xmrig | bbaba439c364f73ee20a7199c47e78874d057d5e4a00d7ce46a9e6b26597944f

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
Size

2.7MB
MD5

149eb945c5abe042a4444b5c2dabb470
SHA1

6d31b9814d005d8cbfb3fbd45c71fff448254bb9
SHA256

bbaba439c364f73ee20a7199c47e78874d057d5e4a00d7ce46a9e6b26597944f
SHA512

40e941ada5bf3775ced88b094a008da6034f0dbbc7791d9251e683c9dd5468810d7340174e812be41021ce1ef6646e82604c360779b6dc75b3ba274705a1702d
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbbnlD53SUDuFEsOa:BemTLkNdfE0pZrx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2764-0-0x000000013F070000-0x000000013F3C4000-memory.dmp	xmrig
behavioral1/files/0x000d000000014e3d-3.dat	xmrig
behavioral1/files/0x00240000000155d4-7.dat	xmrig
behavioral1/memory/2240-18-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/memory/2896-20-0x000000013F6D0000-0x000000013FA24000-memory.dmp	xmrig
behavioral1/files/0x0009000000015a2d-17.dat	xmrig
behavioral1/memory/2832-21-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/files/0x0007000000015a98-27.dat	xmrig
behavioral1/files/0x00170000000155d9-44.dat	xmrig
behavioral1/files/0x0009000000015c3c-55.dat	xmrig
behavioral1/files/0x0006000000016d89-72.dat	xmrig
behavioral1/files/0x000600000001704f-71.dat	xmrig
behavioral1/files/0x0006000000016d4f-47.dat	xmrig
behavioral1/memory/2564-70-0x000000013FBF0000-0x000000013FF44000-memory.dmp	xmrig
behavioral1/files/0x0007000000015c23-39.dat	xmrig
behavioral1/files/0x0006000000016d55-52.dat	xmrig
behavioral1/memory/2764-84-0x000000013FE60000-0x00000001401B4000-memory.dmp	xmrig
behavioral1/files/0x000500000001868c-105.dat	xmrig
behavioral1/files/0x0006000000017090-103.dat	xmrig
behavioral1/memory/2436-101-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/files/0x0006000000016e56-99.dat	xmrig
behavioral1/memory/2472-98-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d84-97.dat	xmrig
behavioral1/memory/2408-96-0x000000013F470000-0x000000013F7C4000-memory.dmp	xmrig
behavioral1/memory/2388-95-0x000000013FB80000-0x000000013FED4000-memory.dmp	xmrig
behavioral1/memory/2764-90-0x000000013FBF0000-0x000000013FF44000-memory.dmp	xmrig
behavioral1/memory/2372-89-0x000000013FE60000-0x00000001401B4000-memory.dmp	xmrig
behavioral1/memory/2764-88-0x000000013F470000-0x000000013F7C4000-memory.dmp	xmrig
behavioral1/memory/2640-87-0x000000013F260000-0x000000013F5B4000-memory.dmp	xmrig
behavioral1/memory/2184-83-0x000000013F2F0000-0x000000013F644000-memory.dmp	xmrig
behavioral1/memory/2700-81-0x000000013FCB0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/2572-50-0x000000013FFD0000-0x0000000140324000-memory.dmp	xmrig
behavioral1/memory/2764-34-0x000000013FFD0000-0x0000000140324000-memory.dmp	xmrig
behavioral1/memory/2468-32-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/files/0x0007000000015c0d-30.dat	xmrig
behavioral1/memory/2240-108-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b15-134.dat	xmrig
behavioral1/files/0x0006000000018b37-148.dat	xmrig
behavioral1/files/0x0006000000018b4a-157.dat	xmrig
behavioral1/files/0x0006000000018b96-171.dat	xmrig
behavioral1/files/0x00050000000192f4-192.dat	xmrig
behavioral1/memory/2572-563-0x000000013FFD0000-0x0000000140324000-memory.dmp	xmrig
behavioral1/memory/2764-294-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/files/0x00050000000192c9-187.dat	xmrig
behavioral1/files/0x0006000000018ba2-178.dat	xmrig
behavioral1/files/0x0006000000018d06-182.dat	xmrig
behavioral1/files/0x0006000000018b73-167.dat	xmrig
behavioral1/files/0x0006000000018b6a-162.dat	xmrig
behavioral1/files/0x0006000000018b42-152.dat	xmrig
behavioral1/files/0x0005000000018698-126.dat	xmrig
behavioral1/files/0x0006000000018ae2-122.dat	xmrig
behavioral1/files/0x0006000000018b33-140.dat	xmrig
behavioral1/files/0x0006000000018ae8-130.dat	xmrig
behavioral1/files/0x00050000000186a0-119.dat	xmrig
behavioral1/memory/2764-106-0x000000013F070000-0x000000013F3C4000-memory.dmp	xmrig
behavioral1/memory/2472-1728-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/memory/2436-2076-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/2896-2580-0x000000013F6D0000-0x000000013FA24000-memory.dmp	xmrig
behavioral1/memory/2240-2587-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/memory/2468-2589-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/memory/2832-2588-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/2372-2596-0x000000013FE60000-0x00000001401B4000-memory.dmp	xmrig
behavioral1/memory/2700-2602-0x000000013FCB0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/2388-2601-0x000000013FB80000-0x000000013FED4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2240	wRwyHyz.exe
2896	Wwysksl.exe
2832	esRyldP.exe
2468	VGEWYYG.exe
2572	mJVLJmE.exe
2564	THvFcOe.exe
2700	nQaCQDM.exe
2184	dIGMSxx.exe
2640	ffOmobe.exe
2372	tghYipe.exe
2388	OVderTe.exe
2408	hFUajjb.exe
2472	fqHWqFP.exe
2436	cbNFbBZ.exe
2344	cMubDkH.exe
2680	lExyRet.exe
1724	PhlCxgA.exe
1040	WHKlYdq.exe
2040	qxxJtTL.exe
2100	PwbLHVR.exe
2004	pqHTocX.exe
1668	EhmOQfy.exe
1732	ESAAibl.exe
1400	CwgyqPu.exe
1680	wIIbTMC.exe
1556	RsrAQlO.exe
1320	nUPmnQv.exe
596	cYCbGWN.exe
288	kGQHixn.exe
2224	SgAGPqT.exe
576	znZAaZS.exe
2144	vmEzdQp.exe
1596	qgSFLiB.exe
400	WMAnlAm.exe
2992	WhzunGT.exe
2712	ZsKUAPz.exe
1832	DTTsPIv.exe
1692	XZsruUW.exe
692	tdTuscR.exe
1620	LlApyXM.exe
1656	SDZTApj.exe
1792	GPyRFHe.exe
1984	hszJIsU.exe
1848	MnVJAlt.exe
652	QAOrtHh.exe
1200	IuJtDiP.exe
2908	dMjUmsN.exe
1256	ZihAcsa.exe
832	rHhBAaa.exe
2268	Pshuprm.exe
1948	ANgsBjQ.exe
1280	FYNBSRz.exe
2076	YNbGaoQ.exe
1508	MlhlPgo.exe
2164	jeRGJOS.exe
760	DznYTCw.exe
1612	XGCkMyh.exe
1708	mfcwqRI.exe
2064	ujMDUcN.exe
2968	GEjcJiq.exe
2508	NpqFLPE.exe
2624	XGIXygr.exe
2528	zUPuBLN.exe
2972	dWklEJA.exe

Loads dropped DLL 64 IoCs

pid	Process
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2764-0-0x000000013F070000-0x000000013F3C4000-memory.dmp	upx
behavioral1/files/0x000d000000014e3d-3.dat	upx
behavioral1/files/0x00240000000155d4-7.dat	upx
behavioral1/memory/2240-18-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/memory/2896-20-0x000000013F6D0000-0x000000013FA24000-memory.dmp	upx
behavioral1/files/0x0009000000015a2d-17.dat	upx
behavioral1/memory/2832-21-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/files/0x0007000000015a98-27.dat	upx
behavioral1/files/0x00170000000155d9-44.dat	upx
behavioral1/files/0x0009000000015c3c-55.dat	upx
behavioral1/files/0x0006000000016d89-72.dat	upx
behavioral1/files/0x000600000001704f-71.dat	upx
behavioral1/files/0x0006000000016d4f-47.dat	upx
behavioral1/memory/2564-70-0x000000013FBF0000-0x000000013FF44000-memory.dmp	upx
behavioral1/files/0x0007000000015c23-39.dat	upx
behavioral1/files/0x0006000000016d55-52.dat	upx
behavioral1/files/0x000500000001868c-105.dat	upx
behavioral1/files/0x0006000000017090-103.dat	upx
behavioral1/memory/2436-101-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/files/0x0006000000016e56-99.dat	upx
behavioral1/memory/2472-98-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/files/0x0006000000016d84-97.dat	upx
behavioral1/memory/2408-96-0x000000013F470000-0x000000013F7C4000-memory.dmp	upx
behavioral1/memory/2388-95-0x000000013FB80000-0x000000013FED4000-memory.dmp	upx
behavioral1/memory/2372-89-0x000000013FE60000-0x00000001401B4000-memory.dmp	upx
behavioral1/memory/2640-87-0x000000013F260000-0x000000013F5B4000-memory.dmp	upx
behavioral1/memory/2184-83-0x000000013F2F0000-0x000000013F644000-memory.dmp	upx
behavioral1/memory/2700-81-0x000000013FCB0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/2572-50-0x000000013FFD0000-0x0000000140324000-memory.dmp	upx
behavioral1/memory/2468-32-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/files/0x0007000000015c0d-30.dat	upx
behavioral1/memory/2240-108-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/files/0x0006000000018b15-134.dat	upx
behavioral1/files/0x0006000000018b37-148.dat	upx
behavioral1/files/0x0006000000018b4a-157.dat	upx
behavioral1/files/0x0006000000018b96-171.dat	upx
behavioral1/files/0x00050000000192f4-192.dat	upx
behavioral1/memory/2572-563-0x000000013FFD0000-0x0000000140324000-memory.dmp	upx
behavioral1/files/0x00050000000192c9-187.dat	upx
behavioral1/files/0x0006000000018ba2-178.dat	upx
behavioral1/files/0x0006000000018d06-182.dat	upx
behavioral1/files/0x0006000000018b73-167.dat	upx
behavioral1/files/0x0006000000018b6a-162.dat	upx
behavioral1/files/0x0006000000018b42-152.dat	upx
behavioral1/files/0x0005000000018698-126.dat	upx
behavioral1/files/0x0006000000018ae2-122.dat	upx
behavioral1/files/0x0006000000018b33-140.dat	upx
behavioral1/files/0x0006000000018ae8-130.dat	upx
behavioral1/files/0x00050000000186a0-119.dat	upx
behavioral1/memory/2764-106-0x000000013F070000-0x000000013F3C4000-memory.dmp	upx
behavioral1/memory/2472-1728-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/memory/2436-2076-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/memory/2896-2580-0x000000013F6D0000-0x000000013FA24000-memory.dmp	upx
behavioral1/memory/2240-2587-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/memory/2468-2589-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/memory/2832-2588-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/2372-2596-0x000000013FE60000-0x00000001401B4000-memory.dmp	upx
behavioral1/memory/2700-2602-0x000000013FCB0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/2388-2601-0x000000013FB80000-0x000000013FED4000-memory.dmp	upx
behavioral1/memory/2572-2600-0x000000013FFD0000-0x0000000140324000-memory.dmp	upx
behavioral1/memory/2640-2599-0x000000013F260000-0x000000013F5B4000-memory.dmp	upx
behavioral1/memory/2184-2597-0x000000013F2F0000-0x000000013F644000-memory.dmp	upx
behavioral1/memory/2564-2592-0x000000013FBF0000-0x000000013FF44000-memory.dmp	upx
behavioral1/memory/2472-2609-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RdDnuFd.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\xbEQHzj.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\brDfAwq.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\yejoSFj.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\XukYexE.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\HzLVNgO.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\WSFmCSG.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\GQHeTkG.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\ktJfUwp.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\DCPsjzw.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\dYeHVJY.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\IuycoBI.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\ximtKPa.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\jskHmyA.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\ftGPvaD.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\YVtlRSN.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\CKuhEwW.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\gFkkIOi.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\leAWNzP.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\XAKMUhW.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\RFOfunJ.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\JabzDYc.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\QkszUxT.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\ceIVRuk.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\LLUXElu.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\CicZatR.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\VpBJkHI.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\TWuzgqs.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\IkYPBnQ.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\CYLeAYm.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\qBUTkNr.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\KpQUzPz.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\oIsyacv.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\aooczpO.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\UblCsWb.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\wvQGiHi.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\pBTUJQI.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\uoipjaM.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\ayWcBaI.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\sFxJONC.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\bbkGlpO.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\QBxjSXz.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\kutUcTT.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\uzcdEMm.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\sMIQOcM.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\TaQOzOP.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\ixjeugo.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\fZgoNDU.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\thJXOwb.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\jPaaBiJ.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\uXzjpIJ.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\ntCbRpP.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\KbZxFNb.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\BjIJBXE.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\jmPDeZH.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\jqYlzih.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\hwgqruG.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\TKSoWae.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\BvEosic.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\EvpldKD.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\SHqZnHH.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\nWOfznH.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\tiEsFiB.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
File created	C:\Windows\System\wjJUNLa.exe	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2240	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	29
PID 2764 wrote to memory of 2240	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	29
PID 2764 wrote to memory of 2240	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	29
PID 2764 wrote to memory of 2896	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	30
PID 2764 wrote to memory of 2896	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	30
PID 2764 wrote to memory of 2896	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	30
PID 2764 wrote to memory of 2832	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	31
PID 2764 wrote to memory of 2832	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	31
PID 2764 wrote to memory of 2832	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	31
PID 2764 wrote to memory of 2468	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	32
PID 2764 wrote to memory of 2468	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	32
PID 2764 wrote to memory of 2468	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	32
PID 2764 wrote to memory of 2572	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	33
PID 2764 wrote to memory of 2572	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	33
PID 2764 wrote to memory of 2572	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	33
PID 2764 wrote to memory of 2564	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	34
PID 2764 wrote to memory of 2564	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	34
PID 2764 wrote to memory of 2564	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	34
PID 2764 wrote to memory of 2640	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	35
PID 2764 wrote to memory of 2640	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	35
PID 2764 wrote to memory of 2640	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	35
PID 2764 wrote to memory of 2700	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	36
PID 2764 wrote to memory of 2700	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	36
PID 2764 wrote to memory of 2700	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	36
PID 2764 wrote to memory of 2388	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	37
PID 2764 wrote to memory of 2388	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	37
PID 2764 wrote to memory of 2388	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	37
PID 2764 wrote to memory of 2184	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	38
PID 2764 wrote to memory of 2184	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	38
PID 2764 wrote to memory of 2184	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	38
PID 2764 wrote to memory of 2472	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	39
PID 2764 wrote to memory of 2472	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	39
PID 2764 wrote to memory of 2472	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	39
PID 2764 wrote to memory of 2372	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	40
PID 2764 wrote to memory of 2372	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	40
PID 2764 wrote to memory of 2372	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	40
PID 2764 wrote to memory of 2436	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	41
PID 2764 wrote to memory of 2436	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	41
PID 2764 wrote to memory of 2436	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	41
PID 2764 wrote to memory of 2408	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	42
PID 2764 wrote to memory of 2408	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	42
PID 2764 wrote to memory of 2408	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	42
PID 2764 wrote to memory of 2344	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	43
PID 2764 wrote to memory of 2344	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	43
PID 2764 wrote to memory of 2344	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	43
PID 2764 wrote to memory of 2680	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	44
PID 2764 wrote to memory of 2680	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	44
PID 2764 wrote to memory of 2680	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	44
PID 2764 wrote to memory of 1040	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	45
PID 2764 wrote to memory of 1040	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	45
PID 2764 wrote to memory of 1040	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	45
PID 2764 wrote to memory of 1724	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	46
PID 2764 wrote to memory of 1724	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	46
PID 2764 wrote to memory of 1724	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	46
PID 2764 wrote to memory of 2100	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	47
PID 2764 wrote to memory of 2100	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	47
PID 2764 wrote to memory of 2100	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	47
PID 2764 wrote to memory of 2040	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	48
PID 2764 wrote to memory of 2040	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	48
PID 2764 wrote to memory of 2040	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	48
PID 2764 wrote to memory of 1668	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	49
PID 2764 wrote to memory of 1668	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	49
PID 2764 wrote to memory of 1668	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	49
PID 2764 wrote to memory of 2004	2764	149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\149eb945c5abe042a4444b5c2dabb470_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\System\wRwyHyz.exe
  C:\Windows\System\wRwyHyz.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\Wwysksl.exe
  C:\Windows\System\Wwysksl.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\esRyldP.exe
  C:\Windows\System\esRyldP.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\VGEWYYG.exe
  C:\Windows\System\VGEWYYG.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\mJVLJmE.exe
  C:\Windows\System\mJVLJmE.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\THvFcOe.exe
  C:\Windows\System\THvFcOe.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\ffOmobe.exe
  C:\Windows\System\ffOmobe.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\nQaCQDM.exe
  C:\Windows\System\nQaCQDM.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\OVderTe.exe
  C:\Windows\System\OVderTe.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\dIGMSxx.exe
  C:\Windows\System\dIGMSxx.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\fqHWqFP.exe
  C:\Windows\System\fqHWqFP.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\tghYipe.exe
  C:\Windows\System\tghYipe.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\cbNFbBZ.exe
  C:\Windows\System\cbNFbBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\hFUajjb.exe
  C:\Windows\System\hFUajjb.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\cMubDkH.exe
  C:\Windows\System\cMubDkH.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\lExyRet.exe
  C:\Windows\System\lExyRet.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\WHKlYdq.exe
  C:\Windows\System\WHKlYdq.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\PhlCxgA.exe
  C:\Windows\System\PhlCxgA.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\PwbLHVR.exe
  C:\Windows\System\PwbLHVR.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\qxxJtTL.exe
  C:\Windows\System\qxxJtTL.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\EhmOQfy.exe
  C:\Windows\System\EhmOQfy.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\pqHTocX.exe
  C:\Windows\System\pqHTocX.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ESAAibl.exe
  C:\Windows\System\ESAAibl.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\CwgyqPu.exe
  C:\Windows\System\CwgyqPu.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\wIIbTMC.exe
  C:\Windows\System\wIIbTMC.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\RsrAQlO.exe
  C:\Windows\System\RsrAQlO.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\nUPmnQv.exe
  C:\Windows\System\nUPmnQv.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\cYCbGWN.exe
  C:\Windows\System\cYCbGWN.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\kGQHixn.exe
  C:\Windows\System\kGQHixn.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\SgAGPqT.exe
  C:\Windows\System\SgAGPqT.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\znZAaZS.exe
  C:\Windows\System\znZAaZS.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\vmEzdQp.exe
  C:\Windows\System\vmEzdQp.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\qgSFLiB.exe
  C:\Windows\System\qgSFLiB.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\WMAnlAm.exe
  C:\Windows\System\WMAnlAm.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\WhzunGT.exe
  C:\Windows\System\WhzunGT.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ZsKUAPz.exe
  C:\Windows\System\ZsKUAPz.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\DTTsPIv.exe
  C:\Windows\System\DTTsPIv.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\XZsruUW.exe
  C:\Windows\System\XZsruUW.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\tdTuscR.exe
  C:\Windows\System\tdTuscR.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\LlApyXM.exe
  C:\Windows\System\LlApyXM.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\SDZTApj.exe
  C:\Windows\System\SDZTApj.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\GPyRFHe.exe
  C:\Windows\System\GPyRFHe.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\hszJIsU.exe
  C:\Windows\System\hszJIsU.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\MnVJAlt.exe
  C:\Windows\System\MnVJAlt.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\QAOrtHh.exe
  C:\Windows\System\QAOrtHh.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\IuJtDiP.exe
  C:\Windows\System\IuJtDiP.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\dMjUmsN.exe
  C:\Windows\System\dMjUmsN.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ZihAcsa.exe
  C:\Windows\System\ZihAcsa.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\rHhBAaa.exe
  C:\Windows\System\rHhBAaa.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\Pshuprm.exe
  C:\Windows\System\Pshuprm.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\ANgsBjQ.exe
  C:\Windows\System\ANgsBjQ.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\FYNBSRz.exe
  C:\Windows\System\FYNBSRz.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\YNbGaoQ.exe
  C:\Windows\System\YNbGaoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\MlhlPgo.exe
  C:\Windows\System\MlhlPgo.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\jeRGJOS.exe
  C:\Windows\System\jeRGJOS.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\DznYTCw.exe
  C:\Windows\System\DznYTCw.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\XGCkMyh.exe
  C:\Windows\System\XGCkMyh.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\mfcwqRI.exe
  C:\Windows\System\mfcwqRI.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ujMDUcN.exe
  C:\Windows\System\ujMDUcN.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\GEjcJiq.exe
  C:\Windows\System\GEjcJiq.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\NpqFLPE.exe
  C:\Windows\System\NpqFLPE.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\XGIXygr.exe
  C:\Windows\System\XGIXygr.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\zUPuBLN.exe
  C:\Windows\System\zUPuBLN.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\dWklEJA.exe
  C:\Windows\System\dWklEJA.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\yhDXFHw.exe
  C:\Windows\System\yhDXFHw.exe
  2⤵
  PID:2664
- C:\Windows\System\ETqIRAu.exe
  C:\Windows\System\ETqIRAu.exe
  2⤵
  PID:2384
- C:\Windows\System\nRFrkDf.exe
  C:\Windows\System\nRFrkDf.exe
  2⤵
  PID:2656
- C:\Windows\System\yBjplMo.exe
  C:\Windows\System\yBjplMo.exe
  2⤵
  PID:2852
- C:\Windows\System\CicZatR.exe
  C:\Windows\System\CicZatR.exe
  2⤵
  PID:2516
- C:\Windows\System\ajUAWXm.exe
  C:\Windows\System\ajUAWXm.exe
  2⤵
  PID:2524
- C:\Windows\System\PJtdtpR.exe
  C:\Windows\System\PJtdtpR.exe
  2⤵
  PID:2044
- C:\Windows\System\UkXbgwm.exe
  C:\Windows\System\UkXbgwm.exe
  2⤵
  PID:1232
- C:\Windows\System\VpNVPxc.exe
  C:\Windows\System\VpNVPxc.exe
  2⤵
  PID:2092
- C:\Windows\System\NMvZkTk.exe
  C:\Windows\System\NMvZkTk.exe
  2⤵
  PID:2228
- C:\Windows\System\EHdwEpT.exe
  C:\Windows\System\EHdwEpT.exe
  2⤵
  PID:1796
- C:\Windows\System\MdaEDhv.exe
  C:\Windows\System\MdaEDhv.exe
  2⤵
  PID:1624
- C:\Windows\System\nbWXNRs.exe
  C:\Windows\System\nbWXNRs.exe
  2⤵
  PID:528
- C:\Windows\System\SHqZnHH.exe
  C:\Windows\System\SHqZnHH.exe
  2⤵
  PID:1576
- C:\Windows\System\rIMygEh.exe
  C:\Windows\System\rIMygEh.exe
  2⤵
  PID:336
- C:\Windows\System\MDqdGbo.exe
  C:\Windows\System\MDqdGbo.exe
  2⤵
  PID:1172
- C:\Windows\System\zDpucUk.exe
  C:\Windows\System\zDpucUk.exe
  2⤵
  PID:2136
- C:\Windows\System\jaOFyNm.exe
  C:\Windows\System\jaOFyNm.exe
  2⤵
  PID:2996
- C:\Windows\System\ZJJBQSd.exe
  C:\Windows\System\ZJJBQSd.exe
  2⤵
  PID:1800
- C:\Windows\System\BJmOXfE.exe
  C:\Windows\System\BJmOXfE.exe
  2⤵
  PID:2940
- C:\Windows\System\CYtuLCS.exe
  C:\Windows\System\CYtuLCS.exe
  2⤵
  PID:2584
- C:\Windows\System\iidFmzv.exe
  C:\Windows\System\iidFmzv.exe
  2⤵
  PID:1812
- C:\Windows\System\BNBRLMJ.exe
  C:\Windows\System\BNBRLMJ.exe
  2⤵
  PID:1868
- C:\Windows\System\qHNVGuB.exe
  C:\Windows\System\qHNVGuB.exe
  2⤵
  PID:1864
- C:\Windows\System\jVBzXpm.exe
  C:\Windows\System\jVBzXpm.exe
  2⤵
  PID:792
- C:\Windows\System\xjpZmFe.exe
  C:\Windows\System\xjpZmFe.exe
  2⤵
  PID:1924
- C:\Windows\System\AtCDVqc.exe
  C:\Windows\System\AtCDVqc.exe
  2⤵
  PID:968
- C:\Windows\System\HTQsnZA.exe
  C:\Windows\System\HTQsnZA.exe
  2⤵
  PID:3028
- C:\Windows\System\eRdPoOK.exe
  C:\Windows\System\eRdPoOK.exe
  2⤵
  PID:1056
- C:\Windows\System\AHWKbiZ.exe
  C:\Windows\System\AHWKbiZ.exe
  2⤵
  PID:2200
- C:\Windows\System\wDXfrDo.exe
  C:\Windows\System\wDXfrDo.exe
  2⤵
  PID:1956
- C:\Windows\System\BGRQJBb.exe
  C:\Windows\System\BGRQJBb.exe
  2⤵
  PID:2264
- C:\Windows\System\wiOItZJ.exe
  C:\Windows\System\wiOItZJ.exe
  2⤵
  PID:884
- C:\Windows\System\UjXrXRP.exe
  C:\Windows\System\UjXrXRP.exe
  2⤵
  PID:3052
- C:\Windows\System\bpiycgD.exe
  C:\Windows\System\bpiycgD.exe
  2⤵
  PID:2464
- C:\Windows\System\KgjpFaV.exe
  C:\Windows\System\KgjpFaV.exe
  2⤵
  PID:2060
- C:\Windows\System\lFDfSmy.exe
  C:\Windows\System\lFDfSmy.exe
  2⤵
  PID:2692
- C:\Windows\System\NTngdXB.exe
  C:\Windows\System\NTngdXB.exe
  2⤵
  PID:2056
- C:\Windows\System\HXqSXOE.exe
  C:\Windows\System\HXqSXOE.exe
  2⤵
  PID:2392
- C:\Windows\System\YIcZEMi.exe
  C:\Windows\System\YIcZEMi.exe
  2⤵
  PID:2360
- C:\Windows\System\fLoCaXN.exe
  C:\Windows\System\fLoCaXN.exe
  2⤵
  PID:3056
- C:\Windows\System\MAkUGAq.exe
  C:\Windows\System\MAkUGAq.exe
  2⤵
  PID:3064
- C:\Windows\System\gDukBNp.exe
  C:\Windows\System\gDukBNp.exe
  2⤵
  PID:2320
- C:\Windows\System\ZRexHWj.exe
  C:\Windows\System\ZRexHWj.exe
  2⤵
  PID:1284
- C:\Windows\System\fUuEXDj.exe
  C:\Windows\System\fUuEXDj.exe
  2⤵
  PID:2912
- C:\Windows\System\jJqVZPA.exe
  C:\Windows\System\jJqVZPA.exe
  2⤵
  PID:1328
- C:\Windows\System\omWavri.exe
  C:\Windows\System\omWavri.exe
  2⤵
  PID:1728
- C:\Windows\System\eysUQHG.exe
  C:\Windows\System\eysUQHG.exe
  2⤵
  PID:1028
- C:\Windows\System\oNVIdce.exe
  C:\Windows\System\oNVIdce.exe
  2⤵
  PID:1336
- C:\Windows\System\sAYYToI.exe
  C:\Windows\System\sAYYToI.exe
  2⤵
  PID:2124
- C:\Windows\System\PtJCUEv.exe
  C:\Windows\System\PtJCUEv.exe
  2⤵
  PID:2000
- C:\Windows\System\zGbBtcv.exe
  C:\Windows\System\zGbBtcv.exe
  2⤵
  PID:2208
- C:\Windows\System\MVzQEyG.exe
  C:\Windows\System\MVzQEyG.exe
  2⤵
  PID:2904
- C:\Windows\System\kHROxGE.exe
  C:\Windows\System\kHROxGE.exe
  2⤵
  PID:972
- C:\Windows\System\pdALAUE.exe
  C:\Windows\System\pdALAUE.exe
  2⤵
  PID:980
- C:\Windows\System\rpjXIBP.exe
  C:\Windows\System\rpjXIBP.exe
  2⤵
  PID:2416
- C:\Windows\System\jaOoSAZ.exe
  C:\Windows\System\jaOoSAZ.exe
  2⤵
  PID:1356
- C:\Windows\System\IoffkcW.exe
  C:\Windows\System\IoffkcW.exe
  2⤵
  PID:1996
- C:\Windows\System\tJxaKgE.exe
  C:\Windows\System\tJxaKgE.exe
  2⤵
  PID:2920
- C:\Windows\System\LGduULG.exe
  C:\Windows\System\LGduULG.exe
  2⤵
  PID:2568
- C:\Windows\System\HTmdJkv.exe
  C:\Windows\System\HTmdJkv.exe
  2⤵
  PID:1760
- C:\Windows\System\RSuEUBx.exe
  C:\Windows\System\RSuEUBx.exe
  2⤵
  PID:1660
- C:\Windows\System\wayguVu.exe
  C:\Windows\System\wayguVu.exe
  2⤵
  PID:2872
- C:\Windows\System\NLJfDQp.exe
  C:\Windows\System\NLJfDQp.exe
  2⤵
  PID:1604
- C:\Windows\System\oxBgrZW.exe
  C:\Windows\System\oxBgrZW.exe
  2⤵
  PID:2612
- C:\Windows\System\GkPrAtv.exe
  C:\Windows\System\GkPrAtv.exe
  2⤵
  PID:1644
- C:\Windows\System\VoGbmhv.exe
  C:\Windows\System\VoGbmhv.exe
  2⤵
  PID:2780
- C:\Windows\System\jPxFPxQ.exe
  C:\Windows\System\jPxFPxQ.exe
  2⤵
  PID:1160
- C:\Windows\System\CZFSBtV.exe
  C:\Windows\System\CZFSBtV.exe
  2⤵
  PID:2120
- C:\Windows\System\frSbZVI.exe
  C:\Windows\System\frSbZVI.exe
  2⤵
  PID:2540
- C:\Windows\System\LgoxOAe.exe
  C:\Windows\System\LgoxOAe.exe
  2⤵
  PID:1168
- C:\Windows\System\RLCaUOL.exe
  C:\Windows\System\RLCaUOL.exe
  2⤵
  PID:2180
- C:\Windows\System\zVQcLUf.exe
  C:\Windows\System\zVQcLUf.exe
  2⤵
  PID:608
- C:\Windows\System\tvpqkqq.exe
  C:\Windows\System\tvpqkqq.exe
  2⤵
  PID:1964
- C:\Windows\System\FPZFgpl.exe
  C:\Windows\System\FPZFgpl.exe
  2⤵
  PID:1828
- C:\Windows\System\SnrxAwJ.exe
  C:\Windows\System\SnrxAwJ.exe
  2⤵
  PID:1104
- C:\Windows\System\yipwhGO.exe
  C:\Windows\System\yipwhGO.exe
  2⤵
  PID:2192
- C:\Windows\System\fevmnix.exe
  C:\Windows\System\fevmnix.exe
  2⤵
  PID:1296
- C:\Windows\System\glijyuI.exe
  C:\Windows\System\glijyuI.exe
  2⤵
  PID:2020
- C:\Windows\System\ALKrpkq.exe
  C:\Windows\System\ALKrpkq.exe
  2⤵
  PID:1600
- C:\Windows\System\cTvMFVj.exe
  C:\Windows\System\cTvMFVj.exe
  2⤵
  PID:2324
- C:\Windows\System\oKbXFKo.exe
  C:\Windows\System\oKbXFKo.exe
  2⤵
  PID:2740
- C:\Windows\System\otZyAMI.exe
  C:\Windows\System\otZyAMI.exe
  2⤵
  PID:2356
- C:\Windows\System\SlKcyBz.exe
  C:\Windows\System\SlKcyBz.exe
  2⤵
  PID:1776
- C:\Windows\System\FNqhdGr.exe
  C:\Windows\System\FNqhdGr.exe
  2⤵
  PID:1036
- C:\Windows\System\CKuhEwW.exe
  C:\Windows\System\CKuhEwW.exe
  2⤵
  PID:2932
- C:\Windows\System\YFMalLL.exe
  C:\Windows\System\YFMalLL.exe
  2⤵
  PID:2848
- C:\Windows\System\DAcHtsU.exe
  C:\Windows\System\DAcHtsU.exe
  2⤵
  PID:1636
- C:\Windows\System\IadnLgz.exe
  C:\Windows\System\IadnLgz.exe
  2⤵
  PID:2856
- C:\Windows\System\BJphjGi.exe
  C:\Windows\System\BJphjGi.exe
  2⤵
  PID:1032
- C:\Windows\System\eAEwyTp.exe
  C:\Windows\System\eAEwyTp.exe
  2⤵
  PID:932
- C:\Windows\System\tJWvJrA.exe
  C:\Windows\System\tJWvJrA.exe
  2⤵
  PID:2052
- C:\Windows\System\kGYDjbN.exe
  C:\Windows\System\kGYDjbN.exe
  2⤵
  PID:1804
- C:\Windows\System\IjMYvcs.exe
  C:\Windows\System\IjMYvcs.exe
  2⤵
  PID:2732
- C:\Windows\System\oYEwIkM.exe
  C:\Windows\System\oYEwIkM.exe
  2⤵
  PID:2716
- C:\Windows\System\OEUAPuh.exe
  C:\Windows\System\OEUAPuh.exe
  2⤵
  PID:776
- C:\Windows\System\pAuILjr.exe
  C:\Windows\System\pAuILjr.exe
  2⤵
  PID:1396
- C:\Windows\System\qbzxUpj.exe
  C:\Windows\System\qbzxUpj.exe
  2⤵
  PID:1744
- C:\Windows\System\pwiejqP.exe
  C:\Windows\System\pwiejqP.exe
  2⤵
  PID:2248
- C:\Windows\System\lZbjQLA.exe
  C:\Windows\System\lZbjQLA.exe
  2⤵
  PID:1652
- C:\Windows\System\kupKhDA.exe
  C:\Windows\System\kupKhDA.exe
  2⤵
  PID:2648
- C:\Windows\System\SKvGkRS.exe
  C:\Windows\System\SKvGkRS.exe
  2⤵
  PID:2600
- C:\Windows\System\ziMLjaC.exe
  C:\Windows\System\ziMLjaC.exe
  2⤵
  PID:936
- C:\Windows\System\ntCbRpP.exe
  C:\Windows\System\ntCbRpP.exe
  2⤵
  PID:1664
- C:\Windows\System\RXbiMoG.exe
  C:\Windows\System\RXbiMoG.exe
  2⤵
  PID:2220
- C:\Windows\System\OcTSSgK.exe
  C:\Windows\System\OcTSSgK.exe
  2⤵
  PID:1016
- C:\Windows\System\sXCiNDh.exe
  C:\Windows\System\sXCiNDh.exe
  2⤵
  PID:2420
- C:\Windows\System\YOCDjGm.exe
  C:\Windows\System\YOCDjGm.exe
  2⤵
  PID:1788
- C:\Windows\System\LuPdVYt.exe
  C:\Windows\System\LuPdVYt.exe
  2⤵
  PID:2736
- C:\Windows\System\hwzOAvL.exe
  C:\Windows\System\hwzOAvL.exe
  2⤵
  PID:2588
- C:\Windows\System\UVetOtA.exe
  C:\Windows\System\UVetOtA.exe
  2⤵
  PID:2548
- C:\Windows\System\EEoAzCy.exe
  C:\Windows\System\EEoAzCy.exe
  2⤵
  PID:1920
- C:\Windows\System\XThxqBg.exe
  C:\Windows\System\XThxqBg.exe
  2⤵
  PID:2312
- C:\Windows\System\tXAGkyB.exe
  C:\Windows\System\tXAGkyB.exe
  2⤵
  PID:1756
- C:\Windows\System\aQfeRxu.exe
  C:\Windows\System\aQfeRxu.exe
  2⤵
  PID:2088
- C:\Windows\System\khqhQNI.exe
  C:\Windows\System\khqhQNI.exe
  2⤵
  PID:2684
- C:\Windows\System\RrVQFLd.exe
  C:\Windows\System\RrVQFLd.exe
  2⤵
  PID:2556
- C:\Windows\System\DpcZzSZ.exe
  C:\Windows\System\DpcZzSZ.exe
  2⤵
  PID:1648
- C:\Windows\System\JlgdFoq.exe
  C:\Windows\System\JlgdFoq.exe
  2⤵
  PID:1216
- C:\Windows\System\oExppzh.exe
  C:\Windows\System\oExppzh.exe
  2⤵
  PID:2232
- C:\Windows\System\KbZxFNb.exe
  C:\Windows\System\KbZxFNb.exe
  2⤵
  PID:2984
- C:\Windows\System\LjUMwGM.exe
  C:\Windows\System\LjUMwGM.exe
  2⤵
  PID:2880
- C:\Windows\System\CBbAecP.exe
  C:\Windows\System\CBbAecP.exe
  2⤵
  PID:1740
- C:\Windows\System\KZftNmG.exe
  C:\Windows\System\KZftNmG.exe
  2⤵
  PID:324
- C:\Windows\System\eEQwqZq.exe
  C:\Windows\System\eEQwqZq.exe
  2⤵
  PID:2724
- C:\Windows\System\OykyjAN.exe
  C:\Windows\System\OykyjAN.exe
  2⤵
  PID:2296
- C:\Windows\System\vxhjsZx.exe
  C:\Windows\System\vxhjsZx.exe
  2⤵
  PID:1372
- C:\Windows\System\lyNRcrd.exe
  C:\Windows\System\lyNRcrd.exe
  2⤵
  PID:1344
- C:\Windows\System\EBLzJuO.exe
  C:\Windows\System\EBLzJuO.exe
  2⤵
  PID:3088
- C:\Windows\System\sISBfBk.exe
  C:\Windows\System\sISBfBk.exe
  2⤵
  PID:3104
- C:\Windows\System\oZOSrED.exe
  C:\Windows\System\oZOSrED.exe
  2⤵
  PID:3120
- C:\Windows\System\iZcWWdq.exe
  C:\Windows\System\iZcWWdq.exe
  2⤵
  PID:3136
- C:\Windows\System\zicmmIF.exe
  C:\Windows\System\zicmmIF.exe
  2⤵
  PID:3160
- C:\Windows\System\mPHktOH.exe
  C:\Windows\System\mPHktOH.exe
  2⤵
  PID:3176
- C:\Windows\System\peuztdg.exe
  C:\Windows\System\peuztdg.exe
  2⤵
  PID:3196
- C:\Windows\System\YjehOvN.exe
  C:\Windows\System\YjehOvN.exe
  2⤵
  PID:3212
- C:\Windows\System\HxGocid.exe
  C:\Windows\System\HxGocid.exe
  2⤵
  PID:3232
- C:\Windows\System\CDRNXwD.exe
  C:\Windows\System\CDRNXwD.exe
  2⤵
  PID:3248
- C:\Windows\System\wlSpDRY.exe
  C:\Windows\System\wlSpDRY.exe
  2⤵
  PID:3264
- C:\Windows\System\XcIzbkO.exe
  C:\Windows\System\XcIzbkO.exe
  2⤵
  PID:3280
- C:\Windows\System\ijJsQKg.exe
  C:\Windows\System\ijJsQKg.exe
  2⤵
  PID:3296
- C:\Windows\System\pFszAWM.exe
  C:\Windows\System\pFszAWM.exe
  2⤵
  PID:3316
- C:\Windows\System\gVrcpLd.exe
  C:\Windows\System\gVrcpLd.exe
  2⤵
  PID:3368
- C:\Windows\System\kqSsHNA.exe
  C:\Windows\System\kqSsHNA.exe
  2⤵
  PID:3384
- C:\Windows\System\OTdnzcX.exe
  C:\Windows\System\OTdnzcX.exe
  2⤵
  PID:3400
- C:\Windows\System\SUHQvfl.exe
  C:\Windows\System\SUHQvfl.exe
  2⤵
  PID:3416
- C:\Windows\System\wabarle.exe
  C:\Windows\System\wabarle.exe
  2⤵
  PID:3432
- C:\Windows\System\teWciBT.exe
  C:\Windows\System\teWciBT.exe
  2⤵
  PID:3448
- C:\Windows\System\ofYfFVz.exe
  C:\Windows\System\ofYfFVz.exe
  2⤵
  PID:3464
- C:\Windows\System\YqzOWjF.exe
  C:\Windows\System\YqzOWjF.exe
  2⤵
  PID:3480
- C:\Windows\System\NJjFnAu.exe
  C:\Windows\System\NJjFnAu.exe
  2⤵
  PID:3496
- C:\Windows\System\QThoLeS.exe
  C:\Windows\System\QThoLeS.exe
  2⤵
  PID:3512
- C:\Windows\System\Mvwlsel.exe
  C:\Windows\System\Mvwlsel.exe
  2⤵
  PID:3564
- C:\Windows\System\GBOdDKN.exe
  C:\Windows\System\GBOdDKN.exe
  2⤵
  PID:3580
- C:\Windows\System\oJuHRmt.exe
  C:\Windows\System\oJuHRmt.exe
  2⤵
  PID:3600
- C:\Windows\System\FUTLnna.exe
  C:\Windows\System\FUTLnna.exe
  2⤵
  PID:3616
- C:\Windows\System\gxtVOVQ.exe
  C:\Windows\System\gxtVOVQ.exe
  2⤵
  PID:3632
- C:\Windows\System\uTSXMsF.exe
  C:\Windows\System\uTSXMsF.exe
  2⤵
  PID:3648
- C:\Windows\System\bYtRSPl.exe
  C:\Windows\System\bYtRSPl.exe
  2⤵
  PID:3664
- C:\Windows\System\NRIvvUz.exe
  C:\Windows\System\NRIvvUz.exe
  2⤵
  PID:3684
- C:\Windows\System\lCKleHu.exe
  C:\Windows\System\lCKleHu.exe
  2⤵
  PID:3704
- C:\Windows\System\JCxrIxQ.exe
  C:\Windows\System\JCxrIxQ.exe
  2⤵
  PID:3756
- C:\Windows\System\QYclxdm.exe
  C:\Windows\System\QYclxdm.exe
  2⤵
  PID:3772
- C:\Windows\System\YVPrSlU.exe
  C:\Windows\System\YVPrSlU.exe
  2⤵
  PID:3788
- C:\Windows\System\jMJgqku.exe
  C:\Windows\System\jMJgqku.exe
  2⤵
  PID:3808
- C:\Windows\System\xoZRAxw.exe
  C:\Windows\System\xoZRAxw.exe
  2⤵
  PID:3824
- C:\Windows\System\fViJIlh.exe
  C:\Windows\System\fViJIlh.exe
  2⤵
  PID:3844
- C:\Windows\System\VpBJkHI.exe
  C:\Windows\System\VpBJkHI.exe
  2⤵
  PID:3864
- C:\Windows\System\vzVDLzM.exe
  C:\Windows\System\vzVDLzM.exe
  2⤵
  PID:3892
- C:\Windows\System\qtsDUtd.exe
  C:\Windows\System\qtsDUtd.exe
  2⤵
  PID:3920
- C:\Windows\System\hedkjRV.exe
  C:\Windows\System\hedkjRV.exe
  2⤵
  PID:3936
- C:\Windows\System\CcTKcXT.exe
  C:\Windows\System\CcTKcXT.exe
  2⤵
  PID:3952
- C:\Windows\System\HJWQFIv.exe
  C:\Windows\System\HJWQFIv.exe
  2⤵
  PID:3968
- C:\Windows\System\dTMQDID.exe
  C:\Windows\System\dTMQDID.exe
  2⤵
  PID:3984
- C:\Windows\System\wTEMlIw.exe
  C:\Windows\System\wTEMlIw.exe
  2⤵
  PID:4020
- C:\Windows\System\PElfkhy.exe
  C:\Windows\System\PElfkhy.exe
  2⤵
  PID:4036
- C:\Windows\System\RVpSoDs.exe
  C:\Windows\System\RVpSoDs.exe
  2⤵
  PID:4068
- C:\Windows\System\PlXnTne.exe
  C:\Windows\System\PlXnTne.exe
  2⤵
  PID:4088
- C:\Windows\System\WEkiVTR.exe
  C:\Windows\System\WEkiVTR.exe
  2⤵
  PID:3080
- C:\Windows\System\rfoPkNn.exe
  C:\Windows\System\rfoPkNn.exe
  2⤵
  PID:3100
- C:\Windows\System\WyPYJMW.exe
  C:\Windows\System\WyPYJMW.exe
  2⤵
  PID:3096
- C:\Windows\System\trroGQD.exe
  C:\Windows\System\trroGQD.exe
  2⤵
  PID:3116
- C:\Windows\System\ElDFZCr.exe
  C:\Windows\System\ElDFZCr.exe
  2⤵
  PID:3188
- C:\Windows\System\GSNmAij.exe
  C:\Windows\System\GSNmAij.exe
  2⤵
  PID:3260
- C:\Windows\System\jYFzUrm.exe
  C:\Windows\System\jYFzUrm.exe
  2⤵
  PID:3340
- C:\Windows\System\DUidDdK.exe
  C:\Windows\System\DUidDdK.exe
  2⤵
  PID:3352
- C:\Windows\System\ebrdBAh.exe
  C:\Windows\System\ebrdBAh.exe
  2⤵
  PID:3276
- C:\Windows\System\HQEFRbJ.exe
  C:\Windows\System\HQEFRbJ.exe
  2⤵
  PID:3308
- C:\Windows\System\FWnyOCs.exe
  C:\Windows\System\FWnyOCs.exe
  2⤵
  PID:3396
- C:\Windows\System\CGuCSNb.exe
  C:\Windows\System\CGuCSNb.exe
  2⤵
  PID:3488
- C:\Windows\System\NTQnGDR.exe
  C:\Windows\System\NTQnGDR.exe
  2⤵
  PID:3532
- C:\Windows\System\GcGxMbM.exe
  C:\Windows\System\GcGxMbM.exe
  2⤵
  PID:3552
- C:\Windows\System\XmozppE.exe
  C:\Windows\System\XmozppE.exe
  2⤵
  PID:3412
- C:\Windows\System\YFLHgxU.exe
  C:\Windows\System\YFLHgxU.exe
  2⤵
  PID:3556
- C:\Windows\System\vYWlSeS.exe
  C:\Windows\System\vYWlSeS.exe
  2⤵
  PID:3624
- C:\Windows\System\TUtcRnC.exe
  C:\Windows\System\TUtcRnC.exe
  2⤵
  PID:3696
- C:\Windows\System\xuYKvMZ.exe
  C:\Windows\System\xuYKvMZ.exe
  2⤵
  PID:3608
- C:\Windows\System\JrzqxZQ.exe
  C:\Windows\System\JrzqxZQ.exe
  2⤵
  PID:2676
- C:\Windows\System\BJYNkBM.exe
  C:\Windows\System\BJYNkBM.exe
  2⤵
  PID:3576
- C:\Windows\System\HqkuelN.exe
  C:\Windows\System\HqkuelN.exe
  2⤵
  PID:3800
- C:\Windows\System\aVxKiOX.exe
  C:\Windows\System\aVxKiOX.exe
  2⤵
  PID:3840
- C:\Windows\System\wqHINnI.exe
  C:\Windows\System\wqHINnI.exe
  2⤵
  PID:3744
- C:\Windows\System\XAKMUhW.exe
  C:\Windows\System\XAKMUhW.exe
  2⤵
  PID:3856
- C:\Windows\System\qGATKXU.exe
  C:\Windows\System\qGATKXU.exe
  2⤵
  PID:3928
- C:\Windows\System\iCnvVuJ.exe
  C:\Windows\System\iCnvVuJ.exe
  2⤵
  PID:3992
- C:\Windows\System\nwMCmFZ.exe
  C:\Windows\System\nwMCmFZ.exe
  2⤵
  PID:4012
- C:\Windows\System\zuXqMFA.exe
  C:\Windows\System\zuXqMFA.exe
  2⤵
  PID:4064
- C:\Windows\System\FvFgIKt.exe
  C:\Windows\System\FvFgIKt.exe
  2⤵
  PID:4048
- C:\Windows\System\goGXBaa.exe
  C:\Windows\System\goGXBaa.exe
  2⤵
  PID:2400
- C:\Windows\System\tEEhUdG.exe
  C:\Windows\System\tEEhUdG.exe
  2⤵
  PID:3980
- C:\Windows\System\kOeJUGx.exe
  C:\Windows\System\kOeJUGx.exe
  2⤵
  PID:3128
- C:\Windows\System\QGeorgx.exe
  C:\Windows\System\QGeorgx.exe
  2⤵
  PID:2668
- C:\Windows\System\ckMgoxD.exe
  C:\Windows\System\ckMgoxD.exe
  2⤵
  PID:3328
- C:\Windows\System\VOjMCNn.exe
  C:\Windows\System\VOjMCNn.exe
  2⤵
  PID:3220
- C:\Windows\System\adKNTrz.exe
  C:\Windows\System\adKNTrz.exe
  2⤵
  PID:3208
- C:\Windows\System\KEYljhE.exe
  C:\Windows\System\KEYljhE.exe
  2⤵
  PID:3392
- C:\Windows\System\uIbsqFW.exe
  C:\Windows\System\uIbsqFW.exe
  2⤵
  PID:3528
- C:\Windows\System\gjZLNzN.exe
  C:\Windows\System\gjZLNzN.exe
  2⤵
  PID:3540
- C:\Windows\System\ncjqXkN.exe
  C:\Windows\System\ncjqXkN.exe
  2⤵
  PID:3508
- C:\Windows\System\EjkPLJd.exe
  C:\Windows\System\EjkPLJd.exe
  2⤵
  PID:3592
- C:\Windows\System\bXDnHOL.exe
  C:\Windows\System\bXDnHOL.exe
  2⤵
  PID:3692
- C:\Windows\System\TfXXifH.exe
  C:\Windows\System\TfXXifH.exe
  2⤵
  PID:3764
- C:\Windows\System\kdqsscU.exe
  C:\Windows\System\kdqsscU.exe
  2⤵
  PID:3872
- C:\Windows\System\kbmtHRU.exe
  C:\Windows\System\kbmtHRU.exe
  2⤵
  PID:3672
- C:\Windows\System\PEWzVBC.exe
  C:\Windows\System\PEWzVBC.exe
  2⤵
  PID:3644
- C:\Windows\System\ZCMciiQ.exe
  C:\Windows\System\ZCMciiQ.exe
  2⤵
  PID:3964
- C:\Windows\System\PeQPaPi.exe
  C:\Windows\System\PeQPaPi.exe
  2⤵
  PID:3900
- C:\Windows\System\FqDIOXv.exe
  C:\Windows\System\FqDIOXv.exe
  2⤵
  PID:3996
- C:\Windows\System\csOppmn.exe
  C:\Windows\System\csOppmn.exe
  2⤵
  PID:3256
- C:\Windows\System\TGomFeA.exe
  C:\Windows\System\TGomFeA.exe
  2⤵
  PID:3976
- C:\Windows\System\RYMcFlZ.exe
  C:\Windows\System\RYMcFlZ.exe
  2⤵
  PID:940
- C:\Windows\System\laZXWMl.exe
  C:\Windows\System\laZXWMl.exe
  2⤵
  PID:1700
- C:\Windows\System\vLENDUz.exe
  C:\Windows\System\vLENDUz.exe
  2⤵
  PID:3524
- C:\Windows\System\uRCftCI.exe
  C:\Windows\System\uRCftCI.exe
  2⤵
  PID:3364
- C:\Windows\System\yfVgooh.exe
  C:\Windows\System\yfVgooh.exe
  2⤵
  PID:3548
- C:\Windows\System\TyWmtLe.exe
  C:\Windows\System\TyWmtLe.exe
  2⤵
  PID:3768
- C:\Windows\System\EzrvQQM.exe
  C:\Windows\System\EzrvQQM.exe
  2⤵
  PID:3752
- C:\Windows\System\oWgkbgt.exe
  C:\Windows\System\oWgkbgt.exe
  2⤵
  PID:3720
- C:\Windows\System\qKLRUmS.exe
  C:\Windows\System\qKLRUmS.exe
  2⤵
  PID:3912
- C:\Windows\System\uSpcYkJ.exe
  C:\Windows\System\uSpcYkJ.exe
  2⤵
  PID:3144
- C:\Windows\System\ucIVnwd.exe
  C:\Windows\System\ucIVnwd.exe
  2⤵
  PID:3168
- C:\Windows\System\WMPrJRz.exe
  C:\Windows\System\WMPrJRz.exe
  2⤵
  PID:3476
- C:\Windows\System\qbhhHkf.exe
  C:\Windows\System\qbhhHkf.exe
  2⤵
  PID:3288
- C:\Windows\System\seJKBvc.exe
  C:\Windows\System\seJKBvc.exe
  2⤵
  PID:3820
- C:\Windows\System\wkEHvqM.exe
  C:\Windows\System\wkEHvqM.exe
  2⤵
  PID:3324
- C:\Windows\System\RiBNetc.exe
  C:\Windows\System\RiBNetc.exe
  2⤵
  PID:3348
- C:\Windows\System\qYWJTes.exe
  C:\Windows\System\qYWJTes.exe
  2⤵
  PID:3336
- C:\Windows\System\RbmyFMM.exe
  C:\Windows\System\RbmyFMM.exe
  2⤵
  PID:3460
- C:\Windows\System\eyYjMTL.exe
  C:\Windows\System\eyYjMTL.exe
  2⤵
  PID:3244
- C:\Windows\System\zHyRlgj.exe
  C:\Windows\System\zHyRlgj.exe
  2⤵
  PID:4104
- C:\Windows\System\YEYKWQr.exe
  C:\Windows\System\YEYKWQr.exe
  2⤵
  PID:4124
- C:\Windows\System\wToCPOp.exe
  C:\Windows\System\wToCPOp.exe
  2⤵
  PID:4144
- C:\Windows\System\RzgEwob.exe
  C:\Windows\System\RzgEwob.exe
  2⤵
  PID:4188
- C:\Windows\System\RCvKmtS.exe
  C:\Windows\System\RCvKmtS.exe
  2⤵
  PID:4212
- C:\Windows\System\iaGskrj.exe
  C:\Windows\System\iaGskrj.exe
  2⤵
  PID:4236
- C:\Windows\System\zIABDWv.exe
  C:\Windows\System\zIABDWv.exe
  2⤵
  PID:4256
- C:\Windows\System\kymDUeU.exe
  C:\Windows\System\kymDUeU.exe
  2⤵
  PID:4276
- C:\Windows\System\EVZwnuP.exe
  C:\Windows\System\EVZwnuP.exe
  2⤵
  PID:4292
- C:\Windows\System\KqZaAdZ.exe
  C:\Windows\System\KqZaAdZ.exe
  2⤵
  PID:4312
- C:\Windows\System\oLrLtHb.exe
  C:\Windows\System\oLrLtHb.exe
  2⤵
  PID:4340
- C:\Windows\System\fjOAyDp.exe
  C:\Windows\System\fjOAyDp.exe
  2⤵
  PID:4360
- C:\Windows\System\ywHZeCz.exe
  C:\Windows\System\ywHZeCz.exe
  2⤵
  PID:4380
- C:\Windows\System\UUOZfrl.exe
  C:\Windows\System\UUOZfrl.exe
  2⤵
  PID:4396
- C:\Windows\System\OWoniqu.exe
  C:\Windows\System\OWoniqu.exe
  2⤵
  PID:4420
- C:\Windows\System\rRKVMAA.exe
  C:\Windows\System\rRKVMAA.exe
  2⤵
  PID:4440
- C:\Windows\System\qrmitmV.exe
  C:\Windows\System\qrmitmV.exe
  2⤵
  PID:4456
- C:\Windows\System\uWyKwNj.exe
  C:\Windows\System\uWyKwNj.exe
  2⤵
  PID:4472
- C:\Windows\System\YkjjxLb.exe
  C:\Windows\System\YkjjxLb.exe
  2⤵
  PID:4504
- C:\Windows\System\ETOxRnX.exe
  C:\Windows\System\ETOxRnX.exe
  2⤵
  PID:4520
- C:\Windows\System\HjMWoSk.exe
  C:\Windows\System\HjMWoSk.exe
  2⤵
  PID:4536
- C:\Windows\System\EXMusOs.exe
  C:\Windows\System\EXMusOs.exe
  2⤵
  PID:4552
- C:\Windows\System\inZDLcC.exe
  C:\Windows\System\inZDLcC.exe
  2⤵
  PID:4572
- C:\Windows\System\UALIsBq.exe
  C:\Windows\System\UALIsBq.exe
  2⤵
  PID:4592
- C:\Windows\System\wvrUvyn.exe
  C:\Windows\System\wvrUvyn.exe
  2⤵
  PID:4608
- C:\Windows\System\dQfczEa.exe
  C:\Windows\System\dQfczEa.exe
  2⤵
  PID:4624
- C:\Windows\System\gjBSndN.exe
  C:\Windows\System\gjBSndN.exe
  2⤵
  PID:4640
- C:\Windows\System\MbxQOJW.exe
  C:\Windows\System\MbxQOJW.exe
  2⤵
  PID:4660
- C:\Windows\System\FnTXKka.exe
  C:\Windows\System\FnTXKka.exe
  2⤵
  PID:4696
- C:\Windows\System\AApOikm.exe
  C:\Windows\System\AApOikm.exe
  2⤵
  PID:4716
- C:\Windows\System\tbMMCMd.exe
  C:\Windows\System\tbMMCMd.exe
  2⤵
  PID:4744
- C:\Windows\System\vlqkkXD.exe
  C:\Windows\System\vlqkkXD.exe
  2⤵
  PID:4760
- C:\Windows\System\XgOYCcL.exe
  C:\Windows\System\XgOYCcL.exe
  2⤵
  PID:4788
- C:\Windows\System\DWZcgml.exe
  C:\Windows\System\DWZcgml.exe
  2⤵
  PID:4804
- C:\Windows\System\yKRVSFi.exe
  C:\Windows\System\yKRVSFi.exe
  2⤵
  PID:4824
- C:\Windows\System\wKjgeTN.exe
  C:\Windows\System\wKjgeTN.exe
  2⤵
  PID:4840
- C:\Windows\System\rYgggvn.exe
  C:\Windows\System\rYgggvn.exe
  2⤵
  PID:4860
- C:\Windows\System\sumQTIh.exe
  C:\Windows\System\sumQTIh.exe
  2⤵
  PID:4876
- C:\Windows\System\vMpOBeh.exe
  C:\Windows\System\vMpOBeh.exe
  2⤵
  PID:4892
- C:\Windows\System\XLlfxNB.exe
  C:\Windows\System\XLlfxNB.exe
  2⤵
  PID:4908
- C:\Windows\System\dVVdLSD.exe
  C:\Windows\System\dVVdLSD.exe
  2⤵
  PID:4932
- C:\Windows\System\jiREFqc.exe
  C:\Windows\System\jiREFqc.exe
  2⤵
  PID:4948
- C:\Windows\System\gDOdmSL.exe
  C:\Windows\System\gDOdmSL.exe
  2⤵
  PID:4964
- C:\Windows\System\sXZtocN.exe
  C:\Windows\System\sXZtocN.exe
  2⤵
  PID:4984
- C:\Windows\System\TBqLSqF.exe
  C:\Windows\System\TBqLSqF.exe
  2⤵
  PID:5004
- C:\Windows\System\triozov.exe
  C:\Windows\System\triozov.exe
  2⤵
  PID:5024
- C:\Windows\System\wiobOqt.exe
  C:\Windows\System\wiobOqt.exe
  2⤵
  PID:5084
- C:\Windows\System\mDhpsLB.exe
  C:\Windows\System\mDhpsLB.exe
  2⤵
  PID:5108
- C:\Windows\System\mjHXNDr.exe
  C:\Windows\System\mjHXNDr.exe
  2⤵
  PID:4052
- C:\Windows\System\kqSsbCZ.exe
  C:\Windows\System\kqSsbCZ.exe
  2⤵
  PID:3960
- C:\Windows\System\uAWvjwH.exe
  C:\Windows\System\uAWvjwH.exe
  2⤵
  PID:3712
- C:\Windows\System\pjRwtZh.exe
  C:\Windows\System\pjRwtZh.exe
  2⤵
  PID:3948
- C:\Windows\System\Zdckkuw.exe
  C:\Windows\System\Zdckkuw.exe
  2⤵
  PID:4196
- C:\Windows\System\ChZjomt.exe
  C:\Windows\System\ChZjomt.exe
  2⤵
  PID:4152
- C:\Windows\System\iaBJLQI.exe
  C:\Windows\System\iaBJLQI.exe
  2⤵
  PID:3860
- C:\Windows\System\JarwSmQ.exe
  C:\Windows\System\JarwSmQ.exe
  2⤵
  PID:4252
- C:\Windows\System\lhMReqs.exe
  C:\Windows\System\lhMReqs.exe
  2⤵
  PID:4332
- C:\Windows\System\AENewqY.exe
  C:\Windows\System\AENewqY.exe
  2⤵
  PID:4272
- C:\Windows\System\IZSWCSO.exe
  C:\Windows\System\IZSWCSO.exe
  2⤵
  PID:4376
- C:\Windows\System\fRuYsQV.exe
  C:\Windows\System\fRuYsQV.exe
  2⤵
  PID:4348
- C:\Windows\System\Isbfefy.exe
  C:\Windows\System\Isbfefy.exe
  2⤵
  PID:4416
- C:\Windows\System\mZQSphk.exe
  C:\Windows\System\mZQSphk.exe
  2⤵
  PID:4484
- C:\Windows\System\EtddirF.exe
  C:\Windows\System\EtddirF.exe
  2⤵
  PID:4468
- C:\Windows\System\dHmvhCe.exe
  C:\Windows\System\dHmvhCe.exe
  2⤵
  PID:4564
- C:\Windows\System\IFwAFrb.exe
  C:\Windows\System\IFwAFrb.exe
  2⤵
  PID:4604
- C:\Windows\System\eCPxGpQ.exe
  C:\Windows\System\eCPxGpQ.exe
  2⤵
  PID:4668
- C:\Windows\System\aahthPv.exe
  C:\Windows\System\aahthPv.exe
  2⤵
  PID:4684
- C:\Windows\System\eNfktto.exe
  C:\Windows\System\eNfktto.exe
  2⤵
  PID:4616
- C:\Windows\System\eLnYDOb.exe
  C:\Windows\System\eLnYDOb.exe
  2⤵
  PID:4544
- C:\Windows\System\lhoGcmD.exe
  C:\Windows\System\lhoGcmD.exe
  2⤵
  PID:4652
- C:\Windows\System\FRFsgKW.exe
  C:\Windows\System\FRFsgKW.exe
  2⤵
  PID:4732
- C:\Windows\System\sHOVVtV.exe
  C:\Windows\System\sHOVVtV.exe
  2⤵
  PID:4780
- C:\Windows\System\cLNTmLX.exe
  C:\Windows\System\cLNTmLX.exe
  2⤵
  PID:4852
- C:\Windows\System\PdlntHQ.exe
  C:\Windows\System\PdlntHQ.exe
  2⤵
  PID:4924
- C:\Windows\System\vVgvJey.exe
  C:\Windows\System\vVgvJey.exe
  2⤵
  PID:4796
- C:\Windows\System\qnSmvrs.exe
  C:\Windows\System\qnSmvrs.exe
  2⤵
  PID:4972
- C:\Windows\System\KEbhkRP.exe
  C:\Windows\System\KEbhkRP.exe
  2⤵
  PID:5016
- C:\Windows\System\GTDKMiM.exe
  C:\Windows\System\GTDKMiM.exe
  2⤵
  PID:4168
- C:\Windows\System\DxJnsYK.exe
  C:\Windows\System\DxJnsYK.exe
  2⤵
  PID:5052
- C:\Windows\System\jlgBncm.exe
  C:\Windows\System\jlgBncm.exe
  2⤵
  PID:5076
- C:\Windows\System\dyHiYFS.exe
  C:\Windows\System\dyHiYFS.exe
  2⤵
  PID:5096
- C:\Windows\System\miNbbih.exe
  C:\Windows\System\miNbbih.exe
  2⤵
  PID:4136
- C:\Windows\System\IOCxKSA.exe
  C:\Windows\System\IOCxKSA.exe
  2⤵
  PID:4140
- C:\Windows\System\RycKkXH.exe
  C:\Windows\System\RycKkXH.exe
  2⤵
  PID:3780
- C:\Windows\System\uTziDdI.exe
  C:\Windows\System\uTziDdI.exe
  2⤵
  PID:4224
- C:\Windows\System\MfEmpdy.exe
  C:\Windows\System\MfEmpdy.exe
  2⤵
  PID:4228
- C:\Windows\System\wouuxxz.exe
  C:\Windows\System\wouuxxz.exe
  2⤵
  PID:4288
- C:\Windows\System\uZAeEjD.exe
  C:\Windows\System\uZAeEjD.exe
  2⤵
  PID:4320
- C:\Windows\System\zXDHJkj.exe
  C:\Windows\System\zXDHJkj.exe
  2⤵
  PID:4392
- C:\Windows\System\qcFtGiM.exe
  C:\Windows\System\qcFtGiM.exe
  2⤵
  PID:4432
- C:\Windows\System\AAAQNru.exe
  C:\Windows\System\AAAQNru.exe
  2⤵
  PID:4492
- C:\Windows\System\VEgEywx.exe
  C:\Windows\System\VEgEywx.exe
  2⤵
  PID:4680
- C:\Windows\System\jfnnGij.exe
  C:\Windows\System\jfnnGij.exe
  2⤵
  PID:4756
- C:\Windows\System\GtzUToe.exe
  C:\Windows\System\GtzUToe.exe
  2⤵
  PID:4888
- C:\Windows\System\lMhvwXW.exe
  C:\Windows\System\lMhvwXW.exe
  2⤵
  PID:4944
- C:\Windows\System\DzNxLKn.exe
  C:\Windows\System\DzNxLKn.exe
  2⤵
  PID:4960
- C:\Windows\System\amAVRVu.exe
  C:\Windows\System\amAVRVu.exe
  2⤵
  PID:4868
- C:\Windows\System\rFZtQRM.exe
  C:\Windows\System\rFZtQRM.exe
  2⤵
  PID:4132
- C:\Windows\System\eRdorIJ.exe
  C:\Windows\System\eRdorIJ.exe
  2⤵
  PID:4284
- C:\Windows\System\gUowRxm.exe
  C:\Windows\System\gUowRxm.exe
  2⤵
  PID:4352
- C:\Windows\System\pMwuzmV.exe
  C:\Windows\System\pMwuzmV.exe
  2⤵
  PID:4428
- C:\Windows\System\LraZTlH.exe
  C:\Windows\System\LraZTlH.exe
  2⤵
  PID:5092
- C:\Windows\System\PjaqVsK.exe
  C:\Windows\System\PjaqVsK.exe
  2⤵
  PID:4560
- C:\Windows\System\XNbjWTV.exe
  C:\Windows\System\XNbjWTV.exe
  2⤵
  PID:4584
- C:\Windows\System\emckfbW.exe
  C:\Windows\System\emckfbW.exe
  2⤵
  PID:4264
- C:\Windows\System\chYgvJT.exe
  C:\Windows\System\chYgvJT.exe
  2⤵
  PID:4408
- C:\Windows\System\aDpMTbE.exe
  C:\Windows\System\aDpMTbE.exe
  2⤵
  PID:4464
- C:\Windows\System\xURYUCN.exe
  C:\Windows\System\xURYUCN.exe
  2⤵
  PID:4956
- C:\Windows\System\GDbmDVJ.exe
  C:\Windows\System\GDbmDVJ.exe
  2⤵
  PID:4872
- C:\Windows\System\IunxdhD.exe
  C:\Windows\System\IunxdhD.exe
  2⤵
  PID:5064
- C:\Windows\System\NkYOeUt.exe
  C:\Windows\System\NkYOeUt.exe
  2⤵
  PID:4056
- C:\Windows\System\fnbRpIY.exe
  C:\Windows\System\fnbRpIY.exe
  2⤵
  PID:5044
- C:\Windows\System\PrcdrkS.exe
  C:\Windows\System\PrcdrkS.exe
  2⤵
  PID:4692
- C:\Windows\System\irOzphI.exe
  C:\Windows\System\irOzphI.exe
  2⤵
  PID:4728
- C:\Windows\System\MCBGWMx.exe
  C:\Windows\System\MCBGWMx.exe
  2⤵
  PID:3428
- C:\Windows\System\gSxNZZS.exe
  C:\Windows\System\gSxNZZS.exe
  2⤵
  PID:4656
- C:\Windows\System\lQnNpix.exe
  C:\Windows\System\lQnNpix.exe
  2⤵
  PID:5000
- C:\Windows\System\xzHfdEN.exe
  C:\Windows\System\xzHfdEN.exe
  2⤵
  PID:4848
- C:\Windows\System\CYIdMMf.exe
  C:\Windows\System\CYIdMMf.exe
  2⤵
  PID:4904
- C:\Windows\System\nJmZaXY.exe
  C:\Windows\System\nJmZaXY.exe
  2⤵
  PID:5136
- C:\Windows\System\pBTUJQI.exe
  C:\Windows\System\pBTUJQI.exe
  2⤵
  PID:5152
- C:\Windows\System\VrWbIsJ.exe
  C:\Windows\System\VrWbIsJ.exe
  2⤵
  PID:5172
- C:\Windows\System\HkzLUIW.exe
  C:\Windows\System\HkzLUIW.exe
  2⤵
  PID:5192
- C:\Windows\System\PbuNviK.exe
  C:\Windows\System\PbuNviK.exe
  2⤵
  PID:5216
- C:\Windows\System\ivkJDAV.exe
  C:\Windows\System\ivkJDAV.exe
  2⤵
  PID:5232
- C:\Windows\System\tdapghx.exe
  C:\Windows\System\tdapghx.exe
  2⤵
  PID:5252
- C:\Windows\System\fBhvtim.exe
  C:\Windows\System\fBhvtim.exe
  2⤵
  PID:5288
- C:\Windows\System\yoxtmPa.exe
  C:\Windows\System\yoxtmPa.exe
  2⤵
  PID:5304
- C:\Windows\System\NMvXkmr.exe
  C:\Windows\System\NMvXkmr.exe
  2⤵
  PID:5320
- C:\Windows\System\cHgglZZ.exe
  C:\Windows\System\cHgglZZ.exe
  2⤵
  PID:5336
- C:\Windows\System\UZZsojy.exe
  C:\Windows\System\UZZsojy.exe
  2⤵
  PID:5352
- C:\Windows\System\TKzwNXW.exe
  C:\Windows\System\TKzwNXW.exe
  2⤵
  PID:5376
- C:\Windows\System\BnfTQSa.exe
  C:\Windows\System\BnfTQSa.exe
  2⤵
  PID:5396
- C:\Windows\System\jMOigSg.exe
  C:\Windows\System\jMOigSg.exe
  2⤵
  PID:5412
- C:\Windows\System\nZLFYdh.exe
  C:\Windows\System\nZLFYdh.exe
  2⤵
  PID:5428
- C:\Windows\System\brLJKWY.exe
  C:\Windows\System\brLJKWY.exe
  2⤵
  PID:5444
- C:\Windows\System\dXrSvoO.exe
  C:\Windows\System\dXrSvoO.exe
  2⤵
  PID:5460
- C:\Windows\System\MHqPYSS.exe
  C:\Windows\System\MHqPYSS.exe
  2⤵
  PID:5488
- C:\Windows\System\YEUVmSi.exe
  C:\Windows\System\YEUVmSi.exe
  2⤵
  PID:5544
- C:\Windows\System\SJrTPby.exe
  C:\Windows\System\SJrTPby.exe
  2⤵
  PID:5560
- C:\Windows\System\QVDqOid.exe
  C:\Windows\System\QVDqOid.exe
  2⤵
  PID:5576
- C:\Windows\System\jDYkMEN.exe
  C:\Windows\System\jDYkMEN.exe
  2⤵
  PID:5596
- C:\Windows\System\AmgaoaW.exe
  C:\Windows\System\AmgaoaW.exe
  2⤵
  PID:5612
- C:\Windows\System\WKVaaDO.exe
  C:\Windows\System\WKVaaDO.exe
  2⤵
  PID:5628
- C:\Windows\System\JbeqSoG.exe
  C:\Windows\System\JbeqSoG.exe
  2⤵
  PID:5644
- C:\Windows\System\vkRnIyS.exe
  C:\Windows\System\vkRnIyS.exe
  2⤵
  PID:5664
- C:\Windows\System\sohQXfn.exe
  C:\Windows\System\sohQXfn.exe
  2⤵
  PID:5688
- C:\Windows\System\oruipcA.exe
  C:\Windows\System\oruipcA.exe
  2⤵
  PID:5704
- C:\Windows\System\TKSoWae.exe
  C:\Windows\System\TKSoWae.exe
  2⤵
  PID:5724
- C:\Windows\System\KIjsyWu.exe
  C:\Windows\System\KIjsyWu.exe
  2⤵
  PID:5756
- C:\Windows\System\PDCkazv.exe
  C:\Windows\System\PDCkazv.exe
  2⤵
  PID:5784
- C:\Windows\System\oKtWMmC.exe
  C:\Windows\System\oKtWMmC.exe
  2⤵
  PID:5808
- C:\Windows\System\MGxoOWL.exe
  C:\Windows\System\MGxoOWL.exe
  2⤵
  PID:5828
- C:\Windows\System\FuJJuLp.exe
  C:\Windows\System\FuJJuLp.exe
  2⤵
  PID:5844
- C:\Windows\System\SNroLwd.exe
  C:\Windows\System\SNroLwd.exe
  2⤵
  PID:5864
- C:\Windows\System\jMtihMv.exe
  C:\Windows\System\jMtihMv.exe
  2⤵
  PID:5884
- C:\Windows\System\MwDJkFF.exe
  C:\Windows\System\MwDJkFF.exe
  2⤵
  PID:5900
- C:\Windows\System\iJZjgpQ.exe
  C:\Windows\System\iJZjgpQ.exe
  2⤵
  PID:5920
- C:\Windows\System\pocdcSu.exe
  C:\Windows\System\pocdcSu.exe
  2⤵
  PID:5944
- C:\Windows\System\lwTAnIE.exe
  C:\Windows\System\lwTAnIE.exe
  2⤵
  PID:5960
- C:\Windows\System\tfMRnWk.exe
  C:\Windows\System\tfMRnWk.exe
  2⤵
  PID:5976
- C:\Windows\System\YrmRqbv.exe
  C:\Windows\System\YrmRqbv.exe
  2⤵
  PID:5992
- C:\Windows\System\AMEZUIZ.exe
  C:\Windows\System\AMEZUIZ.exe
  2⤵
  PID:6020
- C:\Windows\System\KQvbGDn.exe
  C:\Windows\System\KQvbGDn.exe
  2⤵
  PID:6044
- C:\Windows\System\agYZDaU.exe
  C:\Windows\System\agYZDaU.exe
  2⤵
  PID:6064
- C:\Windows\System\YAxHvdf.exe
  C:\Windows\System\YAxHvdf.exe
  2⤵
  PID:6080
- C:\Windows\System\owBdtqO.exe
  C:\Windows\System\owBdtqO.exe
  2⤵
  PID:6096
- C:\Windows\System\FYpFsHS.exe
  C:\Windows\System\FYpFsHS.exe
  2⤵
  PID:6116
- C:\Windows\System\vpIKxMZ.exe
  C:\Windows\System\vpIKxMZ.exe
  2⤵
  PID:6132
- C:\Windows\System\ZaofMvh.exe
  C:\Windows\System\ZaofMvh.exe
  2⤵
  PID:4372
- C:\Windows\System\bcjoYqz.exe
  C:\Windows\System\bcjoYqz.exe
  2⤵
  PID:5144
- C:\Windows\System\LuHOwIK.exe
  C:\Windows\System\LuHOwIK.exe
  2⤵
  PID:4632
- C:\Windows\System\LidNipN.exe
  C:\Windows\System\LidNipN.exe
  2⤵
  PID:5184
- C:\Windows\System\udnIJAE.exe
  C:\Windows\System\udnIJAE.exe
  2⤵
  PID:5264
- C:\Windows\System\uoipjaM.exe
  C:\Windows\System\uoipjaM.exe
  2⤵
  PID:5048
- C:\Windows\System\jwgHmYk.exe
  C:\Windows\System\jwgHmYk.exe
  2⤵
  PID:5160
- C:\Windows\System\JhsDoZT.exe
  C:\Windows\System\JhsDoZT.exe
  2⤵
  PID:5212
- C:\Windows\System\VuuJOHi.exe
  C:\Windows\System\VuuJOHi.exe
  2⤵
  PID:5360
- C:\Windows\System\wdIFBak.exe
  C:\Windows\System\wdIFBak.exe
  2⤵
  PID:5404
- C:\Windows\System\CSPtoeu.exe
  C:\Windows\System\CSPtoeu.exe
  2⤵
  PID:5468
- C:\Windows\System\kgSwPhE.exe
  C:\Windows\System\kgSwPhE.exe
  2⤵
  PID:5420
- C:\Windows\System\LrUTTUk.exe
  C:\Windows\System\LrUTTUk.exe
  2⤵
  PID:5456
- C:\Windows\System\DtItcnF.exe
  C:\Windows\System\DtItcnF.exe
  2⤵
  PID:5504
- C:\Windows\System\YzIffuS.exe
  C:\Windows\System\YzIffuS.exe
  2⤵
  PID:5532
- C:\Windows\System\amkVzmT.exe
  C:\Windows\System\amkVzmT.exe
  2⤵
  PID:5584
- C:\Windows\System\MBRHudC.exe
  C:\Windows\System\MBRHudC.exe
  2⤵
  PID:5624
- C:\Windows\System\hLzKfQU.exe
  C:\Windows\System\hLzKfQU.exe
  2⤵
  PID:5652
- C:\Windows\System\TPAaWoq.exe
  C:\Windows\System\TPAaWoq.exe
  2⤵
  PID:5712
- C:\Windows\System\aSGZVny.exe
  C:\Windows\System\aSGZVny.exe
  2⤵
  PID:5732
- C:\Windows\System\GpYxXIU.exe
  C:\Windows\System\GpYxXIU.exe
  2⤵
  PID:5748
- C:\Windows\System\kQLomZT.exe
  C:\Windows\System\kQLomZT.exe
  2⤵
  PID:5800
- C:\Windows\System\uGHIoqc.exe
  C:\Windows\System\uGHIoqc.exe
  2⤵
  PID:5836
- C:\Windows\System\PCLkVRn.exe
  C:\Windows\System\PCLkVRn.exe
  2⤵
  PID:5776
- C:\Windows\System\AiqlCai.exe
  C:\Windows\System\AiqlCai.exe
  2⤵
  PID:5908
- C:\Windows\System\Qkktjcj.exe
  C:\Windows\System\Qkktjcj.exe
  2⤵
  PID:5820
- C:\Windows\System\xJdDvdj.exe
  C:\Windows\System\xJdDvdj.exe
  2⤵
  PID:5860
- C:\Windows\System\swziOQW.exe
  C:\Windows\System\swziOQW.exe
  2⤵
  PID:5936
- C:\Windows\System\bTHLddq.exe
  C:\Windows\System\bTHLddq.exe
  2⤵
  PID:6032
- C:\Windows\System\abGyzJr.exe
  C:\Windows\System\abGyzJr.exe
  2⤵
  PID:6076
- C:\Windows\System\YITZEec.exe
  C:\Windows\System\YITZEec.exe
  2⤵
  PID:6112
- C:\Windows\System\zlGYKts.exe
  C:\Windows\System\zlGYKts.exe
  2⤵
  PID:6008
- C:\Windows\System\haFCmFQ.exe
  C:\Windows\System\haFCmFQ.exe
  2⤵
  PID:6128
- C:\Windows\System\YLRzYkw.exe
  C:\Windows\System\YLRzYkw.exe
  2⤵
  PID:4672
- C:\Windows\System\SRuHmrZ.exe
  C:\Windows\System\SRuHmrZ.exe
  2⤵
  PID:4776
- C:\Windows\System\dSSsgRZ.exe
  C:\Windows\System\dSSsgRZ.exe
  2⤵
  PID:6092
- C:\Windows\System\GCpXydf.exe
  C:\Windows\System\GCpXydf.exe
  2⤵
  PID:5328
- C:\Windows\System\BBkwDId.exe
  C:\Windows\System\BBkwDId.exe
  2⤵
  PID:4712
- C:\Windows\System\bCCQODD.exe
  C:\Windows\System\bCCQODD.exe
  2⤵
  PID:5204
- C:\Windows\System\ZGKGaXy.exe
  C:\Windows\System\ZGKGaXy.exe
  2⤵
  PID:5424
- C:\Windows\System\tdybUHu.exe
  C:\Windows\System\tdybUHu.exe
  2⤵
  PID:5484
- C:\Windows\System\BvEosic.exe
  C:\Windows\System\BvEosic.exe
  2⤵
  PID:5592
- C:\Windows\System\HOLGJlU.exe
  C:\Windows\System\HOLGJlU.exe
  2⤵
  PID:5620
- C:\Windows\System\DyJciSy.exe
  C:\Windows\System\DyJciSy.exe
  2⤵
  PID:5656
- C:\Windows\System\AmqrURz.exe
  C:\Windows\System\AmqrURz.exe
  2⤵
  PID:5568
- C:\Windows\System\CxDAdRL.exe
  C:\Windows\System\CxDAdRL.exe
  2⤵
  PID:5720
- C:\Windows\System\wKludYf.exe
  C:\Windows\System\wKludYf.exe
  2⤵
  PID:5772
- C:\Windows\System\peshlYW.exe
  C:\Windows\System\peshlYW.exe
  2⤵
  PID:5956
- C:\Windows\System\LvClaZG.exe
  C:\Windows\System\LvClaZG.exe
  2⤵
  PID:6028
- C:\Windows\System\XuBRKbx.exe
  C:\Windows\System\XuBRKbx.exe
  2⤵
  PID:5940
- C:\Windows\System\KhfIOwG.exe
  C:\Windows\System\KhfIOwG.exe
  2⤵
  PID:6052
- C:\Windows\System\oBRryfp.exe
  C:\Windows\System\oBRryfp.exe
  2⤵
  PID:4488
- C:\Windows\System\pJibhdU.exe
  C:\Windows\System\pJibhdU.exe
  2⤵
  PID:5244
- C:\Windows\System\VBNOPdD.exe
  C:\Windows\System\VBNOPdD.exe
  2⤵
  PID:4996
- C:\Windows\System\WqoLHYL.exe
  C:\Windows\System\WqoLHYL.exe
  2⤵
  PID:5260
- C:\Windows\System\SBlMEvC.exe
  C:\Windows\System\SBlMEvC.exe
  2⤵
  PID:5128
- C:\Windows\System\iHqNWCN.exe
  C:\Windows\System\iHqNWCN.exe
  2⤵
  PID:5316
- C:\Windows\System\CkseFXf.exe
  C:\Windows\System\CkseFXf.exe
  2⤵
  PID:5436
- C:\Windows\System\wywmdZU.exe
  C:\Windows\System\wywmdZU.exe
  2⤵
  PID:5284
- C:\Windows\System\KdkqLVB.exe
  C:\Windows\System\KdkqLVB.exe
  2⤵
  PID:5500
- C:\Windows\System\ElQiQKF.exe
  C:\Windows\System\ElQiQKF.exe
  2⤵
  PID:5856
- C:\Windows\System\qLNEHse.exe
  C:\Windows\System\qLNEHse.exe
  2⤵
  PID:5744
- C:\Windows\System\VTPASGd.exe
  C:\Windows\System\VTPASGd.exe
  2⤵
  PID:5780
- C:\Windows\System\VaWsWBD.exe
  C:\Windows\System\VaWsWBD.exe
  2⤵
  PID:5528
- C:\Windows\System\HNySvmq.exe
  C:\Windows\System\HNySvmq.exe
  2⤵
  PID:6000
- C:\Windows\System\vqdaWIg.exe
  C:\Windows\System\vqdaWIg.exe
  2⤵
  PID:4452
- C:\Windows\System\mLLoaam.exe
  C:\Windows\System\mLLoaam.exe
  2⤵
  PID:5524
- C:\Windows\System\UByaNrI.exe
  C:\Windows\System\UByaNrI.exe
  2⤵
  PID:5072
- C:\Windows\System\qBUTkNr.exe
  C:\Windows\System\qBUTkNr.exe
  2⤵
  PID:6036
- C:\Windows\System\IStfcUr.exe
  C:\Windows\System\IStfcUr.exe
  2⤵
  PID:5556
- C:\Windows\System\yhEllZa.exe
  C:\Windows\System\yhEllZa.exe
  2⤵
  PID:5816
- C:\Windows\System\YZYrLOd.exe
  C:\Windows\System\YZYrLOd.exe
  2⤵
  PID:5520
- C:\Windows\System\ZcZqpiF.exe
  C:\Windows\System\ZcZqpiF.exe
  2⤵
  PID:5020
- C:\Windows\System\LnGqlua.exe
  C:\Windows\System\LnGqlua.exe
  2⤵
  PID:6004
- C:\Windows\System\CYOIBHy.exe
  C:\Windows\System\CYOIBHy.exe
  2⤵
  PID:5508
- C:\Windows\System\FENENNs.exe
  C:\Windows\System\FENENNs.exe
  2⤵
  PID:6012
- C:\Windows\System\ACRwVao.exe
  C:\Windows\System\ACRwVao.exe
  2⤵
  PID:5764
- C:\Windows\System\pPKHKTz.exe
  C:\Windows\System\pPKHKTz.exe
  2⤵
  PID:5796
- C:\Windows\System\PiSqYjx.exe
  C:\Windows\System\PiSqYjx.exe
  2⤵
  PID:6088
- C:\Windows\System\HaadXYT.exe
  C:\Windows\System\HaadXYT.exe
  2⤵
  PID:5916
- C:\Windows\System\fIJbLnP.exe
  C:\Windows\System\fIJbLnP.exe
  2⤵
  PID:6160
- C:\Windows\System\FezNKmb.exe
  C:\Windows\System\FezNKmb.exe
  2⤵
  PID:6180
- C:\Windows\System\vuzxKOW.exe
  C:\Windows\System\vuzxKOW.exe
  2⤵
  PID:6196
- C:\Windows\System\BFaHnnd.exe
  C:\Windows\System\BFaHnnd.exe
  2⤵
  PID:6216
- C:\Windows\System\KpZezkY.exe
  C:\Windows\System\KpZezkY.exe
  2⤵
  PID:6232
- C:\Windows\System\tkjdGMj.exe
  C:\Windows\System\tkjdGMj.exe
  2⤵
  PID:6252
- C:\Windows\System\YvEwjvQ.exe
  C:\Windows\System\YvEwjvQ.exe
  2⤵
  PID:6284
- C:\Windows\System\xlONlxf.exe
  C:\Windows\System\xlONlxf.exe
  2⤵
  PID:6300
- C:\Windows\System\bLKqebC.exe
  C:\Windows\System\bLKqebC.exe
  2⤵
  PID:6316
- C:\Windows\System\TonvjAG.exe
  C:\Windows\System\TonvjAG.exe
  2⤵
  PID:6332
- C:\Windows\System\QGMBorw.exe
  C:\Windows\System\QGMBorw.exe
  2⤵
  PID:6352
- C:\Windows\System\NgDrFnf.exe
  C:\Windows\System\NgDrFnf.exe
  2⤵
  PID:6368
- C:\Windows\System\aOwQudH.exe
  C:\Windows\System\aOwQudH.exe
  2⤵
  PID:6384
- C:\Windows\System\WbfiYRx.exe
  C:\Windows\System\WbfiYRx.exe
  2⤵
  PID:6424
- C:\Windows\System\wdHKCDm.exe
  C:\Windows\System\wdHKCDm.exe
  2⤵
  PID:6440
- C:\Windows\System\SlHJIqq.exe
  C:\Windows\System\SlHJIqq.exe
  2⤵
  PID:6456
- C:\Windows\System\zAiIfQF.exe
  C:\Windows\System\zAiIfQF.exe
  2⤵
  PID:6476
- C:\Windows\System\LnhjmxA.exe
  C:\Windows\System\LnhjmxA.exe
  2⤵
  PID:6496
- C:\Windows\System\jPGCMfO.exe
  C:\Windows\System\jPGCMfO.exe
  2⤵
  PID:6520
- C:\Windows\System\wnAnofC.exe
  C:\Windows\System\wnAnofC.exe
  2⤵
  PID:6540
- C:\Windows\System\fJhToLz.exe
  C:\Windows\System\fJhToLz.exe
  2⤵
  PID:6560
- C:\Windows\System\PCfRxqg.exe
  C:\Windows\System\PCfRxqg.exe
  2⤵
  PID:6580
- C:\Windows\System\zfifndS.exe
  C:\Windows\System\zfifndS.exe
  2⤵
  PID:6596
- C:\Windows\System\CjgEMHd.exe
  C:\Windows\System\CjgEMHd.exe
  2⤵
  PID:6616
- C:\Windows\System\DHaynUm.exe
  C:\Windows\System\DHaynUm.exe
  2⤵
  PID:6636
- C:\Windows\System\WVSRuXC.exe
  C:\Windows\System\WVSRuXC.exe
  2⤵
  PID:6652
- C:\Windows\System\jQQNfCX.exe
  C:\Windows\System\jQQNfCX.exe
  2⤵
  PID:6672
- C:\Windows\System\KpQUzPz.exe
  C:\Windows\System\KpQUzPz.exe
  2⤵
  PID:6688
- C:\Windows\System\TjVfqiS.exe
  C:\Windows\System\TjVfqiS.exe
  2⤵
  PID:6704
- C:\Windows\System\uQdQnLf.exe
  C:\Windows\System\uQdQnLf.exe
  2⤵
  PID:6724
- C:\Windows\System\mjskLAl.exe
  C:\Windows\System\mjskLAl.exe
  2⤵
  PID:6740
- C:\Windows\System\idyFXmR.exe
  C:\Windows\System\idyFXmR.exe
  2⤵
  PID:6764
- C:\Windows\System\bVSMwfe.exe
  C:\Windows\System\bVSMwfe.exe
  2⤵
  PID:6784
- C:\Windows\System\ynzvKwj.exe
  C:\Windows\System\ynzvKwj.exe
  2⤵
  PID:6824
- C:\Windows\System\ZtLlWlP.exe
  C:\Windows\System\ZtLlWlP.exe
  2⤵
  PID:6848
- C:\Windows\System\uOsrYff.exe
  C:\Windows\System\uOsrYff.exe
  2⤵
  PID:6864
- C:\Windows\System\uuDMgmF.exe
  C:\Windows\System\uuDMgmF.exe
  2⤵
  PID:6880
- C:\Windows\System\zNcmYIm.exe
  C:\Windows\System\zNcmYIm.exe
  2⤵
  PID:6900
- C:\Windows\System\KHqsICT.exe
  C:\Windows\System\KHqsICT.exe
  2⤵
  PID:6916
- C:\Windows\System\KCICgRv.exe
  C:\Windows\System\KCICgRv.exe
  2⤵
  PID:6944
- C:\Windows\System\odevJVv.exe
  C:\Windows\System\odevJVv.exe
  2⤵
  PID:6968
- C:\Windows\System\urHkUji.exe
  C:\Windows\System\urHkUji.exe
  2⤵
  PID:6984
- C:\Windows\System\HKqDTzZ.exe
  C:\Windows\System\HKqDTzZ.exe
  2⤵
  PID:7000
- C:\Windows\System\Yibroig.exe
  C:\Windows\System\Yibroig.exe
  2⤵
  PID:7020
- C:\Windows\System\eaXmieA.exe
  C:\Windows\System\eaXmieA.exe
  2⤵
  PID:7044
- C:\Windows\System\EYPGjay.exe
  C:\Windows\System\EYPGjay.exe
  2⤵
  PID:7060
- C:\Windows\System\smREUWi.exe
  C:\Windows\System\smREUWi.exe
  2⤵
  PID:7080
- C:\Windows\System\guKRRWp.exe
  C:\Windows\System\guKRRWp.exe
  2⤵
  PID:7104
- C:\Windows\System\GKqHxxA.exe
  C:\Windows\System\GKqHxxA.exe
  2⤵
  PID:7120
- C:\Windows\System\JTfkZwD.exe
  C:\Windows\System\JTfkZwD.exe
  2⤵
  PID:7136
- C:\Windows\System\pWgYzsu.exe
  C:\Windows\System\pWgYzsu.exe
  2⤵
  PID:7160
- C:\Windows\System\uouwhQw.exe
  C:\Windows\System\uouwhQw.exe
  2⤵
  PID:5608
- C:\Windows\System\RosYlRQ.exe
  C:\Windows\System\RosYlRQ.exe
  2⤵
  PID:5700
- C:\Windows\System\CGiHXOO.exe
  C:\Windows\System\CGiHXOO.exe
  2⤵
  PID:6168
- C:\Windows\System\LJoBItK.exe
  C:\Windows\System\LJoBItK.exe
  2⤵
  PID:6228
- C:\Windows\System\XzznBUO.exe
  C:\Windows\System\XzznBUO.exe
  2⤵
  PID:6268
- C:\Windows\System\NfpinVH.exe
  C:\Windows\System\NfpinVH.exe
  2⤵
  PID:6208
- C:\Windows\System\dhgPBgU.exe
  C:\Windows\System\dhgPBgU.exe
  2⤵
  PID:6296
- C:\Windows\System\CxHXxkt.exe
  C:\Windows\System\CxHXxkt.exe
  2⤵
  PID:6312
- C:\Windows\System\tTnkUAG.exe
  C:\Windows\System\tTnkUAG.exe
  2⤵
  PID:6380
- C:\Windows\System\jNujsih.exe
  C:\Windows\System\jNujsih.exe
  2⤵
  PID:6400
- C:\Windows\System\bMJwjjQ.exe
  C:\Windows\System\bMJwjjQ.exe
  2⤵
  PID:6396
- C:\Windows\System\tRTLOib.exe
  C:\Windows\System\tRTLOib.exe
  2⤵
  PID:6468
- C:\Windows\System\dgiFfaG.exe
  C:\Windows\System\dgiFfaG.exe
  2⤵
  PID:6516
- C:\Windows\System\TVbFuhv.exe
  C:\Windows\System\TVbFuhv.exe
  2⤵
  PID:6452
- C:\Windows\System\ApjKROI.exe
  C:\Windows\System\ApjKROI.exe
  2⤵
  PID:6532
- C:\Windows\System\pObPaou.exe
  C:\Windows\System\pObPaou.exe
  2⤵
  PID:6568
- C:\Windows\System\WYHtSiq.exe
  C:\Windows\System\WYHtSiq.exe
  2⤵
  PID:6628
- C:\Windows\System\BOCobnL.exe
  C:\Windows\System\BOCobnL.exe
  2⤵
  PID:6664
- C:\Windows\System\qLsUNci.exe
  C:\Windows\System\qLsUNci.exe
  2⤵
  PID:6716
- C:\Windows\System\tdhRyGp.exe
  C:\Windows\System\tdhRyGp.exe
  2⤵
  PID:6684
- C:\Windows\System\hTmwwga.exe
  C:\Windows\System\hTmwwga.exe
  2⤵
  PID:6804
- C:\Windows\System\QmraQca.exe
  C:\Windows\System\QmraQca.exe
  2⤵
  PID:6812
- C:\Windows\System\Uvyaklm.exe
  C:\Windows\System\Uvyaklm.exe
  2⤵
  PID:6836
- C:\Windows\System\PxWaXBI.exe
  C:\Windows\System\PxWaXBI.exe
  2⤵
  PID:6908
- C:\Windows\System\MlKGEdL.exe
  C:\Windows\System\MlKGEdL.exe
  2⤵
  PID:6952
- C:\Windows\System\YpBzMAl.exe
  C:\Windows\System\YpBzMAl.exe
  2⤵
  PID:6936
- C:\Windows\System\zeKCwZu.exe
  C:\Windows\System\zeKCwZu.exe
  2⤵
  PID:6976
- C:\Windows\System\myOtBvi.exe
  C:\Windows\System\myOtBvi.exe
  2⤵
  PID:7028
- C:\Windows\System\tAhCdzw.exe
  C:\Windows\System\tAhCdzw.exe
  2⤵
  PID:7008
- C:\Windows\System\CwpZGbe.exe
  C:\Windows\System\CwpZGbe.exe
  2⤵
  PID:7068
- C:\Windows\System\gaowxIh.exe
  C:\Windows\System\gaowxIh.exe
  2⤵
  PID:7112
- C:\Windows\System\EzhAQUg.exe
  C:\Windows\System\EzhAQUg.exe
  2⤵
  PID:7128
- C:\Windows\System\ScjIkSp.exe
  C:\Windows\System\ScjIkSp.exe
  2⤵
  PID:5972
- C:\Windows\System\wlRkzPc.exe
  C:\Windows\System\wlRkzPc.exe
  2⤵
  PID:6156
- C:\Windows\System\idiqZdK.exe
  C:\Windows\System\idiqZdK.exe
  2⤵
  PID:6224
- C:\Windows\System\ucKcIiC.exe
  C:\Windows\System\ucKcIiC.exe
  2⤵
  PID:6260
- C:\Windows\System\TmrBOWI.exe
  C:\Windows\System\TmrBOWI.exe
  2⤵
  PID:6324
- C:\Windows\System\pUbnwNW.exe
  C:\Windows\System\pUbnwNW.exe
  2⤵
  PID:6404
- C:\Windows\System\RksbRSq.exe
  C:\Windows\System\RksbRSq.exe
  2⤵
  PID:6556
- C:\Windows\System\vYIacnj.exe
  C:\Windows\System\vYIacnj.exe
  2⤵
  PID:6660
- C:\Windows\System\DFOlAPC.exe
  C:\Windows\System\DFOlAPC.exe
  2⤵
  PID:6700
- C:\Windows\System\CMksxaK.exe
  C:\Windows\System\CMksxaK.exe
  2⤵
  PID:6528
- C:\Windows\System\TChjUJi.exe
  C:\Windows\System\TChjUJi.exe
  2⤵
  PID:6608
- C:\Windows\System\DEjvZfJ.exe
  C:\Windows\System\DEjvZfJ.exe
  2⤵
  PID:6752
- C:\Windows\System\saAcbBk.exe
  C:\Windows\System\saAcbBk.exe
  2⤵
  PID:6792
- C:\Windows\System\jmXutCq.exe
  C:\Windows\System\jmXutCq.exe
  2⤵
  PID:6876
- C:\Windows\System\oIsyacv.exe
  C:\Windows\System\oIsyacv.exe
  2⤵
  PID:6860
- C:\Windows\System\IOEdlxt.exe
  C:\Windows\System\IOEdlxt.exe
  2⤵
  PID:7016
- C:\Windows\System\PviwHVK.exe
  C:\Windows\System\PviwHVK.exe
  2⤵
  PID:7052
- C:\Windows\System\yygHGmw.exe
  C:\Windows\System\yygHGmw.exe
  2⤵
  PID:7156
- C:\Windows\System\kbgBwfO.exe
  C:\Windows\System\kbgBwfO.exe
  2⤵
  PID:7032
- C:\Windows\System\YJPxFeJ.exe
  C:\Windows\System\YJPxFeJ.exe
  2⤵
  PID:5384
- C:\Windows\System\UFJbqmc.exe
  C:\Windows\System\UFJbqmc.exe
  2⤵
  PID:6308
- C:\Windows\System\DNRUvoF.exe
  C:\Windows\System\DNRUvoF.exe
  2⤵
  PID:6436
- C:\Windows\System\kPqgTun.exe
  C:\Windows\System\kPqgTun.exe
  2⤵
  PID:6188
- C:\Windows\System\vsSkYRB.exe
  C:\Windows\System\vsSkYRB.exe
  2⤵
  PID:6736
- C:\Windows\System\BfeuxlI.exe
  C:\Windows\System\BfeuxlI.exe
  2⤵
  PID:6588
- C:\Windows\System\XzWMgsV.exe
  C:\Windows\System\XzWMgsV.exe
  2⤵
  PID:6348
- C:\Windows\System\bfjumsd.exe
  C:\Windows\System\bfjumsd.exe
  2⤵
  PID:6776
- C:\Windows\System\SFyJwhN.exe
  C:\Windows\System\SFyJwhN.exe
  2⤵
  PID:6964
- C:\Windows\System\fXHIToL.exe
  C:\Windows\System\fXHIToL.exe
  2⤵
  PID:6800
- C:\Windows\System\tNjEJBg.exe
  C:\Windows\System\tNjEJBg.exe
  2⤵
  PID:7152
- C:\Windows\System\KMkLgmn.exe
  C:\Windows\System\KMkLgmn.exe
  2⤵
  PID:6992
- C:\Windows\System\FQfkejN.exe
  C:\Windows\System\FQfkejN.exe
  2⤵
  PID:6240
- C:\Windows\System\QfGHhyC.exe
  C:\Windows\System\QfGHhyC.exe
  2⤵
  PID:6264
- C:\Windows\System\fwTKyKC.exe
  C:\Windows\System\fwTKyKC.exe
  2⤵
  PID:6344
- C:\Windows\System\NUYHFVA.exe
  C:\Windows\System\NUYHFVA.exe
  2⤵
  PID:6552
- C:\Windows\System\TaQOzOP.exe
  C:\Windows\System\TaQOzOP.exe
  2⤵
  PID:6712
- C:\Windows\System\mYTKuFr.exe
  C:\Windows\System\mYTKuFr.exe
  2⤵
  PID:7144
- C:\Windows\System\qNnJjMc.exe
  C:\Windows\System\qNnJjMc.exe
  2⤵
  PID:6244
- C:\Windows\System\pQBuGdF.exe
  C:\Windows\System\pQBuGdF.exe
  2⤵
  PID:7096
- C:\Windows\System\uMdYXJU.exe
  C:\Windows\System\uMdYXJU.exe
  2⤵
  PID:6732
- C:\Windows\System\TnpWoEO.exe
  C:\Windows\System\TnpWoEO.exe
  2⤵
  PID:6808
- C:\Windows\System\MAizDZJ.exe
  C:\Windows\System\MAizDZJ.exe
  2⤵
  PID:6760
- C:\Windows\System\WrKBHjh.exe
  C:\Windows\System\WrKBHjh.exe
  2⤵
  PID:6464
- C:\Windows\System\FNcIYza.exe
  C:\Windows\System\FNcIYza.exe
  2⤵
  PID:7072
- C:\Windows\System\gUYfEJQ.exe
  C:\Windows\System\gUYfEJQ.exe
  2⤵
  PID:6844
- C:\Windows\System\jFXWkMr.exe
  C:\Windows\System\jFXWkMr.exe
  2⤵
  PID:6488
- C:\Windows\System\VpGYalH.exe
  C:\Windows\System\VpGYalH.exe
  2⤵
  PID:6772
- C:\Windows\System\jVaBonp.exe
  C:\Windows\System\jVaBonp.exe
  2⤵
  PID:7184
- C:\Windows\System\vPvwZAQ.exe
  C:\Windows\System\vPvwZAQ.exe
  2⤵
  PID:7208
- C:\Windows\System\GnODpIC.exe
  C:\Windows\System\GnODpIC.exe
  2⤵
  PID:7232
- C:\Windows\System\JALjezZ.exe
  C:\Windows\System\JALjezZ.exe
  2⤵
  PID:7252
- C:\Windows\System\cDCbqXU.exe
  C:\Windows\System\cDCbqXU.exe
  2⤵
  PID:7272
- C:\Windows\System\BrjrZQh.exe
  C:\Windows\System\BrjrZQh.exe
  2⤵
  PID:7288
- C:\Windows\System\Zfmpytx.exe
  C:\Windows\System\Zfmpytx.exe
  2⤵
  PID:7304
- C:\Windows\System\MPtiZZc.exe
  C:\Windows\System\MPtiZZc.exe
  2⤵
  PID:7324
- C:\Windows\System\yOoeavU.exe
  C:\Windows\System\yOoeavU.exe
  2⤵
  PID:7340
- C:\Windows\System\XCxtwOM.exe
  C:\Windows\System\XCxtwOM.exe
  2⤵
  PID:7364
- C:\Windows\System\QpZLqtV.exe
  C:\Windows\System\QpZLqtV.exe
  2⤵
  PID:7380
- C:\Windows\System\kGeImhD.exe
  C:\Windows\System\kGeImhD.exe
  2⤵
  PID:7400
- C:\Windows\System\vbxYEdX.exe
  C:\Windows\System\vbxYEdX.exe
  2⤵
  PID:7436
- C:\Windows\System\wkRFYQa.exe
  C:\Windows\System\wkRFYQa.exe
  2⤵
  PID:7452
- C:\Windows\System\qiVNnOT.exe
  C:\Windows\System\qiVNnOT.exe
  2⤵
  PID:7468
- C:\Windows\System\gFveVRI.exe
  C:\Windows\System\gFveVRI.exe
  2⤵
  PID:7484
- C:\Windows\System\KZwVucR.exe
  C:\Windows\System\KZwVucR.exe
  2⤵
  PID:7512
- C:\Windows\System\jZhqoYd.exe
  C:\Windows\System\jZhqoYd.exe
  2⤵
  PID:7528
- C:\Windows\System\vFkGSur.exe
  C:\Windows\System\vFkGSur.exe
  2⤵
  PID:7556
- C:\Windows\System\BjIJBXE.exe
  C:\Windows\System\BjIJBXE.exe
  2⤵
  PID:7572
- C:\Windows\System\XZmFqRh.exe
  C:\Windows\System\XZmFqRh.exe
  2⤵
  PID:7588
- C:\Windows\System\BIYWOiH.exe
  C:\Windows\System\BIYWOiH.exe
  2⤵
  PID:7604
- C:\Windows\System\VqlcIuh.exe
  C:\Windows\System\VqlcIuh.exe
  2⤵
  PID:7632
- C:\Windows\System\CSRDUsf.exe
  C:\Windows\System\CSRDUsf.exe
  2⤵
  PID:7652
- C:\Windows\System\ktJfUwp.exe
  C:\Windows\System\ktJfUwp.exe
  2⤵
  PID:7668
- C:\Windows\System\fpfEqYq.exe
  C:\Windows\System\fpfEqYq.exe
  2⤵
  PID:7688
- C:\Windows\System\feGHdHo.exe
  C:\Windows\System\feGHdHo.exe
  2⤵
  PID:7708
- C:\Windows\System\omLNHzd.exe
  C:\Windows\System\omLNHzd.exe
  2⤵
  PID:7732
- C:\Windows\System\nWOfznH.exe
  C:\Windows\System\nWOfznH.exe
  2⤵
  PID:7760
- C:\Windows\System\vBJymrK.exe
  C:\Windows\System\vBJymrK.exe
  2⤵
  PID:7776
- C:\Windows\System\jYRvAsC.exe
  C:\Windows\System\jYRvAsC.exe
  2⤵
  PID:7792
- C:\Windows\System\BqpGWZI.exe
  C:\Windows\System\BqpGWZI.exe
  2⤵
  PID:7816
- C:\Windows\System\kOLkWKi.exe
  C:\Windows\System\kOLkWKi.exe
  2⤵
  PID:7832
- C:\Windows\System\mMUqDVz.exe
  C:\Windows\System\mMUqDVz.exe
  2⤵
  PID:7856
- C:\Windows\System\NLkjKId.exe
  C:\Windows\System\NLkjKId.exe
  2⤵
  PID:7872
- C:\Windows\System\vXmbnbp.exe
  C:\Windows\System\vXmbnbp.exe
  2⤵
  PID:7888
- C:\Windows\System\BPHYbkx.exe
  C:\Windows\System\BPHYbkx.exe
  2⤵
  PID:7912
- C:\Windows\System\uGsbqUo.exe
  C:\Windows\System\uGsbqUo.exe
  2⤵
  PID:7928
- C:\Windows\System\ezphgve.exe
  C:\Windows\System\ezphgve.exe
  2⤵
  PID:7944
- C:\Windows\System\SnEwSPS.exe
  C:\Windows\System\SnEwSPS.exe
  2⤵
  PID:7964
- C:\Windows\System\PgYHgHZ.exe
  C:\Windows\System\PgYHgHZ.exe
  2⤵
  PID:7980
- C:\Windows\System\lgRefvS.exe
  C:\Windows\System\lgRefvS.exe
  2⤵
  PID:8012
- C:\Windows\System\vpgezsL.exe
  C:\Windows\System\vpgezsL.exe
  2⤵
  PID:8044
- C:\Windows\System\WNMCcGI.exe
  C:\Windows\System\WNMCcGI.exe
  2⤵
  PID:8060
- C:\Windows\System\qgHjHWl.exe
  C:\Windows\System\qgHjHWl.exe
  2⤵
  PID:8076
- C:\Windows\System\vjqzUZw.exe
  C:\Windows\System\vjqzUZw.exe
  2⤵
  PID:8096
- C:\Windows\System\dqKMQQp.exe
  C:\Windows\System\dqKMQQp.exe
  2⤵
  PID:8116
- C:\Windows\System\NqxEAFk.exe
  C:\Windows\System\NqxEAFk.exe
  2⤵
  PID:8136
- C:\Windows\System\dfcTwVg.exe
  C:\Windows\System\dfcTwVg.exe
  2⤵
  PID:8152
- C:\Windows\System\wuiTKTx.exe
  C:\Windows\System\wuiTKTx.exe
  2⤵
  PID:8180
- C:\Windows\System\HguBrOu.exe
  C:\Windows\System\HguBrOu.exe
  2⤵
  PID:5480
- C:\Windows\System\NlouNbG.exe
  C:\Windows\System\NlouNbG.exe
  2⤵
  PID:6280
- C:\Windows\System\xXQUQCm.exe
  C:\Windows\System\xXQUQCm.exe
  2⤵
  PID:7224
- C:\Windows\System\jytEhjQ.exe
  C:\Windows\System\jytEhjQ.exe
  2⤵
  PID:7268
- C:\Windows\System\cMioiPl.exe
  C:\Windows\System\cMioiPl.exe
  2⤵
  PID:7300
- C:\Windows\System\AXjSQnz.exe
  C:\Windows\System\AXjSQnz.exe
  2⤵
  PID:7284
- C:\Windows\System\bNlUkbP.exe
  C:\Windows\System\bNlUkbP.exe
  2⤵
  PID:7356
- C:\Windows\System\NbalEfj.exe
  C:\Windows\System\NbalEfj.exe
  2⤵
  PID:7416
- C:\Windows\System\pUeIDFZ.exe
  C:\Windows\System\pUeIDFZ.exe
  2⤵
  PID:7388
- C:\Windows\System\dUpFiUi.exe
  C:\Windows\System\dUpFiUi.exe
  2⤵
  PID:7412
- C:\Windows\System\MkVfrCK.exe
  C:\Windows\System\MkVfrCK.exe
  2⤵
  PID:7444
- C:\Windows\System\zmXNxvi.exe
  C:\Windows\System\zmXNxvi.exe
  2⤵
  PID:7476
- C:\Windows\System\EHYfVKm.exe
  C:\Windows\System\EHYfVKm.exe
  2⤵
  PID:7552
- C:\Windows\System\lMxKPdj.exe
  C:\Windows\System\lMxKPdj.exe
  2⤵
  PID:7568
- C:\Windows\System\hyCRkpM.exe
  C:\Windows\System\hyCRkpM.exe
  2⤵
  PID:7612
- C:\Windows\System\JSfRpzk.exe
  C:\Windows\System\JSfRpzk.exe
  2⤵
  PID:7600
- C:\Windows\System\qrKXmPA.exe
  C:\Windows\System\qrKXmPA.exe
  2⤵
  PID:7664
- C:\Windows\System\vfMNqCo.exe
  C:\Windows\System\vfMNqCo.exe
  2⤵
  PID:7724
- C:\Windows\System\ehKLSys.exe
  C:\Windows\System\ehKLSys.exe
  2⤵
  PID:7744
- C:\Windows\System\JxytNjT.exe
  C:\Windows\System\JxytNjT.exe
  2⤵
  PID:7756
- C:\Windows\System\bajMROU.exe
  C:\Windows\System\bajMROU.exe
  2⤵
  PID:7800
- C:\Windows\System\CzvXvro.exe
  C:\Windows\System\CzvXvro.exe
  2⤵
  PID:7812
- C:\Windows\System\rlZZOpU.exe
  C:\Windows\System\rlZZOpU.exe
  2⤵
  PID:7904
- C:\Windows\System\jLrxMYb.exe
  C:\Windows\System\jLrxMYb.exe
  2⤵
  PID:7840
- C:\Windows\System\fAlopUS.exe
  C:\Windows\System\fAlopUS.exe
  2⤵
  PID:7844
- C:\Windows\System\hEouTyg.exe
  C:\Windows\System\hEouTyg.exe
  2⤵
  PID:7996
- C:\Windows\System\ftbFplK.exe
  C:\Windows\System\ftbFplK.exe
  2⤵
  PID:8020
- C:\Windows\System\pXjzaqP.exe
  C:\Windows\System\pXjzaqP.exe
  2⤵
  PID:8068
- C:\Windows\System\eXKgYur.exe
  C:\Windows\System\eXKgYur.exe
  2⤵
  PID:8092
- C:\Windows\System\nNWRNEw.exe
  C:\Windows\System\nNWRNEw.exe
  2⤵
  PID:8144
- C:\Windows\System\lNuJIhW.exe
  C:\Windows\System\lNuJIhW.exe
  2⤵
  PID:8148
- C:\Windows\System\bWKESog.exe
  C:\Windows\System\bWKESog.exe
  2⤵
  PID:8188
- C:\Windows\System\IgvaKyM.exe
  C:\Windows\System\IgvaKyM.exe
  2⤵
  PID:5200
- C:\Windows\System\tynMKWq.exe
  C:\Windows\System\tynMKWq.exe
  2⤵
  PID:7280
- C:\Windows\System\DaxIAKY.exe
  C:\Windows\System\DaxIAKY.exe
  2⤵
  PID:7200
- C:\Windows\System\EDvZERN.exe
  C:\Windows\System\EDvZERN.exe
  2⤵
  PID:7424
- C:\Windows\System\kPtoaPg.exe
  C:\Windows\System\kPtoaPg.exe
  2⤵
  PID:7496
- C:\Windows\System\aZOPoHO.exe
  C:\Windows\System\aZOPoHO.exe
  2⤵
  PID:7596
- C:\Windows\System\hpgjTZE.exe
  C:\Windows\System\hpgjTZE.exe
  2⤵
  PID:7740
- C:\Windows\System\xtdXtcU.exe
  C:\Windows\System\xtdXtcU.exe
  2⤵
  PID:7788
- C:\Windows\System\OrPulPk.exe
  C:\Windows\System\OrPulPk.exe
  2⤵
  PID:7700
- C:\Windows\System\GUPHwtU.exe
  C:\Windows\System\GUPHwtU.exe
  2⤵
  PID:7396
- C:\Windows\System\dzxkzdW.exe
  C:\Windows\System\dzxkzdW.exe
  2⤵
  PID:7564
- C:\Windows\System\rSDTstg.exe
  C:\Windows\System\rSDTstg.exe
  2⤵
  PID:7748
- C:\Windows\System\EVNLCGl.exe
  C:\Windows\System\EVNLCGl.exe
  2⤵
  PID:7896
- C:\Windows\System\IkmcElL.exe
  C:\Windows\System\IkmcElL.exe
  2⤵
  PID:8000
- C:\Windows\System\hMUeOir.exe
  C:\Windows\System\hMUeOir.exe
  2⤵
  PID:7848
- C:\Windows\System\QxqRzUh.exe
  C:\Windows\System\QxqRzUh.exe
  2⤵
  PID:7956
- C:\Windows\System\WMETesX.exe
  C:\Windows\System\WMETesX.exe
  2⤵
  PID:8084
- C:\Windows\System\OxlkUKc.exe
  C:\Windows\System\OxlkUKc.exe
  2⤵
  PID:8160
- C:\Windows\System\EFrIaxK.exe
  C:\Windows\System\EFrIaxK.exe
  2⤵
  PID:7220
- C:\Windows\System\RRgPpGd.exe
  C:\Windows\System\RRgPpGd.exe
  2⤵
  PID:7240
- C:\Windows\System\eTChrmP.exe
  C:\Windows\System\eTChrmP.exe
  2⤵
  PID:7348
- C:\Windows\System\OaWyque.exe
  C:\Windows\System\OaWyque.exe
  2⤵
  PID:7320
- C:\Windows\System\XKLySVY.exe
  C:\Windows\System\XKLySVY.exe
  2⤵
  PID:7408
- C:\Windows\System\vRvHaOR.exe
  C:\Windows\System\vRvHaOR.exe
  2⤵
  PID:7504
- C:\Windows\System\xXxmeaU.exe
  C:\Windows\System\xXxmeaU.exe
  2⤵
  PID:7680
- C:\Windows\System\ysPhMMq.exe
  C:\Windows\System\ysPhMMq.exe
  2⤵
  PID:7936
- C:\Windows\System\GsPGwJG.exe
  C:\Windows\System\GsPGwJG.exe
  2⤵
  PID:7676
- C:\Windows\System\QIvxLTt.exe
  C:\Windows\System\QIvxLTt.exe
  2⤵
  PID:8040
- C:\Windows\System\RFOfunJ.exe
  C:\Windows\System\RFOfunJ.exe
  2⤵
  PID:8008
- C:\Windows\System\HnKGMEA.exe
  C:\Windows\System\HnKGMEA.exe
  2⤵
  PID:8164
- C:\Windows\System\yMeplMD.exe
  C:\Windows\System\yMeplMD.exe
  2⤵
  PID:7492
- C:\Windows\System\rGpBjuG.exe
  C:\Windows\System\rGpBjuG.exe
  2⤵
  PID:7432
- C:\Windows\System\ybRRyXE.exe
  C:\Windows\System\ybRRyXE.exe
  2⤵
  PID:7752
- C:\Windows\System\JvaRUmQ.exe
  C:\Windows\System\JvaRUmQ.exe
  2⤵
  PID:8088
- C:\Windows\System\bwXIoMz.exe
  C:\Windows\System\bwXIoMz.exe
  2⤵
  PID:7992
- C:\Windows\System\UDIVzJk.exe
  C:\Windows\System\UDIVzJk.exe
  2⤵
  PID:7784
- C:\Windows\System\SSfJECG.exe
  C:\Windows\System\SSfJECG.exe
  2⤵
  PID:8032
- C:\Windows\System\FyLzSgz.exe
  C:\Windows\System\FyLzSgz.exe
  2⤵
  PID:7920
- C:\Windows\System\VQvkkgF.exe
  C:\Windows\System\VQvkkgF.exe
  2⤵
  PID:8056
- C:\Windows\System\srLypce.exe
  C:\Windows\System\srLypce.exe
  2⤵
  PID:7772
- C:\Windows\System\sAySQwY.exe
  C:\Windows\System\sAySQwY.exe
  2⤵
  PID:7628
- C:\Windows\System\lnhfHwS.exe
  C:\Windows\System\lnhfHwS.exe
  2⤵
  PID:7500
- C:\Windows\System\yfBOvIk.exe
  C:\Windows\System\yfBOvIk.exe
  2⤵
  PID:7540
- C:\Windows\System\TCYekqk.exe
  C:\Windows\System\TCYekqk.exe
  2⤵
  PID:8132
- C:\Windows\System\FnvTQRd.exe
  C:\Windows\System\FnvTQRd.exe
  2⤵
  PID:8124
- C:\Windows\System\oEACEYE.exe
  C:\Windows\System\oEACEYE.exe
  2⤵
  PID:4328
- C:\Windows\System\clfdsoO.exe
  C:\Windows\System\clfdsoO.exe
  2⤵
  PID:8208
- C:\Windows\System\XOiuOUF.exe
  C:\Windows\System\XOiuOUF.exe
  2⤵
  PID:8224
- C:\Windows\System\YcaUZou.exe
  C:\Windows\System\YcaUZou.exe
  2⤵
  PID:8240
- C:\Windows\System\XsGKJCn.exe
  C:\Windows\System\XsGKJCn.exe
  2⤵
  PID:8268
- C:\Windows\System\TPyTLki.exe
  C:\Windows\System\TPyTLki.exe
  2⤵
  PID:8284
- C:\Windows\System\SaDubfR.exe
  C:\Windows\System\SaDubfR.exe
  2⤵
  PID:8300
- C:\Windows\System\xfZVAzH.exe
  C:\Windows\System\xfZVAzH.exe
  2⤵
  PID:8316
- C:\Windows\System\gyllZLt.exe
  C:\Windows\System\gyllZLt.exe
  2⤵
  PID:8340
- C:\Windows\System\kvHrOAD.exe
  C:\Windows\System\kvHrOAD.exe
  2⤵
  PID:8356
- C:\Windows\System\fkxrFIn.exe
  C:\Windows\System\fkxrFIn.exe
  2⤵
  PID:8372
- C:\Windows\System\xwgfVZF.exe
  C:\Windows\System\xwgfVZF.exe
  2⤵
  PID:8452
- C:\Windows\System\gpEirOc.exe
  C:\Windows\System\gpEirOc.exe
  2⤵
  PID:8496
- C:\Windows\System\mqGXxjq.exe
  C:\Windows\System\mqGXxjq.exe
  2⤵
  PID:8512
- C:\Windows\System\ZruNPXz.exe
  C:\Windows\System\ZruNPXz.exe
  2⤵
  PID:8536
- C:\Windows\System\bFyfbxf.exe
  C:\Windows\System\bFyfbxf.exe
  2⤵
  PID:8552
- C:\Windows\System\sFxJONC.exe
  C:\Windows\System\sFxJONC.exe
  2⤵
  PID:8576
- C:\Windows\System\cEZdgeC.exe
  C:\Windows\System\cEZdgeC.exe
  2⤵
  PID:8592
- C:\Windows\System\doLkPuP.exe
  C:\Windows\System\doLkPuP.exe
  2⤵
  PID:8616
- C:\Windows\System\cciWHFG.exe
  C:\Windows\System\cciWHFG.exe
  2⤵
  PID:8632
- C:\Windows\System\CMfZyMo.exe
  C:\Windows\System\CMfZyMo.exe
  2⤵
  PID:8652
- C:\Windows\System\tvUUcxi.exe
  C:\Windows\System\tvUUcxi.exe
  2⤵
  PID:8668
- C:\Windows\System\nxfIxtD.exe
  C:\Windows\System\nxfIxtD.exe
  2⤵
  PID:8692
- C:\Windows\System\tqLzTcD.exe
  C:\Windows\System\tqLzTcD.exe
  2⤵
  PID:8708
- C:\Windows\System\NMnpBlS.exe
  C:\Windows\System\NMnpBlS.exe
  2⤵
  PID:8736
- C:\Windows\System\vvRzoLK.exe
  C:\Windows\System\vvRzoLK.exe
  2⤵
  PID:8756
- C:\Windows\System\mSaIwGI.exe
  C:\Windows\System\mSaIwGI.exe
  2⤵
  PID:8772
- C:\Windows\System\NFlWuIl.exe
  C:\Windows\System\NFlWuIl.exe
  2⤵
  PID:8800
- C:\Windows\System\oAsHNoS.exe
  C:\Windows\System\oAsHNoS.exe
  2⤵
  PID:8816
- C:\Windows\System\GZTGjeH.exe
  C:\Windows\System\GZTGjeH.exe
  2⤵
  PID:8832
- C:\Windows\System\rtLsggS.exe
  C:\Windows\System\rtLsggS.exe
  2⤵
  PID:8852
- C:\Windows\System\eEvyTVg.exe
  C:\Windows\System\eEvyTVg.exe
  2⤵
  PID:8868
- C:\Windows\System\OBWayST.exe
  C:\Windows\System\OBWayST.exe
  2⤵
  PID:8896
- C:\Windows\System\vwDLBfj.exe
  C:\Windows\System\vwDLBfj.exe
  2⤵
  PID:8920
- C:\Windows\System\ZXbpAoO.exe
  C:\Windows\System\ZXbpAoO.exe
  2⤵
  PID:8940
- C:\Windows\System\WlcRbTH.exe
  C:\Windows\System\WlcRbTH.exe
  2⤵
  PID:8960
- C:\Windows\System\CZCFAqW.exe
  C:\Windows\System\CZCFAqW.exe
  2⤵
  PID:8976
- C:\Windows\System\LAvpRnd.exe
  C:\Windows\System\LAvpRnd.exe
  2⤵
  PID:8992
- C:\Windows\System\UWVdfEU.exe
  C:\Windows\System\UWVdfEU.exe
  2⤵
  PID:9008
- C:\Windows\System\rqNwNRM.exe
  C:\Windows\System\rqNwNRM.exe
  2⤵
  PID:9032
- C:\Windows\System\cGjJrnU.exe
  C:\Windows\System\cGjJrnU.exe
  2⤵
  PID:9052
- C:\Windows\System\hzgcKwL.exe
  C:\Windows\System\hzgcKwL.exe
  2⤵
  PID:9068
- C:\Windows\System\fehhZvb.exe
  C:\Windows\System\fehhZvb.exe
  2⤵
  PID:9084
- C:\Windows\System\ikSnuOh.exe
  C:\Windows\System\ikSnuOh.exe
  2⤵
  PID:9104
- C:\Windows\System\DCPsjzw.exe
  C:\Windows\System\DCPsjzw.exe
  2⤵
  PID:9124
- C:\Windows\System\LvbvFeG.exe
  C:\Windows\System\LvbvFeG.exe
  2⤵
  PID:9152
- C:\Windows\System\JIRXVwi.exe
  C:\Windows\System\JIRXVwi.exe
  2⤵
  PID:9172
- C:\Windows\System\KPdtOTl.exe
  C:\Windows\System\KPdtOTl.exe
  2⤵
  PID:9208
- C:\Windows\System\nJqsNsF.exe
  C:\Windows\System\nJqsNsF.exe
  2⤵
  PID:8232
- C:\Windows\System\skCeYOV.exe
  C:\Windows\System\skCeYOV.exe
  2⤵
  PID:5104
- C:\Windows\System\AVkvmzA.exe
  C:\Windows\System\AVkvmzA.exe
  2⤵
  PID:8256
- C:\Windows\System\znoqVvr.exe
  C:\Windows\System\znoqVvr.exe
  2⤵
  PID:8276
- C:\Windows\System\ecuuSZN.exe
  C:\Windows\System\ecuuSZN.exe
  2⤵
  PID:8312
- C:\Windows\System\KSqIOAd.exe
  C:\Windows\System\KSqIOAd.exe
  2⤵
  PID:8352
- C:\Windows\System\BGRmzPL.exe
  C:\Windows\System\BGRmzPL.exe
  2⤵
  PID:8364
- C:\Windows\System\BGOCtdH.exe
  C:\Windows\System\BGOCtdH.exe
  2⤵
  PID:8472
- C:\Windows\System\aFMNZKM.exe
  C:\Windows\System\aFMNZKM.exe
  2⤵
  PID:8528
- C:\Windows\System\kBmLKWj.exe
  C:\Windows\System\kBmLKWj.exe
  2⤵
  PID:8572
- C:\Windows\System\boMjWnL.exe
  C:\Windows\System\boMjWnL.exe
  2⤵
  PID:8584
- C:\Windows\System\ZjVRxdg.exe
  C:\Windows\System\ZjVRxdg.exe
  2⤵
  PID:8600
- C:\Windows\System\CEDhWJa.exe
  C:\Windows\System\CEDhWJa.exe
  2⤵
  PID:8624
- C:\Windows\System\WrtPDbw.exe
  C:\Windows\System\WrtPDbw.exe
  2⤵
  PID:8660
- C:\Windows\System\HAnCJEx.exe
  C:\Windows\System\HAnCJEx.exe
  2⤵
  PID:8384
- C:\Windows\System\fRQOCTU.exe
  C:\Windows\System\fRQOCTU.exe
  2⤵
  PID:8648
- C:\Windows\System\dkazPgk.exe
  C:\Windows\System\dkazPgk.exe
  2⤵
  PID:8684
- C:\Windows\System\UuOwaHp.exe
  C:\Windows\System\UuOwaHp.exe
  2⤵
  PID:8728
- C:\Windows\System\HBtFjwA.exe
  C:\Windows\System\HBtFjwA.exe
  2⤵
  PID:8780
- C:\Windows\System\NNJLAgf.exe
  C:\Windows\System\NNJLAgf.exe
  2⤵
  PID:8808
- C:\Windows\System\rHGKWGp.exe
  C:\Windows\System\rHGKWGp.exe
  2⤵
  PID:8828
- C:\Windows\System\Xqudhbu.exe
  C:\Windows\System\Xqudhbu.exe
  2⤵
  PID:8884
- C:\Windows\System\oEqOJLP.exe
  C:\Windows\System\oEqOJLP.exe
  2⤵
  PID:8404
- C:\Windows\System\wLpqhUt.exe
  C:\Windows\System\wLpqhUt.exe
  2⤵
  PID:8420
- C:\Windows\System\zDaNcKA.exe
  C:\Windows\System\zDaNcKA.exe
  2⤵
  PID:9028
- C:\Windows\System\pPbJQyi.exe
  C:\Windows\System\pPbJQyi.exe
  2⤵
  PID:9092
- C:\Windows\System\dtbxjvZ.exe
  C:\Windows\System\dtbxjvZ.exe
  2⤵
  PID:8936
- C:\Windows\System\lEzuZRh.exe
  C:\Windows\System\lEzuZRh.exe
  2⤵
  PID:9144
- C:\Windows\System\PsVKhfY.exe
  C:\Windows\System\PsVKhfY.exe
  2⤵
  PID:9004
- C:\Windows\System\SssefzI.exe
  C:\Windows\System\SssefzI.exe
  2⤵
  PID:9112
- C:\Windows\System\rWfGWdM.exe
  C:\Windows\System\rWfGWdM.exe
  2⤵
  PID:9168
- C:\Windows\System\YibUMNf.exe
  C:\Windows\System\YibUMNf.exe
  2⤵
  PID:9200
- C:\Windows\System\EJnjrYi.exe
  C:\Windows\System\EJnjrYi.exe
  2⤵
  PID:7976
- C:\Windows\System\YURASeG.exe
  C:\Windows\System\YURASeG.exe
  2⤵
  PID:8296
- C:\Windows\System\NxAhaOt.exe
  C:\Windows\System\NxAhaOt.exe
  2⤵
  PID:8492
- C:\Windows\System\DYwcsCC.exe
  C:\Windows\System\DYwcsCC.exe
  2⤵
  PID:8348
- C:\Windows\System\fwReFbx.exe
  C:\Windows\System\fwReFbx.exe
  2⤵
  PID:8460
- C:\Windows\System\ugzhXKh.exe
  C:\Windows\System\ugzhXKh.exe
  2⤵
  PID:8532
- C:\Windows\System\HdxmNFt.exe
  C:\Windows\System\HdxmNFt.exe
  2⤵
  PID:8328
- C:\Windows\System\ezKGjWt.exe
  C:\Windows\System\ezKGjWt.exe
  2⤵
  PID:8644
- C:\Windows\System\rrHguRp.exe
  C:\Windows\System\rrHguRp.exe
  2⤵
  PID:8792
- C:\Windows\System\CXHhPsA.exe
  C:\Windows\System\CXHhPsA.exe
  2⤵
  PID:8880
- C:\Windows\System\aqKyAqJ.exe
  C:\Windows\System\aqKyAqJ.exe
  2⤵
  PID:8892
- C:\Windows\System\BjqAYwg.exe
  C:\Windows\System\BjqAYwg.exe
  2⤵
  PID:8908
- C:\Windows\System\jPCLoWY.exe
  C:\Windows\System\jPCLoWY.exe
  2⤵
  PID:8480
- C:\Windows\System\quphDUe.exe
  C:\Windows\System\quphDUe.exe
  2⤵
  PID:8704
- C:\Windows\System\PXUrLTj.exe
  C:\Windows\System\PXUrLTj.exe
  2⤵
  PID:8988
- C:\Windows\System\VJSlKAu.exe
  C:\Windows\System\VJSlKAu.exe
  2⤵
  PID:9064
- C:\Windows\System\nruKouS.exe
  C:\Windows\System\nruKouS.exe
  2⤵
  PID:9076
- C:\Windows\System\xWXDGwH.exe
  C:\Windows\System\xWXDGwH.exe
  2⤵
  PID:9196
- C:\Windows\System\YsAiWzL.exe
  C:\Windows\System\YsAiWzL.exe
  2⤵
  PID:8932
- C:\Windows\System\oeHkgXY.exe
  C:\Windows\System\oeHkgXY.exe
  2⤵
  PID:8236
- C:\Windows\System\ibBlraQ.exe
  C:\Windows\System\ibBlraQ.exe
  2⤵
  PID:9164
- C:\Windows\System\DWfHtMR.exe
  C:\Windows\System\DWfHtMR.exe
  2⤵
  PID:8200
- C:\Windows\System\cWVbMWE.exe
  C:\Windows\System\cWVbMWE.exe
  2⤵
  PID:8428
- C:\Windows\System\MGiOFlg.exe
  C:\Windows\System\MGiOFlg.exe
  2⤵
  PID:8544
- C:\Windows\System\NnMtwXk.exe
  C:\Windows\System\NnMtwXk.exe
  2⤵
  PID:8848
- C:\Windows\System\vKiVibW.exe
  C:\Windows\System\vKiVibW.exe
  2⤵
  PID:8608
- C:\Windows\System\nnaMRrV.exe
  C:\Windows\System\nnaMRrV.exe
  2⤵
  PID:8436
- C:\Windows\System\CSfJPJZ.exe
  C:\Windows\System\CSfJPJZ.exe
  2⤵
  PID:8928
- C:\Windows\System\YGhdxNS.exe
  C:\Windows\System\YGhdxNS.exe
  2⤵
  PID:8392
- C:\Windows\System\HfLFPVL.exe
  C:\Windows\System\HfLFPVL.exe
  2⤵
  PID:8968
- C:\Windows\System\HuobamC.exe
  C:\Windows\System\HuobamC.exe
  2⤵
  PID:9140
- C:\Windows\System\AagitzE.exe
  C:\Windows\System\AagitzE.exe
  2⤵
  PID:8220
- C:\Windows\System\jfmIXeP.exe
  C:\Windows\System\jfmIXeP.exe
  2⤵
  PID:9044
- C:\Windows\System\WOrmilT.exe
  C:\Windows\System\WOrmilT.exe
  2⤵
  PID:8264
- C:\Windows\System\UBLLkiY.exe
  C:\Windows\System\UBLLkiY.exe
  2⤵
  PID:8476
- C:\Windows\System\MoiJQRk.exe
  C:\Windows\System\MoiJQRk.exe
  2⤵
  PID:8688
- C:\Windows\System\EHnKSkO.exe
  C:\Windows\System\EHnKSkO.exe
  2⤵
  PID:9136
- C:\Windows\System\ZPsBUWl.exe
  C:\Windows\System\ZPsBUWl.exe
  2⤵
  PID:9000
- C:\Windows\System\ffwxTRP.exe
  C:\Windows\System\ffwxTRP.exe
  2⤵
  PID:8504
- C:\Windows\System\QUeCwFv.exe
  C:\Windows\System\QUeCwFv.exe
  2⤵
  PID:8368
- C:\Windows\System\QgIJxnH.exe
  C:\Windows\System\QgIJxnH.exe
  2⤵
  PID:8764
- C:\Windows\System\PcndzTA.exe
  C:\Windows\System\PcndzTA.exe
  2⤵
  PID:8260
- C:\Windows\System\AEUVQAR.exe
  C:\Windows\System\AEUVQAR.exe
  2⤵
  PID:8888
- C:\Windows\System\xbwRfIa.exe
  C:\Windows\System\xbwRfIa.exe
  2⤵
  PID:8424
- C:\Windows\System\gMiiFZm.exe
  C:\Windows\System\gMiiFZm.exe
  2⤵
  PID:9120
- C:\Windows\System\FypNYlt.exe
  C:\Windows\System\FypNYlt.exe
  2⤵
  PID:9228
- C:\Windows\System\cZHNRnT.exe
  C:\Windows\System\cZHNRnT.exe
  2⤵
  PID:9252
- C:\Windows\System\alysnWG.exe
  C:\Windows\System\alysnWG.exe
  2⤵
  PID:9268
- C:\Windows\System\tkUCmTd.exe
  C:\Windows\System\tkUCmTd.exe
  2⤵
  PID:9288
- C:\Windows\System\NNXOyeu.exe
  C:\Windows\System\NNXOyeu.exe
  2⤵
  PID:9312
- C:\Windows\System\xdTlVxc.exe
  C:\Windows\System\xdTlVxc.exe
  2⤵
  PID:9328
- C:\Windows\System\VnoOUZp.exe
  C:\Windows\System\VnoOUZp.exe
  2⤵
  PID:9352
- C:\Windows\System\wsDBeWn.exe
  C:\Windows\System\wsDBeWn.exe
  2⤵
  PID:9376
- C:\Windows\System\FAtQrBv.exe
  C:\Windows\System\FAtQrBv.exe
  2⤵
  PID:9396
- C:\Windows\System\KoapsXM.exe
  C:\Windows\System\KoapsXM.exe
  2⤵
  PID:9412
- C:\Windows\System\IMzZZKv.exe
  C:\Windows\System\IMzZZKv.exe
  2⤵
  PID:9436
- C:\Windows\System\mnbesmU.exe
  C:\Windows\System\mnbesmU.exe
  2⤵
  PID:9452
- C:\Windows\System\gsAZwVA.exe
  C:\Windows\System\gsAZwVA.exe
  2⤵
  PID:9472
- C:\Windows\System\CrYNJgM.exe
  C:\Windows\System\CrYNJgM.exe
  2⤵
  PID:9496
- C:\Windows\System\UkmizGL.exe
  C:\Windows\System\UkmizGL.exe
  2⤵
  PID:9512
- C:\Windows\System\CNIpmPX.exe
  C:\Windows\System\CNIpmPX.exe
  2⤵
  PID:9528
- C:\Windows\System\CZNuhZw.exe
  C:\Windows\System\CZNuhZw.exe
  2⤵
  PID:9544
- C:\Windows\System\lftCULc.exe
  C:\Windows\System\lftCULc.exe
  2⤵
  PID:9564
- C:\Windows\System\WkBZFJO.exe
  C:\Windows\System\WkBZFJO.exe
  2⤵
  PID:9584
- C:\Windows\System\TYMRRFY.exe
  C:\Windows\System\TYMRRFY.exe
  2⤵
  PID:9604
- C:\Windows\System\JbUlrfu.exe
  C:\Windows\System\JbUlrfu.exe
  2⤵
  PID:9624
- C:\Windows\System\APVLtYc.exe
  C:\Windows\System\APVLtYc.exe
  2⤵
  PID:9640
- C:\Windows\System\NlODyVw.exe
  C:\Windows\System\NlODyVw.exe
  2⤵
  PID:9672
- C:\Windows\System\BSduPux.exe
  C:\Windows\System\BSduPux.exe
  2⤵
  PID:9700
- C:\Windows\System\CqlzYRG.exe
  C:\Windows\System\CqlzYRG.exe
  2⤵
  PID:9716
- C:\Windows\System\HfoXcRu.exe
  C:\Windows\System\HfoXcRu.exe
  2⤵
  PID:9732
- C:\Windows\System\cuEnCff.exe
  C:\Windows\System\cuEnCff.exe
  2⤵
  PID:9760
- C:\Windows\System\DzXssyk.exe
  C:\Windows\System\DzXssyk.exe
  2⤵
  PID:9780
- C:\Windows\System\yiSeSuh.exe
  C:\Windows\System\yiSeSuh.exe
  2⤵
  PID:9796
- C:\Windows\System\ImCpkIM.exe
  C:\Windows\System\ImCpkIM.exe
  2⤵
  PID:9812
- C:\Windows\System\RtmjGet.exe
  C:\Windows\System\RtmjGet.exe
  2⤵
  PID:9832
- C:\Windows\System\bLzddRV.exe
  C:\Windows\System\bLzddRV.exe
  2⤵
  PID:9852
- C:\Windows\System\IYimRNm.exe
  C:\Windows\System\IYimRNm.exe
  2⤵
  PID:9872
- C:\Windows\System\hKjSNKs.exe
  C:\Windows\System\hKjSNKs.exe
  2⤵
  PID:9892
- C:\Windows\System\EsHaEKY.exe
  C:\Windows\System\EsHaEKY.exe
  2⤵
  PID:9916
- C:\Windows\System\GtSPTQB.exe
  C:\Windows\System\GtSPTQB.exe
  2⤵
  PID:9932
- C:\Windows\System\QiEbytX.exe
  C:\Windows\System\QiEbytX.exe
  2⤵
  PID:9956
- C:\Windows\System\GScBsMX.exe
  C:\Windows\System\GScBsMX.exe
  2⤵
  PID:9976
- C:\Windows\System\pXCZOFH.exe
  C:\Windows\System\pXCZOFH.exe
  2⤵
  PID:9996
- C:\Windows\System\zblvQWB.exe
  C:\Windows\System\zblvQWB.exe
  2⤵
  PID:10016
- C:\Windows\System\PQaTCjL.exe
  C:\Windows\System\PQaTCjL.exe
  2⤵
  PID:10032
- C:\Windows\System\JfSULUz.exe
  C:\Windows\System\JfSULUz.exe
  2⤵
  PID:10048
- C:\Windows\System\OBFzwcA.exe
  C:\Windows\System\OBFzwcA.exe
  2⤵
  PID:10064
- C:\Windows\System\FXduqsh.exe
  C:\Windows\System\FXduqsh.exe
  2⤵
  PID:10080
- C:\Windows\System\dujJsRw.exe
  C:\Windows\System\dujJsRw.exe
  2⤵
  PID:10096
- C:\Windows\System\BZTwOde.exe
  C:\Windows\System\BZTwOde.exe
  2⤵
  PID:10124
- C:\Windows\System\cwgAExS.exe
  C:\Windows\System\cwgAExS.exe
  2⤵
  PID:10140
- C:\Windows\System\uMNhRcD.exe
  C:\Windows\System\uMNhRcD.exe
  2⤵
  PID:10160
- C:\Windows\System\qDSnNSh.exe
  C:\Windows\System\qDSnNSh.exe
  2⤵
  PID:10176
- C:\Windows\System\pKuKdgK.exe
  C:\Windows\System\pKuKdgK.exe
  2⤵
  PID:10200
- C:\Windows\System\ekiWfTv.exe
  C:\Windows\System\ekiWfTv.exe
  2⤵
  PID:10216
- C:\Windows\System\cpOFZCj.exe
  C:\Windows\System\cpOFZCj.exe
  2⤵
  PID:10236
- C:\Windows\System\RNmtWMU.exe
  C:\Windows\System\RNmtWMU.exe
  2⤵
  PID:8860
- C:\Windows\System\bcBboPa.exe
  C:\Windows\System\bcBboPa.exe
  2⤵
  PID:9244
- C:\Windows\System\GUXsohe.exe
  C:\Windows\System\GUXsohe.exe
  2⤵
  PID:9276
- C:\Windows\System\OoxOdbr.exe
  C:\Windows\System\OoxOdbr.exe
  2⤵
  PID:9340
- C:\Windows\System\WAWMXLn.exe
  C:\Windows\System\WAWMXLn.exe
  2⤵
  PID:9324
- C:\Windows\System\yikUAfy.exe
  C:\Windows\System\yikUAfy.exe
  2⤵
  PID:9404
- C:\Windows\System\BBMFJIa.exe
  C:\Windows\System\BBMFJIa.exe
  2⤵
  PID:9444
- C:\Windows\System\evAlleo.exe
  C:\Windows\System\evAlleo.exe
  2⤵
  PID:9480
- C:\Windows\System\zBJqfxe.exe
  C:\Windows\System\zBJqfxe.exe
  2⤵
  PID:9540
- C:\Windows\System\opspbvI.exe
  C:\Windows\System\opspbvI.exe
  2⤵
  PID:9612
- C:\Windows\System\APymZVp.exe
  C:\Windows\System\APymZVp.exe
  2⤵
  PID:9600
- C:\Windows\System\adTXCuV.exe
  C:\Windows\System\adTXCuV.exe
  2⤵
  PID:9520
- C:\Windows\System\XukYexE.exe
  C:\Windows\System\XukYexE.exe
  2⤵
  PID:9592
- C:\Windows\System\qDdfsiX.exe
  C:\Windows\System\qDdfsiX.exe
  2⤵
  PID:9680
- C:\Windows\System\KTydeBk.exe
  C:\Windows\System\KTydeBk.exe
  2⤵
  PID:9712
- C:\Windows\System\HIZBBoX.exe
  C:\Windows\System\HIZBBoX.exe
  2⤵
  PID:9728
- C:\Windows\System\OmqjZNo.exe
  C:\Windows\System\OmqjZNo.exe
  2⤵
  PID:9768
- C:\Windows\System\bZhyEFX.exe
  C:\Windows\System\bZhyEFX.exe
  2⤵
  PID:9824
- C:\Windows\System\oIzrAJJ.exe
  C:\Windows\System\oIzrAJJ.exe
  2⤵
  PID:9904
- C:\Windows\System\dcGLkig.exe
  C:\Windows\System\dcGLkig.exe
  2⤵
  PID:9808
- C:\Windows\System\ZTwsypm.exe
  C:\Windows\System\ZTwsypm.exe
  2⤵
  PID:9884
- C:\Windows\System\VXUXPLV.exe
  C:\Windows\System\VXUXPLV.exe
  2⤵
  PID:9992
- C:\Windows\System\Awasvzh.exe
  C:\Windows\System\Awasvzh.exe
  2⤵
  PID:10060
- C:\Windows\System\brDfAwq.exe
  C:\Windows\System\brDfAwq.exe
  2⤵
  PID:10168
- C:\Windows\System\HwHBfoO.exe
  C:\Windows\System\HwHBfoO.exe
  2⤵
  PID:9220
- C:\Windows\System\FAlGYOV.exe
  C:\Windows\System\FAlGYOV.exe
  2⤵
  PID:9300
- C:\Windows\System\BMYgcyT.exe
  C:\Windows\System\BMYgcyT.exe
  2⤵
  PID:9432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CwgyqPu.exe

Filesize
2.7MB

MD5
491fbc65785097fc52a698f43a4896f9

SHA1
79b1d91ad0e8780faad7f7a28f60b054da0211fe

SHA256
1b1d95c6b0ddef30837b61e1fddf21ed5678677d8221f268a5fc93c1b8e1e410

SHA512
679ebc613a7ca4ea1a6b856269f112fec389fbb9d08b2ea00aac513f6a19ab43748b8067a23877def3c1fe7fd8c19f3629c8db9f96575b52fa8d47367cf516b2

Download Submit
C:\Windows\system\ESAAibl.exe

Filesize
2.7MB

MD5
acc574b175e926c6af91b67e7dfa8bc5

SHA1
1fe2326e6975b7b65571407c7676223af6069e15

SHA256
a9fb671c90e7d0215bbe1710ac908bb5f56ae16b56dc1e3ae75373a5316f094c

SHA512
a45fb90f320ab026369244e755c7af28259a0f012b505854b6f036289dee6044d385858380bb88c7c97d38595e3161d71db93f3e8704d843a45bae8f5a1a1252

Download Submit
C:\Windows\system\PhlCxgA.exe

Filesize
2.7MB

MD5
67d6ffb71c206f0f77ea90ab8439adaf

SHA1
333a630b6b22be32da2a515548131e2b722e402c

SHA256
7ef6acec770144922c9d76d216d1255f4bbaa22fae1dff2c1a2f80dea467c5cc

SHA512
ef5ceb669cf01cdd61fec8e4055980de851570e442800c923c1c96f33e12f2807d45e8e99b0edc09bad8f6f730648f83b192df40ec254ee2cdb400dec6601184

Download Submit
C:\Windows\system\RsrAQlO.exe

Filesize
2.7MB

MD5
17e35e20dce521b7528369cd7ba3584b

SHA1
d0968a384ac639f698d9aac71c6f1309d0143a19

SHA256
06bc3d5a8deb38b28976482e81dc941396b62bc973d6a79b75afbf4a39d1d79b

SHA512
d3944e5073b37999ad5b33c381abbfe4fd0ff1f99a2c1a757044da77ac970721fdc12b4fa75f77f459dd7e6255cbeed453afdb7fbe3f7ca4a9392e56f096875d

Download Submit
C:\Windows\system\SgAGPqT.exe

Filesize
2.7MB

MD5
2ca27089227bea8e5812d9f41fe9cbef

SHA1
6ad1bce6fe8a52156854513d41427cb2998e2e17

SHA256
c95927c074d273ee5cb2f9eb0451ef8162d039fdb9647806d8fc49a31a4a2a42

SHA512
1ef7dd9b594af1677b6b4ccb3aacb2f2a8db537bd1f36d10775e0c59c6af4c7646aaf8478e71911fad9cef74c0e62a02bcaf164ceb504b54eda831db94feedab

Download Submit
C:\Windows\system\THvFcOe.exe

Filesize
2.7MB

MD5
b6bcf79161d2b5cc3e2ebb004a0e9d6b

SHA1
7c230ad18c46d2a7e51588b65ee4516494e63868

SHA256
98f9b678758b0b667a324b7eba67d2c7e3393d62f60cc01ce0186ba781c75b94

SHA512
185f52aa01feb347274303891c346f630fa940addf137e0daeb89964ab7d39aab71347934ae4f7135e49aab43e41fcf5c6ecd295cabbeff485caa1772715d01f

Download Submit
C:\Windows\system\VGEWYYG.exe

Filesize
2.7MB

MD5
779dbc7d9b0258c0df9e77204e1f90c0

SHA1
b831167dac360a866381ba7d43575e9fc487b6a3

SHA256
2ae902425f40b115ab79aab6f30de16deed55abee84efe4097d0ae36262bf2fa

SHA512
b15936ef08520d70fdf758ebc1fdb2cd989d79f90027e04de7023c90778cf749a5594a475da8b9935f8a0ee271c3cfd32a766f92fb1e8450e0a60670dfa2d322

Download Submit
C:\Windows\system\WHKlYdq.exe

Filesize
2.7MB

MD5
4e1a3b027ff0abaa95cc3f66fbe26341

SHA1
2766140837f973e428dee8d74e1a3810b60d8ef4

SHA256
3fdf1a991e90c57add10ae93f1c8c5cf02ead4ce4cff4086c5405fe38fd670ea

SHA512
bbf093a7de56fcd4cbcbd376845e0b99fc163eb836a2840021e5a7ddfafefedd8230622e3fa0b7a8147101a85fa91f0fcdd54a03f496e603b1913b9393bf6bdf

Download Submit
C:\Windows\system\cMubDkH.exe

Filesize
2.7MB

MD5
e221fcae96c504ef3180f18fe5982048

SHA1
77d21acc7ffbc01755fefc3ae60991fec1350fb3

SHA256
47006db6d8196018680ddc3661f61536947043064b28be5d9a365278bed7c08a

SHA512
9129d6b63c0400f48c5a296efb3e621a8ac004da473497f6bc7c630586651d77ee4e9ef3006ddf28dd2889828f1604862eb3dc47d815c1f74f31a18467b04c57

Download Submit
C:\Windows\system\cYCbGWN.exe

Filesize
2.7MB

MD5
b8f1988883ee7dab0ef26f8502a220ce

SHA1
8b7bb1c0a94b34397cc5c6572bba238f84af2e92

SHA256
c79b17f199de5aa286381f31644fc46a8ba316b77aba81f9cd90353bd72f65b6

SHA512
fd8a0f2327c0938da4889ed346cee6f67470feb90cb87276dd8da769d1af896dd45b5fead0c3905ad8c131581adfe1435326fe7cabbdce9711ef342cbad6e3c9

Download Submit
C:\Windows\system\cbNFbBZ.exe

Filesize
2.7MB

MD5
a8b3ff33cd14321df7e7c175aba103bd

SHA1
403f5618af386afd4bfa48bb6348f9a05617f3a1

SHA256
d0298c26ae0a2bed04d0d3ec15b33ebb6ed7f600cb80a952ffcbb084ffa8d478

SHA512
84cf7966c6d5615f8de4d14fbfba88cd480ce67edd8b72f6363078682d301e0f2db8a7536321d20c79268a0cf9cb4c6eed95e06e565bad841350ebc57c93f018

Download Submit
C:\Windows\system\esRyldP.exe

Filesize
2.7MB

MD5
8e6f45c17d6d25b3b24ddde13b75c0e1

SHA1
a039194be9dcb3813785b072ce3954b4bfeccdf8

SHA256
ac860a58f9216f29abbde08b6304e9d9059bc809f37baf5c47e9ba32be73abc6

SHA512
af7fec3bcd3011709befd855483ed02a9302595532bd5591bdaa8105e8f1fe4772fb8ab7cef40bfb90cb2718f80f1d1988e8983b03f0928e81b8bd82a419c523

Download Submit
C:\Windows\system\fqHWqFP.exe

Filesize
2.7MB

MD5
c506b3aa3d833ac43b39271e2fe95362

SHA1
61bba16146a834f00c56a322604619606d8c2f6a

SHA256
bb1c4c4531efc30e19c9efae93256307a0d8c72120f5e099f76ed7a337f1e9de

SHA512
19a6e03f77de5570e4955db6356deb1f28426851b26c28ed4066ca7473cd4545c342d1dbadd1ab0dd8b10670ae868dc2e6e0c9fd9f0dd14d7965fcd19091e7fb

Download Submit
C:\Windows\system\kGQHixn.exe

Filesize
2.7MB

MD5
aeac64bf7e8fdab57496037d4d9524cb

SHA1
818cab840b4f7a9f3fdff45d5cb9e823b3ae27d0

SHA256
4b55c5061147a879aff677f12165324c7ab254dab41d0d06b943eaa2f2b51a31

SHA512
8350e0d2bc1aed856c23104c8feda6abc5c73e45a4fffd4d686dcb194e5855b4c08d0248e557e0d5df6d4962386cbfbaca65bcce606fd5065144f7e83f12065b

Download Submit
C:\Windows\system\nQaCQDM.exe

Filesize
2.7MB

MD5
fc3b8aabfff3504819aae405fe37ff97

SHA1
a0067fd20d8444feb780853acf90b0d0eaf9f74f

SHA256
df1dba480f20949ba5cf2e053b20a8dd1674c388c28e34b51226c12ab5f0402e

SHA512
42161d99785f28d93b2b956428a67cbe67efd15abc6f426af7b8367f31ed0ae4bb14345537931e671896f97c6a438da67a436319c871b628ca117943d5295784

Download Submit
C:\Windows\system\nUPmnQv.exe

Filesize
2.7MB

MD5
25560b6f42e6d950e69bb9318b481d88

SHA1
c510da11dce5577574d182df37ce46af9716f65f

SHA256
7fa1b8fc75fc8c7eb9421f95a223c5d82315c488eb0760646a7fc992e224eb7d

SHA512
3625dd6fad414f5d46647c660c373f04fd4171dc229c7b97263b3a0e3a3281f7dac367596ff53c71b3d2e163b50f163cef5fbd67e724cf0c252baf2f49b4bdd6

Download Submit
C:\Windows\system\pqHTocX.exe

Filesize
2.7MB

MD5
d29bdf6f490ea7e0f8d0ed2ebec9ee10

SHA1
105173ad36f70759f13990aab21277308905ce10

SHA256
bfd7950508696687f48c4a58eed46e952b03917be87ba81685d3013c17a8efa6

SHA512
b5dd5b54d8277a66460b7583480f8f52380e23118ae6578d75451b80f0ef1b3530f65873175424ee7ab67088c3e2e2fd83ce4a71f3a4a0857482963c497cb0f8

Download Submit
C:\Windows\system\qxxJtTL.exe

Filesize
2.7MB

MD5
4f9b2d46facf33c625a2015bf61b5845

SHA1
db8c04e77aa0aa5a7f15f179fade6b5bdecc4434

SHA256
9a7dd226e6c89eed5a92fd2550c5c31a64d58a7f0a6f05dce86b0e4ac6b08ff4

SHA512
b45b17855a7dd63e3652272e67dea7f3e7c99dc2c3e5782ec643b91bc167db47b90737782a13e521a285128923decfbe07b3efcb9096c751ea156fcda6273559

Download Submit
C:\Windows\system\tghYipe.exe

Filesize
2.7MB

MD5
084cf5e3306f2fb5740fbc79fc13205b

SHA1
fee5e871aa25af97cf1251ecbca772a75b902ffe

SHA256
64c5db692ed4bc80dfb7edb19f0a8cd5830af103b7b3e88ca5862c3c242bc8bb

SHA512
66a15b6421d699ab42bd32916d3b2eae8197031c1c8000ee9f4dafc1922712b4fbd97911ce7e7dee0e371eea4f5ec398122d002dd81b67b3bc2b780bb6ecde7c

Download Submit
C:\Windows\system\vmEzdQp.exe

Filesize
2.7MB

MD5
7f12f1a0c96101e50a1af616c981755d

SHA1
629d678a9677df6b2b6938d9857382e91f713f1c

SHA256
9cca48c7886014b563f358a35abe4ef11de5bec045643e097154af04b1bc5fdd

SHA512
9d54f675d432a43513c1bd2de5af2fa2710767925f26712daf78b8fcde4c85c5bf642139513d64a425f3ca15f13bf26935d46d0c8bab97b2499ef411f5fc42b9

Download Submit
C:\Windows\system\wIIbTMC.exe

Filesize
2.7MB

MD5
a032b3b3e8ec64f5663c6933a6c6149c

SHA1
314d9249a5c94dd652d9401a510c99a70300c47a

SHA256
0309126d6d5561260fbcf3efa30b19d3c9229baab7d050e221eac88770d4fdf0

SHA512
76b70b6eead25c05b6e7c343431b837c5f193d90ee7772c1fe52c451bcd448f26d0481cf1b3f87413a183c5a490b1d8a90489929f49360abbf092953d78e1706

Download Submit
C:\Windows\system\znZAaZS.exe

Filesize
2.7MB

MD5
b2cf8b5e8c826b060b9a057066338f16

SHA1
8e7522c9a56b2d7b0ba7bf4a222a66bde0f50f6f

SHA256
9cc31416e1d13ff80f55e7111a13126eaa045485a46e8012ff9bc1ab27200226

SHA512
d4644a5a154dc1065fbcde4debe6fa5d0f61f28fa2d0ead7ab8a783905694af660982adebfc89b07228868fb4a7f9286d188918d3f823e98f6c6971e42ced119

Download Submit
\Windows\system\EhmOQfy.exe

Filesize
2.7MB

MD5
b34c0428ff7932c500a96c3ae4e1f3a2

SHA1
df2accb69dd513185fe99236d14875e0ee9472a2

SHA256
5c52137e467691ab34fd7cb9785c1c3b3e4ce408584050e94cf78c23e27058bc

SHA512
19ba7f3e183c2b3a8ab25d842952e50d13d1c611db8fa7c69019cdcf3deffa283648d59c899679ddb0c87d2482967983e829b8647a3114b4001723e30e857aa9

Download Submit
\Windows\system\OVderTe.exe

Filesize
2.7MB

MD5
456773378eaacb374b9d5c71a04535a8

SHA1
7a0dc2da3d2b36399383da435bfeee7e1fa8e0a7

SHA256
b70daa6fc84939c8e25d29259c60464b4a71b75c1d5ab56bec00dc4b65228dec

SHA512
8ee25f48ccb344700465e3d713fe25a92558812204e03d219129af3c0edee712a68259d13506c608a3fb080e6f1107c5b8ba3117e19dc7f69cbf5581c192e01b

Download Submit
\Windows\system\PwbLHVR.exe

Filesize
2.7MB

MD5
63397cbaa98ff26683f9e0ac0283be88

SHA1
e2b535045a42ace8db90cd48116889a0f1ece799

SHA256
2273e3a157195daedf2409ff4522913961e23a23143699bcd462e7099df3fc70

SHA512
6cf60e27bfde158d09ade60a3bdb75eb8cf8e60812f60f4fe1d6cb0f3a9a887cab291eeb525501c5061aeb4573dab0d9d9a9bf0290f6db756cacdd6e8210eb83

Download Submit
\Windows\system\Wwysksl.exe

Filesize
2.7MB

MD5
ef00c68ac9ef83ca0f6ca28596914b79

SHA1
22f12b299369be8012a74e642a8faa0b0833b26a

SHA256
372dac573dba965191d7d023e24e6dd41002694838f010dfde20875774a3182f

SHA512
ca738fa78435c4023148fbf8297211410093144d5d6b59015d857bbc780082c3f42d54303c929db26f683283f61c9f2666e453786b830f17ac3f56f677dd748f

Download Submit
\Windows\system\dIGMSxx.exe

Filesize
2.7MB

MD5
a4ed335516dfd5483040b6da529feb6c

SHA1
864194a3edd019c18f948ca197b97b186feb2409

SHA256
4b759b950ad1c55fa1e1ebd1198b5b88863e4ec0337fefd478b638f760bf9858

SHA512
7de299d2259d2ff22fba38c2631198474bb010127569db0c29939084664a6e6e0286f75adaeb02843bcf1b9d35786c31ab0f9a363b99670229837dac6ff670a0

Download Submit
\Windows\system\ffOmobe.exe

Filesize
2.7MB

MD5
e2bc73aac40b938216f47db1b89beffa

SHA1
ea28a846b3c60947ed37ab7fda5076fd0c24b732

SHA256
6689ca2c50d34f8696bfc7e4839a970091a7357b9e4c503842962579db6fe530

SHA512
43c4bc1f3f55f6709dde8965f142f526a9e3af8c350a2aaae480238f35d485410623eff3016fb0261021a24e1a9dfddf5ea907f9f3ad719159b86b10f399499b

Download Submit
\Windows\system\hFUajjb.exe

Filesize
2.7MB

MD5
728f1e3afeac3836eb3d912d3e9b3c5b

SHA1
e216010e151225f6ebf512f4019addb4d689955c

SHA256
c8639de8fa20bdfc19870d6e9c46422f4dfe3259319922ad19d05bcd3caea76d

SHA512
cc5c13829299c00394d21c6e75cfe46d8c47a37d0e1ba974c6b84bf664d7421df88f0ede7e13308ad1d776a91921f20d1b531d28a02a97a49f598cc823b1e8ec

Download Submit
\Windows\system\lExyRet.exe

Filesize
2.7MB

MD5
eaf78c8d3ca3ae5d0f093f1cb6ad682f

SHA1
373112882659cdb54baf4a29cc889ffda50b3362

SHA256
fc22a0cbc18b076d2d6065abd8f6bb1ef79f386f683d493d53fede7a6da8b68d

SHA512
ae181ec2e643fe299b0b85c53139a2b219fc1ed67fa99544dc0632c2901e8932529f73590fac62ba9a71efd0efb5e06b76d4e34437372d2f362ad4cc328475bb

Download Submit
\Windows\system\mJVLJmE.exe

Filesize
2.7MB

MD5
ba6f6d44bdddac6f8c7a60e7860af0c3

SHA1
bd8d1a6b40cda385f888290d99caded8a405cb93

SHA256
5f8edc1430b5bdd8c2924c41dbc88c2d1bc51d7739840dbdcd701e254fa0ce50

SHA512
034e134be341078b7b641950f90863ce9f34823c3a150d61afe66709fef4c31aac012c8f2fbc558a41763a6ac327ed4cc99fb4e70de34b38fb1568899f27f9a0

Download Submit
\Windows\system\wRwyHyz.exe

Filesize
2.7MB

MD5
9eed9966d1e155058f8c5bf071eaf2f6

SHA1
d43ff384e09802b0cc141f7e3f258a67ac07a504

SHA256
dea2c860318b233850c1eb13729e62ccb6a7488aa932b08d175393d01ea54974

SHA512
63569551e995dca2a390a55ae235f2da2a675c251718ad960535606288be6c590eca26674d68c22b2fd80c33802c490e01b8cf1eb935c069d2419ebb1a90dbce

Download Submit
memory/2184-83-0x000000013F2F0000-0x000000013F644000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2597-0x000000013F2F0000-0x000000013F644000-memory.dmp

Filesize
3.3MB

Download
memory/2240-18-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2240-2587-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2240-108-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2372-2596-0x000000013FE60000-0x00000001401B4000-memory.dmp

Filesize
3.3MB

Download
memory/2372-89-0x000000013FE60000-0x00000001401B4000-memory.dmp

Filesize
3.3MB

Download
memory/2388-95-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/2388-2601-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/2408-96-0x000000013F470000-0x000000013F7C4000-memory.dmp

Filesize
3.3MB

Download
memory/2436-2792-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2436-101-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2436-2076-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2468-2589-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2468-32-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2472-1728-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2472-2609-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2472-98-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-2592-0x000000013FBF0000-0x000000013FF44000-memory.dmp

Filesize
3.3MB

Download
memory/2564-70-0x000000013FBF0000-0x000000013FF44000-memory.dmp

Filesize
3.3MB

Download
memory/2572-50-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2572-563-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2572-2600-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2640-2599-0x000000013F260000-0x000000013F5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-87-0x000000013F260000-0x000000013F5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2700-2602-0x000000013FCB0000-0x0000000140004000-memory.dmp

Filesize
3.3MB

Download
memory/2700-81-0x000000013FCB0000-0x0000000140004000-memory.dmp

Filesize
3.3MB

Download
memory/2764-1444-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-34-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2764-1417-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-77-0x000000013FB80000-0x000000013FED4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-29-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-94-0x000000013F4C0000-0x000000013F814000-memory.dmp

Filesize
3.3MB

Download
memory/2764-22-0x000000013F6D0000-0x000000013FA24000-memory.dmp

Filesize
3.3MB

Download
memory/2764-23-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2764-93-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2764-1455-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2764-11-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2764-1136-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2764-107-0x000000013F410000-0x000000013F764000-memory.dmp

Filesize
3.3MB

Download
memory/2764-106-0x000000013F070000-0x000000013F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-1141-0x000000013FE60000-0x00000001401B4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-771-0x000000013FCB0000-0x0000000140004000-memory.dmp

Filesize
3.3MB

Download
memory/2764-92-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-65-0x000000013FCB0000-0x0000000140004000-memory.dmp

Filesize
3.3MB

Download
memory/2764-0-0x000000013F070000-0x000000013F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-91-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-84-0x000000013FE60000-0x00000001401B4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-294-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2764-82-0x0000000001F50000-0x00000000022A4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-88-0x000000013F470000-0x000000013F7C4000-memory.dmp

Filesize
3.3MB

Download
memory/2764-90-0x000000013FBF0000-0x000000013FF44000-memory.dmp

Filesize
3.3MB

Download
memory/2832-2588-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2832-21-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2896-2580-0x000000013F6D0000-0x000000013FA24000-memory.dmp

Filesize
3.3MB

Download
memory/2896-20-0x000000013F6D0000-0x000000013FA24000-memory.dmp

Filesize
3.3MB

Download