xmrig | a496430f90bfae46d1c8f94265003462835801347697d2e671045e91c5bfcd66

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
Size

2.1MB
MD5

9da7c6de615304bf9250622913e02bc0
SHA1

c57c6b35d41170ddb0246f4bab5642f2495eb257
SHA256

a496430f90bfae46d1c8f94265003462835801347697d2e671045e91c5bfcd66
SHA512

8dd2022890c0e2caa0e6871c2fbba36c2d51991e0f8caa6711c5ab43f9eeca8b8cbbd6553c4221296779f9113aa9bbc2d57c2568b8234b511d0c60281638682e
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmBg4IVa1x6WbSs6eOx:BemTLkNdfE0pZrg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2980-0-0x000000013F3B0000-0x000000013F704000-memory.dmp	xmrig
behavioral1/files/0x000c00000001227b-3.dat	xmrig
behavioral1/files/0x0037000000016d3d-10.dat	xmrig
behavioral1/memory/1848-13-0x000000013FFB0000-0x0000000140304000-memory.dmp	xmrig
behavioral1/files/0x0008000000016d69-16.dat	xmrig
behavioral1/memory/2548-15-0x000000013FE70000-0x00000001401C4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016dda-21.dat	xmrig
behavioral1/files/0x0007000000016dde-33.dat	xmrig
behavioral1/files/0x0007000000016de7-39.dat	xmrig
behavioral1/files/0x0007000000017477-53.dat	xmrig
behavioral1/files/0x00050000000194ef-168.dat	xmrig
behavioral1/files/0x00050000000194eb-164.dat	xmrig
behavioral1/files/0x00050000000194b8-160.dat	xmrig
behavioral1/files/0x00050000000194a8-156.dat	xmrig
behavioral1/files/0x0005000000019491-152.dat	xmrig
behavioral1/files/0x0005000000019462-148.dat	xmrig
behavioral1/files/0x0005000000019457-144.dat	xmrig
behavioral1/files/0x000500000001943e-140.dat	xmrig
behavioral1/files/0x0005000000019433-136.dat	xmrig
behavioral1/files/0x00050000000193b1-132.dat	xmrig
behavioral1/files/0x00050000000193a5-129.dat	xmrig
behavioral1/files/0x0005000000019381-127.dat	xmrig
behavioral1/memory/2980-117-0x000000013FB30000-0x000000013FE84000-memory.dmp	xmrig
behavioral1/files/0x000500000001933a-116.dat	xmrig
behavioral1/files/0x0005000000019277-108.dat	xmrig
behavioral1/files/0x0005000000019283-104.dat	xmrig
behavioral1/files/0x0005000000019260-99.dat	xmrig
behavioral1/memory/2980-98-0x00000000020A0000-0x00000000023F4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019275-95.dat	xmrig
behavioral1/memory/2732-91-0x000000013F1B0000-0x000000013F504000-memory.dmp	xmrig
behavioral1/files/0x000500000001925d-88.dat	xmrig
behavioral1/files/0x000500000001939f-120.dat	xmrig
behavioral1/memory/2696-82-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/files/0x000500000001923b-80.dat	xmrig
behavioral1/memory/2632-102-0x000000013F180000-0x000000013F4D4000-memory.dmp	xmrig
behavioral1/memory/2656-87-0x000000013F5B0000-0x000000013F904000-memory.dmp	xmrig
behavioral1/files/0x0036000000016d45-85.dat	xmrig
behavioral1/memory/376-76-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/1848-74-0x000000013FFB0000-0x0000000140304000-memory.dmp	xmrig
behavioral1/files/0x0005000000019228-72.dat	xmrig
behavioral1/memory/1484-69-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/files/0x0006000000018bf0-67.dat	xmrig
behavioral1/memory/2468-64-0x000000013FFA0000-0x00000001402F4000-memory.dmp	xmrig
behavioral1/memory/2980-63-0x000000013F3B0000-0x000000013F704000-memory.dmp	xmrig
behavioral1/files/0x000500000001878d-62.dat	xmrig
behavioral1/memory/2568-58-0x000000013FF90000-0x00000001402E4000-memory.dmp	xmrig
behavioral1/memory/2820-50-0x000000013F2F0000-0x000000013F644000-memory.dmp	xmrig
behavioral1/memory/2616-43-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/files/0x0009000000017042-47.dat	xmrig
behavioral1/memory/2716-36-0x000000013F3E0000-0x000000013F734000-memory.dmp	xmrig
behavioral1/memory/2732-28-0x000000013F1B0000-0x000000013F504000-memory.dmp	xmrig
behavioral1/memory/2656-25-0x000000013F5B0000-0x000000013F904000-memory.dmp	xmrig
behavioral1/memory/2468-4006-0x000000013FFA0000-0x00000001402F4000-memory.dmp	xmrig
behavioral1/memory/1848-4007-0x000000013FFB0000-0x0000000140304000-memory.dmp	xmrig
behavioral1/memory/2548-4008-0x000000013FE70000-0x00000001401C4000-memory.dmp	xmrig
behavioral1/memory/2656-4009-0x000000013F5B0000-0x000000013F904000-memory.dmp	xmrig
behavioral1/memory/2716-4011-0x000000013F3E0000-0x000000013F734000-memory.dmp	xmrig
behavioral1/memory/2732-4010-0x000000013F1B0000-0x000000013F504000-memory.dmp	xmrig
behavioral1/memory/2616-4012-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/memory/2820-4013-0x000000013F2F0000-0x000000013F644000-memory.dmp	xmrig
behavioral1/memory/2568-4014-0x000000013FF90000-0x00000001402E4000-memory.dmp	xmrig
behavioral1/memory/1484-4015-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/376-4018-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/2632-4017-0x000000013F180000-0x000000013F4D4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1848	braahRH.exe
2548	xjekXxH.exe
2656	ksMaFbZ.exe
2732	UJsyjDJ.exe
2716	PckjvhP.exe
2616	rBurHrP.exe
2820	WcfANEn.exe
2568	WUTMsja.exe
2468	LGjtOvV.exe
1484	rCBDsNB.exe
376	zTwaSQL.exe
2696	HYKCVvD.exe
2632	ccKzEPz.exe
1212	rgNKdYY.exe
1560	fTDburT.exe
1492	xpcCTAE.exe
844	jYSxdJW.exe
2796	NQOrcZD.exe
1216	LfouQZi.exe
276	bzvZhYl.exe
2160	yKgLkeU.exe
692	gySPAkQ.exe
668	PDRGFhe.exe
1860	aYMBkdQ.exe
1172	FFBWebQ.exe
2004	vDWGzkU.exe
1736	eysYuwT.exe
2060	lbAHEgF.exe
816	StnmhJM.exe
1884	qhOFdXz.exe
540	bVOXdkS.exe
2196	BBsyWgG.exe
1552	TZVfDpv.exe
1052	MLGsByX.exe
856	tWdapch.exe
2692	wEwwwED.exe
1076	yHztafL.exe
1152	hpaVEzt.exe
2328	kixHVLs.exe
2316	DLYcTEM.exe
1084	DenPOiB.exe
2412	rDlTrsq.exe
2396	bYUWwaa.exe
2872	xQuxZIP.exe
984	wWBJkOd.exe
1460	noDDGbY.exe
1444	UjijgKv.exe
956	oGIHmbg.exe
764	pdPuMih.exe
820	pplMrJp.exe
1704	bXcRQbX.exe
1620	ZeeBGqZ.exe
1004	OTRzrRJ.exe
1940	QeWPCFA.exe
2320	TooVWkB.exe
1576	nRHsKel.exe
2428	anUOVIo.exe
1852	TnmGpwe.exe
2888	VuEHSfj.exe
1608	jLrIDvm.exe
1740	ntQwhQx.exe
1840	aLrWZqa.exe
1908	qDfflUu.exe
900	evqcLRL.exe

Loads dropped DLL 64 IoCs

pid	Process
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-0-0x000000013F3B0000-0x000000013F704000-memory.dmp	upx
behavioral1/files/0x000c00000001227b-3.dat	upx
behavioral1/files/0x0037000000016d3d-10.dat	upx
behavioral1/memory/1848-13-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx
behavioral1/files/0x0008000000016d69-16.dat	upx
behavioral1/memory/2548-15-0x000000013FE70000-0x00000001401C4000-memory.dmp	upx
behavioral1/files/0x0007000000016dda-21.dat	upx
behavioral1/files/0x0007000000016dde-33.dat	upx
behavioral1/files/0x0007000000016de7-39.dat	upx
behavioral1/files/0x0007000000017477-53.dat	upx
behavioral1/files/0x00050000000194ef-168.dat	upx
behavioral1/files/0x00050000000194eb-164.dat	upx
behavioral1/files/0x00050000000194b8-160.dat	upx
behavioral1/files/0x00050000000194a8-156.dat	upx
behavioral1/files/0x0005000000019491-152.dat	upx
behavioral1/files/0x0005000000019462-148.dat	upx
behavioral1/files/0x0005000000019457-144.dat	upx
behavioral1/files/0x000500000001943e-140.dat	upx
behavioral1/files/0x0005000000019433-136.dat	upx
behavioral1/files/0x00050000000193b1-132.dat	upx
behavioral1/files/0x00050000000193a5-129.dat	upx
behavioral1/files/0x0005000000019381-127.dat	upx
behavioral1/files/0x000500000001933a-116.dat	upx
behavioral1/files/0x0005000000019277-108.dat	upx
behavioral1/files/0x0005000000019283-104.dat	upx
behavioral1/files/0x0005000000019260-99.dat	upx
behavioral1/files/0x0005000000019275-95.dat	upx
behavioral1/memory/2732-91-0x000000013F1B0000-0x000000013F504000-memory.dmp	upx
behavioral1/files/0x000500000001925d-88.dat	upx
behavioral1/files/0x000500000001939f-120.dat	upx
behavioral1/memory/2696-82-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/files/0x000500000001923b-80.dat	upx
behavioral1/memory/2632-102-0x000000013F180000-0x000000013F4D4000-memory.dmp	upx
behavioral1/memory/2656-87-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/files/0x0036000000016d45-85.dat	upx
behavioral1/memory/376-76-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/1848-74-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx
behavioral1/files/0x0005000000019228-72.dat	upx
behavioral1/memory/1484-69-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/files/0x0006000000018bf0-67.dat	upx
behavioral1/memory/2468-64-0x000000013FFA0000-0x00000001402F4000-memory.dmp	upx
behavioral1/memory/2980-63-0x000000013F3B0000-0x000000013F704000-memory.dmp	upx
behavioral1/files/0x000500000001878d-62.dat	upx
behavioral1/memory/2568-58-0x000000013FF90000-0x00000001402E4000-memory.dmp	upx
behavioral1/memory/2820-50-0x000000013F2F0000-0x000000013F644000-memory.dmp	upx
behavioral1/memory/2616-43-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/files/0x0009000000017042-47.dat	upx
behavioral1/memory/2716-36-0x000000013F3E0000-0x000000013F734000-memory.dmp	upx
behavioral1/memory/2732-28-0x000000013F1B0000-0x000000013F504000-memory.dmp	upx
behavioral1/memory/2656-25-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/memory/2468-4006-0x000000013FFA0000-0x00000001402F4000-memory.dmp	upx
behavioral1/memory/1848-4007-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx
behavioral1/memory/2548-4008-0x000000013FE70000-0x00000001401C4000-memory.dmp	upx
behavioral1/memory/2656-4009-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/memory/2716-4011-0x000000013F3E0000-0x000000013F734000-memory.dmp	upx
behavioral1/memory/2732-4010-0x000000013F1B0000-0x000000013F504000-memory.dmp	upx
behavioral1/memory/2616-4012-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/memory/2820-4013-0x000000013F2F0000-0x000000013F644000-memory.dmp	upx
behavioral1/memory/2568-4014-0x000000013FF90000-0x00000001402E4000-memory.dmp	upx
behavioral1/memory/1484-4015-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/376-4018-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/2632-4017-0x000000013F180000-0x000000013F4D4000-memory.dmp	upx
behavioral1/memory/2468-4016-0x000000013FFA0000-0x00000001402F4000-memory.dmp	upx
behavioral1/memory/1484-4019-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MmpWlhC.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\mRpbcbP.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\glQxLtS.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\vYltMcu.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\TkZmkPU.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\RdYIPdz.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\dHrBcsj.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\wKUAwfs.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\CEgttjZ.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\NLeZeaz.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\YtbfNDl.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\OjRFwbP.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\cOaDNru.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\PUDnvQw.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\PlNSJVk.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\DBBQrMa.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\BtNQGog.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\MLGsByX.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\gbGlKkP.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\frKoamQ.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\mNQhaBr.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\eMCHdBo.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\bfiMvLS.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\WPzQfWk.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\YUStfZG.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\cHxtAzQ.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\gEglJSo.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\zpWUGTO.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\jxPyeXZ.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\PCWbGDM.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\udsiUDF.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\bdcFBlT.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\EyqpVQE.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\PiEOZKM.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\fQiKFnr.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\tTeskDV.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\cubnPty.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\SXZbwGz.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\BBjLUrF.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\OsVNbzG.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\vfDEtyv.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\jhqTSkt.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\jzolYjH.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\Lcotwgt.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\aWccvUT.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\yCpbDgc.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\bEKNhdV.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\pOZDJdL.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\NFKXLvp.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\OTRzrRJ.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\TnmGpwe.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\UBygXko.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\HYXPhzZ.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\AOlONQo.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\braahRH.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\vDWGzkU.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\smxGrLm.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\dsxMLCN.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\oyvRgIw.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\flmonFH.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\wMWjbyq.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\opNINkk.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\ccKzEPz.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
File created	C:\Windows\System\AbivQUC.exe	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1848	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 1848	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 1848	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 2548	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	30
PID 2980 wrote to memory of 2548	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	30
PID 2980 wrote to memory of 2548	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	30
PID 2980 wrote to memory of 2656	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	31
PID 2980 wrote to memory of 2656	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	31
PID 2980 wrote to memory of 2656	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	31
PID 2980 wrote to memory of 2732	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	32
PID 2980 wrote to memory of 2732	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	32
PID 2980 wrote to memory of 2732	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	32
PID 2980 wrote to memory of 2716	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	33
PID 2980 wrote to memory of 2716	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	33
PID 2980 wrote to memory of 2716	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	33
PID 2980 wrote to memory of 2616	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	34
PID 2980 wrote to memory of 2616	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	34
PID 2980 wrote to memory of 2616	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	34
PID 2980 wrote to memory of 2820	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	35
PID 2980 wrote to memory of 2820	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	35
PID 2980 wrote to memory of 2820	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	35
PID 2980 wrote to memory of 2568	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	36
PID 2980 wrote to memory of 2568	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	36
PID 2980 wrote to memory of 2568	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	36
PID 2980 wrote to memory of 2468	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	37
PID 2980 wrote to memory of 2468	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	37
PID 2980 wrote to memory of 2468	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	37
PID 2980 wrote to memory of 1484	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	38
PID 2980 wrote to memory of 1484	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	38
PID 2980 wrote to memory of 1484	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	38
PID 2980 wrote to memory of 376	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	39
PID 2980 wrote to memory of 376	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	39
PID 2980 wrote to memory of 376	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	39
PID 2980 wrote to memory of 2696	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	40
PID 2980 wrote to memory of 2696	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	40
PID 2980 wrote to memory of 2696	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	40
PID 2980 wrote to memory of 2632	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	41
PID 2980 wrote to memory of 2632	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	41
PID 2980 wrote to memory of 2632	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	41
PID 2980 wrote to memory of 2796	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	42
PID 2980 wrote to memory of 2796	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	42
PID 2980 wrote to memory of 2796	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	42
PID 2980 wrote to memory of 1212	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	43
PID 2980 wrote to memory of 1212	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	43
PID 2980 wrote to memory of 1212	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	43
PID 2980 wrote to memory of 1216	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	44
PID 2980 wrote to memory of 1216	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	44
PID 2980 wrote to memory of 1216	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	44
PID 2980 wrote to memory of 1560	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	45
PID 2980 wrote to memory of 1560	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	45
PID 2980 wrote to memory of 1560	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	45
PID 2980 wrote to memory of 276	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	46
PID 2980 wrote to memory of 276	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	46
PID 2980 wrote to memory of 276	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	46
PID 2980 wrote to memory of 1492	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	47
PID 2980 wrote to memory of 1492	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	47
PID 2980 wrote to memory of 1492	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	47
PID 2980 wrote to memory of 2160	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	48
PID 2980 wrote to memory of 2160	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	48
PID 2980 wrote to memory of 2160	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	48
PID 2980 wrote to memory of 844	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	49
PID 2980 wrote to memory of 844	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	49
PID 2980 wrote to memory of 844	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	49
PID 2980 wrote to memory of 692	2980	9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9da7c6de615304bf9250622913e02bc0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System\braahRH.exe
  C:\Windows\System\braahRH.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\xjekXxH.exe
  C:\Windows\System\xjekXxH.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ksMaFbZ.exe
  C:\Windows\System\ksMaFbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\UJsyjDJ.exe
  C:\Windows\System\UJsyjDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\PckjvhP.exe
  C:\Windows\System\PckjvhP.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\rBurHrP.exe
  C:\Windows\System\rBurHrP.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\WcfANEn.exe
  C:\Windows\System\WcfANEn.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\WUTMsja.exe
  C:\Windows\System\WUTMsja.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\LGjtOvV.exe
  C:\Windows\System\LGjtOvV.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\rCBDsNB.exe
  C:\Windows\System\rCBDsNB.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\zTwaSQL.exe
  C:\Windows\System\zTwaSQL.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\HYKCVvD.exe
  C:\Windows\System\HYKCVvD.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ccKzEPz.exe
  C:\Windows\System\ccKzEPz.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\NQOrcZD.exe
  C:\Windows\System\NQOrcZD.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\rgNKdYY.exe
  C:\Windows\System\rgNKdYY.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\LfouQZi.exe
  C:\Windows\System\LfouQZi.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\fTDburT.exe
  C:\Windows\System\fTDburT.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\bzvZhYl.exe
  C:\Windows\System\bzvZhYl.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\xpcCTAE.exe
  C:\Windows\System\xpcCTAE.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\yKgLkeU.exe
  C:\Windows\System\yKgLkeU.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\jYSxdJW.exe
  C:\Windows\System\jYSxdJW.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\gySPAkQ.exe
  C:\Windows\System\gySPAkQ.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\PDRGFhe.exe
  C:\Windows\System\PDRGFhe.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\aYMBkdQ.exe
  C:\Windows\System\aYMBkdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\FFBWebQ.exe
  C:\Windows\System\FFBWebQ.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\vDWGzkU.exe
  C:\Windows\System\vDWGzkU.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\eysYuwT.exe
  C:\Windows\System\eysYuwT.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\lbAHEgF.exe
  C:\Windows\System\lbAHEgF.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\StnmhJM.exe
  C:\Windows\System\StnmhJM.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\qhOFdXz.exe
  C:\Windows\System\qhOFdXz.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\bVOXdkS.exe
  C:\Windows\System\bVOXdkS.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\BBsyWgG.exe
  C:\Windows\System\BBsyWgG.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\TZVfDpv.exe
  C:\Windows\System\TZVfDpv.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\MLGsByX.exe
  C:\Windows\System\MLGsByX.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\tWdapch.exe
  C:\Windows\System\tWdapch.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\wEwwwED.exe
  C:\Windows\System\wEwwwED.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\yHztafL.exe
  C:\Windows\System\yHztafL.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\hpaVEzt.exe
  C:\Windows\System\hpaVEzt.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\kixHVLs.exe
  C:\Windows\System\kixHVLs.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\DLYcTEM.exe
  C:\Windows\System\DLYcTEM.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\DenPOiB.exe
  C:\Windows\System\DenPOiB.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\rDlTrsq.exe
  C:\Windows\System\rDlTrsq.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\bYUWwaa.exe
  C:\Windows\System\bYUWwaa.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\xQuxZIP.exe
  C:\Windows\System\xQuxZIP.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\wWBJkOd.exe
  C:\Windows\System\wWBJkOd.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\noDDGbY.exe
  C:\Windows\System\noDDGbY.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\UjijgKv.exe
  C:\Windows\System\UjijgKv.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\oGIHmbg.exe
  C:\Windows\System\oGIHmbg.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\pdPuMih.exe
  C:\Windows\System\pdPuMih.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\pplMrJp.exe
  C:\Windows\System\pplMrJp.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\bXcRQbX.exe
  C:\Windows\System\bXcRQbX.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\ZeeBGqZ.exe
  C:\Windows\System\ZeeBGqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\OTRzrRJ.exe
  C:\Windows\System\OTRzrRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\QeWPCFA.exe
  C:\Windows\System\QeWPCFA.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\TooVWkB.exe
  C:\Windows\System\TooVWkB.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\nRHsKel.exe
  C:\Windows\System\nRHsKel.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\anUOVIo.exe
  C:\Windows\System\anUOVIo.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\TnmGpwe.exe
  C:\Windows\System\TnmGpwe.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\VuEHSfj.exe
  C:\Windows\System\VuEHSfj.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\jLrIDvm.exe
  C:\Windows\System\jLrIDvm.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\ntQwhQx.exe
  C:\Windows\System\ntQwhQx.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\aLrWZqa.exe
  C:\Windows\System\aLrWZqa.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\qDfflUu.exe
  C:\Windows\System\qDfflUu.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\evqcLRL.exe
  C:\Windows\System\evqcLRL.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\voalHHf.exe
  C:\Windows\System\voalHHf.exe
  2⤵
  PID:1996
- C:\Windows\System\YwHPIlb.exe
  C:\Windows\System\YwHPIlb.exe
  2⤵
  PID:2856
- C:\Windows\System\MpXEePX.exe
  C:\Windows\System\MpXEePX.exe
  2⤵
  PID:2896
- C:\Windows\System\pEiQzWh.exe
  C:\Windows\System\pEiQzWh.exe
  2⤵
  PID:1476
- C:\Windows\System\zJlAZVh.exe
  C:\Windows\System\zJlAZVh.exe
  2⤵
  PID:1504
- C:\Windows\System\XuXskDH.exe
  C:\Windows\System\XuXskDH.exe
  2⤵
  PID:2848
- C:\Windows\System\hwDCmpw.exe
  C:\Windows\System\hwDCmpw.exe
  2⤵
  PID:3020
- C:\Windows\System\IxPNcpv.exe
  C:\Windows\System\IxPNcpv.exe
  2⤵
  PID:2688
- C:\Windows\System\hJGTdeO.exe
  C:\Windows\System\hJGTdeO.exe
  2⤵
  PID:2672
- C:\Windows\System\TOCHlrT.exe
  C:\Windows\System\TOCHlrT.exe
  2⤵
  PID:2492
- C:\Windows\System\cubnPty.exe
  C:\Windows\System\cubnPty.exe
  2⤵
  PID:2484
- C:\Windows\System\tPvYPgf.exe
  C:\Windows\System\tPvYPgf.exe
  2⤵
  PID:3036
- C:\Windows\System\bONqRSG.exe
  C:\Windows\System\bONqRSG.exe
  2⤵
  PID:2380
- C:\Windows\System\exuNVTH.exe
  C:\Windows\System\exuNVTH.exe
  2⤵
  PID:1832
- C:\Windows\System\LAnDMPs.exe
  C:\Windows\System\LAnDMPs.exe
  2⤵
  PID:1664
- C:\Windows\System\MrClaEP.exe
  C:\Windows\System\MrClaEP.exe
  2⤵
  PID:2768
- C:\Windows\System\cyutPod.exe
  C:\Windows\System\cyutPod.exe
  2⤵
  PID:532
- C:\Windows\System\piyfwOx.exe
  C:\Windows\System\piyfwOx.exe
  2⤵
  PID:328
- C:\Windows\System\WPzQfWk.exe
  C:\Windows\System\WPzQfWk.exe
  2⤵
  PID:1748
- C:\Windows\System\qcAuhSY.exe
  C:\Windows\System\qcAuhSY.exe
  2⤵
  PID:2112
- C:\Windows\System\kzDtIsv.exe
  C:\Windows\System\kzDtIsv.exe
  2⤵
  PID:2024
- C:\Windows\System\qkTGwyi.exe
  C:\Windows\System\qkTGwyi.exe
  2⤵
  PID:2932
- C:\Windows\System\EmlvGpe.exe
  C:\Windows\System\EmlvGpe.exe
  2⤵
  PID:1404
- C:\Windows\System\GjGiNdy.exe
  C:\Windows\System\GjGiNdy.exe
  2⤵
  PID:2208
- C:\Windows\System\VjsTihb.exe
  C:\Windows\System\VjsTihb.exe
  2⤵
  PID:1112
- C:\Windows\System\AXefjuD.exe
  C:\Windows\System\AXefjuD.exe
  2⤵
  PID:1716
- C:\Windows\System\LsOCBgX.exe
  C:\Windows\System\LsOCBgX.exe
  2⤵
  PID:1412
- C:\Windows\System\ZUNpCIQ.exe
  C:\Windows\System\ZUNpCIQ.exe
  2⤵
  PID:2288
- C:\Windows\System\ABwikrr.exe
  C:\Windows\System\ABwikrr.exe
  2⤵
  PID:1532
- C:\Windows\System\JFCfTkN.exe
  C:\Windows\System\JFCfTkN.exe
  2⤵
  PID:3004
- C:\Windows\System\QKagMlH.exe
  C:\Windows\System\QKagMlH.exe
  2⤵
  PID:3076
- C:\Windows\System\MuDYMmm.exe
  C:\Windows\System\MuDYMmm.exe
  2⤵
  PID:3120
- C:\Windows\System\HspCiqs.exe
  C:\Windows\System\HspCiqs.exe
  2⤵
  PID:3148
- C:\Windows\System\TiATLVx.exe
  C:\Windows\System\TiATLVx.exe
  2⤵
  PID:3164
- C:\Windows\System\GehUzkR.exe
  C:\Windows\System\GehUzkR.exe
  2⤵
  PID:3180
- C:\Windows\System\VMOmBuk.exe
  C:\Windows\System\VMOmBuk.exe
  2⤵
  PID:3196
- C:\Windows\System\YUStfZG.exe
  C:\Windows\System\YUStfZG.exe
  2⤵
  PID:3212
- C:\Windows\System\dPjGxhq.exe
  C:\Windows\System\dPjGxhq.exe
  2⤵
  PID:3240
- C:\Windows\System\hpzekco.exe
  C:\Windows\System\hpzekco.exe
  2⤵
  PID:3264
- C:\Windows\System\BLJSgCf.exe
  C:\Windows\System\BLJSgCf.exe
  2⤵
  PID:3436
- C:\Windows\System\XJQSYNJ.exe
  C:\Windows\System\XJQSYNJ.exe
  2⤵
  PID:3488
- C:\Windows\System\iEpHIgw.exe
  C:\Windows\System\iEpHIgw.exe
  2⤵
  PID:3508
- C:\Windows\System\ScWOFsl.exe
  C:\Windows\System\ScWOFsl.exe
  2⤵
  PID:3528
- C:\Windows\System\xZBIxFD.exe
  C:\Windows\System\xZBIxFD.exe
  2⤵
  PID:3548
- C:\Windows\System\YqWqnBK.exe
  C:\Windows\System\YqWqnBK.exe
  2⤵
  PID:3568
- C:\Windows\System\qQIPuSP.exe
  C:\Windows\System\qQIPuSP.exe
  2⤵
  PID:3588
- C:\Windows\System\LDTsdjn.exe
  C:\Windows\System\LDTsdjn.exe
  2⤵
  PID:3608
- C:\Windows\System\rPlFswZ.exe
  C:\Windows\System\rPlFswZ.exe
  2⤵
  PID:3628
- C:\Windows\System\pOGkfZv.exe
  C:\Windows\System\pOGkfZv.exe
  2⤵
  PID:3648
- C:\Windows\System\cOhfrnn.exe
  C:\Windows\System\cOhfrnn.exe
  2⤵
  PID:3668
- C:\Windows\System\tTgcJod.exe
  C:\Windows\System\tTgcJod.exe
  2⤵
  PID:3688
- C:\Windows\System\IqxgdQG.exe
  C:\Windows\System\IqxgdQG.exe
  2⤵
  PID:3708
- C:\Windows\System\RBGBKFy.exe
  C:\Windows\System\RBGBKFy.exe
  2⤵
  PID:3728
- C:\Windows\System\tuPuWtj.exe
  C:\Windows\System\tuPuWtj.exe
  2⤵
  PID:3748
- C:\Windows\System\GKiYpNw.exe
  C:\Windows\System\GKiYpNw.exe
  2⤵
  PID:3768
- C:\Windows\System\kveGdWd.exe
  C:\Windows\System\kveGdWd.exe
  2⤵
  PID:3788
- C:\Windows\System\UQBtkCm.exe
  C:\Windows\System\UQBtkCm.exe
  2⤵
  PID:3804
- C:\Windows\System\OTdSFnh.exe
  C:\Windows\System\OTdSFnh.exe
  2⤵
  PID:3824
- C:\Windows\System\xVFgNJn.exe
  C:\Windows\System\xVFgNJn.exe
  2⤵
  PID:3844
- C:\Windows\System\EvickoL.exe
  C:\Windows\System\EvickoL.exe
  2⤵
  PID:3864
- C:\Windows\System\xHiQdNy.exe
  C:\Windows\System\xHiQdNy.exe
  2⤵
  PID:3888
- C:\Windows\System\fXRdNYg.exe
  C:\Windows\System\fXRdNYg.exe
  2⤵
  PID:3908
- C:\Windows\System\CCkTxvs.exe
  C:\Windows\System\CCkTxvs.exe
  2⤵
  PID:3924
- C:\Windows\System\rlrByPD.exe
  C:\Windows\System\rlrByPD.exe
  2⤵
  PID:3952
- C:\Windows\System\TdyATLS.exe
  C:\Windows\System\TdyATLS.exe
  2⤵
  PID:3972
- C:\Windows\System\kdSfHHv.exe
  C:\Windows\System\kdSfHHv.exe
  2⤵
  PID:3988
- C:\Windows\System\tswrNrB.exe
  C:\Windows\System\tswrNrB.exe
  2⤵
  PID:4012
- C:\Windows\System\ROsGtjM.exe
  C:\Windows\System\ROsGtjM.exe
  2⤵
  PID:4028
- C:\Windows\System\jfXPaVE.exe
  C:\Windows\System\jfXPaVE.exe
  2⤵
  PID:4052
- C:\Windows\System\jFVxpMa.exe
  C:\Windows\System\jFVxpMa.exe
  2⤵
  PID:4072
- C:\Windows\System\EqYDPTn.exe
  C:\Windows\System\EqYDPTn.exe
  2⤵
  PID:4088
- C:\Windows\System\uvZcnCg.exe
  C:\Windows\System\uvZcnCg.exe
  2⤵
  PID:1432
- C:\Windows\System\jOuIfZN.exe
  C:\Windows\System\jOuIfZN.exe
  2⤵
  PID:2852
- C:\Windows\System\YMyqJjJ.exe
  C:\Windows\System\YMyqJjJ.exe
  2⤵
  PID:2860
- C:\Windows\System\WWlWPwq.exe
  C:\Windows\System\WWlWPwq.exe
  2⤵
  PID:2444
- C:\Windows\System\Hzkedql.exe
  C:\Windows\System\Hzkedql.exe
  2⤵
  PID:1516
- C:\Windows\System\vwHkRQR.exe
  C:\Windows\System\vwHkRQR.exe
  2⤵
  PID:2228
- C:\Windows\System\DdGXzuZ.exe
  C:\Windows\System\DdGXzuZ.exe
  2⤵
  PID:2132
- C:\Windows\System\VOQJZiZ.exe
  C:\Windows\System\VOQJZiZ.exe
  2⤵
  PID:3024
- C:\Windows\System\VVGNXGc.exe
  C:\Windows\System\VVGNXGc.exe
  2⤵
  PID:2620
- C:\Windows\System\koBDGuQ.exe
  C:\Windows\System\koBDGuQ.exe
  2⤵
  PID:2452
- C:\Windows\System\Ytzedva.exe
  C:\Windows\System\Ytzedva.exe
  2⤵
  PID:2152
- C:\Windows\System\hicVPaQ.exe
  C:\Windows\System\hicVPaQ.exe
  2⤵
  PID:644
- C:\Windows\System\RObxwOm.exe
  C:\Windows\System\RObxwOm.exe
  2⤵
  PID:2884
- C:\Windows\System\mSqJiJR.exe
  C:\Windows\System\mSqJiJR.exe
  2⤵
  PID:1448
- C:\Windows\System\GRfixQm.exe
  C:\Windows\System\GRfixQm.exe
  2⤵
  PID:936
- C:\Windows\System\UHqoICT.exe
  C:\Windows\System\UHqoICT.exe
  2⤵
  PID:1656
- C:\Windows\System\ULWMelb.exe
  C:\Windows\System\ULWMelb.exe
  2⤵
  PID:2280
- C:\Windows\System\pAbgcAM.exe
  C:\Windows\System\pAbgcAM.exe
  2⤵
  PID:1836
- C:\Windows\System\mcomSeS.exe
  C:\Windows\System\mcomSeS.exe
  2⤵
  PID:3100
- C:\Windows\System\OjRFwbP.exe
  C:\Windows\System\OjRFwbP.exe
  2⤵
  PID:3116
- C:\Windows\System\MfSOxdI.exe
  C:\Windows\System\MfSOxdI.exe
  2⤵
  PID:1668
- C:\Windows\System\nRDaqzK.exe
  C:\Windows\System\nRDaqzK.exe
  2⤵
  PID:3128
- C:\Windows\System\swOlBbN.exe
  C:\Windows\System\swOlBbN.exe
  2⤵
  PID:3188
- C:\Windows\System\rOPEkbe.exe
  C:\Windows\System\rOPEkbe.exe
  2⤵
  PID:3220
- C:\Windows\System\vMbLqhd.exe
  C:\Windows\System\vMbLqhd.exe
  2⤵
  PID:3236
- C:\Windows\System\CWBpicY.exe
  C:\Windows\System\CWBpicY.exe
  2⤵
  PID:3292
- C:\Windows\System\wKUAwfs.exe
  C:\Windows\System\wKUAwfs.exe
  2⤵
  PID:3308
- C:\Windows\System\czPAQfd.exe
  C:\Windows\System\czPAQfd.exe
  2⤵
  PID:3328
- C:\Windows\System\MTtkrVk.exe
  C:\Windows\System\MTtkrVk.exe
  2⤵
  PID:3344
- C:\Windows\System\HuMiEBI.exe
  C:\Windows\System\HuMiEBI.exe
  2⤵
  PID:3376
- C:\Windows\System\sURyETS.exe
  C:\Windows\System\sURyETS.exe
  2⤵
  PID:3392
- C:\Windows\System\ZHGhseG.exe
  C:\Windows\System\ZHGhseG.exe
  2⤵
  PID:3412
- C:\Windows\System\MPIihCH.exe
  C:\Windows\System\MPIihCH.exe
  2⤵
  PID:3432
- C:\Windows\System\uuydggS.exe
  C:\Windows\System\uuydggS.exe
  2⤵
  PID:3260
- C:\Windows\System\eekwsVP.exe
  C:\Windows\System\eekwsVP.exe
  2⤵
  PID:3460
- C:\Windows\System\DMPfkoQ.exe
  C:\Windows\System\DMPfkoQ.exe
  2⤵
  PID:3480
- C:\Windows\System\whAAqHw.exe
  C:\Windows\System\whAAqHw.exe
  2⤵
  PID:3500
- C:\Windows\System\grZcpSL.exe
  C:\Windows\System\grZcpSL.exe
  2⤵
  PID:3544
- C:\Windows\System\wrqufpY.exe
  C:\Windows\System\wrqufpY.exe
  2⤵
  PID:3560
- C:\Windows\System\RfppapG.exe
  C:\Windows\System\RfppapG.exe
  2⤵
  PID:3616
- C:\Windows\System\vYltMcu.exe
  C:\Windows\System\vYltMcu.exe
  2⤵
  PID:3644
- C:\Windows\System\BZNFetk.exe
  C:\Windows\System\BZNFetk.exe
  2⤵
  PID:3660
- C:\Windows\System\cYnTGXJ.exe
  C:\Windows\System\cYnTGXJ.exe
  2⤵
  PID:3704
- C:\Windows\System\RwGVeMj.exe
  C:\Windows\System\RwGVeMj.exe
  2⤵
  PID:3736
- C:\Windows\System\TkZmkPU.exe
  C:\Windows\System\TkZmkPU.exe
  2⤵
  PID:3776
- C:\Windows\System\KxEpXvg.exe
  C:\Windows\System\KxEpXvg.exe
  2⤵
  PID:3820
- C:\Windows\System\MIsOIuI.exe
  C:\Windows\System\MIsOIuI.exe
  2⤵
  PID:3764
- C:\Windows\System\ImRruSg.exe
  C:\Windows\System\ImRruSg.exe
  2⤵
  PID:3836
- C:\Windows\System\fFOtwpp.exe
  C:\Windows\System\fFOtwpp.exe
  2⤵
  PID:3872
- C:\Windows\System\hvOsgJO.exe
  C:\Windows\System\hvOsgJO.exe
  2⤵
  PID:3944
- C:\Windows\System\eojPDxc.exe
  C:\Windows\System\eojPDxc.exe
  2⤵
  PID:3984
- C:\Windows\System\iMoqEFM.exe
  C:\Windows\System\iMoqEFM.exe
  2⤵
  PID:3964
- C:\Windows\System\pOZDJdL.exe
  C:\Windows\System\pOZDJdL.exe
  2⤵
  PID:4060
- C:\Windows\System\NmyJplz.exe
  C:\Windows\System\NmyJplz.exe
  2⤵
  PID:4064
- C:\Windows\System\jcXVmyn.exe
  C:\Windows\System\jcXVmyn.exe
  2⤵
  PID:4084
- C:\Windows\System\BDoPaYM.exe
  C:\Windows\System\BDoPaYM.exe
  2⤵
  PID:1644
- C:\Windows\System\lYrHnYC.exe
  C:\Windows\System\lYrHnYC.exe
  2⤵
  PID:2628
- C:\Windows\System\lHmPQTm.exe
  C:\Windows\System\lHmPQTm.exe
  2⤵
  PID:1616
- C:\Windows\System\ZvHAuAj.exe
  C:\Windows\System\ZvHAuAj.exe
  2⤵
  PID:2460
- C:\Windows\System\wLjHAtL.exe
  C:\Windows\System\wLjHAtL.exe
  2⤵
  PID:1508
- C:\Windows\System\cqTDAcA.exe
  C:\Windows\System\cqTDAcA.exe
  2⤵
  PID:3028
- C:\Windows\System\kWojSXz.exe
  C:\Windows\System\kWojSXz.exe
  2⤵
  PID:1928
- C:\Windows\System\dbnJoFa.exe
  C:\Windows\System\dbnJoFa.exe
  2⤵
  PID:864
- C:\Windows\System\RExfWpY.exe
  C:\Windows\System\RExfWpY.exe
  2⤵
  PID:1804
- C:\Windows\System\uhOQxpC.exe
  C:\Windows\System\uhOQxpC.exe
  2⤵
  PID:1660
- C:\Windows\System\PzVxxJB.exe
  C:\Windows\System\PzVxxJB.exe
  2⤵
  PID:3096
- C:\Windows\System\jqISFOU.exe
  C:\Windows\System\jqISFOU.exe
  2⤵
  PID:2072
- C:\Windows\System\NicyRRZ.exe
  C:\Windows\System\NicyRRZ.exe
  2⤵
  PID:2564
- C:\Windows\System\sThHFUm.exe
  C:\Windows\System\sThHFUm.exe
  2⤵
  PID:1888
- C:\Windows\System\sbLnhlY.exe
  C:\Windows\System\sbLnhlY.exe
  2⤵
  PID:3192
- C:\Windows\System\iPOROOd.exe
  C:\Windows\System\iPOROOd.exe
  2⤵
  PID:3280
- C:\Windows\System\zTWNTvZ.exe
  C:\Windows\System\zTWNTvZ.exe
  2⤵
  PID:3348
- C:\Windows\System\AqYwrPc.exe
  C:\Windows\System\AqYwrPc.exe
  2⤵
  PID:3360
- C:\Windows\System\kkokawS.exe
  C:\Windows\System\kkokawS.exe
  2⤵
  PID:3404
- C:\Windows\System\QadLKja.exe
  C:\Windows\System\QadLKja.exe
  2⤵
  PID:3452
- C:\Windows\System\llGbRJg.exe
  C:\Windows\System\llGbRJg.exe
  2⤵
  PID:3448
- C:\Windows\System\amjUgIa.exe
  C:\Windows\System\amjUgIa.exe
  2⤵
  PID:3504
- C:\Windows\System\GqHgTgr.exe
  C:\Windows\System\GqHgTgr.exe
  2⤵
  PID:3520
- C:\Windows\System\BBkZbXY.exe
  C:\Windows\System\BBkZbXY.exe
  2⤵
  PID:3620
- C:\Windows\System\YXjdrMX.exe
  C:\Windows\System\YXjdrMX.exe
  2⤵
  PID:3604
- C:\Windows\System\fgcwKLd.exe
  C:\Windows\System\fgcwKLd.exe
  2⤵
  PID:3716
- C:\Windows\System\jbGNGXk.exe
  C:\Windows\System\jbGNGXk.exe
  2⤵
  PID:3856
- C:\Windows\System\QxNywYB.exe
  C:\Windows\System\QxNywYB.exe
  2⤵
  PID:3812
- C:\Windows\System\tXPiRBU.exe
  C:\Windows\System\tXPiRBU.exe
  2⤵
  PID:3800
- C:\Windows\System\bmcwpXb.exe
  C:\Windows\System\bmcwpXb.exe
  2⤵
  PID:3880
- C:\Windows\System\cyYlXuh.exe
  C:\Windows\System\cyYlXuh.exe
  2⤵
  PID:4004
- C:\Windows\System\NFqCkqk.exe
  C:\Windows\System\NFqCkqk.exe
  2⤵
  PID:4000
- C:\Windows\System\yVkIdRD.exe
  C:\Windows\System\yVkIdRD.exe
  2⤵
  PID:4048
- C:\Windows\System\cLqQfMt.exe
  C:\Windows\System\cLqQfMt.exe
  2⤵
  PID:2900
- C:\Windows\System\AGNTvPR.exe
  C:\Windows\System\AGNTvPR.exe
  2⤵
  PID:2248
- C:\Windows\System\hGbbJjW.exe
  C:\Windows\System\hGbbJjW.exe
  2⤵
  PID:2920
- C:\Windows\System\vsIFRxF.exe
  C:\Windows\System\vsIFRxF.exe
  2⤵
  PID:1776
- C:\Windows\System\npDFSsZ.exe
  C:\Windows\System\npDFSsZ.exe
  2⤵
  PID:880
- C:\Windows\System\vJotkNj.exe
  C:\Windows\System\vJotkNj.exe
  2⤵
  PID:1196
- C:\Windows\System\KbPCDvP.exe
  C:\Windows\System\KbPCDvP.exe
  2⤵
  PID:2404
- C:\Windows\System\IoIDtFu.exe
  C:\Windows\System\IoIDtFu.exe
  2⤵
  PID:3300
- C:\Windows\System\AbivQUC.exe
  C:\Windows\System\AbivQUC.exe
  2⤵
  PID:3232
- C:\Windows\System\VmzPVcy.exe
  C:\Windows\System\VmzPVcy.exe
  2⤵
  PID:3336
- C:\Windows\System\jUdzbeV.exe
  C:\Windows\System\jUdzbeV.exe
  2⤵
  PID:3428
- C:\Windows\System\pINjTzE.exe
  C:\Windows\System\pINjTzE.exe
  2⤵
  PID:3396
- C:\Windows\System\qQILBGb.exe
  C:\Windows\System\qQILBGb.exe
  2⤵
  PID:3476
- C:\Windows\System\qQiEqGg.exe
  C:\Windows\System\qQiEqGg.exe
  2⤵
  PID:4100
- C:\Windows\System\VttmIVT.exe
  C:\Windows\System\VttmIVT.exe
  2⤵
  PID:4116
- C:\Windows\System\bNjGBjn.exe
  C:\Windows\System\bNjGBjn.exe
  2⤵
  PID:4136
- C:\Windows\System\USeyAen.exe
  C:\Windows\System\USeyAen.exe
  2⤵
  PID:4160
- C:\Windows\System\QbgTTeT.exe
  C:\Windows\System\QbgTTeT.exe
  2⤵
  PID:4180
- C:\Windows\System\BnrMsKg.exe
  C:\Windows\System\BnrMsKg.exe
  2⤵
  PID:4200
- C:\Windows\System\ZFOsPuK.exe
  C:\Windows\System\ZFOsPuK.exe
  2⤵
  PID:4216
- C:\Windows\System\cmFhpTt.exe
  C:\Windows\System\cmFhpTt.exe
  2⤵
  PID:4236
- C:\Windows\System\RdgGYoa.exe
  C:\Windows\System\RdgGYoa.exe
  2⤵
  PID:4256
- C:\Windows\System\ndZITEf.exe
  C:\Windows\System\ndZITEf.exe
  2⤵
  PID:4280
- C:\Windows\System\dxsxTQv.exe
  C:\Windows\System\dxsxTQv.exe
  2⤵
  PID:4304
- C:\Windows\System\GItKNqE.exe
  C:\Windows\System\GItKNqE.exe
  2⤵
  PID:4324
- C:\Windows\System\duXzlhx.exe
  C:\Windows\System\duXzlhx.exe
  2⤵
  PID:4340
- C:\Windows\System\ohivVJM.exe
  C:\Windows\System\ohivVJM.exe
  2⤵
  PID:4364
- C:\Windows\System\EsVyZfk.exe
  C:\Windows\System\EsVyZfk.exe
  2⤵
  PID:4384
- C:\Windows\System\JrVWIHB.exe
  C:\Windows\System\JrVWIHB.exe
  2⤵
  PID:4404
- C:\Windows\System\OqZBobA.exe
  C:\Windows\System\OqZBobA.exe
  2⤵
  PID:4424
- C:\Windows\System\aNVgkeF.exe
  C:\Windows\System\aNVgkeF.exe
  2⤵
  PID:4444
- C:\Windows\System\zbdSnwW.exe
  C:\Windows\System\zbdSnwW.exe
  2⤵
  PID:4464
- C:\Windows\System\YnhGoMK.exe
  C:\Windows\System\YnhGoMK.exe
  2⤵
  PID:4480
- C:\Windows\System\rJWdqUE.exe
  C:\Windows\System\rJWdqUE.exe
  2⤵
  PID:4504
- C:\Windows\System\UyfboME.exe
  C:\Windows\System\UyfboME.exe
  2⤵
  PID:4520
- C:\Windows\System\EHZZuma.exe
  C:\Windows\System\EHZZuma.exe
  2⤵
  PID:4544
- C:\Windows\System\Oxupwey.exe
  C:\Windows\System\Oxupwey.exe
  2⤵
  PID:4560
- C:\Windows\System\mhjpJLu.exe
  C:\Windows\System\mhjpJLu.exe
  2⤵
  PID:4584
- C:\Windows\System\nLNZkCd.exe
  C:\Windows\System\nLNZkCd.exe
  2⤵
  PID:4600
- C:\Windows\System\agBkKZT.exe
  C:\Windows\System\agBkKZT.exe
  2⤵
  PID:4624
- C:\Windows\System\jooryzc.exe
  C:\Windows\System\jooryzc.exe
  2⤵
  PID:4644
- C:\Windows\System\bOchcqY.exe
  C:\Windows\System\bOchcqY.exe
  2⤵
  PID:4664
- C:\Windows\System\LEsgjoa.exe
  C:\Windows\System\LEsgjoa.exe
  2⤵
  PID:4684
- C:\Windows\System\KHdMAyx.exe
  C:\Windows\System\KHdMAyx.exe
  2⤵
  PID:4704
- C:\Windows\System\opvYWHk.exe
  C:\Windows\System\opvYWHk.exe
  2⤵
  PID:4720
- C:\Windows\System\HvlYjID.exe
  C:\Windows\System\HvlYjID.exe
  2⤵
  PID:4744
- C:\Windows\System\tZSSyTr.exe
  C:\Windows\System\tZSSyTr.exe
  2⤵
  PID:4760
- C:\Windows\System\omgOfDf.exe
  C:\Windows\System\omgOfDf.exe
  2⤵
  PID:4780
- C:\Windows\System\TVxUzDJ.exe
  C:\Windows\System\TVxUzDJ.exe
  2⤵
  PID:4800
- C:\Windows\System\WfThEzO.exe
  C:\Windows\System\WfThEzO.exe
  2⤵
  PID:4824
- C:\Windows\System\aLiWxFX.exe
  C:\Windows\System\aLiWxFX.exe
  2⤵
  PID:4844
- C:\Windows\System\uBreTuM.exe
  C:\Windows\System\uBreTuM.exe
  2⤵
  PID:4864
- C:\Windows\System\fQjCidA.exe
  C:\Windows\System\fQjCidA.exe
  2⤵
  PID:4880
- C:\Windows\System\DWHQrCt.exe
  C:\Windows\System\DWHQrCt.exe
  2⤵
  PID:4904
- C:\Windows\System\vTJwyHU.exe
  C:\Windows\System\vTJwyHU.exe
  2⤵
  PID:4924
- C:\Windows\System\HuLhbWt.exe
  C:\Windows\System\HuLhbWt.exe
  2⤵
  PID:4940
- C:\Windows\System\jxkaljT.exe
  C:\Windows\System\jxkaljT.exe
  2⤵
  PID:4960
- C:\Windows\System\dAaluyl.exe
  C:\Windows\System\dAaluyl.exe
  2⤵
  PID:4976
- C:\Windows\System\EejkOOk.exe
  C:\Windows\System\EejkOOk.exe
  2⤵
  PID:5000
- C:\Windows\System\OLzNeBB.exe
  C:\Windows\System\OLzNeBB.exe
  2⤵
  PID:5016
- C:\Windows\System\deNMGBI.exe
  C:\Windows\System\deNMGBI.exe
  2⤵
  PID:5040
- C:\Windows\System\ZMYxTQA.exe
  C:\Windows\System\ZMYxTQA.exe
  2⤵
  PID:5064
- C:\Windows\System\ideTFFh.exe
  C:\Windows\System\ideTFFh.exe
  2⤵
  PID:5080
- C:\Windows\System\kWZHMgq.exe
  C:\Windows\System\kWZHMgq.exe
  2⤵
  PID:5100
- C:\Windows\System\qLfyXNV.exe
  C:\Windows\System\qLfyXNV.exe
  2⤵
  PID:3252
- C:\Windows\System\yxdVyig.exe
  C:\Windows\System\yxdVyig.exe
  2⤵
  PID:3684
- C:\Windows\System\UPnPQCR.exe
  C:\Windows\System\UPnPQCR.exe
  2⤵
  PID:3696
- C:\Windows\System\jOqEwNp.exe
  C:\Windows\System\jOqEwNp.exe
  2⤵
  PID:3796
- C:\Windows\System\dxmKrgY.exe
  C:\Windows\System\dxmKrgY.exe
  2⤵
  PID:3904
- C:\Windows\System\QtaOrCy.exe
  C:\Windows\System\QtaOrCy.exe
  2⤵
  PID:3884
- C:\Windows\System\vVdWsXD.exe
  C:\Windows\System\vVdWsXD.exe
  2⤵
  PID:2680
- C:\Windows\System\nPLRoYQ.exe
  C:\Windows\System\nPLRoYQ.exe
  2⤵
  PID:4044
- C:\Windows\System\mVleHie.exe
  C:\Windows\System\mVleHie.exe
  2⤵
  PID:3040
- C:\Windows\System\yAYSLNg.exe
  C:\Windows\System\yAYSLNg.exe
  2⤵
  PID:2040
- C:\Windows\System\tTQPBFj.exe
  C:\Windows\System\tTQPBFj.exe
  2⤵
  PID:3160
- C:\Windows\System\kixQUBM.exe
  C:\Windows\System\kixQUBM.exe
  2⤵
  PID:3364
- C:\Windows\System\MlHKIRV.exe
  C:\Windows\System\MlHKIRV.exe
  2⤵
  PID:2708
- C:\Windows\System\JipyeAR.exe
  C:\Windows\System\JipyeAR.exe
  2⤵
  PID:3340
- C:\Windows\System\uerRbSE.exe
  C:\Windows\System\uerRbSE.exe
  2⤵
  PID:3468
- C:\Windows\System\rShmpby.exe
  C:\Windows\System\rShmpby.exe
  2⤵
  PID:3636
- C:\Windows\System\mZBlrTA.exe
  C:\Windows\System\mZBlrTA.exe
  2⤵
  PID:4156
- C:\Windows\System\azDoVzo.exe
  C:\Windows\System\azDoVzo.exe
  2⤵
  PID:4172
- C:\Windows\System\vGxIBwn.exe
  C:\Windows\System\vGxIBwn.exe
  2⤵
  PID:4224
- C:\Windows\System\iIIBWyg.exe
  C:\Windows\System\iIIBWyg.exe
  2⤵
  PID:4248
- C:\Windows\System\JixfvvQ.exe
  C:\Windows\System\JixfvvQ.exe
  2⤵
  PID:4276
- C:\Windows\System\EGzZrMk.exe
  C:\Windows\System\EGzZrMk.exe
  2⤵
  PID:2668
- C:\Windows\System\dYiDquk.exe
  C:\Windows\System\dYiDquk.exe
  2⤵
  PID:4300
- C:\Windows\System\ZPqnebw.exe
  C:\Windows\System\ZPqnebw.exe
  2⤵
  PID:4356
- C:\Windows\System\frKoamQ.exe
  C:\Windows\System\frKoamQ.exe
  2⤵
  PID:4376
- C:\Windows\System\oHxVbhl.exe
  C:\Windows\System\oHxVbhl.exe
  2⤵
  PID:4412
- C:\Windows\System\GzIzePv.exe
  C:\Windows\System\GzIzePv.exe
  2⤵
  PID:4452
- C:\Windows\System\nkgPVgh.exe
  C:\Windows\System\nkgPVgh.exe
  2⤵
  PID:4488
- C:\Windows\System\hvpBDpd.exe
  C:\Windows\System\hvpBDpd.exe
  2⤵
  PID:4552
- C:\Windows\System\lKFWJMt.exe
  C:\Windows\System\lKFWJMt.exe
  2⤵
  PID:4500
- C:\Windows\System\YkznbdY.exe
  C:\Windows\System\YkznbdY.exe
  2⤵
  PID:4540
- C:\Windows\System\sefCzCD.exe
  C:\Windows\System\sefCzCD.exe
  2⤵
  PID:4608
- C:\Windows\System\hvZkTbL.exe
  C:\Windows\System\hvZkTbL.exe
  2⤵
  PID:4636
- C:\Windows\System\UdeTlJh.exe
  C:\Windows\System\UdeTlJh.exe
  2⤵
  PID:4672
- C:\Windows\System\jJkMJex.exe
  C:\Windows\System\jJkMJex.exe
  2⤵
  PID:4692
- C:\Windows\System\EbMpTtY.exe
  C:\Windows\System\EbMpTtY.exe
  2⤵
  PID:4696
- C:\Windows\System\fatlJQv.exe
  C:\Windows\System\fatlJQv.exe
  2⤵
  PID:4772
- C:\Windows\System\ipccEaB.exe
  C:\Windows\System\ipccEaB.exe
  2⤵
  PID:4832
- C:\Windows\System\oDTEZUl.exe
  C:\Windows\System\oDTEZUl.exe
  2⤵
  PID:4872
- C:\Windows\System\qGajjEp.exe
  C:\Windows\System\qGajjEp.exe
  2⤵
  PID:4888
- C:\Windows\System\BQRCfoS.exe
  C:\Windows\System\BQRCfoS.exe
  2⤵
  PID:4896
- C:\Windows\System\CEgttjZ.exe
  C:\Windows\System\CEgttjZ.exe
  2⤵
  PID:4992
- C:\Windows\System\TbCvlIM.exe
  C:\Windows\System\TbCvlIM.exe
  2⤵
  PID:4936
- C:\Windows\System\DFhMtJc.exe
  C:\Windows\System\DFhMtJc.exe
  2⤵
  PID:4968
- C:\Windows\System\rxxoEfJ.exe
  C:\Windows\System\rxxoEfJ.exe
  2⤵
  PID:5008
- C:\Windows\System\OzVmtyK.exe
  C:\Windows\System\OzVmtyK.exe
  2⤵
  PID:5060
- C:\Windows\System\fEOGkEj.exe
  C:\Windows\System\fEOGkEj.exe
  2⤵
  PID:5096
- C:\Windows\System\UQyqPRr.exe
  C:\Windows\System\UQyqPRr.exe
  2⤵
  PID:3724
- C:\Windows\System\YYcGVdX.exe
  C:\Windows\System\YYcGVdX.exe
  2⤵
  PID:3032
- C:\Windows\System\kRWOiWg.exe
  C:\Windows\System\kRWOiWg.exe
  2⤵
  PID:3536
- C:\Windows\System\VsaqEuj.exe
  C:\Windows\System\VsaqEuj.exe
  2⤵
  PID:3932
- C:\Windows\System\MFDrUqF.exe
  C:\Windows\System\MFDrUqF.exe
  2⤵
  PID:3980
- C:\Windows\System\IBOzEEc.exe
  C:\Windows\System\IBOzEEc.exe
  2⤵
  PID:996
- C:\Windows\System\EjsmSjn.exe
  C:\Windows\System\EjsmSjn.exe
  2⤵
  PID:3108
- C:\Windows\System\BweWvnu.exe
  C:\Windows\System\BweWvnu.exe
  2⤵
  PID:3204
- C:\Windows\System\MPotIRd.exe
  C:\Windows\System\MPotIRd.exe
  2⤵
  PID:3408
- C:\Windows\System\hLqdLWJ.exe
  C:\Windows\System\hLqdLWJ.exe
  2⤵
  PID:4128
- C:\Windows\System\lNNlOvp.exe
  C:\Windows\System\lNNlOvp.exe
  2⤵
  PID:3472
- C:\Windows\System\lNowKaM.exe
  C:\Windows\System\lNowKaM.exe
  2⤵
  PID:4228
- C:\Windows\System\skxtSfV.exe
  C:\Windows\System\skxtSfV.exe
  2⤵
  PID:4296
- C:\Windows\System\lhHtgkX.exe
  C:\Windows\System\lhHtgkX.exe
  2⤵
  PID:4416
- C:\Windows\System\kSlDuMz.exe
  C:\Windows\System\kSlDuMz.exe
  2⤵
  PID:4288
- C:\Windows\System\NHSAzCU.exe
  C:\Windows\System\NHSAzCU.exe
  2⤵
  PID:4632
- C:\Windows\System\RGiKDYA.exe
  C:\Windows\System\RGiKDYA.exe
  2⤵
  PID:4676
- C:\Windows\System\JPGKzRG.exe
  C:\Windows\System\JPGKzRG.exe
  2⤵
  PID:4456
- C:\Windows\System\SmxLitq.exe
  C:\Windows\System\SmxLitq.exe
  2⤵
  PID:4796
- C:\Windows\System\UBygXko.exe
  C:\Windows\System\UBygXko.exe
  2⤵
  PID:4620
- C:\Windows\System\UJbBHna.exe
  C:\Windows\System\UJbBHna.exe
  2⤵
  PID:4756
- C:\Windows\System\xoNDplG.exe
  C:\Windows\System\xoNDplG.exe
  2⤵
  PID:4496
- C:\Windows\System\GNGEFTR.exe
  C:\Windows\System\GNGEFTR.exe
  2⤵
  PID:4768
- C:\Windows\System\YJLlxjF.exe
  C:\Windows\System\YJLlxjF.exe
  2⤵
  PID:4912
- C:\Windows\System\EhuLHYJ.exe
  C:\Windows\System\EhuLHYJ.exe
  2⤵
  PID:5088
- C:\Windows\System\UHPftlG.exe
  C:\Windows\System\UHPftlG.exe
  2⤵
  PID:3044
- C:\Windows\System\HhOzuHs.exe
  C:\Windows\System\HhOzuHs.exe
  2⤵
  PID:916
- C:\Windows\System\RCtivGG.exe
  C:\Windows\System\RCtivGG.exe
  2⤵
  PID:3084
- C:\Windows\System\sIYWBdX.exe
  C:\Windows\System\sIYWBdX.exe
  2⤵
  PID:4852
- C:\Windows\System\EtHYcNk.exe
  C:\Windows\System\EtHYcNk.exe
  2⤵
  PID:3584
- C:\Windows\System\xRKRpxC.exe
  C:\Windows\System\xRKRpxC.exe
  2⤵
  PID:3960
- C:\Windows\System\NBhLTQY.exe
  C:\Windows\System\NBhLTQY.exe
  2⤵
  PID:4144
- C:\Windows\System\zVTGGrm.exe
  C:\Windows\System\zVTGGrm.exe
  2⤵
  PID:2720
- C:\Windows\System\mYvOZeN.exe
  C:\Windows\System\mYvOZeN.exe
  2⤵
  PID:860
- C:\Windows\System\HGCYcpr.exe
  C:\Windows\System\HGCYcpr.exe
  2⤵
  PID:5032
- C:\Windows\System\SxhpmEt.exe
  C:\Windows\System\SxhpmEt.exe
  2⤵
  PID:4516
- C:\Windows\System\Vmgjcmr.exe
  C:\Windows\System\Vmgjcmr.exe
  2⤵
  PID:4212
- C:\Windows\System\kUpQiIO.exe
  C:\Windows\System\kUpQiIO.exe
  2⤵
  PID:4740
- C:\Windows\System\wzLiOaW.exe
  C:\Windows\System\wzLiOaW.exe
  2⤵
  PID:2940
- C:\Windows\System\OeDFXwL.exe
  C:\Windows\System\OeDFXwL.exe
  2⤵
  PID:4124
- C:\Windows\System\EIxVGqL.exe
  C:\Windows\System\EIxVGqL.exe
  2⤵
  PID:4952
- C:\Windows\System\VzOwJQI.exe
  C:\Windows\System\VzOwJQI.exe
  2⤵
  PID:2232
- C:\Windows\System\OCuiXds.exe
  C:\Windows\System\OCuiXds.exe
  2⤵
  PID:4132
- C:\Windows\System\KSLuCVz.exe
  C:\Windows\System\KSLuCVz.exe
  2⤵
  PID:4512
- C:\Windows\System\sxpeBMe.exe
  C:\Windows\System\sxpeBMe.exe
  2⤵
  PID:4360
- C:\Windows\System\LqEzkIH.exe
  C:\Windows\System\LqEzkIH.exe
  2⤵
  PID:552
- C:\Windows\System\kqogKYW.exe
  C:\Windows\System\kqogKYW.exe
  2⤵
  PID:2032
- C:\Windows\System\xWiZwei.exe
  C:\Windows\System\xWiZwei.exe
  2⤵
  PID:112
- C:\Windows\System\RXQQrUF.exe
  C:\Windows\System\RXQQrUF.exe
  2⤵
  PID:2572
- C:\Windows\System\XXnrOID.exe
  C:\Windows\System\XXnrOID.exe
  2⤵
  PID:4932
- C:\Windows\System\EEiINzc.exe
  C:\Windows\System\EEiINzc.exe
  2⤵
  PID:1952
- C:\Windows\System\UNQzdbt.exe
  C:\Windows\System\UNQzdbt.exe
  2⤵
  PID:1436
- C:\Windows\System\eQCLXvL.exe
  C:\Windows\System\eQCLXvL.exe
  2⤵
  PID:1528
- C:\Windows\System\wrAOrDq.exe
  C:\Windows\System\wrAOrDq.exe
  2⤵
  PID:3896
- C:\Windows\System\bZDRloQ.exe
  C:\Windows\System\bZDRloQ.exe
  2⤵
  PID:4196
- C:\Windows\System\YopfzTY.exe
  C:\Windows\System\YopfzTY.exe
  2⤵
  PID:2876
- C:\Windows\System\VLjHtto.exe
  C:\Windows\System\VLjHtto.exe
  2⤵
  PID:3936
- C:\Windows\System\YYYIuzU.exe
  C:\Windows\System\YYYIuzU.exe
  2⤵
  PID:1012
- C:\Windows\System\csHZSNF.exe
  C:\Windows\System\csHZSNF.exe
  2⤵
  PID:5036
- C:\Windows\System\BnugKXn.exe
  C:\Windows\System\BnugKXn.exe
  2⤵
  PID:4208
- C:\Windows\System\SnvaVSI.exe
  C:\Windows\System\SnvaVSI.exe
  2⤵
  PID:4312
- C:\Windows\System\ZAmIfXM.exe
  C:\Windows\System\ZAmIfXM.exe
  2⤵
  PID:4660
- C:\Windows\System\vDbyCiV.exe
  C:\Windows\System\vDbyCiV.exe
  2⤵
  PID:4536
- C:\Windows\System\gXjHuxu.exe
  C:\Windows\System\gXjHuxu.exe
  2⤵
  PID:316
- C:\Windows\System\QhNagHd.exe
  C:\Windows\System\QhNagHd.exe
  2⤵
  PID:4736
- C:\Windows\System\qLEdHCk.exe
  C:\Windows\System\qLEdHCk.exe
  2⤵
  PID:4984
- C:\Windows\System\wCmCdOk.exe
  C:\Windows\System\wCmCdOk.exe
  2⤵
  PID:2540
- C:\Windows\System\wanAimI.exe
  C:\Windows\System\wanAimI.exe
  2⤵
  PID:2512
- C:\Windows\System\vSEeQdN.exe
  C:\Windows\System\vSEeQdN.exe
  2⤵
  PID:3780
- C:\Windows\System\TBPVkTu.exe
  C:\Windows\System\TBPVkTu.exe
  2⤵
  PID:780
- C:\Windows\System\PpkNsPZ.exe
  C:\Windows\System\PpkNsPZ.exe
  2⤵
  PID:4108
- C:\Windows\System\KPLQsEn.exe
  C:\Windows\System\KPLQsEn.exe
  2⤵
  PID:4732
- C:\Windows\System\FXdYCVr.exe
  C:\Windows\System\FXdYCVr.exe
  2⤵
  PID:4400
- C:\Windows\System\DVyZAsr.exe
  C:\Windows\System\DVyZAsr.exe
  2⤵
  PID:3664
- C:\Windows\System\ZENpwQn.exe
  C:\Windows\System\ZENpwQn.exe
  2⤵
  PID:2188
- C:\Windows\System\gbGlKkP.exe
  C:\Windows\System\gbGlKkP.exe
  2⤵
  PID:2756
- C:\Windows\System\XxqXlky.exe
  C:\Windows\System\XxqXlky.exe
  2⤵
  PID:2012
- C:\Windows\System\FbZFbPJ.exe
  C:\Windows\System\FbZFbPJ.exe
  2⤵
  PID:4716
- C:\Windows\System\cxNipDm.exe
  C:\Windows\System\cxNipDm.exe
  2⤵
  PID:2108
- C:\Windows\System\wgrkGHg.exe
  C:\Windows\System\wgrkGHg.exe
  2⤵
  PID:2924
- C:\Windows\System\xAPRMIX.exe
  C:\Windows\System\xAPRMIX.exe
  2⤵
  PID:2600
- C:\Windows\System\eYoINHm.exe
  C:\Windows\System\eYoINHm.exe
  2⤵
  PID:2148
- C:\Windows\System\xqRISRW.exe
  C:\Windows\System\xqRISRW.exe
  2⤵
  PID:2780
- C:\Windows\System\dHWDNsy.exe
  C:\Windows\System\dHWDNsy.exe
  2⤵
  PID:2256
- C:\Windows\System\OQpzptb.exe
  C:\Windows\System\OQpzptb.exe
  2⤵
  PID:1684
- C:\Windows\System\NqYrXOi.exe
  C:\Windows\System\NqYrXOi.exe
  2⤵
  PID:2808
- C:\Windows\System\tmAjmuo.exe
  C:\Windows\System\tmAjmuo.exe
  2⤵
  PID:2760
- C:\Windows\System\vEVsEMd.exe
  C:\Windows\System\vEVsEMd.exe
  2⤵
  PID:1732
- C:\Windows\System\JFBkwBP.exe
  C:\Windows\System\JFBkwBP.exe
  2⤵
  PID:1580
- C:\Windows\System\wNPZiwW.exe
  C:\Windows\System\wNPZiwW.exe
  2⤵
  PID:4752
- C:\Windows\System\mNQhaBr.exe
  C:\Windows\System\mNQhaBr.exe
  2⤵
  PID:2236
- C:\Windows\System\NGZBfbQ.exe
  C:\Windows\System\NGZBfbQ.exe
  2⤵
  PID:1764
- C:\Windows\System\tqReRkf.exe
  C:\Windows\System\tqReRkf.exe
  2⤵
  PID:2544
- C:\Windows\System\AMLSiqa.exe
  C:\Windows\System\AMLSiqa.exe
  2⤵
  PID:5128
- C:\Windows\System\GYVhDFk.exe
  C:\Windows\System\GYVhDFk.exe
  2⤵
  PID:5144
- C:\Windows\System\ouQplyR.exe
  C:\Windows\System\ouQplyR.exe
  2⤵
  PID:5160
- C:\Windows\System\qfGtYDu.exe
  C:\Windows\System\qfGtYDu.exe
  2⤵
  PID:5176
- C:\Windows\System\aYLciQP.exe
  C:\Windows\System\aYLciQP.exe
  2⤵
  PID:5192
- C:\Windows\System\vQWkoHU.exe
  C:\Windows\System\vQWkoHU.exe
  2⤵
  PID:5208
- C:\Windows\System\vingVHg.exe
  C:\Windows\System\vingVHg.exe
  2⤵
  PID:5224
- C:\Windows\System\hGqSmcd.exe
  C:\Windows\System\hGqSmcd.exe
  2⤵
  PID:5240
- C:\Windows\System\zZttyFJ.exe
  C:\Windows\System\zZttyFJ.exe
  2⤵
  PID:5256
- C:\Windows\System\GJWscew.exe
  C:\Windows\System\GJWscew.exe
  2⤵
  PID:5272
- C:\Windows\System\rHEnhch.exe
  C:\Windows\System\rHEnhch.exe
  2⤵
  PID:5288
- C:\Windows\System\rrYaCmk.exe
  C:\Windows\System\rrYaCmk.exe
  2⤵
  PID:5324
- C:\Windows\System\kIvpwCs.exe
  C:\Windows\System\kIvpwCs.exe
  2⤵
  PID:5340
- C:\Windows\System\bRMkzmR.exe
  C:\Windows\System\bRMkzmR.exe
  2⤵
  PID:5356
- C:\Windows\System\fNdWJJe.exe
  C:\Windows\System\fNdWJJe.exe
  2⤵
  PID:5452
- C:\Windows\System\ZnILPTv.exe
  C:\Windows\System\ZnILPTv.exe
  2⤵
  PID:5488
- C:\Windows\System\sfshuQc.exe
  C:\Windows\System\sfshuQc.exe
  2⤵
  PID:5508
- C:\Windows\System\YHVQaSM.exe
  C:\Windows\System\YHVQaSM.exe
  2⤵
  PID:5524
- C:\Windows\System\yOgnlvO.exe
  C:\Windows\System\yOgnlvO.exe
  2⤵
  PID:5540
- C:\Windows\System\UGtDgqG.exe
  C:\Windows\System\UGtDgqG.exe
  2⤵
  PID:5564
- C:\Windows\System\OYkzUjH.exe
  C:\Windows\System\OYkzUjH.exe
  2⤵
  PID:5580
- C:\Windows\System\PlvdOZs.exe
  C:\Windows\System\PlvdOZs.exe
  2⤵
  PID:5596
- C:\Windows\System\JCCThiK.exe
  C:\Windows\System\JCCThiK.exe
  2⤵
  PID:5612
- C:\Windows\System\FVmibcN.exe
  C:\Windows\System\FVmibcN.exe
  2⤵
  PID:5628
- C:\Windows\System\XRfaWyP.exe
  C:\Windows\System\XRfaWyP.exe
  2⤵
  PID:5644
- C:\Windows\System\ZKZzKlH.exe
  C:\Windows\System\ZKZzKlH.exe
  2⤵
  PID:5660
- C:\Windows\System\rFXqDHR.exe
  C:\Windows\System\rFXqDHR.exe
  2⤵
  PID:5676
- C:\Windows\System\IPoGoSO.exe
  C:\Windows\System\IPoGoSO.exe
  2⤵
  PID:5692
- C:\Windows\System\YJQfZVC.exe
  C:\Windows\System\YJQfZVC.exe
  2⤵
  PID:5708
- C:\Windows\System\tHPkJvC.exe
  C:\Windows\System\tHPkJvC.exe
  2⤵
  PID:5728
- C:\Windows\System\ULAuaZq.exe
  C:\Windows\System\ULAuaZq.exe
  2⤵
  PID:5744
- C:\Windows\System\qazJACo.exe
  C:\Windows\System\qazJACo.exe
  2⤵
  PID:5760
- C:\Windows\System\KWwoLsU.exe
  C:\Windows\System\KWwoLsU.exe
  2⤵
  PID:5776
- C:\Windows\System\UBjrVRh.exe
  C:\Windows\System\UBjrVRh.exe
  2⤵
  PID:5792
- C:\Windows\System\wwTjGgm.exe
  C:\Windows\System\wwTjGgm.exe
  2⤵
  PID:5808
- C:\Windows\System\mozhbid.exe
  C:\Windows\System\mozhbid.exe
  2⤵
  PID:5824
- C:\Windows\System\dXHiMdx.exe
  C:\Windows\System\dXHiMdx.exe
  2⤵
  PID:5840
- C:\Windows\System\gZNOizn.exe
  C:\Windows\System\gZNOizn.exe
  2⤵
  PID:5856
- C:\Windows\System\NlWPjsB.exe
  C:\Windows\System\NlWPjsB.exe
  2⤵
  PID:5872
- C:\Windows\System\XsvnDyO.exe
  C:\Windows\System\XsvnDyO.exe
  2⤵
  PID:5888
- C:\Windows\System\JwzWwPu.exe
  C:\Windows\System\JwzWwPu.exe
  2⤵
  PID:5904
- C:\Windows\System\MHGqalL.exe
  C:\Windows\System\MHGqalL.exe
  2⤵
  PID:5920
- C:\Windows\System\umFuDSx.exe
  C:\Windows\System\umFuDSx.exe
  2⤵
  PID:5936
- C:\Windows\System\hJjjCBL.exe
  C:\Windows\System\hJjjCBL.exe
  2⤵
  PID:5952
- C:\Windows\System\qYwABtt.exe
  C:\Windows\System\qYwABtt.exe
  2⤵
  PID:5968
- C:\Windows\System\sBpEzFu.exe
  C:\Windows\System\sBpEzFu.exe
  2⤵
  PID:5984
- C:\Windows\System\vfDEtyv.exe
  C:\Windows\System\vfDEtyv.exe
  2⤵
  PID:6000
- C:\Windows\System\nDIyzEL.exe
  C:\Windows\System\nDIyzEL.exe
  2⤵
  PID:6016
- C:\Windows\System\oQvYEHc.exe
  C:\Windows\System\oQvYEHc.exe
  2⤵
  PID:6032
- C:\Windows\System\xJvLfdS.exe
  C:\Windows\System\xJvLfdS.exe
  2⤵
  PID:6048
- C:\Windows\System\icTQmcP.exe
  C:\Windows\System\icTQmcP.exe
  2⤵
  PID:6064
- C:\Windows\System\YNJbCZN.exe
  C:\Windows\System\YNJbCZN.exe
  2⤵
  PID:6080
- C:\Windows\System\PVfQvwe.exe
  C:\Windows\System\PVfQvwe.exe
  2⤵
  PID:6096
- C:\Windows\System\wFOBgCE.exe
  C:\Windows\System\wFOBgCE.exe
  2⤵
  PID:6112
- C:\Windows\System\oahgeLx.exe
  C:\Windows\System\oahgeLx.exe
  2⤵
  PID:6128
- C:\Windows\System\agSfZYP.exe
  C:\Windows\System\agSfZYP.exe
  2⤵
  PID:2624
- C:\Windows\System\ZmADvEE.exe
  C:\Windows\System\ZmADvEE.exe
  2⤵
  PID:3092
- C:\Windows\System\tLkFKAQ.exe
  C:\Windows\System\tLkFKAQ.exe
  2⤵
  PID:5156
- C:\Windows\System\aOHWUqr.exe
  C:\Windows\System\aOHWUqr.exe
  2⤵
  PID:5220
- C:\Windows\System\JQsVKmU.exe
  C:\Windows\System\JQsVKmU.exe
  2⤵
  PID:5248
- C:\Windows\System\Rohxyxn.exe
  C:\Windows\System\Rohxyxn.exe
  2⤵
  PID:2044
- C:\Windows\System\RjNSPbn.exe
  C:\Windows\System\RjNSPbn.exe
  2⤵
  PID:2516
- C:\Windows\System\nzGnOqn.exe
  C:\Windows\System\nzGnOqn.exe
  2⤵
  PID:2804
- C:\Windows\System\ohMkgiH.exe
  C:\Windows\System\ohMkgiH.exe
  2⤵
  PID:5236
- C:\Windows\System\HFbrhTO.exe
  C:\Windows\System\HFbrhTO.exe
  2⤵
  PID:1992
- C:\Windows\System\RfOkwHZ.exe
  C:\Windows\System\RfOkwHZ.exe
  2⤵
  PID:2344
- C:\Windows\System\VPizjkZ.exe
  C:\Windows\System\VPizjkZ.exe
  2⤵
  PID:5284
- C:\Windows\System\gIYQvQz.exe
  C:\Windows\System\gIYQvQz.exe
  2⤵
  PID:5304
- C:\Windows\System\ABJfzRk.exe
  C:\Windows\System\ABJfzRk.exe
  2⤵
  PID:5348
- C:\Windows\System\vcRMNaE.exe
  C:\Windows\System\vcRMNaE.exe
  2⤵
  PID:5364
- C:\Windows\System\QXYkwVn.exe
  C:\Windows\System\QXYkwVn.exe
  2⤵
  PID:5380
- C:\Windows\System\aSLsOYI.exe
  C:\Windows\System\aSLsOYI.exe
  2⤵
  PID:5396
- C:\Windows\System\RxFmHvO.exe
  C:\Windows\System\RxFmHvO.exe
  2⤵
  PID:5404
- C:\Windows\System\hbDgBay.exe
  C:\Windows\System\hbDgBay.exe
  2⤵
  PID:2792
- C:\Windows\System\mrRsNIo.exe
  C:\Windows\System\mrRsNIo.exe
  2⤵
  PID:5424
- C:\Windows\System\gVADYiT.exe
  C:\Windows\System\gVADYiT.exe
  2⤵
  PID:636
- C:\Windows\System\kFqhWFw.exe
  C:\Windows\System\kFqhWFw.exe
  2⤵
  PID:5460
- C:\Windows\System\EyqpVQE.exe
  C:\Windows\System\EyqpVQE.exe
  2⤵
  PID:5472
- C:\Windows\System\gFtgwbC.exe
  C:\Windows\System\gFtgwbC.exe
  2⤵
  PID:5532
- C:\Windows\System\EGBZRYY.exe
  C:\Windows\System\EGBZRYY.exe
  2⤵
  PID:5548
- C:\Windows\System\pTMvNpe.exe
  C:\Windows\System\pTMvNpe.exe
  2⤵
  PID:5576
- C:\Windows\System\CBoSyPx.exe
  C:\Windows\System\CBoSyPx.exe
  2⤵
  PID:5484
- C:\Windows\System\pZzFkBI.exe
  C:\Windows\System\pZzFkBI.exe
  2⤵
  PID:5636
- C:\Windows\System\bVbNqSk.exe
  C:\Windows\System\bVbNqSk.exe
  2⤵
  PID:5624
- C:\Windows\System\tyapdCA.exe
  C:\Windows\System\tyapdCA.exe
  2⤵
  PID:5668
- C:\Windows\System\VRPqllP.exe
  C:\Windows\System\VRPqllP.exe
  2⤵
  PID:5768
- C:\Windows\System\cbaEnIH.exe
  C:\Windows\System\cbaEnIH.exe
  2⤵
  PID:5804
- C:\Windows\System\tIYqtLQ.exe
  C:\Windows\System\tIYqtLQ.exe
  2⤵
  PID:5716
- C:\Windows\System\Gzuenyd.exe
  C:\Windows\System\Gzuenyd.exe
  2⤵
  PID:5784
- C:\Windows\System\HIYcCMy.exe
  C:\Windows\System\HIYcCMy.exe
  2⤵
  PID:5848
- C:\Windows\System\RYFJHnU.exe
  C:\Windows\System\RYFJHnU.exe
  2⤵
  PID:5900
- C:\Windows\System\ppCBkHO.exe
  C:\Windows\System\ppCBkHO.exe
  2⤵
  PID:5720
- C:\Windows\System\NPXPWZo.exe
  C:\Windows\System\NPXPWZo.exe
  2⤵
  PID:5976
- C:\Windows\System\OQPHhCl.exe
  C:\Windows\System\OQPHhCl.exe
  2⤵
  PID:6012
- C:\Windows\System\wUZqVxQ.exe
  C:\Windows\System\wUZqVxQ.exe
  2⤵
  PID:6076
- C:\Windows\System\rNwJfBI.exe
  C:\Windows\System\rNwJfBI.exe
  2⤵
  PID:6136
- C:\Windows\System\ezmQAOz.exe
  C:\Windows\System\ezmQAOz.exe
  2⤵
  PID:5960
- C:\Windows\System\LvaLsPx.exe
  C:\Windows\System\LvaLsPx.exe
  2⤵
  PID:6024
- C:\Windows\System\Erwmffx.exe
  C:\Windows\System\Erwmffx.exe
  2⤵
  PID:6088
- C:\Windows\System\LyekDRz.exe
  C:\Windows\System\LyekDRz.exe
  2⤵
  PID:2560
- C:\Windows\System\OYUwjHP.exe
  C:\Windows\System\OYUwjHP.exe
  2⤵
  PID:2584
- C:\Windows\System\LmNCYsn.exe
  C:\Windows\System\LmNCYsn.exe
  2⤵
  PID:3700
- C:\Windows\System\DkARkhy.exe
  C:\Windows\System\DkARkhy.exe
  2⤵
  PID:5204
- C:\Windows\System\orRZZSP.exe
  C:\Windows\System\orRZZSP.exe
  2⤵
  PID:2480
- C:\Windows\System\jxPyeXZ.exe
  C:\Windows\System\jxPyeXZ.exe
  2⤵
  PID:2832
- C:\Windows\System\RCCNCZi.exe
  C:\Windows\System\RCCNCZi.exe
  2⤵
  PID:5332
- C:\Windows\System\USerjcC.exe
  C:\Windows\System\USerjcC.exe
  2⤵
  PID:5352
- C:\Windows\System\wyUmmxZ.exe
  C:\Windows\System\wyUmmxZ.exe
  2⤵
  PID:1624
- C:\Windows\System\LsJEMYL.exe
  C:\Windows\System\LsJEMYL.exe
  2⤵
  PID:5476
- C:\Windows\System\aWEvfzY.exe
  C:\Windows\System\aWEvfzY.exe
  2⤵
  PID:5480
- C:\Windows\System\nDGpfaj.exe
  C:\Windows\System\nDGpfaj.exe
  2⤵
  PID:5736
- C:\Windows\System\AGEDBTg.exe
  C:\Windows\System\AGEDBTg.exe
  2⤵
  PID:5816
- C:\Windows\System\STNEakm.exe
  C:\Windows\System\STNEakm.exe
  2⤵
  PID:6008
- C:\Windows\System\PVLGLBi.exe
  C:\Windows\System\PVLGLBi.exe
  2⤵
  PID:5992
- C:\Windows\System\DSYHTaJ.exe
  C:\Windows\System\DSYHTaJ.exe
  2⤵
  PID:5188
- C:\Windows\System\edWRFPB.exe
  C:\Windows\System\edWRFPB.exe
  2⤵
  PID:5136
- C:\Windows\System\VLlszAH.exe
  C:\Windows\System\VLlszAH.exe
  2⤵
  PID:5520
- C:\Windows\System\mqTFTIs.exe
  C:\Windows\System\mqTFTIs.exe
  2⤵
  PID:5316
- C:\Windows\System\jhqTSkt.exe
  C:\Windows\System\jhqTSkt.exe
  2⤵
  PID:1924
- C:\Windows\System\LUhwBrE.exe
  C:\Windows\System\LUhwBrE.exe
  2⤵
  PID:5440
- C:\Windows\System\fkbywCQ.exe
  C:\Windows\System\fkbywCQ.exe
  2⤵
  PID:5560
- C:\Windows\System\btXgNgf.exe
  C:\Windows\System\btXgNgf.exe
  2⤵
  PID:5608
- C:\Windows\System\waSxZdb.exe
  C:\Windows\System\waSxZdb.exe
  2⤵
  PID:5800
- C:\Windows\System\sGsJoUv.exe
  C:\Windows\System\sGsJoUv.exe
  2⤵
  PID:5896
- C:\Windows\System\SkpGptb.exe
  C:\Windows\System\SkpGptb.exe
  2⤵
  PID:6072
- C:\Windows\System\HYXPhzZ.exe
  C:\Windows\System\HYXPhzZ.exe
  2⤵
  PID:5916
- C:\Windows\System\Fsxhhzi.exe
  C:\Windows\System\Fsxhhzi.exe
  2⤵
  PID:5140
- C:\Windows\System\nhZsWqj.exe
  C:\Windows\System\nhZsWqj.exe
  2⤵
  PID:5468
- C:\Windows\System\FtrJphY.exe
  C:\Windows\System\FtrJphY.exe
  2⤵
  PID:5836
- C:\Windows\System\kcSsVAL.exe
  C:\Windows\System\kcSsVAL.exe
  2⤵
  PID:6120
- C:\Windows\System\CmhQSTK.exe
  C:\Windows\System\CmhQSTK.exe
  2⤵
  PID:6156
- C:\Windows\System\tDXfbeu.exe
  C:\Windows\System\tDXfbeu.exe
  2⤵
  PID:6172
- C:\Windows\System\nehJaIi.exe
  C:\Windows\System\nehJaIi.exe
  2⤵
  PID:6188
- C:\Windows\System\hzRTLaV.exe
  C:\Windows\System\hzRTLaV.exe
  2⤵
  PID:6204
- C:\Windows\System\vdKiaRa.exe
  C:\Windows\System\vdKiaRa.exe
  2⤵
  PID:6220
- C:\Windows\System\jadTmXH.exe
  C:\Windows\System\jadTmXH.exe
  2⤵
  PID:6236
- C:\Windows\System\eflnxKu.exe
  C:\Windows\System\eflnxKu.exe
  2⤵
  PID:6252
- C:\Windows\System\UGKhtAZ.exe
  C:\Windows\System\UGKhtAZ.exe
  2⤵
  PID:6268
- C:\Windows\System\tNzeFYe.exe
  C:\Windows\System\tNzeFYe.exe
  2⤵
  PID:6284
- C:\Windows\System\BBjLUrF.exe
  C:\Windows\System\BBjLUrF.exe
  2⤵
  PID:6300
- C:\Windows\System\FrkRzgp.exe
  C:\Windows\System\FrkRzgp.exe
  2⤵
  PID:6316
- C:\Windows\System\MFkRfLp.exe
  C:\Windows\System\MFkRfLp.exe
  2⤵
  PID:6332
- C:\Windows\System\ryfzdtO.exe
  C:\Windows\System\ryfzdtO.exe
  2⤵
  PID:6348
- C:\Windows\System\MJNhWIl.exe
  C:\Windows\System\MJNhWIl.exe
  2⤵
  PID:6364
- C:\Windows\System\ZxQcpFv.exe
  C:\Windows\System\ZxQcpFv.exe
  2⤵
  PID:6380
- C:\Windows\System\YUJJgTr.exe
  C:\Windows\System\YUJJgTr.exe
  2⤵
  PID:6396
- C:\Windows\System\MDCWPfF.exe
  C:\Windows\System\MDCWPfF.exe
  2⤵
  PID:6412
- C:\Windows\System\RyAWSRJ.exe
  C:\Windows\System\RyAWSRJ.exe
  2⤵
  PID:6428
- C:\Windows\System\jwzZNLI.exe
  C:\Windows\System\jwzZNLI.exe
  2⤵
  PID:6444
- C:\Windows\System\qEMyEEg.exe
  C:\Windows\System\qEMyEEg.exe
  2⤵
  PID:6460
- C:\Windows\System\gxwgdJF.exe
  C:\Windows\System\gxwgdJF.exe
  2⤵
  PID:6476
- C:\Windows\System\aOkhzhz.exe
  C:\Windows\System\aOkhzhz.exe
  2⤵
  PID:6492
- C:\Windows\System\szmJkXX.exe
  C:\Windows\System\szmJkXX.exe
  2⤵
  PID:6508
- C:\Windows\System\MmpWlhC.exe
  C:\Windows\System\MmpWlhC.exe
  2⤵
  PID:6524
- C:\Windows\System\uNYGtoG.exe
  C:\Windows\System\uNYGtoG.exe
  2⤵
  PID:6540
- C:\Windows\System\OynvexI.exe
  C:\Windows\System\OynvexI.exe
  2⤵
  PID:6556
- C:\Windows\System\AhchnEb.exe
  C:\Windows\System\AhchnEb.exe
  2⤵
  PID:6572
- C:\Windows\System\NdzpuSn.exe
  C:\Windows\System\NdzpuSn.exe
  2⤵
  PID:6588
- C:\Windows\System\aWccvUT.exe
  C:\Windows\System\aWccvUT.exe
  2⤵
  PID:6604
- C:\Windows\System\RhJUhbw.exe
  C:\Windows\System\RhJUhbw.exe
  2⤵
  PID:6620
- C:\Windows\System\yCpbDgc.exe
  C:\Windows\System\yCpbDgc.exe
  2⤵
  PID:6636
- C:\Windows\System\PCWbGDM.exe
  C:\Windows\System\PCWbGDM.exe
  2⤵
  PID:6652
- C:\Windows\System\iOhhJKW.exe
  C:\Windows\System\iOhhJKW.exe
  2⤵
  PID:6668
- C:\Windows\System\YzoaflU.exe
  C:\Windows\System\YzoaflU.exe
  2⤵
  PID:6684
- C:\Windows\System\DqDxOYN.exe
  C:\Windows\System\DqDxOYN.exe
  2⤵
  PID:6700
- C:\Windows\System\lCxVzGi.exe
  C:\Windows\System\lCxVzGi.exe
  2⤵
  PID:6716
- C:\Windows\System\PUDnvQw.exe
  C:\Windows\System\PUDnvQw.exe
  2⤵
  PID:6732
- C:\Windows\System\TKMlqVQ.exe
  C:\Windows\System\TKMlqVQ.exe
  2⤵
  PID:6748
- C:\Windows\System\nQDbxYB.exe
  C:\Windows\System\nQDbxYB.exe
  2⤵
  PID:6764
- C:\Windows\System\zRMlSNY.exe
  C:\Windows\System\zRMlSNY.exe
  2⤵
  PID:6780
- C:\Windows\System\qeQQrnZ.exe
  C:\Windows\System\qeQQrnZ.exe
  2⤵
  PID:6796
- C:\Windows\System\bKVkEzG.exe
  C:\Windows\System\bKVkEzG.exe
  2⤵
  PID:6812
- C:\Windows\System\pcQBfhW.exe
  C:\Windows\System\pcQBfhW.exe
  2⤵
  PID:6828
- C:\Windows\System\gAgZxqp.exe
  C:\Windows\System\gAgZxqp.exe
  2⤵
  PID:6844
- C:\Windows\System\VwTbYUj.exe
  C:\Windows\System\VwTbYUj.exe
  2⤵
  PID:6860
- C:\Windows\System\TlHWBAK.exe
  C:\Windows\System\TlHWBAK.exe
  2⤵
  PID:6876
- C:\Windows\System\gdrDsBh.exe
  C:\Windows\System\gdrDsBh.exe
  2⤵
  PID:6892
- C:\Windows\System\CmlmvAt.exe
  C:\Windows\System\CmlmvAt.exe
  2⤵
  PID:6908
- C:\Windows\System\DPFSBBo.exe
  C:\Windows\System\DPFSBBo.exe
  2⤵
  PID:6924
- C:\Windows\System\IDgehRX.exe
  C:\Windows\System\IDgehRX.exe
  2⤵
  PID:6940
- C:\Windows\System\hKAvbas.exe
  C:\Windows\System\hKAvbas.exe
  2⤵
  PID:6956
- C:\Windows\System\bKzGHOC.exe
  C:\Windows\System\bKzGHOC.exe
  2⤵
  PID:6972
- C:\Windows\System\nFJHlkY.exe
  C:\Windows\System\nFJHlkY.exe
  2⤵
  PID:6988
- C:\Windows\System\QNGAhcV.exe
  C:\Windows\System\QNGAhcV.exe
  2⤵
  PID:7004
- C:\Windows\System\YCqtmdK.exe
  C:\Windows\System\YCqtmdK.exe
  2⤵
  PID:7020
- C:\Windows\System\hUABEnb.exe
  C:\Windows\System\hUABEnb.exe
  2⤵
  PID:7036
- C:\Windows\System\QhwiPsx.exe
  C:\Windows\System\QhwiPsx.exe
  2⤵
  PID:7052
- C:\Windows\System\eWPCkHI.exe
  C:\Windows\System\eWPCkHI.exe
  2⤵
  PID:7068
- C:\Windows\System\VNLZQHb.exe
  C:\Windows\System\VNLZQHb.exe
  2⤵
  PID:7084
- C:\Windows\System\kvlHRXO.exe
  C:\Windows\System\kvlHRXO.exe
  2⤵
  PID:7100
- C:\Windows\System\lqPuHPl.exe
  C:\Windows\System\lqPuHPl.exe
  2⤵
  PID:7116
- C:\Windows\System\waUZroQ.exe
  C:\Windows\System\waUZroQ.exe
  2⤵
  PID:7132
- C:\Windows\System\unzFqnM.exe
  C:\Windows\System\unzFqnM.exe
  2⤵
  PID:7148
- C:\Windows\System\UNPZJQx.exe
  C:\Windows\System\UNPZJQx.exe
  2⤵
  PID:7164
- C:\Windows\System\OrUVTfK.exe
  C:\Windows\System\OrUVTfK.exe
  2⤵
  PID:5376
- C:\Windows\System\pFytQok.exe
  C:\Windows\System\pFytQok.exe
  2⤵
  PID:5772
- C:\Windows\System\aorEsSf.exe
  C:\Windows\System\aorEsSf.exe
  2⤵
  PID:5880
- C:\Windows\System\LFVKial.exe
  C:\Windows\System\LFVKial.exe
  2⤵
  PID:5268
- C:\Windows\System\bnDdvnu.exe
  C:\Windows\System\bnDdvnu.exe
  2⤵
  PID:5420
- C:\Windows\System\PcObJNu.exe
  C:\Windows\System\PcObJNu.exe
  2⤵
  PID:5604
- C:\Windows\System\eMCHdBo.exe
  C:\Windows\System\eMCHdBo.exe
  2⤵
  PID:6060
- C:\Windows\System\VePMZkw.exe
  C:\Windows\System\VePMZkw.exe
  2⤵
  PID:6108
- C:\Windows\System\KxEeyxi.exe
  C:\Windows\System\KxEeyxi.exe
  2⤵
  PID:6200
- C:\Windows\System\lQXrwho.exe
  C:\Windows\System\lQXrwho.exe
  2⤵
  PID:6264
- C:\Windows\System\zmEYjlJ.exe
  C:\Windows\System\zmEYjlJ.exe
  2⤵
  PID:6216
- C:\Windows\System\SrWmbSE.exe
  C:\Windows\System\SrWmbSE.exe
  2⤵
  PID:6308
- C:\Windows\System\QDLcyoC.exe
  C:\Windows\System\QDLcyoC.exe
  2⤵
  PID:6376
- C:\Windows\System\FYnamCW.exe
  C:\Windows\System\FYnamCW.exe
  2⤵
  PID:6292
- C:\Windows\System\rKFdTft.exe
  C:\Windows\System\rKFdTft.exe
  2⤵
  PID:6356
- C:\Windows\System\grMPhlN.exe
  C:\Windows\System\grMPhlN.exe
  2⤵
  PID:6424
- C:\Windows\System\SXZbwGz.exe
  C:\Windows\System\SXZbwGz.exe
  2⤵
  PID:6488
- C:\Windows\System\KdiQXGE.exe
  C:\Windows\System\KdiQXGE.exe
  2⤵
  PID:6552
- C:\Windows\System\xHteACl.exe
  C:\Windows\System\xHteACl.exe
  2⤵
  PID:6440
- C:\Windows\System\PlNSJVk.exe
  C:\Windows\System\PlNSJVk.exe
  2⤵
  PID:6504
- C:\Windows\System\FHAJlBe.exe
  C:\Windows\System\FHAJlBe.exe
  2⤵
  PID:6568
- C:\Windows\System\dGCJvhW.exe
  C:\Windows\System\dGCJvhW.exe
  2⤵
  PID:6632
- C:\Windows\System\VJZULpq.exe
  C:\Windows\System\VJZULpq.exe
  2⤵
  PID:6644
- C:\Windows\System\ZptlfyZ.exe
  C:\Windows\System\ZptlfyZ.exe
  2⤵
  PID:6680
- C:\Windows\System\uqvIINJ.exe
  C:\Windows\System\uqvIINJ.exe
  2⤵
  PID:6696
- C:\Windows\System\hyZlgwA.exe
  C:\Windows\System\hyZlgwA.exe
  2⤵
  PID:6756
- C:\Windows\System\vksRjOl.exe
  C:\Windows\System\vksRjOl.exe
  2⤵
  PID:6804
- C:\Windows\System\oHXvgOT.exe
  C:\Windows\System\oHXvgOT.exe
  2⤵
  PID:6840
- C:\Windows\System\gYsbkBz.exe
  C:\Windows\System\gYsbkBz.exe
  2⤵
  PID:6904
- C:\Windows\System\EmbbifZ.exe
  C:\Windows\System\EmbbifZ.exe
  2⤵
  PID:6968
- C:\Windows\System\IAztOHU.exe
  C:\Windows\System\IAztOHU.exe
  2⤵
  PID:7028
- C:\Windows\System\odFuwCI.exe
  C:\Windows\System\odFuwCI.exe
  2⤵
  PID:6792
- C:\Windows\System\HCiwQjg.exe
  C:\Windows\System\HCiwQjg.exe
  2⤵
  PID:6856
- C:\Windows\System\oCPVJGa.exe
  C:\Windows\System\oCPVJGa.exe
  2⤵
  PID:6952
- C:\Windows\System\tEkykPu.exe
  C:\Windows\System\tEkykPu.exe
  2⤵
  PID:7016
- C:\Windows\System\PdVUXBO.exe
  C:\Windows\System\PdVUXBO.exe
  2⤵
  PID:7048
- C:\Windows\System\TltMRqR.exe
  C:\Windows\System\TltMRqR.exe
  2⤵
  PID:7092
- C:\Windows\System\vtKGHqN.exe
  C:\Windows\System\vtKGHqN.exe
  2⤵
  PID:7140
- C:\Windows\System\TnwCJmI.exe
  C:\Windows\System\TnwCJmI.exe
  2⤵
  PID:5504
- C:\Windows\System\jFAbBHb.exe
  C:\Windows\System\jFAbBHb.exe
  2⤵
  PID:6184
- C:\Windows\System\cLVIRPu.exe
  C:\Windows\System\cLVIRPu.exe
  2⤵
  PID:6232
- C:\Windows\System\UQjaXVg.exe
  C:\Windows\System\UQjaXVg.exe
  2⤵
  PID:5444
- C:\Windows\System\kZopZCM.exe
  C:\Windows\System\kZopZCM.exe
  2⤵
  PID:5412
- C:\Windows\System\keRXbun.exe
  C:\Windows\System\keRXbun.exe
  2⤵
  PID:6388
- C:\Windows\System\YRjvodr.exe
  C:\Windows\System\YRjvodr.exe
  2⤵
  PID:6472
- C:\Windows\System\ixIaZPP.exe
  C:\Windows\System\ixIaZPP.exe
  2⤵
  PID:6664
- C:\Windows\System\QBRNobf.exe
  C:\Windows\System\QBRNobf.exe
  2⤵
  PID:5252
- C:\Windows\System\PHhwGWF.exe
  C:\Windows\System\PHhwGWF.exe
  2⤵
  PID:6056
- C:\Windows\System\vqxhJIh.exe
  C:\Windows\System\vqxhJIh.exe
  2⤵
  PID:6536
- C:\Windows\System\gcajKQn.exe
  C:\Windows\System\gcajKQn.exe
  2⤵
  PID:6772
- C:\Windows\System\uJGHOjl.exe
  C:\Windows\System\uJGHOjl.exe
  2⤵
  PID:6484
- C:\Windows\System\PMoFlRe.exe
  C:\Windows\System\PMoFlRe.exe
  2⤵
  PID:6616
- C:\Windows\System\ZeflbzT.exe
  C:\Windows\System\ZeflbzT.exe
  2⤵
  PID:6760
- C:\Windows\System\XTuArci.exe
  C:\Windows\System\XTuArci.exe
  2⤵
  PID:6788
- C:\Windows\System\pqGYyZa.exe
  C:\Windows\System\pqGYyZa.exe
  2⤵
  PID:7076
- C:\Windows\System\RrmLVpe.exe
  C:\Windows\System\RrmLVpe.exe
  2⤵
  PID:2000
- C:\Windows\System\AfXEuza.exe
  C:\Windows\System\AfXEuza.exe
  2⤵
  PID:6984
- C:\Windows\System\XZPFFej.exe
  C:\Windows\System\XZPFFej.exe
  2⤵
  PID:6916
- C:\Windows\System\OmbqJgM.exe
  C:\Windows\System\OmbqJgM.exe
  2⤵
  PID:7012
- C:\Windows\System\ohEHOfp.exe
  C:\Windows\System\ohEHOfp.exe
  2⤵
  PID:6104
- C:\Windows\System\iFTAMGg.exe
  C:\Windows\System\iFTAMGg.exe
  2⤵
  PID:6408
- C:\Windows\System\yDJAIic.exe
  C:\Windows\System\yDJAIic.exe
  2⤵
  PID:5868
- C:\Windows\System\qggikuD.exe
  C:\Windows\System\qggikuD.exe
  2⤵
  PID:6612
- C:\Windows\System\OWDpnmH.exe
  C:\Windows\System\OWDpnmH.exe
  2⤵
  PID:7172
- C:\Windows\System\BzvKcEk.exe
  C:\Windows\System\BzvKcEk.exe
  2⤵
  PID:7188
- C:\Windows\System\wWEHHnH.exe
  C:\Windows\System\wWEHHnH.exe
  2⤵
  PID:7204
- C:\Windows\System\cGrgqKd.exe
  C:\Windows\System\cGrgqKd.exe
  2⤵
  PID:7220
- C:\Windows\System\cFhpzDL.exe
  C:\Windows\System\cFhpzDL.exe
  2⤵
  PID:7236
- C:\Windows\System\DOWOHtd.exe
  C:\Windows\System\DOWOHtd.exe
  2⤵
  PID:7252
- C:\Windows\System\nSlFvaF.exe
  C:\Windows\System\nSlFvaF.exe
  2⤵
  PID:7268
- C:\Windows\System\uoyaNpL.exe
  C:\Windows\System\uoyaNpL.exe
  2⤵
  PID:7284
- C:\Windows\System\PfqJrYC.exe
  C:\Windows\System\PfqJrYC.exe
  2⤵
  PID:7300
- C:\Windows\System\bUmfhHs.exe
  C:\Windows\System\bUmfhHs.exe
  2⤵
  PID:7316
- C:\Windows\System\cOaDNru.exe
  C:\Windows\System\cOaDNru.exe
  2⤵
  PID:7332
- C:\Windows\System\DBBQrMa.exe
  C:\Windows\System\DBBQrMa.exe
  2⤵
  PID:7348
- C:\Windows\System\QUQxMWh.exe
  C:\Windows\System\QUQxMWh.exe
  2⤵
  PID:7364
- C:\Windows\System\RYiLtbu.exe
  C:\Windows\System\RYiLtbu.exe
  2⤵
  PID:7380
- C:\Windows\System\DkWRJPU.exe
  C:\Windows\System\DkWRJPU.exe
  2⤵
  PID:7396
- C:\Windows\System\RWZZhlG.exe
  C:\Windows\System\RWZZhlG.exe
  2⤵
  PID:7412
- C:\Windows\System\xLFtauX.exe
  C:\Windows\System\xLFtauX.exe
  2⤵
  PID:7428
- C:\Windows\System\aSUYyyj.exe
  C:\Windows\System\aSUYyyj.exe
  2⤵
  PID:7444
- C:\Windows\System\SnANwXR.exe
  C:\Windows\System\SnANwXR.exe
  2⤵
  PID:7460
- C:\Windows\System\oLGpHRm.exe
  C:\Windows\System\oLGpHRm.exe
  2⤵
  PID:7476
- C:\Windows\System\CZOiLuh.exe
  C:\Windows\System\CZOiLuh.exe
  2⤵
  PID:7492
- C:\Windows\System\nSWDxbD.exe
  C:\Windows\System\nSWDxbD.exe
  2⤵
  PID:7508
- C:\Windows\System\cyuKfwB.exe
  C:\Windows\System\cyuKfwB.exe
  2⤵
  PID:7524
- C:\Windows\System\dXlqDHz.exe
  C:\Windows\System\dXlqDHz.exe
  2⤵
  PID:7540
- C:\Windows\System\HZPaIMN.exe
  C:\Windows\System\HZPaIMN.exe
  2⤵
  PID:7556
- C:\Windows\System\mJtFrXH.exe
  C:\Windows\System\mJtFrXH.exe
  2⤵
  PID:7572
- C:\Windows\System\wcODcYq.exe
  C:\Windows\System\wcODcYq.exe
  2⤵
  PID:7588
- C:\Windows\System\kvlbmas.exe
  C:\Windows\System\kvlbmas.exe
  2⤵
  PID:7604
- C:\Windows\System\BtLVjHA.exe
  C:\Windows\System\BtLVjHA.exe
  2⤵
  PID:7620
- C:\Windows\System\wTnoley.exe
  C:\Windows\System\wTnoley.exe
  2⤵
  PID:7636
- C:\Windows\System\hsrZulh.exe
  C:\Windows\System\hsrZulh.exe
  2⤵
  PID:7652
- C:\Windows\System\SshMfaV.exe
  C:\Windows\System\SshMfaV.exe
  2⤵
  PID:7668
- C:\Windows\System\mdqCkTY.exe
  C:\Windows\System\mdqCkTY.exe
  2⤵
  PID:7688
- C:\Windows\System\gWTngzN.exe
  C:\Windows\System\gWTngzN.exe
  2⤵
  PID:7704
- C:\Windows\System\fQiKFnr.exe
  C:\Windows\System\fQiKFnr.exe
  2⤵
  PID:7720
- C:\Windows\System\dmMSexY.exe
  C:\Windows\System\dmMSexY.exe
  2⤵
  PID:7736
- C:\Windows\System\nHtacUd.exe
  C:\Windows\System\nHtacUd.exe
  2⤵
  PID:7752
- C:\Windows\System\smxGrLm.exe
  C:\Windows\System\smxGrLm.exe
  2⤵
  PID:7768
- C:\Windows\System\XhCROVK.exe
  C:\Windows\System\XhCROVK.exe
  2⤵
  PID:7784
- C:\Windows\System\qcVyWgF.exe
  C:\Windows\System\qcVyWgF.exe
  2⤵
  PID:7800
- C:\Windows\System\XyyfXjC.exe
  C:\Windows\System\XyyfXjC.exe
  2⤵
  PID:7816
- C:\Windows\System\MwPhNXZ.exe
  C:\Windows\System\MwPhNXZ.exe
  2⤵
  PID:7832
- C:\Windows\System\lVgnbPV.exe
  C:\Windows\System\lVgnbPV.exe
  2⤵
  PID:7848
- C:\Windows\System\IXvWhFv.exe
  C:\Windows\System\IXvWhFv.exe
  2⤵
  PID:7864
- C:\Windows\System\HSJpaGb.exe
  C:\Windows\System\HSJpaGb.exe
  2⤵
  PID:7940
- C:\Windows\System\DHYALpP.exe
  C:\Windows\System\DHYALpP.exe
  2⤵
  PID:7964
- C:\Windows\System\HyHcUms.exe
  C:\Windows\System\HyHcUms.exe
  2⤵
  PID:7992
- C:\Windows\System\vcwnJuL.exe
  C:\Windows\System\vcwnJuL.exe
  2⤵
  PID:8060
- C:\Windows\System\YJUzwWd.exe
  C:\Windows\System\YJUzwWd.exe
  2⤵
  PID:8076
- C:\Windows\System\FlTjVYF.exe
  C:\Windows\System\FlTjVYF.exe
  2⤵
  PID:6920
- C:\Windows\System\oAEsRbl.exe
  C:\Windows\System\oAEsRbl.exe
  2⤵
  PID:7328
- C:\Windows\System\cFqlMzt.exe
  C:\Windows\System\cFqlMzt.exe
  2⤵
  PID:7392
- C:\Windows\System\uOhNzsg.exe
  C:\Windows\System\uOhNzsg.exe
  2⤵
  PID:7340
- C:\Windows\System\UzCwcoH.exe
  C:\Windows\System\UzCwcoH.exe
  2⤵
  PID:7408
- C:\Windows\System\fKXjoOY.exe
  C:\Windows\System\fKXjoOY.exe
  2⤵
  PID:7484
- C:\Windows\System\EEmqKqh.exe
  C:\Windows\System\EEmqKqh.exe
  2⤵
  PID:7440
- C:\Windows\System\mbXnGhS.exe
  C:\Windows\System\mbXnGhS.exe
  2⤵
  PID:7516
- C:\Windows\System\nfeBPwE.exe
  C:\Windows\System\nfeBPwE.exe
  2⤵
  PID:7580
- C:\Windows\System\fvvpEWU.exe
  C:\Windows\System\fvvpEWU.exe
  2⤵
  PID:7612
- C:\Windows\System\HPdYecN.exe
  C:\Windows\System\HPdYecN.exe
  2⤵
  PID:7532
- C:\Windows\System\nWuWLta.exe
  C:\Windows\System\nWuWLta.exe
  2⤵
  PID:7568
- C:\Windows\System\UQVsYkb.exe
  C:\Windows\System\UQVsYkb.exe
  2⤵
  PID:7680
- C:\Windows\System\dsxMLCN.exe
  C:\Windows\System\dsxMLCN.exe
  2⤵
  PID:7716
- C:\Windows\System\dgUSPGf.exe
  C:\Windows\System\dgUSPGf.exe
  2⤵
  PID:7780
- C:\Windows\System\RIJBdTV.exe
  C:\Windows\System\RIJBdTV.exe
  2⤵
  PID:7840
- C:\Windows\System\cayeXNA.exe
  C:\Windows\System\cayeXNA.exe
  2⤵
  PID:7732
- C:\Windows\System\jJjNWPx.exe
  C:\Windows\System\jJjNWPx.exe
  2⤵
  PID:7796
- C:\Windows\System\WVCPjCj.exe
  C:\Windows\System\WVCPjCj.exe
  2⤵
  PID:7700
- C:\Windows\System\cMJXVIK.exe
  C:\Windows\System\cMJXVIK.exe
  2⤵
  PID:7884
- C:\Windows\System\BlylWRR.exe
  C:\Windows\System\BlylWRR.exe
  2⤵
  PID:7900
- C:\Windows\System\gcJdExV.exe
  C:\Windows\System\gcJdExV.exe
  2⤵
  PID:7952
- C:\Windows\System\QmrtDCl.exe
  C:\Windows\System\QmrtDCl.exe
  2⤵
  PID:8008
- C:\Windows\System\mUwblSJ.exe
  C:\Windows\System\mUwblSJ.exe
  2⤵
  PID:8024
- C:\Windows\System\PiEOZKM.exe
  C:\Windows\System\PiEOZKM.exe
  2⤵
  PID:8036
- C:\Windows\System\GaeOgix.exe
  C:\Windows\System\GaeOgix.exe
  2⤵
  PID:8052
- C:\Windows\System\ftFuJHb.exe
  C:\Windows\System\ftFuJHb.exe
  2⤵
  PID:7936
- C:\Windows\System\ZrLJKGh.exe
  C:\Windows\System\ZrLJKGh.exe
  2⤵
  PID:7976
- C:\Windows\System\Xzerwcy.exe
  C:\Windows\System\Xzerwcy.exe
  2⤵
  PID:8072
- C:\Windows\System\udsiUDF.exe
  C:\Windows\System\udsiUDF.exe
  2⤵
  PID:8088
- C:\Windows\System\OcSxhUt.exe
  C:\Windows\System\OcSxhUt.exe
  2⤵
  PID:8104
- C:\Windows\System\PDNRJxR.exe
  C:\Windows\System\PDNRJxR.exe
  2⤵
  PID:8128
- C:\Windows\System\ebLAVOO.exe
  C:\Windows\System\ebLAVOO.exe
  2⤵
  PID:8140
- C:\Windows\System\hkiZjZN.exe
  C:\Windows\System\hkiZjZN.exe
  2⤵
  PID:8156
- C:\Windows\System\RzJesZP.exe
  C:\Windows\System\RzJesZP.exe
  2⤵
  PID:8176
- C:\Windows\System\lnrxqEI.exe
  C:\Windows\System\lnrxqEI.exe
  2⤵
  PID:8188
- C:\Windows\System\uqjLkTt.exe
  C:\Windows\System\uqjLkTt.exe
  2⤵
  PID:7156
- C:\Windows\System\xzpxCKt.exe
  C:\Windows\System\xzpxCKt.exe
  2⤵
  PID:6964
- C:\Windows\System\gTRBchD.exe
  C:\Windows\System\gTRBchD.exe
  2⤵
  PID:6180
- C:\Windows\System\aVzZQyZ.exe
  C:\Windows\System\aVzZQyZ.exe
  2⤵
  PID:6852
- C:\Windows\System\dSUOYOW.exe
  C:\Windows\System\dSUOYOW.exe
  2⤵
  PID:6436
- C:\Windows\System\qlosBkO.exe
  C:\Windows\System\qlosBkO.exe
  2⤵
  PID:6456
- C:\Windows\System\OrUSspb.exe
  C:\Windows\System\OrUSspb.exe
  2⤵
  PID:7228
- C:\Windows\System\GpMPvIg.exe
  C:\Windows\System\GpMPvIg.exe
  2⤵
  PID:7244
- C:\Windows\System\MzUnNwx.exe
  C:\Windows\System\MzUnNwx.exe
  2⤵
  PID:7292
- C:\Windows\System\KumcpjG.exe
  C:\Windows\System\KumcpjG.exe
  2⤵
  PID:7280
- C:\Windows\System\TLkhheo.exe
  C:\Windows\System\TLkhheo.exe
  2⤵
  PID:7472
- C:\Windows\System\mhVkjDY.exe
  C:\Windows\System\mhVkjDY.exe
  2⤵
  PID:7276
- C:\Windows\System\ggkZCNV.exe
  C:\Windows\System\ggkZCNV.exe
  2⤵
  PID:7684
- C:\Windows\System\JtZoppm.exe
  C:\Windows\System\JtZoppm.exe
  2⤵
  PID:7876
- C:\Windows\System\CaBzWVm.exe
  C:\Windows\System\CaBzWVm.exe
  2⤵
  PID:8016
- C:\Windows\System\GThcacu.exe
  C:\Windows\System\GThcacu.exe
  2⤵
  PID:7928
- C:\Windows\System\rwHtQGk.exe
  C:\Windows\System\rwHtQGk.exe
  2⤵
  PID:8116
- C:\Windows\System\RGouxgc.exe
  C:\Windows\System\RGouxgc.exe
  2⤵
  PID:8180
- C:\Windows\System\cHxtAzQ.exe
  C:\Windows\System\cHxtAzQ.exe
  2⤵
  PID:7196
- C:\Windows\System\RfHIErd.exe
  C:\Windows\System\RfHIErd.exe
  2⤵
  PID:6520
- C:\Windows\System\vrBkxUK.exe
  C:\Windows\System\vrBkxUK.exe
  2⤵
  PID:6824
- C:\Windows\System\wpyFITg.exe
  C:\Windows\System\wpyFITg.exe
  2⤵
  PID:7436
- C:\Windows\System\BNsQZiK.exe
  C:\Windows\System\BNsQZiK.exe
  2⤵
  PID:7184
- C:\Windows\System\iZFKXOu.exe
  C:\Windows\System\iZFKXOu.exe
  2⤵
  PID:7676
- C:\Windows\System\QKDfBbg.exe
  C:\Windows\System\QKDfBbg.exe
  2⤵
  PID:7504
- C:\Windows\System\FjAApHe.exe
  C:\Windows\System\FjAApHe.exe
  2⤵
  PID:8044
- C:\Windows\System\euqtrFR.exe
  C:\Windows\System\euqtrFR.exe
  2⤵
  PID:7628
- C:\Windows\System\TEAcptK.exe
  C:\Windows\System\TEAcptK.exe
  2⤵
  PID:8196
- C:\Windows\System\rNgRztP.exe
  C:\Windows\System\rNgRztP.exe
  2⤵
  PID:8212
- C:\Windows\System\TaKoYLJ.exe
  C:\Windows\System\TaKoYLJ.exe
  2⤵
  PID:8228
- C:\Windows\System\bdcFBlT.exe
  C:\Windows\System\bdcFBlT.exe
  2⤵
  PID:8248
- C:\Windows\System\ItvUuUx.exe
  C:\Windows\System\ItvUuUx.exe
  2⤵
  PID:8268
- C:\Windows\System\TtAFVcW.exe
  C:\Windows\System\TtAFVcW.exe
  2⤵
  PID:8284
- C:\Windows\System\JlTnZbF.exe
  C:\Windows\System\JlTnZbF.exe
  2⤵
  PID:8300
- C:\Windows\System\netcvPJ.exe
  C:\Windows\System\netcvPJ.exe
  2⤵
  PID:8320
- C:\Windows\System\IPeQigu.exe
  C:\Windows\System\IPeQigu.exe
  2⤵
  PID:8340
- C:\Windows\System\yOhZAZJ.exe
  C:\Windows\System\yOhZAZJ.exe
  2⤵
  PID:8356
- C:\Windows\System\Lvywbeg.exe
  C:\Windows\System\Lvywbeg.exe
  2⤵
  PID:8376
- C:\Windows\System\JCyAeKl.exe
  C:\Windows\System\JCyAeKl.exe
  2⤵
  PID:8392
- C:\Windows\System\WhAuqiN.exe
  C:\Windows\System\WhAuqiN.exe
  2⤵
  PID:8408
- C:\Windows\System\gcpanMT.exe
  C:\Windows\System\gcpanMT.exe
  2⤵
  PID:8428
- C:\Windows\System\ZPaGGcd.exe
  C:\Windows\System\ZPaGGcd.exe
  2⤵
  PID:8444
- C:\Windows\System\zCRqAaJ.exe
  C:\Windows\System\zCRqAaJ.exe
  2⤵
  PID:8468
- C:\Windows\System\NXlsOiL.exe
  C:\Windows\System\NXlsOiL.exe
  2⤵
  PID:8484
- C:\Windows\System\JYRCTrq.exe
  C:\Windows\System\JYRCTrq.exe
  2⤵
  PID:8500
- C:\Windows\System\YTGuzvh.exe
  C:\Windows\System\YTGuzvh.exe
  2⤵
  PID:8516
- C:\Windows\System\NFKXLvp.exe
  C:\Windows\System\NFKXLvp.exe
  2⤵
  PID:8532
- C:\Windows\System\zJZVPzo.exe
  C:\Windows\System\zJZVPzo.exe
  2⤵
  PID:8548
- C:\Windows\System\FlmecHg.exe
  C:\Windows\System\FlmecHg.exe
  2⤵
  PID:8564
- C:\Windows\System\PfkahCE.exe
  C:\Windows\System\PfkahCE.exe
  2⤵
  PID:8580
- C:\Windows\System\xbUYxDx.exe
  C:\Windows\System\xbUYxDx.exe
  2⤵
  PID:8600
- C:\Windows\System\DdvbFyY.exe
  C:\Windows\System\DdvbFyY.exe
  2⤵
  PID:8616
- C:\Windows\System\KTSKtRm.exe
  C:\Windows\System\KTSKtRm.exe
  2⤵
  PID:8632
- C:\Windows\System\LVSRDVT.exe
  C:\Windows\System\LVSRDVT.exe
  2⤵
  PID:8648
- C:\Windows\System\ZqDxnss.exe
  C:\Windows\System\ZqDxnss.exe
  2⤵
  PID:8664
- C:\Windows\System\OhxIJvW.exe
  C:\Windows\System\OhxIJvW.exe
  2⤵
  PID:8680
- C:\Windows\System\vSVJyYH.exe
  C:\Windows\System\vSVJyYH.exe
  2⤵
  PID:8696
- C:\Windows\System\nPcMZZf.exe
  C:\Windows\System\nPcMZZf.exe
  2⤵
  PID:8712
- C:\Windows\System\yhywlAG.exe
  C:\Windows\System\yhywlAG.exe
  2⤵
  PID:8728
- C:\Windows\System\ykabAMj.exe
  C:\Windows\System\ykabAMj.exe
  2⤵
  PID:8744
- C:\Windows\System\uLiQdXb.exe
  C:\Windows\System\uLiQdXb.exe
  2⤵
  PID:8760
- C:\Windows\System\koEVHzS.exe
  C:\Windows\System\koEVHzS.exe
  2⤵
  PID:8776
- C:\Windows\System\acacRNQ.exe
  C:\Windows\System\acacRNQ.exe
  2⤵
  PID:8792
- C:\Windows\System\TMcceqO.exe
  C:\Windows\System\TMcceqO.exe
  2⤵
  PID:8808
- C:\Windows\System\DWRxOXv.exe
  C:\Windows\System\DWRxOXv.exe
  2⤵
  PID:8824
- C:\Windows\System\vIdewag.exe
  C:\Windows\System\vIdewag.exe
  2⤵
  PID:8840
- C:\Windows\System\KlkaOxk.exe
  C:\Windows\System\KlkaOxk.exe
  2⤵
  PID:8856
- C:\Windows\System\rSlZUOh.exe
  C:\Windows\System\rSlZUOh.exe
  2⤵
  PID:8872
- C:\Windows\System\iGrbSho.exe
  C:\Windows\System\iGrbSho.exe
  2⤵
  PID:8888
- C:\Windows\System\vNiVbkQ.exe
  C:\Windows\System\vNiVbkQ.exe
  2⤵
  PID:8904
- C:\Windows\System\RUyneTd.exe
  C:\Windows\System\RUyneTd.exe
  2⤵
  PID:8920
- C:\Windows\System\iXkElfK.exe
  C:\Windows\System\iXkElfK.exe
  2⤵
  PID:8936
- C:\Windows\System\OHrrjKc.exe
  C:\Windows\System\OHrrjKc.exe
  2⤵
  PID:8952
- C:\Windows\System\VsGNDLb.exe
  C:\Windows\System\VsGNDLb.exe
  2⤵
  PID:8968
- C:\Windows\System\vdyfkzO.exe
  C:\Windows\System\vdyfkzO.exe
  2⤵
  PID:8984
- C:\Windows\System\aqKrSSp.exe
  C:\Windows\System\aqKrSSp.exe
  2⤵
  PID:9000
- C:\Windows\System\rlpywPa.exe
  C:\Windows\System\rlpywPa.exe
  2⤵
  PID:9016
- C:\Windows\System\ekEhSIe.exe
  C:\Windows\System\ekEhSIe.exe
  2⤵
  PID:9032
- C:\Windows\System\AOlONQo.exe
  C:\Windows\System\AOlONQo.exe
  2⤵
  PID:9048
- C:\Windows\System\FSNGNgl.exe
  C:\Windows\System\FSNGNgl.exe
  2⤵
  PID:9064
- C:\Windows\System\DCnWUYC.exe
  C:\Windows\System\DCnWUYC.exe
  2⤵
  PID:9080
- C:\Windows\System\coAEvxF.exe
  C:\Windows\System\coAEvxF.exe
  2⤵
  PID:9096
- C:\Windows\System\RRGgfWd.exe
  C:\Windows\System\RRGgfWd.exe
  2⤵
  PID:9112
- C:\Windows\System\MdpuIkI.exe
  C:\Windows\System\MdpuIkI.exe
  2⤵
  PID:9128
- C:\Windows\System\KFXYOVZ.exe
  C:\Windows\System\KFXYOVZ.exe
  2⤵
  PID:9144
- C:\Windows\System\XDENyaF.exe
  C:\Windows\System\XDENyaF.exe
  2⤵
  PID:9160
- C:\Windows\System\bHXgQid.exe
  C:\Windows\System\bHXgQid.exe
  2⤵
  PID:9176
- C:\Windows\System\QiyPlwS.exe
  C:\Windows\System\QiyPlwS.exe
  2⤵
  PID:9192
- C:\Windows\System\ORdYrcc.exe
  C:\Windows\System\ORdYrcc.exe
  2⤵
  PID:9208
- C:\Windows\System\kFbxiqY.exe
  C:\Windows\System\kFbxiqY.exe
  2⤵
  PID:7764
- C:\Windows\System\oOBfDhV.exe
  C:\Windows\System\oOBfDhV.exe
  2⤵
  PID:8220
- C:\Windows\System\yrfjSiu.exe
  C:\Windows\System\yrfjSiu.exe
  2⤵
  PID:8264
- C:\Windows\System\bxVrFuW.exe
  C:\Windows\System\bxVrFuW.exe
  2⤵
  PID:8332
- C:\Windows\System\wWgMNAc.exe
  C:\Windows\System\wWgMNAc.exe
  2⤵
  PID:8364
- C:\Windows\System\neoKJyk.exe
  C:\Windows\System\neoKJyk.exe
  2⤵
  PID:7648
- C:\Windows\System\xIQmnFv.exe
  C:\Windows\System\xIQmnFv.exe
  2⤵
  PID:7728
- C:\Windows\System\gATgpDW.exe
  C:\Windows\System\gATgpDW.exe
  2⤵
  PID:7892
- C:\Windows\System\fowoAPS.exe
  C:\Windows\System\fowoAPS.exe
  2⤵
  PID:8032
- C:\Windows\System\RNdaWkU.exe
  C:\Windows\System\RNdaWkU.exe
  2⤵
  PID:7988
- C:\Windows\System\fMDDdFm.exe
  C:\Windows\System\fMDDdFm.exe
  2⤵
  PID:8136
- C:\Windows\System\zzoizeI.exe
  C:\Windows\System\zzoizeI.exe
  2⤵
  PID:7000
- C:\Windows\System\tiCvAHB.exe
  C:\Windows\System\tiCvAHB.exe
  2⤵
  PID:8440
- C:\Windows\System\ZlNWIvq.exe
  C:\Windows\System\ZlNWIvq.exe
  2⤵
  PID:8204
- C:\Windows\System\TzjtaZK.exe
  C:\Windows\System\TzjtaZK.exe
  2⤵
  PID:6948
- C:\Windows\System\UMrxVqu.exe
  C:\Windows\System\UMrxVqu.exe
  2⤵
  PID:7424
- C:\Windows\System\CempQiy.exe
  C:\Windows\System\CempQiy.exe
  2⤵
  PID:8056
- C:\Windows\System\xHFRZfS.exe
  C:\Windows\System\xHFRZfS.exe
  2⤵
  PID:8112
- C:\Windows\System\mHXgaot.exe
  C:\Windows\System\mHXgaot.exe
  2⤵
  PID:6872
- C:\Windows\System\GIctwhb.exe
  C:\Windows\System\GIctwhb.exe
  2⤵
  PID:6392
- C:\Windows\System\pzSfJwr.exe
  C:\Windows\System\pzSfJwr.exe
  2⤵
  PID:8236
- C:\Windows\System\BtNQGog.exe
  C:\Windows\System\BtNQGog.exe
  2⤵
  PID:8280
- C:\Windows\System\ZFVDfVh.exe
  C:\Windows\System\ZFVDfVh.exe
  2⤵
  PID:8352
- C:\Windows\System\ZmHoqls.exe
  C:\Windows\System\ZmHoqls.exe
  2⤵
  PID:8420
- C:\Windows\System\KzCxIHL.exe
  C:\Windows\System\KzCxIHL.exe
  2⤵
  PID:8464
- C:\Windows\System\aPRLpJb.exe
  C:\Windows\System\aPRLpJb.exe
  2⤵
  PID:8476
- C:\Windows\System\gIFBpRT.exe
  C:\Windows\System\gIFBpRT.exe
  2⤵
  PID:8544
- C:\Windows\System\oGgVrVC.exe
  C:\Windows\System\oGgVrVC.exe
  2⤵
  PID:8608
- C:\Windows\System\DOeYISf.exe
  C:\Windows\System\DOeYISf.exe
  2⤵
  PID:8672
- C:\Windows\System\knImPDN.exe
  C:\Windows\System\knImPDN.exe
  2⤵
  PID:8736
- C:\Windows\System\BiEjaNC.exe
  C:\Windows\System\BiEjaNC.exe
  2⤵
  PID:8800
- C:\Windows\System\HJdwDmH.exe
  C:\Windows\System\HJdwDmH.exe
  2⤵
  PID:8836
- C:\Windows\System\YNrguWl.exe
  C:\Windows\System\YNrguWl.exe
  2⤵
  PID:8900
- C:\Windows\System\mFLQXEF.exe
  C:\Windows\System\mFLQXEF.exe
  2⤵
  PID:8964
- C:\Windows\System\TOmnace.exe
  C:\Windows\System\TOmnace.exe
  2⤵
  PID:9056
- C:\Windows\System\smFPLJW.exe
  C:\Windows\System\smFPLJW.exe
  2⤵
  PID:8592
- C:\Windows\System\hGyxFSu.exe
  C:\Windows\System\hGyxFSu.exe
  2⤵
  PID:8756
- C:\Windows\System\RRVgRbN.exe
  C:\Windows\System\RRVgRbN.exe
  2⤵
  PID:8628
- C:\Windows\System\QUyWXVK.exe
  C:\Windows\System\QUyWXVK.exe
  2⤵
  PID:8692
- C:\Windows\System\IXatEUc.exe
  C:\Windows\System\IXatEUc.exe
  2⤵
  PID:8852
- C:\Windows\System\hSkBBdg.exe
  C:\Windows\System\hSkBBdg.exe
  2⤵
  PID:8916
- C:\Windows\System\YegYVVs.exe
  C:\Windows\System\YegYVVs.exe
  2⤵
  PID:8980
- C:\Windows\System\FHpzyFd.exe
  C:\Windows\System\FHpzyFd.exe
  2⤵
  PID:9044
- C:\Windows\System\rZqbGBs.exe
  C:\Windows\System\rZqbGBs.exe
  2⤵
  PID:9120
- C:\Windows\System\HjAZqKV.exe
  C:\Windows\System\HjAZqKV.exe
  2⤵
  PID:9184
- C:\Windows\System\RBSFKjQ.exe
  C:\Windows\System\RBSFKjQ.exe
  2⤵
  PID:8256
- C:\Windows\System\dlNUfFb.exe
  C:\Windows\System\dlNUfFb.exe
  2⤵
  PID:9200
- C:\Windows\System\hUQZNWI.exe
  C:\Windows\System\hUQZNWI.exe
  2⤵
  PID:7404
- C:\Windows\System\FDFfwRf.exe
  C:\Windows\System\FDFfwRf.exe
  2⤵
  PID:8328
- C:\Windows\System\yxxoUIm.exe
  C:\Windows\System\yxxoUIm.exe
  2⤵
  PID:7748
- C:\Windows\System\oYtgokd.exe
  C:\Windows\System\oYtgokd.exe
  2⤵
  PID:8000
- C:\Windows\System\VwuQImd.exe
  C:\Windows\System\VwuQImd.exe
  2⤵
  PID:8132
- C:\Windows\System\quraIrW.exe
  C:\Windows\System\quraIrW.exe
  2⤵
  PID:7924
- C:\Windows\System\maDWgWD.exe
  C:\Windows\System\maDWgWD.exe
  2⤵
  PID:7860
- C:\Windows\System\DHdfKuX.exe
  C:\Windows\System\DHdfKuX.exe
  2⤵
  PID:7296
- C:\Windows\System\DVdxvVM.exe
  C:\Windows\System\DVdxvVM.exe
  2⤵
  PID:7932
- C:\Windows\System\QmiIQYD.exe
  C:\Windows\System\QmiIQYD.exe
  2⤵
  PID:7644
- C:\Windows\System\BinuwWI.exe
  C:\Windows\System\BinuwWI.exe
  2⤵
  PID:7388
- C:\Windows\System\sYybsBv.exe
  C:\Windows\System\sYybsBv.exe
  2⤵
  PID:8456
- C:\Windows\System\keNPVvu.exe
  C:\Windows\System\keNPVvu.exe
  2⤵
  PID:8512
- C:\Windows\System\ZUOeezE.exe
  C:\Windows\System\ZUOeezE.exe
  2⤵
  PID:8416
- C:\Windows\System\KDtaTlo.exe
  C:\Windows\System\KDtaTlo.exe
  2⤵
  PID:8388
- C:\Windows\System\RSCUAul.exe
  C:\Windows\System\RSCUAul.exe
  2⤵
  PID:8868
- C:\Windows\System\ypJuHAl.exe
  C:\Windows\System\ypJuHAl.exe
  2⤵
  PID:8996
- C:\Windows\System\sjwMrYq.exe
  C:\Windows\System\sjwMrYq.exe
  2⤵
  PID:8596
- C:\Windows\System\RdYIPdz.exe
  C:\Windows\System\RdYIPdz.exe
  2⤵
  PID:8832
- C:\Windows\System\vPvndWW.exe
  C:\Windows\System\vPvndWW.exe
  2⤵
  PID:8624
- C:\Windows\System\jnKsxsQ.exe
  C:\Windows\System\jnKsxsQ.exe
  2⤵
  PID:8556
- C:\Windows\System\aeyQXZk.exe
  C:\Windows\System\aeyQXZk.exe
  2⤵
  PID:8912
- C:\Windows\System\sEiwBpt.exe
  C:\Windows\System\sEiwBpt.exe
  2⤵
  PID:8976
- C:\Windows\System\aRthJeY.exe
  C:\Windows\System\aRthJeY.exe
  2⤵
  PID:9156
- C:\Windows\System\GXVEvwW.exe
  C:\Windows\System\GXVEvwW.exe
  2⤵
  PID:7216
- C:\Windows\System\CMYUztw.exe
  C:\Windows\System\CMYUztw.exe
  2⤵
  PID:8296
- C:\Windows\System\CYlvKGc.exe
  C:\Windows\System\CYlvKGc.exe
  2⤵
  PID:7916
- C:\Windows\System\TiSoHRi.exe
  C:\Windows\System\TiSoHRi.exe
  2⤵
  PID:9028
- C:\Windows\System\rwbujoF.exe
  C:\Windows\System\rwbujoF.exe
  2⤵
  PID:8896
- C:\Windows\System\bEKNhdV.exe
  C:\Windows\System\bEKNhdV.exe
  2⤵
  PID:8708
- C:\Windows\System\RYlJWmb.exe
  C:\Windows\System\RYlJWmb.exe
  2⤵
  PID:8948
- C:\Windows\System\UgejfEd.exe
  C:\Windows\System\UgejfEd.exe
  2⤵
  PID:7260
- C:\Windows\System\JBrpPEi.exe
  C:\Windows\System\JBrpPEi.exe
  2⤵
  PID:9108
- C:\Windows\System\oFTfgpj.exe
  C:\Windows\System\oFTfgpj.exe
  2⤵
  PID:8372
- C:\Windows\System\yGmYsVx.exe
  C:\Windows\System\yGmYsVx.exe
  2⤵
  PID:7596
- C:\Windows\System\sPXWyhc.exe
  C:\Windows\System\sPXWyhc.exe
  2⤵
  PID:8084
- C:\Windows\System\hSIlCMd.exe
  C:\Windows\System\hSIlCMd.exe
  2⤵
  PID:8208
- C:\Windows\System\deZEUlj.exe
  C:\Windows\System\deZEUlj.exe
  2⤵
  PID:8588
- C:\Windows\System\zqGfAnq.exe
  C:\Windows\System\zqGfAnq.exe
  2⤵
  PID:8704
- C:\Windows\System\ageccVb.exe
  C:\Windows\System\ageccVb.exe
  2⤵
  PID:9092
- C:\Windows\System\qMGTedc.exe
  C:\Windows\System\qMGTedc.exe
  2⤵
  PID:7552
- C:\Windows\System\LAdiiKT.exe
  C:\Windows\System\LAdiiKT.exe
  2⤵
  PID:8960
- C:\Windows\System\mhOxOXA.exe
  C:\Windows\System\mhOxOXA.exe
  2⤵
  PID:8460
- C:\Windows\System\njBQAjm.exe
  C:\Windows\System\njBQAjm.exe
  2⤵
  PID:9136
- C:\Windows\System\BwCQyRd.exe
  C:\Windows\System\BwCQyRd.exe
  2⤵
  PID:8508
- C:\Windows\System\TiWKuWR.exe
  C:\Windows\System\TiWKuWR.exe
  2⤵
  PID:8784
- C:\Windows\System\fQGgbJK.exe
  C:\Windows\System\fQGgbJK.exe
  2⤵
  PID:5500
- C:\Windows\System\bhOdXLk.exe
  C:\Windows\System\bhOdXLk.exe
  2⤵
  PID:8816
- C:\Windows\System\tyUVjzw.exe
  C:\Windows\System\tyUVjzw.exe
  2⤵
  PID:9220
- C:\Windows\System\jkPOBuT.exe
  C:\Windows\System\jkPOBuT.exe
  2⤵
  PID:9236
- C:\Windows\System\cvMrCob.exe
  C:\Windows\System\cvMrCob.exe
  2⤵
  PID:9252
- C:\Windows\System\gQEQzsY.exe
  C:\Windows\System\gQEQzsY.exe
  2⤵
  PID:9272
- C:\Windows\System\VPtqFTb.exe
  C:\Windows\System\VPtqFTb.exe
  2⤵
  PID:9356
- C:\Windows\System\ubNBnSH.exe
  C:\Windows\System\ubNBnSH.exe
  2⤵
  PID:9376
- C:\Windows\System\FbDKAED.exe
  C:\Windows\System\FbDKAED.exe
  2⤵
  PID:9392
- C:\Windows\System\AaDkdYn.exe
  C:\Windows\System\AaDkdYn.exe
  2⤵
  PID:9408
- C:\Windows\System\rpdiAZS.exe
  C:\Windows\System\rpdiAZS.exe
  2⤵
  PID:9424
- C:\Windows\System\pUpFqHP.exe
  C:\Windows\System\pUpFqHP.exe
  2⤵
  PID:9440
- C:\Windows\System\caJJVFC.exe
  C:\Windows\System\caJJVFC.exe
  2⤵
  PID:9460
- C:\Windows\System\clrnESd.exe
  C:\Windows\System\clrnESd.exe
  2⤵
  PID:9476
- C:\Windows\System\PviGqZy.exe
  C:\Windows\System\PviGqZy.exe
  2⤵
  PID:9492
- C:\Windows\System\WYeFyEE.exe
  C:\Windows\System\WYeFyEE.exe
  2⤵
  PID:9508
- C:\Windows\System\qXYhGBo.exe
  C:\Windows\System\qXYhGBo.exe
  2⤵
  PID:9524
- C:\Windows\System\HBptrtd.exe
  C:\Windows\System\HBptrtd.exe
  2⤵
  PID:9540
- C:\Windows\System\hFUpOMI.exe
  C:\Windows\System\hFUpOMI.exe
  2⤵
  PID:9556
- C:\Windows\System\araHtiY.exe
  C:\Windows\System\araHtiY.exe
  2⤵
  PID:9572
- C:\Windows\System\gEglJSo.exe
  C:\Windows\System\gEglJSo.exe
  2⤵
  PID:9588
- C:\Windows\System\iTWqFMy.exe
  C:\Windows\System\iTWqFMy.exe
  2⤵
  PID:9604
- C:\Windows\System\qmMssFr.exe
  C:\Windows\System\qmMssFr.exe
  2⤵
  PID:9620
- C:\Windows\System\libeEfL.exe
  C:\Windows\System\libeEfL.exe
  2⤵
  PID:9636
- C:\Windows\System\zEzoKOR.exe
  C:\Windows\System\zEzoKOR.exe
  2⤵
  PID:9652
- C:\Windows\System\bfiMvLS.exe
  C:\Windows\System\bfiMvLS.exe
  2⤵
  PID:9668
- C:\Windows\System\NRRaxkB.exe
  C:\Windows\System\NRRaxkB.exe
  2⤵
  PID:9684
- C:\Windows\System\GgGVsXB.exe
  C:\Windows\System\GgGVsXB.exe
  2⤵
  PID:9700
- C:\Windows\System\waNQpvm.exe
  C:\Windows\System\waNQpvm.exe
  2⤵
  PID:9716
- C:\Windows\System\xPhZCsC.exe
  C:\Windows\System\xPhZCsC.exe
  2⤵
  PID:9732
- C:\Windows\System\wNbNwaa.exe
  C:\Windows\System\wNbNwaa.exe
  2⤵
  PID:9748
- C:\Windows\System\mDcKSkJ.exe
  C:\Windows\System\mDcKSkJ.exe
  2⤵
  PID:9764
- C:\Windows\System\jzolYjH.exe
  C:\Windows\System\jzolYjH.exe
  2⤵
  PID:9780
- C:\Windows\System\xovIMQS.exe
  C:\Windows\System\xovIMQS.exe
  2⤵
  PID:9796
- C:\Windows\System\CWniTaR.exe
  C:\Windows\System\CWniTaR.exe
  2⤵
  PID:9824
- C:\Windows\System\ZOLoypc.exe
  C:\Windows\System\ZOLoypc.exe
  2⤵
  PID:9856
- C:\Windows\System\dmzskqM.exe
  C:\Windows\System\dmzskqM.exe
  2⤵
  PID:9872
- C:\Windows\System\BkmRMlH.exe
  C:\Windows\System\BkmRMlH.exe
  2⤵
  PID:9892
- C:\Windows\System\iHgZiGw.exe
  C:\Windows\System\iHgZiGw.exe
  2⤵
  PID:9912
- C:\Windows\System\CIhvdzT.exe
  C:\Windows\System\CIhvdzT.exe
  2⤵
  PID:9944
- C:\Windows\System\ezTBnLG.exe
  C:\Windows\System\ezTBnLG.exe
  2⤵
  PID:9976
- C:\Windows\System\SULCoYj.exe
  C:\Windows\System\SULCoYj.exe
  2⤵
  PID:10008
- C:\Windows\System\irhONQS.exe
  C:\Windows\System\irhONQS.exe
  2⤵
  PID:10024
- C:\Windows\System\vxCgdeK.exe
  C:\Windows\System\vxCgdeK.exe
  2⤵
  PID:10044
- C:\Windows\System\qpKUDdf.exe
  C:\Windows\System\qpKUDdf.exe
  2⤵
  PID:10060
- C:\Windows\System\BlgLgYn.exe
  C:\Windows\System\BlgLgYn.exe
  2⤵
  PID:10076
- C:\Windows\System\rGiBIjQ.exe
  C:\Windows\System\rGiBIjQ.exe
  2⤵
  PID:10092
- C:\Windows\System\cQXvQvS.exe
  C:\Windows\System\cQXvQvS.exe
  2⤵
  PID:10108
- C:\Windows\System\Lcotwgt.exe
  C:\Windows\System\Lcotwgt.exe
  2⤵
  PID:10124
- C:\Windows\System\ErQResq.exe
  C:\Windows\System\ErQResq.exe
  2⤵
  PID:10140
- C:\Windows\System\ATmwPvK.exe
  C:\Windows\System\ATmwPvK.exe
  2⤵
  PID:10156
- C:\Windows\System\oyvRgIw.exe
  C:\Windows\System\oyvRgIw.exe
  2⤵
  PID:10172
- C:\Windows\System\VdHzgLS.exe
  C:\Windows\System\VdHzgLS.exe
  2⤵
  PID:10188
- C:\Windows\System\fLKVwIK.exe
  C:\Windows\System\fLKVwIK.exe
  2⤵
  PID:10204
- C:\Windows\System\coXjGQq.exe
  C:\Windows\System\coXjGQq.exe
  2⤵
  PID:10220
- C:\Windows\System\AIEcgXd.exe
  C:\Windows\System\AIEcgXd.exe
  2⤵
  PID:10236
- C:\Windows\System\qTFgVNw.exe
  C:\Windows\System\qTFgVNw.exe
  2⤵
  PID:9264
- C:\Windows\System\TRSdfZH.exe
  C:\Windows\System\TRSdfZH.exe
  2⤵
  PID:8436
- C:\Windows\System\pavBqDc.exe
  C:\Windows\System\pavBqDc.exe
  2⤵
  PID:9244
- C:\Windows\System\dxaAUjD.exe
  C:\Windows\System\dxaAUjD.exe
  2⤵
  PID:9288
- C:\Windows\System\BRvLFya.exe
  C:\Windows\System\BRvLFya.exe
  2⤵
  PID:9372
- C:\Windows\System\aWrdane.exe
  C:\Windows\System\aWrdane.exe
  2⤵
  PID:9436
- C:\Windows\System\WkZzuqJ.exe
  C:\Windows\System\WkZzuqJ.exe
  2⤵
  PID:9384
- C:\Windows\System\qdeglgG.exe
  C:\Windows\System\qdeglgG.exe
  2⤵
  PID:9564
- C:\Windows\System\NLeZeaz.exe
  C:\Windows\System\NLeZeaz.exe
  2⤵
  PID:9628
- C:\Windows\System\BrpDaCD.exe
  C:\Windows\System\BrpDaCD.exe
  2⤵
  PID:9692
- C:\Windows\System\gOpQzCB.exe
  C:\Windows\System\gOpQzCB.exe
  2⤵
  PID:9552
- C:\Windows\System\yTdVUUJ.exe
  C:\Windows\System\yTdVUUJ.exe
  2⤵
  PID:9456
- C:\Windows\System\OUNheOW.exe
  C:\Windows\System\OUNheOW.exe
  2⤵
  PID:9520
- C:\Windows\System\zPvPbmz.exe
  C:\Windows\System\zPvPbmz.exe
  2⤵
  PID:9612
- C:\Windows\System\ynEZxuW.exe
  C:\Windows\System\ynEZxuW.exe
  2⤵
  PID:9676
- C:\Windows\System\hGTkaSH.exe
  C:\Windows\System\hGTkaSH.exe
  2⤵
  PID:9728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BBsyWgG.exe

Filesize
2.1MB

MD5
36cd862617a5ed2ee8b23bd03cbd01ec

SHA1
0dfb9fdf5200a100927da160766d859207b3eacd

SHA256
6b37f8d79e997e3ec6b79b7db8d5a2ebfffdf55a97050ba2584f90c877e481ca

SHA512
39655aec1920dd6824c60909881e9caf370f9724baa628b2786da3db0bd26fc9676d4eac325c3884854b224d9cb92d9fe44e06d200d65031cc1f9f01f92e0298

Download Submit
C:\Windows\system\FFBWebQ.exe

Filesize
2.1MB

MD5
867194cd7bd39a226582832f457725ac

SHA1
81a4e7876a686415916925592db41b60ae1ae9bd

SHA256
bb81a53c4a7cb63187d84a3d9017ab6afa6e40655ea68ee2ffa4d35ee945c891

SHA512
322a0c3d8d116c5ca135f389f3679944aac09d955e6323b4b6233686ab4bdbc84821ba023bc76c90c9d7ff56fd6ef4d01865e233444f913e7e52f885b3c0812a

Download Submit
C:\Windows\system\HYKCVvD.exe

Filesize
2.1MB

MD5
0a53d09e2f7fa1e60f07519215d37cdf

SHA1
3afbd45e1ad34e33a365d1c04826e9ddc67ea3a6

SHA256
ad10f9a09cdb6f6201802455ae59b5bf12eaf8b56ed61f137ce7bc699e05bfe7

SHA512
09855385a00a422debf9594a4be0b128e674b8a9fa54a06f50524ae4049bc276b4e6b73d95ee2a00838a160066e8ec6ccd6628df961bacdf597b3dee815018be

Download Submit
C:\Windows\system\LGjtOvV.exe

Filesize
2.1MB

MD5
1b75f7c1a5dc311c591ee448b3f97fec

SHA1
656413d6bb4047f1f62ff984fb451466a25f76b1

SHA256
21e1b295939d30cc08adf723bec246987e40e9f198a0c024594564c63bcb3209

SHA512
ec775b1a702430c1f319e2eb4fcbac2867474748f601492f4bc59ecc19a576299e0d09860eba5ea3e6b9d253c08560c33ed54eb9b4077af06872df6cb550437f

Download Submit
C:\Windows\system\PDRGFhe.exe

Filesize
2.1MB

MD5
6f33214a579a5e4b285266b87172a869

SHA1
3fcbaf7dc2f9ca864eb11a9532a1f9f4e2a347b4

SHA256
66517290673fe896b71b64e0558b7a668a56f668f9efa33a240bf60d73ada980

SHA512
c0138459046cae11f6ff76e65b13945a4aa080abe94bb5185a78e3bcf08d5c1025f023e075b9b4dd5640672e5efb2b866708d26bb9ad693d382aa161fa98c67e

Download Submit
C:\Windows\system\PckjvhP.exe

Filesize
2.1MB

MD5
4fe96d434cd3f59175663e004c9cbcbc

SHA1
f445bcc155355d1d46bda3a048f21ac3b2d0f512

SHA256
edc43c4184d51c06c72b899257d064d0c9fe6bc13b0786e3420076f1a5967578

SHA512
9288e1db7540f3d56b7cb340d84a65ef0b0352c05e975ddf8287eb9e5f7e4fa959d15e67370fd316a769961cecb708c78e3ccd16fdebb09c1a9c5c58c9d13cbd

Download Submit
C:\Windows\system\StnmhJM.exe

Filesize
2.1MB

MD5
547bddc02f886eedeb0bd465bfff3055

SHA1
2df0002037f47898a07d18600e8d6c1d9266369b

SHA256
58717219779c5944f95bb71547da032831f44b72229ac2f63d3fd68aa1d9367a

SHA512
3f17ffe2eeecc28d59390db0222213f98d759faed83dd360798ba9c41106cdb85118ee4f43a14a16fe90cae29a7f69f99899996ae7e7caee6b989999dc5c2e22

Download Submit
C:\Windows\system\WUTMsja.exe

Filesize
2.1MB

MD5
e6e89c0e5c773edac7c5942c3521ba58

SHA1
157c33216b9616b1570ed1b3891d689b6760da56

SHA256
838eb41277728a29a2aadb1f53c9d8b245c7c1a591007f9ce700e51ac885ea7b

SHA512
324ece745745500c0e0e2e3190e90c9c57c296abafe39e466b6ff620f0488e0fcc3fcff2cc32967f0d489de16fd334e5f469eed9c49b6bb6808f9f137e30e3ae

Download Submit
C:\Windows\system\WcfANEn.exe

Filesize
2.1MB

MD5
8bb2e45b248a4d8215ca6c065d7a0ba8

SHA1
d1dbe046964297966fedb0bb67c2b6a14fa163c7

SHA256
f53c88d06dcffc56074de8b2754db93e4c80776fe048ebda3523ad9ae4c1fc16

SHA512
ca0b2396e3faba1a713c4d9a1d8dc6f47a1b645357cfd5a7fb4913a658ea0cd4fc11ebbdf7233d5b524e8f9c9718381d67e19b41ebe48c338045a1dec94a6437

Download Submit
C:\Windows\system\aYMBkdQ.exe

Filesize
2.1MB

MD5
0e37a2d5477fb949bfce97719612312d

SHA1
c3240d0aa3ff1906142e784a7e0d1e4e5f7ba4c4

SHA256
cc7360c2234a32fc017e852b51da2b40093623aac561e0936fed61b6cba5e7c8

SHA512
50f974e163d4e86db774d75e9e61f9d8a76cb61b770bb940248aa238f2f8f10d36a1d6314ca6dd91a5361a94ccd94effc9982ad90f72678c876a9a669cce11be

Download Submit
C:\Windows\system\bVOXdkS.exe

Filesize
2.1MB

MD5
3ab66260d456d669ae7859eea970ca1a

SHA1
c2f4ec6ae832b2f9af2210dd680fd82ba7f7f2aa

SHA256
8468921ad1a9f694e2d78b0ee96a3788340473189cad4617fc4a3bc04e818b38

SHA512
c1b2847850b48a92dc9fd46b3e25685150c077722f29443e7da46aeccbe0aa50b2d1c3d187619e7358ca855a50e89834414385b536dde4a511179a29d179119f

Download Submit
C:\Windows\system\ccKzEPz.exe

Filesize
2.1MB

MD5
847dd11eb7831c76e5d1642aa9348bc9

SHA1
23a725628b9c3e7d457cdb9b02ae6beffe16984d

SHA256
540e1adf7ffae612c32bc769f0ccfe32ab2598ba708f9833c795c34cda2baa16

SHA512
71723a033d6a036a197ab76135b2c567c57009380dbab54f08d2e5aa9b564e9a67fa867d26e6ddb85776219db94f05a9fead286a6431f87809425180ed24dfd1

Download Submit
C:\Windows\system\eysYuwT.exe

Filesize
2.1MB

MD5
de9d428ccbdd1d639378247283f40072

SHA1
8354c6bbcd4fba511fd50acba00230166f3a3ced

SHA256
78d47afc2f6ad68a1ef58490c95c243dd41dd21f053da2e2e66eb4492fa256fb

SHA512
b2f7fbc8bf063fa41b17526587305e9f28a550ddb7fe09d6f1dbda0080be82793b0f57d92515e7b22c652f16e23f0c0dcae232bc145bdbb21ea3898a0dd8a3d0

Download Submit
C:\Windows\system\fTDburT.exe

Filesize
2.1MB

MD5
ffd87c407ac6fd954b7e3710a1774252

SHA1
eab4638a9ac13114673a9797f6f876b1ca090ce0

SHA256
21be2883c59e23635faf954b9007968281fdc6c2c95cc2f80ef0b2cd46c9aa9f

SHA512
f74c3cc58cb0a7699c6c72e30f6c1158d9b03b9bf3cf0240c5de01b28ce62212c0b25a09f3edcc54e69d832d46435a3d03205fd19176652852e032b25d01c538

Download Submit
C:\Windows\system\gySPAkQ.exe

Filesize
2.1MB

MD5
592416fd0ef292d88d104134c58a838e

SHA1
af5b20e453562fa4ac4e45f48a9f5e0d88368a96

SHA256
890fbbef6930113e562168596d1b5a524de3be952ffc2ffc8d0eb5d00998cd43

SHA512
c577cc5e96758ead5e784373d6752fc7b981b7d961ae4273b56af30777546724a7d0c9eeace3f02efb6ffcf0deb68236ac501a22232531d733ca0dee9b4b4ac9

Download Submit
C:\Windows\system\jYSxdJW.exe

Filesize
2.1MB

MD5
5755dd3d7c8bec2eda823e71c7b50fa5

SHA1
38c66a82eb04da380e4c4edea49c8a71f7ca77a5

SHA256
42af2cff25af9e4911ef5114f1f4f36365571f99043e3fef1cf5c77bae79015b

SHA512
3d04121e1c6a949099b84c9b3bb3842de3ca4a0ff20e26f2c5c2c31b41cbc145484526eb9d294f711cd11771bacd645a012ea2852eb797216275d551f2b36c82

Download Submit
C:\Windows\system\lbAHEgF.exe

Filesize
2.1MB

MD5
dd0b2cf4b3ca6cee02ad509917ac3a24

SHA1
1dd04e5b489522b48834b90ec322ac35b7bff86f

SHA256
b0dd0815aa271fb475f920e48b48a9e439e936d96a960a33ea796c80e654e324

SHA512
d5bee37ed0d0bc05408f9bc88b2fa7bed919a8485201868ebf5553c3bd458e144263641b8b20812eb2d622002ea8e66c63dc2c22dc269b6b4192d73782036092

Download Submit
C:\Windows\system\qhOFdXz.exe

Filesize
2.1MB

MD5
79a1bbe5fc9575580d3839c321003e9b

SHA1
7d78965781ff80bb97fc1f5cd996cd9fe859044c

SHA256
f678f5e3e1bef576dca95471c1f341b8a7517cb3aaae01e7324d0fbb4773566d

SHA512
ce676bd3780c5d26a6c5a3778068c23a13f7906a474063d29e2435c2f448f55d2b1c9276f897c0a2ee0086b42f09545ae15b7692815094e19932b47a5cbeb65b

Download Submit
C:\Windows\system\rBurHrP.exe

Filesize
2.1MB

MD5
f25021462f211488c85ae3fcf1eb3597

SHA1
a407a89e0f37b6d2e557be5c48c85168182e248d

SHA256
00ea2abd515807b754ed1f9d13aa06d24434811ec47d5e83890c86d5caff222a

SHA512
fd60c65c91821931738ff11062f6e04f2e65ac3ef3b67f0eae8b9f540c09d6bfff08c783a2cd1e93e65c4c6c211a2db1bd0cfad2dda58b31b33986b94e3102ae

Download Submit
C:\Windows\system\rCBDsNB.exe

Filesize
2.1MB

MD5
f3ac840134e76b842d629eeb5e68bc93

SHA1
fed8de2ff1c3054dbe789540a376319cc56925d5

SHA256
659bbae8b47071e8d176596f57064a9719bbdc81a1a1f8e62326991cf877884c

SHA512
3f0aa364f13d687286f94140483dc517b632aa2ffad3d79855854fee46568ddafa8f6ea80fe3699a7080b789b7e22c5d8bb8daffd6ec23e92e291a94dfe13878

Download Submit
C:\Windows\system\rgNKdYY.exe

Filesize
2.1MB

MD5
3e18f67c07ba9d4fe00a977a42ef019b

SHA1
820add13b4ed6de3a16b8f43715ae0e86e8c48e6

SHA256
b19ba8afce7e234294e603011e11ce51c1b68c4ef660b9ae14e92d2d94cdfb77

SHA512
60c078a1b95c668f369a79454faa2c814d4c8dbd8f2ab6f286292dec0cfb6b9fcaa2375240e2c76577a9e3ece01f4314243e36538bef17a26847706ee180abf5

Download Submit
C:\Windows\system\vDWGzkU.exe

Filesize
2.1MB

MD5
032fb58ed07264de6993d072447dddef

SHA1
2d5ef79927c08b6173d040fe0c7aee2f3d2f21f2

SHA256
a031f56f9e6844d3c28e1e5d9d99cba9e50f90351ab1f556eab5dd0d3e96255e

SHA512
c73e026911f1e99e70ffb13a6508197bcedd3778d73b033d6415e35f6678407c03579ecf7c16d79e16d8e435b56ff43d0117c5c43540ac0798763a95ab7a0fb5

Download Submit
C:\Windows\system\xjekXxH.exe

Filesize
2.1MB

MD5
c75f40a52a99521d1ab221232552c68b

SHA1
0aab393b071e630b36df11ff72f35299385eca9d

SHA256
c45386e55a265f68a0a3590e5bd7a3c9ac05758ab6c187fe06b544ff088983f3

SHA512
f52aa80d89cdb584089a049dc4c6c291fc49a8c2cb8010e98161cfb8783fba34b50806cc0b22dd713dee30a86dfb25d5d2cb2b82a207496f2ad4a4f858732a38

Download Submit
C:\Windows\system\xpcCTAE.exe

Filesize
2.1MB

MD5
1650727c0c0583a2cd808022a1167fdb

SHA1
d1c6efc69ad29ab29f7c441bdae427693beeeea3

SHA256
3fbf21a5f11757045169df0edbc254dd4c05a966e323541e420c871254449cec

SHA512
d27dbcb18bc516e2bb8d546063fb3a2c684f691bf2e24e78b7975ec9852a6829fee7fd6988d606d00b5e2c73da2c3abe0d16e3aad39aa4c659db7a2ecd112024

Download Submit
C:\Windows\system\yKgLkeU.exe

Filesize
2.1MB

MD5
70d680c0c5b91c543187106b3b289ac4

SHA1
19aa9a48a1f29a223bf4cdc31faafe1a6a27deb3

SHA256
ff118e129ef7b7eb4cc4c3b1195d324ae752e9d41e74bc0850b6846cae9086fb

SHA512
0a19ff75b8340b8ad7d9456ec4c80d58f49bb7022837810cdc0df1b43fb0f0672dca968c6324246a733cc5d1ace20a8b18154798112ae8a2aa0af6498f21a148

Download Submit
C:\Windows\system\zTwaSQL.exe

Filesize
2.1MB

MD5
a60649d877ca66fa9915867590bf9178

SHA1
e2e54c89a439b11996dbfa0d4fddc66564fa5663

SHA256
863b34954fd56797906b496ab3b92debb9c3e0571d7fb6bf2411db0e3a4e1a3f

SHA512
02c371e4145cb578f10aa9dd257528169580f7553b2aab26f25333b92a0c15439ea0f65193975d8efbf986b9fe01117bf435de6c2f44941a79e3eb58265ba359

Download Submit
\Windows\system\LfouQZi.exe

Filesize
2.1MB

MD5
860bc598007685a26432b83de4ed0dc8

SHA1
ecba63fbf5c828c0d8c89138b8e21a75350afbbd

SHA256
f1d351cc186843147e7df79e63398670371dcbf6b5f11d2ae8ae2d85d1c7ce77

SHA512
055492512b9b546c1d392fa6cc6c1de686231b193c285e9471942c5189b444c4abd456becfdae6229c78dbcbf141dff10b63b98db3ab9f5687462d2851d85f5c

Download Submit
\Windows\system\NQOrcZD.exe

Filesize
2.1MB

MD5
7da20de9f168a4372757328410764aac

SHA1
af2fa26deb15db7a4b10abfde138b1a109ea2f4e

SHA256
ef58773d857d6aae6546e0b38a98362b3468595b7477157d7b34aaa5ac911653

SHA512
25d8d95bd3d616681a967cb982e2a275641a7b21a0c3be89d4dbc2025bb1edf1bcd2b22ea4b5e4419598e00f4e7137770d5d4c08ff0121f79e66578179c3de7c

Download Submit
\Windows\system\UJsyjDJ.exe

Filesize
2.1MB

MD5
0267382025927b4aaa3425d26e75345a

SHA1
aeb374368bbbb1bb102e69a9b8dd6cb6cfc0ccd2

SHA256
457d36dd9efd19e41998bf3a4120ef2d2a0d0f1dbf55928d20f2b6a0ea00e7a8

SHA512
bacba31bf303bea62218b385bdfd2771d6779b05dc394c6584e49ce069497918f9ee4524ec4b01372d7695f60c56a458f2c04cf2144a90fcafa0c7ec142a18e5

Download Submit
\Windows\system\braahRH.exe

Filesize
2.1MB

MD5
2a9dac31c46c91c3a7efb15b49b2c667

SHA1
b87262fcb55f5a403db8f0b2cb3907a4a22ac9f5

SHA256
2b480b19e64da500396c97c81f2e20471ffccca1620dc3ea071b5bed377f665b

SHA512
091a718c96822963c3e7d392c1e24c5578c5e7b3b06722f90d8b7f4d847657c3af4a23bbfba870fe4ce5d53afbbb2636a248a0e8766eafb99958ae548ebae415

Download Submit
\Windows\system\bzvZhYl.exe

Filesize
2.1MB

MD5
7cc7bf50d884eed542a15e61578d3f98

SHA1
6314988240c71e5a5bf5c1e19dfae325417a8020

SHA256
109fb72ba3fa1d8f58600302c679f67463ebb2f1ddbef8b48f883dbe120a2bf4

SHA512
0757882d6ce484c39d818371956c5e75cc46f445ca7da7924ebb8197edbd0a2e3d88f2b2436eb48b29340e738dfd802709cc15dd4c795ccdae6cd066deddcbdf

Download Submit
\Windows\system\ksMaFbZ.exe

Filesize
2.1MB

MD5
4a8e193197fc1f68d4d667302109826d

SHA1
aa1a4863b472dca1c7707698e3be8ce904a28380

SHA256
18415a2b8fdcf8cf4e339c04a251486f75061a8c0cc4197b6aa71e380424ce05

SHA512
e213eb70162fbb77354697615f56d4a43c7adf7e32f89201cb538c193f35113cf65633a6c787748157680505cac09218f90dbad6e132209e4c023c4074db294e

Download Submit
memory/376-4018-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/376-76-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/1484-4019-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/1484-4015-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/1484-69-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/1848-4007-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/1848-13-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/1848-74-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/2468-4006-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2468-4016-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2468-64-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2548-4008-0x000000013FE70000-0x00000001401C4000-memory.dmp

Filesize
3.3MB

Download
memory/2548-15-0x000000013FE70000-0x00000001401C4000-memory.dmp

Filesize
3.3MB

Download
memory/2568-58-0x000000013FF90000-0x00000001402E4000-memory.dmp

Filesize
3.3MB

Download
memory/2568-4014-0x000000013FF90000-0x00000001402E4000-memory.dmp

Filesize
3.3MB

Download
memory/2616-4012-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2616-43-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/2632-102-0x000000013F180000-0x000000013F4D4000-memory.dmp

Filesize
3.3MB

Download
memory/2632-4017-0x000000013F180000-0x000000013F4D4000-memory.dmp

Filesize
3.3MB

Download
memory/2656-4009-0x000000013F5B0000-0x000000013F904000-memory.dmp

Filesize
3.3MB

Download
memory/2656-87-0x000000013F5B0000-0x000000013F904000-memory.dmp

Filesize
3.3MB

Download
memory/2656-25-0x000000013F5B0000-0x000000013F904000-memory.dmp

Filesize
3.3MB

Download
memory/2696-4020-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2696-82-0x000000013F320000-0x000000013F674000-memory.dmp

Filesize
3.3MB

Download
memory/2716-4011-0x000000013F3E0000-0x000000013F734000-memory.dmp

Filesize
3.3MB

Download
memory/2716-36-0x000000013F3E0000-0x000000013F734000-memory.dmp

Filesize
3.3MB

Download
memory/2732-91-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/2732-4010-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/2732-28-0x000000013F1B0000-0x000000013F504000-memory.dmp

Filesize
3.3MB

Download
memory/2820-4013-0x000000013F2F0000-0x000000013F644000-memory.dmp

Filesize
3.3MB

Download
memory/2820-50-0x000000013F2F0000-0x000000013F644000-memory.dmp

Filesize
3.3MB

Download
memory/2980-26-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-35-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2980-763-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-42-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-49-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-61-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-107-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-63-0x000000013F3B0000-0x000000013F704000-memory.dmp

Filesize
3.3MB

Download
memory/2980-14-0x000000013FE70000-0x00000001401C4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-112-0x000000013F960000-0x000000013FCB4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-98-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-57-0x000000013FF90000-0x00000001402E4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-117-0x000000013FB30000-0x000000013FE84000-memory.dmp

Filesize
3.3MB

Download
memory/2980-75-0x000000013FE70000-0x00000001401C4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-0-0x000000013F3B0000-0x000000013F704000-memory.dmp

Filesize
3.3MB

Download
memory/2980-81-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download
memory/2980-19-0x00000000020A0000-0x00000000023F4000-memory.dmp

Filesize
3.3MB

Download