xmrig | 50ba3e44d1afd879e9cbfdc00383e93c255ad0f6ab24d56787a5c7f9b2007bf7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
Size

1.9MB
MD5

8b8c8dce7d6bce8b351a670fa96aac80
SHA1

2d6a404caa74f85ae4ef9f884fb136cf817d1b84
SHA256

50ba3e44d1afd879e9cbfdc00383e93c255ad0f6ab24d56787a5c7f9b2007bf7
SHA512

94e044de545960d8928887ec30f4507a1f6c2dee31d0260d8c6ef1e4586f6034378795e0ddd8490ca748c55053859cd77052eed952f14fb39569850afb54e546
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxxdcvou25dwmTL:BemTLkNdfE0pZrQf

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1224-2-0x000000013FEC0000-0x0000000140214000-memory.dmp	xmrig
behavioral1/files/0x0009000000012280-3.dat	xmrig
behavioral1/memory/2868-9-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/files/0x0038000000016448-13.dat	xmrig
behavioral1/memory/1924-15-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019349-190.dat	xmrig
behavioral1/files/0x0005000000019296-185.dat	xmrig
behavioral1/files/0x00060000000190d6-180.dat	xmrig
behavioral1/files/0x0006000000018bda-175.dat	xmrig
behavioral1/files/0x0006000000018bc6-170.dat	xmrig
behavioral1/files/0x00050000000187a2-160.dat	xmrig
behavioral1/files/0x0006000000018b73-165.dat	xmrig
behavioral1/files/0x000500000001878b-155.dat	xmrig
behavioral1/files/0x0005000000018784-151.dat	xmrig
behavioral1/files/0x000500000001873a-145.dat	xmrig
behavioral1/files/0x0005000000018711-140.dat	xmrig
behavioral1/files/0x000500000001870d-135.dat	xmrig
behavioral1/files/0x0005000000018701-130.dat	xmrig
behavioral1/files/0x00050000000186ff-125.dat	xmrig
behavioral1/files/0x00060000000175f4-120.dat	xmrig
behavioral1/files/0x00060000000175e8-115.dat	xmrig
behavioral1/files/0x0006000000017568-111.dat	xmrig
behavioral1/files/0x00060000000173d3-93.dat	xmrig
behavioral1/memory/2224-104-0x000000013F070000-0x000000013F3C4000-memory.dmp	xmrig
behavioral1/memory/2572-87-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/1332-86-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/files/0x000600000001720f-84.dat	xmrig
behavioral1/memory/1940-102-0x000000013F560000-0x000000013F8B4000-memory.dmp	xmrig
behavioral1/files/0x00060000000173d6-100.dat	xmrig
behavioral1/memory/3064-99-0x000000013F990000-0x000000013FCE4000-memory.dmp	xmrig
behavioral1/files/0x00060000000173b4-90.dat	xmrig
behavioral1/memory/1924-82-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/2508-80-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/memory/2552-71-0x000000013FE30000-0x0000000140184000-memory.dmp	xmrig
behavioral1/memory/1224-70-0x000000013FEC0000-0x0000000140214000-memory.dmp	xmrig
behavioral1/files/0x00060000000171ba-74.dat	xmrig
behavioral1/files/0x0006000000016dd1-68.dat	xmrig
behavioral1/memory/2524-64-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/memory/2772-57-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/files/0x0006000000016dc8-60.dat	xmrig
behavioral1/files/0x0008000000016d05-55.dat	xmrig
behavioral1/memory/1224-54-0x0000000002030000-0x0000000002384000-memory.dmp	xmrig
behavioral1/memory/2720-53-0x000000013F630000-0x000000013F984000-memory.dmp	xmrig
behavioral1/memory/2652-52-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016caf-35.dat	xmrig
behavioral1/files/0x0009000000016cde-45.dat	xmrig
behavioral1/memory/1224-41-0x000000013F630000-0x000000013F984000-memory.dmp	xmrig
behavioral1/memory/2644-40-0x000000013FE90000-0x00000001401E4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c67-33.dat	xmrig
behavioral1/memory/3064-29-0x000000013F990000-0x000000013FCE4000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c5d-27.dat	xmrig
behavioral1/memory/1332-23-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/files/0x0008000000016a7d-12.dat	xmrig
behavioral1/memory/2508-4019-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/memory/2868-4020-0x000000013FC60000-0x000000013FFB4000-memory.dmp	xmrig
behavioral1/memory/1924-4021-0x000000013FF60000-0x00000001402B4000-memory.dmp	xmrig
behavioral1/memory/1332-4022-0x000000013F4F0000-0x000000013F844000-memory.dmp	xmrig
behavioral1/memory/2644-4023-0x000000013FE90000-0x00000001401E4000-memory.dmp	xmrig
behavioral1/memory/2652-4024-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	xmrig
behavioral1/memory/2772-4027-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/2524-4026-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/memory/2720-4025-0x000000013F630000-0x000000013F984000-memory.dmp	xmrig
behavioral1/memory/3064-4028-0x000000013F990000-0x000000013FCE4000-memory.dmp	xmrig
behavioral1/memory/2224-4029-0x000000013F070000-0x000000013F3C4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2868	qILRDdx.exe
1924	AUhEtka.exe
1332	MHVqmhI.exe
3064	VDGjmOU.exe
2644	WMkGSZN.exe
2652	ygtOniG.exe
2720	skNEOPy.exe
2772	GHqHwOq.exe
2524	MZjnFYA.exe
2552	CJVJrcO.exe
2508	nVIarpm.exe
2572	RSlGlwS.exe
1940	uGEOEOY.exe
2224	YUwHTOI.exe
1288	qphetjK.exe
1444	SdLJMnV.exe
1704	PIBvahb.exe
2420	UZspCfy.exe
2424	xTBWZAx.exe
2144	oyYAIuX.exe
772	QKVMjQb.exe
1500	JyNrtNW.exe
1848	XEUkUQr.exe
1080	TgpmdSr.exe
1544	fRQkUzo.exe
1516	DNURNjG.exe
1608	LldeQlN.exe
1888	ycoDDnv.exe
2556	wHCKbob.exe
2536	HemMXVv.exe
1180	NgerbHO.exe
2788	APHVrsg.exe
1212	PEbgZQK.exe
892	ogvtMnj.exe
832	jkzBNAp.exe
444	UwjYkQe.exe
2948	rfuDEBZ.exe
1800	fMTcSQQ.exe
780	xDgSWMY.exe
1656	pMqMxJl.exe
540	VWUMxlS.exe
1348	ZPPKKCZ.exe
2032	PUPVTkK.exe
3068	KYcrErK.exe
1628	ivCHpiU.exe
928	MokJKvU.exe
756	FeqQinf.exe
2952	rhZdEWo.exe
2076	PfflvAq.exe
1512	TJqkhFo.exe
2176	sRhERsf.exe
2964	BfIBuJv.exe
2860	rzPDIeN.exe
2104	KFZuDyp.exe
2064	AQZKegO.exe
2132	ltelWJi.exe
1580	MydMmox.exe
1276	LqObueA.exe
2920	dfvcvDL.exe
2972	MqTTLyu.exe
2708	LDVFBAE.exe
2724	rKCZEny.exe
2760	zVRixPG.exe
2912	XXFbnVu.exe

Loads dropped DLL 64 IoCs

pid	Process
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1224-2-0x000000013FEC0000-0x0000000140214000-memory.dmp	upx
behavioral1/files/0x0009000000012280-3.dat	upx
behavioral1/memory/2868-9-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/files/0x0038000000016448-13.dat	upx
behavioral1/memory/1924-15-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/files/0x0005000000019349-190.dat	upx
behavioral1/files/0x0005000000019296-185.dat	upx
behavioral1/files/0x00060000000190d6-180.dat	upx
behavioral1/files/0x0006000000018bda-175.dat	upx
behavioral1/files/0x0006000000018bc6-170.dat	upx
behavioral1/files/0x00050000000187a2-160.dat	upx
behavioral1/files/0x0006000000018b73-165.dat	upx
behavioral1/files/0x000500000001878b-155.dat	upx
behavioral1/files/0x0005000000018784-151.dat	upx
behavioral1/files/0x000500000001873a-145.dat	upx
behavioral1/files/0x0005000000018711-140.dat	upx
behavioral1/files/0x000500000001870d-135.dat	upx
behavioral1/files/0x0005000000018701-130.dat	upx
behavioral1/files/0x00050000000186ff-125.dat	upx
behavioral1/files/0x00060000000175f4-120.dat	upx
behavioral1/files/0x00060000000175e8-115.dat	upx
behavioral1/files/0x0006000000017568-111.dat	upx
behavioral1/files/0x00060000000173d3-93.dat	upx
behavioral1/memory/2224-104-0x000000013F070000-0x000000013F3C4000-memory.dmp	upx
behavioral1/memory/2572-87-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/1332-86-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/files/0x000600000001720f-84.dat	upx
behavioral1/memory/1940-102-0x000000013F560000-0x000000013F8B4000-memory.dmp	upx
behavioral1/files/0x00060000000173d6-100.dat	upx
behavioral1/memory/3064-99-0x000000013F990000-0x000000013FCE4000-memory.dmp	upx
behavioral1/files/0x00060000000173b4-90.dat	upx
behavioral1/memory/1924-82-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/2508-80-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/memory/2552-71-0x000000013FE30000-0x0000000140184000-memory.dmp	upx
behavioral1/memory/1224-70-0x000000013FEC0000-0x0000000140214000-memory.dmp	upx
behavioral1/files/0x00060000000171ba-74.dat	upx
behavioral1/files/0x0006000000016dd1-68.dat	upx
behavioral1/memory/2524-64-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/memory/2772-57-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/files/0x0006000000016dc8-60.dat	upx
behavioral1/files/0x0008000000016d05-55.dat	upx
behavioral1/memory/2720-53-0x000000013F630000-0x000000013F984000-memory.dmp	upx
behavioral1/memory/2652-52-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	upx
behavioral1/files/0x0007000000016caf-35.dat	upx
behavioral1/files/0x0009000000016cde-45.dat	upx
behavioral1/memory/2644-40-0x000000013FE90000-0x00000001401E4000-memory.dmp	upx
behavioral1/files/0x0007000000016c67-33.dat	upx
behavioral1/memory/3064-29-0x000000013F990000-0x000000013FCE4000-memory.dmp	upx
behavioral1/files/0x0007000000016c5d-27.dat	upx
behavioral1/memory/1332-23-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/files/0x0008000000016a7d-12.dat	upx
behavioral1/memory/2508-4019-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/memory/2868-4020-0x000000013FC60000-0x000000013FFB4000-memory.dmp	upx
behavioral1/memory/1924-4021-0x000000013FF60000-0x00000001402B4000-memory.dmp	upx
behavioral1/memory/1332-4022-0x000000013F4F0000-0x000000013F844000-memory.dmp	upx
behavioral1/memory/2644-4023-0x000000013FE90000-0x00000001401E4000-memory.dmp	upx
behavioral1/memory/2652-4024-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	upx
behavioral1/memory/2772-4027-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/memory/2524-4026-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/memory/2720-4025-0x000000013F630000-0x000000013F984000-memory.dmp	upx
behavioral1/memory/3064-4028-0x000000013F990000-0x000000013FCE4000-memory.dmp	upx
behavioral1/memory/2224-4029-0x000000013F070000-0x000000013F3C4000-memory.dmp	upx
behavioral1/memory/2552-4030-0x000000013FE30000-0x0000000140184000-memory.dmp	upx
behavioral1/memory/2508-4031-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OXVIQhK.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\kUweMUS.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\WarpNZH.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\gmWFRZU.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\xaShrFS.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\lJXnloo.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\umLHhPa.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\zNdssWD.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\CiWrGdf.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\nseYILT.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\RTHcPap.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\qHTzMGs.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\qDLFVLj.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\uTWMErJ.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\oEXcejm.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\NskytPk.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\BynjMUB.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\zZIzenB.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\ezzPZTR.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\OYaoUFd.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\ZGQWRmL.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\sqBppuu.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\hKmZNak.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\naIfowP.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\VGZJdZK.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\FUITWKe.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\VaFviES.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\UUQfAtO.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\VDWACVU.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\WxdGjfC.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\DAvUnLy.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\VeeAFdR.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\rviwRTW.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\KueEyug.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\WKrcbCO.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\hfEYHUU.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\pSQIkuh.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\rxgtyZv.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\UGbujJo.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\XdShbPY.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\RsabmIz.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\KqjAQXP.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\mNTDflY.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\vNsctjz.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\RVIPVFU.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\jdSDKXG.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\SWsOHQR.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\hSRmtaj.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\QfqNUJe.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\TvTjbVi.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\tSjXQZA.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\BnkfqFS.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\TgpmdSr.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\xBSVANO.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\cEXcrXv.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\GGmqfpg.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\vbrkXhr.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\iaAziis.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\PrQreKz.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\uHVbKkR.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\MqTTLyu.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\VmKwIiQ.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\YiWwZUZ.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
File created	C:\Windows\System\DZKlqug.exe	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2868	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	29
PID 1224 wrote to memory of 2868	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	29
PID 1224 wrote to memory of 2868	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	29
PID 1224 wrote to memory of 1924	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	30
PID 1224 wrote to memory of 1924	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	30
PID 1224 wrote to memory of 1924	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	30
PID 1224 wrote to memory of 1332	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	31
PID 1224 wrote to memory of 1332	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	31
PID 1224 wrote to memory of 1332	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	31
PID 1224 wrote to memory of 3064	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	32
PID 1224 wrote to memory of 3064	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	32
PID 1224 wrote to memory of 3064	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	32
PID 1224 wrote to memory of 2644	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	33
PID 1224 wrote to memory of 2644	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	33
PID 1224 wrote to memory of 2644	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	33
PID 1224 wrote to memory of 2720	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	34
PID 1224 wrote to memory of 2720	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	34
PID 1224 wrote to memory of 2720	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	34
PID 1224 wrote to memory of 2652	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	35
PID 1224 wrote to memory of 2652	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	35
PID 1224 wrote to memory of 2652	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	35
PID 1224 wrote to memory of 2772	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	36
PID 1224 wrote to memory of 2772	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	36
PID 1224 wrote to memory of 2772	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	36
PID 1224 wrote to memory of 2524	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	37
PID 1224 wrote to memory of 2524	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	37
PID 1224 wrote to memory of 2524	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	37
PID 1224 wrote to memory of 2552	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	38
PID 1224 wrote to memory of 2552	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	38
PID 1224 wrote to memory of 2552	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	38
PID 1224 wrote to memory of 2508	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	39
PID 1224 wrote to memory of 2508	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	39
PID 1224 wrote to memory of 2508	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	39
PID 1224 wrote to memory of 2572	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	40
PID 1224 wrote to memory of 2572	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	40
PID 1224 wrote to memory of 2572	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	40
PID 1224 wrote to memory of 1940	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	41
PID 1224 wrote to memory of 1940	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	41
PID 1224 wrote to memory of 1940	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	41
PID 1224 wrote to memory of 1288	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	42
PID 1224 wrote to memory of 1288	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	42
PID 1224 wrote to memory of 1288	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	42
PID 1224 wrote to memory of 2224	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	43
PID 1224 wrote to memory of 2224	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	43
PID 1224 wrote to memory of 2224	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	43
PID 1224 wrote to memory of 1444	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	44
PID 1224 wrote to memory of 1444	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	44
PID 1224 wrote to memory of 1444	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	44
PID 1224 wrote to memory of 1704	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	45
PID 1224 wrote to memory of 1704	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	45
PID 1224 wrote to memory of 1704	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	45
PID 1224 wrote to memory of 2420	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	46
PID 1224 wrote to memory of 2420	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	46
PID 1224 wrote to memory of 2420	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	46
PID 1224 wrote to memory of 2424	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	47
PID 1224 wrote to memory of 2424	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	47
PID 1224 wrote to memory of 2424	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	47
PID 1224 wrote to memory of 2144	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	48
PID 1224 wrote to memory of 2144	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	48
PID 1224 wrote to memory of 2144	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	48
PID 1224 wrote to memory of 772	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	49
PID 1224 wrote to memory of 772	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	49
PID 1224 wrote to memory of 772	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	49
PID 1224 wrote to memory of 1500	1224	8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8b8c8dce7d6bce8b351a670fa96aac80_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\System\qILRDdx.exe
  C:\Windows\System\qILRDdx.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\AUhEtka.exe
  C:\Windows\System\AUhEtka.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\MHVqmhI.exe
  C:\Windows\System\MHVqmhI.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\VDGjmOU.exe
  C:\Windows\System\VDGjmOU.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\WMkGSZN.exe
  C:\Windows\System\WMkGSZN.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\skNEOPy.exe
  C:\Windows\System\skNEOPy.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ygtOniG.exe
  C:\Windows\System\ygtOniG.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\GHqHwOq.exe
  C:\Windows\System\GHqHwOq.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\MZjnFYA.exe
  C:\Windows\System\MZjnFYA.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\CJVJrcO.exe
  C:\Windows\System\CJVJrcO.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\nVIarpm.exe
  C:\Windows\System\nVIarpm.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\RSlGlwS.exe
  C:\Windows\System\RSlGlwS.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\uGEOEOY.exe
  C:\Windows\System\uGEOEOY.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\qphetjK.exe
  C:\Windows\System\qphetjK.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\YUwHTOI.exe
  C:\Windows\System\YUwHTOI.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\SdLJMnV.exe
  C:\Windows\System\SdLJMnV.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\PIBvahb.exe
  C:\Windows\System\PIBvahb.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\UZspCfy.exe
  C:\Windows\System\UZspCfy.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\xTBWZAx.exe
  C:\Windows\System\xTBWZAx.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\oyYAIuX.exe
  C:\Windows\System\oyYAIuX.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\QKVMjQb.exe
  C:\Windows\System\QKVMjQb.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\JyNrtNW.exe
  C:\Windows\System\JyNrtNW.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\XEUkUQr.exe
  C:\Windows\System\XEUkUQr.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\TgpmdSr.exe
  C:\Windows\System\TgpmdSr.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\fRQkUzo.exe
  C:\Windows\System\fRQkUzo.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\DNURNjG.exe
  C:\Windows\System\DNURNjG.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\LldeQlN.exe
  C:\Windows\System\LldeQlN.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\ycoDDnv.exe
  C:\Windows\System\ycoDDnv.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\wHCKbob.exe
  C:\Windows\System\wHCKbob.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\HemMXVv.exe
  C:\Windows\System\HemMXVv.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\NgerbHO.exe
  C:\Windows\System\NgerbHO.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\APHVrsg.exe
  C:\Windows\System\APHVrsg.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\PEbgZQK.exe
  C:\Windows\System\PEbgZQK.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\ogvtMnj.exe
  C:\Windows\System\ogvtMnj.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\jkzBNAp.exe
  C:\Windows\System\jkzBNAp.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\UwjYkQe.exe
  C:\Windows\System\UwjYkQe.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\rfuDEBZ.exe
  C:\Windows\System\rfuDEBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\fMTcSQQ.exe
  C:\Windows\System\fMTcSQQ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\xDgSWMY.exe
  C:\Windows\System\xDgSWMY.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\pMqMxJl.exe
  C:\Windows\System\pMqMxJl.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\VWUMxlS.exe
  C:\Windows\System\VWUMxlS.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ZPPKKCZ.exe
  C:\Windows\System\ZPPKKCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\PUPVTkK.exe
  C:\Windows\System\PUPVTkK.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\KYcrErK.exe
  C:\Windows\System\KYcrErK.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\ivCHpiU.exe
  C:\Windows\System\ivCHpiU.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\MokJKvU.exe
  C:\Windows\System\MokJKvU.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\FeqQinf.exe
  C:\Windows\System\FeqQinf.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\rhZdEWo.exe
  C:\Windows\System\rhZdEWo.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\PfflvAq.exe
  C:\Windows\System\PfflvAq.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\TJqkhFo.exe
  C:\Windows\System\TJqkhFo.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\sRhERsf.exe
  C:\Windows\System\sRhERsf.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\BfIBuJv.exe
  C:\Windows\System\BfIBuJv.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\rzPDIeN.exe
  C:\Windows\System\rzPDIeN.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\KFZuDyp.exe
  C:\Windows\System\KFZuDyp.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\AQZKegO.exe
  C:\Windows\System\AQZKegO.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ltelWJi.exe
  C:\Windows\System\ltelWJi.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\MydMmox.exe
  C:\Windows\System\MydMmox.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\LqObueA.exe
  C:\Windows\System\LqObueA.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\dfvcvDL.exe
  C:\Windows\System\dfvcvDL.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\MqTTLyu.exe
  C:\Windows\System\MqTTLyu.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\LDVFBAE.exe
  C:\Windows\System\LDVFBAE.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\rKCZEny.exe
  C:\Windows\System\rKCZEny.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\zVRixPG.exe
  C:\Windows\System\zVRixPG.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\XXFbnVu.exe
  C:\Windows\System\XXFbnVu.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\lQvaFob.exe
  C:\Windows\System\lQvaFob.exe
  2⤵
  PID:2496
- C:\Windows\System\vFfScbJ.exe
  C:\Windows\System\vFfScbJ.exe
  2⤵
  PID:2380
- C:\Windows\System\xmMQocj.exe
  C:\Windows\System\xmMQocj.exe
  2⤵
  PID:1972
- C:\Windows\System\DlhpMmv.exe
  C:\Windows\System\DlhpMmv.exe
  2⤵
  PID:2212
- C:\Windows\System\hKmZNak.exe
  C:\Windows\System\hKmZNak.exe
  2⤵
  PID:2216
- C:\Windows\System\mLOHAqp.exe
  C:\Windows\System\mLOHAqp.exe
  2⤵
  PID:1764
- C:\Windows\System\TknpClL.exe
  C:\Windows\System\TknpClL.exe
  2⤵
  PID:808
- C:\Windows\System\NYKHZmb.exe
  C:\Windows\System\NYKHZmb.exe
  2⤵
  PID:1028
- C:\Windows\System\QomRgvY.exe
  C:\Windows\System\QomRgvY.exe
  2⤵
  PID:1032
- C:\Windows\System\PNRnaiX.exe
  C:\Windows\System\PNRnaiX.exe
  2⤵
  PID:2468
- C:\Windows\System\BRsUfye.exe
  C:\Windows\System\BRsUfye.exe
  2⤵
  PID:1748
- C:\Windows\System\jYOCQNz.exe
  C:\Windows\System\jYOCQNz.exe
  2⤵
  PID:1136
- C:\Windows\System\IsqUYnl.exe
  C:\Windows\System\IsqUYnl.exe
  2⤵
  PID:2052
- C:\Windows\System\HTPpvEW.exe
  C:\Windows\System\HTPpvEW.exe
  2⤵
  PID:2292
- C:\Windows\System\DZKlqug.exe
  C:\Windows\System\DZKlqug.exe
  2⤵
  PID:2836
- C:\Windows\System\wBidGLp.exe
  C:\Windows\System\wBidGLp.exe
  2⤵
  PID:2392
- C:\Windows\System\wRjMIed.exe
  C:\Windows\System\wRjMIed.exe
  2⤵
  PID:1296
- C:\Windows\System\nfeszfM.exe
  C:\Windows\System\nfeszfM.exe
  2⤵
  PID:828
- C:\Windows\System\vBhXznM.exe
  C:\Windows\System\vBhXznM.exe
  2⤵
  PID:280
- C:\Windows\System\VmKwIiQ.exe
  C:\Windows\System\VmKwIiQ.exe
  2⤵
  PID:1600
- C:\Windows\System\tdmTDKC.exe
  C:\Windows\System\tdmTDKC.exe
  2⤵
  PID:688
- C:\Windows\System\kOXmyRQ.exe
  C:\Windows\System\kOXmyRQ.exe
  2⤵
  PID:900
- C:\Windows\System\CxLoIiI.exe
  C:\Windows\System\CxLoIiI.exe
  2⤵
  PID:556
- C:\Windows\System\uDFvclG.exe
  C:\Windows\System\uDFvclG.exe
  2⤵
  PID:1432
- C:\Windows\System\JCBLVlA.exe
  C:\Windows\System\JCBLVlA.exe
  2⤵
  PID:988
- C:\Windows\System\krlgKwi.exe
  C:\Windows\System\krlgKwi.exe
  2⤵
  PID:2004
- C:\Windows\System\qDyfgII.exe
  C:\Windows\System\qDyfgII.exe
  2⤵
  PID:1796
- C:\Windows\System\XdbsOPg.exe
  C:\Windows\System\XdbsOPg.exe
  2⤵
  PID:1728
- C:\Windows\System\SOgGOXE.exe
  C:\Windows\System\SOgGOXE.exe
  2⤵
  PID:2464
- C:\Windows\System\iuKIqhY.exe
  C:\Windows\System\iuKIqhY.exe
  2⤵
  PID:2276
- C:\Windows\System\GOVYiAN.exe
  C:\Windows\System\GOVYiAN.exe
  2⤵
  PID:2504
- C:\Windows\System\obxMORh.exe
  C:\Windows\System\obxMORh.exe
  2⤵
  PID:2832
- C:\Windows\System\nAYrMQq.exe
  C:\Windows\System\nAYrMQq.exe
  2⤵
  PID:2164
- C:\Windows\System\UxSHiwh.exe
  C:\Windows\System\UxSHiwh.exe
  2⤵
  PID:2044
- C:\Windows\System\OsEHxdv.exe
  C:\Windows\System\OsEHxdv.exe
  2⤵
  PID:1708
- C:\Windows\System\vhuZXJi.exe
  C:\Windows\System\vhuZXJi.exe
  2⤵
  PID:2404
- C:\Windows\System\pAYbPyY.exe
  C:\Windows\System\pAYbPyY.exe
  2⤵
  PID:264
- C:\Windows\System\prJCVsV.exe
  C:\Windows\System\prJCVsV.exe
  2⤵
  PID:1480
- C:\Windows\System\oIUZxSM.exe
  C:\Windows\System\oIUZxSM.exe
  2⤵
  PID:2140
- C:\Windows\System\BWgwVDh.exe
  C:\Windows\System\BWgwVDh.exe
  2⤵
  PID:1264
- C:\Windows\System\XXRmkni.exe
  C:\Windows\System\XXRmkni.exe
  2⤵
  PID:2796
- C:\Windows\System\wNfJkoT.exe
  C:\Windows\System\wNfJkoT.exe
  2⤵
  PID:1740
- C:\Windows\System\gvXVwQW.exe
  C:\Windows\System\gvXVwQW.exe
  2⤵
  PID:340
- C:\Windows\System\HEbrmGR.exe
  C:\Windows\System\HEbrmGR.exe
  2⤵
  PID:1672
- C:\Windows\System\mOaJwko.exe
  C:\Windows\System\mOaJwko.exe
  2⤵
  PID:1536
- C:\Windows\System\jHIBczb.exe
  C:\Windows\System\jHIBczb.exe
  2⤵
  PID:2980
- C:\Windows\System\oXkMqQB.exe
  C:\Windows\System\oXkMqQB.exe
  2⤵
  PID:1316
- C:\Windows\System\kDYdOeE.exe
  C:\Windows\System\kDYdOeE.exe
  2⤵
  PID:2304
- C:\Windows\System\fkuASqJ.exe
  C:\Windows\System\fkuASqJ.exe
  2⤵
  PID:2308
- C:\Windows\System\XjWWBAw.exe
  C:\Windows\System\XjWWBAw.exe
  2⤵
  PID:1592
- C:\Windows\System\XoPYBtV.exe
  C:\Windows\System\XoPYBtV.exe
  2⤵
  PID:2124
- C:\Windows\System\THqMOFa.exe
  C:\Windows\System\THqMOFa.exe
  2⤵
  PID:2712
- C:\Windows\System\jQYTQvy.exe
  C:\Windows\System\jQYTQvy.exe
  2⤵
  PID:2664
- C:\Windows\System\hJsLOzZ.exe
  C:\Windows\System\hJsLOzZ.exe
  2⤵
  PID:2192
- C:\Windows\System\FcDaiEG.exe
  C:\Windows\System\FcDaiEG.exe
  2⤵
  PID:3080
- C:\Windows\System\wJLFkxE.exe
  C:\Windows\System\wJLFkxE.exe
  2⤵
  PID:3104
- C:\Windows\System\kVRbVwZ.exe
  C:\Windows\System\kVRbVwZ.exe
  2⤵
  PID:3124
- C:\Windows\System\DTWwXnl.exe
  C:\Windows\System\DTWwXnl.exe
  2⤵
  PID:3144
- C:\Windows\System\PlACbmH.exe
  C:\Windows\System\PlACbmH.exe
  2⤵
  PID:3160
- C:\Windows\System\DYwBlRC.exe
  C:\Windows\System\DYwBlRC.exe
  2⤵
  PID:3176
- C:\Windows\System\WjNIWYb.exe
  C:\Windows\System\WjNIWYb.exe
  2⤵
  PID:3200
- C:\Windows\System\UcFiKqm.exe
  C:\Windows\System\UcFiKqm.exe
  2⤵
  PID:3216
- C:\Windows\System\sTlmxib.exe
  C:\Windows\System\sTlmxib.exe
  2⤵
  PID:3240
- C:\Windows\System\KeLHytM.exe
  C:\Windows\System\KeLHytM.exe
  2⤵
  PID:3256
- C:\Windows\System\VIRXWFE.exe
  C:\Windows\System\VIRXWFE.exe
  2⤵
  PID:3280
- C:\Windows\System\AvREgZG.exe
  C:\Windows\System\AvREgZG.exe
  2⤵
  PID:3308
- C:\Windows\System\grulzzz.exe
  C:\Windows\System\grulzzz.exe
  2⤵
  PID:3328
- C:\Windows\System\eisjQkx.exe
  C:\Windows\System\eisjQkx.exe
  2⤵
  PID:3348
- C:\Windows\System\qpsXRmU.exe
  C:\Windows\System\qpsXRmU.exe
  2⤵
  PID:3364
- C:\Windows\System\RKoXIqz.exe
  C:\Windows\System\RKoXIqz.exe
  2⤵
  PID:3384
- C:\Windows\System\AjtYIlW.exe
  C:\Windows\System\AjtYIlW.exe
  2⤵
  PID:3404
- C:\Windows\System\uKiXzfS.exe
  C:\Windows\System\uKiXzfS.exe
  2⤵
  PID:3420
- C:\Windows\System\IvyrmMv.exe
  C:\Windows\System\IvyrmMv.exe
  2⤵
  PID:3440
- C:\Windows\System\RrsPogV.exe
  C:\Windows\System\RrsPogV.exe
  2⤵
  PID:3460
- C:\Windows\System\JXPVwGT.exe
  C:\Windows\System\JXPVwGT.exe
  2⤵
  PID:3480
- C:\Windows\System\uqzjNXa.exe
  C:\Windows\System\uqzjNXa.exe
  2⤵
  PID:3500
- C:\Windows\System\NskytPk.exe
  C:\Windows\System\NskytPk.exe
  2⤵
  PID:3524
- C:\Windows\System\EMnUorU.exe
  C:\Windows\System\EMnUorU.exe
  2⤵
  PID:3544
- C:\Windows\System\naIfowP.exe
  C:\Windows\System\naIfowP.exe
  2⤵
  PID:3568
- C:\Windows\System\knlSQbK.exe
  C:\Windows\System\knlSQbK.exe
  2⤵
  PID:3588
- C:\Windows\System\xBSVANO.exe
  C:\Windows\System\xBSVANO.exe
  2⤵
  PID:3608
- C:\Windows\System\LOHuZrw.exe
  C:\Windows\System\LOHuZrw.exe
  2⤵
  PID:3624
- C:\Windows\System\omVWOhl.exe
  C:\Windows\System\omVWOhl.exe
  2⤵
  PID:3644
- C:\Windows\System\HvBptDQ.exe
  C:\Windows\System\HvBptDQ.exe
  2⤵
  PID:3668
- C:\Windows\System\hNGwvjv.exe
  C:\Windows\System\hNGwvjv.exe
  2⤵
  PID:3688
- C:\Windows\System\TubGKfG.exe
  C:\Windows\System\TubGKfG.exe
  2⤵
  PID:3708
- C:\Windows\System\hfEYHUU.exe
  C:\Windows\System\hfEYHUU.exe
  2⤵
  PID:3724
- C:\Windows\System\WHgborz.exe
  C:\Windows\System\WHgborz.exe
  2⤵
  PID:3744
- C:\Windows\System\CjcSXYU.exe
  C:\Windows\System\CjcSXYU.exe
  2⤵
  PID:3764
- C:\Windows\System\PjJOodX.exe
  C:\Windows\System\PjJOodX.exe
  2⤵
  PID:3784
- C:\Windows\System\PEmCUzI.exe
  C:\Windows\System\PEmCUzI.exe
  2⤵
  PID:3804
- C:\Windows\System\fMzioAo.exe
  C:\Windows\System\fMzioAo.exe
  2⤵
  PID:3828
- C:\Windows\System\XHyzwNJ.exe
  C:\Windows\System\XHyzwNJ.exe
  2⤵
  PID:3844
- C:\Windows\System\ORANgen.exe
  C:\Windows\System\ORANgen.exe
  2⤵
  PID:3864
- C:\Windows\System\igVTHfs.exe
  C:\Windows\System\igVTHfs.exe
  2⤵
  PID:3884
- C:\Windows\System\KVXeVpD.exe
  C:\Windows\System\KVXeVpD.exe
  2⤵
  PID:3908
- C:\Windows\System\njebGyA.exe
  C:\Windows\System\njebGyA.exe
  2⤵
  PID:3924
- C:\Windows\System\SMZwEIJ.exe
  C:\Windows\System\SMZwEIJ.exe
  2⤵
  PID:3948
- C:\Windows\System\yGnrKuC.exe
  C:\Windows\System\yGnrKuC.exe
  2⤵
  PID:3964
- C:\Windows\System\uiTJkQC.exe
  C:\Windows\System\uiTJkQC.exe
  2⤵
  PID:3980
- C:\Windows\System\tapCLqQ.exe
  C:\Windows\System\tapCLqQ.exe
  2⤵
  PID:4004
- C:\Windows\System\cWDYyZJ.exe
  C:\Windows\System\cWDYyZJ.exe
  2⤵
  PID:4020
- C:\Windows\System\HtVJWdH.exe
  C:\Windows\System\HtVJWdH.exe
  2⤵
  PID:4048
- C:\Windows\System\vBZjcBK.exe
  C:\Windows\System\vBZjcBK.exe
  2⤵
  PID:4068
- C:\Windows\System\FcIYhSE.exe
  C:\Windows\System\FcIYhSE.exe
  2⤵
  PID:4084
- C:\Windows\System\yipermN.exe
  C:\Windows\System\yipermN.exe
  2⤵
  PID:2908
- C:\Windows\System\HPOkRLb.exe
  C:\Windows\System\HPOkRLb.exe
  2⤵
  PID:588
- C:\Windows\System\jkfJasI.exe
  C:\Windows\System\jkfJasI.exe
  2⤵
  PID:1668
- C:\Windows\System\MOZmDnu.exe
  C:\Windows\System\MOZmDnu.exe
  2⤵
  PID:2676
- C:\Windows\System\HeaYgtV.exe
  C:\Windows\System\HeaYgtV.exe
  2⤵
  PID:2684
- C:\Windows\System\jLDwZLp.exe
  C:\Windows\System\jLDwZLp.exe
  2⤵
  PID:1776
- C:\Windows\System\DouAQdC.exe
  C:\Windows\System\DouAQdC.exe
  2⤵
  PID:2752
- C:\Windows\System\wcFcfJE.exe
  C:\Windows\System\wcFcfJE.exe
  2⤵
  PID:2584
- C:\Windows\System\FAljcBe.exe
  C:\Windows\System\FAljcBe.exe
  2⤵
  PID:2028
- C:\Windows\System\tVUPSVM.exe
  C:\Windows\System\tVUPSVM.exe
  2⤵
  PID:3024
- C:\Windows\System\hvWbYzD.exe
  C:\Windows\System\hvWbYzD.exe
  2⤵
  PID:2272
- C:\Windows\System\CjUyxIr.exe
  C:\Windows\System\CjUyxIr.exe
  2⤵
  PID:3092
- C:\Windows\System\shApXFU.exe
  C:\Windows\System\shApXFU.exe
  2⤵
  PID:2636
- C:\Windows\System\qvKTvOe.exe
  C:\Windows\System\qvKTvOe.exe
  2⤵
  PID:3172
- C:\Windows\System\eZAppFY.exe
  C:\Windows\System\eZAppFY.exe
  2⤵
  PID:3076
- C:\Windows\System\wsOHziQ.exe
  C:\Windows\System\wsOHziQ.exe
  2⤵
  PID:3156
- C:\Windows\System\JalPtke.exe
  C:\Windows\System\JalPtke.exe
  2⤵
  PID:3228
- C:\Windows\System\esLeHpw.exe
  C:\Windows\System\esLeHpw.exe
  2⤵
  PID:3304
- C:\Windows\System\NuTHSFe.exe
  C:\Windows\System\NuTHSFe.exe
  2⤵
  PID:3268
- C:\Windows\System\AJAhOxS.exe
  C:\Windows\System\AJAhOxS.exe
  2⤵
  PID:3340
- C:\Windows\System\eJVnrKa.exe
  C:\Windows\System\eJVnrKa.exe
  2⤵
  PID:3372
- C:\Windows\System\YEZXDik.exe
  C:\Windows\System\YEZXDik.exe
  2⤵
  PID:3412
- C:\Windows\System\MXAyZlj.exe
  C:\Windows\System\MXAyZlj.exe
  2⤵
  PID:3396
- C:\Windows\System\pzQxYQA.exe
  C:\Windows\System\pzQxYQA.exe
  2⤵
  PID:3468
- C:\Windows\System\rGhgwnI.exe
  C:\Windows\System\rGhgwnI.exe
  2⤵
  PID:3496
- C:\Windows\System\SVDAWlx.exe
  C:\Windows\System\SVDAWlx.exe
  2⤵
  PID:3540
- C:\Windows\System\FLhzOcy.exe
  C:\Windows\System\FLhzOcy.exe
  2⤵
  PID:3556
- C:\Windows\System\FrxjsaE.exe
  C:\Windows\System\FrxjsaE.exe
  2⤵
  PID:3616
- C:\Windows\System\XhfXDQp.exe
  C:\Windows\System\XhfXDQp.exe
  2⤵
  PID:3604
- C:\Windows\System\ZekcFzF.exe
  C:\Windows\System\ZekcFzF.exe
  2⤵
  PID:3660
- C:\Windows\System\xPggFaC.exe
  C:\Windows\System\xPggFaC.exe
  2⤵
  PID:3700
- C:\Windows\System\MBLaaSR.exe
  C:\Windows\System\MBLaaSR.exe
  2⤵
  PID:3684
- C:\Windows\System\GGmqfpg.exe
  C:\Windows\System\GGmqfpg.exe
  2⤵
  PID:3776
- C:\Windows\System\XfmtNxs.exe
  C:\Windows\System\XfmtNxs.exe
  2⤵
  PID:3824
- C:\Windows\System\IAyEAoN.exe
  C:\Windows\System\IAyEAoN.exe
  2⤵
  PID:3796
- C:\Windows\System\xNdWSrR.exe
  C:\Windows\System\xNdWSrR.exe
  2⤵
  PID:3856
- C:\Windows\System\SJHFXoK.exe
  C:\Windows\System\SJHFXoK.exe
  2⤵
  PID:3904
- C:\Windows\System\SWsOHQR.exe
  C:\Windows\System\SWsOHQR.exe
  2⤵
  PID:3940
- C:\Windows\System\SibPiWQ.exe
  C:\Windows\System\SibPiWQ.exe
  2⤵
  PID:3880
- C:\Windows\System\lFKTqxm.exe
  C:\Windows\System\lFKTqxm.exe
  2⤵
  PID:4012
- C:\Windows\System\ujzTXDQ.exe
  C:\Windows\System\ujzTXDQ.exe
  2⤵
  PID:4000
- C:\Windows\System\bXckdAj.exe
  C:\Windows\System\bXckdAj.exe
  2⤵
  PID:4036
- C:\Windows\System\hSRmtaj.exe
  C:\Windows\System\hSRmtaj.exe
  2⤵
  PID:4080
- C:\Windows\System\OueEAQF.exe
  C:\Windows\System\OueEAQF.exe
  2⤵
  PID:1604
- C:\Windows\System\ziPiYWH.exe
  C:\Windows\System\ziPiYWH.exe
  2⤵
  PID:412
- C:\Windows\System\MAWevVs.exe
  C:\Windows\System\MAWevVs.exe
  2⤵
  PID:2336
- C:\Windows\System\JRXCkth.exe
  C:\Windows\System\JRXCkth.exe
  2⤵
  PID:584
- C:\Windows\System\BfbKgQG.exe
  C:\Windows\System\BfbKgQG.exe
  2⤵
  PID:2128
- C:\Windows\System\FUITWKe.exe
  C:\Windows\System\FUITWKe.exe
  2⤵
  PID:2632
- C:\Windows\System\udtvwNh.exe
  C:\Windows\System\udtvwNh.exe
  2⤵
  PID:1376
- C:\Windows\System\AQgBbDM.exe
  C:\Windows\System\AQgBbDM.exe
  2⤵
  PID:3208
- C:\Windows\System\tirAnDv.exe
  C:\Windows\System\tirAnDv.exe
  2⤵
  PID:3168
- C:\Windows\System\BkOKLRe.exe
  C:\Windows\System\BkOKLRe.exe
  2⤵
  PID:3252
- C:\Windows\System\itOmawy.exe
  C:\Windows\System\itOmawy.exe
  2⤵
  PID:3184
- C:\Windows\System\TFXWAdL.exe
  C:\Windows\System\TFXWAdL.exe
  2⤵
  PID:3316
- C:\Windows\System\Teefxmi.exe
  C:\Windows\System\Teefxmi.exe
  2⤵
  PID:3452
- C:\Windows\System\zZIzenB.exe
  C:\Windows\System\zZIzenB.exe
  2⤵
  PID:3392
- C:\Windows\System\AJCZzKG.exe
  C:\Windows\System\AJCZzKG.exe
  2⤵
  PID:3520
- C:\Windows\System\YngDroV.exe
  C:\Windows\System\YngDroV.exe
  2⤵
  PID:3476
- C:\Windows\System\TSmQWid.exe
  C:\Windows\System\TSmQWid.exe
  2⤵
  PID:3536
- C:\Windows\System\OBvyagL.exe
  C:\Windows\System\OBvyagL.exe
  2⤵
  PID:3564
- C:\Windows\System\aOvehSF.exe
  C:\Windows\System\aOvehSF.exe
  2⤵
  PID:3716
- C:\Windows\System\XiZscLk.exe
  C:\Windows\System\XiZscLk.exe
  2⤵
  PID:2580
- C:\Windows\System\bMYXQLJ.exe
  C:\Windows\System\bMYXQLJ.exe
  2⤵
  PID:3060
- C:\Windows\System\ezzPZTR.exe
  C:\Windows\System\ezzPZTR.exe
  2⤵
  PID:3792
- C:\Windows\System\JRfdSDG.exe
  C:\Windows\System\JRfdSDG.exe
  2⤵
  PID:3972
- C:\Windows\System\QXYOsra.exe
  C:\Windows\System\QXYOsra.exe
  2⤵
  PID:3860
- C:\Windows\System\AIQdOBJ.exe
  C:\Windows\System\AIQdOBJ.exe
  2⤵
  PID:4092
- C:\Windows\System\ORFtKEH.exe
  C:\Windows\System\ORFtKEH.exe
  2⤵
  PID:4104
- C:\Windows\System\fDMFOPR.exe
  C:\Windows\System\fDMFOPR.exe
  2⤵
  PID:4120
- C:\Windows\System\oSPqyUZ.exe
  C:\Windows\System\oSPqyUZ.exe
  2⤵
  PID:4140
- C:\Windows\System\Fwukiyh.exe
  C:\Windows\System\Fwukiyh.exe
  2⤵
  PID:4164
- C:\Windows\System\IJrrczJ.exe
  C:\Windows\System\IJrrczJ.exe
  2⤵
  PID:4180
- C:\Windows\System\Nwdondp.exe
  C:\Windows\System\Nwdondp.exe
  2⤵
  PID:4204
- C:\Windows\System\zXCuFDw.exe
  C:\Windows\System\zXCuFDw.exe
  2⤵
  PID:4220
- C:\Windows\System\mHPHtNC.exe
  C:\Windows\System\mHPHtNC.exe
  2⤵
  PID:4244
- C:\Windows\System\blQAaiv.exe
  C:\Windows\System\blQAaiv.exe
  2⤵
  PID:4260
- C:\Windows\System\ABGIDRx.exe
  C:\Windows\System\ABGIDRx.exe
  2⤵
  PID:4288
- C:\Windows\System\WUgOTxM.exe
  C:\Windows\System\WUgOTxM.exe
  2⤵
  PID:4304
- C:\Windows\System\MicTzyq.exe
  C:\Windows\System\MicTzyq.exe
  2⤵
  PID:4328
- C:\Windows\System\mOQdvcV.exe
  C:\Windows\System\mOQdvcV.exe
  2⤵
  PID:4344
- C:\Windows\System\EQSBbrZ.exe
  C:\Windows\System\EQSBbrZ.exe
  2⤵
  PID:4360
- C:\Windows\System\QPSSdSB.exe
  C:\Windows\System\QPSSdSB.exe
  2⤵
  PID:4380
- C:\Windows\System\TBuRHMv.exe
  C:\Windows\System\TBuRHMv.exe
  2⤵
  PID:4400
- C:\Windows\System\PiDwhkI.exe
  C:\Windows\System\PiDwhkI.exe
  2⤵
  PID:4424
- C:\Windows\System\dFbccLD.exe
  C:\Windows\System\dFbccLD.exe
  2⤵
  PID:4444
- C:\Windows\System\gSMMAJb.exe
  C:\Windows\System\gSMMAJb.exe
  2⤵
  PID:4464
- C:\Windows\System\EucoZsT.exe
  C:\Windows\System\EucoZsT.exe
  2⤵
  PID:4492
- C:\Windows\System\lQNuwwA.exe
  C:\Windows\System\lQNuwwA.exe
  2⤵
  PID:4512
- C:\Windows\System\FdHahXE.exe
  C:\Windows\System\FdHahXE.exe
  2⤵
  PID:4532
- C:\Windows\System\UXjeCkH.exe
  C:\Windows\System\UXjeCkH.exe
  2⤵
  PID:4548
- C:\Windows\System\GyVuMmq.exe
  C:\Windows\System\GyVuMmq.exe
  2⤵
  PID:4568
- C:\Windows\System\ZcLUrYt.exe
  C:\Windows\System\ZcLUrYt.exe
  2⤵
  PID:4588
- C:\Windows\System\yNdZvzW.exe
  C:\Windows\System\yNdZvzW.exe
  2⤵
  PID:4616
- C:\Windows\System\KVSBHiP.exe
  C:\Windows\System\KVSBHiP.exe
  2⤵
  PID:4632
- C:\Windows\System\UbtVNOW.exe
  C:\Windows\System\UbtVNOW.exe
  2⤵
  PID:4652
- C:\Windows\System\BzrkaDw.exe
  C:\Windows\System\BzrkaDw.exe
  2⤵
  PID:4676
- C:\Windows\System\MIfwGMU.exe
  C:\Windows\System\MIfwGMU.exe
  2⤵
  PID:4692
- C:\Windows\System\TdqqpyK.exe
  C:\Windows\System\TdqqpyK.exe
  2⤵
  PID:4712
- C:\Windows\System\qkRIjvW.exe
  C:\Windows\System\qkRIjvW.exe
  2⤵
  PID:4732
- C:\Windows\System\zappoWL.exe
  C:\Windows\System\zappoWL.exe
  2⤵
  PID:4748
- C:\Windows\System\OONqFdC.exe
  C:\Windows\System\OONqFdC.exe
  2⤵
  PID:4768
- C:\Windows\System\mjXGcIH.exe
  C:\Windows\System\mjXGcIH.exe
  2⤵
  PID:4784
- C:\Windows\System\epUqzSB.exe
  C:\Windows\System\epUqzSB.exe
  2⤵
  PID:4808
- C:\Windows\System\vGHeVia.exe
  C:\Windows\System\vGHeVia.exe
  2⤵
  PID:4828
- C:\Windows\System\QfqNUJe.exe
  C:\Windows\System\QfqNUJe.exe
  2⤵
  PID:4844
- C:\Windows\System\jWSMWCp.exe
  C:\Windows\System\jWSMWCp.exe
  2⤵
  PID:4860
- C:\Windows\System\imsbFwF.exe
  C:\Windows\System\imsbFwF.exe
  2⤵
  PID:4884
- C:\Windows\System\iqIrEvA.exe
  C:\Windows\System\iqIrEvA.exe
  2⤵
  PID:4912
- C:\Windows\System\UAkTqjG.exe
  C:\Windows\System\UAkTqjG.exe
  2⤵
  PID:4932
- C:\Windows\System\hMcPoeF.exe
  C:\Windows\System\hMcPoeF.exe
  2⤵
  PID:4948
- C:\Windows\System\nfcHfjo.exe
  C:\Windows\System\nfcHfjo.exe
  2⤵
  PID:4964
- C:\Windows\System\gzeyECt.exe
  C:\Windows\System\gzeyECt.exe
  2⤵
  PID:4980
- C:\Windows\System\PZvvAjM.exe
  C:\Windows\System\PZvvAjM.exe
  2⤵
  PID:5008
- C:\Windows\System\xzigRrS.exe
  C:\Windows\System\xzigRrS.exe
  2⤵
  PID:5032
- C:\Windows\System\CiWrGdf.exe
  C:\Windows\System\CiWrGdf.exe
  2⤵
  PID:5048
- C:\Windows\System\dWSYhqk.exe
  C:\Windows\System\dWSYhqk.exe
  2⤵
  PID:5064
- C:\Windows\System\HdkaMXX.exe
  C:\Windows\System\HdkaMXX.exe
  2⤵
  PID:5088
- C:\Windows\System\iCrkUpz.exe
  C:\Windows\System\iCrkUpz.exe
  2⤵
  PID:5108
- C:\Windows\System\eBGITnL.exe
  C:\Windows\System\eBGITnL.exe
  2⤵
  PID:3920
- C:\Windows\System\NftBAGT.exe
  C:\Windows\System\NftBAGT.exe
  2⤵
  PID:4064
- C:\Windows\System\dKcKMhj.exe
  C:\Windows\System\dKcKMhj.exe
  2⤵
  PID:680
- C:\Windows\System\MwaRgej.exe
  C:\Windows\System\MwaRgej.exe
  2⤵
  PID:1688
- C:\Windows\System\XEhMmhb.exe
  C:\Windows\System\XEhMmhb.exe
  2⤵
  PID:2744
- C:\Windows\System\IfHSjIB.exe
  C:\Windows\System\IfHSjIB.exe
  2⤵
  PID:3288
- C:\Windows\System\mrmHWsS.exe
  C:\Windows\System\mrmHWsS.exe
  2⤵
  PID:2452
- C:\Windows\System\RFIwMgM.exe
  C:\Windows\System\RFIwMgM.exe
  2⤵
  PID:3276
- C:\Windows\System\hwkXtyy.exe
  C:\Windows\System\hwkXtyy.exe
  2⤵
  PID:3336
- C:\Windows\System\cfMacMV.exe
  C:\Windows\System\cfMacMV.exe
  2⤵
  PID:3192
- C:\Windows\System\glkJbGR.exe
  C:\Windows\System\glkJbGR.exe
  2⤵
  PID:2648
- C:\Windows\System\dmrxgQk.exe
  C:\Windows\System\dmrxgQk.exe
  2⤵
  PID:3560
- C:\Windows\System\OQJPJuI.exe
  C:\Windows\System\OQJPJuI.exe
  2⤵
  PID:3780
- C:\Windows\System\eMhmeBj.exe
  C:\Windows\System\eMhmeBj.exe
  2⤵
  PID:3356
- C:\Windows\System\ajZTJBI.exe
  C:\Windows\System\ajZTJBI.exe
  2⤵
  PID:3696
- C:\Windows\System\UKQfsrJ.exe
  C:\Windows\System\UKQfsrJ.exe
  2⤵
  PID:3836
- C:\Windows\System\mcwBQVm.exe
  C:\Windows\System\mcwBQVm.exe
  2⤵
  PID:3676
- C:\Windows\System\SlgipAt.exe
  C:\Windows\System\SlgipAt.exe
  2⤵
  PID:4136
- C:\Windows\System\vwUssBq.exe
  C:\Windows\System\vwUssBq.exe
  2⤵
  PID:4116
- C:\Windows\System\RiwfAwE.exe
  C:\Windows\System\RiwfAwE.exe
  2⤵
  PID:1912
- C:\Windows\System\RxZXyFq.exe
  C:\Windows\System\RxZXyFq.exe
  2⤵
  PID:4200
- C:\Windows\System\XwGsXgB.exe
  C:\Windows\System\XwGsXgB.exe
  2⤵
  PID:4240
- C:\Windows\System\lAsTlqz.exe
  C:\Windows\System\lAsTlqz.exe
  2⤵
  PID:4188
- C:\Windows\System\TcTnlcy.exe
  C:\Windows\System\TcTnlcy.exe
  2⤵
  PID:4368
- C:\Windows\System\szvsMbE.exe
  C:\Windows\System\szvsMbE.exe
  2⤵
  PID:4416
- C:\Windows\System\gsCxYoB.exe
  C:\Windows\System\gsCxYoB.exe
  2⤵
  PID:4280
- C:\Windows\System\kTbuXFQ.exe
  C:\Windows\System\kTbuXFQ.exe
  2⤵
  PID:4276
- C:\Windows\System\DgnedNv.exe
  C:\Windows\System\DgnedNv.exe
  2⤵
  PID:4316
- C:\Windows\System\BynjMUB.exe
  C:\Windows\System\BynjMUB.exe
  2⤵
  PID:4432
- C:\Windows\System\tilzWbx.exe
  C:\Windows\System\tilzWbx.exe
  2⤵
  PID:4456
- C:\Windows\System\liiSSnG.exe
  C:\Windows\System\liiSSnG.exe
  2⤵
  PID:4504
- C:\Windows\System\luvAnhQ.exe
  C:\Windows\System\luvAnhQ.exe
  2⤵
  PID:4544
- C:\Windows\System\pwdHgWO.exe
  C:\Windows\System\pwdHgWO.exe
  2⤵
  PID:4624
- C:\Windows\System\UvMzUlk.exe
  C:\Windows\System\UvMzUlk.exe
  2⤵
  PID:4528
- C:\Windows\System\nzvKYZz.exe
  C:\Windows\System\nzvKYZz.exe
  2⤵
  PID:4604
- C:\Windows\System\PganpTX.exe
  C:\Windows\System\PganpTX.exe
  2⤵
  PID:4708
- C:\Windows\System\WCskQRJ.exe
  C:\Windows\System\WCskQRJ.exe
  2⤵
  PID:2540
- C:\Windows\System\UmEmuVw.exe
  C:\Windows\System\UmEmuVw.exe
  2⤵
  PID:4776
- C:\Windows\System\sLjLLsj.exe
  C:\Windows\System\sLjLLsj.exe
  2⤵
  PID:4852
- C:\Windows\System\NczkpRt.exe
  C:\Windows\System\NczkpRt.exe
  2⤵
  PID:2688
- C:\Windows\System\oRhNVbu.exe
  C:\Windows\System\oRhNVbu.exe
  2⤵
  PID:2660
- C:\Windows\System\uJAQtXd.exe
  C:\Windows\System\uJAQtXd.exe
  2⤵
  PID:4876
- C:\Windows\System\qOnBoDo.exe
  C:\Windows\System\qOnBoDo.exe
  2⤵
  PID:4904
- C:\Windows\System\eeXBRtL.exe
  C:\Windows\System\eeXBRtL.exe
  2⤵
  PID:4928
- C:\Windows\System\JgcdgCw.exe
  C:\Windows\System\JgcdgCw.exe
  2⤵
  PID:5020
- C:\Windows\System\xyPTTuX.exe
  C:\Windows\System\xyPTTuX.exe
  2⤵
  PID:5060
- C:\Windows\System\NlPSRXK.exe
  C:\Windows\System\NlPSRXK.exe
  2⤵
  PID:4992
- C:\Windows\System\NCLkjfw.exe
  C:\Windows\System\NCLkjfw.exe
  2⤵
  PID:5004
- C:\Windows\System\fBKVxOL.exe
  C:\Windows\System\fBKVxOL.exe
  2⤵
  PID:2612
- C:\Windows\System\GWpLTFU.exe
  C:\Windows\System\GWpLTFU.exe
  2⤵
  PID:1944
- C:\Windows\System\DAvUnLy.exe
  C:\Windows\System\DAvUnLy.exe
  2⤵
  PID:3196
- C:\Windows\System\ZpATiAX.exe
  C:\Windows\System\ZpATiAX.exe
  2⤵
  PID:3120
- C:\Windows\System\IHaYqUN.exe
  C:\Windows\System\IHaYqUN.exe
  2⤵
  PID:3600
- C:\Windows\System\FdfJnGn.exe
  C:\Windows\System\FdfJnGn.exe
  2⤵
  PID:3360
- C:\Windows\System\rQQaveA.exe
  C:\Windows\System\rQQaveA.exe
  2⤵
  PID:3852
- C:\Windows\System\khJTQDN.exe
  C:\Windows\System\khJTQDN.exe
  2⤵
  PID:1984
- C:\Windows\System\BrGIkaN.exe
  C:\Windows\System\BrGIkaN.exe
  2⤵
  PID:3400
- C:\Windows\System\WoDANNK.exe
  C:\Windows\System\WoDANNK.exe
  2⤵
  PID:4044
- C:\Windows\System\iiYmstv.exe
  C:\Windows\System\iiYmstv.exe
  2⤵
  PID:4336
- C:\Windows\System\amVYlNk.exe
  C:\Windows\System\amVYlNk.exe
  2⤵
  PID:3552
- C:\Windows\System\ZsNNVKz.exe
  C:\Windows\System\ZsNNVKz.exe
  2⤵
  PID:4128
- C:\Windows\System\lJXnloo.exe
  C:\Windows\System\lJXnloo.exe
  2⤵
  PID:4452
- C:\Windows\System\wGAmPzr.exe
  C:\Windows\System\wGAmPzr.exe
  2⤵
  PID:2924
- C:\Windows\System\zRxCPEF.exe
  C:\Windows\System\zRxCPEF.exe
  2⤵
  PID:4440
- C:\Windows\System\TbgeDOT.exe
  C:\Windows\System\TbgeDOT.exe
  2⤵
  PID:4524
- C:\Windows\System\yPFRKNC.exe
  C:\Windows\System\yPFRKNC.exe
  2⤵
  PID:4160
- C:\Windows\System\nVdmttd.exe
  C:\Windows\System\nVdmttd.exe
  2⤵
  PID:4480
- C:\Windows\System\HkOkQVx.exe
  C:\Windows\System\HkOkQVx.exe
  2⤵
  PID:4196
- C:\Windows\System\yjEfeEX.exe
  C:\Windows\System\yjEfeEX.exe
  2⤵
  PID:4324
- C:\Windows\System\fddFPLq.exe
  C:\Windows\System\fddFPLq.exe
  2⤵
  PID:4556
- C:\Windows\System\lPDUCUO.exe
  C:\Windows\System\lPDUCUO.exe
  2⤵
  PID:4664
- C:\Windows\System\OOWCYJx.exe
  C:\Windows\System\OOWCYJx.exe
  2⤵
  PID:4644
- C:\Windows\System\QLTDseq.exe
  C:\Windows\System\QLTDseq.exe
  2⤵
  PID:4728
- C:\Windows\System\YAsfbgH.exe
  C:\Windows\System\YAsfbgH.exe
  2⤵
  PID:4824
- C:\Windows\System\mnIrUIe.exe
  C:\Windows\System\mnIrUIe.exe
  2⤵
  PID:2516
- C:\Windows\System\uZScySU.exe
  C:\Windows\System\uZScySU.exe
  2⤵
  PID:4892
- C:\Windows\System\fBGncbl.exe
  C:\Windows\System\fBGncbl.exe
  2⤵
  PID:4940
- C:\Windows\System\iSrwIMv.exe
  C:\Windows\System\iSrwIMv.exe
  2⤵
  PID:5056
- C:\Windows\System\qmoOOMG.exe
  C:\Windows\System\qmoOOMG.exe
  2⤵
  PID:4972
- C:\Windows\System\VrPSHZi.exe
  C:\Windows\System\VrPSHZi.exe
  2⤵
  PID:5104
- C:\Windows\System\TvTjbVi.exe
  C:\Windows\System\TvTjbVi.exe
  2⤵
  PID:5072
- C:\Windows\System\zKkbJtK.exe
  C:\Windows\System\zKkbJtK.exe
  2⤵
  PID:2776
- C:\Windows\System\DiXeBUR.exe
  C:\Windows\System\DiXeBUR.exe
  2⤵
  PID:2704
- C:\Windows\System\bJrMxfr.exe
  C:\Windows\System\bJrMxfr.exe
  2⤵
  PID:3300
- C:\Windows\System\SpvZfpy.exe
  C:\Windows\System\SpvZfpy.exe
  2⤵
  PID:2232
- C:\Windows\System\uTeETzu.exe
  C:\Windows\System\uTeETzu.exe
  2⤵
  PID:3900
- C:\Windows\System\PGiJtUw.exe
  C:\Windows\System\PGiJtUw.exe
  2⤵
  PID:960
- C:\Windows\System\fWpaIzh.exe
  C:\Windows\System\fWpaIzh.exe
  2⤵
  PID:3596
- C:\Windows\System\pJkasNQ.exe
  C:\Windows\System\pJkasNQ.exe
  2⤵
  PID:3932
- C:\Windows\System\pYqFHva.exe
  C:\Windows\System\pYqFHva.exe
  2⤵
  PID:1976
- C:\Windows\System\jXQmPPE.exe
  C:\Windows\System\jXQmPPE.exe
  2⤵
  PID:4236
- C:\Windows\System\OlpucKg.exe
  C:\Windows\System\OlpucKg.exe
  2⤵
  PID:572
- C:\Windows\System\NoMEhzB.exe
  C:\Windows\System\NoMEhzB.exe
  2⤵
  PID:4396
- C:\Windows\System\jOdCpIe.exe
  C:\Windows\System\jOdCpIe.exe
  2⤵
  PID:4792
- C:\Windows\System\eyaRLHE.exe
  C:\Windows\System\eyaRLHE.exe
  2⤵
  PID:2564
- C:\Windows\System\RYSOXwK.exe
  C:\Windows\System\RYSOXwK.exe
  2⤵
  PID:4392
- C:\Windows\System\FOnnpyX.exe
  C:\Windows\System\FOnnpyX.exe
  2⤵
  PID:4796
- C:\Windows\System\azBHdmW.exe
  C:\Windows\System\azBHdmW.exe
  2⤵
  PID:4320
- C:\Windows\System\vWJGDKc.exe
  C:\Windows\System\vWJGDKc.exe
  2⤵
  PID:4688
- C:\Windows\System\OjaYVfB.exe
  C:\Windows\System\OjaYVfB.exe
  2⤵
  PID:2588
- C:\Windows\System\PMSMYrt.exe
  C:\Windows\System\PMSMYrt.exe
  2⤵
  PID:2376
- C:\Windows\System\ynHMjAf.exe
  C:\Windows\System\ynHMjAf.exe
  2⤵
  PID:2928
- C:\Windows\System\tJOtCnj.exe
  C:\Windows\System\tJOtCnj.exe
  2⤵
  PID:4988
- C:\Windows\System\vtnWvoI.exe
  C:\Windows\System\vtnWvoI.exe
  2⤵
  PID:5080
- C:\Windows\System\geVSruF.exe
  C:\Windows\System\geVSruF.exe
  2⤵
  PID:3960
- C:\Windows\System\dVzLscH.exe
  C:\Windows\System\dVzLscH.exe
  2⤵
  PID:1312
- C:\Windows\System\bXnAJCF.exe
  C:\Windows\System\bXnAJCF.exe
  2⤵
  PID:2412
- C:\Windows\System\hjBJaCP.exe
  C:\Windows\System\hjBJaCP.exe
  2⤵
  PID:1784
- C:\Windows\System\LWqxpVM.exe
  C:\Windows\System\LWqxpVM.exe
  2⤵
  PID:4296
- C:\Windows\System\nWDVVjD.exe
  C:\Windows\System\nWDVVjD.exe
  2⤵
  PID:536
- C:\Windows\System\ZhnzvMu.exe
  C:\Windows\System\ZhnzvMu.exe
  2⤵
  PID:3516
- C:\Windows\System\VeeAFdR.exe
  C:\Windows\System\VeeAFdR.exe
  2⤵
  PID:2816
- C:\Windows\System\oYKZhPV.exe
  C:\Windows\System\oYKZhPV.exe
  2⤵
  PID:760
- C:\Windows\System\HwnYagI.exe
  C:\Windows\System\HwnYagI.exe
  2⤵
  PID:624
- C:\Windows\System\cfTqGYX.exe
  C:\Windows\System\cfTqGYX.exe
  2⤵
  PID:4820
- C:\Windows\System\bUESswr.exe
  C:\Windows\System\bUESswr.exe
  2⤵
  PID:4540
- C:\Windows\System\IxzUWgK.exe
  C:\Windows\System\IxzUWgK.exe
  2⤵
  PID:2808
- C:\Windows\System\FPvzTzh.exe
  C:\Windows\System\FPvzTzh.exe
  2⤵
  PID:4816
- C:\Windows\System\nISxOAA.exe
  C:\Windows\System\nISxOAA.exe
  2⤵
  PID:2992
- C:\Windows\System\tLkBYci.exe
  C:\Windows\System\tLkBYci.exe
  2⤵
  PID:2960
- C:\Windows\System\DqROfch.exe
  C:\Windows\System\DqROfch.exe
  2⤵
  PID:2800
- C:\Windows\System\pHzMMpX.exe
  C:\Windows\System\pHzMMpX.exe
  2⤵
  PID:4872
- C:\Windows\System\PdsntKU.exe
  C:\Windows\System\PdsntKU.exe
  2⤵
  PID:1788
- C:\Windows\System\zEZJfhQ.exe
  C:\Windows\System\zEZJfhQ.exe
  2⤵
  PID:2432
- C:\Windows\System\ObjddnF.exe
  C:\Windows\System\ObjddnF.exe
  2⤵
  PID:4900
- C:\Windows\System\kuZCTIk.exe
  C:\Windows\System\kuZCTIk.exe
  2⤵
  PID:3992
- C:\Windows\System\pWgfFdX.exe
  C:\Windows\System\pWgfFdX.exe
  2⤵
  PID:2024
- C:\Windows\System\OKjWvrQ.exe
  C:\Windows\System\OKjWvrQ.exe
  2⤵
  PID:2364
- C:\Windows\System\LtnkZKO.exe
  C:\Windows\System\LtnkZKO.exe
  2⤵
  PID:3584
- C:\Windows\System\YItgQUy.exe
  C:\Windows\System\YItgQUy.exe
  2⤵
  PID:316
- C:\Windows\System\MxFJOkF.exe
  C:\Windows\System\MxFJOkF.exe
  2⤵
  PID:2748
- C:\Windows\System\OHfrZaF.exe
  C:\Windows\System\OHfrZaF.exe
  2⤵
  PID:4700
- C:\Windows\System\mopEmXQ.exe
  C:\Windows\System\mopEmXQ.exe
  2⤵
  PID:3944
- C:\Windows\System\auUuFaH.exe
  C:\Windows\System\auUuFaH.exe
  2⤵
  PID:2680
- C:\Windows\System\NOYrLqC.exe
  C:\Windows\System\NOYrLqC.exe
  2⤵
  PID:2500
- C:\Windows\System\Ykcvxqm.exe
  C:\Windows\System\Ykcvxqm.exe
  2⤵
  PID:2188
- C:\Windows\System\GiWsOoE.exe
  C:\Windows\System\GiWsOoE.exe
  2⤵
  PID:2936
- C:\Windows\System\uLDzCxy.exe
  C:\Windows\System\uLDzCxy.exe
  2⤵
  PID:2716
- C:\Windows\System\uyAUODY.exe
  C:\Windows\System\uyAUODY.exe
  2⤵
  PID:544
- C:\Windows\System\jrXXPig.exe
  C:\Windows\System\jrXXPig.exe
  2⤵
  PID:5132
- C:\Windows\System\tgKmzEL.exe
  C:\Windows\System\tgKmzEL.exe
  2⤵
  PID:5148
- C:\Windows\System\mDFiBgO.exe
  C:\Windows\System\mDFiBgO.exe
  2⤵
  PID:5168
- C:\Windows\System\WxINhxr.exe
  C:\Windows\System\WxINhxr.exe
  2⤵
  PID:5184
- C:\Windows\System\NGWHNfM.exe
  C:\Windows\System\NGWHNfM.exe
  2⤵
  PID:5208
- C:\Windows\System\YiLFgjx.exe
  C:\Windows\System\YiLFgjx.exe
  2⤵
  PID:5224
- C:\Windows\System\xhrvVVF.exe
  C:\Windows\System\xhrvVVF.exe
  2⤵
  PID:5240
- C:\Windows\System\imxnaDJ.exe
  C:\Windows\System\imxnaDJ.exe
  2⤵
  PID:5264
- C:\Windows\System\SUjhQXl.exe
  C:\Windows\System\SUjhQXl.exe
  2⤵
  PID:5300
- C:\Windows\System\tSjXQZA.exe
  C:\Windows\System\tSjXQZA.exe
  2⤵
  PID:5324
- C:\Windows\System\WFWcIgG.exe
  C:\Windows\System\WFWcIgG.exe
  2⤵
  PID:5344
- C:\Windows\System\czKxLgI.exe
  C:\Windows\System\czKxLgI.exe
  2⤵
  PID:5360
- C:\Windows\System\BZDYqph.exe
  C:\Windows\System\BZDYqph.exe
  2⤵
  PID:5384
- C:\Windows\System\xGtsqiI.exe
  C:\Windows\System\xGtsqiI.exe
  2⤵
  PID:5400
- C:\Windows\System\YhGmteo.exe
  C:\Windows\System\YhGmteo.exe
  2⤵
  PID:5416
- C:\Windows\System\bQYFgoB.exe
  C:\Windows\System\bQYFgoB.exe
  2⤵
  PID:5432
- C:\Windows\System\RVIPVFU.exe
  C:\Windows\System\RVIPVFU.exe
  2⤵
  PID:5448
- C:\Windows\System\LBQgfyF.exe
  C:\Windows\System\LBQgfyF.exe
  2⤵
  PID:5464
- C:\Windows\System\pmttObB.exe
  C:\Windows\System\pmttObB.exe
  2⤵
  PID:5480
- C:\Windows\System\bObIRKQ.exe
  C:\Windows\System\bObIRKQ.exe
  2⤵
  PID:5496
- C:\Windows\System\LXDoPaO.exe
  C:\Windows\System\LXDoPaO.exe
  2⤵
  PID:5512
- C:\Windows\System\ZQaoAvA.exe
  C:\Windows\System\ZQaoAvA.exe
  2⤵
  PID:5528
- C:\Windows\System\WtDxpas.exe
  C:\Windows\System\WtDxpas.exe
  2⤵
  PID:5544
- C:\Windows\System\QPTDCnW.exe
  C:\Windows\System\QPTDCnW.exe
  2⤵
  PID:5560
- C:\Windows\System\uLDVgRf.exe
  C:\Windows\System\uLDVgRf.exe
  2⤵
  PID:5576
- C:\Windows\System\PIDLMGS.exe
  C:\Windows\System\PIDLMGS.exe
  2⤵
  PID:5592
- C:\Windows\System\pRmLSFR.exe
  C:\Windows\System\pRmLSFR.exe
  2⤵
  PID:5608
- C:\Windows\System\bTuTfcW.exe
  C:\Windows\System\bTuTfcW.exe
  2⤵
  PID:5624
- C:\Windows\System\eIaitmg.exe
  C:\Windows\System\eIaitmg.exe
  2⤵
  PID:5640
- C:\Windows\System\NzfzITn.exe
  C:\Windows\System\NzfzITn.exe
  2⤵
  PID:5656
- C:\Windows\System\qWGQDMr.exe
  C:\Windows\System\qWGQDMr.exe
  2⤵
  PID:5672
- C:\Windows\System\ypKnjMz.exe
  C:\Windows\System\ypKnjMz.exe
  2⤵
  PID:5688
- C:\Windows\System\QrQlSFG.exe
  C:\Windows\System\QrQlSFG.exe
  2⤵
  PID:5704
- C:\Windows\System\SaMHqgw.exe
  C:\Windows\System\SaMHqgw.exe
  2⤵
  PID:5720
- C:\Windows\System\pSQIkuh.exe
  C:\Windows\System\pSQIkuh.exe
  2⤵
  PID:5736
- C:\Windows\System\RTHcPap.exe
  C:\Windows\System\RTHcPap.exe
  2⤵
  PID:5752
- C:\Windows\System\YQdjMSg.exe
  C:\Windows\System\YQdjMSg.exe
  2⤵
  PID:5768
- C:\Windows\System\CqKiUGB.exe
  C:\Windows\System\CqKiUGB.exe
  2⤵
  PID:5784
- C:\Windows\System\DsIHUaR.exe
  C:\Windows\System\DsIHUaR.exe
  2⤵
  PID:5800
- C:\Windows\System\QDzKxZZ.exe
  C:\Windows\System\QDzKxZZ.exe
  2⤵
  PID:5816
- C:\Windows\System\uqgloJf.exe
  C:\Windows\System\uqgloJf.exe
  2⤵
  PID:5832
- C:\Windows\System\uZjGfTt.exe
  C:\Windows\System\uZjGfTt.exe
  2⤵
  PID:5848
- C:\Windows\System\NhPadxj.exe
  C:\Windows\System\NhPadxj.exe
  2⤵
  PID:5864
- C:\Windows\System\jLgBDHk.exe
  C:\Windows\System\jLgBDHk.exe
  2⤵
  PID:5880
- C:\Windows\System\UkLOVIx.exe
  C:\Windows\System\UkLOVIx.exe
  2⤵
  PID:5896
- C:\Windows\System\ahVEgzk.exe
  C:\Windows\System\ahVEgzk.exe
  2⤵
  PID:5912
- C:\Windows\System\TbvPOgy.exe
  C:\Windows\System\TbvPOgy.exe
  2⤵
  PID:5928
- C:\Windows\System\OlgbtXF.exe
  C:\Windows\System\OlgbtXF.exe
  2⤵
  PID:5944
- C:\Windows\System\AeLSTag.exe
  C:\Windows\System\AeLSTag.exe
  2⤵
  PID:5960
- C:\Windows\System\hIkhgPU.exe
  C:\Windows\System\hIkhgPU.exe
  2⤵
  PID:5976
- C:\Windows\System\IoImTNY.exe
  C:\Windows\System\IoImTNY.exe
  2⤵
  PID:5992
- C:\Windows\System\JdqRUAB.exe
  C:\Windows\System\JdqRUAB.exe
  2⤵
  PID:6008
- C:\Windows\System\PYMwSOI.exe
  C:\Windows\System\PYMwSOI.exe
  2⤵
  PID:6024
- C:\Windows\System\vLXrtUR.exe
  C:\Windows\System\vLXrtUR.exe
  2⤵
  PID:6040
- C:\Windows\System\JnjuXCf.exe
  C:\Windows\System\JnjuXCf.exe
  2⤵
  PID:6056
- C:\Windows\System\DvwGPul.exe
  C:\Windows\System\DvwGPul.exe
  2⤵
  PID:6072
- C:\Windows\System\hOdLFRo.exe
  C:\Windows\System\hOdLFRo.exe
  2⤵
  PID:6088
- C:\Windows\System\hHawKpC.exe
  C:\Windows\System\hHawKpC.exe
  2⤵
  PID:6104
- C:\Windows\System\srAvZsq.exe
  C:\Windows\System\srAvZsq.exe
  2⤵
  PID:6120
- C:\Windows\System\AymyrFg.exe
  C:\Windows\System\AymyrFg.exe
  2⤵
  PID:6136
- C:\Windows\System\hTxzBuR.exe
  C:\Windows\System\hTxzBuR.exe
  2⤵
  PID:4836
- C:\Windows\System\xxSSKYa.exe
  C:\Windows\System\xxSSKYa.exe
  2⤵
  PID:3488
- C:\Windows\System\SzFuWAW.exe
  C:\Windows\System\SzFuWAW.exe
  2⤵
  PID:4640
- C:\Windows\System\ETmkPMP.exe
  C:\Windows\System\ETmkPMP.exe
  2⤵
  PID:2624
- C:\Windows\System\wJgsCom.exe
  C:\Windows\System\wJgsCom.exe
  2⤵
  PID:1724
- C:\Windows\System\acwIqRT.exe
  C:\Windows\System\acwIqRT.exe
  2⤵
  PID:4672
- C:\Windows\System\KRNpPec.exe
  C:\Windows\System\KRNpPec.exe
  2⤵
  PID:2820
- C:\Windows\System\arJlGkn.exe
  C:\Windows\System\arJlGkn.exe
  2⤵
  PID:2484
- C:\Windows\System\GLnfUkH.exe
  C:\Windows\System\GLnfUkH.exe
  2⤵
  PID:4408
- C:\Windows\System\VwsEYDP.exe
  C:\Windows\System\VwsEYDP.exe
  2⤵
  PID:5016
- C:\Windows\System\JpdtuFc.exe
  C:\Windows\System\JpdtuFc.exe
  2⤵
  PID:5232
- C:\Windows\System\KDCHHRN.exe
  C:\Windows\System\KDCHHRN.exe
  2⤵
  PID:5192
- C:\Windows\System\YiMTdNm.exe
  C:\Windows\System\YiMTdNm.exe
  2⤵
  PID:5236
- C:\Windows\System\OdPGJAD.exe
  C:\Windows\System\OdPGJAD.exe
  2⤵
  PID:5140
- C:\Windows\System\OLvusDh.exe
  C:\Windows\System\OLvusDh.exe
  2⤵
  PID:4508
- C:\Windows\System\CxLdbmk.exe
  C:\Windows\System\CxLdbmk.exe
  2⤵
  PID:1744
- C:\Windows\System\qaTckQq.exe
  C:\Windows\System\qaTckQq.exe
  2⤵
  PID:5144
- C:\Windows\System\KfofvUq.exe
  C:\Windows\System\KfofvUq.exe
  2⤵
  PID:5308
- C:\Windows\System\YIpbjBk.exe
  C:\Windows\System\YIpbjBk.exe
  2⤵
  PID:5352
- C:\Windows\System\dHPSkNg.exe
  C:\Windows\System\dHPSkNg.exe
  2⤵
  PID:5396
- C:\Windows\System\khMYQVI.exe
  C:\Windows\System\khMYQVI.exe
  2⤵
  PID:5340
- C:\Windows\System\vjOnkkW.exe
  C:\Windows\System\vjOnkkW.exe
  2⤵
  PID:5428
- C:\Windows\System\TNnlVvg.exe
  C:\Windows\System\TNnlVvg.exe
  2⤵
  PID:5492
- C:\Windows\System\gRNgCik.exe
  C:\Windows\System\gRNgCik.exe
  2⤵
  PID:5556
- C:\Windows\System\IkTMCJi.exe
  C:\Windows\System\IkTMCJi.exe
  2⤵
  PID:5620
- C:\Windows\System\dNLZlyU.exe
  C:\Windows\System\dNLZlyU.exe
  2⤵
  PID:5372
- C:\Windows\System\rJbKFKM.exe
  C:\Windows\System\rJbKFKM.exe
  2⤵
  PID:5712
- C:\Windows\System\EuUYZDV.exe
  C:\Windows\System\EuUYZDV.exe
  2⤵
  PID:5776
- C:\Windows\System\dGWUAlA.exe
  C:\Windows\System\dGWUAlA.exe
  2⤵
  PID:5840
- C:\Windows\System\MBDUsQB.exe
  C:\Windows\System\MBDUsQB.exe
  2⤵
  PID:5904
- C:\Windows\System\wqnWfDK.exe
  C:\Windows\System\wqnWfDK.exe
  2⤵
  PID:5968
- C:\Windows\System\BQrWxKU.exe
  C:\Windows\System\BQrWxKU.exe
  2⤵
  PID:5408
- C:\Windows\System\QZQZMER.exe
  C:\Windows\System\QZQZMER.exe
  2⤵
  PID:6036
- C:\Windows\System\WYWFvqp.exe
  C:\Windows\System\WYWFvqp.exe
  2⤵
  PID:5508
- C:\Windows\System\OaEkGvk.exe
  C:\Windows\System\OaEkGvk.exe
  2⤵
  PID:6132
- C:\Windows\System\LwMMAZz.exe
  C:\Windows\System\LwMMAZz.exe
  2⤵
  PID:5568
- C:\Windows\System\HyQBPSM.exe
  C:\Windows\System\HyQBPSM.exe
  2⤵
  PID:5572
- C:\Windows\System\YrUUsWW.exe
  C:\Windows\System\YrUUsWW.exe
  2⤵
  PID:5664
- C:\Windows\System\jdSDKXG.exe
  C:\Windows\System\jdSDKXG.exe
  2⤵
  PID:1568
- C:\Windows\System\dSIiCBu.exe
  C:\Windows\System\dSIiCBu.exe
  2⤵
  PID:6016
- C:\Windows\System\grOJywI.exe
  C:\Windows\System\grOJywI.exe
  2⤵
  PID:6080
- C:\Windows\System\vkMHFqt.exe
  C:\Windows\System\vkMHFqt.exe
  2⤵
  PID:2888
- C:\Windows\System\oZMpykr.exe
  C:\Windows\System\oZMpykr.exe
  2⤵
  PID:5700
- C:\Windows\System\JJtVYJx.exe
  C:\Windows\System\JJtVYJx.exe
  2⤵
  PID:5920
- C:\Windows\System\koGqWwa.exe
  C:\Windows\System\koGqWwa.exe
  2⤵
  PID:5856
- C:\Windows\System\eDCDZCU.exe
  C:\Windows\System\eDCDZCU.exe
  2⤵
  PID:5792
- C:\Windows\System\FrBmCor.exe
  C:\Windows\System\FrBmCor.exe
  2⤵
  PID:5728
- C:\Windows\System\anXVrLT.exe
  C:\Windows\System\anXVrLT.exe
  2⤵
  PID:3704
- C:\Windows\System\hKxaxoZ.exe
  C:\Windows\System\hKxaxoZ.exe
  2⤵
  PID:2160
- C:\Windows\System\VfObrIC.exe
  C:\Windows\System\VfObrIC.exe
  2⤵
  PID:1256
- C:\Windows\System\LAxhsSO.exe
  C:\Windows\System\LAxhsSO.exe
  2⤵
  PID:5276
- C:\Windows\System\kXaOKcc.exe
  C:\Windows\System\kXaOKcc.exe
  2⤵
  PID:5252
- C:\Windows\System\dcCbJxb.exe
  C:\Windows\System\dcCbJxb.exe
  2⤵
  PID:5380
- C:\Windows\System\azNSTMk.exe
  C:\Windows\System\azNSTMk.exe
  2⤵
  PID:5680
- C:\Windows\System\FpZqVsq.exe
  C:\Windows\System\FpZqVsq.exe
  2⤵
  PID:5876
- C:\Windows\System\rZgvKtb.exe
  C:\Windows\System\rZgvKtb.exe
  2⤵
  PID:6000
- C:\Windows\System\aHISaUF.exe
  C:\Windows\System\aHISaUF.exe
  2⤵
  PID:1040
- C:\Windows\System\kUweMUS.exe
  C:\Windows\System\kUweMUS.exe
  2⤵
  PID:5956
- C:\Windows\System\ojRiRIa.exe
  C:\Windows\System\ojRiRIa.exe
  2⤵
  PID:5696
- C:\Windows\System\gyqRMtr.exe
  C:\Windows\System\gyqRMtr.exe
  2⤵
  PID:4228
- C:\Windows\System\BpEQWNv.exe
  C:\Windows\System\BpEQWNv.exe
  2⤵
  PID:5256
- C:\Windows\System\SzinOjY.exe
  C:\Windows\System\SzinOjY.exe
  2⤵
  PID:6156
- C:\Windows\System\TwWprrA.exe
  C:\Windows\System\TwWprrA.exe
  2⤵
  PID:6172
- C:\Windows\System\MhOpVGy.exe
  C:\Windows\System\MhOpVGy.exe
  2⤵
  PID:6188
- C:\Windows\System\ARAdOOZ.exe
  C:\Windows\System\ARAdOOZ.exe
  2⤵
  PID:6204
- C:\Windows\System\vbrkXhr.exe
  C:\Windows\System\vbrkXhr.exe
  2⤵
  PID:6220
- C:\Windows\System\thODlEn.exe
  C:\Windows\System\thODlEn.exe
  2⤵
  PID:6236
- C:\Windows\System\gJzWdOf.exe
  C:\Windows\System\gJzWdOf.exe
  2⤵
  PID:6252
- C:\Windows\System\lXzlqnQ.exe
  C:\Windows\System\lXzlqnQ.exe
  2⤵
  PID:6268
- C:\Windows\System\VDXkaRv.exe
  C:\Windows\System\VDXkaRv.exe
  2⤵
  PID:6284
- C:\Windows\System\uSRFslx.exe
  C:\Windows\System\uSRFslx.exe
  2⤵
  PID:6300
- C:\Windows\System\WarpNZH.exe
  C:\Windows\System\WarpNZH.exe
  2⤵
  PID:6316
- C:\Windows\System\yBgmTpr.exe
  C:\Windows\System\yBgmTpr.exe
  2⤵
  PID:6332
- C:\Windows\System\LOGAKAU.exe
  C:\Windows\System\LOGAKAU.exe
  2⤵
  PID:6348
- C:\Windows\System\MbzuKZV.exe
  C:\Windows\System\MbzuKZV.exe
  2⤵
  PID:6364
- C:\Windows\System\BymRdgn.exe
  C:\Windows\System\BymRdgn.exe
  2⤵
  PID:6380
- C:\Windows\System\bQGCEJP.exe
  C:\Windows\System\bQGCEJP.exe
  2⤵
  PID:6396
- C:\Windows\System\qmlRmqQ.exe
  C:\Windows\System\qmlRmqQ.exe
  2⤵
  PID:6412
- C:\Windows\System\eZWYxsr.exe
  C:\Windows\System\eZWYxsr.exe
  2⤵
  PID:6428
- C:\Windows\System\EFNCGGi.exe
  C:\Windows\System\EFNCGGi.exe
  2⤵
  PID:6444
- C:\Windows\System\EJWfjZE.exe
  C:\Windows\System\EJWfjZE.exe
  2⤵
  PID:6460
- C:\Windows\System\znLuZjg.exe
  C:\Windows\System\znLuZjg.exe
  2⤵
  PID:6476
- C:\Windows\System\zsDuRTg.exe
  C:\Windows\System\zsDuRTg.exe
  2⤵
  PID:6492
- C:\Windows\System\GURelJj.exe
  C:\Windows\System\GURelJj.exe
  2⤵
  PID:6508
- C:\Windows\System\XMFLmiO.exe
  C:\Windows\System\XMFLmiO.exe
  2⤵
  PID:6524
- C:\Windows\System\SmcAuex.exe
  C:\Windows\System\SmcAuex.exe
  2⤵
  PID:6540
- C:\Windows\System\FoySSxG.exe
  C:\Windows\System\FoySSxG.exe
  2⤵
  PID:6556
- C:\Windows\System\JEwpJAU.exe
  C:\Windows\System\JEwpJAU.exe
  2⤵
  PID:6572
- C:\Windows\System\mijOGbQ.exe
  C:\Windows\System\mijOGbQ.exe
  2⤵
  PID:6588
- C:\Windows\System\SGgiwbD.exe
  C:\Windows\System\SGgiwbD.exe
  2⤵
  PID:6604
- C:\Windows\System\vCCaiCt.exe
  C:\Windows\System\vCCaiCt.exe
  2⤵
  PID:6620
- C:\Windows\System\umLHhPa.exe
  C:\Windows\System\umLHhPa.exe
  2⤵
  PID:6636
- C:\Windows\System\NsRHHyo.exe
  C:\Windows\System\NsRHHyo.exe
  2⤵
  PID:6652
- C:\Windows\System\kwTFMCI.exe
  C:\Windows\System\kwTFMCI.exe
  2⤵
  PID:6668
- C:\Windows\System\LeBXunm.exe
  C:\Windows\System\LeBXunm.exe
  2⤵
  PID:6684
- C:\Windows\System\PEdaqNa.exe
  C:\Windows\System\PEdaqNa.exe
  2⤵
  PID:6700
- C:\Windows\System\cLdHTiY.exe
  C:\Windows\System\cLdHTiY.exe
  2⤵
  PID:6716
- C:\Windows\System\OYaoUFd.exe
  C:\Windows\System\OYaoUFd.exe
  2⤵
  PID:6732
- C:\Windows\System\PDhfWDp.exe
  C:\Windows\System\PDhfWDp.exe
  2⤵
  PID:6748
- C:\Windows\System\yNFrqCg.exe
  C:\Windows\System\yNFrqCg.exe
  2⤵
  PID:6764
- C:\Windows\System\fmaanQB.exe
  C:\Windows\System\fmaanQB.exe
  2⤵
  PID:6780
- C:\Windows\System\cmMQRMt.exe
  C:\Windows\System\cmMQRMt.exe
  2⤵
  PID:6796
- C:\Windows\System\dMBTSND.exe
  C:\Windows\System\dMBTSND.exe
  2⤵
  PID:6812
- C:\Windows\System\hwzJaWL.exe
  C:\Windows\System\hwzJaWL.exe
  2⤵
  PID:6828
- C:\Windows\System\rwWJVQl.exe
  C:\Windows\System\rwWJVQl.exe
  2⤵
  PID:6844
- C:\Windows\System\ROTJgsU.exe
  C:\Windows\System\ROTJgsU.exe
  2⤵
  PID:6860
- C:\Windows\System\QwDxhBy.exe
  C:\Windows\System\QwDxhBy.exe
  2⤵
  PID:6876
- C:\Windows\System\JJXrEFV.exe
  C:\Windows\System\JJXrEFV.exe
  2⤵
  PID:6892
- C:\Windows\System\vRJvfJA.exe
  C:\Windows\System\vRJvfJA.exe
  2⤵
  PID:6908
- C:\Windows\System\IusrCJt.exe
  C:\Windows\System\IusrCJt.exe
  2⤵
  PID:6924
- C:\Windows\System\dhhetFn.exe
  C:\Windows\System\dhhetFn.exe
  2⤵
  PID:6940
- C:\Windows\System\WpYWYpJ.exe
  C:\Windows\System\WpYWYpJ.exe
  2⤵
  PID:6956
- C:\Windows\System\lBSIyIt.exe
  C:\Windows\System\lBSIyIt.exe
  2⤵
  PID:6972
- C:\Windows\System\vVAzUmg.exe
  C:\Windows\System\vVAzUmg.exe
  2⤵
  PID:6988
- C:\Windows\System\NnHtfsn.exe
  C:\Windows\System\NnHtfsn.exe
  2⤵
  PID:7004
- C:\Windows\System\MHADXgM.exe
  C:\Windows\System\MHADXgM.exe
  2⤵
  PID:7020
- C:\Windows\System\XNxyWFF.exe
  C:\Windows\System\XNxyWFF.exe
  2⤵
  PID:7036
- C:\Windows\System\iUILXbR.exe
  C:\Windows\System\iUILXbR.exe
  2⤵
  PID:7052
- C:\Windows\System\lymMdFb.exe
  C:\Windows\System\lymMdFb.exe
  2⤵
  PID:7068
- C:\Windows\System\owwGCjP.exe
  C:\Windows\System\owwGCjP.exe
  2⤵
  PID:7084
- C:\Windows\System\jdEpiST.exe
  C:\Windows\System\jdEpiST.exe
  2⤵
  PID:7100
- C:\Windows\System\AJGuwGn.exe
  C:\Windows\System\AJGuwGn.exe
  2⤵
  PID:7116
- C:\Windows\System\dCyJcVB.exe
  C:\Windows\System\dCyJcVB.exe
  2⤵
  PID:7132
- C:\Windows\System\XvPIOvK.exe
  C:\Windows\System\XvPIOvK.exe
  2⤵
  PID:7148
- C:\Windows\System\xwcJOrx.exe
  C:\Windows\System\xwcJOrx.exe
  2⤵
  PID:7164
- C:\Windows\System\FlZdGoU.exe
  C:\Windows\System\FlZdGoU.exe
  2⤵
  PID:5296
- C:\Windows\System\qMwXYna.exe
  C:\Windows\System\qMwXYna.exe
  2⤵
  PID:5796
- C:\Windows\System\cXfVlUz.exe
  C:\Windows\System\cXfVlUz.exe
  2⤵
  PID:6184
- C:\Windows\System\YXvaCxm.exe
  C:\Windows\System\YXvaCxm.exe
  2⤵
  PID:5204
- C:\Windows\System\OduDzQf.exe
  C:\Windows\System\OduDzQf.exe
  2⤵
  PID:6280
- C:\Windows\System\uhPXYzO.exe
  C:\Windows\System\uhPXYzO.exe
  2⤵
  PID:6344
- C:\Windows\System\ONEPPXY.exe
  C:\Windows\System\ONEPPXY.exe
  2⤵
  PID:6408
- C:\Windows\System\vEfypgt.exe
  C:\Windows\System\vEfypgt.exe
  2⤵
  PID:6472
- C:\Windows\System\JqwnJgk.exe
  C:\Windows\System\JqwnJgk.exe
  2⤵
  PID:6536
- C:\Windows\System\ymfNfGB.exe
  C:\Windows\System\ymfNfGB.exe
  2⤵
  PID:6600
- C:\Windows\System\OXeWrTR.exe
  C:\Windows\System\OXeWrTR.exe
  2⤵
  PID:6628
- C:\Windows\System\AZgEKCx.exe
  C:\Windows\System\AZgEKCx.exe
  2⤵
  PID:6692
- C:\Windows\System\FQWMSqo.exe
  C:\Windows\System\FQWMSqo.exe
  2⤵
  PID:6756
- C:\Windows\System\wzsVjsW.exe
  C:\Windows\System\wzsVjsW.exe
  2⤵
  PID:6820
- C:\Windows\System\NCFiCtj.exe
  C:\Windows\System\NCFiCtj.exe
  2⤵
  PID:6884
- C:\Windows\System\dJixCmC.exe
  C:\Windows\System\dJixCmC.exe
  2⤵
  PID:6948
- C:\Windows\System\DMXSgBN.exe
  C:\Windows\System\DMXSgBN.exe
  2⤵
  PID:6980
- C:\Windows\System\KipmdSc.exe
  C:\Windows\System\KipmdSc.exe
  2⤵
  PID:7012
- C:\Windows\System\iaAziis.exe
  C:\Windows\System\iaAziis.exe
  2⤵
  PID:5504
- C:\Windows\System\IBZRWXY.exe
  C:\Windows\System\IBZRWXY.exe
  2⤵
  PID:4720
- C:\Windows\System\HrEKZsJ.exe
  C:\Windows\System\HrEKZsJ.exe
  2⤵
  PID:5460
- C:\Windows\System\ZCVPola.exe
  C:\Windows\System\ZCVPola.exe
  2⤵
  PID:5588
- C:\Windows\System\pKbtedY.exe
  C:\Windows\System\pKbtedY.exe
  2⤵
  PID:5392
- C:\Windows\System\vTrpZyM.exe
  C:\Windows\System\vTrpZyM.exe
  2⤵
  PID:5936
- C:\Windows\System\SzdfvEh.exe
  C:\Windows\System\SzdfvEh.exe
  2⤵
  PID:5444
- C:\Windows\System\MuKHNpn.exe
  C:\Windows\System\MuKHNpn.exe
  2⤵
  PID:6328
- C:\Windows\System\KHdGqzy.exe
  C:\Windows\System\KHdGqzy.exe
  2⤵
  PID:7076
- C:\Windows\System\WjyfyUf.exe
  C:\Windows\System\WjyfyUf.exe
  2⤵
  PID:7144
- C:\Windows\System\unjlqlh.exe
  C:\Windows\System\unjlqlh.exe
  2⤵
  PID:5652
- C:\Windows\System\GNYILBX.exe
  C:\Windows\System\GNYILBX.exe
  2⤵
  PID:6404
- C:\Windows\System\nseYILT.exe
  C:\Windows\System\nseYILT.exe
  2⤵
  PID:2900
- C:\Windows\System\VzCmYJQ.exe
  C:\Windows\System\VzCmYJQ.exe
  2⤵
  PID:6708
- C:\Windows\System\uldzhLt.exe
  C:\Windows\System\uldzhLt.exe
  2⤵
  PID:5760
- C:\Windows\System\ifIzkUh.exe
  C:\Windows\System\ifIzkUh.exe
  2⤵
  PID:5748
- C:\Windows\System\xpkXlXy.exe
  C:\Windows\System\xpkXlXy.exe
  2⤵
  PID:6112
- C:\Windows\System\OKufhnE.exe
  C:\Windows\System\OKufhnE.exe
  2⤵
  PID:7000
- C:\Windows\System\PkfrjXJ.exe
  C:\Windows\System\PkfrjXJ.exe
  2⤵
  PID:6168
- C:\Windows\System\PJVYRBA.exe
  C:\Windows\System\PJVYRBA.exe
  2⤵
  PID:6264
- C:\Windows\System\DElVwXR.exe
  C:\Windows\System\DElVwXR.exe
  2⤵
  PID:6360
- C:\Windows\System\uVkARom.exe
  C:\Windows\System\uVkARom.exe
  2⤵
  PID:6424
- C:\Windows\System\GruuXeR.exe
  C:\Windows\System\GruuXeR.exe
  2⤵
  PID:6520
- C:\Windows\System\kuGLjFz.exe
  C:\Windows\System\kuGLjFz.exe
  2⤵
  PID:6616
- C:\Windows\System\GJvUBBb.exe
  C:\Windows\System\GJvUBBb.exe
  2⤵
  PID:6680
- C:\Windows\System\IrSgYFr.exe
  C:\Windows\System\IrSgYFr.exe
  2⤵
  PID:6772
- C:\Windows\System\aMXYdLC.exe
  C:\Windows\System\aMXYdLC.exe
  2⤵
  PID:6868
- C:\Windows\System\ZAhIUWW.exe
  C:\Windows\System\ZAhIUWW.exe
  2⤵
  PID:6932
- C:\Windows\System\vigrgBb.exe
  C:\Windows\System\vigrgBb.exe
  2⤵
  PID:7124
- C:\Windows\System\SyFhprd.exe
  C:\Windows\System\SyFhprd.exe
  2⤵
  PID:7160
- C:\Windows\System\dLWNXvH.exe
  C:\Windows\System\dLWNXvH.exe
  2⤵
  PID:7092
- C:\Windows\System\VaFviES.exe
  C:\Windows\System\VaFviES.exe
  2⤵
  PID:6312
- C:\Windows\System\OXVIQhK.exe
  C:\Windows\System\OXVIQhK.exe
  2⤵
  PID:5316
- C:\Windows\System\qezlzDv.exe
  C:\Windows\System\qezlzDv.exe
  2⤵
  PID:6852
- C:\Windows\System\qHTzMGs.exe
  C:\Windows\System\qHTzMGs.exe
  2⤵
  PID:5336
- C:\Windows\System\hckAlel.exe
  C:\Windows\System\hckAlel.exe
  2⤵
  PID:1624
- C:\Windows\System\loprjwF.exe
  C:\Windows\System\loprjwF.exe
  2⤵
  PID:6516
- C:\Windows\System\siyxEzy.exe
  C:\Windows\System\siyxEzy.exe
  2⤵
  PID:5540
- C:\Windows\System\HuLBnTc.exe
  C:\Windows\System\HuLBnTc.exe
  2⤵
  PID:6468
- C:\Windows\System\FGlpnPI.exe
  C:\Windows\System\FGlpnPI.exe
  2⤵
  PID:6568
- C:\Windows\System\RathAIL.exe
  C:\Windows\System\RathAIL.exe
  2⤵
  PID:6792
- C:\Windows\System\PoiUanP.exe
  C:\Windows\System\PoiUanP.exe
  2⤵
  PID:2864
- C:\Windows\System\NJFPikm.exe
  C:\Windows\System\NJFPikm.exe
  2⤵
  PID:5888
- C:\Windows\System\QyGPvOa.exe
  C:\Windows\System\QyGPvOa.exe
  2⤵
  PID:6292
- C:\Windows\System\BOwBoUG.exe
  C:\Windows\System\BOwBoUG.exe
  2⤵
  PID:6324
- C:\Windows\System\IidLYTB.exe
  C:\Windows\System\IidLYTB.exe
  2⤵
  PID:6996
- C:\Windows\System\WQPlfFK.exe
  C:\Windows\System\WQPlfFK.exe
  2⤵
  PID:6808
- C:\Windows\System\hAHCSGK.exe
  C:\Windows\System\hAHCSGK.exe
  2⤵
  PID:6052
- C:\Windows\System\EdlqvhD.exe
  C:\Windows\System\EdlqvhD.exe
  2⤵
  PID:6504
- C:\Windows\System\HcdOHcU.exe
  C:\Windows\System\HcdOHcU.exe
  2⤵
  PID:5684
- C:\Windows\System\hXKTZEP.exe
  C:\Windows\System\hXKTZEP.exe
  2⤵
  PID:5860
- C:\Windows\System\QqLqMSp.exe
  C:\Windows\System\QqLqMSp.exe
  2⤵
  PID:2956
- C:\Windows\System\GbLbtIn.exe
  C:\Windows\System\GbLbtIn.exe
  2⤵
  PID:6392
- C:\Windows\System\MpckuuZ.exe
  C:\Windows\System\MpckuuZ.exe
  2⤵
  PID:6740
- C:\Windows\System\pUIxloD.exe
  C:\Windows\System\pUIxloD.exe
  2⤵
  PID:6724
- C:\Windows\System\LWCmIVY.exe
  C:\Windows\System\LWCmIVY.exe
  2⤵
  PID:6216
- C:\Windows\System\ThuoHCT.exe
  C:\Windows\System\ThuoHCT.exe
  2⤵
  PID:5216
- C:\Windows\System\AqXElaf.exe
  C:\Windows\System\AqXElaf.exe
  2⤵
  PID:6552
- C:\Windows\System\CZGxoLc.exe
  C:\Windows\System\CZGxoLc.exe
  2⤵
  PID:6676
- C:\Windows\System\XcroMPN.exe
  C:\Windows\System\XcroMPN.exe
  2⤵
  PID:6228
- C:\Windows\System\cYnesDv.exe
  C:\Windows\System\cYnesDv.exe
  2⤵
  PID:6440
- C:\Windows\System\MaORRlV.exe
  C:\Windows\System\MaORRlV.exe
  2⤵
  PID:6916
- C:\Windows\System\yYktBjL.exe
  C:\Windows\System\yYktBjL.exe
  2⤵
  PID:6488
- C:\Windows\System\SLaxbFZ.exe
  C:\Windows\System\SLaxbFZ.exe
  2⤵
  PID:7044
- C:\Windows\System\IOgNFpJ.exe
  C:\Windows\System\IOgNFpJ.exe
  2⤵
  PID:7176
- C:\Windows\System\nDvJhEM.exe
  C:\Windows\System\nDvJhEM.exe
  2⤵
  PID:7192
- C:\Windows\System\sWKPsnF.exe
  C:\Windows\System\sWKPsnF.exe
  2⤵
  PID:7208
- C:\Windows\System\kyhoKLR.exe
  C:\Windows\System\kyhoKLR.exe
  2⤵
  PID:7224
- C:\Windows\System\pmHGjdl.exe
  C:\Windows\System\pmHGjdl.exe
  2⤵
  PID:7240
- C:\Windows\System\qiSxDmp.exe
  C:\Windows\System\qiSxDmp.exe
  2⤵
  PID:7256
- C:\Windows\System\hKVJNJO.exe
  C:\Windows\System\hKVJNJO.exe
  2⤵
  PID:7272
- C:\Windows\System\CUXNLev.exe
  C:\Windows\System\CUXNLev.exe
  2⤵
  PID:7288
- C:\Windows\System\gFekdwT.exe
  C:\Windows\System\gFekdwT.exe
  2⤵
  PID:7304
- C:\Windows\System\dxQHiaf.exe
  C:\Windows\System\dxQHiaf.exe
  2⤵
  PID:7320
- C:\Windows\System\XLXAulO.exe
  C:\Windows\System\XLXAulO.exe
  2⤵
  PID:7336
- C:\Windows\System\uCuhkMa.exe
  C:\Windows\System\uCuhkMa.exe
  2⤵
  PID:7352
- C:\Windows\System\pYElUaG.exe
  C:\Windows\System\pYElUaG.exe
  2⤵
  PID:7368
- C:\Windows\System\olQuDRy.exe
  C:\Windows\System\olQuDRy.exe
  2⤵
  PID:7384
- C:\Windows\System\STTJxMH.exe
  C:\Windows\System\STTJxMH.exe
  2⤵
  PID:7400
- C:\Windows\System\BCwhTTL.exe
  C:\Windows\System\BCwhTTL.exe
  2⤵
  PID:7416
- C:\Windows\System\bRhUnGZ.exe
  C:\Windows\System\bRhUnGZ.exe
  2⤵
  PID:7432
- C:\Windows\System\aYxmsQA.exe
  C:\Windows\System\aYxmsQA.exe
  2⤵
  PID:7448
- C:\Windows\System\QDpzEiM.exe
  C:\Windows\System\QDpzEiM.exe
  2⤵
  PID:7464
- C:\Windows\System\VBMMtss.exe
  C:\Windows\System\VBMMtss.exe
  2⤵
  PID:7480
- C:\Windows\System\jpUKugI.exe
  C:\Windows\System\jpUKugI.exe
  2⤵
  PID:7496
- C:\Windows\System\aDozFtt.exe
  C:\Windows\System\aDozFtt.exe
  2⤵
  PID:7512
- C:\Windows\System\KJILtfq.exe
  C:\Windows\System\KJILtfq.exe
  2⤵
  PID:7528
- C:\Windows\System\yUjUfeC.exe
  C:\Windows\System\yUjUfeC.exe
  2⤵
  PID:7544
- C:\Windows\System\uSAkdWv.exe
  C:\Windows\System\uSAkdWv.exe
  2⤵
  PID:7560
- C:\Windows\System\LDNFfFi.exe
  C:\Windows\System\LDNFfFi.exe
  2⤵
  PID:7576
- C:\Windows\System\wJUHgIz.exe
  C:\Windows\System\wJUHgIz.exe
  2⤵
  PID:7592
- C:\Windows\System\hiahvPA.exe
  C:\Windows\System\hiahvPA.exe
  2⤵
  PID:7608
- C:\Windows\System\WtbqDIG.exe
  C:\Windows\System\WtbqDIG.exe
  2⤵
  PID:7624
- C:\Windows\System\hrKbarZ.exe
  C:\Windows\System\hrKbarZ.exe
  2⤵
  PID:7640
- C:\Windows\System\ceauVdq.exe
  C:\Windows\System\ceauVdq.exe
  2⤵
  PID:7656
- C:\Windows\System\JCKRdJk.exe
  C:\Windows\System\JCKRdJk.exe
  2⤵
  PID:7672
- C:\Windows\System\rhcuCiT.exe
  C:\Windows\System\rhcuCiT.exe
  2⤵
  PID:7688
- C:\Windows\System\mhqNsuC.exe
  C:\Windows\System\mhqNsuC.exe
  2⤵
  PID:7704
- C:\Windows\System\NEkkBgo.exe
  C:\Windows\System\NEkkBgo.exe
  2⤵
  PID:7720
- C:\Windows\System\EDUaonA.exe
  C:\Windows\System\EDUaonA.exe
  2⤵
  PID:7736
- C:\Windows\System\ZXhZAHX.exe
  C:\Windows\System\ZXhZAHX.exe
  2⤵
  PID:7756
- C:\Windows\System\ejwgNTv.exe
  C:\Windows\System\ejwgNTv.exe
  2⤵
  PID:7772
- C:\Windows\System\PpEvWSf.exe
  C:\Windows\System\PpEvWSf.exe
  2⤵
  PID:7788
- C:\Windows\System\GahAcXL.exe
  C:\Windows\System\GahAcXL.exe
  2⤵
  PID:7804
- C:\Windows\System\bsnxwKG.exe
  C:\Windows\System\bsnxwKG.exe
  2⤵
  PID:7820
- C:\Windows\System\ItLJWkn.exe
  C:\Windows\System\ItLJWkn.exe
  2⤵
  PID:7836
- C:\Windows\System\GxhITlt.exe
  C:\Windows\System\GxhITlt.exe
  2⤵
  PID:7852
- C:\Windows\System\yjdDmHv.exe
  C:\Windows\System\yjdDmHv.exe
  2⤵
  PID:7868
- C:\Windows\System\giAEhRH.exe
  C:\Windows\System\giAEhRH.exe
  2⤵
  PID:7884
- C:\Windows\System\wzvNoAh.exe
  C:\Windows\System\wzvNoAh.exe
  2⤵
  PID:7900
- C:\Windows\System\VFBjjWY.exe
  C:\Windows\System\VFBjjWY.exe
  2⤵
  PID:7916
- C:\Windows\System\VIISvKa.exe
  C:\Windows\System\VIISvKa.exe
  2⤵
  PID:7932
- C:\Windows\System\MbwwTuK.exe
  C:\Windows\System\MbwwTuK.exe
  2⤵
  PID:7948
- C:\Windows\System\xGqgwzs.exe
  C:\Windows\System\xGqgwzs.exe
  2⤵
  PID:7964
- C:\Windows\System\owWrWmF.exe
  C:\Windows\System\owWrWmF.exe
  2⤵
  PID:7980
- C:\Windows\System\FZRnQke.exe
  C:\Windows\System\FZRnQke.exe
  2⤵
  PID:7996
- C:\Windows\System\ViapXMe.exe
  C:\Windows\System\ViapXMe.exe
  2⤵
  PID:8012
- C:\Windows\System\WZfHhjc.exe
  C:\Windows\System\WZfHhjc.exe
  2⤵
  PID:8028
- C:\Windows\System\qDLFVLj.exe
  C:\Windows\System\qDLFVLj.exe
  2⤵
  PID:8044
- C:\Windows\System\TmqvLBD.exe
  C:\Windows\System\TmqvLBD.exe
  2⤵
  PID:8060
- C:\Windows\System\LGrWcnL.exe
  C:\Windows\System\LGrWcnL.exe
  2⤵
  PID:8076
- C:\Windows\System\mJuDYqn.exe
  C:\Windows\System\mJuDYqn.exe
  2⤵
  PID:8092
- C:\Windows\System\cKYGkxu.exe
  C:\Windows\System\cKYGkxu.exe
  2⤵
  PID:8108
- C:\Windows\System\UrKUFON.exe
  C:\Windows\System\UrKUFON.exe
  2⤵
  PID:8124
- C:\Windows\System\NslEKAo.exe
  C:\Windows\System\NslEKAo.exe
  2⤵
  PID:8140
- C:\Windows\System\XvIOzOO.exe
  C:\Windows\System\XvIOzOO.exe
  2⤵
  PID:8156
- C:\Windows\System\YWEAnZP.exe
  C:\Windows\System\YWEAnZP.exe
  2⤵
  PID:8172
- C:\Windows\System\agsVjLc.exe
  C:\Windows\System\agsVjLc.exe
  2⤵
  PID:8188
- C:\Windows\System\SOdYmxB.exe
  C:\Windows\System\SOdYmxB.exe
  2⤵
  PID:6580
- C:\Windows\System\rvgYkwG.exe
  C:\Windows\System\rvgYkwG.exe
  2⤵
  PID:6260
- C:\Windows\System\SBxcBgk.exe
  C:\Windows\System\SBxcBgk.exe
  2⤵
  PID:7172
- C:\Windows\System\JLJXhYg.exe
  C:\Windows\System\JLJXhYg.exe
  2⤵
  PID:7268
- C:\Windows\System\kcLOMcQ.exe
  C:\Windows\System\kcLOMcQ.exe
  2⤵
  PID:7332
- C:\Windows\System\KkXkyts.exe
  C:\Windows\System\KkXkyts.exe
  2⤵
  PID:7364
- C:\Windows\System\lnEODqU.exe
  C:\Windows\System\lnEODqU.exe
  2⤵
  PID:7428
- C:\Windows\System\VCBwGYe.exe
  C:\Windows\System\VCBwGYe.exe
  2⤵
  PID:7492
- C:\Windows\System\BfZaWrs.exe
  C:\Windows\System\BfZaWrs.exe
  2⤵
  PID:6952
- C:\Windows\System\OsNSqqc.exe
  C:\Windows\System\OsNSqqc.exe
  2⤵
  PID:7552
- C:\Windows\System\grcTPmP.exe
  C:\Windows\System\grcTPmP.exe
  2⤵
  PID:7616
- C:\Windows\System\oIvEhSS.exe
  C:\Windows\System\oIvEhSS.exe
  2⤵
  PID:7440
- C:\Windows\System\yNSDghl.exe
  C:\Windows\System\yNSDghl.exe
  2⤵
  PID:6484
- C:\Windows\System\MKnfMPs.exe
  C:\Windows\System\MKnfMPs.exe
  2⤵
  PID:7216
- C:\Windows\System\BjUxqou.exe
  C:\Windows\System\BjUxqou.exe
  2⤵
  PID:7652
- C:\Windows\System\gulTBgw.exe
  C:\Windows\System\gulTBgw.exe
  2⤵
  PID:7712
- C:\Windows\System\FYueuiw.exe
  C:\Windows\System\FYueuiw.exe
  2⤵
  PID:7780
- C:\Windows\System\wvwYLNu.exe
  C:\Windows\System\wvwYLNu.exe
  2⤵
  PID:7316
- C:\Windows\System\hSNrbri.exe
  C:\Windows\System\hSNrbri.exe
  2⤵
  PID:7408
- C:\Windows\System\FjCLRmN.exe
  C:\Windows\System\FjCLRmN.exe
  2⤵
  PID:7504
- C:\Windows\System\UjiWswQ.exe
  C:\Windows\System\UjiWswQ.exe
  2⤵
  PID:7540
- C:\Windows\System\RitmDgM.exe
  C:\Windows\System\RitmDgM.exe
  2⤵
  PID:7812
- C:\Windows\System\AJtTmXM.exe
  C:\Windows\System\AJtTmXM.exe
  2⤵
  PID:7876
- C:\Windows\System\dGGuOSk.exe
  C:\Windows\System\dGGuOSk.exe
  2⤵
  PID:7940
- C:\Windows\System\WLaVcYl.exe
  C:\Windows\System\WLaVcYl.exe
  2⤵
  PID:8004
- C:\Windows\System\whyRfhW.exe
  C:\Windows\System\whyRfhW.exe
  2⤵
  PID:8068
- C:\Windows\System\qeeqFHT.exe
  C:\Windows\System\qeeqFHT.exe
  2⤵
  PID:8132
- C:\Windows\System\rWnZybW.exe
  C:\Windows\System\rWnZybW.exe
  2⤵
  PID:5160
- C:\Windows\System\sxCsTzO.exe
  C:\Windows\System\sxCsTzO.exe
  2⤵
  PID:7300
- C:\Windows\System\YIgqEsE.exe
  C:\Windows\System\YIgqEsE.exe
  2⤵
  PID:6900
- C:\Windows\System\sWqanKe.exe
  C:\Windows\System\sWqanKe.exe
  2⤵
  PID:6968
- C:\Windows\System\OndjaTp.exe
  C:\Windows\System\OndjaTp.exe
  2⤵
  PID:7572
- C:\Windows\System\rzkVlpi.exe
  C:\Windows\System\rzkVlpi.exe
  2⤵
  PID:7636
- C:\Windows\System\MJwzxYL.exe
  C:\Windows\System\MJwzxYL.exe
  2⤵
  PID:7768
- C:\Windows\System\tVuelTz.exe
  C:\Windows\System\tVuelTz.exe
  2⤵
  PID:7664
- C:\Windows\System\ILvKnlt.exe
  C:\Windows\System\ILvKnlt.exe
  2⤵
  PID:7800
- C:\Windows\System\PrQreKz.exe
  C:\Windows\System\PrQreKz.exe
  2⤵
  PID:7832
- C:\Windows\System\kXrpfIK.exe
  C:\Windows\System\kXrpfIK.exe
  2⤵
  PID:7860
- C:\Windows\System\seNfqUn.exe
  C:\Windows\System\seNfqUn.exe
  2⤵
  PID:7892
- C:\Windows\System\Oxljflu.exe
  C:\Windows\System\Oxljflu.exe
  2⤵
  PID:7928
- C:\Windows\System\UGbujJo.exe
  C:\Windows\System\UGbujJo.exe
  2⤵
  PID:8024
- C:\Windows\System\wLIJXVx.exe
  C:\Windows\System\wLIJXVx.exe
  2⤵
  PID:8088
- C:\Windows\System\rlLyeLv.exe
  C:\Windows\System\rlLyeLv.exe
  2⤵
  PID:8148
- C:\Windows\System\lmvWZza.exe
  C:\Windows\System\lmvWZza.exe
  2⤵
  PID:6744
- C:\Windows\System\KIaafqZ.exe
  C:\Windows\System\KIaafqZ.exe
  2⤵
  PID:7360
- C:\Windows\System\cBLQnjF.exe
  C:\Windows\System\cBLQnjF.exe
  2⤵
  PID:6664
- C:\Windows\System\OsxwoTP.exe
  C:\Windows\System\OsxwoTP.exe
  2⤵
  PID:7684
- C:\Windows\System\IfKSdrF.exe
  C:\Windows\System\IfKSdrF.exe
  2⤵
  PID:7700
- C:\Windows\System\ZRQGSuU.exe
  C:\Windows\System\ZRQGSuU.exe
  2⤵
  PID:7908
- C:\Windows\System\gmWFRZU.exe
  C:\Windows\System\gmWFRZU.exe
  2⤵
  PID:8036
- C:\Windows\System\cJIrIqj.exe
  C:\Windows\System\cJIrIqj.exe
  2⤵
  PID:8168
- C:\Windows\System\wKjnIqD.exe
  C:\Windows\System\wKjnIqD.exe
  2⤵
  PID:7424
- C:\Windows\System\xHECREn.exe
  C:\Windows\System\xHECREn.exe
  2⤵
  PID:7252
- C:\Windows\System\EhiPbMi.exe
  C:\Windows\System\EhiPbMi.exe
  2⤵
  PID:8020
- C:\Windows\System\dXeopdj.exe
  C:\Windows\System\dXeopdj.exe
  2⤵
  PID:7896
- C:\Windows\System\AWjxsfw.exe
  C:\Windows\System\AWjxsfw.exe
  2⤵
  PID:7924
- C:\Windows\System\wqyNQej.exe
  C:\Windows\System\wqyNQej.exe
  2⤵
  PID:7380
- C:\Windows\System\qeXczpg.exe
  C:\Windows\System\qeXczpg.exe
  2⤵
  PID:8116
- C:\Windows\System\WbbkyYE.exe
  C:\Windows\System\WbbkyYE.exe
  2⤵
  PID:7264
- C:\Windows\System\bfkIOUi.exe
  C:\Windows\System\bfkIOUi.exe
  2⤵
  PID:7620
- C:\Windows\System\gdJZoZX.exe
  C:\Windows\System\gdJZoZX.exe
  2⤵
  PID:6248
- C:\Windows\System\KTWfnML.exe
  C:\Windows\System\KTWfnML.exe
  2⤵
  PID:7444
- C:\Windows\System\sVjJVOY.exe
  C:\Windows\System\sVjJVOY.exe
  2⤵
  PID:8180
- C:\Windows\System\bQLupmT.exe
  C:\Windows\System\bQLupmT.exe
  2⤵
  PID:8104
- C:\Windows\System\NBojNvM.exe
  C:\Windows\System\NBojNvM.exe
  2⤵
  PID:7796
- C:\Windows\System\OQstHtd.exe
  C:\Windows\System\OQstHtd.exe
  2⤵
  PID:8084
- C:\Windows\System\DAtaLKr.exe
  C:\Windows\System\DAtaLKr.exe
  2⤵
  PID:7188
- C:\Windows\System\ZenQwJR.exe
  C:\Windows\System\ZenQwJR.exe
  2⤵
  PID:7588
- C:\Windows\System\avhoNro.exe
  C:\Windows\System\avhoNro.exe
  2⤵
  PID:7976
- C:\Windows\System\yKBNMVf.exe
  C:\Windows\System\yKBNMVf.exe
  2⤵
  PID:7604
- C:\Windows\System\sJjWxSf.exe
  C:\Windows\System\sJjWxSf.exe
  2⤵
  PID:7488
- C:\Windows\System\TzdzsRE.exe
  C:\Windows\System\TzdzsRE.exe
  2⤵
  PID:8204
- C:\Windows\System\XhJhirL.exe
  C:\Windows\System\XhJhirL.exe
  2⤵
  PID:8220
- C:\Windows\System\cFtLfzu.exe
  C:\Windows\System\cFtLfzu.exe
  2⤵
  PID:8236
- C:\Windows\System\FfWQHda.exe
  C:\Windows\System\FfWQHda.exe
  2⤵
  PID:8252
- C:\Windows\System\RsabmIz.exe
  C:\Windows\System\RsabmIz.exe
  2⤵
  PID:8268
- C:\Windows\System\AzuZoIC.exe
  C:\Windows\System\AzuZoIC.exe
  2⤵
  PID:8284
- C:\Windows\System\cXrAwrQ.exe
  C:\Windows\System\cXrAwrQ.exe
  2⤵
  PID:8300
- C:\Windows\System\NNAHytp.exe
  C:\Windows\System\NNAHytp.exe
  2⤵
  PID:8316
- C:\Windows\System\YBvtwTt.exe
  C:\Windows\System\YBvtwTt.exe
  2⤵
  PID:8332
- C:\Windows\System\AARQrRm.exe
  C:\Windows\System\AARQrRm.exe
  2⤵
  PID:8348
- C:\Windows\System\MHCESFV.exe
  C:\Windows\System\MHCESFV.exe
  2⤵
  PID:8364
- C:\Windows\System\zNdssWD.exe
  C:\Windows\System\zNdssWD.exe
  2⤵
  PID:8380
- C:\Windows\System\rigIZcc.exe
  C:\Windows\System\rigIZcc.exe
  2⤵
  PID:8396
- C:\Windows\System\QaQQWsm.exe
  C:\Windows\System\QaQQWsm.exe
  2⤵
  PID:8412
- C:\Windows\System\VzKaXgu.exe
  C:\Windows\System\VzKaXgu.exe
  2⤵
  PID:8428
- C:\Windows\System\EipJpwQ.exe
  C:\Windows\System\EipJpwQ.exe
  2⤵
  PID:8444
- C:\Windows\System\AfNJyaB.exe
  C:\Windows\System\AfNJyaB.exe
  2⤵
  PID:8460
- C:\Windows\System\XcFeVXq.exe
  C:\Windows\System\XcFeVXq.exe
  2⤵
  PID:8476
- C:\Windows\System\oAfUmIY.exe
  C:\Windows\System\oAfUmIY.exe
  2⤵
  PID:8496
- C:\Windows\System\IGyXcIS.exe
  C:\Windows\System\IGyXcIS.exe
  2⤵
  PID:8512
- C:\Windows\System\rviwRTW.exe
  C:\Windows\System\rviwRTW.exe
  2⤵
  PID:8528
- C:\Windows\System\BkxsPVX.exe
  C:\Windows\System\BkxsPVX.exe
  2⤵
  PID:8668
- C:\Windows\System\PUbhlPL.exe
  C:\Windows\System\PUbhlPL.exe
  2⤵
  PID:8704
- C:\Windows\System\rwxEsnn.exe
  C:\Windows\System\rwxEsnn.exe
  2⤵
  PID:8916
- C:\Windows\System\OnMGNbR.exe
  C:\Windows\System\OnMGNbR.exe
  2⤵
  PID:8948
- C:\Windows\System\rUttrqh.exe
  C:\Windows\System\rUttrqh.exe
  2⤵
  PID:8964
- C:\Windows\System\DDKvaiw.exe
  C:\Windows\System\DDKvaiw.exe
  2⤵
  PID:8980
- C:\Windows\System\ICMcjYZ.exe
  C:\Windows\System\ICMcjYZ.exe
  2⤵
  PID:8996
- C:\Windows\System\jdhFqhm.exe
  C:\Windows\System\jdhFqhm.exe
  2⤵
  PID:9012
- C:\Windows\System\LlSeLhn.exe
  C:\Windows\System\LlSeLhn.exe
  2⤵
  PID:9028
- C:\Windows\System\ZKviwvh.exe
  C:\Windows\System\ZKviwvh.exe
  2⤵
  PID:9044
- C:\Windows\System\ABxiSnl.exe
  C:\Windows\System\ABxiSnl.exe
  2⤵
  PID:9060
- C:\Windows\System\jsHGbwg.exe
  C:\Windows\System\jsHGbwg.exe
  2⤵
  PID:9080
- C:\Windows\System\mfTPHKF.exe
  C:\Windows\System\mfTPHKF.exe
  2⤵
  PID:9096
- C:\Windows\System\OHgvfdX.exe
  C:\Windows\System\OHgvfdX.exe
  2⤵
  PID:9112
- C:\Windows\System\MwOsvbE.exe
  C:\Windows\System\MwOsvbE.exe
  2⤵
  PID:9136
- C:\Windows\System\fLdnETm.exe
  C:\Windows\System\fLdnETm.exe
  2⤵
  PID:9152
- C:\Windows\System\xTAXxiQ.exe
  C:\Windows\System\xTAXxiQ.exe
  2⤵
  PID:9168
- C:\Windows\System\NKDArXD.exe
  C:\Windows\System\NKDArXD.exe
  2⤵
  PID:9188
- C:\Windows\System\FYcslXI.exe
  C:\Windows\System\FYcslXI.exe
  2⤵
  PID:9204
- C:\Windows\System\UGNbaCP.exe
  C:\Windows\System\UGNbaCP.exe
  2⤵
  PID:7348
- C:\Windows\System\NSpQqTN.exe
  C:\Windows\System\NSpQqTN.exe
  2⤵
  PID:8196
- C:\Windows\System\pjOgqnq.exe
  C:\Windows\System\pjOgqnq.exe
  2⤵
  PID:8244
- C:\Windows\System\zmXVsTX.exe
  C:\Windows\System\zmXVsTX.exe
  2⤵
  PID:8264
- C:\Windows\System\ZEYWkoG.exe
  C:\Windows\System\ZEYWkoG.exe
  2⤵
  PID:8296
- C:\Windows\System\MZpZHMl.exe
  C:\Windows\System\MZpZHMl.exe
  2⤵
  PID:8372
- C:\Windows\System\WxCPCIL.exe
  C:\Windows\System\WxCPCIL.exe
  2⤵
  PID:8436
- C:\Windows\System\aiAtdXJ.exe
  C:\Windows\System\aiAtdXJ.exe
  2⤵
  PID:8328
- C:\Windows\System\ZpNMrPZ.exe
  C:\Windows\System\ZpNMrPZ.exe
  2⤵
  PID:8424
- C:\Windows\System\FLGceXi.exe
  C:\Windows\System\FLGceXi.exe
  2⤵
  PID:8468
- C:\Windows\System\lQXQjBG.exe
  C:\Windows\System\lQXQjBG.exe
  2⤵
  PID:8484
- C:\Windows\System\YnLnTSB.exe
  C:\Windows\System\YnLnTSB.exe
  2⤵
  PID:8520
- C:\Windows\System\ctJCXaE.exe
  C:\Windows\System\ctJCXaE.exe
  2⤵
  PID:8540
- C:\Windows\System\hEpoCJy.exe
  C:\Windows\System\hEpoCJy.exe
  2⤵
  PID:8616
- C:\Windows\System\dPyhQcz.exe
  C:\Windows\System\dPyhQcz.exe
  2⤵
  PID:8652
- C:\Windows\System\mBaMOjp.exe
  C:\Windows\System\mBaMOjp.exe
  2⤵
  PID:8556
- C:\Windows\System\fQbTaWB.exe
  C:\Windows\System\fQbTaWB.exe
  2⤵
  PID:8572
- C:\Windows\System\TMPbCfy.exe
  C:\Windows\System\TMPbCfy.exe
  2⤵
  PID:8592
- C:\Windows\System\XbDJKIh.exe
  C:\Windows\System\XbDJKIh.exe
  2⤵
  PID:8628
- C:\Windows\System\wHTQQRw.exe
  C:\Windows\System\wHTQQRw.exe
  2⤵
  PID:8660
- C:\Windows\System\WDVMbFn.exe
  C:\Windows\System\WDVMbFn.exe
  2⤵
  PID:8688
- C:\Windows\System\REvdTRl.exe
  C:\Windows\System\REvdTRl.exe
  2⤵
  PID:8716
- C:\Windows\System\SMbmMza.exe
  C:\Windows\System\SMbmMza.exe
  2⤵
  PID:8724
- C:\Windows\System\losMvCP.exe
  C:\Windows\System\losMvCP.exe
  2⤵
  PID:8748
- C:\Windows\System\mkxLoru.exe
  C:\Windows\System\mkxLoru.exe
  2⤵
  PID:8764
- C:\Windows\System\xaShrFS.exe
  C:\Windows\System\xaShrFS.exe
  2⤵
  PID:8784
- C:\Windows\System\lscqfDl.exe
  C:\Windows\System\lscqfDl.exe
  2⤵
  PID:8840
- C:\Windows\System\uelUlCx.exe
  C:\Windows\System\uelUlCx.exe
  2⤵
  PID:8860
- C:\Windows\System\LOFDHKq.exe
  C:\Windows\System\LOFDHKq.exe
  2⤵
  PID:8884
- C:\Windows\System\hchtESA.exe
  C:\Windows\System\hchtESA.exe
  2⤵
  PID:8904
- C:\Windows\System\VsIuxUI.exe
  C:\Windows\System\VsIuxUI.exe
  2⤵
  PID:8956
- C:\Windows\System\bYbAvwb.exe
  C:\Windows\System\bYbAvwb.exe
  2⤵
  PID:8992
- C:\Windows\System\QwbAqTE.exe
  C:\Windows\System\QwbAqTE.exe
  2⤵
  PID:9020
- C:\Windows\System\KTVbbRb.exe
  C:\Windows\System\KTVbbRb.exe
  2⤵
  PID:9052
- C:\Windows\System\HdPWKdK.exe
  C:\Windows\System\HdPWKdK.exe
  2⤵
  PID:9040
- C:\Windows\System\IzDOkGD.exe
  C:\Windows\System\IzDOkGD.exe
  2⤵
  PID:9004
- C:\Windows\System\rvgMNBL.exe
  C:\Windows\System\rvgMNBL.exe
  2⤵
  PID:9120
- C:\Windows\System\hQopcfU.exe
  C:\Windows\System\hQopcfU.exe
  2⤵
  PID:9160
- C:\Windows\System\ZxaiGbf.exe
  C:\Windows\System\ZxaiGbf.exe
  2⤵
  PID:9196
- C:\Windows\System\jhBKjUg.exe
  C:\Windows\System\jhBKjUg.exe
  2⤵
  PID:9180
- C:\Windows\System\vEyMYdx.exe
  C:\Windows\System\vEyMYdx.exe
  2⤵
  PID:6100
- C:\Windows\System\swhMINT.exe
  C:\Windows\System\swhMINT.exe
  2⤵
  PID:8340
- C:\Windows\System\ByzBava.exe
  C:\Windows\System\ByzBava.exe
  2⤵
  PID:9148
- C:\Windows\System\KueEyug.exe
  C:\Windows\System\KueEyug.exe
  2⤵
  PID:8292
- C:\Windows\System\RaxmUzu.exe
  C:\Windows\System\RaxmUzu.exe
  2⤵
  PID:8536
- C:\Windows\System\nLivDfh.exe
  C:\Windows\System\nLivDfh.exe
  2⤵
  PID:8392
- C:\Windows\System\KrYKgoA.exe
  C:\Windows\System\KrYKgoA.exe
  2⤵
  PID:8612
- C:\Windows\System\wIXJewu.exe
  C:\Windows\System\wIXJewu.exe
  2⤵
  PID:8580
- C:\Windows\System\vKFBGgx.exe
  C:\Windows\System\vKFBGgx.exe
  2⤵
  PID:8492
- C:\Windows\System\EBTlLAu.exe
  C:\Windows\System\EBTlLAu.exe
  2⤵
  PID:8684
- C:\Windows\System\lfbnfwG.exe
  C:\Windows\System\lfbnfwG.exe
  2⤵
  PID:8732
- C:\Windows\System\neobTqO.exe
  C:\Windows\System\neobTqO.exe
  2⤵
  PID:8776
- C:\Windows\System\AUjmddp.exe
  C:\Windows\System\AUjmddp.exe
  2⤵
  PID:8852
- C:\Windows\System\qpAFUDN.exe
  C:\Windows\System\qpAFUDN.exe
  2⤵
  PID:8564
- C:\Windows\System\EuBXnsS.exe
  C:\Windows\System\EuBXnsS.exe
  2⤵
  PID:8892
- C:\Windows\System\CiYnDVU.exe
  C:\Windows\System\CiYnDVU.exe
  2⤵
  PID:8988
- C:\Windows\System\QPveShB.exe
  C:\Windows\System\QPveShB.exe
  2⤵
  PID:8680
- C:\Windows\System\UgBtqtC.exe
  C:\Windows\System\UgBtqtC.exe
  2⤵
  PID:8756
- C:\Windows\System\KgbQQZH.exe
  C:\Windows\System\KgbQQZH.exe
  2⤵
  PID:9072
- C:\Windows\System\xXVEuIA.exe
  C:\Windows\System\xXVEuIA.exe
  2⤵
  PID:9200
- C:\Windows\System\XpdjDyv.exe
  C:\Windows\System\XpdjDyv.exe
  2⤵
  PID:8924
- C:\Windows\System\fFxXAiZ.exe
  C:\Windows\System\fFxXAiZ.exe
  2⤵
  PID:9212
- C:\Windows\System\JShEVBk.exe
  C:\Windows\System\JShEVBk.exe
  2⤵
  PID:8832
- C:\Windows\System\bSrDuKy.exe
  C:\Windows\System\bSrDuKy.exe
  2⤵
  PID:8548
- C:\Windows\System\nRZVxrU.exe
  C:\Windows\System\nRZVxrU.exe
  2⤵
  PID:8744
- C:\Windows\System\yOwohee.exe
  C:\Windows\System\yOwohee.exe
  2⤵
  PID:8976
- C:\Windows\System\xWgqYpV.exe
  C:\Windows\System\xWgqYpV.exe
  2⤵
  PID:9104
- C:\Windows\System\iasjDKv.exe
  C:\Windows\System\iasjDKv.exe
  2⤵
  PID:8588
- C:\Windows\System\UUQfAtO.exe
  C:\Windows\System\UUQfAtO.exe
  2⤵
  PID:8404
- C:\Windows\System\VJNLyXP.exe
  C:\Windows\System\VJNLyXP.exe
  2⤵
  PID:8812
- C:\Windows\System\woUfjpc.exe
  C:\Windows\System\woUfjpc.exe
  2⤵
  PID:8880
- C:\Windows\System\yugOVVQ.exe
  C:\Windows\System\yugOVVQ.exe
  2⤵
  PID:8228
- C:\Windows\System\VAFnBMF.exe
  C:\Windows\System\VAFnBMF.exe
  2⤵
  PID:8848
- C:\Windows\System\VDWACVU.exe
  C:\Windows\System\VDWACVU.exe
  2⤵
  PID:8824
- C:\Windows\System\loHbmvZ.exe
  C:\Windows\System\loHbmvZ.exe
  2⤵
  PID:8664
- C:\Windows\System\mfgqVgR.exe
  C:\Windows\System\mfgqVgR.exe
  2⤵
  PID:9076
- C:\Windows\System\zlKLVbM.exe
  C:\Windows\System\zlKLVbM.exe
  2⤵
  PID:8524
- C:\Windows\System\ZxkbIVz.exe
  C:\Windows\System\ZxkbIVz.exe
  2⤵
  PID:8568
- C:\Windows\System\FOnjQiS.exe
  C:\Windows\System\FOnjQiS.exe
  2⤵
  PID:8260
- C:\Windows\System\WMfWQPA.exe
  C:\Windows\System\WMfWQPA.exe
  2⤵
  PID:9132
- C:\Windows\System\UDxYYMa.exe
  C:\Windows\System\UDxYYMa.exe
  2⤵
  PID:9236
- C:\Windows\System\aXsDVQj.exe
  C:\Windows\System\aXsDVQj.exe
  2⤵
  PID:9260
- C:\Windows\System\mDhcFQi.exe
  C:\Windows\System\mDhcFQi.exe
  2⤵
  PID:9276
- C:\Windows\System\qtZITXd.exe
  C:\Windows\System\qtZITXd.exe
  2⤵
  PID:9300
- C:\Windows\System\alSvahX.exe
  C:\Windows\System\alSvahX.exe
  2⤵
  PID:9320
- C:\Windows\System\qDshsDX.exe
  C:\Windows\System\qDshsDX.exe
  2⤵
  PID:9336
- C:\Windows\System\GVPEqOj.exe
  C:\Windows\System\GVPEqOj.exe
  2⤵
  PID:9360
- C:\Windows\System\MCVVFug.exe
  C:\Windows\System\MCVVFug.exe
  2⤵
  PID:9380
- C:\Windows\System\RZvgirK.exe
  C:\Windows\System\RZvgirK.exe
  2⤵
  PID:9400
- C:\Windows\System\HTcVHRs.exe
  C:\Windows\System\HTcVHRs.exe
  2⤵
  PID:9420
- C:\Windows\System\IkvxIHZ.exe
  C:\Windows\System\IkvxIHZ.exe
  2⤵
  PID:9436
- C:\Windows\System\DMWeZcW.exe
  C:\Windows\System\DMWeZcW.exe
  2⤵
  PID:9452
- C:\Windows\System\ohPXRvV.exe
  C:\Windows\System\ohPXRvV.exe
  2⤵
  PID:9468
- C:\Windows\System\kKMIMYT.exe
  C:\Windows\System\kKMIMYT.exe
  2⤵
  PID:9484
- C:\Windows\System\NdCZMjP.exe
  C:\Windows\System\NdCZMjP.exe
  2⤵
  PID:9500
- C:\Windows\System\EstAwEd.exe
  C:\Windows\System\EstAwEd.exe
  2⤵
  PID:9520
- C:\Windows\System\vKzkmUX.exe
  C:\Windows\System\vKzkmUX.exe
  2⤵
  PID:9544
- C:\Windows\System\pBuCUOj.exe
  C:\Windows\System\pBuCUOj.exe
  2⤵
  PID:9568
- C:\Windows\System\rBvgRwP.exe
  C:\Windows\System\rBvgRwP.exe
  2⤵
  PID:9584
- C:\Windows\System\mJuYtHz.exe
  C:\Windows\System\mJuYtHz.exe
  2⤵
  PID:9608
- C:\Windows\System\ZGQWRmL.exe
  C:\Windows\System\ZGQWRmL.exe
  2⤵
  PID:9640
- C:\Windows\System\NjoEPar.exe
  C:\Windows\System\NjoEPar.exe
  2⤵
  PID:9660
- C:\Windows\System\OGOniGz.exe
  C:\Windows\System\OGOniGz.exe
  2⤵
  PID:9676
- C:\Windows\System\zuXJhDe.exe
  C:\Windows\System\zuXJhDe.exe
  2⤵
  PID:9692
- C:\Windows\System\BgADtRQ.exe
  C:\Windows\System\BgADtRQ.exe
  2⤵
  PID:9720
- C:\Windows\System\VHWORkj.exe
  C:\Windows\System\VHWORkj.exe
  2⤵
  PID:9736
- C:\Windows\System\BUvFBGe.exe
  C:\Windows\System\BUvFBGe.exe
  2⤵
  PID:9752
- C:\Windows\System\hCEddhu.exe
  C:\Windows\System\hCEddhu.exe
  2⤵
  PID:9904
- C:\Windows\System\Srbiceo.exe
  C:\Windows\System\Srbiceo.exe
  2⤵
  PID:9928
- C:\Windows\System\bJugcZE.exe
  C:\Windows\System\bJugcZE.exe
  2⤵
  PID:9948
- C:\Windows\System\hfdCheB.exe
  C:\Windows\System\hfdCheB.exe
  2⤵
  PID:9984
- C:\Windows\System\XBgkAUF.exe
  C:\Windows\System\XBgkAUF.exe
  2⤵
  PID:10024
- C:\Windows\System\rGrdKbT.exe
  C:\Windows\System\rGrdKbT.exe
  2⤵
  PID:10124
- C:\Windows\System\BhOhyAD.exe
  C:\Windows\System\BhOhyAD.exe
  2⤵
  PID:10152
- C:\Windows\System\ZsWdYBS.exe
  C:\Windows\System\ZsWdYBS.exe
  2⤵
  PID:10172
- C:\Windows\System\vCxKJOK.exe
  C:\Windows\System\vCxKJOK.exe
  2⤵
  PID:10192
- C:\Windows\System\SxrHMVN.exe
  C:\Windows\System\SxrHMVN.exe
  2⤵
  PID:10212
- C:\Windows\System\misqKlQ.exe
  C:\Windows\System\misqKlQ.exe
  2⤵
  PID:9344
- C:\Windows\System\OpbBkmT.exe
  C:\Windows\System\OpbBkmT.exe
  2⤵
  PID:8692
- C:\Windows\System\GsCTvSY.exe
  C:\Windows\System\GsCTvSY.exe
  2⤵
  PID:9788
- C:\Windows\System\tafLnbh.exe
  C:\Windows\System\tafLnbh.exe
  2⤵
  PID:9448
- C:\Windows\System\eJPQTVd.exe
  C:\Windows\System\eJPQTVd.exe
  2⤵
  PID:9480
- C:\Windows\System\cgkkoYY.exe
  C:\Windows\System\cgkkoYY.exe
  2⤵
  PID:8796
- C:\Windows\System\aiibjcf.exe
  C:\Windows\System\aiibjcf.exe
  2⤵
  PID:9600
- C:\Windows\System\spVGzlN.exe
  C:\Windows\System\spVGzlN.exe
  2⤵
  PID:9648
- C:\Windows\System\PXhZSaC.exe
  C:\Windows\System\PXhZSaC.exe
  2⤵
  PID:9684
- C:\Windows\System\xvUFaxl.exe
  C:\Windows\System\xvUFaxl.exe
  2⤵
  PID:9688
- C:\Windows\System\XaNAjhc.exe
  C:\Windows\System\XaNAjhc.exe
  2⤵
  PID:9716
- C:\Windows\System\jbKfimR.exe
  C:\Windows\System\jbKfimR.exe
  2⤵
  PID:9784
- C:\Windows\System\TbjomOu.exe
  C:\Windows\System\TbjomOu.exe
  2⤵
  PID:9812
- C:\Windows\System\anCTVCY.exe
  C:\Windows\System\anCTVCY.exe
  2⤵
  PID:9832
- C:\Windows\System\SpNdXya.exe
  C:\Windows\System\SpNdXya.exe
  2⤵
  PID:9776
- C:\Windows\System\OxwmwSz.exe
  C:\Windows\System\OxwmwSz.exe
  2⤵
  PID:9848
- C:\Windows\System\kHNsQWf.exe
  C:\Windows\System\kHNsQWf.exe
  2⤵
  PID:9876
- C:\Windows\System\afHRTPb.exe
  C:\Windows\System\afHRTPb.exe
  2⤵
  PID:9892
- C:\Windows\System\ozMgmHB.exe
  C:\Windows\System\ozMgmHB.exe
  2⤵
  PID:10184
- C:\Windows\System\jClHonQ.exe
  C:\Windows\System\jClHonQ.exe
  2⤵
  PID:1556
- C:\Windows\System\yyUxpFu.exe
  C:\Windows\System\yyUxpFu.exe
  2⤵
  PID:9540
- C:\Windows\System\AuiAeqB.exe
  C:\Windows\System\AuiAeqB.exe
  2⤵
  PID:9824
- C:\Windows\System\tOKWupw.exe
  C:\Windows\System\tOKWupw.exe
  2⤵
  PID:9888
- C:\Windows\System\trRCeAQ.exe
  C:\Windows\System\trRCeAQ.exe
  2⤵
  PID:9900
- C:\Windows\System\uHVbKkR.exe
  C:\Windows\System\uHVbKkR.exe
  2⤵
  PID:9916
- C:\Windows\System\URRbzFV.exe
  C:\Windows\System\URRbzFV.exe
  2⤵
  PID:9968
- C:\Windows\System\EckLTLk.exe
  C:\Windows\System\EckLTLk.exe
  2⤵
  PID:9960
- C:\Windows\System\JGPDpoS.exe
  C:\Windows\System\JGPDpoS.exe
  2⤵
  PID:10012
- C:\Windows\System\wlWQSSP.exe
  C:\Windows\System\wlWQSSP.exe
  2⤵
  PID:10032
- C:\Windows\System\rxWxZbU.exe
  C:\Windows\System\rxWxZbU.exe
  2⤵
  PID:10064
- C:\Windows\System\XeRnxWt.exe
  C:\Windows\System\XeRnxWt.exe
  2⤵
  PID:10080
- C:\Windows\System\YFiBxxX.exe
  C:\Windows\System\YFiBxxX.exe
  2⤵
  PID:10096
- C:\Windows\System\BnkfqFS.exe
  C:\Windows\System\BnkfqFS.exe
  2⤵
  PID:10220
- C:\Windows\System\imwvCzX.exe
  C:\Windows\System\imwvCzX.exe
  2⤵
  PID:10104
- C:\Windows\System\hVkgMJr.exe
  C:\Windows\System\hVkgMJr.exe
  2⤵
  PID:10164
- C:\Windows\System\UJypqkO.exe
  C:\Windows\System\UJypqkO.exe
  2⤵
  PID:8604
- C:\Windows\System\RDLKpSh.exe
  C:\Windows\System\RDLKpSh.exe
  2⤵
  PID:9252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\APHVrsg.exe

Filesize
2.0MB

MD5
9a0d4cfc83d61a630366e660ee0170e7

SHA1
14d48b49ff8b87566073a8f0b4a98ad5a9bd701f

SHA256
e70757001c39528858986bb4a3aae332f01f9eff8098ed1ce6ee44f31b471eac

SHA512
6d85ebe34b89d3b37a22467bd24eaafcb3920fc4d1f98027f55554c7002638d08054c101ba3b4f92d272e722fce98ada587d143aebbbb983f49d4ff75ec5253a

Download Submit
C:\Windows\system\AUhEtka.exe

Filesize
1.9MB

MD5
da394b3961a7d27dfbbea9e4bfeaf22e

SHA1
1fc375e9f43477f500f899de09bebb20d2511122

SHA256
5f0a5054b877431c0108069518c35ac11a2176e9836802e9489f6e24bf958d4d

SHA512
bd3463068ab0a3bb2da5da64784315e7be0cc734794c067fa04cd9988b4e87a938170189c95222f8d1bf839e0657fc339a8f69d7576fbdb4d53d55cc1ed4e52e

Download Submit
C:\Windows\system\CJVJrcO.exe

Filesize
1.9MB

MD5
133a0ffd13d7dbb6d2e47a09ea0de20a

SHA1
360ca628e1cc44ad7ffa1e9617e4a755f8226548

SHA256
4805ce28f892ac067044115d2e24ae68ce97149f7f71397cecfb14c50ed0313d

SHA512
e53fdb2e66ae24f3b39157eae8e1df82aa5545c82039362c0029c02dbebc546387f0aa5239e4a1279501e516c5f49b38bd325ff12d8f5907f91c0e9f4a941ada

Download Submit
C:\Windows\system\DNURNjG.exe

Filesize
1.9MB

MD5
b5e824ca38d4b6fca535a8d6e426c2ef

SHA1
8f1cbd39e81d11e5955e9ae17f5fdf070ee68b71

SHA256
8b08d192962179fab9a0b9d9a8bf1fc9e03254f8f6f25bfb598a763b6e1cde43

SHA512
c5dd570d6a1047db5d19bca4af4abfb2bdf3bf75798d2d5bb6781b997cdd6ad9a0cc886073b688218328ec5e1873301b84c07a66fc63296366cbd33f5086fc9d

Download Submit
C:\Windows\system\GHqHwOq.exe

Filesize
1.9MB

MD5
3c7ccecd9a3a39e8978ab5778fd8dc1f

SHA1
1f90fae5c9b98748e2820e7f6c10fe5dec42a66a

SHA256
300e7fcafa0d4e5c39985286e3304e5e24f96ee36f49ae993cb8c4bb5def5f90

SHA512
0e5830d42fd67c6698f12e73be28b31d046584d3d106442ce3886f372fa6b04739a635a7da1f253338081415d7b12f0742dad6f8a2c9b3f764b004ce1581b490

Download Submit
C:\Windows\system\HemMXVv.exe

Filesize
2.0MB

MD5
bee046ef6c3f44cb9237d73c09193e0c

SHA1
c6351150ba772dfee4f7314ffaf72cb7ececf42e

SHA256
14fc16a5530845ea24c1ff4ff5a989dc6b9af55be762bc9570c5bc139e84fcb5

SHA512
2cec5dddfa3acde61306ecdd0729b8ef6070fb2b4d6c44a1abfa739f6fe07f23eff94864feba74eb65fb740bfa9e07d8e35796af5d0e8326badd6877224cad03

Download Submit
C:\Windows\system\JyNrtNW.exe

Filesize
1.9MB

MD5
e60e9a4edbfce3781b4639cadf61ceb7

SHA1
9ba93dd385b56ab94f8ac849cb833f0c1c4abb27

SHA256
ae49657f607498c449e4fdbeb5cab7722e9a7e7db0b656b10ea7f1b336c0124d

SHA512
fd72d6f180bf218e2698cea26b156bbaacef67e8608128265774fb54c668e2a12e0d426ef73f5a032575507832ee64716be404906440d0635eff4c45bab07467

Download Submit
C:\Windows\system\LldeQlN.exe

Filesize
1.9MB

MD5
2d625e6d3c02edceb191a627e0898291

SHA1
f344a712734f014f8f1f2bbe87b3b338c894561d

SHA256
38ecc304de5b576b91f1f327408a0ab1b2db3943182b956697caf662198f13eb

SHA512
c01e0f8e24b236e620d432d97fec18fc1b5fecb7f800326b9fab8120c198a92691051b90976ea078d658a0b7d2983c3c0fbbcad088c4e85272cb79aecc376e2f

Download Submit
C:\Windows\system\MHVqmhI.exe

Filesize
1.9MB

MD5
97b7e24f1cd0b6bcde55c018af8fd423

SHA1
f86fc693147eece0dbb164248c6f7b00d3493ae9

SHA256
3f8f2b7f9668490906082491b55dea87052c64ebb0af3a62c38233b3fd482452

SHA512
b40422b4d7d05d1e2ceffe6948e8c2c24af851f7c8b7e44b805fef82ea36dee1bd9849df0b1af106d049dfb8b43c8cabe23f301382a8149243c71f28b5b285ef

Download Submit
C:\Windows\system\MZjnFYA.exe

Filesize
1.9MB

MD5
664b095ca7fcbf272e8143d1275a22f2

SHA1
352cb820b846384a8c381847101b54667260e702

SHA256
c62d13bb09ce6820e04b023474675c765bc31ceb3ef0dd8518bb2bef7c0575c7

SHA512
e5f4ae737525e5e66b8a07690af0cfe1bc1f50004719cb38e85e49cb21aadd9f9458f161d2295d52768e21cc373027ba168a99532bbd54b443634bb30689690e

Download Submit
C:\Windows\system\NgerbHO.exe

Filesize
2.0MB

MD5
4db935e0e56913fe3d707a31876ad829

SHA1
92bc5552c91d555eb191e05cbe8b0380561911d9

SHA256
9a21662f29b5181198b88514eb2ed0e50c787403493e8ef4c7cfc30fb38fd209

SHA512
4710998910587119c887ad7f005e05d1fb0917009988b181b9d577ce45c6b2f81d3689b03f65c7e7e1bd7682bd1faf72583ebe12c97d8b4838e505f5b75a0701

Download Submit
C:\Windows\system\PIBvahb.exe

Filesize
1.9MB

MD5
18f165fd85a1982759ce77538c291372

SHA1
99bdbc9db4ac7345c7718779fd4026c4840a2355

SHA256
4322443129db3d9ba8aaac7b727b01b6a5d6df37fa4127e52e3b57247ca1f3ab

SHA512
44aac92537886b078a5192424c2024f45d35221165beb6c57f0266437e6147c78e555eb80b5be84fc7663249cda87328a3f6940619f428ce9e3dcb088b097b67

Download Submit
C:\Windows\system\QKVMjQb.exe

Filesize
1.9MB

MD5
90cdae68badfd082dec268c6b1f33b9d

SHA1
0e9706b799991baa08bef0c24b58d344166ed4c1

SHA256
d155b2110250858fb79bc4e58419da7a2d582a1461a14371ab2f6c8f2ee7c223

SHA512
be7c317fb35c863f7149f75d70351d6076994161348321e2997fb7c6a20a8514daf48a87f1abee51a06cd09437e8a5e66be7954eca701794665454991ceaf2a9

Download Submit
C:\Windows\system\RSlGlwS.exe

Filesize
1.9MB

MD5
f1c4a6b49843c6389c2f303ffea9fde1

SHA1
066eb8967a50e1cb1473a22f86b3ce354819d5cf

SHA256
492ad96927c767f4ff95190cc65e33a9b0397da0282ecf763248e493850fca6a

SHA512
2dfc206a2ac590366b44acb89605fe3350ce6abc843ea3b81c371782b832621eacab4661340c93981a77eab6f3c2d3be7131b72bb6946acfb3e128a50517a2db

Download Submit
C:\Windows\system\SdLJMnV.exe

Filesize
1.9MB

MD5
32000a566aa92b36063d24da09a4fdfa

SHA1
a9e3ab05a30bfeb4aac73dceac9cc5dd6013fd3b

SHA256
b9c389f935ed426f42b72ebac170744b10cf8c798072afc3e1698e33a183553e

SHA512
e13174072d50424684e4aec31c8e3b920d6cd4ac9ec86ca1ccc7d765239079c2f5062fa93a06c00a4cd207bba53ec59acf0fee3d3fe078ea610c134352c9c479

Download Submit
C:\Windows\system\TgpmdSr.exe

Filesize
1.9MB

MD5
2ec1453ce38c897d124692d553b78dfb

SHA1
381e15995eb0723e0cab450515eea2c69c838e4a

SHA256
9e9780d6db311140236efdd941e7ae70196da21499fb5f14b145b7da643e0d27

SHA512
40bb100d85c4635c53bce053ebad1c6073e5f00988ad90f121680577d15492e3275a07a59b920611abf5e077c58bd97f3e1ada3dfb4ba607f3a71053ddb810e6

Download Submit
C:\Windows\system\UZspCfy.exe

Filesize
1.9MB

MD5
837c89f694dee403ea97319b594a879a

SHA1
a59ed898c1ba85f3ebc4ce9c42779a5c0144dae3

SHA256
68155827eaac5f2c9973df06c27369937f3bda6979574cfd98715043b1aea8a7

SHA512
36e94bdaa5d77d8171890e14262cfe9bd1cb8e49499fe9f6e21c87f886741c5a735d027c49813ff82762f51220d34e0ed7a42f5a9669bd1b01753bca5a821093

Download Submit
C:\Windows\system\VDGjmOU.exe

Filesize
1.9MB

MD5
b764ae500cb90c6a0de563696c779b20

SHA1
91b712120ece78622dcc4edc88e50578b875e95b

SHA256
dfd8f70a3fd275eac40cbe84933de8bb9209dfeaf6ab71126c35d1f0f7da13c5

SHA512
01f94ea130fa54ba44e582feb907393643050bbf612ff2f38b00cad53bd6204e4ed50ba05e4b39cf953b64998655d5f3c777e2a3428801802d550075573fcd45

Download Submit
C:\Windows\system\WMkGSZN.exe

Filesize
1.9MB

MD5
51df9e96e2c5e4fd1545a43d2dbfd4f9

SHA1
2735b4ef37acaa17953390296aed815ce85a77c8

SHA256
c6b35d0ba7944999723dbfea5d2d6444e14b1bb6d237720e4aff67fc056a7087

SHA512
ec206e0140c3e2f21f4c736972ea5bb0559f462309b997a82c42f463f1cfe6f14421d5c998c952c0e49aecd8f4b7c2734d3174be7ee5a0ed48d06b24dd9a6351

Download Submit
C:\Windows\system\XEUkUQr.exe

Filesize
1.9MB

MD5
4d9a7414a1a4ebafae58af90a40f719c

SHA1
46af460adb9e1a4b39d56b3017c9d750f1c5d336

SHA256
512f98ffee861d7be493888907e364b21d4201ea76b262f0cfb14dd5cdc92a1a

SHA512
48663129a19d81687821bdaaa6e943332d909f253a959fe2f4f4a5af8ff65fa97015728392ff2ac47165a91e632a581495971bdf9e6c360098b9d53189aa12f2

Download Submit
C:\Windows\system\YUwHTOI.exe

Filesize
1.9MB

MD5
748d9d23ab8bc5f2fcf8939156c4b383

SHA1
a5d1ea75964b3dcef973d684c4f4a9b3666d0c7f

SHA256
ad8a5cab47b1b5c2416ddd9cec27d6eb0d7ae43f432addd947d3a2368c69573b

SHA512
6efd1e3de2b27abfc40019661248552a42c6ed2d7a95332752dcab0e1161ed66152ec128705c079574d93fb06102af3d609a763c4472bd92325baf45081e790e

Download Submit
C:\Windows\system\fRQkUzo.exe

Filesize
1.9MB

MD5
0bd3238eb68d9a90da689dfece3d5935

SHA1
aaf7a0d547c852bc4016c6d4511bb4de0f3b9c50

SHA256
5a9f619cf4c449dde067e7153745c9eb41c7ec6626910d0e6cf174457a8034aa

SHA512
2635607b4e73a72694c64aa6542fa64a3425fe3ffd22a4a484790c83c0c2d9d459d27d544590190b6c0b57dd39531b26deb924286d5df69fdb85f6f8acb27bcd

Download Submit
C:\Windows\system\nVIarpm.exe

Filesize
1.9MB

MD5
55072cd2be12a26639a85d50184349f2

SHA1
b3de9ce826fc55ece3ab020362f80d64d3d3bbcc

SHA256
241a0ecf48d9a8ddb6d4007aa5cadb07ea5536bced704691f15b66e97407f563

SHA512
f22b6a50db92fd4d5291a1a1c9916bc33c502bdf68dae12898f6cd1e54ef0d26292218489151797c4548208021a676b2697b21f229f11c1f271263626f9204a5

Download Submit
C:\Windows\system\oyYAIuX.exe

Filesize
1.9MB

MD5
f1b4ee47b40aee9d9a76ec56017fe473

SHA1
33a74da00bbbbf21dd7529b3b88544c25dfd1308

SHA256
ecd86163f4a2dea637a4a5d4732ad26e9fddfd1f8776be78ed767c54dbbed4b0

SHA512
ace0eb924792367df6e482c588d9e7c3ca7e86e201b53cf3e5e87f462050b3564cdcd60d85c35f03be4f0d5263325ca5efb327f6fe95dd2662f339dbdb874582

Download Submit
C:\Windows\system\uGEOEOY.exe

Filesize
1.9MB

MD5
948d9068dbd83f8a0d7a7ce5cc002f58

SHA1
255c97ecc912bb2c63bc63b51937bde6b34018e7

SHA256
2591ef723aa8809d19fa7a6b74e4561336731a80d7780bb90c34e52052058d89

SHA512
b3b510d61e7c6dcb21bbb3693db1e9a512da82b5c6624968e7c24d1798c00390c17e868b422553c450099a32248bf6eb5d8e993d79dea794224535c32b7dbf07

Download Submit
C:\Windows\system\wHCKbob.exe

Filesize
2.0MB

MD5
7a9fa8f862d9e7f866a2c1b383660f4d

SHA1
c1c7defbb02053026e991ec9399e7472e77c4885

SHA256
7289bb70569a94145efe7cae4e75d0aea31bac7508a8ea2f138261ead7bc7b39

SHA512
5b1b0ed0c7a11086238e6695efde3c1e614c5847bf4db766508a48be7d9ac1cf015ee2be4eb80c40abb7e5cf440539ecddde414ee390923d7ee25c1d86025807

Download Submit
C:\Windows\system\xTBWZAx.exe

Filesize
1.9MB

MD5
3a7ec90f38879f4c35cf87f7166f0f34

SHA1
2533589587337fe412942279c8b6b7670c1b0cfa

SHA256
6210697a6fb0b517f626bc7c9e87435a442bded75b4677193b5684def71c11f9

SHA512
1ac90921e0d5d4fc8e6086aaa3010adfb2b4b4f0c2920b8b9a26fec1632d7e724333dd9e18c5adb8868ae9f4151bb17cab3762ddd8f1887998e235df122eda3b

Download Submit
C:\Windows\system\ycoDDnv.exe

Filesize
2.0MB

MD5
c41210a7c3375285c3c9717c13e29136

SHA1
3b1998ba4b10474fefef1c90a909a09f9bfd7db4

SHA256
c77e254bc696f7923f7df94590adb42104431b1e4e4df2945fda47dab5d74cfb

SHA512
6c765bff56713197428e86578e4fd4619798fb87fe5f93095d2afb095327ed8d16033ed4459c2787fb67c6d86c940d858f401daefc37a075990e6bb3d8bff443

Download Submit
C:\Windows\system\ygtOniG.exe

Filesize
1.9MB

MD5
97a6a9c7f22408805f1987808721097a

SHA1
5e2f999ced2e9717f68a39565cedb3548661f4cd

SHA256
27692b37e5148dd11df987442adb7db7143b2f9a6a43657f569766b69df1758a

SHA512
42e13589265cd882f81e3428f61df275f629fa7ed462a4f3716a69131305f628abbc5877f3a98947b8adcf9417064f14505edefdee77e9be92ca5cdb1d0a453c

Download Submit
\Windows\system\qILRDdx.exe

Filesize
1.9MB

MD5
65f29d7ee00f471630e761b7c04f025e

SHA1
36cdf503a668dee5489df71f9cda79a7cd9d95ce

SHA256
1ea17d8da9e391a01758a2a3cc232b759273dd31a1d4f4da21f8c9b8889aebdc

SHA512
9d9e68e3cffd80a92291b9a94364da433841f00b362b97aa3937efca707b45af24fefa1156a1a985fe62035d152e29110b727803948cb69ae90085c024237d00

Download Submit
\Windows\system\qphetjK.exe

Filesize
1.9MB

MD5
acc9fb9775b9bf16ad1d885310029945

SHA1
cfb9441606378c005cc43535374b8effa404a6b3

SHA256
ac3280fff7d8c185a73b469a05721c8c3fa8f5cbcf1dfe276b29983652af8a20

SHA512
26696fdeba13a300c73fa089ece851f5638059cce0e9ab094cb8713de5fcf8ef1a3b91fc00eee029688303c0e1c36b5fc7c73cb34ae27b0dd90157b481685144

Download Submit
\Windows\system\skNEOPy.exe

Filesize
1.9MB

MD5
1c488e3a726d0087ab8aae6b7f2e814b

SHA1
85771649f09152ab46fa08b2276d087096b40770

SHA256
35048798e042ecec930073911fe8cc3ac4e044b2ba7e7d20ab661f1c9170d8ca

SHA512
658e76ccc147b76b0ff8cb2133878e640499e7605ac98432a1e902abd2283a3fdda843fc764fc37ea2157522012bba98071684b0ecd5a5ee8438ff1ff6442a97

Download Submit
memory/1224-70-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download
memory/1224-8-0x0000000002030000-0x0000000002384000-memory.dmp

Filesize
3.3MB

Download
memory/1224-3649-0x0000000002030000-0x0000000002384000-memory.dmp

Filesize
3.3MB

Download
memory/1224-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1224-20-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/1224-81-0x0000000002030000-0x0000000002384000-memory.dmp

Filesize
3.3MB

Download
memory/1224-28-0x000000013F990000-0x000000013FCE4000-memory.dmp

Filesize
3.3MB

Download
memory/1224-79-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/1224-101-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1224-2-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download
memory/1224-103-0x000000013F340000-0x000000013F694000-memory.dmp

Filesize
3.3MB

Download
memory/1224-41-0x000000013F630000-0x000000013F984000-memory.dmp

Filesize
3.3MB

Download
memory/1224-42-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Filesize
3.3MB

Download
memory/1224-63-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/1224-14-0x0000000002030000-0x0000000002384000-memory.dmp

Filesize
3.3MB

Download
memory/1224-54-0x0000000002030000-0x0000000002384000-memory.dmp

Filesize
3.3MB

Download
memory/1332-86-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/1332-4022-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/1332-23-0x000000013F4F0000-0x000000013F844000-memory.dmp

Filesize
3.3MB

Download
memory/1924-4021-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/1924-82-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/1924-15-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/1940-102-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1940-4032-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2224-4029-0x000000013F070000-0x000000013F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/2224-104-0x000000013F070000-0x000000013F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/2224-4033-0x000000013F070000-0x000000013F3C4000-memory.dmp

Filesize
3.3MB

Download
memory/2508-4031-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/2508-80-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/2508-4019-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/2524-64-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2524-4026-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2552-71-0x000000013FE30000-0x0000000140184000-memory.dmp

Filesize
3.3MB

Download
memory/2552-4030-0x000000013FE30000-0x0000000140184000-memory.dmp

Filesize
3.3MB

Download
memory/2572-4034-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2572-87-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2644-40-0x000000013FE90000-0x00000001401E4000-memory.dmp

Filesize
3.3MB

Download
memory/2644-4023-0x000000013FE90000-0x00000001401E4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4024-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-52-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Filesize
3.3MB

Download
memory/2720-4025-0x000000013F630000-0x000000013F984000-memory.dmp

Filesize
3.3MB

Download
memory/2720-53-0x000000013F630000-0x000000013F984000-memory.dmp

Filesize
3.3MB

Download
memory/2772-4027-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2772-57-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2868-4020-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/2868-9-0x000000013FC60000-0x000000013FFB4000-memory.dmp

Filesize
3.3MB

Download
memory/3064-4028-0x000000013F990000-0x000000013FCE4000-memory.dmp

Filesize
3.3MB

Download
memory/3064-99-0x000000013F990000-0x000000013FCE4000-memory.dmp

Filesize
3.3MB

Download
memory/3064-29-0x000000013F990000-0x000000013FCE4000-memory.dmp

Filesize
3.3MB

Download