xmrig | ffd925ebeb7c037d50946488259b882b8c48974ece23fddc9b24caf89be51fe3

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
Size

2.7MB
MD5

7f0ae061812610b77e7452d1d428a160
SHA1

bf854b3e338a366ef958a01f226fca3dd63100f0
SHA256

ffd925ebeb7c037d50946488259b882b8c48974ece23fddc9b24caf89be51fe3
SHA512

3d71769b3acf4552123f8b8c239a3f15ef7f3cf55dffdb295e791a8fcedb7d9ebb81ffd29ee4b747eeb77652278536bdfa7ac2c02158a724e572db33d97d0679
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd5frdkgOHhbVK62:BemTLkNdfE0pZr8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2988-0-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	xmrig
behavioral1/files/0x000e00000001226f-5.dat	xmrig
behavioral1/memory/1988-8-0x000000013F950000-0x000000013FCA4000-memory.dmp	xmrig
behavioral1/files/0x0035000000016d61-9.dat	xmrig
behavioral1/memory/2988-12-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/memory/1872-14-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/files/0x0008000000016dde-15.dat	xmrig
behavioral1/files/0x0007000000016eb9-25.dat	xmrig
behavioral1/memory/2628-27-0x000000013FFD0000-0x0000000140324000-memory.dmp	xmrig
behavioral1/files/0x0007000000017477-34.dat	xmrig
behavioral1/files/0x0007000000017042-31.dat	xmrig
behavioral1/memory/2680-40-0x000000013F530000-0x000000013F884000-memory.dmp	xmrig
behavioral1/files/0x0006000000019228-51.dat	xmrig
behavioral1/memory/2684-47-0x000000013F1F0000-0x000000013F544000-memory.dmp	xmrig
behavioral1/memory/2820-55-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/files/0x0005000000019275-82.dat	xmrig
behavioral1/memory/1668-85-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/memory/1736-78-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/files/0x00050000000193b1-126.dat	xmrig
behavioral1/files/0x00050000000194eb-166.dat	xmrig
behavioral1/memory/2532-1113-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/memory/2692-859-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/memory/2820-359-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/files/0x000500000001957d-191.dat	xmrig
behavioral1/files/0x000500000001954b-186.dat	xmrig
behavioral1/files/0x0005000000019507-181.dat	xmrig
behavioral1/files/0x0005000000019501-176.dat	xmrig
behavioral1/files/0x00050000000194ef-171.dat	xmrig
behavioral1/files/0x00050000000194b8-161.dat	xmrig
behavioral1/files/0x00050000000194a8-156.dat	xmrig
behavioral1/files/0x0005000000019491-151.dat	xmrig
behavioral1/files/0x0005000000019462-146.dat	xmrig
behavioral1/files/0x0005000000019457-141.dat	xmrig
behavioral1/files/0x000500000001943e-136.dat	xmrig
behavioral1/files/0x0005000000019433-130.dat	xmrig
behavioral1/files/0x00050000000193a5-121.dat	xmrig
behavioral1/files/0x000500000001939f-116.dat	xmrig
behavioral1/files/0x0005000000019381-111.dat	xmrig
behavioral1/memory/2684-107-0x000000013F1F0000-0x000000013F544000-memory.dmp	xmrig
behavioral1/files/0x000500000001933a-105.dat	xmrig
behavioral1/memory/1060-100-0x000000013F290000-0x000000013F5E4000-memory.dmp	xmrig
behavioral1/memory/2680-98-0x000000013F530000-0x000000013F884000-memory.dmp	xmrig
behavioral1/memory/1500-94-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/files/0x0005000000019277-92.dat	xmrig
behavioral1/files/0x0005000000019283-97.dat	xmrig
behavioral1/memory/2740-89-0x000000013F980000-0x000000013FCD4000-memory.dmp	xmrig
behavioral1/memory/2988-77-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019260-74.dat	xmrig
behavioral1/memory/2628-83-0x000000013FFD0000-0x0000000140324000-memory.dmp	xmrig
behavioral1/memory/2532-70-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/files/0x000500000001925d-67.dat	xmrig
behavioral1/memory/2692-62-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/memory/1872-61-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/files/0x000500000001923b-60.dat	xmrig
behavioral1/memory/2988-46-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	xmrig
behavioral1/files/0x0008000000017495-45.dat	xmrig
behavioral1/memory/2740-33-0x000000013F980000-0x000000013FCD4000-memory.dmp	xmrig
behavioral1/memory/2616-21-0x000000013FE80000-0x00000001401D4000-memory.dmp	xmrig
behavioral1/memory/2988-19-0x000000013FE80000-0x00000001401D4000-memory.dmp	xmrig
behavioral1/memory/1668-1913-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/memory/2988-2521-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/1060-2713-0x000000013F290000-0x000000013F5E4000-memory.dmp	xmrig
behavioral1/memory/2988-2774-0x000000013F120000-0x000000013F474000-memory.dmp	xmrig
behavioral1/memory/1872-4048-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1988	xdEzvCq.exe
1872	OnmfSin.exe
2616	rApvXTX.exe
2628	VCHfsPF.exe
2740	vNqEQaD.exe
2680	BqwJMtk.exe
2684	YiODMaA.exe
2820	nOeYHCO.exe
2692	dDOqJwp.exe
2532	QYNrHVy.exe
1736	hjnDYGq.exe
1668	NtrleeX.exe
1500	DPYENjM.exe
1060	ubsgePL.exe
2220	uUothmx.exe
1520	owQBkUG.exe
812	mtIURLA.exe
1816	MbFRBqF.exe
1936	RNBTXPP.exe
1256	gfmFjUO.exe
536	SbCxxVh.exe
332	SZVeXfO.exe
1764	RvMAMGF.exe
1444	gNHJwsz.exe
1284	TyuriUd.exe
2368	OLaEEOX.exe
3052	ZEJzLkY.exe
2880	tAAWDDF.exe
2376	lMGYmco.exe
2884	USVSlNu.exe
1744	lzmQtAi.exe
1864	WsfHAwo.exe
1832	fSQcdaU.exe
2428	CWxHZCa.exe
2088	JSqOmVL.exe
2192	ymwYUYX.exe
1096	uHLucaW.exe
856	FwGoksx.exe
1048	aotQTLF.exe
1868	hEvtiMV.exe
964	ziUJAxI.exe
1116	BQtZlgG.exe
1796	BssQUYi.exe
1824	aNypcKd.exe
916	PIrllUF.exe
2332	ppQHONg.exe
3040	mfzWHuA.exe
2392	oXiiSLa.exe
1708	TJGblgu.exe
1616	mbzspzg.exe
288	DGHhIFJ.exe
1880	SbytegM.exe
2076	LwiSiPL.exe
2452	NaFbdAb.exe
1828	vMCdhDK.exe
1992	EGEUEeH.exe
1584	xpIQGTW.exe
1448	rlHlbVe.exe
1312	RPoDXyn.exe
2144	ogPrtJM.exe
2772	iCoyHkh.exe
2992	zVTywPv.exe
2840	PqnnIOd.exe
1724	MaoTLJZ.exe

Loads dropped DLL 64 IoCs

pid	Process
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2988-0-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	upx
behavioral1/files/0x000e00000001226f-5.dat	upx
behavioral1/memory/1988-8-0x000000013F950000-0x000000013FCA4000-memory.dmp	upx
behavioral1/files/0x0035000000016d61-9.dat	upx
behavioral1/memory/1872-14-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/files/0x0008000000016dde-15.dat	upx
behavioral1/files/0x0007000000016eb9-25.dat	upx
behavioral1/memory/2628-27-0x000000013FFD0000-0x0000000140324000-memory.dmp	upx
behavioral1/files/0x0007000000017477-34.dat	upx
behavioral1/files/0x0007000000017042-31.dat	upx
behavioral1/memory/2680-40-0x000000013F530000-0x000000013F884000-memory.dmp	upx
behavioral1/files/0x0006000000019228-51.dat	upx
behavioral1/memory/2684-47-0x000000013F1F0000-0x000000013F544000-memory.dmp	upx
behavioral1/memory/2820-55-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/files/0x0005000000019275-82.dat	upx
behavioral1/memory/1668-85-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/memory/1736-78-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/files/0x00050000000193b1-126.dat	upx
behavioral1/files/0x00050000000194eb-166.dat	upx
behavioral1/memory/2532-1113-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/memory/2692-859-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/memory/2820-359-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/files/0x000500000001957d-191.dat	upx
behavioral1/files/0x000500000001954b-186.dat	upx
behavioral1/files/0x0005000000019507-181.dat	upx
behavioral1/files/0x0005000000019501-176.dat	upx
behavioral1/files/0x00050000000194ef-171.dat	upx
behavioral1/files/0x00050000000194b8-161.dat	upx
behavioral1/files/0x00050000000194a8-156.dat	upx
behavioral1/files/0x0005000000019491-151.dat	upx
behavioral1/files/0x0005000000019462-146.dat	upx
behavioral1/files/0x0005000000019457-141.dat	upx
behavioral1/files/0x000500000001943e-136.dat	upx
behavioral1/files/0x0005000000019433-130.dat	upx
behavioral1/files/0x00050000000193a5-121.dat	upx
behavioral1/files/0x000500000001939f-116.dat	upx
behavioral1/files/0x0005000000019381-111.dat	upx
behavioral1/memory/2684-107-0x000000013F1F0000-0x000000013F544000-memory.dmp	upx
behavioral1/files/0x000500000001933a-105.dat	upx
behavioral1/memory/1060-100-0x000000013F290000-0x000000013F5E4000-memory.dmp	upx
behavioral1/memory/2680-98-0x000000013F530000-0x000000013F884000-memory.dmp	upx
behavioral1/memory/1500-94-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/files/0x0005000000019277-92.dat	upx
behavioral1/files/0x0005000000019283-97.dat	upx
behavioral1/memory/2740-89-0x000000013F980000-0x000000013FCD4000-memory.dmp	upx
behavioral1/files/0x0005000000019260-74.dat	upx
behavioral1/memory/2628-83-0x000000013FFD0000-0x0000000140324000-memory.dmp	upx
behavioral1/memory/2532-70-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/files/0x000500000001925d-67.dat	upx
behavioral1/memory/2692-62-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/memory/1872-61-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/files/0x000500000001923b-60.dat	upx
behavioral1/memory/2988-46-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	upx
behavioral1/files/0x0008000000017495-45.dat	upx
behavioral1/memory/2740-33-0x000000013F980000-0x000000013FCD4000-memory.dmp	upx
behavioral1/memory/2616-21-0x000000013FE80000-0x00000001401D4000-memory.dmp	upx
behavioral1/memory/1668-1913-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/memory/1060-2713-0x000000013F290000-0x000000013F5E4000-memory.dmp	upx
behavioral1/memory/1872-4048-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/memory/2628-4049-0x000000013FFD0000-0x0000000140324000-memory.dmp	upx
behavioral1/memory/2740-4050-0x000000013F980000-0x000000013FCD4000-memory.dmp	upx
behavioral1/memory/2680-4052-0x000000013F530000-0x000000013F884000-memory.dmp	upx
behavioral1/memory/2820-4051-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/memory/2684-4053-0x000000013F1F0000-0x000000013F544000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EGEUEeH.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\CJvjnUN.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\uLmfzsl.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\sqytPbN.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\HBNVYwT.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\bjYGJCF.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\KLhoZfI.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\DjxPlVK.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\YgNKgKG.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\aOvBEyt.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\dKJjGWB.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\ABgjmnJ.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\eFJFMor.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\viBVgdd.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\eCLCmNc.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\DTTbPUP.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\QbwAVvd.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\EWXyqtS.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\MnyzUhU.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\ocZUYIr.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\XEwStco.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\bLEgGvm.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\CPpNDzf.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\xYCFPxC.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\bmPyJVy.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\ZVwBHqx.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\SPDdrWO.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\OcNfZKU.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\USVSlNu.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\QQpEtsq.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\NwtYqPY.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\IpPhzRY.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\pGAcTMD.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\aYJVpdF.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\MkjrCFN.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\CgCMNjb.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\QStqovq.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\tQMgOeE.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\MUYrCyy.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\LIoOxeJ.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\ubVqZAr.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\hOQQraf.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\HapRIZV.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\kmMjhHZ.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\sgomPTn.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\AAcUEMi.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\nklObXY.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\dLHHWgk.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\CindBsf.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\MXUkeRC.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\eemsSNy.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\wAmrDnE.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\HYfaqDx.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\HUnBbvF.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\TYpVwUO.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\ubsgePL.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\JnqHWVO.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\UVTIbOm.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\SfTDgkM.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\xUJNjYP.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\jQHsVYZ.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\AMDbmEJ.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\YoHQmiU.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
File created	C:\Windows\System\gNHJwsz.exe	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1988	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 1988	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 1988	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 1872	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	30
PID 2988 wrote to memory of 1872	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	30
PID 2988 wrote to memory of 1872	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	30
PID 2988 wrote to memory of 2616	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	31
PID 2988 wrote to memory of 2616	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	31
PID 2988 wrote to memory of 2616	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	31
PID 2988 wrote to memory of 2628	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	32
PID 2988 wrote to memory of 2628	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	32
PID 2988 wrote to memory of 2628	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	32
PID 2988 wrote to memory of 2740	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	33
PID 2988 wrote to memory of 2740	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	33
PID 2988 wrote to memory of 2740	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	33
PID 2988 wrote to memory of 2680	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	34
PID 2988 wrote to memory of 2680	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	34
PID 2988 wrote to memory of 2680	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	34
PID 2988 wrote to memory of 2684	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	35
PID 2988 wrote to memory of 2684	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	35
PID 2988 wrote to memory of 2684	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	35
PID 2988 wrote to memory of 2820	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	36
PID 2988 wrote to memory of 2820	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	36
PID 2988 wrote to memory of 2820	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	36
PID 2988 wrote to memory of 2692	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	37
PID 2988 wrote to memory of 2692	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	37
PID 2988 wrote to memory of 2692	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	37
PID 2988 wrote to memory of 2532	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	38
PID 2988 wrote to memory of 2532	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	38
PID 2988 wrote to memory of 2532	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	38
PID 2988 wrote to memory of 1736	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	39
PID 2988 wrote to memory of 1736	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	39
PID 2988 wrote to memory of 1736	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	39
PID 2988 wrote to memory of 1668	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	40
PID 2988 wrote to memory of 1668	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	40
PID 2988 wrote to memory of 1668	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	40
PID 2988 wrote to memory of 1500	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	41
PID 2988 wrote to memory of 1500	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	41
PID 2988 wrote to memory of 1500	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	41
PID 2988 wrote to memory of 1060	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	42
PID 2988 wrote to memory of 1060	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	42
PID 2988 wrote to memory of 1060	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	42
PID 2988 wrote to memory of 2220	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	43
PID 2988 wrote to memory of 2220	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	43
PID 2988 wrote to memory of 2220	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	43
PID 2988 wrote to memory of 1520	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	44
PID 2988 wrote to memory of 1520	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	44
PID 2988 wrote to memory of 1520	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	44
PID 2988 wrote to memory of 812	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	45
PID 2988 wrote to memory of 812	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	45
PID 2988 wrote to memory of 812	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	45
PID 2988 wrote to memory of 1816	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	46
PID 2988 wrote to memory of 1816	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	46
PID 2988 wrote to memory of 1816	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	46
PID 2988 wrote to memory of 1936	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	47
PID 2988 wrote to memory of 1936	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	47
PID 2988 wrote to memory of 1936	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	47
PID 2988 wrote to memory of 1256	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	48
PID 2988 wrote to memory of 1256	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	48
PID 2988 wrote to memory of 1256	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	48
PID 2988 wrote to memory of 536	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	49
PID 2988 wrote to memory of 536	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	49
PID 2988 wrote to memory of 536	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	49
PID 2988 wrote to memory of 332	2988	7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7f0ae061812610b77e7452d1d428a160_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\System\xdEzvCq.exe
  C:\Windows\System\xdEzvCq.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\OnmfSin.exe
  C:\Windows\System\OnmfSin.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\rApvXTX.exe
  C:\Windows\System\rApvXTX.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\VCHfsPF.exe
  C:\Windows\System\VCHfsPF.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\vNqEQaD.exe
  C:\Windows\System\vNqEQaD.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\BqwJMtk.exe
  C:\Windows\System\BqwJMtk.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\YiODMaA.exe
  C:\Windows\System\YiODMaA.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\nOeYHCO.exe
  C:\Windows\System\nOeYHCO.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\dDOqJwp.exe
  C:\Windows\System\dDOqJwp.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\QYNrHVy.exe
  C:\Windows\System\QYNrHVy.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\hjnDYGq.exe
  C:\Windows\System\hjnDYGq.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\NtrleeX.exe
  C:\Windows\System\NtrleeX.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\DPYENjM.exe
  C:\Windows\System\DPYENjM.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ubsgePL.exe
  C:\Windows\System\ubsgePL.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\uUothmx.exe
  C:\Windows\System\uUothmx.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\owQBkUG.exe
  C:\Windows\System\owQBkUG.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\mtIURLA.exe
  C:\Windows\System\mtIURLA.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\MbFRBqF.exe
  C:\Windows\System\MbFRBqF.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\RNBTXPP.exe
  C:\Windows\System\RNBTXPP.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\gfmFjUO.exe
  C:\Windows\System\gfmFjUO.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\SbCxxVh.exe
  C:\Windows\System\SbCxxVh.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\SZVeXfO.exe
  C:\Windows\System\SZVeXfO.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\RvMAMGF.exe
  C:\Windows\System\RvMAMGF.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\gNHJwsz.exe
  C:\Windows\System\gNHJwsz.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\TyuriUd.exe
  C:\Windows\System\TyuriUd.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\OLaEEOX.exe
  C:\Windows\System\OLaEEOX.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ZEJzLkY.exe
  C:\Windows\System\ZEJzLkY.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\tAAWDDF.exe
  C:\Windows\System\tAAWDDF.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\lMGYmco.exe
  C:\Windows\System\lMGYmco.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\USVSlNu.exe
  C:\Windows\System\USVSlNu.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\lzmQtAi.exe
  C:\Windows\System\lzmQtAi.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\WsfHAwo.exe
  C:\Windows\System\WsfHAwo.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\fSQcdaU.exe
  C:\Windows\System\fSQcdaU.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\CWxHZCa.exe
  C:\Windows\System\CWxHZCa.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\JSqOmVL.exe
  C:\Windows\System\JSqOmVL.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\ymwYUYX.exe
  C:\Windows\System\ymwYUYX.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\uHLucaW.exe
  C:\Windows\System\uHLucaW.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\FwGoksx.exe
  C:\Windows\System\FwGoksx.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\aotQTLF.exe
  C:\Windows\System\aotQTLF.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\hEvtiMV.exe
  C:\Windows\System\hEvtiMV.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\ziUJAxI.exe
  C:\Windows\System\ziUJAxI.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\BQtZlgG.exe
  C:\Windows\System\BQtZlgG.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\BssQUYi.exe
  C:\Windows\System\BssQUYi.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\aNypcKd.exe
  C:\Windows\System\aNypcKd.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\PIrllUF.exe
  C:\Windows\System\PIrllUF.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\ppQHONg.exe
  C:\Windows\System\ppQHONg.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\mfzWHuA.exe
  C:\Windows\System\mfzWHuA.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\oXiiSLa.exe
  C:\Windows\System\oXiiSLa.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\TJGblgu.exe
  C:\Windows\System\TJGblgu.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\mbzspzg.exe
  C:\Windows\System\mbzspzg.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\DGHhIFJ.exe
  C:\Windows\System\DGHhIFJ.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\SbytegM.exe
  C:\Windows\System\SbytegM.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\LwiSiPL.exe
  C:\Windows\System\LwiSiPL.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\NaFbdAb.exe
  C:\Windows\System\NaFbdAb.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\vMCdhDK.exe
  C:\Windows\System\vMCdhDK.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\EGEUEeH.exe
  C:\Windows\System\EGEUEeH.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\xpIQGTW.exe
  C:\Windows\System\xpIQGTW.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\rlHlbVe.exe
  C:\Windows\System\rlHlbVe.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\RPoDXyn.exe
  C:\Windows\System\RPoDXyn.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\ogPrtJM.exe
  C:\Windows\System\ogPrtJM.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\iCoyHkh.exe
  C:\Windows\System\iCoyHkh.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\zVTywPv.exe
  C:\Windows\System\zVTywPv.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\PqnnIOd.exe
  C:\Windows\System\PqnnIOd.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\MaoTLJZ.exe
  C:\Windows\System\MaoTLJZ.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\YCVlJqi.exe
  C:\Windows\System\YCVlJqi.exe
  2⤵
  PID:1628
- C:\Windows\System\LFPtfHH.exe
  C:\Windows\System\LFPtfHH.exe
  2⤵
  PID:2572
- C:\Windows\System\FkXuUnV.exe
  C:\Windows\System\FkXuUnV.exe
  2⤵
  PID:2224
- C:\Windows\System\rNXmFhU.exe
  C:\Windows\System\rNXmFhU.exe
  2⤵
  PID:780
- C:\Windows\System\pMbYqFx.exe
  C:\Windows\System\pMbYqFx.exe
  2⤵
  PID:2260
- C:\Windows\System\MmNkVsq.exe
  C:\Windows\System\MmNkVsq.exe
  2⤵
  PID:1512
- C:\Windows\System\uGsyazw.exe
  C:\Windows\System\uGsyazw.exe
  2⤵
  PID:604
- C:\Windows\System\DlvqkVV.exe
  C:\Windows\System\DlvqkVV.exe
  2⤵
  PID:684
- C:\Windows\System\YlsOeTf.exe
  C:\Windows\System\YlsOeTf.exe
  2⤵
  PID:1332
- C:\Windows\System\IpdCtcd.exe
  C:\Windows\System\IpdCtcd.exe
  2⤵
  PID:2956
- C:\Windows\System\tUThfBr.exe
  C:\Windows\System\tUThfBr.exe
  2⤵
  PID:2292
- C:\Windows\System\evMEqao.exe
  C:\Windows\System\evMEqao.exe
  2⤵
  PID:2888
- C:\Windows\System\bCNCMhM.exe
  C:\Windows\System\bCNCMhM.exe
  2⤵
  PID:1320
- C:\Windows\System\EblAREW.exe
  C:\Windows\System\EblAREW.exe
  2⤵
  PID:2836
- C:\Windows\System\arGrMFp.exe
  C:\Windows\System\arGrMFp.exe
  2⤵
  PID:276
- C:\Windows\System\rTxNJIy.exe
  C:\Windows\System\rTxNJIy.exe
  2⤵
  PID:2180
- C:\Windows\System\NGDAZAh.exe
  C:\Windows\System\NGDAZAh.exe
  2⤵
  PID:696
- C:\Windows\System\kynJaFU.exe
  C:\Windows\System\kynJaFU.exe
  2⤵
  PID:1532
- C:\Windows\System\blaObiP.exe
  C:\Windows\System\blaObiP.exe
  2⤵
  PID:1412
- C:\Windows\System\UlGwtiA.exe
  C:\Windows\System\UlGwtiA.exe
  2⤵
  PID:1076
- C:\Windows\System\miXWDOV.exe
  C:\Windows\System\miXWDOV.exe
  2⤵
  PID:1064
- C:\Windows\System\lFUjynB.exe
  C:\Windows\System\lFUjynB.exe
  2⤵
  PID:568
- C:\Windows\System\sKSNduz.exe
  C:\Windows\System\sKSNduz.exe
  2⤵
  PID:888
- C:\Windows\System\aathRQJ.exe
  C:\Windows\System\aathRQJ.exe
  2⤵
  PID:2168
- C:\Windows\System\GCHiypB.exe
  C:\Windows\System\GCHiypB.exe
  2⤵
  PID:2012
- C:\Windows\System\xTniMLS.exe
  C:\Windows\System\xTniMLS.exe
  2⤵
  PID:1756
- C:\Windows\System\cYrgsSh.exe
  C:\Windows\System\cYrgsSh.exe
  2⤵
  PID:2248
- C:\Windows\System\PwYDqlw.exe
  C:\Windows\System\PwYDqlw.exe
  2⤵
  PID:1592
- C:\Windows\System\bLEgGvm.exe
  C:\Windows\System\bLEgGvm.exe
  2⤵
  PID:1932
- C:\Windows\System\nTEtztD.exe
  C:\Windows\System\nTEtztD.exe
  2⤵
  PID:2720
- C:\Windows\System\goVkqgP.exe
  C:\Windows\System\goVkqgP.exe
  2⤵
  PID:2760
- C:\Windows\System\LuXABtT.exe
  C:\Windows\System\LuXABtT.exe
  2⤵
  PID:2860
- C:\Windows\System\kOUDCbw.exe
  C:\Windows\System\kOUDCbw.exe
  2⤵
  PID:272
- C:\Windows\System\dIlPIwu.exe
  C:\Windows\System\dIlPIwu.exe
  2⤵
  PID:2580
- C:\Windows\System\GDUPiVV.exe
  C:\Windows\System\GDUPiVV.exe
  2⤵
  PID:2240
- C:\Windows\System\uJbdgPF.exe
  C:\Windows\System\uJbdgPF.exe
  2⤵
  PID:2164
- C:\Windows\System\BAxyzAt.exe
  C:\Windows\System\BAxyzAt.exe
  2⤵
  PID:2480
- C:\Windows\System\CPpNDzf.exe
  C:\Windows\System\CPpNDzf.exe
  2⤵
  PID:2236
- C:\Windows\System\zisTRPC.exe
  C:\Windows\System\zisTRPC.exe
  2⤵
  PID:1492
- C:\Windows\System\DcUeHIF.exe
  C:\Windows\System\DcUeHIF.exe
  2⤵
  PID:2356
- C:\Windows\System\lpSVyXQ.exe
  C:\Windows\System\lpSVyXQ.exe
  2⤵
  PID:2364
- C:\Windows\System\aMlRNyH.exe
  C:\Windows\System\aMlRNyH.exe
  2⤵
  PID:2360
- C:\Windows\System\GolLMKp.exe
  C:\Windows\System\GolLMKp.exe
  2⤵
  PID:1528
- C:\Windows\System\bAfjAsL.exe
  C:\Windows\System\bAfjAsL.exe
  2⤵
  PID:1296
- C:\Windows\System\xzXxjzQ.exe
  C:\Windows\System\xzXxjzQ.exe
  2⤵
  PID:2896
- C:\Windows\System\TqonSxB.exe
  C:\Windows\System\TqonSxB.exe
  2⤵
  PID:2900
- C:\Windows\System\HyvawOg.exe
  C:\Windows\System\HyvawOg.exe
  2⤵
  PID:2960
- C:\Windows\System\BMwiYOl.exe
  C:\Windows\System\BMwiYOl.exe
  2⤵
  PID:2036
- C:\Windows\System\AiDpUOa.exe
  C:\Windows\System\AiDpUOa.exe
  2⤵
  PID:2556
- C:\Windows\System\MDoWBjP.exe
  C:\Windows\System\MDoWBjP.exe
  2⤵
  PID:1704
- C:\Windows\System\LOnaHCo.exe
  C:\Windows\System\LOnaHCo.exe
  2⤵
  PID:2588
- C:\Windows\System\LltGiex.exe
  C:\Windows\System\LltGiex.exe
  2⤵
  PID:2832
- C:\Windows\System\YZQEdyJ.exe
  C:\Windows\System\YZQEdyJ.exe
  2⤵
  PID:3000
- C:\Windows\System\dBGbrEx.exe
  C:\Windows\System\dBGbrEx.exe
  2⤵
  PID:320
- C:\Windows\System\FIMavtM.exe
  C:\Windows\System\FIMavtM.exe
  2⤵
  PID:2200
- C:\Windows\System\AXhIiMy.exe
  C:\Windows\System\AXhIiMy.exe
  2⤵
  PID:2872
- C:\Windows\System\VuKLLTz.exe
  C:\Windows\System\VuKLLTz.exe
  2⤵
  PID:2484
- C:\Windows\System\bvxcYGs.exe
  C:\Windows\System\bvxcYGs.exe
  2⤵
  PID:572
- C:\Windows\System\xtStdDi.exe
  C:\Windows\System\xtStdDi.exe
  2⤵
  PID:1664
- C:\Windows\System\NJjpclE.exe
  C:\Windows\System\NJjpclE.exe
  2⤵
  PID:1344
- C:\Windows\System\fCVVqhs.exe
  C:\Windows\System\fCVVqhs.exe
  2⤵
  PID:1452
- C:\Windows\System\xYCFPxC.exe
  C:\Windows\System\xYCFPxC.exe
  2⤵
  PID:2468
- C:\Windows\System\ghFZAyx.exe
  C:\Windows\System\ghFZAyx.exe
  2⤵
  PID:1632
- C:\Windows\System\KqRlBga.exe
  C:\Windows\System\KqRlBga.exe
  2⤵
  PID:1952
- C:\Windows\System\qCLvkbl.exe
  C:\Windows\System\qCLvkbl.exe
  2⤵
  PID:3088
- C:\Windows\System\dYzXaHT.exe
  C:\Windows\System\dYzXaHT.exe
  2⤵
  PID:3104
- C:\Windows\System\QlgCwJX.exe
  C:\Windows\System\QlgCwJX.exe
  2⤵
  PID:3128
- C:\Windows\System\IEgNPJi.exe
  C:\Windows\System\IEgNPJi.exe
  2⤵
  PID:3148
- C:\Windows\System\hHKVADv.exe
  C:\Windows\System\hHKVADv.exe
  2⤵
  PID:3168
- C:\Windows\System\mkirfTz.exe
  C:\Windows\System\mkirfTz.exe
  2⤵
  PID:3188
- C:\Windows\System\TBjvEpK.exe
  C:\Windows\System\TBjvEpK.exe
  2⤵
  PID:3208
- C:\Windows\System\nhmaouN.exe
  C:\Windows\System\nhmaouN.exe
  2⤵
  PID:3228
- C:\Windows\System\eOGmwDs.exe
  C:\Windows\System\eOGmwDs.exe
  2⤵
  PID:3248
- C:\Windows\System\xXnWGBg.exe
  C:\Windows\System\xXnWGBg.exe
  2⤵
  PID:3272
- C:\Windows\System\fqCpdWY.exe
  C:\Windows\System\fqCpdWY.exe
  2⤵
  PID:3292
- C:\Windows\System\iUlWSOM.exe
  C:\Windows\System\iUlWSOM.exe
  2⤵
  PID:3308
- C:\Windows\System\gxdmGBf.exe
  C:\Windows\System\gxdmGBf.exe
  2⤵
  PID:3332
- C:\Windows\System\dZdopWk.exe
  C:\Windows\System\dZdopWk.exe
  2⤵
  PID:3352
- C:\Windows\System\FeHsXEL.exe
  C:\Windows\System\FeHsXEL.exe
  2⤵
  PID:3372
- C:\Windows\System\oqsOVOb.exe
  C:\Windows\System\oqsOVOb.exe
  2⤵
  PID:3392
- C:\Windows\System\TPfwXyU.exe
  C:\Windows\System\TPfwXyU.exe
  2⤵
  PID:3412
- C:\Windows\System\YqLGuXr.exe
  C:\Windows\System\YqLGuXr.exe
  2⤵
  PID:3432
- C:\Windows\System\LeeOWAe.exe
  C:\Windows\System\LeeOWAe.exe
  2⤵
  PID:3452
- C:\Windows\System\TGXbzkI.exe
  C:\Windows\System\TGXbzkI.exe
  2⤵
  PID:3472
- C:\Windows\System\DxVMYwt.exe
  C:\Windows\System\DxVMYwt.exe
  2⤵
  PID:3492
- C:\Windows\System\bQjdWEv.exe
  C:\Windows\System\bQjdWEv.exe
  2⤵
  PID:3512
- C:\Windows\System\ybIGbaK.exe
  C:\Windows\System\ybIGbaK.exe
  2⤵
  PID:3532
- C:\Windows\System\IngzWPg.exe
  C:\Windows\System\IngzWPg.exe
  2⤵
  PID:3552
- C:\Windows\System\FkNMUPz.exe
  C:\Windows\System\FkNMUPz.exe
  2⤵
  PID:3572
- C:\Windows\System\xDGqHXa.exe
  C:\Windows\System\xDGqHXa.exe
  2⤵
  PID:3592
- C:\Windows\System\hUPLDpG.exe
  C:\Windows\System\hUPLDpG.exe
  2⤵
  PID:3612
- C:\Windows\System\QbwAVvd.exe
  C:\Windows\System\QbwAVvd.exe
  2⤵
  PID:3632
- C:\Windows\System\nzgKdVB.exe
  C:\Windows\System\nzgKdVB.exe
  2⤵
  PID:3652
- C:\Windows\System\RrEoaFz.exe
  C:\Windows\System\RrEoaFz.exe
  2⤵
  PID:3668
- C:\Windows\System\HHRHzYi.exe
  C:\Windows\System\HHRHzYi.exe
  2⤵
  PID:3688
- C:\Windows\System\hFBKoAF.exe
  C:\Windows\System\hFBKoAF.exe
  2⤵
  PID:3704
- C:\Windows\System\XxDLkMl.exe
  C:\Windows\System\XxDLkMl.exe
  2⤵
  PID:3724
- C:\Windows\System\azwZrOG.exe
  C:\Windows\System\azwZrOG.exe
  2⤵
  PID:3748
- C:\Windows\System\bMkKOBQ.exe
  C:\Windows\System\bMkKOBQ.exe
  2⤵
  PID:3768
- C:\Windows\System\EGymwKi.exe
  C:\Windows\System\EGymwKi.exe
  2⤵
  PID:3792
- C:\Windows\System\BZdAeSN.exe
  C:\Windows\System\BZdAeSN.exe
  2⤵
  PID:3812
- C:\Windows\System\edUCYXD.exe
  C:\Windows\System\edUCYXD.exe
  2⤵
  PID:3832
- C:\Windows\System\QbTEYDx.exe
  C:\Windows\System\QbTEYDx.exe
  2⤵
  PID:3852
- C:\Windows\System\SACtObt.exe
  C:\Windows\System\SACtObt.exe
  2⤵
  PID:3868
- C:\Windows\System\OvFktlV.exe
  C:\Windows\System\OvFktlV.exe
  2⤵
  PID:3888
- C:\Windows\System\nUAqQLw.exe
  C:\Windows\System\nUAqQLw.exe
  2⤵
  PID:3908
- C:\Windows\System\IwhfYyQ.exe
  C:\Windows\System\IwhfYyQ.exe
  2⤵
  PID:3932
- C:\Windows\System\PPQpBDP.exe
  C:\Windows\System\PPQpBDP.exe
  2⤵
  PID:3948
- C:\Windows\System\ZKqzVkE.exe
  C:\Windows\System\ZKqzVkE.exe
  2⤵
  PID:3972
- C:\Windows\System\PZNKyBk.exe
  C:\Windows\System\PZNKyBk.exe
  2⤵
  PID:3992
- C:\Windows\System\jbfOuFJ.exe
  C:\Windows\System\jbfOuFJ.exe
  2⤵
  PID:4012
- C:\Windows\System\elgVmIH.exe
  C:\Windows\System\elgVmIH.exe
  2⤵
  PID:4032
- C:\Windows\System\fJRahwI.exe
  C:\Windows\System\fJRahwI.exe
  2⤵
  PID:4052
- C:\Windows\System\TbbWZuy.exe
  C:\Windows\System\TbbWZuy.exe
  2⤵
  PID:4072
- C:\Windows\System\hDamaZY.exe
  C:\Windows\System\hDamaZY.exe
  2⤵
  PID:4092
- C:\Windows\System\YJITLBE.exe
  C:\Windows\System\YJITLBE.exe
  2⤵
  PID:2312
- C:\Windows\System\RnXnYsr.exe
  C:\Windows\System\RnXnYsr.exe
  2⤵
  PID:1488
- C:\Windows\System\hkflBte.exe
  C:\Windows\System\hkflBte.exe
  2⤵
  PID:1352
- C:\Windows\System\aqyXmkp.exe
  C:\Windows\System\aqyXmkp.exe
  2⤵
  PID:1544
- C:\Windows\System\CckJSwh.exe
  C:\Windows\System\CckJSwh.exe
  2⤵
  PID:1752
- C:\Windows\System\rufZBLK.exe
  C:\Windows\System\rufZBLK.exe
  2⤵
  PID:2848
- C:\Windows\System\wyRJFZV.exe
  C:\Windows\System\wyRJFZV.exe
  2⤵
  PID:3076
- C:\Windows\System\norRiCO.exe
  C:\Windows\System\norRiCO.exe
  2⤵
  PID:3120
- C:\Windows\System\ilvyVey.exe
  C:\Windows\System\ilvyVey.exe
  2⤵
  PID:3160
- C:\Windows\System\tWZGlQu.exe
  C:\Windows\System\tWZGlQu.exe
  2⤵
  PID:3196
- C:\Windows\System\nZuzSzS.exe
  C:\Windows\System\nZuzSzS.exe
  2⤵
  PID:3236
- C:\Windows\System\AruaQbe.exe
  C:\Windows\System\AruaQbe.exe
  2⤵
  PID:3256
- C:\Windows\System\tMIEqzy.exe
  C:\Windows\System\tMIEqzy.exe
  2⤵
  PID:3288
- C:\Windows\System\QQpEtsq.exe
  C:\Windows\System\QQpEtsq.exe
  2⤵
  PID:3324
- C:\Windows\System\ArBgItP.exe
  C:\Windows\System\ArBgItP.exe
  2⤵
  PID:3364
- C:\Windows\System\wDfwIxi.exe
  C:\Windows\System\wDfwIxi.exe
  2⤵
  PID:3404
- C:\Windows\System\QxZgPcO.exe
  C:\Windows\System\QxZgPcO.exe
  2⤵
  PID:3384
- C:\Windows\System\aqvDMAx.exe
  C:\Windows\System\aqvDMAx.exe
  2⤵
  PID:3480
- C:\Windows\System\wdLqGja.exe
  C:\Windows\System\wdLqGja.exe
  2⤵
  PID:3488
- C:\Windows\System\LHOVMwv.exe
  C:\Windows\System\LHOVMwv.exe
  2⤵
  PID:3520
- C:\Windows\System\RuPDneZ.exe
  C:\Windows\System\RuPDneZ.exe
  2⤵
  PID:3564
- C:\Windows\System\HBNVYwT.exe
  C:\Windows\System\HBNVYwT.exe
  2⤵
  PID:3600
- C:\Windows\System\MCixzNo.exe
  C:\Windows\System\MCixzNo.exe
  2⤵
  PID:3640
- C:\Windows\System\hdmmSKC.exe
  C:\Windows\System\hdmmSKC.exe
  2⤵
  PID:3624
- C:\Windows\System\lcCEAvN.exe
  C:\Windows\System\lcCEAvN.exe
  2⤵
  PID:3720
- C:\Windows\System\XIPnDgb.exe
  C:\Windows\System\XIPnDgb.exe
  2⤵
  PID:3664
- C:\Windows\System\VeWHyRc.exe
  C:\Windows\System\VeWHyRc.exe
  2⤵
  PID:3760
- C:\Windows\System\jLJGoAM.exe
  C:\Windows\System\jLJGoAM.exe
  2⤵
  PID:3780
- C:\Windows\System\aBtVAfb.exe
  C:\Windows\System\aBtVAfb.exe
  2⤵
  PID:3788
- C:\Windows\System\cZavGAm.exe
  C:\Windows\System\cZavGAm.exe
  2⤵
  PID:3844
- C:\Windows\System\qKBlhLu.exe
  C:\Windows\System\qKBlhLu.exe
  2⤵
  PID:2668
- C:\Windows\System\vTDhcsC.exe
  C:\Windows\System\vTDhcsC.exe
  2⤵
  PID:3956
- C:\Windows\System\NqQSazy.exe
  C:\Windows\System\NqQSazy.exe
  2⤵
  PID:3896
- C:\Windows\System\udyhVWl.exe
  C:\Windows\System\udyhVWl.exe
  2⤵
  PID:4000
- C:\Windows\System\ENClwNu.exe
  C:\Windows\System\ENClwNu.exe
  2⤵
  PID:3988
- C:\Windows\System\zKSqOnI.exe
  C:\Windows\System\zKSqOnI.exe
  2⤵
  PID:4044
- C:\Windows\System\kNqneNb.exe
  C:\Windows\System\kNqneNb.exe
  2⤵
  PID:4028
- C:\Windows\System\vFmqeSE.exe
  C:\Windows\System\vFmqeSE.exe
  2⤵
  PID:4060
- C:\Windows\System\HIbMNip.exe
  C:\Windows\System\HIbMNip.exe
  2⤵
  PID:1944
- C:\Windows\System\ndtYmUs.exe
  C:\Windows\System\ndtYmUs.exe
  2⤵
  PID:2112
- C:\Windows\System\McFtmeM.exe
  C:\Windows\System\McFtmeM.exe
  2⤵
  PID:236
- C:\Windows\System\DUzGfNY.exe
  C:\Windows\System\DUzGfNY.exe
  2⤵
  PID:3100
- C:\Windows\System\KyIKLJs.exe
  C:\Windows\System\KyIKLJs.exe
  2⤵
  PID:3136
- C:\Windows\System\YgZGLaO.exe
  C:\Windows\System\YgZGLaO.exe
  2⤵
  PID:3220
- C:\Windows\System\cxaTTdw.exe
  C:\Windows\System\cxaTTdw.exe
  2⤵
  PID:3180
- C:\Windows\System\efXyfZt.exe
  C:\Windows\System\efXyfZt.exe
  2⤵
  PID:3284
- C:\Windows\System\QXFQhBm.exe
  C:\Windows\System\QXFQhBm.exe
  2⤵
  PID:3400
- C:\Windows\System\ifmShHS.exe
  C:\Windows\System\ifmShHS.exe
  2⤵
  PID:3428
- C:\Windows\System\OXNDCnV.exe
  C:\Windows\System\OXNDCnV.exe
  2⤵
  PID:3380
- C:\Windows\System\XjXnhqJ.exe
  C:\Windows\System\XjXnhqJ.exe
  2⤵
  PID:3460
- C:\Windows\System\hlnLZsZ.exe
  C:\Windows\System\hlnLZsZ.exe
  2⤵
  PID:3264
- C:\Windows\System\UiSeFQj.exe
  C:\Windows\System\UiSeFQj.exe
  2⤵
  PID:3528
- C:\Windows\System\aJiBpgF.exe
  C:\Windows\System\aJiBpgF.exe
  2⤵
  PID:3660
- C:\Windows\System\nwfzVcR.exe
  C:\Windows\System\nwfzVcR.exe
  2⤵
  PID:3684
- C:\Windows\System\ChhBWmO.exe
  C:\Windows\System\ChhBWmO.exe
  2⤵
  PID:3820
- C:\Windows\System\jJaROhU.exe
  C:\Windows\System\jJaROhU.exe
  2⤵
  PID:3732
- C:\Windows\System\CPFHPul.exe
  C:\Windows\System\CPFHPul.exe
  2⤵
  PID:3904
- C:\Windows\System\SiDjJok.exe
  C:\Windows\System\SiDjJok.exe
  2⤵
  PID:3968
- C:\Windows\System\zMdiwGp.exe
  C:\Windows\System\zMdiwGp.exe
  2⤵
  PID:2172
- C:\Windows\System\PEadpew.exe
  C:\Windows\System\PEadpew.exe
  2⤵
  PID:2728
- C:\Windows\System\tXOoOUi.exe
  C:\Windows\System\tXOoOUi.exe
  2⤵
  PID:4020
- C:\Windows\System\mXrfiyB.exe
  C:\Windows\System\mXrfiyB.exe
  2⤵
  PID:4108
- C:\Windows\System\QMwfIfR.exe
  C:\Windows\System\QMwfIfR.exe
  2⤵
  PID:4132
- C:\Windows\System\QsKfnmz.exe
  C:\Windows\System\QsKfnmz.exe
  2⤵
  PID:4156
- C:\Windows\System\zIDktcm.exe
  C:\Windows\System\zIDktcm.exe
  2⤵
  PID:4176
- C:\Windows\System\IRpYGxx.exe
  C:\Windows\System\IRpYGxx.exe
  2⤵
  PID:4196
- C:\Windows\System\INEkFPw.exe
  C:\Windows\System\INEkFPw.exe
  2⤵
  PID:4216
- C:\Windows\System\XngbZvc.exe
  C:\Windows\System\XngbZvc.exe
  2⤵
  PID:4236
- C:\Windows\System\QalLCnU.exe
  C:\Windows\System\QalLCnU.exe
  2⤵
  PID:4256
- C:\Windows\System\sUJTQwI.exe
  C:\Windows\System\sUJTQwI.exe
  2⤵
  PID:4276
- C:\Windows\System\uJgwxLS.exe
  C:\Windows\System\uJgwxLS.exe
  2⤵
  PID:4296
- C:\Windows\System\VfmCCbh.exe
  C:\Windows\System\VfmCCbh.exe
  2⤵
  PID:4316
- C:\Windows\System\OPMrufO.exe
  C:\Windows\System\OPMrufO.exe
  2⤵
  PID:4336
- C:\Windows\System\VPywiWZ.exe
  C:\Windows\System\VPywiWZ.exe
  2⤵
  PID:4356
- C:\Windows\System\PNKmfys.exe
  C:\Windows\System\PNKmfys.exe
  2⤵
  PID:4376
- C:\Windows\System\HwwPiUG.exe
  C:\Windows\System\HwwPiUG.exe
  2⤵
  PID:4400
- C:\Windows\System\sGelvQX.exe
  C:\Windows\System\sGelvQX.exe
  2⤵
  PID:4420
- C:\Windows\System\cROJKqE.exe
  C:\Windows\System\cROJKqE.exe
  2⤵
  PID:4436
- C:\Windows\System\JXQCmer.exe
  C:\Windows\System\JXQCmer.exe
  2⤵
  PID:4456
- C:\Windows\System\FeszqNN.exe
  C:\Windows\System\FeszqNN.exe
  2⤵
  PID:4476
- C:\Windows\System\TEqqTpw.exe
  C:\Windows\System\TEqqTpw.exe
  2⤵
  PID:4500
- C:\Windows\System\czCMMUn.exe
  C:\Windows\System\czCMMUn.exe
  2⤵
  PID:4520
- C:\Windows\System\hZEdeoT.exe
  C:\Windows\System\hZEdeoT.exe
  2⤵
  PID:4536
- C:\Windows\System\uYFWZgN.exe
  C:\Windows\System\uYFWZgN.exe
  2⤵
  PID:4560
- C:\Windows\System\XHHaxcZ.exe
  C:\Windows\System\XHHaxcZ.exe
  2⤵
  PID:4580
- C:\Windows\System\DLXngFo.exe
  C:\Windows\System\DLXngFo.exe
  2⤵
  PID:4600
- C:\Windows\System\DJANmAn.exe
  C:\Windows\System\DJANmAn.exe
  2⤵
  PID:4620
- C:\Windows\System\xMBhKYz.exe
  C:\Windows\System\xMBhKYz.exe
  2⤵
  PID:4640
- C:\Windows\System\UuQmTUk.exe
  C:\Windows\System\UuQmTUk.exe
  2⤵
  PID:4660
- C:\Windows\System\GUbRTOn.exe
  C:\Windows\System\GUbRTOn.exe
  2⤵
  PID:4680
- C:\Windows\System\pOzSAsC.exe
  C:\Windows\System\pOzSAsC.exe
  2⤵
  PID:4700
- C:\Windows\System\EWXyqtS.exe
  C:\Windows\System\EWXyqtS.exe
  2⤵
  PID:4720
- C:\Windows\System\JBsWiDg.exe
  C:\Windows\System\JBsWiDg.exe
  2⤵
  PID:4736
- C:\Windows\System\NjCSVbZ.exe
  C:\Windows\System\NjCSVbZ.exe
  2⤵
  PID:4756
- C:\Windows\System\RPBhQSJ.exe
  C:\Windows\System\RPBhQSJ.exe
  2⤵
  PID:4780
- C:\Windows\System\tYHkpPx.exe
  C:\Windows\System\tYHkpPx.exe
  2⤵
  PID:4800
- C:\Windows\System\SgxUnzf.exe
  C:\Windows\System\SgxUnzf.exe
  2⤵
  PID:4816
- C:\Windows\System\VuRqAGZ.exe
  C:\Windows\System\VuRqAGZ.exe
  2⤵
  PID:4836
- C:\Windows\System\RZZKSPE.exe
  C:\Windows\System\RZZKSPE.exe
  2⤵
  PID:4860
- C:\Windows\System\LAsevRQ.exe
  C:\Windows\System\LAsevRQ.exe
  2⤵
  PID:4880
- C:\Windows\System\pEyphdy.exe
  C:\Windows\System\pEyphdy.exe
  2⤵
  PID:4896
- C:\Windows\System\IlEPOBi.exe
  C:\Windows\System\IlEPOBi.exe
  2⤵
  PID:4920
- C:\Windows\System\CJvjnUN.exe
  C:\Windows\System\CJvjnUN.exe
  2⤵
  PID:4936
- C:\Windows\System\WypeEdt.exe
  C:\Windows\System\WypeEdt.exe
  2⤵
  PID:4952
- C:\Windows\System\jMVqQxN.exe
  C:\Windows\System\jMVqQxN.exe
  2⤵
  PID:4976
- C:\Windows\System\hJvfcVv.exe
  C:\Windows\System\hJvfcVv.exe
  2⤵
  PID:4996
- C:\Windows\System\efsZQbY.exe
  C:\Windows\System\efsZQbY.exe
  2⤵
  PID:5016
- C:\Windows\System\dUFxHbp.exe
  C:\Windows\System\dUFxHbp.exe
  2⤵
  PID:5036
- C:\Windows\System\lNIJhKP.exe
  C:\Windows\System\lNIJhKP.exe
  2⤵
  PID:5056
- C:\Windows\System\RbjJXPv.exe
  C:\Windows\System\RbjJXPv.exe
  2⤵
  PID:5076
- C:\Windows\System\LvYBCUe.exe
  C:\Windows\System\LvYBCUe.exe
  2⤵
  PID:5096
- C:\Windows\System\WpehvPl.exe
  C:\Windows\System\WpehvPl.exe
  2⤵
  PID:5116
- C:\Windows\System\flgXNTu.exe
  C:\Windows\System\flgXNTu.exe
  2⤵
  PID:3244
- C:\Windows\System\BecsiVN.exe
  C:\Windows\System\BecsiVN.exe
  2⤵
  PID:1072
- C:\Windows\System\rkajwlV.exe
  C:\Windows\System\rkajwlV.exe
  2⤵
  PID:3112
- C:\Windows\System\rYNDOOm.exe
  C:\Windows\System\rYNDOOm.exe
  2⤵
  PID:3224
- C:\Windows\System\QXNXnsZ.exe
  C:\Windows\System\QXNXnsZ.exe
  2⤵
  PID:3360
- C:\Windows\System\LvSWOkX.exe
  C:\Windows\System\LvSWOkX.exe
  2⤵
  PID:3548
- C:\Windows\System\OikebQL.exe
  C:\Windows\System\OikebQL.exe
  2⤵
  PID:3560
- C:\Windows\System\HveJMvf.exe
  C:\Windows\System\HveJMvf.exe
  2⤵
  PID:3620
- C:\Windows\System\EDmMKVS.exe
  C:\Windows\System\EDmMKVS.exe
  2⤵
  PID:3804
- C:\Windows\System\UnmRNzg.exe
  C:\Windows\System\UnmRNzg.exe
  2⤵
  PID:3764
- C:\Windows\System\eROFCnA.exe
  C:\Windows\System\eROFCnA.exe
  2⤵
  PID:3840
- C:\Windows\System\RmyvmXO.exe
  C:\Windows\System\RmyvmXO.exe
  2⤵
  PID:4068
- C:\Windows\System\YtmeSfp.exe
  C:\Windows\System\YtmeSfp.exe
  2⤵
  PID:4048
- C:\Windows\System\golswyH.exe
  C:\Windows\System\golswyH.exe
  2⤵
  PID:1980
- C:\Windows\System\NtYbNHF.exe
  C:\Windows\System\NtYbNHF.exe
  2⤵
  PID:4116
- C:\Windows\System\EKBRUyT.exe
  C:\Windows\System\EKBRUyT.exe
  2⤵
  PID:4184
- C:\Windows\System\muOcEoV.exe
  C:\Windows\System\muOcEoV.exe
  2⤵
  PID:4172
- C:\Windows\System\YctfLRH.exe
  C:\Windows\System\YctfLRH.exe
  2⤵
  PID:4272
- C:\Windows\System\OURyelx.exe
  C:\Windows\System\OURyelx.exe
  2⤵
  PID:4252
- C:\Windows\System\TmivSrl.exe
  C:\Windows\System\TmivSrl.exe
  2⤵
  PID:4308
- C:\Windows\System\ExIcIsz.exe
  C:\Windows\System\ExIcIsz.exe
  2⤵
  PID:4324
- C:\Windows\System\xJvIcaj.exe
  C:\Windows\System\xJvIcaj.exe
  2⤵
  PID:4384
- C:\Windows\System\hYwswcs.exe
  C:\Windows\System\hYwswcs.exe
  2⤵
  PID:4368
- C:\Windows\System\BzUNekt.exe
  C:\Windows\System\BzUNekt.exe
  2⤵
  PID:4416
- C:\Windows\System\NIovhVw.exe
  C:\Windows\System\NIovhVw.exe
  2⤵
  PID:4508
- C:\Windows\System\BVmIniY.exe
  C:\Windows\System\BVmIniY.exe
  2⤵
  PID:4444
- C:\Windows\System\HParRKx.exe
  C:\Windows\System\HParRKx.exe
  2⤵
  PID:4552
- C:\Windows\System\qsKsVbI.exe
  C:\Windows\System\qsKsVbI.exe
  2⤵
  PID:4592
- C:\Windows\System\NwtYqPY.exe
  C:\Windows\System\NwtYqPY.exe
  2⤵
  PID:4568
- C:\Windows\System\sZAaxNx.exe
  C:\Windows\System\sZAaxNx.exe
  2⤵
  PID:4668
- C:\Windows\System\TsCpmCo.exe
  C:\Windows\System\TsCpmCo.exe
  2⤵
  PID:4612
- C:\Windows\System\MxHowKn.exe
  C:\Windows\System\MxHowKn.exe
  2⤵
  PID:4716
- C:\Windows\System\GKzUUKc.exe
  C:\Windows\System\GKzUUKc.exe
  2⤵
  PID:4696
- C:\Windows\System\jsMyDOl.exe
  C:\Windows\System\jsMyDOl.exe
  2⤵
  PID:4728
- C:\Windows\System\IPFXLey.exe
  C:\Windows\System\IPFXLey.exe
  2⤵
  PID:4768
- C:\Windows\System\pXJHssF.exe
  C:\Windows\System\pXJHssF.exe
  2⤵
  PID:4832
- C:\Windows\System\HJQrnyh.exe
  C:\Windows\System\HJQrnyh.exe
  2⤵
  PID:2876
- C:\Windows\System\WEuSSXn.exe
  C:\Windows\System\WEuSSXn.exe
  2⤵
  PID:4872
- C:\Windows\System\EZMWNJP.exe
  C:\Windows\System\EZMWNJP.exe
  2⤵
  PID:4856
- C:\Windows\System\yoRtBhx.exe
  C:\Windows\System\yoRtBhx.exe
  2⤵
  PID:4948
- C:\Windows\System\VGxnuSW.exe
  C:\Windows\System\VGxnuSW.exe
  2⤵
  PID:4988
- C:\Windows\System\ntBCvCH.exe
  C:\Windows\System\ntBCvCH.exe
  2⤵
  PID:5032
- C:\Windows\System\TcIZrsS.exe
  C:\Windows\System\TcIZrsS.exe
  2⤵
  PID:5008
- C:\Windows\System\wclXxrD.exe
  C:\Windows\System\wclXxrD.exe
  2⤵
  PID:5068
- C:\Windows\System\mSRcrNV.exe
  C:\Windows\System\mSRcrNV.exe
  2⤵
  PID:5108
- C:\Windows\System\gLaZqjH.exe
  C:\Windows\System\gLaZqjH.exe
  2⤵
  PID:5088
- C:\Windows\System\BxkPpvo.exe
  C:\Windows\System\BxkPpvo.exe
  2⤵
  PID:3080
- C:\Windows\System\vrMGZdN.exe
  C:\Windows\System\vrMGZdN.exe
  2⤵
  PID:3316
- C:\Windows\System\KZiuJvF.exe
  C:\Windows\System\KZiuJvF.exe
  2⤵
  PID:3408
- C:\Windows\System\JzKKbxB.exe
  C:\Windows\System\JzKKbxB.exe
  2⤵
  PID:3468
- C:\Windows\System\oIkueeL.exe
  C:\Windows\System\oIkueeL.exe
  2⤵
  PID:3568
- C:\Windows\System\OxyKQzi.exe
  C:\Windows\System\OxyKQzi.exe
  2⤵
  PID:3824
- C:\Windows\System\vbJcrgl.exe
  C:\Windows\System\vbJcrgl.exe
  2⤵
  PID:4104
- C:\Windows\System\sXhlHNv.exe
  C:\Windows\System\sXhlHNv.exe
  2⤵
  PID:4120
- C:\Windows\System\WbEkXrk.exe
  C:\Windows\System\WbEkXrk.exe
  2⤵
  PID:4144
- C:\Windows\System\WsXOdQf.exe
  C:\Windows\System\WsXOdQf.exe
  2⤵
  PID:4224
- C:\Windows\System\iydSjec.exe
  C:\Windows\System\iydSjec.exe
  2⤵
  PID:4268
- C:\Windows\System\czSKoqC.exe
  C:\Windows\System\czSKoqC.exe
  2⤵
  PID:4284
- C:\Windows\System\JjsertF.exe
  C:\Windows\System\JjsertF.exe
  2⤵
  PID:4348
- C:\Windows\System\FbxYYKC.exe
  C:\Windows\System\FbxYYKC.exe
  2⤵
  PID:3268
- C:\Windows\System\aWRQSUi.exe
  C:\Windows\System\aWRQSUi.exe
  2⤵
  PID:4408
- C:\Windows\System\uuzfIyv.exe
  C:\Windows\System\uuzfIyv.exe
  2⤵
  PID:4472
- C:\Windows\System\PwJvyZj.exe
  C:\Windows\System\PwJvyZj.exe
  2⤵
  PID:2864
- C:\Windows\System\rtAggWQ.exe
  C:\Windows\System\rtAggWQ.exe
  2⤵
  PID:4544
- C:\Windows\System\nPDnFdN.exe
  C:\Windows\System\nPDnFdN.exe
  2⤵
  PID:4632
- C:\Windows\System\tJvryKO.exe
  C:\Windows\System\tJvryKO.exe
  2⤵
  PID:4672
- C:\Windows\System\sZNjILD.exe
  C:\Windows\System\sZNjILD.exe
  2⤵
  PID:4692
- C:\Windows\System\JwgPxUD.exe
  C:\Windows\System\JwgPxUD.exe
  2⤵
  PID:4788
- C:\Windows\System\mNOKkGN.exe
  C:\Windows\System\mNOKkGN.exe
  2⤵
  PID:2712
- C:\Windows\System\ONtMAkX.exe
  C:\Windows\System\ONtMAkX.exe
  2⤵
  PID:4808
- C:\Windows\System\nlldLcZ.exe
  C:\Windows\System\nlldLcZ.exe
  2⤵
  PID:4912
- C:\Windows\System\BpESJnv.exe
  C:\Windows\System\BpESJnv.exe
  2⤵
  PID:2736
- C:\Windows\System\ZVwBHqx.exe
  C:\Windows\System\ZVwBHqx.exe
  2⤵
  PID:4932
- C:\Windows\System\vMzkgBk.exe
  C:\Windows\System\vMzkgBk.exe
  2⤵
  PID:2732
- C:\Windows\System\MkjrCFN.exe
  C:\Windows\System\MkjrCFN.exe
  2⤵
  PID:2948
- C:\Windows\System\bYTuoAJ.exe
  C:\Windows\System\bYTuoAJ.exe
  2⤵
  PID:3304
- C:\Windows\System\ZYcIoFw.exe
  C:\Windows\System\ZYcIoFw.exe
  2⤵
  PID:2476
- C:\Windows\System\hQXocuU.exe
  C:\Windows\System\hQXocuU.exe
  2⤵
  PID:3544
- C:\Windows\System\zfNgeSk.exe
  C:\Windows\System\zfNgeSk.exe
  2⤵
  PID:2336
- C:\Windows\System\mluiURH.exe
  C:\Windows\System\mluiURH.exe
  2⤵
  PID:3740
- C:\Windows\System\QKewIpX.exe
  C:\Windows\System\QKewIpX.exe
  2⤵
  PID:3964
- C:\Windows\System\NnLHLPu.exe
  C:\Windows\System\NnLHLPu.exe
  2⤵
  PID:2612
- C:\Windows\System\XCawRwo.exe
  C:\Windows\System\XCawRwo.exe
  2⤵
  PID:4212
- C:\Windows\System\BkcGYUM.exe
  C:\Windows\System\BkcGYUM.exe
  2⤵
  PID:4372
- C:\Windows\System\IsliGEK.exe
  C:\Windows\System\IsliGEK.exe
  2⤵
  PID:1652
- C:\Windows\System\MAUtaMN.exe
  C:\Windows\System\MAUtaMN.exe
  2⤵
  PID:2784
- C:\Windows\System\aJDiKjC.exe
  C:\Windows\System\aJDiKjC.exe
  2⤵
  PID:4596
- C:\Windows\System\BbLOobg.exe
  C:\Windows\System\BbLOobg.exe
  2⤵
  PID:4448
- C:\Windows\System\uARnEnI.exe
  C:\Windows\System\uARnEnI.exe
  2⤵
  PID:4648
- C:\Windows\System\CvfmbpT.exe
  C:\Windows\System\CvfmbpT.exe
  2⤵
  PID:4628
- C:\Windows\System\OhCxoWc.exe
  C:\Windows\System\OhCxoWc.exe
  2⤵
  PID:1624
- C:\Windows\System\fGgIdJU.exe
  C:\Windows\System\fGgIdJU.exe
  2⤵
  PID:4776
- C:\Windows\System\vAvsUpV.exe
  C:\Windows\System\vAvsUpV.exe
  2⤵
  PID:4772
- C:\Windows\System\LzaWJEd.exe
  C:\Windows\System\LzaWJEd.exe
  2⤵
  PID:5084
- C:\Windows\System\FdKPWQQ.exe
  C:\Windows\System\FdKPWQQ.exe
  2⤵
  PID:2744
- C:\Windows\System\DlsOcra.exe
  C:\Windows\System\DlsOcra.exe
  2⤵
  PID:4972
- C:\Windows\System\PrYGnkq.exe
  C:\Windows\System\PrYGnkq.exe
  2⤵
  PID:3344
- C:\Windows\System\ndchVmb.exe
  C:\Windows\System\ndchVmb.exe
  2⤵
  PID:3184
- C:\Windows\System\rHKwGwn.exe
  C:\Windows\System\rHKwGwn.exe
  2⤵
  PID:4164
- C:\Windows\System\OosTvEI.exe
  C:\Windows\System\OosTvEI.exe
  2⤵
  PID:4064
- C:\Windows\System\EgMpPZZ.exe
  C:\Windows\System\EgMpPZZ.exe
  2⤵
  PID:1672
- C:\Windows\System\tHRUwlY.exe
  C:\Windows\System\tHRUwlY.exe
  2⤵
  PID:4124
- C:\Windows\System\xVWBXdu.exe
  C:\Windows\System\xVWBXdu.exe
  2⤵
  PID:4228
- C:\Windows\System\kJQzzdW.exe
  C:\Windows\System\kJQzzdW.exe
  2⤵
  PID:2564
- C:\Windows\System\WuDgDky.exe
  C:\Windows\System\WuDgDky.exe
  2⤵
  PID:1656
- C:\Windows\System\AnlUxtr.exe
  C:\Windows\System\AnlUxtr.exe
  2⤵
  PID:2844
- C:\Windows\System\xtNfLEQ.exe
  C:\Windows\System\xtNfLEQ.exe
  2⤵
  PID:2768
- C:\Windows\System\HxHflMh.exe
  C:\Windows\System\HxHflMh.exe
  2⤵
  PID:4752
- C:\Windows\System\bwAQDCK.exe
  C:\Windows\System\bwAQDCK.exe
  2⤵
  PID:4528
- C:\Windows\System\riOfMXC.exe
  C:\Windows\System\riOfMXC.exe
  2⤵
  PID:2792
- C:\Windows\System\eroTdrE.exe
  C:\Windows\System\eroTdrE.exe
  2⤵
  PID:5064
- C:\Windows\System\vhQVRdB.exe
  C:\Windows\System\vhQVRdB.exe
  2⤵
  PID:1536
- C:\Windows\System\aIkIEsS.exe
  C:\Windows\System\aIkIEsS.exe
  2⤵
  PID:1552
- C:\Windows\System\rBxChCV.exe
  C:\Windows\System\rBxChCV.exe
  2⤵
  PID:4968
- C:\Windows\System\jKXhXxB.exe
  C:\Windows\System\jKXhXxB.exe
  2⤵
  PID:3444
- C:\Windows\System\FwdVvOe.exe
  C:\Windows\System\FwdVvOe.exe
  2⤵
  PID:1340
- C:\Windows\System\fyhhtdd.exe
  C:\Windows\System\fyhhtdd.exe
  2⤵
  PID:4588
- C:\Windows\System\fkPddCB.exe
  C:\Windows\System\fkPddCB.exe
  2⤵
  PID:4576
- C:\Windows\System\etgPzOQ.exe
  C:\Windows\System\etgPzOQ.exe
  2⤵
  PID:1948
- C:\Windows\System\vnjIRzl.exe
  C:\Windows\System\vnjIRzl.exe
  2⤵
  PID:4396
- C:\Windows\System\HnmOwmF.exe
  C:\Windows\System\HnmOwmF.exe
  2⤵
  PID:2212
- C:\Windows\System\ESmmXvV.exe
  C:\Windows\System\ESmmXvV.exe
  2⤵
  PID:4328
- C:\Windows\System\ABgjmnJ.exe
  C:\Windows\System\ABgjmnJ.exe
  2⤵
  PID:2352
- C:\Windows\System\MJliTtm.exe
  C:\Windows\System\MJliTtm.exe
  2⤵
  PID:2636
- C:\Windows\System\VMcxCeR.exe
  C:\Windows\System\VMcxCeR.exe
  2⤵
  PID:4960
- C:\Windows\System\SPDdrWO.exe
  C:\Windows\System\SPDdrWO.exe
  2⤵
  PID:3084
- C:\Windows\System\ldcvRtX.exe
  C:\Windows\System\ldcvRtX.exe
  2⤵
  PID:2540
- C:\Windows\System\dBcKIQT.exe
  C:\Windows\System\dBcKIQT.exe
  2⤵
  PID:5012
- C:\Windows\System\OTTSWTv.exe
  C:\Windows\System\OTTSWTv.exe
  2⤵
  PID:4652
- C:\Windows\System\mNHDiiS.exe
  C:\Windows\System\mNHDiiS.exe
  2⤵
  PID:4468
- C:\Windows\System\VtcjldX.exe
  C:\Windows\System\VtcjldX.exe
  2⤵
  PID:2920
- C:\Windows\System\GzcDpLr.exe
  C:\Windows\System\GzcDpLr.exe
  2⤵
  PID:2764
- C:\Windows\System\OocXUni.exe
  C:\Windows\System\OocXUni.exe
  2⤵
  PID:4868
- C:\Windows\System\AyYZHMV.exe
  C:\Windows\System\AyYZHMV.exe
  2⤵
  PID:4512
- C:\Windows\System\uPsxTcv.exe
  C:\Windows\System\uPsxTcv.exe
  2⤵
  PID:2600
- C:\Windows\System\jMHZtWz.exe
  C:\Windows\System\jMHZtWz.exe
  2⤵
  PID:1928
- C:\Windows\System\VpOigvB.exe
  C:\Windows\System\VpOigvB.exe
  2⤵
  PID:2568
- C:\Windows\System\zNSdCNM.exe
  C:\Windows\System\zNSdCNM.exe
  2⤵
  PID:3924
- C:\Windows\System\daElLcA.exe
  C:\Windows\System\daElLcA.exe
  2⤵
  PID:2828
- C:\Windows\System\Agnzufr.exe
  C:\Windows\System\Agnzufr.exe
  2⤵
  PID:5124
- C:\Windows\System\DgwNaNf.exe
  C:\Windows\System\DgwNaNf.exe
  2⤵
  PID:5144
- C:\Windows\System\tqlYgKj.exe
  C:\Windows\System\tqlYgKj.exe
  2⤵
  PID:5164
- C:\Windows\System\bqdGynX.exe
  C:\Windows\System\bqdGynX.exe
  2⤵
  PID:5184
- C:\Windows\System\kocnHTD.exe
  C:\Windows\System\kocnHTD.exe
  2⤵
  PID:5204
- C:\Windows\System\YMRDyOT.exe
  C:\Windows\System\YMRDyOT.exe
  2⤵
  PID:5224
- C:\Windows\System\XDoFbzg.exe
  C:\Windows\System\XDoFbzg.exe
  2⤵
  PID:5244
- C:\Windows\System\XPIxQQM.exe
  C:\Windows\System\XPIxQQM.exe
  2⤵
  PID:5264
- C:\Windows\System\rFLSXlF.exe
  C:\Windows\System\rFLSXlF.exe
  2⤵
  PID:5284
- C:\Windows\System\iZsVDbx.exe
  C:\Windows\System\iZsVDbx.exe
  2⤵
  PID:5304
- C:\Windows\System\DfaWYDd.exe
  C:\Windows\System\DfaWYDd.exe
  2⤵
  PID:5328
- C:\Windows\System\fenNXBD.exe
  C:\Windows\System\fenNXBD.exe
  2⤵
  PID:5348
- C:\Windows\System\fUYAGIo.exe
  C:\Windows\System\fUYAGIo.exe
  2⤵
  PID:5364
- C:\Windows\System\wylqVCW.exe
  C:\Windows\System\wylqVCW.exe
  2⤵
  PID:5400
- C:\Windows\System\ZSHtmHn.exe
  C:\Windows\System\ZSHtmHn.exe
  2⤵
  PID:5416
- C:\Windows\System\royyQjx.exe
  C:\Windows\System\royyQjx.exe
  2⤵
  PID:5432
- C:\Windows\System\wvWEWRu.exe
  C:\Windows\System\wvWEWRu.exe
  2⤵
  PID:5452
- C:\Windows\System\nTjaumq.exe
  C:\Windows\System\nTjaumq.exe
  2⤵
  PID:5472
- C:\Windows\System\gAFKqLG.exe
  C:\Windows\System\gAFKqLG.exe
  2⤵
  PID:5488
- C:\Windows\System\RSFONBZ.exe
  C:\Windows\System\RSFONBZ.exe
  2⤵
  PID:5504
- C:\Windows\System\EVkvYyh.exe
  C:\Windows\System\EVkvYyh.exe
  2⤵
  PID:5524
- C:\Windows\System\cOirfST.exe
  C:\Windows\System\cOirfST.exe
  2⤵
  PID:5540
- C:\Windows\System\lIdGmyO.exe
  C:\Windows\System\lIdGmyO.exe
  2⤵
  PID:5564
- C:\Windows\System\tHryWOv.exe
  C:\Windows\System\tHryWOv.exe
  2⤵
  PID:5588
- C:\Windows\System\LxojPZR.exe
  C:\Windows\System\LxojPZR.exe
  2⤵
  PID:5604
- C:\Windows\System\GjqZboy.exe
  C:\Windows\System\GjqZboy.exe
  2⤵
  PID:5620
- C:\Windows\System\ylohktX.exe
  C:\Windows\System\ylohktX.exe
  2⤵
  PID:5636
- C:\Windows\System\MHaaowu.exe
  C:\Windows\System\MHaaowu.exe
  2⤵
  PID:5652
- C:\Windows\System\TKBLZfk.exe
  C:\Windows\System\TKBLZfk.exe
  2⤵
  PID:5668
- C:\Windows\System\mgoItsI.exe
  C:\Windows\System\mgoItsI.exe
  2⤵
  PID:5684
- C:\Windows\System\rBvzvej.exe
  C:\Windows\System\rBvzvej.exe
  2⤵
  PID:5700
- C:\Windows\System\NgGRBNB.exe
  C:\Windows\System\NgGRBNB.exe
  2⤵
  PID:5716
- C:\Windows\System\NgdHzPS.exe
  C:\Windows\System\NgdHzPS.exe
  2⤵
  PID:5732
- C:\Windows\System\ZmpdSpP.exe
  C:\Windows\System\ZmpdSpP.exe
  2⤵
  PID:5756
- C:\Windows\System\szDtsQc.exe
  C:\Windows\System\szDtsQc.exe
  2⤵
  PID:5792
- C:\Windows\System\YaLgZev.exe
  C:\Windows\System\YaLgZev.exe
  2⤵
  PID:5828
- C:\Windows\System\EtWlTEp.exe
  C:\Windows\System\EtWlTEp.exe
  2⤵
  PID:5848
- C:\Windows\System\wClZQiF.exe
  C:\Windows\System\wClZQiF.exe
  2⤵
  PID:5864
- C:\Windows\System\uTblNyK.exe
  C:\Windows\System\uTblNyK.exe
  2⤵
  PID:5880
- C:\Windows\System\ReLUdRJ.exe
  C:\Windows\System\ReLUdRJ.exe
  2⤵
  PID:5896
- C:\Windows\System\aSbIqZA.exe
  C:\Windows\System\aSbIqZA.exe
  2⤵
  PID:5940
- C:\Windows\System\HjPPZVE.exe
  C:\Windows\System\HjPPZVE.exe
  2⤵
  PID:5960
- C:\Windows\System\NsVqoDu.exe
  C:\Windows\System\NsVqoDu.exe
  2⤵
  PID:5976
- C:\Windows\System\xJqHqvA.exe
  C:\Windows\System\xJqHqvA.exe
  2⤵
  PID:5996
- C:\Windows\System\WuangMS.exe
  C:\Windows\System\WuangMS.exe
  2⤵
  PID:6012
- C:\Windows\System\IePBdoc.exe
  C:\Windows\System\IePBdoc.exe
  2⤵
  PID:6028
- C:\Windows\System\BhBsquM.exe
  C:\Windows\System\BhBsquM.exe
  2⤵
  PID:6044
- C:\Windows\System\hOQQraf.exe
  C:\Windows\System\hOQQraf.exe
  2⤵
  PID:6060
- C:\Windows\System\OxFbOJX.exe
  C:\Windows\System\OxFbOJX.exe
  2⤵
  PID:6104
- C:\Windows\System\pixcBao.exe
  C:\Windows\System\pixcBao.exe
  2⤵
  PID:6120
- C:\Windows\System\iIrvame.exe
  C:\Windows\System\iIrvame.exe
  2⤵
  PID:2548
- C:\Windows\System\HEBJIbI.exe
  C:\Windows\System\HEBJIbI.exe
  2⤵
  PID:4944
- C:\Windows\System\MpLxcte.exe
  C:\Windows\System\MpLxcte.exe
  2⤵
  PID:4140
- C:\Windows\System\sJKZgCa.exe
  C:\Windows\System\sJKZgCa.exe
  2⤵
  PID:5136
- C:\Windows\System\cdCdkpz.exe
  C:\Windows\System\cdCdkpz.exe
  2⤵
  PID:5200
- C:\Windows\System\YcgeXEW.exe
  C:\Windows\System\YcgeXEW.exe
  2⤵
  PID:5240
- C:\Windows\System\ahXHifd.exe
  C:\Windows\System\ahXHifd.exe
  2⤵
  PID:5252
- C:\Windows\System\eENCwPm.exe
  C:\Windows\System\eENCwPm.exe
  2⤵
  PID:5316
- C:\Windows\System\dBjbvaC.exe
  C:\Windows\System\dBjbvaC.exe
  2⤵
  PID:5292
- C:\Windows\System\dTVylWp.exe
  C:\Windows\System\dTVylWp.exe
  2⤵
  PID:2440
- C:\Windows\System\LXppQQT.exe
  C:\Windows\System\LXppQQT.exe
  2⤵
  PID:5340
- C:\Windows\System\ZRPifIM.exe
  C:\Windows\System\ZRPifIM.exe
  2⤵
  PID:5384
- C:\Windows\System\FUUfUYo.exe
  C:\Windows\System\FUUfUYo.exe
  2⤵
  PID:2276
- C:\Windows\System\pjuXJvq.exe
  C:\Windows\System\pjuXJvq.exe
  2⤵
  PID:848
- C:\Windows\System\MPzZGKH.exe
  C:\Windows\System\MPzZGKH.exe
  2⤵
  PID:2892
- C:\Windows\System\WUXHDQu.exe
  C:\Windows\System\WUXHDQu.exe
  2⤵
  PID:2444
- C:\Windows\System\wjHkqjr.exe
  C:\Windows\System\wjHkqjr.exe
  2⤵
  PID:2924
- C:\Windows\System\cRPSObf.exe
  C:\Windows\System\cRPSObf.exe
  2⤵
  PID:5412
- C:\Windows\System\kIlDVLX.exe
  C:\Windows\System\kIlDVLX.exe
  2⤵
  PID:5428
- C:\Windows\System\liQewMR.exe
  C:\Windows\System\liQewMR.exe
  2⤵
  PID:5548
- C:\Windows\System\CgCMNjb.exe
  C:\Windows\System\CgCMNjb.exe
  2⤵
  PID:5552
- C:\Windows\System\jeRyQQX.exe
  C:\Windows\System\jeRyQQX.exe
  2⤵
  PID:5576
- C:\Windows\System\RAmEcWs.exe
  C:\Windows\System\RAmEcWs.exe
  2⤵
  PID:5648
- C:\Windows\System\NlWGbgl.exe
  C:\Windows\System\NlWGbgl.exe
  2⤵
  PID:5632
- C:\Windows\System\VnUegLK.exe
  C:\Windows\System\VnUegLK.exe
  2⤵
  PID:5724
- C:\Windows\System\uruSfRR.exe
  C:\Windows\System\uruSfRR.exe
  2⤵
  PID:5740
- C:\Windows\System\iuMonQw.exe
  C:\Windows\System\iuMonQw.exe
  2⤵
  PID:5572
- C:\Windows\System\YTmynir.exe
  C:\Windows\System\YTmynir.exe
  2⤵
  PID:5780
- C:\Windows\System\QStqovq.exe
  C:\Windows\System\QStqovq.exe
  2⤵
  PID:5876
- C:\Windows\System\Znyrats.exe
  C:\Windows\System\Znyrats.exe
  2⤵
  PID:5808
- C:\Windows\System\HuRXwpP.exe
  C:\Windows\System\HuRXwpP.exe
  2⤵
  PID:5932
- C:\Windows\System\XslCHFf.exe
  C:\Windows\System\XslCHFf.exe
  2⤵
  PID:5856
- C:\Windows\System\ObHxwER.exe
  C:\Windows\System\ObHxwER.exe
  2⤵
  PID:6068
- C:\Windows\System\aZpqvFF.exe
  C:\Windows\System\aZpqvFF.exe
  2⤵
  PID:6092
- C:\Windows\System\aORJzQF.exe
  C:\Windows\System\aORJzQF.exe
  2⤵
  PID:5952
- C:\Windows\System\IYjUzdd.exe
  C:\Windows\System\IYjUzdd.exe
  2⤵
  PID:6100
- C:\Windows\System\DbNdeYR.exe
  C:\Windows\System\DbNdeYR.exe
  2⤵
  PID:6136
- C:\Windows\System\SdlHyKo.exe
  C:\Windows\System\SdlHyKo.exe
  2⤵
  PID:5992
- C:\Windows\System\vATvNTg.exe
  C:\Windows\System\vATvNTg.exe
  2⤵
  PID:4244
- C:\Windows\System\JnqHWVO.exe
  C:\Windows\System\JnqHWVO.exe
  2⤵
  PID:5212
- C:\Windows\System\Tyjqxwd.exe
  C:\Windows\System\Tyjqxwd.exe
  2⤵
  PID:5272
- C:\Windows\System\UoBNEVm.exe
  C:\Windows\System\UoBNEVm.exe
  2⤵
  PID:5176
- C:\Windows\System\XcAwdAu.exe
  C:\Windows\System\XcAwdAu.exe
  2⤵
  PID:5172
- C:\Windows\System\pMuohYw.exe
  C:\Windows\System\pMuohYw.exe
  2⤵
  PID:2464
- C:\Windows\System\nvMJEek.exe
  C:\Windows\System\nvMJEek.exe
  2⤵
  PID:5336
- C:\Windows\System\VOjnozf.exe
  C:\Windows\System\VOjnozf.exe
  2⤵
  PID:5376
- C:\Windows\System\bjYGJCF.exe
  C:\Windows\System\bjYGJCF.exe
  2⤵
  PID:2936
- C:\Windows\System\BYVoxrl.exe
  C:\Windows\System\BYVoxrl.exe
  2⤵
  PID:1572
- C:\Windows\System\dbLKURk.exe
  C:\Windows\System\dbLKURk.exe
  2⤵
  PID:5460
- C:\Windows\System\rqcnYDX.exe
  C:\Windows\System\rqcnYDX.exe
  2⤵
  PID:5396
- C:\Windows\System\WNOYFlV.exe
  C:\Windows\System\WNOYFlV.exe
  2⤵
  PID:5516
- C:\Windows\System\ujzyBYK.exe
  C:\Windows\System\ujzyBYK.exe
  2⤵
  PID:5520
- C:\Windows\System\iOOpFhX.exe
  C:\Windows\System\iOOpFhX.exe
  2⤵
  PID:5788
- C:\Windows\System\KwKLUVP.exe
  C:\Windows\System\KwKLUVP.exe
  2⤵
  PID:5840
- C:\Windows\System\vrSvDBp.exe
  C:\Windows\System\vrSvDBp.exe
  2⤵
  PID:5744
- C:\Windows\System\pwovVEw.exe
  C:\Windows\System\pwovVEw.exe
  2⤵
  PID:5968
- C:\Windows\System\zKrmApl.exe
  C:\Windows\System\zKrmApl.exe
  2⤵
  PID:5820
- C:\Windows\System\khVxgbk.exe
  C:\Windows\System\khVxgbk.exe
  2⤵
  PID:6040
- C:\Windows\System\BaabCLQ.exe
  C:\Windows\System\BaabCLQ.exe
  2⤵
  PID:5948
- C:\Windows\System\UVTIbOm.exe
  C:\Windows\System\UVTIbOm.exe
  2⤵
  PID:6096
- C:\Windows\System\LJSsTgE.exe
  C:\Windows\System\LJSsTgE.exe
  2⤵
  PID:5216
- C:\Windows\System\uqQRtKj.exe
  C:\Windows\System\uqQRtKj.exe
  2⤵
  PID:5988
- C:\Windows\System\rjlZHJa.exe
  C:\Windows\System\rjlZHJa.exe
  2⤵
  PID:2724
- C:\Windows\System\yFEAzlA.exe
  C:\Windows\System\yFEAzlA.exe
  2⤵
  PID:5312
- C:\Windows\System\kascreM.exe
  C:\Windows\System\kascreM.exe
  2⤵
  PID:6116
- C:\Windows\System\basgxkl.exe
  C:\Windows\System\basgxkl.exe
  2⤵
  PID:1240
- C:\Windows\System\RPzymkp.exe
  C:\Windows\System\RPzymkp.exe
  2⤵
  PID:2716
- C:\Windows\System\uvSsMFA.exe
  C:\Windows\System\uvSsMFA.exe
  2⤵
  PID:5360
- C:\Windows\System\PrDpKqH.exe
  C:\Windows\System\PrDpKqH.exe
  2⤵
  PID:5644
- C:\Windows\System\bpvsjcC.exe
  C:\Windows\System\bpvsjcC.exe
  2⤵
  PID:5692
- C:\Windows\System\pZLHIfR.exe
  C:\Windows\System\pZLHIfR.exe
  2⤵
  PID:5924
- C:\Windows\System\IMEuChf.exe
  C:\Windows\System\IMEuChf.exe
  2⤵
  PID:5532
- C:\Windows\System\lbKcdgw.exe
  C:\Windows\System\lbKcdgw.exe
  2⤵
  PID:5916
- C:\Windows\System\OXJSDyv.exe
  C:\Windows\System\OXJSDyv.exe
  2⤵
  PID:5448
- C:\Windows\System\gbqXKwL.exe
  C:\Windows\System\gbqXKwL.exe
  2⤵
  PID:5392
- C:\Windows\System\ruJOPqp.exe
  C:\Windows\System\ruJOPqp.exe
  2⤵
  PID:5140
- C:\Windows\System\PTXbMhR.exe
  C:\Windows\System\PTXbMhR.exe
  2⤵
  PID:5708
- C:\Windows\System\JejlAXB.exe
  C:\Windows\System\JejlAXB.exe
  2⤵
  PID:5616
- C:\Windows\System\zcDWDxl.exe
  C:\Windows\System\zcDWDxl.exe
  2⤵
  PID:5748
- C:\Windows\System\WhHHDNu.exe
  C:\Windows\System\WhHHDNu.exe
  2⤵
  PID:6008
- C:\Windows\System\DOyHNdK.exe
  C:\Windows\System\DOyHNdK.exe
  2⤵
  PID:5424
- C:\Windows\System\iVXMwmT.exe
  C:\Windows\System\iVXMwmT.exe
  2⤵
  PID:1044
- C:\Windows\System\oYxYKOc.exe
  C:\Windows\System\oYxYKOc.exe
  2⤵
  PID:2104
- C:\Windows\System\YCYYoqV.exe
  C:\Windows\System\YCYYoqV.exe
  2⤵
  PID:5872
- C:\Windows\System\rNjZahd.exe
  C:\Windows\System\rNjZahd.exe
  2⤵
  PID:5836
- C:\Windows\System\ZQTDGBk.exe
  C:\Windows\System\ZQTDGBk.exe
  2⤵
  PID:5480
- C:\Windows\System\hGMnxdy.exe
  C:\Windows\System\hGMnxdy.exe
  2⤵
  PID:5984
- C:\Windows\System\dPxVSMx.exe
  C:\Windows\System\dPxVSMx.exe
  2⤵
  PID:2624
- C:\Windows\System\OjfSEDP.exe
  C:\Windows\System\OjfSEDP.exe
  2⤵
  PID:5260
- C:\Windows\System\WFzdzln.exe
  C:\Windows\System\WFzdzln.exe
  2⤵
  PID:5696
- C:\Windows\System\GAZRDzk.exe
  C:\Windows\System\GAZRDzk.exe
  2⤵
  PID:6160
- C:\Windows\System\DHvcOmi.exe
  C:\Windows\System\DHvcOmi.exe
  2⤵
  PID:6188
- C:\Windows\System\xKJcxKp.exe
  C:\Windows\System\xKJcxKp.exe
  2⤵
  PID:6204
- C:\Windows\System\NYWHYbt.exe
  C:\Windows\System\NYWHYbt.exe
  2⤵
  PID:6224
- C:\Windows\System\GEzrrKF.exe
  C:\Windows\System\GEzrrKF.exe
  2⤵
  PID:6240
- C:\Windows\System\olBbCwB.exe
  C:\Windows\System\olBbCwB.exe
  2⤵
  PID:6256
- C:\Windows\System\iZZkHJP.exe
  C:\Windows\System\iZZkHJP.exe
  2⤵
  PID:6272
- C:\Windows\System\BsTcYjq.exe
  C:\Windows\System\BsTcYjq.exe
  2⤵
  PID:6296
- C:\Windows\System\NcdQZcE.exe
  C:\Windows\System\NcdQZcE.exe
  2⤵
  PID:6312
- C:\Windows\System\fBZVZZm.exe
  C:\Windows\System\fBZVZZm.exe
  2⤵
  PID:6328
- C:\Windows\System\PGfVNQn.exe
  C:\Windows\System\PGfVNQn.exe
  2⤵
  PID:6348
- C:\Windows\System\zRLvUWA.exe
  C:\Windows\System\zRLvUWA.exe
  2⤵
  PID:6364
- C:\Windows\System\yNvWIOJ.exe
  C:\Windows\System\yNvWIOJ.exe
  2⤵
  PID:6380
- C:\Windows\System\OHAegEL.exe
  C:\Windows\System\OHAegEL.exe
  2⤵
  PID:6404
- C:\Windows\System\bxuXzpI.exe
  C:\Windows\System\bxuXzpI.exe
  2⤵
  PID:6424
- C:\Windows\System\NbxVnpK.exe
  C:\Windows\System\NbxVnpK.exe
  2⤵
  PID:6440
- C:\Windows\System\FixvNPQ.exe
  C:\Windows\System\FixvNPQ.exe
  2⤵
  PID:6488
- C:\Windows\System\nXMEJcG.exe
  C:\Windows\System\nXMEJcG.exe
  2⤵
  PID:6508
- C:\Windows\System\MnyzUhU.exe
  C:\Windows\System\MnyzUhU.exe
  2⤵
  PID:6528
- C:\Windows\System\MndIfZM.exe
  C:\Windows\System\MndIfZM.exe
  2⤵
  PID:6548
- C:\Windows\System\LvehpaK.exe
  C:\Windows\System\LvehpaK.exe
  2⤵
  PID:6564
- C:\Windows\System\WEmdyYm.exe
  C:\Windows\System\WEmdyYm.exe
  2⤵
  PID:6580
- C:\Windows\System\puILlva.exe
  C:\Windows\System\puILlva.exe
  2⤵
  PID:6600
- C:\Windows\System\cqfEGnH.exe
  C:\Windows\System\cqfEGnH.exe
  2⤵
  PID:6620
- C:\Windows\System\yWkgKNC.exe
  C:\Windows\System\yWkgKNC.exe
  2⤵
  PID:6640
- C:\Windows\System\eaIaDnF.exe
  C:\Windows\System\eaIaDnF.exe
  2⤵
  PID:6656
- C:\Windows\System\KCAjoSL.exe
  C:\Windows\System\KCAjoSL.exe
  2⤵
  PID:6676
- C:\Windows\System\mOqKIrT.exe
  C:\Windows\System\mOqKIrT.exe
  2⤵
  PID:6696
- C:\Windows\System\umBNVCf.exe
  C:\Windows\System\umBNVCf.exe
  2⤵
  PID:6720
- C:\Windows\System\bdGQwRT.exe
  C:\Windows\System\bdGQwRT.exe
  2⤵
  PID:6744
- C:\Windows\System\fDKuhIu.exe
  C:\Windows\System\fDKuhIu.exe
  2⤵
  PID:6764
- C:\Windows\System\ARTxZCE.exe
  C:\Windows\System\ARTxZCE.exe
  2⤵
  PID:6784
- C:\Windows\System\CbhuEJa.exe
  C:\Windows\System\CbhuEJa.exe
  2⤵
  PID:6800
- C:\Windows\System\aGwnfgy.exe
  C:\Windows\System\aGwnfgy.exe
  2⤵
  PID:6844
- C:\Windows\System\eFJFMor.exe
  C:\Windows\System\eFJFMor.exe
  2⤵
  PID:6860
- C:\Windows\System\xMVFMPF.exe
  C:\Windows\System\xMVFMPF.exe
  2⤵
  PID:6880
- C:\Windows\System\QJmZRKY.exe
  C:\Windows\System\QJmZRKY.exe
  2⤵
  PID:6896
- C:\Windows\System\kYZfwuz.exe
  C:\Windows\System\kYZfwuz.exe
  2⤵
  PID:6912
- C:\Windows\System\GUcxlsV.exe
  C:\Windows\System\GUcxlsV.exe
  2⤵
  PID:6936
- C:\Windows\System\QSWhiDy.exe
  C:\Windows\System\QSWhiDy.exe
  2⤵
  PID:6956
- C:\Windows\System\StaksdZ.exe
  C:\Windows\System\StaksdZ.exe
  2⤵
  PID:6972
- C:\Windows\System\eTBOgBT.exe
  C:\Windows\System\eTBOgBT.exe
  2⤵
  PID:6988
- C:\Windows\System\DMqSjSk.exe
  C:\Windows\System\DMqSjSk.exe
  2⤵
  PID:7008
- C:\Windows\System\ZBXzPoh.exe
  C:\Windows\System\ZBXzPoh.exe
  2⤵
  PID:7024
- C:\Windows\System\wMvSnEX.exe
  C:\Windows\System\wMvSnEX.exe
  2⤵
  PID:7040
- C:\Windows\System\LFlgkWz.exe
  C:\Windows\System\LFlgkWz.exe
  2⤵
  PID:7064
- C:\Windows\System\gDVwAqZ.exe
  C:\Windows\System\gDVwAqZ.exe
  2⤵
  PID:7092
- C:\Windows\System\bzKbURR.exe
  C:\Windows\System\bzKbURR.exe
  2⤵
  PID:7112
- C:\Windows\System\uUETXKH.exe
  C:\Windows\System\uUETXKH.exe
  2⤵
  PID:7132
- C:\Windows\System\hTPiYhJ.exe
  C:\Windows\System\hTPiYhJ.exe
  2⤵
  PID:7156
- C:\Windows\System\HapRIZV.exe
  C:\Windows\System\HapRIZV.exe
  2⤵
  PID:5256
- C:\Windows\System\jQoKxsz.exe
  C:\Windows\System\jQoKxsz.exe
  2⤵
  PID:5816
- C:\Windows\System\ZkovZVN.exe
  C:\Windows\System\ZkovZVN.exe
  2⤵
  PID:6200
- C:\Windows\System\jbyBuxZ.exe
  C:\Windows\System\jbyBuxZ.exe
  2⤵
  PID:6308
- C:\Windows\System\cgYKNEY.exe
  C:\Windows\System\cgYKNEY.exe
  2⤵
  PID:6376
- C:\Windows\System\RVlnVDf.exe
  C:\Windows\System\RVlnVDf.exe
  2⤵
  PID:5444
- C:\Windows\System\ORaTLDk.exe
  C:\Windows\System\ORaTLDk.exe
  2⤵
  PID:6456
- C:\Windows\System\mwUXJpf.exe
  C:\Windows\System\mwUXJpf.exe
  2⤵
  PID:6460
- C:\Windows\System\YntDfRw.exe
  C:\Windows\System\YntDfRw.exe
  2⤵
  PID:6468
- C:\Windows\System\vZwPFWk.exe
  C:\Windows\System\vZwPFWk.exe
  2⤵
  PID:6392
- C:\Windows\System\EbHtcct.exe
  C:\Windows\System\EbHtcct.exe
  2⤵
  PID:6280
- C:\Windows\System\OsPRRnw.exe
  C:\Windows\System\OsPRRnw.exe
  2⤵
  PID:6356
- C:\Windows\System\SxNxCox.exe
  C:\Windows\System\SxNxCox.exe
  2⤵
  PID:6452
- C:\Windows\System\nMSFduS.exe
  C:\Windows\System\nMSFduS.exe
  2⤵
  PID:6500
- C:\Windows\System\svxNqlQ.exe
  C:\Windows\System\svxNqlQ.exe
  2⤵
  PID:5500
- C:\Windows\System\WRcTaXa.exe
  C:\Windows\System\WRcTaXa.exe
  2⤵
  PID:6540
- C:\Windows\System\bfPNZYx.exe
  C:\Windows\System\bfPNZYx.exe
  2⤵
  PID:6632
- C:\Windows\System\kfbLkVg.exe
  C:\Windows\System\kfbLkVg.exe
  2⤵
  PID:6672
- C:\Windows\System\YVClATu.exe
  C:\Windows\System\YVClATu.exe
  2⤵
  PID:6716
- C:\Windows\System\PTrSBwi.exe
  C:\Windows\System\PTrSBwi.exe
  2⤵
  PID:6760
- C:\Windows\System\hiEbDqT.exe
  C:\Windows\System\hiEbDqT.exe
  2⤵
  PID:6740
- C:\Windows\System\MUcccUT.exe
  C:\Windows\System\MUcccUT.exe
  2⤵
  PID:6808
- C:\Windows\System\xWzteLr.exe
  C:\Windows\System\xWzteLr.exe
  2⤵
  PID:6824
- C:\Windows\System\BQLRIFE.exe
  C:\Windows\System\BQLRIFE.exe
  2⤵
  PID:6836
- C:\Windows\System\oyTnAsa.exe
  C:\Windows\System\oyTnAsa.exe
  2⤵
  PID:6892
- C:\Windows\System\uJgfnuu.exe
  C:\Windows\System\uJgfnuu.exe
  2⤵
  PID:6948
- C:\Windows\System\IpPhzRY.exe
  C:\Windows\System\IpPhzRY.exe
  2⤵
  PID:7000
- C:\Windows\System\HkIrxnc.exe
  C:\Windows\System\HkIrxnc.exe
  2⤵
  PID:7004
- C:\Windows\System\eemsSNy.exe
  C:\Windows\System\eemsSNy.exe
  2⤵
  PID:7016
- C:\Windows\System\TCYTNDi.exe
  C:\Windows\System\TCYTNDi.exe
  2⤵
  PID:6944
- C:\Windows\System\TVJkUNm.exe
  C:\Windows\System\TVJkUNm.exe
  2⤵
  PID:7108
- C:\Windows\System\gxWDTVa.exe
  C:\Windows\System\gxWDTVa.exe
  2⤵
  PID:7140
- C:\Windows\System\ijXsjCZ.exe
  C:\Windows\System\ijXsjCZ.exe
  2⤵
  PID:1716
- C:\Windows\System\eKWJYEr.exe
  C:\Windows\System\eKWJYEr.exe
  2⤵
  PID:6184
- C:\Windows\System\jORgJPB.exe
  C:\Windows\System\jORgJPB.exe
  2⤵
  PID:6168
- C:\Windows\System\wAmrDnE.exe
  C:\Windows\System\wAmrDnE.exe
  2⤵
  PID:6304
- C:\Windows\System\MXgMAmu.exe
  C:\Windows\System\MXgMAmu.exe
  2⤵
  PID:6212
- C:\Windows\System\RDcOXpD.exe
  C:\Windows\System\RDcOXpD.exe
  2⤵
  PID:6484
- C:\Windows\System\uzRFCAe.exe
  C:\Windows\System\uzRFCAe.exe
  2⤵
  PID:6432
- C:\Windows\System\OkmGGWK.exe
  C:\Windows\System\OkmGGWK.exe
  2⤵
  PID:6628
- C:\Windows\System\tSfmbyY.exe
  C:\Windows\System\tSfmbyY.exe
  2⤵
  PID:6608
- C:\Windows\System\ZlSwVMy.exe
  C:\Windows\System\ZlSwVMy.exe
  2⤵
  PID:6448
- C:\Windows\System\pMoLgnU.exe
  C:\Windows\System\pMoLgnU.exe
  2⤵
  PID:6292
- C:\Windows\System\Pcjsmtf.exe
  C:\Windows\System\Pcjsmtf.exe
  2⤵
  PID:6592
- C:\Windows\System\rKIRQvK.exe
  C:\Windows\System\rKIRQvK.exe
  2⤵
  PID:6688
- C:\Windows\System\mKEylLs.exe
  C:\Windows\System\mKEylLs.exe
  2⤵
  PID:6868
- C:\Windows\System\AsyqwGB.exe
  C:\Windows\System\AsyqwGB.exe
  2⤵
  PID:7020
- C:\Windows\System\EFqFsMv.exe
  C:\Windows\System\EFqFsMv.exe
  2⤵
  PID:6796
- C:\Windows\System\TaaAwfn.exe
  C:\Windows\System\TaaAwfn.exe
  2⤵
  PID:6984
- C:\Windows\System\MptRYcq.exe
  C:\Windows\System\MptRYcq.exe
  2⤵
  PID:7104
- C:\Windows\System\vpracIE.exe
  C:\Windows\System\vpracIE.exe
  2⤵
  PID:7072
- C:\Windows\System\Hosyxif.exe
  C:\Windows\System\Hosyxif.exe
  2⤵
  PID:7080
- C:\Windows\System\rEZqnhQ.exe
  C:\Windows\System\rEZqnhQ.exe
  2⤵
  PID:7060
- C:\Windows\System\JieIWtv.exe
  C:\Windows\System\JieIWtv.exe
  2⤵
  PID:6036
- C:\Windows\System\NXjUQaU.exe
  C:\Windows\System\NXjUQaU.exe
  2⤵
  PID:2268
- C:\Windows\System\CRtkuyF.exe
  C:\Windows\System\CRtkuyF.exe
  2⤵
  PID:6668
- C:\Windows\System\dHPZDdx.exe
  C:\Windows\System\dHPZDdx.exe
  2⤵
  PID:5580
- C:\Windows\System\mkHNVlS.exe
  C:\Windows\System\mkHNVlS.exe
  2⤵
  PID:6780
- C:\Windows\System\ySPEkxf.exe
  C:\Windows\System\ySPEkxf.exe
  2⤵
  PID:6664
- C:\Windows\System\DSloASk.exe
  C:\Windows\System\DSloASk.exe
  2⤵
  PID:6520
- C:\Windows\System\fCslPCA.exe
  C:\Windows\System\fCslPCA.exe
  2⤵
  PID:6996
- C:\Windows\System\WNmZorX.exe
  C:\Windows\System\WNmZorX.exe
  2⤵
  PID:6928
- C:\Windows\System\pGAcTMD.exe
  C:\Windows\System\pGAcTMD.exe
  2⤵
  PID:6932
- C:\Windows\System\uehZugG.exe
  C:\Windows\System\uehZugG.exe
  2⤵
  PID:6464
- C:\Windows\System\rLYoege.exe
  C:\Windows\System\rLYoege.exe
  2⤵
  PID:6536
- C:\Windows\System\RFeyylj.exe
  C:\Windows\System\RFeyylj.exe
  2⤵
  PID:7124
- C:\Windows\System\WPVzouP.exe
  C:\Windows\System\WPVzouP.exe
  2⤵
  PID:7128
- C:\Windows\System\KhHIBYp.exe
  C:\Windows\System\KhHIBYp.exe
  2⤵
  PID:6388
- C:\Windows\System\RBnYiTv.exe
  C:\Windows\System\RBnYiTv.exe
  2⤵
  PID:6712
- C:\Windows\System\xmlkGfP.exe
  C:\Windows\System\xmlkGfP.exe
  2⤵
  PID:6812
- C:\Windows\System\RTBDKHo.exe
  C:\Windows\System\RTBDKHo.exe
  2⤵
  PID:6576
- C:\Windows\System\rtsxrFr.exe
  C:\Windows\System\rtsxrFr.exe
  2⤵
  PID:6288
- C:\Windows\System\fmOsHsX.exe
  C:\Windows\System\fmOsHsX.exe
  2⤵
  PID:7188
- C:\Windows\System\cAGPwYp.exe
  C:\Windows\System\cAGPwYp.exe
  2⤵
  PID:7204
- C:\Windows\System\WuaqfvH.exe
  C:\Windows\System\WuaqfvH.exe
  2⤵
  PID:7220
- C:\Windows\System\dLHHWgk.exe
  C:\Windows\System\dLHHWgk.exe
  2⤵
  PID:7236
- C:\Windows\System\SafJRZd.exe
  C:\Windows\System\SafJRZd.exe
  2⤵
  PID:7252
- C:\Windows\System\lEfXHTo.exe
  C:\Windows\System\lEfXHTo.exe
  2⤵
  PID:7272
- C:\Windows\System\KHbNItA.exe
  C:\Windows\System\KHbNItA.exe
  2⤵
  PID:7288
- C:\Windows\System\viBVgdd.exe
  C:\Windows\System\viBVgdd.exe
  2⤵
  PID:7336
- C:\Windows\System\yQPqkEB.exe
  C:\Windows\System\yQPqkEB.exe
  2⤵
  PID:7356
- C:\Windows\System\KGbjNph.exe
  C:\Windows\System\KGbjNph.exe
  2⤵
  PID:7376
- C:\Windows\System\hAxkxZN.exe
  C:\Windows\System\hAxkxZN.exe
  2⤵
  PID:7396
- C:\Windows\System\HdkTjfo.exe
  C:\Windows\System\HdkTjfo.exe
  2⤵
  PID:7416
- C:\Windows\System\ndDmRRI.exe
  C:\Windows\System\ndDmRRI.exe
  2⤵
  PID:7432
- C:\Windows\System\QcXhHUA.exe
  C:\Windows\System\QcXhHUA.exe
  2⤵
  PID:7456
- C:\Windows\System\ylbYndj.exe
  C:\Windows\System\ylbYndj.exe
  2⤵
  PID:7472
- C:\Windows\System\eSRdVKp.exe
  C:\Windows\System\eSRdVKp.exe
  2⤵
  PID:7488
- C:\Windows\System\qXerxtR.exe
  C:\Windows\System\qXerxtR.exe
  2⤵
  PID:7512
- C:\Windows\System\diGbHvq.exe
  C:\Windows\System\diGbHvq.exe
  2⤵
  PID:7532
- C:\Windows\System\JYrwwFV.exe
  C:\Windows\System\JYrwwFV.exe
  2⤵
  PID:7560
- C:\Windows\System\KafRlrt.exe
  C:\Windows\System\KafRlrt.exe
  2⤵
  PID:7576
- C:\Windows\System\sndQTru.exe
  C:\Windows\System\sndQTru.exe
  2⤵
  PID:7592
- C:\Windows\System\TZZGXMb.exe
  C:\Windows\System\TZZGXMb.exe
  2⤵
  PID:7616
- C:\Windows\System\TZGOuqN.exe
  C:\Windows\System\TZGOuqN.exe
  2⤵
  PID:7636
- C:\Windows\System\dmsWBPg.exe
  C:\Windows\System\dmsWBPg.exe
  2⤵
  PID:7656
- C:\Windows\System\KviWBKJ.exe
  C:\Windows\System\KviWBKJ.exe
  2⤵
  PID:7672
- C:\Windows\System\nckyyzI.exe
  C:\Windows\System\nckyyzI.exe
  2⤵
  PID:7688
- C:\Windows\System\qQoGXUi.exe
  C:\Windows\System\qQoGXUi.exe
  2⤵
  PID:7708
- C:\Windows\System\bwQzLpV.exe
  C:\Windows\System\bwQzLpV.exe
  2⤵
  PID:7724
- C:\Windows\System\GfZIUql.exe
  C:\Windows\System\GfZIUql.exe
  2⤵
  PID:7744
- C:\Windows\System\UQHKbbX.exe
  C:\Windows\System\UQHKbbX.exe
  2⤵
  PID:7760
- C:\Windows\System\cVfoxVj.exe
  C:\Windows\System\cVfoxVj.exe
  2⤵
  PID:7776
- C:\Windows\System\BIUSfei.exe
  C:\Windows\System\BIUSfei.exe
  2⤵
  PID:7792
- C:\Windows\System\UHdzwMp.exe
  C:\Windows\System\UHdzwMp.exe
  2⤵
  PID:7808
- C:\Windows\System\jAaZHrq.exe
  C:\Windows\System\jAaZHrq.exe
  2⤵
  PID:7824
- C:\Windows\System\jkDUMlH.exe
  C:\Windows\System\jkDUMlH.exe
  2⤵
  PID:7840
- C:\Windows\System\EfCojEn.exe
  C:\Windows\System\EfCojEn.exe
  2⤵
  PID:7896
- C:\Windows\System\KsbUvuH.exe
  C:\Windows\System\KsbUvuH.exe
  2⤵
  PID:7912
- C:\Windows\System\okShIaZ.exe
  C:\Windows\System\okShIaZ.exe
  2⤵
  PID:7932
- C:\Windows\System\GOZbUNj.exe
  C:\Windows\System\GOZbUNj.exe
  2⤵
  PID:7948
- C:\Windows\System\ivnvuvf.exe
  C:\Windows\System\ivnvuvf.exe
  2⤵
  PID:7964
- C:\Windows\System\RAiEDMX.exe
  C:\Windows\System\RAiEDMX.exe
  2⤵
  PID:7980
- C:\Windows\System\uZOMlpM.exe
  C:\Windows\System\uZOMlpM.exe
  2⤵
  PID:7996
- C:\Windows\System\irfSgCh.exe
  C:\Windows\System\irfSgCh.exe
  2⤵
  PID:8012
- C:\Windows\System\DlOzBBa.exe
  C:\Windows\System\DlOzBBa.exe
  2⤵
  PID:8036
- C:\Windows\System\rCqaHwp.exe
  C:\Windows\System\rCqaHwp.exe
  2⤵
  PID:8052
- C:\Windows\System\UCXUxas.exe
  C:\Windows\System\UCXUxas.exe
  2⤵
  PID:8068
- C:\Windows\System\ZyuBINY.exe
  C:\Windows\System\ZyuBINY.exe
  2⤵
  PID:8084
- C:\Windows\System\ZeFWFjl.exe
  C:\Windows\System\ZeFWFjl.exe
  2⤵
  PID:8104
- C:\Windows\System\bqzleqO.exe
  C:\Windows\System\bqzleqO.exe
  2⤵
  PID:8128
- C:\Windows\System\qtniLuF.exe
  C:\Windows\System\qtniLuF.exe
  2⤵
  PID:8144
- C:\Windows\System\eCLjJft.exe
  C:\Windows\System\eCLjJft.exe
  2⤵
  PID:6832
- C:\Windows\System\YgWtwYJ.exe
  C:\Windows\System\YgWtwYJ.exe
  2⤵
  PID:6268
- C:\Windows\System\oYgBMyt.exe
  C:\Windows\System\oYgBMyt.exe
  2⤵
  PID:7176
- C:\Windows\System\WrENrPy.exe
  C:\Windows\System\WrENrPy.exe
  2⤵
  PID:7216
- C:\Windows\System\xQPnrEL.exe
  C:\Windows\System\xQPnrEL.exe
  2⤵
  PID:7284
- C:\Windows\System\dsQIZoF.exe
  C:\Windows\System\dsQIZoF.exe
  2⤵
  PID:6856
- C:\Windows\System\psmpgRD.exe
  C:\Windows\System\psmpgRD.exe
  2⤵
  PID:6180
- C:\Windows\System\eMInFvR.exe
  C:\Windows\System\eMInFvR.exe
  2⤵
  PID:6792
- C:\Windows\System\jIyPZPX.exe
  C:\Windows\System\jIyPZPX.exe
  2⤵
  PID:7264
- C:\Windows\System\FoGMaNF.exe
  C:\Windows\System\FoGMaNF.exe
  2⤵
  PID:7324
- C:\Windows\System\lEqygXg.exe
  C:\Windows\System\lEqygXg.exe
  2⤵
  PID:7348
- C:\Windows\System\eILnylD.exe
  C:\Windows\System\eILnylD.exe
  2⤵
  PID:7364
- C:\Windows\System\tuPxRmF.exe
  C:\Windows\System\tuPxRmF.exe
  2⤵
  PID:7412
- C:\Windows\System\otAOONi.exe
  C:\Windows\System\otAOONi.exe
  2⤵
  PID:7468
- C:\Windows\System\PtRqqyq.exe
  C:\Windows\System\PtRqqyq.exe
  2⤵
  PID:7448
- C:\Windows\System\kmMjhHZ.exe
  C:\Windows\System\kmMjhHZ.exe
  2⤵
  PID:7508
- C:\Windows\System\ocZUYIr.exe
  C:\Windows\System\ocZUYIr.exe
  2⤵
  PID:7556
- C:\Windows\System\oadrXkc.exe
  C:\Windows\System\oadrXkc.exe
  2⤵
  PID:7568
- C:\Windows\System\wlSrqrr.exe
  C:\Windows\System\wlSrqrr.exe
  2⤵
  PID:7624
- C:\Windows\System\oQjiYui.exe
  C:\Windows\System\oQjiYui.exe
  2⤵
  PID:7644
- C:\Windows\System\xrjohzx.exe
  C:\Windows\System\xrjohzx.exe
  2⤵
  PID:7700
- C:\Windows\System\ExiLyPW.exe
  C:\Windows\System\ExiLyPW.exe
  2⤵
  PID:7716
- C:\Windows\System\WyOCbPx.exe
  C:\Windows\System\WyOCbPx.exe
  2⤵
  PID:7804
- C:\Windows\System\MjMiCxJ.exe
  C:\Windows\System\MjMiCxJ.exe
  2⤵
  PID:7788
- C:\Windows\System\tiDpADt.exe
  C:\Windows\System\tiDpADt.exe
  2⤵
  PID:7860
- C:\Windows\System\sgqtlpi.exe
  C:\Windows\System\sgqtlpi.exe
  2⤵
  PID:7876
- C:\Windows\System\NDuILoM.exe
  C:\Windows\System\NDuILoM.exe
  2⤵
  PID:7904
- C:\Windows\System\WpMoSyN.exe
  C:\Windows\System\WpMoSyN.exe
  2⤵
  PID:7972
- C:\Windows\System\dIBYaxn.exe
  C:\Windows\System\dIBYaxn.exe
  2⤵
  PID:8044
- C:\Windows\System\OyjQGsg.exe
  C:\Windows\System\OyjQGsg.exe
  2⤵
  PID:8020
- C:\Windows\System\ZsSQCSs.exe
  C:\Windows\System\ZsSQCSs.exe
  2⤵
  PID:8032
- C:\Windows\System\mjorMVs.exe
  C:\Windows\System\mjorMVs.exe
  2⤵
  PID:7924
- C:\Windows\System\eCLCmNc.exe
  C:\Windows\System\eCLCmNc.exe
  2⤵
  PID:8100
- C:\Windows\System\KAvJgTy.exe
  C:\Windows\System\KAvJgTy.exe
  2⤵
  PID:8152
- C:\Windows\System\BGVLcVY.exe
  C:\Windows\System\BGVLcVY.exe
  2⤵
  PID:8176
- C:\Windows\System\bFnPkoL.exe
  C:\Windows\System\bFnPkoL.exe
  2⤵
  PID:8156
- C:\Windows\System\vleKLJL.exe
  C:\Windows\System\vleKLJL.exe
  2⤵
  PID:7280
- C:\Windows\System\EVPhlxp.exe
  C:\Windows\System\EVPhlxp.exe
  2⤵
  PID:7232
- C:\Windows\System\CEWmHAC.exe
  C:\Windows\System\CEWmHAC.exe
  2⤵
  PID:7300
- C:\Windows\System\khqyZMD.exe
  C:\Windows\System\khqyZMD.exe
  2⤵
  PID:7404
- C:\Windows\System\cZTgmFW.exe
  C:\Windows\System\cZTgmFW.exe
  2⤵
  PID:7444
- C:\Windows\System\PpMAuWf.exe
  C:\Windows\System\PpMAuWf.exe
  2⤵
  PID:7544
- C:\Windows\System\ICmwlel.exe
  C:\Windows\System\ICmwlel.exe
  2⤵
  PID:7308
- C:\Windows\System\UyBLGCz.exe
  C:\Windows\System\UyBLGCz.exe
  2⤵
  PID:7464
- C:\Windows\System\CsoFDhz.exe
  C:\Windows\System\CsoFDhz.exe
  2⤵
  PID:7608
- C:\Windows\System\nAWxIvr.exe
  C:\Windows\System\nAWxIvr.exe
  2⤵
  PID:7736
- C:\Windows\System\oIpewyG.exe
  C:\Windows\System\oIpewyG.exe
  2⤵
  PID:7588
- C:\Windows\System\RNaLLyV.exe
  C:\Windows\System\RNaLLyV.exe
  2⤵
  PID:7888
- C:\Windows\System\osuhyzs.exe
  C:\Windows\System\osuhyzs.exe
  2⤵
  PID:7632
- C:\Windows\System\aWjTHlz.exe
  C:\Windows\System\aWjTHlz.exe
  2⤵
  PID:7956
- C:\Windows\System\UVRDMrC.exe
  C:\Windows\System\UVRDMrC.exe
  2⤵
  PID:8160
- C:\Windows\System\omChCdF.exe
  C:\Windows\System\omChCdF.exe
  2⤵
  PID:7248
- C:\Windows\System\uluvvra.exe
  C:\Windows\System\uluvvra.exe
  2⤵
  PID:7872
- C:\Windows\System\OAYcJQN.exe
  C:\Windows\System\OAYcJQN.exe
  2⤵
  PID:7940
- C:\Windows\System\bmPyJVy.exe
  C:\Windows\System\bmPyJVy.exe
  2⤵
  PID:7944
- C:\Windows\System\LbbDQsN.exe
  C:\Windows\System\LbbDQsN.exe
  2⤵
  PID:7212
- C:\Windows\System\skcqBhB.exe
  C:\Windows\System\skcqBhB.exe
  2⤵
  PID:7388
- C:\Windows\System\IKFODaO.exe
  C:\Windows\System\IKFODaO.exe
  2⤵
  PID:6752
- C:\Windows\System\uLnaRfn.exe
  C:\Windows\System\uLnaRfn.exe
  2⤵
  PID:8092
- C:\Windows\System\Urbqzmd.exe
  C:\Windows\System\Urbqzmd.exe
  2⤵
  PID:7768
- C:\Windows\System\mCrdniL.exe
  C:\Windows\System\mCrdniL.exe
  2⤵
  PID:7408
- C:\Windows\System\badzJlb.exe
  C:\Windows\System\badzJlb.exe
  2⤵
  PID:7480
- C:\Windows\System\bSkosmb.exe
  C:\Windows\System\bSkosmb.exe
  2⤵
  PID:7892
- C:\Windows\System\lVXcnga.exe
  C:\Windows\System\lVXcnga.exe
  2⤵
  PID:7332
- C:\Windows\System\ahvFMqm.exe
  C:\Windows\System\ahvFMqm.exe
  2⤵
  PID:7056
- C:\Windows\System\eLWwXVC.exe
  C:\Windows\System\eLWwXVC.exe
  2⤵
  PID:7652
- C:\Windows\System\tQMgOeE.exe
  C:\Windows\System\tQMgOeE.exe
  2⤵
  PID:7988
- C:\Windows\System\LREbtmQ.exe
  C:\Windows\System\LREbtmQ.exe
  2⤵
  PID:6736
- C:\Windows\System\CeDcdTQ.exe
  C:\Windows\System\CeDcdTQ.exe
  2⤵
  PID:8188
- C:\Windows\System\MwyqVNf.exe
  C:\Windows\System\MwyqVNf.exe
  2⤵
  PID:7540
- C:\Windows\System\gVaYVBM.exe
  C:\Windows\System\gVaYVBM.exe
  2⤵
  PID:8080
- C:\Windows\System\hGiPodV.exe
  C:\Windows\System\hGiPodV.exe
  2⤵
  PID:7604
- C:\Windows\System\iUSfWpe.exe
  C:\Windows\System\iUSfWpe.exe
  2⤵
  PID:8096
- C:\Windows\System\yQrzbtJ.exe
  C:\Windows\System\yQrzbtJ.exe
  2⤵
  PID:6476
- C:\Windows\System\smdMsLo.exe
  C:\Windows\System\smdMsLo.exe
  2⤵
  PID:7684
- C:\Windows\System\luQbUaj.exe
  C:\Windows\System\luQbUaj.exe
  2⤵
  PID:7184
- C:\Windows\System\iIaAXnO.exe
  C:\Windows\System\iIaAXnO.exe
  2⤵
  PID:7800
- C:\Windows\System\MUYrCyy.exe
  C:\Windows\System\MUYrCyy.exe
  2⤵
  PID:7816
- C:\Windows\System\IVyVUzd.exe
  C:\Windows\System\IVyVUzd.exe
  2⤵
  PID:1560
- C:\Windows\System\neOCjCe.exe
  C:\Windows\System\neOCjCe.exe
  2⤵
  PID:7848
- C:\Windows\System\pQoESIx.exe
  C:\Windows\System\pQoESIx.exe
  2⤵
  PID:8008
- C:\Windows\System\FWxUeiY.exe
  C:\Windows\System\FWxUeiY.exe
  2⤵
  PID:6216
- C:\Windows\System\RXlqzKc.exe
  C:\Windows\System\RXlqzKc.exe
  2⤵
  PID:7228
- C:\Windows\System\MYgwMnp.exe
  C:\Windows\System\MYgwMnp.exe
  2⤵
  PID:6968
- C:\Windows\System\OMhURJF.exe
  C:\Windows\System\OMhURJF.exe
  2⤵
  PID:7440
- C:\Windows\System\sbMcGCp.exe
  C:\Windows\System\sbMcGCp.exe
  2⤵
  PID:7784
- C:\Windows\System\UxyOhdY.exe
  C:\Windows\System\UxyOhdY.exe
  2⤵
  PID:8204
- C:\Windows\System\NOlJxFj.exe
  C:\Windows\System\NOlJxFj.exe
  2⤵
  PID:8220
- C:\Windows\System\VuaPoHY.exe
  C:\Windows\System\VuaPoHY.exe
  2⤵
  PID:8236
- C:\Windows\System\NUXQxeE.exe
  C:\Windows\System\NUXQxeE.exe
  2⤵
  PID:8252
- C:\Windows\System\azNRDLu.exe
  C:\Windows\System\azNRDLu.exe
  2⤵
  PID:8268
- C:\Windows\System\YuixDyz.exe
  C:\Windows\System\YuixDyz.exe
  2⤵
  PID:8284
- C:\Windows\System\AkJaoQa.exe
  C:\Windows\System\AkJaoQa.exe
  2⤵
  PID:8304
- C:\Windows\System\qqlvEWd.exe
  C:\Windows\System\qqlvEWd.exe
  2⤵
  PID:8328
- C:\Windows\System\halTGlr.exe
  C:\Windows\System\halTGlr.exe
  2⤵
  PID:8348
- C:\Windows\System\jSTaDcA.exe
  C:\Windows\System\jSTaDcA.exe
  2⤵
  PID:8368
- C:\Windows\System\ZKLURCy.exe
  C:\Windows\System\ZKLURCy.exe
  2⤵
  PID:8384
- C:\Windows\System\STGXjVz.exe
  C:\Windows\System\STGXjVz.exe
  2⤵
  PID:8432
- C:\Windows\System\VHZTfEQ.exe
  C:\Windows\System\VHZTfEQ.exe
  2⤵
  PID:8448
- C:\Windows\System\FestvCg.exe
  C:\Windows\System\FestvCg.exe
  2⤵
  PID:8468
- C:\Windows\System\daLPDri.exe
  C:\Windows\System\daLPDri.exe
  2⤵
  PID:8488
- C:\Windows\System\LChzyET.exe
  C:\Windows\System\LChzyET.exe
  2⤵
  PID:8508
- C:\Windows\System\ESyTXqz.exe
  C:\Windows\System\ESyTXqz.exe
  2⤵
  PID:8524
- C:\Windows\System\XEwStco.exe
  C:\Windows\System\XEwStco.exe
  2⤵
  PID:8544
- C:\Windows\System\lYqBusz.exe
  C:\Windows\System\lYqBusz.exe
  2⤵
  PID:8564
- C:\Windows\System\EDyvgJJ.exe
  C:\Windows\System\EDyvgJJ.exe
  2⤵
  PID:8592
- C:\Windows\System\ULvbaqA.exe
  C:\Windows\System\ULvbaqA.exe
  2⤵
  PID:8608
- C:\Windows\System\dhsSEVs.exe
  C:\Windows\System\dhsSEVs.exe
  2⤵
  PID:8628
- C:\Windows\System\SfTDgkM.exe
  C:\Windows\System\SfTDgkM.exe
  2⤵
  PID:8644
- C:\Windows\System\NBEELUn.exe
  C:\Windows\System\NBEELUn.exe
  2⤵
  PID:8660
- C:\Windows\System\iGXOkpw.exe
  C:\Windows\System\iGXOkpw.exe
  2⤵
  PID:8676
- C:\Windows\System\tlikjpN.exe
  C:\Windows\System\tlikjpN.exe
  2⤵
  PID:8692
- C:\Windows\System\pthGwHH.exe
  C:\Windows\System\pthGwHH.exe
  2⤵
  PID:8716
- C:\Windows\System\NWWzyoH.exe
  C:\Windows\System\NWWzyoH.exe
  2⤵
  PID:8732
- C:\Windows\System\hsMFuAQ.exe
  C:\Windows\System\hsMFuAQ.exe
  2⤵
  PID:8752
- C:\Windows\System\VhFfsiG.exe
  C:\Windows\System\VhFfsiG.exe
  2⤵
  PID:8768
- C:\Windows\System\AQpjBME.exe
  C:\Windows\System\AQpjBME.exe
  2⤵
  PID:8788
- C:\Windows\System\RjWZRlt.exe
  C:\Windows\System\RjWZRlt.exe
  2⤵
  PID:8808
- C:\Windows\System\XxXqOYz.exe
  C:\Windows\System\XxXqOYz.exe
  2⤵
  PID:8828
- C:\Windows\System\sgomPTn.exe
  C:\Windows\System\sgomPTn.exe
  2⤵
  PID:8844
- C:\Windows\System\xUJNjYP.exe
  C:\Windows\System\xUJNjYP.exe
  2⤵
  PID:8860
- C:\Windows\System\DcXPhue.exe
  C:\Windows\System\DcXPhue.exe
  2⤵
  PID:8916
- C:\Windows\System\ArQpXvF.exe
  C:\Windows\System\ArQpXvF.exe
  2⤵
  PID:8932
- C:\Windows\System\uZthAgO.exe
  C:\Windows\System\uZthAgO.exe
  2⤵
  PID:8952
- C:\Windows\System\EXaZdvb.exe
  C:\Windows\System\EXaZdvb.exe
  2⤵
  PID:8968
- C:\Windows\System\MpSouXv.exe
  C:\Windows\System\MpSouXv.exe
  2⤵
  PID:8984
- C:\Windows\System\IiYvGoN.exe
  C:\Windows\System\IiYvGoN.exe
  2⤵
  PID:9004
- C:\Windows\System\oTPlQXd.exe
  C:\Windows\System\oTPlQXd.exe
  2⤵
  PID:9044
- C:\Windows\System\JKHKzpI.exe
  C:\Windows\System\JKHKzpI.exe
  2⤵
  PID:9060
- C:\Windows\System\CindBsf.exe
  C:\Windows\System\CindBsf.exe
  2⤵
  PID:9080
- C:\Windows\System\BvHzRTd.exe
  C:\Windows\System\BvHzRTd.exe
  2⤵
  PID:9100
- C:\Windows\System\JEaWyIz.exe
  C:\Windows\System\JEaWyIz.exe
  2⤵
  PID:9116
- C:\Windows\System\RdyaTkI.exe
  C:\Windows\System\RdyaTkI.exe
  2⤵
  PID:9136
- C:\Windows\System\nDUgXqf.exe
  C:\Windows\System\nDUgXqf.exe
  2⤵
  PID:9156
- C:\Windows\System\svUYJvJ.exe
  C:\Windows\System\svUYJvJ.exe
  2⤵
  PID:9172
- C:\Windows\System\YnoyFML.exe
  C:\Windows\System\YnoyFML.exe
  2⤵
  PID:9200
- C:\Windows\System\BqEKNQC.exe
  C:\Windows\System\BqEKNQC.exe
  2⤵
  PID:8212
- C:\Windows\System\Eoezqrh.exe
  C:\Windows\System\Eoezqrh.exe
  2⤵
  PID:8296
- C:\Windows\System\KictAgN.exe
  C:\Windows\System\KictAgN.exe
  2⤵
  PID:8340
- C:\Windows\System\kdSVGeU.exe
  C:\Windows\System\kdSVGeU.exe
  2⤵
  PID:8380
- C:\Windows\System\lMcaQfv.exe
  C:\Windows\System\lMcaQfv.exe
  2⤵
  PID:8248
- C:\Windows\System\LBEsTct.exe
  C:\Windows\System\LBEsTct.exe
  2⤵
  PID:8396
- C:\Windows\System\OxJeVGN.exe
  C:\Windows\System\OxJeVGN.exe
  2⤵
  PID:8412
- C:\Windows\System\xxZtzma.exe
  C:\Windows\System\xxZtzma.exe
  2⤵
  PID:8428
- C:\Windows\System\RLYVROR.exe
  C:\Windows\System\RLYVROR.exe
  2⤵
  PID:8484
- C:\Windows\System\WubXhrB.exe
  C:\Windows\System\WubXhrB.exe
  2⤵
  PID:8520
- C:\Windows\System\ybDcVha.exe
  C:\Windows\System\ybDcVha.exe
  2⤵
  PID:8552
- C:\Windows\System\iGYyrQL.exe
  C:\Windows\System\iGYyrQL.exe
  2⤵
  PID:8588
- C:\Windows\System\ktOBNhO.exe
  C:\Windows\System\ktOBNhO.exe
  2⤵
  PID:8620
- C:\Windows\System\fIBlehq.exe
  C:\Windows\System\fIBlehq.exe
  2⤵
  PID:8672
- C:\Windows\System\aYJVpdF.exe
  C:\Windows\System\aYJVpdF.exe
  2⤵
  PID:8712
- C:\Windows\System\IoibpPq.exe
  C:\Windows\System\IoibpPq.exe
  2⤵
  PID:8656
- C:\Windows\System\LaVEQCi.exe
  C:\Windows\System\LaVEQCi.exe
  2⤵
  PID:8780
- C:\Windows\System\hYRiwVa.exe
  C:\Windows\System\hYRiwVa.exe
  2⤵
  PID:8740
- C:\Windows\System\lHYmsLK.exe
  C:\Windows\System\lHYmsLK.exe
  2⤵
  PID:8824
- C:\Windows\System\EssnIOo.exe
  C:\Windows\System\EssnIOo.exe
  2⤵
  PID:8836
- C:\Windows\System\JpPaueS.exe
  C:\Windows\System\JpPaueS.exe
  2⤵
  PID:8892
- C:\Windows\System\snzCEYM.exe
  C:\Windows\System\snzCEYM.exe
  2⤵
  PID:8912
- C:\Windows\System\aZZIozn.exe
  C:\Windows\System\aZZIozn.exe
  2⤵
  PID:8940
- C:\Windows\System\nEBMCny.exe
  C:\Windows\System\nEBMCny.exe
  2⤵
  PID:9000
- C:\Windows\System\UdXdOIO.exe
  C:\Windows\System\UdXdOIO.exe
  2⤵
  PID:9016
- C:\Windows\System\AjbqxWU.exe
  C:\Windows\System\AjbqxWU.exe
  2⤵
  PID:9032
- C:\Windows\System\VfouuLq.exe
  C:\Windows\System\VfouuLq.exe
  2⤵
  PID:9088
- C:\Windows\System\HYfaqDx.exe
  C:\Windows\System\HYfaqDx.exe
  2⤵
  PID:9092
- C:\Windows\System\MUXiaUc.exe
  C:\Windows\System\MUXiaUc.exe
  2⤵
  PID:9112
- C:\Windows\System\InMJAkc.exe
  C:\Windows\System\InMJAkc.exe
  2⤵
  PID:9180
- C:\Windows\System\KFfOTFU.exe
  C:\Windows\System\KFfOTFU.exe
  2⤵
  PID:8196
- C:\Windows\System\OWGpHyD.exe
  C:\Windows\System\OWGpHyD.exe
  2⤵
  PID:8232
- C:\Windows\System\tGZarDX.exe
  C:\Windows\System\tGZarDX.exe
  2⤵
  PID:8244
- C:\Windows\System\itOQtHL.exe
  C:\Windows\System\itOQtHL.exe
  2⤵
  PID:8324
- C:\Windows\System\wfQbawY.exe
  C:\Windows\System\wfQbawY.exe
  2⤵
  PID:8404
- C:\Windows\System\LMCbyWI.exe
  C:\Windows\System\LMCbyWI.exe
  2⤵
  PID:7520
- C:\Windows\System\bjDjFld.exe
  C:\Windows\System\bjDjFld.exe
  2⤵
  PID:8500
- C:\Windows\System\NybfjaJ.exe
  C:\Windows\System\NybfjaJ.exe
  2⤵
  PID:8560
- C:\Windows\System\kNHsPAh.exe
  C:\Windows\System\kNHsPAh.exe
  2⤵
  PID:8708
- C:\Windows\System\hLGERNQ.exe
  C:\Windows\System\hLGERNQ.exe
  2⤵
  PID:8684
- C:\Windows\System\AKwSgeg.exe
  C:\Windows\System\AKwSgeg.exe
  2⤵
  PID:8796
- C:\Windows\System\ZDnBEjo.exe
  C:\Windows\System\ZDnBEjo.exe
  2⤵
  PID:8476
- C:\Windows\System\RaHPJBE.exe
  C:\Windows\System\RaHPJBE.exe
  2⤵
  PID:8784
- C:\Windows\System\vtFedxm.exe
  C:\Windows\System\vtFedxm.exe
  2⤵
  PID:8888
- C:\Windows\System\ijqWiTv.exe
  C:\Windows\System\ijqWiTv.exe
  2⤵
  PID:8960
- C:\Windows\System\olrWiLc.exe
  C:\Windows\System\olrWiLc.exe
  2⤵
  PID:9040
- C:\Windows\System\slorndn.exe
  C:\Windows\System\slorndn.exe
  2⤵
  PID:9024
- C:\Windows\System\zbBQYik.exe
  C:\Windows\System\zbBQYik.exe
  2⤵
  PID:9164
- C:\Windows\System\JrfYjAf.exe
  C:\Windows\System\JrfYjAf.exe
  2⤵
  PID:9192
- C:\Windows\System\zPDdiYq.exe
  C:\Windows\System\zPDdiYq.exe
  2⤵
  PID:9148
- C:\Windows\System\RuVgizM.exe
  C:\Windows\System\RuVgizM.exe
  2⤵
  PID:8300
- C:\Windows\System\UIlukEc.exe
  C:\Windows\System\UIlukEc.exe
  2⤵
  PID:8364
- C:\Windows\System\HgUwfxr.exe
  C:\Windows\System\HgUwfxr.exe
  2⤵
  PID:8460
- C:\Windows\System\EWWoIuB.exe
  C:\Windows\System\EWWoIuB.exe
  2⤵
  PID:8536
- C:\Windows\System\RfxxaRi.exe
  C:\Windows\System\RfxxaRi.exe
  2⤵
  PID:8584
- C:\Windows\System\lQLtSTi.exe
  C:\Windows\System\lQLtSTi.exe
  2⤵
  PID:8636
- C:\Windows\System\UuEsMtN.exe
  C:\Windows\System\UuEsMtN.exe
  2⤵
  PID:8856
- C:\Windows\System\qKTTSKB.exe
  C:\Windows\System\qKTTSKB.exe
  2⤵
  PID:8840
- C:\Windows\System\oZfOepQ.exe
  C:\Windows\System\oZfOepQ.exe
  2⤵
  PID:9188
- C:\Windows\System\gcGvvEt.exe
  C:\Windows\System\gcGvvEt.exe
  2⤵
  PID:8420
- C:\Windows\System\MVnCwsV.exe
  C:\Windows\System\MVnCwsV.exe
  2⤵
  PID:8316
- C:\Windows\System\YZHalkc.exe
  C:\Windows\System\YZHalkc.exe
  2⤵
  PID:8744
- C:\Windows\System\iWBGgQq.exe
  C:\Windows\System\iWBGgQq.exe
  2⤵
  PID:8580
- C:\Windows\System\DSeVHMs.exe
  C:\Windows\System\DSeVHMs.exe
  2⤵
  PID:9196
- C:\Windows\System\rvFtlTp.exe
  C:\Windows\System\rvFtlTp.exe
  2⤵
  PID:8760
- C:\Windows\System\jQHsVYZ.exe
  C:\Windows\System\jQHsVYZ.exe
  2⤵
  PID:9012
- C:\Windows\System\fVjCaBx.exe
  C:\Windows\System\fVjCaBx.exe
  2⤵
  PID:8948
- C:\Windows\System\FxbsDIs.exe
  C:\Windows\System\FxbsDIs.exe
  2⤵
  PID:8456
- C:\Windows\System\EEUxUtk.exe
  C:\Windows\System\EEUxUtk.exe
  2⤵
  PID:9128
- C:\Windows\System\EIYQKeG.exe
  C:\Windows\System\EIYQKeG.exe
  2⤵
  PID:8464
- C:\Windows\System\hKWVJfM.exe
  C:\Windows\System\hKWVJfM.exe
  2⤵
  PID:8880
- C:\Windows\System\WPPPXjA.exe
  C:\Windows\System\WPPPXjA.exe
  2⤵
  PID:9144
- C:\Windows\System\bZrNFUD.exe
  C:\Windows\System\bZrNFUD.exe
  2⤵
  PID:8876
- C:\Windows\System\pETwbjt.exe
  C:\Windows\System\pETwbjt.exe
  2⤵
  PID:9096
- C:\Windows\System\CXKSZJT.exe
  C:\Windows\System\CXKSZJT.exe
  2⤵
  PID:9232
- C:\Windows\System\oQJjlji.exe
  C:\Windows\System\oQJjlji.exe
  2⤵
  PID:9256
- C:\Windows\System\yPUBUXT.exe
  C:\Windows\System\yPUBUXT.exe
  2⤵
  PID:9272
- C:\Windows\System\NvbFYVK.exe
  C:\Windows\System\NvbFYVK.exe
  2⤵
  PID:9288
- C:\Windows\System\dAiVlkV.exe
  C:\Windows\System\dAiVlkV.exe
  2⤵
  PID:9316
- C:\Windows\System\DBXNDVA.exe
  C:\Windows\System\DBXNDVA.exe
  2⤵
  PID:9332
- C:\Windows\System\RjhFmbV.exe
  C:\Windows\System\RjhFmbV.exe
  2⤵
  PID:9348
- C:\Windows\System\hZmNTXw.exe
  C:\Windows\System\hZmNTXw.exe
  2⤵
  PID:9364
- C:\Windows\System\AMDbmEJ.exe
  C:\Windows\System\AMDbmEJ.exe
  2⤵
  PID:9380
- C:\Windows\System\VzXfAsG.exe
  C:\Windows\System\VzXfAsG.exe
  2⤵
  PID:9396
- C:\Windows\System\OCAnbyS.exe
  C:\Windows\System\OCAnbyS.exe
  2⤵
  PID:9416
- C:\Windows\System\OwqolYK.exe
  C:\Windows\System\OwqolYK.exe
  2⤵
  PID:9436
- C:\Windows\System\ZscmvLm.exe
  C:\Windows\System\ZscmvLm.exe
  2⤵
  PID:9456
- C:\Windows\System\GQrDHDy.exe
  C:\Windows\System\GQrDHDy.exe
  2⤵
  PID:9480
- C:\Windows\System\JSgSLKX.exe
  C:\Windows\System\JSgSLKX.exe
  2⤵
  PID:9500
- C:\Windows\System\DjxPlVK.exe
  C:\Windows\System\DjxPlVK.exe
  2⤵
  PID:9540
- C:\Windows\System\zOwYrsG.exe
  C:\Windows\System\zOwYrsG.exe
  2⤵
  PID:9556
- C:\Windows\System\ryBcMbx.exe
  C:\Windows\System\ryBcMbx.exe
  2⤵
  PID:9572
- C:\Windows\System\EmNHBPb.exe
  C:\Windows\System\EmNHBPb.exe
  2⤵
  PID:9588
- C:\Windows\System\hKGzLET.exe
  C:\Windows\System\hKGzLET.exe
  2⤵
  PID:9604
- C:\Windows\System\OEKTRIC.exe
  C:\Windows\System\OEKTRIC.exe
  2⤵
  PID:9624
- C:\Windows\System\POIQlwx.exe
  C:\Windows\System\POIQlwx.exe
  2⤵
  PID:9640
- C:\Windows\System\ZysbKyN.exe
  C:\Windows\System\ZysbKyN.exe
  2⤵
  PID:9656
- C:\Windows\System\eIRHmHN.exe
  C:\Windows\System\eIRHmHN.exe
  2⤵
  PID:9672
- C:\Windows\System\zFlhCND.exe
  C:\Windows\System\zFlhCND.exe
  2⤵
  PID:9692
- C:\Windows\System\CUuFTpB.exe
  C:\Windows\System\CUuFTpB.exe
  2⤵
  PID:9712
- C:\Windows\System\NwSZwNW.exe
  C:\Windows\System\NwSZwNW.exe
  2⤵
  PID:9768
- C:\Windows\System\NNpNwlF.exe
  C:\Windows\System\NNpNwlF.exe
  2⤵
  PID:9788
- C:\Windows\System\MJuANBW.exe
  C:\Windows\System\MJuANBW.exe
  2⤵
  PID:9804
- C:\Windows\System\AAzlcKt.exe
  C:\Windows\System\AAzlcKt.exe
  2⤵
  PID:9824
- C:\Windows\System\flEKoDz.exe
  C:\Windows\System\flEKoDz.exe
  2⤵
  PID:9848
- C:\Windows\System\vgboSIk.exe
  C:\Windows\System\vgboSIk.exe
  2⤵
  PID:9864
- C:\Windows\System\UyCYdsF.exe
  C:\Windows\System\UyCYdsF.exe
  2⤵
  PID:9880
- C:\Windows\System\ulQwUfj.exe
  C:\Windows\System\ulQwUfj.exe
  2⤵
  PID:9904
- C:\Windows\System\ZIKCGRS.exe
  C:\Windows\System\ZIKCGRS.exe
  2⤵
  PID:9920
- C:\Windows\System\ZiBvIZo.exe
  C:\Windows\System\ZiBvIZo.exe
  2⤵
  PID:9944
- C:\Windows\System\utkWetv.exe
  C:\Windows\System\utkWetv.exe
  2⤵
  PID:9968
- C:\Windows\System\tGCeiWf.exe
  C:\Windows\System\tGCeiWf.exe
  2⤵
  PID:9984
- C:\Windows\System\oAMLTxy.exe
  C:\Windows\System\oAMLTxy.exe
  2⤵
  PID:10004
- C:\Windows\System\bqsJKxu.exe
  C:\Windows\System\bqsJKxu.exe
  2⤵
  PID:10020
- C:\Windows\System\uLmfzsl.exe
  C:\Windows\System\uLmfzsl.exe
  2⤵
  PID:10048
- C:\Windows\System\TzghQwC.exe
  C:\Windows\System\TzghQwC.exe
  2⤵
  PID:10064
- C:\Windows\System\nBTEbbX.exe
  C:\Windows\System\nBTEbbX.exe
  2⤵
  PID:10080
- C:\Windows\System\btWIHKi.exe
  C:\Windows\System\btWIHKi.exe
  2⤵
  PID:10100
- C:\Windows\System\ccBgyRA.exe
  C:\Windows\System\ccBgyRA.exe
  2⤵
  PID:10124
- C:\Windows\System\iIEtpnW.exe
  C:\Windows\System\iIEtpnW.exe
  2⤵
  PID:10144
- C:\Windows\System\tRwseOg.exe
  C:\Windows\System\tRwseOg.exe
  2⤵
  PID:10160
- C:\Windows\System\EyRnCDe.exe
  C:\Windows\System\EyRnCDe.exe
  2⤵
  PID:10176
- C:\Windows\System\ixLUPDx.exe
  C:\Windows\System\ixLUPDx.exe
  2⤵
  PID:10212
- C:\Windows\System\ktgyGvU.exe
  C:\Windows\System\ktgyGvU.exe
  2⤵
  PID:10228
- C:\Windows\System\pmiQQyq.exe
  C:\Windows\System\pmiQQyq.exe
  2⤵
  PID:9220
- C:\Windows\System\oJqTNXA.exe
  C:\Windows\System\oJqTNXA.exe
  2⤵
  PID:8980
- C:\Windows\System\MNHdioL.exe
  C:\Windows\System\MNHdioL.exe
  2⤵
  PID:9252
- C:\Windows\System\MXUkeRC.exe
  C:\Windows\System\MXUkeRC.exe
  2⤵
  PID:9280
- C:\Windows\System\njaomny.exe
  C:\Windows\System\njaomny.exe
  2⤵
  PID:9312
- C:\Windows\System\nGbbvoJ.exe
  C:\Windows\System\nGbbvoJ.exe
  2⤵
  PID:9408
- C:\Windows\System\DXKftIf.exe
  C:\Windows\System\DXKftIf.exe
  2⤵
  PID:9356
- C:\Windows\System\upypjdF.exe
  C:\Windows\System\upypjdF.exe
  2⤵
  PID:9324
- C:\Windows\System\ldSVTaB.exe
  C:\Windows\System\ldSVTaB.exe
  2⤵
  PID:9388
- C:\Windows\System\dDtwllh.exe
  C:\Windows\System\dDtwllh.exe
  2⤵
  PID:9492
- C:\Windows\System\BcudpYg.exe
  C:\Windows\System\BcudpYg.exe
  2⤵
  PID:9524
- C:\Windows\System\KzlZwMw.exe
  C:\Windows\System\KzlZwMw.exe
  2⤵
  PID:9548
- C:\Windows\System\CNvVqTg.exe
  C:\Windows\System\CNvVqTg.exe
  2⤵
  PID:9612
- C:\Windows\System\xxOCsdt.exe
  C:\Windows\System\xxOCsdt.exe
  2⤵
  PID:9680
- C:\Windows\System\hUhvVpS.exe
  C:\Windows\System\hUhvVpS.exe
  2⤵
  PID:9728
- C:\Windows\System\wWNhCsp.exe
  C:\Windows\System\wWNhCsp.exe
  2⤵
  PID:9632
- C:\Windows\System\eeQOZVw.exe
  C:\Windows\System\eeQOZVw.exe
  2⤵
  PID:9600
- C:\Windows\System\WJdyzin.exe
  C:\Windows\System\WJdyzin.exe
  2⤵
  PID:9756
- C:\Windows\System\iVkvsNl.exe
  C:\Windows\System\iVkvsNl.exe
  2⤵
  PID:9784
- C:\Windows\System\hNBTRXk.exe
  C:\Windows\System\hNBTRXk.exe
  2⤵
  PID:9816
- C:\Windows\System\ZoMGCgW.exe
  C:\Windows\System\ZoMGCgW.exe
  2⤵
  PID:9844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DPYENjM.exe

Filesize
2.7MB

MD5
1ca33b63b28d325b3fbe2b0498e76401

SHA1
6fc3c1dc5cd98b0b6c255be1a93fcb58acc1c5ba

SHA256
b65b8223a61f7f1cc675dbb3c11a5b4ade11d1dd6a964d0be7668f26a542e220

SHA512
1a925093cca9b33b35bace8a598216939895990a9ee0cbe4d8f3206b5ace91ef98e533b38a9d4b40c40c802b3261c8fefa6da4ac0514caa1223bccc8ed07fdaa

Download Submit
C:\Windows\system\MbFRBqF.exe

Filesize
2.7MB

MD5
f05096ce57461982832018da8f075672

SHA1
e72119f934a2f3ed6a85b39c05c0e7c1b489ee48

SHA256
d15140265f6b4137f44943491411388e9a50334a2103aaff539c0a15e67b36c9

SHA512
89e1a69771888bf24290d46d7ccf898ca7b1369b2cd3e2d1a336df2b8ed807a8dea9a6aeccb3e0b020129e956bcb01df3f29cdd6aa5be93a4789eaeb3c465a61

Download Submit
C:\Windows\system\NtrleeX.exe

Filesize
2.7MB

MD5
6a870ca130031c24034659d401dbb310

SHA1
4ce8a35ac2f3b1c61d1710cee59dfe7f02b25dc2

SHA256
22595708a9045592089979079f861bdbe54a4e131789762cbc571dbfb6406407

SHA512
1499e505f536668bab4ccf57a0502ba59a44d74d24cbaf91ba510248834129b578fcf2219cc902d6ca7ab3effe953d637acaefc835ac85c9e4ec74b5077b0ee5

Download Submit
C:\Windows\system\OLaEEOX.exe

Filesize
2.7MB

MD5
7f86b9a8d1abd243957f9ffbe499b911

SHA1
d33c44ef78408197a2140fc31ad6ad88064af1f8

SHA256
b9ac3e6ded753ef2fe64f2f62f6d69ae4312268da042f2f5974db8af98664a38

SHA512
3d6c2315abdc8da5c636bf4e86475b7ba0e64f7b910a3f19e5f6c89bc2c63680de39475aa2287a9640e38dc90027ab73ba82e584b5994c1c27957963303f2f21

Download Submit
C:\Windows\system\QYNrHVy.exe

Filesize
2.7MB

MD5
ef96ec1f0e737f293984dbf67ab63812

SHA1
df32b8fe5a23ccbff7bace493c8a02900e2096e1

SHA256
673969b5e8cb8a2b81157797d631a50a4682d4c9a69c38708839b15d624c58e4

SHA512
8157068fe0059328bf2059d2983f6586795cf99ed8f802e0b6a3778666cb060177d2dbb8ad8e5358a8e555fc2f21123e52fdca1dad1c08ec639946f93928b3d3

Download Submit
C:\Windows\system\RNBTXPP.exe

Filesize
2.7MB

MD5
9294456d14f139d702ea5d040ceffa03

SHA1
bb5ed2250841ad89c91269829e3522b509309f5e

SHA256
f7dc4f359c49b26ded2309bf8c89d6f3c283f048b7e3d52b6a76faccbf5a8c0a

SHA512
8da47bb69452940694c2200008a6140b0b46cc410f883ded9f93136bf536aa975f833ef8e85ca5a3676e39fd6f3c3a6d8380c14f04a26fcba58ecb7dc47de3e9

Download Submit
C:\Windows\system\RvMAMGF.exe

Filesize
2.7MB

MD5
132df14481d9c82a2d80a1baf8aadd9c

SHA1
3d17d50cb13d3f4507dca597b8ec7a8399a876ae

SHA256
3339f9bd7cf3c7b984596b23a9a5e75c5878426eb3e7a8cf7e2388244ef4dd11

SHA512
54cc1434d422bdf36c560ed5d7e651d07726fb5d3dd4e0a3a55708a85ff852eb3699056891f7388523aa82c00b4e64370721f15af7af75b1577363f81680c4be

Download Submit
C:\Windows\system\SZVeXfO.exe

Filesize
2.7MB

MD5
1e941fb98e2021a8bf24c8a77d38d2a2

SHA1
615a5f2d253535213c10aa4b6b0856a97046521e

SHA256
9fe5dff942b06c845c5d02adaddcbbc764b3350589dc82ec28b81a8421eff6b7

SHA512
5db5348bb1a938c7ef2e2595145c7c8c743300bbf143e8af00f4d774e7147f75d0e8d7cfc53a0e6484698da5bbb9f14a2432a91c9df13c62bc700756e6947476

Download Submit
C:\Windows\system\SbCxxVh.exe

Filesize
2.7MB

MD5
2b28b67b802db144718ff31f3f3b33cc

SHA1
177a692b6c025ff89a624e14ed7200cccf0ddcd2

SHA256
ae4eba6b6751fe639a5ccafd376f4f88ab095b0b51f2a823d175bc9e08913cbd

SHA512
80fa58247825c056bc5c5eabb1fa1e7069fde2b884254aa155727507244ba3d84f6014b56de715cab1baa1710d538353fbaf25829566221e0253191f9df6cecc

Download Submit
C:\Windows\system\TyuriUd.exe

Filesize
2.7MB

MD5
cfcf847c8dfe510f41f14a3b8b1ea948

SHA1
aeaeece4bb6108952b5b538fc8a6b7f931c45652

SHA256
a9b967ce9b79e313593233785d5eb8b9fd698ef7bb1c84ba1778176a4d35102f

SHA512
6f74c8f9a79ca84bb42acc79c90f1d2830c877559bee64420b96b6f7929e43b610dcc43cc2417480d6b0a16903f8742fb5b11595c71ee9215f304fab66000b85

Download Submit
C:\Windows\system\USVSlNu.exe

Filesize
2.7MB

MD5
10a5e94b27e1809ab82a818bdb3f69c0

SHA1
6511f2923054cee73e89224057c9431f4f0211f2

SHA256
621cd114ff0c20cc37b8371e7c5f3f902c06285a03c8c48cf8f0f2111d535104

SHA512
0b95e31dc72e5adc421cb27e7753e9a71ae1f0ab5d9c3c7439fe2fe9e01efd59f4ca6b89a74bb63f4c7e148664167a9fa2825c75b032b186a3defff229fbf5ee

Download Submit
C:\Windows\system\VCHfsPF.exe

Filesize
2.7MB

MD5
7084faf5d984b899e7bee8003cffe799

SHA1
4c09cbc99a906ff81a30012a2a699e02a861dbc4

SHA256
992804d6007603680291c5de038145d2bf0190bed62618f1229f4af71f47b504

SHA512
3bd5cb7949119708d86837d87c12b0bd4f1474f12aaff3d20121ea04b5aeecfc283280002bd6d385accb5ac9b553d2dba1ff7b86ce70188a5262232d8428f418

Download Submit
C:\Windows\system\WsfHAwo.exe

Filesize
2.7MB

MD5
0df3fd995fb0630fece30b5e0deeff1a

SHA1
61fc8e610bfa135bd07e57c2d7e108eefafb7b4c

SHA256
20358655ae61fe795538ef6953c17f2074ca5cad35902336f79aef0cd29dc762

SHA512
e5d7b854e1f579127973681c62851e9922d2e8bd827e9e1cbff9a21342369bd861e8ce9f3e15a4641cc44a6fdd071ba945709b90e49ec86ecfae8b9d9a64669d

Download Submit
C:\Windows\system\YiODMaA.exe

Filesize
2.7MB

MD5
2e6a8f23bad660efc34fef68248d2ecf

SHA1
c5ea157665afa9f197b678142d30fdb12031cbeb

SHA256
8faf67bc435d9d42a83aa6fc364ba3123159d2faa738bd23cc0206a0fce3fce8

SHA512
b7fc4a102f9237f9bc85ec891d43569f87f08c4ac54c666129cf909e2e0c761b04b6a47b4cecae5e062b8836162e64149f3c6e2145e71ac16020a189633d1525

Download Submit
C:\Windows\system\ZEJzLkY.exe

Filesize
2.7MB

MD5
05a56b5ad54609c94fcfdf32622713b9

SHA1
51f65a06d095347d9e85fda397f2eeab93058022

SHA256
b3b1fdf801a5074713585a4ac632c6280aa69ef30e48a66cd4dfd52f0904a888

SHA512
7dc59b18fdf4289abce54943c2e362d008423e0a7c381ebba92ab95d309f4b0b50fa096141d75e27e69d80a35d6d2ee8d586d3cf7082ff424f482b6ec4358d00

Download Submit
C:\Windows\system\dDOqJwp.exe

Filesize
2.7MB

MD5
f71762f3f28acbe4ff63eaf3e4cef3a1

SHA1
94a3dd2d8fb60a8588ac565eed86f054df97e75c

SHA256
9155f09cc46ce97169a6456c8240233c04f2510a0be823b5ea78f96769d9fd76

SHA512
237dacbf7a44b8bcdaca07fdcbbbd2e3abb14dd6b8f3a6b2d4152b90bfe15cf7d66db92b13a4ab9cb8bf4529f0037eec7cbcef0ff03f2a700a6cd592d5177cd1

Download Submit
C:\Windows\system\gNHJwsz.exe

Filesize
2.7MB

MD5
1ea7e82861279754c4bbaeb67b50838b

SHA1
87bf7813e869d11e4eede43dd2fa785e50916c83

SHA256
3f1ff64e22875ed59cde59a195faeb97a4b19a6167d05ef3721d6de1b049846a

SHA512
159aa9942f37dc596eb00b218203fd8cd7397ecec87aa2271419a73458fdc7dc44af517285de7c1ffdf0bfe88a8e0cae394c95c7fecd8790e3a21fe8ad5de0a4

Download Submit
C:\Windows\system\gfmFjUO.exe

Filesize
2.7MB

MD5
9293a8127fa81855a38101acf90a446e

SHA1
5cbc17f77f6449207e78fd94f02090d5c8b6d97e

SHA256
5da284f2eb187395a4f8c10c6bd74579b5647ace5798f43940ae49be97960b9e

SHA512
41b57c5f70fb2a45c745af5ebe72e2d93211a58c1a32f350388ce9c63215c7bf00557ab917925d76d4fd91591b941ffe80bfe319612f28051e1ccdf049d6cee9

Download Submit
C:\Windows\system\hjnDYGq.exe

Filesize
2.7MB

MD5
430eb5406996fffee5406fac97190757

SHA1
b2cea325b186a12388b0d1e0db5ec7f3be9e8811

SHA256
aeb4d6f1683f68cba368f496c4c4e5d105cf2bbeb44d2e5716081bad566b1909

SHA512
8a81fe1277894e041f97571957816725867e8c70f2de542b3bac020c994a08e85736a8cc282a0e0fa63929f7169c1c4e0a1e64c2ac737daabfe42ea5a0db699a

Download Submit
C:\Windows\system\lMGYmco.exe

Filesize
2.7MB

MD5
106dcf3100032324720ee691f8d22da6

SHA1
e5d6be5c0d55bcb695721de12f44d9051b6edbe1

SHA256
baa41dd4fe5b4a63905d2153f1c2bcef80fb61443745cd86d338bd33a82e9884

SHA512
dfef006f37b411e89d59afd4ab08344c67b9ba402e115f587da058c992950f70ef40730a90c024bcc31673b6eb189619dd0a5c1349a48a8df49a855c75118222

Download Submit
C:\Windows\system\lzmQtAi.exe

Filesize
2.7MB

MD5
ee2a4ea8ea0e2c5e14d6f8cb3be415c5

SHA1
0ca1184921f5f65cbbfdd7de1dc874497cda6b42

SHA256
1a9f845e05d9e0cacd0bcabd695c74f6dc84a1fd0f8d833d0fe2ec126ae8b9f0

SHA512
78c349c3a53b2e9356f0a63e7d5fba180467634f81611546c39551377d1e02bbe06471ae0712433595cc04d3e4bba7489e3505abb5b2d0c95cc8cadf51eadbb6

Download Submit
C:\Windows\system\mtIURLA.exe

Filesize
2.7MB

MD5
c0366fece6a5a973b6865f6b218c750e

SHA1
74db3d843cd97435456ed01b889adde434420dfc

SHA256
e73c03d25b006dcf83fc6b14ee4883d14819a2d94785dc394cb2181e47789063

SHA512
dcd8ef79767c4b131d30b84d0d30d43bfcfac9da1116d0b3d430123227961cfed704362be56bce60436ac4f15ffa922d83eef340f7c3cfad280bafdab3f918cf

Download Submit
C:\Windows\system\nOeYHCO.exe

Filesize
2.7MB

MD5
0e7521af65477a8f4c2be9e0bbf7571e

SHA1
7978219e94e7e6fad5bb614fabedd8f3e71ec07f

SHA256
d77907713b259f4d9b3284b95423b89325569402111a9ae1476ba805605084e9

SHA512
18c7b61ed241d20a9c43d69ac80cf00f254d2e8a9ac22cc1ed2cdd4b7607a937ff4f0adfd36e6851505bae3e7b9b1f905b60f3277af89961e0ce864d2bdef0e2

Download Submit
C:\Windows\system\owQBkUG.exe

Filesize
2.7MB

MD5
705ff0adc62a7c459d3a4f59f31049d3

SHA1
1a442b9c5f9e0085d95b07f79eef83592b3cdf6a

SHA256
062866467aada1e3b24186f82e94c515fc1c7f06bb6227be617f382d5a4c3fe7

SHA512
fc5c5961c65a7a212a12670be0550429650446e32e1a776a7675695cd1a33fe72f7b375daecf0ec8fa6dd8c079c6ea1c76ca7fbf439f603e6f405b5d7d82421e

Download Submit
C:\Windows\system\tAAWDDF.exe

Filesize
2.7MB

MD5
8657c91f1db28ebc499d65a6b9777e7e

SHA1
8ba591b8f7652e25cc4752c69d105870d4c027a0

SHA256
ee8461c8d4f7b60f7d7761424a140f017c00eb0f38fbb3f97b751e9e44d0a958

SHA512
8198d91db2866106d35f4e530a7a7b799308e3df288076b5e4f83137ad96f1069c1642d3c3e6fa568cd63f0c51a53af2f75a3599e6e302d4e9474149b80bef7b

Download Submit
C:\Windows\system\uUothmx.exe

Filesize
2.7MB

MD5
5844d37bb58efe9873192ae70c078401

SHA1
fdd46a897123343ccfdb05b62afdb75931a7f6fa

SHA256
1d63dd7786579661a40257242bd509e56074ad41f4572d319507328e6ec0e00b

SHA512
66274f4eef6f2ead08a305d98c4e02dfb7b5d6d559a9011a0e45daad8a3d3db9fb40973d385b5b756ca4061500acadd63cd71797b9d34241e740035e4a07bb50

Download Submit
C:\Windows\system\ubsgePL.exe

Filesize
2.7MB

MD5
c93d9d18a11a807c10b00d425f6e7a9b

SHA1
4a3d99ab3272a23e92a52bdf178dc6b1ba5c17f2

SHA256
f86aedef8f803718c52deb942e5a5c4e96b304307dbf7df1448d138356afad6f

SHA512
7837aa9ebe5b92c652473e6068c15360efb9ec9de7128aa00aba8912ac9bc0813e3b13ef18edf6b12fbd9f1e9c144d31853de66c34df4136aefff29ed5043103

Download Submit
C:\Windows\system\vNqEQaD.exe

Filesize
2.7MB

MD5
0294da91b1e762665794b9b943197b8a

SHA1
d130ba0c6bb7debdbb0820cd62ca9a898555b0de

SHA256
dcae1e0438c61844849fb952d1cd164b8989e687509e6d1b7e8a96bcbbc2f6cd

SHA512
383f1fced66346d5f3822a85227cd1dba33371b5c839b9c945bed0391ecd24601c605274aa023a55ff4f388fb25d0819992466769a88b478b27b4e1b6414ef2b

Download Submit
C:\Windows\system\xdEzvCq.exe

Filesize
2.7MB

MD5
fa272c4fd484cbb463c509f1474bbce8

SHA1
fa83c0a9401263f683c03f65af30139816848805

SHA256
bc99ccfb30a57ab51e4cb84bc42505634ae5f49fcfede7b9866466f18d1f1e7f

SHA512
a77bc014c989b98065e4d648b40fd2989b783f353e65619e8d440d3e7bf907ea9a9c16f07f0e6bfb01bb0c9fb424f5e4b76ddce1b95e41633db9478c6e0acabf

Download Submit
\Windows\system\BqwJMtk.exe

Filesize
2.7MB

MD5
ba91cfd0d483b202e51e41c93d05ad71

SHA1
0b0682ca35c0fc04da3531bca671c73dc8ef28ee

SHA256
3713b55523bd76170fafdb84d717abef21b8fc952b69c3ccdb6d557ba6af0388

SHA512
16db2d3b5be6b6e6f2f2a8c5d1710fc1210d426e01618af5ac8b081a98860916593ebcb67e6ff000ba12a14fb597bda386fc996222fb87d9d872db13f1414578

Download Submit
\Windows\system\OnmfSin.exe

Filesize
2.7MB

MD5
c8ea45dd937d620f897429f6bc922d07

SHA1
e277ee9322f0770aab9f7465b1fc23d96015e0f2

SHA256
bbac2630c2aaf100a17c42b0da74786e753aadf3bccad33e44fb8e17300b0464

SHA512
7fde97fcd4cef7dae6dff1216a44bce1ed4f2e4eb4877ef9e97bdabc5c75c5b2a79a08becda2c9ef8214dad57bde50be7a5113d00cf92e200e0b67fd95d54131

Download Submit
\Windows\system\rApvXTX.exe

Filesize
2.7MB

MD5
db9e1bd19f3488f3586b2c0d3b1c9331

SHA1
c20a7a0be4f6874915f67b9ae4ae660b465e3056

SHA256
accd0ad50b78c880d50c8e9c3da257ea51a2e88a3e5cc5149968382849a5e858

SHA512
fbe73f132c1ad9b68f19895928e3cc2d86a72af457a7678a21bd8f6faa2c1b7e854f11176fb6c530f3102e2eab69cbde94b692f704e042c154d9b2f3b4d2b4e7

Download Submit
memory/1060-100-0x000000013F290000-0x000000013F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/1060-4057-0x000000013F290000-0x000000013F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/1060-2713-0x000000013F290000-0x000000013F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/1500-94-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/1500-4058-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/1668-4055-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/1668-1913-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/1668-85-0x000000013F720000-0x000000013FA74000-memory.dmp

Filesize
3.3MB

Download
memory/1736-78-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/1736-4059-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/1872-4048-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/1872-61-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/1872-14-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/1988-8-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/2532-4054-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2532-1113-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2532-70-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2616-4060-0x000000013FE80000-0x00000001401D4000-memory.dmp

Filesize
3.3MB

Download
memory/2616-21-0x000000013FE80000-0x00000001401D4000-memory.dmp

Filesize
3.3MB

Download
memory/2628-4049-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2628-83-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2628-27-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2680-98-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2680-4052-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2680-40-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2684-47-0x000000013F1F0000-0x000000013F544000-memory.dmp

Filesize
3.3MB

Download
memory/2684-4053-0x000000013F1F0000-0x000000013F544000-memory.dmp

Filesize
3.3MB

Download
memory/2684-107-0x000000013F1F0000-0x000000013F544000-memory.dmp

Filesize
3.3MB

Download
memory/2692-62-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4056-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/2692-859-0x000000013F0E0000-0x000000013F434000-memory.dmp

Filesize
3.3MB

Download
memory/2740-89-0x000000013F980000-0x000000013FCD4000-memory.dmp

Filesize
3.3MB

Download
memory/2740-4050-0x000000013F980000-0x000000013FCD4000-memory.dmp

Filesize
3.3MB

Download
memory/2740-33-0x000000013F980000-0x000000013FCD4000-memory.dmp

Filesize
3.3MB

Download
memory/2820-359-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2820-4051-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2820-55-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2988-46-0x000000013F5A0000-0x000000013F8F4000-memory.dmp

Filesize
3.3MB

Download
memory/2988-1-0x0000000000190000-0x00000000001A0000-memory.dmp

Filesize
64KB

Download
memory/2988-1912-0x0000000001F10000-0x0000000002264000-memory.dmp

Filesize
3.3MB

Download
memory/2988-99-0x0000000001F10000-0x0000000002264000-memory.dmp

Filesize
3.3MB

Download
memory/2988-2521-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2988-2712-0x0000000001F10000-0x0000000002264000-memory.dmp

Filesize
3.3MB

Download
memory/2988-0-0x000000013F5A0000-0x000000013F8F4000-memory.dmp

Filesize
3.3MB

Download
memory/2988-2774-0x000000013F120000-0x000000013F474000-memory.dmp

Filesize
3.3MB

Download
memory/2988-36-0x0000000001F10000-0x0000000002264000-memory.dmp

Filesize
3.3MB

Download
memory/2988-32-0x000000013F980000-0x000000013FCD4000-memory.dmp

Filesize
3.3MB

Download
memory/2988-54-0x000000013F950000-0x000000013FCA4000-memory.dmp

Filesize
3.3MB

Download
memory/2988-19-0x000000013FE80000-0x00000001401D4000-memory.dmp

Filesize
3.3MB

Download
memory/2988-84-0x0000000001F10000-0x0000000002264000-memory.dmp

Filesize
3.3MB

Download
memory/2988-58-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2988-26-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2988-12-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2988-69-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2988-90-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/2988-1112-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2988-1423-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/2988-77-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download