xmrig | 96765a91b6f6597b00c9d7904ac3e7b6a2975d67d9482fd68a0944ee77eea276

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
Size

2.9MB
MD5

50c6c8d132d9283ef923c236c36ff090
SHA1

74c9fea91dadd0e36514d312506d27c8549e1d7e
SHA256

96765a91b6f6597b00c9d7904ac3e7b6a2975d67d9482fd68a0944ee77eea276
SHA512

5ef96e3f912197082e9bd031429e5b6efb67b653a5f6f1e354c73d3c2077930c3caf73791fff76a08990d7e20d05cd5a26b7ef00af359d1a91ec6fc14d04a318
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a2yKmktEf:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2752-1-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/files/0x000c00000001269e-6.dat	xmrig
behavioral1/files/0x002f00000001566b-8.dat	xmrig
behavioral1/files/0x0008000000015ca6-14.dat	xmrig
behavioral1/files/0x0007000000004e76-29.dat	xmrig
behavioral1/files/0x0008000000015ce1-33.dat	xmrig
behavioral1/files/0x0008000000016117-44.dat	xmrig
behavioral1/files/0x0006000000016572-60.dat	xmrig
behavioral1/files/0x000600000001661c-64.dat	xmrig
behavioral1/files/0x0006000000016d0d-96.dat	xmrig
behavioral1/files/0x0006000000016d3a-108.dat	xmrig
behavioral1/files/0x0006000000016da7-120.dat	xmrig
behavioral1/memory/2448-745-0x000000013FF00000-0x00000001402F6000-memory.dmp	xmrig
behavioral1/memory/2312-523-0x000000013F030000-0x000000013F426000-memory.dmp	xmrig
behavioral1/memory/2752-979-0x000000013F430000-0x000000013F826000-memory.dmp	xmrig
behavioral1/memory/2752-1102-0x0000000003660000-0x0000000003A56000-memory.dmp	xmrig
behavioral1/memory/2452-1101-0x000000013F430000-0x000000013F826000-memory.dmp	xmrig
behavioral1/memory/2752-1268-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig
behavioral1/memory/1728-1267-0x000000013F680000-0x000000013FA76000-memory.dmp	xmrig
behavioral1/memory/3008-1235-0x000000013F7F0000-0x000000013FBE6000-memory.dmp	xmrig
behavioral1/memory/2752-1215-0x0000000003660000-0x0000000003A56000-memory.dmp	xmrig
behavioral1/memory/2996-1214-0x000000013FCB0000-0x00000001400A6000-memory.dmp	xmrig
behavioral1/memory/2508-1180-0x000000013F4A0000-0x000000013F896000-memory.dmp	xmrig
behavioral1/memory/2496-978-0x000000013F160000-0x000000013F556000-memory.dmp	xmrig
behavioral1/memory/2752-977-0x000000013F160000-0x000000013F556000-memory.dmp	xmrig
behavioral1/memory/2620-976-0x000000013F130000-0x000000013F526000-memory.dmp	xmrig
behavioral1/memory/2752-975-0x000000013F130000-0x000000013F526000-memory.dmp	xmrig
behavioral1/memory/2836-974-0x000000013F020000-0x000000013F416000-memory.dmp	xmrig
behavioral1/memory/2608-873-0x000000013F190000-0x000000013F586000-memory.dmp	xmrig
behavioral1/memory/2636-729-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig
behavioral1/files/0x0006000000017052-140.dat	xmrig
behavioral1/files/0x0006000000016eb2-136.dat	xmrig
behavioral1/files/0x0006000000016e94-132.dat	xmrig
behavioral1/files/0x0006000000016dbf-128.dat	xmrig
behavioral1/files/0x0006000000016dbb-124.dat	xmrig
behavioral1/files/0x0006000000016d90-116.dat	xmrig
behavioral1/files/0x0006000000016d7e-112.dat	xmrig
behavioral1/files/0x0006000000016d26-104.dat	xmrig
behavioral1/files/0x0006000000016d1e-100.dat	xmrig
behavioral1/files/0x0006000000016ce4-92.dat	xmrig
behavioral1/files/0x0006000000016cb7-88.dat	xmrig
behavioral1/files/0x0006000000016c6b-84.dat	xmrig
behavioral1/files/0x0006000000016c63-80.dat	xmrig
behavioral1/files/0x0006000000016c4a-76.dat	xmrig
behavioral1/files/0x0006000000016a9a-72.dat	xmrig
behavioral1/files/0x0006000000016843-68.dat	xmrig
behavioral1/files/0x00060000000164b2-56.dat	xmrig
behavioral1/files/0x000600000001630b-52.dat	xmrig
behavioral1/files/0x00060000000161e7-48.dat	xmrig
behavioral1/files/0x0007000000015d07-41.dat	xmrig
behavioral1/files/0x0007000000015ceb-36.dat	xmrig
behavioral1/memory/2312-3346-0x000000013F030000-0x000000013F426000-memory.dmp	xmrig
behavioral1/memory/2636-3450-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig
behavioral1/memory/2608-3925-0x000000013F190000-0x000000013F586000-memory.dmp	xmrig
behavioral1/memory/2452-3920-0x000000013F430000-0x000000013F826000-memory.dmp	xmrig
behavioral1/memory/2620-3929-0x000000013F130000-0x000000013F526000-memory.dmp	xmrig
behavioral1/memory/2496-4543-0x000000013F160000-0x000000013F556000-memory.dmp	xmrig
behavioral1/memory/2448-4539-0x000000013FF00000-0x00000001402F6000-memory.dmp	xmrig
behavioral1/memory/2836-4547-0x000000013F020000-0x000000013F416000-memory.dmp	xmrig
behavioral1/memory/3008-4575-0x000000013F7F0000-0x000000013FBE6000-memory.dmp	xmrig
behavioral1/memory/2508-4583-0x000000013F4A0000-0x000000013F896000-memory.dmp	xmrig
behavioral1/memory/2752-5557-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/memory/2752-5718-0x000000013F160000-0x000000013F556000-memory.dmp	xmrig
behavioral1/memory/2752-5715-0x000000013F130000-0x000000013F526000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1728	PcGNdPx.exe
2312	rOrAWly.exe
2636	gFQAlTx.exe
2448	CBqvcCr.exe
2608	pyqkXSY.exe
2836	azsyXuf.exe
2620	hQXrzIO.exe
2496	VPwZpmq.exe
2452	VfnPwqO.exe
2508	NXcYsBl.exe
2996	GSIJvNe.exe
3008	kkOXtmG.exe
2244	vFTdVWR.exe
2776	UyChBow.exe
2808	MpmdJVm.exe
2848	uIbQjvw.exe
2872	HJNOybx.exe
2660	evedKJB.exe
2992	rWagGun.exe
1852	LSAilfz.exe
2504	MIXkcCk.exe
2176	wyawDdc.exe
664	lvwDOLw.exe
2704	AfTGNlc.exe
2756	GaVcrrR.exe
2156	nkhcVJA.exe
3044	lhFTdsz.exe
3020	QOeBWJn.exe
2064	OBaaecx.exe
2628	gTlygvn.exe
2424	ZMsyCbO.exe
1100	ruxIrvy.exe
1048	NDAaXrG.exe
596	xbakGRy.exe
1488	KlEJzch.exe
532	RmwjayZ.exe
1680	sQRvFYU.exe
2972	jAhniSZ.exe
2392	qPFdgmS.exe
2168	oGQVqpe.exe
700	MsHECaG.exe
1088	fKagOvP.exe
1272	pHVxAnC.exe
2108	IEplYXB.exe
1760	iFrgDAQ.exe
272	ZCNhDAd.exe
1860	zdYGARn.exe
1940	LpNAAji.exe
1388	TvuaxpN.exe
852	FhkVKkW.exe
1032	zcCeCkh.exe
1028	kwFwhha.exe
868	Lyypplx.exe
920	mheIKtV.exe
1956	ToZDMZl.exe
992	csGmOUZ.exe
2928	dqOuJED.exe
2032	stlxeXe.exe
1444	zsxIByD.exe
1252	MzOiAoQ.exe
1308	liNhlul.exe
2240	vNfocnc.exe
1988	aPFmCoz.exe
1692	dKDRPwY.exe

Loads dropped DLL 64 IoCs

pid	Process
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2752-1-0x000000013F890000-0x000000013FC86000-memory.dmp	upx
behavioral1/files/0x000c00000001269e-6.dat	upx
behavioral1/files/0x002f00000001566b-8.dat	upx
behavioral1/files/0x0008000000015ca6-14.dat	upx
behavioral1/files/0x0007000000004e76-29.dat	upx
behavioral1/files/0x0008000000015ce1-33.dat	upx
behavioral1/files/0x0008000000016117-44.dat	upx
behavioral1/files/0x0006000000016572-60.dat	upx
behavioral1/files/0x000600000001661c-64.dat	upx
behavioral1/files/0x0006000000016d0d-96.dat	upx
behavioral1/files/0x0006000000016d3a-108.dat	upx
behavioral1/files/0x0006000000016da7-120.dat	upx
behavioral1/memory/2448-745-0x000000013FF00000-0x00000001402F6000-memory.dmp	upx
behavioral1/memory/2312-523-0x000000013F030000-0x000000013F426000-memory.dmp	upx
behavioral1/memory/2452-1101-0x000000013F430000-0x000000013F826000-memory.dmp	upx
behavioral1/memory/1728-1267-0x000000013F680000-0x000000013FA76000-memory.dmp	upx
behavioral1/memory/3008-1235-0x000000013F7F0000-0x000000013FBE6000-memory.dmp	upx
behavioral1/memory/2996-1214-0x000000013FCB0000-0x00000001400A6000-memory.dmp	upx
behavioral1/memory/2508-1180-0x000000013F4A0000-0x000000013F896000-memory.dmp	upx
behavioral1/memory/2496-978-0x000000013F160000-0x000000013F556000-memory.dmp	upx
behavioral1/memory/2620-976-0x000000013F130000-0x000000013F526000-memory.dmp	upx
behavioral1/memory/2836-974-0x000000013F020000-0x000000013F416000-memory.dmp	upx
behavioral1/memory/2608-873-0x000000013F190000-0x000000013F586000-memory.dmp	upx
behavioral1/memory/2636-729-0x000000013FE30000-0x0000000140226000-memory.dmp	upx
behavioral1/files/0x0006000000017052-140.dat	upx
behavioral1/files/0x0006000000016eb2-136.dat	upx
behavioral1/files/0x0006000000016e94-132.dat	upx
behavioral1/files/0x0006000000016dbf-128.dat	upx
behavioral1/files/0x0006000000016dbb-124.dat	upx
behavioral1/files/0x0006000000016d90-116.dat	upx
behavioral1/files/0x0006000000016d7e-112.dat	upx
behavioral1/files/0x0006000000016d26-104.dat	upx
behavioral1/files/0x0006000000016d1e-100.dat	upx
behavioral1/files/0x0006000000016ce4-92.dat	upx
behavioral1/files/0x0006000000016cb7-88.dat	upx
behavioral1/files/0x0006000000016c6b-84.dat	upx
behavioral1/files/0x0006000000016c63-80.dat	upx
behavioral1/files/0x0006000000016c4a-76.dat	upx
behavioral1/files/0x0006000000016a9a-72.dat	upx
behavioral1/files/0x0006000000016843-68.dat	upx
behavioral1/files/0x00060000000164b2-56.dat	upx
behavioral1/files/0x000600000001630b-52.dat	upx
behavioral1/files/0x00060000000161e7-48.dat	upx
behavioral1/files/0x0007000000015d07-41.dat	upx
behavioral1/files/0x0007000000015ceb-36.dat	upx
behavioral1/memory/2312-3346-0x000000013F030000-0x000000013F426000-memory.dmp	upx
behavioral1/memory/2636-3450-0x000000013FE30000-0x0000000140226000-memory.dmp	upx
behavioral1/memory/2608-3925-0x000000013F190000-0x000000013F586000-memory.dmp	upx
behavioral1/memory/2452-3920-0x000000013F430000-0x000000013F826000-memory.dmp	upx
behavioral1/memory/2620-3929-0x000000013F130000-0x000000013F526000-memory.dmp	upx
behavioral1/memory/2496-4543-0x000000013F160000-0x000000013F556000-memory.dmp	upx
behavioral1/memory/2448-4539-0x000000013FF00000-0x00000001402F6000-memory.dmp	upx
behavioral1/memory/2836-4547-0x000000013F020000-0x000000013F416000-memory.dmp	upx
behavioral1/memory/3008-4575-0x000000013F7F0000-0x000000013FBE6000-memory.dmp	upx
behavioral1/memory/2508-4583-0x000000013F4A0000-0x000000013F896000-memory.dmp	upx
behavioral1/memory/2752-5557-0x000000013F890000-0x000000013FC86000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WTFikRB.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\VGNPsDv.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\RHLhYwA.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\yUeGGzv.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\eIxvWuF.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\JtpHbxb.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\xsjjCcN.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\Iohkvqk.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\SGGHVBI.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\RJpchXN.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\JEPAmMC.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\dJIaCYz.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\oVHklnc.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\QrsTemD.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\ZbhBbhj.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\SWGpVuJ.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\zSvKwMH.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\hJAxGbg.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\LlKplOt.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\VCgcQQg.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\NnsFnwy.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\DygMkjn.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\MSHxcCt.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\csGmOUZ.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\kYhXvnC.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\zgbbPLJ.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\EfIkDnO.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\nKIIVPW.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\GBANBCT.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\tBhgKtp.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\wAQCzpT.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\XbsYJDs.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\IahfjKM.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\peCDVlk.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\PYmzGHW.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\LtZqKwN.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\FJitBdD.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\ZRLPbiE.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\iqtRMom.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\EKtdCbe.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\CqeRHVm.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\gGlqZlx.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\QLvKHiU.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\PlTKtKx.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\LAJedkM.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\AwKCTDB.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\OYJhIDQ.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\ErJyVYD.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\iNVXVmo.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\QZGsQBH.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\HAOeyZu.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\mvhxxOU.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\ynRYBes.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\QtxZMvx.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\tzdXccF.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\LRofuWf.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\qrUmaTE.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\lSRgBdq.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\VnHxOil.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\vkmZLsq.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\IdpMEuN.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\OLaFHtp.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\UCScQhM.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
File created	C:\Windows\System\IXAsQGp.exe	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
Token: SeDebugPrivilege	1740	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 1740	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	29
PID 2752 wrote to memory of 1740	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	29
PID 2752 wrote to memory of 1740	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	29
PID 2752 wrote to memory of 1728	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	30
PID 2752 wrote to memory of 1728	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	30
PID 2752 wrote to memory of 1728	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	30
PID 2752 wrote to memory of 2312	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	31
PID 2752 wrote to memory of 2312	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	31
PID 2752 wrote to memory of 2312	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	31
PID 2752 wrote to memory of 2636	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	32
PID 2752 wrote to memory of 2636	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	32
PID 2752 wrote to memory of 2636	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	32
PID 2752 wrote to memory of 2448	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	33
PID 2752 wrote to memory of 2448	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	33
PID 2752 wrote to memory of 2448	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	33
PID 2752 wrote to memory of 2608	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	34
PID 2752 wrote to memory of 2608	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	34
PID 2752 wrote to memory of 2608	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	34
PID 2752 wrote to memory of 2836	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	35
PID 2752 wrote to memory of 2836	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	35
PID 2752 wrote to memory of 2836	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	35
PID 2752 wrote to memory of 2620	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	36
PID 2752 wrote to memory of 2620	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	36
PID 2752 wrote to memory of 2620	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	36
PID 2752 wrote to memory of 2496	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	37
PID 2752 wrote to memory of 2496	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	37
PID 2752 wrote to memory of 2496	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	37
PID 2752 wrote to memory of 2452	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	38
PID 2752 wrote to memory of 2452	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	38
PID 2752 wrote to memory of 2452	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	38
PID 2752 wrote to memory of 2508	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	39
PID 2752 wrote to memory of 2508	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	39
PID 2752 wrote to memory of 2508	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	39
PID 2752 wrote to memory of 2996	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	40
PID 2752 wrote to memory of 2996	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	40
PID 2752 wrote to memory of 2996	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	40
PID 2752 wrote to memory of 3008	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	41
PID 2752 wrote to memory of 3008	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	41
PID 2752 wrote to memory of 3008	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	41
PID 2752 wrote to memory of 2244	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	42
PID 2752 wrote to memory of 2244	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	42
PID 2752 wrote to memory of 2244	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	42
PID 2752 wrote to memory of 2776	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	43
PID 2752 wrote to memory of 2776	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	43
PID 2752 wrote to memory of 2776	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	43
PID 2752 wrote to memory of 2808	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	44
PID 2752 wrote to memory of 2808	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	44
PID 2752 wrote to memory of 2808	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	44
PID 2752 wrote to memory of 2848	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	45
PID 2752 wrote to memory of 2848	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	45
PID 2752 wrote to memory of 2848	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	45
PID 2752 wrote to memory of 2872	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	46
PID 2752 wrote to memory of 2872	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	46
PID 2752 wrote to memory of 2872	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	46
PID 2752 wrote to memory of 2660	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	47
PID 2752 wrote to memory of 2660	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	47
PID 2752 wrote to memory of 2660	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	47
PID 2752 wrote to memory of 2992	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	48
PID 2752 wrote to memory of 2992	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	48
PID 2752 wrote to memory of 2992	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	48
PID 2752 wrote to memory of 1852	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	49
PID 2752 wrote to memory of 1852	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	49
PID 2752 wrote to memory of 1852	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	49
PID 2752 wrote to memory of 2504	2752	50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\50c6c8d132d9283ef923c236c36ff090_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\System\PcGNdPx.exe
  C:\Windows\System\PcGNdPx.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\rOrAWly.exe
  C:\Windows\System\rOrAWly.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\gFQAlTx.exe
  C:\Windows\System\gFQAlTx.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\CBqvcCr.exe
  C:\Windows\System\CBqvcCr.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\pyqkXSY.exe
  C:\Windows\System\pyqkXSY.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\azsyXuf.exe
  C:\Windows\System\azsyXuf.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\hQXrzIO.exe
  C:\Windows\System\hQXrzIO.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\VPwZpmq.exe
  C:\Windows\System\VPwZpmq.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\VfnPwqO.exe
  C:\Windows\System\VfnPwqO.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\NXcYsBl.exe
  C:\Windows\System\NXcYsBl.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\GSIJvNe.exe
  C:\Windows\System\GSIJvNe.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\kkOXtmG.exe
  C:\Windows\System\kkOXtmG.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\vFTdVWR.exe
  C:\Windows\System\vFTdVWR.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\UyChBow.exe
  C:\Windows\System\UyChBow.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\MpmdJVm.exe
  C:\Windows\System\MpmdJVm.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\uIbQjvw.exe
  C:\Windows\System\uIbQjvw.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\HJNOybx.exe
  C:\Windows\System\HJNOybx.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\evedKJB.exe
  C:\Windows\System\evedKJB.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\rWagGun.exe
  C:\Windows\System\rWagGun.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\LSAilfz.exe
  C:\Windows\System\LSAilfz.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\MIXkcCk.exe
  C:\Windows\System\MIXkcCk.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\wyawDdc.exe
  C:\Windows\System\wyawDdc.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\lvwDOLw.exe
  C:\Windows\System\lvwDOLw.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\AfTGNlc.exe
  C:\Windows\System\AfTGNlc.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\GaVcrrR.exe
  C:\Windows\System\GaVcrrR.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\nkhcVJA.exe
  C:\Windows\System\nkhcVJA.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\lhFTdsz.exe
  C:\Windows\System\lhFTdsz.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\QOeBWJn.exe
  C:\Windows\System\QOeBWJn.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\OBaaecx.exe
  C:\Windows\System\OBaaecx.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\gTlygvn.exe
  C:\Windows\System\gTlygvn.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\ZMsyCbO.exe
  C:\Windows\System\ZMsyCbO.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\ruxIrvy.exe
  C:\Windows\System\ruxIrvy.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\NDAaXrG.exe
  C:\Windows\System\NDAaXrG.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\xbakGRy.exe
  C:\Windows\System\xbakGRy.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\KlEJzch.exe
  C:\Windows\System\KlEJzch.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\RmwjayZ.exe
  C:\Windows\System\RmwjayZ.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\sQRvFYU.exe
  C:\Windows\System\sQRvFYU.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\jAhniSZ.exe
  C:\Windows\System\jAhniSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\qPFdgmS.exe
  C:\Windows\System\qPFdgmS.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\oGQVqpe.exe
  C:\Windows\System\oGQVqpe.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\MsHECaG.exe
  C:\Windows\System\MsHECaG.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\fKagOvP.exe
  C:\Windows\System\fKagOvP.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\pHVxAnC.exe
  C:\Windows\System\pHVxAnC.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\IEplYXB.exe
  C:\Windows\System\IEplYXB.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\iFrgDAQ.exe
  C:\Windows\System\iFrgDAQ.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ZCNhDAd.exe
  C:\Windows\System\ZCNhDAd.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\zdYGARn.exe
  C:\Windows\System\zdYGARn.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\LpNAAji.exe
  C:\Windows\System\LpNAAji.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\TvuaxpN.exe
  C:\Windows\System\TvuaxpN.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\FhkVKkW.exe
  C:\Windows\System\FhkVKkW.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\zcCeCkh.exe
  C:\Windows\System\zcCeCkh.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\kwFwhha.exe
  C:\Windows\System\kwFwhha.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\Lyypplx.exe
  C:\Windows\System\Lyypplx.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\mheIKtV.exe
  C:\Windows\System\mheIKtV.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\ToZDMZl.exe
  C:\Windows\System\ToZDMZl.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\csGmOUZ.exe
  C:\Windows\System\csGmOUZ.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\dqOuJED.exe
  C:\Windows\System\dqOuJED.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\stlxeXe.exe
  C:\Windows\System\stlxeXe.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\zsxIByD.exe
  C:\Windows\System\zsxIByD.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\MzOiAoQ.exe
  C:\Windows\System\MzOiAoQ.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\liNhlul.exe
  C:\Windows\System\liNhlul.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\vNfocnc.exe
  C:\Windows\System\vNfocnc.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\aPFmCoz.exe
  C:\Windows\System\aPFmCoz.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\dKDRPwY.exe
  C:\Windows\System\dKDRPwY.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\cVYnofr.exe
  C:\Windows\System\cVYnofr.exe
  2⤵
  PID:2940
- C:\Windows\System\CjByvVa.exe
  C:\Windows\System\CjByvVa.exe
  2⤵
  PID:2124
- C:\Windows\System\qNIjTux.exe
  C:\Windows\System\qNIjTux.exe
  2⤵
  PID:3060
- C:\Windows\System\vTUpCyL.exe
  C:\Windows\System\vTUpCyL.exe
  2⤵
  PID:1588
- C:\Windows\System\kBAvXZX.exe
  C:\Windows\System\kBAvXZX.exe
  2⤵
  PID:1684
- C:\Windows\System\IIpQrsU.exe
  C:\Windows\System\IIpQrsU.exe
  2⤵
  PID:1580
- C:\Windows\System\qBoKnIn.exe
  C:\Windows\System\qBoKnIn.exe
  2⤵
  PID:1092
- C:\Windows\System\YTXoaKz.exe
  C:\Windows\System\YTXoaKz.exe
  2⤵
  PID:2732
- C:\Windows\System\NJuYtSH.exe
  C:\Windows\System\NJuYtSH.exe
  2⤵
  PID:2580
- C:\Windows\System\GOJumiJ.exe
  C:\Windows\System\GOJumiJ.exe
  2⤵
  PID:2720
- C:\Windows\System\dHeNGTV.exe
  C:\Windows\System\dHeNGTV.exe
  2⤵
  PID:1948
- C:\Windows\System\jYiCgqk.exe
  C:\Windows\System\jYiCgqk.exe
  2⤵
  PID:2436
- C:\Windows\System\LMTAozO.exe
  C:\Windows\System\LMTAozO.exe
  2⤵
  PID:3004
- C:\Windows\System\jHjGJcj.exe
  C:\Windows\System\jHjGJcj.exe
  2⤵
  PID:1992
- C:\Windows\System\xpvSQSL.exe
  C:\Windows\System\xpvSQSL.exe
  2⤵
  PID:2828
- C:\Windows\System\MrZCuVX.exe
  C:\Windows\System\MrZCuVX.exe
  2⤵
  PID:2544
- C:\Windows\System\iyXJJlp.exe
  C:\Windows\System\iyXJJlp.exe
  2⤵
  PID:764
- C:\Windows\System\pIGVpGq.exe
  C:\Windows\System\pIGVpGq.exe
  2⤵
  PID:1584
- C:\Windows\System\fdtrtwB.exe
  C:\Windows\System\fdtrtwB.exe
  2⤵
  PID:348
- C:\Windows\System\vWEYpNs.exe
  C:\Windows\System\vWEYpNs.exe
  2⤵
  PID:2980
- C:\Windows\System\Gzvkxxa.exe
  C:\Windows\System\Gzvkxxa.exe
  2⤵
  PID:1916
- C:\Windows\System\eTeIDsS.exe
  C:\Windows\System\eTeIDsS.exe
  2⤵
  PID:2340
- C:\Windows\System\zpZYSEA.exe
  C:\Windows\System\zpZYSEA.exe
  2⤵
  PID:2912
- C:\Windows\System\PAbqHri.exe
  C:\Windows\System\PAbqHri.exe
  2⤵
  PID:756
- C:\Windows\System\ghwophU.exe
  C:\Windows\System\ghwophU.exe
  2⤵
  PID:904
- C:\Windows\System\QlOhqci.exe
  C:\Windows\System\QlOhqci.exe
  2⤵
  PID:2024
- C:\Windows\System\tIiyjok.exe
  C:\Windows\System\tIiyjok.exe
  2⤵
  PID:1804
- C:\Windows\System\RsWiRfo.exe
  C:\Windows\System\RsWiRfo.exe
  2⤵
  PID:960
- C:\Windows\System\awoffeX.exe
  C:\Windows\System\awoffeX.exe
  2⤵
  PID:2744
- C:\Windows\System\RJHNxdA.exe
  C:\Windows\System\RJHNxdA.exe
  2⤵
  PID:2028
- C:\Windows\System\vYsXdMp.exe
  C:\Windows\System\vYsXdMp.exe
  2⤵
  PID:1244
- C:\Windows\System\kxhafpR.exe
  C:\Windows\System\kxhafpR.exe
  2⤵
  PID:1532
- C:\Windows\System\oGOgszy.exe
  C:\Windows\System\oGOgszy.exe
  2⤵
  PID:1368
- C:\Windows\System\eKmwhVV.exe
  C:\Windows\System\eKmwhVV.exe
  2⤵
  PID:1012
- C:\Windows\System\VllSsUA.exe
  C:\Windows\System\VllSsUA.exe
  2⤵
  PID:908
- C:\Windows\System\eCruNtL.exe
  C:\Windows\System\eCruNtL.exe
  2⤵
  PID:936
- C:\Windows\System\zNMCpBs.exe
  C:\Windows\System\zNMCpBs.exe
  2⤵
  PID:2932
- C:\Windows\System\VzXCnXs.exe
  C:\Windows\System\VzXCnXs.exe
  2⤵
  PID:2092
- C:\Windows\System\FpleTAL.exe
  C:\Windows\System\FpleTAL.exe
  2⤵
  PID:3056
- C:\Windows\System\xqUNNGn.exe
  C:\Windows\System\xqUNNGn.exe
  2⤵
  PID:1764
- C:\Windows\System\TSFFXLr.exe
  C:\Windows\System\TSFFXLr.exe
  2⤵
  PID:2072
- C:\Windows\System\YnLqEGU.exe
  C:\Windows\System\YnLqEGU.exe
  2⤵
  PID:2416
- C:\Windows\System\gFLxAvi.exe
  C:\Windows\System\gFLxAvi.exe
  2⤵
  PID:2012
- C:\Windows\System\OdETiQX.exe
  C:\Windows\System\OdETiQX.exe
  2⤵
  PID:2712
- C:\Windows\System\jPhNFpI.exe
  C:\Windows\System\jPhNFpI.exe
  2⤵
  PID:2648
- C:\Windows\System\jrZtfCn.exe
  C:\Windows\System\jrZtfCn.exe
  2⤵
  PID:2688
- C:\Windows\System\NrubRlC.exe
  C:\Windows\System\NrubRlC.exe
  2⤵
  PID:2568
- C:\Windows\System\sVoebLW.exe
  C:\Windows\System\sVoebLW.exe
  2⤵
  PID:2860
- C:\Windows\System\jegOOuP.exe
  C:\Windows\System\jegOOuP.exe
  2⤵
  PID:2324
- C:\Windows\System\mFLLvei.exe
  C:\Windows\System\mFLLvei.exe
  2⤵
  PID:2676
- C:\Windows\System\MiUvYKi.exe
  C:\Windows\System\MiUvYKi.exe
  2⤵
  PID:632
- C:\Windows\System\lWeqqHI.exe
  C:\Windows\System\lWeqqHI.exe
  2⤵
  PID:2904
- C:\Windows\System\hCSZjeU.exe
  C:\Windows\System\hCSZjeU.exe
  2⤵
  PID:1500
- C:\Windows\System\lJLxIIG.exe
  C:\Windows\System\lJLxIIG.exe
  2⤵
  PID:1676
- C:\Windows\System\tzdXccF.exe
  C:\Windows\System\tzdXccF.exe
  2⤵
  PID:1132
- C:\Windows\System\EcVcvuu.exe
  C:\Windows\System\EcVcvuu.exe
  2⤵
  PID:3084
- C:\Windows\System\uWFdOXK.exe
  C:\Windows\System\uWFdOXK.exe
  2⤵
  PID:3100
- C:\Windows\System\xIiKnoJ.exe
  C:\Windows\System\xIiKnoJ.exe
  2⤵
  PID:3116
- C:\Windows\System\SUyDXgF.exe
  C:\Windows\System\SUyDXgF.exe
  2⤵
  PID:3132
- C:\Windows\System\kYhXvnC.exe
  C:\Windows\System\kYhXvnC.exe
  2⤵
  PID:3148
- C:\Windows\System\zVxgFZi.exe
  C:\Windows\System\zVxgFZi.exe
  2⤵
  PID:3164
- C:\Windows\System\bbwOZqV.exe
  C:\Windows\System\bbwOZqV.exe
  2⤵
  PID:3180
- C:\Windows\System\kdmtTNY.exe
  C:\Windows\System\kdmtTNY.exe
  2⤵
  PID:3196
- C:\Windows\System\aCrnDwM.exe
  C:\Windows\System\aCrnDwM.exe
  2⤵
  PID:3212
- C:\Windows\System\PKfCvbt.exe
  C:\Windows\System\PKfCvbt.exe
  2⤵
  PID:3228
- C:\Windows\System\xOAwxSQ.exe
  C:\Windows\System\xOAwxSQ.exe
  2⤵
  PID:3244
- C:\Windows\System\nwkuPNv.exe
  C:\Windows\System\nwkuPNv.exe
  2⤵
  PID:3260
- C:\Windows\System\GpxAHsv.exe
  C:\Windows\System\GpxAHsv.exe
  2⤵
  PID:3276
- C:\Windows\System\DrzpAdc.exe
  C:\Windows\System\DrzpAdc.exe
  2⤵
  PID:3292
- C:\Windows\System\eFEFKtg.exe
  C:\Windows\System\eFEFKtg.exe
  2⤵
  PID:3308
- C:\Windows\System\IfUqlmn.exe
  C:\Windows\System\IfUqlmn.exe
  2⤵
  PID:3324
- C:\Windows\System\PitqTQz.exe
  C:\Windows\System\PitqTQz.exe
  2⤵
  PID:3340
- C:\Windows\System\iTHjpsk.exe
  C:\Windows\System\iTHjpsk.exe
  2⤵
  PID:3356
- C:\Windows\System\eVjXoUk.exe
  C:\Windows\System\eVjXoUk.exe
  2⤵
  PID:3372
- C:\Windows\System\sSsFeKe.exe
  C:\Windows\System\sSsFeKe.exe
  2⤵
  PID:3388
- C:\Windows\System\XoHjStf.exe
  C:\Windows\System\XoHjStf.exe
  2⤵
  PID:3404
- C:\Windows\System\SKLrwQq.exe
  C:\Windows\System\SKLrwQq.exe
  2⤵
  PID:3420
- C:\Windows\System\LQPJBLB.exe
  C:\Windows\System\LQPJBLB.exe
  2⤵
  PID:3436
- C:\Windows\System\rCqseal.exe
  C:\Windows\System\rCqseal.exe
  2⤵
  PID:3452
- C:\Windows\System\tokPKXI.exe
  C:\Windows\System\tokPKXI.exe
  2⤵
  PID:3468
- C:\Windows\System\WIySvNJ.exe
  C:\Windows\System\WIySvNJ.exe
  2⤵
  PID:3484
- C:\Windows\System\bITJJPV.exe
  C:\Windows\System\bITJJPV.exe
  2⤵
  PID:3500
- C:\Windows\System\iuhSJDl.exe
  C:\Windows\System\iuhSJDl.exe
  2⤵
  PID:3516
- C:\Windows\System\luqmQGE.exe
  C:\Windows\System\luqmQGE.exe
  2⤵
  PID:3532
- C:\Windows\System\ARHcHpq.exe
  C:\Windows\System\ARHcHpq.exe
  2⤵
  PID:3548
- C:\Windows\System\OcddNBZ.exe
  C:\Windows\System\OcddNBZ.exe
  2⤵
  PID:3564
- C:\Windows\System\LMBjtho.exe
  C:\Windows\System\LMBjtho.exe
  2⤵
  PID:3580
- C:\Windows\System\pkDuHxG.exe
  C:\Windows\System\pkDuHxG.exe
  2⤵
  PID:3596
- C:\Windows\System\ExidaJo.exe
  C:\Windows\System\ExidaJo.exe
  2⤵
  PID:3612
- C:\Windows\System\RFiGgkO.exe
  C:\Windows\System\RFiGgkO.exe
  2⤵
  PID:3628
- C:\Windows\System\sBUleVr.exe
  C:\Windows\System\sBUleVr.exe
  2⤵
  PID:3644
- C:\Windows\System\ElMNIse.exe
  C:\Windows\System\ElMNIse.exe
  2⤵
  PID:3660
- C:\Windows\System\kqREqBu.exe
  C:\Windows\System\kqREqBu.exe
  2⤵
  PID:3676
- C:\Windows\System\cTHqiOq.exe
  C:\Windows\System\cTHqiOq.exe
  2⤵
  PID:3692
- C:\Windows\System\OFuDnBF.exe
  C:\Windows\System\OFuDnBF.exe
  2⤵
  PID:3708
- C:\Windows\System\MeFEAfl.exe
  C:\Windows\System\MeFEAfl.exe
  2⤵
  PID:3724
- C:\Windows\System\fSvgIGC.exe
  C:\Windows\System\fSvgIGC.exe
  2⤵
  PID:3740
- C:\Windows\System\iBvglyT.exe
  C:\Windows\System\iBvglyT.exe
  2⤵
  PID:3756
- C:\Windows\System\ErfnqnZ.exe
  C:\Windows\System\ErfnqnZ.exe
  2⤵
  PID:3772
- C:\Windows\System\JbFSIjJ.exe
  C:\Windows\System\JbFSIjJ.exe
  2⤵
  PID:3788
- C:\Windows\System\ZEqwjUq.exe
  C:\Windows\System\ZEqwjUq.exe
  2⤵
  PID:3804
- C:\Windows\System\oHUTkzi.exe
  C:\Windows\System\oHUTkzi.exe
  2⤵
  PID:3820
- C:\Windows\System\tPTSFfM.exe
  C:\Windows\System\tPTSFfM.exe
  2⤵
  PID:3836
- C:\Windows\System\ZgFJtjZ.exe
  C:\Windows\System\ZgFJtjZ.exe
  2⤵
  PID:3852
- C:\Windows\System\PttSSTY.exe
  C:\Windows\System\PttSSTY.exe
  2⤵
  PID:3868
- C:\Windows\System\XfQvzCo.exe
  C:\Windows\System\XfQvzCo.exe
  2⤵
  PID:3884
- C:\Windows\System\qOptETh.exe
  C:\Windows\System\qOptETh.exe
  2⤵
  PID:3900
- C:\Windows\System\liUCMdK.exe
  C:\Windows\System\liUCMdK.exe
  2⤵
  PID:3916
- C:\Windows\System\QwztYcb.exe
  C:\Windows\System\QwztYcb.exe
  2⤵
  PID:3932
- C:\Windows\System\BNQaSWO.exe
  C:\Windows\System\BNQaSWO.exe
  2⤵
  PID:3948
- C:\Windows\System\DGiuUMi.exe
  C:\Windows\System\DGiuUMi.exe
  2⤵
  PID:3964
- C:\Windows\System\pgbPDIE.exe
  C:\Windows\System\pgbPDIE.exe
  2⤵
  PID:3980
- C:\Windows\System\AukUKFZ.exe
  C:\Windows\System\AukUKFZ.exe
  2⤵
  PID:3996
- C:\Windows\System\NMlFubg.exe
  C:\Windows\System\NMlFubg.exe
  2⤵
  PID:4012
- C:\Windows\System\lnWkKBe.exe
  C:\Windows\System\lnWkKBe.exe
  2⤵
  PID:3268
- C:\Windows\System\zwqyCju.exe
  C:\Windows\System\zwqyCju.exe
  2⤵
  PID:3288
- C:\Windows\System\GRBsdpd.exe
  C:\Windows\System\GRBsdpd.exe
  2⤵
  PID:3336
- C:\Windows\System\uFPUIsf.exe
  C:\Windows\System\uFPUIsf.exe
  2⤵
  PID:3368
- C:\Windows\System\PGMtPuh.exe
  C:\Windows\System\PGMtPuh.exe
  2⤵
  PID:3428
- C:\Windows\System\UPfFZdm.exe
  C:\Windows\System\UPfFZdm.exe
  2⤵
  PID:3460
- C:\Windows\System\EORBrdu.exe
  C:\Windows\System\EORBrdu.exe
  2⤵
  PID:3492
- C:\Windows\System\axympGu.exe
  C:\Windows\System\axympGu.exe
  2⤵
  PID:3512
- C:\Windows\System\xuXmvLp.exe
  C:\Windows\System\xuXmvLp.exe
  2⤵
  PID:3544
- C:\Windows\System\JvfkFhb.exe
  C:\Windows\System\JvfkFhb.exe
  2⤵
  PID:3592
- C:\Windows\System\vGRTCkp.exe
  C:\Windows\System\vGRTCkp.exe
  2⤵
  PID:3608
- C:\Windows\System\EiQSkcv.exe
  C:\Windows\System\EiQSkcv.exe
  2⤵
  PID:3656
- C:\Windows\System\cwZhzci.exe
  C:\Windows\System\cwZhzci.exe
  2⤵
  PID:3700
- C:\Windows\System\NZXpJFO.exe
  C:\Windows\System\NZXpJFO.exe
  2⤵
  PID:3748
- C:\Windows\System\HYxzUNc.exe
  C:\Windows\System\HYxzUNc.exe
  2⤵
  PID:1980
- C:\Windows\System\eTbxfit.exe
  C:\Windows\System\eTbxfit.exe
  2⤵
  PID:3816
- C:\Windows\System\UhgRbeX.exe
  C:\Windows\System\UhgRbeX.exe
  2⤵
  PID:3880
- C:\Windows\System\VkkdDtE.exe
  C:\Windows\System\VkkdDtE.exe
  2⤵
  PID:3972
- C:\Windows\System\VgqvWdf.exe
  C:\Windows\System\VgqvWdf.exe
  2⤵
  PID:2896
- C:\Windows\System\WTFikRB.exe
  C:\Windows\System\WTFikRB.exe
  2⤵
  PID:2560
- C:\Windows\System\mZRFXPp.exe
  C:\Windows\System\mZRFXPp.exe
  2⤵
  PID:2112
- C:\Windows\System\UUIjWJd.exe
  C:\Windows\System\UUIjWJd.exe
  2⤵
  PID:2852
- C:\Windows\System\dCTngOx.exe
  C:\Windows\System\dCTngOx.exe
  2⤵
  PID:320
- C:\Windows\System\AlIRcmY.exe
  C:\Windows\System\AlIRcmY.exe
  2⤵
  PID:2772
- C:\Windows\System\VcyBPBG.exe
  C:\Windows\System\VcyBPBG.exe
  2⤵
  PID:3028
- C:\Windows\System\RZzxgvV.exe
  C:\Windows\System\RZzxgvV.exe
  2⤵
  PID:2284
- C:\Windows\System\EKDtlXn.exe
  C:\Windows\System\EKDtlXn.exe
  2⤵
  PID:1936
- C:\Windows\System\FGVNTJE.exe
  C:\Windows\System\FGVNTJE.exe
  2⤵
  PID:2668
- C:\Windows\System\inXLnwP.exe
  C:\Windows\System\inXLnwP.exe
  2⤵
  PID:3508
- C:\Windows\System\lZnwDiQ.exe
  C:\Windows\System\lZnwDiQ.exe
  2⤵
  PID:3576
- C:\Windows\System\rSjAJbd.exe
  C:\Windows\System\rSjAJbd.exe
  2⤵
  PID:3720
- C:\Windows\System\QOHUOaC.exe
  C:\Windows\System\QOHUOaC.exe
  2⤵
  PID:3912
- C:\Windows\System\YiNcCSc.exe
  C:\Windows\System\YiNcCSc.exe
  2⤵
  PID:2764
- C:\Windows\System\ozKzeGg.exe
  C:\Windows\System\ozKzeGg.exe
  2⤵
  PID:2832
- C:\Windows\System\xdijueN.exe
  C:\Windows\System\xdijueN.exe
  2⤵
  PID:1060
- C:\Windows\System\PWOYvFQ.exe
  C:\Windows\System\PWOYvFQ.exe
  2⤵
  PID:3572
- C:\Windows\System\EcLowzA.exe
  C:\Windows\System\EcLowzA.exe
  2⤵
  PID:2792
- C:\Windows\System\iCsmUFd.exe
  C:\Windows\System\iCsmUFd.exe
  2⤵
  PID:2052
- C:\Windows\System\VFWcWUk.exe
  C:\Windows\System\VFWcWUk.exe
  2⤵
  PID:4104
- C:\Windows\System\kzCibEs.exe
  C:\Windows\System\kzCibEs.exe
  2⤵
  PID:4124
- C:\Windows\System\mBpYvqI.exe
  C:\Windows\System\mBpYvqI.exe
  2⤵
  PID:4140
- C:\Windows\System\EENdiDr.exe
  C:\Windows\System\EENdiDr.exe
  2⤵
  PID:4156
- C:\Windows\System\mLAUhNA.exe
  C:\Windows\System\mLAUhNA.exe
  2⤵
  PID:4176
- C:\Windows\System\fulxVpE.exe
  C:\Windows\System\fulxVpE.exe
  2⤵
  PID:4196
- C:\Windows\System\CWHQZkN.exe
  C:\Windows\System\CWHQZkN.exe
  2⤵
  PID:4212
- C:\Windows\System\YetiGOc.exe
  C:\Windows\System\YetiGOc.exe
  2⤵
  PID:4232
- C:\Windows\System\UeSCfjW.exe
  C:\Windows\System\UeSCfjW.exe
  2⤵
  PID:4248
- C:\Windows\System\pKAHDPn.exe
  C:\Windows\System\pKAHDPn.exe
  2⤵
  PID:4268
- C:\Windows\System\aENceos.exe
  C:\Windows\System\aENceos.exe
  2⤵
  PID:4284
- C:\Windows\System\tAJMZHz.exe
  C:\Windows\System\tAJMZHz.exe
  2⤵
  PID:4304
- C:\Windows\System\fmputOO.exe
  C:\Windows\System\fmputOO.exe
  2⤵
  PID:4320
- C:\Windows\System\kTimjyd.exe
  C:\Windows\System\kTimjyd.exe
  2⤵
  PID:4340
- C:\Windows\System\flwbbSl.exe
  C:\Windows\System\flwbbSl.exe
  2⤵
  PID:4356
- C:\Windows\System\ctCcKiK.exe
  C:\Windows\System\ctCcKiK.exe
  2⤵
  PID:4376
- C:\Windows\System\cwEJVZN.exe
  C:\Windows\System\cwEJVZN.exe
  2⤵
  PID:4392
- C:\Windows\System\CJqgvHJ.exe
  C:\Windows\System\CJqgvHJ.exe
  2⤵
  PID:4412
- C:\Windows\System\HBHtqpJ.exe
  C:\Windows\System\HBHtqpJ.exe
  2⤵
  PID:4428
- C:\Windows\System\FDXrFwN.exe
  C:\Windows\System\FDXrFwN.exe
  2⤵
  PID:4448
- C:\Windows\System\nrdSkmj.exe
  C:\Windows\System\nrdSkmj.exe
  2⤵
  PID:4464
- C:\Windows\System\drVBYFk.exe
  C:\Windows\System\drVBYFk.exe
  2⤵
  PID:4484
- C:\Windows\System\bJAfTOm.exe
  C:\Windows\System\bJAfTOm.exe
  2⤵
  PID:4500
- C:\Windows\System\peCDVlk.exe
  C:\Windows\System\peCDVlk.exe
  2⤵
  PID:4520
- C:\Windows\System\WHTvwvY.exe
  C:\Windows\System\WHTvwvY.exe
  2⤵
  PID:4536
- C:\Windows\System\wJQCaSB.exe
  C:\Windows\System\wJQCaSB.exe
  2⤵
  PID:4556
- C:\Windows\System\EzkYmZL.exe
  C:\Windows\System\EzkYmZL.exe
  2⤵
  PID:4572
- C:\Windows\System\icfjOON.exe
  C:\Windows\System\icfjOON.exe
  2⤵
  PID:4592
- C:\Windows\System\HupntgF.exe
  C:\Windows\System\HupntgF.exe
  2⤵
  PID:4608
- C:\Windows\System\jVJcjYI.exe
  C:\Windows\System\jVJcjYI.exe
  2⤵
  PID:4628
- C:\Windows\System\zqxFtKp.exe
  C:\Windows\System\zqxFtKp.exe
  2⤵
  PID:4644
- C:\Windows\System\vxyjcgj.exe
  C:\Windows\System\vxyjcgj.exe
  2⤵
  PID:4664
- C:\Windows\System\UmgSORD.exe
  C:\Windows\System\UmgSORD.exe
  2⤵
  PID:4680
- C:\Windows\System\dELaVRd.exe
  C:\Windows\System\dELaVRd.exe
  2⤵
  PID:4700
- C:\Windows\System\Pgpccur.exe
  C:\Windows\System\Pgpccur.exe
  2⤵
  PID:4716
- C:\Windows\System\vFSXLWB.exe
  C:\Windows\System\vFSXLWB.exe
  2⤵
  PID:4736
- C:\Windows\System\iqtRMom.exe
  C:\Windows\System\iqtRMom.exe
  2⤵
  PID:4752
- C:\Windows\System\edRrnNw.exe
  C:\Windows\System\edRrnNw.exe
  2⤵
  PID:4772
- C:\Windows\System\hcTTVrM.exe
  C:\Windows\System\hcTTVrM.exe
  2⤵
  PID:4788
- C:\Windows\System\kyjDgGF.exe
  C:\Windows\System\kyjDgGF.exe
  2⤵
  PID:4808
- C:\Windows\System\tbhqVSS.exe
  C:\Windows\System\tbhqVSS.exe
  2⤵
  PID:4824
- C:\Windows\System\eINmjIc.exe
  C:\Windows\System\eINmjIc.exe
  2⤵
  PID:4856
- C:\Windows\System\rRsXNKJ.exe
  C:\Windows\System\rRsXNKJ.exe
  2⤵
  PID:4872
- C:\Windows\System\mExQSBY.exe
  C:\Windows\System\mExQSBY.exe
  2⤵
  PID:4888
- C:\Windows\System\SrFpJDg.exe
  C:\Windows\System\SrFpJDg.exe
  2⤵
  PID:4908
- C:\Windows\System\LWFyxbi.exe
  C:\Windows\System\LWFyxbi.exe
  2⤵
  PID:4924
- C:\Windows\System\OwoNoja.exe
  C:\Windows\System\OwoNoja.exe
  2⤵
  PID:4944
- C:\Windows\System\EobYVsJ.exe
  C:\Windows\System\EobYVsJ.exe
  2⤵
  PID:4968
- C:\Windows\System\Uaghylq.exe
  C:\Windows\System\Uaghylq.exe
  2⤵
  PID:4996
- C:\Windows\System\rlhWhNT.exe
  C:\Windows\System\rlhWhNT.exe
  2⤵
  PID:5020
- C:\Windows\System\Sxwkxkr.exe
  C:\Windows\System\Sxwkxkr.exe
  2⤵
  PID:5036
- C:\Windows\System\jbREIzs.exe
  C:\Windows\System\jbREIzs.exe
  2⤵
  PID:5056
- C:\Windows\System\FBfnwmj.exe
  C:\Windows\System\FBfnwmj.exe
  2⤵
  PID:5072
- C:\Windows\System\jlIHJRH.exe
  C:\Windows\System\jlIHJRH.exe
  2⤵
  PID:5092
- C:\Windows\System\iVmpcRt.exe
  C:\Windows\System\iVmpcRt.exe
  2⤵
  PID:5108
- C:\Windows\System\xnGFVhp.exe
  C:\Windows\System\xnGFVhp.exe
  2⤵
  PID:4116
- C:\Windows\System\ylvoFxu.exe
  C:\Windows\System\ylvoFxu.exe
  2⤵
  PID:4192
- C:\Windows\System\MXEjVYV.exe
  C:\Windows\System\MXEjVYV.exe
  2⤵
  PID:4256
- C:\Windows\System\lptXcyw.exe
  C:\Windows\System\lptXcyw.exe
  2⤵
  PID:4300
- C:\Windows\System\UxxRnot.exe
  C:\Windows\System\UxxRnot.exe
  2⤵
  PID:4332
- C:\Windows\System\ZYiBnLx.exe
  C:\Windows\System\ZYiBnLx.exe
  2⤵
  PID:4408
- C:\Windows\System\WNEBsQn.exe
  C:\Windows\System\WNEBsQn.exe
  2⤵
  PID:4472
- C:\Windows\System\qQHSSVs.exe
  C:\Windows\System\qQHSSVs.exe
  2⤵
  PID:4516
- C:\Windows\System\yzFJyId.exe
  C:\Windows\System\yzFJyId.exe
  2⤵
  PID:4580
- C:\Windows\System\umAclZh.exe
  C:\Windows\System\umAclZh.exe
  2⤵
  PID:4620
- C:\Windows\System\PMfODJo.exe
  C:\Windows\System\PMfODJo.exe
  2⤵
  PID:4656
- C:\Windows\System\jvWGIoD.exe
  C:\Windows\System\jvWGIoD.exe
  2⤵
  PID:4732
- C:\Windows\System\QjzLIVZ.exe
  C:\Windows\System\QjzLIVZ.exe
  2⤵
  PID:4796
- C:\Windows\System\vPmgCBg.exe
  C:\Windows\System\vPmgCBg.exe
  2⤵
  PID:4836
- C:\Windows\System\oGWhMHl.exe
  C:\Windows\System\oGWhMHl.exe
  2⤵
  PID:4916
- C:\Windows\System\AQOPZlt.exe
  C:\Windows\System\AQOPZlt.exe
  2⤵
  PID:3796
- C:\Windows\System\CNpoyxZ.exe
  C:\Windows\System\CNpoyxZ.exe
  2⤵
  PID:4956
- C:\Windows\System\uzXyVHH.exe
  C:\Windows\System\uzXyVHH.exe
  2⤵
  PID:3064
- C:\Windows\System\PxwiBVp.exe
  C:\Windows\System\PxwiBVp.exe
  2⤵
  PID:5012
- C:\Windows\System\rnvgCRB.exe
  C:\Windows\System\rnvgCRB.exe
  2⤵
  PID:5048
- C:\Windows\System\zivgOyu.exe
  C:\Windows\System\zivgOyu.exe
  2⤵
  PID:5116
- C:\Windows\System\IKsAFew.exe
  C:\Windows\System\IKsAFew.exe
  2⤵
  PID:4224
- C:\Windows\System\mkuGmQU.exe
  C:\Windows\System\mkuGmQU.exe
  2⤵
  PID:4440
- C:\Windows\System\lZzSnXS.exe
  C:\Windows\System\lZzSnXS.exe
  2⤵
  PID:4552
- C:\Windows\System\WNXHUUl.exe
  C:\Windows\System\WNXHUUl.exe
  2⤵
  PID:4768
- C:\Windows\System\qwEWbOq.exe
  C:\Windows\System\qwEWbOq.exe
  2⤵
  PID:3960
- C:\Windows\System\vNPFZkd.exe
  C:\Windows\System\vNPFZkd.exe
  2⤵
  PID:5084
- C:\Windows\System\vneAFTc.exe
  C:\Windows\System\vneAFTc.exe
  2⤵
  PID:4436
- C:\Windows\System\KRABRRz.exe
  C:\Windows\System\KRABRRz.exe
  2⤵
  PID:4964
- C:\Windows\System\SVLdpae.exe
  C:\Windows\System\SVLdpae.exe
  2⤵
  PID:4764
- C:\Windows\System\umACdKv.exe
  C:\Windows\System\umACdKv.exe
  2⤵
  PID:5136
- C:\Windows\System\suQltya.exe
  C:\Windows\System\suQltya.exe
  2⤵
  PID:5152
- C:\Windows\System\MiJgbOD.exe
  C:\Windows\System\MiJgbOD.exe
  2⤵
  PID:5172
- C:\Windows\System\JEPAmMC.exe
  C:\Windows\System\JEPAmMC.exe
  2⤵
  PID:5188
- C:\Windows\System\SOjPzxb.exe
  C:\Windows\System\SOjPzxb.exe
  2⤵
  PID:5208
- C:\Windows\System\vhuIuRT.exe
  C:\Windows\System\vhuIuRT.exe
  2⤵
  PID:5224
- C:\Windows\System\vMDikkw.exe
  C:\Windows\System\vMDikkw.exe
  2⤵
  PID:5244
- C:\Windows\System\eKVCWEq.exe
  C:\Windows\System\eKVCWEq.exe
  2⤵
  PID:5260
- C:\Windows\System\KKFhaSZ.exe
  C:\Windows\System\KKFhaSZ.exe
  2⤵
  PID:5280
- C:\Windows\System\zWcmGVl.exe
  C:\Windows\System\zWcmGVl.exe
  2⤵
  PID:5296
- C:\Windows\System\IBJMVAH.exe
  C:\Windows\System\IBJMVAH.exe
  2⤵
  PID:5316
- C:\Windows\System\YDlKpYL.exe
  C:\Windows\System\YDlKpYL.exe
  2⤵
  PID:5332
- C:\Windows\System\nnjBKYC.exe
  C:\Windows\System\nnjBKYC.exe
  2⤵
  PID:5352
- C:\Windows\System\oHyiuKH.exe
  C:\Windows\System\oHyiuKH.exe
  2⤵
  PID:5368
- C:\Windows\System\LpEoklz.exe
  C:\Windows\System\LpEoklz.exe
  2⤵
  PID:5388
- C:\Windows\System\RdlvzIF.exe
  C:\Windows\System\RdlvzIF.exe
  2⤵
  PID:5408
- C:\Windows\System\FVAnNQy.exe
  C:\Windows\System\FVAnNQy.exe
  2⤵
  PID:5428
- C:\Windows\System\DQfLDzW.exe
  C:\Windows\System\DQfLDzW.exe
  2⤵
  PID:5444
- C:\Windows\System\eKjkUgz.exe
  C:\Windows\System\eKjkUgz.exe
  2⤵
  PID:5464
- C:\Windows\System\DLDWxpp.exe
  C:\Windows\System\DLDWxpp.exe
  2⤵
  PID:5480
- C:\Windows\System\yuoDBal.exe
  C:\Windows\System\yuoDBal.exe
  2⤵
  PID:5500
- C:\Windows\System\yEApQwJ.exe
  C:\Windows\System\yEApQwJ.exe
  2⤵
  PID:5516
- C:\Windows\System\MUYAxTF.exe
  C:\Windows\System\MUYAxTF.exe
  2⤵
  PID:5536
- C:\Windows\System\PJYfVgP.exe
  C:\Windows\System\PJYfVgP.exe
  2⤵
  PID:5552
- C:\Windows\System\JZCTtcz.exe
  C:\Windows\System\JZCTtcz.exe
  2⤵
  PID:5572
- C:\Windows\System\fEOaYxX.exe
  C:\Windows\System\fEOaYxX.exe
  2⤵
  PID:5588
- C:\Windows\System\gHVVmLX.exe
  C:\Windows\System\gHVVmLX.exe
  2⤵
  PID:5608
- C:\Windows\System\piopXwA.exe
  C:\Windows\System\piopXwA.exe
  2⤵
  PID:5624
- C:\Windows\System\giDubIk.exe
  C:\Windows\System\giDubIk.exe
  2⤵
  PID:5644
- C:\Windows\System\CwLXtEb.exe
  C:\Windows\System\CwLXtEb.exe
  2⤵
  PID:5660
- C:\Windows\System\bqFaEKj.exe
  C:\Windows\System\bqFaEKj.exe
  2⤵
  PID:5680
- C:\Windows\System\CqsFbFU.exe
  C:\Windows\System\CqsFbFU.exe
  2⤵
  PID:5696
- C:\Windows\System\qcezuwl.exe
  C:\Windows\System\qcezuwl.exe
  2⤵
  PID:5716
- C:\Windows\System\cDfcYRP.exe
  C:\Windows\System\cDfcYRP.exe
  2⤵
  PID:5732
- C:\Windows\System\YtVdUFd.exe
  C:\Windows\System\YtVdUFd.exe
  2⤵
  PID:5752
- C:\Windows\System\mRAathW.exe
  C:\Windows\System\mRAathW.exe
  2⤵
  PID:5768
- C:\Windows\System\YCNWcAa.exe
  C:\Windows\System\YCNWcAa.exe
  2⤵
  PID:5788
- C:\Windows\System\CaucAij.exe
  C:\Windows\System\CaucAij.exe
  2⤵
  PID:5804
- C:\Windows\System\VDJBzxV.exe
  C:\Windows\System\VDJBzxV.exe
  2⤵
  PID:5824
- C:\Windows\System\UCScQhM.exe
  C:\Windows\System\UCScQhM.exe
  2⤵
  PID:5840
- C:\Windows\System\tpZEoSO.exe
  C:\Windows\System\tpZEoSO.exe
  2⤵
  PID:5860
- C:\Windows\System\mdVaiBJ.exe
  C:\Windows\System\mdVaiBJ.exe
  2⤵
  PID:5876
- C:\Windows\System\drKMdpo.exe
  C:\Windows\System\drKMdpo.exe
  2⤵
  PID:5896
- C:\Windows\System\JfEybBR.exe
  C:\Windows\System\JfEybBR.exe
  2⤵
  PID:5912
- C:\Windows\System\ZAYRczr.exe
  C:\Windows\System\ZAYRczr.exe
  2⤵
  PID:5932
- C:\Windows\System\sQYMXKE.exe
  C:\Windows\System\sQYMXKE.exe
  2⤵
  PID:5948
- C:\Windows\System\KmUvUiL.exe
  C:\Windows\System\KmUvUiL.exe
  2⤵
  PID:5968
- C:\Windows\System\fJAIsaO.exe
  C:\Windows\System\fJAIsaO.exe
  2⤵
  PID:5984
- C:\Windows\System\tSkflwn.exe
  C:\Windows\System\tSkflwn.exe
  2⤵
  PID:6004
- C:\Windows\System\bvCDcRp.exe
  C:\Windows\System\bvCDcRp.exe
  2⤵
  PID:6020
- C:\Windows\System\zqxxWJg.exe
  C:\Windows\System\zqxxWJg.exe
  2⤵
  PID:6040
- C:\Windows\System\dtiTbmn.exe
  C:\Windows\System\dtiTbmn.exe
  2⤵
  PID:6056
- C:\Windows\System\ALZNNoR.exe
  C:\Windows\System\ALZNNoR.exe
  2⤵
  PID:6072
- C:\Windows\System\PlCzcbF.exe
  C:\Windows\System\PlCzcbF.exe
  2⤵
  PID:6092
- C:\Windows\System\VxfVaQJ.exe
  C:\Windows\System\VxfVaQJ.exe
  2⤵
  PID:6112
- C:\Windows\System\vubRKyg.exe
  C:\Windows\System\vubRKyg.exe
  2⤵
  PID:4820
- C:\Windows\System\dmNkkMv.exe
  C:\Windows\System\dmNkkMv.exe
  2⤵
  PID:2528
- C:\Windows\System\gZzmfbw.exe
  C:\Windows\System\gZzmfbw.exe
  2⤵
  PID:1340
- C:\Windows\System\PzDyTsO.exe
  C:\Windows\System\PzDyTsO.exe
  2⤵
  PID:4564
- C:\Windows\System\RtTJAKT.exe
  C:\Windows\System\RtTJAKT.exe
  2⤵
  PID:1656
- C:\Windows\System\gAdtjuH.exe
  C:\Windows\System\gAdtjuH.exe
  2⤵
  PID:3400
- C:\Windows\System\iMkHdld.exe
  C:\Windows\System\iMkHdld.exe
  2⤵
  PID:3556
- C:\Windows\System\ogPRsBO.exe
  C:\Windows\System\ogPRsBO.exe
  2⤵
  PID:4008
- C:\Windows\System\AWxJHdi.exe
  C:\Windows\System\AWxJHdi.exe
  2⤵
  PID:4528
- C:\Windows\System\EKtdCbe.exe
  C:\Windows\System\EKtdCbe.exe
  2⤵
  PID:4640
- C:\Windows\System\CqeRHVm.exe
  C:\Windows\System\CqeRHVm.exe
  2⤵
  PID:4780
- C:\Windows\System\fxAgfBL.exe
  C:\Windows\System\fxAgfBL.exe
  2⤵
  PID:4900
- C:\Windows\System\JqWTbHd.exe
  C:\Windows\System\JqWTbHd.exe
  2⤵
  PID:4988
- C:\Windows\System\jIyUphf.exe
  C:\Windows\System\jIyUphf.exe
  2⤵
  PID:5064
- C:\Windows\System\peIQwmp.exe
  C:\Windows\System\peIQwmp.exe
  2⤵
  PID:4152
- C:\Windows\System\lAcqOAy.exe
  C:\Windows\System\lAcqOAy.exe
  2⤵
  PID:4372
- C:\Windows\System\xFRAAcS.exe
  C:\Windows\System\xFRAAcS.exe
  2⤵
  PID:4508
- C:\Windows\System\iYTRzHS.exe
  C:\Windows\System\iYTRzHS.exe
  2⤵
  PID:880
- C:\Windows\System\dPGcCCS.exe
  C:\Windows\System\dPGcCCS.exe
  2⤵
  PID:4800
- C:\Windows\System\hgIwOBo.exe
  C:\Windows\System\hgIwOBo.exe
  2⤵
  PID:4844
- C:\Windows\System\mdxbKZj.exe
  C:\Windows\System\mdxbKZj.exe
  2⤵
  PID:5052
- C:\Windows\System\NnsFnwy.exe
  C:\Windows\System\NnsFnwy.exe
  2⤵
  PID:4548
- C:\Windows\System\cqYIWzR.exe
  C:\Windows\System\cqYIWzR.exe
  2⤵
  PID:4328
- C:\Windows\System\zMPHsfh.exe
  C:\Windows\System\zMPHsfh.exe
  2⤵
  PID:5184
- C:\Windows\System\XGKYsda.exe
  C:\Windows\System\XGKYsda.exe
  2⤵
  PID:5220
- C:\Windows\System\VquvjWk.exe
  C:\Windows\System\VquvjWk.exe
  2⤵
  PID:5292
- C:\Windows\System\KFwsEvA.exe
  C:\Windows\System\KFwsEvA.exe
  2⤵
  PID:5364
- C:\Windows\System\fkDhBCY.exe
  C:\Windows\System\fkDhBCY.exe
  2⤵
  PID:5440
- C:\Windows\System\uPocznv.exe
  C:\Windows\System\uPocznv.exe
  2⤵
  PID:5512
- C:\Windows\System\wQTYrBM.exe
  C:\Windows\System\wQTYrBM.exe
  2⤵
  PID:5584
- C:\Windows\System\ryQaZaI.exe
  C:\Windows\System\ryQaZaI.exe
  2⤵
  PID:5656
- C:\Windows\System\jENyesW.exe
  C:\Windows\System\jENyesW.exe
  2⤵
  PID:5728
- C:\Windows\System\alboePA.exe
  C:\Windows\System\alboePA.exe
  2⤵
  PID:5800
- C:\Windows\System\YdqStTl.exe
  C:\Windows\System\YdqStTl.exe
  2⤵
  PID:5904
- C:\Windows\System\JsuFrqw.exe
  C:\Windows\System\JsuFrqw.exe
  2⤵
  PID:5976
- C:\Windows\System\yRESIDr.exe
  C:\Windows\System\yRESIDr.exe
  2⤵
  PID:6048
- C:\Windows\System\nfeCsRd.exe
  C:\Windows\System\nfeCsRd.exe
  2⤵
  PID:6088
- C:\Windows\System\EDRSelv.exe
  C:\Windows\System\EDRSelv.exe
  2⤵
  PID:5168
- C:\Windows\System\gGlqZlx.exe
  C:\Windows\System\gGlqZlx.exe
  2⤵
  PID:5200
- C:\Windows\System\MlHRGDy.exe
  C:\Windows\System\MlHRGDy.exe
  2⤵
  PID:5268
- C:\Windows\System\dyAGAeI.exe
  C:\Windows\System\dyAGAeI.exe
  2⤵
  PID:5308
- C:\Windows\System\bQuEuOM.exe
  C:\Windows\System\bQuEuOM.exe
  2⤵
  PID:5344
- C:\Windows\System\OmCYqXF.exe
  C:\Windows\System\OmCYqXF.exe
  2⤵
  PID:5416
- C:\Windows\System\GFpUEyK.exe
  C:\Windows\System\GFpUEyK.exe
  2⤵
  PID:5456
- C:\Windows\System\SNQdHvz.exe
  C:\Windows\System\SNQdHvz.exe
  2⤵
  PID:5524
- C:\Windows\System\qkewoUq.exe
  C:\Windows\System\qkewoUq.exe
  2⤵
  PID:5568
- C:\Windows\System\JmSecgs.exe
  C:\Windows\System\JmSecgs.exe
  2⤵
  PID:5600
- C:\Windows\System\zSAaypq.exe
  C:\Windows\System\zSAaypq.exe
  2⤵
  PID:5668
- C:\Windows\System\CqWCrcE.exe
  C:\Windows\System\CqWCrcE.exe
  2⤵
  PID:5740
- C:\Windows\System\JFpYPGV.exe
  C:\Windows\System\JFpYPGV.exe
  2⤵
  PID:5780
- C:\Windows\System\yCeUiwl.exe
  C:\Windows\System\yCeUiwl.exe
  2⤵
  PID:2788
- C:\Windows\System\UFTKxpQ.exe
  C:\Windows\System\UFTKxpQ.exe
  2⤵
  PID:5892
- C:\Windows\System\OxqWsQp.exe
  C:\Windows\System\OxqWsQp.exe
  2⤵
  PID:5928
- C:\Windows\System\CyMcHpz.exe
  C:\Windows\System\CyMcHpz.exe
  2⤵
  PID:2492
- C:\Windows\System\IkZWLdT.exe
  C:\Windows\System\IkZWLdT.exe
  2⤵
  PID:6028
- C:\Windows\System\djyITJp.exe
  C:\Windows\System\djyITJp.exe
  2⤵
  PID:6068
- C:\Windows\System\zNibzLT.exe
  C:\Windows\System\zNibzLT.exe
  2⤵
  PID:6104
- C:\Windows\System\UHtjajd.exe
  C:\Windows\System\UHtjajd.exe
  2⤵
  PID:4020
- C:\Windows\System\qONVvsN.exe
  C:\Windows\System\qONVvsN.exe
  2⤵
  PID:3860
- C:\Windows\System\MStRwuR.exe
  C:\Windows\System\MStRwuR.exe
  2⤵
  PID:3924
- C:\Windows\System\lQbOjzI.exe
  C:\Windows\System\lQbOjzI.exe
  2⤵
  PID:1316
- C:\Windows\System\sEuLmLL.exe
  C:\Windows\System\sEuLmLL.exe
  2⤵
  PID:4044
- C:\Windows\System\iqoPvxC.exe
  C:\Windows\System\iqoPvxC.exe
  2⤵
  PID:4060
- C:\Windows\System\IoZYJAn.exe
  C:\Windows\System\IoZYJAn.exe
  2⤵
  PID:4076
- C:\Windows\System\erTmULm.exe
  C:\Windows\System\erTmULm.exe
  2⤵
  PID:4092
- C:\Windows\System\QsxQJjn.exe
  C:\Windows\System\QsxQJjn.exe
  2⤵
  PID:1352
- C:\Windows\System\lxawhZl.exe
  C:\Windows\System\lxawhZl.exe
  2⤵
  PID:4532
- C:\Windows\System\PMcBIQN.exe
  C:\Windows\System\PMcBIQN.exe
  2⤵
  PID:2948
- C:\Windows\System\amsBgsp.exe
  C:\Windows\System\amsBgsp.exe
  2⤵
  PID:2884
- C:\Windows\System\YmzNvAn.exe
  C:\Windows\System\YmzNvAn.exe
  2⤵
  PID:892
- C:\Windows\System\hjnBuQM.exe
  C:\Windows\System\hjnBuQM.exe
  2⤵
  PID:2036
- C:\Windows\System\HkhrWkB.exe
  C:\Windows\System\HkhrWkB.exe
  2⤵
  PID:696
- C:\Windows\System\lJskmiN.exe
  C:\Windows\System\lJskmiN.exe
  2⤵
  PID:2644
- C:\Windows\System\LKcBptJ.exe
  C:\Windows\System\LKcBptJ.exe
  2⤵
  PID:2768
- C:\Windows\System\NEjSDee.exe
  C:\Windows\System\NEjSDee.exe
  2⤵
  PID:1872
- C:\Windows\System\EWnLIoa.exe
  C:\Windows\System\EWnLIoa.exe
  2⤵
  PID:2292
- C:\Windows\System\SlPLERU.exe
  C:\Windows\System\SlPLERU.exe
  2⤵
  PID:4280
- C:\Windows\System\HCZMwJm.exe
  C:\Windows\System\HCZMwJm.exe
  2⤵
  PID:4172
- C:\Windows\System\mZzTfzt.exe
  C:\Windows\System\mZzTfzt.exe
  2⤵
  PID:4100
- C:\Windows\System\nSshvXV.exe
  C:\Windows\System\nSshvXV.exe
  2⤵
  PID:2068
- C:\Windows\System\qrKeohU.exe
  C:\Windows\System\qrKeohU.exe
  2⤵
  PID:3640
- C:\Windows\System\DjjqcmL.exe
  C:\Windows\System\DjjqcmL.exe
  2⤵
  PID:3284
- C:\Windows\System\MhFBOee.exe
  C:\Windows\System\MhFBOee.exe
  2⤵
  PID:1596
- C:\Windows\System\dBXdRKc.exe
  C:\Windows\System\dBXdRKc.exe
  2⤵
  PID:2264
- C:\Windows\System\FbCtjlA.exe
  C:\Windows\System\FbCtjlA.exe
  2⤵
  PID:3112
- C:\Windows\System\drZESZL.exe
  C:\Windows\System\drZESZL.exe
  2⤵
  PID:2892
- C:\Windows\System\fSdCexa.exe
  C:\Windows\System\fSdCexa.exe
  2⤵
  PID:4936
- C:\Windows\System\dNljzHr.exe
  C:\Windows\System\dNljzHr.exe
  2⤵
  PID:2696
- C:\Windows\System\nayBFLN.exe
  C:\Windows\System\nayBFLN.exe
  2⤵
  PID:4028
- C:\Windows\System\vnWCDyC.exe
  C:\Windows\System\vnWCDyC.exe
  2⤵
  PID:3156
- C:\Windows\System\nbUXwJr.exe
  C:\Windows\System\nbUXwJr.exe
  2⤵
  PID:3188
- C:\Windows\System\vpAVTpW.exe
  C:\Windows\System\vpAVTpW.exe
  2⤵
  PID:3624
- C:\Windows\System\HAyjNru.exe
  C:\Windows\System\HAyjNru.exe
  2⤵
  PID:3752
- C:\Windows\System\WUbMudV.exe
  C:\Windows\System\WUbMudV.exe
  2⤵
  PID:4312
- C:\Windows\System\geZAakw.exe
  C:\Windows\System\geZAakw.exe
  2⤵
  PID:4868
- C:\Windows\System\LeMKbAG.exe
  C:\Windows\System\LeMKbAG.exe
  2⤵
  PID:4492
- C:\Windows\System\MMmEFuf.exe
  C:\Windows\System\MMmEFuf.exe
  2⤵
  PID:4676
- C:\Windows\System\deYGXNu.exe
  C:\Windows\System\deYGXNu.exe
  2⤵
  PID:4980
- C:\Windows\System\gNwyFuO.exe
  C:\Windows\System\gNwyFuO.exe
  2⤵
  PID:5100
- C:\Windows\System\EdkmnLZ.exe
  C:\Windows\System\EdkmnLZ.exe
  2⤵
  PID:4400
- C:\Windows\System\eddhXAf.exe
  C:\Windows\System\eddhXAf.exe
  2⤵
  PID:4692
- C:\Windows\System\fuziKho.exe
  C:\Windows\System\fuziKho.exe
  2⤵
  PID:3988
- C:\Windows\System\qnAoDXh.exe
  C:\Windows\System\qnAoDXh.exe
  2⤵
  PID:4880
- C:\Windows\System\KxMVEYJ.exe
  C:\Windows\System\KxMVEYJ.exe
  2⤵
  PID:3252
- C:\Windows\System\AVxLmra.exe
  C:\Windows\System\AVxLmra.exe
  2⤵
  PID:4316
- C:\Windows\System\NYlftes.exe
  C:\Windows\System\NYlftes.exe
  2⤵
  PID:5288
- C:\Windows\System\SKQWMHD.exe
  C:\Windows\System\SKQWMHD.exe
  2⤵
  PID:5436
- C:\Windows\System\igksSja.exe
  C:\Windows\System\igksSja.exe
  2⤵
  PID:5580
- C:\Windows\System\YSmupdU.exe
  C:\Windows\System\YSmupdU.exe
  2⤵
  PID:5652
- C:\Windows\System\URnGmMU.exe
  C:\Windows\System\URnGmMU.exe
  2⤵
  PID:5796
- C:\Windows\System\kFyfWxz.exe
  C:\Windows\System\kFyfWxz.exe
  2⤵
  PID:5944
- C:\Windows\System\imNNlvL.exe
  C:\Windows\System\imNNlvL.exe
  2⤵
  PID:6084
- C:\Windows\System\vkPLfXb.exe
  C:\Windows\System\vkPLfXb.exe
  2⤵
  PID:5204
- C:\Windows\System\TaKKJYF.exe
  C:\Windows\System\TaKKJYF.exe
  2⤵
  PID:5340
- C:\Windows\System\nQIfhFq.exe
  C:\Windows\System\nQIfhFq.exe
  2⤵
  PID:1960
- C:\Windows\System\Fmcsqfb.exe
  C:\Windows\System\Fmcsqfb.exe
  2⤵
  PID:5488
- C:\Windows\System\fQnwcZq.exe
  C:\Windows\System\fQnwcZq.exe
  2⤵
  PID:5496
- C:\Windows\System\yjJHCgO.exe
  C:\Windows\System\yjJHCgO.exe
  2⤵
  PID:5636
- C:\Windows\System\CaXvIhN.exe
  C:\Windows\System\CaXvIhN.exe
  2⤵
  PID:5704
- C:\Windows\System\iILXWDn.exe
  C:\Windows\System\iILXWDn.exe
  2⤵
  PID:5852
- C:\Windows\System\VBBCPNF.exe
  C:\Windows\System\VBBCPNF.exe
  2⤵
  PID:3000
- C:\Windows\System\ohQUylD.exe
  C:\Windows\System\ohQUylD.exe
  2⤵
  PID:5996
- C:\Windows\System\TmGVNRt.exe
  C:\Windows\System\TmGVNRt.exe
  2⤵
  PID:4960
- C:\Windows\System\wIaeKUd.exe
  C:\Windows\System\wIaeKUd.exe
  2⤵
  PID:2984
- C:\Windows\System\aTLmjXh.exe
  C:\Windows\System\aTLmjXh.exe
  2⤵
  PID:2140
- C:\Windows\System\PAAJkev.exe
  C:\Windows\System\PAAJkev.exe
  2⤵
  PID:4056
- C:\Windows\System\FtDJCUu.exe
  C:\Windows\System\FtDJCUu.exe
  2⤵
  PID:4088
- C:\Windows\System\tbCQIHq.exe
  C:\Windows\System\tbCQIHq.exe
  2⤵
  PID:1260
- C:\Windows\System\wEeDjYr.exe
  C:\Windows\System\wEeDjYr.exe
  2⤵
  PID:2228
- C:\Windows\System\hbwZFku.exe
  C:\Windows\System\hbwZFku.exe
  2⤵
  PID:1696
- C:\Windows\System\zKnrPqf.exe
  C:\Windows\System\zKnrPqf.exe
  2⤵
  PID:2272
- C:\Windows\System\qzKeZJv.exe
  C:\Windows\System\qzKeZJv.exe
  2⤵
  PID:3036
- C:\Windows\System\TYjrbBW.exe
  C:\Windows\System\TYjrbBW.exe
  2⤵
  PID:4240
- C:\Windows\System\ffFJgoe.exe
  C:\Windows\System\ffFJgoe.exe
  2⤵
  PID:4204
- C:\Windows\System\GtOLIEB.exe
  C:\Windows\System\GtOLIEB.exe
  2⤵
  PID:3784
- C:\Windows\System\oYMzcap.exe
  C:\Windows\System\oYMzcap.exe
  2⤵
  PID:3704
- C:\Windows\System\NDmjbzq.exe
  C:\Windows\System\NDmjbzq.exe
  2⤵
  PID:1784
- C:\Windows\System\HilOIvA.exe
  C:\Windows\System\HilOIvA.exe
  2⤵
  PID:3096
- C:\Windows\System\xWhNjWX.exe
  C:\Windows\System\xWhNjWX.exe
  2⤵
  PID:4932
- C:\Windows\System\lyrKanj.exe
  C:\Windows\System\lyrKanj.exe
  2⤵
  PID:3320
- C:\Windows\System\RoSszaj.exe
  C:\Windows\System\RoSszaj.exe
  2⤵
  PID:3204
- C:\Windows\System\iWILQeH.exe
  C:\Windows\System\iWILQeH.exe
  2⤵
  PID:2820
- C:\Windows\System\OLNdfGP.exe
  C:\Windows\System\OLNdfGP.exe
  2⤵
  PID:3464
- C:\Windows\System\nHKoblk.exe
  C:\Windows\System\nHKoblk.exe
  2⤵
  PID:4712
- C:\Windows\System\LryjASw.exe
  C:\Windows\System\LryjASw.exe
  2⤵
  PID:4984
- C:\Windows\System\NqFUIYh.exe
  C:\Windows\System\NqFUIYh.exe
  2⤵
  PID:4476
- C:\Windows\System\APTPlNP.exe
  C:\Windows\System\APTPlNP.exe
  2⤵
  PID:5016
- C:\Windows\System\oqiBhYy.exe
  C:\Windows\System\oqiBhYy.exe
  2⤵
  PID:5856
- C:\Windows\System\wedlvwQ.exe
  C:\Windows\System\wedlvwQ.exe
  2⤵
  PID:5548
- C:\Windows\System\RRqWaKf.exe
  C:\Windows\System\RRqWaKf.exe
  2⤵
  PID:5764
- C:\Windows\System\RqjDgeY.exe
  C:\Windows\System\RqjDgeY.exe
  2⤵
  PID:6012
- C:\Windows\System\EeNZFKh.exe
  C:\Windows\System\EeNZFKh.exe
  2⤵
  PID:5196
- C:\Windows\System\rxTmklj.exe
  C:\Windows\System\rxTmklj.exe
  2⤵
  PID:5384
- C:\Windows\System\dlDaqZo.exe
  C:\Windows\System\dlDaqZo.exe
  2⤵
  PID:5560
- C:\Windows\System\sFSbcSF.exe
  C:\Windows\System\sFSbcSF.exe
  2⤵
  PID:5776
- C:\Windows\System\KZgeiFG.exe
  C:\Windows\System\KZgeiFG.exe
  2⤵
  PID:5816
- C:\Windows\System\hdShXHZ.exe
  C:\Windows\System\hdShXHZ.exe
  2⤵
  PID:6032
- C:\Windows\System\XjyvTxs.exe
  C:\Windows\System\XjyvTxs.exe
  2⤵
  PID:3992
- C:\Windows\System\IsSMwIj.exe
  C:\Windows\System\IsSMwIj.exe
  2⤵
  PID:4036
- C:\Windows\System\IEpfDij.exe
  C:\Windows\System\IEpfDij.exe
  2⤵
  PID:2780
- C:\Windows\System\SWGpVuJ.exe
  C:\Windows\System\SWGpVuJ.exe
  2⤵
  PID:2672
- C:\Windows\System\CbXApuP.exe
  C:\Windows\System\CbXApuP.exe
  2⤵
  PID:2624
- C:\Windows\System\BCEszsk.exe
  C:\Windows\System\BCEszsk.exe
  2⤵
  PID:2512
- C:\Windows\System\xAruzwe.exe
  C:\Windows\System\xAruzwe.exe
  2⤵
  PID:2564
- C:\Windows\System\ObTKWvA.exe
  C:\Windows\System\ObTKWvA.exe
  2⤵
  PID:4132
- C:\Windows\System\qYtFTDr.exe
  C:\Windows\System\qYtFTDr.exe
  2⤵
  PID:3076
- C:\Windows\System\cWPeaRH.exe
  C:\Windows\System\cWPeaRH.exe
  2⤵
  PID:3384
- C:\Windows\System\ppKrViU.exe
  C:\Windows\System\ppKrViU.exe
  2⤵
  PID:3688
- C:\Windows\System\eGtTJga.exe
  C:\Windows\System\eGtTJga.exe
  2⤵
  PID:1328
- C:\Windows\System\EVJTjlb.exe
  C:\Windows\System\EVJTjlb.exe
  2⤵
  PID:1336
- C:\Windows\System\KGPyRja.exe
  C:\Windows\System\KGPyRja.exe
  2⤵
  PID:5848
- C:\Windows\System\ShzfwNw.exe
  C:\Windows\System\ShzfwNw.exe
  2⤵
  PID:5508
- C:\Windows\System\jgOZSgN.exe
  C:\Windows\System\jgOZSgN.exe
  2⤵
  PID:2700
- C:\Windows\System\YdwYFdH.exe
  C:\Windows\System\YdwYFdH.exe
  2⤵
  PID:5240
- C:\Windows\System\iSnXMsw.exe
  C:\Windows\System\iSnXMsw.exe
  2⤵
  PID:5784
- C:\Windows\System\PyASuUc.exe
  C:\Windows\System\PyASuUc.exe
  2⤵
  PID:2532
- C:\Windows\System\LCzUjHM.exe
  C:\Windows\System\LCzUjHM.exe
  2⤵
  PID:4068
- C:\Windows\System\eLZhbeo.exe
  C:\Windows\System\eLZhbeo.exe
  2⤵
  PID:2956
- C:\Windows\System\uzRYABW.exe
  C:\Windows\System\uzRYABW.exe
  2⤵
  PID:5460
- C:\Windows\System\KJpeRhU.exe
  C:\Windows\System\KJpeRhU.exe
  2⤵
  PID:2296
- C:\Windows\System\tjBzYZv.exe
  C:\Windows\System\tjBzYZv.exe
  2⤵
  PID:3108
- C:\Windows\System\qqahDQr.exe
  C:\Windows\System\qqahDQr.exe
  2⤵
  PID:3672
- C:\Windows\System\sDNIilZ.exe
  C:\Windows\System\sDNIilZ.exe
  2⤵
  PID:5032
- C:\Windows\System\bZaocfN.exe
  C:\Windows\System\bZaocfN.exe
  2⤵
  PID:2480
- C:\Windows\System\ffgAEYu.exe
  C:\Windows\System\ffgAEYu.exe
  2⤵
  PID:2576
- C:\Windows\System\xnpPhNO.exe
  C:\Windows\System\xnpPhNO.exe
  2⤵
  PID:5920
- C:\Windows\System\JKJSdxq.exe
  C:\Windows\System\JKJSdxq.exe
  2⤵
  PID:1548
- C:\Windows\System\bxKViKa.exe
  C:\Windows\System\bxKViKa.exe
  2⤵
  PID:1528
- C:\Windows\System\UmEEFem.exe
  C:\Windows\System\UmEEFem.exe
  2⤵
  PID:3396
- C:\Windows\System\CuxrDfZ.exe
  C:\Windows\System\CuxrDfZ.exe
  2⤵
  PID:5132
- C:\Windows\System\qfxInQv.exe
  C:\Windows\System\qfxInQv.exe
  2⤵
  PID:4084
- C:\Windows\System\LgAepgN.exe
  C:\Windows\System\LgAepgN.exe
  2⤵
  PID:6156
- C:\Windows\System\SPVvjOF.exe
  C:\Windows\System\SPVvjOF.exe
  2⤵
  PID:6172
- C:\Windows\System\HGJwkoO.exe
  C:\Windows\System\HGJwkoO.exe
  2⤵
  PID:6188
- C:\Windows\System\mguNUNh.exe
  C:\Windows\System\mguNUNh.exe
  2⤵
  PID:6204
- C:\Windows\System\RZnYMiG.exe
  C:\Windows\System\RZnYMiG.exe
  2⤵
  PID:6220
- C:\Windows\System\myoitNA.exe
  C:\Windows\System\myoitNA.exe
  2⤵
  PID:6236
- C:\Windows\System\FeDoyPC.exe
  C:\Windows\System\FeDoyPC.exe
  2⤵
  PID:6252
- C:\Windows\System\jepJHtA.exe
  C:\Windows\System\jepJHtA.exe
  2⤵
  PID:6268
- C:\Windows\System\pIFgwCQ.exe
  C:\Windows\System\pIFgwCQ.exe
  2⤵
  PID:6284
- C:\Windows\System\hAtNIJR.exe
  C:\Windows\System\hAtNIJR.exe
  2⤵
  PID:6300
- C:\Windows\System\tQtZqzf.exe
  C:\Windows\System\tQtZqzf.exe
  2⤵
  PID:6316
- C:\Windows\System\CgyyFZT.exe
  C:\Windows\System\CgyyFZT.exe
  2⤵
  PID:6332
- C:\Windows\System\cZGJtXK.exe
  C:\Windows\System\cZGJtXK.exe
  2⤵
  PID:6348
- C:\Windows\System\kAPABFq.exe
  C:\Windows\System\kAPABFq.exe
  2⤵
  PID:6368
- C:\Windows\System\EBMztPC.exe
  C:\Windows\System\EBMztPC.exe
  2⤵
  PID:6384
- C:\Windows\System\KQEURUv.exe
  C:\Windows\System\KQEURUv.exe
  2⤵
  PID:6400
- C:\Windows\System\UiCSWNb.exe
  C:\Windows\System\UiCSWNb.exe
  2⤵
  PID:6416
- C:\Windows\System\fxHAVEi.exe
  C:\Windows\System\fxHAVEi.exe
  2⤵
  PID:6432
- C:\Windows\System\BJOsPFi.exe
  C:\Windows\System\BJOsPFi.exe
  2⤵
  PID:6448
- C:\Windows\System\RSOyeKI.exe
  C:\Windows\System\RSOyeKI.exe
  2⤵
  PID:6464
- C:\Windows\System\jAtcCzq.exe
  C:\Windows\System\jAtcCzq.exe
  2⤵
  PID:6480
- C:\Windows\System\ByXTett.exe
  C:\Windows\System\ByXTett.exe
  2⤵
  PID:6496
- C:\Windows\System\kGTEEAF.exe
  C:\Windows\System\kGTEEAF.exe
  2⤵
  PID:6512
- C:\Windows\System\DgBDeBF.exe
  C:\Windows\System\DgBDeBF.exe
  2⤵
  PID:6528
- C:\Windows\System\AwvQSwv.exe
  C:\Windows\System\AwvQSwv.exe
  2⤵
  PID:6544
- C:\Windows\System\HSwawwm.exe
  C:\Windows\System\HSwawwm.exe
  2⤵
  PID:6560
- C:\Windows\System\VMTrhvn.exe
  C:\Windows\System\VMTrhvn.exe
  2⤵
  PID:6576
- C:\Windows\System\Pznpytg.exe
  C:\Windows\System\Pznpytg.exe
  2⤵
  PID:6592
- C:\Windows\System\ZHpFeFJ.exe
  C:\Windows\System\ZHpFeFJ.exe
  2⤵
  PID:6608
- C:\Windows\System\czVjDAs.exe
  C:\Windows\System\czVjDAs.exe
  2⤵
  PID:6624
- C:\Windows\System\bsFjglS.exe
  C:\Windows\System\bsFjglS.exe
  2⤵
  PID:6640
- C:\Windows\System\jFaJAQz.exe
  C:\Windows\System\jFaJAQz.exe
  2⤵
  PID:6656
- C:\Windows\System\SfVaGzI.exe
  C:\Windows\System\SfVaGzI.exe
  2⤵
  PID:6732
- C:\Windows\System\vixdtuM.exe
  C:\Windows\System\vixdtuM.exe
  2⤵
  PID:6756
- C:\Windows\System\tBhgKtp.exe
  C:\Windows\System\tBhgKtp.exe
  2⤵
  PID:6776
- C:\Windows\System\uoWczBx.exe
  C:\Windows\System\uoWczBx.exe
  2⤵
  PID:6792
- C:\Windows\System\JpyBwqE.exe
  C:\Windows\System\JpyBwqE.exe
  2⤵
  PID:6812
- C:\Windows\System\riDcEkm.exe
  C:\Windows\System\riDcEkm.exe
  2⤵
  PID:6840
- C:\Windows\System\khHMylZ.exe
  C:\Windows\System\khHMylZ.exe
  2⤵
  PID:6864
- C:\Windows\System\cwuwGEf.exe
  C:\Windows\System\cwuwGEf.exe
  2⤵
  PID:7048
- C:\Windows\System\FeLLlYo.exe
  C:\Windows\System\FeLLlYo.exe
  2⤵
  PID:7152
- C:\Windows\System\XyCndWM.exe
  C:\Windows\System\XyCndWM.exe
  2⤵
  PID:6184
- C:\Windows\System\LHUlpCa.exe
  C:\Windows\System\LHUlpCa.exe
  2⤵
  PID:6360
- C:\Windows\System\MXJoiJo.exe
  C:\Windows\System\MXJoiJo.exe
  2⤵
  PID:6408
- C:\Windows\System\GpjxMvo.exe
  C:\Windows\System\GpjxMvo.exe
  2⤵
  PID:6132
- C:\Windows\System\XKktajO.exe
  C:\Windows\System\XKktajO.exe
  2⤵
  PID:4832
- C:\Windows\System\EHWVVrp.exe
  C:\Windows\System\EHWVVrp.exe
  2⤵
  PID:6136
- C:\Windows\System\iyYnAzs.exe
  C:\Windows\System\iyYnAzs.exe
  2⤵
  PID:6428
- C:\Windows\System\EnxsDPF.exe
  C:\Windows\System\EnxsDPF.exe
  2⤵
  PID:6472
- C:\Windows\System\zSgRpXL.exe
  C:\Windows\System\zSgRpXL.exe
  2⤵
  PID:6504
- C:\Windows\System\epHSrGI.exe
  C:\Windows\System\epHSrGI.exe
  2⤵
  PID:6536
- C:\Windows\System\KOLGxbT.exe
  C:\Windows\System\KOLGxbT.exe
  2⤵
  PID:6568
- C:\Windows\System\CHvvIwD.exe
  C:\Windows\System\CHvvIwD.exe
  2⤵
  PID:4164
- C:\Windows\System\NTmTHbA.exe
  C:\Windows\System\NTmTHbA.exe
  2⤵
  PID:6600
- C:\Windows\System\YgEjJcW.exe
  C:\Windows\System\YgEjJcW.exe
  2⤵
  PID:6616
- C:\Windows\System\ZSvERGO.exe
  C:\Windows\System\ZSvERGO.exe
  2⤵
  PID:6636
- C:\Windows\System\dXracqc.exe
  C:\Windows\System\dXracqc.exe
  2⤵
  PID:6664
- C:\Windows\System\XTPaDrg.exe
  C:\Windows\System\XTPaDrg.exe
  2⤵
  PID:6680
- C:\Windows\System\YagfbYs.exe
  C:\Windows\System\YagfbYs.exe
  2⤵
  PID:6704
- C:\Windows\System\AUmBRYO.exe
  C:\Windows\System\AUmBRYO.exe
  2⤵
  PID:6728
- C:\Windows\System\BZnFfki.exe
  C:\Windows\System\BZnFfki.exe
  2⤵
  PID:6804
- C:\Windows\System\DXAPfrf.exe
  C:\Windows\System\DXAPfrf.exe
  2⤵
  PID:6860
- C:\Windows\System\PCKwzwm.exe
  C:\Windows\System\PCKwzwm.exe
  2⤵
  PID:6824
- C:\Windows\System\vMIetAL.exe
  C:\Windows\System\vMIetAL.exe
  2⤵
  PID:6872
- C:\Windows\System\aJdexsh.exe
  C:\Windows\System\aJdexsh.exe
  2⤵
  PID:6788
- C:\Windows\System\OUFmMdi.exe
  C:\Windows\System\OUFmMdi.exe
  2⤵
  PID:6888
- C:\Windows\System\ajMIarp.exe
  C:\Windows\System\ajMIarp.exe
  2⤵
  PID:6904
- C:\Windows\System\WLvfwky.exe
  C:\Windows\System\WLvfwky.exe
  2⤵
  PID:6740
- C:\Windows\System\uKMtkwA.exe
  C:\Windows\System\uKMtkwA.exe
  2⤵
  PID:6924
- C:\Windows\System\qpzXzTO.exe
  C:\Windows\System\qpzXzTO.exe
  2⤵
  PID:6948
- C:\Windows\System\ucBrRAo.exe
  C:\Windows\System\ucBrRAo.exe
  2⤵
  PID:6960
- C:\Windows\System\jNoOcWN.exe
  C:\Windows\System\jNoOcWN.exe
  2⤵
  PID:6976
- C:\Windows\System\caRywEr.exe
  C:\Windows\System\caRywEr.exe
  2⤵
  PID:7036
- C:\Windows\System\HHQnfTy.exe
  C:\Windows\System\HHQnfTy.exe
  2⤵
  PID:6980
- C:\Windows\System\zmGSjWv.exe
  C:\Windows\System\zmGSjWv.exe
  2⤵
  PID:7024
- C:\Windows\System\FAZwbSU.exe
  C:\Windows\System\FAZwbSU.exe
  2⤵
  PID:7044
- C:\Windows\System\fGerFsL.exe
  C:\Windows\System\fGerFsL.exe
  2⤵
  PID:7064
- C:\Windows\System\xAGJTfZ.exe
  C:\Windows\System\xAGJTfZ.exe
  2⤵
  PID:7088
- C:\Windows\System\FKvuQJP.exe
  C:\Windows\System\FKvuQJP.exe
  2⤵
  PID:7104
- C:\Windows\System\YPXujUR.exe
  C:\Windows\System\YPXujUR.exe
  2⤵
  PID:7132
- C:\Windows\System\KVYxMMS.exe
  C:\Windows\System\KVYxMMS.exe
  2⤵
  PID:7144
- C:\Windows\System\qvTFYnO.exe
  C:\Windows\System\qvTFYnO.exe
  2⤵
  PID:6216
- C:\Windows\System\xKsalow.exe
  C:\Windows\System\xKsalow.exe
  2⤵
  PID:6260
- C:\Windows\System\kiQvXih.exe
  C:\Windows\System\kiQvXih.exe
  2⤵
  PID:6308
- C:\Windows\System\wGlHYmA.exe
  C:\Windows\System\wGlHYmA.exe
  2⤵
  PID:6328
- C:\Windows\System\PKDLNxS.exe
  C:\Windows\System\PKDLNxS.exe
  2⤵
  PID:5124
- C:\Windows\System\SNIKKTd.exe
  C:\Windows\System\SNIKKTd.exe
  2⤵
  PID:6520
- C:\Windows\System\DpfTagk.exe
  C:\Windows\System\DpfTagk.exe
  2⤵
  PID:6604
- C:\Windows\System\JzHJXYO.exe
  C:\Windows\System\JzHJXYO.exe
  2⤵
  PID:6540
- C:\Windows\System\teZOVUg.exe
  C:\Windows\System\teZOVUg.exe
  2⤵
  PID:7164
- C:\Windows\System\KnxPrgB.exe
  C:\Windows\System\KnxPrgB.exe
  2⤵
  PID:3224
- C:\Windows\System\ivlpoza.exe
  C:\Windows\System\ivlpoza.exe
  2⤵
  PID:6152
- C:\Windows\System\ycZhEqZ.exe
  C:\Windows\System\ycZhEqZ.exe
  2⤵
  PID:6696
- C:\Windows\System\sOqEaJX.exe
  C:\Windows\System\sOqEaJX.exe
  2⤵
  PID:6364
- C:\Windows\System\WQpOPfd.exe
  C:\Windows\System\WQpOPfd.exe
  2⤵
  PID:5400
- C:\Windows\System\hpPZYYy.exe
  C:\Windows\System\hpPZYYy.exe
  2⤵
  PID:5148
- C:\Windows\System\yGnDAmu.exe
  C:\Windows\System\yGnDAmu.exe
  2⤵
  PID:5712
- C:\Windows\System\fdVMbXW.exe
  C:\Windows\System\fdVMbXW.exe
  2⤵
  PID:6676
- C:\Windows\System\knFVlvn.exe
  C:\Windows\System\knFVlvn.exe
  2⤵
  PID:6752
- C:\Windows\System\xDeafhL.exe
  C:\Windows\System\xDeafhL.exe
  2⤵
  PID:6724
- C:\Windows\System\YJGMfIt.exe
  C:\Windows\System\YJGMfIt.exe
  2⤵
  PID:6856
- C:\Windows\System\GlGwNLE.exe
  C:\Windows\System\GlGwNLE.exe
  2⤵
  PID:7004
- C:\Windows\System\gEVTCLA.exe
  C:\Windows\System\gEVTCLA.exe
  2⤵
  PID:7012
- C:\Windows\System\bkFdXfS.exe
  C:\Windows\System\bkFdXfS.exe
  2⤵
  PID:7056
- C:\Windows\System\KDpVIgD.exe
  C:\Windows\System\KDpVIgD.exe
  2⤵
  PID:7000
- C:\Windows\System\jkjzCxw.exe
  C:\Windows\System\jkjzCxw.exe
  2⤵
  PID:7072
- C:\Windows\System\NBMtpqW.exe
  C:\Windows\System\NBMtpqW.exe
  2⤵
  PID:7060
- C:\Windows\System\zVRLtlj.exe
  C:\Windows\System\zVRLtlj.exe
  2⤵
  PID:7112
- C:\Windows\System\sTfctGS.exe
  C:\Windows\System\sTfctGS.exe
  2⤵
  PID:6200
- C:\Windows\System\VIAzZUf.exe
  C:\Windows\System\VIAzZUf.exe
  2⤵
  PID:6444
- C:\Windows\System\HLryOmR.exe
  C:\Windows\System\HLryOmR.exe
  2⤵
  PID:6292
- C:\Windows\System\eVdDFTR.exe
  C:\Windows\System\eVdDFTR.exe
  2⤵
  PID:6392
- C:\Windows\System\nocoXZi.exe
  C:\Windows\System\nocoXZi.exe
  2⤵
  PID:6476
- C:\Windows\System\VkUOJEl.exe
  C:\Windows\System\VkUOJEl.exe
  2⤵
  PID:6344
- C:\Windows\System\fYKtHMX.exe
  C:\Windows\System\fYKtHMX.exe
  2⤵
  PID:6552
- C:\Windows\System\TaMeZFM.exe
  C:\Windows\System\TaMeZFM.exe
  2⤵
  PID:6784
- C:\Windows\System\xcgcJzM.exe
  C:\Windows\System\xcgcJzM.exe
  2⤵
  PID:6936
- C:\Windows\System\VsdFwtA.exe
  C:\Windows\System\VsdFwtA.exe
  2⤵
  PID:6996
- C:\Windows\System\GhJxwJX.exe
  C:\Windows\System\GhJxwJX.exe
  2⤵
  PID:7128
- C:\Windows\System\lUNsBAC.exe
  C:\Windows\System\lUNsBAC.exe
  2⤵
  PID:6968
- C:\Windows\System\lqfOQQC.exe
  C:\Windows\System\lqfOQQC.exe
  2⤵
  PID:7120
- C:\Windows\System\rOeYSPN.exe
  C:\Windows\System\rOeYSPN.exe
  2⤵
  PID:7116
- C:\Windows\System\rhZloem.exe
  C:\Windows\System\rhZloem.exe
  2⤵
  PID:1564
- C:\Windows\System\FJitBdD.exe
  C:\Windows\System\FJitBdD.exe
  2⤵
  PID:6264
- C:\Windows\System\mToINDE.exe
  C:\Windows\System\mToINDE.exe
  2⤵
  PID:6440
- C:\Windows\System\kgCZIPg.exe
  C:\Windows\System\kgCZIPg.exe
  2⤵
  PID:5836
- C:\Windows\System\kyUAAyY.exe
  C:\Windows\System\kyUAAyY.exe
  2⤵
  PID:6884
- C:\Windows\System\bPToRxd.exe
  C:\Windows\System\bPToRxd.exe
  2⤵
  PID:6916
- C:\Windows\System\eiXjtjk.exe
  C:\Windows\System\eiXjtjk.exe
  2⤵
  PID:6992
- C:\Windows\System\htVyrol.exe
  C:\Windows\System\htVyrol.exe
  2⤵
  PID:6296
- C:\Windows\System\GTBObIZ.exe
  C:\Windows\System\GTBObIZ.exe
  2⤵
  PID:6196
- C:\Windows\System\PmncEBo.exe
  C:\Windows\System\PmncEBo.exe
  2⤵
  PID:6556
- C:\Windows\System\jFyKVjY.exe
  C:\Windows\System\jFyKVjY.exe
  2⤵
  PID:6880
- C:\Windows\System\DZwCbMw.exe
  C:\Windows\System\DZwCbMw.exe
  2⤵
  PID:7136
- C:\Windows\System\zIwJhlR.exe
  C:\Windows\System\zIwJhlR.exe
  2⤵
  PID:6900
- C:\Windows\System\dbjrmXZ.exe
  C:\Windows\System\dbjrmXZ.exe
  2⤵
  PID:6836
- C:\Windows\System\cYfjimz.exe
  C:\Windows\System\cYfjimz.exe
  2⤵
  PID:6716
- C:\Windows\System\JRHMLjV.exe
  C:\Windows\System\JRHMLjV.exe
  2⤵
  PID:6412
- C:\Windows\System\PgClbnK.exe
  C:\Windows\System\PgClbnK.exe
  2⤵
  PID:6700
- C:\Windows\System\gPNgIeR.exe
  C:\Windows\System\gPNgIeR.exe
  2⤵
  PID:6632
- C:\Windows\System\ZCqePCC.exe
  C:\Windows\System\ZCqePCC.exe
  2⤵
  PID:7184
- C:\Windows\System\TuDbgTo.exe
  C:\Windows\System\TuDbgTo.exe
  2⤵
  PID:7200
- C:\Windows\System\iSbEHUC.exe
  C:\Windows\System\iSbEHUC.exe
  2⤵
  PID:7220
- C:\Windows\System\yVCoaoS.exe
  C:\Windows\System\yVCoaoS.exe
  2⤵
  PID:7236
- C:\Windows\System\WVYWWtO.exe
  C:\Windows\System\WVYWWtO.exe
  2⤵
  PID:7252
- C:\Windows\System\IzAdUTQ.exe
  C:\Windows\System\IzAdUTQ.exe
  2⤵
  PID:7272
- C:\Windows\System\WHFiKGG.exe
  C:\Windows\System\WHFiKGG.exe
  2⤵
  PID:7292
- C:\Windows\System\XqgOXYC.exe
  C:\Windows\System\XqgOXYC.exe
  2⤵
  PID:7312
- C:\Windows\System\JqEqPhQ.exe
  C:\Windows\System\JqEqPhQ.exe
  2⤵
  PID:7332
- C:\Windows\System\bHsAOrr.exe
  C:\Windows\System\bHsAOrr.exe
  2⤵
  PID:7352
- C:\Windows\System\LzirxCH.exe
  C:\Windows\System\LzirxCH.exe
  2⤵
  PID:7376
- C:\Windows\System\XAVbTYt.exe
  C:\Windows\System\XAVbTYt.exe
  2⤵
  PID:7392
- C:\Windows\System\nuZgKvN.exe
  C:\Windows\System\nuZgKvN.exe
  2⤵
  PID:7416
- C:\Windows\System\KRONHkI.exe
  C:\Windows\System\KRONHkI.exe
  2⤵
  PID:7432
- C:\Windows\System\bSODkLU.exe
  C:\Windows\System\bSODkLU.exe
  2⤵
  PID:7452
- C:\Windows\System\TjhmwzJ.exe
  C:\Windows\System\TjhmwzJ.exe
  2⤵
  PID:7480
- C:\Windows\System\bcWfjIk.exe
  C:\Windows\System\bcWfjIk.exe
  2⤵
  PID:7500
- C:\Windows\System\NtkCJoy.exe
  C:\Windows\System\NtkCJoy.exe
  2⤵
  PID:7520
- C:\Windows\System\ZfkArxD.exe
  C:\Windows\System\ZfkArxD.exe
  2⤵
  PID:7536
- C:\Windows\System\DMMECpH.exe
  C:\Windows\System\DMMECpH.exe
  2⤵
  PID:7552
- C:\Windows\System\aOyRBsn.exe
  C:\Windows\System\aOyRBsn.exe
  2⤵
  PID:7568
- C:\Windows\System\CHBHGYO.exe
  C:\Windows\System\CHBHGYO.exe
  2⤵
  PID:7584
- C:\Windows\System\VCgcQQg.exe
  C:\Windows\System\VCgcQQg.exe
  2⤵
  PID:7600
- C:\Windows\System\gONRWHB.exe
  C:\Windows\System\gONRWHB.exe
  2⤵
  PID:7616
- C:\Windows\System\zodTeDo.exe
  C:\Windows\System\zodTeDo.exe
  2⤵
  PID:7632
- C:\Windows\System\pZWVFxO.exe
  C:\Windows\System\pZWVFxO.exe
  2⤵
  PID:7652
- C:\Windows\System\UZYlSLe.exe
  C:\Windows\System\UZYlSLe.exe
  2⤵
  PID:7668
- C:\Windows\System\eLsaVzO.exe
  C:\Windows\System\eLsaVzO.exe
  2⤵
  PID:7684
- C:\Windows\System\ByGgDqz.exe
  C:\Windows\System\ByGgDqz.exe
  2⤵
  PID:7700
- C:\Windows\System\ypkOdEC.exe
  C:\Windows\System\ypkOdEC.exe
  2⤵
  PID:7720
- C:\Windows\System\PwvqxNN.exe
  C:\Windows\System\PwvqxNN.exe
  2⤵
  PID:7740
- C:\Windows\System\HPrjrBy.exe
  C:\Windows\System\HPrjrBy.exe
  2⤵
  PID:7760
- C:\Windows\System\BZfpLmj.exe
  C:\Windows\System\BZfpLmj.exe
  2⤵
  PID:7784
- C:\Windows\System\rYSyjEw.exe
  C:\Windows\System\rYSyjEw.exe
  2⤵
  PID:7804
- C:\Windows\System\VGNmcVE.exe
  C:\Windows\System\VGNmcVE.exe
  2⤵
  PID:7828
- C:\Windows\System\ZiejPjQ.exe
  C:\Windows\System\ZiejPjQ.exe
  2⤵
  PID:7848
- C:\Windows\System\bCRqmyE.exe
  C:\Windows\System\bCRqmyE.exe
  2⤵
  PID:7872
- C:\Windows\System\LWxORqU.exe
  C:\Windows\System\LWxORqU.exe
  2⤵
  PID:7888
- C:\Windows\System\tnEFeSH.exe
  C:\Windows\System\tnEFeSH.exe
  2⤵
  PID:7908
- C:\Windows\System\tezApEt.exe
  C:\Windows\System\tezApEt.exe
  2⤵
  PID:7932
- C:\Windows\System\HHOFnfo.exe
  C:\Windows\System\HHOFnfo.exe
  2⤵
  PID:7952
- C:\Windows\System\vZmtNoe.exe
  C:\Windows\System\vZmtNoe.exe
  2⤵
  PID:7972
- C:\Windows\System\XoymEOG.exe
  C:\Windows\System\XoymEOG.exe
  2⤵
  PID:7996
- C:\Windows\System\dJYUzSw.exe
  C:\Windows\System\dJYUzSw.exe
  2⤵
  PID:8012
- C:\Windows\System\uFYTbIV.exe
  C:\Windows\System\uFYTbIV.exe
  2⤵
  PID:8040
- C:\Windows\System\KYJlTQk.exe
  C:\Windows\System\KYJlTQk.exe
  2⤵
  PID:8060
- C:\Windows\System\LCAdROV.exe
  C:\Windows\System\LCAdROV.exe
  2⤵
  PID:8080
- C:\Windows\System\iAHDzBY.exe
  C:\Windows\System\iAHDzBY.exe
  2⤵
  PID:8104
- C:\Windows\System\KQJnoHD.exe
  C:\Windows\System\KQJnoHD.exe
  2⤵
  PID:8120
- C:\Windows\System\qJuTUBa.exe
  C:\Windows\System\qJuTUBa.exe
  2⤵
  PID:8140
- C:\Windows\System\wwuVnMV.exe
  C:\Windows\System\wwuVnMV.exe
  2⤵
  PID:8160
- C:\Windows\System\SBCpJyx.exe
  C:\Windows\System\SBCpJyx.exe
  2⤵
  PID:8176
- C:\Windows\System\zkUywNr.exe
  C:\Windows\System\zkUywNr.exe
  2⤵
  PID:7176
- C:\Windows\System\oLNFyYC.exe
  C:\Windows\System\oLNFyYC.exe
  2⤵
  PID:7216
- C:\Windows\System\AFtiUMV.exe
  C:\Windows\System\AFtiUMV.exe
  2⤵
  PID:7280
- C:\Windows\System\dJIaCYz.exe
  C:\Windows\System\dJIaCYz.exe
  2⤵
  PID:7228
- C:\Windows\System\PfwXbOx.exe
  C:\Windows\System\PfwXbOx.exe
  2⤵
  PID:7320
- C:\Windows\System\FZAyjfO.exe
  C:\Windows\System\FZAyjfO.exe
  2⤵
  PID:7328
- C:\Windows\System\uHyHCqE.exe
  C:\Windows\System\uHyHCqE.exe
  2⤵
  PID:7340
- C:\Windows\System\LbewYOa.exe
  C:\Windows\System\LbewYOa.exe
  2⤵
  PID:7384
- C:\Windows\System\FijUYir.exe
  C:\Windows\System\FijUYir.exe
  2⤵
  PID:7424
- C:\Windows\System\RiOqQyr.exe
  C:\Windows\System\RiOqQyr.exe
  2⤵
  PID:7464
- C:\Windows\System\sYEperC.exe
  C:\Windows\System\sYEperC.exe
  2⤵
  PID:7492
- C:\Windows\System\pcEBwhy.exe
  C:\Windows\System\pcEBwhy.exe
  2⤵
  PID:7532
- C:\Windows\System\mAejFwc.exe
  C:\Windows\System\mAejFwc.exe
  2⤵
  PID:7468
- C:\Windows\System\WrGMnaL.exe
  C:\Windows\System\WrGMnaL.exe
  2⤵
  PID:7660
- C:\Windows\System\ttLjAgn.exe
  C:\Windows\System\ttLjAgn.exe
  2⤵
  PID:7580
- C:\Windows\System\WlRFTcB.exe
  C:\Windows\System\WlRFTcB.exe
  2⤵
  PID:7648
- C:\Windows\System\GxzAGNt.exe
  C:\Windows\System\GxzAGNt.exe
  2⤵
  PID:7712
- C:\Windows\System\uZdtIXJ.exe
  C:\Windows\System\uZdtIXJ.exe
  2⤵
  PID:7772
- C:\Windows\System\Bwofebg.exe
  C:\Windows\System\Bwofebg.exe
  2⤵
  PID:7756
- C:\Windows\System\ALenCVv.exe
  C:\Windows\System\ALenCVv.exe
  2⤵
  PID:7856
- C:\Windows\System\EYIIQCb.exe
  C:\Windows\System\EYIIQCb.exe
  2⤵
  PID:7868
- C:\Windows\System\zxEKCsA.exe
  C:\Windows\System\zxEKCsA.exe
  2⤵
  PID:7900
- C:\Windows\System\Ycfsqan.exe
  C:\Windows\System\Ycfsqan.exe
  2⤵
  PID:7944
- C:\Windows\System\yWMHxZA.exe
  C:\Windows\System\yWMHxZA.exe
  2⤵
  PID:7928
- C:\Windows\System\WFWUJRP.exe
  C:\Windows\System\WFWUJRP.exe
  2⤵
  PID:7964
- C:\Windows\System\TazYeBu.exe
  C:\Windows\System\TazYeBu.exe
  2⤵
  PID:8004
- C:\Windows\System\qLAGIwq.exe
  C:\Windows\System\qLAGIwq.exe
  2⤵
  PID:8048
- C:\Windows\System\NcgtorU.exe
  C:\Windows\System\NcgtorU.exe
  2⤵
  PID:8088
- C:\Windows\System\DyPWyeV.exe
  C:\Windows\System\DyPWyeV.exe
  2⤵
  PID:8148
- C:\Windows\System\fBZdGWm.exe
  C:\Windows\System\fBZdGWm.exe
  2⤵
  PID:7248
- C:\Windows\System\CYQaoHz.exe
  C:\Windows\System\CYQaoHz.exe
  2⤵
  PID:6324
- C:\Windows\System\zldTNXC.exe
  C:\Windows\System\zldTNXC.exe
  2⤵
  PID:7212
- C:\Windows\System\AOAwZlw.exe
  C:\Windows\System\AOAwZlw.exe
  2⤵
  PID:7260
- C:\Windows\System\wDwCyPM.exe
  C:\Windows\System\wDwCyPM.exe
  2⤵
  PID:7412
- C:\Windows\System\zWsIiXW.exe
  C:\Windows\System\zWsIiXW.exe
  2⤵
  PID:7344
- C:\Windows\System\NWhSUII.exe
  C:\Windows\System\NWhSUII.exe
  2⤵
  PID:7488
- C:\Windows\System\UVRdDfJ.exe
  C:\Windows\System\UVRdDfJ.exe
  2⤵
  PID:7624
- C:\Windows\System\OSJkAaI.exe
  C:\Windows\System\OSJkAaI.exe
  2⤵
  PID:7548
- C:\Windows\System\PmqPYzO.exe
  C:\Windows\System\PmqPYzO.exe
  2⤵
  PID:7708
- C:\Windows\System\PpEuYQZ.exe
  C:\Windows\System\PpEuYQZ.exe
  2⤵
  PID:7800
- C:\Windows\System\QZVgUoW.exe
  C:\Windows\System\QZVgUoW.exe
  2⤵
  PID:7812
- C:\Windows\System\UxBlwQj.exe
  C:\Windows\System\UxBlwQj.exe
  2⤵
  PID:7736
- C:\Windows\System\aYoxfWF.exe
  C:\Windows\System\aYoxfWF.exe
  2⤵
  PID:7840
- C:\Windows\System\BijWBGt.exe
  C:\Windows\System\BijWBGt.exe
  2⤵
  PID:7896
- C:\Windows\System\WIDXWWl.exe
  C:\Windows\System\WIDXWWl.exe
  2⤵
  PID:7924
- C:\Windows\System\mgfTBSG.exe
  C:\Windows\System\mgfTBSG.exe
  2⤵
  PID:8096
- C:\Windows\System\mIbWnVo.exe
  C:\Windows\System\mIbWnVo.exe
  2⤵
  PID:8184
- C:\Windows\System\QKnymYS.exe
  C:\Windows\System\QKnymYS.exe
  2⤵
  PID:8052
- C:\Windows\System\YZptkRp.exe
  C:\Windows\System\YZptkRp.exe
  2⤵
  PID:8112
- C:\Windows\System\IJKSuwa.exe
  C:\Windows\System\IJKSuwa.exe
  2⤵
  PID:7208
- C:\Windows\System\MHoXvFL.exe
  C:\Windows\System\MHoXvFL.exe
  2⤵
  PID:7596
- C:\Windows\System\IjYvYra.exe
  C:\Windows\System\IjYvYra.exe
  2⤵
  PID:7460
- C:\Windows\System\oZgBmgJ.exe
  C:\Windows\System\oZgBmgJ.exe
  2⤵
  PID:7748
- C:\Windows\System\WbpfZHn.exe
  C:\Windows\System\WbpfZHn.exe
  2⤵
  PID:7824
- C:\Windows\System\SGsOpcX.exe
  C:\Windows\System\SGsOpcX.exe
  2⤵
  PID:7608
- C:\Windows\System\jUebxBw.exe
  C:\Windows\System\jUebxBw.exe
  2⤵
  PID:7968
- C:\Windows\System\slbDuno.exe
  C:\Windows\System\slbDuno.exe
  2⤵
  PID:7988
- C:\Windows\System\MRAOxdd.exe
  C:\Windows\System\MRAOxdd.exe
  2⤵
  PID:8076
- C:\Windows\System\NqxKwRM.exe
  C:\Windows\System\NqxKwRM.exe
  2⤵
  PID:8100
- C:\Windows\System\tXrngEB.exe
  C:\Windows\System\tXrngEB.exe
  2⤵
  PID:7576
- C:\Windows\System\dbeBpIN.exe
  C:\Windows\System\dbeBpIN.exe
  2⤵
  PID:8172
- C:\Windows\System\ETQszCP.exe
  C:\Windows\System\ETQszCP.exe
  2⤵
  PID:7528
- C:\Windows\System\bwMJijI.exe
  C:\Windows\System\bwMJijI.exe
  2⤵
  PID:7780
- C:\Windows\System\AZhqyUL.exe
  C:\Windows\System\AZhqyUL.exe
  2⤵
  PID:7364
- C:\Windows\System\dbrfBBT.exe
  C:\Windows\System\dbrfBBT.exe
  2⤵
  PID:7992
- C:\Windows\System\dtMrrkd.exe
  C:\Windows\System\dtMrrkd.exe
  2⤵
  PID:8068
- C:\Windows\System\mXOTcKR.exe
  C:\Windows\System\mXOTcKR.exe
  2⤵
  PID:7544
- C:\Windows\System\FSApfyR.exe
  C:\Windows\System\FSApfyR.exe
  2⤵
  PID:8032
- C:\Windows\System\eIxvWuF.exe
  C:\Windows\System\eIxvWuF.exe
  2⤵
  PID:7592
- C:\Windows\System\cypsqNA.exe
  C:\Windows\System\cypsqNA.exe
  2⤵
  PID:7816
- C:\Windows\System\VBNdxkB.exe
  C:\Windows\System\VBNdxkB.exe
  2⤵
  PID:7696
- C:\Windows\System\tmuUgdy.exe
  C:\Windows\System\tmuUgdy.exe
  2⤵
  PID:8168
- C:\Windows\System\nlxsJsS.exe
  C:\Windows\System\nlxsJsS.exe
  2⤵
  PID:8208
- C:\Windows\System\dFhyOXW.exe
  C:\Windows\System\dFhyOXW.exe
  2⤵
  PID:8224
- C:\Windows\System\SIsXcea.exe
  C:\Windows\System\SIsXcea.exe
  2⤵
  PID:8240
- C:\Windows\System\vJqYbWn.exe
  C:\Windows\System\vJqYbWn.exe
  2⤵
  PID:8256
- C:\Windows\System\GhaZJKr.exe
  C:\Windows\System\GhaZJKr.exe
  2⤵
  PID:8272
- C:\Windows\System\yeUZqAn.exe
  C:\Windows\System\yeUZqAn.exe
  2⤵
  PID:8296
- C:\Windows\System\giehCkS.exe
  C:\Windows\System\giehCkS.exe
  2⤵
  PID:8312
- C:\Windows\System\KgMeJqB.exe
  C:\Windows\System\KgMeJqB.exe
  2⤵
  PID:8328
- C:\Windows\System\jyrQaEx.exe
  C:\Windows\System\jyrQaEx.exe
  2⤵
  PID:8344
- C:\Windows\System\GquECDL.exe
  C:\Windows\System\GquECDL.exe
  2⤵
  PID:8360
- C:\Windows\System\tClRWem.exe
  C:\Windows\System\tClRWem.exe
  2⤵
  PID:8376
- C:\Windows\System\RYiJlRI.exe
  C:\Windows\System\RYiJlRI.exe
  2⤵
  PID:8392
- C:\Windows\System\HNcqdDL.exe
  C:\Windows\System\HNcqdDL.exe
  2⤵
  PID:8408
- C:\Windows\System\YTmTqIZ.exe
  C:\Windows\System\YTmTqIZ.exe
  2⤵
  PID:8424
- C:\Windows\System\DrplomK.exe
  C:\Windows\System\DrplomK.exe
  2⤵
  PID:8440
- C:\Windows\System\ofiGkeZ.exe
  C:\Windows\System\ofiGkeZ.exe
  2⤵
  PID:8456
- C:\Windows\System\CeIimVi.exe
  C:\Windows\System\CeIimVi.exe
  2⤵
  PID:8472
- C:\Windows\System\CFkDPmi.exe
  C:\Windows\System\CFkDPmi.exe
  2⤵
  PID:8500
- C:\Windows\System\vMMSfEd.exe
  C:\Windows\System\vMMSfEd.exe
  2⤵
  PID:8520
- C:\Windows\System\AJoWvgX.exe
  C:\Windows\System\AJoWvgX.exe
  2⤵
  PID:8536
- C:\Windows\System\WXQgLFo.exe
  C:\Windows\System\WXQgLFo.exe
  2⤵
  PID:8552
- C:\Windows\System\WhIbPuN.exe
  C:\Windows\System\WhIbPuN.exe
  2⤵
  PID:8584
- C:\Windows\System\TYcYuGo.exe
  C:\Windows\System\TYcYuGo.exe
  2⤵
  PID:8608
- C:\Windows\System\TFGqVWs.exe
  C:\Windows\System\TFGqVWs.exe
  2⤵
  PID:8628
- C:\Windows\System\qLAmVAu.exe
  C:\Windows\System\qLAmVAu.exe
  2⤵
  PID:8656
- C:\Windows\System\VqcBctE.exe
  C:\Windows\System\VqcBctE.exe
  2⤵
  PID:8672
- C:\Windows\System\KCSWght.exe
  C:\Windows\System\KCSWght.exe
  2⤵
  PID:8688
- C:\Windows\System\vDUktzu.exe
  C:\Windows\System\vDUktzu.exe
  2⤵
  PID:8704
- C:\Windows\System\dpxPJfw.exe
  C:\Windows\System\dpxPJfw.exe
  2⤵
  PID:8728
- C:\Windows\System\EHFRzpS.exe
  C:\Windows\System\EHFRzpS.exe
  2⤵
  PID:8748
- C:\Windows\System\mtBtfrA.exe
  C:\Windows\System\mtBtfrA.exe
  2⤵
  PID:8768
- C:\Windows\System\kVPWQRa.exe
  C:\Windows\System\kVPWQRa.exe
  2⤵
  PID:8784
- C:\Windows\System\toiPIfi.exe
  C:\Windows\System\toiPIfi.exe
  2⤵
  PID:8804
- C:\Windows\System\RMOIxZG.exe
  C:\Windows\System\RMOIxZG.exe
  2⤵
  PID:8824
- C:\Windows\System\ygvihGt.exe
  C:\Windows\System\ygvihGt.exe
  2⤵
  PID:8840
- C:\Windows\System\LRlSSXg.exe
  C:\Windows\System\LRlSSXg.exe
  2⤵
  PID:8984
- C:\Windows\System\Kfjseba.exe
  C:\Windows\System\Kfjseba.exe
  2⤵
  PID:9000
- C:\Windows\System\HguWlPT.exe
  C:\Windows\System\HguWlPT.exe
  2⤵
  PID:9016
- C:\Windows\System\jRBKrdS.exe
  C:\Windows\System\jRBKrdS.exe
  2⤵
  PID:9032
- C:\Windows\System\lAMxHyy.exe
  C:\Windows\System\lAMxHyy.exe
  2⤵
  PID:9052
- C:\Windows\System\akyGlTT.exe
  C:\Windows\System\akyGlTT.exe
  2⤵
  PID:9068
- C:\Windows\System\wUfZNzN.exe
  C:\Windows\System\wUfZNzN.exe
  2⤵
  PID:9084
- C:\Windows\System\sHGiFgn.exe
  C:\Windows\System\sHGiFgn.exe
  2⤵
  PID:9100
- C:\Windows\System\glDAVMg.exe
  C:\Windows\System\glDAVMg.exe
  2⤵
  PID:9116
- C:\Windows\System\ZGpdutt.exe
  C:\Windows\System\ZGpdutt.exe
  2⤵
  PID:9132
- C:\Windows\System\KpCeksk.exe
  C:\Windows\System\KpCeksk.exe
  2⤵
  PID:9148
- C:\Windows\System\RfmnnLn.exe
  C:\Windows\System\RfmnnLn.exe
  2⤵
  PID:9168
- C:\Windows\System\UmceFAr.exe
  C:\Windows\System\UmceFAr.exe
  2⤵
  PID:9184
- C:\Windows\System\KGRTXwf.exe
  C:\Windows\System\KGRTXwf.exe
  2⤵
  PID:9200
- C:\Windows\System\FwfPIGQ.exe
  C:\Windows\System\FwfPIGQ.exe
  2⤵
  PID:7844
- C:\Windows\System\ksldPeX.exe
  C:\Windows\System\ksldPeX.exe
  2⤵
  PID:8024
- C:\Windows\System\kmkEoRS.exe
  C:\Windows\System\kmkEoRS.exe
  2⤵
  PID:8200
- C:\Windows\System\EZHnWlp.exe
  C:\Windows\System\EZHnWlp.exe
  2⤵
  PID:8368
- C:\Windows\System\EOsONKt.exe
  C:\Windows\System\EOsONKt.exe
  2⤵
  PID:8464
- C:\Windows\System\xPOoXiB.exe
  C:\Windows\System\xPOoXiB.exe
  2⤵
  PID:8404
- C:\Windows\System\NgdXVDc.exe
  C:\Windows\System\NgdXVDc.exe
  2⤵
  PID:8508
- C:\Windows\System\kjYNWDa.exe
  C:\Windows\System\kjYNWDa.exe
  2⤵
  PID:8388
- C:\Windows\System\CFBipFu.exe
  C:\Windows\System\CFBipFu.exe
  2⤵
  PID:8484
- C:\Windows\System\yNRaDbl.exe
  C:\Windows\System\yNRaDbl.exe
  2⤵
  PID:8280
- C:\Windows\System\tfafYXb.exe
  C:\Windows\System\tfafYXb.exe
  2⤵
  PID:8156
- C:\Windows\System\QLvKHiU.exe
  C:\Windows\System\QLvKHiU.exe
  2⤵
  PID:8252
- C:\Windows\System\sIVsgWH.exe
  C:\Windows\System\sIVsgWH.exe
  2⤵
  PID:8320
- C:\Windows\System\iJDeUXg.exe
  C:\Windows\System\iJDeUXg.exe
  2⤵
  PID:8596
- C:\Windows\System\NIxQdIY.exe
  C:\Windows\System\NIxQdIY.exe
  2⤵
  PID:8492
- C:\Windows\System\CBBZhhi.exe
  C:\Windows\System\CBBZhhi.exe
  2⤵
  PID:8532
- C:\Windows\System\AqlfVQE.exe
  C:\Windows\System\AqlfVQE.exe
  2⤵
  PID:8636
- C:\Windows\System\hAemeHu.exe
  C:\Windows\System\hAemeHu.exe
  2⤵
  PID:8616
- C:\Windows\System\mvhxxOU.exe
  C:\Windows\System\mvhxxOU.exe
  2⤵
  PID:8620
- C:\Windows\System\txmlJep.exe
  C:\Windows\System\txmlJep.exe
  2⤵
  PID:8716
- C:\Windows\System\zEMFEAe.exe
  C:\Windows\System\zEMFEAe.exe
  2⤵
  PID:8760
- C:\Windows\System\aymmpAE.exe
  C:\Windows\System\aymmpAE.exe
  2⤵
  PID:8776
- C:\Windows\System\FujqwME.exe
  C:\Windows\System\FujqwME.exe
  2⤵
  PID:8696
- C:\Windows\System\uUiSdJY.exe
  C:\Windows\System\uUiSdJY.exe
  2⤵
  PID:8780
- C:\Windows\System\OmLPtcM.exe
  C:\Windows\System\OmLPtcM.exe
  2⤵
  PID:8820
- C:\Windows\System\OpYeAsg.exe
  C:\Windows\System\OpYeAsg.exe
  2⤵
  PID:8848
- C:\Windows\System\YqQMqjF.exe
  C:\Windows\System\YqQMqjF.exe
  2⤵
  PID:8868
- C:\Windows\System\tZMIkYe.exe
  C:\Windows\System\tZMIkYe.exe
  2⤵
  PID:8896
- C:\Windows\System\PKvNZqj.exe
  C:\Windows\System\PKvNZqj.exe
  2⤵
  PID:8900
- C:\Windows\System\hZDNvLG.exe
  C:\Windows\System\hZDNvLG.exe
  2⤵
  PID:8912
- C:\Windows\System\VCNZQbt.exe
  C:\Windows\System\VCNZQbt.exe
  2⤵
  PID:8940
- C:\Windows\System\AjBqXsh.exe
  C:\Windows\System\AjBqXsh.exe
  2⤵
  PID:8948
- C:\Windows\System\JAhRkhs.exe
  C:\Windows\System\JAhRkhs.exe
  2⤵
  PID:8968
- C:\Windows\System\oVHklnc.exe
  C:\Windows\System\oVHklnc.exe
  2⤵
  PID:8972
- C:\Windows\System\UbzQdBC.exe
  C:\Windows\System\UbzQdBC.exe
  2⤵
  PID:8512
- C:\Windows\System\wGJudwV.exe
  C:\Windows\System\wGJudwV.exe
  2⤵
  PID:9044
- C:\Windows\System\Pmqqvdl.exe
  C:\Windows\System\Pmqqvdl.exe
  2⤵
  PID:9124
- C:\Windows\System\mKYihGU.exe
  C:\Windows\System\mKYihGU.exe
  2⤵
  PID:9108
- C:\Windows\System\BbUxyVH.exe
  C:\Windows\System\BbUxyVH.exe
  2⤵
  PID:7752
- C:\Windows\System\SpDNnug.exe
  C:\Windows\System\SpDNnug.exe
  2⤵
  PID:8268
- C:\Windows\System\BbVfaJe.exe
  C:\Windows\System\BbVfaJe.exe
  2⤵
  PID:8372
- C:\Windows\System\yHvKYhj.exe
  C:\Windows\System\yHvKYhj.exe
  2⤵
  PID:8384
- C:\Windows\System\qsZddFo.exe
  C:\Windows\System\qsZddFo.exe
  2⤵
  PID:9180
- C:\Windows\System\sbVJoEF.exe
  C:\Windows\System\sbVJoEF.exe
  2⤵
  PID:8420
- C:\Windows\System\WlwLUTt.exe
  C:\Windows\System\WlwLUTt.exe
  2⤵
  PID:8496
- C:\Windows\System\XWMWjEQ.exe
  C:\Windows\System\XWMWjEQ.exe
  2⤵
  PID:6708
- C:\Windows\System\IMjWCrR.exe
  C:\Windows\System\IMjWCrR.exe
  2⤵
  PID:8452
- C:\Windows\System\HIhHEqO.exe
  C:\Windows\System\HIhHEqO.exe
  2⤵
  PID:8288
- C:\Windows\System\WxMuHqy.exe
  C:\Windows\System\WxMuHqy.exe
  2⤵
  PID:8604
- C:\Windows\System\YsQIacl.exe
  C:\Windows\System\YsQIacl.exe
  2⤵
  PID:8644
- C:\Windows\System\qdtblmj.exe
  C:\Windows\System\qdtblmj.exe
  2⤵
  PID:8908
- C:\Windows\System\MIbJrZc.exe
  C:\Windows\System\MIbJrZc.exe
  2⤵
  PID:8916
- C:\Windows\System\JiWWdPl.exe
  C:\Windows\System\JiWWdPl.exe
  2⤵
  PID:8816
- C:\Windows\System\aYTVhOb.exe
  C:\Windows\System\aYTVhOb.exe
  2⤵
  PID:8992
- C:\Windows\System\WpJrEkQ.exe
  C:\Windows\System\WpJrEkQ.exe
  2⤵
  PID:9160
- C:\Windows\System\tEKcVIN.exe
  C:\Windows\System\tEKcVIN.exe
  2⤵
  PID:8648
- C:\Windows\System\rRogsvn.exe
  C:\Windows\System\rRogsvn.exe
  2⤵
  PID:8888
- C:\Windows\System\SECrhlc.exe
  C:\Windows\System\SECrhlc.exe
  2⤵
  PID:9212
- C:\Windows\System\REtGugR.exe
  C:\Windows\System\REtGugR.exe
  2⤵
  PID:8720
- C:\Windows\System\UZAwvHS.exe
  C:\Windows\System\UZAwvHS.exe
  2⤵
  PID:8864
- C:\Windows\System\nYRTrAC.exe
  C:\Windows\System\nYRTrAC.exe
  2⤵
  PID:8812
- C:\Windows\System\DGXDCSg.exe
  C:\Windows\System\DGXDCSg.exe
  2⤵
  PID:9176
- C:\Windows\System\RXvVqkj.exe
  C:\Windows\System\RXvVqkj.exe
  2⤵
  PID:9008
- C:\Windows\System\PfZandm.exe
  C:\Windows\System\PfZandm.exe
  2⤵
  PID:8304
- C:\Windows\System\BdDbshd.exe
  C:\Windows\System\BdDbshd.exe
  2⤵
  PID:8576
- C:\Windows\System\fObONTS.exe
  C:\Windows\System\fObONTS.exe
  2⤵
  PID:8488
- C:\Windows\System\xKIvwBv.exe
  C:\Windows\System\xKIvwBv.exe
  2⤵
  PID:8236
- C:\Windows\System\lKIBRjA.exe
  C:\Windows\System\lKIBRjA.exe
  2⤵
  PID:9156
- C:\Windows\System\JJyODwi.exe
  C:\Windows\System\JJyODwi.exe
  2⤵
  PID:8356
- C:\Windows\System\SdgstGU.exe
  C:\Windows\System\SdgstGU.exe
  2⤵
  PID:8996
- C:\Windows\System\ZSsbFai.exe
  C:\Windows\System\ZSsbFai.exe
  2⤵
  PID:8860
- C:\Windows\System\pzYBuge.exe
  C:\Windows\System\pzYBuge.exe
  2⤵
  PID:8308
- C:\Windows\System\agBzjTZ.exe
  C:\Windows\System\agBzjTZ.exe
  2⤵
  PID:8664
- C:\Windows\System\vJbiofh.exe
  C:\Windows\System\vJbiofh.exe
  2⤵
  PID:8944
- C:\Windows\System\jUNmoaG.exe
  C:\Windows\System\jUNmoaG.exe
  2⤵
  PID:8744
- C:\Windows\System\ttZOUjE.exe
  C:\Windows\System\ttZOUjE.exe
  2⤵
  PID:8796
- C:\Windows\System\CGOZhpt.exe
  C:\Windows\System\CGOZhpt.exe
  2⤵
  PID:9096
- C:\Windows\System\LkeflPh.exe
  C:\Windows\System\LkeflPh.exe
  2⤵
  PID:9028
- C:\Windows\System\EoNUToE.exe
  C:\Windows\System\EoNUToE.exe
  2⤵
  PID:9228
- C:\Windows\System\bFHQtpe.exe
  C:\Windows\System\bFHQtpe.exe
  2⤵
  PID:9248
- C:\Windows\System\mvMHhpA.exe
  C:\Windows\System\mvMHhpA.exe
  2⤵
  PID:9264
- C:\Windows\System\JNKvyHK.exe
  C:\Windows\System\JNKvyHK.exe
  2⤵
  PID:9288
- C:\Windows\System\iJaQawx.exe
  C:\Windows\System\iJaQawx.exe
  2⤵
  PID:9304
- C:\Windows\System\IAmqXhp.exe
  C:\Windows\System\IAmqXhp.exe
  2⤵
  PID:9320
- C:\Windows\System\ZAdCyzK.exe
  C:\Windows\System\ZAdCyzK.exe
  2⤵
  PID:9336
- C:\Windows\System\HMDrBGf.exe
  C:\Windows\System\HMDrBGf.exe
  2⤵
  PID:9352
- C:\Windows\System\vWLLYmh.exe
  C:\Windows\System\vWLLYmh.exe
  2⤵
  PID:9368
- C:\Windows\System\iuzZHRU.exe
  C:\Windows\System\iuzZHRU.exe
  2⤵
  PID:9384
- C:\Windows\System\sVUaWOf.exe
  C:\Windows\System\sVUaWOf.exe
  2⤵
  PID:9400
- C:\Windows\System\AZZYGIi.exe
  C:\Windows\System\AZZYGIi.exe
  2⤵
  PID:9416
- C:\Windows\System\ANFSuAP.exe
  C:\Windows\System\ANFSuAP.exe
  2⤵
  PID:9432
- C:\Windows\System\OMklgLD.exe
  C:\Windows\System\OMklgLD.exe
  2⤵
  PID:9448
- C:\Windows\System\XFVYyvA.exe
  C:\Windows\System\XFVYyvA.exe
  2⤵
  PID:9464
- C:\Windows\System\zeEpzxV.exe
  C:\Windows\System\zeEpzxV.exe
  2⤵
  PID:9480
- C:\Windows\System\pQjXCqm.exe
  C:\Windows\System\pQjXCqm.exe
  2⤵
  PID:9496
- C:\Windows\System\jwoDTGQ.exe
  C:\Windows\System\jwoDTGQ.exe
  2⤵
  PID:9512
- C:\Windows\System\PxDbDzA.exe
  C:\Windows\System\PxDbDzA.exe
  2⤵
  PID:9528
- C:\Windows\System\eckfKpn.exe
  C:\Windows\System\eckfKpn.exe
  2⤵
  PID:9544
- C:\Windows\System\uFQPykp.exe
  C:\Windows\System\uFQPykp.exe
  2⤵
  PID:9560
- C:\Windows\System\NkzsUcJ.exe
  C:\Windows\System\NkzsUcJ.exe
  2⤵
  PID:9576
- C:\Windows\System\MINuWzJ.exe
  C:\Windows\System\MINuWzJ.exe
  2⤵
  PID:9592
- C:\Windows\System\tnYHlvD.exe
  C:\Windows\System\tnYHlvD.exe
  2⤵
  PID:9612
- C:\Windows\System\TkhfJEk.exe
  C:\Windows\System\TkhfJEk.exe
  2⤵
  PID:9628
- C:\Windows\System\zIbFVrW.exe
  C:\Windows\System\zIbFVrW.exe
  2⤵
  PID:9644
- C:\Windows\System\pDtQZpK.exe
  C:\Windows\System\pDtQZpK.exe
  2⤵
  PID:9660
- C:\Windows\System\jVSHIol.exe
  C:\Windows\System\jVSHIol.exe
  2⤵
  PID:9676
- C:\Windows\System\ruQmYaD.exe
  C:\Windows\System\ruQmYaD.exe
  2⤵
  PID:9692
- C:\Windows\System\HgNeIZM.exe
  C:\Windows\System\HgNeIZM.exe
  2⤵
  PID:9708
- C:\Windows\System\msNbhMH.exe
  C:\Windows\System\msNbhMH.exe
  2⤵
  PID:9724
- C:\Windows\System\DavWUWS.exe
  C:\Windows\System\DavWUWS.exe
  2⤵
  PID:9740
- C:\Windows\System\PGLxFFW.exe
  C:\Windows\System\PGLxFFW.exe
  2⤵
  PID:9756
- C:\Windows\System\WVDoHXa.exe
  C:\Windows\System\WVDoHXa.exe
  2⤵
  PID:9772
- C:\Windows\System\tERMGgd.exe
  C:\Windows\System\tERMGgd.exe
  2⤵
  PID:9788
- C:\Windows\System\rejbalB.exe
  C:\Windows\System\rejbalB.exe
  2⤵
  PID:9804
- C:\Windows\System\LCgmsMm.exe
  C:\Windows\System\LCgmsMm.exe
  2⤵
  PID:9820
- C:\Windows\System\yErlibl.exe
  C:\Windows\System\yErlibl.exe
  2⤵
  PID:9836
- C:\Windows\System\UYNEPtf.exe
  C:\Windows\System\UYNEPtf.exe
  2⤵
  PID:9856
- C:\Windows\System\lWBMAwq.exe
  C:\Windows\System\lWBMAwq.exe
  2⤵
  PID:9872
- C:\Windows\System\tVbZDfA.exe
  C:\Windows\System\tVbZDfA.exe
  2⤵
  PID:9888
- C:\Windows\System\tJEwtTr.exe
  C:\Windows\System\tJEwtTr.exe
  2⤵
  PID:9904
- C:\Windows\System\dtuSxzv.exe
  C:\Windows\System\dtuSxzv.exe
  2⤵
  PID:9920
- C:\Windows\System\gKAeMBc.exe
  C:\Windows\System\gKAeMBc.exe
  2⤵
  PID:9936
- C:\Windows\System\QrsTemD.exe
  C:\Windows\System\QrsTemD.exe
  2⤵
  PID:9952
- C:\Windows\System\zeSzVme.exe
  C:\Windows\System\zeSzVme.exe
  2⤵
  PID:9968
- C:\Windows\System\tIiJoqn.exe
  C:\Windows\System\tIiJoqn.exe
  2⤵
  PID:9984
- C:\Windows\System\hIBTjuA.exe
  C:\Windows\System\hIBTjuA.exe
  2⤵
  PID:10004
- C:\Windows\System\tKiPAxm.exe
  C:\Windows\System\tKiPAxm.exe
  2⤵
  PID:10020
- C:\Windows\System\kxbGvTh.exe
  C:\Windows\System\kxbGvTh.exe
  2⤵
  PID:10040
- C:\Windows\System\RqODhwh.exe
  C:\Windows\System\RqODhwh.exe
  2⤵
  PID:10056
- C:\Windows\System\sIywqBx.exe
  C:\Windows\System\sIywqBx.exe
  2⤵
  PID:10072
- C:\Windows\System\TvywbHN.exe
  C:\Windows\System\TvywbHN.exe
  2⤵
  PID:10088
- C:\Windows\System\WlGasVA.exe
  C:\Windows\System\WlGasVA.exe
  2⤵
  PID:10104
- C:\Windows\System\YxmzvRU.exe
  C:\Windows\System\YxmzvRU.exe
  2⤵
  PID:10124
- C:\Windows\System\HmmjcrZ.exe
  C:\Windows\System\HmmjcrZ.exe
  2⤵
  PID:10140
- C:\Windows\System\wejrKmq.exe
  C:\Windows\System\wejrKmq.exe
  2⤵
  PID:10156
- C:\Windows\System\CoBSSUS.exe
  C:\Windows\System\CoBSSUS.exe
  2⤵
  PID:10172
- C:\Windows\System\xxdFgey.exe
  C:\Windows\System\xxdFgey.exe
  2⤵
  PID:10188
- C:\Windows\System\FVThNBK.exe
  C:\Windows\System\FVThNBK.exe
  2⤵
  PID:10204
- C:\Windows\System\GOXKSEs.exe
  C:\Windows\System\GOXKSEs.exe
  2⤵
  PID:10220
- C:\Windows\System\mJMhLVa.exe
  C:\Windows\System\mJMhLVa.exe
  2⤵
  PID:10236
- C:\Windows\System\MlKjNLM.exe
  C:\Windows\System\MlKjNLM.exe
  2⤵
  PID:8880
- C:\Windows\System\PpNYXzs.exe
  C:\Windows\System\PpNYXzs.exe
  2⤵
  PID:8544
- C:\Windows\System\LPFDCpS.exe
  C:\Windows\System\LPFDCpS.exe
  2⤵
  PID:9244
- C:\Windows\System\ciXILUv.exe
  C:\Windows\System\ciXILUv.exe
  2⤵
  PID:9272
- C:\Windows\System\XikTrve.exe
  C:\Windows\System\XikTrve.exe
  2⤵
  PID:9312
- C:\Windows\System\eXQJiFa.exe
  C:\Windows\System\eXQJiFa.exe
  2⤵
  PID:9376
- C:\Windows\System\LMWUrdC.exe
  C:\Windows\System\LMWUrdC.exe
  2⤵
  PID:9412
- C:\Windows\System\RVbOKea.exe
  C:\Windows\System\RVbOKea.exe
  2⤵
  PID:9392
- C:\Windows\System\JExtWti.exe
  C:\Windows\System\JExtWti.exe
  2⤵
  PID:9428
- C:\Windows\System\TdbUuUx.exe
  C:\Windows\System\TdbUuUx.exe
  2⤵
  PID:9476
- C:\Windows\System\MtqCllQ.exe
  C:\Windows\System\MtqCllQ.exe
  2⤵
  PID:9568
- C:\Windows\System\fJOavzM.exe
  C:\Windows\System\fJOavzM.exe
  2⤵
  PID:9460
- C:\Windows\System\qaRtLZE.exe
  C:\Windows\System\qaRtLZE.exe
  2⤵
  PID:9364
- C:\Windows\System\zNwbbDR.exe
  C:\Windows\System\zNwbbDR.exe
  2⤵
  PID:9588
- C:\Windows\System\JIXBiYp.exe
  C:\Windows\System\JIXBiYp.exe
  2⤵
  PID:9668
- C:\Windows\System\mNgiZFp.exe
  C:\Windows\System\mNgiZFp.exe
  2⤵
  PID:9736
- C:\Windows\System\LhJlLHe.exe
  C:\Windows\System\LhJlLHe.exe
  2⤵
  PID:9684
- C:\Windows\System\gVCcAvC.exe
  C:\Windows\System\gVCcAvC.exe
  2⤵
  PID:9652
- C:\Windows\System\whylQtW.exe
  C:\Windows\System\whylQtW.exe
  2⤵
  PID:9764
- C:\Windows\System\eaVWmyb.exe
  C:\Windows\System\eaVWmyb.exe
  2⤵
  PID:9828
- C:\Windows\System\IcUlaTL.exe
  C:\Windows\System\IcUlaTL.exe
  2⤵
  PID:9868
- C:\Windows\System\WHHsrFu.exe
  C:\Windows\System\WHHsrFu.exe
  2⤵
  PID:9780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AfTGNlc.exe

Filesize
2.9MB

MD5
e4b4fb75f3aa320b562a8d4b4ba434a8

SHA1
72ea5922e4dce48fa61d7d31e6b6021e8c0cd246

SHA256
8a358b31da4d1a1a823f767ca7d2a8e84e9a3d708e9f884724acdca9591f8fab

SHA512
32d03eb0d60b2d2c340dcddc874486ea0bf806720232be27dcd5ae022d4684d6fc2d8839f7621357c677904cfc5d91fcd7102386c529eca6980e23e2bd6f564c

Download Submit
C:\Windows\system\CBqvcCr.exe

Filesize
2.9MB

MD5
48bbeb4901fd080af324321593644ba6

SHA1
ead1553e327eb135a5ae675d74d98847b6e50ba4

SHA256
fe3b4804b174536edd97407e6bed918286b4db6cdbf424f9e52d4d188326fca0

SHA512
85bfe1204dc7b47886dc513b5b13a7d7f5aaad11a35ba0332beae2c524508abb5b3cd0a598ce98787a570fb41e0e8239685453c1624ab1b9634f5d31dc967c05

Download Submit
C:\Windows\system\GSIJvNe.exe

Filesize
2.9MB

MD5
c5c127054d271d160b2c3b1e6a4a009a

SHA1
0fec9cad78479362fdc1996a197289cee28c88c1

SHA256
aafc837b488d219a7192a67a4c42cb131b4279a25421578ccfe235bacc40ad06

SHA512
b45a2df4db54353aca0a306bfe1fec64bcdd59cb8933ddbe69f6510c94adee2008c0987026b0d1ef8b450013c636292f7c969835c29c54f45ea6271cdc266314

Download Submit
C:\Windows\system\GaVcrrR.exe

Filesize
2.9MB

MD5
3bfb7356a2c8a31f73a858c72c0342f6

SHA1
bc8a00f6bd3bdd356f74b0d24d3532785f3b05a3

SHA256
567eb3d53d34d9c6ef30f15e94b200495c09cfd38a8a13de2f035296e1d6c9a8

SHA512
fa154d4d69438daf350efa03f24d9e7761a7bd33d19cfcb376c0c873f707e5873ce3e1b7fc60298658125b43ea86607f791bddf722163fedae1f5a5ad871c560

Download Submit
C:\Windows\system\HJNOybx.exe

Filesize
2.9MB

MD5
ffedf8c338c39db42da74f1b552815f1

SHA1
234eb7b46cb9b41fd98d73d428bb6b48824ee835

SHA256
b1abd0250e6d452c150be80aa6068f9fc6b3c3bc54e0d9ab3543a47fe5750b60

SHA512
38582336b1535f1b48c5b4f0929ab710e4fe29bb2727dee5f4b42279f773b9f9e3d5d36f0ae2676d188a1d863b3cc8abc56542ac820edd6065de368230ad41cb

Download Submit
C:\Windows\system\LSAilfz.exe

Filesize
2.9MB

MD5
dad1ce6ac301abf7922ef0a40cc75ea2

SHA1
5600ec76cf651ce3abcfe2f9b2b87bc4d0b6d115

SHA256
dfa5dc083295871ad509de0459ff2f0ab2f8eb983e8a2a8e9672c9e2e92d0061

SHA512
4feaa99b05d200f6a14f6c3d3bf729274bdd4d89a1142ae6c6e73da44098b7cbcf6df6c95dbaa1538a9153e698197f7a27a3d47d9686835ba27b89859b823c19

Download Submit
C:\Windows\system\MIXkcCk.exe

Filesize
2.9MB

MD5
2220dee93ea50ddbefef2677f9fdadb7

SHA1
7b46d902f7035e5ea08127eb2d65ef56652c7e86

SHA256
a6c68bfdb107c8a259af929110ce290fb530f0da00b42871e2d365c3a5538005

SHA512
f77cd105e7ebc4f8c57cbfdb4b2cc49fb36956064b7dbacd110628c48fbadeda44e75a2a999ea56a17c52c23dba37c33a40d742bddf45686e399518b319836c2

Download Submit
C:\Windows\system\MpmdJVm.exe

Filesize
2.9MB

MD5
b7b9ebebb3afd8a36724838a2862a8d9

SHA1
c80fcce6de6fdd84e901c2b0ddcbc7d3ec4b15ae

SHA256
aa7ec62e3966ec987a40fb2f38b6bbd990a67453d0d1eda6a622ffc57ab133ed

SHA512
31846ac6015a501d8810a83b51fe72012f7245fbdc930a0d5db95bb2e63110806528693f142f41b5a2c27dd2eb8cb505f90ad5ab41a03098c80fec5cc95b08a5

Download Submit
C:\Windows\system\NXcYsBl.exe

Filesize
2.9MB

MD5
e0f15e5208f450ab4c3e8c32ecc69239

SHA1
99cc617800a6e44901ab433848b67bfedee82328

SHA256
37fc12371cc80059a443ee5e8d6333ae11c7077461a453639d893b8745654582

SHA512
8c6d527525cd6d30ddf5afc8c88331f5661731f694c3adf49ee8dd33388f39a6bc09cf8a5029d758406427370e6c24a72154ececb1ecd96a13164369a33bae64

Download Submit
C:\Windows\system\OBaaecx.exe

Filesize
2.9MB

MD5
262137ac2ffa7bce22bcfc6870638a84

SHA1
d17974e29023cf50b0fb078d27281a4bbed9ac4f

SHA256
d9812155a33f10719c74611f2e7903f5a22949480ccc3218918afc54670280bf

SHA512
de9daebc28c9ddf70b680de0b61ca3ddc87c6ffe99cd055caca4e07c64f7eb88b24388b1f0bf5b09f2d9ca9c1ec6bb616d833e2d1abb0430fbafed0530d07f78

Download Submit
C:\Windows\system\PcGNdPx.exe

Filesize
2.9MB

MD5
807b4cedd836e2b8d44438aec8de4d5b

SHA1
dfe180ca9d4f4da43a470c06e2900d57149696cb

SHA256
8f69e77c606b55ad21a2baa987c0d3c45ba8ca2ad0333d60b7691ee7bad1aa05

SHA512
68b483dcb2aa8f2946674b529d26e131947184e8dccbaf70de6d30f59a13e65272896af119531158de4068d97f0b41e1e5edb7c2a7ed15099d89c5d047b77ca8

Download Submit
C:\Windows\system\QOeBWJn.exe

Filesize
2.9MB

MD5
a69744649bb55e386fa6da411f98523c

SHA1
ccb39c3e44d3d07051f5d0b53fed213f9b41dffd

SHA256
02836ab29f05b0067a54b8735cb571300403ceac48c6d0b8d8a8193c39f3e331

SHA512
ccdab198e0b569adfb0f10f191018e750ad265390add0977c0646b9613a9f326958da313c9131ab80bb47c304ef22fd565a1ad97ad7a169ecfcf695845df7ad8

Download Submit
C:\Windows\system\UyChBow.exe

Filesize
2.9MB

MD5
d6a79f85a03494b5c5968f44f2f07fe4

SHA1
b59a78da09bb885becaae8d0b4c6c1056e6c4b75

SHA256
0066f612fccbb07159fba304eb513cf13480657c98db88b11bcd2e2f797e92f8

SHA512
791122ab832f22ec9e25ca85b29ad5d4a53d868b9152b75429754ba31a1cc56043202a051f9defa01b2fa9297359a096141f3a6edb19504f0679d806bfa5cce2

Download Submit
C:\Windows\system\VPwZpmq.exe

Filesize
2.9MB

MD5
2855db994436f9280c2b54e27cfa17b2

SHA1
ebab1a209ef366c2203175869e7c23ed2c2b765a

SHA256
6e676732e16ea6281ad707d57b1dfd749a40e71a0eae4db89a3bf14bcd65f484

SHA512
bf0b9023d2e49e9449d07b755d8599f512cabb7e956e91c0dd523b5b392f987805f6bb22d1634f1d04a7bc742bb0018852a0d02af698f3b65bba72179ccc946c

Download Submit
C:\Windows\system\VfnPwqO.exe

Filesize
2.9MB

MD5
17993097f47a2501604af18009d43d0c

SHA1
f076923c25ffdebe95f2b2b24858d1336ee33426

SHA256
9a12f81d399db43bb1507067dff7a67dabc1c56ade1c32d5d26b1cd054cea7be

SHA512
0c08e6ea3b9695eea7e56e71d0d5d1eec8119b346efbdbfb2c8dfb3109c0a6d49060c140298e73007bd144f4fab3fc24a2a65cce90969a95b67079c563ebd8f3

Download Submit
C:\Windows\system\ZMsyCbO.exe

Filesize
2.9MB

MD5
2d85ed08515be25dc4cde0b3f7800895

SHA1
423c85dc9bc65ef7995cec889714abf1fc878598

SHA256
498c326586b686da926819c3c0f3f561d5ff3bcaadfd77c639feb15829d07d0a

SHA512
83a06a41478d9e3dd75c9b6e5bcf952d89d29806671e3d4269365538004c1b94832e8e58d87e5d43d7c6922bffd13db596e0be98a14b6301bcb94b1e39aa7c30

Download Submit
C:\Windows\system\azsyXuf.exe

Filesize
2.9MB

MD5
aec219c6aed5ba5314bae88eebf4eae4

SHA1
036980bde747aa1843df48f6db2b0054add06b06

SHA256
da1275eb89b60a1cc667c8e4d8830fbb4975350a8bbd13a3ccd7783f02afb25c

SHA512
caa535d303f26d9284080d7a5c7ec6a945fac72028662d66f7e25ee373b6df6c5075ba7c83fae32a7032ab7c06e927ec85323aa0969965459b4fe36e01b17bb9

Download Submit
C:\Windows\system\evedKJB.exe

Filesize
2.9MB

MD5
d4031cf33803a181b2a2d4316d43b260

SHA1
b2b0d5650f9e94356510517285fe3c0ea754ebc6

SHA256
c4edfad2a4e07b2ec77e5a2a063f35af269d572f4640c75e01ea9cf8ba26a453

SHA512
9d25fbf55a4e912f921e2d2637fed550eea172db773bfe3b22028e9522c0719ba06ee9d9d3d18575ba4440eede18391d2b0c311b0ea1a0549ef61e10e0873df6

Download Submit
C:\Windows\system\gTlygvn.exe

Filesize
2.9MB

MD5
1319a066b19643da1371db75ed6ff382

SHA1
11e47a0aef1bfc0598b1d93bfc24a4565c77885e

SHA256
32c07be3e856c11134939f2fafa2c840935730b758df553d18b805b83c8d835c

SHA512
206e5d8bc9b4b164eda4d61bd299e7c76a9d4ad147de6ae204fe30058124f0b7fb6116627ff5e93229f63802c5d27467ce3003b08d8f904b52e1d2bada7e5f63

Download Submit
C:\Windows\system\hQXrzIO.exe

Filesize
2.9MB

MD5
28920859d9933191f44605b0a1021a15

SHA1
d832833f13fd830800890d9a619e09e0580297a5

SHA256
afb521509985e4a0e837522151daacb99757548afb12ef17fd6c3c9eda744c9a

SHA512
91d006f7254ff5b3536593dbae62fb8642f452137d486d2546efca898e1c770992ce4ddde2e06320bd91ccb5b0d2a264b4f10d356b333b2e476f73ab7d90b3e6

Download Submit
C:\Windows\system\kkOXtmG.exe

Filesize
2.9MB

MD5
78f6796187a079a4d4fba471dcbbf477

SHA1
9ee973d3bdd4f74c6adc2b7f5c8d224e79d0f68a

SHA256
9a2c9f2c0283cc55a22a7598fe3968f19e546deceaf12c29ba4984bc34313410

SHA512
87f8d59fde8f4f453685346465af0a52b2dcc9c01d8ac123cfef249f422ad7cc6646c305d1a02fd1826076699d7d8decc16b7b4c305fe83f7d0f86fedbbd471c

Download Submit
C:\Windows\system\lhFTdsz.exe

Filesize
2.9MB

MD5
d44a18af7e3df541300272f5dc864e92

SHA1
78ed03fbc92b2c9b5eda45181e7eb2aefa46405e

SHA256
619490180458442b74514e76fe803452fbed364c7cbfb7baa05b94d30ea5ba66

SHA512
b0589482adf7adb07ed7944a7f2cec28117127522044ddfa983431ff709095ee17c943dd672e4f62141d62b8679ed119486eb7340fce4da1f7ca63ea2121ed48

Download Submit
C:\Windows\system\lvwDOLw.exe

Filesize
2.9MB

MD5
0a179231b1ef172ca0e019579eabfb57

SHA1
eeb353770ac670c01676a5c1db43f6a1c1a0a158

SHA256
100c74207b545308a37f4087a5495370f6df0735c07c4de6465c5bf1a3e2f936

SHA512
fb8be6a6c7feb263089e54e52847bbe037cc981d040f0b7a78e8565ccb98df27f46cc5a8f95c3feb383cf140dc00700c76bc8153f7804d1b0463e6896c37fd26

Download Submit
C:\Windows\system\nkhcVJA.exe

Filesize
2.9MB

MD5
2513f676be3664baabb448d277614335

SHA1
3223c0d310d3803ce85bdd321bdbe25c057542b9

SHA256
d70c6cca0e16e8afad8f1083d843a9a63e2264ee9bb8a96527ba40f0a955c17e

SHA512
b3015e624eb0e09e0ada367bb8fd3eaaf48311e975fded4267c345c1afddd06fd663ccc6a10cd40670f14142f5d854dc70dddbc832431d6035ae77ba386a9687

Download Submit
C:\Windows\system\pyqkXSY.exe

Filesize
2.9MB

MD5
1766d6509b5f5bf2314fe1de711af43a

SHA1
a12572303b4fde4a1ff50c1f2ce3a8ad1cdfe91c

SHA256
496550a94a7e443bf3f6c071bfe3f7c32eedd1ac4b0a2509099ef2e5a3ddfecf

SHA512
78bfd5b222fdb3cb333b931efea0acd41e8325d014d39f4360b5d3b33ce27b00f1873dc09741e815430b88ceeef7027517b1e1a36a68c85a36d60e4d0ef43d5c

Download Submit
C:\Windows\system\rWagGun.exe

Filesize
2.9MB

MD5
78563b4cd81ef7461d897d21a16b014d

SHA1
6b08d740738d65bc2e0916892bc184799e689d89

SHA256
eacf54a6a2554b586065cadcda0dc016607b411e8bc2caca54ec3bce9c49409f

SHA512
3c1fbed213b86b9181f8d26bd503a1f6bbe741c033fbb23d2fff28f927c53460387646c3d4e65e0095e707b6f35772e6bc201059484f997c7a6564e7ef770b8a

Download Submit
C:\Windows\system\ruxIrvy.exe

Filesize
2.9MB

MD5
4d32487151fc53810eeda953175ae05c

SHA1
b99d24d2259ad8b05dafcc539ca4da34963408a5

SHA256
f50745fd7be9a80672157af383f223057cd801fe21b393c037b33f4469b63c2f

SHA512
e9331f25167a44a0d412ea298dd4bf52f76070bde4c3af9c4052ad1cb0b80a86e5b3025065c97ce4ebd0ecf161a110be67b2afaa8a6754889c8d0f6ed84fe282

Download Submit
C:\Windows\system\uIbQjvw.exe

Filesize
2.9MB

MD5
88ddd86ae75d08f88ce35135fce79248

SHA1
9c7251345250b0771ba5ab62405b5acd6a19466f

SHA256
bd28696610ac0fbfac98f878dfca834d2f21aa7d535594d4219cf2f09ee304cf

SHA512
46a53c7ec7a9be6f2d84557c92367a6b2de17e02f70161ac54618d0290efb56473256d890d35bf6c1de904102b4ee2fb2444b3e8cb2953052a2390919dd68141

Download Submit
C:\Windows\system\vFTdVWR.exe

Filesize
2.9MB

MD5
6620eb6f4dac37db74368fbd91793dc6

SHA1
76664da1050b8cd90df09317e4aab0efc66327b2

SHA256
84eca3eede68d54959b6db6708e0096a4a0ea68f6392323f51c61bd5ee42b64c

SHA512
f1d038cf271bac74a33d3cccd34ecb523a78f6e8fd500309edc8eaac92b97612328a1147960c945e113295d4621b42a6f5d082a24997b3810b01e4d7aa6abcd8

Download Submit
C:\Windows\system\wyawDdc.exe

Filesize
2.9MB

MD5
0d20ff4eb0dfb1875c5d507e92bc235b

SHA1
687dedffd1977bbfac430acbed286ccda8537481

SHA256
e8ff646fa766bef99333e7ef358a8435949bf594d61a29753b33ca44cf350989

SHA512
c1b9126049abc17cc100f14a5d6af4b6bb34f8806417edffd01ef58f6fe936ceb9cf91add6d58792e83a6eac4ba7066ca55a6eeee42775dc0621f774e92b3b3f

Download Submit
\Windows\system\gFQAlTx.exe

Filesize
2.9MB

MD5
af8b8a4a6ac084214fb8865c9a209f85

SHA1
0b4adb88fe910fae77fdcf223e54759148fe9179

SHA256
4c5a488af59b91949810d647a61e96f8eaaddec8c96cce65bae7659d38f866fc

SHA512
e089db5216653c6ea4546cbd0f82d3f2517c2bdb072226ead7b3b9f1a06ad23785932d3bc7c8a87ffe543f0beb70bef4d51c079698ccf08ed365e6904566fb54

Download Submit
\Windows\system\rOrAWly.exe

Filesize
2.9MB

MD5
13b17c6f2d051109bb551a09d01dd925

SHA1
7ef70b510a84876d9cea3816b6fffa35bace9aff

SHA256
ef21b1a431288916bbc56cc802780494a1e3f85773855c12f575668897a97bfa

SHA512
f0d03ce668b10c7a6254b11686c7024a4ae1afc616eec2fff37506fc91e545625f06258b3515b460b7f2e5ef38dbf5b647c7bac8875f14a9f3fc9d51598c93c8

Download Submit
memory/1728-1267-0x000000013F680000-0x000000013FA76000-memory.dmp

Filesize
4.0MB

Download
memory/1740-20-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/1740-19-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1740-720-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/1740-721-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/1740-1159-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/1740-1158-0x000000000298B000-0x00000000029F2000-memory.dmp

Filesize
412KB

Download
memory/1740-528-0x000007FEF5A1E000-0x000007FEF5A1F000-memory.dmp

Filesize
4KB

Download
memory/2312-3346-0x000000013F030000-0x000000013F426000-memory.dmp

Filesize
4.0MB

Download
memory/2312-523-0x000000013F030000-0x000000013F426000-memory.dmp

Filesize
4.0MB

Download
memory/2448-4539-0x000000013FF00000-0x00000001402F6000-memory.dmp

Filesize
4.0MB

Download
memory/2448-745-0x000000013FF00000-0x00000001402F6000-memory.dmp

Filesize
4.0MB

Download
memory/2452-1101-0x000000013F430000-0x000000013F826000-memory.dmp

Filesize
4.0MB

Download
memory/2452-3920-0x000000013F430000-0x000000013F826000-memory.dmp

Filesize
4.0MB

Download
memory/2496-978-0x000000013F160000-0x000000013F556000-memory.dmp

Filesize
4.0MB

Download
memory/2496-4543-0x000000013F160000-0x000000013F556000-memory.dmp

Filesize
4.0MB

Download
memory/2508-1180-0x000000013F4A0000-0x000000013F896000-memory.dmp

Filesize
4.0MB

Download
memory/2508-4583-0x000000013F4A0000-0x000000013F896000-memory.dmp

Filesize
4.0MB

Download
memory/2608-3925-0x000000013F190000-0x000000013F586000-memory.dmp

Filesize
4.0MB

Download
memory/2608-873-0x000000013F190000-0x000000013F586000-memory.dmp

Filesize
4.0MB

Download
memory/2620-976-0x000000013F130000-0x000000013F526000-memory.dmp

Filesize
4.0MB

Download
memory/2620-3929-0x000000013F130000-0x000000013F526000-memory.dmp

Filesize
4.0MB

Download
memory/2636-3450-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2636-729-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2752-25-0x000000013F030000-0x000000013F426000-memory.dmp

Filesize
4.0MB

Download
memory/2752-792-0x000000013F190000-0x000000013F586000-memory.dmp

Filesize
4.0MB

Download
memory/2752-979-0x000000013F430000-0x000000013F826000-memory.dmp

Filesize
4.0MB

Download
memory/2752-1102-0x0000000003660000-0x0000000003A56000-memory.dmp

Filesize
4.0MB

Download
memory/2752-1268-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2752-13-0x00000000030F0000-0x00000000034E6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-1-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2752-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2752-5868-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2752-1215-0x0000000003660000-0x0000000003A56000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5705-0x000000013FF00000-0x00000001402F6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-1181-0x000000013FCB0000-0x00000001400A6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-977-0x000000013F160000-0x000000013F556000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5715-0x000000013F130000-0x000000013F526000-memory.dmp

Filesize
4.0MB

Download
memory/2752-973-0x000000013F020000-0x000000013F416000-memory.dmp

Filesize
4.0MB

Download
memory/2752-734-0x000000013FF00000-0x00000001402F6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5702-0x0000000003660000-0x0000000003A56000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5708-0x000000013F190000-0x000000013F586000-memory.dmp

Filesize
4.0MB

Download
memory/2752-975-0x000000013F130000-0x000000013F526000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5557-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5563-0x000000013F030000-0x000000013F426000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5718-0x000000013F160000-0x000000013F556000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5711-0x000000013F020000-0x000000013F416000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5724-0x0000000003660000-0x0000000003A56000-memory.dmp

Filesize
4.0MB

Download
memory/2752-5721-0x000000013F430000-0x000000013F826000-memory.dmp

Filesize
4.0MB

Download
memory/2836-974-0x000000013F020000-0x000000013F416000-memory.dmp

Filesize
4.0MB

Download
memory/2836-4547-0x000000013F020000-0x000000013F416000-memory.dmp

Filesize
4.0MB

Download
memory/2996-1214-0x000000013FCB0000-0x00000001400A6000-memory.dmp

Filesize
4.0MB

Download
memory/3008-4575-0x000000013F7F0000-0x000000013FBE6000-memory.dmp

Filesize
4.0MB

Download
memory/3008-1235-0x000000013F7F0000-0x000000013FBE6000-memory.dmp

Filesize
4.0MB

Download