 2564	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	30
PID 2860 wrote to memory of 2564	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	30
PID 2860 wrote to memory of 2564	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	30
PID 2860 wrote to memory of 2512	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	31
PID 2860 wrote to memory of 2512	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	31
PID 2860 wrote to memory of 2512	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	31
PID 2860 wrote to memory of 2528	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	32
PID 2860 wrote to memory of 2528	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	32
PID 2860 wrote to memory of 2528	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	32
PID 2860 wrote to memory of 1652	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	33
PID 2860 wrote to memory of 1652	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	33
PID 2860 wrote to memory of 1652	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	33
PID 2860 wrote to memory of 2488	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	34
PID 2860 wrote to memory of 2488	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	34
PID 2860 wrote to memory of 2488	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	34
PID 2860 wrote to memory of 2400	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	35
PID 2860 wrote to memory of 2400	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	35
PID 2860 wrote to memory of 2400	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	35
PID 2860 wrote to memory of 2508	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	36
PID 2860 wrote to memory of 2508	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	36
PID 2860 wrote to memory of 2508	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	36
PID 2860 wrote to memory of 2428	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	37
PID 2860 wrote to memory of 2428	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	37
PID 2860 wrote to memory of 2428	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	37
PID 2860 wrote to memory of 2384	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	38
PID 2860 wrote to memory of 2384	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	38
PID 2860 wrote to memory of 2384	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	38
PID 2860 wrote to memory of 2444	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	39
PID 2860 wrote to memory of 2444	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	39
PID 2860 wrote to memory of 2444	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	39
PID 2860 wrote to memory of 2908	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	40
PID 2860 wrote to memory of 2908	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	40
PID 2860 wrote to memory of 2908	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	40
PID 2860 wrote to memory of 112	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	41
PID 2860 wrote to memory of 112	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	41
PID 2860 wrote to memory of 112	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	41
PID 2860 wrote to memory of 2472	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	42
PID 2860 wrote to memory of 2472	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	42
PID 2860 wrote to memory of 2472	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	42
PID 2860 wrote to memory of 2736	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	43
PID 2860 wrote to memory of 2736	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	43
PID 2860 wrote to memory of 2736	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	43
PID 2860 wrote to memory of 2780	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	44
PID 2860 wrote to memory of 2780	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	44
PID 2860 wrote to memory of 2780	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	44
PID 2860 wrote to memory of 1936	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	45
PID 2860 wrote to memory of 1936	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	45
PID 2860 wrote to memory of 1936	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	45
PID 2860 wrote to memory of 1488	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	46
PID 2860 wrote to memory of 1488	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	46
PID 2860 wrote to memory of 1488	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	46
PID 2860 wrote to memory of 1876	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	47
PID 2860 wrote to memory of 1876	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	47
PID 2860 wrote to memory of 1876	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	47
PID 2860 wrote to memory of 2264	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	48
PID 2860 wrote to memory of 2264	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	48
PID 2860 wrote to memory of 2264	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	48
PID 2860 wrote to memory of 2620	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	49
PID 2860 wrote to memory of 2620	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	49
PID 2860 wrote to memory of 2620	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	49
PID 2860 wrote to memory of 612	2860	73923baafabb32f52d3dc1709665e3b0_NEIKI.exe	50

C:\Users\Admin\AppData\Local\Temp\73923baafabb32f52d3dc1709665e3b0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\73923baafabb32f52d3dc1709665e3b0_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\System\glQZrfz.exe
  C:\Windows\System\glQZrfz.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\XIjHKtn.exe
  C:\Windows\System\XIjHKtn.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\sTCAjcJ.exe
  C:\Windows\System\sTCAjcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\hsoerGZ.exe
  C:\Windows\System\hsoerGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\RFrlDwJ.exe
  C:\Windows\System\RFrlDwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\eqiZCoc.exe
  C:\Windows\System\eqiZCoc.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\aLTQNYp.exe
  C:\Windows\System\aLTQNYp.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\kLiZOAT.exe
  C:\Windows\System\kLiZOAT.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\UJFOQoK.exe
  C:\Windows\System\UJFOQoK.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\FINhpsS.exe
  C:\Windows\System\FINhpsS.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\IEKyKCN.exe
  C:\Windows\System\IEKyKCN.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\hScdSal.exe
  C:\Windows\System\hScdSal.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\KFiBamG.exe
  C:\Windows\System\KFiBamG.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\WeuUmnZ.exe
  C:\Windows\System\WeuUmnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\LLVGyTi.exe
  C:\Windows\System\LLVGyTi.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\CuHuVOM.exe
  C:\Windows\System\CuHuVOM.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\WYInhHn.exe
  C:\Windows\System\WYInhHn.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\AajAxSO.exe
  C:\Windows\System\AajAxSO.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\MYMiNYg.exe
  C:\Windows\System\MYMiNYg.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\rgwQuFL.exe
  C:\Windows\System\rgwQuFL.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\BImmILJ.exe
  C:\Windows\System\BImmILJ.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\JBNJmGc.exe
  C:\Windows\System\JBNJmGc.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\pVchSrg.exe
  C:\Windows\System\pVchSrg.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\MIQcRCo.exe
  C:\Windows\System\MIQcRCo.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ErCBYMk.exe
  C:\Windows\System\ErCBYMk.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\EGymjUf.exe
  C:\Windows\System\EGymjUf.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\ihyKPFt.exe
  C:\Windows\System\ihyKPFt.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\jusWjAl.exe
  C:\Windows\System\jusWjAl.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\OvdXdda.exe
  C:\Windows\System\OvdXdda.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\LnsaQoZ.exe
  C:\Windows\System\LnsaQoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\qHDYuRy.exe
  C:\Windows\System\qHDYuRy.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\XyXPMfb.exe
  C:\Windows\System\XyXPMfb.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\bMitauz.exe
  C:\Windows\System\bMitauz.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\VqnBzsx.exe
  C:\Windows\System\VqnBzsx.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\XmFDInZ.exe
  C:\Windows\System\XmFDInZ.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\LgodYAT.exe
  C:\Windows\System\LgodYAT.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\iPcIJBY.exe
  C:\Windows\System\iPcIJBY.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\CwQTZxs.exe
  C:\Windows\System\CwQTZxs.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\EJilPuW.exe
  C:\Windows\System\EJilPuW.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\LIpBqmN.exe
  C:\Windows\System\LIpBqmN.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\RSJvVDR.exe
  C:\Windows\System\RSJvVDR.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ouYPttl.exe
  C:\Windows\System\ouYPttl.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\SvKXuBK.exe
  C:\Windows\System\SvKXuBK.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\POuNarh.exe
  C:\Windows\System\POuNarh.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\PYBYUxy.exe
  C:\Windows\System\PYBYUxy.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\NVXqXsh.exe
  C:\Windows\System\NVXqXsh.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\BOROkns.exe
  C:\Windows\System\BOROkns.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\lXVFaoI.exe
  C:\Windows\System\lXVFaoI.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\odIxyuC.exe
  C:\Windows\System\odIxyuC.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ALBTveT.exe
  C:\Windows\System\ALBTveT.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\yTSbOxE.exe
  C:\Windows\System\yTSbOxE.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\xijCyCY.exe
  C:\Windows\System\xijCyCY.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\FcumzYs.exe
  C:\Windows\System\FcumzYs.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\EGoFWCf.exe
  C:\Windows\System\EGoFWCf.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\tCshYRK.exe
  C:\Windows\System\tCshYRK.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\Zhhuxot.exe
  C:\Windows\System\Zhhuxot.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\FEFjHhx.exe
  C:\Windows\System\FEFjHhx.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\ZyUAfvR.exe
  C:\Windows\System\ZyUAfvR.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\yRFykEd.exe
  C:\Windows\System\yRFykEd.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\VaBfqGf.exe
  C:\Windows\System\VaBfqGf.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\xancLxg.exe
  C:\Windows\System\xancLxg.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\oldrtsy.exe
  C:\Windows\System\oldrtsy.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\EDxrRMm.exe
  C:\Windows\System\EDxrRMm.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\xfkivFn.exe
  C:\Windows\System\xfkivFn.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\hgcuCwd.exe
  C:\Windows\System\hgcuCwd.exe
  2⤵
  PID:272
- C:\Windows\System\nLgidyV.exe
  C:\Windows\System\nLgidyV.exe
  2⤵
  PID:2784
- C:\Windows\System\GEluJVY.exe
  C:\Windows\System\GEluJVY.exe
  2⤵
  PID:2772
- C:\Windows\System\hIGYGZK.exe
  C:\Windows\System\hIGYGZK.exe
  2⤵
  PID:1444
- C:\Windows\System\jngufjg.exe
  C:\Windows\System\jngufjg.exe
  2⤵
  PID:2128
- C:\Windows\System\soamAct.exe
  C:\Windows\System\soamAct.exe
  2⤵
  PID:1720
- C:\Windows\System\kMdyBzs.exe
  C:\Windows\System\kMdyBzs.exe
  2⤵
  PID:592
- C:\Windows\System\wrjnZvo.exe
  C:\Windows\System\wrjnZvo.exe
  2⤵
  PID:632
- C:\Windows\System\GQbuXnv.exe
  C:\Windows\System\GQbuXnv.exe
  2⤵
  PID:2032
- C:\Windows\System\lxhuWgW.exe
  C:\Windows\System\lxhuWgW.exe
  2⤵
  PID:1988
- C:\Windows\System\cHfCSZU.exe
  C:\Windows\System\cHfCSZU.exe
  2⤵
  PID:1788
- C:\Windows\System\bqBNWaZ.exe
  C:\Windows\System\bqBNWaZ.exe
  2⤵
  PID:2948
- C:\Windows\System\UPOWTeQ.exe
  C:\Windows\System\UPOWTeQ.exe
  2⤵
  PID:1264
- C:\Windows\System\AjjmiYU.exe
  C:\Windows\System\AjjmiYU.exe
  2⤵
  PID:2000
- C:\Windows\System\FkrFfxB.exe
  C:\Windows\System\FkrFfxB.exe
  2⤵
  PID:448
- C:\Windows\System\NipwZxb.exe
  C:\Windows\System\NipwZxb.exe
  2⤵
  PID:2640
- C:\Windows\System\glmveBc.exe
  C:\Windows\System\glmveBc.exe
  2⤵
  PID:832
- C:\Windows\System\OluEWaH.exe
  C:\Windows\System\OluEWaH.exe
  2⤵
  PID:2200
- C:\Windows\System\psfeaaU.exe
  C:\Windows\System\psfeaaU.exe
  2⤵
  PID:1016
- C:\Windows\System\mwVjIeg.exe
  C:\Windows\System\mwVjIeg.exe
  2⤵
  PID:2064
- C:\Windows\System\zNYfcUC.exe
  C:\Windows\System\zNYfcUC.exe
  2⤵
  PID:1436
- C:\Windows\System\otKwRfY.exe
  C:\Windows\System\otKwRfY.exe
  2⤵
  PID:2108
- C:\Windows\System\hpNGsQi.exe
  C:\Windows\System\hpNGsQi.exe
  2⤵
  PID:1640
- C:\Windows\System\ZFXfJAk.exe
  C:\Windows\System\ZFXfJAk.exe
  2⤵
  PID:1860
- C:\Windows\System\EJzgttg.exe
  C:\Windows\System\EJzgttg.exe
  2⤵
  PID:2996
- C:\Windows\System\motBGwg.exe
  C:\Windows\System\motBGwg.exe
  2⤵
  PID:1740
- C:\Windows\System\YtbTCNk.exe
  C:\Windows\System\YtbTCNk.exe
  2⤵
  PID:1672
- C:\Windows\System\jZUeZeh.exe
  C:\Windows\System\jZUeZeh.exe
  2⤵
  PID:1508
- C:\Windows\System\yazuctG.exe
  C:\Windows\System\yazuctG.exe
  2⤵
  PID:2464
- C:\Windows\System\bjjkRvL.exe
  C:\Windows\System\bjjkRvL.exe
  2⤵
  PID:2668
- C:\Windows\System\shfigUT.exe
  C:\Windows\System\shfigUT.exe
  2⤵
  PID:2408
- C:\Windows\System\GiCQtJw.exe
  C:\Windows\System\GiCQtJw.exe
  2⤵
  PID:2368
- C:\Windows\System\vMvYHuR.exe
  C:\Windows\System\vMvYHuR.exe
  2⤵
  PID:2916
- C:\Windows\System\CzLAUxX.exe
  C:\Windows\System\CzLAUxX.exe
  2⤵
  PID:2748
- C:\Windows\System\teiEORF.exe
  C:\Windows\System\teiEORF.exe
  2⤵
  PID:2752
- C:\Windows\System\OKktYBb.exe
  C:\Windows\System\OKktYBb.exe
  2⤵
  PID:2120
- C:\Windows\System\PupjwNl.exe
  C:\Windows\System\PupjwNl.exe
  2⤵
  PID:1244
- C:\Windows\System\PgFhKEw.exe
  C:\Windows\System\PgFhKEw.exe
  2⤵
  PID:2012
- C:\Windows\System\bTssZmB.exe
  C:\Windows\System\bTssZmB.exe
  2⤵
  PID:2688
- C:\Windows\System\LQsPuhm.exe
  C:\Windows\System\LQsPuhm.exe
  2⤵
  PID:576
- C:\Windows\System\cNXrefL.exe
  C:\Windows\System\cNXrefL.exe
  2⤵
  PID:984
- C:\Windows\System\GYwyZPP.exe
  C:\Windows\System\GYwyZPP.exe
  2⤵
  PID:568
- C:\Windows\System\QvdMCXS.exe
  C:\Windows\System\QvdMCXS.exe
  2⤵
  PID:672
- C:\Windows\System\zWHakIa.exe
  C:\Windows\System\zWHakIa.exe
  2⤵
  PID:1796
- C:\Windows\System\xisxzec.exe
  C:\Windows\System\xisxzec.exe
  2⤵
  PID:320
- C:\Windows\System\IjcFdyJ.exe
  C:\Windows\System\IjcFdyJ.exe
  2⤵
  PID:1592
- C:\Windows\System\GkkUkNt.exe
  C:\Windows\System\GkkUkNt.exe
  2⤵
  PID:2840
- C:\Windows\System\mMPwpug.exe
  C:\Windows\System\mMPwpug.exe
  2⤵
  PID:3056
- C:\Windows\System\BrnzjSu.exe
  C:\Windows\System\BrnzjSu.exe
  2⤵
  PID:2828
- C:\Windows\System\aNnfRmM.exe
  C:\Windows\System\aNnfRmM.exe
  2⤵
  PID:2692
- C:\Windows\System\PyjbAPM.exe
  C:\Windows\System\PyjbAPM.exe
  2⤵
  PID:2068
- C:\Windows\System\jcLfFDI.exe
  C:\Windows\System\jcLfFDI.exe
  2⤵
  PID:1628
- C:\Windows\System\uLdhuzm.exe
  C:\Windows\System\uLdhuzm.exe
  2⤵
  PID:1516
- C:\Windows\System\iQUeVFG.exe
  C:\Windows\System\iQUeVFG.exe
  2⤵
  PID:2288
- C:\Windows\System\WzUnEON.exe
  C:\Windows\System\WzUnEON.exe
  2⤵
  PID:2484
- C:\Windows\System\GpCMrip.exe
  C:\Windows\System\GpCMrip.exe
  2⤵
  PID:2416
- C:\Windows\System\FWNGWHu.exe
  C:\Windows\System\FWNGWHu.exe
  2⤵
  PID:2440
- C:\Windows\System\hxTlCWT.exe
  C:\Windows\System\hxTlCWT.exe
  2⤵
  PID:1456
- C:\Windows\System\SiLBuGB.exe
  C:\Windows\System\SiLBuGB.exe
  2⤵
  PID:2292
- C:\Windows\System\GRAUuBc.exe
  C:\Windows\System\GRAUuBc.exe
  2⤵
  PID:2944
- C:\Windows\System\YMUOIAt.exe
  C:\Windows\System\YMUOIAt.exe
  2⤵
  PID:304
- C:\Windows\System\lShhdAJ.exe
  C:\Windows\System\lShhdAJ.exe
  2⤵
  PID:1764
- C:\Windows\System\hcCjrrp.exe
  C:\Windows\System\hcCjrrp.exe
  2⤵
  PID:1028
- C:\Windows\System\arghfFJ.exe
  C:\Windows\System\arghfFJ.exe
  2⤵
  PID:2228
- C:\Windows\System\IyIojry.exe
  C:\Windows\System\IyIojry.exe
  2⤵
  PID:1084
- C:\Windows\System\MwnxAPP.exe
  C:\Windows\System\MwnxAPP.exe
  2⤵
  PID:1752
- C:\Windows\System\tkUPEub.exe
  C:\Windows\System\tkUPEub.exe
  2⤵
  PID:752
- C:\Windows\System\vgnklSN.exe
  C:\Windows\System\vgnklSN.exe
  2⤵
  PID:1412
- C:\Windows\System\GbDbRpb.exe
  C:\Windows\System\GbDbRpb.exe
  2⤵
  PID:564
- C:\Windows\System\ZmRrFKZ.exe
  C:\Windows\System\ZmRrFKZ.exe
  2⤵
  PID:1748
- C:\Windows\System\hCOCczT.exe
  C:\Windows\System\hCOCczT.exe
  2⤵
  PID:2808
- C:\Windows\System\peBUKOU.exe
  C:\Windows\System\peBUKOU.exe
  2⤵
  PID:2296
- C:\Windows\System\KYcvPsF.exe
  C:\Windows\System\KYcvPsF.exe
  2⤵
  PID:2704
- C:\Windows\System\NPereNH.exe
  C:\Windows\System\NPereNH.exe
  2⤵
  PID:540
- C:\Windows\System\vkjkBBK.exe
  C:\Windows\System\vkjkBBK.exe
  2⤵
  PID:1256
- C:\Windows\System\supbyxH.exe
  C:\Windows\System\supbyxH.exe
  2⤵
  PID:1964
- C:\Windows\System\XojLvvV.exe
  C:\Windows\System\XojLvvV.exe
  2⤵
  PID:2468
- C:\Windows\System\FJLKqjA.exe
  C:\Windows\System\FJLKqjA.exe
  2⤵
  PID:2792
- C:\Windows\System\ZYgVMyo.exe
  C:\Windows\System\ZYgVMyo.exe
  2⤵
  PID:1380
- C:\Windows\System\AkEJURp.exe
  C:\Windows\System\AkEJURp.exe
  2⤵
  PID:2676
- C:\Windows\System\kNrPzRz.exe
  C:\Windows\System\kNrPzRz.exe
  2⤵
  PID:1692
- C:\Windows\System\UbMLafU.exe
  C:\Windows\System\UbMLafU.exe
  2⤵
  PID:2424
- C:\Windows\System\vOfmFsQ.exe
  C:\Windows\System\vOfmFsQ.exe
  2⤵
  PID:1908
- C:\Windows\System\XMXrLZv.exe
  C:\Windows\System\XMXrLZv.exe
  2⤵
  PID:1528
- C:\Windows\System\qlIbrsC.exe
  C:\Windows\System\qlIbrsC.exe
  2⤵
  PID:1172
- C:\Windows\System\RFcnMRC.exe
  C:\Windows\System\RFcnMRC.exe
  2⤵
  PID:1208
- C:\Windows\System\gqiJOGN.exe
  C:\Windows\System\gqiJOGN.exe
  2⤵
  PID:792
- C:\Windows\System\rcDJBir.exe
  C:\Windows\System\rcDJBir.exe
  2⤵
  PID:3088
- C:\Windows\System\ODPkPoh.exe
  C:\Windows\System\ODPkPoh.exe
  2⤵
  PID:3104
- C:\Windows\System\sYCzZQo.exe
  C:\Windows\System\sYCzZQo.exe
  2⤵
  PID:3120
- C:\Windows\System\OshbIxW.exe
  C:\Windows\System\OshbIxW.exe
  2⤵
  PID:3136
- C:\Windows\System\awDfICa.exe
  C:\Windows\System\awDfICa.exe
  2⤵
  PID:3152
- C:\Windows\System\ZvfAykb.exe
  C:\Windows\System\ZvfAykb.exe
  2⤵
  PID:3168
- C:\Windows\System\JgaiETz.exe
  C:\Windows\System\JgaiETz.exe
  2⤵
  PID:3184
- C:\Windows\System\RrOJvdx.exe
  C:\Windows\System\RrOJvdx.exe
  2⤵
  PID:3200
- C:\Windows\System\xnXNUfI.exe
  C:\Windows\System\xnXNUfI.exe
  2⤵
  PID:3216
- C:\Windows\System\KpRxLIw.exe
  C:\Windows\System\KpRxLIw.exe
  2⤵
  PID:3232
- C:\Windows\System\bnJCECp.exe
  C:\Windows\System\bnJCECp.exe
  2⤵
  PID:3248
- C:\Windows\System\ZFoFnav.exe
  C:\Windows\System\ZFoFnav.exe
  2⤵
  PID:3264
- C:\Windows\System\UQzvDtQ.exe
  C:\Windows\System\UQzvDtQ.exe
  2⤵
  PID:3280
- C:\Windows\System\oPtVpSt.exe
  C:\Windows\System\oPtVpSt.exe
  2⤵
  PID:3296
- C:\Windows\System\LoLFZZL.exe
  C:\Windows\System\LoLFZZL.exe
  2⤵
  PID:3312
- C:\Windows\System\iBdgTUC.exe
  C:\Windows\System\iBdgTUC.exe
  2⤵
  PID:3328
- C:\Windows\System\Extgpom.exe
  C:\Windows\System\Extgpom.exe
  2⤵
  PID:3344
- C:\Windows\System\yIAQEGe.exe
  C:\Windows\System\yIAQEGe.exe
  2⤵
  PID:3360
- C:\Windows\System\xYuQwZF.exe
  C:\Windows\System\xYuQwZF.exe
  2⤵
  PID:3376
- C:\Windows\System\axJsYFP.exe
  C:\Windows\System\axJsYFP.exe
  2⤵
  PID:3400
- C:\Windows\System\BOYwXYV.exe
  C:\Windows\System\BOYwXYV.exe
  2⤵
  PID:3424
- C:\Windows\System\AFQFEyp.exe
  C:\Windows\System\AFQFEyp.exe
  2⤵
  PID:3452
- C:\Windows\System\exYhcOe.exe
  C:\Windows\System\exYhcOe.exe
  2⤵
  PID:3480
- C:\Windows\System\tnPvGhj.exe
  C:\Windows\System\tnPvGhj.exe
  2⤵
  PID:3504
- C:\Windows\System\DjgDDng.exe
  C:\Windows\System\DjgDDng.exe
  2⤵
  PID:3536
- C:\Windows\System\EmayZpj.exe
  C:\Windows\System\EmayZpj.exe
  2⤵
  PID:3556
- C:\Windows\System\sacpePg.exe
  C:\Windows\System\sacpePg.exe
  2⤵
  PID:3584
- C:\Windows\System\qLWGtWr.exe
  C:\Windows\System\qLWGtWr.exe
  2⤵
  PID:3636
- C:\Windows\System\wXuZERW.exe
  C:\Windows\System\wXuZERW.exe
  2⤵
  PID:3652
- C:\Windows\System\bPyusNV.exe
  C:\Windows\System\bPyusNV.exe
  2⤵
  PID:3668
- C:\Windows\System\aiXYkze.exe
  C:\Windows\System\aiXYkze.exe
  2⤵
  PID:3684
- C:\Windows\System\KDVmgyR.exe
  C:\Windows\System\KDVmgyR.exe
  2⤵
  PID:3700
- C:\Windows\System\AXuyndA.exe
  C:\Windows\System\AXuyndA.exe
  2⤵
  PID:3716
- C:\Windows\System\dQJXGbB.exe
  C:\Windows\System\dQJXGbB.exe
  2⤵
  PID:3732
- C:\Windows\System\CuIxDgd.exe
  C:\Windows\System\CuIxDgd.exe
  2⤵
  PID:3748
- C:\Windows\System\uSWqLgC.exe
  C:\Windows\System\uSWqLgC.exe
  2⤵
  PID:3764
- C:\Windows\System\blgdqWy.exe
  C:\Windows\System\blgdqWy.exe
  2⤵
  PID:3780
- C:\Windows\System\pECXfgx.exe
  C:\Windows\System\pECXfgx.exe
  2⤵
  PID:3796
- C:\Windows\System\AOsYidV.exe
  C:\Windows\System\AOsYidV.exe
  2⤵
  PID:3812
- C:\Windows\System\xQvoufr.exe
  C:\Windows\System\xQvoufr.exe
  2⤵
  PID:3828
- C:\Windows\System\smeYxxf.exe
  C:\Windows\System\smeYxxf.exe
  2⤵
  PID:3844
- C:\Windows\System\monfIFP.exe
  C:\Windows\System\monfIFP.exe
  2⤵
  PID:3860
- C:\Windows\System\yHEaYwB.exe
  C:\Windows\System\yHEaYwB.exe
  2⤵
  PID:3876
- C:\Windows\System\IdeLzzq.exe
  C:\Windows\System\IdeLzzq.exe
  2⤵
  PID:3972
- C:\Windows\System\IQEAOlZ.exe
  C:\Windows\System\IQEAOlZ.exe
  2⤵
  PID:3988
- C:\Windows\System\BtLuFcV.exe
  C:\Windows\System\BtLuFcV.exe
  2⤵
  PID:4004
- C:\Windows\System\MkRBkWm.exe
  C:\Windows\System\MkRBkWm.exe
  2⤵
  PID:4020
- C:\Windows\System\BfgiFGJ.exe
  C:\Windows\System\BfgiFGJ.exe
  2⤵
  PID:4036
- C:\Windows\System\imIBKeE.exe
  C:\Windows\System\imIBKeE.exe
  2⤵
  PID:4052
- C:\Windows\System\CzRZXcp.exe
  C:\Windows\System\CzRZXcp.exe
  2⤵
  PID:4068
- C:\Windows\System\ecoOcla.exe
  C:\Windows\System\ecoOcla.exe
  2⤵
  PID:4084
- C:\Windows\System\QUsCytZ.exe
  C:\Windows\System\QUsCytZ.exe
  2⤵
  PID:2148
- C:\Windows\System\MrGunZn.exe
  C:\Windows\System\MrGunZn.exe
  2⤵
  PID:3080
- C:\Windows\System\eiuPinG.exe
  C:\Windows\System\eiuPinG.exe
  2⤵
  PID:3100
- C:\Windows\System\oHyiWIi.exe
  C:\Windows\System\oHyiWIi.exe
  2⤵
  PID:3132
- C:\Windows\System\vgdPWJu.exe
  C:\Windows\System\vgdPWJu.exe
  2⤵
  PID:1604
- C:\Windows\System\jEVJJNz.exe
  C:\Windows\System\jEVJJNz.exe
  2⤵
  PID:3192
- C:\Windows\System\LhswBLj.exe
  C:\Windows\System\LhswBLj.exe
  2⤵
  PID:3224
- C:\Windows\System\fKzhxzI.exe
  C:\Windows\System\fKzhxzI.exe
  2⤵
  PID:3336
- C:\Windows\System\mSVdTnP.exe
  C:\Windows\System\mSVdTnP.exe
  2⤵
  PID:3276
- C:\Windows\System\CEcPOPI.exe
  C:\Windows\System\CEcPOPI.exe
  2⤵
  PID:3412
- C:\Windows\System\uGqywNe.exe
  C:\Windows\System\uGqywNe.exe
  2⤵
  PID:3472
- C:\Windows\System\dVBUvGS.exe
  C:\Windows\System\dVBUvGS.exe
  2⤵
  PID:3532
- C:\Windows\System\pLCBgma.exe
  C:\Windows\System\pLCBgma.exe
  2⤵
  PID:3580
- C:\Windows\System\lFpeSRC.exe
  C:\Windows\System\lFpeSRC.exe
  2⤵
  PID:3744
- C:\Windows\System\uNfSVZJ.exe
  C:\Windows\System\uNfSVZJ.exe
  2⤵
  PID:3808
- C:\Windows\System\bnEZKBH.exe
  C:\Windows\System\bnEZKBH.exe
  2⤵
  PID:3872
- C:\Windows\System\kFefIts.exe
  C:\Windows\System\kFefIts.exe
  2⤵
  PID:3984
- C:\Windows\System\kAmFbkd.exe
  C:\Windows\System\kAmFbkd.exe
  2⤵
  PID:4048
- C:\Windows\System\SOwEyzn.exe
  C:\Windows\System\SOwEyzn.exe
  2⤵
  PID:3116
- C:\Windows\System\uNlWbac.exe
  C:\Windows\System\uNlWbac.exe
  2⤵
  PID:2920
- C:\Windows\System\saZRVZh.exe
  C:\Windows\System\saZRVZh.exe
  2⤵
  PID:3516
- C:\Windows\System\ZbZVaBr.exe
  C:\Windows\System\ZbZVaBr.exe
  2⤵
  PID:3256
- C:\Windows\System\HtqfVdM.exe
  C:\Windows\System\HtqfVdM.exe
  2⤵
  PID:3712
- C:\Windows\System\JNsrOYu.exe
  C:\Windows\System\JNsrOYu.exe
  2⤵
  PID:4116
- C:\Windows\System\taBEvjC.exe
  C:\Windows\System\taBEvjC.exe
  2⤵
  PID:4132
- C:\Windows\System\ICymMwP.exe
  C:\Windows\System\ICymMwP.exe
  2⤵
  PID:4148
- C:\Windows\System\iiGuRzm.exe
  C:\Windows\System\iiGuRzm.exe
  2⤵
  PID:4164
- C:\Windows\System\BkXerMH.exe
  C:\Windows\System\BkXerMH.exe
  2⤵
  PID:4184
- C:\Windows\System\zqqlqgE.exe
  C:\Windows\System\zqqlqgE.exe
  2⤵
  PID:4200
- C:\Windows\System\lZLEenW.exe
  C:\Windows\System\lZLEenW.exe
  2⤵
  PID:4260
- C:\Windows\System\GjcfPaW.exe
  C:\Windows\System\GjcfPaW.exe
  2⤵
  PID:4276
- C:\Windows\System\QmhVCIn.exe
  C:\Windows\System\QmhVCIn.exe
  2⤵
  PID:4296
- C:\Windows\System\tljzVDH.exe
  C:\Windows\System\tljzVDH.exe
  2⤵
  PID:4312
- C:\Windows\System\eDgAuBu.exe
  C:\Windows\System\eDgAuBu.exe
  2⤵
  PID:4332
- C:\Windows\System\cnCJIzm.exe
  C:\Windows\System\cnCJIzm.exe
  2⤵
  PID:4348
- C:\Windows\System\GHPdfIR.exe
  C:\Windows\System\GHPdfIR.exe
  2⤵
  PID:4364
- C:\Windows\System\PVCLAjQ.exe
  C:\Windows\System\PVCLAjQ.exe
  2⤵
  PID:4384
- C:\Windows\System\ZlecgZQ.exe
  C:\Windows\System\ZlecgZQ.exe
  2⤵
  PID:4400
- C:\Windows\System\ewVWcnu.exe
  C:\Windows\System\ewVWcnu.exe
  2⤵
  PID:4416
- C:\Windows\System\Xcufmjk.exe
  C:\Windows\System\Xcufmjk.exe
  2⤵
  PID:4436
- C:\Windows\System\xDjhUIX.exe
  C:\Windows\System\xDjhUIX.exe
  2⤵
  PID:4456
- C:\Windows\System\jhkpfeB.exe
  C:\Windows\System\jhkpfeB.exe
  2⤵
  PID:4472
- C:\Windows\System\tuVbhID.exe
  C:\Windows\System\tuVbhID.exe
  2⤵
  PID:4492
- C:\Windows\System\RgNnkHZ.exe
  C:\Windows\System\RgNnkHZ.exe
  2⤵
  PID:4508
- C:\Windows\System\xYFLNYq.exe
  C:\Windows\System\xYFLNYq.exe
  2⤵
  PID:4524
- C:\Windows\System\ezGzuPv.exe
  C:\Windows\System\ezGzuPv.exe
  2⤵
  PID:4544
- C:\Windows\System\jmsRPxZ.exe
  C:\Windows\System\jmsRPxZ.exe
  2⤵
  PID:4572
- C:\Windows\System\TuHIPrz.exe
  C:\Windows\System\TuHIPrz.exe
  2⤵
  PID:4588
- C:\Windows\System\PAIvCWe.exe
  C:\Windows\System\PAIvCWe.exe
  2⤵
  PID:4608
- C:\Windows\System\NgTAAyW.exe
  C:\Windows\System\NgTAAyW.exe
  2⤵
  PID:4624
- C:\Windows\System\JGqrYbM.exe
  C:\Windows\System\JGqrYbM.exe
  2⤵
  PID:4640
- C:\Windows\System\SDKUzhI.exe
  C:\Windows\System\SDKUzhI.exe
  2⤵
  PID:4656
- C:\Windows\System\gFoetOp.exe
  C:\Windows\System\gFoetOp.exe
  2⤵
  PID:4676
- C:\Windows\System\GjJJGxs.exe
  C:\Windows\System\GjJJGxs.exe
  2⤵
  PID:4692
- C:\Windows\System\vjKrFFX.exe
  C:\Windows\System\vjKrFFX.exe
  2⤵
  PID:4708
- C:\Windows\System\EQavYei.exe
  C:\Windows\System\EQavYei.exe
  2⤵
  PID:4724
- C:\Windows\System\pFhSotM.exe
  C:\Windows\System\pFhSotM.exe
  2⤵
  PID:4752
- C:\Windows\System\khRiyqr.exe
  C:\Windows\System\khRiyqr.exe
  2⤵
  PID:4768
- C:\Windows\System\JhFosLH.exe
  C:\Windows\System\JhFosLH.exe
  2⤵
  PID:4784
- C:\Windows\System\iufBjtJ.exe
  C:\Windows\System\iufBjtJ.exe
  2⤵
  PID:4804
- C:\Windows\System\vhFoiwA.exe
  C:\Windows\System\vhFoiwA.exe
  2⤵
  PID:4840
- C:\Windows\System\rxKAJdY.exe
  C:\Windows\System\rxKAJdY.exe
  2⤵
  PID:4896
- C:\Windows\System\nCFIcym.exe
  C:\Windows\System\nCFIcym.exe
  2⤵
  PID:4992
- C:\Windows\System\LEYhJme.exe
  C:\Windows\System\LEYhJme.exe
  2⤵
  PID:5064
- C:\Windows\System\VxCDHOu.exe
  C:\Windows\System\VxCDHOu.exe
  2⤵
  PID:5088
- C:\Windows\System\GvlKBgU.exe
  C:\Windows\System\GvlKBgU.exe
  2⤵
  PID:5104
- C:\Windows\System\WzvKLsX.exe
  C:\Windows\System\WzvKLsX.exe
  2⤵
  PID:3868
- C:\Windows\System\mRGTcoi.exe
  C:\Windows\System\mRGTcoi.exe
  2⤵
  PID:3180
- C:\Windows\System\BpeWoKd.exe
  C:\Windows\System\BpeWoKd.exe
  2⤵
  PID:4104
- C:\Windows\System\UWYktdA.exe
  C:\Windows\System\UWYktdA.exe
  2⤵
  PID:4212
- C:\Windows\System\kKljAzh.exe
  C:\Windows\System\kKljAzh.exe
  2⤵
  PID:4244
- C:\Windows\System\ysUPWLU.exe
  C:\Windows\System\ysUPWLU.exe
  2⤵
  PID:4284
- C:\Windows\System\uBYLoVS.exe
  C:\Windows\System\uBYLoVS.exe
  2⤵
  PID:4324
- C:\Windows\System\ZxQhKDq.exe
  C:\Windows\System\ZxQhKDq.exe
  2⤵
  PID:4424
- C:\Windows\System\iGNAYKq.exe
  C:\Windows\System\iGNAYKq.exe
  2⤵
  PID:4580
- C:\Windows\System\fKNFQdv.exe
  C:\Windows\System\fKNFQdv.exe
  2⤵
  PID:4536
- C:\Windows\System\RAOakdh.exe
  C:\Windows\System\RAOakdh.exe
  2⤵
  PID:4652
- C:\Windows\System\IolvjzJ.exe
  C:\Windows\System\IolvjzJ.exe
  2⤵
  PID:4760
- C:\Windows\System\irWIEgN.exe
  C:\Windows\System\irWIEgN.exe
  2⤵
  PID:4796
- C:\Windows\System\LDreliL.exe
  C:\Windows\System\LDreliL.exe
  2⤵
  PID:4856
- C:\Windows\System\bnAlPKq.exe
  C:\Windows\System\bnAlPKq.exe
  2⤵
  PID:4880
- C:\Windows\System\TTZtCgO.exe
  C:\Windows\System\TTZtCgO.exe
  2⤵
  PID:5000
- C:\Windows\System\rYPsVbi.exe
  C:\Windows\System\rYPsVbi.exe
  2⤵
  PID:3444
- C:\Windows\System\BabOWPb.exe
  C:\Windows\System\BabOWPb.exe
  2⤵
  PID:3552
- C:\Windows\System\SwIOFaj.exe
  C:\Windows\System\SwIOFaj.exe
  2⤵
  PID:3612
- C:\Windows\System\iZqMCra.exe
  C:\Windows\System\iZqMCra.exe
  2⤵
  PID:3632
- C:\Windows\System\bmGluAT.exe
  C:\Windows\System\bmGluAT.exe
  2⤵
  PID:3956
- C:\Windows\System\nFlPCxX.exe
  C:\Windows\System\nFlPCxX.exe
  2⤵
  PID:4028
- C:\Windows\System\FQnPtNk.exe
  C:\Windows\System\FQnPtNk.exe
  2⤵
  PID:4092
- C:\Windows\System\HsQGBgc.exe
  C:\Windows\System\HsQGBgc.exe
  2⤵
  PID:3148
- C:\Windows\System\gzVWPkJ.exe
  C:\Windows\System\gzVWPkJ.exe
  2⤵
  PID:3512
- C:\Windows\System\edIonFs.exe
  C:\Windows\System\edIonFs.exe
  2⤵
  PID:3564
- C:\Windows\System\aInrFCw.exe
  C:\Windows\System\aInrFCw.exe
  2⤵
  PID:3468
- C:\Windows\System\HXMbuDl.exe
  C:\Windows\System\HXMbuDl.exe
  2⤵
  PID:3176
- C:\Windows\System\JbIzSxp.exe
  C:\Windows\System\JbIzSxp.exe
  2⤵
  PID:4160
- C:\Windows\System\cWWyyng.exe
  C:\Windows\System\cWWyyng.exe
  2⤵
  PID:4380
- C:\Windows\System\sTulQJr.exe
  C:\Windows\System\sTulQJr.exe
  2⤵
  PID:4448
- C:\Windows\System\eQbgKhg.exe
  C:\Windows\System\eQbgKhg.exe
  2⤵
  PID:4520
- C:\Windows\System\ATdPnbS.exe
  C:\Windows\System\ATdPnbS.exe
  2⤵
  PID:4908
- C:\Windows\System\udWTaEV.exe
  C:\Windows\System\udWTaEV.exe
  2⤵
  PID:4936
- C:\Windows\System\golYbLe.exe
  C:\Windows\System\golYbLe.exe
  2⤵
  PID:4968
- C:\Windows\System\kMZNPUr.exe
  C:\Windows\System\kMZNPUr.exe
  2⤵
  PID:4944
- C:\Windows\System\fbAbfKT.exe
  C:\Windows\System\fbAbfKT.exe
  2⤵
  PID:4980
- C:\Windows\System\vxVYssI.exe
  C:\Windows\System\vxVYssI.exe
  2⤵
  PID:5048
- C:\Windows\System\lkdeiXS.exe
  C:\Windows\System\lkdeiXS.exe
  2⤵
  PID:3820
- C:\Windows\System\dfLRMdy.exe
  C:\Windows\System\dfLRMdy.exe
  2⤵
  PID:3760
- C:\Windows\System\IHBrELh.exe
  C:\Windows\System\IHBrELh.exe
  2⤵
  PID:3696
- C:\Windows\System\DugvZkp.exe
  C:\Windows\System\DugvZkp.exe
  2⤵
  PID:3616
- C:\Windows\System\CtcETDi.exe
  C:\Windows\System\CtcETDi.exe
  2⤵
  PID:3492
- C:\Windows\System\VhhrQBF.exe
  C:\Windows\System\VhhrQBF.exe
  2⤵
  PID:3392
- C:\Windows\System\HZrYsJr.exe
  C:\Windows\System\HZrYsJr.exe
  2⤵
  PID:3324
- C:\Windows\System\JQYKuiQ.exe
  C:\Windows\System\JQYKuiQ.exe
  2⤵
  PID:4144
- C:\Windows\System\xAiEZkS.exe
  C:\Windows\System\xAiEZkS.exe
  2⤵
  PID:4076
- C:\Windows\System\yQBEiHg.exe
  C:\Windows\System\yQBEiHg.exe
  2⤵
  PID:4208
- C:\Windows\System\LGMPFbg.exe
  C:\Windows\System\LGMPFbg.exe
  2⤵
  PID:4392
- C:\Windows\System\DJAFFjP.exe
  C:\Windows\System\DJAFFjP.exe
  2⤵
  PID:4688
- C:\Windows\System\ZxsexLm.exe
  C:\Windows\System\ZxsexLm.exe
  2⤵
  PID:4860
- C:\Windows\System\BdmWCBV.exe
  C:\Windows\System\BdmWCBV.exe
  2⤵
  PID:3496
- C:\Windows\System\GSchEGY.exe
  C:\Windows\System\GSchEGY.exe
  2⤵
  PID:3996
- C:\Windows\System\TDuniDb.exe
  C:\Windows\System\TDuniDb.exe
  2⤵
  PID:3368
- C:\Windows\System\aHCgjOy.exe
  C:\Windows\System\aHCgjOy.exe
  2⤵
  PID:3804
- C:\Windows\System\qRhUEJC.exe
  C:\Windows\System\qRhUEJC.exe
  2⤵
  PID:4308
- C:\Windows\System\WrlKKWB.exe
  C:\Windows\System\WrlKKWB.exe
  2⤵
  PID:4372
- C:\Windows\System\KFSpDpl.exe
  C:\Windows\System\KFSpDpl.exe
  2⤵
  PID:5084
- C:\Windows\System\kLRHIfR.exe
  C:\Windows\System\kLRHIfR.exe
  2⤵
  PID:5112
- C:\Windows\System\RKBjTcz.exe
  C:\Windows\System\RKBjTcz.exe
  2⤵
  PID:4220
- C:\Windows\System\kupoqNN.exe
  C:\Windows\System\kupoqNN.exe
  2⤵
  PID:4464
- C:\Windows\System\tFKbRnF.exe
  C:\Windows\System\tFKbRnF.exe
  2⤵
  PID:4648
- C:\Windows\System\nEWnNKo.exe
  C:\Windows\System\nEWnNKo.exe
  2⤵
  PID:4872
- C:\Windows\System\HsxrXVn.exe
  C:\Windows\System\HsxrXVn.exe
  2⤵
  PID:3440
- C:\Windows\System\HWBcLxz.exe
  C:\Windows\System\HWBcLxz.exe
  2⤵
  PID:4564
- C:\Windows\System\efhSutH.exe
  C:\Windows\System\efhSutH.exe
  2⤵
  PID:4924
- C:\Windows\System\JaGFjWm.exe
  C:\Windows\System\JaGFjWm.exe
  2⤵
  PID:3904
- C:\Windows\System\tSUPrZV.exe
  C:\Windows\System\tSUPrZV.exe
  2⤵
  PID:3928
- C:\Windows\System\oXVDASd.exe
  C:\Windows\System\oXVDASd.exe
  2⤵
  PID:3944
- C:\Windows\System\OsOkFgo.exe
  C:\Windows\System\OsOkFgo.exe
  2⤵
  PID:4060
- C:\Windows\System\KxSwzkx.exe
  C:\Windows\System\KxSwzkx.exe
  2⤵
  PID:3460
- C:\Windows\System\WBEMrpm.exe
  C:\Windows\System\WBEMrpm.exe
  2⤵
  PID:3340
- C:\Windows\System\rAfqGXu.exe
  C:\Windows\System\rAfqGXu.exe
  2⤵
  PID:4268
- C:\Windows\System\kedcsuq.exe
  C:\Windows\System\kedcsuq.exe
  2⤵
  PID:4412
- C:\Windows\System\rNRpHid.exe
  C:\Windows\System\rNRpHid.exe
  2⤵
  PID:4560
- C:\Windows\System\LuCyGZj.exe
  C:\Windows\System\LuCyGZj.exe
  2⤵
  PID:4600
- C:\Windows\System\MWtogFo.exe
  C:\Windows\System\MWtogFo.exe
  2⤵
  PID:4672
- C:\Windows\System\TmYtTzB.exe
  C:\Windows\System\TmYtTzB.exe
  2⤵
  PID:4736
- C:\Windows\System\TIjXoSE.exe
  C:\Windows\System\TIjXoSE.exe
  2⤵
  PID:4780
- C:\Windows\System\STvRDyg.exe
  C:\Windows\System\STvRDyg.exe
  2⤵
  PID:4820
- C:\Windows\System\BHQXTvN.exe
  C:\Windows\System\BHQXTvN.exe
  2⤵
  PID:4836
- C:\Windows\System\XjBISyc.exe
  C:\Windows\System\XjBISyc.exe
  2⤵
  PID:4948
- C:\Windows\System\Pziohua.exe
  C:\Windows\System\Pziohua.exe
  2⤵
  PID:2976
- C:\Windows\System\ndHmhVV.exe
  C:\Windows\System\ndHmhVV.exe
  2⤵
  PID:3660
- C:\Windows\System\lTGhxJD.exe
  C:\Windows\System\lTGhxJD.exe
  2⤵
  PID:3436
- C:\Windows\System\WEAnavw.exe
  C:\Windows\System\WEAnavw.exe
  2⤵
  PID:2460
- C:\Windows\System\itaZqCZ.exe
  C:\Windows\System\itaZqCZ.exe
  2⤵
  PID:3548
- C:\Windows\System\BbyAHKC.exe
  C:\Windows\System\BbyAHKC.exe
  2⤵
  PID:4256
- C:\Windows\System\PWCdlBx.exe
  C:\Windows\System\PWCdlBx.exe
  2⤵
  PID:4892
- C:\Windows\System\ilAzfxr.exe
  C:\Windows\System\ilAzfxr.exe
  2⤵
  PID:4848
- C:\Windows\System\YqLHhaC.exe
  C:\Windows\System\YqLHhaC.exe
  2⤵
  PID:3680
- C:\Windows\System\SvRVVyM.exe
  C:\Windows\System\SvRVVyM.exe
  2⤵
  PID:1664
- C:\Windows\System\nyIMWiV.exe
  C:\Windows\System\nyIMWiV.exe
  2⤵
  PID:4616
- C:\Windows\System\UYVZNmt.exe
  C:\Windows\System\UYVZNmt.exe
  2⤵
  PID:3916
- C:\Windows\System\wUHbyQa.exe
  C:\Windows\System\wUHbyQa.exe
  2⤵
  PID:980
- C:\Windows\System\wwmqPzT.exe
  C:\Windows\System\wwmqPzT.exe
  2⤵
  PID:4340
- C:\Windows\System\xAOdgse.exe
  C:\Windows\System\xAOdgse.exe
  2⤵
  PID:5080
- C:\Windows\System\HnpGbLz.exe
  C:\Windows\System\HnpGbLz.exe
  2⤵
  PID:4964
- C:\Windows\System\THfyOqR.exe
  C:\Windows\System\THfyOqR.exe
  2⤵
  PID:3664
- C:\Windows\System\fVadZCq.exe
  C:\Windows\System\fVadZCq.exe
  2⤵
  PID:2480
- C:\Windows\System\aKuhWvB.exe
  C:\Windows\System\aKuhWvB.exe
  2⤵
  PID:2524
- C:\Windows\System\XoaFtsA.exe
  C:\Windows\System\XoaFtsA.exe
  2⤵
  PID:2716
- C:\Windows\System\VARDntY.exe
  C:\Windows\System\VARDntY.exe
  2⤵
  PID:4596
- C:\Windows\System\BSRDEqF.exe
  C:\Windows\System\BSRDEqF.exe
  2⤵
  PID:3212
- C:\Windows\System\jiviCyq.exe
  C:\Windows\System\jiviCyq.exe
  2⤵
  PID:4920
- C:\Windows\System\LtqlOwq.exe
  C:\Windows\System\LtqlOwq.exe
  2⤵
  PID:4748
- C:\Windows\System\qakfFZn.exe
  C:\Windows\System\qakfFZn.exe
  2⤵
  PID:3852
- C:\Windows\System\NiRqoYv.exe
  C:\Windows\System\NiRqoYv.exe
  2⤵
  PID:1032
- C:\Windows\System\HTuMKwy.exe
  C:\Windows\System\HTuMKwy.exe
  2⤵
  PID:4016
- C:\Windows\System\AjmHQZk.exe
  C:\Windows\System\AjmHQZk.exe
  2⤵
  PID:3084
- C:\Windows\System\bmTvBDJ.exe
  C:\Windows\System\bmTvBDJ.exe
  2⤵
  PID:2592
- C:\Windows\System\GQvJher.exe
  C:\Windows\System\GQvJher.exe
  2⤵
  PID:4360
- C:\Windows\System\FtjdPLL.exe
  C:\Windows\System\FtjdPLL.exe
  2⤵
  PID:3356
- C:\Windows\System\iWOfrjJ.exe
  C:\Windows\System\iWOfrjJ.exe
  2⤵
  PID:4832
- C:\Windows\System\BCMrKRH.exe
  C:\Windows\System\BCMrKRH.exe
  2⤵
  PID:4776
- C:\Windows\System\giJFIau.exe
  C:\Windows\System\giJFIau.exe
  2⤵
  PID:3624
- C:\Windows\System\cFePXWr.exe
  C:\Windows\System\cFePXWr.exe
  2⤵
  PID:2708
- C:\Windows\System\qojCKtT.exe
  C:\Windows\System\qojCKtT.exe
  2⤵
  PID:4704
- C:\Windows\System\nHAZyQv.exe
  C:\Windows\System\nHAZyQv.exe
  2⤵
  PID:2576
- C:\Windows\System\XiBAOfH.exe
  C:\Windows\System\XiBAOfH.exe
  2⤵
  PID:4196
- C:\Windows\System\HgKnzxq.exe
  C:\Windows\System\HgKnzxq.exe
  2⤵
  PID:5124
- C:\Windows\System\NHDjfwn.exe
  C:\Windows\System\NHDjfwn.exe
  2⤵
  PID:5140
- C:\Windows\System\HhNPeoX.exe
  C:\Windows\System\HhNPeoX.exe
  2⤵
  PID:5156
- C:\Windows\System\cphFSsK.exe
  C:\Windows\System\cphFSsK.exe
  2⤵
  PID:5172
- C:\Windows\System\PJdeorS.exe
  C:\Windows\System\PJdeorS.exe
  2⤵
  PID:5188
- C:\Windows\System\wYmMrcn.exe
  C:\Windows\System\wYmMrcn.exe
  2⤵
  PID:5204
- C:\Windows\System\dCESrqh.exe
  C:\Windows\System\dCESrqh.exe
  2⤵
  PID:5220
- C:\Windows\System\rRQJmIc.exe
  C:\Windows\System\rRQJmIc.exe
  2⤵
  PID:5236
- C:\Windows\System\wzIuCeT.exe
  C:\Windows\System\wzIuCeT.exe
  2⤵
  PID:5252
- C:\Windows\System\BRjNZFq.exe
  C:\Windows\System\BRjNZFq.exe
  2⤵
  PID:5268
- C:\Windows\System\bHiyfLs.exe
  C:\Windows\System\bHiyfLs.exe
  2⤵
  PID:5284
- C:\Windows\System\rRyUAeu.exe
  C:\Windows\System\rRyUAeu.exe
  2⤵
  PID:5300
- C:\Windows\System\mcREEmC.exe
  C:\Windows\System\mcREEmC.exe
  2⤵
  PID:5316
- C:\Windows\System\OtWbjZD.exe
  C:\Windows\System\OtWbjZD.exe
  2⤵
  PID:5332
- C:\Windows\System\yAYYJfn.exe
  C:\Windows\System\yAYYJfn.exe
  2⤵
  PID:5348
- C:\Windows\System\CSUIYlX.exe
  C:\Windows\System\CSUIYlX.exe
  2⤵
  PID:5364
- C:\Windows\System\gMlOPQl.exe
  C:\Windows\System\gMlOPQl.exe
  2⤵
  PID:5380
- C:\Windows\System\knVoaRG.exe
  C:\Windows\System\knVoaRG.exe
  2⤵
  PID:5396
- C:\Windows\System\RuMIgZL.exe
  C:\Windows\System\RuMIgZL.exe
  2⤵
  PID:5412
- C:\Windows\System\jlRtDcR.exe
  C:\Windows\System\jlRtDcR.exe
  2⤵
  PID:5428
- C:\Windows\System\wxkZYVk.exe
  C:\Windows\System\wxkZYVk.exe
  2⤵
  PID:5444
- C:\Windows\System\YjjcQUQ.exe
  C:\Windows\System\YjjcQUQ.exe
  2⤵
  PID:5460
- C:\Windows\System\UEhAkyB.exe
  C:\Windows\System\UEhAkyB.exe
  2⤵
  PID:5476
- C:\Windows\System\LbtiwbA.exe
  C:\Windows\System\LbtiwbA.exe
  2⤵
  PID:5492
- C:\Windows\System\rQmFXnA.exe
  C:\Windows\System\rQmFXnA.exe
  2⤵
  PID:5508
- C:\Windows\System\wRPHvjC.exe
  C:\Windows\System\wRPHvjC.exe
  2⤵
  PID:5524
- C:\Windows\System\eWoLaEL.exe
  C:\Windows\System\eWoLaEL.exe
  2⤵
  PID:5540
- C:\Windows\System\hbPbnXc.exe
  C:\Windows\System\hbPbnXc.exe
  2⤵
  PID:5556
- C:\Windows\System\XrCLUko.exe
  C:\Windows\System\XrCLUko.exe
  2⤵
  PID:5572
- C:\Windows\System\ackBTds.exe
  C:\Windows\System\ackBTds.exe
  2⤵
  PID:5588
- C:\Windows\System\AhvimMj.exe
  C:\Windows\System\AhvimMj.exe
  2⤵
  PID:5604
- C:\Windows\System\hBcOVra.exe
  C:\Windows\System\hBcOVra.exe
  2⤵
  PID:5640
- C:\Windows\System\jcYPUSk.exe
  C:\Windows\System\jcYPUSk.exe
  2⤵
  PID:5684
- C:\Windows\System\UyAkbyo.exe
  C:\Windows\System\UyAkbyo.exe
  2⤵
  PID:5704
- C:\Windows\System\BhLLmFd.exe
  C:\Windows\System\BhLLmFd.exe
  2⤵
  PID:5720
- C:\Windows\System\xpJfaqb.exe
  C:\Windows\System\xpJfaqb.exe
  2⤵
  PID:5736
- C:\Windows\System\fesiXJC.exe
  C:\Windows\System\fesiXJC.exe
  2⤵
  PID:5752
- C:\Windows\System\tZxweBB.exe
  C:\Windows\System\tZxweBB.exe
  2⤵
  PID:5768
- C:\Windows\System\liqEzux.exe
  C:\Windows\System\liqEzux.exe
  2⤵
  PID:5784
- C:\Windows\System\BRhIMbJ.exe
  C:\Windows\System\BRhIMbJ.exe
  2⤵
  PID:5800
- C:\Windows\System\nIYiUBK.exe
  C:\Windows\System\nIYiUBK.exe
  2⤵
  PID:5816
- C:\Windows\System\kyIuwnf.exe
  C:\Windows\System\kyIuwnf.exe
  2⤵
  PID:5832
- C:\Windows\System\ZSIiOCW.exe
  C:\Windows\System\ZSIiOCW.exe
  2⤵
  PID:5848
- C:\Windows\System\zBdsZgQ.exe
  C:\Windows\System\zBdsZgQ.exe
  2⤵
  PID:5864
- C:\Windows\System\AlTRnvh.exe
  C:\Windows\System\AlTRnvh.exe
  2⤵
  PID:5928
- C:\Windows\System\UJhkVVf.exe
  C:\Windows\System\UJhkVVf.exe
  2⤵
  PID:5948
- C:\Windows\System\uxbLOIy.exe
  C:\Windows\System\uxbLOIy.exe
  2⤵
  PID:5980
- C:\Windows\System\QQaJyRJ.exe
  C:\Windows\System\QQaJyRJ.exe
  2⤵
  PID:6004
- C:\Windows\System\nXOAOpX.exe
  C:\Windows\System\nXOAOpX.exe
  2⤵
  PID:6020
- C:\Windows\System\OrITsXV.exe
  C:\Windows\System\OrITsXV.exe
  2⤵
  PID:6036
- C:\Windows\System\YbGPMpt.exe
  C:\Windows\System\YbGPMpt.exe
  2⤵
  PID:6052
- C:\Windows\System\dErIXON.exe
  C:\Windows\System\dErIXON.exe
  2⤵
  PID:6068
- C:\Windows\System\FuJRJgD.exe
  C:\Windows\System\FuJRJgD.exe
  2⤵
  PID:6084
- C:\Windows\System\DJxwsst.exe
  C:\Windows\System\DJxwsst.exe
  2⤵
  PID:6100
- C:\Windows\System\OSVxRdQ.exe
  C:\Windows\System\OSVxRdQ.exe
  2⤵
  PID:6116
- C:\Windows\System\psdbUcM.exe
  C:\Windows\System\psdbUcM.exe
  2⤵
  PID:6132
- C:\Windows\System\HxoLRDp.exe
  C:\Windows\System\HxoLRDp.exe
  2⤵
  PID:4172
- C:\Windows\System\AbjTOdw.exe
  C:\Windows\System\AbjTOdw.exe
  2⤵
  PID:2768
- C:\Windows\System\fLccniD.exe
  C:\Windows\System\fLccniD.exe
  2⤵
  PID:5164
- C:\Windows\System\FdtUhia.exe
  C:\Windows\System\FdtUhia.exe
  2⤵
  PID:1888
- C:\Windows\System\VPPjSsT.exe
  C:\Windows\System\VPPjSsT.exe
  2⤵
  PID:5232
- C:\Windows\System\mkmIpfL.exe
  C:\Windows\System\mkmIpfL.exe
  2⤵
  PID:5296
- C:\Windows\System\BVcaDKo.exe
  C:\Windows\System\BVcaDKo.exe
  2⤵
  PID:5360
- C:\Windows\System\zCcxAmC.exe
  C:\Windows\System\zCcxAmC.exe
  2⤵
  PID:5424
- C:\Windows\System\NShGWoX.exe
  C:\Windows\System\NShGWoX.exe
  2⤵
  PID:5456
- C:\Windows\System\zmxmAQu.exe
  C:\Windows\System\zmxmAQu.exe
  2⤵
  PID:5100
- C:\Windows\System\ZopwdQr.exe
  C:\Windows\System\ZopwdQr.exe
  2⤵
  PID:4816
- C:\Windows\System\wenWBXQ.exe
  C:\Windows\System\wenWBXQ.exe
  2⤵
  PID:4556
- C:\Windows\System\wBwwHPF.exe
  C:\Windows\System\wBwwHPF.exe
  2⤵
  PID:3900
- C:\Windows\System\nSPBURS.exe
  C:\Windows\System\nSPBURS.exe
  2⤵
  PID:5168
- C:\Windows\System\UGkIXni.exe
  C:\Windows\System\UGkIXni.exe
  2⤵
  PID:5484
- C:\Windows\System\tmfQZpa.exe
  C:\Windows\System\tmfQZpa.exe
  2⤵
  PID:6048
- C:\Windows\System\uCmSnTr.exe
  C:\Windows\System\uCmSnTr.exe
  2⤵
  PID:3524
- C:\Windows\System\bQyugWi.exe
  C:\Windows\System\bQyugWi.exe
  2⤵
  PID:5180
- C:\Windows\System\YIhogvA.exe
  C:\Windows\System\YIhogvA.exe
  2⤵
  PID:5244
- C:\Windows\System\RiqxkKu.exe
  C:\Windows\System\RiqxkKu.exe
  2⤵
  PID:5308
- C:\Windows\System\jVVpgNN.exe
  C:\Windows\System\jVVpgNN.exe
  2⤵
  PID:5504
- C:\Windows\System\fxzeIeG.exe
  C:\Windows\System\fxzeIeG.exe
  2⤵
  PID:5580
- C:\Windows\System\EIVjKlV.exe
  C:\Windows\System\EIVjKlV.exe
  2⤵
  PID:5620
- C:\Windows\System\QyYiCLO.exe
  C:\Windows\System\QyYiCLO.exe
  2⤵
  PID:5696
- C:\Windows\System\rGuOPFU.exe
  C:\Windows\System\rGuOPFU.exe
  2⤵
  PID:5728
- C:\Windows\System\qvFJECo.exe
  C:\Windows\System\qvFJECo.exe
  2⤵
  PID:5796
- C:\Windows\System\UDjkReS.exe
  C:\Windows\System\UDjkReS.exe
  2⤵
  PID:5940
- C:\Windows\System\UHCHIrC.exe
  C:\Windows\System\UHCHIrC.exe
  2⤵
  PID:2776
- C:\Windows\System\cbmmtOq.exe
  C:\Windows\System\cbmmtOq.exe
  2⤵
  PID:6000
- C:\Windows\System\hGQastG.exe
  C:\Windows\System\hGQastG.exe
  2⤵
  PID:6060
- C:\Windows\System\ttHUzXV.exe
  C:\Windows\System\ttHUzXV.exe
  2⤵
  PID:5744
- C:\Windows\System\TzfBtGu.exe
  C:\Windows\System\TzfBtGu.exe
  2⤵
  PID:5812
- C:\Windows\System\WMGqSTb.exe
  C:\Windows\System\WMGqSTb.exe
  2⤵
  PID:5892
- C:\Windows\System\siovZmK.exe
  C:\Windows\System\siovZmK.exe
  2⤵
  PID:5908
- C:\Windows\System\olNzwoV.exe
  C:\Windows\System\olNzwoV.exe
  2⤵
  PID:5968
- C:\Windows\System\DXMsfuK.exe
  C:\Windows\System\DXMsfuK.exe
  2⤵
  PID:6012
- C:\Windows\System\rdidcFo.exe
  C:\Windows\System\rdidcFo.exe
  2⤵
  PID:5648
- C:\Windows\System\GLuDYvc.exe
  C:\Windows\System\GLuDYvc.exe
  2⤵
  PID:5676
- C:\Windows\System\mCiCIec.exe
  C:\Windows\System\mCiCIec.exe
  2⤵
  PID:4932
- C:\Windows\System\gsmGQOs.exe
  C:\Windows\System\gsmGQOs.exe
  2⤵
  PID:6140
- C:\Windows\System\HHvczDm.exe
  C:\Windows\System\HHvczDm.exe
  2⤵
  PID:5132
- C:\Windows\System\FHjxpGq.exe
  C:\Windows\System\FHjxpGq.exe
  2⤵
  PID:5420
- C:\Windows\System\gPHJfdy.exe
  C:\Windows\System\gPHJfdy.exe
  2⤵
  PID:5880
- C:\Windows\System\dRybidN.exe
  C:\Windows\System\dRybidN.exe
  2⤵
  PID:5340
- C:\Windows\System\yizlQWN.exe
  C:\Windows\System\yizlQWN.exe
  2⤵
  PID:4668
- C:\Windows\System\PznGrsp.exe
  C:\Windows\System\PznGrsp.exe
  2⤵
  PID:5312
- C:\Windows\System\KPSvalk.exe
  C:\Windows\System\KPSvalk.exe
  2⤵
  PID:5628
- C:\Windows\System\AOsseFk.exe
  C:\Windows\System\AOsseFk.exe
  2⤵
  PID:5760
- C:\Windows\System\lOYaeyt.exe
  C:\Windows\System\lOYaeyt.exe
  2⤵
  PID:5596
- C:\Windows\System\bYeMhaU.exe
  C:\Windows\System\bYeMhaU.exe
  2⤵
  PID:5780
- C:\Windows\System\ZxmWHNN.exe
  C:\Windows\System\ZxmWHNN.exe
  2⤵
  PID:5376
- C:\Windows\System\kDWCYfe.exe
  C:\Windows\System\kDWCYfe.exe
  2⤵
  PID:5972
- C:\Windows\System\cItNEon.exe
  C:\Windows\System\cItNEon.exe
  2⤵
  PID:4504
- C:\Windows\System\ZQtWTaq.exe
  C:\Windows\System\ZQtWTaq.exe
  2⤵
  PID:5520
- C:\Windows\System\HBKCQjg.exe
  C:\Windows\System\HBKCQjg.exe
  2⤵
  PID:5660
- C:\Windows\System\FvIxgqb.exe
  C:\Windows\System\FvIxgqb.exe
  2⤵
  PID:3728
- C:\Windows\System\PybVxpj.exe
  C:\Windows\System\PybVxpj.exe
  2⤵
  PID:5920
- C:\Windows\System\YypfWDW.exe
  C:\Windows\System\YypfWDW.exe
  2⤵
  PID:5692
- C:\Windows\System\BxhYvXx.exe
  C:\Windows\System\BxhYvXx.exe
  2⤵
  PID:6028
- C:\Windows\System\ulSRtBa.exe
  C:\Windows\System\ulSRtBa.exe
  2⤵
  PID:5872
- C:\Windows\System\pdTkEzx.exe
  C:\Windows\System\pdTkEzx.exe
  2⤵
  PID:5516
- C:\Windows\System\fNnLLfx.exe
  C:\Windows\System\fNnLLfx.exe
  2⤵
  PID:5824
- C:\Windows\System\dIczWge.exe
  C:\Windows\System\dIczWge.exe
  2⤵
  PID:2536
- C:\Windows\System\aYnSUQu.exe
  C:\Windows\System\aYnSUQu.exe
  2⤵
  PID:6080
- C:\Windows\System\TsbApTY.exe
  C:\Windows\System\TsbApTY.exe
  2⤵
  PID:5960
- C:\Windows\System\ZxMrGFJ.exe
  C:\Windows\System\ZxMrGFJ.exe
  2⤵
  PID:4180
- C:\Windows\System\cUjfFmk.exe
  C:\Windows\System\cUjfFmk.exe
  2⤵
  PID:5216
- C:\Windows\System\VTbKdai.exe
  C:\Windows\System\VTbKdai.exe
  2⤵
  PID:5472
- C:\Windows\System\gHFoGYR.exe
  C:\Windows\System\gHFoGYR.exe
  2⤵
  PID:5844
- C:\Windows\System\HpLBHZj.exe
  C:\Windows\System\HpLBHZj.exe
  2⤵
  PID:6156
- C:\Windows\System\wKmmCwB.exe
  C:\Windows\System\wKmmCwB.exe
  2⤵
  PID:6172
- C:\Windows\System\pfcHYEi.exe
  C:\Windows\System\pfcHYEi.exe
  2⤵
  PID:6188
- C:\Windows\System\ovOhzMH.exe
  C:\Windows\System\ovOhzMH.exe
  2⤵
  PID:6204
- C:\Windows\System\PRKmlXU.exe
  C:\Windows\System\PRKmlXU.exe
  2⤵
  PID:6220
- C:\Windows\System\KaUKhdR.exe
  C:\Windows\System\KaUKhdR.exe
  2⤵
  PID:6236
- C:\Windows\System\odrWejT.exe
  C:\Windows\System\odrWejT.exe
  2⤵
  PID:6252
- C:\Windows\System\kpzUaew.exe
  C:\Windows\System\kpzUaew.exe
  2⤵
  PID:6268
- C:\Windows\System\PJhoTaL.exe
  C:\Windows\System\PJhoTaL.exe
  2⤵
  PID:6284
- C:\Windows\System\XfJJVwC.exe
  C:\Windows\System\XfJJVwC.exe
  2⤵
  PID:6300
- C:\Windows\System\GfVZJYy.exe
  C:\Windows\System\GfVZJYy.exe
  2⤵
  PID:6320
- C:\Windows\System\IHFSrEK.exe
  C:\Windows\System\IHFSrEK.exe
  2⤵
  PID:6336
- C:\Windows\System\HaYAIWU.exe
  C:\Windows\System\HaYAIWU.exe
  2⤵
  PID:6352
- C:\Windows\System\sdNEsIS.exe
  C:\Windows\System\sdNEsIS.exe
  2⤵
  PID:6368
- C:\Windows\System\IoXUWGm.exe
  C:\Windows\System\IoXUWGm.exe
  2⤵
  PID:6384
- C:\Windows\System\HuopxJt.exe
  C:\Windows\System\HuopxJt.exe
  2⤵
  PID:6400
- C:\Windows\System\lcGsEzF.exe
  C:\Windows\System\lcGsEzF.exe
  2⤵
  PID:6416
- C:\Windows\System\JTzGlsH.exe
  C:\Windows\System\JTzGlsH.exe
  2⤵
  PID:6432
- C:\Windows\System\JnXgQDL.exe
  C:\Windows\System\JnXgQDL.exe
  2⤵
  PID:6536
- C:\Windows\System\NavUNzW.exe
  C:\Windows\System\NavUNzW.exe
  2⤵
  PID:6552
- C:\Windows\System\fkYYTtc.exe
  C:\Windows\System\fkYYTtc.exe
  2⤵
  PID:6572
- C:\Windows\System\XAJSfRf.exe
  C:\Windows\System\XAJSfRf.exe
  2⤵
  PID:6588
- C:\Windows\System\BzQbrlb.exe
  C:\Windows\System\BzQbrlb.exe
  2⤵
  PID:6608
- C:\Windows\System\GGElDmd.exe
  C:\Windows\System\GGElDmd.exe
  2⤵
  PID:6644
- C:\Windows\System\DnujqGA.exe
  C:\Windows\System\DnujqGA.exe
  2⤵
  PID:6668
- C:\Windows\System\PogfUIa.exe
  C:\Windows\System\PogfUIa.exe
  2⤵
  PID:6688
- C:\Windows\System\Szkload.exe
  C:\Windows\System\Szkload.exe
  2⤵
  PID:6704
- C:\Windows\System\SWzbXDJ.exe
  C:\Windows\System\SWzbXDJ.exe
  2⤵
  PID:6724
- C:\Windows\System\FAVQDLI.exe
  C:\Windows\System\FAVQDLI.exe
  2⤵
  PID:6740
- C:\Windows\System\EkCFaCN.exe
  C:\Windows\System\EkCFaCN.exe
  2⤵
  PID:6760
- C:\Windows\System\jxaHWEI.exe
  C:\Windows\System\jxaHWEI.exe
  2⤵
  PID:6776
- C:\Windows\System\RexcskE.exe
  C:\Windows\System\RexcskE.exe
  2⤵
  PID:6824
- C:\Windows\System\HDOYDFL.exe
  C:\Windows\System\HDOYDFL.exe
  2⤵
  PID:6844
- C:\Windows\System\uhDdxAA.exe
  C:\Windows\System\uhDdxAA.exe
  2⤵
  PID:6864
- C:\Windows\System\eruGPqb.exe
  C:\Windows\System\eruGPqb.exe
  2⤵
  PID:6884
- C:\Windows\System\gphZoFV.exe
  C:\Windows\System\gphZoFV.exe
  2⤵
  PID:6900
- C:\Windows\System\RDmALMa.exe
  C:\Windows\System\RDmALMa.exe
  2⤵
  PID:6916
- C:\Windows\System\OdqENoE.exe
  C:\Windows\System\OdqENoE.exe
  2⤵
  PID:6932
- C:\Windows\System\lzMPJVX.exe
  C:\Windows\System\lzMPJVX.exe
  2⤵
  PID:6948
- C:\Windows\System\bOaVdxW.exe
  C:\Windows\System\bOaVdxW.exe
  2⤵
  PID:6964
- C:\Windows\System\pkefJDF.exe
  C:\Windows\System\pkefJDF.exe
  2⤵
  PID:6980
- C:\Windows\System\kOsKIsS.exe
  C:\Windows\System\kOsKIsS.exe
  2⤵
  PID:6996
- C:\Windows\System\urKdIuc.exe
  C:\Windows\System\urKdIuc.exe
  2⤵
  PID:7020
- C:\Windows\System\kzCpPHA.exe
  C:\Windows\System\kzCpPHA.exe
  2⤵
  PID:7044
- C:\Windows\System\MzbWrnf.exe
  C:\Windows\System\MzbWrnf.exe
  2⤵
  PID:7064
- C:\Windows\System\lMfsEpZ.exe
  C:\Windows\System\lMfsEpZ.exe
  2⤵
  PID:7080
- C:\Windows\System\xywkapg.exe
  C:\Windows\System\xywkapg.exe
  2⤵
  PID:7096
- C:\Windows\System\YPOTdMu.exe
  C:\Windows\System\YPOTdMu.exe
  2⤵
  PID:7116
- C:\Windows\System\DxLQMfk.exe
  C:\Windows\System\DxLQMfk.exe
  2⤵
  PID:7140
- C:\Windows\System\urngYee.exe
  C:\Windows\System\urngYee.exe
  2⤵
  PID:7156
- C:\Windows\System\GWZyXxr.exe
  C:\Windows\System\GWZyXxr.exe
  2⤵
  PID:6076
- C:\Windows\System\MDiBnQf.exe
  C:\Windows\System\MDiBnQf.exe
  2⤵
  PID:5552
- C:\Windows\System\MhmMBhs.exe
  C:\Windows\System\MhmMBhs.exe
  2⤵
  PID:5904
- C:\Windows\System\VijeYHH.exe
  C:\Windows\System\VijeYHH.exe
  2⤵
  PID:5716
- C:\Windows\System\gYvFpMb.exe
  C:\Windows\System\gYvFpMb.exe
  2⤵
  PID:6184
- C:\Windows\System\gsUbMAm.exe
  C:\Windows\System\gsUbMAm.exe
  2⤵
  PID:6248
- C:\Windows\System\jkieUuI.exe
  C:\Windows\System\jkieUuI.exe
  2⤵
  PID:6344
- C:\Windows\System\RxqvHvg.exe
  C:\Windows\System\RxqvHvg.exe
  2⤵
  PID:6408
- C:\Windows\System\GgEeUpu.exe
  C:\Windows\System\GgEeUpu.exe
  2⤵
  PID:6460
- C:\Windows\System\zBPAcPG.exe
  C:\Windows\System\zBPAcPG.exe
  2⤵
  PID:6484
- C:\Windows\System\wyZVyQn.exe
  C:\Windows\System\wyZVyQn.exe
  2⤵
  PID:6512
- C:\Windows\System\EJWzLPn.exe
  C:\Windows\System\EJWzLPn.exe
  2⤵
  PID:5372
- C:\Windows\System\TaODbTS.exe
  C:\Windows\System\TaODbTS.exe
  2⤵
  PID:6524
- C:\Windows\System\KqmObHR.exe
  C:\Windows\System\KqmObHR.exe
  2⤵
  PID:6568
- C:\Windows\System\ANSigne.exe
  C:\Windows\System\ANSigne.exe
  2⤵
  PID:5792
- C:\Windows\System\PsVoUiR.exe
  C:\Windows\System\PsVoUiR.exe
  2⤵
  PID:6196
- C:\Windows\System\CYGXjks.exe
  C:\Windows\System\CYGXjks.exe
  2⤵
  PID:6228
- C:\Windows\System\DiQjsXv.exe
  C:\Windows\System\DiQjsXv.exe
  2⤵
  PID:6260
- C:\Windows\System\STbbQsi.exe
  C:\Windows\System\STbbQsi.exe
  2⤵
  PID:6364
- C:\Windows\System\RgbeFtU.exe
  C:\Windows\System\RgbeFtU.exe
  2⤵
  PID:6428
- C:\Windows\System\QWppyLY.exe
  C:\Windows\System\QWppyLY.exe
  2⤵
  PID:2140
- C:\Windows\System\nVmlSim.exe
  C:\Windows\System\nVmlSim.exe
  2⤵
  PID:5072
- C:\Windows\System\gDuiJvt.exe
  C:\Windows\System\gDuiJvt.exe
  2⤵
  PID:6772
- C:\Windows\System\kfniusa.exe
  C:\Windows\System\kfniusa.exe
  2⤵
  PID:5612
- C:\Windows\System\BAzmuyH.exe
  C:\Windows\System\BAzmuyH.exe
  2⤵
  PID:6632
- C:\Windows\System\HiVkFhB.exe
  C:\Windows\System\HiVkFhB.exe
  2⤵
  PID:6684
- C:\Windows\System\SZVjMsU.exe
  C:\Windows\System\SZVjMsU.exe
  2⤵
  PID:6752
- C:\Windows\System\feXUGUR.exe
  C:\Windows\System\feXUGUR.exe
  2⤵
  PID:6792
- C:\Windows\System\HdWbHnZ.exe
  C:\Windows\System\HdWbHnZ.exe
  2⤵
  PID:6820
- C:\Windows\System\aDHNDYr.exe
  C:\Windows\System\aDHNDYr.exe
  2⤵
  PID:6836
- C:\Windows\System\Mkjtqcb.exe
  C:\Windows\System\Mkjtqcb.exe
  2⤵
  PID:6880
- C:\Windows\System\AUWbPbE.exe
  C:\Windows\System\AUWbPbE.exe
  2⤵
  PID:6972
- C:\Windows\System\kgtjHxp.exe
  C:\Windows\System\kgtjHxp.exe
  2⤵
  PID:7016
- C:\Windows\System\RczKWEc.exe
  C:\Windows\System\RczKWEc.exe
  2⤵
  PID:7056
- C:\Windows\System\jxafuDJ.exe
  C:\Windows\System\jxafuDJ.exe
  2⤵
  PID:5500
- C:\Windows\System\wyHFpKW.exe
  C:\Windows\System\wyHFpKW.exe
  2⤵
  PID:5956
- C:\Windows\System\DFMXQog.exe
  C:\Windows\System\DFMXQog.exe
  2⤵
  PID:6152
- C:\Windows\System\mdhdlUa.exe
  C:\Windows\System\mdhdlUa.exe
  2⤵
  PID:6892
- C:\Windows\System\mWGECvl.exe
  C:\Windows\System\mWGECvl.exe
  2⤵
  PID:6988
- C:\Windows\System\RialkNO.exe
  C:\Windows\System\RialkNO.exe
  2⤵
  PID:7036
- C:\Windows\System\PTRemxG.exe
  C:\Windows\System\PTRemxG.exe
  2⤵
  PID:6440
- C:\Windows\System\aNaCTHK.exe
  C:\Windows\System\aNaCTHK.exe
  2⤵
  PID:7112
- C:\Windows\System\qRpatnD.exe
  C:\Windows\System\qRpatnD.exe
  2⤵
  PID:7148
- C:\Windows\System\nYXjJrS.exe
  C:\Windows\System\nYXjJrS.exe
  2⤵
  PID:5600
- C:\Windows\System\GhfiUrR.exe
  C:\Windows\System\GhfiUrR.exe
  2⤵
  PID:5532
- C:\Windows\System\eHXlNtv.exe
  C:\Windows\System\eHXlNtv.exe
  2⤵
  PID:6600
- C:\Windows\System\defvxDm.exe
  C:\Windows\System\defvxDm.exe
  2⤵
  PID:6468
- C:\Windows\System\lzRTguE.exe
  C:\Windows\System\lzRTguE.exe
  2⤵
  PID:6652
- C:\Windows\System\mWTgoxD.exe
  C:\Windows\System\mWTgoxD.exe
  2⤵
  PID:6560
- C:\Windows\System\WlYcfaC.exe
  C:\Windows\System\WlYcfaC.exe
  2⤵
  PID:6664
- C:\Windows\System\bUVjdsk.exe
  C:\Windows\System\bUVjdsk.exe
  2⤵
  PID:6360
- C:\Windows\System\fgZwYNE.exe
  C:\Windows\System\fgZwYNE.exe
  2⤵
  PID:6584
- C:\Windows\System\arIROtd.exe
  C:\Windows\System\arIROtd.exe
  2⤵
  PID:6544
- C:\Windows\System\QOMuwTA.exe
  C:\Windows\System\QOMuwTA.exe
  2⤵
  PID:6748
- C:\Windows\System\UnYfDjw.exe
  C:\Windows\System\UnYfDjw.exe
  2⤵
  PID:7004
- C:\Windows\System\KHHMxyQ.exe
  C:\Windows\System\KHHMxyQ.exe
  2⤵
  PID:7128
- C:\Windows\System\XRMgHEL.exe
  C:\Windows\System\XRMgHEL.exe
  2⤵
  PID:7076
- C:\Windows\System\DNOAzRv.exe
  C:\Windows\System\DNOAzRv.exe
  2⤵
  PID:6264
- C:\Windows\System\lthiGmE.exe
  C:\Windows\System\lthiGmE.exe
  2⤵
  PID:6832
- C:\Windows\System\qLfvmoE.exe
  C:\Windows\System\qLfvmoE.exe
  2⤵
  PID:6620
- C:\Windows\System\TYfESUN.exe
  C:\Windows\System\TYfESUN.exe
  2⤵
  PID:6840
- C:\Windows\System\hKCKsmT.exe
  C:\Windows\System\hKCKsmT.exe
  2⤵
  PID:6960
- C:\Windows\System\mAnVXIq.exe
  C:\Windows\System\mAnVXIq.exe
  2⤵
  PID:6912
- C:\Windows\System\gfpVDZH.exe
  C:\Windows\System\gfpVDZH.exe
  2⤵
  PID:5404
- C:\Windows\System\gNxIyzI.exe
  C:\Windows\System\gNxIyzI.exe
  2⤵
  PID:7028
- C:\Windows\System\WeGYnIr.exe
  C:\Windows\System\WeGYnIr.exe
  2⤵
  PID:6488
- C:\Windows\System\bQqWtiF.exe
  C:\Windows\System\bQqWtiF.exe
  2⤵
  PID:5912
- C:\Windows\System\fQlFsOT.exe
  C:\Windows\System\fQlFsOT.exe
  2⤵
  PID:6464
- C:\Windows\System\uxKZcPz.exe
  C:\Windows\System\uxKZcPz.exe
  2⤵
  PID:6696
- C:\Windows\System\yjeElDb.exe
  C:\Windows\System\yjeElDb.exe
  2⤵
  PID:6548
- C:\Windows\System\MkGgMiT.exe
  C:\Windows\System\MkGgMiT.exe
  2⤵
  PID:6872
- C:\Windows\System\afpzueG.exe
  C:\Windows\System\afpzueG.exe
  2⤵
  PID:6452
- C:\Windows\System\gkEIGJM.exe
  C:\Windows\System\gkEIGJM.exe
  2⤵
  PID:6164
- C:\Windows\System\XgtTpHv.exe
  C:\Windows\System\XgtTpHv.exe
  2⤵
  PID:7008
- C:\Windows\System\OAxQbcj.exe
  C:\Windows\System\OAxQbcj.exe
  2⤵
  PID:6680
- C:\Windows\System\SPwImqP.exe
  C:\Windows\System\SPwImqP.exe
  2⤵
  PID:6312
- C:\Windows\System\tffDkwd.exe
  C:\Windows\System\tffDkwd.exe
  2⤵
  PID:6532
- C:\Windows\System\qRClYXK.exe
  C:\Windows\System\qRClYXK.exe
  2⤵
  PID:6852
- C:\Windows\System\KrelfNV.exe
  C:\Windows\System\KrelfNV.exe
  2⤵
  PID:5392
- C:\Windows\System\PxKadsJ.exe
  C:\Windows\System\PxKadsJ.exe
  2⤵
  PID:6480
- C:\Windows\System\tNNXwCQ.exe
  C:\Windows\System\tNNXwCQ.exe
  2⤵
  PID:7164
- C:\Windows\System\LzwcLHn.exe
  C:\Windows\System\LzwcLHn.exe
  2⤵
  PID:7136
- C:\Windows\System\nWHxnnT.exe
  C:\Windows\System\nWHxnnT.exe
  2⤵
  PID:6496
- C:\Windows\System\vjqyijd.exe
  C:\Windows\System\vjqyijd.exe
  2⤵
  PID:6328
- C:\Windows\System\aCUYJve.exe
  C:\Windows\System\aCUYJve.exe
  2⤵
  PID:6700
- C:\Windows\System\FFAznot.exe
  C:\Windows\System\FFAznot.exe
  2⤵
  PID:6292
- C:\Windows\System\hDIUCBS.exe
  C:\Windows\System\hDIUCBS.exe
  2⤵
  PID:6504
- C:\Windows\System\AtMJKxO.exe
  C:\Windows\System\AtMJKxO.exe
  2⤵
  PID:2080
- C:\Windows\System\chtlHpW.exe
  C:\Windows\System\chtlHpW.exe
  2⤵
  PID:7124
- C:\Windows\System\nkriiav.exe
  C:\Windows\System\nkriiav.exe
  2⤵
  PID:952
- C:\Windows\System\wAaXVsS.exe
  C:\Windows\System\wAaXVsS.exe
  2⤵
  PID:7192
- C:\Windows\System\ksetMKO.exe
  C:\Windows\System\ksetMKO.exe
  2⤵
  PID:7208
- C:\Windows\System\sQvRXsU.exe
  C:\Windows\System\sQvRXsU.exe
  2⤵
  PID:7228
- C:\Windows\System\LYVGCFP.exe
  C:\Windows\System\LYVGCFP.exe
  2⤵
  PID:7260
- C:\Windows\System\PSqWnxV.exe
  C:\Windows\System\PSqWnxV.exe
  2⤵
  PID:7296
- C:\Windows\System\TfgMPzR.exe
  C:\Windows\System\TfgMPzR.exe
  2⤵
  PID:7312
- C:\Windows\System\OFQwLSp.exe
  C:\Windows\System\OFQwLSp.exe
  2⤵
  PID:7332
- C:\Windows\System\ppkPeGJ.exe
  C:\Windows\System\ppkPeGJ.exe
  2⤵
  PID:7348
- C:\Windows\System\tSNUOmI.exe
  C:\Windows\System\tSNUOmI.exe
  2⤵
  PID:7364
- C:\Windows\System\LoxgouG.exe
  C:\Windows\System\LoxgouG.exe
  2⤵
  PID:7380
- C:\Windows\System\pllSsMY.exe
  C:\Windows\System\pllSsMY.exe
  2⤵
  PID:7404
- C:\Windows\System\dQGPAEB.exe
  C:\Windows\System\dQGPAEB.exe
  2⤵
  PID:7420
- C:\Windows\System\hovLOBa.exe
  C:\Windows\System\hovLOBa.exe
  2⤵
  PID:7444
- C:\Windows\System\IFCCSux.exe
  C:\Windows\System\IFCCSux.exe
  2⤵
  PID:7460
- C:\Windows\System\SLmQOCo.exe
  C:\Windows\System\SLmQOCo.exe
  2⤵
  PID:7476
- C:\Windows\System\DzzByYw.exe
  C:\Windows\System\DzzByYw.exe
  2⤵
  PID:7492
- C:\Windows\System\VfVWFQo.exe
  C:\Windows\System\VfVWFQo.exe
  2⤵
  PID:7540
- C:\Windows\System\VXDTwZC.exe
  C:\Windows\System\VXDTwZC.exe
  2⤵
  PID:7556
- C:\Windows\System\jsxcYCG.exe
  C:\Windows\System\jsxcYCG.exe
  2⤵
  PID:7572
- C:\Windows\System\ysyezZD.exe
  C:\Windows\System\ysyezZD.exe
  2⤵
  PID:7592
- C:\Windows\System\DbeqNlJ.exe
  C:\Windows\System\DbeqNlJ.exe
  2⤵
  PID:7608
- C:\Windows\System\NuoBmoc.exe
  C:\Windows\System\NuoBmoc.exe
  2⤵
  PID:7632
- C:\Windows\System\ptPvwSm.exe
  C:\Windows\System\ptPvwSm.exe
  2⤵
  PID:7652
- C:\Windows\System\oXMnWUg.exe
  C:\Windows\System\oXMnWUg.exe
  2⤵
  PID:7668
- C:\Windows\System\vVLAsun.exe
  C:\Windows\System\vVLAsun.exe
  2⤵
  PID:7684
- C:\Windows\System\yybdvYi.exe
  C:\Windows\System\yybdvYi.exe
  2⤵
  PID:7700
- C:\Windows\System\kCmfmxa.exe
  C:\Windows\System\kCmfmxa.exe
  2⤵
  PID:7716
- C:\Windows\System\eueBrmB.exe
  C:\Windows\System\eueBrmB.exe
  2⤵
  PID:7740
- C:\Windows\System\wXiGbyv.exe
  C:\Windows\System\wXiGbyv.exe
  2⤵
  PID:7760
- C:\Windows\System\WaQFsxt.exe
  C:\Windows\System\WaQFsxt.exe
  2⤵
  PID:7808
- C:\Windows\System\XqdjPBT.exe
  C:\Windows\System\XqdjPBT.exe
  2⤵
  PID:7824
- C:\Windows\System\XezRiGJ.exe
  C:\Windows\System\XezRiGJ.exe
  2⤵
  PID:7844
- C:\Windows\System\MQSqKbC.exe
  C:\Windows\System\MQSqKbC.exe
  2⤵
  PID:7868
- C:\Windows\System\jXvfRJj.exe
  C:\Windows\System\jXvfRJj.exe
  2⤵
  PID:7888
- C:\Windows\System\xsFnJvG.exe
  C:\Windows\System\xsFnJvG.exe
  2⤵
  PID:7912
- C:\Windows\System\iufSqSa.exe
  C:\Windows\System\iufSqSa.exe
  2⤵
  PID:7928
- C:\Windows\System\ZuIQJmE.exe
  C:\Windows\System\ZuIQJmE.exe
  2⤵
  PID:7948
- C:\Windows\System\wBlFlAz.exe
  C:\Windows\System\wBlFlAz.exe
  2⤵
  PID:7976
- C:\Windows\System\WMFPSez.exe
  C:\Windows\System\WMFPSez.exe
  2⤵
  PID:7996
- C:\Windows\System\UUcDODL.exe
  C:\Windows\System\UUcDODL.exe
  2⤵
  PID:8012
- C:\Windows\System\QHmxxUi.exe
  C:\Windows\System\QHmxxUi.exe
  2⤵
  PID:8032
- C:\Windows\System\EtuWWOY.exe
  C:\Windows\System\EtuWWOY.exe
  2⤵
  PID:8048
- C:\Windows\System\lYiUhGb.exe
  C:\Windows\System\lYiUhGb.exe
  2⤵
  PID:8064
- C:\Windows\System\zafGuIb.exe
  C:\Windows\System\zafGuIb.exe
  2⤵
  PID:8088
- C:\Windows\System\CqUZfha.exe
  C:\Windows\System\CqUZfha.exe
  2⤵
  PID:8108
- C:\Windows\System\zkRuQxr.exe
  C:\Windows\System\zkRuQxr.exe
  2⤵
  PID:8124
- C:\Windows\System\hQtqDEP.exe
  C:\Windows\System\hQtqDEP.exe
  2⤵
  PID:8140
- C:\Windows\System\opMZRgk.exe
  C:\Windows\System\opMZRgk.exe
  2⤵
  PID:8156
- C:\Windows\System\LGtcNPp.exe
  C:\Windows\System\LGtcNPp.exe
  2⤵
  PID:8172
- C:\Windows\System\HwyDucd.exe
  C:\Windows\System\HwyDucd.exe
  2⤵
  PID:7180
- C:\Windows\System\XzGXYJM.exe
  C:\Windows\System\XzGXYJM.exe
  2⤵
  PID:7220
- C:\Windows\System\FJupayZ.exe
  C:\Windows\System\FJupayZ.exe
  2⤵
  PID:6908
- C:\Windows\System\MPjAZXL.exe
  C:\Windows\System\MPjAZXL.exe
  2⤵
  PID:6244
- C:\Windows\System\EvwzAOh.exe
  C:\Windows\System\EvwzAOh.exe
  2⤵
  PID:6380
- C:\Windows\System\UGrItuZ.exe
  C:\Windows\System\UGrItuZ.exe
  2⤵
  PID:7236
- C:\Windows\System\UyVRsWW.exe
  C:\Windows\System\UyVRsWW.exe
  2⤵
  PID:7060
- C:\Windows\System\TGfAegx.exe
  C:\Windows\System\TGfAegx.exe
  2⤵
  PID:7204
- C:\Windows\System\sKMoHLj.exe
  C:\Windows\System\sKMoHLj.exe
  2⤵
  PID:2212
- C:\Windows\System\QYQheXX.exe
  C:\Windows\System\QYQheXX.exe
  2⤵
  PID:7244
- C:\Windows\System\RBmOERy.exe
  C:\Windows\System\RBmOERy.exe
  2⤵
  PID:2568
- C:\Windows\System\PBTtJGr.exe
  C:\Windows\System\PBTtJGr.exe
  2⤵
  PID:2268
- C:\Windows\System\SOqoBal.exe
  C:\Windows\System\SOqoBal.exe
  2⤵
  PID:7360
- C:\Windows\System\crCRhfz.exe
  C:\Windows\System\crCRhfz.exe
  2⤵
  PID:2244
- C:\Windows\System\XXPvqAZ.exe
  C:\Windows\System\XXPvqAZ.exe
  2⤵
  PID:7452
- C:\Windows\System\sTzYbGZ.exe
  C:\Windows\System\sTzYbGZ.exe
  2⤵
  PID:7512
- C:\Windows\System\XZIsrWQ.exe
  C:\Windows\System\XZIsrWQ.exe
  2⤵
  PID:7524
- C:\Windows\System\kdBetJP.exe
  C:\Windows\System\kdBetJP.exe
  2⤵
  PID:6656
- C:\Windows\System\WevhZkM.exe
  C:\Windows\System\WevhZkM.exe
  2⤵
  PID:7288
- C:\Windows\System\uDuxyaG.exe
  C:\Windows\System\uDuxyaG.exe
  2⤵
  PID:7568
- C:\Windows\System\TsfoOaC.exe
  C:\Windows\System\TsfoOaC.exe
  2⤵
  PID:7676
- C:\Windows\System\fiuqrJL.exe
  C:\Windows\System\fiuqrJL.exe
  2⤵
  PID:7756
- C:\Windows\System\hLrnkEr.exe
  C:\Windows\System\hLrnkEr.exe
  2⤵
  PID:7580
- C:\Windows\System\JbLVvEw.exe
  C:\Windows\System\JbLVvEw.exe
  2⤵
  PID:7616
- C:\Windows\System\KFyVYnA.exe
  C:\Windows\System\KFyVYnA.exe
  2⤵
  PID:7724
- C:\Windows\System\gjgRfHk.exe
  C:\Windows\System\gjgRfHk.exe
  2⤵
  PID:7664
- C:\Windows\System\fEDdbGV.exe
  C:\Windows\System\fEDdbGV.exe
  2⤵
  PID:7780
- C:\Windows\System\RTyeIir.exe
  C:\Windows\System\RTyeIir.exe
  2⤵
  PID:7836
- C:\Windows\System\Pfvnrjd.exe
  C:\Windows\System\Pfvnrjd.exe
  2⤵
  PID:1744
- C:\Windows\System\ZEqnWJU.exe
  C:\Windows\System\ZEqnWJU.exe
  2⤵
  PID:844
- C:\Windows\System\kbZHnsJ.exe
  C:\Windows\System\kbZHnsJ.exe
  2⤵
  PID:7908
- C:\Windows\System\rdVqRgy.exe
  C:\Windows\System\rdVqRgy.exe
  2⤵
  PID:7880
- C:\Windows\System\djLUsuH.exe
  C:\Windows\System\djLUsuH.exe
  2⤵
  PID:7924
- C:\Windows\System\vJgkXZT.exe
  C:\Windows\System\vJgkXZT.exe
  2⤵
  PID:7964
- C:\Windows\System\IqgtlmR.exe
  C:\Windows\System\IqgtlmR.exe
  2⤵
  PID:8020
- C:\Windows\System\KGapIPT.exe
  C:\Windows\System\KGapIPT.exe
  2⤵
  PID:8060
- C:\Windows\System\akaOTzL.exe
  C:\Windows\System\akaOTzL.exe
  2⤵
  PID:2988
- C:\Windows\System\eQnrqhq.exe
  C:\Windows\System\eQnrqhq.exe
  2⤵
  PID:4176
- C:\Windows\System\vvmNjSF.exe
  C:\Windows\System\vvmNjSF.exe
  2⤵
  PID:8008
- C:\Windows\System\jrFWUaM.exe
  C:\Windows\System\jrFWUaM.exe
  2⤵
  PID:8040
- C:\Windows\System\sdBfTlh.exe
  C:\Windows\System\sdBfTlh.exe
  2⤵
  PID:8116
- C:\Windows\System\qTuEcCb.exe
  C:\Windows\System\qTuEcCb.exe
  2⤵
  PID:7224
- C:\Windows\System\IaIpuUq.exe
  C:\Windows\System\IaIpuUq.exe
  2⤵
  PID:7092
- C:\Windows\System\EnnshCd.exe
  C:\Windows\System\EnnshCd.exe
  2⤵
  PID:7392
- C:\Windows\System\JHDemxO.exe
  C:\Windows\System\JHDemxO.exe
  2⤵
  PID:7428
- C:\Windows\System\NHSPbXw.exe
  C:\Windows\System\NHSPbXw.exe
  2⤵
  PID:7188
- C:\Windows\System\cglNLsX.exe
  C:\Windows\System\cglNLsX.exe
  2⤵
  PID:6168
- C:\Windows\System\JfqAyGu.exe
  C:\Windows\System\JfqAyGu.exe
  2⤵
  PID:7320
- C:\Windows\System\aaDsskw.exe
  C:\Windows\System\aaDsskw.exe
  2⤵
  PID:7468
- C:\Windows\System\MjcmSSP.exe
  C:\Windows\System\MjcmSSP.exe
  2⤵
  PID:7500
- C:\Windows\System\ldGDeki.exe
  C:\Windows\System\ldGDeki.exe
  2⤵
  PID:7412
- C:\Windows\System\RVLLmTB.exe
  C:\Windows\System\RVLLmTB.exe
  2⤵
  PID:2496
- C:\Windows\System\IprMdUY.exe
  C:\Windows\System\IprMdUY.exe
  2⤵
  PID:7708
- C:\Windows\System\OXJjDcH.exe
  C:\Windows\System\OXJjDcH.exe
  2⤵
  PID:7816
- C:\Windows\System\nHANAHG.exe
  C:\Windows\System\nHANAHG.exe
  2⤵
  PID:7800
- C:\Windows\System\UqSBuVx.exe
  C:\Windows\System\UqSBuVx.exe
  2⤵
  PID:1756
- C:\Windows\System\cfbLcBv.exe
  C:\Windows\System\cfbLcBv.exe
  2⤵
  PID:7864
- C:\Windows\System\IpEKJxD.exe
  C:\Windows\System\IpEKJxD.exe
  2⤵
  PID:7960
- C:\Windows\System\qFbNITg.exe
  C:\Windows\System\qFbNITg.exe
  2⤵
  PID:8056
- C:\Windows\System\svgtcdd.exe
  C:\Windows\System\svgtcdd.exe
  2⤵
  PID:7516
- C:\Windows\System\dDnolMs.exe
  C:\Windows\System\dDnolMs.exe
  2⤵
  PID:8076
- C:\Windows\System\NVtKWYA.exe
  C:\Windows\System\NVtKWYA.exe
  2⤵
  PID:8080
- C:\Windows\System\KkNKQsF.exe
  C:\Windows\System\KkNKQsF.exe
  2⤵
  PID:7216
- C:\Windows\System\KQgVTsw.exe
  C:\Windows\System\KQgVTsw.exe
  2⤵
  PID:1568
- C:\Windows\System\PucmGjh.exe
  C:\Windows\System\PucmGjh.exe
  2⤵
  PID:7648
- C:\Windows\System\bxDheiy.exe
  C:\Windows\System\bxDheiy.exe
  2⤵
  PID:7200
- C:\Windows\System\rYCehOi.exe
  C:\Windows\System\rYCehOi.exe
  2⤵
  PID:7276
- C:\Windows\System\cJipRii.exe
  C:\Windows\System\cJipRii.exe
  2⤵
  PID:796
- C:\Windows\System\REgruZk.exe
  C:\Windows\System\REgruZk.exe
  2⤵
  PID:7900
- C:\Windows\System\QbsXbcs.exe
  C:\Windows\System\QbsXbcs.exe
  2⤵
  PID:5976
- C:\Windows\System\NzUApuV.exe
  C:\Windows\System\NzUApuV.exe
  2⤵
  PID:8168
- C:\Windows\System\qBjpiXl.exe
  C:\Windows\System\qBjpiXl.exe
  2⤵
  PID:7988
- C:\Windows\System\HpybqNg.exe
  C:\Windows\System\HpybqNg.exe
  2⤵
  PID:7340
- C:\Windows\System\OTfyGUn.exe
  C:\Windows\System\OTfyGUn.exe
  2⤵
  PID:6860
- C:\Windows\System\TlbCKDt.exe
  C:\Windows\System\TlbCKDt.exe
  2⤵
  PID:7108
- C:\Windows\System\CplNTgT.exe
  C:\Windows\System\CplNTgT.exe
  2⤵
  PID:7504
- C:\Windows\System\QghySAo.exe
  C:\Windows\System\QghySAo.exe
  2⤵
  PID:4376
- C:\Windows\System\owbKkuZ.exe
  C:\Windows\System\owbKkuZ.exe
  2⤵
  PID:4532
- C:\Windows\System\ollDkdj.exe
  C:\Windows\System\ollDkdj.exe
  2⤵
  PID:7792
- C:\Windows\System\LyLvqft.exe
  C:\Windows\System\LyLvqft.exe
  2⤵
  PID:7940
- C:\Windows\System\enBUnYY.exe
  C:\Windows\System\enBUnYY.exe
  2⤵
  PID:3968
- C:\Windows\System\uJtriSJ.exe
  C:\Windows\System\uJtriSJ.exe
  2⤵
  PID:3388
- C:\Windows\System\NvRcNFP.exe
  C:\Windows\System\NvRcNFP.exe
  2⤵
  PID:7252
- C:\Windows\System\TFDHAAb.exe
  C:\Windows\System\TFDHAAb.exe
  2⤵
  PID:7472
- C:\Windows\System\TInvQVy.exe
  C:\Windows\System\TInvQVy.exe
  2⤵
  PID:6216
- C:\Windows\System\HsXhgBm.exe
  C:\Windows\System\HsXhgBm.exe
  2⤵
  PID:8072
- C:\Windows\System\XUnvJac.exe
  C:\Windows\System\XUnvJac.exe
  2⤵
  PID:7528
- C:\Windows\System\RZEwwIq.exe
  C:\Windows\System\RZEwwIq.exe
  2⤵
  PID:4664
- C:\Windows\System\CDzTkXM.exe
  C:\Windows\System\CDzTkXM.exe
  2⤵
  PID:8188
- C:\Windows\System\gLpaMWU.exe
  C:\Windows\System\gLpaMWU.exe
  2⤵
  PID:7588
- C:\Windows\System\PHLELCb.exe
  C:\Windows\System\PHLELCb.exe
  2⤵
  PID:8004
- C:\Windows\System\aZvnEcn.exe
  C:\Windows\System\aZvnEcn.exe
  2⤵
  PID:7820
- C:\Windows\System\oDSefkr.exe
  C:\Windows\System\oDSefkr.exe
  2⤵
  PID:7692
- C:\Windows\System\eceXPLa.exe
  C:\Windows\System\eceXPLa.exe
  2⤵
  PID:7396
- C:\Windows\System\aqxbTRB.exe
  C:\Windows\System\aqxbTRB.exe
  2⤵
  PID:7776
- C:\Windows\System\ULwUdGa.exe
  C:\Windows\System\ULwUdGa.exe
  2⤵
  PID:8104
- C:\Windows\System\MSCygQh.exe
  C:\Windows\System\MSCygQh.exe
  2⤵
  PID:3980
- C:\Windows\System\lfJAxgL.exe
  C:\Windows\System\lfJAxgL.exe
  2⤵
  PID:8164
- C:\Windows\System\tIFhYaQ.exe
  C:\Windows\System\tIFhYaQ.exe
  2⤵
  PID:7604
- C:\Windows\System\ZvwiyiF.exe
  C:\Windows\System\ZvwiyiF.exe
  2⤵
  PID:4112
- C:\Windows\System\AIJVmxW.exe
  C:\Windows\System\AIJVmxW.exe
  2⤵
  PID:7328
- C:\Windows\System\WIjMcDQ.exe
  C:\Windows\System\WIjMcDQ.exe
  2⤵
  PID:8120
- C:\Windows\System\yRmuKAa.exe
  C:\Windows\System\yRmuKAa.exe
  2⤵
  PID:1612
- C:\Windows\System\lUOtsEL.exe
  C:\Windows\System\lUOtsEL.exe
  2⤵
  PID:8196
- C:\Windows\System\JkLrTUW.exe
  C:\Windows\System\JkLrTUW.exe
  2⤵
  PID:8212
- C:\Windows\System\NxTlVqI.exe
  C:\Windows\System\NxTlVqI.exe
  2⤵
  PID:8228
- C:\Windows\System\MDNdncB.exe
  C:\Windows\System\MDNdncB.exe
  2⤵
  PID:8244
- C:\Windows\System\UABmayM.exe
  C:\Windows\System\UABmayM.exe
  2⤵
  PID:8260
- C:\Windows\System\SHApekb.exe
  C:\Windows\System\SHApekb.exe
  2⤵
  PID:8276
- C:\Windows\System\dVHBMUT.exe
  C:\Windows\System\dVHBMUT.exe
  2⤵
  PID:8292
- C:\Windows\System\BlytehM.exe
  C:\Windows\System\BlytehM.exe
  2⤵
  PID:8312
- C:\Windows\System\tqKnbbb.exe
  C:\Windows\System\tqKnbbb.exe
  2⤵
  PID:8328
- C:\Windows\System\PemWTdD.exe
  C:\Windows\System\PemWTdD.exe
  2⤵
  PID:8344
- C:\Windows\System\AnIEiNr.exe
  C:\Windows\System\AnIEiNr.exe
  2⤵
  PID:8364
- C:\Windows\System\OxyFycP.exe
  C:\Windows\System\OxyFycP.exe
  2⤵
  PID:8420
- C:\Windows\System\WfPBxNq.exe
  C:\Windows\System\WfPBxNq.exe
  2⤵
  PID:8440
- C:\Windows\System\dUCPoHw.exe
  C:\Windows\System\dUCPoHw.exe
  2⤵
  PID:8456
- C:\Windows\System\tnopsct.exe
  C:\Windows\System\tnopsct.exe
  2⤵
  PID:8472
- C:\Windows\System\zNttQjA.exe
  C:\Windows\System\zNttQjA.exe
  2⤵
  PID:8492
- C:\Windows\System\nqKucYK.exe
  C:\Windows\System\nqKucYK.exe
  2⤵
  PID:8508
- C:\Windows\System\eFgKStb.exe
  C:\Windows\System\eFgKStb.exe
  2⤵
  PID:8528
- C:\Windows\System\sEsqQta.exe
  C:\Windows\System\sEsqQta.exe
  2⤵
  PID:8584
- C:\Windows\System\TRjVyMP.exe
  C:\Windows\System\TRjVyMP.exe
  2⤵
  PID:8600
- C:\Windows\System\HWCUwxr.exe
  C:\Windows\System\HWCUwxr.exe
  2⤵
  PID:8616
- C:\Windows\System\rrXpcTZ.exe
  C:\Windows\System\rrXpcTZ.exe
  2⤵
  PID:8632
- C:\Windows\System\jyEnZii.exe
  C:\Windows\System\jyEnZii.exe
  2⤵
  PID:8652
- C:\Windows\System\hBUXxNt.exe
  C:\Windows\System\hBUXxNt.exe
  2⤵
  PID:8672
- C:\Windows\System\oOPTCmZ.exe
  C:\Windows\System\oOPTCmZ.exe
  2⤵
  PID:8704
- C:\Windows\System\dspDrle.exe
  C:\Windows\System\dspDrle.exe
  2⤵
  PID:8720
- C:\Windows\System\jZNvLDQ.exe
  C:\Windows\System\jZNvLDQ.exe
  2⤵
  PID:8744
- C:\Windows\System\vchpARA.exe
  C:\Windows\System\vchpARA.exe
  2⤵
  PID:8760
- C:\Windows\System\vJHqMEf.exe
  C:\Windows\System\vJHqMEf.exe
  2⤵
  PID:8788
- C:\Windows\System\nTGDTHn.exe
  C:\Windows\System\nTGDTHn.exe
  2⤵
  PID:8804
- C:\Windows\System\UBWXJhh.exe
  C:\Windows\System\UBWXJhh.exe
  2⤵
  PID:8824
- C:\Windows\System\mqxLjKU.exe
  C:\Windows\System\mqxLjKU.exe
  2⤵
  PID:8844
- C:\Windows\System\PkWCvZy.exe
  C:\Windows\System\PkWCvZy.exe
  2⤵
  PID:8864
- C:\Windows\System\FQITYxd.exe
  C:\Windows\System\FQITYxd.exe
  2⤵
  PID:8884
- C:\Windows\System\aBLZoww.exe
  C:\Windows\System\aBLZoww.exe
  2⤵
  PID:8900
- C:\Windows\System\ZKEDFkN.exe
  C:\Windows\System\ZKEDFkN.exe
  2⤵
  PID:8920
- C:\Windows\System\Zzfcser.exe
  C:\Windows\System\Zzfcser.exe
  2⤵
  PID:8940
- C:\Windows\System\bMyTmBr.exe
  C:\Windows\System\bMyTmBr.exe
  2⤵
  PID:8976
- C:\Windows\System\JWTgnsB.exe
  C:\Windows\System\JWTgnsB.exe
  2⤵
  PID:8992
- C:\Windows\System\qdordTI.exe
  C:\Windows\System\qdordTI.exe
  2⤵
  PID:9008
- C:\Windows\System\UBHiFNo.exe
  C:\Windows\System\UBHiFNo.exe
  2⤵
  PID:9036
- C:\Windows\System\akmMHEe.exe
  C:\Windows\System\akmMHEe.exe
  2⤵
  PID:9052
- C:\Windows\System\wiaaNzb.exe
  C:\Windows\System\wiaaNzb.exe
  2⤵
  PID:9076
- C:\Windows\System\upmZthT.exe
  C:\Windows\System\upmZthT.exe
  2⤵
  PID:9092
- C:\Windows\System\MaHpZZU.exe
  C:\Windows\System\MaHpZZU.exe
  2⤵
  PID:9112
- C:\Windows\System\gptxQZq.exe
  C:\Windows\System\gptxQZq.exe
  2⤵
  PID:9128
- C:\Windows\System\RhMtSkz.exe
  C:\Windows\System\RhMtSkz.exe
  2⤵
  PID:9152
- C:\Windows\System\FbtpFwc.exe
  C:\Windows\System\FbtpFwc.exe
  2⤵
  PID:9168
- C:\Windows\System\HuWwemy.exe
  C:\Windows\System\HuWwemy.exe
  2⤵
  PID:9188
- C:\Windows\System\axLPNxh.exe
  C:\Windows\System\axLPNxh.exe
  2⤵
  PID:9204
- C:\Windows\System\oVbHkJv.exe
  C:\Windows\System\oVbHkJv.exe
  2⤵
  PID:8132
- C:\Windows\System\evvdABn.exe
  C:\Windows\System\evvdABn.exe
  2⤵
  PID:8252
- C:\Windows\System\jZVAPSf.exe
  C:\Windows\System\jZVAPSf.exe
  2⤵
  PID:8288
- C:\Windows\System\oJDhiha.exe
  C:\Windows\System\oJDhiha.exe
  2⤵
  PID:2656
- C:\Windows\System\ZRdwcSJ.exe
  C:\Windows\System\ZRdwcSJ.exe
  2⤵
  PID:6528
- C:\Windows\System\pmCfyWN.exe
  C:\Windows\System\pmCfyWN.exe
  2⤵
  PID:8372
- C:\Windows\System\rZPrGGw.exe
  C:\Windows\System\rZPrGGw.exe
  2⤵
  PID:8240
- C:\Windows\System\iOdFuxl.exe
  C:\Windows\System\iOdFuxl.exe
  2⤵
  PID:8340
- C:\Windows\System\XIIMpLP.exe
  C:\Windows\System\XIIMpLP.exe
  2⤵
  PID:7732
- C:\Windows\System\VFCGsUl.exe
  C:\Windows\System\VFCGsUl.exe
  2⤵
  PID:8384
- C:\Windows\System\RusySFf.exe
  C:\Windows\System\RusySFf.exe
  2⤵
  PID:2492
- C:\Windows\System\WSdQwYt.exe
  C:\Windows\System\WSdQwYt.exe
  2⤵
  PID:8536
- C:\Windows\System\xLCOfCX.exe
  C:\Windows\System\xLCOfCX.exe
  2⤵
  PID:8452
- C:\Windows\System\qiYawyG.exe
  C:\Windows\System\qiYawyG.exe
  2⤵
  PID:8488
- C:\Windows\System\Cdjddtv.exe
  C:\Windows\System\Cdjddtv.exe
  2⤵
  PID:8552
- C:\Windows\System\ULAXUNl.exe
  C:\Windows\System\ULAXUNl.exe
  2⤵
  PID:8564
- C:\Windows\System\gGCANaM.exe
  C:\Windows\System\gGCANaM.exe
  2⤵
  PID:8580
- C:\Windows\System\KnODEBq.exe
  C:\Windows\System\KnODEBq.exe
  2⤵
  PID:8644
- C:\Windows\System\OfkSuNN.exe
  C:\Windows\System\OfkSuNN.exe
  2⤵
  PID:8664
- C:\Windows\System\zsizxPb.exe
  C:\Windows\System\zsizxPb.exe
  2⤵
  PID:8668
- C:\Windows\System\kHjbOXU.exe
  C:\Windows\System\kHjbOXU.exe
  2⤵
  PID:8696
- C:\Windows\System\bMQQYjy.exe
  C:\Windows\System\bMQQYjy.exe
  2⤵
  PID:8716
- C:\Windows\System\UeivYTC.exe
  C:\Windows\System\UeivYTC.exe
  2⤵
  PID:8736
- C:\Windows\System\rKhuoFs.exe
  C:\Windows\System\rKhuoFs.exe
  2⤵
  PID:8796
- C:\Windows\System\NZSpNsP.exe
  C:\Windows\System\NZSpNsP.exe
  2⤵
  PID:8856
- C:\Windows\System\jpxwrvn.exe
  C:\Windows\System\jpxwrvn.exe
  2⤵
  PID:8860
- C:\Windows\System\XLJrzSq.exe
  C:\Windows\System\XLJrzSq.exe
  2⤵
  PID:8908
- C:\Windows\System\KMbMSXb.exe
  C:\Windows\System\KMbMSXb.exe
  2⤵
  PID:8932
- C:\Windows\System\mmvvqCZ.exe
  C:\Windows\System\mmvvqCZ.exe
  2⤵
  PID:8776
- C:\Windows\System\PFINTPT.exe
  C:\Windows\System\PFINTPT.exe
  2⤵
  PID:8984
- C:\Windows\System\kdZdaJZ.exe
  C:\Windows\System\kdZdaJZ.exe
  2⤵
  PID:9020
- C:\Windows\System\HbAiFgh.exe
  C:\Windows\System\HbAiFgh.exe
  2⤵
  PID:9064
- C:\Windows\System\hSJbtQd.exe
  C:\Windows\System\hSJbtQd.exe
  2⤵
  PID:9184
- C:\Windows\System\goLuhsj.exe
  C:\Windows\System\goLuhsj.exe
  2⤵
  PID:8256
- C:\Windows\System\TGRTjNI.exe
  C:\Windows\System\TGRTjNI.exe
  2⤵
  PID:9160
- C:\Windows\System\PidBhCF.exe
  C:\Windows\System\PidBhCF.exe
  2⤵
  PID:8436
- C:\Windows\System\gKXxRSr.exe
  C:\Windows\System\gKXxRSr.exe
  2⤵
  PID:8236
- C:\Windows\System\EYMuBaF.exe
  C:\Windows\System\EYMuBaF.exe
  2⤵
  PID:8300
- C:\Windows\System\MwyaKfH.exe
  C:\Windows\System\MwyaKfH.exe
  2⤵
  PID:8100
- C:\Windows\System\aJuktJt.exe
  C:\Windows\System\aJuktJt.exe
  2⤵
  PID:8308
- C:\Windows\System\vvUbugy.exe
  C:\Windows\System\vvUbugy.exe
  2⤵
  PID:8392
- C:\Windows\System\CwcIMeE.exe
  C:\Windows\System\CwcIMeE.exe
  2⤵
  PID:7920
- C:\Windows\System\QXGGxrN.exe
  C:\Windows\System\QXGGxrN.exe
  2⤵
  PID:8968
- C:\Windows\System\tAWBOGR.exe
  C:\Windows\System\tAWBOGR.exe
  2⤵
  PID:8548
- C:\Windows\System\OCfjgzD.exe
  C:\Windows\System\OCfjgzD.exe
  2⤵
  PID:8680
- C:\Windows\System\RUXwReu.exe
  C:\Windows\System\RUXwReu.exe
  2⤵
  PID:8812
- C:\Windows\System\PMpJAQl.exe
  C:\Windows\System\PMpJAQl.exe
  2⤵
  PID:8484
- C:\Windows\System\dHRYEsN.exe
  C:\Windows\System\dHRYEsN.exe
  2⤵
  PID:8480
- C:\Windows\System\NZwUVhT.exe
  C:\Windows\System\NZwUVhT.exe
  2⤵
  PID:8712
- C:\Windows\System\ZLZqcje.exe
  C:\Windows\System\ZLZqcje.exe
  2⤵
  PID:8660
- C:\Windows\System\wLwqDsr.exe
  C:\Windows\System\wLwqDsr.exe
  2⤵
  PID:8872
- C:\Windows\System\WvZzIGB.exe
  C:\Windows\System\WvZzIGB.exe
  2⤵
  PID:8952
- C:\Windows\System\qUTDvkD.exe
  C:\Windows\System\qUTDvkD.exe
  2⤵
  PID:9044
- C:\Windows\System\AfBhAdZ.exe
  C:\Windows\System\AfBhAdZ.exe
  2⤵
  PID:8916
- C:\Windows\System\ssrbIND.exe
  C:\Windows\System\ssrbIND.exe
  2⤵
  PID:9072
- C:\Windows\System\SSrWTHR.exe
  C:\Windows\System\SSrWTHR.exe
  2⤵
  PID:9140
- C:\Windows\System\elZQbUF.exe
  C:\Windows\System\elZQbUF.exe
  2⤵
  PID:9176
- C:\Windows\System\tXnLqqu.exe
  C:\Windows\System\tXnLqqu.exe
  2⤵
  PID:8284
- C:\Windows\System\ZJMKQTU.exe
  C:\Windows\System\ZJMKQTU.exe
  2⤵
  PID:9164
- C:\Windows\System\CBJujpJ.exe
  C:\Windows\System\CBJujpJ.exe
  2⤵
  PID:2300
- C:\Windows\System\NXBikBW.exe
  C:\Windows\System\NXBikBW.exe
  2⤵
  PID:8272
- C:\Windows\System\fIhOPCk.exe
  C:\Windows\System\fIhOPCk.exe
  2⤵
  PID:8896
- C:\Windows\System\skOxsiT.exe
  C:\Windows\System\skOxsiT.exe
  2⤵
  PID:8408
- C:\Windows\System\gPXrbhU.exe
  C:\Windows\System\gPXrbhU.exe
  2⤵
  PID:8612
- C:\Windows\System\xinmXBy.exe
  C:\Windows\System\xinmXBy.exe
  2⤵
  PID:9004
- C:\Windows\System\saLTmNU.exe
  C:\Windows\System\saLTmNU.exe
  2⤵
  PID:9060
- C:\Windows\System\NLZMJkH.exe
  C:\Windows\System\NLZMJkH.exe
  2⤵
  PID:8208
- C:\Windows\System\mRpfHDI.exe
  C:\Windows\System\mRpfHDI.exe
  2⤵
  PID:8544
- C:\Windows\System\oesPaQm.exe
  C:\Windows\System\oesPaQm.exe
  2⤵
  PID:8628
- C:\Windows\System\UEhjDjV.exe
  C:\Windows\System\UEhjDjV.exe
  2⤵
  PID:8780
- C:\Windows\System\AYRGkIX.exe
  C:\Windows\System\AYRGkIX.exe
  2⤵
  PID:8700
- C:\Windows\System\qGwpIIn.exe
  C:\Windows\System\qGwpIIn.exe
  2⤵
  PID:8960
- C:\Windows\System\mzluLWa.exe
  C:\Windows\System\mzluLWa.exe
  2⤵
  PID:1480
- C:\Windows\System\jTDUYwg.exe
  C:\Windows\System\jTDUYwg.exe
  2⤵
  PID:9124
- C:\Windows\System\yMZKRvg.exe
  C:\Windows\System\yMZKRvg.exe
  2⤵
  PID:8832
- C:\Windows\System\Rqbmtmj.exe
  C:\Windows\System\Rqbmtmj.exe
  2⤵
  PID:8352
- C:\Windows\System\KPMaCcs.exe
  C:\Windows\System\KPMaCcs.exe
  2⤵
  PID:8840
- C:\Windows\System\TYXhhUC.exe
  C:\Windows\System\TYXhhUC.exe
  2⤵
  PID:8324
- C:\Windows\System\VLEufzd.exe
  C:\Windows\System\VLEufzd.exe
  2⤵
  PID:8948
- C:\Windows\System\WuBBShl.exe
  C:\Windows\System\WuBBShl.exe
  2⤵
  PID:8224
- C:\Windows\System\ptOeDLT.exe
  C:\Windows\System\ptOeDLT.exe
  2⤵
  PID:8608
- C:\Windows\System\wMGqdpd.exe
  C:\Windows\System\wMGqdpd.exe
  2⤵
  PID:8692
- C:\Windows\System\MkyWVpr.exe
  C:\Windows\System\MkyWVpr.exe
  2⤵
  PID:9248
- C:\Windows\System\oQhNLzH.exe
  C:\Windows\System\oQhNLzH.exe
  2⤵
  PID:9268
- C:\Windows\System\yFHngQK.exe
  C:\Windows\System\yFHngQK.exe
  2⤵
  PID:9288
- C:\Windows\System\JJzCNFu.exe
  C:\Windows\System\JJzCNFu.exe
  2⤵
  PID:9312
- C:\Windows\System\lBKgmVT.exe
  C:\Windows\System\lBKgmVT.exe
  2⤵
  PID:9328
- C:\Windows\System\qGIuhyu.exe
  C:\Windows\System\qGIuhyu.exe
  2⤵
  PID:9344
- C:\Windows\System\hWqpjkq.exe
  C:\Windows\System\hWqpjkq.exe
  2⤵
  PID:9368
- C:\Windows\System\ZpIQYjU.exe
  C:\Windows\System\ZpIQYjU.exe
  2⤵
  PID:9384
- C:\Windows\System\FtxPcgL.exe
  C:\Windows\System\FtxPcgL.exe
  2⤵
  PID:9404
- C:\Windows\System\AnCZGXK.exe
  C:\Windows\System\AnCZGXK.exe
  2⤵
  PID:9420
- C:\Windows\System\CGiLgWO.exe
  C:\Windows\System\CGiLgWO.exe
  2⤵
  PID:9448
- C:\Windows\System\oDJwQHE.exe
  C:\Windows\System\oDJwQHE.exe
  2⤵
  PID:9472
- C:\Windows\System\whXABwt.exe
  C:\Windows\System\whXABwt.exe
  2⤵
  PID:9488
- C:\Windows\System\qFUThNh.exe
  C:\Windows\System\qFUThNh.exe
  2⤵
  PID:9504
- C:\Windows\System\CtEWFUU.exe
  C:\Windows\System\CtEWFUU.exe
  2⤵
  PID:9532
- C:\Windows\System\vYCIpVB.exe
  C:\Windows\System\vYCIpVB.exe
  2⤵
  PID:9556
- C:\Windows\System\rxVQIhe.exe
  C:\Windows\System\rxVQIhe.exe
  2⤵
  PID:9576
- C:\Windows\System\CgYNKWd.exe
  C:\Windows\System\CgYNKWd.exe
  2⤵
  PID:9592
- C:\Windows\System\MbuEBtc.exe
  C:\Windows\System\MbuEBtc.exe
  2⤵
  PID:9608
- C:\Windows\System\vuCBAPp.exe
  C:\Windows\System\vuCBAPp.exe
  2⤵
  PID:9632
- C:\Windows\System\rvcDGnH.exe
  C:\Windows\System\rvcDGnH.exe
  2⤵
  PID:9656
- C:\Windows\System\WjjPHHO.exe
  C:\Windows\System\WjjPHHO.exe
  2⤵
  PID:9672
- C:\Windows\System\gvpfUuL.exe
  C:\Windows\System\gvpfUuL.exe
  2⤵
  PID:9692
- C:\Windows\System\vwTxUFR.exe
  C:\Windows\System\vwTxUFR.exe
  2⤵
  PID:9712
- C:\Windows\System\FQmBOmK.exe
  C:\Windows\System\FQmBOmK.exe
  2⤵
  PID:9728
- C:\Windows\System\NrXTgtT.exe
  C:\Windows\System\NrXTgtT.exe
  2⤵
  PID:9744
- C:\Windows\System\WsTtEwG.exe
  C:\Windows\System\WsTtEwG.exe
  2⤵
  PID:9760
- C:\Windows\System\sXnhlfo.exe
  C:\Windows\System\sXnhlfo.exe
  2⤵
  PID:9776
- C:\Windows\System\CvcBmyy.exe
  C:\Windows\System\CvcBmyy.exe
  2⤵
  PID:9792
- C:\Windows\System\lKimYse.exe
  C:\Windows\System\lKimYse.exe
  2⤵
  PID:9808
- C:\Windows\System\GjjupdX.exe
  C:\Windows\System\GjjupdX.exe
  2⤵
  PID:9824
- C:\Windows\System\LnZdIwC.exe
  C:\Windows\System\LnZdIwC.exe
  2⤵
  PID:9840
- C:\Windows\System\BuyLhmu.exe
  C:\Windows\System\BuyLhmu.exe
  2⤵
  PID:9856
- C:\Windows\System\KcOilkv.exe
  C:\Windows\System\KcOilkv.exe
  2⤵
  PID:9872
- C:\Windows\System\diLkTeW.exe
  C:\Windows\System\diLkTeW.exe
  2⤵
  PID:9892
- C:\Windows\System\LXvmLrF.exe
  C:\Windows\System\LXvmLrF.exe
  2⤵
  PID:9908
- C:\Windows\System\XAKAlMV.exe
  C:\Windows\System\XAKAlMV.exe
  2⤵
  PID:9924
- C:\Windows\System\UUkhpPe.exe
  C:\Windows\System\UUkhpPe.exe
  2⤵
  PID:9940
- C:\Windows\System\CfiGkmy.exe
  C:\Windows\System\CfiGkmy.exe
  2⤵
  PID:9956
- C:\Windows\System\LlDCUyJ.exe
  C:\Windows\System\LlDCUyJ.exe
  2⤵
  PID:9972
- C:\Windows\System\jCyaORI.exe
  C:\Windows\System\jCyaORI.exe
  2⤵
  PID:9988
- C:\Windows\System\knGSkBY.exe
  C:\Windows\System\knGSkBY.exe
  2⤵
  PID:10004
- C:\Windows\System\AEhILEW.exe
  C:\Windows\System\AEhILEW.exe
  2⤵
  PID:10024
- C:\Windows\System\qbCPXoI.exe
  C:\Windows\System\qbCPXoI.exe
  2⤵
  PID:10040
- C:\Windows\System\XtDfbIK.exe
  C:\Windows\System\XtDfbIK.exe
  2⤵
  PID:10056
- C:\Windows\System\paPkxPs.exe
  C:\Windows\System\paPkxPs.exe
  2⤵
  PID:10072
- C:\Windows\System\DcNFQdc.exe
  C:\Windows\System\DcNFQdc.exe
  2⤵
  PID:10088
- C:\Windows\System\guaCTgm.exe
  C:\Windows\System\guaCTgm.exe
  2⤵
  PID:10104
- C:\Windows\System\YHiDqKK.exe
  C:\Windows\System\YHiDqKK.exe
  2⤵
  PID:10120
- C:\Windows\System\IHxACES.exe
  C:\Windows\System\IHxACES.exe
  2⤵
  PID:10136
- C:\Windows\System\sjXvJHt.exe
  C:\Windows\System\sjXvJHt.exe
  2⤵
  PID:10152
- C:\Windows\System\cJKhXYI.exe
  C:\Windows\System\cJKhXYI.exe
  2⤵
  PID:10172
- C:\Windows\System\VGoEnAY.exe
  C:\Windows\System\VGoEnAY.exe
  2⤵
  PID:10188
- C:\Windows\System\heramtW.exe
  C:\Windows\System\heramtW.exe
  2⤵
  PID:10208
- C:\Windows\System\mxfPlex.exe
  C:\Windows\System\mxfPlex.exe
  2⤵
  PID:9240
- C:\Windows\System\olsbduo.exe
  C:\Windows\System\olsbduo.exe
  2⤵
  PID:9304
- C:\Windows\System\PrsYXKN.exe
  C:\Windows\System\PrsYXKN.exe
  2⤵
  PID:9336
- C:\Windows\System\MEjPYZF.exe
  C:\Windows\System\MEjPYZF.exe
  2⤵
  PID:9364
- C:\Windows\System\eKDOOjS.exe
  C:\Windows\System\eKDOOjS.exe
  2⤵
  PID:9392
- C:\Windows\System\MdsAAuS.exe
  C:\Windows\System\MdsAAuS.exe
  2⤵
  PID:9412
- C:\Windows\System\TNFBNQg.exe
  C:\Windows\System\TNFBNQg.exe
  2⤵
  PID:9468
- C:\Windows\System\yaKbkKj.exe
  C:\Windows\System\yaKbkKj.exe
  2⤵
  PID:9484
- C:\Windows\System\NDcIkQD.exe
  C:\Windows\System\NDcIkQD.exe
  2⤵
  PID:9524
- C:\Windows\System\klyCDcB.exe
  C:\Windows\System\klyCDcB.exe
  2⤵
  PID:9544
- C:\Windows\System\bYdBaKA.exe
  C:\Windows\System\bYdBaKA.exe
  2⤵
  PID:9572
- C:\Windows\System\ziumDmz.exe
  C:\Windows\System\ziumDmz.exe
  2⤵
  PID:9604
- C:\Windows\System\PTTEmfG.exe
  C:\Windows\System\PTTEmfG.exe
  2⤵
  PID:9624
- C:\Windows\System\UoETlfD.exe
  C:\Windows\System\UoETlfD.exe
  2⤵
  PID:9652
- C:\Windows\System\hURroAN.exe
  C:\Windows\System\hURroAN.exe
  2⤵
  PID:9708
- C:\Windows\System\AiSgrOy.exe
  C:\Windows\System\AiSgrOy.exe
  2⤵
  PID:9784
- C:\Windows\System\zxcgzzt.exe
  C:\Windows\System\zxcgzzt.exe
  2⤵
  PID:9804
- C:\Windows\System\HVKWyeO.exe
  C:\Windows\System\HVKWyeO.exe
  2⤵
  PID:9932
- C:\Windows\System\wFnOXiC.exe
  C:\Windows\System\wFnOXiC.exe
  2⤵
  PID:10000
- C:\Windows\System\DAehxvx.exe
  C:\Windows\System\DAehxvx.exe
  2⤵
  PID:10068
- C:\Windows\System\dCgkzkR.exe
  C:\Windows\System\dCgkzkR.exe
  2⤵
  PID:10160
- C:\Windows\System\eLDuUse.exe
  C:\Windows\System\eLDuUse.exe
  2⤵
  PID:9720
- C:\Windows\System\fpZtkpP.exe
  C:\Windows\System\fpZtkpP.exe
  2⤵
  PID:9904
- C:\Windows\System\UofVCIS.exe
  C:\Windows\System\UofVCIS.exe
  2⤵
  PID:10216
- C:\Windows\System\kTsEQMq.exe
  C:\Windows\System\kTsEQMq.exe
  2⤵
  PID:10012
- C:\Windows\System\UUxbpdE.exe
  C:\Windows\System\UUxbpdE.exe
  2⤵
  PID:10080
- C:\Windows\System\sOsZYJf.exe
  C:\Windows\System\sOsZYJf.exe
  2⤵
  PID:10236
- C:\Windows\System\fvsfBih.exe
  C:\Windows\System\fvsfBih.exe
  2⤵
  PID:10180
- C:\Windows\System\qAxIGGA.exe
  C:\Windows\System\qAxIGGA.exe
  2⤵
  PID:8876
- C:\Windows\System\EaKbNkg.exe
  C:\Windows\System\EaKbNkg.exe
  2⤵
  PID:9920
- C:\Windows\System\llisPkl.exe
  C:\Windows\System\llisPkl.exe
  2⤵
  PID:9228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AajAxSO.exe

Filesize
2.2MB

MD5
93564dede3573c1eb18148eee96ed6fe

SHA1
0c7454121a81faf16fc2dbb4bdc6a3b436112254

SHA256
296effc5be4537b6a3f22801dc9e175b2c5c70c0fccc096ba1b5da3b3f73ed8f

SHA512
3be0579c6eb79a7074feab0a07b9d04480ae6958c8c9f1f566606638a97f6161c41b5ba2d9de83fce8bc2a7079aaa310a61498b44a4bd8ec5bf9d097ff00cce0

Download Submit
C:\Windows\system\CuHuVOM.exe

Filesize
2.4MB

MD5
badbf7a40608951371b821df899e28ae

SHA1
eacef7bb925be8a47d671200872891e37a7479d7

SHA256
73e09208d645a361288c0d12b46a1a229e1348778da3addbfc1587d7ab741f89

SHA512
b17d628d2a9a6d58e8f7db07c365aa80c55388f954febdb05315878c2725b4ee667ba0af5ce5a8e75fc32b7329aea5c58e65f21b1a770cde72b898e06116fa48

Download Submit
C:\Windows\system\FINhpsS.exe

Filesize
3.1MB

MD5
41b2b7250795d5de3a78f0f73f795f47

SHA1
502a66e9cc8ae89242e5ffc0da0c42f98101ac5d

SHA256
76c02905b2f7d977405fabf09244560e51674c2fc38a7ab9e2e12794831f43da

SHA512
d41993fbfd66607034a19740ff1648559a18a81e39a35a7724d6e40c65592f1bfedfdcff70de2424b6c91cb5593fe34669c8dd2b4650d7eb3faceb73820ebdaf

Download Submit
C:\Windows\system\IEKyKCN.exe

Filesize
3.2MB

MD5
017d9bad676b484a15bdda47855bfa07

SHA1
3a491d42dde44d14f86785b8845541d9488a1816

SHA256
950e97043de0c6c6cb151b69838eb1c9531bab2b1b7c51ae3ca566b1cb9d0fc5

SHA512
9dd37e00fbe339db084da379b0237f1a8a01b455dd0d38eaac5638649bddb248fc20131263bce2e379266a3836f33ab04fe634fc8c8fbff0ea851a4b09f5e9b3

Download Submit
C:\Windows\system\JBNJmGc.exe

Filesize
3.2MB

MD5
ad93daf9e89911c9707ce224886c99b0

SHA1
63eeaafab27a84819ec8b050aeadbb350f950858

SHA256
af55c3432286992204d20f1f1072d15627369946c766693d650276a7c234e060

SHA512
f04d1cca550645cb610c103a502a2ef1a030bd9a58dccee21f9a84bdd353b6bcbed98b316da10de8a397323ed22bed9a7e7ecd0c405d7f89e447feaa58e66b8b

Download Submit
C:\Windows\system\KFiBamG.exe

Filesize
3.2MB

MD5
5a459ad683fd6b055a2aca71a6c00255

SHA1
c6b4ab7f7035d6ca3fa79c176da18f4d7584b1f8

SHA256
b01a70940990dcba03dae455b30ff1e47ddd28f90f6e4cbcb179d7c1f5ff385a

SHA512
dbf08ce8fad87aefdd68b6505b028d15d75dd186c595e76439b8be34f853c35cc4772eb079b12215f5cf0317c14be1943daf99425b8941e4ce9f7adab7dc2993

Download Submit
C:\Windows\system\LLVGyTi.exe

Filesize
3.2MB

MD5
e9a903b1580af66706d05422ece27152

SHA1
3747c27a6b1aac91aeb19335e331748bb5926d26

SHA256
aa6aeae61bd2eda70f4fc8afc2dd49aee31d64fa328bd714abcdba3dc2ba6edd

SHA512
a2041ce19ec7c1ca7f01fa15333bcfd1abd8c109c863f9d2ddad918baa4f2276a60e8907402dd3c32594c022c974a3190c48abfa28fd6333bd56379a379e8d7d

Download Submit
C:\Windows\system\LnsaQoZ.exe

Filesize
1024KB

MD5
ccd7e31144c9a6c08a27e3bedd8595da

SHA1
7552e10ef0c413d55dd4eb57ab8f205b233df64e

SHA256
255ed5e02f8a0c643044a2516cf5a6f7f24e4307347872f0b33f6db87e9350a6

SHA512
c8fdef843fe6cf141f6e4a77f992721adc0be2aef770fad32a257fa90c32a312d6a7ae40aaaae8be5de0cfadb869a45cd1688821f5fabf67cadbfdb854c24ff3

Download Submit
C:\Windows\system\MIQcRCo.exe

Filesize
3.2MB

MD5
85a849a86961aed15be545ef49ba32cd

SHA1
63778a2c0fd0d736238ae3916c6dab2987f931f1

SHA256
3c54d78f7a7f5e5e090e66c7c9b92c21a2aa753d12aa23b24a05338b6302d874

SHA512
09810bad4087ef7cd69a188c8668a373cf8d5a602ce921b8fee6a855378f851a7cbd3287521eefa7f9f2b7fe1ca3b855abdb3b56ef8072329bf32c68ea23574f

Download Submit
C:\Windows\system\MYMiNYg.exe

Filesize
2.4MB

MD5
9e9a32be07c85579de3a42cae4a4ea89

SHA1
e5be9d2101e2d896061d697c427be4c23c625dd0

SHA256
5e8cfe58b1b9cd54d9bfa78c5e27ac08e84142f3d81ff57c174f274b4251367e

SHA512
2a747d2762c230fcc325e5b3af70655af25af54151f05384cbc182b249c74c461dff3f8c215bece582f0f69ea6b027f1d69ec68f91b21ef7530029ad3a1d5e83

Download Submit
C:\Windows\system\RFrlDwJ.exe

Filesize
3.2MB

MD5
bbf2b84b9c0034a972807a629507d295

SHA1
27ae61c2f99ce9da71836f17d71b2fdc689cfa6c

SHA256
00b9816249bd068e091231622400088be463e48cbb7aab14ec400fc17dac762e

SHA512
1d06c1307d17e8d4c01737940524c77399f9a7129880de3e910ddf245743fa8e8e74ee22afbab3904ad011e6dc74fe0e834f0bec0e961432e5198dff1347a782

Download Submit
C:\Windows\system\UJFOQoK.exe

Filesize
3.2MB

MD5
a2ccc82cff5bf59be37aed7f2d35b4e8

SHA1
8db3a94bfc4dfd93131098778c3c70d016ea69ea

SHA256
3b95f7044e2b5d89cdfe7103ea1af0e987db68a8308d3fd316a709755c4543e1

SHA512
6b5e6d84c736290c57075f766b975a508f62dbe5c35086394427903e31d86bd0e7666b1e3d061700d8b9a299eb491e8d57c64b6dd9c33a12efa0d949020038d9

Download Submit
C:\Windows\system\WYInhHn.exe

Filesize
3.2MB

MD5
fe200623697849c0a1f327e911f635d2

SHA1
e40b40389a6a9df8d8081d8832b2298c5eeb0845

SHA256
fca3f73c1df33d562556c0971664015eb3735cc0a2ed8e84a2a5b310d5781e95

SHA512
8090f1fbdb3464d8eeedb4ff3fa943900ea493d8fc22243228dba9b5f8fdf9247f4cbc3971f88785d2e90f2beee8981888f4ffd338ddf6b5a2c4aa2c4ba9360a

Download Submit
C:\Windows\system\XIjHKtn.exe

Filesize
3.2MB

MD5
cb51ff0b8ebae58d18033946d5c501d3

SHA1
3a499fb7fea183d274ae5e9c5135c2a27ed2f04c

SHA256
f81a10de302c5ce0d0625416d7a84b30b96b435e906111be45c0dc30f5c39e02

SHA512
ca4b65a5011043e2215056b4b03e7c12550b5fe2adf8b3ed089b5ef72b7b1a2e4d2cb6e515680a0f32381d733c43446f0b878ac1fccb1cc9f5c62e66aba6d57f

Download Submit
C:\Windows\system\XyXPMfb.exe

Filesize
1.1MB

MD5
0a323fa3eff823937fb239bff97f8086

SHA1
058088a28c3a2e5335928c4e7a4f25c8b6b8dd42

SHA256
9a7c837285b800a6910ed199e51f31de7a8baa8f1a6a4c5c6f31e3a56fda4ace

SHA512
66337544354be3bfef95541f7b11587f752b983efa4f6387e56ce2f9a67e99929119765c099468b624953a7a62401f09adff46f91edf457e3c3d5b2a1da23cc6

Download Submit
C:\Windows\system\aLTQNYp.exe

Filesize
3.2MB

MD5
af05fdf13e41299b83ff653fdaf81414

SHA1
03d6b80ce234cd595e88a27134c3c4e1f620baf7

SHA256
75546b0f8877184403b658bd8b2e7153252017cf0414f2f3b7cf2bbdb31dc45c

SHA512
9a76f2b782c6cf3bfe93f4ebb28b3748e34ffe7aa617920680b558824f8b6d1fb90adfb0b84dabe64e4d714acbf167ad273eb5d315ca653e9bc2ca30de06ac4f

Download Submit
C:\Windows\system\eqiZCoc.exe

Filesize
3.2MB

MD5
363d8ced6267c556880fbf7ad2848f11

SHA1
92cc8e6b2014c704ee52db2758416ffd46a2857d

SHA256
741d34a82524c2b137ebb712426aa6db8d0ac10e90f17765f83dc08417a5e5e5

SHA512
d88c12daefd99858aab8d2ddfaa6731a9662dfdd90c4f1ea5c1276289cbaf66995a9c65b54a8b28fe1744f5254f8067b6061ff4ee5c839b97bd937c736974abd

Download Submit
C:\Windows\system\glQZrfz.exe

Filesize
3.2MB

MD5
2acab0b7e78018e8cb2f53e218fedfce

SHA1
34ac6638db4cd435baecd96f6ef9b1fa0b277cb7

SHA256
fdf430ebdd4c0bc94a59031ddece593c43041af83bbdebdb80e7240387fff46d

SHA512
e1924124c9aa8608556e441f845da8033d5ce1ec49534721666666c7cada6be3086b73928e659fcf391d40a436dc3b5ecfadb8bc6ecb777eb5fbc0d7e828fd0b

Download Submit
C:\Windows\system\hScdSal.exe

Filesize
2.8MB

MD5
49e38c847996f90f8e92a80193dab3d7

SHA1
869f4308183e11ea290664673d748aa9daa86f1d

SHA256
3b0327d3678df44aa6b1abb5884f3956f54264d1e8b67bf45df242c25e82d703

SHA512
48991c17046f341cf5a1686f2f04e54a93863a71d05f71e80d4aff3b65a15ae25989b8453fd39052a10799221e14c321134500b61012bfa8e6eea8dff73f2ebb

Download Submit
C:\Windows\system\hsoerGZ.exe

Filesize
3.2MB

MD5
b045c36060243dd482967c153fc9030e

SHA1
00b89ce5bad5849c4adf4a12318376d3c53ac4a8

SHA256
fac95ea93364c148a8be9de1a92d04cd90eab7a89a87c1ed57c8696e177b2b8e

SHA512
495e41d34f8723a8cc3245fd19d294a48e260e95b1ab7c9d6087f15f05fce86749497d71db539e5961947773119dd7e288c87b612005fca08ca03f90282b0f86

Download Submit
C:\Windows\system\ihyKPFt.exe

Filesize
1.4MB

MD5
a6fca15c6f1b82902fa40217551a5dce

SHA1
cdbac7c814c5f3e71e2a153b641e40ce0589d501

SHA256
3ba6d22fa35dab250eefff04c343188557e3ed286fb6145ed4c2ea6f1a6e8775

SHA512
f28ec9135e630578e081aa0ac646039b1e580e8f68a413da70116b3f6a995b67d0d7dcc852a928bc57ac964e5b406c473a2e1622f62eb2e6e1afba8aeddee041

Download Submit
C:\Windows\system\kLiZOAT.exe

Filesize
3.0MB

MD5
6b579c30677d8235fa5bdaa307babb50

SHA1
db9d56029e9c748d5d067bb04bb27cebc2483192

SHA256
ca59a5fc89e70929fef5512ada69991e927a770f6d6f453872c58535f4df8200

SHA512
405748e8314cc44326f2776b0bc574b9d46f441db550995ebdb74691fc9eec162ca387f514732c7942d840086b79e011c4d03bf966b32df630b4b48392d8901c

Download Submit
C:\Windows\system\pVchSrg.exe

Filesize
3.2MB

MD5
5140f8349691efff72f060d9c365ace0

SHA1
e36429d73a28cf3fca324756df8c8a10a3785779

SHA256
01fb00c9a49adbac0bfb11d0267a81a320993002ea8e51a68b828012722f4520

SHA512
341daee5b6d444155a93fa3560a8a54ab65a12ab03ddfee263271ca45a2d2419dbe4429b49fac43e1fc2f6b7e66fbb9ad630ddfc43fd081d6b965397de08d202

Download Submit
C:\Windows\system\qHDYuRy.exe

Filesize
1.2MB

MD5
7f8e0a6822531fc1039d8a6bce159083

SHA1
47f95f1a7a9eaabad4c50ffd816906e278c8681b

SHA256
7a9b71aff99bdc53b469fe135d78fffcb8e850e481cd5dafb394f3135a4b110a

SHA512
3e01ce51d419b5de20cca0c3752b0e65c3202aa31ad07946000247de428decb271df4d7e3c87c55d789b045bebf11c9d1f77094a55f7186c779e72c45cd12ea4

Download Submit
C:\Windows\system\rgwQuFL.exe

Filesize
2.5MB

MD5
91ead158f504dc677ad6e05b9f25f85e

SHA1
46663be302df27b2c2037d985f44c2ea82fcad55

SHA256
89c465cbec6225b0abaee3e97366b35dd9ec364220ed027e19a80a11874cb16b

SHA512
0a0e78aaa036ed8f220d63a7634db34065861b07c14c99c847a2a37f19d4408defd4599a37e97e9fbbc705fac9bab0e400c61931e1d5d7a7a447d9c1849b25e2

Download Submit
C:\Windows\system\sTCAjcJ.exe

Filesize
3.2MB

MD5
a40525eb73dc8835f5a9f530da4abb12

SHA1
5eb7513fbc79d566187e75a484bd8a931cb56594

SHA256
332af842f1ff84badcb496524fca308bf0b93f5aec4abb0ec6de2bb3d0631eab

SHA512
7db26831407e3843a2df01a61f8c1fbad597a0a97e304004479aebb0ee035d1cdfdc677939279bfa9ca4a647e082d167765a0b4f7e3707119cf8b9adfbf929b2

Download Submit
\Windows\system\AajAxSO.exe

Filesize
2.6MB

MD5
e8edc528f7a63ccf95a0583c1ee25c8b

SHA1
d430e8659c4c326688de902b10c399c23af955d6

SHA256
a196d8bbd678b6358bc35a6cb64cdbd717b50867a61a6f8d4f525e44c85c9108

SHA512
5abb475f5ebac24e62e631c675339974c1a67b908a41cd4eec8d8667ff33568bbff7cbfd61718eac6933068648f5cd6f4bd05acd1b17a7c29f5ca3176bd9c586

Download Submit
\Windows\system\BImmILJ.exe

Filesize
3.2MB

MD5
efe2fa6c89fb8c0dcc0901e69184dba2

SHA1
9c9abbaa10c3349caaf679b6b1ecdb25785e33d2

SHA256
6068cc9ea24953f3d372d8bf30b2dbbbd186b1bc90c55ff200574d5c93b4b95e

SHA512
d1ad48269c50ef3e6f12489c3f8cf044e6cdef0ffeeaef0923d49b8bae75a4eacc93f41f62e079623a88902ba0f1e6a17ef98946f48729be9eca6be17c3b3cf8

Download Submit
\Windows\system\CuHuVOM.exe

Filesize
3.2MB

MD5
953d3d5e259a86926c42cfbc18550ca2

SHA1
498d68952bc1a7af6d42d645b0ba5354ed5a77a5

SHA256
eb3a82930b707d91cecde6d4a572d9ce10ae782f77c098f8ca74c6648a9e3b3c

SHA512
810841d8dfa04675a9e571c36522e307a403b8a69a6f36100ba8843499c42c4b334c3091b199c7b428b96eaaad58a6524736bb3f80b9f270235701e4e66657cb

Download Submit
\Windows\system\EGymjUf.exe

Filesize
1.9MB

MD5
cbcaa51d6f0323cf9fcfa6488e215f3c

SHA1
628ad0ee2a0d7793358f48f23061ff5f77d85855

SHA256
cd35f99f8c30df37c96a571ebafdac395b1c934accce104b64d04120ba9875e9

SHA512
006c8dbc39acc5fbc053ac48e144d968027eb11f14ee057f8b322bdbb5239608f665dcd5fc387026adf565351799311423b0c75016a4d67119f58320612cfee5

Download Submit
\Windows\system\JBNJmGc.exe

Filesize
1.9MB

MD5
381370c424c61ef49cea8ec9c4edbd99

SHA1
c69a81b501d09e89111bb81b35a3f2c5947bc20c

SHA256
84aaf7025436c5d4d214fdee66a7ab83f76f105d58ed06614f4611268f110ac4

SHA512
7264952e2188c1a7c81ec078ac2a4c4dc122b666631fa6da7af7e36385ed712f3da08e86a12cd0db8b0bcb6622d268566468d964bd3ea5d08c50d44fef607a31

Download Submit
\Windows\system\LnsaQoZ.exe

Filesize
3.3MB

MD5
2a23481faaed9f693594d48b0a2d46ff

SHA1
927c656877aa9ddd4fc537198f599ec77115c87d

SHA256
8a371afa3c57219d0b746c551b1a0b309285b0025966f66f0d8793a6144c4419

SHA512
de2c17a961f1d9bf2da0f216e65f579fead736b8555ff1dda53daaf896c9e850354911406f39652b2abf221dcbc6dd2f6c3dde70281fb0322b01b3b6a3d4b15a

Download Submit
\Windows\system\MYMiNYg.exe

Filesize
1.6MB

MD5
a4691b8e216cd611961da759b17ddf59

SHA1
58ad5f80132b11e7448194f826277c3d74552e19

SHA256
b5b196c78d296637ec4ebd7e2de6fe4c02d677cdd9368770a826d2b95dbfd3f3

SHA512
cfd7205c2cdc9378023b28107a5d3c149d4c7311c329b24b35cce017085e62dfee07a6d0773fee431fa72fb19373098afe10237442d4338094e561d8f6b4189f

Download Submit
\Windows\system\OvdXdda.exe

Filesize
2.1MB

MD5
8af96bcfc13b0d5dbab08789c15c6e24

SHA1
77d733b6f325014a0a62ba21be260aa575538951

SHA256
4dd40e4630cf39c99789b9fa37841700f107caabdcd863cb66dd9b5fdcbb4ea6

SHA512
bdf02986555fb862ac541b079aa7c11ae133a2d99c74148ae3881ed052853fd01e5910e31f84179af8369c9d016f67116452224318a11b08b026db9ebf16d9a4

Download Submit
\Windows\system\WeuUmnZ.exe

Filesize
2.9MB

MD5
e9c7a493bbfeb2ca440689195e31e4d6

SHA1
a1f6ce9f85be5eda1d60030ae463b15273ba9b5c

SHA256
e9efbeb8014eecd50a9e986108bcbcbcf44b87bad076196a509c4abde733a76d

SHA512
ef2184f0a9dea50a9a58a80c0550afd9ac1894b5cbe27fce28d9f671c37be3c5831b691c4c14b1debaca71f2784af4ea7beb3d659bffffde062f601a1a08b8e2

Download Submit
\Windows\system\XyXPMfb.exe

Filesize
2.7MB

MD5
96c58b94aadde0531995c0bc96def633

SHA1
875d30089e8565e70e3d19e5b587743c3b3b878b

SHA256
21092563ca11d333a77380df85ccfd06c37e4f879cbc80d6406192ab979a6ae8

SHA512
4c74930bddb12d793651d1749f64cf3844738bb151b5b9b0eba3b0c8408b12066a9f41b7a81b3282349b68f06cf1c50aded3351c84154bb69f2f8352ec5515c2

Download Submit
\Windows\system\aLTQNYp.exe

Filesize
2.6MB

MD5
e9f618213b05d531d163ec5dbe56700e

SHA1
49c0eb45ce631ec2149d6ef6ec4b7d018045b28a

SHA256
980ea1544279c348cac3cbcd8d23e5b76cb4af771d94838be0471ea4b5dca817

SHA512
7fbc280c0d31e488d9ec4e397353284d0d9d9af20cbe098738eb15334319d631b3c855f1a9c7018c908742b0649eb9eaf5af04022f06b603244239d52a02c8d3

Download Submit
\Windows\system\ihyKPFt.exe

Filesize
1.8MB

MD5
b23a38d7cf157978ef2b792dc63ab0d1

SHA1
0864858b1504c85110a73ed402bc86123955bd13

SHA256
e822984c8f3f7ae2b4bffba9ceef34f4161c0e68454182000ee79d3fd7aeaced

SHA512
143a7df4f2dd1189149e92476dc557691b3abd6019ba908f37e7fc9eaf852770f51de37b76a64f47d3b6c7396656403c27a12147dc2640c3a5f7605a215c035b

Download Submit
\Windows\system\jusWjAl.exe

Filesize
1.1MB

MD5
153b8ae141907f468179073fca5869c3

SHA1
3112e61d0879026aeeb160ddac250777b2be012f

SHA256
34fe9f400a6e97af045befd3271d7b8978c50144a79249607bb5a255fa9f1858

SHA512
e7fa23204cfd27c43b1a4aeeacb5a5d77548b127049c3fd133d4b3f2f752681339bfc43cc119763bd7720b9c1380318f49ebd4ce780c0ff41e0adf54802ee494

Download Submit
memory/112-772-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/112-4280-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/1636-392-0x000007FEF5970000-0x000007FEF630D000-memory.dmp

Filesize
9.6MB

Download
memory/1636-394-0x000007FEF5970000-0x000007FEF630D000-memory.dmp

Filesize
9.6MB

Download
memory/1636-395-0x000007FEF5970000-0x000007FEF630D000-memory.dmp

Filesize
9.6MB

Download
memory/1636-123-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/1636-122-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download
memory/1636-1040-0x000007FEF5970000-0x000007FEF630D000-memory.dmp

Filesize
9.6MB

Download
memory/1636-144-0x000007FEF5C2E000-0x000007FEF5C2F000-memory.dmp

Filesize
4KB

Download
memory/1652-608-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2384-4273-0x000000013F5E0000-0x000000013F9D6000-memory.dmp

Filesize
4.0MB

Download
memory/2384-719-0x000000013F5E0000-0x000000013F9D6000-memory.dmp

Filesize
4.0MB

Download
memory/2400-683-0x000000013F690000-0x000000013FA86000-memory.dmp

Filesize
4.0MB

Download
memory/2400-4270-0x000000013F690000-0x000000013FA86000-memory.dmp

Filesize
4.0MB

Download
memory/2428-716-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2428-4274-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2444-739-0x000000013F5B0000-0x000000013F9A6000-memory.dmp

Filesize
4.0MB

Download
memory/2488-622-0x000000013F740000-0x000000013FB36000-memory.dmp

Filesize
4.0MB

Download
memory/2508-699-0x000000013FFF0000-0x00000001403E6000-memory.dmp

Filesize
4.0MB

Download
memory/2508-4268-0x000000013FFF0000-0x00000001403E6000-memory.dmp

Filesize
4.0MB

Download
memory/2512-143-0x000000013F1A0000-0x000000013F596000-memory.dmp

Filesize
4.0MB

Download
memory/2528-525-0x000000013F400000-0x000000013F7F6000-memory.dmp

Filesize
4.0MB

Download
memory/2528-4258-0x000000013F400000-0x000000013F7F6000-memory.dmp

Filesize
4.0MB

Download
memory/2564-132-0x000000013F1E0000-0x000000013F5D6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3161-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3449-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-675-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-690-0x000000013FFF0000-0x00000001403E6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-113-0x000000013F1E0000-0x000000013F5D6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-707-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-717-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-733-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-746-0x000000013FCA0000-0x0000000140096000-memory.dmp

Filesize
4.0MB

Download
memory/2860-760-0x000000013F0F0000-0x000000013F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-602-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-614-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-2-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-396-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3448-0x000000013FCA0000-0x0000000140096000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3447-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3445-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3446-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3441-0x000000013FFF0000-0x00000001403E6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3438-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3439-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3440-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-3394-0x00000000031B0000-0x00000000035A6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2860-779-0x000000013F1A0000-0x000000013F596000-memory.dmp

Filesize
4.0MB

Download
memory/2908-4278-0x000000013FCA0000-0x0000000140096000-memory.dmp

Filesize
4.0MB

Download
memory/2908-754-0x000000013FCA0000-0x0000000140096000-memory.dmp

Filesize
4.0MB

Download