xmrig | 5f29fdce7d7219a4254df1cfb76c51aef410fdb0291fa7aa9d59e35e8ae3f098

Analysis

max time kernel
123s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
Size

1.7MB
MD5

c8e96e9d6204272108db8dcc8dd01da0
SHA1

b59dbea42bdd3e77a092eaadf80a3f7359bd29ee
SHA256

5f29fdce7d7219a4254df1cfb76c51aef410fdb0291fa7aa9d59e35e8ae3f098
SHA512

6e005160a2e331133217ef7bf47b59450d105f757481a52887e9245325e75599cfba2cac70d5b2cd668839a0af1231103b34c529adf1eaef7b5f215678678e86
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1V8:NABr

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4336-401-0x00007FF7D9150000-0x00007FF7D9542000-memory.dmp	xmrig
behavioral2/memory/1224-441-0x00007FF6A2840000-0x00007FF6A2C32000-memory.dmp	xmrig
behavioral2/memory/3628-505-0x00007FF6A5C60000-0x00007FF6A6052000-memory.dmp	xmrig
behavioral2/memory/5100-508-0x00007FF6E8060000-0x00007FF6E8452000-memory.dmp	xmrig
behavioral2/memory/1576-511-0x00007FF72F740000-0x00007FF72FB32000-memory.dmp	xmrig
behavioral2/memory/2916-803-0x00007FF637200000-0x00007FF6375F2000-memory.dmp	xmrig
behavioral2/memory/5004-704-0x00007FF7D5C20000-0x00007FF7D6012000-memory.dmp	xmrig
behavioral2/memory/4232-659-0x00007FF633010000-0x00007FF633402000-memory.dmp	xmrig
behavioral2/memory/2416-513-0x00007FF796750000-0x00007FF796B42000-memory.dmp	xmrig
behavioral2/memory/4532-512-0x00007FF60AC60000-0x00007FF60B052000-memory.dmp	xmrig
behavioral2/memory/1108-510-0x00007FF6A4880000-0x00007FF6A4C72000-memory.dmp	xmrig
behavioral2/memory/5080-509-0x00007FF7E33C0000-0x00007FF7E37B2000-memory.dmp	xmrig
behavioral2/memory/2948-507-0x00007FF75D810000-0x00007FF75DC02000-memory.dmp	xmrig
behavioral2/memory/4100-506-0x00007FF6A3400000-0x00007FF6A37F2000-memory.dmp	xmrig
behavioral2/memory/3880-504-0x00007FF7B7B20000-0x00007FF7B7F12000-memory.dmp	xmrig
behavioral2/memory/1756-503-0x00007FF7EA360000-0x00007FF7EA752000-memory.dmp	xmrig
behavioral2/memory/1300-502-0x00007FF702310000-0x00007FF702702000-memory.dmp	xmrig
behavioral2/memory/4364-501-0x00007FF6F3970000-0x00007FF6F3D62000-memory.dmp	xmrig
behavioral2/memory/3580-500-0x00007FF77D1C0000-0x00007FF77D5B2000-memory.dmp	xmrig
behavioral2/memory/1356-499-0x00007FF7AF7C0000-0x00007FF7AFBB2000-memory.dmp	xmrig
behavioral2/memory/632-324-0x00007FF65F7B0000-0x00007FF65FBA2000-memory.dmp	xmrig
behavioral2/memory/4304-281-0x00007FF732ED0000-0x00007FF7332C2000-memory.dmp	xmrig
behavioral2/memory/1488-162-0x00007FF6EA150000-0x00007FF6EA542000-memory.dmp	xmrig
behavioral2/memory/1056-17-0x00007FF711F60000-0x00007FF712352000-memory.dmp	xmrig
behavioral2/memory/1056-2681-0x00007FF711F60000-0x00007FF712352000-memory.dmp	xmrig
behavioral2/memory/4232-2683-0x00007FF633010000-0x00007FF633402000-memory.dmp	xmrig
behavioral2/memory/632-2685-0x00007FF65F7B0000-0x00007FF65FBA2000-memory.dmp	xmrig
behavioral2/memory/1488-2690-0x00007FF6EA150000-0x00007FF6EA542000-memory.dmp	xmrig
behavioral2/memory/2948-2691-0x00007FF75D810000-0x00007FF75DC02000-memory.dmp	xmrig
behavioral2/memory/4364-2688-0x00007FF6F3970000-0x00007FF6F3D62000-memory.dmp	xmrig
behavioral2/memory/4304-2693-0x00007FF732ED0000-0x00007FF7332C2000-memory.dmp	xmrig
behavioral2/memory/1224-2699-0x00007FF6A2840000-0x00007FF6A2C32000-memory.dmp	xmrig
behavioral2/memory/4336-2703-0x00007FF7D9150000-0x00007FF7D9542000-memory.dmp	xmrig
behavioral2/memory/3580-2705-0x00007FF77D1C0000-0x00007FF77D5B2000-memory.dmp	xmrig
behavioral2/memory/5004-2701-0x00007FF7D5C20000-0x00007FF7D6012000-memory.dmp	xmrig
behavioral2/memory/1356-2698-0x00007FF7AF7C0000-0x00007FF7AFBB2000-memory.dmp	xmrig
behavioral2/memory/5080-2695-0x00007FF7E33C0000-0x00007FF7E37B2000-memory.dmp	xmrig
behavioral2/memory/3628-2740-0x00007FF6A5C60000-0x00007FF6A6052000-memory.dmp	xmrig
behavioral2/memory/3880-2754-0x00007FF7B7B20000-0x00007FF7B7F12000-memory.dmp	xmrig
behavioral2/memory/1576-2752-0x00007FF72F740000-0x00007FF72FB32000-memory.dmp	xmrig
behavioral2/memory/2416-2731-0x00007FF796750000-0x00007FF796B42000-memory.dmp	xmrig
behavioral2/memory/4532-2724-0x00007FF60AC60000-0x00007FF60B052000-memory.dmp	xmrig
behavioral2/memory/1108-2720-0x00007FF6A4880000-0x00007FF6A4C72000-memory.dmp	xmrig
behavioral2/memory/4100-2716-0x00007FF6A3400000-0x00007FF6A37F2000-memory.dmp	xmrig
behavioral2/memory/1300-2714-0x00007FF702310000-0x00007FF702702000-memory.dmp	xmrig
behavioral2/memory/2916-2713-0x00007FF637200000-0x00007FF6375F2000-memory.dmp	xmrig
behavioral2/memory/1756-2711-0x00007FF7EA360000-0x00007FF7EA752000-memory.dmp	xmrig
behavioral2/memory/5100-2709-0x00007FF6E8060000-0x00007FF6E8452000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4820	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1056	aifnmoc.exe
4232	oIWfPwF.exe
5004	hsVRxue.exe
1488	udhXvmG.exe
4304	HIKcAra.exe
632	iRJXyQp.exe
4336	SXlxjWq.exe
1224	bnHfgaI.exe
1356	qLLIbDV.exe
3580	ZvFNSKe.exe
4364	lQDbAWs.exe
1300	JwqeGEV.exe
1756	JdqcShB.exe
3880	KMgYCYI.exe
3628	KxVdFTh.exe
4100	vpddVFW.exe
2948	KlshPMR.exe
5100	gnTOHRm.exe
5080	DsprFgB.exe
1108	PaHTPJa.exe
1576	LQvRJTH.exe
2916	nOEoLOI.exe
4532	ywXCLRB.exe
2416	DFcGcjO.exe
4636	xwNSbgd.exe
4924	JohsZQr.exe
2556	DxNZlES.exe
2140	SyVKcwl.exe
1404	cVhUzAt.exe
3348	DzvUzyK.exe
3748	sigcSvF.exe
1388	uSWrkQR.exe
816	bmLTVGG.exe
2252	UnHYzmK.exe
936	yBKWfzb.exe
1932	QBLQjqk.exe
728	zwQwZRs.exe
3552	LJtPSYj.exe
2784	COElmpN.exe
3764	WJojRon.exe
1896	XSDqgCG.exe
4668	PshIwtQ.exe
4236	SBFbhuq.exe
2380	OHTdYBK.exe
2376	PcnPhId.exe
3916	QldUIcl.exe
412	tzDuKsD.exe
644	aIXUhbp.exe
4020	cjKXXid.exe
736	bXvwKgY.exe
2028	XGYdReK.exe
640	uuyJqrA.exe
4496	sLKUxKP.exe
1916	HrbBfPq.exe
1392	xBvGiOy.exe
3516	GwwNvsq.exe
2868	pWZWqes.exe
1604	NdUDMgX.exe
4748	GxzeGHZ.exe
2740	UXsjInJ.exe
628	hCbYKaZ.exe
2384	Yibpksi.exe
228	VyPuWGk.exe
900	yZwoAQL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3368-0-0x00007FF6ECE00000-0x00007FF6ED1F2000-memory.dmp	upx
behavioral2/files/0x0007000000023278-5.dat	upx
behavioral2/files/0x0007000000023400-22.dat	upx
behavioral2/files/0x0007000000023402-29.dat	upx
behavioral2/files/0x0007000000023405-44.dat	upx
behavioral2/files/0x000700000002340c-67.dat	upx
behavioral2/files/0x0007000000023409-183.dat	upx
behavioral2/memory/4336-401-0x00007FF7D9150000-0x00007FF7D9542000-memory.dmp	upx
behavioral2/memory/1224-441-0x00007FF6A2840000-0x00007FF6A2C32000-memory.dmp	upx
behavioral2/memory/3628-505-0x00007FF6A5C60000-0x00007FF6A6052000-memory.dmp	upx
behavioral2/memory/5100-508-0x00007FF6E8060000-0x00007FF6E8452000-memory.dmp	upx
behavioral2/memory/1576-511-0x00007FF72F740000-0x00007FF72FB32000-memory.dmp	upx
behavioral2/memory/2916-803-0x00007FF637200000-0x00007FF6375F2000-memory.dmp	upx
behavioral2/memory/5004-704-0x00007FF7D5C20000-0x00007FF7D6012000-memory.dmp	upx
behavioral2/memory/4232-659-0x00007FF633010000-0x00007FF633402000-memory.dmp	upx
behavioral2/memory/2416-513-0x00007FF796750000-0x00007FF796B42000-memory.dmp	upx
behavioral2/memory/4532-512-0x00007FF60AC60000-0x00007FF60B052000-memory.dmp	upx
behavioral2/memory/1108-510-0x00007FF6A4880000-0x00007FF6A4C72000-memory.dmp	upx
behavioral2/memory/5080-509-0x00007FF7E33C0000-0x00007FF7E37B2000-memory.dmp	upx
behavioral2/memory/2948-507-0x00007FF75D810000-0x00007FF75DC02000-memory.dmp	upx
behavioral2/memory/4100-506-0x00007FF6A3400000-0x00007FF6A37F2000-memory.dmp	upx
behavioral2/memory/3880-504-0x00007FF7B7B20000-0x00007FF7B7F12000-memory.dmp	upx
behavioral2/memory/1756-503-0x00007FF7EA360000-0x00007FF7EA752000-memory.dmp	upx
behavioral2/memory/1300-502-0x00007FF702310000-0x00007FF702702000-memory.dmp	upx
behavioral2/memory/4364-501-0x00007FF6F3970000-0x00007FF6F3D62000-memory.dmp	upx
behavioral2/memory/3580-500-0x00007FF77D1C0000-0x00007FF77D5B2000-memory.dmp	upx
behavioral2/memory/1356-499-0x00007FF7AF7C0000-0x00007FF7AFBB2000-memory.dmp	upx
behavioral2/memory/632-324-0x00007FF65F7B0000-0x00007FF65FBA2000-memory.dmp	upx
behavioral2/memory/4304-281-0x00007FF732ED0000-0x00007FF7332C2000-memory.dmp	upx
behavioral2/files/0x0007000000023410-188.dat	upx
behavioral2/files/0x0007000000023421-174.dat	upx
behavioral2/files/0x000700000002340e-171.dat	upx
behavioral2/files/0x0007000000023415-170.dat	upx
behavioral2/files/0x0007000000023413-164.dat	upx
behavioral2/files/0x000700000002341f-153.dat	upx
behavioral2/files/0x000700000002341e-152.dat	upx
behavioral2/files/0x000700000002341d-151.dat	upx
behavioral2/files/0x000700000002341b-150.dat	upx
behavioral2/files/0x000700000002341c-140.dat	upx
behavioral2/files/0x000700000002341a-198.dat	upx
behavioral2/files/0x0007000000023411-136.dat	upx
behavioral2/files/0x0007000000023419-133.dat	upx
behavioral2/files/0x0007000000023418-131.dat	upx
behavioral2/files/0x0007000000023417-130.dat	upx
behavioral2/files/0x0007000000023408-175.dat	upx
behavioral2/files/0x0007000000023416-128.dat	upx
behavioral2/memory/1488-162-0x00007FF6EA150000-0x00007FF6EA542000-memory.dmp	upx
behavioral2/files/0x0007000000023420-146.dat	upx
behavioral2/files/0x0007000000023406-117.dat	upx
behavioral2/files/0x0007000000023412-112.dat	upx
behavioral2/files/0x000700000002340a-102.dat	upx
behavioral2/files/0x0007000000023404-97.dat	upx
behavioral2/files/0x000700000002340b-134.dat	upx
behavioral2/files/0x000700000002340f-90.dat	upx
behavioral2/files/0x0007000000023414-127.dat	upx
behavioral2/files/0x0007000000023403-108.dat	upx
behavioral2/files/0x00070000000233ff-70.dat	upx
behavioral2/files/0x0007000000023407-58.dat	upx
behavioral2/files/0x0007000000023401-56.dat	upx
behavioral2/files/0x000700000002340d-76.dat	upx
behavioral2/files/0x00080000000233fe-35.dat	upx
behavioral2/memory/1056-17-0x00007FF711F60000-0x00007FF712352000-memory.dmp	upx
behavioral2/memory/1056-2681-0x00007FF711F60000-0x00007FF712352000-memory.dmp	upx
behavioral2/memory/4232-2683-0x00007FF633010000-0x00007FF633402000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mxQdCUR.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\MqHxStq.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\VyPuWGk.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\YlqpvGE.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\RZZAOpF.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\dAxDDtu.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\pqRiGwB.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\mXocKtr.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\pCvtMwS.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\LFMQXir.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\aUcdQqO.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\FaRGejZ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\GFjqcHW.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\gCmLJNs.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\ROLZqoW.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\BdreJPP.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\VbOPfOR.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\zniCVSy.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\HorVIrx.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\qLLIbDV.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\KMgYCYI.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\qcGSYBv.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\xWGUcFq.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\NOblnKg.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\BKAwXar.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\dJQQpUF.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\cAsuNOJ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\KAQtVch.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\hshMtlW.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\eprVUxs.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\iOTIWmb.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\yMQnigS.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\OdJKotJ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\XofjBcF.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\xfNmROY.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\PySCYLd.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\LeaizgJ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\RWXVfHA.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\TYRCRyl.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\bbAOwIv.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\FIUkFiQ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\jLXQFve.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\MWBBVMN.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\VuuQARf.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\NcxGkfJ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\hYXmban.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\rEqFqTm.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\pthjJXq.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\aOgeokp.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\guIzzzr.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\mhhGtrb.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\BgNnLcx.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\ZWfYffr.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\jSkkbBO.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\CkCloyj.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\kSPgeTX.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\QFYXflp.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\zfYCFfF.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\DQenlEG.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\cSghJed.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\StoLQnA.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\JwqeGEV.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\tzDuKsD.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\Lonlwbd.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4820	powershell.exe
4820	powershell.exe
4820	powershell.exe
4820	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4820	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4820	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	83
PID 3368 wrote to memory of 4820	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	83
PID 3368 wrote to memory of 1056	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	84
PID 3368 wrote to memory of 1056	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	84
PID 3368 wrote to memory of 4232	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	85
PID 3368 wrote to memory of 4232	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	85
PID 3368 wrote to memory of 5004	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	86
PID 3368 wrote to memory of 5004	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	86
PID 3368 wrote to memory of 1488	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	87
PID 3368 wrote to memory of 1488	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	87
PID 3368 wrote to memory of 4304	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	88
PID 3368 wrote to memory of 4304	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	88
PID 3368 wrote to memory of 632	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	89
PID 3368 wrote to memory of 632	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	89
PID 3368 wrote to memory of 4336	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	90
PID 3368 wrote to memory of 4336	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	90
PID 3368 wrote to memory of 1224	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	91
PID 3368 wrote to memory of 1224	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	91
PID 3368 wrote to memory of 1356	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	92
PID 3368 wrote to memory of 1356	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	92
PID 3368 wrote to memory of 3580	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	93
PID 3368 wrote to memory of 3580	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	93
PID 3368 wrote to memory of 4364	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	94
PID 3368 wrote to memory of 4364	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	94
PID 3368 wrote to memory of 1300	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	95
PID 3368 wrote to memory of 1300	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	95
PID 3368 wrote to memory of 1756	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	96
PID 3368 wrote to memory of 1756	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	96
PID 3368 wrote to memory of 3880	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	97
PID 3368 wrote to memory of 3880	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	97
PID 3368 wrote to memory of 3628	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	98
PID 3368 wrote to memory of 3628	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	98
PID 3368 wrote to memory of 4100	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	99
PID 3368 wrote to memory of 4100	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	99
PID 3368 wrote to memory of 2948	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	100
PID 3368 wrote to memory of 2948	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	100
PID 3368 wrote to memory of 5100	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	101
PID 3368 wrote to memory of 5100	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	101
PID 3368 wrote to memory of 5080	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	102
PID 3368 wrote to memory of 5080	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	102
PID 3368 wrote to memory of 1108	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	103
PID 3368 wrote to memory of 1108	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	103
PID 3368 wrote to memory of 2140	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	104
PID 3368 wrote to memory of 2140	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	104
PID 3368 wrote to memory of 1576	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	105
PID 3368 wrote to memory of 1576	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	105
PID 3368 wrote to memory of 2916	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	106
PID 3368 wrote to memory of 2916	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	106
PID 3368 wrote to memory of 4532	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	107
PID 3368 wrote to memory of 4532	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	107
PID 3368 wrote to memory of 1932	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	108
PID 3368 wrote to memory of 1932	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	108
PID 3368 wrote to memory of 2416	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	109
PID 3368 wrote to memory of 2416	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	109
PID 3368 wrote to memory of 4636	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	110
PID 3368 wrote to memory of 4636	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	110
PID 3368 wrote to memory of 4924	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	111
PID 3368 wrote to memory of 4924	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	111
PID 3368 wrote to memory of 2556	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	112
PID 3368 wrote to memory of 2556	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	112
PID 3368 wrote to memory of 1404	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	113
PID 3368 wrote to memory of 1404	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	113
PID 3368 wrote to memory of 3348	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	114
PID 3368 wrote to memory of 3348	3368	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4820
- C:\Windows\System\aifnmoc.exe
  C:\Windows\System\aifnmoc.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\oIWfPwF.exe
  C:\Windows\System\oIWfPwF.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\hsVRxue.exe
  C:\Windows\System\hsVRxue.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\udhXvmG.exe
  C:\Windows\System\udhXvmG.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\HIKcAra.exe
  C:\Windows\System\HIKcAra.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\iRJXyQp.exe
  C:\Windows\System\iRJXyQp.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\SXlxjWq.exe
  C:\Windows\System\SXlxjWq.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\bnHfgaI.exe
  C:\Windows\System\bnHfgaI.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\qLLIbDV.exe
  C:\Windows\System\qLLIbDV.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\ZvFNSKe.exe
  C:\Windows\System\ZvFNSKe.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\lQDbAWs.exe
  C:\Windows\System\lQDbAWs.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\JwqeGEV.exe
  C:\Windows\System\JwqeGEV.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\JdqcShB.exe
  C:\Windows\System\JdqcShB.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\KMgYCYI.exe
  C:\Windows\System\KMgYCYI.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\KxVdFTh.exe
  C:\Windows\System\KxVdFTh.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\vpddVFW.exe
  C:\Windows\System\vpddVFW.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\KlshPMR.exe
  C:\Windows\System\KlshPMR.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\gnTOHRm.exe
  C:\Windows\System\gnTOHRm.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\DsprFgB.exe
  C:\Windows\System\DsprFgB.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\PaHTPJa.exe
  C:\Windows\System\PaHTPJa.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\SyVKcwl.exe
  C:\Windows\System\SyVKcwl.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\LQvRJTH.exe
  C:\Windows\System\LQvRJTH.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\nOEoLOI.exe
  C:\Windows\System\nOEoLOI.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\ywXCLRB.exe
  C:\Windows\System\ywXCLRB.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\QBLQjqk.exe
  C:\Windows\System\QBLQjqk.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\DFcGcjO.exe
  C:\Windows\System\DFcGcjO.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\xwNSbgd.exe
  C:\Windows\System\xwNSbgd.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\JohsZQr.exe
  C:\Windows\System\JohsZQr.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\DxNZlES.exe
  C:\Windows\System\DxNZlES.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\cVhUzAt.exe
  C:\Windows\System\cVhUzAt.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\DzvUzyK.exe
  C:\Windows\System\DzvUzyK.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\sigcSvF.exe
  C:\Windows\System\sigcSvF.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\uSWrkQR.exe
  C:\Windows\System\uSWrkQR.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\bmLTVGG.exe
  C:\Windows\System\bmLTVGG.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\UnHYzmK.exe
  C:\Windows\System\UnHYzmK.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\yBKWfzb.exe
  C:\Windows\System\yBKWfzb.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\zwQwZRs.exe
  C:\Windows\System\zwQwZRs.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\LJtPSYj.exe
  C:\Windows\System\LJtPSYj.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\COElmpN.exe
  C:\Windows\System\COElmpN.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\WJojRon.exe
  C:\Windows\System\WJojRon.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\XSDqgCG.exe
  C:\Windows\System\XSDqgCG.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\PshIwtQ.exe
  C:\Windows\System\PshIwtQ.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\SBFbhuq.exe
  C:\Windows\System\SBFbhuq.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\Yibpksi.exe
  C:\Windows\System\Yibpksi.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\OHTdYBK.exe
  C:\Windows\System\OHTdYBK.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\PcnPhId.exe
  C:\Windows\System\PcnPhId.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\QldUIcl.exe
  C:\Windows\System\QldUIcl.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\tzDuKsD.exe
  C:\Windows\System\tzDuKsD.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\aIXUhbp.exe
  C:\Windows\System\aIXUhbp.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\cjKXXid.exe
  C:\Windows\System\cjKXXid.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\bXvwKgY.exe
  C:\Windows\System\bXvwKgY.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\XGYdReK.exe
  C:\Windows\System\XGYdReK.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\uuyJqrA.exe
  C:\Windows\System\uuyJqrA.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\sLKUxKP.exe
  C:\Windows\System\sLKUxKP.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\HrbBfPq.exe
  C:\Windows\System\HrbBfPq.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\xBvGiOy.exe
  C:\Windows\System\xBvGiOy.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\GwwNvsq.exe
  C:\Windows\System\GwwNvsq.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\pWZWqes.exe
  C:\Windows\System\pWZWqes.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\NdUDMgX.exe
  C:\Windows\System\NdUDMgX.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\GxzeGHZ.exe
  C:\Windows\System\GxzeGHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\UXsjInJ.exe
  C:\Windows\System\UXsjInJ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\hCbYKaZ.exe
  C:\Windows\System\hCbYKaZ.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\VyPuWGk.exe
  C:\Windows\System\VyPuWGk.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\yZwoAQL.exe
  C:\Windows\System\yZwoAQL.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\utNtrfV.exe
  C:\Windows\System\utNtrfV.exe
  2⤵
  PID:4644
- C:\Windows\System\hbxiIDD.exe
  C:\Windows\System\hbxiIDD.exe
  2⤵
  PID:2268
- C:\Windows\System\EBjaGlf.exe
  C:\Windows\System\EBjaGlf.exe
  2⤵
  PID:4132
- C:\Windows\System\NDKnhju.exe
  C:\Windows\System\NDKnhju.exe
  2⤵
  PID:4928
- C:\Windows\System\IZXnlOd.exe
  C:\Windows\System\IZXnlOd.exe
  2⤵
  PID:1076
- C:\Windows\System\wbQdMEv.exe
  C:\Windows\System\wbQdMEv.exe
  2⤵
  PID:4996
- C:\Windows\System\kwWZhch.exe
  C:\Windows\System\kwWZhch.exe
  2⤵
  PID:4832
- C:\Windows\System\YVGgdbr.exe
  C:\Windows\System\YVGgdbr.exe
  2⤵
  PID:2928
- C:\Windows\System\YtivzNB.exe
  C:\Windows\System\YtivzNB.exe
  2⤵
  PID:3204
- C:\Windows\System\ZVILIlD.exe
  C:\Windows\System\ZVILIlD.exe
  2⤵
  PID:4088
- C:\Windows\System\jhTcRVX.exe
  C:\Windows\System\jhTcRVX.exe
  2⤵
  PID:4628
- C:\Windows\System\ZzmMjic.exe
  C:\Windows\System\ZzmMjic.exe
  2⤵
  PID:4728
- C:\Windows\System\UtRqhww.exe
  C:\Windows\System\UtRqhww.exe
  2⤵
  PID:1372
- C:\Windows\System\RLNlCJw.exe
  C:\Windows\System\RLNlCJw.exe
  2⤵
  PID:2492
- C:\Windows\System\vLMfDCZ.exe
  C:\Windows\System\vLMfDCZ.exe
  2⤵
  PID:4176
- C:\Windows\System\hxkIQBa.exe
  C:\Windows\System\hxkIQBa.exe
  2⤵
  PID:3688
- C:\Windows\System\KgbDffJ.exe
  C:\Windows\System\KgbDffJ.exe
  2⤵
  PID:3600
- C:\Windows\System\bOhRZFC.exe
  C:\Windows\System\bOhRZFC.exe
  2⤵
  PID:4484
- C:\Windows\System\fnsCSGe.exe
  C:\Windows\System\fnsCSGe.exe
  2⤵
  PID:4536
- C:\Windows\System\juOgjBr.exe
  C:\Windows\System\juOgjBr.exe
  2⤵
  PID:1336
- C:\Windows\System\daZLdjI.exe
  C:\Windows\System\daZLdjI.exe
  2⤵
  PID:4540
- C:\Windows\System\KKGmmyA.exe
  C:\Windows\System\KKGmmyA.exe
  2⤵
  PID:3680
- C:\Windows\System\yQqUBlD.exe
  C:\Windows\System\yQqUBlD.exe
  2⤵
  PID:448
- C:\Windows\System\COFWlvi.exe
  C:\Windows\System\COFWlvi.exe
  2⤵
  PID:5124
- C:\Windows\System\HYzvrhs.exe
  C:\Windows\System\HYzvrhs.exe
  2⤵
  PID:5140
- C:\Windows\System\LQiMvcp.exe
  C:\Windows\System\LQiMvcp.exe
  2⤵
  PID:5164
- C:\Windows\System\bHSwCZS.exe
  C:\Windows\System\bHSwCZS.exe
  2⤵
  PID:5196
- C:\Windows\System\CbeeOnu.exe
  C:\Windows\System\CbeeOnu.exe
  2⤵
  PID:5216
- C:\Windows\System\AKCSukm.exe
  C:\Windows\System\AKCSukm.exe
  2⤵
  PID:5240
- C:\Windows\System\JZYZaCl.exe
  C:\Windows\System\JZYZaCl.exe
  2⤵
  PID:5268
- C:\Windows\System\NNelUqd.exe
  C:\Windows\System\NNelUqd.exe
  2⤵
  PID:5284
- C:\Windows\System\kuNZdrg.exe
  C:\Windows\System\kuNZdrg.exe
  2⤵
  PID:5300
- C:\Windows\System\IvoyUdq.exe
  C:\Windows\System\IvoyUdq.exe
  2⤵
  PID:5316
- C:\Windows\System\LDWseBx.exe
  C:\Windows\System\LDWseBx.exe
  2⤵
  PID:5332
- C:\Windows\System\yrlLlAM.exe
  C:\Windows\System\yrlLlAM.exe
  2⤵
  PID:5348
- C:\Windows\System\mhhGtrb.exe
  C:\Windows\System\mhhGtrb.exe
  2⤵
  PID:5364
- C:\Windows\System\KBvegqN.exe
  C:\Windows\System\KBvegqN.exe
  2⤵
  PID:5380
- C:\Windows\System\AAepMyk.exe
  C:\Windows\System\AAepMyk.exe
  2⤵
  PID:5464
- C:\Windows\System\MbmqYwx.exe
  C:\Windows\System\MbmqYwx.exe
  2⤵
  PID:5480
- C:\Windows\System\OFHVbdP.exe
  C:\Windows\System\OFHVbdP.exe
  2⤵
  PID:5500
- C:\Windows\System\EQabpEv.exe
  C:\Windows\System\EQabpEv.exe
  2⤵
  PID:5520
- C:\Windows\System\QGhtQVL.exe
  C:\Windows\System\QGhtQVL.exe
  2⤵
  PID:5540
- C:\Windows\System\UILjEPv.exe
  C:\Windows\System\UILjEPv.exe
  2⤵
  PID:5568
- C:\Windows\System\slnpjiL.exe
  C:\Windows\System\slnpjiL.exe
  2⤵
  PID:5588
- C:\Windows\System\sqWMnkS.exe
  C:\Windows\System\sqWMnkS.exe
  2⤵
  PID:5608
- C:\Windows\System\XzhKymC.exe
  C:\Windows\System\XzhKymC.exe
  2⤵
  PID:5628
- C:\Windows\System\npXPypx.exe
  C:\Windows\System\npXPypx.exe
  2⤵
  PID:5648
- C:\Windows\System\bjUMzGB.exe
  C:\Windows\System\bjUMzGB.exe
  2⤵
  PID:5672
- C:\Windows\System\AlEKopM.exe
  C:\Windows\System\AlEKopM.exe
  2⤵
  PID:5688
- C:\Windows\System\mZcjZSp.exe
  C:\Windows\System\mZcjZSp.exe
  2⤵
  PID:5712
- C:\Windows\System\idNNjtN.exe
  C:\Windows\System\idNNjtN.exe
  2⤵
  PID:5732
- C:\Windows\System\xgJrkYX.exe
  C:\Windows\System\xgJrkYX.exe
  2⤵
  PID:5752
- C:\Windows\System\CfyFFcx.exe
  C:\Windows\System\CfyFFcx.exe
  2⤵
  PID:5776
- C:\Windows\System\NiPpZwg.exe
  C:\Windows\System\NiPpZwg.exe
  2⤵
  PID:5792
- C:\Windows\System\SBufNAW.exe
  C:\Windows\System\SBufNAW.exe
  2⤵
  PID:5816
- C:\Windows\System\EqBYEsT.exe
  C:\Windows\System\EqBYEsT.exe
  2⤵
  PID:5832
- C:\Windows\System\JWUSIQb.exe
  C:\Windows\System\JWUSIQb.exe
  2⤵
  PID:5856
- C:\Windows\System\xeRMPAN.exe
  C:\Windows\System\xeRMPAN.exe
  2⤵
  PID:5880
- C:\Windows\System\PlGQlLX.exe
  C:\Windows\System\PlGQlLX.exe
  2⤵
  PID:5900
- C:\Windows\System\mRJycjl.exe
  C:\Windows\System\mRJycjl.exe
  2⤵
  PID:5924
- C:\Windows\System\djpVljy.exe
  C:\Windows\System\djpVljy.exe
  2⤵
  PID:5968
- C:\Windows\System\uyvYfZm.exe
  C:\Windows\System\uyvYfZm.exe
  2⤵
  PID:6112
- C:\Windows\System\seEfXcj.exe
  C:\Windows\System\seEfXcj.exe
  2⤵
  PID:6132
- C:\Windows\System\ONfBFdt.exe
  C:\Windows\System\ONfBFdt.exe
  2⤵
  PID:4480
- C:\Windows\System\ecRIDvZ.exe
  C:\Windows\System\ecRIDvZ.exe
  2⤵
  PID:1900
- C:\Windows\System\YvgVRuS.exe
  C:\Windows\System\YvgVRuS.exe
  2⤵
  PID:4348
- C:\Windows\System\RIQOQzR.exe
  C:\Windows\System\RIQOQzR.exe
  2⤵
  PID:3104
- C:\Windows\System\nBzcWCW.exe
  C:\Windows\System\nBzcWCW.exe
  2⤵
  PID:1968
- C:\Windows\System\IogQWBs.exe
  C:\Windows\System\IogQWBs.exe
  2⤵
  PID:1400
- C:\Windows\System\DswjtUE.exe
  C:\Windows\System\DswjtUE.exe
  2⤵
  PID:4452
- C:\Windows\System\WJUFsbn.exe
  C:\Windows\System\WJUFsbn.exe
  2⤵
  PID:2120
- C:\Windows\System\scsrXYM.exe
  C:\Windows\System\scsrXYM.exe
  2⤵
  PID:2024
- C:\Windows\System\hKqOaks.exe
  C:\Windows\System\hKqOaks.exe
  2⤵
  PID:5252
- C:\Windows\System\XclkpHx.exe
  C:\Windows\System\XclkpHx.exe
  2⤵
  PID:2940
- C:\Windows\System\vsjQOIT.exe
  C:\Windows\System\vsjQOIT.exe
  2⤵
  PID:2700
- C:\Windows\System\ZlTHvxm.exe
  C:\Windows\System\ZlTHvxm.exe
  2⤵
  PID:3828
- C:\Windows\System\ZrLqdTs.exe
  C:\Windows\System\ZrLqdTs.exe
  2⤵
  PID:2768
- C:\Windows\System\lqcrEIv.exe
  C:\Windows\System\lqcrEIv.exe
  2⤵
  PID:4068
- C:\Windows\System\VIjiAmI.exe
  C:\Windows\System\VIjiAmI.exe
  2⤵
  PID:5828
- C:\Windows\System\FuDZnUi.exe
  C:\Windows\System\FuDZnUi.exe
  2⤵
  PID:5256
- C:\Windows\System\GXHpZIc.exe
  C:\Windows\System\GXHpZIc.exe
  2⤵
  PID:5956
- C:\Windows\System\NvybHwu.exe
  C:\Windows\System\NvybHwu.exe
  2⤵
  PID:6160
- C:\Windows\System\dUKcqXP.exe
  C:\Windows\System\dUKcqXP.exe
  2⤵
  PID:6180
- C:\Windows\System\UCCGoSr.exe
  C:\Windows\System\UCCGoSr.exe
  2⤵
  PID:6196
- C:\Windows\System\ysrzCiL.exe
  C:\Windows\System\ysrzCiL.exe
  2⤵
  PID:6212
- C:\Windows\System\NXakcYU.exe
  C:\Windows\System\NXakcYU.exe
  2⤵
  PID:6232
- C:\Windows\System\puGJguk.exe
  C:\Windows\System\puGJguk.exe
  2⤵
  PID:6260
- C:\Windows\System\EquJQdc.exe
  C:\Windows\System\EquJQdc.exe
  2⤵
  PID:6284
- C:\Windows\System\tjUSlBn.exe
  C:\Windows\System\tjUSlBn.exe
  2⤵
  PID:6300
- C:\Windows\System\MRoaysZ.exe
  C:\Windows\System\MRoaysZ.exe
  2⤵
  PID:6316
- C:\Windows\System\uvdouGM.exe
  C:\Windows\System\uvdouGM.exe
  2⤵
  PID:6332
- C:\Windows\System\LKoxlTg.exe
  C:\Windows\System\LKoxlTg.exe
  2⤵
  PID:6376
- C:\Windows\System\QdDyDEk.exe
  C:\Windows\System\QdDyDEk.exe
  2⤵
  PID:6396
- C:\Windows\System\ZtMbIas.exe
  C:\Windows\System\ZtMbIas.exe
  2⤵
  PID:6412
- C:\Windows\System\bKarrGi.exe
  C:\Windows\System\bKarrGi.exe
  2⤵
  PID:6436
- C:\Windows\System\JXWRtfV.exe
  C:\Windows\System\JXWRtfV.exe
  2⤵
  PID:6452
- C:\Windows\System\SUGBTQl.exe
  C:\Windows\System\SUGBTQl.exe
  2⤵
  PID:6476
- C:\Windows\System\CysIjLs.exe
  C:\Windows\System\CysIjLs.exe
  2⤵
  PID:6616
- C:\Windows\System\uYpreuH.exe
  C:\Windows\System\uYpreuH.exe
  2⤵
  PID:6632
- C:\Windows\System\DRhwVJS.exe
  C:\Windows\System\DRhwVJS.exe
  2⤵
  PID:6648
- C:\Windows\System\fBVHjDe.exe
  C:\Windows\System\fBVHjDe.exe
  2⤵
  PID:6664
- C:\Windows\System\ZLgAfiF.exe
  C:\Windows\System\ZLgAfiF.exe
  2⤵
  PID:6684
- C:\Windows\System\KAQtVch.exe
  C:\Windows\System\KAQtVch.exe
  2⤵
  PID:6700
- C:\Windows\System\xfNmROY.exe
  C:\Windows\System\xfNmROY.exe
  2⤵
  PID:6716
- C:\Windows\System\aJmdJkw.exe
  C:\Windows\System\aJmdJkw.exe
  2⤵
  PID:6732
- C:\Windows\System\fnYdbtT.exe
  C:\Windows\System\fnYdbtT.exe
  2⤵
  PID:6752
- C:\Windows\System\dDoWroa.exe
  C:\Windows\System\dDoWroa.exe
  2⤵
  PID:6772
- C:\Windows\System\sfZGfai.exe
  C:\Windows\System\sfZGfai.exe
  2⤵
  PID:6800
- C:\Windows\System\UzDiXir.exe
  C:\Windows\System\UzDiXir.exe
  2⤵
  PID:6816
- C:\Windows\System\ieMeBOv.exe
  C:\Windows\System\ieMeBOv.exe
  2⤵
  PID:6836
- C:\Windows\System\bkBKhdr.exe
  C:\Windows\System\bkBKhdr.exe
  2⤵
  PID:6852
- C:\Windows\System\tOIhsgI.exe
  C:\Windows\System\tOIhsgI.exe
  2⤵
  PID:6872
- C:\Windows\System\qurcBAX.exe
  C:\Windows\System\qurcBAX.exe
  2⤵
  PID:6892
- C:\Windows\System\LJNbLBW.exe
  C:\Windows\System\LJNbLBW.exe
  2⤵
  PID:6912
- C:\Windows\System\zlmDXCv.exe
  C:\Windows\System\zlmDXCv.exe
  2⤵
  PID:6928
- C:\Windows\System\sWIpgMH.exe
  C:\Windows\System\sWIpgMH.exe
  2⤵
  PID:6944
- C:\Windows\System\VuuQARf.exe
  C:\Windows\System\VuuQARf.exe
  2⤵
  PID:6964
- C:\Windows\System\ONazbET.exe
  C:\Windows\System\ONazbET.exe
  2⤵
  PID:6984
- C:\Windows\System\ZDaSxhJ.exe
  C:\Windows\System\ZDaSxhJ.exe
  2⤵
  PID:7000
- C:\Windows\System\xMhMXCF.exe
  C:\Windows\System\xMhMXCF.exe
  2⤵
  PID:7020
- C:\Windows\System\oVeAHxo.exe
  C:\Windows\System\oVeAHxo.exe
  2⤵
  PID:7044
- C:\Windows\System\gToxYys.exe
  C:\Windows\System\gToxYys.exe
  2⤵
  PID:7060
- C:\Windows\System\YCnQnRr.exe
  C:\Windows\System\YCnQnRr.exe
  2⤵
  PID:7084
- C:\Windows\System\bMUDgIV.exe
  C:\Windows\System\bMUDgIV.exe
  2⤵
  PID:7108
- C:\Windows\System\MsNnang.exe
  C:\Windows\System\MsNnang.exe
  2⤵
  PID:7128
- C:\Windows\System\fuHcOKH.exe
  C:\Windows\System\fuHcOKH.exe
  2⤵
  PID:7148
- C:\Windows\System\QdjxhUs.exe
  C:\Windows\System\QdjxhUs.exe
  2⤵
  PID:3924
- C:\Windows\System\pzBwTzM.exe
  C:\Windows\System\pzBwTzM.exe
  2⤵
  PID:3904
- C:\Windows\System\yPKQkRg.exe
  C:\Windows\System\yPKQkRg.exe
  2⤵
  PID:4396
- C:\Windows\System\VpJhmIb.exe
  C:\Windows\System\VpJhmIb.exe
  2⤵
  PID:1852
- C:\Windows\System\hscgZdc.exe
  C:\Windows\System\hscgZdc.exe
  2⤵
  PID:5160
- C:\Windows\System\STStVDc.exe
  C:\Windows\System\STStVDc.exe
  2⤵
  PID:5192
- C:\Windows\System\qMIHPgM.exe
  C:\Windows\System\qMIHPgM.exe
  2⤵
  PID:5236
- C:\Windows\System\OhcmnTo.exe
  C:\Windows\System\OhcmnTo.exe
  2⤵
  PID:2824
- C:\Windows\System\UhLCSUI.exe
  C:\Windows\System\UhLCSUI.exe
  2⤵
  PID:5988
- C:\Windows\System\pkVJcdq.exe
  C:\Windows\System\pkVJcdq.exe
  2⤵
  PID:5296
- C:\Windows\System\bobCWoy.exe
  C:\Windows\System\bobCWoy.exe
  2⤵
  PID:6356
- C:\Windows\System\ntaPegr.exe
  C:\Windows\System\ntaPegr.exe
  2⤵
  PID:6000
- C:\Windows\System\FJCWHno.exe
  C:\Windows\System\FJCWHno.exe
  2⤵
  PID:4524
- C:\Windows\System\pfducqr.exe
  C:\Windows\System\pfducqr.exe
  2⤵
  PID:4724
- C:\Windows\System\FLxphOF.exe
  C:\Windows\System\FLxphOF.exe
  2⤵
  PID:4704
- C:\Windows\System\sdwBpoe.exe
  C:\Windows\System\sdwBpoe.exe
  2⤵
  PID:1424
- C:\Windows\System\TltRXky.exe
  C:\Windows\System\TltRXky.exe
  2⤵
  PID:2548
- C:\Windows\System\jaRFCIg.exe
  C:\Windows\System\jaRFCIg.exe
  2⤵
  PID:6048
- C:\Windows\System\itoUZqR.exe
  C:\Windows\System\itoUZqR.exe
  2⤵
  PID:5960
- C:\Windows\System\wxjbRAM.exe
  C:\Windows\System\wxjbRAM.exe
  2⤵
  PID:5788
- C:\Windows\System\tHTTPLa.exe
  C:\Windows\System\tHTTPLa.exe
  2⤵
  PID:5760
- C:\Windows\System\pCvtMwS.exe
  C:\Windows\System\pCvtMwS.exe
  2⤵
  PID:5704
- C:\Windows\System\WAURzNI.exe
  C:\Windows\System\WAURzNI.exe
  2⤵
  PID:5660
- C:\Windows\System\wsrWxCX.exe
  C:\Windows\System\wsrWxCX.exe
  2⤵
  PID:5636
- C:\Windows\System\ULOGtVt.exe
  C:\Windows\System\ULOGtVt.exe
  2⤵
  PID:5580
- C:\Windows\System\ULuriLj.exe
  C:\Windows\System\ULuriLj.exe
  2⤵
  PID:5532
- C:\Windows\System\EJCixgx.exe
  C:\Windows\System\EJCixgx.exe
  2⤵
  PID:5496
- C:\Windows\System\ggMixDC.exe
  C:\Windows\System\ggMixDC.exe
  2⤵
  PID:5448
- C:\Windows\System\IhsHhmY.exe
  C:\Windows\System\IhsHhmY.exe
  2⤵
  PID:5372
- C:\Windows\System\UFQpKJh.exe
  C:\Windows\System\UFQpKJh.exe
  2⤵
  PID:5328
- C:\Windows\System\PFXYgLe.exe
  C:\Windows\System\PFXYgLe.exe
  2⤵
  PID:5996
- C:\Windows\System\aIRCcMC.exe
  C:\Windows\System\aIRCcMC.exe
  2⤵
  PID:7348
- C:\Windows\System\ELDFkRH.exe
  C:\Windows\System\ELDFkRH.exe
  2⤵
  PID:7372
- C:\Windows\System\ZhpIkOj.exe
  C:\Windows\System\ZhpIkOj.exe
  2⤵
  PID:7412
- C:\Windows\System\YgBBfls.exe
  C:\Windows\System\YgBBfls.exe
  2⤵
  PID:7436
- C:\Windows\System\yHxuAxB.exe
  C:\Windows\System\yHxuAxB.exe
  2⤵
  PID:7452
- C:\Windows\System\lLZzAAG.exe
  C:\Windows\System\lLZzAAG.exe
  2⤵
  PID:7468
- C:\Windows\System\AMCBnMo.exe
  C:\Windows\System\AMCBnMo.exe
  2⤵
  PID:7492
- C:\Windows\System\ueiuvcZ.exe
  C:\Windows\System\ueiuvcZ.exe
  2⤵
  PID:7520
- C:\Windows\System\qqkLozN.exe
  C:\Windows\System\qqkLozN.exe
  2⤵
  PID:7540
- C:\Windows\System\gEkAQSX.exe
  C:\Windows\System\gEkAQSX.exe
  2⤵
  PID:7560
- C:\Windows\System\hPhlCWG.exe
  C:\Windows\System\hPhlCWG.exe
  2⤵
  PID:7580
- C:\Windows\System\MKbnvlw.exe
  C:\Windows\System\MKbnvlw.exe
  2⤵
  PID:7596
- C:\Windows\System\FUXUacN.exe
  C:\Windows\System\FUXUacN.exe
  2⤵
  PID:7620
- C:\Windows\System\wRQMLwO.exe
  C:\Windows\System\wRQMLwO.exe
  2⤵
  PID:7636
- C:\Windows\System\YQXIeAJ.exe
  C:\Windows\System\YQXIeAJ.exe
  2⤵
  PID:7652
- C:\Windows\System\PqoqLVh.exe
  C:\Windows\System\PqoqLVh.exe
  2⤵
  PID:7724
- C:\Windows\System\KYwrSzv.exe
  C:\Windows\System\KYwrSzv.exe
  2⤵
  PID:7740
- C:\Windows\System\LDVVXxx.exe
  C:\Windows\System\LDVVXxx.exe
  2⤵
  PID:7756
- C:\Windows\System\wGshuJg.exe
  C:\Windows\System\wGshuJg.exe
  2⤵
  PID:7772
- C:\Windows\System\YyPHYpM.exe
  C:\Windows\System\YyPHYpM.exe
  2⤵
  PID:7788
- C:\Windows\System\muBsxgk.exe
  C:\Windows\System\muBsxgk.exe
  2⤵
  PID:7804
- C:\Windows\System\mqXUsLu.exe
  C:\Windows\System\mqXUsLu.exe
  2⤵
  PID:7820
- C:\Windows\System\GDPgHSm.exe
  C:\Windows\System\GDPgHSm.exe
  2⤵
  PID:7836
- C:\Windows\System\qLlSopq.exe
  C:\Windows\System\qLlSopq.exe
  2⤵
  PID:7852
- C:\Windows\System\ngFVDii.exe
  C:\Windows\System\ngFVDii.exe
  2⤵
  PID:7868
- C:\Windows\System\UMnVQlA.exe
  C:\Windows\System\UMnVQlA.exe
  2⤵
  PID:7884
- C:\Windows\System\oUJnWnd.exe
  C:\Windows\System\oUJnWnd.exe
  2⤵
  PID:7900
- C:\Windows\System\bbAOwIv.exe
  C:\Windows\System\bbAOwIv.exe
  2⤵
  PID:7916
- C:\Windows\System\ZGyYlPQ.exe
  C:\Windows\System\ZGyYlPQ.exe
  2⤵
  PID:7932
- C:\Windows\System\mlHWMvV.exe
  C:\Windows\System\mlHWMvV.exe
  2⤵
  PID:7948
- C:\Windows\System\sqghKLz.exe
  C:\Windows\System\sqghKLz.exe
  2⤵
  PID:7968
- C:\Windows\System\NbtenWD.exe
  C:\Windows\System\NbtenWD.exe
  2⤵
  PID:7996
- C:\Windows\System\HlsBnhn.exe
  C:\Windows\System\HlsBnhn.exe
  2⤵
  PID:8016
- C:\Windows\System\EQDMppo.exe
  C:\Windows\System\EQDMppo.exe
  2⤵
  PID:8048
- C:\Windows\System\ZGeOIcJ.exe
  C:\Windows\System\ZGeOIcJ.exe
  2⤵
  PID:8072
- C:\Windows\System\iVMgAAi.exe
  C:\Windows\System\iVMgAAi.exe
  2⤵
  PID:8092
- C:\Windows\System\YlqpvGE.exe
  C:\Windows\System\YlqpvGE.exe
  2⤵
  PID:8120
- C:\Windows\System\jurNHCh.exe
  C:\Windows\System\jurNHCh.exe
  2⤵
  PID:8136
- C:\Windows\System\dAOgjYi.exe
  C:\Windows\System\dAOgjYi.exe
  2⤵
  PID:8160
- C:\Windows\System\TWWGpma.exe
  C:\Windows\System\TWWGpma.exe
  2⤵
  PID:8188
- C:\Windows\System\JmSmDTI.exe
  C:\Windows\System\JmSmDTI.exe
  2⤵
  PID:5472
- C:\Windows\System\qRYgijo.exe
  C:\Windows\System\qRYgijo.exe
  2⤵
  PID:5400
- C:\Windows\System\ZvxJCRF.exe
  C:\Windows\System\ZvxJCRF.exe
  2⤵
  PID:5948
- C:\Windows\System\JJZflbA.exe
  C:\Windows\System\JJZflbA.exe
  2⤵
  PID:6324
- C:\Windows\System\NMuJfln.exe
  C:\Windows\System\NMuJfln.exe
  2⤵
  PID:6392
- C:\Windows\System\NPvLdhu.exe
  C:\Windows\System\NPvLdhu.exe
  2⤵
  PID:7384
- C:\Windows\System\pkIyIgH.exe
  C:\Windows\System\pkIyIgH.exe
  2⤵
  PID:8204
- C:\Windows\System\ToNimcE.exe
  C:\Windows\System\ToNimcE.exe
  2⤵
  PID:8232
- C:\Windows\System\kTBInyj.exe
  C:\Windows\System\kTBInyj.exe
  2⤵
  PID:8252
- C:\Windows\System\ByHRYQb.exe
  C:\Windows\System\ByHRYQb.exe
  2⤵
  PID:8272
- C:\Windows\System\DeqcaTi.exe
  C:\Windows\System\DeqcaTi.exe
  2⤵
  PID:8296
- C:\Windows\System\GrKjTSC.exe
  C:\Windows\System\GrKjTSC.exe
  2⤵
  PID:8316
- C:\Windows\System\iNGCXrn.exe
  C:\Windows\System\iNGCXrn.exe
  2⤵
  PID:8340
- C:\Windows\System\fPPSYkt.exe
  C:\Windows\System\fPPSYkt.exe
  2⤵
  PID:8364
- C:\Windows\System\RZZAOpF.exe
  C:\Windows\System\RZZAOpF.exe
  2⤵
  PID:8380
- C:\Windows\System\EFladHe.exe
  C:\Windows\System\EFladHe.exe
  2⤵
  PID:8408
- C:\Windows\System\LkNxgrh.exe
  C:\Windows\System\LkNxgrh.exe
  2⤵
  PID:8436
- C:\Windows\System\fcQzAVx.exe
  C:\Windows\System\fcQzAVx.exe
  2⤵
  PID:8460
- C:\Windows\System\qahHRwj.exe
  C:\Windows\System\qahHRwj.exe
  2⤵
  PID:8476
- C:\Windows\System\DKdzXba.exe
  C:\Windows\System\DKdzXba.exe
  2⤵
  PID:8496
- C:\Windows\System\mvQhNCI.exe
  C:\Windows\System\mvQhNCI.exe
  2⤵
  PID:8516
- C:\Windows\System\DFpxcyg.exe
  C:\Windows\System\DFpxcyg.exe
  2⤵
  PID:8532
- C:\Windows\System\RDohBFF.exe
  C:\Windows\System\RDohBFF.exe
  2⤵
  PID:8548
- C:\Windows\System\LXzdhuu.exe
  C:\Windows\System\LXzdhuu.exe
  2⤵
  PID:8572
- C:\Windows\System\fLXpyos.exe
  C:\Windows\System\fLXpyos.exe
  2⤵
  PID:8588
- C:\Windows\System\CseMARX.exe
  C:\Windows\System\CseMARX.exe
  2⤵
  PID:8604
- C:\Windows\System\OyklUNW.exe
  C:\Windows\System\OyklUNW.exe
  2⤵
  PID:8624
- C:\Windows\System\WUWeunq.exe
  C:\Windows\System\WUWeunq.exe
  2⤵
  PID:8652
- C:\Windows\System\ISNbRLf.exe
  C:\Windows\System\ISNbRLf.exe
  2⤵
  PID:8672
- C:\Windows\System\GUwlSFb.exe
  C:\Windows\System\GUwlSFb.exe
  2⤵
  PID:8696
- C:\Windows\System\AnRYjZN.exe
  C:\Windows\System\AnRYjZN.exe
  2⤵
  PID:8720
- C:\Windows\System\QFPjKYd.exe
  C:\Windows\System\QFPjKYd.exe
  2⤵
  PID:8736
- C:\Windows\System\DowzwGk.exe
  C:\Windows\System\DowzwGk.exe
  2⤵
  PID:8772
- C:\Windows\System\WsZcBCR.exe
  C:\Windows\System\WsZcBCR.exe
  2⤵
  PID:8804
- C:\Windows\System\AUpzkWJ.exe
  C:\Windows\System\AUpzkWJ.exe
  2⤵
  PID:8824
- C:\Windows\System\CzaemVz.exe
  C:\Windows\System\CzaemVz.exe
  2⤵
  PID:8848
- C:\Windows\System\ckciKDL.exe
  C:\Windows\System\ckciKDL.exe
  2⤵
  PID:8872
- C:\Windows\System\lMMUyYH.exe
  C:\Windows\System\lMMUyYH.exe
  2⤵
  PID:8896
- C:\Windows\System\oyPuezn.exe
  C:\Windows\System\oyPuezn.exe
  2⤵
  PID:8916
- C:\Windows\System\oOENoWD.exe
  C:\Windows\System\oOENoWD.exe
  2⤵
  PID:8940
- C:\Windows\System\qiVMKii.exe
  C:\Windows\System\qiVMKii.exe
  2⤵
  PID:8960
- C:\Windows\System\bqOlzAy.exe
  C:\Windows\System\bqOlzAy.exe
  2⤵
  PID:8984
- C:\Windows\System\VbOPfOR.exe
  C:\Windows\System\VbOPfOR.exe
  2⤵
  PID:9004
- C:\Windows\System\CyUrpIB.exe
  C:\Windows\System\CyUrpIB.exe
  2⤵
  PID:9024
- C:\Windows\System\KdMBPzD.exe
  C:\Windows\System\KdMBPzD.exe
  2⤵
  PID:9048
- C:\Windows\System\HdWwhTz.exe
  C:\Windows\System\HdWwhTz.exe
  2⤵
  PID:9072
- C:\Windows\System\lowYshA.exe
  C:\Windows\System\lowYshA.exe
  2⤵
  PID:9096
- C:\Windows\System\UdjOPBb.exe
  C:\Windows\System\UdjOPBb.exe
  2⤵
  PID:9116
- C:\Windows\System\oKCwRpQ.exe
  C:\Windows\System\oKCwRpQ.exe
  2⤵
  PID:9136
- C:\Windows\System\HkBJISV.exe
  C:\Windows\System\HkBJISV.exe
  2⤵
  PID:9160
- C:\Windows\System\hKfVkEd.exe
  C:\Windows\System\hKfVkEd.exe
  2⤵
  PID:9192
- C:\Windows\System\OUUdvBu.exe
  C:\Windows\System\OUUdvBu.exe
  2⤵
  PID:9208
- C:\Windows\System\sLfufMU.exe
  C:\Windows\System\sLfufMU.exe
  2⤵
  PID:5668
- C:\Windows\System\HZKPmph.exe
  C:\Windows\System\HZKPmph.exe
  2⤵
  PID:7648
- C:\Windows\System\BgNnLcx.exe
  C:\Windows\System\BgNnLcx.exe
  2⤵
  PID:6640
- C:\Windows\System\UQsVcRH.exe
  C:\Windows\System\UQsVcRH.exe
  2⤵
  PID:6676
- C:\Windows\System\gcriqtV.exe
  C:\Windows\System\gcriqtV.exe
  2⤵
  PID:6712
- C:\Windows\System\kTUzwwY.exe
  C:\Windows\System\kTUzwwY.exe
  2⤵
  PID:7880
- C:\Windows\System\EHyLWBy.exe
  C:\Windows\System\EHyLWBy.exe
  2⤵
  PID:6784
- C:\Windows\System\SWLlOZz.exe
  C:\Windows\System\SWLlOZz.exe
  2⤵
  PID:6828
- C:\Windows\System\WaCLskD.exe
  C:\Windows\System\WaCLskD.exe
  2⤵
  PID:6884
- C:\Windows\System\OViABHy.exe
  C:\Windows\System\OViABHy.exe
  2⤵
  PID:6924
- C:\Windows\System\PpDeKgX.exe
  C:\Windows\System\PpDeKgX.exe
  2⤵
  PID:6972
- C:\Windows\System\JKgfWUs.exe
  C:\Windows\System\JKgfWUs.exe
  2⤵
  PID:7012
- C:\Windows\System\wGhWaZy.exe
  C:\Windows\System\wGhWaZy.exe
  2⤵
  PID:7056
- C:\Windows\System\YlpmcTj.exe
  C:\Windows\System\YlpmcTj.exe
  2⤵
  PID:7116
- C:\Windows\System\ffVdEZM.exe
  C:\Windows\System\ffVdEZM.exe
  2⤵
  PID:7144
- C:\Windows\System\flwAWns.exe
  C:\Windows\System\flwAWns.exe
  2⤵
  PID:976
- C:\Windows\System\WIRqFmo.exe
  C:\Windows\System\WIRqFmo.exe
  2⤵
  PID:5136
- C:\Windows\System\rrIHOnS.exe
  C:\Windows\System\rrIHOnS.exe
  2⤵
  PID:5248
- C:\Windows\System\FFlvCAL.exe
  C:\Windows\System\FFlvCAL.exe
  2⤵
  PID:5984
- C:\Windows\System\fvRmSln.exe
  C:\Windows\System\fvRmSln.exe
  2⤵
  PID:6244
- C:\Windows\System\kRvskqY.exe
  C:\Windows\System\kRvskqY.exe
  2⤵
  PID:4472
- C:\Windows\System\TSSOLJo.exe
  C:\Windows\System\TSSOLJo.exe
  2⤵
  PID:1316
- C:\Windows\System\BRONWlK.exe
  C:\Windows\System\BRONWlK.exe
  2⤵
  PID:6076
- C:\Windows\System\XFmjTPW.exe
  C:\Windows\System\XFmjTPW.exe
  2⤵
  PID:4632
- C:\Windows\System\izNIZly.exe
  C:\Windows\System\izNIZly.exe
  2⤵
  PID:5740
- C:\Windows\System\XxWDQQK.exe
  C:\Windows\System\XxWDQQK.exe
  2⤵
  PID:8024
- C:\Windows\System\ewcAtfO.exe
  C:\Windows\System\ewcAtfO.exe
  2⤵
  PID:8108
- C:\Windows\System\ggwWWpt.exe
  C:\Windows\System\ggwWWpt.exe
  2⤵
  PID:8144
- C:\Windows\System\WQIIZJu.exe
  C:\Windows\System\WQIIZJu.exe
  2⤵
  PID:6268
- C:\Windows\System\DxyiqDg.exe
  C:\Windows\System\DxyiqDg.exe
  2⤵
  PID:6468
- C:\Windows\System\SGvWINw.exe
  C:\Windows\System\SGvWINw.exe
  2⤵
  PID:5596
- C:\Windows\System\uUNpchi.exe
  C:\Windows\System\uUNpchi.exe
  2⤵
  PID:7448
- C:\Windows\System\iNPKcFI.exe
  C:\Windows\System\iNPKcFI.exe
  2⤵
  PID:7460
- C:\Windows\System\ZaypIBC.exe
  C:\Windows\System\ZaypIBC.exe
  2⤵
  PID:5508
- C:\Windows\System\eJiFPvo.exe
  C:\Windows\System\eJiFPvo.exe
  2⤵
  PID:8248
- C:\Windows\System\NWBJKlr.exe
  C:\Windows\System\NWBJKlr.exe
  2⤵
  PID:8284
- C:\Windows\System\UuuJqZw.exe
  C:\Windows\System\UuuJqZw.exe
  2⤵
  PID:4200
- C:\Windows\System\kIKAdTj.exe
  C:\Windows\System\kIKAdTj.exe
  2⤵
  PID:9220
- C:\Windows\System\OPaBvDu.exe
  C:\Windows\System\OPaBvDu.exe
  2⤵
  PID:9456
- C:\Windows\System\dskPnjL.exe
  C:\Windows\System\dskPnjL.exe
  2⤵
  PID:9472
- C:\Windows\System\lOQSfFb.exe
  C:\Windows\System\lOQSfFb.exe
  2⤵
  PID:9488
- C:\Windows\System\UaGioaJ.exe
  C:\Windows\System\UaGioaJ.exe
  2⤵
  PID:9508
- C:\Windows\System\JaITWfW.exe
  C:\Windows\System\JaITWfW.exe
  2⤵
  PID:9524
- C:\Windows\System\LBOQaoO.exe
  C:\Windows\System\LBOQaoO.exe
  2⤵
  PID:9540
- C:\Windows\System\QqGPODW.exe
  C:\Windows\System\QqGPODW.exe
  2⤵
  PID:9556
- C:\Windows\System\EcPBEHi.exe
  C:\Windows\System\EcPBEHi.exe
  2⤵
  PID:9576
- C:\Windows\System\FfEjOma.exe
  C:\Windows\System\FfEjOma.exe
  2⤵
  PID:9592
- C:\Windows\System\IDGZktd.exe
  C:\Windows\System\IDGZktd.exe
  2⤵
  PID:9608
- C:\Windows\System\qZBpFyT.exe
  C:\Windows\System\qZBpFyT.exe
  2⤵
  PID:9624
- C:\Windows\System\ZcyTSsU.exe
  C:\Windows\System\ZcyTSsU.exe
  2⤵
  PID:9640
- C:\Windows\System\gqgxVIM.exe
  C:\Windows\System\gqgxVIM.exe
  2⤵
  PID:9660
- C:\Windows\System\DsPuYsr.exe
  C:\Windows\System\DsPuYsr.exe
  2⤵
  PID:9684
- C:\Windows\System\SIICkas.exe
  C:\Windows\System\SIICkas.exe
  2⤵
  PID:9708
- C:\Windows\System\TsgWNsK.exe
  C:\Windows\System\TsgWNsK.exe
  2⤵
  PID:9728
- C:\Windows\System\MzMvpis.exe
  C:\Windows\System\MzMvpis.exe
  2⤵
  PID:9752
- C:\Windows\System\wheDNoQ.exe
  C:\Windows\System\wheDNoQ.exe
  2⤵
  PID:9772
- C:\Windows\System\JtCQZtA.exe
  C:\Windows\System\JtCQZtA.exe
  2⤵
  PID:9796
- C:\Windows\System\KedTmGU.exe
  C:\Windows\System\KedTmGU.exe
  2⤵
  PID:9820
- C:\Windows\System\YJaMXSN.exe
  C:\Windows\System\YJaMXSN.exe
  2⤵
  PID:9844
- C:\Windows\System\dlYVTVc.exe
  C:\Windows\System\dlYVTVc.exe
  2⤵
  PID:9868
- C:\Windows\System\FIUkFiQ.exe
  C:\Windows\System\FIUkFiQ.exe
  2⤵
  PID:9884
- C:\Windows\System\iZQGvkW.exe
  C:\Windows\System\iZQGvkW.exe
  2⤵
  PID:9912
- C:\Windows\System\BhJxbBT.exe
  C:\Windows\System\BhJxbBT.exe
  2⤵
  PID:9928
- C:\Windows\System\ZZxdBrM.exe
  C:\Windows\System\ZZxdBrM.exe
  2⤵
  PID:9952
- C:\Windows\System\JFDbVZe.exe
  C:\Windows\System\JFDbVZe.exe
  2⤵
  PID:9968
- C:\Windows\System\mTUjnvB.exe
  C:\Windows\System\mTUjnvB.exe
  2⤵
  PID:9984
- C:\Windows\System\rWryBaW.exe
  C:\Windows\System\rWryBaW.exe
  2⤵
  PID:10000
- C:\Windows\System\KaCeqjg.exe
  C:\Windows\System\KaCeqjg.exe
  2⤵
  PID:10016
- C:\Windows\System\ZWfYffr.exe
  C:\Windows\System\ZWfYffr.exe
  2⤵
  PID:10040
- C:\Windows\System\wZObUpv.exe
  C:\Windows\System\wZObUpv.exe
  2⤵
  PID:10064
- C:\Windows\System\NOymcBJ.exe
  C:\Windows\System\NOymcBJ.exe
  2⤵
  PID:10092
- C:\Windows\System\KgcbWcQ.exe
  C:\Windows\System\KgcbWcQ.exe
  2⤵
  PID:10108
- C:\Windows\System\JVxIdFn.exe
  C:\Windows\System\JVxIdFn.exe
  2⤵
  PID:10132
- C:\Windows\System\wCLXLQt.exe
  C:\Windows\System\wCLXLQt.exe
  2⤵
  PID:7028
- C:\Windows\System\GFNOvtP.exe
  C:\Windows\System\GFNOvtP.exe
  2⤵
  PID:7160
- C:\Windows\System\hzxSMKM.exe
  C:\Windows\System\hzxSMKM.exe
  2⤵
  PID:2276
- C:\Windows\System\naKbHYQ.exe
  C:\Windows\System\naKbHYQ.exe
  2⤵
  PID:5232
- C:\Windows\System\DYwdslF.exe
  C:\Windows\System\DYwdslF.exe
  2⤵
  PID:3288
- C:\Windows\System\zdPnShZ.exe
  C:\Windows\System\zdPnShZ.exe
  2⤵
  PID:3392
- C:\Windows\System\dxUeBkA.exe
  C:\Windows\System\dxUeBkA.exe
  2⤵
  PID:7504
- C:\Windows\System\sarBffq.exe
  C:\Windows\System\sarBffq.exe
  2⤵
  PID:5772
- C:\Windows\System\fQIZsEG.exe
  C:\Windows\System\fQIZsEG.exe
  2⤵
  PID:8132
- C:\Windows\System\xqeweGB.exe
  C:\Windows\System\xqeweGB.exe
  2⤵
  PID:6344
- C:\Windows\System\oYvFuTw.exe
  C:\Windows\System\oYvFuTw.exe
  2⤵
  PID:7604
- C:\Windows\System\cCywaDQ.exe
  C:\Windows\System\cCywaDQ.exe
  2⤵
  PID:7736
- C:\Windows\System\dijjccL.exe
  C:\Windows\System\dijjccL.exe
  2⤵
  PID:7784
- C:\Windows\System\GZBNhLD.exe
  C:\Windows\System\GZBNhLD.exe
  2⤵
  PID:7848
- C:\Windows\System\nKPIquy.exe
  C:\Windows\System\nKPIquy.exe
  2⤵
  PID:7896
- C:\Windows\System\IaKMwfb.exe
  C:\Windows\System\IaKMwfb.exe
  2⤵
  PID:7960
- C:\Windows\System\VUgPtPo.exe
  C:\Windows\System\VUgPtPo.exe
  2⤵
  PID:8088
- C:\Windows\System\rmFFPyX.exe
  C:\Windows\System\rmFFPyX.exe
  2⤵
  PID:10248
- C:\Windows\System\uZnwoit.exe
  C:\Windows\System\uZnwoit.exe
  2⤵
  PID:10272
- C:\Windows\System\hshMtlW.exe
  C:\Windows\System\hshMtlW.exe
  2⤵
  PID:10292
- C:\Windows\System\SZilyKm.exe
  C:\Windows\System\SZilyKm.exe
  2⤵
  PID:10316
- C:\Windows\System\dAxDDtu.exe
  C:\Windows\System\dAxDDtu.exe
  2⤵
  PID:10336
- C:\Windows\System\ldfXGka.exe
  C:\Windows\System\ldfXGka.exe
  2⤵
  PID:10360
- C:\Windows\System\UMJyYfI.exe
  C:\Windows\System\UMJyYfI.exe
  2⤵
  PID:10380
- C:\Windows\System\NRWggNp.exe
  C:\Windows\System\NRWggNp.exe
  2⤵
  PID:10400
- C:\Windows\System\nDdjyWa.exe
  C:\Windows\System\nDdjyWa.exe
  2⤵
  PID:10420
- C:\Windows\System\efSfEDU.exe
  C:\Windows\System\efSfEDU.exe
  2⤵
  PID:10440
- C:\Windows\System\BJOZIfY.exe
  C:\Windows\System\BJOZIfY.exe
  2⤵
  PID:10464
- C:\Windows\System\fMqEJCJ.exe
  C:\Windows\System\fMqEJCJ.exe
  2⤵
  PID:10488
- C:\Windows\System\InbIPln.exe
  C:\Windows\System\InbIPln.exe
  2⤵
  PID:10512
- C:\Windows\System\HzXNahb.exe
  C:\Windows\System\HzXNahb.exe
  2⤵
  PID:10532
- C:\Windows\System\jTncIOT.exe
  C:\Windows\System\jTncIOT.exe
  2⤵
  PID:10552
- C:\Windows\System\BCzWeGJ.exe
  C:\Windows\System\BCzWeGJ.exe
  2⤵
  PID:10572
- C:\Windows\System\SYVTOHd.exe
  C:\Windows\System\SYVTOHd.exe
  2⤵
  PID:10600
- C:\Windows\System\sbpTdfN.exe
  C:\Windows\System\sbpTdfN.exe
  2⤵
  PID:10620
- C:\Windows\System\VgJVdhf.exe
  C:\Windows\System\VgJVdhf.exe
  2⤵
  PID:10640
- C:\Windows\System\zniCVSy.exe
  C:\Windows\System\zniCVSy.exe
  2⤵
  PID:10656
- C:\Windows\System\UfiKYZb.exe
  C:\Windows\System\UfiKYZb.exe
  2⤵
  PID:10672
- C:\Windows\System\eziuUIG.exe
  C:\Windows\System\eziuUIG.exe
  2⤵
  PID:10692
- C:\Windows\System\dvgcxAz.exe
  C:\Windows\System\dvgcxAz.exe
  2⤵
  PID:10720
- C:\Windows\System\KncRmfw.exe
  C:\Windows\System\KncRmfw.exe
  2⤵
  PID:10736
- C:\Windows\System\gDmwuyI.exe
  C:\Windows\System\gDmwuyI.exe
  2⤵
  PID:10760
- C:\Windows\System\wnxmspN.exe
  C:\Windows\System\wnxmspN.exe
  2⤵
  PID:10784
- C:\Windows\System\SpoNkIC.exe
  C:\Windows\System\SpoNkIC.exe
  2⤵
  PID:10804
- C:\Windows\System\TSnQiKx.exe
  C:\Windows\System\TSnQiKx.exe
  2⤵
  PID:10828
- C:\Windows\System\SUpCjen.exe
  C:\Windows\System\SUpCjen.exe
  2⤵
  PID:10848
- C:\Windows\System\foJoKWj.exe
  C:\Windows\System\foJoKWj.exe
  2⤵
  PID:10868
- C:\Windows\System\Lonlwbd.exe
  C:\Windows\System\Lonlwbd.exe
  2⤵
  PID:10888
- C:\Windows\System\wUbEjKS.exe
  C:\Windows\System\wUbEjKS.exe
  2⤵
  PID:10912
- C:\Windows\System\zxRBcwp.exe
  C:\Windows\System\zxRBcwp.exe
  2⤵
  PID:10928
- C:\Windows\System\QmtXuoL.exe
  C:\Windows\System\QmtXuoL.exe
  2⤵
  PID:10948
- C:\Windows\System\eprVUxs.exe
  C:\Windows\System\eprVUxs.exe
  2⤵
  PID:10968
- C:\Windows\System\ydxHPZK.exe
  C:\Windows\System\ydxHPZK.exe
  2⤵
  PID:10992
- C:\Windows\System\imekPNa.exe
  C:\Windows\System\imekPNa.exe
  2⤵
  PID:8632
- C:\Windows\System\sKvlYHl.exe
  C:\Windows\System\sKvlYHl.exe
  2⤵
  PID:8668
- C:\Windows\System\UBjGGxd.exe
  C:\Windows\System\UBjGGxd.exe
  2⤵
  PID:8728
- C:\Windows\System\XHeJhoy.exe
  C:\Windows\System\XHeJhoy.exe
  2⤵
  PID:8764
- C:\Windows\System\UTuyOmu.exe
  C:\Windows\System\UTuyOmu.exe
  2⤵
  PID:8816
- C:\Windows\System\NajaXtv.exe
  C:\Windows\System\NajaXtv.exe
  2⤵
  PID:8860
- C:\Windows\System\WtATqmZ.exe
  C:\Windows\System\WtATqmZ.exe
  2⤵
  PID:8924
- C:\Windows\System\Uuigrnt.exe
  C:\Windows\System\Uuigrnt.exe
  2⤵
  PID:8976
- C:\Windows\System\UuUYGpN.exe
  C:\Windows\System\UuUYGpN.exe
  2⤵
  PID:9040
- C:\Windows\System\XNpdYQr.exe
  C:\Windows\System\XNpdYQr.exe
  2⤵
  PID:9068
- C:\Windows\System\HFbzjaL.exe
  C:\Windows\System\HFbzjaL.exe
  2⤵
  PID:9112
- C:\Windows\System\cpYLdER.exe
  C:\Windows\System\cpYLdER.exe
  2⤵
  PID:9152
- C:\Windows\System\SukWTQe.exe
  C:\Windows\System\SukWTQe.exe
  2⤵
  PID:10704
- C:\Windows\System\sOVVuDd.exe
  C:\Windows\System\sOVVuDd.exe
  2⤵
  PID:10772
- C:\Windows\System\mVTZWVk.exe
  C:\Windows\System\mVTZWVk.exe
  2⤵
  PID:9900
- C:\Windows\System\NfXkWNv.exe
  C:\Windows\System\NfXkWNv.exe
  2⤵
  PID:6420
- C:\Windows\System\RkVvsEs.exe
  C:\Windows\System\RkVvsEs.exe
  2⤵
  PID:10976
- C:\Windows\System\npFYesv.exe
  C:\Windows\System\npFYesv.exe
  2⤵
  PID:10192
- C:\Windows\System\hJoHMXu.exe
  C:\Windows\System\hJoHMXu.exe
  2⤵
  PID:8156
- C:\Windows\System\ibcOqdo.exe
  C:\Windows\System\ibcOqdo.exe
  2⤵
  PID:5512
- C:\Windows\System\SaRKwZH.exe
  C:\Windows\System\SaRKwZH.exe
  2⤵
  PID:7532
- C:\Windows\System\FetynXe.exe
  C:\Windows\System\FetynXe.exe
  2⤵
  PID:5340
- C:\Windows\System\IgKBjSL.exe
  C:\Windows\System\IgKBjSL.exe
  2⤵
  PID:4756
- C:\Windows\System\jSkkbBO.exe
  C:\Windows\System\jSkkbBO.exe
  2⤵
  PID:9288
- C:\Windows\System\EzrDBBh.exe
  C:\Windows\System\EzrDBBh.exe
  2⤵
  PID:9396
- C:\Windows\System\AjsBmvo.exe
  C:\Windows\System\AjsBmvo.exe
  2⤵
  PID:9432
- C:\Windows\System\grrTKRe.exe
  C:\Windows\System\grrTKRe.exe
  2⤵
  PID:9464
- C:\Windows\System\qVNSuif.exe
  C:\Windows\System\qVNSuif.exe
  2⤵
  PID:620
- C:\Windows\System\AkWabUr.exe
  C:\Windows\System\AkWabUr.exe
  2⤵
  PID:9828
- C:\Windows\System\GvBdyrq.exe
  C:\Windows\System\GvBdyrq.exe
  2⤵
  PID:10328
- C:\Windows\System\YfjheSq.exe
  C:\Windows\System\YfjheSq.exe
  2⤵
  PID:11296
- C:\Windows\System\KpfAIzw.exe
  C:\Windows\System\KpfAIzw.exe
  2⤵
  PID:11332
- C:\Windows\System\FURHmNq.exe
  C:\Windows\System\FURHmNq.exe
  2⤵
  PID:11360
- C:\Windows\System\ZpttDRE.exe
  C:\Windows\System\ZpttDRE.exe
  2⤵
  PID:11380
- C:\Windows\System\odlMIle.exe
  C:\Windows\System\odlMIle.exe
  2⤵
  PID:11400
- C:\Windows\System\bhhuwkh.exe
  C:\Windows\System\bhhuwkh.exe
  2⤵
  PID:11424
- C:\Windows\System\NUodICo.exe
  C:\Windows\System\NUodICo.exe
  2⤵
  PID:11444
- C:\Windows\System\AObkJpk.exe
  C:\Windows\System\AObkJpk.exe
  2⤵
  PID:11468
- C:\Windows\System\mnUyJUC.exe
  C:\Windows\System\mnUyJUC.exe
  2⤵
  PID:11488
- C:\Windows\System\pAcxfHy.exe
  C:\Windows\System\pAcxfHy.exe
  2⤵
  PID:11516
- C:\Windows\System\IIjBbry.exe
  C:\Windows\System\IIjBbry.exe
  2⤵
  PID:11536
- C:\Windows\System\KmnPrwu.exe
  C:\Windows\System\KmnPrwu.exe
  2⤵
  PID:11556
- C:\Windows\System\ovNNuaQ.exe
  C:\Windows\System\ovNNuaQ.exe
  2⤵
  PID:11580
- C:\Windows\System\wvPIcqF.exe
  C:\Windows\System\wvPIcqF.exe
  2⤵
  PID:11600
- C:\Windows\System\gCmLJNs.exe
  C:\Windows\System\gCmLJNs.exe
  2⤵
  PID:11624
- C:\Windows\System\IjScBiI.exe
  C:\Windows\System\IjScBiI.exe
  2⤵
  PID:11644
- C:\Windows\System\vlZHrsz.exe
  C:\Windows\System\vlZHrsz.exe
  2⤵
  PID:11668
- C:\Windows\System\RdqbQnN.exe
  C:\Windows\System\RdqbQnN.exe
  2⤵
  PID:11688
- C:\Windows\System\pCYIOgq.exe
  C:\Windows\System\pCYIOgq.exe
  2⤵
  PID:11708
- C:\Windows\System\sDIOiYG.exe
  C:\Windows\System\sDIOiYG.exe
  2⤵
  PID:11736
- C:\Windows\System\rcLBBex.exe
  C:\Windows\System\rcLBBex.exe
  2⤵
  PID:11764
- C:\Windows\System\aXQFGKg.exe
  C:\Windows\System\aXQFGKg.exe
  2⤵
  PID:11788
- C:\Windows\System\ZfFoqmD.exe
  C:\Windows\System\ZfFoqmD.exe
  2⤵
  PID:11824
- C:\Windows\System\noCZJeT.exe
  C:\Windows\System\noCZJeT.exe
  2⤵
  PID:11852
- C:\Windows\System\eyQENEa.exe
  C:\Windows\System\eyQENEa.exe
  2⤵
  PID:11876
- C:\Windows\System\cvfKElH.exe
  C:\Windows\System\cvfKElH.exe
  2⤵
  PID:11908
- C:\Windows\System\GqVotOo.exe
  C:\Windows\System\GqVotOo.exe
  2⤵
  PID:11924
- C:\Windows\System\lLZuWNR.exe
  C:\Windows\System\lLZuWNR.exe
  2⤵
  PID:11944
- C:\Windows\System\mffWedc.exe
  C:\Windows\System\mffWedc.exe
  2⤵
  PID:11964
- C:\Windows\System\vQEoQBS.exe
  C:\Windows\System\vQEoQBS.exe
  2⤵
  PID:11988
- C:\Windows\System\HhdiDUw.exe
  C:\Windows\System\HhdiDUw.exe
  2⤵
  PID:12008
- C:\Windows\System\CJkfSXC.exe
  C:\Windows\System\CJkfSXC.exe
  2⤵
  PID:12028
- C:\Windows\System\YqLucRH.exe
  C:\Windows\System\YqLucRH.exe
  2⤵
  PID:12052
- C:\Windows\System\OhaNKqI.exe
  C:\Windows\System\OhaNKqI.exe
  2⤵
  PID:12072
- C:\Windows\System\KhuRKdC.exe
  C:\Windows\System\KhuRKdC.exe
  2⤵
  PID:12092
- C:\Windows\System\jXiSeJN.exe
  C:\Windows\System\jXiSeJN.exe
  2⤵
  PID:12108
- C:\Windows\System\tjNAsJN.exe
  C:\Windows\System\tjNAsJN.exe
  2⤵
  PID:12128
- C:\Windows\System\iQierAh.exe
  C:\Windows\System\iQierAh.exe
  2⤵
  PID:12148
- C:\Windows\System\ZJbCIvB.exe
  C:\Windows\System\ZJbCIvB.exe
  2⤵
  PID:12172
- C:\Windows\System\jLXQFve.exe
  C:\Windows\System\jLXQFve.exe
  2⤵
  PID:12192
- C:\Windows\System\TeuuUbx.exe
  C:\Windows\System\TeuuUbx.exe
  2⤵
  PID:12212
- C:\Windows\System\pUuVUzO.exe
  C:\Windows\System\pUuVUzO.exe
  2⤵
  PID:12232
- C:\Windows\System\BseIEAG.exe
  C:\Windows\System\BseIEAG.exe
  2⤵
  PID:12264
- C:\Windows\System\DuwMQaq.exe
  C:\Windows\System\DuwMQaq.exe
  2⤵
  PID:9944
- C:\Windows\System\rjgRFzF.exe
  C:\Windows\System\rjgRFzF.exe
  2⤵
  PID:2240
- C:\Windows\System\CFbXfge.exe
  C:\Windows\System\CFbXfge.exe
  2⤵
  PID:9636
- C:\Windows\System\JxEGJEM.exe
  C:\Windows\System\JxEGJEM.exe
  2⤵
  PID:10524
- C:\Windows\System\lWgNwUz.exe
  C:\Windows\System\lWgNwUz.exe
  2⤵
  PID:10564
- C:\Windows\System\ucVjvvI.exe
  C:\Windows\System\ucVjvvI.exe
  2⤵
  PID:10588
- C:\Windows\System\cyIALKU.exe
  C:\Windows\System\cyIALKU.exe
  2⤵
  PID:10628
- C:\Windows\System\BdWeGDT.exe
  C:\Windows\System\BdWeGDT.exe
  2⤵
  PID:8504
- C:\Windows\System\qcQPNJA.exe
  C:\Windows\System\qcQPNJA.exe
  2⤵
  PID:9836
- C:\Windows\System\AChrKDS.exe
  C:\Windows\System\AChrKDS.exe
  2⤵
  PID:8528
- C:\Windows\System\qcGSYBv.exe
  C:\Windows\System\qcGSYBv.exe
  2⤵
  PID:10836
- C:\Windows\System\SyAAQuM.exe
  C:\Windows\System\SyAAQuM.exe
  2⤵
  PID:9880
- C:\Windows\System\LeaizgJ.exe
  C:\Windows\System\LeaizgJ.exe
  2⤵
  PID:9996
- C:\Windows\System\QQfKCWZ.exe
  C:\Windows\System\QQfKCWZ.exe
  2⤵
  PID:10956
- C:\Windows\System\RlTngLU.exe
  C:\Windows\System\RlTngLU.exe
  2⤵
  PID:10116
- C:\Windows\System\taVJVDo.exe
  C:\Windows\System\taVJVDo.exe
  2⤵
  PID:8904
- C:\Windows\System\IsnjRBK.exe
  C:\Windows\System\IsnjRBK.exe
  2⤵
  PID:8956
- C:\Windows\System\vBvZdGZ.exe
  C:\Windows\System\vBvZdGZ.exe
  2⤵
  PID:9020
- C:\Windows\System\UsajYhX.exe
  C:\Windows\System\UsajYhX.exe
  2⤵
  PID:12308
- C:\Windows\System\OalvCaa.exe
  C:\Windows\System\OalvCaa.exe
  2⤵
  PID:12324
- C:\Windows\System\IfyEckc.exe
  C:\Windows\System\IfyEckc.exe
  2⤵
  PID:12356
- C:\Windows\System\wWFKmlt.exe
  C:\Windows\System\wWFKmlt.exe
  2⤵
  PID:12372
- C:\Windows\System\Zopcrqg.exe
  C:\Windows\System\Zopcrqg.exe
  2⤵
  PID:12396
- C:\Windows\System\cpJqxty.exe
  C:\Windows\System\cpJqxty.exe
  2⤵
  PID:12416
- C:\Windows\System\sCFMVDC.exe
  C:\Windows\System\sCFMVDC.exe
  2⤵
  PID:12436
- C:\Windows\System\XkuaATI.exe
  C:\Windows\System\XkuaATI.exe
  2⤵
  PID:12460
- C:\Windows\System\vYfCsKu.exe
  C:\Windows\System\vYfCsKu.exe
  2⤵
  PID:12476
- C:\Windows\System\CdZrcNM.exe
  C:\Windows\System\CdZrcNM.exe
  2⤵
  PID:12496
- C:\Windows\System\duaUHms.exe
  C:\Windows\System\duaUHms.exe
  2⤵
  PID:12516
- C:\Windows\System\XAWwbug.exe
  C:\Windows\System\XAWwbug.exe
  2⤵
  PID:12564
- C:\Windows\System\fLDHbWL.exe
  C:\Windows\System\fLDHbWL.exe
  2⤵
  PID:12580
- C:\Windows\System\zbyhHAt.exe
  C:\Windows\System\zbyhHAt.exe
  2⤵
  PID:12600
- C:\Windows\System\IUMGmYY.exe
  C:\Windows\System\IUMGmYY.exe
  2⤵
  PID:12616
- C:\Windows\System\jzRYoLX.exe
  C:\Windows\System\jzRYoLX.exe
  2⤵
  PID:12684
- C:\Windows\System\hOmZmCy.exe
  C:\Windows\System\hOmZmCy.exe
  2⤵
  PID:12704
- C:\Windows\System\ZQlYWUW.exe
  C:\Windows\System\ZQlYWUW.exe
  2⤵
  PID:12720
- C:\Windows\System\CkPwRlp.exe
  C:\Windows\System\CkPwRlp.exe
  2⤵
  PID:12748
- C:\Windows\System\kqedfyj.exe
  C:\Windows\System\kqedfyj.exe
  2⤵
  PID:12764
- C:\Windows\System\YYEyKlr.exe
  C:\Windows\System\YYEyKlr.exe
  2⤵
  PID:13192
- C:\Windows\System\YRotFbi.exe
  C:\Windows\System\YRotFbi.exe
  2⤵
  PID:13208
- C:\Windows\System\renEjOC.exe
  C:\Windows\System\renEjOC.exe
  2⤵
  PID:13224
- C:\Windows\System\bRRFpAQ.exe
  C:\Windows\System\bRRFpAQ.exe
  2⤵
  PID:13240
- C:\Windows\System\jYwsqUF.exe
  C:\Windows\System\jYwsqUF.exe
  2⤵
  PID:13256
- C:\Windows\System\ZLlRLAi.exe
  C:\Windows\System\ZLlRLAi.exe
  2⤵
  PID:13272
- C:\Windows\System\sDTCaai.exe
  C:\Windows\System\sDTCaai.exe
  2⤵
  PID:13288
- C:\Windows\System\KaCEuBe.exe
  C:\Windows\System\KaCEuBe.exe
  2⤵
  PID:11476
- C:\Windows\System\osMccyQ.exe
  C:\Windows\System\osMccyQ.exe
  2⤵
  PID:11504
- C:\Windows\System\rqYdHtu.exe
  C:\Windows\System\rqYdHtu.exe
  2⤵
  PID:11524
- C:\Windows\System\QRqEQHK.exe
  C:\Windows\System\QRqEQHK.exe
  2⤵
  PID:11572
- C:\Windows\System\vtTVhCU.exe
  C:\Windows\System\vtTVhCU.exe
  2⤵
  PID:11616
- C:\Windows\System\FlUapHD.exe
  C:\Windows\System\FlUapHD.exe
  2⤵
  PID:11632
- C:\Windows\System\CkCloyj.exe
  C:\Windows\System\CkCloyj.exe
  2⤵
  PID:11656
- C:\Windows\System\xmHSSmj.exe
  C:\Windows\System\xmHSSmj.exe
  2⤵
  PID:4936
- C:\Windows\System\lkHaaZK.exe
  C:\Windows\System\lkHaaZK.exe
  2⤵
  PID:11180
- C:\Windows\System\gkdWdTR.exe
  C:\Windows\System\gkdWdTR.exe
  2⤵
  PID:9672
- C:\Windows\System\vARtvlv.exe
  C:\Windows\System\vARtvlv.exe
  2⤵
  PID:9144
- C:\Windows\System\ZOKUJAM.exe
  C:\Windows\System\ZOKUJAM.exe
  2⤵
  PID:8084
- C:\Windows\System\DxPjxfK.exe
  C:\Windows\System\DxPjxfK.exe
  2⤵
  PID:12208
- C:\Windows\System\WndrcmG.exe
  C:\Windows\System\WndrcmG.exe
  2⤵
  PID:12244
- C:\Windows\System\WDVKIQP.exe
  C:\Windows\System\WDVKIQP.exe
  2⤵
  PID:12280
- C:\Windows\System\XiRavnc.exe
  C:\Windows\System\XiRavnc.exe
  2⤵
  PID:10396
- C:\Windows\System\aUcdQqO.exe
  C:\Windows\System\aUcdQqO.exe
  2⤵
  PID:8376
- C:\Windows\System\QEiPbMn.exe
  C:\Windows\System\QEiPbMn.exe
  2⤵
  PID:10584
- C:\Windows\System\eAAGYUr.exe
  C:\Windows\System\eAAGYUr.exe
  2⤵
  PID:10700
- C:\Windows\System\iTsTFFw.exe
  C:\Windows\System\iTsTFFw.exe
  2⤵
  PID:10756
- C:\Windows\System\ULRkuvy.exe
  C:\Windows\System\ULRkuvy.exe
  2⤵
  PID:11064
- C:\Windows\System\vRFMLnZ.exe
  C:\Windows\System\vRFMLnZ.exe
  2⤵
  PID:2992
- C:\Windows\System\KXONURZ.exe
  C:\Windows\System\KXONURZ.exe
  2⤵
  PID:12484
- C:\Windows\System\oyQFRph.exe
  C:\Windows\System\oyQFRph.exe
  2⤵
  PID:12592
- C:\Windows\System\lpfsDfF.exe
  C:\Windows\System\lpfsDfF.exe
  2⤵
  PID:12676
- C:\Windows\System\zILnTEm.exe
  C:\Windows\System\zILnTEm.exe
  2⤵
  PID:12716
- C:\Windows\System\CjrTyBM.exe
  C:\Windows\System\CjrTyBM.exe
  2⤵
  PID:12800
- C:\Windows\System\xUCXBrs.exe
  C:\Windows\System\xUCXBrs.exe
  2⤵
  PID:10632
- C:\Windows\System\HBbkkzN.exe
  C:\Windows\System\HBbkkzN.exe
  2⤵
  PID:13200
- C:\Windows\System\cLmGABB.exe
  C:\Windows\System\cLmGABB.exe
  2⤵
  PID:11932
- C:\Windows\System\bIdnbUM.exe
  C:\Windows\System\bIdnbUM.exe
  2⤵
  PID:8268
- C:\Windows\System\DNNGwSy.exe
  C:\Windows\System\DNNGwSy.exe
  2⤵
  PID:4696
- C:\Windows\System\RuapPEC.exe
  C:\Windows\System\RuapPEC.exe
  2⤵
  PID:5616
- C:\Windows\System\SYCxggw.exe
  C:\Windows\System\SYCxggw.exe
  2⤵
  PID:11408
- C:\Windows\System\NMicvwk.exe
  C:\Windows\System\NMicvwk.exe
  2⤵
  PID:10408
- C:\Windows\System\AolWiXY.exe
  C:\Windows\System\AolWiXY.exe
  2⤵
  PID:884
- C:\Windows\System\iOTIWmb.exe
  C:\Windows\System\iOTIWmb.exe
  2⤵
  PID:11564
- C:\Windows\System\ZQoRsVB.exe
  C:\Windows\System\ZQoRsVB.exe
  2⤵
  PID:10508
- C:\Windows\System\mjDYgAF.exe
  C:\Windows\System\mjDYgAF.exe
  2⤵
  PID:11840
- C:\Windows\System\NrxkhFh.exe
  C:\Windows\System\NrxkhFh.exe
  2⤵
  PID:12316
- C:\Windows\System\cuXmOUb.exe
  C:\Windows\System\cuXmOUb.exe
  2⤵
  PID:11220
- C:\Windows\System\MtReXFM.exe
  C:\Windows\System\MtReXFM.exe
  2⤵
  PID:11156
- C:\Windows\System\SLXWrnZ.exe
  C:\Windows\System\SLXWrnZ.exe
  2⤵
  PID:12412
- C:\Windows\System\fnflUYt.exe
  C:\Windows\System\fnflUYt.exe
  2⤵
  PID:11260
- C:\Windows\System\hStdiiW.exe
  C:\Windows\System\hStdiiW.exe
  2⤵
  PID:13008
- C:\Windows\System\NiDwGyX.exe
  C:\Windows\System\NiDwGyX.exe
  2⤵
  PID:12320
- C:\Windows\System\aXhaBwt.exe
  C:\Windows\System\aXhaBwt.exe
  2⤵
  PID:232
- C:\Windows\System\yMQnigS.exe
  C:\Windows\System\yMQnigS.exe
  2⤵
  PID:9904
- C:\Windows\System\BaqvQkp.exe
  C:\Windows\System\BaqvQkp.exe
  2⤵
  PID:10264
- C:\Windows\System\WTxFXZD.exe
  C:\Windows\System\WTxFXZD.exe
  2⤵
  PID:1740
- C:\Windows\System\OptPCVv.exe
  C:\Windows\System\OptPCVv.exe
  2⤵
  PID:1692
- C:\Windows\System\gadfOrn.exe
  C:\Windows\System\gadfOrn.exe
  2⤵
  PID:6208
- C:\Windows\System\pnFcBjo.exe
  C:\Windows\System\pnFcBjo.exe
  2⤵
  PID:12760
- C:\Windows\System\kNiJDvd.exe
  C:\Windows\System\kNiJDvd.exe
  2⤵
  PID:4596
- C:\Windows\System\rClLiqR.exe
  C:\Windows\System\rClLiqR.exe
  2⤵
  PID:1452
- C:\Windows\System\eaJASKb.exe
  C:\Windows\System\eaJASKb.exe
  2⤵
  PID:1236
- C:\Windows\System\eOnIieA.exe
  C:\Windows\System\eOnIieA.exe
  2⤵
  PID:1792
- C:\Windows\System\LoAiDkU.exe
  C:\Windows\System\LoAiDkU.exe
  2⤵
  PID:12572
- C:\Windows\System\elsqcsj.exe
  C:\Windows\System\elsqcsj.exe
  2⤵
  PID:3472
- C:\Windows\System\xLwPPmA.exe
  C:\Windows\System\xLwPPmA.exe
  2⤵
  PID:8060
- C:\Windows\System\vQVoNLX.exe
  C:\Windows\System\vQVoNLX.exe
  2⤵
  PID:13084
- C:\Windows\System\ehyEcip.exe
  C:\Windows\System\ehyEcip.exe
  2⤵
  PID:11136
- C:\Windows\System\UISaEra.exe
  C:\Windows\System\UISaEra.exe
  2⤵
  PID:12040
- C:\Windows\System\seJiJpj.exe
  C:\Windows\System\seJiJpj.exe
  2⤵
  PID:9128
- C:\Windows\System\VYNebQr.exe
  C:\Windows\System\VYNebQr.exe
  2⤵
  PID:9588
- C:\Windows\System\WBcTFhO.exe
  C:\Windows\System\WBcTFhO.exe
  2⤵
  PID:13180
- C:\Windows\System\zOGpHRA.exe
  C:\Windows\System\zOGpHRA.exe
  2⤵
  PID:4440
- C:\Windows\System\HSdrXmS.exe
  C:\Windows\System\HSdrXmS.exe
  2⤵
  PID:13056
- C:\Windows\System\KBudfMS.exe
  C:\Windows\System\KBudfMS.exe
  2⤵
  PID:3840
- C:\Windows\System\hhBXAcE.exe
  C:\Windows\System\hhBXAcE.exe
  2⤵
  PID:12384
- C:\Windows\System\zhJNtey.exe
  C:\Windows\System\zhJNtey.exe
  2⤵
  PID:8240
- C:\Windows\System\mkAyhvt.exe
  C:\Windows\System\mkAyhvt.exe
  2⤵
  PID:9256
- C:\Windows\System\ElkYQIh.exe
  C:\Windows\System\ElkYQIh.exe
  2⤵
  PID:12508
- C:\Windows\System\EPlXYdC.exe
  C:\Windows\System\EPlXYdC.exe
  2⤵
  PID:11164
- C:\Windows\System\qIhtfMR.exe
  C:\Windows\System\qIhtfMR.exe
  2⤵
  PID:11120
- C:\Windows\System\HrhAJfc.exe
  C:\Windows\System\HrhAJfc.exe
  2⤵
  PID:2676
- C:\Windows\System\CylWrAR.exe
  C:\Windows\System\CylWrAR.exe
  2⤵
  PID:6564
- C:\Windows\System\bHgsAJZ.exe
  C:\Windows\System\bHgsAJZ.exe
  2⤵
  PID:848
- C:\Windows\System\DfPRjXt.exe
  C:\Windows\System\DfPRjXt.exe
  2⤵
  PID:7100
- C:\Windows\System\LAnlFJc.exe
  C:\Windows\System\LAnlFJc.exe
  2⤵
  PID:4312
- C:\Windows\System\QCHtTyU.exe
  C:\Windows\System\QCHtTyU.exe
  2⤵
  PID:1924
- C:\Windows\System\ZmrsTpi.exe
  C:\Windows\System\ZmrsTpi.exe
  2⤵
  PID:6592
- C:\Windows\System\RSTaaTU.exe
  C:\Windows\System\RSTaaTU.exe
  2⤵
  PID:2884
- C:\Windows\System\xQkInbp.exe
  C:\Windows\System\xQkInbp.exe
  2⤵
  PID:12876
- C:\Windows\System\yPUKiGE.exe
  C:\Windows\System\yPUKiGE.exe
  2⤵
  PID:2232
- C:\Windows\System\kXGfbOZ.exe
  C:\Windows\System\kXGfbOZ.exe
  2⤵
  PID:8324
- C:\Windows\System\IuwcHGH.exe
  C:\Windows\System\IuwcHGH.exe
  2⤵
  PID:13060
- C:\Windows\System\SHThRPa.exe
  C:\Windows\System\SHThRPa.exe
  2⤵
  PID:9964
- C:\Windows\System\qMrznUh.exe
  C:\Windows\System\qMrznUh.exe
  2⤵
  PID:6580
- C:\Windows\System\mhfGOnV.exe
  C:\Windows\System\mhfGOnV.exe
  2⤵
  PID:7616
- C:\Windows\System\GrFlfZV.exe
  C:\Windows\System\GrFlfZV.exe
  2⤵
  PID:12756
- C:\Windows\System\lflxUzn.exe
  C:\Windows\System\lflxUzn.exe
  2⤵
  PID:7428
- C:\Windows\System\yjWeThH.exe
  C:\Windows\System\yjWeThH.exe
  2⤵
  PID:8128
- C:\Windows\System\OKrMoAj.exe
  C:\Windows\System\OKrMoAj.exe
  2⤵
  PID:9584
- C:\Windows\System\YQXKbga.exe
  C:\Windows\System\YQXKbga.exe
  2⤵
  PID:12740
- C:\Windows\System\qYhnfMp.exe
  C:\Windows\System\qYhnfMp.exe
  2⤵
  PID:6552
- C:\Windows\System\YdfyJKx.exe
  C:\Windows\System\YdfyJKx.exe
  2⤵
  PID:1568
- C:\Windows\System\cqYUNVD.exe
  C:\Windows\System\cqYUNVD.exe
  2⤵
  PID:5092
- C:\Windows\System\AGkdKMc.exe
  C:\Windows\System\AGkdKMc.exe
  2⤵
  PID:2204
- C:\Windows\System\lXhzGcB.exe
  C:\Windows\System\lXhzGcB.exe
  2⤵
  PID:12168
- C:\Windows\System\pOuDWBQ.exe
  C:\Windows\System\pOuDWBQ.exe
  2⤵
  PID:12924
- C:\Windows\System\cGyUUjt.exe
  C:\Windows\System\cGyUUjt.exe
  2⤵
  PID:11460
- C:\Windows\System\YcUSDZE.exe
  C:\Windows\System\YcUSDZE.exe
  2⤵
  PID:1904
- C:\Windows\System\GOhwJgF.exe
  C:\Windows\System\GOhwJgF.exe
  2⤵
  PID:12588
- C:\Windows\System\YVAyJyj.exe
  C:\Windows\System\YVAyJyj.exe
  2⤵
  PID:10820
- C:\Windows\System\zdWDobb.exe
  C:\Windows\System\zdWDobb.exe
  2⤵
  PID:10176
- C:\Windows\System\AqEWazP.exe
  C:\Windows\System\AqEWazP.exe
  2⤵
  PID:4320
- C:\Windows\System\bfJdIsY.exe
  C:\Windows\System\bfJdIsY.exe
  2⤵
  PID:9648
- C:\Windows\System\fQGoCbg.exe
  C:\Windows\System\fQGoCbg.exe
  2⤵
  PID:12224
- C:\Windows\System\gDgJRyf.exe
  C:\Windows\System\gDgJRyf.exe
  2⤵
  PID:13284
- C:\Windows\System\SAnmZGt.exe
  C:\Windows\System\SAnmZGt.exe
  2⤵
  PID:4608
- C:\Windows\System\ErrctHu.exe
  C:\Windows\System\ErrctHu.exe
  2⤵
  PID:13356
- C:\Windows\System\CIluOlV.exe
  C:\Windows\System\CIluOlV.exe
  2⤵
  PID:13384
- C:\Windows\System\yWZLqMs.exe
  C:\Windows\System\yWZLqMs.exe
  2⤵
  PID:13404
- C:\Windows\System\NNiRCKP.exe
  C:\Windows\System\NNiRCKP.exe
  2⤵
  PID:13428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uuqz1lrh.cnm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DFcGcjO.exe

Filesize
1.7MB

MD5
893dbc5e49b10283c70e93fec3173e41

SHA1
3ec38f383061cbea164ec47ced4d9ecd2c545b79

SHA256
bbd8249a9b3597da05ea376897b6959f9a064cb29a538492776a33c2b817ecf8

SHA512
e38c47c197f8fd72beb76107b93e44a111acf15281a41bac6bef9ba9d501084d1aa8cf623e2ba96e1b47a976f75d8831ae9d9b6da9c3b7d55532c7040e107053

Download Submit
C:\Windows\System\DsprFgB.exe

Filesize
1.7MB

MD5
fac81c364166ab273651b0f2ff8ae709

SHA1
d321ca5c5644db4676c23c8bf8827759877c1721

SHA256
c8cc84d9520345cea3f9083bb7fd00f7f486189c410193963cdcdb7d43bc488e

SHA512
4936dc21b5192c0ce412696cdb1a4e588f2abdac8afcc48182cf313bf39687b03121a724050196c6ef43eef565b6c1df5f8a4ecf2f02294aeed5b29940b0f34b

Download Submit
C:\Windows\System\DxNZlES.exe

Filesize
1.7MB

MD5
76c76d2b36a7210df7792912c554f771

SHA1
23957fe1db2c20feaa7f552b4834cf4451942745

SHA256
190f2f75d75815150b4e717b0a4da315d3ef4734c9c125acbb9921f7c99cd6e1

SHA512
d83dbb6e32ec9959fe5a4ef67aeced35a796d88d325f63cafab2606d4deebb3d807bb6aec896cd2ce4a39e60cde9ad5f8b57fd02d2d98a7e3064e1ecf2087a7a

Download Submit
C:\Windows\System\DzvUzyK.exe

Filesize
1.7MB

MD5
27c748469c4de17cbafed4f410237bd3

SHA1
0e3d8a6d897c4949fd47650488204bea4b0adcc1

SHA256
2bf18968a7d8a1e94eace29885092e312a8b5a64842b3dbdf776ff013b4511c3

SHA512
0947e7d91197fb2560320401d8ff123e4fdfe6423034ff08c11e67d2a9dc8f98320b9b472bf00599765684c13a62481da1a4c4c054fb252abac5fa50b788c183

Download Submit
C:\Windows\System\HIKcAra.exe

Filesize
1.7MB

MD5
96381001d6f163de267652d04a5a71db

SHA1
28a8ff3e55fb239471504f343aaea02ff12472dc

SHA256
a0724ee5ff21c4a31cab8f213a019cd673b9ab57e3d8d2d1aac56e568c0d7788

SHA512
96c5ecf586e090aab573184cde0652eb608339699a1c12a76fcc45fa47a670dc5f993b475908997a3ceaaa0bbe06d1359bfb9af37d7d6111870e21addca56057

Download Submit
C:\Windows\System\JdqcShB.exe

Filesize
1.7MB

MD5
010891ce4aa2d785e05def58a2b71cd6

SHA1
2e4153ac5a099bdf91793c8f50cb4436c42f80d6

SHA256
2eff59ba31af0ea02f9024596eae7dc45c847a72faaf6afdf7a9030dbf478b69

SHA512
14e92baa2eaef4b95b712117a595218647f42430630b400bd5313fb103adeca63afdf32e8382fd26841115490c729fd37d5694acdd785743d11f8773077e6036

Download Submit
C:\Windows\System\JohsZQr.exe

Filesize
1.7MB

MD5
656a8f54e423f9992b4fded60ee94bed

SHA1
c7e13625715d528ce76608567db0a71419293784

SHA256
056f13c4d90ffda4b81c71a36c5dcb6b5b5077cd2d256b36b9bd1965fbddf0bf

SHA512
c4095bbc1c871728646851beb563e67dbcad744ee5a102ae2bf97bfb29f6b51408a2d072f7e836dc121ec51392b21acfa4785816b3beee3bbc0e4e7b1bb0f364

Download Submit
C:\Windows\System\JwqeGEV.exe

Filesize
1.7MB

MD5
3ac1784362e9e12d32116cce8ce146af

SHA1
6a09341c56a900e990933a1f0197a4d5a3e556a2

SHA256
6ab512d65f4df1eca34526ebede3564379a4f5ebcd7849cc2c404789999e600f

SHA512
17df03bc71dc7716289d95c5da2245f364cacbba6c7500b0446ec41c688799f5a4cc95fab1ea6a5b586a2975615a8ec14485a56e7569b13fe51703e24552ca35

Download Submit
C:\Windows\System\KMgYCYI.exe

Filesize
1.7MB

MD5
99bbbd7c964fd1dc8cfae3426aa6c0c5

SHA1
a4494391311ead3edc88d8e4ff058871c8a2a523

SHA256
2aa6a43e8e93ed807d6581f3e4dc2ebbeee19fe0c7d8e3308d669c8d1815f1ff

SHA512
56128113e8b567b0e919b90b49e7b7a9503d581e524bb83f9afd4c54a4c4b3affe9054625cb181cd2c051ad49086c391604410f06b4b21bfff16a617b7978b7d

Download Submit
C:\Windows\System\KlshPMR.exe

Filesize
1.7MB

MD5
ce7f0c9a1a5136949389408bee40e67c

SHA1
8ac36327ee8db25d718470335332f0775b1a85e7

SHA256
1dc7bcfcae4de25d61d22f7280af5d22beb41ba48f42259c04de6f497cfc1485

SHA512
8731b9ce51c67cee96ce1832a9cf116c060e5111ed726136dedd408f1ac3a2224ea5c3219cd19c52f5e8dfa5a0b34a8fe1f18f41c52a5abc2ddcfe9608652944

Download Submit
C:\Windows\System\KxVdFTh.exe

Filesize
1.7MB

MD5
7279ee9ab2ed8a29da4ee5ed6f2c6fd0

SHA1
10a38fa7a880d11b9faafb0ce24f4495d5717566

SHA256
9d3ef16786b7f69273b059484d0f206b4bb97d790ea47bd7259fdaaf8cf3c301

SHA512
d918d0d5bed75a3130b72234e43f07ad0692ff9bdabe82c3f8d61fb057e6a18f4509381a6245d74300efa32ecc64ce1626c2b086417680b2e09458cf18c8e521

Download Submit
C:\Windows\System\LQvRJTH.exe

Filesize
1.7MB

MD5
053caa655d23baad520bc6de7e05d2e5

SHA1
33b7943249d0ee543be487207e0b021bf4a46c76

SHA256
4483b872c54d03b83fcdc741f6b4b25e3d93ec6ef1129c46b3f71defd1e9109e

SHA512
5c0b762acaddb0e3ce0277ae79d9ab72aa39166a7c7bfec42a4f0c16dffdf037c028d55910164b2587350db4eb831a57230ed4f7208134d9bbc7c669c0722f89

Download Submit
C:\Windows\System\PaHTPJa.exe

Filesize
1.7MB

MD5
65a0d67b0a4f44da8e0fdba7d81c0626

SHA1
28791c8ded5b3fac3b4c3d10b63cbf48e2139b04

SHA256
c13b14d87d5b96c1a1c841c68ff3c2438f6bc30332166037dd8443f0e38c55ca

SHA512
d2a7ea36c21779bab328514bd309a769f82e6ab161614c97a033e832699cbcff70be8456985a9acb1009ab77249d250a69225fce4952b1aec043049a22cde23a

Download Submit
C:\Windows\System\QBLQjqk.exe

Filesize
1.7MB

MD5
2ac150aa87f8e7311c3c7d7e43a7fffe

SHA1
d0185a55abe89dae86cd1cbfb3a46e35e2972da7

SHA256
f095e745dfbcd321f1767b6be01d12bcf672fbefc4d0f6154f2ba5c501a3dbc5

SHA512
4b38e27eed67cba6be397a86a08d778ca9fb34bd3947e45e0660672e6f688afa4c2e2a95ae5af35d88b9343d9abbf0ba5b27f6054698744f1c5c4dfbeaa50523

Download Submit
C:\Windows\System\SXlxjWq.exe

Filesize
1.7MB

MD5
1050eef32ba51d1fb24217e714aa5cad

SHA1
444a79e52d738ebce6c6fbf8914973d58affc755

SHA256
285c9ced3ae903d72740d12917deeadcc78000263cf16859b18d5695b3c30db8

SHA512
9acd71eae88b868f204d6364a8848dbd74b7c0b62dea5cf49473df409d1b9cd7128c5fe76e39f416bbe7b359e7766ff67814a7944519ce87d68cc44a4e1b60fb

Download Submit
C:\Windows\System\SyVKcwl.exe

Filesize
1.7MB

MD5
34e0ea88b589b1d3d6fd5ee686da50eb

SHA1
98643da0b8008f25be1d081d72c885c9dd8a2d10

SHA256
c33633612989d37c67fe6560edea959d96d7b4d15bfdc76bb8f698a5399de287

SHA512
9dcefb828c6111109f1c10f9981fefd27421cb6da21a508025583c88bb6b0ca03dc1a1bf069d45b4c91a674768ec98ee9e221dd81c5a7fd200ae5e553f4a9768

Download Submit
C:\Windows\System\UnHYzmK.exe

Filesize
1.7MB

MD5
0517cfe1b6ce65f19ebe4fcb5dd24246

SHA1
b3471ff3568e8a7b1bc5c96978c294cbbca6813e

SHA256
0a1f82048e4da48950d660c72e0ce3c1c7ea71a2b17b0d587828a940f3916309

SHA512
a91cb61733b2886ef253d23e5bae7271bda5da573906fac13a02c5b975988ffc70e0a857426632f54b0fba2e58edf61a854ab25c1471642d20dc5c7c44507ffc

Download Submit
C:\Windows\System\ZvFNSKe.exe

Filesize
1.7MB

MD5
49c4c3be611bdf4c9d497b45def4a82d

SHA1
0d23e38e7435ab88fa1cd7a63e499856f0ab8191

SHA256
ecbc2b0509ce657ea11e0ba075b3ca64c924ebee215b97579c5aa4f1fcd52cbc

SHA512
654acf655b2c2c7540db6515dcb3fbebe1e3e8c58b805bd4d7b0dcb438dfcacb2161898b2e3099c444d3ce8960dab0ab1a57d163f902972db04254d93112a0f3

Download Submit
C:\Windows\System\aifnmoc.exe

Filesize
1.7MB

MD5
eb81f0bd85f34646a6ab7aa187ea398d

SHA1
f30f9c2ecee919a7b6180fcf96c47c52c09d0218

SHA256
2a04dce273459b30d2984a9be7086aecdaad746c765ee023c60872a90b5ff807

SHA512
aafbe54e8814fcd21ff046c15d4d636d0dfc3fb9ed4ca03feaa1e48a57b7e6e382245f384676c1126c8c763945b74324e74dd94d2d5b1004bc9c5a6c6bb426b9

Download Submit
C:\Windows\System\bmLTVGG.exe

Filesize
1.7MB

MD5
baeeaf2392e99fb9419c6355a2976213

SHA1
48eda714cf72fc35234e6290e3587082bec7bfd3

SHA256
e0f06f4686aecbb64fa32b11b87c89a071ebb92a77585ef67e7800294ec7cae4

SHA512
08e640b89d12887e79414f6a0a278a84970a0c27b312763a549ff1b3ca8202eb39e90281f71fe45095509ed6fd0da3f31bc897622b930e21edb9ddc5e3dfe959

Download Submit
C:\Windows\System\bnHfgaI.exe

Filesize
1.7MB

MD5
3544907dd695a7fb66a4b18daa870ede

SHA1
c8eb345d2e92b5a9b0dd76817fa834f4f5956f73

SHA256
15fbf58b4f2355eb48a163f303b17dbdf6528db42feb2aabaa3f243bfe00dbdf

SHA512
a78d7be4cb098e49933470a4388cbe35ec58954d4c770a38fbdccd6761793030086a65b2819ede8d1ce4b670bd6e2ac6139d4d29de2413d747273743342aeef7

Download Submit
C:\Windows\System\cVhUzAt.exe

Filesize
1.7MB

MD5
3ca5ce132cf4ebaf1c14a1d7071e84fe

SHA1
c2280bc7533be869f5002508efb8c88a76ba5fdb

SHA256
559fb4e876d36157445005968bf9bff574d6b4b22b1450851f8d814158d4b008

SHA512
d453e1457fb6646895fe52ceaaa453e8b9a74f4768c9eb225bdc8e9ab2f69e9f32f08e1fd78a260db1d974245b1d672834d4f3143a515655eca93bb9586fb9d7

Download Submit
C:\Windows\System\gnTOHRm.exe

Filesize
1.7MB

MD5
08290183606d137f4687fb971113dd9b

SHA1
beb2dd6357584b8deac5e2c43bbf1108aa59ddb8

SHA256
b5085ddd1ed1103bdc8af730ab1112ac27e0af033fb13cf83226d34517e4a43b

SHA512
6adb9351f45d950dea97599c4a7b441d6c30a768a426b181a41fd20088c6ffad48c1d350e38fc0b8d5b7991008cd75d19dfb296aaf765bdfff8436219623a5eb

Download Submit
C:\Windows\System\hsVRxue.exe

Filesize
1.7MB

MD5
cf10c83f4656986d63cf8fb873f0dfc8

SHA1
8f5ea74302727d118a67aac9e08f62495e90fa63

SHA256
0c79dd044af66fb450fe365e38cd49590a5ea6cfebe2317d27215c4a55e37671

SHA512
66c169bdb747022a1a68480ede73eff473da1a5bbcdb1e2ad6e3ebfeaef4309d224f59912c5f962aefdd4760a5f79da8ee7569ec283abf3716cc3029ed27a38b

Download Submit
C:\Windows\System\iRJXyQp.exe

Filesize
1.7MB

MD5
bfcd1640fc4aa0289fd23f0f75248253

SHA1
758e86137099cc5e6ad88ba2aee42f46a142b5dc

SHA256
0868cac7537a6806dcee6e4dae5e39c0c3d814501a5474f8d942cd75742e2e90

SHA512
d9e28e81fdfa5326c8aaac812dae640eb75accf0df0782191a95b4c1bfcf408155aec272730e6cfd8dc8852dd34026b7af6d32731c0f8e384316f63050dc8658

Download Submit
C:\Windows\System\lQDbAWs.exe

Filesize
1.7MB

MD5
71a3967861ea041495becd887d024604

SHA1
32cf581d11f15aea96ca4774adc45fc3cbd0b61c

SHA256
0a86bae86e0fdb245ab5a4ee2d46651e9917c42c65bc5648e5180b5378e09808

SHA512
a6d414de9de383dc374773001856595a5e2c5b1c81502dbddd6ede83467c4c53f55da69c5fa42f3661450bf3972cf77f508f8eb086bbf0920455d6113ae54e58

Download Submit
C:\Windows\System\nOEoLOI.exe

Filesize
1.7MB

MD5
5234fa67453a805b21cde3d816984e0a

SHA1
2a1e67220f0faf7faad8e0241e2f9b9f75f7f648

SHA256
0f377b2d7485c6340d7ebb2a1745cfb3d18259b2e9a74c30ada5bdd7a741fcbb

SHA512
91454998d349b4d6e5ca7cce1661d7eff93394f69039c4e69f75c6a13d4a3dfb03e8950adba6be80f5cda598ab869cdd447ade5c8c35dc993347cb7bb0caeaa1

Download Submit
C:\Windows\System\oIWfPwF.exe

Filesize
1.7MB

MD5
a6ed8cc67873748a36465a5d93048daf

SHA1
c1435bedf4e7d5a44387437f81638e76c5f72379

SHA256
80099b44aeff58691bba88d5dd158458edf6494bfb9893db2b1c1ef88fef51ab

SHA512
e808774dea2e575466155ddd6ddf2ab4a314551397e51ef29bba002fec92e7097326e04537274e0042f69d5deac5386d7b2cb50a12d156413111a304ac090be1

Download Submit
C:\Windows\System\qLLIbDV.exe

Filesize
1.7MB

MD5
c669c1c2aa7752a94ca96e4ebc2949f1

SHA1
98970569352b73146adeb61db9b5ff0c5764f348

SHA256
1bdfe0eaccf3b388fd519aae0301081cf5590a643ccdc2791842242e7afef554

SHA512
1311c8b456fa7728c7655652b73cf7a9274e64809ddc5a59d2b6afcda299906d6e1c0dc1d8295a0f9a173a5fe7b21c9761e1768798d4b2fde24b735847c37dbe

Download Submit
C:\Windows\System\sigcSvF.exe

Filesize
1.7MB

MD5
4872d079c0a91cf82fd439fb30ced863

SHA1
cd964bb77c4ce5be2524ee7ba1089638eee92ba0

SHA256
8c47acaf19edd216efeb95989c1e00d6d120fc1557e5badc4691307999c1ab4f

SHA512
0d379fe9e7043fff5196da144a9720fe64d78c5887ab30eaeb9e3b97f2d5b3bbb1fe3d061472051242543a88fa929a1bcd2d8c51bdeb28de476759b5ba373c7f

Download Submit
C:\Windows\System\uSWrkQR.exe

Filesize
1.7MB

MD5
56ab77599450f63f80edf6e13c250ad7

SHA1
16c534d4cfb952b12a9db376934b5d61ccdb0a76

SHA256
c683b9dc2d481a9bad21a4c8c69e2f5153efd1ad11510ed1654ac17bfe015386

SHA512
90b817427ad4ee7ee862f92090b9d71ae3ea7a804f863f032fdb72876bb9f9ea5b7b8407df55589ba4d070c3a57850ebaf84e7241d65e2000f4e850efc40eb04

Download Submit
C:\Windows\System\udhXvmG.exe

Filesize
1.7MB

MD5
ccd9dbaeae3ff0a9db7b7db4df61cbaf

SHA1
df4f36a9a027faffbb6b418e5cd0bc23291d9144

SHA256
f38a650e3a2f1322f20f2c54406d85bd69ec2b45eb0a9139e7c91aad7ec83e8a

SHA512
6a03b55e6f59a1f8e18e5bed193bcf7e71e6f406844c367e1894da65f699dc82a7a28b9694e660ebe79a929146b791ee737c8dd056c48565552325c0ef615706

Download Submit
C:\Windows\System\vpddVFW.exe

Filesize
1.7MB

MD5
f764a54e2953b2f887ec53d8124cb05a

SHA1
1bc1257388e1a8c3cab28e0b135e98a522b17262

SHA256
9d3cbdb885ab7670a0564ed07576c652d987139b59140b62de3563f7a7fcd438

SHA512
82ccb7632cb3e8073d467821fc6b18891539c9f86e32b1dac33b3730bf485876515f200a255db970befc39bc9c4900302ad430217b60e75ed6dc1d3b13d189fa

Download Submit
C:\Windows\System\xwNSbgd.exe

Filesize
1.7MB

MD5
db78516db635a4583de86a4bc865fe3b

SHA1
a197d20d1f94780378f4ae07b757a3532673e7d5

SHA256
139f697e66aa678c18a71cf10cd1e5a637412642313b24f5907b0a5b727df0f2

SHA512
90cb666dd3c8f491ea6508014f9fdd5875a024c190d64fc1c9e6ce64b0005b6526c4c16947522c7be047699a908a1826dc8af56618716fc1b5d8a0294dc0b942

Download Submit
C:\Windows\System\yBKWfzb.exe

Filesize
1.7MB

MD5
1d8e512b10a4b9189586d943c56007d2

SHA1
47093d6d3d8ff60b10de8e35ee85f964ec504f52

SHA256
8858976449ff802de5d5a3ae893cc8f2efad4f106c1ff7c694d3b7a8b92f53a7

SHA512
316a9f287ea4725f94efaeb902e5efb297bf008f8cc2d3d92cf560f3d3a5894971adb45e4342ec03530b0261644c463dec32f44bc534ce414595c584a0b817d0

Download Submit
C:\Windows\System\ywXCLRB.exe

Filesize
1.7MB

MD5
1d6cd695c7a70efb19a60208799a341f

SHA1
fd8253bc30b97da8a736059734871d77c4444b4a

SHA256
73c9d6cfadd376dc809c9066e3072d7d499aa18d69fab4a686be70751eaf7c65

SHA512
60e94d0f8c1a194fa8059d2362b84cf9faeb21787d5d01d77a179861a704d61077c3028834d829f7361e066dd2e59f57026870c61d3e8eee7f8cf557242abfe1

Download Submit
C:\Windows\System\zwQwZRs.exe

Filesize
1.7MB

MD5
1c9c15460fca84ecc38a6493f83ad9f2

SHA1
2ee47b513d8809c955c973130b96777917889af7

SHA256
130a59abf509b6fd0c91a6dcdc1d55fa5a142583b12deb5d5dd1e30a84f0a191

SHA512
c393f9fa0286d5b8566cef1ba32da084079fa320d69aa6dca1ccc01c0131d0cdd4d09f0810a26d0fb73874e0e4e454a1033f88456db79a69c27f04634c47bd2b

Download Submit
memory/632-324-0x00007FF65F7B0000-0x00007FF65FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/632-2685-0x00007FF65F7B0000-0x00007FF65FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1056-2681-0x00007FF711F60000-0x00007FF712352000-memory.dmp

Filesize
3.9MB

Download
memory/1056-17-0x00007FF711F60000-0x00007FF712352000-memory.dmp

Filesize
3.9MB

Download
memory/1108-2720-0x00007FF6A4880000-0x00007FF6A4C72000-memory.dmp

Filesize
3.9MB

Download
memory/1108-510-0x00007FF6A4880000-0x00007FF6A4C72000-memory.dmp

Filesize
3.9MB

Download
memory/1224-441-0x00007FF6A2840000-0x00007FF6A2C32000-memory.dmp

Filesize
3.9MB

Download
memory/1224-2699-0x00007FF6A2840000-0x00007FF6A2C32000-memory.dmp

Filesize
3.9MB

Download
memory/1300-502-0x00007FF702310000-0x00007FF702702000-memory.dmp

Filesize
3.9MB

Download
memory/1300-2714-0x00007FF702310000-0x00007FF702702000-memory.dmp

Filesize
3.9MB

Download
memory/1356-499-0x00007FF7AF7C0000-0x00007FF7AFBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1356-2698-0x00007FF7AF7C0000-0x00007FF7AFBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1488-162-0x00007FF6EA150000-0x00007FF6EA542000-memory.dmp

Filesize
3.9MB

Download
memory/1488-2690-0x00007FF6EA150000-0x00007FF6EA542000-memory.dmp

Filesize
3.9MB

Download
memory/1576-511-0x00007FF72F740000-0x00007FF72FB32000-memory.dmp

Filesize
3.9MB

Download
memory/1576-2752-0x00007FF72F740000-0x00007FF72FB32000-memory.dmp

Filesize
3.9MB

Download
memory/1756-2711-0x00007FF7EA360000-0x00007FF7EA752000-memory.dmp

Filesize
3.9MB

Download
memory/1756-503-0x00007FF7EA360000-0x00007FF7EA752000-memory.dmp

Filesize
3.9MB

Download
memory/2416-2731-0x00007FF796750000-0x00007FF796B42000-memory.dmp

Filesize
3.9MB

Download
memory/2416-513-0x00007FF796750000-0x00007FF796B42000-memory.dmp

Filesize
3.9MB

Download
memory/2916-2713-0x00007FF637200000-0x00007FF6375F2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-803-0x00007FF637200000-0x00007FF6375F2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-507-0x00007FF75D810000-0x00007FF75DC02000-memory.dmp

Filesize
3.9MB

Download
memory/2948-2691-0x00007FF75D810000-0x00007FF75DC02000-memory.dmp

Filesize
3.9MB

Download
memory/3368-1-0x000001A0FC660000-0x000001A0FC670000-memory.dmp

Filesize
64KB

Download
memory/3368-0-0x00007FF6ECE00000-0x00007FF6ED1F2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-500-0x00007FF77D1C0000-0x00007FF77D5B2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-2705-0x00007FF77D1C0000-0x00007FF77D5B2000-memory.dmp

Filesize
3.9MB

Download
memory/3628-2740-0x00007FF6A5C60000-0x00007FF6A6052000-memory.dmp

Filesize
3.9MB

Download
memory/3628-505-0x00007FF6A5C60000-0x00007FF6A6052000-memory.dmp

Filesize
3.9MB

Download
memory/3880-2754-0x00007FF7B7B20000-0x00007FF7B7F12000-memory.dmp

Filesize
3.9MB

Download
memory/3880-504-0x00007FF7B7B20000-0x00007FF7B7F12000-memory.dmp

Filesize
3.9MB

Download
memory/4100-2716-0x00007FF6A3400000-0x00007FF6A37F2000-memory.dmp

Filesize
3.9MB

Download
memory/4100-506-0x00007FF6A3400000-0x00007FF6A37F2000-memory.dmp

Filesize
3.9MB

Download
memory/4232-2683-0x00007FF633010000-0x00007FF633402000-memory.dmp

Filesize
3.9MB

Download
memory/4232-659-0x00007FF633010000-0x00007FF633402000-memory.dmp

Filesize
3.9MB

Download
memory/4304-281-0x00007FF732ED0000-0x00007FF7332C2000-memory.dmp

Filesize
3.9MB

Download
memory/4304-2693-0x00007FF732ED0000-0x00007FF7332C2000-memory.dmp

Filesize
3.9MB

Download
memory/4336-2703-0x00007FF7D9150000-0x00007FF7D9542000-memory.dmp

Filesize
3.9MB

Download
memory/4336-401-0x00007FF7D9150000-0x00007FF7D9542000-memory.dmp

Filesize
3.9MB

Download
memory/4364-2688-0x00007FF6F3970000-0x00007FF6F3D62000-memory.dmp

Filesize
3.9MB

Download
memory/4364-501-0x00007FF6F3970000-0x00007FF6F3D62000-memory.dmp

Filesize
3.9MB

Download
memory/4532-2724-0x00007FF60AC60000-0x00007FF60B052000-memory.dmp

Filesize
3.9MB

Download
memory/4532-512-0x00007FF60AC60000-0x00007FF60B052000-memory.dmp

Filesize
3.9MB

Download
memory/4820-121-0x00007FFCFFC70000-0x00007FFD00731000-memory.dmp

Filesize
10.8MB

Download
memory/4820-18-0x00007FFCFFC73000-0x00007FFCFFC75000-memory.dmp

Filesize
8KB

Download
memory/4820-399-0x000001EE72310000-0x000001EE72332000-memory.dmp

Filesize
136KB

Download
memory/4820-252-0x00007FFCFFC70000-0x00007FFD00731000-memory.dmp

Filesize
10.8MB

Download
memory/5004-2701-0x00007FF7D5C20000-0x00007FF7D6012000-memory.dmp

Filesize
3.9MB

Download
memory/5004-704-0x00007FF7D5C20000-0x00007FF7D6012000-memory.dmp

Filesize
3.9MB

Download
memory/5080-2695-0x00007FF7E33C0000-0x00007FF7E37B2000-memory.dmp

Filesize
3.9MB

Download
memory/5080-509-0x00007FF7E33C0000-0x00007FF7E37B2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-508-0x00007FF6E8060000-0x00007FF6E8452000-memory.dmp

Filesize
3.9MB

Download
memory/5100-2709-0x00007FF6E8060000-0x00007FF6E8452000-memory.dmp

Filesize
3.9MB

Download