xmrig | 3e8962808e1b2db78c0f365b233fc1dff51970909ba9781d1080f6927e9d356a

Analysis

max time kernel
121s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
Size

2.1MB
MD5

6dd7284c578d01a75770cfcf8011e4d0
SHA1

ef939425ec29850467c42b93003af546095a3b62
SHA256

3e8962808e1b2db78c0f365b233fc1dff51970909ba9781d1080f6927e9d356a
SHA512

ed347c1819f2d871eccd05a6b0474e42f06979c67604d0723af6dd1975d6c7fff8a92f75bbf2764dbffcc4c8e6f5f292ca5816117515780e466ded2258e07a95
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTG4:NABd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3244-259-0x00007FF6558A0000-0x00007FF655C92000-memory.dmp	xmrig
behavioral2/memory/2496-269-0x00007FF688C20000-0x00007FF689012000-memory.dmp	xmrig
behavioral2/memory/2124-286-0x00007FF75C7C0000-0x00007FF75CBB2000-memory.dmp	xmrig
behavioral2/memory/436-368-0x00007FF610690000-0x00007FF610A82000-memory.dmp	xmrig
behavioral2/memory/4580-395-0x00007FF6462B0000-0x00007FF6466A2000-memory.dmp	xmrig
behavioral2/memory/4500-410-0x00007FF60B420000-0x00007FF60B812000-memory.dmp	xmrig
behavioral2/memory/1068-422-0x00007FF647F80000-0x00007FF648372000-memory.dmp	xmrig
behavioral2/memory/4468-428-0x00007FF7CD6A0000-0x00007FF7CDA92000-memory.dmp	xmrig
behavioral2/memory/4904-427-0x00007FF6EDCE0000-0x00007FF6EE0D2000-memory.dmp	xmrig
behavioral2/memory/1072-426-0x00007FF723D00000-0x00007FF7240F2000-memory.dmp	xmrig
behavioral2/memory/1692-425-0x00007FF636BC0000-0x00007FF636FB2000-memory.dmp	xmrig
behavioral2/memory/944-423-0x00007FF7A8C30000-0x00007FF7A9022000-memory.dmp	xmrig
behavioral2/memory/3632-421-0x00007FF631490000-0x00007FF631882000-memory.dmp	xmrig
behavioral2/memory/2736-406-0x00007FF62F4D0000-0x00007FF62F8C2000-memory.dmp	xmrig
behavioral2/memory/3616-394-0x00007FF712160000-0x00007FF712552000-memory.dmp	xmrig
behavioral2/memory/2336-347-0x00007FF76FC10000-0x00007FF770002000-memory.dmp	xmrig
behavioral2/memory/1272-345-0x00007FF764480000-0x00007FF764872000-memory.dmp	xmrig
behavioral2/memory/3964-344-0x00007FF77C9C0000-0x00007FF77CDB2000-memory.dmp	xmrig
behavioral2/memory/2328-325-0x00007FF6D9210000-0x00007FF6D9602000-memory.dmp	xmrig
behavioral2/memory/5076-268-0x00007FF7045A0000-0x00007FF704992000-memory.dmp	xmrig
behavioral2/memory/4816-214-0x00007FF61B590000-0x00007FF61B982000-memory.dmp	xmrig
behavioral2/memory/5036-150-0x00007FF726770000-0x00007FF726B62000-memory.dmp	xmrig
behavioral2/memory/1672-90-0x00007FF7DDDF0000-0x00007FF7DE1E2000-memory.dmp	xmrig
behavioral2/memory/716-71-0x00007FF74CCA0000-0x00007FF74D092000-memory.dmp	xmrig
behavioral2/memory/716-3329-0x00007FF74CCA0000-0x00007FF74D092000-memory.dmp	xmrig
behavioral2/memory/1672-3331-0x00007FF7DDDF0000-0x00007FF7DE1E2000-memory.dmp	xmrig
behavioral2/memory/4816-3335-0x00007FF61B590000-0x00007FF61B982000-memory.dmp	xmrig
behavioral2/memory/1692-3334-0x00007FF636BC0000-0x00007FF636FB2000-memory.dmp	xmrig
behavioral2/memory/5036-3337-0x00007FF726770000-0x00007FF726B62000-memory.dmp	xmrig
behavioral2/memory/4468-3360-0x00007FF7CD6A0000-0x00007FF7CDA92000-memory.dmp	xmrig
behavioral2/memory/4500-3361-0x00007FF60B420000-0x00007FF60B812000-memory.dmp	xmrig
behavioral2/memory/2328-3365-0x00007FF6D9210000-0x00007FF6D9602000-memory.dmp	xmrig
behavioral2/memory/436-3363-0x00007FF610690000-0x00007FF610A82000-memory.dmp	xmrig
behavioral2/memory/1272-3358-0x00007FF764480000-0x00007FF764872000-memory.dmp	xmrig
behavioral2/memory/2336-3356-0x00007FF76FC10000-0x00007FF770002000-memory.dmp	xmrig
behavioral2/memory/3244-3353-0x00007FF6558A0000-0x00007FF655C92000-memory.dmp	xmrig
behavioral2/memory/1072-3349-0x00007FF723D00000-0x00007FF7240F2000-memory.dmp	xmrig
behavioral2/memory/5076-3348-0x00007FF7045A0000-0x00007FF704992000-memory.dmp	xmrig
behavioral2/memory/4580-3345-0x00007FF6462B0000-0x00007FF6466A2000-memory.dmp	xmrig
behavioral2/memory/2124-3341-0x00007FF75C7C0000-0x00007FF75CBB2000-memory.dmp	xmrig
behavioral2/memory/4904-3340-0x00007FF6EDCE0000-0x00007FF6EE0D2000-memory.dmp	xmrig
behavioral2/memory/2496-3352-0x00007FF688C20000-0x00007FF689012000-memory.dmp	xmrig
behavioral2/memory/3964-3344-0x00007FF77C9C0000-0x00007FF77CDB2000-memory.dmp	xmrig
behavioral2/memory/3632-3383-0x00007FF631490000-0x00007FF631882000-memory.dmp	xmrig
behavioral2/memory/2736-3413-0x00007FF62F4D0000-0x00007FF62F8C2000-memory.dmp	xmrig
behavioral2/memory/944-3379-0x00007FF7A8C30000-0x00007FF7A9022000-memory.dmp	xmrig
behavioral2/memory/3616-3376-0x00007FF712160000-0x00007FF712552000-memory.dmp	xmrig
behavioral2/memory/1068-3375-0x00007FF647F80000-0x00007FF648372000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2756	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
716	smueQMM.exe
1692	pbsFhkq.exe
1672	HMfgZqd.exe
5036	qnUANif.exe
4816	dQzlfll.exe
3244	GExjLCl.exe
5076	XUKcgTa.exe
1072	MtCfdXZ.exe
2496	fwUQFJp.exe
2124	nHUPahQ.exe
2328	TczTBwm.exe
3964	RXlAwXh.exe
4904	xVBlcxS.exe
1272	IxXyupd.exe
2336	ROsDSKY.exe
436	egBKpuJ.exe
3616	LBnvSvX.exe
4580	PcyAEKC.exe
2736	KDviODU.exe
4468	jfVfsyh.exe
4500	AUOFHrx.exe
3632	fJNQFVY.exe
1068	QWvWEBE.exe
944	woGNpXD.exe
3436	ObDpHju.exe
1612	mGrNmcl.exe
2464	gLVlvKK.exe
1308	DJMpPCp.exe
1920	RegmPXu.exe
4920	xynjbSL.exe
1684	BkyvqTo.exe
3388	gYThNHe.exe
544	gbPmDnG.exe
4400	OZWsYJd.exe
1060	NjvfeWL.exe
4164	mppYRGQ.exe
324	LuZeNeH.exe
4216	OGbsGJf.exe
3000	OFmmbtj.exe
4560	RtNUgUu.exe
3392	PqRKonE.exe
1316	EYVmYug.exe
2960	jtSYSte.exe
3492	IYMkmve.exe
1884	TamjVrv.exe
924	VgSvdbL.exe
4436	BEUFSzE.exe
1104	EvsHPLc.exe
5008	OFWSwLD.exe
3360	AsNxjYd.exe
3064	QPRhUqD.exe
4428	JDiHpUP.exe
452	hqYexkn.exe
4800	nBgwZqm.exe
3644	aQijMBA.exe
1748	OMbCDVA.exe
4368	QbIxVBd.exe
1968	ZKyfAuc.exe
3176	rmMllxR.exe
2484	IwVDXQB.exe
3168	AbVgIjz.exe
3996	BXIfisz.exe
4440	PkEvQPM.exe
1832	dWJuMMX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2540-0-0x00007FF76ADE0000-0x00007FF76B1D2000-memory.dmp	upx
behavioral2/files/0x000800000002340d-7.dat	upx
behavioral2/files/0x0007000000023417-42.dat	upx
behavioral2/files/0x0007000000023419-57.dat	upx
behavioral2/files/0x000700000002341f-77.dat	upx
behavioral2/files/0x000700000002341b-99.dat	upx
behavioral2/files/0x0007000000023432-169.dat	upx
behavioral2/memory/3244-259-0x00007FF6558A0000-0x00007FF655C92000-memory.dmp	upx
behavioral2/memory/2496-269-0x00007FF688C20000-0x00007FF689012000-memory.dmp	upx
behavioral2/memory/2124-286-0x00007FF75C7C0000-0x00007FF75CBB2000-memory.dmp	upx
behavioral2/memory/436-368-0x00007FF610690000-0x00007FF610A82000-memory.dmp	upx
behavioral2/memory/4580-395-0x00007FF6462B0000-0x00007FF6466A2000-memory.dmp	upx
behavioral2/memory/4500-410-0x00007FF60B420000-0x00007FF60B812000-memory.dmp	upx
behavioral2/memory/1068-422-0x00007FF647F80000-0x00007FF648372000-memory.dmp	upx
behavioral2/memory/4468-428-0x00007FF7CD6A0000-0x00007FF7CDA92000-memory.dmp	upx
behavioral2/memory/4904-427-0x00007FF6EDCE0000-0x00007FF6EE0D2000-memory.dmp	upx
behavioral2/memory/1072-426-0x00007FF723D00000-0x00007FF7240F2000-memory.dmp	upx
behavioral2/memory/1692-425-0x00007FF636BC0000-0x00007FF636FB2000-memory.dmp	upx
behavioral2/memory/944-423-0x00007FF7A8C30000-0x00007FF7A9022000-memory.dmp	upx
behavioral2/memory/3632-421-0x00007FF631490000-0x00007FF631882000-memory.dmp	upx
behavioral2/memory/2736-406-0x00007FF62F4D0000-0x00007FF62F8C2000-memory.dmp	upx
behavioral2/memory/3616-394-0x00007FF712160000-0x00007FF712552000-memory.dmp	upx
behavioral2/memory/2336-347-0x00007FF76FC10000-0x00007FF770002000-memory.dmp	upx
behavioral2/memory/1272-345-0x00007FF764480000-0x00007FF764872000-memory.dmp	upx
behavioral2/memory/3964-344-0x00007FF77C9C0000-0x00007FF77CDB2000-memory.dmp	upx
behavioral2/memory/2328-325-0x00007FF6D9210000-0x00007FF6D9602000-memory.dmp	upx
behavioral2/memory/5076-268-0x00007FF7045A0000-0x00007FF704992000-memory.dmp	upx
behavioral2/memory/4816-214-0x00007FF61B590000-0x00007FF61B982000-memory.dmp	upx
behavioral2/files/0x0007000000023438-207.dat	upx
behavioral2/files/0x0007000000023427-206.dat	upx
behavioral2/files/0x0007000000023426-200.dat	upx
behavioral2/files/0x0007000000023436-190.dat	upx
behavioral2/files/0x000700000002342a-189.dat	upx
behavioral2/files/0x0007000000023435-179.dat	upx
behavioral2/files/0x0007000000023434-176.dat	upx
behavioral2/files/0x0007000000023431-166.dat	upx
behavioral2/files/0x000700000002342f-164.dat	upx
behavioral2/files/0x000700000002342e-163.dat	upx
behavioral2/files/0x000700000002342d-162.dat	upx
behavioral2/files/0x000700000002342c-161.dat	upx
behavioral2/files/0x000700000002342b-158.dat	upx
behavioral2/files/0x0007000000023422-153.dat	upx
behavioral2/files/0x0007000000023421-194.dat	upx
behavioral2/memory/5036-150-0x00007FF726770000-0x00007FF726B62000-memory.dmp	upx
behavioral2/files/0x0007000000023425-170.dat	upx
behavioral2/files/0x000700000002341a-137.dat	upx
behavioral2/files/0x0007000000023420-133.dat	upx
behavioral2/files/0x0007000000023424-127.dat	upx
behavioral2/files/0x0007000000023423-123.dat	upx
behavioral2/files/0x0007000000023428-107.dat	upx
behavioral2/files/0x0007000000023429-143.dat	upx
behavioral2/files/0x000700000002341e-114.dat	upx
behavioral2/files/0x000700000002341c-92.dat	upx
behavioral2/memory/1672-90-0x00007FF7DDDF0000-0x00007FF7DE1E2000-memory.dmp	upx
behavioral2/files/0x000700000002341d-108.dat	upx
behavioral2/memory/716-71-0x00007FF74CCA0000-0x00007FF74D092000-memory.dmp	upx
behavioral2/files/0x0007000000023418-49.dat	upx
behavioral2/files/0x0007000000023415-45.dat	upx
behavioral2/files/0x0007000000023416-54.dat	upx
behavioral2/files/0x0007000000023413-30.dat	upx
behavioral2/files/0x0007000000023412-27.dat	upx
behavioral2/files/0x0007000000023414-21.dat	upx
behavioral2/files/0x0007000000023411-24.dat	upx
behavioral2/memory/716-3329-0x00007FF74CCA0000-0x00007FF74D092000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VgSvdbL.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\XGSTKqB.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\HXWBhjV.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\IXZkYjr.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\rZXnuYu.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\dWLvHvR.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\oLlhOBi.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\CpagOhY.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\XKhXksM.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\HZXgiey.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\KULOZVb.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\ACieZDh.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\rQREEJG.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\FDTxerd.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\YYaPckQ.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\lAeZGIf.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\YMeFTRn.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\bhCMVCg.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\nJXngEG.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\HmWqHoL.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\RAcFqxQ.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\juiTKEV.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\XbYCcki.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\MpEiCaA.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\OGbsGJf.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\RtNUgUu.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\xRqeKmN.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\zECuvkf.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZzIxuoO.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\TbVivNG.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\RnLiniC.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\BxzPtga.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\RwGYnud.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\PPupiah.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\rrOQhhC.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\YoyYEDu.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\rXOgSJz.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\dJYcBEd.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\NPxmusM.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\bxMOUcd.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\zgAEXJw.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\rIlMjaa.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\QOJQrMf.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\ubvXxJe.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\RTiDraq.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\cVSTHGX.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\WZnAZZg.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\bgTRrXh.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\rruUvfV.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\EZtWlvF.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\YtBYlpl.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\NDVmHQy.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\PWdtCil.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\xynjbSL.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\DtEJqNx.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\OurBzXZ.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\fsIKbhn.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\yHneQvf.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\xVTJpCD.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\TnNHgAH.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\iPMWglB.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\CORehgL.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\kcpsRgj.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
File created	C:\Windows\System\VzPxbWy.exe	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2756	powershell.exe
2756	powershell.exe
2756	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2756	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2756	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	84
PID 2540 wrote to memory of 2756	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	84
PID 2540 wrote to memory of 716	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	85
PID 2540 wrote to memory of 716	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	85
PID 2540 wrote to memory of 1692	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	86
PID 2540 wrote to memory of 1692	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	86
PID 2540 wrote to memory of 1672	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	87
PID 2540 wrote to memory of 1672	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	87
PID 2540 wrote to memory of 5036	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	88
PID 2540 wrote to memory of 5036	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	88
PID 2540 wrote to memory of 4816	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	89
PID 2540 wrote to memory of 4816	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	89
PID 2540 wrote to memory of 3244	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	90
PID 2540 wrote to memory of 3244	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	90
PID 2540 wrote to memory of 5076	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	91
PID 2540 wrote to memory of 5076	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	91
PID 2540 wrote to memory of 1072	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	92
PID 2540 wrote to memory of 1072	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	92
PID 2540 wrote to memory of 2496	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	93
PID 2540 wrote to memory of 2496	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	93
PID 2540 wrote to memory of 2124	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	94
PID 2540 wrote to memory of 2124	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	94
PID 2540 wrote to memory of 2328	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	95
PID 2540 wrote to memory of 2328	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	95
PID 2540 wrote to memory of 3964	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	96
PID 2540 wrote to memory of 3964	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	96
PID 2540 wrote to memory of 4580	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	97
PID 2540 wrote to memory of 4580	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	97
PID 2540 wrote to memory of 4904	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	98
PID 2540 wrote to memory of 4904	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	98
PID 2540 wrote to memory of 1272	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	99
PID 2540 wrote to memory of 1272	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	99
PID 2540 wrote to memory of 2336	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	100
PID 2540 wrote to memory of 2336	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	100
PID 2540 wrote to memory of 436	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	101
PID 2540 wrote to memory of 436	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	101
PID 2540 wrote to memory of 3616	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	102
PID 2540 wrote to memory of 3616	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	102
PID 2540 wrote to memory of 2736	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	103
PID 2540 wrote to memory of 2736	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	103
PID 2540 wrote to memory of 4468	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	104
PID 2540 wrote to memory of 4468	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	104
PID 2540 wrote to memory of 4500	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	105
PID 2540 wrote to memory of 4500	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	105
PID 2540 wrote to memory of 3632	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	106
PID 2540 wrote to memory of 3632	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	106
PID 2540 wrote to memory of 1068	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	107
PID 2540 wrote to memory of 1068	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	107
PID 2540 wrote to memory of 944	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	108
PID 2540 wrote to memory of 944	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	108
PID 2540 wrote to memory of 3436	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	109
PID 2540 wrote to memory of 3436	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	109
PID 2540 wrote to memory of 1612	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	110
PID 2540 wrote to memory of 1612	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	110
PID 2540 wrote to memory of 2464	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	111
PID 2540 wrote to memory of 2464	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	111
PID 2540 wrote to memory of 1308	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	112
PID 2540 wrote to memory of 1308	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	112
PID 2540 wrote to memory of 1920	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	113
PID 2540 wrote to memory of 1920	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	113
PID 2540 wrote to memory of 4920	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	114
PID 2540 wrote to memory of 4920	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	114
PID 2540 wrote to memory of 1684	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	115
PID 2540 wrote to memory of 1684	2540	6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6dd7284c578d01a75770cfcf8011e4d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\System\smueQMM.exe
  C:\Windows\System\smueQMM.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\pbsFhkq.exe
  C:\Windows\System\pbsFhkq.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\HMfgZqd.exe
  C:\Windows\System\HMfgZqd.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\qnUANif.exe
  C:\Windows\System\qnUANif.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\dQzlfll.exe
  C:\Windows\System\dQzlfll.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\GExjLCl.exe
  C:\Windows\System\GExjLCl.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\XUKcgTa.exe
  C:\Windows\System\XUKcgTa.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\MtCfdXZ.exe
  C:\Windows\System\MtCfdXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\fwUQFJp.exe
  C:\Windows\System\fwUQFJp.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\nHUPahQ.exe
  C:\Windows\System\nHUPahQ.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\TczTBwm.exe
  C:\Windows\System\TczTBwm.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\RXlAwXh.exe
  C:\Windows\System\RXlAwXh.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\PcyAEKC.exe
  C:\Windows\System\PcyAEKC.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\xVBlcxS.exe
  C:\Windows\System\xVBlcxS.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\IxXyupd.exe
  C:\Windows\System\IxXyupd.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\ROsDSKY.exe
  C:\Windows\System\ROsDSKY.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\egBKpuJ.exe
  C:\Windows\System\egBKpuJ.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\LBnvSvX.exe
  C:\Windows\System\LBnvSvX.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\KDviODU.exe
  C:\Windows\System\KDviODU.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\jfVfsyh.exe
  C:\Windows\System\jfVfsyh.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\AUOFHrx.exe
  C:\Windows\System\AUOFHrx.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\fJNQFVY.exe
  C:\Windows\System\fJNQFVY.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\QWvWEBE.exe
  C:\Windows\System\QWvWEBE.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\woGNpXD.exe
  C:\Windows\System\woGNpXD.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\ObDpHju.exe
  C:\Windows\System\ObDpHju.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\mGrNmcl.exe
  C:\Windows\System\mGrNmcl.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\gLVlvKK.exe
  C:\Windows\System\gLVlvKK.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\DJMpPCp.exe
  C:\Windows\System\DJMpPCp.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\RegmPXu.exe
  C:\Windows\System\RegmPXu.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\xynjbSL.exe
  C:\Windows\System\xynjbSL.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\BkyvqTo.exe
  C:\Windows\System\BkyvqTo.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\gYThNHe.exe
  C:\Windows\System\gYThNHe.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\PqRKonE.exe
  C:\Windows\System\PqRKonE.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\gbPmDnG.exe
  C:\Windows\System\gbPmDnG.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\OZWsYJd.exe
  C:\Windows\System\OZWsYJd.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\jtSYSte.exe
  C:\Windows\System\jtSYSte.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\NjvfeWL.exe
  C:\Windows\System\NjvfeWL.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\mppYRGQ.exe
  C:\Windows\System\mppYRGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\LuZeNeH.exe
  C:\Windows\System\LuZeNeH.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\EvsHPLc.exe
  C:\Windows\System\EvsHPLc.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\OGbsGJf.exe
  C:\Windows\System\OGbsGJf.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\OFmmbtj.exe
  C:\Windows\System\OFmmbtj.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\RtNUgUu.exe
  C:\Windows\System\RtNUgUu.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\EYVmYug.exe
  C:\Windows\System\EYVmYug.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\IYMkmve.exe
  C:\Windows\System\IYMkmve.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\TamjVrv.exe
  C:\Windows\System\TamjVrv.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\VgSvdbL.exe
  C:\Windows\System\VgSvdbL.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\BEUFSzE.exe
  C:\Windows\System\BEUFSzE.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\OFWSwLD.exe
  C:\Windows\System\OFWSwLD.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\AsNxjYd.exe
  C:\Windows\System\AsNxjYd.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\QPRhUqD.exe
  C:\Windows\System\QPRhUqD.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\JDiHpUP.exe
  C:\Windows\System\JDiHpUP.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\hqYexkn.exe
  C:\Windows\System\hqYexkn.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\nBgwZqm.exe
  C:\Windows\System\nBgwZqm.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\aQijMBA.exe
  C:\Windows\System\aQijMBA.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\OMbCDVA.exe
  C:\Windows\System\OMbCDVA.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\QbIxVBd.exe
  C:\Windows\System\QbIxVBd.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\ZKyfAuc.exe
  C:\Windows\System\ZKyfAuc.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\rmMllxR.exe
  C:\Windows\System\rmMllxR.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\IwVDXQB.exe
  C:\Windows\System\IwVDXQB.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\AbVgIjz.exe
  C:\Windows\System\AbVgIjz.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\BXIfisz.exe
  C:\Windows\System\BXIfisz.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\PkEvQPM.exe
  C:\Windows\System\PkEvQPM.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\dWJuMMX.exe
  C:\Windows\System\dWJuMMX.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\phWKOfk.exe
  C:\Windows\System\phWKOfk.exe
  2⤵
  PID:4616
- C:\Windows\System\HFMLkLX.exe
  C:\Windows\System\HFMLkLX.exe
  2⤵
  PID:4624
- C:\Windows\System\PPupiah.exe
  C:\Windows\System\PPupiah.exe
  2⤵
  PID:4496
- C:\Windows\System\FLKwUNu.exe
  C:\Windows\System\FLKwUNu.exe
  2⤵
  PID:1816
- C:\Windows\System\gBodPLM.exe
  C:\Windows\System\gBodPLM.exe
  2⤵
  PID:2424
- C:\Windows\System\AvdUXWY.exe
  C:\Windows\System\AvdUXWY.exe
  2⤵
  PID:1820
- C:\Windows\System\pMrbGVx.exe
  C:\Windows\System\pMrbGVx.exe
  2⤵
  PID:4188
- C:\Windows\System\gHDpXvG.exe
  C:\Windows\System\gHDpXvG.exe
  2⤵
  PID:3232
- C:\Windows\System\IRLCIOI.exe
  C:\Windows\System\IRLCIOI.exe
  2⤵
  PID:3088
- C:\Windows\System\mUzXYjD.exe
  C:\Windows\System\mUzXYjD.exe
  2⤵
  PID:5132
- C:\Windows\System\LzARXsE.exe
  C:\Windows\System\LzARXsE.exe
  2⤵
  PID:5156
- C:\Windows\System\XHaeEZj.exe
  C:\Windows\System\XHaeEZj.exe
  2⤵
  PID:5172
- C:\Windows\System\JIMEwed.exe
  C:\Windows\System\JIMEwed.exe
  2⤵
  PID:5320
- C:\Windows\System\ZFnWQSP.exe
  C:\Windows\System\ZFnWQSP.exe
  2⤵
  PID:5348
- C:\Windows\System\LgecnnF.exe
  C:\Windows\System\LgecnnF.exe
  2⤵
  PID:5372
- C:\Windows\System\XVSEzjQ.exe
  C:\Windows\System\XVSEzjQ.exe
  2⤵
  PID:5396
- C:\Windows\System\OlMbNXU.exe
  C:\Windows\System\OlMbNXU.exe
  2⤵
  PID:5420
- C:\Windows\System\HZRlSQF.exe
  C:\Windows\System\HZRlSQF.exe
  2⤵
  PID:5448
- C:\Windows\System\OuKOtLj.exe
  C:\Windows\System\OuKOtLj.exe
  2⤵
  PID:5468
- C:\Windows\System\LHUtkVY.exe
  C:\Windows\System\LHUtkVY.exe
  2⤵
  PID:5492
- C:\Windows\System\IawlHSL.exe
  C:\Windows\System\IawlHSL.exe
  2⤵
  PID:5512
- C:\Windows\System\QSBVXiu.exe
  C:\Windows\System\QSBVXiu.exe
  2⤵
  PID:5544
- C:\Windows\System\bsdTCSi.exe
  C:\Windows\System\bsdTCSi.exe
  2⤵
  PID:5568
- C:\Windows\System\GcVwktk.exe
  C:\Windows\System\GcVwktk.exe
  2⤵
  PID:5596
- C:\Windows\System\PGvQmqg.exe
  C:\Windows\System\PGvQmqg.exe
  2⤵
  PID:5616
- C:\Windows\System\YtBYlpl.exe
  C:\Windows\System\YtBYlpl.exe
  2⤵
  PID:5652
- C:\Windows\System\HMNJTJu.exe
  C:\Windows\System\HMNJTJu.exe
  2⤵
  PID:5784
- C:\Windows\System\JPVtKHm.exe
  C:\Windows\System\JPVtKHm.exe
  2⤵
  PID:5904
- C:\Windows\System\CLRbYGy.exe
  C:\Windows\System\CLRbYGy.exe
  2⤵
  PID:5928
- C:\Windows\System\KMzZWuv.exe
  C:\Windows\System\KMzZWuv.exe
  2⤵
  PID:5948
- C:\Windows\System\kYhKWXW.exe
  C:\Windows\System\kYhKWXW.exe
  2⤵
  PID:5968
- C:\Windows\System\vEqCylW.exe
  C:\Windows\System\vEqCylW.exe
  2⤵
  PID:5992
- C:\Windows\System\tVFehMe.exe
  C:\Windows\System\tVFehMe.exe
  2⤵
  PID:6060
- C:\Windows\System\EUWcRZb.exe
  C:\Windows\System\EUWcRZb.exe
  2⤵
  PID:6076
- C:\Windows\System\AqkOMwF.exe
  C:\Windows\System\AqkOMwF.exe
  2⤵
  PID:6092
- C:\Windows\System\fOhsXmz.exe
  C:\Windows\System\fOhsXmz.exe
  2⤵
  PID:6112
- C:\Windows\System\swVCrhf.exe
  C:\Windows\System\swVCrhf.exe
  2⤵
  PID:6128
- C:\Windows\System\hKPEvze.exe
  C:\Windows\System\hKPEvze.exe
  2⤵
  PID:4236
- C:\Windows\System\oBiDkUb.exe
  C:\Windows\System\oBiDkUb.exe
  2⤵
  PID:2596
- C:\Windows\System\GDQREqR.exe
  C:\Windows\System\GDQREqR.exe
  2⤵
  PID:5072
- C:\Windows\System\eZerRZn.exe
  C:\Windows\System\eZerRZn.exe
  2⤵
  PID:1700
- C:\Windows\System\FZxGpzo.exe
  C:\Windows\System\FZxGpzo.exe
  2⤵
  PID:3784
- C:\Windows\System\VUrAAIp.exe
  C:\Windows\System\VUrAAIp.exe
  2⤵
  PID:4364
- C:\Windows\System\pqtmYUi.exe
  C:\Windows\System\pqtmYUi.exe
  2⤵
  PID:3352
- C:\Windows\System\cBtYaWE.exe
  C:\Windows\System\cBtYaWE.exe
  2⤵
  PID:4808
- C:\Windows\System\zpQOazS.exe
  C:\Windows\System\zpQOazS.exe
  2⤵
  PID:2224
- C:\Windows\System\icCsJqx.exe
  C:\Windows\System\icCsJqx.exe
  2⤵
  PID:4868
- C:\Windows\System\rrOQhhC.exe
  C:\Windows\System\rrOQhhC.exe
  2⤵
  PID:404
- C:\Windows\System\fSfiWJs.exe
  C:\Windows\System\fSfiWJs.exe
  2⤵
  PID:5312
- C:\Windows\System\KKWsuJm.exe
  C:\Windows\System\KKWsuJm.exe
  2⤵
  PID:5356
- C:\Windows\System\qUvOrxJ.exe
  C:\Windows\System\qUvOrxJ.exe
  2⤵
  PID:5384
- C:\Windows\System\LMDteZc.exe
  C:\Windows\System\LMDteZc.exe
  2⤵
  PID:5416
- C:\Windows\System\aMfJdcz.exe
  C:\Windows\System\aMfJdcz.exe
  2⤵
  PID:5460
- C:\Windows\System\mLipNee.exe
  C:\Windows\System\mLipNee.exe
  2⤵
  PID:5488
- C:\Windows\System\DBEVeBP.exe
  C:\Windows\System\DBEVeBP.exe
  2⤵
  PID:5608
- C:\Windows\System\aCpuRGN.exe
  C:\Windows\System\aCpuRGN.exe
  2⤵
  PID:5676
- C:\Windows\System\sMEOvcE.exe
  C:\Windows\System\sMEOvcE.exe
  2⤵
  PID:5976
- C:\Windows\System\wJwsoYm.exe
  C:\Windows\System\wJwsoYm.exe
  2⤵
  PID:5708
- C:\Windows\System\urFfZtb.exe
  C:\Windows\System\urFfZtb.exe
  2⤵
  PID:1508
- C:\Windows\System\SMqJaxW.exe
  C:\Windows\System\SMqJaxW.exe
  2⤵
  PID:5792
- C:\Windows\System\zawFRwP.exe
  C:\Windows\System\zawFRwP.exe
  2⤵
  PID:5856
- C:\Windows\System\tdzDaHU.exe
  C:\Windows\System\tdzDaHU.exe
  2⤵
  PID:5888
- C:\Windows\System\HtEJlsd.exe
  C:\Windows\System\HtEJlsd.exe
  2⤵
  PID:5920
- C:\Windows\System\suUlifY.exe
  C:\Windows\System\suUlifY.exe
  2⤵
  PID:5944
- C:\Windows\System\EqsWhdq.exe
  C:\Windows\System\EqsWhdq.exe
  2⤵
  PID:2164
- C:\Windows\System\GLRVNFv.exe
  C:\Windows\System\GLRVNFv.exe
  2⤵
  PID:6120
- C:\Windows\System\PmKHhQc.exe
  C:\Windows\System\PmKHhQc.exe
  2⤵
  PID:6084
- C:\Windows\System\SqvPkHW.exe
  C:\Windows\System\SqvPkHW.exe
  2⤵
  PID:4492
- C:\Windows\System\ACieZDh.exe
  C:\Windows\System\ACieZDh.exe
  2⤵
  PID:2264
- C:\Windows\System\AhIwoWV.exe
  C:\Windows\System\AhIwoWV.exe
  2⤵
  PID:460
- C:\Windows\System\ptPRlul.exe
  C:\Windows\System\ptPRlul.exe
  2⤵
  PID:6372
- C:\Windows\System\IVhczEG.exe
  C:\Windows\System\IVhczEG.exe
  2⤵
  PID:6388
- C:\Windows\System\jTFWIuk.exe
  C:\Windows\System\jTFWIuk.exe
  2⤵
  PID:6404
- C:\Windows\System\BfPdrGR.exe
  C:\Windows\System\BfPdrGR.exe
  2⤵
  PID:6420
- C:\Windows\System\fYrTnNJ.exe
  C:\Windows\System\fYrTnNJ.exe
  2⤵
  PID:6440
- C:\Windows\System\AYGQsnR.exe
  C:\Windows\System\AYGQsnR.exe
  2⤵
  PID:6460
- C:\Windows\System\APoQrwf.exe
  C:\Windows\System\APoQrwf.exe
  2⤵
  PID:6480
- C:\Windows\System\wrBetCW.exe
  C:\Windows\System\wrBetCW.exe
  2⤵
  PID:6500
- C:\Windows\System\pxAJBIt.exe
  C:\Windows\System\pxAJBIt.exe
  2⤵
  PID:6520
- C:\Windows\System\tQhpPyg.exe
  C:\Windows\System\tQhpPyg.exe
  2⤵
  PID:6704
- C:\Windows\System\BbunWLk.exe
  C:\Windows\System\BbunWLk.exe
  2⤵
  PID:6728
- C:\Windows\System\UZRNMQu.exe
  C:\Windows\System\UZRNMQu.exe
  2⤵
  PID:6748
- C:\Windows\System\KlWnaGF.exe
  C:\Windows\System\KlWnaGF.exe
  2⤵
  PID:6768
- C:\Windows\System\CsTvobg.exe
  C:\Windows\System\CsTvobg.exe
  2⤵
  PID:6788
- C:\Windows\System\BIIGxYI.exe
  C:\Windows\System\BIIGxYI.exe
  2⤵
  PID:6808
- C:\Windows\System\cFMiact.exe
  C:\Windows\System\cFMiact.exe
  2⤵
  PID:6824
- C:\Windows\System\sQavwei.exe
  C:\Windows\System\sQavwei.exe
  2⤵
  PID:6844
- C:\Windows\System\AYmkRYp.exe
  C:\Windows\System\AYmkRYp.exe
  2⤵
  PID:6860
- C:\Windows\System\DmaSYpM.exe
  C:\Windows\System\DmaSYpM.exe
  2⤵
  PID:6888
- C:\Windows\System\fgIfWTB.exe
  C:\Windows\System\fgIfWTB.exe
  2⤵
  PID:6908
- C:\Windows\System\vVXONaM.exe
  C:\Windows\System\vVXONaM.exe
  2⤵
  PID:6932
- C:\Windows\System\KjOslUs.exe
  C:\Windows\System\KjOslUs.exe
  2⤵
  PID:6952
- C:\Windows\System\KkWFLSF.exe
  C:\Windows\System\KkWFLSF.exe
  2⤵
  PID:6972
- C:\Windows\System\BsBDKpl.exe
  C:\Windows\System\BsBDKpl.exe
  2⤵
  PID:7000
- C:\Windows\System\ZbKEWyZ.exe
  C:\Windows\System\ZbKEWyZ.exe
  2⤵
  PID:7016
- C:\Windows\System\aEKDNhW.exe
  C:\Windows\System\aEKDNhW.exe
  2⤵
  PID:7032
- C:\Windows\System\yfRNuMK.exe
  C:\Windows\System\yfRNuMK.exe
  2⤵
  PID:7056
- C:\Windows\System\MgGGdBf.exe
  C:\Windows\System\MgGGdBf.exe
  2⤵
  PID:7080
- C:\Windows\System\azGECBz.exe
  C:\Windows\System\azGECBz.exe
  2⤵
  PID:7096
- C:\Windows\System\xpMqtyy.exe
  C:\Windows\System\xpMqtyy.exe
  2⤵
  PID:7112
- C:\Windows\System\jIbReey.exe
  C:\Windows\System\jIbReey.exe
  2⤵
  PID:7132
- C:\Windows\System\CkAvCtx.exe
  C:\Windows\System\CkAvCtx.exe
  2⤵
  PID:7148
- C:\Windows\System\UlqKXdX.exe
  C:\Windows\System\UlqKXdX.exe
  2⤵
  PID:5796
- C:\Windows\System\YyBwnSA.exe
  C:\Windows\System\YyBwnSA.exe
  2⤵
  PID:5412
- C:\Windows\System\kKIZdZg.exe
  C:\Windows\System\kKIZdZg.exe
  2⤵
  PID:5476
- C:\Windows\System\gwmVmnD.exe
  C:\Windows\System\gwmVmnD.exe
  2⤵
  PID:5684
- C:\Windows\System\pxiZduY.exe
  C:\Windows\System\pxiZduY.exe
  2⤵
  PID:5988
- C:\Windows\System\saJkcWd.exe
  C:\Windows\System\saJkcWd.exe
  2⤵
  PID:5772
- C:\Windows\System\pWfZYbm.exe
  C:\Windows\System\pWfZYbm.exe
  2⤵
  PID:5872
- C:\Windows\System\YiOjOnV.exe
  C:\Windows\System\YiOjOnV.exe
  2⤵
  PID:4100
- C:\Windows\System\ddmoJBB.exe
  C:\Windows\System\ddmoJBB.exe
  2⤵
  PID:6100
- C:\Windows\System\pCaDqYL.exe
  C:\Windows\System\pCaDqYL.exe
  2⤵
  PID:4840
- C:\Windows\System\vxeOJza.exe
  C:\Windows\System\vxeOJza.exe
  2⤵
  PID:4108
- C:\Windows\System\xoInzTv.exe
  C:\Windows\System\xoInzTv.exe
  2⤵
  PID:4536
- C:\Windows\System\cVSTHGX.exe
  C:\Windows\System\cVSTHGX.exe
  2⤵
  PID:6396
- C:\Windows\System\GHMeUdH.exe
  C:\Windows\System\GHMeUdH.exe
  2⤵
  PID:6416
- C:\Windows\System\SpnQkGK.exe
  C:\Windows\System\SpnQkGK.exe
  2⤵
  PID:6488
- C:\Windows\System\CCLAqFY.exe
  C:\Windows\System\CCLAqFY.exe
  2⤵
  PID:6528
- C:\Windows\System\zsYmwqz.exe
  C:\Windows\System\zsYmwqz.exe
  2⤵
  PID:6552
- C:\Windows\System\OTAuQAp.exe
  C:\Windows\System\OTAuQAp.exe
  2⤵
  PID:6568
- C:\Windows\System\bMSZqPw.exe
  C:\Windows\System\bMSZqPw.exe
  2⤵
  PID:6588
- C:\Windows\System\STcqebI.exe
  C:\Windows\System\STcqebI.exe
  2⤵
  PID:2600
- C:\Windows\System\ZEoOFav.exe
  C:\Windows\System\ZEoOFav.exe
  2⤵
  PID:2628
- C:\Windows\System\ljKdJlg.exe
  C:\Windows\System\ljKdJlg.exe
  2⤵
  PID:4716
- C:\Windows\System\JdkbbAF.exe
  C:\Windows\System\JdkbbAF.exe
  2⤵
  PID:2636
- C:\Windows\System\PsBZpmP.exe
  C:\Windows\System\PsBZpmP.exe
  2⤵
  PID:1480
- C:\Windows\System\uwLyPNC.exe
  C:\Windows\System\uwLyPNC.exe
  2⤵
  PID:384
- C:\Windows\System\UaRdmgx.exe
  C:\Windows\System\UaRdmgx.exe
  2⤵
  PID:4896
- C:\Windows\System\qACEsTY.exe
  C:\Windows\System\qACEsTY.exe
  2⤵
  PID:2816
- C:\Windows\System\IlTvxDy.exe
  C:\Windows\System\IlTvxDy.exe
  2⤵
  PID:5272
- C:\Windows\System\XgwNSLr.exe
  C:\Windows\System\XgwNSLr.exe
  2⤵
  PID:5800
- C:\Windows\System\GBvQYtr.exe
  C:\Windows\System\GBvQYtr.exe
  2⤵
  PID:5148
- C:\Windows\System\bXFXGMe.exe
  C:\Windows\System\bXFXGMe.exe
  2⤵
  PID:5264
- C:\Windows\System\WIjKpZL.exe
  C:\Windows\System\WIjKpZL.exe
  2⤵
  PID:6740
- C:\Windows\System\YkSRogi.exe
  C:\Windows\System\YkSRogi.exe
  2⤵
  PID:6816
- C:\Windows\System\IutPJzp.exe
  C:\Windows\System\IutPJzp.exe
  2⤵
  PID:6712
- C:\Windows\System\QiahMyu.exe
  C:\Windows\System\QiahMyu.exe
  2⤵
  PID:6756
- C:\Windows\System\RXsDlee.exe
  C:\Windows\System\RXsDlee.exe
  2⤵
  PID:6924
- C:\Windows\System\TCenGAh.exe
  C:\Windows\System\TCenGAh.exe
  2⤵
  PID:6948
- C:\Windows\System\SrybYAl.exe
  C:\Windows\System\SrybYAl.exe
  2⤵
  PID:6984
- C:\Windows\System\aqQlUUV.exe
  C:\Windows\System\aqQlUUV.exe
  2⤵
  PID:7008
- C:\Windows\System\MmecBGO.exe
  C:\Windows\System\MmecBGO.exe
  2⤵
  PID:5916
- C:\Windows\System\xURFPJH.exe
  C:\Windows\System\xURFPJH.exe
  2⤵
  PID:1972
- C:\Windows\System\nqFPdyf.exe
  C:\Windows\System\nqFPdyf.exe
  2⤵
  PID:4596
- C:\Windows\System\KCzCfvV.exe
  C:\Windows\System\KCzCfvV.exe
  2⤵
  PID:3220
- C:\Windows\System\wZhIEZa.exe
  C:\Windows\System\wZhIEZa.exe
  2⤵
  PID:4464
- C:\Windows\System\ePwFiNa.exe
  C:\Windows\System\ePwFiNa.exe
  2⤵
  PID:7072
- C:\Windows\System\TfNGzNK.exe
  C:\Windows\System\TfNGzNK.exe
  2⤵
  PID:7104
- C:\Windows\System\RJAbpOl.exe
  C:\Windows\System\RJAbpOl.exe
  2⤵
  PID:7128
- C:\Windows\System\lGutVNe.exe
  C:\Windows\System\lGutVNe.exe
  2⤵
  PID:6604
- C:\Windows\System\DBKxunq.exe
  C:\Windows\System\DBKxunq.exe
  2⤵
  PID:5064
- C:\Windows\System\KTAkzdB.exe
  C:\Windows\System\KTAkzdB.exe
  2⤵
  PID:5380
- C:\Windows\System\MZIDXMF.exe
  C:\Windows\System\MZIDXMF.exe
  2⤵
  PID:3208
- C:\Windows\System\ZSFntbx.exe
  C:\Windows\System\ZSFntbx.exe
  2⤵
  PID:6436
- C:\Windows\System\epWQhom.exe
  C:\Windows\System\epWQhom.exe
  2⤵
  PID:1380
- C:\Windows\System\JEmyAse.exe
  C:\Windows\System\JEmyAse.exe
  2⤵
  PID:6720
- C:\Windows\System\LZJrJYD.exe
  C:\Windows\System\LZJrJYD.exe
  2⤵
  PID:1980
- C:\Windows\System\aaLrhnx.exe
  C:\Windows\System\aaLrhnx.exe
  2⤵
  PID:5628
- C:\Windows\System\hTvcelh.exe
  C:\Windows\System\hTvcelh.exe
  2⤵
  PID:2220
- C:\Windows\System\ZbzFuXw.exe
  C:\Windows\System\ZbzFuXw.exe
  2⤵
  PID:7012
- C:\Windows\System\AqMOfYs.exe
  C:\Windows\System\AqMOfYs.exe
  2⤵
  PID:7184
- C:\Windows\System\xLKVETh.exe
  C:\Windows\System\xLKVETh.exe
  2⤵
  PID:7204
- C:\Windows\System\QTenyrR.exe
  C:\Windows\System\QTenyrR.exe
  2⤵
  PID:7228
- C:\Windows\System\ZStqDWG.exe
  C:\Windows\System\ZStqDWG.exe
  2⤵
  PID:7252
- C:\Windows\System\jtbxYMJ.exe
  C:\Windows\System\jtbxYMJ.exe
  2⤵
  PID:7272
- C:\Windows\System\pIEhFKG.exe
  C:\Windows\System\pIEhFKG.exe
  2⤵
  PID:7296
- C:\Windows\System\pbRECSt.exe
  C:\Windows\System\pbRECSt.exe
  2⤵
  PID:7316
- C:\Windows\System\OlfUFvD.exe
  C:\Windows\System\OlfUFvD.exe
  2⤵
  PID:7336
- C:\Windows\System\EQUFIQe.exe
  C:\Windows\System\EQUFIQe.exe
  2⤵
  PID:7364
- C:\Windows\System\bfAlowi.exe
  C:\Windows\System\bfAlowi.exe
  2⤵
  PID:7384
- C:\Windows\System\pPvPdeV.exe
  C:\Windows\System\pPvPdeV.exe
  2⤵
  PID:7408
- C:\Windows\System\FjAxsnZ.exe
  C:\Windows\System\FjAxsnZ.exe
  2⤵
  PID:7428
- C:\Windows\System\RiuGAmD.exe
  C:\Windows\System\RiuGAmD.exe
  2⤵
  PID:7456
- C:\Windows\System\QUTiHzl.exe
  C:\Windows\System\QUTiHzl.exe
  2⤵
  PID:7476
- C:\Windows\System\uFYbwgR.exe
  C:\Windows\System\uFYbwgR.exe
  2⤵
  PID:7496
- C:\Windows\System\joCMAuD.exe
  C:\Windows\System\joCMAuD.exe
  2⤵
  PID:7520
- C:\Windows\System\heBDgFK.exe
  C:\Windows\System\heBDgFK.exe
  2⤵
  PID:7540
- C:\Windows\System\zRPLSLe.exe
  C:\Windows\System\zRPLSLe.exe
  2⤵
  PID:7556
- C:\Windows\System\KFWxiUb.exe
  C:\Windows\System\KFWxiUb.exe
  2⤵
  PID:7580
- C:\Windows\System\EPbFCRz.exe
  C:\Windows\System\EPbFCRz.exe
  2⤵
  PID:7604
- C:\Windows\System\enngNlA.exe
  C:\Windows\System\enngNlA.exe
  2⤵
  PID:7620
- C:\Windows\System\BfqDnYz.exe
  C:\Windows\System\BfqDnYz.exe
  2⤵
  PID:7640
- C:\Windows\System\xsYxGpL.exe
  C:\Windows\System\xsYxGpL.exe
  2⤵
  PID:7688
- C:\Windows\System\KwVCqAh.exe
  C:\Windows\System\KwVCqAh.exe
  2⤵
  PID:7704
- C:\Windows\System\HpAnktV.exe
  C:\Windows\System\HpAnktV.exe
  2⤵
  PID:7728
- C:\Windows\System\YRlgjgk.exe
  C:\Windows\System\YRlgjgk.exe
  2⤵
  PID:7752
- C:\Windows\System\ZMTiihe.exe
  C:\Windows\System\ZMTiihe.exe
  2⤵
  PID:7772
- C:\Windows\System\HPavglj.exe
  C:\Windows\System\HPavglj.exe
  2⤵
  PID:7792
- C:\Windows\System\cHBqYdP.exe
  C:\Windows\System\cHBqYdP.exe
  2⤵
  PID:7816
- C:\Windows\System\TAfLxlb.exe
  C:\Windows\System\TAfLxlb.exe
  2⤵
  PID:7844
- C:\Windows\System\eBGWxNd.exe
  C:\Windows\System\eBGWxNd.exe
  2⤵
  PID:7864
- C:\Windows\System\jdeVxyy.exe
  C:\Windows\System\jdeVxyy.exe
  2⤵
  PID:7884
- C:\Windows\System\xwygzJg.exe
  C:\Windows\System\xwygzJg.exe
  2⤵
  PID:7904
- C:\Windows\System\jCbbTMA.exe
  C:\Windows\System\jCbbTMA.exe
  2⤵
  PID:7928
- C:\Windows\System\byaQdYs.exe
  C:\Windows\System\byaQdYs.exe
  2⤵
  PID:7952
- C:\Windows\System\rruUvfV.exe
  C:\Windows\System\rruUvfV.exe
  2⤵
  PID:7976
- C:\Windows\System\OnxVgDW.exe
  C:\Windows\System\OnxVgDW.exe
  2⤵
  PID:7996
- C:\Windows\System\zUgbKcS.exe
  C:\Windows\System\zUgbKcS.exe
  2⤵
  PID:8020
- C:\Windows\System\QdNBsQE.exe
  C:\Windows\System\QdNBsQE.exe
  2⤵
  PID:8036
- C:\Windows\System\ozlblvn.exe
  C:\Windows\System\ozlblvn.exe
  2⤵
  PID:8060
- C:\Windows\System\bwCzjBA.exe
  C:\Windows\System\bwCzjBA.exe
  2⤵
  PID:8076
- C:\Windows\System\oCGxoRr.exe
  C:\Windows\System\oCGxoRr.exe
  2⤵
  PID:8100
- C:\Windows\System\APjjjkQ.exe
  C:\Windows\System\APjjjkQ.exe
  2⤵
  PID:8124
- C:\Windows\System\iPMWglB.exe
  C:\Windows\System\iPMWglB.exe
  2⤵
  PID:8148
- C:\Windows\System\JcOLDdF.exe
  C:\Windows\System\JcOLDdF.exe
  2⤵
  PID:8164
- C:\Windows\System\rHjpmKj.exe
  C:\Windows\System\rHjpmKj.exe
  2⤵
  PID:8188
- C:\Windows\System\HMtXdFq.exe
  C:\Windows\System\HMtXdFq.exe
  2⤵
  PID:5432
- C:\Windows\System\qcKJFMF.exe
  C:\Windows\System\qcKJFMF.exe
  2⤵
  PID:6968
- C:\Windows\System\psUjcmy.exe
  C:\Windows\System\psUjcmy.exe
  2⤵
  PID:1848
- C:\Windows\System\xkXtecJ.exe
  C:\Windows\System\xkXtecJ.exe
  2⤵
  PID:5828
- C:\Windows\System\uBvPwjP.exe
  C:\Windows\System\uBvPwjP.exe
  2⤵
  PID:5576
- C:\Windows\System\OYKJjvE.exe
  C:\Windows\System\OYKJjvE.exe
  2⤵
  PID:7172
- C:\Windows\System\eaxJffM.exe
  C:\Windows\System\eaxJffM.exe
  2⤵
  PID:7220
- C:\Windows\System\BkPismv.exe
  C:\Windows\System\BkPismv.exe
  2⤵
  PID:7240
- C:\Windows\System\gpdmQCb.exe
  C:\Windows\System\gpdmQCb.exe
  2⤵
  PID:7280
- C:\Windows\System\YyrZUQA.exe
  C:\Windows\System\YyrZUQA.exe
  2⤵
  PID:3576
- C:\Windows\System\QMdGieW.exe
  C:\Windows\System\QMdGieW.exe
  2⤵
  PID:7356
- C:\Windows\System\sQeAyVH.exe
  C:\Windows\System\sQeAyVH.exe
  2⤵
  PID:7424
- C:\Windows\System\BVKeLUD.exe
  C:\Windows\System\BVKeLUD.exe
  2⤵
  PID:7052
- C:\Windows\System\NDVmHQy.exe
  C:\Windows\System\NDVmHQy.exe
  2⤵
  PID:7504
- C:\Windows\System\IRxuoMs.exe
  C:\Windows\System\IRxuoMs.exe
  2⤵
  PID:636
- C:\Windows\System\SugRJap.exe
  C:\Windows\System\SugRJap.exe
  2⤵
  PID:7224
- C:\Windows\System\LUXDOXm.exe
  C:\Windows\System\LUXDOXm.exe
  2⤵
  PID:7264
- C:\Windows\System\ZGWQiGW.exe
  C:\Windows\System\ZGWQiGW.exe
  2⤵
  PID:4972
- C:\Windows\System\lfPKIHW.exe
  C:\Windows\System\lfPKIHW.exe
  2⤵
  PID:1408
- C:\Windows\System\aWoYxOv.exe
  C:\Windows\System\aWoYxOv.exe
  2⤵
  PID:2068
- C:\Windows\System\PPHeMzK.exe
  C:\Windows\System\PPHeMzK.exe
  2⤵
  PID:7724
- C:\Windows\System\UcmpBJm.exe
  C:\Windows\System\UcmpBJm.exe
  2⤵
  PID:7764
- C:\Windows\System\GZbdvLy.exe
  C:\Windows\System\GZbdvLy.exe
  2⤵
  PID:7880
- C:\Windows\System\PVzdcms.exe
  C:\Windows\System\PVzdcms.exe
  2⤵
  PID:7944
- C:\Windows\System\ByPENfH.exe
  C:\Windows\System\ByPENfH.exe
  2⤵
  PID:7972
- C:\Windows\System\AsWMADl.exe
  C:\Windows\System\AsWMADl.exe
  2⤵
  PID:8092
- C:\Windows\System\qREIIbd.exe
  C:\Windows\System\qREIIbd.exe
  2⤵
  PID:8208
- C:\Windows\System\PuvWlcA.exe
  C:\Windows\System\PuvWlcA.exe
  2⤵
  PID:8228
- C:\Windows\System\CUgNTfy.exe
  C:\Windows\System\CUgNTfy.exe
  2⤵
  PID:8252
- C:\Windows\System\hnORwUm.exe
  C:\Windows\System\hnORwUm.exe
  2⤵
  PID:8272
- C:\Windows\System\yCaYamr.exe
  C:\Windows\System\yCaYamr.exe
  2⤵
  PID:8296
- C:\Windows\System\aQWwHKT.exe
  C:\Windows\System\aQWwHKT.exe
  2⤵
  PID:8316
- C:\Windows\System\hiWNFmf.exe
  C:\Windows\System\hiWNFmf.exe
  2⤵
  PID:8340
- C:\Windows\System\WCsIdwP.exe
  C:\Windows\System\WCsIdwP.exe
  2⤵
  PID:8368
- C:\Windows\System\ZYHwHaS.exe
  C:\Windows\System\ZYHwHaS.exe
  2⤵
  PID:8384
- C:\Windows\System\KeXwjxd.exe
  C:\Windows\System\KeXwjxd.exe
  2⤵
  PID:8400
- C:\Windows\System\ppHTzJj.exe
  C:\Windows\System\ppHTzJj.exe
  2⤵
  PID:8424
- C:\Windows\System\YYaPckQ.exe
  C:\Windows\System\YYaPckQ.exe
  2⤵
  PID:8448
- C:\Windows\System\nLNQQWJ.exe
  C:\Windows\System\nLNQQWJ.exe
  2⤵
  PID:8468
- C:\Windows\System\SilzkmL.exe
  C:\Windows\System\SilzkmL.exe
  2⤵
  PID:8492
- C:\Windows\System\mqHrMhh.exe
  C:\Windows\System\mqHrMhh.exe
  2⤵
  PID:8516
- C:\Windows\System\LBKPmyr.exe
  C:\Windows\System\LBKPmyr.exe
  2⤵
  PID:8536
- C:\Windows\System\izAEjHc.exe
  C:\Windows\System\izAEjHc.exe
  2⤵
  PID:8560
- C:\Windows\System\rbUPBTA.exe
  C:\Windows\System\rbUPBTA.exe
  2⤵
  PID:8584
- C:\Windows\System\skYrxGB.exe
  C:\Windows\System\skYrxGB.exe
  2⤵
  PID:8608
- C:\Windows\System\DMZxAVc.exe
  C:\Windows\System\DMZxAVc.exe
  2⤵
  PID:8628
- C:\Windows\System\PJAFaXI.exe
  C:\Windows\System\PJAFaXI.exe
  2⤵
  PID:8652
- C:\Windows\System\KvnHRbD.exe
  C:\Windows\System\KvnHRbD.exe
  2⤵
  PID:8676
- C:\Windows\System\twboPaF.exe
  C:\Windows\System\twboPaF.exe
  2⤵
  PID:8700
- C:\Windows\System\nAtKJqB.exe
  C:\Windows\System\nAtKJqB.exe
  2⤵
  PID:8720
- C:\Windows\System\XGSTKqB.exe
  C:\Windows\System\XGSTKqB.exe
  2⤵
  PID:8744
- C:\Windows\System\KnfWvCW.exe
  C:\Windows\System\KnfWvCW.exe
  2⤵
  PID:8768
- C:\Windows\System\fEyorfp.exe
  C:\Windows\System\fEyorfp.exe
  2⤵
  PID:8788
- C:\Windows\System\nKFqDRx.exe
  C:\Windows\System\nKFqDRx.exe
  2⤵
  PID:8808
- C:\Windows\System\GqioZkh.exe
  C:\Windows\System\GqioZkh.exe
  2⤵
  PID:8840
- C:\Windows\System\tzdqLuy.exe
  C:\Windows\System\tzdqLuy.exe
  2⤵
  PID:8860
- C:\Windows\System\HrjWDRP.exe
  C:\Windows\System\HrjWDRP.exe
  2⤵
  PID:8884
- C:\Windows\System\QUPPYhA.exe
  C:\Windows\System\QUPPYhA.exe
  2⤵
  PID:8904
- C:\Windows\System\ATSLLow.exe
  C:\Windows\System\ATSLLow.exe
  2⤵
  PID:8924
- C:\Windows\System\ktyNuhz.exe
  C:\Windows\System\ktyNuhz.exe
  2⤵
  PID:8952
- C:\Windows\System\MMZDhKX.exe
  C:\Windows\System\MMZDhKX.exe
  2⤵
  PID:8976
- C:\Windows\System\ZBJPNWL.exe
  C:\Windows\System\ZBJPNWL.exe
  2⤵
  PID:9000
- C:\Windows\System\YWMWAUF.exe
  C:\Windows\System\YWMWAUF.exe
  2⤵
  PID:9016
- C:\Windows\System\IKqNftp.exe
  C:\Windows\System\IKqNftp.exe
  2⤵
  PID:9040
- C:\Windows\System\UqAsvxu.exe
  C:\Windows\System\UqAsvxu.exe
  2⤵
  PID:9056
- C:\Windows\System\keYZvzS.exe
  C:\Windows\System\keYZvzS.exe
  2⤵
  PID:9076
- C:\Windows\System\ubvXxJe.exe
  C:\Windows\System\ubvXxJe.exe
  2⤵
  PID:9096
- C:\Windows\System\uXOCWET.exe
  C:\Windows\System\uXOCWET.exe
  2⤵
  PID:9120
- C:\Windows\System\abHuDei.exe
  C:\Windows\System\abHuDei.exe
  2⤵
  PID:9136
- C:\Windows\System\jLiOHQE.exe
  C:\Windows\System\jLiOHQE.exe
  2⤵
  PID:9156
- C:\Windows\System\KnUMPoT.exe
  C:\Windows\System\KnUMPoT.exe
  2⤵
  PID:9180
- C:\Windows\System\zLcCvCx.exe
  C:\Windows\System\zLcCvCx.exe
  2⤵
  PID:9204
- C:\Windows\System\DhklHKa.exe
  C:\Windows\System\DhklHKa.exe
  2⤵
  PID:8184
- C:\Windows\System\WlzaLhG.exe
  C:\Windows\System\WlzaLhG.exe
  2⤵
  PID:6944
- C:\Windows\System\ZutIlMJ.exe
  C:\Windows\System\ZutIlMJ.exe
  2⤵
  PID:7784
- C:\Windows\System\aSFVSEk.exe
  C:\Windows\System\aSFVSEk.exe
  2⤵
  PID:3608
- C:\Windows\System\tBIxrqH.exe
  C:\Windows\System\tBIxrqH.exe
  2⤵
  PID:7308
- C:\Windows\System\drEJWoj.exe
  C:\Windows\System\drEJWoj.exe
  2⤵
  PID:1504
- C:\Windows\System\xRqeKmN.exe
  C:\Windows\System\xRqeKmN.exe
  2⤵
  PID:8072
- C:\Windows\System\LrQLlka.exe
  C:\Windows\System\LrQLlka.exe
  2⤵
  PID:8160
- C:\Windows\System\SjyYuhF.exe
  C:\Windows\System\SjyYuhF.exe
  2⤵
  PID:6856
- C:\Windows\System\MtRbPrG.exe
  C:\Windows\System\MtRbPrG.exe
  2⤵
  PID:8220
- C:\Windows\System\MJccBWd.exe
  C:\Windows\System\MJccBWd.exe
  2⤵
  PID:3544
- C:\Windows\System\bpsFsfQ.exe
  C:\Windows\System\bpsFsfQ.exe
  2⤵
  PID:1376
- C:\Windows\System\lydmNkf.exe
  C:\Windows\System\lydmNkf.exe
  2⤵
  PID:7860
- C:\Windows\System\EUOrvBQ.exe
  C:\Windows\System\EUOrvBQ.exe
  2⤵
  PID:6140
- C:\Windows\System\SMZWVJS.exe
  C:\Windows\System\SMZWVJS.exe
  2⤵
  PID:4356
- C:\Windows\System\OQhUDrW.exe
  C:\Windows\System\OQhUDrW.exe
  2⤵
  PID:7564
- C:\Windows\System\nYsHNjz.exe
  C:\Windows\System\nYsHNjz.exe
  2⤵
  PID:8012
- C:\Windows\System\bDjsNvW.exe
  C:\Windows\System\bDjsNvW.exe
  2⤵
  PID:8044
- C:\Windows\System\uDbmoCp.exe
  C:\Windows\System\uDbmoCp.exe
  2⤵
  PID:7720
- C:\Windows\System\TpPIYQy.exe
  C:\Windows\System\TpPIYQy.exe
  2⤵
  PID:8596
- C:\Windows\System\WQfkPqG.exe
  C:\Windows\System\WQfkPqG.exe
  2⤵
  PID:8636
- C:\Windows\System\yvTnpks.exe
  C:\Windows\System\yvTnpks.exe
  2⤵
  PID:8692
- C:\Windows\System\rKXbSse.exe
  C:\Windows\System\rKXbSse.exe
  2⤵
  PID:2432
- C:\Windows\System\OWtVAFu.exe
  C:\Windows\System\OWtVAFu.exe
  2⤵
  PID:8784
- C:\Windows\System\jQfhhMh.exe
  C:\Windows\System\jQfhhMh.exe
  2⤵
  PID:3448
- C:\Windows\System\hsmaYpR.exe
  C:\Windows\System\hsmaYpR.exe
  2⤵
  PID:8896
- C:\Windows\System\MoUbCXA.exe
  C:\Windows\System\MoUbCXA.exe
  2⤵
  PID:8968
- C:\Windows\System\FHoyrUH.exe
  C:\Windows\System\FHoyrUH.exe
  2⤵
  PID:9048
- C:\Windows\System\nEKbiuS.exe
  C:\Windows\System\nEKbiuS.exe
  2⤵
  PID:7352
- C:\Windows\System\qATPOHW.exe
  C:\Windows\System\qATPOHW.exe
  2⤵
  PID:9224
- C:\Windows\System\wwNpqZB.exe
  C:\Windows\System\wwNpqZB.exe
  2⤵
  PID:9248
- C:\Windows\System\NrLzRlM.exe
  C:\Windows\System\NrLzRlM.exe
  2⤵
  PID:9268
- C:\Windows\System\oytEvgt.exe
  C:\Windows\System\oytEvgt.exe
  2⤵
  PID:9292
- C:\Windows\System\fxBFctN.exe
  C:\Windows\System\fxBFctN.exe
  2⤵
  PID:9312
- C:\Windows\System\ugMDCZX.exe
  C:\Windows\System\ugMDCZX.exe
  2⤵
  PID:9332
- C:\Windows\System\mIbrpzf.exe
  C:\Windows\System\mIbrpzf.exe
  2⤵
  PID:9356
- C:\Windows\System\UoGAKkm.exe
  C:\Windows\System\UoGAKkm.exe
  2⤵
  PID:9380
- C:\Windows\System\lbfpzIF.exe
  C:\Windows\System\lbfpzIF.exe
  2⤵
  PID:9400
- C:\Windows\System\aDnxnzw.exe
  C:\Windows\System\aDnxnzw.exe
  2⤵
  PID:9424
- C:\Windows\System\mDLxVpV.exe
  C:\Windows\System\mDLxVpV.exe
  2⤵
  PID:9444
- C:\Windows\System\eYIBJVG.exe
  C:\Windows\System\eYIBJVG.exe
  2⤵
  PID:9464
- C:\Windows\System\GuhcwQD.exe
  C:\Windows\System\GuhcwQD.exe
  2⤵
  PID:9484
- C:\Windows\System\zZtldTP.exe
  C:\Windows\System\zZtldTP.exe
  2⤵
  PID:9512
- C:\Windows\System\VAdPMlj.exe
  C:\Windows\System\VAdPMlj.exe
  2⤵
  PID:9532
- C:\Windows\System\UpiQqbg.exe
  C:\Windows\System\UpiQqbg.exe
  2⤵
  PID:9548
- C:\Windows\System\szmosWN.exe
  C:\Windows\System\szmosWN.exe
  2⤵
  PID:9572
- C:\Windows\System\yqhjASP.exe
  C:\Windows\System\yqhjASP.exe
  2⤵
  PID:9596
- C:\Windows\System\WjZoYAI.exe
  C:\Windows\System\WjZoYAI.exe
  2⤵
  PID:9612
- C:\Windows\System\MnfffFU.exe
  C:\Windows\System\MnfffFU.exe
  2⤵
  PID:9636
- C:\Windows\System\ZwyUFNB.exe
  C:\Windows\System\ZwyUFNB.exe
  2⤵
  PID:9656
- C:\Windows\System\LgMmXix.exe
  C:\Windows\System\LgMmXix.exe
  2⤵
  PID:9676
- C:\Windows\System\AXuwSup.exe
  C:\Windows\System\AXuwSup.exe
  2⤵
  PID:9700
- C:\Windows\System\RBsIqig.exe
  C:\Windows\System\RBsIqig.exe
  2⤵
  PID:9724
- C:\Windows\System\pluDBSK.exe
  C:\Windows\System\pluDBSK.exe
  2⤵
  PID:9744
- C:\Windows\System\zvgZjNE.exe
  C:\Windows\System\zvgZjNE.exe
  2⤵
  PID:9768
- C:\Windows\System\LDADQXM.exe
  C:\Windows\System\LDADQXM.exe
  2⤵
  PID:9792
- C:\Windows\System\mdqPFtM.exe
  C:\Windows\System\mdqPFtM.exe
  2⤵
  PID:9816
- C:\Windows\System\HsvczcK.exe
  C:\Windows\System\HsvczcK.exe
  2⤵
  PID:9840
- C:\Windows\System\hLONucK.exe
  C:\Windows\System\hLONucK.exe
  2⤵
  PID:9860
- C:\Windows\System\zaufpKw.exe
  C:\Windows\System\zaufpKw.exe
  2⤵
  PID:9884
- C:\Windows\System\HswNhqR.exe
  C:\Windows\System\HswNhqR.exe
  2⤵
  PID:9908
- C:\Windows\System\ijpiUdw.exe
  C:\Windows\System\ijpiUdw.exe
  2⤵
  PID:9928
- C:\Windows\System\LXIcxEp.exe
  C:\Windows\System\LXIcxEp.exe
  2⤵
  PID:9952
- C:\Windows\System\LVbRCGN.exe
  C:\Windows\System\LVbRCGN.exe
  2⤵
  PID:9980
- C:\Windows\System\gUFPZcW.exe
  C:\Windows\System\gUFPZcW.exe
  2⤵
  PID:10000
- C:\Windows\System\VLgMAvz.exe
  C:\Windows\System\VLgMAvz.exe
  2⤵
  PID:10028
- C:\Windows\System\FxhgYed.exe
  C:\Windows\System\FxhgYed.exe
  2⤵
  PID:10048
- C:\Windows\System\NDRnrFx.exe
  C:\Windows\System\NDRnrFx.exe
  2⤵
  PID:10072
- C:\Windows\System\dguMqxe.exe
  C:\Windows\System\dguMqxe.exe
  2⤵
  PID:10092
- C:\Windows\System\mlJmaft.exe
  C:\Windows\System\mlJmaft.exe
  2⤵
  PID:10116
- C:\Windows\System\KkIquJw.exe
  C:\Windows\System\KkIquJw.exe
  2⤵
  PID:10136
- C:\Windows\System\DmASduZ.exe
  C:\Windows\System\DmASduZ.exe
  2⤵
  PID:10156
- C:\Windows\System\ooEEunQ.exe
  C:\Windows\System\ooEEunQ.exe
  2⤵
  PID:10180
- C:\Windows\System\UDxzzJC.exe
  C:\Windows\System\UDxzzJC.exe
  2⤵
  PID:10204
- C:\Windows\System\gBhpuJm.exe
  C:\Windows\System\gBhpuJm.exe
  2⤵
  PID:10228
- C:\Windows\System\UTcBRhA.exe
  C:\Windows\System\UTcBRhA.exe
  2⤵
  PID:9112
- C:\Windows\System\LFtDzHC.exe
  C:\Windows\System\LFtDzHC.exe
  2⤵
  PID:8512
- C:\Windows\System\HGZgFfr.exe
  C:\Windows\System\HGZgFfr.exe
  2⤵
  PID:9200
- C:\Windows\System\aTEHVIy.exe
  C:\Windows\System\aTEHVIy.exe
  2⤵
  PID:8664
- C:\Windows\System\ENPxunO.exe
  C:\Windows\System\ENPxunO.exe
  2⤵
  PID:8108
- C:\Windows\System\vSsZszM.exe
  C:\Windows\System\vSsZszM.exe
  2⤵
  PID:8828
- C:\Windows\System\hxkWZay.exe
  C:\Windows\System\hxkWZay.exe
  2⤵
  PID:7196
- C:\Windows\System\UutKcZK.exe
  C:\Windows\System\UutKcZK.exe
  2⤵
  PID:8480
- C:\Windows\System\qTMyVbu.exe
  C:\Windows\System\qTMyVbu.exe
  2⤵
  PID:7760
- C:\Windows\System\LNqIZGN.exe
  C:\Windows\System\LNqIZGN.exe
  2⤵
  PID:8360
- C:\Windows\System\mKTspQs.exe
  C:\Windows\System\mKTspQs.exe
  2⤵
  PID:8728
- C:\Windows\System\kKaygjp.exe
  C:\Windows\System\kKaygjp.exe
  2⤵
  PID:724
- C:\Windows\System\MlHJdwp.exe
  C:\Windows\System\MlHJdwp.exe
  2⤵
  PID:9068
- C:\Windows\System\uQncxFp.exe
  C:\Windows\System\uQncxFp.exe
  2⤵
  PID:9300
- C:\Windows\System\vZSEdXX.exe
  C:\Windows\System\vZSEdXX.exe
  2⤵
  PID:9340
- C:\Windows\System\wZVRVcX.exe
  C:\Windows\System\wZVRVcX.exe
  2⤵
  PID:9376
- C:\Windows\System\sbHkUJk.exe
  C:\Windows\System\sbHkUJk.exe
  2⤵
  PID:9460
- C:\Windows\System\lrJuvGM.exe
  C:\Windows\System\lrJuvGM.exe
  2⤵
  PID:7192
- C:\Windows\System\KcEuMSW.exe
  C:\Windows\System\KcEuMSW.exe
  2⤵
  PID:7964
- C:\Windows\System\YgtTZtJ.exe
  C:\Windows\System\YgtTZtJ.exe
  2⤵
  PID:10268
- C:\Windows\System\ClYFeGC.exe
  C:\Windows\System\ClYFeGC.exe
  2⤵
  PID:10288
- C:\Windows\System\EvafGLx.exe
  C:\Windows\System\EvafGLx.exe
  2⤵
  PID:10308
- C:\Windows\System\kZUQACy.exe
  C:\Windows\System\kZUQACy.exe
  2⤵
  PID:10332
- C:\Windows\System\RxLpBaI.exe
  C:\Windows\System\RxLpBaI.exe
  2⤵
  PID:10352
- C:\Windows\System\wlLDYxl.exe
  C:\Windows\System\wlLDYxl.exe
  2⤵
  PID:10372
- C:\Windows\System\ArhpiEH.exe
  C:\Windows\System\ArhpiEH.exe
  2⤵
  PID:10396
- C:\Windows\System\mMfwnTA.exe
  C:\Windows\System\mMfwnTA.exe
  2⤵
  PID:10420
- C:\Windows\System\ZYceWpX.exe
  C:\Windows\System\ZYceWpX.exe
  2⤵
  PID:10448
- C:\Windows\System\dkSWBqY.exe
  C:\Windows\System\dkSWBqY.exe
  2⤵
  PID:10468
- C:\Windows\System\FxUMcZk.exe
  C:\Windows\System\FxUMcZk.exe
  2⤵
  PID:10492
- C:\Windows\System\KpOGYjQ.exe
  C:\Windows\System\KpOGYjQ.exe
  2⤵
  PID:10516
- C:\Windows\System\JCDtoYu.exe
  C:\Windows\System\JCDtoYu.exe
  2⤵
  PID:10536
- C:\Windows\System\wAAkNze.exe
  C:\Windows\System\wAAkNze.exe
  2⤵
  PID:10564
- C:\Windows\System\UeENkxf.exe
  C:\Windows\System\UeENkxf.exe
  2⤵
  PID:10584
- C:\Windows\System\UFvzwKr.exe
  C:\Windows\System\UFvzwKr.exe
  2⤵
  PID:10604
- C:\Windows\System\KJsDhOU.exe
  C:\Windows\System\KJsDhOU.exe
  2⤵
  PID:10628
- C:\Windows\System\gEzJZKO.exe
  C:\Windows\System\gEzJZKO.exe
  2⤵
  PID:10648
- C:\Windows\System\HdLWaod.exe
  C:\Windows\System\HdLWaod.exe
  2⤵
  PID:10668
- C:\Windows\System\NUiNHOQ.exe
  C:\Windows\System\NUiNHOQ.exe
  2⤵
  PID:10696
- C:\Windows\System\daKvXtn.exe
  C:\Windows\System\daKvXtn.exe
  2⤵
  PID:10720
- C:\Windows\System\nNktoiP.exe
  C:\Windows\System\nNktoiP.exe
  2⤵
  PID:10740
- C:\Windows\System\iZxWBfB.exe
  C:\Windows\System\iZxWBfB.exe
  2⤵
  PID:10764
- C:\Windows\System\kWWpOie.exe
  C:\Windows\System\kWWpOie.exe
  2⤵
  PID:10788
- C:\Windows\System\mdVQNrx.exe
  C:\Windows\System\mdVQNrx.exe
  2⤵
  PID:10812
- C:\Windows\System\UUeIFex.exe
  C:\Windows\System\UUeIFex.exe
  2⤵
  PID:10832
- C:\Windows\System\zSIVQdW.exe
  C:\Windows\System\zSIVQdW.exe
  2⤵
  PID:10856
- C:\Windows\System\aRntRTV.exe
  C:\Windows\System\aRntRTV.exe
  2⤵
  PID:10876
- C:\Windows\System\jasqYmz.exe
  C:\Windows\System\jasqYmz.exe
  2⤵
  PID:10896
- C:\Windows\System\YAnyWaF.exe
  C:\Windows\System\YAnyWaF.exe
  2⤵
  PID:10920
- C:\Windows\System\XRaGRRG.exe
  C:\Windows\System\XRaGRRG.exe
  2⤵
  PID:10948
- C:\Windows\System\TMoQcyO.exe
  C:\Windows\System\TMoQcyO.exe
  2⤵
  PID:10964
- C:\Windows\System\ozQAKha.exe
  C:\Windows\System\ozQAKha.exe
  2⤵
  PID:10984
- C:\Windows\System\toyupei.exe
  C:\Windows\System\toyupei.exe
  2⤵
  PID:11008
- C:\Windows\System\YoyYEDu.exe
  C:\Windows\System\YoyYEDu.exe
  2⤵
  PID:11032
- C:\Windows\System\rkavYac.exe
  C:\Windows\System\rkavYac.exe
  2⤵
  PID:11056
- C:\Windows\System\DKbETnL.exe
  C:\Windows\System\DKbETnL.exe
  2⤵
  PID:11084
- C:\Windows\System\UIKyrcs.exe
  C:\Windows\System\UIKyrcs.exe
  2⤵
  PID:11104
- C:\Windows\System\ZrVYexV.exe
  C:\Windows\System\ZrVYexV.exe
  2⤵
  PID:11128
- C:\Windows\System\VdSKBWF.exe
  C:\Windows\System\VdSKBWF.exe
  2⤵
  PID:11148
- C:\Windows\System\zffTkdb.exe
  C:\Windows\System\zffTkdb.exe
  2⤵
  PID:11168
- C:\Windows\System\tqaNxzA.exe
  C:\Windows\System\tqaNxzA.exe
  2⤵
  PID:11192
- C:\Windows\System\UXeXGEh.exe
  C:\Windows\System\UXeXGEh.exe
  2⤵
  PID:11208
- C:\Windows\System\EZzYJON.exe
  C:\Windows\System\EZzYJON.exe
  2⤵
  PID:11232
- C:\Windows\System\LzkVwnb.exe
  C:\Windows\System\LzkVwnb.exe
  2⤵
  PID:11252
- C:\Windows\System\RmpDkNs.exe
  C:\Windows\System\RmpDkNs.exe
  2⤵
  PID:8920
- C:\Windows\System\CwNkoER.exe
  C:\Windows\System\CwNkoER.exe
  2⤵
  PID:9588
- C:\Windows\System\IRjrEaX.exe
  C:\Windows\System\IRjrEaX.exe
  2⤵
  PID:9632
- C:\Windows\System\emMmvkR.exe
  C:\Windows\System\emMmvkR.exe
  2⤵
  PID:10572
- C:\Windows\System\Dwfpxqn.exe
  C:\Windows\System\Dwfpxqn.exe
  2⤵
  PID:9736
- C:\Windows\System\pnEdcWq.exe
  C:\Windows\System\pnEdcWq.exe
  2⤵
  PID:9808
- C:\Windows\System\MqbErmR.exe
  C:\Windows\System\MqbErmR.exe
  2⤵
  PID:9872
- C:\Windows\System\tXOVcbd.exe
  C:\Windows\System\tXOVcbd.exe
  2⤵
  PID:10872
- C:\Windows\System\KZCZkDV.exe
  C:\Windows\System\KZCZkDV.exe
  2⤵
  PID:8824
- C:\Windows\System\MxjotUz.exe
  C:\Windows\System\MxjotUz.exe
  2⤵
  PID:8332
- C:\Windows\System\QeuQicc.exe
  C:\Windows\System\QeuQicc.exe
  2⤵
  PID:10216
- C:\Windows\System\NdRmVsa.exe
  C:\Windows\System\NdRmVsa.exe
  2⤵
  PID:7404
- C:\Windows\System\cukreCO.exe
  C:\Windows\System\cukreCO.exe
  2⤵
  PID:8740
- C:\Windows\System\YeqRhLa.exe
  C:\Windows\System\YeqRhLa.exe
  2⤵
  PID:10864
- C:\Windows\System\WuLftiw.exe
  C:\Windows\System\WuLftiw.exe
  2⤵
  PID:8568
- C:\Windows\System\CkgpNwT.exe
  C:\Windows\System\CkgpNwT.exe
  2⤵
  PID:4360
- C:\Windows\System\LDOCAPY.exe
  C:\Windows\System\LDOCAPY.exe
  2⤵
  PID:10276
- C:\Windows\System\oaenmzu.exe
  C:\Windows\System\oaenmzu.exe
  2⤵
  PID:10504
- C:\Windows\System\JDsATke.exe
  C:\Windows\System\JDsATke.exe
  2⤵
  PID:10640
- C:\Windows\System\ZEqtzXf.exe
  C:\Windows\System\ZEqtzXf.exe
  2⤵
  PID:7788
- C:\Windows\System\tpNCwwR.exe
  C:\Windows\System\tpNCwwR.exe
  2⤵
  PID:8120
- C:\Windows\System\XGuxEVm.exe
  C:\Windows\System\XGuxEVm.exe
  2⤵
  PID:7900
- C:\Windows\System\oJRzXUS.exe
  C:\Windows\System\oJRzXUS.exe
  2⤵
  PID:10316
- C:\Windows\System\iVZZYbK.exe
  C:\Windows\System\iVZZYbK.exe
  2⤵
  PID:9620
- C:\Windows\System\TqlcNYq.exe
  C:\Windows\System\TqlcNYq.exe
  2⤵
  PID:11284
- C:\Windows\System\omBAQlj.exe
  C:\Windows\System\omBAQlj.exe
  2⤵
  PID:11316
- C:\Windows\System\AzkdaaI.exe
  C:\Windows\System\AzkdaaI.exe
  2⤵
  PID:11340
- C:\Windows\System\QNCzfhF.exe
  C:\Windows\System\QNCzfhF.exe
  2⤵
  PID:11368
- C:\Windows\System\eLYGNnR.exe
  C:\Windows\System\eLYGNnR.exe
  2⤵
  PID:11396
- C:\Windows\System\CMKGOAn.exe
  C:\Windows\System\CMKGOAn.exe
  2⤵
  PID:11412
- C:\Windows\System\aiEZHkd.exe
  C:\Windows\System\aiEZHkd.exe
  2⤵
  PID:11436
- C:\Windows\System\dQYcgoO.exe
  C:\Windows\System\dQYcgoO.exe
  2⤵
  PID:11460
- C:\Windows\System\DwYWbCd.exe
  C:\Windows\System\DwYWbCd.exe
  2⤵
  PID:11480
- C:\Windows\System\xbbPDAR.exe
  C:\Windows\System\xbbPDAR.exe
  2⤵
  PID:11504
- C:\Windows\System\ClaeEGR.exe
  C:\Windows\System\ClaeEGR.exe
  2⤵
  PID:11524
- C:\Windows\System\eHtrUPI.exe
  C:\Windows\System\eHtrUPI.exe
  2⤵
  PID:11552
- C:\Windows\System\VTldHPu.exe
  C:\Windows\System\VTldHPu.exe
  2⤵
  PID:11572
- C:\Windows\System\wYWvecM.exe
  C:\Windows\System\wYWvecM.exe
  2⤵
  PID:11604
- C:\Windows\System\aTfQslT.exe
  C:\Windows\System\aTfQslT.exe
  2⤵
  PID:11628
- C:\Windows\System\IWLnbeC.exe
  C:\Windows\System\IWLnbeC.exe
  2⤵
  PID:11644
- C:\Windows\System\jiTWNOc.exe
  C:\Windows\System\jiTWNOc.exe
  2⤵
  PID:11660
- C:\Windows\System\DgqpHCA.exe
  C:\Windows\System\DgqpHCA.exe
  2⤵
  PID:11680
- C:\Windows\System\tZVCiJz.exe
  C:\Windows\System\tZVCiJz.exe
  2⤵
  PID:11696
- C:\Windows\System\BlHBMPO.exe
  C:\Windows\System\BlHBMPO.exe
  2⤵
  PID:11712
- C:\Windows\System\YEXbmMG.exe
  C:\Windows\System\YEXbmMG.exe
  2⤵
  PID:11728
- C:\Windows\System\FJReusG.exe
  C:\Windows\System\FJReusG.exe
  2⤵
  PID:11744
- C:\Windows\System\BlBuhDj.exe
  C:\Windows\System\BlBuhDj.exe
  2⤵
  PID:11760
- C:\Windows\System\yFBqVti.exe
  C:\Windows\System\yFBqVti.exe
  2⤵
  PID:11792
- C:\Windows\System\BedtEnY.exe
  C:\Windows\System\BedtEnY.exe
  2⤵
  PID:11820
- C:\Windows\System\EtFiIhr.exe
  C:\Windows\System\EtFiIhr.exe
  2⤵
  PID:11844
- C:\Windows\System\TcNVQad.exe
  C:\Windows\System\TcNVQad.exe
  2⤵
  PID:11864
- C:\Windows\System\BquUQgu.exe
  C:\Windows\System\BquUQgu.exe
  2⤵
  PID:11884
- C:\Windows\System\qkcKVBY.exe
  C:\Windows\System\qkcKVBY.exe
  2⤵
  PID:11912
- C:\Windows\System\mNePjFk.exe
  C:\Windows\System\mNePjFk.exe
  2⤵
  PID:11932
- C:\Windows\System\CORehgL.exe
  C:\Windows\System\CORehgL.exe
  2⤵
  PID:11956
- C:\Windows\System\bgxtqft.exe
  C:\Windows\System\bgxtqft.exe
  2⤵
  PID:11976
- C:\Windows\System\XMQZhoT.exe
  C:\Windows\System\XMQZhoT.exe
  2⤵
  PID:11996
- C:\Windows\System\tuWJVoa.exe
  C:\Windows\System\tuWJVoa.exe
  2⤵
  PID:12016
- C:\Windows\System\WulYpkB.exe
  C:\Windows\System\WulYpkB.exe
  2⤵
  PID:12032
- C:\Windows\System\oKMVYLN.exe
  C:\Windows\System\oKMVYLN.exe
  2⤵
  PID:12056
- C:\Windows\System\YQHqFkV.exe
  C:\Windows\System\YQHqFkV.exe
  2⤵
  PID:12080
- C:\Windows\System\SnqszpP.exe
  C:\Windows\System\SnqszpP.exe
  2⤵
  PID:12104
- C:\Windows\System\wLKZAfY.exe
  C:\Windows\System\wLKZAfY.exe
  2⤵
  PID:12136
- C:\Windows\System\oGTXJZO.exe
  C:\Windows\System\oGTXJZO.exe
  2⤵
  PID:12156
- C:\Windows\System\KHMRdXe.exe
  C:\Windows\System\KHMRdXe.exe
  2⤵
  PID:12180
- C:\Windows\System\VyjSaqC.exe
  C:\Windows\System\VyjSaqC.exe
  2⤵
  PID:12204
- C:\Windows\System\aJUEmQJ.exe
  C:\Windows\System\aJUEmQJ.exe
  2⤵
  PID:12228
- C:\Windows\System\uRSUDqn.exe
  C:\Windows\System\uRSUDqn.exe
  2⤵
  PID:12248
- C:\Windows\System\JTXgxtm.exe
  C:\Windows\System\JTXgxtm.exe
  2⤵
  PID:12272
- C:\Windows\System\pdOgENC.exe
  C:\Windows\System\pdOgENC.exe
  2⤵
  PID:10512
- C:\Windows\System\zECuvkf.exe
  C:\Windows\System\zECuvkf.exe
  2⤵
  PID:10748
- C:\Windows\System\DmfKREZ.exe
  C:\Windows\System\DmfKREZ.exe
  2⤵
  PID:10904
- C:\Windows\System\uulYZsc.exe
  C:\Windows\System\uulYZsc.exe
  2⤵
  PID:10056
- C:\Windows\System\ZEFpbMY.exe
  C:\Windows\System\ZEFpbMY.exe
  2⤵
  PID:11076
- C:\Windows\System\IAliPnC.exe
  C:\Windows\System\IAliPnC.exe
  2⤵
  PID:12316
- C:\Windows\System\yzWXgvu.exe
  C:\Windows\System\yzWXgvu.exe
  2⤵
  PID:12344
- C:\Windows\System\fgRgckw.exe
  C:\Windows\System\fgRgckw.exe
  2⤵
  PID:12364
- C:\Windows\System\LKAtuLs.exe
  C:\Windows\System\LKAtuLs.exe
  2⤵
  PID:12388
- C:\Windows\System\hHpambk.exe
  C:\Windows\System\hHpambk.exe
  2⤵
  PID:12408
- C:\Windows\System\rJSIYAg.exe
  C:\Windows\System\rJSIYAg.exe
  2⤵
  PID:12440
- C:\Windows\System\yzjFmDX.exe
  C:\Windows\System\yzjFmDX.exe
  2⤵
  PID:12468
- C:\Windows\System\nogYXme.exe
  C:\Windows\System\nogYXme.exe
  2⤵
  PID:12488
- C:\Windows\System\JrPAZaU.exe
  C:\Windows\System\JrPAZaU.exe
  2⤵
  PID:12512
- C:\Windows\System\ebNUmjh.exe
  C:\Windows\System\ebNUmjh.exe
  2⤵
  PID:12532
- C:\Windows\System\jKYlJVu.exe
  C:\Windows\System\jKYlJVu.exe
  2⤵
  PID:12552
- C:\Windows\System\YKxWPTx.exe
  C:\Windows\System\YKxWPTx.exe
  2⤵
  PID:12576
- C:\Windows\System\BcTuztJ.exe
  C:\Windows\System\BcTuztJ.exe
  2⤵
  PID:12600
- C:\Windows\System\BmeAQoV.exe
  C:\Windows\System\BmeAQoV.exe
  2⤵
  PID:12620
- C:\Windows\System\OujyDVn.exe
  C:\Windows\System\OujyDVn.exe
  2⤵
  PID:12636
- C:\Windows\System\ccCLXBS.exe
  C:\Windows\System\ccCLXBS.exe
  2⤵
  PID:12660
- C:\Windows\System\cfHpWEt.exe
  C:\Windows\System\cfHpWEt.exe
  2⤵
  PID:12684
- C:\Windows\System\XuJBCKW.exe
  C:\Windows\System\XuJBCKW.exe
  2⤵
  PID:12708
- C:\Windows\System\FsBhBwq.exe
  C:\Windows\System\FsBhBwq.exe
  2⤵
  PID:12732
- C:\Windows\System\VRUPFzI.exe
  C:\Windows\System\VRUPFzI.exe
  2⤵
  PID:12756
- C:\Windows\System\GsIwELl.exe
  C:\Windows\System\GsIwELl.exe
  2⤵
  PID:12792
- C:\Windows\System\XMIuYrf.exe
  C:\Windows\System\XMIuYrf.exe
  2⤵
  PID:12812
- C:\Windows\System\ubZoTeT.exe
  C:\Windows\System\ubZoTeT.exe
  2⤵
  PID:12828
- C:\Windows\System\qDLFdNb.exe
  C:\Windows\System\qDLFdNb.exe
  2⤵
  PID:12844
- C:\Windows\System\eqZLBGp.exe
  C:\Windows\System\eqZLBGp.exe
  2⤵
  PID:12860
- C:\Windows\System\KyTtFGQ.exe
  C:\Windows\System\KyTtFGQ.exe
  2⤵
  PID:12876
- C:\Windows\System\cIDTcYz.exe
  C:\Windows\System\cIDTcYz.exe
  2⤵
  PID:12892
- C:\Windows\System\vNQTibk.exe
  C:\Windows\System\vNQTibk.exe
  2⤵
  PID:12908
- C:\Windows\System\XPNPXmV.exe
  C:\Windows\System\XPNPXmV.exe
  2⤵
  PID:12928
- C:\Windows\System\GHHeooa.exe
  C:\Windows\System\GHHeooa.exe
  2⤵
  PID:12944
- C:\Windows\System\fkWYHJg.exe
  C:\Windows\System\fkWYHJg.exe
  2⤵
  PID:12960
- C:\Windows\System\AkgkOTD.exe
  C:\Windows\System\AkgkOTD.exe
  2⤵
  PID:12996
- C:\Windows\System\EenpLQt.exe
  C:\Windows\System\EenpLQt.exe
  2⤵
  PID:13040
- C:\Windows\System\lmaOyEq.exe
  C:\Windows\System\lmaOyEq.exe
  2⤵
  PID:13068
- C:\Windows\System\GUaZOaL.exe
  C:\Windows\System\GUaZOaL.exe
  2⤵
  PID:9264
- C:\Windows\System\huLQMwp.exe
  C:\Windows\System\huLQMwp.exe
  2⤵
  PID:8880
- C:\Windows\System\yUUYvZP.exe
  C:\Windows\System\yUUYvZP.exe
  2⤵
  PID:11300
- C:\Windows\System\eGLjDvp.exe
  C:\Windows\System\eGLjDvp.exe
  2⤵
  PID:11456
- C:\Windows\System\narPxKz.exe
  C:\Windows\System\narPxKz.exe
  2⤵
  PID:11476
- C:\Windows\System\UjsnoPK.exe
  C:\Windows\System\UjsnoPK.exe
  2⤵
  PID:11540
- C:\Windows\System\FTiHqbn.exe
  C:\Windows\System\FTiHqbn.exe
  2⤵
  PID:12112
- C:\Windows\System\GnRhTNv.exe
  C:\Windows\System\GnRhTNv.exe
  2⤵
  PID:12300
- C:\Windows\System\iyJXtLg.exe
  C:\Windows\System\iyJXtLg.exe
  2⤵
  PID:8396
- C:\Windows\System\xxZJkJZ.exe
  C:\Windows\System\xxZJkJZ.exe
  2⤵
  PID:13024
- C:\Windows\System\fvGjlZy.exe
  C:\Windows\System\fvGjlZy.exe
  2⤵
  PID:13076
- C:\Windows\System\vagqMqQ.exe
  C:\Windows\System\vagqMqQ.exe
  2⤵
  PID:10600
- C:\Windows\System\fiEoNmu.exe
  C:\Windows\System\fiEoNmu.exe
  2⤵
  PID:9856
- C:\Windows\System\PrEqOMx.exe
  C:\Windows\System\PrEqOMx.exe
  2⤵
  PID:8660
- C:\Windows\System\xlzWipp.exe
  C:\Windows\System\xlzWipp.exe
  2⤵
  PID:11620
- C:\Windows\System\kJpGCFe.exe
  C:\Windows\System\kJpGCFe.exe
  2⤵
  PID:12176
- C:\Windows\System\CBoOvCW.exe
  C:\Windows\System\CBoOvCW.exe
  2⤵
  PID:13164
- C:\Windows\System\WQcNxnL.exe
  C:\Windows\System\WQcNxnL.exe
  2⤵
  PID:7552
- C:\Windows\System\MxgFbjh.exe
  C:\Windows\System\MxgFbjh.exe
  2⤵
  PID:13220
- C:\Windows\System\qQOwfnz.exe
  C:\Windows\System\qQOwfnz.exe
  2⤵
  PID:8180
- C:\Windows\System\CLJeays.exe
  C:\Windows\System\CLJeays.exe
  2⤵
  PID:13244
- C:\Windows\System\ixOsRXv.exe
  C:\Windows\System\ixOsRXv.exe
  2⤵
  PID:11332
- C:\Windows\System\YnDfGDp.exe
  C:\Windows\System\YnDfGDp.exe
  2⤵
  PID:13224
- C:\Windows\System\mGWNZEl.exe
  C:\Windows\System\mGWNZEl.exe
  2⤵
  PID:10828
- C:\Windows\System\WtnkvMI.exe
  C:\Windows\System\WtnkvMI.exe
  2⤵
  PID:10868
- C:\Windows\System\ACHZZoW.exe
  C:\Windows\System\ACHZZoW.exe
  2⤵
  PID:1184
- C:\Windows\System\vuCeKxn.exe
  C:\Windows\System\vuCeKxn.exe
  2⤵
  PID:11972
- C:\Windows\System\cojQmmU.exe
  C:\Windows\System\cojQmmU.exe
  2⤵
  PID:9504
- C:\Windows\System\jSkrkGj.exe
  C:\Windows\System\jSkrkGj.exe
  2⤵
  PID:10760
- C:\Windows\System\dEOhrCo.exe
  C:\Windows\System\dEOhrCo.exe
  2⤵
  PID:12360
- C:\Windows\System\FaOEcAK.exe
  C:\Windows\System\FaOEcAK.exe
  2⤵
  PID:12560
- C:\Windows\System\VzPxbWy.exe
  C:\Windows\System\VzPxbWy.exe
  2⤵
  PID:12900
- C:\Windows\System\oQmVSnB.exe
  C:\Windows\System\oQmVSnB.exe
  2⤵
  PID:13056
- C:\Windows\System\XSkdDfp.exe
  C:\Windows\System\XSkdDfp.exe
  2⤵
  PID:9648
- C:\Windows\System\nKeXEpK.exe
  C:\Windows\System\nKeXEpK.exe
  2⤵
  PID:13284
- C:\Windows\System\fMYSrcX.exe
  C:\Windows\System\fMYSrcX.exe
  2⤵
  PID:11560
- C:\Windows\System\SaeIpIV.exe
  C:\Windows\System\SaeIpIV.exe
  2⤵
  PID:4588
- C:\Windows\System\atAmmRI.exe
  C:\Windows\System\atAmmRI.exe
  2⤵
  PID:9052
- C:\Windows\System\ftmYsjc.exe
  C:\Windows\System\ftmYsjc.exe
  2⤵
  PID:11164
- C:\Windows\System\cBAwNly.exe
  C:\Windows\System\cBAwNly.exe
  2⤵
  PID:8960
- C:\Windows\System\NxFirBR.exe
  C:\Windows\System\NxFirBR.exe
  2⤵
  PID:11432
- C:\Windows\System\asmxoBb.exe
  C:\Windows\System\asmxoBb.exe
  2⤵
  PID:12672
- C:\Windows\System\aJYgDgG.exe
  C:\Windows\System\aJYgDgG.exe
  2⤵
  PID:12628
- C:\Windows\System\udmbMXZ.exe
  C:\Windows\System\udmbMXZ.exe
  2⤵
  PID:11328
- C:\Windows\System\sbfaIau.exe
  C:\Windows\System\sbfaIau.exe
  2⤵
  PID:12188
- C:\Windows\System\FlvqkwY.exe
  C:\Windows\System\FlvqkwY.exe
  2⤵
  PID:10148
- C:\Windows\System\KwRbrKX.exe
  C:\Windows\System\KwRbrKX.exe
  2⤵
  PID:12596
- C:\Windows\System\criwoty.exe
  C:\Windows\System\criwoty.exe
  2⤵
  PID:12152
- C:\Windows\System\bSDoNCv.exe
  C:\Windows\System\bSDoNCv.exe
  2⤵
  PID:10784
- C:\Windows\System\yvcqYjq.exe
  C:\Windows\System\yvcqYjq.exe
  2⤵
  PID:8288
- C:\Windows\System\sbuRHmC.exe
  C:\Windows\System\sbuRHmC.exe
  2⤵
  PID:12764
- C:\Windows\System\lmVqrhw.exe
  C:\Windows\System\lmVqrhw.exe
  2⤵
  PID:12772
- C:\Windows\System\RRPescl.exe
  C:\Windows\System\RRPescl.exe
  2⤵
  PID:10976
- C:\Windows\System\hchXWYN.exe
  C:\Windows\System\hchXWYN.exe
  2⤵
  PID:11616
- C:\Windows\System\XSJILdu.exe
  C:\Windows\System\XSJILdu.exe
  2⤵
  PID:3500
- C:\Windows\System\OUZdHdk.exe
  C:\Windows\System\OUZdHdk.exe
  2⤵
  PID:12028
- C:\Windows\System\OVZhyzN.exe
  C:\Windows\System\OVZhyzN.exe
  2⤵
  PID:9944
- C:\Windows\System\IzmolYF.exe
  C:\Windows\System\IzmolYF.exe
  2⤵
  PID:12484
- C:\Windows\System\RubzpfG.exe
  C:\Windows\System\RubzpfG.exe
  2⤵
  PID:12012
- C:\Windows\System\rxZXfAb.exe
  C:\Windows\System\rxZXfAb.exe
  2⤵
  PID:2516
- C:\Windows\System\pMXXpeS.exe
  C:\Windows\System\pMXXpeS.exe
  2⤵
  PID:8532
- C:\Windows\System\QofdWSt.exe
  C:\Windows\System\QofdWSt.exe
  2⤵
  PID:12592
- C:\Windows\System\qwRhedI.exe
  C:\Windows\System\qwRhedI.exe
  2⤵
  PID:11180
- C:\Windows\System\WZnAZZg.exe
  C:\Windows\System\WZnAZZg.exe
  2⤵
  PID:8248
- C:\Windows\System\mulMnmf.exe
  C:\Windows\System\mulMnmf.exe
  2⤵
  PID:4768
- C:\Windows\System\LBPgBwY.exe
  C:\Windows\System\LBPgBwY.exe
  2⤵
  PID:13388
- C:\Windows\System\qwQTvtH.exe
  C:\Windows\System\qwQTvtH.exe
  2⤵
  PID:13420
- C:\Windows\System\PztWNEG.exe
  C:\Windows\System\PztWNEG.exe
  2⤵
  PID:13444
- C:\Windows\System\qnKfoZh.exe
  C:\Windows\System\qnKfoZh.exe
  2⤵
  PID:13468
- C:\Windows\System\CqkXPFy.exe
  C:\Windows\System\CqkXPFy.exe
  2⤵
  PID:13492
- C:\Windows\System\RPRaAgz.exe
  C:\Windows\System\RPRaAgz.exe
  2⤵
  PID:13508
- C:\Windows\System\kBwoNtu.exe
  C:\Windows\System\kBwoNtu.exe
  2⤵
  PID:13532
- C:\Windows\System\qUaTCDI.exe
  C:\Windows\System\qUaTCDI.exe
  2⤵
  PID:13560
- C:\Windows\System\gjQLRij.exe
  C:\Windows\System\gjQLRij.exe
  2⤵
  PID:13584
- C:\Windows\System\XKhXksM.exe
  C:\Windows\System\XKhXksM.exe
  2⤵
  PID:13816
- C:\Windows\System\cLBiSUx.exe
  C:\Windows\System\cLBiSUx.exe
  2⤵
  PID:13912
- C:\Windows\System\CIUgIio.exe
  C:\Windows\System\CIUgIio.exe
  2⤵
  PID:13936
- C:\Windows\System\qYMxwaH.exe
  C:\Windows\System\qYMxwaH.exe
  2⤵
  PID:13992
- C:\Windows\System\BETqwXC.exe
  C:\Windows\System\BETqwXC.exe
  2⤵
  PID:14156
- C:\Windows\System\lmDxDsH.exe
  C:\Windows\System\lmDxDsH.exe
  2⤵
  PID:14220
- C:\Windows\System\GpCFPrW.exe
  C:\Windows\System\GpCFPrW.exe
  2⤵
  PID:14240
- C:\Windows\System\HDaSAXn.exe
  C:\Windows\System\HDaSAXn.exe
  2⤵
  PID:14256
- C:\Windows\System\idhAvwj.exe
  C:\Windows\System\idhAvwj.exe
  2⤵
  PID:14276
- C:\Windows\System\dLEIHqr.exe
  C:\Windows\System\dLEIHqr.exe
  2⤵
  PID:9284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hcyvevpj.iyp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AUOFHrx.exe

Filesize
2.1MB

MD5
923b48aa3462e7c441f4a05d9f9c7009

SHA1
9eab5cd449efc31304be92457d940ebb62124b0d

SHA256
66dea605e7b290fe58175b7c8585193a87d554d6fee109a3becf197dc2911409

SHA512
539b1eca16b4e2c1e4e02178c0d6cfc0838c92ff25b038212a623f16dcfeb45511d432e8044508f30fde04276c8ed399cef07d61a11387a83e64aa34aa44c6ef

Download Submit
C:\Windows\System\BkyvqTo.exe

Filesize
2.1MB

MD5
c7c1a578c76e414c6032a20f36113eda

SHA1
e4459800fe6482d67ca35b6a6e0e8297eba1b90a

SHA256
3bd989194ca7fabfa84be84fadd853911d7a6124a099528ddd7add2106e299c7

SHA512
d86b2d6185f7fc5039de7c80349d4ccf09e1206fee75b0a7ec94f818cae764e4165405cf225950f38b2bb69693b7ca664b313752cdd1e0bf62bf038633c49a13

Download Submit
C:\Windows\System\DJMpPCp.exe

Filesize
2.1MB

MD5
f61f84a5dd9e9f73cb8ecebc42f3a91b

SHA1
55cc49cc9b165882cd96e22f53f515185e8fce37

SHA256
d1c4d3a93ff5f9d15569260075232df797bb93fed5f144dc43f26f0f751e211f

SHA512
f8778433888c7e749cbb6f6969fb863d4c5827809f9946b59e92ae3c83edc0fe59d6a588c1ec757b050c092efdb8c68c7f690d819e4a35786dcd22cbf9c2bd73

Download Submit
C:\Windows\System\GExjLCl.exe

Filesize
2.1MB

MD5
3bb11786d92d959bb72eb0a20c5eb24e

SHA1
53ced420c9efe061979b21e41e58b70630b7d297

SHA256
8430b5180636bd76e651c0f683fb59622997bb7eb47673cda881b887df62b572

SHA512
b34e9fe71047bfdc83fe9cc0d71f1f2964a8459d788a2b71fe4d3c4499dfbd1ad7051f9efe2ac1b9fd67d5257820bc1eeaa34935db50c591384ae73aaaebdfc9

Download Submit
C:\Windows\System\HMfgZqd.exe

Filesize
2.1MB

MD5
052a4b2638289569cff8f83c4869cf67

SHA1
46074dfde0faa2b5af17ffcd5afc03c8b3645e3f

SHA256
853d672061318f9603e09f03668f82bd2a4ed3472438bfab8207bf4c3fe0b162

SHA512
36401ccc55a0334a4cd3ce8dfe55af518c282c78144c5879698b5643a13caf7e802324ab721cbe92034aa0d4c65f4a611cbc7aa238945a72a86f8e495d1f1fd7

Download Submit
C:\Windows\System\IxXyupd.exe

Filesize
2.1MB

MD5
1f0078ba60427757c3a79d849b0e2f98

SHA1
9c1fc30d962b7a5c2f2db086dabdba5ec67d67ba

SHA256
4082bfd107ab7ee728914db7178cd48ad12fe9e4b4155f3d9759c3a2f9656a84

SHA512
f616c1dca775a091fd58222e1f76db45324478641ad91d06fc59534ce4af70c5742be6bea3433dfb36953bb59ee8b5390495144698aa88d6b1a1d03935e51c27

Download Submit
C:\Windows\System\KDviODU.exe

Filesize
2.1MB

MD5
33db922ae3f1cdde96307c1741154cf2

SHA1
9c7556bd37fb5d8c49ceb18699a2718d8ffb28b7

SHA256
64f4f2d1a3fcd286697a806558e7adc1dad82fc9b1b61da5a11f2feed840653c

SHA512
4a5119d9a123f4678a977b4043d05bfef553b358398f5fd81f539fdb9105c712a258778bf43f6e7f7bb2b014103d9b619f2085ec5651c7f8fa49f259f01fdbda

Download Submit
C:\Windows\System\LBnvSvX.exe

Filesize
2.1MB

MD5
6fbc08a6c8611560c5522659a657a2f9

SHA1
afd36bb1a2ba505e991ccb33119198fad37f9f64

SHA256
731dbfd77fde66dbc824e063c6dfbc4118c7e08e1a96667c14f6d5aacb95befe

SHA512
cfaa10c0147251b0298f5d34f3a54431943294d3236ee4e8910eb29e0fbfbe1b5230d952e2e5b83d348e7435655acec6c6863600079732d2423bda3ccc26f9b5

Download Submit
C:\Windows\System\LuZeNeH.exe

Filesize
2.1MB

MD5
b976ab926064210c7ff363879670ff49

SHA1
8a70c07aa16a2cdb902f47dca812c56084400673

SHA256
4ee74f8a05e5733feaa7ce8a1e5af3a55547cf4b4e77c0c00eb460343232de4c

SHA512
f12cc45b851ab30ae35de23e75cb2615eeaf2dc5c3a557b16d1af66f7256e4dea91aa5d2102ee76e5feecf6bbae40524d9d4ea9f5e1d7dc827cbcd1ef32f5159

Download Submit
C:\Windows\System\MtCfdXZ.exe

Filesize
2.1MB

MD5
be6a4cf5bdb20691ba3f48b7747f3e65

SHA1
06c6a1dc75a117841c6b0c230cf559fb5e626568

SHA256
52e55f3d0c22f2ad1786b037b1adbbc5a4796575eb4c34e2895fbc4d93b62a6a

SHA512
cb3c87797c6ee43ef42b737a3e0a37fb33f5692808a4399fda18fed8862bbf9881a0e199d678ca7a19b76b2735c1002917a9cf29c47cc5894bd6f8a1d757bbfa

Download Submit
C:\Windows\System\NjvfeWL.exe

Filesize
2.1MB

MD5
c2cb7aea1b9add711887b36af34866b5

SHA1
976c7957b8e0499bcbebad69a513eee0e1e864ec

SHA256
6892560b6a055dacb98d3267a102fcc7902aef505eab61a70b42cbc4b17a7083

SHA512
14aa9196f0d18a6a13aed55267e5d58078a619cf1dc3669021955dfb745292b38e0dc9d95d66808fe106d5028131c1f9a3e6ebd9bd1452f7e63dfe36218366d7

Download Submit
C:\Windows\System\OGbsGJf.exe

Filesize
2.1MB

MD5
046a8f59c04eea9cbcbbbf4b9b311bd1

SHA1
51bc35753a8a715d5bdcf0040d076eb90b734305

SHA256
575ed7212d4fd7df1ab749e8baf27371f5ff6b59ce51b141ad0d4785ff9af3c8

SHA512
41dc6aaca57b8309ad5f5d66ba601c6449dbfa8eb1f06718204094374b96ed32f35282115b346947c7f8bdf4af152d693c09a55dd92107353d060ae04bc7fed1

Download Submit
C:\Windows\System\OZWsYJd.exe

Filesize
2.1MB

MD5
cd9cd43866dfeaaffab739b3efd350a8

SHA1
afc132ed4a41cb714d33f98082f043ca90cb268f

SHA256
c08baa83824e6016a906726ccf67cdb18cfc86c3ecfddac62edd594f3d21e439

SHA512
bfa6fb6d9ab2efeffe1413356ec504d5026813a73bdff24a78f5b9c1590e5fa5d992f84b5be8bea70b7315c5f446c66ecec9083e9760d63aaddfb02fff3c7ee9

Download Submit
C:\Windows\System\ObDpHju.exe

Filesize
2.1MB

MD5
e5e230e15c3ecbe665b68f9c883ab098

SHA1
35ef2a1417a4ff964b4708a5b75aba6c66de74b8

SHA256
6c06a7cfaf87cd2977405f9818cee3709e380d4fd5819dc509c57591cc71caa5

SHA512
769591f721cc52aa126d0c2ecca17b122cbe6681fa035518efbf87cacecdc754e97c66e7557dbfe68e2bfdaf4870879c27428ef61f38f6a90216cefad041e2fa

Download Submit
C:\Windows\System\PcyAEKC.exe

Filesize
2.1MB

MD5
00d702946c3973c9beb87fbffae99498

SHA1
a418f774ee9a5c881e243f7f58e6120e98df855d

SHA256
d9e66aa0b95bd4aa6321355897636786a1281fe10bfc20bcb7d2d19578f4bf5c

SHA512
e96733ea3295fb6dd7e7fb4ce61ce2f5b77f4137e3b5d2cb975fc7d0d8d8544a04f6f7c329e42db17ad704be7099f3d9f36865a276b5ad01e9effd72d95d49fa

Download Submit
C:\Windows\System\QWvWEBE.exe

Filesize
2.1MB

MD5
d42a79eb3e450814586f1a84d45724d9

SHA1
4da881d046ee0c80f5c838793f411453ae22829d

SHA256
d4105996154c09e492ca7beded9fad31c78f72ceea4a8e6504e57147dec5074c

SHA512
37efbc191cac4d1412bb35161eb898bf4fb75aeffa7e8f1ea441e65c705d6490550498780f84aab95057df01a5f04610b0a99fed0896e0468f7606080f40028d

Download Submit
C:\Windows\System\ROsDSKY.exe

Filesize
2.1MB

MD5
c1202ccbb9cdaa917c3c78c03940d301

SHA1
6d36ea250b1c49bd882c8c1e730ce01a8053ecc0

SHA256
de38eb5b0607cb37a9c8f01b5492b73ac3b1f9f4e2571a167e823fa7efda60bf

SHA512
e8ddce6874d1a020a182aa37917815febc3f52ebc815668a43db7e9a07ed299a78e6ca5b5741fc54e999435d4a392077069b850cfce33f0c1d0990cfb9a87798

Download Submit
C:\Windows\System\RXlAwXh.exe

Filesize
2.1MB

MD5
346b2923a2a8903913cdf2feb2cc4c28

SHA1
00cd7af64ff04f5814544bdbb5f0693a760c3951

SHA256
987b199c348bedce9851955803fe2751ea1f33b92266d46df54dc75db515a7a8

SHA512
bc85adaf6b9e5fec7fae8653ab0315e0fde6b8d41ee4539ada6dca5897963d1affc42d19a9dc4e6c7c4e3146da7b2f8108b082297c451900c381c79e285472e4

Download Submit
C:\Windows\System\RegmPXu.exe

Filesize
2.1MB

MD5
f56f71e119bfbcf520803c37d2c49b91

SHA1
ebe0b6b45f68779c2c7b57af5facbcf1acbac77b

SHA256
76af955ec1bade2e3a4a958b0eff71cecddfc28a1fa9c4a70bf65eca68278f53

SHA512
1dfea71bb623e24d8151c57128c931cec296c976091822e89fca79465e88e50a1d13dbd8bff93f792f2cab592a9a6af5d6f2a8653d9a131b2b2ac4d5c4ceed94

Download Submit
C:\Windows\System\TDhrrmz.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\TczTBwm.exe

Filesize
2.1MB

MD5
3aadcdd6ab8a603346691b2c9473571d

SHA1
babd6657da0c35db4b9f672707f015ce7230a035

SHA256
f08c75f8407038b47c3bb0b3b04c0f9a700a15978d83570fc43f94ea25b05f53

SHA512
a5c485a9a894a85c6268d872c081e06aa73506b1ee449b4bba2696379a51a53c4e1de9e9f75abbd9160ac5bd391006e18b63ca90547c192a67a338775066b4f3

Download Submit
C:\Windows\System\XUKcgTa.exe

Filesize
2.1MB

MD5
0c583f115ae34363332444fc168bc007

SHA1
1753aed55254cd83323bdbf0ceda72c37633147c

SHA256
d5fdcd43e14611fe8fdd59ddbff5078a85bac866242fb34c5e1d6c7a30161aef

SHA512
0669b0dde2ecc08f118587ecb08017ceaec48410c3aed2680d1b251db67bbc239370cdaa3ec18009abe549a064c6c666e24811a5d2f208b487583905f41a90f6

Download Submit
C:\Windows\System\dQzlfll.exe

Filesize
2.1MB

MD5
a6d0eb7cc5824d321bfbc9438c86386e

SHA1
9587ace7c479d5f38f5c949ff29f2e881de03a19

SHA256
2b21dad900f996b0b61bf82f1d91f12af04b75628a129064d7cba0ecf05fe669

SHA512
d2cebd579d6551a14684915c440a60786a0ddd4085d4e870337844624567a9a7a84b583a96e8583f3614cd4281d5b142b6260f505bf67f55dcb3662419cce3a5

Download Submit
C:\Windows\System\egBKpuJ.exe

Filesize
2.1MB

MD5
4228a2a66f078c2a5aa4118d73a64707

SHA1
ba64a9fad7eb9aafc5efd46b501cd6a14186e9cc

SHA256
5c4bb4098046ea6c68acac8a5151cca6411f34c6cc1d77b3d4a8642ade2cf0d0

SHA512
9ec75b0cd273e4ba77a254e899cfde91c7e29b53ac87f9d5ddfa32086164bced04a1e71a21675f45b693c08faded7c24175b069f4f8961afee0aca0b37a917af

Download Submit
C:\Windows\System\fJNQFVY.exe

Filesize
2.1MB

MD5
436856ea4f4ff9caf08c3a61bbaf207d

SHA1
c916f095e88870df3c674d89adf09f587a15e74e

SHA256
f89cf65d7ea921c48d51aab803fc47f15862d58ee88a40ee877d0f0720021aab

SHA512
3513b2f141e7e9ad6aa4d1abe9a9808586e3a79ffa6c8f3f159d6f4f056122f8f0cdadbdc81a97760f1a9f42a32ac4ee15f80bfc5665e57757473137b292ea7b

Download Submit
C:\Windows\System\fwUQFJp.exe

Filesize
2.1MB

MD5
f618717e44907b29bb196f71d27d98b2

SHA1
4a10737cc6ba0e08465e6e6a23b197e279e64dd3

SHA256
72ac57b883a92ccc7bfb2dd01b774c89bb37423bc2939d194a34843c9933d6ee

SHA512
d2e8e980279f7c8fb737c80ccfa1ce171e829ec946e2f278398786bcb969e4b4a4c8c8a305e6e1934fedbee706961b17b11d6143da108b1c19c90c7ddb75b1de

Download Submit
C:\Windows\System\gLVlvKK.exe

Filesize
2.1MB

MD5
87ccdebac81eef614ca05996da36ff24

SHA1
5cc1edeb6c1be659c425b8ba13232846c8ca666b

SHA256
c01b0e579f609fa84a68f2fc7f0a8e0f4f8ea31a5b228637cc920df5253f00e4

SHA512
dc27fead6a564bfd0bc7bb7a4184fedc4c6abcfaaf8a7f80e33105f956cb5c0264d2a327bee5bd9874bb72ea613b08f367152ebead00ee8bd8355aadb81866cc

Download Submit
C:\Windows\System\gYThNHe.exe

Filesize
2.1MB

MD5
fc410dc737d5cfe7b91c57977541593b

SHA1
68abd09ed16370f773bba25e1c3ba3309c1bb733

SHA256
d49bc1a499618677a91ca958b2a8d0077edfdf29525609ef6ac0b09b7f5c89cb

SHA512
4d15078deaa78d0dc5abfd8f417b7ee41f60539536f7b437c12c457c6ed04109fa00b002c4fd09877f24e5bb572693698c8dc7a5785eedfdf6efcd875cded428

Download Submit
C:\Windows\System\gbPmDnG.exe

Filesize
2.1MB

MD5
dc5ea94598fac0c646f44118d11466f7

SHA1
14118fb172ff9dc6c61694d6ef99805017761df9

SHA256
8048699516c9a452a90345648ab691877712fa1abe991700cd475300b8f6d19b

SHA512
3ff7587819e69146d6473f59eabca14dc558ba55e2a7bbf2f894b2f6f944f0cfbed05adc7e97a4776ba2c45848839cd0a8b39f678406e4b4cb2494a0c4841918

Download Submit
C:\Windows\System\jfVfsyh.exe

Filesize
2.1MB

MD5
377decfca90d1d16dbc547e604dc4e43

SHA1
36d29b8acaf2ef7100c14efb3f50f18a5b6610bd

SHA256
fc8b2bb16dc717b7d1b9cd41ab0cd6b4e49a622b9630b037dfaad3d1bbf9159f

SHA512
42e89e3c3261763137772ae995f05c8aa79b559619783077cfa8c6ab24da3d6372df1e0d5658d10593416e12f9632990f9a65cf781c130c9d306e72247e4ca7b

Download Submit
C:\Windows\System\mGrNmcl.exe

Filesize
2.1MB

MD5
43f98a4e1e9d01c4608147aac2c38a5d

SHA1
214b57d4fa72c82cfd58f205418315e87a87f70b

SHA256
d5233167c7e8cf0091d2cc71e14586f4b18d05f9a5c638f3500e76f18fd1c669

SHA512
ecf5d92d446784955857976ff1e23ea8cc39354418bd63fee035aac90981583537e594255326283d00dd999ac136547342567568f607779f46e58fbd81644a0f

Download Submit
C:\Windows\System\mppYRGQ.exe

Filesize
2.1MB

MD5
bdb5879c8186531ffc290f5be3d18e46

SHA1
43d404880cd7a47fd1f87f11a3fa0b19bcb1a991

SHA256
188f9c5d29e0be017a5e40e3cc9d021e63f3e92a5f1f6fcb5683e844ed3f0a8f

SHA512
87b6bf59087cceb88d38f397223b3678eac468d3b271d8ed14e83d8178cf75c18a72b1fee02ced9cac2614562622acb9988fa808cea717c2ba11dc3a1c13f20e

Download Submit
C:\Windows\System\nHUPahQ.exe

Filesize
2.1MB

MD5
c21485bc5b53318c16806e27c2bc5c71

SHA1
5133e4d6ec7cb4310da86e0ef046149a5b11fe28

SHA256
847594bca2fb5979144d3637dda6459afbb239c142aa4942343ad8b6b84e0214

SHA512
96eac62fddd5e0510fc1866dfa0d291b2286a5b13a8cfad69c14541af99f14111618e500e72d7b49b2702a56175fb74a51da3edd6335b2b15998448cc9568cd6

Download Submit
C:\Windows\System\pbsFhkq.exe

Filesize
2.1MB

MD5
1ff7ab2673d70f1e25864e7393d48e74

SHA1
9b26263a9d9aebbc18132625a9b687dea85a5d39

SHA256
fb4bc964a2c512a8475748c592bb32f781f4f16c10e46edb3e8b2c4e8c733a89

SHA512
28642d6c3142e31400031afa99c2f18d5ae79edba9887df35d8a510e91dbbace409973b258c0b947ec099cc12401554a5dead1bbc5083daf620374a07d8bd175

Download Submit
C:\Windows\System\qnUANif.exe

Filesize
2.1MB

MD5
de527304e4552da88a1ff8abf13ac125

SHA1
8152fe432cf321f2a256a9a17eafb6dac94163dd

SHA256
bec60cce59f904b0cf666ade9f57ab94e7a9c2876b3032ddffd71872d64e767f

SHA512
63111ea2400a41f273a5f62bc1fdda4cbe6f50f129fa1e07fe06a5987aff5d631ec5b40e736f61442b379f6edfb9bd471925f70ad0dca94bcc44b3e9fed54c35

Download Submit
C:\Windows\System\smueQMM.exe

Filesize
2.1MB

MD5
758f95e4f69a67d04083be78d3c6671a

SHA1
601ff5edc49705d4b8023566c90a1216179d9373

SHA256
7a1f0ae1398488253d39453d06fe116ac8329802efeedf104e3032e7761854c7

SHA512
4d4dbb1084a06b029b854725ea65d6ab01c9708f58a87a0753f39a11cebda4f5d190dd6254c5f416fde3afa9161f440f5e924de8d8bbfce3ce8729fbd85a17bb

Download Submit
C:\Windows\System\woGNpXD.exe

Filesize
2.1MB

MD5
824882be97d37eb8ae6667c694ce7c04

SHA1
fccc26f5ae0d7e9a32171e14693841c1002b0804

SHA256
2ad1660a2949901af219cbfabb6b3906bc46a98ebf2a65b9dee003750b5747ea

SHA512
be933d692e458828946fc8d7efcf0bd50d7c345725c30ecd0c9e7f403acec00f648efda3a5303d082182b3696d463785945723c68c8d80f50c360a3556255a5c

Download Submit
C:\Windows\System\xVBlcxS.exe

Filesize
2.1MB

MD5
68b441a502601e13a4466993bafd096b

SHA1
49e9214daa0bc26f619edf07e2536fe754b85602

SHA256
2edc674b6ef3b41cf29db4985b109f1046398013efbf377506948808414f8caa

SHA512
d3abb7e97715d150063ec546844890deb8bc003c406a866c4d91fa81417830f61c95a8fc1273597cfb97e2661720c28b5d3576e219dfdbfe85c6800242d6c729

Download Submit
C:\Windows\System\xynjbSL.exe

Filesize
2.1MB

MD5
60364432d8e2b3fadca66a91413cf9ef

SHA1
2d46242358ccfb8ce71092887ae0c32a2d3b693a

SHA256
aa03da87ddde335168b3dba450e7a94888000969d8f33f3f7ec08c30dafd0e8a

SHA512
bd3983cd2bd2b3baef3e7d9d34f15abf93b552c6cf7db2fb45aed72d4e3fdd2531ec65d81f8692f5f7d99a49012e3184cb988ac177bc73a0c7bbebf8a506b9e7

Download Submit
memory/436-368-0x00007FF610690000-0x00007FF610A82000-memory.dmp

Filesize
3.9MB

Download
memory/436-3363-0x00007FF610690000-0x00007FF610A82000-memory.dmp

Filesize
3.9MB

Download
memory/716-3329-0x00007FF74CCA0000-0x00007FF74D092000-memory.dmp

Filesize
3.9MB

Download
memory/716-71-0x00007FF74CCA0000-0x00007FF74D092000-memory.dmp

Filesize
3.9MB

Download
memory/944-3379-0x00007FF7A8C30000-0x00007FF7A9022000-memory.dmp

Filesize
3.9MB

Download
memory/944-423-0x00007FF7A8C30000-0x00007FF7A9022000-memory.dmp

Filesize
3.9MB

Download
memory/1068-422-0x00007FF647F80000-0x00007FF648372000-memory.dmp

Filesize
3.9MB

Download
memory/1068-3375-0x00007FF647F80000-0x00007FF648372000-memory.dmp

Filesize
3.9MB

Download
memory/1072-3349-0x00007FF723D00000-0x00007FF7240F2000-memory.dmp

Filesize
3.9MB

Download
memory/1072-426-0x00007FF723D00000-0x00007FF7240F2000-memory.dmp

Filesize
3.9MB

Download
memory/1272-345-0x00007FF764480000-0x00007FF764872000-memory.dmp

Filesize
3.9MB

Download
memory/1272-3358-0x00007FF764480000-0x00007FF764872000-memory.dmp

Filesize
3.9MB

Download
memory/1672-90-0x00007FF7DDDF0000-0x00007FF7DE1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1672-3331-0x00007FF7DDDF0000-0x00007FF7DE1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1692-3334-0x00007FF636BC0000-0x00007FF636FB2000-memory.dmp

Filesize
3.9MB

Download
memory/1692-425-0x00007FF636BC0000-0x00007FF636FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-286-0x00007FF75C7C0000-0x00007FF75CBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-3341-0x00007FF75C7C0000-0x00007FF75CBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-325-0x00007FF6D9210000-0x00007FF6D9602000-memory.dmp

Filesize
3.9MB

Download
memory/2328-3365-0x00007FF6D9210000-0x00007FF6D9602000-memory.dmp

Filesize
3.9MB

Download
memory/2336-3356-0x00007FF76FC10000-0x00007FF770002000-memory.dmp

Filesize
3.9MB

Download
memory/2336-347-0x00007FF76FC10000-0x00007FF770002000-memory.dmp

Filesize
3.9MB

Download
memory/2496-269-0x00007FF688C20000-0x00007FF689012000-memory.dmp

Filesize
3.9MB

Download
memory/2496-3352-0x00007FF688C20000-0x00007FF689012000-memory.dmp

Filesize
3.9MB

Download
memory/2540-0-0x00007FF76ADE0000-0x00007FF76B1D2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-1-0x0000022F47BE0000-0x0000022F47BF0000-memory.dmp

Filesize
64KB

Download
memory/2736-3413-0x00007FF62F4D0000-0x00007FF62F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-406-0x00007FF62F4D0000-0x00007FF62F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-8-0x00007FFFC7ED3000-0x00007FFFC7ED5000-memory.dmp

Filesize
8KB

Download
memory/2756-41-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

Filesize
10.8MB

Download
memory/2756-191-0x0000026EDF180000-0x0000026EDF1A2000-memory.dmp

Filesize
136KB

Download
memory/2756-2169-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

Filesize
10.8MB

Download
memory/2756-424-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

Filesize
10.8MB

Download
memory/3244-259-0x00007FF6558A0000-0x00007FF655C92000-memory.dmp

Filesize
3.9MB

Download
memory/3244-3353-0x00007FF6558A0000-0x00007FF655C92000-memory.dmp

Filesize
3.9MB

Download
memory/3616-394-0x00007FF712160000-0x00007FF712552000-memory.dmp

Filesize
3.9MB

Download
memory/3616-3376-0x00007FF712160000-0x00007FF712552000-memory.dmp

Filesize
3.9MB

Download
memory/3632-421-0x00007FF631490000-0x00007FF631882000-memory.dmp

Filesize
3.9MB

Download
memory/3632-3383-0x00007FF631490000-0x00007FF631882000-memory.dmp

Filesize
3.9MB

Download
memory/3964-344-0x00007FF77C9C0000-0x00007FF77CDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3964-3344-0x00007FF77C9C0000-0x00007FF77CDB2000-memory.dmp

Filesize
3.9MB

Download
memory/4468-3360-0x00007FF7CD6A0000-0x00007FF7CDA92000-memory.dmp

Filesize
3.9MB

Download
memory/4468-428-0x00007FF7CD6A0000-0x00007FF7CDA92000-memory.dmp

Filesize
3.9MB

Download
memory/4500-3361-0x00007FF60B420000-0x00007FF60B812000-memory.dmp

Filesize
3.9MB

Download
memory/4500-410-0x00007FF60B420000-0x00007FF60B812000-memory.dmp

Filesize
3.9MB

Download
memory/4580-3345-0x00007FF6462B0000-0x00007FF6466A2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-395-0x00007FF6462B0000-0x00007FF6466A2000-memory.dmp

Filesize
3.9MB

Download
memory/4816-214-0x00007FF61B590000-0x00007FF61B982000-memory.dmp

Filesize
3.9MB

Download
memory/4816-3335-0x00007FF61B590000-0x00007FF61B982000-memory.dmp

Filesize
3.9MB

Download
memory/4904-3340-0x00007FF6EDCE0000-0x00007FF6EE0D2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-427-0x00007FF6EDCE0000-0x00007FF6EE0D2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-3337-0x00007FF726770000-0x00007FF726B62000-memory.dmp

Filesize
3.9MB

Download
memory/5036-150-0x00007FF726770000-0x00007FF726B62000-memory.dmp

Filesize
3.9MB

Download
memory/5076-3348-0x00007FF7045A0000-0x00007FF704992000-memory.dmp

Filesize
3.9MB

Download
memory/5076-268-0x00007FF7045A0000-0x00007FF704992000-memory.dmp

Filesize
3.9MB

Download