xmrig | c87cf131fd199eeaa85bcdba21817bf293f558f1a45a4663695ba0d9b8de8ba5

Analysis

max time kernel
123s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
Size 1.6MB
Sample240525-tlmvasae43
SHA256 c87cf131fd199eeaa85bcdba21817bf293f558f1a45a4663695ba0d9b8de8ba5
MD5 26590cd7c82716739d9ea3c4ff0f7550
SHA1 0a26e3046643e5d8a972f9e636ae47ca025d60eb
SHA512 88961b8da0dcf47fc6a60e7123b514129e1cbef21a722b6c567e8c486f78de9075ee0a5daac35c67deb147bedd01927d166a573ba69f644e6750a1be78442866
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaZ:Lz071uv4BPMkFfdg6NsNtJViSOZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/1368-454-0x00007FF7E9440000-0x00007FF7E9832000-memory.dmp	xmrig
behavioral2/memory/2044-639-0x00007FF6B3C10000-0x00007FF6B4002000-memory.dmp	xmrig
behavioral2/memory/5068-643-0x00007FF68B960000-0x00007FF68BD52000-memory.dmp	xmrig
behavioral2/memory/3268-649-0x00007FF621D10000-0x00007FF622102000-memory.dmp	xmrig
behavioral2/memory/1228-653-0x00007FF74E210000-0x00007FF74E602000-memory.dmp	xmrig
behavioral2/memory/1728-652-0x00007FF763590000-0x00007FF763982000-memory.dmp	xmrig
behavioral2/memory/1716-651-0x00007FF69F610000-0x00007FF69FA02000-memory.dmp	xmrig
behavioral2/memory/3152-648-0x00007FF7E9180000-0x00007FF7E9572000-memory.dmp	xmrig
behavioral2/memory/1744-647-0x00007FF68C1C0000-0x00007FF68C5B2000-memory.dmp	xmrig
behavioral2/memory/1600-646-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp	xmrig
behavioral2/memory/1300-645-0x00007FF7802E0000-0x00007FF7806D2000-memory.dmp	xmrig
behavioral2/memory/2232-644-0x00007FF66DC30000-0x00007FF66E022000-memory.dmp	xmrig
behavioral2/memory/3520-642-0x00007FF6AABD0000-0x00007FF6AAFC2000-memory.dmp	xmrig
behavioral2/memory/1688-574-0x00007FF772960000-0x00007FF772D52000-memory.dmp	xmrig
behavioral2/memory/4224-363-0x00007FF7E40F0000-0x00007FF7E44E2000-memory.dmp	xmrig
behavioral2/memory/4728-298-0x00007FF6D7DD0000-0x00007FF6D81C2000-memory.dmp	xmrig
behavioral2/memory/4216-295-0x00007FF7A5230000-0x00007FF7A5622000-memory.dmp	xmrig
behavioral2/memory/5116-247-0x00007FF7E0700000-0x00007FF7E0AF2000-memory.dmp	xmrig
behavioral2/memory/3292-182-0x00007FF6BE6F0000-0x00007FF6BEAE2000-memory.dmp	xmrig
behavioral2/memory/412-132-0x00007FF6A9530000-0x00007FF6A9922000-memory.dmp	xmrig
behavioral2/memory/4228-84-0x00007FF61F100000-0x00007FF61F4F2000-memory.dmp	xmrig
behavioral2/memory/3168-21-0x00007FF618670000-0x00007FF618A62000-memory.dmp	xmrig
behavioral2/memory/3168-2731-0x00007FF618670000-0x00007FF618A62000-memory.dmp	xmrig
behavioral2/memory/1152-2734-0x00007FF6D32E0000-0x00007FF6D36D2000-memory.dmp	xmrig
behavioral2/memory/4228-2735-0x00007FF61F100000-0x00007FF61F4F2000-memory.dmp	xmrig
behavioral2/memory/412-2737-0x00007FF6A9530000-0x00007FF6A9922000-memory.dmp	xmrig
behavioral2/memory/3292-2739-0x00007FF6BE6F0000-0x00007FF6BEAE2000-memory.dmp	xmrig
behavioral2/memory/4216-2741-0x00007FF7A5230000-0x00007FF7A5622000-memory.dmp	xmrig
behavioral2/memory/4224-2752-0x00007FF7E40F0000-0x00007FF7E44E2000-memory.dmp	xmrig
behavioral2/memory/1688-2756-0x00007FF772960000-0x00007FF772D52000-memory.dmp	xmrig
behavioral2/memory/1368-2755-0x00007FF7E9440000-0x00007FF7E9832000-memory.dmp	xmrig
behavioral2/memory/5116-2749-0x00007FF7E0700000-0x00007FF7E0AF2000-memory.dmp	xmrig
behavioral2/memory/1728-2748-0x00007FF763590000-0x00007FF763982000-memory.dmp	xmrig
behavioral2/memory/4380-2746-0x00007FF7FEF00000-0x00007FF7FF2F2000-memory.dmp	xmrig
behavioral2/memory/1716-2744-0x00007FF69F610000-0x00007FF69FA02000-memory.dmp	xmrig
behavioral2/memory/3152-2788-0x00007FF7E9180000-0x00007FF7E9572000-memory.dmp	xmrig
behavioral2/memory/5068-2784-0x00007FF68B960000-0x00007FF68BD52000-memory.dmp	xmrig
behavioral2/memory/1600-2781-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp	xmrig
behavioral2/memory/2044-2780-0x00007FF6B3C10000-0x00007FF6B4002000-memory.dmp	xmrig
behavioral2/memory/4728-2773-0x00007FF6D7DD0000-0x00007FF6D81C2000-memory.dmp	xmrig
behavioral2/memory/2232-2772-0x00007FF66DC30000-0x00007FF66E022000-memory.dmp	xmrig
behavioral2/memory/3520-2769-0x00007FF6AABD0000-0x00007FF6AAFC2000-memory.dmp	xmrig
behavioral2/memory/1300-2765-0x00007FF7802E0000-0x00007FF7806D2000-memory.dmp	xmrig
behavioral2/memory/1744-2760-0x00007FF68C1C0000-0x00007FF68C5B2000-memory.dmp	xmrig
behavioral2/memory/1228-2764-0x00007FF74E210000-0x00007FF74E602000-memory.dmp	xmrig
behavioral2/memory/3268-2759-0x00007FF621D10000-0x00007FF622102000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1772	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3168	tZnxvkn.exe
1152	dvMStoH.exe
1716	NelGIQE.exe
4380	RMzaCnh.exe
4228	cYAmqVA.exe
412	tJxjlhw.exe
3292	GGVBqBN.exe
5116	eYKYqhH.exe
1728	wCbUewx.exe
4216	pdLyRtq.exe
4728	ldcijzu.exe
4224	WSQJXtU.exe
1368	IAhzepO.exe
1688	fAXqiUS.exe
2044	JShXxkE.exe
1228	mCMVFRq.exe
3520	RKFfqti.exe
5068	exomayS.exe
2232	DcujSkn.exe
1300	tPeMumq.exe
1600	dfGwOmA.exe
1744	SnMLxoo.exe
3152	JjevbyK.exe
3268	bbrltEg.exe
4552	rhbUjCZ.exe
4320	QFDAvMu.exe
2892	cEGPXEJ.exe
1592	ZhOWyHb.exe
2392	JWSgZiI.exe
2272	FNFVrDi.exe
3844	IhtoAOM.exe
4712	huBzImC.exe
1352	NGMbSxW.exe
3140	RfaDfTw.exe
5012	NJucOvC.exe
440	AouZKYx.exe
1932	nfNdAxf.exe
4400	DXpGwea.exe
4256	dBxNGmr.exe
4720	BGijCry.exe
1828	OveXCAy.exe
2220	XkVKTOC.exe
4372	PGDsUGi.exe
1712	fObGxFp.exe
2300	mWcHBIv.exe
2192	RAeLDVM.exe
2644	MwWEFfk.exe
3088	zdSxpUR.exe
972	dfWBpaW.exe
3312	OSgzmwu.exe
2444	CyGTmBM.exe
4348	HALqFXH.exe
2248	LeJhadN.exe
2512	vREPhvs.exe
5040	xIbdBSh.exe
4800	jQFVjyk.exe
1580	ryKxzHM.exe
4280	BYznBpF.exe
1288	wjHoxhq.exe
4956	zYdAkvk.exe
4452	KJeoAyd.exe
4804	vNFWKLK.exe
2460	vazkVkw.exe
4392	sKJeVpC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1952-0-0x00007FF6ED570000-0x00007FF6ED962000-memory.dmp	upx
behavioral2/files/0x000900000002328e-5.dat	upx
behavioral2/files/0x0007000000023406-9.dat	upx
behavioral2/files/0x0007000000023408-28.dat	upx
behavioral2/files/0x000700000002340a-54.dat	upx
behavioral2/files/0x0007000000023415-78.dat	upx
behavioral2/files/0x0007000000023428-177.dat	upx
behavioral2/memory/1368-454-0x00007FF7E9440000-0x00007FF7E9832000-memory.dmp	upx
behavioral2/memory/2044-639-0x00007FF6B3C10000-0x00007FF6B4002000-memory.dmp	upx
behavioral2/memory/5068-643-0x00007FF68B960000-0x00007FF68BD52000-memory.dmp	upx
behavioral2/memory/3268-649-0x00007FF621D10000-0x00007FF622102000-memory.dmp	upx
behavioral2/memory/1228-653-0x00007FF74E210000-0x00007FF74E602000-memory.dmp	upx
behavioral2/memory/1728-652-0x00007FF763590000-0x00007FF763982000-memory.dmp	upx
behavioral2/memory/1716-651-0x00007FF69F610000-0x00007FF69FA02000-memory.dmp	upx
behavioral2/memory/3152-648-0x00007FF7E9180000-0x00007FF7E9572000-memory.dmp	upx
behavioral2/memory/1744-647-0x00007FF68C1C0000-0x00007FF68C5B2000-memory.dmp	upx
behavioral2/memory/1600-646-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp	upx
behavioral2/memory/1300-645-0x00007FF7802E0000-0x00007FF7806D2000-memory.dmp	upx
behavioral2/memory/2232-644-0x00007FF66DC30000-0x00007FF66E022000-memory.dmp	upx
behavioral2/memory/3520-642-0x00007FF6AABD0000-0x00007FF6AAFC2000-memory.dmp	upx
behavioral2/memory/1688-574-0x00007FF772960000-0x00007FF772D52000-memory.dmp	upx
behavioral2/memory/4224-363-0x00007FF7E40F0000-0x00007FF7E44E2000-memory.dmp	upx
behavioral2/memory/4728-298-0x00007FF6D7DD0000-0x00007FF6D81C2000-memory.dmp	upx
behavioral2/memory/4216-295-0x00007FF7A5230000-0x00007FF7A5622000-memory.dmp	upx
behavioral2/memory/5116-247-0x00007FF7E0700000-0x00007FF7E0AF2000-memory.dmp	upx
behavioral2/files/0x0007000000023431-207.dat	upx
behavioral2/files/0x0007000000023430-203.dat	upx
behavioral2/files/0x0007000000023421-201.dat	upx
behavioral2/files/0x0007000000023420-197.dat	upx
behavioral2/files/0x0007000000023416-195.dat	upx
behavioral2/files/0x000700000002342f-194.dat	upx
behavioral2/files/0x000700000002342e-193.dat	upx
behavioral2/files/0x000700000002342d-188.dat	upx
behavioral2/files/0x000700000002342c-185.dat	upx
behavioral2/files/0x000700000002341f-184.dat	upx
behavioral2/memory/3292-182-0x00007FF6BE6F0000-0x00007FF6BEAE2000-memory.dmp	upx
behavioral2/files/0x000700000002342b-180.dat	upx
behavioral2/files/0x000700000002342a-179.dat	upx
behavioral2/files/0x0007000000023429-178.dat	upx
behavioral2/files/0x0007000000023427-168.dat	upx
behavioral2/files/0x0007000000023424-167.dat	upx
behavioral2/files/0x0007000000023417-158.dat	upx
behavioral2/files/0x0007000000023413-155.dat	upx
behavioral2/files/0x0007000000023412-149.dat	upx
behavioral2/files/0x0007000000023410-137.dat	upx
behavioral2/memory/412-132-0x00007FF6A9530000-0x00007FF6A9922000-memory.dmp	upx
behavioral2/files/0x000700000002341e-127.dat	upx
behavioral2/files/0x000700000002341d-122.dat	upx
behavioral2/files/0x000700000002341c-121.dat	upx
behavioral2/files/0x000700000002341b-118.dat	upx
behavioral2/files/0x000700000002341a-114.dat	upx
behavioral2/files/0x000700000002340f-169.dat	upx
behavioral2/files/0x000700000002340e-113.dat	upx
behavioral2/files/0x0007000000023419-110.dat	upx
behavioral2/files/0x0007000000023423-165.dat	upx
behavioral2/files/0x0007000000023422-161.dat	upx
behavioral2/files/0x000700000002340d-99.dat	upx
behavioral2/files/0x0007000000023411-141.dat	upx
behavioral2/memory/4228-84-0x00007FF61F100000-0x00007FF61F4F2000-memory.dmp	upx
behavioral2/files/0x000700000002340b-83.dat	upx
behavioral2/files/0x0007000000023418-104.dat	upx
behavioral2/files/0x0007000000023407-62.dat	upx
behavioral2/files/0x000700000002340c-87.dat	upx
behavioral2/files/0x0007000000023414-71.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WOGutOw.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\jXNcuvt.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\tboaaKI.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\HNbmyFe.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\fAXqiUS.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\RufNkiI.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\BmveGmz.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\aMMdjot.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\hadFhnT.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\Huafwgl.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\eizMYpa.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\PnKafZS.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\fCgNdtn.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\swRaOSH.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\jIEqUKW.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\XSeXcKP.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\SPLdGRN.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\bQhTnZo.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\ZhvHvCV.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\DXhkVvO.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\tatEhQW.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\xFSXtxw.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\IUECKLz.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\IurGjXJ.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\JbwUrsd.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\pdvTzuX.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\JMsholg.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\HXQSoFE.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\pCxeMPQ.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\DBwrTgf.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\wzcDuSD.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\kWxVaMs.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\RfKTyLd.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\tpDxOMG.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\IAhzepO.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\umuWIez.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\eYgoirZ.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\qwlrQzm.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\NysgfNv.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\eVkCRru.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\xIbdBSh.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\klLdbgA.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\xagatkO.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\QwmJasN.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\koynZor.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\ivtWgHu.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\smRqENg.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\jVJhRLq.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\nSyOnlN.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\bOZrRgX.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\ANSYhXa.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\QFDAvMu.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\ZmQXjAG.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\GJgSTHQ.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\NGkhnma.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\RxprYti.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\yTGGycw.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\UrIWAWE.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\MJRXMgH.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\hLlhSAy.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\OWfFiML.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\RFgyimx.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\GGVBqBN.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
File created	C:\Windows\System\GjeuntJ.exe	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1772	powershell.exe
1772	powershell.exe
1772	powershell.exe
1772	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
Token: SeDebugPrivilege	1772	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1772	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	84
PID 1952 wrote to memory of 1772	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	84
PID 1952 wrote to memory of 3168	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	85
PID 1952 wrote to memory of 3168	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	85
PID 1952 wrote to memory of 1152	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	86
PID 1952 wrote to memory of 1152	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	86
PID 1952 wrote to memory of 1716	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	87
PID 1952 wrote to memory of 1716	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	87
PID 1952 wrote to memory of 4380	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	88
PID 1952 wrote to memory of 4380	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	88
PID 1952 wrote to memory of 4228	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	89
PID 1952 wrote to memory of 4228	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	89
PID 1952 wrote to memory of 412	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	90
PID 1952 wrote to memory of 412	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	90
PID 1952 wrote to memory of 3292	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	91
PID 1952 wrote to memory of 3292	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	91
PID 1952 wrote to memory of 5116	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	92
PID 1952 wrote to memory of 5116	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	92
PID 1952 wrote to memory of 1728	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	93
PID 1952 wrote to memory of 1728	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	93
PID 1952 wrote to memory of 4216	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	94
PID 1952 wrote to memory of 4216	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	94
PID 1952 wrote to memory of 4728	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	95
PID 1952 wrote to memory of 4728	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	95
PID 1952 wrote to memory of 4224	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	96
PID 1952 wrote to memory of 4224	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	96
PID 1952 wrote to memory of 1368	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	97
PID 1952 wrote to memory of 1368	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	97
PID 1952 wrote to memory of 1688	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	98
PID 1952 wrote to memory of 1688	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	98
PID 1952 wrote to memory of 2044	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	99
PID 1952 wrote to memory of 2044	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	99
PID 1952 wrote to memory of 1228	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	100
PID 1952 wrote to memory of 1228	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	100
PID 1952 wrote to memory of 3520	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	101
PID 1952 wrote to memory of 3520	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	101
PID 1952 wrote to memory of 5068	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	102
PID 1952 wrote to memory of 5068	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	102
PID 1952 wrote to memory of 2232	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	103
PID 1952 wrote to memory of 2232	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	103
PID 1952 wrote to memory of 1300	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	104
PID 1952 wrote to memory of 1300	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	104
PID 1952 wrote to memory of 1600	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	105
PID 1952 wrote to memory of 1600	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	105
PID 1952 wrote to memory of 1744	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	106
PID 1952 wrote to memory of 1744	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	106
PID 1952 wrote to memory of 3152	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	107
PID 1952 wrote to memory of 3152	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	107
PID 1952 wrote to memory of 3268	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	108
PID 1952 wrote to memory of 3268	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	108
PID 1952 wrote to memory of 4552	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	109
PID 1952 wrote to memory of 4552	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	109
PID 1952 wrote to memory of 4320	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	110
PID 1952 wrote to memory of 4320	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	110
PID 1952 wrote to memory of 1932	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	111
PID 1952 wrote to memory of 1932	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	111
PID 1952 wrote to memory of 2892	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	112
PID 1952 wrote to memory of 2892	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	112
PID 1952 wrote to memory of 1592	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	113
PID 1952 wrote to memory of 1592	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	113
PID 1952 wrote to memory of 2392	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	114
PID 1952 wrote to memory of 2392	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	114
PID 1952 wrote to memory of 2272	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	115
PID 1952 wrote to memory of 2272	1952	26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\26590cd7c82716739d9ea3c4ff0f7550_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\System\tZnxvkn.exe
  C:\Windows\System\tZnxvkn.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\dvMStoH.exe
  C:\Windows\System\dvMStoH.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\NelGIQE.exe
  C:\Windows\System\NelGIQE.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\RMzaCnh.exe
  C:\Windows\System\RMzaCnh.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\cYAmqVA.exe
  C:\Windows\System\cYAmqVA.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\tJxjlhw.exe
  C:\Windows\System\tJxjlhw.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\GGVBqBN.exe
  C:\Windows\System\GGVBqBN.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\eYKYqhH.exe
  C:\Windows\System\eYKYqhH.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\wCbUewx.exe
  C:\Windows\System\wCbUewx.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\pdLyRtq.exe
  C:\Windows\System\pdLyRtq.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\ldcijzu.exe
  C:\Windows\System\ldcijzu.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\WSQJXtU.exe
  C:\Windows\System\WSQJXtU.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\IAhzepO.exe
  C:\Windows\System\IAhzepO.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\fAXqiUS.exe
  C:\Windows\System\fAXqiUS.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\JShXxkE.exe
  C:\Windows\System\JShXxkE.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\mCMVFRq.exe
  C:\Windows\System\mCMVFRq.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\RKFfqti.exe
  C:\Windows\System\RKFfqti.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\exomayS.exe
  C:\Windows\System\exomayS.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\DcujSkn.exe
  C:\Windows\System\DcujSkn.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\tPeMumq.exe
  C:\Windows\System\tPeMumq.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\dfGwOmA.exe
  C:\Windows\System\dfGwOmA.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\SnMLxoo.exe
  C:\Windows\System\SnMLxoo.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\JjevbyK.exe
  C:\Windows\System\JjevbyK.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\bbrltEg.exe
  C:\Windows\System\bbrltEg.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\rhbUjCZ.exe
  C:\Windows\System\rhbUjCZ.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\QFDAvMu.exe
  C:\Windows\System\QFDAvMu.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\nfNdAxf.exe
  C:\Windows\System\nfNdAxf.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\cEGPXEJ.exe
  C:\Windows\System\cEGPXEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\ZhOWyHb.exe
  C:\Windows\System\ZhOWyHb.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\JWSgZiI.exe
  C:\Windows\System\JWSgZiI.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\FNFVrDi.exe
  C:\Windows\System\FNFVrDi.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\IhtoAOM.exe
  C:\Windows\System\IhtoAOM.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\MwWEFfk.exe
  C:\Windows\System\MwWEFfk.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\zdSxpUR.exe
  C:\Windows\System\zdSxpUR.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\huBzImC.exe
  C:\Windows\System\huBzImC.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\NGMbSxW.exe
  C:\Windows\System\NGMbSxW.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\RfaDfTw.exe
  C:\Windows\System\RfaDfTw.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\NJucOvC.exe
  C:\Windows\System\NJucOvC.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\AouZKYx.exe
  C:\Windows\System\AouZKYx.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\DXpGwea.exe
  C:\Windows\System\DXpGwea.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\dBxNGmr.exe
  C:\Windows\System\dBxNGmr.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\BGijCry.exe
  C:\Windows\System\BGijCry.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\OveXCAy.exe
  C:\Windows\System\OveXCAy.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\XkVKTOC.exe
  C:\Windows\System\XkVKTOC.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\PGDsUGi.exe
  C:\Windows\System\PGDsUGi.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\fObGxFp.exe
  C:\Windows\System\fObGxFp.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\mWcHBIv.exe
  C:\Windows\System\mWcHBIv.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\RAeLDVM.exe
  C:\Windows\System\RAeLDVM.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\dfWBpaW.exe
  C:\Windows\System\dfWBpaW.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\OSgzmwu.exe
  C:\Windows\System\OSgzmwu.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\CyGTmBM.exe
  C:\Windows\System\CyGTmBM.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\HALqFXH.exe
  C:\Windows\System\HALqFXH.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\LeJhadN.exe
  C:\Windows\System\LeJhadN.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\vREPhvs.exe
  C:\Windows\System\vREPhvs.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\xIbdBSh.exe
  C:\Windows\System\xIbdBSh.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\jQFVjyk.exe
  C:\Windows\System\jQFVjyk.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\ryKxzHM.exe
  C:\Windows\System\ryKxzHM.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\BYznBpF.exe
  C:\Windows\System\BYznBpF.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\wjHoxhq.exe
  C:\Windows\System\wjHoxhq.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\zYdAkvk.exe
  C:\Windows\System\zYdAkvk.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\KJeoAyd.exe
  C:\Windows\System\KJeoAyd.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\vNFWKLK.exe
  C:\Windows\System\vNFWKLK.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\vazkVkw.exe
  C:\Windows\System\vazkVkw.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\sKJeVpC.exe
  C:\Windows\System\sKJeVpC.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\OETywgH.exe
  C:\Windows\System\OETywgH.exe
  2⤵
  PID:4316
- C:\Windows\System\WlmxZVg.exe
  C:\Windows\System\WlmxZVg.exe
  2⤵
  PID:4308
- C:\Windows\System\SSrdYqU.exe
  C:\Windows\System\SSrdYqU.exe
  2⤵
  PID:216
- C:\Windows\System\klLdbgA.exe
  C:\Windows\System\klLdbgA.exe
  2⤵
  PID:1612
- C:\Windows\System\qXoAKfY.exe
  C:\Windows\System\qXoAKfY.exe
  2⤵
  PID:1060
- C:\Windows\System\oSNAwxq.exe
  C:\Windows\System\oSNAwxq.exe
  2⤵
  PID:1628
- C:\Windows\System\EhWkarm.exe
  C:\Windows\System\EhWkarm.exe
  2⤵
  PID:2152
- C:\Windows\System\IBoPcxb.exe
  C:\Windows\System\IBoPcxb.exe
  2⤵
  PID:3008
- C:\Windows\System\NOzeTSs.exe
  C:\Windows\System\NOzeTSs.exe
  2⤵
  PID:1924
- C:\Windows\System\LZAVgbd.exe
  C:\Windows\System\LZAVgbd.exe
  2⤵
  PID:2092
- C:\Windows\System\msQOstw.exe
  C:\Windows\System\msQOstw.exe
  2⤵
  PID:1248
- C:\Windows\System\wpcvAiS.exe
  C:\Windows\System\wpcvAiS.exe
  2⤵
  PID:60
- C:\Windows\System\chaqqJC.exe
  C:\Windows\System\chaqqJC.exe
  2⤵
  PID:4932
- C:\Windows\System\weiHdgO.exe
  C:\Windows\System\weiHdgO.exe
  2⤵
  PID:3248
- C:\Windows\System\ssHpkbS.exe
  C:\Windows\System\ssHpkbS.exe
  2⤵
  PID:1540
- C:\Windows\System\KsLHWbi.exe
  C:\Windows\System\KsLHWbi.exe
  2⤵
  PID:2660
- C:\Windows\System\myJlIzE.exe
  C:\Windows\System\myJlIzE.exe
  2⤵
  PID:3732
- C:\Windows\System\dxgXPtT.exe
  C:\Windows\System\dxgXPtT.exe
  2⤵
  PID:3156
- C:\Windows\System\YfwBgXK.exe
  C:\Windows\System\YfwBgXK.exe
  2⤵
  PID:2464
- C:\Windows\System\ljBebPC.exe
  C:\Windows\System\ljBebPC.exe
  2⤵
  PID:1764
- C:\Windows\System\TzvTSBr.exe
  C:\Windows\System\TzvTSBr.exe
  2⤵
  PID:2912
- C:\Windows\System\hSABXdA.exe
  C:\Windows\System\hSABXdA.exe
  2⤵
  PID:5132
- C:\Windows\System\rMIsysm.exe
  C:\Windows\System\rMIsysm.exe
  2⤵
  PID:5152
- C:\Windows\System\vNgyMmM.exe
  C:\Windows\System\vNgyMmM.exe
  2⤵
  PID:5172
- C:\Windows\System\UngoLbn.exe
  C:\Windows\System\UngoLbn.exe
  2⤵
  PID:5196
- C:\Windows\System\RrwhOGX.exe
  C:\Windows\System\RrwhOGX.exe
  2⤵
  PID:5212
- C:\Windows\System\MNwjfPS.exe
  C:\Windows\System\MNwjfPS.exe
  2⤵
  PID:5236
- C:\Windows\System\qCLjDMa.exe
  C:\Windows\System\qCLjDMa.exe
  2⤵
  PID:5260
- C:\Windows\System\fguFPBk.exe
  C:\Windows\System\fguFPBk.exe
  2⤵
  PID:5284
- C:\Windows\System\rqFvzhT.exe
  C:\Windows\System\rqFvzhT.exe
  2⤵
  PID:5300
- C:\Windows\System\HYTnwLe.exe
  C:\Windows\System\HYTnwLe.exe
  2⤵
  PID:5320
- C:\Windows\System\pYlSVFb.exe
  C:\Windows\System\pYlSVFb.exe
  2⤵
  PID:5340
- C:\Windows\System\mIskkRe.exe
  C:\Windows\System\mIskkRe.exe
  2⤵
  PID:5356
- C:\Windows\System\PhbBBfi.exe
  C:\Windows\System\PhbBBfi.exe
  2⤵
  PID:5380
- C:\Windows\System\wzVyfYW.exe
  C:\Windows\System\wzVyfYW.exe
  2⤵
  PID:5404
- C:\Windows\System\RcCWxcg.exe
  C:\Windows\System\RcCWxcg.exe
  2⤵
  PID:5420
- C:\Windows\System\eizUUiS.exe
  C:\Windows\System\eizUUiS.exe
  2⤵
  PID:5444
- C:\Windows\System\dHfczUO.exe
  C:\Windows\System\dHfczUO.exe
  2⤵
  PID:5468
- C:\Windows\System\tVTZCzb.exe
  C:\Windows\System\tVTZCzb.exe
  2⤵
  PID:5484
- C:\Windows\System\fBCulAq.exe
  C:\Windows\System\fBCulAq.exe
  2⤵
  PID:5508
- C:\Windows\System\NoxkHwy.exe
  C:\Windows\System\NoxkHwy.exe
  2⤵
  PID:5532
- C:\Windows\System\XigEGyO.exe
  C:\Windows\System\XigEGyO.exe
  2⤵
  PID:5548
- C:\Windows\System\DeCdMnh.exe
  C:\Windows\System\DeCdMnh.exe
  2⤵
  PID:5564
- C:\Windows\System\QPYKdeF.exe
  C:\Windows\System\QPYKdeF.exe
  2⤵
  PID:5636
- C:\Windows\System\SJrToJW.exe
  C:\Windows\System\SJrToJW.exe
  2⤵
  PID:5652
- C:\Windows\System\cnpVQdd.exe
  C:\Windows\System\cnpVQdd.exe
  2⤵
  PID:5680
- C:\Windows\System\eFYASof.exe
  C:\Windows\System\eFYASof.exe
  2⤵
  PID:5696
- C:\Windows\System\dFNAeDR.exe
  C:\Windows\System\dFNAeDR.exe
  2⤵
  PID:5716
- C:\Windows\System\jUIzWGq.exe
  C:\Windows\System\jUIzWGq.exe
  2⤵
  PID:5736
- C:\Windows\System\TDnYeyT.exe
  C:\Windows\System\TDnYeyT.exe
  2⤵
  PID:5764
- C:\Windows\System\BomKITC.exe
  C:\Windows\System\BomKITC.exe
  2⤵
  PID:5800
- C:\Windows\System\ARTvdSZ.exe
  C:\Windows\System\ARTvdSZ.exe
  2⤵
  PID:5824
- C:\Windows\System\ZJPGXtm.exe
  C:\Windows\System\ZJPGXtm.exe
  2⤵
  PID:5848
- C:\Windows\System\jkJcMKH.exe
  C:\Windows\System\jkJcMKH.exe
  2⤵
  PID:5864
- C:\Windows\System\qwlrQzm.exe
  C:\Windows\System\qwlrQzm.exe
  2⤵
  PID:5896
- C:\Windows\System\tAsWEMc.exe
  C:\Windows\System\tAsWEMc.exe
  2⤵
  PID:5912
- C:\Windows\System\ToDiYYC.exe
  C:\Windows\System\ToDiYYC.exe
  2⤵
  PID:5940
- C:\Windows\System\qOoqikP.exe
  C:\Windows\System\qOoqikP.exe
  2⤵
  PID:5956
- C:\Windows\System\lYrkxnn.exe
  C:\Windows\System\lYrkxnn.exe
  2⤵
  PID:5984
- C:\Windows\System\ExZtJWe.exe
  C:\Windows\System\ExZtJWe.exe
  2⤵
  PID:6004
- C:\Windows\System\fuxYIsx.exe
  C:\Windows\System\fuxYIsx.exe
  2⤵
  PID:6020
- C:\Windows\System\czEmUOp.exe
  C:\Windows\System\czEmUOp.exe
  2⤵
  PID:6048
- C:\Windows\System\yyXWLay.exe
  C:\Windows\System\yyXWLay.exe
  2⤵
  PID:6064
- C:\Windows\System\dBdSrdL.exe
  C:\Windows\System\dBdSrdL.exe
  2⤵
  PID:6096
- C:\Windows\System\NMDatkj.exe
  C:\Windows\System\NMDatkj.exe
  2⤵
  PID:6112
- C:\Windows\System\MadOnXI.exe
  C:\Windows\System\MadOnXI.exe
  2⤵
  PID:6136
- C:\Windows\System\jKZkGXj.exe
  C:\Windows\System\jKZkGXj.exe
  2⤵
  PID:5048
- C:\Windows\System\JrfvhVF.exe
  C:\Windows\System\JrfvhVF.exe
  2⤵
  PID:3348
- C:\Windows\System\jpVAJuG.exe
  C:\Windows\System\jpVAJuG.exe
  2⤵
  PID:2764
- C:\Windows\System\hlwgUwI.exe
  C:\Windows\System\hlwgUwI.exe
  2⤵
  PID:2344
- C:\Windows\System\nlmBeCQ.exe
  C:\Windows\System\nlmBeCQ.exe
  2⤵
  PID:2600
- C:\Windows\System\JhHjETW.exe
  C:\Windows\System\JhHjETW.exe
  2⤵
  PID:1128
- C:\Windows\System\koynZor.exe
  C:\Windows\System\koynZor.exe
  2⤵
  PID:5248
- C:\Windows\System\RkWpIgA.exe
  C:\Windows\System\RkWpIgA.exe
  2⤵
  PID:3372
- C:\Windows\System\gHZaAlJ.exe
  C:\Windows\System\gHZaAlJ.exe
  2⤵
  PID:5312
- C:\Windows\System\oHLPamd.exe
  C:\Windows\System\oHLPamd.exe
  2⤵
  PID:5544
- C:\Windows\System\hhNhtid.exe
  C:\Windows\System\hhNhtid.exe
  2⤵
  PID:1492
- C:\Windows\System\btUvBAi.exe
  C:\Windows\System\btUvBAi.exe
  2⤵
  PID:4064
- C:\Windows\System\RIBtfBB.exe
  C:\Windows\System\RIBtfBB.exe
  2⤵
  PID:2504
- C:\Windows\System\uhOKOOo.exe
  C:\Windows\System\uhOKOOo.exe
  2⤵
  PID:4176
- C:\Windows\System\BQsqjxz.exe
  C:\Windows\System\BQsqjxz.exe
  2⤵
  PID:1992
- C:\Windows\System\UYRoKiY.exe
  C:\Windows\System\UYRoKiY.exe
  2⤵
  PID:3800
- C:\Windows\System\Jzfgdkw.exe
  C:\Windows\System\Jzfgdkw.exe
  2⤵
  PID:4528
- C:\Windows\System\MNOCFgL.exe
  C:\Windows\System\MNOCFgL.exe
  2⤵
  PID:5228
- C:\Windows\System\ieNqoGJ.exe
  C:\Windows\System\ieNqoGJ.exe
  2⤵
  PID:6164
- C:\Windows\System\VmjNUqR.exe
  C:\Windows\System\VmjNUqR.exe
  2⤵
  PID:6180
- C:\Windows\System\zCZfFtH.exe
  C:\Windows\System\zCZfFtH.exe
  2⤵
  PID:6200
- C:\Windows\System\vLJbMOA.exe
  C:\Windows\System\vLJbMOA.exe
  2⤵
  PID:6220
- C:\Windows\System\UkHbsQW.exe
  C:\Windows\System\UkHbsQW.exe
  2⤵
  PID:6240
- C:\Windows\System\rRVXMib.exe
  C:\Windows\System\rRVXMib.exe
  2⤵
  PID:6260
- C:\Windows\System\ciomsGR.exe
  C:\Windows\System\ciomsGR.exe
  2⤵
  PID:6276
- C:\Windows\System\CKidozJ.exe
  C:\Windows\System\CKidozJ.exe
  2⤵
  PID:6292
- C:\Windows\System\aPHaSaY.exe
  C:\Windows\System\aPHaSaY.exe
  2⤵
  PID:6324
- C:\Windows\System\zcQdJjP.exe
  C:\Windows\System\zcQdJjP.exe
  2⤵
  PID:6344
- C:\Windows\System\YhxdAPk.exe
  C:\Windows\System\YhxdAPk.exe
  2⤵
  PID:6360
- C:\Windows\System\SyeZoNl.exe
  C:\Windows\System\SyeZoNl.exe
  2⤵
  PID:6384
- C:\Windows\System\rJBICnh.exe
  C:\Windows\System\rJBICnh.exe
  2⤵
  PID:6404
- C:\Windows\System\WIdyuJd.exe
  C:\Windows\System\WIdyuJd.exe
  2⤵
  PID:6428
- C:\Windows\System\rlaOwnR.exe
  C:\Windows\System\rlaOwnR.exe
  2⤵
  PID:6444
- C:\Windows\System\zjzHZTH.exe
  C:\Windows\System\zjzHZTH.exe
  2⤵
  PID:6472
- C:\Windows\System\IowqUyi.exe
  C:\Windows\System\IowqUyi.exe
  2⤵
  PID:6488
- C:\Windows\System\rLUEhgk.exe
  C:\Windows\System\rLUEhgk.exe
  2⤵
  PID:6508
- C:\Windows\System\DsrYuFh.exe
  C:\Windows\System\DsrYuFh.exe
  2⤵
  PID:6528
- C:\Windows\System\HXQSoFE.exe
  C:\Windows\System\HXQSoFE.exe
  2⤵
  PID:6552
- C:\Windows\System\XFfnNuO.exe
  C:\Windows\System\XFfnNuO.exe
  2⤵
  PID:6568
- C:\Windows\System\iZWCjMi.exe
  C:\Windows\System\iZWCjMi.exe
  2⤵
  PID:6592
- C:\Windows\System\ogzftIs.exe
  C:\Windows\System\ogzftIs.exe
  2⤵
  PID:6608
- C:\Windows\System\nbfbHuN.exe
  C:\Windows\System\nbfbHuN.exe
  2⤵
  PID:6632
- C:\Windows\System\gfUbepJ.exe
  C:\Windows\System\gfUbepJ.exe
  2⤵
  PID:6652
- C:\Windows\System\ShSunYu.exe
  C:\Windows\System\ShSunYu.exe
  2⤵
  PID:6688
- C:\Windows\System\ghEAbAl.exe
  C:\Windows\System\ghEAbAl.exe
  2⤵
  PID:6712
- C:\Windows\System\NuFFCzl.exe
  C:\Windows\System\NuFFCzl.exe
  2⤵
  PID:6728
- C:\Windows\System\HGVDXGr.exe
  C:\Windows\System\HGVDXGr.exe
  2⤵
  PID:6756
- C:\Windows\System\xgnqMmf.exe
  C:\Windows\System\xgnqMmf.exe
  2⤵
  PID:6772
- C:\Windows\System\AlvpDnY.exe
  C:\Windows\System\AlvpDnY.exe
  2⤵
  PID:6796
- C:\Windows\System\QfGvslx.exe
  C:\Windows\System\QfGvslx.exe
  2⤵
  PID:6820
- C:\Windows\System\IZSkuyi.exe
  C:\Windows\System\IZSkuyi.exe
  2⤵
  PID:6840
- C:\Windows\System\AhKYAEm.exe
  C:\Windows\System\AhKYAEm.exe
  2⤵
  PID:6864
- C:\Windows\System\xRdDvov.exe
  C:\Windows\System\xRdDvov.exe
  2⤵
  PID:6880
- C:\Windows\System\mgArEKP.exe
  C:\Windows\System\mgArEKP.exe
  2⤵
  PID:6896
- C:\Windows\System\WjiuMke.exe
  C:\Windows\System\WjiuMke.exe
  2⤵
  PID:6916
- C:\Windows\System\bkGmBsp.exe
  C:\Windows\System\bkGmBsp.exe
  2⤵
  PID:6932
- C:\Windows\System\hOPpHro.exe
  C:\Windows\System\hOPpHro.exe
  2⤵
  PID:6956
- C:\Windows\System\EUktKNN.exe
  C:\Windows\System\EUktKNN.exe
  2⤵
  PID:6972
- C:\Windows\System\ADMlGbZ.exe
  C:\Windows\System\ADMlGbZ.exe
  2⤵
  PID:6996
- C:\Windows\System\zYaSiYG.exe
  C:\Windows\System\zYaSiYG.exe
  2⤵
  PID:7020
- C:\Windows\System\QAqbCoK.exe
  C:\Windows\System\QAqbCoK.exe
  2⤵
  PID:7040
- C:\Windows\System\CXzbbqj.exe
  C:\Windows\System\CXzbbqj.exe
  2⤵
  PID:7056
- C:\Windows\System\PWhxdjl.exe
  C:\Windows\System\PWhxdjl.exe
  2⤵
  PID:7076
- C:\Windows\System\NbRvIwn.exe
  C:\Windows\System\NbRvIwn.exe
  2⤵
  PID:7092
- C:\Windows\System\IhcgKpy.exe
  C:\Windows\System\IhcgKpy.exe
  2⤵
  PID:7112
- C:\Windows\System\onWDOyH.exe
  C:\Windows\System\onWDOyH.exe
  2⤵
  PID:7132
- C:\Windows\System\UHwEBTI.exe
  C:\Windows\System\UHwEBTI.exe
  2⤵
  PID:7152
- C:\Windows\System\QlPHTuM.exe
  C:\Windows\System\QlPHTuM.exe
  2⤵
  PID:5860
- C:\Windows\System\ZqCBCHX.exe
  C:\Windows\System\ZqCBCHX.exe
  2⤵
  PID:2876
- C:\Windows\System\fAHjuSI.exe
  C:\Windows\System\fAHjuSI.exe
  2⤵
  PID:5416
- C:\Windows\System\RTgXzZY.exe
  C:\Windows\System\RTgXzZY.exe
  2⤵
  PID:2652
- C:\Windows\System\EjFxvGN.exe
  C:\Windows\System\EjFxvGN.exe
  2⤵
  PID:2356
- C:\Windows\System\hJqLtzd.exe
  C:\Windows\System\hJqLtzd.exe
  2⤵
  PID:2604
- C:\Windows\System\qKRqgSt.exe
  C:\Windows\System\qKRqgSt.exe
  2⤵
  PID:4776
- C:\Windows\System\VGAleyo.exe
  C:\Windows\System\VGAleyo.exe
  2⤵
  PID:4748
- C:\Windows\System\pCxeMPQ.exe
  C:\Windows\System\pCxeMPQ.exe
  2⤵
  PID:5232
- C:\Windows\System\ghvcCyR.exe
  C:\Windows\System\ghvcCyR.exe
  2⤵
  PID:5440
- C:\Windows\System\WmfVTyC.exe
  C:\Windows\System\WmfVTyC.exe
  2⤵
  PID:4232
- C:\Windows\System\GDjluOL.exe
  C:\Windows\System\GDjluOL.exe
  2⤵
  PID:5776
- C:\Windows\System\QLEyzZs.exe
  C:\Windows\System\QLEyzZs.exe
  2⤵
  PID:5092
- C:\Windows\System\XminnOO.exe
  C:\Windows\System\XminnOO.exe
  2⤵
  PID:5164
- C:\Windows\System\ogPmHMm.exe
  C:\Windows\System\ogPmHMm.exe
  2⤵
  PID:5192
- C:\Windows\System\cFFaQAL.exe
  C:\Windows\System\cFFaQAL.exe
  2⤵
  PID:6172
- C:\Windows\System\IIpYKmf.exe
  C:\Windows\System\IIpYKmf.exe
  2⤵
  PID:6232
- C:\Windows\System\JqRNsSq.exe
  C:\Windows\System\JqRNsSq.exe
  2⤵
  PID:5268
- C:\Windows\System\ndcsbAv.exe
  C:\Windows\System\ndcsbAv.exe
  2⤵
  PID:5332
- C:\Windows\System\BJTsZIW.exe
  C:\Windows\System\BJTsZIW.exe
  2⤵
  PID:5388
- C:\Windows\System\cXnBYXi.exe
  C:\Windows\System\cXnBYXi.exe
  2⤵
  PID:5968
- C:\Windows\System\cbtZXbP.exe
  C:\Windows\System\cbtZXbP.exe
  2⤵
  PID:7188
- C:\Windows\System\xfBaRRg.exe
  C:\Windows\System\xfBaRRg.exe
  2⤵
  PID:7204
- C:\Windows\System\oRYvsTQ.exe
  C:\Windows\System\oRYvsTQ.exe
  2⤵
  PID:7228
- C:\Windows\System\pbidfJo.exe
  C:\Windows\System\pbidfJo.exe
  2⤵
  PID:7248
- C:\Windows\System\uXaEBai.exe
  C:\Windows\System\uXaEBai.exe
  2⤵
  PID:7268
- C:\Windows\System\TsctRfb.exe
  C:\Windows\System\TsctRfb.exe
  2⤵
  PID:7284
- C:\Windows\System\ZAVCaNa.exe
  C:\Windows\System\ZAVCaNa.exe
  2⤵
  PID:7312
- C:\Windows\System\pHjbtwo.exe
  C:\Windows\System\pHjbtwo.exe
  2⤵
  PID:7328
- C:\Windows\System\DBwrTgf.exe
  C:\Windows\System\DBwrTgf.exe
  2⤵
  PID:7348
- C:\Windows\System\DUsfRdE.exe
  C:\Windows\System\DUsfRdE.exe
  2⤵
  PID:7364
- C:\Windows\System\RajQBAV.exe
  C:\Windows\System\RajQBAV.exe
  2⤵
  PID:7388
- C:\Windows\System\fwESTFa.exe
  C:\Windows\System\fwESTFa.exe
  2⤵
  PID:7412
- C:\Windows\System\kUGZeqt.exe
  C:\Windows\System\kUGZeqt.exe
  2⤵
  PID:7632
- C:\Windows\System\XNbHhbd.exe
  C:\Windows\System\XNbHhbd.exe
  2⤵
  PID:7648
- C:\Windows\System\rfFMDXT.exe
  C:\Windows\System\rfFMDXT.exe
  2⤵
  PID:7664
- C:\Windows\System\cPeZfLt.exe
  C:\Windows\System\cPeZfLt.exe
  2⤵
  PID:7680
- C:\Windows\System\KCeKwqN.exe
  C:\Windows\System\KCeKwqN.exe
  2⤵
  PID:7696
- C:\Windows\System\MBZcJNy.exe
  C:\Windows\System\MBZcJNy.exe
  2⤵
  PID:7712
- C:\Windows\System\PpGbuEX.exe
  C:\Windows\System\PpGbuEX.exe
  2⤵
  PID:7728
- C:\Windows\System\LoTDTow.exe
  C:\Windows\System\LoTDTow.exe
  2⤵
  PID:7744
- C:\Windows\System\UviGwno.exe
  C:\Windows\System\UviGwno.exe
  2⤵
  PID:7760
- C:\Windows\System\hTPOFko.exe
  C:\Windows\System\hTPOFko.exe
  2⤵
  PID:7776
- C:\Windows\System\dKFBshq.exe
  C:\Windows\System\dKFBshq.exe
  2⤵
  PID:7792
- C:\Windows\System\mRcxYnb.exe
  C:\Windows\System\mRcxYnb.exe
  2⤵
  PID:7808
- C:\Windows\System\YZRoNMh.exe
  C:\Windows\System\YZRoNMh.exe
  2⤵
  PID:7824
- C:\Windows\System\pIRqQbK.exe
  C:\Windows\System\pIRqQbK.exe
  2⤵
  PID:7840
- C:\Windows\System\GjeuntJ.exe
  C:\Windows\System\GjeuntJ.exe
  2⤵
  PID:7856
- C:\Windows\System\QglnELz.exe
  C:\Windows\System\QglnELz.exe
  2⤵
  PID:7872
- C:\Windows\System\KwBuHpG.exe
  C:\Windows\System\KwBuHpG.exe
  2⤵
  PID:7892
- C:\Windows\System\cHpNZnu.exe
  C:\Windows\System\cHpNZnu.exe
  2⤵
  PID:7908
- C:\Windows\System\aDNBJka.exe
  C:\Windows\System\aDNBJka.exe
  2⤵
  PID:7924
- C:\Windows\System\wGFDubu.exe
  C:\Windows\System\wGFDubu.exe
  2⤵
  PID:7940
- C:\Windows\System\KfReXVD.exe
  C:\Windows\System\KfReXVD.exe
  2⤵
  PID:7956
- C:\Windows\System\qQOzvoV.exe
  C:\Windows\System\qQOzvoV.exe
  2⤵
  PID:8000
- C:\Windows\System\AjYiHDU.exe
  C:\Windows\System\AjYiHDU.exe
  2⤵
  PID:8024
- C:\Windows\System\IKLLNyb.exe
  C:\Windows\System\IKLLNyb.exe
  2⤵
  PID:8080
- C:\Windows\System\XTtCGBX.exe
  C:\Windows\System\XTtCGBX.exe
  2⤵
  PID:5888
- C:\Windows\System\wcZFlBq.exe
  C:\Windows\System\wcZFlBq.exe
  2⤵
  PID:5948
- C:\Windows\System\nuLqrHk.exe
  C:\Windows\System\nuLqrHk.exe
  2⤵
  PID:5884
- C:\Windows\System\PEnQjdR.exe
  C:\Windows\System\PEnQjdR.exe
  2⤵
  PID:6036
- C:\Windows\System\KjxFEEv.exe
  C:\Windows\System\KjxFEEv.exe
  2⤵
  PID:6080
- C:\Windows\System\ddcTACu.exe
  C:\Windows\System\ddcTACu.exe
  2⤵
  PID:6120
- C:\Windows\System\mdjkEBh.exe
  C:\Windows\System\mdjkEBh.exe
  2⤵
  PID:2788
- C:\Windows\System\JbwUrsd.exe
  C:\Windows\System\JbwUrsd.exe
  2⤵
  PID:3544
- C:\Windows\System\NysgfNv.exe
  C:\Windows\System\NysgfNv.exe
  2⤵
  PID:5220
- C:\Windows\System\JcNoOjV.exe
  C:\Windows\System\JcNoOjV.exe
  2⤵
  PID:392
- C:\Windows\System\YYGhJud.exe
  C:\Windows\System\YYGhJud.exe
  2⤵
  PID:5712
- C:\Windows\System\ypBWvql.exe
  C:\Windows\System\ypBWvql.exe
  2⤵
  PID:2536
- C:\Windows\System\vDZFNuc.exe
  C:\Windows\System\vDZFNuc.exe
  2⤵
  PID:6216
- C:\Windows\System\zbmwqVr.exe
  C:\Windows\System\zbmwqVr.exe
  2⤵
  PID:6316
- C:\Windows\System\SmJxxLR.exe
  C:\Windows\System\SmJxxLR.exe
  2⤵
  PID:6356
- C:\Windows\System\ggFPkSn.exe
  C:\Windows\System\ggFPkSn.exe
  2⤵
  PID:6392
- C:\Windows\System\RorGBHy.exe
  C:\Windows\System\RorGBHy.exe
  2⤵
  PID:6452
- C:\Windows\System\HSFlTZC.exe
  C:\Windows\System\HSFlTZC.exe
  2⤵
  PID:6668
- C:\Windows\System\tkQHVfY.exe
  C:\Windows\System\tkQHVfY.exe
  2⤵
  PID:6852
- C:\Windows\System\AOjxedH.exe
  C:\Windows\System\AOjxedH.exe
  2⤵
  PID:7164
- C:\Windows\System\Qsjvgia.exe
  C:\Windows\System\Qsjvgia.exe
  2⤵
  PID:5204
- C:\Windows\System\TSzsxwN.exe
  C:\Windows\System\TSzsxwN.exe
  2⤵
  PID:7292
- C:\Windows\System\DsFnOsA.exe
  C:\Windows\System\DsFnOsA.exe
  2⤵
  PID:3832
- C:\Windows\System\UHaqMaG.exe
  C:\Windows\System\UHaqMaG.exe
  2⤵
  PID:6504
- C:\Windows\System\KoFpDWV.exe
  C:\Windows\System\KoFpDWV.exe
  2⤵
  PID:6584
- C:\Windows\System\jmIqUzB.exe
  C:\Windows\System\jmIqUzB.exe
  2⤵
  PID:6664
- C:\Windows\System\RVxQKgb.exe
  C:\Windows\System\RVxQKgb.exe
  2⤵
  PID:6744
- C:\Windows\System\lQHQySU.exe
  C:\Windows\System\lQHQySU.exe
  2⤵
  PID:6832
- C:\Windows\System\BYbccZc.exe
  C:\Windows\System\BYbccZc.exe
  2⤵
  PID:6888
- C:\Windows\System\yGbhOUh.exe
  C:\Windows\System\yGbhOUh.exe
  2⤵
  PID:6952
- C:\Windows\System\DvzYEHm.exe
  C:\Windows\System\DvzYEHm.exe
  2⤵
  PID:7004
- C:\Windows\System\pIeASbO.exe
  C:\Windows\System\pIeASbO.exe
  2⤵
  PID:7052
- C:\Windows\System\rESfPFN.exe
  C:\Windows\System\rESfPFN.exe
  2⤵
  PID:7120
- C:\Windows\System\oFzNgfz.exe
  C:\Windows\System\oFzNgfz.exe
  2⤵
  PID:5856
- C:\Windows\System\SsQOFOf.exe
  C:\Windows\System\SsQOFOf.exe
  2⤵
  PID:1272
- C:\Windows\System\VeTBPsu.exe
  C:\Windows\System\VeTBPsu.exe
  2⤵
  PID:2776
- C:\Windows\System\SeLMhyg.exe
  C:\Windows\System\SeLMhyg.exe
  2⤵
  PID:8784
- C:\Windows\System\mXsCZrK.exe
  C:\Windows\System\mXsCZrK.exe
  2⤵
  PID:8804
- C:\Windows\System\HADPRXE.exe
  C:\Windows\System\HADPRXE.exe
  2⤵
  PID:8872
- C:\Windows\System\pTTKhhm.exe
  C:\Windows\System\pTTKhhm.exe
  2⤵
  PID:8924
- C:\Windows\System\TuoJjHu.exe
  C:\Windows\System\TuoJjHu.exe
  2⤵
  PID:8964
- C:\Windows\System\zebscyq.exe
  C:\Windows\System\zebscyq.exe
  2⤵
  PID:8988
- C:\Windows\System\JHOPNcK.exe
  C:\Windows\System\JHOPNcK.exe
  2⤵
  PID:9040
- C:\Windows\System\OtCsAPn.exe
  C:\Windows\System\OtCsAPn.exe
  2⤵
  PID:9060
- C:\Windows\System\MoxyNeG.exe
  C:\Windows\System\MoxyNeG.exe
  2⤵
  PID:9084
- C:\Windows\System\HwpzTRs.exe
  C:\Windows\System\HwpzTRs.exe
  2⤵
  PID:9112
- C:\Windows\System\anxcYLE.exe
  C:\Windows\System\anxcYLE.exe
  2⤵
  PID:9128
- C:\Windows\System\SmCFWyQ.exe
  C:\Windows\System\SmCFWyQ.exe
  2⤵
  PID:9148
- C:\Windows\System\bfEYpSv.exe
  C:\Windows\System\bfEYpSv.exe
  2⤵
  PID:9164
- C:\Windows\System\ykhFaDS.exe
  C:\Windows\System\ykhFaDS.exe
  2⤵
  PID:9184
- C:\Windows\System\CwEqdEN.exe
  C:\Windows\System\CwEqdEN.exe
  2⤵
  PID:9204
- C:\Windows\System\kOeoqid.exe
  C:\Windows\System\kOeoqid.exe
  2⤵
  PID:6720
- C:\Windows\System\jWIQNPN.exe
  C:\Windows\System\jWIQNPN.exe
  2⤵
  PID:6968
- C:\Windows\System\BKyDkZg.exe
  C:\Windows\System\BKyDkZg.exe
  2⤵
  PID:8196
- C:\Windows\System\RmXxSKn.exe
  C:\Windows\System\RmXxSKn.exe
  2⤵
  PID:9220
- C:\Windows\System\NEIQXJJ.exe
  C:\Windows\System\NEIQXJJ.exe
  2⤵
  PID:9240
- C:\Windows\System\NFocSxr.exe
  C:\Windows\System\NFocSxr.exe
  2⤵
  PID:9260
- C:\Windows\System\jSTEFtb.exe
  C:\Windows\System\jSTEFtb.exe
  2⤵
  PID:9280
- C:\Windows\System\xubeKIb.exe
  C:\Windows\System\xubeKIb.exe
  2⤵
  PID:9368
- C:\Windows\System\eLdZhzd.exe
  C:\Windows\System\eLdZhzd.exe
  2⤵
  PID:9384
- C:\Windows\System\yzEoGou.exe
  C:\Windows\System\yzEoGou.exe
  2⤵
  PID:9400
- C:\Windows\System\SqgcUef.exe
  C:\Windows\System\SqgcUef.exe
  2⤵
  PID:9416
- C:\Windows\System\VKOIqtK.exe
  C:\Windows\System\VKOIqtK.exe
  2⤵
  PID:9432
- C:\Windows\System\cyjbvoe.exe
  C:\Windows\System\cyjbvoe.exe
  2⤵
  PID:9448
- C:\Windows\System\ZQOcpKh.exe
  C:\Windows\System\ZQOcpKh.exe
  2⤵
  PID:9464
- C:\Windows\System\JWVoahM.exe
  C:\Windows\System\JWVoahM.exe
  2⤵
  PID:9484
- C:\Windows\System\UrIWAWE.exe
  C:\Windows\System\UrIWAWE.exe
  2⤵
  PID:9508
- C:\Windows\System\MotzDVy.exe
  C:\Windows\System\MotzDVy.exe
  2⤵
  PID:9532
- C:\Windows\System\HtHuxGY.exe
  C:\Windows\System\HtHuxGY.exe
  2⤵
  PID:9548
- C:\Windows\System\FJqFWGW.exe
  C:\Windows\System\FJqFWGW.exe
  2⤵
  PID:9568
- C:\Windows\System\wGbCJlF.exe
  C:\Windows\System\wGbCJlF.exe
  2⤵
  PID:9588
- C:\Windows\System\knNUrGP.exe
  C:\Windows\System\knNUrGP.exe
  2⤵
  PID:9604
- C:\Windows\System\mHSRPGR.exe
  C:\Windows\System\mHSRPGR.exe
  2⤵
  PID:9620
- C:\Windows\System\MrcyklJ.exe
  C:\Windows\System\MrcyklJ.exe
  2⤵
  PID:9640
- C:\Windows\System\SjGaPns.exe
  C:\Windows\System\SjGaPns.exe
  2⤵
  PID:9664
- C:\Windows\System\JvuwObt.exe
  C:\Windows\System\JvuwObt.exe
  2⤵
  PID:9680
- C:\Windows\System\YECjbWz.exe
  C:\Windows\System\YECjbWz.exe
  2⤵
  PID:9704
- C:\Windows\System\xdzVIEx.exe
  C:\Windows\System\xdzVIEx.exe
  2⤵
  PID:9732
- C:\Windows\System\HZfCrtm.exe
  C:\Windows\System\HZfCrtm.exe
  2⤵
  PID:9752
- C:\Windows\System\CYwbTgb.exe
  C:\Windows\System\CYwbTgb.exe
  2⤵
  PID:9772
- C:\Windows\System\FoSHkQM.exe
  C:\Windows\System\FoSHkQM.exe
  2⤵
  PID:9788
- C:\Windows\System\HnYdBhK.exe
  C:\Windows\System\HnYdBhK.exe
  2⤵
  PID:9804
- C:\Windows\System\nrlTYEm.exe
  C:\Windows\System\nrlTYEm.exe
  2⤵
  PID:9824
- C:\Windows\System\fIMoDvZ.exe
  C:\Windows\System\fIMoDvZ.exe
  2⤵
  PID:9840
- C:\Windows\System\pGJwTke.exe
  C:\Windows\System\pGJwTke.exe
  2⤵
  PID:9864
- C:\Windows\System\EYGousB.exe
  C:\Windows\System\EYGousB.exe
  2⤵
  PID:9892
- C:\Windows\System\ByLdPWs.exe
  C:\Windows\System\ByLdPWs.exe
  2⤵
  PID:9908
- C:\Windows\System\nojbyub.exe
  C:\Windows\System\nojbyub.exe
  2⤵
  PID:9932
- C:\Windows\System\QffAzqy.exe
  C:\Windows\System\QffAzqy.exe
  2⤵
  PID:9952
- C:\Windows\System\vblpzgh.exe
  C:\Windows\System\vblpzgh.exe
  2⤵
  PID:9972
- C:\Windows\System\vCOmfnB.exe
  C:\Windows\System\vCOmfnB.exe
  2⤵
  PID:9996
- C:\Windows\System\vZbYbjB.exe
  C:\Windows\System\vZbYbjB.exe
  2⤵
  PID:10020
- C:\Windows\System\ecvdQpp.exe
  C:\Windows\System\ecvdQpp.exe
  2⤵
  PID:10036
- C:\Windows\System\hnNfEdb.exe
  C:\Windows\System\hnNfEdb.exe
  2⤵
  PID:10068
- C:\Windows\System\qoHmmED.exe
  C:\Windows\System\qoHmmED.exe
  2⤵
  PID:10092
- C:\Windows\System\EjmmdQe.exe
  C:\Windows\System\EjmmdQe.exe
  2⤵
  PID:10116
- C:\Windows\System\CBFUYQG.exe
  C:\Windows\System\CBFUYQG.exe
  2⤵
  PID:10132
- C:\Windows\System\OSjNWsj.exe
  C:\Windows\System\OSjNWsj.exe
  2⤵
  PID:10160
- C:\Windows\System\dKvNAqq.exe
  C:\Windows\System\dKvNAqq.exe
  2⤵
  PID:10180
- C:\Windows\System\NQYELaj.exe
  C:\Windows\System\NQYELaj.exe
  2⤵
  PID:10204
- C:\Windows\System\RufNkiI.exe
  C:\Windows\System\RufNkiI.exe
  2⤵
  PID:10228
- C:\Windows\System\CXWHtdc.exe
  C:\Windows\System\CXWHtdc.exe
  2⤵
  PID:8328
- C:\Windows\System\FtUTzgt.exe
  C:\Windows\System\FtUTzgt.exe
  2⤵
  PID:6640
- C:\Windows\System\twtdbMS.exe
  C:\Windows\System\twtdbMS.exe
  2⤵
  PID:8308
- C:\Windows\System\MSVQXMs.exe
  C:\Windows\System\MSVQXMs.exe
  2⤵
  PID:9120
- C:\Windows\System\bnEmmMe.exe
  C:\Windows\System\bnEmmMe.exe
  2⤵
  PID:9192
- C:\Windows\System\CMyVXwB.exe
  C:\Windows\System\CMyVXwB.exe
  2⤵
  PID:8232
- C:\Windows\System\lnogkZs.exe
  C:\Windows\System\lnogkZs.exe
  2⤵
  PID:7640
- C:\Windows\System\dBCbYvm.exe
  C:\Windows\System\dBCbYvm.exe
  2⤵
  PID:7692
- C:\Windows\System\hadFhnT.exe
  C:\Windows\System\hadFhnT.exe
  2⤵
  PID:5004
- C:\Windows\System\NQydNpY.exe
  C:\Windows\System\NQydNpY.exe
  2⤵
  PID:10252
- C:\Windows\System\iBhKStw.exe
  C:\Windows\System\iBhKStw.exe
  2⤵
  PID:10276
- C:\Windows\System\HsdbmlQ.exe
  C:\Windows\System\HsdbmlQ.exe
  2⤵
  PID:10300
- C:\Windows\System\WYBntkb.exe
  C:\Windows\System\WYBntkb.exe
  2⤵
  PID:10316
- C:\Windows\System\UXyqHLu.exe
  C:\Windows\System\UXyqHLu.exe
  2⤵
  PID:10340
- C:\Windows\System\umVLSrH.exe
  C:\Windows\System\umVLSrH.exe
  2⤵
  PID:10364
- C:\Windows\System\XudNfkU.exe
  C:\Windows\System\XudNfkU.exe
  2⤵
  PID:10384
- C:\Windows\System\XSeXcKP.exe
  C:\Windows\System\XSeXcKP.exe
  2⤵
  PID:10404
- C:\Windows\System\kYtZIUp.exe
  C:\Windows\System\kYtZIUp.exe
  2⤵
  PID:10448
- C:\Windows\System\JCmcTOM.exe
  C:\Windows\System\JCmcTOM.exe
  2⤵
  PID:10464
- C:\Windows\System\DLiYyRk.exe
  C:\Windows\System\DLiYyRk.exe
  2⤵
  PID:10484
- C:\Windows\System\tRjLXIs.exe
  C:\Windows\System\tRjLXIs.exe
  2⤵
  PID:10500
- C:\Windows\System\yFbmrjC.exe
  C:\Windows\System\yFbmrjC.exe
  2⤵
  PID:10532
- C:\Windows\System\HwSLzsw.exe
  C:\Windows\System\HwSLzsw.exe
  2⤵
  PID:10552
- C:\Windows\System\vbEviJc.exe
  C:\Windows\System\vbEviJc.exe
  2⤵
  PID:10568
- C:\Windows\System\cCpPZPJ.exe
  C:\Windows\System\cCpPZPJ.exe
  2⤵
  PID:10584
- C:\Windows\System\SWQHvZz.exe
  C:\Windows\System\SWQHvZz.exe
  2⤵
  PID:10604
- C:\Windows\System\hHHqaJO.exe
  C:\Windows\System\hHHqaJO.exe
  2⤵
  PID:10620
- C:\Windows\System\BHvYwSk.exe
  C:\Windows\System\BHvYwSk.exe
  2⤵
  PID:10636
- C:\Windows\System\Huafwgl.exe
  C:\Windows\System\Huafwgl.exe
  2⤵
  PID:10652
- C:\Windows\System\IOkUtId.exe
  C:\Windows\System\IOkUtId.exe
  2⤵
  PID:10668
- C:\Windows\System\SggBeCb.exe
  C:\Windows\System\SggBeCb.exe
  2⤵
  PID:10692
- C:\Windows\System\JvxgnpE.exe
  C:\Windows\System\JvxgnpE.exe
  2⤵
  PID:10716
- C:\Windows\System\GmmRwBU.exe
  C:\Windows\System\GmmRwBU.exe
  2⤵
  PID:10740
- C:\Windows\System\ejVPIvY.exe
  C:\Windows\System\ejVPIvY.exe
  2⤵
  PID:10756
- C:\Windows\System\lMoqDUu.exe
  C:\Windows\System\lMoqDUu.exe
  2⤵
  PID:10780
- C:\Windows\System\OBHhgyT.exe
  C:\Windows\System\OBHhgyT.exe
  2⤵
  PID:10804
- C:\Windows\System\aRfYJBk.exe
  C:\Windows\System\aRfYJBk.exe
  2⤵
  PID:10820
- C:\Windows\System\hHipBDk.exe
  C:\Windows\System\hHipBDk.exe
  2⤵
  PID:10836
- C:\Windows\System\rVZqHur.exe
  C:\Windows\System\rVZqHur.exe
  2⤵
  PID:10852
- C:\Windows\System\KJDSLdw.exe
  C:\Windows\System\KJDSLdw.exe
  2⤵
  PID:10868
- C:\Windows\System\ahegrvh.exe
  C:\Windows\System\ahegrvh.exe
  2⤵
  PID:10884
- C:\Windows\System\osCkuma.exe
  C:\Windows\System\osCkuma.exe
  2⤵
  PID:10904
- C:\Windows\System\eqyyjjo.exe
  C:\Windows\System\eqyyjjo.exe
  2⤵
  PID:10924
- C:\Windows\System\eOZuHoo.exe
  C:\Windows\System\eOZuHoo.exe
  2⤵
  PID:10948
- C:\Windows\System\gmYzpSF.exe
  C:\Windows\System\gmYzpSF.exe
  2⤵
  PID:10968
- C:\Windows\System\GrFuEFW.exe
  C:\Windows\System\GrFuEFW.exe
  2⤵
  PID:10992
- C:\Windows\System\nKCxfOG.exe
  C:\Windows\System\nKCxfOG.exe
  2⤵
  PID:11016
- C:\Windows\System\fcgNAjc.exe
  C:\Windows\System\fcgNAjc.exe
  2⤵
  PID:11036
- C:\Windows\System\nhYbBrP.exe
  C:\Windows\System\nhYbBrP.exe
  2⤵
  PID:11060
- C:\Windows\System\IUyzpZb.exe
  C:\Windows\System\IUyzpZb.exe
  2⤵
  PID:11080
- C:\Windows\System\sPSmUBk.exe
  C:\Windows\System\sPSmUBk.exe
  2⤵
  PID:11100
- C:\Windows\System\xklmbhE.exe
  C:\Windows\System\xklmbhE.exe
  2⤵
  PID:11128
- C:\Windows\System\EzbVYeW.exe
  C:\Windows\System\EzbVYeW.exe
  2⤵
  PID:11144
- C:\Windows\System\flfXYSk.exe
  C:\Windows\System\flfXYSk.exe
  2⤵
  PID:11168
- C:\Windows\System\EWJwtxW.exe
  C:\Windows\System\EWJwtxW.exe
  2⤵
  PID:11192
- C:\Windows\System\WMDqhHw.exe
  C:\Windows\System\WMDqhHw.exe
  2⤵
  PID:11208
- C:\Windows\System\WOVAFnm.exe
  C:\Windows\System\WOVAFnm.exe
  2⤵
  PID:11228
- C:\Windows\System\RmBRROM.exe
  C:\Windows\System\RmBRROM.exe
  2⤵
  PID:11248
- C:\Windows\System\wzRiEyu.exe
  C:\Windows\System\wzRiEyu.exe
  2⤵
  PID:7772
- C:\Windows\System\bRsMZuQ.exe
  C:\Windows\System\bRsMZuQ.exe
  2⤵
  PID:7816
- C:\Windows\System\XTBPpfS.exe
  C:\Windows\System\XTBPpfS.exe
  2⤵
  PID:7864
- C:\Windows\System\muQbrHd.exe
  C:\Windows\System\muQbrHd.exe
  2⤵
  PID:7916
- C:\Windows\System\FSSjBeb.exe
  C:\Windows\System\FSSjBeb.exe
  2⤵
  PID:7948
- C:\Windows\System\NmdUSIw.exe
  C:\Windows\System\NmdUSIw.exe
  2⤵
  PID:7996
- C:\Windows\System\RxcDRmY.exe
  C:\Windows\System\RxcDRmY.exe
  2⤵
  PID:5516
- C:\Windows\System\KuCrrPG.exe
  C:\Windows\System\KuCrrPG.exe
  2⤵
  PID:5608
- C:\Windows\System\EiKPpgQ.exe
  C:\Windows\System\EiKPpgQ.exe
  2⤵
  PID:5664
- C:\Windows\System\rXitMhj.exe
  C:\Windows\System\rXitMhj.exe
  2⤵
  PID:1892
- C:\Windows\System\UbKtNvl.exe
  C:\Windows\System\UbKtNvl.exe
  2⤵
  PID:5928
- C:\Windows\System\skuatIa.exe
  C:\Windows\System\skuatIa.exe
  2⤵
  PID:6988
- C:\Windows\System\fdbNWJE.exe
  C:\Windows\System\fdbNWJE.exe
  2⤵
  PID:7148
- C:\Windows\System\veYAZCp.exe
  C:\Windows\System\veYAZCp.exe
  2⤵
  PID:1572
- C:\Windows\System\oosFUyj.exe
  C:\Windows\System\oosFUyj.exe
  2⤵
  PID:5748
- C:\Windows\System\EVfTrEH.exe
  C:\Windows\System\EVfTrEH.exe
  2⤵
  PID:7196
- C:\Windows\System\RJrOaau.exe
  C:\Windows\System\RJrOaau.exe
  2⤵
  PID:7280
- C:\Windows\System\ivtWgHu.exe
  C:\Windows\System\ivtWgHu.exe
  2⤵
  PID:8204
- C:\Windows\System\zfpvSCA.exe
  C:\Windows\System\zfpvSCA.exe
  2⤵
  PID:9092
- C:\Windows\System\dAYAQBM.exe
  C:\Windows\System\dAYAQBM.exe
  2⤵
  PID:9564
- C:\Windows\System\QhOwNlo.exe
  C:\Windows\System\QhOwNlo.exe
  2⤵
  PID:9156
- C:\Windows\System\OJvvPWS.exe
  C:\Windows\System\OJvvPWS.exe
  2⤵
  PID:9600
- C:\Windows\System\PDCBYPf.exe
  C:\Windows\System\PDCBYPf.exe
  2⤵
  PID:1396
- C:\Windows\System\rmIJXAt.exe
  C:\Windows\System\rmIJXAt.exe
  2⤵
  PID:8260
- C:\Windows\System\DaXCIjE.exe
  C:\Windows\System\DaXCIjE.exe
  2⤵
  PID:9256
- C:\Windows\System\mjzvFkG.exe
  C:\Windows\System\mjzvFkG.exe
  2⤵
  PID:8368
- C:\Windows\System\DHrzXWL.exe
  C:\Windows\System\DHrzXWL.exe
  2⤵
  PID:9716
- C:\Windows\System\lnbwsWe.exe
  C:\Windows\System\lnbwsWe.exe
  2⤵
  PID:9832
- C:\Windows\System\hwMpuHe.exe
  C:\Windows\System\hwMpuHe.exe
  2⤵
  PID:8672
- C:\Windows\System\cvNKxoV.exe
  C:\Windows\System\cvNKxoV.exe
  2⤵
  PID:8812
- C:\Windows\System\QjtJPRN.exe
  C:\Windows\System\QjtJPRN.exe
  2⤵
  PID:8916
- C:\Windows\System\IUECKLz.exe
  C:\Windows\System\IUECKLz.exe
  2⤵
  PID:9004
- C:\Windows\System\VaSEVCv.exe
  C:\Windows\System\VaSEVCv.exe
  2⤵
  PID:9456
- C:\Windows\System\nnnTcWl.exe
  C:\Windows\System\nnnTcWl.exe
  2⤵
  PID:9068
- C:\Windows\System\gzoupPd.exe
  C:\Windows\System\gzoupPd.exe
  2⤵
  PID:9504
- C:\Windows\System\KCnZbaf.exe
  C:\Windows\System\KCnZbaf.exe
  2⤵
  PID:11012
- C:\Windows\System\oUdxfsS.exe
  C:\Windows\System\oUdxfsS.exe
  2⤵
  PID:11044
- C:\Windows\System\eBhfYNP.exe
  C:\Windows\System\eBhfYNP.exe
  2⤵
  PID:9636
- C:\Windows\System\CYJIysS.exe
  C:\Windows\System\CYJIysS.exe
  2⤵
  PID:9276
- C:\Windows\System\HUzOtTX.exe
  C:\Windows\System\HUzOtTX.exe
  2⤵
  PID:4992
- C:\Windows\System\pHbsDJz.exe
  C:\Windows\System\pHbsDJz.exe
  2⤵
  PID:7832
- C:\Windows\System\JZjEEPv.exe
  C:\Windows\System\JZjEEPv.exe
  2⤵
  PID:7884
- C:\Windows\System\QzcLjnz.exe
  C:\Windows\System\QzcLjnz.exe
  2⤵
  PID:11664
- C:\Windows\System\PNFfXrh.exe
  C:\Windows\System\PNFfXrh.exe
  2⤵
  PID:11716
- C:\Windows\System\uGERaPR.exe
  C:\Windows\System\uGERaPR.exe
  2⤵
  PID:11748
- C:\Windows\System\wSBZZFt.exe
  C:\Windows\System\wSBZZFt.exe
  2⤵
  PID:11764
- C:\Windows\System\sXNFBpG.exe
  C:\Windows\System\sXNFBpG.exe
  2⤵
  PID:11784
- C:\Windows\System\GfSiszF.exe
  C:\Windows\System\GfSiszF.exe
  2⤵
  PID:11804
- C:\Windows\System\ISEvLoy.exe
  C:\Windows\System\ISEvLoy.exe
  2⤵
  PID:11824
- C:\Windows\System\CmaXrsY.exe
  C:\Windows\System\CmaXrsY.exe
  2⤵
  PID:11844
- C:\Windows\System\UapAzVj.exe
  C:\Windows\System\UapAzVj.exe
  2⤵
  PID:11864
- C:\Windows\System\YpcwXdC.exe
  C:\Windows\System\YpcwXdC.exe
  2⤵
  PID:11880
- C:\Windows\System\DEpJkbr.exe
  C:\Windows\System\DEpJkbr.exe
  2⤵
  PID:11904
- C:\Windows\System\ZmQXjAG.exe
  C:\Windows\System\ZmQXjAG.exe
  2⤵
  PID:11924
- C:\Windows\System\ATZdbiG.exe
  C:\Windows\System\ATZdbiG.exe
  2⤵
  PID:11944
- C:\Windows\System\HRipimB.exe
  C:\Windows\System\HRipimB.exe
  2⤵
  PID:11968
- C:\Windows\System\LfRMeED.exe
  C:\Windows\System\LfRMeED.exe
  2⤵
  PID:11984
- C:\Windows\System\PzCeaZb.exe
  C:\Windows\System\PzCeaZb.exe
  2⤵
  PID:12000
- C:\Windows\System\MAOhruB.exe
  C:\Windows\System\MAOhruB.exe
  2⤵
  PID:12024
- C:\Windows\System\BByDNNc.exe
  C:\Windows\System\BByDNNc.exe
  2⤵
  PID:12040
- C:\Windows\System\WCcJNJF.exe
  C:\Windows\System\WCcJNJF.exe
  2⤵
  PID:12064
- C:\Windows\System\XgZfpzG.exe
  C:\Windows\System\XgZfpzG.exe
  2⤵
  PID:12080
- C:\Windows\System\VyoTiYW.exe
  C:\Windows\System\VyoTiYW.exe
  2⤵
  PID:12096
- C:\Windows\System\pWPVgzc.exe
  C:\Windows\System\pWPVgzc.exe
  2⤵
  PID:12144
- C:\Windows\System\DtgRrCo.exe
  C:\Windows\System\DtgRrCo.exe
  2⤵
  PID:12160
- C:\Windows\System\qKpyroT.exe
  C:\Windows\System\qKpyroT.exe
  2⤵
  PID:12180
- C:\Windows\System\VTPVbUU.exe
  C:\Windows\System\VTPVbUU.exe
  2⤵
  PID:12204
- C:\Windows\System\NfdTfrW.exe
  C:\Windows\System\NfdTfrW.exe
  2⤵
  PID:12224
- C:\Windows\System\lnhHNYq.exe
  C:\Windows\System\lnhHNYq.exe
  2⤵
  PID:12248
- C:\Windows\System\hRvDBze.exe
  C:\Windows\System\hRvDBze.exe
  2⤵
  PID:12264
- C:\Windows\System\RYZxpTt.exe
  C:\Windows\System\RYZxpTt.exe
  2⤵
  PID:9340
- C:\Windows\System\teBotDe.exe
  C:\Windows\System\teBotDe.exe
  2⤵
  PID:9360
- C:\Windows\System\pZfAXfL.exe
  C:\Windows\System\pZfAXfL.exe
  2⤵
  PID:9392
- C:\Windows\System\ouNxdRz.exe
  C:\Windows\System\ouNxdRz.exe
  2⤵
  PID:9444
- C:\Windows\System\szBkDLL.exe
  C:\Windows\System\szBkDLL.exe
  2⤵
  PID:9632
- C:\Windows\System\lgcirgv.exe
  C:\Windows\System\lgcirgv.exe
  2⤵
  PID:11160
- C:\Windows\System\eizmmuP.exe
  C:\Windows\System\eizmmuP.exe
  2⤵
  PID:9780
- C:\Windows\System\dqDmcXk.exe
  C:\Windows\System\dqDmcXk.exe
  2⤵
  PID:9820
- C:\Windows\System\WxTACcN.exe
  C:\Windows\System\WxTACcN.exe
  2⤵
  PID:9944
- C:\Windows\System\siymsNC.exe
  C:\Windows\System\siymsNC.exe
  2⤵
  PID:10064
- C:\Windows\System\DXgRucl.exe
  C:\Windows\System\DXgRucl.exe
  2⤵
  PID:10152
- C:\Windows\System\qXcTRxl.exe
  C:\Windows\System\qXcTRxl.exe
  2⤵
  PID:10212
- C:\Windows\System\kSHLdSk.exe
  C:\Windows\System\kSHLdSk.exe
  2⤵
  PID:8340
- C:\Windows\System\bLkNiTr.exe
  C:\Windows\System\bLkNiTr.exe
  2⤵
  PID:9100
- C:\Windows\System\itfhpNY.exe
  C:\Windows\System\itfhpNY.exe
  2⤵
  PID:9212
- C:\Windows\System\eNyFpFk.exe
  C:\Windows\System\eNyFpFk.exe
  2⤵
  PID:4864
- C:\Windows\System\lelSAQY.exe
  C:\Windows\System\lelSAQY.exe
  2⤵
  PID:7720
- C:\Windows\System\KzFmNeF.exe
  C:\Windows\System\KzFmNeF.exe
  2⤵
  PID:10272
- C:\Windows\System\XfPLEkd.exe
  C:\Windows\System\XfPLEkd.exe
  2⤵
  PID:10324
- C:\Windows\System\sUMBhjO.exe
  C:\Windows\System\sUMBhjO.exe
  2⤵
  PID:10360
- C:\Windows\System\CpRLuJa.exe
  C:\Windows\System\CpRLuJa.exe
  2⤵
  PID:10400
- C:\Windows\System\OWfFiML.exe
  C:\Windows\System\OWfFiML.exe
  2⤵
  PID:10444
- C:\Windows\System\jscRsYj.exe
  C:\Windows\System\jscRsYj.exe
  2⤵
  PID:10496
- C:\Windows\System\dnnmWYl.exe
  C:\Windows\System\dnnmWYl.exe
  2⤵
  PID:10540
- C:\Windows\System\KigeIWR.exe
  C:\Windows\System\KigeIWR.exe
  2⤵
  PID:10592
- C:\Windows\System\FrFuHay.exe
  C:\Windows\System\FrFuHay.exe
  2⤵
  PID:10644
- C:\Windows\System\OrXcUuN.exe
  C:\Windows\System\OrXcUuN.exe
  2⤵
  PID:10688
- C:\Windows\System\oZedjCi.exe
  C:\Windows\System\oZedjCi.exe
  2⤵
  PID:10748
- C:\Windows\System\aHHSrVd.exe
  C:\Windows\System\aHHSrVd.exe
  2⤵
  PID:10776
- C:\Windows\System\eEOxUcm.exe
  C:\Windows\System\eEOxUcm.exe
  2⤵
  PID:10832
- C:\Windows\System\SPLdGRN.exe
  C:\Windows\System\SPLdGRN.exe
  2⤵
  PID:10960
- C:\Windows\System\IurGjXJ.exe
  C:\Windows\System\IurGjXJ.exe
  2⤵
  PID:11068
- C:\Windows\System\PZcGZDy.exe
  C:\Windows\System\PZcGZDy.exe
  2⤵
  PID:11184
- C:\Windows\System\WcDNkQI.exe
  C:\Windows\System\WcDNkQI.exe
  2⤵
  PID:11236
- C:\Windows\System\bQhTnZo.exe
  C:\Windows\System\bQhTnZo.exe
  2⤵
  PID:7756
- C:\Windows\System\pDixxro.exe
  C:\Windows\System\pDixxro.exe
  2⤵
  PID:10956
- C:\Windows\System\jBCvMuE.exe
  C:\Windows\System\jBCvMuE.exe
  2⤵
  PID:11056
- C:\Windows\System\OxPQxan.exe
  C:\Windows\System\OxPQxan.exe
  2⤵
  PID:9724
- C:\Windows\System\FrFkrZy.exe
  C:\Windows\System\FrFkrZy.exe
  2⤵
  PID:9304
- C:\Windows\System\OKZRyqh.exe
  C:\Windows\System\OKZRyqh.exe
  2⤵
  PID:912
- C:\Windows\System\heCCXLQ.exe
  C:\Windows\System\heCCXLQ.exe
  2⤵
  PID:1824
- C:\Windows\System\biHFDbX.exe
  C:\Windows\System\biHFDbX.exe
  2⤵
  PID:6908
- C:\Windows\System\wHMnPSC.exe
  C:\Windows\System\wHMnPSC.exe
  2⤵
  PID:7100
- C:\Windows\System\vfDsmAe.exe
  C:\Windows\System\vfDsmAe.exe
  2⤵
  PID:3176
- C:\Windows\System\ZhvHvCV.exe
  C:\Windows\System\ZhvHvCV.exe
  2⤵
  PID:7324
- C:\Windows\System\rIycXgA.exe
  C:\Windows\System\rIycXgA.exe
  2⤵
  PID:9500
- C:\Windows\System\vxtzQOm.exe
  C:\Windows\System\vxtzQOm.exe
  2⤵
  PID:9596
- C:\Windows\System\CDShBqr.exe
  C:\Windows\System\CDShBqr.exe
  2⤵
  PID:9232
- C:\Windows\System\jDqRxpe.exe
  C:\Windows\System\jDqRxpe.exe
  2⤵
  PID:8312
- C:\Windows\System\STrtQsq.exe
  C:\Windows\System\STrtQsq.exe
  2⤵
  PID:9748
- C:\Windows\System\whysQTP.exe
  C:\Windows\System\whysQTP.exe
  2⤵
  PID:9964
- C:\Windows\System\UjRNirj.exe
  C:\Windows\System\UjRNirj.exe
  2⤵
  PID:10140
- C:\Windows\System\BDquwAL.exe
  C:\Windows\System\BDquwAL.exe
  2⤵
  PID:8596
- C:\Windows\System\VbRqWTK.exe
  C:\Windows\System\VbRqWTK.exe
  2⤵
  PID:8660
- C:\Windows\System\kSoDUfk.exe
  C:\Windows\System\kSoDUfk.exe
  2⤵
  PID:8944
- C:\Windows\System\YrHGHkU.exe
  C:\Windows\System\YrHGHkU.exe
  2⤵
  PID:11652
- C:\Windows\System\erHNsBn.exe
  C:\Windows\System\erHNsBn.exe
  2⤵
  PID:11684
- C:\Windows\System\YPKhEsv.exe
  C:\Windows\System\YPKhEsv.exe
  2⤵
  PID:11704
- C:\Windows\System\bEdSOSC.exe
  C:\Windows\System\bEdSOSC.exe
  2⤵
  PID:11736
- C:\Windows\System\zIpjBdX.exe
  C:\Windows\System\zIpjBdX.exe
  2⤵
  PID:11772
- C:\Windows\System\vDnLbCF.exe
  C:\Windows\System\vDnLbCF.exe
  2⤵
  PID:11812
- C:\Windows\System\eqZOvKc.exe
  C:\Windows\System\eqZOvKc.exe
  2⤵
  PID:11852
- C:\Windows\System\hkKHvjk.exe
  C:\Windows\System\hkKHvjk.exe
  2⤵
  PID:11876
- C:\Windows\System\RAvWzoo.exe
  C:\Windows\System\RAvWzoo.exe
  2⤵
  PID:11916
- C:\Windows\System\wJtuhrv.exe
  C:\Windows\System\wJtuhrv.exe
  2⤵
  PID:11996
- C:\Windows\System\fSmNJpN.exe
  C:\Windows\System\fSmNJpN.exe
  2⤵
  PID:11992
- C:\Windows\System\HTWLRlf.exe
  C:\Windows\System\HTWLRlf.exe
  2⤵
  PID:12036
- C:\Windows\System\DLEEucR.exe
  C:\Windows\System\DLEEucR.exe
  2⤵
  PID:12052
- C:\Windows\System\FzGwvto.exe
  C:\Windows\System\FzGwvto.exe
  2⤵
  PID:12304
- C:\Windows\System\DXhkVvO.exe
  C:\Windows\System\DXhkVvO.exe
  2⤵
  PID:12320
- C:\Windows\System\JDlUIuB.exe
  C:\Windows\System\JDlUIuB.exe
  2⤵
  PID:12348
- C:\Windows\System\zmLAJKB.exe
  C:\Windows\System\zmLAJKB.exe
  2⤵
  PID:12368
- C:\Windows\System\SbIqJRn.exe
  C:\Windows\System\SbIqJRn.exe
  2⤵
  PID:12392
- C:\Windows\System\LmKRXLk.exe
  C:\Windows\System\LmKRXLk.exe
  2⤵
  PID:12408
- C:\Windows\System\eLQqitt.exe
  C:\Windows\System\eLQqitt.exe
  2⤵
  PID:12448
- C:\Windows\System\xBXGzGS.exe
  C:\Windows\System\xBXGzGS.exe
  2⤵
  PID:12464
- C:\Windows\System\JdiEaAq.exe
  C:\Windows\System\JdiEaAq.exe
  2⤵
  PID:12484
- C:\Windows\System\oLcZPAn.exe
  C:\Windows\System\oLcZPAn.exe
  2⤵
  PID:12504
- C:\Windows\System\kAOiYmL.exe
  C:\Windows\System\kAOiYmL.exe
  2⤵
  PID:12524
- C:\Windows\System\aLdTCXo.exe
  C:\Windows\System\aLdTCXo.exe
  2⤵
  PID:12540
- C:\Windows\System\qqrOZIq.exe
  C:\Windows\System\qqrOZIq.exe
  2⤵
  PID:12556
- C:\Windows\System\NsTQlxg.exe
  C:\Windows\System\NsTQlxg.exe
  2⤵
  PID:12572
- C:\Windows\System\qCCDUQc.exe
  C:\Windows\System\qCCDUQc.exe
  2⤵
  PID:12600
- C:\Windows\System\gXfVpme.exe
  C:\Windows\System\gXfVpme.exe
  2⤵
  PID:12616
- C:\Windows\System\UPAsipE.exe
  C:\Windows\System\UPAsipE.exe
  2⤵
  PID:12644
- C:\Windows\System\afpZjvZ.exe
  C:\Windows\System\afpZjvZ.exe
  2⤵
  PID:12664
- C:\Windows\System\JEoBnLX.exe
  C:\Windows\System\JEoBnLX.exe
  2⤵
  PID:12688
- C:\Windows\System\WOGutOw.exe
  C:\Windows\System\WOGutOw.exe
  2⤵
  PID:12712
- C:\Windows\System\qmiZuKD.exe
  C:\Windows\System\qmiZuKD.exe
  2⤵
  PID:12732
- C:\Windows\System\KVTuCPJ.exe
  C:\Windows\System\KVTuCPJ.exe
  2⤵
  PID:12756
- C:\Windows\System\KPpUZsW.exe
  C:\Windows\System\KPpUZsW.exe
  2⤵
  PID:10460
- C:\Windows\System\bwiqGKk.exe
  C:\Windows\System\bwiqGKk.exe
  2⤵
  PID:10632
- C:\Windows\System\bSBUlXs.exe
  C:\Windows\System\bSBUlXs.exe
  2⤵
  PID:10848
- C:\Windows\System\uzRxNQs.exe
  C:\Windows\System\uzRxNQs.exe
  2⤵
  PID:11028
- C:\Windows\System\ieMfuwu.exe
  C:\Windows\System\ieMfuwu.exe
  2⤵
  PID:11204
- C:\Windows\System\RjcEklB.exe
  C:\Windows\System\RjcEklB.exe
  2⤵
  PID:11260
- C:\Windows\System\IAfRBNJ.exe
  C:\Windows\System\IAfRBNJ.exe
  2⤵
  PID:11032
- C:\Windows\System\sVPLPSY.exe
  C:\Windows\System\sVPLPSY.exe
  2⤵
  PID:11388
- C:\Windows\System\VpgYcOC.exe
  C:\Windows\System\VpgYcOC.exe
  2⤵
  PID:464
- C:\Windows\System\HOdaQsh.exe
  C:\Windows\System\HOdaQsh.exe
  2⤵
  PID:7276
- C:\Windows\System\FXhzlvh.exe
  C:\Windows\System\FXhzlvh.exe
  2⤵
  PID:11780
- C:\Windows\System\lvTPnHc.exe
  C:\Windows\System\lvTPnHc.exe
  2⤵
  PID:11800
- C:\Windows\System\LYVcVQe.exe
  C:\Windows\System\LYVcVQe.exe
  2⤵
  PID:11872
- C:\Windows\System\tbNjANa.exe
  C:\Windows\System\tbNjANa.exe
  2⤵
  PID:12016
- C:\Windows\System\TglIXLk.exe
  C:\Windows\System\TglIXLk.exe
  2⤵
  PID:12316
- C:\Windows\System\cHfrSHv.exe
  C:\Windows\System\cHfrSHv.exe
  2⤵
  PID:12568
- C:\Windows\System\YJOzNpR.exe
  C:\Windows\System\YJOzNpR.exe
  2⤵
  PID:12612
- C:\Windows\System\DNxinRT.exe
  C:\Windows\System\DNxinRT.exe
  2⤵
  PID:12660
- C:\Windows\System\tatEhQW.exe
  C:\Windows\System\tatEhQW.exe
  2⤵
  PID:12724
- C:\Windows\System\MJRXMgH.exe
  C:\Windows\System\MJRXMgH.exe
  2⤵
  PID:12768
- C:\Windows\System\tbnYoVL.exe
  C:\Windows\System\tbnYoVL.exe
  2⤵
  PID:12828
- C:\Windows\System\rpcgjWU.exe
  C:\Windows\System\rpcgjWU.exe
  2⤵
  PID:10580
- C:\Windows\System\kDCJHzA.exe
  C:\Windows\System\kDCJHzA.exe
  2⤵
  PID:10728
- C:\Windows\System\fvWEKaZ.exe
  C:\Windows\System\fvWEKaZ.exe
  2⤵
  PID:11628
- C:\Windows\System\PyzqUmq.exe
  C:\Windows\System\PyzqUmq.exe
  2⤵
  PID:11644
- C:\Windows\System\ovdNaAr.exe
  C:\Windows\System\ovdNaAr.exe
  2⤵
  PID:11776
- C:\Windows\System\MPOizDX.exe
  C:\Windows\System\MPOizDX.exe
  2⤵
  PID:11952
- C:\Windows\System\vjGGWAb.exe
  C:\Windows\System\vjGGWAb.exe
  2⤵
  PID:12076
- C:\Windows\System\XJUHSiQ.exe
  C:\Windows\System\XJUHSiQ.exe
  2⤵
  PID:12152
- C:\Windows\System\VxxWVPn.exe
  C:\Windows\System\VxxWVPn.exe
  2⤵
  PID:10352
- C:\Windows\System\AeWFAxG.exe
  C:\Windows\System\AeWFAxG.exe
  2⤵
  PID:10440
- C:\Windows\System\NCqibPy.exe
  C:\Windows\System\NCqibPy.exe
  2⤵
  PID:10676
- C:\Windows\System\KBEhikE.exe
  C:\Windows\System\KBEhikE.exe
  2⤵
  PID:10764
- C:\Windows\System\leDOwfH.exe
  C:\Windows\System\leDOwfH.exe
  2⤵
  PID:7972
- C:\Windows\System\WfDckIl.exe
  C:\Windows\System\WfDckIl.exe
  2⤵
  PID:5584
- C:\Windows\System\QyBStNg.exe
  C:\Windows\System\QyBStNg.exe
  2⤵
  PID:12956
- C:\Windows\System\eDMSbJe.exe
  C:\Windows\System\eDMSbJe.exe
  2⤵
  PID:13016
- C:\Windows\System\uiEKozW.exe
  C:\Windows\System\uiEKozW.exe
  2⤵
  PID:13048
- C:\Windows\System\iIDDIen.exe
  C:\Windows\System\iIDDIen.exe
  2⤵
  PID:13076
- C:\Windows\System\OIpWAkY.exe
  C:\Windows\System\OIpWAkY.exe
  2⤵
  PID:13012
- C:\Windows\System\SMXkiVs.exe
  C:\Windows\System\SMXkiVs.exe
  2⤵
  PID:6872
- C:\Windows\System\kTUGtpf.exe
  C:\Windows\System\kTUGtpf.exe
  2⤵
  PID:5364
- C:\Windows\System\hvtXioW.exe
  C:\Windows\System\hvtXioW.exe
  2⤵
  PID:10812
- C:\Windows\System\lMofVzf.exe
  C:\Windows\System\lMofVzf.exe
  2⤵
  PID:11744
- C:\Windows\System\PWhrHog.exe
  C:\Windows\System\PWhrHog.exe
  2⤵
  PID:12364
- C:\Windows\System\yUfDTJU.exe
  C:\Windows\System\yUfDTJU.exe
  2⤵
  PID:12472
- C:\Windows\System\fbJajPP.exe
  C:\Windows\System\fbJajPP.exe
  2⤵
  PID:12580
- C:\Windows\System\oHkcpcU.exe
  C:\Windows\System\oHkcpcU.exe
  2⤵
  PID:12720
- C:\Windows\System\WVWTaqH.exe
  C:\Windows\System\WVWTaqH.exe
  2⤵
  PID:1528
- C:\Windows\System\rTOafpp.exe
  C:\Windows\System\rTOafpp.exe
  2⤵
  PID:7572
- C:\Windows\System\kWxVaMs.exe
  C:\Windows\System\kWxVaMs.exe
  2⤵
  PID:5060
- C:\Windows\System\vJzwmiT.exe
  C:\Windows\System\vJzwmiT.exe
  2⤵
  PID:2472
- C:\Windows\System\pUKAbad.exe
  C:\Windows\System\pUKAbad.exe
  2⤵
  PID:1940
- C:\Windows\System\ZkWkKnO.exe
  C:\Windows\System\ZkWkKnO.exe
  2⤵
  PID:13360
- C:\Windows\System\uJZYbGZ.exe
  C:\Windows\System\uJZYbGZ.exe
  2⤵
  PID:13376
- C:\Windows\System\cMNhjCF.exe
  C:\Windows\System\cMNhjCF.exe
  2⤵
  PID:13420
- C:\Windows\System\PQidedn.exe
  C:\Windows\System\PQidedn.exe
  2⤵
  PID:13440
- C:\Windows\System\TJszqDd.exe
  C:\Windows\System\TJszqDd.exe
  2⤵
  PID:13456
- C:\Windows\System\cLUQlBp.exe
  C:\Windows\System\cLUQlBp.exe
  2⤵
  PID:13472
- C:\Windows\System\YybwyWH.exe
  C:\Windows\System\YybwyWH.exe
  2⤵
  PID:13708
- C:\Windows\System\eClXsFO.exe
  C:\Windows\System\eClXsFO.exe
  2⤵
  PID:13740
- C:\Windows\System\OgIBKYv.exe
  C:\Windows\System\OgIBKYv.exe
  2⤵
  PID:13864
- C:\Windows\System\oqLECeR.exe
  C:\Windows\System\oqLECeR.exe
  2⤵
  PID:13888
- C:\Windows\System\wrkpeUB.exe
  C:\Windows\System\wrkpeUB.exe
  2⤵
  PID:13908
- C:\Windows\System\YRXUXje.exe
  C:\Windows\System\YRXUXje.exe
  2⤵
  PID:14016
- C:\Windows\System\IOZssds.exe
  C:\Windows\System\IOZssds.exe
  2⤵
  PID:14032
- C:\Windows\System\LaQnqrA.exe
  C:\Windows\System\LaQnqrA.exe
  2⤵
  PID:14060
- C:\Windows\System\yEKzOgs.exe
  C:\Windows\System\yEKzOgs.exe
  2⤵
  PID:14076
- C:\Windows\System\RDPjjSy.exe
  C:\Windows\System\RDPjjSy.exe
  2⤵
  PID:14092
- C:\Windows\System\wIKaRkl.exe
  C:\Windows\System\wIKaRkl.exe
  2⤵
  PID:14112
- C:\Windows\System\cEMzUXF.exe
  C:\Windows\System\cEMzUXF.exe
  2⤵
  PID:14140
- C:\Windows\System\NlhkMPs.exe
  C:\Windows\System\NlhkMPs.exe
  2⤵
  PID:14172
- C:\Windows\System\busgkIH.exe
  C:\Windows\System\busgkIH.exe
  2⤵
  PID:14192
- C:\Windows\System\oTeavte.exe
  C:\Windows\System\oTeavte.exe
  2⤵
  PID:14220
- C:\Windows\System\znCCyTH.exe
  C:\Windows\System\znCCyTH.exe
  2⤵
  PID:14240
- C:\Windows\System\TYKGsVT.exe
  C:\Windows\System\TYKGsVT.exe
  2⤵
  PID:14288
- C:\Windows\System\pmdYOsx.exe
  C:\Windows\System\pmdYOsx.exe
  2⤵
  PID:14308
- C:\Windows\System\RnAgvLN.exe
  C:\Windows\System\RnAgvLN.exe
  2⤵
  PID:14328
- C:\Windows\System\OWuXxuL.exe
  C:\Windows\System\OWuXxuL.exe
  2⤵
  PID:1108
- C:\Windows\System\zAQZOdt.exe
  C:\Windows\System\zAQZOdt.exe
  2⤵
  PID:7240
- C:\Windows\System\zAHfPxV.exe
  C:\Windows\System\zAHfPxV.exe
  2⤵
  PID:9580
- C:\Windows\System\iNvqqmN.exe
  C:\Windows\System\iNvqqmN.exe
  2⤵
  PID:13192
- C:\Windows\System\RKsnxUN.exe
  C:\Windows\System\RKsnxUN.exe
  2⤵
  PID:13288
- C:\Windows\System\dEeQPTb.exe
  C:\Windows\System\dEeQPTb.exe
  2⤵
  PID:13488
- C:\Windows\System\oLDWeBt.exe
  C:\Windows\System\oLDWeBt.exe
  2⤵
  PID:14180
- C:\Windows\System\NOfMzdw.exe
  C:\Windows\System\NOfMzdw.exe
  2⤵
  PID:10800
- C:\Windows\System\GXdVqrt.exe
  C:\Windows\System\GXdVqrt.exe
  2⤵
  PID:13716
- C:\Windows\System\NCRmaxX.exe
  C:\Windows\System\NCRmaxX.exe
  2⤵
  PID:14068
- C:\Windows\System\EmIDQIs.exe
  C:\Windows\System\EmIDQIs.exe
  2⤵
  PID:12968
- C:\Windows\System\kABbbGh.exe
  C:\Windows\System\kABbbGh.exe
  2⤵
  PID:13828
- C:\Windows\System\WjMmeDH.exe
  C:\Windows\System\WjMmeDH.exe
  2⤵
  PID:13856
- C:\Windows\System\MmaLbMt.exe
  C:\Windows\System\MmaLbMt.exe
  2⤵
  PID:12236
- C:\Windows\System\kYlSxyr.exe
  C:\Windows\System\kYlSxyr.exe
  2⤵
  PID:14268
- C:\Windows\System\bELpLtA.exe
  C:\Windows\System\bELpLtA.exe
  2⤵
  PID:12072
- C:\Windows\System\gryEwjI.exe
  C:\Windows\System\gryEwjI.exe
  2⤵
  PID:3420
- C:\Windows\System\kUZXKBd.exe
  C:\Windows\System\kUZXKBd.exe
  2⤵
  PID:704
- C:\Windows\System\dktWSAr.exe
  C:\Windows\System\dktWSAr.exe
  2⤵
  PID:3952
- C:\Windows\System\PfIrzGX.exe
  C:\Windows\System\PfIrzGX.exe
  2⤵
  PID:13256
- C:\Windows\System\knuQOUa.exe
  C:\Windows\System\knuQOUa.exe
  2⤵
  PID:11440
- C:\Windows\System\xFSXtxw.exe
  C:\Windows\System\xFSXtxw.exe
  2⤵
  PID:13492
- C:\Windows\System\xTwRFTh.exe
  C:\Windows\System\xTwRFTh.exe
  2⤵
  PID:11672
- C:\Windows\System\OcsxPZl.exe
  C:\Windows\System\OcsxPZl.exe
  2⤵
  PID:10684
- C:\Windows\System\lCnOFrY.exe
  C:\Windows\System\lCnOFrY.exe
  2⤵
  PID:14028
- C:\Windows\System\cfQKZkc.exe
  C:\Windows\System\cfQKZkc.exe
  2⤵
  PID:13780
- C:\Windows\System\CHKOgum.exe
  C:\Windows\System\CHKOgum.exe
  2⤵
  PID:13728
- C:\Windows\System\FlOOnMy.exe
  C:\Windows\System\FlOOnMy.exe
  2⤵
  PID:14088
- C:\Windows\System\YZjkYyA.exe
  C:\Windows\System\YZjkYyA.exe
  2⤵
  PID:3748
- C:\Windows\System\tBDruxl.exe
  C:\Windows\System\tBDruxl.exe
  2⤵
  PID:13572
- C:\Windows\System\rXQcxkU.exe
  C:\Windows\System\rXQcxkU.exe
  2⤵
  PID:2312
- C:\Windows\System\BjRTJoL.exe
  C:\Windows\System\BjRTJoL.exe
  2⤵
  PID:13452
- C:\Windows\System\veuZXJg.exe
  C:\Windows\System\veuZXJg.exe
  2⤵
  PID:14012
- C:\Windows\System\rKQmZUw.exe
  C:\Windows\System\rKQmZUw.exe
  2⤵
  PID:14100
- C:\Windows\System\RsKZsus.exe
  C:\Windows\System\RsKZsus.exe
  2⤵
  PID:12432
- C:\Windows\System\fRwRtWP.exe
  C:\Windows\System\fRwRtWP.exe
  2⤵
  PID:3260
- C:\Windows\System\JwltYLo.exe
  C:\Windows\System\JwltYLo.exe
  2⤵
  PID:5620
- C:\Windows\System\HcSknng.exe
  C:\Windows\System\HcSknng.exe
  2⤵
  PID:13960
- C:\Windows\System\lnMbSBH.exe
  C:\Windows\System\lnMbSBH.exe
  2⤵
  PID:7048
- C:\Windows\System\GvMqEGm.exe
  C:\Windows\System\GvMqEGm.exe
  2⤵
  PID:12972
- C:\Windows\System\GGGyvJZ.exe
  C:\Windows\System\GGGyvJZ.exe
  2⤵
  PID:3632
- C:\Windows\System\uwjQoIF.exe
  C:\Windows\System\uwjQoIF.exe
  2⤵
  PID:14200
- C:\Windows\System\fZdAACn.exe
  C:\Windows\System\fZdAACn.exe
  2⤵
  PID:13652
- C:\Windows\System\QesXvfx.exe
  C:\Windows\System\QesXvfx.exe
  2⤵
  PID:13764
- C:\Windows\System\iurCJeB.exe
  C:\Windows\System\iurCJeB.exe
  2⤵
  PID:3436
- C:\Windows\System\xSYssaq.exe
  C:\Windows\System\xSYssaq.exe
  2⤵
  PID:13132
- C:\Windows\System\rzOgjqQ.exe
  C:\Windows\System\rzOgjqQ.exe
  2⤵
  PID:13976
- C:\Windows\System\zIqcgkj.exe
  C:\Windows\System\zIqcgkj.exe
  2⤵
  PID:13968
- C:\Windows\System\ptVftEy.exe
  C:\Windows\System\ptVftEy.exe
  2⤵
  PID:13584
- C:\Windows\System\yzmUyaj.exe
  C:\Windows\System\yzmUyaj.exe
  2⤵
  PID:13984
- C:\Windows\System\WmqYjin.exe
  C:\Windows\System\WmqYjin.exe
  2⤵
  PID:8012
- C:\Windows\System\dmuOlbd.exe
  C:\Windows\System\dmuOlbd.exe
  2⤵
  PID:13044
- C:\Windows\System\ANSYhXa.exe
  C:\Windows\System\ANSYhXa.exe
  2⤵
  PID:13588
- C:\Windows\System\obfsszs.exe
  C:\Windows\System\obfsszs.exe
  2⤵
  PID:14056
- C:\Windows\System\IgrevWl.exe
  C:\Windows\System\IgrevWl.exe
  2⤵
  PID:13496
- C:\Windows\System\zmSpNkt.exe
  C:\Windows\System\zmSpNkt.exe
  2⤵
  PID:13768
- C:\Windows\System\olyvnQW.exe
  C:\Windows\System\olyvnQW.exe
  2⤵
  PID:11156
- C:\Windows\System\bubGOKE.exe
  C:\Windows\System\bubGOKE.exe
  2⤵
  PID:14252
- C:\Windows\System\QwmJasN.exe
  C:\Windows\System\QwmJasN.exe
  2⤵
  PID:13384
- C:\Windows\System\fWUjfug.exe
  C:\Windows\System\fWUjfug.exe
  2⤵
  PID:13600
- C:\Windows\System\MdxbCbD.exe
  C:\Windows\System\MdxbCbD.exe
  2⤵
  PID:12108
- C:\Windows\System\pQWSUwO.exe
  C:\Windows\System\pQWSUwO.exe
  2⤵
  PID:13388

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 884 -p 11236 -ip 11236
1⤵
PID:13256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 932 -p 9500 -ip 9500
1⤵
PID:10684

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 948 -p 9748 -ip 9748
1⤵
PID:3420

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 980 -p 11996 -ip 11996
1⤵
PID:9580

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 1004 -p 12408 -ip 12408
1⤵
PID:12072

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 1080 -p 12600 -ip 12600
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_wnaaex0m.b4o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wnaaex0m.b4o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AouZKYx.exe

Path C:\Windows\System\AouZKYx.exe
Size 1.6MB
SHA256 830caa2fcd644526c79ba763769abf0726e0fe846ce8382f29ee826f919b4d66
MD5 dfc015a67eb1c57fd18d4d9bf1343baf
SHA1 ff55ad92038171352f5b75ca9ba23ed307d7aa8e
SHA512 c4d01031a56afdc250923367784d2e342d5aa3d5d6ff37f80d454a7403053d16bb448518ec9dabadd7211611fbc9f94142a126f593649334cc2ad58edcbf95d4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jao:Lz071uv4BPMkFfdg6NsNtJViSOo
MD5 SHA1 SHA512 SSDEEP

Submit Download

BGijCry.exe

Path C:\Windows\System\BGijCry.exe
Size 1.6MB
SHA256 e97c5bd9394e597e26b49af4443d2b0240021dd1a9b362b5c56aff422355bef9
MD5 106db550b3f64b64421929cff667a641
SHA1 845f949bbe950bbb830fd801bb4b03f73060c0c3
SHA512 8326cb38ae75117f67c9a64c6b0b69ca1d367a452652190fa4e3c68f32bb27e5c3e0b56861135e59c8e150f1114d42f19b2dc78fdb4b55b35ff3602d289a33d2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jao:Lz071uv4BPMkFfdg6NsNtJViSOo
MD5 SHA1 SHA512 SSDEEP

Submit Download

DXpGwea.exe

Path C:\Windows\System\DXpGwea.exe
Size 1.6MB
SHA256 601af71642fdacff3b0e1ba6f9081ea043d837ccdc24118b14ae0166cdd09413
MD5 246fca9753742abb8a49f8ff931037cf
SHA1 e80f37aaa1bd8fd469a9b509390e2c8d53be2c7f
SHA512 1aadce30ffa7acc9bd2550c815f4ecaf2e6cfc04b828ed0cc7ea722368f29009f12ef95645c426cf00002cebcdf63b815a72d257060923d55b1e48343e2b238b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/ja2:Lz071uv4BPMkFfdg6NsNtJViSO2
MD5 SHA1 SHA512 SSDEEP

Submit Download

DcujSkn.exe

Path C:\Windows\System\DcujSkn.exe
Size 1.6MB
SHA256 d32d65a273910f76de029415eb835b9d195f469663dcc35db88b5ab7efcea7e4
MD5 08efd0cf027cd3401c85e57b3616ac53
SHA1 eaea52a6bdaea6ecd9829882fc7eefdec6a91255
SHA512 e2645d718c5cf70d1d8a01b0b022d4d9dad23d77c2bf960ee4744ff8cf1caf0ee7dab7fab414028c669ebed5f9cdbd500673ea60ab0da8ba55ee0740e09f8929
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jag:Lz071uv4BPMkFfdg6NsNtJViSOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

FNFVrDi.exe

Path C:\Windows\System\FNFVrDi.exe
Size 1.6MB
SHA256 4db1e5a4549d72b2fef686a396e4b73b812b557a0462d80e5d2afd5212d69f27
MD5 24d1a6ba10677e76bf485d1649c23b52
SHA1 f4ab31df32cf10d7f961f83b92a16b23d12b8d64
SHA512 197a1720e20039589ecd989c104939a54dded437135e427637374e85070f2c49949c56812b99377d0feb90e33ccf4faaa18be2647cda6277d094713743359505
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaij:Lz071uv4BPMkFfdg6NsNtJViSOij
MD5 SHA1 SHA512 SSDEEP

Submit Download

GGVBqBN.exe

Path C:\Windows\System\GGVBqBN.exe
Size 1.6MB
SHA256 bfe32d6d6da44e1affc291b0894c2154f6e9176ee01930a3bbffbfefdad9dcbc
MD5 1dbc0127cd1b62d22c7007108678a38f
SHA1 2d86734c567fc9abe61e83bb3d7084fc01dc5f0f
SHA512 7f5b0e8a0a1a0b4ad90f354f52d3421f11739300d2f3d288ed36d3b95a8c37045c960a4320097d4ad147da62233a170608d419ae8522499f858be6711e555859
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/ja9:Lz071uv4BPMkFfdg6NsNtJViSO9
MD5 SHA1 SHA512 SSDEEP

Submit Download

IAhzepO.exe

Path C:\Windows\System\IAhzepO.exe
Size 1.6MB
SHA256 f1304bcb5a67d2552b491fb3ede11ca2ad8bf85c2d4eadd880ba43ffe5451294
MD5 7662ff9903e011b51c05fd18bf201e97
SHA1 5adb373735a560ede967279d0606b4b57f22ffc2
SHA512 4798a4e29d3680842b2273bb8adf91d64adaf23a5896a647ffa073dba085c21d214c95799db869b5693d573e549c44ad32817db895f948368e4b53e9e6df2571
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaG:Lz071uv4BPMkFfdg6NsNtJViSOG
MD5 SHA1 SHA512 SSDEEP

Submit Download

IhtoAOM.exe

Path C:\Windows\System\IhtoAOM.exe
Size 1.6MB
SHA256 d8484cb935f60999873852ad8b7bce0f76730a94d42a1330d9b510da6bb90544
MD5 6df172658700143fec2ca71253e67dda
SHA1 a0557a2f364791110f631a52ee438b813e4e551a
SHA512 230c9720e0370b9752dd17aa8fb734b8c47a99c72fd67d26ca34b8c0a95a2b3743a6d001b43ed85961327f01e7b9b6d18646e47d8864b5542c70fe5ba6eb6a2e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaC:Lz071uv4BPMkFfdg6NsNtJViSOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

JShXxkE.exe

Path C:\Windows\System\JShXxkE.exe
Size 1.6MB
SHA256 e902c135430e7ad64f585c4d8319c536e9da5c1841c0888d688398d9d7ba7dfd
MD5 cded22557afe51caae8d607bd5aff242
SHA1 43542ba76377fe63fbab9b8cbab95bd36eb5aaad
SHA512 65d56dc6bee23f0df5850b00f5794e711f614079df95788f0748bf3ba6f3e8ced53be6f23497123cc0c678cb3046982969993dbb612ca8c43c0b7938a77feb34
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jax:Lz071uv4BPMkFfdg6NsNtJViSOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

JWSgZiI.exe

Path C:\Windows\System\JWSgZiI.exe
Size 1.6MB
SHA256 8dc759c5e9b2fddbb2d2f495f463de313fe914a4427b38fb0d61ea96a82a6bca
MD5 b045dc2b2be3eb71d5563d971bab27a6
SHA1 7dfe8150ec1311856ef890ba0de104aa22208645
SHA512 bae7685505933e9900b086fb70107e69a3b3bb68c3107ee302e01f271ae1afee589a40bef9081baeb36037446aa93b58f264fbb93a980420522d8168f252c97b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaB3:Lz071uv4BPMkFfdg6NsNtJViSOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

JjevbyK.exe

Path C:\Windows\System\JjevbyK.exe
Size 1.6MB
SHA256 168bd835b64ef47d752de1bca539b0e535d95649395d34d40933b41afa4bc82d
MD5 129fc361de6c8c1dcd45f73c2509847a
SHA1 6e58fcc04081ff060bba62620396358ef607fb98
SHA512 1a0883ff65e8acdbc18ab7d6aea2b9e08682c7729cbf44dd816b51a42afe0deb3a1a391c6b460192a9d546ed4cf5dabc556480377c062c98a563b14170940d23
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/ja1:Lz071uv4BPMkFfdg6NsNtJViSO1
MD5 SHA1 SHA512 SSDEEP

Submit Download

NGMbSxW.exe

Path C:\Windows\System\NGMbSxW.exe
Size 1.6MB
SHA256 c16470fc1b251285d07bc7ff29e03f0c665cc3e017f6a9957d69b3e45f3814a4
MD5 253fa0275da762d611248624792bb661
SHA1 74969b87b0accfd74c9284b248d70ecaeb227d27
SHA512 6fb9a89d1daf6bc49416ba2deb0c993d105a65e363255ce339a01d2e99a934779b2d4d1c9ff6cb8bf0438833e0d098f285ca4cb1b42c8c955d98942843b47710
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaGC6:Lz071uv4BPMkFfdg6NsNtJViSOM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJucOvC.exe

Path C:\Windows\System\NJucOvC.exe
Size 1.6MB
SHA256 5e30d7d9a7af58ea4d50ae3b67660ac47473ace2555512cad75b01228867dd2b
MD5 0d2277f9dbcff40253dbedbc7a04bec3
SHA1 ac9e82d65a2131c0d639f2f09ab7c643d813cf4d
SHA512 d31e92f2edbc6d1a83426de6995e4bd3518eacb3862822d429878a20abc937fe645d7daccbe89a1f3e4e96b39ef4b48e847252631cf95cc5d90c1342489b536b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jal:Lz071uv4BPMkFfdg6NsNtJViSOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

NelGIQE.exe

Path C:\Windows\System\NelGIQE.exe
Size 1.6MB
SHA256 718eb83892c9cbfbcd63250549c83be03948ff5ac85a6822b20d5b6be4e0e578
MD5 68fc670de51292889ae84e8c5e0030f3
SHA1 8c5d27d716ee5ff4f931ab0c1c699962e900990f
SHA512 9deb4bbce47d6765e17775e8fa7c3a4bc63f3435f5ecdde2aff1f1790dd30c4c33dc17d3f0931801b8f1d09a5f5039396f645e259fc79ca2ff35684e136ae5b6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaa:Lz071uv4BPMkFfdg6NsNtJViSOa
MD5 SHA1 SHA512 SSDEEP

Submit Download

OveXCAy.exe

Path C:\Windows\System\OveXCAy.exe
Size 1.6MB
SHA256 d40a52f341da1f7d615e966a942602f57b206524529eaadfb7c896afbe0063f9
MD5 2f7f6c61ff4764b1dd7f7f8cd6984ecb
SHA1 ce76a6e4fac7bf8995a56f63f8c312e25f97eebf
SHA512 023049791def34c64c33183b9f7bc9a546b2738123334b9452536ed0e756f36e85d25f96e3c398721748145a99b5fb8e84b5eeb01cdefda8cc0af8a2dda5540e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaq:Lz071uv4BPMkFfdg6NsNtJViSOq
MD5 SHA1 SHA512 SSDEEP

Submit Download

PGDsUGi.exe

Path C:\Windows\System\PGDsUGi.exe
Size 1.6MB
SHA256 a56a126c76183e2d7d2d18fb97795430fc73aff3df8c51bf564fc3b1ae60a4b6
MD5 e0384b262777c5ec6e558f3213802324
SHA1 a3648acc7e778f43b024d5195f576b10a92b5e13
SHA512 940a330e426ec27ec793e9aca8be693c007313776f39cb4ef37bf9b6623c21c29797b27d4a405e758d32c601f3ef5653078f6b894160a830b403ac78fb9f621c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaPY:Lz071uv4BPMkFfdg6NsNtJViSOQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QFDAvMu.exe

Path C:\Windows\System\QFDAvMu.exe
Size 1.6MB
SHA256 368e01aabb81c6c524bc28941944586090ef2b86ee662563fd44a7b3d5188a51
MD5 7f5e56a5d5cb3be727ec7c7e8c05d3c1
SHA1 69189669404050948828a6bb2d2a6e6080b659c5
SHA512 4aa756a87d46509d124b0315ae81967192ffd8d4633dca82b9eada6738fa6f260a876511aac9fa71c50700a1784de4d142df4c8af04120f0dd05c28ad0236d69
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaL:Lz071uv4BPMkFfdg6NsNtJViSOL
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKFfqti.exe

Path C:\Windows\System\RKFfqti.exe
Size 1.6MB
SHA256 12df3c14d84d39171fdcc746e6713cbb562d71b47be437bcbeae42aba76cb6e5
MD5 4eef6089f6700f75d1f977eede0d6fba
SHA1 6e33b48462d1896809c0154d0752834d2b0cbc6e
SHA512 44528c7eb2fadd61dd15a6396ab931f05fed3bcd99353ff68994efa9c3aa40f81fbb34097cd0ef518bb2f8c684d48fe75708411c84ad389e72a5e27d5f9ccceb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jas:Lz071uv4BPMkFfdg6NsNtJViSOs
MD5 SHA1 SHA512 SSDEEP

Submit Download

RMzaCnh.exe

Path C:\Windows\System\RMzaCnh.exe
Size 1.6MB
SHA256 d735b63117cecdc24c61d2798d497ffd46efafcd8015ad0ec078c186cd36207a
MD5 a205a671a8fc309a00786869c53f2ec7
SHA1 a3950ea226435549ce489cc4118f527a13ed1f77
SHA512 8eaf0da7d6e581532a74c0f755f06b5fd82b6551ebadfbe6734ab13205befa54b91039c0c0dcf67ea49fa2c994322127028a170ed966c723565eab74e7926b78
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaT:Lz071uv4BPMkFfdg6NsNtJViSOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

RfaDfTw.exe

Path C:\Windows\System\RfaDfTw.exe
Size 1.6MB
SHA256 33f1f47544bb2a04304cbf9bcd69fb055cbab6702ee49bed528fd65bf1b55291
MD5 2e0d08c5fefaa2e85620020e93937869
SHA1 c35c0a632c1bfe8d21ad40b6b469164291057678
SHA512 0d7bd7b259d55ad1a334b186bc0b973b595134307af96e91796d3b69f470e17541544f34a8c06ac716d44bd477bc737dc9e8d3953b460f49e1927f572ce4b73f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaL:Lz071uv4BPMkFfdg6NsNtJViSOL
MD5 SHA1 SHA512 SSDEEP

Submit Download

SnMLxoo.exe

Path C:\Windows\System\SnMLxoo.exe
Size 1.6MB
SHA256 07eb540fcd4f5c17b3eacf9029b0748608e67079c02fa121b195f1a6125ba30e
MD5 53c24db5ac9a22df29a88447a0af02ab
SHA1 3c4ad2142582381f32c11f36f00b505b032ed35c
SHA512 1a7dd049142211ec587111ec56b1b6751119a7e82ba23c43dfd1455378730db120ecb8dfd200f23849481d9fea02a97a8c8a8a5e9dfe99ba657139303ebd646f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaG:Lz071uv4BPMkFfdg6NsNtJViSOG
MD5 SHA1 SHA512 SSDEEP

Submit Download

WSQJXtU.exe

Path C:\Windows\System\WSQJXtU.exe
Size 1.6MB
SHA256 573523063f48e441e044b7f47c0c7d417d9689484bb3916aa44677c236d1c81b
MD5 19a50068ad256da647f6036710538bd5
SHA1 21ecd3a390bc6d6f874c49c950231e9ba29bf7fd
SHA512 234759500c0548eaed91480b55750c97d2d2e8a063be4716f9da2a356ba0ff60c3ce44b5d9205e4ecea6615bc7ea3610d48ab85a9fc3f4efbf86b2ae0059cb67
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaf:Lz071uv4BPMkFfdg6NsNtJViSOf
MD5 SHA1 SHA512 SSDEEP

Submit Download

XkVKTOC.exe

Path C:\Windows\System\XkVKTOC.exe
Size 1.6MB
SHA256 8af88ae2113a5535418751dbbaec1d559f5fee2a769e3964d43acfc5144a4d98
MD5 175d316ff578e801a6754cefc482e776
SHA1 4805055e7bea1487b3d61694f8f82a132b7bd207
SHA512 ad7374a680c8c6dbb167f8303a089f3764e77583c4a5950954c4cc8df5f46f5e2d0efbcaea12608e5912f28db827095261ffb8e8cd4127ae48807596839f9bc2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaW2:Lz071uv4BPMkFfdg6NsNtJViSOz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZhOWyHb.exe

Path C:\Windows\System\ZhOWyHb.exe
Size 1.6MB
SHA256 8c4677de02c303316b13e2e56ab9e19feb2b50df66dee24d75c267e5a0f2c4c6
MD5 da4fd8868397952eed8d2ffc98e4d2fb
SHA1 1ff6146904753b6cab468e2ee705605ed19d2957
SHA512 87f0eefcb13562caa72674784fb7193f9497d003875788daec7c2a737d3974e898de992b3a2d80c809eac286c518fd9983ca4532681cd391db2099f5bc8d0864
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jah:Lz071uv4BPMkFfdg6NsNtJViSOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbrltEg.exe

Path C:\Windows\System\bbrltEg.exe
Size 1.6MB
SHA256 3b08a0e36a8d29e240651fa7b7ec11052709b32cbcefa0f3824a35ff14ea288b
MD5 1e746f06fad69a3c2e187aa5f177b21b
SHA1 38bb04ea07faa82514b21ae3c8894b7f59f5e85c
SHA512 dd16da7ac5a30a7627f48571fa97660df9d7f0ce757eb824c91264d375f7b973363bd662069f25803b2ec5547ce34c559bd1c78a619c30888204c6eac33754c5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jabDR:Lz071uv4BPMkFfdg6NsNtJViSOfR
MD5 SHA1 SHA512 SSDEEP

Submit Download

cEGPXEJ.exe

Path C:\Windows\System\cEGPXEJ.exe
Size 1.6MB
SHA256 083eba736660a0cc683f2110be40271ce2a1757cbf9ff66e4dedf330f2a6b37b
MD5 aee0c77ee7f620c84bc1b3c33decfc81
SHA1 d0c77549ed8999e9b0695d99c1b041a4c009034f
SHA512 4995cc3c85c68ef74efe99a75627afa06e17b7bb68931f59bffece1a0372f924eee37b337e6b2b565250d7958e2fea2746fbca8bef6e3b3e23cdb498e3575011
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaX:Lz071uv4BPMkFfdg6NsNtJViSOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

cYAmqVA.exe

Path C:\Windows\System\cYAmqVA.exe
Size 1.6MB
SHA256 484ae81ee6a3cdca06433e0907d5b30010935001fc009cc49f97882c6894be9e
MD5 1358aee0301c4906244a25160247841a
SHA1 7f950dc497bdb82c28204e15fa48be310afa2c40
SHA512 01d8314593cb8d0e6edb5597420909863b404bb28a8005df80178777c14f9634d8c3a6ea56dd652e3a48247d8d3ebc5c550fc227d3eefcfa83e7602384f62760
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaJ:Lz071uv4BPMkFfdg6NsNtJViSOJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dBxNGmr.exe

Path C:\Windows\System\dBxNGmr.exe
Size 1.6MB
SHA256 045500cf091c98936e3f275b0f1060db1db3c2c764724ab2840bdc3fd0d09dfb
MD5 6a1f0aade7e5fdd73083863974fc5ef0
SHA1 6cb39a174442eb999410e5a47ffc2be1292d8ce7
SHA512 00af3a7cef6eb7d2f5f036e3cef5dac0797adec2d9c376e86021f9d0640d59b9696842cf5da10579edbdc7b2b23843e6a0de6ebac1b4e07a4f4e035e6b57f043
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaNr:Lz071uv4BPMkFfdg6NsNtJViSOJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfGwOmA.exe

Path C:\Windows\System\dfGwOmA.exe
Size 1.6MB
SHA256 6640d72f9161908a771f64f98c737e7827441798b0a2f5c2d35a0ab56cb1e3cd
MD5 80f23c682f81e8e54646a4ec718e0a8d
SHA1 c63efc4aba4cd872427fec3675c82d143da91974
SHA512 4726c7582c4d7867636e742e6a6d6404559db3ee5400fcd95052195f6d4ee4e1612259403cbd18cae6accfa92addc26e8eb76a8366dc1f69072f8a4cce15ef1b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jau:Lz071uv4BPMkFfdg6NsNtJViSOu
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvMStoH.exe

Path C:\Windows\System\dvMStoH.exe
Size 1.6MB
SHA256 92e00d4213b675ad623a4b4baf7884c2d38c6b8b035ae5d8a2e88c6f052af9e9
MD5 bf14fa3fc942b2ef294e330387e709b9
SHA1 3c7ae547396bb75729aa64ad73e7cf7b69c7b8dc
SHA512 af9230d9fccd32b629ea187c9df72f2665a6ae721ba1a32d3b3c33e1b9c2c222b8a2b6954a2f6c1a625c95777af3a8dd4b92484d1c59a930b774d08c08881e61
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/ja3:Lz071uv4BPMkFfdg6NsNtJViSO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

eYKYqhH.exe

Path C:\Windows\System\eYKYqhH.exe
Size 1.6MB
SHA256 174849dfd0adf16ea89825170d0087623b10b8d202395f938b011936f63faaa2
MD5 8d29a04b1109b0c9a78f77f0ff869442
SHA1 a44f34e9387dc4c7ea7c2276a9698331d912c896
SHA512 a37e109b62cef5b695c26a6dd1ab1c6296bbb3a44995be692719fdd5a5c6780ce8c75c3937d65f3842861d0275b72ccfc41b9de0325d69ee5c0e91b073150da3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaj:Lz071uv4BPMkFfdg6NsNtJViSOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

exomayS.exe

Path C:\Windows\System\exomayS.exe
Size 1.6MB
SHA256 7066cd4155e2a830a77b4ed697004a0c5622a44217110b6a6777d118e9857cef
MD5 f668c8d94c4efd13a213ea5779a9be44
SHA1 ef1885a38303ab65013cf7837b0f35046e7778fc
SHA512 b59dba8626202c626ebd400310eb22e73644b75eb9454f10b8150caabfc650dc3c955623b5dca218b9bc1392815b0f6385cd1b9c4908a9257dac3172a7ea799b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/ja+:Lz071uv4BPMkFfdg6NsNtJViSO+
MD5 SHA1 SHA512 SSDEEP

Submit Download

fAXqiUS.exe

Path C:\Windows\System\fAXqiUS.exe
Size 1.6MB
SHA256 271cae3f4a1f01450525f05388be20a6f810975f28b2300c1eab866969baf8ef
MD5 de73e026014509b49420a23f4502fae7
SHA1 c512e159bb268381add902097197973b4d4e1983
SHA512 9a4629ed892bd0af80f17001c62514d8ffd872184859760166ceca5bd9184aa364291dc20db684047bf9d4325261c10af4c5ce5508aeb3d630fc7de7c87d51e4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jajK:Lz071uv4BPMkFfdg6NsNtJViSOjK
MD5 SHA1 SHA512 SSDEEP

Submit Download

huBzImC.exe

Path C:\Windows\System\huBzImC.exe
Size 1.6MB
SHA256 bbadb3ee8918a5d9cec84faea8ae2361fdb5bb9becacb699919ebaedd3e2736c
MD5 2fb63c82faf1386da370955df3aba342
SHA1 e0867b9191e4ad2c425fce7a21fd01a2c47f88a2
SHA512 71e4ce4d440250bbe51367a439b1537e4edce60a6a94a5ffb4ea60f37b44b742334eb84719794dedf4641fa796193e793499462ce8b3f0c4ecc4ae5215e4c1f5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jas:Lz071uv4BPMkFfdg6NsNtJViSOs
MD5 SHA1 SHA512 SSDEEP

Submit Download

ldcijzu.exe

Path C:\Windows\System\ldcijzu.exe
Size 1.6MB
SHA256 2d67f0005552bf2d2871152135bc733f56091570c3a2de6993b1aced7cd01050
MD5 a96e674cb9b23750f2e812e00e9121c5
SHA1 0f82f0b4dcb4497b4c960ad1f8c466202db83bc3
SHA512 0314ff6e1691ffc4e9bdfc5e05b8c8d46760d5e5b29645c4acdc5490f2427e18ef456a07431bf5a79461f325cdb43c56904824896a02b195ed1c26178fe41c24
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaG:Lz071uv4BPMkFfdg6NsNtJViSOG
MD5 SHA1 SHA512 SSDEEP

Submit Download

mCMVFRq.exe

Path C:\Windows\System\mCMVFRq.exe
Size 1.6MB
SHA256 52b49a898051f4ef1e0a64044ea34aaf250312c74b9e24c3af02515d782cc36b
MD5 724b272a6dbb32a509c36728e6f42bb0
SHA1 79f3cf213c8d5b905fbf3bb00d361d977e2de0bb
SHA512 81030ad1e6555ac8d1bda5fe8b9383797b2d7a7cb2473b36a1dc08ad6ec1ba061689adc73e4310ea58b38a86937d0a92dc5bcc499cc68df9dd8fa61bf8daf90e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jap2:Lz071uv4BPMkFfdg6NsNtJViSOp2
MD5 SHA1 SHA512 SSDEEP

Submit Download

nfNdAxf.exe

Path C:\Windows\System\nfNdAxf.exe
Size 1.6MB
SHA256 9b6082b26f8cfc5f450a00803f00262f3131d374c8bf9f8ebe6244898e84e506
MD5 34c9c99b33c9302e6e0a06b23f876374
SHA1 685715dab5631b3fa970518a46c6d2dc5bdb69f1
SHA512 ab8574da2a864ba8aa9758fdf778d2c2ae8e27479e931495f3a18b76239348962f340b21bef75845d055810a87cd298ca7e8c0bb2d3e9d9c7e9586ea3f40e3fd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaq:Lz071uv4BPMkFfdg6NsNtJViSOq
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdLyRtq.exe

Path C:\Windows\System\pdLyRtq.exe
Size 1.6MB
SHA256 9415f5b62fab5fe287217355a109b577ab388ffb150042f4d5ab1848d2f1d821
MD5 323d4e2f7095de72743f1559632692f9
SHA1 6a3684aaaff8a6131a369390ba27a10f8c330df1
SHA512 ea5f72895ebb15dca9f4f21604b0ea1c5b355da3766b08caa142587d9df6f01bd336b4e07e7ec2b3bf7c5a1f4979cf1e476dc0a064005acb6c2062e47c3a8b43
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaY:Lz071uv4BPMkFfdg6NsNtJViSOY
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhbUjCZ.exe

Path C:\Windows\System\rhbUjCZ.exe
Size 1.6MB
SHA256 3e2b4a38816f92e5d9f11c114c0b325a2cc9e4df241fbfa61476ffa3498f7061
MD5 f73463ca3858091b939388d5fa156d8f
SHA1 0a20647c1f8db5162543da962fd2554f2b259037
SHA512 e5e09c99aa01d00d317d6aa08e14544ca9ad7d17a342afb22267b4bd7093afb1b79cdd2177675cfc8ad9f9e82f2018a3d5f7ba272d651a57d6fed3965a2ed722
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jam:Lz071uv4BPMkFfdg6NsNtJViSOm
MD5 SHA1 SHA512 SSDEEP

Submit Download

tJxjlhw.exe

Path C:\Windows\System\tJxjlhw.exe
Size 1.6MB
SHA256 6b9d4dbbffa087fdf1cfd7ff7dad9e8a5219eb5646b745bb06494f29cf5a811a
MD5 4f4112b57bbfafc9333adc461ca27a9f
SHA1 fdd06fe54b2a18f70a81a1e57b9aba6a14791874
SHA512 3dcdb3e9420c476fcae537ddb3efb4a1467897af0b3e5703d99ec99d74a9b4933553ed12c5fad7c1179cf8a7ecffa0eeb360f69b1da418e117a2f8245fefaed2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/ja/:Lz071uv4BPMkFfdg6NsNtJViSO/
MD5 SHA1 SHA512 SSDEEP

Submit Download

tPeMumq.exe

Path C:\Windows\System\tPeMumq.exe
Size 1.6MB
SHA256 0ed33d11483452579a4e10b672d61e2ea80fbe2060931f609a0fe88ec1254ef3
MD5 2be77bf9586ac640b44868ee2f0ace37
SHA1 494defc10afa91fed96a6a84cd46de14fe3662a9
SHA512 a9082e8d17d0ef95e465e369b0d8b656ffa2a8026c7eccba481fda480fadd86082019682c94f615e561fd72ab5af548d9536cbe2136f45e567b9271972823cb3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jah:Lz071uv4BPMkFfdg6NsNtJViSOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

tZnxvkn.exe

Path C:\Windows\System\tZnxvkn.exe
Size 1.6MB
SHA256 b0c69bd0457da22a8a1518e89972ad94d2bf3f1959e76e97e62122cc55012030
MD5 e85c2a6dbfd6e6f2eb50d6179d2eea7c
SHA1 75f770157fa1f27c5648483f300ce7c57d6e8bb5
SHA512 95bd491887fbf0da698b5302e1e63334085963f0146794dd1a483122999c99c4ce46495df3c1f05e95891f36619fe19b535d8788e01efb788426a8f7aafa2762
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/ja2:Lz071uv4BPMkFfdg6NsNtJViSO2
MD5 SHA1 SHA512 SSDEEP

Submit Download

wCbUewx.exe

Path C:\Windows\System\wCbUewx.exe
Size 1.6MB
SHA256 302f4eed31f7a243a57c574c24ad3618dae9f46db2c492f0a850c26953e0e19d
MD5 8daad5d607403491ed49249d5ff257e4
SHA1 193bab095cb9c7cd1d41158585fa79e1165f88a8
SHA512 def4e4fce743c32bca80a821c5d0a0e0da36355fc1eb52474acf68cd77439ebd641cd9b6c950fb8b9c574f94ca80149d1641289fa8efffdd0414ceed5bd55161
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDi9S3/jaV:Lz071uv4BPMkFfdg6NsNtJViSOV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-2737-0x00007FF6A9530000-0x00007FF6A9922000-memory.dmp

Download

memory/412-132-0x00007FF6A9530000-0x00007FF6A9922000-memory.dmp

Download

memory/1152-44-0x00007FF6D32E0000-0x00007FF6D36D2000-memory.dmp

Download

memory/1152-2734-0x00007FF6D32E0000-0x00007FF6D36D2000-memory.dmp

Download

memory/1228-2764-0x00007FF74E210000-0x00007FF74E602000-memory.dmp

Download

memory/1228-653-0x00007FF74E210000-0x00007FF74E602000-memory.dmp

Download

memory/1300-645-0x00007FF7802E0000-0x00007FF7806D2000-memory.dmp

Download

memory/1300-2765-0x00007FF7802E0000-0x00007FF7806D2000-memory.dmp

Download

memory/1368-2755-0x00007FF7E9440000-0x00007FF7E9832000-memory.dmp

Download

memory/1368-454-0x00007FF7E9440000-0x00007FF7E9832000-memory.dmp

Download

memory/1600-646-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp

Download

memory/1600-2781-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp

Download

memory/1688-574-0x00007FF772960000-0x00007FF772D52000-memory.dmp

Download

memory/1688-2756-0x00007FF772960000-0x00007FF772D52000-memory.dmp

Download

memory/1716-2744-0x00007FF69F610000-0x00007FF69FA02000-memory.dmp

Download

memory/1716-651-0x00007FF69F610000-0x00007FF69FA02000-memory.dmp

Download

memory/1728-652-0x00007FF763590000-0x00007FF763982000-memory.dmp

Download

memory/1728-2748-0x00007FF763590000-0x00007FF763982000-memory.dmp

Download

memory/1744-2760-0x00007FF68C1C0000-0x00007FF68C5B2000-memory.dmp

Download

memory/1744-647-0x00007FF68C1C0000-0x00007FF68C5B2000-memory.dmp

Download

memory/1772-641-0x00007FF917AA0000-0x00007FF918561000-memory.dmp

Download

memory/1772-45-0x00007FF917AA3000-0x00007FF917AA5000-memory.dmp

Download

memory/1772-731-0x0000028D7E750000-0x0000028D7E772000-memory.dmp

Download

memory/1772-650-0x00007FF917AA0000-0x00007FF918561000-memory.dmp

Download

memory/1952-1-0x00000220C4AF0000-0x00000220C4B00000-memory.dmp

Download

memory/1952-0-0x00007FF6ED570000-0x00007FF6ED962000-memory.dmp

Download

memory/2044-639-0x00007FF6B3C10000-0x00007FF6B4002000-memory.dmp

Download

memory/2044-2780-0x00007FF6B3C10000-0x00007FF6B4002000-memory.dmp

Download

memory/2232-644-0x00007FF66DC30000-0x00007FF66E022000-memory.dmp

Download

memory/2232-2772-0x00007FF66DC30000-0x00007FF66E022000-memory.dmp

Download

memory/3152-2788-0x00007FF7E9180000-0x00007FF7E9572000-memory.dmp

Download

memory/3152-648-0x00007FF7E9180000-0x00007FF7E9572000-memory.dmp

Download

memory/3168-21-0x00007FF618670000-0x00007FF618A62000-memory.dmp

Download

memory/3168-2731-0x00007FF618670000-0x00007FF618A62000-memory.dmp

Download

memory/3268-649-0x00007FF621D10000-0x00007FF622102000-memory.dmp

Download

memory/3268-2759-0x00007FF621D10000-0x00007FF622102000-memory.dmp

Download

memory/3292-2739-0x00007FF6BE6F0000-0x00007FF6BEAE2000-memory.dmp

Download

memory/3292-182-0x00007FF6BE6F0000-0x00007FF6BEAE2000-memory.dmp

Download

memory/3520-2769-0x00007FF6AABD0000-0x00007FF6AAFC2000-memory.dmp

Download

memory/3520-642-0x00007FF6AABD0000-0x00007FF6AAFC2000-memory.dmp

Download

memory/4216-295-0x00007FF7A5230000-0x00007FF7A5622000-memory.dmp

Download

memory/4216-2741-0x00007FF7A5230000-0x00007FF7A5622000-memory.dmp

Download

memory/4224-2752-0x00007FF7E40F0000-0x00007FF7E44E2000-memory.dmp

Download

memory/4224-363-0x00007FF7E40F0000-0x00007FF7E44E2000-memory.dmp

Download

memory/4228-84-0x00007FF61F100000-0x00007FF61F4F2000-memory.dmp

Download

memory/4228-2735-0x00007FF61F100000-0x00007FF61F4F2000-memory.dmp

Download

memory/4380-51-0x00007FF7FEF00000-0x00007FF7FF2F2000-memory.dmp

Download

memory/4380-2746-0x00007FF7FEF00000-0x00007FF7FF2F2000-memory.dmp

Download

memory/4728-298-0x00007FF6D7DD0000-0x00007FF6D81C2000-memory.dmp

Download

memory/4728-2773-0x00007FF6D7DD0000-0x00007FF6D81C2000-memory.dmp

Download

memory/5068-2784-0x00007FF68B960000-0x00007FF68BD52000-memory.dmp

Download

memory/5068-643-0x00007FF68B960000-0x00007FF68BD52000-memory.dmp

Download

memory/5116-247-0x00007FF7E0700000-0x00007FF7E0AF2000-memory.dmp

Download

memory/5116-2749-0x00007FF7E0700000-0x00007FF7E0AF2000-memory.dmp

Download