xmrig | 22dd9e765b4c4387130794d0c4e52d9b1d865b621fb5af6efd5a7031796e04f9

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
Size

2.1MB
MD5

536237cf0f5f44b490565d79c76e7710
SHA1

ec8ceb3b0795851bcdd686574eb17a1aa62b56b7
SHA256

22dd9e765b4c4387130794d0c4e52d9b1d865b621fb5af6efd5a7031796e04f9
SHA512

0aad04dc8339da9c04ffd334e630b80c07f3ef9793468e8181a6615bf47ad793481910a998b417f58035d127b71cbddb637cba0b86a915ace61fed72c13aed89
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+A8JhP70M+:oemTLkNdfE0pZrE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1664-2-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/files/0x000b0000000144e0-3.dat	xmrig
behavioral1/memory/2156-9-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/files/0x003400000001480e-10.dat	xmrig
behavioral1/memory/2604-28-0x000000013F780000-0x000000013FAD4000-memory.dmp	xmrig
behavioral1/files/0x000700000001502c-29.dat	xmrig
behavioral1/memory/2536-43-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/memory/2520-44-0x000000013F210000-0x000000013F564000-memory.dmp	xmrig
behavioral1/memory/2796-38-0x000000013F400000-0x000000013F754000-memory.dmp	xmrig
behavioral1/files/0x0007000000014eb9-34.dat	xmrig
behavioral1/files/0x0007000000014dae-30.dat	xmrig
behavioral1/memory/2956-24-0x000000013FAD0000-0x000000013FE24000-memory.dmp	xmrig
behavioral1/files/0x000e000000014ba7-18.dat	xmrig
behavioral1/files/0x00340000000149e1-49.dat	xmrig
behavioral1/memory/2568-69-0x000000013F140000-0x000000013F494000-memory.dmp	xmrig
behavioral1/memory/2252-88-0x000000013F590000-0x000000013F8E4000-memory.dmp	xmrig
behavioral1/memory/2580-96-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/memory/2876-97-0x000000013FF90000-0x00000001402E4000-memory.dmp	xmrig
behavioral1/memory/632-95-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d24-103.dat	xmrig
behavioral1/files/0x00060000000160cc-137.dat	xmrig
behavioral1/files/0x00060000000162c9-147.dat	xmrig
behavioral1/files/0x0006000000016813-162.dat	xmrig
behavioral1/files/0x0006000000016c8c-186.dat	xmrig
behavioral1/memory/2796-1840-0x000000013F400000-0x000000013F754000-memory.dmp	xmrig
behavioral1/files/0x0006000000016c42-182.dat	xmrig
behavioral1/files/0x0006000000016c3a-177.dat	xmrig
behavioral1/files/0x0006000000016c1d-172.dat	xmrig
behavioral1/files/0x0006000000016a6f-167.dat	xmrig
behavioral1/files/0x000600000001654a-157.dat	xmrig
behavioral1/files/0x0006000000016476-153.dat	xmrig
behavioral1/files/0x00060000000161b3-142.dat	xmrig
behavioral1/files/0x0006000000015fa7-132.dat	xmrig
behavioral1/files/0x0006000000015f3c-127.dat	xmrig
behavioral1/files/0x0006000000015e6d-122.dat	xmrig
behavioral1/files/0x0006000000015e09-117.dat	xmrig
behavioral1/files/0x0006000000015d4c-112.dat	xmrig
behavioral1/files/0x0006000000015d44-106.dat	xmrig
behavioral1/memory/2472-101-0x000000013FB30000-0x000000013FE84000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cf5-89.dat	xmrig
behavioral1/memory/1664-86-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d0c-85.dat	xmrig
behavioral1/files/0x0006000000015ce3-84.dat	xmrig
behavioral1/files/0x0008000000015cce-83.dat	xmrig
behavioral1/files/0x0006000000015cd9-74.dat	xmrig
behavioral1/memory/2456-65-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/2652-58-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/files/0x000900000001540d-60.dat	xmrig
behavioral1/files/0x00070000000153c7-48.dat	xmrig
behavioral1/memory/2456-2703-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/2156-4012-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/2956-4013-0x000000013FAD0000-0x000000013FE24000-memory.dmp	xmrig
behavioral1/memory/2604-4014-0x000000013F780000-0x000000013FAD4000-memory.dmp	xmrig
behavioral1/memory/2536-4015-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/memory/2796-4016-0x000000013F400000-0x000000013F754000-memory.dmp	xmrig
behavioral1/memory/2520-4017-0x000000013F210000-0x000000013F564000-memory.dmp	xmrig
behavioral1/memory/2652-4018-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/2568-4019-0x000000013F140000-0x000000013F494000-memory.dmp	xmrig
behavioral1/memory/2252-4021-0x000000013F590000-0x000000013F8E4000-memory.dmp	xmrig
behavioral1/memory/2456-4020-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/2580-4022-0x000000013F9E0000-0x000000013FD34000-memory.dmp	xmrig
behavioral1/memory/2876-4023-0x000000013FF90000-0x00000001402E4000-memory.dmp	xmrig
behavioral1/memory/632-4024-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/memory/2472-4025-0x000000013FB30000-0x000000013FE84000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2156	wcRuCnG.exe
2956	iTYrrTp.exe
2604	BMmcqBw.exe
2796	tVOUvmv.exe
2536	xlnNOyG.exe
2520	YYimdEz.exe
2568	BYAUaqX.exe
2652	pFFyCZw.exe
2456	rldrunp.exe
2252	peJsbOZ.exe
2876	GuNQsmJ.exe
632	pLDVMeF.exe
2580	EuaaNRW.exe
2472	sWtOchT.exe
2292	qSeSATX.exe
1616	TLVrddt.exe
1572	LVbAgrK.exe
1624	NEmEbNY.exe
1844	qEYeAuv.exe
1564	ObxQBEb.exe
1468	tvkcXjc.exe
2168	pGeAybd.exe
1264	QNezYGi.exe
856	uHkFKMw.exe
2080	mxOVlYE.exe
608	aJLMTsT.exe
488	SajvdXR.exe
1428	btEtqYt.exe
564	SgBAQSp.exe
1832	zmdrhLa.exe
1096	JdRfHcQ.exe
2932	hdZpVYK.exe
412	fZiSfSq.exe
2276	VqdlSZA.exe
1064	jCmexMC.exe
3060	TXEViJD.exe
692	qEIKQhw.exe
1492	XDENgBB.exe
980	rXJQSMb.exe
1012	MKEpWxA.exe
2124	qRerOPo.exe
380	QnZZxNA.exe
968	MyVLPTQ.exe
1072	fiHFFca.exe
1888	IXfXFFI.exe
1632	oNhpDfJ.exe
1944	ingoMpX.exe
996	ysuywMY.exe
2280	XCzQDRj.exe
1548	aHgTLKW.exe
2004	GPihahh.exe
904	WqYBGbR.exe
1604	xVkWoAz.exe
2028	VpuzPHl.exe
2832	WxQbkQZ.exe
1508	XAxhQfY.exe
1540	eJmnzGJ.exe
3004	uYgkanK.exe
2628	DgdasRU.exe
2528	mfHQRUI.exe
2012	cAJCqVo.exe
2416	TlZrkQw.exe
2680	qyppkqN.exe
2880	SZcsTpD.exe

Loads dropped DLL 64 IoCs

pid	Process
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-2-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/files/0x000b0000000144e0-3.dat	upx
behavioral1/memory/2156-9-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/files/0x003400000001480e-10.dat	upx
behavioral1/memory/2604-28-0x000000013F780000-0x000000013FAD4000-memory.dmp	upx
behavioral1/files/0x000700000001502c-29.dat	upx
behavioral1/memory/2536-43-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/2520-44-0x000000013F210000-0x000000013F564000-memory.dmp	upx
behavioral1/memory/2796-38-0x000000013F400000-0x000000013F754000-memory.dmp	upx
behavioral1/memory/1664-35-0x0000000001F70000-0x00000000022C4000-memory.dmp	upx
behavioral1/files/0x0007000000014eb9-34.dat	upx
behavioral1/files/0x0007000000014dae-30.dat	upx
behavioral1/memory/2956-24-0x000000013FAD0000-0x000000013FE24000-memory.dmp	upx
behavioral1/files/0x000e000000014ba7-18.dat	upx
behavioral1/files/0x00340000000149e1-49.dat	upx
behavioral1/memory/2568-69-0x000000013F140000-0x000000013F494000-memory.dmp	upx
behavioral1/memory/2252-88-0x000000013F590000-0x000000013F8E4000-memory.dmp	upx
behavioral1/memory/2580-96-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/memory/2876-97-0x000000013FF90000-0x00000001402E4000-memory.dmp	upx
behavioral1/memory/632-95-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/files/0x0006000000015d24-103.dat	upx
behavioral1/files/0x00060000000160cc-137.dat	upx
behavioral1/files/0x00060000000162c9-147.dat	upx
behavioral1/files/0x0006000000016813-162.dat	upx
behavioral1/files/0x0006000000016c8c-186.dat	upx
behavioral1/memory/2796-1840-0x000000013F400000-0x000000013F754000-memory.dmp	upx
behavioral1/files/0x0006000000016c42-182.dat	upx
behavioral1/files/0x0006000000016c3a-177.dat	upx
behavioral1/files/0x0006000000016c1d-172.dat	upx
behavioral1/files/0x0006000000016a6f-167.dat	upx
behavioral1/files/0x000600000001654a-157.dat	upx
behavioral1/files/0x0006000000016476-153.dat	upx
behavioral1/files/0x00060000000161b3-142.dat	upx
behavioral1/files/0x0006000000015fa7-132.dat	upx
behavioral1/files/0x0006000000015f3c-127.dat	upx
behavioral1/files/0x0006000000015e6d-122.dat	upx
behavioral1/files/0x0006000000015e09-117.dat	upx
behavioral1/files/0x0006000000015d4c-112.dat	upx
behavioral1/files/0x0006000000015d44-106.dat	upx
behavioral1/memory/2472-101-0x000000013FB30000-0x000000013FE84000-memory.dmp	upx
behavioral1/files/0x0006000000015cf5-89.dat	upx
behavioral1/memory/1664-86-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/files/0x0006000000015d0c-85.dat	upx
behavioral1/files/0x0006000000015ce3-84.dat	upx
behavioral1/files/0x0008000000015cce-83.dat	upx
behavioral1/files/0x0006000000015cd9-74.dat	upx
behavioral1/memory/2456-65-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/memory/2652-58-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/files/0x000900000001540d-60.dat	upx
behavioral1/files/0x00070000000153c7-48.dat	upx
behavioral1/memory/2456-2703-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/memory/2156-4012-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/memory/2956-4013-0x000000013FAD0000-0x000000013FE24000-memory.dmp	upx
behavioral1/memory/2604-4014-0x000000013F780000-0x000000013FAD4000-memory.dmp	upx
behavioral1/memory/2536-4015-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/2796-4016-0x000000013F400000-0x000000013F754000-memory.dmp	upx
behavioral1/memory/2520-4017-0x000000013F210000-0x000000013F564000-memory.dmp	upx
behavioral1/memory/2652-4018-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/2568-4019-0x000000013F140000-0x000000013F494000-memory.dmp	upx
behavioral1/memory/2252-4021-0x000000013F590000-0x000000013F8E4000-memory.dmp	upx
behavioral1/memory/2456-4020-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/memory/2580-4022-0x000000013F9E0000-0x000000013FD34000-memory.dmp	upx
behavioral1/memory/2876-4023-0x000000013FF90000-0x00000001402E4000-memory.dmp	upx
behavioral1/memory/632-4024-0x000000013F220000-0x000000013F574000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TlZrkQw.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\dFmIdxh.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\BDYThXE.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\HcKNOfn.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\Vyubmqa.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\hxmMFNW.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\VWJIcqX.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\rjNqALQ.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\haAdZgc.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\UoIpFny.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\RbvEaXj.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\hkcaBIn.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\MyVLPTQ.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\giLlRhQ.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\VlclHoj.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\DTuWZvL.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\RmSzHIf.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\COkpjMO.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\bDNlJcB.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\dPsSRVX.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\lQkgOrU.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\enBTMup.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\qAHhQwK.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\SoMDcTH.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\yUffDJe.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\pwmPEKY.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\czMCMSS.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\TqIdCcN.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\Dsyceao.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\OtDwpCf.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\tCoeTuG.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\hNEJaYw.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\LPFbXOR.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\yWNPbUu.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\MgWBLlC.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\jPgRlCl.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\DLOBvTU.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\cmkjfXl.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\PAMzzNp.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\jGynBVB.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\YMeFRYb.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\OoatiRK.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\MqJmHRX.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\tztiQKy.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\NZSpGeV.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\fIVhGYU.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\brxzXBE.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\MMjKlvW.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\vfFxrBZ.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\bPKRVtV.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\hEBLbrD.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\gWWmpez.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\lSMWzuq.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\SlhrEKz.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\lvjNhCU.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\OKSZTuD.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\NUSpcoq.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\oeScJZX.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\edNhmdl.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\LUjmNRd.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\qwXdwuf.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\mxXJTgJ.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\ctYrHjQ.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
File created	C:\Windows\System\DonfTBJ.exe	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2156	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	29
PID 1664 wrote to memory of 2156	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	29
PID 1664 wrote to memory of 2156	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	29
PID 1664 wrote to memory of 2956	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	30
PID 1664 wrote to memory of 2956	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	30
PID 1664 wrote to memory of 2956	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	30
PID 1664 wrote to memory of 2604	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	31
PID 1664 wrote to memory of 2604	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	31
PID 1664 wrote to memory of 2604	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	31
PID 1664 wrote to memory of 2796	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	32
PID 1664 wrote to memory of 2796	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	32
PID 1664 wrote to memory of 2796	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	32
PID 1664 wrote to memory of 2536	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	33
PID 1664 wrote to memory of 2536	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	33
PID 1664 wrote to memory of 2536	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	33
PID 1664 wrote to memory of 2520	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	34
PID 1664 wrote to memory of 2520	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	34
PID 1664 wrote to memory of 2520	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	34
PID 1664 wrote to memory of 2568	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	35
PID 1664 wrote to memory of 2568	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	35
PID 1664 wrote to memory of 2568	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	35
PID 1664 wrote to memory of 2652	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	36
PID 1664 wrote to memory of 2652	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	36
PID 1664 wrote to memory of 2652	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	36
PID 1664 wrote to memory of 2456	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	37
PID 1664 wrote to memory of 2456	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	37
PID 1664 wrote to memory of 2456	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	37
PID 1664 wrote to memory of 2876	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	38
PID 1664 wrote to memory of 2876	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	38
PID 1664 wrote to memory of 2876	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	38
PID 1664 wrote to memory of 2252	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	39
PID 1664 wrote to memory of 2252	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	39
PID 1664 wrote to memory of 2252	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	39
PID 1664 wrote to memory of 632	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	40
PID 1664 wrote to memory of 632	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	40
PID 1664 wrote to memory of 632	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	40
PID 1664 wrote to memory of 2472	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	41
PID 1664 wrote to memory of 2472	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	41
PID 1664 wrote to memory of 2472	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	41
PID 1664 wrote to memory of 2580	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	42
PID 1664 wrote to memory of 2580	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	42
PID 1664 wrote to memory of 2580	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	42
PID 1664 wrote to memory of 2292	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	43
PID 1664 wrote to memory of 2292	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	43
PID 1664 wrote to memory of 2292	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	43
PID 1664 wrote to memory of 1616	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	44
PID 1664 wrote to memory of 1616	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	44
PID 1664 wrote to memory of 1616	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	44
PID 1664 wrote to memory of 1572	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	45
PID 1664 wrote to memory of 1572	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	45
PID 1664 wrote to memory of 1572	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	45
PID 1664 wrote to memory of 1624	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	46
PID 1664 wrote to memory of 1624	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	46
PID 1664 wrote to memory of 1624	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	46
PID 1664 wrote to memory of 1844	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	47
PID 1664 wrote to memory of 1844	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	47
PID 1664 wrote to memory of 1844	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	47
PID 1664 wrote to memory of 1564	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	48
PID 1664 wrote to memory of 1564	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	48
PID 1664 wrote to memory of 1564	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	48
PID 1664 wrote to memory of 1468	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	49
PID 1664 wrote to memory of 1468	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	49
PID 1664 wrote to memory of 1468	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	49
PID 1664 wrote to memory of 2168	1664	536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\536237cf0f5f44b490565d79c76e7710_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System\wcRuCnG.exe
  C:\Windows\System\wcRuCnG.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\iTYrrTp.exe
  C:\Windows\System\iTYrrTp.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\BMmcqBw.exe
  C:\Windows\System\BMmcqBw.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\tVOUvmv.exe
  C:\Windows\System\tVOUvmv.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\xlnNOyG.exe
  C:\Windows\System\xlnNOyG.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\YYimdEz.exe
  C:\Windows\System\YYimdEz.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\BYAUaqX.exe
  C:\Windows\System\BYAUaqX.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\pFFyCZw.exe
  C:\Windows\System\pFFyCZw.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\rldrunp.exe
  C:\Windows\System\rldrunp.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\GuNQsmJ.exe
  C:\Windows\System\GuNQsmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\peJsbOZ.exe
  C:\Windows\System\peJsbOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\pLDVMeF.exe
  C:\Windows\System\pLDVMeF.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\sWtOchT.exe
  C:\Windows\System\sWtOchT.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\EuaaNRW.exe
  C:\Windows\System\EuaaNRW.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\qSeSATX.exe
  C:\Windows\System\qSeSATX.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\TLVrddt.exe
  C:\Windows\System\TLVrddt.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\LVbAgrK.exe
  C:\Windows\System\LVbAgrK.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\NEmEbNY.exe
  C:\Windows\System\NEmEbNY.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\qEYeAuv.exe
  C:\Windows\System\qEYeAuv.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ObxQBEb.exe
  C:\Windows\System\ObxQBEb.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\tvkcXjc.exe
  C:\Windows\System\tvkcXjc.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\pGeAybd.exe
  C:\Windows\System\pGeAybd.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\QNezYGi.exe
  C:\Windows\System\QNezYGi.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\uHkFKMw.exe
  C:\Windows\System\uHkFKMw.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\mxOVlYE.exe
  C:\Windows\System\mxOVlYE.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\aJLMTsT.exe
  C:\Windows\System\aJLMTsT.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\SajvdXR.exe
  C:\Windows\System\SajvdXR.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\btEtqYt.exe
  C:\Windows\System\btEtqYt.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\SgBAQSp.exe
  C:\Windows\System\SgBAQSp.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\zmdrhLa.exe
  C:\Windows\System\zmdrhLa.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\JdRfHcQ.exe
  C:\Windows\System\JdRfHcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\hdZpVYK.exe
  C:\Windows\System\hdZpVYK.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\fZiSfSq.exe
  C:\Windows\System\fZiSfSq.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\VqdlSZA.exe
  C:\Windows\System\VqdlSZA.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\jCmexMC.exe
  C:\Windows\System\jCmexMC.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\TXEViJD.exe
  C:\Windows\System\TXEViJD.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\qEIKQhw.exe
  C:\Windows\System\qEIKQhw.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\XDENgBB.exe
  C:\Windows\System\XDENgBB.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\rXJQSMb.exe
  C:\Windows\System\rXJQSMb.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\MKEpWxA.exe
  C:\Windows\System\MKEpWxA.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\qRerOPo.exe
  C:\Windows\System\qRerOPo.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\QnZZxNA.exe
  C:\Windows\System\QnZZxNA.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\MyVLPTQ.exe
  C:\Windows\System\MyVLPTQ.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\fiHFFca.exe
  C:\Windows\System\fiHFFca.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\IXfXFFI.exe
  C:\Windows\System\IXfXFFI.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\oNhpDfJ.exe
  C:\Windows\System\oNhpDfJ.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\ingoMpX.exe
  C:\Windows\System\ingoMpX.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\ysuywMY.exe
  C:\Windows\System\ysuywMY.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\XCzQDRj.exe
  C:\Windows\System\XCzQDRj.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\aHgTLKW.exe
  C:\Windows\System\aHgTLKW.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\GPihahh.exe
  C:\Windows\System\GPihahh.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\WqYBGbR.exe
  C:\Windows\System\WqYBGbR.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\xVkWoAz.exe
  C:\Windows\System\xVkWoAz.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\VpuzPHl.exe
  C:\Windows\System\VpuzPHl.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\WxQbkQZ.exe
  C:\Windows\System\WxQbkQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\XAxhQfY.exe
  C:\Windows\System\XAxhQfY.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\eJmnzGJ.exe
  C:\Windows\System\eJmnzGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\uYgkanK.exe
  C:\Windows\System\uYgkanK.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\DgdasRU.exe
  C:\Windows\System\DgdasRU.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\mfHQRUI.exe
  C:\Windows\System\mfHQRUI.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\cAJCqVo.exe
  C:\Windows\System\cAJCqVo.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\TlZrkQw.exe
  C:\Windows\System\TlZrkQw.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\qyppkqN.exe
  C:\Windows\System\qyppkqN.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\SZcsTpD.exe
  C:\Windows\System\SZcsTpD.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\hoBypch.exe
  C:\Windows\System\hoBypch.exe
  2⤵
  PID:2684
- C:\Windows\System\ZudtltO.exe
  C:\Windows\System\ZudtltO.exe
  2⤵
  PID:1644
- C:\Windows\System\IxtCkJL.exe
  C:\Windows\System\IxtCkJL.exe
  2⤵
  PID:2288
- C:\Windows\System\lvePdEi.exe
  C:\Windows\System\lvePdEi.exe
  2⤵
  PID:1588
- C:\Windows\System\LzYVByA.exe
  C:\Windows\System\LzYVByA.exe
  2⤵
  PID:1808
- C:\Windows\System\QLAwLhW.exe
  C:\Windows\System\QLAwLhW.exe
  2⤵
  PID:852
- C:\Windows\System\QuvXRWQ.exe
  C:\Windows\System\QuvXRWQ.exe
  2⤵
  PID:296
- C:\Windows\System\NWFdMiD.exe
  C:\Windows\System\NWFdMiD.exe
  2⤵
  PID:1708
- C:\Windows\System\BpSdHdj.exe
  C:\Windows\System\BpSdHdj.exe
  2⤵
  PID:2816
- C:\Windows\System\WVgOEXo.exe
  C:\Windows\System\WVgOEXo.exe
  2⤵
  PID:384
- C:\Windows\System\XePkzli.exe
  C:\Windows\System\XePkzli.exe
  2⤵
  PID:1080
- C:\Windows\System\zZphlIR.exe
  C:\Windows\System\zZphlIR.exe
  2⤵
  PID:1828
- C:\Windows\System\cXlYtDX.exe
  C:\Windows\System\cXlYtDX.exe
  2⤵
  PID:1684
- C:\Windows\System\EuIOnRs.exe
  C:\Windows\System\EuIOnRs.exe
  2⤵
  PID:3040
- C:\Windows\System\MsrATZN.exe
  C:\Windows\System\MsrATZN.exe
  2⤵
  PID:1128
- C:\Windows\System\FunMUHp.exe
  C:\Windows\System\FunMUHp.exe
  2⤵
  PID:3056
- C:\Windows\System\wrzZsZF.exe
  C:\Windows\System\wrzZsZF.exe
  2⤵
  PID:1480
- C:\Windows\System\QVCSCqS.exe
  C:\Windows\System\QVCSCqS.exe
  2⤵
  PID:1232
- C:\Windows\System\bDNlJcB.exe
  C:\Windows\System\bDNlJcB.exe
  2⤵
  PID:1556
- C:\Windows\System\gBTtNRA.exe
  C:\Windows\System\gBTtNRA.exe
  2⤵
  PID:344
- C:\Windows\System\ntZnKue.exe
  C:\Windows\System\ntZnKue.exe
  2⤵
  PID:2224
- C:\Windows\System\SkrjVBl.exe
  C:\Windows\System\SkrjVBl.exe
  2⤵
  PID:1092
- C:\Windows\System\swhkVjE.exe
  C:\Windows\System\swhkVjE.exe
  2⤵
  PID:936
- C:\Windows\System\HSQsWBA.exe
  C:\Windows\System\HSQsWBA.exe
  2⤵
  PID:2352
- C:\Windows\System\xKIdQLb.exe
  C:\Windows\System\xKIdQLb.exe
  2⤵
  PID:2728
- C:\Windows\System\ArkqxBY.exe
  C:\Windows\System\ArkqxBY.exe
  2⤵
  PID:2084
- C:\Windows\System\BAPBczQ.exe
  C:\Windows\System\BAPBczQ.exe
  2⤵
  PID:2484
- C:\Windows\System\iXzMcUu.exe
  C:\Windows\System\iXzMcUu.exe
  2⤵
  PID:1940
- C:\Windows\System\vGmpSIB.exe
  C:\Windows\System\vGmpSIB.exe
  2⤵
  PID:2904
- C:\Windows\System\giLlRhQ.exe
  C:\Windows\System\giLlRhQ.exe
  2⤵
  PID:2616
- C:\Windows\System\bBpzuHa.exe
  C:\Windows\System\bBpzuHa.exe
  2⤵
  PID:2496
- C:\Windows\System\OdGshoW.exe
  C:\Windows\System\OdGshoW.exe
  2⤵
  PID:2720
- C:\Windows\System\aczmbPz.exe
  C:\Windows\System\aczmbPz.exe
  2⤵
  PID:2644
- C:\Windows\System\UGIYVLp.exe
  C:\Windows\System\UGIYVLp.exe
  2⤵
  PID:2676
- C:\Windows\System\NnHBTRU.exe
  C:\Windows\System\NnHBTRU.exe
  2⤵
  PID:2864
- C:\Windows\System\FFyEYzV.exe
  C:\Windows\System\FFyEYzV.exe
  2⤵
  PID:1908
- C:\Windows\System\uxeJxpQ.exe
  C:\Windows\System\uxeJxpQ.exe
  2⤵
  PID:1496
- C:\Windows\System\hqLnCOy.exe
  C:\Windows\System\hqLnCOy.exe
  2⤵
  PID:1028
- C:\Windows\System\DPGwHSc.exe
  C:\Windows\System\DPGwHSc.exe
  2⤵
  PID:2160
- C:\Windows\System\olOilob.exe
  C:\Windows\System\olOilob.exe
  2⤵
  PID:1424
- C:\Windows\System\MkuDBLO.exe
  C:\Windows\System\MkuDBLO.exe
  2⤵
  PID:2820
- C:\Windows\System\qhwmcdk.exe
  C:\Windows\System\qhwmcdk.exe
  2⤵
  PID:2376
- C:\Windows\System\Upsrjxv.exe
  C:\Windows\System\Upsrjxv.exe
  2⤵
  PID:1928
- C:\Windows\System\tJtgEwa.exe
  C:\Windows\System\tJtgEwa.exe
  2⤵
  PID:2040
- C:\Windows\System\nQnWmtX.exe
  C:\Windows\System\nQnWmtX.exe
  2⤵
  PID:1932
- C:\Windows\System\kemncBW.exe
  C:\Windows\System\kemncBW.exe
  2⤵
  PID:320
- C:\Windows\System\boefvPT.exe
  C:\Windows\System\boefvPT.exe
  2⤵
  PID:1672
- C:\Windows\System\tmwGCOO.exe
  C:\Windows\System\tmwGCOO.exe
  2⤵
  PID:1584
- C:\Windows\System\KYsYEYw.exe
  C:\Windows\System\KYsYEYw.exe
  2⤵
  PID:1688
- C:\Windows\System\psayjIM.exe
  C:\Windows\System\psayjIM.exe
  2⤵
  PID:2312
- C:\Windows\System\zPQZvAe.exe
  C:\Windows\System\zPQZvAe.exe
  2⤵
  PID:2268
- C:\Windows\System\DonfTBJ.exe
  C:\Windows\System\DonfTBJ.exe
  2⤵
  PID:1984
- C:\Windows\System\Jxtzafq.exe
  C:\Windows\System\Jxtzafq.exe
  2⤵
  PID:2120
- C:\Windows\System\onRmCam.exe
  C:\Windows\System\onRmCam.exe
  2⤵
  PID:2548
- C:\Windows\System\XBOKXgj.exe
  C:\Windows\System\XBOKXgj.exe
  2⤵
  PID:2192
- C:\Windows\System\kkrZUVw.exe
  C:\Windows\System\kkrZUVw.exe
  2⤵
  PID:1760
- C:\Windows\System\ujXREAk.exe
  C:\Windows\System\ujXREAk.exe
  2⤵
  PID:1552
- C:\Windows\System\xItuPJQ.exe
  C:\Windows\System\xItuPJQ.exe
  2⤵
  PID:2804
- C:\Windows\System\sVRzVwo.exe
  C:\Windows\System\sVRzVwo.exe
  2⤵
  PID:1980
- C:\Windows\System\eXyAtqF.exe
  C:\Windows\System\eXyAtqF.exe
  2⤵
  PID:1892
- C:\Windows\System\VyIddYU.exe
  C:\Windows\System\VyIddYU.exe
  2⤵
  PID:1692
- C:\Windows\System\VDWiClb.exe
  C:\Windows\System\VDWiClb.exe
  2⤵
  PID:3036
- C:\Windows\System\kSHVfFN.exe
  C:\Windows\System\kSHVfFN.exe
  2⤵
  PID:2632
- C:\Windows\System\VEeSGNw.exe
  C:\Windows\System\VEeSGNw.exe
  2⤵
  PID:2828
- C:\Windows\System\TCERRXB.exe
  C:\Windows\System\TCERRXB.exe
  2⤵
  PID:2740
- C:\Windows\System\HCWudVn.exe
  C:\Windows\System\HCWudVn.exe
  2⤵
  PID:2284
- C:\Windows\System\amQmrwU.exe
  C:\Windows\System\amQmrwU.exe
  2⤵
  PID:2772
- C:\Windows\System\ygdlbHn.exe
  C:\Windows\System\ygdlbHn.exe
  2⤵
  PID:2316
- C:\Windows\System\NKiThpd.exe
  C:\Windows\System\NKiThpd.exe
  2⤵
  PID:2752
- C:\Windows\System\KnYTZfm.exe
  C:\Windows\System\KnYTZfm.exe
  2⤵
  PID:1544
- C:\Windows\System\hkXBkyZ.exe
  C:\Windows\System\hkXBkyZ.exe
  2⤵
  PID:704
- C:\Windows\System\CVlbEqF.exe
  C:\Windows\System\CVlbEqF.exe
  2⤵
  PID:1136
- C:\Windows\System\EJyjgDx.exe
  C:\Windows\System\EJyjgDx.exe
  2⤵
  PID:1016
- C:\Windows\System\mKcSxLC.exe
  C:\Windows\System\mKcSxLC.exe
  2⤵
  PID:2420
- C:\Windows\System\IfTXlbK.exe
  C:\Windows\System\IfTXlbK.exe
  2⤵
  PID:2636
- C:\Windows\System\ijqxxbh.exe
  C:\Windows\System\ijqxxbh.exe
  2⤵
  PID:1448
- C:\Windows\System\vJLcQRW.exe
  C:\Windows\System\vJLcQRW.exe
  2⤵
  PID:1700
- C:\Windows\System\pxomRPx.exe
  C:\Windows\System\pxomRPx.exe
  2⤵
  PID:2272
- C:\Windows\System\URaXkrb.exe
  C:\Windows\System\URaXkrb.exe
  2⤵
  PID:2400
- C:\Windows\System\qPuHFsL.exe
  C:\Windows\System\qPuHFsL.exe
  2⤵
  PID:2792
- C:\Windows\System\KkqGVRl.exe
  C:\Windows\System\KkqGVRl.exe
  2⤵
  PID:2712
- C:\Windows\System\MmcyLTU.exe
  C:\Windows\System\MmcyLTU.exe
  2⤵
  PID:2232
- C:\Windows\System\tUauIZJ.exe
  C:\Windows\System\tUauIZJ.exe
  2⤵
  PID:2708
- C:\Windows\System\zzcDyjj.exe
  C:\Windows\System\zzcDyjj.exe
  2⤵
  PID:2148
- C:\Windows\System\ZoWLHUz.exe
  C:\Windows\System\ZoWLHUz.exe
  2⤵
  PID:2492
- C:\Windows\System\kqzPowF.exe
  C:\Windows\System\kqzPowF.exe
  2⤵
  PID:2800
- C:\Windows\System\PGexlau.exe
  C:\Windows\System\PGexlau.exe
  2⤵
  PID:1600
- C:\Windows\System\tmdBrgP.exe
  C:\Windows\System\tmdBrgP.exe
  2⤵
  PID:1720
- C:\Windows\System\VlclHoj.exe
  C:\Windows\System\VlclHoj.exe
  2⤵
  PID:1336
- C:\Windows\System\SlhrEKz.exe
  C:\Windows\System\SlhrEKz.exe
  2⤵
  PID:1784
- C:\Windows\System\YvfAMyN.exe
  C:\Windows\System\YvfAMyN.exe
  2⤵
  PID:2248
- C:\Windows\System\rNseOKk.exe
  C:\Windows\System\rNseOKk.exe
  2⤵
  PID:2260
- C:\Windows\System\otPFydp.exe
  C:\Windows\System\otPFydp.exe
  2⤵
  PID:1704
- C:\Windows\System\HlrjFsH.exe
  C:\Windows\System\HlrjFsH.exe
  2⤵
  PID:820
- C:\Windows\System\YpMrxzE.exe
  C:\Windows\System\YpMrxzE.exe
  2⤵
  PID:1620
- C:\Windows\System\zasaakE.exe
  C:\Windows\System\zasaakE.exe
  2⤵
  PID:3088
- C:\Windows\System\vqYlmmx.exe
  C:\Windows\System\vqYlmmx.exe
  2⤵
  PID:3148
- C:\Windows\System\GmjalBZ.exe
  C:\Windows\System\GmjalBZ.exe
  2⤵
  PID:3168
- C:\Windows\System\nZMGTKE.exe
  C:\Windows\System\nZMGTKE.exe
  2⤵
  PID:3184
- C:\Windows\System\RFivxzP.exe
  C:\Windows\System\RFivxzP.exe
  2⤵
  PID:3200
- C:\Windows\System\Cupaoom.exe
  C:\Windows\System\Cupaoom.exe
  2⤵
  PID:3216
- C:\Windows\System\ipkeQkc.exe
  C:\Windows\System\ipkeQkc.exe
  2⤵
  PID:3232
- C:\Windows\System\djmFTtl.exe
  C:\Windows\System\djmFTtl.exe
  2⤵
  PID:3248
- C:\Windows\System\sMNdJJk.exe
  C:\Windows\System\sMNdJJk.exe
  2⤵
  PID:3276
- C:\Windows\System\MJlXYUp.exe
  C:\Windows\System\MJlXYUp.exe
  2⤵
  PID:3292
- C:\Windows\System\rYohMFj.exe
  C:\Windows\System\rYohMFj.exe
  2⤵
  PID:3312
- C:\Windows\System\bxbdEzc.exe
  C:\Windows\System\bxbdEzc.exe
  2⤵
  PID:3328
- C:\Windows\System\exBCKmn.exe
  C:\Windows\System\exBCKmn.exe
  2⤵
  PID:3344
- C:\Windows\System\PeaTpwN.exe
  C:\Windows\System\PeaTpwN.exe
  2⤵
  PID:3364
- C:\Windows\System\rTxVgJY.exe
  C:\Windows\System\rTxVgJY.exe
  2⤵
  PID:3380
- C:\Windows\System\WRfOsiY.exe
  C:\Windows\System\WRfOsiY.exe
  2⤵
  PID:3396
- C:\Windows\System\bGUcBiR.exe
  C:\Windows\System\bGUcBiR.exe
  2⤵
  PID:3420
- C:\Windows\System\gRANMwy.exe
  C:\Windows\System\gRANMwy.exe
  2⤵
  PID:3436
- C:\Windows\System\QSyjBup.exe
  C:\Windows\System\QSyjBup.exe
  2⤵
  PID:3456
- C:\Windows\System\UMsQHuZ.exe
  C:\Windows\System\UMsQHuZ.exe
  2⤵
  PID:3472
- C:\Windows\System\xuhZXUi.exe
  C:\Windows\System\xuhZXUi.exe
  2⤵
  PID:3488
- C:\Windows\System\FrbjygE.exe
  C:\Windows\System\FrbjygE.exe
  2⤵
  PID:3504
- C:\Windows\System\JhKWQRt.exe
  C:\Windows\System\JhKWQRt.exe
  2⤵
  PID:3524
- C:\Windows\System\ipucBRK.exe
  C:\Windows\System\ipucBRK.exe
  2⤵
  PID:3540
- C:\Windows\System\BFScGeB.exe
  C:\Windows\System\BFScGeB.exe
  2⤵
  PID:3556
- C:\Windows\System\fEDHAgU.exe
  C:\Windows\System\fEDHAgU.exe
  2⤵
  PID:3576
- C:\Windows\System\ByGeZdx.exe
  C:\Windows\System\ByGeZdx.exe
  2⤵
  PID:3592
- C:\Windows\System\FDpxtLX.exe
  C:\Windows\System\FDpxtLX.exe
  2⤵
  PID:3616
- C:\Windows\System\seDJxOr.exe
  C:\Windows\System\seDJxOr.exe
  2⤵
  PID:3632
- C:\Windows\System\JukWyjP.exe
  C:\Windows\System\JukWyjP.exe
  2⤵
  PID:3648
- C:\Windows\System\UDWecDm.exe
  C:\Windows\System\UDWecDm.exe
  2⤵
  PID:3664
- C:\Windows\System\bKbBCWW.exe
  C:\Windows\System\bKbBCWW.exe
  2⤵
  PID:3680
- C:\Windows\System\rwQbetr.exe
  C:\Windows\System\rwQbetr.exe
  2⤵
  PID:3712
- C:\Windows\System\qMuBkqR.exe
  C:\Windows\System\qMuBkqR.exe
  2⤵
  PID:3732
- C:\Windows\System\tbPduka.exe
  C:\Windows\System\tbPduka.exe
  2⤵
  PID:3752
- C:\Windows\System\sEvYgeA.exe
  C:\Windows\System\sEvYgeA.exe
  2⤵
  PID:3768
- C:\Windows\System\UkCQsvj.exe
  C:\Windows\System\UkCQsvj.exe
  2⤵
  PID:3788
- C:\Windows\System\OqhDLkh.exe
  C:\Windows\System\OqhDLkh.exe
  2⤵
  PID:3808
- C:\Windows\System\BZnpCWS.exe
  C:\Windows\System\BZnpCWS.exe
  2⤵
  PID:3824
- C:\Windows\System\zNesesz.exe
  C:\Windows\System\zNesesz.exe
  2⤵
  PID:3844
- C:\Windows\System\ZtezFRh.exe
  C:\Windows\System\ZtezFRh.exe
  2⤵
  PID:3976
- C:\Windows\System\AgcZojo.exe
  C:\Windows\System\AgcZojo.exe
  2⤵
  PID:3992
- C:\Windows\System\FLFQQaO.exe
  C:\Windows\System\FLFQQaO.exe
  2⤵
  PID:4008
- C:\Windows\System\dFmIdxh.exe
  C:\Windows\System\dFmIdxh.exe
  2⤵
  PID:4024
- C:\Windows\System\DTuWZvL.exe
  C:\Windows\System\DTuWZvL.exe
  2⤵
  PID:4040
- C:\Windows\System\OsFCktP.exe
  C:\Windows\System\OsFCktP.exe
  2⤵
  PID:4072
- C:\Windows\System\QIapfNQ.exe
  C:\Windows\System\QIapfNQ.exe
  2⤵
  PID:4088
- C:\Windows\System\hRICabC.exe
  C:\Windows\System\hRICabC.exe
  2⤵
  PID:688
- C:\Windows\System\eJhQvwc.exe
  C:\Windows\System\eJhQvwc.exe
  2⤵
  PID:2736
- C:\Windows\System\mpPyJZt.exe
  C:\Windows\System\mpPyJZt.exe
  2⤵
  PID:1796
- C:\Windows\System\DlxIiaP.exe
  C:\Windows\System\DlxIiaP.exe
  2⤵
  PID:2488
- C:\Windows\System\iazGgxv.exe
  C:\Windows\System\iazGgxv.exe
  2⤵
  PID:3096
- C:\Windows\System\UEfdOjm.exe
  C:\Windows\System\UEfdOjm.exe
  2⤵
  PID:2112
- C:\Windows\System\WogWmxC.exe
  C:\Windows\System\WogWmxC.exe
  2⤵
  PID:3112
- C:\Windows\System\vbNTeVy.exe
  C:\Windows\System\vbNTeVy.exe
  2⤵
  PID:3128
- C:\Windows\System\TOyFeWh.exe
  C:\Windows\System\TOyFeWh.exe
  2⤵
  PID:792
- C:\Windows\System\NMKtubs.exe
  C:\Windows\System\NMKtubs.exe
  2⤵
  PID:3140
- C:\Windows\System\jgLBRaj.exe
  C:\Windows\System\jgLBRaj.exe
  2⤵
  PID:3144
- C:\Windows\System\nVWuSex.exe
  C:\Windows\System\nVWuSex.exe
  2⤵
  PID:3212
- C:\Windows\System\fgIFCkW.exe
  C:\Windows\System\fgIFCkW.exe
  2⤵
  PID:3356
- C:\Windows\System\xJNZEgC.exe
  C:\Windows\System\xJNZEgC.exe
  2⤵
  PID:3432
- C:\Windows\System\ERiLwpb.exe
  C:\Windows\System\ERiLwpb.exe
  2⤵
  PID:3500
- C:\Windows\System\wnulVhT.exe
  C:\Windows\System\wnulVhT.exe
  2⤵
  PID:3564
- C:\Windows\System\pcJzzlL.exe
  C:\Windows\System\pcJzzlL.exe
  2⤵
  PID:3608
- C:\Windows\System\rIPJZjR.exe
  C:\Windows\System\rIPJZjR.exe
  2⤵
  PID:3256
- C:\Windows\System\lvjNhCU.exe
  C:\Windows\System\lvjNhCU.exe
  2⤵
  PID:3416
- C:\Windows\System\oAbaTez.exe
  C:\Windows\System\oAbaTez.exe
  2⤵
  PID:3484
- C:\Windows\System\lgKddho.exe
  C:\Windows\System\lgKddho.exe
  2⤵
  PID:3720
- C:\Windows\System\KlViGIm.exe
  C:\Windows\System\KlViGIm.exe
  2⤵
  PID:3760
- C:\Windows\System\VsIOtJn.exe
  C:\Windows\System\VsIOtJn.exe
  2⤵
  PID:3832
- C:\Windows\System\YylNNEf.exe
  C:\Windows\System\YylNNEf.exe
  2⤵
  PID:3304
- C:\Windows\System\oNxKsNM.exe
  C:\Windows\System\oNxKsNM.exe
  2⤵
  PID:3584
- C:\Windows\System\sRpuQSE.exe
  C:\Windows\System\sRpuQSE.exe
  2⤵
  PID:3444
- C:\Windows\System\dVmruHc.exe
  C:\Windows\System\dVmruHc.exe
  2⤵
  PID:3308
- C:\Windows\System\QwtDRwV.exe
  C:\Windows\System\QwtDRwV.exe
  2⤵
  PID:3264
- C:\Windows\System\hNEJaYw.exe
  C:\Windows\System\hNEJaYw.exe
  2⤵
  PID:3748
- C:\Windows\System\rTAJrcM.exe
  C:\Windows\System\rTAJrcM.exe
  2⤵
  PID:3816
- C:\Windows\System\CtbfCah.exe
  C:\Windows\System\CtbfCah.exe
  2⤵
  PID:3900
- C:\Windows\System\DHXDruf.exe
  C:\Windows\System\DHXDruf.exe
  2⤵
  PID:3920
- C:\Windows\System\GJipOHd.exe
  C:\Windows\System\GJipOHd.exe
  2⤵
  PID:3932
- C:\Windows\System\GKjYzaE.exe
  C:\Windows\System\GKjYzaE.exe
  2⤵
  PID:3948
- C:\Windows\System\uJjCodh.exe
  C:\Windows\System\uJjCodh.exe
  2⤵
  PID:3964
- C:\Windows\System\nVuWVbM.exe
  C:\Windows\System\nVuWVbM.exe
  2⤵
  PID:4020
- C:\Windows\System\hKcUEcz.exe
  C:\Windows\System\hKcUEcz.exe
  2⤵
  PID:4060
- C:\Windows\System\RmSzHIf.exe
  C:\Windows\System\RmSzHIf.exe
  2⤵
  PID:4000
- C:\Windows\System\IyhpLxp.exe
  C:\Windows\System\IyhpLxp.exe
  2⤵
  PID:2872
- C:\Windows\System\nNKSbys.exe
  C:\Windows\System\nNKSbys.exe
  2⤵
  PID:2344
- C:\Windows\System\rbVjbMJ.exe
  C:\Windows\System\rbVjbMJ.exe
  2⤵
  PID:4036
- C:\Windows\System\ZzGwCKK.exe
  C:\Windows\System\ZzGwCKK.exe
  2⤵
  PID:2756
- C:\Windows\System\uYBRgUt.exe
  C:\Windows\System\uYBRgUt.exe
  2⤵
  PID:1964
- C:\Windows\System\AMUfpwo.exe
  C:\Windows\System\AMUfpwo.exe
  2⤵
  PID:1160
- C:\Windows\System\paPZupJ.exe
  C:\Windows\System\paPZupJ.exe
  2⤵
  PID:3324
- C:\Windows\System\TnGuInK.exe
  C:\Windows\System\TnGuInK.exe
  2⤵
  PID:876
- C:\Windows\System\lfVAsto.exe
  C:\Windows\System\lfVAsto.exe
  2⤵
  PID:4080
- C:\Windows\System\BXQOdSO.exe
  C:\Windows\System\BXQOdSO.exe
  2⤵
  PID:3656
- C:\Windows\System\PEitscr.exe
  C:\Windows\System\PEitscr.exe
  2⤵
  PID:3268
- C:\Windows\System\yoHFbfZ.exe
  C:\Windows\System\yoHFbfZ.exe
  2⤵
  PID:3404
- C:\Windows\System\glydCbW.exe
  C:\Windows\System\glydCbW.exe
  2⤵
  PID:3640
- C:\Windows\System\PFdmBPM.exe
  C:\Windows\System\PFdmBPM.exe
  2⤵
  PID:3836
- C:\Windows\System\Szzwubf.exe
  C:\Windows\System\Szzwubf.exe
  2⤵
  PID:3536
- C:\Windows\System\sjTrQMx.exe
  C:\Windows\System\sjTrQMx.exe
  2⤵
  PID:3704
- C:\Windows\System\jbwljNH.exe
  C:\Windows\System\jbwljNH.exe
  2⤵
  PID:3744
- C:\Windows\System\uyZMgKD.exe
  C:\Windows\System\uyZMgKD.exe
  2⤵
  PID:2584
- C:\Windows\System\LmwPQuy.exe
  C:\Windows\System\LmwPQuy.exe
  2⤵
  PID:3448
- C:\Windows\System\RPsFtHB.exe
  C:\Windows\System\RPsFtHB.exe
  2⤵
  PID:3796
- C:\Windows\System\ulFTMos.exe
  C:\Windows\System\ulFTMos.exe
  2⤵
  PID:3928
- C:\Windows\System\cSCFwJo.exe
  C:\Windows\System\cSCFwJo.exe
  2⤵
  PID:2572
- C:\Windows\System\BRrzjBi.exe
  C:\Windows\System\BRrzjBi.exe
  2⤵
  PID:1220
- C:\Windows\System\ynMrcFM.exe
  C:\Windows\System\ynMrcFM.exe
  2⤵
  PID:3320
- C:\Windows\System\dPsSRVX.exe
  C:\Windows\System\dPsSRVX.exe
  2⤵
  PID:3464
- C:\Windows\System\NJvSkBb.exe
  C:\Windows\System\NJvSkBb.exe
  2⤵
  PID:3940
- C:\Windows\System\dsMVnUJ.exe
  C:\Windows\System\dsMVnUJ.exe
  2⤵
  PID:3600
- C:\Windows\System\yEhjfAI.exe
  C:\Windows\System\yEhjfAI.exe
  2⤵
  PID:540
- C:\Windows\System\wEDLAzC.exe
  C:\Windows\System\wEDLAzC.exe
  2⤵
  PID:4016
- C:\Windows\System\FsMRWoS.exe
  C:\Windows\System\FsMRWoS.exe
  2⤵
  PID:3108
- C:\Windows\System\qMCzusZ.exe
  C:\Windows\System\qMCzusZ.exe
  2⤵
  PID:2768
- C:\Windows\System\vQBHlkJ.exe
  C:\Windows\System\vQBHlkJ.exe
  2⤵
  PID:3340
- C:\Windows\System\HFiruFA.exe
  C:\Windows\System\HFiruFA.exe
  2⤵
  PID:3552
- C:\Windows\System\wvzypKn.exe
  C:\Windows\System\wvzypKn.exe
  2⤵
  PID:3480
- C:\Windows\System\MeViyPJ.exe
  C:\Windows\System\MeViyPJ.exe
  2⤵
  PID:3820
- C:\Windows\System\eqkzjxU.exe
  C:\Windows\System\eqkzjxU.exe
  2⤵
  PID:1364
- C:\Windows\System\jxoRXic.exe
  C:\Windows\System\jxoRXic.exe
  2⤵
  PID:3912
- C:\Windows\System\cHkLJxt.exe
  C:\Windows\System\cHkLJxt.exe
  2⤵
  PID:3496
- C:\Windows\System\FJChGBt.exe
  C:\Windows\System\FJChGBt.exe
  2⤵
  PID:3208
- C:\Windows\System\htAsNwl.exe
  C:\Windows\System\htAsNwl.exe
  2⤵
  PID:3336
- C:\Windows\System\AOdOXJH.exe
  C:\Windows\System\AOdOXJH.exe
  2⤵
  PID:3740
- C:\Windows\System\SoMDcTH.exe
  C:\Windows\System\SoMDcTH.exe
  2⤵
  PID:4052
- C:\Windows\System\hGhzlTK.exe
  C:\Windows\System\hGhzlTK.exe
  2⤵
  PID:2504
- C:\Windows\System\bgObZdc.exe
  C:\Windows\System\bgObZdc.exe
  2⤵
  PID:3176
- C:\Windows\System\tQUJAfr.exe
  C:\Windows\System\tQUJAfr.exe
  2⤵
  PID:3124
- C:\Windows\System\xXvovrM.exe
  C:\Windows\System\xXvovrM.exe
  2⤵
  PID:3240
- C:\Windows\System\nwIagEu.exe
  C:\Windows\System\nwIagEu.exe
  2⤵
  PID:1472
- C:\Windows\System\dbPlLRC.exe
  C:\Windows\System\dbPlLRC.exe
  2⤵
  PID:1368
- C:\Windows\System\EAjLwmO.exe
  C:\Windows\System\EAjLwmO.exe
  2⤵
  PID:4104
- C:\Windows\System\vjQjeQX.exe
  C:\Windows\System\vjQjeQX.exe
  2⤵
  PID:4120
- C:\Windows\System\VLWXnvy.exe
  C:\Windows\System\VLWXnvy.exe
  2⤵
  PID:4144
- C:\Windows\System\vrVdIRX.exe
  C:\Windows\System\vrVdIRX.exe
  2⤵
  PID:4168
- C:\Windows\System\oJusPmY.exe
  C:\Windows\System\oJusPmY.exe
  2⤵
  PID:4184
- C:\Windows\System\ZeTOhiJ.exe
  C:\Windows\System\ZeTOhiJ.exe
  2⤵
  PID:4200
- C:\Windows\System\rzofuwf.exe
  C:\Windows\System\rzofuwf.exe
  2⤵
  PID:4220
- C:\Windows\System\fYKkgwq.exe
  C:\Windows\System\fYKkgwq.exe
  2⤵
  PID:4236
- C:\Windows\System\FWgUtfY.exe
  C:\Windows\System\FWgUtfY.exe
  2⤵
  PID:4256
- C:\Windows\System\QejVOYe.exe
  C:\Windows\System\QejVOYe.exe
  2⤵
  PID:4280
- C:\Windows\System\oMsMHUm.exe
  C:\Windows\System\oMsMHUm.exe
  2⤵
  PID:4300
- C:\Windows\System\UscaFRF.exe
  C:\Windows\System\UscaFRF.exe
  2⤵
  PID:4320
- C:\Windows\System\PUsXXTc.exe
  C:\Windows\System\PUsXXTc.exe
  2⤵
  PID:4340
- C:\Windows\System\mivMmPN.exe
  C:\Windows\System\mivMmPN.exe
  2⤵
  PID:4360
- C:\Windows\System\xpJbmMU.exe
  C:\Windows\System\xpJbmMU.exe
  2⤵
  PID:4388
- C:\Windows\System\edNhmdl.exe
  C:\Windows\System\edNhmdl.exe
  2⤵
  PID:4404
- C:\Windows\System\PmYguhI.exe
  C:\Windows\System\PmYguhI.exe
  2⤵
  PID:4420
- C:\Windows\System\LFMRkQT.exe
  C:\Windows\System\LFMRkQT.exe
  2⤵
  PID:4436
- C:\Windows\System\FBjClTF.exe
  C:\Windows\System\FBjClTF.exe
  2⤵
  PID:4456
- C:\Windows\System\qOybfqB.exe
  C:\Windows\System\qOybfqB.exe
  2⤵
  PID:4472
- C:\Windows\System\enlcQay.exe
  C:\Windows\System\enlcQay.exe
  2⤵
  PID:4492
- C:\Windows\System\mgTXHbh.exe
  C:\Windows\System\mgTXHbh.exe
  2⤵
  PID:4508
- C:\Windows\System\SSFkwNJ.exe
  C:\Windows\System\SSFkwNJ.exe
  2⤵
  PID:4524
- C:\Windows\System\wZBOrNR.exe
  C:\Windows\System\wZBOrNR.exe
  2⤵
  PID:4556
- C:\Windows\System\okeVAZs.exe
  C:\Windows\System\okeVAZs.exe
  2⤵
  PID:4580
- C:\Windows\System\MaSbCDC.exe
  C:\Windows\System\MaSbCDC.exe
  2⤵
  PID:4596
- C:\Windows\System\iOXhmyh.exe
  C:\Windows\System\iOXhmyh.exe
  2⤵
  PID:4616
- C:\Windows\System\TiTWDVG.exe
  C:\Windows\System\TiTWDVG.exe
  2⤵
  PID:4640
- C:\Windows\System\LlJFxgI.exe
  C:\Windows\System\LlJFxgI.exe
  2⤵
  PID:4656
- C:\Windows\System\YNgluxw.exe
  C:\Windows\System\YNgluxw.exe
  2⤵
  PID:4684
- C:\Windows\System\vkUeCkU.exe
  C:\Windows\System\vkUeCkU.exe
  2⤵
  PID:4708
- C:\Windows\System\CdNexzr.exe
  C:\Windows\System\CdNexzr.exe
  2⤵
  PID:4724
- C:\Windows\System\QRoysWs.exe
  C:\Windows\System\QRoysWs.exe
  2⤵
  PID:4740
- C:\Windows\System\kWRTsPJ.exe
  C:\Windows\System\kWRTsPJ.exe
  2⤵
  PID:4760
- C:\Windows\System\ZNVGWWF.exe
  C:\Windows\System\ZNVGWWF.exe
  2⤵
  PID:4780
- C:\Windows\System\sRfmpYC.exe
  C:\Windows\System\sRfmpYC.exe
  2⤵
  PID:4804
- C:\Windows\System\CqcRLeo.exe
  C:\Windows\System\CqcRLeo.exe
  2⤵
  PID:4824
- C:\Windows\System\XafLSmu.exe
  C:\Windows\System\XafLSmu.exe
  2⤵
  PID:4848
- C:\Windows\System\BRsMWpa.exe
  C:\Windows\System\BRsMWpa.exe
  2⤵
  PID:4864
- C:\Windows\System\SqlEXPr.exe
  C:\Windows\System\SqlEXPr.exe
  2⤵
  PID:4884
- C:\Windows\System\cQzUlDi.exe
  C:\Windows\System\cQzUlDi.exe
  2⤵
  PID:4904
- C:\Windows\System\buHWxVG.exe
  C:\Windows\System\buHWxVG.exe
  2⤵
  PID:4920
- C:\Windows\System\JDIdgzd.exe
  C:\Windows\System\JDIdgzd.exe
  2⤵
  PID:4936
- C:\Windows\System\qhiQBGL.exe
  C:\Windows\System\qhiQBGL.exe
  2⤵
  PID:5000
- C:\Windows\System\DLBZPSk.exe
  C:\Windows\System\DLBZPSk.exe
  2⤵
  PID:5016
- C:\Windows\System\AVzXQGH.exe
  C:\Windows\System\AVzXQGH.exe
  2⤵
  PID:5036
- C:\Windows\System\usxXJaN.exe
  C:\Windows\System\usxXJaN.exe
  2⤵
  PID:5056
- C:\Windows\System\nTWpNNC.exe
  C:\Windows\System\nTWpNNC.exe
  2⤵
  PID:5072
- C:\Windows\System\ooWerIw.exe
  C:\Windows\System\ooWerIw.exe
  2⤵
  PID:5096
- C:\Windows\System\bibWOMV.exe
  C:\Windows\System\bibWOMV.exe
  2⤵
  PID:5116
- C:\Windows\System\jGynBVB.exe
  C:\Windows\System\jGynBVB.exe
  2⤵
  PID:4132
- C:\Windows\System\hOfmNCm.exe
  C:\Windows\System\hOfmNCm.exe
  2⤵
  PID:3288
- C:\Windows\System\AiYxcWu.exe
  C:\Windows\System\AiYxcWu.exe
  2⤵
  PID:4208
- C:\Windows\System\EBbapPg.exe
  C:\Windows\System\EBbapPg.exe
  2⤵
  PID:4252
- C:\Windows\System\XogfUlS.exe
  C:\Windows\System\XogfUlS.exe
  2⤵
  PID:4328
- C:\Windows\System\fLVmSsN.exe
  C:\Windows\System\fLVmSsN.exe
  2⤵
  PID:1628
- C:\Windows\System\HBkYDnW.exe
  C:\Windows\System\HBkYDnW.exe
  2⤵
  PID:2688
- C:\Windows\System\ZcJJbWA.exe
  C:\Windows\System\ZcJJbWA.exe
  2⤵
  PID:1820
- C:\Windows\System\Kskvjiu.exe
  C:\Windows\System\Kskvjiu.exe
  2⤵
  PID:3452
- C:\Windows\System\vQCbgaS.exe
  C:\Windows\System\vQCbgaS.exe
  2⤵
  PID:4384
- C:\Windows\System\vHcpOhf.exe
  C:\Windows\System\vHcpOhf.exe
  2⤵
  PID:4452
- C:\Windows\System\bzMYxKA.exe
  C:\Windows\System\bzMYxKA.exe
  2⤵
  PID:4488
- C:\Windows\System\EFbNBqW.exe
  C:\Windows\System\EFbNBqW.exe
  2⤵
  PID:4568
- C:\Windows\System\aJXszMz.exe
  C:\Windows\System\aJXszMz.exe
  2⤵
  PID:3896
- C:\Windows\System\rhMGYLZ.exe
  C:\Windows\System\rhMGYLZ.exe
  2⤵
  PID:4648
- C:\Windows\System\sjhurOf.exe
  C:\Windows\System\sjhurOf.exe
  2⤵
  PID:3244
- C:\Windows\System\XIiIDli.exe
  C:\Windows\System\XIiIDli.exe
  2⤵
  PID:4696
- C:\Windows\System\SquTFAE.exe
  C:\Windows\System\SquTFAE.exe
  2⤵
  PID:4732
- C:\Windows\System\NXZQxLV.exe
  C:\Windows\System\NXZQxLV.exe
  2⤵
  PID:4812
- C:\Windows\System\FQoEVOr.exe
  C:\Windows\System\FQoEVOr.exe
  2⤵
  PID:4860
- C:\Windows\System\heiTwHo.exe
  C:\Windows\System\heiTwHo.exe
  2⤵
  PID:4592
- C:\Windows\System\wUGSdtx.exe
  C:\Windows\System\wUGSdtx.exe
  2⤵
  PID:4264
- C:\Windows\System\jbKnFzW.exe
  C:\Windows\System\jbKnFzW.exe
  2⤵
  PID:1200
- C:\Windows\System\vsaLJje.exe
  C:\Windows\System\vsaLJje.exe
  2⤵
  PID:4468
- C:\Windows\System\cmkjfXl.exe
  C:\Windows\System\cmkjfXl.exe
  2⤵
  PID:4800
- C:\Windows\System\VXtWevt.exe
  C:\Windows\System\VXtWevt.exe
  2⤵
  PID:4532
- C:\Windows\System\hSskODY.exe
  C:\Windows\System\hSskODY.exe
  2⤵
  PID:4624
- C:\Windows\System\YvgDdGe.exe
  C:\Windows\System\YvgDdGe.exe
  2⤵
  PID:4268
- C:\Windows\System\JtuvfAj.exe
  C:\Windows\System\JtuvfAj.exe
  2⤵
  PID:4668
- C:\Windows\System\BkbPxAo.exe
  C:\Windows\System\BkbPxAo.exe
  2⤵
  PID:4316
- C:\Windows\System\mnPaiba.exe
  C:\Windows\System\mnPaiba.exe
  2⤵
  PID:4972
- C:\Windows\System\UwBRiXM.exe
  C:\Windows\System\UwBRiXM.exe
  2⤵
  PID:4880
- C:\Windows\System\pRgBiQa.exe
  C:\Windows\System\pRgBiQa.exe
  2⤵
  PID:4952
- C:\Windows\System\xWfIyIj.exe
  C:\Windows\System\xWfIyIj.exe
  2⤵
  PID:5048
- C:\Windows\System\YuNubxE.exe
  C:\Windows\System\YuNubxE.exe
  2⤵
  PID:5024
- C:\Windows\System\tNulSVG.exe
  C:\Windows\System\tNulSVG.exe
  2⤵
  PID:5068
- C:\Windows\System\dnbxcJE.exe
  C:\Windows\System\dnbxcJE.exe
  2⤵
  PID:1580
- C:\Windows\System\WhJHCht.exe
  C:\Windows\System\WhJHCht.exe
  2⤵
  PID:4292
- C:\Windows\System\AfwsBVK.exe
  C:\Windows\System\AfwsBVK.exe
  2⤵
  PID:4156
- C:\Windows\System\VIRvTwX.exe
  C:\Windows\System\VIRvTwX.exe
  2⤵
  PID:4564
- C:\Windows\System\mHzKwGD.exe
  C:\Windows\System\mHzKwGD.exe
  2⤵
  PID:3988
- C:\Windows\System\ZJHZUFt.exe
  C:\Windows\System\ZJHZUFt.exe
  2⤵
  PID:4772
- C:\Windows\System\roydPLy.exe
  C:\Windows\System\roydPLy.exe
  2⤵
  PID:4588
- C:\Windows\System\lacGYqP.exe
  C:\Windows\System\lacGYqP.exe
  2⤵
  PID:4160
- C:\Windows\System\MOiCgTg.exe
  C:\Windows\System\MOiCgTg.exe
  2⤵
  PID:4944
- C:\Windows\System\dDjBNqe.exe
  C:\Windows\System\dDjBNqe.exe
  2⤵
  PID:4380
- C:\Windows\System\pghcfRg.exe
  C:\Windows\System\pghcfRg.exe
  2⤵
  PID:4356
- C:\Windows\System\EmYqBOQ.exe
  C:\Windows\System\EmYqBOQ.exe
  2⤵
  PID:4352
- C:\Windows\System\YXIRDvV.exe
  C:\Windows\System\YXIRDvV.exe
  2⤵
  PID:4428
- C:\Windows\System\aZukUxj.exe
  C:\Windows\System\aZukUxj.exe
  2⤵
  PID:4916
- C:\Windows\System\oLaYzBZ.exe
  C:\Windows\System\oLaYzBZ.exe
  2⤵
  PID:5112
- C:\Windows\System\RPOkubW.exe
  C:\Windows\System\RPOkubW.exe
  2⤵
  PID:4336
- C:\Windows\System\pXCLyvc.exe
  C:\Windows\System\pXCLyvc.exe
  2⤵
  PID:5084
- C:\Windows\System\QsBQmOa.exe
  C:\Windows\System\QsBQmOa.exe
  2⤵
  PID:3388
- C:\Windows\System\mXXNdNT.exe
  C:\Windows\System\mXXNdNT.exe
  2⤵
  PID:2448
- C:\Windows\System\fVWqaze.exe
  C:\Windows\System\fVWqaze.exe
  2⤵
  PID:4228
- C:\Windows\System\nUtsweG.exe
  C:\Windows\System\nUtsweG.exe
  2⤵
  PID:4480
- C:\Windows\System\FKMcIPc.exe
  C:\Windows\System\FKMcIPc.exe
  2⤵
  PID:5080
- C:\Windows\System\YZneqWu.exe
  C:\Windows\System\YZneqWu.exe
  2⤵
  PID:4612
- C:\Windows\System\trisEGO.exe
  C:\Windows\System\trisEGO.exe
  2⤵
  PID:5136
- C:\Windows\System\SpIlifX.exe
  C:\Windows\System\SpIlifX.exe
  2⤵
  PID:5216
- C:\Windows\System\hFBzHIv.exe
  C:\Windows\System\hFBzHIv.exe
  2⤵
  PID:5232
- C:\Windows\System\YjNrHTA.exe
  C:\Windows\System\YjNrHTA.exe
  2⤵
  PID:5248
- C:\Windows\System\XhtOPgT.exe
  C:\Windows\System\XhtOPgT.exe
  2⤵
  PID:5272
- C:\Windows\System\kMFoQMu.exe
  C:\Windows\System\kMFoQMu.exe
  2⤵
  PID:5288
- C:\Windows\System\ZHGgQCb.exe
  C:\Windows\System\ZHGgQCb.exe
  2⤵
  PID:5304
- C:\Windows\System\Dizyhng.exe
  C:\Windows\System\Dizyhng.exe
  2⤵
  PID:5320
- C:\Windows\System\METfTYm.exe
  C:\Windows\System\METfTYm.exe
  2⤵
  PID:5336
- C:\Windows\System\Bwzujdi.exe
  C:\Windows\System\Bwzujdi.exe
  2⤵
  PID:5352
- C:\Windows\System\CNphfKJ.exe
  C:\Windows\System\CNphfKJ.exe
  2⤵
  PID:5372
- C:\Windows\System\WYowylc.exe
  C:\Windows\System\WYowylc.exe
  2⤵
  PID:5392
- C:\Windows\System\XkELayh.exe
  C:\Windows\System\XkELayh.exe
  2⤵
  PID:5420
- C:\Windows\System\tgRgMHf.exe
  C:\Windows\System\tgRgMHf.exe
  2⤵
  PID:5436
- C:\Windows\System\OKSZTuD.exe
  C:\Windows\System\OKSZTuD.exe
  2⤵
  PID:5452
- C:\Windows\System\SmrqzVY.exe
  C:\Windows\System\SmrqzVY.exe
  2⤵
  PID:5472
- C:\Windows\System\voOikUu.exe
  C:\Windows\System\voOikUu.exe
  2⤵
  PID:5488
- C:\Windows\System\tzXCzHm.exe
  C:\Windows\System\tzXCzHm.exe
  2⤵
  PID:5508
- C:\Windows\System\QeKzfdw.exe
  C:\Windows\System\QeKzfdw.exe
  2⤵
  PID:5528
- C:\Windows\System\JvBgqyu.exe
  C:\Windows\System\JvBgqyu.exe
  2⤵
  PID:5544
- C:\Windows\System\zmJeDhU.exe
  C:\Windows\System\zmJeDhU.exe
  2⤵
  PID:5568
- C:\Windows\System\YsItKsK.exe
  C:\Windows\System\YsItKsK.exe
  2⤵
  PID:5584
- C:\Windows\System\pOzKkGs.exe
  C:\Windows\System\pOzKkGs.exe
  2⤵
  PID:5600
- C:\Windows\System\ftCVedS.exe
  C:\Windows\System\ftCVedS.exe
  2⤵
  PID:5620
- C:\Windows\System\FsHTgDd.exe
  C:\Windows\System\FsHTgDd.exe
  2⤵
  PID:5640
- C:\Windows\System\zSAJwdk.exe
  C:\Windows\System\zSAJwdk.exe
  2⤵
  PID:5672
- C:\Windows\System\aAFlSDd.exe
  C:\Windows\System\aAFlSDd.exe
  2⤵
  PID:5696
- C:\Windows\System\ROslvSP.exe
  C:\Windows\System\ROslvSP.exe
  2⤵
  PID:5720
- C:\Windows\System\oNcyPgT.exe
  C:\Windows\System\oNcyPgT.exe
  2⤵
  PID:5740
- C:\Windows\System\drzrbvM.exe
  C:\Windows\System\drzrbvM.exe
  2⤵
  PID:5756
- C:\Windows\System\WbPBMgX.exe
  C:\Windows\System\WbPBMgX.exe
  2⤵
  PID:5772
- C:\Windows\System\xzGFxIh.exe
  C:\Windows\System\xzGFxIh.exe
  2⤵
  PID:5820
- C:\Windows\System\VGqVhIA.exe
  C:\Windows\System\VGqVhIA.exe
  2⤵
  PID:5836
- C:\Windows\System\VjsqJLJ.exe
  C:\Windows\System\VjsqJLJ.exe
  2⤵
  PID:5852
- C:\Windows\System\iufBkbD.exe
  C:\Windows\System\iufBkbD.exe
  2⤵
  PID:5868
- C:\Windows\System\kNYfFNy.exe
  C:\Windows\System\kNYfFNy.exe
  2⤵
  PID:5888
- C:\Windows\System\sqBiXvo.exe
  C:\Windows\System\sqBiXvo.exe
  2⤵
  PID:5908
- C:\Windows\System\TtXAzmr.exe
  C:\Windows\System\TtXAzmr.exe
  2⤵
  PID:5932
- C:\Windows\System\FbYjDaz.exe
  C:\Windows\System\FbYjDaz.exe
  2⤵
  PID:5948
- C:\Windows\System\QfXtOla.exe
  C:\Windows\System\QfXtOla.exe
  2⤵
  PID:5964
- C:\Windows\System\mjaqvmV.exe
  C:\Windows\System\mjaqvmV.exe
  2⤵
  PID:5980
- C:\Windows\System\dqXUCwq.exe
  C:\Windows\System\dqXUCwq.exe
  2⤵
  PID:6000
- C:\Windows\System\OMVIcVW.exe
  C:\Windows\System\OMVIcVW.exe
  2⤵
  PID:6024
- C:\Windows\System\mfaFIpH.exe
  C:\Windows\System\mfaFIpH.exe
  2⤵
  PID:6044
- C:\Windows\System\HRErPDN.exe
  C:\Windows\System\HRErPDN.exe
  2⤵
  PID:6064
- C:\Windows\System\TbCOpIq.exe
  C:\Windows\System\TbCOpIq.exe
  2⤵
  PID:6088
- C:\Windows\System\imcWSZD.exe
  C:\Windows\System\imcWSZD.exe
  2⤵
  PID:6104
- C:\Windows\System\tiyqMjp.exe
  C:\Windows\System\tiyqMjp.exe
  2⤵
  PID:6124
- C:\Windows\System\ynMBkGk.exe
  C:\Windows\System\ynMBkGk.exe
  2⤵
  PID:4976
- C:\Windows\System\xVodrOL.exe
  C:\Windows\System\xVodrOL.exe
  2⤵
  PID:4984
- C:\Windows\System\ejzJAPN.exe
  C:\Windows\System\ejzJAPN.exe
  2⤵
  PID:5012
- C:\Windows\System\NUSpcoq.exe
  C:\Windows\System\NUSpcoq.exe
  2⤵
  PID:4348
- C:\Windows\System\aRFJZVP.exe
  C:\Windows\System\aRFJZVP.exe
  2⤵
  PID:4892
- C:\Windows\System\ldiQwNF.exe
  C:\Windows\System\ldiQwNF.exe
  2⤵
  PID:4840
- C:\Windows\System\NFdtcQK.exe
  C:\Windows\System\NFdtcQK.exe
  2⤵
  PID:4312
- C:\Windows\System\rSrehBD.exe
  C:\Windows\System\rSrehBD.exe
  2⤵
  PID:4432
- C:\Windows\System\yVhaLic.exe
  C:\Windows\System\yVhaLic.exe
  2⤵
  PID:5152
- C:\Windows\System\QRIJMRu.exe
  C:\Windows\System\QRIJMRu.exe
  2⤵
  PID:4112
- C:\Windows\System\fdfaobV.exe
  C:\Windows\System\fdfaobV.exe
  2⤵
  PID:4372
- C:\Windows\System\AWkAYGq.exe
  C:\Windows\System\AWkAYGq.exe
  2⤵
  PID:5184
- C:\Windows\System\pkniuSj.exe
  C:\Windows\System\pkniuSj.exe
  2⤵
  PID:4128
- C:\Windows\System\TpqDUqP.exe
  C:\Windows\System\TpqDUqP.exe
  2⤵
  PID:5192
- C:\Windows\System\YMeFRYb.exe
  C:\Windows\System\YMeFRYb.exe
  2⤵
  PID:5108
- C:\Windows\System\DeCHtfB.exe
  C:\Windows\System\DeCHtfB.exe
  2⤵
  PID:4876
- C:\Windows\System\TqDGJqc.exe
  C:\Windows\System\TqDGJqc.exe
  2⤵
  PID:5240
- C:\Windows\System\WLkhNDt.exe
  C:\Windows\System\WLkhNDt.exe
  2⤵
  PID:4664
- C:\Windows\System\MeKFygs.exe
  C:\Windows\System\MeKFygs.exe
  2⤵
  PID:4376
- C:\Windows\System\Icqmgst.exe
  C:\Windows\System\Icqmgst.exe
  2⤵
  PID:5132
- C:\Windows\System\JGGnQJX.exe
  C:\Windows\System\JGGnQJX.exe
  2⤵
  PID:5224
- C:\Windows\System\WZoabIs.exe
  C:\Windows\System\WZoabIs.exe
  2⤵
  PID:4212
- C:\Windows\System\kJmUCpD.exe
  C:\Windows\System\kJmUCpD.exe
  2⤵
  PID:5432
- C:\Windows\System\LdQamez.exe
  C:\Windows\System\LdQamez.exe
  2⤵
  PID:5500
- C:\Windows\System\MNzqHFe.exe
  C:\Windows\System\MNzqHFe.exe
  2⤵
  PID:4968
- C:\Windows\System\WtKgnvd.exe
  C:\Windows\System\WtKgnvd.exe
  2⤵
  PID:5612
- C:\Windows\System\fmUoXdi.exe
  C:\Windows\System\fmUoXdi.exe
  2⤵
  PID:5660
- C:\Windows\System\lBNTehk.exe
  C:\Windows\System\lBNTehk.exe
  2⤵
  PID:5716
- C:\Windows\System\GWFeQXH.exe
  C:\Windows\System\GWFeQXH.exe
  2⤵
  PID:5300
- C:\Windows\System\NDJoZFt.exe
  C:\Windows\System\NDJoZFt.exe
  2⤵
  PID:5364
- C:\Windows\System\VVvNxuC.exe
  C:\Windows\System\VVvNxuC.exe
  2⤵
  PID:5628
- C:\Windows\System\jDESFxR.exe
  C:\Windows\System\jDESFxR.exe
  2⤵
  PID:5688
- C:\Windows\System\krxWgib.exe
  C:\Windows\System\krxWgib.exe
  2⤵
  PID:5524
- C:\Windows\System\JSPqszg.exe
  C:\Windows\System\JSPqszg.exe
  2⤵
  PID:5748
- C:\Windows\System\IuzemqF.exe
  C:\Windows\System\IuzemqF.exe
  2⤵
  PID:5788
- C:\Windows\System\zqaIdYd.exe
  C:\Windows\System\zqaIdYd.exe
  2⤵
  PID:5800
- C:\Windows\System\jlwZrtB.exe
  C:\Windows\System\jlwZrtB.exe
  2⤵
  PID:5816
- C:\Windows\System\FTFGEJz.exe
  C:\Windows\System\FTFGEJz.exe
  2⤵
  PID:5876
- C:\Windows\System\PjVkVLq.exe
  C:\Windows\System\PjVkVLq.exe
  2⤵
  PID:5832
- C:\Windows\System\bWGZKno.exe
  C:\Windows\System\bWGZKno.exe
  2⤵
  PID:5924
- C:\Windows\System\xAalomJ.exe
  C:\Windows\System\xAalomJ.exe
  2⤵
  PID:5988
- C:\Windows\System\MMjKlvW.exe
  C:\Windows\System\MMjKlvW.exe
  2⤵
  PID:6036
- C:\Windows\System\nXmFWKl.exe
  C:\Windows\System\nXmFWKl.exe
  2⤵
  PID:6076
- C:\Windows\System\CanFeJa.exe
  C:\Windows\System\CanFeJa.exe
  2⤵
  PID:6116
- C:\Windows\System\uuBYlhQ.exe
  C:\Windows\System\uuBYlhQ.exe
  2⤵
  PID:4836
- C:\Windows\System\jbNKXcr.exe
  C:\Windows\System\jbNKXcr.exe
  2⤵
  PID:4756
- C:\Windows\System\PsZdswE.exe
  C:\Windows\System\PsZdswE.exe
  2⤵
  PID:3520
- C:\Windows\System\yUffDJe.exe
  C:\Windows\System\yUffDJe.exe
  2⤵
  PID:5164
- C:\Windows\System\jBgBbpq.exe
  C:\Windows\System\jBgBbpq.exe
  2⤵
  PID:6008
- C:\Windows\System\IqCLEhm.exe
  C:\Windows\System\IqCLEhm.exe
  2⤵
  PID:4792
- C:\Windows\System\UWqjGwy.exe
  C:\Windows\System\UWqjGwy.exe
  2⤵
  PID:4100
- C:\Windows\System\acIdYbp.exe
  C:\Windows\System\acIdYbp.exe
  2⤵
  PID:4416
- C:\Windows\System\MXgGkVS.exe
  C:\Windows\System\MXgGkVS.exe
  2⤵
  PID:4820
- C:\Windows\System\iYFQQEZ.exe
  C:\Windows\System\iYFQQEZ.exe
  2⤵
  PID:5348
- C:\Windows\System\sWugFXe.exe
  C:\Windows\System\sWugFXe.exe
  2⤵
  PID:5260
- C:\Windows\System\hcfzNil.exe
  C:\Windows\System\hcfzNil.exe
  2⤵
  PID:5580
- C:\Windows\System\sauESuK.exe
  C:\Windows\System\sauESuK.exe
  2⤵
  PID:5708
- C:\Windows\System\AVqBaii.exe
  C:\Windows\System\AVqBaii.exe
  2⤵
  PID:5144
- C:\Windows\System\InnGrOj.exe
  C:\Windows\System\InnGrOj.exe
  2⤵
  PID:5332
- C:\Windows\System\dwhxxrz.exe
  C:\Windows\System\dwhxxrz.exe
  2⤵
  PID:5768
- C:\Windows\System\jdFcfHj.exe
  C:\Windows\System\jdFcfHj.exe
  2⤵
  PID:5284
- C:\Windows\System\eujLeai.exe
  C:\Windows\System\eujLeai.exe
  2⤵
  PID:5536
- C:\Windows\System\fDZVOEY.exe
  C:\Windows\System\fDZVOEY.exe
  2⤵
  PID:5652
- C:\Windows\System\RfNupgk.exe
  C:\Windows\System\RfNupgk.exe
  2⤵
  PID:5592
- C:\Windows\System\uSZyNpt.exe
  C:\Windows\System\uSZyNpt.exe
  2⤵
  PID:5404
- C:\Windows\System\dxyRwQE.exe
  C:\Windows\System\dxyRwQE.exe
  2⤵
  PID:5792
- C:\Windows\System\hjKgMpl.exe
  C:\Windows\System\hjKgMpl.exe
  2⤵
  PID:5480
- C:\Windows\System\MmAQymv.exe
  C:\Windows\System\MmAQymv.exe
  2⤵
  PID:5520
- C:\Windows\System\djlcYCe.exe
  C:\Windows\System\djlcYCe.exe
  2⤵
  PID:5996
- C:\Windows\System\wqCzMAS.exe
  C:\Windows\System\wqCzMAS.exe
  2⤵
  PID:4608
- C:\Windows\System\PDKXZDQ.exe
  C:\Windows\System\PDKXZDQ.exe
  2⤵
  PID:6132
- C:\Windows\System\PEmZMbJ.exe
  C:\Windows\System\PEmZMbJ.exe
  2⤵
  PID:4928
- C:\Windows\System\wFQXKly.exe
  C:\Windows\System\wFQXKly.exe
  2⤵
  PID:4676
- C:\Windows\System\jxXQMSd.exe
  C:\Windows\System\jxXQMSd.exe
  2⤵
  PID:5576
- C:\Windows\System\UhMfmhC.exe
  C:\Windows\System\UhMfmhC.exe
  2⤵
  PID:5884
- C:\Windows\System\hiNMweN.exe
  C:\Windows\System\hiNMweN.exe
  2⤵
  PID:1728
- C:\Windows\System\kiuLGqB.exe
  C:\Windows\System\kiuLGqB.exe
  2⤵
  PID:4788
- C:\Windows\System\xxhLAwt.exe
  C:\Windows\System\xxhLAwt.exe
  2⤵
  PID:5812
- C:\Windows\System\HkQZQgZ.exe
  C:\Windows\System\HkQZQgZ.exe
  2⤵
  PID:5200
- C:\Windows\System\nqFlrep.exe
  C:\Windows\System\nqFlrep.exe
  2⤵
  PID:2180
- C:\Windows\System\InHLMxF.exe
  C:\Windows\System\InHLMxF.exe
  2⤵
  PID:5712
- C:\Windows\System\daVvxDk.exe
  C:\Windows\System\daVvxDk.exe
  2⤵
  PID:5764
- C:\Windows\System\ZbHYody.exe
  C:\Windows\System\ZbHYody.exe
  2⤵
  PID:5228
- C:\Windows\System\oGDzmda.exe
  C:\Windows\System\oGDzmda.exe
  2⤵
  PID:5312
- C:\Windows\System\JDyHFvO.exe
  C:\Windows\System\JDyHFvO.exe
  2⤵
  PID:5556
- C:\Windows\System\umpDJWW.exe
  C:\Windows\System\umpDJWW.exe
  2⤵
  PID:5400
- C:\Windows\System\LYGidwB.exe
  C:\Windows\System\LYGidwB.exe
  2⤵
  PID:5516
- C:\Windows\System\prgjuqq.exe
  C:\Windows\System\prgjuqq.exe
  2⤵
  PID:5848
- C:\Windows\System\fGjnoQV.exe
  C:\Windows\System\fGjnoQV.exe
  2⤵
  PID:5780
- C:\Windows\System\mnvJSRT.exe
  C:\Windows\System\mnvJSRT.exe
  2⤵
  PID:5176
- C:\Windows\System\GiGIfdH.exe
  C:\Windows\System\GiGIfdH.exe
  2⤵
  PID:5828
- C:\Windows\System\LmOfTNr.exe
  C:\Windows\System\LmOfTNr.exe
  2⤵
  PID:6120
- C:\Windows\System\OoatiRK.exe
  C:\Windows\System\OoatiRK.exe
  2⤵
  PID:6096
- C:\Windows\System\XCMZqPj.exe
  C:\Windows\System\XCMZqPj.exe
  2⤵
  PID:5900
- C:\Windows\System\DlVzYcM.exe
  C:\Windows\System\DlVzYcM.exe
  2⤵
  PID:5736
- C:\Windows\System\CAgqCvW.exe
  C:\Windows\System\CAgqCvW.exe
  2⤵
  PID:5960
- C:\Windows\System\AuQhieK.exe
  C:\Windows\System\AuQhieK.exe
  2⤵
  PID:5264
- C:\Windows\System\BDYThXE.exe
  C:\Windows\System\BDYThXE.exe
  2⤵
  PID:5296
- C:\Windows\System\xdnWBUk.exe
  C:\Windows\System\xdnWBUk.exe
  2⤵
  PID:4152
- C:\Windows\System\dCkBair.exe
  C:\Windows\System\dCkBair.exe
  2⤵
  PID:5388
- C:\Windows\System\ZyJECWL.exe
  C:\Windows\System\ZyJECWL.exe
  2⤵
  PID:5484
- C:\Windows\System\xdlEDXY.exe
  C:\Windows\System\xdlEDXY.exe
  2⤵
  PID:6020
- C:\Windows\System\dtMHUDP.exe
  C:\Windows\System\dtMHUDP.exe
  2⤵
  PID:3052
- C:\Windows\System\kGVmKTP.exe
  C:\Windows\System\kGVmKTP.exe
  2⤵
  PID:4948
- C:\Windows\System\keepiYb.exe
  C:\Windows\System\keepiYb.exe
  2⤵
  PID:5128
- C:\Windows\System\AOSIXnD.exe
  C:\Windows\System\AOSIXnD.exe
  2⤵
  PID:5416
- C:\Windows\System\lEqsOjx.exe
  C:\Windows\System\lEqsOjx.exe
  2⤵
  PID:6084
- C:\Windows\System\XPGfvGf.exe
  C:\Windows\System\XPGfvGf.exe
  2⤵
  PID:5564
- C:\Windows\System\mpTbDgK.exe
  C:\Windows\System\mpTbDgK.exe
  2⤵
  PID:5148
- C:\Windows\System\wHpeDez.exe
  C:\Windows\System\wHpeDez.exe
  2⤵
  PID:6184
- C:\Windows\System\IGscJLo.exe
  C:\Windows\System\IGscJLo.exe
  2⤵
  PID:6200
- C:\Windows\System\BXzApUI.exe
  C:\Windows\System\BXzApUI.exe
  2⤵
  PID:6216
- C:\Windows\System\LSUPbya.exe
  C:\Windows\System\LSUPbya.exe
  2⤵
  PID:6232
- C:\Windows\System\TVhWVGB.exe
  C:\Windows\System\TVhWVGB.exe
  2⤵
  PID:6248
- C:\Windows\System\sqkKMNv.exe
  C:\Windows\System\sqkKMNv.exe
  2⤵
  PID:6264
- C:\Windows\System\HcKNOfn.exe
  C:\Windows\System\HcKNOfn.exe
  2⤵
  PID:6284
- C:\Windows\System\rjNqALQ.exe
  C:\Windows\System\rjNqALQ.exe
  2⤵
  PID:6300
- C:\Windows\System\bOhvwsY.exe
  C:\Windows\System\bOhvwsY.exe
  2⤵
  PID:6316
- C:\Windows\System\WBNbhDo.exe
  C:\Windows\System\WBNbhDo.exe
  2⤵
  PID:6332
- C:\Windows\System\kILuvhZ.exe
  C:\Windows\System\kILuvhZ.exe
  2⤵
  PID:6356
- C:\Windows\System\VKPUGxf.exe
  C:\Windows\System\VKPUGxf.exe
  2⤵
  PID:6376
- C:\Windows\System\aWbgvUM.exe
  C:\Windows\System\aWbgvUM.exe
  2⤵
  PID:6392
- C:\Windows\System\LYoTwpA.exe
  C:\Windows\System\LYoTwpA.exe
  2⤵
  PID:6408
- C:\Windows\System\PfJOUIV.exe
  C:\Windows\System\PfJOUIV.exe
  2⤵
  PID:6428
- C:\Windows\System\YkAQDzu.exe
  C:\Windows\System\YkAQDzu.exe
  2⤵
  PID:6448
- C:\Windows\System\LkvbSxW.exe
  C:\Windows\System\LkvbSxW.exe
  2⤵
  PID:6464
- C:\Windows\System\fFryQar.exe
  C:\Windows\System\fFryQar.exe
  2⤵
  PID:6480
- C:\Windows\System\KLSDuGM.exe
  C:\Windows\System\KLSDuGM.exe
  2⤵
  PID:6504
- C:\Windows\System\eOKqoHz.exe
  C:\Windows\System\eOKqoHz.exe
  2⤵
  PID:6520
- C:\Windows\System\diiUjxQ.exe
  C:\Windows\System\diiUjxQ.exe
  2⤵
  PID:6540
- C:\Windows\System\hOHousy.exe
  C:\Windows\System\hOHousy.exe
  2⤵
  PID:6568
- C:\Windows\System\kJLVWbC.exe
  C:\Windows\System\kJLVWbC.exe
  2⤵
  PID:6584
- C:\Windows\System\erwQEvv.exe
  C:\Windows\System\erwQEvv.exe
  2⤵
  PID:6600
- C:\Windows\System\QKhTkko.exe
  C:\Windows\System\QKhTkko.exe
  2⤵
  PID:6616
- C:\Windows\System\QmbIFEU.exe
  C:\Windows\System\QmbIFEU.exe
  2⤵
  PID:6632
- C:\Windows\System\ueskiFs.exe
  C:\Windows\System\ueskiFs.exe
  2⤵
  PID:6648
- C:\Windows\System\xpYWDPS.exe
  C:\Windows\System\xpYWDPS.exe
  2⤵
  PID:6664
- C:\Windows\System\lmTamic.exe
  C:\Windows\System\lmTamic.exe
  2⤵
  PID:6680
- C:\Windows\System\DxzMwEr.exe
  C:\Windows\System\DxzMwEr.exe
  2⤵
  PID:6700
- C:\Windows\System\GQbnyhy.exe
  C:\Windows\System\GQbnyhy.exe
  2⤵
  PID:6716
- C:\Windows\System\RjcMtfD.exe
  C:\Windows\System\RjcMtfD.exe
  2⤵
  PID:6736
- C:\Windows\System\wMWjzyj.exe
  C:\Windows\System\wMWjzyj.exe
  2⤵
  PID:6756
- C:\Windows\System\BdPzALe.exe
  C:\Windows\System\BdPzALe.exe
  2⤵
  PID:6776
- C:\Windows\System\clKegNZ.exe
  C:\Windows\System\clKegNZ.exe
  2⤵
  PID:6792
- C:\Windows\System\VEVaEPV.exe
  C:\Windows\System\VEVaEPV.exe
  2⤵
  PID:6808
- C:\Windows\System\cHPPbmX.exe
  C:\Windows\System\cHPPbmX.exe
  2⤵
  PID:6824
- C:\Windows\System\cGqOCgx.exe
  C:\Windows\System\cGqOCgx.exe
  2⤵
  PID:6840
- C:\Windows\System\zxdXHZZ.exe
  C:\Windows\System\zxdXHZZ.exe
  2⤵
  PID:6856
- C:\Windows\System\mTQfNOj.exe
  C:\Windows\System\mTQfNOj.exe
  2⤵
  PID:6876
- C:\Windows\System\EdNIrsN.exe
  C:\Windows\System\EdNIrsN.exe
  2⤵
  PID:6896
- C:\Windows\System\yYbfyVS.exe
  C:\Windows\System\yYbfyVS.exe
  2⤵
  PID:6912
- C:\Windows\System\hxrIWvO.exe
  C:\Windows\System\hxrIWvO.exe
  2⤵
  PID:6928
- C:\Windows\System\OdprLzX.exe
  C:\Windows\System\OdprLzX.exe
  2⤵
  PID:6944
- C:\Windows\System\zeHTlGb.exe
  C:\Windows\System\zeHTlGb.exe
  2⤵
  PID:6960
- C:\Windows\System\qRGjOam.exe
  C:\Windows\System\qRGjOam.exe
  2⤵
  PID:6984
- C:\Windows\System\dtMRmYN.exe
  C:\Windows\System\dtMRmYN.exe
  2⤵
  PID:7000
- C:\Windows\System\lVFTLBl.exe
  C:\Windows\System\lVFTLBl.exe
  2⤵
  PID:7020
- C:\Windows\System\LMpCybN.exe
  C:\Windows\System\LMpCybN.exe
  2⤵
  PID:7036
- C:\Windows\System\yyQLcmF.exe
  C:\Windows\System\yyQLcmF.exe
  2⤵
  PID:7052
- C:\Windows\System\qUvLaSh.exe
  C:\Windows\System\qUvLaSh.exe
  2⤵
  PID:7068
- C:\Windows\System\DfrNGCM.exe
  C:\Windows\System\DfrNGCM.exe
  2⤵
  PID:7084
- C:\Windows\System\BxSfVZj.exe
  C:\Windows\System\BxSfVZj.exe
  2⤵
  PID:7100
- C:\Windows\System\YoChoUj.exe
  C:\Windows\System\YoChoUj.exe
  2⤵
  PID:7116
- C:\Windows\System\KfjdByc.exe
  C:\Windows\System\KfjdByc.exe
  2⤵
  PID:7132
- C:\Windows\System\ZHhwpVR.exe
  C:\Windows\System\ZHhwpVR.exe
  2⤵
  PID:7148
- C:\Windows\System\KPzlkVC.exe
  C:\Windows\System\KPzlkVC.exe
  2⤵
  PID:7164
- C:\Windows\System\GJvJsuH.exe
  C:\Windows\System\GJvJsuH.exe
  2⤵
  PID:5684
- C:\Windows\System\YxSTSNO.exe
  C:\Windows\System\YxSTSNO.exe
  2⤵
  PID:5920
- C:\Windows\System\DdfnhhJ.exe
  C:\Windows\System\DdfnhhJ.exe
  2⤵
  PID:3968
- C:\Windows\System\VautMvT.exe
  C:\Windows\System\VautMvT.exe
  2⤵
  PID:5976
- C:\Windows\System\MZlzFsW.exe
  C:\Windows\System\MZlzFsW.exe
  2⤵
  PID:6160
- C:\Windows\System\ARCvVLc.exe
  C:\Windows\System\ARCvVLc.exe
  2⤵
  PID:6176
- C:\Windows\System\QctuwrU.exe
  C:\Windows\System\QctuwrU.exe
  2⤵
  PID:6240
- C:\Windows\System\qtAOCVw.exe
  C:\Windows\System\qtAOCVw.exe
  2⤵
  PID:6280
- C:\Windows\System\QprFYSK.exe
  C:\Windows\System\QprFYSK.exe
  2⤵
  PID:6340
- C:\Windows\System\FyhWyIr.exe
  C:\Windows\System\FyhWyIr.exe
  2⤵
  PID:6372
- C:\Windows\System\AgTXsxR.exe
  C:\Windows\System\AgTXsxR.exe
  2⤵
  PID:6416
- C:\Windows\System\WuJogSD.exe
  C:\Windows\System\WuJogSD.exe
  2⤵
  PID:6460
- C:\Windows\System\JBQNqIk.exe
  C:\Windows\System\JBQNqIk.exe
  2⤵
  PID:6476
- C:\Windows\System\cWckVmj.exe
  C:\Windows\System\cWckVmj.exe
  2⤵
  PID:6472
- C:\Windows\System\jisTsHr.exe
  C:\Windows\System\jisTsHr.exe
  2⤵
  PID:6256
- C:\Windows\System\xDcvYNr.exe
  C:\Windows\System\xDcvYNr.exe
  2⤵
  PID:6500
- C:\Windows\System\NuhhriU.exe
  C:\Windows\System\NuhhriU.exe
  2⤵
  PID:6548
- C:\Windows\System\wnBZcsJ.exe
  C:\Windows\System\wnBZcsJ.exe
  2⤵
  PID:6564
- C:\Windows\System\mHxDQLh.exe
  C:\Windows\System\mHxDQLh.exe
  2⤵
  PID:6552
- C:\Windows\System\YUwNSYu.exe
  C:\Windows\System\YUwNSYu.exe
  2⤵
  PID:6644
- C:\Windows\System\wFPUNJf.exe
  C:\Windows\System\wFPUNJf.exe
  2⤵
  PID:6748
- C:\Windows\System\ViJVoNu.exe
  C:\Windows\System\ViJVoNu.exe
  2⤵
  PID:6816
- C:\Windows\System\HnKBOxO.exe
  C:\Windows\System\HnKBOxO.exe
  2⤵
  PID:6768
- C:\Windows\System\ptyQCeX.exe
  C:\Windows\System\ptyQCeX.exe
  2⤵
  PID:6656
- C:\Windows\System\XZGGkAJ.exe
  C:\Windows\System\XZGGkAJ.exe
  2⤵
  PID:6696
- C:\Windows\System\NXyDqpV.exe
  C:\Windows\System\NXyDqpV.exe
  2⤵
  PID:6800
- C:\Windows\System\VgsThkJ.exe
  C:\Windows\System\VgsThkJ.exe
  2⤵
  PID:6864
- C:\Windows\System\AkRtXtK.exe
  C:\Windows\System\AkRtXtK.exe
  2⤵
  PID:6868
- C:\Windows\System\vznvZUf.exe
  C:\Windows\System\vznvZUf.exe
  2⤵
  PID:6940
- C:\Windows\System\ngqMHHg.exe
  C:\Windows\System\ngqMHHg.exe
  2⤵
  PID:4504
- C:\Windows\System\sEtnCeU.exe
  C:\Windows\System\sEtnCeU.exe
  2⤵
  PID:7060
- C:\Windows\System\OdHPcaS.exe
  C:\Windows\System\OdHPcaS.exe
  2⤵
  PID:7124
- C:\Windows\System\RqsLJxn.exe
  C:\Windows\System\RqsLJxn.exe
  2⤵
  PID:5732
- C:\Windows\System\OTIzbNM.exe
  C:\Windows\System\OTIzbNM.exe
  2⤵
  PID:5704
- C:\Windows\System\FTVrpUM.exe
  C:\Windows\System\FTVrpUM.exe
  2⤵
  PID:7144
- C:\Windows\System\LUjmNRd.exe
  C:\Windows\System\LUjmNRd.exe
  2⤵
  PID:5844
- C:\Windows\System\crFxFII.exe
  C:\Windows\System\crFxFII.exe
  2⤵
  PID:7076
- C:\Windows\System\LfpsBEZ.exe
  C:\Windows\System\LfpsBEZ.exe
  2⤵
  PID:6168
- C:\Windows\System\jfZAkFG.exe
  C:\Windows\System\jfZAkFG.exe
  2⤵
  PID:6348
- C:\Windows\System\Vyubmqa.exe
  C:\Windows\System\Vyubmqa.exe
  2⤵
  PID:6208
- C:\Windows\System\zDffGxu.exe
  C:\Windows\System\zDffGxu.exe
  2⤵
  PID:6424
- C:\Windows\System\APdAmCe.exe
  C:\Windows\System\APdAmCe.exe
  2⤵
  PID:6404
- C:\Windows\System\pyjzjAf.exe
  C:\Windows\System\pyjzjAf.exe
  2⤵
  PID:6496
- C:\Windows\System\aMJVTss.exe
  C:\Windows\System\aMJVTss.exe
  2⤵
  PID:6260
- C:\Windows\System\MRHlfbw.exe
  C:\Windows\System\MRHlfbw.exe
  2⤵
  PID:6884
- C:\Windows\System\aZvwAMS.exe
  C:\Windows\System\aZvwAMS.exe
  2⤵
  PID:6936
- C:\Windows\System\JddwFKQ.exe
  C:\Windows\System\JddwFKQ.exe
  2⤵
  PID:6976
- C:\Windows\System\bojeVYs.exe
  C:\Windows\System\bojeVYs.exe
  2⤵
  PID:7048
- C:\Windows\System\wNdpIeK.exe
  C:\Windows\System\wNdpIeK.exe
  2⤵
  PID:6156
- C:\Windows\System\GRAlJZT.exe
  C:\Windows\System\GRAlJZT.exe
  2⤵
  PID:6312
- C:\Windows\System\oxfFAtX.exe
  C:\Windows\System\oxfFAtX.exe
  2⤵
  PID:6560
- C:\Windows\System\LPFbXOR.exe
  C:\Windows\System\LPFbXOR.exe
  2⤵
  PID:6224
- C:\Windows\System\XXEKNkI.exe
  C:\Windows\System\XXEKNkI.exe
  2⤵
  PID:6536
- C:\Windows\System\CBLyDaR.exe
  C:\Windows\System\CBLyDaR.exe
  2⤵
  PID:6640
- C:\Windows\System\kpqaUlx.exe
  C:\Windows\System\kpqaUlx.exe
  2⤵
  PID:6784
- C:\Windows\System\ApVzCIZ.exe
  C:\Windows\System\ApVzCIZ.exe
  2⤵
  PID:6688
- C:\Windows\System\fovpfLA.exe
  C:\Windows\System\fovpfLA.exe
  2⤵
  PID:6924
- C:\Windows\System\gvIYnlE.exe
  C:\Windows\System\gvIYnlE.exe
  2⤵
  PID:7160
- C:\Windows\System\DpIYgVp.exe
  C:\Windows\System\DpIYgVp.exe
  2⤵
  PID:7080
- C:\Windows\System\IvIFCbN.exe
  C:\Windows\System\IvIFCbN.exe
  2⤵
  PID:7044
- C:\Windows\System\lpTtiBq.exe
  C:\Windows\System\lpTtiBq.exe
  2⤵
  PID:6192
- C:\Windows\System\OtDwpCf.exe
  C:\Windows\System\OtDwpCf.exe
  2⤵
  PID:6492
- C:\Windows\System\CSYDAIp.exe
  C:\Windows\System\CSYDAIp.exe
  2⤵
  PID:6512
- C:\Windows\System\wzAPuRB.exe
  C:\Windows\System\wzAPuRB.exe
  2⤵
  PID:6676
- C:\Windows\System\Pxfxltl.exe
  C:\Windows\System\Pxfxltl.exe
  2⤵
  PID:6596
- C:\Windows\System\EfmMxnG.exe
  C:\Windows\System\EfmMxnG.exe
  2⤵
  PID:6920
- C:\Windows\System\pxoLSCY.exe
  C:\Windows\System\pxoLSCY.exe
  2⤵
  PID:7096
- C:\Windows\System\dWqkSBF.exe
  C:\Windows\System\dWqkSBF.exe
  2⤵
  PID:7008
- C:\Windows\System\tRHfIHI.exe
  C:\Windows\System\tRHfIHI.exe
  2⤵
  PID:6772
- C:\Windows\System\xMTNazn.exe
  C:\Windows\System\xMTNazn.exe
  2⤵
  PID:7028
- C:\Windows\System\nWRMpoD.exe
  C:\Windows\System\nWRMpoD.exe
  2⤵
  PID:6852
- C:\Windows\System\tztiQKy.exe
  C:\Windows\System\tztiQKy.exe
  2⤵
  PID:6580
- C:\Windows\System\zGgUdbX.exe
  C:\Windows\System\zGgUdbX.exe
  2⤵
  PID:6440
- C:\Windows\System\IcmMbdK.exe
  C:\Windows\System\IcmMbdK.exe
  2⤵
  PID:7184
- C:\Windows\System\kHQxjQK.exe
  C:\Windows\System\kHQxjQK.exe
  2⤵
  PID:7200
- C:\Windows\System\wsRfgqT.exe
  C:\Windows\System\wsRfgqT.exe
  2⤵
  PID:7220
- C:\Windows\System\YMjznEi.exe
  C:\Windows\System\YMjznEi.exe
  2⤵
  PID:7240
- C:\Windows\System\hxmMFNW.exe
  C:\Windows\System\hxmMFNW.exe
  2⤵
  PID:7256
- C:\Windows\System\JIfXUDy.exe
  C:\Windows\System\JIfXUDy.exe
  2⤵
  PID:7272
- C:\Windows\System\homuvMW.exe
  C:\Windows\System\homuvMW.exe
  2⤵
  PID:7296
- C:\Windows\System\zwBIqAL.exe
  C:\Windows\System\zwBIqAL.exe
  2⤵
  PID:7316
- C:\Windows\System\bZVMeAS.exe
  C:\Windows\System\bZVMeAS.exe
  2⤵
  PID:7368
- C:\Windows\System\mWvkLMP.exe
  C:\Windows\System\mWvkLMP.exe
  2⤵
  PID:7388
- C:\Windows\System\aLuRiLe.exe
  C:\Windows\System\aLuRiLe.exe
  2⤵
  PID:7408
- C:\Windows\System\TxhOiZm.exe
  C:\Windows\System\TxhOiZm.exe
  2⤵
  PID:7424
- C:\Windows\System\qrGztcu.exe
  C:\Windows\System\qrGztcu.exe
  2⤵
  PID:7440
- C:\Windows\System\QYzulga.exe
  C:\Windows\System\QYzulga.exe
  2⤵
  PID:7456
- C:\Windows\System\BGbBWDV.exe
  C:\Windows\System\BGbBWDV.exe
  2⤵
  PID:7472
- C:\Windows\System\vyNLRkt.exe
  C:\Windows\System\vyNLRkt.exe
  2⤵
  PID:7488
- C:\Windows\System\OuVQfGS.exe
  C:\Windows\System\OuVQfGS.exe
  2⤵
  PID:7504
- C:\Windows\System\AiCfHdh.exe
  C:\Windows\System\AiCfHdh.exe
  2⤵
  PID:7520
- C:\Windows\System\DnqMdQb.exe
  C:\Windows\System\DnqMdQb.exe
  2⤵
  PID:7536
- C:\Windows\System\HYqXfhV.exe
  C:\Windows\System\HYqXfhV.exe
  2⤵
  PID:7552
- C:\Windows\System\NZSpGeV.exe
  C:\Windows\System\NZSpGeV.exe
  2⤵
  PID:7568
- C:\Windows\System\MTJfRWV.exe
  C:\Windows\System\MTJfRWV.exe
  2⤵
  PID:7584
- C:\Windows\System\Brrazsd.exe
  C:\Windows\System\Brrazsd.exe
  2⤵
  PID:7600
- C:\Windows\System\qLuscdM.exe
  C:\Windows\System\qLuscdM.exe
  2⤵
  PID:7616
- C:\Windows\System\veDWVeM.exe
  C:\Windows\System\veDWVeM.exe
  2⤵
  PID:7632
- C:\Windows\System\mZHTBsJ.exe
  C:\Windows\System\mZHTBsJ.exe
  2⤵
  PID:7648
- C:\Windows\System\lQkgOrU.exe
  C:\Windows\System\lQkgOrU.exe
  2⤵
  PID:7668
- C:\Windows\System\xduLKBW.exe
  C:\Windows\System\xduLKBW.exe
  2⤵
  PID:7684
- C:\Windows\System\fawIuVL.exe
  C:\Windows\System\fawIuVL.exe
  2⤵
  PID:7700
- C:\Windows\System\vfFxrBZ.exe
  C:\Windows\System\vfFxrBZ.exe
  2⤵
  PID:7716
- C:\Windows\System\TXRDpnC.exe
  C:\Windows\System\TXRDpnC.exe
  2⤵
  PID:7732
- C:\Windows\System\ReIRZGQ.exe
  C:\Windows\System\ReIRZGQ.exe
  2⤵
  PID:7748
- C:\Windows\System\lpXGbzr.exe
  C:\Windows\System\lpXGbzr.exe
  2⤵
  PID:7764
- C:\Windows\System\ZiGjSAr.exe
  C:\Windows\System\ZiGjSAr.exe
  2⤵
  PID:7784
- C:\Windows\System\UbXSMAc.exe
  C:\Windows\System\UbXSMAc.exe
  2⤵
  PID:7800
- C:\Windows\System\KSwcUvM.exe
  C:\Windows\System\KSwcUvM.exe
  2⤵
  PID:7820
- C:\Windows\System\giWcoiL.exe
  C:\Windows\System\giWcoiL.exe
  2⤵
  PID:7840
- C:\Windows\System\KTRtona.exe
  C:\Windows\System\KTRtona.exe
  2⤵
  PID:7856
- C:\Windows\System\wWcYWJd.exe
  C:\Windows\System\wWcYWJd.exe
  2⤵
  PID:7872
- C:\Windows\System\xrLOkpc.exe
  C:\Windows\System\xrLOkpc.exe
  2⤵
  PID:7892
- C:\Windows\System\tBUCVAQ.exe
  C:\Windows\System\tBUCVAQ.exe
  2⤵
  PID:7908
- C:\Windows\System\Xuxcmei.exe
  C:\Windows\System\Xuxcmei.exe
  2⤵
  PID:7924
- C:\Windows\System\PYbFiBr.exe
  C:\Windows\System\PYbFiBr.exe
  2⤵
  PID:7940
- C:\Windows\System\vBiSUQY.exe
  C:\Windows\System\vBiSUQY.exe
  2⤵
  PID:7964
- C:\Windows\System\nOClKrA.exe
  C:\Windows\System\nOClKrA.exe
  2⤵
  PID:7980
- C:\Windows\System\ukKBkXh.exe
  C:\Windows\System\ukKBkXh.exe
  2⤵
  PID:8008
- C:\Windows\System\PJUcpDM.exe
  C:\Windows\System\PJUcpDM.exe
  2⤵
  PID:8028
- C:\Windows\System\ZjmyijK.exe
  C:\Windows\System\ZjmyijK.exe
  2⤵
  PID:8052
- C:\Windows\System\vyoVCSD.exe
  C:\Windows\System\vyoVCSD.exe
  2⤵
  PID:8072
- C:\Windows\System\mccBPHk.exe
  C:\Windows\System\mccBPHk.exe
  2⤵
  PID:8088
- C:\Windows\System\nHzZEPJ.exe
  C:\Windows\System\nHzZEPJ.exe
  2⤵
  PID:8104
- C:\Windows\System\vSDpoKK.exe
  C:\Windows\System\vSDpoKK.exe
  2⤵
  PID:8120
- C:\Windows\System\ntHwjtZ.exe
  C:\Windows\System\ntHwjtZ.exe
  2⤵
  PID:8136
- C:\Windows\System\FtBzOlZ.exe
  C:\Windows\System\FtBzOlZ.exe
  2⤵
  PID:8152
- C:\Windows\System\dPQVDDQ.exe
  C:\Windows\System\dPQVDDQ.exe
  2⤵
  PID:8168
- C:\Windows\System\rjbXlSS.exe
  C:\Windows\System\rjbXlSS.exe
  2⤵
  PID:8184
- C:\Windows\System\HogFUOi.exe
  C:\Windows\System\HogFUOi.exe
  2⤵
  PID:7212
- C:\Windows\System\vbuxByH.exe
  C:\Windows\System\vbuxByH.exe
  2⤵
  PID:6228
- C:\Windows\System\kkcJdDm.exe
  C:\Windows\System\kkcJdDm.exe
  2⤵
  PID:7196
- C:\Windows\System\ktuifOL.exe
  C:\Windows\System\ktuifOL.exe
  2⤵
  PID:7232
- C:\Windows\System\pVxRHWM.exe
  C:\Windows\System\pVxRHWM.exe
  2⤵
  PID:7264
- C:\Windows\System\wfAryaX.exe
  C:\Windows\System\wfAryaX.exe
  2⤵
  PID:7288
- C:\Windows\System\rsiqfDA.exe
  C:\Windows\System\rsiqfDA.exe
  2⤵
  PID:7324
- C:\Windows\System\HTMdXYq.exe
  C:\Windows\System\HTMdXYq.exe
  2⤵
  PID:7344
- C:\Windows\System\ohtKgcZ.exe
  C:\Windows\System\ohtKgcZ.exe
  2⤵
  PID:7376
- C:\Windows\System\MTRhwyS.exe
  C:\Windows\System\MTRhwyS.exe
  2⤵
  PID:7404
- C:\Windows\System\qoqBWwK.exe
  C:\Windows\System\qoqBWwK.exe
  2⤵
  PID:7468
- C:\Windows\System\hVxGYhU.exe
  C:\Windows\System\hVxGYhU.exe
  2⤵
  PID:7420
- C:\Windows\System\pwmPEKY.exe
  C:\Windows\System\pwmPEKY.exe
  2⤵
  PID:7452
- C:\Windows\System\MOUgDVO.exe
  C:\Windows\System\MOUgDVO.exe
  2⤵
  PID:7548
- C:\Windows\System\zXauOvT.exe
  C:\Windows\System\zXauOvT.exe
  2⤵
  PID:7596
- C:\Windows\System\ELNKKGB.exe
  C:\Windows\System\ELNKKGB.exe
  2⤵
  PID:7692
- C:\Windows\System\aqEvvaI.exe
  C:\Windows\System\aqEvvaI.exe
  2⤵
  PID:7796
- C:\Windows\System\GJWTgFX.exe
  C:\Windows\System\GJWTgFX.exe
  2⤵
  PID:7832
- C:\Windows\System\sDgaQqg.exe
  C:\Windows\System\sDgaQqg.exe
  2⤵
  PID:7816
- C:\Windows\System\PcOPzzR.exe
  C:\Windows\System\PcOPzzR.exe
  2⤵
  PID:7852
- C:\Windows\System\PsIHYbE.exe
  C:\Windows\System\PsIHYbE.exe
  2⤵
  PID:7772
- C:\Windows\System\OhXbbNb.exe
  C:\Windows\System\OhXbbNb.exe
  2⤵
  PID:7900
- C:\Windows\System\PpTSNGP.exe
  C:\Windows\System\PpTSNGP.exe
  2⤵
  PID:7888
- C:\Windows\System\acFjLrV.exe
  C:\Windows\System\acFjLrV.exe
  2⤵
  PID:7916
- C:\Windows\System\wrOxOjs.exe
  C:\Windows\System\wrOxOjs.exe
  2⤵
  PID:7956
- C:\Windows\System\fdGFbAQ.exe
  C:\Windows\System\fdGFbAQ.exe
  2⤵
  PID:8020
- C:\Windows\System\qwXdwuf.exe
  C:\Windows\System\qwXdwuf.exe
  2⤵
  PID:8064
- C:\Windows\System\MobLxUX.exe
  C:\Windows\System\MobLxUX.exe
  2⤵
  PID:8068
- C:\Windows\System\rLOEjNk.exe
  C:\Windows\System\rLOEjNk.exe
  2⤵
  PID:8040
- C:\Windows\System\mdcnbPr.exe
  C:\Windows\System\mdcnbPr.exe
  2⤵
  PID:8100
- C:\Windows\System\boqSGcF.exe
  C:\Windows\System\boqSGcF.exe
  2⤵
  PID:8132
- C:\Windows\System\ThdHggN.exe
  C:\Windows\System\ThdHggN.exe
  2⤵
  PID:8176
- C:\Windows\System\HRRZxUo.exe
  C:\Windows\System\HRRZxUo.exe
  2⤵
  PID:7176
- C:\Windows\System\CZpAmXd.exe
  C:\Windows\System\CZpAmXd.exe
  2⤵
  PID:7192
- C:\Windows\System\iwJEYtT.exe
  C:\Windows\System\iwJEYtT.exe
  2⤵
  PID:6888
- C:\Windows\System\tpJVKjZ.exe
  C:\Windows\System\tpJVKjZ.exe
  2⤵
  PID:7356
- C:\Windows\System\jHQxhOQ.exe
  C:\Windows\System\jHQxhOQ.exe
  2⤵
  PID:7340
- C:\Windows\System\lNrGpZB.exe
  C:\Windows\System\lNrGpZB.exe
  2⤵
  PID:7380
- C:\Windows\System\ngXbLxu.exe
  C:\Windows\System\ngXbLxu.exe
  2⤵
  PID:7464
- C:\Windows\System\KCxZGOl.exe
  C:\Windows\System\KCxZGOl.exe
  2⤵
  PID:7416
- C:\Windows\System\stUADuh.exe
  C:\Windows\System\stUADuh.exe
  2⤵
  PID:7544
- C:\Windows\System\VvdAYUr.exe
  C:\Windows\System\VvdAYUr.exe
  2⤵
  PID:7480
- C:\Windows\System\lfroTMi.exe
  C:\Windows\System\lfroTMi.exe
  2⤵
  PID:7724
- C:\Windows\System\BranJFp.exe
  C:\Windows\System\BranJFp.exe
  2⤵
  PID:7792
- C:\Windows\System\GEZGFvq.exe
  C:\Windows\System\GEZGFvq.exe
  2⤵
  PID:7812
- C:\Windows\System\EMrefaY.exe
  C:\Windows\System\EMrefaY.exe
  2⤵
  PID:7612
- C:\Windows\System\rvbijfl.exe
  C:\Windows\System\rvbijfl.exe
  2⤵
  PID:2020
- C:\Windows\System\THeAlcR.exe
  C:\Windows\System\THeAlcR.exe
  2⤵
  PID:6728
- C:\Windows\System\ezyXrYK.exe
  C:\Windows\System\ezyXrYK.exe
  2⤵
  PID:7972
- C:\Windows\System\gUASyir.exe
  C:\Windows\System\gUASyir.exe
  2⤵
  PID:7884
- C:\Windows\System\izlKXzz.exe
  C:\Windows\System\izlKXzz.exe
  2⤵
  PID:8060
- C:\Windows\System\AteiuIP.exe
  C:\Windows\System\AteiuIP.exe
  2⤵
  PID:8128
- C:\Windows\System\ooeGeke.exe
  C:\Windows\System\ooeGeke.exe
  2⤵
  PID:7332
- C:\Windows\System\VSBUVSu.exe
  C:\Windows\System\VSBUVSu.exe
  2⤵
  PID:7756
- C:\Windows\System\bgpJkKN.exe
  C:\Windows\System\bgpJkKN.exe
  2⤵
  PID:7992
- C:\Windows\System\uzXVwmy.exe
  C:\Windows\System\uzXVwmy.exe
  2⤵
  PID:8116
- C:\Windows\System\EDPqWBc.exe
  C:\Windows\System\EDPqWBc.exe
  2⤵
  PID:7252
- C:\Windows\System\EgSIYUG.exe
  C:\Windows\System\EgSIYUG.exe
  2⤵
  PID:8164
- C:\Windows\System\RYmrQPs.exe
  C:\Windows\System\RYmrQPs.exe
  2⤵
  PID:7396
- C:\Windows\System\jVVBNBD.exe
  C:\Windows\System\jVVBNBD.exe
  2⤵
  PID:7948
- C:\Windows\System\fJsWWLC.exe
  C:\Windows\System\fJsWWLC.exe
  2⤵
  PID:7760
- C:\Windows\System\enBTMup.exe
  C:\Windows\System\enBTMup.exe
  2⤵
  PID:7656
- C:\Windows\System\rWiLENo.exe
  C:\Windows\System\rWiLENo.exe
  2⤵
  PID:7976
- C:\Windows\System\cGQrqLJ.exe
  C:\Windows\System\cGQrqLJ.exe
  2⤵
  PID:6276
- C:\Windows\System\LtOqnvT.exe
  C:\Windows\System\LtOqnvT.exe
  2⤵
  PID:7208
- C:\Windows\System\dlIahwE.exe
  C:\Windows\System\dlIahwE.exe
  2⤵
  PID:7092
- C:\Windows\System\knNYuoC.exe
  C:\Windows\System\knNYuoC.exe
  2⤵
  PID:7400
- C:\Windows\System\sHZyFjK.exe
  C:\Windows\System\sHZyFjK.exe
  2⤵
  PID:7664
- C:\Windows\System\UGjDjQo.exe
  C:\Windows\System\UGjDjQo.exe
  2⤵
  PID:6832
- C:\Windows\System\ajOPmFT.exe
  C:\Windows\System\ajOPmFT.exe
  2⤵
  PID:7308
- C:\Windows\System\mvAuhqC.exe
  C:\Windows\System\mvAuhqC.exe
  2⤵
  PID:7680
- C:\Windows\System\eiiIXEs.exe
  C:\Windows\System\eiiIXEs.exe
  2⤵
  PID:8084
- C:\Windows\System\plAcEry.exe
  C:\Windows\System\plAcEry.exe
  2⤵
  PID:7864
- C:\Windows\System\rUHYebV.exe
  C:\Windows\System\rUHYebV.exe
  2⤵
  PID:8208
- C:\Windows\System\bsAsqOE.exe
  C:\Windows\System\bsAsqOE.exe
  2⤵
  PID:8224
- C:\Windows\System\TNlpYHr.exe
  C:\Windows\System\TNlpYHr.exe
  2⤵
  PID:8244
- C:\Windows\System\tlZMQfM.exe
  C:\Windows\System\tlZMQfM.exe
  2⤵
  PID:8264
- C:\Windows\System\hTDJukr.exe
  C:\Windows\System\hTDJukr.exe
  2⤵
  PID:8288
- C:\Windows\System\aFhOtIA.exe
  C:\Windows\System\aFhOtIA.exe
  2⤵
  PID:8312
- C:\Windows\System\lLWpVeR.exe
  C:\Windows\System\lLWpVeR.exe
  2⤵
  PID:8332
- C:\Windows\System\kWCjrVm.exe
  C:\Windows\System\kWCjrVm.exe
  2⤵
  PID:8352
- C:\Windows\System\yWNPbUu.exe
  C:\Windows\System\yWNPbUu.exe
  2⤵
  PID:8368
- C:\Windows\System\hQbGzgm.exe
  C:\Windows\System\hQbGzgm.exe
  2⤵
  PID:8392
- C:\Windows\System\lmVVHWa.exe
  C:\Windows\System\lmVVHWa.exe
  2⤵
  PID:8416
- C:\Windows\System\bPKRVtV.exe
  C:\Windows\System\bPKRVtV.exe
  2⤵
  PID:8436
- C:\Windows\System\KploBCI.exe
  C:\Windows\System\KploBCI.exe
  2⤵
  PID:8456
- C:\Windows\System\qUBTIKS.exe
  C:\Windows\System\qUBTIKS.exe
  2⤵
  PID:8472
- C:\Windows\System\pHaAEOC.exe
  C:\Windows\System\pHaAEOC.exe
  2⤵
  PID:8496
- C:\Windows\System\YgSKZiy.exe
  C:\Windows\System\YgSKZiy.exe
  2⤵
  PID:8512
- C:\Windows\System\hWKVFnF.exe
  C:\Windows\System\hWKVFnF.exe
  2⤵
  PID:8528
- C:\Windows\System\MRtEBPl.exe
  C:\Windows\System\MRtEBPl.exe
  2⤵
  PID:8548
- C:\Windows\System\jkfXWbO.exe
  C:\Windows\System\jkfXWbO.exe
  2⤵
  PID:8580
- C:\Windows\System\dSvhFOu.exe
  C:\Windows\System\dSvhFOu.exe
  2⤵
  PID:8608
- C:\Windows\System\ZWVrFqu.exe
  C:\Windows\System\ZWVrFqu.exe
  2⤵
  PID:8624
- C:\Windows\System\hoLilpF.exe
  C:\Windows\System\hoLilpF.exe
  2⤵
  PID:8640
- C:\Windows\System\LUIAiPb.exe
  C:\Windows\System\LUIAiPb.exe
  2⤵
  PID:8660
- C:\Windows\System\PXyFabW.exe
  C:\Windows\System\PXyFabW.exe
  2⤵
  PID:8676
- C:\Windows\System\taDTNSH.exe
  C:\Windows\System\taDTNSH.exe
  2⤵
  PID:8692
- C:\Windows\System\gFzKspE.exe
  C:\Windows\System\gFzKspE.exe
  2⤵
  PID:8708
- C:\Windows\System\SRfrKyh.exe
  C:\Windows\System\SRfrKyh.exe
  2⤵
  PID:8728
- C:\Windows\System\eJcMxto.exe
  C:\Windows\System\eJcMxto.exe
  2⤵
  PID:8748
- C:\Windows\System\oTocjHC.exe
  C:\Windows\System\oTocjHC.exe
  2⤵
  PID:8764
- C:\Windows\System\VjjPxgH.exe
  C:\Windows\System\VjjPxgH.exe
  2⤵
  PID:8784
- C:\Windows\System\SzLXxVg.exe
  C:\Windows\System\SzLXxVg.exe
  2⤵
  PID:8804
- C:\Windows\System\MhcSzik.exe
  C:\Windows\System\MhcSzik.exe
  2⤵
  PID:8820
- C:\Windows\System\ckVwbqV.exe
  C:\Windows\System\ckVwbqV.exe
  2⤵
  PID:8836
- C:\Windows\System\PfblDgj.exe
  C:\Windows\System\PfblDgj.exe
  2⤵
  PID:8856
- C:\Windows\System\XjwqpMi.exe
  C:\Windows\System\XjwqpMi.exe
  2⤵
  PID:8876
- C:\Windows\System\gcKeYjr.exe
  C:\Windows\System\gcKeYjr.exe
  2⤵
  PID:8904
- C:\Windows\System\chcyeVj.exe
  C:\Windows\System\chcyeVj.exe
  2⤵
  PID:8920
- C:\Windows\System\fTyMLGL.exe
  C:\Windows\System\fTyMLGL.exe
  2⤵
  PID:8944
- C:\Windows\System\wzmtFCI.exe
  C:\Windows\System\wzmtFCI.exe
  2⤵
  PID:8960
- C:\Windows\System\wVDZCRc.exe
  C:\Windows\System\wVDZCRc.exe
  2⤵
  PID:9012
- C:\Windows\System\arYyrRP.exe
  C:\Windows\System\arYyrRP.exe
  2⤵
  PID:9028
- C:\Windows\System\JDtJpYp.exe
  C:\Windows\System\JDtJpYp.exe
  2⤵
  PID:9048
- C:\Windows\System\KVwmcWQ.exe
  C:\Windows\System\KVwmcWQ.exe
  2⤵
  PID:9068
- C:\Windows\System\pgnMjDu.exe
  C:\Windows\System\pgnMjDu.exe
  2⤵
  PID:9088
- C:\Windows\System\WQbHdKs.exe
  C:\Windows\System\WQbHdKs.exe
  2⤵
  PID:9108
- C:\Windows\System\tCoeTuG.exe
  C:\Windows\System\tCoeTuG.exe
  2⤵
  PID:9124
- C:\Windows\System\mxXJTgJ.exe
  C:\Windows\System\mxXJTgJ.exe
  2⤵
  PID:9148
- C:\Windows\System\vfITNks.exe
  C:\Windows\System\vfITNks.exe
  2⤵
  PID:9172
- C:\Windows\System\mlANidf.exe
  C:\Windows\System\mlANidf.exe
  2⤵
  PID:9188
- C:\Windows\System\TqTrymS.exe
  C:\Windows\System\TqTrymS.exe
  2⤵
  PID:9204
- C:\Windows\System\ZcaxHxM.exe
  C:\Windows\System\ZcaxHxM.exe
  2⤵
  PID:7592
- C:\Windows\System\ijNWkgp.exe
  C:\Windows\System\ijNWkgp.exe
  2⤵
  PID:8220
- C:\Windows\System\EssXaZS.exe
  C:\Windows\System\EssXaZS.exe
  2⤵
  PID:8240
- C:\Windows\System\innxocY.exe
  C:\Windows\System\innxocY.exe
  2⤵
  PID:8296
- C:\Windows\System\oeyGgTX.exe
  C:\Windows\System\oeyGgTX.exe
  2⤵
  PID:8276
- C:\Windows\System\gcZsJAl.exe
  C:\Windows\System\gcZsJAl.exe
  2⤵
  PID:8344
- C:\Windows\System\WNLMHCc.exe
  C:\Windows\System\WNLMHCc.exe
  2⤵
  PID:8380
- C:\Windows\System\WHcJpsA.exe
  C:\Windows\System\WHcJpsA.exe
  2⤵
  PID:8388
- C:\Windows\System\vUqCnpq.exe
  C:\Windows\System\vUqCnpq.exe
  2⤵
  PID:8464
- C:\Windows\System\wpdkAZz.exe
  C:\Windows\System\wpdkAZz.exe
  2⤵
  PID:8536
- C:\Windows\System\LuKWGdw.exe
  C:\Windows\System\LuKWGdw.exe
  2⤵
  PID:8404
- C:\Windows\System\yLueiRu.exe
  C:\Windows\System\yLueiRu.exe
  2⤵
  PID:8524
- C:\Windows\System\QykJRnF.exe
  C:\Windows\System\QykJRnF.exe
  2⤵
  PID:8484
- C:\Windows\System\YwAmALf.exe
  C:\Windows\System\YwAmALf.exe
  2⤵
  PID:8560
- C:\Windows\System\GHVgWjO.exe
  C:\Windows\System\GHVgWjO.exe
  2⤵
  PID:8620
- C:\Windows\System\ABOGXew.exe
  C:\Windows\System\ABOGXew.exe
  2⤵
  PID:8672
- C:\Windows\System\bZwEMnS.exe
  C:\Windows\System\bZwEMnS.exe
  2⤵
  PID:8736
- C:\Windows\System\IzuPFDH.exe
  C:\Windows\System\IzuPFDH.exe
  2⤵
  PID:8812
- C:\Windows\System\HyNWkUQ.exe
  C:\Windows\System\HyNWkUQ.exe
  2⤵
  PID:8852
- C:\Windows\System\ffiqLdx.exe
  C:\Windows\System\ffiqLdx.exe
  2⤵
  PID:8932
- C:\Windows\System\OIknhGU.exe
  C:\Windows\System\OIknhGU.exe
  2⤵
  PID:8652
- C:\Windows\System\DJmODxt.exe
  C:\Windows\System\DJmODxt.exe
  2⤵
  PID:8756
- C:\Windows\System\hEBLbrD.exe
  C:\Windows\System\hEBLbrD.exe
  2⤵
  PID:8832
- C:\Windows\System\iKiXBNB.exe
  C:\Windows\System\iKiXBNB.exe
  2⤵
  PID:8956
- C:\Windows\System\QvXXfvf.exe
  C:\Windows\System\QvXXfvf.exe
  2⤵
  PID:8972
- C:\Windows\System\MnRNMKI.exe
  C:\Windows\System\MnRNMKI.exe
  2⤵
  PID:8992
- C:\Windows\System\MgWBLlC.exe
  C:\Windows\System\MgWBLlC.exe
  2⤵
  PID:9020
- C:\Windows\System\rCOlend.exe
  C:\Windows\System\rCOlend.exe
  2⤵
  PID:9044
- C:\Windows\System\vPTQawT.exe
  C:\Windows\System\vPTQawT.exe
  2⤵
  PID:9080
- C:\Windows\System\ZkILESG.exe
  C:\Windows\System\ZkILESG.exe
  2⤵
  PID:9116
- C:\Windows\System\DsWLgtZ.exe
  C:\Windows\System\DsWLgtZ.exe
  2⤵
  PID:9156
- C:\Windows\System\qAHhQwK.exe
  C:\Windows\System\qAHhQwK.exe
  2⤵
  PID:9164
- C:\Windows\System\PqJzbkK.exe
  C:\Windows\System\PqJzbkK.exe
  2⤵
  PID:9212
- C:\Windows\System\anZZhvu.exe
  C:\Windows\System\anZZhvu.exe
  2⤵
  PID:7248
- C:\Windows\System\mfRrqVV.exe
  C:\Windows\System\mfRrqVV.exe
  2⤵
  PID:8200
- C:\Windows\System\CMPKjHG.exe
  C:\Windows\System\CMPKjHG.exe
  2⤵
  PID:8204
- C:\Windows\System\CRdMRMp.exe
  C:\Windows\System\CRdMRMp.exe
  2⤵
  PID:8320
- C:\Windows\System\aApcCXA.exe
  C:\Windows\System\aApcCXA.exe
  2⤵
  PID:8444
- C:\Windows\System\IwjNGTY.exe
  C:\Windows\System\IwjNGTY.exe
  2⤵
  PID:8400
- C:\Windows\System\kEWqaNj.exe
  C:\Windows\System\kEWqaNj.exe
  2⤵
  PID:8564
- C:\Windows\System\lMTVOvZ.exe
  C:\Windows\System\lMTVOvZ.exe
  2⤵
  PID:8596
- C:\Windows\System\xNZCjki.exe
  C:\Windows\System\xNZCjki.exe
  2⤵
  PID:8452
- C:\Windows\System\hXLJVlv.exe
  C:\Windows\System\hXLJVlv.exe
  2⤵
  PID:8744
- C:\Windows\System\gSxbCtF.exe
  C:\Windows\System\gSxbCtF.exe
  2⤵
  PID:8888
- C:\Windows\System\TetDmoq.exe
  C:\Windows\System\TetDmoq.exe
  2⤵
  PID:8704
- C:\Windows\System\igSwrnr.exe
  C:\Windows\System\igSwrnr.exe
  2⤵
  PID:8940
- C:\Windows\System\rnapjIV.exe
  C:\Windows\System\rnapjIV.exe
  2⤵
  PID:8968
- C:\Windows\System\YVnQdmf.exe
  C:\Windows\System\YVnQdmf.exe
  2⤵
  PID:8988
- C:\Windows\System\haAdZgc.exe
  C:\Windows\System\haAdZgc.exe
  2⤵
  PID:9040
- C:\Windows\System\xsqQQHb.exe
  C:\Windows\System\xsqQQHb.exe
  2⤵
  PID:9084
- C:\Windows\System\FgTIciC.exe
  C:\Windows\System\FgTIciC.exe
  2⤵
  PID:9168
- C:\Windows\System\YymSjWN.exe
  C:\Windows\System\YymSjWN.exe
  2⤵
  PID:8308
- C:\Windows\System\kBSstHv.exe
  C:\Windows\System\kBSstHv.exe
  2⤵
  PID:9196
- C:\Windows\System\cyHOkYM.exe
  C:\Windows\System\cyHOkYM.exe
  2⤵
  PID:8340
- C:\Windows\System\Xztgmvy.exe
  C:\Windows\System\Xztgmvy.exe
  2⤵
  PID:8324
- C:\Windows\System\HXEeZdG.exe
  C:\Windows\System\HXEeZdG.exe
  2⤵
  PID:8508
- C:\Windows\System\jQdiahx.exe
  C:\Windows\System\jQdiahx.exe
  2⤵
  PID:8448
- C:\Windows\System\xgsuXCk.exe
  C:\Windows\System\xgsuXCk.exe
  2⤵
  PID:8588
- C:\Windows\System\EMPLEnn.exe
  C:\Windows\System\EMPLEnn.exe
  2⤵
  PID:8900
- C:\Windows\System\ZXPANUM.exe
  C:\Windows\System\ZXPANUM.exe
  2⤵
  PID:8828
- C:\Windows\System\XkRcgpv.exe
  C:\Windows\System\XkRcgpv.exe
  2⤵
  PID:8872
- C:\Windows\System\rbbMskW.exe
  C:\Windows\System\rbbMskW.exe
  2⤵
  PID:8980
- C:\Windows\System\MLLQiUq.exe
  C:\Windows\System\MLLQiUq.exe
  2⤵
  PID:9076
- C:\Windows\System\pifJiAu.exe
  C:\Windows\System\pifJiAu.exe
  2⤵
  PID:9004
- C:\Windows\System\UeWtPmC.exe
  C:\Windows\System\UeWtPmC.exe
  2⤵
  PID:9200
- C:\Windows\System\dGbRicv.exe
  C:\Windows\System\dGbRicv.exe
  2⤵
  PID:8780
- C:\Windows\System\UQBrTNE.exe
  C:\Windows\System\UQBrTNE.exe
  2⤵
  PID:8844
- C:\Windows\System\rIuTAlx.exe
  C:\Windows\System\rIuTAlx.exe
  2⤵
  PID:8796
- C:\Windows\System\LjsiZiw.exe
  C:\Windows\System\LjsiZiw.exe
  2⤵
  PID:8428
- C:\Windows\System\wngdbTn.exe
  C:\Windows\System\wngdbTn.exe
  2⤵
  PID:8716
- C:\Windows\System\rJiRiXe.exe
  C:\Windows\System\rJiRiXe.exe
  2⤵
  PID:2016
- C:\Windows\System\RozpFkx.exe
  C:\Windows\System\RozpFkx.exe
  2⤵
  PID:7644
- C:\Windows\System\CVySscu.exe
  C:\Windows\System\CVySscu.exe
  2⤵
  PID:8304
- C:\Windows\System\PVhGDuA.exe
  C:\Windows\System\PVhGDuA.exe
  2⤵
  PID:8928
- C:\Windows\System\UoIpFny.exe
  C:\Windows\System\UoIpFny.exe
  2⤵
  PID:7436
- C:\Windows\System\YpyzQSK.exe
  C:\Windows\System\YpyzQSK.exe
  2⤵
  PID:9036
- C:\Windows\System\iDKJYVk.exe
  C:\Windows\System\iDKJYVk.exe
  2⤵
  PID:8648
- C:\Windows\System\VfwssZc.exe
  C:\Windows\System\VfwssZc.exe
  2⤵
  PID:8688
- C:\Windows\System\JucTraW.exe
  C:\Windows\System\JucTraW.exe
  2⤵
  PID:8684
- C:\Windows\System\NodOqSP.exe
  C:\Windows\System\NodOqSP.exe
  2⤵
  PID:8432
- C:\Windows\System\loxIofj.exe
  C:\Windows\System\loxIofj.exe
  2⤵
  PID:8760
- C:\Windows\System\zurcUWE.exe
  C:\Windows\System\zurcUWE.exe
  2⤵
  PID:8328
- C:\Windows\System\UdSnaqu.exe
  C:\Windows\System\UdSnaqu.exe
  2⤵
  PID:9220
- C:\Windows\System\KcaSJEg.exe
  C:\Windows\System\KcaSJEg.exe
  2⤵
  PID:9236
- C:\Windows\System\iLvrmQp.exe
  C:\Windows\System\iLvrmQp.exe
  2⤵
  PID:9252
- C:\Windows\System\HEpObuw.exe
  C:\Windows\System\HEpObuw.exe
  2⤵
  PID:9296
- C:\Windows\System\oeScJZX.exe
  C:\Windows\System\oeScJZX.exe
  2⤵
  PID:9312
- C:\Windows\System\CmHfnto.exe
  C:\Windows\System\CmHfnto.exe
  2⤵
  PID:9332
- C:\Windows\System\BXvBCAo.exe
  C:\Windows\System\BXvBCAo.exe
  2⤵
  PID:9352
- C:\Windows\System\kQEDMCC.exe
  C:\Windows\System\kQEDMCC.exe
  2⤵
  PID:9372
- C:\Windows\System\TylnMkd.exe
  C:\Windows\System\TylnMkd.exe
  2⤵
  PID:9388
- C:\Windows\System\WzSKkBu.exe
  C:\Windows\System\WzSKkBu.exe
  2⤵
  PID:9404
- C:\Windows\System\RgtiFYq.exe
  C:\Windows\System\RgtiFYq.exe
  2⤵
  PID:9436
- C:\Windows\System\BDNhXnx.exe
  C:\Windows\System\BDNhXnx.exe
  2⤵
  PID:9452
- C:\Windows\System\BqrTxqL.exe
  C:\Windows\System\BqrTxqL.exe
  2⤵
  PID:9472
- C:\Windows\System\MseMobC.exe
  C:\Windows\System\MseMobC.exe
  2⤵
  PID:9488
- C:\Windows\System\JoeYMZK.exe
  C:\Windows\System\JoeYMZK.exe
  2⤵
  PID:9508
- C:\Windows\System\Tovzjru.exe
  C:\Windows\System\Tovzjru.exe
  2⤵
  PID:9528
- C:\Windows\System\ZfPrjSt.exe
  C:\Windows\System\ZfPrjSt.exe
  2⤵
  PID:9552
- C:\Windows\System\gWWmpez.exe
  C:\Windows\System\gWWmpez.exe
  2⤵
  PID:9568
- C:\Windows\System\WXZViQd.exe
  C:\Windows\System\WXZViQd.exe
  2⤵
  PID:9584
- C:\Windows\System\udGYysq.exe
  C:\Windows\System\udGYysq.exe
  2⤵
  PID:9600
- C:\Windows\System\XjPtoYQ.exe
  C:\Windows\System\XjPtoYQ.exe
  2⤵
  PID:9628
- C:\Windows\System\soahlwR.exe
  C:\Windows\System\soahlwR.exe
  2⤵
  PID:9648
- C:\Windows\System\aWfPNAF.exe
  C:\Windows\System\aWfPNAF.exe
  2⤵
  PID:9668
- C:\Windows\System\MBbZHqn.exe
  C:\Windows\System\MBbZHqn.exe
  2⤵
  PID:9684
- C:\Windows\System\svxqCZp.exe
  C:\Windows\System\svxqCZp.exe
  2⤵
  PID:9704
- C:\Windows\System\VPXEPKH.exe
  C:\Windows\System\VPXEPKH.exe
  2⤵
  PID:9740
- C:\Windows\System\fRwCrCf.exe
  C:\Windows\System\fRwCrCf.exe
  2⤵
  PID:9756
- C:\Windows\System\NeWOrxb.exe
  C:\Windows\System\NeWOrxb.exe
  2⤵
  PID:9776
- C:\Windows\System\FkLJutF.exe
  C:\Windows\System\FkLJutF.exe
  2⤵
  PID:9796
- C:\Windows\System\cpgJdnl.exe
  C:\Windows\System\cpgJdnl.exe
  2⤵
  PID:9816
- C:\Windows\System\GhbYsNG.exe
  C:\Windows\System\GhbYsNG.exe
  2⤵
  PID:9832
- C:\Windows\System\ayoEeJa.exe
  C:\Windows\System\ayoEeJa.exe
  2⤵
  PID:9856
- C:\Windows\System\YOJxKIf.exe
  C:\Windows\System\YOJxKIf.exe
  2⤵
  PID:9872
- C:\Windows\System\cRKAjbb.exe
  C:\Windows\System\cRKAjbb.exe
  2⤵
  PID:9888
- C:\Windows\System\UgHZsof.exe
  C:\Windows\System\UgHZsof.exe
  2⤵
  PID:9920
- C:\Windows\System\VKNwNrb.exe
  C:\Windows\System\VKNwNrb.exe
  2⤵
  PID:9940
- C:\Windows\System\ABKVTUz.exe
  C:\Windows\System\ABKVTUz.exe
  2⤵
  PID:9956
- C:\Windows\System\yBNdbQK.exe
  C:\Windows\System\yBNdbQK.exe
  2⤵
  PID:9972
- C:\Windows\System\MqJmHRX.exe
  C:\Windows\System\MqJmHRX.exe
  2⤵
  PID:9996
- C:\Windows\System\kmeFcQq.exe
  C:\Windows\System\kmeFcQq.exe
  2⤵
  PID:10016
- C:\Windows\System\MYVCDdO.exe
  C:\Windows\System\MYVCDdO.exe
  2⤵
  PID:10040
- C:\Windows\System\SsIJbfC.exe
  C:\Windows\System\SsIJbfC.exe
  2⤵
  PID:10056
- C:\Windows\System\jPHVeKf.exe
  C:\Windows\System\jPHVeKf.exe
  2⤵
  PID:10072
- C:\Windows\System\VuiySuU.exe
  C:\Windows\System\VuiySuU.exe
  2⤵
  PID:10100
- C:\Windows\System\BuyZMLQ.exe
  C:\Windows\System\BuyZMLQ.exe
  2⤵
  PID:10116
- C:\Windows\System\nqpKXFd.exe
  C:\Windows\System\nqpKXFd.exe
  2⤵
  PID:10132
- C:\Windows\System\hnlCUtp.exe
  C:\Windows\System\hnlCUtp.exe
  2⤵
  PID:10156
- C:\Windows\System\EuuavTj.exe
  C:\Windows\System\EuuavTj.exe
  2⤵
  PID:10176
- C:\Windows\System\FPRTAee.exe
  C:\Windows\System\FPRTAee.exe
  2⤵
  PID:10196
- C:\Windows\System\iFQZIqr.exe
  C:\Windows\System\iFQZIqr.exe
  2⤵
  PID:10216
- C:\Windows\System\KNvZukg.exe
  C:\Windows\System\KNvZukg.exe
  2⤵
  PID:10232
- C:\Windows\System\BtMXdvC.exe
  C:\Windows\System\BtMXdvC.exe
  2⤵
  PID:9268
- C:\Windows\System\kHzEzAz.exe
  C:\Windows\System\kHzEzAz.exe
  2⤵
  PID:9272
- C:\Windows\System\HGqiIuI.exe
  C:\Windows\System\HGqiIuI.exe
  2⤵
  PID:9292
- C:\Windows\System\fNZeNcf.exe
  C:\Windows\System\fNZeNcf.exe
  2⤵
  PID:9360
- C:\Windows\System\NBhHLtw.exe
  C:\Windows\System\NBhHLtw.exe
  2⤵
  PID:9384
- C:\Windows\System\gJaBkNw.exe
  C:\Windows\System\gJaBkNw.exe
  2⤵
  PID:9348
- C:\Windows\System\IecjYUe.exe
  C:\Windows\System\IecjYUe.exe
  2⤵
  PID:9444
- C:\Windows\System\UpiiNyi.exe
  C:\Windows\System\UpiiNyi.exe
  2⤵
  PID:9480
- C:\Windows\System\fUWDXwX.exe
  C:\Windows\System\fUWDXwX.exe
  2⤵
  PID:9500
- C:\Windows\System\PvvkeYZ.exe
  C:\Windows\System\PvvkeYZ.exe
  2⤵
  PID:9592
- C:\Windows\System\tgFUfFg.exe
  C:\Windows\System\tgFUfFg.exe
  2⤵
  PID:9596
- C:\Windows\System\ESZnPlv.exe
  C:\Windows\System\ESZnPlv.exe
  2⤵
  PID:9612
- C:\Windows\System\WzZvNIV.exe
  C:\Windows\System\WzZvNIV.exe
  2⤵
  PID:9644
- C:\Windows\System\yfxgssE.exe
  C:\Windows\System\yfxgssE.exe
  2⤵
  PID:9696
- C:\Windows\System\ikdnOoX.exe
  C:\Windows\System\ikdnOoX.exe
  2⤵
  PID:9716
- C:\Windows\System\mOGhKON.exe
  C:\Windows\System\mOGhKON.exe
  2⤵
  PID:9748
- C:\Windows\System\eZXNbQI.exe
  C:\Windows\System\eZXNbQI.exe
  2⤵
  PID:9768
- C:\Windows\System\mrAXMya.exe
  C:\Windows\System\mrAXMya.exe
  2⤵
  PID:9804
- C:\Windows\System\eurpUAx.exe
  C:\Windows\System\eurpUAx.exe
  2⤵
  PID:9864
- C:\Windows\System\snyzlKK.exe
  C:\Windows\System\snyzlKK.exe
  2⤵
  PID:9884
- C:\Windows\System\bWIfuWP.exe
  C:\Windows\System\bWIfuWP.exe
  2⤵
  PID:9908
- C:\Windows\System\QfvMhZI.exe
  C:\Windows\System\QfvMhZI.exe
  2⤵
  PID:9932
- C:\Windows\System\SHMMqUG.exe
  C:\Windows\System\SHMMqUG.exe
  2⤵
  PID:9984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BMmcqBw.exe

Filesize
2.1MB

MD5
f4e9edf1e3c6345334a0da9b6cd711ca

SHA1
4268658062fa75c010df4b8d82042947399da207

SHA256
333e3f070a8b7686f0790952ab51dc65d69d3aaec79129e0e93346532d7eec45

SHA512
c21511a37b9a6685812f18918e17aece49f2635de16600cf0b043bcc46da0c7ae20f4db18e4cd04f6db49617dd18c2c5ab21839b9c9c7887ae7c7de2f727140f

Download Submit
C:\Windows\system\BYAUaqX.exe

Filesize
2.1MB

MD5
dae78ae5d240bcd1bb14f51a755dc798

SHA1
2ce547bc5908d871988ec1883e1cb04b5b9d8709

SHA256
778ac060f86e790166ed68978666d6a6ec735aae5e7fd813148a37954f3596ac

SHA512
119d2489b51854765401c131c1b30f588c698c2639c61262675bcce6b564b685dd58c62d6f407d66a823b5149bb724f3952b86fdb82faa4d0979cc97155205f0

Download Submit
C:\Windows\system\EuaaNRW.exe

Filesize
2.1MB

MD5
32778b1ffcccfe351b521de414dc8552

SHA1
d21b1021ca107775b1b1b72b11eb2429418a7324

SHA256
3b7df6017cbcafe2ae350ca9661f1e7fec4a2b0c81e5279d5e271d14bae06d7b

SHA512
b1a090a2e5eab09adccfe21ff9da131d7cb58c80fe9ac3d6c9e9666cd2c8b096ab860bbbb56e54cc7ec029eea0f14098b06442af2ff645592405f89f19a44cca

Download Submit
C:\Windows\system\GuNQsmJ.exe

Filesize
2.1MB

MD5
adcd0525a2e2ca43dd9df291aaece7e0

SHA1
f4e385c231b8e74b3e9b405733f575845a0f439f

SHA256
473770d51ca45be757ab1ea36f14d012fb287babc70e9e5440d7057021a438fc

SHA512
8c6519723fbdf16bfde6d5722b04d0d6c1f448c87543a65ac57f2c4e80d046486bc1a55f3b0a851ff0c8835dda7d5ab1ea311cf6c6f78852626a3f9750eb2365

Download Submit
C:\Windows\system\JdRfHcQ.exe

Filesize
2.1MB

MD5
05b5cf862a5263e107ab3e94ea7e8591

SHA1
b80b6e6d7ad1bd792bfda62d8b0080dd3bcac435

SHA256
d919473f7d3864fc7fcabe709efe93f3ec1cf5a88d968d9284ba0976df3f0fe2

SHA512
1ff7634e685b0edfd78080190ae44cecff15f974958ecc53278518c4e128d89e0e5009cceea32d7217b618c42a0644f076119f13eb4e2f58934b64c5691aa903

Download Submit
C:\Windows\system\LVbAgrK.exe

Filesize
2.1MB

MD5
8a0ecd3c9e2e15fd0537e9743f308273

SHA1
309d49fd33ad0c0d808fe3ac7ef15243826469ed

SHA256
7ba70e9fdfe7a51d7d775c54697845cadca9c7ba6d4c848cd58b2c936bcad358

SHA512
66b38f5110511f6acc62093cee170ec7e612b90e463c035d1e9fee8c351a431ed160817b1167ca740b63c506a8f0540d6b5df3665849564a03a76873f9a71ec2

Download Submit
C:\Windows\system\NEmEbNY.exe

Filesize
2.1MB

MD5
1e81288d4909ef1a20bc1dd5fab29235

SHA1
e0a8e1b698d1c172ea392d45da3013b6913e2c7d

SHA256
a74381c223aa144063deb2048c9eaafe1b0088c91a51a8cbe393e0f6aba82bc2

SHA512
b35d89620dea7ea639a5a09e30155c9391c0aa8d701f7d7077992b9802ab7ddfd89f342a290a043a8263cbdcba575f363f80a5d88d5f7ab5da471cfff3e91f41

Download Submit
C:\Windows\system\ObxQBEb.exe

Filesize
2.1MB

MD5
e7f00fa42c2fa708f2d77f99f6be03c2

SHA1
d3d4f6305795201a63fdc1d15c5f4ae52ea1c577

SHA256
79e3b4a312b9b6136d7020214822ded0481a35c699d54cab4f3716421e4e1bcf

SHA512
858c4e63af0f696dfbe4ca0ad8d8c53da7e62339eea69a50bc050ef2d2f0218d8b120314a05ea7df76eccf4393c0acec0e55a102014d1065c055ff4d4a2c6c08

Download Submit
C:\Windows\system\QNezYGi.exe

Filesize
2.1MB

MD5
1a00de7fc1c321c1b080d240f5d813a0

SHA1
066a0a75e55b3246daf023b800d668133503342a

SHA256
695df6635042bd88bc6ab3bdbd51da210461562f51d6011f738577d03f57bc8a

SHA512
98380805b6bdbdc690ee8cefa7bc8323744afdc060e15ae0345411db08112cdc657b8d2b28f08781208d35e1fdfb0b2cf2acc89827f32feca9c0bed4d78a2804

Download Submit
C:\Windows\system\SajvdXR.exe

Filesize
2.1MB

MD5
5a6b63ac860cf3406b0b64f7c8a3d972

SHA1
faacddf8740e0521733ec2be349197c40c35d340

SHA256
bb89c80f1229b202774e0586a5e89de20235586f316aae9cc5cfc8b4a445110b

SHA512
d40f7799cfd706b6e734c7888d3c0827435d4b5ea7a96c370e66a4d27e30ecf7e97d081e8b23fd81d02f7cc93a47c25d3d570eb1f85542f133db812c4a24eb00

Download Submit
C:\Windows\system\SgBAQSp.exe

Filesize
2.1MB

MD5
45b542bc384cb208d1dcc9ea0550efba

SHA1
9b857db6cd1a850eaa276738c54c8a2af819ee88

SHA256
9b02fa60478f1960a03efb97f1d7c333411e2707440fab3cca1db4423a8a21e2

SHA512
74384fc9c5b362a2e3dea5cc0fd180763175640e619b2d94a2b86d15141c9c58de910bfab2dfd434cc3bcb573939dcd19f3946bb320b8491beb4ac0f869b1949

Download Submit
C:\Windows\system\TLVrddt.exe

Filesize
2.1MB

MD5
d490c7341934544ad2670d415cf36508

SHA1
04f5185107f96aeaf8635102209d3faa887bf10f

SHA256
769b65cf95df1584b88394dc0073c05d6f8fe483e763ebaae88247c18172fc09

SHA512
30849f56b209aab586f6ad382d1bc6b6d6a2c2b29d37eafcde287041d3c91d49d9ede86de4d4bc4df3fddc63fa08cbde869f81cb8b0cedcb34847b45ddc3b062

Download Submit
C:\Windows\system\aJLMTsT.exe

Filesize
2.1MB

MD5
c965f297867d50d4cd1e40f7f2abdf5f

SHA1
bae4515547b6ef22da7ea305b8301ebbdc42e35a

SHA256
6aee13038b7d5fe8504bc58e4f21c4a38f1653ceec3d108aa0658ce8e6276830

SHA512
874c9931ef29562bb0e9744eb7b7adc3ceea49c71bdfac93ab0cd97e515d626cdb1214d44e14196b9956e1704c57998a06283e5532971a743783cd10bfe528e8

Download Submit
C:\Windows\system\btEtqYt.exe

Filesize
2.1MB

MD5
66e8f90366d470594dac0acfdea97df3

SHA1
10bbfced8ef52ac2b057f88f0018aeace4e68b71

SHA256
f5a9dbbe2817d272d5e87b40d0c8f23458fba31f00f6089b77d227472e7f8e30

SHA512
cb37cded734be78c0594127dc6ed265610917a1faee7aa800facdc24844946e1e3315826fcec56c268be276049100fe88c1d8f7005de00e6766e3c5e007fabff

Download Submit
C:\Windows\system\hdZpVYK.exe

Filesize
2.1MB

MD5
8f09e82da22f998f44fe6de64a45f4e4

SHA1
5702744f2315802a7bcdde9fd11047ccad83b87f

SHA256
8adbd8a22bcbb13b767b93fb753395e24c6ab1f645bbfd9935a3eca85faf0a67

SHA512
f01d49767d6eae8f52afb66f8be43b4df498e0567ac32b38682b4ceba13f88d3ada884e42a1ae7033fbcf1343a4abeccd248277e4576a1d06d478890e7ee5207

Download Submit
C:\Windows\system\mxOVlYE.exe

Filesize
2.1MB

MD5
3db35ccd6ccb41bae6eaf4ef65bf4f8c

SHA1
0e4fd6fe7ab05f61e0ba294e8f063ab814c1a35a

SHA256
fbe5e22a0e8c0a48d29104c0e085e568abfd0031b04a2fab838d0df12f9b59bc

SHA512
80cf041779bc7ffb3bfe0251ca515f433a786c3213f6d32a68875089ce96d8dff261b40d2b1ab964e26b26e37913ad1bc20f58d1066847a2807e71c3227ae36c

Download Submit
C:\Windows\system\pGeAybd.exe

Filesize
2.1MB

MD5
492ab2b046ea91a2794778e704859cc7

SHA1
1d6960a23fb953971f87d584f6c4d545f39f920f

SHA256
d6b125b1223d13cb68a3380097811196b5537645f5876b496c4035cfd7a3940c

SHA512
7e05b8a4f11e269e4f7c988535af19ecd8c372927400e66e298da64947c7bd5125081ebdd58547bc42f798cf66833b37903b6d842b24c81c779737f4f75e8d5f

Download Submit
C:\Windows\system\pLDVMeF.exe

Filesize
2.1MB

MD5
2a2936d7f9bae60e8b38e9967e73d305

SHA1
fd3adb305c55a02e2e3560af8004807137270401

SHA256
1814ced75c7abe5fe05b87506114e9cccbd89a05d29fb8cf86d6bc95568eb828

SHA512
5e65452b91b3a68976db5ab0b5d07cd21198eaa98bbdc8b072caf363f44f81141a8b654f2160aae52f40c10946a41f571ce51921f65b6ee4d154e71b5f073b14

Download Submit
C:\Windows\system\peJsbOZ.exe

Filesize
2.1MB

MD5
15985c19553d5aae4ec430b0aae2db38

SHA1
62ff6ef0ca8b7fae442ee4a1df02550901a665e5

SHA256
6bf28d722d594440d252e95b848cb2ea22e6b251e7292d6d8b74a7c803598c32

SHA512
3f15c5415407e9329606478e55c9176d1fdaa17f9f01b32596e3b4e2b0b0d54f94fc5156b37438ee982ca5f0000d26dc214dc3d3b88aef10599bade10b87bcc8

Download Submit
C:\Windows\system\qEYeAuv.exe

Filesize
2.1MB

MD5
f485a201e063817d90b237f0cc20ed3f

SHA1
d844391fa4405daf8278c996cda5ae998e8cf850

SHA256
20eae1b724b0f4257e06ac6338c3d2f1fedcc7f7033cb022b67403a446ca5443

SHA512
119d6cea9e640e4fe5b6994ade5fd507d777416402b600e4d5fa225547852e4fc74c179aa6f9fe8c0293b943ce5047cf89de7f102790e4857ebe1abd724cb104

Download Submit
C:\Windows\system\qSeSATX.exe

Filesize
2.1MB

MD5
6bed97f34b52bbf95802dc9e3a714e7c

SHA1
2a9f7b756ecd0627c6915b4fb1dd8b7371f2189b

SHA256
66a68bcefdb7947f771b19bcfdba0a0bc977ea9ab9b698d464fd80daa9b7d77d

SHA512
c4e8d90aa5dee1213c9082b0fd446ce24b1f5488d6acc638e487ce2209765059330df8c3db9ed1b484f747a81e43a41deca8176c04b8982deaf3803a16cad6cd

Download Submit
C:\Windows\system\rldrunp.exe

Filesize
2.1MB

MD5
3bf2631a203e34c5135976990ee9a9a9

SHA1
3b09cf5ea5cc73dc67a61078a44b43adf668925f

SHA256
f41e8c58a22e3d7cab6b00d82b1d751a1b727ae1f2a1ccff9bf996fb5cf2f963

SHA512
a2b67eb3b7a6b68e0aa33c1ddf42ab83801a3590cf4fa949e0c514800d8abc28aa9bba3224f1467f0313da8a7a02f2d4d3dc7e83707e5833b50f3c3bf3f59aa4

Download Submit
C:\Windows\system\sWtOchT.exe

Filesize
2.1MB

MD5
eecc0be919a2e76f6c366ed37a901667

SHA1
1b23bd629880850dd9f3ecbfd681077f90085cca

SHA256
d802a20fae1d5328d8691e3b8db7a17248ffe4f59599daeaa454496dad2675c5

SHA512
5c6077008121d68bd473ceef590cc9bfe8975652e621045f4f25dd2ceb873801c805d3cf7798056c389e05cf949bba9f5b71d4807d397bc664fe23de0070bccf

Download Submit
C:\Windows\system\tVOUvmv.exe

Filesize
2.1MB

MD5
f355d6202af9ed7645fee4bed40c1ebd

SHA1
b4c776759fb852f7d6783710002e73076d691018

SHA256
8fa897e05213efb3997097cd2197b3b2791285782e161f86b702539ffd8fa220

SHA512
a84b738c212489f044cefc556e768396914026442fb90d617ad66d5fda04dd006548f7c7b3fa75c7f9a679e9dcf61ba481308f777ec47398d7b3da6195460e1f

Download Submit
C:\Windows\system\tvkcXjc.exe

Filesize
2.1MB

MD5
3849081a6a5cd7d2b65331d47a8edde3

SHA1
e3055b4a916ee298b0c3b82797ba232cb6cd508b

SHA256
385d5b4a8e4ac35f279e7fdd819a3ed07da2f981ed943f7a9cdbbbd5267f34fa

SHA512
58399d7ad92bdf824722374568beee64a60d28d5eb8aa342ee4b009634ce7db8054a83f149cecfe73d6479c8ccc0e62ed3d6e3a49b2fdb294bf07ff487b33179

Download Submit
C:\Windows\system\uHkFKMw.exe

Filesize
2.1MB

MD5
5494211f949a5900dd52d61016fd21c7

SHA1
b0d257c430cbed26c49aa9b4522bae89903b55c3

SHA256
f9fe60bf1240f494cde4e47ffda9c5b7c403e741bfe34155ee8019ba32018cd5

SHA512
2b2bdc8805ef09696254dd6cc7bb6e294570d9b9bd804f502ba60858ecfd01b8de57067fa734be77930040368f3357faee4f4853c07090d2ae016702b9fdc76d

Download Submit
C:\Windows\system\xlnNOyG.exe

Filesize
2.1MB

MD5
6367db40dd0143c45239a477860626c3

SHA1
97b7f7665be911e98e40156d344a832c132958ba

SHA256
98bfe66c7dd0447ca25f15189170b68ad85c02992552cdaee9e5011c3e6dc708

SHA512
2c5bf12fac814ef0a3bd094d39c85b90842e6b19416a7c075c9ea213c11fa2233b8a5e5b66b16f217c95fb95b72c69867a706f6ef8c7688363e34d1aadaa2c6f

Download Submit
C:\Windows\system\zmdrhLa.exe

Filesize
2.1MB

MD5
76557a4fbb67197e80dc46ca82c24e0f

SHA1
5cf45b1eb2ef81af55f15b89f71fff7306aa0a5b

SHA256
f1d035415cff2fc303b584d04d76c1c6ca361a400533b82dbae117393e805112

SHA512
801dca913289d709fdc2d366cdf4e18e4978dca91d98ff091305118664aad836a8bab2c485e6f5c6ecc5381e8316f4818d7688c8b72070f0223c7448266b4b7e

Download Submit
\Windows\system\YYimdEz.exe

Filesize
2.1MB

MD5
7a5192b4905e44097d56b4e33eb718d8

SHA1
caf4caa207d66c08d6893a93c9eebbeb2b737ce9

SHA256
84651cb1897ba57eb60a09f35922d6f0df6a7500baa5c9575af6c266600a0310

SHA512
e7087311a634f332929311301b09329c2fda7faacf5f0c909b32e1431ed628e90201c78abbc3f2fbdf8c12e353b07f2d8a1c41831ba378a1481f52190f2f75dc

Download Submit
\Windows\system\iTYrrTp.exe

Filesize
2.1MB

MD5
84ec6376d958038254d962c1141079a2

SHA1
b77f25b7fe23646a86a6c756caa5b7a8bb39e85a

SHA256
d888dcc1ef8d6a940e5582d21b8d3d8364b7eeff1d2b8333cbe393c46b6d8684

SHA512
8970aa624854d833e03761fe725d173cf6b8f3ad3f32f9ff57cde1876d364ed1d50308f44f182ea46e27102bf17837ee7527008f68fb2bd57d1dbd46b22862ac

Download Submit
\Windows\system\pFFyCZw.exe

Filesize
2.1MB

MD5
e14caec6fcfdfe2c2f0cae2c2aa635e7

SHA1
e09d653cf9f7108b34c1cc50f5073cbac7582b9b

SHA256
068df23ef83542eb672a6183ffa742cb1a35fffbf9ad5f0ced3d9964f31a8d8d

SHA512
89869732388d15ed507a4f0ac203a738fd29d4128097acea903df0de6424dc6c9a84c45455ba929552e06a26056bf9780d58b17f68d2f2619d8924a493d8b80d

Download Submit
\Windows\system\wcRuCnG.exe

Filesize
2.1MB

MD5
6f7cc4992132a54c2bf9fdf259818c72

SHA1
5069ad50cd0d99d292915e9ec99589b7d6842c31

SHA256
2a0ef612a13ad3b292a0a0f0b485281cb0131b9f22a9807faf2dc89d9f68d92e

SHA512
e3f64a87c2c3dd20550eb628090d3103b6693fc2f8aadd476195b8f05fb1a6ee4b5212725a8a6538673719bffea6b1ed5d3e7aaa91736a4a1f0a2b9abaf2565d

Download Submit
memory/632-4024-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/632-95-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/1664-94-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/1664-54-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-1835-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/1664-3253-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-31-0x000000013F780000-0x000000013FAD4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-87-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-35-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-37-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/1664-3252-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-19-0x000000013FAD0000-0x000000013FE24000-memory.dmp

Filesize
3.3MB

Download
memory/1664-40-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-2828-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-2702-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-1842-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-2-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-102-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1664-3839-0x0000000001F70000-0x00000000022C4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-72-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/1664-86-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-82-0x000000013FB30000-0x000000013FE84000-memory.dmp

Filesize
3.3MB

Download
memory/1664-8-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2156-4012-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2156-9-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2252-4021-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2252-88-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2456-4020-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2456-2703-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2456-65-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2472-101-0x000000013FB30000-0x000000013FE84000-memory.dmp

Filesize
3.3MB

Download
memory/2472-4025-0x000000013FB30000-0x000000013FE84000-memory.dmp

Filesize
3.3MB

Download
memory/2520-4017-0x000000013F210000-0x000000013F564000-memory.dmp

Filesize
3.3MB

Download
memory/2520-44-0x000000013F210000-0x000000013F564000-memory.dmp

Filesize
3.3MB

Download
memory/2536-43-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2536-4015-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2568-69-0x000000013F140000-0x000000013F494000-memory.dmp

Filesize
3.3MB

Download
memory/2568-4019-0x000000013F140000-0x000000013F494000-memory.dmp

Filesize
3.3MB

Download
memory/2580-4022-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/2580-96-0x000000013F9E0000-0x000000013FD34000-memory.dmp

Filesize
3.3MB

Download
memory/2604-4014-0x000000013F780000-0x000000013FAD4000-memory.dmp

Filesize
3.3MB

Download
memory/2604-28-0x000000013F780000-0x000000013FAD4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4018-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2652-58-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2796-4016-0x000000013F400000-0x000000013F754000-memory.dmp

Filesize
3.3MB

Download
memory/2796-38-0x000000013F400000-0x000000013F754000-memory.dmp

Filesize
3.3MB

Download
memory/2796-1840-0x000000013F400000-0x000000013F754000-memory.dmp

Filesize
3.3MB

Download
memory/2876-97-0x000000013FF90000-0x00000001402E4000-memory.dmp

Filesize
3.3MB

Download
memory/2876-4023-0x000000013FF90000-0x00000001402E4000-memory.dmp

Filesize
3.3MB

Download
memory/2956-4013-0x000000013FAD0000-0x000000013FE24000-memory.dmp

Filesize
3.3MB

Download
memory/2956-24-0x000000013FAD0000-0x000000013FE24000-memory.dmp

Filesize
3.3MB

Download