xmrig | bb7b338db87ed6f8e3e5f0820c6e12fc89eece6e5fd774794792ea917bae56a8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
Size

2.2MB
MD5

d4ab1c2df6729b368c14a80d1e41a660
SHA1

47b1d856cee8853b71c0cc5c00e2a7a6cafd38cb
SHA256

bb7b338db87ed6f8e3e5f0820c6e12fc89eece6e5fd774794792ea917bae56a8
SHA512

495334f500af8d694dee8cbfe2217e20f1b95f1a15f27e56f18f3f1b251ad4a3edd4cb013d2576c2d5e9f4cd22b91df920a190c4f82759cb88349c8bc25ea066
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbbnlD5DhUKZIx4yT:BemTLkNdfE0pZrr

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1796-0-0x000000013F1D0000-0x000000013F524000-memory.dmp	xmrig
behavioral1/files/0x000700000001211c-3.dat	xmrig
behavioral1/memory/2236-8-0x000000013FE80000-0x00000001401D4000-memory.dmp	xmrig
behavioral1/files/0x0035000000015d90-9.dat	xmrig
behavioral1/memory/1796-12-0x000000013FC80000-0x000000013FFD4000-memory.dmp	xmrig
behavioral1/files/0x0008000000015f73-11.dat	xmrig
behavioral1/files/0x000800000001611e-23.dat	xmrig
behavioral1/memory/2832-19-0x000000013FC80000-0x000000013FFD4000-memory.dmp	xmrig
behavioral1/memory/2616-22-0x000000013F7A0000-0x000000013FAF4000-memory.dmp	xmrig
behavioral1/memory/2736-29-0x000000013F3E0000-0x000000013F734000-memory.dmp	xmrig
behavioral1/memory/2276-35-0x000000013F450000-0x000000013F7A4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016455-39.dat	xmrig
behavioral1/memory/2548-41-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/memory/1796-56-0x000000013FC80000-0x000000013FFD4000-memory.dmp	xmrig
behavioral1/files/0x0008000000016835-65.dat	xmrig
behavioral1/memory/2576-67-0x000000013F7A0000-0x000000013FAF4000-memory.dmp	xmrig
behavioral1/files/0x00090000000165e1-59.dat	xmrig
behavioral1/files/0x0006000000016d9f-83.dat	xmrig
behavioral1/memory/2600-89-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/files/0x00060000000173f6-140.dat	xmrig
behavioral1/files/0x000500000001870f-170.dat	xmrig
behavioral1/memory/2996-1197-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/memory/2576-908-0x000000013F7A0000-0x000000013FAF4000-memory.dmp	xmrig
behavioral1/memory/2488-313-0x000000013FC80000-0x000000013FFD4000-memory.dmp	xmrig
behavioral1/files/0x000500000001879e-195.dat	xmrig
behavioral1/files/0x0005000000018797-190.dat	xmrig
behavioral1/files/0x0005000000018784-185.dat	xmrig
behavioral1/files/0x0005000000018723-180.dat	xmrig
behavioral1/files/0x000500000001871f-175.dat	xmrig
behavioral1/files/0x000500000001870e-166.dat	xmrig
behavioral1/files/0x000d000000018673-160.dat	xmrig
behavioral1/files/0x0014000000018668-155.dat	xmrig
behavioral1/files/0x0006000000017577-150.dat	xmrig
behavioral1/files/0x00060000000173f9-145.dat	xmrig
behavioral1/files/0x00060000000173ca-135.dat	xmrig
behavioral1/files/0x0006000000017223-130.dat	xmrig
behavioral1/files/0x00060000000171d7-125.dat	xmrig
behavioral1/files/0x0006000000016de3-120.dat	xmrig
behavioral1/files/0x0006000000016ddc-115.dat	xmrig
behavioral1/files/0x0006000000016dd1-109.dat	xmrig
behavioral1/memory/1764-105-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	xmrig
behavioral1/memory/2892-97-0x000000013FE00000-0x0000000140154000-memory.dmp	xmrig
behavioral1/files/0x0006000000016dc8-101.dat	xmrig
behavioral1/memory/2548-95-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/files/0x0006000000016dba-93.dat	xmrig
behavioral1/memory/2276-88-0x000000013F450000-0x000000013F7A4000-memory.dmp	xmrig
behavioral1/memory/1856-80-0x000000013F950000-0x000000013FCA4000-memory.dmp	xmrig
behavioral1/memory/2832-78-0x000000013FC80000-0x000000013FFD4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d8b-77.dat	xmrig
behavioral1/memory/2996-71-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/memory/2236-66-0x000000013FE80000-0x00000001401D4000-memory.dmp	xmrig
behavioral1/memory/2488-57-0x000000013FC80000-0x000000013FFD4000-memory.dmp	xmrig
behavioral1/memory/2432-50-0x000000013F740000-0x000000013FA94000-memory.dmp	xmrig
behavioral1/files/0x0036000000015d9f-48.dat	xmrig
behavioral1/memory/1796-55-0x000000013F1D0000-0x000000013F524000-memory.dmp	xmrig
behavioral1/files/0x0007000000016581-54.dat	xmrig
behavioral1/files/0x00070000000162e4-33.dat	xmrig
behavioral1/memory/1856-1834-0x000000013F950000-0x000000013FCA4000-memory.dmp	xmrig
behavioral1/memory/1796-1833-0x000000013F950000-0x000000013FCA4000-memory.dmp	xmrig
behavioral1/memory/2600-2532-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/memory/2892-2624-0x000000013FE00000-0x0000000140154000-memory.dmp	xmrig
behavioral1/memory/1764-2714-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	xmrig
behavioral1/memory/1796-2885-0x00000000020F0000-0x0000000002444000-memory.dmp	xmrig
behavioral1/memory/2236-4044-0x000000013FE80000-0x00000001401D4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2236	mavLoMQ.exe
2832	BfzWouU.exe
2616	hJRrizy.exe
2736	pIgeany.exe
2276	anpwzdR.exe
2548	rfjFpjx.exe
2432	fWipKfv.exe
2488	yveNaJy.exe
2576	TtTZVXY.exe
2996	oHKPaYY.exe
1856	IRQGWsu.exe
2600	KyUkOJz.exe
2892	UatugEJ.exe
1764	OsmRTKz.exe
1704	YdXpHBg.exe
1308	lxAWzjc.exe
2300	kqqHLrq.exe
1444	jOKYdxq.exe
2500	FsQzUIr.exe
2788	HizXoui.exe
536	XrdKBYK.exe
2064	ywwmiDI.exe
1460	HSjVrQF.exe
628	YCtnbGP.exe
1960	zlcgNKC.exe
2100	aylequz.exe
2084	JnJoDUB.exe
2896	xHzMOUR.exe
2692	IUPktMU.exe
1948	uWXmDoX.exe
1344	gNbyuqG.exe
1104	wLcyczG.exe
648	UfxJrhU.exe
1788	pQmhKLS.exe
1968	kDeypmS.exe
2472	ceqeulJ.exe
2340	PkhaWIC.exe
2376	lshRbau.exe
1348	vyFkKgq.exe
1672	TMBNfsH.exe
1784	VQBsNNq.exe
1384	lBvPUGP.exe
2956	TPwcgnw.exe
2972	UCoZSzl.exe
824	YgbPjHT.exe
1508	opYYtrO.exe
548	qCTUZUg.exe
2220	maGucQw.exe
1700	thZgvya.exe
2420	HlxVFdM.exe
1688	VebpdSg.exe
2256	yzYQyrz.exe
2320	YMRPMGi.exe
2176	ELItFky.exe
1660	rnLucuJ.exe
296	lNUZWEf.exe
1572	LPbQbDH.exe
1716	OzthwHx.exe
2484	PUgtYmG.exe
2128	xKzpRlX.exe
2664	IJiTCaK.exe
1624	QAvXDKf.exe
2552	yPJFJwu.exe
2700	usHuhtK.exe

Loads dropped DLL 64 IoCs

pid	Process
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1796-0-0x000000013F1D0000-0x000000013F524000-memory.dmp	upx
behavioral1/files/0x000700000001211c-3.dat	upx
behavioral1/memory/2236-8-0x000000013FE80000-0x00000001401D4000-memory.dmp	upx
behavioral1/files/0x0035000000015d90-9.dat	upx
behavioral1/files/0x0008000000015f73-11.dat	upx
behavioral1/files/0x000800000001611e-23.dat	upx
behavioral1/memory/2832-19-0x000000013FC80000-0x000000013FFD4000-memory.dmp	upx
behavioral1/memory/2616-22-0x000000013F7A0000-0x000000013FAF4000-memory.dmp	upx
behavioral1/memory/2736-29-0x000000013F3E0000-0x000000013F734000-memory.dmp	upx
behavioral1/memory/2276-35-0x000000013F450000-0x000000013F7A4000-memory.dmp	upx
behavioral1/files/0x0007000000016455-39.dat	upx
behavioral1/memory/2548-41-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/files/0x0008000000016835-65.dat	upx
behavioral1/memory/2576-67-0x000000013F7A0000-0x000000013FAF4000-memory.dmp	upx
behavioral1/files/0x00090000000165e1-59.dat	upx
behavioral1/files/0x0006000000016d9f-83.dat	upx
behavioral1/memory/2600-89-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/files/0x00060000000173f6-140.dat	upx
behavioral1/files/0x000500000001870f-170.dat	upx
behavioral1/memory/2996-1197-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/memory/2576-908-0x000000013F7A0000-0x000000013FAF4000-memory.dmp	upx
behavioral1/memory/2488-313-0x000000013FC80000-0x000000013FFD4000-memory.dmp	upx
behavioral1/files/0x000500000001879e-195.dat	upx
behavioral1/files/0x0005000000018797-190.dat	upx
behavioral1/files/0x0005000000018784-185.dat	upx
behavioral1/files/0x0005000000018723-180.dat	upx
behavioral1/files/0x000500000001871f-175.dat	upx
behavioral1/files/0x000500000001870e-166.dat	upx
behavioral1/files/0x000d000000018673-160.dat	upx
behavioral1/files/0x0014000000018668-155.dat	upx
behavioral1/files/0x0006000000017577-150.dat	upx
behavioral1/files/0x00060000000173f9-145.dat	upx
behavioral1/files/0x00060000000173ca-135.dat	upx
behavioral1/files/0x0006000000017223-130.dat	upx
behavioral1/files/0x00060000000171d7-125.dat	upx
behavioral1/files/0x0006000000016de3-120.dat	upx
behavioral1/files/0x0006000000016ddc-115.dat	upx
behavioral1/files/0x0006000000016dd1-109.dat	upx
behavioral1/memory/1764-105-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	upx
behavioral1/memory/2892-97-0x000000013FE00000-0x0000000140154000-memory.dmp	upx
behavioral1/files/0x0006000000016dc8-101.dat	upx
behavioral1/memory/2548-95-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/files/0x0006000000016dba-93.dat	upx
behavioral1/memory/2276-88-0x000000013F450000-0x000000013F7A4000-memory.dmp	upx
behavioral1/memory/1856-80-0x000000013F950000-0x000000013FCA4000-memory.dmp	upx
behavioral1/memory/2832-78-0x000000013FC80000-0x000000013FFD4000-memory.dmp	upx
behavioral1/files/0x0006000000016d8b-77.dat	upx
behavioral1/memory/2996-71-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/memory/2236-66-0x000000013FE80000-0x00000001401D4000-memory.dmp	upx
behavioral1/memory/2488-57-0x000000013FC80000-0x000000013FFD4000-memory.dmp	upx
behavioral1/memory/2432-50-0x000000013F740000-0x000000013FA94000-memory.dmp	upx
behavioral1/files/0x0036000000015d9f-48.dat	upx
behavioral1/memory/1796-55-0x000000013F1D0000-0x000000013F524000-memory.dmp	upx
behavioral1/files/0x0007000000016581-54.dat	upx
behavioral1/files/0x00070000000162e4-33.dat	upx
behavioral1/memory/1856-1834-0x000000013F950000-0x000000013FCA4000-memory.dmp	upx
behavioral1/memory/2600-2532-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/memory/2892-2624-0x000000013FE00000-0x0000000140154000-memory.dmp	upx
behavioral1/memory/1764-2714-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	upx
behavioral1/memory/2236-4044-0x000000013FE80000-0x00000001401D4000-memory.dmp	upx
behavioral1/memory/2616-4045-0x000000013F7A0000-0x000000013FAF4000-memory.dmp	upx
behavioral1/memory/2832-4046-0x000000013FC80000-0x000000013FFD4000-memory.dmp	upx
behavioral1/memory/2736-4047-0x000000013F3E0000-0x000000013F734000-memory.dmp	upx
behavioral1/memory/2276-4048-0x000000013F450000-0x000000013F7A4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BLRLqnf.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\eApfVZN.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\NHnkixN.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\ryJMLQa.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\RZMdMNM.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\XkcqVCy.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\EtlQbWh.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\fEFakEV.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\CUQvBzf.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\CEPNVDC.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\sRcPsqT.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\IJiTCaK.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\YlxVpNk.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\UjIxcFh.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\hYFzkmF.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\cwxLPxu.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\ufxybPO.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\bhUyuLi.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\SXscBYG.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\THVUNJu.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\fuSbxnn.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\TwwNihl.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\IRQGWsu.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\yHozSSy.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\NCzOiVr.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\tJCpHnG.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\hpDZSwd.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\xqMjRtj.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\bACQdMa.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\mlRnZqF.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\CXiLIWX.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\VekEswB.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\BBeFfli.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\dkPyDRr.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\PQXgsEQ.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\fVWxFlO.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\ooWhMkW.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\tXDLCpx.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\jkZTQXP.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\bQLrUOK.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\Donvrii.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\GllZtHs.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\VsqWZjl.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\pNfelkA.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\ezyHXZr.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\GTgvljM.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\XhOrWCo.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\aZEbgiB.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\JCPwGbq.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\BvEreNu.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\WbVBFln.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\oqKvFLs.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\CbrZXIj.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\epIKzUy.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\pbcXXrv.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\XoZvTSB.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\MIVtFwZ.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\IYyGnhw.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\HVdhfZm.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\vZpIAop.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\taBcbpf.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\XpwLtJn.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\gfcZvhu.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
File created	C:\Windows\System\zfiTkkE.exe	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2236	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	29
PID 1796 wrote to memory of 2236	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	29
PID 1796 wrote to memory of 2236	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	29
PID 1796 wrote to memory of 2832	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	30
PID 1796 wrote to memory of 2832	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	30
PID 1796 wrote to memory of 2832	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	30
PID 1796 wrote to memory of 2616	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	31
PID 1796 wrote to memory of 2616	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	31
PID 1796 wrote to memory of 2616	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	31
PID 1796 wrote to memory of 2736	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	32
PID 1796 wrote to memory of 2736	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	32
PID 1796 wrote to memory of 2736	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	32
PID 1796 wrote to memory of 2276	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	33
PID 1796 wrote to memory of 2276	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	33
PID 1796 wrote to memory of 2276	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	33
PID 1796 wrote to memory of 2548	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	34
PID 1796 wrote to memory of 2548	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	34
PID 1796 wrote to memory of 2548	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	34
PID 1796 wrote to memory of 2432	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	35
PID 1796 wrote to memory of 2432	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	35
PID 1796 wrote to memory of 2432	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	35
PID 1796 wrote to memory of 2488	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	36
PID 1796 wrote to memory of 2488	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	36
PID 1796 wrote to memory of 2488	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	36
PID 1796 wrote to memory of 2576	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	37
PID 1796 wrote to memory of 2576	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	37
PID 1796 wrote to memory of 2576	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	37
PID 1796 wrote to memory of 2996	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	38
PID 1796 wrote to memory of 2996	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	38
PID 1796 wrote to memory of 2996	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	38
PID 1796 wrote to memory of 1856	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	39
PID 1796 wrote to memory of 1856	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	39
PID 1796 wrote to memory of 1856	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	39
PID 1796 wrote to memory of 2600	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	40
PID 1796 wrote to memory of 2600	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	40
PID 1796 wrote to memory of 2600	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	40
PID 1796 wrote to memory of 2892	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	41
PID 1796 wrote to memory of 2892	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	41
PID 1796 wrote to memory of 2892	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	41
PID 1796 wrote to memory of 1764	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	42
PID 1796 wrote to memory of 1764	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	42
PID 1796 wrote to memory of 1764	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	42
PID 1796 wrote to memory of 1704	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	43
PID 1796 wrote to memory of 1704	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	43
PID 1796 wrote to memory of 1704	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	43
PID 1796 wrote to memory of 1308	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	44
PID 1796 wrote to memory of 1308	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	44
PID 1796 wrote to memory of 1308	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	44
PID 1796 wrote to memory of 2300	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	45
PID 1796 wrote to memory of 2300	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	45
PID 1796 wrote to memory of 2300	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	45
PID 1796 wrote to memory of 1444	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	46
PID 1796 wrote to memory of 1444	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	46
PID 1796 wrote to memory of 1444	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	46
PID 1796 wrote to memory of 2500	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	47
PID 1796 wrote to memory of 2500	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	47
PID 1796 wrote to memory of 2500	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	47
PID 1796 wrote to memory of 2788	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	48
PID 1796 wrote to memory of 2788	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	48
PID 1796 wrote to memory of 2788	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	48
PID 1796 wrote to memory of 536	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	49
PID 1796 wrote to memory of 536	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	49
PID 1796 wrote to memory of 536	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	49
PID 1796 wrote to memory of 2064	1796	d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d4ab1c2df6729b368c14a80d1e41a660_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\System\mavLoMQ.exe
  C:\Windows\System\mavLoMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\BfzWouU.exe
  C:\Windows\System\BfzWouU.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\hJRrizy.exe
  C:\Windows\System\hJRrizy.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\pIgeany.exe
  C:\Windows\System\pIgeany.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\anpwzdR.exe
  C:\Windows\System\anpwzdR.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\rfjFpjx.exe
  C:\Windows\System\rfjFpjx.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\fWipKfv.exe
  C:\Windows\System\fWipKfv.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\yveNaJy.exe
  C:\Windows\System\yveNaJy.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\TtTZVXY.exe
  C:\Windows\System\TtTZVXY.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\oHKPaYY.exe
  C:\Windows\System\oHKPaYY.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\IRQGWsu.exe
  C:\Windows\System\IRQGWsu.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\KyUkOJz.exe
  C:\Windows\System\KyUkOJz.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\UatugEJ.exe
  C:\Windows\System\UatugEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\OsmRTKz.exe
  C:\Windows\System\OsmRTKz.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\YdXpHBg.exe
  C:\Windows\System\YdXpHBg.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\lxAWzjc.exe
  C:\Windows\System\lxAWzjc.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\kqqHLrq.exe
  C:\Windows\System\kqqHLrq.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\jOKYdxq.exe
  C:\Windows\System\jOKYdxq.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\FsQzUIr.exe
  C:\Windows\System\FsQzUIr.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\HizXoui.exe
  C:\Windows\System\HizXoui.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\XrdKBYK.exe
  C:\Windows\System\XrdKBYK.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\ywwmiDI.exe
  C:\Windows\System\ywwmiDI.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\HSjVrQF.exe
  C:\Windows\System\HSjVrQF.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\YCtnbGP.exe
  C:\Windows\System\YCtnbGP.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\zlcgNKC.exe
  C:\Windows\System\zlcgNKC.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\aylequz.exe
  C:\Windows\System\aylequz.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\JnJoDUB.exe
  C:\Windows\System\JnJoDUB.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\xHzMOUR.exe
  C:\Windows\System\xHzMOUR.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\IUPktMU.exe
  C:\Windows\System\IUPktMU.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\uWXmDoX.exe
  C:\Windows\System\uWXmDoX.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\gNbyuqG.exe
  C:\Windows\System\gNbyuqG.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\wLcyczG.exe
  C:\Windows\System\wLcyczG.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\UfxJrhU.exe
  C:\Windows\System\UfxJrhU.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\pQmhKLS.exe
  C:\Windows\System\pQmhKLS.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\kDeypmS.exe
  C:\Windows\System\kDeypmS.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ceqeulJ.exe
  C:\Windows\System\ceqeulJ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\PkhaWIC.exe
  C:\Windows\System\PkhaWIC.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\lshRbau.exe
  C:\Windows\System\lshRbau.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\vyFkKgq.exe
  C:\Windows\System\vyFkKgq.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\TMBNfsH.exe
  C:\Windows\System\TMBNfsH.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\VQBsNNq.exe
  C:\Windows\System\VQBsNNq.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\lBvPUGP.exe
  C:\Windows\System\lBvPUGP.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\TPwcgnw.exe
  C:\Windows\System\TPwcgnw.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\UCoZSzl.exe
  C:\Windows\System\UCoZSzl.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\YgbPjHT.exe
  C:\Windows\System\YgbPjHT.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\opYYtrO.exe
  C:\Windows\System\opYYtrO.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\qCTUZUg.exe
  C:\Windows\System\qCTUZUg.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\maGucQw.exe
  C:\Windows\System\maGucQw.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\thZgvya.exe
  C:\Windows\System\thZgvya.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\HlxVFdM.exe
  C:\Windows\System\HlxVFdM.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\VebpdSg.exe
  C:\Windows\System\VebpdSg.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\yzYQyrz.exe
  C:\Windows\System\yzYQyrz.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\YMRPMGi.exe
  C:\Windows\System\YMRPMGi.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\ELItFky.exe
  C:\Windows\System\ELItFky.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\rnLucuJ.exe
  C:\Windows\System\rnLucuJ.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\lNUZWEf.exe
  C:\Windows\System\lNUZWEf.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\LPbQbDH.exe
  C:\Windows\System\LPbQbDH.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\OzthwHx.exe
  C:\Windows\System\OzthwHx.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\PUgtYmG.exe
  C:\Windows\System\PUgtYmG.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\xKzpRlX.exe
  C:\Windows\System\xKzpRlX.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\IJiTCaK.exe
  C:\Windows\System\IJiTCaK.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\QAvXDKf.exe
  C:\Windows\System\QAvXDKf.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\yPJFJwu.exe
  C:\Windows\System\yPJFJwu.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\usHuhtK.exe
  C:\Windows\System\usHuhtK.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\RZnTfpK.exe
  C:\Windows\System\RZnTfpK.exe
  2⤵
  PID:2436
- C:\Windows\System\XfOZxCJ.exe
  C:\Windows\System\XfOZxCJ.exe
  2⤵
  PID:1676
- C:\Windows\System\RSdmMqa.exe
  C:\Windows\System\RSdmMqa.exe
  2⤵
  PID:2900
- C:\Windows\System\bJhztYT.exe
  C:\Windows\System\bJhztYT.exe
  2⤵
  PID:2764
- C:\Windows\System\JWXjrQG.exe
  C:\Windows\System\JWXjrQG.exe
  2⤵
  PID:1616
- C:\Windows\System\fyABPym.exe
  C:\Windows\System\fyABPym.exe
  2⤵
  PID:1528
- C:\Windows\System\ZqZHGxz.exe
  C:\Windows\System\ZqZHGxz.exe
  2⤵
  PID:2780
- C:\Windows\System\MkcQaEC.exe
  C:\Windows\System\MkcQaEC.exe
  2⤵
  PID:1300
- C:\Windows\System\UyJeMSY.exe
  C:\Windows\System\UyJeMSY.exe
  2⤵
  PID:1336
- C:\Windows\System\ZOHyoTV.exe
  C:\Windows\System\ZOHyoTV.exe
  2⤵
  PID:1240
- C:\Windows\System\rmRbtDe.exe
  C:\Windows\System\rmRbtDe.exe
  2⤵
  PID:564
- C:\Windows\System\xGTdzKR.exe
  C:\Windows\System\xGTdzKR.exe
  2⤵
  PID:2940
- C:\Windows\System\uUrpXtZ.exe
  C:\Windows\System\uUrpXtZ.exe
  2⤵
  PID:1728
- C:\Windows\System\LYANzfZ.exe
  C:\Windows\System\LYANzfZ.exe
  2⤵
  PID:588
- C:\Windows\System\qCuiwwP.exe
  C:\Windows\System\qCuiwwP.exe
  2⤵
  PID:1140
- C:\Windows\System\zjVxGJu.exe
  C:\Windows\System\zjVxGJu.exe
  2⤵
  PID:1544
- C:\Windows\System\zoiveCH.exe
  C:\Windows\System\zoiveCH.exe
  2⤵
  PID:2464
- C:\Windows\System\QFlFshB.exe
  C:\Windows\System\QFlFshB.exe
  2⤵
  PID:2356
- C:\Windows\System\iTVqKcX.exe
  C:\Windows\System\iTVqKcX.exe
  2⤵
  PID:1780
- C:\Windows\System\fXTMgQk.exe
  C:\Windows\System\fXTMgQk.exe
  2⤵
  PID:304
- C:\Windows\System\RQCWdQw.exe
  C:\Windows\System\RQCWdQw.exe
  2⤵
  PID:764
- C:\Windows\System\PmCzfJI.exe
  C:\Windows\System\PmCzfJI.exe
  2⤵
  PID:2944
- C:\Windows\System\rqAFPSR.exe
  C:\Windows\System\rqAFPSR.exe
  2⤵
  PID:1152
- C:\Windows\System\tVyxtRl.exe
  C:\Windows\System\tVyxtRl.exe
  2⤵
  PID:3052
- C:\Windows\System\RFAXfZd.exe
  C:\Windows\System\RFAXfZd.exe
  2⤵
  PID:1828
- C:\Windows\System\LUywmeI.exe
  C:\Windows\System\LUywmeI.exe
  2⤵
  PID:2264
- C:\Windows\System\YsOEwnc.exe
  C:\Windows\System\YsOEwnc.exe
  2⤵
  PID:1004
- C:\Windows\System\NjAbEsX.exe
  C:\Windows\System\NjAbEsX.exe
  2⤵
  PID:1752
- C:\Windows\System\EFBGBdz.exe
  C:\Windows\System\EFBGBdz.exe
  2⤵
  PID:3028
- C:\Windows\System\tybgsFZ.exe
  C:\Windows\System\tybgsFZ.exe
  2⤵
  PID:1612
- C:\Windows\System\fUnNmMV.exe
  C:\Windows\System\fUnNmMV.exe
  2⤵
  PID:2228
- C:\Windows\System\ALwGDEZ.exe
  C:\Windows\System\ALwGDEZ.exe
  2⤵
  PID:2932
- C:\Windows\System\poQhOKi.exe
  C:\Windows\System\poQhOKi.exe
  2⤵
  PID:2796
- C:\Windows\System\PEiXNId.exe
  C:\Windows\System\PEiXNId.exe
  2⤵
  PID:2564
- C:\Windows\System\sEOLEJz.exe
  C:\Windows\System\sEOLEJz.exe
  2⤵
  PID:2696
- C:\Windows\System\hGjhZFr.exe
  C:\Windows\System\hGjhZFr.exe
  2⤵
  PID:2284
- C:\Windows\System\RVnJNxn.exe
  C:\Windows\System\RVnJNxn.exe
  2⤵
  PID:1628
- C:\Windows\System\BqGRVZk.exe
  C:\Windows\System\BqGRVZk.exe
  2⤵
  PID:2572
- C:\Windows\System\SbtFoQZ.exe
  C:\Windows\System\SbtFoQZ.exe
  2⤵
  PID:1324
- C:\Windows\System\JALLotV.exe
  C:\Windows\System\JALLotV.exe
  2⤵
  PID:2248
- C:\Windows\System\LChYuSc.exe
  C:\Windows\System\LChYuSc.exe
  2⤵
  PID:2060
- C:\Windows\System\kFGTlMZ.exe
  C:\Windows\System\kFGTlMZ.exe
  2⤵
  PID:1400
- C:\Windows\System\wOTRhZo.exe
  C:\Windows\System\wOTRhZo.exe
  2⤵
  PID:976
- C:\Windows\System\JbBpiya.exe
  C:\Windows\System\JbBpiya.exe
  2⤵
  PID:2344
- C:\Windows\System\WaiBrtB.exe
  C:\Windows\System\WaiBrtB.exe
  2⤵
  PID:1756
- C:\Windows\System\TSgPApa.exe
  C:\Windows\System\TSgPApa.exe
  2⤵
  PID:1364
- C:\Windows\System\HdSCSDX.exe
  C:\Windows\System\HdSCSDX.exe
  2⤵
  PID:2920
- C:\Windows\System\vLOGxZy.exe
  C:\Windows\System\vLOGxZy.exe
  2⤵
  PID:1648
- C:\Windows\System\DKtyZiM.exe
  C:\Windows\System\DKtyZiM.exe
  2⤵
  PID:2088
- C:\Windows\System\QUdpxeV.exe
  C:\Windows\System\QUdpxeV.exe
  2⤵
  PID:828
- C:\Windows\System\vMorknF.exe
  C:\Windows\System\vMorknF.exe
  2⤵
  PID:2412
- C:\Windows\System\JbYHCBq.exe
  C:\Windows\System\JbYHCBq.exe
  2⤵
  PID:2444
- C:\Windows\System\wPtPsyo.exe
  C:\Windows\System\wPtPsyo.exe
  2⤵
  PID:2724
- C:\Windows\System\sgdfmmT.exe
  C:\Windows\System\sgdfmmT.exe
  2⤵
  PID:2732
- C:\Windows\System\HQaiCGo.exe
  C:\Windows\System\HQaiCGo.exe
  2⤵
  PID:3000
- C:\Windows\System\yYeuJUT.exe
  C:\Windows\System\yYeuJUT.exe
  2⤵
  PID:2260
- C:\Windows\System\KssbsAt.exe
  C:\Windows\System\KssbsAt.exe
  2⤵
  PID:3092
- C:\Windows\System\pvFEsiZ.exe
  C:\Windows\System\pvFEsiZ.exe
  2⤵
  PID:3108
- C:\Windows\System\IjftFkk.exe
  C:\Windows\System\IjftFkk.exe
  2⤵
  PID:3132
- C:\Windows\System\vGivdrL.exe
  C:\Windows\System\vGivdrL.exe
  2⤵
  PID:3148
- C:\Windows\System\ZaoDgwW.exe
  C:\Windows\System\ZaoDgwW.exe
  2⤵
  PID:3172
- C:\Windows\System\YlxVpNk.exe
  C:\Windows\System\YlxVpNk.exe
  2⤵
  PID:3188
- C:\Windows\System\ktlBZOF.exe
  C:\Windows\System\ktlBZOF.exe
  2⤵
  PID:3204
- C:\Windows\System\IKJOoYd.exe
  C:\Windows\System\IKJOoYd.exe
  2⤵
  PID:3228
- C:\Windows\System\FBegjNd.exe
  C:\Windows\System\FBegjNd.exe
  2⤵
  PID:3248
- C:\Windows\System\BjDJBxl.exe
  C:\Windows\System\BjDJBxl.exe
  2⤵
  PID:3264
- C:\Windows\System\VsqWZjl.exe
  C:\Windows\System\VsqWZjl.exe
  2⤵
  PID:3284
- C:\Windows\System\DYtzMYN.exe
  C:\Windows\System\DYtzMYN.exe
  2⤵
  PID:3304
- C:\Windows\System\RxzWeUf.exe
  C:\Windows\System\RxzWeUf.exe
  2⤵
  PID:3320
- C:\Windows\System\OLMaBpw.exe
  C:\Windows\System\OLMaBpw.exe
  2⤵
  PID:3348
- C:\Windows\System\RIUzakc.exe
  C:\Windows\System\RIUzakc.exe
  2⤵
  PID:3372
- C:\Windows\System\SEDFpeO.exe
  C:\Windows\System\SEDFpeO.exe
  2⤵
  PID:3392
- C:\Windows\System\XsCRLVA.exe
  C:\Windows\System\XsCRLVA.exe
  2⤵
  PID:3412
- C:\Windows\System\CnpKkkq.exe
  C:\Windows\System\CnpKkkq.exe
  2⤵
  PID:3428
- C:\Windows\System\aDCQtUV.exe
  C:\Windows\System\aDCQtUV.exe
  2⤵
  PID:3452
- C:\Windows\System\vgdQZeY.exe
  C:\Windows\System\vgdQZeY.exe
  2⤵
  PID:3472
- C:\Windows\System\DSDNkYF.exe
  C:\Windows\System\DSDNkYF.exe
  2⤵
  PID:3492
- C:\Windows\System\HCBvLvr.exe
  C:\Windows\System\HCBvLvr.exe
  2⤵
  PID:3508
- C:\Windows\System\ugkSJSw.exe
  C:\Windows\System\ugkSJSw.exe
  2⤵
  PID:3532
- C:\Windows\System\SBKsvQw.exe
  C:\Windows\System\SBKsvQw.exe
  2⤵
  PID:3552
- C:\Windows\System\xzOzQWF.exe
  C:\Windows\System\xzOzQWF.exe
  2⤵
  PID:3576
- C:\Windows\System\VjBXFrj.exe
  C:\Windows\System\VjBXFrj.exe
  2⤵
  PID:3596
- C:\Windows\System\rtbeCya.exe
  C:\Windows\System\rtbeCya.exe
  2⤵
  PID:3616
- C:\Windows\System\JKLUgRM.exe
  C:\Windows\System\JKLUgRM.exe
  2⤵
  PID:3632
- C:\Windows\System\zprDwnG.exe
  C:\Windows\System\zprDwnG.exe
  2⤵
  PID:3656
- C:\Windows\System\WxvOEDu.exe
  C:\Windows\System\WxvOEDu.exe
  2⤵
  PID:3676
- C:\Windows\System\oUMMDdq.exe
  C:\Windows\System\oUMMDdq.exe
  2⤵
  PID:3696
- C:\Windows\System\xgorBaa.exe
  C:\Windows\System\xgorBaa.exe
  2⤵
  PID:3712
- C:\Windows\System\NXfNWba.exe
  C:\Windows\System\NXfNWba.exe
  2⤵
  PID:3736
- C:\Windows\System\MmoHxjf.exe
  C:\Windows\System\MmoHxjf.exe
  2⤵
  PID:3756
- C:\Windows\System\gFscHkO.exe
  C:\Windows\System\gFscHkO.exe
  2⤵
  PID:3776
- C:\Windows\System\IwUlqUv.exe
  C:\Windows\System\IwUlqUv.exe
  2⤵
  PID:3792
- C:\Windows\System\ZSIfELg.exe
  C:\Windows\System\ZSIfELg.exe
  2⤵
  PID:3812
- C:\Windows\System\KkqqkZA.exe
  C:\Windows\System\KkqqkZA.exe
  2⤵
  PID:3832
- C:\Windows\System\IYyGnhw.exe
  C:\Windows\System\IYyGnhw.exe
  2⤵
  PID:3852
- C:\Windows\System\hmMDwtg.exe
  C:\Windows\System\hmMDwtg.exe
  2⤵
  PID:3876
- C:\Windows\System\BszcNiu.exe
  C:\Windows\System\BszcNiu.exe
  2⤵
  PID:3896
- C:\Windows\System\xDHhGAi.exe
  C:\Windows\System\xDHhGAi.exe
  2⤵
  PID:3916
- C:\Windows\System\ApsSWzQ.exe
  C:\Windows\System\ApsSWzQ.exe
  2⤵
  PID:3936
- C:\Windows\System\QzDCsVS.exe
  C:\Windows\System\QzDCsVS.exe
  2⤵
  PID:3956
- C:\Windows\System\bypUyIH.exe
  C:\Windows\System\bypUyIH.exe
  2⤵
  PID:3976
- C:\Windows\System\ryJMLQa.exe
  C:\Windows\System\ryJMLQa.exe
  2⤵
  PID:3992
- C:\Windows\System\LeZouEo.exe
  C:\Windows\System\LeZouEo.exe
  2⤵
  PID:4012
- C:\Windows\System\TQzRsvG.exe
  C:\Windows\System\TQzRsvG.exe
  2⤵
  PID:4032
- C:\Windows\System\XprviaH.exe
  C:\Windows\System\XprviaH.exe
  2⤵
  PID:4048
- C:\Windows\System\cBTbkgh.exe
  C:\Windows\System\cBTbkgh.exe
  2⤵
  PID:4072
- C:\Windows\System\FdzLtgD.exe
  C:\Windows\System\FdzLtgD.exe
  2⤵
  PID:4092
- C:\Windows\System\zpJXGzP.exe
  C:\Windows\System\zpJXGzP.exe
  2⤵
  PID:1816
- C:\Windows\System\LvSvKlG.exe
  C:\Windows\System\LvSvKlG.exe
  2⤵
  PID:1772
- C:\Windows\System\AlKxOMo.exe
  C:\Windows\System\AlKxOMo.exe
  2⤵
  PID:484
- C:\Windows\System\yuMsEeo.exe
  C:\Windows\System\yuMsEeo.exe
  2⤵
  PID:112
- C:\Windows\System\sSeJlnz.exe
  C:\Windows\System\sSeJlnz.exe
  2⤵
  PID:1956
- C:\Windows\System\rrNajBv.exe
  C:\Windows\System\rrNajBv.exe
  2⤵
  PID:1792
- C:\Windows\System\pSVpvVk.exe
  C:\Windows\System\pSVpvVk.exe
  2⤵
  PID:1932
- C:\Windows\System\YqbhOyC.exe
  C:\Windows\System\YqbhOyC.exe
  2⤵
  PID:2148
- C:\Windows\System\jQTcaKm.exe
  C:\Windows\System\jQTcaKm.exe
  2⤵
  PID:1600
- C:\Windows\System\YiFQaXd.exe
  C:\Windows\System\YiFQaXd.exe
  2⤵
  PID:1044
- C:\Windows\System\imqMXsh.exe
  C:\Windows\System\imqMXsh.exe
  2⤵
  PID:3076
- C:\Windows\System\mSTAQSE.exe
  C:\Windows\System\mSTAQSE.exe
  2⤵
  PID:3124
- C:\Windows\System\Tndiyii.exe
  C:\Windows\System\Tndiyii.exe
  2⤵
  PID:3164
- C:\Windows\System\nyUoJkp.exe
  C:\Windows\System\nyUoJkp.exe
  2⤵
  PID:3100
- C:\Windows\System\sWNTSeF.exe
  C:\Windows\System\sWNTSeF.exe
  2⤵
  PID:3140
- C:\Windows\System\ySgmzsC.exe
  C:\Windows\System\ySgmzsC.exe
  2⤵
  PID:3272
- C:\Windows\System\ShDQpFt.exe
  C:\Windows\System\ShDQpFt.exe
  2⤵
  PID:3224
- C:\Windows\System\pyULzzt.exe
  C:\Windows\System\pyULzzt.exe
  2⤵
  PID:3260
- C:\Windows\System\frpOUTt.exe
  C:\Windows\System\frpOUTt.exe
  2⤵
  PID:3360
- C:\Windows\System\ToPcSLi.exe
  C:\Windows\System\ToPcSLi.exe
  2⤵
  PID:3336
- C:\Windows\System\zkMAAML.exe
  C:\Windows\System\zkMAAML.exe
  2⤵
  PID:2308
- C:\Windows\System\YkcRyVd.exe
  C:\Windows\System\YkcRyVd.exe
  2⤵
  PID:3448
- C:\Windows\System\fCROLpI.exe
  C:\Windows\System\fCROLpI.exe
  2⤵
  PID:3384
- C:\Windows\System\yJMzcxX.exe
  C:\Windows\System\yJMzcxX.exe
  2⤵
  PID:3464
- C:\Windows\System\hgJirQA.exe
  C:\Windows\System\hgJirQA.exe
  2⤵
  PID:3524
- C:\Windows\System\pfUrCNH.exe
  C:\Windows\System\pfUrCNH.exe
  2⤵
  PID:3544
- C:\Windows\System\HSHnrkr.exe
  C:\Windows\System\HSHnrkr.exe
  2⤵
  PID:3604
- C:\Windows\System\jYFaiaS.exe
  C:\Windows\System\jYFaiaS.exe
  2⤵
  PID:3648
- C:\Windows\System\AsvhaBk.exe
  C:\Windows\System\AsvhaBk.exe
  2⤵
  PID:3624
- C:\Windows\System\jZqPFXK.exe
  C:\Windows\System\jZqPFXK.exe
  2⤵
  PID:3688
- C:\Windows\System\oxkmSLS.exe
  C:\Windows\System\oxkmSLS.exe
  2⤵
  PID:3732
- C:\Windows\System\RzVCsGc.exe
  C:\Windows\System\RzVCsGc.exe
  2⤵
  PID:3708
- C:\Windows\System\KnLubqU.exe
  C:\Windows\System\KnLubqU.exe
  2⤵
  PID:3808
- C:\Windows\System\VzjNYJU.exe
  C:\Windows\System\VzjNYJU.exe
  2⤵
  PID:3840
- C:\Windows\System\VGhIUfv.exe
  C:\Windows\System\VGhIUfv.exe
  2⤵
  PID:3884
- C:\Windows\System\MPlEuxl.exe
  C:\Windows\System\MPlEuxl.exe
  2⤵
  PID:3868
- C:\Windows\System\UiKNRhs.exe
  C:\Windows\System\UiKNRhs.exe
  2⤵
  PID:3924
- C:\Windows\System\YPdFvVJ.exe
  C:\Windows\System\YPdFvVJ.exe
  2⤵
  PID:3972
- C:\Windows\System\WFmKozE.exe
  C:\Windows\System\WFmKozE.exe
  2⤵
  PID:3912
- C:\Windows\System\RTjHsGo.exe
  C:\Windows\System\RTjHsGo.exe
  2⤵
  PID:3952
- C:\Windows\System\FKRGdGY.exe
  C:\Windows\System\FKRGdGY.exe
  2⤵
  PID:4084
- C:\Windows\System\NuHoRPa.exe
  C:\Windows\System\NuHoRPa.exe
  2⤵
  PID:4060
- C:\Windows\System\UTHRmRQ.exe
  C:\Windows\System\UTHRmRQ.exe
  2⤵
  PID:3068
- C:\Windows\System\EbnxrXB.exe
  C:\Windows\System\EbnxrXB.exe
  2⤵
  PID:2752
- C:\Windows\System\qfIOcgC.exe
  C:\Windows\System\qfIOcgC.exe
  2⤵
  PID:2204
- C:\Windows\System\wahShWY.exe
  C:\Windows\System\wahShWY.exe
  2⤵
  PID:1040
- C:\Windows\System\yHozSSy.exe
  C:\Windows\System\yHozSSy.exe
  2⤵
  PID:1028
- C:\Windows\System\LqDVETP.exe
  C:\Windows\System\LqDVETP.exe
  2⤵
  PID:2024
- C:\Windows\System\BLrakIL.exe
  C:\Windows\System\BLrakIL.exe
  2⤵
  PID:2632
- C:\Windows\System\aWoiZnh.exe
  C:\Windows\System\aWoiZnh.exe
  2⤵
  PID:2512
- C:\Windows\System\WHodJdA.exe
  C:\Windows\System\WHodJdA.exe
  2⤵
  PID:3244
- C:\Windows\System\qisjPax.exe
  C:\Windows\System\qisjPax.exe
  2⤵
  PID:3160
- C:\Windows\System\WqFwjhN.exe
  C:\Windows\System\WqFwjhN.exe
  2⤵
  PID:3216
- C:\Windows\System\PBAOFmL.exe
  C:\Windows\System\PBAOFmL.exe
  2⤵
  PID:3368
- C:\Windows\System\PjRkBgr.exe
  C:\Windows\System\PjRkBgr.exe
  2⤵
  PID:3340
- C:\Windows\System\ReKVWJs.exe
  C:\Windows\System\ReKVWJs.exe
  2⤵
  PID:3344
- C:\Windows\System\BaWGbpN.exe
  C:\Windows\System\BaWGbpN.exe
  2⤵
  PID:3480
- C:\Windows\System\ZmMlNUi.exe
  C:\Windows\System\ZmMlNUi.exe
  2⤵
  PID:3540
- C:\Windows\System\XkcqVCy.exe
  C:\Windows\System\XkcqVCy.exe
  2⤵
  PID:3640
- C:\Windows\System\yrszckd.exe
  C:\Windows\System\yrszckd.exe
  2⤵
  PID:3548
- C:\Windows\System\RMgdaHq.exe
  C:\Windows\System\RMgdaHq.exe
  2⤵
  PID:3672
- C:\Windows\System\dyZInOQ.exe
  C:\Windows\System\dyZInOQ.exe
  2⤵
  PID:3704
- C:\Windows\System\HIsESRd.exe
  C:\Windows\System\HIsESRd.exe
  2⤵
  PID:2916
- C:\Windows\System\CjVZHxl.exe
  C:\Windows\System\CjVZHxl.exe
  2⤵
  PID:3788
- C:\Windows\System\DyPcatC.exe
  C:\Windows\System\DyPcatC.exe
  2⤵
  PID:3968
- C:\Windows\System\JYrpuCa.exe
  C:\Windows\System\JYrpuCa.exe
  2⤵
  PID:4040
- C:\Windows\System\rGcpJpq.exe
  C:\Windows\System\rGcpJpq.exe
  2⤵
  PID:3872
- C:\Windows\System\sMxflsz.exe
  C:\Windows\System\sMxflsz.exe
  2⤵
  PID:3864
- C:\Windows\System\wJYqrbv.exe
  C:\Windows\System\wJYqrbv.exe
  2⤵
  PID:3988
- C:\Windows\System\iPPuWQj.exe
  C:\Windows\System\iPPuWQj.exe
  2⤵
  PID:2528
- C:\Windows\System\HATyolf.exe
  C:\Windows\System\HATyolf.exe
  2⤵
  PID:1012
- C:\Windows\System\SfTwJKK.exe
  C:\Windows\System\SfTwJKK.exe
  2⤵
  PID:2912
- C:\Windows\System\SDNIfHr.exe
  C:\Windows\System\SDNIfHr.exe
  2⤵
  PID:3120
- C:\Windows\System\kYjiOud.exe
  C:\Windows\System\kYjiOud.exe
  2⤵
  PID:2224
- C:\Windows\System\vqloYpg.exe
  C:\Windows\System\vqloYpg.exe
  2⤵
  PID:2620
- C:\Windows\System\PuMheip.exe
  C:\Windows\System\PuMheip.exe
  2⤵
  PID:4116
- C:\Windows\System\IJtoidQ.exe
  C:\Windows\System\IJtoidQ.exe
  2⤵
  PID:4132
- C:\Windows\System\jDokyMV.exe
  C:\Windows\System\jDokyMV.exe
  2⤵
  PID:4152
- C:\Windows\System\sNzrejz.exe
  C:\Windows\System\sNzrejz.exe
  2⤵
  PID:4172
- C:\Windows\System\nwaLXhb.exe
  C:\Windows\System\nwaLXhb.exe
  2⤵
  PID:4192
- C:\Windows\System\QogkFSI.exe
  C:\Windows\System\QogkFSI.exe
  2⤵
  PID:4212
- C:\Windows\System\GCEsVXz.exe
  C:\Windows\System\GCEsVXz.exe
  2⤵
  PID:4232
- C:\Windows\System\rLdsaUU.exe
  C:\Windows\System\rLdsaUU.exe
  2⤵
  PID:4248
- C:\Windows\System\pFlmuMX.exe
  C:\Windows\System\pFlmuMX.exe
  2⤵
  PID:4272
- C:\Windows\System\KVkhCWY.exe
  C:\Windows\System\KVkhCWY.exe
  2⤵
  PID:4288
- C:\Windows\System\tDZgqNv.exe
  C:\Windows\System\tDZgqNv.exe
  2⤵
  PID:4316
- C:\Windows\System\xBPffeb.exe
  C:\Windows\System\xBPffeb.exe
  2⤵
  PID:4336
- C:\Windows\System\CZTYtEh.exe
  C:\Windows\System\CZTYtEh.exe
  2⤵
  PID:4356
- C:\Windows\System\FFwbCoh.exe
  C:\Windows\System\FFwbCoh.exe
  2⤵
  PID:4372
- C:\Windows\System\VSKrwMt.exe
  C:\Windows\System\VSKrwMt.exe
  2⤵
  PID:4396
- C:\Windows\System\KHpqhWU.exe
  C:\Windows\System\KHpqhWU.exe
  2⤵
  PID:4412
- C:\Windows\System\IVlPrMJ.exe
  C:\Windows\System\IVlPrMJ.exe
  2⤵
  PID:4436
- C:\Windows\System\ujxfxZm.exe
  C:\Windows\System\ujxfxZm.exe
  2⤵
  PID:4456
- C:\Windows\System\eqZnYVh.exe
  C:\Windows\System\eqZnYVh.exe
  2⤵
  PID:4476
- C:\Windows\System\tuwjPPN.exe
  C:\Windows\System\tuwjPPN.exe
  2⤵
  PID:4492
- C:\Windows\System\pPdMBFZ.exe
  C:\Windows\System\pPdMBFZ.exe
  2⤵
  PID:4512
- C:\Windows\System\bMDjNJp.exe
  C:\Windows\System\bMDjNJp.exe
  2⤵
  PID:4532
- C:\Windows\System\vcRixPy.exe
  C:\Windows\System\vcRixPy.exe
  2⤵
  PID:4560
- C:\Windows\System\FvIoZmc.exe
  C:\Windows\System\FvIoZmc.exe
  2⤵
  PID:4576
- C:\Windows\System\NFilEnw.exe
  C:\Windows\System\NFilEnw.exe
  2⤵
  PID:4592
- C:\Windows\System\nfKlmIY.exe
  C:\Windows\System\nfKlmIY.exe
  2⤵
  PID:4616
- C:\Windows\System\xhPxlza.exe
  C:\Windows\System\xhPxlza.exe
  2⤵
  PID:4640
- C:\Windows\System\zLIJqAc.exe
  C:\Windows\System\zLIJqAc.exe
  2⤵
  PID:4656
- C:\Windows\System\ngbtdXB.exe
  C:\Windows\System\ngbtdXB.exe
  2⤵
  PID:4680
- C:\Windows\System\kkGzpTa.exe
  C:\Windows\System\kkGzpTa.exe
  2⤵
  PID:4696
- C:\Windows\System\zijaIMK.exe
  C:\Windows\System\zijaIMK.exe
  2⤵
  PID:4720
- C:\Windows\System\TNxBvew.exe
  C:\Windows\System\TNxBvew.exe
  2⤵
  PID:4736
- C:\Windows\System\aUNRUsI.exe
  C:\Windows\System\aUNRUsI.exe
  2⤵
  PID:4756
- C:\Windows\System\TFQCYYi.exe
  C:\Windows\System\TFQCYYi.exe
  2⤵
  PID:4776
- C:\Windows\System\szeRMnT.exe
  C:\Windows\System\szeRMnT.exe
  2⤵
  PID:4796
- C:\Windows\System\vscbxGU.exe
  C:\Windows\System\vscbxGU.exe
  2⤵
  PID:4816
- C:\Windows\System\SWPTAHo.exe
  C:\Windows\System\SWPTAHo.exe
  2⤵
  PID:4840
- C:\Windows\System\AEdtuTN.exe
  C:\Windows\System\AEdtuTN.exe
  2⤵
  PID:4860
- C:\Windows\System\rylNEUx.exe
  C:\Windows\System\rylNEUx.exe
  2⤵
  PID:4880
- C:\Windows\System\HIhrhEZ.exe
  C:\Windows\System\HIhrhEZ.exe
  2⤵
  PID:4896
- C:\Windows\System\DyVVAzT.exe
  C:\Windows\System\DyVVAzT.exe
  2⤵
  PID:4920
- C:\Windows\System\HNMGJmG.exe
  C:\Windows\System\HNMGJmG.exe
  2⤵
  PID:4936
- C:\Windows\System\fPJStBR.exe
  C:\Windows\System\fPJStBR.exe
  2⤵
  PID:4960
- C:\Windows\System\JxUfSPP.exe
  C:\Windows\System\JxUfSPP.exe
  2⤵
  PID:4980
- C:\Windows\System\WKqYcKL.exe
  C:\Windows\System\WKqYcKL.exe
  2⤵
  PID:5000
- C:\Windows\System\IaNRjhy.exe
  C:\Windows\System\IaNRjhy.exe
  2⤵
  PID:5016
- C:\Windows\System\zCFezWA.exe
  C:\Windows\System\zCFezWA.exe
  2⤵
  PID:5040
- C:\Windows\System\dLaOkoH.exe
  C:\Windows\System\dLaOkoH.exe
  2⤵
  PID:5060
- C:\Windows\System\kpJHqoj.exe
  C:\Windows\System\kpJHqoj.exe
  2⤵
  PID:5076
- C:\Windows\System\ffaYaIR.exe
  C:\Windows\System\ffaYaIR.exe
  2⤵
  PID:5096
- C:\Windows\System\RRecMWt.exe
  C:\Windows\System\RRecMWt.exe
  2⤵
  PID:3436
- C:\Windows\System\mzbVNUD.exe
  C:\Windows\System\mzbVNUD.exe
  2⤵
  PID:3296
- C:\Windows\System\UZXgTXm.exe
  C:\Windows\System\UZXgTXm.exe
  2⤵
  PID:3504
- C:\Windows\System\yXtoCyC.exe
  C:\Windows\System\yXtoCyC.exe
  2⤵
  PID:3488
- C:\Windows\System\fVWxFlO.exe
  C:\Windows\System\fVWxFlO.exe
  2⤵
  PID:3768
- C:\Windows\System\kgNsvDt.exe
  C:\Windows\System\kgNsvDt.exe
  2⤵
  PID:3824
- C:\Windows\System\HVdhfZm.exe
  C:\Windows\System\HVdhfZm.exe
  2⤵
  PID:3592
- C:\Windows\System\BoDTHon.exe
  C:\Windows\System\BoDTHon.exe
  2⤵
  PID:3728
- C:\Windows\System\WAAcNOt.exe
  C:\Windows\System\WAAcNOt.exe
  2⤵
  PID:4008
- C:\Windows\System\QitQeXp.exe
  C:\Windows\System\QitQeXp.exe
  2⤵
  PID:4088
- C:\Windows\System\EBgMzgk.exe
  C:\Windows\System\EBgMzgk.exe
  2⤵
  PID:1488
- C:\Windows\System\wsGWrXJ.exe
  C:\Windows\System\wsGWrXJ.exe
  2⤵
  PID:3180
- C:\Windows\System\UmGAcOk.exe
  C:\Windows\System\UmGAcOk.exe
  2⤵
  PID:3156
- C:\Windows\System\ZEYmGuM.exe
  C:\Windows\System\ZEYmGuM.exe
  2⤵
  PID:3116
- C:\Windows\System\CMDIIST.exe
  C:\Windows\System\CMDIIST.exe
  2⤵
  PID:4112
- C:\Windows\System\FrGqjiF.exe
  C:\Windows\System\FrGqjiF.exe
  2⤵
  PID:2856
- C:\Windows\System\wdPCfYX.exe
  C:\Windows\System\wdPCfYX.exe
  2⤵
  PID:4188
- C:\Windows\System\fIWrgrE.exe
  C:\Windows\System\fIWrgrE.exe
  2⤵
  PID:4228
- C:\Windows\System\pWYpGET.exe
  C:\Windows\System\pWYpGET.exe
  2⤵
  PID:4168
- C:\Windows\System\MlbLtbd.exe
  C:\Windows\System\MlbLtbd.exe
  2⤵
  PID:4200
- C:\Windows\System\ziWyxqZ.exe
  C:\Windows\System\ziWyxqZ.exe
  2⤵
  PID:4300
- C:\Windows\System\WdHapuH.exe
  C:\Windows\System\WdHapuH.exe
  2⤵
  PID:4284
- C:\Windows\System\VgSBTZK.exe
  C:\Windows\System\VgSBTZK.exe
  2⤵
  PID:4332
- C:\Windows\System\ReNTXuU.exe
  C:\Windows\System\ReNTXuU.exe
  2⤵
  PID:4384
- C:\Windows\System\kRFlBQN.exe
  C:\Windows\System\kRFlBQN.exe
  2⤵
  PID:4424
- C:\Windows\System\zjfZlWt.exe
  C:\Windows\System\zjfZlWt.exe
  2⤵
  PID:4464
- C:\Windows\System\bdXGUCB.exe
  C:\Windows\System\bdXGUCB.exe
  2⤵
  PID:4472
- C:\Windows\System\TQhIZzK.exe
  C:\Windows\System\TQhIZzK.exe
  2⤵
  PID:4484
- C:\Windows\System\WbVBFln.exe
  C:\Windows\System\WbVBFln.exe
  2⤵
  PID:4544
- C:\Windows\System\jlWLoEh.exe
  C:\Windows\System\jlWLoEh.exe
  2⤵
  PID:4568
- C:\Windows\System\KMZLvVe.exe
  C:\Windows\System\KMZLvVe.exe
  2⤵
  PID:4572
- C:\Windows\System\MGnxyzP.exe
  C:\Windows\System\MGnxyzP.exe
  2⤵
  PID:4604
- C:\Windows\System\jGMCvup.exe
  C:\Windows\System\jGMCvup.exe
  2⤵
  PID:4672
- C:\Windows\System\fPqhRlP.exe
  C:\Windows\System\fPqhRlP.exe
  2⤵
  PID:4716
- C:\Windows\System\gbCPUiu.exe
  C:\Windows\System\gbCPUiu.exe
  2⤵
  PID:4748
- C:\Windows\System\DPuaXME.exe
  C:\Windows\System\DPuaXME.exe
  2⤵
  PID:4788
- C:\Windows\System\BMsEFCv.exe
  C:\Windows\System\BMsEFCv.exe
  2⤵
  PID:4804
- C:\Windows\System\TLaOdaC.exe
  C:\Windows\System\TLaOdaC.exe
  2⤵
  PID:4832
- C:\Windows\System\rIGZyMA.exe
  C:\Windows\System\rIGZyMA.exe
  2⤵
  PID:4912
- C:\Windows\System\KgzPqkr.exe
  C:\Windows\System\KgzPqkr.exe
  2⤵
  PID:4852
- C:\Windows\System\RZMdMNM.exe
  C:\Windows\System\RZMdMNM.exe
  2⤵
  PID:4944
- C:\Windows\System\BFbxVaY.exe
  C:\Windows\System\BFbxVaY.exe
  2⤵
  PID:1680
- C:\Windows\System\kZlWrJG.exe
  C:\Windows\System\kZlWrJG.exe
  2⤵
  PID:4968
- C:\Windows\System\BorjhzN.exe
  C:\Windows\System\BorjhzN.exe
  2⤵
  PID:5028
- C:\Windows\System\VSgUREY.exe
  C:\Windows\System\VSgUREY.exe
  2⤵
  PID:5068
- C:\Windows\System\BaoxRPZ.exe
  C:\Windows\System\BaoxRPZ.exe
  2⤵
  PID:5112
- C:\Windows\System\mqeckSZ.exe
  C:\Windows\System\mqeckSZ.exe
  2⤵
  PID:3500
- C:\Windows\System\dbyWnit.exe
  C:\Windows\System\dbyWnit.exe
  2⤵
  PID:5088
- C:\Windows\System\LGmfjFb.exe
  C:\Windows\System\LGmfjFb.exe
  2⤵
  PID:3608
- C:\Windows\System\FBqMWAV.exe
  C:\Windows\System\FBqMWAV.exe
  2⤵
  PID:4004
- C:\Windows\System\OpZhBAb.exe
  C:\Windows\System\OpZhBAb.exe
  2⤵
  PID:2180
- C:\Windows\System\BOiqgqU.exe
  C:\Windows\System\BOiqgqU.exe
  2⤵
  PID:1996
- C:\Windows\System\ABLhtYr.exe
  C:\Windows\System\ABLhtYr.exe
  2⤵
  PID:3784
- C:\Windows\System\jGpYecn.exe
  C:\Windows\System\jGpYecn.exe
  2⤵
  PID:3588
- C:\Windows\System\uLOOcUu.exe
  C:\Windows\System\uLOOcUu.exe
  2⤵
  PID:4124
- C:\Windows\System\LrvdZsi.exe
  C:\Windows\System\LrvdZsi.exe
  2⤵
  PID:4160
- C:\Windows\System\NsxpMdo.exe
  C:\Windows\System\NsxpMdo.exe
  2⤵
  PID:1876
- C:\Windows\System\gQlkNXG.exe
  C:\Windows\System\gQlkNXG.exe
  2⤵
  PID:4280
- C:\Windows\System\DCLYIwt.exe
  C:\Windows\System\DCLYIwt.exe
  2⤵
  PID:4148
- C:\Windows\System\BMqnSAB.exe
  C:\Windows\System\BMqnSAB.exe
  2⤵
  PID:4324
- C:\Windows\System\hSyfqSi.exe
  C:\Windows\System\hSyfqSi.exe
  2⤵
  PID:4268
- C:\Windows\System\pwaNqWW.exe
  C:\Windows\System\pwaNqWW.exe
  2⤵
  PID:4312
- C:\Windows\System\XJDTBfu.exe
  C:\Windows\System\XJDTBfu.exe
  2⤵
  PID:4520
- C:\Windows\System\dyhRwDv.exe
  C:\Windows\System\dyhRwDv.exe
  2⤵
  PID:4428
- C:\Windows\System\DtyqFxE.exe
  C:\Windows\System\DtyqFxE.exe
  2⤵
  PID:4500
- C:\Windows\System\umbTjlV.exe
  C:\Windows\System\umbTjlV.exe
  2⤵
  PID:4636
- C:\Windows\System\JmLDhDq.exe
  C:\Windows\System\JmLDhDq.exe
  2⤵
  PID:4528
- C:\Windows\System\frqrCrL.exe
  C:\Windows\System\frqrCrL.exe
  2⤵
  PID:2728
- C:\Windows\System\hdJNpep.exe
  C:\Windows\System\hdJNpep.exe
  2⤵
  PID:2056
- C:\Windows\System\LYVKWcS.exe
  C:\Windows\System\LYVKWcS.exe
  2⤵
  PID:1280
- C:\Windows\System\tOgicPS.exe
  C:\Windows\System\tOgicPS.exe
  2⤵
  PID:4744
- C:\Windows\System\azfhhHF.exe
  C:\Windows\System\azfhhHF.exe
  2⤵
  PID:4704
- C:\Windows\System\JGxsLgX.exe
  C:\Windows\System\JGxsLgX.exe
  2⤵
  PID:4768
- C:\Windows\System\RrFKnGR.exe
  C:\Windows\System\RrFKnGR.exe
  2⤵
  PID:2524
- C:\Windows\System\pJiECjO.exe
  C:\Windows\System\pJiECjO.exe
  2⤵
  PID:4904
- C:\Windows\System\jfWfQrl.exe
  C:\Windows\System\jfWfQrl.exe
  2⤵
  PID:4888
- C:\Windows\System\tweHMkq.exe
  C:\Windows\System\tweHMkq.exe
  2⤵
  PID:2076
- C:\Windows\System\ufxybPO.exe
  C:\Windows\System\ufxybPO.exe
  2⤵
  PID:4988
- C:\Windows\System\DDuqvBO.exe
  C:\Windows\System\DDuqvBO.exe
  2⤵
  PID:5012
- C:\Windows\System\yVUEnwB.exe
  C:\Windows\System\yVUEnwB.exe
  2⤵
  PID:5024
- C:\Windows\System\AQELEvO.exe
  C:\Windows\System\AQELEvO.exe
  2⤵
  PID:2032
- C:\Windows\System\HbGEUYl.exe
  C:\Windows\System\HbGEUYl.exe
  2⤵
  PID:5104
- C:\Windows\System\eEIXTYe.exe
  C:\Windows\System\eEIXTYe.exe
  2⤵
  PID:2744
- C:\Windows\System\bACQdMa.exe
  C:\Windows\System\bACQdMa.exe
  2⤵
  PID:2108
- C:\Windows\System\EtlQbWh.exe
  C:\Windows\System\EtlQbWh.exe
  2⤵
  PID:2800
- C:\Windows\System\PwVWUKA.exe
  C:\Windows\System\PwVWUKA.exe
  2⤵
  PID:2860
- C:\Windows\System\DUucMFV.exe
  C:\Windows\System\DUucMFV.exe
  2⤵
  PID:1924
- C:\Windows\System\gCzuWgr.exe
  C:\Windows\System\gCzuWgr.exe
  2⤵
  PID:2884
- C:\Windows\System\FkFdpLZ.exe
  C:\Windows\System\FkFdpLZ.exe
  2⤵
  PID:2888
- C:\Windows\System\GKMnBHR.exe
  C:\Windows\System\GKMnBHR.exe
  2⤵
  PID:3220
- C:\Windows\System\UdhcZxZ.exe
  C:\Windows\System\UdhcZxZ.exe
  2⤵
  PID:3312
- C:\Windows\System\zJeyBiF.exe
  C:\Windows\System\zJeyBiF.exe
  2⤵
  PID:2848
- C:\Windows\System\SlVOEoo.exe
  C:\Windows\System\SlVOEoo.exe
  2⤵
  PID:2948
- C:\Windows\System\KxuEvWY.exe
  C:\Windows\System\KxuEvWY.exe
  2⤵
  PID:2964
- C:\Windows\System\DZTuEWD.exe
  C:\Windows\System\DZTuEWD.exe
  2⤵
  PID:1304
- C:\Windows\System\WZLEljf.exe
  C:\Windows\System\WZLEljf.exe
  2⤵
  PID:560
- C:\Windows\System\WHNMifO.exe
  C:\Windows\System\WHNMifO.exe
  2⤵
  PID:4352
- C:\Windows\System\ovQLicZ.exe
  C:\Windows\System\ovQLicZ.exe
  2⤵
  PID:2992
- C:\Windows\System\ErpXFBC.exe
  C:\Windows\System\ErpXFBC.exe
  2⤵
  PID:4628
- C:\Windows\System\BLRLqnf.exe
  C:\Windows\System\BLRLqnf.exe
  2⤵
  PID:2244
- C:\Windows\System\nwkOycb.exe
  C:\Windows\System\nwkOycb.exe
  2⤵
  PID:4872
- C:\Windows\System\ELwPyQZ.exe
  C:\Windows\System\ELwPyQZ.exe
  2⤵
  PID:1864
- C:\Windows\System\AscDjJF.exe
  C:\Windows\System\AscDjJF.exe
  2⤵
  PID:4996
- C:\Windows\System\tJyZTKV.exe
  C:\Windows\System\tJyZTKV.exe
  2⤵
  PID:5008
- C:\Windows\System\jbsDLHj.exe
  C:\Windows\System\jbsDLHj.exe
  2⤵
  PID:5052
- C:\Windows\System\COvuPPe.exe
  C:\Windows\System\COvuPPe.exe
  2⤵
  PID:5108
- C:\Windows\System\WWbNkqF.exe
  C:\Windows\System\WWbNkqF.exe
  2⤵
  PID:2980
- C:\Windows\System\nlzpSXR.exe
  C:\Windows\System\nlzpSXR.exe
  2⤵
  PID:2976
- C:\Windows\System\LhnHEBm.exe
  C:\Windows\System\LhnHEBm.exe
  2⤵
  PID:4688
- C:\Windows\System\RUVaGXL.exe
  C:\Windows\System\RUVaGXL.exe
  2⤵
  PID:1428
- C:\Windows\System\gqTBZHz.exe
  C:\Windows\System\gqTBZHz.exe
  2⤵
  PID:1980
- C:\Windows\System\GlJHQdq.exe
  C:\Windows\System\GlJHQdq.exe
  2⤵
  PID:1684
- C:\Windows\System\TjVTiqd.exe
  C:\Windows\System\TjVTiqd.exe
  2⤵
  PID:2656
- C:\Windows\System\zdotFEx.exe
  C:\Windows\System\zdotFEx.exe
  2⤵
  PID:3036
- C:\Windows\System\GdvYZwi.exe
  C:\Windows\System\GdvYZwi.exe
  2⤵
  PID:640
- C:\Windows\System\ENbXeFz.exe
  C:\Windows\System\ENbXeFz.exe
  2⤵
  PID:4448
- C:\Windows\System\dAilANx.exe
  C:\Windows\System\dAilANx.exe
  2⤵
  PID:2840
- C:\Windows\System\NmoEjSD.exe
  C:\Windows\System\NmoEjSD.exe
  2⤵
  PID:3200
- C:\Windows\System\sOJiZUa.exe
  C:\Windows\System\sOJiZUa.exe
  2⤵
  PID:1880
- C:\Windows\System\tSMcGQV.exe
  C:\Windows\System\tSMcGQV.exe
  2⤵
  PID:2152
- C:\Windows\System\VlECYHE.exe
  C:\Windows\System\VlECYHE.exe
  2⤵
  PID:4956
- C:\Windows\System\CKugehJ.exe
  C:\Windows\System\CKugehJ.exe
  2⤵
  PID:2440
- C:\Windows\System\YWZZagC.exe
  C:\Windows\System\YWZZagC.exe
  2⤵
  PID:4612
- C:\Windows\System\sYXmOvY.exe
  C:\Windows\System\sYXmOvY.exe
  2⤵
  PID:4044
- C:\Windows\System\oNNuArz.exe
  C:\Windows\System\oNNuArz.exe
  2⤵
  PID:4348
- C:\Windows\System\nWijVYh.exe
  C:\Windows\System\nWijVYh.exe
  2⤵
  PID:4444
- C:\Windows\System\VCnhHqy.exe
  C:\Windows\System\VCnhHqy.exe
  2⤵
  PID:3928
- C:\Windows\System\fEFakEV.exe
  C:\Windows\System\fEFakEV.exe
  2⤵
  PID:4812
- C:\Windows\System\bPBwOcX.exe
  C:\Windows\System\bPBwOcX.exe
  2⤵
  PID:3844
- C:\Windows\System\WsERrza.exe
  C:\Windows\System\WsERrza.exe
  2⤵
  PID:1708
- C:\Windows\System\zggzJRl.exe
  C:\Windows\System\zggzJRl.exe
  2⤵
  PID:2384
- C:\Windows\System\hYeImoV.exe
  C:\Windows\System\hYeImoV.exe
  2⤵
  PID:2784
- C:\Windows\System\PpyVsMy.exe
  C:\Windows\System\PpyVsMy.exe
  2⤵
  PID:2772
- C:\Windows\System\BFMyBob.exe
  C:\Windows\System\BFMyBob.exe
  2⤵
  PID:1576
- C:\Windows\System\AiyiqcY.exe
  C:\Windows\System\AiyiqcY.exe
  2⤵
  PID:4972
- C:\Windows\System\nZwfCUj.exe
  C:\Windows\System\nZwfCUj.exe
  2⤵
  PID:5036
- C:\Windows\System\qKhDemn.exe
  C:\Windows\System\qKhDemn.exe
  2⤵
  PID:1804
- C:\Windows\System\HUutOLu.exe
  C:\Windows\System\HUutOLu.exe
  2⤵
  PID:3520
- C:\Windows\System\jCVtsNr.exe
  C:\Windows\System\jCVtsNr.exe
  2⤵
  PID:1632
- C:\Windows\System\BrRvcLt.exe
  C:\Windows\System\BrRvcLt.exe
  2⤵
  PID:2232
- C:\Windows\System\dNXiWEM.exe
  C:\Windows\System\dNXiWEM.exe
  2⤵
  PID:4824
- C:\Windows\System\hgydhfM.exe
  C:\Windows\System\hgydhfM.exe
  2⤵
  PID:2196
- C:\Windows\System\CUQvBzf.exe
  C:\Windows\System\CUQvBzf.exe
  2⤵
  PID:2680
- C:\Windows\System\ceAztIU.exe
  C:\Windows\System\ceAztIU.exe
  2⤵
  PID:4648
- C:\Windows\System\mlRnZqF.exe
  C:\Windows\System\mlRnZqF.exe
  2⤵
  PID:784
- C:\Windows\System\DxkOWOF.exe
  C:\Windows\System\DxkOWOF.exe
  2⤵
  PID:4556
- C:\Windows\System\ItebdLI.exe
  C:\Windows\System\ItebdLI.exe
  2⤵
  PID:3316
- C:\Windows\System\ntMomYQ.exe
  C:\Windows\System\ntMomYQ.exe
  2⤵
  PID:2740
- C:\Windows\System\xUBSokt.exe
  C:\Windows\System\xUBSokt.exe
  2⤵
  PID:5124
- C:\Windows\System\tJCpHnG.exe
  C:\Windows\System\tJCpHnG.exe
  2⤵
  PID:5144
- C:\Windows\System\rmJFpxO.exe
  C:\Windows\System\rmJFpxO.exe
  2⤵
  PID:5168
- C:\Windows\System\fqOyCnm.exe
  C:\Windows\System\fqOyCnm.exe
  2⤵
  PID:5200
- C:\Windows\System\JMjkZOi.exe
  C:\Windows\System\JMjkZOi.exe
  2⤵
  PID:5216
- C:\Windows\System\BHmebZN.exe
  C:\Windows\System\BHmebZN.exe
  2⤵
  PID:5244
- C:\Windows\System\xwvrAlE.exe
  C:\Windows\System\xwvrAlE.exe
  2⤵
  PID:5268
- C:\Windows\System\dAqPZld.exe
  C:\Windows\System\dAqPZld.exe
  2⤵
  PID:5288
- C:\Windows\System\mCuhMUl.exe
  C:\Windows\System\mCuhMUl.exe
  2⤵
  PID:5312
- C:\Windows\System\oqKvFLs.exe
  C:\Windows\System\oqKvFLs.exe
  2⤵
  PID:5328
- C:\Windows\System\ibdrsbq.exe
  C:\Windows\System\ibdrsbq.exe
  2⤵
  PID:5348
- C:\Windows\System\lLPfCJG.exe
  C:\Windows\System\lLPfCJG.exe
  2⤵
  PID:5372
- C:\Windows\System\EBeVKEE.exe
  C:\Windows\System\EBeVKEE.exe
  2⤵
  PID:5388
- C:\Windows\System\ePbuBFB.exe
  C:\Windows\System\ePbuBFB.exe
  2⤵
  PID:5408
- C:\Windows\System\sewopKZ.exe
  C:\Windows\System\sewopKZ.exe
  2⤵
  PID:5424
- C:\Windows\System\dtrYEtw.exe
  C:\Windows\System\dtrYEtw.exe
  2⤵
  PID:5440
- C:\Windows\System\xEFhSXm.exe
  C:\Windows\System\xEFhSXm.exe
  2⤵
  PID:5464
- C:\Windows\System\GlpCrjh.exe
  C:\Windows\System\GlpCrjh.exe
  2⤵
  PID:5484
- C:\Windows\System\GKKENmz.exe
  C:\Windows\System\GKKENmz.exe
  2⤵
  PID:5508
- C:\Windows\System\EYdwGdy.exe
  C:\Windows\System\EYdwGdy.exe
  2⤵
  PID:5528
- C:\Windows\System\OGfTqhT.exe
  C:\Windows\System\OGfTqhT.exe
  2⤵
  PID:5544
- C:\Windows\System\wSZTfRM.exe
  C:\Windows\System\wSZTfRM.exe
  2⤵
  PID:5576
- C:\Windows\System\ZyjUHMw.exe
  C:\Windows\System\ZyjUHMw.exe
  2⤵
  PID:5592
- C:\Windows\System\AwiiCei.exe
  C:\Windows\System\AwiiCei.exe
  2⤵
  PID:5608
- C:\Windows\System\isezSHj.exe
  C:\Windows\System\isezSHj.exe
  2⤵
  PID:5632
- C:\Windows\System\joBHgba.exe
  C:\Windows\System\joBHgba.exe
  2⤵
  PID:5652
- C:\Windows\System\ZECpZfq.exe
  C:\Windows\System\ZECpZfq.exe
  2⤵
  PID:5668
- C:\Windows\System\jiRVCmX.exe
  C:\Windows\System\jiRVCmX.exe
  2⤵
  PID:5684
- C:\Windows\System\CRgbpaX.exe
  C:\Windows\System\CRgbpaX.exe
  2⤵
  PID:5700
- C:\Windows\System\ARofnSI.exe
  C:\Windows\System\ARofnSI.exe
  2⤵
  PID:5716
- C:\Windows\System\uEPEPBQ.exe
  C:\Windows\System\uEPEPBQ.exe
  2⤵
  PID:5732
- C:\Windows\System\qfCalPQ.exe
  C:\Windows\System\qfCalPQ.exe
  2⤵
  PID:5756
- C:\Windows\System\CvHaCbz.exe
  C:\Windows\System\CvHaCbz.exe
  2⤵
  PID:5772
- C:\Windows\System\NwvKQlP.exe
  C:\Windows\System\NwvKQlP.exe
  2⤵
  PID:5792
- C:\Windows\System\jbMBeIk.exe
  C:\Windows\System\jbMBeIk.exe
  2⤵
  PID:5808
- C:\Windows\System\aIagCmj.exe
  C:\Windows\System\aIagCmj.exe
  2⤵
  PID:5824
- C:\Windows\System\EVuDwWq.exe
  C:\Windows\System\EVuDwWq.exe
  2⤵
  PID:5844
- C:\Windows\System\dzxONkO.exe
  C:\Windows\System\dzxONkO.exe
  2⤵
  PID:5860
- C:\Windows\System\JdEynlG.exe
  C:\Windows\System\JdEynlG.exe
  2⤵
  PID:5876
- C:\Windows\System\aBOBZJc.exe
  C:\Windows\System\aBOBZJc.exe
  2⤵
  PID:5896
- C:\Windows\System\aQNZMeG.exe
  C:\Windows\System\aQNZMeG.exe
  2⤵
  PID:5916
- C:\Windows\System\IzBjQhp.exe
  C:\Windows\System\IzBjQhp.exe
  2⤵
  PID:5936
- C:\Windows\System\FhGBecP.exe
  C:\Windows\System\FhGBecP.exe
  2⤵
  PID:5964
- C:\Windows\System\aWeQfuW.exe
  C:\Windows\System\aWeQfuW.exe
  2⤵
  PID:5980
- C:\Windows\System\NCgTIHM.exe
  C:\Windows\System\NCgTIHM.exe
  2⤵
  PID:6000
- C:\Windows\System\qyOBlrK.exe
  C:\Windows\System\qyOBlrK.exe
  2⤵
  PID:6024
- C:\Windows\System\ZdSMAAo.exe
  C:\Windows\System\ZdSMAAo.exe
  2⤵
  PID:6044
- C:\Windows\System\ejqTHwM.exe
  C:\Windows\System\ejqTHwM.exe
  2⤵
  PID:6068
- C:\Windows\System\OdAGpgv.exe
  C:\Windows\System\OdAGpgv.exe
  2⤵
  PID:6088
- C:\Windows\System\ooWhMkW.exe
  C:\Windows\System\ooWhMkW.exe
  2⤵
  PID:6124
- C:\Windows\System\azEAski.exe
  C:\Windows\System\azEAski.exe
  2⤵
  PID:4392
- C:\Windows\System\svyqsWw.exe
  C:\Windows\System\svyqsWw.exe
  2⤵
  PID:4828
- C:\Windows\System\BIYRxTP.exe
  C:\Windows\System\BIYRxTP.exe
  2⤵
  PID:5164
- C:\Windows\System\ZkAkHON.exe
  C:\Windows\System\ZkAkHON.exe
  2⤵
  PID:5176
- C:\Windows\System\aeJTcnb.exe
  C:\Windows\System\aeJTcnb.exe
  2⤵
  PID:3568
- C:\Windows\System\NEARBCX.exe
  C:\Windows\System\NEARBCX.exe
  2⤵
  PID:672
- C:\Windows\System\iqlyCFg.exe
  C:\Windows\System\iqlyCFg.exe
  2⤵
  PID:5212
- C:\Windows\System\qnKvTjs.exe
  C:\Windows\System\qnKvTjs.exe
  2⤵
  PID:5296
- C:\Windows\System\kmViQWk.exe
  C:\Windows\System\kmViQWk.exe
  2⤵
  PID:5240
- C:\Windows\System\VjIzdqD.exe
  C:\Windows\System\VjIzdqD.exe
  2⤵
  PID:5340
- C:\Windows\System\VcJyqAS.exe
  C:\Windows\System\VcJyqAS.exe
  2⤵
  PID:5284
- C:\Windows\System\PbWYfXP.exe
  C:\Windows\System\PbWYfXP.exe
  2⤵
  PID:5456
- C:\Windows\System\yuwzmmJ.exe
  C:\Windows\System\yuwzmmJ.exe
  2⤵
  PID:5492
- C:\Windows\System\lXBGaQQ.exe
  C:\Windows\System\lXBGaQQ.exe
  2⤵
  PID:5324
- C:\Windows\System\rKaqevP.exe
  C:\Windows\System\rKaqevP.exe
  2⤵
  PID:5360
- C:\Windows\System\WDajinh.exe
  C:\Windows\System\WDajinh.exe
  2⤵
  PID:5396
- C:\Windows\System\KdjpGsU.exe
  C:\Windows\System\KdjpGsU.exe
  2⤵
  PID:5524
- C:\Windows\System\KSvulTn.exe
  C:\Windows\System\KSvulTn.exe
  2⤵
  PID:5560
- C:\Windows\System\mHdONAQ.exe
  C:\Windows\System\mHdONAQ.exe
  2⤵
  PID:5600
- C:\Windows\System\jVeSQtU.exe
  C:\Windows\System\jVeSQtU.exe
  2⤵
  PID:5616
- C:\Windows\System\GbLXqMm.exe
  C:\Windows\System\GbLXqMm.exe
  2⤵
  PID:5728
- C:\Windows\System\qQWTcPi.exe
  C:\Windows\System\qQWTcPi.exe
  2⤵
  PID:5800
- C:\Windows\System\jrhorWE.exe
  C:\Windows\System\jrhorWE.exe
  2⤵
  PID:5840
- C:\Windows\System\vZpIAop.exe
  C:\Windows\System\vZpIAop.exe
  2⤵
  PID:5956
- C:\Windows\System\eXSTJDO.exe
  C:\Windows\System\eXSTJDO.exe
  2⤵
  PID:5992
- C:\Windows\System\rNlraUw.exe
  C:\Windows\System\rNlraUw.exe
  2⤵
  PID:5892
- C:\Windows\System\vZWMVhj.exe
  C:\Windows\System\vZWMVhj.exe
  2⤵
  PID:5680
- C:\Windows\System\YDExCYB.exe
  C:\Windows\System\YDExCYB.exe
  2⤵
  PID:5712
- C:\Windows\System\ooRRaUP.exe
  C:\Windows\System\ooRRaUP.exe
  2⤵
  PID:5820
- C:\Windows\System\XZAHbXy.exe
  C:\Windows\System\XZAHbXy.exe
  2⤵
  PID:5780
- C:\Windows\System\YskdkoV.exe
  C:\Windows\System\YskdkoV.exe
  2⤵
  PID:6032
- C:\Windows\System\HREsMlL.exe
  C:\Windows\System\HREsMlL.exe
  2⤵
  PID:6080
- C:\Windows\System\HWXTDTu.exe
  C:\Windows\System\HWXTDTu.exe
  2⤵
  PID:6140
- C:\Windows\System\AUKvoCb.exe
  C:\Windows\System\AUKvoCb.exe
  2⤵
  PID:6060
- C:\Windows\System\UuyOxyY.exe
  C:\Windows\System\UuyOxyY.exe
  2⤵
  PID:6112
- C:\Windows\System\pvnhZcw.exe
  C:\Windows\System\pvnhZcw.exe
  2⤵
  PID:5156
- C:\Windows\System\bWwwMfO.exe
  C:\Windows\System\bWwwMfO.exe
  2⤵
  PID:4752
- C:\Windows\System\HggaTaU.exe
  C:\Windows\System\HggaTaU.exe
  2⤵
  PID:3804
- C:\Windows\System\pWvDdPL.exe
  C:\Windows\System\pWvDdPL.exe
  2⤵
  PID:5304
- C:\Windows\System\bhUyuLi.exe
  C:\Windows\System\bhUyuLi.exe
  2⤵
  PID:5264
- C:\Windows\System\fPBIKrO.exe
  C:\Windows\System\fPBIKrO.exe
  2⤵
  PID:5460
- C:\Windows\System\tzCTXYn.exe
  C:\Windows\System\tzCTXYn.exe
  2⤵
  PID:5436
- C:\Windows\System\PoSYQvb.exe
  C:\Windows\System\PoSYQvb.exe
  2⤵
  PID:5500
- C:\Windows\System\WxxuWdm.exe
  C:\Windows\System\WxxuWdm.exe
  2⤵
  PID:5224
- C:\Windows\System\CiUMLfQ.exe
  C:\Windows\System\CiUMLfQ.exe
  2⤵
  PID:5556
- C:\Windows\System\taBcbpf.exe
  C:\Windows\System\taBcbpf.exe
  2⤵
  PID:5588
- C:\Windows\System\rdlMZTj.exe
  C:\Windows\System\rdlMZTj.exe
  2⤵
  PID:5832
- C:\Windows\System\bLgXFvJ.exe
  C:\Windows\System\bLgXFvJ.exe
  2⤵
  PID:5908
- C:\Windows\System\chGmjTu.exe
  C:\Windows\System\chGmjTu.exe
  2⤵
  PID:5944
- C:\Windows\System\PxhkQuc.exe
  C:\Windows\System\PxhkQuc.exe
  2⤵
  PID:5932
- C:\Windows\System\wmjdVks.exe
  C:\Windows\System\wmjdVks.exe
  2⤵
  PID:5788
- C:\Windows\System\UsVQLlD.exe
  C:\Windows\System\UsVQLlD.exe
  2⤵
  PID:6020
- C:\Windows\System\SXscBYG.exe
  C:\Windows\System\SXscBYG.exe
  2⤵
  PID:5784
- C:\Windows\System\BIJmdnK.exe
  C:\Windows\System\BIJmdnK.exe
  2⤵
  PID:6132
- C:\Windows\System\BmacWLJ.exe
  C:\Windows\System\BmacWLJ.exe
  2⤵
  PID:5160
- C:\Windows\System\uQYKXdb.exe
  C:\Windows\System\uQYKXdb.exe
  2⤵
  PID:2008
- C:\Windows\System\nSUMpyW.exe
  C:\Windows\System\nSUMpyW.exe
  2⤵
  PID:6052
- C:\Windows\System\YEAeTqp.exe
  C:\Windows\System\YEAeTqp.exe
  2⤵
  PID:5196
- C:\Windows\System\CXpuhBS.exe
  C:\Windows\System\CXpuhBS.exe
  2⤵
  PID:5256
- C:\Windows\System\qTVQRwJ.exe
  C:\Windows\System\qTVQRwJ.exe
  2⤵
  PID:5420
- C:\Windows\System\jFpFMZZ.exe
  C:\Windows\System\jFpFMZZ.exe
  2⤵
  PID:5228
- C:\Windows\System\hfgWzLl.exe
  C:\Windows\System\hfgWzLl.exe
  2⤵
  PID:5432
- C:\Windows\System\cgiAYqL.exe
  C:\Windows\System\cgiAYqL.exe
  2⤵
  PID:5952
- C:\Windows\System\epIKzUy.exe
  C:\Windows\System\epIKzUy.exe
  2⤵
  PID:5976
- C:\Windows\System\GlUdiFi.exe
  C:\Windows\System\GlUdiFi.exe
  2⤵
  PID:5884
- C:\Windows\System\uAVChGU.exe
  C:\Windows\System\uAVChGU.exe
  2⤵
  PID:6120
- C:\Windows\System\WQaaVsx.exe
  C:\Windows\System\WQaaVsx.exe
  2⤵
  PID:6100
- C:\Windows\System\mRfpGXj.exe
  C:\Windows\System\mRfpGXj.exe
  2⤵
  PID:684
- C:\Windows\System\QWjFKwD.exe
  C:\Windows\System\QWjFKwD.exe
  2⤵
  PID:5476
- C:\Windows\System\PANKGRu.exe
  C:\Windows\System\PANKGRu.exe
  2⤵
  PID:5540
- C:\Windows\System\WOYXdgI.exe
  C:\Windows\System\WOYXdgI.exe
  2⤵
  PID:5520
- C:\Windows\System\tnJEdTF.exe
  C:\Windows\System\tnJEdTF.exe
  2⤵
  PID:5644
- C:\Windows\System\fqWwfYH.exe
  C:\Windows\System\fqWwfYH.exe
  2⤵
  PID:5836
- C:\Windows\System\DgeMjVA.exe
  C:\Windows\System\DgeMjVA.exe
  2⤵
  PID:5676
- C:\Windows\System\XZQrsSx.exe
  C:\Windows\System\XZQrsSx.exe
  2⤵
  PID:6096
- C:\Windows\System\DMBLRQh.exe
  C:\Windows\System\DMBLRQh.exe
  2⤵
  PID:5384
- C:\Windows\System\gqrrBQy.exe
  C:\Windows\System\gqrrBQy.exe
  2⤵
  PID:6156
- C:\Windows\System\uXBnzkQ.exe
  C:\Windows\System\uXBnzkQ.exe
  2⤵
  PID:6176
- C:\Windows\System\ogEuXwt.exe
  C:\Windows\System\ogEuXwt.exe
  2⤵
  PID:6196
- C:\Windows\System\CzVvNHZ.exe
  C:\Windows\System\CzVvNHZ.exe
  2⤵
  PID:6216
- C:\Windows\System\qCIQHbr.exe
  C:\Windows\System\qCIQHbr.exe
  2⤵
  PID:6236
- C:\Windows\System\hdUbKNc.exe
  C:\Windows\System\hdUbKNc.exe
  2⤵
  PID:6252
- C:\Windows\System\eDieCab.exe
  C:\Windows\System\eDieCab.exe
  2⤵
  PID:6272
- C:\Windows\System\emCmWvi.exe
  C:\Windows\System\emCmWvi.exe
  2⤵
  PID:6308
- C:\Windows\System\AizzRvX.exe
  C:\Windows\System\AizzRvX.exe
  2⤵
  PID:6360
- C:\Windows\System\kKIGwFQ.exe
  C:\Windows\System\kKIGwFQ.exe
  2⤵
  PID:6376
- C:\Windows\System\MrYYEZa.exe
  C:\Windows\System\MrYYEZa.exe
  2⤵
  PID:6392
- C:\Windows\System\FJmMXkL.exe
  C:\Windows\System\FJmMXkL.exe
  2⤵
  PID:6408
- C:\Windows\System\FJymaHL.exe
  C:\Windows\System\FJymaHL.exe
  2⤵
  PID:6424
- C:\Windows\System\CjQAnVJ.exe
  C:\Windows\System\CjQAnVJ.exe
  2⤵
  PID:6440
- C:\Windows\System\tHJtgVw.exe
  C:\Windows\System\tHJtgVw.exe
  2⤵
  PID:6464
- C:\Windows\System\SWqmdgX.exe
  C:\Windows\System\SWqmdgX.exe
  2⤵
  PID:6484
- C:\Windows\System\IbCCiYY.exe
  C:\Windows\System\IbCCiYY.exe
  2⤵
  PID:6500
- C:\Windows\System\bisQdNx.exe
  C:\Windows\System\bisQdNx.exe
  2⤵
  PID:6520
- C:\Windows\System\GfTRgyX.exe
  C:\Windows\System\GfTRgyX.exe
  2⤵
  PID:6536
- C:\Windows\System\hjPxGPJ.exe
  C:\Windows\System\hjPxGPJ.exe
  2⤵
  PID:6552
- C:\Windows\System\CEPNVDC.exe
  C:\Windows\System\CEPNVDC.exe
  2⤵
  PID:6568
- C:\Windows\System\nfsrbZy.exe
  C:\Windows\System\nfsrbZy.exe
  2⤵
  PID:6584
- C:\Windows\System\AVnQIuS.exe
  C:\Windows\System\AVnQIuS.exe
  2⤵
  PID:6600
- C:\Windows\System\HLrnBhY.exe
  C:\Windows\System\HLrnBhY.exe
  2⤵
  PID:6616
- C:\Windows\System\BBeFfli.exe
  C:\Windows\System\BBeFfli.exe
  2⤵
  PID:6632
- C:\Windows\System\wHpcYoQ.exe
  C:\Windows\System\wHpcYoQ.exe
  2⤵
  PID:6700
- C:\Windows\System\rBpMjZL.exe
  C:\Windows\System\rBpMjZL.exe
  2⤵
  PID:6720
- C:\Windows\System\RUPEkrk.exe
  C:\Windows\System\RUPEkrk.exe
  2⤵
  PID:6736
- C:\Windows\System\ksjxHvf.exe
  C:\Windows\System\ksjxHvf.exe
  2⤵
  PID:6756
- C:\Windows\System\rXkKPwa.exe
  C:\Windows\System\rXkKPwa.exe
  2⤵
  PID:6772
- C:\Windows\System\qhGVcjg.exe
  C:\Windows\System\qhGVcjg.exe
  2⤵
  PID:6788
- C:\Windows\System\pwbBcNg.exe
  C:\Windows\System\pwbBcNg.exe
  2⤵
  PID:6808
- C:\Windows\System\ilytpjE.exe
  C:\Windows\System\ilytpjE.exe
  2⤵
  PID:6824
- C:\Windows\System\DOLcyeu.exe
  C:\Windows\System\DOLcyeu.exe
  2⤵
  PID:6840
- C:\Windows\System\lfzGDJe.exe
  C:\Windows\System\lfzGDJe.exe
  2⤵
  PID:6860
- C:\Windows\System\vMtCvgb.exe
  C:\Windows\System\vMtCvgb.exe
  2⤵
  PID:6880
- C:\Windows\System\ItryYmS.exe
  C:\Windows\System\ItryYmS.exe
  2⤵
  PID:6896
- C:\Windows\System\FmZWsPs.exe
  C:\Windows\System\FmZWsPs.exe
  2⤵
  PID:6916
- C:\Windows\System\HxgPNZo.exe
  C:\Windows\System\HxgPNZo.exe
  2⤵
  PID:6940
- C:\Windows\System\CluWikG.exe
  C:\Windows\System\CluWikG.exe
  2⤵
  PID:6960
- C:\Windows\System\HCtrytB.exe
  C:\Windows\System\HCtrytB.exe
  2⤵
  PID:6976
- C:\Windows\System\rozSxFQ.exe
  C:\Windows\System\rozSxFQ.exe
  2⤵
  PID:6992
- C:\Windows\System\gksoiJH.exe
  C:\Windows\System\gksoiJH.exe
  2⤵
  PID:7008
- C:\Windows\System\XwxLmWl.exe
  C:\Windows\System\XwxLmWl.exe
  2⤵
  PID:7024
- C:\Windows\System\ToSuowR.exe
  C:\Windows\System\ToSuowR.exe
  2⤵
  PID:7040
- C:\Windows\System\PlwNKQs.exe
  C:\Windows\System\PlwNKQs.exe
  2⤵
  PID:7056
- C:\Windows\System\MKFnrnB.exe
  C:\Windows\System\MKFnrnB.exe
  2⤵
  PID:7072
- C:\Windows\System\KkupHXD.exe
  C:\Windows\System\KkupHXD.exe
  2⤵
  PID:7120
- C:\Windows\System\JltHTEy.exe
  C:\Windows\System\JltHTEy.exe
  2⤵
  PID:7144
- C:\Windows\System\PJSrQni.exe
  C:\Windows\System\PJSrQni.exe
  2⤵
  PID:7160
- C:\Windows\System\jveTNZG.exe
  C:\Windows\System\jveTNZG.exe
  2⤵
  PID:5232
- C:\Windows\System\BnAyfED.exe
  C:\Windows\System\BnAyfED.exe
  2⤵
  PID:6224
- C:\Windows\System\kSAUZdz.exe
  C:\Windows\System\kSAUZdz.exe
  2⤵
  PID:5208
- C:\Windows\System\vlumvHD.exe
  C:\Windows\System\vlumvHD.exe
  2⤵
  PID:6260
- C:\Windows\System\NBHZUNM.exe
  C:\Windows\System\NBHZUNM.exe
  2⤵
  PID:6244
- C:\Windows\System\gQTRzpw.exe
  C:\Windows\System\gQTRzpw.exe
  2⤵
  PID:6172
- C:\Windows\System\SdpcCuh.exe
  C:\Windows\System\SdpcCuh.exe
  2⤵
  PID:6212
- C:\Windows\System\PlypHQa.exe
  C:\Windows\System\PlypHQa.exe
  2⤵
  PID:5660
- C:\Windows\System\fiVUexv.exe
  C:\Windows\System\fiVUexv.exe
  2⤵
  PID:6304
- C:\Windows\System\aVDfnqn.exe
  C:\Windows\System\aVDfnqn.exe
  2⤵
  PID:6340
- C:\Windows\System\xABoGFL.exe
  C:\Windows\System\xABoGFL.exe
  2⤵
  PID:6356
- C:\Windows\System\pQJdXKh.exe
  C:\Windows\System\pQJdXKh.exe
  2⤵
  PID:6416
- C:\Windows\System\sTXWNow.exe
  C:\Windows\System\sTXWNow.exe
  2⤵
  PID:6460
- C:\Windows\System\LZWXGwq.exe
  C:\Windows\System\LZWXGwq.exe
  2⤵
  PID:6564
- C:\Windows\System\KGYoLnZ.exe
  C:\Windows\System\KGYoLnZ.exe
  2⤵
  PID:6628
- C:\Windows\System\JEJiIPi.exe
  C:\Windows\System\JEJiIPi.exe
  2⤵
  PID:6608
- C:\Windows\System\KWnKpqe.exe
  C:\Windows\System\KWnKpqe.exe
  2⤵
  PID:6680
- C:\Windows\System\HtzNxyv.exe
  C:\Windows\System\HtzNxyv.exe
  2⤵
  PID:6516
- C:\Windows\System\FZlNAab.exe
  C:\Windows\System\FZlNAab.exe
  2⤵
  PID:6580
- C:\Windows\System\tknwONg.exe
  C:\Windows\System\tknwONg.exe
  2⤵
  PID:6652
- C:\Windows\System\boKEqnT.exe
  C:\Windows\System\boKEqnT.exe
  2⤵
  PID:6644
- C:\Windows\System\pbcXXrv.exe
  C:\Windows\System\pbcXXrv.exe
  2⤵
  PID:6728
- C:\Windows\System\FsFojZX.exe
  C:\Windows\System\FsFojZX.exe
  2⤵
  PID:6752
- C:\Windows\System\ZNFTsSX.exe
  C:\Windows\System\ZNFTsSX.exe
  2⤵
  PID:6848
- C:\Windows\System\RHtQESc.exe
  C:\Windows\System\RHtQESc.exe
  2⤵
  PID:6924
- C:\Windows\System\pwPXiRK.exe
  C:\Windows\System\pwPXiRK.exe
  2⤵
  PID:7000
- C:\Windows\System\XoZvTSB.exe
  C:\Windows\System\XoZvTSB.exe
  2⤵
  PID:6804
- C:\Windows\System\xYYJDLq.exe
  C:\Windows\System\xYYJDLq.exe
  2⤵
  PID:7136
- C:\Windows\System\oXDSQgx.exe
  C:\Windows\System\oXDSQgx.exe
  2⤵
  PID:6016
- C:\Windows\System\ZtxKqKl.exe
  C:\Windows\System\ZtxKqKl.exe
  2⤵
  PID:6832
- C:\Windows\System\whNloJA.exe
  C:\Windows\System\whNloJA.exe
  2⤵
  PID:6876
- C:\Windows\System\dNjlYmh.exe
  C:\Windows\System\dNjlYmh.exe
  2⤵
  PID:6732
- C:\Windows\System\JNYymqL.exe
  C:\Windows\System\JNYymqL.exe
  2⤵
  PID:7016
- C:\Windows\System\KKlJPcd.exe
  C:\Windows\System\KKlJPcd.exe
  2⤵
  PID:6208
- C:\Windows\System\kTvGgGo.exe
  C:\Windows\System\kTvGgGo.exe
  2⤵
  PID:6300
- C:\Windows\System\DenghBB.exe
  C:\Windows\System\DenghBB.exe
  2⤵
  PID:6420
- C:\Windows\System\DRYIUne.exe
  C:\Windows\System\DRYIUne.exe
  2⤵
  PID:7112
- C:\Windows\System\tSAbzEX.exe
  C:\Windows\System\tSAbzEX.exe
  2⤵
  PID:6592
- C:\Windows\System\goZawTm.exe
  C:\Windows\System\goZawTm.exe
  2⤵
  PID:7152
- C:\Windows\System\oGFpxHU.exe
  C:\Windows\System\oGFpxHU.exe
  2⤵
  PID:6336
- C:\Windows\System\WHkmGQN.exe
  C:\Windows\System\WHkmGQN.exe
  2⤵
  PID:6496
- C:\Windows\System\ZlFgCmK.exe
  C:\Windows\System\ZlFgCmK.exe
  2⤵
  PID:6188
- C:\Windows\System\KHIBMmt.exe
  C:\Windows\System\KHIBMmt.exe
  2⤵
  PID:6476
- C:\Windows\System\tXgxsCU.exe
  C:\Windows\System\tXgxsCU.exe
  2⤵
  PID:5972
- C:\Windows\System\LwqjUOC.exe
  C:\Windows\System\LwqjUOC.exe
  2⤵
  PID:6668
- C:\Windows\System\vvytwMF.exe
  C:\Windows\System\vvytwMF.exe
  2⤵
  PID:6672
- C:\Windows\System\GCVutVD.exe
  C:\Windows\System\GCVutVD.exe
  2⤵
  PID:6640
- C:\Windows\System\foDTFjq.exe
  C:\Windows\System\foDTFjq.exe
  2⤵
  PID:6784
- C:\Windows\System\DFTJyEl.exe
  C:\Windows\System\DFTJyEl.exe
  2⤵
  PID:6508
- C:\Windows\System\RTtQUBH.exe
  C:\Windows\System\RTtQUBH.exe
  2⤵
  PID:6816
- C:\Windows\System\FXTgegf.exe
  C:\Windows\System\FXTgegf.exe
  2⤵
  PID:7132
- C:\Windows\System\ezyHXZr.exe
  C:\Windows\System\ezyHXZr.exe
  2⤵
  PID:6868
- C:\Windows\System\fxjLpvJ.exe
  C:\Windows\System\fxjLpvJ.exe
  2⤵
  PID:6984
- C:\Windows\System\deAmgUl.exe
  C:\Windows\System\deAmgUl.exe
  2⤵
  PID:5852
- C:\Windows\System\RIoyZre.exe
  C:\Windows\System\RIoyZre.exe
  2⤵
  PID:7052
- C:\Windows\System\zvUhJmc.exe
  C:\Windows\System\zvUhJmc.exe
  2⤵
  PID:6280
- C:\Windows\System\ribNQlw.exe
  C:\Windows\System\ribNQlw.exe
  2⤵
  PID:6660
- C:\Windows\System\qNFMlZh.exe
  C:\Windows\System\qNFMlZh.exe
  2⤵
  PID:6388
- C:\Windows\System\psjjvVa.exe
  C:\Windows\System\psjjvVa.exe
  2⤵
  PID:7104
- C:\Windows\System\eupEjHG.exe
  C:\Windows\System\eupEjHG.exe
  2⤵
  PID:6148
- C:\Windows\System\ZKZWQUB.exe
  C:\Windows\System\ZKZWQUB.exe
  2⤵
  PID:7156
- C:\Windows\System\ahnCLwJ.exe
  C:\Windows\System\ahnCLwJ.exe
  2⤵
  PID:6436
- C:\Windows\System\EpeCYAi.exe
  C:\Windows\System\EpeCYAi.exe
  2⤵
  PID:6748
- C:\Windows\System\WRyWdSF.exe
  C:\Windows\System\WRyWdSF.exe
  2⤵
  PID:7032
- C:\Windows\System\BFguUZR.exe
  C:\Windows\System\BFguUZR.exe
  2⤵
  PID:7064
- C:\Windows\System\zzoZubN.exe
  C:\Windows\System\zzoZubN.exe
  2⤵
  PID:2968
- C:\Windows\System\QsXCDMh.exe
  C:\Windows\System\QsXCDMh.exe
  2⤵
  PID:6372
- C:\Windows\System\lmnHgqR.exe
  C:\Windows\System\lmnHgqR.exe
  2⤵
  PID:6952
- C:\Windows\System\GcHKrhk.exe
  C:\Windows\System\GcHKrhk.exe
  2⤵
  PID:6284
- C:\Windows\System\WEczOQl.exe
  C:\Windows\System\WEczOQl.exe
  2⤵
  PID:7176
- C:\Windows\System\pIJvglf.exe
  C:\Windows\System\pIJvglf.exe
  2⤵
  PID:7196
- C:\Windows\System\CXiLIWX.exe
  C:\Windows\System\CXiLIWX.exe
  2⤵
  PID:7212
- C:\Windows\System\IeOqkbJ.exe
  C:\Windows\System\IeOqkbJ.exe
  2⤵
  PID:7228
- C:\Windows\System\yAYZdVW.exe
  C:\Windows\System\yAYZdVW.exe
  2⤵
  PID:7244
- C:\Windows\System\cUTnpCb.exe
  C:\Windows\System\cUTnpCb.exe
  2⤵
  PID:7260
- C:\Windows\System\eApfVZN.exe
  C:\Windows\System\eApfVZN.exe
  2⤵
  PID:7276
- C:\Windows\System\qqUATlM.exe
  C:\Windows\System\qqUATlM.exe
  2⤵
  PID:7292
- C:\Windows\System\XpwLtJn.exe
  C:\Windows\System\XpwLtJn.exe
  2⤵
  PID:7312
- C:\Windows\System\UaRaKzA.exe
  C:\Windows\System\UaRaKzA.exe
  2⤵
  PID:7332
- C:\Windows\System\FznZFit.exe
  C:\Windows\System\FznZFit.exe
  2⤵
  PID:7348
- C:\Windows\System\rjAgyaS.exe
  C:\Windows\System\rjAgyaS.exe
  2⤵
  PID:7364
- C:\Windows\System\WYhPYBV.exe
  C:\Windows\System\WYhPYBV.exe
  2⤵
  PID:7380
- C:\Windows\System\qJsANRY.exe
  C:\Windows\System\qJsANRY.exe
  2⤵
  PID:7396
- C:\Windows\System\hXTOrvP.exe
  C:\Windows\System\hXTOrvP.exe
  2⤵
  PID:7428
- C:\Windows\System\DnFCKow.exe
  C:\Windows\System\DnFCKow.exe
  2⤵
  PID:7448
- C:\Windows\System\MDGdSwk.exe
  C:\Windows\System\MDGdSwk.exe
  2⤵
  PID:7464
- C:\Windows\System\XWEGfUa.exe
  C:\Windows\System\XWEGfUa.exe
  2⤵
  PID:7484
- C:\Windows\System\YCmPIbT.exe
  C:\Windows\System\YCmPIbT.exe
  2⤵
  PID:7504
- C:\Windows\System\uWTmlVR.exe
  C:\Windows\System\uWTmlVR.exe
  2⤵
  PID:7604
- C:\Windows\System\TvrBGoO.exe
  C:\Windows\System\TvrBGoO.exe
  2⤵
  PID:7620
- C:\Windows\System\Ctnyspw.exe
  C:\Windows\System\Ctnyspw.exe
  2⤵
  PID:7636
- C:\Windows\System\HYlbFjZ.exe
  C:\Windows\System\HYlbFjZ.exe
  2⤵
  PID:7652
- C:\Windows\System\ewAlgMQ.exe
  C:\Windows\System\ewAlgMQ.exe
  2⤵
  PID:7672
- C:\Windows\System\THVUNJu.exe
  C:\Windows\System\THVUNJu.exe
  2⤵
  PID:7688
- C:\Windows\System\suxfPEA.exe
  C:\Windows\System\suxfPEA.exe
  2⤵
  PID:7708
- C:\Windows\System\FhRHLWy.exe
  C:\Windows\System\FhRHLWy.exe
  2⤵
  PID:7732
- C:\Windows\System\YjejDbb.exe
  C:\Windows\System\YjejDbb.exe
  2⤵
  PID:7752
- C:\Windows\System\FDnPJJF.exe
  C:\Windows\System\FDnPJJF.exe
  2⤵
  PID:7784
- C:\Windows\System\rUtFuOu.exe
  C:\Windows\System\rUtFuOu.exe
  2⤵
  PID:7800
- C:\Windows\System\mxXlZzG.exe
  C:\Windows\System\mxXlZzG.exe
  2⤵
  PID:7816
- C:\Windows\System\LOwPrDq.exe
  C:\Windows\System\LOwPrDq.exe
  2⤵
  PID:7836
- C:\Windows\System\bhyyMNN.exe
  C:\Windows\System\bhyyMNN.exe
  2⤵
  PID:7856
- C:\Windows\System\KvtDDUh.exe
  C:\Windows\System\KvtDDUh.exe
  2⤵
  PID:7872
- C:\Windows\System\hkAESNy.exe
  C:\Windows\System\hkAESNy.exe
  2⤵
  PID:7896
- C:\Windows\System\hQkAMVm.exe
  C:\Windows\System\hQkAMVm.exe
  2⤵
  PID:7916
- C:\Windows\System\gzhMhge.exe
  C:\Windows\System\gzhMhge.exe
  2⤵
  PID:7932
- C:\Windows\System\nTQvFFx.exe
  C:\Windows\System\nTQvFFx.exe
  2⤵
  PID:7952
- C:\Windows\System\OTsFPtu.exe
  C:\Windows\System\OTsFPtu.exe
  2⤵
  PID:7972
- C:\Windows\System\DJFdzlA.exe
  C:\Windows\System\DJFdzlA.exe
  2⤵
  PID:7992
- C:\Windows\System\pNfelkA.exe
  C:\Windows\System\pNfelkA.exe
  2⤵
  PID:8008
- C:\Windows\System\qoxYwZy.exe
  C:\Windows\System\qoxYwZy.exe
  2⤵
  PID:8028
- C:\Windows\System\hETwMsY.exe
  C:\Windows\System\hETwMsY.exe
  2⤵
  PID:8044
- C:\Windows\System\gOkpgFm.exe
  C:\Windows\System\gOkpgFm.exe
  2⤵
  PID:8060
- C:\Windows\System\WvQJCiQ.exe
  C:\Windows\System\WvQJCiQ.exe
  2⤵
  PID:8076
- C:\Windows\System\BWqtXXR.exe
  C:\Windows\System\BWqtXXR.exe
  2⤵
  PID:8092
- C:\Windows\System\wPhWriK.exe
  C:\Windows\System\wPhWriK.exe
  2⤵
  PID:8116
- C:\Windows\System\ifuZWTO.exe
  C:\Windows\System\ifuZWTO.exe
  2⤵
  PID:8132
- C:\Windows\System\dSzloaL.exe
  C:\Windows\System\dSzloaL.exe
  2⤵
  PID:8148
- C:\Windows\System\HebGObf.exe
  C:\Windows\System\HebGObf.exe
  2⤵
  PID:8164
- C:\Windows\System\luEyWvp.exe
  C:\Windows\System\luEyWvp.exe
  2⤵
  PID:6936
- C:\Windows\System\aDEGtuN.exe
  C:\Windows\System\aDEGtuN.exe
  2⤵
  PID:6448
- C:\Windows\System\DDVuwxy.exe
  C:\Windows\System\DDVuwxy.exe
  2⤵
  PID:6164
- C:\Windows\System\NSCuGGb.exe
  C:\Windows\System\NSCuGGb.exe
  2⤵
  PID:7192
- C:\Windows\System\FDyxykv.exe
  C:\Windows\System\FDyxykv.exe
  2⤵
  PID:7256
- C:\Windows\System\coIBKey.exe
  C:\Windows\System\coIBKey.exe
  2⤵
  PID:6320
- C:\Windows\System\nhaQxKJ.exe
  C:\Windows\System\nhaQxKJ.exe
  2⤵
  PID:6972
- C:\Windows\System\OQRZnON.exe
  C:\Windows\System\OQRZnON.exe
  2⤵
  PID:7476
- C:\Windows\System\DCSMOcd.exe
  C:\Windows\System\DCSMOcd.exe
  2⤵
  PID:7512
- C:\Windows\System\ALeKGYK.exe
  C:\Windows\System\ALeKGYK.exe
  2⤵
  PID:7520
- C:\Windows\System\bxaCqaN.exe
  C:\Windows\System\bxaCqaN.exe
  2⤵
  PID:7544
- C:\Windows\System\nTVPVzM.exe
  C:\Windows\System\nTVPVzM.exe
  2⤵
  PID:7236
- C:\Windows\System\vuaRHDu.exe
  C:\Windows\System\vuaRHDu.exe
  2⤵
  PID:7560
- C:\Windows\System\xAfvfRd.exe
  C:\Windows\System\xAfvfRd.exe
  2⤵
  PID:7340
- C:\Windows\System\YTPhcyd.exe
  C:\Windows\System\YTPhcyd.exe
  2⤵
  PID:7408
- C:\Windows\System\fuSbxnn.exe
  C:\Windows\System\fuSbxnn.exe
  2⤵
  PID:7456
- C:\Windows\System\SQJARjt.exe
  C:\Windows\System\SQJARjt.exe
  2⤵
  PID:7588
- C:\Windows\System\xpppFnu.exe
  C:\Windows\System\xpppFnu.exe
  2⤵
  PID:7500
- C:\Windows\System\rBRVIra.exe
  C:\Windows\System\rBRVIra.exe
  2⤵
  PID:6648
- C:\Windows\System\KZxhgHd.exe
  C:\Windows\System\KZxhgHd.exe
  2⤵
  PID:7272
- C:\Windows\System\gAuhqVY.exe
  C:\Windows\System\gAuhqVY.exe
  2⤵
  PID:7612
- C:\Windows\System\SsdptCS.exe
  C:\Windows\System\SsdptCS.exe
  2⤵
  PID:7696
- C:\Windows\System\cODYGMK.exe
  C:\Windows\System\cODYGMK.exe
  2⤵
  PID:7680
- C:\Windows\System\DNEcTBF.exe
  C:\Windows\System\DNEcTBF.exe
  2⤵
  PID:7724
- C:\Windows\System\okVhKlh.exe
  C:\Windows\System\okVhKlh.exe
  2⤵
  PID:7760
- C:\Windows\System\hoZJFUl.exe
  C:\Windows\System\hoZJFUl.exe
  2⤵
  PID:7768
- C:\Windows\System\sdBnYwt.exe
  C:\Windows\System\sdBnYwt.exe
  2⤵
  PID:996
- C:\Windows\System\gzXDjTT.exe
  C:\Windows\System\gzXDjTT.exe
  2⤵
  PID:7824
- C:\Windows\System\chMdKqh.exe
  C:\Windows\System\chMdKqh.exe
  2⤵
  PID:7868
- C:\Windows\System\dkPyDRr.exe
  C:\Windows\System\dkPyDRr.exe
  2⤵
  PID:7904
- C:\Windows\System\fnyfXOX.exe
  C:\Windows\System\fnyfXOX.exe
  2⤵
  PID:7908
- C:\Windows\System\QPMAFlx.exe
  C:\Windows\System\QPMAFlx.exe
  2⤵
  PID:7948
- C:\Windows\System\VoaJZIB.exe
  C:\Windows\System\VoaJZIB.exe
  2⤵
  PID:8000
- C:\Windows\System\beOvgJw.exe
  C:\Windows\System\beOvgJw.exe
  2⤵
  PID:8100
- C:\Windows\System\flbhxEI.exe
  C:\Windows\System\flbhxEI.exe
  2⤵
  PID:6324
- C:\Windows\System\nLhxVEM.exe
  C:\Windows\System\nLhxVEM.exe
  2⤵
  PID:8160
- C:\Windows\System\PJIWhVQ.exe
  C:\Windows\System\PJIWhVQ.exe
  2⤵
  PID:8180
- C:\Windows\System\qjMCsCA.exe
  C:\Windows\System\qjMCsCA.exe
  2⤵
  PID:6288
- C:\Windows\System\JeCGTuG.exe
  C:\Windows\System\JeCGTuG.exe
  2⤵
  PID:5624
- C:\Windows\System\hrKjVpm.exe
  C:\Windows\System\hrKjVpm.exe
  2⤵
  PID:6908
- C:\Windows\System\YfqFuvd.exe
  C:\Windows\System\YfqFuvd.exe
  2⤵
  PID:7320
- C:\Windows\System\vBcxtbe.exe
  C:\Windows\System\vBcxtbe.exe
  2⤵
  PID:7328
- C:\Windows\System\KlfPilD.exe
  C:\Windows\System\KlfPilD.exe
  2⤵
  PID:7552
- C:\Windows\System\wKyPtRK.exe
  C:\Windows\System\wKyPtRK.exe
  2⤵
  PID:7344
- C:\Windows\System\anIbHOr.exe
  C:\Windows\System\anIbHOr.exe
  2⤵
  PID:6968
- C:\Windows\System\FNrtzeI.exe
  C:\Windows\System\FNrtzeI.exe
  2⤵
  PID:7496
- C:\Windows\System\aApnWXP.exe
  C:\Windows\System\aApnWXP.exe
  2⤵
  PID:7268
- C:\Windows\System\JGvOtqE.exe
  C:\Windows\System\JGvOtqE.exe
  2⤵
  PID:7572
- C:\Windows\System\EXHLQWs.exe
  C:\Windows\System\EXHLQWs.exe
  2⤵
  PID:7720
- C:\Windows\System\EVxDQAH.exe
  C:\Windows\System\EVxDQAH.exe
  2⤵
  PID:7392
- C:\Windows\System\QfplDSC.exe
  C:\Windows\System\QfplDSC.exe
  2⤵
  PID:7580
- C:\Windows\System\uhDZWgh.exe
  C:\Windows\System\uhDZWgh.exe
  2⤵
  PID:7796
- C:\Windows\System\pSWixqi.exe
  C:\Windows\System\pSWixqi.exe
  2⤵
  PID:7304
- C:\Windows\System\gPDdHkl.exe
  C:\Windows\System\gPDdHkl.exe
  2⤵
  PID:7704
- C:\Windows\System\UrYjdFX.exe
  C:\Windows\System\UrYjdFX.exe
  2⤵
  PID:8056
- C:\Windows\System\DlSbEuP.exe
  C:\Windows\System\DlSbEuP.exe
  2⤵
  PID:7648
- C:\Windows\System\VqGsvsG.exe
  C:\Windows\System\VqGsvsG.exe
  2⤵
  PID:7924
- C:\Windows\System\CjKREIT.exe
  C:\Windows\System\CjKREIT.exe
  2⤵
  PID:7968
- C:\Windows\System\kxKozTO.exe
  C:\Windows\System\kxKozTO.exe
  2⤵
  PID:8112
- C:\Windows\System\XuwRRdr.exe
  C:\Windows\System\XuwRRdr.exe
  2⤵
  PID:8176
- C:\Windows\System\aDoVJMb.exe
  C:\Windows\System\aDoVJMb.exe
  2⤵
  PID:6768
- C:\Windows\System\vXEnygd.exe
  C:\Windows\System\vXEnygd.exe
  2⤵
  PID:8144
- C:\Windows\System\gmniCZE.exe
  C:\Windows\System\gmniCZE.exe
  2⤵
  PID:5568
- C:\Windows\System\wrUflUf.exe
  C:\Windows\System\wrUflUf.exe
  2⤵
  PID:7172
- C:\Windows\System\ZkPtCLL.exe
  C:\Windows\System\ZkPtCLL.exe
  2⤵
  PID:7492
- C:\Windows\System\RIdcLtc.exe
  C:\Windows\System\RIdcLtc.exe
  2⤵
  PID:7536
- C:\Windows\System\iMUkswk.exe
  C:\Windows\System\iMUkswk.exe
  2⤵
  PID:7664
- C:\Windows\System\EtxoNnq.exe
  C:\Windows\System\EtxoNnq.exe
  2⤵
  PID:7516
- C:\Windows\System\IjpJTSQ.exe
  C:\Windows\System\IjpJTSQ.exe
  2⤵
  PID:7424
- C:\Windows\System\tYClgqp.exe
  C:\Windows\System\tYClgqp.exe
  2⤵
  PID:7884
- C:\Windows\System\DNiKmaB.exe
  C:\Windows\System\DNiKmaB.exe
  2⤵
  PID:7780
- C:\Windows\System\obABoxj.exe
  C:\Windows\System\obABoxj.exe
  2⤵
  PID:7984
- C:\Windows\System\PdhtDyu.exe
  C:\Windows\System\PdhtDyu.exe
  2⤵
  PID:8072
- C:\Windows\System\HNJmhsX.exe
  C:\Windows\System\HNJmhsX.exe
  2⤵
  PID:8108
- C:\Windows\System\VYEmGQZ.exe
  C:\Windows\System\VYEmGQZ.exe
  2⤵
  PID:5628
- C:\Windows\System\HwuqwiU.exe
  C:\Windows\System\HwuqwiU.exe
  2⤵
  PID:7568
- C:\Windows\System\NaKvMhy.exe
  C:\Windows\System\NaKvMhy.exe
  2⤵
  PID:7532
- C:\Windows\System\LWFWfcL.exe
  C:\Windows\System\LWFWfcL.exe
  2⤵
  PID:6716
- C:\Windows\System\jdfwDVT.exe
  C:\Windows\System\jdfwDVT.exe
  2⤵
  PID:7660
- C:\Windows\System\WxUIPmL.exe
  C:\Windows\System\WxUIPmL.exe
  2⤵
  PID:8040
- C:\Windows\System\lNncWZg.exe
  C:\Windows\System\lNncWZg.exe
  2⤵
  PID:8020
- C:\Windows\System\TMNwMcm.exe
  C:\Windows\System\TMNwMcm.exe
  2⤵
  PID:7324
- C:\Windows\System\zosUKpb.exe
  C:\Windows\System\zosUKpb.exe
  2⤵
  PID:7988
- C:\Windows\System\KLaGAwt.exe
  C:\Windows\System\KLaGAwt.exe
  2⤵
  PID:6912
- C:\Windows\System\DzAUcvW.exe
  C:\Windows\System\DzAUcvW.exe
  2⤵
  PID:7224
- C:\Windows\System\FPIpvjB.exe
  C:\Windows\System\FPIpvjB.exe
  2⤵
  PID:7844
- C:\Windows\System\ENLqdcc.exe
  C:\Windows\System\ENLqdcc.exe
  2⤵
  PID:1568
- C:\Windows\System\RoAPnRi.exe
  C:\Windows\System\RoAPnRi.exe
  2⤵
  PID:7100
- C:\Windows\System\deNVTPi.exe
  C:\Windows\System\deNVTPi.exe
  2⤵
  PID:7960
- C:\Windows\System\TlksSYQ.exe
  C:\Windows\System\TlksSYQ.exe
  2⤵
  PID:6692
- C:\Windows\System\zohtgWd.exe
  C:\Windows\System\zohtgWd.exe
  2⤵
  PID:6268
- C:\Windows\System\xDpgkky.exe
  C:\Windows\System\xDpgkky.exe
  2⤵
  PID:7404
- C:\Windows\System\MfWAIXy.exe
  C:\Windows\System\MfWAIXy.exe
  2⤵
  PID:7644
- C:\Windows\System\RiUcsJy.exe
  C:\Windows\System\RiUcsJy.exe
  2⤵
  PID:7600
- C:\Windows\System\nenSSvS.exe
  C:\Windows\System\nenSSvS.exe
  2⤵
  PID:7528
- C:\Windows\System\SgentfO.exe
  C:\Windows\System\SgentfO.exe
  2⤵
  PID:8204
- C:\Windows\System\IFByhoj.exe
  C:\Windows\System\IFByhoj.exe
  2⤵
  PID:8220
- C:\Windows\System\kkaSmjb.exe
  C:\Windows\System\kkaSmjb.exe
  2⤵
  PID:8236
- C:\Windows\System\xMpbVLH.exe
  C:\Windows\System\xMpbVLH.exe
  2⤵
  PID:8252
- C:\Windows\System\bPlOviG.exe
  C:\Windows\System\bPlOviG.exe
  2⤵
  PID:8308
- C:\Windows\System\iJPNvAa.exe
  C:\Windows\System\iJPNvAa.exe
  2⤵
  PID:8324
- C:\Windows\System\MzcmsxN.exe
  C:\Windows\System\MzcmsxN.exe
  2⤵
  PID:8340
- C:\Windows\System\MnUEmtO.exe
  C:\Windows\System\MnUEmtO.exe
  2⤵
  PID:8356
- C:\Windows\System\FwgDJjw.exe
  C:\Windows\System\FwgDJjw.exe
  2⤵
  PID:8376
- C:\Windows\System\AHzRJHk.exe
  C:\Windows\System\AHzRJHk.exe
  2⤵
  PID:8400
- C:\Windows\System\CnQwCns.exe
  C:\Windows\System\CnQwCns.exe
  2⤵
  PID:8416
- C:\Windows\System\JBGagmS.exe
  C:\Windows\System\JBGagmS.exe
  2⤵
  PID:8432
- C:\Windows\System\cevkrzn.exe
  C:\Windows\System\cevkrzn.exe
  2⤵
  PID:8456
- C:\Windows\System\mUONTQP.exe
  C:\Windows\System\mUONTQP.exe
  2⤵
  PID:8476
- C:\Windows\System\WitFDij.exe
  C:\Windows\System\WitFDij.exe
  2⤵
  PID:8492
- C:\Windows\System\EPxQvDj.exe
  C:\Windows\System\EPxQvDj.exe
  2⤵
  PID:8508
- C:\Windows\System\MIdlEWh.exe
  C:\Windows\System\MIdlEWh.exe
  2⤵
  PID:8532
- C:\Windows\System\GTgvljM.exe
  C:\Windows\System\GTgvljM.exe
  2⤵
  PID:8548
- C:\Windows\System\MCLGawj.exe
  C:\Windows\System\MCLGawj.exe
  2⤵
  PID:8564
- C:\Windows\System\zgQmZAY.exe
  C:\Windows\System\zgQmZAY.exe
  2⤵
  PID:8592
- C:\Windows\System\TIZwYmf.exe
  C:\Windows\System\TIZwYmf.exe
  2⤵
  PID:8628
- C:\Windows\System\jtMHoBm.exe
  C:\Windows\System\jtMHoBm.exe
  2⤵
  PID:8648
- C:\Windows\System\QXUsbzK.exe
  C:\Windows\System\QXUsbzK.exe
  2⤵
  PID:8672
- C:\Windows\System\WJbJUct.exe
  C:\Windows\System\WJbJUct.exe
  2⤵
  PID:8688
- C:\Windows\System\HaJCnsk.exe
  C:\Windows\System\HaJCnsk.exe
  2⤵
  PID:8704
- C:\Windows\System\DpxjiMe.exe
  C:\Windows\System\DpxjiMe.exe
  2⤵
  PID:8724
- C:\Windows\System\UPlqOAr.exe
  C:\Windows\System\UPlqOAr.exe
  2⤵
  PID:8744
- C:\Windows\System\Vojmpbe.exe
  C:\Windows\System\Vojmpbe.exe
  2⤵
  PID:8764
- C:\Windows\System\XhOrWCo.exe
  C:\Windows\System\XhOrWCo.exe
  2⤵
  PID:8784
- C:\Windows\System\krFEOrU.exe
  C:\Windows\System\krFEOrU.exe
  2⤵
  PID:8808
- C:\Windows\System\SwgDbcq.exe
  C:\Windows\System\SwgDbcq.exe
  2⤵
  PID:8828
- C:\Windows\System\rJxXCnk.exe
  C:\Windows\System\rJxXCnk.exe
  2⤵
  PID:8844
- C:\Windows\System\eMyMGAG.exe
  C:\Windows\System\eMyMGAG.exe
  2⤵
  PID:8872
- C:\Windows\System\jfmUuTW.exe
  C:\Windows\System\jfmUuTW.exe
  2⤵
  PID:8892
- C:\Windows\System\sRcPsqT.exe
  C:\Windows\System\sRcPsqT.exe
  2⤵
  PID:8912
- C:\Windows\System\nKWsnzP.exe
  C:\Windows\System\nKWsnzP.exe
  2⤵
  PID:8928
- C:\Windows\System\MujgJrm.exe
  C:\Windows\System\MujgJrm.exe
  2⤵
  PID:8956
- C:\Windows\System\TjRPeWP.exe
  C:\Windows\System\TjRPeWP.exe
  2⤵
  PID:8972
- C:\Windows\System\MhfFSbg.exe
  C:\Windows\System\MhfFSbg.exe
  2⤵
  PID:8992
- C:\Windows\System\ooeZlcs.exe
  C:\Windows\System\ooeZlcs.exe
  2⤵
  PID:9016
- C:\Windows\System\XOpdrus.exe
  C:\Windows\System\XOpdrus.exe
  2⤵
  PID:9032
- C:\Windows\System\gpLFAwY.exe
  C:\Windows\System\gpLFAwY.exe
  2⤵
  PID:9056
- C:\Windows\System\KqGLvta.exe
  C:\Windows\System\KqGLvta.exe
  2⤵
  PID:9072
- C:\Windows\System\plZlJmP.exe
  C:\Windows\System\plZlJmP.exe
  2⤵
  PID:9088
- C:\Windows\System\eLioTYa.exe
  C:\Windows\System\eLioTYa.exe
  2⤵
  PID:9104
- C:\Windows\System\LKGGzxG.exe
  C:\Windows\System\LKGGzxG.exe
  2⤵
  PID:9124
- C:\Windows\System\auPvajn.exe
  C:\Windows\System\auPvajn.exe
  2⤵
  PID:9148
- C:\Windows\System\NkbPBVJ.exe
  C:\Windows\System\NkbPBVJ.exe
  2⤵
  PID:9180
- C:\Windows\System\RaLNYSm.exe
  C:\Windows\System\RaLNYSm.exe
  2⤵
  PID:9196
- C:\Windows\System\hBgyIek.exe
  C:\Windows\System\hBgyIek.exe
  2⤵
  PID:9212
- C:\Windows\System\EnBTpDR.exe
  C:\Windows\System\EnBTpDR.exe
  2⤵
  PID:8248
- C:\Windows\System\gMnaZLi.exe
  C:\Windows\System\gMnaZLi.exe
  2⤵
  PID:8260
- C:\Windows\System\MTNJzwx.exe
  C:\Windows\System\MTNJzwx.exe
  2⤵
  PID:8276
- C:\Windows\System\VlPolmf.exe
  C:\Windows\System\VlPolmf.exe
  2⤵
  PID:8304
- C:\Windows\System\tvfPdLk.exe
  C:\Windows\System\tvfPdLk.exe
  2⤵
  PID:8336
- C:\Windows\System\RVcsSqS.exe
  C:\Windows\System\RVcsSqS.exe
  2⤵
  PID:8372
- C:\Windows\System\sCpzInC.exe
  C:\Windows\System\sCpzInC.exe
  2⤵
  PID:8396
- C:\Windows\System\FWhPAER.exe
  C:\Windows\System\FWhPAER.exe
  2⤵
  PID:8452
- C:\Windows\System\ZhsXVlZ.exe
  C:\Windows\System\ZhsXVlZ.exe
  2⤵
  PID:8516
- C:\Windows\System\lkoyIsP.exe
  C:\Windows\System\lkoyIsP.exe
  2⤵
  PID:8556
- C:\Windows\System\twarmOn.exe
  C:\Windows\System\twarmOn.exe
  2⤵
  PID:8580
- C:\Windows\System\IEhEktK.exe
  C:\Windows\System\IEhEktK.exe
  2⤵
  PID:8600
- C:\Windows\System\fGJGxlj.exe
  C:\Windows\System\fGJGxlj.exe
  2⤵
  PID:8616
- C:\Windows\System\OhVBHdv.exe
  C:\Windows\System\OhVBHdv.exe
  2⤵
  PID:8640
- C:\Windows\System\YJgCTXP.exe
  C:\Windows\System\YJgCTXP.exe
  2⤵
  PID:8684
- C:\Windows\System\ZjOeqkj.exe
  C:\Windows\System\ZjOeqkj.exe
  2⤵
  PID:8700
- C:\Windows\System\JfTkZSB.exe
  C:\Windows\System\JfTkZSB.exe
  2⤵
  PID:8740
- C:\Windows\System\xlONUtq.exe
  C:\Windows\System\xlONUtq.exe
  2⤵
  PID:8776
- C:\Windows\System\wdpiUAQ.exe
  C:\Windows\System\wdpiUAQ.exe
  2⤵
  PID:8800
- C:\Windows\System\lkoAzlj.exe
  C:\Windows\System\lkoAzlj.exe
  2⤵
  PID:8860
- C:\Windows\System\wtahgTf.exe
  C:\Windows\System\wtahgTf.exe
  2⤵
  PID:8884
- C:\Windows\System\PdMsgeE.exe
  C:\Windows\System\PdMsgeE.exe
  2⤵
  PID:8936
- C:\Windows\System\OcDEsDF.exe
  C:\Windows\System\OcDEsDF.exe
  2⤵
  PID:8980
- C:\Windows\System\DoKosWJ.exe
  C:\Windows\System\DoKosWJ.exe
  2⤵
  PID:8988
- C:\Windows\System\hYFzkmF.exe
  C:\Windows\System\hYFzkmF.exe
  2⤵
  PID:9008
- C:\Windows\System\SzZoCtG.exe
  C:\Windows\System\SzZoCtG.exe
  2⤵
  PID:9064
- C:\Windows\System\tXDLCpx.exe
  C:\Windows\System\tXDLCpx.exe
  2⤵
  PID:9080
- C:\Windows\System\yuWMxOu.exe
  C:\Windows\System\yuWMxOu.exe
  2⤵
  PID:9116
- C:\Windows\System\ZNmECEf.exe
  C:\Windows\System\ZNmECEf.exe
  2⤵
  PID:9140
- C:\Windows\System\WFWNVEO.exe
  C:\Windows\System\WFWNVEO.exe
  2⤵
  PID:8228
- C:\Windows\System\rVFkiPp.exe
  C:\Windows\System\rVFkiPp.exe
  2⤵
  PID:8272
- C:\Windows\System\SWxfLkp.exe
  C:\Windows\System\SWxfLkp.exe
  2⤵
  PID:8388
- C:\Windows\System\bibrqua.exe
  C:\Windows\System\bibrqua.exe
  2⤵
  PID:8412
- C:\Windows\System\cHrhoyz.exe
  C:\Windows\System\cHrhoyz.exe
  2⤵
  PID:9208
- C:\Windows\System\ydrrhEe.exe
  C:\Windows\System\ydrrhEe.exe
  2⤵
  PID:8212
- C:\Windows\System\RUItihR.exe
  C:\Windows\System\RUItihR.exe
  2⤵
  PID:8464
- C:\Windows\System\GQBCnlQ.exe
  C:\Windows\System\GQBCnlQ.exe
  2⤵
  PID:8448
- C:\Windows\System\ZqCPcBO.exe
  C:\Windows\System\ZqCPcBO.exe
  2⤵
  PID:8292
- C:\Windows\System\AqoaAVH.exe
  C:\Windows\System\AqoaAVH.exe
  2⤵
  PID:8612
- C:\Windows\System\TeaxtcH.exe
  C:\Windows\System\TeaxtcH.exe
  2⤵
  PID:8636
- C:\Windows\System\inuDHCy.exe
  C:\Windows\System\inuDHCy.exe
  2⤵
  PID:8792
- C:\Windows\System\ItzDTaK.exe
  C:\Windows\System\ItzDTaK.exe
  2⤵
  PID:8824
- C:\Windows\System\RVikEzJ.exe
  C:\Windows\System\RVikEzJ.exe
  2⤵
  PID:8856
- C:\Windows\System\COflNBE.exe
  C:\Windows\System\COflNBE.exe
  2⤵
  PID:8920
- C:\Windows\System\PbUhwwX.exe
  C:\Windows\System\PbUhwwX.exe
  2⤵
  PID:9004
- C:\Windows\System\vEvtIdf.exe
  C:\Windows\System\vEvtIdf.exe
  2⤵
  PID:9052
- C:\Windows\System\MIVtFwZ.exe
  C:\Windows\System\MIVtFwZ.exe
  2⤵
  PID:9120
- C:\Windows\System\PIPpvvW.exe
  C:\Windows\System\PIPpvvW.exe
  2⤵
  PID:9048
- C:\Windows\System\YVXyTAI.exe
  C:\Windows\System\YVXyTAI.exe
  2⤵
  PID:8332
- C:\Windows\System\epTaDxb.exe
  C:\Windows\System\epTaDxb.exe
  2⤵
  PID:9168
- C:\Windows\System\jkZTQXP.exe
  C:\Windows\System\jkZTQXP.exe
  2⤵
  PID:7792
- C:\Windows\System\fWWdnEq.exe
  C:\Windows\System\fWWdnEq.exe
  2⤵
  PID:8588
- C:\Windows\System\hgnXMHF.exe
  C:\Windows\System\hgnXMHF.exe
  2⤵
  PID:8524
- C:\Windows\System\FQgYRLa.exe
  C:\Windows\System\FQgYRLa.exe
  2⤵
  PID:8300
- C:\Windows\System\mIbiMdR.exe
  C:\Windows\System\mIbiMdR.exe
  2⤵
  PID:8668
- C:\Windows\System\knoPGqj.exe
  C:\Windows\System\knoPGqj.exe
  2⤵
  PID:8752
- C:\Windows\System\NHnkixN.exe
  C:\Windows\System\NHnkixN.exe
  2⤵
  PID:8820
- C:\Windows\System\ojlCdEt.exe
  C:\Windows\System\ojlCdEt.exe
  2⤵
  PID:8880
- C:\Windows\System\GDhVBOo.exe
  C:\Windows\System\GDhVBOo.exe
  2⤵
  PID:8888
- C:\Windows\System\xtFZBzx.exe
  C:\Windows\System\xtFZBzx.exe
  2⤵
  PID:9096
- C:\Windows\System\kjwjqmD.exe
  C:\Windows\System\kjwjqmD.exe
  2⤵
  PID:9160
- C:\Windows\System\wOdDZLS.exe
  C:\Windows\System\wOdDZLS.exe
  2⤵
  PID:8216
- C:\Windows\System\UgTrbkI.exe
  C:\Windows\System\UgTrbkI.exe
  2⤵
  PID:8660
- C:\Windows\System\YaIuOzq.exe
  C:\Windows\System\YaIuOzq.exe
  2⤵
  PID:8540
- C:\Windows\System\RJXMxQU.exe
  C:\Windows\System\RJXMxQU.exe
  2⤵
  PID:8760
- C:\Windows\System\cWAeIgB.exe
  C:\Windows\System\cWAeIgB.exe
  2⤵
  PID:9044
- C:\Windows\System\UBoSfUi.exe
  C:\Windows\System\UBoSfUi.exe
  2⤵
  PID:9028
- C:\Windows\System\bIIMEXz.exe
  C:\Windows\System\bIIMEXz.exe
  2⤵
  PID:9176
- C:\Windows\System\QtxEzjd.exe
  C:\Windows\System\QtxEzjd.exe
  2⤵
  PID:8604
- C:\Windows\System\iEKKFav.exe
  C:\Windows\System\iEKKFav.exe
  2⤵
  PID:9204
- C:\Windows\System\bQLrUOK.exe
  C:\Windows\System\bQLrUOK.exe
  2⤵
  PID:8948
- C:\Windows\System\WwUQdCA.exe
  C:\Windows\System\WwUQdCA.exe
  2⤵
  PID:9040
- C:\Windows\System\gBMTWnW.exe
  C:\Windows\System\gBMTWnW.exe
  2⤵
  PID:9164
- C:\Windows\System\NSiOkay.exe
  C:\Windows\System\NSiOkay.exe
  2⤵
  PID:9136
- C:\Windows\System\CfShAOF.exe
  C:\Windows\System\CfShAOF.exe
  2⤵
  PID:8268
- C:\Windows\System\YRZhORC.exe
  C:\Windows\System\YRZhORC.exe
  2⤵
  PID:8732
- C:\Windows\System\TwwNihl.exe
  C:\Windows\System\TwwNihl.exe
  2⤵
  PID:8488
- C:\Windows\System\ioMVKEw.exe
  C:\Windows\System\ioMVKEw.exe
  2⤵
  PID:9220
- C:\Windows\System\KpHeLoP.exe
  C:\Windows\System\KpHeLoP.exe
  2⤵
  PID:9240
- C:\Windows\System\oCgkaEI.exe
  C:\Windows\System\oCgkaEI.exe
  2⤵
  PID:9260
- C:\Windows\System\zJpULjz.exe
  C:\Windows\System\zJpULjz.exe
  2⤵
  PID:9280
- C:\Windows\System\bLLcovH.exe
  C:\Windows\System\bLLcovH.exe
  2⤵
  PID:9304
- C:\Windows\System\AIvciew.exe
  C:\Windows\System\AIvciew.exe
  2⤵
  PID:9320
- C:\Windows\System\YYFlaDL.exe
  C:\Windows\System\YYFlaDL.exe
  2⤵
  PID:9344
- C:\Windows\System\TFgCkpW.exe
  C:\Windows\System\TFgCkpW.exe
  2⤵
  PID:9364
- C:\Windows\System\VekEswB.exe
  C:\Windows\System\VekEswB.exe
  2⤵
  PID:9380
- C:\Windows\System\DJwlwtd.exe
  C:\Windows\System\DJwlwtd.exe
  2⤵
  PID:9400
- C:\Windows\System\UPJxgeG.exe
  C:\Windows\System\UPJxgeG.exe
  2⤵
  PID:9416
- C:\Windows\System\gVkfdmi.exe
  C:\Windows\System\gVkfdmi.exe
  2⤵
  PID:9432
- C:\Windows\System\CWPNUNb.exe
  C:\Windows\System\CWPNUNb.exe
  2⤵
  PID:9456
- C:\Windows\System\VXmdlHQ.exe
  C:\Windows\System\VXmdlHQ.exe
  2⤵
  PID:9476
- C:\Windows\System\WTyIhjh.exe
  C:\Windows\System\WTyIhjh.exe
  2⤵
  PID:9500
- C:\Windows\System\ZZriKjk.exe
  C:\Windows\System\ZZriKjk.exe
  2⤵
  PID:9520
- C:\Windows\System\hyZvmPZ.exe
  C:\Windows\System\hyZvmPZ.exe
  2⤵
  PID:9544
- C:\Windows\System\GiyVyex.exe
  C:\Windows\System\GiyVyex.exe
  2⤵
  PID:9560
- C:\Windows\System\wZNgcFD.exe
  C:\Windows\System\wZNgcFD.exe
  2⤵
  PID:9580
- C:\Windows\System\PiHPFKk.exe
  C:\Windows\System\PiHPFKk.exe
  2⤵
  PID:9600
- C:\Windows\System\eMkubPL.exe
  C:\Windows\System\eMkubPL.exe
  2⤵
  PID:9616
- C:\Windows\System\Donvrii.exe
  C:\Windows\System\Donvrii.exe
  2⤵
  PID:9632
- C:\Windows\System\XOhIWXe.exe
  C:\Windows\System\XOhIWXe.exe
  2⤵
  PID:9656
- C:\Windows\System\FrAucWs.exe
  C:\Windows\System\FrAucWs.exe
  2⤵
  PID:9672
- C:\Windows\System\wjPmmYn.exe
  C:\Windows\System\wjPmmYn.exe
  2⤵
  PID:9708
- C:\Windows\System\lGxuaHK.exe
  C:\Windows\System\lGxuaHK.exe
  2⤵
  PID:9724
- C:\Windows\System\JgHpNvx.exe
  C:\Windows\System\JgHpNvx.exe
  2⤵
  PID:9740
- C:\Windows\System\prbJVFU.exe
  C:\Windows\System\prbJVFU.exe
  2⤵
  PID:9756
- C:\Windows\System\pcvCBeA.exe
  C:\Windows\System\pcvCBeA.exe
  2⤵
  PID:9772
- C:\Windows\System\yqOgyIH.exe
  C:\Windows\System\yqOgyIH.exe
  2⤵
  PID:9788
- C:\Windows\System\gtZtGHz.exe
  C:\Windows\System\gtZtGHz.exe
  2⤵
  PID:9816
- C:\Windows\System\Xngaxfx.exe
  C:\Windows\System\Xngaxfx.exe
  2⤵
  PID:9832
- C:\Windows\System\iuvzxCO.exe
  C:\Windows\System\iuvzxCO.exe
  2⤵
  PID:9856
- C:\Windows\System\iwNMOfq.exe
  C:\Windows\System\iwNMOfq.exe
  2⤵
  PID:9880
- C:\Windows\System\NOMAEHk.exe
  C:\Windows\System\NOMAEHk.exe
  2⤵
  PID:9900
- C:\Windows\System\TlkWDkt.exe
  C:\Windows\System\TlkWDkt.exe
  2⤵
  PID:9916
- C:\Windows\System\wCrvLbZ.exe
  C:\Windows\System\wCrvLbZ.exe
  2⤵
  PID:9940
- C:\Windows\System\QYlBQOi.exe
  C:\Windows\System\QYlBQOi.exe
  2⤵
  PID:9972
- C:\Windows\System\GhBMeDb.exe
  C:\Windows\System\GhBMeDb.exe
  2⤵
  PID:9988
- C:\Windows\System\lEywLaT.exe
  C:\Windows\System\lEywLaT.exe
  2⤵
  PID:10004
- C:\Windows\System\NqfpUMD.exe
  C:\Windows\System\NqfpUMD.exe
  2⤵
  PID:10020
- C:\Windows\System\NKyUnxg.exe
  C:\Windows\System\NKyUnxg.exe
  2⤵
  PID:10036
- C:\Windows\System\KHsPnrn.exe
  C:\Windows\System\KHsPnrn.exe
  2⤵
  PID:10052
- C:\Windows\System\NgibcCH.exe
  C:\Windows\System\NgibcCH.exe
  2⤵
  PID:10068
- C:\Windows\System\EvtGtZJ.exe
  C:\Windows\System\EvtGtZJ.exe
  2⤵
  PID:10088
- C:\Windows\System\pBwIQQk.exe
  C:\Windows\System\pBwIQQk.exe
  2⤵
  PID:10108
- C:\Windows\System\fwwJouy.exe
  C:\Windows\System\fwwJouy.exe
  2⤵
  PID:10124
- C:\Windows\System\sqHqCkx.exe
  C:\Windows\System\sqHqCkx.exe
  2⤵
  PID:10148
- C:\Windows\System\iHkjbfz.exe
  C:\Windows\System\iHkjbfz.exe
  2⤵
  PID:10192
- C:\Windows\System\PBMZAAd.exe
  C:\Windows\System\PBMZAAd.exe
  2⤵
  PID:10208
- C:\Windows\System\dtQxHLZ.exe
  C:\Windows\System\dtQxHLZ.exe
  2⤵
  PID:10228
- C:\Windows\System\TjfVauJ.exe
  C:\Windows\System\TjfVauJ.exe
  2⤵
  PID:9232
- C:\Windows\System\mKFduxe.exe
  C:\Windows\System\mKFduxe.exe
  2⤵
  PID:9248
- C:\Windows\System\HhCaabh.exe
  C:\Windows\System\HhCaabh.exe
  2⤵
  PID:9252
- C:\Windows\System\yadhVKn.exe
  C:\Windows\System\yadhVKn.exe
  2⤵
  PID:9312
- C:\Windows\System\pJGDNHD.exe
  C:\Windows\System\pJGDNHD.exe
  2⤵
  PID:9336
- C:\Windows\System\LXGSXzK.exe
  C:\Windows\System\LXGSXzK.exe
  2⤵
  PID:9372
- C:\Windows\System\uGmwKfw.exe
  C:\Windows\System\uGmwKfw.exe
  2⤵
  PID:9428
- C:\Windows\System\BfiXHPp.exe
  C:\Windows\System\BfiXHPp.exe
  2⤵
  PID:9472
- C:\Windows\System\uFybykZ.exe
  C:\Windows\System\uFybykZ.exe
  2⤵
  PID:9444
- C:\Windows\System\DKLhEjy.exe
  C:\Windows\System\DKLhEjy.exe
  2⤵
  PID:9492
- C:\Windows\System\RHJCybU.exe
  C:\Windows\System\RHJCybU.exe
  2⤵
  PID:9528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FsQzUIr.exe

Filesize
2.2MB

MD5
ed96928dd3313867e4dee7cf84c3e898

SHA1
f7ae952b5b94c0ea015d4a98a6dd7d70efecc5da

SHA256
25ee26bd1d93439315f831b85206695c6f2073d41cdcf0d00bfff599b8e2871a

SHA512
6e0d41ac3151e2de852ac8389f08ee1e63d15ee04e094a43d12071e723d417865e22c1c135347b3206e4285212d22b9fd166da2a50dfc21f9fe1eeba8ef17208

Download Submit
C:\Windows\system\HSjVrQF.exe

Filesize
2.2MB

MD5
c01f3335c6021d218fbf4b4fefa66357

SHA1
bc0dc12bb5d672fbbf0eeb3d45b7547b09903b58

SHA256
b7fdc09d7ee39d98628b99e8acd4110811932a099c1e2988edd5fe9ff8a66eed

SHA512
ac33130dfeb45b7389d88e0065d27a58f6bd48da98116c4d34e3e974708b00d909ba5faa4bc61e4342070ce31a5c192727ab02849923190e0f4bcfc2a5c0abba

Download Submit
C:\Windows\system\HizXoui.exe

Filesize
2.2MB

MD5
f1c996d68a05d14f320e5096cf9e456e

SHA1
44eeba485969d7e2639c35eba9ff99188f67e206

SHA256
f9eeac617d01828c9f8421941a353673c2d809f674a85df7884ff49ebae830cb

SHA512
8b6dd03ab4c73517b637cb665abba97d2fe717f343e1c7b6003b1fab85349d89b5de71cb792d643f0ee54838fb10de97eb809cf0c2f7825be37f772e201eab61

Download Submit
C:\Windows\system\IRQGWsu.exe

Filesize
2.2MB

MD5
a445546a127663c208566cadb2edd98d

SHA1
c667334661d4e0f9f13b6887235fadee9be35009

SHA256
33607feb0a20fcc0a6131bb3798de580200be3aa89e77f76d5e3bf6000ddbfe6

SHA512
da426707d7379b3bed053274143e196e622b49f7596f5f265c5e5f7b38820b5b1c6b4636609316513f21197df1728dc4684655b1f30c0e84d9ae071325da67a8

Download Submit
C:\Windows\system\IUPktMU.exe

Filesize
2.2MB

MD5
1e1070f7d10a21aee58fb63d91aec762

SHA1
c659438d71bf7dc1146e5fa44c76db6aeff6e2aa

SHA256
3df5e88988d8bd652257d8bfa77729726bd78fd75f6a0c6c56e6a73fb1b71513

SHA512
0dfd160857142e8314abe6af91f44a908e2918de46dd7c298e3eeccaccbda8dcec239f2fc625ee98d4da6c34ddc2350fc7e9fade36bb61b8fa50c08346a3b6d9

Download Submit
C:\Windows\system\JnJoDUB.exe

Filesize
2.2MB

MD5
f29c0dbd6897ef7d915354bbb77d2d0f

SHA1
b3d48f84ebc8a8f35d8e45410bb085487f682923

SHA256
a32d7d1787a4c30fbe986865f2ba39697953d91850c02e360040c507662d9bde

SHA512
86764a751e70548c3bc1a8794af6c134661905a9cbbadaf3519ac82f631f0e482d5b2c6468bd4bf5d4425177c220b3dba3f75f239b804b6dd59bf3ca3b4e104c

Download Submit
C:\Windows\system\OsmRTKz.exe

Filesize
2.2MB

MD5
6d0944b84de23c60a63e59ce4dce721e

SHA1
cb912e46ad4114b583d8cdccbc74f507e1166a8f

SHA256
9948eaaedfadfc65cdca24368d3e9b2b3e69009229d16231f93f15b8a453debe

SHA512
d77c02093e032e7eff6c37c7fec0e6ca49484c65f528b02525b001d3770763f262c768cacb1e15772ab4dd56e315dd580b12209860b21445095f50f4eabe77d2

Download Submit
C:\Windows\system\UatugEJ.exe

Filesize
2.2MB

MD5
30897e3e2ecd09e53dc517069aecab13

SHA1
aec000f7065390fad1660bea5860e0bee030b8d4

SHA256
06d34de947138f04bcd4be2e001696f3c58d7d2d543db5a3c393d78020722f94

SHA512
c00a2446cbb5c08be1781587d83cbac165b07f8ddfd780aacdbdd53a9eabcd4e7ae0bcc00436734ca7b5e7683ddb9297d9434f6be56ad363ba1333a5c27b666b

Download Submit
C:\Windows\system\XrdKBYK.exe

Filesize
2.2MB

MD5
0f9369e8e2745806e1190a9d8d3643bc

SHA1
132c3a617fae85082af9843d8ab78226df9a05e2

SHA256
b07efa4ad398bcc102d7061b9c041f1b1171df8178a60d8e54ccf4636e4e711a

SHA512
97432314633612a7ceefea634e750511273e987f611b47e6ff77a2deede02f89adacb109c7559c65891d0483606b793ec2d8fbbaf8ddc7df1c9965a83f65cbbf

Download Submit
C:\Windows\system\YCtnbGP.exe

Filesize
2.2MB

MD5
27aa6b0b02025c2f6b052fd90d03b1b3

SHA1
53dc4027d873351b160dca98ba13357f8b5067f7

SHA256
a51f7ff3368f34219d3a84c77125f6d085d0279e6ef3b3b99eaffac671573bcd

SHA512
15d7975146f0015e7f2101bbe97f6ae7ea9695392a80e294ddd35f7c240778206a4bfa9a414cd77618cb7fff0b6ecab0804601dbaa541998117e94fa86f8922b

Download Submit
C:\Windows\system\YdXpHBg.exe

Filesize
2.2MB

MD5
d5368c5d7e48edf6bde4dd96c57e1407

SHA1
38208fa80fad1c7f35f5ea447d74a38e3ef3cb10

SHA256
4e3f12220cc5c14d696d491379f2f853b9236230a1def07084ed0103363045d5

SHA512
6bdec9387d47c1d4d4060c1d14d61a6d20166e85ca1e88a05321fbe5a006df92c4bb9f2a0cf71d39e15c25c8e4cea8bf23d05527c32d6d7676e9478070b4a4b0

Download Submit
C:\Windows\system\anpwzdR.exe

Filesize
2.2MB

MD5
724ad4ccc05883803f25f29f303fd823

SHA1
23d5c3a94b57b982821cf846ef56160a158a4804

SHA256
d98b79624b98c7295d39d795e9c57c2f3541de479a0cf03fb609b11bb5a09973

SHA512
47dc1e854d95583d758a0bfac490fa3cf31996c3a80afaa1ccb264ccfa2d02ba92a7487227362712d427e4af067ed9f436a6fa14a5da65779000046d0efee0aa

Download Submit
C:\Windows\system\aylequz.exe

Filesize
2.2MB

MD5
01dfe129631e28408a1fa94ecc8ddc86

SHA1
37447fa3dd3b479f6e66f54b53ef0998aa5da17e

SHA256
6f5f5e1510b958a2ccb00b612001bd3777fd39309bc89c4844c1a6d650bc0ed8

SHA512
3430d681e4348034837b78ad16e7dc381bf28658e5471633a99c8c464d0b150107bec46024a075e511d215d46bfb996ed8c41bbafd63103e26e71a5f7ae0aaa9

Download Submit
C:\Windows\system\fWipKfv.exe

Filesize
2.2MB

MD5
8b6734d2b759bd30737bf3ad20ea53c1

SHA1
b2a2fce6dd0515e7da33d2daf543b5a0972b3174

SHA256
02f5085a986c5968051abd2f4ea8b925a0fdad9c717fbcceb746a3ffe3ce074b

SHA512
beb2092cb40fbcfaa26fe828dae8c4c6b846be6085789a33fcaa614a82dfb7ba2bac2d9b869551c27c71c44b4e44a42f5bc572627c707e307ca839dd8e2020ac

Download Submit
C:\Windows\system\gNbyuqG.exe

Filesize
2.2MB

MD5
d37c5994fd0cb8c26046b338f6eeebe5

SHA1
14dd02d0eab5337b942881148d1ccc49fd0da1eb

SHA256
98c3755613cea71a9081ca9703b2c00f1c63e40327fcdc85c268b7561705e04d

SHA512
612050c11ecf1e2d714e33f6fad35e1a792db8793f5273bfcd73488bb5cbab5aaa995fa6149c0546ec12afa95a94d247600b57a979d277caed034b0f31afc224

Download Submit
C:\Windows\system\hJRrizy.exe

Filesize
2.2MB

MD5
102b657d641b9d80a01b1dd7c81ce0bb

SHA1
7e061f960b034a5c0c16672d61508193ac7b6e3c

SHA256
228fed6e45049386dbc2def9cc40efec510a238811a3ff1f563d536592ed14e5

SHA512
29bc9f7ba89dc583d0193939feece3dc2ddd1812f76c9136b2f46933db32550dec3da53fdb8029e7c0ea6a3908befa43e61e8f9b01315a80df3661bccf653dbb

Download Submit
C:\Windows\system\jOKYdxq.exe

Filesize
2.2MB

MD5
5b36884f6a9427928a21a46797b114ed

SHA1
146dd460ffb251de2cb825a850bb8c8154b4dca7

SHA256
60e8c62816249d4cf55f7583222693651a8eb378762647420c2d55aeefb4ec31

SHA512
c13dc391aa1715a25a5d77a784fe859b802385da494f88719624545284f44d83922fdd0b74fb968760bdd33cf31a2ec392cde260a9b28bb6a1facf9782f6848c

Download Submit
C:\Windows\system\kqqHLrq.exe

Filesize
2.2MB

MD5
155a039292daf4c3b0a9fcf78630677f

SHA1
5a58a3f30c427988d218f745c0ce32e6a4a56465

SHA256
2be7404470bbabd8ed8b43dcde55a5ef16a6a428a7f659d78f3efa0442761811

SHA512
7d7f37855898b537a67d1da7988b568bbabbbaca969f7fb4b3b8b89a8f86f11008f72c12b8499a052c5f2f14695eaa925a03c887b38b7835af294a822589d476

Download Submit
C:\Windows\system\lxAWzjc.exe

Filesize
2.2MB

MD5
0f17cb4f147bc475060ff9c3ab60de67

SHA1
ed4bcda22d7c5b62d0019b28313547f01431fb0e

SHA256
d5370e8c6467dca84b4c4dce7dd52f91064aa08b914ecdba45d9290d6cc36ab7

SHA512
619930eabbfb70437d46b2342a05d42f3f26f5c0a3532271e401e7bb43be07f89ce890dec47c6bd6c4e7dcce5cfd4834155fafb1204ae1f5635fad4aac7f0d20

Download Submit
C:\Windows\system\rfjFpjx.exe

Filesize
2.2MB

MD5
8bbaf7b4024e236023cf8aea9149e134

SHA1
934d536ee708a4d663ac2a97d717ad7ec82f8070

SHA256
0f136421f0a9c9055d05e3678f2bb4794b240dcd6ddd61931176b60bd12ce053

SHA512
c70d8fdba758d1526247cca35f7803f9f7196d05f08db6b65a78ac5c70ccaa6bbe5394c7f7c30246b4e8f76916d5d69fa8a51242a35d7f4b1227a7b86aef9c92

Download Submit
C:\Windows\system\uWXmDoX.exe

Filesize
2.2MB

MD5
e1cf18900ffe26d560ed6d6de7ce3ccc

SHA1
b7bb3513c324573f241389514576ca41c72cc324

SHA256
8a2691741b609a7f2372a84842a4c97869d68c44a86feb5d2b91ebe0d8824a99

SHA512
68855842761f61f2c904c5e7d248e0d0afd465667304f8818a7eba93c6ec3a5b617cee3098e68585e0f0b7ee0dcf748f55a91f7aa1900d173b3d7828a5d41af5

Download Submit
C:\Windows\system\wLcyczG.exe

Filesize
2.2MB

MD5
0c30d027d47e455c6fef65a097e0fef6

SHA1
006f509528d3e2ab3654355a23655eace6aa3f66

SHA256
ffa5f20bf0263cd3e32eb1f47e668137660accb926b30e8f1e6cf7b8b333dfd9

SHA512
16ee333e9cfa68e0d8bace6026ffe86a70fa6a9ea3d52e6d702e910b4c465da3f8e90e1796ed003cf23a6dad7e56c6b00cbd0153f622b4418fe9db5cd5f6eb6a

Download Submit
C:\Windows\system\xHzMOUR.exe

Filesize
2.2MB

MD5
cc88776b1ff81fa4924297b2b9e66d1e

SHA1
73da478f6be44ae0bf0f6f1d1d1e96d63b739181

SHA256
52d156e9b1927a548ae51178e4d71956af0d7657b5b2e4531f04b920508baaba

SHA512
844902ac304a06686461ca82dc48dad0555a241082697a63c433edf39ece69003d77b58cab3c7991cc8542c2840a8d5687498993efaa74562ab9a7b333fbf70e

Download Submit
C:\Windows\system\yveNaJy.exe

Filesize
2.2MB

MD5
4bd38c689510ad857a761df7351a2590

SHA1
d5dbd0b1295d1c920a9180744e1b666f7555b9e0

SHA256
e2cdb43a4d0bfa7aa68ade2c08103fa5291c41b4874238568c87172f8a765417

SHA512
e2db79f7217dd2c363d5ad6a85456a91594ea7bf292139bfe2cbaab9cff6fd7572734956dc5b18d97c12ba0e66396ec48e71b9d245d97b8473d0200d3af4b150

Download Submit
C:\Windows\system\ywwmiDI.exe

Filesize
2.2MB

MD5
eb8105265d72a49c0b0935bbca56d1cf

SHA1
7ee2660c5089359f2b79101223a792cd8370cad0

SHA256
60bddca24f3053615f56c7b7cc766859dce6be439ddb500e0c6308344fdd0653

SHA512
187cbd1d5b29b72773c13ba2b53589b45c1cc8d9dc717c4b5376dcf4f327eaadd52fed74d9d5e240b0354947cd8799c027b81b5e86e7f7a1bc44e9d7190fddb7

Download Submit
C:\Windows\system\zlcgNKC.exe

Filesize
2.2MB

MD5
194543c1f32c1b87ec707036d639d960

SHA1
ccecafd16e2023b46888ae7759f079fb7bb87b0b

SHA256
5ae862ef1d0ad1e8a17bd0ceccff3b8d340b560d6082b7ba6cf623d83a9c418f

SHA512
6489300d657b30061c9b23be7224d4c52d7c137604fe132749b55b7372c56add2a511c4ba19ce83a7888a646539ba10d3a096d913ac16c71acea8ebe8572dc48

Download Submit
\Windows\system\BfzWouU.exe

Filesize
2.2MB

MD5
be70a79814aa2bf29536da844b258ff0

SHA1
8b5d41eebda6d780d1fb9405145d252e979960b0

SHA256
012137d7ac0ccfe9e96ba2041ec97da66b1d3acb2724831ed0a2d65b94e889b4

SHA512
034ddd980f8a0a8bc8445cfc9057fed0f0b1e6c4977ed848f0fc8b46ccaf6a70c962d5524de3ac8871cce7b699dd7b6a02ecc6d5e8018f8c508a463c702f4568

Download Submit
\Windows\system\KyUkOJz.exe

Filesize
2.2MB

MD5
1155b8e6cbccbd1978b81a4b1884e801

SHA1
b33f20d01ef68a8eec64a82ead1440a5210fd9d9

SHA256
0c2b00008dc459ef8f05666e58a3780041cc17dec990bd9cf2c93dea95aa6b6c

SHA512
822527fdd90e0ee860f79bd67cfd7a51c3438d0bf5543d081a971efc73fd1103b36148aa42b624d2a4107440789327a6f3acb5a91fb06dc17c41f31c34b773cc

Download Submit
\Windows\system\TtTZVXY.exe

Filesize
2.2MB

MD5
4ccb2358da0760ef0508a87fbec0ff69

SHA1
8b18c5e1671aa099801e627287917c796997ea1b

SHA256
81af1809692cf8bc41ccb80257b55677f874f6bf7d06c4933a206c0146e6197a

SHA512
bb3ea1f634367d7d90f0ea909cf2a143ddda617127ab8d0818a1dc466aa1d489737785fe9348442600c27aae0a8df145619398c0ba9a7ea5429d1fc32b353d23

Download Submit
\Windows\system\mavLoMQ.exe

Filesize
2.2MB

MD5
2aad697355f561f062988bb5f0930bd3

SHA1
67a199ec566b2e59d5f59d0ac178c0b11a8700cf

SHA256
092c74053b10f017f197474c8a831928cf01b223f52b1439163c00aa446475d4

SHA512
4650482c58765b01c68c87139447667da9a50761f5dfd651be7f6e8f791067594bf1f3866253613bece8d819eed69ea35605df313eed8ee8b37edfc696341997

Download Submit
\Windows\system\oHKPaYY.exe

Filesize
2.2MB

MD5
2e0b7a10c1010de0091084441c77f40f

SHA1
bcb7c8765f3a8a6723327d0f349b64d64dfce0f2

SHA256
f4f28149fe11421b7be5ead884adc2cca2c2fbef0bd169907197ebab5d8eed59

SHA512
1eb0e642bb7bd1c6ab9ca74237617908b41be2c3f5c9d262ffea2e80b15079771d9138ce1c18952739a50a77f6ce450fbed412a2dc5d54aa64e0d1404393637a

Download Submit
\Windows\system\pIgeany.exe

Filesize
2.2MB

MD5
49d2c0dcf60b0f5283ccb57533093c0a

SHA1
79d612395d882e2b92553ab6076feb2236898a75

SHA256
04f0e23db034b14581321ed9a017e07c6dcdb3cea42b49ab8ecc0c960ba785fb

SHA512
581c135e394dca7559a540c298f880b5cba74bf8586f872d473861d98d4e3682d9f1681e20a90f727b78bb30a58ed25fcf641f966bc01df5c7c177e80887c989

Download Submit
memory/1764-2714-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/1764-105-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/1764-4057-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-103-0x000000013F740000-0x000000013FA94000-memory.dmp

Filesize
3.3MB

Download
memory/1796-96-0x000000013FE00000-0x0000000140154000-memory.dmp

Filesize
3.3MB

Download
memory/1796-534-0x000000013F7A0000-0x000000013FAF4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1796-55-0x000000013F1D0000-0x000000013F524000-memory.dmp

Filesize
3.3MB

Download
memory/1796-104-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1796-34-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1796-70-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-2885-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1796-111-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1796-56-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-40-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/1796-12-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-0-0x000000013F1D0000-0x000000013F524000-memory.dmp

Filesize
3.3MB

Download
memory/1796-2712-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1796-47-0x000000013F740000-0x000000013FA94000-memory.dmp

Filesize
3.3MB

Download
memory/1796-2623-0x000000013FE00000-0x0000000140154000-memory.dmp

Filesize
3.3MB

Download
memory/1796-2318-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-28-0x00000000020F0000-0x0000000002444000-memory.dmp

Filesize
3.3MB

Download
memory/1796-1833-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-84-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-62-0x000000013FE80000-0x00000001401D4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-79-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-63-0x000000013F7A0000-0x000000013FAF4000-memory.dmp

Filesize
3.3MB

Download
memory/1796-21-0x000000013F7A0000-0x000000013FAF4000-memory.dmp

Filesize
3.3MB

Download
memory/1856-1834-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/1856-80-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/1856-4054-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/2236-8-0x000000013FE80000-0x00000001401D4000-memory.dmp

Filesize
3.3MB

Download
memory/2236-66-0x000000013FE80000-0x00000001401D4000-memory.dmp

Filesize
3.3MB

Download
memory/2236-4044-0x000000013FE80000-0x00000001401D4000-memory.dmp

Filesize
3.3MB

Download
memory/2276-35-0x000000013F450000-0x000000013F7A4000-memory.dmp

Filesize
3.3MB

Download
memory/2276-88-0x000000013F450000-0x000000013F7A4000-memory.dmp

Filesize
3.3MB

Download
memory/2276-4048-0x000000013F450000-0x000000013F7A4000-memory.dmp

Filesize
3.3MB

Download
memory/2432-4050-0x000000013F740000-0x000000013FA94000-memory.dmp

Filesize
3.3MB

Download
memory/2432-50-0x000000013F740000-0x000000013FA94000-memory.dmp

Filesize
3.3MB

Download
memory/2488-57-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/2488-4051-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/2488-313-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/2548-4049-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/2548-95-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/2548-41-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/2576-908-0x000000013F7A0000-0x000000013FAF4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-4053-0x000000013F7A0000-0x000000013FAF4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-67-0x000000013F7A0000-0x000000013FAF4000-memory.dmp

Filesize
3.3MB

Download
memory/2600-4055-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2600-89-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2600-2532-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2616-4045-0x000000013F7A0000-0x000000013FAF4000-memory.dmp

Filesize
3.3MB

Download
memory/2616-22-0x000000013F7A0000-0x000000013FAF4000-memory.dmp

Filesize
3.3MB

Download
memory/2736-29-0x000000013F3E0000-0x000000013F734000-memory.dmp

Filesize
3.3MB

Download
memory/2736-4047-0x000000013F3E0000-0x000000013F734000-memory.dmp

Filesize
3.3MB

Download
memory/2832-19-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/2832-4046-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/2832-78-0x000000013FC80000-0x000000013FFD4000-memory.dmp

Filesize
3.3MB

Download
memory/2892-2624-0x000000013FE00000-0x0000000140154000-memory.dmp

Filesize
3.3MB

Download
memory/2892-97-0x000000013FE00000-0x0000000140154000-memory.dmp

Filesize
3.3MB

Download
memory/2892-4056-0x000000013FE00000-0x0000000140154000-memory.dmp

Filesize
3.3MB

Download
memory/2996-4052-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/2996-1197-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/2996-71-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download