xmrig | 721720cb32befcc98215f059d719049ef92c811084f1313a834ed13bff0f86ae

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
Size

2.2MB
MD5

b07f355c8763584124a551a4fffdac20
SHA1

0a9b7ca6a592492f84a6340d866c03e9179a77a6
SHA256

721720cb32befcc98215f059d719049ef92c811084f1313a834ed13bff0f86ae
SHA512

2cb47840b00ba743ff5dd7131f4f5d38e7d168309a8abbca70b8aa7f401ca32ab59f137b5f1326de322662367f94980a9feee7c02cd076ec8c09373538b1483b
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbbnlD52U7/dNS:BemTLkNdfE0pZrZ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2444-0-0x000000013FDB0000-0x0000000140104000-memory.dmp	xmrig
behavioral1/files/0x000a000000012286-3.dat	xmrig
behavioral1/files/0x000a00000001471a-10.dat	xmrig
behavioral1/files/0x000800000001489f-11.dat	xmrig
behavioral1/memory/2440-48-0x000000013F5D0000-0x000000013F924000-memory.dmp	xmrig
behavioral1/memory/2080-55-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2744-56-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig
behavioral1/memory/2444-58-0x0000000002010000-0x0000000002364000-memory.dmp	xmrig
behavioral1/memory/2216-61-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/memory/2200-64-0x000000013FD80000-0x00000001400D4000-memory.dmp	xmrig
behavioral1/files/0x0007000000015d3b-68.dat	xmrig
behavioral1/files/0x0006000000015d73-73.dat	xmrig
behavioral1/memory/2628-81-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	xmrig
behavioral1/memory/2444-94-0x000000013FDB0000-0x0000000140104000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d9f-104.dat	xmrig
behavioral1/memory/2608-1095-0x000000013FD10000-0x0000000140064000-memory.dmp	xmrig
behavioral1/memory/2200-1094-0x000000013FD80000-0x00000001400D4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016cc1-181.dat	xmrig
behavioral1/files/0x0006000000016ceb-184.dat	xmrig
behavioral1/files/0x0006000000016c6f-170.dat	xmrig
behavioral1/files/0x0006000000016a8a-160.dat	xmrig
behavioral1/files/0x0006000000016c78-175.dat	xmrig
behavioral1/files/0x00060000000165e1-150.dat	xmrig
behavioral1/files/0x0006000000016c52-165.dat	xmrig
behavioral1/files/0x0006000000016835-155.dat	xmrig
behavioral1/files/0x0006000000016455-140.dat	xmrig
behavioral1/files/0x0006000000016581-145.dat	xmrig
behavioral1/files/0x000600000001615c-130.dat	xmrig
behavioral1/files/0x00060000000162e4-134.dat	xmrig
behavioral1/files/0x0006000000015fef-120.dat	xmrig
behavioral1/files/0x000600000001611e-125.dat	xmrig
behavioral1/files/0x0006000000015e1d-111.dat	xmrig
behavioral1/files/0x0006000000015f73-114.dat	xmrig
behavioral1/files/0x0006000000015dca-103.dat	xmrig
behavioral1/memory/2228-89-0x000000013FBD0000-0x000000013FF24000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d83-88.dat	xmrig
behavioral1/memory/1696-95-0x000000013F8C0000-0x000000013FC14000-memory.dmp	xmrig
behavioral1/memory/2652-75-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d90-92.dat	xmrig
behavioral1/files/0x0009000000015d08-37.dat	xmrig
behavioral1/files/0x0006000000015d7b-78.dat	xmrig
behavioral1/memory/2664-69-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/files/0x0009000000015065-26.dat	xmrig
behavioral1/files/0x0007000000014b5c-18.dat	xmrig
behavioral1/memory/2608-65-0x000000013FD10000-0x0000000140064000-memory.dmp	xmrig
behavioral1/memory/2624-60-0x000000013F430000-0x000000013F784000-memory.dmp	xmrig
behavioral1/memory/2932-57-0x000000013F9C0000-0x000000013FD14000-memory.dmp	xmrig
behavioral1/memory/2084-50-0x000000013FA20000-0x000000013FD74000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d53-47.dat	xmrig
behavioral1/files/0x0007000000014b9e-24.dat	xmrig
behavioral1/files/0x0007000000014b36-23.dat	xmrig
behavioral1/memory/2444-8-0x0000000002010000-0x0000000002364000-memory.dmp	xmrig
behavioral1/memory/2664-1544-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/memory/2652-2347-0x000000013F8D0000-0x000000013FC24000-memory.dmp	xmrig
behavioral1/memory/2628-2497-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	xmrig
behavioral1/memory/2228-2731-0x000000013FBD0000-0x000000013FF24000-memory.dmp	xmrig
behavioral1/memory/1696-2864-0x000000013F8C0000-0x000000013FC14000-memory.dmp	xmrig
behavioral1/memory/2932-4002-0x000000013F9C0000-0x000000013FD14000-memory.dmp	xmrig
behavioral1/memory/2624-4006-0x000000013F430000-0x000000013F784000-memory.dmp	xmrig
behavioral1/memory/2080-4005-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2084-4004-0x000000013FA20000-0x000000013FD74000-memory.dmp	xmrig
behavioral1/memory/2440-4003-0x000000013F5D0000-0x000000013F924000-memory.dmp	xmrig
behavioral1/memory/2216-4007-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/memory/2744-4008-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2932	fehnXEg.exe
2440	YPmraGf.exe
2084	mIjgMMl.exe
2624	PhrFeTX.exe
2080	bTAaFhq.exe
2216	IRIiyTh.exe
2744	WEApgEn.exe
2200	czwEZgV.exe
2608	rwYDODI.exe
2664	XSlaXhN.exe
2652	GCbKKWr.exe
2628	zuubKMX.exe
2228	rfsSYAx.exe
1696	eVeEFGF.exe
344	BkCpWMg.exe
1788	NiNvwzX.exe
2488	UjhBxHt.exe
1812	fvBAHHi.exe
1832	DItqEek.exe
2808	GzYDIbI.exe
304	uTKvxSk.exe
2820	dQVFXiR.exe
1572	dgXAQyn.exe
2972	VBceURL.exe
2816	WLgNLTC.exe
2328	voBTjbJ.exe
1260	pQSNxbl.exe
2136	cXWllxe.exe
1740	YfWTPJl.exe
572	HQhrcDQ.exe
988	zdLsYhK.exe
920	frtAZPi.exe
1488	gcntirc.exe
1808	ExQbYjg.exe
1856	RwIEQQp.exe
2380	uiaPPNH.exe
1132	fcmJiDp.exe
2500	ejvbZlU.exe
1912	GLtVYdr.exe
1392	OEAnZoN.exe
1660	WRxMHcG.exe
1648	GYdjYsn.exe
1404	vgtQOAf.exe
1868	FlwHPnl.exe
3068	rilYeud.exe
1628	jKcqSHP.exe
940	lZqeORR.exe
1304	mURMYGC.exe
3040	imULDdF.exe
2364	NmZRivz.exe
2128	tbysFlC.exe
2896	mcCvGQe.exe
3044	zvahGSS.exe
2192	nZtLkXp.exe
1752	kfflUNZ.exe
1056	QQGpOSW.exe
1196	krCVIwQ.exe
1560	XDDGWTS.exe
1288	WhdjTwW.exe
2996	xvMaPmS.exe
2728	whMMoXy.exe
2436	JYOgkIZ.exe
1280	BHgyXjd.exe
2220	dGqAmFv.exe

Loads dropped DLL 64 IoCs

pid	Process
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2444-0-0x000000013FDB0000-0x0000000140104000-memory.dmp	upx
behavioral1/files/0x000a000000012286-3.dat	upx
behavioral1/files/0x000a00000001471a-10.dat	upx
behavioral1/files/0x000800000001489f-11.dat	upx
behavioral1/memory/2440-48-0x000000013F5D0000-0x000000013F924000-memory.dmp	upx
behavioral1/memory/2080-55-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/2744-56-0x000000013F190000-0x000000013F4E4000-memory.dmp	upx
behavioral1/memory/2216-61-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/memory/2200-64-0x000000013FD80000-0x00000001400D4000-memory.dmp	upx
behavioral1/files/0x0007000000015d3b-68.dat	upx
behavioral1/files/0x0006000000015d73-73.dat	upx
behavioral1/memory/2628-81-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	upx
behavioral1/memory/2444-94-0x000000013FDB0000-0x0000000140104000-memory.dmp	upx
behavioral1/files/0x0006000000015d9f-104.dat	upx
behavioral1/memory/2608-1095-0x000000013FD10000-0x0000000140064000-memory.dmp	upx
behavioral1/memory/2200-1094-0x000000013FD80000-0x00000001400D4000-memory.dmp	upx
behavioral1/files/0x0006000000016cc1-181.dat	upx
behavioral1/files/0x0006000000016ceb-184.dat	upx
behavioral1/files/0x0006000000016c6f-170.dat	upx
behavioral1/files/0x0006000000016a8a-160.dat	upx
behavioral1/files/0x0006000000016c78-175.dat	upx
behavioral1/files/0x00060000000165e1-150.dat	upx
behavioral1/files/0x0006000000016c52-165.dat	upx
behavioral1/files/0x0006000000016835-155.dat	upx
behavioral1/files/0x0006000000016455-140.dat	upx
behavioral1/files/0x0006000000016581-145.dat	upx
behavioral1/files/0x000600000001615c-130.dat	upx
behavioral1/files/0x00060000000162e4-134.dat	upx
behavioral1/files/0x0006000000015fef-120.dat	upx
behavioral1/files/0x000600000001611e-125.dat	upx
behavioral1/files/0x0006000000015e1d-111.dat	upx
behavioral1/files/0x0006000000015f73-114.dat	upx
behavioral1/files/0x0006000000015dca-103.dat	upx
behavioral1/memory/2228-89-0x000000013FBD0000-0x000000013FF24000-memory.dmp	upx
behavioral1/files/0x0006000000015d83-88.dat	upx
behavioral1/memory/1696-95-0x000000013F8C0000-0x000000013FC14000-memory.dmp	upx
behavioral1/memory/2652-75-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/files/0x0006000000015d90-92.dat	upx
behavioral1/files/0x0009000000015d08-37.dat	upx
behavioral1/files/0x0006000000015d7b-78.dat	upx
behavioral1/memory/2664-69-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/files/0x0009000000015065-26.dat	upx
behavioral1/files/0x0007000000014b5c-18.dat	upx
behavioral1/memory/2608-65-0x000000013FD10000-0x0000000140064000-memory.dmp	upx
behavioral1/memory/2624-60-0x000000013F430000-0x000000013F784000-memory.dmp	upx
behavioral1/memory/2932-57-0x000000013F9C0000-0x000000013FD14000-memory.dmp	upx
behavioral1/memory/2084-50-0x000000013FA20000-0x000000013FD74000-memory.dmp	upx
behavioral1/files/0x0006000000015d53-47.dat	upx
behavioral1/files/0x0007000000014b9e-24.dat	upx
behavioral1/files/0x0007000000014b36-23.dat	upx
behavioral1/memory/2444-8-0x0000000002010000-0x0000000002364000-memory.dmp	upx
behavioral1/memory/2664-1544-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/memory/2652-2347-0x000000013F8D0000-0x000000013FC24000-memory.dmp	upx
behavioral1/memory/2628-2497-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	upx
behavioral1/memory/2228-2731-0x000000013FBD0000-0x000000013FF24000-memory.dmp	upx
behavioral1/memory/1696-2864-0x000000013F8C0000-0x000000013FC14000-memory.dmp	upx
behavioral1/memory/2932-4002-0x000000013F9C0000-0x000000013FD14000-memory.dmp	upx
behavioral1/memory/2624-4006-0x000000013F430000-0x000000013F784000-memory.dmp	upx
behavioral1/memory/2080-4005-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/2084-4004-0x000000013FA20000-0x000000013FD74000-memory.dmp	upx
behavioral1/memory/2440-4003-0x000000013F5D0000-0x000000013F924000-memory.dmp	upx
behavioral1/memory/2216-4007-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/memory/2744-4008-0x000000013F190000-0x000000013F4E4000-memory.dmp	upx
behavioral1/memory/2664-4009-0x000000013FE20000-0x0000000140174000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\goHUYkD.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\YbkQmcb.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\fdIllpk.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\Mhdhkao.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\BMlPuQH.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\HCyIbMe.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\FgGGtZC.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\oKJrtcu.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\MJllXaU.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ACFtTeC.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\pRDsPxA.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\kLfsUdA.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\fkQEIMv.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\RsUNSDN.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\bznwFDf.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\zIamnkR.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\nlFJbIr.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\vYRQOuw.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\aOfTGvw.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\gVeUULg.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\OMyaYPL.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\fzAVMEm.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\WHDybds.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\frAkhpO.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ToYwSwg.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ikBnUvy.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\DiqWtUA.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\YJwlarf.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\QvOejfw.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\NtnGDCT.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\tvQojCP.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\RzKcvEO.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\IXTfHET.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\tbysFlC.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\YROxuOQ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\RIsRrVg.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\TWznkpi.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\vVcbouZ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\pytVsiL.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\NGfkxeD.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\lxPpfnF.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\nZtLkXp.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\sagWqyC.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\VASoOIa.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\xTEFqYv.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\QZenwYD.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\DNrafCL.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ElurLcc.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\QoXwxxW.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\ZlXzkaf.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\XmriWJj.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\vgEnSKK.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\DWMxTXN.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\CMpvMlJ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\BBWDfvQ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\xgVtoMo.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\BtfSeLS.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\tnXRpvw.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\LIysjqM.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\pbEbKkX.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\EhUkkJq.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\mIjgMMl.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\rfsSYAx.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
File created	C:\Windows\System\eArOaBZ.exe	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2080	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	29
PID 2444 wrote to memory of 2080	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	29
PID 2444 wrote to memory of 2080	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	29
PID 2444 wrote to memory of 2932	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	30
PID 2444 wrote to memory of 2932	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	30
PID 2444 wrote to memory of 2932	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	30
PID 2444 wrote to memory of 2216	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	31
PID 2444 wrote to memory of 2216	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	31
PID 2444 wrote to memory of 2216	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	31
PID 2444 wrote to memory of 2440	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	32
PID 2444 wrote to memory of 2440	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	32
PID 2444 wrote to memory of 2440	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	32
PID 2444 wrote to memory of 2200	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	33
PID 2444 wrote to memory of 2200	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	33
PID 2444 wrote to memory of 2200	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	33
PID 2444 wrote to memory of 2084	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	34
PID 2444 wrote to memory of 2084	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	34
PID 2444 wrote to memory of 2084	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	34
PID 2444 wrote to memory of 2608	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	35
PID 2444 wrote to memory of 2608	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	35
PID 2444 wrote to memory of 2608	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	35
PID 2444 wrote to memory of 2624	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	36
PID 2444 wrote to memory of 2624	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	36
PID 2444 wrote to memory of 2624	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	36
PID 2444 wrote to memory of 2664	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	37
PID 2444 wrote to memory of 2664	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	37
PID 2444 wrote to memory of 2664	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	37
PID 2444 wrote to memory of 2744	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	38
PID 2444 wrote to memory of 2744	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	38
PID 2444 wrote to memory of 2744	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	38
PID 2444 wrote to memory of 2652	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	39
PID 2444 wrote to memory of 2652	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	39
PID 2444 wrote to memory of 2652	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	39
PID 2444 wrote to memory of 2628	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	40
PID 2444 wrote to memory of 2628	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	40
PID 2444 wrote to memory of 2628	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	40
PID 2444 wrote to memory of 2228	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	41
PID 2444 wrote to memory of 2228	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	41
PID 2444 wrote to memory of 2228	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	41
PID 2444 wrote to memory of 1696	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	42
PID 2444 wrote to memory of 1696	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	42
PID 2444 wrote to memory of 1696	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	42
PID 2444 wrote to memory of 1788	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	43
PID 2444 wrote to memory of 1788	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	43
PID 2444 wrote to memory of 1788	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	43
PID 2444 wrote to memory of 344	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	44
PID 2444 wrote to memory of 344	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	44
PID 2444 wrote to memory of 344	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	44
PID 2444 wrote to memory of 2488	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	45
PID 2444 wrote to memory of 2488	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	45
PID 2444 wrote to memory of 2488	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	45
PID 2444 wrote to memory of 1812	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	46
PID 2444 wrote to memory of 1812	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	46
PID 2444 wrote to memory of 1812	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	46
PID 2444 wrote to memory of 1832	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	47
PID 2444 wrote to memory of 1832	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	47
PID 2444 wrote to memory of 1832	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	47
PID 2444 wrote to memory of 2808	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	48
PID 2444 wrote to memory of 2808	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	48
PID 2444 wrote to memory of 2808	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	48
PID 2444 wrote to memory of 304	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	49
PID 2444 wrote to memory of 304	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	49
PID 2444 wrote to memory of 304	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	49
PID 2444 wrote to memory of 2820	2444	b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b07f355c8763584124a551a4fffdac20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System\bTAaFhq.exe
  C:\Windows\System\bTAaFhq.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\fehnXEg.exe
  C:\Windows\System\fehnXEg.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\IRIiyTh.exe
  C:\Windows\System\IRIiyTh.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\YPmraGf.exe
  C:\Windows\System\YPmraGf.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\czwEZgV.exe
  C:\Windows\System\czwEZgV.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\mIjgMMl.exe
  C:\Windows\System\mIjgMMl.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\rwYDODI.exe
  C:\Windows\System\rwYDODI.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\PhrFeTX.exe
  C:\Windows\System\PhrFeTX.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\XSlaXhN.exe
  C:\Windows\System\XSlaXhN.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\WEApgEn.exe
  C:\Windows\System\WEApgEn.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\GCbKKWr.exe
  C:\Windows\System\GCbKKWr.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\zuubKMX.exe
  C:\Windows\System\zuubKMX.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\rfsSYAx.exe
  C:\Windows\System\rfsSYAx.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\eVeEFGF.exe
  C:\Windows\System\eVeEFGF.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\NiNvwzX.exe
  C:\Windows\System\NiNvwzX.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\BkCpWMg.exe
  C:\Windows\System\BkCpWMg.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\UjhBxHt.exe
  C:\Windows\System\UjhBxHt.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\fvBAHHi.exe
  C:\Windows\System\fvBAHHi.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\DItqEek.exe
  C:\Windows\System\DItqEek.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\GzYDIbI.exe
  C:\Windows\System\GzYDIbI.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\uTKvxSk.exe
  C:\Windows\System\uTKvxSk.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\dQVFXiR.exe
  C:\Windows\System\dQVFXiR.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\dgXAQyn.exe
  C:\Windows\System\dgXAQyn.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\VBceURL.exe
  C:\Windows\System\VBceURL.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\WLgNLTC.exe
  C:\Windows\System\WLgNLTC.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\voBTjbJ.exe
  C:\Windows\System\voBTjbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\pQSNxbl.exe
  C:\Windows\System\pQSNxbl.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\cXWllxe.exe
  C:\Windows\System\cXWllxe.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\YfWTPJl.exe
  C:\Windows\System\YfWTPJl.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\HQhrcDQ.exe
  C:\Windows\System\HQhrcDQ.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\zdLsYhK.exe
  C:\Windows\System\zdLsYhK.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\frtAZPi.exe
  C:\Windows\System\frtAZPi.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\gcntirc.exe
  C:\Windows\System\gcntirc.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\ExQbYjg.exe
  C:\Windows\System\ExQbYjg.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\RwIEQQp.exe
  C:\Windows\System\RwIEQQp.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\uiaPPNH.exe
  C:\Windows\System\uiaPPNH.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\fcmJiDp.exe
  C:\Windows\System\fcmJiDp.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\ejvbZlU.exe
  C:\Windows\System\ejvbZlU.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\GLtVYdr.exe
  C:\Windows\System\GLtVYdr.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\OEAnZoN.exe
  C:\Windows\System\OEAnZoN.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\WRxMHcG.exe
  C:\Windows\System\WRxMHcG.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\GYdjYsn.exe
  C:\Windows\System\GYdjYsn.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\vgtQOAf.exe
  C:\Windows\System\vgtQOAf.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\FlwHPnl.exe
  C:\Windows\System\FlwHPnl.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\rilYeud.exe
  C:\Windows\System\rilYeud.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\jKcqSHP.exe
  C:\Windows\System\jKcqSHP.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\lZqeORR.exe
  C:\Windows\System\lZqeORR.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\mURMYGC.exe
  C:\Windows\System\mURMYGC.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\imULDdF.exe
  C:\Windows\System\imULDdF.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\NmZRivz.exe
  C:\Windows\System\NmZRivz.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\tbysFlC.exe
  C:\Windows\System\tbysFlC.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\mcCvGQe.exe
  C:\Windows\System\mcCvGQe.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\zvahGSS.exe
  C:\Windows\System\zvahGSS.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\nZtLkXp.exe
  C:\Windows\System\nZtLkXp.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\kfflUNZ.exe
  C:\Windows\System\kfflUNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\QQGpOSW.exe
  C:\Windows\System\QQGpOSW.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\krCVIwQ.exe
  C:\Windows\System\krCVIwQ.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\XDDGWTS.exe
  C:\Windows\System\XDDGWTS.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\WhdjTwW.exe
  C:\Windows\System\WhdjTwW.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\xvMaPmS.exe
  C:\Windows\System\xvMaPmS.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\whMMoXy.exe
  C:\Windows\System\whMMoXy.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\JYOgkIZ.exe
  C:\Windows\System\JYOgkIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\BHgyXjd.exe
  C:\Windows\System\BHgyXjd.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\dGqAmFv.exe
  C:\Windows\System\dGqAmFv.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\tKwzpKq.exe
  C:\Windows\System\tKwzpKq.exe
  2⤵
  PID:3024
- C:\Windows\System\LJajlVz.exe
  C:\Windows\System\LJajlVz.exe
  2⤵
  PID:2948
- C:\Windows\System\fjmgcdE.exe
  C:\Windows\System\fjmgcdE.exe
  2⤵
  PID:2740
- C:\Windows\System\PmwtNRH.exe
  C:\Windows\System\PmwtNRH.exe
  2⤵
  PID:1316
- C:\Windows\System\yYutoEn.exe
  C:\Windows\System\yYutoEn.exe
  2⤵
  PID:2232
- C:\Windows\System\PwEcYGd.exe
  C:\Windows\System\PwEcYGd.exe
  2⤵
  PID:2024
- C:\Windows\System\NMvtlUL.exe
  C:\Windows\System\NMvtlUL.exe
  2⤵
  PID:348
- C:\Windows\System\dShjQlg.exe
  C:\Windows\System\dShjQlg.exe
  2⤵
  PID:1564
- C:\Windows\System\QrVGNRG.exe
  C:\Windows\System\QrVGNRG.exe
  2⤵
  PID:1672
- C:\Windows\System\oBCXmoO.exe
  C:\Windows\System\oBCXmoO.exe
  2⤵
  PID:2944
- C:\Windows\System\YtTyeTU.exe
  C:\Windows\System\YtTyeTU.exe
  2⤵
  PID:2268
- C:\Windows\System\DlqwMdR.exe
  C:\Windows\System\DlqwMdR.exe
  2⤵
  PID:1264
- C:\Windows\System\kxMMPjI.exe
  C:\Windows\System\kxMMPjI.exe
  2⤵
  PID:2112
- C:\Windows\System\hNeTNls.exe
  C:\Windows\System\hNeTNls.exe
  2⤵
  PID:484
- C:\Windows\System\kBDuchc.exe
  C:\Windows\System\kBDuchc.exe
  2⤵
  PID:752
- C:\Windows\System\tNYkcjR.exe
  C:\Windows\System\tNYkcjR.exe
  2⤵
  PID:2612
- C:\Windows\System\rxwBXKh.exe
  C:\Windows\System\rxwBXKh.exe
  2⤵
  PID:448
- C:\Windows\System\iPFlUwh.exe
  C:\Windows\System\iPFlUwh.exe
  2⤵
  PID:2472
- C:\Windows\System\NlEYPqp.exe
  C:\Windows\System\NlEYPqp.exe
  2⤵
  PID:1360
- C:\Windows\System\cOrKzSh.exe
  C:\Windows\System\cOrKzSh.exe
  2⤵
  PID:1680
- C:\Windows\System\eNulZBY.exe
  C:\Windows\System\eNulZBY.exe
  2⤵
  PID:2032
- C:\Windows\System\PjdhYWw.exe
  C:\Windows\System\PjdhYWw.exe
  2⤵
  PID:1848
- C:\Windows\System\RIqmTCO.exe
  C:\Windows\System\RIqmTCO.exe
  2⤵
  PID:1608
- C:\Windows\System\FUBqtik.exe
  C:\Windows\System\FUBqtik.exe
  2⤵
  PID:1348
- C:\Windows\System\SkEhMFf.exe
  C:\Windows\System\SkEhMFf.exe
  2⤵
  PID:1376
- C:\Windows\System\QoXwxxW.exe
  C:\Windows\System\QoXwxxW.exe
  2⤵
  PID:2468
- C:\Windows\System\yqHTMor.exe
  C:\Windows\System\yqHTMor.exe
  2⤵
  PID:2404
- C:\Windows\System\PKBbGwA.exe
  C:\Windows\System\PKBbGwA.exe
  2⤵
  PID:2124
- C:\Windows\System\nXZvcnM.exe
  C:\Windows\System\nXZvcnM.exe
  2⤵
  PID:2156
- C:\Windows\System\uxhGHtb.exe
  C:\Windows\System\uxhGHtb.exe
  2⤵
  PID:2044
- C:\Windows\System\MTjraZX.exe
  C:\Windows\System\MTjraZX.exe
  2⤵
  PID:848
- C:\Windows\System\MtVAwla.exe
  C:\Windows\System\MtVAwla.exe
  2⤵
  PID:1400
- C:\Windows\System\THPHotN.exe
  C:\Windows\System\THPHotN.exe
  2⤵
  PID:2660
- C:\Windows\System\PNiIpiF.exe
  C:\Windows\System\PNiIpiF.exe
  2⤵
  PID:2764
- C:\Windows\System\eqLziQW.exe
  C:\Windows\System\eqLziQW.exe
  2⤵
  PID:2720
- C:\Windows\System\GUMWoOg.exe
  C:\Windows\System\GUMWoOg.exe
  2⤵
  PID:1936
- C:\Windows\System\GUQyafK.exe
  C:\Windows\System\GUQyafK.exe
  2⤵
  PID:1796
- C:\Windows\System\AnLojoo.exe
  C:\Windows\System\AnLojoo.exe
  2⤵
  PID:2008
- C:\Windows\System\ztqaUKF.exe
  C:\Windows\System\ztqaUKF.exe
  2⤵
  PID:292
- C:\Windows\System\bzWLvLs.exe
  C:\Windows\System\bzWLvLs.exe
  2⤵
  PID:1776
- C:\Windows\System\fcnTlzt.exe
  C:\Windows\System\fcnTlzt.exe
  2⤵
  PID:1328
- C:\Windows\System\dMqNwti.exe
  C:\Windows\System\dMqNwti.exe
  2⤵
  PID:1692
- C:\Windows\System\lKQbvAT.exe
  C:\Windows\System\lKQbvAT.exe
  2⤵
  PID:1484
- C:\Windows\System\YqReGLC.exe
  C:\Windows\System\YqReGLC.exe
  2⤵
  PID:2812
- C:\Windows\System\mthUdre.exe
  C:\Windows\System\mthUdre.exe
  2⤵
  PID:2288
- C:\Windows\System\GsWIiJc.exe
  C:\Windows\System\GsWIiJc.exe
  2⤵
  PID:1920
- C:\Windows\System\qYQakDo.exe
  C:\Windows\System\qYQakDo.exe
  2⤵
  PID:1864
- C:\Windows\System\SUyKusr.exe
  C:\Windows\System\SUyKusr.exe
  2⤵
  PID:2072
- C:\Windows\System\flXoHtp.exe
  C:\Windows\System\flXoHtp.exe
  2⤵
  PID:3080
- C:\Windows\System\VLagSKQ.exe
  C:\Windows\System\VLagSKQ.exe
  2⤵
  PID:3100
- C:\Windows\System\pBPKAXQ.exe
  C:\Windows\System\pBPKAXQ.exe
  2⤵
  PID:3120
- C:\Windows\System\eowLjvw.exe
  C:\Windows\System\eowLjvw.exe
  2⤵
  PID:3140
- C:\Windows\System\PcKCDxu.exe
  C:\Windows\System\PcKCDxu.exe
  2⤵
  PID:3160
- C:\Windows\System\fgZoYzh.exe
  C:\Windows\System\fgZoYzh.exe
  2⤵
  PID:3180
- C:\Windows\System\MwcOXEz.exe
  C:\Windows\System\MwcOXEz.exe
  2⤵
  PID:3200
- C:\Windows\System\rETLFyA.exe
  C:\Windows\System\rETLFyA.exe
  2⤵
  PID:3220
- C:\Windows\System\buccJNT.exe
  C:\Windows\System\buccJNT.exe
  2⤵
  PID:3240
- C:\Windows\System\tpEORtX.exe
  C:\Windows\System\tpEORtX.exe
  2⤵
  PID:3260
- C:\Windows\System\zuwNspD.exe
  C:\Windows\System\zuwNspD.exe
  2⤵
  PID:3280
- C:\Windows\System\vMdyANP.exe
  C:\Windows\System\vMdyANP.exe
  2⤵
  PID:3300
- C:\Windows\System\ZmLxpQO.exe
  C:\Windows\System\ZmLxpQO.exe
  2⤵
  PID:3320
- C:\Windows\System\qegSPZT.exe
  C:\Windows\System\qegSPZT.exe
  2⤵
  PID:3336
- C:\Windows\System\vZIifDD.exe
  C:\Windows\System\vZIifDD.exe
  2⤵
  PID:3360
- C:\Windows\System\qPZLvfr.exe
  C:\Windows\System\qPZLvfr.exe
  2⤵
  PID:3380
- C:\Windows\System\BWLFpNf.exe
  C:\Windows\System\BWLFpNf.exe
  2⤵
  PID:3400
- C:\Windows\System\gOZOOGR.exe
  C:\Windows\System\gOZOOGR.exe
  2⤵
  PID:3420
- C:\Windows\System\OmKoxuG.exe
  C:\Windows\System\OmKoxuG.exe
  2⤵
  PID:3440
- C:\Windows\System\lxRdMbc.exe
  C:\Windows\System\lxRdMbc.exe
  2⤵
  PID:3460
- C:\Windows\System\hwKaxdE.exe
  C:\Windows\System\hwKaxdE.exe
  2⤵
  PID:3480
- C:\Windows\System\TFxSPiG.exe
  C:\Windows\System\TFxSPiG.exe
  2⤵
  PID:3496
- C:\Windows\System\FoapaPA.exe
  C:\Windows\System\FoapaPA.exe
  2⤵
  PID:3516
- C:\Windows\System\IWchpnE.exe
  C:\Windows\System\IWchpnE.exe
  2⤵
  PID:3540
- C:\Windows\System\YUUfXSk.exe
  C:\Windows\System\YUUfXSk.exe
  2⤵
  PID:3560
- C:\Windows\System\vBlxjdG.exe
  C:\Windows\System\vBlxjdG.exe
  2⤵
  PID:3580
- C:\Windows\System\OTtkpPp.exe
  C:\Windows\System\OTtkpPp.exe
  2⤵
  PID:3600
- C:\Windows\System\ttpyfoQ.exe
  C:\Windows\System\ttpyfoQ.exe
  2⤵
  PID:3616
- C:\Windows\System\BixBpSq.exe
  C:\Windows\System\BixBpSq.exe
  2⤵
  PID:3640
- C:\Windows\System\AaWciLd.exe
  C:\Windows\System\AaWciLd.exe
  2⤵
  PID:3660
- C:\Windows\System\aMcXolL.exe
  C:\Windows\System\aMcXolL.exe
  2⤵
  PID:3680
- C:\Windows\System\xEfyoqV.exe
  C:\Windows\System\xEfyoqV.exe
  2⤵
  PID:3696
- C:\Windows\System\tIGOiyK.exe
  C:\Windows\System\tIGOiyK.exe
  2⤵
  PID:3720
- C:\Windows\System\lWISoxQ.exe
  C:\Windows\System\lWISoxQ.exe
  2⤵
  PID:3736
- C:\Windows\System\NAmIFpd.exe
  C:\Windows\System\NAmIFpd.exe
  2⤵
  PID:3760
- C:\Windows\System\iSRPPbA.exe
  C:\Windows\System\iSRPPbA.exe
  2⤵
  PID:3776
- C:\Windows\System\qltKApM.exe
  C:\Windows\System\qltKApM.exe
  2⤵
  PID:3800
- C:\Windows\System\pWUuOol.exe
  C:\Windows\System\pWUuOol.exe
  2⤵
  PID:3816
- C:\Windows\System\IcNOWUT.exe
  C:\Windows\System\IcNOWUT.exe
  2⤵
  PID:3836
- C:\Windows\System\ydslEEI.exe
  C:\Windows\System\ydslEEI.exe
  2⤵
  PID:3856
- C:\Windows\System\YJgnadp.exe
  C:\Windows\System\YJgnadp.exe
  2⤵
  PID:3876
- C:\Windows\System\SyPcKzK.exe
  C:\Windows\System\SyPcKzK.exe
  2⤵
  PID:3896
- C:\Windows\System\rKFZqiM.exe
  C:\Windows\System\rKFZqiM.exe
  2⤵
  PID:3920
- C:\Windows\System\YyctoWs.exe
  C:\Windows\System\YyctoWs.exe
  2⤵
  PID:3936
- C:\Windows\System\jpGvhyC.exe
  C:\Windows\System\jpGvhyC.exe
  2⤵
  PID:3960
- C:\Windows\System\fpIHnFR.exe
  C:\Windows\System\fpIHnFR.exe
  2⤵
  PID:3976
- C:\Windows\System\zRzfomt.exe
  C:\Windows\System\zRzfomt.exe
  2⤵
  PID:3992
- C:\Windows\System\BtfSeLS.exe
  C:\Windows\System\BtfSeLS.exe
  2⤵
  PID:4020
- C:\Windows\System\IzKpbNn.exe
  C:\Windows\System\IzKpbNn.exe
  2⤵
  PID:4040
- C:\Windows\System\qbGMRll.exe
  C:\Windows\System\qbGMRll.exe
  2⤵
  PID:4056
- C:\Windows\System\LfopGni.exe
  C:\Windows\System\LfopGni.exe
  2⤵
  PID:4080
- C:\Windows\System\pXxOhIO.exe
  C:\Windows\System\pXxOhIO.exe
  2⤵
  PID:3056
- C:\Windows\System\lHiGdMf.exe
  C:\Windows\System\lHiGdMf.exe
  2⤵
  PID:2484
- C:\Windows\System\lkUblde.exe
  C:\Windows\System\lkUblde.exe
  2⤵
  PID:2160
- C:\Windows\System\THHoIkc.exe
  C:\Windows\System\THHoIkc.exe
  2⤵
  PID:976
- C:\Windows\System\IPamjzC.exe
  C:\Windows\System\IPamjzC.exe
  2⤵
  PID:2656
- C:\Windows\System\KHlDrXe.exe
  C:\Windows\System\KHlDrXe.exe
  2⤵
  PID:2132
- C:\Windows\System\QDIumOl.exe
  C:\Windows\System\QDIumOl.exe
  2⤵
  PID:2504
- C:\Windows\System\sXoZTxA.exe
  C:\Windows\System\sXoZTxA.exe
  2⤵
  PID:1652
- C:\Windows\System\KoCbptU.exe
  C:\Windows\System\KoCbptU.exe
  2⤵
  PID:2252
- C:\Windows\System\OLbHuse.exe
  C:\Windows\System\OLbHuse.exe
  2⤵
  PID:2376
- C:\Windows\System\HXIPbGc.exe
  C:\Windows\System\HXIPbGc.exe
  2⤵
  PID:2824
- C:\Windows\System\VEVkfoj.exe
  C:\Windows\System\VEVkfoj.exe
  2⤵
  PID:2496
- C:\Windows\System\SPEzcLI.exe
  C:\Windows\System\SPEzcLI.exe
  2⤵
  PID:1356
- C:\Windows\System\GDFCQGT.exe
  C:\Windows\System\GDFCQGT.exe
  2⤵
  PID:1528
- C:\Windows\System\HHxOBJc.exe
  C:\Windows\System\HHxOBJc.exe
  2⤵
  PID:1616
- C:\Windows\System\XdFgBoq.exe
  C:\Windows\System\XdFgBoq.exe
  2⤵
  PID:3092
- C:\Windows\System\cYKoRBU.exe
  C:\Windows\System\cYKoRBU.exe
  2⤵
  PID:3128
- C:\Windows\System\DvvvYcu.exe
  C:\Windows\System\DvvvYcu.exe
  2⤵
  PID:3196
- C:\Windows\System\ZwgtMuW.exe
  C:\Windows\System\ZwgtMuW.exe
  2⤵
  PID:3192
- C:\Windows\System\eedJTFT.exe
  C:\Windows\System\eedJTFT.exe
  2⤵
  PID:3216
- C:\Windows\System\iurcoJe.exe
  C:\Windows\System\iurcoJe.exe
  2⤵
  PID:3256
- C:\Windows\System\hxBUThF.exe
  C:\Windows\System\hxBUThF.exe
  2⤵
  PID:3344
- C:\Windows\System\vifSzPH.exe
  C:\Windows\System\vifSzPH.exe
  2⤵
  PID:3356
- C:\Windows\System\dJRikjd.exe
  C:\Windows\System\dJRikjd.exe
  2⤵
  PID:3388
- C:\Windows\System\cKyIOCZ.exe
  C:\Windows\System\cKyIOCZ.exe
  2⤵
  PID:3428
- C:\Windows\System\HGkKNhy.exe
  C:\Windows\System\HGkKNhy.exe
  2⤵
  PID:3448
- C:\Windows\System\nlFJbIr.exe
  C:\Windows\System\nlFJbIr.exe
  2⤵
  PID:3472
- C:\Windows\System\AYwuzFm.exe
  C:\Windows\System\AYwuzFm.exe
  2⤵
  PID:3508
- C:\Windows\System\IWBROFu.exe
  C:\Windows\System\IWBROFu.exe
  2⤵
  PID:3556
- C:\Windows\System\AqSIGGm.exe
  C:\Windows\System\AqSIGGm.exe
  2⤵
  PID:3588
- C:\Windows\System\FlZgevA.exe
  C:\Windows\System\FlZgevA.exe
  2⤵
  PID:3608
- C:\Windows\System\lwMENvE.exe
  C:\Windows\System\lwMENvE.exe
  2⤵
  PID:2984
- C:\Windows\System\NEixAGP.exe
  C:\Windows\System\NEixAGP.exe
  2⤵
  PID:3676
- C:\Windows\System\FBgVFVV.exe
  C:\Windows\System\FBgVFVV.exe
  2⤵
  PID:3708
- C:\Windows\System\tJNZAtN.exe
  C:\Windows\System\tJNZAtN.exe
  2⤵
  PID:3692
- C:\Windows\System\YrZlzhC.exe
  C:\Windows\System\YrZlzhC.exe
  2⤵
  PID:3732
- C:\Windows\System\LfdKYJY.exe
  C:\Windows\System\LfdKYJY.exe
  2⤵
  PID:3772
- C:\Windows\System\OdUiGez.exe
  C:\Windows\System\OdUiGez.exe
  2⤵
  PID:3812
- C:\Windows\System\WmalfGt.exe
  C:\Windows\System\WmalfGt.exe
  2⤵
  PID:3848
- C:\Windows\System\lzxqiEB.exe
  C:\Windows\System\lzxqiEB.exe
  2⤵
  PID:3916
- C:\Windows\System\bgvWCWV.exe
  C:\Windows\System\bgvWCWV.exe
  2⤵
  PID:3944
- C:\Windows\System\LEnGFMw.exe
  C:\Windows\System\LEnGFMw.exe
  2⤵
  PID:3028
- C:\Windows\System\xPZFXDj.exe
  C:\Windows\System\xPZFXDj.exe
  2⤵
  PID:3968
- C:\Windows\System\XLdxtvs.exe
  C:\Windows\System\XLdxtvs.exe
  2⤵
  PID:4016
- C:\Windows\System\BiMfXpy.exe
  C:\Windows\System\BiMfXpy.exe
  2⤵
  PID:4064
- C:\Windows\System\WTclBFY.exe
  C:\Windows\System\WTclBFY.exe
  2⤵
  PID:2224
- C:\Windows\System\sagWqyC.exe
  C:\Windows\System\sagWqyC.exe
  2⤵
  PID:4048
- C:\Windows\System\kZpbFwB.exe
  C:\Windows\System\kZpbFwB.exe
  2⤵
  PID:1592
- C:\Windows\System\pCHFzuQ.exe
  C:\Windows\System\pCHFzuQ.exe
  2⤵
  PID:876
- C:\Windows\System\nHlqWwM.exe
  C:\Windows\System\nHlqWwM.exe
  2⤵
  PID:2708
- C:\Windows\System\RCXlZzD.exe
  C:\Windows\System\RCXlZzD.exe
  2⤵
  PID:852
- C:\Windows\System\VYsbeIO.exe
  C:\Windows\System\VYsbeIO.exe
  2⤵
  PID:2968
- C:\Windows\System\DEckqCI.exe
  C:\Windows\System\DEckqCI.exe
  2⤵
  PID:624
- C:\Windows\System\hazOcfN.exe
  C:\Windows\System\hazOcfN.exe
  2⤵
  PID:3064
- C:\Windows\System\gKsYpdR.exe
  C:\Windows\System\gKsYpdR.exe
  2⤵
  PID:1872
- C:\Windows\System\VgtdTcp.exe
  C:\Windows\System\VgtdTcp.exe
  2⤵
  PID:3096
- C:\Windows\System\oBHtDqt.exe
  C:\Windows\System\oBHtDqt.exe
  2⤵
  PID:3132
- C:\Windows\System\PpQpkhg.exe
  C:\Windows\System\PpQpkhg.exe
  2⤵
  PID:3236
- C:\Windows\System\SODFEHr.exe
  C:\Windows\System\SODFEHr.exe
  2⤵
  PID:3172
- C:\Windows\System\lkzMDVx.exe
  C:\Windows\System\lkzMDVx.exe
  2⤵
  PID:3312
- C:\Windows\System\TzmkCtR.exe
  C:\Windows\System\TzmkCtR.exe
  2⤵
  PID:3296
- C:\Windows\System\xzdRDjr.exe
  C:\Windows\System\xzdRDjr.exe
  2⤵
  PID:3416
- C:\Windows\System\GPPUwYx.exe
  C:\Windows\System\GPPUwYx.exe
  2⤵
  PID:3392
- C:\Windows\System\FhmHVXO.exe
  C:\Windows\System\FhmHVXO.exe
  2⤵
  PID:3492
- C:\Windows\System\iOyfQZe.exe
  C:\Windows\System\iOyfQZe.exe
  2⤵
  PID:3548
- C:\Windows\System\tHvpGok.exe
  C:\Windows\System\tHvpGok.exe
  2⤵
  PID:3592
- C:\Windows\System\FgcKUpu.exe
  C:\Windows\System\FgcKUpu.exe
  2⤵
  PID:3652
- C:\Windows\System\ttATqNB.exe
  C:\Windows\System\ttATqNB.exe
  2⤵
  PID:1088
- C:\Windows\System\SWEUJDo.exe
  C:\Windows\System\SWEUJDo.exe
  2⤵
  PID:3808
- C:\Windows\System\ECKgPWs.exe
  C:\Windows\System\ECKgPWs.exe
  2⤵
  PID:3768
- C:\Windows\System\DzrqDvM.exe
  C:\Windows\System\DzrqDvM.exe
  2⤵
  PID:2480
- C:\Windows\System\LujjSGY.exe
  C:\Windows\System\LujjSGY.exe
  2⤵
  PID:3904
- C:\Windows\System\bFShYOE.exe
  C:\Windows\System\bFShYOE.exe
  2⤵
  PID:3888
- C:\Windows\System\KyamqYm.exe
  C:\Windows\System\KyamqYm.exe
  2⤵
  PID:4036
- C:\Windows\System\wqJrdBl.exe
  C:\Windows\System\wqJrdBl.exe
  2⤵
  PID:1928
- C:\Windows\System\fbNqmbd.exe
  C:\Windows\System\fbNqmbd.exe
  2⤵
  PID:2920
- C:\Windows\System\zjnIsPY.exe
  C:\Windows\System\zjnIsPY.exe
  2⤵
  PID:4088
- C:\Windows\System\cSzNBaG.exe
  C:\Windows\System\cSzNBaG.exe
  2⤵
  PID:1456
- C:\Windows\System\FcaEeQo.exe
  C:\Windows\System\FcaEeQo.exe
  2⤵
  PID:2980
- C:\Windows\System\ZIhxISs.exe
  C:\Windows\System\ZIhxISs.exe
  2⤵
  PID:2672
- C:\Windows\System\xEMCkVd.exe
  C:\Windows\System\xEMCkVd.exe
  2⤵
  PID:584
- C:\Windows\System\MMWDbUi.exe
  C:\Windows\System\MMWDbUi.exe
  2⤵
  PID:3148
- C:\Windows\System\LzjcRHh.exe
  C:\Windows\System\LzjcRHh.exe
  2⤵
  PID:3276
- C:\Windows\System\bgRkAcM.exe
  C:\Windows\System\bgRkAcM.exe
  2⤵
  PID:3408
- C:\Windows\System\GmUopZI.exe
  C:\Windows\System\GmUopZI.exe
  2⤵
  PID:3528
- C:\Windows\System\BMydRKP.exe
  C:\Windows\System\BMydRKP.exe
  2⤵
  PID:3536
- C:\Windows\System\GODhfZi.exe
  C:\Windows\System\GODhfZi.exe
  2⤵
  PID:3532
- C:\Windows\System\oSkimFy.exe
  C:\Windows\System\oSkimFy.exe
  2⤵
  PID:3752
- C:\Windows\System\rEfSVRB.exe
  C:\Windows\System\rEfSVRB.exe
  2⤵
  PID:3712
- C:\Windows\System\OrXWfWq.exe
  C:\Windows\System\OrXWfWq.exe
  2⤵
  PID:3788
- C:\Windows\System\ywSekat.exe
  C:\Windows\System\ywSekat.exe
  2⤵
  PID:4112
- C:\Windows\System\vKgUpCz.exe
  C:\Windows\System\vKgUpCz.exe
  2⤵
  PID:4136
- C:\Windows\System\uborPfh.exe
  C:\Windows\System\uborPfh.exe
  2⤵
  PID:4156
- C:\Windows\System\qeBwotj.exe
  C:\Windows\System\qeBwotj.exe
  2⤵
  PID:4176
- C:\Windows\System\sSLRUEB.exe
  C:\Windows\System\sSLRUEB.exe
  2⤵
  PID:4196
- C:\Windows\System\SwPGvBC.exe
  C:\Windows\System\SwPGvBC.exe
  2⤵
  PID:4216
- C:\Windows\System\QLzrFUr.exe
  C:\Windows\System\QLzrFUr.exe
  2⤵
  PID:4240
- C:\Windows\System\xJjEUeZ.exe
  C:\Windows\System\xJjEUeZ.exe
  2⤵
  PID:4260
- C:\Windows\System\aitVtFO.exe
  C:\Windows\System\aitVtFO.exe
  2⤵
  PID:4276
- C:\Windows\System\aYXnpAe.exe
  C:\Windows\System\aYXnpAe.exe
  2⤵
  PID:4300
- C:\Windows\System\nDoKiSQ.exe
  C:\Windows\System\nDoKiSQ.exe
  2⤵
  PID:4316
- C:\Windows\System\naHqOEN.exe
  C:\Windows\System\naHqOEN.exe
  2⤵
  PID:4340
- C:\Windows\System\ySYxZnv.exe
  C:\Windows\System\ySYxZnv.exe
  2⤵
  PID:4356
- C:\Windows\System\ZYWDCRY.exe
  C:\Windows\System\ZYWDCRY.exe
  2⤵
  PID:4376
- C:\Windows\System\jUaSqik.exe
  C:\Windows\System\jUaSqik.exe
  2⤵
  PID:4396
- C:\Windows\System\OlMapDq.exe
  C:\Windows\System\OlMapDq.exe
  2⤵
  PID:4420
- C:\Windows\System\QrQoFNj.exe
  C:\Windows\System\QrQoFNj.exe
  2⤵
  PID:4436
- C:\Windows\System\miWUOHi.exe
  C:\Windows\System\miWUOHi.exe
  2⤵
  PID:4456
- C:\Windows\System\jGWDcEJ.exe
  C:\Windows\System\jGWDcEJ.exe
  2⤵
  PID:4480
- C:\Windows\System\lmuUhiQ.exe
  C:\Windows\System\lmuUhiQ.exe
  2⤵
  PID:4500
- C:\Windows\System\xNdkLTT.exe
  C:\Windows\System\xNdkLTT.exe
  2⤵
  PID:4516
- C:\Windows\System\pJtyUoM.exe
  C:\Windows\System\pJtyUoM.exe
  2⤵
  PID:4540
- C:\Windows\System\kGVoInS.exe
  C:\Windows\System\kGVoInS.exe
  2⤵
  PID:4556
- C:\Windows\System\EXTaiYH.exe
  C:\Windows\System\EXTaiYH.exe
  2⤵
  PID:4576
- C:\Windows\System\nBqMQpn.exe
  C:\Windows\System\nBqMQpn.exe
  2⤵
  PID:4600
- C:\Windows\System\WsilHSm.exe
  C:\Windows\System\WsilHSm.exe
  2⤵
  PID:4620
- C:\Windows\System\NRyqCMT.exe
  C:\Windows\System\NRyqCMT.exe
  2⤵
  PID:4636
- C:\Windows\System\ZHKWDkf.exe
  C:\Windows\System\ZHKWDkf.exe
  2⤵
  PID:4660
- C:\Windows\System\XEvmHzZ.exe
  C:\Windows\System\XEvmHzZ.exe
  2⤵
  PID:4676
- C:\Windows\System\UJzZzeq.exe
  C:\Windows\System\UJzZzeq.exe
  2⤵
  PID:4696
- C:\Windows\System\TFpWCFw.exe
  C:\Windows\System\TFpWCFw.exe
  2⤵
  PID:4716
- C:\Windows\System\cHbDGYl.exe
  C:\Windows\System\cHbDGYl.exe
  2⤵
  PID:4736
- C:\Windows\System\cHesVoY.exe
  C:\Windows\System\cHesVoY.exe
  2⤵
  PID:4756
- C:\Windows\System\SKuHvnz.exe
  C:\Windows\System\SKuHvnz.exe
  2⤵
  PID:4776
- C:\Windows\System\tnXRpvw.exe
  C:\Windows\System\tnXRpvw.exe
  2⤵
  PID:4796
- C:\Windows\System\DrHSzoF.exe
  C:\Windows\System\DrHSzoF.exe
  2⤵
  PID:4820
- C:\Windows\System\mJOvxvh.exe
  C:\Windows\System\mJOvxvh.exe
  2⤵
  PID:4836
- C:\Windows\System\IOGzTqx.exe
  C:\Windows\System\IOGzTqx.exe
  2⤵
  PID:4856
- C:\Windows\System\bVGRvXb.exe
  C:\Windows\System\bVGRvXb.exe
  2⤵
  PID:4876
- C:\Windows\System\yGVjSVQ.exe
  C:\Windows\System\yGVjSVQ.exe
  2⤵
  PID:4900
- C:\Windows\System\XFLnbSn.exe
  C:\Windows\System\XFLnbSn.exe
  2⤵
  PID:4916
- C:\Windows\System\SfMfMTw.exe
  C:\Windows\System\SfMfMTw.exe
  2⤵
  PID:4940
- C:\Windows\System\wCjGCjd.exe
  C:\Windows\System\wCjGCjd.exe
  2⤵
  PID:4960
- C:\Windows\System\wOairPI.exe
  C:\Windows\System\wOairPI.exe
  2⤵
  PID:4980
- C:\Windows\System\TWNieMi.exe
  C:\Windows\System\TWNieMi.exe
  2⤵
  PID:5000
- C:\Windows\System\XbHHzjL.exe
  C:\Windows\System\XbHHzjL.exe
  2⤵
  PID:5020
- C:\Windows\System\OXmohRV.exe
  C:\Windows\System\OXmohRV.exe
  2⤵
  PID:5040
- C:\Windows\System\jkDXRhJ.exe
  C:\Windows\System\jkDXRhJ.exe
  2⤵
  PID:5060
- C:\Windows\System\LIysjqM.exe
  C:\Windows\System\LIysjqM.exe
  2⤵
  PID:5080
- C:\Windows\System\DWmuGxc.exe
  C:\Windows\System\DWmuGxc.exe
  2⤵
  PID:5100
- C:\Windows\System\seFbTWv.exe
  C:\Windows\System\seFbTWv.exe
  2⤵
  PID:3908
- C:\Windows\System\YJkBcgn.exe
  C:\Windows\System\YJkBcgn.exe
  2⤵
  PID:4032
- C:\Windows\System\ToYwSwg.exe
  C:\Windows\System\ToYwSwg.exe
  2⤵
  PID:3892
- C:\Windows\System\EUKlzwp.exe
  C:\Windows\System\EUKlzwp.exe
  2⤵
  PID:2860
- C:\Windows\System\BkpSHUE.exe
  C:\Windows\System\BkpSHUE.exe
  2⤵
  PID:3844
- C:\Windows\System\OYrGEUF.exe
  C:\Windows\System\OYrGEUF.exe
  2⤵
  PID:3020
- C:\Windows\System\fHdUayy.exe
  C:\Windows\System\fHdUayy.exe
  2⤵
  PID:3368
- C:\Windows\System\KHtIxVj.exe
  C:\Windows\System\KHtIxVj.exe
  2⤵
  PID:3088
- C:\Windows\System\KMrQpdV.exe
  C:\Windows\System\KMrQpdV.exe
  2⤵
  PID:3176
- C:\Windows\System\QnLUItw.exe
  C:\Windows\System\QnLUItw.exe
  2⤵
  PID:3504
- C:\Windows\System\JfBjmPB.exe
  C:\Windows\System\JfBjmPB.exe
  2⤵
  PID:3488
- C:\Windows\System\bNslDvy.exe
  C:\Windows\System\bNslDvy.exe
  2⤵
  PID:4120
- C:\Windows\System\FijFBmr.exe
  C:\Windows\System\FijFBmr.exe
  2⤵
  PID:3796
- C:\Windows\System\taQBBDm.exe
  C:\Windows\System\taQBBDm.exe
  2⤵
  PID:4108
- C:\Windows\System\jrjfNdI.exe
  C:\Windows\System\jrjfNdI.exe
  2⤵
  PID:4204
- C:\Windows\System\JwfbDFB.exe
  C:\Windows\System\JwfbDFB.exe
  2⤵
  PID:4248
- C:\Windows\System\MPfDANg.exe
  C:\Windows\System\MPfDANg.exe
  2⤵
  PID:4188
- C:\Windows\System\CCYuijl.exe
  C:\Windows\System\CCYuijl.exe
  2⤵
  PID:4268
- C:\Windows\System\KpfNJFf.exe
  C:\Windows\System\KpfNJFf.exe
  2⤵
  PID:4328
- C:\Windows\System\btwYsTP.exe
  C:\Windows\System\btwYsTP.exe
  2⤵
  PID:4368
- C:\Windows\System\SKnhSQu.exe
  C:\Windows\System\SKnhSQu.exe
  2⤵
  PID:4348
- C:\Windows\System\iDwqhHN.exe
  C:\Windows\System\iDwqhHN.exe
  2⤵
  PID:4392
- C:\Windows\System\uqQDzzs.exe
  C:\Windows\System\uqQDzzs.exe
  2⤵
  PID:4488
- C:\Windows\System\GMhdzmP.exe
  C:\Windows\System\GMhdzmP.exe
  2⤵
  PID:4536
- C:\Windows\System\IMoVmJr.exe
  C:\Windows\System\IMoVmJr.exe
  2⤵
  PID:4468
- C:\Windows\System\DopGmLc.exe
  C:\Windows\System\DopGmLc.exe
  2⤵
  PID:4508
- C:\Windows\System\HoNIuwd.exe
  C:\Windows\System\HoNIuwd.exe
  2⤵
  PID:4608
- C:\Windows\System\FwxPwKA.exe
  C:\Windows\System\FwxPwKA.exe
  2⤵
  PID:4644
- C:\Windows\System\RAEcfbo.exe
  C:\Windows\System\RAEcfbo.exe
  2⤵
  PID:4684
- C:\Windows\System\JglFuWv.exe
  C:\Windows\System\JglFuWv.exe
  2⤵
  PID:4632
- C:\Windows\System\WMHjYkl.exe
  C:\Windows\System\WMHjYkl.exe
  2⤵
  PID:4732
- C:\Windows\System\TyqEMdC.exe
  C:\Windows\System\TyqEMdC.exe
  2⤵
  PID:4708
- C:\Windows\System\UgmuYcF.exe
  C:\Windows\System\UgmuYcF.exe
  2⤵
  PID:4744
- C:\Windows\System\XJLNmxG.exe
  C:\Windows\System\XJLNmxG.exe
  2⤵
  PID:4852
- C:\Windows\System\BakKSJN.exe
  C:\Windows\System\BakKSJN.exe
  2⤵
  PID:4868
- C:\Windows\System\CGcrdgv.exe
  C:\Windows\System\CGcrdgv.exe
  2⤵
  PID:4864
- C:\Windows\System\RyKYRbq.exe
  C:\Windows\System\RyKYRbq.exe
  2⤵
  PID:4924
- C:\Windows\System\ueKMdUG.exe
  C:\Windows\System\ueKMdUG.exe
  2⤵
  PID:4948
- C:\Windows\System\VJsFUNt.exe
  C:\Windows\System\VJsFUNt.exe
  2⤵
  PID:3004
- C:\Windows\System\cIIctmk.exe
  C:\Windows\System\cIIctmk.exe
  2⤵
  PID:4992
- C:\Windows\System\MUyWByG.exe
  C:\Windows\System\MUyWByG.exe
  2⤵
  PID:5036
- C:\Windows\System\vgEnSKK.exe
  C:\Windows\System\vgEnSKK.exe
  2⤵
  PID:5088
- C:\Windows\System\fxYUfFI.exe
  C:\Windows\System\fxYUfFI.exe
  2⤵
  PID:4004
- C:\Windows\System\PDmsBoS.exe
  C:\Windows\System\PDmsBoS.exe
  2⤵
  PID:3984
- C:\Windows\System\kRXAltl.exe
  C:\Windows\System\kRXAltl.exe
  2⤵
  PID:5116
- C:\Windows\System\NkNbjHX.exe
  C:\Windows\System\NkNbjHX.exe
  2⤵
  PID:2928
- C:\Windows\System\FsxsyyS.exe
  C:\Windows\System\FsxsyyS.exe
  2⤵
  PID:3372
- C:\Windows\System\tJVGvLy.exe
  C:\Windows\System\tJVGvLy.exe
  2⤵
  PID:2536
- C:\Windows\System\ACFtTeC.exe
  C:\Windows\System\ACFtTeC.exe
  2⤵
  PID:3636
- C:\Windows\System\VPaAvmw.exe
  C:\Windows\System\VPaAvmw.exe
  2⤵
  PID:3648
- C:\Windows\System\jaLIpXE.exe
  C:\Windows\System\jaLIpXE.exe
  2⤵
  PID:4132
- C:\Windows\System\npkujOI.exe
  C:\Windows\System\npkujOI.exe
  2⤵
  PID:1300
- C:\Windows\System\VASoOIa.exe
  C:\Windows\System\VASoOIa.exe
  2⤵
  PID:2620
- C:\Windows\System\nPJghOQ.exe
  C:\Windows\System\nPJghOQ.exe
  2⤵
  PID:4296
- C:\Windows\System\kmHFXtq.exe
  C:\Windows\System\kmHFXtq.exe
  2⤵
  PID:4372
- C:\Windows\System\FxkNysQ.exe
  C:\Windows\System\FxkNysQ.exe
  2⤵
  PID:4416
- C:\Windows\System\bNoiubG.exe
  C:\Windows\System\bNoiubG.exe
  2⤵
  PID:4528
- C:\Windows\System\bNjSrKu.exe
  C:\Windows\System\bNjSrKu.exe
  2⤵
  PID:2540
- C:\Windows\System\oLIUAJA.exe
  C:\Windows\System\oLIUAJA.exe
  2⤵
  PID:4428
- C:\Windows\System\HaMjrcj.exe
  C:\Windows\System\HaMjrcj.exe
  2⤵
  PID:4552
- C:\Windows\System\YROxuOQ.exe
  C:\Windows\System\YROxuOQ.exe
  2⤵
  PID:4628
- C:\Windows\System\xMyrGns.exe
  C:\Windows\System\xMyrGns.exe
  2⤵
  PID:4764
- C:\Windows\System\szSWCBd.exe
  C:\Windows\System\szSWCBd.exe
  2⤵
  PID:2184
- C:\Windows\System\eGiaCAo.exe
  C:\Windows\System\eGiaCAo.exe
  2⤵
  PID:4844
- C:\Windows\System\rHwSIdu.exe
  C:\Windows\System\rHwSIdu.exe
  2⤵
  PID:4832
- C:\Windows\System\TEyWLIK.exe
  C:\Windows\System\TEyWLIK.exe
  2⤵
  PID:4788
- C:\Windows\System\TiMcpvP.exe
  C:\Windows\System\TiMcpvP.exe
  2⤵
  PID:4956
- C:\Windows\System\natcIty.exe
  C:\Windows\System\natcIty.exe
  2⤵
  PID:2724
- C:\Windows\System\sQWijUI.exe
  C:\Windows\System\sQWijUI.exe
  2⤵
  PID:5008
- C:\Windows\System\sRpIRgg.exe
  C:\Windows\System\sRpIRgg.exe
  2⤵
  PID:5048
- C:\Windows\System\lDblZXE.exe
  C:\Windows\System\lDblZXE.exe
  2⤵
  PID:3988
- C:\Windows\System\oxBiPtY.exe
  C:\Windows\System\oxBiPtY.exe
  2⤵
  PID:5112
- C:\Windows\System\Hdbqneq.exe
  C:\Windows\System\Hdbqneq.exe
  2⤵
  PID:544
- C:\Windows\System\mWPHMjG.exe
  C:\Windows\System\mWPHMjG.exe
  2⤵
  PID:1800
- C:\Windows\System\JKoNgBQ.exe
  C:\Windows\System\JKoNgBQ.exe
  2⤵
  PID:2872
- C:\Windows\System\ObnUutS.exe
  C:\Windows\System\ObnUutS.exe
  2⤵
  PID:3832
- C:\Windows\System\FgGGtZC.exe
  C:\Windows\System\FgGGtZC.exe
  2⤵
  PID:4172
- C:\Windows\System\oEOAAMF.exe
  C:\Windows\System\oEOAAMF.exe
  2⤵
  PID:4128
- C:\Windows\System\DWMxTXN.exe
  C:\Windows\System\DWMxTXN.exe
  2⤵
  PID:4232
- C:\Windows\System\yvGPpNp.exe
  C:\Windows\System\yvGPpNp.exe
  2⤵
  PID:4192
- C:\Windows\System\IExCfEy.exe
  C:\Windows\System\IExCfEy.exe
  2⤵
  PID:4324
- C:\Windows\System\hOOQtOx.exe
  C:\Windows\System\hOOQtOx.exe
  2⤵
  PID:2848
- C:\Windows\System\SjIZMTg.exe
  C:\Windows\System\SjIZMTg.exe
  2⤵
  PID:2852
- C:\Windows\System\IdORcFY.exe
  C:\Windows\System\IdORcFY.exe
  2⤵
  PID:4476
- C:\Windows\System\ahzJENB.exe
  C:\Windows\System\ahzJENB.exe
  2⤵
  PID:4472
- C:\Windows\System\gfbWpsx.exe
  C:\Windows\System\gfbWpsx.exe
  2⤵
  PID:2028
- C:\Windows\System\kLHhRkA.exe
  C:\Windows\System\kLHhRkA.exe
  2⤵
  PID:4688
- C:\Windows\System\QwTJmaG.exe
  C:\Windows\System\QwTJmaG.exe
  2⤵
  PID:576
- C:\Windows\System\lQOjhbK.exe
  C:\Windows\System\lQOjhbK.exe
  2⤵
  PID:4816
- C:\Windows\System\pRDsPxA.exe
  C:\Windows\System\pRDsPxA.exe
  2⤵
  PID:4768
- C:\Windows\System\MneqhlD.exe
  C:\Windows\System\MneqhlD.exe
  2⤵
  PID:1712
- C:\Windows\System\GuBCtLj.exe
  C:\Windows\System\GuBCtLj.exe
  2⤵
  PID:4896
- C:\Windows\System\ikBnUvy.exe
  C:\Windows\System\ikBnUvy.exe
  2⤵
  PID:5056
- C:\Windows\System\tVdDfeQ.exe
  C:\Windows\System\tVdDfeQ.exe
  2⤵
  PID:5016
- C:\Windows\System\LyJQrTw.exe
  C:\Windows\System\LyJQrTw.exe
  2⤵
  PID:5068
- C:\Windows\System\wudRvtD.exe
  C:\Windows\System\wudRvtD.exe
  2⤵
  PID:5076
- C:\Windows\System\rXskrPc.exe
  C:\Windows\System\rXskrPc.exe
  2⤵
  PID:1076
- C:\Windows\System\nkkLjKi.exe
  C:\Windows\System\nkkLjKi.exe
  2⤵
  PID:2772
- C:\Windows\System\btxwQCS.exe
  C:\Windows\System\btxwQCS.exe
  2⤵
  PID:1584
- C:\Windows\System\HVUgyoi.exe
  C:\Windows\System\HVUgyoi.exe
  2⤵
  PID:3232
- C:\Windows\System\ZKWJTYD.exe
  C:\Windows\System\ZKWJTYD.exe
  2⤵
  PID:4100
- C:\Windows\System\hGvGbkh.exe
  C:\Windows\System\hGvGbkh.exe
  2⤵
  PID:3452
- C:\Windows\System\IpSKors.exe
  C:\Windows\System\IpSKors.exe
  2⤵
  PID:4208
- C:\Windows\System\aFNAnFn.exe
  C:\Windows\System\aFNAnFn.exe
  2⤵
  PID:4308
- C:\Windows\System\DqXubwl.exe
  C:\Windows\System\DqXubwl.exe
  2⤵
  PID:1084
- C:\Windows\System\AOfJunP.exe
  C:\Windows\System\AOfJunP.exe
  2⤵
  PID:2320
- C:\Windows\System\LzWVOTq.exe
  C:\Windows\System\LzWVOTq.exe
  2⤵
  PID:4584
- C:\Windows\System\bkbGmmm.exe
  C:\Windows\System\bkbGmmm.exe
  2⤵
  PID:4588
- C:\Windows\System\AxVjqrz.exe
  C:\Windows\System\AxVjqrz.exe
  2⤵
  PID:2700
- C:\Windows\System\zyAziCn.exe
  C:\Windows\System\zyAziCn.exe
  2⤵
  PID:1756
- C:\Windows\System\NpTlNHC.exe
  C:\Windows\System\NpTlNHC.exe
  2⤵
  PID:1072
- C:\Windows\System\DPYaQxL.exe
  C:\Windows\System\DPYaQxL.exe
  2⤵
  PID:288
- C:\Windows\System\ACpAzYw.exe
  C:\Windows\System\ACpAzYw.exe
  2⤵
  PID:4968
- C:\Windows\System\xDznNDd.exe
  C:\Windows\System\xDznNDd.exe
  2⤵
  PID:2164
- C:\Windows\System\hYJNsSr.exe
  C:\Windows\System\hYJNsSr.exe
  2⤵
  PID:4908
- C:\Windows\System\ziXhmSH.exe
  C:\Windows\System\ziXhmSH.exe
  2⤵
  PID:5052
- C:\Windows\System\LXWluLz.exe
  C:\Windows\System\LXWluLz.exe
  2⤵
  PID:2688
- C:\Windows\System\luateDQ.exe
  C:\Windows\System\luateDQ.exe
  2⤵
  PID:5108
- C:\Windows\System\kjhwknz.exe
  C:\Windows\System\kjhwknz.exe
  2⤵
  PID:2776
- C:\Windows\System\LEnbpHe.exe
  C:\Windows\System\LEnbpHe.exe
  2⤵
  PID:2788
- C:\Windows\System\WGzaojf.exe
  C:\Windows\System\WGzaojf.exe
  2⤵
  PID:3576
- C:\Windows\System\hsDikLp.exe
  C:\Windows\System\hsDikLp.exe
  2⤵
  PID:4148
- C:\Windows\System\KSMmJqu.exe
  C:\Windows\System\KSMmJqu.exe
  2⤵
  PID:4224
- C:\Windows\System\gfAdVFN.exe
  C:\Windows\System\gfAdVFN.exe
  2⤵
  PID:2528
- C:\Windows\System\sTBafll.exe
  C:\Windows\System\sTBafll.exe
  2⤵
  PID:4596
- C:\Windows\System\vyWLWcH.exe
  C:\Windows\System\vyWLWcH.exe
  2⤵
  PID:1736
- C:\Windows\System\ofqddSb.exe
  C:\Windows\System\ofqddSb.exe
  2⤵
  PID:2120
- C:\Windows\System\kptITFX.exe
  C:\Windows\System\kptITFX.exe
  2⤵
  PID:2256
- C:\Windows\System\VSMQUZZ.exe
  C:\Windows\System\VSMQUZZ.exe
  2⤵
  PID:4492
- C:\Windows\System\pEiMmmC.exe
  C:\Windows\System\pEiMmmC.exe
  2⤵
  PID:1984
- C:\Windows\System\GqOGCjh.exe
  C:\Windows\System\GqOGCjh.exe
  2⤵
  PID:2172
- C:\Windows\System\DfivLfX.exe
  C:\Windows\System\DfivLfX.exe
  2⤵
  PID:4928
- C:\Windows\System\NszAHHC.exe
  C:\Windows\System\NszAHHC.exe
  2⤵
  PID:2188
- C:\Windows\System\vhAxHke.exe
  C:\Windows\System\vhAxHke.exe
  2⤵
  PID:2976
- C:\Windows\System\GrhErOA.exe
  C:\Windows\System\GrhErOA.exe
  2⤵
  PID:2492
- C:\Windows\System\NfANhiK.exe
  C:\Windows\System\NfANhiK.exe
  2⤵
  PID:5012
- C:\Windows\System\lrJbFCH.exe
  C:\Windows\System\lrJbFCH.exe
  2⤵
  PID:4252
- C:\Windows\System\iGTkMSu.exe
  C:\Windows\System\iGTkMSu.exe
  2⤵
  PID:4712
- C:\Windows\System\iUdxJfT.exe
  C:\Windows\System\iUdxJfT.exe
  2⤵
  PID:2300
- C:\Windows\System\TuCVQXq.exe
  C:\Windows\System\TuCVQXq.exe
  2⤵
  PID:756
- C:\Windows\System\EeyDRnL.exe
  C:\Windows\System\EeyDRnL.exe
  2⤵
  PID:5136
- C:\Windows\System\NrSVbRv.exe
  C:\Windows\System\NrSVbRv.exe
  2⤵
  PID:5152
- C:\Windows\System\mpzJKGr.exe
  C:\Windows\System\mpzJKGr.exe
  2⤵
  PID:5168
- C:\Windows\System\hGUIgcb.exe
  C:\Windows\System\hGUIgcb.exe
  2⤵
  PID:5184
- C:\Windows\System\ggQJsDA.exe
  C:\Windows\System\ggQJsDA.exe
  2⤵
  PID:5200
- C:\Windows\System\yWXMhUP.exe
  C:\Windows\System\yWXMhUP.exe
  2⤵
  PID:5216
- C:\Windows\System\qKTnmEw.exe
  C:\Windows\System\qKTnmEw.exe
  2⤵
  PID:5232
- C:\Windows\System\aweRWHk.exe
  C:\Windows\System\aweRWHk.exe
  2⤵
  PID:5252
- C:\Windows\System\cMfuKpD.exe
  C:\Windows\System\cMfuKpD.exe
  2⤵
  PID:5272
- C:\Windows\System\mJDePpU.exe
  C:\Windows\System\mJDePpU.exe
  2⤵
  PID:5292
- C:\Windows\System\FYCRsfF.exe
  C:\Windows\System\FYCRsfF.exe
  2⤵
  PID:5308
- C:\Windows\System\mFUuFwH.exe
  C:\Windows\System\mFUuFwH.exe
  2⤵
  PID:5340
- C:\Windows\System\neFgrxl.exe
  C:\Windows\System\neFgrxl.exe
  2⤵
  PID:5388
- C:\Windows\System\KPBDcaK.exe
  C:\Windows\System\KPBDcaK.exe
  2⤵
  PID:5408
- C:\Windows\System\OdiTPLU.exe
  C:\Windows\System\OdiTPLU.exe
  2⤵
  PID:5436
- C:\Windows\System\vKsEVRS.exe
  C:\Windows\System\vKsEVRS.exe
  2⤵
  PID:5452
- C:\Windows\System\eArOaBZ.exe
  C:\Windows\System\eArOaBZ.exe
  2⤵
  PID:5468
- C:\Windows\System\ycuAmVV.exe
  C:\Windows\System\ycuAmVV.exe
  2⤵
  PID:5484
- C:\Windows\System\HTTWeDR.exe
  C:\Windows\System\HTTWeDR.exe
  2⤵
  PID:5500
- C:\Windows\System\vlVcTIa.exe
  C:\Windows\System\vlVcTIa.exe
  2⤵
  PID:5516
- C:\Windows\System\qRDlgDP.exe
  C:\Windows\System\qRDlgDP.exe
  2⤵
  PID:5532
- C:\Windows\System\yvYmoFD.exe
  C:\Windows\System\yvYmoFD.exe
  2⤵
  PID:5552
- C:\Windows\System\JyHQhwG.exe
  C:\Windows\System\JyHQhwG.exe
  2⤵
  PID:5568
- C:\Windows\System\ifpAIAB.exe
  C:\Windows\System\ifpAIAB.exe
  2⤵
  PID:5588
- C:\Windows\System\vLznmcu.exe
  C:\Windows\System\vLznmcu.exe
  2⤵
  PID:5604
- C:\Windows\System\AtZrXEP.exe
  C:\Windows\System\AtZrXEP.exe
  2⤵
  PID:5628
- C:\Windows\System\btUpSLh.exe
  C:\Windows\System\btUpSLh.exe
  2⤵
  PID:5648
- C:\Windows\System\atWldxU.exe
  C:\Windows\System\atWldxU.exe
  2⤵
  PID:5668
- C:\Windows\System\vJClkjM.exe
  C:\Windows\System\vJClkjM.exe
  2⤵
  PID:5732
- C:\Windows\System\YPsoeNS.exe
  C:\Windows\System\YPsoeNS.exe
  2⤵
  PID:5748
- C:\Windows\System\YoSVUBd.exe
  C:\Windows\System\YoSVUBd.exe
  2⤵
  PID:5768
- C:\Windows\System\oKJrtcu.exe
  C:\Windows\System\oKJrtcu.exe
  2⤵
  PID:5792
- C:\Windows\System\TxqfLoL.exe
  C:\Windows\System\TxqfLoL.exe
  2⤵
  PID:5808
- C:\Windows\System\ibAiXVM.exe
  C:\Windows\System\ibAiXVM.exe
  2⤵
  PID:5824
- C:\Windows\System\PKhDzSn.exe
  C:\Windows\System\PKhDzSn.exe
  2⤵
  PID:5840
- C:\Windows\System\gSWwOJV.exe
  C:\Windows\System\gSWwOJV.exe
  2⤵
  PID:5856
- C:\Windows\System\ohbKqbG.exe
  C:\Windows\System\ohbKqbG.exe
  2⤵
  PID:5876
- C:\Windows\System\QYNnbpQ.exe
  C:\Windows\System\QYNnbpQ.exe
  2⤵
  PID:5892
- C:\Windows\System\HRBaBWB.exe
  C:\Windows\System\HRBaBWB.exe
  2⤵
  PID:5908
- C:\Windows\System\vVcbouZ.exe
  C:\Windows\System\vVcbouZ.exe
  2⤵
  PID:5924
- C:\Windows\System\nftWrIx.exe
  C:\Windows\System\nftWrIx.exe
  2⤵
  PID:5940
- C:\Windows\System\TzJUSYT.exe
  C:\Windows\System\TzJUSYT.exe
  2⤵
  PID:5964
- C:\Windows\System\igQwVbl.exe
  C:\Windows\System\igQwVbl.exe
  2⤵
  PID:5984
- C:\Windows\System\Aayzxoh.exe
  C:\Windows\System\Aayzxoh.exe
  2⤵
  PID:6004
- C:\Windows\System\alLlFUf.exe
  C:\Windows\System\alLlFUf.exe
  2⤵
  PID:6024
- C:\Windows\System\RUPwuKK.exe
  C:\Windows\System\RUPwuKK.exe
  2⤵
  PID:6100
- C:\Windows\System\IfjWYUj.exe
  C:\Windows\System\IfjWYUj.exe
  2⤵
  PID:6116
- C:\Windows\System\KuJLOmU.exe
  C:\Windows\System\KuJLOmU.exe
  2⤵
  PID:6132
- C:\Windows\System\LhsAJCn.exe
  C:\Windows\System\LhsAJCn.exe
  2⤵
  PID:4652
- C:\Windows\System\lmIqUxN.exe
  C:\Windows\System\lmIqUxN.exe
  2⤵
  PID:5176
- C:\Windows\System\LuSGqFG.exe
  C:\Windows\System\LuSGqFG.exe
  2⤵
  PID:5240
- C:\Windows\System\kNETVtL.exe
  C:\Windows\System\kNETVtL.exe
  2⤵
  PID:5288
- C:\Windows\System\FDaJvNU.exe
  C:\Windows\System\FDaJvNU.exe
  2⤵
  PID:1760
- C:\Windows\System\OjPweeA.exe
  C:\Windows\System\OjPweeA.exe
  2⤵
  PID:5072
- C:\Windows\System\vYRQOuw.exe
  C:\Windows\System\vYRQOuw.exe
  2⤵
  PID:5396
- C:\Windows\System\UiBANVL.exe
  C:\Windows\System\UiBANVL.exe
  2⤵
  PID:5260
- C:\Windows\System\MtnDITC.exe
  C:\Windows\System\MtnDITC.exe
  2⤵
  PID:548
- C:\Windows\System\DiqWtUA.exe
  C:\Windows\System\DiqWtUA.exe
  2⤵
  PID:5540
- C:\Windows\System\OfajPHy.exe
  C:\Windows\System\OfajPHy.exe
  2⤵
  PID:5580
- C:\Windows\System\gCbZEeS.exe
  C:\Windows\System\gCbZEeS.exe
  2⤵
  PID:5620
- C:\Windows\System\fExkkqX.exe
  C:\Windows\System\fExkkqX.exe
  2⤵
  PID:5304
- C:\Windows\System\pWvSJYH.exe
  C:\Windows\System\pWvSJYH.exe
  2⤵
  PID:5360
- C:\Windows\System\bvcIgqh.exe
  C:\Windows\System\bvcIgqh.exe
  2⤵
  PID:5380
- C:\Windows\System\DQMWVKZ.exe
  C:\Windows\System\DQMWVKZ.exe
  2⤵
  PID:5428
- C:\Windows\System\eEtazeO.exe
  C:\Windows\System\eEtazeO.exe
  2⤵
  PID:2564
- C:\Windows\System\uNXGsnB.exe
  C:\Windows\System\uNXGsnB.exe
  2⤵
  PID:5560
- C:\Windows\System\rArWlIY.exe
  C:\Windows\System\rArWlIY.exe
  2⤵
  PID:5640
- C:\Windows\System\TUaCUly.exe
  C:\Windows\System\TUaCUly.exe
  2⤵
  PID:5700
- C:\Windows\System\YFkHxlh.exe
  C:\Windows\System\YFkHxlh.exe
  2⤵
  PID:5708
- C:\Windows\System\mPMwpfu.exe
  C:\Windows\System\mPMwpfu.exe
  2⤵
  PID:5724
- C:\Windows\System\yEYxqyB.exe
  C:\Windows\System\yEYxqyB.exe
  2⤵
  PID:5744
- C:\Windows\System\RIsRrVg.exe
  C:\Windows\System\RIsRrVg.exe
  2⤵
  PID:5784
- C:\Windows\System\mQKwZkS.exe
  C:\Windows\System\mQKwZkS.exe
  2⤵
  PID:5832
- C:\Windows\System\QtZatOX.exe
  C:\Windows\System\QtZatOX.exe
  2⤵
  PID:5888
- C:\Windows\System\YBwhDXs.exe
  C:\Windows\System\YBwhDXs.exe
  2⤵
  PID:5952
- C:\Windows\System\CNBQFod.exe
  C:\Windows\System\CNBQFod.exe
  2⤵
  PID:5996
- C:\Windows\System\ZfWgbcH.exe
  C:\Windows\System\ZfWgbcH.exe
  2⤵
  PID:5872
- C:\Windows\System\SYrrmQK.exe
  C:\Windows\System\SYrrmQK.exe
  2⤵
  PID:5936
- C:\Windows\System\cKDDUMR.exe
  C:\Windows\System\cKDDUMR.exe
  2⤵
  PID:6016
- C:\Windows\System\lJDmwig.exe
  C:\Windows\System\lJDmwig.exe
  2⤵
  PID:6064
- C:\Windows\System\AsHnsWy.exe
  C:\Windows\System\AsHnsWy.exe
  2⤵
  PID:6084
- C:\Windows\System\HRhgMkB.exe
  C:\Windows\System\HRhgMkB.exe
  2⤵
  PID:6128
- C:\Windows\System\FcglvRv.exe
  C:\Windows\System\FcglvRv.exe
  2⤵
  PID:5284
- C:\Windows\System\MdAvGkP.exe
  C:\Windows\System\MdAvGkP.exe
  2⤵
  PID:5228
- C:\Windows\System\CGIGUaN.exe
  C:\Windows\System\CGIGUaN.exe
  2⤵
  PID:5320
- C:\Windows\System\ATZeLml.exe
  C:\Windows\System\ATZeLml.exe
  2⤵
  PID:5192
- C:\Windows\System\UJfHEOy.exe
  C:\Windows\System\UJfHEOy.exe
  2⤵
  PID:5132
- C:\Windows\System\pbEbKkX.exe
  C:\Windows\System\pbEbKkX.exe
  2⤵
  PID:5352
- C:\Windows\System\szTDttP.exe
  C:\Windows\System\szTDttP.exe
  2⤵
  PID:5660
- C:\Windows\System\MOeqKwZ.exe
  C:\Windows\System\MOeqKwZ.exe
  2⤵
  PID:5372
- C:\Windows\System\MJllXaU.exe
  C:\Windows\System\MJllXaU.exe
  2⤵
  PID:5528
- C:\Windows\System\UGzPtcL.exe
  C:\Windows\System\UGzPtcL.exe
  2⤵
  PID:5688
- C:\Windows\System\gnOvDBC.exe
  C:\Windows\System\gnOvDBC.exe
  2⤵
  PID:5664
- C:\Windows\System\GtmZsuu.exe
  C:\Windows\System\GtmZsuu.exe
  2⤵
  PID:5764
- C:\Windows\System\aGrscIb.exe
  C:\Windows\System\aGrscIb.exe
  2⤵
  PID:5884
- C:\Windows\System\xnxLbnp.exe
  C:\Windows\System\xnxLbnp.exe
  2⤵
  PID:6060
- C:\Windows\System\gVeUULg.exe
  C:\Windows\System\gVeUULg.exe
  2⤵
  PID:4784
- C:\Windows\System\VmOAIpY.exe
  C:\Windows\System\VmOAIpY.exe
  2⤵
  PID:5524
- C:\Windows\System\gMymTmC.exe
  C:\Windows\System\gMymTmC.exe
  2⤵
  PID:5836
- C:\Windows\System\HpUHAjV.exe
  C:\Windows\System\HpUHAjV.exe
  2⤵
  PID:5900
- C:\Windows\System\ZlXzkaf.exe
  C:\Windows\System\ZlXzkaf.exe
  2⤵
  PID:5160
- C:\Windows\System\VAWstGQ.exe
  C:\Windows\System\VAWstGQ.exe
  2⤵
  PID:2348
- C:\Windows\System\WviNdWn.exe
  C:\Windows\System\WviNdWn.exe
  2⤵
  PID:5212
- C:\Windows\System\IPzDQKz.exe
  C:\Windows\System\IPzDQKz.exe
  2⤵
  PID:5820
- C:\Windows\System\RSUFJrF.exe
  C:\Windows\System\RSUFJrF.exe
  2⤵
  PID:5348
- C:\Windows\System\qjOHQBe.exe
  C:\Windows\System\qjOHQBe.exe
  2⤵
  PID:5416
- C:\Windows\System\rRKdzZh.exe
  C:\Windows\System\rRKdzZh.exe
  2⤵
  PID:5420
- C:\Windows\System\bJtXCrW.exe
  C:\Windows\System\bJtXCrW.exe
  2⤵
  PID:5716
- C:\Windows\System\jqtrBkv.exe
  C:\Windows\System\jqtrBkv.exe
  2⤵
  PID:5932
- C:\Windows\System\IESiUvx.exe
  C:\Windows\System\IESiUvx.exe
  2⤵
  PID:6096
- C:\Windows\System\XmriWJj.exe
  C:\Windows\System\XmriWJj.exe
  2⤵
  PID:5432
- C:\Windows\System\RvfcyYu.exe
  C:\Windows\System\RvfcyYu.exe
  2⤵
  PID:5508
- C:\Windows\System\xQnsgVj.exe
  C:\Windows\System\xQnsgVj.exe
  2⤵
  PID:5816
- C:\Windows\System\FhAnBXb.exe
  C:\Windows\System\FhAnBXb.exe
  2⤵
  PID:5980
- C:\Windows\System\opZbifM.exe
  C:\Windows\System\opZbifM.exe
  2⤵
  PID:5148
- C:\Windows\System\rhbbbOw.exe
  C:\Windows\System\rhbbbOw.exe
  2⤵
  PID:5596
- C:\Windows\System\JGShwIm.exe
  C:\Windows\System\JGShwIm.exe
  2⤵
  PID:5576
- C:\Windows\System\pfzELAP.exe
  C:\Windows\System\pfzELAP.exe
  2⤵
  PID:5904
- C:\Windows\System\YkuNZeq.exe
  C:\Windows\System\YkuNZeq.exe
  2⤵
  PID:5300
- C:\Windows\System\xTEFqYv.exe
  C:\Windows\System\xTEFqYv.exe
  2⤵
  PID:5464
- C:\Windows\System\PVDjhSz.exe
  C:\Windows\System\PVDjhSz.exe
  2⤵
  PID:5920
- C:\Windows\System\PSFdRIa.exe
  C:\Windows\System\PSFdRIa.exe
  2⤵
  PID:6140
- C:\Windows\System\lTDjzzZ.exe
  C:\Windows\System\lTDjzzZ.exe
  2⤵
  PID:5376
- C:\Windows\System\OMyaYPL.exe
  C:\Windows\System\OMyaYPL.exe
  2⤵
  PID:5424
- C:\Windows\System\arGUfHP.exe
  C:\Windows\System\arGUfHP.exe
  2⤵
  PID:6160
- C:\Windows\System\PlGhrYi.exe
  C:\Windows\System\PlGhrYi.exe
  2⤵
  PID:6180
- C:\Windows\System\tlgHdYy.exe
  C:\Windows\System\tlgHdYy.exe
  2⤵
  PID:6196
- C:\Windows\System\lYqygQw.exe
  C:\Windows\System\lYqygQw.exe
  2⤵
  PID:6212
- C:\Windows\System\PeXaoki.exe
  C:\Windows\System\PeXaoki.exe
  2⤵
  PID:6228
- C:\Windows\System\bxiJLUL.exe
  C:\Windows\System\bxiJLUL.exe
  2⤵
  PID:6244
- C:\Windows\System\jouYpYB.exe
  C:\Windows\System\jouYpYB.exe
  2⤵
  PID:6260
- C:\Windows\System\MjcuVVv.exe
  C:\Windows\System\MjcuVVv.exe
  2⤵
  PID:6280
- C:\Windows\System\SpeAEoq.exe
  C:\Windows\System\SpeAEoq.exe
  2⤵
  PID:6304
- C:\Windows\System\FbNOaZP.exe
  C:\Windows\System\FbNOaZP.exe
  2⤵
  PID:6320
- C:\Windows\System\EImVSIl.exe
  C:\Windows\System\EImVSIl.exe
  2⤵
  PID:6340
- C:\Windows\System\Uyzbufg.exe
  C:\Windows\System\Uyzbufg.exe
  2⤵
  PID:6360
- C:\Windows\System\mboYhoH.exe
  C:\Windows\System\mboYhoH.exe
  2⤵
  PID:6380
- C:\Windows\System\MfsgsDC.exe
  C:\Windows\System\MfsgsDC.exe
  2⤵
  PID:6408
- C:\Windows\System\yOSbgeZ.exe
  C:\Windows\System\yOSbgeZ.exe
  2⤵
  PID:6460
- C:\Windows\System\cmdcKWJ.exe
  C:\Windows\System\cmdcKWJ.exe
  2⤵
  PID:6476
- C:\Windows\System\cRdsGCV.exe
  C:\Windows\System\cRdsGCV.exe
  2⤵
  PID:6492
- C:\Windows\System\EaQpVgH.exe
  C:\Windows\System\EaQpVgH.exe
  2⤵
  PID:6508
- C:\Windows\System\vYizHqu.exe
  C:\Windows\System\vYizHqu.exe
  2⤵
  PID:6528
- C:\Windows\System\gNVihLu.exe
  C:\Windows\System\gNVihLu.exe
  2⤵
  PID:6544
- C:\Windows\System\aoMaUkt.exe
  C:\Windows\System\aoMaUkt.exe
  2⤵
  PID:6564
- C:\Windows\System\wNBUswJ.exe
  C:\Windows\System\wNBUswJ.exe
  2⤵
  PID:6580
- C:\Windows\System\pytVsiL.exe
  C:\Windows\System\pytVsiL.exe
  2⤵
  PID:6596
- C:\Windows\System\whWIPLK.exe
  C:\Windows\System\whWIPLK.exe
  2⤵
  PID:6612
- C:\Windows\System\GYvGvST.exe
  C:\Windows\System\GYvGvST.exe
  2⤵
  PID:6628
- C:\Windows\System\oqIvuhe.exe
  C:\Windows\System\oqIvuhe.exe
  2⤵
  PID:6648
- C:\Windows\System\feBqmgK.exe
  C:\Windows\System\feBqmgK.exe
  2⤵
  PID:6668
- C:\Windows\System\whJZaMI.exe
  C:\Windows\System\whJZaMI.exe
  2⤵
  PID:6688
- C:\Windows\System\IgLnBVp.exe
  C:\Windows\System\IgLnBVp.exe
  2⤵
  PID:6708
- C:\Windows\System\ppvhXEf.exe
  C:\Windows\System\ppvhXEf.exe
  2⤵
  PID:6736
- C:\Windows\System\IZyqaes.exe
  C:\Windows\System\IZyqaes.exe
  2⤵
  PID:6764
- C:\Windows\System\iiLHFYb.exe
  C:\Windows\System\iiLHFYb.exe
  2⤵
  PID:6780
- C:\Windows\System\FHUlMEj.exe
  C:\Windows\System\FHUlMEj.exe
  2⤵
  PID:6800
- C:\Windows\System\PvHCSVP.exe
  C:\Windows\System\PvHCSVP.exe
  2⤵
  PID:6816
- C:\Windows\System\QvOejfw.exe
  C:\Windows\System\QvOejfw.exe
  2⤵
  PID:6836
- C:\Windows\System\HObeYlE.exe
  C:\Windows\System\HObeYlE.exe
  2⤵
  PID:6852
- C:\Windows\System\fubLnHX.exe
  C:\Windows\System\fubLnHX.exe
  2⤵
  PID:6868
- C:\Windows\System\pyyNDxM.exe
  C:\Windows\System\pyyNDxM.exe
  2⤵
  PID:6888
- C:\Windows\System\LtrHzlG.exe
  C:\Windows\System\LtrHzlG.exe
  2⤵
  PID:6904
- C:\Windows\System\tQyrafv.exe
  C:\Windows\System\tQyrafv.exe
  2⤵
  PID:6920
- C:\Windows\System\yUIckkk.exe
  C:\Windows\System\yUIckkk.exe
  2⤵
  PID:6940
- C:\Windows\System\RlfDYph.exe
  C:\Windows\System\RlfDYph.exe
  2⤵
  PID:6956
- C:\Windows\System\CMpvMlJ.exe
  C:\Windows\System\CMpvMlJ.exe
  2⤵
  PID:6976
- C:\Windows\System\aOfTGvw.exe
  C:\Windows\System\aOfTGvw.exe
  2⤵
  PID:6992
- C:\Windows\System\veHtnhv.exe
  C:\Windows\System\veHtnhv.exe
  2⤵
  PID:7008
- C:\Windows\System\KsAhdPo.exe
  C:\Windows\System\KsAhdPo.exe
  2⤵
  PID:7028
- C:\Windows\System\GOcfNZn.exe
  C:\Windows\System\GOcfNZn.exe
  2⤵
  PID:7048
- C:\Windows\System\hMbFzod.exe
  C:\Windows\System\hMbFzod.exe
  2⤵
  PID:7084
- C:\Windows\System\UShwDdv.exe
  C:\Windows\System\UShwDdv.exe
  2⤵
  PID:7100
- C:\Windows\System\GMpmHDp.exe
  C:\Windows\System\GMpmHDp.exe
  2⤵
  PID:7116
- C:\Windows\System\GHkFzDI.exe
  C:\Windows\System\GHkFzDI.exe
  2⤵
  PID:7132
- C:\Windows\System\kLfsUdA.exe
  C:\Windows\System\kLfsUdA.exe
  2⤵
  PID:1820
- C:\Windows\System\eOJFTmc.exe
  C:\Windows\System\eOJFTmc.exe
  2⤵
  PID:6268
- C:\Windows\System\htdsEgx.exe
  C:\Windows\System\htdsEgx.exe
  2⤵
  PID:6348
- C:\Windows\System\cZEmUKb.exe
  C:\Windows\System\cZEmUKb.exe
  2⤵
  PID:6392
- C:\Windows\System\MhegCCP.exe
  C:\Windows\System\MhegCCP.exe
  2⤵
  PID:6188
- C:\Windows\System\CvzIoAs.exe
  C:\Windows\System\CvzIoAs.exe
  2⤵
  PID:6292
- C:\Windows\System\iCiCcNd.exe
  C:\Windows\System\iCiCcNd.exe
  2⤵
  PID:6336
- C:\Windows\System\WLVJaKD.exe
  C:\Windows\System\WLVJaKD.exe
  2⤵
  PID:6148
- C:\Windows\System\HiCRhia.exe
  C:\Windows\System\HiCRhia.exe
  2⤵
  PID:5692
- C:\Windows\System\QeOckTy.exe
  C:\Windows\System\QeOckTy.exe
  2⤵
  PID:6468
- C:\Windows\System\ccagohb.exe
  C:\Windows\System\ccagohb.exe
  2⤵
  PID:6536
- C:\Windows\System\eLoxYwy.exe
  C:\Windows\System\eLoxYwy.exe
  2⤵
  PID:6604
- C:\Windows\System\TDUgALG.exe
  C:\Windows\System\TDUgALG.exe
  2⤵
  PID:6680
- C:\Windows\System\CLhzYka.exe
  C:\Windows\System\CLhzYka.exe
  2⤵
  PID:6724
- C:\Windows\System\nhgVxuq.exe
  C:\Windows\System\nhgVxuq.exe
  2⤵
  PID:6808
- C:\Windows\System\gJiJpPc.exe
  C:\Windows\System\gJiJpPc.exe
  2⤵
  PID:6880
- C:\Windows\System\HSzMCzX.exe
  C:\Windows\System\HSzMCzX.exe
  2⤵
  PID:6952
- C:\Windows\System\aJRPTIw.exe
  C:\Windows\System\aJRPTIw.exe
  2⤵
  PID:7020
- C:\Windows\System\NfSAKaV.exe
  C:\Windows\System\NfSAKaV.exe
  2⤵
  PID:6448
- C:\Windows\System\yfdDGSF.exe
  C:\Windows\System\yfdDGSF.exe
  2⤵
  PID:6620
- C:\Windows\System\nOFSKOi.exe
  C:\Windows\System\nOFSKOi.exe
  2⤵
  PID:6664
- C:\Windows\System\sneQZfL.exe
  C:\Windows\System\sneQZfL.exe
  2⤵
  PID:7140
- C:\Windows\System\SEaFURW.exe
  C:\Windows\System\SEaFURW.exe
  2⤵
  PID:6748
- C:\Windows\System\hdWxHOQ.exe
  C:\Windows\System\hdWxHOQ.exe
  2⤵
  PID:6420
- C:\Windows\System\QTscgWQ.exe
  C:\Windows\System\QTscgWQ.exe
  2⤵
  PID:6760
- C:\Windows\System\UnfoZSt.exe
  C:\Windows\System\UnfoZSt.exe
  2⤵
  PID:6796
- C:\Windows\System\cIlBfRY.exe
  C:\Windows\System\cIlBfRY.exe
  2⤵
  PID:6860
- C:\Windows\System\bYLeIbb.exe
  C:\Windows\System\bYLeIbb.exe
  2⤵
  PID:6900
- C:\Windows\System\qbREDGX.exe
  C:\Windows\System\qbREDGX.exe
  2⤵
  PID:2020
- C:\Windows\System\EZlqwdK.exe
  C:\Windows\System\EZlqwdK.exe
  2⤵
  PID:5128
- C:\Windows\System\lMdjkXm.exe
  C:\Windows\System\lMdjkXm.exe
  2⤵
  PID:5548
- C:\Windows\System\TICNhcq.exe
  C:\Windows\System\TICNhcq.exe
  2⤵
  PID:7044
- C:\Windows\System\rcMaoZv.exe
  C:\Windows\System\rcMaoZv.exe
  2⤵
  PID:7128
- C:\Windows\System\BNAZnMV.exe
  C:\Windows\System\BNAZnMV.exe
  2⤵
  PID:6204
- C:\Windows\System\rWfiHcQ.exe
  C:\Windows\System\rWfiHcQ.exe
  2⤵
  PID:6968
- C:\Windows\System\JXeaVQF.exe
  C:\Windows\System\JXeaVQF.exe
  2⤵
  PID:6240
- C:\Windows\System\PFNWUwZ.exe
  C:\Windows\System\PFNWUwZ.exe
  2⤵
  PID:6256
- C:\Windows\System\LwjUYyZ.exe
  C:\Windows\System\LwjUYyZ.exe
  2⤵
  PID:6332
- C:\Windows\System\HakJuXw.exe
  C:\Windows\System\HakJuXw.exe
  2⤵
  PID:6356
- C:\Windows\System\nZUUKaB.exe
  C:\Windows\System\nZUUKaB.exe
  2⤵
  PID:6376
- C:\Windows\System\IVLDxhZ.exe
  C:\Windows\System\IVLDxhZ.exe
  2⤵
  PID:6572
- C:\Windows\System\aMqVdbI.exe
  C:\Windows\System\aMqVdbI.exe
  2⤵
  PID:6516
- C:\Windows\System\iefwHhg.exe
  C:\Windows\System\iefwHhg.exe
  2⤵
  PID:7060
- C:\Windows\System\CJekVBt.exe
  C:\Windows\System\CJekVBt.exe
  2⤵
  PID:6844
- C:\Windows\System\FnXYZnR.exe
  C:\Windows\System\FnXYZnR.exe
  2⤵
  PID:6560
- C:\Windows\System\zFspkaR.exe
  C:\Windows\System\zFspkaR.exe
  2⤵
  PID:6660
- C:\Windows\System\vNjFEyD.exe
  C:\Windows\System\vNjFEyD.exe
  2⤵
  PID:6744
- C:\Windows\System\XCrjVBZ.exe
  C:\Windows\System\XCrjVBZ.exe
  2⤵
  PID:6700
- C:\Windows\System\WjqgHoe.exe
  C:\Windows\System\WjqgHoe.exe
  2⤵
  PID:7152
- C:\Windows\System\yOPKyGA.exe
  C:\Windows\System\yOPKyGA.exe
  2⤵
  PID:6828
- C:\Windows\System\tKrlkwP.exe
  C:\Windows\System\tKrlkwP.exe
  2⤵
  PID:7160
- C:\Windows\System\BDAUcaE.exe
  C:\Windows\System\BDAUcaE.exe
  2⤵
  PID:7096
- C:\Windows\System\NrvUWZe.exe
  C:\Windows\System\NrvUWZe.exe
  2⤵
  PID:6156
- C:\Windows\System\BBWDfvQ.exe
  C:\Windows\System\BBWDfvQ.exe
  2⤵
  PID:6644
- C:\Windows\System\whjKMyx.exe
  C:\Windows\System\whjKMyx.exe
  2⤵
  PID:6776
- C:\Windows\System\CnegxKC.exe
  C:\Windows\System\CnegxKC.exe
  2⤵
  PID:6964
- C:\Windows\System\ckxeYDy.exe
  C:\Windows\System\ckxeYDy.exe
  2⤵
  PID:6328
- C:\Windows\System\TCdudMq.exe
  C:\Windows\System\TCdudMq.exe
  2⤵
  PID:6876
- C:\Windows\System\aIUiFYi.exe
  C:\Windows\System\aIUiFYi.exe
  2⤵
  PID:7148
- C:\Windows\System\gzNrRvi.exe
  C:\Windows\System\gzNrRvi.exe
  2⤵
  PID:6456
- C:\Windows\System\OLBkoIx.exe
  C:\Windows\System\OLBkoIx.exe
  2⤵
  PID:6732
- C:\Windows\System\SvqUgeG.exe
  C:\Windows\System\SvqUgeG.exe
  2⤵
  PID:6176
- C:\Windows\System\aoTjLEL.exe
  C:\Windows\System\aoTjLEL.exe
  2⤵
  PID:5612
- C:\Windows\System\yTbbSxU.exe
  C:\Windows\System\yTbbSxU.exe
  2⤵
  PID:5852
- C:\Windows\System\XEtjpzN.exe
  C:\Windows\System\XEtjpzN.exe
  2⤵
  PID:7004
- C:\Windows\System\NtnGDCT.exe
  C:\Windows\System\NtnGDCT.exe
  2⤵
  PID:6108
- C:\Windows\System\ycQFbGW.exe
  C:\Windows\System\ycQFbGW.exe
  2⤵
  PID:6916
- C:\Windows\System\HQrqmcb.exe
  C:\Windows\System\HQrqmcb.exe
  2⤵
  PID:7036
- C:\Windows\System\BJgzeok.exe
  C:\Windows\System\BJgzeok.exe
  2⤵
  PID:6640
- C:\Windows\System\XPHGWEp.exe
  C:\Windows\System\XPHGWEp.exe
  2⤵
  PID:7112
- C:\Windows\System\imxxqPf.exe
  C:\Windows\System\imxxqPf.exe
  2⤵
  PID:6416
- C:\Windows\System\cPltCaN.exe
  C:\Windows\System\cPltCaN.exe
  2⤵
  PID:6552
- C:\Windows\System\tHlTrEZ.exe
  C:\Windows\System\tHlTrEZ.exe
  2⤵
  PID:6936
- C:\Windows\System\bzRuqiX.exe
  C:\Windows\System\bzRuqiX.exe
  2⤵
  PID:6792
- C:\Windows\System\dkkxxpQ.exe
  C:\Windows\System\dkkxxpQ.exe
  2⤵
  PID:6316
- C:\Windows\System\FgMUdcZ.exe
  C:\Windows\System\FgMUdcZ.exe
  2⤵
  PID:7080
- C:\Windows\System\yWBXNxL.exe
  C:\Windows\System\yWBXNxL.exe
  2⤵
  PID:6636
- C:\Windows\System\SilhLUW.exe
  C:\Windows\System\SilhLUW.exe
  2⤵
  PID:7000
- C:\Windows\System\yVvCoCR.exe
  C:\Windows\System\yVvCoCR.exe
  2⤵
  PID:6932
- C:\Windows\System\bzVGwWB.exe
  C:\Windows\System\bzVGwWB.exe
  2⤵
  PID:7016
- C:\Windows\System\SyxmrRp.exe
  C:\Windows\System\SyxmrRp.exe
  2⤵
  PID:7176
- C:\Windows\System\zHvFSSA.exe
  C:\Windows\System\zHvFSSA.exe
  2⤵
  PID:7196
- C:\Windows\System\ArVSfsq.exe
  C:\Windows\System\ArVSfsq.exe
  2⤵
  PID:7212
- C:\Windows\System\zXcXbSW.exe
  C:\Windows\System\zXcXbSW.exe
  2⤵
  PID:7232
- C:\Windows\System\IByQvdG.exe
  C:\Windows\System\IByQvdG.exe
  2⤵
  PID:7252
- C:\Windows\System\SvwrBmr.exe
  C:\Windows\System\SvwrBmr.exe
  2⤵
  PID:7272
- C:\Windows\System\WRiFSTe.exe
  C:\Windows\System\WRiFSTe.exe
  2⤵
  PID:7288
- C:\Windows\System\gNMkwML.exe
  C:\Windows\System\gNMkwML.exe
  2⤵
  PID:7312
- C:\Windows\System\tFvdBAu.exe
  C:\Windows\System\tFvdBAu.exe
  2⤵
  PID:7348
- C:\Windows\System\uTVeCzV.exe
  C:\Windows\System\uTVeCzV.exe
  2⤵
  PID:7364
- C:\Windows\System\UzMmEaO.exe
  C:\Windows\System\UzMmEaO.exe
  2⤵
  PID:7380
- C:\Windows\System\GlRCuTv.exe
  C:\Windows\System\GlRCuTv.exe
  2⤵
  PID:7400
- C:\Windows\System\xsRqaZO.exe
  C:\Windows\System\xsRqaZO.exe
  2⤵
  PID:7416
- C:\Windows\System\goHUYkD.exe
  C:\Windows\System\goHUYkD.exe
  2⤵
  PID:7436
- C:\Windows\System\VyBzwrL.exe
  C:\Windows\System\VyBzwrL.exe
  2⤵
  PID:7452
- C:\Windows\System\PnYfyKS.exe
  C:\Windows\System\PnYfyKS.exe
  2⤵
  PID:7468
- C:\Windows\System\zUUlWTh.exe
  C:\Windows\System\zUUlWTh.exe
  2⤵
  PID:7484
- C:\Windows\System\fhAtkjj.exe
  C:\Windows\System\fhAtkjj.exe
  2⤵
  PID:7500
- C:\Windows\System\imDoQIb.exe
  C:\Windows\System\imDoQIb.exe
  2⤵
  PID:7520
- C:\Windows\System\nFSpUtx.exe
  C:\Windows\System\nFSpUtx.exe
  2⤵
  PID:7536
- C:\Windows\System\lZbIuXz.exe
  C:\Windows\System\lZbIuXz.exe
  2⤵
  PID:7552
- C:\Windows\System\lDRuQme.exe
  C:\Windows\System\lDRuQme.exe
  2⤵
  PID:7576
- C:\Windows\System\peHdmjP.exe
  C:\Windows\System\peHdmjP.exe
  2⤵
  PID:7592
- C:\Windows\System\QDFYVoZ.exe
  C:\Windows\System\QDFYVoZ.exe
  2⤵
  PID:7612
- C:\Windows\System\VDIfSJK.exe
  C:\Windows\System\VDIfSJK.exe
  2⤵
  PID:7628
- C:\Windows\System\bZlMTHW.exe
  C:\Windows\System\bZlMTHW.exe
  2⤵
  PID:7672
- C:\Windows\System\DxQdWqs.exe
  C:\Windows\System\DxQdWqs.exe
  2⤵
  PID:7692
- C:\Windows\System\XyuQkKx.exe
  C:\Windows\System\XyuQkKx.exe
  2⤵
  PID:7720
- C:\Windows\System\EATVagx.exe
  C:\Windows\System\EATVagx.exe
  2⤵
  PID:7744
- C:\Windows\System\yFpFzNN.exe
  C:\Windows\System\yFpFzNN.exe
  2⤵
  PID:7760
- C:\Windows\System\tjDFbBA.exe
  C:\Windows\System\tjDFbBA.exe
  2⤵
  PID:7776
- C:\Windows\System\nXBgRMy.exe
  C:\Windows\System\nXBgRMy.exe
  2⤵
  PID:7792
- C:\Windows\System\laTmJbo.exe
  C:\Windows\System\laTmJbo.exe
  2⤵
  PID:7812
- C:\Windows\System\fHeTlzG.exe
  C:\Windows\System\fHeTlzG.exe
  2⤵
  PID:7828
- C:\Windows\System\yXqBJca.exe
  C:\Windows\System\yXqBJca.exe
  2⤵
  PID:7848
- C:\Windows\System\tUwHpWs.exe
  C:\Windows\System\tUwHpWs.exe
  2⤵
  PID:7868
- C:\Windows\System\cyIGeGb.exe
  C:\Windows\System\cyIGeGb.exe
  2⤵
  PID:7888
- C:\Windows\System\DEzeEHM.exe
  C:\Windows\System\DEzeEHM.exe
  2⤵
  PID:7904
- C:\Windows\System\ByrjFxC.exe
  C:\Windows\System\ByrjFxC.exe
  2⤵
  PID:7920
- C:\Windows\System\bcsVBiD.exe
  C:\Windows\System\bcsVBiD.exe
  2⤵
  PID:7940
- C:\Windows\System\fzAVMEm.exe
  C:\Windows\System\fzAVMEm.exe
  2⤵
  PID:7956
- C:\Windows\System\NGfkxeD.exe
  C:\Windows\System\NGfkxeD.exe
  2⤵
  PID:7972
- C:\Windows\System\rBVWfyA.exe
  C:\Windows\System\rBVWfyA.exe
  2⤵
  PID:7988
- C:\Windows\System\FdOfsLD.exe
  C:\Windows\System\FdOfsLD.exe
  2⤵
  PID:8020
- C:\Windows\System\xSeQrZv.exe
  C:\Windows\System\xSeQrZv.exe
  2⤵
  PID:8068
- C:\Windows\System\xzczsjd.exe
  C:\Windows\System\xzczsjd.exe
  2⤵
  PID:8084
- C:\Windows\System\FsFJPkC.exe
  C:\Windows\System\FsFJPkC.exe
  2⤵
  PID:8100
- C:\Windows\System\XcAVonI.exe
  C:\Windows\System\XcAVonI.exe
  2⤵
  PID:8116
- C:\Windows\System\YIkyMhu.exe
  C:\Windows\System\YIkyMhu.exe
  2⤵
  PID:8144
- C:\Windows\System\OTBdgDs.exe
  C:\Windows\System\OTBdgDs.exe
  2⤵
  PID:8160
- C:\Windows\System\fkQEIMv.exe
  C:\Windows\System\fkQEIMv.exe
  2⤵
  PID:8176
- C:\Windows\System\IENXgLp.exe
  C:\Windows\System\IENXgLp.exe
  2⤵
  PID:6592
- C:\Windows\System\HVlKeoa.exe
  C:\Windows\System\HVlKeoa.exe
  2⤵
  PID:7240
- C:\Windows\System\lIfsHca.exe
  C:\Windows\System\lIfsHca.exe
  2⤵
  PID:7284
- C:\Windows\System\tOsxBEs.exe
  C:\Windows\System\tOsxBEs.exe
  2⤵
  PID:7192
- C:\Windows\System\XOefgmp.exe
  C:\Windows\System\XOefgmp.exe
  2⤵
  PID:7260
- C:\Windows\System\ECGRIPM.exe
  C:\Windows\System\ECGRIPM.exe
  2⤵
  PID:7304
- C:\Windows\System\RsUNSDN.exe
  C:\Windows\System\RsUNSDN.exe
  2⤵
  PID:7328
- C:\Windows\System\UzMidGV.exe
  C:\Windows\System\UzMidGV.exe
  2⤵
  PID:7340
- C:\Windows\System\YcYwTmF.exe
  C:\Windows\System\YcYwTmF.exe
  2⤵
  PID:7408
- C:\Windows\System\wZjTGRR.exe
  C:\Windows\System\wZjTGRR.exe
  2⤵
  PID:7388
- C:\Windows\System\ycwmBhg.exe
  C:\Windows\System\ycwmBhg.exe
  2⤵
  PID:7512
- C:\Windows\System\PJJVrkZ.exe
  C:\Windows\System\PJJVrkZ.exe
  2⤵
  PID:7492
- C:\Windows\System\DPfKeZN.exe
  C:\Windows\System\DPfKeZN.exe
  2⤵
  PID:7608
- C:\Windows\System\BMlPuQH.exe
  C:\Windows\System\BMlPuQH.exe
  2⤵
  PID:7460
- C:\Windows\System\kOMsyCZ.exe
  C:\Windows\System\kOMsyCZ.exe
  2⤵
  PID:7660
- C:\Windows\System\YBwXeSz.exe
  C:\Windows\System\YBwXeSz.exe
  2⤵
  PID:7684
- C:\Windows\System\HXSYwdE.exe
  C:\Windows\System\HXSYwdE.exe
  2⤵
  PID:7740
- C:\Windows\System\dJvLqnQ.exe
  C:\Windows\System\dJvLqnQ.exe
  2⤵
  PID:7804
- C:\Windows\System\NBHxcVz.exe
  C:\Windows\System\NBHxcVz.exe
  2⤵
  PID:7752
- C:\Windows\System\ceSjpwQ.exe
  C:\Windows\System\ceSjpwQ.exe
  2⤵
  PID:7916
- C:\Windows\System\vILvTOW.exe
  C:\Windows\System\vILvTOW.exe
  2⤵
  PID:7984
- C:\Windows\System\CizxwPd.exe
  C:\Windows\System\CizxwPd.exe
  2⤵
  PID:7708
- C:\Windows\System\xLSswpz.exe
  C:\Windows\System\xLSswpz.exe
  2⤵
  PID:7788
- C:\Windows\System\yzkZboz.exe
  C:\Windows\System\yzkZboz.exe
  2⤵
  PID:8040
- C:\Windows\System\MvdfAEl.exe
  C:\Windows\System\MvdfAEl.exe
  2⤵
  PID:7968
- C:\Windows\System\EhUkkJq.exe
  C:\Windows\System\EhUkkJq.exe
  2⤵
  PID:7820
- C:\Windows\System\xUahHvg.exe
  C:\Windows\System\xUahHvg.exe
  2⤵
  PID:8064
- C:\Windows\System\LUlPlit.exe
  C:\Windows\System\LUlPlit.exe
  2⤵
  PID:8000
- C:\Windows\System\kncMRkF.exe
  C:\Windows\System\kncMRkF.exe
  2⤵
  PID:8124
- C:\Windows\System\sjSHbNZ.exe
  C:\Windows\System\sjSHbNZ.exe
  2⤵
  PID:7204
- C:\Windows\System\AGvbhDq.exe
  C:\Windows\System\AGvbhDq.exe
  2⤵
  PID:8140
- C:\Windows\System\xHspJvu.exe
  C:\Windows\System\xHspJvu.exe
  2⤵
  PID:7184
- C:\Windows\System\zTqkfEG.exe
  C:\Windows\System\zTqkfEG.exe
  2⤵
  PID:7320
- C:\Windows\System\pmYYJgq.exe
  C:\Windows\System\pmYYJgq.exe
  2⤵
  PID:8188
- C:\Windows\System\rwtPinH.exe
  C:\Windows\System\rwtPinH.exe
  2⤵
  PID:7040
- C:\Windows\System\JOGBXgp.exe
  C:\Windows\System\JOGBXgp.exe
  2⤵
  PID:7448
- C:\Windows\System\tvQojCP.exe
  C:\Windows\System\tvQojCP.exe
  2⤵
  PID:7624
- C:\Windows\System\ezZueiX.exe
  C:\Windows\System\ezZueiX.exe
  2⤵
  PID:7648
- C:\Windows\System\zKjgUZV.exe
  C:\Windows\System\zKjgUZV.exe
  2⤵
  PID:7572
- C:\Windows\System\qmLtryx.exe
  C:\Windows\System\qmLtryx.exe
  2⤵
  PID:7652
- C:\Windows\System\zzaUsAm.exe
  C:\Windows\System\zzaUsAm.exe
  2⤵
  PID:7668
- C:\Windows\System\pdOQMrC.exe
  C:\Windows\System\pdOQMrC.exe
  2⤵
  PID:7880
- C:\Windows\System\NXIPBUe.exe
  C:\Windows\System\NXIPBUe.exe
  2⤵
  PID:7864
- C:\Windows\System\mtjiXOj.exe
  C:\Windows\System\mtjiXOj.exe
  2⤵
  PID:7900
- C:\Windows\System\vKdDorK.exe
  C:\Windows\System\vKdDorK.exe
  2⤵
  PID:6432
- C:\Windows\System\ggaLueu.exe
  C:\Windows\System\ggaLueu.exe
  2⤵
  PID:7840
- C:\Windows\System\Wwudhrm.exe
  C:\Windows\System\Wwudhrm.exe
  2⤵
  PID:7980
- C:\Windows\System\gaPPDkc.exe
  C:\Windows\System\gaPPDkc.exe
  2⤵
  PID:8012
- C:\Windows\System\dewHrzS.exe
  C:\Windows\System\dewHrzS.exe
  2⤵
  PID:8172
- C:\Windows\System\mVARWhO.exe
  C:\Windows\System\mVARWhO.exe
  2⤵
  PID:7544
- C:\Windows\System\zpAIciQ.exe
  C:\Windows\System\zpAIciQ.exe
  2⤵
  PID:8184
- C:\Windows\System\FPWJeXQ.exe
  C:\Windows\System\FPWJeXQ.exe
  2⤵
  PID:7228
- C:\Windows\System\MjgJLmA.exe
  C:\Windows\System\MjgJLmA.exe
  2⤵
  PID:7604
- C:\Windows\System\PVlKupT.exe
  C:\Windows\System\PVlKupT.exe
  2⤵
  PID:7508
- C:\Windows\System\eGQXZal.exe
  C:\Windows\System\eGQXZal.exe
  2⤵
  PID:7636
- C:\Windows\System\hNsdAcN.exe
  C:\Windows\System\hNsdAcN.exe
  2⤵
  PID:7860
- C:\Windows\System\QOLxRlN.exe
  C:\Windows\System\QOLxRlN.exe
  2⤵
  PID:7716
- C:\Windows\System\PxzJaFv.exe
  C:\Windows\System\PxzJaFv.exe
  2⤵
  PID:8028
- C:\Windows\System\YtFGmAr.exe
  C:\Windows\System\YtFGmAr.exe
  2⤵
  PID:8096
- C:\Windows\System\qMjYUmL.exe
  C:\Windows\System\qMjYUmL.exe
  2⤵
  PID:1968
- C:\Windows\System\IICVstX.exe
  C:\Windows\System\IICVstX.exe
  2⤵
  PID:8108
- C:\Windows\System\MKKPTvz.exe
  C:\Windows\System\MKKPTvz.exe
  2⤵
  PID:7444
- C:\Windows\System\WiChdju.exe
  C:\Windows\System\WiChdju.exe
  2⤵
  PID:7528
- C:\Windows\System\ZHOavqn.exe
  C:\Windows\System\ZHOavqn.exe
  2⤵
  PID:7700
- C:\Windows\System\gMXhTRd.exe
  C:\Windows\System\gMXhTRd.exe
  2⤵
  PID:868
- C:\Windows\System\NCrTbWH.exe
  C:\Windows\System\NCrTbWH.exe
  2⤵
  PID:7736
- C:\Windows\System\UEeUTlj.exe
  C:\Windows\System\UEeUTlj.exe
  2⤵
  PID:8060
- C:\Windows\System\rKvCsPC.exe
  C:\Windows\System\rKvCsPC.exe
  2⤵
  PID:7644
- C:\Windows\System\PuegxXG.exe
  C:\Windows\System\PuegxXG.exe
  2⤵
  PID:7548
- C:\Windows\System\cvZibGS.exe
  C:\Windows\System\cvZibGS.exe
  2⤵
  PID:7912
- C:\Windows\System\uJGmWqp.exe
  C:\Windows\System\uJGmWqp.exe
  2⤵
  PID:8080
- C:\Windows\System\KDdGzXZ.exe
  C:\Windows\System\KDdGzXZ.exe
  2⤵
  PID:7856
- C:\Windows\System\NFwxtGv.exe
  C:\Windows\System\NFwxtGv.exe
  2⤵
  PID:7772
- C:\Windows\System\sEUhsDh.exe
  C:\Windows\System\sEUhsDh.exe
  2⤵
  PID:8056
- C:\Windows\System\sTTOeSv.exe
  C:\Windows\System\sTTOeSv.exe
  2⤵
  PID:8128
- C:\Windows\System\XCTUPQW.exe
  C:\Windows\System\XCTUPQW.exe
  2⤵
  PID:8004
- C:\Windows\System\jthtmch.exe
  C:\Windows\System\jthtmch.exe
  2⤵
  PID:7280
- C:\Windows\System\BxSAMjV.exe
  C:\Windows\System\BxSAMjV.exe
  2⤵
  PID:7584
- C:\Windows\System\qdqReQE.exe
  C:\Windows\System\qdqReQE.exe
  2⤵
  PID:8208
- C:\Windows\System\QZenwYD.exe
  C:\Windows\System\QZenwYD.exe
  2⤵
  PID:8224
- C:\Windows\System\WHDybds.exe
  C:\Windows\System\WHDybds.exe
  2⤵
  PID:8244
- C:\Windows\System\sIDStrj.exe
  C:\Windows\System\sIDStrj.exe
  2⤵
  PID:8264
- C:\Windows\System\lBDyplz.exe
  C:\Windows\System\lBDyplz.exe
  2⤵
  PID:8284
- C:\Windows\System\GTtZEmj.exe
  C:\Windows\System\GTtZEmj.exe
  2⤵
  PID:8308
- C:\Windows\System\XgwglxI.exe
  C:\Windows\System\XgwglxI.exe
  2⤵
  PID:8324
- C:\Windows\System\YVFQutT.exe
  C:\Windows\System\YVFQutT.exe
  2⤵
  PID:8340
- C:\Windows\System\kLkASCC.exe
  C:\Windows\System\kLkASCC.exe
  2⤵
  PID:8360
- C:\Windows\System\ISCYlyZ.exe
  C:\Windows\System\ISCYlyZ.exe
  2⤵
  PID:8376
- C:\Windows\System\tEmFjjs.exe
  C:\Windows\System\tEmFjjs.exe
  2⤵
  PID:8392
- C:\Windows\System\BeTkrQd.exe
  C:\Windows\System\BeTkrQd.exe
  2⤵
  PID:8436
- C:\Windows\System\TnkNNyA.exe
  C:\Windows\System\TnkNNyA.exe
  2⤵
  PID:8456
- C:\Windows\System\bTkhGjd.exe
  C:\Windows\System\bTkhGjd.exe
  2⤵
  PID:8472
- C:\Windows\System\qmJILuQ.exe
  C:\Windows\System\qmJILuQ.exe
  2⤵
  PID:8492
- C:\Windows\System\RMGcjrW.exe
  C:\Windows\System\RMGcjrW.exe
  2⤵
  PID:8512
- C:\Windows\System\InaNumc.exe
  C:\Windows\System\InaNumc.exe
  2⤵
  PID:8532
- C:\Windows\System\ZjfkbsE.exe
  C:\Windows\System\ZjfkbsE.exe
  2⤵
  PID:8548
- C:\Windows\System\OVyRaNs.exe
  C:\Windows\System\OVyRaNs.exe
  2⤵
  PID:8580
- C:\Windows\System\fWlOcbP.exe
  C:\Windows\System\fWlOcbP.exe
  2⤵
  PID:8596
- C:\Windows\System\eumLjLn.exe
  C:\Windows\System\eumLjLn.exe
  2⤵
  PID:8616
- C:\Windows\System\oWwXAcj.exe
  C:\Windows\System\oWwXAcj.exe
  2⤵
  PID:8632
- C:\Windows\System\XEobXoa.exe
  C:\Windows\System\XEobXoa.exe
  2⤵
  PID:8648
- C:\Windows\System\RmIxQHr.exe
  C:\Windows\System\RmIxQHr.exe
  2⤵
  PID:8668
- C:\Windows\System\xrBhXJt.exe
  C:\Windows\System\xrBhXJt.exe
  2⤵
  PID:8688
- C:\Windows\System\lxPpfnF.exe
  C:\Windows\System\lxPpfnF.exe
  2⤵
  PID:8712
- C:\Windows\System\tbNyFJM.exe
  C:\Windows\System\tbNyFJM.exe
  2⤵
  PID:8736
- C:\Windows\System\lzdgTNZ.exe
  C:\Windows\System\lzdgTNZ.exe
  2⤵
  PID:8752
- C:\Windows\System\QfttNzK.exe
  C:\Windows\System\QfttNzK.exe
  2⤵
  PID:8772
- C:\Windows\System\RzroLCb.exe
  C:\Windows\System\RzroLCb.exe
  2⤵
  PID:8788
- C:\Windows\System\HQbmJvS.exe
  C:\Windows\System\HQbmJvS.exe
  2⤵
  PID:8812
- C:\Windows\System\pHmKdZL.exe
  C:\Windows\System\pHmKdZL.exe
  2⤵
  PID:8836
- C:\Windows\System\IlYgagY.exe
  C:\Windows\System\IlYgagY.exe
  2⤵
  PID:8856
- C:\Windows\System\CPFBxsf.exe
  C:\Windows\System\CPFBxsf.exe
  2⤵
  PID:8872
- C:\Windows\System\eIYgOPR.exe
  C:\Windows\System\eIYgOPR.exe
  2⤵
  PID:8888
- C:\Windows\System\mdwGktC.exe
  C:\Windows\System\mdwGktC.exe
  2⤵
  PID:8916
- C:\Windows\System\jRAJXZD.exe
  C:\Windows\System\jRAJXZD.exe
  2⤵
  PID:8936
- C:\Windows\System\DgWwbml.exe
  C:\Windows\System\DgWwbml.exe
  2⤵
  PID:8956
- C:\Windows\System\GlOcASU.exe
  C:\Windows\System\GlOcASU.exe
  2⤵
  PID:8976
- C:\Windows\System\fJEGMZn.exe
  C:\Windows\System\fJEGMZn.exe
  2⤵
  PID:8992
- C:\Windows\System\SmtTdPF.exe
  C:\Windows\System\SmtTdPF.exe
  2⤵
  PID:9008
- C:\Windows\System\nHZHgWq.exe
  C:\Windows\System\nHZHgWq.exe
  2⤵
  PID:9028
- C:\Windows\System\eQrAmap.exe
  C:\Windows\System\eQrAmap.exe
  2⤵
  PID:9044
- C:\Windows\System\bksIlrU.exe
  C:\Windows\System\bksIlrU.exe
  2⤵
  PID:9060
- C:\Windows\System\wkbnbRd.exe
  C:\Windows\System\wkbnbRd.exe
  2⤵
  PID:9080
- C:\Windows\System\KYtpSma.exe
  C:\Windows\System\KYtpSma.exe
  2⤵
  PID:9104
- C:\Windows\System\miKgczu.exe
  C:\Windows\System\miKgczu.exe
  2⤵
  PID:9124
- C:\Windows\System\imYUvpP.exe
  C:\Windows\System\imYUvpP.exe
  2⤵
  PID:9144
- C:\Windows\System\xRPrvJq.exe
  C:\Windows\System\xRPrvJq.exe
  2⤵
  PID:9160
- C:\Windows\System\TguctQH.exe
  C:\Windows\System\TguctQH.exe
  2⤵
  PID:9180
- C:\Windows\System\eAocDFv.exe
  C:\Windows\System\eAocDFv.exe
  2⤵
  PID:9196
- C:\Windows\System\BOkJEHg.exe
  C:\Windows\System\BOkJEHg.exe
  2⤵
  PID:8292
- C:\Windows\System\TGpoWVP.exe
  C:\Windows\System\TGpoWVP.exe
  2⤵
  PID:8232
- C:\Windows\System\LGVEEct.exe
  C:\Windows\System\LGVEEct.exe
  2⤵
  PID:8368
- C:\Windows\System\bdjBFXa.exe
  C:\Windows\System\bdjBFXa.exe
  2⤵
  PID:8352
- C:\Windows\System\ADxDNto.exe
  C:\Windows\System\ADxDNto.exe
  2⤵
  PID:8240
- C:\Windows\System\aKQcrXi.exe
  C:\Windows\System\aKQcrXi.exe
  2⤵
  PID:1556
- C:\Windows\System\qxsptwB.exe
  C:\Windows\System\qxsptwB.exe
  2⤵
  PID:8424
- C:\Windows\System\YCnHkMa.exe
  C:\Windows\System\YCnHkMa.exe
  2⤵
  PID:8444
- C:\Windows\System\fYhLDfb.exe
  C:\Windows\System\fYhLDfb.exe
  2⤵
  PID:8484
- C:\Windows\System\GEFZGQx.exe
  C:\Windows\System\GEFZGQx.exe
  2⤵
  PID:8508
- C:\Windows\System\WqodQTd.exe
  C:\Windows\System\WqodQTd.exe
  2⤵
  PID:8544
- C:\Windows\System\AJqHtrB.exe
  C:\Windows\System\AJqHtrB.exe
  2⤵
  PID:8576
- C:\Windows\System\mndfAyG.exe
  C:\Windows\System\mndfAyG.exe
  2⤵
  PID:8624
- C:\Windows\System\MgOGTpA.exe
  C:\Windows\System\MgOGTpA.exe
  2⤵
  PID:8640
- C:\Windows\System\QgFKVyb.exe
  C:\Windows\System\QgFKVyb.exe
  2⤵
  PID:8660
- C:\Windows\System\DXFeuoS.exe
  C:\Windows\System\DXFeuoS.exe
  2⤵
  PID:8684
- C:\Windows\System\OsvHAIM.exe
  C:\Windows\System\OsvHAIM.exe
  2⤵
  PID:8732
- C:\Windows\System\dMuHOUS.exe
  C:\Windows\System\dMuHOUS.exe
  2⤵
  PID:8764
- C:\Windows\System\NUopcrA.exe
  C:\Windows\System\NUopcrA.exe
  2⤵
  PID:8808
- C:\Windows\System\HayAZTO.exe
  C:\Windows\System\HayAZTO.exe
  2⤵
  PID:8852
- C:\Windows\System\zuxyfQZ.exe
  C:\Windows\System\zuxyfQZ.exe
  2⤵
  PID:8904
- C:\Windows\System\ZDRtVdv.exe
  C:\Windows\System\ZDRtVdv.exe
  2⤵
  PID:8928
- C:\Windows\System\mTByawJ.exe
  C:\Windows\System\mTByawJ.exe
  2⤵
  PID:8952
- C:\Windows\System\QmOtyNF.exe
  C:\Windows\System\QmOtyNF.exe
  2⤵
  PID:8988
- C:\Windows\System\BbGdPpp.exe
  C:\Windows\System\BbGdPpp.exe
  2⤵
  PID:9092
- C:\Windows\System\VEWIxtg.exe
  C:\Windows\System\VEWIxtg.exe
  2⤵
  PID:9140
- C:\Windows\System\fNgYsOi.exe
  C:\Windows\System\fNgYsOi.exe
  2⤵
  PID:9176
- C:\Windows\System\AbkbToH.exe
  C:\Windows\System\AbkbToH.exe
  2⤵
  PID:9156
- C:\Windows\System\frAkhpO.exe
  C:\Windows\System\frAkhpO.exe
  2⤵
  PID:9000
- C:\Windows\System\OcgpsXu.exe
  C:\Windows\System\OcgpsXu.exe
  2⤵
  PID:9120
- C:\Windows\System\OdbfpEO.exe
  C:\Windows\System\OdbfpEO.exe
  2⤵
  PID:7568
- C:\Windows\System\wHFbiEU.exe
  C:\Windows\System\wHFbiEU.exe
  2⤵
  PID:8256
- C:\Windows\System\RzKcvEO.exe
  C:\Windows\System\RzKcvEO.exe
  2⤵
  PID:8280
- C:\Windows\System\ivtDLDj.exe
  C:\Windows\System\ivtDLDj.exe
  2⤵
  PID:8388
- C:\Windows\System\xyiiKWs.exe
  C:\Windows\System\xyiiKWs.exe
  2⤵
  PID:8320
- C:\Windows\System\asSSKTb.exe
  C:\Windows\System\asSSKTb.exe
  2⤵
  PID:8420
- C:\Windows\System\TuVPyAL.exe
  C:\Windows\System\TuVPyAL.exe
  2⤵
  PID:7372
- C:\Windows\System\xxXbOQQ.exe
  C:\Windows\System\xxXbOQQ.exe
  2⤵
  PID:8744
- C:\Windows\System\RPRQBUc.exe
  C:\Windows\System\RPRQBUc.exe
  2⤵
  PID:8468
- C:\Windows\System\WkIknMQ.exe
  C:\Windows\System\WkIknMQ.exe
  2⤵
  PID:8700
- C:\Windows\System\fcLmGcF.exe
  C:\Windows\System\fcLmGcF.exe
  2⤵
  PID:8780
- C:\Windows\System\RmfKMri.exe
  C:\Windows\System\RmfKMri.exe
  2⤵
  PID:8728
- C:\Windows\System\zmivEjl.exe
  C:\Windows\System\zmivEjl.exe
  2⤵
  PID:8864
- C:\Windows\System\tfmoVGO.exe
  C:\Windows\System\tfmoVGO.exe
  2⤵
  PID:8896
- C:\Windows\System\itUpTYI.exe
  C:\Windows\System\itUpTYI.exe
  2⤵
  PID:8984
- C:\Windows\System\hqXEDrz.exe
  C:\Windows\System\hqXEDrz.exe
  2⤵
  PID:9100
- C:\Windows\System\lPFCJYU.exe
  C:\Windows\System\lPFCJYU.exe
  2⤵
  PID:9188
- C:\Windows\System\XWbGJEF.exe
  C:\Windows\System\XWbGJEF.exe
  2⤵
  PID:9116
- C:\Windows\System\NtETagg.exe
  C:\Windows\System\NtETagg.exe
  2⤵
  PID:7360
- C:\Windows\System\oeNlEhq.exe
  C:\Windows\System\oeNlEhq.exe
  2⤵
  PID:9076
- C:\Windows\System\sFEQOUu.exe
  C:\Windows\System\sFEQOUu.exe
  2⤵
  PID:8220
- C:\Windows\System\pohiUXU.exe
  C:\Windows\System\pohiUXU.exe
  2⤵
  PID:8272
- C:\Windows\System\kzcKrSq.exe
  C:\Windows\System\kzcKrSq.exe
  2⤵
  PID:8524
- C:\Windows\System\RqaRmbn.exe
  C:\Windows\System\RqaRmbn.exe
  2⤵
  PID:8656
- C:\Windows\System\WjbJWUC.exe
  C:\Windows\System\WjbJWUC.exe
  2⤵
  PID:8564
- C:\Windows\System\rWfEDZb.exe
  C:\Windows\System\rWfEDZb.exe
  2⤵
  PID:8804
- C:\Windows\System\OjwTtCL.exe
  C:\Windows\System\OjwTtCL.exe
  2⤵
  PID:8880
- C:\Windows\System\dySQaqz.exe
  C:\Windows\System\dySQaqz.exe
  2⤵
  PID:8972
- C:\Windows\System\xROSMcm.exe
  C:\Windows\System\xROSMcm.exe
  2⤵
  PID:9172
- C:\Windows\System\JeEbNNI.exe
  C:\Windows\System\JeEbNNI.exe
  2⤵
  PID:9068
- C:\Windows\System\oQYPjXL.exe
  C:\Windows\System\oQYPjXL.exe
  2⤵
  PID:8408
- C:\Windows\System\ToXlaNQ.exe
  C:\Windows\System\ToXlaNQ.exe
  2⤵
  PID:8520
- C:\Windows\System\inXsmWv.exe
  C:\Windows\System\inXsmWv.exe
  2⤵
  PID:8720
- C:\Windows\System\YgZFcsC.exe
  C:\Windows\System\YgZFcsC.exe
  2⤵
  PID:9212
- C:\Windows\System\DXMHClv.exe
  C:\Windows\System\DXMHClv.exe
  2⤵
  PID:8908
- C:\Windows\System\HCTvSqj.exe
  C:\Windows\System\HCTvSqj.exe
  2⤵
  PID:8948
- C:\Windows\System\aOrnYbL.exe
  C:\Windows\System\aOrnYbL.exe
  2⤵
  PID:9208
- C:\Windows\System\IqdxfEu.exe
  C:\Windows\System\IqdxfEu.exe
  2⤵
  PID:8200
- C:\Windows\System\FYWuyAq.exe
  C:\Windows\System\FYWuyAq.exe
  2⤵
  PID:8612
- C:\Windows\System\gfeWgvl.exe
  C:\Windows\System\gfeWgvl.exe
  2⤵
  PID:8724
- C:\Windows\System\SSREYxg.exe
  C:\Windows\System\SSREYxg.exe
  2⤵
  PID:8924
- C:\Windows\System\uLiqcQb.exe
  C:\Windows\System\uLiqcQb.exe
  2⤵
  PID:8404
- C:\Windows\System\ZvJPyGq.exe
  C:\Windows\System\ZvJPyGq.exe
  2⤵
  PID:8708
- C:\Windows\System\ZMIEoVO.exe
  C:\Windows\System\ZMIEoVO.exe
  2⤵
  PID:8560
- C:\Windows\System\bPFiprS.exe
  C:\Windows\System\bPFiprS.exe
  2⤵
  PID:8768
- C:\Windows\System\KgUUGLB.exe
  C:\Windows\System\KgUUGLB.exe
  2⤵
  PID:8592
- C:\Windows\System\bMGFbCv.exe
  C:\Windows\System\bMGFbCv.exe
  2⤵
  PID:9228
- C:\Windows\System\MPvtZTu.exe
  C:\Windows\System\MPvtZTu.exe
  2⤵
  PID:9248
- C:\Windows\System\awCFkAH.exe
  C:\Windows\System\awCFkAH.exe
  2⤵
  PID:9264
- C:\Windows\System\nbSvdkC.exe
  C:\Windows\System\nbSvdkC.exe
  2⤵
  PID:9284
- C:\Windows\System\yXehEMz.exe
  C:\Windows\System\yXehEMz.exe
  2⤵
  PID:9304
- C:\Windows\System\CMafgcJ.exe
  C:\Windows\System\CMafgcJ.exe
  2⤵
  PID:9324
- C:\Windows\System\QJrpZpP.exe
  C:\Windows\System\QJrpZpP.exe
  2⤵
  PID:9340
- C:\Windows\System\QzCowuk.exe
  C:\Windows\System\QzCowuk.exe
  2⤵
  PID:9360
- C:\Windows\System\uxSXOPT.exe
  C:\Windows\System\uxSXOPT.exe
  2⤵
  PID:9388
- C:\Windows\System\JTdrpWZ.exe
  C:\Windows\System\JTdrpWZ.exe
  2⤵
  PID:9412
- C:\Windows\System\lKTbeim.exe
  C:\Windows\System\lKTbeim.exe
  2⤵
  PID:9428
- C:\Windows\System\GsipWFD.exe
  C:\Windows\System\GsipWFD.exe
  2⤵
  PID:9444
- C:\Windows\System\XFsboQb.exe
  C:\Windows\System\XFsboQb.exe
  2⤵
  PID:9468
- C:\Windows\System\IXTfHET.exe
  C:\Windows\System\IXTfHET.exe
  2⤵
  PID:9484
- C:\Windows\System\tEWgWLa.exe
  C:\Windows\System\tEWgWLa.exe
  2⤵
  PID:9508
- C:\Windows\System\besNeSh.exe
  C:\Windows\System\besNeSh.exe
  2⤵
  PID:9532
- C:\Windows\System\FMTPCvG.exe
  C:\Windows\System\FMTPCvG.exe
  2⤵
  PID:9548
- C:\Windows\System\DNrafCL.exe
  C:\Windows\System\DNrafCL.exe
  2⤵
  PID:9568
- C:\Windows\System\shlCVQf.exe
  C:\Windows\System\shlCVQf.exe
  2⤵
  PID:9592
- C:\Windows\System\BZMqLRq.exe
  C:\Windows\System\BZMqLRq.exe
  2⤵
  PID:9612
- C:\Windows\System\tnazYIu.exe
  C:\Windows\System\tnazYIu.exe
  2⤵
  PID:9632
- C:\Windows\System\OuZFJEX.exe
  C:\Windows\System\OuZFJEX.exe
  2⤵
  PID:9648
- C:\Windows\System\puTRFKS.exe
  C:\Windows\System\puTRFKS.exe
  2⤵
  PID:9668
- C:\Windows\System\JKhDwKF.exe
  C:\Windows\System\JKhDwKF.exe
  2⤵
  PID:9688
- C:\Windows\System\KhssBxu.exe
  C:\Windows\System\KhssBxu.exe
  2⤵
  PID:9716
- C:\Windows\System\tiBCFAD.exe
  C:\Windows\System\tiBCFAD.exe
  2⤵
  PID:9732
- C:\Windows\System\VXlBqJI.exe
  C:\Windows\System\VXlBqJI.exe
  2⤵
  PID:9752
- C:\Windows\System\mFTwlGS.exe
  C:\Windows\System\mFTwlGS.exe
  2⤵
  PID:9772
- C:\Windows\System\gtZkBZP.exe
  C:\Windows\System\gtZkBZP.exe
  2⤵
  PID:9796
- C:\Windows\System\iqTuRiF.exe
  C:\Windows\System\iqTuRiF.exe
  2⤵
  PID:9816
- C:\Windows\System\AMdnKbY.exe
  C:\Windows\System\AMdnKbY.exe
  2⤵
  PID:9836
- C:\Windows\System\HdrZgRp.exe
  C:\Windows\System\HdrZgRp.exe
  2⤵
  PID:9852
- C:\Windows\System\bUUnHrd.exe
  C:\Windows\System\bUUnHrd.exe
  2⤵
  PID:9876
- C:\Windows\System\RXthBBs.exe
  C:\Windows\System\RXthBBs.exe
  2⤵
  PID:9900
- C:\Windows\System\ZNLqMtm.exe
  C:\Windows\System\ZNLqMtm.exe
  2⤵
  PID:9916
- C:\Windows\System\SlFpdwg.exe
  C:\Windows\System\SlFpdwg.exe
  2⤵
  PID:9936
- C:\Windows\System\LQfyMRM.exe
  C:\Windows\System\LQfyMRM.exe
  2⤵
  PID:9956
- C:\Windows\System\FmkIkwR.exe
  C:\Windows\System\FmkIkwR.exe
  2⤵
  PID:9976
- C:\Windows\System\AfzVNTm.exe
  C:\Windows\System\AfzVNTm.exe
  2⤵
  PID:9996
- C:\Windows\System\sKaXisL.exe
  C:\Windows\System\sKaXisL.exe
  2⤵
  PID:10016
- C:\Windows\System\dHyYmnS.exe
  C:\Windows\System\dHyYmnS.exe
  2⤵
  PID:10036
- C:\Windows\System\WXOTkhu.exe
  C:\Windows\System\WXOTkhu.exe
  2⤵
  PID:10056
- C:\Windows\System\dJrlLCz.exe
  C:\Windows\System\dJrlLCz.exe
  2⤵
  PID:10076
- C:\Windows\System\uUyNmxG.exe
  C:\Windows\System\uUyNmxG.exe
  2⤵
  PID:10100
- C:\Windows\System\YbkQmcb.exe
  C:\Windows\System\YbkQmcb.exe
  2⤵
  PID:10120
- C:\Windows\System\OSwoAfY.exe
  C:\Windows\System\OSwoAfY.exe
  2⤵
  PID:10140
- C:\Windows\System\SBOFrEA.exe
  C:\Windows\System\SBOFrEA.exe
  2⤵
  PID:10156
- C:\Windows\System\oIvxiIm.exe
  C:\Windows\System\oIvxiIm.exe
  2⤵
  PID:10176
- C:\Windows\System\zECaFRC.exe
  C:\Windows\System\zECaFRC.exe
  2⤵
  PID:10200
- C:\Windows\System\bznwFDf.exe
  C:\Windows\System\bznwFDf.exe
  2⤵
  PID:10220
- C:\Windows\System\useQJJr.exe
  C:\Windows\System\useQJJr.exe
  2⤵
  PID:9052
- C:\Windows\System\zVSCdEC.exe
  C:\Windows\System\zVSCdEC.exe
  2⤵
  PID:8416
- C:\Windows\System\gMwXhRE.exe
  C:\Windows\System\gMwXhRE.exe
  2⤵
  PID:9244
- C:\Windows\System\LEiZGOX.exe
  C:\Windows\System\LEiZGOX.exe
  2⤵
  PID:9312
- C:\Windows\System\HjcgFUh.exe
  C:\Windows\System\HjcgFUh.exe
  2⤵
  PID:9336
- C:\Windows\System\RZFwUFV.exe
  C:\Windows\System\RZFwUFV.exe
  2⤵
  PID:9372
- C:\Windows\System\zwiYpnL.exe
  C:\Windows\System\zwiYpnL.exe
  2⤵
  PID:9396
- C:\Windows\System\gRXSSVS.exe
  C:\Windows\System\gRXSSVS.exe
  2⤵
  PID:9020
- C:\Windows\System\KxDxvaD.exe
  C:\Windows\System\KxDxvaD.exe
  2⤵
  PID:9456
- C:\Windows\System\nQoGBim.exe
  C:\Windows\System\nQoGBim.exe
  2⤵
  PID:9492
- C:\Windows\System\BPRYmGD.exe
  C:\Windows\System\BPRYmGD.exe
  2⤵
  PID:9524
- C:\Windows\System\sVQhUOD.exe
  C:\Windows\System\sVQhUOD.exe
  2⤵
  PID:9580
- C:\Windows\System\bHVxraM.exe
  C:\Windows\System\bHVxraM.exe
  2⤵
  PID:9604
- C:\Windows\System\MBYFKig.exe
  C:\Windows\System\MBYFKig.exe
  2⤵
  PID:9628
- C:\Windows\System\paUvZJP.exe
  C:\Windows\System\paUvZJP.exe
  2⤵
  PID:9656
- C:\Windows\System\HCyIbMe.exe
  C:\Windows\System\HCyIbMe.exe
  2⤵
  PID:9724
- C:\Windows\System\UzESKDy.exe
  C:\Windows\System\UzESKDy.exe
  2⤵
  PID:9728
- C:\Windows\System\NTCIKjT.exe
  C:\Windows\System\NTCIKjT.exe
  2⤵
  PID:9760
- C:\Windows\System\JnOtlKf.exe
  C:\Windows\System\JnOtlKf.exe
  2⤵
  PID:9804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BkCpWMg.exe

Filesize
2.2MB

MD5
6894b2e6fe08ab790b3d3211b494c67a

SHA1
aa391e7f0dfc3da8a9a93e74a3682f9e217ab58c

SHA256
0bd5b015228ecadc42340723022834d88e919731061aada2e809628c06f4c118

SHA512
a42365014c9e78b5d465c57d0768c11fb4d54032003c90be7c2e844d5865c4c2a6cceff09a2a57d034e66e49735e726c4a884ba3ee342b987f136cf99e2ad02c

Download Submit
C:\Windows\system\DItqEek.exe

Filesize
2.2MB

MD5
32b9056143fee3360eec2ada3b88c1e1

SHA1
31f774ca58999744975a4587069ce1d718739b2c

SHA256
27f6c7dd738bdcba441fcb5fe0ef50093270fcec5d88c7650adc675aa02bc1c3

SHA512
d865922949bfb0ae9b89fbe80b0355b8d3c032019181dbd2c98da8c52f3260ec21d0513a5f029d4092cd9d227c40242f75b652cb337acbc2df6da74a72a68a22

Download Submit
C:\Windows\system\GCbKKWr.exe

Filesize
2.2MB

MD5
0e34cfea2a941626052328515e3e63eb

SHA1
a1f0b12c9072f2e40ab66014c6bdc6462b8455ad

SHA256
9d8413c0e65d639fff711d6b1100cde50864784973e4ee05890de8d168d6f052

SHA512
193a1a85b8db3997ec99e58274290b2b674a24824cbb2dcbcf041af0ab6b34973ed3c654bdc3af37f98ff3be76b13aeddbf107a0b9210855facb81a839896c4d

Download Submit
C:\Windows\system\GzYDIbI.exe

Filesize
2.2MB

MD5
8e07354b53a390ebcffcb081803d60e4

SHA1
b325075c457bfa9fd85048057eff4fc26fa7691d

SHA256
cdb3881d22aeb9e73a757f11692d62e3d6a14c1a07fd525850d17f53df1703c1

SHA512
a0fc195e6992effecc74eb9f16842bb648f4966c618922edfaba5ed4722db167525b1427a5a27f5c556fd308328a56b54fb87eeaf015d5d171194c2639b22149

Download Submit
C:\Windows\system\HQhrcDQ.exe

Filesize
2.2MB

MD5
8dd998507eb20d172ef14ef892223242

SHA1
6a482c5eb4fbbb193480e275242b8ba6890eea0f

SHA256
696e44a5593b96a83da05a41b25b66867c6752c144dca7832eb82f3d3c008705

SHA512
73bd29fe0bc41588a301e8af6fac6d577fe10ecc9c55dc3cea4b7d9a6dc41f70ecdc2bf64336f3c7e03d465c38d3f6d96ac73c7cd81092dd41c60fb7a47ca2d7

Download Submit
C:\Windows\system\NiNvwzX.exe

Filesize
2.2MB

MD5
898358cd961ab7f8cc52a7c7e7b89c3d

SHA1
6e3f32e5a694ffe690209a2472e619226bc3952d

SHA256
ef238a1f03edd3b6820265b5557e2b4c920dab52ce26e1e950c48018235764cc

SHA512
b40acd34affeb44e1fdd6abece836aec73f96461f48491f434a534844b510ab58b497eba0ca14856bdb2f700ed5fa350ddd744f65ccdba8457f37e56ce7fd25f

Download Submit
C:\Windows\system\PhrFeTX.exe

Filesize
2.2MB

MD5
6eb4969ce42e1079a8e13948bc7d7304

SHA1
c526c83ba80328616d80a2cb32a76b3468765cf5

SHA256
082120be25cbb752877164397d5eee233adaf541451b976fd283b0ac0c5bf2c5

SHA512
7d1b59a2ceb9b0430e4242879dc518b02166c42d71f1144a56c8c24e3a6e13b9024b4b55b63f20757da1f362c3cf2dba3e4c074cdfc8f170a5809faaaf59066a

Download Submit
C:\Windows\system\UjhBxHt.exe

Filesize
2.2MB

MD5
4afbc9b27eb5d4d3bcb4a25e21f3bc07

SHA1
36f1fcbb97995f4cd28302c03240c7e6b1961832

SHA256
a9de305d2296269939c8304c1eca9fb239620b7da6797e0cdefc9fe7e876cb92

SHA512
ad3c58a84ce38b7136f9d48ae3ec1a07880f30d794e8a6e64659a21e03373859e75520bebca50ec4a997de52ba3500af2e2793070fbde5d269affe388a82db8a

Download Submit
C:\Windows\system\VBceURL.exe

Filesize
2.2MB

MD5
87b98241e41cbf3b77224f1acab3a683

SHA1
b7d31e98a3920e7fdfaf5a3792c78789eedf2073

SHA256
5e8aadb2df20c79237b30d253b8e82fc73bebe11bef712cd3fb26270c7697414

SHA512
afc0c1f373a13ca086ddc412b7dab77877bf30746ab61470001ce4171dba34b586ad9771f905be96c83ecb94e6da9cfc3d5196ab8a6c98acaf004eae27ca9d9c

Download Submit
C:\Windows\system\WEApgEn.exe

Filesize
2.2MB

MD5
a9edd7a49f18367fb9af811368547a57

SHA1
e0f1c93062ffc436a14c44b006e791895e1e7dae

SHA256
0f08440c74968ea5a76e5c3257503315f57613088407e3e51df25e2214234da6

SHA512
150b1ee24336089664f4ae04b9557f78f400e1161a2d098466b670bfbb2b812e788e12427323a7c78f75b9f3427b4f8efcf58e4fb03c5bbe887372f84ae6177c

Download Submit
C:\Windows\system\WLgNLTC.exe

Filesize
2.2MB

MD5
412419f590c582a9d1f98c98b402d4fd

SHA1
b2fb52e54330b1c55bb5025b29a02fc6799d7fdc

SHA256
6bcc804ed8bf471c8710addddd8a659e1fb3e95fa12cd59867d1d41e0c4ad984

SHA512
88ca1feed88dec11c3163259d5460cd3ae65b129935d30d362a1ad3876d40a0ed6069df213ed0619b5a93e6c4df164e320cd806f2ec8671d9c016a96802fb543

Download Submit
C:\Windows\system\XSlaXhN.exe

Filesize
2.2MB

MD5
175000b4fdf533f6cec3a368e004fb6f

SHA1
f23a9c80d25abecceecb24836d31b064aee9588c

SHA256
ad3157c4c4a30dc6d0df42691cbc45aa65d6be8852eb330de7e80c9cf4b92ad5

SHA512
f983960870f752c654f2084ab5ef63eb120b6de08a8d94d07b3840a9580be1adaee8df92439ff7ca25fd0df8698fc4e7277d9355b5d7acc038f92f4aa30db93c

Download Submit
C:\Windows\system\YPmraGf.exe

Filesize
2.2MB

MD5
d9656994311ea6d036063014004bad02

SHA1
9c8e8d021585c4d036c5caad8ab070729357b393

SHA256
c36bc366672c11665509a43ac1172bef4862cb2a7b9302fd14eb1dfcfcec9757

SHA512
72e0a92bdd0bfa30b80cf4ce39aa766e1973b3b3e2927e221f3d87255357db8510be9234f2822e4c479b513865af7a080b5e8c457046eef539bcee2728251534

Download Submit
C:\Windows\system\YfWTPJl.exe

Filesize
2.2MB

MD5
0e078e5fff1fc71cf2167b4d9bffa7a5

SHA1
c11de3a12951f05af2fc4aaa1fd38219a7e00dda

SHA256
593245fb3fa299c7a3d21ee3e5ef7c6dbc118365d4c4bae7d18385b492a64d58

SHA512
11438247d76c72ff5ec29e1c9b3b354f1799cd583020e7e795f74bd316405b13f99f61e213f3057541bd9cf48ec5fcd1084fbdc202b35f5622f3d235741d6bfd

Download Submit
C:\Windows\system\cXWllxe.exe

Filesize
2.2MB

MD5
8424c89531602f3326d6ddb934fb5af2

SHA1
8ed87bfdbb64dd128dcbe59624f5eb343f73a4ab

SHA256
07b3dc1619fe07da43b36d0ad4d9fbbd687cd7c20e5efd3096e6566712a5ed54

SHA512
6ad593adbefc11914e5243715b9bea96e00dfcd650efb8432ca2d80b65340c9a541285556cff9bd3701115306a9cd56dadd2f304886ea7ec603511d8e9a5f4b7

Download Submit
C:\Windows\system\dQVFXiR.exe

Filesize
2.2MB

MD5
527abeb7f3090a9c858e94acebe15f2e

SHA1
3f5147534a6e42410c53c4f52ae710de7874135d

SHA256
d12da983310533aa6b52f2c77ce08aaed253e33054b8fc3bdb31cd5ca29cf020

SHA512
c638d41598f84ff5b2ff909fdf22d07c8064ad27f45afc251180301d14e25738b19c2132cd77277aeb2894c938296fe31cf341becb05b6859c525da596ad35ed

Download Submit
C:\Windows\system\dgXAQyn.exe

Filesize
2.2MB

MD5
2f8a0f9e66bc8b152296099e833168e9

SHA1
8e80af9f06d7605e3ed50699eb658d2fb8d66938

SHA256
0e00be005f01701adbac41d25d1a7b317e2acef1c99ce85615489d0651278c5a

SHA512
d6f51a8598f2318cb84535b12ccb783497bdeb12d1ddda0780e1b3b38959224c4fe5552974f22c2b23db0a7923a054e6bd6e9e983a6550918e808394646e9e95

Download Submit
C:\Windows\system\eVeEFGF.exe

Filesize
2.2MB

MD5
775144df0932be0f78a4646656cba2d6

SHA1
75bd90d41cdd75fb5be2a71bd5045a2702e8ed47

SHA256
9d1662d78a02c926018207a132bb0c7fb4bb2bf06e1857c2e3fd166ec4ba1c28

SHA512
6aade04bb8083273e20ba9e5ef10137e8bee09cef8c5f9f5ca597cb1ea1438764803d1efc54c82eb021373d06b2b7421fa834d6ae17d1760a6299be8dc050d45

Download Submit
C:\Windows\system\fehnXEg.exe

Filesize
2.2MB

MD5
9c38bcdd121c4387c39184ba596607e1

SHA1
6ba025626feebda93789e26959d0cd91277d4d24

SHA256
920eedb88ffdcfe99b4f1e3537838d316ba24caf96db61aaf033220724f6ff1e

SHA512
82e0295ef070433b2cbba6683480c2d3541d7f67b912ccb57246fe92b6a39437dcadf512ac502aacd937cd238387872bba8ab2758bdfd525981265dda04c5565

Download Submit
C:\Windows\system\frtAZPi.exe

Filesize
2.2MB

MD5
552258573b9041b6f994aed2247814a3

SHA1
2027b6ac07f5ce5343a74de7c3339482a42c1d9c

SHA256
36a6a91a9d0c00739967a7e41ff1581160ca25c3d92e76e71aef6fb2564a5bc0

SHA512
ec74d6bd94bcd31c8cdd084959cfdd4a136fe8212daad29ebcafda7a8017a161fc8d999a4ca5b9daa489269574737a46fb208f2a6556ec89b3d098f8fac589b7

Download Submit
C:\Windows\system\fvBAHHi.exe

Filesize
2.2MB

MD5
e9ba373a4cf2c09cec790442c780dfb4

SHA1
d1dc138e7c3ff69d1dd936a7e64cbbaa5cc6a341

SHA256
57f0cb73e3a279c990c30e7f8611fc65fb79802c225f72c55295169b41513e01

SHA512
f39558bf3b817409397383a7b20af483d1d3adcb4b16b30f6da0532133075d502e0735bbe08ddef432657984b828ea7b2096f6e9181b51efce8f20ad8eabeeb2

Download Submit
C:\Windows\system\mIjgMMl.exe

Filesize
2.2MB

MD5
739a626d198d280e8971da284f1be753

SHA1
ac73db38d030dd7e31c094b5bb1c22341a1eef63

SHA256
0028746ca03bde81025302253dd33347b0823eb4b0b6c1f7aeb669a628dc9360

SHA512
4864bca317398aa90c4cf8437d7741762d5135fa2964844f5706709e3f285518a75153519dc4603f2ef7e53bd258841b7ffbf96fe548daf0dfe2ab4f4ece3a3e

Download Submit
C:\Windows\system\pQSNxbl.exe

Filesize
2.2MB

MD5
f8b3e5926bdc1414735ee4d7468d65d7

SHA1
d1037e8d23ebfb91467f812220711951f819a88b

SHA256
25ed973693a386c1d811956d7c8b0219b23e9b8acc928a3ca92e09da726e9fb0

SHA512
72174b2cfbaecb035e2cab745d299c8672937b1d6bd4acd9dfe15bef58a00be57ad2db8d5b75dc6f44918d9495c00065c56dc85504764716fa175146cbac45f5

Download Submit
C:\Windows\system\rfsSYAx.exe

Filesize
2.2MB

MD5
d3c5df7811a3086eb58e64cc509059f5

SHA1
8042a12663d175cad9921cbfa40fb8a600ee9e6d

SHA256
3504ff1a920218df8e0f39ac7ce765c87e18eed2706eff2ea0551250f398c4e5

SHA512
4c957bb466136bed609f25255806515087abb50ea549244e840d27b99e5819c59fd5c7b9634c8e0ab6f45e8d90bafc3838b38207d47d3abf8d0a38eb77bc1bc3

Download Submit
C:\Windows\system\uTKvxSk.exe

Filesize
2.2MB

MD5
218a24dccf3c9e76b7a9dbf7a4dc7080

SHA1
b0f7fcdf7a3b5836aa75cca96b8f2ed721604908

SHA256
4f47d71beff2b40701b29cb5173ea4ef4dbfd534b12aad856ab8ba332de3a57a

SHA512
60cc8a5f2426b21ecd24fc0fbaf50dccb623f599d6193db3989fb2ad4b517a2298d5e4c437d9c1ad45c8e0f46f57f8fb7087d14dc5c6ebb8efc1ffcfb12f5e11

Download Submit
C:\Windows\system\voBTjbJ.exe

Filesize
2.2MB

MD5
75aeb84f1668736925a3b932e6b325a9

SHA1
6af54c8f5db847a2c91fcdc6facecf8e823414eb

SHA256
3041a81397c77d730c9e0cca66358afa65080dee8b9e92d3d58ae088816ae0d0

SHA512
92fe5997fdef46aed2a8cf29c3840625a54762381fbd69c9ece6d6d450b716d3b9212a66e7e6e5229d05ef3cf31da20020570bded1ca325b68963ab60bdda723

Download Submit
C:\Windows\system\zdLsYhK.exe

Filesize
2.2MB

MD5
776e471578df473586f5d7d7ee8919c5

SHA1
9ba8c03b578ad4bc9cf0450114d091dd9a1b1618

SHA256
94ec2f2a554bad14ab46a078f97f93ec2424f02470089b2ffd9a97549503bff1

SHA512
0842c45f1a24fced2a6c0572a9dacb74b321ec65a701df8b9f1fa600edad0a3b44c05e176b4481f8b5b097185ac3fbd32874a9f094398cc5b8393fa326f21dba

Download Submit
C:\Windows\system\zuubKMX.exe

Filesize
2.2MB

MD5
9a5e8cc4004ea407cb2c1b1f1ffd4b60

SHA1
b4f3df3fb189de173aadc3defcb22f5fa7e5e38d

SHA256
4677fc084e0966e6fe8750060eb74f3155cc08f82ee266d298dcb53fdad498b0

SHA512
8561e6727bb4f59a285af535bb5d7f63630dad1c2d0c728da5fc105b10850e7a4667af43edd55c8a6a43decfc2dedfbed9af8fbb034ff5e4e2221c3e54458fc4

Download Submit
\Windows\system\IRIiyTh.exe

Filesize
2.2MB

MD5
8bef346483affb58cc5694a3ade15d65

SHA1
91cc8ee638dfa6ddb9480691b95aad37e4d7e2fe

SHA256
f96451989d86e16e4360fdc9d7233f141ec6205483bb173f23498e9b14deae7a

SHA512
35ff3f91e2c42f01187592ffd6e9e4d0ab8610899fe67fb58dc2b380da90923f2694990764e0c7162b7e87ef5715dc69352550249989441b2a9d899b462076f5

Download Submit
\Windows\system\bTAaFhq.exe

Filesize
2.2MB

MD5
f69fe1ac18ec4ca4d1ca954cdd8d96ae

SHA1
8e0d2fc610eaa15f423557718f0cde386f9d93fe

SHA256
e7ab32fa377b6f455f134b6548f3e8f418e911a65ddab54453f978c4a32a02dc

SHA512
d63c1593f97e5e1be9266f3d62e7f4759c38ba70b41fddca50e5386a75ec6d8a64156b529aa827307f4bc5573f1f763936e5841de3f138937ce0f80a3c061542

Download Submit
\Windows\system\czwEZgV.exe

Filesize
2.2MB

MD5
5d31cb67580c76b608c3b3f6d0b0c95c

SHA1
93e10eb0722d07006f143ecd2d938eeb251f4543

SHA256
cdce90f39c4c3989a978be67c737d6e5164a039b81a1376f750b9faf26dfbc22

SHA512
d287ceb98970ab3075b79622454371b477b0eea62cc39f7e14dfcffe243537730a25c0d12eba6ab495993871596e0e2baa509aca93dc6e259e38c0fe848f7bb5

Download Submit
\Windows\system\rwYDODI.exe

Filesize
2.2MB

MD5
e8e75485d6408d5c173074c012fc89a5

SHA1
f1a5b4d4b60938a61d24fb1ecf1e5cbdd31dc345

SHA256
e6ec83365cf40d93313834a3893cc1f80f45bbd8f6d8e1f7b0a486580a65ae54

SHA512
c69c5357ea87f4f0e3d1ae3ecb14e789d5dd665847b3e1f4315d10a3bc5f1c63367008a0e9b36ab17a7c73cdc0d2808cdaca0f165093e2a9c405be38ef804f96

Download Submit
memory/1696-2864-0x000000013F8C0000-0x000000013FC14000-memory.dmp

Filesize
3.3MB

Download
memory/1696-95-0x000000013F8C0000-0x000000013FC14000-memory.dmp

Filesize
3.3MB

Download
memory/1696-4014-0x000000013F8C0000-0x000000013FC14000-memory.dmp

Filesize
3.3MB

Download
memory/2080-55-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2080-4005-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2084-4004-0x000000013FA20000-0x000000013FD74000-memory.dmp

Filesize
3.3MB

Download
memory/2084-50-0x000000013FA20000-0x000000013FD74000-memory.dmp

Filesize
3.3MB

Download
memory/2200-1094-0x000000013FD80000-0x00000001400D4000-memory.dmp

Filesize
3.3MB

Download
memory/2200-64-0x000000013FD80000-0x00000001400D4000-memory.dmp

Filesize
3.3MB

Download
memory/2200-4013-0x000000013FD80000-0x00000001400D4000-memory.dmp

Filesize
3.3MB

Download
memory/2216-61-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/2216-4007-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/2228-2731-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/2228-89-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/2228-4015-0x000000013FBD0000-0x000000013FF24000-memory.dmp

Filesize
3.3MB

Download
memory/2440-4003-0x000000013F5D0000-0x000000013F924000-memory.dmp

Filesize
3.3MB

Download
memory/2440-48-0x000000013F5D0000-0x000000013F924000-memory.dmp

Filesize
3.3MB

Download
memory/2444-52-0x000000013F430000-0x000000013F784000-memory.dmp

Filesize
3.3MB

Download
memory/2444-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2444-14-0x000000013F9C0000-0x000000013FD14000-memory.dmp

Filesize
3.3MB

Download
memory/2444-80-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2444-59-0x0000000002010000-0x0000000002364000-memory.dmp

Filesize
3.3MB

Download
memory/2444-3038-0x0000000002010000-0x0000000002364000-memory.dmp

Filesize
3.3MB

Download
memory/2444-750-0x0000000002010000-0x0000000002364000-memory.dmp

Filesize
3.3MB

Download
memory/2444-53-0x0000000002010000-0x0000000002364000-memory.dmp

Filesize
3.3MB

Download
memory/2444-58-0x0000000002010000-0x0000000002364000-memory.dmp

Filesize
3.3MB

Download
memory/2444-54-0x000000013F190000-0x000000013F4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2444-0-0x000000013FDB0000-0x0000000140104000-memory.dmp

Filesize
3.3MB

Download
memory/2444-87-0x0000000002010000-0x0000000002364000-memory.dmp

Filesize
3.3MB

Download
memory/2444-8-0x0000000002010000-0x0000000002364000-memory.dmp

Filesize
3.3MB

Download
memory/2444-33-0x000000013F5D0000-0x000000013F924000-memory.dmp

Filesize
3.3MB

Download
memory/2444-2568-0x0000000002010000-0x0000000002364000-memory.dmp

Filesize
3.3MB

Download
memory/2444-94-0x000000013FDB0000-0x0000000140104000-memory.dmp

Filesize
3.3MB

Download
memory/2608-4010-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/2608-1095-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/2608-65-0x000000013FD10000-0x0000000140064000-memory.dmp

Filesize
3.3MB

Download
memory/2624-4006-0x000000013F430000-0x000000013F784000-memory.dmp

Filesize
3.3MB

Download
memory/2624-60-0x000000013F430000-0x000000013F784000-memory.dmp

Filesize
3.3MB

Download
memory/2628-81-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2628-2497-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2628-4011-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-75-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2652-2347-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4012-0x000000013F8D0000-0x000000013FC24000-memory.dmp

Filesize
3.3MB

Download
memory/2664-4009-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2664-1544-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2664-69-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2744-56-0x000000013F190000-0x000000013F4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2744-4008-0x000000013F190000-0x000000013F4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2932-4002-0x000000013F9C0000-0x000000013FD14000-memory.dmp

Filesize
3.3MB

Download
memory/2932-57-0x000000013F9C0000-0x000000013FD14000-memory.dmp

Filesize
3.3MB

Download