xmrig | 673ec9bac4756aa6e27456e504ddc9e76bc17cfa1375a0087c3df007c14452e0

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
Size

1.7MB
MD5

0b8f75c1fb317f8388256a2235fdf690
SHA1

acb31a1d5dde5f66f6c1bbefa838cad4a9941191
SHA256

673ec9bac4756aa6e27456e504ddc9e76bc17cfa1375a0087c3df007c14452e0
SHA512

dfc6ab2793b1642173da959964bfd42d58bf19dd808985dd908b78b0816feaf21836e0a8af319940c66e813311714922b085186b5159ad7a78ee9d2850cf95bd
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoCSxnhvuqAP9dbWmbOt0BXdnyr+Dh:Lz071uv4BPMkHC0I6GCInhG1dtdF2+Dh

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/1364-18-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2548-33-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2656-32-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2908-12-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2384-42-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2180-1079-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2908-1124-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2960-172-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2504-171-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/1436-170-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2180-168-0x0000000003530000-0x0000000003922000-memory.dmp	xmrig
behavioral1/memory/2464-167-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2620-132-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2960-5637-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2504-5635-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/1436-5633-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2384-5437-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2464-5433-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2656-5350-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2908-5398-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/1364-5354-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2908	jfpBhsp.exe
1364	RLlMmLA.exe
2656	dFGvxDe.exe
2548	kNhiNfl.exe
2384	RSwUdQg.exe
2620	TnHEeTm.exe
2464	ifutxln.exe
1436	FhrXmKk.exe
2504	YfElmWy.exe
2960	ZLVfSQI.exe
2900	JDgIjDK.exe
768	BTIEDPc.exe
1088	KjjxcNQ.exe
1988	WBPSNOn.exe
1068	pqILUYd.exe
1096	fJQrpMp.exe
900	iNpHWzM.exe
1628	gSgOSga.exe
1580	NMyuloB.exe
2680	iirKzAj.exe
1828	YJsylEa.exe
1492	LMlOypk.exe
1284	OApFleB.exe
1520	FVyXAVg.exe
1892	dJgfgzH.exe
2052	AwogKzq.exe
1880	GNLKMgh.exe
2004	lNwcLgG.exe
1752	UKtZMkZ.exe
804	foTnCGr.exe
1572	GCZXFha.exe
1772	HAHgewR.exe
2256	DGRefNb.exe
3008	ztTfcmw.exe
1524	ERrHgLF.exe
1856	ZpNrYuT.exe
380	NJwkyrn.exe
1400	FhMkaKC.exe
980	IyuSGCl.exe
2280	nvVuLfX.exe
2356	ZMAeGqI.exe
2996	raeTwZl.exe
656	AwaAwnr.exe
1236	YWQvmiS.exe
1968	xZVNolC.exe
2808	aosqeUZ.exe
3044	KPxqAAi.exe
2652	VzKztjx.exe
1552	UtfvXKf.exe
1336	rqyEeSa.exe
1060	bFPUSfc.exe
896	rdBLpEd.exe
2044	tdjLuDZ.exe
1568	xGljonj.exe
2268	AQrKCIf.exe
2456	rHEKCiS.exe
2220	natfyXQ.exe
1660	iuuEYZT.exe
2344	nGVEEyS.exe
1200	qagnETG.exe
2556	IYUwexA.exe
2108	hskvAdQ.exe
2748	RXDFEzi.exe
2208	AOnCTtw.exe

Loads dropped DLL 64 IoCs

pid	Process
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-0-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x000d00000001342b-3.dat	upx
behavioral1/files/0x00070000000141e6-19.dat	upx
behavioral1/files/0x000a000000013a21-8.dat	upx
behavioral1/memory/1364-18-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2548-33-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2656-32-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2180-35-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/files/0x00070000000142b0-34.dat	upx
behavioral1/files/0x00080000000141c0-24.dat	upx
behavioral1/memory/2908-12-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2384-42-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/files/0x000700000001448a-61.dat	upx
behavioral1/files/0x0006000000014539-79.dat	upx
behavioral1/files/0x00060000000155f3-149.dat	upx
behavioral1/files/0x0006000000015c3d-156.dat	upx
behavioral1/files/0x0006000000015605-151.dat	upx
behavioral1/files/0x0006000000015c6b-175.dat	upx
behavioral1/files/0x0006000000015018-148.dat	upx
behavioral1/files/0x0006000000015626-146.dat	upx
behavioral1/files/0x0009000000014390-60.dat	upx
behavioral1/files/0x0006000000014667-189.dat	upx
behavioral1/files/0x00060000000147ea-193.dat	upx
behavioral1/files/0x00060000000146b8-191.dat	upx
behavioral1/files/0x00070000000144ac-187.dat	upx
behavioral1/files/0x00060000000155ed-120.dat	upx
behavioral1/files/0x00060000000155f7-130.dat	upx
behavioral1/files/0x0006000000014ef8-114.dat	upx
behavioral1/files/0x0006000000014b70-108.dat	upx
behavioral1/memory/2180-1079-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2908-1124-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2960-172-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2504-171-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/1436-170-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2464-167-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/files/0x0006000000015c52-160.dat	upx
behavioral1/files/0x0006000000015b6f-153.dat	upx
behavioral1/files/0x0006000000014de9-145.dat	upx
behavioral1/files/0x0006000000014b31-144.dat	upx
behavioral1/files/0x0006000000014abe-143.dat	upx
behavioral1/files/0x0006000000014825-142.dat	upx
behavioral1/files/0x00060000000146c0-141.dat	upx
behavioral1/files/0x00060000000146a2-140.dat	upx
behavioral1/files/0x0006000000015616-137.dat	upx
behavioral1/memory/2620-132-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/files/0x0006000000014af6-101.dat	upx
behavioral1/files/0x00060000000149f5-95.dat	upx
behavioral1/files/0x000700000001447e-91.dat	upx
behavioral1/files/0x000a0000000143ec-75.dat	upx
behavioral1/files/0x0009000000014120-74.dat	upx
behavioral1/files/0x000f000000005578-45.dat	upx
behavioral1/memory/2960-5637-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2504-5635-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/1436-5633-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2384-5437-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2464-5433-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2656-5350-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2908-5398-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/1364-5354-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ARrnCcu.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\abDpURP.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\HicdvNu.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\cSqIWAn.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\LRXDfAV.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\QaduxTD.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\iJbwPCO.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\nXoXEHW.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\CBQgufy.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\VEGcAqb.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\WQaYKQb.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\bCfvmkd.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\NyAgeVb.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\tBstINO.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\bKmxWfv.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\nEgPMbP.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\sDoVtAe.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\kOsrCSI.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\vVUOduq.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\rAyZZQc.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\EWOFHBK.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\ngqfTKR.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\APcahPb.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\jrcHNSl.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\bFfZuRS.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\TjGEuOm.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\WlNCYFN.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\yitUdGV.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\yuycBty.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\rAJINNG.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\RMQHmRo.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\GrANaoI.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\UoryLOY.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\EDFcmUi.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\XmXkizl.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\NvmtLsT.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\njIDrcn.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\NltmsGV.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\lqjNnrl.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\OpDFjST.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\CBZqwQA.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\lUKdFPl.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\DgXVwwj.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\TNxHsqH.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\QaDhNQF.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\dNdsGIm.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\VVJjpVp.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\pJPjWIG.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\acXguJZ.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\WYQEQlN.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\JZHrnDD.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\fNfugTX.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\QXFoKbM.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\jaJlyHt.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\czuRNPj.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\rpfcAom.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\fHKWQFN.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\xSqBaWI.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\hGOfhwO.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\LFysTpx.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\QrVWzad.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\tnclWka.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\VxpnLBb.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
File created	C:\Windows\System\yCLlsHG.exe	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
Token: SeDebugPrivilege	2368	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2368	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2368	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2368	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2908	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	30
PID 2180 wrote to memory of 2908	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	30
PID 2180 wrote to memory of 2908	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	30
PID 2180 wrote to memory of 1364	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	31
PID 2180 wrote to memory of 1364	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	31
PID 2180 wrote to memory of 1364	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	31
PID 2180 wrote to memory of 2548	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	32
PID 2180 wrote to memory of 2548	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	32
PID 2180 wrote to memory of 2548	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	32
PID 2180 wrote to memory of 2656	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	33
PID 2180 wrote to memory of 2656	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	33
PID 2180 wrote to memory of 2656	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	33
PID 2180 wrote to memory of 2384	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	34
PID 2180 wrote to memory of 2384	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	34
PID 2180 wrote to memory of 2384	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	34
PID 2180 wrote to memory of 2620	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	35
PID 2180 wrote to memory of 2620	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	35
PID 2180 wrote to memory of 2620	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	35
PID 2180 wrote to memory of 1436	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	36
PID 2180 wrote to memory of 1436	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	36
PID 2180 wrote to memory of 1436	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	36
PID 2180 wrote to memory of 2464	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	37
PID 2180 wrote to memory of 2464	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	37
PID 2180 wrote to memory of 2464	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	37
PID 2180 wrote to memory of 2504	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	38
PID 2180 wrote to memory of 2504	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	38
PID 2180 wrote to memory of 2504	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	38
PID 2180 wrote to memory of 768	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	39
PID 2180 wrote to memory of 768	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	39
PID 2180 wrote to memory of 768	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	39
PID 2180 wrote to memory of 2960	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	40
PID 2180 wrote to memory of 2960	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	40
PID 2180 wrote to memory of 2960	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	40
PID 2180 wrote to memory of 1520	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	41
PID 2180 wrote to memory of 1520	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	41
PID 2180 wrote to memory of 1520	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	41
PID 2180 wrote to memory of 2900	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	42
PID 2180 wrote to memory of 2900	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	42
PID 2180 wrote to memory of 2900	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	42
PID 2180 wrote to memory of 1892	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	43
PID 2180 wrote to memory of 1892	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	43
PID 2180 wrote to memory of 1892	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	43
PID 2180 wrote to memory of 1088	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	44
PID 2180 wrote to memory of 1088	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	44
PID 2180 wrote to memory of 1088	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	44
PID 2180 wrote to memory of 2052	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	45
PID 2180 wrote to memory of 2052	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	45
PID 2180 wrote to memory of 2052	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	45
PID 2180 wrote to memory of 1988	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	46
PID 2180 wrote to memory of 1988	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	46
PID 2180 wrote to memory of 1988	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	46
PID 2180 wrote to memory of 1880	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	47
PID 2180 wrote to memory of 1880	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	47
PID 2180 wrote to memory of 1880	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	47
PID 2180 wrote to memory of 1068	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	48
PID 2180 wrote to memory of 1068	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	48
PID 2180 wrote to memory of 1068	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	48
PID 2180 wrote to memory of 2004	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	49
PID 2180 wrote to memory of 2004	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	49
PID 2180 wrote to memory of 2004	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	49
PID 2180 wrote to memory of 1096	2180	0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b8f75c1fb317f8388256a2235fdf690_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\System\jfpBhsp.exe
  C:\Windows\System\jfpBhsp.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\RLlMmLA.exe
  C:\Windows\System\RLlMmLA.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\kNhiNfl.exe
  C:\Windows\System\kNhiNfl.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\dFGvxDe.exe
  C:\Windows\System\dFGvxDe.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\RSwUdQg.exe
  C:\Windows\System\RSwUdQg.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\TnHEeTm.exe
  C:\Windows\System\TnHEeTm.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\FhrXmKk.exe
  C:\Windows\System\FhrXmKk.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\ifutxln.exe
  C:\Windows\System\ifutxln.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\YfElmWy.exe
  C:\Windows\System\YfElmWy.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\BTIEDPc.exe
  C:\Windows\System\BTIEDPc.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\ZLVfSQI.exe
  C:\Windows\System\ZLVfSQI.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\FVyXAVg.exe
  C:\Windows\System\FVyXAVg.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\JDgIjDK.exe
  C:\Windows\System\JDgIjDK.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\dJgfgzH.exe
  C:\Windows\System\dJgfgzH.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\KjjxcNQ.exe
  C:\Windows\System\KjjxcNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\AwogKzq.exe
  C:\Windows\System\AwogKzq.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\WBPSNOn.exe
  C:\Windows\System\WBPSNOn.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\GNLKMgh.exe
  C:\Windows\System\GNLKMgh.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\pqILUYd.exe
  C:\Windows\System\pqILUYd.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\lNwcLgG.exe
  C:\Windows\System\lNwcLgG.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\fJQrpMp.exe
  C:\Windows\System\fJQrpMp.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\UKtZMkZ.exe
  C:\Windows\System\UKtZMkZ.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\iNpHWzM.exe
  C:\Windows\System\iNpHWzM.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\foTnCGr.exe
  C:\Windows\System\foTnCGr.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\gSgOSga.exe
  C:\Windows\System\gSgOSga.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\GCZXFha.exe
  C:\Windows\System\GCZXFha.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\NMyuloB.exe
  C:\Windows\System\NMyuloB.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\HAHgewR.exe
  C:\Windows\System\HAHgewR.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\iirKzAj.exe
  C:\Windows\System\iirKzAj.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\DGRefNb.exe
  C:\Windows\System\DGRefNb.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\YJsylEa.exe
  C:\Windows\System\YJsylEa.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\ERrHgLF.exe
  C:\Windows\System\ERrHgLF.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\LMlOypk.exe
  C:\Windows\System\LMlOypk.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\ZpNrYuT.exe
  C:\Windows\System\ZpNrYuT.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\OApFleB.exe
  C:\Windows\System\OApFleB.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\NJwkyrn.exe
  C:\Windows\System\NJwkyrn.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\ztTfcmw.exe
  C:\Windows\System\ztTfcmw.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\FhMkaKC.exe
  C:\Windows\System\FhMkaKC.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\IyuSGCl.exe
  C:\Windows\System\IyuSGCl.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\nvVuLfX.exe
  C:\Windows\System\nvVuLfX.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ZMAeGqI.exe
  C:\Windows\System\ZMAeGqI.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\UtfvXKf.exe
  C:\Windows\System\UtfvXKf.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\raeTwZl.exe
  C:\Windows\System\raeTwZl.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\rqyEeSa.exe
  C:\Windows\System\rqyEeSa.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\AwaAwnr.exe
  C:\Windows\System\AwaAwnr.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\bFPUSfc.exe
  C:\Windows\System\bFPUSfc.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\YWQvmiS.exe
  C:\Windows\System\YWQvmiS.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\rdBLpEd.exe
  C:\Windows\System\rdBLpEd.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\xZVNolC.exe
  C:\Windows\System\xZVNolC.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\tdjLuDZ.exe
  C:\Windows\System\tdjLuDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\aosqeUZ.exe
  C:\Windows\System\aosqeUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\xGljonj.exe
  C:\Windows\System\xGljonj.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\KPxqAAi.exe
  C:\Windows\System\KPxqAAi.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\AQrKCIf.exe
  C:\Windows\System\AQrKCIf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\VzKztjx.exe
  C:\Windows\System\VzKztjx.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\natfyXQ.exe
  C:\Windows\System\natfyXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\rHEKCiS.exe
  C:\Windows\System\rHEKCiS.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\iuuEYZT.exe
  C:\Windows\System\iuuEYZT.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\nGVEEyS.exe
  C:\Windows\System\nGVEEyS.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\qagnETG.exe
  C:\Windows\System\qagnETG.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\IYUwexA.exe
  C:\Windows\System\IYUwexA.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\hskvAdQ.exe
  C:\Windows\System\hskvAdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\RXDFEzi.exe
  C:\Windows\System\RXDFEzi.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\AOnCTtw.exe
  C:\Windows\System\AOnCTtw.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\VEGcAqb.exe
  C:\Windows\System\VEGcAqb.exe
  2⤵
  PID:1076
- C:\Windows\System\yriDBdZ.exe
  C:\Windows\System\yriDBdZ.exe
  2⤵
  PID:1672
- C:\Windows\System\ibhikhO.exe
  C:\Windows\System\ibhikhO.exe
  2⤵
  PID:616
- C:\Windows\System\YdnZdPo.exe
  C:\Windows\System\YdnZdPo.exe
  2⤵
  PID:2544
- C:\Windows\System\VuHPGMF.exe
  C:\Windows\System\VuHPGMF.exe
  2⤵
  PID:1848
- C:\Windows\System\hDdUktw.exe
  C:\Windows\System\hDdUktw.exe
  2⤵
  PID:2092
- C:\Windows\System\xVNVDpc.exe
  C:\Windows\System\xVNVDpc.exe
  2⤵
  PID:1084
- C:\Windows\System\wVFgrDL.exe
  C:\Windows\System\wVFgrDL.exe
  2⤵
  PID:1092
- C:\Windows\System\WtSaInK.exe
  C:\Windows\System\WtSaInK.exe
  2⤵
  PID:1900
- C:\Windows\System\lELhIHM.exe
  C:\Windows\System\lELhIHM.exe
  2⤵
  PID:2552
- C:\Windows\System\xhKXyhH.exe
  C:\Windows\System\xhKXyhH.exe
  2⤵
  PID:2428
- C:\Windows\System\oLDJTvz.exe
  C:\Windows\System\oLDJTvz.exe
  2⤵
  PID:2308
- C:\Windows\System\tQbVgQJ.exe
  C:\Windows\System\tQbVgQJ.exe
  2⤵
  PID:2840
- C:\Windows\System\paRTnPG.exe
  C:\Windows\System\paRTnPG.exe
  2⤵
  PID:2272
- C:\Windows\System\fOTHOxx.exe
  C:\Windows\System\fOTHOxx.exe
  2⤵
  PID:1144
- C:\Windows\System\bgLYcvD.exe
  C:\Windows\System\bgLYcvD.exe
  2⤵
  PID:1852
- C:\Windows\System\QnDXylm.exe
  C:\Windows\System\QnDXylm.exe
  2⤵
  PID:2696
- C:\Windows\System\azRoPcF.exe
  C:\Windows\System\azRoPcF.exe
  2⤵
  PID:2460
- C:\Windows\System\TjGEuOm.exe
  C:\Windows\System\TjGEuOm.exe
  2⤵
  PID:2644
- C:\Windows\System\qUJuwcK.exe
  C:\Windows\System\qUJuwcK.exe
  2⤵
  PID:3052
- C:\Windows\System\wibjhZp.exe
  C:\Windows\System\wibjhZp.exe
  2⤵
  PID:704
- C:\Windows\System\NItOAzj.exe
  C:\Windows\System\NItOAzj.exe
  2⤵
  PID:2300
- C:\Windows\System\DuBNSgm.exe
  C:\Windows\System\DuBNSgm.exe
  2⤵
  PID:2744
- C:\Windows\System\IrHUBeW.exe
  C:\Windows\System\IrHUBeW.exe
  2⤵
  PID:1712
- C:\Windows\System\PKhGfPk.exe
  C:\Windows\System\PKhGfPk.exe
  2⤵
  PID:2888
- C:\Windows\System\mVWjvwK.exe
  C:\Windows\System\mVWjvwK.exe
  2⤵
  PID:320
- C:\Windows\System\kdYBHhN.exe
  C:\Windows\System\kdYBHhN.exe
  2⤵
  PID:1220
- C:\Windows\System\esDAALG.exe
  C:\Windows\System\esDAALG.exe
  2⤵
  PID:1576
- C:\Windows\System\lcyyyAd.exe
  C:\Windows\System\lcyyyAd.exe
  2⤵
  PID:2452
- C:\Windows\System\doyZJzI.exe
  C:\Windows\System\doyZJzI.exe
  2⤵
  PID:592
- C:\Windows\System\ZdSeRWv.exe
  C:\Windows\System\ZdSeRWv.exe
  2⤵
  PID:2740
- C:\Windows\System\dGqlGbY.exe
  C:\Windows\System\dGqlGbY.exe
  2⤵
  PID:1640
- C:\Windows\System\qkEHsoB.exe
  C:\Windows\System\qkEHsoB.exe
  2⤵
  PID:1588
- C:\Windows\System\RCpQOhZ.exe
  C:\Windows\System\RCpQOhZ.exe
  2⤵
  PID:2608
- C:\Windows\System\KyIJvlS.exe
  C:\Windows\System\KyIJvlS.exe
  2⤵
  PID:356
- C:\Windows\System\GkLIVYI.exe
  C:\Windows\System\GkLIVYI.exe
  2⤵
  PID:2388
- C:\Windows\System\HbSDqRf.exe
  C:\Windows\System\HbSDqRf.exe
  2⤵
  PID:1432
- C:\Windows\System\odgRCMr.exe
  C:\Windows\System\odgRCMr.exe
  2⤵
  PID:1680
- C:\Windows\System\vfEdYTD.exe
  C:\Windows\System\vfEdYTD.exe
  2⤵
  PID:2512
- C:\Windows\System\JErUVfr.exe
  C:\Windows\System\JErUVfr.exe
  2⤵
  PID:2972
- C:\Windows\System\STWXcth.exe
  C:\Windows\System\STWXcth.exe
  2⤵
  PID:1916
- C:\Windows\System\pEDJehZ.exe
  C:\Windows\System\pEDJehZ.exe
  2⤵
  PID:2616
- C:\Windows\System\kXIsWZL.exe
  C:\Windows\System\kXIsWZL.exe
  2⤵
  PID:1608
- C:\Windows\System\ZCAapOr.exe
  C:\Windows\System\ZCAapOr.exe
  2⤵
  PID:1740
- C:\Windows\System\wQEMJqG.exe
  C:\Windows\System\wQEMJqG.exe
  2⤵
  PID:2576
- C:\Windows\System\PvZYKts.exe
  C:\Windows\System\PvZYKts.exe
  2⤵
  PID:2476
- C:\Windows\System\jsKvWXt.exe
  C:\Windows\System\jsKvWXt.exe
  2⤵
  PID:2480
- C:\Windows\System\ygJIpns.exe
  C:\Windows\System\ygJIpns.exe
  2⤵
  PID:1824
- C:\Windows\System\gWPcIAf.exe
  C:\Windows\System\gWPcIAf.exe
  2⤵
  PID:2660
- C:\Windows\System\vHIMBAd.exe
  C:\Windows\System\vHIMBAd.exe
  2⤵
  PID:1872
- C:\Windows\System\XdpqPsP.exe
  C:\Windows\System\XdpqPsP.exe
  2⤵
  PID:984
- C:\Windows\System\IfAozHj.exe
  C:\Windows\System\IfAozHj.exe
  2⤵
  PID:2928
- C:\Windows\System\EmBnLvv.exe
  C:\Windows\System\EmBnLvv.exe
  2⤵
  PID:2768
- C:\Windows\System\LRlFlAB.exe
  C:\Windows\System\LRlFlAB.exe
  2⤵
  PID:2432
- C:\Windows\System\VuyYemw.exe
  C:\Windows\System\VuyYemw.exe
  2⤵
  PID:1908
- C:\Windows\System\zQobslv.exe
  C:\Windows\System\zQobslv.exe
  2⤵
  PID:568
- C:\Windows\System\AEFhwsx.exe
  C:\Windows\System\AEFhwsx.exe
  2⤵
  PID:1820
- C:\Windows\System\KPYGwCC.exe
  C:\Windows\System\KPYGwCC.exe
  2⤵
  PID:2060
- C:\Windows\System\XRQEjNc.exe
  C:\Windows\System\XRQEjNc.exe
  2⤵
  PID:3004
- C:\Windows\System\BrkDSBY.exe
  C:\Windows\System\BrkDSBY.exe
  2⤵
  PID:2852
- C:\Windows\System\lOzvYNK.exe
  C:\Windows\System\lOzvYNK.exe
  2⤵
  PID:1516
- C:\Windows\System\WTFuLtW.exe
  C:\Windows\System\WTFuLtW.exe
  2⤵
  PID:2212
- C:\Windows\System\EiPvHEb.exe
  C:\Windows\System\EiPvHEb.exe
  2⤵
  PID:1760
- C:\Windows\System\xBrdvFF.exe
  C:\Windows\System\xBrdvFF.exe
  2⤵
  PID:1192
- C:\Windows\System\yAzjINn.exe
  C:\Windows\System\yAzjINn.exe
  2⤵
  PID:1596
- C:\Windows\System\hxwjSea.exe
  C:\Windows\System\hxwjSea.exe
  2⤵
  PID:2764
- C:\Windows\System\EZeEuqj.exe
  C:\Windows\System\EZeEuqj.exe
  2⤵
  PID:2584
- C:\Windows\System\jXcbWsI.exe
  C:\Windows\System\jXcbWsI.exe
  2⤵
  PID:1544
- C:\Windows\System\tEADqWv.exe
  C:\Windows\System\tEADqWv.exe
  2⤵
  PID:2672
- C:\Windows\System\aHIDKvJ.exe
  C:\Windows\System\aHIDKvJ.exe
  2⤵
  PID:2144
- C:\Windows\System\ADuERsf.exe
  C:\Windows\System\ADuERsf.exe
  2⤵
  PID:2312
- C:\Windows\System\grTgtUT.exe
  C:\Windows\System\grTgtUT.exe
  2⤵
  PID:2588
- C:\Windows\System\SeUmvxw.exe
  C:\Windows\System\SeUmvxw.exe
  2⤵
  PID:1080
- C:\Windows\System\HlUbcRt.exe
  C:\Windows\System\HlUbcRt.exe
  2⤵
  PID:1464
- C:\Windows\System\igJZdNH.exe
  C:\Windows\System\igJZdNH.exe
  2⤵
  PID:3136
- C:\Windows\System\hLESrcR.exe
  C:\Windows\System\hLESrcR.exe
  2⤵
  PID:3156
- C:\Windows\System\DJVANhZ.exe
  C:\Windows\System\DJVANhZ.exe
  2⤵
  PID:3204
- C:\Windows\System\gJjDDYD.exe
  C:\Windows\System\gJjDDYD.exe
  2⤵
  PID:3220
- C:\Windows\System\LfHJOuQ.exe
  C:\Windows\System\LfHJOuQ.exe
  2⤵
  PID:3236
- C:\Windows\System\oxEWKlc.exe
  C:\Windows\System\oxEWKlc.exe
  2⤵
  PID:3252
- C:\Windows\System\dDKARRS.exe
  C:\Windows\System\dDKARRS.exe
  2⤵
  PID:3268
- C:\Windows\System\zasfFep.exe
  C:\Windows\System\zasfFep.exe
  2⤵
  PID:3284
- C:\Windows\System\qVmfubh.exe
  C:\Windows\System\qVmfubh.exe
  2⤵
  PID:3300
- C:\Windows\System\vkWUeod.exe
  C:\Windows\System\vkWUeod.exe
  2⤵
  PID:3316
- C:\Windows\System\aoTtxoY.exe
  C:\Windows\System\aoTtxoY.exe
  2⤵
  PID:3332
- C:\Windows\System\WbtHFuw.exe
  C:\Windows\System\WbtHFuw.exe
  2⤵
  PID:3348
- C:\Windows\System\uqFGgdW.exe
  C:\Windows\System\uqFGgdW.exe
  2⤵
  PID:3368
- C:\Windows\System\eihbTRV.exe
  C:\Windows\System\eihbTRV.exe
  2⤵
  PID:3384
- C:\Windows\System\QASxFAM.exe
  C:\Windows\System\QASxFAM.exe
  2⤵
  PID:3400
- C:\Windows\System\zUIlYRv.exe
  C:\Windows\System\zUIlYRv.exe
  2⤵
  PID:3468
- C:\Windows\System\NmBiELt.exe
  C:\Windows\System\NmBiELt.exe
  2⤵
  PID:3484
- C:\Windows\System\kOTMjDO.exe
  C:\Windows\System\kOTMjDO.exe
  2⤵
  PID:3500
- C:\Windows\System\FKALLqc.exe
  C:\Windows\System\FKALLqc.exe
  2⤵
  PID:3516
- C:\Windows\System\hRbwNKr.exe
  C:\Windows\System\hRbwNKr.exe
  2⤵
  PID:3532
- C:\Windows\System\hTdhjHW.exe
  C:\Windows\System\hTdhjHW.exe
  2⤵
  PID:3548
- C:\Windows\System\aTeNDWX.exe
  C:\Windows\System\aTeNDWX.exe
  2⤵
  PID:3564
- C:\Windows\System\RTLgubd.exe
  C:\Windows\System\RTLgubd.exe
  2⤵
  PID:3580
- C:\Windows\System\ycnsvjC.exe
  C:\Windows\System\ycnsvjC.exe
  2⤵
  PID:3596
- C:\Windows\System\UpgqQkb.exe
  C:\Windows\System\UpgqQkb.exe
  2⤵
  PID:3612
- C:\Windows\System\uBuEppw.exe
  C:\Windows\System\uBuEppw.exe
  2⤵
  PID:3628
- C:\Windows\System\QfEsUXH.exe
  C:\Windows\System\QfEsUXH.exe
  2⤵
  PID:3644
- C:\Windows\System\CkkirKG.exe
  C:\Windows\System\CkkirKG.exe
  2⤵
  PID:3660
- C:\Windows\System\WCxyvoS.exe
  C:\Windows\System\WCxyvoS.exe
  2⤵
  PID:3676
- C:\Windows\System\fbgYCVf.exe
  C:\Windows\System\fbgYCVf.exe
  2⤵
  PID:3692
- C:\Windows\System\mtoUgiw.exe
  C:\Windows\System\mtoUgiw.exe
  2⤵
  PID:3708
- C:\Windows\System\rHxMfrU.exe
  C:\Windows\System\rHxMfrU.exe
  2⤵
  PID:3724
- C:\Windows\System\RFIeHhl.exe
  C:\Windows\System\RFIeHhl.exe
  2⤵
  PID:3740
- C:\Windows\System\nsBnduh.exe
  C:\Windows\System\nsBnduh.exe
  2⤵
  PID:3756
- C:\Windows\System\MKcRhEl.exe
  C:\Windows\System\MKcRhEl.exe
  2⤵
  PID:3772
- C:\Windows\System\eMHsfgn.exe
  C:\Windows\System\eMHsfgn.exe
  2⤵
  PID:3788
- C:\Windows\System\ctEOEcb.exe
  C:\Windows\System\ctEOEcb.exe
  2⤵
  PID:3804
- C:\Windows\System\XbvTnID.exe
  C:\Windows\System\XbvTnID.exe
  2⤵
  PID:3820
- C:\Windows\System\iyAHtQb.exe
  C:\Windows\System\iyAHtQb.exe
  2⤵
  PID:3836
- C:\Windows\System\XeqZjDh.exe
  C:\Windows\System\XeqZjDh.exe
  2⤵
  PID:3856
- C:\Windows\System\EfsrvWa.exe
  C:\Windows\System\EfsrvWa.exe
  2⤵
  PID:3872
- C:\Windows\System\unzDMkY.exe
  C:\Windows\System\unzDMkY.exe
  2⤵
  PID:3888
- C:\Windows\System\CGuNcCl.exe
  C:\Windows\System\CGuNcCl.exe
  2⤵
  PID:3904
- C:\Windows\System\BUoAUfF.exe
  C:\Windows\System\BUoAUfF.exe
  2⤵
  PID:3920
- C:\Windows\System\YPXJsqd.exe
  C:\Windows\System\YPXJsqd.exe
  2⤵
  PID:3936
- C:\Windows\System\ToRlCty.exe
  C:\Windows\System\ToRlCty.exe
  2⤵
  PID:3952
- C:\Windows\System\FYqdnia.exe
  C:\Windows\System\FYqdnia.exe
  2⤵
  PID:3968
- C:\Windows\System\kILIzjt.exe
  C:\Windows\System\kILIzjt.exe
  2⤵
  PID:3988
- C:\Windows\System\oJeeOje.exe
  C:\Windows\System\oJeeOje.exe
  2⤵
  PID:4004
- C:\Windows\System\XadXOPY.exe
  C:\Windows\System\XadXOPY.exe
  2⤵
  PID:4020
- C:\Windows\System\MwAipZl.exe
  C:\Windows\System\MwAipZl.exe
  2⤵
  PID:4036
- C:\Windows\System\xNGdbaC.exe
  C:\Windows\System\xNGdbaC.exe
  2⤵
  PID:4052
- C:\Windows\System\OHngoWt.exe
  C:\Windows\System\OHngoWt.exe
  2⤵
  PID:4068
- C:\Windows\System\vccNVrS.exe
  C:\Windows\System\vccNVrS.exe
  2⤵
  PID:3080
- C:\Windows\System\qakaJxe.exe
  C:\Windows\System\qakaJxe.exe
  2⤵
  PID:3104
- C:\Windows\System\VfCeDtY.exe
  C:\Windows\System\VfCeDtY.exe
  2⤵
  PID:3168
- C:\Windows\System\wgGEimQ.exe
  C:\Windows\System\wgGEimQ.exe
  2⤵
  PID:3180
- C:\Windows\System\lApFZCe.exe
  C:\Windows\System\lApFZCe.exe
  2⤵
  PID:3260
- C:\Windows\System\btXlVLc.exe
  C:\Windows\System\btXlVLc.exe
  2⤵
  PID:3324
- C:\Windows\System\eASBxGP.exe
  C:\Windows\System\eASBxGP.exe
  2⤵
  PID:3392
- C:\Windows\System\SQYJNkc.exe
  C:\Windows\System\SQYJNkc.exe
  2⤵
  PID:3380
- C:\Windows\System\ZJaTBcb.exe
  C:\Windows\System\ZJaTBcb.exe
  2⤵
  PID:3280
- C:\Windows\System\ClKvzwl.exe
  C:\Windows\System\ClKvzwl.exe
  2⤵
  PID:3416
- C:\Windows\System\ZuncjSm.exe
  C:\Windows\System\ZuncjSm.exe
  2⤵
  PID:3436
- C:\Windows\System\hkCMEov.exe
  C:\Windows\System\hkCMEov.exe
  2⤵
  PID:3452
- C:\Windows\System\OzGngTl.exe
  C:\Windows\System\OzGngTl.exe
  2⤵
  PID:3524
- C:\Windows\System\KTkwpsw.exe
  C:\Windows\System\KTkwpsw.exe
  2⤵
  PID:3588
- C:\Windows\System\rPRvwBm.exe
  C:\Windows\System\rPRvwBm.exe
  2⤵
  PID:3652
- C:\Windows\System\TfQLGzA.exe
  C:\Windows\System\TfQLGzA.exe
  2⤵
  PID:3688
- C:\Windows\System\NOTGCmR.exe
  C:\Windows\System\NOTGCmR.exe
  2⤵
  PID:3700
- C:\Windows\System\BydAomp.exe
  C:\Windows\System\BydAomp.exe
  2⤵
  PID:3768
- C:\Windows\System\hJmXTTm.exe
  C:\Windows\System\hJmXTTm.exe
  2⤵
  PID:3716
- C:\Windows\System\yrQzevT.exe
  C:\Windows\System\yrQzevT.exe
  2⤵
  PID:3780
- C:\Windows\System\WsPqVNt.exe
  C:\Windows\System\WsPqVNt.exe
  2⤵
  PID:3864
- C:\Windows\System\kKhAYhU.exe
  C:\Windows\System\kKhAYhU.exe
  2⤵
  PID:3964
- C:\Windows\System\maZPibf.exe
  C:\Windows\System\maZPibf.exe
  2⤵
  PID:3884
- C:\Windows\System\ZpuOHTR.exe
  C:\Windows\System\ZpuOHTR.exe
  2⤵
  PID:3948
- C:\Windows\System\eyBYxyh.exe
  C:\Windows\System\eyBYxyh.exe
  2⤵
  PID:4016
- C:\Windows\System\sabUUcq.exe
  C:\Windows\System\sabUUcq.exe
  2⤵
  PID:4084
- C:\Windows\System\NnBwFgc.exe
  C:\Windows\System\NnBwFgc.exe
  2⤵
  PID:1420
- C:\Windows\System\iwrNsZF.exe
  C:\Windows\System\iwrNsZF.exe
  2⤵
  PID:1536
- C:\Windows\System\WbMMvAX.exe
  C:\Windows\System\WbMMvAX.exe
  2⤵
  PID:2484
- C:\Windows\System\WlkyISG.exe
  C:\Windows\System\WlkyISG.exe
  2⤵
  PID:2132
- C:\Windows\System\YUAmVaf.exe
  C:\Windows\System\YUAmVaf.exe
  2⤵
  PID:2472
- C:\Windows\System\RofwOiv.exe
  C:\Windows\System\RofwOiv.exe
  2⤵
  PID:3024
- C:\Windows\System\VApOzQe.exe
  C:\Windows\System\VApOzQe.exe
  2⤵
  PID:1072
- C:\Windows\System\iZXMKGu.exe
  C:\Windows\System\iZXMKGu.exe
  2⤵
  PID:1736
- C:\Windows\System\NuDdbks.exe
  C:\Windows\System\NuDdbks.exe
  2⤵
  PID:1652
- C:\Windows\System\qwzcZJA.exe
  C:\Windows\System\qwzcZJA.exe
  2⤵
  PID:3736
- C:\Windows\System\lRVHWjx.exe
  C:\Windows\System\lRVHWjx.exe
  2⤵
  PID:4032
- C:\Windows\System\CbIOFvz.exe
  C:\Windows\System\CbIOFvz.exe
  2⤵
  PID:3124
- C:\Windows\System\ElletWn.exe
  C:\Windows\System\ElletWn.exe
  2⤵
  PID:3576
- C:\Windows\System\fVvgLTE.exe
  C:\Windows\System\fVvgLTE.exe
  2⤵
  PID:2700
- C:\Windows\System\TibZeao.exe
  C:\Windows\System\TibZeao.exe
  2⤵
  PID:3100
- C:\Windows\System\FCOAkze.exe
  C:\Windows\System\FCOAkze.exe
  2⤵
  PID:3184
- C:\Windows\System\OeVtfDf.exe
  C:\Windows\System\OeVtfDf.exe
  2⤵
  PID:2076
- C:\Windows\System\ofauPTj.exe
  C:\Windows\System\ofauPTj.exe
  2⤵
  PID:3232
- C:\Windows\System\zwrXnna.exe
  C:\Windows\System\zwrXnna.exe
  2⤵
  PID:3360
- C:\Windows\System\GMfAsQR.exe
  C:\Windows\System\GMfAsQR.exe
  2⤵
  PID:3216
- C:\Windows\System\IzpTRAD.exe
  C:\Windows\System\IzpTRAD.exe
  2⤵
  PID:3340
- C:\Windows\System\iIKSndX.exe
  C:\Windows\System\iIKSndX.exe
  2⤵
  PID:3408
- C:\Windows\System\NqUEZta.exe
  C:\Windows\System\NqUEZta.exe
  2⤵
  PID:3432
- C:\Windows\System\QQtZTVZ.exe
  C:\Windows\System\QQtZTVZ.exe
  2⤵
  PID:3492
- C:\Windows\System\rmLJUyq.exe
  C:\Windows\System\rmLJUyq.exe
  2⤵
  PID:1348
- C:\Windows\System\DlZaqmo.exe
  C:\Windows\System\DlZaqmo.exe
  2⤵
  PID:1748
- C:\Windows\System\rGKXdRY.exe
  C:\Windows\System\rGKXdRY.exe
  2⤵
  PID:412
- C:\Windows\System\heFxBCa.exe
  C:\Windows\System\heFxBCa.exe
  2⤵
  PID:748
- C:\Windows\System\ThCOUYL.exe
  C:\Windows\System\ThCOUYL.exe
  2⤵
  PID:3560
- C:\Windows\System\KLfBrmJ.exe
  C:\Windows\System\KLfBrmJ.exe
  2⤵
  PID:3732
- C:\Windows\System\BkRdbYB.exe
  C:\Windows\System\BkRdbYB.exe
  2⤵
  PID:3668
- C:\Windows\System\NyccaSh.exe
  C:\Windows\System\NyccaSh.exe
  2⤵
  PID:3844
- C:\Windows\System\KSVxeWY.exe
  C:\Windows\System\KSVxeWY.exe
  2⤵
  PID:3816
- C:\Windows\System\CBZqwQA.exe
  C:\Windows\System\CBZqwQA.exe
  2⤵
  PID:3932
- C:\Windows\System\AhdrviO.exe
  C:\Windows\System\AhdrviO.exe
  2⤵
  PID:2592
- C:\Windows\System\rMHgpXD.exe
  C:\Windows\System\rMHgpXD.exe
  2⤵
  PID:4048
- C:\Windows\System\kiXjYws.exe
  C:\Windows\System\kiXjYws.exe
  2⤵
  PID:4012
- C:\Windows\System\jLMlhFV.exe
  C:\Windows\System\jLMlhFV.exe
  2⤵
  PID:1816
- C:\Windows\System\jksrbAr.exe
  C:\Windows\System\jksrbAr.exe
  2⤵
  PID:4104
- C:\Windows\System\pnSYrMy.exe
  C:\Windows\System\pnSYrMy.exe
  2⤵
  PID:4120
- C:\Windows\System\euByHDp.exe
  C:\Windows\System\euByHDp.exe
  2⤵
  PID:4136
- C:\Windows\System\xwzWOZK.exe
  C:\Windows\System\xwzWOZK.exe
  2⤵
  PID:4152
- C:\Windows\System\xfuiBIT.exe
  C:\Windows\System\xfuiBIT.exe
  2⤵
  PID:4172
- C:\Windows\System\tMwcPzO.exe
  C:\Windows\System\tMwcPzO.exe
  2⤵
  PID:4188
- C:\Windows\System\NBsoyKr.exe
  C:\Windows\System\NBsoyKr.exe
  2⤵
  PID:4204
- C:\Windows\System\KYKSxJn.exe
  C:\Windows\System\KYKSxJn.exe
  2⤵
  PID:4220
- C:\Windows\System\zocrFvc.exe
  C:\Windows\System\zocrFvc.exe
  2⤵
  PID:4240
- C:\Windows\System\xoEyADj.exe
  C:\Windows\System\xoEyADj.exe
  2⤵
  PID:4256
- C:\Windows\System\lYsCdiX.exe
  C:\Windows\System\lYsCdiX.exe
  2⤵
  PID:4272
- C:\Windows\System\cpdpuaL.exe
  C:\Windows\System\cpdpuaL.exe
  2⤵
  PID:4288
- C:\Windows\System\ChAkaGG.exe
  C:\Windows\System\ChAkaGG.exe
  2⤵
  PID:4304
- C:\Windows\System\OFBqUSc.exe
  C:\Windows\System\OFBqUSc.exe
  2⤵
  PID:4320
- C:\Windows\System\YPLKToo.exe
  C:\Windows\System\YPLKToo.exe
  2⤵
  PID:4340
- C:\Windows\System\pWskMdv.exe
  C:\Windows\System\pWskMdv.exe
  2⤵
  PID:4356
- C:\Windows\System\XMlvdZq.exe
  C:\Windows\System\XMlvdZq.exe
  2⤵
  PID:4372
- C:\Windows\System\jYVcozG.exe
  C:\Windows\System\jYVcozG.exe
  2⤵
  PID:4388
- C:\Windows\System\QlhCHju.exe
  C:\Windows\System\QlhCHju.exe
  2⤵
  PID:4404
- C:\Windows\System\bxIdRFB.exe
  C:\Windows\System\bxIdRFB.exe
  2⤵
  PID:4420
- C:\Windows\System\IOFfRnw.exe
  C:\Windows\System\IOFfRnw.exe
  2⤵
  PID:4436
- C:\Windows\System\IsetCtQ.exe
  C:\Windows\System\IsetCtQ.exe
  2⤵
  PID:4452
- C:\Windows\System\xjGkZUQ.exe
  C:\Windows\System\xjGkZUQ.exe
  2⤵
  PID:4472
- C:\Windows\System\vavePSJ.exe
  C:\Windows\System\vavePSJ.exe
  2⤵
  PID:4488
- C:\Windows\System\yWzSZqg.exe
  C:\Windows\System\yWzSZqg.exe
  2⤵
  PID:4564
- C:\Windows\System\wpADdWa.exe
  C:\Windows\System\wpADdWa.exe
  2⤵
  PID:4584
- C:\Windows\System\gEQaJLQ.exe
  C:\Windows\System\gEQaJLQ.exe
  2⤵
  PID:4600
- C:\Windows\System\xPQRIZR.exe
  C:\Windows\System\xPQRIZR.exe
  2⤵
  PID:4616
- C:\Windows\System\bHtDdtO.exe
  C:\Windows\System\bHtDdtO.exe
  2⤵
  PID:4632
- C:\Windows\System\scSOQqc.exe
  C:\Windows\System\scSOQqc.exe
  2⤵
  PID:4648
- C:\Windows\System\HTFYXyi.exe
  C:\Windows\System\HTFYXyi.exe
  2⤵
  PID:4664
- C:\Windows\System\LTavFdX.exe
  C:\Windows\System\LTavFdX.exe
  2⤵
  PID:4680
- C:\Windows\System\JbShKUp.exe
  C:\Windows\System\JbShKUp.exe
  2⤵
  PID:4696
- C:\Windows\System\nNmwaXO.exe
  C:\Windows\System\nNmwaXO.exe
  2⤵
  PID:4712
- C:\Windows\System\wiqEaDV.exe
  C:\Windows\System\wiqEaDV.exe
  2⤵
  PID:4728
- C:\Windows\System\lcXtItB.exe
  C:\Windows\System\lcXtItB.exe
  2⤵
  PID:4744
- C:\Windows\System\UkheoKE.exe
  C:\Windows\System\UkheoKE.exe
  2⤵
  PID:4760
- C:\Windows\System\BIuLsGy.exe
  C:\Windows\System\BIuLsGy.exe
  2⤵
  PID:4776
- C:\Windows\System\QExWQij.exe
  C:\Windows\System\QExWQij.exe
  2⤵
  PID:4792
- C:\Windows\System\ISlloxM.exe
  C:\Windows\System\ISlloxM.exe
  2⤵
  PID:4808
- C:\Windows\System\PJQAVCY.exe
  C:\Windows\System\PJQAVCY.exe
  2⤵
  PID:4824
- C:\Windows\System\wawjuYJ.exe
  C:\Windows\System\wawjuYJ.exe
  2⤵
  PID:4840
- C:\Windows\System\PLUwTqC.exe
  C:\Windows\System\PLUwTqC.exe
  2⤵
  PID:4856
- C:\Windows\System\MxKIbAR.exe
  C:\Windows\System\MxKIbAR.exe
  2⤵
  PID:4876
- C:\Windows\System\WgYoiBV.exe
  C:\Windows\System\WgYoiBV.exe
  2⤵
  PID:4892
- C:\Windows\System\YCgpnbw.exe
  C:\Windows\System\YCgpnbw.exe
  2⤵
  PID:4908
- C:\Windows\System\lsEeIMt.exe
  C:\Windows\System\lsEeIMt.exe
  2⤵
  PID:4924
- C:\Windows\System\aCRMHDJ.exe
  C:\Windows\System\aCRMHDJ.exe
  2⤵
  PID:4940
- C:\Windows\System\IvmiKbR.exe
  C:\Windows\System\IvmiKbR.exe
  2⤵
  PID:4956
- C:\Windows\System\QBPfGTx.exe
  C:\Windows\System\QBPfGTx.exe
  2⤵
  PID:4972
- C:\Windows\System\BiuaMTH.exe
  C:\Windows\System\BiuaMTH.exe
  2⤵
  PID:4988
- C:\Windows\System\TwhbVeW.exe
  C:\Windows\System\TwhbVeW.exe
  2⤵
  PID:5004
- C:\Windows\System\DjqywPS.exe
  C:\Windows\System\DjqywPS.exe
  2⤵
  PID:5020
- C:\Windows\System\qjXnAGI.exe
  C:\Windows\System\qjXnAGI.exe
  2⤵
  PID:5036
- C:\Windows\System\LSdsiZT.exe
  C:\Windows\System\LSdsiZT.exe
  2⤵
  PID:5052
- C:\Windows\System\jWcJkHW.exe
  C:\Windows\System\jWcJkHW.exe
  2⤵
  PID:5068
- C:\Windows\System\QBaebFZ.exe
  C:\Windows\System\QBaebFZ.exe
  2⤵
  PID:5112
- C:\Windows\System\QnxWbNe.exe
  C:\Windows\System\QnxWbNe.exe
  2⤵
  PID:3128
- C:\Windows\System\iIBnHLS.exe
  C:\Windows\System\iIBnHLS.exe
  2⤵
  PID:324
- C:\Windows\System\pqrfFwa.exe
  C:\Windows\System\pqrfFwa.exe
  2⤵
  PID:2020
- C:\Windows\System\JBaSRSz.exe
  C:\Windows\System\JBaSRSz.exe
  2⤵
  PID:1016
- C:\Windows\System\wXonMvK.exe
  C:\Windows\System\wXonMvK.exe
  2⤵
  PID:3480
- C:\Windows\System\eSIlLHY.exe
  C:\Windows\System\eSIlLHY.exe
  2⤵
  PID:3800
- C:\Windows\System\uWYGngw.exe
  C:\Windows\System\uWYGngw.exe
  2⤵
  PID:3960
- C:\Windows\System\vMKPLjk.exe
  C:\Windows\System\vMKPLjk.exe
  2⤵
  PID:4116
- C:\Windows\System\XTDyvBl.exe
  C:\Windows\System\XTDyvBl.exe
  2⤵
  PID:4312
- C:\Windows\System\stGPaoj.exe
  C:\Windows\System\stGPaoj.exe
  2⤵
  PID:1676
- C:\Windows\System\zAnNuSP.exe
  C:\Windows\System\zAnNuSP.exe
  2⤵
  PID:3572
- C:\Windows\System\hdcLaXB.exe
  C:\Windows\System\hdcLaXB.exe
  2⤵
  PID:3868
- C:\Windows\System\lnvtgxs.exe
  C:\Windows\System\lnvtgxs.exe
  2⤵
  PID:3084
- C:\Windows\System\ToLmsWe.exe
  C:\Windows\System\ToLmsWe.exe
  2⤵
  PID:1556
- C:\Windows\System\zecvDeA.exe
  C:\Windows\System\zecvDeA.exe
  2⤵
  PID:3292
- C:\Windows\System\ekQEwMc.exe
  C:\Windows\System\ekQEwMc.exe
  2⤵
  PID:3428
- C:\Windows\System\bgCKyvo.exe
  C:\Windows\System\bgCKyvo.exe
  2⤵
  PID:1600
- C:\Windows\System\ankBWsg.exe
  C:\Windows\System\ankBWsg.exe
  2⤵
  PID:3748
- C:\Windows\System\QGaTimP.exe
  C:\Windows\System\QGaTimP.exe
  2⤵
  PID:3980
- C:\Windows\System\JhpktCS.exe
  C:\Windows\System\JhpktCS.exe
  2⤵
  PID:2536
- C:\Windows\System\XsllGCr.exe
  C:\Windows\System\XsllGCr.exe
  2⤵
  PID:4160
- C:\Windows\System\VOGsbCr.exe
  C:\Windows\System\VOGsbCr.exe
  2⤵
  PID:4200
- C:\Windows\System\XzJYWTx.exe
  C:\Windows\System\XzJYWTx.exe
  2⤵
  PID:4264
- C:\Windows\System\XbwScvg.exe
  C:\Windows\System\XbwScvg.exe
  2⤵
  PID:4328
- C:\Windows\System\WgUMaJi.exe
  C:\Windows\System\WgUMaJi.exe
  2⤵
  PID:4508
- C:\Windows\System\lRPqDpD.exe
  C:\Windows\System\lRPqDpD.exe
  2⤵
  PID:4412
- C:\Windows\System\yRTcDpA.exe
  C:\Windows\System\yRTcDpA.exe
  2⤵
  PID:4580
- C:\Windows\System\GCOgypV.exe
  C:\Windows\System\GCOgypV.exe
  2⤵
  PID:4608
- C:\Windows\System\xENTzMg.exe
  C:\Windows\System\xENTzMg.exe
  2⤵
  PID:4804
- C:\Windows\System\amqTpVT.exe
  C:\Windows\System\amqTpVT.exe
  2⤵
  PID:4952
- C:\Windows\System\LGEGQVw.exe
  C:\Windows\System\LGEGQVw.exe
  2⤵
  PID:5080
- C:\Windows\System\IbUGNNg.exe
  C:\Windows\System\IbUGNNg.exe
  2⤵
  PID:5104
- C:\Windows\System\LEuJqMs.exe
  C:\Windows\System\LEuJqMs.exe
  2⤵
  PID:3276
- C:\Windows\System\UEUJwjZ.exe
  C:\Windows\System\UEUJwjZ.exe
  2⤵
  PID:4216
- C:\Windows\System\IyfDTct.exe
  C:\Windows\System\IyfDTct.exe
  2⤵
  PID:4212
- C:\Windows\System\mVOenrY.exe
  C:\Windows\System\mVOenrY.exe
  2⤵
  PID:3152
- C:\Windows\System\skXEmkD.exe
  C:\Windows\System\skXEmkD.exe
  2⤵
  PID:3420
- C:\Windows\System\czXxmnr.exe
  C:\Windows\System\czXxmnr.exe
  2⤵
  PID:2572
- C:\Windows\System\RlQSSoh.exe
  C:\Windows\System\RlQSSoh.exe
  2⤵
  PID:4520
- C:\Windows\System\OlthorJ.exe
  C:\Windows\System\OlthorJ.exe
  2⤵
  PID:2824
- C:\Windows\System\LseYoII.exe
  C:\Windows\System\LseYoII.exe
  2⤵
  PID:4128
- C:\Windows\System\hFKUpRH.exe
  C:\Windows\System\hFKUpRH.exe
  2⤵
  PID:4428
- C:\Windows\System\eomHTXj.exe
  C:\Windows\System\eomHTXj.exe
  2⤵
  PID:4132
- C:\Windows\System\tBstINO.exe
  C:\Windows\System\tBstINO.exe
  2⤵
  PID:3608
- C:\Windows\System\ZlusbcO.exe
  C:\Windows\System\ZlusbcO.exe
  2⤵
  PID:3412
- C:\Windows\System\cDWyEuY.exe
  C:\Windows\System\cDWyEuY.exe
  2⤵
  PID:2336
- C:\Windows\System\XZrqPpL.exe
  C:\Windows\System\XZrqPpL.exe
  2⤵
  PID:4464
- C:\Windows\System\VJvskMN.exe
  C:\Windows\System\VJvskMN.exe
  2⤵
  PID:4544
- C:\Windows\System\hQzaMDX.exe
  C:\Windows\System\hQzaMDX.exe
  2⤵
  PID:4548
- C:\Windows\System\sMwAdcZ.exe
  C:\Windows\System\sMwAdcZ.exe
  2⤵
  PID:1528
- C:\Windows\System\RJpLpjL.exe
  C:\Windows\System\RJpLpjL.exe
  2⤵
  PID:4576
- C:\Windows\System\JSOoxju.exe
  C:\Windows\System\JSOoxju.exe
  2⤵
  PID:4468
- C:\Windows\System\YGirlVE.exe
  C:\Windows\System\YGirlVE.exe
  2⤵
  PID:4644
- C:\Windows\System\pZOAwlq.exe
  C:\Windows\System\pZOAwlq.exe
  2⤵
  PID:4736
- C:\Windows\System\VuQHxSa.exe
  C:\Windows\System\VuQHxSa.exe
  2⤵
  PID:4708
- C:\Windows\System\IcHyipN.exe
  C:\Windows\System\IcHyipN.exe
  2⤵
  PID:4872
- C:\Windows\System\QNlcGdo.exe
  C:\Windows\System\QNlcGdo.exe
  2⤵
  PID:4936
- C:\Windows\System\QvrRwaX.exe
  C:\Windows\System\QvrRwaX.exe
  2⤵
  PID:5028
- C:\Windows\System\kgKZyMp.exe
  C:\Windows\System\kgKZyMp.exe
  2⤵
  PID:5064
- C:\Windows\System\yXKwvVa.exe
  C:\Windows\System\yXKwvVa.exe
  2⤵
  PID:4064
- C:\Windows\System\LhrCLky.exe
  C:\Windows\System\LhrCLky.exe
  2⤵
  PID:4720
- C:\Windows\System\HhPacrl.exe
  C:\Windows\System\HhPacrl.exe
  2⤵
  PID:4784
- C:\Windows\System\YvtVSlm.exe
  C:\Windows\System\YvtVSlm.exe
  2⤵
  PID:4884
- C:\Windows\System\AKioCNl.exe
  C:\Windows\System\AKioCNl.exe
  2⤵
  PID:5044
- C:\Windows\System\HfuYxmZ.exe
  C:\Windows\System\HfuYxmZ.exe
  2⤵
  PID:5092
- C:\Windows\System\DQDzTjy.exe
  C:\Windows\System\DQDzTjy.exe
  2⤵
  PID:5100
- C:\Windows\System\GXjWZyM.exe
  C:\Windows\System\GXjWZyM.exe
  2⤵
  PID:3944
- C:\Windows\System\sJntYeV.exe
  C:\Windows\System\sJntYeV.exe
  2⤵
  PID:3464
- C:\Windows\System\aIzMvTY.exe
  C:\Windows\System\aIzMvTY.exe
  2⤵
  PID:4280
- C:\Windows\System\QQmWKea.exe
  C:\Windows\System\QQmWKea.exe
  2⤵
  PID:4000
- C:\Windows\System\aXJGfod.exe
  C:\Windows\System\aXJGfod.exe
  2⤵
  PID:4196
- C:\Windows\System\EFCMHdy.exe
  C:\Windows\System\EFCMHdy.exe
  2⤵
  PID:4512
- C:\Windows\System\hVxbzWa.exe
  C:\Windows\System\hVxbzWa.exe
  2⤵
  PID:4028
- C:\Windows\System\HBmqwPB.exe
  C:\Windows\System\HBmqwPB.exe
  2⤵
  PID:4504
- C:\Windows\System\WlNCYFN.exe
  C:\Windows\System\WlNCYFN.exe
  2⤵
  PID:2916
- C:\Windows\System\QCyzLzW.exe
  C:\Windows\System\QCyzLzW.exe
  2⤵
  PID:4496
- C:\Windows\System\GHkgxOi.exe
  C:\Windows\System\GHkgxOi.exe
  2⤵
  PID:1768
- C:\Windows\System\oNdTbLa.exe
  C:\Windows\System\oNdTbLa.exe
  2⤵
  PID:4332
- C:\Windows\System\qjSgSPz.exe
  C:\Windows\System\qjSgSPz.exe
  2⤵
  PID:1888
- C:\Windows\System\HBKvGTF.exe
  C:\Windows\System\HBKvGTF.exe
  2⤵
  PID:4612
- C:\Windows\System\EUNRlgr.exe
  C:\Windows\System\EUNRlgr.exe
  2⤵
  PID:2844
- C:\Windows\System\MWVuexh.exe
  C:\Windows\System\MWVuexh.exe
  2⤵
  PID:4868
- C:\Windows\System\efqouhI.exe
  C:\Windows\System\efqouhI.exe
  2⤵
  PID:4396
- C:\Windows\System\fgnHaTw.exe
  C:\Windows\System\fgnHaTw.exe
  2⤵
  PID:2736
- C:\Windows\System\GnvuzxT.exe
  C:\Windows\System\GnvuzxT.exe
  2⤵
  PID:4628
- C:\Windows\System\hckSrtJ.exe
  C:\Windows\System\hckSrtJ.exe
  2⤵
  PID:4816
- C:\Windows\System\srucmPA.exe
  C:\Windows\System\srucmPA.exe
  2⤵
  PID:4848
- C:\Windows\System\sqKnxYx.exe
  C:\Windows\System\sqKnxYx.exe
  2⤵
  PID:5076
- C:\Windows\System\fbQvFHr.exe
  C:\Windows\System\fbQvFHr.exe
  2⤵
  PID:4248
- C:\Windows\System\uPzHqCA.exe
  C:\Windows\System\uPzHqCA.exe
  2⤵
  PID:3248
- C:\Windows\System\dZXZoVi.exe
  C:\Windows\System\dZXZoVi.exe
  2⤵
  PID:3032
- C:\Windows\System\fucoMcQ.exe
  C:\Windows\System\fucoMcQ.exe
  2⤵
  PID:4232
- C:\Windows\System\EbVLAyw.exe
  C:\Windows\System\EbVLAyw.exe
  2⤵
  PID:3900
- C:\Windows\System\sJDHyrA.exe
  C:\Windows\System\sJDHyrA.exe
  2⤵
  PID:3640
- C:\Windows\System\rtlmatF.exe
  C:\Windows\System\rtlmatF.exe
  2⤵
  PID:4920
- C:\Windows\System\qlnAkSz.exe
  C:\Windows\System\qlnAkSz.exe
  2⤵
  PID:5016
- C:\Windows\System\kVbHxTo.exe
  C:\Windows\System\kVbHxTo.exe
  2⤵
  PID:452
- C:\Windows\System\Nmbxirv.exe
  C:\Windows\System\Nmbxirv.exe
  2⤵
  PID:4752
- C:\Windows\System\NqkjgVe.exe
  C:\Windows\System\NqkjgVe.exe
  2⤵
  PID:2072
- C:\Windows\System\dSKBLaP.exe
  C:\Windows\System\dSKBLaP.exe
  2⤵
  PID:4484
- C:\Windows\System\EdxnIEe.exe
  C:\Windows\System\EdxnIEe.exe
  2⤵
  PID:3444
- C:\Windows\System\dLIOyov.exe
  C:\Windows\System\dLIOyov.exe
  2⤵
  PID:5000
- C:\Windows\System\dVbkoQQ.exe
  C:\Windows\System\dVbkoQQ.exe
  2⤵
  PID:840
- C:\Windows\System\QlivBQY.exe
  C:\Windows\System\QlivBQY.exe
  2⤵
  PID:4640
- C:\Windows\System\qGKTPdP.exe
  C:\Windows\System\qGKTPdP.exe
  2⤵
  PID:4560
- C:\Windows\System\CaNibCJ.exe
  C:\Windows\System\CaNibCJ.exe
  2⤵
  PID:3828
- C:\Windows\System\chjKxIp.exe
  C:\Windows\System\chjKxIp.exe
  2⤵
  PID:4180
- C:\Windows\System\aBYzsVB.exe
  C:\Windows\System\aBYzsVB.exe
  2⤵
  PID:4572
- C:\Windows\System\PjZAlYu.exe
  C:\Windows\System\PjZAlYu.exe
  2⤵
  PID:5128
- C:\Windows\System\zEaJOok.exe
  C:\Windows\System\zEaJOok.exe
  2⤵
  PID:5144
- C:\Windows\System\GDZGuVf.exe
  C:\Windows\System\GDZGuVf.exe
  2⤵
  PID:5160
- C:\Windows\System\wGoSZBN.exe
  C:\Windows\System\wGoSZBN.exe
  2⤵
  PID:5176
- C:\Windows\System\OkFpsiT.exe
  C:\Windows\System\OkFpsiT.exe
  2⤵
  PID:5192
- C:\Windows\System\vWXqfUg.exe
  C:\Windows\System\vWXqfUg.exe
  2⤵
  PID:5208
- C:\Windows\System\LNBsKNR.exe
  C:\Windows\System\LNBsKNR.exe
  2⤵
  PID:5228
- C:\Windows\System\PKYTaSF.exe
  C:\Windows\System\PKYTaSF.exe
  2⤵
  PID:5244
- C:\Windows\System\txPvBdI.exe
  C:\Windows\System\txPvBdI.exe
  2⤵
  PID:5260
- C:\Windows\System\lMoKBbd.exe
  C:\Windows\System\lMoKBbd.exe
  2⤵
  PID:5276
- C:\Windows\System\PujtXps.exe
  C:\Windows\System\PujtXps.exe
  2⤵
  PID:5292
- C:\Windows\System\ulVHFZU.exe
  C:\Windows\System\ulVHFZU.exe
  2⤵
  PID:5308
- C:\Windows\System\urCNbzo.exe
  C:\Windows\System\urCNbzo.exe
  2⤵
  PID:5324
- C:\Windows\System\EkaVWpE.exe
  C:\Windows\System\EkaVWpE.exe
  2⤵
  PID:5344
- C:\Windows\System\qQuhbQf.exe
  C:\Windows\System\qQuhbQf.exe
  2⤵
  PID:5360
- C:\Windows\System\oSRKQUY.exe
  C:\Windows\System\oSRKQUY.exe
  2⤵
  PID:5376
- C:\Windows\System\avJjtlY.exe
  C:\Windows\System\avJjtlY.exe
  2⤵
  PID:5392
- C:\Windows\System\teKPwdR.exe
  C:\Windows\System\teKPwdR.exe
  2⤵
  PID:5408
- C:\Windows\System\vXOssvc.exe
  C:\Windows\System\vXOssvc.exe
  2⤵
  PID:5424
- C:\Windows\System\RMLhdgg.exe
  C:\Windows\System\RMLhdgg.exe
  2⤵
  PID:5444
- C:\Windows\System\UNgeQfW.exe
  C:\Windows\System\UNgeQfW.exe
  2⤵
  PID:5460
- C:\Windows\System\gvXMbud.exe
  C:\Windows\System\gvXMbud.exe
  2⤵
  PID:5476
- C:\Windows\System\PCdGYCa.exe
  C:\Windows\System\PCdGYCa.exe
  2⤵
  PID:5492
- C:\Windows\System\KTgPEvi.exe
  C:\Windows\System\KTgPEvi.exe
  2⤵
  PID:5508
- C:\Windows\System\qNIqMJj.exe
  C:\Windows\System\qNIqMJj.exe
  2⤵
  PID:5524
- C:\Windows\System\UAHHTai.exe
  C:\Windows\System\UAHHTai.exe
  2⤵
  PID:5540
- C:\Windows\System\ITeCDpA.exe
  C:\Windows\System\ITeCDpA.exe
  2⤵
  PID:5580
- C:\Windows\System\frBXqSH.exe
  C:\Windows\System\frBXqSH.exe
  2⤵
  PID:5600
- C:\Windows\System\tOjYlox.exe
  C:\Windows\System\tOjYlox.exe
  2⤵
  PID:5616
- C:\Windows\System\LOzLFxL.exe
  C:\Windows\System\LOzLFxL.exe
  2⤵
  PID:5632
- C:\Windows\System\vCZYFvq.exe
  C:\Windows\System\vCZYFvq.exe
  2⤵
  PID:5648
- C:\Windows\System\mpjYLPp.exe
  C:\Windows\System\mpjYLPp.exe
  2⤵
  PID:5664
- C:\Windows\System\UvoQFiI.exe
  C:\Windows\System\UvoQFiI.exe
  2⤵
  PID:5680
- C:\Windows\System\FNwAKVR.exe
  C:\Windows\System\FNwAKVR.exe
  2⤵
  PID:5700
- C:\Windows\System\IisQKid.exe
  C:\Windows\System\IisQKid.exe
  2⤵
  PID:5716
- C:\Windows\System\UuvALBu.exe
  C:\Windows\System\UuvALBu.exe
  2⤵
  PID:5732
- C:\Windows\System\geMUOZo.exe
  C:\Windows\System\geMUOZo.exe
  2⤵
  PID:5748
- C:\Windows\System\raphREC.exe
  C:\Windows\System\raphREC.exe
  2⤵
  PID:5764
- C:\Windows\System\lCPCVuo.exe
  C:\Windows\System\lCPCVuo.exe
  2⤵
  PID:5780
- C:\Windows\System\MyhLzwh.exe
  C:\Windows\System\MyhLzwh.exe
  2⤵
  PID:5940
- C:\Windows\System\lEnRnej.exe
  C:\Windows\System\lEnRnej.exe
  2⤵
  PID:5956
- C:\Windows\System\IkLsVhN.exe
  C:\Windows\System\IkLsVhN.exe
  2⤵
  PID:5976
- C:\Windows\System\cCHEXCp.exe
  C:\Windows\System\cCHEXCp.exe
  2⤵
  PID:5992
- C:\Windows\System\eWRVezf.exe
  C:\Windows\System\eWRVezf.exe
  2⤵
  PID:6008
- C:\Windows\System\vVUOduq.exe
  C:\Windows\System\vVUOduq.exe
  2⤵
  PID:6024
- C:\Windows\System\toJSwuF.exe
  C:\Windows\System\toJSwuF.exe
  2⤵
  PID:6040
- C:\Windows\System\uyygIPJ.exe
  C:\Windows\System\uyygIPJ.exe
  2⤵
  PID:6056
- C:\Windows\System\fQaknrS.exe
  C:\Windows\System\fQaknrS.exe
  2⤵
  PID:6072
- C:\Windows\System\XgkNTOQ.exe
  C:\Windows\System\XgkNTOQ.exe
  2⤵
  PID:6088
- C:\Windows\System\QacmByP.exe
  C:\Windows\System\QacmByP.exe
  2⤵
  PID:6108
- C:\Windows\System\DKCJJaL.exe
  C:\Windows\System\DKCJJaL.exe
  2⤵
  PID:6124
- C:\Windows\System\CLPrJOj.exe
  C:\Windows\System\CLPrJOj.exe
  2⤵
  PID:6140
- C:\Windows\System\pclFkKb.exe
  C:\Windows\System\pclFkKb.exe
  2⤵
  PID:4768
- C:\Windows\System\YoVfTNA.exe
  C:\Windows\System\YoVfTNA.exe
  2⤵
  PID:5152
- C:\Windows\System\LaTQxla.exe
  C:\Windows\System\LaTQxla.exe
  2⤵
  PID:5216
- C:\Windows\System\XtcXnZB.exe
  C:\Windows\System\XtcXnZB.exe
  2⤵
  PID:5256
- C:\Windows\System\CXBIuPB.exe
  C:\Windows\System\CXBIuPB.exe
  2⤵
  PID:5320
- C:\Windows\System\tJqHzCY.exe
  C:\Windows\System\tJqHzCY.exe
  2⤵
  PID:5388
- C:\Windows\System\VlyOQFu.exe
  C:\Windows\System\VlyOQFu.exe
  2⤵
  PID:3928
- C:\Windows\System\HNBbuEY.exe
  C:\Windows\System\HNBbuEY.exe
  2⤵
  PID:540
- C:\Windows\System\situbPB.exe
  C:\Windows\System\situbPB.exe
  2⤵
  PID:5140
- C:\Windows\System\NzFuLxz.exe
  C:\Windows\System\NzFuLxz.exe
  2⤵
  PID:5236
- C:\Windows\System\rHeXSUS.exe
  C:\Windows\System\rHeXSUS.exe
  2⤵
  PID:5300
- C:\Windows\System\FcoJuSz.exe
  C:\Windows\System\FcoJuSz.exe
  2⤵
  PID:5340
- C:\Windows\System\lKhRrzS.exe
  C:\Windows\System\lKhRrzS.exe
  2⤵
  PID:5404
- C:\Windows\System\ZDTUMGu.exe
  C:\Windows\System\ZDTUMGu.exe
  2⤵
  PID:5504
- C:\Windows\System\YknCLWd.exe
  C:\Windows\System\YknCLWd.exe
  2⤵
  PID:5500
- C:\Windows\System\ArTOqcm.exe
  C:\Windows\System\ArTOqcm.exe
  2⤵
  PID:5516
- C:\Windows\System\yUEMJNZ.exe
  C:\Windows\System\yUEMJNZ.exe
  2⤵
  PID:5552
- C:\Windows\System\mUnqEKH.exe
  C:\Windows\System\mUnqEKH.exe
  2⤵
  PID:5596
- C:\Windows\System\OBcDjCk.exe
  C:\Windows\System\OBcDjCk.exe
  2⤵
  PID:5688
- C:\Windows\System\bdmeINz.exe
  C:\Windows\System\bdmeINz.exe
  2⤵
  PID:5728
- C:\Windows\System\LaGoxIk.exe
  C:\Windows\System\LaGoxIk.exe
  2⤵
  PID:5792
- C:\Windows\System\DdbUfBS.exe
  C:\Windows\System\DdbUfBS.exe
  2⤵
  PID:5568
- C:\Windows\System\hMuPPVo.exe
  C:\Windows\System\hMuPPVo.exe
  2⤵
  PID:5644
- C:\Windows\System\ssWGjHQ.exe
  C:\Windows\System\ssWGjHQ.exe
  2⤵
  PID:5712
- C:\Windows\System\csYeJzi.exe
  C:\Windows\System\csYeJzi.exe
  2⤵
  PID:5776
- C:\Windows\System\VzjfcVJ.exe
  C:\Windows\System\VzjfcVJ.exe
  2⤵
  PID:5608
- C:\Windows\System\tVbPPAG.exe
  C:\Windows\System\tVbPPAG.exe
  2⤵
  PID:4772
- C:\Windows\System\OPJsmAJ.exe
  C:\Windows\System\OPJsmAJ.exe
  2⤵
  PID:5836
- C:\Windows\System\CCxZSMi.exe
  C:\Windows\System\CCxZSMi.exe
  2⤵
  PID:2192
- C:\Windows\System\vntkZUj.exe
  C:\Windows\System\vntkZUj.exe
  2⤵
  PID:5860
- C:\Windows\System\aVQbEGk.exe
  C:\Windows\System\aVQbEGk.exe
  2⤵
  PID:5948
- C:\Windows\System\gKbvCpg.exe
  C:\Windows\System\gKbvCpg.exe
  2⤵
  PID:5988
- C:\Windows\System\hGOfhwO.exe
  C:\Windows\System\hGOfhwO.exe
  2⤵
  PID:6080
- C:\Windows\System\HMhXurY.exe
  C:\Windows\System\HMhXurY.exe
  2⤵
  PID:4948
- C:\Windows\System\CIJATiV.exe
  C:\Windows\System\CIJATiV.exe
  2⤵
  PID:5288
- C:\Windows\System\skRNhhF.exe
  C:\Windows\System\skRNhhF.exe
  2⤵
  PID:5136
- C:\Windows\System\aKEOBdm.exe
  C:\Windows\System\aKEOBdm.exe
  2⤵
  PID:5372
- C:\Windows\System\zYhAoSA.exe
  C:\Windows\System\zYhAoSA.exe
  2⤵
  PID:6148
- C:\Windows\System\luHaVGJ.exe
  C:\Windows\System\luHaVGJ.exe
  2⤵
  PID:6164
- C:\Windows\System\vqNzcZN.exe
  C:\Windows\System\vqNzcZN.exe
  2⤵
  PID:6180
- C:\Windows\System\dpBhbHO.exe
  C:\Windows\System\dpBhbHO.exe
  2⤵
  PID:6200
- C:\Windows\System\ZDLlWtZ.exe
  C:\Windows\System\ZDLlWtZ.exe
  2⤵
  PID:6216
- C:\Windows\System\csvImwU.exe
  C:\Windows\System\csvImwU.exe
  2⤵
  PID:6232
- C:\Windows\System\zvhvXkN.exe
  C:\Windows\System\zvhvXkN.exe
  2⤵
  PID:6248
- C:\Windows\System\nkxaIYO.exe
  C:\Windows\System\nkxaIYO.exe
  2⤵
  PID:6268
- C:\Windows\System\EIjhobq.exe
  C:\Windows\System\EIjhobq.exe
  2⤵
  PID:6284
- C:\Windows\System\aciQHdI.exe
  C:\Windows\System\aciQHdI.exe
  2⤵
  PID:6300
- C:\Windows\System\njhTjyf.exe
  C:\Windows\System\njhTjyf.exe
  2⤵
  PID:6388
- C:\Windows\System\HKquXPH.exe
  C:\Windows\System\HKquXPH.exe
  2⤵
  PID:6404
- C:\Windows\System\ITuBoWz.exe
  C:\Windows\System\ITuBoWz.exe
  2⤵
  PID:6420
- C:\Windows\System\FJrZvah.exe
  C:\Windows\System\FJrZvah.exe
  2⤵
  PID:6436
- C:\Windows\System\IvruqJr.exe
  C:\Windows\System\IvruqJr.exe
  2⤵
  PID:6452
- C:\Windows\System\KMNlPDz.exe
  C:\Windows\System\KMNlPDz.exe
  2⤵
  PID:6468
- C:\Windows\System\KvNigSL.exe
  C:\Windows\System\KvNigSL.exe
  2⤵
  PID:6484
- C:\Windows\System\rjIYZDt.exe
  C:\Windows\System\rjIYZDt.exe
  2⤵
  PID:6500
- C:\Windows\System\ZqvxGVA.exe
  C:\Windows\System\ZqvxGVA.exe
  2⤵
  PID:6516
- C:\Windows\System\mVUpdCM.exe
  C:\Windows\System\mVUpdCM.exe
  2⤵
  PID:6536
- C:\Windows\System\QvqTtQu.exe
  C:\Windows\System\QvqTtQu.exe
  2⤵
  PID:6552
- C:\Windows\System\srKRHbs.exe
  C:\Windows\System\srKRHbs.exe
  2⤵
  PID:6568
- C:\Windows\System\GoUEsfR.exe
  C:\Windows\System\GoUEsfR.exe
  2⤵
  PID:6584
- C:\Windows\System\LZloCpU.exe
  C:\Windows\System\LZloCpU.exe
  2⤵
  PID:6600
- C:\Windows\System\vBZhMZV.exe
  C:\Windows\System\vBZhMZV.exe
  2⤵
  PID:6616
- C:\Windows\System\BlXrGHh.exe
  C:\Windows\System\BlXrGHh.exe
  2⤵
  PID:6632
- C:\Windows\System\TyuIekv.exe
  C:\Windows\System\TyuIekv.exe
  2⤵
  PID:6648
- C:\Windows\System\KaiuJWj.exe
  C:\Windows\System\KaiuJWj.exe
  2⤵
  PID:6664
- C:\Windows\System\PrIjHWN.exe
  C:\Windows\System\PrIjHWN.exe
  2⤵
  PID:6680
- C:\Windows\System\WwknlYX.exe
  C:\Windows\System\WwknlYX.exe
  2⤵
  PID:6696
- C:\Windows\System\cDllpRp.exe
  C:\Windows\System\cDllpRp.exe
  2⤵
  PID:6712
- C:\Windows\System\FhkXWJI.exe
  C:\Windows\System\FhkXWJI.exe
  2⤵
  PID:6728
- C:\Windows\System\ENYQeJT.exe
  C:\Windows\System\ENYQeJT.exe
  2⤵
  PID:6744
- C:\Windows\System\MDBLYzG.exe
  C:\Windows\System\MDBLYzG.exe
  2⤵
  PID:6760
- C:\Windows\System\jCPkJef.exe
  C:\Windows\System\jCPkJef.exe
  2⤵
  PID:6776
- C:\Windows\System\plBoxey.exe
  C:\Windows\System\plBoxey.exe
  2⤵
  PID:6796
- C:\Windows\System\tQMvzfJ.exe
  C:\Windows\System\tQMvzfJ.exe
  2⤵
  PID:6812
- C:\Windows\System\TyEWKKI.exe
  C:\Windows\System\TyEWKKI.exe
  2⤵
  PID:6828
- C:\Windows\System\stsLFTL.exe
  C:\Windows\System\stsLFTL.exe
  2⤵
  PID:6844
- C:\Windows\System\hRkcXQb.exe
  C:\Windows\System\hRkcXQb.exe
  2⤵
  PID:6860
- C:\Windows\System\CJYfsEa.exe
  C:\Windows\System\CJYfsEa.exe
  2⤵
  PID:6876
- C:\Windows\System\VfxakTi.exe
  C:\Windows\System\VfxakTi.exe
  2⤵
  PID:6892
- C:\Windows\System\VmsjWLL.exe
  C:\Windows\System\VmsjWLL.exe
  2⤵
  PID:6908
- C:\Windows\System\khXuHVh.exe
  C:\Windows\System\khXuHVh.exe
  2⤵
  PID:6924
- C:\Windows\System\LvKTsIS.exe
  C:\Windows\System\LvKTsIS.exe
  2⤵
  PID:6940
- C:\Windows\System\PvVPDVT.exe
  C:\Windows\System\PvVPDVT.exe
  2⤵
  PID:6956
- C:\Windows\System\rzJFPZK.exe
  C:\Windows\System\rzJFPZK.exe
  2⤵
  PID:6972
- C:\Windows\System\GLTkwCo.exe
  C:\Windows\System\GLTkwCo.exe
  2⤵
  PID:6988
- C:\Windows\System\huyhXsx.exe
  C:\Windows\System\huyhXsx.exe
  2⤵
  PID:7004
- C:\Windows\System\OoFwbOT.exe
  C:\Windows\System\OoFwbOT.exe
  2⤵
  PID:7020
- C:\Windows\System\TatbRlc.exe
  C:\Windows\System\TatbRlc.exe
  2⤵
  PID:7036
- C:\Windows\System\dDeCxHH.exe
  C:\Windows\System\dDeCxHH.exe
  2⤵
  PID:7052
- C:\Windows\System\fpWTcZz.exe
  C:\Windows\System\fpWTcZz.exe
  2⤵
  PID:7068
- C:\Windows\System\VPfatet.exe
  C:\Windows\System\VPfatet.exe
  2⤵
  PID:7084
- C:\Windows\System\abdaZsH.exe
  C:\Windows\System\abdaZsH.exe
  2⤵
  PID:7100
- C:\Windows\System\rNfFWPx.exe
  C:\Windows\System\rNfFWPx.exe
  2⤵
  PID:7116
- C:\Windows\System\QBsIzEg.exe
  C:\Windows\System\QBsIzEg.exe
  2⤵
  PID:7132
- C:\Windows\System\kOVWdhm.exe
  C:\Windows\System\kOVWdhm.exe
  2⤵
  PID:7148
- C:\Windows\System\vmJjzVg.exe
  C:\Windows\System\vmJjzVg.exe
  2⤵
  PID:7164
- C:\Windows\System\EKPEWbE.exe
  C:\Windows\System\EKPEWbE.exe
  2⤵
  PID:5628
- C:\Windows\System\wNRnXPf.exe
  C:\Windows\System\wNRnXPf.exe
  2⤵
  PID:5640
- C:\Windows\System\lYsgIwI.exe
  C:\Windows\System\lYsgIwI.exe
  2⤵
  PID:5816
- C:\Windows\System\pbmfoLi.exe
  C:\Windows\System\pbmfoLi.exe
  2⤵
  PID:5880
- C:\Windows\System\bliQNAV.exe
  C:\Windows\System\bliQNAV.exe
  2⤵
  PID:5184
- C:\Windows\System\ehqQPTt.exe
  C:\Windows\System\ehqQPTt.exe
  2⤵
  PID:6156
- C:\Windows\System\yvAJAsc.exe
  C:\Windows\System\yvAJAsc.exe
  2⤵
  PID:6264
- C:\Windows\System\ohnVlPj.exe
  C:\Windows\System\ohnVlPj.exe
  2⤵
  PID:6224
- C:\Windows\System\wsbNXex.exe
  C:\Windows\System\wsbNXex.exe
  2⤵
  PID:5876
- C:\Windows\System\XtJBZFH.exe
  C:\Windows\System\XtJBZFH.exe
  2⤵
  PID:5124
- C:\Windows\System\nrgKugi.exe
  C:\Windows\System\nrgKugi.exe
  2⤵
  PID:5900
- C:\Windows\System\svDXwSQ.exe
  C:\Windows\System\svDXwSQ.exe
  2⤵
  PID:5920
- C:\Windows\System\MKdKxsg.exe
  C:\Windows\System\MKdKxsg.exe
  2⤵
  PID:5968
- C:\Windows\System\reeOuyF.exe
  C:\Windows\System\reeOuyF.exe
  2⤵
  PID:6036
- C:\Windows\System\KpwfSAG.exe
  C:\Windows\System\KpwfSAG.exe
  2⤵
  PID:6100
- C:\Windows\System\baprmKg.exe
  C:\Windows\System\baprmKg.exe
  2⤵
  PID:4384
- C:\Windows\System\qdVQiNk.exe
  C:\Windows\System\qdVQiNk.exe
  2⤵
  PID:5356
- C:\Windows\System\BkGvhjp.exe
  C:\Windows\System\BkGvhjp.exe
  2⤵
  PID:5204
- C:\Windows\System\CQdKBQR.exe
  C:\Windows\System\CQdKBQR.exe
  2⤵
  PID:5436
- C:\Windows\System\seiEtQk.exe
  C:\Windows\System\seiEtQk.exe
  2⤵
  PID:5588
- C:\Windows\System\beFrBRb.exe
  C:\Windows\System\beFrBRb.exe
  2⤵
  PID:5796
- C:\Windows\System\UZkvAnP.exe
  C:\Windows\System\UZkvAnP.exe
  2⤵
  PID:5708
- C:\Windows\System\JbtbEwi.exe
  C:\Windows\System\JbtbEwi.exe
  2⤵
  PID:5824
- C:\Windows\System\hMnntSi.exe
  C:\Windows\System\hMnntSi.exe
  2⤵
  PID:5936
- C:\Windows\System\RkcfASQ.exe
  C:\Windows\System\RkcfASQ.exe
  2⤵
  PID:4500
- C:\Windows\System\ZWUShQb.exe
  C:\Windows\System\ZWUShQb.exe
  2⤵
  PID:6172
- C:\Windows\System\eZRLCaX.exe
  C:\Windows\System\eZRLCaX.exe
  2⤵
  PID:6240
- C:\Windows\System\sniPxgj.exe
  C:\Windows\System\sniPxgj.exe
  2⤵
  PID:6308
- C:\Windows\System\tzxVPCg.exe
  C:\Windows\System\tzxVPCg.exe
  2⤵
  PID:5096
- C:\Windows\System\qrKfwFs.exe
  C:\Windows\System\qrKfwFs.exe
  2⤵
  PID:6336
- C:\Windows\System\SgFaLVg.exe
  C:\Windows\System\SgFaLVg.exe
  2⤵
  PID:6352
- C:\Windows\System\dVPeHlf.exe
  C:\Windows\System\dVPeHlf.exe
  2⤵
  PID:6368
- C:\Windows\System\FrkfjbS.exe
  C:\Windows\System\FrkfjbS.exe
  2⤵
  PID:6396
- C:\Windows\System\gSVgfZf.exe
  C:\Windows\System\gSVgfZf.exe
  2⤵
  PID:6416
- C:\Windows\System\rVDrMxv.exe
  C:\Windows\System\rVDrMxv.exe
  2⤵
  PID:6480
- C:\Windows\System\JYWbsej.exe
  C:\Windows\System\JYWbsej.exe
  2⤵
  PID:6548
- C:\Windows\System\NThLNyf.exe
  C:\Windows\System\NThLNyf.exe
  2⤵
  PID:6580
- C:\Windows\System\isNQJsd.exe
  C:\Windows\System\isNQJsd.exe
  2⤵
  PID:6672
- C:\Windows\System\mLIcxdt.exe
  C:\Windows\System\mLIcxdt.exe
  2⤵
  PID:6740
- C:\Windows\System\IfWPccj.exe
  C:\Windows\System\IfWPccj.exe
  2⤵
  PID:6460
- C:\Windows\System\hSSejqw.exe
  C:\Windows\System\hSSejqw.exe
  2⤵
  PID:6528
- C:\Windows\System\eydOGfz.exe
  C:\Windows\System\eydOGfz.exe
  2⤵
  PID:6592
- C:\Windows\System\ApTSBri.exe
  C:\Windows\System\ApTSBri.exe
  2⤵
  PID:6656
- C:\Windows\System\WpkMRFR.exe
  C:\Windows\System\WpkMRFR.exe
  2⤵
  PID:6724
- C:\Windows\System\atRErIn.exe
  C:\Windows\System\atRErIn.exe
  2⤵
  PID:6788
- C:\Windows\System\iStpVDU.exe
  C:\Windows\System\iStpVDU.exe
  2⤵
  PID:6856
- C:\Windows\System\RqnVnlh.exe
  C:\Windows\System\RqnVnlh.exe
  2⤵
  PID:6920
- C:\Windows\System\zMkqJnM.exe
  C:\Windows\System\zMkqJnM.exe
  2⤵
  PID:6952
- C:\Windows\System\SyyUTmD.exe
  C:\Windows\System\SyyUTmD.exe
  2⤵
  PID:7012
- C:\Windows\System\lOTafEm.exe
  C:\Windows\System\lOTafEm.exe
  2⤵
  PID:7076
- C:\Windows\System\UVzFCLx.exe
  C:\Windows\System\UVzFCLx.exe
  2⤵
  PID:6804
- C:\Windows\System\qfPbYCk.exe
  C:\Windows\System\qfPbYCk.exe
  2⤵
  PID:7108
- C:\Windows\System\yxjQeyo.exe
  C:\Windows\System\yxjQeyo.exe
  2⤵
  PID:7112
- C:\Windows\System\qBhCQDS.exe
  C:\Windows\System\qBhCQDS.exe
  2⤵
  PID:6932
- C:\Windows\System\dPARdDo.exe
  C:\Windows\System\dPARdDo.exe
  2⤵
  PID:7000
- C:\Windows\System\sCOtJQf.exe
  C:\Windows\System\sCOtJQf.exe
  2⤵
  PID:7124
- C:\Windows\System\GKVOKbO.exe
  C:\Windows\System\GKVOKbO.exe
  2⤵
  PID:5788
- C:\Windows\System\bFYwIfc.exe
  C:\Windows\System\bFYwIfc.exe
  2⤵
  PID:5452
- C:\Windows\System\blVPHms.exe
  C:\Windows\System\blVPHms.exe
  2⤵
  PID:5812
- C:\Windows\System\GBNHlRs.exe
  C:\Windows\System\GBNHlRs.exe
  2⤵
  PID:6296
- C:\Windows\System\VSnPpTz.exe
  C:\Windows\System\VSnPpTz.exe
  2⤵
  PID:6228
- C:\Windows\System\gzjJCIi.exe
  C:\Windows\System\gzjJCIi.exe
  2⤵
  PID:6000
- C:\Windows\System\NemsvVG.exe
  C:\Windows\System\NemsvVG.exe
  2⤵
  PID:6032
- C:\Windows\System\UhBgmHM.exe
  C:\Windows\System\UhBgmHM.exe
  2⤵
  PID:5892
- C:\Windows\System\XItxVCb.exe
  C:\Windows\System\XItxVCb.exe
  2⤵
  PID:5224
- C:\Windows\System\RLEGQen.exe
  C:\Windows\System\RLEGQen.exe
  2⤵
  PID:5696
- C:\Windows\System\iUINFsG.exe
  C:\Windows\System\iUINFsG.exe
  2⤵
  PID:6116
- C:\Windows\System\QNEUvel.exe
  C:\Windows\System\QNEUvel.exe
  2⤵
  PID:6208
- C:\Windows\System\WkhXbKJ.exe
  C:\Windows\System\WkhXbKJ.exe
  2⤵
  PID:5488
- C:\Windows\System\LOcondL.exe
  C:\Windows\System\LOcondL.exe
  2⤵
  PID:5856
- C:\Windows\System\ZjVUIOh.exe
  C:\Windows\System\ZjVUIOh.exe
  2⤵
  PID:6720
- C:\Windows\System\SIstaYh.exe
  C:\Windows\System\SIstaYh.exe
  2⤵
  PID:6772
- C:\Windows\System\KIpxgiK.exe
  C:\Windows\System\KIpxgiK.exe
  2⤵
  PID:7144
- C:\Windows\System\fAxnYeJ.exe
  C:\Windows\System\fAxnYeJ.exe
  2⤵
  PID:5272
- C:\Windows\System\GiitMig.exe
  C:\Windows\System\GiitMig.exe
  2⤵
  PID:6068
- C:\Windows\System\LieyLAx.exe
  C:\Windows\System\LieyLAx.exe
  2⤵
  PID:6160
- C:\Windows\System\VEzrGAT.exe
  C:\Windows\System\VEzrGAT.exe
  2⤵
  PID:5336
- C:\Windows\System\BeRmJxK.exe
  C:\Windows\System\BeRmJxK.exe
  2⤵
  PID:5868
- C:\Windows\System\axvKxpy.exe
  C:\Windows\System\axvKxpy.exe
  2⤵
  PID:6380
- C:\Windows\System\vZYYVcB.exe
  C:\Windows\System\vZYYVcB.exe
  2⤵
  PID:6612
- C:\Windows\System\HPAFewj.exe
  C:\Windows\System\HPAFewj.exe
  2⤵
  PID:6708
- C:\Windows\System\wuIvGiK.exe
  C:\Windows\System\wuIvGiK.exe
  2⤵
  PID:4592
- C:\Windows\System\UMVBtmW.exe
  C:\Windows\System\UMVBtmW.exe
  2⤵
  PID:4656
- C:\Windows\System\uQIfCbW.exe
  C:\Windows\System\uQIfCbW.exe
  2⤵
  PID:6360
- C:\Windows\System\qYHPTHL.exe
  C:\Windows\System\qYHPTHL.exe
  2⤵
  PID:6428
- C:\Windows\System\cNDYllF.exe
  C:\Windows\System\cNDYllF.exe
  2⤵
  PID:6692
- C:\Windows\System\jhWahla.exe
  C:\Windows\System\jhWahla.exe
  2⤵
  PID:6432
- C:\Windows\System\mdFSLhI.exe
  C:\Windows\System\mdFSLhI.exe
  2⤵
  PID:6984
- C:\Windows\System\flsEbnp.exe
  C:\Windows\System\flsEbnp.exe
  2⤵
  PID:6836
- C:\Windows\System\jOZCpoh.exe
  C:\Windows\System\jOZCpoh.exe
  2⤵
  PID:6644
- C:\Windows\System\qrWyTkK.exe
  C:\Windows\System\qrWyTkK.exe
  2⤵
  PID:7048
- C:\Windows\System\hBUqMVu.exe
  C:\Windows\System\hBUqMVu.exe
  2⤵
  PID:6900
- C:\Windows\System\whqMwWZ.exe
  C:\Windows\System\whqMwWZ.exe
  2⤵
  PID:7160
- C:\Windows\System\nwrhSCu.exe
  C:\Windows\System\nwrhSCu.exe
  2⤵
  PID:6904
- C:\Windows\System\PZqECrV.exe
  C:\Windows\System\PZqECrV.exe
  2⤵
  PID:7140
- C:\Windows\System\kymnapL.exe
  C:\Windows\System\kymnapL.exe
  2⤵
  PID:5332
- C:\Windows\System\nrCriEj.exe
  C:\Windows\System\nrCriEj.exe
  2⤵
  PID:6576
- C:\Windows\System\iixzdvU.exe
  C:\Windows\System\iixzdvU.exe
  2⤵
  PID:6784
- C:\Windows\System\cURRaJw.exe
  C:\Windows\System\cURRaJw.exe
  2⤵
  PID:6820
- C:\Windows\System\QvAoQTj.exe
  C:\Windows\System\QvAoQTj.exe
  2⤵
  PID:6344
- C:\Windows\System\mejVQpG.exe
  C:\Windows\System\mejVQpG.exe
  2⤵
  PID:6476
- C:\Windows\System\rKDnRUh.exe
  C:\Windows\System\rKDnRUh.exe
  2⤵
  PID:6628
- C:\Windows\System\najVEUZ.exe
  C:\Windows\System\najVEUZ.exe
  2⤵
  PID:5832
- C:\Windows\System\TVgXiIr.exe
  C:\Windows\System\TVgXiIr.exe
  2⤵
  PID:5676
- C:\Windows\System\tWuAmic.exe
  C:\Windows\System\tWuAmic.exe
  2⤵
  PID:7156
- C:\Windows\System\ppYyZCq.exe
  C:\Windows\System\ppYyZCq.exe
  2⤵
  PID:5772
- C:\Windows\System\eAtZnCU.exe
  C:\Windows\System\eAtZnCU.exe
  2⤵
  PID:6192
- C:\Windows\System\TTEhWPN.exe
  C:\Windows\System\TTEhWPN.exe
  2⤵
  PID:6492
- C:\Windows\System\cybOFTY.exe
  C:\Windows\System\cybOFTY.exe
  2⤵
  PID:5928
- C:\Windows\System\eNSjTbE.exe
  C:\Windows\System\eNSjTbE.exe
  2⤵
  PID:6332
- C:\Windows\System\wKOkvjp.exe
  C:\Windows\System\wKOkvjp.exe
  2⤵
  PID:6688
- C:\Windows\System\bTmqTrl.exe
  C:\Windows\System\bTmqTrl.exe
  2⤵
  PID:5268
- C:\Windows\System\gFtdzrQ.exe
  C:\Windows\System\gFtdzrQ.exe
  2⤵
  PID:7032
- C:\Windows\System\cyCOySK.exe
  C:\Windows\System\cyCOySK.exe
  2⤵
  PID:6948
- C:\Windows\System\HvYFUsA.exe
  C:\Windows\System\HvYFUsA.exe
  2⤵
  PID:7184
- C:\Windows\System\wKtJlvH.exe
  C:\Windows\System\wKtJlvH.exe
  2⤵
  PID:7200
- C:\Windows\System\EXgrEUY.exe
  C:\Windows\System\EXgrEUY.exe
  2⤵
  PID:7216
- C:\Windows\System\GCYjOHp.exe
  C:\Windows\System\GCYjOHp.exe
  2⤵
  PID:7236
- C:\Windows\System\khTBEtG.exe
  C:\Windows\System\khTBEtG.exe
  2⤵
  PID:7252
- C:\Windows\System\OyttBTv.exe
  C:\Windows\System\OyttBTv.exe
  2⤵
  PID:7268
- C:\Windows\System\RmTWvVv.exe
  C:\Windows\System\RmTWvVv.exe
  2⤵
  PID:7284
- C:\Windows\System\LRXDfAV.exe
  C:\Windows\System\LRXDfAV.exe
  2⤵
  PID:7300
- C:\Windows\System\ZwRdhhb.exe
  C:\Windows\System\ZwRdhhb.exe
  2⤵
  PID:7316
- C:\Windows\System\lyisnji.exe
  C:\Windows\System\lyisnji.exe
  2⤵
  PID:7332
- C:\Windows\System\YqVOYXu.exe
  C:\Windows\System\YqVOYXu.exe
  2⤵
  PID:7348
- C:\Windows\System\jLiAuFP.exe
  C:\Windows\System\jLiAuFP.exe
  2⤵
  PID:7364
- C:\Windows\System\lQkCfWI.exe
  C:\Windows\System\lQkCfWI.exe
  2⤵
  PID:7380
- C:\Windows\System\pSDfhMN.exe
  C:\Windows\System\pSDfhMN.exe
  2⤵
  PID:7396
- C:\Windows\System\ZpPRoBp.exe
  C:\Windows\System\ZpPRoBp.exe
  2⤵
  PID:7412
- C:\Windows\System\XRAJUbv.exe
  C:\Windows\System\XRAJUbv.exe
  2⤵
  PID:7428
- C:\Windows\System\kEukxnh.exe
  C:\Windows\System\kEukxnh.exe
  2⤵
  PID:7444
- C:\Windows\System\PStNMhW.exe
  C:\Windows\System\PStNMhW.exe
  2⤵
  PID:7460
- C:\Windows\System\pvjseSY.exe
  C:\Windows\System\pvjseSY.exe
  2⤵
  PID:7476
- C:\Windows\System\ARSjYrI.exe
  C:\Windows\System\ARSjYrI.exe
  2⤵
  PID:7492
- C:\Windows\System\cxHyBRs.exe
  C:\Windows\System\cxHyBRs.exe
  2⤵
  PID:7508
- C:\Windows\System\dFLipfr.exe
  C:\Windows\System\dFLipfr.exe
  2⤵
  PID:7524
- C:\Windows\System\XkwsSau.exe
  C:\Windows\System\XkwsSau.exe
  2⤵
  PID:7540
- C:\Windows\System\oXDWdnk.exe
  C:\Windows\System\oXDWdnk.exe
  2⤵
  PID:7556
- C:\Windows\System\HenWWDm.exe
  C:\Windows\System\HenWWDm.exe
  2⤵
  PID:7576
- C:\Windows\System\WYcYyvZ.exe
  C:\Windows\System\WYcYyvZ.exe
  2⤵
  PID:7592
- C:\Windows\System\XzTKTqF.exe
  C:\Windows\System\XzTKTqF.exe
  2⤵
  PID:7608
- C:\Windows\System\ahplWtm.exe
  C:\Windows\System\ahplWtm.exe
  2⤵
  PID:7624
- C:\Windows\System\dORZCeg.exe
  C:\Windows\System\dORZCeg.exe
  2⤵
  PID:7640
- C:\Windows\System\FYdwuxK.exe
  C:\Windows\System\FYdwuxK.exe
  2⤵
  PID:7656
- C:\Windows\System\sYDjXAN.exe
  C:\Windows\System\sYDjXAN.exe
  2⤵
  PID:7672
- C:\Windows\System\XQIUeEQ.exe
  C:\Windows\System\XQIUeEQ.exe
  2⤵
  PID:7688
- C:\Windows\System\bFPBBWP.exe
  C:\Windows\System\bFPBBWP.exe
  2⤵
  PID:7704
- C:\Windows\System\ocTMwCT.exe
  C:\Windows\System\ocTMwCT.exe
  2⤵
  PID:7724
- C:\Windows\System\WjwgwjQ.exe
  C:\Windows\System\WjwgwjQ.exe
  2⤵
  PID:7740
- C:\Windows\System\UUqQMzh.exe
  C:\Windows\System\UUqQMzh.exe
  2⤵
  PID:7756
- C:\Windows\System\bKTwOvo.exe
  C:\Windows\System\bKTwOvo.exe
  2⤵
  PID:7772
- C:\Windows\System\EAifgbq.exe
  C:\Windows\System\EAifgbq.exe
  2⤵
  PID:7788
- C:\Windows\System\wddKTMh.exe
  C:\Windows\System\wddKTMh.exe
  2⤵
  PID:7808
- C:\Windows\System\muLPnSi.exe
  C:\Windows\System\muLPnSi.exe
  2⤵
  PID:7824
- C:\Windows\System\gylgUZZ.exe
  C:\Windows\System\gylgUZZ.exe
  2⤵
  PID:7844
- C:\Windows\System\BNWgsjE.exe
  C:\Windows\System\BNWgsjE.exe
  2⤵
  PID:7860
- C:\Windows\System\AoRYoVG.exe
  C:\Windows\System\AoRYoVG.exe
  2⤵
  PID:7880
- C:\Windows\System\kTYDtza.exe
  C:\Windows\System\kTYDtza.exe
  2⤵
  PID:7896
- C:\Windows\System\KAUReCg.exe
  C:\Windows\System\KAUReCg.exe
  2⤵
  PID:7916
- C:\Windows\System\cqQkYgc.exe
  C:\Windows\System\cqQkYgc.exe
  2⤵
  PID:7932
- C:\Windows\System\NVlXfum.exe
  C:\Windows\System\NVlXfum.exe
  2⤵
  PID:7948
- C:\Windows\System\BLGoPkS.exe
  C:\Windows\System\BLGoPkS.exe
  2⤵
  PID:7964
- C:\Windows\System\HTRhMQR.exe
  C:\Windows\System\HTRhMQR.exe
  2⤵
  PID:7980
- C:\Windows\System\ythhWAN.exe
  C:\Windows\System\ythhWAN.exe
  2⤵
  PID:7996
- C:\Windows\System\cOMVlim.exe
  C:\Windows\System\cOMVlim.exe
  2⤵
  PID:8012
- C:\Windows\System\zjxfHZe.exe
  C:\Windows\System\zjxfHZe.exe
  2⤵
  PID:8028
- C:\Windows\System\vsjZInD.exe
  C:\Windows\System\vsjZInD.exe
  2⤵
  PID:8048
- C:\Windows\System\TnUizCb.exe
  C:\Windows\System\TnUizCb.exe
  2⤵
  PID:8076
- C:\Windows\System\IpahHWT.exe
  C:\Windows\System\IpahHWT.exe
  2⤵
  PID:8092
- C:\Windows\System\ENhwyUo.exe
  C:\Windows\System\ENhwyUo.exe
  2⤵
  PID:8108
- C:\Windows\System\mJUctov.exe
  C:\Windows\System\mJUctov.exe
  2⤵
  PID:8124
- C:\Windows\System\TslBgaI.exe
  C:\Windows\System\TslBgaI.exe
  2⤵
  PID:8140
- C:\Windows\System\vzkaLkA.exe
  C:\Windows\System\vzkaLkA.exe
  2⤵
  PID:8156
- C:\Windows\System\UcEFyTC.exe
  C:\Windows\System\UcEFyTC.exe
  2⤵
  PID:8172
- C:\Windows\System\LppqQPk.exe
  C:\Windows\System\LppqQPk.exe
  2⤵
  PID:8188
- C:\Windows\System\TbxckpD.exe
  C:\Windows\System\TbxckpD.exe
  2⤵
  PID:7212
- C:\Windows\System\AXYihxW.exe
  C:\Windows\System\AXYihxW.exe
  2⤵
  PID:7276
- C:\Windows\System\tznADAF.exe
  C:\Windows\System\tznADAF.exe
  2⤵
  PID:7344
- C:\Windows\System\XysKNzT.exe
  C:\Windows\System\XysKNzT.exe
  2⤵
  PID:6564
- C:\Windows\System\aMIvYlt.exe
  C:\Windows\System\aMIvYlt.exe
  2⤵
  PID:7468
- C:\Windows\System\aarbAup.exe
  C:\Windows\System\aarbAup.exe
  2⤵
  PID:7392
- C:\Windows\System\lyDzIIK.exe
  C:\Windows\System\lyDzIIK.exe
  2⤵
  PID:6756
- C:\Windows\System\OVTVMwT.exe
  C:\Windows\System\OVTVMwT.exe
  2⤵
  PID:7224
- C:\Windows\System\tLLbUwc.exe
  C:\Windows\System\tLLbUwc.exe
  2⤵
  PID:7516
- C:\Windows\System\DCtRCeq.exe
  C:\Windows\System\DCtRCeq.exe
  2⤵
  PID:7552
- C:\Windows\System\BFtbBzf.exe
  C:\Windows\System\BFtbBzf.exe
  2⤵
  PID:7620
- C:\Windows\System\trfJxzT.exe
  C:\Windows\System\trfJxzT.exe
  2⤵
  PID:7712
- C:\Windows\System\niSUdBv.exe
  C:\Windows\System\niSUdBv.exe
  2⤵
  PID:7752
- C:\Windows\System\NUufxgI.exe
  C:\Windows\System\NUufxgI.exe
  2⤵
  PID:7700
- C:\Windows\System\hyqsLPi.exe
  C:\Windows\System\hyqsLPi.exe
  2⤵
  PID:7820
- C:\Windows\System\QdCHjfF.exe
  C:\Windows\System\QdCHjfF.exe
  2⤵
  PID:7840
- C:\Windows\System\AfYnvsN.exe
  C:\Windows\System\AfYnvsN.exe
  2⤵
  PID:7876
- C:\Windows\System\ekOpxxl.exe
  C:\Windows\System\ekOpxxl.exe
  2⤵
  PID:7796
- C:\Windows\System\PAffUXe.exe
  C:\Windows\System\PAffUXe.exe
  2⤵
  PID:7852
- C:\Windows\System\LCfNjJs.exe
  C:\Windows\System\LCfNjJs.exe
  2⤵
  PID:7888
- C:\Windows\System\lxDKuNR.exe
  C:\Windows\System\lxDKuNR.exe
  2⤵
  PID:7960
- C:\Windows\System\unLGrFv.exe
  C:\Windows\System\unLGrFv.exe
  2⤵
  PID:8008
- C:\Windows\System\gDAWSCf.exe
  C:\Windows\System\gDAWSCf.exe
  2⤵
  PID:8040
- C:\Windows\System\iqAhUla.exe
  C:\Windows\System\iqAhUla.exe
  2⤵
  PID:8056
- C:\Windows\System\NtkNgBJ.exe
  C:\Windows\System\NtkNgBJ.exe
  2⤵
  PID:8072
- C:\Windows\System\XaSTJXL.exe
  C:\Windows\System\XaSTJXL.exe
  2⤵
  PID:8120
- C:\Windows\System\ZbbbumX.exe
  C:\Windows\System\ZbbbumX.exe
  2⤵
  PID:8184
- C:\Windows\System\JzBkPap.exe
  C:\Windows\System\JzBkPap.exe
  2⤵
  PID:7260
- C:\Windows\System\Dwqjvee.exe
  C:\Windows\System\Dwqjvee.exe
  2⤵
  PID:8104
- C:\Windows\System\juNiGCA.exe
  C:\Windows\System\juNiGCA.exe
  2⤵
  PID:7180
- C:\Windows\System\eiUFjSX.exe
  C:\Windows\System\eiUFjSX.exe
  2⤵
  PID:7340
- C:\Windows\System\TbMPbHE.exe
  C:\Windows\System\TbMPbHE.exe
  2⤵
  PID:5576
- C:\Windows\System\INAlvUE.exe
  C:\Windows\System\INAlvUE.exe
  2⤵
  PID:7296
- C:\Windows\System\gfeDZEw.exe
  C:\Windows\System\gfeDZEw.exe
  2⤵
  PID:7360
- C:\Windows\System\AvuzxRi.exe
  C:\Windows\System\AvuzxRi.exe
  2⤵
  PID:7536
- C:\Windows\System\nLfnLYw.exe
  C:\Windows\System\nLfnLYw.exe
  2⤵
  PID:7636
- C:\Windows\System\xTJObXG.exe
  C:\Windows\System\xTJObXG.exe
  2⤵
  PID:7668
- C:\Windows\System\HSyDYNU.exe
  C:\Windows\System\HSyDYNU.exe
  2⤵
  PID:7684
- C:\Windows\System\KVNIPyg.exe
  C:\Windows\System\KVNIPyg.exe
  2⤵
  PID:7836
- C:\Windows\System\HOhCJWU.exe
  C:\Windows\System\HOhCJWU.exe
  2⤵
  PID:7816
- C:\Windows\System\cLQhAfY.exe
  C:\Windows\System\cLQhAfY.exe
  2⤵
  PID:7992
- C:\Windows\System\wgZDFbH.exe
  C:\Windows\System\wgZDFbH.exe
  2⤵
  PID:8088
- C:\Windows\System\mnEvtes.exe
  C:\Windows\System\mnEvtes.exe
  2⤵
  PID:7404
- C:\Windows\System\OamSUIQ.exe
  C:\Windows\System\OamSUIQ.exe
  2⤵
  PID:7972
- C:\Windows\System\NstHhWw.exe
  C:\Windows\System\NstHhWw.exe
  2⤵
  PID:7988
- C:\Windows\System\YUbGfyy.exe
  C:\Windows\System\YUbGfyy.exe
  2⤵
  PID:7892
- C:\Windows\System\IluAJBk.exe
  C:\Windows\System\IluAJBk.exe
  2⤵
  PID:7192
- C:\Windows\System\xrmmzGe.exe
  C:\Windows\System\xrmmzGe.exe
  2⤵
  PID:7420
- C:\Windows\System\CInAmNA.exe
  C:\Windows\System\CInAmNA.exe
  2⤵
  PID:7312
- C:\Windows\System\pSfrYgT.exe
  C:\Windows\System\pSfrYgT.exe
  2⤵
  PID:7680
- C:\Windows\System\dAaCbro.exe
  C:\Windows\System\dAaCbro.exe
  2⤵
  PID:7568
- C:\Windows\System\aGyKktm.exe
  C:\Windows\System\aGyKktm.exe
  2⤵
  PID:7696
- C:\Windows\System\siThwPW.exe
  C:\Windows\System\siThwPW.exe
  2⤵
  PID:8004
- C:\Windows\System\QzjuWzB.exe
  C:\Windows\System\QzjuWzB.exe
  2⤵
  PID:7748
- C:\Windows\System\zmEWuGa.exe
  C:\Windows\System\zmEWuGa.exe
  2⤵
  PID:7096
- C:\Windows\System\rgKRFDg.exe
  C:\Windows\System\rgKRFDg.exe
  2⤵
  PID:7248
- C:\Windows\System\XnepnTf.exe
  C:\Windows\System\XnepnTf.exe
  2⤵
  PID:8168
- C:\Windows\System\ZKjSlYr.exe
  C:\Windows\System\ZKjSlYr.exe
  2⤵
  PID:7976
- C:\Windows\System\YBwIKUD.exe
  C:\Windows\System\YBwIKUD.exe
  2⤵
  PID:8208
- C:\Windows\System\maOyRZB.exe
  C:\Windows\System\maOyRZB.exe
  2⤵
  PID:8224
- C:\Windows\System\iERtfOo.exe
  C:\Windows\System\iERtfOo.exe
  2⤵
  PID:8240
- C:\Windows\System\jljrIgR.exe
  C:\Windows\System\jljrIgR.exe
  2⤵
  PID:8256
- C:\Windows\System\GcVWGgX.exe
  C:\Windows\System\GcVWGgX.exe
  2⤵
  PID:8272
- C:\Windows\System\YLYczmF.exe
  C:\Windows\System\YLYczmF.exe
  2⤵
  PID:8288
- C:\Windows\System\JYDgYeA.exe
  C:\Windows\System\JYDgYeA.exe
  2⤵
  PID:8304
- C:\Windows\System\DbjHHQr.exe
  C:\Windows\System\DbjHHQr.exe
  2⤵
  PID:8320
- C:\Windows\System\ehSAYEB.exe
  C:\Windows\System\ehSAYEB.exe
  2⤵
  PID:8336
- C:\Windows\System\gKttBlK.exe
  C:\Windows\System\gKttBlK.exe
  2⤵
  PID:8356
- C:\Windows\System\ywfQfLV.exe
  C:\Windows\System\ywfQfLV.exe
  2⤵
  PID:8372
- C:\Windows\System\eypJDiZ.exe
  C:\Windows\System\eypJDiZ.exe
  2⤵
  PID:8388
- C:\Windows\System\DVyvBye.exe
  C:\Windows\System\DVyvBye.exe
  2⤵
  PID:8404
- C:\Windows\System\wAqVRzy.exe
  C:\Windows\System\wAqVRzy.exe
  2⤵
  PID:8420
- C:\Windows\System\RwSWCQc.exe
  C:\Windows\System\RwSWCQc.exe
  2⤵
  PID:8436
- C:\Windows\System\JckYONb.exe
  C:\Windows\System\JckYONb.exe
  2⤵
  PID:8456
- C:\Windows\System\EDJZeJd.exe
  C:\Windows\System\EDJZeJd.exe
  2⤵
  PID:8472
- C:\Windows\System\CvLfUPW.exe
  C:\Windows\System\CvLfUPW.exe
  2⤵
  PID:8488
- C:\Windows\System\sAfoAca.exe
  C:\Windows\System\sAfoAca.exe
  2⤵
  PID:8504
- C:\Windows\System\GSJOOhn.exe
  C:\Windows\System\GSJOOhn.exe
  2⤵
  PID:8520
- C:\Windows\System\PThjmlH.exe
  C:\Windows\System\PThjmlH.exe
  2⤵
  PID:8536
- C:\Windows\System\SRvMtpj.exe
  C:\Windows\System\SRvMtpj.exe
  2⤵
  PID:8552
- C:\Windows\System\gVutcGl.exe
  C:\Windows\System\gVutcGl.exe
  2⤵
  PID:8568
- C:\Windows\System\aGwNzGf.exe
  C:\Windows\System\aGwNzGf.exe
  2⤵
  PID:8584
- C:\Windows\System\jHYKiCW.exe
  C:\Windows\System\jHYKiCW.exe
  2⤵
  PID:8600
- C:\Windows\System\zUybtGk.exe
  C:\Windows\System\zUybtGk.exe
  2⤵
  PID:8616
- C:\Windows\System\HzteBOH.exe
  C:\Windows\System\HzteBOH.exe
  2⤵
  PID:8632
- C:\Windows\System\IotCjPT.exe
  C:\Windows\System\IotCjPT.exe
  2⤵
  PID:8648
- C:\Windows\System\LPbtKhE.exe
  C:\Windows\System\LPbtKhE.exe
  2⤵
  PID:8664
- C:\Windows\System\jemCHJd.exe
  C:\Windows\System\jemCHJd.exe
  2⤵
  PID:8680
- C:\Windows\System\mjqCudn.exe
  C:\Windows\System\mjqCudn.exe
  2⤵
  PID:8696
- C:\Windows\System\OOtyxFn.exe
  C:\Windows\System\OOtyxFn.exe
  2⤵
  PID:8712
- C:\Windows\System\NvJGOfF.exe
  C:\Windows\System\NvJGOfF.exe
  2⤵
  PID:8728
- C:\Windows\System\QMiYjcz.exe
  C:\Windows\System\QMiYjcz.exe
  2⤵
  PID:8744
- C:\Windows\System\grpRFuV.exe
  C:\Windows\System\grpRFuV.exe
  2⤵
  PID:8760
- C:\Windows\System\ojtgodv.exe
  C:\Windows\System\ojtgodv.exe
  2⤵
  PID:8776
- C:\Windows\System\tigEivm.exe
  C:\Windows\System\tigEivm.exe
  2⤵
  PID:8792
- C:\Windows\System\caXJyla.exe
  C:\Windows\System\caXJyla.exe
  2⤵
  PID:8808
- C:\Windows\System\pVljbCl.exe
  C:\Windows\System\pVljbCl.exe
  2⤵
  PID:8824
- C:\Windows\System\aVCYwhW.exe
  C:\Windows\System\aVCYwhW.exe
  2⤵
  PID:8840
- C:\Windows\System\avznToE.exe
  C:\Windows\System\avznToE.exe
  2⤵
  PID:8856
- C:\Windows\System\VVJjpVp.exe
  C:\Windows\System\VVJjpVp.exe
  2⤵
  PID:8872
- C:\Windows\System\VQQXkzj.exe
  C:\Windows\System\VQQXkzj.exe
  2⤵
  PID:8888
- C:\Windows\System\RCjvXfF.exe
  C:\Windows\System\RCjvXfF.exe
  2⤵
  PID:8904
- C:\Windows\System\gZpcQyY.exe
  C:\Windows\System\gZpcQyY.exe
  2⤵
  PID:8920
- C:\Windows\System\xkavMGS.exe
  C:\Windows\System\xkavMGS.exe
  2⤵
  PID:8936
- C:\Windows\System\MHZVcuP.exe
  C:\Windows\System\MHZVcuP.exe
  2⤵
  PID:8952
- C:\Windows\System\TdWTntU.exe
  C:\Windows\System\TdWTntU.exe
  2⤵
  PID:8968
- C:\Windows\System\IYzviKB.exe
  C:\Windows\System\IYzviKB.exe
  2⤵
  PID:8984
- C:\Windows\System\pKabTRA.exe
  C:\Windows\System\pKabTRA.exe
  2⤵
  PID:9000
- C:\Windows\System\rGLEXNe.exe
  C:\Windows\System\rGLEXNe.exe
  2⤵
  PID:9016
- C:\Windows\System\bAbJxav.exe
  C:\Windows\System\bAbJxav.exe
  2⤵
  PID:9032
- C:\Windows\System\rmvROTc.exe
  C:\Windows\System\rmvROTc.exe
  2⤵
  PID:9048
- C:\Windows\System\jzTntKq.exe
  C:\Windows\System\jzTntKq.exe
  2⤵
  PID:9064
- C:\Windows\System\YylZeYN.exe
  C:\Windows\System\YylZeYN.exe
  2⤵
  PID:9080
- C:\Windows\System\BBdOerS.exe
  C:\Windows\System\BBdOerS.exe
  2⤵
  PID:9096
- C:\Windows\System\qCwGXJq.exe
  C:\Windows\System\qCwGXJq.exe
  2⤵
  PID:9112
- C:\Windows\System\HCuVMsU.exe
  C:\Windows\System\HCuVMsU.exe
  2⤵
  PID:9128
- C:\Windows\System\ZRNJMWY.exe
  C:\Windows\System\ZRNJMWY.exe
  2⤵
  PID:9144
- C:\Windows\System\sodtGKJ.exe
  C:\Windows\System\sodtGKJ.exe
  2⤵
  PID:9160
- C:\Windows\System\xEeAmcI.exe
  C:\Windows\System\xEeAmcI.exe
  2⤵
  PID:9176
- C:\Windows\System\dnOoXYi.exe
  C:\Windows\System\dnOoXYi.exe
  2⤵
  PID:9192
- C:\Windows\System\leuHXDE.exe
  C:\Windows\System\leuHXDE.exe
  2⤵
  PID:9208
- C:\Windows\System\WODjAqu.exe
  C:\Windows\System\WODjAqu.exe
  2⤵
  PID:7208
- C:\Windows\System\aNGFuTO.exe
  C:\Windows\System\aNGFuTO.exe
  2⤵
  PID:7648
- C:\Windows\System\ILqAxwT.exe
  C:\Windows\System\ILqAxwT.exe
  2⤵
  PID:8164
- C:\Windows\System\hSSdguy.exe
  C:\Windows\System\hSSdguy.exe
  2⤵
  PID:8216
- C:\Windows\System\tPlykbi.exe
  C:\Windows\System\tPlykbi.exe
  2⤵
  PID:8204
- C:\Windows\System\PwXKrKq.exe
  C:\Windows\System\PwXKrKq.exe
  2⤵
  PID:8312
- C:\Windows\System\hQCKynp.exe
  C:\Windows\System\hQCKynp.exe
  2⤵
  PID:8236
- C:\Windows\System\IJDFwpa.exe
  C:\Windows\System\IJDFwpa.exe
  2⤵
  PID:8332
- C:\Windows\System\CSrHrDx.exe
  C:\Windows\System\CSrHrDx.exe
  2⤵
  PID:8344
- C:\Windows\System\ovkVvyV.exe
  C:\Windows\System\ovkVvyV.exe
  2⤵
  PID:8412
- C:\Windows\System\SGYtENy.exe
  C:\Windows\System\SGYtENy.exe
  2⤵
  PID:8480
- C:\Windows\System\KHetEjv.exe
  C:\Windows\System\KHetEjv.exe
  2⤵
  PID:8428
- C:\Windows\System\CuhAuAK.exe
  C:\Windows\System\CuhAuAK.exe
  2⤵
  PID:8512
- C:\Windows\System\xCduGPP.exe
  C:\Windows\System\xCduGPP.exe
  2⤵
  PID:8576
- C:\Windows\System\AuSFfPw.exe
  C:\Windows\System\AuSFfPw.exe
  2⤵
  PID:8496
- C:\Windows\System\mqUbTKA.exe
  C:\Windows\System\mqUbTKA.exe
  2⤵
  PID:8596
- C:\Windows\System\RQfWjsa.exe
  C:\Windows\System\RQfWjsa.exe
  2⤵
  PID:8644
- C:\Windows\System\PQWBLJC.exe
  C:\Windows\System\PQWBLJC.exe
  2⤵
  PID:8704
- C:\Windows\System\QECSTOW.exe
  C:\Windows\System\QECSTOW.exe
  2⤵
  PID:8708
- C:\Windows\System\AdjcxAf.exe
  C:\Windows\System\AdjcxAf.exe
  2⤵
  PID:8720
- C:\Windows\System\JANmacm.exe
  C:\Windows\System\JANmacm.exe
  2⤵
  PID:8816
- C:\Windows\System\TrhRtgi.exe
  C:\Windows\System\TrhRtgi.exe
  2⤵
  PID:8880
- C:\Windows\System\QTlAbYU.exe
  C:\Windows\System\QTlAbYU.exe
  2⤵
  PID:8944
- C:\Windows\System\JHvtQzq.exe
  C:\Windows\System\JHvtQzq.exe
  2⤵
  PID:8740
- C:\Windows\System\BvaIygU.exe
  C:\Windows\System\BvaIygU.exe
  2⤵
  PID:8800
- C:\Windows\System\dkzHHHm.exe
  C:\Windows\System\dkzHHHm.exe
  2⤵
  PID:8864
- C:\Windows\System\lqHbzFD.exe
  C:\Windows\System\lqHbzFD.exe
  2⤵
  PID:8928
- C:\Windows\System\TcDuJHC.exe
  C:\Windows\System\TcDuJHC.exe
  2⤵
  PID:8976
- C:\Windows\System\beasOPH.exe
  C:\Windows\System\beasOPH.exe
  2⤵
  PID:9028
- C:\Windows\System\xyVTqZP.exe
  C:\Windows\System\xyVTqZP.exe
  2⤵
  PID:9092
- C:\Windows\System\LILozWH.exe
  C:\Windows\System\LILozWH.exe
  2⤵
  PID:9072
- C:\Windows\System\tJIMyIZ.exe
  C:\Windows\System\tJIMyIZ.exe
  2⤵
  PID:9076
- C:\Windows\System\NKnEbrN.exe
  C:\Windows\System\NKnEbrN.exe
  2⤵
  PID:9152
- C:\Windows\System\JYGiVvU.exe
  C:\Windows\System\JYGiVvU.exe
  2⤵
  PID:9136
- C:\Windows\System\lOdmDlm.exe
  C:\Windows\System\lOdmDlm.exe
  2⤵
  PID:9168
- C:\Windows\System\ElHewzT.exe
  C:\Windows\System\ElHewzT.exe
  2⤵
  PID:7632
- C:\Windows\System\uvnwSvG.exe
  C:\Windows\System\uvnwSvG.exe
  2⤵
  PID:7764
- C:\Windows\System\nVjKCdA.exe
  C:\Windows\System\nVjKCdA.exe
  2⤵
  PID:8268
- C:\Windows\System\QQebKga.exe
  C:\Windows\System\QQebKga.exe
  2⤵
  PID:8316
- C:\Windows\System\mjIrybf.exe
  C:\Windows\System\mjIrybf.exe
  2⤵
  PID:8468
- C:\Windows\System\FBpkkfq.exe
  C:\Windows\System\FBpkkfq.exe
  2⤵
  PID:8640
- C:\Windows\System\dDpBUqC.exe
  C:\Windows\System\dDpBUqC.exe
  2⤵
  PID:8752
- C:\Windows\System\jjSYWBb.exe
  C:\Windows\System\jjSYWBb.exe
  2⤵
  PID:8772
- C:\Windows\System\QFjoVJa.exe
  C:\Windows\System\QFjoVJa.exe
  2⤵
  PID:8996
- C:\Windows\System\hjyShnB.exe
  C:\Windows\System\hjyShnB.exe
  2⤵
  PID:9108
- C:\Windows\System\VUQzaSj.exe
  C:\Windows\System\VUQzaSj.exe
  2⤵
  PID:8396
- C:\Windows\System\zVkZNmT.exe
  C:\Windows\System\zVkZNmT.exe
  2⤵
  PID:8300
- C:\Windows\System\WDvjroN.exe
  C:\Windows\System\WDvjroN.exe
  2⤵
  PID:8400
- C:\Windows\System\tdKEnNK.exe
  C:\Windows\System\tdKEnNK.exe
  2⤵
  PID:8848
- C:\Windows\System\GLsGCUv.exe
  C:\Windows\System\GLsGCUv.exe
  2⤵
  PID:8832
- C:\Windows\System\ybXtNiz.exe
  C:\Windows\System\ybXtNiz.exe
  2⤵
  PID:9060
- C:\Windows\System\taWSGxu.exe
  C:\Windows\System\taWSGxu.exe
  2⤵
  PID:9184
- C:\Windows\System\CNIOPgo.exe
  C:\Windows\System\CNIOPgo.exe
  2⤵
  PID:7616
- C:\Windows\System\tFFBwyS.exe
  C:\Windows\System\tFFBwyS.exe
  2⤵
  PID:8444
- C:\Windows\System\AHdsITD.exe
  C:\Windows\System\AHdsITD.exe
  2⤵
  PID:8592
- C:\Windows\System\YIwHeHF.exe
  C:\Windows\System\YIwHeHF.exe
  2⤵
  PID:7940
- C:\Windows\System\sXMFyjU.exe
  C:\Windows\System\sXMFyjU.exe
  2⤵
  PID:8532
- C:\Windows\System\NAIYOVc.exe
  C:\Windows\System\NAIYOVc.exe
  2⤵
  PID:8464
- C:\Windows\System\dvYeSbJ.exe
  C:\Windows\System\dvYeSbJ.exe
  2⤵
  PID:8608
- C:\Windows\System\lXPNoxx.exe
  C:\Windows\System\lXPNoxx.exe
  2⤵
  PID:8736
- C:\Windows\System\qhwqdPt.exe
  C:\Windows\System\qhwqdPt.exe
  2⤵
  PID:9012
- C:\Windows\System\bkUaPel.exe
  C:\Windows\System\bkUaPel.exe
  2⤵
  PID:8020
- C:\Windows\System\jhOMetH.exe
  C:\Windows\System\jhOMetH.exe
  2⤵
  PID:9124
- C:\Windows\System\sHcSxRE.exe
  C:\Windows\System\sHcSxRE.exe
  2⤵
  PID:8296
- C:\Windows\System\qNAbksr.exe
  C:\Windows\System\qNAbksr.exe
  2⤵
  PID:8756
- C:\Windows\System\hbhgUpY.exe
  C:\Windows\System\hbhgUpY.exe
  2⤵
  PID:8960
- C:\Windows\System\LFwpYWO.exe
  C:\Windows\System\LFwpYWO.exe
  2⤵
  PID:9204
- C:\Windows\System\SHCItbL.exe
  C:\Windows\System\SHCItbL.exe
  2⤵
  PID:9044
- C:\Windows\System\DeISbov.exe
  C:\Windows\System\DeISbov.exe
  2⤵
  PID:9232
- C:\Windows\System\SlJjOgm.exe
  C:\Windows\System\SlJjOgm.exe
  2⤵
  PID:9248
- C:\Windows\System\xDaDCMG.exe
  C:\Windows\System\xDaDCMG.exe
  2⤵
  PID:9264
- C:\Windows\System\YDSMuHQ.exe
  C:\Windows\System\YDSMuHQ.exe
  2⤵
  PID:9280
- C:\Windows\System\HMivkDK.exe
  C:\Windows\System\HMivkDK.exe
  2⤵
  PID:9296
- C:\Windows\System\YZLcuvN.exe
  C:\Windows\System\YZLcuvN.exe
  2⤵
  PID:9312
- C:\Windows\System\dLuLPcd.exe
  C:\Windows\System\dLuLPcd.exe
  2⤵
  PID:9328
- C:\Windows\System\YtxeimX.exe
  C:\Windows\System\YtxeimX.exe
  2⤵
  PID:9344
- C:\Windows\System\gDbdkyT.exe
  C:\Windows\System\gDbdkyT.exe
  2⤵
  PID:9360
- C:\Windows\System\dKRNUCf.exe
  C:\Windows\System\dKRNUCf.exe
  2⤵
  PID:9376
- C:\Windows\System\DyeUyHX.exe
  C:\Windows\System\DyeUyHX.exe
  2⤵
  PID:9392
- C:\Windows\System\YxLljbl.exe
  C:\Windows\System\YxLljbl.exe
  2⤵
  PID:9408
- C:\Windows\System\NXBoCQH.exe
  C:\Windows\System\NXBoCQH.exe
  2⤵
  PID:9424
- C:\Windows\System\QLDyaJI.exe
  C:\Windows\System\QLDyaJI.exe
  2⤵
  PID:9440
- C:\Windows\System\bhqvgQt.exe
  C:\Windows\System\bhqvgQt.exe
  2⤵
  PID:9456
- C:\Windows\System\TdcHDYy.exe
  C:\Windows\System\TdcHDYy.exe
  2⤵
  PID:9472
- C:\Windows\System\hXkYZit.exe
  C:\Windows\System\hXkYZit.exe
  2⤵
  PID:9488
- C:\Windows\System\PtwcWrD.exe
  C:\Windows\System\PtwcWrD.exe
  2⤵
  PID:9504
- C:\Windows\System\gcklHzf.exe
  C:\Windows\System\gcklHzf.exe
  2⤵
  PID:9520
- C:\Windows\System\zmJPUTz.exe
  C:\Windows\System\zmJPUTz.exe
  2⤵
  PID:9536
- C:\Windows\System\wmJDqqS.exe
  C:\Windows\System\wmJDqqS.exe
  2⤵
  PID:9552
- C:\Windows\System\Ucchsfv.exe
  C:\Windows\System\Ucchsfv.exe
  2⤵
  PID:9568
- C:\Windows\System\vZWcfji.exe
  C:\Windows\System\vZWcfji.exe
  2⤵
  PID:9584
- C:\Windows\System\iPtdaZo.exe
  C:\Windows\System\iPtdaZo.exe
  2⤵
  PID:9600
- C:\Windows\System\HscTlmL.exe
  C:\Windows\System\HscTlmL.exe
  2⤵
  PID:9616
- C:\Windows\System\vggRwuk.exe
  C:\Windows\System\vggRwuk.exe
  2⤵
  PID:9632
- C:\Windows\System\mdRBpwr.exe
  C:\Windows\System\mdRBpwr.exe
  2⤵
  PID:9648
- C:\Windows\System\oALkaGI.exe
  C:\Windows\System\oALkaGI.exe
  2⤵
  PID:9664
- C:\Windows\System\ycqyFmE.exe
  C:\Windows\System\ycqyFmE.exe
  2⤵
  PID:9680
- C:\Windows\System\qCwwDCX.exe
  C:\Windows\System\qCwwDCX.exe
  2⤵
  PID:9696
- C:\Windows\System\CJqpBUA.exe
  C:\Windows\System\CJqpBUA.exe
  2⤵
  PID:9712
- C:\Windows\System\fVqPYoP.exe
  C:\Windows\System\fVqPYoP.exe
  2⤵
  PID:9728
- C:\Windows\System\dFPBLkJ.exe
  C:\Windows\System\dFPBLkJ.exe
  2⤵
  PID:9744
- C:\Windows\System\RmjcHsk.exe
  C:\Windows\System\RmjcHsk.exe
  2⤵
  PID:9760
- C:\Windows\System\npxUjLc.exe
  C:\Windows\System\npxUjLc.exe
  2⤵
  PID:9776
- C:\Windows\System\tVphAmh.exe
  C:\Windows\System\tVphAmh.exe
  2⤵
  PID:9792
- C:\Windows\System\WMRcehn.exe
  C:\Windows\System\WMRcehn.exe
  2⤵
  PID:9808
- C:\Windows\System\tQKlxSs.exe
  C:\Windows\System\tQKlxSs.exe
  2⤵
  PID:9824
- C:\Windows\System\TDcXCbA.exe
  C:\Windows\System\TDcXCbA.exe
  2⤵
  PID:9840
- C:\Windows\System\iragLXX.exe
  C:\Windows\System\iragLXX.exe
  2⤵
  PID:9856
- C:\Windows\System\FcLNuZq.exe
  C:\Windows\System\FcLNuZq.exe
  2⤵
  PID:9872
- C:\Windows\System\NVrmJPo.exe
  C:\Windows\System\NVrmJPo.exe
  2⤵
  PID:9888
- C:\Windows\System\QpGinOR.exe
  C:\Windows\System\QpGinOR.exe
  2⤵
  PID:9904
- C:\Windows\System\FkkGAAD.exe
  C:\Windows\System\FkkGAAD.exe
  2⤵
  PID:9920
- C:\Windows\System\CEHYkVa.exe
  C:\Windows\System\CEHYkVa.exe
  2⤵
  PID:9936
- C:\Windows\System\mFbeJUp.exe
  C:\Windows\System\mFbeJUp.exe
  2⤵
  PID:9952
- C:\Windows\System\jxDFqVT.exe
  C:\Windows\System\jxDFqVT.exe
  2⤵
  PID:9968
- C:\Windows\System\WhlnLlA.exe
  C:\Windows\System\WhlnLlA.exe
  2⤵
  PID:9984
- C:\Windows\System\SHIJrRd.exe
  C:\Windows\System\SHIJrRd.exe
  2⤵
  PID:10000
- C:\Windows\System\uHDhnuG.exe
  C:\Windows\System\uHDhnuG.exe
  2⤵
  PID:10016
- C:\Windows\System\AJwIUgj.exe
  C:\Windows\System\AJwIUgj.exe
  2⤵
  PID:10032
- C:\Windows\System\IUuvBXC.exe
  C:\Windows\System\IUuvBXC.exe
  2⤵
  PID:10048
- C:\Windows\System\mgykHnn.exe
  C:\Windows\System\mgykHnn.exe
  2⤵
  PID:10064
- C:\Windows\System\IEaLwEK.exe
  C:\Windows\System\IEaLwEK.exe
  2⤵
  PID:10080
- C:\Windows\System\AZUQscG.exe
  C:\Windows\System\AZUQscG.exe
  2⤵
  PID:10096
- C:\Windows\System\gjFsSmA.exe
  C:\Windows\System\gjFsSmA.exe
  2⤵
  PID:10112
- C:\Windows\System\cYtYXkU.exe
  C:\Windows\System\cYtYXkU.exe
  2⤵
  PID:10128
- C:\Windows\System\grPchRT.exe
  C:\Windows\System\grPchRT.exe
  2⤵
  PID:10144
- C:\Windows\System\AdOuiPS.exe
  C:\Windows\System\AdOuiPS.exe
  2⤵
  PID:10160
- C:\Windows\System\EEwXGuB.exe
  C:\Windows\System\EEwXGuB.exe
  2⤵
  PID:10176
- C:\Windows\System\tilDRzm.exe
  C:\Windows\System\tilDRzm.exe
  2⤵
  PID:10192
- C:\Windows\System\BRvBKhv.exe
  C:\Windows\System\BRvBKhv.exe
  2⤵
  PID:10208
- C:\Windows\System\DMQPuXN.exe
  C:\Windows\System\DMQPuXN.exe
  2⤵
  PID:10224
- C:\Windows\System\vTjrQNS.exe
  C:\Windows\System\vTjrQNS.exe
  2⤵
  PID:9224
- C:\Windows\System\PKFIxTc.exe
  C:\Windows\System\PKFIxTc.exe
  2⤵
  PID:8692
- C:\Windows\System\hOODlrl.exe
  C:\Windows\System\hOODlrl.exe
  2⤵
  PID:9256
- C:\Windows\System\oRZQomJ.exe
  C:\Windows\System\oRZQomJ.exe
  2⤵
  PID:9272
- C:\Windows\System\BROlgjt.exe
  C:\Windows\System\BROlgjt.exe
  2⤵
  PID:9324
- C:\Windows\System\gEuSOEt.exe
  C:\Windows\System\gEuSOEt.exe
  2⤵
  PID:9276
- C:\Windows\System\lFBwEzi.exe
  C:\Windows\System\lFBwEzi.exe
  2⤵
  PID:9304
- C:\Windows\System\tVNjgaU.exe
  C:\Windows\System\tVNjgaU.exe
  2⤵
  PID:9340
- C:\Windows\System\aFgKxXB.exe
  C:\Windows\System\aFgKxXB.exe
  2⤵
  PID:9480
- C:\Windows\System\DRfjpdY.exe
  C:\Windows\System\DRfjpdY.exe
  2⤵
  PID:9516
- C:\Windows\System\JdwgnpR.exe
  C:\Windows\System\JdwgnpR.exe
  2⤵
  PID:9548
- C:\Windows\System\OlKSXgI.exe
  C:\Windows\System\OlKSXgI.exe
  2⤵
  PID:9436
- C:\Windows\System\QgpBCvN.exe
  C:\Windows\System\QgpBCvN.exe
  2⤵
  PID:9672
- C:\Windows\System\IhoWdAf.exe
  C:\Windows\System\IhoWdAf.exe
  2⤵
  PID:9676
- C:\Windows\System\XuBhZOO.exe
  C:\Windows\System\XuBhZOO.exe
  2⤵
  PID:9708
- C:\Windows\System\vvRSZgN.exe
  C:\Windows\System\vvRSZgN.exe
  2⤵
  PID:9628
- C:\Windows\System\yPJCmQQ.exe
  C:\Windows\System\yPJCmQQ.exe
  2⤵
  PID:9768
- C:\Windows\System\GvJcziw.exe
  C:\Windows\System\GvJcziw.exe
  2⤵
  PID:9592
- C:\Windows\System\unwGQHL.exe
  C:\Windows\System\unwGQHL.exe
  2⤵
  PID:9836
- C:\Windows\System\kPyVArM.exe
  C:\Windows\System\kPyVArM.exe
  2⤵
  PID:9788
- C:\Windows\System\XRGqCFE.exe
  C:\Windows\System\XRGqCFE.exe
  2⤵
  PID:9900
- C:\Windows\System\pEABHEP.exe
  C:\Windows\System\pEABHEP.exe
  2⤵
  PID:9688
- C:\Windows\System\ASXJQhH.exe
  C:\Windows\System\ASXJQhH.exe
  2⤵
  PID:9848
- C:\Windows\System\TpfXqLK.exe
  C:\Windows\System\TpfXqLK.exe
  2⤵
  PID:9820
- C:\Windows\System\VNPkUcM.exe
  C:\Windows\System\VNPkUcM.exe
  2⤵
  PID:9996
- C:\Windows\System\pOtQHgO.exe
  C:\Windows\System\pOtQHgO.exe
  2⤵
  PID:10060
- C:\Windows\System\rAWHiEY.exe
  C:\Windows\System\rAWHiEY.exe
  2⤵
  PID:9880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AwogKzq.exe

Filesize
1.7MB

MD5
43bce3cd3a2e291c8c358e2ddfcaa51a

SHA1
2ae70f384e366d76638ca08bf68fa6e090070a5d

SHA256
e95144b31542dd8c2d81032240557ff3877814d897612a82149817183902b27a

SHA512
11eced07be2d03268e1a3591ee49818026611b9f9d49288f0bca66c1dae40e68cf042a4ddc2739473312acf0d8b7e61d650e8a1a540a630cb37a86861589a92e

Download Submit
C:\Windows\system\BTIEDPc.exe

Filesize
1.7MB

MD5
19d1ee8d6d5b94703a83e284798829e3

SHA1
ce8c56cf3a77fa532b4f2d22e78ace040c5748df

SHA256
d3e4820b84766d390461b00ebc2eaa67acbdb03a2d93b5397a891eae218ca7aa

SHA512
6af4ce21598023544fd73486d1e3c41f6dc1e2b97a9e287a8e72b8c48994c0547f9b1a0895045a7e7cf48c4babc340b1c20e13013413bc7e28dfc14b1926c867

Download Submit
C:\Windows\system\FVyXAVg.exe

Filesize
1.7MB

MD5
a0b69b44ac0e3102166c73ffc0a9c060

SHA1
51104724f07e9d6074d402dcd546d60e9365e3f7

SHA256
2cb0b23e1c7da9da59ebe33309884d071878c6fef122771e4f9ccc63f728de23

SHA512
633863c13a95b77cc8fd1e02b85c4df59065508468c778f52bef047c5d4576d1bc73d7099c65617886302cab556deffa08f40790416fef0d4fb7bb5be081158e

Download Submit
C:\Windows\system\FhrXmKk.exe

Filesize
1.7MB

MD5
a4324cf2b7fd10f6c607739825959a39

SHA1
829a17d85547826990a1ee178b0464858b73fb80

SHA256
8686ada707bf080d5e9b310cb9299e4efb729a41089f41b7aad0006b4d04745e

SHA512
243a806fe6f35dece1ce67c4dac804ebfc0c7c732ded9fb7a594e782b62319e61167d0794706c2171a6521e65dbaa5708f00d2e546da7a7b49afadd7b7032fe6

Download Submit
C:\Windows\system\GNLKMgh.exe

Filesize
1.7MB

MD5
0f4b2d3d1f1f31c380e665b89e1edfb7

SHA1
4555b97a7546f0d325773ae6eaaf5213d45a0be5

SHA256
e8614cbd3c8c24ff85d6852dc68049d770357e47d2c1811ad2dc180b5df2d5a6

SHA512
2dcaf6cd542af7c2cc25c88ec7f15dfd51ca5e07563872f72c3b225bb75b4ed034c98d86dc2e2a21e154dcb330a990727e299165d861be65592c18dd8db1f9eb

Download Submit
C:\Windows\system\JDgIjDK.exe

Filesize
1.7MB

MD5
ff2755162c52f3e01698e22fe9741f71

SHA1
f49b12583f005e88af4d716a33b9ce60d68fb075

SHA256
f03e971575144c1fac8af781273ca15b12ed924d41eff93a86d63d891393037b

SHA512
b046a92ea26e202c0a055f469bdb12e3644a34f327577e64d201ccb878c741e0a3bb79147f1e5c4a8c87917bac7247ba3e62e2783b2b19efb80685ebb5b9c634

Download Submit
C:\Windows\system\KjjxcNQ.exe

Filesize
1.7MB

MD5
9d0961fd36ea989927fc2fff677e0510

SHA1
94500da800cd41b6d5f808a9404b83a863d914f7

SHA256
1570aa157fd8bba983ea34af5abf3d23c85c34b03d0081cc100332fe430a135e

SHA512
058c10fbc7af1d076df0d93f7e53dccf9694ca4138da744da233cb22b4a9aa4b68ed057b627445a96c45675fbde6b333c48bb1b79215ec0f49891ee1e5aae61a

Download Submit
C:\Windows\system\NMyuloB.exe

Filesize
1.7MB

MD5
7956f70a17d2358d84b8f4d86906332b

SHA1
fae95096aedc98ab4ddb37ca994f568598549f97

SHA256
be73f7103457e894bed10e44181a986a3d2f31c3d910a44a23e1e5881cf0a4c5

SHA512
6a743fad40799ca85b6c9125c6046326cf268e791d2868bddc5bbe76ba54edbeeedd1e643ba6c0dafae03f80d7a85ffda5cc94bb1421ae7758c6f43d1dd70486

Download Submit
C:\Windows\system\NsqnqZV.exe

Filesize
8B

MD5
4585af961e6be7f3b03d075298565b62

SHA1
8e84c60639225761f581ea4ec1ff9a2d8e5472c9

SHA256
b8920be4ca9181e84576dfb449141c7d9af40d7ddc5588ea3cac8c68ef3a0a88

SHA512
aca862ef42a6056537a17dcbf9d8778efa38fbecbcb6ce3dce02a2eb0f5b9ffb56a667b21c26a29159a0ebcd14d21a77c5b25a36880c46863acba28da90e75f0

Download Submit
C:\Windows\system\TnHEeTm.exe

Filesize
1.7MB

MD5
cf71c72dfa73588b3a5cf3473bf350a3

SHA1
26add3e4046c1db50b02a662a42b09f915d6b56e

SHA256
2abc01b4d91ec55d624a623910234b73d8b61f2fd6f8b9f7ffe5dff7c0bcda14

SHA512
bbc9300d18212ea5fa1001936c35125140ff3da3535cb8907213b2bc9eb99763acd27dded5da782b82947b3cad5196471f56e9aec6c47054286d47cd346c3ecb

Download Submit
C:\Windows\system\WBPSNOn.exe

Filesize
1.7MB

MD5
4e818163c83518ae32772d3a13949494

SHA1
7d943100bf3e75753a6975abfba637d01474389c

SHA256
2ada76f7e87d0835dc719f992fe6523ec86bcff58272739708402a62b9f7f913

SHA512
fea9a6194d163a4eb07884aeaa0b1d267ed241c40f0256c56dd97bddcab28d80999955426769f0668cb3fdeea7717d8f3638756e40488443737dba7ed628ddee

Download Submit
C:\Windows\system\YJsylEa.exe

Filesize
1.7MB

MD5
97f37ead26835970b1387d9af47b6e6d

SHA1
faf8f1757e0412d41c5759b72efc2dff63e84f2b

SHA256
6c84517515cf34d8e379649adee59e228d8ceda828bd5700c739eb183e164fd3

SHA512
573abe44ddf6c2df953ab5edabffe3edb441b5bf0a537623e0dcdabdc24ba172af8e431be31b6ede0a5747bf1ac465b5d07afe512a28c30b032e929bda700b22

Download Submit
C:\Windows\system\YfElmWy.exe

Filesize
1.7MB

MD5
a78c1d5fdf1a233f5a3afeaa9336c671

SHA1
0c9fb586d0bf253097d973c90c008554997ca73b

SHA256
f3fe4bbe23a63beee3302eb2a1c2df46dc0235c3e0d8a1e4e1ef8e47c744720a

SHA512
69d0df12a706326f50fdc2dd185dda18ccf2eacf531b27b2d3c2c7ac2e36551bd93797147f4c1d32083099fb3973c7b1660ee2536c9c48fea1df4940c5d64788

Download Submit
C:\Windows\system\dJgfgzH.exe

Filesize
1.7MB

MD5
f8a477ad456137d7481408df208e469a

SHA1
50ba24c16f8e56404113ec087f8a4efef49eb7ec

SHA256
6483e25bb019b3f575082b6c8be380ffefd19054fe7e5a22bca7971ad2b1a179

SHA512
6b7032d464daa1578c1554dafbf7097be846dd9cf6c8a3a96f33ee0626e6566dcf7fe617dc7227c07340e9cc1e8c9420b2279b0e840f695769891f11ae46195a

Download Submit
C:\Windows\system\fJQrpMp.exe

Filesize
1.7MB

MD5
bc9ab490b4013b87110b37e8d9a829e4

SHA1
92a0d307d7122c02accf63f300741c1091dd4cc6

SHA256
c47dcac1344ebaf8347071991f26ea935e5921b34b071781937ab8dcc47556df

SHA512
4c5d50f0dadc85e4ee6daba7ed75866d4b9487641a145c7cd45f28f0f527ed7e1a190305229870d98f8b308da229706ec3c0546334401d8577b26b418ea31ef2

Download Submit
C:\Windows\system\gSgOSga.exe

Filesize
1.7MB

MD5
67216c521f115cdebb73b64bfd0582ed

SHA1
e86d19e8aaaeebbceb346666efbbe9d0f852b4a7

SHA256
13dfefa9fe94a3b1395c60fb4374d04100ea50dea9dfe91bc0fbb0b4bba930eb

SHA512
29ee41240f93b5add86f79aa1351ae12d2393a0f0d505e93b83e851a8700f3c4d797dd6832fc168ea6aa4cedd07e516437215f16e4e063b51de4a1d14bebb8c2

Download Submit
C:\Windows\system\iNpHWzM.exe

Filesize
1.7MB

MD5
0ecc353d939e98da905a55bb493887b2

SHA1
5e793cb27e796c75c79ff2dfa3db4b3e8300f0ba

SHA256
83c918cee2e4f8d2bb05a6f8e6f14a879e1ff804ac6a47b1ef658d0e8485c8a0

SHA512
4bfe8605b89b177a2ebccde8b9096e781f6d1635c3fd6e8a27be168090b14e39d137725f402809590f477958255c83938fbb02f63ad18a5c5527de527baeb7a0

Download Submit
C:\Windows\system\ifutxln.exe

Filesize
1.7MB

MD5
41ea1de9b700bebb551679075d2b7487

SHA1
37a70d050d7a7f140a7d5777ce93afa7ab6e7277

SHA256
487b84c8e5b46f856ad204e16e05378743eed5cdd0ceabb42fffc3f7f7f55121

SHA512
fd1d447f9b28adfedfeaaf23a67e8e9ab8bb137768ff745bd38239f214a9f31314fef95e7d13d672134503ee19de8d8fbcb5d3a10b2c5a0c35d0514a625f9ed9

Download Submit
C:\Windows\system\iirKzAj.exe

Filesize
1.7MB

MD5
042dc1305b3ff246331e5627e5ee5e85

SHA1
5c4214205cf8cf044944934ad752ac1b87737738

SHA256
5a90932329b07835b66b36c92cf1d50d80f4cd600307adfec1267b4b02ce1839

SHA512
54f5e936ea5ffeef0751c273cf2072f21ee3e47cf00190287be153614d444c5ef07e072c67e327bb3a4c833373f5e42d4a218b4e3a6ab101bb4b84af07ce0b8d

Download Submit
C:\Windows\system\kNhiNfl.exe

Filesize
1.7MB

MD5
1f26a93666794cd2d14a3f3161170ff9

SHA1
d566a4b437ba971a17befee6e6ba345f88a76574

SHA256
fcf2aa4cb969690145902f82961e206fe4ba06c0b60d5dd49d9981617dc97a0d

SHA512
17f82439f59f65cfa9063f54648e7faca03bbefce5f27b4ede5ce766eacebcc8a9a7ba9a4c28d156f96ac5a5a71be2a04b9ac2b2b2deb50419fc45fab4702304

Download Submit
C:\Windows\system\pqILUYd.exe

Filesize
1.7MB

MD5
edcfb7b12763df2329a1f5aa5be08ef5

SHA1
81698695918288762bb398e0da036a7876667920

SHA256
3c133f18e0205bce4966804affabc275e12c09b95fecd6ab2485540907c6f5de

SHA512
0a57e8c7348ecd9693375cb6fe091104a190ea9f50bebc25ab86ae9ee47c5856b7ec00e89d76d693833f0bb78a4781701fbb62e673b05282b24c9e98c12aaca4

Download Submit
\Windows\system\DGRefNb.exe

Filesize
1.7MB

MD5
ee20498fdda7871eb4c17a11eead7d4d

SHA1
d26468eb9f63ddc73d0c87fed9d2fb72b8535cfc

SHA256
bbb24e84a8d00842ca3ff55b3f883ac4d2224e02c352faac5f08d2a0749c20ad

SHA512
5d06a53b30323c2bfb9fb10fd22a7f44a7ce5ef94aa663b1773ec9affc858422d92f326c7fefdbabb642cd89e0965e2902942284eeeb8293ed278aa677fe0826

Download Submit
\Windows\system\ERrHgLF.exe

Filesize
1.7MB

MD5
106be0583b11cc1f9ec8304a379efbc8

SHA1
c166a42d8efd3defee08c1d6eea394063b3cffdc

SHA256
422a56278a34a24997bc8962d2bd97614a0fefa123a88d7984d5ff470fa9642d

SHA512
9009452f2c96ff42b24b678dfbfb87e483599d440908d8d91fd14606abc220ed7714c2723dc03ee2c25c6643b356d6314cbdef033facf4b8645b4bb26ed407ab

Download Submit
\Windows\system\GCZXFha.exe

Filesize
1.7MB

MD5
6b76ffdcd12eef8e784e14d22fc30424

SHA1
e4266ffdcc969b9841e74fb698f353b0167e35a8

SHA256
d68625cb40fc2a2b798bfbc168e73059994fe88b4a8a86bd1d2f7d20e0eaf1b9

SHA512
b42052c12b46bed8574c66863ba7b8801ad0a4935fb0a780024596b3db25a2af3935dd47190f19579edbbfc7917260ba3d86653ed424e59a8e2adc8e28ab9009

Download Submit
\Windows\system\HAHgewR.exe

Filesize
1.7MB

MD5
1425a671536ee56072e604f73de24ab6

SHA1
ebad3cecb28a529986da81fa3f736f7df562c455

SHA256
2050bcb74e907b263f5b35e70099e5cad994e3864eec5fae6a02b97cb0081011

SHA512
f18093f6f0763ccc402ba09b49654bfa40fb3c1b122e44f84cd222201e02ca9d05342c08318fb311b59baf03e1c805ef63e8cd47fb318da7f7b989aed2b874d7

Download Submit
\Windows\system\LMlOypk.exe

Filesize
1.7MB

MD5
6786ca12b532c06f3167af0ed737ea8d

SHA1
99c1c2983d3aae8caaf36ec4568483fe24da5560

SHA256
a6770ea86273e378f9c5db90ff118a644138769f1f519bb2c44cd5e93a627d60

SHA512
b45cad8de291271725805c1398782246bd83cecb6cef9b551e1a75e13b6fe95cd2c3f201c24061632d677278e172278fb597bba90423c0cd9762dcc90b6668d9

Download Submit
\Windows\system\NJwkyrn.exe

Filesize
1.7MB

MD5
13b774bce7dd086368eee2aaf9c3dac9

SHA1
a92815e87dccfcd52e9a5b0f51f247de92ebd645

SHA256
723943e3b4fc36ade17415b9fbc0ebd529f2870b246e8e0e2159a8b19486ab34

SHA512
16532545565dbfc457143e4195b55e289fb59c84cd09207629e4417af21a9f3f84c657ea5b3ad96fcc33fcd23947b1b4e6c230d34e569ccd75ef7a4489f85b6e

Download Submit
\Windows\system\OApFleB.exe

Filesize
1.7MB

MD5
7fc91511def55450d988db86b1d77884

SHA1
e792c47e9daea67079857467db16097bd14c2806

SHA256
994e0642316eba6974975a89af86524f454babb5d7a6bcdcbc5124f9cacae407

SHA512
bc542338997b12699f11a2cd643348945cf9b466229c1e93381711025268b28bc250264c6bc831849390cb177c5bd6cd692b3ea6a9b0bb7f7c5c3bc4cdbdee8e

Download Submit
\Windows\system\RLlMmLA.exe

Filesize
1.7MB

MD5
5ebe592dfd152b0395562385aa0ab4e5

SHA1
df1af4b6dccbf1b6bc5598df57c603166a61aac7

SHA256
946d48a5a9b90eea18d81bb015adf224b66cb6a4c9f314992067d1506fa3382a

SHA512
943048fc514f14ea3090b864d10f664cd8e9ca014b57bd3a130eb4dbe91a6eff5f461defa8c1e2243097f360c10510a9a8f67f2fafc367e430cd05b908f13584

Download Submit
\Windows\system\RSwUdQg.exe

Filesize
1.7MB

MD5
bdd5d316a50574bd9564e51ae4208fa6

SHA1
a1e2890982cefcd16649510fc082bc0e2f48e7ae

SHA256
f11e0c8683e7dab2a0e0bcb5f882f657ccc3d7b3f4564b05535ee137c4735982

SHA512
25974354c3e147f746166595f5148589752756364de282d4d45b9b3917f318179331c15c4aa20c502fb67b5714b82f92700ccfd01500fc8cc2c4d6af8a9437de

Download Submit
\Windows\system\UKtZMkZ.exe

Filesize
1.7MB

MD5
16b03b77e8ace4dcb0c64331e0d1b1c4

SHA1
47da4722401511a100c5ad3699d3d2fdc7317b34

SHA256
7b154c9ce1010b313c0c8dcd351251a43a996f686bcb5ffd45e31693c6911e6c

SHA512
a990d556f16c948054583622c05bd65489af897e938e8e02fb499bbd10df12c8653a3ed4a2345e8e25a8913a6f69fb3a3931b77f5f312e9d7a0618766004429f

Download Submit
\Windows\system\ZLVfSQI.exe

Filesize
1.7MB

MD5
06c5910581469099219a2ad16babcbee

SHA1
2c280e15e9517cb7b88bd321afde1fcbf723d938

SHA256
2edab2e10f9389ad0b6558677c24bb2b27ce4dbf2975b4e28ee4f14436452c61

SHA512
e288154ef1577e9ac0a16b0336679e80b21e71ce13c390c950493a27d7af65e85b83a853710f7eb922f23bba8ac124c89173ddf670bfb09f78994043f5bf4e7b

Download Submit
\Windows\system\ZpNrYuT.exe

Filesize
1.7MB

MD5
ab8d53bc79233e3fed2714af6c781ae9

SHA1
fddc8e1e5ebda1e7fce00a19f4f4c8f3ff68f856

SHA256
cce44184cb88771fc4cf1fdf290cfd8463bd9458f2fe1c13ab1bb05ba0d5bde7

SHA512
590df04c8c62841fa4edc508795146191a9d66e4c1c567753698effd05bbaa54277e9514c5bb655d9e093bae925317662136b17c05efa0fa70d11a4d28842666

Download Submit
\Windows\system\dFGvxDe.exe

Filesize
1.7MB

MD5
2663ee7b000a139b450ff5f2fd28cdc5

SHA1
fc586315aa6f6f693a1ab49da78bb9281cf1af04

SHA256
f0139ca38fe1c891c2148a71a477d625992e183bf25eb8e4beaae76586aac505

SHA512
5d917f68df1b6d582321356823932eb9a47e378c01f50318a40eb7cc0e35a358c795c5e9d15b4afab98ee27d67bf60e4603516fb99c00c3c359b5a036e86b1df

Download Submit
\Windows\system\foTnCGr.exe

Filesize
1.7MB

MD5
d8e7646ce14fa22270e18acbcc5a45c3

SHA1
3995d44590145e6b1a1d4e20c8ed6427ff1dffb9

SHA256
03eca22390f4eff9667c0a000ec1df5d3de8be2db5e12da98a6bfbca44a52b4a

SHA512
b18e709495936989abab24f3bb077795edb0acb74f36f278746161976a3e3db02f164fbfa29aacc994f1a50ac398ff8dfc19effbf642a1752b5c7c1084426a2c

Download Submit
\Windows\system\jfpBhsp.exe

Filesize
1.7MB

MD5
5c0cf56924c5f60f923d420cb0a827ad

SHA1
138fc9f700a94c7d7777a43ccb969885d4229101

SHA256
c838fc834991fbea82a4c5ab21c836ad49713c0a9d0257df26b6ab3603d3a85a

SHA512
80f64637e6a1b888ccce6e3e76b4262f7edfd7a68c77a39deb882893c9a6a58d9800ed2c58df61574a08cece2ccf9a29ced09e0ec846b6b00a182b6ca50aa5b6

Download Submit
\Windows\system\lNwcLgG.exe

Filesize
1.7MB

MD5
6ccf2661b95a3c885cb31bc28df0113c

SHA1
261eb693fc95fe0304d473f92304bbff98228163

SHA256
1847e8bd5a5755865ae39b8430c1e123567231a953e5168f504c1949c4fea7cb

SHA512
9a23109f464d3bb0ea962ca80f877fce9ff48d4acfadb1f6b960adc24abfcbdd2e4ea0922383f777238a168f74da4f1a531a0c8d9c9045d67950d4d20b10eb56

Download Submit
\Windows\system\ztTfcmw.exe

Filesize
1.7MB

MD5
14447cd5195f3a9fb9c22a5ade06ba5d

SHA1
40fc6f7b1ee9621fc51622d4badb98ec693d9a96

SHA256
0802c12cb76007a62e73547fcd8b31424dba870de37bd9966f17cde1aa3b001c

SHA512
6d72f4e5bd08c83dbd82ad30884c2708504395cabac0a82c119fea1dfb8625e064e6c134ad12a5b222ae4a326c7aae629d0fbb94033bb4bc4f31a2939c4d7be6

Download Submit
memory/1364-5354-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/1364-18-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/1436-170-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/1436-5633-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-165-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-152-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-168-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2180-159-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2180-166-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2180-35-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-173-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2180-174-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2180-7-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-169-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2180-1079-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-0-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-84-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-25-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-14-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-16972-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2180-17361-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2368-36-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/2368-40-0x0000000001F60000-0x0000000001F68000-memory.dmp

Filesize
32KB

Download
memory/2384-5437-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-42-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-5433-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2464-167-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2504-5635-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-171-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-33-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2620-132-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-5350-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2656-32-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2908-1124-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2908-5398-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2908-12-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2960-5637-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2960-172-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download