xmrig | c7988d0523ff3c7998fb986818d96d8a454fcc742127fb8aa125926630021c84

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
Size

1.4MB
MD5

63c33e41ba1a15f562ed52dd6ebee7e0
SHA1

5277e8bdb2b0dc0f70d5034c54b0bc7f3586f20e
SHA256

c7988d0523ff3c7998fb986818d96d8a454fcc742127fb8aa125926630021c84
SHA512

ca9c9f41f035379e0c1b4c93f475550b0985f0aaeb8f3c1bb90d3982383dfc653074b938652576a993300533eeda97a8697f4db7961d3a181a7f430967e189d4
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2wE:Lz071uv4BPMkFfdg6Nsg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2588-13-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2264-20-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2684-85-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2456-119-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2136-116-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2664-128-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/1736-114-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2884-112-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2188-110-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2408-109-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2284-107-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2416-96-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2684-4681-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2416-4717-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2456-4768-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2664-4832-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/1736-4774-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2136-4835-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2860-6343-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2588	ZnZJkhu.exe
2264	LxTubcz.exe
2684	MbRzKgs.exe
2416	PHdbFVr.exe
2284	nwRqhvg.exe
2408	qzWvdMC.exe
2188	zzNyMEW.exe
2884	ikkqueV.exe
1736	VrqTECu.exe
2136	jpQRhNy.exe
2456	wPRPxQn.exe
2664	hXXEOZm.exe
2736	TxyBWYW.exe
2740	jtefhTl.exe
356	nSDtpSX.exe
1844	YHSaXZR.exe
1572	oAXPGxa.exe
1856	wJpDhth.exe
1568	SydBoGZ.exe
1980	spBaypt.exe
2052	VHCnPsL.exe
324	PkDgHmB.exe
2332	RJnaZyL.exe
1780	NbwsAia.exe
636	nwXBCzc.exe
1052	PtUNGqj.exe
1108	BMlQmFy.exe
840	KDzqzVH.exe
2484	YheJteJ.exe
1484	BgMIYGa.exe
1792	SQfRoQF.exe
344	BucvxqI.exe
688	NPOKipC.exe
908	dZGdLvq.exe
704	gvNlEOJ.exe
2092	xiyAgnc.exe
1784	FoJvirI.exe
2964	dKCBUPX.exe
2116	zXcVNeo.exe
696	pRmZNZz.exe
760	YxQPZOw.exe
112	NvTarDT.exe
1680	XwUqVla.exe
2820	wCemANl.exe
1720	dvfwJAI.exe
1964	ePlXwjn.exe
724	DOeNmIb.exe
1924	KUSsXxQ.exe
1936	dAvEqrL.exe
880	YpNOWWR.exe
2472	OWDnUnE.exe
1664	SYqsKrG.exe
1524	RgPTInQ.exe
1528	xGbSQkq.exe
2260	vXLxueR.exe
2580	CYVfhZf.exe
2672	JxfaiJf.exe
2608	DCbwGea.exe
2528	yFiCvRp.exe
2452	tUVnmUc.exe
2404	GddaodC.exe
2148	aYDrOLx.exe
2648	CEspkOQ.exe
2744	DhmhMtp.exe

Loads dropped DLL 64 IoCs

pid	Process
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-1-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x000a000000016813-7.dat	upx
behavioral1/memory/2588-13-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x001800000000558a-17.dat	upx
behavioral1/memory/2264-20-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/files/0x0009000000016d0e-16.dat	upx
behavioral1/files/0x0007000000016d16-29.dat	upx
behavioral1/files/0x0007000000016d1f-31.dat	upx
behavioral1/files/0x0008000000016d36-39.dat	upx
behavioral1/files/0x0007000000016d32-35.dat	upx
behavioral1/files/0x00050000000186c1-57.dat	upx
behavioral1/files/0x0006000000018bba-77.dat	upx
behavioral1/memory/2684-85-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/files/0x00050000000191ed-102.dat	upx
behavioral1/files/0x000500000001934a-155.dat	upx
behavioral1/files/0x000500000001942c-191.dat	upx
behavioral1/files/0x000500000001947d-198.dat	upx
behavioral1/files/0x0005000000019248-178.dat	upx
behavioral1/files/0x0005000000019426-190.dat	upx
behavioral1/files/0x0005000000019417-183.dat	upx
behavioral1/files/0x00050000000193f4-175.dat	upx
behavioral1/files/0x002e000000016cf5-166.dat	upx
behavioral1/memory/2456-119-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x00050000000191eb-118.dat	upx
behavioral1/memory/2136-116-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x0005000000019233-160.dat	upx
behavioral1/files/0x0005000000019254-151.dat	upx
behavioral1/files/0x0005000000019235-150.dat	upx
behavioral1/files/0x000500000001935b-147.dat	upx
behavioral1/files/0x0005000000019223-142.dat	upx
behavioral1/files/0x0005000000019437-194.dat	upx
behavioral1/files/0x0005000000019331-140.dat	upx
behavioral1/files/0x0005000000019413-181.dat	upx
behavioral1/memory/2664-128-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/files/0x0005000000019227-127.dat	upx
behavioral1/files/0x00050000000193e2-171.dat	upx
behavioral1/files/0x000500000001936e-164.dat	upx
behavioral1/memory/1736-114-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2884-112-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/memory/2188-110-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2408-109-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2284-107-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2416-96-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x000500000001874c-73.dat	upx
behavioral1/files/0x000500000001874a-69.dat	upx
behavioral1/files/0x0005000000018700-65.dat	upx
behavioral1/files/0x00050000000186d3-61.dat	upx
behavioral1/files/0x000500000001865a-53.dat	upx
behavioral1/files/0x0008000000016d3a-49.dat	upx
behavioral1/memory/2684-4681-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2416-4717-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2456-4768-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2664-4832-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/1736-4774-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2136-4835-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2860-6343-0x000000013F060000-0x000000013F452000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RCiNCtx.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\ImtMMYN.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\mwNSRBJ.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\XdqDwdZ.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\YPrJAIL.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\XtvaftT.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\iwMdcUO.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\ziwbMeG.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\yuHuQgO.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\xgxPwCJ.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\EIsZwmM.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\sBzKFKF.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\GYuxcaR.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\JYElQBE.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\uaANDwh.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZqxiZJC.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\vGPbUPE.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\YWRkXGU.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\YGSYONH.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\gCMloHd.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\PcCBhuZ.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\OUmcsGv.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\paLOrss.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\UanNFTo.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\RWNposA.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\tRRalzi.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\qcVuroh.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\jMPJfou.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\PCVXjVX.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\Voxwkbd.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\suZnzro.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\iVoXTBh.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\VmrVODr.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\NKxwnck.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\DdEqlMy.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\sUQaqlG.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\kIOAjjG.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\mGzUqzS.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\mHGAVkR.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\BXEFUbd.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\psJtACV.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\wZZUHpD.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\MkmsJKR.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\AwLFraV.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\VJTDsYY.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\ydSIYlc.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\WugCBOK.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\JscpCYu.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\BpJTMjN.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\cWvTZPy.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\RupZnPH.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\AjhxCmx.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\WWQuWyW.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\LNxzuJG.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\wVrIoHH.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\tHnaknC.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\IgEeTNk.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\cdfYeDM.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\MgAQKNM.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\LXvJsbA.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\MDbqYsH.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\DzDNUMm.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\dVHsVeJ.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\UtedqgZ.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2912	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2912	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2912	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 2912	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 2912	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 2588	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	30
PID 2860 wrote to memory of 2588	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	30
PID 2860 wrote to memory of 2588	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	30
PID 2860 wrote to memory of 2264	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	31
PID 2860 wrote to memory of 2264	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	31
PID 2860 wrote to memory of 2264	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	31
PID 2860 wrote to memory of 2684	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	32
PID 2860 wrote to memory of 2684	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	32
PID 2860 wrote to memory of 2684	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	32
PID 2860 wrote to memory of 2416	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	33
PID 2860 wrote to memory of 2416	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	33
PID 2860 wrote to memory of 2416	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	33
PID 2860 wrote to memory of 2284	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	34
PID 2860 wrote to memory of 2284	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	34
PID 2860 wrote to memory of 2284	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	34
PID 2860 wrote to memory of 2188	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	35
PID 2860 wrote to memory of 2188	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	35
PID 2860 wrote to memory of 2188	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	35
PID 2860 wrote to memory of 2408	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	36
PID 2860 wrote to memory of 2408	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	36
PID 2860 wrote to memory of 2408	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	36
PID 2860 wrote to memory of 2884	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	37
PID 2860 wrote to memory of 2884	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	37
PID 2860 wrote to memory of 2884	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	37
PID 2860 wrote to memory of 1736	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	38
PID 2860 wrote to memory of 1736	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	38
PID 2860 wrote to memory of 1736	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	38
PID 2860 wrote to memory of 2136	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	39
PID 2860 wrote to memory of 2136	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	39
PID 2860 wrote to memory of 2136	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	39
PID 2860 wrote to memory of 2456	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	40
PID 2860 wrote to memory of 2456	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	40
PID 2860 wrote to memory of 2456	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	40
PID 2860 wrote to memory of 2664	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	41
PID 2860 wrote to memory of 2664	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	41
PID 2860 wrote to memory of 2664	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	41
PID 2860 wrote to memory of 2736	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	42
PID 2860 wrote to memory of 2736	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	42
PID 2860 wrote to memory of 2736	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	42
PID 2860 wrote to memory of 2740	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	43
PID 2860 wrote to memory of 2740	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	43
PID 2860 wrote to memory of 2740	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	43
PID 2860 wrote to memory of 356	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	44
PID 2860 wrote to memory of 356	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	44
PID 2860 wrote to memory of 356	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	44
PID 2860 wrote to memory of 1572	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	45
PID 2860 wrote to memory of 1572	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	45
PID 2860 wrote to memory of 1572	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	45
PID 2860 wrote to memory of 1844	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	46
PID 2860 wrote to memory of 1844	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	46
PID 2860 wrote to memory of 1844	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	46
PID 2860 wrote to memory of 1568	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	47
PID 2860 wrote to memory of 1568	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	47
PID 2860 wrote to memory of 1568	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	47
PID 2860 wrote to memory of 1856	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	48
PID 2860 wrote to memory of 1856	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	48
PID 2860 wrote to memory of 1856	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	48
PID 2860 wrote to memory of 2332	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	49
PID 2860 wrote to memory of 2332	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	49
PID 2860 wrote to memory of 2332	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	49
PID 2860 wrote to memory of 1980	2860	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System\ZnZJkhu.exe
  C:\Windows\System\ZnZJkhu.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\LxTubcz.exe
  C:\Windows\System\LxTubcz.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\MbRzKgs.exe
  C:\Windows\System\MbRzKgs.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\PHdbFVr.exe
  C:\Windows\System\PHdbFVr.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\nwRqhvg.exe
  C:\Windows\System\nwRqhvg.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\zzNyMEW.exe
  C:\Windows\System\zzNyMEW.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\qzWvdMC.exe
  C:\Windows\System\qzWvdMC.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\ikkqueV.exe
  C:\Windows\System\ikkqueV.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\VrqTECu.exe
  C:\Windows\System\VrqTECu.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\jpQRhNy.exe
  C:\Windows\System\jpQRhNy.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\wPRPxQn.exe
  C:\Windows\System\wPRPxQn.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\hXXEOZm.exe
  C:\Windows\System\hXXEOZm.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\TxyBWYW.exe
  C:\Windows\System\TxyBWYW.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\jtefhTl.exe
  C:\Windows\System\jtefhTl.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\nSDtpSX.exe
  C:\Windows\System\nSDtpSX.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\oAXPGxa.exe
  C:\Windows\System\oAXPGxa.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\YHSaXZR.exe
  C:\Windows\System\YHSaXZR.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\SydBoGZ.exe
  C:\Windows\System\SydBoGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\wJpDhth.exe
  C:\Windows\System\wJpDhth.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\RJnaZyL.exe
  C:\Windows\System\RJnaZyL.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\spBaypt.exe
  C:\Windows\System\spBaypt.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\PtUNGqj.exe
  C:\Windows\System\PtUNGqj.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\VHCnPsL.exe
  C:\Windows\System\VHCnPsL.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\YheJteJ.exe
  C:\Windows\System\YheJteJ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\PkDgHmB.exe
  C:\Windows\System\PkDgHmB.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\NPOKipC.exe
  C:\Windows\System\NPOKipC.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\NbwsAia.exe
  C:\Windows\System\NbwsAia.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\FoJvirI.exe
  C:\Windows\System\FoJvirI.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\nwXBCzc.exe
  C:\Windows\System\nwXBCzc.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\dKCBUPX.exe
  C:\Windows\System\dKCBUPX.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\BMlQmFy.exe
  C:\Windows\System\BMlQmFy.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\zXcVNeo.exe
  C:\Windows\System\zXcVNeo.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\KDzqzVH.exe
  C:\Windows\System\KDzqzVH.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\pRmZNZz.exe
  C:\Windows\System\pRmZNZz.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\BgMIYGa.exe
  C:\Windows\System\BgMIYGa.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\YxQPZOw.exe
  C:\Windows\System\YxQPZOw.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\SQfRoQF.exe
  C:\Windows\System\SQfRoQF.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\NvTarDT.exe
  C:\Windows\System\NvTarDT.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\BucvxqI.exe
  C:\Windows\System\BucvxqI.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\XwUqVla.exe
  C:\Windows\System\XwUqVla.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\dZGdLvq.exe
  C:\Windows\System\dZGdLvq.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\wCemANl.exe
  C:\Windows\System\wCemANl.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\gvNlEOJ.exe
  C:\Windows\System\gvNlEOJ.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\dvfwJAI.exe
  C:\Windows\System\dvfwJAI.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\xiyAgnc.exe
  C:\Windows\System\xiyAgnc.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\ePlXwjn.exe
  C:\Windows\System\ePlXwjn.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\DOeNmIb.exe
  C:\Windows\System\DOeNmIb.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\KUSsXxQ.exe
  C:\Windows\System\KUSsXxQ.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\dAvEqrL.exe
  C:\Windows\System\dAvEqrL.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\YpNOWWR.exe
  C:\Windows\System\YpNOWWR.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\OWDnUnE.exe
  C:\Windows\System\OWDnUnE.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\SYqsKrG.exe
  C:\Windows\System\SYqsKrG.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\RgPTInQ.exe
  C:\Windows\System\RgPTInQ.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\xGbSQkq.exe
  C:\Windows\System\xGbSQkq.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\vXLxueR.exe
  C:\Windows\System\vXLxueR.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\CYVfhZf.exe
  C:\Windows\System\CYVfhZf.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\JxfaiJf.exe
  C:\Windows\System\JxfaiJf.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\DCbwGea.exe
  C:\Windows\System\DCbwGea.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\yFiCvRp.exe
  C:\Windows\System\yFiCvRp.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\tUVnmUc.exe
  C:\Windows\System\tUVnmUc.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\GddaodC.exe
  C:\Windows\System\GddaodC.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\aYDrOLx.exe
  C:\Windows\System\aYDrOLx.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\CEspkOQ.exe
  C:\Windows\System\CEspkOQ.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\DhmhMtp.exe
  C:\Windows\System\DhmhMtp.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\gVxenEc.exe
  C:\Windows\System\gVxenEc.exe
  2⤵
  PID:1488
- C:\Windows\System\pompBQN.exe
  C:\Windows\System\pompBQN.exe
  2⤵
  PID:1452
- C:\Windows\System\aIbuLbR.exe
  C:\Windows\System\aIbuLbR.exe
  2⤵
  PID:2276
- C:\Windows\System\tMwiGDS.exe
  C:\Windows\System\tMwiGDS.exe
  2⤵
  PID:500
- C:\Windows\System\hrRFFem.exe
  C:\Windows\System\hrRFFem.exe
  2⤵
  PID:1420
- C:\Windows\System\McKhWep.exe
  C:\Windows\System\McKhWep.exe
  2⤵
  PID:2216
- C:\Windows\System\xyChxnC.exe
  C:\Windows\System\xyChxnC.exe
  2⤵
  PID:2248
- C:\Windows\System\YOzCIRm.exe
  C:\Windows\System\YOzCIRm.exe
  2⤵
  PID:568
- C:\Windows\System\MyHMXVw.exe
  C:\Windows\System\MyHMXVw.exe
  2⤵
  PID:2628
- C:\Windows\System\EIulGwK.exe
  C:\Windows\System\EIulGwK.exe
  2⤵
  PID:1904
- C:\Windows\System\oFAMHqj.exe
  C:\Windows\System\oFAMHqj.exe
  2⤵
  PID:800
- C:\Windows\System\lsZjcfK.exe
  C:\Windows\System\lsZjcfK.exe
  2⤵
  PID:1472
- C:\Windows\System\xbSoMhj.exe
  C:\Windows\System\xbSoMhj.exe
  2⤵
  PID:1772
- C:\Windows\System\HSQoawS.exe
  C:\Windows\System\HSQoawS.exe
  2⤵
  PID:2944
- C:\Windows\System\nMPJzkN.exe
  C:\Windows\System\nMPJzkN.exe
  2⤵
  PID:612
- C:\Windows\System\qsqNTVp.exe
  C:\Windows\System\qsqNTVp.exe
  2⤵
  PID:1708
- C:\Windows\System\NQrwFIU.exe
  C:\Windows\System\NQrwFIU.exe
  2⤵
  PID:1600
- C:\Windows\System\eKxngZt.exe
  C:\Windows\System\eKxngZt.exe
  2⤵
  PID:1932
- C:\Windows\System\bJXYyVq.exe
  C:\Windows\System\bJXYyVq.exe
  2⤵
  PID:3028
- C:\Windows\System\rylESzF.exe
  C:\Windows\System\rylESzF.exe
  2⤵
  PID:2708
- C:\Windows\System\rgqPlRh.exe
  C:\Windows\System\rgqPlRh.exe
  2⤵
  PID:2340
- C:\Windows\System\elnYGVQ.exe
  C:\Windows\System\elnYGVQ.exe
  2⤵
  PID:2220
- C:\Windows\System\fhdTLOO.exe
  C:\Windows\System\fhdTLOO.exe
  2⤵
  PID:592
- C:\Windows\System\dUooSdF.exe
  C:\Windows\System\dUooSdF.exe
  2⤵
  PID:1728
- C:\Windows\System\azOjdfp.exe
  C:\Windows\System\azOjdfp.exe
  2⤵
  PID:1320
- C:\Windows\System\KEPivRJ.exe
  C:\Windows\System\KEPivRJ.exe
  2⤵
  PID:2808
- C:\Windows\System\AKRsKwN.exe
  C:\Windows\System\AKRsKwN.exe
  2⤵
  PID:580
- C:\Windows\System\UVhbobO.exe
  C:\Windows\System\UVhbobO.exe
  2⤵
  PID:1644
- C:\Windows\System\kfVviDr.exe
  C:\Windows\System\kfVviDr.exe
  2⤵
  PID:1996
- C:\Windows\System\gPaQMuP.exe
  C:\Windows\System\gPaQMuP.exe
  2⤵
  PID:1432
- C:\Windows\System\QtXpjfd.exe
  C:\Windows\System\QtXpjfd.exe
  2⤵
  PID:2732
- C:\Windows\System\CeQuwRJ.exe
  C:\Windows\System\CeQuwRJ.exe
  2⤵
  PID:1584
- C:\Windows\System\XcrOhvC.exe
  C:\Windows\System\XcrOhvC.exe
  2⤵
  PID:2060
- C:\Windows\System\ScecSVw.exe
  C:\Windows\System\ScecSVw.exe
  2⤵
  PID:1916
- C:\Windows\System\KVfLYKh.exe
  C:\Windows\System\KVfLYKh.exe
  2⤵
  PID:2856
- C:\Windows\System\YgrtYkZ.exe
  C:\Windows\System\YgrtYkZ.exe
  2⤵
  PID:2980
- C:\Windows\System\MJTSjpk.exe
  C:\Windows\System\MJTSjpk.exe
  2⤵
  PID:756
- C:\Windows\System\QTpvXlc.exe
  C:\Windows\System\QTpvXlc.exe
  2⤵
  PID:1920
- C:\Windows\System\kmIeWDP.exe
  C:\Windows\System\kmIeWDP.exe
  2⤵
  PID:2084
- C:\Windows\System\QSBCqqu.exe
  C:\Windows\System\QSBCqqu.exe
  2⤵
  PID:2904
- C:\Windows\System\wteYDnj.exe
  C:\Windows\System\wteYDnj.exe
  2⤵
  PID:2960
- C:\Windows\System\SDkQDnp.exe
  C:\Windows\System\SDkQDnp.exe
  2⤵
  PID:3044
- C:\Windows\System\wlvzAzV.exe
  C:\Windows\System\wlvzAzV.exe
  2⤵
  PID:2108
- C:\Windows\System\MFrcrAT.exe
  C:\Windows\System\MFrcrAT.exe
  2⤵
  PID:1416
- C:\Windows\System\SsLjFcn.exe
  C:\Windows\System\SsLjFcn.exe
  2⤵
  PID:2040
- C:\Windows\System\VAFCOCI.exe
  C:\Windows\System\VAFCOCI.exe
  2⤵
  PID:2752
- C:\Windows\System\SOqkXlV.exe
  C:\Windows\System\SOqkXlV.exe
  2⤵
  PID:1968
- C:\Windows\System\gFsJiNQ.exe
  C:\Windows\System\gFsJiNQ.exe
  2⤵
  PID:2168
- C:\Windows\System\sLlpPHU.exe
  C:\Windows\System\sLlpPHU.exe
  2⤵
  PID:2520
- C:\Windows\System\XZzAyZk.exe
  C:\Windows\System\XZzAyZk.exe
  2⤵
  PID:2516
- C:\Windows\System\Eudspkv.exe
  C:\Windows\System\Eudspkv.exe
  2⤵
  PID:2760
- C:\Windows\System\irJlWsG.exe
  C:\Windows\System\irJlWsG.exe
  2⤵
  PID:2444
- C:\Windows\System\JFPyITc.exe
  C:\Windows\System\JFPyITc.exe
  2⤵
  PID:2880
- C:\Windows\System\GcyMTDE.exe
  C:\Windows\System\GcyMTDE.exe
  2⤵
  PID:2376
- C:\Windows\System\NKdJeVP.exe
  C:\Windows\System\NKdJeVP.exe
  2⤵
  PID:556
- C:\Windows\System\FTPnpMR.exe
  C:\Windows\System\FTPnpMR.exe
  2⤵
  PID:2180
- C:\Windows\System\WUpCFDj.exe
  C:\Windows\System\WUpCFDj.exe
  2⤵
  PID:1748
- C:\Windows\System\ZhTapkN.exe
  C:\Windows\System\ZhTapkN.exe
  2⤵
  PID:2424
- C:\Windows\System\SNvlPSo.exe
  C:\Windows\System\SNvlPSo.exe
  2⤵
  PID:2512
- C:\Windows\System\QpTMQmK.exe
  C:\Windows\System\QpTMQmK.exe
  2⤵
  PID:3088
- C:\Windows\System\tLsBAlo.exe
  C:\Windows\System\tLsBAlo.exe
  2⤵
  PID:3104
- C:\Windows\System\NNpgDQh.exe
  C:\Windows\System\NNpgDQh.exe
  2⤵
  PID:3120
- C:\Windows\System\qbyQMQs.exe
  C:\Windows\System\qbyQMQs.exe
  2⤵
  PID:3136
- C:\Windows\System\KiJwpuF.exe
  C:\Windows\System\KiJwpuF.exe
  2⤵
  PID:3152
- C:\Windows\System\nEyRkiV.exe
  C:\Windows\System\nEyRkiV.exe
  2⤵
  PID:3168
- C:\Windows\System\UDzYCZP.exe
  C:\Windows\System\UDzYCZP.exe
  2⤵
  PID:3184
- C:\Windows\System\GZXWvrC.exe
  C:\Windows\System\GZXWvrC.exe
  2⤵
  PID:3200
- C:\Windows\System\jaTbQls.exe
  C:\Windows\System\jaTbQls.exe
  2⤵
  PID:3216
- C:\Windows\System\cFQlRKp.exe
  C:\Windows\System\cFQlRKp.exe
  2⤵
  PID:3232
- C:\Windows\System\IbEmagX.exe
  C:\Windows\System\IbEmagX.exe
  2⤵
  PID:3248
- C:\Windows\System\oHUeLqV.exe
  C:\Windows\System\oHUeLqV.exe
  2⤵
  PID:3264
- C:\Windows\System\rnmSUex.exe
  C:\Windows\System\rnmSUex.exe
  2⤵
  PID:3280
- C:\Windows\System\niljkTA.exe
  C:\Windows\System\niljkTA.exe
  2⤵
  PID:3296
- C:\Windows\System\TDLhTxf.exe
  C:\Windows\System\TDLhTxf.exe
  2⤵
  PID:3312
- C:\Windows\System\hFqAZVw.exe
  C:\Windows\System\hFqAZVw.exe
  2⤵
  PID:3328
- C:\Windows\System\sLrozgQ.exe
  C:\Windows\System\sLrozgQ.exe
  2⤵
  PID:3344
- C:\Windows\System\NgFDIOJ.exe
  C:\Windows\System\NgFDIOJ.exe
  2⤵
  PID:3360
- C:\Windows\System\KhfEMli.exe
  C:\Windows\System\KhfEMli.exe
  2⤵
  PID:3376
- C:\Windows\System\kIIczFd.exe
  C:\Windows\System\kIIczFd.exe
  2⤵
  PID:3392
- C:\Windows\System\lHTwHnV.exe
  C:\Windows\System\lHTwHnV.exe
  2⤵
  PID:3408
- C:\Windows\System\CVRMcvH.exe
  C:\Windows\System\CVRMcvH.exe
  2⤵
  PID:3424
- C:\Windows\System\bWUlIFq.exe
  C:\Windows\System\bWUlIFq.exe
  2⤵
  PID:3440
- C:\Windows\System\EVbgXLo.exe
  C:\Windows\System\EVbgXLo.exe
  2⤵
  PID:3456
- C:\Windows\System\AYfcpjS.exe
  C:\Windows\System\AYfcpjS.exe
  2⤵
  PID:3664
- C:\Windows\System\sSSYbgN.exe
  C:\Windows\System\sSSYbgN.exe
  2⤵
  PID:3816
- C:\Windows\System\oyGqATT.exe
  C:\Windows\System\oyGqATT.exe
  2⤵
  PID:3832
- C:\Windows\System\UtRZgST.exe
  C:\Windows\System\UtRZgST.exe
  2⤵
  PID:3848
- C:\Windows\System\HlwrhaW.exe
  C:\Windows\System\HlwrhaW.exe
  2⤵
  PID:3864
- C:\Windows\System\jWGsqPE.exe
  C:\Windows\System\jWGsqPE.exe
  2⤵
  PID:3880
- C:\Windows\System\QJPrAxt.exe
  C:\Windows\System\QJPrAxt.exe
  2⤵
  PID:3916
- C:\Windows\System\VBmATIl.exe
  C:\Windows\System\VBmATIl.exe
  2⤵
  PID:3952
- C:\Windows\System\SDCejNv.exe
  C:\Windows\System\SDCejNv.exe
  2⤵
  PID:3972
- C:\Windows\System\itWWeHr.exe
  C:\Windows\System\itWWeHr.exe
  2⤵
  PID:3992
- C:\Windows\System\uInGeIe.exe
  C:\Windows\System\uInGeIe.exe
  2⤵
  PID:4008
- C:\Windows\System\eCFbVhL.exe
  C:\Windows\System\eCFbVhL.exe
  2⤵
  PID:4036
- C:\Windows\System\WMiDChu.exe
  C:\Windows\System\WMiDChu.exe
  2⤵
  PID:4052
- C:\Windows\System\EiIotlg.exe
  C:\Windows\System\EiIotlg.exe
  2⤵
  PID:4072
- C:\Windows\System\jCVfbjs.exe
  C:\Windows\System\jCVfbjs.exe
  2⤵
  PID:4092
- C:\Windows\System\Axpnsjp.exe
  C:\Windows\System\Axpnsjp.exe
  2⤵
  PID:748
- C:\Windows\System\rpftBNP.exe
  C:\Windows\System\rpftBNP.exe
  2⤵
  PID:2076
- C:\Windows\System\pxVcNbf.exe
  C:\Windows\System\pxVcNbf.exe
  2⤵
  PID:3008
- C:\Windows\System\igYrRiO.exe
  C:\Windows\System\igYrRiO.exe
  2⤵
  PID:1840
- C:\Windows\System\bHLARHh.exe
  C:\Windows\System\bHLARHh.exe
  2⤵
  PID:2600
- C:\Windows\System\qTxbPvH.exe
  C:\Windows\System\qTxbPvH.exe
  2⤵
  PID:2756
- C:\Windows\System\TFiIYrO.exe
  C:\Windows\System\TFiIYrO.exe
  2⤵
  PID:2940
- C:\Windows\System\GUYWiyG.exe
  C:\Windows\System\GUYWiyG.exe
  2⤵
  PID:2804
- C:\Windows\System\DrsmHhG.exe
  C:\Windows\System\DrsmHhG.exe
  2⤵
  PID:3112
- C:\Windows\System\LkzqsSJ.exe
  C:\Windows\System\LkzqsSJ.exe
  2⤵
  PID:3144
- C:\Windows\System\dsYeCPn.exe
  C:\Windows\System\dsYeCPn.exe
  2⤵
  PID:2800
- C:\Windows\System\IjyLBET.exe
  C:\Windows\System\IjyLBET.exe
  2⤵
  PID:2400
- C:\Windows\System\UwrpCiX.exe
  C:\Windows\System\UwrpCiX.exe
  2⤵
  PID:3224
- C:\Windows\System\MNBWYFE.exe
  C:\Windows\System\MNBWYFE.exe
  2⤵
  PID:3260
- C:\Windows\System\jPrExtw.exe
  C:\Windows\System\jPrExtw.exe
  2⤵
  PID:3304
- C:\Windows\System\rIcupWz.exe
  C:\Windows\System\rIcupWz.exe
  2⤵
  PID:3308
- C:\Windows\System\jdXclCL.exe
  C:\Windows\System\jdXclCL.exe
  2⤵
  PID:3340
- C:\Windows\System\SwksPPM.exe
  C:\Windows\System\SwksPPM.exe
  2⤵
  PID:3372
- C:\Windows\System\OkeeoXE.exe
  C:\Windows\System\OkeeoXE.exe
  2⤵
  PID:3400
- C:\Windows\System\WnZhEMR.exe
  C:\Windows\System\WnZhEMR.exe
  2⤵
  PID:3420
- C:\Windows\System\eGqMQPA.exe
  C:\Windows\System\eGqMQPA.exe
  2⤵
  PID:3464
- C:\Windows\System\aspmIlo.exe
  C:\Windows\System\aspmIlo.exe
  2⤵
  PID:3480
- C:\Windows\System\wUnkWxl.exe
  C:\Windows\System\wUnkWxl.exe
  2⤵
  PID:3496
- C:\Windows\System\gbqkYLF.exe
  C:\Windows\System\gbqkYLF.exe
  2⤵
  PID:3512
- C:\Windows\System\vtODHFM.exe
  C:\Windows\System\vtODHFM.exe
  2⤵
  PID:3528
- C:\Windows\System\JPabUWK.exe
  C:\Windows\System\JPabUWK.exe
  2⤵
  PID:3568
- C:\Windows\System\ChfDAWS.exe
  C:\Windows\System\ChfDAWS.exe
  2⤵
  PID:3584
- C:\Windows\System\GwAuWIP.exe
  C:\Windows\System\GwAuWIP.exe
  2⤵
  PID:3608
- C:\Windows\System\CjoKBVH.exe
  C:\Windows\System\CjoKBVH.exe
  2⤵
  PID:3624
- C:\Windows\System\nCvnhJW.exe
  C:\Windows\System\nCvnhJW.exe
  2⤵
  PID:3640
- C:\Windows\System\uJbjrDE.exe
  C:\Windows\System\uJbjrDE.exe
  2⤵
  PID:3648
- C:\Windows\System\kNznmvb.exe
  C:\Windows\System\kNznmvb.exe
  2⤵
  PID:1700
- C:\Windows\System\cBixuBY.exe
  C:\Windows\System\cBixuBY.exe
  2⤵
  PID:3672
- C:\Windows\System\dVjLcJf.exe
  C:\Windows\System\dVjLcJf.exe
  2⤵
  PID:3692
- C:\Windows\System\RfmUxqF.exe
  C:\Windows\System\RfmUxqF.exe
  2⤵
  PID:3712
- C:\Windows\System\sqbYnUT.exe
  C:\Windows\System\sqbYnUT.exe
  2⤵
  PID:3724
- C:\Windows\System\uwCobUO.exe
  C:\Windows\System\uwCobUO.exe
  2⤵
  PID:3740
- C:\Windows\System\YnnrlZk.exe
  C:\Windows\System\YnnrlZk.exe
  2⤵
  PID:3760
- C:\Windows\System\hLsNTMe.exe
  C:\Windows\System\hLsNTMe.exe
  2⤵
  PID:3776
- C:\Windows\System\LVPegqk.exe
  C:\Windows\System\LVPegqk.exe
  2⤵
  PID:3792
- C:\Windows\System\ApyEvSN.exe
  C:\Windows\System\ApyEvSN.exe
  2⤵
  PID:3812
- C:\Windows\System\CmuyIYN.exe
  C:\Windows\System\CmuyIYN.exe
  2⤵
  PID:3856
- C:\Windows\System\uIrzBtn.exe
  C:\Windows\System\uIrzBtn.exe
  2⤵
  PID:2476
- C:\Windows\System\xQWiwRh.exe
  C:\Windows\System\xQWiwRh.exe
  2⤵
  PID:3892
- C:\Windows\System\sEtkNoD.exe
  C:\Windows\System\sEtkNoD.exe
  2⤵
  PID:3876
- C:\Windows\System\xsrPIWd.exe
  C:\Windows\System\xsrPIWd.exe
  2⤵
  PID:3908
- C:\Windows\System\DUruNZb.exe
  C:\Windows\System\DUruNZb.exe
  2⤵
  PID:3932
- C:\Windows\System\SoCvLPn.exe
  C:\Windows\System\SoCvLPn.exe
  2⤵
  PID:3928
- C:\Windows\System\ljRtAOm.exe
  C:\Windows\System\ljRtAOm.exe
  2⤵
  PID:3000
- C:\Windows\System\WXyWRuy.exe
  C:\Windows\System\WXyWRuy.exe
  2⤵
  PID:2948
- C:\Windows\System\azYqBjy.exe
  C:\Windows\System\azYqBjy.exe
  2⤵
  PID:488
- C:\Windows\System\OQmJfwF.exe
  C:\Windows\System\OQmJfwF.exe
  2⤵
  PID:1468
- C:\Windows\System\KSlMXmG.exe
  C:\Windows\System\KSlMXmG.exe
  2⤵
  PID:3984
- C:\Windows\System\KqzHlXj.exe
  C:\Windows\System\KqzHlXj.exe
  2⤵
  PID:2816
- C:\Windows\System\AXjXLGx.exe
  C:\Windows\System\AXjXLGx.exe
  2⤵
  PID:1460
- C:\Windows\System\wJVfIXx.exe
  C:\Windows\System\wJVfIXx.exe
  2⤵
  PID:1604
- C:\Windows\System\kyMdRZp.exe
  C:\Windows\System\kyMdRZp.exe
  2⤵
  PID:4020
- C:\Windows\System\PVbuDfr.exe
  C:\Windows\System\PVbuDfr.exe
  2⤵
  PID:4064
- C:\Windows\System\WmWQqGr.exe
  C:\Windows\System\WmWQqGr.exe
  2⤵
  PID:4088
- C:\Windows\System\LbctiCP.exe
  C:\Windows\System\LbctiCP.exe
  2⤵
  PID:1036
- C:\Windows\System\YFDINFz.exe
  C:\Windows\System\YFDINFz.exe
  2⤵
  PID:1292
- C:\Windows\System\MWrogSL.exe
  C:\Windows\System\MWrogSL.exe
  2⤵
  PID:1628
- C:\Windows\System\AhVNaWI.exe
  C:\Windows\System\AhVNaWI.exe
  2⤵
  PID:2508
- C:\Windows\System\LHOeTOm.exe
  C:\Windows\System\LHOeTOm.exe
  2⤵
  PID:2704
- C:\Windows\System\pgNKbpd.exe
  C:\Windows\System\pgNKbpd.exe
  2⤵
  PID:3368
- C:\Windows\System\LnzEIlE.exe
  C:\Windows\System\LnzEIlE.exe
  2⤵
  PID:3384
- C:\Windows\System\yAutLbD.exe
  C:\Windows\System\yAutLbD.exe
  2⤵
  PID:3492
- C:\Windows\System\MCzJdSM.exe
  C:\Windows\System\MCzJdSM.exe
  2⤵
  PID:3508
- C:\Windows\System\BpcLhTe.exe
  C:\Windows\System\BpcLhTe.exe
  2⤵
  PID:3548
- C:\Windows\System\CSXrDuQ.exe
  C:\Windows\System\CSXrDuQ.exe
  2⤵
  PID:3564
- C:\Windows\System\VveaXyE.exe
  C:\Windows\System\VveaXyE.exe
  2⤵
  PID:3596
- C:\Windows\System\rLvAEyQ.exe
  C:\Windows\System\rLvAEyQ.exe
  2⤵
  PID:3520
- C:\Windows\System\uAHkHkI.exe
  C:\Windows\System\uAHkHkI.exe
  2⤵
  PID:3652
- C:\Windows\System\dkEGSYJ.exe
  C:\Windows\System\dkEGSYJ.exe
  2⤵
  PID:3700
- C:\Windows\System\FonhKGE.exe
  C:\Windows\System\FonhKGE.exe
  2⤵
  PID:3704
- C:\Windows\System\zrYmOWR.exe
  C:\Windows\System\zrYmOWR.exe
  2⤵
  PID:3732
- C:\Windows\System\CnNImxf.exe
  C:\Windows\System\CnNImxf.exe
  2⤵
  PID:384
- C:\Windows\System\pUUkGHo.exe
  C:\Windows\System\pUUkGHo.exe
  2⤵
  PID:3872
- C:\Windows\System\lAdNwOu.exe
  C:\Windows\System\lAdNwOu.exe
  2⤵
  PID:3632
- C:\Windows\System\JirsNIa.exe
  C:\Windows\System\JirsNIa.exe
  2⤵
  PID:3752
- C:\Windows\System\YzDNuCv.exe
  C:\Windows\System\YzDNuCv.exe
  2⤵
  PID:3840
- C:\Windows\System\VSTZeyB.exe
  C:\Windows\System\VSTZeyB.exe
  2⤵
  PID:2428
- C:\Windows\System\dzclUdy.exe
  C:\Windows\System\dzclUdy.exe
  2⤵
  PID:2020
- C:\Windows\System\WXmzalc.exe
  C:\Windows\System\WXmzalc.exe
  2⤵
  PID:4016
- C:\Windows\System\bAdhUlz.exe
  C:\Windows\System\bAdhUlz.exe
  2⤵
  PID:4068
- C:\Windows\System\AtVBzjX.exe
  C:\Windows\System\AtVBzjX.exe
  2⤵
  PID:1788
- C:\Windows\System\JmGMRxG.exe
  C:\Windows\System\JmGMRxG.exe
  2⤵
  PID:1564
- C:\Windows\System\MNAnmoq.exe
  C:\Windows\System\MNAnmoq.exe
  2⤵
  PID:3084
- C:\Windows\System\KkQRKUt.exe
  C:\Windows\System\KkQRKUt.exe
  2⤵
  PID:3100
- C:\Windows\System\TiRhxBh.exe
  C:\Windows\System\TiRhxBh.exe
  2⤵
  PID:3160
- C:\Windows\System\htPNvNo.exe
  C:\Windows\System\htPNvNo.exe
  2⤵
  PID:3324
- C:\Windows\System\cToeuHX.exe
  C:\Windows\System\cToeuHX.exe
  2⤵
  PID:1576
- C:\Windows\System\CADWXBJ.exe
  C:\Windows\System\CADWXBJ.exe
  2⤵
  PID:3588
- C:\Windows\System\OJHflBc.exe
  C:\Windows\System\OJHflBc.exe
  2⤵
  PID:3824
- C:\Windows\System\snUubAG.exe
  C:\Windows\System\snUubAG.exe
  2⤵
  PID:3860
- C:\Windows\System\SSeGSaj.exe
  C:\Windows\System\SSeGSaj.exe
  2⤵
  PID:3748
- C:\Windows\System\nUstWwL.exe
  C:\Windows\System\nUstWwL.exe
  2⤵
  PID:912
- C:\Windows\System\eFEIRBe.exe
  C:\Windows\System\eFEIRBe.exe
  2⤵
  PID:3620
- C:\Windows\System\owWQVoi.exe
  C:\Windows\System\owWQVoi.exe
  2⤵
  PID:3688
- C:\Windows\System\MrbZJoJ.exe
  C:\Windows\System\MrbZJoJ.exe
  2⤵
  PID:3948
- C:\Windows\System\QHNwkhl.exe
  C:\Windows\System\QHNwkhl.exe
  2⤵
  PID:3080
- C:\Windows\System\bPrDpog.exe
  C:\Windows\System\bPrDpog.exe
  2⤵
  PID:1480
- C:\Windows\System\PWrUTNQ.exe
  C:\Windows\System\PWrUTNQ.exe
  2⤵
  PID:3804
- C:\Windows\System\GuhGMRR.exe
  C:\Windows\System\GuhGMRR.exe
  2⤵
  PID:2256
- C:\Windows\System\dbcNUvf.exe
  C:\Windows\System\dbcNUvf.exe
  2⤵
  PID:2660
- C:\Windows\System\NTurHjh.exe
  C:\Windows\System\NTurHjh.exe
  2⤵
  PID:1268
- C:\Windows\System\qUveVNq.exe
  C:\Windows\System\qUveVNq.exe
  2⤵
  PID:3988
- C:\Windows\System\PROCiHe.exe
  C:\Windows\System\PROCiHe.exe
  2⤵
  PID:2300
- C:\Windows\System\Llzmwcp.exe
  C:\Windows\System\Llzmwcp.exe
  2⤵
  PID:3580
- C:\Windows\System\nxmTrSa.exe
  C:\Windows\System\nxmTrSa.exe
  2⤵
  PID:3540
- C:\Windows\System\fkaWvif.exe
  C:\Windows\System\fkaWvif.exe
  2⤵
  PID:3768
- C:\Windows\System\zafpWtR.exe
  C:\Windows\System\zafpWtR.exe
  2⤵
  PID:3616
- C:\Windows\System\dVSqwWY.exe
  C:\Windows\System\dVSqwWY.exe
  2⤵
  PID:2544
- C:\Windows\System\HsyReQA.exe
  C:\Windows\System\HsyReQA.exe
  2⤵
  PID:3452
- C:\Windows\System\ugVYiLc.exe
  C:\Windows\System\ugVYiLc.exe
  2⤵
  PID:2632
- C:\Windows\System\geXPUMF.exe
  C:\Windows\System\geXPUMF.exe
  2⤵
  PID:3212
- C:\Windows\System\TMeqkQp.exe
  C:\Windows\System\TMeqkQp.exe
  2⤵
  PID:2796
- C:\Windows\System\vaYaoCF.exe
  C:\Windows\System\vaYaoCF.exe
  2⤵
  PID:864
- C:\Windows\System\ttwcXEx.exe
  C:\Windows\System\ttwcXEx.exe
  2⤵
  PID:856
- C:\Windows\System\VvybNqq.exe
  C:\Windows\System\VvybNqq.exe
  2⤵
  PID:4032
- C:\Windows\System\IWydaCG.exe
  C:\Windows\System\IWydaCG.exe
  2⤵
  PID:3808
- C:\Windows\System\YRkglMN.exe
  C:\Windows\System\YRkglMN.exe
  2⤵
  PID:2900
- C:\Windows\System\fWICpBc.exe
  C:\Windows\System\fWICpBc.exe
  2⤵
  PID:1608
- C:\Windows\System\gjyqziD.exe
  C:\Windows\System\gjyqziD.exe
  2⤵
  PID:1796
- C:\Windows\System\VhSjjdC.exe
  C:\Windows\System\VhSjjdC.exe
  2⤵
  PID:1248
- C:\Windows\System\QTmuyFB.exe
  C:\Windows\System\QTmuyFB.exe
  2⤵
  PID:3828
- C:\Windows\System\clTLhik.exe
  C:\Windows\System\clTLhik.exe
  2⤵
  PID:3720
- C:\Windows\System\EczJXJo.exe
  C:\Windows\System\EczJXJo.exe
  2⤵
  PID:1244
- C:\Windows\System\vDgKKIy.exe
  C:\Windows\System\vDgKKIy.exe
  2⤵
  PID:2748
- C:\Windows\System\WhMIgkc.exe
  C:\Windows\System\WhMIgkc.exe
  2⤵
  PID:2624
- C:\Windows\System\eKSXEvk.exe
  C:\Windows\System\eKSXEvk.exe
  2⤵
  PID:2080
- C:\Windows\System\xBXdTBI.exe
  C:\Windows\System\xBXdTBI.exe
  2⤵
  PID:1508
- C:\Windows\System\XkxATJl.exe
  C:\Windows\System\XkxATJl.exe
  2⤵
  PID:2584
- C:\Windows\System\wJEwHuu.exe
  C:\Windows\System\wJEwHuu.exe
  2⤵
  PID:4048
- C:\Windows\System\ziEXUkZ.exe
  C:\Windows\System\ziEXUkZ.exe
  2⤵
  PID:308
- C:\Windows\System\OaVjXLy.exe
  C:\Windows\System\OaVjXLy.exe
  2⤵
  PID:1672
- C:\Windows\System\YttjJQC.exe
  C:\Windows\System\YttjJQC.exe
  2⤵
  PID:4104
- C:\Windows\System\UqmQBFs.exe
  C:\Windows\System\UqmQBFs.exe
  2⤵
  PID:4120
- C:\Windows\System\HfMxSqp.exe
  C:\Windows\System\HfMxSqp.exe
  2⤵
  PID:4160
- C:\Windows\System\dwyDomK.exe
  C:\Windows\System\dwyDomK.exe
  2⤵
  PID:4176
- C:\Windows\System\ILHWgwh.exe
  C:\Windows\System\ILHWgwh.exe
  2⤵
  PID:4192
- C:\Windows\System\UHKlsdG.exe
  C:\Windows\System\UHKlsdG.exe
  2⤵
  PID:4208
- C:\Windows\System\DzEwaLi.exe
  C:\Windows\System\DzEwaLi.exe
  2⤵
  PID:4224
- C:\Windows\System\gEpejPn.exe
  C:\Windows\System\gEpejPn.exe
  2⤵
  PID:4240
- C:\Windows\System\CNxqeyg.exe
  C:\Windows\System\CNxqeyg.exe
  2⤵
  PID:4256
- C:\Windows\System\ABvImYR.exe
  C:\Windows\System\ABvImYR.exe
  2⤵
  PID:4272
- C:\Windows\System\GxMpHAU.exe
  C:\Windows\System\GxMpHAU.exe
  2⤵
  PID:4292
- C:\Windows\System\JxLAmdZ.exe
  C:\Windows\System\JxLAmdZ.exe
  2⤵
  PID:4312
- C:\Windows\System\EKEcOtJ.exe
  C:\Windows\System\EKEcOtJ.exe
  2⤵
  PID:4328
- C:\Windows\System\IMXZaiP.exe
  C:\Windows\System\IMXZaiP.exe
  2⤵
  PID:4344
- C:\Windows\System\ecpCRNV.exe
  C:\Windows\System\ecpCRNV.exe
  2⤵
  PID:4360
- C:\Windows\System\LVEJAJz.exe
  C:\Windows\System\LVEJAJz.exe
  2⤵
  PID:4376
- C:\Windows\System\HCdoswK.exe
  C:\Windows\System\HCdoswK.exe
  2⤵
  PID:4396
- C:\Windows\System\grNIsUn.exe
  C:\Windows\System\grNIsUn.exe
  2⤵
  PID:4412
- C:\Windows\System\hZbwSRo.exe
  C:\Windows\System\hZbwSRo.exe
  2⤵
  PID:4428
- C:\Windows\System\NzwtkFz.exe
  C:\Windows\System\NzwtkFz.exe
  2⤵
  PID:4444
- C:\Windows\System\OOKsgRN.exe
  C:\Windows\System\OOKsgRN.exe
  2⤵
  PID:4460
- C:\Windows\System\OjBisqD.exe
  C:\Windows\System\OjBisqD.exe
  2⤵
  PID:4476
- C:\Windows\System\elbwcrm.exe
  C:\Windows\System\elbwcrm.exe
  2⤵
  PID:4496
- C:\Windows\System\uuoKefr.exe
  C:\Windows\System\uuoKefr.exe
  2⤵
  PID:4512
- C:\Windows\System\UuMBpvO.exe
  C:\Windows\System\UuMBpvO.exe
  2⤵
  PID:4528
- C:\Windows\System\ivVQYMT.exe
  C:\Windows\System\ivVQYMT.exe
  2⤵
  PID:4544
- C:\Windows\System\gghMgAb.exe
  C:\Windows\System\gghMgAb.exe
  2⤵
  PID:4564
- C:\Windows\System\DVjoimf.exe
  C:\Windows\System\DVjoimf.exe
  2⤵
  PID:4580
- C:\Windows\System\hGQnfRo.exe
  C:\Windows\System\hGQnfRo.exe
  2⤵
  PID:4596
- C:\Windows\System\fZlshgA.exe
  C:\Windows\System\fZlshgA.exe
  2⤵
  PID:4616
- C:\Windows\System\JVmScUk.exe
  C:\Windows\System\JVmScUk.exe
  2⤵
  PID:4632
- C:\Windows\System\tKyjIZw.exe
  C:\Windows\System\tKyjIZw.exe
  2⤵
  PID:4648
- C:\Windows\System\XVadkqN.exe
  C:\Windows\System\XVadkqN.exe
  2⤵
  PID:4668
- C:\Windows\System\ulqOMtT.exe
  C:\Windows\System\ulqOMtT.exe
  2⤵
  PID:4684
- C:\Windows\System\ueWydmF.exe
  C:\Windows\System\ueWydmF.exe
  2⤵
  PID:4700
- C:\Windows\System\JSzYtdm.exe
  C:\Windows\System\JSzYtdm.exe
  2⤵
  PID:4716
- C:\Windows\System\TsWTIKN.exe
  C:\Windows\System\TsWTIKN.exe
  2⤵
  PID:4732
- C:\Windows\System\bFkqrUM.exe
  C:\Windows\System\bFkqrUM.exe
  2⤵
  PID:4748
- C:\Windows\System\bxpAveN.exe
  C:\Windows\System\bxpAveN.exe
  2⤵
  PID:4772
- C:\Windows\System\FbmPRNk.exe
  C:\Windows\System\FbmPRNk.exe
  2⤵
  PID:4788
- C:\Windows\System\WuCSIvo.exe
  C:\Windows\System\WuCSIvo.exe
  2⤵
  PID:4804
- C:\Windows\System\XGXMuiV.exe
  C:\Windows\System\XGXMuiV.exe
  2⤵
  PID:4832
- C:\Windows\System\UohtjAy.exe
  C:\Windows\System\UohtjAy.exe
  2⤵
  PID:4972
- C:\Windows\System\BXAaDYw.exe
  C:\Windows\System\BXAaDYw.exe
  2⤵
  PID:4992
- C:\Windows\System\PrzWqKi.exe
  C:\Windows\System\PrzWqKi.exe
  2⤵
  PID:5012
- C:\Windows\System\eiwWaBX.exe
  C:\Windows\System\eiwWaBX.exe
  2⤵
  PID:5028
- C:\Windows\System\KfWzIZw.exe
  C:\Windows\System\KfWzIZw.exe
  2⤵
  PID:5052
- C:\Windows\System\xxGIJmz.exe
  C:\Windows\System\xxGIJmz.exe
  2⤵
  PID:5076
- C:\Windows\System\dimmiZI.exe
  C:\Windows\System\dimmiZI.exe
  2⤵
  PID:5092
- C:\Windows\System\piTJhlm.exe
  C:\Windows\System\piTJhlm.exe
  2⤵
  PID:5108
- C:\Windows\System\mxIFXNC.exe
  C:\Windows\System\mxIFXNC.exe
  2⤵
  PID:3276
- C:\Windows\System\xEpCpCW.exe
  C:\Windows\System\xEpCpCW.exe
  2⤵
  PID:4116
- C:\Windows\System\nmmYiUQ.exe
  C:\Windows\System\nmmYiUQ.exe
  2⤵
  PID:3716
- C:\Windows\System\hDULHcU.exe
  C:\Windows\System\hDULHcU.exe
  2⤵
  PID:4264
- C:\Windows\System\MjOAtsN.exe
  C:\Windows\System\MjOAtsN.exe
  2⤵
  PID:4408
- C:\Windows\System\KPNMnKX.exe
  C:\Windows\System\KPNMnKX.exe
  2⤵
  PID:4472
- C:\Windows\System\CpJyhhf.exe
  C:\Windows\System\CpJyhhf.exe
  2⤵
  PID:4232
- C:\Windows\System\AZKfBzz.exe
  C:\Windows\System\AZKfBzz.exe
  2⤵
  PID:4304
- C:\Windows\System\bospRVK.exe
  C:\Windows\System\bospRVK.exe
  2⤵
  PID:4368
- C:\Windows\System\OVrTSna.exe
  C:\Windows\System\OVrTSna.exe
  2⤵
  PID:4640
- C:\Windows\System\sRKkDTe.exe
  C:\Windows\System\sRKkDTe.exe
  2⤵
  PID:4820
- C:\Windows\System\XvMMqfl.exe
  C:\Windows\System\XvMMqfl.exe
  2⤵
  PID:4184
- C:\Windows\System\UnWiTlc.exe
  C:\Windows\System\UnWiTlc.exe
  2⤵
  PID:4456
- C:\Windows\System\XTpxsdU.exe
  C:\Windows\System\XTpxsdU.exe
  2⤵
  PID:4392
- C:\Windows\System\ToytQJY.exe
  C:\Windows\System\ToytQJY.exe
  2⤵
  PID:4352
- C:\Windows\System\ZkJYyZm.exe
  C:\Windows\System\ZkJYyZm.exe
  2⤵
  PID:4288
- C:\Windows\System\HxhMKcb.exe
  C:\Windows\System\HxhMKcb.exe
  2⤵
  PID:4556
- C:\Windows\System\nXQCQld.exe
  C:\Windows\System\nXQCQld.exe
  2⤵
  PID:4624
- C:\Windows\System\dwiywZP.exe
  C:\Windows\System\dwiywZP.exe
  2⤵
  PID:4756
- C:\Windows\System\tNnOhBA.exe
  C:\Windows\System\tNnOhBA.exe
  2⤵
  PID:4796
- C:\Windows\System\RSIxtDO.exe
  C:\Windows\System\RSIxtDO.exe
  2⤵
  PID:4144
- C:\Windows\System\lstNyrA.exe
  C:\Windows\System\lstNyrA.exe
  2⤵
  PID:4188
- C:\Windows\System\aJSbZkG.exe
  C:\Windows\System\aJSbZkG.exe
  2⤵
  PID:4284
- C:\Windows\System\CNwpgNX.exe
  C:\Windows\System\CNwpgNX.exe
  2⤵
  PID:4848
- C:\Windows\System\gPrtCkO.exe
  C:\Windows\System\gPrtCkO.exe
  2⤵
  PID:4860
- C:\Windows\System\wbMWbQK.exe
  C:\Windows\System\wbMWbQK.exe
  2⤵
  PID:4884
- C:\Windows\System\kywFxQF.exe
  C:\Windows\System\kywFxQF.exe
  2⤵
  PID:2496
- C:\Windows\System\hnNVkXQ.exe
  C:\Windows\System\hnNVkXQ.exe
  2⤵
  PID:4920
- C:\Windows\System\mPlmDAn.exe
  C:\Windows\System\mPlmDAn.exe
  2⤵
  PID:4936
- C:\Windows\System\PlTAeco.exe
  C:\Windows\System\PlTAeco.exe
  2⤵
  PID:4952
- C:\Windows\System\yPUTnaw.exe
  C:\Windows\System\yPUTnaw.exe
  2⤵
  PID:5040
- C:\Windows\System\kUmydeL.exe
  C:\Windows\System\kUmydeL.exe
  2⤵
  PID:5064
- C:\Windows\System\jgciden.exe
  C:\Windows\System\jgciden.exe
  2⤵
  PID:5116
- C:\Windows\System\uhVWLiw.exe
  C:\Windows\System\uhVWLiw.exe
  2⤵
  PID:5100
- C:\Windows\System\BmiMeTw.exe
  C:\Windows\System\BmiMeTw.exe
  2⤵
  PID:4112
- C:\Windows\System\NxXNvci.exe
  C:\Windows\System\NxXNvci.exe
  2⤵
  PID:4268
- C:\Windows\System\TJWgMGN.exe
  C:\Windows\System\TJWgMGN.exe
  2⤵
  PID:4680
- C:\Windows\System\ohwBJAg.exe
  C:\Windows\System\ohwBJAg.exe
  2⤵
  PID:4536
- C:\Windows\System\qDLtDgy.exe
  C:\Windows\System\qDLtDgy.exe
  2⤵
  PID:4676
- C:\Windows\System\jZbZECr.exe
  C:\Windows\System\jZbZECr.exe
  2⤵
  PID:4712
- C:\Windows\System\qPzrHAJ.exe
  C:\Windows\System\qPzrHAJ.exe
  2⤵
  PID:1632
- C:\Windows\System\yjceHwL.exe
  C:\Windows\System\yjceHwL.exe
  2⤵
  PID:1688
- C:\Windows\System\nXIsfcJ.exe
  C:\Windows\System\nXIsfcJ.exe
  2⤵
  PID:4552
- C:\Windows\System\ZDyhsqd.exe
  C:\Windows\System\ZDyhsqd.exe
  2⤵
  PID:4660
- C:\Windows\System\OaqGYnG.exe
  C:\Windows\System\OaqGYnG.exe
  2⤵
  PID:4728
- C:\Windows\System\bNqPgFj.exe
  C:\Windows\System\bNqPgFj.exe
  2⤵
  PID:4872
- C:\Windows\System\vueWUWI.exe
  C:\Windows\System\vueWUWI.exe
  2⤵
  PID:4928
- C:\Windows\System\kTrbxPs.exe
  C:\Windows\System\kTrbxPs.exe
  2⤵
  PID:4852
- C:\Windows\System\AIslJcp.exe
  C:\Windows\System\AIslJcp.exe
  2⤵
  PID:4908
- C:\Windows\System\SxAUimd.exe
  C:\Windows\System\SxAUimd.exe
  2⤵
  PID:4136
- C:\Windows\System\OMVqzfX.exe
  C:\Windows\System\OMVqzfX.exe
  2⤵
  PID:5008
- C:\Windows\System\xEASSOe.exe
  C:\Windows\System\xEASSOe.exe
  2⤵
  PID:1976
- C:\Windows\System\SPpslle.exe
  C:\Windows\System\SPpslle.exe
  2⤵
  PID:5068
- C:\Windows\System\RjPaTCz.exe
  C:\Windows\System\RjPaTCz.exe
  2⤵
  PID:5088
- C:\Windows\System\pGlDbtD.exe
  C:\Windows\System\pGlDbtD.exe
  2⤵
  PID:4708
- C:\Windows\System\klQkXXs.exe
  C:\Windows\System\klQkXXs.exe
  2⤵
  PID:4604
- C:\Windows\System\jSHLgPZ.exe
  C:\Windows\System\jSHLgPZ.exe
  2⤵
  PID:4828
- C:\Windows\System\OYWoXuW.exe
  C:\Windows\System\OYWoXuW.exe
  2⤵
  PID:4492
- C:\Windows\System\nnidqLh.exe
  C:\Windows\System\nnidqLh.exe
  2⤵
  PID:4484
- C:\Windows\System\eYymxee.exe
  C:\Windows\System\eYymxee.exe
  2⤵
  PID:4384
- C:\Windows\System\OLwADKB.exe
  C:\Windows\System\OLwADKB.exe
  2⤵
  PID:4132
- C:\Windows\System\dncpQzm.exe
  C:\Windows\System\dncpQzm.exe
  2⤵
  PID:4896
- C:\Windows\System\FYgDili.exe
  C:\Windows\System\FYgDili.exe
  2⤵
  PID:4888
- C:\Windows\System\OxucaUO.exe
  C:\Windows\System\OxucaUO.exe
  2⤵
  PID:4980
- C:\Windows\System\bcroeWw.exe
  C:\Windows\System\bcroeWw.exe
  2⤵
  PID:4148
- C:\Windows\System\miEsRpr.exe
  C:\Windows\System\miEsRpr.exe
  2⤵
  PID:1124
- C:\Windows\System\ngLsDmg.exe
  C:\Windows\System\ngLsDmg.exe
  2⤵
  PID:4468
- C:\Windows\System\cOJJwRo.exe
  C:\Windows\System\cOJJwRo.exe
  2⤵
  PID:4404
- C:\Windows\System\YdhPDKy.exe
  C:\Windows\System\YdhPDKy.exe
  2⤵
  PID:4128
- C:\Windows\System\Xmfwqwi.exe
  C:\Windows\System\Xmfwqwi.exe
  2⤵
  PID:4592
- C:\Windows\System\YZxubeJ.exe
  C:\Windows\System\YZxubeJ.exe
  2⤵
  PID:4252
- C:\Windows\System\ePQnVAA.exe
  C:\Windows\System\ePQnVAA.exe
  2⤵
  PID:4984
- C:\Windows\System\JkVjVAo.exe
  C:\Windows\System\JkVjVAo.exe
  2⤵
  PID:4904
- C:\Windows\System\zzUseVE.exe
  C:\Windows\System\zzUseVE.exe
  2⤵
  PID:5060
- C:\Windows\System\RedaMIT.exe
  C:\Windows\System\RedaMIT.exe
  2⤵
  PID:5132
- C:\Windows\System\gUSNWBQ.exe
  C:\Windows\System\gUSNWBQ.exe
  2⤵
  PID:5200
- C:\Windows\System\BMwebNO.exe
  C:\Windows\System\BMwebNO.exe
  2⤵
  PID:5220
- C:\Windows\System\NMQUOVv.exe
  C:\Windows\System\NMQUOVv.exe
  2⤵
  PID:5236
- C:\Windows\System\QyJAuoA.exe
  C:\Windows\System\QyJAuoA.exe
  2⤵
  PID:5252
- C:\Windows\System\fvYWhMC.exe
  C:\Windows\System\fvYWhMC.exe
  2⤵
  PID:5268
- C:\Windows\System\kSIYNvp.exe
  C:\Windows\System\kSIYNvp.exe
  2⤵
  PID:5284
- C:\Windows\System\MegfiUP.exe
  C:\Windows\System\MegfiUP.exe
  2⤵
  PID:5300
- C:\Windows\System\Frezdmy.exe
  C:\Windows\System\Frezdmy.exe
  2⤵
  PID:5316
- C:\Windows\System\Ltusyem.exe
  C:\Windows\System\Ltusyem.exe
  2⤵
  PID:5332
- C:\Windows\System\SfIotus.exe
  C:\Windows\System\SfIotus.exe
  2⤵
  PID:5348
- C:\Windows\System\IbsHAAN.exe
  C:\Windows\System\IbsHAAN.exe
  2⤵
  PID:5364
- C:\Windows\System\ApSshHI.exe
  C:\Windows\System\ApSshHI.exe
  2⤵
  PID:5380
- C:\Windows\System\QbCwYGQ.exe
  C:\Windows\System\QbCwYGQ.exe
  2⤵
  PID:5396
- C:\Windows\System\xrBRIhi.exe
  C:\Windows\System\xrBRIhi.exe
  2⤵
  PID:5412
- C:\Windows\System\mPvDiiN.exe
  C:\Windows\System\mPvDiiN.exe
  2⤵
  PID:5428
- C:\Windows\System\EeUddnc.exe
  C:\Windows\System\EeUddnc.exe
  2⤵
  PID:5444
- C:\Windows\System\hplomUa.exe
  C:\Windows\System\hplomUa.exe
  2⤵
  PID:5460
- C:\Windows\System\aIelbmX.exe
  C:\Windows\System\aIelbmX.exe
  2⤵
  PID:5476
- C:\Windows\System\sjVKbfj.exe
  C:\Windows\System\sjVKbfj.exe
  2⤵
  PID:5492
- C:\Windows\System\GTuWpMX.exe
  C:\Windows\System\GTuWpMX.exe
  2⤵
  PID:5508
- C:\Windows\System\JzDaTHa.exe
  C:\Windows\System\JzDaTHa.exe
  2⤵
  PID:5524
- C:\Windows\System\byNRXIM.exe
  C:\Windows\System\byNRXIM.exe
  2⤵
  PID:5572
- C:\Windows\System\KHnAUWR.exe
  C:\Windows\System\KHnAUWR.exe
  2⤵
  PID:5588
- C:\Windows\System\XvbCFdJ.exe
  C:\Windows\System\XvbCFdJ.exe
  2⤵
  PID:5604
- C:\Windows\System\gVXJSzW.exe
  C:\Windows\System\gVXJSzW.exe
  2⤵
  PID:5620
- C:\Windows\System\FmZBxnj.exe
  C:\Windows\System\FmZBxnj.exe
  2⤵
  PID:5636
- C:\Windows\System\LnmIszi.exe
  C:\Windows\System\LnmIszi.exe
  2⤵
  PID:5652
- C:\Windows\System\SAcBNuO.exe
  C:\Windows\System\SAcBNuO.exe
  2⤵
  PID:5668
- C:\Windows\System\zJupeHa.exe
  C:\Windows\System\zJupeHa.exe
  2⤵
  PID:5684
- C:\Windows\System\BJXgpln.exe
  C:\Windows\System\BJXgpln.exe
  2⤵
  PID:5704
- C:\Windows\System\NHVxTNN.exe
  C:\Windows\System\NHVxTNN.exe
  2⤵
  PID:5720
- C:\Windows\System\oNwSdio.exe
  C:\Windows\System\oNwSdio.exe
  2⤵
  PID:5864
- C:\Windows\System\VzFlDAC.exe
  C:\Windows\System\VzFlDAC.exe
  2⤵
  PID:5884
- C:\Windows\System\jsfEJAw.exe
  C:\Windows\System\jsfEJAw.exe
  2⤵
  PID:5900
- C:\Windows\System\mEcIDzq.exe
  C:\Windows\System\mEcIDzq.exe
  2⤵
  PID:5920
- C:\Windows\System\FisbwDQ.exe
  C:\Windows\System\FisbwDQ.exe
  2⤵
  PID:5944
- C:\Windows\System\tkUndUg.exe
  C:\Windows\System\tkUndUg.exe
  2⤵
  PID:5960
- C:\Windows\System\AxspwzW.exe
  C:\Windows\System\AxspwzW.exe
  2⤵
  PID:5976
- C:\Windows\System\YdlbYiy.exe
  C:\Windows\System\YdlbYiy.exe
  2⤵
  PID:5996
- C:\Windows\System\YxlGLTI.exe
  C:\Windows\System\YxlGLTI.exe
  2⤵
  PID:6016
- C:\Windows\System\QHCRhmR.exe
  C:\Windows\System\QHCRhmR.exe
  2⤵
  PID:6036
- C:\Windows\System\NKuqQMp.exe
  C:\Windows\System\NKuqQMp.exe
  2⤵
  PID:6052
- C:\Windows\System\CicwFEb.exe
  C:\Windows\System\CicwFEb.exe
  2⤵
  PID:6072
- C:\Windows\System\SZChiRA.exe
  C:\Windows\System\SZChiRA.exe
  2⤵
  PID:6108
- C:\Windows\System\fwaSZuC.exe
  C:\Windows\System\fwaSZuC.exe
  2⤵
  PID:6124
- C:\Windows\System\wwYZIrI.exe
  C:\Windows\System\wwYZIrI.exe
  2⤵
  PID:2448
- C:\Windows\System\emJwNwG.exe
  C:\Windows\System\emJwNwG.exe
  2⤵
  PID:4588
- C:\Windows\System\zMIJrTw.exe
  C:\Windows\System\zMIJrTw.exe
  2⤵
  PID:4168
- C:\Windows\System\AFYNSgm.exe
  C:\Windows\System\AFYNSgm.exe
  2⤵
  PID:4784
- C:\Windows\System\qZvIftl.exe
  C:\Windows\System\qZvIftl.exe
  2⤵
  PID:2056
- C:\Windows\System\YPVlftU.exe
  C:\Windows\System\YPVlftU.exe
  2⤵
  PID:5140
- C:\Windows\System\ZetIOfp.exe
  C:\Windows\System\ZetIOfp.exe
  2⤵
  PID:5160
- C:\Windows\System\eUxEGSA.exe
  C:\Windows\System\eUxEGSA.exe
  2⤵
  PID:5180
- C:\Windows\System\xdpDIpv.exe
  C:\Windows\System\xdpDIpv.exe
  2⤵
  PID:5196
- C:\Windows\System\yhsgjbj.exe
  C:\Windows\System\yhsgjbj.exe
  2⤵
  PID:5292
- C:\Windows\System\YXENtLX.exe
  C:\Windows\System\YXENtLX.exe
  2⤵
  PID:5356
- C:\Windows\System\xssWRjA.exe
  C:\Windows\System\xssWRjA.exe
  2⤵
  PID:5420
- C:\Windows\System\LlZwXsJ.exe
  C:\Windows\System\LlZwXsJ.exe
  2⤵
  PID:5472
- C:\Windows\System\UAXHYLn.exe
  C:\Windows\System\UAXHYLn.exe
  2⤵
  PID:5436
- C:\Windows\System\jZEqJps.exe
  C:\Windows\System\jZEqJps.exe
  2⤵
  PID:5372
- C:\Windows\System\AtvqiFk.exe
  C:\Windows\System\AtvqiFk.exe
  2⤵
  PID:5308
- C:\Windows\System\OYkZOwS.exe
  C:\Windows\System\OYkZOwS.exe
  2⤵
  PID:5244
- C:\Windows\System\LBiOVpc.exe
  C:\Windows\System\LBiOVpc.exe
  2⤵
  PID:5532
- C:\Windows\System\ylfSXLG.exe
  C:\Windows\System\ylfSXLG.exe
  2⤵
  PID:5540
- C:\Windows\System\uUPeIUI.exe
  C:\Windows\System\uUPeIUI.exe
  2⤵
  PID:5560
- C:\Windows\System\GSTFFdr.exe
  C:\Windows\System\GSTFFdr.exe
  2⤵
  PID:5580
- C:\Windows\System\VISHTJr.exe
  C:\Windows\System\VISHTJr.exe
  2⤵
  PID:5676
- C:\Windows\System\moPDgjk.exe
  C:\Windows\System\moPDgjk.exe
  2⤵
  PID:5692
- C:\Windows\System\QAoGeOp.exe
  C:\Windows\System\QAoGeOp.exe
  2⤵
  PID:5564
- C:\Windows\System\ufNEkXA.exe
  C:\Windows\System\ufNEkXA.exe
  2⤵
  PID:5632
- C:\Windows\System\lecKNJr.exe
  C:\Windows\System\lecKNJr.exe
  2⤵
  PID:5736
- C:\Windows\System\KWKjQKF.exe
  C:\Windows\System\KWKjQKF.exe
  2⤵
  PID:5748
- C:\Windows\System\XNkCGMC.exe
  C:\Windows\System\XNkCGMC.exe
  2⤵
  PID:5764
- C:\Windows\System\blRyboA.exe
  C:\Windows\System\blRyboA.exe
  2⤵
  PID:5784
- C:\Windows\System\IiCuiXr.exe
  C:\Windows\System\IiCuiXr.exe
  2⤵
  PID:5804
- C:\Windows\System\XrAtULv.exe
  C:\Windows\System\XrAtULv.exe
  2⤵
  PID:5820
- C:\Windows\System\SxgBmBr.exe
  C:\Windows\System\SxgBmBr.exe
  2⤵
  PID:5840
- C:\Windows\System\ailpGfB.exe
  C:\Windows\System\ailpGfB.exe
  2⤵
  PID:5848
- C:\Windows\System\VgZWnoK.exe
  C:\Windows\System\VgZWnoK.exe
  2⤵
  PID:5860
- C:\Windows\System\cEViIQd.exe
  C:\Windows\System\cEViIQd.exe
  2⤵
  PID:6032
- C:\Windows\System\eqvIwqg.exe
  C:\Windows\System\eqvIwqg.exe
  2⤵
  PID:5936
- C:\Windows\System\OyTxEXP.exe
  C:\Windows\System\OyTxEXP.exe
  2⤵
  PID:5972
- C:\Windows\System\UxRlsEa.exe
  C:\Windows\System\UxRlsEa.exe
  2⤵
  PID:6044
- C:\Windows\System\reWVecy.exe
  C:\Windows\System\reWVecy.exe
  2⤵
  PID:4960
- C:\Windows\System\cfBYHHo.exe
  C:\Windows\System\cfBYHHo.exe
  2⤵
  PID:4140
- C:\Windows\System\UjQUJrV.exe
  C:\Windows\System\UjQUJrV.exe
  2⤵
  PID:6080
- C:\Windows\System\iPdFPSw.exe
  C:\Windows\System\iPdFPSw.exe
  2⤵
  PID:6104
- C:\Windows\System\dwoHPGN.exe
  C:\Windows\System\dwoHPGN.exe
  2⤵
  PID:5124
- C:\Windows\System\RBptoAO.exe
  C:\Windows\System\RBptoAO.exe
  2⤵
  PID:6088
- C:\Windows\System\pIJlvIv.exe
  C:\Windows\System\pIJlvIv.exe
  2⤵
  PID:4724
- C:\Windows\System\UpgYDiU.exe
  C:\Windows\System\UpgYDiU.exe
  2⤵
  PID:5232
- C:\Windows\System\MzgdPGL.exe
  C:\Windows\System\MzgdPGL.exe
  2⤵
  PID:5392
- C:\Windows\System\KSNnCXj.exe
  C:\Windows\System\KSNnCXj.exe
  2⤵
  PID:5312
- C:\Windows\System\OmWUXca.exe
  C:\Windows\System\OmWUXca.exe
  2⤵
  PID:2364
- C:\Windows\System\TtjushL.exe
  C:\Windows\System\TtjushL.exe
  2⤵
  PID:5644
- C:\Windows\System\UkWrlbL.exe
  C:\Windows\System\UkWrlbL.exe
  2⤵
  PID:5696
- C:\Windows\System\ubPmSsF.exe
  C:\Windows\System\ubPmSsF.exe
  2⤵
  PID:5792
- C:\Windows\System\HfVorFE.exe
  C:\Windows\System\HfVorFE.exe
  2⤵
  PID:5836
- C:\Windows\System\KRVdtff.exe
  C:\Windows\System\KRVdtff.exe
  2⤵
  PID:5780
- C:\Windows\System\wxZYklI.exe
  C:\Windows\System\wxZYklI.exe
  2⤵
  PID:5456
- C:\Windows\System\CVWQaDG.exe
  C:\Windows\System\CVWQaDG.exe
  2⤵
  PID:5600
- C:\Windows\System\KIjZWAf.exe
  C:\Windows\System\KIjZWAf.exe
  2⤵
  PID:5324
- C:\Windows\System\oqYvhNG.exe
  C:\Windows\System\oqYvhNG.exe
  2⤵
  PID:5536
- C:\Windows\System\abWBtrc.exe
  C:\Windows\System\abWBtrc.exe
  2⤵
  PID:5276
- C:\Windows\System\EsfRrKM.exe
  C:\Windows\System\EsfRrKM.exe
  2⤵
  PID:5716
- C:\Windows\System\cbXzxFv.exe
  C:\Windows\System\cbXzxFv.exe
  2⤵
  PID:5984
- C:\Windows\System\tMzXanH.exe
  C:\Windows\System\tMzXanH.exe
  2⤵
  PID:5952
- C:\Windows\System\cfSCNZt.exe
  C:\Windows\System\cfSCNZt.exe
  2⤵
  PID:6028
- C:\Windows\System\zxMatdX.exe
  C:\Windows\System\zxMatdX.exe
  2⤵
  PID:6004
- C:\Windows\System\fpvkojJ.exe
  C:\Windows\System\fpvkojJ.exe
  2⤵
  PID:6116
- C:\Windows\System\ehwiAZd.exe
  C:\Windows\System\ehwiAZd.exe
  2⤵
  PID:5168
- C:\Windows\System\eiUzeqF.exe
  C:\Windows\System\eiUzeqF.exe
  2⤵
  PID:5000
- C:\Windows\System\cKDtczi.exe
  C:\Windows\System\cKDtczi.exe
  2⤵
  PID:6136
- C:\Windows\System\tfnBFMM.exe
  C:\Windows\System\tfnBFMM.exe
  2⤵
  PID:5264
- C:\Windows\System\UOUuWFo.exe
  C:\Windows\System\UOUuWFo.exe
  2⤵
  PID:5212
- C:\Windows\System\QDdhBJl.exe
  C:\Windows\System\QDdhBJl.exe
  2⤵
  PID:5700
- C:\Windows\System\RkVLusl.exe
  C:\Windows\System\RkVLusl.exe
  2⤵
  PID:5824
- C:\Windows\System\ZyCylpL.exe
  C:\Windows\System\ZyCylpL.exe
  2⤵
  PID:5740
- C:\Windows\System\etRmfoF.exe
  C:\Windows\System\etRmfoF.exe
  2⤵
  PID:5832
- C:\Windows\System\kDRwpQZ.exe
  C:\Windows\System\kDRwpQZ.exe
  2⤵
  PID:5908
- C:\Windows\System\nNuMtuY.exe
  C:\Windows\System\nNuMtuY.exe
  2⤵
  PID:5912
- C:\Windows\System\hBqXpwu.exe
  C:\Windows\System\hBqXpwu.exe
  2⤵
  PID:5956
- C:\Windows\System\oRFrjQX.exe
  C:\Windows\System\oRFrjQX.exe
  2⤵
  PID:4968
- C:\Windows\System\XEeurFf.exe
  C:\Windows\System\XEeurFf.exe
  2⤵
  PID:6100
- C:\Windows\System\xoDzkUO.exe
  C:\Windows\System\xoDzkUO.exe
  2⤵
  PID:6156
- C:\Windows\System\wDGrNJi.exe
  C:\Windows\System\wDGrNJi.exe
  2⤵
  PID:6348
- C:\Windows\System\fpkiddq.exe
  C:\Windows\System\fpkiddq.exe
  2⤵
  PID:6372
- C:\Windows\System\aEXcDeH.exe
  C:\Windows\System\aEXcDeH.exe
  2⤵
  PID:6388
- C:\Windows\System\CQPDPcV.exe
  C:\Windows\System\CQPDPcV.exe
  2⤵
  PID:6404
- C:\Windows\System\qmHKYzi.exe
  C:\Windows\System\qmHKYzi.exe
  2⤵
  PID:6420
- C:\Windows\System\SPGavDA.exe
  C:\Windows\System\SPGavDA.exe
  2⤵
  PID:6436
- C:\Windows\System\CRfaNQx.exe
  C:\Windows\System\CRfaNQx.exe
  2⤵
  PID:6452
- C:\Windows\System\ECoxIvO.exe
  C:\Windows\System\ECoxIvO.exe
  2⤵
  PID:6468
- C:\Windows\System\fuhsHfg.exe
  C:\Windows\System\fuhsHfg.exe
  2⤵
  PID:6484
- C:\Windows\System\WQJAWCe.exe
  C:\Windows\System\WQJAWCe.exe
  2⤵
  PID:6508
- C:\Windows\System\KPztoly.exe
  C:\Windows\System\KPztoly.exe
  2⤵
  PID:6524
- C:\Windows\System\gwxzSMx.exe
  C:\Windows\System\gwxzSMx.exe
  2⤵
  PID:6540
- C:\Windows\System\QAjpfxk.exe
  C:\Windows\System\QAjpfxk.exe
  2⤵
  PID:6592
- C:\Windows\System\WkmkbOO.exe
  C:\Windows\System\WkmkbOO.exe
  2⤵
  PID:6608
- C:\Windows\System\ApOrmYi.exe
  C:\Windows\System\ApOrmYi.exe
  2⤵
  PID:6624
- C:\Windows\System\rBKZVHW.exe
  C:\Windows\System\rBKZVHW.exe
  2⤵
  PID:6640
- C:\Windows\System\yhLRgXC.exe
  C:\Windows\System\yhLRgXC.exe
  2⤵
  PID:6656
- C:\Windows\System\qKhvVMS.exe
  C:\Windows\System\qKhvVMS.exe
  2⤵
  PID:6672
- C:\Windows\System\XLzVLpi.exe
  C:\Windows\System\XLzVLpi.exe
  2⤵
  PID:6692
- C:\Windows\System\cKsdZyG.exe
  C:\Windows\System\cKsdZyG.exe
  2⤵
  PID:6824
- C:\Windows\System\psNcbjZ.exe
  C:\Windows\System\psNcbjZ.exe
  2⤵
  PID:6840
- C:\Windows\System\MyUgQaW.exe
  C:\Windows\System\MyUgQaW.exe
  2⤵
  PID:6856
- C:\Windows\System\Phqcnpm.exe
  C:\Windows\System\Phqcnpm.exe
  2⤵
  PID:6872
- C:\Windows\System\IszAoaE.exe
  C:\Windows\System\IszAoaE.exe
  2⤵
  PID:6888
- C:\Windows\System\zrujePL.exe
  C:\Windows\System\zrujePL.exe
  2⤵
  PID:6904
- C:\Windows\System\lsUcjEO.exe
  C:\Windows\System\lsUcjEO.exe
  2⤵
  PID:6920
- C:\Windows\System\LzaNlaI.exe
  C:\Windows\System\LzaNlaI.exe
  2⤵
  PID:6936
- C:\Windows\System\owKYOZn.exe
  C:\Windows\System\owKYOZn.exe
  2⤵
  PID:6952
- C:\Windows\System\yniHXMC.exe
  C:\Windows\System\yniHXMC.exe
  2⤵
  PID:6968
- C:\Windows\System\SZfwBLH.exe
  C:\Windows\System\SZfwBLH.exe
  2⤵
  PID:6984
- C:\Windows\System\XeLmAKR.exe
  C:\Windows\System\XeLmAKR.exe
  2⤵
  PID:7000
- C:\Windows\System\pklzoSq.exe
  C:\Windows\System\pklzoSq.exe
  2⤵
  PID:7020
- C:\Windows\System\lmbstDC.exe
  C:\Windows\System\lmbstDC.exe
  2⤵
  PID:7036
- C:\Windows\System\ovSqHNy.exe
  C:\Windows\System\ovSqHNy.exe
  2⤵
  PID:7052
- C:\Windows\System\gtHSOIr.exe
  C:\Windows\System\gtHSOIr.exe
  2⤵
  PID:7068
- C:\Windows\System\FqskUVL.exe
  C:\Windows\System\FqskUVL.exe
  2⤵
  PID:7112
- C:\Windows\System\jPLOHVi.exe
  C:\Windows\System\jPLOHVi.exe
  2⤵
  PID:7128
- C:\Windows\System\RygGoPn.exe
  C:\Windows\System\RygGoPn.exe
  2⤵
  PID:7144
- C:\Windows\System\MDNVzol.exe
  C:\Windows\System\MDNVzol.exe
  2⤵
  PID:5388
- C:\Windows\System\CTRUhib.exe
  C:\Windows\System\CTRUhib.exe
  2⤵
  PID:5744
- C:\Windows\System\ZUgVRdp.exe
  C:\Windows\System\ZUgVRdp.exe
  2⤵
  PID:5916
- C:\Windows\System\pQXaeYo.exe
  C:\Windows\System\pQXaeYo.exe
  2⤵
  PID:6152
- C:\Windows\System\gyrLQSD.exe
  C:\Windows\System\gyrLQSD.exe
  2⤵
  PID:5404
- C:\Windows\System\LRHdpUl.exe
  C:\Windows\System\LRHdpUl.exe
  2⤵
  PID:6092
- C:\Windows\System\OUxJMav.exe
  C:\Windows\System\OUxJMav.exe
  2⤵
  PID:6172
- C:\Windows\System\utkirrc.exe
  C:\Windows\System\utkirrc.exe
  2⤵
  PID:5896
- C:\Windows\System\nZYDfzr.exe
  C:\Windows\System\nZYDfzr.exe
  2⤵
  PID:6192
- C:\Windows\System\qELhXLb.exe
  C:\Windows\System\qELhXLb.exe
  2⤵
  PID:6200
- C:\Windows\System\nRpavtl.exe
  C:\Windows\System\nRpavtl.exe
  2⤵
  PID:6216
- C:\Windows\System\SasmGlz.exe
  C:\Windows\System\SasmGlz.exe
  2⤵
  PID:6244
- C:\Windows\System\ZCQQvhA.exe
  C:\Windows\System\ZCQQvhA.exe
  2⤵
  PID:6256
- C:\Windows\System\ZeeGVPb.exe
  C:\Windows\System\ZeeGVPb.exe
  2⤵
  PID:6272
- C:\Windows\System\YSjJxyp.exe
  C:\Windows\System\YSjJxyp.exe
  2⤵
  PID:6328
- C:\Windows\System\CIvTElE.exe
  C:\Windows\System\CIvTElE.exe
  2⤵
  PID:6292
- C:\Windows\System\QLguUEl.exe
  C:\Windows\System\QLguUEl.exe
  2⤵
  PID:6332
- C:\Windows\System\BiuIcgg.exe
  C:\Windows\System\BiuIcgg.exe
  2⤵
  PID:360
- C:\Windows\System\DGxhnZX.exe
  C:\Windows\System\DGxhnZX.exe
  2⤵
  PID:6364
- C:\Windows\System\NLKSAEK.exe
  C:\Windows\System\NLKSAEK.exe
  2⤵
  PID:6460
- C:\Windows\System\QwsiTbR.exe
  C:\Windows\System\QwsiTbR.exe
  2⤵
  PID:6492
- C:\Windows\System\aJryBKi.exe
  C:\Windows\System\aJryBKi.exe
  2⤵
  PID:6532
- C:\Windows\System\rrbcEPW.exe
  C:\Windows\System\rrbcEPW.exe
  2⤵
  PID:6552
- C:\Windows\System\BBCLVZp.exe
  C:\Windows\System\BBCLVZp.exe
  2⤵
  PID:6688
- C:\Windows\System\RTyvoJr.exe
  C:\Windows\System\RTyvoJr.exe
  2⤵
  PID:6648
- C:\Windows\System\CkHOMvX.exe
  C:\Windows\System\CkHOMvX.exe
  2⤵
  PID:6704
- C:\Windows\System\fpjiFbS.exe
  C:\Windows\System\fpjiFbS.exe
  2⤵
  PID:6720
- C:\Windows\System\HqnNaYP.exe
  C:\Windows\System\HqnNaYP.exe
  2⤵
  PID:6748
- C:\Windows\System\etTgJcL.exe
  C:\Windows\System\etTgJcL.exe
  2⤵
  PID:6764
- C:\Windows\System\ImxAReW.exe
  C:\Windows\System\ImxAReW.exe
  2⤵
  PID:6780
- C:\Windows\System\yXoFpZs.exe
  C:\Windows\System\yXoFpZs.exe
  2⤵
  PID:6792
- C:\Windows\System\pSddXGN.exe
  C:\Windows\System\pSddXGN.exe
  2⤵
  PID:6812
- C:\Windows\System\jUeFami.exe
  C:\Windows\System\jUeFami.exe
  2⤵
  PID:6852
- C:\Windows\System\YNNZroH.exe
  C:\Windows\System\YNNZroH.exe
  2⤵
  PID:7028
- C:\Windows\System\ZdcoZyg.exe
  C:\Windows\System\ZdcoZyg.exe
  2⤵
  PID:7120
- C:\Windows\System\evmEZKs.exe
  C:\Windows\System\evmEZKs.exe
  2⤵
  PID:7160
- C:\Windows\System\RkZxnoq.exe
  C:\Windows\System\RkZxnoq.exe
  2⤵
  PID:6252
- C:\Windows\System\raYBCMG.exe
  C:\Windows\System\raYBCMG.exe
  2⤵
  PID:6164
- C:\Windows\System\AQZbVJW.exe
  C:\Windows\System\AQZbVJW.exe
  2⤵
  PID:6188
- C:\Windows\System\eZFzIvW.exe
  C:\Windows\System\eZFzIvW.exe
  2⤵
  PID:6316
- C:\Windows\System\GKlMYOn.exe
  C:\Windows\System\GKlMYOn.exe
  2⤵
  PID:6916
- C:\Windows\System\EWiXtpC.exe
  C:\Windows\System\EWiXtpC.exe
  2⤵
  PID:7048
- C:\Windows\System\SbdeSnH.exe
  C:\Windows\System\SbdeSnH.exe
  2⤵
  PID:7084
- C:\Windows\System\gtZyhsF.exe
  C:\Windows\System\gtZyhsF.exe
  2⤵
  PID:7104
- C:\Windows\System\iLtLxxs.exe
  C:\Windows\System\iLtLxxs.exe
  2⤵
  PID:5176
- C:\Windows\System\oxERazu.exe
  C:\Windows\System\oxERazu.exe
  2⤵
  PID:6312
- C:\Windows\System\wUAgHzd.exe
  C:\Windows\System\wUAgHzd.exe
  2⤵
  PID:6180
- C:\Windows\System\fqVzxhW.exe
  C:\Windows\System\fqVzxhW.exe
  2⤵
  PID:6236
- C:\Windows\System\MevDQri.exe
  C:\Windows\System\MevDQri.exe
  2⤵
  PID:6288
- C:\Windows\System\zuaaXQb.exe
  C:\Windows\System\zuaaXQb.exe
  2⤵
  PID:6668
- C:\Windows\System\XWXuHAF.exe
  C:\Windows\System\XWXuHAF.exe
  2⤵
  PID:6732
- C:\Windows\System\cuLGRKy.exe
  C:\Windows\System\cuLGRKy.exe
  2⤵
  PID:6736
- C:\Windows\System\FzdSmlq.exe
  C:\Windows\System\FzdSmlq.exe
  2⤵
  PID:6412
- C:\Windows\System\hBCIcsV.exe
  C:\Windows\System\hBCIcsV.exe
  2⤵
  PID:6744
- C:\Windows\System\eAIAFfP.exe
  C:\Windows\System\eAIAFfP.exe
  2⤵
  PID:6680
- C:\Windows\System\yRyYTtL.exe
  C:\Windows\System\yRyYTtL.exe
  2⤵
  PID:6712
- C:\Windows\System\MHpatzP.exe
  C:\Windows\System\MHpatzP.exe
  2⤵
  PID:6816
- C:\Windows\System\snxtPot.exe
  C:\Windows\System\snxtPot.exe
  2⤵
  PID:7064
- C:\Windows\System\FKnsyki.exe
  C:\Windows\System\FKnsyki.exe
  2⤵
  PID:6960
- C:\Windows\System\SypoPfd.exe
  C:\Windows\System\SypoPfd.exe
  2⤵
  PID:6868
- C:\Windows\System\simwhQz.exe
  C:\Windows\System\simwhQz.exe
  2⤵
  PID:5796
- C:\Windows\System\SYAVuXb.exe
  C:\Windows\System\SYAVuXb.exe
  2⤵
  PID:5424
- C:\Windows\System\zoOGBcf.exe
  C:\Windows\System\zoOGBcf.exe
  2⤵
  PID:7080
- C:\Windows\System\pOzfGQV.exe
  C:\Windows\System\pOzfGQV.exe
  2⤵
  PID:6148
- C:\Windows\System\jIXmusH.exe
  C:\Windows\System\jIXmusH.exe
  2⤵
  PID:6284
- C:\Windows\System\OuodCgu.exe
  C:\Windows\System\OuodCgu.exe
  2⤵
  PID:6196
- C:\Windows\System\yaBtbQk.exe
  C:\Windows\System\yaBtbQk.exe
  2⤵
  PID:6464
- C:\Windows\System\poayapp.exe
  C:\Windows\System\poayapp.exe
  2⤵
  PID:6564
- C:\Windows\System\CesOFQU.exe
  C:\Windows\System\CesOFQU.exe
  2⤵
  PID:6568
- C:\Windows\System\vsKNOPF.exe
  C:\Windows\System\vsKNOPF.exe
  2⤵
  PID:6384
- C:\Windows\System\UjcmYGW.exe
  C:\Windows\System\UjcmYGW.exe
  2⤵
  PID:6604
- C:\Windows\System\MywtEQm.exe
  C:\Windows\System\MywtEQm.exe
  2⤵
  PID:6548
- C:\Windows\System\BhpRVhJ.exe
  C:\Windows\System\BhpRVhJ.exe
  2⤵
  PID:6476
- C:\Windows\System\ZHvePxZ.exe
  C:\Windows\System\ZHvePxZ.exe
  2⤵
  PID:6804
- C:\Windows\System\ZlagboD.exe
  C:\Windows\System\ZlagboD.exe
  2⤵
  PID:7012
- C:\Windows\System\BAQQwQv.exe
  C:\Windows\System\BAQQwQv.exe
  2⤵
  PID:7044
- C:\Windows\System\IbYfZuO.exe
  C:\Windows\System\IbYfZuO.exe
  2⤵
  PID:6796
- C:\Windows\System\Israqwd.exe
  C:\Windows\System\Israqwd.exe
  2⤵
  PID:6300
- C:\Windows\System\nTkuCXF.exe
  C:\Windows\System\nTkuCXF.exe
  2⤵
  PID:6504
- C:\Windows\System\BWXAiDo.exe
  C:\Windows\System\BWXAiDo.exe
  2⤵
  PID:6580
- C:\Windows\System\muxPfhh.exe
  C:\Windows\System\muxPfhh.exe
  2⤵
  PID:6380
- C:\Windows\System\IpIYAoz.exe
  C:\Windows\System\IpIYAoz.exe
  2⤵
  PID:6788
- C:\Windows\System\ehPgsvf.exe
  C:\Windows\System\ehPgsvf.exe
  2⤵
  PID:6944
- C:\Windows\System\EGMYbXG.exe
  C:\Windows\System\EGMYbXG.exe
  2⤵
  PID:6264
- C:\Windows\System\PPXeGOv.exe
  C:\Windows\System\PPXeGOv.exe
  2⤵
  PID:6320
- C:\Windows\System\EhWcUXc.exe
  C:\Windows\System\EhWcUXc.exe
  2⤵
  PID:1496
- C:\Windows\System\NWlHkiN.exe
  C:\Windows\System\NWlHkiN.exe
  2⤵
  PID:6432
- C:\Windows\System\cMyHHEu.exe
  C:\Windows\System\cMyHHEu.exe
  2⤵
  PID:7136
- C:\Windows\System\pUMnFbM.exe
  C:\Windows\System\pUMnFbM.exe
  2⤵
  PID:5892
- C:\Windows\System\nCcgipb.exe
  C:\Windows\System\nCcgipb.exe
  2⤵
  PID:7152
- C:\Windows\System\MCScwym.exe
  C:\Windows\System\MCScwym.exe
  2⤵
  PID:7008
- C:\Windows\System\yofSOmX.exe
  C:\Windows\System\yofSOmX.exe
  2⤵
  PID:6576
- C:\Windows\System\iTYaBuK.exe
  C:\Windows\System\iTYaBuK.exe
  2⤵
  PID:6760
- C:\Windows\System\vwNNmAz.exe
  C:\Windows\System\vwNNmAz.exe
  2⤵
  PID:2280
- C:\Windows\System\iwFHgpg.exe
  C:\Windows\System\iwFHgpg.exe
  2⤵
  PID:7172
- C:\Windows\System\mLmMPWf.exe
  C:\Windows\System\mLmMPWf.exe
  2⤵
  PID:7188
- C:\Windows\System\nvcFGEw.exe
  C:\Windows\System\nvcFGEw.exe
  2⤵
  PID:7204
- C:\Windows\System\UkyIZHV.exe
  C:\Windows\System\UkyIZHV.exe
  2⤵
  PID:7224
- C:\Windows\System\AqmQiZF.exe
  C:\Windows\System\AqmQiZF.exe
  2⤵
  PID:7240
- C:\Windows\System\erktVJs.exe
  C:\Windows\System\erktVJs.exe
  2⤵
  PID:7256
- C:\Windows\System\BzXEixY.exe
  C:\Windows\System\BzXEixY.exe
  2⤵
  PID:7272
- C:\Windows\System\QrSHtBL.exe
  C:\Windows\System\QrSHtBL.exe
  2⤵
  PID:7288
- C:\Windows\System\sJUPwMm.exe
  C:\Windows\System\sJUPwMm.exe
  2⤵
  PID:7304
- C:\Windows\System\HVGmsxy.exe
  C:\Windows\System\HVGmsxy.exe
  2⤵
  PID:7324
- C:\Windows\System\aWIWWVH.exe
  C:\Windows\System\aWIWWVH.exe
  2⤵
  PID:7340
- C:\Windows\System\VQOGviu.exe
  C:\Windows\System\VQOGviu.exe
  2⤵
  PID:7356
- C:\Windows\System\NAhOexB.exe
  C:\Windows\System\NAhOexB.exe
  2⤵
  PID:7372
- C:\Windows\System\NNaXDqX.exe
  C:\Windows\System\NNaXDqX.exe
  2⤵
  PID:7388
- C:\Windows\System\kIEzUIC.exe
  C:\Windows\System\kIEzUIC.exe
  2⤵
  PID:7404
- C:\Windows\System\qPKtrhq.exe
  C:\Windows\System\qPKtrhq.exe
  2⤵
  PID:7420
- C:\Windows\System\SOjrZlU.exe
  C:\Windows\System\SOjrZlU.exe
  2⤵
  PID:7436
- C:\Windows\System\bdpzQSD.exe
  C:\Windows\System\bdpzQSD.exe
  2⤵
  PID:7452
- C:\Windows\System\yvkiBij.exe
  C:\Windows\System\yvkiBij.exe
  2⤵
  PID:7468
- C:\Windows\System\eVWqARw.exe
  C:\Windows\System\eVWqARw.exe
  2⤵
  PID:7484
- C:\Windows\System\pVSuobZ.exe
  C:\Windows\System\pVSuobZ.exe
  2⤵
  PID:7504
- C:\Windows\System\PNfdBHV.exe
  C:\Windows\System\PNfdBHV.exe
  2⤵
  PID:7520
- C:\Windows\System\Ckkxwju.exe
  C:\Windows\System\Ckkxwju.exe
  2⤵
  PID:7536
- C:\Windows\System\vCpMFUj.exe
  C:\Windows\System\vCpMFUj.exe
  2⤵
  PID:7552
- C:\Windows\System\mJeONJk.exe
  C:\Windows\System\mJeONJk.exe
  2⤵
  PID:7568
- C:\Windows\System\zAnkkMn.exe
  C:\Windows\System\zAnkkMn.exe
  2⤵
  PID:7584
- C:\Windows\System\PANDWSi.exe
  C:\Windows\System\PANDWSi.exe
  2⤵
  PID:7604
- C:\Windows\System\fvitjqK.exe
  C:\Windows\System\fvitjqK.exe
  2⤵
  PID:7620
- C:\Windows\System\bIyxrOX.exe
  C:\Windows\System\bIyxrOX.exe
  2⤵
  PID:7636
- C:\Windows\System\DLdwtIu.exe
  C:\Windows\System\DLdwtIu.exe
  2⤵
  PID:7652
- C:\Windows\System\nglbevB.exe
  C:\Windows\System\nglbevB.exe
  2⤵
  PID:7668
- C:\Windows\System\MZSCPmf.exe
  C:\Windows\System\MZSCPmf.exe
  2⤵
  PID:7684
- C:\Windows\System\anRoEfX.exe
  C:\Windows\System\anRoEfX.exe
  2⤵
  PID:7700
- C:\Windows\System\SFTkoHH.exe
  C:\Windows\System\SFTkoHH.exe
  2⤵
  PID:7716
- C:\Windows\System\vJFUMyN.exe
  C:\Windows\System\vJFUMyN.exe
  2⤵
  PID:7736
- C:\Windows\System\SrwBYFI.exe
  C:\Windows\System\SrwBYFI.exe
  2⤵
  PID:7752
- C:\Windows\System\sDnucMD.exe
  C:\Windows\System\sDnucMD.exe
  2⤵
  PID:7768
- C:\Windows\System\pcedTqh.exe
  C:\Windows\System\pcedTqh.exe
  2⤵
  PID:7784
- C:\Windows\System\zHjjncr.exe
  C:\Windows\System\zHjjncr.exe
  2⤵
  PID:7800
- C:\Windows\System\sTbJLHD.exe
  C:\Windows\System\sTbJLHD.exe
  2⤵
  PID:7816
- C:\Windows\System\uvHZuZU.exe
  C:\Windows\System\uvHZuZU.exe
  2⤵
  PID:7832
- C:\Windows\System\AlfQBmx.exe
  C:\Windows\System\AlfQBmx.exe
  2⤵
  PID:7848
- C:\Windows\System\UtJSjtw.exe
  C:\Windows\System\UtJSjtw.exe
  2⤵
  PID:7864
- C:\Windows\System\fzXocpd.exe
  C:\Windows\System\fzXocpd.exe
  2⤵
  PID:7896
- C:\Windows\System\gzpnNER.exe
  C:\Windows\System\gzpnNER.exe
  2⤵
  PID:7912
- C:\Windows\System\ULZElCp.exe
  C:\Windows\System\ULZElCp.exe
  2⤵
  PID:7928
- C:\Windows\System\CkBMdzH.exe
  C:\Windows\System\CkBMdzH.exe
  2⤵
  PID:7944
- C:\Windows\System\RWjWWTr.exe
  C:\Windows\System\RWjWWTr.exe
  2⤵
  PID:7960
- C:\Windows\System\pNFmdvH.exe
  C:\Windows\System\pNFmdvH.exe
  2⤵
  PID:7976
- C:\Windows\System\uffaQqy.exe
  C:\Windows\System\uffaQqy.exe
  2⤵
  PID:7992
- C:\Windows\System\ttAtFvT.exe
  C:\Windows\System\ttAtFvT.exe
  2⤵
  PID:8012
- C:\Windows\System\ykOVmDf.exe
  C:\Windows\System\ykOVmDf.exe
  2⤵
  PID:8028
- C:\Windows\System\vfDnEyx.exe
  C:\Windows\System\vfDnEyx.exe
  2⤵
  PID:8044
- C:\Windows\System\yhGAfRY.exe
  C:\Windows\System\yhGAfRY.exe
  2⤵
  PID:8060
- C:\Windows\System\mLqUfkt.exe
  C:\Windows\System\mLqUfkt.exe
  2⤵
  PID:8076
- C:\Windows\System\vzICLdi.exe
  C:\Windows\System\vzICLdi.exe
  2⤵
  PID:8092
- C:\Windows\System\DyfEfsX.exe
  C:\Windows\System\DyfEfsX.exe
  2⤵
  PID:8108
- C:\Windows\System\QLBvczF.exe
  C:\Windows\System\QLBvczF.exe
  2⤵
  PID:8124
- C:\Windows\System\uIhspeJ.exe
  C:\Windows\System\uIhspeJ.exe
  2⤵
  PID:8144
- C:\Windows\System\XBtrump.exe
  C:\Windows\System\XBtrump.exe
  2⤵
  PID:8160
- C:\Windows\System\DOUrDrX.exe
  C:\Windows\System\DOUrDrX.exe
  2⤵
  PID:8176
- C:\Windows\System\xHXNGnq.exe
  C:\Windows\System\xHXNGnq.exe
  2⤵
  PID:7016
- C:\Windows\System\RKNabij.exe
  C:\Windows\System\RKNabij.exe
  2⤵
  PID:7312
- C:\Windows\System\IQprkgO.exe
  C:\Windows\System\IQprkgO.exe
  2⤵
  PID:7412
- C:\Windows\System\RzeKQtr.exe
  C:\Windows\System\RzeKQtr.exe
  2⤵
  PID:7216
- C:\Windows\System\dTOMzzd.exe
  C:\Windows\System\dTOMzzd.exe
  2⤵
  PID:7252
- C:\Windows\System\DdpkSUS.exe
  C:\Windows\System\DdpkSUS.exe
  2⤵
  PID:7212
- C:\Windows\System\QSRFPCb.exe
  C:\Windows\System\QSRFPCb.exe
  2⤵
  PID:7348
- C:\Windows\System\ibChkVG.exe
  C:\Windows\System\ibChkVG.exe
  2⤵
  PID:7512
- C:\Windows\System\JselbHn.exe
  C:\Windows\System\JselbHn.exe
  2⤵
  PID:7576
- C:\Windows\System\ILxUcKB.exe
  C:\Windows\System\ILxUcKB.exe
  2⤵
  PID:6932
- C:\Windows\System\DMiZAIh.exe
  C:\Windows\System\DMiZAIh.exe
  2⤵
  PID:7092
- C:\Windows\System\fYQtMvp.exe
  C:\Windows\System\fYQtMvp.exe
  2⤵
  PID:7232
- C:\Windows\System\mMrFBkf.exe
  C:\Windows\System\mMrFBkf.exe
  2⤵
  PID:7332
- C:\Windows\System\gxIrTll.exe
  C:\Windows\System\gxIrTll.exe
  2⤵
  PID:7396
- C:\Windows\System\JLicLmb.exe
  C:\Windows\System\JLicLmb.exe
  2⤵
  PID:7464
- C:\Windows\System\RUDvrPP.exe
  C:\Windows\System\RUDvrPP.exe
  2⤵
  PID:7532
- C:\Windows\System\CPLfiAn.exe
  C:\Windows\System\CPLfiAn.exe
  2⤵
  PID:7596
- C:\Windows\System\qDEtNOW.exe
  C:\Windows\System\qDEtNOW.exe
  2⤵
  PID:7660
- C:\Windows\System\pFjlfoi.exe
  C:\Windows\System\pFjlfoi.exe
  2⤵
  PID:7724
- C:\Windows\System\sIjsRzO.exe
  C:\Windows\System\sIjsRzO.exe
  2⤵
  PID:7728
- C:\Windows\System\lbgesHA.exe
  C:\Windows\System\lbgesHA.exe
  2⤵
  PID:7812
- C:\Windows\System\rHnalTl.exe
  C:\Windows\System\rHnalTl.exe
  2⤵
  PID:7824
- C:\Windows\System\UeKIiKI.exe
  C:\Windows\System\UeKIiKI.exe
  2⤵
  PID:7876
- C:\Windows\System\NPLRkOk.exe
  C:\Windows\System\NPLRkOk.exe
  2⤵
  PID:7744
- C:\Windows\System\yqUeuTn.exe
  C:\Windows\System\yqUeuTn.exe
  2⤵
  PID:8104
- C:\Windows\System\XyYWYgA.exe
  C:\Windows\System\XyYWYgA.exe
  2⤵
  PID:7284
- C:\Windows\System\DfmNeoC.exe
  C:\Windows\System\DfmNeoC.exe
  2⤵
  PID:7184
- C:\Windows\System\BQgKCeS.exe
  C:\Windows\System\BQgKCeS.exe
  2⤵
  PID:6416
- C:\Windows\System\PWvQZRo.exe
  C:\Windows\System\PWvQZRo.exe
  2⤵
  PID:7200
- C:\Windows\System\Tsvkytx.exe
  C:\Windows\System\Tsvkytx.exe
  2⤵
  PID:7632
- C:\Windows\System\JUIwOCZ.exe
  C:\Windows\System\JUIwOCZ.exe
  2⤵
  PID:7368
- C:\Windows\System\TKfaPBY.exe
  C:\Windows\System\TKfaPBY.exe
  2⤵
  PID:6336
- C:\Windows\System\vxmxptq.exe
  C:\Windows\System\vxmxptq.exe
  2⤵
  PID:7920
- C:\Windows\System\eoVoAAy.exe
  C:\Windows\System\eoVoAAy.exe
  2⤵
  PID:8184
- C:\Windows\System\IZuIMeQ.exe
  C:\Windows\System\IZuIMeQ.exe
  2⤵
  PID:7428
- C:\Windows\System\dmNxlIJ.exe
  C:\Windows\System\dmNxlIJ.exe
  2⤵
  PID:7972
- C:\Windows\System\lTfqJWW.exe
  C:\Windows\System\lTfqJWW.exe
  2⤵
  PID:7984
- C:\Windows\System\UBgRyYg.exe
  C:\Windows\System\UBgRyYg.exe
  2⤵
  PID:8056
- C:\Windows\System\NBFDgWJ.exe
  C:\Windows\System\NBFDgWJ.exe
  2⤵
  PID:8120
- C:\Windows\System\QThmNZL.exe
  C:\Windows\System\QThmNZL.exe
  2⤵
  PID:8156
- C:\Windows\System\oxbKRyz.exe
  C:\Windows\System\oxbKRyz.exe
  2⤵
  PID:7060
- C:\Windows\System\LeuyTNG.exe
  C:\Windows\System\LeuyTNG.exe
  2⤵
  PID:7460
- C:\Windows\System\TlvVswN.exe
  C:\Windows\System\TlvVswN.exe
  2⤵
  PID:7732
- C:\Windows\System\HwHeOXB.exe
  C:\Windows\System\HwHeOXB.exe
  2⤵
  PID:7496
- C:\Windows\System\uQZbJCs.exe
  C:\Windows\System\uQZbJCs.exe
  2⤵
  PID:7528
- C:\Windows\System\AQzcYWg.exe
  C:\Windows\System\AQzcYWg.exe
  2⤵
  PID:7884
- C:\Windows\System\JJohKMg.exe
  C:\Windows\System\JJohKMg.exe
  2⤵
  PID:7296
- C:\Windows\System\JJzGceE.exe
  C:\Windows\System\JJzGceE.exe
  2⤵
  PID:7544
- C:\Windows\System\euPHTcb.exe
  C:\Windows\System\euPHTcb.exe
  2⤵
  PID:7844
- C:\Windows\System\gjDHjmC.exe
  C:\Windows\System\gjDHjmC.exe
  2⤵
  PID:7316
- C:\Windows\System\TvBHWqS.exe
  C:\Windows\System\TvBHWqS.exe
  2⤵
  PID:7904
- C:\Windows\System\DfccBWk.exe
  C:\Windows\System\DfccBWk.exe
  2⤵
  PID:8188
- C:\Windows\System\wXNXxJv.exe
  C:\Windows\System\wXNXxJv.exe
  2⤵
  PID:7856
- C:\Windows\System\Gufujid.exe
  C:\Windows\System\Gufujid.exe
  2⤵
  PID:7760
- C:\Windows\System\gJgkdxj.exe
  C:\Windows\System\gJgkdxj.exe
  2⤵
  PID:8008
- C:\Windows\System\lQqfATL.exe
  C:\Windows\System\lQqfATL.exe
  2⤵
  PID:8072
- C:\Windows\System\BeJflbx.exe
  C:\Windows\System\BeJflbx.exe
  2⤵
  PID:8140
- C:\Windows\System\ZbKAeop.exe
  C:\Windows\System\ZbKAeop.exe
  2⤵
  PID:8136
- C:\Windows\System\XdsUeVh.exe
  C:\Windows\System\XdsUeVh.exe
  2⤵
  PID:7840
- C:\Windows\System\QfCAeUb.exe
  C:\Windows\System\QfCAeUb.exe
  2⤵
  PID:8052
- C:\Windows\System\msCrFIE.exe
  C:\Windows\System\msCrFIE.exe
  2⤵
  PID:8088
- C:\Windows\System\xMtlZvL.exe
  C:\Windows\System\xMtlZvL.exe
  2⤵
  PID:7268
- C:\Windows\System\vBHMneK.exe
  C:\Windows\System\vBHMneK.exe
  2⤵
  PID:8168
- C:\Windows\System\fdFOdol.exe
  C:\Windows\System\fdFOdol.exe
  2⤵
  PID:7956
- C:\Windows\System\nLYCFjL.exe
  C:\Windows\System\nLYCFjL.exe
  2⤵
  PID:6520
- C:\Windows\System\vWrZeWE.exe
  C:\Windows\System\vWrZeWE.exe
  2⤵
  PID:8204
- C:\Windows\System\TkHUEhx.exe
  C:\Windows\System\TkHUEhx.exe
  2⤵
  PID:8220
- C:\Windows\System\svBICQR.exe
  C:\Windows\System\svBICQR.exe
  2⤵
  PID:8236
- C:\Windows\System\UjNbSJc.exe
  C:\Windows\System\UjNbSJc.exe
  2⤵
  PID:8252
- C:\Windows\System\mvIMaeB.exe
  C:\Windows\System\mvIMaeB.exe
  2⤵
  PID:8268
- C:\Windows\System\vwscwwH.exe
  C:\Windows\System\vwscwwH.exe
  2⤵
  PID:8284
- C:\Windows\System\gfklVnU.exe
  C:\Windows\System\gfklVnU.exe
  2⤵
  PID:8300
- C:\Windows\System\gadrSNJ.exe
  C:\Windows\System\gadrSNJ.exe
  2⤵
  PID:8316
- C:\Windows\System\igZzztB.exe
  C:\Windows\System\igZzztB.exe
  2⤵
  PID:8336
- C:\Windows\System\TDNgvMj.exe
  C:\Windows\System\TDNgvMj.exe
  2⤵
  PID:8352
- C:\Windows\System\WroNjQL.exe
  C:\Windows\System\WroNjQL.exe
  2⤵
  PID:8368
- C:\Windows\System\WyBlosU.exe
  C:\Windows\System\WyBlosU.exe
  2⤵
  PID:8384
- C:\Windows\System\AgwFknX.exe
  C:\Windows\System\AgwFknX.exe
  2⤵
  PID:8400
- C:\Windows\System\szvQhlo.exe
  C:\Windows\System\szvQhlo.exe
  2⤵
  PID:8420
- C:\Windows\System\vLdgzLe.exe
  C:\Windows\System\vLdgzLe.exe
  2⤵
  PID:8436
- C:\Windows\System\WtNQPVd.exe
  C:\Windows\System\WtNQPVd.exe
  2⤵
  PID:8452
- C:\Windows\System\cCMdnPV.exe
  C:\Windows\System\cCMdnPV.exe
  2⤵
  PID:8468
- C:\Windows\System\uOLqzQH.exe
  C:\Windows\System\uOLqzQH.exe
  2⤵
  PID:8488
- C:\Windows\System\WHrXGzq.exe
  C:\Windows\System\WHrXGzq.exe
  2⤵
  PID:8504
- C:\Windows\System\MFNNzFr.exe
  C:\Windows\System\MFNNzFr.exe
  2⤵
  PID:8520
- C:\Windows\System\YiUJdML.exe
  C:\Windows\System\YiUJdML.exe
  2⤵
  PID:8536
- C:\Windows\System\eDfFmRb.exe
  C:\Windows\System\eDfFmRb.exe
  2⤵
  PID:8552
- C:\Windows\System\WrUYgLo.exe
  C:\Windows\System\WrUYgLo.exe
  2⤵
  PID:8568
- C:\Windows\System\UrZedqT.exe
  C:\Windows\System\UrZedqT.exe
  2⤵
  PID:8588
- C:\Windows\System\bSRNhpm.exe
  C:\Windows\System\bSRNhpm.exe
  2⤵
  PID:8604
- C:\Windows\System\ASGRHuV.exe
  C:\Windows\System\ASGRHuV.exe
  2⤵
  PID:8620
- C:\Windows\System\gkQxYPE.exe
  C:\Windows\System\gkQxYPE.exe
  2⤵
  PID:8640
- C:\Windows\System\HDBkSay.exe
  C:\Windows\System\HDBkSay.exe
  2⤵
  PID:8660
- C:\Windows\System\BDMgCmN.exe
  C:\Windows\System\BDMgCmN.exe
  2⤵
  PID:8676
- C:\Windows\System\GOCYCGg.exe
  C:\Windows\System\GOCYCGg.exe
  2⤵
  PID:8692
- C:\Windows\System\YvHuLFu.exe
  C:\Windows\System\YvHuLFu.exe
  2⤵
  PID:8708
- C:\Windows\System\YDryGpw.exe
  C:\Windows\System\YDryGpw.exe
  2⤵
  PID:8724
- C:\Windows\System\lVBYAZt.exe
  C:\Windows\System\lVBYAZt.exe
  2⤵
  PID:8740
- C:\Windows\System\ZBSlhwl.exe
  C:\Windows\System\ZBSlhwl.exe
  2⤵
  PID:8756
- C:\Windows\System\kzmfQlq.exe
  C:\Windows\System\kzmfQlq.exe
  2⤵
  PID:8772
- C:\Windows\System\SkVbCXt.exe
  C:\Windows\System\SkVbCXt.exe
  2⤵
  PID:8788
- C:\Windows\System\UjmfEID.exe
  C:\Windows\System\UjmfEID.exe
  2⤵
  PID:8804
- C:\Windows\System\cXKbBVw.exe
  C:\Windows\System\cXKbBVw.exe
  2⤵
  PID:8820
- C:\Windows\System\SrZHqvH.exe
  C:\Windows\System\SrZHqvH.exe
  2⤵
  PID:8916
- C:\Windows\System\XYxlxdA.exe
  C:\Windows\System\XYxlxdA.exe
  2⤵
  PID:8948
- C:\Windows\System\sWSwJID.exe
  C:\Windows\System\sWSwJID.exe
  2⤵
  PID:8964
- C:\Windows\System\YillBev.exe
  C:\Windows\System\YillBev.exe
  2⤵
  PID:8980
- C:\Windows\System\MGndvUI.exe
  C:\Windows\System\MGndvUI.exe
  2⤵
  PID:9000
- C:\Windows\System\pmZCYSj.exe
  C:\Windows\System\pmZCYSj.exe
  2⤵
  PID:9016
- C:\Windows\System\aaguhQU.exe
  C:\Windows\System\aaguhQU.exe
  2⤵
  PID:9032
- C:\Windows\System\vcFgLDq.exe
  C:\Windows\System\vcFgLDq.exe
  2⤵
  PID:9048
- C:\Windows\System\QBgFiEb.exe
  C:\Windows\System\QBgFiEb.exe
  2⤵
  PID:9064
- C:\Windows\System\pglorAD.exe
  C:\Windows\System\pglorAD.exe
  2⤵
  PID:9080
- C:\Windows\System\CjOYKhM.exe
  C:\Windows\System\CjOYKhM.exe
  2⤵
  PID:9096
- C:\Windows\System\jMCjefq.exe
  C:\Windows\System\jMCjefq.exe
  2⤵
  PID:9112
- C:\Windows\System\NfuVjUM.exe
  C:\Windows\System\NfuVjUM.exe
  2⤵
  PID:9128
- C:\Windows\System\VOpZeqO.exe
  C:\Windows\System\VOpZeqO.exe
  2⤵
  PID:9144
- C:\Windows\System\RqIIZSv.exe
  C:\Windows\System\RqIIZSv.exe
  2⤵
  PID:9160
- C:\Windows\System\yPcSmuw.exe
  C:\Windows\System\yPcSmuw.exe
  2⤵
  PID:9176
- C:\Windows\System\isYKAsV.exe
  C:\Windows\System\isYKAsV.exe
  2⤵
  PID:9192
- C:\Windows\System\HgFMJvR.exe
  C:\Windows\System\HgFMJvR.exe
  2⤵
  PID:9208
- C:\Windows\System\nxXWeQz.exe
  C:\Windows\System\nxXWeQz.exe
  2⤵
  PID:7936
- C:\Windows\System\yyPTYVh.exe
  C:\Windows\System\yyPTYVh.exe
  2⤵
  PID:7748
- C:\Windows\System\pJROUcJ.exe
  C:\Windows\System\pJROUcJ.exe
  2⤵
  PID:8152
- C:\Windows\System\iJmzBmk.exe
  C:\Windows\System\iJmzBmk.exe
  2⤵
  PID:8196
- C:\Windows\System\CiIiBMV.exe
  C:\Windows\System\CiIiBMV.exe
  2⤵
  PID:8216
- C:\Windows\System\nqOkyuy.exe
  C:\Windows\System\nqOkyuy.exe
  2⤵
  PID:8280
- C:\Windows\System\twYsTPY.exe
  C:\Windows\System\twYsTPY.exe
  2⤵
  PID:8040
- C:\Windows\System\NFtRBiC.exe
  C:\Windows\System\NFtRBiC.exe
  2⤵
  PID:8020
- C:\Windows\System\efmaisG.exe
  C:\Windows\System\efmaisG.exe
  2⤵
  PID:8344
- C:\Windows\System\zDfaJrg.exe
  C:\Windows\System\zDfaJrg.exe
  2⤵
  PID:8408
- C:\Windows\System\eBQfxed.exe
  C:\Windows\System\eBQfxed.exe
  2⤵
  PID:8448
- C:\Windows\System\CKqPhwM.exe
  C:\Windows\System\CKqPhwM.exe
  2⤵
  PID:8512
- C:\Windows\System\WThjqMF.exe
  C:\Windows\System\WThjqMF.exe
  2⤵
  PID:8576
- C:\Windows\System\NDTZaRl.exe
  C:\Windows\System\NDTZaRl.exe
  2⤵
  PID:8584
- C:\Windows\System\JmaONVX.exe
  C:\Windows\System\JmaONVX.exe
  2⤵
  PID:8292
- C:\Windows\System\TJlAvNN.exe
  C:\Windows\System\TJlAvNN.exe
  2⤵
  PID:8428
- C:\Windows\System\YeFfjsT.exe
  C:\Windows\System\YeFfjsT.exe
  2⤵
  PID:8648
- C:\Windows\System\sSTaZRa.exe
  C:\Windows\System\sSTaZRa.exe
  2⤵
  PID:8656
- C:\Windows\System\BUZDKFn.exe
  C:\Windows\System\BUZDKFn.exe
  2⤵
  PID:8532
- C:\Windows\System\kzPYEBu.exe
  C:\Windows\System\kzPYEBu.exe
  2⤵
  PID:8596
- C:\Windows\System\pZufBOl.exe
  C:\Windows\System\pZufBOl.exe
  2⤵
  PID:8636
- C:\Windows\System\EAdWorH.exe
  C:\Windows\System\EAdWorH.exe
  2⤵
  PID:8716
- C:\Windows\System\mphsXce.exe
  C:\Windows\System\mphsXce.exe
  2⤵
  PID:8748
- C:\Windows\System\WdsYGRz.exe
  C:\Windows\System\WdsYGRz.exe
  2⤵
  PID:8812
- C:\Windows\System\pfBjHcu.exe
  C:\Windows\System\pfBjHcu.exe
  2⤵
  PID:8704
- C:\Windows\System\JJVbupZ.exe
  C:\Windows\System\JJVbupZ.exe
  2⤵
  PID:8796
- C:\Windows\System\voYsVjx.exe
  C:\Windows\System\voYsVjx.exe
  2⤵
  PID:8832
- C:\Windows\System\ZZZFxFt.exe
  C:\Windows\System\ZZZFxFt.exe
  2⤵
  PID:8848
- C:\Windows\System\kwFRMGy.exe
  C:\Windows\System\kwFRMGy.exe
  2⤵
  PID:8856
- C:\Windows\System\kWdcMUE.exe
  C:\Windows\System\kWdcMUE.exe
  2⤵
  PID:8884
- C:\Windows\System\RfLsUhl.exe
  C:\Windows\System\RfLsUhl.exe
  2⤵
  PID:8904
- C:\Windows\System\VNnsJAG.exe
  C:\Windows\System\VNnsJAG.exe
  2⤵
  PID:8924
- C:\Windows\System\rOamYQS.exe
  C:\Windows\System\rOamYQS.exe
  2⤵
  PID:8944
- C:\Windows\System\zgkBHyB.exe
  C:\Windows\System\zgkBHyB.exe
  2⤵
  PID:8976
- C:\Windows\System\usEWheY.exe
  C:\Windows\System\usEWheY.exe
  2⤵
  PID:9044
- C:\Windows\System\yfuAGcI.exe
  C:\Windows\System\yfuAGcI.exe
  2⤵
  PID:8996
- C:\Windows\System\kNUxawq.exe
  C:\Windows\System\kNUxawq.exe
  2⤵
  PID:9060
- C:\Windows\System\cadHDhI.exe
  C:\Windows\System\cadHDhI.exe
  2⤵
  PID:9124
- C:\Windows\System\rrxTLyN.exe
  C:\Windows\System\rrxTLyN.exe
  2⤵
  PID:9168
- C:\Windows\System\cTQEZQp.exe
  C:\Windows\System\cTQEZQp.exe
  2⤵
  PID:7908
- C:\Windows\System\DreGlSf.exe
  C:\Windows\System\DreGlSf.exe
  2⤵
  PID:7796
- C:\Windows\System\ETQzBWf.exe
  C:\Windows\System\ETQzBWf.exe
  2⤵
  PID:7380
- C:\Windows\System\ilDAYAO.exe
  C:\Windows\System\ilDAYAO.exe
  2⤵
  PID:8484
- C:\Windows\System\goNBypp.exe
  C:\Windows\System\goNBypp.exe
  2⤵
  PID:8396
- C:\Windows\System\JVPhtRH.exe
  C:\Windows\System\JVPhtRH.exe
  2⤵
  PID:8464
- C:\Windows\System\rTHtQEe.exe
  C:\Windows\System\rTHtQEe.exe
  2⤵
  PID:9188
- C:\Windows\System\dlzDraw.exe
  C:\Windows\System\dlzDraw.exe
  2⤵
  PID:8616
- C:\Windows\System\pkbqviw.exe
  C:\Windows\System\pkbqviw.exe
  2⤵
  PID:8416
- C:\Windows\System\gaSANKu.exe
  C:\Windows\System\gaSANKu.exe
  2⤵
  PID:8312
- C:\Windows\System\DmSmlyz.exe
  C:\Windows\System\DmSmlyz.exe
  2⤵
  PID:7448
- C:\Windows\System\IlQWSch.exe
  C:\Windows\System\IlQWSch.exe
  2⤵
  PID:8684
- C:\Windows\System\WvDKHMk.exe
  C:\Windows\System\WvDKHMk.exe
  2⤵
  PID:8668
- C:\Windows\System\ebHAVLZ.exe
  C:\Windows\System\ebHAVLZ.exe
  2⤵
  PID:8732
- C:\Windows\System\cXHqJsX.exe
  C:\Windows\System\cXHqJsX.exe
  2⤵
  PID:8836
- C:\Windows\System\ENXnDwH.exe
  C:\Windows\System\ENXnDwH.exe
  2⤵
  PID:8864
- C:\Windows\System\OuUaAQp.exe
  C:\Windows\System\OuUaAQp.exe
  2⤵
  PID:9076
- C:\Windows\System\HUlnDPd.exe
  C:\Windows\System\HUlnDPd.exe
  2⤵
  PID:9120
- C:\Windows\System\UjWIxZG.exe
  C:\Windows\System\UjWIxZG.exe
  2⤵
  PID:9028
- C:\Windows\System\CUWHjVO.exe
  C:\Windows\System\CUWHjVO.exe
  2⤵
  PID:8892
- C:\Windows\System\WwtiidB.exe
  C:\Windows\System\WwtiidB.exe
  2⤵
  PID:9156
- C:\Windows\System\VmrVODr.exe
  C:\Windows\System\VmrVODr.exe
  2⤵
  PID:9140
- C:\Windows\System\MLsmcLJ.exe
  C:\Windows\System\MLsmcLJ.exe
  2⤵
  PID:8248
- C:\Windows\System\HEIOjiF.exe
  C:\Windows\System\HEIOjiF.exe
  2⤵
  PID:7880
- C:\Windows\System\onlyGLr.exe
  C:\Windows\System\onlyGLr.exe
  2⤵
  PID:8380
- C:\Windows\System\hMYqUbE.exe
  C:\Windows\System\hMYqUbE.exe
  2⤵
  PID:8544
- C:\Windows\System\ZKNVCHC.exe
  C:\Windows\System\ZKNVCHC.exe
  2⤵
  PID:7892
- C:\Windows\System\hlyJvjX.exe
  C:\Windows\System\hlyJvjX.exe
  2⤵
  PID:8784
- C:\Windows\System\rcggZxg.exe
  C:\Windows\System\rcggZxg.exe
  2⤵
  PID:8736
- C:\Windows\System\AYdHsDs.exe
  C:\Windows\System\AYdHsDs.exe
  2⤵
  PID:8876
- C:\Windows\System\ighSGAo.exe
  C:\Windows\System\ighSGAo.exe
  2⤵
  PID:9056
- C:\Windows\System\RNunIPz.exe
  C:\Windows\System\RNunIPz.exe
  2⤵
  PID:8988
- C:\Windows\System\zPkenZJ.exe
  C:\Windows\System\zPkenZJ.exe
  2⤵
  PID:8628
- C:\Windows\System\IeVAkWv.exe
  C:\Windows\System\IeVAkWv.exe
  2⤵
  PID:9232
- C:\Windows\System\NRXcZGx.exe
  C:\Windows\System\NRXcZGx.exe
  2⤵
  PID:9248
- C:\Windows\System\sXHNyHg.exe
  C:\Windows\System\sXHNyHg.exe
  2⤵
  PID:9264
- C:\Windows\System\RUeWjVk.exe
  C:\Windows\System\RUeWjVk.exe
  2⤵
  PID:9280
- C:\Windows\System\gOFjFLJ.exe
  C:\Windows\System\gOFjFLJ.exe
  2⤵
  PID:9296
- C:\Windows\System\scbcWVX.exe
  C:\Windows\System\scbcWVX.exe
  2⤵
  PID:9360
- C:\Windows\System\HsmPuxL.exe
  C:\Windows\System\HsmPuxL.exe
  2⤵
  PID:9376
- C:\Windows\System\SJuSmdY.exe
  C:\Windows\System\SJuSmdY.exe
  2⤵
  PID:9392
- C:\Windows\System\uWhOxWg.exe
  C:\Windows\System\uWhOxWg.exe
  2⤵
  PID:9408
- C:\Windows\System\PILdHua.exe
  C:\Windows\System\PILdHua.exe
  2⤵
  PID:9428
- C:\Windows\System\zherEdi.exe
  C:\Windows\System\zherEdi.exe
  2⤵
  PID:9444
- C:\Windows\System\QMHvDjB.exe
  C:\Windows\System\QMHvDjB.exe
  2⤵
  PID:9460
- C:\Windows\System\LSDlVNU.exe
  C:\Windows\System\LSDlVNU.exe
  2⤵
  PID:9480
- C:\Windows\System\DqPTpwJ.exe
  C:\Windows\System\DqPTpwJ.exe
  2⤵
  PID:9496
- C:\Windows\System\XCnhnSS.exe
  C:\Windows\System\XCnhnSS.exe
  2⤵
  PID:9512
- C:\Windows\System\KiPWakT.exe
  C:\Windows\System\KiPWakT.exe
  2⤵
  PID:9528
- C:\Windows\System\iwirZDO.exe
  C:\Windows\System\iwirZDO.exe
  2⤵
  PID:9544
- C:\Windows\System\lguYdbX.exe
  C:\Windows\System\lguYdbX.exe
  2⤵
  PID:9560
- C:\Windows\System\MNuUNyT.exe
  C:\Windows\System\MNuUNyT.exe
  2⤵
  PID:9580
- C:\Windows\System\MtcJoyV.exe
  C:\Windows\System\MtcJoyV.exe
  2⤵
  PID:9608
- C:\Windows\System\dxzZvON.exe
  C:\Windows\System\dxzZvON.exe
  2⤵
  PID:9624
- C:\Windows\System\RSnALag.exe
  C:\Windows\System\RSnALag.exe
  2⤵
  PID:9644
- C:\Windows\System\ZmwcPYn.exe
  C:\Windows\System\ZmwcPYn.exe
  2⤵
  PID:9664
- C:\Windows\System\nBybvRw.exe
  C:\Windows\System\nBybvRw.exe
  2⤵
  PID:9680
- C:\Windows\System\XMPppTE.exe
  C:\Windows\System\XMPppTE.exe
  2⤵
  PID:9772
- C:\Windows\System\Uqhmiqu.exe
  C:\Windows\System\Uqhmiqu.exe
  2⤵
  PID:9788
- C:\Windows\System\YicZPhC.exe
  C:\Windows\System\YicZPhC.exe
  2⤵
  PID:9804
- C:\Windows\System\KWytOYu.exe
  C:\Windows\System\KWytOYu.exe
  2⤵
  PID:9824
- C:\Windows\System\pXjaVDj.exe
  C:\Windows\System\pXjaVDj.exe
  2⤵
  PID:9840
- C:\Windows\System\lPxwqDw.exe
  C:\Windows\System\lPxwqDw.exe
  2⤵
  PID:9856
- C:\Windows\System\MGOAnZZ.exe
  C:\Windows\System\MGOAnZZ.exe
  2⤵
  PID:9872
- C:\Windows\System\bsfQiWd.exe
  C:\Windows\System\bsfQiWd.exe
  2⤵
  PID:9888
- C:\Windows\System\lWzFEBo.exe
  C:\Windows\System\lWzFEBo.exe
  2⤵
  PID:9904
- C:\Windows\System\FpEZFmy.exe
  C:\Windows\System\FpEZFmy.exe
  2⤵
  PID:9920
- C:\Windows\System\EHtHmLQ.exe
  C:\Windows\System\EHtHmLQ.exe
  2⤵
  PID:9936
- C:\Windows\System\AsRLLIR.exe
  C:\Windows\System\AsRLLIR.exe
  2⤵
  PID:9952
- C:\Windows\System\jyHLubE.exe
  C:\Windows\System\jyHLubE.exe
  2⤵
  PID:9968
- C:\Windows\System\dYqKhFv.exe
  C:\Windows\System\dYqKhFv.exe
  2⤵
  PID:9984
- C:\Windows\System\CHwELSu.exe
  C:\Windows\System\CHwELSu.exe
  2⤵
  PID:10000
- C:\Windows\System\MBOyDcC.exe
  C:\Windows\System\MBOyDcC.exe
  2⤵
  PID:10052
- C:\Windows\System\rsXuSfg.exe
  C:\Windows\System\rsXuSfg.exe
  2⤵
  PID:10072
- C:\Windows\System\bmGDMqH.exe
  C:\Windows\System\bmGDMqH.exe
  2⤵
  PID:10088
- C:\Windows\System\gFqGizy.exe
  C:\Windows\System\gFqGizy.exe
  2⤵
  PID:10108
- C:\Windows\System\xXtdinx.exe
  C:\Windows\System\xXtdinx.exe
  2⤵
  PID:10128
- C:\Windows\System\sbpiJgn.exe
  C:\Windows\System\sbpiJgn.exe
  2⤵
  PID:10144
- C:\Windows\System\VIuJwpm.exe
  C:\Windows\System\VIuJwpm.exe
  2⤵
  PID:10160
- C:\Windows\System\WQFTdYX.exe
  C:\Windows\System\WQFTdYX.exe
  2⤵
  PID:10176
- C:\Windows\System\EtAnTHv.exe
  C:\Windows\System\EtAnTHv.exe
  2⤵
  PID:10192
- C:\Windows\System\LHwUJgM.exe
  C:\Windows\System\LHwUJgM.exe
  2⤵
  PID:10208
- C:\Windows\System\rRMhgge.exe
  C:\Windows\System\rRMhgge.exe
  2⤵
  PID:10224
- C:\Windows\System\fOOjsWL.exe
  C:\Windows\System\fOOjsWL.exe
  2⤵
  PID:8936
- C:\Windows\System\GRjcuYh.exe
  C:\Windows\System\GRjcuYh.exe
  2⤵
  PID:9092
- C:\Windows\System\LVxTvBi.exe
  C:\Windows\System\LVxTvBi.exe
  2⤵
  PID:7952
- C:\Windows\System\ljYkISo.exe
  C:\Windows\System\ljYkISo.exe
  2⤵
  PID:8972
- C:\Windows\System\PmfmSeI.exe
  C:\Windows\System\PmfmSeI.exe
  2⤵
  PID:8260
- C:\Windows\System\lPWnlOE.exe
  C:\Windows\System\lPWnlOE.exe
  2⤵
  PID:9240
- C:\Windows\System\Ksiovio.exe
  C:\Windows\System\Ksiovio.exe
  2⤵
  PID:9272
- C:\Windows\System\vBVAoCv.exe
  C:\Windows\System\vBVAoCv.exe
  2⤵
  PID:9552
- C:\Windows\System\NdrHYCD.exe
  C:\Windows\System\NdrHYCD.exe
  2⤵
  PID:9508
- C:\Windows\System\GDNEdtV.exe
  C:\Windows\System\GDNEdtV.exe
  2⤵
  PID:9368
- C:\Windows\System\gRRwbug.exe
  C:\Windows\System\gRRwbug.exe
  2⤵
  PID:9596
- C:\Windows\System\VDhekSZ.exe
  C:\Windows\System\VDhekSZ.exe
  2⤵
  PID:9812
- C:\Windows\System\mOzGGMq.exe
  C:\Windows\System\mOzGGMq.exe
  2⤵
  PID:9820
- C:\Windows\System\YLauyCJ.exe
  C:\Windows\System\YLauyCJ.exe
  2⤵
  PID:9852
- C:\Windows\System\qRNlsnX.exe
  C:\Windows\System\qRNlsnX.exe
  2⤵
  PID:9912
- C:\Windows\System\ULkCJiO.exe
  C:\Windows\System\ULkCJiO.exe
  2⤵
  PID:9868
- C:\Windows\System\ySEVlQO.exe
  C:\Windows\System\ySEVlQO.exe
  2⤵
  PID:9948
- C:\Windows\System\KNtuVWJ.exe
  C:\Windows\System\KNtuVWJ.exe
  2⤵
  PID:9964
- C:\Windows\System\HtEXfYW.exe
  C:\Windows\System\HtEXfYW.exe
  2⤵
  PID:10016
- C:\Windows\System\iZEuPka.exe
  C:\Windows\System\iZEuPka.exe
  2⤵
  PID:10036
- C:\Windows\System\jKYIaGj.exe
  C:\Windows\System\jKYIaGj.exe
  2⤵
  PID:10080
- C:\Windows\System\AbzOKLa.exe
  C:\Windows\System\AbzOKLa.exe
  2⤵
  PID:10152
- C:\Windows\System\rWKTRvv.exe
  C:\Windows\System\rWKTRvv.exe
  2⤵
  PID:10096
- C:\Windows\System\MgiPMCG.exe
  C:\Windows\System\MgiPMCG.exe
  2⤵
  PID:10136
- C:\Windows\System\pkcKvkY.exe
  C:\Windows\System\pkcKvkY.exe
  2⤵
  PID:10172
- C:\Windows\System\VsFnKTs.exe
  C:\Windows\System\VsFnKTs.exe
  2⤵
  PID:10200
- C:\Windows\System\IJefBWk.exe
  C:\Windows\System\IJefBWk.exe
  2⤵
  PID:10236
- C:\Windows\System\miXhTEJ.exe
  C:\Windows\System\miXhTEJ.exe
  2⤵
  PID:8764
- C:\Windows\System\WzErCiT.exe
  C:\Windows\System\WzErCiT.exe
  2⤵
  PID:8632
- C:\Windows\System\dIbGXXZ.exe
  C:\Windows\System\dIbGXXZ.exe
  2⤵
  PID:9256
- C:\Windows\System\LzQecqA.exe
  C:\Windows\System\LzQecqA.exe
  2⤵
  PID:9740
- C:\Windows\System\vyScUvD.exe
  C:\Windows\System\vyScUvD.exe
  2⤵
  PID:9328
- C:\Windows\System\dMJVHgf.exe
  C:\Windows\System\dMJVHgf.exe
  2⤵
  PID:9348
- C:\Windows\System\sEtZqXZ.exe
  C:\Windows\System\sEtZqXZ.exe
  2⤵
  PID:9456
- C:\Windows\System\MxdBhPO.exe
  C:\Windows\System\MxdBhPO.exe
  2⤵
  PID:9384
- C:\Windows\System\yLuzYrq.exe
  C:\Windows\System\yLuzYrq.exe
  2⤵
  PID:9420
- C:\Windows\System\TgcoGUB.exe
  C:\Windows\System\TgcoGUB.exe
  2⤵
  PID:9468
- C:\Windows\System\fiZBXyY.exe
  C:\Windows\System\fiZBXyY.exe
  2⤵
  PID:9372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BMlQmFy.exe

Filesize
1.4MB

MD5
d42a05688ee959809cf03c7f99997b94

SHA1
a985900ae6fa5b6d51e223d959f58e3c06d743d1

SHA256
ab211d032193ac1c3fb53a2d3547da5fe5094b0169e339ec8ebe2f79adf115d8

SHA512
9a30f4ba0784e60bbbd290c06e327ada8791e425ae5120dac6dda003d98ebae0f79b779277a2e3fe1224090c93671156fdd21f30f1d9e82aa1d9619b89caa82f

Download Submit
C:\Windows\system\KDzqzVH.exe

Filesize
1.4MB

MD5
40079612b4f5af2030c44217d1f0754a

SHA1
b16edbc0e5331a0a7037a44446605508094ae90a

SHA256
be7d34a7530b2937f5cd9ecb368a01c6fde4c279722e864ec3436aa8bf47dcc0

SHA512
21eafc1d4bbf060dd89600b2dc126a0ff7a7c743fb2ad49d4e8d8eefc1773f9aa85a93a2cf64943f2c399e46efafcc92ddb0af31d334055ca608a2b734f8e07d

Download Submit
C:\Windows\system\LxTubcz.exe

Filesize
1.4MB

MD5
bdadeb9f5840b0c333aad3c6dc541d87

SHA1
55dca34913e0af66f803e17ac4f015cbe0c47bd6

SHA256
4a000eab0a8d17a5428c07111cc7c49529439074fdd04a69fa262c890c879c8b

SHA512
26612f2d626731bdd8de651cb5c7fa036a1af6ecd5365a2ee6b8423287be4dcd8b64f78b0798be280f47e9211e02fd072e09f7903b7f19a26934298d6f26f3ab

Download Submit
C:\Windows\system\MbRzKgs.exe

Filesize
1.4MB

MD5
a92c84b237c26df92112c617266f692f

SHA1
2c7068b4d6d7c0d16aae634173311a6c97dac530

SHA256
806b339c70aa8b3d6818ce6e2c93fc2281fcd558feedb4ec1a13caf47abc4f88

SHA512
bbca1cb755e76bd67eb456e3853e5f43114d622f3ed460044fbb9c1433e8b64644fa76df03a6827efdb5c9f9f6c84ee9a53ac627346d89eb9a123adcc569e2fd

Download Submit
C:\Windows\system\NbwsAia.exe

Filesize
1.4MB

MD5
dfa0b11fbd31a7308ff398f6f5c8a4da

SHA1
5b74730df0545185a6d6fae2e425cb40d55960e4

SHA256
b8aad8be6b63919b910d86e546ff5b71ecf7a69af078b7116d7ddf36d4a7252b

SHA512
2e89977fdb93418445ba0940192a7082119a56a5b8174afbeee678ca2cf2fc580c142dfba80dd9627e4123367f0fa38a6fc7c0266e6ab37dc636eb83867bbf98

Download Submit
C:\Windows\system\PHdbFVr.exe

Filesize
1.4MB

MD5
fe66328ffdce9d7f262143ceb2dbce99

SHA1
4bb1ce122a9a542350dd0e0f943e349d14b9811e

SHA256
23ca617085c47f2b709be8dbfb84bcc22a253fd92d4786489c654ce8da6822d0

SHA512
7587b643a0610352ef9a050f9fb872bb4e2f914abd4bdf90ff9c8310eda5058fcc77891f991eb637afffe28e3a66b72a18a5bfda9c1b47b614e1ca0a30d64d6f

Download Submit
C:\Windows\system\PkDgHmB.exe

Filesize
1.4MB

MD5
4ec5e62b2179058eaba45e78aa2b7282

SHA1
7bf3c6262e9d575e3f75e0b22c6dfd1abc0e9ab9

SHA256
deb5901d2f8eb725dfe21c05b7ae5023a468423928e8460b2cecfc00a832a9b5

SHA512
15300c51ca3b60ce53b9913bf8009c9393fba5a808a0e6bd6653c1aa91735a5b86bca6a6ee4cf649dc21e73a6aeeffef8ac1d20d6da91e5236c3cc1ccb556c62

Download Submit
C:\Windows\system\PtUNGqj.exe

Filesize
1.4MB

MD5
cdfee8e410bd94269d8d97f65f70821a

SHA1
a31bdb90395aee6de352c57fdbb7b461c6977fb8

SHA256
19b98c88b1895dbf230ab7edc204de894474855f8d27412b1274bf7cd1681b8b

SHA512
274179c170bb0056e606277be387c56d5e66578c9a5c7ae0a50fc20b6c6bbf6461dac7fe8abf1b8a3ef4dd0a1bc4d7ed21de397447a66d1345857d1b9f59cde4

Download Submit
C:\Windows\system\RJnaZyL.exe

Filesize
1.4MB

MD5
1b11cacac7c92885ced733a35cb45bb4

SHA1
d43dd9f87054ffe579edca667576dedba8171a9b

SHA256
bf649e8e1ac575eacfee910c9e2dc8b6f393d37397f90f6302a67bafb77a62b3

SHA512
56749cc6ab0852f8c78e7165a3f433a7a475c056315f453ebf228860d8e39b868e304715332a42c1cbe1c50b3641a68a99de9885050209e4e9024df7f5269f22

Download Submit
C:\Windows\system\SydBoGZ.exe

Filesize
1.4MB

MD5
c3e0ca944299eb991e71ca87c40b0794

SHA1
9abd9c3cfd30b8ae9d7592d675c094036b51e79f

SHA256
fcec93c383afe860182ae956ce1196fb10d65e93353b7bacb67f8ae6b9c0799e

SHA512
fe8ebf9e64ec2267fb6f55525d9e205c6dfdfc2f48b12c1d66540711ae65256918ddb13a17509997300b31dea6a3314edb4ec5261f3aa688e19cb7862526ed34

Download Submit
C:\Windows\system\TxyBWYW.exe

Filesize
1.4MB

MD5
37f0abffd2dbd66574efbcdafa0fd5cc

SHA1
9e79899722825f2118bdd2687a5fd55157c747e1

SHA256
99776faf1ff508bc6eb0869213e155db8c688d37840f2455485792c8cb740d17

SHA512
1c061fc802e8fce2f55d40e094a79d63c78be35f1ad573e9720ffb4f794193d4a793cb18487b7e8564f94782f6a4244b8a4280007ec80df76f274329dcc529c6

Download Submit
C:\Windows\system\VHCnPsL.exe

Filesize
1.4MB

MD5
c33e4c2b2b39c1c383fa8228a57f19be

SHA1
e48c066f2901149ac419dea7c68d5758966fa133

SHA256
8a1e067f1b775e38ec29fd84f6e0a9147e966e93cca4203465796e360195ba3c

SHA512
e4689928c1c7e0393752c9ed1b8a807688fdd6f1e57e21521f9074bf3e3cd0b13ca98741652fb888f51c4a01a78466b69997a46475fb739b1f850c78772cdf74

Download Submit
C:\Windows\system\VrqTECu.exe

Filesize
1.4MB

MD5
94755de6ba4d13fc2621c75545d90786

SHA1
72ff367aa49b3ae31d595177001274f5271f6590

SHA256
794ea403cc6c45bdfd89ddae4bc1ead28e21305ed3ab3c74bb94cfd28a038650

SHA512
47ce51317918deb4806be4c484561f2b34957cca9dc2706c4ef5c74dc1930cd65017a6b7025491d2989734c15a1dbf68c53cfbab04500864c9fd9e64ec9aaf57

Download Submit
C:\Windows\system\YHSaXZR.exe

Filesize
1.4MB

MD5
322a30b107c9d1557a7e2e766e2b5bb7

SHA1
1b919f6a814bb3c53fd4887a337893077807ff04

SHA256
4853a9f42e58f868d5e49fcadc0bbcfdd9cea906ec953ed9b65308d193c658c7

SHA512
5dc6edcd8855cc2ef41a1e5e395bdd8f3daa36a28008c1258583994e19e7e69248ac578126dd35f9faf6ff6d18a35a4d6f7c7064304c0a2ce36db50e18055925

Download Submit
C:\Windows\system\hXXEOZm.exe

Filesize
1.4MB

MD5
34e0be573e957d45239ad9b4c4901709

SHA1
823b25b1122b489512a18d4d766f5bb0d5548d05

SHA256
d718d5f352e8604fb2f16c22d40846ce7135e6079c34e04ea6d85aa184b3557c

SHA512
ecad9f0e9ebd21c63a7f8a2fcb3abc5c67e11223f9eb78014af4b30541a24399145fffe35192b63f5129c2b4ba3ac1e2540687cb731037bd8da6508e6c207a5e

Download Submit
C:\Windows\system\ikkqueV.exe

Filesize
1.4MB

MD5
2dcebcb24874e1877813a69eb6ad9168

SHA1
2f6a13773149abf0c022dbb8e6c184174aba7902

SHA256
ec831e9c587d6390b016e057ebcdfdb6bd3f3b2ee84b19a94732bb9de692a8d4

SHA512
44362ee3c243d4325771e0fd9dabeacbb7013f490e167c96d5fd747f953ae2d1339100ad7a782e7069497445ac32857379977637df2c4e20809163035e389bf9

Download Submit
C:\Windows\system\jpQRhNy.exe

Filesize
1.4MB

MD5
d2093786c1f0e89da5d6b2ff25bc2ad8

SHA1
93b83781b522b2b6d92d19ce7d4f618f752b306e

SHA256
11482d3f544fab9442f6d7564c434c3f3d5a67f61d6f2a056f017a1832e9003b

SHA512
d62ea6a564f5a2d63469b6ecf2defe68b63127e36d21967c2cba0f988a9e4be7294e56b5a23253bbf3874965e2a687d58042aab10d4b8e5064ac5a97c26d5300

Download Submit
C:\Windows\system\jtefhTl.exe

Filesize
1.4MB

MD5
690dc5fdf1791067bbd95f19ff349aa2

SHA1
4074d17a49e2994fe41a3025d1b7dbebc0aa4241

SHA256
96819edfb813909b4ac51314e99d31322af977cb9797f040f8f212e5402b9fd6

SHA512
4c9b24eb051a034d33e886e9bcf3922c5cb57457914616d9f5085e3bdf1424a42a1b4ac34cdaf3142832ea1e6306eb87b5b2d0f8ab9b0d416032500ddf653c1d

Download Submit
C:\Windows\system\nSDtpSX.exe

Filesize
1.4MB

MD5
4bf4a605f58e32d3da7879a17ae23a1d

SHA1
8e77c590766ae0098d2e1be8edcbc8530a75ebd7

SHA256
a635c22f07b28c0440c30d6531f263507f2f824f7a866a00440dfb356ca8834f

SHA512
d0a9dbb4537a1dc39dcb214dc8a50b215f9fd56a133694cb6838564f892358fcb8149ce937e0268f2aa924e29cf7e629727b45b077b3931221172542c0e99b4d

Download Submit
C:\Windows\system\nwXBCzc.exe

Filesize
1.4MB

MD5
c27a7f88a6454661ecb07b0b81f87065

SHA1
fa31412444e16c265fa16d3ef73c80b6d71666e7

SHA256
188425e51699f086476884053e51101ea5e9c4df1724f9f4c9aaee2f119d5238

SHA512
e3f508b666d42a9f0af1b10a2d82a30521b858bb7b6c89aa57b7f8475fba8c68a3f4053b6c0a2a1f686e41d22d38a6aecdb159f0441724f3cffd7fd1fdb49967

Download Submit
C:\Windows\system\oAXPGxa.exe

Filesize
1.4MB

MD5
aefef514f2057b93245e011df52f525a

SHA1
cc4f3fc03c2b6598f0fb879d989442884816059c

SHA256
93a2441d5b260a8c9b988034996a53f04d520f1dba89f46ab90542bbd40480ef

SHA512
d412f38b2f0106438005c41993058ed9f5ab276db73dcc6d77907fad3aa996c48192c72e0ff28ded0880115b9523c7bb92b09bfa854eb63e321b266915147dff

Download Submit
C:\Windows\system\spBaypt.exe

Filesize
1.4MB

MD5
5f9511876c00d294f66765d706622e3b

SHA1
a14db4c016cd1340ff2c361247abae0e43b54a44

SHA256
c7f73f6abb6fb27ee1b4fa99d2c4cfb963a6055a20fca21ed9826777fff4fab9

SHA512
9ed889ce2c1b801c225884f11cbab188f39e8736bbe1c82cfceb8316ac965405ab22b00a159c378cf89d3c4906929fbc1a93454a92167d3d48a906e9aca38fe5

Download Submit
C:\Windows\system\wJpDhth.exe

Filesize
1.4MB

MD5
59a51b8cc2b3650d3e9f01ad97c667c9

SHA1
0c0ddeb1aeaaf7162e7ca76ac9aa1643923cdde4

SHA256
310976df5b2fd914f3b32df171a2af4f098de65737eb7db0268532f0c51dd75b

SHA512
46820b979e03752f13eb8b2b85ad5b6a0a02bf75fb558ca6c6d552226c268ded67d8a70f875c1daf6e5f32d0639cf3fbf6fbc5fe9fa04dfbd5798b2e4d171f10

Download Submit
C:\Windows\system\wPRPxQn.exe

Filesize
1.4MB

MD5
db892ccde2951607eb746c6f0e827ecb

SHA1
cea433b2588c48ff0ba9261a17f72fbc81f5b55f

SHA256
3200c43026407bf1057a62685ed843db859f68d0d8ac3da0b85da0b95581cbec

SHA512
ea19d02022d51563796e32a0accc46d245d3ea1c64ab79904f6bbf12b843b1a3c9c204c55a96c3a067753be988b530afc5184cce656c733c85c7fcfbd51d7e0c

Download Submit
\Windows\system\BgMIYGa.exe

Filesize
1.4MB

MD5
80318f3dc51264168f927ac81cb48148

SHA1
7a93a1f2be5a4c8ef62e50a7a6a257126da968e2

SHA256
83d3d5dbc28873f659f4ec69b3baab585ec8a9cdcaf5ec215673ee3569b9a4c2

SHA512
ae3982facf828f39e7c621725f4ce801cf2449088f47ef94d2d8691e0b59e2a528b4b57708f88c71f1a83143497da9461117998eaf4ba19d5cb04a7f9c5a2b9d

Download Submit
\Windows\system\FoJvirI.exe

Filesize
1.4MB

MD5
5c391693d303ed1b8271119973a40d32

SHA1
0f11e99b253381699e6bb1bedd16ce124e23c7da

SHA256
c9e117f2ce176e588187708b1a8de023abf0c52babf34d18cfaac4cda2d737c7

SHA512
7dd50b24b51b54b8500d2d8d3883e99d702f75475b5e01fda80aefde7c41192a8c78ebc030b1db7cd37988bb0abe431aa407b7fe51011f2df9ff889b5bab7e0b

Download Submit
\Windows\system\NPOKipC.exe

Filesize
1.4MB

MD5
80a89a5ba0d8668101999b16c204ecc3

SHA1
4de06bad7c518a6ee408a61836f39a1ebb76e62b

SHA256
574fe788efd53876200f29e1ca1ba4af4f88aed5dd207ad810ad4a3c81aa510b

SHA512
1bfe6ac15a356de1ba3dcd2e2e435e41f031526a1c1e2bf2ca1e8d801f436e415e51b8c8c5863ec88e6936f92f6594105dd9052612dbd4d21a01ab9d579e19a9

Download Submit
\Windows\system\YheJteJ.exe

Filesize
1.4MB

MD5
31a3c9bf95867eb4281ba9878c84a76e

SHA1
af8b6beb602de5197abce491f84fdf25a59fa36b

SHA256
764948beebfe20c8b4a4d440f02bed87f70871d0a04f875b98d51cbd930a3f85

SHA512
4eb9cf06ecb2bd7d386fe1588eb758d868321ac400163ca732e462724409cfcdb4c36f2ee15b8b0d0d040d2796eaa3745659883d005ec9a1fd824d966c408757

Download Submit
\Windows\system\YxQPZOw.exe

Filesize
1.4MB

MD5
2e7981d56b4874dae98a2609e95cd472

SHA1
e33fac315eea463d352a49d8ecb0ca332f6a3b1b

SHA256
b77c2f6526570b22b2517529e42fb3cd20f792eb3406644d7fefc8a34b8df763

SHA512
6eca8b295a2956096b6cb73848e25ecc2447d2467b1f2c83e9aebebd7d04512c76ea7a682d52297701d329ed94175331b42c50476f214dcf95b0e645b3a282ce

Download Submit
\Windows\system\ZnZJkhu.exe

Filesize
1.4MB

MD5
33c080b6dd72e22451045012efd823b0

SHA1
75b26eb7a96f92d1dff5cef49f80f03e39cce899

SHA256
5e6f72d04dc6e7bcd8c2bba73823eb79b9c640ef665f58227200e77ea42a7ea9

SHA512
3df77a79852280f3af83d072d6a7db34932d503685a54d0949dd599fafa6b8992f33b779a9f9f6cc78d4162e32c74b78d8c4b6b44409ba2f072b0421d8910e8f

Download Submit
\Windows\system\dKCBUPX.exe

Filesize
1.4MB

MD5
fec6b59fdca1c7a52aa361cf42c602bc

SHA1
230df3bbb6c1837708668aa759f10824bbac3c8c

SHA256
2bf9e0edbbe7548a6de79231ab0c353090d133dc31fd5585450d92cc1099eb90

SHA512
c88a6b3cc57313b862205674addeda02ea9a48aa17f8312629ac3266ea5e75082330dcab3f93a0d3ab4eb2ceed2d4ac61154c1c4317196947d7558068abfd167

Download Submit
\Windows\system\nwRqhvg.exe

Filesize
1.4MB

MD5
23532c6d59f836efb235ef54b6c08091

SHA1
48e4d062dfa6c513f88ed28f3fceaf0444477142

SHA256
58b40dc0ba20b6d7c1099fbe1290ecb0c6c4b82180839b3fa73d61d533fdb8ba

SHA512
ba2cd3890cfd138a4b5c4cbeffb5deb2ffa9457375299c990653c2ac686f5ff68c6e5999f0a41f330c055ec7857827c55ab2cd2ec4696a4c84558d3f31749d5c

Download Submit
\Windows\system\pRmZNZz.exe

Filesize
1.4MB

MD5
33e2eb266fc3a5d9d8326c8f6d2acc71

SHA1
1e7ce3753d6f6625e0dcba24a50e3274f2e15fef

SHA256
e657b20d211c3c901c9cba9245823b76929f00fca94cf6b135b4948e73c56568

SHA512
4e82f8ae4f206b5f93c688f9939aeac61995d84573039a492afe5215be66c9e9aa1329cb4864094214bd99d621dd5fcad6e17b701b9e76bca709b03b1d04db83

Download Submit
\Windows\system\qzWvdMC.exe

Filesize
1.4MB

MD5
bcf38d55805ddfdc5a5c4b177d9dc9d4

SHA1
f3d7dbb2b45b13acb96d71e708e545fb202b6c2b

SHA256
fcd269a1d119a370ca797315c48382a6c653050931e4d5ce6f9b090a15407ed1

SHA512
ee8ab10a7c3809155bc52904458777c470a0810683b0f1a960b19e5cae83229e2727d27375b2bd617c2ad4c09101a42b97823fceb09d1f2833c92849fc91aa81

Download Submit
\Windows\system\zXcVNeo.exe

Filesize
1.4MB

MD5
d59fb63a50fd494517c59e716b6f82ee

SHA1
d2e2d7e0029e8514aebe891a6d0b92f00565c2e9

SHA256
8df6619055e91b6d22767f51c5d1e5179f593a62c92184f386b0a76f9479c093

SHA512
ae91db6ba14e4db30238f2738aa6f693ca8696a45c6eb4a223dc52e38a3ffcd6fe0c71846759d2aa4e67e9897752fdcd2905789e6892b70b9746542b0223299d

Download Submit
\Windows\system\zzNyMEW.exe

Filesize
1.4MB

MD5
b7f8a368038415f1b23b90a092f6ca28

SHA1
98acdf18708884d5a0d95146825bac9d5f1890eb

SHA256
15af1414ad7934a54a1f1f415edcdff99ac4cfe9013c13d7588f0c0b1f492b3f

SHA512
c919c27c3ed2fb0f808b1ab47a685dd300fe4d6ce82dabd62ea5d493c14ed85cc86fd760a3b8b35c8bb29db9597f02425047137113b0d00d9167f49a7dc4418b

Download Submit
memory/1736-114-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-4774-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-116-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2136-4835-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2188-110-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2264-20-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-107-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2408-109-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-96-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-4717-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-119-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2456-4768-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2588-13-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2664-128-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-4832-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-85-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-4681-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-159-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-88-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-11-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2860-108-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-113-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2860-106-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2860-6934-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2860-6343-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2860-123-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-18-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2860-115-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2860-117-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2860-111-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2860-1-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2860-103-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2884-112-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2912-562-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/2912-46-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2912-21-0x000007FEF5F4E000-0x000007FEF5F4F000-memory.dmp

Filesize
4KB

Download
memory/2912-84-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/2912-34-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2912-156-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/2912-158-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download
memory/2912-105-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

Filesize
9.6MB

Download