xmrig | e80b8bea281fac909fe1193ba5eacad52508ed0161c89d2d9d4764e6959bf552

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
Size

1.6MB
MD5

5a8b61af55cbad96cf4d09b8e2418360
SHA1

64e0b901fc8fbbd045a909756d27a907c2d2ee61
SHA256

e80b8bea281fac909fe1193ba5eacad52508ed0161c89d2d9d4764e6959bf552
SHA512

4d41ab345d76f1871a97e94a48507bc85a674e81d5b3bf8ef8cc34213803841691eadf9e7a2dea481a068ac7f63f03b01bf3070e96519911827b8f5e06d28166
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098di:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1E+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/848-471-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp	xmrig
behavioral2/memory/4380-596-0x00007FF7215A0000-0x00007FF721992000-memory.dmp	xmrig
behavioral2/memory/4952-719-0x00007FF665A60000-0x00007FF665E52000-memory.dmp	xmrig
behavioral2/memory/4844-722-0x00007FF78F2C0000-0x00007FF78F6B2000-memory.dmp	xmrig
behavioral2/memory/1852-726-0x00007FF755C20000-0x00007FF756012000-memory.dmp	xmrig
behavioral2/memory/2656-731-0x00007FF61D220000-0x00007FF61D612000-memory.dmp	xmrig
behavioral2/memory/2088-730-0x00007FF69BD40000-0x00007FF69C132000-memory.dmp	xmrig
behavioral2/memory/5112-728-0x00007FF6D8870000-0x00007FF6D8C62000-memory.dmp	xmrig
behavioral2/memory/4516-727-0x00007FF68BBC0000-0x00007FF68BFB2000-memory.dmp	xmrig
behavioral2/memory/3948-725-0x00007FF67ECD0000-0x00007FF67F0C2000-memory.dmp	xmrig
behavioral2/memory/740-724-0x00007FF669F60000-0x00007FF66A352000-memory.dmp	xmrig
behavioral2/memory/4608-723-0x00007FF7FF650000-0x00007FF7FFA42000-memory.dmp	xmrig
behavioral2/memory/5056-721-0x00007FF6A6720000-0x00007FF6A6B12000-memory.dmp	xmrig
behavioral2/memory/3500-720-0x00007FF7F6C90000-0x00007FF7F7082000-memory.dmp	xmrig
behavioral2/memory/408-591-0x00007FF6A1CA0000-0x00007FF6A2092000-memory.dmp	xmrig
behavioral2/memory/2676-475-0x00007FF653AD0000-0x00007FF653EC2000-memory.dmp	xmrig
behavioral2/memory/1652-369-0x00007FF7CCC10000-0x00007FF7CD002000-memory.dmp	xmrig
behavioral2/memory/752-306-0x00007FF6A98C0000-0x00007FF6A9CB2000-memory.dmp	xmrig
behavioral2/memory/5084-246-0x00007FF6C4000000-0x00007FF6C43F2000-memory.dmp	xmrig
behavioral2/memory/4880-243-0x00007FF6573C0000-0x00007FF6577B2000-memory.dmp	xmrig
behavioral2/memory/428-194-0x00007FF7C4410000-0x00007FF7C4802000-memory.dmp	xmrig
behavioral2/memory/3556-181-0x00007FF7392A0000-0x00007FF739692000-memory.dmp	xmrig
behavioral2/memory/4848-128-0x00007FF6B2AB0000-0x00007FF6B2EA2000-memory.dmp	xmrig
behavioral2/memory/2364-99-0x00007FF6B6DD0000-0x00007FF6B71C2000-memory.dmp	xmrig
behavioral2/memory/2364-3818-0x00007FF6B6DD0000-0x00007FF6B71C2000-memory.dmp	xmrig
behavioral2/memory/2088-3820-0x00007FF69BD40000-0x00007FF69C132000-memory.dmp	xmrig
behavioral2/memory/4848-3824-0x00007FF6B2AB0000-0x00007FF6B2EA2000-memory.dmp	xmrig
behavioral2/memory/428-3826-0x00007FF7C4410000-0x00007FF7C4802000-memory.dmp	xmrig
behavioral2/memory/5084-3828-0x00007FF6C4000000-0x00007FF6C43F2000-memory.dmp	xmrig
behavioral2/memory/3556-3832-0x00007FF7392A0000-0x00007FF739692000-memory.dmp	xmrig
behavioral2/memory/752-3831-0x00007FF6A98C0000-0x00007FF6A9CB2000-memory.dmp	xmrig
behavioral2/memory/1652-3834-0x00007FF7CCC10000-0x00007FF7CD002000-memory.dmp	xmrig
behavioral2/memory/3948-3836-0x00007FF67ECD0000-0x00007FF67F0C2000-memory.dmp	xmrig
behavioral2/memory/4880-3839-0x00007FF6573C0000-0x00007FF6577B2000-memory.dmp	xmrig
behavioral2/memory/408-3840-0x00007FF6A1CA0000-0x00007FF6A2092000-memory.dmp	xmrig
behavioral2/memory/4844-3842-0x00007FF78F2C0000-0x00007FF78F6B2000-memory.dmp	xmrig
behavioral2/memory/4380-3844-0x00007FF7215A0000-0x00007FF721992000-memory.dmp	xmrig
behavioral2/memory/848-3847-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp	xmrig
behavioral2/memory/4952-3848-0x00007FF665A60000-0x00007FF665E52000-memory.dmp	xmrig
behavioral2/memory/2676-3850-0x00007FF653AD0000-0x00007FF653EC2000-memory.dmp	xmrig
behavioral2/memory/5056-3854-0x00007FF6A6720000-0x00007FF6A6B12000-memory.dmp	xmrig
behavioral2/memory/4608-3858-0x00007FF7FF650000-0x00007FF7FFA42000-memory.dmp	xmrig
behavioral2/memory/5112-3857-0x00007FF6D8870000-0x00007FF6D8C62000-memory.dmp	xmrig
behavioral2/memory/4516-3852-0x00007FF68BBC0000-0x00007FF68BFB2000-memory.dmp	xmrig
behavioral2/memory/2656-3863-0x00007FF61D220000-0x00007FF61D612000-memory.dmp	xmrig
behavioral2/memory/740-3865-0x00007FF669F60000-0x00007FF66A352000-memory.dmp	xmrig
behavioral2/memory/3500-3872-0x00007FF7F6C90000-0x00007FF7F7082000-memory.dmp	xmrig
behavioral2/memory/1852-3875-0x00007FF755C20000-0x00007FF756012000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1004	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2088	pIurETD.exe
2364	JxItxJo.exe
4848	CLheryI.exe
3556	hthtKPZ.exe
428	KtCsJTn.exe
4880	abcDEtU.exe
5084	GzBQxKu.exe
752	NfQPdAr.exe
1652	GXcxKTS.exe
848	kPDHfVk.exe
2676	pcEnESB.exe
408	miSXisT.exe
4380	ZQZiXxf.exe
4952	CNItSkb.exe
3500	DChnOKY.exe
5056	uPkdicG.exe
4844	VOJiSjB.exe
4608	IHpPvYf.exe
740	OqENMBJ.exe
3948	FJaSqoD.exe
2656	vyypZYn.exe
1852	ROScPdT.exe
4516	kWOFgMC.exe
5112	KoLPdWp.exe
4744	QqrMlNA.exe
4964	mgRaIsx.exe
4376	RTKcUoc.exe
3716	PawspFM.exe
3232	WdjhEVt.exe
3880	ijcwuHH.exe
2996	nrKAHLT.exe
3976	TBYUhyx.exe
2936	ICUINhO.exe
4876	GFHcIYd.exe
3048	NUkxbkr.exe
4616	ocqttdF.exe
2156	VtmQCkw.exe
4548	lDSKRkS.exe
1872	ADTkfta.exe
880	hkGCqBG.exe
1300	daFjAhf.exe
452	FbFJXzj.exe
1592	tqMlPTs.exe
3840	SJQhNzx.exe
3632	LyaiaaT.exe
4064	KBEaLco.exe
4976	HdbvuqU.exe
4544	QaJAPma.exe
3896	RDLDlXD.exe
4668	lhgddje.exe
3828	vMfneFU.exe
3580	GeemmWd.exe
1656	kEaPvWu.exe
4424	fjmnmvh.exe
3004	BugPUzC.exe
3980	xngvUaC.exe
4008	UJijOeR.exe
1756	XqVULVG.exe
1076	QybMqdR.exe
3916	xMDgrBC.exe
1356	ETrApru.exe
4256	kFJtemw.exe
4272	uZmlxBH.exe
1648	eJkTLgy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3744-0-0x00007FF6CE560000-0x00007FF6CE952000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-6.dat	upx
behavioral2/files/0x0007000000023401-41.dat	upx
behavioral2/files/0x0007000000023409-89.dat	upx
behavioral2/files/0x000700000002340a-90.dat	upx
behavioral2/files/0x0007000000023411-120.dat	upx
behavioral2/memory/848-471-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp	upx
behavioral2/memory/4380-596-0x00007FF7215A0000-0x00007FF721992000-memory.dmp	upx
behavioral2/memory/4952-719-0x00007FF665A60000-0x00007FF665E52000-memory.dmp	upx
behavioral2/memory/4844-722-0x00007FF78F2C0000-0x00007FF78F6B2000-memory.dmp	upx
behavioral2/memory/1852-726-0x00007FF755C20000-0x00007FF756012000-memory.dmp	upx
behavioral2/memory/2656-731-0x00007FF61D220000-0x00007FF61D612000-memory.dmp	upx
behavioral2/memory/2088-730-0x00007FF69BD40000-0x00007FF69C132000-memory.dmp	upx
behavioral2/memory/5112-728-0x00007FF6D8870000-0x00007FF6D8C62000-memory.dmp	upx
behavioral2/memory/4516-727-0x00007FF68BBC0000-0x00007FF68BFB2000-memory.dmp	upx
behavioral2/memory/3948-725-0x00007FF67ECD0000-0x00007FF67F0C2000-memory.dmp	upx
behavioral2/memory/740-724-0x00007FF669F60000-0x00007FF66A352000-memory.dmp	upx
behavioral2/memory/4608-723-0x00007FF7FF650000-0x00007FF7FFA42000-memory.dmp	upx
behavioral2/memory/5056-721-0x00007FF6A6720000-0x00007FF6A6B12000-memory.dmp	upx
behavioral2/memory/3500-720-0x00007FF7F6C90000-0x00007FF7F7082000-memory.dmp	upx
behavioral2/memory/408-591-0x00007FF6A1CA0000-0x00007FF6A2092000-memory.dmp	upx
behavioral2/memory/2676-475-0x00007FF653AD0000-0x00007FF653EC2000-memory.dmp	upx
behavioral2/memory/1652-369-0x00007FF7CCC10000-0x00007FF7CD002000-memory.dmp	upx
behavioral2/memory/752-306-0x00007FF6A98C0000-0x00007FF6A9CB2000-memory.dmp	upx
behavioral2/memory/5084-246-0x00007FF6C4000000-0x00007FF6C43F2000-memory.dmp	upx
behavioral2/memory/4880-243-0x00007FF6573C0000-0x00007FF6577B2000-memory.dmp	upx
behavioral2/files/0x000700000002341e-203.dat	upx
behavioral2/files/0x000700000002341d-200.dat	upx
behavioral2/memory/428-194-0x00007FF7C4410000-0x00007FF7C4802000-memory.dmp	upx
behavioral2/files/0x000700000002341c-191.dat	upx
behavioral2/files/0x0007000000023414-182.dat	upx
behavioral2/memory/3556-181-0x00007FF7392A0000-0x00007FF739692000-memory.dmp	upx
behavioral2/files/0x000700000002341b-178.dat	upx
behavioral2/files/0x0007000000023419-174.dat	upx
behavioral2/files/0x000700000002341a-173.dat	upx
behavioral2/files/0x0007000000023412-171.dat	upx
behavioral2/files/0x0007000000023418-168.dat	upx
behavioral2/files/0x0007000000023410-160.dat	upx
behavioral2/files/0x0007000000023417-159.dat	upx
behavioral2/files/0x000700000002340f-158.dat	upx
behavioral2/files/0x0007000000023416-151.dat	upx
behavioral2/files/0x0007000000023402-144.dat	upx
behavioral2/files/0x0007000000023405-136.dat	upx
behavioral2/files/0x0007000000023415-135.dat	upx
behavioral2/files/0x0007000000023404-133.dat	upx
behavioral2/memory/4848-128-0x00007FF6B2AB0000-0x00007FF6B2EA2000-memory.dmp	upx
behavioral2/files/0x0007000000023413-123.dat	upx
behavioral2/files/0x000700000002340e-114.dat	upx
behavioral2/files/0x0007000000023403-111.dat	upx
behavioral2/files/0x0007000000023407-147.dat	upx
behavioral2/files/0x000700000002340d-108.dat	upx
behavioral2/files/0x000700000002340c-107.dat	upx
behavioral2/memory/2364-99-0x00007FF6B6DD0000-0x00007FF6B71C2000-memory.dmp	upx
behavioral2/files/0x000700000002340b-97.dat	upx
behavioral2/files/0x0007000000023408-84.dat	upx
behavioral2/files/0x0007000000023400-79.dat	upx
behavioral2/files/0x0007000000023406-73.dat	upx
behavioral2/files/0x00070000000233ff-66.dat	upx
behavioral2/files/0x00070000000233fe-55.dat	upx
behavioral2/files/0x00070000000233fd-53.dat	upx
behavioral2/files/0x00070000000233fc-47.dat	upx
behavioral2/files/0x00070000000233fb-45.dat	upx
behavioral2/files/0x00080000000233f5-17.dat	upx
behavioral2/files/0x00070000000233f9-13.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mmQuCRp.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\CzPXlbb.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\pChysbj.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\NKWsfyZ.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\PGDOxlJ.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\zUrkseb.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\MXjpcXb.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\oCHnOPT.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\dXCiNmT.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\VmVisDM.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\hzgwSni.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\DwAwmdj.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\jFhPaOg.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\kMRtEpN.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\LLSgllG.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\cWXNdhr.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\SFNRUah.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\oSAtepx.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\oLUBNne.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\DRyHOXT.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\SInjbXp.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\wceMcnC.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\BNDfZEN.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\wXFsfwc.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\NTtrJhb.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\WBnaMnF.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\iwAskvh.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\RUhswDs.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\anUOhRT.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\NDKfgOx.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\VKkwEJS.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\RVzXNpL.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\PuzHBem.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\zgThwgM.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\PeTRFOd.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\AXUFbKs.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\ZHplDIB.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\UYOpfJE.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\ixcvtsC.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\hkqdKWs.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\AThoRSW.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\KOVIvTM.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\kmGwZst.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\WOhOHkj.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\IVCyVBD.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\zHtXyWj.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\wgepKFC.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\EPfMOCU.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\XOZJniB.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\fthQeph.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\vMfneFU.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\CMnGLjg.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\eUBFJrF.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\cEHxAZL.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\MbBmWEq.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\oaTmfHe.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\IsokIVJ.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\kXHBRKR.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\ljvrDHp.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\ZsLylYX.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\EAHfhoq.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\wKBwvbI.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\ICUINhO.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
File created	C:\Windows\System\cefgjXc.exe	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1004	powershell.exe
1004	powershell.exe
1004	powershell.exe
1004	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
Token: SeDebugPrivilege	1004	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 1004	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	83
PID 3744 wrote to memory of 1004	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	83
PID 3744 wrote to memory of 2088	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	84
PID 3744 wrote to memory of 2088	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	84
PID 3744 wrote to memory of 2364	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	85
PID 3744 wrote to memory of 2364	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	85
PID 3744 wrote to memory of 4848	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	86
PID 3744 wrote to memory of 4848	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	86
PID 3744 wrote to memory of 3556	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	87
PID 3744 wrote to memory of 3556	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	87
PID 3744 wrote to memory of 428	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	88
PID 3744 wrote to memory of 428	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	88
PID 3744 wrote to memory of 4880	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	89
PID 3744 wrote to memory of 4880	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	89
PID 3744 wrote to memory of 5084	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	90
PID 3744 wrote to memory of 5084	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	90
PID 3744 wrote to memory of 752	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	91
PID 3744 wrote to memory of 752	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	91
PID 3744 wrote to memory of 1652	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	92
PID 3744 wrote to memory of 1652	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	92
PID 3744 wrote to memory of 848	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	93
PID 3744 wrote to memory of 848	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	93
PID 3744 wrote to memory of 2676	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	94
PID 3744 wrote to memory of 2676	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	94
PID 3744 wrote to memory of 408	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	95
PID 3744 wrote to memory of 408	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	95
PID 3744 wrote to memory of 4380	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	96
PID 3744 wrote to memory of 4380	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	96
PID 3744 wrote to memory of 4952	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	97
PID 3744 wrote to memory of 4952	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	97
PID 3744 wrote to memory of 3500	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	98
PID 3744 wrote to memory of 3500	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	98
PID 3744 wrote to memory of 5056	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	99
PID 3744 wrote to memory of 5056	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	99
PID 3744 wrote to memory of 4844	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	100
PID 3744 wrote to memory of 4844	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	100
PID 3744 wrote to memory of 4608	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	101
PID 3744 wrote to memory of 4608	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	101
PID 3744 wrote to memory of 740	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	102
PID 3744 wrote to memory of 740	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	102
PID 3744 wrote to memory of 3948	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	103
PID 3744 wrote to memory of 3948	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	103
PID 3744 wrote to memory of 2656	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	104
PID 3744 wrote to memory of 2656	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	104
PID 3744 wrote to memory of 1852	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	105
PID 3744 wrote to memory of 1852	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	105
PID 3744 wrote to memory of 4516	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	106
PID 3744 wrote to memory of 4516	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	106
PID 3744 wrote to memory of 5112	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	107
PID 3744 wrote to memory of 5112	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	107
PID 3744 wrote to memory of 2996	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	108
PID 3744 wrote to memory of 2996	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	108
PID 3744 wrote to memory of 4744	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	109
PID 3744 wrote to memory of 4744	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	109
PID 3744 wrote to memory of 2936	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	110
PID 3744 wrote to memory of 2936	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	110
PID 3744 wrote to memory of 4964	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	111
PID 3744 wrote to memory of 4964	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	111
PID 3744 wrote to memory of 4376	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	112
PID 3744 wrote to memory of 4376	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	112
PID 3744 wrote to memory of 3716	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	113
PID 3744 wrote to memory of 3716	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	113
PID 3744 wrote to memory of 3232	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	114
PID 3744 wrote to memory of 3232	3744	5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5a8b61af55cbad96cf4d09b8e2418360_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\System\pIurETD.exe
  C:\Windows\System\pIurETD.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\JxItxJo.exe
  C:\Windows\System\JxItxJo.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\CLheryI.exe
  C:\Windows\System\CLheryI.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\hthtKPZ.exe
  C:\Windows\System\hthtKPZ.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\KtCsJTn.exe
  C:\Windows\System\KtCsJTn.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\abcDEtU.exe
  C:\Windows\System\abcDEtU.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\GzBQxKu.exe
  C:\Windows\System\GzBQxKu.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\NfQPdAr.exe
  C:\Windows\System\NfQPdAr.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\GXcxKTS.exe
  C:\Windows\System\GXcxKTS.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\kPDHfVk.exe
  C:\Windows\System\kPDHfVk.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\pcEnESB.exe
  C:\Windows\System\pcEnESB.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\miSXisT.exe
  C:\Windows\System\miSXisT.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\ZQZiXxf.exe
  C:\Windows\System\ZQZiXxf.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\CNItSkb.exe
  C:\Windows\System\CNItSkb.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\DChnOKY.exe
  C:\Windows\System\DChnOKY.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\uPkdicG.exe
  C:\Windows\System\uPkdicG.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\VOJiSjB.exe
  C:\Windows\System\VOJiSjB.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\IHpPvYf.exe
  C:\Windows\System\IHpPvYf.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\OqENMBJ.exe
  C:\Windows\System\OqENMBJ.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\FJaSqoD.exe
  C:\Windows\System\FJaSqoD.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\vyypZYn.exe
  C:\Windows\System\vyypZYn.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ROScPdT.exe
  C:\Windows\System\ROScPdT.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\kWOFgMC.exe
  C:\Windows\System\kWOFgMC.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\KoLPdWp.exe
  C:\Windows\System\KoLPdWp.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\nrKAHLT.exe
  C:\Windows\System\nrKAHLT.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\QqrMlNA.exe
  C:\Windows\System\QqrMlNA.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\ICUINhO.exe
  C:\Windows\System\ICUINhO.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\mgRaIsx.exe
  C:\Windows\System\mgRaIsx.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\RTKcUoc.exe
  C:\Windows\System\RTKcUoc.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\PawspFM.exe
  C:\Windows\System\PawspFM.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\WdjhEVt.exe
  C:\Windows\System\WdjhEVt.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\ijcwuHH.exe
  C:\Windows\System\ijcwuHH.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\TBYUhyx.exe
  C:\Windows\System\TBYUhyx.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\GFHcIYd.exe
  C:\Windows\System\GFHcIYd.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\NUkxbkr.exe
  C:\Windows\System\NUkxbkr.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\ocqttdF.exe
  C:\Windows\System\ocqttdF.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\VtmQCkw.exe
  C:\Windows\System\VtmQCkw.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\lDSKRkS.exe
  C:\Windows\System\lDSKRkS.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\ADTkfta.exe
  C:\Windows\System\ADTkfta.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\hkGCqBG.exe
  C:\Windows\System\hkGCqBG.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\daFjAhf.exe
  C:\Windows\System\daFjAhf.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\FbFJXzj.exe
  C:\Windows\System\FbFJXzj.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\tqMlPTs.exe
  C:\Windows\System\tqMlPTs.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\SJQhNzx.exe
  C:\Windows\System\SJQhNzx.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\LyaiaaT.exe
  C:\Windows\System\LyaiaaT.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\KBEaLco.exe
  C:\Windows\System\KBEaLco.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\HdbvuqU.exe
  C:\Windows\System\HdbvuqU.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\QaJAPma.exe
  C:\Windows\System\QaJAPma.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\RDLDlXD.exe
  C:\Windows\System\RDLDlXD.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\lhgddje.exe
  C:\Windows\System\lhgddje.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\exYtdDe.exe
  C:\Windows\System\exYtdDe.exe
  2⤵
  PID:2652
- C:\Windows\System\vMfneFU.exe
  C:\Windows\System\vMfneFU.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\GeemmWd.exe
  C:\Windows\System\GeemmWd.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\aVKCFZN.exe
  C:\Windows\System\aVKCFZN.exe
  2⤵
  PID:1280
- C:\Windows\System\kEaPvWu.exe
  C:\Windows\System\kEaPvWu.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\fjmnmvh.exe
  C:\Windows\System\fjmnmvh.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\BugPUzC.exe
  C:\Windows\System\BugPUzC.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\xngvUaC.exe
  C:\Windows\System\xngvUaC.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\UJijOeR.exe
  C:\Windows\System\UJijOeR.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\XqVULVG.exe
  C:\Windows\System\XqVULVG.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\QybMqdR.exe
  C:\Windows\System\QybMqdR.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\xMDgrBC.exe
  C:\Windows\System\xMDgrBC.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\ETrApru.exe
  C:\Windows\System\ETrApru.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\kFJtemw.exe
  C:\Windows\System\kFJtemw.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\uZmlxBH.exe
  C:\Windows\System\uZmlxBH.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\eJkTLgy.exe
  C:\Windows\System\eJkTLgy.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\KEbmsmi.exe
  C:\Windows\System\KEbmsmi.exe
  2⤵
  PID:3128
- C:\Windows\System\zrJGCWu.exe
  C:\Windows\System\zrJGCWu.exe
  2⤵
  PID:3364
- C:\Windows\System\RYnksDM.exe
  C:\Windows\System\RYnksDM.exe
  2⤵
  PID:2144
- C:\Windows\System\pbadhSu.exe
  C:\Windows\System\pbadhSu.exe
  2⤵
  PID:2532
- C:\Windows\System\FVZzDzq.exe
  C:\Windows\System\FVZzDzq.exe
  2⤵
  PID:4940
- C:\Windows\System\afcBOgG.exe
  C:\Windows\System\afcBOgG.exe
  2⤵
  PID:1084
- C:\Windows\System\BdROtMO.exe
  C:\Windows\System\BdROtMO.exe
  2⤵
  PID:4348
- C:\Windows\System\SSOYSaS.exe
  C:\Windows\System\SSOYSaS.exe
  2⤵
  PID:4392
- C:\Windows\System\fOhAhAT.exe
  C:\Windows\System\fOhAhAT.exe
  2⤵
  PID:3836
- C:\Windows\System\amPhiwn.exe
  C:\Windows\System\amPhiwn.exe
  2⤵
  PID:3096
- C:\Windows\System\XIoaxTb.exe
  C:\Windows\System\XIoaxTb.exe
  2⤵
  PID:3188
- C:\Windows\System\TJPdsYT.exe
  C:\Windows\System\TJPdsYT.exe
  2⤵
  PID:2900
- C:\Windows\System\KOVIvTM.exe
  C:\Windows\System\KOVIvTM.exe
  2⤵
  PID:1036
- C:\Windows\System\tmoGWxn.exe
  C:\Windows\System\tmoGWxn.exe
  2⤵
  PID:4280
- C:\Windows\System\Hwdespb.exe
  C:\Windows\System\Hwdespb.exe
  2⤵
  PID:1568
- C:\Windows\System\wwLLHJu.exe
  C:\Windows\System\wwLLHJu.exe
  2⤵
  PID:2160
- C:\Windows\System\kmGwZst.exe
  C:\Windows\System\kmGwZst.exe
  2⤵
  PID:5132
- C:\Windows\System\sxgXzig.exe
  C:\Windows\System\sxgXzig.exe
  2⤵
  PID:5148
- C:\Windows\System\wCQFtIc.exe
  C:\Windows\System\wCQFtIc.exe
  2⤵
  PID:5168
- C:\Windows\System\lWsvgLv.exe
  C:\Windows\System\lWsvgLv.exe
  2⤵
  PID:5192
- C:\Windows\System\tNuTzOB.exe
  C:\Windows\System\tNuTzOB.exe
  2⤵
  PID:5208
- C:\Windows\System\TlpDhoA.exe
  C:\Windows\System\TlpDhoA.exe
  2⤵
  PID:5236
- C:\Windows\System\UesEnVq.exe
  C:\Windows\System\UesEnVq.exe
  2⤵
  PID:5252
- C:\Windows\System\XPglQzj.exe
  C:\Windows\System\XPglQzj.exe
  2⤵
  PID:5276
- C:\Windows\System\PRLABpB.exe
  C:\Windows\System\PRLABpB.exe
  2⤵
  PID:5292
- C:\Windows\System\ZJLTyGE.exe
  C:\Windows\System\ZJLTyGE.exe
  2⤵
  PID:5316
- C:\Windows\System\zDjywDM.exe
  C:\Windows\System\zDjywDM.exe
  2⤵
  PID:5340
- C:\Windows\System\SPsLnHX.exe
  C:\Windows\System\SPsLnHX.exe
  2⤵
  PID:5364
- C:\Windows\System\zpNPuEY.exe
  C:\Windows\System\zpNPuEY.exe
  2⤵
  PID:5396
- C:\Windows\System\ktRiHsz.exe
  C:\Windows\System\ktRiHsz.exe
  2⤵
  PID:5424
- C:\Windows\System\MFRrEXX.exe
  C:\Windows\System\MFRrEXX.exe
  2⤵
  PID:5448
- C:\Windows\System\YYJvoMe.exe
  C:\Windows\System\YYJvoMe.exe
  2⤵
  PID:5468
- C:\Windows\System\TYUffTI.exe
  C:\Windows\System\TYUffTI.exe
  2⤵
  PID:5492
- C:\Windows\System\XkXXCDt.exe
  C:\Windows\System\XkXXCDt.exe
  2⤵
  PID:5508
- C:\Windows\System\PuzHBem.exe
  C:\Windows\System\PuzHBem.exe
  2⤵
  PID:5528
- C:\Windows\System\FClJgZT.exe
  C:\Windows\System\FClJgZT.exe
  2⤵
  PID:5564
- C:\Windows\System\JBpyhrl.exe
  C:\Windows\System\JBpyhrl.exe
  2⤵
  PID:5588
- C:\Windows\System\nQoOidc.exe
  C:\Windows\System\nQoOidc.exe
  2⤵
  PID:5616
- C:\Windows\System\yUWzbjm.exe
  C:\Windows\System\yUWzbjm.exe
  2⤵
  PID:5632
- C:\Windows\System\zfgOPKi.exe
  C:\Windows\System\zfgOPKi.exe
  2⤵
  PID:5648
- C:\Windows\System\DkRWBQf.exe
  C:\Windows\System\DkRWBQf.exe
  2⤵
  PID:5676
- C:\Windows\System\ehoulsJ.exe
  C:\Windows\System\ehoulsJ.exe
  2⤵
  PID:5700
- C:\Windows\System\jNeragq.exe
  C:\Windows\System\jNeragq.exe
  2⤵
  PID:5720
- C:\Windows\System\pWyOYtY.exe
  C:\Windows\System\pWyOYtY.exe
  2⤵
  PID:5744
- C:\Windows\System\bsfwVbm.exe
  C:\Windows\System\bsfwVbm.exe
  2⤵
  PID:5764
- C:\Windows\System\rCBNMlU.exe
  C:\Windows\System\rCBNMlU.exe
  2⤵
  PID:5784
- C:\Windows\System\PyAXIAH.exe
  C:\Windows\System\PyAXIAH.exe
  2⤵
  PID:5808
- C:\Windows\System\DIUfIwr.exe
  C:\Windows\System\DIUfIwr.exe
  2⤵
  PID:5828
- C:\Windows\System\iMkzVWu.exe
  C:\Windows\System\iMkzVWu.exe
  2⤵
  PID:5848
- C:\Windows\System\OqpdJaz.exe
  C:\Windows\System\OqpdJaz.exe
  2⤵
  PID:5868
- C:\Windows\System\mCEmuYr.exe
  C:\Windows\System\mCEmuYr.exe
  2⤵
  PID:5888
- C:\Windows\System\vYZGETX.exe
  C:\Windows\System\vYZGETX.exe
  2⤵
  PID:5920
- C:\Windows\System\HDRAmad.exe
  C:\Windows\System\HDRAmad.exe
  2⤵
  PID:5940
- C:\Windows\System\xXeodFf.exe
  C:\Windows\System\xXeodFf.exe
  2⤵
  PID:5960
- C:\Windows\System\ZxShIul.exe
  C:\Windows\System\ZxShIul.exe
  2⤵
  PID:5980
- C:\Windows\System\oRlLjzH.exe
  C:\Windows\System\oRlLjzH.exe
  2⤵
  PID:6004
- C:\Windows\System\yharblF.exe
  C:\Windows\System\yharblF.exe
  2⤵
  PID:6020
- C:\Windows\System\sPpTUcJ.exe
  C:\Windows\System\sPpTUcJ.exe
  2⤵
  PID:6044
- C:\Windows\System\naVPVgo.exe
  C:\Windows\System\naVPVgo.exe
  2⤵
  PID:6076
- C:\Windows\System\yVmORcx.exe
  C:\Windows\System\yVmORcx.exe
  2⤵
  PID:6092
- C:\Windows\System\VifrMca.exe
  C:\Windows\System\VifrMca.exe
  2⤵
  PID:6140
- C:\Windows\System\KYmnIJJ.exe
  C:\Windows\System\KYmnIJJ.exe
  2⤵
  PID:2928
- C:\Windows\System\njwhCZs.exe
  C:\Windows\System\njwhCZs.exe
  2⤵
  PID:1788
- C:\Windows\System\pzYYDkq.exe
  C:\Windows\System\pzYYDkq.exe
  2⤵
  PID:540
- C:\Windows\System\WbWtPui.exe
  C:\Windows\System\WbWtPui.exe
  2⤵
  PID:3020
- C:\Windows\System\zgThwgM.exe
  C:\Windows\System\zgThwgM.exe
  2⤵
  PID:1212
- C:\Windows\System\aXADjYT.exe
  C:\Windows\System\aXADjYT.exe
  2⤵
  PID:3808
- C:\Windows\System\FIPpeDU.exe
  C:\Windows\System\FIPpeDU.exe
  2⤵
  PID:224
- C:\Windows\System\tjLMsqt.exe
  C:\Windows\System\tjLMsqt.exe
  2⤵
  PID:412
- C:\Windows\System\SWkqthz.exe
  C:\Windows\System\SWkqthz.exe
  2⤵
  PID:2620
- C:\Windows\System\xkZacnB.exe
  C:\Windows\System\xkZacnB.exe
  2⤵
  PID:2744
- C:\Windows\System\PkYKyzG.exe
  C:\Windows\System\PkYKyzG.exe
  2⤵
  PID:1304
- C:\Windows\System\kmxdEPm.exe
  C:\Windows\System\kmxdEPm.exe
  2⤵
  PID:1456
- C:\Windows\System\ACCZOGD.exe
  C:\Windows\System\ACCZOGD.exe
  2⤵
  PID:2600
- C:\Windows\System\RyWVQtZ.exe
  C:\Windows\System\RyWVQtZ.exe
  2⤵
  PID:5048
- C:\Windows\System\EaFkJzH.exe
  C:\Windows\System\EaFkJzH.exe
  2⤵
  PID:4680
- C:\Windows\System\KDqDUUs.exe
  C:\Windows\System\KDqDUUs.exe
  2⤵
  PID:5664
- C:\Windows\System\ETIbvHl.exe
  C:\Windows\System\ETIbvHl.exe
  2⤵
  PID:5752
- C:\Windows\System\FWbTUum.exe
  C:\Windows\System\FWbTUum.exe
  2⤵
  PID:5164
- C:\Windows\System\DDJukKm.exe
  C:\Windows\System\DDJukKm.exe
  2⤵
  PID:6156
- C:\Windows\System\RUhswDs.exe
  C:\Windows\System\RUhswDs.exe
  2⤵
  PID:6176
- C:\Windows\System\nQUtcXi.exe
  C:\Windows\System\nQUtcXi.exe
  2⤵
  PID:6196
- C:\Windows\System\wgepKFC.exe
  C:\Windows\System\wgepKFC.exe
  2⤵
  PID:6224
- C:\Windows\System\DnMQwYr.exe
  C:\Windows\System\DnMQwYr.exe
  2⤵
  PID:6248
- C:\Windows\System\LEgilen.exe
  C:\Windows\System\LEgilen.exe
  2⤵
  PID:6268
- C:\Windows\System\CITzGqq.exe
  C:\Windows\System\CITzGqq.exe
  2⤵
  PID:6284
- C:\Windows\System\iWpGimU.exe
  C:\Windows\System\iWpGimU.exe
  2⤵
  PID:6308
- C:\Windows\System\maehbLp.exe
  C:\Windows\System\maehbLp.exe
  2⤵
  PID:6332
- C:\Windows\System\JvfYbmK.exe
  C:\Windows\System\JvfYbmK.exe
  2⤵
  PID:6352
- C:\Windows\System\BabxmOD.exe
  C:\Windows\System\BabxmOD.exe
  2⤵
  PID:6380
- C:\Windows\System\lWjjVnu.exe
  C:\Windows\System\lWjjVnu.exe
  2⤵
  PID:6396
- C:\Windows\System\edVUZfe.exe
  C:\Windows\System\edVUZfe.exe
  2⤵
  PID:6420
- C:\Windows\System\wCWfaAO.exe
  C:\Windows\System\wCWfaAO.exe
  2⤵
  PID:6440
- C:\Windows\System\qCecWRa.exe
  C:\Windows\System\qCecWRa.exe
  2⤵
  PID:6460
- C:\Windows\System\iZtYjCm.exe
  C:\Windows\System\iZtYjCm.exe
  2⤵
  PID:6480
- C:\Windows\System\JObXCwV.exe
  C:\Windows\System\JObXCwV.exe
  2⤵
  PID:6504
- C:\Windows\System\IakIsEE.exe
  C:\Windows\System\IakIsEE.exe
  2⤵
  PID:6520
- C:\Windows\System\skmveQU.exe
  C:\Windows\System\skmveQU.exe
  2⤵
  PID:6544
- C:\Windows\System\LSQaVxr.exe
  C:\Windows\System\LSQaVxr.exe
  2⤵
  PID:6568
- C:\Windows\System\eFfNuFX.exe
  C:\Windows\System\eFfNuFX.exe
  2⤵
  PID:6596
- C:\Windows\System\cDSaJjF.exe
  C:\Windows\System\cDSaJjF.exe
  2⤵
  PID:6628
- C:\Windows\System\BtqhgaU.exe
  C:\Windows\System\BtqhgaU.exe
  2⤵
  PID:6644
- C:\Windows\System\dEAZRLu.exe
  C:\Windows\System\dEAZRLu.exe
  2⤵
  PID:6664
- C:\Windows\System\vmvfzJL.exe
  C:\Windows\System\vmvfzJL.exe
  2⤵
  PID:6712
- C:\Windows\System\zKurwFQ.exe
  C:\Windows\System\zKurwFQ.exe
  2⤵
  PID:6728
- C:\Windows\System\ipClwYV.exe
  C:\Windows\System\ipClwYV.exe
  2⤵
  PID:6752
- C:\Windows\System\CKbYzCr.exe
  C:\Windows\System\CKbYzCr.exe
  2⤵
  PID:6768
- C:\Windows\System\hDeLtRk.exe
  C:\Windows\System\hDeLtRk.exe
  2⤵
  PID:6788
- C:\Windows\System\MjJoQCR.exe
  C:\Windows\System\MjJoQCR.exe
  2⤵
  PID:6808
- C:\Windows\System\hIWCRFE.exe
  C:\Windows\System\hIWCRFE.exe
  2⤵
  PID:6828
- C:\Windows\System\CvOtOUQ.exe
  C:\Windows\System\CvOtOUQ.exe
  2⤵
  PID:6852
- C:\Windows\System\EvwoQVr.exe
  C:\Windows\System\EvwoQVr.exe
  2⤵
  PID:6872
- C:\Windows\System\hVgUOuc.exe
  C:\Windows\System\hVgUOuc.exe
  2⤵
  PID:6896
- C:\Windows\System\mkqULWr.exe
  C:\Windows\System\mkqULWr.exe
  2⤵
  PID:6916
- C:\Windows\System\iiOuzvz.exe
  C:\Windows\System\iiOuzvz.exe
  2⤵
  PID:6932
- C:\Windows\System\RTHgpIe.exe
  C:\Windows\System\RTHgpIe.exe
  2⤵
  PID:6952
- C:\Windows\System\siPezAb.exe
  C:\Windows\System\siPezAb.exe
  2⤵
  PID:6976
- C:\Windows\System\ONeGUDQ.exe
  C:\Windows\System\ONeGUDQ.exe
  2⤵
  PID:7004
- C:\Windows\System\WOhOHkj.exe
  C:\Windows\System\WOhOHkj.exe
  2⤵
  PID:7020
- C:\Windows\System\RurrPlB.exe
  C:\Windows\System\RurrPlB.exe
  2⤵
  PID:7040
- C:\Windows\System\nMyHpFg.exe
  C:\Windows\System\nMyHpFg.exe
  2⤵
  PID:7060
- C:\Windows\System\fVABkNI.exe
  C:\Windows\System\fVABkNI.exe
  2⤵
  PID:7084
- C:\Windows\System\mosGEcB.exe
  C:\Windows\System\mosGEcB.exe
  2⤵
  PID:7100
- C:\Windows\System\UYOpfJE.exe
  C:\Windows\System\UYOpfJE.exe
  2⤵
  PID:7128
- C:\Windows\System\guFYTUC.exe
  C:\Windows\System\guFYTUC.exe
  2⤵
  PID:7148
- C:\Windows\System\HuvVkdV.exe
  C:\Windows\System\HuvVkdV.exe
  2⤵
  PID:5792
- C:\Windows\System\SOsXqHh.exe
  C:\Windows\System\SOsXqHh.exe
  2⤵
  PID:5104
- C:\Windows\System\EUMOrAo.exe
  C:\Windows\System\EUMOrAo.exe
  2⤵
  PID:2536
- C:\Windows\System\hFYACiR.exe
  C:\Windows\System\hFYACiR.exe
  2⤵
  PID:3036
- C:\Windows\System\kjQCyAS.exe
  C:\Windows\System\kjQCyAS.exe
  2⤵
  PID:5936
- C:\Windows\System\HslSjlJ.exe
  C:\Windows\System\HslSjlJ.exe
  2⤵
  PID:3244
- C:\Windows\System\bGVGBSW.exe
  C:\Windows\System\bGVGBSW.exe
  2⤵
  PID:6088
- C:\Windows\System\iWznsDk.exe
  C:\Windows\System\iWznsDk.exe
  2⤵
  PID:2336
- C:\Windows\System\QXkXJaL.exe
  C:\Windows\System\QXkXJaL.exe
  2⤵
  PID:4508
- C:\Windows\System\KzzfFQh.exe
  C:\Windows\System\KzzfFQh.exe
  2⤵
  PID:5600
- C:\Windows\System\bErmPVU.exe
  C:\Windows\System\bErmPVU.exe
  2⤵
  PID:3352
- C:\Windows\System\UoeJMKs.exe
  C:\Windows\System\UoeJMKs.exe
  2⤵
  PID:4352
- C:\Windows\System\DDIPlED.exe
  C:\Windows\System\DDIPlED.exe
  2⤵
  PID:5128
- C:\Windows\System\JHREUoA.exe
  C:\Windows\System\JHREUoA.exe
  2⤵
  PID:5488
- C:\Windows\System\PIQzBEf.exe
  C:\Windows\System\PIQzBEf.exe
  2⤵
  PID:2084
- C:\Windows\System\IpBXgWk.exe
  C:\Windows\System\IpBXgWk.exe
  2⤵
  PID:5184
- C:\Windows\System\erhfuBO.exe
  C:\Windows\System\erhfuBO.exe
  2⤵
  PID:6164
- C:\Windows\System\lFnWYZp.exe
  C:\Windows\System\lFnWYZp.exe
  2⤵
  PID:5264
- C:\Windows\System\yxrRrHV.exe
  C:\Windows\System\yxrRrHV.exe
  2⤵
  PID:5300
- C:\Windows\System\SInjbXp.exe
  C:\Windows\System\SInjbXp.exe
  2⤵
  PID:5348
- C:\Windows\System\jdxFXCw.exe
  C:\Windows\System\jdxFXCw.exe
  2⤵
  PID:6448
- C:\Windows\System\AxgJnyn.exe
  C:\Windows\System\AxgJnyn.exe
  2⤵
  PID:5408
- C:\Windows\System\ZBSvXYT.exe
  C:\Windows\System\ZBSvXYT.exe
  2⤵
  PID:6100
- C:\Windows\System\zFhfKqS.exe
  C:\Windows\System\zFhfKqS.exe
  2⤵
  PID:5484
- C:\Windows\System\dihOsMG.exe
  C:\Windows\System\dihOsMG.exe
  2⤵
  PID:7180
- C:\Windows\System\RTjlRFT.exe
  C:\Windows\System\RTjlRFT.exe
  2⤵
  PID:7204
- C:\Windows\System\vYcMbbg.exe
  C:\Windows\System\vYcMbbg.exe
  2⤵
  PID:7220
- C:\Windows\System\BbnLSsm.exe
  C:\Windows\System\BbnLSsm.exe
  2⤵
  PID:7240
- C:\Windows\System\CwJRGBe.exe
  C:\Windows\System\CwJRGBe.exe
  2⤵
  PID:7260
- C:\Windows\System\lrUYzTu.exe
  C:\Windows\System\lrUYzTu.exe
  2⤵
  PID:7276
- C:\Windows\System\DERiyeJ.exe
  C:\Windows\System\DERiyeJ.exe
  2⤵
  PID:7300
- C:\Windows\System\fwZhGwc.exe
  C:\Windows\System\fwZhGwc.exe
  2⤵
  PID:7320
- C:\Windows\System\PxsRqUC.exe
  C:\Windows\System\PxsRqUC.exe
  2⤵
  PID:7344
- C:\Windows\System\deyaoMl.exe
  C:\Windows\System\deyaoMl.exe
  2⤵
  PID:7364
- C:\Windows\System\SmSJpBG.exe
  C:\Windows\System\SmSJpBG.exe
  2⤵
  PID:7380
- C:\Windows\System\EIJhFtB.exe
  C:\Windows\System\EIJhFtB.exe
  2⤵
  PID:7400
- C:\Windows\System\llfppcI.exe
  C:\Windows\System\llfppcI.exe
  2⤵
  PID:7420
- C:\Windows\System\HAuBqcB.exe
  C:\Windows\System\HAuBqcB.exe
  2⤵
  PID:7440
- C:\Windows\System\wBbnjTD.exe
  C:\Windows\System\wBbnjTD.exe
  2⤵
  PID:7460
- C:\Windows\System\UyVzxuY.exe
  C:\Windows\System\UyVzxuY.exe
  2⤵
  PID:7484
- C:\Windows\System\NWQcusD.exe
  C:\Windows\System\NWQcusD.exe
  2⤵
  PID:7508
- C:\Windows\System\cnRhaiV.exe
  C:\Windows\System\cnRhaiV.exe
  2⤵
  PID:7528
- C:\Windows\System\bjikplq.exe
  C:\Windows\System\bjikplq.exe
  2⤵
  PID:7544
- C:\Windows\System\nhvTszD.exe
  C:\Windows\System\nhvTszD.exe
  2⤵
  PID:7564
- C:\Windows\System\UCHJzWx.exe
  C:\Windows\System\UCHJzWx.exe
  2⤵
  PID:7588
- C:\Windows\System\caQlSZC.exe
  C:\Windows\System\caQlSZC.exe
  2⤵
  PID:7608
- C:\Windows\System\uZxNlIo.exe
  C:\Windows\System\uZxNlIo.exe
  2⤵
  PID:7628
- C:\Windows\System\SjihBgH.exe
  C:\Windows\System\SjihBgH.exe
  2⤵
  PID:7652
- C:\Windows\System\bBmOMep.exe
  C:\Windows\System\bBmOMep.exe
  2⤵
  PID:7668
- C:\Windows\System\qIHNrLR.exe
  C:\Windows\System\qIHNrLR.exe
  2⤵
  PID:7700
- C:\Windows\System\AQYNBDp.exe
  C:\Windows\System\AQYNBDp.exe
  2⤵
  PID:7716
- C:\Windows\System\cRpNgSI.exe
  C:\Windows\System\cRpNgSI.exe
  2⤵
  PID:7740
- C:\Windows\System\fzhlMQz.exe
  C:\Windows\System\fzhlMQz.exe
  2⤵
  PID:7756
- C:\Windows\System\BgouObZ.exe
  C:\Windows\System\BgouObZ.exe
  2⤵
  PID:7780
- C:\Windows\System\MAqgmfg.exe
  C:\Windows\System\MAqgmfg.exe
  2⤵
  PID:7796
- C:\Windows\System\GLiyMYW.exe
  C:\Windows\System\GLiyMYW.exe
  2⤵
  PID:7824
- C:\Windows\System\KOezpCX.exe
  C:\Windows\System\KOezpCX.exe
  2⤵
  PID:7840
- C:\Windows\System\UDaMRhu.exe
  C:\Windows\System\UDaMRhu.exe
  2⤵
  PID:7860
- C:\Windows\System\CNpSovO.exe
  C:\Windows\System\CNpSovO.exe
  2⤵
  PID:7880
- C:\Windows\System\XudyNtk.exe
  C:\Windows\System\XudyNtk.exe
  2⤵
  PID:7904
- C:\Windows\System\fbVzDtX.exe
  C:\Windows\System\fbVzDtX.exe
  2⤵
  PID:7924
- C:\Windows\System\MgPYlUJ.exe
  C:\Windows\System\MgPYlUJ.exe
  2⤵
  PID:7956
- C:\Windows\System\kORSXFT.exe
  C:\Windows\System\kORSXFT.exe
  2⤵
  PID:7972
- C:\Windows\System\fKJSUTj.exe
  C:\Windows\System\fKJSUTj.exe
  2⤵
  PID:8160
- C:\Windows\System\UjJqkey.exe
  C:\Windows\System\UjJqkey.exe
  2⤵
  PID:8176
- C:\Windows\System\xGrSNMK.exe
  C:\Windows\System\xGrSNMK.exe
  2⤵
  PID:5536
- C:\Windows\System\CkkeAdE.exe
  C:\Windows\System\CkkeAdE.exe
  2⤵
  PID:6744
- C:\Windows\System\zCzXeId.exe
  C:\Windows\System\zCzXeId.exe
  2⤵
  PID:4916
- C:\Windows\System\fGOcbwQ.exe
  C:\Windows\System\fGOcbwQ.exe
  2⤵
  PID:6864
- C:\Windows\System\yArUhCQ.exe
  C:\Windows\System\yArUhCQ.exe
  2⤵
  PID:780
- C:\Windows\System\xUyRQUN.exe
  C:\Windows\System\xUyRQUN.exe
  2⤵
  PID:5712
- C:\Windows\System\slNfMgA.exe
  C:\Windows\System\slNfMgA.exe
  2⤵
  PID:4396
- C:\Windows\System\engAGMc.exe
  C:\Windows\System\engAGMc.exe
  2⤵
  PID:7052
- C:\Windows\System\konZShA.exe
  C:\Windows\System\konZShA.exe
  2⤵
  PID:7072
- C:\Windows\System\HzavpXt.exe
  C:\Windows\System\HzavpXt.exe
  2⤵
  PID:7108
- C:\Windows\System\TZjdYut.exe
  C:\Windows\System\TZjdYut.exe
  2⤵
  PID:6152
- C:\Windows\System\TUfmDTX.exe
  C:\Windows\System\TUfmDTX.exe
  2⤵
  PID:7140
- C:\Windows\System\dOfPNXy.exe
  C:\Windows\System\dOfPNXy.exe
  2⤵
  PID:7164
- C:\Windows\System\TylxIwL.exe
  C:\Windows\System\TylxIwL.exe
  2⤵
  PID:6276
- C:\Windows\System\HfHpHEN.exe
  C:\Windows\System\HfHpHEN.exe
  2⤵
  PID:6328
- C:\Windows\System\ThhjNoR.exe
  C:\Windows\System\ThhjNoR.exe
  2⤵
  PID:6344
- C:\Windows\System\uVdKvzw.exe
  C:\Windows\System\uVdKvzw.exe
  2⤵
  PID:5404
- C:\Windows\System\shhsjFe.exe
  C:\Windows\System\shhsjFe.exe
  2⤵
  PID:6500
- C:\Windows\System\WIyNUPI.exe
  C:\Windows\System\WIyNUPI.exe
  2⤵
  PID:6552
- C:\Windows\System\EKBzCAq.exe
  C:\Windows\System\EKBzCAq.exe
  2⤵
  PID:6640
- C:\Windows\System\ioHAWQi.exe
  C:\Windows\System\ioHAWQi.exe
  2⤵
  PID:6604
- C:\Windows\System\xferuHg.exe
  C:\Windows\System\xferuHg.exe
  2⤵
  PID:6700
- C:\Windows\System\zRbOqAo.exe
  C:\Windows\System\zRbOqAo.exe
  2⤵
  PID:6760
- C:\Windows\System\iqsgMHM.exe
  C:\Windows\System\iqsgMHM.exe
  2⤵
  PID:6824
- C:\Windows\System\BlHCuvl.exe
  C:\Windows\System\BlHCuvl.exe
  2⤵
  PID:6924
- C:\Windows\System\jYKAVDG.exe
  C:\Windows\System\jYKAVDG.exe
  2⤵
  PID:6992
- C:\Windows\System\JGSSCur.exe
  C:\Windows\System\JGSSCur.exe
  2⤵
  PID:7028
- C:\Windows\System\VKJzlyu.exe
  C:\Windows\System\VKJzlyu.exe
  2⤵
  PID:5820
- C:\Windows\System\onUUubV.exe
  C:\Windows\System\onUUubV.exe
  2⤵
  PID:1128
- C:\Windows\System\ZbHuunl.exe
  C:\Windows\System\ZbHuunl.exe
  2⤵
  PID:1152
- C:\Windows\System\nHqYJOX.exe
  C:\Windows\System\nHqYJOX.exe
  2⤵
  PID:6556
- C:\Windows\System\jvxOGPJ.exe
  C:\Windows\System\jvxOGPJ.exe
  2⤵
  PID:7496
- C:\Windows\System\ecSSZgc.exe
  C:\Windows\System\ecSSZgc.exe
  2⤵
  PID:5524
- C:\Windows\System\NpcoFiq.exe
  C:\Windows\System\NpcoFiq.exe
  2⤵
  PID:5284
- C:\Windows\System\IMRyAyF.exe
  C:\Windows\System\IMRyAyF.exe
  2⤵
  PID:7212
- C:\Windows\System\cefgjXc.exe
  C:\Windows\System\cefgjXc.exe
  2⤵
  PID:7360
- C:\Windows\System\vtLXYcC.exe
  C:\Windows\System\vtLXYcC.exe
  2⤵
  PID:7412
- C:\Windows\System\jyFbjww.exe
  C:\Windows\System\jyFbjww.exe
  2⤵
  PID:7536
- C:\Windows\System\QWuTEIk.exe
  C:\Windows\System\QWuTEIk.exe
  2⤵
  PID:7712
- C:\Windows\System\cpDviyL.exe
  C:\Windows\System\cpDviyL.exe
  2⤵
  PID:7856
- C:\Windows\System\pAwHikx.exe
  C:\Windows\System\pAwHikx.exe
  2⤵
  PID:7892
- C:\Windows\System\bvhAAGc.exe
  C:\Windows\System\bvhAAGc.exe
  2⤵
  PID:7936
- C:\Windows\System\RYjrtlM.exe
  C:\Windows\System\RYjrtlM.exe
  2⤵
  PID:3104
- C:\Windows\System\aURfEze.exe
  C:\Windows\System\aURfEze.exe
  2⤵
  PID:6368
- C:\Windows\System\RtgJtRT.exe
  C:\Windows\System\RtgJtRT.exe
  2⤵
  PID:8208
- C:\Windows\System\AjFefRJ.exe
  C:\Windows\System\AjFefRJ.exe
  2⤵
  PID:8224
- C:\Windows\System\WUpfClu.exe
  C:\Windows\System\WUpfClu.exe
  2⤵
  PID:8240
- C:\Windows\System\rBriZTZ.exe
  C:\Windows\System\rBriZTZ.exe
  2⤵
  PID:8256
- C:\Windows\System\kSWKUEm.exe
  C:\Windows\System\kSWKUEm.exe
  2⤵
  PID:8276
- C:\Windows\System\gUtxMKA.exe
  C:\Windows\System\gUtxMKA.exe
  2⤵
  PID:8292
- C:\Windows\System\VQutPzu.exe
  C:\Windows\System\VQutPzu.exe
  2⤵
  PID:8308
- C:\Windows\System\tjCnQZf.exe
  C:\Windows\System\tjCnQZf.exe
  2⤵
  PID:8324
- C:\Windows\System\DFTdtzR.exe
  C:\Windows\System\DFTdtzR.exe
  2⤵
  PID:8340
- C:\Windows\System\scfJqMX.exe
  C:\Windows\System\scfJqMX.exe
  2⤵
  PID:8356
- C:\Windows\System\lMIoAjF.exe
  C:\Windows\System\lMIoAjF.exe
  2⤵
  PID:8372
- C:\Windows\System\NuajDxc.exe
  C:\Windows\System\NuajDxc.exe
  2⤵
  PID:8388
- C:\Windows\System\fAKQCUd.exe
  C:\Windows\System\fAKQCUd.exe
  2⤵
  PID:8404
- C:\Windows\System\iWXhuqJ.exe
  C:\Windows\System\iWXhuqJ.exe
  2⤵
  PID:8424
- C:\Windows\System\HCBQGdz.exe
  C:\Windows\System\HCBQGdz.exe
  2⤵
  PID:8444
- C:\Windows\System\YyQkqIS.exe
  C:\Windows\System\YyQkqIS.exe
  2⤵
  PID:8464
- C:\Windows\System\RYBXfRa.exe
  C:\Windows\System\RYBXfRa.exe
  2⤵
  PID:8480
- C:\Windows\System\RuuxDkW.exe
  C:\Windows\System\RuuxDkW.exe
  2⤵
  PID:8500
- C:\Windows\System\QbTaAMP.exe
  C:\Windows\System\QbTaAMP.exe
  2⤵
  PID:8520
- C:\Windows\System\bqGmZzW.exe
  C:\Windows\System\bqGmZzW.exe
  2⤵
  PID:8540
- C:\Windows\System\aZvOcwj.exe
  C:\Windows\System\aZvOcwj.exe
  2⤵
  PID:8560
- C:\Windows\System\bCVufzP.exe
  C:\Windows\System\bCVufzP.exe
  2⤵
  PID:8576
- C:\Windows\System\QFBdYNg.exe
  C:\Windows\System\QFBdYNg.exe
  2⤵
  PID:8596
- C:\Windows\System\GNKcbxq.exe
  C:\Windows\System\GNKcbxq.exe
  2⤵
  PID:8616
- C:\Windows\System\NmgKMVq.exe
  C:\Windows\System\NmgKMVq.exe
  2⤵
  PID:8636
- C:\Windows\System\NbNyhkI.exe
  C:\Windows\System\NbNyhkI.exe
  2⤵
  PID:8652
- C:\Windows\System\olNJGSI.exe
  C:\Windows\System\olNJGSI.exe
  2⤵
  PID:8672
- C:\Windows\System\TpMAFvQ.exe
  C:\Windows\System\TpMAFvQ.exe
  2⤵
  PID:8692
- C:\Windows\System\ngxhmsI.exe
  C:\Windows\System\ngxhmsI.exe
  2⤵
  PID:8708
- C:\Windows\System\msOjFCj.exe
  C:\Windows\System\msOjFCj.exe
  2⤵
  PID:8728
- C:\Windows\System\VxAseDb.exe
  C:\Windows\System\VxAseDb.exe
  2⤵
  PID:8748
- C:\Windows\System\oyJnMGk.exe
  C:\Windows\System\oyJnMGk.exe
  2⤵
  PID:8764
- C:\Windows\System\McqZXjD.exe
  C:\Windows\System\McqZXjD.exe
  2⤵
  PID:8784
- C:\Windows\System\AkJsbKs.exe
  C:\Windows\System\AkJsbKs.exe
  2⤵
  PID:8804
- C:\Windows\System\zmvwpwp.exe
  C:\Windows\System\zmvwpwp.exe
  2⤵
  PID:8824
- C:\Windows\System\jCiTSLa.exe
  C:\Windows\System\jCiTSLa.exe
  2⤵
  PID:8844
- C:\Windows\System\kFJltTz.exe
  C:\Windows\System\kFJltTz.exe
  2⤵
  PID:8860
- C:\Windows\System\sMUyEcd.exe
  C:\Windows\System\sMUyEcd.exe
  2⤵
  PID:8880
- C:\Windows\System\hNYIqEm.exe
  C:\Windows\System\hNYIqEm.exe
  2⤵
  PID:9476
- C:\Windows\System\zMXuPAE.exe
  C:\Windows\System\zMXuPAE.exe
  2⤵
  PID:9492
- C:\Windows\System\jOhTqeT.exe
  C:\Windows\System\jOhTqeT.exe
  2⤵
  PID:9512
- C:\Windows\System\iGlxLQl.exe
  C:\Windows\System\iGlxLQl.exe
  2⤵
  PID:9528
- C:\Windows\System\NiEHdQn.exe
  C:\Windows\System\NiEHdQn.exe
  2⤵
  PID:9544
- C:\Windows\System\TxSLgPo.exe
  C:\Windows\System\TxSLgPo.exe
  2⤵
  PID:9560
- C:\Windows\System\vamBbck.exe
  C:\Windows\System\vamBbck.exe
  2⤵
  PID:9580
- C:\Windows\System\fTAroYa.exe
  C:\Windows\System\fTAroYa.exe
  2⤵
  PID:9604
- C:\Windows\System\QzmMbZL.exe
  C:\Windows\System\QzmMbZL.exe
  2⤵
  PID:9624
- C:\Windows\System\gVzuymZ.exe
  C:\Windows\System\gVzuymZ.exe
  2⤵
  PID:9640
- C:\Windows\System\HCtczdi.exe
  C:\Windows\System\HCtczdi.exe
  2⤵
  PID:9660
- C:\Windows\System\cDXvJfQ.exe
  C:\Windows\System\cDXvJfQ.exe
  2⤵
  PID:9676
- C:\Windows\System\wqiZfeN.exe
  C:\Windows\System\wqiZfeN.exe
  2⤵
  PID:9696
- C:\Windows\System\pYHTgWN.exe
  C:\Windows\System\pYHTgWN.exe
  2⤵
  PID:9716
- C:\Windows\System\zqXzlQj.exe
  C:\Windows\System\zqXzlQj.exe
  2⤵
  PID:9732
- C:\Windows\System\YjeyCsH.exe
  C:\Windows\System\YjeyCsH.exe
  2⤵
  PID:9752
- C:\Windows\System\fuKORJj.exe
  C:\Windows\System\fuKORJj.exe
  2⤵
  PID:9772
- C:\Windows\System\woJsVsl.exe
  C:\Windows\System\woJsVsl.exe
  2⤵
  PID:9788
- C:\Windows\System\dRttTRc.exe
  C:\Windows\System\dRttTRc.exe
  2⤵
  PID:9808
- C:\Windows\System\jDJluYE.exe
  C:\Windows\System\jDJluYE.exe
  2⤵
  PID:9828
- C:\Windows\System\mDFHSgk.exe
  C:\Windows\System\mDFHSgk.exe
  2⤵
  PID:9848
- C:\Windows\System\HLxdrpW.exe
  C:\Windows\System\HLxdrpW.exe
  2⤵
  PID:9864
- C:\Windows\System\bhxKOod.exe
  C:\Windows\System\bhxKOod.exe
  2⤵
  PID:9884
- C:\Windows\System\NmoMobX.exe
  C:\Windows\System\NmoMobX.exe
  2⤵
  PID:9916
- C:\Windows\System\fdAKYEk.exe
  C:\Windows\System\fdAKYEk.exe
  2⤵
  PID:9932
- C:\Windows\System\iyKbtLe.exe
  C:\Windows\System\iyKbtLe.exe
  2⤵
  PID:9948
- C:\Windows\System\ZmRpimO.exe
  C:\Windows\System\ZmRpimO.exe
  2⤵
  PID:9964
- C:\Windows\System\ECkXpgx.exe
  C:\Windows\System\ECkXpgx.exe
  2⤵
  PID:9980
- C:\Windows\System\OlRwWEs.exe
  C:\Windows\System\OlRwWEs.exe
  2⤵
  PID:9996
- C:\Windows\System\Dvnlihw.exe
  C:\Windows\System\Dvnlihw.exe
  2⤵
  PID:10012
- C:\Windows\System\vlwFbUz.exe
  C:\Windows\System\vlwFbUz.exe
  2⤵
  PID:10028
- C:\Windows\System\mGFtTla.exe
  C:\Windows\System\mGFtTla.exe
  2⤵
  PID:10048
- C:\Windows\System\JJmNUUr.exe
  C:\Windows\System\JJmNUUr.exe
  2⤵
  PID:10064
- C:\Windows\System\cnlvLRg.exe
  C:\Windows\System\cnlvLRg.exe
  2⤵
  PID:10084
- C:\Windows\System\oMaTWjz.exe
  C:\Windows\System\oMaTWjz.exe
  2⤵
  PID:10104
- C:\Windows\System\OerMNEh.exe
  C:\Windows\System\OerMNEh.exe
  2⤵
  PID:10120
- C:\Windows\System\uJznfJw.exe
  C:\Windows\System\uJznfJw.exe
  2⤵
  PID:10140
- C:\Windows\System\gIDDexz.exe
  C:\Windows\System\gIDDexz.exe
  2⤵
  PID:10160
- C:\Windows\System\fzkZOSY.exe
  C:\Windows\System\fzkZOSY.exe
  2⤵
  PID:10180
- C:\Windows\System\tfeQGqu.exe
  C:\Windows\System\tfeQGqu.exe
  2⤵
  PID:10200
- C:\Windows\System\NZGeHKU.exe
  C:\Windows\System\NZGeHKU.exe
  2⤵
  PID:10220
- C:\Windows\System\qdhWLdG.exe
  C:\Windows\System\qdhWLdG.exe
  2⤵
  PID:7296
- C:\Windows\System\mdUdGbq.exe
  C:\Windows\System\mdUdGbq.exe
  2⤵
  PID:2036
- C:\Windows\System\aSRNJFq.exe
  C:\Windows\System\aSRNJFq.exe
  2⤵
  PID:8892
- C:\Windows\System\xkHoMIk.exe
  C:\Windows\System\xkHoMIk.exe
  2⤵
  PID:6656
- C:\Windows\System\GcErYFj.exe
  C:\Windows\System\GcErYFj.exe
  2⤵
  PID:6776
- C:\Windows\System\QSGxhLQ.exe
  C:\Windows\System\QSGxhLQ.exe
  2⤵
  PID:7012
- C:\Windows\System\DPhuzxD.exe
  C:\Windows\System\DPhuzxD.exe
  2⤵
  PID:2136
- C:\Windows\System\cbcrmwl.exe
  C:\Windows\System\cbcrmwl.exe
  2⤵
  PID:10260
- C:\Windows\System\CmxBKag.exe
  C:\Windows\System\CmxBKag.exe
  2⤵
  PID:10280
- C:\Windows\System\XHmDEgB.exe
  C:\Windows\System\XHmDEgB.exe
  2⤵
  PID:10296
- C:\Windows\System\FayYOzy.exe
  C:\Windows\System\FayYOzy.exe
  2⤵
  PID:10316
- C:\Windows\System\UiTdYIg.exe
  C:\Windows\System\UiTdYIg.exe
  2⤵
  PID:10340
- C:\Windows\System\rORIkyp.exe
  C:\Windows\System\rORIkyp.exe
  2⤵
  PID:10372
- C:\Windows\System\bqtvBFc.exe
  C:\Windows\System\bqtvBFc.exe
  2⤵
  PID:10396
- C:\Windows\System\AIRqVWY.exe
  C:\Windows\System\AIRqVWY.exe
  2⤵
  PID:10416
- C:\Windows\System\rMRflVX.exe
  C:\Windows\System\rMRflVX.exe
  2⤵
  PID:10436
- C:\Windows\System\jQAhIzQ.exe
  C:\Windows\System\jQAhIzQ.exe
  2⤵
  PID:10460
- C:\Windows\System\eYhDmgh.exe
  C:\Windows\System\eYhDmgh.exe
  2⤵
  PID:10480
- C:\Windows\System\aEmIALU.exe
  C:\Windows\System\aEmIALU.exe
  2⤵
  PID:10536
- C:\Windows\System\cKIJXim.exe
  C:\Windows\System\cKIJXim.exe
  2⤵
  PID:10560
- C:\Windows\System\DpHmwft.exe
  C:\Windows\System\DpHmwft.exe
  2⤵
  PID:10580
- C:\Windows\System\EdLYKyK.exe
  C:\Windows\System\EdLYKyK.exe
  2⤵
  PID:10604
- C:\Windows\System\kqWAOwa.exe
  C:\Windows\System\kqWAOwa.exe
  2⤵
  PID:10632
- C:\Windows\System\PeTRFOd.exe
  C:\Windows\System\PeTRFOd.exe
  2⤵
  PID:10652
- C:\Windows\System\DiofUby.exe
  C:\Windows\System\DiofUby.exe
  2⤵
  PID:10668
- C:\Windows\System\gykFrqn.exe
  C:\Windows\System\gykFrqn.exe
  2⤵
  PID:10692
- C:\Windows\System\IqeVwDZ.exe
  C:\Windows\System\IqeVwDZ.exe
  2⤵
  PID:10716
- C:\Windows\System\MkHxorK.exe
  C:\Windows\System\MkHxorK.exe
  2⤵
  PID:10740
- C:\Windows\System\XfNRGUK.exe
  C:\Windows\System\XfNRGUK.exe
  2⤵
  PID:10756
- C:\Windows\System\WlDlDPH.exe
  C:\Windows\System\WlDlDPH.exe
  2⤵
  PID:10780
- C:\Windows\System\NlXtYeg.exe
  C:\Windows\System\NlXtYeg.exe
  2⤵
  PID:10804
- C:\Windows\System\ivLaWlB.exe
  C:\Windows\System\ivLaWlB.exe
  2⤵
  PID:10824
- C:\Windows\System\VxPHvlJ.exe
  C:\Windows\System\VxPHvlJ.exe
  2⤵
  PID:10848
- C:\Windows\System\FLioArI.exe
  C:\Windows\System\FLioArI.exe
  2⤵
  PID:10868
- C:\Windows\System\cDVWQyb.exe
  C:\Windows\System\cDVWQyb.exe
  2⤵
  PID:10892
- C:\Windows\System\bKPXgCE.exe
  C:\Windows\System\bKPXgCE.exe
  2⤵
  PID:10908
- C:\Windows\System\oLhfbvU.exe
  C:\Windows\System\oLhfbvU.exe
  2⤵
  PID:10928
- C:\Windows\System\VZjXUhG.exe
  C:\Windows\System\VZjXUhG.exe
  2⤵
  PID:10944
- C:\Windows\System\KzJEInP.exe
  C:\Windows\System\KzJEInP.exe
  2⤵
  PID:10964
- C:\Windows\System\QrLJeMP.exe
  C:\Windows\System\QrLJeMP.exe
  2⤵
  PID:10988
- C:\Windows\System\JbkrpEl.exe
  C:\Windows\System\JbkrpEl.exe
  2⤵
  PID:11016
- C:\Windows\System\ifbOwqF.exe
  C:\Windows\System\ifbOwqF.exe
  2⤵
  PID:11040
- C:\Windows\System\wRXAxeB.exe
  C:\Windows\System\wRXAxeB.exe
  2⤵
  PID:11056
- C:\Windows\System\CMnGLjg.exe
  C:\Windows\System\CMnGLjg.exe
  2⤵
  PID:11076
- C:\Windows\System\xrgbVpm.exe
  C:\Windows\System\xrgbVpm.exe
  2⤵
  PID:8400
- C:\Windows\System\qrhGwTV.exe
  C:\Windows\System\qrhGwTV.exe
  2⤵
  PID:8740
- C:\Windows\System\KfILZxd.exe
  C:\Windows\System\KfILZxd.exe
  2⤵
  PID:8756
- C:\Windows\System\QByxHcV.exe
  C:\Windows\System\QByxHcV.exe
  2⤵
  PID:8800
- C:\Windows\System\XFsAVxn.exe
  C:\Windows\System\XFsAVxn.exe
  2⤵
  PID:8832
- C:\Windows\System\BWypArD.exe
  C:\Windows\System\BWypArD.exe
  2⤵
  PID:8856
- C:\Windows\System\RekLSvC.exe
  C:\Windows\System\RekLSvC.exe
  2⤵
  PID:8888
- C:\Windows\System\wncKcCb.exe
  C:\Windows\System\wncKcCb.exe
  2⤵
  PID:8932
- C:\Windows\System\eIEwQLk.exe
  C:\Windows\System\eIEwQLk.exe
  2⤵
  PID:8944
- C:\Windows\System\DYPCKSg.exe
  C:\Windows\System\DYPCKSg.exe
  2⤵
  PID:8968
- C:\Windows\System\oTiZYxv.exe
  C:\Windows\System\oTiZYxv.exe
  2⤵
  PID:8984
- C:\Windows\System\tpPdpeJ.exe
  C:\Windows\System\tpPdpeJ.exe
  2⤵
  PID:9004
- C:\Windows\System\QbPRCws.exe
  C:\Windows\System\QbPRCws.exe
  2⤵
  PID:9024
- C:\Windows\System\EygGvVP.exe
  C:\Windows\System\EygGvVP.exe
  2⤵
  PID:9044
- C:\Windows\System\YHBkfjk.exe
  C:\Windows\System\YHBkfjk.exe
  2⤵
  PID:9064
- C:\Windows\System\XzhMZeT.exe
  C:\Windows\System\XzhMZeT.exe
  2⤵
  PID:9076
- C:\Windows\System\hVzvbmA.exe
  C:\Windows\System\hVzvbmA.exe
  2⤵
  PID:9768
- C:\Windows\System\YevsBHz.exe
  C:\Windows\System\YevsBHz.exe
  2⤵
  PID:9684
- C:\Windows\System\TGwmyqZ.exe
  C:\Windows\System\TGwmyqZ.exe
  2⤵
  PID:9900
- C:\Windows\System\riGYiIr.exe
  C:\Windows\System\riGYiIr.exe
  2⤵
  PID:10380
- C:\Windows\System\FNsJfxl.exe
  C:\Windows\System\FNsJfxl.exe
  2⤵
  PID:9436
- C:\Windows\System\JGDqmtM.exe
  C:\Windows\System\JGDqmtM.exe
  2⤵
  PID:9416
- C:\Windows\System\pTXrnNl.exe
  C:\Windows\System\pTXrnNl.exe
  2⤵
  PID:9396
- C:\Windows\System\cChHift.exe
  C:\Windows\System\cChHift.exe
  2⤵
  PID:1544
- C:\Windows\System\nRKfnQH.exe
  C:\Windows\System\nRKfnQH.exe
  2⤵
  PID:9472
- C:\Windows\System\bXLBNsN.exe
  C:\Windows\System\bXLBNsN.exe
  2⤵
  PID:11096
- C:\Windows\System\XXmCgYu.exe
  C:\Windows\System\XXmCgYu.exe
  2⤵
  PID:9764
- C:\Windows\System\znbZunA.exe
  C:\Windows\System\znbZunA.exe
  2⤵
  PID:10884
- C:\Windows\System\cfWsIpP.exe
  C:\Windows\System\cfWsIpP.exe
  2⤵
  PID:10152
- C:\Windows\System\YqoNtbb.exe
  C:\Windows\System\YqoNtbb.exe
  2⤵
  PID:10004
- C:\Windows\System\POComQh.exe
  C:\Windows\System\POComQh.exe
  2⤵
  PID:11036
- C:\Windows\System\aDgiJgk.exe
  C:\Windows\System\aDgiJgk.exe
  2⤵
  PID:9840
- C:\Windows\System\vOaoROh.exe
  C:\Windows\System\vOaoROh.exe
  2⤵
  PID:10024
- C:\Windows\System\ZccbbhA.exe
  C:\Windows\System\ZccbbhA.exe
  2⤵
  PID:10060
- C:\Windows\System\QnoKHiO.exe
  C:\Windows\System\QnoKHiO.exe
  2⤵
  PID:10136
- C:\Windows\System\XNuqOXK.exe
  C:\Windows\System\XNuqOXK.exe
  2⤵
  PID:10176
- C:\Windows\System\eAmOXqh.exe
  C:\Windows\System\eAmOXqh.exe
  2⤵
  PID:8904
- C:\Windows\System\LjgMapx.exe
  C:\Windows\System\LjgMapx.exe
  2⤵
  PID:7048
- C:\Windows\System\RMSnhLR.exe
  C:\Windows\System\RMSnhLR.exe
  2⤵
  PID:10272
- C:\Windows\System\GmYwzfr.exe
  C:\Windows\System\GmYwzfr.exe
  2⤵
  PID:11220
- C:\Windows\System\FoUJzEv.exe
  C:\Windows\System\FoUJzEv.exe
  2⤵
  PID:11276
- C:\Windows\System\oTPGecF.exe
  C:\Windows\System\oTPGecF.exe
  2⤵
  PID:11300
- C:\Windows\System\XyRtlsZ.exe
  C:\Windows\System\XyRtlsZ.exe
  2⤵
  PID:11324
- C:\Windows\System\ElaXJsL.exe
  C:\Windows\System\ElaXJsL.exe
  2⤵
  PID:11348
- C:\Windows\System\QWaystx.exe
  C:\Windows\System\QWaystx.exe
  2⤵
  PID:11364
- C:\Windows\System\gijwGJo.exe
  C:\Windows\System\gijwGJo.exe
  2⤵
  PID:11384
- C:\Windows\System\Pqsmgpm.exe
  C:\Windows\System\Pqsmgpm.exe
  2⤵
  PID:11404
- C:\Windows\System\kHYIJdd.exe
  C:\Windows\System\kHYIJdd.exe
  2⤵
  PID:11432
- C:\Windows\System\mznuxpa.exe
  C:\Windows\System\mznuxpa.exe
  2⤵
  PID:11580
- C:\Windows\System\lASziZq.exe
  C:\Windows\System\lASziZq.exe
  2⤵
  PID:11596
- C:\Windows\System\zZdvBVI.exe
  C:\Windows\System\zZdvBVI.exe
  2⤵
  PID:11612
- C:\Windows\System\kKjcdlV.exe
  C:\Windows\System\kKjcdlV.exe
  2⤵
  PID:11628
- C:\Windows\System\yqdZzyQ.exe
  C:\Windows\System\yqdZzyQ.exe
  2⤵
  PID:11648
- C:\Windows\System\evDLjVR.exe
  C:\Windows\System\evDLjVR.exe
  2⤵
  PID:11676
- C:\Windows\System\ysdPZzz.exe
  C:\Windows\System\ysdPZzz.exe
  2⤵
  PID:11708
- C:\Windows\System\SWOAwcb.exe
  C:\Windows\System\SWOAwcb.exe
  2⤵
  PID:11740
- C:\Windows\System\lhrWgAp.exe
  C:\Windows\System\lhrWgAp.exe
  2⤵
  PID:11764
- C:\Windows\System\thZfGaB.exe
  C:\Windows\System\thZfGaB.exe
  2⤵
  PID:11780
- C:\Windows\System\uyAtIKk.exe
  C:\Windows\System\uyAtIKk.exe
  2⤵
  PID:11812
- C:\Windows\System\JDQNsnx.exe
  C:\Windows\System\JDQNsnx.exe
  2⤵
  PID:11828
- C:\Windows\System\XmKelml.exe
  C:\Windows\System\XmKelml.exe
  2⤵
  PID:11848
- C:\Windows\System\zcMbpAM.exe
  C:\Windows\System\zcMbpAM.exe
  2⤵
  PID:11864
- C:\Windows\System\KvTMmbe.exe
  C:\Windows\System\KvTMmbe.exe
  2⤵
  PID:11880
- C:\Windows\System\KVmKcQQ.exe
  C:\Windows\System\KVmKcQQ.exe
  2⤵
  PID:11896
- C:\Windows\System\CiiEQJl.exe
  C:\Windows\System\CiiEQJl.exe
  2⤵
  PID:11912
- C:\Windows\System\CZyMycd.exe
  C:\Windows\System\CZyMycd.exe
  2⤵
  PID:11928
- C:\Windows\System\TTXKXcA.exe
  C:\Windows\System\TTXKXcA.exe
  2⤵
  PID:11944
- C:\Windows\System\MnnDYkt.exe
  C:\Windows\System\MnnDYkt.exe
  2⤵
  PID:11960
- C:\Windows\System\BJlrsKf.exe
  C:\Windows\System\BJlrsKf.exe
  2⤵
  PID:11976
- C:\Windows\System\sYvsbkD.exe
  C:\Windows\System\sYvsbkD.exe
  2⤵
  PID:11992
- C:\Windows\System\eCbsXoe.exe
  C:\Windows\System\eCbsXoe.exe
  2⤵
  PID:12008
- C:\Windows\System\yypRyDO.exe
  C:\Windows\System\yypRyDO.exe
  2⤵
  PID:12024
- C:\Windows\System\EQtnoSO.exe
  C:\Windows\System\EQtnoSO.exe
  2⤵
  PID:12040
- C:\Windows\System\vfAgIHq.exe
  C:\Windows\System\vfAgIHq.exe
  2⤵
  PID:12056
- C:\Windows\System\grHYdRV.exe
  C:\Windows\System\grHYdRV.exe
  2⤵
  PID:12084
- C:\Windows\System\szQQEti.exe
  C:\Windows\System\szQQEti.exe
  2⤵
  PID:12108
- C:\Windows\System\JNyATFw.exe
  C:\Windows\System\JNyATFw.exe
  2⤵
  PID:12136
- C:\Windows\System\zuDrqzG.exe
  C:\Windows\System\zuDrqzG.exe
  2⤵
  PID:12176
- C:\Windows\System\YqcCtBX.exe
  C:\Windows\System\YqcCtBX.exe
  2⤵
  PID:12200
- C:\Windows\System\Oypqexm.exe
  C:\Windows\System\Oypqexm.exe
  2⤵
  PID:12252
- C:\Windows\System\aJcOoDs.exe
  C:\Windows\System\aJcOoDs.exe
  2⤵
  PID:12268
- C:\Windows\System\OVdZAKG.exe
  C:\Windows\System\OVdZAKG.exe
  2⤵
  PID:1420
- C:\Windows\System\wceMcnC.exe
  C:\Windows\System\wceMcnC.exe
  2⤵
  PID:10816
- C:\Windows\System\ouGuCHA.exe
  C:\Windows\System\ouGuCHA.exe
  2⤵
  PID:10752
- C:\Windows\System\hyWLHcN.exe
  C:\Windows\System\hyWLHcN.exe
  2⤵
  PID:10664
- C:\Windows\System\DZKTbQE.exe
  C:\Windows\System\DZKTbQE.exe
  2⤵
  PID:10512
- C:\Windows\System\dcSSQkh.exe
  C:\Windows\System\dcSSQkh.exe
  2⤵
  PID:3460
- C:\Windows\System\MdOYwEu.exe
  C:\Windows\System\MdOYwEu.exe
  2⤵
  PID:10488
- C:\Windows\System\sIoWQrt.exe
  C:\Windows\System\sIoWQrt.exe
  2⤵
  PID:9056
- C:\Windows\System\fJCGxnX.exe
  C:\Windows\System\fJCGxnX.exe
  2⤵
  PID:4452
- C:\Windows\System\ZtndqUL.exe
  C:\Windows\System\ZtndqUL.exe
  2⤵
  PID:10960
- C:\Windows\System\aviSnTh.exe
  C:\Windows\System\aviSnTh.exe
  2⤵
  PID:5972
- C:\Windows\System\eUBFJrF.exe
  C:\Windows\System\eUBFJrF.exe
  2⤵
  PID:9688
- C:\Windows\System\ghlZnnj.exe
  C:\Windows\System\ghlZnnj.exe
  2⤵
  PID:10252
- C:\Windows\System\GrDZJlE.exe
  C:\Windows\System\GrDZJlE.exe
  2⤵
  PID:10192
- C:\Windows\System\RtqNxXY.exe
  C:\Windows\System\RtqNxXY.exe
  2⤵
  PID:9568
- C:\Windows\System\VUCPGTj.exe
  C:\Windows\System\VUCPGTj.exe
  2⤵
  PID:11204
- C:\Windows\System\YzEwUMk.exe
  C:\Windows\System\YzEwUMk.exe
  2⤵
  PID:10128
- C:\Windows\System\REgEWjD.exe
  C:\Windows\System\REgEWjD.exe
  2⤵
  PID:2320
- C:\Windows\System\LxUdzlW.exe
  C:\Windows\System\LxUdzlW.exe
  2⤵
  PID:2240
- C:\Windows\System\fQCrmxe.exe
  C:\Windows\System\fQCrmxe.exe
  2⤵
  PID:6188
- C:\Windows\System\TZzBEPU.exe
  C:\Windows\System\TZzBEPU.exe
  2⤵
  PID:9612
- C:\Windows\System\NkcnwBi.exe
  C:\Windows\System\NkcnwBi.exe
  2⤵
  PID:9540
- C:\Windows\System\pLeIDHE.exe
  C:\Windows\System\pLeIDHE.exe
  2⤵
  PID:10076
- C:\Windows\System\rBFLHhK.exe
  C:\Windows\System\rBFLHhK.exe
  2⤵
  PID:10388
- C:\Windows\System\lhmpuQZ.exe
  C:\Windows\System\lhmpuQZ.exe
  2⤵
  PID:10468
- C:\Windows\System\eREmVRe.exe
  C:\Windows\System\eREmVRe.exe
  2⤵
  PID:10616
- C:\Windows\System\EXtYyHS.exe
  C:\Windows\System\EXtYyHS.exe
  2⤵
  PID:10772
- C:\Windows\System\OduibOn.exe
  C:\Windows\System\OduibOn.exe
  2⤵
  PID:12296
- C:\Windows\System\LgqFViI.exe
  C:\Windows\System\LgqFViI.exe
  2⤵
  PID:12324
- C:\Windows\System\bTBhjGv.exe
  C:\Windows\System\bTBhjGv.exe
  2⤵
  PID:12340
- C:\Windows\System\lWHyCxU.exe
  C:\Windows\System\lWHyCxU.exe
  2⤵
  PID:12364
- C:\Windows\System\kOqHtyt.exe
  C:\Windows\System\kOqHtyt.exe
  2⤵
  PID:12388
- C:\Windows\System\iMnDsBd.exe
  C:\Windows\System\iMnDsBd.exe
  2⤵
  PID:12404
- C:\Windows\System\Iwwxvwn.exe
  C:\Windows\System\Iwwxvwn.exe
  2⤵
  PID:12428
- C:\Windows\System\czbZKyP.exe
  C:\Windows\System\czbZKyP.exe
  2⤵
  PID:12452
- C:\Windows\System\lzKqLqM.exe
  C:\Windows\System\lzKqLqM.exe
  2⤵
  PID:12476
- C:\Windows\System\mxoSfQM.exe
  C:\Windows\System\mxoSfQM.exe
  2⤵
  PID:12492
- C:\Windows\System\AaclVDH.exe
  C:\Windows\System\AaclVDH.exe
  2⤵
  PID:12512
- C:\Windows\System\CXABTUm.exe
  C:\Windows\System\CXABTUm.exe
  2⤵
  PID:12528
- C:\Windows\System\NVZqNVM.exe
  C:\Windows\System\NVZqNVM.exe
  2⤵
  PID:12548
- C:\Windows\System\qppqbJF.exe
  C:\Windows\System\qppqbJF.exe
  2⤵
  PID:12568
- C:\Windows\System\youCgmA.exe
  C:\Windows\System\youCgmA.exe
  2⤵
  PID:12592
- C:\Windows\System\tqVEoTV.exe
  C:\Windows\System\tqVEoTV.exe
  2⤵
  PID:12608
- C:\Windows\System\KOuMsnS.exe
  C:\Windows\System\KOuMsnS.exe
  2⤵
  PID:12632
- C:\Windows\System\vsOEwmB.exe
  C:\Windows\System\vsOEwmB.exe
  2⤵
  PID:12656
- C:\Windows\System\GKFzTez.exe
  C:\Windows\System\GKFzTez.exe
  2⤵
  PID:12676
- C:\Windows\System\TkkHbgk.exe
  C:\Windows\System\TkkHbgk.exe
  2⤵
  PID:12696
- C:\Windows\System\uvNJEKG.exe
  C:\Windows\System\uvNJEKG.exe
  2⤵
  PID:12716
- C:\Windows\System\zUuQjsB.exe
  C:\Windows\System\zUuQjsB.exe
  2⤵
  PID:12732
- C:\Windows\System\GSrJHzy.exe
  C:\Windows\System\GSrJHzy.exe
  2⤵
  PID:12748
- C:\Windows\System\nMkueBy.exe
  C:\Windows\System\nMkueBy.exe
  2⤵
  PID:12764
- C:\Windows\System\cFobNew.exe
  C:\Windows\System\cFobNew.exe
  2⤵
  PID:12780
- C:\Windows\System\aqUPLzU.exe
  C:\Windows\System\aqUPLzU.exe
  2⤵
  PID:12796
- C:\Windows\System\lPYbCXH.exe
  C:\Windows\System\lPYbCXH.exe
  2⤵
  PID:12812
- C:\Windows\System\adcqsOt.exe
  C:\Windows\System\adcqsOt.exe
  2⤵
  PID:12828
- C:\Windows\System\FOuFwaX.exe
  C:\Windows\System\FOuFwaX.exe
  2⤵
  PID:12844
- C:\Windows\System\GQgctvf.exe
  C:\Windows\System\GQgctvf.exe
  2⤵
  PID:12860
- C:\Windows\System\QJwPQuN.exe
  C:\Windows\System\QJwPQuN.exe
  2⤵
  PID:12876
- C:\Windows\System\tIubvMU.exe
  C:\Windows\System\tIubvMU.exe
  2⤵
  PID:12892
- C:\Windows\System\UrDlAId.exe
  C:\Windows\System\UrDlAId.exe
  2⤵
  PID:12912
- C:\Windows\System\yJqxqyW.exe
  C:\Windows\System\yJqxqyW.exe
  2⤵
  PID:12928
- C:\Windows\System\ttuCRJq.exe
  C:\Windows\System\ttuCRJq.exe
  2⤵
  PID:12944
- C:\Windows\System\pmAiyfN.exe
  C:\Windows\System\pmAiyfN.exe
  2⤵
  PID:12964
- C:\Windows\System\GjhVSVd.exe
  C:\Windows\System\GjhVSVd.exe
  2⤵
  PID:12988
- C:\Windows\System\OdNLBgF.exe
  C:\Windows\System\OdNLBgF.exe
  2⤵
  PID:13004
- C:\Windows\System\lkNCGcG.exe
  C:\Windows\System\lkNCGcG.exe
  2⤵
  PID:13024
- C:\Windows\System\RMxHVEr.exe
  C:\Windows\System\RMxHVEr.exe
  2⤵
  PID:13100
- C:\Windows\System\FVfWlGx.exe
  C:\Windows\System\FVfWlGx.exe
  2⤵
  PID:9692
- C:\Windows\System\RmkYiQJ.exe
  C:\Windows\System\RmkYiQJ.exe
  2⤵
  PID:12852
- C:\Windows\System\ScORMKF.exe
  C:\Windows\System\ScORMKF.exe
  2⤵
  PID:10700
- C:\Windows\System\ALHTOPa.exe
  C:\Windows\System\ALHTOPa.exe
  2⤵
  PID:4592
- C:\Windows\System\hFvFXAj.exe
  C:\Windows\System\hFvFXAj.exe
  2⤵
  PID:11292
- C:\Windows\System\DqVnvxS.exe
  C:\Windows\System\DqVnvxS.exe
  2⤵
  PID:11456
- C:\Windows\System\kjIzRJQ.exe
  C:\Windows\System\kjIzRJQ.exe
  2⤵
  PID:2380
- C:\Windows\System\bujMuOn.exe
  C:\Windows\System\bujMuOn.exe
  2⤵
  PID:11688
- C:\Windows\System\jpNIUlw.exe
  C:\Windows\System\jpNIUlw.exe
  2⤵
  PID:11756
- C:\Windows\System\mpXwGlR.exe
  C:\Windows\System\mpXwGlR.exe
  2⤵
  PID:11808
- C:\Windows\System\pgZLrvV.exe
  C:\Windows\System\pgZLrvV.exe
  2⤵
  PID:11844
- C:\Windows\System\sOWQtHx.exe
  C:\Windows\System\sOWQtHx.exe
  2⤵
  PID:11940
- C:\Windows\System\hiXgglo.exe
  C:\Windows\System\hiXgglo.exe
  2⤵
  PID:12488
- C:\Windows\System\ARVZIbN.exe
  C:\Windows\System\ARVZIbN.exe
  2⤵
  PID:12648
- C:\Windows\System\gcVpUOZ.exe
  C:\Windows\System\gcVpUOZ.exe
  2⤵
  PID:10856
- C:\Windows\System\McnBHXp.exe
  C:\Windows\System\McnBHXp.exe
  2⤵
  PID:10776
- C:\Windows\System\RnGObSl.exe
  C:\Windows\System\RnGObSl.exe
  2⤵
  PID:13000
- C:\Windows\System\oidGKlm.exe
  C:\Windows\System\oidGKlm.exe
  2⤵
  PID:13020
- C:\Windows\System\pLoggrl.exe
  C:\Windows\System\pLoggrl.exe
  2⤵
  PID:1180
- C:\Windows\System\XrsZJxu.exe
  C:\Windows\System\XrsZJxu.exe
  2⤵
  PID:10640
- C:\Windows\System\RimYWMu.exe
  C:\Windows\System\RimYWMu.exe
  2⤵
  PID:10172
- C:\Windows\System\tcdGVku.exe
  C:\Windows\System\tcdGVku.exe
  2⤵
  PID:7092
- C:\Windows\System\CaSuwTM.exe
  C:\Windows\System\CaSuwTM.exe
  2⤵
  PID:13260
- C:\Windows\System\NBSdkvP.exe
  C:\Windows\System\NBSdkvP.exe
  2⤵
  PID:9820
- C:\Windows\System\xotykTL.exe
  C:\Windows\System\xotykTL.exe
  2⤵
  PID:12120
- C:\Windows\System\CzPXlbb.exe
  C:\Windows\System\CzPXlbb.exe
  2⤵
  PID:12372
- C:\Windows\System\oPwVMVb.exe
  C:\Windows\System\oPwVMVb.exe
  2⤵
  PID:11024
- C:\Windows\System\mpSectt.exe
  C:\Windows\System\mpSectt.exe
  2⤵
  PID:12524
- C:\Windows\System\HABVfng.exe
  C:\Windows\System\HABVfng.exe
  2⤵
  PID:11396
- C:\Windows\System\NXQuxmS.exe
  C:\Windows\System\NXQuxmS.exe
  2⤵
  PID:12728
- C:\Windows\System\IDptMeW.exe
  C:\Windows\System\IDptMeW.exe
  2⤵
  PID:12036
- C:\Windows\System\tiNvmtq.exe
  C:\Windows\System\tiNvmtq.exe
  2⤵
  PID:60
- C:\Windows\System\CbQxyfr.exe
  C:\Windows\System\CbQxyfr.exe
  2⤵
  PID:12900
- C:\Windows\System\ThQOjoc.exe
  C:\Windows\System\ThQOjoc.exe
  2⤵
  PID:13016
- C:\Windows\System\wCxopWH.exe
  C:\Windows\System\wCxopWH.exe
  2⤵
  PID:10444
- C:\Windows\System\ujhktvb.exe
  C:\Windows\System\ujhktvb.exe
  2⤵
  PID:11592
- C:\Windows\System\ZhJMria.exe
  C:\Windows\System\ZhJMria.exe
  2⤵
  PID:13224
- C:\Windows\System\PrBkqPA.exe
  C:\Windows\System\PrBkqPA.exe
  2⤵
  PID:13156
- C:\Windows\System\ykCQSPy.exe
  C:\Windows\System\ykCQSPy.exe
  2⤵
  PID:13124
- C:\Windows\System\kmIZVhC.exe
  C:\Windows\System\kmIZVhC.exe
  2⤵
  PID:3144
- C:\Windows\System\adKULAo.exe
  C:\Windows\System\adKULAo.exe
  2⤵
  PID:11788
- C:\Windows\System\ASRsCZa.exe
  C:\Windows\System\ASRsCZa.exe
  2⤵
  PID:11892
- C:\Windows\System\kDSUuRG.exe
  C:\Windows\System\kDSUuRG.exe
  2⤵
  PID:11888
- C:\Windows\System\vxyATTI.exe
  C:\Windows\System\vxyATTI.exe
  2⤵
  PID:12000
- C:\Windows\System\lRigTBG.exe
  C:\Windows\System\lRigTBG.exe
  2⤵
  PID:10428
- C:\Windows\System\mabGUkf.exe
  C:\Windows\System\mabGUkf.exe
  2⤵
  PID:13308
- C:\Windows\System\tOlDRaK.exe
  C:\Windows\System\tOlDRaK.exe
  2⤵
  PID:4344
- C:\Windows\System\sfOESiB.exe
  C:\Windows\System\sfOESiB.exe
  2⤵
  PID:12776
- C:\Windows\System\HwCOrnY.exe
  C:\Windows\System\HwCOrnY.exe
  2⤵
  PID:8900
- C:\Windows\System\hBZerJF.exe
  C:\Windows\System\hBZerJF.exe
  2⤵
  PID:12836
- C:\Windows\System\LSYdxtL.exe
  C:\Windows\System\LSYdxtL.exe
  2⤵
  PID:8872
- C:\Windows\System\YeZyHwy.exe
  C:\Windows\System\YeZyHwy.exe
  2⤵
  PID:8992
- C:\Windows\System\XMSMxBE.exe
  C:\Windows\System\XMSMxBE.exe
  2⤵
  PID:11972
- C:\Windows\System\tcIuoHb.exe
  C:\Windows\System\tcIuoHb.exe
  2⤵
  PID:4476
- C:\Windows\System\yJVWtpF.exe
  C:\Windows\System\yJVWtpF.exe
  2⤵
  PID:9760
- C:\Windows\System\CRkynRb.exe
  C:\Windows\System\CRkynRb.exe
  2⤵
  PID:12688
- C:\Windows\System\cUcaUpA.exe
  C:\Windows\System\cUcaUpA.exe
  2⤵
  PID:9648
- C:\Windows\System\ZksAAJw.exe
  C:\Windows\System\ZksAAJw.exe
  2⤵
  PID:13240
- C:\Windows\System\EvxWVJk.exe
  C:\Windows\System\EvxWVJk.exe
  2⤵
  PID:13056
- C:\Windows\System\KRCiUSv.exe
  C:\Windows\System\KRCiUSv.exe
  2⤵
  PID:3080
- C:\Windows\System\PtmhSnE.exe
  C:\Windows\System\PtmhSnE.exe
  2⤵
  PID:11576
- C:\Windows\System\svwIUwl.exe
  C:\Windows\System\svwIUwl.exe
  2⤵
  PID:11416
- C:\Windows\System\lDjxwes.exe
  C:\Windows\System\lDjxwes.exe
  2⤵
  PID:11536
- C:\Windows\System\BOxEkuZ.exe
  C:\Windows\System\BOxEkuZ.exe
  2⤵
  PID:12808
- C:\Windows\System\QPfHuPL.exe
  C:\Windows\System\QPfHuPL.exe
  2⤵
  PID:13276
- C:\Windows\System\GYqsvQn.exe
  C:\Windows\System\GYqsvQn.exe
  2⤵
  PID:12292
- C:\Windows\System\zyCHvFY.exe
  C:\Windows\System\zyCHvFY.exe
  2⤵
  PID:3408
- C:\Windows\System\pxJZUnd.exe
  C:\Windows\System\pxJZUnd.exe
  2⤵
  PID:8664
- C:\Windows\System\cGGdsxz.exe
  C:\Windows\System\cGGdsxz.exe
  2⤵
  PID:12692
- C:\Windows\System\XnoXFZb.exe
  C:\Windows\System\XnoXFZb.exe
  2⤵
  PID:4852
- C:\Windows\System\IQwWZWo.exe
  C:\Windows\System\IQwWZWo.exe
  2⤵
  PID:4244
- C:\Windows\System\AgUSDep.exe
  C:\Windows\System\AgUSDep.exe
  2⤵
  PID:12740
- C:\Windows\System\IVCyVBD.exe
  C:\Windows\System\IVCyVBD.exe
  2⤵
  PID:11908
- C:\Windows\System\QPnmxTu.exe
  C:\Windows\System\QPnmxTu.exe
  2⤵
  PID:3012
- C:\Windows\System\ArfLRej.exe
  C:\Windows\System\ArfLRej.exe
  2⤵
  PID:11356
- C:\Windows\System\iaKSOgv.exe
  C:\Windows\System\iaKSOgv.exe
  2⤵
  PID:9992
- C:\Windows\System\SNaYXRZ.exe
  C:\Windows\System\SNaYXRZ.exe
  2⤵
  PID:10256
- C:\Windows\System\ZjKbyqR.exe
  C:\Windows\System\ZjKbyqR.exe
  2⤵
  PID:12152
- C:\Windows\System\TcOFsaT.exe
  C:\Windows\System\TcOFsaT.exe
  2⤵
  PID:3396
- C:\Windows\System\CSTibRU.exe
  C:\Windows\System\CSTibRU.exe
  2⤵
  PID:8948
- C:\Windows\System\WRkTKgw.exe
  C:\Windows\System\WRkTKgw.exe
  2⤵
  PID:11088
- C:\Windows\System\eYLYUPq.exe
  C:\Windows\System\eYLYUPq.exe
  2⤵
  PID:12652
- C:\Windows\System\fKfvnxw.exe
  C:\Windows\System\fKfvnxw.exe
  2⤵
  PID:12016
- C:\Windows\System\OlnGprH.exe
  C:\Windows\System\OlnGprH.exe
  2⤵
  PID:3260
- C:\Windows\System\hjyuVZe.exe
  C:\Windows\System\hjyuVZe.exe
  2⤵
  PID:9092
- C:\Windows\System\rPkYBMn.exe
  C:\Windows\System\rPkYBMn.exe
  2⤵
  PID:9428
- C:\Windows\System\jjMlKhB.exe
  C:\Windows\System\jjMlKhB.exe
  2⤵
  PID:2680
- C:\Windows\System\ioBmmHm.exe
  C:\Windows\System\ioBmmHm.exe
  2⤵
  PID:11548
- C:\Windows\System\lqIHQOJ.exe
  C:\Windows\System\lqIHQOJ.exe
  2⤵
  PID:5308
- C:\Windows\System\uCqBdKj.exe
  C:\Windows\System\uCqBdKj.exe
  2⤵
  PID:4792
- C:\Windows\System\ghjmEHm.exe
  C:\Windows\System\ghjmEHm.exe
  2⤵
  PID:11540
- C:\Windows\System\GFPGJLY.exe
  C:\Windows\System\GFPGJLY.exe
  2⤵
  PID:8492
- C:\Windows\System\NSGBcNc.exe
  C:\Windows\System\NSGBcNc.exe
  2⤵
  PID:4576
- C:\Windows\System\mZrQEPz.exe
  C:\Windows\System\mZrQEPz.exe
  2⤵
  PID:13160
- C:\Windows\System\xEgWGue.exe
  C:\Windows\System\xEgWGue.exe
  2⤵
  PID:8104
- C:\Windows\System\ZgsjXGV.exe
  C:\Windows\System\ZgsjXGV.exe
  2⤵
  PID:12588
- C:\Windows\System\nqJETOd.exe
  C:\Windows\System\nqJETOd.exe
  2⤵
  PID:2588
- C:\Windows\System\NIdJXYQ.exe
  C:\Windows\System\NIdJXYQ.exe
  2⤵
  PID:1996
- C:\Windows\System\ZgHHiZC.exe
  C:\Windows\System\ZgHHiZC.exe
  2⤵
  PID:1080
- C:\Windows\System\hRlJzYo.exe
  C:\Windows\System\hRlJzYo.exe
  2⤵
  PID:14136
- C:\Windows\System\kVSOcac.exe
  C:\Windows\System\kVSOcac.exe
  2⤵
  PID:14168

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 1544 -ip 1544
1⤵
PID:11536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qvexanql.35o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ADTkfta.exe

Filesize
1.6MB

MD5
a5490552dc85f3667b1b4a0e6a6fe82a

SHA1
6bb813de7c90df69280cee75ac2822caccbd906d

SHA256
e65f33177585e31ab0c90c1f0684b1235c3518ab4af9d00c70e4027ded77f582

SHA512
9c12b02835bde61f8ca727dd412b26dad712230b924f6be8cc2fb327f02e92bc7fa977619d28d0b5496152ec1bd0c45fa75c83955ec64319f0b3c68ddf2d26e6

Download Submit
C:\Windows\System\CLheryI.exe

Filesize
1.6MB

MD5
a3e9060d9efde7e943d2bd738ed28dc2

SHA1
f4ed3e2de5cf4ab3976766a14995f6ba2e141f61

SHA256
a777e4204e0243f242fd05a999de4554d89847dc442c1a4a7d1890b3e6c50296

SHA512
7f8f2492ce7fca1718f73c92bf9ab1a679f2562d93429c0ceb5265300d04fff34c861a997cbc44f77123bb02e2492db55b9cfd60b589e33d2e672e9f7d5bcaf6

Download Submit
C:\Windows\System\CNItSkb.exe

Filesize
1.6MB

MD5
fadacde895ae3dda2f8f400ab06f069b

SHA1
30fb016d748ec9ef2a4a9fbcd94254ed3658295f

SHA256
b248ea45de76a94bc476630c48b4f13d413251ba8a153b2640102f0c44135621

SHA512
64790a3ceca5f805200bbbb46416fc54c72ff3f7e1333bcfa640cee59fd0e0b17840e54d605a15c0cf617ce954efa07377b7d3bba16e2e699fa2ab92b2388362

Download Submit
C:\Windows\System\DChnOKY.exe

Filesize
1.6MB

MD5
d86246177e6f7724cbd825ce18a8737f

SHA1
a42106d3bf3933209060c0ba8cf054d6dc0025d3

SHA256
208f3a6b24ffb7d8dd168a79b230a1b1d3ceaa05c6e18d97637c234388089852

SHA512
9665cd477f607114206e488ff4e9fa571c40c88d9f1ba45a21eafb4afa81f90964fdbe9612fca138f94c55bb6314c2dda460f82e084538656d6b8f225fa0a3f0

Download Submit
C:\Windows\System\FJaSqoD.exe

Filesize
1.6MB

MD5
a7f4b1ea76ecae892ab4b4828c25d588

SHA1
db5cd94f5d70f3de9fa48d1a965988e03813ac58

SHA256
43fec6a43be63301e21251a7dcc0a3bfb6a6f7d3540b6948e40379da89a995b4

SHA512
a7a272edeb97653678d545555506ef48343f6ebf3f0a737aa97807b6f5e281625630bd02883657c297342bc20a3f56031ba7893093c5ca840ddb257afe225096

Download Submit
C:\Windows\System\GFHcIYd.exe

Filesize
1.6MB

MD5
5053bbad3c7345c87267fac800c73c8a

SHA1
05862a9d1a15b28f7c26db7bc43def7f13d00817

SHA256
5afdbd2ed7779e214cb3bf27df65a4e047ee30ce9071b50ee4ccfc88994658da

SHA512
d4ecc03ce3f2adf77081c6f8b5c5831439981c443d401cdef9c676f73abe6752609989c9ae4fbc6baa61954bd300ad0d9b315c0f225b5a70595617edd19970e3

Download Submit
C:\Windows\System\GXcxKTS.exe

Filesize
1.6MB

MD5
c3509b016218b98fce65b6f099bfef73

SHA1
409226484054280fd1e33dfddd5e71d7f5b88d95

SHA256
5dbacdb2d6bf09126cacd2d44736fab1e719bdd4416ee60444226553051c703e

SHA512
d96016c9c220fbf0fd8970dd8a879502d262184a286b4d9373231524470654450d521b5c13c7de603362d03f5cafa921f9be6a950fd771758aa5b2791098d6c5

Download Submit
C:\Windows\System\GzBQxKu.exe

Filesize
1.6MB

MD5
1ee81f3255f983327fd8406d71b300d1

SHA1
405768251be44d79b3c6fe079022091a8cb51f8d

SHA256
8a6b6705edc1b60da0dc3c22e4b3190ad85e8a9be78972ccf284932ee7835471

SHA512
1998af0bdb47d8643cd198085ec347fe9708303d3643fa1e1e00eb950e42ef4efe79b4052c97b2ac0b703de8bcd4202ece0b1da19c5a9c49373906ce66b38583

Download Submit
C:\Windows\System\ICUINhO.exe

Filesize
1.6MB

MD5
e6174b18b3d17644e57e055cda7a7933

SHA1
74f921e0ed3ac3a75bd49557d2e106c354f7ba13

SHA256
cff000fbba696e6cd104ecc0df87e2dbb2ee54dc3139ec487a669577e0a9491b

SHA512
31c4965a1b6d4b76115c1a1e95c352f9e2ba6546a91c91a23f3c1b88cf1ec0742af6f2bf89ad55e4c33e2a8b5ce27b5c1211bce729527a0cff22c9121a64ecdb

Download Submit
C:\Windows\System\IHpPvYf.exe

Filesize
1.6MB

MD5
0f5df0e0081f6f0062e79e08cb2de341

SHA1
0cdf474bca78aba9a35feb065ec508eeec814189

SHA256
a42f664c1a97c83ec529845616f32c5f682c0a576c177adcea06e88e60816e21

SHA512
9c761425494e88d54d76831a9d9900bd9e1b47f2fb4b3a15efa05d635c56e54ee97ed0299a886baaaf3f509cca5fc546d5bc77d58bfaeffb30a1d9f8719fc85f

Download Submit
C:\Windows\System\JxItxJo.exe

Filesize
1.6MB

MD5
cc9708ea405e8c6609262b91312097d3

SHA1
9842a826974ae2ed4b57feedd2aa93f929df0bf7

SHA256
021226d7a1e6f21e8280a2c2f4fa56d407323d8811850f16f66f918d0a8de580

SHA512
7e21c085241abff3cf1ed801f7b62172074421a8426995349eb640e177e99c68753cba506259789dc8ad7fbd724f8e817d382e0cbaa0cd39aef1a2bc7cffd664

Download Submit
C:\Windows\System\KoLPdWp.exe

Filesize
1.6MB

MD5
f2f9e12ec090040f4af862fae6eb5672

SHA1
80e6a07e1015621aa0a57654dd5e2784ef36eca1

SHA256
8df6951a0e946d944dbed4b37b904e273005a88fc81ffd688793b5fb969515c4

SHA512
2f81f63fbec9f40992cef2418487755aba19b970f6eaeac87cd4b30302b38c16a54d5bb308750a53d6935959b710985c044b168efac599766c18f023012095c4

Download Submit
C:\Windows\System\KtCsJTn.exe

Filesize
1.6MB

MD5
0c0c9ff49ee5e47bcb8acd08e9cedbad

SHA1
c099f3830d9eff171f9ee04201230e583d781f74

SHA256
2defeeebc7836701c5eed56df6d606cf8334c604261389d9eb142a9af7c50114

SHA512
8e06fbab27f3f92640ca12d3778ad1c16ea5df4d3cb1efb40348bd20963243e8f608d54899111bc51306d1243dc4c219b75a8e0b9287fc1bce1f0586e4d63659

Download Submit
C:\Windows\System\NUkxbkr.exe

Filesize
1.6MB

MD5
faf8223b6f9af2a7f58545bad4633bc7

SHA1
acb141ac9eb34a0c22b0ca21cae0c5f54717b5ca

SHA256
4f975028d5acf5c7385dc218ab94aacdd90b124dff87916445886881d84de708

SHA512
76c2c707a5d687e7ba1d3c80b3fd141b8a6dceb4448949d4ec62ed97dbdd7be4dfa5c356a22d587f62ad0f3ae503f6e549bb9836d394907b13a5719cffd3021a

Download Submit
C:\Windows\System\NfQPdAr.exe

Filesize
1.6MB

MD5
9a3364244414d3c06e2c1618c2950338

SHA1
8313295e5b3581b4f18931c7bb85646baad44f99

SHA256
df52c315aecc9d97e13fa61891560edf45eac526bfdde802b87c4b70eeb5c287

SHA512
58e6f17ee99b6f59d038ef78b9cdb33019e89711319f17b835f81318a557c636deb760468b795106b1ead976009ef95fe154ff63de3deebd1fedf6044cc58088

Download Submit
C:\Windows\System\OqENMBJ.exe

Filesize
1.6MB

MD5
8df307ec0a7c84bc7de3962cba6cce09

SHA1
ea476b21d35d2ba0c4138dc7143d99e076580aff

SHA256
17f44541ef911c39b9eff6bb745909dcbb3d0e09b8ec120bf78d333a548b76da

SHA512
af4a1d86a7109ae9607cffa9912da763271da4a3c1bff6fb11d4534a7058ceccd50f30364cf2efcfb1ea60677114b08a4b31bd6003372299b0dd8a13e3a00582

Download Submit
C:\Windows\System\PawspFM.exe

Filesize
1.6MB

MD5
20488182a61b760feb84108f566824c6

SHA1
35e6b77ace9df44f2dc6cea9d1f5ed6095e35097

SHA256
d6a5b6c524d95d371c7cf57ab7cdc7bc20f86a84aad0028714785eff508bec29

SHA512
449b9552956fb359ed22c9cefc6c807dace4652cbf935b6b53327d7316b34897673d5015b41fe113e4b56fd6e50cdbade5236cf160d02bd8f67a2217f0b2b9c1

Download Submit
C:\Windows\System\QqrMlNA.exe

Filesize
1.6MB

MD5
a702915e82fd05f9e7a7168b26b25f48

SHA1
3f7b0485b96cf3b78c6e1f769599f8e69a9f890c

SHA256
67335d889ba023f46c7c78efef48692b5b93b9ac4aded6cac9ad79f008720348

SHA512
9f5e95f1a7053a4ae59e87ad4a714a6b4cd471028f2ef8001419fcfd740b416fd6ebe162568418bf3aaeeb55ddd0bc8e9581a2d2c8e3bc40da3c4d855a3683fe

Download Submit
C:\Windows\System\ROScPdT.exe

Filesize
1.6MB

MD5
b62409cfd933fa3e5398fef6e08d8cba

SHA1
0c0813b7431c918c3fcebba9a773e69edea9863b

SHA256
1b6b3548479b568b34d8080f5e40901da52e2890f198f29e2a83fd3f43904dff

SHA512
86a5df3c5f9e15cbfdee83eedad18f41aff4850bedc0c0cd5d27ffda4f6e21acdc72d10c4adacc2fd6c4af42d809349582c251d14d3631d7958c78336e620f4b

Download Submit
C:\Windows\System\RTKcUoc.exe

Filesize
1.6MB

MD5
101fb8764c12299ec6ae7377e31eddab

SHA1
67915e4f2ce6fa4a74948d770abeb25d3a9b9c91

SHA256
cbbc88e2bb720a54cdcc813ea99f03a26915e05158c6f379e7025b626f3a6ab5

SHA512
7e9a975b6992fd27a879126c9fa83a0109e7b6c985e52f083f0d777d24b06dc8673d84b6f8b254aa06e158df89e81467a479c3a56608dd1fa6590e900876d4fb

Download Submit
C:\Windows\System\TBYUhyx.exe

Filesize
1.6MB

MD5
ad1d6985284cda550dfa8d7db774164b

SHA1
12c701d05e8a1dacfc60b7905b567b2194940ba9

SHA256
800d4660eb58e64a31ab03c555c8830daac7c5a1f5a4c911a7c6c577ef4e7e96

SHA512
938d4cc2ae27bb41ef6acaa45c18c0b938cf797e974fc6c04c964b818faa3a81ccec6b64f006d1ad4a0a5e3e0938b4453a14a48d939d53250dab5ec40f30b5ff

Download Submit
C:\Windows\System\VFuBzxB.exe

Filesize
8B

MD5
67d893d1a2095d39d451d08ee1cc05e9

SHA1
dad7ef4487e41ff3c3e600250e691ed16832dc94

SHA256
cc871666e89dd430f5e3dc9cc361cd1a4ecf7214b4b8daeb86cca2257079f3ce

SHA512
7799e4db272ac6c136cb55f2e50c1582a5027767dc6d148dbf159fdb6f776a047cf2ac573fbb2f2ca5a994173cf0465c93ef3f6e6c86e8981136e854def9801d

Download Submit
C:\Windows\System\VOJiSjB.exe

Filesize
1.6MB

MD5
c36afeb61e7aca6b274c6ae74e0cfa11

SHA1
a71816e5632ca0a9b8af4ee3357943ad2f6a9b11

SHA256
7872fea6ec61b1b32cb814100536459f9d05f6afbc1a8cc177049cddcc5cbd45

SHA512
8bfc9a3c28b2f1ff92e52a4fd855c56e170d51f6fb0d3bd10e709d8d51ef812a3720fe07a36b83dcc901e2f627b5735dd4dd36e2157117cdf3c4fc7deb874839

Download Submit
C:\Windows\System\VtmQCkw.exe

Filesize
1.6MB

MD5
c02357f1278558937984f643ea4bc489

SHA1
4b9743b551036c13e531ce00e59d61621cc1eefb

SHA256
19cb6491ff46ac1467ce483076ebf5144344ff6770f6e6577a65390dc497886f

SHA512
b0cf20845ff818b590fba6635df57aaa2d60ab7843844ff8897ae7c9aae5bff3d1dfa6cf6a61d6b13fc772d8c09b7974b4e5dd3f152813a93ce5e442fef5c92b

Download Submit
C:\Windows\System\WdjhEVt.exe

Filesize
1.6MB

MD5
9ddc57e72b50ac933a00572d657d44fb

SHA1
52426ebc24267dd68fe623f1f0bbb3540e83203a

SHA256
712211b804fac7bf7f1a12c5dd824e47226912027c4b62d33a4ca10cbd0757fd

SHA512
c934eaab3576f060d8854a52b9a607dc2ba7e5c178d206a67cc5c43d73edda3b6f0d14442e5f863eb6d3ddd97e051eb99b6dce3b023ff10b26b2eeb5838eb962

Download Submit
C:\Windows\System\ZQZiXxf.exe

Filesize
1.6MB

MD5
e78c8166f747bf690b33917c277942c5

SHA1
9501f48d46d3468156d9d22ba2b2680746022e31

SHA256
f6ef00d09efe518aed45f68b14abf296e991a37a4f1dced9e2d40755da66f2ae

SHA512
49e120761718a12d2f748317ce780fdaed994651b1506942a1373d4f2346fdd1c0ce62f3e7ef6cfd7b849ebcfa73f6d35e9e15fd6019baf684fb6071217802aa

Download Submit
C:\Windows\System\abcDEtU.exe

Filesize
1.6MB

MD5
da22ecf02ced4635e43f3f15fd617621

SHA1
fe5b481349d4e6c438680b865a6777957c8a645d

SHA256
a48cf55a534ac026d0a8ce2f2266446a8fb63b32fa9b3aac3fb526d82886cd0d

SHA512
65a1206729f4d3f34a0ad8116bea501423c067d048639d24d50dfd3f38cac4e6915a49d39549c577d9c8544269ea196347fd9e012a1fc6806a9062698f654317

Download Submit
C:\Windows\System\hthtKPZ.exe

Filesize
1.6MB

MD5
0821d026da85ea9298ef83d8f3be48f9

SHA1
fe5359356b1909991a64e11e626d98ea530bf08e

SHA256
199cdc65230e65fedd78521e40a8f153afb8dbc04cbe5e67d7c74552b4be3237

SHA512
339ce660124b394de5051e8450e9851587f71e4c4956ebaa21a29b97100edd61a5c0d46a241b07e894bb4bbc3d302c8d1b414b23fafbbb7398a1cb2bf1cb666e

Download Submit
C:\Windows\System\ijcwuHH.exe

Filesize
1.6MB

MD5
f1fb6343e85eda108110436575658351

SHA1
6ef1a4d640cb9cf14cb3ce19b3107ebed5fe6c4d

SHA256
ef541ab35954e9a6ebda0df7f0f684e53863d3f2ee4079bf7e140f2a85cb0076

SHA512
94ef396d717901908f9e154450a248f3aa23563f9da2c7514e7da80d4fc2a0195ea253bc0decf09f1677f916f3aee0cc2331489d1b3cfbfd8da375568b0acdd4

Download Submit
C:\Windows\System\kPDHfVk.exe

Filesize
1.6MB

MD5
3506d2c2d6ea22422108601c7f9ade81

SHA1
bde71edc386a7f46a4f445f8a39b2b91cc98feee

SHA256
ae8442f73fb3babd8e0394638d7fd86728f0379868bdcbc00619f4c225f4a06b

SHA512
4f026a3fa4c20889a1f8f8c2a7a108917388477eaf318c8d66d715d0fa1092e086d2f5c4c3c72212340ad6dfc96fcaadc5f59a4464993aaed01d1d56767ac803

Download Submit
C:\Windows\System\kWOFgMC.exe

Filesize
1.6MB

MD5
761d79406c1441e195d1140762550a9e

SHA1
31d23693d14573df7942fe50b50a4c026350031c

SHA256
fbb720f46e2c51ae07660995dc6d9907031f9559c3bd63f791e3e9dbe008efd7

SHA512
fb6295677b9888c55ea90f457aa7aae08b97171056c24ba05e07f725c2170dbceb2b6dfdb2670b8f4014f5cdd1004a615539d1b34b460374d9701937c1d2e7b4

Download Submit
C:\Windows\System\lDSKRkS.exe

Filesize
1.6MB

MD5
c8356db529509c2b901f9cc93dfac9a3

SHA1
2af6c145733acd18927871446830c88a85c00cf7

SHA256
50d188f13b2fa276767ac6466865423ff7a0cec31425d0d7da9dd2d04c86d0c1

SHA512
2892c19918ed70661cf56d6e5c59ab65da871403a924ca7ca5a9e9fa4b60e40b8d0fef5db34bf34c08f9d2cb4582bc55a770e729d7c8f79f9ad53fe766107a3d

Download Submit
C:\Windows\System\mgRaIsx.exe

Filesize
1.6MB

MD5
a66a647e9a04ca5f2725f9e469b03edf

SHA1
758d862a7c15b50de900a655d97630fee0187bdd

SHA256
aff48040e990e314d7c2eae1f02aff6ac0a10abeba9eed698a2508a14ae47986

SHA512
d80fd82ac58b47a1c8e925cf0e9ed97ea9e2e760e5d98da45b30f3e63d723cbfa5bb0ac55ea18b328ce6083010eff2fe3826c4ac316b80d2b651b1114cf569de

Download Submit
C:\Windows\System\miSXisT.exe

Filesize
1.6MB

MD5
b2cca1621aab35f4d71ec2f5f223340b

SHA1
b8db5645c827a8becdc51e6876acac2f546111ca

SHA256
d06113dcd87836cc2ca69e4a8fcee7d1a7a7425b05aab613ac676696073b5442

SHA512
2ad4ee1802d8c101397075c9a1c9593f3bda4eb5c66b58e013fefe9a924a1ed112394c37ae9fc2f7427de44140cba0bfa714157c1f708cd2f74e58ce9a5dd6e8

Download Submit
C:\Windows\System\nrKAHLT.exe

Filesize
1.6MB

MD5
388e63fb49e0c665f1b23281c8623449

SHA1
9697463bf216b68dae45153c962e30bcdf0da590

SHA256
f27775c7f95df208746df6a08bd19054856edc1b1536f1c8640f96643e78c6d9

SHA512
1e8528c9a3ad0cd90d4244041a0e1c0a2ed4e8fea3951548a7be89633b6d82b7feb58751f40fdbe8d98fca1dfd7bc154440c1759787fb0a625cf2ad5cea40e67

Download Submit
C:\Windows\System\ocqttdF.exe

Filesize
1.6MB

MD5
8f60679c7ec63f3ec8a694cfea0b597b

SHA1
62f364cf7e8a25f9431c754cd6d23d5436202197

SHA256
2aa8ee9493f892679629ade4be7e39b803d0fca96adc823cd51c1b3180ebf4ad

SHA512
64c752724e211fe21b485c61a1706e71eaa8f00c4a1696b8f69bf3022c26dbc05992a34e4dbf32f092e7e06730c2ed97c82f6cc6210055795233fac9f3f80ada

Download Submit
C:\Windows\System\pIurETD.exe

Filesize
1.6MB

MD5
5f6bb1465f891171b13270e5c18aa363

SHA1
07ab7ffb4cce4f4229dbb21bbacc17924cf8f7ef

SHA256
e2b3dd29b2c49a9ddeab55d56598b033ea173db4311d5d20850bb3325fd14827

SHA512
ab9cce5cddd067309f2a5e7793193b916d80f13c049664c43252afd9364f1dca92dfd819c825a41d41b694081a5820b829d656d32b18083b24c7f42710415649

Download Submit
C:\Windows\System\pcEnESB.exe

Filesize
1.6MB

MD5
fdb7bcfeddc196de8f7cbf1010b5ba95

SHA1
99390d0b458b1a6f068511435355717fc89c2fbc

SHA256
28c0caef4353d1f20d214d29c49878072300d5e082dc98639a583db18a4cc709

SHA512
6ae25ad965803b7d7d9e4827d70ee587159c0e72689cc91c031be620d39dc4fb26209be3e961dbfbe3e3230a492ba61c212456c81ce4cb49a96dda7f3e67c961

Download Submit
C:\Windows\System\uPkdicG.exe

Filesize
1.6MB

MD5
38e2dcbf30639ed32c212a38b5740f11

SHA1
15e671da40e8fc10148de65f43a33647b550993c

SHA256
5f72a13fe14a7f63b3fd09d556508ad9e06615f87b12aa0f753a1af44b175185

SHA512
4dc46394999ecb736c024805256c8448528cde9a5de7e9af58643ee344372931c5ede1d91140a1326efd1c1bd614dd807ff8e05175bd656b8a4e8b63e34891d3

Download Submit
C:\Windows\System\vyypZYn.exe

Filesize
1.6MB

MD5
c664fccbfe53c97d004298499cda272a

SHA1
541d536403e5da003ebba017dd94bf3a6ce9c8f9

SHA256
8939f08fe5acc25b1a7c4caf4f7def37a4beb3d099ea6432897c389a338d0532

SHA512
8818369cc66a27f2814c8878abe127b7904c62b5a2ec00a584090006d0fa348df86a670bc385a8a12d7b68ccb02dbde51e2917bbbb478015e222adaac3a5161c

Download Submit
memory/408-3840-0x00007FF6A1CA0000-0x00007FF6A2092000-memory.dmp

Filesize
3.9MB

Download
memory/408-591-0x00007FF6A1CA0000-0x00007FF6A2092000-memory.dmp

Filesize
3.9MB

Download
memory/428-3826-0x00007FF7C4410000-0x00007FF7C4802000-memory.dmp

Filesize
3.9MB

Download
memory/428-194-0x00007FF7C4410000-0x00007FF7C4802000-memory.dmp

Filesize
3.9MB

Download
memory/740-724-0x00007FF669F60000-0x00007FF66A352000-memory.dmp

Filesize
3.9MB

Download
memory/740-3865-0x00007FF669F60000-0x00007FF66A352000-memory.dmp

Filesize
3.9MB

Download
memory/752-3831-0x00007FF6A98C0000-0x00007FF6A9CB2000-memory.dmp

Filesize
3.9MB

Download
memory/752-306-0x00007FF6A98C0000-0x00007FF6A9CB2000-memory.dmp

Filesize
3.9MB

Download
memory/848-471-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp

Filesize
3.9MB

Download
memory/848-3847-0x00007FF659AE0000-0x00007FF659ED2000-memory.dmp

Filesize
3.9MB

Download
memory/1004-729-0x00007FFF52840000-0x00007FFF53301000-memory.dmp

Filesize
10.8MB

Download
memory/1004-7-0x00007FFF52843000-0x00007FFF52845000-memory.dmp

Filesize
8KB

Download
memory/1004-92-0x00007FFF52840000-0x00007FFF53301000-memory.dmp

Filesize
10.8MB

Download
memory/1004-317-0x0000023D7CC30000-0x0000023D7CC52000-memory.dmp

Filesize
136KB

Download
memory/1652-3834-0x00007FF7CCC10000-0x00007FF7CD002000-memory.dmp

Filesize
3.9MB

Download
memory/1652-369-0x00007FF7CCC10000-0x00007FF7CD002000-memory.dmp

Filesize
3.9MB

Download
memory/1852-726-0x00007FF755C20000-0x00007FF756012000-memory.dmp

Filesize
3.9MB

Download
memory/1852-3875-0x00007FF755C20000-0x00007FF756012000-memory.dmp

Filesize
3.9MB

Download
memory/2088-730-0x00007FF69BD40000-0x00007FF69C132000-memory.dmp

Filesize
3.9MB

Download
memory/2088-3820-0x00007FF69BD40000-0x00007FF69C132000-memory.dmp

Filesize
3.9MB

Download
memory/2364-99-0x00007FF6B6DD0000-0x00007FF6B71C2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-3818-0x00007FF6B6DD0000-0x00007FF6B71C2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-731-0x00007FF61D220000-0x00007FF61D612000-memory.dmp

Filesize
3.9MB

Download
memory/2656-3863-0x00007FF61D220000-0x00007FF61D612000-memory.dmp

Filesize
3.9MB

Download
memory/2676-475-0x00007FF653AD0000-0x00007FF653EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-3850-0x00007FF653AD0000-0x00007FF653EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3500-3872-0x00007FF7F6C90000-0x00007FF7F7082000-memory.dmp

Filesize
3.9MB

Download
memory/3500-720-0x00007FF7F6C90000-0x00007FF7F7082000-memory.dmp

Filesize
3.9MB

Download
memory/3556-3832-0x00007FF7392A0000-0x00007FF739692000-memory.dmp

Filesize
3.9MB

Download
memory/3556-181-0x00007FF7392A0000-0x00007FF739692000-memory.dmp

Filesize
3.9MB

Download
memory/3744-1-0x00000227BDB50000-0x00000227BDB60000-memory.dmp

Filesize
64KB

Download
memory/3744-0-0x00007FF6CE560000-0x00007FF6CE952000-memory.dmp

Filesize
3.9MB

Download
memory/3948-3836-0x00007FF67ECD0000-0x00007FF67F0C2000-memory.dmp

Filesize
3.9MB

Download
memory/3948-725-0x00007FF67ECD0000-0x00007FF67F0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4380-596-0x00007FF7215A0000-0x00007FF721992000-memory.dmp

Filesize
3.9MB

Download
memory/4380-3844-0x00007FF7215A0000-0x00007FF721992000-memory.dmp

Filesize
3.9MB

Download
memory/4516-727-0x00007FF68BBC0000-0x00007FF68BFB2000-memory.dmp

Filesize
3.9MB

Download
memory/4516-3852-0x00007FF68BBC0000-0x00007FF68BFB2000-memory.dmp

Filesize
3.9MB

Download
memory/4608-3858-0x00007FF7FF650000-0x00007FF7FFA42000-memory.dmp

Filesize
3.9MB

Download
memory/4608-723-0x00007FF7FF650000-0x00007FF7FFA42000-memory.dmp

Filesize
3.9MB

Download
memory/4844-722-0x00007FF78F2C0000-0x00007FF78F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4844-3842-0x00007FF78F2C0000-0x00007FF78F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-3824-0x00007FF6B2AB0000-0x00007FF6B2EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-128-0x00007FF6B2AB0000-0x00007FF6B2EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-3839-0x00007FF6573C0000-0x00007FF6577B2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-243-0x00007FF6573C0000-0x00007FF6577B2000-memory.dmp

Filesize
3.9MB

Download
memory/4952-3848-0x00007FF665A60000-0x00007FF665E52000-memory.dmp

Filesize
3.9MB

Download
memory/4952-719-0x00007FF665A60000-0x00007FF665E52000-memory.dmp

Filesize
3.9MB

Download
memory/5056-3854-0x00007FF6A6720000-0x00007FF6A6B12000-memory.dmp

Filesize
3.9MB

Download
memory/5056-721-0x00007FF6A6720000-0x00007FF6A6B12000-memory.dmp

Filesize
3.9MB

Download
memory/5084-246-0x00007FF6C4000000-0x00007FF6C43F2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-3828-0x00007FF6C4000000-0x00007FF6C43F2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-728-0x00007FF6D8870000-0x00007FF6D8C62000-memory.dmp

Filesize
3.9MB

Download
memory/5112-3857-0x00007FF6D8870000-0x00007FF6D8C62000-memory.dmp

Filesize
3.9MB

Download