xmrig | 1ea48d3ecfc182aec295b602075a0b0fec48bcfc5c8743721b0bb22c1441109d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
Size

1.9MB
MD5

18d708bb8ec38d98210415284ae03b40
SHA1

72e6913c4521f00c96ca654492f685070855f75f
SHA256

1ea48d3ecfc182aec295b602075a0b0fec48bcfc5c8743721b0bb22c1441109d
SHA512

a4771790bbfbb3bf063ed313353bfff67c01022fa39c3878e9172dc1c319ab731c2fd1e001b4baca2cd3082122901089d4dd5a9985b2fd553f6aa2798154400e
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXYPGg8O:NAB+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/2612-234-0x00007FF7964E0000-0x00007FF7968D2000-memory.dmp	xmrig
behavioral2/memory/5004-238-0x00007FF7B11A0000-0x00007FF7B1592000-memory.dmp	xmrig
behavioral2/memory/2688-243-0x00007FF7D0DF0000-0x00007FF7D11E2000-memory.dmp	xmrig
behavioral2/memory/1444-364-0x00007FF6ABD20000-0x00007FF6AC112000-memory.dmp	xmrig
behavioral2/memory/1704-370-0x00007FF67DDC0000-0x00007FF67E1B2000-memory.dmp	xmrig
behavioral2/memory/3632-365-0x00007FF6E1660000-0x00007FF6E1A52000-memory.dmp	xmrig
behavioral2/memory/2480-246-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp	xmrig
behavioral2/memory/3568-245-0x00007FF728480000-0x00007FF728872000-memory.dmp	xmrig
behavioral2/memory/2516-244-0x00007FF6922A0000-0x00007FF692692000-memory.dmp	xmrig
behavioral2/memory/1688-242-0x00007FF7AEEA0000-0x00007FF7AF292000-memory.dmp	xmrig
behavioral2/memory/4924-241-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp	xmrig
behavioral2/memory/2592-240-0x00007FF6AE8E0000-0x00007FF6AECD2000-memory.dmp	xmrig
behavioral2/memory/848-239-0x00007FF681810000-0x00007FF681C02000-memory.dmp	xmrig
behavioral2/memory/4084-237-0x00007FF77B160000-0x00007FF77B552000-memory.dmp	xmrig
behavioral2/memory/3188-236-0x00007FF708900000-0x00007FF708CF2000-memory.dmp	xmrig
behavioral2/memory/4588-235-0x00007FF655460000-0x00007FF655852000-memory.dmp	xmrig
behavioral2/memory/3492-233-0x00007FF681DC0000-0x00007FF6821B2000-memory.dmp	xmrig
behavioral2/memory/4316-232-0x00007FF661870000-0x00007FF661C62000-memory.dmp	xmrig
behavioral2/memory/3276-231-0x00007FF636460000-0x00007FF636852000-memory.dmp	xmrig
behavioral2/memory/4340-230-0x00007FF7A0DB0000-0x00007FF7A11A2000-memory.dmp	xmrig
behavioral2/memory/2564-202-0x00007FF681E40000-0x00007FF682232000-memory.dmp	xmrig
behavioral2/memory/4312-197-0x00007FF7F3BC0000-0x00007FF7F3FB2000-memory.dmp	xmrig
behavioral2/memory/4104-145-0x00007FF6AE4D0000-0x00007FF6AE8C2000-memory.dmp	xmrig
behavioral2/memory/4340-4659-0x00007FF7A0DB0000-0x00007FF7A11A2000-memory.dmp	xmrig
behavioral2/memory/1444-4661-0x00007FF6ABD20000-0x00007FF6AC112000-memory.dmp	xmrig
behavioral2/memory/4084-4665-0x00007FF77B160000-0x00007FF77B552000-memory.dmp	xmrig
behavioral2/memory/4104-4670-0x00007FF6AE4D0000-0x00007FF6AE8C2000-memory.dmp	xmrig
behavioral2/memory/2564-4676-0x00007FF681E40000-0x00007FF682232000-memory.dmp	xmrig
behavioral2/memory/4316-4693-0x00007FF661870000-0x00007FF661C62000-memory.dmp	xmrig
behavioral2/memory/3276-4706-0x00007FF636460000-0x00007FF636852000-memory.dmp	xmrig
behavioral2/memory/4924-4734-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp	xmrig
behavioral2/memory/1688-4732-0x00007FF7AEEA0000-0x00007FF7AF292000-memory.dmp	xmrig
behavioral2/memory/5004-4729-0x00007FF7B11A0000-0x00007FF7B1592000-memory.dmp	xmrig
behavioral2/memory/3568-4720-0x00007FF728480000-0x00007FF728872000-memory.dmp	xmrig
behavioral2/memory/2688-4717-0x00007FF7D0DF0000-0x00007FF7D11E2000-memory.dmp	xmrig
behavioral2/memory/848-4715-0x00007FF681810000-0x00007FF681C02000-memory.dmp	xmrig
behavioral2/memory/2480-4712-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp	xmrig
behavioral2/memory/2516-4708-0x00007FF6922A0000-0x00007FF692692000-memory.dmp	xmrig
behavioral2/memory/2592-4701-0x00007FF6AE8E0000-0x00007FF6AECD2000-memory.dmp	xmrig
behavioral2/memory/2612-4695-0x00007FF7964E0000-0x00007FF7968D2000-memory.dmp	xmrig
behavioral2/memory/3492-4690-0x00007FF681DC0000-0x00007FF6821B2000-memory.dmp	xmrig
behavioral2/memory/3188-4681-0x00007FF708900000-0x00007FF708CF2000-memory.dmp	xmrig
behavioral2/memory/4588-4678-0x00007FF655460000-0x00007FF655852000-memory.dmp	xmrig
behavioral2/memory/1704-4774-0x00007FF67DDC0000-0x00007FF67E1B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1656	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3208	bejitqJ.exe
1444	VbqzSBl.exe
4104	RedxnwK.exe
3632	vrfbqMx.exe
4312	yaEbPQC.exe
2564	JNINyEt.exe
4340	UKLlHzl.exe
3276	UsqtQUN.exe
4316	oNgQXtp.exe
3492	Sqncmnh.exe
2612	vOBoxwY.exe
4588	UokzOIk.exe
3188	myCuPLV.exe
4084	KbmHcpt.exe
5004	xwsRxzr.exe
848	FWBrMdb.exe
2592	TSaJaEv.exe
4924	xjQplYo.exe
1688	IATGzau.exe
2688	yiAtEkH.exe
2516	XbkraIF.exe
3568	pGPPvEW.exe
1704	TjkxtvQ.exe
2480	lpmpDAI.exe
948	AtXtlZl.exe
1392	pYCjgPZ.exe
3616	gNCzRvI.exe
4004	IFamZEw.exe
3136	strgOMR.exe
4940	JopdLcQ.exe
4856	qmGGvND.exe
2464	aeGuwDz.exe
4524	WMgilRR.exe
1644	ThZDDlx.exe
2484	vroaXMb.exe
4784	ffbdCSZ.exe
1276	MYLEMYv.exe
2068	bwAPRZj.exe
3604	NursNEH.exe
3336	TqJwZhK.exe
2976	ZyWrmgN.exe
1856	utEEcdx.exe
3876	uZbjZXg.exe
5012	IlmKGPY.exe
2584	EDsYgkb.exe
1272	LcqqzRR.exe
1052	JzRKxHk.exe
4420	gQRfyhg.exe
2532	CImCzUY.exe
4884	lSyLdjF.exe
4384	uLoSUVu.exe
1952	pxubiKC.exe
2684	DjomFza.exe
228	imvhfHO.exe
3488	VHEXnWU.exe
4184	TakRLaP.exe
3212	WbpNXGu.exe
4796	OIKXmBH.exe
4324	gEkcDiL.exe
4292	uvlKLkl.exe
1340	xKgCoKi.exe
4932	JiueYVA.exe
1292	yQiPejT.exe
1396	kWdYIup.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4992-0-0x00007FF62EB30000-0x00007FF62EF22000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-7.dat	upx
behavioral2/files/0x000700000002328e-11.dat	upx
behavioral2/files/0x00070000000233fa-10.dat	upx
behavioral2/files/0x0007000000023400-46.dat	upx
behavioral2/files/0x00070000000233fd-26.dat	upx
behavioral2/files/0x00070000000233fc-25.dat	upx
behavioral2/files/0x00070000000233fe-29.dat	upx
behavioral2/memory/3208-18-0x00007FF7B66E0000-0x00007FF7B6AD2000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-32.dat	upx
behavioral2/files/0x000700000002340d-136.dat	upx
behavioral2/files/0x0007000000023415-168.dat	upx
behavioral2/files/0x0007000000023421-206.dat	upx
behavioral2/memory/2612-234-0x00007FF7964E0000-0x00007FF7968D2000-memory.dmp	upx
behavioral2/memory/5004-238-0x00007FF7B11A0000-0x00007FF7B1592000-memory.dmp	upx
behavioral2/memory/2688-243-0x00007FF7D0DF0000-0x00007FF7D11E2000-memory.dmp	upx
behavioral2/memory/1444-364-0x00007FF6ABD20000-0x00007FF6AC112000-memory.dmp	upx
behavioral2/memory/1704-370-0x00007FF67DDC0000-0x00007FF67E1B2000-memory.dmp	upx
behavioral2/memory/3632-365-0x00007FF6E1660000-0x00007FF6E1A52000-memory.dmp	upx
behavioral2/memory/2480-246-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp	upx
behavioral2/memory/3568-245-0x00007FF728480000-0x00007FF728872000-memory.dmp	upx
behavioral2/memory/2516-244-0x00007FF6922A0000-0x00007FF692692000-memory.dmp	upx
behavioral2/memory/1688-242-0x00007FF7AEEA0000-0x00007FF7AF292000-memory.dmp	upx
behavioral2/memory/4924-241-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp	upx
behavioral2/memory/2592-240-0x00007FF6AE8E0000-0x00007FF6AECD2000-memory.dmp	upx
behavioral2/memory/848-239-0x00007FF681810000-0x00007FF681C02000-memory.dmp	upx
behavioral2/memory/4084-237-0x00007FF77B160000-0x00007FF77B552000-memory.dmp	upx
behavioral2/memory/3188-236-0x00007FF708900000-0x00007FF708CF2000-memory.dmp	upx
behavioral2/memory/4588-235-0x00007FF655460000-0x00007FF655852000-memory.dmp	upx
behavioral2/memory/3492-233-0x00007FF681DC0000-0x00007FF6821B2000-memory.dmp	upx
behavioral2/memory/4316-232-0x00007FF661870000-0x00007FF661C62000-memory.dmp	upx
behavioral2/memory/3276-231-0x00007FF636460000-0x00007FF636852000-memory.dmp	upx
behavioral2/memory/4340-230-0x00007FF7A0DB0000-0x00007FF7A11A2000-memory.dmp	upx
behavioral2/files/0x0007000000023419-203.dat	upx
behavioral2/memory/2564-202-0x00007FF681E40000-0x00007FF682232000-memory.dmp	upx
behavioral2/memory/4312-197-0x00007FF7F3BC0000-0x00007FF7F3FB2000-memory.dmp	upx
behavioral2/files/0x0007000000023420-193.dat	upx
behavioral2/files/0x0007000000023418-189.dat	upx
behavioral2/files/0x000700000002341f-188.dat	upx
behavioral2/files/0x000700000002341e-185.dat	upx
behavioral2/files/0x0007000000023416-182.dat	upx
behavioral2/files/0x000700000002340e-169.dat	upx
behavioral2/files/0x0007000000023414-167.dat	upx
behavioral2/files/0x000700000002340c-163.dat	upx
behavioral2/files/0x0007000000023412-162.dat	upx
behavioral2/files/0x0007000000023409-154.dat	upx
behavioral2/files/0x000700000002341a-150.dat	upx
behavioral2/files/0x0007000000023410-149.dat	upx
behavioral2/memory/4104-145-0x00007FF6AE4D0000-0x00007FF6AE8C2000-memory.dmp	upx
behavioral2/files/0x0007000000023417-141.dat	upx
behavioral2/files/0x0007000000023413-133.dat	upx
behavioral2/files/0x000700000002341c-158.dat	upx
behavioral2/files/0x0007000000023406-127.dat	upx
behavioral2/files/0x000700000002341b-157.dat	upx
behavioral2/files/0x0007000000023411-124.dat	upx
behavioral2/files/0x0007000000023403-120.dat	upx
behavioral2/files/0x0007000000023401-117.dat	upx
behavioral2/files/0x0007000000023408-148.dat	upx
behavioral2/files/0x0007000000023402-111.dat	upx
behavioral2/files/0x000700000002340f-109.dat	upx
behavioral2/files/0x000700000002340b-95.dat	upx
behavioral2/files/0x0007000000023405-86.dat	upx
behavioral2/files/0x0007000000023404-84.dat	upx
behavioral2/files/0x0007000000023407-68.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kqQdbHv.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\YKWhCVK.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\QfqOkdQ.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\LKeItam.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\sHNWbhb.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\hSratla.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\cncWvUi.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\AKcxkQL.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\cLnPcpN.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\xuZYTvi.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\YJCQnxJ.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\SNUOlrB.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\qgEVfRz.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\FdSvpyp.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\GRLMjzG.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\uvXqOlo.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\AakmAfJ.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\AViFVHJ.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\POccSbv.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\SjVqLbv.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\wfloJel.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\xtVTFdy.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\kvvYALb.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\ftnfzLP.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\QGRfjjv.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\xGQTYlD.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\pAxLrwn.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\xMsNufU.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\ECFNLcm.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\xvEuHDs.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\MWVDRoX.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\IAfqjKS.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\XvlpHbn.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\eLhIDWC.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\NKUZkxy.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\SvLTTjG.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\vNMMHmL.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\HAhLMKB.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\QggHgCu.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\CeYhKlz.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\LpDrQJd.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\RqXwLnN.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\nsntlGu.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\AQIRZJa.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\ffoiuiJ.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\fBYnnml.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\FOxCqGC.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\sQMWkhR.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\rmVpXpr.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\RAwZbKg.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\pkxupBR.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\UWbcUVt.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\AdfTyZl.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\mRkrFqH.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\joWXERt.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\SqSoBma.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\BdUohpL.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\xtLQUmr.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\YCctlkN.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\vTrVreL.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\LhjwVpf.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\McAVKUR.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\tDbrJxc.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\swoaLSq.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1656	powershell.exe
1656	powershell.exe
1656	powershell.exe
1656	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeLockMemoryPrivilege	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 1656	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	86
PID 4992 wrote to memory of 1656	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	86
PID 4992 wrote to memory of 3208	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	87
PID 4992 wrote to memory of 3208	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	87
PID 4992 wrote to memory of 1444	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	88
PID 4992 wrote to memory of 1444	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	88
PID 4992 wrote to memory of 4104	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	89
PID 4992 wrote to memory of 4104	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	89
PID 4992 wrote to memory of 3632	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	90
PID 4992 wrote to memory of 3632	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	90
PID 4992 wrote to memory of 4312	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	91
PID 4992 wrote to memory of 4312	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	91
PID 4992 wrote to memory of 2564	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	92
PID 4992 wrote to memory of 2564	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	92
PID 4992 wrote to memory of 4340	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	93
PID 4992 wrote to memory of 4340	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	93
PID 4992 wrote to memory of 3276	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	94
PID 4992 wrote to memory of 3276	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	94
PID 4992 wrote to memory of 4316	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	95
PID 4992 wrote to memory of 4316	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	95
PID 4992 wrote to memory of 3492	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	96
PID 4992 wrote to memory of 3492	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	96
PID 4992 wrote to memory of 2612	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	97
PID 4992 wrote to memory of 2612	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	97
PID 4992 wrote to memory of 4588	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	98
PID 4992 wrote to memory of 4588	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	98
PID 4992 wrote to memory of 3188	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	99
PID 4992 wrote to memory of 3188	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	99
PID 4992 wrote to memory of 2592	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	100
PID 4992 wrote to memory of 2592	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	100
PID 4992 wrote to memory of 4084	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	101
PID 4992 wrote to memory of 4084	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	101
PID 4992 wrote to memory of 5004	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	102
PID 4992 wrote to memory of 5004	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	102
PID 4992 wrote to memory of 848	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	103
PID 4992 wrote to memory of 848	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	103
PID 4992 wrote to memory of 4924	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	104
PID 4992 wrote to memory of 4924	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	104
PID 4992 wrote to memory of 1688	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	105
PID 4992 wrote to memory of 1688	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	105
PID 4992 wrote to memory of 2688	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	106
PID 4992 wrote to memory of 2688	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	106
PID 4992 wrote to memory of 2516	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	107
PID 4992 wrote to memory of 2516	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	107
PID 4992 wrote to memory of 3568	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	108
PID 4992 wrote to memory of 3568	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	108
PID 4992 wrote to memory of 1704	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	109
PID 4992 wrote to memory of 1704	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	109
PID 4992 wrote to memory of 2480	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	110
PID 4992 wrote to memory of 2480	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	110
PID 4992 wrote to memory of 948	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	111
PID 4992 wrote to memory of 948	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	111
PID 4992 wrote to memory of 4524	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	112
PID 4992 wrote to memory of 4524	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	112
PID 4992 wrote to memory of 1392	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	113
PID 4992 wrote to memory of 1392	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	113
PID 4992 wrote to memory of 1644	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	114
PID 4992 wrote to memory of 1644	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	114
PID 4992 wrote to memory of 2484	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	115
PID 4992 wrote to memory of 2484	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	115
PID 4992 wrote to memory of 3616	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	116
PID 4992 wrote to memory of 3616	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	116
PID 4992 wrote to memory of 4004	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	117
PID 4992 wrote to memory of 4004	4992	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- C:\Windows\System\bejitqJ.exe
  C:\Windows\System\bejitqJ.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\VbqzSBl.exe
  C:\Windows\System\VbqzSBl.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\RedxnwK.exe
  C:\Windows\System\RedxnwK.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\vrfbqMx.exe
  C:\Windows\System\vrfbqMx.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\yaEbPQC.exe
  C:\Windows\System\yaEbPQC.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\JNINyEt.exe
  C:\Windows\System\JNINyEt.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\UKLlHzl.exe
  C:\Windows\System\UKLlHzl.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\UsqtQUN.exe
  C:\Windows\System\UsqtQUN.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\oNgQXtp.exe
  C:\Windows\System\oNgQXtp.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\Sqncmnh.exe
  C:\Windows\System\Sqncmnh.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\vOBoxwY.exe
  C:\Windows\System\vOBoxwY.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\UokzOIk.exe
  C:\Windows\System\UokzOIk.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\myCuPLV.exe
  C:\Windows\System\myCuPLV.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\TSaJaEv.exe
  C:\Windows\System\TSaJaEv.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\KbmHcpt.exe
  C:\Windows\System\KbmHcpt.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\xwsRxzr.exe
  C:\Windows\System\xwsRxzr.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\FWBrMdb.exe
  C:\Windows\System\FWBrMdb.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\xjQplYo.exe
  C:\Windows\System\xjQplYo.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\IATGzau.exe
  C:\Windows\System\IATGzau.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\yiAtEkH.exe
  C:\Windows\System\yiAtEkH.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\XbkraIF.exe
  C:\Windows\System\XbkraIF.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\pGPPvEW.exe
  C:\Windows\System\pGPPvEW.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\TjkxtvQ.exe
  C:\Windows\System\TjkxtvQ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\lpmpDAI.exe
  C:\Windows\System\lpmpDAI.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\AtXtlZl.exe
  C:\Windows\System\AtXtlZl.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\WMgilRR.exe
  C:\Windows\System\WMgilRR.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\pYCjgPZ.exe
  C:\Windows\System\pYCjgPZ.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\ThZDDlx.exe
  C:\Windows\System\ThZDDlx.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\vroaXMb.exe
  C:\Windows\System\vroaXMb.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\gNCzRvI.exe
  C:\Windows\System\gNCzRvI.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\IFamZEw.exe
  C:\Windows\System\IFamZEw.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\strgOMR.exe
  C:\Windows\System\strgOMR.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\NursNEH.exe
  C:\Windows\System\NursNEH.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\JopdLcQ.exe
  C:\Windows\System\JopdLcQ.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\qmGGvND.exe
  C:\Windows\System\qmGGvND.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\aeGuwDz.exe
  C:\Windows\System\aeGuwDz.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\uZbjZXg.exe
  C:\Windows\System\uZbjZXg.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\ffbdCSZ.exe
  C:\Windows\System\ffbdCSZ.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\MYLEMYv.exe
  C:\Windows\System\MYLEMYv.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\bwAPRZj.exe
  C:\Windows\System\bwAPRZj.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\TqJwZhK.exe
  C:\Windows\System\TqJwZhK.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\ZyWrmgN.exe
  C:\Windows\System\ZyWrmgN.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\utEEcdx.exe
  C:\Windows\System\utEEcdx.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\IlmKGPY.exe
  C:\Windows\System\IlmKGPY.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\EDsYgkb.exe
  C:\Windows\System\EDsYgkb.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\LcqqzRR.exe
  C:\Windows\System\LcqqzRR.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\JzRKxHk.exe
  C:\Windows\System\JzRKxHk.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\gQRfyhg.exe
  C:\Windows\System\gQRfyhg.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\CImCzUY.exe
  C:\Windows\System\CImCzUY.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\lSyLdjF.exe
  C:\Windows\System\lSyLdjF.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\uLoSUVu.exe
  C:\Windows\System\uLoSUVu.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\pxubiKC.exe
  C:\Windows\System\pxubiKC.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\DjomFza.exe
  C:\Windows\System\DjomFza.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\imvhfHO.exe
  C:\Windows\System\imvhfHO.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\VHEXnWU.exe
  C:\Windows\System\VHEXnWU.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\TakRLaP.exe
  C:\Windows\System\TakRLaP.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\WbpNXGu.exe
  C:\Windows\System\WbpNXGu.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\OIKXmBH.exe
  C:\Windows\System\OIKXmBH.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\gEkcDiL.exe
  C:\Windows\System\gEkcDiL.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\uvlKLkl.exe
  C:\Windows\System\uvlKLkl.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\xKgCoKi.exe
  C:\Windows\System\xKgCoKi.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\JiueYVA.exe
  C:\Windows\System\JiueYVA.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\yQiPejT.exe
  C:\Windows\System\yQiPejT.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\kWdYIup.exe
  C:\Windows\System\kWdYIup.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\qsmmgyM.exe
  C:\Windows\System\qsmmgyM.exe
  2⤵
  PID:4704
- C:\Windows\System\FqTChZP.exe
  C:\Windows\System\FqTChZP.exe
  2⤵
  PID:760
- C:\Windows\System\yGOGoNt.exe
  C:\Windows\System\yGOGoNt.exe
  2⤵
  PID:548
- C:\Windows\System\gjJCVTF.exe
  C:\Windows\System\gjJCVTF.exe
  2⤵
  PID:640
- C:\Windows\System\cbtFmIh.exe
  C:\Windows\System\cbtFmIh.exe
  2⤵
  PID:3788
- C:\Windows\System\AqkJCtR.exe
  C:\Windows\System\AqkJCtR.exe
  2⤵
  PID:4956
- C:\Windows\System\bKFXfgz.exe
  C:\Windows\System\bKFXfgz.exe
  2⤵
  PID:912
- C:\Windows\System\ANktVWm.exe
  C:\Windows\System\ANktVWm.exe
  2⤵
  PID:4216
- C:\Windows\System\VtCYFLw.exe
  C:\Windows\System\VtCYFLw.exe
  2⤵
  PID:60
- C:\Windows\System\ePplIhS.exe
  C:\Windows\System\ePplIhS.exe
  2⤵
  PID:3716
- C:\Windows\System\FIhdnTU.exe
  C:\Windows\System\FIhdnTU.exe
  2⤵
  PID:3268
- C:\Windows\System\GOuJRpi.exe
  C:\Windows\System\GOuJRpi.exe
  2⤵
  PID:1460
- C:\Windows\System\nHZfuHA.exe
  C:\Windows\System\nHZfuHA.exe
  2⤵
  PID:348
- C:\Windows\System\HtvRcSr.exe
  C:\Windows\System\HtvRcSr.exe
  2⤵
  PID:4076
- C:\Windows\System\WUtPJjB.exe
  C:\Windows\System\WUtPJjB.exe
  2⤵
  PID:5124
- C:\Windows\System\jtqYQiy.exe
  C:\Windows\System\jtqYQiy.exe
  2⤵
  PID:5148
- C:\Windows\System\MKPMYmO.exe
  C:\Windows\System\MKPMYmO.exe
  2⤵
  PID:5168
- C:\Windows\System\rHmMNvf.exe
  C:\Windows\System\rHmMNvf.exe
  2⤵
  PID:5196
- C:\Windows\System\VMKcAhc.exe
  C:\Windows\System\VMKcAhc.exe
  2⤵
  PID:5212
- C:\Windows\System\qzEeCGK.exe
  C:\Windows\System\qzEeCGK.exe
  2⤵
  PID:5232
- C:\Windows\System\UQkTFmA.exe
  C:\Windows\System\UQkTFmA.exe
  2⤵
  PID:5256
- C:\Windows\System\YJndkNH.exe
  C:\Windows\System\YJndkNH.exe
  2⤵
  PID:5276
- C:\Windows\System\EbbGeXX.exe
  C:\Windows\System\EbbGeXX.exe
  2⤵
  PID:5308
- C:\Windows\System\xnZBIjJ.exe
  C:\Windows\System\xnZBIjJ.exe
  2⤵
  PID:5328
- C:\Windows\System\flRjYCK.exe
  C:\Windows\System\flRjYCK.exe
  2⤵
  PID:5348
- C:\Windows\System\wYrUqHg.exe
  C:\Windows\System\wYrUqHg.exe
  2⤵
  PID:5372
- C:\Windows\System\dpfRUyC.exe
  C:\Windows\System\dpfRUyC.exe
  2⤵
  PID:5388
- C:\Windows\System\yLIzAYp.exe
  C:\Windows\System\yLIzAYp.exe
  2⤵
  PID:5408
- C:\Windows\System\VqufzQG.exe
  C:\Windows\System\VqufzQG.exe
  2⤵
  PID:5424
- C:\Windows\System\tjEptLp.exe
  C:\Windows\System\tjEptLp.exe
  2⤵
  PID:5444
- C:\Windows\System\AVNIqbx.exe
  C:\Windows\System\AVNIqbx.exe
  2⤵
  PID:5536
- C:\Windows\System\GrpuNhA.exe
  C:\Windows\System\GrpuNhA.exe
  2⤵
  PID:5560
- C:\Windows\System\SPfEjFQ.exe
  C:\Windows\System\SPfEjFQ.exe
  2⤵
  PID:5580
- C:\Windows\System\dnxyvxa.exe
  C:\Windows\System\dnxyvxa.exe
  2⤵
  PID:5600
- C:\Windows\System\jbiItgq.exe
  C:\Windows\System\jbiItgq.exe
  2⤵
  PID:5616
- C:\Windows\System\uxRFGjy.exe
  C:\Windows\System\uxRFGjy.exe
  2⤵
  PID:5640
- C:\Windows\System\JMxUnmQ.exe
  C:\Windows\System\JMxUnmQ.exe
  2⤵
  PID:5664
- C:\Windows\System\gXoOOXA.exe
  C:\Windows\System\gXoOOXA.exe
  2⤵
  PID:5684
- C:\Windows\System\ouNEFYR.exe
  C:\Windows\System\ouNEFYR.exe
  2⤵
  PID:5704
- C:\Windows\System\qJNQWVj.exe
  C:\Windows\System\qJNQWVj.exe
  2⤵
  PID:5724
- C:\Windows\System\BYKCJKO.exe
  C:\Windows\System\BYKCJKO.exe
  2⤵
  PID:5840
- C:\Windows\System\nSQbDRv.exe
  C:\Windows\System\nSQbDRv.exe
  2⤵
  PID:5864
- C:\Windows\System\GCIcBru.exe
  C:\Windows\System\GCIcBru.exe
  2⤵
  PID:5896
- C:\Windows\System\ztobAjr.exe
  C:\Windows\System\ztobAjr.exe
  2⤵
  PID:5916
- C:\Windows\System\dItWAmx.exe
  C:\Windows\System\dItWAmx.exe
  2⤵
  PID:5940
- C:\Windows\System\MkzQDhi.exe
  C:\Windows\System\MkzQDhi.exe
  2⤵
  PID:5956
- C:\Windows\System\sYJuWhP.exe
  C:\Windows\System\sYJuWhP.exe
  2⤵
  PID:5980
- C:\Windows\System\EcINcSt.exe
  C:\Windows\System\EcINcSt.exe
  2⤵
  PID:6004
- C:\Windows\System\HQZPCSt.exe
  C:\Windows\System\HQZPCSt.exe
  2⤵
  PID:6024
- C:\Windows\System\uDOPScC.exe
  C:\Windows\System\uDOPScC.exe
  2⤵
  PID:6044
- C:\Windows\System\yTyBWav.exe
  C:\Windows\System\yTyBWav.exe
  2⤵
  PID:6068
- C:\Windows\System\rRLYsde.exe
  C:\Windows\System\rRLYsde.exe
  2⤵
  PID:6084
- C:\Windows\System\iqEULVK.exe
  C:\Windows\System\iqEULVK.exe
  2⤵
  PID:6108
- C:\Windows\System\wFPCryh.exe
  C:\Windows\System\wFPCryh.exe
  2⤵
  PID:6124
- C:\Windows\System\OBaBfZL.exe
  C:\Windows\System\OBaBfZL.exe
  2⤵
  PID:412
- C:\Windows\System\TRNOeWr.exe
  C:\Windows\System\TRNOeWr.exe
  2⤵
  PID:3792
- C:\Windows\System\yhTxdhD.exe
  C:\Windows\System\yhTxdhD.exe
  2⤵
  PID:2304
- C:\Windows\System\laCXZTL.exe
  C:\Windows\System\laCXZTL.exe
  2⤵
  PID:3348
- C:\Windows\System\qfRCPtR.exe
  C:\Windows\System\qfRCPtR.exe
  2⤵
  PID:3140
- C:\Windows\System\WDbYiFp.exe
  C:\Windows\System\WDbYiFp.exe
  2⤵
  PID:2424
- C:\Windows\System\zBpYdXk.exe
  C:\Windows\System\zBpYdXk.exe
  2⤵
  PID:5084
- C:\Windows\System\ESUmBUR.exe
  C:\Windows\System\ESUmBUR.exe
  2⤵
  PID:1876
- C:\Windows\System\VAWlrfy.exe
  C:\Windows\System\VAWlrfy.exe
  2⤵
  PID:5060
- C:\Windows\System\rWTZyux.exe
  C:\Windows\System\rWTZyux.exe
  2⤵
  PID:5088
- C:\Windows\System\KoHqrjb.exe
  C:\Windows\System\KoHqrjb.exe
  2⤵
  PID:5140
- C:\Windows\System\hpBMZcA.exe
  C:\Windows\System\hpBMZcA.exe
  2⤵
  PID:5184
- C:\Windows\System\PIwUrRK.exe
  C:\Windows\System\PIwUrRK.exe
  2⤵
  PID:5240
- C:\Windows\System\HilkPzm.exe
  C:\Windows\System\HilkPzm.exe
  2⤵
  PID:5288
- C:\Windows\System\lsTEzHe.exe
  C:\Windows\System\lsTEzHe.exe
  2⤵
  PID:5320
- C:\Windows\System\MZWCVOu.exe
  C:\Windows\System\MZWCVOu.exe
  2⤵
  PID:5380
- C:\Windows\System\PSOJWPF.exe
  C:\Windows\System\PSOJWPF.exe
  2⤵
  PID:5440
- C:\Windows\System\rIHImRS.exe
  C:\Windows\System\rIHImRS.exe
  2⤵
  PID:5924
- C:\Windows\System\IJKRCCw.exe
  C:\Windows\System\IJKRCCw.exe
  2⤵
  PID:5988
- C:\Windows\System\FloxTeR.exe
  C:\Windows\System\FloxTeR.exe
  2⤵
  PID:6040
- C:\Windows\System\LPdlvYK.exe
  C:\Windows\System\LPdlvYK.exe
  2⤵
  PID:6116
- C:\Windows\System\BcLbNTB.exe
  C:\Windows\System\BcLbNTB.exe
  2⤵
  PID:6152
- C:\Windows\System\oioPbzl.exe
  C:\Windows\System\oioPbzl.exe
  2⤵
  PID:6168
- C:\Windows\System\habhqJU.exe
  C:\Windows\System\habhqJU.exe
  2⤵
  PID:6192
- C:\Windows\System\ncWgBKu.exe
  C:\Windows\System\ncWgBKu.exe
  2⤵
  PID:6212
- C:\Windows\System\djmOtDA.exe
  C:\Windows\System\djmOtDA.exe
  2⤵
  PID:6236
- C:\Windows\System\MdclzJd.exe
  C:\Windows\System\MdclzJd.exe
  2⤵
  PID:6252
- C:\Windows\System\rYYSGuY.exe
  C:\Windows\System\rYYSGuY.exe
  2⤵
  PID:6272
- C:\Windows\System\ZQTUWPA.exe
  C:\Windows\System\ZQTUWPA.exe
  2⤵
  PID:6304
- C:\Windows\System\PnSwDCY.exe
  C:\Windows\System\PnSwDCY.exe
  2⤵
  PID:6324
- C:\Windows\System\dWtpqYp.exe
  C:\Windows\System\dWtpqYp.exe
  2⤵
  PID:6344
- C:\Windows\System\UgpekYc.exe
  C:\Windows\System\UgpekYc.exe
  2⤵
  PID:6364
- C:\Windows\System\piIuAcH.exe
  C:\Windows\System\piIuAcH.exe
  2⤵
  PID:6384
- C:\Windows\System\FLIDMFt.exe
  C:\Windows\System\FLIDMFt.exe
  2⤵
  PID:6400
- C:\Windows\System\XRGekfL.exe
  C:\Windows\System\XRGekfL.exe
  2⤵
  PID:6424
- C:\Windows\System\VwPskJd.exe
  C:\Windows\System\VwPskJd.exe
  2⤵
  PID:6540
- C:\Windows\System\FWkxCQx.exe
  C:\Windows\System\FWkxCQx.exe
  2⤵
  PID:6560
- C:\Windows\System\SpRjtgR.exe
  C:\Windows\System\SpRjtgR.exe
  2⤵
  PID:6584
- C:\Windows\System\HiFSNPA.exe
  C:\Windows\System\HiFSNPA.exe
  2⤵
  PID:6600
- C:\Windows\System\pZpbQAv.exe
  C:\Windows\System\pZpbQAv.exe
  2⤵
  PID:6620
- C:\Windows\System\usSWcnn.exe
  C:\Windows\System\usSWcnn.exe
  2⤵
  PID:6648
- C:\Windows\System\cdTCvVp.exe
  C:\Windows\System\cdTCvVp.exe
  2⤵
  PID:6668
- C:\Windows\System\VbWQaKu.exe
  C:\Windows\System\VbWQaKu.exe
  2⤵
  PID:6684
- C:\Windows\System\kYxRYeZ.exe
  C:\Windows\System\kYxRYeZ.exe
  2⤵
  PID:6704
- C:\Windows\System\EVuDZem.exe
  C:\Windows\System\EVuDZem.exe
  2⤵
  PID:6728
- C:\Windows\System\AYXjIwt.exe
  C:\Windows\System\AYXjIwt.exe
  2⤵
  PID:6744
- C:\Windows\System\wQHqaBT.exe
  C:\Windows\System\wQHqaBT.exe
  2⤵
  PID:6772
- C:\Windows\System\DmvKlyj.exe
  C:\Windows\System\DmvKlyj.exe
  2⤵
  PID:6792
- C:\Windows\System\BihFyJE.exe
  C:\Windows\System\BihFyJE.exe
  2⤵
  PID:6832
- C:\Windows\System\FkyoltK.exe
  C:\Windows\System\FkyoltK.exe
  2⤵
  PID:6880
- C:\Windows\System\dJJUdQa.exe
  C:\Windows\System\dJJUdQa.exe
  2⤵
  PID:6904
- C:\Windows\System\wvrOdiY.exe
  C:\Windows\System\wvrOdiY.exe
  2⤵
  PID:6928
- C:\Windows\System\WUIXcQt.exe
  C:\Windows\System\WUIXcQt.exe
  2⤵
  PID:6948
- C:\Windows\System\HcbbJTC.exe
  C:\Windows\System\HcbbJTC.exe
  2⤵
  PID:7008
- C:\Windows\System\eEOGdSp.exe
  C:\Windows\System\eEOGdSp.exe
  2⤵
  PID:7028
- C:\Windows\System\vYKqKDT.exe
  C:\Windows\System\vYKqKDT.exe
  2⤵
  PID:7052
- C:\Windows\System\sEoDuVb.exe
  C:\Windows\System\sEoDuVb.exe
  2⤵
  PID:7068
- C:\Windows\System\DcUmvTg.exe
  C:\Windows\System\DcUmvTg.exe
  2⤵
  PID:7092
- C:\Windows\System\mSEZxJb.exe
  C:\Windows\System\mSEZxJb.exe
  2⤵
  PID:7116
- C:\Windows\System\nULJlBn.exe
  C:\Windows\System\nULJlBn.exe
  2⤵
  PID:7144
- C:\Windows\System\pkEiBJn.exe
  C:\Windows\System\pkEiBJn.exe
  2⤵
  PID:7164
- C:\Windows\System\wciaZtU.exe
  C:\Windows\System\wciaZtU.exe
  2⤵
  PID:4424
- C:\Windows\System\VqZVjzR.exe
  C:\Windows\System\VqZVjzR.exe
  2⤵
  PID:5476
- C:\Windows\System\DvOAHtI.exe
  C:\Windows\System\DvOAHtI.exe
  2⤵
  PID:5552
- C:\Windows\System\BVzUOQP.exe
  C:\Windows\System\BVzUOQP.exe
  2⤵
  PID:5596
- C:\Windows\System\XNayuur.exe
  C:\Windows\System\XNayuur.exe
  2⤵
  PID:5632
- C:\Windows\System\rindiRp.exe
  C:\Windows\System\rindiRp.exe
  2⤵
  PID:5676
- C:\Windows\System\MZimiQl.exe
  C:\Windows\System\MZimiQl.exe
  2⤵
  PID:6160
- C:\Windows\System\ULjxYfG.exe
  C:\Windows\System\ULjxYfG.exe
  2⤵
  PID:6320
- C:\Windows\System\LePapIt.exe
  C:\Windows\System\LePapIt.exe
  2⤵
  PID:6356
- C:\Windows\System\JRXUYvd.exe
  C:\Windows\System\JRXUYvd.exe
  2⤵
  PID:6408
- C:\Windows\System\IdriDor.exe
  C:\Windows\System\IdriDor.exe
  2⤵
  PID:5812
- C:\Windows\System\mGIuQUa.exe
  C:\Windows\System\mGIuQUa.exe
  2⤵
  PID:5860
- C:\Windows\System\DTGsOGk.exe
  C:\Windows\System\DTGsOGk.exe
  2⤵
  PID:3264
- C:\Windows\System\fjcyxOf.exe
  C:\Windows\System\fjcyxOf.exe
  2⤵
  PID:6576
- C:\Windows\System\MqkAHqj.exe
  C:\Windows\System\MqkAHqj.exe
  2⤵
  PID:1480
- C:\Windows\System\cKzdnlu.exe
  C:\Windows\System\cKzdnlu.exe
  2⤵
  PID:6764
- C:\Windows\System\UAEutZj.exe
  C:\Windows\System\UAEutZj.exe
  2⤵
  PID:1456
- C:\Windows\System\ZbpddhT.exe
  C:\Windows\System\ZbpddhT.exe
  2⤵
  PID:5104
- C:\Windows\System\VYzXshf.exe
  C:\Windows\System\VYzXshf.exe
  2⤵
  PID:5204
- C:\Windows\System\FIZgBzA.exe
  C:\Windows\System\FIZgBzA.exe
  2⤵
  PID:5268
- C:\Windows\System\izrJimU.exe
  C:\Windows\System\izrJimU.exe
  2⤵
  PID:5356
- C:\Windows\System\ljpVErZ.exe
  C:\Windows\System\ljpVErZ.exe
  2⤵
  PID:5948
- C:\Windows\System\jRfeMpn.exe
  C:\Windows\System\jRfeMpn.exe
  2⤵
  PID:6100
- C:\Windows\System\IUaHEBD.exe
  C:\Windows\System\IUaHEBD.exe
  2⤵
  PID:6204
- C:\Windows\System\qNuxrTV.exe
  C:\Windows\System\qNuxrTV.exe
  2⤵
  PID:6552
- C:\Windows\System\cNwsRJB.exe
  C:\Windows\System\cNwsRJB.exe
  2⤵
  PID:7084
- C:\Windows\System\dTtdjRB.exe
  C:\Windows\System\dTtdjRB.exe
  2⤵
  PID:6264
- C:\Windows\System\OACphuA.exe
  C:\Windows\System\OACphuA.exe
  2⤵
  PID:5472
- C:\Windows\System\KXixnft.exe
  C:\Windows\System\KXixnft.exe
  2⤵
  PID:5648
- C:\Windows\System\inoOOox.exe
  C:\Windows\System\inoOOox.exe
  2⤵
  PID:4660
- C:\Windows\System\EnGFpQH.exe
  C:\Windows\System\EnGFpQH.exe
  2⤵
  PID:7176
- C:\Windows\System\cOnuGUj.exe
  C:\Windows\System\cOnuGUj.exe
  2⤵
  PID:7200
- C:\Windows\System\CSzxYCs.exe
  C:\Windows\System\CSzxYCs.exe
  2⤵
  PID:7224
- C:\Windows\System\iJSVBxF.exe
  C:\Windows\System\iJSVBxF.exe
  2⤵
  PID:7256
- C:\Windows\System\OtdQoAN.exe
  C:\Windows\System\OtdQoAN.exe
  2⤵
  PID:7272
- C:\Windows\System\NcEbYCP.exe
  C:\Windows\System\NcEbYCP.exe
  2⤵
  PID:7292
- C:\Windows\System\RDEPxCM.exe
  C:\Windows\System\RDEPxCM.exe
  2⤵
  PID:7308
- C:\Windows\System\FrFwTCh.exe
  C:\Windows\System\FrFwTCh.exe
  2⤵
  PID:7328
- C:\Windows\System\FGEunVk.exe
  C:\Windows\System\FGEunVk.exe
  2⤵
  PID:7344
- C:\Windows\System\gBKAyBg.exe
  C:\Windows\System\gBKAyBg.exe
  2⤵
  PID:7392
- C:\Windows\System\xBlvKyi.exe
  C:\Windows\System\xBlvKyi.exe
  2⤵
  PID:7408
- C:\Windows\System\kLlnxxg.exe
  C:\Windows\System\kLlnxxg.exe
  2⤵
  PID:7432
- C:\Windows\System\RucdEeS.exe
  C:\Windows\System\RucdEeS.exe
  2⤵
  PID:7448
- C:\Windows\System\lWNbVRV.exe
  C:\Windows\System\lWNbVRV.exe
  2⤵
  PID:7476
- C:\Windows\System\dsXsBoW.exe
  C:\Windows\System\dsXsBoW.exe
  2⤵
  PID:7520
- C:\Windows\System\hOIEMtM.exe
  C:\Windows\System\hOIEMtM.exe
  2⤵
  PID:7556
- C:\Windows\System\YpSqSWv.exe
  C:\Windows\System\YpSqSWv.exe
  2⤵
  PID:7576
- C:\Windows\System\AsHpaLi.exe
  C:\Windows\System\AsHpaLi.exe
  2⤵
  PID:7596
- C:\Windows\System\fNHSSKA.exe
  C:\Windows\System\fNHSSKA.exe
  2⤵
  PID:7616
- C:\Windows\System\KJpCnup.exe
  C:\Windows\System\KJpCnup.exe
  2⤵
  PID:7632
- C:\Windows\System\jAlHAJr.exe
  C:\Windows\System\jAlHAJr.exe
  2⤵
  PID:7656
- C:\Windows\System\UqLqzcT.exe
  C:\Windows\System\UqLqzcT.exe
  2⤵
  PID:7680
- C:\Windows\System\YIcetXP.exe
  C:\Windows\System\YIcetXP.exe
  2⤵
  PID:7704
- C:\Windows\System\GJzPwvz.exe
  C:\Windows\System\GJzPwvz.exe
  2⤵
  PID:7732
- C:\Windows\System\QMjiNVD.exe
  C:\Windows\System\QMjiNVD.exe
  2⤵
  PID:7748
- C:\Windows\System\NztgMcn.exe
  C:\Windows\System\NztgMcn.exe
  2⤵
  PID:7772
- C:\Windows\System\wOGbBxO.exe
  C:\Windows\System\wOGbBxO.exe
  2⤵
  PID:7792
- C:\Windows\System\CEYdIKI.exe
  C:\Windows\System\CEYdIKI.exe
  2⤵
  PID:7812
- C:\Windows\System\nuURlNM.exe
  C:\Windows\System\nuURlNM.exe
  2⤵
  PID:7836
- C:\Windows\System\CfJcuyn.exe
  C:\Windows\System\CfJcuyn.exe
  2⤵
  PID:7860
- C:\Windows\System\HuUNEXa.exe
  C:\Windows\System\HuUNEXa.exe
  2⤵
  PID:7884
- C:\Windows\System\ToVuwZN.exe
  C:\Windows\System\ToVuwZN.exe
  2⤵
  PID:7912
- C:\Windows\System\jLcmpsu.exe
  C:\Windows\System\jLcmpsu.exe
  2⤵
  PID:7940
- C:\Windows\System\BrnyFwJ.exe
  C:\Windows\System\BrnyFwJ.exe
  2⤵
  PID:7960
- C:\Windows\System\BvYXpWN.exe
  C:\Windows\System\BvYXpWN.exe
  2⤵
  PID:7984
- C:\Windows\System\jIfMATS.exe
  C:\Windows\System\jIfMATS.exe
  2⤵
  PID:8000
- C:\Windows\System\AsQajKc.exe
  C:\Windows\System\AsQajKc.exe
  2⤵
  PID:8028
- C:\Windows\System\ZpyuoBr.exe
  C:\Windows\System\ZpyuoBr.exe
  2⤵
  PID:8048
- C:\Windows\System\vCQrMoB.exe
  C:\Windows\System\vCQrMoB.exe
  2⤵
  PID:8072
- C:\Windows\System\KNluXPz.exe
  C:\Windows\System\KNluXPz.exe
  2⤵
  PID:8132
- C:\Windows\System\mGfDwgK.exe
  C:\Windows\System\mGfDwgK.exe
  2⤵
  PID:8148
- C:\Windows\System\xtZOWki.exe
  C:\Windows\System\xtZOWki.exe
  2⤵
  PID:8164
- C:\Windows\System\XgmpbFy.exe
  C:\Windows\System\XgmpbFy.exe
  2⤵
  PID:8180
- C:\Windows\System\GjxmUHp.exe
  C:\Windows\System\GjxmUHp.exe
  2⤵
  PID:3692
- C:\Windows\System\WzKeTEO.exe
  C:\Windows\System\WzKeTEO.exe
  2⤵
  PID:6924
- C:\Windows\System\YYpoNeW.exe
  C:\Windows\System\YYpoNeW.exe
  2⤵
  PID:6080
- C:\Windows\System\uhFJwsy.exe
  C:\Windows\System\uhFJwsy.exe
  2⤵
  PID:6516
- C:\Windows\System\zmWLGlT.exe
  C:\Windows\System\zmWLGlT.exe
  2⤵
  PID:6372
- C:\Windows\System\nNfqWgA.exe
  C:\Windows\System\nNfqWgA.exe
  2⤵
  PID:1160
- C:\Windows\System\AqectzZ.exe
  C:\Windows\System\AqectzZ.exe
  2⤵
  PID:6612
- C:\Windows\System\ipKxDDl.exe
  C:\Windows\System\ipKxDDl.exe
  2⤵
  PID:6636
- C:\Windows\System\KnoBhaF.exe
  C:\Windows\System\KnoBhaF.exe
  2⤵
  PID:6572
- C:\Windows\System\MyWEjlB.exe
  C:\Windows\System\MyWEjlB.exe
  2⤵
  PID:5660
- C:\Windows\System\JxzeoUc.exe
  C:\Windows\System\JxzeoUc.exe
  2⤵
  PID:6036
- C:\Windows\System\MTrDTmM.exe
  C:\Windows\System\MTrDTmM.exe
  2⤵
  PID:6568
- C:\Windows\System\rhiWJNO.exe
  C:\Windows\System\rhiWJNO.exe
  2⤵
  PID:7172
- C:\Windows\System\aNnaLMo.exe
  C:\Windows\System\aNnaLMo.exe
  2⤵
  PID:8200
- C:\Windows\System\htHevBa.exe
  C:\Windows\System\htHevBa.exe
  2⤵
  PID:8224
- C:\Windows\System\NpPAKDB.exe
  C:\Windows\System\NpPAKDB.exe
  2⤵
  PID:8260
- C:\Windows\System\wicUUGb.exe
  C:\Windows\System\wicUUGb.exe
  2⤵
  PID:8280
- C:\Windows\System\WcqhEWP.exe
  C:\Windows\System\WcqhEWP.exe
  2⤵
  PID:8300
- C:\Windows\System\PeVOdPX.exe
  C:\Windows\System\PeVOdPX.exe
  2⤵
  PID:8316
- C:\Windows\System\DHunPus.exe
  C:\Windows\System\DHunPus.exe
  2⤵
  PID:8340
- C:\Windows\System\eBWjJJW.exe
  C:\Windows\System\eBWjJJW.exe
  2⤵
  PID:8360
- C:\Windows\System\UGSrahW.exe
  C:\Windows\System\UGSrahW.exe
  2⤵
  PID:8376
- C:\Windows\System\TJJKbpc.exe
  C:\Windows\System\TJJKbpc.exe
  2⤵
  PID:8396
- C:\Windows\System\ekmzFoY.exe
  C:\Windows\System\ekmzFoY.exe
  2⤵
  PID:8416
- C:\Windows\System\ORMTVNc.exe
  C:\Windows\System\ORMTVNc.exe
  2⤵
  PID:8436
- C:\Windows\System\yKIiotE.exe
  C:\Windows\System\yKIiotE.exe
  2⤵
  PID:8456
- C:\Windows\System\WFHLVVA.exe
  C:\Windows\System\WFHLVVA.exe
  2⤵
  PID:8472
- C:\Windows\System\UpoxXuZ.exe
  C:\Windows\System\UpoxXuZ.exe
  2⤵
  PID:8500
- C:\Windows\System\JpvnmaH.exe
  C:\Windows\System\JpvnmaH.exe
  2⤵
  PID:8528
- C:\Windows\System\ClpKJdf.exe
  C:\Windows\System\ClpKJdf.exe
  2⤵
  PID:8552
- C:\Windows\System\zBpsXuV.exe
  C:\Windows\System\zBpsXuV.exe
  2⤵
  PID:8568
- C:\Windows\System\RNXkGhr.exe
  C:\Windows\System\RNXkGhr.exe
  2⤵
  PID:8592
- C:\Windows\System\JNqGuWH.exe
  C:\Windows\System\JNqGuWH.exe
  2⤵
  PID:8616
- C:\Windows\System\cuiPmKR.exe
  C:\Windows\System\cuiPmKR.exe
  2⤵
  PID:8640
- C:\Windows\System\yYbZhHv.exe
  C:\Windows\System\yYbZhHv.exe
  2⤵
  PID:8660
- C:\Windows\System\yVKEieI.exe
  C:\Windows\System\yVKEieI.exe
  2⤵
  PID:8680
- C:\Windows\System\LgclZFu.exe
  C:\Windows\System\LgclZFu.exe
  2⤵
  PID:8704
- C:\Windows\System\HEvhzhk.exe
  C:\Windows\System\HEvhzhk.exe
  2⤵
  PID:8728
- C:\Windows\System\wAdtFzI.exe
  C:\Windows\System\wAdtFzI.exe
  2⤵
  PID:8744
- C:\Windows\System\kKysEVs.exe
  C:\Windows\System\kKysEVs.exe
  2⤵
  PID:8916
- C:\Windows\System\MkBlanN.exe
  C:\Windows\System\MkBlanN.exe
  2⤵
  PID:8932
- C:\Windows\System\FeSAOJH.exe
  C:\Windows\System\FeSAOJH.exe
  2⤵
  PID:8948
- C:\Windows\System\MpFeXfb.exe
  C:\Windows\System\MpFeXfb.exe
  2⤵
  PID:8964
- C:\Windows\System\ilDWTFH.exe
  C:\Windows\System\ilDWTFH.exe
  2⤵
  PID:8980
- C:\Windows\System\FkwWGEZ.exe
  C:\Windows\System\FkwWGEZ.exe
  2⤵
  PID:8996
- C:\Windows\System\YUbhvHd.exe
  C:\Windows\System\YUbhvHd.exe
  2⤵
  PID:9012
- C:\Windows\System\UHfjRXE.exe
  C:\Windows\System\UHfjRXE.exe
  2⤵
  PID:9028
- C:\Windows\System\wgTYpYa.exe
  C:\Windows\System\wgTYpYa.exe
  2⤵
  PID:9044
- C:\Windows\System\qNDmpNO.exe
  C:\Windows\System\qNDmpNO.exe
  2⤵
  PID:9060
- C:\Windows\System\RcovXVG.exe
  C:\Windows\System\RcovXVG.exe
  2⤵
  PID:9076
- C:\Windows\System\pNdtqXz.exe
  C:\Windows\System\pNdtqXz.exe
  2⤵
  PID:9092
- C:\Windows\System\NtNmzmT.exe
  C:\Windows\System\NtNmzmT.exe
  2⤵
  PID:9108
- C:\Windows\System\idRnPuU.exe
  C:\Windows\System\idRnPuU.exe
  2⤵
  PID:9124
- C:\Windows\System\rnVUuDz.exe
  C:\Windows\System\rnVUuDz.exe
  2⤵
  PID:9140
- C:\Windows\System\kOfvzOh.exe
  C:\Windows\System\kOfvzOh.exe
  2⤵
  PID:9156
- C:\Windows\System\UUgZORU.exe
  C:\Windows\System\UUgZORU.exe
  2⤵
  PID:9172
- C:\Windows\System\BTOBfTO.exe
  C:\Windows\System\BTOBfTO.exe
  2⤵
  PID:9188
- C:\Windows\System\CEFEyDE.exe
  C:\Windows\System\CEFEyDE.exe
  2⤵
  PID:9204
- C:\Windows\System\TccBWjk.exe
  C:\Windows\System\TccBWjk.exe
  2⤵
  PID:7924
- C:\Windows\System\aMvurWV.exe
  C:\Windows\System\aMvurWV.exe
  2⤵
  PID:8012
- C:\Windows\System\OJnXsdm.exe
  C:\Windows\System\OJnXsdm.exe
  2⤵
  PID:7324
- C:\Windows\System\gndqoYC.exe
  C:\Windows\System\gndqoYC.exe
  2⤵
  PID:7356
- C:\Windows\System\tvMSyIY.exe
  C:\Windows\System\tvMSyIY.exe
  2⤵
  PID:7404
- C:\Windows\System\PlAbBOU.exe
  C:\Windows\System\PlAbBOU.exe
  2⤵
  PID:7440
- C:\Windows\System\SBcmmer.exe
  C:\Windows\System\SBcmmer.exe
  2⤵
  PID:7672
- C:\Windows\System\thPPAyB.exe
  C:\Windows\System\thPPAyB.exe
  2⤵
  PID:7728
- C:\Windows\System\AlQqGNP.exe
  C:\Windows\System\AlQqGNP.exe
  2⤵
  PID:7780
- C:\Windows\System\RURFLSC.exe
  C:\Windows\System\RURFLSC.exe
  2⤵
  PID:7852
- C:\Windows\System\AMkXgRB.exe
  C:\Windows\System\AMkXgRB.exe
  2⤵
  PID:8036
- C:\Windows\System\eYrCHQc.exe
  C:\Windows\System\eYrCHQc.exe
  2⤵
  PID:8080
- C:\Windows\System\ofCRNRa.exe
  C:\Windows\System\ofCRNRa.exe
  2⤵
  PID:8128
- C:\Windows\System\ZNiEQjX.exe
  C:\Windows\System\ZNiEQjX.exe
  2⤵
  PID:8172
- C:\Windows\System\VssDSqv.exe
  C:\Windows\System\VssDSqv.exe
  2⤵
  PID:6480
- C:\Windows\System\dvVRReM.exe
  C:\Windows\System\dvVRReM.exe
  2⤵
  PID:6500
- C:\Windows\System\mScBuOQ.exe
  C:\Windows\System\mScBuOQ.exe
  2⤵
  PID:7040
- C:\Windows\System\WREIWBz.exe
  C:\Windows\System\WREIWBz.exe
  2⤵
  PID:5164
- C:\Windows\System\rWWOVgg.exe
  C:\Windows\System\rWWOVgg.exe
  2⤵
  PID:6640
- C:\Windows\System\ITrzUmD.exe
  C:\Windows\System\ITrzUmD.exe
  2⤵
  PID:2964
- C:\Windows\System\NEuwDzU.exe
  C:\Windows\System\NEuwDzU.exe
  2⤵
  PID:3524
- C:\Windows\System\hcIGEhe.exe
  C:\Windows\System\hcIGEhe.exe
  2⤵
  PID:1980
- C:\Windows\System\XYNqyjY.exe
  C:\Windows\System\XYNqyjY.exe
  2⤵
  PID:6852
- C:\Windows\System\oreqwBS.exe
  C:\Windows\System\oreqwBS.exe
  2⤵
  PID:7488
- C:\Windows\System\VwWbAee.exe
  C:\Windows\System\VwWbAee.exe
  2⤵
  PID:5420
- C:\Windows\System\UUrfdZi.exe
  C:\Windows\System\UUrfdZi.exe
  2⤵
  PID:7192
- C:\Windows\System\zVXRnyP.exe
  C:\Windows\System\zVXRnyP.exe
  2⤵
  PID:8220
- C:\Windows\System\TuWHFte.exe
  C:\Windows\System\TuWHFte.exe
  2⤵
  PID:8252
- C:\Windows\System\ySvRKQA.exe
  C:\Windows\System\ySvRKQA.exe
  2⤵
  PID:8292
- C:\Windows\System\sBcpJrZ.exe
  C:\Windows\System\sBcpJrZ.exe
  2⤵
  PID:8324
- C:\Windows\System\tePbrcZ.exe
  C:\Windows\System\tePbrcZ.exe
  2⤵
  PID:8348
- C:\Windows\System\rqeojrG.exe
  C:\Windows\System\rqeojrG.exe
  2⤵
  PID:8388
- C:\Windows\System\lWwAlqB.exe
  C:\Windows\System\lWwAlqB.exe
  2⤵
  PID:8412
- C:\Windows\System\LQROLFd.exe
  C:\Windows\System\LQROLFd.exe
  2⤵
  PID:8464
- C:\Windows\System\qBQVdrK.exe
  C:\Windows\System\qBQVdrK.exe
  2⤵
  PID:8496
- C:\Windows\System\OwCUrUg.exe
  C:\Windows\System\OwCUrUg.exe
  2⤵
  PID:8544
- C:\Windows\System\pqkDmRE.exe
  C:\Windows\System\pqkDmRE.exe
  2⤵
  PID:8600
- C:\Windows\System\aIAYygd.exe
  C:\Windows\System\aIAYygd.exe
  2⤵
  PID:8652
- C:\Windows\System\xwzHcqx.exe
  C:\Windows\System\xwzHcqx.exe
  2⤵
  PID:8696
- C:\Windows\System\cxauVCk.exe
  C:\Windows\System\cxauVCk.exe
  2⤵
  PID:8740
- C:\Windows\System\FEQLmDC.exe
  C:\Windows\System\FEQLmDC.exe
  2⤵
  PID:9228
- C:\Windows\System\rjHLEIK.exe
  C:\Windows\System\rjHLEIK.exe
  2⤵
  PID:9248
- C:\Windows\System\rZKlOuu.exe
  C:\Windows\System\rZKlOuu.exe
  2⤵
  PID:9272
- C:\Windows\System\FsdmgPI.exe
  C:\Windows\System\FsdmgPI.exe
  2⤵
  PID:9296
- C:\Windows\System\kyPzlmd.exe
  C:\Windows\System\kyPzlmd.exe
  2⤵
  PID:9324
- C:\Windows\System\iWMvVph.exe
  C:\Windows\System\iWMvVph.exe
  2⤵
  PID:9344
- C:\Windows\System\CHdyKDs.exe
  C:\Windows\System\CHdyKDs.exe
  2⤵
  PID:9360
- C:\Windows\System\pnGZADY.exe
  C:\Windows\System\pnGZADY.exe
  2⤵
  PID:9564
- C:\Windows\System\aEFDbEX.exe
  C:\Windows\System\aEFDbEX.exe
  2⤵
  PID:9588
- C:\Windows\System\kvqEbGG.exe
  C:\Windows\System\kvqEbGG.exe
  2⤵
  PID:9608
- C:\Windows\System\mzfwxlT.exe
  C:\Windows\System\mzfwxlT.exe
  2⤵
  PID:9628
- C:\Windows\System\MIweaZq.exe
  C:\Windows\System\MIweaZq.exe
  2⤵
  PID:9648
- C:\Windows\System\GByEttj.exe
  C:\Windows\System\GByEttj.exe
  2⤵
  PID:9664
- C:\Windows\System\lxOQZIr.exe
  C:\Windows\System\lxOQZIr.exe
  2⤵
  PID:9680
- C:\Windows\System\tfCYDzG.exe
  C:\Windows\System\tfCYDzG.exe
  2⤵
  PID:9704
- C:\Windows\System\AFzhWyh.exe
  C:\Windows\System\AFzhWyh.exe
  2⤵
  PID:9720
- C:\Windows\System\ivzOtCZ.exe
  C:\Windows\System\ivzOtCZ.exe
  2⤵
  PID:9744
- C:\Windows\System\olWVkAe.exe
  C:\Windows\System\olWVkAe.exe
  2⤵
  PID:9768
- C:\Windows\System\WdrFBtL.exe
  C:\Windows\System\WdrFBtL.exe
  2⤵
  PID:9792
- C:\Windows\System\WQfNdJf.exe
  C:\Windows\System\WQfNdJf.exe
  2⤵
  PID:9808
- C:\Windows\System\ePTzXfh.exe
  C:\Windows\System\ePTzXfh.exe
  2⤵
  PID:9832
- C:\Windows\System\pBIHmcT.exe
  C:\Windows\System\pBIHmcT.exe
  2⤵
  PID:9860
- C:\Windows\System\POtREhQ.exe
  C:\Windows\System\POtREhQ.exe
  2⤵
  PID:9888
- C:\Windows\System\yMETBma.exe
  C:\Windows\System\yMETBma.exe
  2⤵
  PID:9908
- C:\Windows\System\LekoUWq.exe
  C:\Windows\System\LekoUWq.exe
  2⤵
  PID:9928
- C:\Windows\System\YIKYUPV.exe
  C:\Windows\System\YIKYUPV.exe
  2⤵
  PID:9948
- C:\Windows\System\ALDrQpd.exe
  C:\Windows\System\ALDrQpd.exe
  2⤵
  PID:9968
- C:\Windows\System\SZvMuSo.exe
  C:\Windows\System\SZvMuSo.exe
  2⤵
  PID:9988
- C:\Windows\System\avUvwnR.exe
  C:\Windows\System\avUvwnR.exe
  2⤵
  PID:10004
- C:\Windows\System\eBAeHYC.exe
  C:\Windows\System\eBAeHYC.exe
  2⤵
  PID:10036
- C:\Windows\System\HpTslQs.exe
  C:\Windows\System\HpTslQs.exe
  2⤵
  PID:10056
- C:\Windows\System\axnvgeV.exe
  C:\Windows\System\axnvgeV.exe
  2⤵
  PID:10076
- C:\Windows\System\BdbcqlV.exe
  C:\Windows\System\BdbcqlV.exe
  2⤵
  PID:10092
- C:\Windows\System\jVCKgnh.exe
  C:\Windows\System\jVCKgnh.exe
  2⤵
  PID:10108
- C:\Windows\System\KBAUJza.exe
  C:\Windows\System\KBAUJza.exe
  2⤵
  PID:10124
- C:\Windows\System\UYzoGkr.exe
  C:\Windows\System\UYzoGkr.exe
  2⤵
  PID:10148
- C:\Windows\System\jNTgKWa.exe
  C:\Windows\System\jNTgKWa.exe
  2⤵
  PID:10172
- C:\Windows\System\PJBXJMO.exe
  C:\Windows\System\PJBXJMO.exe
  2⤵
  PID:10188
- C:\Windows\System\FWMHhGT.exe
  C:\Windows\System\FWMHhGT.exe
  2⤵
  PID:10212
- C:\Windows\System\gIparof.exe
  C:\Windows\System\gIparof.exe
  2⤵
  PID:10236
- C:\Windows\System\tGvMQNl.exe
  C:\Windows\System\tGvMQNl.exe
  2⤵
  PID:8876
- C:\Windows\System\YQVXSwp.exe
  C:\Windows\System\YQVXSwp.exe
  2⤵
  PID:9152
- C:\Windows\System\VysztYq.exe
  C:\Windows\System\VysztYq.exe
  2⤵
  PID:9200
- C:\Windows\System\JuhjKkZ.exe
  C:\Windows\System\JuhjKkZ.exe
  2⤵
  PID:7948
- C:\Windows\System\ecMsmdN.exe
  C:\Windows\System\ecMsmdN.exe
  2⤵
  PID:10252
- C:\Windows\System\TuDdRvf.exe
  C:\Windows\System\TuDdRvf.exe
  2⤵
  PID:10276
- C:\Windows\System\PvmtlKE.exe
  C:\Windows\System\PvmtlKE.exe
  2⤵
  PID:10300
- C:\Windows\System\tNsiAYF.exe
  C:\Windows\System\tNsiAYF.exe
  2⤵
  PID:10324
- C:\Windows\System\FxJMLRB.exe
  C:\Windows\System\FxJMLRB.exe
  2⤵
  PID:10340
- C:\Windows\System\UDldgrS.exe
  C:\Windows\System\UDldgrS.exe
  2⤵
  PID:10364
- C:\Windows\System\mBnyhRZ.exe
  C:\Windows\System\mBnyhRZ.exe
  2⤵
  PID:10388
- C:\Windows\System\vAqwpxO.exe
  C:\Windows\System\vAqwpxO.exe
  2⤵
  PID:10412
- C:\Windows\System\xntlnXX.exe
  C:\Windows\System\xntlnXX.exe
  2⤵
  PID:10428
- C:\Windows\System\IxoDJjy.exe
  C:\Windows\System\IxoDJjy.exe
  2⤵
  PID:10452
- C:\Windows\System\BsTuWuA.exe
  C:\Windows\System\BsTuWuA.exe
  2⤵
  PID:10476
- C:\Windows\System\edeDBzC.exe
  C:\Windows\System\edeDBzC.exe
  2⤵
  PID:10500
- C:\Windows\System\pBslhXP.exe
  C:\Windows\System\pBslhXP.exe
  2⤵
  PID:10524
- C:\Windows\System\BQDQJDY.exe
  C:\Windows\System\BQDQJDY.exe
  2⤵
  PID:10544
- C:\Windows\System\dxjgrCe.exe
  C:\Windows\System\dxjgrCe.exe
  2⤵
  PID:10568
- C:\Windows\System\ZOJxgCz.exe
  C:\Windows\System\ZOJxgCz.exe
  2⤵
  PID:10592
- C:\Windows\System\LQQfHwD.exe
  C:\Windows\System\LQQfHwD.exe
  2⤵
  PID:10612
- C:\Windows\System\JeAFpFk.exe
  C:\Windows\System\JeAFpFk.exe
  2⤵
  PID:10632
- C:\Windows\System\CcladSx.exe
  C:\Windows\System\CcladSx.exe
  2⤵
  PID:10656
- C:\Windows\System\ubFAqsN.exe
  C:\Windows\System\ubFAqsN.exe
  2⤵
  PID:10688
- C:\Windows\System\VksCVMa.exe
  C:\Windows\System\VksCVMa.exe
  2⤵
  PID:10716
- C:\Windows\System\jCwbEQu.exe
  C:\Windows\System\jCwbEQu.exe
  2⤵
  PID:10732
- C:\Windows\System\dqkOjES.exe
  C:\Windows\System\dqkOjES.exe
  2⤵
  PID:10924
- C:\Windows\System\zZUxUsm.exe
  C:\Windows\System\zZUxUsm.exe
  2⤵
  PID:10940
- C:\Windows\System\XgRPDlQ.exe
  C:\Windows\System\XgRPDlQ.exe
  2⤵
  PID:10956
- C:\Windows\System\zxMGqGf.exe
  C:\Windows\System\zxMGqGf.exe
  2⤵
  PID:10972
- C:\Windows\System\nExdECl.exe
  C:\Windows\System\nExdECl.exe
  2⤵
  PID:10988
- C:\Windows\System\KWsrKhm.exe
  C:\Windows\System\KWsrKhm.exe
  2⤵
  PID:11012
- C:\Windows\System\OBrELOJ.exe
  C:\Windows\System\OBrELOJ.exe
  2⤵
  PID:11048
- C:\Windows\System\NWKokeX.exe
  C:\Windows\System\NWKokeX.exe
  2⤵
  PID:11068
- C:\Windows\System\QEhDHXi.exe
  C:\Windows\System\QEhDHXi.exe
  2⤵
  PID:11088
- C:\Windows\System\zBWQbWp.exe
  C:\Windows\System\zBWQbWp.exe
  2⤵
  PID:11112
- C:\Windows\System\UbNnWbp.exe
  C:\Windows\System\UbNnWbp.exe
  2⤵
  PID:11132
- C:\Windows\System\vQRlwyB.exe
  C:\Windows\System\vQRlwyB.exe
  2⤵
  PID:11156
- C:\Windows\System\cDyRfwd.exe
  C:\Windows\System\cDyRfwd.exe
  2⤵
  PID:11192
- C:\Windows\System\CJNUHkZ.exe
  C:\Windows\System\CJNUHkZ.exe
  2⤵
  PID:11208
- C:\Windows\System\tLYnITD.exe
  C:\Windows\System\tLYnITD.exe
  2⤵
  PID:8428
- C:\Windows\System\GWYCONE.exe
  C:\Windows\System\GWYCONE.exe
  2⤵
  PID:8492
- C:\Windows\System\MwEyKks.exe
  C:\Windows\System\MwEyKks.exe
  2⤵
  PID:8564
- C:\Windows\System\ZuyMONG.exe
  C:\Windows\System\ZuyMONG.exe
  2⤵
  PID:8636
- C:\Windows\System\ZZMoZbX.exe
  C:\Windows\System\ZZMoZbX.exe
  2⤵
  PID:8712
- C:\Windows\System\URqlVlO.exe
  C:\Windows\System\URqlVlO.exe
  2⤵
  PID:9256
- C:\Windows\System\gXIWeTN.exe
  C:\Windows\System\gXIWeTN.exe
  2⤵
  PID:10332
- C:\Windows\System\wCSZMGn.exe
  C:\Windows\System\wCSZMGn.exe
  2⤵
  PID:10372
- C:\Windows\System\cnLTiGc.exe
  C:\Windows\System\cnLTiGc.exe
  2⤵
  PID:9572
- C:\Windows\System\bQuLubu.exe
  C:\Windows\System\bQuLubu.exe
  2⤵
  PID:10628
- C:\Windows\System\coRYcuZ.exe
  C:\Windows\System\coRYcuZ.exe
  2⤵
  PID:10728
- C:\Windows\System\zJJPdcZ.exe
  C:\Windows\System\zJJPdcZ.exe
  2⤵
  PID:9336
- C:\Windows\System\uHMLfpR.exe
  C:\Windows\System\uHMLfpR.exe
  2⤵
  PID:9980
- C:\Windows\System\WNjRowB.exe
  C:\Windows\System\WNjRowB.exe
  2⤵
  PID:9440
- C:\Windows\System\eyXJbpc.exe
  C:\Windows\System\eyXJbpc.exe
  2⤵
  PID:2824
- C:\Windows\System\slxkMyq.exe
  C:\Windows\System\slxkMyq.exe
  2⤵
  PID:9552
- C:\Windows\System\gtnTxHj.exe
  C:\Windows\System\gtnTxHj.exe
  2⤵
  PID:9596
- C:\Windows\System\tSbiazy.exe
  C:\Windows\System\tSbiazy.exe
  2⤵
  PID:10068
- C:\Windows\System\KpGohah.exe
  C:\Windows\System\KpGohah.exe
  2⤵
  PID:10436
- C:\Windows\System\yOIJyKF.exe
  C:\Windows\System\yOIJyKF.exe
  2⤵
  PID:9624
- C:\Windows\System\zYMlpCt.exe
  C:\Windows\System\zYMlpCt.exe
  2⤵
  PID:11292
- C:\Windows\System\CQqGmim.exe
  C:\Windows\System\CQqGmim.exe
  2⤵
  PID:11336
- C:\Windows\System\oZlUeQq.exe
  C:\Windows\System\oZlUeQq.exe
  2⤵
  PID:11372
- C:\Windows\System\ojhDQzn.exe
  C:\Windows\System\ojhDQzn.exe
  2⤵
  PID:11404
- C:\Windows\System\KpVvxlK.exe
  C:\Windows\System\KpVvxlK.exe
  2⤵
  PID:11472
- C:\Windows\System\xHDxgGS.exe
  C:\Windows\System\xHDxgGS.exe
  2⤵
  PID:11488
- C:\Windows\System\YJusVhO.exe
  C:\Windows\System\YJusVhO.exe
  2⤵
  PID:11504
- C:\Windows\System\LeHZmsu.exe
  C:\Windows\System\LeHZmsu.exe
  2⤵
  PID:11520
- C:\Windows\System\BBQjVKQ.exe
  C:\Windows\System\BBQjVKQ.exe
  2⤵
  PID:11536
- C:\Windows\System\avIgbDV.exe
  C:\Windows\System\avIgbDV.exe
  2⤵
  PID:11556
- C:\Windows\System\JfFTpNa.exe
  C:\Windows\System\JfFTpNa.exe
  2⤵
  PID:11588
- C:\Windows\System\vHVDExl.exe
  C:\Windows\System\vHVDExl.exe
  2⤵
  PID:11604
- C:\Windows\System\alIRGKK.exe
  C:\Windows\System\alIRGKK.exe
  2⤵
  PID:11620
- C:\Windows\System\MXsOBsV.exe
  C:\Windows\System\MXsOBsV.exe
  2⤵
  PID:11640
- C:\Windows\System\vXBkitL.exe
  C:\Windows\System\vXBkitL.exe
  2⤵
  PID:11660
- C:\Windows\System\GLjoGfo.exe
  C:\Windows\System\GLjoGfo.exe
  2⤵
  PID:11680
- C:\Windows\System\zRFQFoE.exe
  C:\Windows\System\zRFQFoE.exe
  2⤵
  PID:11696
- C:\Windows\System\ZVPtwYA.exe
  C:\Windows\System\ZVPtwYA.exe
  2⤵
  PID:11716
- C:\Windows\System\ocHOPIf.exe
  C:\Windows\System\ocHOPIf.exe
  2⤵
  PID:11736
- C:\Windows\System\GHtNMri.exe
  C:\Windows\System\GHtNMri.exe
  2⤵
  PID:11756
- C:\Windows\System\vgLOwey.exe
  C:\Windows\System\vgLOwey.exe
  2⤵
  PID:11776
- C:\Windows\System\stRlkpd.exe
  C:\Windows\System\stRlkpd.exe
  2⤵
  PID:11796
- C:\Windows\System\CMtXERK.exe
  C:\Windows\System\CMtXERK.exe
  2⤵
  PID:11816
- C:\Windows\System\QcgveLy.exe
  C:\Windows\System\QcgveLy.exe
  2⤵
  PID:11836
- C:\Windows\System\VkBqVmE.exe
  C:\Windows\System\VkBqVmE.exe
  2⤵
  PID:11856
- C:\Windows\System\qDiecvj.exe
  C:\Windows\System\qDiecvj.exe
  2⤵
  PID:11876
- C:\Windows\System\VqLwXEI.exe
  C:\Windows\System\VqLwXEI.exe
  2⤵
  PID:11896
- C:\Windows\System\VkTvovi.exe
  C:\Windows\System\VkTvovi.exe
  2⤵
  PID:11912
- C:\Windows\System\TTGERGv.exe
  C:\Windows\System\TTGERGv.exe
  2⤵
  PID:11932
- C:\Windows\System\bqxSJUJ.exe
  C:\Windows\System\bqxSJUJ.exe
  2⤵
  PID:11952
- C:\Windows\System\kRUPwcT.exe
  C:\Windows\System\kRUPwcT.exe
  2⤵
  PID:11972
- C:\Windows\System\tHjHNIn.exe
  C:\Windows\System\tHjHNIn.exe
  2⤵
  PID:11992
- C:\Windows\System\msVNnSe.exe
  C:\Windows\System\msVNnSe.exe
  2⤵
  PID:12012
- C:\Windows\System\wIDtqJd.exe
  C:\Windows\System\wIDtqJd.exe
  2⤵
  PID:12032
- C:\Windows\System\IqeSLcl.exe
  C:\Windows\System\IqeSLcl.exe
  2⤵
  PID:12052
- C:\Windows\System\hdkwjxM.exe
  C:\Windows\System\hdkwjxM.exe
  2⤵
  PID:12080
- C:\Windows\System\PtkRSJe.exe
  C:\Windows\System\PtkRSJe.exe
  2⤵
  PID:12112
- C:\Windows\System\yjeOraH.exe
  C:\Windows\System\yjeOraH.exe
  2⤵
  PID:12140
- C:\Windows\System\UxmyEDJ.exe
  C:\Windows\System\UxmyEDJ.exe
  2⤵
  PID:12156
- C:\Windows\System\XYwJiiv.exe
  C:\Windows\System\XYwJiiv.exe
  2⤵
  PID:12188
- C:\Windows\System\CfhcsQp.exe
  C:\Windows\System\CfhcsQp.exe
  2⤵
  PID:12208
- C:\Windows\System\vzOSLoY.exe
  C:\Windows\System\vzOSLoY.exe
  2⤵
  PID:12232
- C:\Windows\System\fQeIwFj.exe
  C:\Windows\System\fQeIwFj.exe
  2⤵
  PID:12252
- C:\Windows\System\gwljRrp.exe
  C:\Windows\System\gwljRrp.exe
  2⤵
  PID:12280
- C:\Windows\System\pHgRegZ.exe
  C:\Windows\System\pHgRegZ.exe
  2⤵
  PID:9736
- C:\Windows\System\cEXVuqs.exe
  C:\Windows\System\cEXVuqs.exe
  2⤵
  PID:9776
- C:\Windows\System\jSAEglY.exe
  C:\Windows\System\jSAEglY.exe
  2⤵
  PID:9816
- C:\Windows\System\wmGBNRo.exe
  C:\Windows\System\wmGBNRo.exe
  2⤵
  PID:9900
- C:\Windows\System\akiUcuT.exe
  C:\Windows\System\akiUcuT.exe
  2⤵
  PID:9964
- C:\Windows\System\UQaPxyb.exe
  C:\Windows\System\UQaPxyb.exe
  2⤵
  PID:9052
- C:\Windows\System\FVRmKEF.exe
  C:\Windows\System\FVRmKEF.exe
  2⤵
  PID:9116
- C:\Windows\System\LEKzGDy.exe
  C:\Windows\System\LEKzGDy.exe
  2⤵
  PID:10248
- C:\Windows\System\eLFmDLr.exe
  C:\Windows\System\eLFmDLr.exe
  2⤵
  PID:10132
- C:\Windows\System\RubRyWn.exe
  C:\Windows\System\RubRyWn.exe
  2⤵
  PID:10508
- C:\Windows\System\WMOhwQS.exe
  C:\Windows\System\WMOhwQS.exe
  2⤵
  PID:10552
- C:\Windows\System\siZRusN.exe
  C:\Windows\System\siZRusN.exe
  2⤵
  PID:10316
- C:\Windows\System\JpxpkHL.exe
  C:\Windows\System\JpxpkHL.exe
  2⤵
  PID:10700
- C:\Windows\System\TgNPNMt.exe
  C:\Windows\System\TgNPNMt.exe
  2⤵
  PID:10748
- C:\Windows\System\KgszVpi.exe
  C:\Windows\System\KgszVpi.exe
  2⤵
  PID:6760
- C:\Windows\System\hQadLTL.exe
  C:\Windows\System\hQadLTL.exe
  2⤵
  PID:11348
- C:\Windows\System\JbjltxO.exe
  C:\Windows\System\JbjltxO.exe
  2⤵
  PID:6840
- C:\Windows\System\jRxgruS.exe
  C:\Windows\System\jRxgruS.exe
  2⤵
  PID:10904
- C:\Windows\System\IckJmeA.exe
  C:\Windows\System\IckJmeA.exe
  2⤵
  PID:11040
- C:\Windows\System\sEiDwEd.exe
  C:\Windows\System\sEiDwEd.exe
  2⤵
  PID:11084
- C:\Windows\System\BAhUBZa.exe
  C:\Windows\System\BAhUBZa.exe
  2⤵
  PID:11124
- C:\Windows\System\mNCpWlb.exe
  C:\Windows\System\mNCpWlb.exe
  2⤵
  PID:11164
- C:\Windows\System\HhyJcqX.exe
  C:\Windows\System\HhyJcqX.exe
  2⤵
  PID:11216
- C:\Windows\System\Nqrxhbw.exe
  C:\Windows\System\Nqrxhbw.exe
  2⤵
  PID:7428
- C:\Windows\System\onFyeLA.exe
  C:\Windows\System\onFyeLA.exe
  2⤵
  PID:11632
- C:\Windows\System\KAyQcud.exe
  C:\Windows\System\KAyQcud.exe
  2⤵
  PID:11656
- C:\Windows\System\hzBlcbB.exe
  C:\Windows\System\hzBlcbB.exe
  2⤵
  PID:11688
- C:\Windows\System\Xzphjbp.exe
  C:\Windows\System\Xzphjbp.exe
  2⤵
  PID:11712
- C:\Windows\System\dHQzHXy.exe
  C:\Windows\System\dHQzHXy.exe
  2⤵
  PID:11784
- C:\Windows\System\TclTLww.exe
  C:\Windows\System\TclTLww.exe
  2⤵
  PID:11812
- C:\Windows\System\EQngbnX.exe
  C:\Windows\System\EQngbnX.exe
  2⤵
  PID:12308
- C:\Windows\System\yTpnfux.exe
  C:\Windows\System\yTpnfux.exe
  2⤵
  PID:12328
- C:\Windows\System\pwdHgsL.exe
  C:\Windows\System\pwdHgsL.exe
  2⤵
  PID:12348
- C:\Windows\System\oDDgEjb.exe
  C:\Windows\System\oDDgEjb.exe
  2⤵
  PID:12372
- C:\Windows\System\xRGyDmn.exe
  C:\Windows\System\xRGyDmn.exe
  2⤵
  PID:12388
- C:\Windows\System\cLBSCtF.exe
  C:\Windows\System\cLBSCtF.exe
  2⤵
  PID:12408
- C:\Windows\System\cBAZdlA.exe
  C:\Windows\System\cBAZdlA.exe
  2⤵
  PID:12424
- C:\Windows\System\ozNXrby.exe
  C:\Windows\System\ozNXrby.exe
  2⤵
  PID:12440
- C:\Windows\System\OwLNKEo.exe
  C:\Windows\System\OwLNKEo.exe
  2⤵
  PID:12460
- C:\Windows\System\BZLcqFX.exe
  C:\Windows\System\BZLcqFX.exe
  2⤵
  PID:12480
- C:\Windows\System\WqUzbmF.exe
  C:\Windows\System\WqUzbmF.exe
  2⤵
  PID:12500
- C:\Windows\System\ZbkkZZx.exe
  C:\Windows\System\ZbkkZZx.exe
  2⤵
  PID:12520
- C:\Windows\System\kyteOmX.exe
  C:\Windows\System\kyteOmX.exe
  2⤵
  PID:12540
- C:\Windows\System\fHUsGze.exe
  C:\Windows\System\fHUsGze.exe
  2⤵
  PID:12560
- C:\Windows\System\CguPdLn.exe
  C:\Windows\System\CguPdLn.exe
  2⤵
  PID:12588
- C:\Windows\System\tzreLvH.exe
  C:\Windows\System\tzreLvH.exe
  2⤵
  PID:12612
- C:\Windows\System\dAOvOOO.exe
  C:\Windows\System\dAOvOOO.exe
  2⤵
  PID:12636
- C:\Windows\System\alHBVbj.exe
  C:\Windows\System\alHBVbj.exe
  2⤵
  PID:12660
- C:\Windows\System\ypSWghg.exe
  C:\Windows\System\ypSWghg.exe
  2⤵
  PID:12680
- C:\Windows\System\iDrrgfu.exe
  C:\Windows\System\iDrrgfu.exe
  2⤵
  PID:12704
- C:\Windows\System\wsWvkok.exe
  C:\Windows\System\wsWvkok.exe
  2⤵
  PID:12720
- C:\Windows\System\niLmQnK.exe
  C:\Windows\System\niLmQnK.exe
  2⤵
  PID:12744
- C:\Windows\System\lJJisji.exe
  C:\Windows\System\lJJisji.exe
  2⤵
  PID:12768
- C:\Windows\System\wlgQyVk.exe
  C:\Windows\System\wlgQyVk.exe
  2⤵
  PID:12788
- C:\Windows\System\sFMpQqo.exe
  C:\Windows\System\sFMpQqo.exe
  2⤵
  PID:12804
- C:\Windows\System\NzUigOX.exe
  C:\Windows\System\NzUigOX.exe
  2⤵
  PID:12832
- C:\Windows\System\KpQOhlN.exe
  C:\Windows\System\KpQOhlN.exe
  2⤵
  PID:12848
- C:\Windows\System\PQPSDQB.exe
  C:\Windows\System\PQPSDQB.exe
  2⤵
  PID:12880
- C:\Windows\System\CJNVSsm.exe
  C:\Windows\System\CJNVSsm.exe
  2⤵
  PID:12904
- C:\Windows\System\RzzYCpk.exe
  C:\Windows\System\RzzYCpk.exe
  2⤵
  PID:12924
- C:\Windows\System\bvFspTF.exe
  C:\Windows\System\bvFspTF.exe
  2⤵
  PID:12960
- C:\Windows\System\plBriMP.exe
  C:\Windows\System\plBriMP.exe
  2⤵
  PID:12980
- C:\Windows\System\NxERXIn.exe
  C:\Windows\System\NxERXIn.exe
  2⤵
  PID:13004
- C:\Windows\System\leYVavy.exe
  C:\Windows\System\leYVavy.exe
  2⤵
  PID:13020
- C:\Windows\System\TyGeECh.exe
  C:\Windows\System\TyGeECh.exe
  2⤵
  PID:13040
- C:\Windows\System\NcqybRX.exe
  C:\Windows\System\NcqybRX.exe
  2⤵
  PID:13056
- C:\Windows\System\wUiCxuG.exe
  C:\Windows\System\wUiCxuG.exe
  2⤵
  PID:13072
- C:\Windows\System\emeghNg.exe
  C:\Windows\System\emeghNg.exe
  2⤵
  PID:13088
- C:\Windows\System\gIoSQxX.exe
  C:\Windows\System\gIoSQxX.exe
  2⤵
  PID:13104
- C:\Windows\System\mSZtIZf.exe
  C:\Windows\System\mSZtIZf.exe
  2⤵
  PID:13120
- C:\Windows\System\ZNevHoL.exe
  C:\Windows\System\ZNevHoL.exe
  2⤵
  PID:13136
- C:\Windows\System\AddqEVV.exe
  C:\Windows\System\AddqEVV.exe
  2⤵
  PID:13152
- C:\Windows\System\XXilIhf.exe
  C:\Windows\System\XXilIhf.exe
  2⤵
  PID:13168
- C:\Windows\System\SpkZccq.exe
  C:\Windows\System\SpkZccq.exe
  2⤵
  PID:13184
- C:\Windows\System\zZFoBAR.exe
  C:\Windows\System\zZFoBAR.exe
  2⤵
  PID:4200
- C:\Windows\System\BuxZxHG.exe
  C:\Windows\System\BuxZxHG.exe
  2⤵
  PID:10560
- C:\Windows\System\UixywVu.exe
  C:\Windows\System\UixywVu.exe
  2⤵
  PID:10908
- C:\Windows\System\cWymOBO.exe
  C:\Windows\System\cWymOBO.exe
  2⤵
  PID:2968
- C:\Windows\System\jGRwOxT.exe
  C:\Windows\System\jGRwOxT.exe
  2⤵
  PID:11060
- C:\Windows\System\LyyYOKV.exe
  C:\Windows\System\LyyYOKV.exe
  2⤵
  PID:12296
- C:\Windows\System\VLpUrWX.exe
  C:\Windows\System\VLpUrWX.exe
  2⤵
  PID:12436
- C:\Windows\System\DsdVYJO.exe
  C:\Windows\System\DsdVYJO.exe
  2⤵
  PID:12548
- C:\Windows\System\NVwNYyG.exe
  C:\Windows\System\NVwNYyG.exe
  2⤵
  PID:12656
- C:\Windows\System\GuFTiil.exe
  C:\Windows\System\GuFTiil.exe
  2⤵
  PID:12740
- C:\Windows\System\Naiycja.exe
  C:\Windows\System\Naiycja.exe
  2⤵
  PID:12812
- C:\Windows\System\inhaKgo.exe
  C:\Windows\System\inhaKgo.exe
  2⤵
  PID:12864
- C:\Windows\System\ItuKoYQ.exe
  C:\Windows\System\ItuKoYQ.exe
  2⤵
  PID:12912
- C:\Windows\System\IkTVHfe.exe
  C:\Windows\System\IkTVHfe.exe
  2⤵
  PID:12956
- C:\Windows\System\stQiBWc.exe
  C:\Windows\System\stQiBWc.exe
  2⤵
  PID:13000
- C:\Windows\System\ePOfyfV.exe
  C:\Windows\System\ePOfyfV.exe
  2⤵
  PID:13048
- C:\Windows\System\mKixIAC.exe
  C:\Windows\System\mKixIAC.exe
  2⤵
  PID:13084
- C:\Windows\System\xuEcCdR.exe
  C:\Windows\System\xuEcCdR.exe
  2⤵
  PID:13144
- C:\Windows\System\zzWwnYH.exe
  C:\Windows\System\zzWwnYH.exe
  2⤵
  PID:13180
- C:\Windows\System\gVofxYo.exe
  C:\Windows\System\gVofxYo.exe
  2⤵
  PID:13212
- C:\Windows\System\EKHOJbG.exe
  C:\Windows\System\EKHOJbG.exe
  2⤵
  PID:13240
- C:\Windows\System\KYsPEmq.exe
  C:\Windows\System\KYsPEmq.exe
  2⤵
  PID:13276
- C:\Windows\System\EkChkaR.exe
  C:\Windows\System\EkChkaR.exe
  2⤵
  PID:13304
- C:\Windows\System\fVqftmp.exe
  C:\Windows\System\fVqftmp.exe
  2⤵
  PID:11928
- C:\Windows\System\lekpbTf.exe
  C:\Windows\System\lekpbTf.exe
  2⤵
  PID:12004
- C:\Windows\System\naxhFuL.exe
  C:\Windows\System\naxhFuL.exe
  2⤵
  PID:9984
- C:\Windows\System\bIAKSRF.exe
  C:\Windows\System\bIAKSRF.exe
  2⤵
  PID:10204
- C:\Windows\System\fYiFFhh.exe
  C:\Windows\System\fYiFFhh.exe
  2⤵
  PID:9800
- C:\Windows\System\IqwnWHy.exe
  C:\Windows\System\IqwnWHy.exe
  2⤵
  PID:932
- C:\Windows\System\vohCeGb.exe
  C:\Windows\System\vohCeGb.exe
  2⤵
  PID:8540
- C:\Windows\System\KOdoGnC.exe
  C:\Windows\System\KOdoGnC.exe
  2⤵
  PID:12568
- C:\Windows\System\tcglXMw.exe
  C:\Windows\System\tcglXMw.exe
  2⤵
  PID:3128
- C:\Windows\System\eNCZViA.exe
  C:\Windows\System\eNCZViA.exe
  2⤵
  PID:8688
- C:\Windows\System\adqiUHX.exe
  C:\Windows\System\adqiUHX.exe
  2⤵
  PID:11152
- C:\Windows\System\BcnEart.exe
  C:\Windows\System\BcnEart.exe
  2⤵
  PID:11652
- C:\Windows\System\IeEkYJD.exe
  C:\Windows\System\IeEkYJD.exe
  2⤵
  PID:12320
- C:\Windows\System\oYKyMNy.exe
  C:\Windows\System\oYKyMNy.exe
  2⤵
  PID:11864
- C:\Windows\System\PsktFFc.exe
  C:\Windows\System\PsktFFc.exe
  2⤵
  PID:12044
- C:\Windows\System\fNPOowd.exe
  C:\Windows\System\fNPOowd.exe
  2⤵
  PID:10360
- C:\Windows\System\wWNkPEu.exe
  C:\Windows\System\wWNkPEu.exe
  2⤵
  PID:10604
- C:\Windows\System\ZwCrnOC.exe
  C:\Windows\System\ZwCrnOC.exe
  2⤵
  PID:12492
- C:\Windows\System\xAwkQnm.exe
  C:\Windows\System\xAwkQnm.exe
  2⤵
  PID:12556
- C:\Windows\System\CawPXhS.exe
  C:\Windows\System\CawPXhS.exe
  2⤵
  PID:4256
- C:\Windows\System\seKMLbp.exe
  C:\Windows\System\seKMLbp.exe
  2⤵
  PID:9828
- C:\Windows\System\JzIEpgr.exe
  C:\Windows\System\JzIEpgr.exe
  2⤵
  PID:9712
- C:\Windows\System\bIbvoFx.exe
  C:\Windows\System\bIbvoFx.exe
  2⤵
  PID:4192
- C:\Windows\System\XknpwTr.exe
  C:\Windows\System\XknpwTr.exe
  2⤵
  PID:3260
- C:\Windows\System\oDXToWs.exe
  C:\Windows\System\oDXToWs.exe
  2⤵
  PID:5824
- C:\Windows\System\caxIsHD.exe
  C:\Windows\System\caxIsHD.exe
  2⤵
  PID:3648
- C:\Windows\System\xmmFqls.exe
  C:\Windows\System\xmmFqls.exe
  2⤵
  PID:2420
- C:\Windows\System\RQzfIvM.exe
  C:\Windows\System\RQzfIvM.exe
  2⤵
  PID:10468
- C:\Windows\System\cikKVAm.exe
  C:\Windows\System\cikKVAm.exe
  2⤵
  PID:1784
- C:\Windows\System\dsZHrPF.exe
  C:\Windows\System\dsZHrPF.exe
  2⤵
  PID:2344
- C:\Windows\System\sUucvZO.exe
  C:\Windows\System\sUucvZO.exe
  2⤵
  PID:7060
- C:\Windows\System\AplLVrk.exe
  C:\Windows\System\AplLVrk.exe
  2⤵
  PID:13164
- C:\Windows\System\bHHjSsb.exe
  C:\Windows\System\bHHjSsb.exe
  2⤵
  PID:13288
- C:\Windows\System\tvMgtvP.exe
  C:\Windows\System\tvMgtvP.exe
  2⤵
  PID:10684
- C:\Windows\System\uGHnjpg.exe
  C:\Windows\System\uGHnjpg.exe
  2⤵
  PID:1896
- C:\Windows\System\gnmhOQW.exe
  C:\Windows\System\gnmhOQW.exe
  2⤵
  PID:1900
- C:\Windows\System\NhAAIsC.exe
  C:\Windows\System\NhAAIsC.exe
  2⤵
  PID:11204
- C:\Windows\System\fnxsgIT.exe
  C:\Windows\System\fnxsgIT.exe
  2⤵
  PID:13028
- C:\Windows\System\Baqzerq.exe
  C:\Windows\System\Baqzerq.exe
  2⤵
  PID:5612
- C:\Windows\System\RJWzmSF.exe
  C:\Windows\System\RJWzmSF.exe
  2⤵
  PID:10676
- C:\Windows\System\lNCQDrj.exe
  C:\Windows\System\lNCQDrj.exe
  2⤵
  PID:11844
- C:\Windows\System\RErVvqy.exe
  C:\Windows\System\RErVvqy.exe
  2⤵
  PID:4080
- C:\Windows\System\zscaXXa.exe
  C:\Windows\System\zscaXXa.exe
  2⤵
  PID:11232
- C:\Windows\System\IPNaPlJ.exe
  C:\Windows\System\IPNaPlJ.exe
  2⤵
  PID:1888
- C:\Windows\System\kUtyoFt.exe
  C:\Windows\System\kUtyoFt.exe
  2⤵
  PID:12732
- C:\Windows\System\LmfZhke.exe
  C:\Windows\System\LmfZhke.exe
  2⤵
  PID:9672
- C:\Windows\System\mzZVyQR.exe
  C:\Windows\System\mzZVyQR.exe
  2⤵
  PID:12008
- C:\Windows\System\LnrAPne.exe
  C:\Windows\System\LnrAPne.exe
  2⤵
  PID:13160
- C:\Windows\System\mNKGLYA.exe
  C:\Windows\System\mNKGLYA.exe
  2⤵
  PID:3252
- C:\Windows\System\hqxxHjp.exe
  C:\Windows\System\hqxxHjp.exe
  2⤵
  PID:3696
- C:\Windows\System\rTqZofE.exe
  C:\Windows\System\rTqZofE.exe
  2⤵
  PID:1404
- C:\Windows\System\PRjwwCt.exe
  C:\Windows\System\PRjwwCt.exe
  2⤵
  PID:13268
- C:\Windows\System\rLHwQfF.exe
  C:\Windows\System\rLHwQfF.exe
  2⤵
  PID:13332
- C:\Windows\System\lAVZIUf.exe
  C:\Windows\System\lAVZIUf.exe
  2⤵
  PID:13444
- C:\Windows\System\xZbJCKY.exe
  C:\Windows\System\xZbJCKY.exe
  2⤵
  PID:13464
- C:\Windows\System\UnzrcHv.exe
  C:\Windows\System\UnzrcHv.exe
  2⤵
  PID:13488
- C:\Windows\System\bGjcyjB.exe
  C:\Windows\System\bGjcyjB.exe
  2⤵
  PID:13504
- C:\Windows\System\THQmrKJ.exe
  C:\Windows\System\THQmrKJ.exe
  2⤵
  PID:13528
- C:\Windows\System\iMHdOQJ.exe
  C:\Windows\System\iMHdOQJ.exe
  2⤵
  PID:13548
- C:\Windows\System\HWHWJNL.exe
  C:\Windows\System\HWHWJNL.exe
  2⤵
  PID:13672
- C:\Windows\System\ucLudCH.exe
  C:\Windows\System\ucLudCH.exe
  2⤵
  PID:13692
- C:\Windows\System\lcEQmFU.exe
  C:\Windows\System\lcEQmFU.exe
  2⤵
  PID:13712
- C:\Windows\System\wTZHMrN.exe
  C:\Windows\System\wTZHMrN.exe
  2⤵
  PID:13736
- C:\Windows\System\FpkmioW.exe
  C:\Windows\System\FpkmioW.exe
  2⤵
  PID:13760
- C:\Windows\System\CqkQUKj.exe
  C:\Windows\System\CqkQUKj.exe
  2⤵
  PID:13796
- C:\Windows\System\mhbVkbI.exe
  C:\Windows\System\mhbVkbI.exe
  2⤵
  PID:13820
- C:\Windows\System\YkmiAUr.exe
  C:\Windows\System\YkmiAUr.exe
  2⤵
  PID:13916
- C:\Windows\System\caxqZDa.exe
  C:\Windows\System\caxqZDa.exe
  2⤵
  PID:13980
- C:\Windows\System\NJnjBlr.exe
  C:\Windows\System\NJnjBlr.exe
  2⤵
  PID:14012
- C:\Windows\System\xKVGabD.exe
  C:\Windows\System\xKVGabD.exe
  2⤵
  PID:14188
- C:\Windows\System\rmOIxJN.exe
  C:\Windows\System\rmOIxJN.exe
  2⤵
  PID:14332
- C:\Windows\System\XacdqKy.exe
  C:\Windows\System\XacdqKy.exe
  2⤵
  PID:11944
- C:\Windows\System\JlBbkLp.exe
  C:\Windows\System\JlBbkLp.exe
  2⤵
  PID:10460
- C:\Windows\System\EiEpyMk.exe
  C:\Windows\System\EiEpyMk.exe
  2⤵
  PID:11920
- C:\Windows\System\FxLESqE.exe
  C:\Windows\System\FxLESqE.exe
  2⤵
  PID:4644
- C:\Windows\System\fEiycbP.exe
  C:\Windows\System\fEiycbP.exe
  2⤵
  PID:13396
- C:\Windows\System\dfoTNES.exe
  C:\Windows\System\dfoTNES.exe
  2⤵
  PID:13428
- C:\Windows\System\qPDKWod.exe
  C:\Windows\System\qPDKWod.exe
  2⤵
  PID:13500
- C:\Windows\System\VYBSbAI.exe
  C:\Windows\System\VYBSbAI.exe
  2⤵
  PID:13560
- C:\Windows\System\vXHFNbT.exe
  C:\Windows\System\vXHFNbT.exe
  2⤵
  PID:13828
- C:\Windows\System\TjckhlC.exe
  C:\Windows\System\TjckhlC.exe
  2⤵
  PID:10808
- C:\Windows\System\fFZyUrE.exe
  C:\Windows\System\fFZyUrE.exe
  2⤵
  PID:10028
- C:\Windows\System\TkibNjW.exe
  C:\Windows\System\TkibNjW.exe
  2⤵
  PID:3428
- C:\Windows\System\fYXPYgw.exe
  C:\Windows\System\fYXPYgw.exe
  2⤵
  PID:13496
- C:\Windows\System\jdGRSvt.exe
  C:\Windows\System\jdGRSvt.exe
  2⤵
  PID:10764
- C:\Windows\System\VszJfSY.exe
  C:\Windows\System\VszJfSY.exe
  2⤵
  PID:13636
- C:\Windows\System\DzSXOQz.exe
  C:\Windows\System\DzSXOQz.exe
  2⤵
  PID:13644
- C:\Windows\System\pnlgfnt.exe
  C:\Windows\System\pnlgfnt.exe
  2⤵
  PID:13704
- C:\Windows\System\CFRPtoJ.exe
  C:\Windows\System\CFRPtoJ.exe
  2⤵
  PID:13612
- C:\Windows\System\sbYIDIf.exe
  C:\Windows\System\sbYIDIf.exe
  2⤵
  PID:13836
- C:\Windows\System\vDRfcXi.exe
  C:\Windows\System\vDRfcXi.exe
  2⤵
  PID:13876
- C:\Windows\System\nseTlpk.exe
  C:\Windows\System\nseTlpk.exe
  2⤵
  PID:13592
- C:\Windows\System\PrLprxm.exe
  C:\Windows\System\PrLprxm.exe
  2⤵
  PID:14004
- C:\Windows\System\nSSacrD.exe
  C:\Windows\System\nSSacrD.exe
  2⤵
  PID:13924
- C:\Windows\System\YwzRogx.exe
  C:\Windows\System\YwzRogx.exe
  2⤵
  PID:14108
- C:\Windows\System\UaAdJoM.exe
  C:\Windows\System\UaAdJoM.exe
  2⤵
  PID:13952
- C:\Windows\System\UuBpDPY.exe
  C:\Windows\System\UuBpDPY.exe
  2⤵
  PID:14272
- C:\Windows\System\LwdFgKX.exe
  C:\Windows\System\LwdFgKX.exe
  2⤵
  PID:12048
- C:\Windows\System\wMAKQPX.exe
  C:\Windows\System\wMAKQPX.exe
  2⤵
  PID:12324
- C:\Windows\System\UZYjsoO.exe
  C:\Windows\System\UZYjsoO.exe
  2⤵
  PID:8108
- C:\Windows\System\GdFjUgk.exe
  C:\Windows\System\GdFjUgk.exe
  2⤵
  PID:13372
- C:\Windows\System\RaPFGoo.exe
  C:\Windows\System\RaPFGoo.exe
  2⤵
  PID:13388
- C:\Windows\System\ueBGtyP.exe
  C:\Windows\System\ueBGtyP.exe
  2⤵
  PID:14068
- C:\Windows\System\KsynoMq.exe
  C:\Windows\System\KsynoMq.exe
  2⤵
  PID:3836
- C:\Windows\System\kzOgyRr.exe
  C:\Windows\System\kzOgyRr.exe
  2⤵
  PID:13596
- C:\Windows\System\gMXrdTm.exe
  C:\Windows\System\gMXrdTm.exe
  2⤵
  PID:4364
- C:\Windows\System\wXRhbYB.exe
  C:\Windows\System\wXRhbYB.exe
  2⤵
  PID:4908
- C:\Windows\System\CoRsqeU.exe
  C:\Windows\System\CoRsqeU.exe
  2⤵
  PID:3020
- C:\Windows\System\QVaGPFd.exe
  C:\Windows\System\QVaGPFd.exe
  2⤵
  PID:1032
- C:\Windows\System\ndAYgwT.exe
  C:\Windows\System\ndAYgwT.exe
  2⤵
  PID:4852
- C:\Windows\System\dQuSPJE.exe
  C:\Windows\System\dQuSPJE.exe
  2⤵
  PID:13480
- C:\Windows\System\lRqVuXf.exe
  C:\Windows\System\lRqVuXf.exe
  2⤵
  PID:936
- C:\Windows\System\mzJAHOI.exe
  C:\Windows\System\mzJAHOI.exe
  2⤵
  PID:12336
- C:\Windows\System\TYFKRbZ.exe
  C:\Windows\System\TYFKRbZ.exe
  2⤵
  PID:13848
- C:\Windows\System\GXIYhVM.exe
  C:\Windows\System\GXIYhVM.exe
  2⤵
  PID:3708
- C:\Windows\System\bCpeirG.exe
  C:\Windows\System\bCpeirG.exe
  2⤵
  PID:1524
- C:\Windows\System\lMdPPQC.exe
  C:\Windows\System\lMdPPQC.exe
  2⤵
  PID:11940
- C:\Windows\System\uafkHYq.exe
  C:\Windows\System\uafkHYq.exe
  2⤵
  PID:13228
- C:\Windows\System\poNytHw.exe
  C:\Windows\System\poNytHw.exe
  2⤵
  PID:3184
- C:\Windows\System\vpfgQAT.exe
  C:\Windows\System\vpfgQAT.exe
  2⤵
  PID:8308
- C:\Windows\System\wbbhAvG.exe
  C:\Windows\System\wbbhAvG.exe
  2⤵
  PID:11168
- C:\Windows\System\HfhObhB.exe
  C:\Windows\System\HfhObhB.exe
  2⤵
  PID:9240
- C:\Windows\System\rQUSKzq.exe
  C:\Windows\System\rQUSKzq.exe
  2⤵
  PID:10104
- C:\Windows\System\yzOVRXT.exe
  C:\Windows\System\yzOVRXT.exe
  2⤵
  PID:7508
- C:\Windows\System\UtLFHJB.exe
  C:\Windows\System\UtLFHJB.exe
  2⤵
  PID:7152
- C:\Windows\System\bCcwkRL.exe
  C:\Windows\System\bCcwkRL.exe
  2⤵
  PID:3780
- C:\Windows\System\nKjBjuR.exe
  C:\Windows\System\nKjBjuR.exe
  2⤵
  PID:1520
- C:\Windows\System\TiLCsDY.exe
  C:\Windows\System\TiLCsDY.exe
  2⤵
  PID:4416
- C:\Windows\System\rapYByT.exe
  C:\Windows\System\rapYByT.exe
  2⤵
  PID:5496
- C:\Windows\System\tUbhbfc.exe
  C:\Windows\System\tUbhbfc.exe
  2⤵
  PID:14200
- C:\Windows\System\rpTCYEQ.exe
  C:\Windows\System\rpTCYEQ.exe
  2⤵
  PID:5360
- C:\Windows\System\IeMsfeE.exe
  C:\Windows\System\IeMsfeE.exe
  2⤵
  PID:5680
- C:\Windows\System\KeFjLPI.exe
  C:\Windows\System\KeFjLPI.exe
  2⤵
  PID:14072
- C:\Windows\System\KnZbGFy.exe
  C:\Windows\System\KnZbGFy.exe
  2⤵
  PID:5052
- C:\Windows\System\sHtgJZX.exe
  C:\Windows\System\sHtgJZX.exe
  2⤵
  PID:14256
- C:\Windows\System\tCJjLQz.exe
  C:\Windows\System\tCJjLQz.exe
  2⤵
  PID:14056
- C:\Windows\System\xNklIfn.exe
  C:\Windows\System\xNklIfn.exe
  2⤵
  PID:14196
- C:\Windows\System\aMapYrN.exe
  C:\Windows\System\aMapYrN.exe
  2⤵
  PID:5740
- C:\Windows\System\hQwVBML.exe
  C:\Windows\System\hQwVBML.exe
  2⤵
  PID:5284
- C:\Windows\System\FnmjPUf.exe
  C:\Windows\System\FnmjPUf.exe
  2⤵
  PID:2492
- C:\Windows\System\xOvmIbj.exe
  C:\Windows\System\xOvmIbj.exe
  2⤵
  PID:2948
- C:\Windows\System\gOGAaBF.exe
  C:\Windows\System\gOGAaBF.exe
  2⤵
  PID:6016
- C:\Windows\System\JCUCTeW.exe
  C:\Windows\System\JCUCTeW.exe
  2⤵
  PID:6312
- C:\Windows\System\PIDvJos.exe
  C:\Windows\System\PIDvJos.exe
  2⤵
  PID:3328
- C:\Windows\System\tiOsASu.exe
  C:\Windows\System\tiOsASu.exe
  2⤵
  PID:8
- C:\Windows\System\UKOagRr.exe
  C:\Windows\System\UKOagRr.exe
  2⤵
  PID:5888
- C:\Windows\System\cFuUeCr.exe
  C:\Windows\System\cFuUeCr.exe
  2⤵
  PID:3484
- C:\Windows\System\xOypRrz.exe
  C:\Windows\System\xOypRrz.exe
  2⤵
  PID:5228
- C:\Windows\System\Pgggtwb.exe
  C:\Windows\System\Pgggtwb.exe
  2⤵
  PID:11436
- C:\Windows\System\FkMtwGl.exe
  C:\Windows\System\FkMtwGl.exe
  2⤵
  PID:13580
- C:\Windows\System\JSWnkhT.exe
  C:\Windows\System\JSWnkhT.exe
  2⤵
  PID:13772
- C:\Windows\System\TanPUCT.exe
  C:\Windows\System\TanPUCT.exe
  2⤵
  PID:6800
- C:\Windows\System\hWqeKGl.exe
  C:\Windows\System\hWqeKGl.exe
  2⤵
  PID:6844
- C:\Windows\System\xPoVyxB.exe
  C:\Windows\System\xPoVyxB.exe
  2⤵
  PID:14044
- C:\Windows\System\vMNHLVJ.exe
  C:\Windows\System\vMNHLVJ.exe
  2⤵
  PID:9268
- C:\Windows\System\gnQKBUM.exe
  C:\Windows\System\gnQKBUM.exe
  2⤵
  PID:6996
- C:\Windows\System\WapOyJu.exe
  C:\Windows\System\WapOyJu.exe
  2⤵
  PID:6580
- C:\Windows\System\YzvsLLM.exe
  C:\Windows\System\YzvsLLM.exe
  2⤵
  PID:5544
- C:\Windows\System\jfgvMWj.exe
  C:\Windows\System\jfgvMWj.exe
  2⤵
  PID:11080
- C:\Windows\System\soSbsqZ.exe
  C:\Windows\System\soSbsqZ.exe
  2⤵
  PID:8384
- C:\Windows\System\xDouqJU.exe
  C:\Windows\System\xDouqJU.exe
  2⤵
  PID:8736
- C:\Windows\System\WtZciKE.exe
  C:\Windows\System\WtZciKE.exe
  2⤵
  PID:6876
- C:\Windows\System\IcOATYW.exe
  C:\Windows\System\IcOATYW.exe
  2⤵
  PID:6916
- C:\Windows\System\MsJTRys.exe
  C:\Windows\System\MsJTRys.exe
  2⤵
  PID:4400
- C:\Windows\System\RaIyaHL.exe
  C:\Windows\System\RaIyaHL.exe
  2⤵
  PID:5464
- C:\Windows\System\DjCQWXw.exe
  C:\Windows\System\DjCQWXw.exe
  2⤵
  PID:14116
- C:\Windows\System\WsCoaZf.exe
  C:\Windows\System\WsCoaZf.exe
  2⤵
  PID:5468
- C:\Windows\System\gUHCqDM.exe
  C:\Windows\System\gUHCqDM.exe
  2⤵
  PID:7024
- C:\Windows\System\meVrmTO.exe
  C:\Windows\System\meVrmTO.exe
  2⤵
  PID:14052
- C:\Windows\System\xJtKVfw.exe
  C:\Windows\System\xJtKVfw.exe
  2⤵
  PID:7364
- C:\Windows\System\qKKhtrC.exe
  C:\Windows\System\qKKhtrC.exe
  2⤵
  PID:13956
- C:\Windows\System\YaDiwTV.exe
  C:\Windows\System\YaDiwTV.exe
  2⤵
  PID:7460
- C:\Windows\System\WTbIRvU.exe
  C:\Windows\System\WTbIRvU.exe
  2⤵
  PID:6220
- C:\Windows\System\bBgmiYf.exe
  C:\Windows\System\bBgmiYf.exe
  2⤵
  PID:5880
- C:\Windows\System\IammofH.exe
  C:\Windows\System\IammofH.exe
  2⤵
  PID:6784
- C:\Windows\System\FbbOuMD.exe
  C:\Windows\System\FbbOuMD.exe
  2⤵
  PID:5788
- C:\Windows\System\wfnOTdt.exe
  C:\Windows\System\wfnOTdt.exe
  2⤵
  PID:6000
- C:\Windows\System\jOlOhva.exe
  C:\Windows\System\jOlOhva.exe
  2⤵
  PID:7820
- C:\Windows\System\DQSmrmF.exe
  C:\Windows\System\DQSmrmF.exe
  2⤵
  PID:3728
- C:\Windows\System\nrWDUrM.exe
  C:\Windows\System\nrWDUrM.exe
  2⤵
  PID:1624
- C:\Windows\System\vyXYJNc.exe
  C:\Windows\System\vyXYJNc.exe
  2⤵
  PID:7100
- C:\Windows\System\tCyEIRa.exe
  C:\Windows\System\tCyEIRa.exe
  2⤵
  PID:6448
- C:\Windows\System\gocEufL.exe
  C:\Windows\System\gocEufL.exe
  2⤵
  PID:13424
- C:\Windows\System\ZxrwdMg.exe
  C:\Windows\System\ZxrwdMg.exe
  2⤵
  PID:1208
- C:\Windows\System\EFueXYS.exe
  C:\Windows\System\EFueXYS.exe
  2⤵
  PID:7384
- C:\Windows\System\GnJGFiU.exe
  C:\Windows\System\GnJGFiU.exe
  2⤵
  PID:8124
- C:\Windows\System\VjFlshf.exe
  C:\Windows\System\VjFlshf.exe
  2⤵
  PID:1960
- C:\Windows\System\jQziDdf.exe
  C:\Windows\System\jQziDdf.exe
  2⤵
  PID:13540
- C:\Windows\System\zIUkXnd.exe
  C:\Windows\System\zIUkXnd.exe
  2⤵
  PID:6092
- C:\Windows\System\kpVcEkv.exe
  C:\Windows\System\kpVcEkv.exe
  2⤵
  PID:7936
- C:\Windows\System\tNCHOEV.exe
  C:\Windows\System\tNCHOEV.exe
  2⤵
  PID:7232
- C:\Windows\System\iLFYqEu.exe
  C:\Windows\System\iLFYqEu.exe
  2⤵
  PID:8044
- C:\Windows\System\nXhlwQV.exe
  C:\Windows\System\nXhlwQV.exe
  2⤵
  PID:4212
- C:\Windows\System\UJlueBc.exe
  C:\Windows\System\UJlueBc.exe
  2⤵
  PID:8112
- C:\Windows\System\PBrGFWr.exe
  C:\Windows\System\PBrGFWr.exe
  2⤵
  PID:6956
- C:\Windows\System\zRvRAJp.exe
  C:\Windows\System\zRvRAJp.exe
  2⤵
  PID:4632
- C:\Windows\System\OZZJYlU.exe
  C:\Windows\System\OZZJYlU.exe
  2⤵
  PID:6020
- C:\Windows\System\rMRSKVN.exe
  C:\Windows\System\rMRSKVN.exe
  2⤵
  PID:10896
- C:\Windows\System\kzpFTnD.exe
  C:\Windows\System\kzpFTnD.exe
  2⤵
  PID:7784
- C:\Windows\System\vKRjFYt.exe
  C:\Windows\System\vKRjFYt.exe
  2⤵
  PID:6824
- C:\Windows\System\AVuDONK.exe
  C:\Windows\System\AVuDONK.exe
  2⤵
  PID:6052
- C:\Windows\System\VcpPniQ.exe
  C:\Windows\System\VcpPniQ.exe
  2⤵
  PID:6856
- C:\Windows\System\RuFheKW.exe
  C:\Windows\System\RuFheKW.exe
  2⤵
  PID:6892
- C:\Windows\System\XXAuPII.exe
  C:\Windows\System\XXAuPII.exe
  2⤵
  PID:6436
- C:\Windows\System\fUWuvjV.exe
  C:\Windows\System\fUWuvjV.exe
  2⤵
  PID:6592
- C:\Windows\System\duupLlp.exe
  C:\Windows\System\duupLlp.exe
  2⤵
  PID:8828
- C:\Windows\System\zgelEhn.exe
  C:\Windows\System\zgelEhn.exe
  2⤵
  PID:8768
- C:\Windows\System\FSceHNN.exe
  C:\Windows\System\FSceHNN.exe
  2⤵
  PID:5512
- C:\Windows\System\BZpWMOI.exe
  C:\Windows\System\BZpWMOI.exe
  2⤵
  PID:6376
- C:\Windows\System\wYxepng.exe
  C:\Windows\System\wYxepng.exe
  2⤵
  PID:5528
- C:\Windows\System\prCvkkW.exe
  C:\Windows\System\prCvkkW.exe
  2⤵
  PID:8632
- C:\Windows\System\BfUCawc.exe
  C:\Windows\System\BfUCawc.exe
  2⤵
  PID:3352
- C:\Windows\System\woqIORX.exe
  C:\Windows\System\woqIORX.exe
  2⤵
  PID:8904
- C:\Windows\System\GbwRtXs.exe
  C:\Windows\System\GbwRtXs.exe
  2⤵
  PID:8692
- C:\Windows\System\ZXlDOkT.exe
  C:\Windows\System\ZXlDOkT.exe
  2⤵
  PID:11480
- C:\Windows\System\cqhxioL.exe
  C:\Windows\System\cqhxioL.exe
  2⤵
  PID:7724
- C:\Windows\System\NuhtyVx.exe
  C:\Windows\System\NuhtyVx.exe
  2⤵
  PID:6300
- C:\Windows\System\ZZMAwRu.exe
  C:\Windows\System\ZZMAwRu.exe
  2⤵
  PID:13368
- C:\Windows\System\atGRYbE.exe
  C:\Windows\System\atGRYbE.exe
  2⤵
  PID:9396
- C:\Windows\System\CFoZkkt.exe
  C:\Windows\System\CFoZkkt.exe
  2⤵
  PID:7696
- C:\Windows\System\tqQimlt.exe
  C:\Windows\System\tqQimlt.exe
  2⤵
  PID:9372
- C:\Windows\System\fvYPdoJ.exe
  C:\Windows\System\fvYPdoJ.exe
  2⤵
  PID:7492
- C:\Windows\System\Aygprol.exe
  C:\Windows\System\Aygprol.exe
  2⤵
  PID:5072
- C:\Windows\System\EIgHhmQ.exe
  C:\Windows\System\EIgHhmQ.exe
  2⤵
  PID:9460
- C:\Windows\System\EwlzmEt.exe
  C:\Windows\System\EwlzmEt.exe
  2⤵
  PID:13664
- C:\Windows\System\uCBuyeM.exe
  C:\Windows\System\uCBuyeM.exe
  2⤵
  PID:6148
- C:\Windows\System\UxtwFQp.exe
  C:\Windows\System\UxtwFQp.exe
  2⤵
  PID:4240
- C:\Windows\System\qSRQRye.exe
  C:\Windows\System\qSRQRye.exe
  2⤵
  PID:8612
- C:\Windows\System\PEQLRwA.exe
  C:\Windows\System\PEQLRwA.exe
  2⤵
  PID:8088
- C:\Windows\System\jnPwKIU.exe
  C:\Windows\System\jnPwKIU.exe
  2⤵
  PID:14088
- C:\Windows\System\fhlimKs.exe
  C:\Windows\System\fhlimKs.exe
  2⤵
  PID:10644
- C:\Windows\System\aNSPNsN.exe
  C:\Windows\System\aNSPNsN.exe
  2⤵
  PID:9696
- C:\Windows\System\ebTXTHa.exe
  C:\Windows\System\ebTXTHa.exe
  2⤵
  PID:9784
- C:\Windows\System\izpsiWV.exe
  C:\Windows\System\izpsiWV.exe
  2⤵
  PID:6396
- C:\Windows\System\kudAIJG.exe
  C:\Windows\System\kudAIJG.exe
  2⤵
  PID:8268
- C:\Windows\System\nQMvWmr.exe
  C:\Windows\System\nQMvWmr.exe
  2⤵
  PID:7804
- C:\Windows\System\QOgtFtB.exe
  C:\Windows\System\QOgtFtB.exe
  2⤵
  PID:6820
- C:\Windows\System\gbPtkqz.exe
  C:\Windows\System\gbPtkqz.exe
  2⤵
  PID:10872
- C:\Windows\System\hkNpEDW.exe
  C:\Windows\System\hkNpEDW.exe
  2⤵
  PID:6848
- C:\Windows\System\NDYIPvW.exe
  C:\Windows\System\NDYIPvW.exe
  2⤵
  PID:10920
- C:\Windows\System\fXYsLae.exe
  C:\Windows\System\fXYsLae.exe
  2⤵
  PID:9520
- C:\Windows\System\bhWLieG.exe
  C:\Windows\System\bhWLieG.exe
  2⤵
  PID:3872
- C:\Windows\System\zmdSlGP.exe
  C:\Windows\System\zmdSlGP.exe
  2⤵
  PID:8784
- C:\Windows\System\loRxogG.exe
  C:\Windows\System\loRxogG.exe
  2⤵
  PID:9120
- C:\Windows\System\FwyvFNu.exe
  C:\Windows\System\FwyvFNu.exe
  2⤵
  PID:11244
- C:\Windows\System\Rdjopjr.exe
  C:\Windows\System\Rdjopjr.exe
  2⤵
  PID:9616
- C:\Windows\System\dLeKSII.exe
  C:\Windows\System\dLeKSII.exe
  2⤵
  PID:10064
- C:\Windows\System\GJLagoY.exe
  C:\Windows\System\GJLagoY.exe
  2⤵
  PID:10100
- C:\Windows\System\RDZHBij.exe
  C:\Windows\System\RDZHBij.exe
  2⤵
  PID:8512
- C:\Windows\System\kzGzhOf.exe
  C:\Windows\System\kzGzhOf.exe
  2⤵
  PID:5156
- C:\Windows\System\KnGSYCj.exe
  C:\Windows\System\KnGSYCj.exe
  2⤵
  PID:5336
- C:\Windows\System\WLabdQc.exe
  C:\Windows\System\WLabdQc.exe
  2⤵
  PID:7112
- C:\Windows\System\pNZUsBK.exe
  C:\Windows\System\pNZUsBK.exe
  2⤵
  PID:8524
- C:\Windows\System\PPoZQUt.exe
  C:\Windows\System\PPoZQUt.exe
  2⤵
  PID:8896
- C:\Windows\System\UrySCXD.exe
  C:\Windows\System\UrySCXD.exe
  2⤵
  PID:11500
- C:\Windows\System\rSQTaIS.exe
  C:\Windows\System\rSQTaIS.exe
  2⤵
  PID:4208
- C:\Windows\System\QTIqLME.exe
  C:\Windows\System\QTIqLME.exe
  2⤵
  PID:13360
- C:\Windows\System\XUcFLFT.exe
  C:\Windows\System\XUcFLFT.exe
  2⤵
  PID:6920
- C:\Windows\System\aHgPfYM.exe
  C:\Windows\System\aHgPfYM.exe
  2⤵
  PID:10880
- C:\Windows\System\zOEFfBh.exe
  C:\Windows\System\zOEFfBh.exe
  2⤵
  PID:4260
- C:\Windows\System\OOZhCyn.exe
  C:\Windows\System\OOZhCyn.exe
  2⤵
  PID:9400
- C:\Windows\System\WXMNGmz.exe
  C:\Windows\System\WXMNGmz.exe
  2⤵
  PID:1772
- C:\Windows\System\ydYppOx.exe
  C:\Windows\System\ydYppOx.exe
  2⤵
  PID:11100
- C:\Windows\System\dopxyfW.exe
  C:\Windows\System\dopxyfW.exe
  2⤵
  PID:8208
- C:\Windows\System\AgfkIjG.exe
  C:\Windows\System\AgfkIjG.exe
  2⤵
  PID:9312
- C:\Windows\System\vwhMDBS.exe
  C:\Windows\System\vwhMDBS.exe
  2⤵
  PID:7692
- C:\Windows\System\AQgugQj.exe
  C:\Windows\System\AQgugQj.exe
  2⤵
  PID:9692
- C:\Windows\System\gvYtqJe.exe
  C:\Windows\System\gvYtqJe.exe
  2⤵
  PID:9500
- C:\Windows\System\xgRsjGV.exe
  C:\Windows\System\xgRsjGV.exe
  2⤵
  PID:8144
- C:\Windows\System\wWIdeNi.exe
  C:\Windows\System\wWIdeNi.exe
  2⤵
  PID:7872
- C:\Windows\System\TBvpwKU.exe
  C:\Windows\System\TBvpwKU.exe
  2⤵
  PID:9436
- C:\Windows\System\bwysrYJ.exe
  C:\Windows\System\bwysrYJ.exe
  2⤵
  PID:1488
- C:\Windows\System\LwDcwDk.exe
  C:\Windows\System\LwDcwDk.exe
  2⤵
  PID:6616
- C:\Windows\System\cMsYjnL.exe
  C:\Windows\System\cMsYjnL.exe
  2⤵
  PID:9556
- C:\Windows\System\CSLogmc.exe
  C:\Windows\System\CSLogmc.exe
  2⤵
  PID:7880
- C:\Windows\System\SrxkrFs.exe
  C:\Windows\System\SrxkrFs.exe
  2⤵
  PID:10444
- C:\Windows\System\DJibddB.exe
  C:\Windows\System\DJibddB.exe
  2⤵
  PID:1948
- C:\Windows\System\FiCdGdP.exe
  C:\Windows\System\FiCdGdP.exe
  2⤵
  PID:11004
- C:\Windows\System\PPuwYjz.exe
  C:\Windows\System\PPuwYjz.exe
  2⤵
  PID:8608
- C:\Windows\System\xzPENUu.exe
  C:\Windows\System\xzPENUu.exe
  2⤵
  PID:7340
- C:\Windows\System\DdqVqSq.exe
  C:\Windows\System\DdqVqSq.exe
  2⤵
  PID:9084
- C:\Windows\System\GQRtmoa.exe
  C:\Windows\System\GQRtmoa.exe
  2⤵
  PID:11452
- C:\Windows\System\NkkVnDc.exe
  C:\Windows\System\NkkVnDc.exe
  2⤵
  PID:9196
- C:\Windows\System\piOYEWq.exe
  C:\Windows\System\piOYEWq.exe
  2⤵
  PID:10024
- C:\Windows\System\AegfAMG.exe
  C:\Windows\System\AegfAMG.exe
  2⤵
  PID:11428
- C:\Windows\System\DHLRKHL.exe
  C:\Windows\System\DHLRKHL.exe
  2⤵
  PID:10000
- C:\Windows\System\KHOoOIh.exe
  C:\Windows\System\KHOoOIh.exe
  2⤵
  PID:4560
- C:\Windows\System\sFbqwOO.exe
  C:\Windows\System\sFbqwOO.exe
  2⤵
  PID:7044
- C:\Windows\System\InhhQYn.exe
  C:\Windows\System\InhhQYn.exe
  2⤵
  PID:10144
- C:\Windows\System\xpzeQIq.exe
  C:\Windows\System\xpzeQIq.exe
  2⤵
  PID:8892
- C:\Windows\System\HfsTAka.exe
  C:\Windows\System\HfsTAka.exe
  2⤵
  PID:10536
- C:\Windows\System\ibXMorF.exe
  C:\Windows\System\ibXMorF.exe
  2⤵
  PID:8836
- C:\Windows\System\NUgKXdZ.exe
  C:\Windows\System\NUgKXdZ.exe
  2⤵
  PID:8860
- C:\Windows\System\USDHphq.exe
  C:\Windows\System\USDHphq.exe
  2⤵
  PID:10620
- C:\Windows\System\uFPUlIO.exe
  C:\Windows\System\uFPUlIO.exe
  2⤵
  PID:10220
- C:\Windows\System\gfNNiZh.exe
  C:\Windows\System\gfNNiZh.exe
  2⤵
  PID:12828
- C:\Windows\System\fojCjky.exe
  C:\Windows\System\fojCjky.exe
  2⤵
  PID:7352
- C:\Windows\System\OfFHBcA.exe
  C:\Windows\System\OfFHBcA.exe
  2⤵
  PID:5752
- C:\Windows\System\pkzQdzd.exe
  C:\Windows\System\pkzQdzd.exe
  2⤵
  PID:7304
- C:\Windows\System\kUvgnGZ.exe
  C:\Windows\System\kUvgnGZ.exe
  2⤵
  PID:12948
- C:\Windows\System\GuqVSyZ.exe
  C:\Windows\System\GuqVSyZ.exe
  2⤵
  PID:7464
- C:\Windows\System\wItfhJA.exe
  C:\Windows\System\wItfhJA.exe
  2⤵
  PID:7532
- C:\Windows\System\IMzpIEd.exe
  C:\Windows\System\IMzpIEd.exe
  2⤵
  PID:2352
- C:\Windows\System\wAmhSCP.exe
  C:\Windows\System\wAmhSCP.exe
  2⤵
  PID:7188
- C:\Windows\System\YJnjTrD.exe
  C:\Windows\System\YJnjTrD.exe
  2⤵
  PID:10308
- C:\Windows\System\bJvOiFl.exe
  C:\Windows\System\bJvOiFl.exe
  2⤵
  PID:10652
- C:\Windows\System\kuxgalR.exe
  C:\Windows\System\kuxgalR.exe
  2⤵
  PID:10696
- C:\Windows\System\tEDDNKK.exe
  C:\Windows\System\tEDDNKK.exe
  2⤵
  PID:5400
- C:\Windows\System\jcudndK.exe
  C:\Windows\System\jcudndK.exe
  2⤵
  PID:12816
- C:\Windows\System\LTfphhs.exe
  C:\Windows\System\LTfphhs.exe
  2⤵
  PID:12364
- C:\Windows\System\PgbothN.exe
  C:\Windows\System\PgbothN.exe
  2⤵
  PID:7668
- C:\Windows\System\iWQmhWC.exe
  C:\Windows\System\iWQmhWC.exe
  2⤵
  PID:4580
- C:\Windows\System\rLClHRA.exe
  C:\Windows\System\rLClHRA.exe
  2⤵
  PID:13036
- C:\Windows\System\OYnTbYk.exe
  C:\Windows\System\OYnTbYk.exe
  2⤵
  PID:11284
- C:\Windows\System\DlMZBSR.exe
  C:\Windows\System\DlMZBSR.exe
  2⤵
  PID:13960
- C:\Windows\System\SNEJuEW.exe
  C:\Windows\System\SNEJuEW.exe
  2⤵
  PID:10348
- C:\Windows\System\QmrTSRP.exe
  C:\Windows\System\QmrTSRP.exe
  2⤵
  PID:13244
- C:\Windows\System\YoLdAJv.exe
  C:\Windows\System\YoLdAJv.exe
  2⤵
  PID:7280
- C:\Windows\System\FESMkbM.exe
  C:\Windows\System\FESMkbM.exe
  2⤵
  PID:6912
- C:\Windows\System\ttjUHQR.exe
  C:\Windows\System\ttjUHQR.exe
  2⤵
  PID:7652
- C:\Windows\System\MWFryhI.exe
  C:\Windows\System\MWFryhI.exe
  2⤵
  PID:7972
- C:\Windows\System\iPkqaJE.exe
  C:\Windows\System\iPkqaJE.exe
  2⤵
  PID:5592
- C:\Windows\System\WSOLjgU.exe
  C:\Windows\System\WSOLjgU.exe
  2⤵
  PID:10272
- C:\Windows\System\aznavHL.exe
  C:\Windows\System\aznavHL.exe
  2⤵
  PID:8844
- C:\Windows\System\GUuDWSd.exe
  C:\Windows\System\GUuDWSd.exe
  2⤵
  PID:5500
- C:\Windows\System\KCBRhkH.exe
  C:\Windows\System\KCBRhkH.exe
  2⤵
  PID:9856
- C:\Windows\System\uPOFnGr.exe
  C:\Windows\System\uPOFnGr.exe
  2⤵
  PID:7380
- C:\Windows\System\jvndXFx.exe
  C:\Windows\System\jvndXFx.exe
  2⤵
  PID:12916
- C:\Windows\System\ifLmyyr.exe
  C:\Windows\System\ifLmyyr.exe
  2⤵
  PID:8772
- C:\Windows\System\JGpyZnP.exe
  C:\Windows\System\JGpyZnP.exe
  2⤵
  PID:10852
- C:\Windows\System\LsfOctD.exe
  C:\Windows\System\LsfOctD.exe
  2⤵
  PID:7212
- C:\Windows\System\BlfNZft.exe
  C:\Windows\System\BlfNZft.exe
  2⤵
  PID:11288
- C:\Windows\System\SJNoNNM.exe
  C:\Windows\System\SJNoNNM.exe
  2⤵
  PID:7824
- C:\Windows\System\glxKCCb.exe
  C:\Windows\System\glxKCCb.exe
  2⤵
  PID:9560
- C:\Windows\System\ZFVInPe.exe
  C:\Windows\System\ZFVInPe.exe
  2⤵
  PID:12180
- C:\Windows\System\gMNIBic.exe
  C:\Windows\System\gMNIBic.exe
  2⤵
  PID:7236
- C:\Windows\System\aqALfmI.exe
  C:\Windows\System\aqALfmI.exe
  2⤵
  PID:11236
- C:\Windows\System\EwXhHzB.exe
  C:\Windows\System\EwXhHzB.exe
  2⤵
  PID:4048
- C:\Windows\System\WKBbhmh.exe
  C:\Windows\System\WKBbhmh.exe
  2⤵
  PID:9944
- C:\Windows\System\IXAVvYe.exe
  C:\Windows\System\IXAVvYe.exe
  2⤵
  PID:11268
- C:\Windows\System\nHOjigD.exe
  C:\Windows\System\nHOjigD.exe
  2⤵
  PID:10492
- C:\Windows\System\iDLOCku.exe
  C:\Windows\System\iDLOCku.exe
  2⤵
  PID:10044
- C:\Windows\System\SryUJHs.exe
  C:\Windows\System\SryUJHs.exe
  2⤵
  PID:1088
- C:\Windows\System\RdnxaIw.exe
  C:\Windows\System\RdnxaIw.exe
  2⤵
  PID:5700
- C:\Windows\System\CvLsKXM.exe
  C:\Windows\System\CvLsKXM.exe
  2⤵
  PID:12404
- C:\Windows\System\xEbwvXc.exe
  C:\Windows\System\xEbwvXc.exe
  2⤵
  PID:11832
- C:\Windows\System\IhunffI.exe
  C:\Windows\System\IhunffI.exe
  2⤵
  PID:5008
- C:\Windows\System\mmYIbwQ.exe
  C:\Windows\System\mmYIbwQ.exe
  2⤵
  PID:7920
- C:\Windows\System\SpUHTja.exe
  C:\Windows\System\SpUHTja.exe
  2⤵
  PID:13224
- C:\Windows\System\QSAYQDt.exe
  C:\Windows\System\QSAYQDt.exe
  2⤵
  PID:4332
- C:\Windows\System\mAqrFxB.exe
  C:\Windows\System\mAqrFxB.exe
  2⤵
  PID:12316
- C:\Windows\System\nPvCkdO.exe
  C:\Windows\System\nPvCkdO.exe
  2⤵
  PID:8928
- C:\Windows\System\iunOLCl.exe
  C:\Windows\System\iunOLCl.exe
  2⤵
  PID:2064
- C:\Windows\System\PxQcTCe.exe
  C:\Windows\System\PxQcTCe.exe
  2⤵
  PID:11392
- C:\Windows\System\eXkPNON.exe
  C:\Windows\System\eXkPNON.exe
  2⤵
  PID:8796
- C:\Windows\System\bXcJzpB.exe
  C:\Windows\System\bXcJzpB.exe
  2⤵
  PID:8808
- C:\Windows\System\OMdjqZE.exe
  C:\Windows\System\OMdjqZE.exe
  2⤵
  PID:12532
- C:\Windows\System\zceCwwT.exe
  C:\Windows\System\zceCwwT.exe
  2⤵
  PID:13016
- C:\Windows\System\CsojpeA.exe
  C:\Windows\System\CsojpeA.exe
  2⤵
  PID:4304
- C:\Windows\System\BSwmdlc.exe
  C:\Windows\System\BSwmdlc.exe
  2⤵
  PID:2072
- C:\Windows\System\SoaieOH.exe
  C:\Windows\System\SoaieOH.exe
  2⤵
  PID:11380
- C:\Windows\System\VXdhWhm.exe
  C:\Windows\System\VXdhWhm.exe
  2⤵
  PID:1384
- C:\Windows\System\FmTrUDa.exe
  C:\Windows\System\FmTrUDa.exe
  2⤵
  PID:6936
- C:\Windows\System\XQxeASc.exe
  C:\Windows\System\XQxeASc.exe
  2⤵
  PID:11312
- C:\Windows\System\DoIKBys.exe
  C:\Windows\System\DoIKBys.exe
  2⤵
  PID:7608
- C:\Windows\System\pApWXFS.exe
  C:\Windows\System\pApWXFS.exe
  2⤵
  PID:9516
- C:\Windows\System\trTIfOp.exe
  C:\Windows\System\trTIfOp.exe
  2⤵
  PID:536
- C:\Windows\System\rndEDYD.exe
  C:\Windows\System\rndEDYD.exe
  2⤵
  PID:12200
- C:\Windows\System\KrdNuyV.exe
  C:\Windows\System\KrdNuyV.exe
  2⤵
  PID:2476
- C:\Windows\System\vSdYCKj.exe
  C:\Windows\System\vSdYCKj.exe
  2⤵
  PID:13204
- C:\Windows\System\sHBowXZ.exe
  C:\Windows\System\sHBowXZ.exe
  2⤵
  PID:13220
- C:\Windows\System\DLIwVtV.exe
  C:\Windows\System\DLIwVtV.exe
  2⤵
  PID:8628
- C:\Windows\System\YgeByPs.exe
  C:\Windows\System\YgeByPs.exe
  2⤵
  PID:11948
- C:\Windows\System\yEdBRtW.exe
  C:\Windows\System\yEdBRtW.exe
  2⤵
  PID:12260
- C:\Windows\System\veyjMgi.exe
  C:\Windows\System\veyjMgi.exe
  2⤵
  PID:12400
- C:\Windows\System\HVmtvPn.exe
  C:\Windows\System\HVmtvPn.exe
  2⤵
  PID:11884
- C:\Windows\System\IHhnkBe.exe
  C:\Windows\System\IHhnkBe.exe
  2⤵
  PID:14216
- C:\Windows\System\IXdpmOf.exe
  C:\Windows\System\IXdpmOf.exe
  2⤵
  PID:1064
- C:\Windows\System\ocaiYpm.exe
  C:\Windows\System\ocaiYpm.exe
  2⤵
  PID:1452
- C:\Windows\System\IrVCDVE.exe
  C:\Windows\System\IrVCDVE.exe
  2⤵
  PID:11872
- C:\Windows\System\WtmHvlK.exe
  C:\Windows\System\WtmHvlK.exe
  2⤵
  PID:13520
- C:\Windows\System\XQkuXHa.exe
  C:\Windows\System\XQkuXHa.exe
  2⤵
  PID:13536
- C:\Windows\System\YgvbnFD.exe
  C:\Windows\System\YgvbnFD.exe
  2⤵
  PID:12624
- C:\Windows\System\iuXASXD.exe
  C:\Windows\System\iuXASXD.exe
  2⤵
  PID:12728
- C:\Windows\System\AEAhgfA.exe
  C:\Windows\System\AEAhgfA.exe
  2⤵
  PID:684
- C:\Windows\System\UXMBmFQ.exe
  C:\Windows\System\UXMBmFQ.exe
  2⤵
  PID:11984
- C:\Windows\System\AeQwxwH.exe
  C:\Windows\System\AeQwxwH.exe
  2⤵
  PID:8312
- C:\Windows\System\KjGvuZR.exe
  C:\Windows\System\KjGvuZR.exe
  2⤵
  PID:13896
- C:\Windows\System\hvrAsat.exe
  C:\Windows\System\hvrAsat.exe
  2⤵
  PID:13856
- C:\Windows\System\oMtQwDL.exe
  C:\Windows\System\oMtQwDL.exe
  2⤵
  PID:5744
- C:\Windows\System\rIqaUsy.exe
  C:\Windows\System\rIqaUsy.exe
  2⤵
  PID:14208
- C:\Windows\System\UWBzfHO.exe
  C:\Windows\System\UWBzfHO.exe
  2⤵
  PID:9760
- C:\Windows\System\mAhHTSU.exe
  C:\Windows\System\mAhHTSU.exe
  2⤵
  PID:836
- C:\Windows\System\zJubhfC.exe
  C:\Windows\System\zJubhfC.exe
  2⤵
  PID:1972
- C:\Windows\System\VFSzZdp.exe
  C:\Windows\System\VFSzZdp.exe
  2⤵
  PID:8988
- C:\Windows\System\lSQMIPA.exe
  C:\Windows\System\lSQMIPA.exe
  2⤵
  PID:11708
- C:\Windows\System\HDuOBSy.exe
  C:\Windows\System\HDuOBSy.exe
  2⤵
  PID:3324
- C:\Windows\System\GLJfBph.exe
  C:\Windows\System\GLJfBph.exe
  2⤵
  PID:12888
- C:\Windows\System\IArkrSc.exe
  C:\Windows\System\IArkrSc.exe
  2⤵
  PID:10952
- C:\Windows\System\VRQionp.exe
  C:\Windows\System\VRQionp.exe
  2⤵
  PID:12696
- C:\Windows\System\fjLhmFA.exe
  C:\Windows\System\fjLhmFA.exe
  2⤵
  PID:13436
- C:\Windows\System\zWMIEyG.exe
  C:\Windows\System\zWMIEyG.exe
  2⤵
  PID:11384
- C:\Windows\System\BowgImB.exe
  C:\Windows\System\BowgImB.exe
  2⤵
  PID:12168
- C:\Windows\System\hZOzLLY.exe
  C:\Windows\System\hZOzLLY.exe
  2⤵
  PID:13768
- C:\Windows\System\qbmKoyr.exe
  C:\Windows\System\qbmKoyr.exe
  2⤵
  PID:10932
- C:\Windows\System\MsfCKtz.exe
  C:\Windows\System\MsfCKtz.exe
  2⤵
  PID:14000
- C:\Windows\System\qhRFKVy.exe
  C:\Windows\System\qhRFKVy.exe
  2⤵
  PID:8536
- C:\Windows\System\OMjplbs.exe
  C:\Windows\System\OMjplbs.exe
  2⤵
  PID:13064
- C:\Windows\System\zcNQROe.exe
  C:\Windows\System\zcNQROe.exe
  2⤵
  PID:14304
- C:\Windows\System\ZxpBFsB.exe
  C:\Windows\System\ZxpBFsB.exe
  2⤵
  PID:4284
- C:\Windows\System\nOZLJSq.exe
  C:\Windows\System\nOZLJSq.exe
  2⤵
  PID:13100
- C:\Windows\System\xpUnFgi.exe
  C:\Windows\System\xpUnFgi.exe
  2⤵
  PID:10576
- C:\Windows\System\MMFxgMM.exe
  C:\Windows\System\MMFxgMM.exe
  2⤵
  PID:5224
- C:\Windows\System\HPQTJnQ.exe
  C:\Windows\System\HPQTJnQ.exe
  2⤵
  PID:13328
- C:\Windows\System\LgdZjje.exe
  C:\Windows\System\LgdZjje.exe
  2⤵
  PID:13384
- C:\Windows\System\CubFxIR.exe
  C:\Windows\System\CubFxIR.exe
  2⤵
  PID:12000
- C:\Windows\System\eYgPVgT.exe
  C:\Windows\System\eYgPVgT.exe
  2⤵
  PID:12120
- C:\Windows\System\JubsgaK.exe
  C:\Windows\System\JubsgaK.exe
  2⤵
  PID:10704
- C:\Windows\System\xwJunjD.exe
  C:\Windows\System\xwJunjD.exe
  2⤵
  PID:14092
- C:\Windows\System\mSEuqoN.exe
  C:\Windows\System\mSEuqoN.exe
  2⤵
  PID:4368
- C:\Windows\System\TWjGOEF.exe
  C:\Windows\System\TWjGOEF.exe
  2⤵
  PID:3304
- C:\Windows\System\kebqrry.exe
  C:\Windows\System\kebqrry.exe
  2⤵
  PID:8820
- C:\Windows\System\EzDBECz.exe
  C:\Windows\System\EzDBECz.exe
  2⤵
  PID:13632
- C:\Windows\System\zTsZVnR.exe
  C:\Windows\System\zTsZVnR.exe
  2⤵
  PID:14348
- C:\Windows\System\yzIeVxF.exe
  C:\Windows\System\yzIeVxF.exe
  2⤵
  PID:14472
- C:\Windows\System\ZMjYkRO.exe
  C:\Windows\System\ZMjYkRO.exe
  2⤵
  PID:14488
- C:\Windows\System\WNOwYrF.exe
  C:\Windows\System\WNOwYrF.exe
  2⤵
  PID:14532
- C:\Windows\System\jXSwxIQ.exe
  C:\Windows\System\jXSwxIQ.exe
  2⤵
  PID:14556
- C:\Windows\System\vSPVZll.exe
  C:\Windows\System\vSPVZll.exe
  2⤵
  PID:14604
- C:\Windows\System\EYgJbOY.exe
  C:\Windows\System\EYgJbOY.exe
  2⤵
  PID:14644
- C:\Windows\System\niqguyO.exe
  C:\Windows\System\niqguyO.exe
  2⤵
  PID:14672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p40tqqnt.pda.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AtXtlZl.exe

Filesize
1.9MB

MD5
53c358c7519f467110596cc841aa35e9

SHA1
2ed1b48c41583b61f47604434ef97c4f8baaaf98

SHA256
aa5380bb380890841efbf858fc35d29287c2f8126a8b9f91eb903274221f72a8

SHA512
8e373c4bb00ed1b05195dccfe6bbf63e4486632242345eb786ef8208c30ebe55c95c1a412792d1a10b77d7fd56ad2b44ab5d83ae8c5cd8557ee3d871616aa8a9

Download Submit
C:\Windows\System\FWBrMdb.exe

Filesize
1.9MB

MD5
1d2ed30b134893c164b8197d26935cea

SHA1
7973998e3d50ad0ad0804d0cea30ad30462498d5

SHA256
64bcc5dcc75a247b0941a0ea74fa03b6b9836b5a8f0bf2d18858654faf0af61e

SHA512
af6da04fe70abf41f7d4dc8e7fd20dfec9122f091552eae8f9bdea1131c774f113800cad9fc421375fe58fef853f253f2badafd67582a4bd56cbbee58bb9d8dc

Download Submit
C:\Windows\System\IATGzau.exe

Filesize
1.9MB

MD5
0145871740d4645e4c3c725b6b0b9a6e

SHA1
1b35a3d307002a0a5186d298bcd2bda1a4772924

SHA256
d444ca1538a828ac067c26d2c98a221fa86af28fabd67e9429b57d26248f0cad

SHA512
f7f2469824ced10ea1dbd824e015805b391210218a8b800ce557d23c309a7d060dda24c0f69bba3be3de72fd376681e04dcab21cb9718711cf314155daa9075e

Download Submit
C:\Windows\System\IFamZEw.exe

Filesize
1.9MB

MD5
9a342e467f97a0df5066e1455ed29a1c

SHA1
166ac198498fb161d8fe2fb83c8376101b9229b5

SHA256
c81e340f158fb590ae7a4eaa224291d6d4ff4b6c8d4f517461cb19dd27a6dc72

SHA512
d25d2927014d550dc19a2dc763b65c2edeb25b384d8e83635e1582c0c28d6bfd9ed79b75eb1e149e1eca7a71ce1bfb265756f2f330342ecb32d257ccba625e05

Download Submit
C:\Windows\System\JNINyEt.exe

Filesize
1.9MB

MD5
7e7c1d9639bee869747fff31baba53b4

SHA1
5f2f98eee599ec4c7b16884d2b5216691a6db6f6

SHA256
50d1bb309f73f0e63fc396278a544087e2491f525c94899695d40bd61b6dcc6d

SHA512
3d1eed067bf020afb9ba0cba6d265153500cbaa7e03cde0b6cbf8118469d265f73dde72620c9722ae903958bb4079e385960d422ac6014bef004b39e6cf0212e

Download Submit
C:\Windows\System\JopdLcQ.exe

Filesize
1.9MB

MD5
e97e42743109bff52f815c85094a208e

SHA1
4e9195f89e95b99da04db707cf25f3ad1f1e3b42

SHA256
19ce873f64e9fba179d17679875ef5daa44aee06a5ca5a9404f381b55eac6146

SHA512
3746d5cf409130f12473f425f338b1c2599f75a9d444a52e4d84537f19add0c264dc6b22d7719bbc3e3106febf12fe0172e02cbc70be32bb29803806fd973fff

Download Submit
C:\Windows\System\KbmHcpt.exe

Filesize
1.9MB

MD5
6c03d225bd01efdd541c46f99724ae6f

SHA1
5551e5a34620b96dbd2bc7e5dbd8250a75afb148

SHA256
63f96d41da110b12ab14ca1bb5dea67f89b645acbce7dc9f2682f439a4bed710

SHA512
3109ec47f2eb14a0ed21bd97502349f9e5f3b55bc765295745bef33c48e8438107a4fa0bf036e236a0a0b948f6de0b49b9225b503d9f185a09a181b1c10a2ca3

Download Submit
C:\Windows\System\MYLEMYv.exe

Filesize
1.9MB

MD5
1746a44eb41b428a5ec9be1066575e17

SHA1
3077e41a6d9e17bd21a04a0b08ac4833288204b6

SHA256
91a8f31e5e1bf8bed5f1cffb876168dcf00bf517634b97f1edb51aeae56b4542

SHA512
3b205142c1c6fe4ba30036b264288ab6bc556f27cee3f1fd3a649408b8df4ad704a01a6bb8d2c0389f88838dbf84ac12ca100eaa5c6a75fac5b0f12b9306dbc7

Download Submit
C:\Windows\System\NursNEH.exe

Filesize
1.9MB

MD5
9637f66ace312237153f1677e4343c80

SHA1
e0227109792dec7d3029b4fb7980db096bd8533b

SHA256
f9b1073f6ab8c01ada8aacb5df0a8ebb6383af96d9a557fd7b804351a9d1410d

SHA512
e702fd924572adb606f11d26cdb43c6bdd78b06d0abe96063fdcf1f2ab5038bf866e20b901a7b90725337abd3ee877fa3f3cafbfdae87f1860353e0cb7bbb6ea

Download Submit
C:\Windows\System\RedxnwK.exe

Filesize
1.9MB

MD5
09af498a0d9a576520a6b8238192ec94

SHA1
3df26505438b91de4024381205da83b736c00533

SHA256
0fc1347ba2a26497b970fdc85eac0860ca30605a3970e856031abb4d83c576f1

SHA512
b9ce518577ef89ada17348380dfcc3c76a9f520bbb28b8d6e78b4668fe01c2e1c2d929abe65bb899f0c5b5440a6064f2d1d106c980959b1b8b372d3dd0e1fc39

Download Submit
C:\Windows\System\Sqncmnh.exe

Filesize
1.9MB

MD5
84570bb5c0e9d40488caaf0d999b09d6

SHA1
2097bf010db946131a9af89f200fe682b5cd5463

SHA256
dbb9242b280f1dd78ab18db4ac375e9d72aceb4d3d22a91ca9711560a01b6572

SHA512
4cb71c11db3072e292e64f61bd91d793db59c2ea9f2cbba2fce7869cc31b7a3cd72e479334009987a3a40ab717fecebdad0af10de43f2efb4240119f29b73dd9

Download Submit
C:\Windows\System\TSaJaEv.exe

Filesize
1.9MB

MD5
f2a3ff4019daba7646fd85935cd3bc3c

SHA1
36fed872d36de3d7b30b2cd5ead38eb024f62e78

SHA256
c3ed90e5b42d1f504f53eaddbe0e3dd4733f3dd800c95b774c4fa8f27eb3a33a

SHA512
a883133059d92c05061bd67d896709bc05f92ec648d8517dae5263ccd2ced3ea4bfc2bb22c7727f08f979182ff57c393c3aa9263efebd0d17fde3e98201e11d6

Download Submit
C:\Windows\System\ThZDDlx.exe

Filesize
1.9MB

MD5
cd2b1200d9f4811003ebcf3d2af02101

SHA1
e981d265e5bb5ba1cea9955f0bb3fd271257ff17

SHA256
199cd614cca026635ab96586b6a91a7639b9e4a03fe4ec23b426b2aaebc74903

SHA512
52c4791a77d3b43898f3f9187f1edfdc99aa1050124fba8a1b9530b09c55ba7829a785957f631ad6d2c6b42951b084e3e09c784c80cb01debd6cc2b7f8c9bf41

Download Submit
C:\Windows\System\TjkxtvQ.exe

Filesize
1.9MB

MD5
55e0abd9e08ea76d7f72843ab96f669a

SHA1
80b801b7ebc66d4a2ca66cace099e07bcb011222

SHA256
73d232a4d44bf83a30b66c1e6252d509dab609a0767f3202ba2070cb13d9fa57

SHA512
59f98de6b23e57137bc80b16796a0e22a55595db4017450111973476cbc1d68f62b263cbdff41d269b26e3e46b41d28a848113abbd86fd03243253cfe5030feb

Download Submit
C:\Windows\System\TqJwZhK.exe

Filesize
1.9MB

MD5
675275f79efb368b947bf3cdf3190c86

SHA1
20d180b111afcb5edd64c5d0b209540ab7172f84

SHA256
d35f4ffb2eda0e0bcc7f7ac5e0f64e0f99727d0e9b75d867d4da9285a1c6bf74

SHA512
2ef63e8b527b9ca572fbd0736f27efe300f8487a56310c9b577ada9b0da4fc3603ee846c3159a6a563b7e51fe86e61dfdd974014f72edad4b226e351f47b7310

Download Submit
C:\Windows\System\UKLlHzl.exe

Filesize
1.9MB

MD5
7156d4ccd58fc62cdfc82a538eead6e1

SHA1
6fbfe2322fd81a33cf8e61bf2d7836616222d410

SHA256
c1fcf8a8c68e87d29ffa45299255cf626912b04ab4e47e01bcd6397551393eb8

SHA512
ffe5271a28f8f8819c32edb70cf358e7d7433be4e6f6fc7dcd1aa77a593b3f14cbe68a3cdd36ac8c9388f2e655f9eb76857191489fa51cb2d5d655a5d16aaaf4

Download Submit
C:\Windows\System\UokzOIk.exe

Filesize
1.9MB

MD5
613ebd432d988685b34adb5fcb58c4de

SHA1
efd13188dcecc125c498063e97b5be891ce289c2

SHA256
85e5a650e582adfa1fe1dea41d08a3112609cdb2dbcedefeef66d0f78e11f007

SHA512
6fcb8917a87396c8ae0c1e62135ebc7e2c1b2f8d9c0c811e7966eca05b96610cecd34d49c3628fd712c401e547b884b2ec9a3f3219d892052891534349ca1406

Download Submit
C:\Windows\System\UsqtQUN.exe

Filesize
1.9MB

MD5
2b04837dcc1df0cf03bbdaf055c7ace8

SHA1
ab36b3a4edbfa4a9d6aa38c4ad3946e5553076f7

SHA256
768fd61a0449d7644774c9faf60697d4dc73f7c59d08104226ff8ec1a4e28e06

SHA512
a76b9966af6d1902588f2f3cd08f95ec372d6b361ca60a2007fa1da5586fb9e70eba67dd1aaf3b2b94ab650c998b0a33ae450b1aff76762c72b22079cc970545

Download Submit
C:\Windows\System\VbqzSBl.exe

Filesize
1.9MB

MD5
0b15f2883a050dbfad6413a4aacb9021

SHA1
474c0e20981087be93b3659d9fd2a5d82a515620

SHA256
473445a2a8928959cd570683ff99b3db9a64171bfa91e04406b026c3bc160568

SHA512
6d2a489708426482112e50da8bcb40ef43bb36074725d582869e7295314d0bba9e800641491cef923fe555f7a33cb99d4183e6dd6cdeac8d771fd87c7eb3e0d9

Download Submit
C:\Windows\System\WMgilRR.exe

Filesize
1.9MB

MD5
ea28516e5cd7508a1b622fa2d0130d9b

SHA1
e8d3463b04096faac9532ccef8b2b7db0a6d44d4

SHA256
505ce95492f9318480a70178a47519a160719b11da760a02dcba924693f327bf

SHA512
9258d1294bb55dfef923e5f66dc5d56699d922fd7fb26477e0bc7baaed3e50d75033c2ad2bdb1d04037add1d55457516b9592c850460047d0d712c30075fff4e

Download Submit
C:\Windows\System\XbkraIF.exe

Filesize
1.9MB

MD5
38b67ff665a742f3d787b63d15d35eab

SHA1
194a544f69fa406cbddf786e1b5620221c90dd9b

SHA256
2061ccdb418fc0292934a19c9adf4ad2f27c741866f922d2ea6afc001e9195e5

SHA512
67acca1fc43686250a6e66f655ac4c6bf1fde26c4bd87960110cdcf591ec7158c9053251a400647973a696d5b1c75b035402ac000cbe119aed2b2b9ae1cfc2b7

Download Submit
C:\Windows\System\aeGuwDz.exe

Filesize
1.9MB

MD5
acc23be4c402f32e1c56beed772418a9

SHA1
b1ffc5625b307718241412714c3d6f86ca8dba72

SHA256
e69a3cbe4359846060544480ca8740bcff769b1283a888c4f81af17a0121e6a3

SHA512
aff2688a2d537c1a6832c230c9d6de52026e2b0158a7ff2b8e759bce31db34084d4d7596fb44dbbf4e1e577b41d70386b9486d0ad0d36cd2a3d5b8067e190e30

Download Submit
C:\Windows\System\asnCKtI.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\bejitqJ.exe

Filesize
1.9MB

MD5
65f277d6e3611555240eb2b164932c38

SHA1
e57e32baaeea298e7a07ff54ecbafc912e8e5cd6

SHA256
5f4e9574068f7d0fc22d39c8f691d1c2265d145a6e30e39f2ffeb32cbfd76f3b

SHA512
fdcad3ed8a18ffdead8702ed6b7754ffa38680ec9f9430edb58a64c171d8acfe8e6029f28fe1b60ebffd449fb6bdfc8a79c759baa3e52c79fdcb761f7a2cb322

Download Submit
C:\Windows\System\bwAPRZj.exe

Filesize
1.9MB

MD5
1b78d90c6c46d3d04cf44f34f51e0ce2

SHA1
bd36c8f7c764c86854ce4089ddf3195452a6156d

SHA256
a91e5e48b7fdd3ef8d731ac6d5a280fac5210161f2b239e22ea67f79633fff43

SHA512
27ef9bbed5dd3fb3adc798c49e56d34db62c51c3ed726355ad26264313847bec31f31aa56133f103d540152d10e7813a5e97776612bb0a132a54f27ee73649c9

Download Submit
C:\Windows\System\ffbdCSZ.exe

Filesize
1.9MB

MD5
9d18c2d3f997cddf44b16404958938c8

SHA1
aa6eaa4d41b2af14d03c626404d84b8ad3c2b8dd

SHA256
fcbcd908c89e631e855db53e1b0f46d38becbd798abcc64d83a81240d8b137a7

SHA512
45b28b5163f743e669d2f81509dca09f40c46fa239a5e4195328284dd2b966fd53a3bc943c74965ae78f45f3b5d09ca718c4293f78a20642a4004f108ebc7437

Download Submit
C:\Windows\System\gNCzRvI.exe

Filesize
1.9MB

MD5
cfde813e8af8a1d13c4e08209275bb28

SHA1
1dfd1a861b7e26af86198da5e43a5cfaab4ddb16

SHA256
c41a59ff774dc1308cdfb06a172d1f8a8c03f32b3911c24fb749052efe4f5ca5

SHA512
894f796cd99e4e23fa94d4bd90d66d59c4e27ba42329c14d4dc4934cd7a93c1a220b17190418dbaa824d89561f8ff9dbdc4f6f2222e97553d901b2531a42f33b

Download Submit
C:\Windows\System\lpmpDAI.exe

Filesize
1.9MB

MD5
8207bff2ccfca1f128d507cc3f0a9405

SHA1
8f7fceece49718565a7389dd5baef59d5d84179e

SHA256
80a31a2798a72d756d02957baee3ec290ce2197aeced82633c1a76cd55aaaf3a

SHA512
0beedfc6a45080f48440d7fdedb51a4ec16a72fda695348a43de21e98241e08632ac9018ef1e375ea7e4639abcc0c36b6a6da192b9870af98c6f3bcf40bcc70e

Download Submit
C:\Windows\System\myCuPLV.exe

Filesize
1.9MB

MD5
042c3d12f5bd99403838e9f2313df5bd

SHA1
10a60dfe3cd83d1dc1a341b874702d4a75c4e43f

SHA256
5e38f1d68cf0dfce0d5a7b6b6a8833ac9a33d4756101538057b75d049bce97c6

SHA512
3cc120585fb6ed0a1875ae082913774490d89c8e8bc7e3164594354c34c698022eea1cef1248194116e08a9584ce5bfcb7f1112d9556e01f111bb583fa4d7a9b

Download Submit
C:\Windows\System\oNgQXtp.exe

Filesize
1.9MB

MD5
2d8eaa85ac62902ddf1f02abfe69db50

SHA1
27705809140a9e3eb2a1e3cba681ba67a3ea8123

SHA256
1ad42c3d1331e8bd0e3a85b62e0cc61d1aa675f5dc4a641574f9fc88d8bf0499

SHA512
041eecaa985ca68c304766890dc5858a9b9b291b3927a6b12aa38a29b93c21bb22d73c80919f285e47b3ea4bc741bdaf9009948328961ba0f6feba053769c6aa

Download Submit
C:\Windows\System\pGPPvEW.exe

Filesize
1.9MB

MD5
165d576409a198913b8696c030f0166d

SHA1
c4f8348ed10a7f946bf80661fb3e0ab76e0c7aec

SHA256
d75a43bfb03b0989ef9e2e5e1ddb4215dbe0c600c6e6cdf663abb8282b20c16a

SHA512
503affaa143a6a0c57ab189a95f45bb0d2c83aea44d5a6fb98dff6be0aa5b426faa1a31f4dc1c0e44ec8fcba3d97b1777dd3823e9f61ab37833e2ffc6afcbc82

Download Submit
C:\Windows\System\pYCjgPZ.exe

Filesize
1.9MB

MD5
2b4dc22a41c7458a2269ee7b7aea9eb0

SHA1
4690ac8307ad12f379903860f7d24b789a24686d

SHA256
44872958ab4b4b28ed78390a1a13adfc266228aef92bb26ac3ebb682d905c43a

SHA512
bc522458b82630c74e388b9fc3b3792159fa44f68d4f521730b141519b9087bde8309537bf29da19d850f399a9293bfb3d7ea5b97c5d06819d7dadc337b8aac1

Download Submit
C:\Windows\System\qmGGvND.exe

Filesize
1.9MB

MD5
8aba5ca20d679730f0d437670448fe44

SHA1
a83d7729686e45813d8c965912d6cb77f761638a

SHA256
8677c2f24a4fca8b6052859bd7faee233486e3d8c14189b51c80336d10ee0683

SHA512
c4f4a1bd1c3bc47b2bcac8ee9db16ca8359bbc5d5d03791e47bffdee09911682b71dc7302e71f197d7f9a4161a164aa3143ba29556eda2b18f61731b97c26b16

Download Submit
C:\Windows\System\strgOMR.exe

Filesize
1.9MB

MD5
6245dd2a0505196dd2fb6b9109878a6e

SHA1
743cdc404fe66d6d5515dbb938a4f621770d050f

SHA256
32c03e92d290b1ddedf9e9462da55ef4cf066b3c17551bb7f0dbddf7a749688d

SHA512
19354101958e6eb5d51002ec6de06a639d35ecb4b69de4ab914355804ffcf670a5ce3ca47afd87be73fcf1dad2a0686d320968baea493ad84d27d825ac36c2a4

Download Submit
C:\Windows\System\vOBoxwY.exe

Filesize
1.9MB

MD5
9b873a1d1b77c7edda50b0c42f8078f2

SHA1
945ae081ecb5fe49d35b1983840d980db26f30bf

SHA256
6fce0a23de22ed994f8f708e5a68582f3bb1c2d5a7f5f3b970612cd580af066f

SHA512
21628ba67b2c004c77237ba524406649d0deba61a3801a2bdf403702672da05979ff7bd3f7e106594b3bbdf7da581e796dd22981b26989c8085a1082c4eca3e3

Download Submit
C:\Windows\System\vrfbqMx.exe

Filesize
1.9MB

MD5
59a4564b5cccef1c6b11a188f4fdac90

SHA1
7188c2dd4b26c00e7879aff1718ff3751b8a83a6

SHA256
9af485bdefc916cc0b38aed766ff1d09471255332af162e060629fad29f71c45

SHA512
64b2bb3a16cd4861d6ca0b3d852b1926a5487ae082608766b8b9d40c81eaa258498c4b6ea5348949d96d4ced985ecb7ea6c5d7d90f6cd03f56a2960452b82d73

Download Submit
C:\Windows\System\vroaXMb.exe

Filesize
1.9MB

MD5
82ea3f3082772c295a288da2c8399368

SHA1
61dc8e78eff7dc0328944f150f0c0b102ac64fb2

SHA256
f7c354ecbeb4304bbfd1eca2174c89b8f846ba5123c777b8805052213b760f39

SHA512
8357dd815082f6e1fe35d29c6b4dd861ab6ec687e4d7a6d92a4663f03a6abf94e9825164190d9393b76423854773a3e4985995b624bd4f646c84c789a0d07731

Download Submit
C:\Windows\System\wVFLNhe.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\xjQplYo.exe

Filesize
1.9MB

MD5
cffaddd8103ae0aa65ca31cf69f625a0

SHA1
2cb261c5689423747931bf52e418a217c4f4cb5c

SHA256
3b007106a1fbe60dd630ebd17314d84786292cde2e245ca61a11123630e3de58

SHA512
7fc6ef3a39224a943faa6edfeb932c5c18885e82136de2d3ee6ff11a47a069533bda76aa585c97413777acde5432e97d79cb4bd2e04f1388562cbdb1e414848b

Download Submit
C:\Windows\System\xwsRxzr.exe

Filesize
1.9MB

MD5
98abb91429b6154b040a2e06c88e4fb3

SHA1
d606ababdd7ce2506b1ae1f59b7f8e4e742cbc06

SHA256
f9845a82f148c4018f83b271cf57d93603c9249dfab45fdf89e84364b661a162

SHA512
d62a64e79b6c69d22e396d0a92cc21d07ae3c8e811215cae5485468a4a5dc1b34bfea128eaaad2a952f7c55c30519dcad12a2a44cdc995b4e900ce074f398bca

Download Submit
C:\Windows\System\yaEbPQC.exe

Filesize
1.9MB

MD5
690e62212ea2f1d726d5ce62114fbbad

SHA1
49ff46f3df748c0c19dbb0b36e7d2d53a8ed2734

SHA256
b9ef24d6b3791b0426374767ba3108fe047b37a5c7b0adb82e438247e6073334

SHA512
b21b8d5187cf53cdf5c01c65f6a39ae8f28c15a7a9908fcfa970ad433b1d41636326997a678a6d28cb72cfcb3a2de4b7339eee80510f5b327357616fb4e2da59

Download Submit
C:\Windows\System\yiAtEkH.exe

Filesize
1.9MB

MD5
f25bfb3fe83a2dd67741c9066d47b3ff

SHA1
fe059bb765292ba6e921922dffbab2814c58676c

SHA256
207b93bfa070d326722194ebe4be9351cd7da12a33f76dc7fc19e1ac656446ce

SHA512
e7619afc1376d3af1851851b1cbcfc9140dea681bd9c2069b901e0d24015e9e3754bccfbf87f824ee654dc62a99122c28bc3a620e38aee5a45526f24e55db104

Download Submit
memory/848-239-0x00007FF681810000-0x00007FF681C02000-memory.dmp

Filesize
3.9MB

Download
memory/848-4715-0x00007FF681810000-0x00007FF681C02000-memory.dmp

Filesize
3.9MB

Download
memory/1444-4661-0x00007FF6ABD20000-0x00007FF6AC112000-memory.dmp

Filesize
3.9MB

Download
memory/1444-364-0x00007FF6ABD20000-0x00007FF6AC112000-memory.dmp

Filesize
3.9MB

Download
memory/1656-181-0x000001CE6D060000-0x000001CE6D082000-memory.dmp

Filesize
136KB

Download
memory/1656-102-0x00007FF816410000-0x00007FF816ED1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-291-0x00007FF816410000-0x00007FF816ED1000-memory.dmp

Filesize
10.8MB

Download
memory/1656-19-0x00007FF816413000-0x00007FF816415000-memory.dmp

Filesize
8KB

Download
memory/1688-4732-0x00007FF7AEEA0000-0x00007FF7AF292000-memory.dmp

Filesize
3.9MB

Download
memory/1688-242-0x00007FF7AEEA0000-0x00007FF7AF292000-memory.dmp

Filesize
3.9MB

Download
memory/1704-370-0x00007FF67DDC0000-0x00007FF67E1B2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-4774-0x00007FF67DDC0000-0x00007FF67E1B2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-246-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp

Filesize
3.9MB

Download
memory/2480-4712-0x00007FF7C2550000-0x00007FF7C2942000-memory.dmp

Filesize
3.9MB

Download
memory/2516-244-0x00007FF6922A0000-0x00007FF692692000-memory.dmp

Filesize
3.9MB

Download
memory/2516-4708-0x00007FF6922A0000-0x00007FF692692000-memory.dmp

Filesize
3.9MB

Download
memory/2564-4676-0x00007FF681E40000-0x00007FF682232000-memory.dmp

Filesize
3.9MB

Download
memory/2564-202-0x00007FF681E40000-0x00007FF682232000-memory.dmp

Filesize
3.9MB

Download
memory/2592-4701-0x00007FF6AE8E0000-0x00007FF6AECD2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-240-0x00007FF6AE8E0000-0x00007FF6AECD2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-4695-0x00007FF7964E0000-0x00007FF7968D2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-234-0x00007FF7964E0000-0x00007FF7968D2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-4717-0x00007FF7D0DF0000-0x00007FF7D11E2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-243-0x00007FF7D0DF0000-0x00007FF7D11E2000-memory.dmp

Filesize
3.9MB

Download
memory/3188-4681-0x00007FF708900000-0x00007FF708CF2000-memory.dmp

Filesize
3.9MB

Download
memory/3188-236-0x00007FF708900000-0x00007FF708CF2000-memory.dmp

Filesize
3.9MB

Download
memory/3208-18-0x00007FF7B66E0000-0x00007FF7B6AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3276-231-0x00007FF636460000-0x00007FF636852000-memory.dmp

Filesize
3.9MB

Download
memory/3276-4706-0x00007FF636460000-0x00007FF636852000-memory.dmp

Filesize
3.9MB

Download
memory/3492-233-0x00007FF681DC0000-0x00007FF6821B2000-memory.dmp

Filesize
3.9MB

Download
memory/3492-4690-0x00007FF681DC0000-0x00007FF6821B2000-memory.dmp

Filesize
3.9MB

Download
memory/3568-245-0x00007FF728480000-0x00007FF728872000-memory.dmp

Filesize
3.9MB

Download
memory/3568-4720-0x00007FF728480000-0x00007FF728872000-memory.dmp

Filesize
3.9MB

Download
memory/3632-365-0x00007FF6E1660000-0x00007FF6E1A52000-memory.dmp

Filesize
3.9MB

Download
memory/4084-4665-0x00007FF77B160000-0x00007FF77B552000-memory.dmp

Filesize
3.9MB

Download
memory/4084-237-0x00007FF77B160000-0x00007FF77B552000-memory.dmp

Filesize
3.9MB

Download
memory/4104-4670-0x00007FF6AE4D0000-0x00007FF6AE8C2000-memory.dmp

Filesize
3.9MB

Download
memory/4104-145-0x00007FF6AE4D0000-0x00007FF6AE8C2000-memory.dmp

Filesize
3.9MB

Download
memory/4312-197-0x00007FF7F3BC0000-0x00007FF7F3FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4316-232-0x00007FF661870000-0x00007FF661C62000-memory.dmp

Filesize
3.9MB

Download
memory/4316-4693-0x00007FF661870000-0x00007FF661C62000-memory.dmp

Filesize
3.9MB

Download
memory/4340-230-0x00007FF7A0DB0000-0x00007FF7A11A2000-memory.dmp

Filesize
3.9MB

Download
memory/4340-4659-0x00007FF7A0DB0000-0x00007FF7A11A2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-235-0x00007FF655460000-0x00007FF655852000-memory.dmp

Filesize
3.9MB

Download
memory/4588-4678-0x00007FF655460000-0x00007FF655852000-memory.dmp

Filesize
3.9MB

Download
memory/4924-4734-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp

Filesize
3.9MB

Download
memory/4924-241-0x00007FF6EEC20000-0x00007FF6EF012000-memory.dmp

Filesize
3.9MB

Download
memory/4992-0-0x00007FF62EB30000-0x00007FF62EF22000-memory.dmp

Filesize
3.9MB

Download
memory/4992-1-0x000001D322450000-0x000001D322460000-memory.dmp

Filesize
64KB

Download
memory/5004-4729-0x00007FF7B11A0000-0x00007FF7B1592000-memory.dmp

Filesize
3.9MB

Download
memory/5004-238-0x00007FF7B11A0000-0x00007FF7B1592000-memory.dmp

Filesize
3.9MB

Download