xmrig | 5928de3cd8815d9afcd954ff4215c41dc488c8a348378d7dd2a1dcc7ff1b9adc

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
Size

1.6MB
MD5

8d46bfb29ddf9d5314124307e4d97ee0
SHA1

2ce9e60c31635c5decf89535f2086f167a532e94
SHA256

5928de3cd8815d9afcd954ff4215c41dc488c8a348378d7dd2a1dcc7ff1b9adc
SHA512

30bad4b34abb44a5a5b031f1537b36df0559738d14ad8be15afcda9edcf3f45057bf3b6d41e5fbff401ba98dfdb0b77aea9d30edb5dc33bdad44768d482e3223
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXYWnisvE:Lz071uv4BPMkHC0IaSEzQR4iRJWC

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/548-260-0x00007FF727250000-0x00007FF727642000-memory.dmp	xmrig
behavioral2/memory/2908-569-0x00007FF6AAFA0000-0x00007FF6AB392000-memory.dmp	xmrig
behavioral2/memory/1300-589-0x00007FF73D8F0000-0x00007FF73DCE2000-memory.dmp	xmrig
behavioral2/memory/2648-591-0x00007FF7842A0000-0x00007FF784692000-memory.dmp	xmrig
behavioral2/memory/2192-594-0x00007FF6B4150000-0x00007FF6B4542000-memory.dmp	xmrig
behavioral2/memory/4084-1299-0x00007FF6CEB70000-0x00007FF6CEF62000-memory.dmp	xmrig
behavioral2/memory/1636-1044-0x00007FF748150000-0x00007FF748542000-memory.dmp	xmrig
behavioral2/memory/3904-829-0x00007FF714760000-0x00007FF714B52000-memory.dmp	xmrig
behavioral2/memory/2608-730-0x00007FF769A20000-0x00007FF769E12000-memory.dmp	xmrig
behavioral2/memory/3584-631-0x00007FF7155F0000-0x00007FF7159E2000-memory.dmp	xmrig
behavioral2/memory/688-595-0x00007FF7D6330000-0x00007FF7D6722000-memory.dmp	xmrig
behavioral2/memory/4568-593-0x00007FF6E6AA0000-0x00007FF6E6E92000-memory.dmp	xmrig
behavioral2/memory/3616-592-0x00007FF733E00000-0x00007FF7341F2000-memory.dmp	xmrig
behavioral2/memory/4996-590-0x00007FF721B60000-0x00007FF721F52000-memory.dmp	xmrig
behavioral2/memory/1260-588-0x00007FF631350000-0x00007FF631742000-memory.dmp	xmrig
behavioral2/memory/388-420-0x00007FF604C30000-0x00007FF605022000-memory.dmp	xmrig
behavioral2/memory/4328-411-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp	xmrig
behavioral2/memory/4476-348-0x00007FF6F6AA0000-0x00007FF6F6E92000-memory.dmp	xmrig
behavioral2/memory/1872-312-0x00007FF763450000-0x00007FF763842000-memory.dmp	xmrig
behavioral2/memory/4316-188-0x00007FF79AF40000-0x00007FF79B332000-memory.dmp	xmrig
behavioral2/memory/4544-134-0x00007FF7D2FA0000-0x00007FF7D3392000-memory.dmp	xmrig
behavioral2/memory/2996-100-0x00007FF772230000-0x00007FF772622000-memory.dmp	xmrig
behavioral2/memory/4992-2491-0x00007FF649900000-0x00007FF649CF2000-memory.dmp	xmrig
behavioral2/memory/4992-2493-0x00007FF649900000-0x00007FF649CF2000-memory.dmp	xmrig
behavioral2/memory/4316-2495-0x00007FF79AF40000-0x00007FF79B332000-memory.dmp	xmrig
behavioral2/memory/548-2498-0x00007FF727250000-0x00007FF727642000-memory.dmp	xmrig
behavioral2/memory/1636-2499-0x00007FF748150000-0x00007FF748542000-memory.dmp	xmrig
behavioral2/memory/4544-2502-0x00007FF7D2FA0000-0x00007FF7D3392000-memory.dmp	xmrig
behavioral2/memory/4476-2505-0x00007FF6F6AA0000-0x00007FF6F6E92000-memory.dmp	xmrig
behavioral2/memory/2996-2504-0x00007FF772230000-0x00007FF772622000-memory.dmp	xmrig
behavioral2/memory/1872-2507-0x00007FF763450000-0x00007FF763842000-memory.dmp	xmrig
behavioral2/memory/4568-2516-0x00007FF6E6AA0000-0x00007FF6E6E92000-memory.dmp	xmrig
behavioral2/memory/2908-2521-0x00007FF6AAFA0000-0x00007FF6AB392000-memory.dmp	xmrig
behavioral2/memory/388-2520-0x00007FF604C30000-0x00007FF605022000-memory.dmp	xmrig
behavioral2/memory/2648-2523-0x00007FF7842A0000-0x00007FF784692000-memory.dmp	xmrig
behavioral2/memory/1260-2514-0x00007FF631350000-0x00007FF631742000-memory.dmp	xmrig
behavioral2/memory/4328-2511-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp	xmrig
behavioral2/memory/1300-2510-0x00007FF73D8F0000-0x00007FF73DCE2000-memory.dmp	xmrig
behavioral2/memory/3616-2517-0x00007FF733E00000-0x00007FF7341F2000-memory.dmp	xmrig
behavioral2/memory/688-2550-0x00007FF7D6330000-0x00007FF7D6722000-memory.dmp	xmrig
behavioral2/memory/4996-2548-0x00007FF721B60000-0x00007FF721F52000-memory.dmp	xmrig
behavioral2/memory/3416-2552-0x00007FF665DB0000-0x00007FF6661A2000-memory.dmp	xmrig
behavioral2/memory/4084-2546-0x00007FF6CEB70000-0x00007FF6CEF62000-memory.dmp	xmrig
behavioral2/memory/2608-2540-0x00007FF769A20000-0x00007FF769E12000-memory.dmp	xmrig
behavioral2/memory/2192-2532-0x00007FF6B4150000-0x00007FF6B4542000-memory.dmp	xmrig
behavioral2/memory/3584-2544-0x00007FF7155F0000-0x00007FF7159E2000-memory.dmp	xmrig
behavioral2/memory/3904-2537-0x00007FF714760000-0x00007FF714B52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1972	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4992	mAhGcDg.exe
1636	GvtAFhK.exe
2996	zubnjbU.exe
4544	sZuJFLX.exe
4316	ggHcuok.exe
548	MeRTZgO.exe
1872	zYxRbfc.exe
4476	JjAUbUH.exe
4328	xuTitsS.exe
388	ZPinXZi.exe
2908	OXfIuGc.exe
1260	LFSCFIB.exe
1300	SPpGPzI.exe
4996	ayyjmCq.exe
4084	ZdAtwLw.exe
2648	lsPDGLo.exe
3616	zeUNNwJ.exe
4568	QRPFnKN.exe
2192	dRRScGH.exe
688	YfkvAOR.exe
3416	dISHqRl.exe
3584	KDAWynd.exe
2608	AiFVVWL.exe
3904	pkqiYHW.exe
2008	iUqBkdE.exe
2856	cbuefup.exe
1284	oeYuePE.exe
4644	WLDFPoR.exe
1372	svmfhPr.exe
3260	rYJYPGu.exe
4888	ofYbgOM.exe
2684	NuZZVhD.exe
1724	ChmZwwo.exe
1648	oRkHkZE.exe
2080	MgVIJap.exe
3696	HkOhLXf.exe
4052	yYICYdZ.exe
2208	TJKipSn.exe
880	gjpTqnn.exe
396	gSRfRMv.exe
2652	uekEiJO.exe
3860	XUuFYQP.exe
2200	cKdHKaP.exe
1532	YvKkIYS.exe
4112	FGvljVv.exe
4456	xRsCGqb.exe
1424	tNYUHsh.exe
4204	qDxMmgm.exe
2624	vuyOXjv.exe
672	dWTtQCE.exe
3004	yUgNDIi.exe
4208	uSlYrHi.exe
1624	pKAKtmL.exe
3360	NUvYmYp.exe
5000	sglABqQ.exe
4104	haMrPDw.exe
3088	XdYEkeI.exe
2196	FKukuoE.exe
4976	xlBhbmb.exe
4744	jqPfPsg.exe
2228	FDfvkEe.exe
4788	fMhOoHY.exe
3596	GraepVu.exe
912	KJYunrz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4940-0-0x00007FF777F50000-0x00007FF778342000-memory.dmp	upx
behavioral2/files/0x0007000000023425-7.dat	upx
behavioral2/files/0x0007000000023424-18.dat	upx
behavioral2/files/0x000700000002342a-36.dat	upx
behavioral2/files/0x0007000000023432-79.dat	upx
behavioral2/files/0x0007000000023434-103.dat	upx
behavioral2/files/0x000700000002343e-128.dat	upx
behavioral2/memory/548-260-0x00007FF727250000-0x00007FF727642000-memory.dmp	upx
behavioral2/memory/2908-569-0x00007FF6AAFA0000-0x00007FF6AB392000-memory.dmp	upx
behavioral2/memory/1300-589-0x00007FF73D8F0000-0x00007FF73DCE2000-memory.dmp	upx
behavioral2/memory/2648-591-0x00007FF7842A0000-0x00007FF784692000-memory.dmp	upx
behavioral2/memory/2192-594-0x00007FF6B4150000-0x00007FF6B4542000-memory.dmp	upx
behavioral2/memory/4084-1299-0x00007FF6CEB70000-0x00007FF6CEF62000-memory.dmp	upx
behavioral2/memory/1636-1044-0x00007FF748150000-0x00007FF748542000-memory.dmp	upx
behavioral2/memory/3904-829-0x00007FF714760000-0x00007FF714B52000-memory.dmp	upx
behavioral2/memory/2608-730-0x00007FF769A20000-0x00007FF769E12000-memory.dmp	upx
behavioral2/memory/3584-631-0x00007FF7155F0000-0x00007FF7159E2000-memory.dmp	upx
behavioral2/memory/688-595-0x00007FF7D6330000-0x00007FF7D6722000-memory.dmp	upx
behavioral2/memory/4568-593-0x00007FF6E6AA0000-0x00007FF6E6E92000-memory.dmp	upx
behavioral2/memory/3616-592-0x00007FF733E00000-0x00007FF7341F2000-memory.dmp	upx
behavioral2/memory/4996-590-0x00007FF721B60000-0x00007FF721F52000-memory.dmp	upx
behavioral2/memory/1260-588-0x00007FF631350000-0x00007FF631742000-memory.dmp	upx
behavioral2/memory/388-420-0x00007FF604C30000-0x00007FF605022000-memory.dmp	upx
behavioral2/memory/4328-411-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp	upx
behavioral2/memory/4476-348-0x00007FF6F6AA0000-0x00007FF6F6E92000-memory.dmp	upx
behavioral2/memory/1872-312-0x00007FF763450000-0x00007FF763842000-memory.dmp	upx
behavioral2/memory/4316-188-0x00007FF79AF40000-0x00007FF79B332000-memory.dmp	upx
behavioral2/files/0x000700000002343b-187.dat	upx
behavioral2/files/0x0007000000023435-176.dat	upx
behavioral2/files/0x0007000000023438-175.dat	upx
behavioral2/files/0x0007000000023439-174.dat	upx
behavioral2/files/0x0007000000023433-171.dat	upx
behavioral2/files/0x0007000000023447-168.dat	upx
behavioral2/files/0x0007000000023446-167.dat	upx
behavioral2/files/0x0007000000023445-159.dat	upx
behavioral2/files/0x0007000000023437-150.dat	upx
behavioral2/files/0x0007000000023443-149.dat	upx
behavioral2/files/0x000700000002342b-148.dat	upx
behavioral2/files/0x0007000000023442-147.dat	upx
behavioral2/files/0x000700000002343a-144.dat	upx
behavioral2/files/0x000700000002344a-194.dat	upx
behavioral2/files/0x0007000000023449-193.dat	upx
behavioral2/files/0x0007000000023441-141.dat	upx
behavioral2/files/0x0007000000023440-139.dat	upx
behavioral2/files/0x0007000000023448-182.dat	upx
behavioral2/memory/4544-134-0x00007FF7D2FA0000-0x00007FF7D3392000-memory.dmp	upx
behavioral2/files/0x0007000000023444-158.dat	upx
behavioral2/files/0x000700000002343d-125.dat	upx
behavioral2/files/0x0007000000023431-123.dat	upx
behavioral2/files/0x000700000002343c-121.dat	upx
behavioral2/files/0x000700000002343f-137.dat	upx
behavioral2/files/0x000700000002342e-106.dat	upx
behavioral2/files/0x0007000000023430-97.dat	upx
behavioral2/files/0x0007000000023436-96.dat	upx
behavioral2/files/0x000700000002342f-91.dat	upx
behavioral2/files/0x000700000002342d-82.dat	upx
behavioral2/memory/2996-100-0x00007FF772230000-0x00007FF772622000-memory.dmp	upx
behavioral2/files/0x0007000000023429-70.dat	upx
behavioral2/files/0x0007000000023427-68.dat	upx
behavioral2/files/0x000700000002342c-55.dat	upx
behavioral2/files/0x0007000000023426-29.dat	upx
behavioral2/files/0x0007000000023428-26.dat	upx
behavioral2/memory/4992-13-0x00007FF649900000-0x00007FF649CF2000-memory.dmp	upx
behavioral2/files/0x0006000000022f42-10.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UgCIGSb.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\cyNxinO.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\oypvHWC.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\tWWdOgz.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\KgLiXoQ.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\XhwGtDW.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\jhUrVIY.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\BlykWXR.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\yuueHXI.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\lxVSNRQ.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\wQwqrYp.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\lwelKih.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\BzBNath.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\BrhINja.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\mTOOwBw.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\IBcMhrc.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\nrlMNif.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\PvdcjQD.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\aaZVYKT.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\IidkAGW.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\QoYSufe.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\lhSWlyK.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\wDmocNn.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\KLrgbJe.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\rvxEaTu.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\qFvotSv.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\GWNVIZw.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\ufnUTmP.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\eSzcKUX.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\MTLfsRl.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\ERoojjI.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\svmfhPr.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\vuyOXjv.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\LAGGntU.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\AYYDUEk.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\FMZCwwR.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\CgXNlle.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\WmKLBAi.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\qZjaThV.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\gOOPHXh.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\qzDYuHR.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\eqCRPrO.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\zicUncK.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\wgaVdzc.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\yoCYpPb.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\NIsWUUF.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\vIafANb.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\yTfreXf.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\sszMjPT.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\detakaF.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\sOJmsdE.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\SGMHQvr.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\XLxFPFG.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\epBDoqP.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\oOeRthK.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\mAhGcDg.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\xZVPwNu.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\vYfZWam.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\hzvuBWW.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\NvDwQit.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\qDERSct.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\OzOLkQT.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\FAORvoo.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
File created	C:\Windows\System\ZjGpXwr.exe	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1972	powershell.exe
1972	powershell.exe
1972	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeLockMemoryPrivilege	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 1972	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	85
PID 4940 wrote to memory of 1972	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	85
PID 4940 wrote to memory of 4992	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	86
PID 4940 wrote to memory of 4992	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	86
PID 4940 wrote to memory of 1636	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	87
PID 4940 wrote to memory of 1636	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	87
PID 4940 wrote to memory of 2996	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	88
PID 4940 wrote to memory of 2996	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	88
PID 4940 wrote to memory of 548	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	89
PID 4940 wrote to memory of 548	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	89
PID 4940 wrote to memory of 4544	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	90
PID 4940 wrote to memory of 4544	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	90
PID 4940 wrote to memory of 4316	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	91
PID 4940 wrote to memory of 4316	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	91
PID 4940 wrote to memory of 1872	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	92
PID 4940 wrote to memory of 1872	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	92
PID 4940 wrote to memory of 4476	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	93
PID 4940 wrote to memory of 4476	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	93
PID 4940 wrote to memory of 4328	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	94
PID 4940 wrote to memory of 4328	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	94
PID 4940 wrote to memory of 388	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	95
PID 4940 wrote to memory of 388	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	95
PID 4940 wrote to memory of 2908	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	96
PID 4940 wrote to memory of 2908	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	96
PID 4940 wrote to memory of 1260	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	97
PID 4940 wrote to memory of 1260	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	97
PID 4940 wrote to memory of 4568	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	98
PID 4940 wrote to memory of 4568	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	98
PID 4940 wrote to memory of 1300	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	99
PID 4940 wrote to memory of 1300	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	99
PID 4940 wrote to memory of 4996	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	100
PID 4940 wrote to memory of 4996	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	100
PID 4940 wrote to memory of 4084	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	101
PID 4940 wrote to memory of 4084	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	101
PID 4940 wrote to memory of 2648	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	102
PID 4940 wrote to memory of 2648	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	102
PID 4940 wrote to memory of 3616	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	103
PID 4940 wrote to memory of 3616	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	103
PID 4940 wrote to memory of 2608	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	104
PID 4940 wrote to memory of 2608	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	104
PID 4940 wrote to memory of 2192	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	105
PID 4940 wrote to memory of 2192	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	105
PID 4940 wrote to memory of 688	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	106
PID 4940 wrote to memory of 688	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	106
PID 4940 wrote to memory of 3416	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	107
PID 4940 wrote to memory of 3416	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	107
PID 4940 wrote to memory of 3584	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	108
PID 4940 wrote to memory of 3584	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	108
PID 4940 wrote to memory of 4888	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	109
PID 4940 wrote to memory of 4888	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	109
PID 4940 wrote to memory of 3904	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	110
PID 4940 wrote to memory of 3904	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	110
PID 4940 wrote to memory of 2008	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	111
PID 4940 wrote to memory of 2008	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	111
PID 4940 wrote to memory of 2856	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	112
PID 4940 wrote to memory of 2856	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	112
PID 4940 wrote to memory of 1284	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	113
PID 4940 wrote to memory of 1284	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	113
PID 4940 wrote to memory of 4644	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	114
PID 4940 wrote to memory of 4644	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	114
PID 4940 wrote to memory of 1372	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	115
PID 4940 wrote to memory of 1372	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	115
PID 4940 wrote to memory of 3260	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	116
PID 4940 wrote to memory of 3260	4940	8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8d46bfb29ddf9d5314124307e4d97ee0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\System\mAhGcDg.exe
  C:\Windows\System\mAhGcDg.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\GvtAFhK.exe
  C:\Windows\System\GvtAFhK.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\zubnjbU.exe
  C:\Windows\System\zubnjbU.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\MeRTZgO.exe
  C:\Windows\System\MeRTZgO.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\sZuJFLX.exe
  C:\Windows\System\sZuJFLX.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\ggHcuok.exe
  C:\Windows\System\ggHcuok.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\zYxRbfc.exe
  C:\Windows\System\zYxRbfc.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\JjAUbUH.exe
  C:\Windows\System\JjAUbUH.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\xuTitsS.exe
  C:\Windows\System\xuTitsS.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\ZPinXZi.exe
  C:\Windows\System\ZPinXZi.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\OXfIuGc.exe
  C:\Windows\System\OXfIuGc.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\LFSCFIB.exe
  C:\Windows\System\LFSCFIB.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\QRPFnKN.exe
  C:\Windows\System\QRPFnKN.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\SPpGPzI.exe
  C:\Windows\System\SPpGPzI.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\ayyjmCq.exe
  C:\Windows\System\ayyjmCq.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\ZdAtwLw.exe
  C:\Windows\System\ZdAtwLw.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\lsPDGLo.exe
  C:\Windows\System\lsPDGLo.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\zeUNNwJ.exe
  C:\Windows\System\zeUNNwJ.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\AiFVVWL.exe
  C:\Windows\System\AiFVVWL.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\dRRScGH.exe
  C:\Windows\System\dRRScGH.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\YfkvAOR.exe
  C:\Windows\System\YfkvAOR.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\dISHqRl.exe
  C:\Windows\System\dISHqRl.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\KDAWynd.exe
  C:\Windows\System\KDAWynd.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\ofYbgOM.exe
  C:\Windows\System\ofYbgOM.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\pkqiYHW.exe
  C:\Windows\System\pkqiYHW.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\iUqBkdE.exe
  C:\Windows\System\iUqBkdE.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\cbuefup.exe
  C:\Windows\System\cbuefup.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\oeYuePE.exe
  C:\Windows\System\oeYuePE.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\WLDFPoR.exe
  C:\Windows\System\WLDFPoR.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\svmfhPr.exe
  C:\Windows\System\svmfhPr.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\rYJYPGu.exe
  C:\Windows\System\rYJYPGu.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\NuZZVhD.exe
  C:\Windows\System\NuZZVhD.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\ChmZwwo.exe
  C:\Windows\System\ChmZwwo.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\oRkHkZE.exe
  C:\Windows\System\oRkHkZE.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\MgVIJap.exe
  C:\Windows\System\MgVIJap.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\HkOhLXf.exe
  C:\Windows\System\HkOhLXf.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\yYICYdZ.exe
  C:\Windows\System\yYICYdZ.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\TJKipSn.exe
  C:\Windows\System\TJKipSn.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\gjpTqnn.exe
  C:\Windows\System\gjpTqnn.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\gSRfRMv.exe
  C:\Windows\System\gSRfRMv.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\uekEiJO.exe
  C:\Windows\System\uekEiJO.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\XUuFYQP.exe
  C:\Windows\System\XUuFYQP.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\cKdHKaP.exe
  C:\Windows\System\cKdHKaP.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\YvKkIYS.exe
  C:\Windows\System\YvKkIYS.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\FGvljVv.exe
  C:\Windows\System\FGvljVv.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\xRsCGqb.exe
  C:\Windows\System\xRsCGqb.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\tNYUHsh.exe
  C:\Windows\System\tNYUHsh.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\qDxMmgm.exe
  C:\Windows\System\qDxMmgm.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\vuyOXjv.exe
  C:\Windows\System\vuyOXjv.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\dWTtQCE.exe
  C:\Windows\System\dWTtQCE.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\yUgNDIi.exe
  C:\Windows\System\yUgNDIi.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\fIqisQN.exe
  C:\Windows\System\fIqisQN.exe
  2⤵
  PID:5068
- C:\Windows\System\uSlYrHi.exe
  C:\Windows\System\uSlYrHi.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\pKAKtmL.exe
  C:\Windows\System\pKAKtmL.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\NUvYmYp.exe
  C:\Windows\System\NUvYmYp.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\sglABqQ.exe
  C:\Windows\System\sglABqQ.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\haMrPDw.exe
  C:\Windows\System\haMrPDw.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\XdYEkeI.exe
  C:\Windows\System\XdYEkeI.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\FKukuoE.exe
  C:\Windows\System\FKukuoE.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\xlBhbmb.exe
  C:\Windows\System\xlBhbmb.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\jqPfPsg.exe
  C:\Windows\System\jqPfPsg.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\FDfvkEe.exe
  C:\Windows\System\FDfvkEe.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\fMhOoHY.exe
  C:\Windows\System\fMhOoHY.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\GraepVu.exe
  C:\Windows\System\GraepVu.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\KJYunrz.exe
  C:\Windows\System\KJYunrz.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\jVPicFc.exe
  C:\Windows\System\jVPicFc.exe
  2⤵
  PID:4532
- C:\Windows\System\qZjaThV.exe
  C:\Windows\System\qZjaThV.exe
  2⤵
  PID:2112
- C:\Windows\System\qbNWmUl.exe
  C:\Windows\System\qbNWmUl.exe
  2⤵
  PID:804
- C:\Windows\System\UMyXvdP.exe
  C:\Windows\System\UMyXvdP.exe
  2⤵
  PID:2788
- C:\Windows\System\hJHwauv.exe
  C:\Windows\System\hJHwauv.exe
  2⤵
  PID:1812
- C:\Windows\System\XHCktdK.exe
  C:\Windows\System\XHCktdK.exe
  2⤵
  PID:3640
- C:\Windows\System\ztcgJov.exe
  C:\Windows\System\ztcgJov.exe
  2⤵
  PID:3164
- C:\Windows\System\viXTVho.exe
  C:\Windows\System\viXTVho.exe
  2⤵
  PID:5024
- C:\Windows\System\TRXLHsw.exe
  C:\Windows\System\TRXLHsw.exe
  2⤵
  PID:2052
- C:\Windows\System\qstJWZk.exe
  C:\Windows\System\qstJWZk.exe
  2⤵
  PID:4008
- C:\Windows\System\UmXUvea.exe
  C:\Windows\System\UmXUvea.exe
  2⤵
  PID:3632
- C:\Windows\System\QhQZErj.exe
  C:\Windows\System\QhQZErj.exe
  2⤵
  PID:1712
- C:\Windows\System\IeWKbdD.exe
  C:\Windows\System\IeWKbdD.exe
  2⤵
  PID:1168
- C:\Windows\System\eVKaQPJ.exe
  C:\Windows\System\eVKaQPJ.exe
  2⤵
  PID:2944
- C:\Windows\System\aQYHgKw.exe
  C:\Windows\System\aQYHgKw.exe
  2⤵
  PID:1616
- C:\Windows\System\aBxXAHl.exe
  C:\Windows\System\aBxXAHl.exe
  2⤵
  PID:5028
- C:\Windows\System\rPgIRlH.exe
  C:\Windows\System\rPgIRlH.exe
  2⤵
  PID:436
- C:\Windows\System\kmAfwze.exe
  C:\Windows\System\kmAfwze.exe
  2⤵
  PID:4416
- C:\Windows\System\ePPjHEN.exe
  C:\Windows\System\ePPjHEN.exe
  2⤵
  PID:5124
- C:\Windows\System\aVolWTr.exe
  C:\Windows\System\aVolWTr.exe
  2⤵
  PID:5140
- C:\Windows\System\vsdrUvU.exe
  C:\Windows\System\vsdrUvU.exe
  2⤵
  PID:5156
- C:\Windows\System\ERMXhCp.exe
  C:\Windows\System\ERMXhCp.exe
  2⤵
  PID:5176
- C:\Windows\System\hlxcrSb.exe
  C:\Windows\System\hlxcrSb.exe
  2⤵
  PID:5200
- C:\Windows\System\EJaFUJJ.exe
  C:\Windows\System\EJaFUJJ.exe
  2⤵
  PID:5216
- C:\Windows\System\gPkvOtW.exe
  C:\Windows\System\gPkvOtW.exe
  2⤵
  PID:5248
- C:\Windows\System\cZimNej.exe
  C:\Windows\System\cZimNej.exe
  2⤵
  PID:5280
- C:\Windows\System\JzltwKf.exe
  C:\Windows\System\JzltwKf.exe
  2⤵
  PID:5316
- C:\Windows\System\UKxapJv.exe
  C:\Windows\System\UKxapJv.exe
  2⤵
  PID:5332
- C:\Windows\System\YtutBBF.exe
  C:\Windows\System\YtutBBF.exe
  2⤵
  PID:5352
- C:\Windows\System\HKgrHrG.exe
  C:\Windows\System\HKgrHrG.exe
  2⤵
  PID:5376
- C:\Windows\System\YDRmBmL.exe
  C:\Windows\System\YDRmBmL.exe
  2⤵
  PID:5396
- C:\Windows\System\FzYkXqP.exe
  C:\Windows\System\FzYkXqP.exe
  2⤵
  PID:5424
- C:\Windows\System\JouGYID.exe
  C:\Windows\System\JouGYID.exe
  2⤵
  PID:5448
- C:\Windows\System\vUxbGXA.exe
  C:\Windows\System\vUxbGXA.exe
  2⤵
  PID:5464
- C:\Windows\System\ZRSzEUi.exe
  C:\Windows\System\ZRSzEUi.exe
  2⤵
  PID:5488
- C:\Windows\System\zaqOMHE.exe
  C:\Windows\System\zaqOMHE.exe
  2⤵
  PID:5512
- C:\Windows\System\zGiZsBG.exe
  C:\Windows\System\zGiZsBG.exe
  2⤵
  PID:5528
- C:\Windows\System\AgHfuNs.exe
  C:\Windows\System\AgHfuNs.exe
  2⤵
  PID:5552
- C:\Windows\System\miqEcaj.exe
  C:\Windows\System\miqEcaj.exe
  2⤵
  PID:5568
- C:\Windows\System\xZVPwNu.exe
  C:\Windows\System\xZVPwNu.exe
  2⤵
  PID:5592
- C:\Windows\System\PmRmuYg.exe
  C:\Windows\System\PmRmuYg.exe
  2⤵
  PID:5616
- C:\Windows\System\mOsrxlz.exe
  C:\Windows\System\mOsrxlz.exe
  2⤵
  PID:5636
- C:\Windows\System\detakaF.exe
  C:\Windows\System\detakaF.exe
  2⤵
  PID:5652
- C:\Windows\System\EHUQNsC.exe
  C:\Windows\System\EHUQNsC.exe
  2⤵
  PID:5788
- C:\Windows\System\gOOPHXh.exe
  C:\Windows\System\gOOPHXh.exe
  2⤵
  PID:5808
- C:\Windows\System\cortsWH.exe
  C:\Windows\System\cortsWH.exe
  2⤵
  PID:5824
- C:\Windows\System\dQnrAzO.exe
  C:\Windows\System\dQnrAzO.exe
  2⤵
  PID:5848
- C:\Windows\System\STLyZgM.exe
  C:\Windows\System\STLyZgM.exe
  2⤵
  PID:5872
- C:\Windows\System\RJmRRxX.exe
  C:\Windows\System\RJmRRxX.exe
  2⤵
  PID:5896
- C:\Windows\System\GRLDzPa.exe
  C:\Windows\System\GRLDzPa.exe
  2⤵
  PID:5936
- C:\Windows\System\mWjaKwL.exe
  C:\Windows\System\mWjaKwL.exe
  2⤵
  PID:5960
- C:\Windows\System\BrHwDQY.exe
  C:\Windows\System\BrHwDQY.exe
  2⤵
  PID:5984
- C:\Windows\System\ZjGpXwr.exe
  C:\Windows\System\ZjGpXwr.exe
  2⤵
  PID:6004
- C:\Windows\System\fhkKOWr.exe
  C:\Windows\System\fhkKOWr.exe
  2⤵
  PID:6020
- C:\Windows\System\sYyJNsh.exe
  C:\Windows\System\sYyJNsh.exe
  2⤵
  PID:6044
- C:\Windows\System\xEteFky.exe
  C:\Windows\System\xEteFky.exe
  2⤵
  PID:6072
- C:\Windows\System\rPEckaC.exe
  C:\Windows\System\rPEckaC.exe
  2⤵
  PID:6100
- C:\Windows\System\DfrFSQx.exe
  C:\Windows\System\DfrFSQx.exe
  2⤵
  PID:6124
- C:\Windows\System\zQHlfRT.exe
  C:\Windows\System\zQHlfRT.exe
  2⤵
  PID:6140
- C:\Windows\System\RfBghMq.exe
  C:\Windows\System\RfBghMq.exe
  2⤵
  PID:2168
- C:\Windows\System\tQApyta.exe
  C:\Windows\System\tQApyta.exe
  2⤵
  PID:384
- C:\Windows\System\yanbIRo.exe
  C:\Windows\System\yanbIRo.exe
  2⤵
  PID:3692
- C:\Windows\System\XQoNcmU.exe
  C:\Windows\System\XQoNcmU.exe
  2⤵
  PID:2224
- C:\Windows\System\UgCIGSb.exe
  C:\Windows\System\UgCIGSb.exe
  2⤵
  PID:3472
- C:\Windows\System\gZBZkml.exe
  C:\Windows\System\gZBZkml.exe
  2⤵
  PID:2348
- C:\Windows\System\dLXgwQh.exe
  C:\Windows\System\dLXgwQh.exe
  2⤵
  PID:4956
- C:\Windows\System\uhYTHDb.exe
  C:\Windows\System\uhYTHDb.exe
  2⤵
  PID:1140
- C:\Windows\System\zVCplfx.exe
  C:\Windows\System\zVCplfx.exe
  2⤵
  PID:2876
- C:\Windows\System\IymppaJ.exe
  C:\Windows\System\IymppaJ.exe
  2⤵
  PID:2148
- C:\Windows\System\MOJNTWF.exe
  C:\Windows\System\MOJNTWF.exe
  2⤵
  PID:4352
- C:\Windows\System\ZuFZUJt.exe
  C:\Windows\System\ZuFZUJt.exe
  2⤵
  PID:3660
- C:\Windows\System\vaqeRhO.exe
  C:\Windows\System\vaqeRhO.exe
  2⤵
  PID:884
- C:\Windows\System\dCczrQI.exe
  C:\Windows\System\dCczrQI.exe
  2⤵
  PID:1252
- C:\Windows\System\CnnfnAP.exe
  C:\Windows\System\CnnfnAP.exe
  2⤵
  PID:372
- C:\Windows\System\dDDrdju.exe
  C:\Windows\System\dDDrdju.exe
  2⤵
  PID:2388
- C:\Windows\System\OMxACQz.exe
  C:\Windows\System\OMxACQz.exe
  2⤵
  PID:2356
- C:\Windows\System\TJEQmIr.exe
  C:\Windows\System\TJEQmIr.exe
  2⤵
  PID:5008
- C:\Windows\System\HkMZxKQ.exe
  C:\Windows\System\HkMZxKQ.exe
  2⤵
  PID:3568
- C:\Windows\System\mBgkpYP.exe
  C:\Windows\System\mBgkpYP.exe
  2⤵
  PID:376
- C:\Windows\System\zKhmGiZ.exe
  C:\Windows\System\zKhmGiZ.exe
  2⤵
  PID:6164
- C:\Windows\System\ufnUTmP.exe
  C:\Windows\System\ufnUTmP.exe
  2⤵
  PID:6184
- C:\Windows\System\URLAlcj.exe
  C:\Windows\System\URLAlcj.exe
  2⤵
  PID:6220
- C:\Windows\System\wGKLoQr.exe
  C:\Windows\System\wGKLoQr.exe
  2⤵
  PID:6236
- C:\Windows\System\jhUrVIY.exe
  C:\Windows\System\jhUrVIY.exe
  2⤵
  PID:6252
- C:\Windows\System\ONjhefs.exe
  C:\Windows\System\ONjhefs.exe
  2⤵
  PID:6268
- C:\Windows\System\qkfpvnW.exe
  C:\Windows\System\qkfpvnW.exe
  2⤵
  PID:6284
- C:\Windows\System\RZzaHON.exe
  C:\Windows\System\RZzaHON.exe
  2⤵
  PID:6300
- C:\Windows\System\lpMNbVZ.exe
  C:\Windows\System\lpMNbVZ.exe
  2⤵
  PID:6320
- C:\Windows\System\qFvotSv.exe
  C:\Windows\System\qFvotSv.exe
  2⤵
  PID:6340
- C:\Windows\System\MJeFFKy.exe
  C:\Windows\System\MJeFFKy.exe
  2⤵
  PID:6376
- C:\Windows\System\wwkKVfx.exe
  C:\Windows\System\wwkKVfx.exe
  2⤵
  PID:6396
- C:\Windows\System\WpfjYjq.exe
  C:\Windows\System\WpfjYjq.exe
  2⤵
  PID:6412
- C:\Windows\System\BUwXYGG.exe
  C:\Windows\System\BUwXYGG.exe
  2⤵
  PID:6436
- C:\Windows\System\cpkLLBa.exe
  C:\Windows\System\cpkLLBa.exe
  2⤵
  PID:6452
- C:\Windows\System\KfaTiQg.exe
  C:\Windows\System\KfaTiQg.exe
  2⤵
  PID:6480
- C:\Windows\System\lCVkOaf.exe
  C:\Windows\System\lCVkOaf.exe
  2⤵
  PID:6496
- C:\Windows\System\pZIQZHJ.exe
  C:\Windows\System\pZIQZHJ.exe
  2⤵
  PID:6512
- C:\Windows\System\CvVFHgd.exe
  C:\Windows\System\CvVFHgd.exe
  2⤵
  PID:6528
- C:\Windows\System\bbUrMct.exe
  C:\Windows\System\bbUrMct.exe
  2⤵
  PID:6552
- C:\Windows\System\MOxuKBB.exe
  C:\Windows\System\MOxuKBB.exe
  2⤵
  PID:6568
- C:\Windows\System\EgLdDWw.exe
  C:\Windows\System\EgLdDWw.exe
  2⤵
  PID:6592
- C:\Windows\System\KJQlWxR.exe
  C:\Windows\System\KJQlWxR.exe
  2⤵
  PID:6612
- C:\Windows\System\rAiUrFa.exe
  C:\Windows\System\rAiUrFa.exe
  2⤵
  PID:6632
- C:\Windows\System\xfZiNwi.exe
  C:\Windows\System\xfZiNwi.exe
  2⤵
  PID:6656
- C:\Windows\System\eSzcKUX.exe
  C:\Windows\System\eSzcKUX.exe
  2⤵
  PID:6672
- C:\Windows\System\TVUxolh.exe
  C:\Windows\System\TVUxolh.exe
  2⤵
  PID:6688
- C:\Windows\System\XeVCTaf.exe
  C:\Windows\System\XeVCTaf.exe
  2⤵
  PID:6716
- C:\Windows\System\aPlIHYH.exe
  C:\Windows\System\aPlIHYH.exe
  2⤵
  PID:6732
- C:\Windows\System\IjtBcWX.exe
  C:\Windows\System\IjtBcWX.exe
  2⤵
  PID:6764
- C:\Windows\System\HMNrtXa.exe
  C:\Windows\System\HMNrtXa.exe
  2⤵
  PID:6784
- C:\Windows\System\HVeZjGM.exe
  C:\Windows\System\HVeZjGM.exe
  2⤵
  PID:6800
- C:\Windows\System\GZufCMJ.exe
  C:\Windows\System\GZufCMJ.exe
  2⤵
  PID:6820
- C:\Windows\System\cKGQnoY.exe
  C:\Windows\System\cKGQnoY.exe
  2⤵
  PID:6836
- C:\Windows\System\KqikoiR.exe
  C:\Windows\System\KqikoiR.exe
  2⤵
  PID:6860
- C:\Windows\System\bZRgXZR.exe
  C:\Windows\System\bZRgXZR.exe
  2⤵
  PID:6876
- C:\Windows\System\LSyTlZD.exe
  C:\Windows\System\LSyTlZD.exe
  2⤵
  PID:6900
- C:\Windows\System\HsnulyK.exe
  C:\Windows\System\HsnulyK.exe
  2⤵
  PID:6920
- C:\Windows\System\yrUdOXm.exe
  C:\Windows\System\yrUdOXm.exe
  2⤵
  PID:6944
- C:\Windows\System\kCQuGgH.exe
  C:\Windows\System\kCQuGgH.exe
  2⤵
  PID:6960
- C:\Windows\System\arYDegM.exe
  C:\Windows\System\arYDegM.exe
  2⤵
  PID:6992
- C:\Windows\System\tQhQlkG.exe
  C:\Windows\System\tQhQlkG.exe
  2⤵
  PID:7016
- C:\Windows\System\guVOYpX.exe
  C:\Windows\System\guVOYpX.exe
  2⤵
  PID:7036
- C:\Windows\System\GEvauec.exe
  C:\Windows\System\GEvauec.exe
  2⤵
  PID:7060
- C:\Windows\System\erLkBML.exe
  C:\Windows\System\erLkBML.exe
  2⤵
  PID:7076
- C:\Windows\System\vNoNixi.exe
  C:\Windows\System\vNoNixi.exe
  2⤵
  PID:7104
- C:\Windows\System\yVPmgxE.exe
  C:\Windows\System\yVPmgxE.exe
  2⤵
  PID:7120
- C:\Windows\System\SHuvPBV.exe
  C:\Windows\System\SHuvPBV.exe
  2⤵
  PID:7144
- C:\Windows\System\qDxYPAT.exe
  C:\Windows\System\qDxYPAT.exe
  2⤵
  PID:7164
- C:\Windows\System\jgIryoU.exe
  C:\Windows\System\jgIryoU.exe
  2⤵
  PID:5864
- C:\Windows\System\EHPSrkn.exe
  C:\Windows\System\EHPSrkn.exe
  2⤵
  PID:5212
- C:\Windows\System\obtibhS.exe
  C:\Windows\System\obtibhS.exe
  2⤵
  PID:5136
- C:\Windows\System\lhSWlyK.exe
  C:\Windows\System\lhSWlyK.exe
  2⤵
  PID:1448
- C:\Windows\System\QgnwLRY.exe
  C:\Windows\System\QgnwLRY.exe
  2⤵
  PID:6056
- C:\Windows\System\iVmHdVM.exe
  C:\Windows\System\iVmHdVM.exe
  2⤵
  PID:6116
- C:\Windows\System\yqJQsSJ.exe
  C:\Windows\System\yqJQsSJ.exe
  2⤵
  PID:3456
- C:\Windows\System\PIqrwrY.exe
  C:\Windows\System\PIqrwrY.exe
  2⤵
  PID:4492
- C:\Windows\System\tiMGlgy.exe
  C:\Windows\System\tiMGlgy.exe
  2⤵
  PID:5560
- C:\Windows\System\pRBzZMA.exe
  C:\Windows\System\pRBzZMA.exe
  2⤵
  PID:5524
- C:\Windows\System\oZMYaLX.exe
  C:\Windows\System\oZMYaLX.exe
  2⤵
  PID:5496
- C:\Windows\System\IJGzkvd.exe
  C:\Windows\System\IJGzkvd.exe
  2⤵
  PID:5460
- C:\Windows\System\UAZjtXv.exe
  C:\Windows\System\UAZjtXv.exe
  2⤵
  PID:5432
- C:\Windows\System\JodvBYf.exe
  C:\Windows\System\JodvBYf.exe
  2⤵
  PID:5384
- C:\Windows\System\qBYoTYo.exe
  C:\Windows\System\qBYoTYo.exe
  2⤵
  PID:5680
- C:\Windows\System\iUnuKLa.exe
  C:\Windows\System\iUnuKLa.exe
  2⤵
  PID:5796
- C:\Windows\System\RamrpMB.exe
  C:\Windows\System\RamrpMB.exe
  2⤵
  PID:5832
- C:\Windows\System\DnGRCWr.exe
  C:\Windows\System\DnGRCWr.exe
  2⤵
  PID:6608
- C:\Windows\System\IBcMhrc.exe
  C:\Windows\System\IBcMhrc.exe
  2⤵
  PID:6772
- C:\Windows\System\TQYgeWa.exe
  C:\Windows\System\TQYgeWa.exe
  2⤵
  PID:6916
- C:\Windows\System\uPmoHhn.exe
  C:\Windows\System\uPmoHhn.exe
  2⤵
  PID:832
- C:\Windows\System\RQAFoPr.exe
  C:\Windows\System\RQAFoPr.exe
  2⤵
  PID:5188
- C:\Windows\System\BpZWZAI.exe
  C:\Windows\System\BpZWZAI.exe
  2⤵
  PID:2448
- C:\Windows\System\qTAbqAO.exe
  C:\Windows\System\qTAbqAO.exe
  2⤵
  PID:1064
- C:\Windows\System\mZCKRnW.exe
  C:\Windows\System\mZCKRnW.exe
  2⤵
  PID:6180
- C:\Windows\System\yoCYpPb.exe
  C:\Windows\System\yoCYpPb.exe
  2⤵
  PID:6276
- C:\Windows\System\oLpEpwA.exe
  C:\Windows\System\oLpEpwA.exe
  2⤵
  PID:6504
- C:\Windows\System\yxZXgRU.exe
  C:\Windows\System\yxZXgRU.exe
  2⤵
  PID:6548
- C:\Windows\System\rAMgiBM.exe
  C:\Windows\System\rAMgiBM.exe
  2⤵
  PID:6624
- C:\Windows\System\HYvRKrK.exe
  C:\Windows\System\HYvRKrK.exe
  2⤵
  PID:3188
- C:\Windows\System\bBifgzL.exe
  C:\Windows\System\bBifgzL.exe
  2⤵
  PID:3908
- C:\Windows\System\ydLnrJH.exe
  C:\Windows\System\ydLnrJH.exe
  2⤵
  PID:4916
- C:\Windows\System\webmDrF.exe
  C:\Windows\System\webmDrF.exe
  2⤵
  PID:5996
- C:\Windows\System\rhSfKCQ.exe
  C:\Windows\System\rhSfKCQ.exe
  2⤵
  PID:6192
- C:\Windows\System\fdEwgrj.exe
  C:\Windows\System\fdEwgrj.exe
  2⤵
  PID:6332
- C:\Windows\System\HyTKEQM.exe
  C:\Windows\System\HyTKEQM.exe
  2⤵
  PID:7184
- C:\Windows\System\XHHvVfP.exe
  C:\Windows\System\XHHvVfP.exe
  2⤵
  PID:7200
- C:\Windows\System\NLykEXl.exe
  C:\Windows\System\NLykEXl.exe
  2⤵
  PID:7216
- C:\Windows\System\zNPLYYf.exe
  C:\Windows\System\zNPLYYf.exe
  2⤵
  PID:7236
- C:\Windows\System\SfvcNZO.exe
  C:\Windows\System\SfvcNZO.exe
  2⤵
  PID:7252
- C:\Windows\System\oZaxCEp.exe
  C:\Windows\System\oZaxCEp.exe
  2⤵
  PID:7268
- C:\Windows\System\XfEUlpB.exe
  C:\Windows\System\XfEUlpB.exe
  2⤵
  PID:7284
- C:\Windows\System\SaUYZli.exe
  C:\Windows\System\SaUYZli.exe
  2⤵
  PID:7312
- C:\Windows\System\gdqbqkK.exe
  C:\Windows\System\gdqbqkK.exe
  2⤵
  PID:7344
- C:\Windows\System\dpzRkEF.exe
  C:\Windows\System\dpzRkEF.exe
  2⤵
  PID:7368
- C:\Windows\System\QEYoFuV.exe
  C:\Windows\System\QEYoFuV.exe
  2⤵
  PID:7404
- C:\Windows\System\cAAcsaM.exe
  C:\Windows\System\cAAcsaM.exe
  2⤵
  PID:7424
- C:\Windows\System\zMneany.exe
  C:\Windows\System\zMneany.exe
  2⤵
  PID:7444
- C:\Windows\System\tuhbyQj.exe
  C:\Windows\System\tuhbyQj.exe
  2⤵
  PID:7472
- C:\Windows\System\sBNhaeN.exe
  C:\Windows\System\sBNhaeN.exe
  2⤵
  PID:7488
- C:\Windows\System\ttysbOC.exe
  C:\Windows\System\ttysbOC.exe
  2⤵
  PID:7508
- C:\Windows\System\NIsWUUF.exe
  C:\Windows\System\NIsWUUF.exe
  2⤵
  PID:7528
- C:\Windows\System\FRZYhiy.exe
  C:\Windows\System\FRZYhiy.exe
  2⤵
  PID:7552
- C:\Windows\System\qtqBQmF.exe
  C:\Windows\System\qtqBQmF.exe
  2⤵
  PID:7584
- C:\Windows\System\jyZKEHk.exe
  C:\Windows\System\jyZKEHk.exe
  2⤵
  PID:7612
- C:\Windows\System\dXheqee.exe
  C:\Windows\System\dXheqee.exe
  2⤵
  PID:7632
- C:\Windows\System\vIafANb.exe
  C:\Windows\System\vIafANb.exe
  2⤵
  PID:7648
- C:\Windows\System\oNHSPiL.exe
  C:\Windows\System\oNHSPiL.exe
  2⤵
  PID:7664
- C:\Windows\System\SkpmAJM.exe
  C:\Windows\System\SkpmAJM.exe
  2⤵
  PID:7688
- C:\Windows\System\iFtIpwK.exe
  C:\Windows\System\iFtIpwK.exe
  2⤵
  PID:7736
- C:\Windows\System\lnBSiXG.exe
  C:\Windows\System\lnBSiXG.exe
  2⤵
  PID:7760
- C:\Windows\System\bdFjKsQ.exe
  C:\Windows\System\bdFjKsQ.exe
  2⤵
  PID:7776
- C:\Windows\System\JNheIok.exe
  C:\Windows\System\JNheIok.exe
  2⤵
  PID:7792
- C:\Windows\System\WezdUIv.exe
  C:\Windows\System\WezdUIv.exe
  2⤵
  PID:7812
- C:\Windows\System\mOmJMeV.exe
  C:\Windows\System\mOmJMeV.exe
  2⤵
  PID:7828
- C:\Windows\System\FRkcKoX.exe
  C:\Windows\System\FRkcKoX.exe
  2⤵
  PID:7852
- C:\Windows\System\uGceuVF.exe
  C:\Windows\System\uGceuVF.exe
  2⤵
  PID:7868
- C:\Windows\System\mYjweBM.exe
  C:\Windows\System\mYjweBM.exe
  2⤵
  PID:7892
- C:\Windows\System\JrGVIHf.exe
  C:\Windows\System\JrGVIHf.exe
  2⤵
  PID:7908
- C:\Windows\System\CCaUVry.exe
  C:\Windows\System\CCaUVry.exe
  2⤵
  PID:7932
- C:\Windows\System\ZoSIKIz.exe
  C:\Windows\System\ZoSIKIz.exe
  2⤵
  PID:7956
- C:\Windows\System\YWxZGcW.exe
  C:\Windows\System\YWxZGcW.exe
  2⤵
  PID:7972
- C:\Windows\System\FUBxgtf.exe
  C:\Windows\System\FUBxgtf.exe
  2⤵
  PID:7996
- C:\Windows\System\bGHwscb.exe
  C:\Windows\System\bGHwscb.exe
  2⤵
  PID:8016
- C:\Windows\System\HYkmBdg.exe
  C:\Windows\System\HYkmBdg.exe
  2⤵
  PID:8036
- C:\Windows\System\pErCEVh.exe
  C:\Windows\System\pErCEVh.exe
  2⤵
  PID:8056
- C:\Windows\System\WYcvmgH.exe
  C:\Windows\System\WYcvmgH.exe
  2⤵
  PID:8076
- C:\Windows\System\oRnOMcS.exe
  C:\Windows\System\oRnOMcS.exe
  2⤵
  PID:8104
- C:\Windows\System\UrNouUP.exe
  C:\Windows\System\UrNouUP.exe
  2⤵
  PID:8128
- C:\Windows\System\yTfreXf.exe
  C:\Windows\System\yTfreXf.exe
  2⤵
  PID:8144
- C:\Windows\System\SXqxRqe.exe
  C:\Windows\System\SXqxRqe.exe
  2⤵
  PID:8168
- C:\Windows\System\xIWKxUY.exe
  C:\Windows\System\xIWKxUY.exe
  2⤵
  PID:8184
- C:\Windows\System\cdzqVxS.exe
  C:\Windows\System\cdzqVxS.exe
  2⤵
  PID:6444
- C:\Windows\System\uRxhrFn.exe
  C:\Windows\System\uRxhrFn.exe
  2⤵
  PID:6492
- C:\Windows\System\jpvBPqv.exe
  C:\Windows\System\jpvBPqv.exe
  2⤵
  PID:6628
- C:\Windows\System\SNvirFY.exe
  C:\Windows\System\SNvirFY.exe
  2⤵
  PID:6696
- C:\Windows\System\nTSnjyi.exe
  C:\Windows\System\nTSnjyi.exe
  2⤵
  PID:6780
- C:\Windows\System\lZLzgBm.exe
  C:\Windows\System\lZLzgBm.exe
  2⤵
  PID:6852
- C:\Windows\System\uAZOWCL.exe
  C:\Windows\System\uAZOWCL.exe
  2⤵
  PID:6088
- C:\Windows\System\ElOSHVL.exe
  C:\Windows\System\ElOSHVL.exe
  2⤵
  PID:6972
- C:\Windows\System\xlosBrC.exe
  C:\Windows\System\xlosBrC.exe
  2⤵
  PID:5860
- C:\Windows\System\uNPPJwo.exe
  C:\Windows\System\uNPPJwo.exe
  2⤵
  PID:1900
- C:\Windows\System\KsnunfS.exe
  C:\Windows\System\KsnunfS.exe
  2⤵
  PID:4436
- C:\Windows\System\yUgMojm.exe
  C:\Windows\System\yUgMojm.exe
  2⤵
  PID:6232
- C:\Windows\System\zWSHYeJ.exe
  C:\Windows\System\zWSHYeJ.exe
  2⤵
  PID:6356
- C:\Windows\System\oZMHPmv.exe
  C:\Windows\System\oZMHPmv.exe
  2⤵
  PID:6828
- C:\Windows\System\OVWzWgz.exe
  C:\Windows\System\OVWzWgz.exe
  2⤵
  PID:7048
- C:\Windows\System\wVmZSkN.exe
  C:\Windows\System\wVmZSkN.exe
  2⤵
  PID:7096
- C:\Windows\System\AASrHxy.exe
  C:\Windows\System\AASrHxy.exe
  2⤵
  PID:5232
- C:\Windows\System\ewpEoQh.exe
  C:\Windows\System\ewpEoQh.exe
  2⤵
  PID:4232
- C:\Windows\System\qeRKBtW.exe
  C:\Windows\System\qeRKBtW.exe
  2⤵
  PID:8196
- C:\Windows\System\tqadCpG.exe
  C:\Windows\System\tqadCpG.exe
  2⤵
  PID:8216
- C:\Windows\System\vAvOWQv.exe
  C:\Windows\System\vAvOWQv.exe
  2⤵
  PID:8236
- C:\Windows\System\QbGnVNb.exe
  C:\Windows\System\QbGnVNb.exe
  2⤵
  PID:8252
- C:\Windows\System\VLhirew.exe
  C:\Windows\System\VLhirew.exe
  2⤵
  PID:8284
- C:\Windows\System\bLsKzWL.exe
  C:\Windows\System\bLsKzWL.exe
  2⤵
  PID:8312
- C:\Windows\System\mnpzKTw.exe
  C:\Windows\System\mnpzKTw.exe
  2⤵
  PID:8332
- C:\Windows\System\kujijVr.exe
  C:\Windows\System\kujijVr.exe
  2⤵
  PID:8352
- C:\Windows\System\vvXqXsH.exe
  C:\Windows\System\vvXqXsH.exe
  2⤵
  PID:8372
- C:\Windows\System\qdKFQjV.exe
  C:\Windows\System\qdKFQjV.exe
  2⤵
  PID:8392
- C:\Windows\System\bSTmiqS.exe
  C:\Windows\System\bSTmiqS.exe
  2⤵
  PID:8416
- C:\Windows\System\OjbyNIT.exe
  C:\Windows\System\OjbyNIT.exe
  2⤵
  PID:8432
- C:\Windows\System\yRxlyRp.exe
  C:\Windows\System\yRxlyRp.exe
  2⤵
  PID:8456
- C:\Windows\System\SnwpqrE.exe
  C:\Windows\System\SnwpqrE.exe
  2⤵
  PID:8484
- C:\Windows\System\UFgOLho.exe
  C:\Windows\System\UFgOLho.exe
  2⤵
  PID:8504
- C:\Windows\System\qBjBgSt.exe
  C:\Windows\System\qBjBgSt.exe
  2⤵
  PID:8524
- C:\Windows\System\pMZUdga.exe
  C:\Windows\System\pMZUdga.exe
  2⤵
  PID:8548
- C:\Windows\System\vIKEuIU.exe
  C:\Windows\System\vIKEuIU.exe
  2⤵
  PID:8572
- C:\Windows\System\hhPjjHX.exe
  C:\Windows\System\hhPjjHX.exe
  2⤵
  PID:8592
- C:\Windows\System\YMpquLE.exe
  C:\Windows\System\YMpquLE.exe
  2⤵
  PID:8608
- C:\Windows\System\JanpQwf.exe
  C:\Windows\System\JanpQwf.exe
  2⤵
  PID:8632
- C:\Windows\System\npdeYUi.exe
  C:\Windows\System\npdeYUi.exe
  2⤵
  PID:8656
- C:\Windows\System\UpVelAZ.exe
  C:\Windows\System\UpVelAZ.exe
  2⤵
  PID:8680
- C:\Windows\System\elzPDhz.exe
  C:\Windows\System\elzPDhz.exe
  2⤵
  PID:8704
- C:\Windows\System\tmhhVQO.exe
  C:\Windows\System\tmhhVQO.exe
  2⤵
  PID:8720
- C:\Windows\System\RhdRkhY.exe
  C:\Windows\System\RhdRkhY.exe
  2⤵
  PID:8740
- C:\Windows\System\OVPziPc.exe
  C:\Windows\System\OVPziPc.exe
  2⤵
  PID:8756
- C:\Windows\System\qWHgMzP.exe
  C:\Windows\System\qWHgMzP.exe
  2⤵
  PID:8780
- C:\Windows\System\sOJmsdE.exe
  C:\Windows\System\sOJmsdE.exe
  2⤵
  PID:8796
- C:\Windows\System\FvkNPcJ.exe
  C:\Windows\System\FvkNPcJ.exe
  2⤵
  PID:8820
- C:\Windows\System\VZhcFAo.exe
  C:\Windows\System\VZhcFAo.exe
  2⤵
  PID:8844
- C:\Windows\System\rxXEhtk.exe
  C:\Windows\System\rxXEhtk.exe
  2⤵
  PID:8864
- C:\Windows\System\jLPPBHN.exe
  C:\Windows\System\jLPPBHN.exe
  2⤵
  PID:8884
- C:\Windows\System\WTYFMop.exe
  C:\Windows\System\WTYFMop.exe
  2⤵
  PID:8904
- C:\Windows\System\UJrrMyH.exe
  C:\Windows\System\UJrrMyH.exe
  2⤵
  PID:8928
- C:\Windows\System\jgGtLTY.exe
  C:\Windows\System\jgGtLTY.exe
  2⤵
  PID:8948
- C:\Windows\System\cByTYzd.exe
  C:\Windows\System\cByTYzd.exe
  2⤵
  PID:8968
- C:\Windows\System\UqhspJQ.exe
  C:\Windows\System\UqhspJQ.exe
  2⤵
  PID:8996
- C:\Windows\System\MHKrQGg.exe
  C:\Windows\System\MHKrQGg.exe
  2⤵
  PID:9016
- C:\Windows\System\prkNptY.exe
  C:\Windows\System\prkNptY.exe
  2⤵
  PID:9040
- C:\Windows\System\RBBiLID.exe
  C:\Windows\System\RBBiLID.exe
  2⤵
  PID:9056
- C:\Windows\System\leErDrt.exe
  C:\Windows\System\leErDrt.exe
  2⤵
  PID:9084
- C:\Windows\System\iEhcyVx.exe
  C:\Windows\System\iEhcyVx.exe
  2⤵
  PID:9104
- C:\Windows\System\bnGLkVk.exe
  C:\Windows\System\bnGLkVk.exe
  2⤵
  PID:9128
- C:\Windows\System\eXiLKNo.exe
  C:\Windows\System\eXiLKNo.exe
  2⤵
  PID:9152
- C:\Windows\System\qLNWhnc.exe
  C:\Windows\System\qLNWhnc.exe
  2⤵
  PID:9188
- C:\Windows\System\KOBuwex.exe
  C:\Windows\System\KOBuwex.exe
  2⤵
  PID:7756
- C:\Windows\System\YBNmZkS.exe
  C:\Windows\System\YBNmZkS.exe
  2⤵
  PID:7884
- C:\Windows\System\pTLQeun.exe
  C:\Windows\System\pTLQeun.exe
  2⤵
  PID:7944
- C:\Windows\System\sqQxvfh.exe
  C:\Windows\System\sqQxvfh.exe
  2⤵
  PID:7992
- C:\Windows\System\FrMHjkS.exe
  C:\Windows\System\FrMHjkS.exe
  2⤵
  PID:8044
- C:\Windows\System\BsTwddS.exe
  C:\Windows\System\BsTwddS.exe
  2⤵
  PID:8116
- C:\Windows\System\kKofgVa.exe
  C:\Windows\System\kKofgVa.exe
  2⤵
  PID:6564
- C:\Windows\System\BlykWXR.exe
  C:\Windows\System\BlykWXR.exe
  2⤵
  PID:7136
- C:\Windows\System\DRtJcop.exe
  C:\Windows\System\DRtJcop.exe
  2⤵
  PID:5932
- C:\Windows\System\RPtqXQO.exe
  C:\Windows\System\RPtqXQO.exe
  2⤵
  PID:6216
- C:\Windows\System\SZvKTzN.exe
  C:\Windows\System\SZvKTzN.exe
  2⤵
  PID:9240
- C:\Windows\System\vYfZWam.exe
  C:\Windows\System\vYfZWam.exe
  2⤵
  PID:9256
- C:\Windows\System\TirbIah.exe
  C:\Windows\System\TirbIah.exe
  2⤵
  PID:9276
- C:\Windows\System\wqzJPGT.exe
  C:\Windows\System\wqzJPGT.exe
  2⤵
  PID:9296
- C:\Windows\System\nuYEyVX.exe
  C:\Windows\System\nuYEyVX.exe
  2⤵
  PID:9312
- C:\Windows\System\YLeyXQQ.exe
  C:\Windows\System\YLeyXQQ.exe
  2⤵
  PID:9336
- C:\Windows\System\CEuoclC.exe
  C:\Windows\System\CEuoclC.exe
  2⤵
  PID:9364
- C:\Windows\System\swwbJcl.exe
  C:\Windows\System\swwbJcl.exe
  2⤵
  PID:9384
- C:\Windows\System\fyhYtHB.exe
  C:\Windows\System\fyhYtHB.exe
  2⤵
  PID:9408
- C:\Windows\System\ShlInMr.exe
  C:\Windows\System\ShlInMr.exe
  2⤵
  PID:9432
- C:\Windows\System\tnEBgdQ.exe
  C:\Windows\System\tnEBgdQ.exe
  2⤵
  PID:9448
- C:\Windows\System\PwsbPIv.exe
  C:\Windows\System\PwsbPIv.exe
  2⤵
  PID:9472
- C:\Windows\System\WXYyaUS.exe
  C:\Windows\System\WXYyaUS.exe
  2⤵
  PID:9492
- C:\Windows\System\RyFECfX.exe
  C:\Windows\System\RyFECfX.exe
  2⤵
  PID:9516
- C:\Windows\System\sszMjPT.exe
  C:\Windows\System\sszMjPT.exe
  2⤵
  PID:9536
- C:\Windows\System\sCpgsrv.exe
  C:\Windows\System\sCpgsrv.exe
  2⤵
  PID:9556
- C:\Windows\System\rqSVpfp.exe
  C:\Windows\System\rqSVpfp.exe
  2⤵
  PID:9576
- C:\Windows\System\tzhBKkw.exe
  C:\Windows\System\tzhBKkw.exe
  2⤵
  PID:9600
- C:\Windows\System\HCFrAzT.exe
  C:\Windows\System\HCFrAzT.exe
  2⤵
  PID:9616
- C:\Windows\System\FuooTgQ.exe
  C:\Windows\System\FuooTgQ.exe
  2⤵
  PID:9644
- C:\Windows\System\eehHomo.exe
  C:\Windows\System\eehHomo.exe
  2⤵
  PID:9760
- C:\Windows\System\qDERSct.exe
  C:\Windows\System\qDERSct.exe
  2⤵
  PID:9780
- C:\Windows\System\BSBRNvL.exe
  C:\Windows\System\BSBRNvL.exe
  2⤵
  PID:9804
- C:\Windows\System\hMxEtCT.exe
  C:\Windows\System\hMxEtCT.exe
  2⤵
  PID:9820
- C:\Windows\System\CrIaclu.exe
  C:\Windows\System\CrIaclu.exe
  2⤵
  PID:9844
- C:\Windows\System\RPsAKZX.exe
  C:\Windows\System\RPsAKZX.exe
  2⤵
  PID:9868
- C:\Windows\System\WXhGnID.exe
  C:\Windows\System\WXhGnID.exe
  2⤵
  PID:9892
- C:\Windows\System\JpSlkSP.exe
  C:\Windows\System\JpSlkSP.exe
  2⤵
  PID:9912
- C:\Windows\System\lfMjojF.exe
  C:\Windows\System\lfMjojF.exe
  2⤵
  PID:9936
- C:\Windows\System\RdcGxrz.exe
  C:\Windows\System\RdcGxrz.exe
  2⤵
  PID:9960
- C:\Windows\System\CzodZRu.exe
  C:\Windows\System\CzodZRu.exe
  2⤵
  PID:9976
- C:\Windows\System\MFFDmna.exe
  C:\Windows\System\MFFDmna.exe
  2⤵
  PID:10000
- C:\Windows\System\ZlaBbcO.exe
  C:\Windows\System\ZlaBbcO.exe
  2⤵
  PID:10020
- C:\Windows\System\EGHBxlM.exe
  C:\Windows\System\EGHBxlM.exe
  2⤵
  PID:10044
- C:\Windows\System\TYKVloH.exe
  C:\Windows\System\TYKVloH.exe
  2⤵
  PID:10068
- C:\Windows\System\EPRRngX.exe
  C:\Windows\System\EPRRngX.exe
  2⤵
  PID:10084
- C:\Windows\System\xxojYoJ.exe
  C:\Windows\System\xxojYoJ.exe
  2⤵
  PID:10108
- C:\Windows\System\pfluAml.exe
  C:\Windows\System\pfluAml.exe
  2⤵
  PID:10136
- C:\Windows\System\aRVHihH.exe
  C:\Windows\System\aRVHihH.exe
  2⤵
  PID:10156
- C:\Windows\System\GlYVwOT.exe
  C:\Windows\System\GlYVwOT.exe
  2⤵
  PID:10180
- C:\Windows\System\aPqDgyN.exe
  C:\Windows\System\aPqDgyN.exe
  2⤵
  PID:10196
- C:\Windows\System\wcrlqLs.exe
  C:\Windows\System\wcrlqLs.exe
  2⤵
  PID:10216
- C:\Windows\System\mNkGzdh.exe
  C:\Windows\System\mNkGzdh.exe
  2⤵
  PID:6724
- C:\Windows\System\zbZyjVj.exe
  C:\Windows\System\zbZyjVj.exe
  2⤵
  PID:7092
- C:\Windows\System\CgXNlle.exe
  C:\Windows\System\CgXNlle.exe
  2⤵
  PID:6740
- C:\Windows\System\wovjmTs.exe
  C:\Windows\System\wovjmTs.exe
  2⤵
  PID:7128
- C:\Windows\System\CfOxKKZ.exe
  C:\Windows\System\CfOxKKZ.exe
  2⤵
  PID:632
- C:\Windows\System\AomHbtw.exe
  C:\Windows\System\AomHbtw.exe
  2⤵
  PID:6488
- C:\Windows\System\dTQiWGI.exe
  C:\Windows\System\dTQiWGI.exe
  2⤵
  PID:7028
- C:\Windows\System\aoepEZN.exe
  C:\Windows\System\aoepEZN.exe
  2⤵
  PID:1148
- C:\Windows\System\yTeTsaI.exe
  C:\Windows\System\yTeTsaI.exe
  2⤵
  PID:6312
- C:\Windows\System\JLeIeTa.exe
  C:\Windows\System\JLeIeTa.exe
  2⤵
  PID:7212
- C:\Windows\System\CaWxkJN.exe
  C:\Windows\System\CaWxkJN.exe
  2⤵
  PID:7244
- C:\Windows\System\iExSeaO.exe
  C:\Windows\System\iExSeaO.exe
  2⤵
  PID:7276
- C:\Windows\System\dnlYuhv.exe
  C:\Windows\System\dnlYuhv.exe
  2⤵
  PID:7320
- C:\Windows\System\FUKSBwH.exe
  C:\Windows\System\FUKSBwH.exe
  2⤵
  PID:7356
- C:\Windows\System\MulNBRz.exe
  C:\Windows\System\MulNBRz.exe
  2⤵
  PID:7400
- C:\Windows\System\PofOZme.exe
  C:\Windows\System\PofOZme.exe
  2⤵
  PID:7440
- C:\Windows\System\yuueHXI.exe
  C:\Windows\System\yuueHXI.exe
  2⤵
  PID:7484
- C:\Windows\System\OzOLkQT.exe
  C:\Windows\System\OzOLkQT.exe
  2⤵
  PID:7520
- C:\Windows\System\mWvrwAn.exe
  C:\Windows\System\mWvrwAn.exe
  2⤵
  PID:7580
- C:\Windows\System\lwelKih.exe
  C:\Windows\System\lwelKih.exe
  2⤵
  PID:7628
- C:\Windows\System\CdVZxMU.exe
  C:\Windows\System\CdVZxMU.exe
  2⤵
  PID:7672
- C:\Windows\System\jMoxDku.exe
  C:\Windows\System\jMoxDku.exe
  2⤵
  PID:8260
- C:\Windows\System\TvGnXuv.exe
  C:\Windows\System\TvGnXuv.exe
  2⤵
  PID:8400
- C:\Windows\System\plZsuPi.exe
  C:\Windows\System\plZsuPi.exe
  2⤵
  PID:8560
- C:\Windows\System\BcQaGDD.exe
  C:\Windows\System\BcQaGDD.exe
  2⤵
  PID:8688
- C:\Windows\System\ADggxBD.exe
  C:\Windows\System\ADggxBD.exe
  2⤵
  PID:8748
- C:\Windows\System\kPvRjXF.exe
  C:\Windows\System\kPvRjXF.exe
  2⤵
  PID:10256
- C:\Windows\System\rhbSCjx.exe
  C:\Windows\System\rhbSCjx.exe
  2⤵
  PID:10284
- C:\Windows\System\dgBuZQF.exe
  C:\Windows\System\dgBuZQF.exe
  2⤵
  PID:10304
- C:\Windows\System\JIPtidS.exe
  C:\Windows\System\JIPtidS.exe
  2⤵
  PID:10328
- C:\Windows\System\YSgClHE.exe
  C:\Windows\System\YSgClHE.exe
  2⤵
  PID:10348
- C:\Windows\System\AZmIzLd.exe
  C:\Windows\System\AZmIzLd.exe
  2⤵
  PID:10372
- C:\Windows\System\nrlMNif.exe
  C:\Windows\System\nrlMNif.exe
  2⤵
  PID:10396
- C:\Windows\System\zikixOv.exe
  C:\Windows\System\zikixOv.exe
  2⤵
  PID:10412
- C:\Windows\System\VprOJKN.exe
  C:\Windows\System\VprOJKN.exe
  2⤵
  PID:10436
- C:\Windows\System\DLhqChl.exe
  C:\Windows\System\DLhqChl.exe
  2⤵
  PID:10456
- C:\Windows\System\GykDuaK.exe
  C:\Windows\System\GykDuaK.exe
  2⤵
  PID:10480
- C:\Windows\System\LAGGntU.exe
  C:\Windows\System\LAGGntU.exe
  2⤵
  PID:10500
- C:\Windows\System\zSOOSxD.exe
  C:\Windows\System\zSOOSxD.exe
  2⤵
  PID:10520
- C:\Windows\System\BdfaHTP.exe
  C:\Windows\System\BdfaHTP.exe
  2⤵
  PID:10544
- C:\Windows\System\xxUcoZt.exe
  C:\Windows\System\xxUcoZt.exe
  2⤵
  PID:10564
- C:\Windows\System\yPwsNuV.exe
  C:\Windows\System\yPwsNuV.exe
  2⤵
  PID:10584
- C:\Windows\System\yeNFekG.exe
  C:\Windows\System\yeNFekG.exe
  2⤵
  PID:10600
- C:\Windows\System\GebJUuP.exe
  C:\Windows\System\GebJUuP.exe
  2⤵
  PID:10620
- C:\Windows\System\uwwlHDt.exe
  C:\Windows\System\uwwlHDt.exe
  2⤵
  PID:10644
- C:\Windows\System\ISUOjGv.exe
  C:\Windows\System\ISUOjGv.exe
  2⤵
  PID:10668
- C:\Windows\System\YKFJSde.exe
  C:\Windows\System\YKFJSde.exe
  2⤵
  PID:10688
- C:\Windows\System\hjxFiMK.exe
  C:\Windows\System\hjxFiMK.exe
  2⤵
  PID:10708
- C:\Windows\System\XszKkyW.exe
  C:\Windows\System\XszKkyW.exe
  2⤵
  PID:10732
- C:\Windows\System\uuWsCUN.exe
  C:\Windows\System\uuWsCUN.exe
  2⤵
  PID:10760
- C:\Windows\System\cyNxinO.exe
  C:\Windows\System\cyNxinO.exe
  2⤵
  PID:10776
- C:\Windows\System\jTadzOK.exe
  C:\Windows\System\jTadzOK.exe
  2⤵
  PID:10800
- C:\Windows\System\CKgZgMf.exe
  C:\Windows\System\CKgZgMf.exe
  2⤵
  PID:10816
- C:\Windows\System\Krwheaj.exe
  C:\Windows\System\Krwheaj.exe
  2⤵
  PID:10836
- C:\Windows\System\DRqfwur.exe
  C:\Windows\System\DRqfwur.exe
  2⤵
  PID:10856
- C:\Windows\System\FLsmhcV.exe
  C:\Windows\System\FLsmhcV.exe
  2⤵
  PID:10884
- C:\Windows\System\jhZCtMY.exe
  C:\Windows\System\jhZCtMY.exe
  2⤵
  PID:10900
- C:\Windows\System\jRFnBAU.exe
  C:\Windows\System\jRFnBAU.exe
  2⤵
  PID:10916
- C:\Windows\System\tzjvCIg.exe
  C:\Windows\System\tzjvCIg.exe
  2⤵
  PID:10936
- C:\Windows\System\LJlbTAI.exe
  C:\Windows\System\LJlbTAI.exe
  2⤵
  PID:10956
- C:\Windows\System\PyikGdK.exe
  C:\Windows\System\PyikGdK.exe
  2⤵
  PID:10976
- C:\Windows\System\NYJJgnj.exe
  C:\Windows\System\NYJJgnj.exe
  2⤵
  PID:10996
- C:\Windows\System\SEDRPrk.exe
  C:\Windows\System\SEDRPrk.exe
  2⤵
  PID:11016
- C:\Windows\System\LzdKwEk.exe
  C:\Windows\System\LzdKwEk.exe
  2⤵
  PID:11040
- C:\Windows\System\THBoIxC.exe
  C:\Windows\System\THBoIxC.exe
  2⤵
  PID:11056
- C:\Windows\System\YvqJamd.exe
  C:\Windows\System\YvqJamd.exe
  2⤵
  PID:11072
- C:\Windows\System\jyRLLUo.exe
  C:\Windows\System\jyRLLUo.exe
  2⤵
  PID:11088
- C:\Windows\System\DUyvNBB.exe
  C:\Windows\System\DUyvNBB.exe
  2⤵
  PID:11108
- C:\Windows\System\FnMsroO.exe
  C:\Windows\System\FnMsroO.exe
  2⤵
  PID:11128
- C:\Windows\System\XTLVDBH.exe
  C:\Windows\System\XTLVDBH.exe
  2⤵
  PID:11148
- C:\Windows\System\OhyTJTc.exe
  C:\Windows\System\OhyTJTc.exe
  2⤵
  PID:11192
- C:\Windows\System\BrfFxVc.exe
  C:\Windows\System\BrfFxVc.exe
  2⤵
  PID:11212
- C:\Windows\System\SGXeyom.exe
  C:\Windows\System\SGXeyom.exe
  2⤵
  PID:11236
- C:\Windows\System\MPpmTOn.exe
  C:\Windows\System\MPpmTOn.exe
  2⤵
  PID:11256
- C:\Windows\System\xXWfjBY.exe
  C:\Windows\System\xXWfjBY.exe
  2⤵
  PID:8804
- C:\Windows\System\uQkSwHa.exe
  C:\Windows\System\uQkSwHa.exe
  2⤵
  PID:8872
- C:\Windows\System\EZTMjqp.exe
  C:\Windows\System\EZTMjqp.exe
  2⤵
  PID:8960
- C:\Windows\System\uZDOeEe.exe
  C:\Windows\System\uZDOeEe.exe
  2⤵
  PID:8980
- C:\Windows\System\ZqlXCCr.exe
  C:\Windows\System\ZqlXCCr.exe
  2⤵
  PID:9068
- C:\Windows\System\XqFpyxL.exe
  C:\Windows\System\XqFpyxL.exe
  2⤵
  PID:6684
- C:\Windows\System\uogtNbk.exe
  C:\Windows\System\uogtNbk.exe
  2⤵
  PID:8180
- C:\Windows\System\wDmocNn.exe
  C:\Windows\System\wDmocNn.exe
  2⤵
  PID:9456
- C:\Windows\System\noKLMoq.exe
  C:\Windows\System\noKLMoq.exe
  2⤵
  PID:9572
- C:\Windows\System\EBXmbGD.exe
  C:\Windows\System\EBXmbGD.exe
  2⤵
  PID:11320
- C:\Windows\System\KBeCWzv.exe
  C:\Windows\System\KBeCWzv.exe
  2⤵
  PID:11340
- C:\Windows\System\MfaMABQ.exe
  C:\Windows\System\MfaMABQ.exe
  2⤵
  PID:11360
- C:\Windows\System\ytfSBQm.exe
  C:\Windows\System\ytfSBQm.exe
  2⤵
  PID:11380
- C:\Windows\System\EDgkGjv.exe
  C:\Windows\System\EDgkGjv.exe
  2⤵
  PID:11400
- C:\Windows\System\GtJNQUH.exe
  C:\Windows\System\GtJNQUH.exe
  2⤵
  PID:11420
- C:\Windows\System\ytTdzOI.exe
  C:\Windows\System\ytTdzOI.exe
  2⤵
  PID:11440
- C:\Windows\System\nJGONZZ.exe
  C:\Windows\System\nJGONZZ.exe
  2⤵
  PID:11460
- C:\Windows\System\hhontUd.exe
  C:\Windows\System\hhontUd.exe
  2⤵
  PID:11484
- C:\Windows\System\lxVSNRQ.exe
  C:\Windows\System\lxVSNRQ.exe
  2⤵
  PID:11504
- C:\Windows\System\dGGzBjm.exe
  C:\Windows\System\dGGzBjm.exe
  2⤵
  PID:11528
- C:\Windows\System\nHArDeL.exe
  C:\Windows\System\nHArDeL.exe
  2⤵
  PID:11544
- C:\Windows\System\ndFGGAS.exe
  C:\Windows\System\ndFGGAS.exe
  2⤵
  PID:11568
- C:\Windows\System\bjnymYN.exe
  C:\Windows\System\bjnymYN.exe
  2⤵
  PID:11592
- C:\Windows\System\lsviqNo.exe
  C:\Windows\System\lsviqNo.exe
  2⤵
  PID:11612
- C:\Windows\System\wTXlGmv.exe
  C:\Windows\System\wTXlGmv.exe
  2⤵
  PID:11628
- C:\Windows\System\UThvLUC.exe
  C:\Windows\System\UThvLUC.exe
  2⤵
  PID:11652
- C:\Windows\System\CVzPVvB.exe
  C:\Windows\System\CVzPVvB.exe
  2⤵
  PID:11672
- C:\Windows\System\cBkHvUQ.exe
  C:\Windows\System\cBkHvUQ.exe
  2⤵
  PID:11688
- C:\Windows\System\xOwtvFy.exe
  C:\Windows\System\xOwtvFy.exe
  2⤵
  PID:11708
- C:\Windows\System\eIvdfVf.exe
  C:\Windows\System\eIvdfVf.exe
  2⤵
  PID:11732
- C:\Windows\System\aWTNtXK.exe
  C:\Windows\System\aWTNtXK.exe
  2⤵
  PID:11760
- C:\Windows\System\csNypnP.exe
  C:\Windows\System\csNypnP.exe
  2⤵
  PID:11780
- C:\Windows\System\YMJiuje.exe
  C:\Windows\System\YMJiuje.exe
  2⤵
  PID:11800
- C:\Windows\System\REHIysw.exe
  C:\Windows\System\REHIysw.exe
  2⤵
  PID:11820
- C:\Windows\System\omBrYCP.exe
  C:\Windows\System\omBrYCP.exe
  2⤵
  PID:11848
- C:\Windows\System\qzDYuHR.exe
  C:\Windows\System\qzDYuHR.exe
  2⤵
  PID:11872
- C:\Windows\System\bLoGrLO.exe
  C:\Windows\System\bLoGrLO.exe
  2⤵
  PID:11896
- C:\Windows\System\xYjMxBN.exe
  C:\Windows\System\xYjMxBN.exe
  2⤵
  PID:11920
- C:\Windows\System\qjhJTkL.exe
  C:\Windows\System\qjhJTkL.exe
  2⤵
  PID:11940
- C:\Windows\System\dwIpSoE.exe
  C:\Windows\System\dwIpSoE.exe
  2⤵
  PID:11968
- C:\Windows\System\bcGnJzQ.exe
  C:\Windows\System\bcGnJzQ.exe
  2⤵
  PID:11988
- C:\Windows\System\rDNoTef.exe
  C:\Windows\System\rDNoTef.exe
  2⤵
  PID:12016
- C:\Windows\System\vMTfniw.exe
  C:\Windows\System\vMTfniw.exe
  2⤵
  PID:12032
- C:\Windows\System\KLrgbJe.exe
  C:\Windows\System\KLrgbJe.exe
  2⤵
  PID:12052
- C:\Windows\System\SGMHQvr.exe
  C:\Windows\System\SGMHQvr.exe
  2⤵
  PID:12072
- C:\Windows\System\qNCaERN.exe
  C:\Windows\System\qNCaERN.exe
  2⤵
  PID:12100
- C:\Windows\System\ueQLXij.exe
  C:\Windows\System\ueQLXij.exe
  2⤵
  PID:12116
- C:\Windows\System\DHDCOvs.exe
  C:\Windows\System\DHDCOvs.exe
  2⤵
  PID:12140
- C:\Windows\System\QLaYtZx.exe
  C:\Windows\System\QLaYtZx.exe
  2⤵
  PID:12164
- C:\Windows\System\tPeLvnk.exe
  C:\Windows\System\tPeLvnk.exe
  2⤵
  PID:12184
- C:\Windows\System\STKfCgG.exe
  C:\Windows\System\STKfCgG.exe
  2⤵
  PID:12204
- C:\Windows\System\fdugidO.exe
  C:\Windows\System\fdugidO.exe
  2⤵
  PID:12224
- C:\Windows\System\jxacpnX.exe
  C:\Windows\System\jxacpnX.exe
  2⤵
  PID:12248
- C:\Windows\System\WJpwFxD.exe
  C:\Windows\System\WJpwFxD.exe
  2⤵
  PID:12268
- C:\Windows\System\vkmKmht.exe
  C:\Windows\System\vkmKmht.exe
  2⤵
  PID:12284
- C:\Windows\System\CYGqtRE.exe
  C:\Windows\System\CYGqtRE.exe
  2⤵
  PID:6884
- C:\Windows\System\nbeFCnF.exe
  C:\Windows\System\nbeFCnF.exe
  2⤵
  PID:8644
- C:\Windows\System\xwMOVwc.exe
  C:\Windows\System\xwMOVwc.exe
  2⤵
  PID:7772
- C:\Windows\System\xQYdgpk.exe
  C:\Windows\System\xQYdgpk.exe
  2⤵
  PID:7228
- C:\Windows\System\oqlSfCs.exe
  C:\Windows\System\oqlSfCs.exe
  2⤵
  PID:7328
- C:\Windows\System\kvNybrZ.exe
  C:\Windows\System\kvNybrZ.exe
  2⤵
  PID:7384
- C:\Windows\System\VyyiZwY.exe
  C:\Windows\System\VyyiZwY.exe
  2⤵
  PID:7500
- C:\Windows\System\BLQNerh.exe
  C:\Windows\System\BLQNerh.exe
  2⤵
  PID:7660
- C:\Windows\System\lIWmDRk.exe
  C:\Windows\System\lIWmDRk.exe
  2⤵
  PID:8736
- C:\Windows\System\THWsTGY.exe
  C:\Windows\System\THWsTGY.exe
  2⤵
  PID:8828
- C:\Windows\System\UXglnPE.exe
  C:\Windows\System\UXglnPE.exe
  2⤵
  PID:10472
- C:\Windows\System\FTLxkzo.exe
  C:\Windows\System\FTLxkzo.exe
  2⤵
  PID:8912
- C:\Windows\System\RxIefZL.exe
  C:\Windows\System\RxIefZL.exe
  2⤵
  PID:10552
- C:\Windows\System\PbDKHmY.exe
  C:\Windows\System\PbDKHmY.exe
  2⤵
  PID:12300
- C:\Windows\System\MtEZbCU.exe
  C:\Windows\System\MtEZbCU.exe
  2⤵
  PID:12324
- C:\Windows\System\hwCoswe.exe
  C:\Windows\System\hwCoswe.exe
  2⤵
  PID:12344
- C:\Windows\System\crFKidY.exe
  C:\Windows\System\crFKidY.exe
  2⤵
  PID:12376
- C:\Windows\System\DaOeCBn.exe
  C:\Windows\System\DaOeCBn.exe
  2⤵
  PID:12392
- C:\Windows\System\GBfHlWX.exe
  C:\Windows\System\GBfHlWX.exe
  2⤵
  PID:12424
- C:\Windows\System\ILOAOdi.exe
  C:\Windows\System\ILOAOdi.exe
  2⤵
  PID:12444
- C:\Windows\System\oJhKlOU.exe
  C:\Windows\System\oJhKlOU.exe
  2⤵
  PID:12468
- C:\Windows\System\FcinrYY.exe
  C:\Windows\System\FcinrYY.exe
  2⤵
  PID:12488
- C:\Windows\System\klNagac.exe
  C:\Windows\System\klNagac.exe
  2⤵
  PID:12504
- C:\Windows\System\LECPUuB.exe
  C:\Windows\System\LECPUuB.exe
  2⤵
  PID:12528
- C:\Windows\System\obNrkCA.exe
  C:\Windows\System\obNrkCA.exe
  2⤵
  PID:12556
- C:\Windows\System\KTNSFgA.exe
  C:\Windows\System\KTNSFgA.exe
  2⤵
  PID:12576
- C:\Windows\System\TnVrxpq.exe
  C:\Windows\System\TnVrxpq.exe
  2⤵
  PID:12592
- C:\Windows\System\CbwTJlo.exe
  C:\Windows\System\CbwTJlo.exe
  2⤵
  PID:12612
- C:\Windows\System\VmxRZdY.exe
  C:\Windows\System\VmxRZdY.exe
  2⤵
  PID:12632
- C:\Windows\System\fNGtwDv.exe
  C:\Windows\System\fNGtwDv.exe
  2⤵
  PID:12652
- C:\Windows\System\sbWdkAz.exe
  C:\Windows\System\sbWdkAz.exe
  2⤵
  PID:12672
- C:\Windows\System\fVEgoDt.exe
  C:\Windows\System\fVEgoDt.exe
  2⤵
  PID:12696
- C:\Windows\System\zOnLesp.exe
  C:\Windows\System\zOnLesp.exe
  2⤵
  PID:12720
- C:\Windows\System\SXmNUKP.exe
  C:\Windows\System\SXmNUKP.exe
  2⤵
  PID:12740
- C:\Windows\System\MSWjKbJ.exe
  C:\Windows\System\MSWjKbJ.exe
  2⤵
  PID:12760
- C:\Windows\System\KpdNLAF.exe
  C:\Windows\System\KpdNLAF.exe
  2⤵
  PID:12780
- C:\Windows\System\ltaBcwC.exe
  C:\Windows\System\ltaBcwC.exe
  2⤵
  PID:12804
- C:\Windows\System\APdhicU.exe
  C:\Windows\System\APdhicU.exe
  2⤵
  PID:12820
- C:\Windows\System\lkNBLNu.exe
  C:\Windows\System\lkNBLNu.exe
  2⤵
  PID:12840
- C:\Windows\System\PGuWkio.exe
  C:\Windows\System\PGuWkio.exe
  2⤵
  PID:12860
- C:\Windows\System\zlJkpnM.exe
  C:\Windows\System\zlJkpnM.exe
  2⤵
  PID:12880
- C:\Windows\System\VCVrbyc.exe
  C:\Windows\System\VCVrbyc.exe
  2⤵
  PID:12900
- C:\Windows\System\vAbniYM.exe
  C:\Windows\System\vAbniYM.exe
  2⤵
  PID:12928
- C:\Windows\System\stgzMoW.exe
  C:\Windows\System\stgzMoW.exe
  2⤵
  PID:12948
- C:\Windows\System\jeSFusZ.exe
  C:\Windows\System\jeSFusZ.exe
  2⤵
  PID:12968
- C:\Windows\System\PvdcjQD.exe
  C:\Windows\System\PvdcjQD.exe
  2⤵
  PID:13000
- C:\Windows\System\PlsdbOZ.exe
  C:\Windows\System\PlsdbOZ.exe
  2⤵
  PID:13020
- C:\Windows\System\RBEXanj.exe
  C:\Windows\System\RBEXanj.exe
  2⤵
  PID:13040
- C:\Windows\System\pfPwGAb.exe
  C:\Windows\System\pfPwGAb.exe
  2⤵
  PID:13060
- C:\Windows\System\cVEYJgU.exe
  C:\Windows\System\cVEYJgU.exe
  2⤵
  PID:13076
- C:\Windows\System\vTzbMWy.exe
  C:\Windows\System\vTzbMWy.exe
  2⤵
  PID:13096
- C:\Windows\System\tkfakzW.exe
  C:\Windows\System\tkfakzW.exe
  2⤵
  PID:13112
- C:\Windows\System\ijKGlYb.exe
  C:\Windows\System\ijKGlYb.exe
  2⤵
  PID:13132
- C:\Windows\System\uLIdTTw.exe
  C:\Windows\System\uLIdTTw.exe
  2⤵
  PID:13152
- C:\Windows\System\RIbyuFS.exe
  C:\Windows\System\RIbyuFS.exe
  2⤵
  PID:13172
- C:\Windows\System\hVTfxsQ.exe
  C:\Windows\System\hVTfxsQ.exe
  2⤵
  PID:13192
- C:\Windows\System\tRgwHIV.exe
  C:\Windows\System\tRgwHIV.exe
  2⤵
  PID:13208
- C:\Windows\System\eJhvpit.exe
  C:\Windows\System\eJhvpit.exe
  2⤵
  PID:13224
- C:\Windows\System\eTLnUaT.exe
  C:\Windows\System\eTLnUaT.exe
  2⤵
  PID:13252
- C:\Windows\System\iZsvZxt.exe
  C:\Windows\System\iZsvZxt.exe
  2⤵
  PID:13268
- C:\Windows\System\wZnAsPH.exe
  C:\Windows\System\wZnAsPH.exe
  2⤵
  PID:13284
- C:\Windows\System\opmRbAZ.exe
  C:\Windows\System\opmRbAZ.exe
  2⤵
  PID:10704
- C:\Windows\System\ybphnqD.exe
  C:\Windows\System\ybphnqD.exe
  2⤵
  PID:7696
- C:\Windows\System\BzBNath.exe
  C:\Windows\System\BzBNath.exe
  2⤵
  PID:9268
- C:\Windows\System\UKFHvVZ.exe
  C:\Windows\System\UKFHvVZ.exe
  2⤵
  PID:11080
- C:\Windows\System\CUBHfYl.exe
  C:\Windows\System\CUBHfYl.exe
  2⤵
  PID:9320
- C:\Windows\System\oaahIMW.exe
  C:\Windows\System\oaahIMW.exe
  2⤵
  PID:1444
- C:\Windows\System\jWxEPJE.exe
  C:\Windows\System\jWxEPJE.exe
  2⤵
  PID:9480
- C:\Windows\System\oVFnNxg.exe
  C:\Windows\System\oVFnNxg.exe
  2⤵
  PID:13056
- C:\Windows\System\dTdxRtQ.exe
  C:\Windows\System\dTdxRtQ.exe
  2⤵
  PID:8480
- C:\Windows\System\srbSqXv.exe
  C:\Windows\System\srbSqXv.exe
  2⤵
  PID:12160
- C:\Windows\System\GriShjq.exe
  C:\Windows\System\GriShjq.exe
  2⤵
  PID:7928
- C:\Windows\System\MBUXKsO.exe
  C:\Windows\System\MBUXKsO.exe
  2⤵
  PID:5608
- C:\Windows\System\uTAIvVo.exe
  C:\Windows\System\uTAIvVo.exe
  2⤵
  PID:3864
- C:\Windows\System\HMEIyEa.exe
  C:\Windows\System\HMEIyEa.exe
  2⤵
  PID:3112
- C:\Windows\System\jnVhANu.exe
  C:\Windows\System\jnVhANu.exe
  2⤵
  PID:3412
- C:\Windows\System\DXADaTu.exe
  C:\Windows\System\DXADaTu.exe
  2⤵
  PID:1996
- C:\Windows\System\HXLqIry.exe
  C:\Windows\System\HXLqIry.exe
  2⤵
  PID:7624
- C:\Windows\System\jaIFxbH.exe
  C:\Windows\System\jaIFxbH.exe
  2⤵
  PID:11604
- C:\Windows\System\FeuyFtt.exe
  C:\Windows\System\FeuyFtt.exe
  2⤵
  PID:10968
- C:\Windows\System\bPGmgoM.exe
  C:\Windows\System\bPGmgoM.exe
  2⤵
  PID:9344
- C:\Windows\System\JJCwmbd.exe
  C:\Windows\System\JJCwmbd.exe
  2⤵
  PID:9420
- C:\Windows\System\WaNUqdU.exe
  C:\Windows\System\WaNUqdU.exe
  2⤵
  PID:10656
- C:\Windows\System\PTcQnIS.exe
  C:\Windows\System\PTcQnIS.exe
  2⤵
  PID:6872
- C:\Windows\System\gVMxAgE.exe
  C:\Windows\System\gVMxAgE.exe
  2⤵
  PID:9880
- C:\Windows\System\CXpWmWq.exe
  C:\Windows\System\CXpWmWq.exe
  2⤵
  PID:5916
- C:\Windows\System\KXKvlPJ.exe
  C:\Windows\System\KXKvlPJ.exe
  2⤵
  PID:10132
- C:\Windows\System\tePDtMq.exe
  C:\Windows\System\tePDtMq.exe
  2⤵
  PID:6976
- C:\Windows\System\bGKTqZc.exe
  C:\Windows\System\bGKTqZc.exe
  2⤵
  PID:5192
- C:\Windows\System\KcCEBdw.exe
  C:\Windows\System\KcCEBdw.exe
  2⤵
  PID:4624
- C:\Windows\System\RKoBclM.exe
  C:\Windows\System\RKoBclM.exe
  2⤵
  PID:3480
- C:\Windows\System\Zgiomrh.exe
  C:\Windows\System\Zgiomrh.exe
  2⤵
  PID:12628
- C:\Windows\System\nhXexKU.exe
  C:\Windows\System\nhXexKU.exe
  2⤵
  PID:7264
- C:\Windows\System\boTXOyh.exe
  C:\Windows\System\boTXOyh.exe
  2⤵
  PID:4908
- C:\Windows\System\AkATaOh.exe
  C:\Windows\System\AkATaOh.exe
  2⤵
  PID:10452
- C:\Windows\System\aQmFekm.exe
  C:\Windows\System\aQmFekm.exe
  2⤵
  PID:10392
- C:\Windows\System\frNzjdH.exe
  C:\Windows\System\frNzjdH.exe
  2⤵
  PID:6700
- C:\Windows\System\qqvuCzn.exe
  C:\Windows\System\qqvuCzn.exe
  2⤵
  PID:12956
- C:\Windows\System\WcxNqxW.exe
  C:\Windows\System\WcxNqxW.exe
  2⤵
  PID:7844
- C:\Windows\System\jWgWagV.exe
  C:\Windows\System\jWgWagV.exe
  2⤵
  PID:8452
- C:\Windows\System\AvNnxZa.exe
  C:\Windows\System\AvNnxZa.exe
  2⤵
  PID:9568
- C:\Windows\System\BapgEgF.exe
  C:\Windows\System\BapgEgF.exe
  2⤵
  PID:13220
- C:\Windows\System\gkTPCvm.exe
  C:\Windows\System\gkTPCvm.exe
  2⤵
  PID:12296
- C:\Windows\System\upCfGoh.exe
  C:\Windows\System\upCfGoh.exe
  2⤵
  PID:12540
- C:\Windows\System\WhSgMHy.exe
  C:\Windows\System\WhSgMHy.exe
  2⤵
  PID:12728
- C:\Windows\System\hzvuBWW.exe
  C:\Windows\System\hzvuBWW.exe
  2⤵
  PID:7864
- C:\Windows\System\NbSKZYv.exe
  C:\Windows\System\NbSKZYv.exe
  2⤵
  PID:2712
- C:\Windows\System\TwCqbqu.exe
  C:\Windows\System\TwCqbqu.exe
  2⤵
  PID:12832
- C:\Windows\System\cqYtIyp.exe
  C:\Windows\System\cqYtIyp.exe
  2⤵
  PID:2960
- C:\Windows\System\sbVYqzO.exe
  C:\Windows\System\sbVYqzO.exe
  2⤵
  PID:8776
- C:\Windows\System\aTrQech.exe
  C:\Windows\System\aTrQech.exe
  2⤵
  PID:11888
- C:\Windows\System\ydIqKot.exe
  C:\Windows\System\ydIqKot.exe
  2⤵
  PID:11352
- C:\Windows\System\dZkEVrW.exe
  C:\Windows\System\dZkEVrW.exe
  2⤵
  PID:4716
- C:\Windows\System\WMYNmRe.exe
  C:\Windows\System\WMYNmRe.exe
  2⤵
  PID:12812
- C:\Windows\System\VSrhekV.exe
  C:\Windows\System\VSrhekV.exe
  2⤵
  PID:2280
- C:\Windows\System\UsgikkZ.exe
  C:\Windows\System\UsgikkZ.exe
  2⤵
  PID:9360
- C:\Windows\System\GtpVLMk.exe
  C:\Windows\System\GtpVLMk.exe
  2⤵
  PID:10740
- C:\Windows\System\UdHlJWd.exe
  C:\Windows\System\UdHlJWd.exe
  2⤵
  PID:9908
- C:\Windows\System\sFYpOQY.exe
  C:\Windows\System\sFYpOQY.exe
  2⤵
  PID:6328
- C:\Windows\System\wQwqrYp.exe
  C:\Windows\System\wQwqrYp.exe
  2⤵
  PID:11964
- C:\Windows\System\BrhINja.exe
  C:\Windows\System\BrhINja.exe
  2⤵
  PID:4588
- C:\Windows\System\vCfIyVx.exe
  C:\Windows\System\vCfIyVx.exe
  2⤵
  PID:12200
- C:\Windows\System\zlVqDhG.exe
  C:\Windows\System\zlVqDhG.exe
  2⤵
  PID:12752
- C:\Windows\System\cWpOQaJ.exe
  C:\Windows\System\cWpOQaJ.exe
  2⤵
  PID:624
- C:\Windows\System\YYjFrHv.exe
  C:\Windows\System\YYjFrHv.exe
  2⤵
  PID:2384
- C:\Windows\System\mGrocOA.exe
  C:\Windows\System\mGrocOA.exe
  2⤵
  PID:2780
- C:\Windows\System\kRniNNz.exe
  C:\Windows\System\kRniNNz.exe
  2⤵
  PID:3724
- C:\Windows\System\ArpHvRE.exe
  C:\Windows\System\ArpHvRE.exe
  2⤵
  PID:3420
- C:\Windows\System\KgtnaTQ.exe
  C:\Windows\System\KgtnaTQ.exe
  2⤵
  PID:10028
- C:\Windows\System\HmzWOlT.exe
  C:\Windows\System\HmzWOlT.exe
  2⤵
  PID:7000
- C:\Windows\System\bwXfWzc.exe
  C:\Windows\System\bwXfWzc.exe
  2⤵
  PID:10516
- C:\Windows\System\MAhoeeo.exe
  C:\Windows\System\MAhoeeo.exe
  2⤵
  PID:12176
- C:\Windows\System\qcqRCNw.exe
  C:\Windows\System\qcqRCNw.exe
  2⤵
  PID:12292
- C:\Windows\System\xjFLvII.exe
  C:\Windows\System\xjFLvII.exe
  2⤵
  PID:1248
- C:\Windows\System\vBbPkaA.exe
  C:\Windows\System\vBbPkaA.exe
  2⤵
  PID:3148
- C:\Windows\System\uaJxSBx.exe
  C:\Windows\System\uaJxSBx.exe
  2⤵
  PID:1056
- C:\Windows\System\YmohBZr.exe
  C:\Windows\System\YmohBZr.exe
  2⤵
  PID:6392
- C:\Windows\System\VRzNWjz.exe
  C:\Windows\System\VRzNWjz.exe
  2⤵
  PID:12496
- C:\Windows\System\FtrWGWh.exe
  C:\Windows\System\FtrWGWh.exe
  2⤵
  PID:9220
- C:\Windows\System\qAaOMPv.exe
  C:\Windows\System\qAaOMPv.exe
  2⤵
  PID:5044
- C:\Windows\System\zfMasMO.exe
  C:\Windows\System\zfMasMO.exe
  2⤵
  PID:9836
- C:\Windows\System\UHQzQSO.exe
  C:\Windows\System\UHQzQSO.exe
  2⤵
  PID:9928
- C:\Windows\System\shqsTjb.exe
  C:\Windows\System\shqsTjb.exe
  2⤵
  PID:6588
- C:\Windows\System\JBhsVdc.exe
  C:\Windows\System\JBhsVdc.exe
  2⤵
  PID:8516
- C:\Windows\System\OBXrngp.exe
  C:\Windows\System\OBXrngp.exe
  2⤵
  PID:9856
- C:\Windows\System\BUhHrwy.exe
  C:\Windows\System\BUhHrwy.exe
  2⤵
  PID:4088
- C:\Windows\System\wVoXHpf.exe
  C:\Windows\System\wVoXHpf.exe
  2⤵
  PID:12464
- C:\Windows\System\SBaybJh.exe
  C:\Windows\System\SBaybJh.exe
  2⤵
  PID:544
- C:\Windows\System\mWPsHsX.exe
  C:\Windows\System\mWPsHsX.exe
  2⤵
  PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:12728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uky4bhap.vz1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AiFVVWL.exe

Filesize
1.6MB

MD5
18b24bb0461bd9b73dba060043fc5965

SHA1
d1dd5ebf044c35245512a4543ae61befce21e5db

SHA256
ff8b048b388fae787071eefaf17b0da7268b3aaa5b218ad46cb23bafea6d22b8

SHA512
bcabecc6dea1bf58d94fb20925e9b14f4a4a44ada6d460f6e853c124ed39d01a8a61c6cddafa6de862489265311c077ded226ca7dcfcfdb87829c176931708bc

Download Submit
C:\Windows\System\ChmZwwo.exe

Filesize
1.6MB

MD5
915eabc9b6f8416f350d89d6e27131e9

SHA1
b5234c781a641f9cd2e5517d665dc7493e834b3a

SHA256
563001eeda390bd2e1a8139ea2a462aa4dda7e55f401f8876263e7190cbde3af

SHA512
5e1a5880829d19760726e5188210da7fdb3470629e02c31ac88c1801e97b0009d82660e0a6cd3587ce3c31411c6b27a2155931b5354fede540881b8f2553425b

Download Submit
C:\Windows\System\GvtAFhK.exe

Filesize
1.6MB

MD5
3df0a34eb788d0300f10aa2ba35d2ce4

SHA1
9080edb843781c2cac950c620c283f8c4fbb10e8

SHA256
c821890db67e21f09a0f4529c1bd76e287c5386f8675d752653808e345f94a3c

SHA512
93ed42384b7649b21bf5f7e23d6e8f7a615077992e8f9e422f2767db26ee0e8df908b7c8b7e678004ce0f9f52a83c9cee59b396902934b7ef07d32539d132b8c

Download Submit
C:\Windows\System\HiYTamB.exe

Filesize
8B

MD5
cf50e241303d497858ee01855fb582c8

SHA1
071c6ca1d65e04749f98c6a703cbc804ec84ade3

SHA256
501a1602089109b7d1620eb45678928ef48594bd3e9d379e4d9cd5c0f3bdf610

SHA512
9acf492462174dc95aadbf576467af6a3992f55fe198a880427aa6ca9bf21c04fc7a421b1986a9d47e9b0a48e3c4b3d86850c8700c25e99a738c34f1ba7766bb

Download Submit
C:\Windows\System\HkOhLXf.exe

Filesize
1.6MB

MD5
80f04a079211edc264c8598f7c57d470

SHA1
51a228c525a9153866c065923feabb8321f2a661

SHA256
81a199a363681b9523e240e7248010c06bb2017416f181b1d07bf84673e7cb89

SHA512
0cd97156397533ae8d34e7a4edfe2ac5132ec76b08dd87c7c408acb62cf2e74d56343823c84366cb1c0f83356ea2864b406a45ec11bab0feba48ba0829b8fe51

Download Submit
C:\Windows\System\JjAUbUH.exe

Filesize
1.6MB

MD5
ac00946a4f26dc1c9b6a6bd94536eb00

SHA1
b23d8a9c2e11fb1e24a711fe3eac0cb6258cc5cc

SHA256
10b48f2f195d86227b6c32711b8457b3a354caf5a8a2444632433498535da72c

SHA512
811e56cd606af95fbd22ec0b8093443dc6c74c47f05831803e8b8237cd5cb65a7a24b4eed6135479513e2d43ad550c63a5dfd7132351a9f695e3d01bd3fb14ee

Download Submit
C:\Windows\System\KDAWynd.exe

Filesize
1.6MB

MD5
e205b272c1534ec4fe0e82480803de9b

SHA1
ce5f87ce8b46c1979a27e44c96f5c5679c90c3e0

SHA256
2f567ef3e63d57fe7da0d5b699244bec28fd15137b34a4e28349d0555676e2e0

SHA512
744fa08bce86733b2047e5b6db81e1abea04d424370d7e8c54173dc2ed6d3072c8b74ff2b02dcf24d95d01de6ddbaf1c0f4b5d27123a4e7bdf9546ce127e3b23

Download Submit
C:\Windows\System\LFSCFIB.exe

Filesize
1.6MB

MD5
2eb2b5581a76615df2c4279606e8b91c

SHA1
198bae0ba002b057b7c08de196069b89af0bd564

SHA256
fa14c79f16a2d566bbd97dec0938c85911b162789f3abe4e24894bde518b0237

SHA512
cf4025619440f259bbfb62ed799dc3aaaa1786c8224907e04a92e25ec5981b1cf00d8e9e1448640065fb03327840eab135fc1ef7b90e60b68175b6874260aea9

Download Submit
C:\Windows\System\MeRTZgO.exe

Filesize
1.6MB

MD5
0d862573344d9bb907ba0df2d22c763c

SHA1
cda1bbf707e01aa6e1dadf801d1df63411e0136c

SHA256
a71bb0201ea9175f18aadd2b1308b9d333e0e71f23aa2ae1f44e63fe64524628

SHA512
10349e38a3d9685f407d380aea3407c7e6532b51ebcf4ef965c86e2b91affc3eff886c91ea0672978cf6fa48c1091d89325464caadbd939178a2ba3d3a377828

Download Submit
C:\Windows\System\MgVIJap.exe

Filesize
1.6MB

MD5
f8cbeaeddcf7d7d0d90903811e574a8f

SHA1
62b512e7b2809236f9fa8df663cdf7a63591594a

SHA256
6c9668910b5dd63fe4631687d5fb1cf07220581473bcf98df0c76d20470f47ad

SHA512
6c4747717ea56de41049b88cd599dfa7fd747ee1bf0fec8d304f59dc6b8e6aed5c7f096362c0bd725b6355819ec1897be062341da319b902aa5e81f642936ff7

Download Submit
C:\Windows\System\NuZZVhD.exe

Filesize
1.6MB

MD5
9ba0976ee1d1575a53886ee0e26231f7

SHA1
7f40f8405a688295fd8a19c915a29c0b2e644fcc

SHA256
6dcd41153482c9877022284e9a3ae963f342800de9c94db34dda923889ae8182

SHA512
8fbb5e8b554f893d688f5530cbe6574d06bada16fa546d82d77de0c5cd6d4a3286b897a4bb31613dc861971811264c468ca19f871201dfa0ad68a79be96ee97c

Download Submit
C:\Windows\System\OXfIuGc.exe

Filesize
1.6MB

MD5
10628d76bd5ee57c79cac4c73f90cc95

SHA1
bbac6be5b1e564f6e3231859c61d6d9cd09e784d

SHA256
954d69023b42feda8a828c7e35a27c9c9222a068ddaaf1aab4fc84fa047e4e93

SHA512
1341fa15af7f9826d04570d1be794fd779e08d7eed73c8787bda225bec4ab0c504f6c3755526da5e8e5bf4e9f15bccdfad2902d3d50ed0b3420c6daaffbda0a5

Download Submit
C:\Windows\System\QRPFnKN.exe

Filesize
1.6MB

MD5
ae1b553a3bc5a56a17ba14bef8e7fe75

SHA1
8ad66c751aaa22bc563146248857d6853ab630f5

SHA256
588ecfae9fa39fe4686fb8f2e29c7ecd23f63257c10a73785d64f0ea4605a193

SHA512
d51786aae5a14b452ee38429ca919810fd73b4e5c109f73e8f44e69b7e953570ec05fec019a5a4ce5837f68c883b37c878537b1cfbac3de10893530ff2b1edb6

Download Submit
C:\Windows\System\SPpGPzI.exe

Filesize
1.6MB

MD5
b5582e6180169d95f16f06fb1d41aaee

SHA1
c1c99ab368ed0ae6efbc935505278c27a614aa01

SHA256
6df36641224845c6586ecd1cd1d47f29a0571d00523f6ad93deef73f5a879e88

SHA512
ea63a61d7d0eac3231f3fa08bba95722f0b18114cd9892267a11cc543b37701562f1f9621b987e9781b096093b1932f716ac2a563773c831aede4bd6bf49d107

Download Submit
C:\Windows\System\TJKipSn.exe

Filesize
1.6MB

MD5
df2224c11b4fe1cdc43e12c43792d4d2

SHA1
999f7899ba07bf755eadcbb3cf3a6f3a33ecfe81

SHA256
992f1fad6ee0a7b3768801ca780bdc0fabd1f8cb3dd576c00fec7711e88fe973

SHA512
809c0ec03ccd61364cae5606e1eed90867ffd879797fead11d40eb49001bfc1a2bee4ab8d410a60525c4b00b2122b42b041a3ce78bd5b2a30fce34e17652f81e

Download Submit
C:\Windows\System\WLDFPoR.exe

Filesize
1.6MB

MD5
596ac7433c74296d74f6c6695ec6b3de

SHA1
d33f7a6bf512d9b51c3f03be7628b5a3c0967577

SHA256
b510303f28be18af9a63d64b783c96e7c8917bc3a6bd5e3fcc8982acc33b6da8

SHA512
08ae9d54f91bfc42b1d2da1cbd40ffb0d80abb5b78ebdd8d841794c378da88b3bfe74e45c8f3783ec009c10babac0799561f568c1560ea442954cc031ec13161

Download Submit
C:\Windows\System\YfkvAOR.exe

Filesize
1.6MB

MD5
50a41d780fa9589f25549b029d7038ac

SHA1
3aa8094b5f6c9e0fb7bc34873f1d0256241d63a9

SHA256
5598e0923ca0d4e3f7f7251c156f6ba62cff5b493199ec4168de510b7e67e494

SHA512
1f0c85653dfbf1fa7fb3b35fbe8f0418986a3d551a043a2e8e45c640251adc6498e4fcb03ff5ed6e1403214a15071770b00058cf60a2eeb5530148ac9ea054fb

Download Submit
C:\Windows\System\ZPinXZi.exe

Filesize
1.6MB

MD5
cfc6755df5ba2feadaa55cdc35c33a2b

SHA1
34aee9a1ea8348be59d748c476c71457d84e6db5

SHA256
800637955a53b2d4df5a757ee4c5f3fe2a91b3e08b2af9852f58dcd64e829e77

SHA512
28e9dcb79b153d2b77bf26e7814bb4c98ecdfaad6aa1b29f30913e7d9e56d5820006214f1d751595f2f4a3352257f1c2e388074306e06c3ade06dbd1ce4b84f6

Download Submit
C:\Windows\System\ZdAtwLw.exe

Filesize
1.6MB

MD5
e3636202976ccdd842f72858b64391be

SHA1
e769a2b29ae9a81544530517a203af5805b3f1e1

SHA256
c38a835349c65fc2096788a80193ea2c4e6dfbf4ca8b9088faa1aea274e661f9

SHA512
ca0be36fc39373da312bfbd593b37e1a51804b98dca763a3356f00a38cc3df911dc14b94a2917fc0225979723b2c1c64df1389774a6165debcba80a5f870024f

Download Submit
C:\Windows\System\ayyjmCq.exe

Filesize
1.6MB

MD5
0f97f23b17d8cac23287138b9b58d008

SHA1
15d11c4a01ebbb533295f0279d5602c22ee08089

SHA256
0d366bbb82d83b422204d40c35e055f11a76d4fcaed32d26f7a33474da1d81be

SHA512
072977bfd35c052232554ef1ec249d1147a5cabbd108821abd1ec66668e64226d28d7bbfad2f45e5080d0663fac85906754b2eb3a64cdcc00404a1a6cc9c9a66

Download Submit
C:\Windows\System\cbuefup.exe

Filesize
1.6MB

MD5
bb8557ffbe2b3732b583b34b5d49929c

SHA1
6cd4cd5a773b187caa8921c24953e12e10a3b6b0

SHA256
22525a9d35023398c20db12d2867c7a0c8a146c0fa7c255a01c254e54d8d51bf

SHA512
2ce2d820054a196d9f6dee087116d2f0b159a22af34b2b9cc74767c8605bd080818c2f8f0b2af11d99cfc53c3c711df4c07ad904d0eef853851fbb6a183eef54

Download Submit
C:\Windows\System\dISHqRl.exe

Filesize
1.6MB

MD5
32f568d7599905a74e13a83a67d6b715

SHA1
3d07a1820561bec1791d646c3432152e5c30a631

SHA256
36429f1287b74ce5a4571f60fd1f51fb8b7f2618a01f7f5dd8a61875af908db0

SHA512
8ae90c73ae8f421a40da127dece7b54ff8fa7b45367598768727c2437c5432d344b34fc7de2d7712fb317afb7239cb29082fd4b42ea83d3349ee836398d952e9

Download Submit
C:\Windows\System\dRRScGH.exe

Filesize
1.6MB

MD5
0faba831a0e30c5e9436b01af80fe0c8

SHA1
4e1664814d5a15dd17cb221098a017f0b4eaaca8

SHA256
9da2e695b30d7a048bae89ee64bbaee6acbb47b27dfa360236f64b0e9ec07c5c

SHA512
a50b81835b38ab1e2ca9e0ab79662dea9c20481d3e5b5b4db4236e5b732446bfd62afc5de825903ed7efe8425b74f5e1b3ffe8f6fd8240ffb38e26e849823fe1

Download Submit
C:\Windows\System\gSRfRMv.exe

Filesize
1.6MB

MD5
e73344e91854ea639b8ac9722da0c177

SHA1
28569791c7b50d568527d2b1f6f485dd533d2321

SHA256
9f053c9754a3b4c3a56d2a3aefa9586a33faf3cdfa919bbd19b0850d52a42b5e

SHA512
0fa6524bb5ff1a0cbd05b4e69f97e6dc96696f9af61ad6dc78f0751def8f8ebb0e30da7b7d377df075a51de2fe525a37fbe73fb1bd8ad2881061abadcca2084a

Download Submit
C:\Windows\System\ggHcuok.exe

Filesize
1.6MB

MD5
360054da73cd4f88f0d3226c536211c0

SHA1
6209e89c86698d226d7880f3b0cc961b5d2cc7e3

SHA256
145326ee7da573b05712960fbee54a454d3514f62045568c3974c34f6ec1473a

SHA512
ca2b6f58105aa20892e07ba52d740ff4c2c356494b7368601bc9387a0c1023d279c19b3cc7099ad9c56531c533c252d7613c522dfab30ab2fa79e9e29896836e

Download Submit
C:\Windows\System\gjpTqnn.exe

Filesize
1.6MB

MD5
61cf97f52fc58edda15a18ff253a3cb5

SHA1
14113bdc2b7a55b8c983c581d356783230a5eb93

SHA256
ee47ce5d191f6802f02ed4d91f78a7aba3ea821a7362d35a60ef35aeb8065989

SHA512
13eb25968bea35cfedced74b0dcca43317b43f3e8244616b9a7be7d3b1edd6c7d24a8f2f46657bb7db3c4478bd946c0f1708c29d710508aefb1f4ffbc5a2c7fd

Download Submit
C:\Windows\System\iUqBkdE.exe

Filesize
1.6MB

MD5
b966db5742a8ec28d15468a20cdc7f72

SHA1
120415651c37be18ec584cb111e363e52842960b

SHA256
363b57de1501b28fe4c0dfcb5ebb190dd6ae34808d6f18e3fe231859357cac5e

SHA512
35e5989ee3135fe0fe022f9171f08469f87cf46d008a961cd9581a9da27bd1af61865a38fb24aaf2fe6b91fdc0995d928426b2f3d336981a9e750c886896bc03

Download Submit
C:\Windows\System\lsPDGLo.exe

Filesize
1.6MB

MD5
bbe02c660403a614321c4caec2ad2b5a

SHA1
3978ab8a3b3521f32a72acb729d0fe103499d69f

SHA256
ea9e744fc6adb0938b216a649cc1e134c6e42cf3b0a2b4bf0cf3519fb23c4337

SHA512
30e4cf5ca739121870ae79543f752f762a5c70fa3b2b3ae2b171c20b29f18386afdc9d7922250cc442dbf9841b40aa0ee77d4bcaa5503b36fa929a8638f7618f

Download Submit
C:\Windows\System\mAhGcDg.exe

Filesize
1.6MB

MD5
c6fec514e2311253a966977ccf208aba

SHA1
bae20b38ebd9a47a69d3f1fe7fc0d07fd6a58426

SHA256
75baa8d8d29a96cd22e5236bd3b0385602a85912a69c6e2f79cf7b66b9e055d6

SHA512
91f63dc55cce44373e90c32352f23ef08cbdc7252a3201bbbb3d7695ebcbf7e22221f03ea693eb5737d1b1960c6611dc22fb093efa642ad5f698b4b9470492cf

Download Submit
C:\Windows\System\oRkHkZE.exe

Filesize
1.6MB

MD5
875584e377678c273c8933feaf139505

SHA1
61d62fc2376810ca85450be24bb500b3e3b4142c

SHA256
10db96aab986f12c2083f5f0449d7e714a2da7a658189c0b4d8f42e27e118e27

SHA512
075380835c016cd8c2a8eecee18b2f796a426cd7f016bab9b97db2acd147f6cca1b5aaec3343067bb3f5c678278da68f93fb2a9702619dbcf8b0436f71d5aafc

Download Submit
C:\Windows\System\oeYuePE.exe

Filesize
1.6MB

MD5
e7a1ae4c6efe9b2f7f14c17f8a4bb279

SHA1
db2968ab9e176af44e64d081e7a086338d2ccecd

SHA256
3696004aa22f4f29e5d7038ae9816a3f5e74cb485bde84e8e486a2778876d5f8

SHA512
4778462851cb290385e8f4e1ed73e5cdeaf50ad2fdd6086f2d491d3a6edb63e299ee2996bfa869135d6e30cba3fd774bb079bd99cd3c4c3db92e8cdbb339899b

Download Submit
C:\Windows\System\ofYbgOM.exe

Filesize
1.6MB

MD5
e196a02ce5c86aab7a108b3673cd8329

SHA1
6396716e8a48b8091d1f33e3cc96422eb32f9aa9

SHA256
cb426f9975bc9799313414a8b40b0cfcebd9543cd50691f23defa7fd97c423f3

SHA512
21a980a7b3834be4773470ed762ec52863de50c94fa9a456fe671606ef8468f14a84cad892abe569f393c9fcba5e43cd21522bd81cc359f7e0de5fdd74e0ea1a

Download Submit
C:\Windows\System\pkqiYHW.exe

Filesize
1.6MB

MD5
e0919f706f4268a735da7f48121150dd

SHA1
d059130c59355e0b4195348ab54d61f2683c680e

SHA256
f732671efcff05cdbf639ae565e859be01483d1642781f5fce6c4f585d9e3ec5

SHA512
a2cf786cfe2e41b16e1a5b6ff1d521c24fd641e7027a41fbbbdbdab33f0b86e34edb440ea608afc26c9bfbd329588f76ff669d28a63c1e5b7cd090dccdd1a307

Download Submit
C:\Windows\System\rYJYPGu.exe

Filesize
1.6MB

MD5
6d533e4b0ccd3cebf1d9d31914fa1e90

SHA1
098ea18b5a63813620f80a3004ecdda8c0734893

SHA256
3eef807c3cb4d728a58a204773876f8d7c5b364b46d66e4fda326b32daf1f41a

SHA512
3a7edfcf743f834030c4805363b9998590454b2d27a5ae408ad8bfbd1b90474507202205578de0be6dcf2e35e4ea9a2d4867461c4ad5d97663de8c3f7cb1b241

Download Submit
C:\Windows\System\sZuJFLX.exe

Filesize
1.6MB

MD5
657cc865278dd60e669cf4b0080f7cc5

SHA1
c831a0842d95ef02c5c4113aa1206eaa01efef9f

SHA256
5e966bf45c2b4df66d985c0d9470a8568af0d59c215901170612894d22e29450

SHA512
8a0db7415ee1d1f2f0d2a909cca3b8d36f705caf941d4c601bcd26b1061e19a3253123dc1547da9f3c257e89459c8ee08cc547742811fae5644a123af166be11

Download Submit
C:\Windows\System\svmfhPr.exe

Filesize
1.6MB

MD5
9fe5bdae92245be79d58ebfc3fdd213d

SHA1
507a6a780992024f85a8f94064d80184f96caa41

SHA256
36aea15272b5b27b21e6ef3bd55043e4847d9abed1354f9fdbdc5dd8687184d7

SHA512
21665a4bafdbfdaa9819d162702a084f9119ef7b147f0f774f65b6798b60d284ef99493424682dada1c3e2d8c6da551cbd1133cbb68f888df6eb1f923d9a8b09

Download Submit
C:\Windows\System\xuTitsS.exe

Filesize
1.6MB

MD5
5ac9cb070931103e8ede7c614501aea9

SHA1
6530550b576bad1241884ec1bf30899f067f84cf

SHA256
e78d37768b481186eff9118a3abadf9910c1529079bc574d4985761a26269b66

SHA512
98b87eaad2be6581127317c3c806a5af99b84ecb4a18eabfaf55a34621a291febd712f5079a269cdad005f4fff9729301275c99dae9b42c5526148d4f59e678b

Download Submit
C:\Windows\System\yYICYdZ.exe

Filesize
1.6MB

MD5
0cd0630016a27fce817522e89a22740b

SHA1
6e267a6751f63bd0ac0c91035a5925b2c2777478

SHA256
5a80dd9f8cd35e39931eb8f7320adfa8c2084536db5ea425a7dbd4cebde85b25

SHA512
1265913603adfe73c1f92383586eff6a654015565d5c50c770bc0fb680aa6f06f16506ccaa69e596dd25c23a327783032d4ee87073ca6ab5d0862aac1743462e

Download Submit
C:\Windows\System\zYxRbfc.exe

Filesize
1.6MB

MD5
0929e91d1f3670a7044c0f4a7efc25db

SHA1
8b4b0c8a5d101c5c73b787e15bc2333fc0db84ff

SHA256
12ea5f6058b5d2b972ea0677c43dd7ca3a72bd5297541287194e48cacc831665

SHA512
4dff0e43dfac6fe9aa34963c340513466fbb07d77092f7ead1250f22cd4f7b6d02178a4e87e9b5e730ad1f2500cda0d5ff5657af1799bd9ce781af2b73946e55

Download Submit
C:\Windows\System\zeUNNwJ.exe

Filesize
1.6MB

MD5
196cace438cf88b4a193df342a42e50c

SHA1
07ceeafa8ef82318b7809f6478d8853a536ec9be

SHA256
9c48274792eb8a220ab56552720d2e0b93e504cc5cd6dbb21811f48a6b452d98

SHA512
1d614febdbe41523fc4435fabe665e417a348a042421dbab53cee614ca837dc980d38707441d87ac33aa62a290b067b62d3cb3d51113892eabc5b3e40d9ebf75

Download Submit
C:\Windows\System\zubnjbU.exe

Filesize
1.6MB

MD5
9299e5a563c480aaad1524f203248edc

SHA1
543e6c7493972698f2925bf2e3971a865a2ba699

SHA256
99c4fec43294eeb1b83113ab05cbd7e9f91e0557ff694e82cf30b0e0c59a7579

SHA512
1ec2af1e91d396728c26befabfba579336c7d808b0e618039ba3c9d58785993cbcc97b443747656967cf353a29012564dbc618e3763284612d5fd348f706e56b

Download Submit
memory/388-2520-0x00007FF604C30000-0x00007FF605022000-memory.dmp

Filesize
3.9MB

Download
memory/388-420-0x00007FF604C30000-0x00007FF605022000-memory.dmp

Filesize
3.9MB

Download
memory/548-260-0x00007FF727250000-0x00007FF727642000-memory.dmp

Filesize
3.9MB

Download
memory/548-2498-0x00007FF727250000-0x00007FF727642000-memory.dmp

Filesize
3.9MB

Download
memory/688-595-0x00007FF7D6330000-0x00007FF7D6722000-memory.dmp

Filesize
3.9MB

Download
memory/688-2550-0x00007FF7D6330000-0x00007FF7D6722000-memory.dmp

Filesize
3.9MB

Download
memory/1260-588-0x00007FF631350000-0x00007FF631742000-memory.dmp

Filesize
3.9MB

Download
memory/1260-2514-0x00007FF631350000-0x00007FF631742000-memory.dmp

Filesize
3.9MB

Download
memory/1300-2510-0x00007FF73D8F0000-0x00007FF73DCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1300-589-0x00007FF73D8F0000-0x00007FF73DCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-1044-0x00007FF748150000-0x00007FF748542000-memory.dmp

Filesize
3.9MB

Download
memory/1636-2499-0x00007FF748150000-0x00007FF748542000-memory.dmp

Filesize
3.9MB

Download
memory/1872-2507-0x00007FF763450000-0x00007FF763842000-memory.dmp

Filesize
3.9MB

Download
memory/1872-312-0x00007FF763450000-0x00007FF763842000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1043-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/1972-78-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/1972-257-0x0000018D695A0000-0x0000018D695C2000-memory.dmp

Filesize
136KB

Download
memory/1972-1895-0x00007FFA45920000-0x00007FFA463E1000-memory.dmp

Filesize
10.8MB

Download
memory/1972-15-0x00007FFA45923000-0x00007FFA45925000-memory.dmp

Filesize
8KB

Download
memory/2192-594-0x00007FF6B4150000-0x00007FF6B4542000-memory.dmp

Filesize
3.9MB

Download
memory/2192-2532-0x00007FF6B4150000-0x00007FF6B4542000-memory.dmp

Filesize
3.9MB

Download
memory/2608-730-0x00007FF769A20000-0x00007FF769E12000-memory.dmp

Filesize
3.9MB

Download
memory/2608-2540-0x00007FF769A20000-0x00007FF769E12000-memory.dmp

Filesize
3.9MB

Download
memory/2648-2523-0x00007FF7842A0000-0x00007FF784692000-memory.dmp

Filesize
3.9MB

Download
memory/2648-591-0x00007FF7842A0000-0x00007FF784692000-memory.dmp

Filesize
3.9MB

Download
memory/2908-569-0x00007FF6AAFA0000-0x00007FF6AB392000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2521-0x00007FF6AAFA0000-0x00007FF6AB392000-memory.dmp

Filesize
3.9MB

Download
memory/2996-100-0x00007FF772230000-0x00007FF772622000-memory.dmp

Filesize
3.9MB

Download
memory/2996-2504-0x00007FF772230000-0x00007FF772622000-memory.dmp

Filesize
3.9MB

Download
memory/3416-2552-0x00007FF665DB0000-0x00007FF6661A2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-631-0x00007FF7155F0000-0x00007FF7159E2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-2544-0x00007FF7155F0000-0x00007FF7159E2000-memory.dmp

Filesize
3.9MB

Download
memory/3616-2517-0x00007FF733E00000-0x00007FF7341F2000-memory.dmp

Filesize
3.9MB

Download
memory/3616-592-0x00007FF733E00000-0x00007FF7341F2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-2537-0x00007FF714760000-0x00007FF714B52000-memory.dmp

Filesize
3.9MB

Download
memory/3904-829-0x00007FF714760000-0x00007FF714B52000-memory.dmp

Filesize
3.9MB

Download
memory/4084-1299-0x00007FF6CEB70000-0x00007FF6CEF62000-memory.dmp

Filesize
3.9MB

Download
memory/4084-2546-0x00007FF6CEB70000-0x00007FF6CEF62000-memory.dmp

Filesize
3.9MB

Download
memory/4316-188-0x00007FF79AF40000-0x00007FF79B332000-memory.dmp

Filesize
3.9MB

Download
memory/4316-2495-0x00007FF79AF40000-0x00007FF79B332000-memory.dmp

Filesize
3.9MB

Download
memory/4328-2511-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4328-411-0x00007FF7AB1F0000-0x00007FF7AB5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-2505-0x00007FF6F6AA0000-0x00007FF6F6E92000-memory.dmp

Filesize
3.9MB

Download
memory/4476-348-0x00007FF6F6AA0000-0x00007FF6F6E92000-memory.dmp

Filesize
3.9MB

Download
memory/4544-134-0x00007FF7D2FA0000-0x00007FF7D3392000-memory.dmp

Filesize
3.9MB

Download
memory/4544-2502-0x00007FF7D2FA0000-0x00007FF7D3392000-memory.dmp

Filesize
3.9MB

Download
memory/4568-593-0x00007FF6E6AA0000-0x00007FF6E6E92000-memory.dmp

Filesize
3.9MB

Download
memory/4568-2516-0x00007FF6E6AA0000-0x00007FF6E6E92000-memory.dmp

Filesize
3.9MB

Download
memory/4940-0-0x00007FF777F50000-0x00007FF778342000-memory.dmp

Filesize
3.9MB

Download
memory/4940-1-0x000001A299EB0000-0x000001A299EC0000-memory.dmp

Filesize
64KB

Download
memory/4992-13-0x00007FF649900000-0x00007FF649CF2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-2493-0x00007FF649900000-0x00007FF649CF2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-2491-0x00007FF649900000-0x00007FF649CF2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-2548-0x00007FF721B60000-0x00007FF721F52000-memory.dmp

Filesize
3.9MB

Download
memory/4996-590-0x00007FF721B60000-0x00007FF721F52000-memory.dmp

Filesize
3.9MB

Download