xmrig | 1dd3d9deeeb32235e4e797df605e661c56bfb17bcfb213f447839dd93456822f

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
Size

3.6MB
MD5

0f9299bb3ce988bf0e29b140ac2901f0
SHA1

f1532bb9a2febfed93e89c2b0d0e459d2cb44027
SHA256

1dd3d9deeeb32235e4e797df605e661c56bfb17bcfb213f447839dd93456822f
SHA512

01e262e55ad883296f4c93cdba8ac606c75384bd06d12f9fea3fabbfe9e2ef343d423439805babd2667eb6973c6b063bb27c2248c3e0b83dc95118f072ef011c
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:7bBeSFkh

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 53 IoCs

miner

resource	yara_rule
behavioral1/memory/2856-1-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	xmrig
behavioral1/files/0x000b00000001267a-6.dat	xmrig
behavioral1/files/0x002b000000012721-15.dat	xmrig
behavioral1/memory/2356-18-0x000000013FD60000-0x0000000140156000-memory.dmp	xmrig
behavioral1/memory/1296-19-0x000000013FCC0000-0x00000001400B6000-memory.dmp	xmrig
behavioral1/files/0x000e0000000054ab-21.dat	xmrig
behavioral1/files/0x000900000001322b-29.dat	xmrig
behavioral1/files/0x000800000001332e-30.dat	xmrig
behavioral1/files/0x000900000001341c-58.dat	xmrig
behavioral1/memory/2856-53-0x0000000003540000-0x0000000003936000-memory.dmp	xmrig
behavioral1/files/0x000800000001340b-50.dat	xmrig
behavioral1/memory/2680-49-0x000000013F260000-0x000000013F656000-memory.dmp	xmrig
behavioral1/files/0x0006000000014246-70.dat	xmrig
behavioral1/files/0x0006000000014312-76.dat	xmrig
behavioral1/files/0x0006000000014326-80.dat	xmrig
behavioral1/memory/2488-88-0x000000013FED0000-0x00000001402C6000-memory.dmp	xmrig
behavioral1/files/0x0006000000014358-93.dat	xmrig
behavioral1/memory/2856-101-0x000000013F460000-0x000000013F856000-memory.dmp	xmrig
behavioral1/files/0x00060000000146fc-146.dat	xmrig
behavioral1/files/0x0006000000014a9a-171.dat	xmrig
behavioral1/files/0x0006000000014b18-176.dat	xmrig
behavioral1/files/0x0006000000014fa2-197.dat	xmrig
behavioral1/memory/2856-3045-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	xmrig
behavioral1/memory/2856-3845-0x000000013FED0000-0x00000001402C6000-memory.dmp	xmrig
behavioral1/memory/2656-6300-0x000000013FA10000-0x000000013FE06000-memory.dmp	xmrig
behavioral1/memory/2712-6339-0x000000013F240000-0x000000013F636000-memory.dmp	xmrig
behavioral1/files/0x0006000000014bbc-194.dat	xmrig
behavioral1/files/0x0006000000014e71-190.dat	xmrig
behavioral1/files/0x0006000000014b4c-181.dat	xmrig
behavioral1/files/0x000600000001487f-167.dat	xmrig
behavioral1/files/0x000600000001471a-156.dat	xmrig
behavioral1/files/0x0006000000014826-161.dat	xmrig
behavioral1/files/0x0006000000014712-151.dat	xmrig
behavioral1/files/0x00060000000146f4-141.dat	xmrig
behavioral1/files/0x000600000001469d-136.dat	xmrig
behavioral1/files/0x000600000001458c-127.dat	xmrig
behavioral1/files/0x0006000000014597-131.dat	xmrig
behavioral1/files/0x00060000000144e8-120.dat	xmrig
behavioral1/files/0x00060000000144e8-118.dat	xmrig
behavioral1/files/0x000600000001443b-115.dat	xmrig
behavioral1/files/0x00060000000143e5-107.dat	xmrig
behavioral1/files/0x002b000000012747-110.dat	xmrig
behavioral1/memory/2856-103-0x0000000003540000-0x0000000003936000-memory.dmp	xmrig
behavioral1/memory/2576-91-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	xmrig
behavioral1/memory/2632-102-0x000000013F460000-0x000000013F856000-memory.dmp	xmrig
behavioral1/memory/2500-100-0x000000013FC90000-0x0000000140086000-memory.dmp	xmrig
behavioral1/memory/2880-97-0x000000013F180000-0x000000013F576000-memory.dmp	xmrig
behavioral1/memory/2452-90-0x000000013F490000-0x000000013F886000-memory.dmp	xmrig
behavioral1/files/0x0006000000014228-66.dat	xmrig
behavioral1/memory/2712-61-0x000000013F240000-0x000000013F636000-memory.dmp	xmrig
behavioral1/memory/2076-57-0x000000013F960000-0x000000013FD56000-memory.dmp	xmrig
behavioral1/files/0x000a000000013413-48.dat	xmrig
behavioral1/memory/2656-42-0x000000013FA10000-0x000000013FE06000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2356	aQoStdh.exe
1296	BrRKzcy.exe
2656	PpMwkaB.exe
2680	QhSchfA.exe
2076	tmywhqX.exe
2712	sokIYqI.exe
2488	ltoogbv.exe
2452	sAtYElo.exe
2576	oRQLNak.exe
2880	kJeAiuR.exe
2500	lYjqOra.exe
2632	YDoEStz.exe
1156	ZlIadZL.exe
1436	cLBnund.exe
1828	wJVplsq.exe
1896	OhRQOVU.exe
852	CQoYUZE.exe
1820	FoyVTRR.exe
2544	cuGYCpm.exe
2072	XvosbRr.exe
1620	KLnqoGl.exe
1764	nNPnIDx.exe
2100	LgkYyTw.exe
2068	OJEPDGY.exe
1392	VWySBJj.exe
1648	JaPMAfw.exe
984	BsPHvvL.exe
2312	gPAUjbd.exe
844	mEMyWZx.exe
2132	HBGETAW.exe
2028	WyaPTZM.exe
1340	HmmkbbI.exe
1852	RkGSNgo.exe
1640	uiXBrRB.exe
1664	IcCrsPB.exe
704	IzYGFJV.exe
1076	XscmxLL.exe
3060	dnLoDmz.exe
932	QfNdyCe.exe
1696	tFEkKRv.exe
2988	XzIjuFv.exe
2304	aKEYGWk.exe
1904	jxNUSDd.exe
288	vzzCeEt.exe
1508	yMiiUvL.exe
1120	qJjhEcj.exe
2364	SrcRMxA.exe
2836	WtBLuqa.exe
2960	qyMjtXt.exe
2324	eYxGLWw.exe
1724	NvYzQCv.exe
2612	dUyRPvh.exe
2616	XplPFqb.exe
2464	LIKXEVi.exe
300	lnPRSOI.exe
2020	LWXGrvW.exe
2372	QYyecWP.exe
2884	VBFNYZl.exe
2740	QWyiyFf.exe
3048	RZNWfIM.exe
2016	hyZoMoC.exe
1680	txcoBXb.exe
2420	OALrnzV.exe
2116	vfDGrkF.exe

Loads dropped DLL 64 IoCs

pid	Process
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2856-1-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	upx
behavioral1/files/0x000b00000001267a-6.dat	upx
behavioral1/files/0x002b000000012721-15.dat	upx
behavioral1/memory/2356-18-0x000000013FD60000-0x0000000140156000-memory.dmp	upx
behavioral1/memory/1296-19-0x000000013FCC0000-0x00000001400B6000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-21.dat	upx
behavioral1/files/0x000900000001322b-29.dat	upx
behavioral1/files/0x000800000001332e-30.dat	upx
behavioral1/files/0x000900000001341c-58.dat	upx
behavioral1/files/0x000800000001340b-50.dat	upx
behavioral1/memory/2680-49-0x000000013F260000-0x000000013F656000-memory.dmp	upx
behavioral1/files/0x0006000000014246-70.dat	upx
behavioral1/files/0x0006000000014312-76.dat	upx
behavioral1/files/0x0006000000014326-80.dat	upx
behavioral1/memory/2488-88-0x000000013FED0000-0x00000001402C6000-memory.dmp	upx
behavioral1/files/0x0006000000014358-93.dat	upx
behavioral1/files/0x00060000000146fc-146.dat	upx
behavioral1/files/0x0006000000014a9a-171.dat	upx
behavioral1/files/0x0006000000014b18-176.dat	upx
behavioral1/files/0x0006000000014fa2-197.dat	upx
behavioral1/memory/2856-3045-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	upx
behavioral1/memory/2656-6300-0x000000013FA10000-0x000000013FE06000-memory.dmp	upx
behavioral1/memory/2712-6339-0x000000013F240000-0x000000013F636000-memory.dmp	upx
behavioral1/files/0x0006000000014bbc-194.dat	upx
behavioral1/files/0x0006000000014e71-190.dat	upx
behavioral1/files/0x0006000000014b4c-181.dat	upx
behavioral1/files/0x000600000001487f-167.dat	upx
behavioral1/files/0x000600000001471a-156.dat	upx
behavioral1/files/0x0006000000014826-161.dat	upx
behavioral1/files/0x0006000000014712-151.dat	upx
behavioral1/files/0x00060000000146f4-141.dat	upx
behavioral1/files/0x000600000001469d-136.dat	upx
behavioral1/files/0x000600000001458c-127.dat	upx
behavioral1/files/0x0006000000014597-131.dat	upx
behavioral1/files/0x00060000000144e8-120.dat	upx
behavioral1/files/0x00060000000144e8-118.dat	upx
behavioral1/files/0x000600000001443b-115.dat	upx
behavioral1/files/0x00060000000143e5-107.dat	upx
behavioral1/files/0x002b000000012747-110.dat	upx
behavioral1/memory/2576-91-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	upx
behavioral1/memory/2632-102-0x000000013F460000-0x000000013F856000-memory.dmp	upx
behavioral1/memory/2500-100-0x000000013FC90000-0x0000000140086000-memory.dmp	upx
behavioral1/memory/2880-97-0x000000013F180000-0x000000013F576000-memory.dmp	upx
behavioral1/memory/2452-90-0x000000013F490000-0x000000013F886000-memory.dmp	upx
behavioral1/files/0x0006000000014228-66.dat	upx
behavioral1/memory/2712-61-0x000000013F240000-0x000000013F636000-memory.dmp	upx
behavioral1/memory/2076-57-0x000000013F960000-0x000000013FD56000-memory.dmp	upx
behavioral1/files/0x000a000000013413-48.dat	upx
behavioral1/memory/2656-42-0x000000013FA10000-0x000000013FE06000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ryNOUxN.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\VTTAJsf.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\tHvVAHe.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\BSLHgmU.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\iVjqhhs.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\aKBKPKo.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\oXETeEc.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\yYmuJbq.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\zqlNyDp.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\xwxtCbS.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\gKsfVxa.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\iLbwpVf.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\lpFpZkI.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\oLoKHXy.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\KyxrwSm.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\BnuuVjN.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\dXNIRKI.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\zbYSuwD.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\dTaDWsJ.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\ifMSfxi.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\yPpeFLN.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\uZTWDNr.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\hGhNSjD.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\tKfILJu.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\EXPjWsr.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\MGmWlzc.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\RXziniK.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\cvabukd.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\NVNzxFB.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\rLIoZpo.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\oUSgfRg.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\JMmyfDO.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\LJHkkzl.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\mDBYeIZ.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\ccHDzQo.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\KMMBUeK.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\MlKlJLT.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\BeBZugo.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\FbanzuX.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\SeuAsGl.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\ySykqjT.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\LxDlWTi.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\neDhffC.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\sMxqIHY.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\oStlFlK.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\WftrHcy.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\psGrBMk.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\BBDlSBv.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\FKNaPlx.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\zExAzPE.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\BjhipdO.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\SpcPmgq.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\oqifdeZ.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZmvnpgL.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\PlplTuZ.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\oCqpUtv.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\wjQXLjR.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\VBFNYZl.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\EWzzzxi.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\jpjUtNY.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\ReqlnSd.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\JOURfhc.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\HNtsRVS.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\hrofKaD.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2332	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2332	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2332	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 2332	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 2332	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	29
PID 2856 wrote to memory of 2356	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	30
PID 2856 wrote to memory of 2356	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	30
PID 2856 wrote to memory of 2356	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	30
PID 2856 wrote to memory of 1296	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 1296	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 1296	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	31
PID 2856 wrote to memory of 2656	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	32
PID 2856 wrote to memory of 2656	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	32
PID 2856 wrote to memory of 2656	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	32
PID 2856 wrote to memory of 2680	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	33
PID 2856 wrote to memory of 2680	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	33
PID 2856 wrote to memory of 2680	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	33
PID 2856 wrote to memory of 2076	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	34
PID 2856 wrote to memory of 2076	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	34
PID 2856 wrote to memory of 2076	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	34
PID 2856 wrote to memory of 2488	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	35
PID 2856 wrote to memory of 2488	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	35
PID 2856 wrote to memory of 2488	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	35
PID 2856 wrote to memory of 2712	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	36
PID 2856 wrote to memory of 2712	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	36
PID 2856 wrote to memory of 2712	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	36
PID 2856 wrote to memory of 2452	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	37
PID 2856 wrote to memory of 2452	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	37
PID 2856 wrote to memory of 2452	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	37
PID 2856 wrote to memory of 2576	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	38
PID 2856 wrote to memory of 2576	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	38
PID 2856 wrote to memory of 2576	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	38
PID 2856 wrote to memory of 2880	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	39
PID 2856 wrote to memory of 2880	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	39
PID 2856 wrote to memory of 2880	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	39
PID 2856 wrote to memory of 2500	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	40
PID 2856 wrote to memory of 2500	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	40
PID 2856 wrote to memory of 2500	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	40
PID 2856 wrote to memory of 2632	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	41
PID 2856 wrote to memory of 2632	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	41
PID 2856 wrote to memory of 2632	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	41
PID 2856 wrote to memory of 1156	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	42
PID 2856 wrote to memory of 1156	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	42
PID 2856 wrote to memory of 1156	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	42
PID 2856 wrote to memory of 1436	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	43
PID 2856 wrote to memory of 1436	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	43
PID 2856 wrote to memory of 1436	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	43
PID 2856 wrote to memory of 1828	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	44
PID 2856 wrote to memory of 1828	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	44
PID 2856 wrote to memory of 1828	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	44
PID 2856 wrote to memory of 1896	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	45
PID 2856 wrote to memory of 1896	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	45
PID 2856 wrote to memory of 1896	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	45
PID 2856 wrote to memory of 852	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	46
PID 2856 wrote to memory of 852	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	46
PID 2856 wrote to memory of 852	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	46
PID 2856 wrote to memory of 1820	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	47
PID 2856 wrote to memory of 1820	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	47
PID 2856 wrote to memory of 1820	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	47
PID 2856 wrote to memory of 2544	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	48
PID 2856 wrote to memory of 2544	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	48
PID 2856 wrote to memory of 2544	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	48
PID 2856 wrote to memory of 2072	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	49
PID 2856 wrote to memory of 2072	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	49
PID 2856 wrote to memory of 2072	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	49
PID 2856 wrote to memory of 1620	2856	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\System\aQoStdh.exe
  C:\Windows\System\aQoStdh.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\BrRKzcy.exe
  C:\Windows\System\BrRKzcy.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\PpMwkaB.exe
  C:\Windows\System\PpMwkaB.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\QhSchfA.exe
  C:\Windows\System\QhSchfA.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\tmywhqX.exe
  C:\Windows\System\tmywhqX.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\ltoogbv.exe
  C:\Windows\System\ltoogbv.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\sokIYqI.exe
  C:\Windows\System\sokIYqI.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\sAtYElo.exe
  C:\Windows\System\sAtYElo.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\oRQLNak.exe
  C:\Windows\System\oRQLNak.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\kJeAiuR.exe
  C:\Windows\System\kJeAiuR.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\lYjqOra.exe
  C:\Windows\System\lYjqOra.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\YDoEStz.exe
  C:\Windows\System\YDoEStz.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\ZlIadZL.exe
  C:\Windows\System\ZlIadZL.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\cLBnund.exe
  C:\Windows\System\cLBnund.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\wJVplsq.exe
  C:\Windows\System\wJVplsq.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\OhRQOVU.exe
  C:\Windows\System\OhRQOVU.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\CQoYUZE.exe
  C:\Windows\System\CQoYUZE.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\FoyVTRR.exe
  C:\Windows\System\FoyVTRR.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\cuGYCpm.exe
  C:\Windows\System\cuGYCpm.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\XvosbRr.exe
  C:\Windows\System\XvosbRr.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\KLnqoGl.exe
  C:\Windows\System\KLnqoGl.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\nNPnIDx.exe
  C:\Windows\System\nNPnIDx.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\LgkYyTw.exe
  C:\Windows\System\LgkYyTw.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\OJEPDGY.exe
  C:\Windows\System\OJEPDGY.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\VWySBJj.exe
  C:\Windows\System\VWySBJj.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\JaPMAfw.exe
  C:\Windows\System\JaPMAfw.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\BsPHvvL.exe
  C:\Windows\System\BsPHvvL.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\gPAUjbd.exe
  C:\Windows\System\gPAUjbd.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\mEMyWZx.exe
  C:\Windows\System\mEMyWZx.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\WyaPTZM.exe
  C:\Windows\System\WyaPTZM.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\HBGETAW.exe
  C:\Windows\System\HBGETAW.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\HmmkbbI.exe
  C:\Windows\System\HmmkbbI.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\RkGSNgo.exe
  C:\Windows\System\RkGSNgo.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\XscmxLL.exe
  C:\Windows\System\XscmxLL.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\uiXBrRB.exe
  C:\Windows\System\uiXBrRB.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\dnLoDmz.exe
  C:\Windows\System\dnLoDmz.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\IcCrsPB.exe
  C:\Windows\System\IcCrsPB.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\QfNdyCe.exe
  C:\Windows\System\QfNdyCe.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\IzYGFJV.exe
  C:\Windows\System\IzYGFJV.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\tFEkKRv.exe
  C:\Windows\System\tFEkKRv.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\XzIjuFv.exe
  C:\Windows\System\XzIjuFv.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\aKEYGWk.exe
  C:\Windows\System\aKEYGWk.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\jxNUSDd.exe
  C:\Windows\System\jxNUSDd.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\vzzCeEt.exe
  C:\Windows\System\vzzCeEt.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\yMiiUvL.exe
  C:\Windows\System\yMiiUvL.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\qJjhEcj.exe
  C:\Windows\System\qJjhEcj.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\SrcRMxA.exe
  C:\Windows\System\SrcRMxA.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\eYxGLWw.exe
  C:\Windows\System\eYxGLWw.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\WtBLuqa.exe
  C:\Windows\System\WtBLuqa.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\NvYzQCv.exe
  C:\Windows\System\NvYzQCv.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\qyMjtXt.exe
  C:\Windows\System\qyMjtXt.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\dUyRPvh.exe
  C:\Windows\System\dUyRPvh.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\XplPFqb.exe
  C:\Windows\System\XplPFqb.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\LIKXEVi.exe
  C:\Windows\System\LIKXEVi.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\lnPRSOI.exe
  C:\Windows\System\lnPRSOI.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\VBFNYZl.exe
  C:\Windows\System\VBFNYZl.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\LWXGrvW.exe
  C:\Windows\System\LWXGrvW.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\QWyiyFf.exe
  C:\Windows\System\QWyiyFf.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\QYyecWP.exe
  C:\Windows\System\QYyecWP.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\RZNWfIM.exe
  C:\Windows\System\RZNWfIM.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\hyZoMoC.exe
  C:\Windows\System\hyZoMoC.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\OALrnzV.exe
  C:\Windows\System\OALrnzV.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\txcoBXb.exe
  C:\Windows\System\txcoBXb.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\lULVewl.exe
  C:\Windows\System\lULVewl.exe
  2⤵
  PID:1576
- C:\Windows\System\vfDGrkF.exe
  C:\Windows\System\vfDGrkF.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\nqpHDPP.exe
  C:\Windows\System\nqpHDPP.exe
  2⤵
  PID:2812
- C:\Windows\System\jYrZZGF.exe
  C:\Windows\System\jYrZZGF.exe
  2⤵
  PID:2044
- C:\Windows\System\nCDUdWr.exe
  C:\Windows\System\nCDUdWr.exe
  2⤵
  PID:1472
- C:\Windows\System\MjTcRoC.exe
  C:\Windows\System\MjTcRoC.exe
  2⤵
  PID:3016
- C:\Windows\System\GpUdJbL.exe
  C:\Windows\System\GpUdJbL.exe
  2⤵
  PID:1804
- C:\Windows\System\uAGXLwy.exe
  C:\Windows\System\uAGXLwy.exe
  2⤵
  PID:1608
- C:\Windows\System\kyvCKAN.exe
  C:\Windows\System\kyvCKAN.exe
  2⤵
  PID:912
- C:\Windows\System\pibwgOz.exe
  C:\Windows\System\pibwgOz.exe
  2⤵
  PID:1772
- C:\Windows\System\TuZFLYA.exe
  C:\Windows\System\TuZFLYA.exe
  2⤵
  PID:2152
- C:\Windows\System\pygoRTf.exe
  C:\Windows\System\pygoRTf.exe
  2⤵
  PID:1500
- C:\Windows\System\WmhHyvI.exe
  C:\Windows\System\WmhHyvI.exe
  2⤵
  PID:1692
- C:\Windows\System\oFeKaOa.exe
  C:\Windows\System\oFeKaOa.exe
  2⤵
  PID:992
- C:\Windows\System\cngYTnD.exe
  C:\Windows\System\cngYTnD.exe
  2⤵
  PID:892
- C:\Windows\System\AwwjHxh.exe
  C:\Windows\System\AwwjHxh.exe
  2⤵
  PID:2536
- C:\Windows\System\kFXZQWA.exe
  C:\Windows\System\kFXZQWA.exe
  2⤵
  PID:2400
- C:\Windows\System\qZfNoWm.exe
  C:\Windows\System\qZfNoWm.exe
  2⤵
  PID:2476
- C:\Windows\System\hMFsCCf.exe
  C:\Windows\System\hMFsCCf.exe
  2⤵
  PID:1228
- C:\Windows\System\DxJFqpx.exe
  C:\Windows\System\DxJFqpx.exe
  2⤵
  PID:1872
- C:\Windows\System\nTULDoi.exe
  C:\Windows\System\nTULDoi.exe
  2⤵
  PID:2876
- C:\Windows\System\qNVKbNv.exe
  C:\Windows\System\qNVKbNv.exe
  2⤵
  PID:2752
- C:\Windows\System\giDMvdb.exe
  C:\Windows\System\giDMvdb.exe
  2⤵
  PID:1980
- C:\Windows\System\qbuFQHO.exe
  C:\Windows\System\qbuFQHO.exe
  2⤵
  PID:2824
- C:\Windows\System\QNrytYt.exe
  C:\Windows\System\QNrytYt.exe
  2⤵
  PID:2892
- C:\Windows\System\eJOFwlu.exe
  C:\Windows\System\eJOFwlu.exe
  2⤵
  PID:2000
- C:\Windows\System\nNBTLUl.exe
  C:\Windows\System\nNBTLUl.exe
  2⤵
  PID:1756
- C:\Windows\System\oiPPmaj.exe
  C:\Windows\System\oiPPmaj.exe
  2⤵
  PID:1236
- C:\Windows\System\OYKISAt.exe
  C:\Windows\System\OYKISAt.exe
  2⤵
  PID:1528
- C:\Windows\System\uyVILXl.exe
  C:\Windows\System\uyVILXl.exe
  2⤵
  PID:2124
- C:\Windows\System\rJZZGJB.exe
  C:\Windows\System\rJZZGJB.exe
  2⤵
  PID:2156
- C:\Windows\System\WuIHfjk.exe
  C:\Windows\System\WuIHfjk.exe
  2⤵
  PID:1748
- C:\Windows\System\CKtxEqY.exe
  C:\Windows\System\CKtxEqY.exe
  2⤵
  PID:2992
- C:\Windows\System\fcbiOFD.exe
  C:\Windows\System\fcbiOFD.exe
  2⤵
  PID:1860
- C:\Windows\System\gJjwoRz.exe
  C:\Windows\System\gJjwoRz.exe
  2⤵
  PID:2280
- C:\Windows\System\QjFKPAd.exe
  C:\Windows\System\QjFKPAd.exe
  2⤵
  PID:1596
- C:\Windows\System\BNPbMvs.exe
  C:\Windows\System\BNPbMvs.exe
  2⤵
  PID:1600
- C:\Windows\System\TFnlZyR.exe
  C:\Windows\System\TFnlZyR.exe
  2⤵
  PID:2660
- C:\Windows\System\zLftAgR.exe
  C:\Windows\System\zLftAgR.exe
  2⤵
  PID:2784
- C:\Windows\System\qZFjwPw.exe
  C:\Windows\System\qZFjwPw.exe
  2⤵
  PID:1676
- C:\Windows\System\jJQqXnU.exe
  C:\Windows\System\jJQqXnU.exe
  2⤵
  PID:2496
- C:\Windows\System\feeOdRu.exe
  C:\Windows\System\feeOdRu.exe
  2⤵
  PID:2136
- C:\Windows\System\RyMPVMd.exe
  C:\Windows\System\RyMPVMd.exe
  2⤵
  PID:3008
- C:\Windows\System\Hnbcmfw.exe
  C:\Windows\System\Hnbcmfw.exe
  2⤵
  PID:1332
- C:\Windows\System\khMqaSj.exe
  C:\Windows\System\khMqaSj.exe
  2⤵
  PID:2424
- C:\Windows\System\uqDWfiJ.exe
  C:\Windows\System\uqDWfiJ.exe
  2⤵
  PID:1924
- C:\Windows\System\WYxsAVV.exe
  C:\Windows\System\WYxsAVV.exe
  2⤵
  PID:3088
- C:\Windows\System\qzYLcQy.exe
  C:\Windows\System\qzYLcQy.exe
  2⤵
  PID:3112
- C:\Windows\System\AfDtFoK.exe
  C:\Windows\System\AfDtFoK.exe
  2⤵
  PID:3132
- C:\Windows\System\LTigpEb.exe
  C:\Windows\System\LTigpEb.exe
  2⤵
  PID:3152
- C:\Windows\System\MRFuXLM.exe
  C:\Windows\System\MRFuXLM.exe
  2⤵
  PID:3168
- C:\Windows\System\EbSsrXn.exe
  C:\Windows\System\EbSsrXn.exe
  2⤵
  PID:3188
- C:\Windows\System\mYznNwr.exe
  C:\Windows\System\mYznNwr.exe
  2⤵
  PID:3204
- C:\Windows\System\TDgCmOT.exe
  C:\Windows\System\TDgCmOT.exe
  2⤵
  PID:3228
- C:\Windows\System\eeEIkQP.exe
  C:\Windows\System\eeEIkQP.exe
  2⤵
  PID:3244
- C:\Windows\System\DwETMzy.exe
  C:\Windows\System\DwETMzy.exe
  2⤵
  PID:3264
- C:\Windows\System\hSXouFe.exe
  C:\Windows\System\hSXouFe.exe
  2⤵
  PID:3280
- C:\Windows\System\PQaPFuJ.exe
  C:\Windows\System\PQaPFuJ.exe
  2⤵
  PID:3296
- C:\Windows\System\uYVLSbV.exe
  C:\Windows\System\uYVLSbV.exe
  2⤵
  PID:3336
- C:\Windows\System\DNvtxFw.exe
  C:\Windows\System\DNvtxFw.exe
  2⤵
  PID:3360
- C:\Windows\System\HKSjeNx.exe
  C:\Windows\System\HKSjeNx.exe
  2⤵
  PID:3380
- C:\Windows\System\LVUBUSe.exe
  C:\Windows\System\LVUBUSe.exe
  2⤵
  PID:3396
- C:\Windows\System\iBqHmTi.exe
  C:\Windows\System\iBqHmTi.exe
  2⤵
  PID:3412
- C:\Windows\System\eTgOSkT.exe
  C:\Windows\System\eTgOSkT.exe
  2⤵
  PID:3440
- C:\Windows\System\EoLgMHC.exe
  C:\Windows\System\EoLgMHC.exe
  2⤵
  PID:3460
- C:\Windows\System\OIplifu.exe
  C:\Windows\System\OIplifu.exe
  2⤵
  PID:3476
- C:\Windows\System\dgqNUlz.exe
  C:\Windows\System\dgqNUlz.exe
  2⤵
  PID:3492
- C:\Windows\System\arIPkrk.exe
  C:\Windows\System\arIPkrk.exe
  2⤵
  PID:3512
- C:\Windows\System\wkEnNsf.exe
  C:\Windows\System\wkEnNsf.exe
  2⤵
  PID:3528
- C:\Windows\System\jMVdIUD.exe
  C:\Windows\System\jMVdIUD.exe
  2⤵
  PID:3548
- C:\Windows\System\GmsNdGc.exe
  C:\Windows\System\GmsNdGc.exe
  2⤵
  PID:3564
- C:\Windows\System\LCupaaq.exe
  C:\Windows\System\LCupaaq.exe
  2⤵
  PID:3604
- C:\Windows\System\YMBMeCp.exe
  C:\Windows\System\YMBMeCp.exe
  2⤵
  PID:3620
- C:\Windows\System\kwZdcuQ.exe
  C:\Windows\System\kwZdcuQ.exe
  2⤵
  PID:3640
- C:\Windows\System\ydhKrnm.exe
  C:\Windows\System\ydhKrnm.exe
  2⤵
  PID:3656
- C:\Windows\System\usvvtcA.exe
  C:\Windows\System\usvvtcA.exe
  2⤵
  PID:3676
- C:\Windows\System\XTtMyBS.exe
  C:\Windows\System\XTtMyBS.exe
  2⤵
  PID:3692
- C:\Windows\System\OQhyEAk.exe
  C:\Windows\System\OQhyEAk.exe
  2⤵
  PID:3708
- C:\Windows\System\LZWkLMW.exe
  C:\Windows\System\LZWkLMW.exe
  2⤵
  PID:3728
- C:\Windows\System\uZVscae.exe
  C:\Windows\System\uZVscae.exe
  2⤵
  PID:3748
- C:\Windows\System\KXmWXcY.exe
  C:\Windows\System\KXmWXcY.exe
  2⤵
  PID:3764
- C:\Windows\System\NjeJpeK.exe
  C:\Windows\System\NjeJpeK.exe
  2⤵
  PID:3784
- C:\Windows\System\FUQDMac.exe
  C:\Windows\System\FUQDMac.exe
  2⤵
  PID:3808
- C:\Windows\System\DIuqTkr.exe
  C:\Windows\System\DIuqTkr.exe
  2⤵
  PID:3852
- C:\Windows\System\OAzkemT.exe
  C:\Windows\System\OAzkemT.exe
  2⤵
  PID:3872
- C:\Windows\System\ujIPdyQ.exe
  C:\Windows\System\ujIPdyQ.exe
  2⤵
  PID:3892
- C:\Windows\System\YhyxFiC.exe
  C:\Windows\System\YhyxFiC.exe
  2⤵
  PID:3908
- C:\Windows\System\HODdKIl.exe
  C:\Windows\System\HODdKIl.exe
  2⤵
  PID:3924
- C:\Windows\System\SpIGCIO.exe
  C:\Windows\System\SpIGCIO.exe
  2⤵
  PID:3952
- C:\Windows\System\GqAnmEZ.exe
  C:\Windows\System\GqAnmEZ.exe
  2⤵
  PID:3972
- C:\Windows\System\RIcToqR.exe
  C:\Windows\System\RIcToqR.exe
  2⤵
  PID:3992
- C:\Windows\System\bnRQYfJ.exe
  C:\Windows\System\bnRQYfJ.exe
  2⤵
  PID:4008
- C:\Windows\System\PMnvFgD.exe
  C:\Windows\System\PMnvFgD.exe
  2⤵
  PID:4024
- C:\Windows\System\HHiJTIE.exe
  C:\Windows\System\HHiJTIE.exe
  2⤵
  PID:4044
- C:\Windows\System\elsTKUX.exe
  C:\Windows\System\elsTKUX.exe
  2⤵
  PID:4064
- C:\Windows\System\IIilryL.exe
  C:\Windows\System\IIilryL.exe
  2⤵
  PID:4092
- C:\Windows\System\tKpCrWY.exe
  C:\Windows\System\tKpCrWY.exe
  2⤵
  PID:2956
- C:\Windows\System\ANvJXFP.exe
  C:\Windows\System\ANvJXFP.exe
  2⤵
  PID:840
- C:\Windows\System\EsLysVP.exe
  C:\Windows\System\EsLysVP.exe
  2⤵
  PID:2248
- C:\Windows\System\ykQAlAs.exe
  C:\Windows\System\ykQAlAs.exe
  2⤵
  PID:3080
- C:\Windows\System\TkJFKfq.exe
  C:\Windows\System\TkJFKfq.exe
  2⤵
  PID:3160
- C:\Windows\System\nyycFiA.exe
  C:\Windows\System\nyycFiA.exe
  2⤵
  PID:3236
- C:\Windows\System\gyAYbJk.exe
  C:\Windows\System\gyAYbJk.exe
  2⤵
  PID:2996
- C:\Windows\System\FeVyrYl.exe
  C:\Windows\System\FeVyrYl.exe
  2⤵
  PID:1252
- C:\Windows\System\dJZcLPP.exe
  C:\Windows\System\dJZcLPP.exe
  2⤵
  PID:2008
- C:\Windows\System\JTwgBNH.exe
  C:\Windows\System\JTwgBNH.exe
  2⤵
  PID:3308
- C:\Windows\System\ZygPxkB.exe
  C:\Windows\System\ZygPxkB.exe
  2⤵
  PID:3316
- C:\Windows\System\kpfpvFv.exe
  C:\Windows\System\kpfpvFv.exe
  2⤵
  PID:3104
- C:\Windows\System\XhIxyYC.exe
  C:\Windows\System\XhIxyYC.exe
  2⤵
  PID:3144
- C:\Windows\System\HKVjZPr.exe
  C:\Windows\System\HKVjZPr.exe
  2⤵
  PID:3184
- C:\Windows\System\TQHpUBZ.exe
  C:\Windows\System\TQHpUBZ.exe
  2⤵
  PID:3224
- C:\Windows\System\VNwHAnp.exe
  C:\Windows\System\VNwHAnp.exe
  2⤵
  PID:3372
- C:\Windows\System\SKKUafT.exe
  C:\Windows\System\SKKUafT.exe
  2⤵
  PID:3456
- C:\Windows\System\XZiTcSF.exe
  C:\Windows\System\XZiTcSF.exe
  2⤵
  PID:3524
- C:\Windows\System\SzzCMtV.exe
  C:\Windows\System\SzzCMtV.exe
  2⤵
  PID:3648
- C:\Windows\System\KsBtQoR.exe
  C:\Windows\System\KsBtQoR.exe
  2⤵
  PID:3260
- C:\Windows\System\WXPbzEm.exe
  C:\Windows\System\WXPbzEm.exe
  2⤵
  PID:3716
- C:\Windows\System\fhMdRYC.exe
  C:\Windows\System\fhMdRYC.exe
  2⤵
  PID:3424
- C:\Windows\System\uqIXdHh.exe
  C:\Windows\System\uqIXdHh.exe
  2⤵
  PID:3472
- C:\Windows\System\TCdMuXu.exe
  C:\Windows\System\TCdMuXu.exe
  2⤵
  PID:3536
- C:\Windows\System\BMmkiEO.exe
  C:\Windows\System\BMmkiEO.exe
  2⤵
  PID:3576
- C:\Windows\System\xfgeUFq.exe
  C:\Windows\System\xfgeUFq.exe
  2⤵
  PID:3592
- C:\Windows\System\FnBdUOz.exe
  C:\Windows\System\FnBdUOz.exe
  2⤵
  PID:3800
- C:\Windows\System\qaSsobY.exe
  C:\Windows\System\qaSsobY.exe
  2⤵
  PID:3672
- C:\Windows\System\uAHXFhz.exe
  C:\Windows\System\uAHXFhz.exe
  2⤵
  PID:3740
- C:\Windows\System\iwwPTBg.exe
  C:\Windows\System\iwwPTBg.exe
  2⤵
  PID:3780
- C:\Windows\System\MMsZhSF.exe
  C:\Windows\System\MMsZhSF.exe
  2⤵
  PID:3628
- C:\Windows\System\giTTgpF.exe
  C:\Windows\System\giTTgpF.exe
  2⤵
  PID:3828
- C:\Windows\System\zPPEJAb.exe
  C:\Windows\System\zPPEJAb.exe
  2⤵
  PID:3868
- C:\Windows\System\kmzrFRp.exe
  C:\Windows\System\kmzrFRp.exe
  2⤵
  PID:3940
- C:\Windows\System\UiRoQLq.exe
  C:\Windows\System\UiRoQLq.exe
  2⤵
  PID:3884
- C:\Windows\System\OpdyNrL.exe
  C:\Windows\System\OpdyNrL.exe
  2⤵
  PID:3984
- C:\Windows\System\MAMsAHo.exe
  C:\Windows\System\MAMsAHo.exe
  2⤵
  PID:1916
- C:\Windows\System\mIkaARQ.exe
  C:\Windows\System\mIkaARQ.exe
  2⤵
  PID:4072
- C:\Windows\System\RhuvGFO.exe
  C:\Windows\System\RhuvGFO.exe
  2⤵
  PID:4084
- C:\Windows\System\xVxdBfb.exe
  C:\Windows\System\xVxdBfb.exe
  2⤵
  PID:3052
- C:\Windows\System\QtgrFEc.exe
  C:\Windows\System\QtgrFEc.exe
  2⤵
  PID:3124
- C:\Windows\System\tYiEzyp.exe
  C:\Windows\System\tYiEzyp.exe
  2⤵
  PID:3040
- C:\Windows\System\JJewkvI.exe
  C:\Windows\System\JJewkvI.exe
  2⤵
  PID:900
- C:\Windows\System\yqjeEDQ.exe
  C:\Windows\System\yqjeEDQ.exe
  2⤵
  PID:2564
- C:\Windows\System\lKAEOWG.exe
  C:\Windows\System\lKAEOWG.exe
  2⤵
  PID:2552
- C:\Windows\System\NmWHxAa.exe
  C:\Windows\System\NmWHxAa.exe
  2⤵
  PID:3216
- C:\Windows\System\UVDyIMK.exe
  C:\Windows\System\UVDyIMK.exe
  2⤵
  PID:3356
- C:\Windows\System\GHSUerU.exe
  C:\Windows\System\GHSUerU.exe
  2⤵
  PID:3436
- C:\Windows\System\peCMRcH.exe
  C:\Windows\System\peCMRcH.exe
  2⤵
  PID:3540
- C:\Windows\System\mvbLGyf.exe
  C:\Windows\System\mvbLGyf.exe
  2⤵
  PID:3736
- C:\Windows\System\ScdvJPA.exe
  C:\Windows\System\ScdvJPA.exe
  2⤵
  PID:3096
- C:\Windows\System\zOTfvrU.exe
  C:\Windows\System\zOTfvrU.exe
  2⤵
  PID:3664
- C:\Windows\System\fAkQKgI.exe
  C:\Windows\System\fAkQKgI.exe
  2⤵
  PID:1796
- C:\Windows\System\DxNgNdt.exe
  C:\Windows\System\DxNgNdt.exe
  2⤵
  PID:3488
- C:\Windows\System\BJskgfG.exe
  C:\Windows\System\BJskgfG.exe
  2⤵
  PID:4052
- C:\Windows\System\GYjXgwC.exe
  C:\Windows\System\GYjXgwC.exe
  2⤵
  PID:4076
- C:\Windows\System\YQOmtJa.exe
  C:\Windows\System\YQOmtJa.exe
  2⤵
  PID:3392
- C:\Windows\System\jAKANCC.exe
  C:\Windows\System\jAKANCC.exe
  2⤵
  PID:3344
- C:\Windows\System\QKNXrqM.exe
  C:\Windows\System\QKNXrqM.exe
  2⤵
  PID:3508
- C:\Windows\System\jDsRZpb.exe
  C:\Windows\System\jDsRZpb.exe
  2⤵
  PID:3772
- C:\Windows\System\CBPsUoe.exe
  C:\Windows\System\CBPsUoe.exe
  2⤵
  PID:3832
- C:\Windows\System\rXxQQmq.exe
  C:\Windows\System\rXxQQmq.exe
  2⤵
  PID:1192
- C:\Windows\System\YfKjljG.exe
  C:\Windows\System\YfKjljG.exe
  2⤵
  PID:3584
- C:\Windows\System\HUrxrZU.exe
  C:\Windows\System\HUrxrZU.exe
  2⤵
  PID:3612
- C:\Windows\System\dpqElLq.exe
  C:\Windows\System\dpqElLq.exe
  2⤵
  PID:2440
- C:\Windows\System\GsiGcZE.exe
  C:\Windows\System\GsiGcZE.exe
  2⤵
  PID:3848
- C:\Windows\System\dUcxzPy.exe
  C:\Windows\System\dUcxzPy.exe
  2⤵
  PID:1572
- C:\Windows\System\cMLvtDO.exe
  C:\Windows\System\cMLvtDO.exe
  2⤵
  PID:1616
- C:\Windows\System\rYjysja.exe
  C:\Windows\System\rYjysja.exe
  2⤵
  PID:3312
- C:\Windows\System\eOegWMK.exe
  C:\Windows\System\eOegWMK.exe
  2⤵
  PID:3720
- C:\Windows\System\UxIuWal.exe
  C:\Windows\System\UxIuWal.exe
  2⤵
  PID:2696
- C:\Windows\System\rvgEKli.exe
  C:\Windows\System\rvgEKli.exe
  2⤵
  PID:3176
- C:\Windows\System\bADMMJO.exe
  C:\Windows\System\bADMMJO.exe
  2⤵
  PID:3484
- C:\Windows\System\hmpIYJB.exe
  C:\Windows\System\hmpIYJB.exe
  2⤵
  PID:3600
- C:\Windows\System\gZCTMlY.exe
  C:\Windows\System\gZCTMlY.exe
  2⤵
  PID:2584
- C:\Windows\System\QfnPzlc.exe
  C:\Windows\System\QfnPzlc.exe
  2⤵
  PID:4100
- C:\Windows\System\IPyGWtG.exe
  C:\Windows\System\IPyGWtG.exe
  2⤵
  PID:4116
- C:\Windows\System\gfkglBA.exe
  C:\Windows\System\gfkglBA.exe
  2⤵
  PID:4132
- C:\Windows\System\PTPcZMh.exe
  C:\Windows\System\PTPcZMh.exe
  2⤵
  PID:4148
- C:\Windows\System\CIOysme.exe
  C:\Windows\System\CIOysme.exe
  2⤵
  PID:4164
- C:\Windows\System\NgTddkv.exe
  C:\Windows\System\NgTddkv.exe
  2⤵
  PID:4180
- C:\Windows\System\liFdfMM.exe
  C:\Windows\System\liFdfMM.exe
  2⤵
  PID:4200
- C:\Windows\System\doqGvRo.exe
  C:\Windows\System\doqGvRo.exe
  2⤵
  PID:4216
- C:\Windows\System\sIBHfKW.exe
  C:\Windows\System\sIBHfKW.exe
  2⤵
  PID:4232
- C:\Windows\System\wrXDtwm.exe
  C:\Windows\System\wrXDtwm.exe
  2⤵
  PID:4248
- C:\Windows\System\AuMJGAk.exe
  C:\Windows\System\AuMJGAk.exe
  2⤵
  PID:4264
- C:\Windows\System\ZvshmyX.exe
  C:\Windows\System\ZvshmyX.exe
  2⤵
  PID:4280
- C:\Windows\System\JjJvsPL.exe
  C:\Windows\System\JjJvsPL.exe
  2⤵
  PID:4300
- C:\Windows\System\RZWsjQx.exe
  C:\Windows\System\RZWsjQx.exe
  2⤵
  PID:4324
- C:\Windows\System\SQiAGPn.exe
  C:\Windows\System\SQiAGPn.exe
  2⤵
  PID:4340
- C:\Windows\System\fFurQTT.exe
  C:\Windows\System\fFurQTT.exe
  2⤵
  PID:4356
- C:\Windows\System\dqFoJer.exe
  C:\Windows\System\dqFoJer.exe
  2⤵
  PID:4372
- C:\Windows\System\QAaGkNf.exe
  C:\Windows\System\QAaGkNf.exe
  2⤵
  PID:4392
- C:\Windows\System\AOlibKW.exe
  C:\Windows\System\AOlibKW.exe
  2⤵
  PID:4408
- C:\Windows\System\FpOLRsU.exe
  C:\Windows\System\FpOLRsU.exe
  2⤵
  PID:4424
- C:\Windows\System\VPlLWqU.exe
  C:\Windows\System\VPlLWqU.exe
  2⤵
  PID:4440
- C:\Windows\System\WfdgzTv.exe
  C:\Windows\System\WfdgzTv.exe
  2⤵
  PID:4456
- C:\Windows\System\HSgwwSA.exe
  C:\Windows\System\HSgwwSA.exe
  2⤵
  PID:4472
- C:\Windows\System\HrgflEZ.exe
  C:\Windows\System\HrgflEZ.exe
  2⤵
  PID:4488
- C:\Windows\System\XDbpwQI.exe
  C:\Windows\System\XDbpwQI.exe
  2⤵
  PID:4504
- C:\Windows\System\xBEUwcq.exe
  C:\Windows\System\xBEUwcq.exe
  2⤵
  PID:4520
- C:\Windows\System\yIwgTwA.exe
  C:\Windows\System\yIwgTwA.exe
  2⤵
  PID:4536
- C:\Windows\System\NOokjEt.exe
  C:\Windows\System\NOokjEt.exe
  2⤵
  PID:4552
- C:\Windows\System\SxUEAcG.exe
  C:\Windows\System\SxUEAcG.exe
  2⤵
  PID:4568
- C:\Windows\System\UGVjtRW.exe
  C:\Windows\System\UGVjtRW.exe
  2⤵
  PID:4584
- C:\Windows\System\cFbxfRg.exe
  C:\Windows\System\cFbxfRg.exe
  2⤵
  PID:4684
- C:\Windows\System\JcwHMiw.exe
  C:\Windows\System\JcwHMiw.exe
  2⤵
  PID:4704
- C:\Windows\System\anfmMrj.exe
  C:\Windows\System\anfmMrj.exe
  2⤵
  PID:4720
- C:\Windows\System\tGOiCPT.exe
  C:\Windows\System\tGOiCPT.exe
  2⤵
  PID:4736
- C:\Windows\System\AtHZctu.exe
  C:\Windows\System\AtHZctu.exe
  2⤵
  PID:4752
- C:\Windows\System\OGnXULD.exe
  C:\Windows\System\OGnXULD.exe
  2⤵
  PID:4768
- C:\Windows\System\ATLWMMP.exe
  C:\Windows\System\ATLWMMP.exe
  2⤵
  PID:4784
- C:\Windows\System\zEbbxiI.exe
  C:\Windows\System\zEbbxiI.exe
  2⤵
  PID:4800
- C:\Windows\System\NMflzZV.exe
  C:\Windows\System\NMflzZV.exe
  2⤵
  PID:4836
- C:\Windows\System\jDqfTGD.exe
  C:\Windows\System\jDqfTGD.exe
  2⤵
  PID:4852
- C:\Windows\System\gkCJIdB.exe
  C:\Windows\System\gkCJIdB.exe
  2⤵
  PID:4868
- C:\Windows\System\OMRzWeq.exe
  C:\Windows\System\OMRzWeq.exe
  2⤵
  PID:4884
- C:\Windows\System\nSGHbpM.exe
  C:\Windows\System\nSGHbpM.exe
  2⤵
  PID:4900
- C:\Windows\System\RHRNXoc.exe
  C:\Windows\System\RHRNXoc.exe
  2⤵
  PID:4916
- C:\Windows\System\vzSQOQX.exe
  C:\Windows\System\vzSQOQX.exe
  2⤵
  PID:4932
- C:\Windows\System\WjRvuQJ.exe
  C:\Windows\System\WjRvuQJ.exe
  2⤵
  PID:4948
- C:\Windows\System\nErroEg.exe
  C:\Windows\System\nErroEg.exe
  2⤵
  PID:4964
- C:\Windows\System\SYLjAkG.exe
  C:\Windows\System\SYLjAkG.exe
  2⤵
  PID:4980
- C:\Windows\System\SnljPZM.exe
  C:\Windows\System\SnljPZM.exe
  2⤵
  PID:4996
- C:\Windows\System\acudHwG.exe
  C:\Windows\System\acudHwG.exe
  2⤵
  PID:5012
- C:\Windows\System\wzFHUOD.exe
  C:\Windows\System\wzFHUOD.exe
  2⤵
  PID:5028
- C:\Windows\System\XSHpxBr.exe
  C:\Windows\System\XSHpxBr.exe
  2⤵
  PID:5044
- C:\Windows\System\BqbgHHJ.exe
  C:\Windows\System\BqbgHHJ.exe
  2⤵
  PID:5060
- C:\Windows\System\AksbYvk.exe
  C:\Windows\System\AksbYvk.exe
  2⤵
  PID:5076
- C:\Windows\System\bZMKNQS.exe
  C:\Windows\System\bZMKNQS.exe
  2⤵
  PID:5092
- C:\Windows\System\iTupMCT.exe
  C:\Windows\System\iTupMCT.exe
  2⤵
  PID:5108
- C:\Windows\System\CQpvjen.exe
  C:\Windows\System\CQpvjen.exe
  2⤵
  PID:3288
- C:\Windows\System\xCDteLb.exe
  C:\Windows\System\xCDteLb.exe
  2⤵
  PID:2732
- C:\Windows\System\iiuEGIk.exe
  C:\Windows\System\iiuEGIk.exe
  2⤵
  PID:3968
- C:\Windows\System\hnzuRDq.exe
  C:\Windows\System\hnzuRDq.exe
  2⤵
  PID:4036
- C:\Windows\System\yDGciWB.exe
  C:\Windows\System\yDGciWB.exe
  2⤵
  PID:3272
- C:\Windows\System\BTecfgc.exe
  C:\Windows\System\BTecfgc.exe
  2⤵
  PID:3760
- C:\Windows\System\DOhLwgo.exe
  C:\Windows\System\DOhLwgo.exe
  2⤵
  PID:3880
- C:\Windows\System\MgpwtQS.exe
  C:\Windows\System\MgpwtQS.exe
  2⤵
  PID:2728
- C:\Windows\System\pQwJoiZ.exe
  C:\Windows\System\pQwJoiZ.exe
  2⤵
  PID:3368
- C:\Windows\System\gyEqOuv.exe
  C:\Windows\System\gyEqOuv.exe
  2⤵
  PID:4240
- C:\Windows\System\YHASbuI.exe
  C:\Windows\System\YHASbuI.exe
  2⤵
  PID:4144
- C:\Windows\System\JfjqKgj.exe
  C:\Windows\System\JfjqKgj.exe
  2⤵
  PID:4212
- C:\Windows\System\tFMAkMr.exe
  C:\Windows\System\tFMAkMr.exe
  2⤵
  PID:4308
- C:\Windows\System\fmQWevT.exe
  C:\Windows\System\fmQWevT.exe
  2⤵
  PID:4348
- C:\Windows\System\tMXmSVd.exe
  C:\Windows\System\tMXmSVd.exe
  2⤵
  PID:4388
- C:\Windows\System\UVKLIqz.exe
  C:\Windows\System\UVKLIqz.exe
  2⤵
  PID:4452
- C:\Windows\System\CXKiPPG.exe
  C:\Windows\System\CXKiPPG.exe
  2⤵
  PID:3804
- C:\Windows\System\QUpQbjf.exe
  C:\Windows\System\QUpQbjf.exe
  2⤵
  PID:3560
- C:\Windows\System\obWdBhV.exe
  C:\Windows\System\obWdBhV.exe
  2⤵
  PID:4512
- C:\Windows\System\KabqLlT.exe
  C:\Windows\System\KabqLlT.exe
  2⤵
  PID:4548
- C:\Windows\System\dVHRbGx.exe
  C:\Windows\System\dVHRbGx.exe
  2⤵
  PID:1856
- C:\Windows\System\JOURfhc.exe
  C:\Windows\System\JOURfhc.exe
  2⤵
  PID:4160
- C:\Windows\System\NzncdRB.exe
  C:\Windows\System\NzncdRB.exe
  2⤵
  PID:4224
- C:\Windows\System\yjoSPGD.exe
  C:\Windows\System\yjoSPGD.exe
  2⤵
  PID:4288
- C:\Windows\System\ZWKkxHS.exe
  C:\Windows\System\ZWKkxHS.exe
  2⤵
  PID:4336
- C:\Windows\System\sZFkAlb.exe
  C:\Windows\System\sZFkAlb.exe
  2⤵
  PID:4404
- C:\Windows\System\bEkFWtf.exe
  C:\Windows\System\bEkFWtf.exe
  2⤵
  PID:4468
- C:\Windows\System\PDyLlKd.exe
  C:\Windows\System\PDyLlKd.exe
  2⤵
  PID:4532
- C:\Windows\System\TdHJkCc.exe
  C:\Windows\System\TdHJkCc.exe
  2⤵
  PID:3964
- C:\Windows\System\OWUJPLL.exe
  C:\Windows\System\OWUJPLL.exe
  2⤵
  PID:4604
- C:\Windows\System\dMLXfTt.exe
  C:\Windows\System\dMLXfTt.exe
  2⤵
  PID:4620
- C:\Windows\System\aUVjtmC.exe
  C:\Windows\System\aUVjtmC.exe
  2⤵
  PID:4636
- C:\Windows\System\TVvxNqd.exe
  C:\Windows\System\TVvxNqd.exe
  2⤵
  PID:2508
- C:\Windows\System\ZwaKQGR.exe
  C:\Windows\System\ZwaKQGR.exe
  2⤵
  PID:1996
- C:\Windows\System\dElTjhf.exe
  C:\Windows\System\dElTjhf.exe
  2⤵
  PID:4692
- C:\Windows\System\zcQbYbh.exe
  C:\Windows\System\zcQbYbh.exe
  2⤵
  PID:4732
- C:\Windows\System\YwBWvER.exe
  C:\Windows\System\YwBWvER.exe
  2⤵
  PID:4792
- C:\Windows\System\trXXPTr.exe
  C:\Windows\System\trXXPTr.exe
  2⤵
  PID:4848
- C:\Windows\System\xEipvUL.exe
  C:\Windows\System\xEipvUL.exe
  2⤵
  PID:4940
- C:\Windows\System\MPcyeGY.exe
  C:\Windows\System\MPcyeGY.exe
  2⤵
  PID:4976
- C:\Windows\System\XMhfPNC.exe
  C:\Windows\System\XMhfPNC.exe
  2⤵
  PID:5040
- C:\Windows\System\sYoYnQA.exe
  C:\Windows\System\sYoYnQA.exe
  2⤵
  PID:5104
- C:\Windows\System\GrmoKUy.exe
  C:\Windows\System\GrmoKUy.exe
  2⤵
  PID:2672
- C:\Windows\System\jhLTNyR.exe
  C:\Windows\System\jhLTNyR.exe
  2⤵
  PID:2572
- C:\Windows\System\chCnekP.exe
  C:\Windows\System\chCnekP.exe
  2⤵
  PID:4812
- C:\Windows\System\qulWfeZ.exe
  C:\Windows\System\qulWfeZ.exe
  2⤵
  PID:4832
- C:\Windows\System\unTUEpw.exe
  C:\Windows\System\unTUEpw.exe
  2⤵
  PID:4924
- C:\Windows\System\kOpsTOJ.exe
  C:\Windows\System\kOpsTOJ.exe
  2⤵
  PID:3980
- C:\Windows\System\QmiUEwg.exe
  C:\Windows\System\QmiUEwg.exe
  2⤵
  PID:3816
- C:\Windows\System\vTKoSPW.exe
  C:\Windows\System\vTKoSPW.exe
  2⤵
  PID:4320
- C:\Windows\System\QytVfDn.exe
  C:\Windows\System\QytVfDn.exe
  2⤵
  PID:3140
- C:\Windows\System\vTCZaoK.exe
  C:\Windows\System\vTCZaoK.exe
  2⤵
  PID:1248
- C:\Windows\System\Kggfxbi.exe
  C:\Windows\System\Kggfxbi.exe
  2⤵
  PID:4256
- C:\Windows\System\dJVsFAb.exe
  C:\Windows\System\dJVsFAb.exe
  2⤵
  PID:4500
- C:\Windows\System\kRElnmP.exe
  C:\Windows\System\kRElnmP.exe
  2⤵
  PID:4628
- C:\Windows\System\ZqlRULv.exe
  C:\Windows\System\ZqlRULv.exe
  2⤵
  PID:4700
- C:\Windows\System\unWKfrc.exe
  C:\Windows\System\unWKfrc.exe
  2⤵
  PID:4844
- C:\Windows\System\hAAHiMr.exe
  C:\Windows\System\hAAHiMr.exe
  2⤵
  PID:5072
- C:\Windows\System\ZruSJTY.exe
  C:\Windows\System\ZruSJTY.exe
  2⤵
  PID:4824
- C:\Windows\System\wjDTpzw.exe
  C:\Windows\System\wjDTpzw.exe
  2⤵
  PID:2340
- C:\Windows\System\NhuFrNo.exe
  C:\Windows\System\NhuFrNo.exe
  2⤵
  PID:4272
- C:\Windows\System\snUDWwQ.exe
  C:\Windows\System\snUDWwQ.exe
  2⤵
  PID:4316
- C:\Windows\System\Kndouvu.exe
  C:\Windows\System\Kndouvu.exe
  2⤵
  PID:5020
- C:\Windows\System\zqlNyDp.exe
  C:\Windows\System\zqlNyDp.exe
  2⤵
  PID:3864
- C:\Windows\System\ZHDXHcX.exe
  C:\Windows\System\ZHDXHcX.exe
  2⤵
  PID:4400
- C:\Windows\System\qOrvAyt.exe
  C:\Windows\System\qOrvAyt.exe
  2⤵
  PID:4564
- C:\Windows\System\xKktXJY.exe
  C:\Windows\System\xKktXJY.exe
  2⤵
  PID:5132
- C:\Windows\System\ASFlwPZ.exe
  C:\Windows\System\ASFlwPZ.exe
  2⤵
  PID:5148
- C:\Windows\System\MUfzpGZ.exe
  C:\Windows\System\MUfzpGZ.exe
  2⤵
  PID:5164
- C:\Windows\System\nFLdxxN.exe
  C:\Windows\System\nFLdxxN.exe
  2⤵
  PID:5180
- C:\Windows\System\XcwBYiQ.exe
  C:\Windows\System\XcwBYiQ.exe
  2⤵
  PID:5196
- C:\Windows\System\vbllEFb.exe
  C:\Windows\System\vbllEFb.exe
  2⤵
  PID:5212
- C:\Windows\System\BIDgAFd.exe
  C:\Windows\System\BIDgAFd.exe
  2⤵
  PID:5228
- C:\Windows\System\Zndgbee.exe
  C:\Windows\System\Zndgbee.exe
  2⤵
  PID:5244
- C:\Windows\System\hnJtHrr.exe
  C:\Windows\System\hnJtHrr.exe
  2⤵
  PID:5260
- C:\Windows\System\NIWLbbx.exe
  C:\Windows\System\NIWLbbx.exe
  2⤵
  PID:5276
- C:\Windows\System\fQFocWe.exe
  C:\Windows\System\fQFocWe.exe
  2⤵
  PID:5292
- C:\Windows\System\CUDndDR.exe
  C:\Windows\System\CUDndDR.exe
  2⤵
  PID:5308
- C:\Windows\System\cUgtNOC.exe
  C:\Windows\System\cUgtNOC.exe
  2⤵
  PID:5324
- C:\Windows\System\jagAsCR.exe
  C:\Windows\System\jagAsCR.exe
  2⤵
  PID:5340
- C:\Windows\System\FbVFyYB.exe
  C:\Windows\System\FbVFyYB.exe
  2⤵
  PID:5356
- C:\Windows\System\OQnhtaN.exe
  C:\Windows\System\OQnhtaN.exe
  2⤵
  PID:5372
- C:\Windows\System\RjirywR.exe
  C:\Windows\System\RjirywR.exe
  2⤵
  PID:5388
- C:\Windows\System\xSROAXo.exe
  C:\Windows\System\xSROAXo.exe
  2⤵
  PID:5404
- C:\Windows\System\rYlaRNQ.exe
  C:\Windows\System\rYlaRNQ.exe
  2⤵
  PID:5420
- C:\Windows\System\BCCXJxK.exe
  C:\Windows\System\BCCXJxK.exe
  2⤵
  PID:5436
- C:\Windows\System\RTeAQfh.exe
  C:\Windows\System\RTeAQfh.exe
  2⤵
  PID:5452
- C:\Windows\System\gsriHum.exe
  C:\Windows\System\gsriHum.exe
  2⤵
  PID:5468
- C:\Windows\System\BqUdOxI.exe
  C:\Windows\System\BqUdOxI.exe
  2⤵
  PID:5484
- C:\Windows\System\uZjIbcl.exe
  C:\Windows\System\uZjIbcl.exe
  2⤵
  PID:5500
- C:\Windows\System\iuPZPJD.exe
  C:\Windows\System\iuPZPJD.exe
  2⤵
  PID:5516
- C:\Windows\System\rfSRNIT.exe
  C:\Windows\System\rfSRNIT.exe
  2⤵
  PID:5532
- C:\Windows\System\UpPGzGl.exe
  C:\Windows\System\UpPGzGl.exe
  2⤵
  PID:5548
- C:\Windows\System\ukUTmBB.exe
  C:\Windows\System\ukUTmBB.exe
  2⤵
  PID:5564
- C:\Windows\System\hXiZCYP.exe
  C:\Windows\System\hXiZCYP.exe
  2⤵
  PID:5580
- C:\Windows\System\JhmDPFz.exe
  C:\Windows\System\JhmDPFz.exe
  2⤵
  PID:5596
- C:\Windows\System\XaEdxPd.exe
  C:\Windows\System\XaEdxPd.exe
  2⤵
  PID:5612
- C:\Windows\System\yFLfxDa.exe
  C:\Windows\System\yFLfxDa.exe
  2⤵
  PID:5628
- C:\Windows\System\xwQmWTR.exe
  C:\Windows\System\xwQmWTR.exe
  2⤵
  PID:5644
- C:\Windows\System\IEcNFti.exe
  C:\Windows\System\IEcNFti.exe
  2⤵
  PID:5660
- C:\Windows\System\Zkeencx.exe
  C:\Windows\System\Zkeencx.exe
  2⤵
  PID:5676
- C:\Windows\System\lrOgMfs.exe
  C:\Windows\System\lrOgMfs.exe
  2⤵
  PID:5692
- C:\Windows\System\sBNATnQ.exe
  C:\Windows\System\sBNATnQ.exe
  2⤵
  PID:5708
- C:\Windows\System\QxoOmTK.exe
  C:\Windows\System\QxoOmTK.exe
  2⤵
  PID:5724
- C:\Windows\System\kBEMQFz.exe
  C:\Windows\System\kBEMQFz.exe
  2⤵
  PID:5740
- C:\Windows\System\EwlDDcH.exe
  C:\Windows\System\EwlDDcH.exe
  2⤵
  PID:5756
- C:\Windows\System\psGrBMk.exe
  C:\Windows\System\psGrBMk.exe
  2⤵
  PID:5772
- C:\Windows\System\WxVtmpY.exe
  C:\Windows\System\WxVtmpY.exe
  2⤵
  PID:5788
- C:\Windows\System\qwUCVME.exe
  C:\Windows\System\qwUCVME.exe
  2⤵
  PID:5804
- C:\Windows\System\oLoKHXy.exe
  C:\Windows\System\oLoKHXy.exe
  2⤵
  PID:5820
- C:\Windows\System\pPaTJHI.exe
  C:\Windows\System\pPaTJHI.exe
  2⤵
  PID:5836
- C:\Windows\System\ZxNeiYS.exe
  C:\Windows\System\ZxNeiYS.exe
  2⤵
  PID:5852
- C:\Windows\System\QDLYCgT.exe
  C:\Windows\System\QDLYCgT.exe
  2⤵
  PID:5868
- C:\Windows\System\uTFwasX.exe
  C:\Windows\System\uTFwasX.exe
  2⤵
  PID:5884
- C:\Windows\System\ALptyfF.exe
  C:\Windows\System\ALptyfF.exe
  2⤵
  PID:5900
- C:\Windows\System\TURkFci.exe
  C:\Windows\System\TURkFci.exe
  2⤵
  PID:5916
- C:\Windows\System\MOudnyh.exe
  C:\Windows\System\MOudnyh.exe
  2⤵
  PID:5932
- C:\Windows\System\XniOuqQ.exe
  C:\Windows\System\XniOuqQ.exe
  2⤵
  PID:5948
- C:\Windows\System\cAPNCEH.exe
  C:\Windows\System\cAPNCEH.exe
  2⤵
  PID:5964
- C:\Windows\System\AHhHJcw.exe
  C:\Windows\System\AHhHJcw.exe
  2⤵
  PID:5980
- C:\Windows\System\teYBCKo.exe
  C:\Windows\System\teYBCKo.exe
  2⤵
  PID:5996
- C:\Windows\System\XeOxWDd.exe
  C:\Windows\System\XeOxWDd.exe
  2⤵
  PID:6012
- C:\Windows\System\WTkaduz.exe
  C:\Windows\System\WTkaduz.exe
  2⤵
  PID:6028
- C:\Windows\System\IyiWVpG.exe
  C:\Windows\System\IyiWVpG.exe
  2⤵
  PID:6044
- C:\Windows\System\KWcBjfD.exe
  C:\Windows\System\KWcBjfD.exe
  2⤵
  PID:6060
- C:\Windows\System\cVACJes.exe
  C:\Windows\System\cVACJes.exe
  2⤵
  PID:6076
- C:\Windows\System\afOZHOG.exe
  C:\Windows\System\afOZHOG.exe
  2⤵
  PID:6092
- C:\Windows\System\gYVODNJ.exe
  C:\Windows\System\gYVODNJ.exe
  2⤵
  PID:6108
- C:\Windows\System\nmeTqbu.exe
  C:\Windows\System\nmeTqbu.exe
  2⤵
  PID:6124
- C:\Windows\System\ZcqnahA.exe
  C:\Windows\System\ZcqnahA.exe
  2⤵
  PID:6140
- C:\Windows\System\xVrfvUA.exe
  C:\Windows\System\xVrfvUA.exe
  2⤵
  PID:4972
- C:\Windows\System\iHuifbp.exe
  C:\Windows\System\iHuifbp.exe
  2⤵
  PID:4176
- C:\Windows\System\cPLxtCK.exe
  C:\Windows\System\cPLxtCK.exe
  2⤵
  PID:4436
- C:\Windows\System\CTIulIh.exe
  C:\Windows\System\CTIulIh.exe
  2⤵
  PID:5204
- C:\Windows\System\tLipwhm.exe
  C:\Windows\System\tLipwhm.exe
  2⤵
  PID:5240
- C:\Windows\System\XNujNoL.exe
  C:\Windows\System\XNujNoL.exe
  2⤵
  PID:2932
- C:\Windows\System\WBGPWhQ.exe
  C:\Windows\System\WBGPWhQ.exe
  2⤵
  PID:5332
- C:\Windows\System\dxaRTmZ.exe
  C:\Windows\System\dxaRTmZ.exe
  2⤵
  PID:5400
- C:\Windows\System\yKIBybh.exe
  C:\Windows\System\yKIBybh.exe
  2⤵
  PID:5464
- C:\Windows\System\HvcHHpZ.exe
  C:\Windows\System\HvcHHpZ.exe
  2⤵
  PID:2348
- C:\Windows\System\yAgOgAy.exe
  C:\Windows\System\yAgOgAy.exe
  2⤵
  PID:5528
- C:\Windows\System\BBDlSBv.exe
  C:\Windows\System\BBDlSBv.exe
  2⤵
  PID:1292
- C:\Windows\System\oFMOEXt.exe
  C:\Windows\System\oFMOEXt.exe
  2⤵
  PID:5592
- C:\Windows\System\WeWWdva.exe
  C:\Windows\System\WeWWdva.exe
  2⤵
  PID:1308
- C:\Windows\System\vKMlrIr.exe
  C:\Windows\System\vKMlrIr.exe
  2⤵
  PID:5720
- C:\Windows\System\CdMgLNA.exe
  C:\Windows\System\CdMgLNA.exe
  2⤵
  PID:5784
- C:\Windows\System\uAKEuUV.exe
  C:\Windows\System\uAKEuUV.exe
  2⤵
  PID:5848
- C:\Windows\System\SEewJpb.exe
  C:\Windows\System\SEewJpb.exe
  2⤵
  PID:5912
- C:\Windows\System\sRuBQIN.exe
  C:\Windows\System\sRuBQIN.exe
  2⤵
  PID:5976
- C:\Windows\System\Suiuuqb.exe
  C:\Windows\System\Suiuuqb.exe
  2⤵
  PID:6040
- C:\Windows\System\URtNzsl.exe
  C:\Windows\System\URtNzsl.exe
  2⤵
  PID:4712
- C:\Windows\System\DxHmiHY.exe
  C:\Windows\System\DxHmiHY.exe
  2⤵
  PID:5008
- C:\Windows\System\MRHXelA.exe
  C:\Windows\System\MRHXelA.exe
  2⤵
  PID:2004
- C:\Windows\System\mKcGXjD.exe
  C:\Windows\System\mKcGXjD.exe
  2⤵
  PID:3276
- C:\Windows\System\hLYWJvO.exe
  C:\Windows\System\hLYWJvO.exe
  2⤵
  PID:4192
- C:\Windows\System\OpNSFCO.exe
  C:\Windows\System\OpNSFCO.exe
  2⤵
  PID:2832
- C:\Windows\System\jznFZRr.exe
  C:\Windows\System\jznFZRr.exe
  2⤵
  PID:6132
- C:\Windows\System\xOxJnkm.exe
  C:\Windows\System\xOxJnkm.exe
  2⤵
  PID:4828
- C:\Windows\System\zAYdpFm.exe
  C:\Windows\System\zAYdpFm.exe
  2⤵
  PID:5220
- C:\Windows\System\oxFFHbO.exe
  C:\Windows\System\oxFFHbO.exe
  2⤵
  PID:5144
- C:\Windows\System\cjiaGFM.exe
  C:\Windows\System\cjiaGFM.exe
  2⤵
  PID:5316
- C:\Windows\System\avAbhzP.exe
  C:\Windows\System\avAbhzP.exe
  2⤵
  PID:5412
- C:\Windows\System\RXziniK.exe
  C:\Windows\System\RXziniK.exe
  2⤵
  PID:5476
- C:\Windows\System\fKvaOWJ.exe
  C:\Windows\System\fKvaOWJ.exe
  2⤵
  PID:5540
- C:\Windows\System\wZipeEL.exe
  C:\Windows\System\wZipeEL.exe
  2⤵
  PID:5604
- C:\Windows\System\qniiLMr.exe
  C:\Windows\System\qniiLMr.exe
  2⤵
  PID:5672
- C:\Windows\System\SfWGTVm.exe
  C:\Windows\System\SfWGTVm.exe
  2⤵
  PID:5272
- C:\Windows\System\gzWmgeQ.exe
  C:\Windows\System\gzWmgeQ.exe
  2⤵
  PID:5764
- C:\Windows\System\oRpOrOs.exe
  C:\Windows\System\oRpOrOs.exe
  2⤵
  PID:5828
- C:\Windows\System\bdAuoYL.exe
  C:\Windows\System\bdAuoYL.exe
  2⤵
  PID:5896
- C:\Windows\System\hBvvSru.exe
  C:\Windows\System\hBvvSru.exe
  2⤵
  PID:5368
- C:\Windows\System\vDjmDPc.exe
  C:\Windows\System\vDjmDPc.exe
  2⤵
  PID:4648
- C:\Windows\System\fdyMrjX.exe
  C:\Windows\System\fdyMrjX.exe
  2⤵
  PID:5780
- C:\Windows\System\HgwWVmZ.exe
  C:\Windows\System\HgwWVmZ.exe
  2⤵
  PID:6008
- C:\Windows\System\neTIbaO.exe
  C:\Windows\System\neTIbaO.exe
  2⤵
  PID:2344
- C:\Windows\System\GLaQisr.exe
  C:\Windows\System\GLaQisr.exe
  2⤵
  PID:4764
- C:\Windows\System\xcVMeno.exe
  C:\Windows\System\xcVMeno.exe
  2⤵
  PID:4108
- C:\Windows\System\ThbebBZ.exe
  C:\Windows\System\ThbebBZ.exe
  2⤵
  PID:4592
- C:\Windows\System\tWhtaUW.exe
  C:\Windows\System\tWhtaUW.exe
  2⤵
  PID:2828
- C:\Windows\System\CfYVFsv.exe
  C:\Windows\System\CfYVFsv.exe
  2⤵
  PID:6116
- C:\Windows\System\PmzKOsm.exe
  C:\Windows\System\PmzKOsm.exe
  2⤵
  PID:628
- C:\Windows\System\WJkBxGZ.exe
  C:\Windows\System\WJkBxGZ.exe
  2⤵
  PID:5352
- C:\Windows\System\aBJsxVE.exe
  C:\Windows\System\aBJsxVE.exe
  2⤵
  PID:5956
- C:\Windows\System\rAulNPQ.exe
  C:\Windows\System\rAulNPQ.exe
  2⤵
  PID:6024
- C:\Windows\System\lRIdueu.exe
  C:\Windows\System\lRIdueu.exe
  2⤵
  PID:4368
- C:\Windows\System\SeGldKA.exe
  C:\Windows\System\SeGldKA.exe
  2⤵
  PID:4864
- C:\Windows\System\LOPLrTq.exe
  C:\Windows\System\LOPLrTq.exe
  2⤵
  PID:3448
- C:\Windows\System\ynhRRyW.exe
  C:\Windows\System\ynhRRyW.exe
  2⤵
  PID:4600
- C:\Windows\System\ywFoUQs.exe
  C:\Windows\System\ywFoUQs.exe
  2⤵
  PID:5100
- C:\Windows\System\bXezDGL.exe
  C:\Windows\System\bXezDGL.exe
  2⤵
  PID:2180
- C:\Windows\System\ZdihBQc.exe
  C:\Windows\System\ZdihBQc.exe
  2⤵
  PID:1036
- C:\Windows\System\xuaPbtE.exe
  C:\Windows\System\xuaPbtE.exe
  2⤵
  PID:5640
- C:\Windows\System\yBClOIl.exe
  C:\Windows\System\yBClOIl.exe
  2⤵
  PID:6072
- C:\Windows\System\uXRONfo.exe
  C:\Windows\System\uXRONfo.exe
  2⤵
  PID:2684
- C:\Windows\System\hsDVZJr.exe
  C:\Windows\System\hsDVZJr.exe
  2⤵
  PID:6104
- C:\Windows\System\GhnqqCe.exe
  C:\Windows\System\GhnqqCe.exe
  2⤵
  PID:5188
- C:\Windows\System\KjetwWg.exe
  C:\Windows\System\KjetwWg.exe
  2⤵
  PID:1740
- C:\Windows\System\MxfMaAc.exe
  C:\Windows\System\MxfMaAc.exe
  2⤵
  PID:5268
- C:\Windows\System\ugzLMLg.exe
  C:\Windows\System\ugzLMLg.exe
  2⤵
  PID:5236
- C:\Windows\System\bjYeMYC.exe
  C:\Windows\System\bjYeMYC.exe
  2⤵
  PID:5524
- C:\Windows\System\bhTDSXS.exe
  C:\Windows\System\bhTDSXS.exe
  2⤵
  PID:5816
- C:\Windows\System\vNhRsah.exe
  C:\Windows\System\vNhRsah.exe
  2⤵
  PID:5972
- C:\Windows\System\wJflusb.exe
  C:\Windows\System\wJflusb.exe
  2⤵
  PID:5444
- C:\Windows\System\HsRBBTG.exe
  C:\Windows\System\HsRBBTG.exe
  2⤵
  PID:5396
- C:\Windows\System\YOYgBFf.exe
  C:\Windows\System\YOYgBFf.exe
  2⤵
  PID:4780
- C:\Windows\System\AeAcxlc.exe
  C:\Windows\System\AeAcxlc.exe
  2⤵
  PID:5752
- C:\Windows\System\CYnfAvl.exe
  C:\Windows\System\CYnfAvl.exe
  2⤵
  PID:5988
- C:\Windows\System\NqulxFG.exe
  C:\Windows\System\NqulxFG.exe
  2⤵
  PID:5160
- C:\Windows\System\ewtBupo.exe
  C:\Windows\System\ewtBupo.exe
  2⤵
  PID:6052
- C:\Windows\System\tnQKSQo.exe
  C:\Windows\System\tnQKSQo.exe
  2⤵
  PID:2952
- C:\Windows\System\bDfbDSP.exe
  C:\Windows\System\bDfbDSP.exe
  2⤵
  PID:2120
- C:\Windows\System\NIuhDae.exe
  C:\Windows\System\NIuhDae.exe
  2⤵
  PID:6056
- C:\Windows\System\igbPajO.exe
  C:\Windows\System\igbPajO.exe
  2⤵
  PID:5256
- C:\Windows\System\PdjJIsS.exe
  C:\Windows\System\PdjJIsS.exe
  2⤵
  PID:5736
- C:\Windows\System\xkHmuxj.exe
  C:\Windows\System\xkHmuxj.exe
  2⤵
  PID:4616
- C:\Windows\System\SuhPezu.exe
  C:\Windows\System\SuhPezu.exe
  2⤵
  PID:5560
- C:\Windows\System\UkPhbms.exe
  C:\Windows\System\UkPhbms.exe
  2⤵
  PID:4528
- C:\Windows\System\ZoIcyuL.exe
  C:\Windows\System\ZoIcyuL.exe
  2⤵
  PID:4296
- C:\Windows\System\wMuTCyA.exe
  C:\Windows\System\wMuTCyA.exe
  2⤵
  PID:3032
- C:\Windows\System\bIiaJzq.exe
  C:\Windows\System\bIiaJzq.exe
  2⤵
  PID:5496
- C:\Windows\System\IOarrIO.exe
  C:\Windows\System\IOarrIO.exe
  2⤵
  PID:2600
- C:\Windows\System\tsDcSRz.exe
  C:\Windows\System\tsDcSRz.exe
  2⤵
  PID:4140
- C:\Windows\System\HWuUxFa.exe
  C:\Windows\System\HWuUxFa.exe
  2⤵
  PID:4448
- C:\Windows\System\fBJalmR.exe
  C:\Windows\System\fBJalmR.exe
  2⤵
  PID:3936
- C:\Windows\System\pIooOsS.exe
  C:\Windows\System\pIooOsS.exe
  2⤵
  PID:5364
- C:\Windows\System\oLoBtEm.exe
  C:\Windows\System\oLoBtEm.exe
  2⤵
  PID:4156
- C:\Windows\System\ZdsLqwO.exe
  C:\Windows\System\ZdsLqwO.exe
  2⤵
  PID:5796
- C:\Windows\System\LhRpUEs.exe
  C:\Windows\System\LhRpUEs.exe
  2⤵
  PID:5892
- C:\Windows\System\tcBXKrp.exe
  C:\Windows\System\tcBXKrp.exe
  2⤵
  PID:2448
- C:\Windows\System\yaHwYXG.exe
  C:\Windows\System\yaHwYXG.exe
  2⤵
  PID:3000
- C:\Windows\System\tbTqDvZ.exe
  C:\Windows\System\tbTqDvZ.exe
  2⤵
  PID:2772
- C:\Windows\System\cghLAbt.exe
  C:\Windows\System\cghLAbt.exe
  2⤵
  PID:6152
- C:\Windows\System\lgqYsNr.exe
  C:\Windows\System\lgqYsNr.exe
  2⤵
  PID:6168
- C:\Windows\System\scXPEwA.exe
  C:\Windows\System\scXPEwA.exe
  2⤵
  PID:6184
- C:\Windows\System\YCtvuXT.exe
  C:\Windows\System\YCtvuXT.exe
  2⤵
  PID:6200
- C:\Windows\System\vbnpkZq.exe
  C:\Windows\System\vbnpkZq.exe
  2⤵
  PID:6216
- C:\Windows\System\BMulNuy.exe
  C:\Windows\System\BMulNuy.exe
  2⤵
  PID:6232
- C:\Windows\System\eNuHWuf.exe
  C:\Windows\System\eNuHWuf.exe
  2⤵
  PID:6248
- C:\Windows\System\WakfAoo.exe
  C:\Windows\System\WakfAoo.exe
  2⤵
  PID:6264
- C:\Windows\System\ndMjZRL.exe
  C:\Windows\System\ndMjZRL.exe
  2⤵
  PID:6280
- C:\Windows\System\SMIhIrx.exe
  C:\Windows\System\SMIhIrx.exe
  2⤵
  PID:6296
- C:\Windows\System\WgJnXJI.exe
  C:\Windows\System\WgJnXJI.exe
  2⤵
  PID:6312
- C:\Windows\System\CqXltnG.exe
  C:\Windows\System\CqXltnG.exe
  2⤵
  PID:6328
- C:\Windows\System\OcexkPE.exe
  C:\Windows\System\OcexkPE.exe
  2⤵
  PID:6344
- C:\Windows\System\NYadlXc.exe
  C:\Windows\System\NYadlXc.exe
  2⤵
  PID:6360
- C:\Windows\System\hHLlSvI.exe
  C:\Windows\System\hHLlSvI.exe
  2⤵
  PID:6376
- C:\Windows\System\WTXmIWW.exe
  C:\Windows\System\WTXmIWW.exe
  2⤵
  PID:6392
- C:\Windows\System\KsEtmzy.exe
  C:\Windows\System\KsEtmzy.exe
  2⤵
  PID:6408
- C:\Windows\System\pEsyVxz.exe
  C:\Windows\System\pEsyVxz.exe
  2⤵
  PID:6424
- C:\Windows\System\LnmbVgk.exe
  C:\Windows\System\LnmbVgk.exe
  2⤵
  PID:6440
- C:\Windows\System\oJgRrFg.exe
  C:\Windows\System\oJgRrFg.exe
  2⤵
  PID:6456
- C:\Windows\System\uFWyhfP.exe
  C:\Windows\System\uFWyhfP.exe
  2⤵
  PID:6472
- C:\Windows\System\tEyZIdi.exe
  C:\Windows\System\tEyZIdi.exe
  2⤵
  PID:6488
- C:\Windows\System\PxBsLwN.exe
  C:\Windows\System\PxBsLwN.exe
  2⤵
  PID:6504
- C:\Windows\System\KsQPmyW.exe
  C:\Windows\System\KsQPmyW.exe
  2⤵
  PID:6520
- C:\Windows\System\qsRpETe.exe
  C:\Windows\System\qsRpETe.exe
  2⤵
  PID:6536
- C:\Windows\System\QjwzJmi.exe
  C:\Windows\System\QjwzJmi.exe
  2⤵
  PID:6552
- C:\Windows\System\wIKoPhJ.exe
  C:\Windows\System\wIKoPhJ.exe
  2⤵
  PID:6568
- C:\Windows\System\tioMJjV.exe
  C:\Windows\System\tioMJjV.exe
  2⤵
  PID:6584
- C:\Windows\System\XFyJueU.exe
  C:\Windows\System\XFyJueU.exe
  2⤵
  PID:6600
- C:\Windows\System\mppkIRb.exe
  C:\Windows\System\mppkIRb.exe
  2⤵
  PID:6616
- C:\Windows\System\LuWqSlm.exe
  C:\Windows\System\LuWqSlm.exe
  2⤵
  PID:6632
- C:\Windows\System\MnvppYo.exe
  C:\Windows\System\MnvppYo.exe
  2⤵
  PID:6960
- C:\Windows\System\jUQmRtJ.exe
  C:\Windows\System\jUQmRtJ.exe
  2⤵
  PID:6976
- C:\Windows\System\gAtYRjj.exe
  C:\Windows\System\gAtYRjj.exe
  2⤵
  PID:7004
- C:\Windows\System\HnvXtVX.exe
  C:\Windows\System\HnvXtVX.exe
  2⤵
  PID:7064
- C:\Windows\System\ZUAFtDv.exe
  C:\Windows\System\ZUAFtDv.exe
  2⤵
  PID:7160
- C:\Windows\System\aSJOGZg.exe
  C:\Windows\System\aSJOGZg.exe
  2⤵
  PID:6180
- C:\Windows\System\nlOwVyd.exe
  C:\Windows\System\nlOwVyd.exe
  2⤵
  PID:6592
- C:\Windows\System\PGKzvCH.exe
  C:\Windows\System\PGKzvCH.exe
  2⤵
  PID:7144
- C:\Windows\System\XFSuvLm.exe
  C:\Windows\System\XFSuvLm.exe
  2⤵
  PID:7156
- C:\Windows\System\MeyoLNx.exe
  C:\Windows\System\MeyoLNx.exe
  2⤵
  PID:7104
- C:\Windows\System\gPzGgQg.exe
  C:\Windows\System\gPzGgQg.exe
  2⤵
  PID:5572
- C:\Windows\System\RTnuEym.exe
  C:\Windows\System\RTnuEym.exe
  2⤵
  PID:5508
- C:\Windows\System\sPKCPGZ.exe
  C:\Windows\System\sPKCPGZ.exe
  2⤵
  PID:1636
- C:\Windows\System\DdaAgvO.exe
  C:\Windows\System\DdaAgvO.exe
  2⤵
  PID:1124
- C:\Windows\System\vEKDtFc.exe
  C:\Windows\System\vEKDtFc.exe
  2⤵
  PID:6160
- C:\Windows\System\zNRoQQC.exe
  C:\Windows\System\zNRoQQC.exe
  2⤵
  PID:6224
- C:\Windows\System\IxwxiWa.exe
  C:\Windows\System\IxwxiWa.exe
  2⤵
  PID:6240
- C:\Windows\System\lqYtZUi.exe
  C:\Windows\System\lqYtZUi.exe
  2⤵
  PID:6276
- C:\Windows\System\AOwEfdL.exe
  C:\Windows\System\AOwEfdL.exe
  2⤵
  PID:6260
- C:\Windows\System\FcjvOsY.exe
  C:\Windows\System\FcjvOsY.exe
  2⤵
  PID:6288
- C:\Windows\System\AMhJqnF.exe
  C:\Windows\System\AMhJqnF.exe
  2⤵
  PID:6404
- C:\Windows\System\uhLlVQU.exe
  C:\Windows\System\uhLlVQU.exe
  2⤵
  PID:6388
- C:\Windows\System\rTIMCne.exe
  C:\Windows\System\rTIMCne.exe
  2⤵
  PID:6596
- C:\Windows\System\llPMzYr.exe
  C:\Windows\System\llPMzYr.exe
  2⤵
  PID:6576
- C:\Windows\System\VbWyktw.exe
  C:\Windows\System\VbWyktw.exe
  2⤵
  PID:1660
- C:\Windows\System\uEShqen.exe
  C:\Windows\System\uEShqen.exe
  2⤵
  PID:6644
- C:\Windows\System\pUtuQxf.exe
  C:\Windows\System\pUtuQxf.exe
  2⤵
  PID:6660
- C:\Windows\System\cJnaaUq.exe
  C:\Windows\System\cJnaaUq.exe
  2⤵
  PID:6500
- C:\Windows\System\hjuEfPW.exe
  C:\Windows\System\hjuEfPW.exe
  2⤵
  PID:332
- C:\Windows\System\qWmfJxd.exe
  C:\Windows\System\qWmfJxd.exe
  2⤵
  PID:1632
- C:\Windows\System\ZpfXWqd.exe
  C:\Windows\System\ZpfXWqd.exe
  2⤵
  PID:6676
- C:\Windows\System\fJtTTLw.exe
  C:\Windows\System\fJtTTLw.exe
  2⤵
  PID:6688
- C:\Windows\System\TMftcAx.exe
  C:\Windows\System\TMftcAx.exe
  2⤵
  PID:6716
- C:\Windows\System\MKpNfCh.exe
  C:\Windows\System\MKpNfCh.exe
  2⤵
  PID:6728
- C:\Windows\System\qsZPsGm.exe
  C:\Windows\System\qsZPsGm.exe
  2⤵
  PID:6752
- C:\Windows\System\rtpOJry.exe
  C:\Windows\System\rtpOJry.exe
  2⤵
  PID:6768
- C:\Windows\System\XnIkgUf.exe
  C:\Windows\System\XnIkgUf.exe
  2⤵
  PID:6784
- C:\Windows\System\cAnjZjw.exe
  C:\Windows\System\cAnjZjw.exe
  2⤵
  PID:6804
- C:\Windows\System\KwioYNn.exe
  C:\Windows\System\KwioYNn.exe
  2⤵
  PID:6820
- C:\Windows\System\BdkJUYx.exe
  C:\Windows\System\BdkJUYx.exe
  2⤵
  PID:6844
- C:\Windows\System\YDUuexk.exe
  C:\Windows\System\YDUuexk.exe
  2⤵
  PID:6860
- C:\Windows\System\EycnSEZ.exe
  C:\Windows\System\EycnSEZ.exe
  2⤵
  PID:6876
- C:\Windows\System\GAhCpYt.exe
  C:\Windows\System\GAhCpYt.exe
  2⤵
  PID:6896
- C:\Windows\System\EhtDoBg.exe
  C:\Windows\System\EhtDoBg.exe
  2⤵
  PID:6908
- C:\Windows\System\LxqPJPB.exe
  C:\Windows\System\LxqPJPB.exe
  2⤵
  PID:6920
- C:\Windows\System\IWjMEKr.exe
  C:\Windows\System\IWjMEKr.exe
  2⤵
  PID:6948
- C:\Windows\System\RnxjEQX.exe
  C:\Windows\System\RnxjEQX.exe
  2⤵
  PID:6996
- C:\Windows\System\DIAxaiX.exe
  C:\Windows\System\DIAxaiX.exe
  2⤵
  PID:7040
- C:\Windows\System\EvQKraO.exe
  C:\Windows\System\EvQKraO.exe
  2⤵
  PID:7048
- C:\Windows\System\ZMnJGNc.exe
  C:\Windows\System\ZMnJGNc.exe
  2⤵
  PID:7072
- C:\Windows\System\xWKPqFk.exe
  C:\Windows\System\xWKPqFk.exe
  2⤵
  PID:7096
- C:\Windows\System\LKcwZCC.exe
  C:\Windows\System\LKcwZCC.exe
  2⤵
  PID:7128
- C:\Windows\System\OTNLVdc.exe
  C:\Windows\System\OTNLVdc.exe
  2⤵
  PID:2860
- C:\Windows\System\PMjKZoZ.exe
  C:\Windows\System\PMjKZoZ.exe
  2⤵
  PID:2888
- C:\Windows\System\lqhVpaJ.exe
  C:\Windows\System\lqhVpaJ.exe
  2⤵
  PID:6148
- C:\Windows\System\rOluxjn.exe
  C:\Windows\System\rOluxjn.exe
  2⤵
  PID:3376
- C:\Windows\System\KNOkgwG.exe
  C:\Windows\System\KNOkgwG.exe
  2⤵
  PID:6228
- C:\Windows\System\bNkUjqI.exe
  C:\Windows\System\bNkUjqI.exe
  2⤵
  PID:6372
- C:\Windows\System\jRjBemz.exe
  C:\Windows\System\jRjBemz.exe
  2⤵
  PID:6256
- C:\Windows\System\FmysinE.exe
  C:\Windows\System\FmysinE.exe
  2⤵
  PID:6548
- C:\Windows\System\hgfHIvy.exe
  C:\Windows\System\hgfHIvy.exe
  2⤵
  PID:3352
- C:\Windows\System\bvlimUT.exe
  C:\Windows\System\bvlimUT.exe
  2⤵
  PID:5252
- C:\Windows\System\MVvtcbQ.exe
  C:\Windows\System\MVvtcbQ.exe
  2⤵
  PID:2484
- C:\Windows\System\aXLVkdD.exe
  C:\Windows\System\aXLVkdD.exe
  2⤵
  PID:6664
- C:\Windows\System\hPXhRCp.exe
  C:\Windows\System\hPXhRCp.exe
  2⤵
  PID:6292
- C:\Windows\System\DNoCBtz.exe
  C:\Windows\System\DNoCBtz.exe
  2⤵
  PID:6612
- C:\Windows\System\BfgJdQs.exe
  C:\Windows\System\BfgJdQs.exe
  2⤵
  PID:6496
- C:\Windows\System\RupcpUW.exe
  C:\Windows\System\RupcpUW.exe
  2⤵
  PID:2744
- C:\Windows\System\aGmSizf.exe
  C:\Windows\System\aGmSizf.exe
  2⤵
  PID:6516
- C:\Windows\System\yWBlXLn.exe
  C:\Windows\System\yWBlXLn.exe
  2⤵
  PID:1544
- C:\Windows\System\xOfyiWE.exe
  C:\Windows\System\xOfyiWE.exe
  2⤵
  PID:6704
- C:\Windows\System\uatTmVf.exe
  C:\Windows\System\uatTmVf.exe
  2⤵
  PID:6748
- C:\Windows\System\GrQbbHI.exe
  C:\Windows\System\GrQbbHI.exe
  2⤵
  PID:6780
- C:\Windows\System\YtkUvfL.exe
  C:\Windows\System\YtkUvfL.exe
  2⤵
  PID:6852
- C:\Windows\System\nlaMXkU.exe
  C:\Windows\System\nlaMXkU.exe
  2⤵
  PID:6888
- C:\Windows\System\INRNDDJ.exe
  C:\Windows\System\INRNDDJ.exe
  2⤵
  PID:2300
- C:\Windows\System\FKBNkXa.exe
  C:\Windows\System\FKBNkXa.exe
  2⤵
  PID:6868
- C:\Windows\System\uoomqoc.exe
  C:\Windows\System\uoomqoc.exe
  2⤵
  PID:6796
- C:\Windows\System\OmAXMGE.exe
  C:\Windows\System\OmAXMGE.exe
  2⤵
  PID:6824
- C:\Windows\System\YfQdbeE.exe
  C:\Windows\System\YfQdbeE.exe
  2⤵
  PID:7092
- C:\Windows\System\ecRLNSe.exe
  C:\Windows\System\ecRLNSe.exe
  2⤵
  PID:2480
- C:\Windows\System\AaHzuXJ.exe
  C:\Windows\System\AaHzuXJ.exe
  2⤵
  PID:6932
- C:\Windows\System\UYSENSh.exe
  C:\Windows\System\UYSENSh.exe
  2⤵
  PID:7044
- C:\Windows\System\smWiGqW.exe
  C:\Windows\System\smWiGqW.exe
  2⤵
  PID:7024
- C:\Windows\System\XAFnTyR.exe
  C:\Windows\System\XAFnTyR.exe
  2⤵
  PID:6564
- C:\Windows\System\DPkCisO.exe
  C:\Windows\System\DPkCisO.exe
  2⤵
  PID:6036
- C:\Windows\System\xxRbRpo.exe
  C:\Windows\System\xxRbRpo.exe
  2⤵
  PID:4912
- C:\Windows\System\eiPUSEe.exe
  C:\Windows\System\eiPUSEe.exe
  2⤵
  PID:6712
- C:\Windows\System\BsJusAG.exe
  C:\Windows\System\BsJusAG.exe
  2⤵
  PID:6968
- C:\Windows\System\uzEoYkU.exe
  C:\Windows\System\uzEoYkU.exe
  2⤵
  PID:6692
- C:\Windows\System\qIidgcb.exe
  C:\Windows\System\qIidgcb.exe
  2⤵
  PID:6432
- C:\Windows\System\ikNqirL.exe
  C:\Windows\System\ikNqirL.exe
  2⤵
  PID:6872
- C:\Windows\System\FRAhyMM.exe
  C:\Windows\System\FRAhyMM.exe
  2⤵
  PID:6724
- C:\Windows\System\LkrYjlv.exe
  C:\Windows\System\LkrYjlv.exe
  2⤵
  PID:6988
- C:\Windows\System\mswKqtO.exe
  C:\Windows\System\mswKqtO.exe
  2⤵
  PID:2492
- C:\Windows\System\EYMWASd.exe
  C:\Windows\System\EYMWASd.exe
  2⤵
  PID:2928
- C:\Windows\System\zwOeglr.exe
  C:\Windows\System\zwOeglr.exe
  2⤵
  PID:6944
- C:\Windows\System\seyDvmp.exe
  C:\Windows\System\seyDvmp.exe
  2⤵
  PID:1548
- C:\Windows\System\bPwTFkc.exe
  C:\Windows\System\bPwTFkc.exe
  2⤵
  PID:7192
- C:\Windows\System\QfaIWxW.exe
  C:\Windows\System\QfaIWxW.exe
  2⤵
  PID:7212
- C:\Windows\System\XnkpLnG.exe
  C:\Windows\System\XnkpLnG.exe
  2⤵
  PID:7232
- C:\Windows\System\MDCMHcE.exe
  C:\Windows\System\MDCMHcE.exe
  2⤵
  PID:7252
- C:\Windows\System\JSRqfXp.exe
  C:\Windows\System\JSRqfXp.exe
  2⤵
  PID:7276
- C:\Windows\System\kBMzJkd.exe
  C:\Windows\System\kBMzJkd.exe
  2⤵
  PID:7292
- C:\Windows\System\MGsfbnU.exe
  C:\Windows\System\MGsfbnU.exe
  2⤵
  PID:7312
- C:\Windows\System\unsXxtD.exe
  C:\Windows\System\unsXxtD.exe
  2⤵
  PID:7332
- C:\Windows\System\boicjDU.exe
  C:\Windows\System\boicjDU.exe
  2⤵
  PID:7356
- C:\Windows\System\MwZdlkR.exe
  C:\Windows\System\MwZdlkR.exe
  2⤵
  PID:7380
- C:\Windows\System\NYXpMxL.exe
  C:\Windows\System\NYXpMxL.exe
  2⤵
  PID:7404
- C:\Windows\System\BSjlbJE.exe
  C:\Windows\System\BSjlbJE.exe
  2⤵
  PID:7424
- C:\Windows\System\yMbHTmj.exe
  C:\Windows\System\yMbHTmj.exe
  2⤵
  PID:7444
- C:\Windows\System\mcVxYrI.exe
  C:\Windows\System\mcVxYrI.exe
  2⤵
  PID:7464
- C:\Windows\System\RMsFLqf.exe
  C:\Windows\System\RMsFLqf.exe
  2⤵
  PID:7480
- C:\Windows\System\cQYhQRt.exe
  C:\Windows\System\cQYhQRt.exe
  2⤵
  PID:7504
- C:\Windows\System\aghVFaI.exe
  C:\Windows\System\aghVFaI.exe
  2⤵
  PID:7528
- C:\Windows\System\AXOoVMV.exe
  C:\Windows\System\AXOoVMV.exe
  2⤵
  PID:7548
- C:\Windows\System\PpAqOzs.exe
  C:\Windows\System\PpAqOzs.exe
  2⤵
  PID:7568
- C:\Windows\System\MxWwecM.exe
  C:\Windows\System\MxWwecM.exe
  2⤵
  PID:7592
- C:\Windows\System\fdQcOyd.exe
  C:\Windows\System\fdQcOyd.exe
  2⤵
  PID:7612
- C:\Windows\System\IXGlxcL.exe
  C:\Windows\System\IXGlxcL.exe
  2⤵
  PID:7628
- C:\Windows\System\LYjcGVf.exe
  C:\Windows\System\LYjcGVf.exe
  2⤵
  PID:7652
- C:\Windows\System\duBDVbJ.exe
  C:\Windows\System\duBDVbJ.exe
  2⤵
  PID:7672
- C:\Windows\System\KbaUlrn.exe
  C:\Windows\System\KbaUlrn.exe
  2⤵
  PID:7696
- C:\Windows\System\ZWinMYH.exe
  C:\Windows\System\ZWinMYH.exe
  2⤵
  PID:7716
- C:\Windows\System\ZSmzEYi.exe
  C:\Windows\System\ZSmzEYi.exe
  2⤵
  PID:7736
- C:\Windows\System\aGvGVDQ.exe
  C:\Windows\System\aGvGVDQ.exe
  2⤵
  PID:7760
- C:\Windows\System\JWfJsyJ.exe
  C:\Windows\System\JWfJsyJ.exe
  2⤵
  PID:7784
- C:\Windows\System\hgtBcaA.exe
  C:\Windows\System\hgtBcaA.exe
  2⤵
  PID:7800
- C:\Windows\System\MlpkFnz.exe
  C:\Windows\System\MlpkFnz.exe
  2⤵
  PID:7820
- C:\Windows\System\QWSaSpD.exe
  C:\Windows\System\QWSaSpD.exe
  2⤵
  PID:7840
- C:\Windows\System\iqIXvTf.exe
  C:\Windows\System\iqIXvTf.exe
  2⤵
  PID:7868
- C:\Windows\System\RblTeXi.exe
  C:\Windows\System\RblTeXi.exe
  2⤵
  PID:7884
- C:\Windows\System\AsNMtRm.exe
  C:\Windows\System\AsNMtRm.exe
  2⤵
  PID:7908
- C:\Windows\System\tIjXpYn.exe
  C:\Windows\System\tIjXpYn.exe
  2⤵
  PID:7932
- C:\Windows\System\RlfQTuJ.exe
  C:\Windows\System\RlfQTuJ.exe
  2⤵
  PID:7964
- C:\Windows\System\xOREsZp.exe
  C:\Windows\System\xOREsZp.exe
  2⤵
  PID:7992
- C:\Windows\System\rDgUPis.exe
  C:\Windows\System\rDgUPis.exe
  2⤵
  PID:8020
- C:\Windows\System\noHQleR.exe
  C:\Windows\System\noHQleR.exe
  2⤵
  PID:8036
- C:\Windows\System\WGmWZuO.exe
  C:\Windows\System\WGmWZuO.exe
  2⤵
  PID:8060
- C:\Windows\System\QYqmFIN.exe
  C:\Windows\System\QYqmFIN.exe
  2⤵
  PID:8080
- C:\Windows\System\ewOBwey.exe
  C:\Windows\System\ewOBwey.exe
  2⤵
  PID:8104
- C:\Windows\System\MxeGUwf.exe
  C:\Windows\System\MxeGUwf.exe
  2⤵
  PID:8120
- C:\Windows\System\HKCczfp.exe
  C:\Windows\System\HKCczfp.exe
  2⤵
  PID:8140
- C:\Windows\System\dysuopx.exe
  C:\Windows\System\dysuopx.exe
  2⤵
  PID:8156
- C:\Windows\System\JAkrJeH.exe
  C:\Windows\System\JAkrJeH.exe
  2⤵
  PID:8180
- C:\Windows\System\MaguxrE.exe
  C:\Windows\System\MaguxrE.exe
  2⤵
  PID:7224
- C:\Windows\System\BSmEVJn.exe
  C:\Windows\System\BSmEVJn.exe
  2⤵
  PID:7260
- C:\Windows\System\FxDvaLN.exe
  C:\Windows\System\FxDvaLN.exe
  2⤵
  PID:7300
- C:\Windows\System\PoumCuV.exe
  C:\Windows\System\PoumCuV.exe
  2⤵
  PID:7340
- C:\Windows\System\qDXpOga.exe
  C:\Windows\System\qDXpOga.exe
  2⤵
  PID:7348
- C:\Windows\System\UtNRgXz.exe
  C:\Windows\System\UtNRgXz.exe
  2⤵
  PID:7400
- C:\Windows\System\inJMfiP.exe
  C:\Windows\System\inJMfiP.exe
  2⤵
  PID:7436
- C:\Windows\System\HsEFYbG.exe
  C:\Windows\System\HsEFYbG.exe
  2⤵
  PID:7516
- C:\Windows\System\dKTLFYx.exe
  C:\Windows\System\dKTLFYx.exe
  2⤵
  PID:7148
- C:\Windows\System\nfYIesm.exe
  C:\Windows\System\nfYIesm.exe
  2⤵
  PID:7600
- C:\Windows\System\WFCMnmZ.exe
  C:\Windows\System\WFCMnmZ.exe
  2⤵
  PID:7636
- C:\Windows\System\yrxsYaO.exe
  C:\Windows\System\yrxsYaO.exe
  2⤵
  PID:1580
- C:\Windows\System\yoWLNda.exe
  C:\Windows\System\yoWLNda.exe
  2⤵
  PID:7692
- C:\Windows\System\VgsQyjM.exe
  C:\Windows\System\VgsQyjM.exe
  2⤵
  PID:2652
- C:\Windows\System\FKNaPlx.exe
  C:\Windows\System\FKNaPlx.exe
  2⤵
  PID:6628
- C:\Windows\System\RwoCNmJ.exe
  C:\Windows\System\RwoCNmJ.exe
  2⤵
  PID:7732
- C:\Windows\System\JjIuWAj.exe
  C:\Windows\System\JjIuWAj.exe
  2⤵
  PID:6528
- C:\Windows\System\FtFrBwx.exe
  C:\Windows\System\FtFrBwx.exe
  2⤵
  PID:804
- C:\Windows\System\fLKVjIa.exe
  C:\Windows\System\fLKVjIa.exe
  2⤵
  PID:6788
- C:\Windows\System\GiKsVgF.exe
  C:\Windows\System\GiKsVgF.exe
  2⤵
  PID:7456
- C:\Windows\System\BDofEFl.exe
  C:\Windows\System\BDofEFl.exe
  2⤵
  PID:4880
- C:\Windows\System\yCHzKlg.exe
  C:\Windows\System\yCHzKlg.exe
  2⤵
  PID:7812
- C:\Windows\System\UBhCslx.exe
  C:\Windows\System\UBhCslx.exe
  2⤵
  PID:7668
- C:\Windows\System\Cfqixne.exe
  C:\Windows\System\Cfqixne.exe
  2⤵
  PID:6484
- C:\Windows\System\vQmEWjc.exe
  C:\Windows\System\vQmEWjc.exe
  2⤵
  PID:6420
- C:\Windows\System\oLBvwEe.exe
  C:\Windows\System\oLBvwEe.exe
  2⤵
  PID:6816
- C:\Windows\System\dcMSFbH.exe
  C:\Windows\System\dcMSFbH.exe
  2⤵
  PID:6760
- C:\Windows\System\imgztVV.exe
  C:\Windows\System\imgztVV.exe
  2⤵
  PID:7080
- C:\Windows\System\ULatHDZ.exe
  C:\Windows\System\ULatHDZ.exe
  2⤵
  PID:7856
- C:\Windows\System\SugiiHN.exe
  C:\Windows\System\SugiiHN.exe
  2⤵
  PID:7896
- C:\Windows\System\ZwoyHpF.exe
  C:\Windows\System\ZwoyHpF.exe
  2⤵
  PID:7940
- C:\Windows\System\nsXTGhA.exe
  C:\Windows\System\nsXTGhA.exe
  2⤵
  PID:7944
- C:\Windows\System\rPZucaR.exe
  C:\Windows\System\rPZucaR.exe
  2⤵
  PID:7100
- C:\Windows\System\uqdLOum.exe
  C:\Windows\System\uqdLOum.exe
  2⤵
  PID:7500
- C:\Windows\System\gJDTFhs.exe
  C:\Windows\System\gJDTFhs.exe
  2⤵
  PID:1888
- C:\Windows\System\BzzNoOb.exe
  C:\Windows\System\BzzNoOb.exe
  2⤵
  PID:7120
- C:\Windows\System\SIVdGcw.exe
  C:\Windows\System\SIVdGcw.exe
  2⤵
  PID:7832
- C:\Windows\System\AGOhzye.exe
  C:\Windows\System\AGOhzye.exe
  2⤵
  PID:7712
- C:\Windows\System\MXYYDHP.exe
  C:\Windows\System\MXYYDHP.exe
  2⤵
  PID:7880
- C:\Windows\System\yIbGLSl.exe
  C:\Windows\System\yIbGLSl.exe
  2⤵
  PID:7924
- C:\Windows\System\zTvrMWA.exe
  C:\Windows\System\zTvrMWA.exe
  2⤵
  PID:7976
- C:\Windows\System\ZkTYmre.exe
  C:\Windows\System\ZkTYmre.exe
  2⤵
  PID:8164
- C:\Windows\System\uwYlndo.exe
  C:\Windows\System\uwYlndo.exe
  2⤵
  PID:8176
- C:\Windows\System\GTTQaYd.exe
  C:\Windows\System\GTTQaYd.exe
  2⤵
  PID:8148
- C:\Windows\System\ybYspdN.exe
  C:\Windows\System\ybYspdN.exe
  2⤵
  PID:7184
- C:\Windows\System\LRLgkUY.exe
  C:\Windows\System\LRLgkUY.exe
  2⤵
  PID:7116
- C:\Windows\System\cMomvcE.exe
  C:\Windows\System\cMomvcE.exe
  2⤵
  PID:6560
- C:\Windows\System\dRHROji.exe
  C:\Windows\System\dRHROji.exe
  2⤵
  PID:7396
- C:\Windows\System\IWAYecn.exe
  C:\Windows\System\IWAYecn.exe
  2⤵
  PID:7272
- C:\Windows\System\nMWasUG.exe
  C:\Windows\System\nMWasUG.exe
  2⤵
  PID:7524
- C:\Windows\System\TmRlYNb.exe
  C:\Windows\System\TmRlYNb.exe
  2⤵
  PID:7564
- C:\Windows\System\aZZTyso.exe
  C:\Windows\System\aZZTyso.exe
  2⤵
  PID:2844
- C:\Windows\System\mDBYeIZ.exe
  C:\Windows\System\mDBYeIZ.exe
  2⤵
  PID:7776
- C:\Windows\System\DRnrsei.exe
  C:\Windows\System\DRnrsei.exe
  2⤵
  PID:7780
- C:\Windows\System\QBbJgPW.exe
  C:\Windows\System\QBbJgPW.exe
  2⤵
  PID:7852
- C:\Windows\System\WdQeDYA.exe
  C:\Windows\System\WdQeDYA.exe
  2⤵
  PID:6836
- C:\Windows\System\HyfJNXl.exe
  C:\Windows\System\HyfJNXl.exe
  2⤵
  PID:7952
- C:\Windows\System\OrbZElE.exe
  C:\Windows\System\OrbZElE.exe
  2⤵
  PID:7624
- C:\Windows\System\LhjjUlF.exe
  C:\Windows\System\LhjjUlF.exe
  2⤵
  PID:6984
- C:\Windows\System\wicmqSp.exe
  C:\Windows\System\wicmqSp.exe
  2⤵
  PID:2472
- C:\Windows\System\IfDuRsq.exe
  C:\Windows\System\IfDuRsq.exe
  2⤵
  PID:7492
- C:\Windows\System\yPrpDMf.exe
  C:\Windows\System\yPrpDMf.exe
  2⤵
  PID:2512
- C:\Windows\System\GMZTvyd.exe
  C:\Windows\System\GMZTvyd.exe
  2⤵
  PID:7012
- C:\Windows\System\uWzmopm.exe
  C:\Windows\System\uWzmopm.exe
  2⤵
  PID:7460
- C:\Windows\System\zVKhyRK.exe
  C:\Windows\System\zVKhyRK.exe
  2⤵
  PID:8000
- C:\Windows\System\RXOUXBb.exe
  C:\Windows\System\RXOUXBb.exe
  2⤵
  PID:7328
- C:\Windows\System\fCgHuEG.exe
  C:\Windows\System\fCgHuEG.exe
  2⤵
  PID:7200
- C:\Windows\System\yEUigAg.exe
  C:\Windows\System\yEUigAg.exe
  2⤵
  PID:7288
- C:\Windows\System\vlJwvPy.exe
  C:\Windows\System\vlJwvPy.exe
  2⤵
  PID:7412
- C:\Windows\System\SThtnVG.exe
  C:\Windows\System\SThtnVG.exe
  2⤵
  PID:8012
- C:\Windows\System\eLXeWhl.exe
  C:\Windows\System\eLXeWhl.exe
  2⤵
  PID:8048
- C:\Windows\System\scBiAim.exe
  C:\Windows\System\scBiAim.exe
  2⤵
  PID:7588
- C:\Windows\System\pVYskZA.exe
  C:\Windows\System\pVYskZA.exe
  2⤵
  PID:7708
- C:\Windows\System\oakESeN.exe
  C:\Windows\System\oakESeN.exe
  2⤵
  PID:7916
- C:\Windows\System\MbWdEJQ.exe
  C:\Windows\System\MbWdEJQ.exe
  2⤵
  PID:8100
- C:\Windows\System\aYWjDSP.exe
  C:\Windows\System\aYWjDSP.exe
  2⤵
  PID:7620
- C:\Windows\System\cKBNrde.exe
  C:\Windows\System\cKBNrde.exe
  2⤵
  PID:8028
- C:\Windows\System\PdksCwz.exe
  C:\Windows\System\PdksCwz.exe
  2⤵
  PID:8188
- C:\Windows\System\mkyrQnE.exe
  C:\Windows\System\mkyrQnE.exe
  2⤵
  PID:664
- C:\Windows\System\NLqwGGd.exe
  C:\Windows\System\NLqwGGd.exe
  2⤵
  PID:7440
- C:\Windows\System\NbLGOXV.exe
  C:\Windows\System\NbLGOXV.exe
  2⤵
  PID:7268
- C:\Windows\System\mHnAqZt.exe
  C:\Windows\System\mHnAqZt.exe
  2⤵
  PID:6928
- C:\Windows\System\FkCNAic.exe
  C:\Windows\System\FkCNAic.exe
  2⤵
  PID:7028
- C:\Windows\System\CmEOViu.exe
  C:\Windows\System\CmEOViu.exe
  2⤵
  PID:6916
- C:\Windows\System\xNpJaKf.exe
  C:\Windows\System\xNpJaKf.exe
  2⤵
  PID:7904
- C:\Windows\System\FTgKJOk.exe
  C:\Windows\System\FTgKJOk.exe
  2⤵
  PID:7452
- C:\Windows\System\HEntosQ.exe
  C:\Windows\System\HEntosQ.exe
  2⤵
  PID:2556
- C:\Windows\System\GpbojQZ.exe
  C:\Windows\System\GpbojQZ.exe
  2⤵
  PID:6912
- C:\Windows\System\dEcVNrU.exe
  C:\Windows\System\dEcVNrU.exe
  2⤵
  PID:7204
- C:\Windows\System\CqIuKeo.exe
  C:\Windows\System\CqIuKeo.exe
  2⤵
  PID:7248
- C:\Windows\System\lSqVCeL.exe
  C:\Windows\System\lSqVCeL.exe
  2⤵
  PID:6776
- C:\Windows\System\zAueMCR.exe
  C:\Windows\System\zAueMCR.exe
  2⤵
  PID:7420
- C:\Windows\System\QyksbIX.exe
  C:\Windows\System\QyksbIX.exe
  2⤵
  PID:7544
- C:\Windows\System\dmFkNIX.exe
  C:\Windows\System\dmFkNIX.exe
  2⤵
  PID:8132
- C:\Windows\System\BMIQZph.exe
  C:\Windows\System\BMIQZph.exe
  2⤵
  PID:8056
- C:\Windows\System\gUBDixr.exe
  C:\Windows\System\gUBDixr.exe
  2⤵
  PID:8092
- C:\Windows\System\zCAobsl.exe
  C:\Windows\System\zCAobsl.exe
  2⤵
  PID:1964
- C:\Windows\System\SvCzpqw.exe
  C:\Windows\System\SvCzpqw.exe
  2⤵
  PID:1424
- C:\Windows\System\OBfItip.exe
  C:\Windows\System\OBfItip.exe
  2⤵
  PID:2288
- C:\Windows\System\PgsxhWa.exe
  C:\Windows\System\PgsxhWa.exe
  2⤵
  PID:7392
- C:\Windows\System\CpzBXbd.exe
  C:\Windows\System\CpzBXbd.exe
  2⤵
  PID:1776
- C:\Windows\System\moOdkBs.exe
  C:\Windows\System\moOdkBs.exe
  2⤵
  PID:8072
- C:\Windows\System\xLLbIDB.exe
  C:\Windows\System\xLLbIDB.exe
  2⤵
  PID:7756
- C:\Windows\System\oqifdeZ.exe
  C:\Windows\System\oqifdeZ.exe
  2⤵
  PID:7660
- C:\Windows\System\IzKAuKH.exe
  C:\Windows\System\IzKAuKH.exe
  2⤵
  PID:7796
- C:\Windows\System\RxVQpvI.exe
  C:\Windows\System\RxVQpvI.exe
  2⤵
  PID:7828
- C:\Windows\System\FLylqCh.exe
  C:\Windows\System\FLylqCh.exe
  2⤵
  PID:7488
- C:\Windows\System\uEltHMb.exe
  C:\Windows\System\uEltHMb.exe
  2⤵
  PID:7680
- C:\Windows\System\UJwmdyI.exe
  C:\Windows\System\UJwmdyI.exe
  2⤵
  PID:7364
- C:\Windows\System\YlmipVP.exe
  C:\Windows\System\YlmipVP.exe
  2⤵
  PID:7876
- C:\Windows\System\nMcXXRe.exe
  C:\Windows\System\nMcXXRe.exe
  2⤵
  PID:6340
- C:\Windows\System\gacFLXG.exe
  C:\Windows\System\gacFLXG.exe
  2⤵
  PID:7988
- C:\Windows\System\AesCkke.exe
  C:\Windows\System\AesCkke.exe
  2⤵
  PID:8208
- C:\Windows\System\lqkVrSE.exe
  C:\Windows\System\lqkVrSE.exe
  2⤵
  PID:8224
- C:\Windows\System\IWoitDx.exe
  C:\Windows\System\IWoitDx.exe
  2⤵
  PID:8240
- C:\Windows\System\bXmedBV.exe
  C:\Windows\System\bXmedBV.exe
  2⤵
  PID:8256
- C:\Windows\System\gMpTshf.exe
  C:\Windows\System\gMpTshf.exe
  2⤵
  PID:8272
- C:\Windows\System\DXqihlJ.exe
  C:\Windows\System\DXqihlJ.exe
  2⤵
  PID:8288
- C:\Windows\System\sUVjOXG.exe
  C:\Windows\System\sUVjOXG.exe
  2⤵
  PID:8304
- C:\Windows\System\TQLgrTJ.exe
  C:\Windows\System\TQLgrTJ.exe
  2⤵
  PID:8320
- C:\Windows\System\DMNXrKx.exe
  C:\Windows\System\DMNXrKx.exe
  2⤵
  PID:8344
- C:\Windows\System\BoxBGjx.exe
  C:\Windows\System\BoxBGjx.exe
  2⤵
  PID:8360
- C:\Windows\System\kYKyXuX.exe
  C:\Windows\System\kYKyXuX.exe
  2⤵
  PID:8380
- C:\Windows\System\lQzAaYX.exe
  C:\Windows\System\lQzAaYX.exe
  2⤵
  PID:8400
- C:\Windows\System\evzzvcT.exe
  C:\Windows\System\evzzvcT.exe
  2⤵
  PID:8420
- C:\Windows\System\vCisWdu.exe
  C:\Windows\System\vCisWdu.exe
  2⤵
  PID:8436
- C:\Windows\System\kaARwBF.exe
  C:\Windows\System\kaARwBF.exe
  2⤵
  PID:8456
- C:\Windows\System\eGMHUEV.exe
  C:\Windows\System\eGMHUEV.exe
  2⤵
  PID:8472
- C:\Windows\System\DwVZCQu.exe
  C:\Windows\System\DwVZCQu.exe
  2⤵
  PID:8492
- C:\Windows\System\uwgmDqT.exe
  C:\Windows\System\uwgmDqT.exe
  2⤵
  PID:8568
- C:\Windows\System\wtnNypz.exe
  C:\Windows\System\wtnNypz.exe
  2⤵
  PID:8584
- C:\Windows\System\KvvCTwZ.exe
  C:\Windows\System\KvvCTwZ.exe
  2⤵
  PID:8600
- C:\Windows\System\DAnczXg.exe
  C:\Windows\System\DAnczXg.exe
  2⤵
  PID:8616
- C:\Windows\System\ayPYOKH.exe
  C:\Windows\System\ayPYOKH.exe
  2⤵
  PID:8632
- C:\Windows\System\PDvUcOl.exe
  C:\Windows\System\PDvUcOl.exe
  2⤵
  PID:8664
- C:\Windows\System\rPGfUIk.exe
  C:\Windows\System\rPGfUIk.exe
  2⤵
  PID:8680
- C:\Windows\System\RvFhUAu.exe
  C:\Windows\System\RvFhUAu.exe
  2⤵
  PID:8696
- C:\Windows\System\mVUVUqn.exe
  C:\Windows\System\mVUVUqn.exe
  2⤵
  PID:8716
- C:\Windows\System\dDBVVbo.exe
  C:\Windows\System\dDBVVbo.exe
  2⤵
  PID:8732
- C:\Windows\System\DBkqtHT.exe
  C:\Windows\System\DBkqtHT.exe
  2⤵
  PID:8748
- C:\Windows\System\LpKONkj.exe
  C:\Windows\System\LpKONkj.exe
  2⤵
  PID:8764
- C:\Windows\System\DJCGnSw.exe
  C:\Windows\System\DJCGnSw.exe
  2⤵
  PID:8780
- C:\Windows\System\vuNkcOe.exe
  C:\Windows\System\vuNkcOe.exe
  2⤵
  PID:8796
- C:\Windows\System\Tvmqqmt.exe
  C:\Windows\System\Tvmqqmt.exe
  2⤵
  PID:8812
- C:\Windows\System\abwqlQp.exe
  C:\Windows\System\abwqlQp.exe
  2⤵
  PID:8828
- C:\Windows\System\YBuuSAR.exe
  C:\Windows\System\YBuuSAR.exe
  2⤵
  PID:8844
- C:\Windows\System\EHQDFTb.exe
  C:\Windows\System\EHQDFTb.exe
  2⤵
  PID:8908
- C:\Windows\System\uRwSomT.exe
  C:\Windows\System\uRwSomT.exe
  2⤵
  PID:8924
- C:\Windows\System\rtCywKq.exe
  C:\Windows\System\rtCywKq.exe
  2⤵
  PID:8940
- C:\Windows\System\SuwgsTh.exe
  C:\Windows\System\SuwgsTh.exe
  2⤵
  PID:8956
- C:\Windows\System\XvuODcS.exe
  C:\Windows\System\XvuODcS.exe
  2⤵
  PID:8972
- C:\Windows\System\oVQRhoR.exe
  C:\Windows\System\oVQRhoR.exe
  2⤵
  PID:8988
- C:\Windows\System\DAonTAk.exe
  C:\Windows\System\DAonTAk.exe
  2⤵
  PID:9008
- C:\Windows\System\HpxWTmw.exe
  C:\Windows\System\HpxWTmw.exe
  2⤵
  PID:9024
- C:\Windows\System\DJffvwD.exe
  C:\Windows\System\DJffvwD.exe
  2⤵
  PID:9048
- C:\Windows\System\ZWOOZRV.exe
  C:\Windows\System\ZWOOZRV.exe
  2⤵
  PID:9068
- C:\Windows\System\PTqFjaP.exe
  C:\Windows\System\PTqFjaP.exe
  2⤵
  PID:9092
- C:\Windows\System\RoMoBUf.exe
  C:\Windows\System\RoMoBUf.exe
  2⤵
  PID:9112
- C:\Windows\System\sctrNjc.exe
  C:\Windows\System\sctrNjc.exe
  2⤵
  PID:9128
- C:\Windows\System\KrSOiYn.exe
  C:\Windows\System\KrSOiYn.exe
  2⤵
  PID:9148
- C:\Windows\System\uZTWDNr.exe
  C:\Windows\System\uZTWDNr.exe
  2⤵
  PID:9164
- C:\Windows\System\zDMumNt.exe
  C:\Windows\System\zDMumNt.exe
  2⤵
  PID:9184
- C:\Windows\System\qGfciar.exe
  C:\Windows\System\qGfciar.exe
  2⤵
  PID:9200
- C:\Windows\System\VlWxEZf.exe
  C:\Windows\System\VlWxEZf.exe
  2⤵
  PID:8008
- C:\Windows\System\ZHoTMGg.exe
  C:\Windows\System\ZHoTMGg.exe
  2⤵
  PID:8248
- C:\Windows\System\DlWvdsw.exe
  C:\Windows\System\DlWvdsw.exe
  2⤵
  PID:8312
- C:\Windows\System\xTHkmtv.exe
  C:\Windows\System\xTHkmtv.exe
  2⤵
  PID:8388
- C:\Windows\System\AdxCkqV.exe
  C:\Windows\System\AdxCkqV.exe
  2⤵
  PID:8464
- C:\Windows\System\ajWFGgV.exe
  C:\Windows\System\ajWFGgV.exe
  2⤵
  PID:8296
- C:\Windows\System\MVYSLWd.exe
  C:\Windows\System\MVYSLWd.exe
  2⤵
  PID:6708
- C:\Windows\System\rwTopms.exe
  C:\Windows\System\rwTopms.exe
  2⤵
  PID:8232
- C:\Windows\System\DhYrSbZ.exe
  C:\Windows\System\DhYrSbZ.exe
  2⤵
  PID:8340
- C:\Windows\System\hdXBZII.exe
  C:\Windows\System\hdXBZII.exe
  2⤵
  PID:8412
- C:\Windows\System\jDMGRCQ.exe
  C:\Windows\System\jDMGRCQ.exe
  2⤵
  PID:8484
- C:\Windows\System\DDVQufo.exe
  C:\Windows\System\DDVQufo.exe
  2⤵
  PID:8524
- C:\Windows\System\ZRUzoTT.exe
  C:\Windows\System\ZRUzoTT.exe
  2⤵
  PID:8540
- C:\Windows\System\VxpETOR.exe
  C:\Windows\System\VxpETOR.exe
  2⤵
  PID:8548
- C:\Windows\System\rAkVoSU.exe
  C:\Windows\System\rAkVoSU.exe
  2⤵
  PID:8576
- C:\Windows\System\OIKCusA.exe
  C:\Windows\System\OIKCusA.exe
  2⤵
  PID:8648
- C:\Windows\System\hTgGiMV.exe
  C:\Windows\System\hTgGiMV.exe
  2⤵
  PID:2668
- C:\Windows\System\dnZtSpn.exe
  C:\Windows\System\dnZtSpn.exe
  2⤵
  PID:8724
- C:\Windows\System\yjHTyMh.exe
  C:\Windows\System\yjHTyMh.exe
  2⤵
  PID:8712
- C:\Windows\System\EfpVekG.exe
  C:\Windows\System\EfpVekG.exe
  2⤵
  PID:8788
- C:\Windows\System\adBUzhI.exe
  C:\Windows\System\adBUzhI.exe
  2⤵
  PID:8676
- C:\Windows\System\HOzNjmc.exe
  C:\Windows\System\HOzNjmc.exe
  2⤵
  PID:8820
- C:\Windows\System\UoRxuWV.exe
  C:\Windows\System\UoRxuWV.exe
  2⤵
  PID:8852
- C:\Windows\System\jQdzOCH.exe
  C:\Windows\System\jQdzOCH.exe
  2⤵
  PID:8864
- C:\Windows\System\HqvytMk.exe
  C:\Windows\System\HqvytMk.exe
  2⤵
  PID:8888
- C:\Windows\System\aNGcmjV.exe
  C:\Windows\System\aNGcmjV.exe
  2⤵
  PID:8900
- C:\Windows\System\Sftipxi.exe
  C:\Windows\System\Sftipxi.exe
  2⤵
  PID:8968
- C:\Windows\System\pPnALlY.exe
  C:\Windows\System\pPnALlY.exe
  2⤵
  PID:9176
- C:\Windows\System\QfFgcfF.exe
  C:\Windows\System\QfFgcfF.exe
  2⤵
  PID:9212
- C:\Windows\System\aKKKDOG.exe
  C:\Windows\System\aKKKDOG.exe
  2⤵
  PID:8300
- C:\Windows\System\uZfcWOJ.exe
  C:\Windows\System\uZfcWOJ.exe
  2⤵
  PID:9040
- C:\Windows\System\btKKLFm.exe
  C:\Windows\System\btKKLFm.exe
  2⤵
  PID:8564
- C:\Windows\System\GNcTRRK.exe
  C:\Windows\System\GNcTRRK.exe
  2⤵
  PID:8672
- C:\Windows\System\IVfYgmP.exe
  C:\Windows\System\IVfYgmP.exe
  2⤵
  PID:8792
- C:\Windows\System\XnlKxbl.exe
  C:\Windows\System\XnlKxbl.exe
  2⤵
  PID:8880
- C:\Windows\System\LXESHpA.exe
  C:\Windows\System\LXESHpA.exe
  2⤵
  PID:8204
- C:\Windows\System\zDidYSr.exe
  C:\Windows\System\zDidYSr.exe
  2⤵
  PID:9160
- C:\Windows\System\xMQOzBA.exe
  C:\Windows\System\xMQOzBA.exe
  2⤵
  PID:2896
- C:\Windows\System\LDuaRDz.exe
  C:\Windows\System\LDuaRDz.exe
  2⤵
  PID:8516
- C:\Windows\System\PJsXuZW.exe
  C:\Windows\System\PJsXuZW.exe
  2⤵
  PID:9192
- C:\Windows\System\DtTvdCi.exe
  C:\Windows\System\DtTvdCi.exe
  2⤵
  PID:8264
- C:\Windows\System\NWDRTEq.exe
  C:\Windows\System\NWDRTEq.exe
  2⤵
  PID:8536
- C:\Windows\System\xCsEjrl.exe
  C:\Windows\System\xCsEjrl.exe
  2⤵
  PID:8612
- C:\Windows\System\ljtytPI.exe
  C:\Windows\System\ljtytPI.exe
  2⤵
  PID:8728
- C:\Windows\System\LciFfmL.exe
  C:\Windows\System\LciFfmL.exe
  2⤵
  PID:8772
- C:\Windows\System\nOlfqWl.exe
  C:\Windows\System\nOlfqWl.exe
  2⤵
  PID:8936
- C:\Windows\System\FvmQwlH.exe
  C:\Windows\System\FvmQwlH.exe
  2⤵
  PID:1568
- C:\Windows\System\iQCbfIy.exe
  C:\Windows\System\iQCbfIy.exe
  2⤵
  PID:9016
- C:\Windows\System\uPJOkIm.exe
  C:\Windows\System\uPJOkIm.exe
  2⤵
  PID:9108
- C:\Windows\System\fqVRGhK.exe
  C:\Windows\System\fqVRGhK.exe
  2⤵
  PID:9172
- C:\Windows\System\KaUkDwb.exe
  C:\Windows\System\KaUkDwb.exe
  2⤵
  PID:8332
- C:\Windows\System\CpGqhvP.exe
  C:\Windows\System\CpGqhvP.exe
  2⤵
  PID:8480
- C:\Windows\System\grEZUcK.exe
  C:\Windows\System\grEZUcK.exe
  2⤵
  PID:8840
- C:\Windows\System\tTVWibi.exe
  C:\Windows\System\tTVWibi.exe
  2⤵
  PID:9004
- C:\Windows\System\AnfyuQI.exe
  C:\Windows\System\AnfyuQI.exe
  2⤵
  PID:7584
- C:\Windows\System\vyTUpOt.exe
  C:\Windows\System\vyTUpOt.exe
  2⤵
  PID:8220
- C:\Windows\System\bPzaJmU.exe
  C:\Windows\System\bPzaJmU.exe
  2⤵
  PID:8920
- C:\Windows\System\IBGJznX.exe
  C:\Windows\System\IBGJznX.exe
  2⤵
  PID:9120
- C:\Windows\System\rrTvYAD.exe
  C:\Windows\System\rrTvYAD.exe
  2⤵
  PID:8804
- C:\Windows\System\TrjenuL.exe
  C:\Windows\System\TrjenuL.exe
  2⤵
  PID:8984
- C:\Windows\System\vfKIeKE.exe
  C:\Windows\System\vfKIeKE.exe
  2⤵
  PID:8280
- C:\Windows\System\GXElqvV.exe
  C:\Windows\System\GXElqvV.exe
  2⤵
  PID:9084
- C:\Windows\System\ooIfShO.exe
  C:\Windows\System\ooIfShO.exe
  2⤵
  PID:9056
- C:\Windows\System\AtdWOau.exe
  C:\Windows\System\AtdWOau.exe
  2⤵
  PID:9228
- C:\Windows\System\vtRPAlY.exe
  C:\Windows\System\vtRPAlY.exe
  2⤵
  PID:9288
- C:\Windows\System\prMwthb.exe
  C:\Windows\System\prMwthb.exe
  2⤵
  PID:9308
- C:\Windows\System\eSWEyjI.exe
  C:\Windows\System\eSWEyjI.exe
  2⤵
  PID:9324
- C:\Windows\System\qeNNLFA.exe
  C:\Windows\System\qeNNLFA.exe
  2⤵
  PID:9340
- C:\Windows\System\hymUuaK.exe
  C:\Windows\System\hymUuaK.exe
  2⤵
  PID:9356
- C:\Windows\System\YyLHcTm.exe
  C:\Windows\System\YyLHcTm.exe
  2⤵
  PID:9376
- C:\Windows\System\fJZPKWN.exe
  C:\Windows\System\fJZPKWN.exe
  2⤵
  PID:9392
- C:\Windows\System\rSvRIWo.exe
  C:\Windows\System\rSvRIWo.exe
  2⤵
  PID:9412
- C:\Windows\System\IRkuTPx.exe
  C:\Windows\System\IRkuTPx.exe
  2⤵
  PID:9432
- C:\Windows\System\vXustIF.exe
  C:\Windows\System\vXustIF.exe
  2⤵
  PID:9448
- C:\Windows\System\kbyYxDu.exe
  C:\Windows\System\kbyYxDu.exe
  2⤵
  PID:9468
- C:\Windows\System\SWUfuCh.exe
  C:\Windows\System\SWUfuCh.exe
  2⤵
  PID:9488
- C:\Windows\System\AxvYlSN.exe
  C:\Windows\System\AxvYlSN.exe
  2⤵
  PID:9504
- C:\Windows\System\SMjXdlW.exe
  C:\Windows\System\SMjXdlW.exe
  2⤵
  PID:9524
- C:\Windows\System\EdYOTMM.exe
  C:\Windows\System\EdYOTMM.exe
  2⤵
  PID:9540
- C:\Windows\System\XXXcshJ.exe
  C:\Windows\System\XXXcshJ.exe
  2⤵
  PID:9556
- C:\Windows\System\LQPelBs.exe
  C:\Windows\System\LQPelBs.exe
  2⤵
  PID:9584
- C:\Windows\System\UbYNAoc.exe
  C:\Windows\System\UbYNAoc.exe
  2⤵
  PID:9600
- C:\Windows\System\mkQDzDO.exe
  C:\Windows\System\mkQDzDO.exe
  2⤵
  PID:9620
- C:\Windows\System\TlKRwXB.exe
  C:\Windows\System\TlKRwXB.exe
  2⤵
  PID:9652
- C:\Windows\System\rTHXjyQ.exe
  C:\Windows\System\rTHXjyQ.exe
  2⤵
  PID:9668
- C:\Windows\System\vUXwKwq.exe
  C:\Windows\System\vUXwKwq.exe
  2⤵
  PID:9704
- C:\Windows\System\EgZWkGM.exe
  C:\Windows\System\EgZWkGM.exe
  2⤵
  PID:9720
- C:\Windows\System\IivHGqz.exe
  C:\Windows\System\IivHGqz.exe
  2⤵
  PID:9744
- C:\Windows\System\JrIkdeV.exe
  C:\Windows\System\JrIkdeV.exe
  2⤵
  PID:9768
- C:\Windows\System\QYsbEFl.exe
  C:\Windows\System\QYsbEFl.exe
  2⤵
  PID:9784
- C:\Windows\System\wRDmxhn.exe
  C:\Windows\System\wRDmxhn.exe
  2⤵
  PID:9800
- C:\Windows\System\rQUIYfZ.exe
  C:\Windows\System\rQUIYfZ.exe
  2⤵
  PID:9820
- C:\Windows\System\QWZGEJn.exe
  C:\Windows\System\QWZGEJn.exe
  2⤵
  PID:9840
- C:\Windows\System\KQHjnct.exe
  C:\Windows\System\KQHjnct.exe
  2⤵
  PID:9856
- C:\Windows\System\jxnTqzz.exe
  C:\Windows\System\jxnTqzz.exe
  2⤵
  PID:9872
- C:\Windows\System\hTQqrBJ.exe
  C:\Windows\System\hTQqrBJ.exe
  2⤵
  PID:9888
- C:\Windows\System\eEOhxYy.exe
  C:\Windows\System\eEOhxYy.exe
  2⤵
  PID:9904
- C:\Windows\System\AMbKBcb.exe
  C:\Windows\System\AMbKBcb.exe
  2⤵
  PID:9928
- C:\Windows\System\rqRmEfd.exe
  C:\Windows\System\rqRmEfd.exe
  2⤵
  PID:9944
- C:\Windows\System\AiOGFRC.exe
  C:\Windows\System\AiOGFRC.exe
  2⤵
  PID:9960
- C:\Windows\System\mxNDRfT.exe
  C:\Windows\System\mxNDRfT.exe
  2⤵
  PID:9976
- C:\Windows\System\BVgoMvN.exe
  C:\Windows\System\BVgoMvN.exe
  2⤵
  PID:9992
- C:\Windows\System\tllALGH.exe
  C:\Windows\System\tllALGH.exe
  2⤵
  PID:10008
- C:\Windows\System\gABLILI.exe
  C:\Windows\System\gABLILI.exe
  2⤵
  PID:10028
- C:\Windows\System\cdkUDTc.exe
  C:\Windows\System\cdkUDTc.exe
  2⤵
  PID:10044
- C:\Windows\System\cQHrFux.exe
  C:\Windows\System\cQHrFux.exe
  2⤵
  PID:10060
- C:\Windows\System\lAZsIEA.exe
  C:\Windows\System\lAZsIEA.exe
  2⤵
  PID:10080
- C:\Windows\System\KgSthNN.exe
  C:\Windows\System\KgSthNN.exe
  2⤵
  PID:10152
- C:\Windows\System\xMwIEta.exe
  C:\Windows\System\xMwIEta.exe
  2⤵
  PID:10168
- C:\Windows\System\HRYVNLw.exe
  C:\Windows\System\HRYVNLw.exe
  2⤵
  PID:10188
- C:\Windows\System\fUDXALV.exe
  C:\Windows\System\fUDXALV.exe
  2⤵
  PID:10212
- C:\Windows\System\hKLrAVv.exe
  C:\Windows\System\hKLrAVv.exe
  2⤵
  PID:10228
- C:\Windows\System\OFDLGzl.exe
  C:\Windows\System\OFDLGzl.exe
  2⤵
  PID:8512
- C:\Windows\System\dBAHUFg.exe
  C:\Windows\System\dBAHUFg.exe
  2⤵
  PID:8660
- C:\Windows\System\HQuPecD.exe
  C:\Windows\System\HQuPecD.exe
  2⤵
  PID:8896
- C:\Windows\System\WbgEUWb.exe
  C:\Windows\System\WbgEUWb.exe
  2⤵
  PID:9144
- C:\Windows\System\jSOrafB.exe
  C:\Windows\System\jSOrafB.exe
  2⤵
  PID:8876
- C:\Windows\System\zrjVAoX.exe
  C:\Windows\System\zrjVAoX.exe
  2⤵
  PID:8856
- C:\Windows\System\OhWkbHC.exe
  C:\Windows\System\OhWkbHC.exe
  2⤵
  PID:8652
- C:\Windows\System\qtjkuQs.exe
  C:\Windows\System\qtjkuQs.exe
  2⤵
  PID:9240
- C:\Windows\System\BEAXGAS.exe
  C:\Windows\System\BEAXGAS.exe
  2⤵
  PID:2756
- C:\Windows\System\AVGjTft.exe
  C:\Windows\System\AVGjTft.exe
  2⤵
  PID:9264
- C:\Windows\System\QYkZoPx.exe
  C:\Windows\System\QYkZoPx.exe
  2⤵
  PID:9316
- C:\Windows\System\zyWCwmY.exe
  C:\Windows\System\zyWCwmY.exe
  2⤵
  PID:9428
- C:\Windows\System\mdSkGka.exe
  C:\Windows\System\mdSkGka.exe
  2⤵
  PID:9496
- C:\Windows\System\alWRKCB.exe
  C:\Windows\System\alWRKCB.exe
  2⤵
  PID:9564
- C:\Windows\System\kkcIHnl.exe
  C:\Windows\System\kkcIHnl.exe
  2⤵
  PID:9404
- C:\Windows\System\lKvrjan.exe
  C:\Windows\System\lKvrjan.exe
  2⤵
  PID:9616
- C:\Windows\System\htxxzCf.exe
  C:\Windows\System\htxxzCf.exe
  2⤵
  PID:9664
- C:\Windows\System\wIIvqjU.exe
  C:\Windows\System\wIIvqjU.exe
  2⤵
  PID:9548
- C:\Windows\System\XeoczJm.exe
  C:\Windows\System\XeoczJm.exe
  2⤵
  PID:9408
- C:\Windows\System\nVYmGmI.exe
  C:\Windows\System\nVYmGmI.exe
  2⤵
  PID:9712
- C:\Windows\System\xhfZcNN.exe
  C:\Windows\System\xhfZcNN.exe
  2⤵
  PID:9516
- C:\Windows\System\SZuiUwL.exe
  C:\Windows\System\SZuiUwL.exe
  2⤵
  PID:9688
- C:\Windows\System\nNmOsEV.exe
  C:\Windows\System\nNmOsEV.exe
  2⤵
  PID:9644
- C:\Windows\System\YKahAdS.exe
  C:\Windows\System\YKahAdS.exe
  2⤵
  PID:9700
- C:\Windows\System\xFpxdQV.exe
  C:\Windows\System\xFpxdQV.exe
  2⤵
  PID:9764
- C:\Windows\System\cGzZGVf.exe
  C:\Windows\System\cGzZGVf.exe
  2⤵
  PID:9832
- C:\Windows\System\nVOyaYF.exe
  C:\Windows\System\nVOyaYF.exe
  2⤵
  PID:9896
- C:\Windows\System\mljRlDG.exe
  C:\Windows\System\mljRlDG.exe
  2⤵
  PID:9972
- C:\Windows\System\GvRACZh.exe
  C:\Windows\System\GvRACZh.exe
  2⤵
  PID:10040
- C:\Windows\System\PjDHmeO.exe
  C:\Windows\System\PjDHmeO.exe
  2⤵
  PID:10088
- C:\Windows\System\WSSfAvY.exe
  C:\Windows\System\WSSfAvY.exe
  2⤵
  PID:9812
- C:\Windows\System\GEkghSa.exe
  C:\Windows\System\GEkghSa.exe
  2⤵
  PID:9884
- C:\Windows\System\JsEHfLK.exe
  C:\Windows\System\JsEHfLK.exe
  2⤵
  PID:9924
- C:\Windows\System\KZGMSDS.exe
  C:\Windows\System\KZGMSDS.exe
  2⤵
  PID:10020
- C:\Windows\System\xzItVFg.exe
  C:\Windows\System\xzItVFg.exe
  2⤵
  PID:10056
- C:\Windows\System\XvMsgEm.exe
  C:\Windows\System\XvMsgEm.exe
  2⤵
  PID:10120
- C:\Windows\System\DvLIsXV.exe
  C:\Windows\System\DvLIsXV.exe
  2⤵
  PID:10136
- C:\Windows\System\XwnYLLn.exe
  C:\Windows\System\XwnYLLn.exe
  2⤵
  PID:10148
- C:\Windows\System\LsrvYIu.exe
  C:\Windows\System\LsrvYIu.exe
  2⤵
  PID:10204
- C:\Windows\System\gqUmpZM.exe
  C:\Windows\System\gqUmpZM.exe
  2⤵
  PID:10236
- C:\Windows\System\PDvYYNQ.exe
  C:\Windows\System\PDvYYNQ.exe
  2⤵
  PID:8452
- C:\Windows\System\wpBtKcR.exe
  C:\Windows\System\wpBtKcR.exe
  2⤵
  PID:9136
- C:\Windows\System\vFZtJsG.exe
  C:\Windows\System\vFZtJsG.exe
  2⤵
  PID:9104
- C:\Windows\System\AAyMDbi.exe
  C:\Windows\System\AAyMDbi.exe
  2⤵
  PID:9224
- C:\Windows\System\afkAwvG.exe
  C:\Windows\System\afkAwvG.exe
  2⤵
  PID:9276
- C:\Windows\System\yeylEJc.exe
  C:\Windows\System\yeylEJc.exe
  2⤵
  PID:9272
- C:\Windows\System\MtsuRZY.exe
  C:\Windows\System\MtsuRZY.exe
  2⤵
  PID:9460
- C:\Windows\System\MuZwAxu.exe
  C:\Windows\System\MuZwAxu.exe
  2⤵
  PID:9336
- C:\Windows\System\yOADDga.exe
  C:\Windows\System\yOADDga.exe
  2⤵
  PID:9680
- C:\Windows\System\NwejSyh.exe
  C:\Windows\System\NwejSyh.exe
  2⤵
  PID:9636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BrRKzcy.exe

Filesize
3.6MB

MD5
b7fdef3046ad24318a9bbdf6af7527c6

SHA1
b7d3b179660625eae6d5482b378660d01c6dc9ed

SHA256
debb2305ee3319623ce269f98ee5277c36d3ad695bd2580b1667039cb08fbda0

SHA512
b92bb56867a4971afbd6b02a56a0faf22a9cc6b48942278f341b4a8db64e79bbbede886b20e676359aa70a043b10d26501370434d499cd86d70b0fbbbe97dd16

Download Submit
C:\Windows\system\BsPHvvL.exe

Filesize
3.6MB

MD5
64bc1b75cdccbe7df358a4a1d0c2169b

SHA1
5d03406261cde62f97c04c013c35cc3bc5bb403f

SHA256
924f0d908653d6b096373e35a5ba6175f7fc5fc8c54cf4c08941e2870935acd0

SHA512
49baafbeb6eee8acba4f9063cd1e005203853a2ee2cedcdf74fee9c4e98ee5ea3b021c63006305315a48e6ef4cf618fd170dc45411b5263e949f69779050ebd8

Download Submit
C:\Windows\system\CQoYUZE.exe

Filesize
3.6MB

MD5
d2da7a970b828433c2b4520e18e0ad39

SHA1
26eb52c553a13ae4110a61fe7c2ce22227eddd35

SHA256
f50db84f0a0218d70d2532fe1844ea5bc16a6d6966547d0310afd2164201ae03

SHA512
d6481451b1f20f658c0819ef433babac05ec5929d6b4db07c9b00e3f302281a5ef4673afc05e2dd5160d789f2f0edc9c631163a9e19852fb83c4cb8a49e9b887

Download Submit
C:\Windows\system\FoyVTRR.exe

Filesize
3.6MB

MD5
6a4ee7ae1bf7d51d723cb1934b0dc090

SHA1
462740a7d50d8c8bec21e1d1eb3261ddefba4e59

SHA256
6c947c4d2c8a6db4d741249a6b76d0fe08624fb02205d12f54ea1af3dce64c90

SHA512
af48f868c18529e123e35b1deaeeafa8232b12cdbb0575f10eb6861d5ac1b51e0586518201cf740644dcc3139230b632df9fdee34a1653ceef2ad1c6790bd3eb

Download Submit
C:\Windows\system\HBGETAW.exe

Filesize
3.6MB

MD5
9aa138541e2d1355df4855cf26741f34

SHA1
60aae256e3bd2655f1cb0c25e98020a708a3c0b5

SHA256
6cdc1ae3b5b68bcd05a2fd49a8669c5895f9a256540851f1aab41cccb01ef0bc

SHA512
38faca90d6afb2de4b7faf11e1174359bf306669cfeacb46c363e3109d3d2e66ed16bfce069e64b59f46688753a250c93d7ae5587e8b84d2edaa081365d277c0

Download Submit
C:\Windows\system\HmmkbbI.exe

Filesize
3.6MB

MD5
c3e17c062dfda7f325ddcd7c254b6e08

SHA1
e658ed086e1dfd8fa0cb0296d6cb888403d9bcd3

SHA256
07b7999d0a4a6771837a68209caa8e2994a2af15ac9e0abf9270b1ffb30a63b9

SHA512
811df636f625e3590e795b96d21ee9ba3315ba49d04ef17f4301f5a89bcf4c2b544caec6e6a83a97d0d3d234b4f6c357c48c4987ffd3d5b95b3b920c3b961397

Download Submit
C:\Windows\system\JaPMAfw.exe

Filesize
3.6MB

MD5
a3984feab296fbe08cd701461064b517

SHA1
998743c013a989d118affe423d8c55990a3e1798

SHA256
10efc12c97013ab035c18688418c1c930658d852f50e55318304835df3bea400

SHA512
d9fd39bc18d6782f0161f79373a559f4f7fbb3b24b2fc65e2b56769ce86f9f90f4fdafc906f2e736adb0782eb483b6a42dedb60acf065114c86f88ed79e3c1bb

Download Submit
C:\Windows\system\KLnqoGl.exe

Filesize
3.6MB

MD5
3ce0197fc496a8a80c0dd2be606ccbd5

SHA1
70c358e7196fd63669843d0f5decb8c02bf1211b

SHA256
0c2fcb107b24bed7b3d595e94ab8cded54a7f0c415b400743e2f2f5edb23fef0

SHA512
41c3bd6b95957e3800b289d821b9b0e387d6081b04f0307d60f90814951e4f068bf5e23dbfa6aeb180eb93555c2ea200803bcb7cae303c77eb56a51d130887a0

Download Submit
C:\Windows\system\LgkYyTw.exe

Filesize
3.6MB

MD5
55a20ac8d47f6f182ee665c18e66b1a0

SHA1
85aa9eefc60faaac2f35354c0c98af06901289db

SHA256
a8d858bad0059fd361680445c68364473b41023364dcbac1550601675cf427b3

SHA512
bbef3cb99d69ee35d3919899163818c859e74a100dda161504e5e0a876f63c0c568a84a965b212757380f5a0b4a20cdae861b30f3fbe091e5f5271b083cc2531

Download Submit
C:\Windows\system\OJEPDGY.exe

Filesize
3.6MB

MD5
1e1f5dcaabe99e884a0fdec81006e405

SHA1
31c9ebb14bd0c74f2580f2226aab1578c09807c8

SHA256
e4187b4d6a06d34b72379945ca4bf131f088c9bf11eea0800016da579040165c

SHA512
1264d82fb8d1c7be6a552cb40678ee57201530a6f8468a694aa10b02abf59eb940f77d06e8015b0a92f4778da318ddbdd03358546a25f8e74b0192cc4996b367

Download Submit
C:\Windows\system\OhRQOVU.exe

Filesize
3.6MB

MD5
b73b3f6310d11b27d8c480bfa541406e

SHA1
cc6f845639837f4c9946c392996704ea9836fc45

SHA256
72d6c04884225b36557aa686138f8af100146aab6332dc3b80e99ef51a944e7f

SHA512
acfff5dfbd798c2aad1c41e0371f4e1c98dd4bf694cbd2f44ca95afed83b60f76f782884dcd7868ba91fb7dbe56f3bcc71419290a72a1eba5a28c4c30c1ee297

Download Submit
C:\Windows\system\QhSchfA.exe

Filesize
3.6MB

MD5
6e5bf04db1f397f68b609bce114a64c6

SHA1
2cc3616763f7bf38dff4b1f9c637acf147159871

SHA256
d7e8a39a085b045a4feedb8a64a902a173bb7d8792b2eef48acf90f7c3fd1d7a

SHA512
29340c9ec0361eb7990f8f0cd7a9f9d2136ef509553749d5328c0c55e2718f984f97659b0760538f2e0ba6f8a7692385985b99f0c66963fe6cc9427ea57637a9

Download Submit
C:\Windows\system\VWySBJj.exe

Filesize
3.6MB

MD5
87f821fe42c71f51c4f00e6d7815608c

SHA1
a8f06c2c55773232631cebd8a3bb1cdcefc85533

SHA256
04fddab2e1f57bb1dd8c27e06ce4d4319f6021da05685c95a5d99ee38c92eda7

SHA512
5702a11dfb888479a48450ad235d5b42974a4cf253d67748fb01c19a6e488153de708388e057f9e65d763c76c386d081bbf4e26db5c37b3e79bffe071daba00e

Download Submit
C:\Windows\system\WyaPTZM.exe

Filesize
3.6MB

MD5
c9ffa8d88c40db09f687bab560d91510

SHA1
83e85abd5e492de6d6551b9c43c4880d85b65011

SHA256
483be0fe3032fe57d7370dbd8dec57ab6f8226f9ab1d4dbb1010b939aeee378f

SHA512
b60aaf51064773f106fa12f9f5fa6e23406a33e42cef5480773b35d553ff8899264c9cf8e9dec42373c2086765ebfc237ffd2b1b28645a93e0e452b8540b10a7

Download Submit
C:\Windows\system\XvosbRr.exe

Filesize
3.6MB

MD5
dc34f08dd07b86e6c69161b269052fa8

SHA1
7195052688aee506b682578c1a8f9415406ec61a

SHA256
a94034976647366f9989fc493a4b34b07841240d8ae3ed60b6de5461712923d4

SHA512
4cab9785e038f20f194e2c725682c6abe9809235d53c94550c09370271f2d5d0b73d7d9f806126239f29f634b2d88d4c7b6123dc1ec496c79a744e6b21926f75

Download Submit
C:\Windows\system\YDoEStz.exe

Filesize
3.6MB

MD5
4d8294ebe66cd2acd404e6b263b791d7

SHA1
7b1a98923c90c0ce52476a38c6585994eef15906

SHA256
f508f09f47b74f7bc1d47ec6c12dc7a82d5444df589f5da788443bc5ed99bb02

SHA512
8e3d5ec911bec1e4910784b132ae1bea4397dd430f938105d20bed39712d294d464be5427dd78eafd2b7c0281d0d215bc6e15bf796e65e8dc63ff67b1847a932

Download Submit
C:\Windows\system\aQoStdh.exe

Filesize
3.6MB

MD5
8b9ef8efa9445db48194ef4e0490f5d0

SHA1
e70784c4c6deabffac8d1dbb9bf55a2be552533d

SHA256
5bd2a8b000534598a064036b2273e3b67803946c91ee579342c9489fe8bb3a06

SHA512
163c19114873532f92eb5f399a2df4633776b7b49071a448404a256bde75f71ce156c2b6b5d24aba9ad841ff213212e0611af84afa4276071a83d17c68391c3f

Download Submit
C:\Windows\system\cLBnund.exe

Filesize
3.6MB

MD5
a884abd0b7ff06f7ec5cb7bfc3084d65

SHA1
e25daa2566ff2840de6d59f9fc893c6420f47688

SHA256
b8f20cf6378a4b9d2ff3db27ae15968ff02f5a6152c59c6ed81d961eb51368fc

SHA512
cb53d363bec117d9194fd43c60045722c61843edd572df1f18523031e66fadf9f131a762414648d55993d9e44f1412420745bb7b091726bdcbf747c55d8e970d

Download Submit
C:\Windows\system\cuGYCpm.exe

Filesize
3.6MB

MD5
ceee8855bfc35ad6acfd25f9b8d44856

SHA1
f6e30effa0c6ae829d31d05f201097b41a2f903d

SHA256
9ee78fe9417c55f3b2e0dd6a2f14ed893929fd95c20693e86e166cd0cd23d216

SHA512
22dc88a499e3f5bf5e2a369effc75f0771833bcbcd41c31b6e42622f8ad0bd493bcdefe4e0643a7ea79b296adcfe06ed5a6ca379b79f74541c0889c41bcea2a2

Download Submit
C:\Windows\system\gPAUjbd.exe

Filesize
3.6MB

MD5
f7d89682fc1dc7c40f68c18f6373798d

SHA1
9339cad46f676e766253acc50431b62da2e9973c

SHA256
11e1321915a807c8cda577201d3846e2c197a55b9220478c94bbadc9a4b97153

SHA512
7c00f7dbfb7fb78cde317ec894529272879575cf6a04ce5e28f07063873e92b59c8b69b1e4e787ade3fc272b8e44204d17ab64996ab6447d1727ea6709afecb2

Download Submit
C:\Windows\system\kJeAiuR.exe

Filesize
3.6MB

MD5
45a90c25f05635e2c422167ed6ecb894

SHA1
3a2fcbd2a309c71d276dfc8d6b73f6c95b1cf30d

SHA256
0d3d36dfe372ff74a8cb4a0a5b5c2257beb00c3c12975b0ece722c71248fc57a

SHA512
1954a92888666a543622d1dca1cea9560e8cb4d38e8db96f29efa60864e60fbf7ff5e328f6c1f3b2521fec7cc50c9c6daa62a4e5e9a92a0c5f101cc6d8e19bda

Download Submit
C:\Windows\system\lYjqOra.exe

Filesize
3.6MB

MD5
79896f9ccfcf18de8a2d7e7d7d51f902

SHA1
42dab9b2088dbdf10cb5cced83d8eb8845f9bf03

SHA256
afd0d0e5cfbc62f33a2e9f3b171f0a71a419f1af0acae0513e5564267bb245a9

SHA512
a2be3eec42b3eb00d4520caf975f64677b4f516884f950927061032b62d74a5d9371f2fd4cb4b728226810bee508549c42106da8582db1616107d6cc14c7afe1

Download Submit
C:\Windows\system\ltoogbv.exe

Filesize
3.6MB

MD5
140319a92ddf28d7d08eb4a2a5ce80e4

SHA1
12d770b6c1af46f3285a0a24f33b68540ad08d4c

SHA256
95bdb5cf1269400039f12466ed3ba91c781052fce0a42e74919cc1b991a21ba5

SHA512
c017442070aa6b4eb1fb8ea2fb306fb99e1c06a6b19228aff550d09605f2aa4262e9ab2f3eacaf1de6f54390e1a5274e9bdd73e4f2fb15592a86858c3bad836d

Download Submit
C:\Windows\system\mEMyWZx.exe

Filesize
3.6MB

MD5
da4885efe349b192772ee5f9b172e6b7

SHA1
0e945c9d468a7d04596d0764441b6a68e04c47c6

SHA256
088f542b53b90f489cfdab397de8a3e7545b3c2f3b004b17287e247845db4d7d

SHA512
c8791c0c84ef7a4e35314d9ee17a2ab276a23fc3b568fd9d48d19b1f69c0b242b872c19a5d7b0c293e6ab6ad3e8ecf6ae4eae49584ec0ff6a8ecca24e56072e8

Download Submit
C:\Windows\system\nNPnIDx.exe

Filesize
3.6MB

MD5
ba6dea1f06b23eaf7752f6626151cc72

SHA1
86a67ddb07519aedc56c9474051284a17a4b84b7

SHA256
52f70cd8233c19d5c520caf0e5f623c8aa50c11fe57efe7d6faf1c8624862c19

SHA512
48276a27c79ab3d1d540ee0adc86596b948d0fdff4b366c1e2a99b6cf1bf525524a54b5002064d50969326eaaed2a0ea1a74ef97cbb6bbe68d5dc75a64f28bba

Download Submit
C:\Windows\system\oRQLNak.exe

Filesize
3.6MB

MD5
fb45f24ac0ab28b6845bc5784a0c5bb6

SHA1
72244eebd21277aca5be8cc5cdb269233b60b562

SHA256
ff55631b0cc3f0c9a2a1f7ef7a397c40a5c181bb6ea5fc61dd0eed680803fe6c

SHA512
4cdbe81638317fe200411a3a02cdbb1f592814af9afc188506480a1157dbdb3a0000cde9dc59f90b408dd8294455eb8b9e2611774b69815acd08747e3f2f4f32

Download Submit
C:\Windows\system\sAtYElo.exe

Filesize
3.6MB

MD5
a9ffc1257504c566f3243cfee94bf278

SHA1
9baf8a4f3f3e60fa7f027a48d600c4e5c78e345d

SHA256
2c9facd42d2a60d3a22c3b1614eeb317d92b2209a109ea7785d6f07dfa18213d

SHA512
7d0c1250394d9a83f069d11934e0c311e335c055753ec50d80556db79a42730d7bbe10408147e78778222be2ad17316b50c50e4f4111c6d657bfc4627a43b4ad

Download Submit
C:\Windows\system\sokIYqI.exe

Filesize
3.6MB

MD5
b990bc15a9d95bd2e5ae4d3d842bdc68

SHA1
0c963fdf01c718b98c7c1d7a2e92dc61abd0b729

SHA256
f1738e383edf872e855c51577e2efa86d1a32908aa5bb1cbbe19cf9df2a46225

SHA512
ccdd0755dfa7bd6ab2e7f6a2e73b7f32d124269d3ef07a0857b262f9a02e774dc27555fe30aca19be42e945149c553247b3d6ece685fb42b87be943c0038d40c

Download Submit
C:\Windows\system\wJVplsq.exe

Filesize
3.6MB

MD5
59ae219cc60296f655a75371a0487933

SHA1
cd921acf3a8e1086151023d6250f66180b6ae443

SHA256
fd6b6857802d1a37f08380bc5d3a3c5dab457d7bab354deabcdf574aa933d819

SHA512
2ea3c09bed28340d1cc3b8c94718ca15fa0966252533e51089d25de57c33680ba6f4d802f7e0b9be8c91a98612b84b45e372b3c98157bfabec6caf3c7f86c725

Download Submit
\Windows\system\CQoYUZE.exe

Filesize
2.6MB

MD5
993b66e3acf344439515ebc97ad21182

SHA1
9317917b1faaaf00c44e6fcc2f1041d947527e37

SHA256
6b90351172b14b9a2531573b5683fa78fcaeafcca897e79d358620c6764348a3

SHA512
40e9aadf04c37e3fa574c730542195d8936469c452e8c58b8af78c5769445745d17a0ae4bb116f0bea026669be282aef6b4d5df448ac992eae47d27fedb45cde

Download Submit
\Windows\system\PpMwkaB.exe

Filesize
3.6MB

MD5
ecbbab6a67dec7e0c979e8c06de45e52

SHA1
ca729d7d2452742f24b194214f0d8a92e8e2228b

SHA256
dfd466d31e5b9e72be6d50e15042f8b9638d096b345cd0650e36bcad40224032

SHA512
061b05e2de3152fcfb50fab18eb66dcb2921d50230fdd1857e61cd441bc4e41dfe36a1b51d5996b491befa8855d9fc66ab5d705e433db75e9950828b2aea4d56

Download Submit
\Windows\system\ZlIadZL.exe

Filesize
3.6MB

MD5
41a49febb2c5efd480f0f371a0588ab3

SHA1
63fc835d4af6f38cc3b14499d09e683b52952643

SHA256
6d4a03d5ec5ec6d7858644be43f8a2421a5d5294ac9448b67b9b2b187656cb7f

SHA512
c5064b46da5f6b733a4e260125e4c5f0da34c761d610761827b88a9de6d59b47d0bb87fc270711d8fcdc8829af3d6942f1500d4a4cef74030646485c81d5ee47

Download Submit
\Windows\system\tmywhqX.exe

Filesize
3.6MB

MD5
8500820dfaa870d0107e078810de5bc3

SHA1
a474689bf9a7ea332dffd812f179441c846516e4

SHA256
a7ecc165d5998d7d5b7fd3c0a36f4a1fcf19817259dfc9408e02bdf16eb75a51

SHA512
a8a4a91fb10d2322720e327181d55ec1c78a13929952b629b11f749bab62e4bec33edd2cd5ff53a7c2efcdcea4fb76b0186128f53f66868ca14f68103f71d214

Download Submit
memory/1296-19-0x000000013FCC0000-0x00000001400B6000-memory.dmp

Filesize
4.0MB

Download
memory/2076-57-0x000000013F960000-0x000000013FD56000-memory.dmp

Filesize
4.0MB

Download
memory/2332-35-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2332-85-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2332-36-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2332-20-0x000007FEF5ECE000-0x000007FEF5ECF000-memory.dmp

Filesize
4KB

Download
memory/2332-82-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2332-37-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2332-40-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2332-60-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2356-18-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/2452-90-0x000000013F490000-0x000000013F886000-memory.dmp

Filesize
4.0MB

Download
memory/2488-88-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/2500-100-0x000000013FC90000-0x0000000140086000-memory.dmp

Filesize
4.0MB

Download
memory/2576-91-0x000000013FBB0000-0x000000013FFA6000-memory.dmp

Filesize
4.0MB

Download
memory/2632-102-0x000000013F460000-0x000000013F856000-memory.dmp

Filesize
4.0MB

Download
memory/2656-42-0x000000013FA10000-0x000000013FE06000-memory.dmp

Filesize
4.0MB

Download
memory/2656-6300-0x000000013FA10000-0x000000013FE06000-memory.dmp

Filesize
4.0MB

Download
memory/2680-49-0x000000013F260000-0x000000013F656000-memory.dmp

Filesize
4.0MB

Download
memory/2712-6339-0x000000013F240000-0x000000013F636000-memory.dmp

Filesize
4.0MB

Download
memory/2712-61-0x000000013F240000-0x000000013F636000-memory.dmp

Filesize
4.0MB

Download
memory/2856-84-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/2856-44-0x000000013F260000-0x000000013F656000-memory.dmp

Filesize
4.0MB

Download
memory/2856-103-0x0000000003540000-0x0000000003936000-memory.dmp

Filesize
4.0MB

Download
memory/2856-92-0x000000013F180000-0x000000013F576000-memory.dmp

Filesize
4.0MB

Download
memory/2856-3845-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/2856-3851-0x000000013F180000-0x000000013F576000-memory.dmp

Filesize
4.0MB

Download
memory/2856-3857-0x000000013F460000-0x000000013F856000-memory.dmp

Filesize
4.0MB

Download
memory/2856-99-0x0000000003540000-0x0000000003936000-memory.dmp

Filesize
4.0MB

Download
memory/2856-3848-0x000000013F490000-0x000000013F886000-memory.dmp

Filesize
4.0MB

Download
memory/2856-3852-0x0000000003540000-0x0000000003936000-memory.dmp

Filesize
4.0MB

Download
memory/2856-1-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2856-4398-0x0000000003540000-0x0000000003936000-memory.dmp

Filesize
4.0MB

Download
memory/2856-87-0x000000013F240000-0x000000013F636000-memory.dmp

Filesize
4.0MB

Download
memory/2856-3045-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2856-83-0x0000000003030000-0x0000000003426000-memory.dmp

Filesize
4.0MB

Download
memory/2856-3047-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/2856-3048-0x0000000003540000-0x0000000003936000-memory.dmp

Filesize
4.0MB

Download
memory/2856-101-0x000000013F460000-0x000000013F856000-memory.dmp

Filesize
4.0MB

Download
memory/2856-89-0x000000013F490000-0x000000013F886000-memory.dmp

Filesize
4.0MB

Download
memory/2856-62-0x0000000003030000-0x0000000003426000-memory.dmp

Filesize
4.0MB

Download
memory/2856-53-0x0000000003540000-0x0000000003936000-memory.dmp

Filesize
4.0MB

Download
memory/2856-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2856-16-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/2880-97-0x000000013F180000-0x000000013F576000-memory.dmp

Filesize
4.0MB

Download