xmrig | aabfdd5a7a0ca3c821ebdbe0c6eb7eeb1ea22e5c8b57a80b10489d14979b3e6e

Analysis

max time kernel
47s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
Size

1.6MB
MD5

aaeb8a13c7cc58cb6b55919f6b035ac0
SHA1

b6b1a6859610ddf8355e8c45ecb593b33bf0351e
SHA256

aabfdd5a7a0ca3c821ebdbe0c6eb7eeb1ea22e5c8b57a80b10489d14979b3e6e
SHA512

dc044b99515850db1a283afaeb93b3fb3e1d4f0a29dbed3ea98757ce2136b281849d869c6ecac759b138377d01b3eff425af97cc73c3519a22483ed3bcd3de5d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupQF4g6FNGzM2XNJSX:Lz071uv4BPMki8CnfZFZzMuNEX

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/3908-61-0x00007FF68EE60000-0x00007FF68F252000-memory.dmp	xmrig
behavioral2/memory/4180-67-0x00007FF79E5F0000-0x00007FF79E9E2000-memory.dmp	xmrig
behavioral2/memory/4504-74-0x00007FF638180000-0x00007FF638572000-memory.dmp	xmrig
behavioral2/memory/5052-73-0x00007FF6B0770000-0x00007FF6B0B62000-memory.dmp	xmrig
behavioral2/memory/3192-81-0x00007FF6EABC0000-0x00007FF6EAFB2000-memory.dmp	xmrig
behavioral2/memory/840-78-0x00007FF69C070000-0x00007FF69C462000-memory.dmp	xmrig
behavioral2/memory/5036-267-0x00007FF7A09C0000-0x00007FF7A0DB2000-memory.dmp	xmrig
behavioral2/memory/4692-289-0x00007FF69F2F0000-0x00007FF69F6E2000-memory.dmp	xmrig
behavioral2/memory/3528-295-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp	xmrig
behavioral2/memory/2940-269-0x00007FF663FB0000-0x00007FF6643A2000-memory.dmp	xmrig
behavioral2/memory/512-307-0x00007FF77B8B0000-0x00007FF77BCA2000-memory.dmp	xmrig
behavioral2/memory/2032-310-0x00007FF6FE300000-0x00007FF6FE6F2000-memory.dmp	xmrig
behavioral2/memory/1608-268-0x00007FF72F390000-0x00007FF72F782000-memory.dmp	xmrig
behavioral2/memory/3992-326-0x00007FF78FE10000-0x00007FF790202000-memory.dmp	xmrig
behavioral2/memory/3448-329-0x00007FF7A41F0000-0x00007FF7A45E2000-memory.dmp	xmrig
behavioral2/memory/4024-337-0x00007FF6BDD50000-0x00007FF6BE142000-memory.dmp	xmrig
behavioral2/memory/3956-341-0x00007FF6D3170000-0x00007FF6D3562000-memory.dmp	xmrig
behavioral2/memory/4944-347-0x00007FF6EE830000-0x00007FF6EEC22000-memory.dmp	xmrig
behavioral2/memory/2676-349-0x00007FF6E7CE0000-0x00007FF6E80D2000-memory.dmp	xmrig
behavioral2/memory/2564-352-0x00007FF77A2A0000-0x00007FF77A692000-memory.dmp	xmrig
behavioral2/memory/3636-340-0x00007FF60A5A0000-0x00007FF60A992000-memory.dmp	xmrig
behavioral2/memory/3640-335-0x00007FF767E10000-0x00007FF768202000-memory.dmp	xmrig
behavioral2/memory/2080-332-0x00007FF638CD0000-0x00007FF6390C2000-memory.dmp	xmrig
behavioral2/memory/3152-320-0x00007FF6E0950000-0x00007FF6E0D42000-memory.dmp	xmrig
behavioral2/memory/1428-314-0x00007FF637990000-0x00007FF637D82000-memory.dmp	xmrig
behavioral2/memory/1396-311-0x00007FF7323C0000-0x00007FF7327B2000-memory.dmp	xmrig
behavioral2/memory/4180-1635-0x00007FF79E5F0000-0x00007FF79E9E2000-memory.dmp	xmrig
behavioral2/memory/4944-1745-0x00007FF6EE830000-0x00007FF6EEC22000-memory.dmp	xmrig
behavioral2/memory/2676-1960-0x00007FF6E7CE0000-0x00007FF6E80D2000-memory.dmp	xmrig
behavioral2/memory/2032-2081-0x00007FF6FE300000-0x00007FF6FE6F2000-memory.dmp	xmrig
behavioral2/memory/1396-2115-0x00007FF7323C0000-0x00007FF7327B2000-memory.dmp	xmrig
behavioral2/memory/3636-2126-0x00007FF60A5A0000-0x00007FF60A992000-memory.dmp	xmrig
behavioral2/memory/2080-2125-0x00007FF638CD0000-0x00007FF6390C2000-memory.dmp	xmrig
behavioral2/memory/2564-2124-0x00007FF77A2A0000-0x00007FF77A692000-memory.dmp	xmrig
behavioral2/memory/3956-2123-0x00007FF6D3170000-0x00007FF6D3562000-memory.dmp	xmrig
behavioral2/memory/512-2122-0x00007FF77B8B0000-0x00007FF77BCA2000-memory.dmp	xmrig
behavioral2/memory/4024-2121-0x00007FF6BDD50000-0x00007FF6BE142000-memory.dmp	xmrig
behavioral2/memory/1428-2120-0x00007FF637990000-0x00007FF637D82000-memory.dmp	xmrig
behavioral2/memory/3640-2119-0x00007FF767E10000-0x00007FF768202000-memory.dmp	xmrig
behavioral2/memory/3992-2118-0x00007FF78FE10000-0x00007FF790202000-memory.dmp	xmrig
behavioral2/memory/3448-2117-0x00007FF7A41F0000-0x00007FF7A45E2000-memory.dmp	xmrig
behavioral2/memory/3152-2116-0x00007FF6E0950000-0x00007FF6E0D42000-memory.dmp	xmrig
behavioral2/memory/4692-1803-0x00007FF69F2F0000-0x00007FF69F6E2000-memory.dmp	xmrig
behavioral2/memory/5036-1792-0x00007FF7A09C0000-0x00007FF7A0DB2000-memory.dmp	xmrig
behavioral2/memory/840-1675-0x00007FF69C070000-0x00007FF69C462000-memory.dmp	xmrig
behavioral2/memory/3192-1666-0x00007FF6EABC0000-0x00007FF6EAFB2000-memory.dmp	xmrig
behavioral2/memory/3528-1691-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp	xmrig
behavioral2/memory/5052-1629-0x00007FF6B0770000-0x00007FF6B0B62000-memory.dmp	xmrig
behavioral2/memory/3908-1568-0x00007FF68EE60000-0x00007FF68F252000-memory.dmp	xmrig
behavioral2/memory/2940-1538-0x00007FF663FB0000-0x00007FF6643A2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	416	powershell.exe
11	416	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
416	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2940	EVxRIME.exe
3908	poqGiVm.exe
4180	aGmnQRg.exe
5052	QvNGoze.exe
840	WBQPToR.exe
3192	hBryxSk.exe
5036	ATPAXUa.exe
4692	aGIKBVT.exe
3528	YMJVtqi.exe
4944	LQcuSzh.exe
2676	iLZCdvX.exe
512	PVUxjej.exe
2564	QOurlss.exe
2032	YDlCFqE.exe
1396	wwtQqFu.exe
1428	ZeEZzSN.exe
3152	KMKEVtc.exe
3992	pVYPiwg.exe
3448	DYOJdEB.exe
2080	TuTIdGE.exe
3640	NgDUdiv.exe
4024	NvdlkAu.exe
3636	XhCAzyN.exe
3956	JdjnEKQ.exe
4048	SwpCWMi.exe
3028	HzMylCL.exe
4696	zCaTlIH.exe
4408	UaFILaw.exe
4344	JOAHEYl.exe
4744	JUZEXcA.exe
4452	ZRDHsjs.exe
1060	sTAmIpI.exe
3204	SRNypDh.exe
2480	lYFULep.exe
2756	jKaeorg.exe
508	LxXQgVY.exe
1928	Vvxtwyi.exe
2652	fRleFSr.exe
4676	alGjgDY.exe
4960	HviHmtv.exe
3200	gujqgpR.exe
4828	wFVphVB.exe
1068	yKbeqxg.exe
2300	KTocqDK.exe
4636	CZmtyFe.exe
3780	iwPGnFv.exe
1608	WKYaiWA.exe
4712	vMRJZXG.exe
4324	HbQTQPc.exe
1012	vZcmWFl.exe
4860	TMFmfEU.exe
3088	iPUhccs.exe
4588	zYDLosJ.exe
3208	TVxrSSb.exe
384	ztJpodw.exe
1768	ISgWtWu.exe
3116	WDKRKxg.exe
5012	iyEgVrl.exe
4256	tymPmJX.exe
740	WFcIQVu.exe
2468	JFBHBNB.exe
5072	tUbPWXv.exe
1032	EjFqrBi.exe
4424	HQITJYV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4504-0-0x00007FF638180000-0x00007FF638572000-memory.dmp	upx
behavioral2/files/0x000900000002326d-6.dat	upx
behavioral2/files/0x0008000000023271-11.dat	upx
behavioral2/files/0x0007000000023275-13.dat	upx
behavioral2/files/0x0009000000023273-30.dat	upx
behavioral2/files/0x0008000000023274-35.dat	upx
behavioral2/files/0x0007000000023276-41.dat	upx
behavioral2/files/0x0007000000023277-46.dat	upx
behavioral2/files/0x0007000000023278-51.dat	upx
behavioral2/files/0x0007000000023279-57.dat	upx
behavioral2/files/0x000700000002327a-64.dat	upx
behavioral2/memory/3908-61-0x00007FF68EE60000-0x00007FF68F252000-memory.dmp	upx
behavioral2/files/0x000700000002327b-70.dat	upx
behavioral2/memory/4180-67-0x00007FF79E5F0000-0x00007FF79E9E2000-memory.dmp	upx
behavioral2/memory/4504-74-0x00007FF638180000-0x00007FF638572000-memory.dmp	upx
behavioral2/memory/5052-73-0x00007FF6B0770000-0x00007FF6B0B62000-memory.dmp	upx
behavioral2/files/0x000700000002327c-77.dat	upx
behavioral2/memory/3192-81-0x00007FF6EABC0000-0x00007FF6EAFB2000-memory.dmp	upx
behavioral2/memory/840-78-0x00007FF69C070000-0x00007FF69C462000-memory.dmp	upx
behavioral2/files/0x000700000002327d-85.dat	upx
behavioral2/files/0x000700000002327e-90.dat	upx
behavioral2/files/0x000700000002327f-95.dat	upx
behavioral2/files/0x0007000000023280-100.dat	upx
behavioral2/files/0x0007000000023281-105.dat	upx
behavioral2/files/0x0007000000023282-109.dat	upx
behavioral2/files/0x0007000000023285-124.dat	upx
behavioral2/files/0x0007000000023287-139.dat	upx
behavioral2/files/0x0007000000023288-143.dat	upx
behavioral2/files/0x0007000000023289-149.dat	upx
behavioral2/files/0x000700000002328b-155.dat	upx
behavioral2/files/0x000700000002328c-161.dat	upx
behavioral2/files/0x000700000002328d-166.dat	upx
behavioral2/files/0x0007000000023290-180.dat	upx
behavioral2/files/0x0007000000023291-183.dat	upx
behavioral2/files/0x000700000002328f-176.dat	upx
behavioral2/memory/5036-267-0x00007FF7A09C0000-0x00007FF7A0DB2000-memory.dmp	upx
behavioral2/memory/4692-289-0x00007FF69F2F0000-0x00007FF69F6E2000-memory.dmp	upx
behavioral2/memory/3528-295-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp	upx
behavioral2/memory/2940-269-0x00007FF663FB0000-0x00007FF6643A2000-memory.dmp	upx
behavioral2/memory/512-307-0x00007FF77B8B0000-0x00007FF77BCA2000-memory.dmp	upx
behavioral2/memory/2032-310-0x00007FF6FE300000-0x00007FF6FE6F2000-memory.dmp	upx
behavioral2/memory/1608-268-0x00007FF72F390000-0x00007FF72F782000-memory.dmp	upx
behavioral2/memory/3992-326-0x00007FF78FE10000-0x00007FF790202000-memory.dmp	upx
behavioral2/memory/3448-329-0x00007FF7A41F0000-0x00007FF7A45E2000-memory.dmp	upx
behavioral2/memory/4024-337-0x00007FF6BDD50000-0x00007FF6BE142000-memory.dmp	upx
behavioral2/memory/3956-341-0x00007FF6D3170000-0x00007FF6D3562000-memory.dmp	upx
behavioral2/memory/4944-347-0x00007FF6EE830000-0x00007FF6EEC22000-memory.dmp	upx
behavioral2/memory/2676-349-0x00007FF6E7CE0000-0x00007FF6E80D2000-memory.dmp	upx
behavioral2/memory/2564-352-0x00007FF77A2A0000-0x00007FF77A692000-memory.dmp	upx
behavioral2/memory/3636-340-0x00007FF60A5A0000-0x00007FF60A992000-memory.dmp	upx
behavioral2/memory/3640-335-0x00007FF767E10000-0x00007FF768202000-memory.dmp	upx
behavioral2/memory/2080-332-0x00007FF638CD0000-0x00007FF6390C2000-memory.dmp	upx
behavioral2/memory/3152-320-0x00007FF6E0950000-0x00007FF6E0D42000-memory.dmp	upx
behavioral2/memory/1428-314-0x00007FF637990000-0x00007FF637D82000-memory.dmp	upx
behavioral2/memory/1396-311-0x00007FF7323C0000-0x00007FF7327B2000-memory.dmp	upx
behavioral2/files/0x000700000002328e-171.dat	upx
behavioral2/files/0x000700000002328a-151.dat	upx
behavioral2/files/0x0007000000023286-134.dat	upx
behavioral2/files/0x0007000000023284-122.dat	upx
behavioral2/files/0x0007000000023283-118.dat	upx
behavioral2/memory/4180-1635-0x00007FF79E5F0000-0x00007FF79E9E2000-memory.dmp	upx
behavioral2/memory/4944-1745-0x00007FF6EE830000-0x00007FF6EEC22000-memory.dmp	upx
behavioral2/memory/2676-1960-0x00007FF6E7CE0000-0x00007FF6E80D2000-memory.dmp	upx
behavioral2/memory/2032-2081-0x00007FF6FE300000-0x00007FF6FE6F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rXJayBQ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\kwqfnjg.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\yysAxby.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\RDYnaDS.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\XuqeIOE.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\zCaTlIH.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ISgWtWu.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\rHcPanU.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\NbYXUGZ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\Zhyksou.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\gfOxJMW.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ahqOSoL.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\VRvDKWr.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\FOyioiF.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\kTulIpm.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\vMRJZXG.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\JYTXxAD.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\giWinWt.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\zYDLosJ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\nDtjJDn.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\PmvLVQA.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\dznhphx.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\RQfPqrn.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\EVxRIME.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\YMJVtqi.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\HzMylCL.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\AjLajGz.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\YfVOSyj.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\XWeAGfP.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\ovLEYnr.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\fdGRHOU.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\uOiNPOe.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\iaZvRIJ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\vcQXoxn.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\SRNypDh.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\CZmtyFe.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\lhJCJpy.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\CdICiAX.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\qkAnSPe.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\VsKlGfu.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\DYOJdEB.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\UBNmwfL.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\bTJriBd.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\NAqTfxd.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\RfSgOMA.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\trtPUwe.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\OCbMcHd.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\jKwsoql.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\QvNGoze.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\fRleFSr.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\yKbeqxg.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\HdyCMZs.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\itwUIlZ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\RabUteq.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\QQQqzXp.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\TuTIdGE.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\alGjgDY.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\guBfkjG.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\JdjnEKQ.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\iwPGnFv.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\zpRcMLS.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\oXcpCnF.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\hEZNisR.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
File created	C:\Windows\System\WBQPToR.exe	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
416	powershell.exe
416	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
Token: SeDebugPrivilege	416	powershell.exe
Token: SeLockMemoryPrivilege	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 416	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	93
PID 4504 wrote to memory of 416	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	93
PID 4504 wrote to memory of 2940	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	94
PID 4504 wrote to memory of 2940	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	94
PID 4504 wrote to memory of 3908	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	95
PID 4504 wrote to memory of 3908	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	95
PID 4504 wrote to memory of 4180	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	96
PID 4504 wrote to memory of 4180	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	96
PID 4504 wrote to memory of 5052	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	97
PID 4504 wrote to memory of 5052	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	97
PID 4504 wrote to memory of 840	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	98
PID 4504 wrote to memory of 840	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	98
PID 4504 wrote to memory of 3192	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	99
PID 4504 wrote to memory of 3192	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	99
PID 4504 wrote to memory of 5036	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	100
PID 4504 wrote to memory of 5036	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	100
PID 4504 wrote to memory of 4692	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	101
PID 4504 wrote to memory of 4692	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	101
PID 4504 wrote to memory of 3528	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	102
PID 4504 wrote to memory of 3528	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	102
PID 4504 wrote to memory of 4944	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	103
PID 4504 wrote to memory of 4944	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	103
PID 4504 wrote to memory of 2676	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	104
PID 4504 wrote to memory of 2676	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	104
PID 4504 wrote to memory of 512	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	105
PID 4504 wrote to memory of 512	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	105
PID 4504 wrote to memory of 2564	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	106
PID 4504 wrote to memory of 2564	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	106
PID 4504 wrote to memory of 2032	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	107
PID 4504 wrote to memory of 2032	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	107
PID 4504 wrote to memory of 1396	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	108
PID 4504 wrote to memory of 1396	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	108
PID 4504 wrote to memory of 1428	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	109
PID 4504 wrote to memory of 1428	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	109
PID 4504 wrote to memory of 3152	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	110
PID 4504 wrote to memory of 3152	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	110
PID 4504 wrote to memory of 3992	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	111
PID 4504 wrote to memory of 3992	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	111
PID 4504 wrote to memory of 3448	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	112
PID 4504 wrote to memory of 3448	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	112
PID 4504 wrote to memory of 2080	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	113
PID 4504 wrote to memory of 2080	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	113
PID 4504 wrote to memory of 3640	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	114
PID 4504 wrote to memory of 3640	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	114
PID 4504 wrote to memory of 4024	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	115
PID 4504 wrote to memory of 4024	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	115
PID 4504 wrote to memory of 3636	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	116
PID 4504 wrote to memory of 3636	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	116
PID 4504 wrote to memory of 3956	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	117
PID 4504 wrote to memory of 3956	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	117
PID 4504 wrote to memory of 4048	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	118
PID 4504 wrote to memory of 4048	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	118
PID 4504 wrote to memory of 3028	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	119
PID 4504 wrote to memory of 3028	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	119
PID 4504 wrote to memory of 4696	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	120
PID 4504 wrote to memory of 4696	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	120
PID 4504 wrote to memory of 4408	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	121
PID 4504 wrote to memory of 4408	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	121
PID 4504 wrote to memory of 4344	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	122
PID 4504 wrote to memory of 4344	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	122
PID 4504 wrote to memory of 4744	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	123
PID 4504 wrote to memory of 4744	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	123
PID 4504 wrote to memory of 4452	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	124
PID 4504 wrote to memory of 4452	4504	aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aaeb8a13c7cc58cb6b55919f6b035ac0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:416
- C:\Windows\System\EVxRIME.exe
  C:\Windows\System\EVxRIME.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\poqGiVm.exe
  C:\Windows\System\poqGiVm.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\aGmnQRg.exe
  C:\Windows\System\aGmnQRg.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\QvNGoze.exe
  C:\Windows\System\QvNGoze.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\WBQPToR.exe
  C:\Windows\System\WBQPToR.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\hBryxSk.exe
  C:\Windows\System\hBryxSk.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\ATPAXUa.exe
  C:\Windows\System\ATPAXUa.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\aGIKBVT.exe
  C:\Windows\System\aGIKBVT.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\YMJVtqi.exe
  C:\Windows\System\YMJVtqi.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\LQcuSzh.exe
  C:\Windows\System\LQcuSzh.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\iLZCdvX.exe
  C:\Windows\System\iLZCdvX.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\PVUxjej.exe
  C:\Windows\System\PVUxjej.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\QOurlss.exe
  C:\Windows\System\QOurlss.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\YDlCFqE.exe
  C:\Windows\System\YDlCFqE.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\wwtQqFu.exe
  C:\Windows\System\wwtQqFu.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\ZeEZzSN.exe
  C:\Windows\System\ZeEZzSN.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\KMKEVtc.exe
  C:\Windows\System\KMKEVtc.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\pVYPiwg.exe
  C:\Windows\System\pVYPiwg.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\DYOJdEB.exe
  C:\Windows\System\DYOJdEB.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\TuTIdGE.exe
  C:\Windows\System\TuTIdGE.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\NgDUdiv.exe
  C:\Windows\System\NgDUdiv.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\NvdlkAu.exe
  C:\Windows\System\NvdlkAu.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\XhCAzyN.exe
  C:\Windows\System\XhCAzyN.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\JdjnEKQ.exe
  C:\Windows\System\JdjnEKQ.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\SwpCWMi.exe
  C:\Windows\System\SwpCWMi.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\HzMylCL.exe
  C:\Windows\System\HzMylCL.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\zCaTlIH.exe
  C:\Windows\System\zCaTlIH.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\UaFILaw.exe
  C:\Windows\System\UaFILaw.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\JOAHEYl.exe
  C:\Windows\System\JOAHEYl.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\JUZEXcA.exe
  C:\Windows\System\JUZEXcA.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\ZRDHsjs.exe
  C:\Windows\System\ZRDHsjs.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\sTAmIpI.exe
  C:\Windows\System\sTAmIpI.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\SRNypDh.exe
  C:\Windows\System\SRNypDh.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\lYFULep.exe
  C:\Windows\System\lYFULep.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\jKaeorg.exe
  C:\Windows\System\jKaeorg.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\LxXQgVY.exe
  C:\Windows\System\LxXQgVY.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\Vvxtwyi.exe
  C:\Windows\System\Vvxtwyi.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\fRleFSr.exe
  C:\Windows\System\fRleFSr.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\alGjgDY.exe
  C:\Windows\System\alGjgDY.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\HviHmtv.exe
  C:\Windows\System\HviHmtv.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\gujqgpR.exe
  C:\Windows\System\gujqgpR.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\wFVphVB.exe
  C:\Windows\System\wFVphVB.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\yKbeqxg.exe
  C:\Windows\System\yKbeqxg.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\KTocqDK.exe
  C:\Windows\System\KTocqDK.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\CZmtyFe.exe
  C:\Windows\System\CZmtyFe.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\iwPGnFv.exe
  C:\Windows\System\iwPGnFv.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\WKYaiWA.exe
  C:\Windows\System\WKYaiWA.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\vMRJZXG.exe
  C:\Windows\System\vMRJZXG.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\HbQTQPc.exe
  C:\Windows\System\HbQTQPc.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\vZcmWFl.exe
  C:\Windows\System\vZcmWFl.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\TMFmfEU.exe
  C:\Windows\System\TMFmfEU.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\iPUhccs.exe
  C:\Windows\System\iPUhccs.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\zYDLosJ.exe
  C:\Windows\System\zYDLosJ.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\TVxrSSb.exe
  C:\Windows\System\TVxrSSb.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\ztJpodw.exe
  C:\Windows\System\ztJpodw.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\ISgWtWu.exe
  C:\Windows\System\ISgWtWu.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\WDKRKxg.exe
  C:\Windows\System\WDKRKxg.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\iyEgVrl.exe
  C:\Windows\System\iyEgVrl.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\tymPmJX.exe
  C:\Windows\System\tymPmJX.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\WFcIQVu.exe
  C:\Windows\System\WFcIQVu.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\JFBHBNB.exe
  C:\Windows\System\JFBHBNB.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\tUbPWXv.exe
  C:\Windows\System\tUbPWXv.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\HQITJYV.exe
  C:\Windows\System\HQITJYV.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\EjFqrBi.exe
  C:\Windows\System\EjFqrBi.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\XKyoXxT.exe
  C:\Windows\System\XKyoXxT.exe
  2⤵
  PID:1984
- C:\Windows\System\lhJCJpy.exe
  C:\Windows\System\lhJCJpy.exe
  2⤵
  PID:2116
- C:\Windows\System\VZvpScK.exe
  C:\Windows\System\VZvpScK.exe
  2⤵
  PID:3920
- C:\Windows\System\RLejNPb.exe
  C:\Windows\System\RLejNPb.exe
  2⤵
  PID:992
- C:\Windows\System\vDiOFSE.exe
  C:\Windows\System\vDiOFSE.exe
  2⤵
  PID:3952
- C:\Windows\System\GRgTCIn.exe
  C:\Windows\System\GRgTCIn.exe
  2⤵
  PID:5172
- C:\Windows\System\fiQiTNP.exe
  C:\Windows\System\fiQiTNP.exe
  2⤵
  PID:5192
- C:\Windows\System\jycSVYf.exe
  C:\Windows\System\jycSVYf.exe
  2⤵
  PID:5212
- C:\Windows\System\puzaPxD.exe
  C:\Windows\System\puzaPxD.exe
  2⤵
  PID:5248
- C:\Windows\System\yvpoCOv.exe
  C:\Windows\System\yvpoCOv.exe
  2⤵
  PID:5272
- C:\Windows\System\eHmhuEJ.exe
  C:\Windows\System\eHmhuEJ.exe
  2⤵
  PID:5312
- C:\Windows\System\zpRcMLS.exe
  C:\Windows\System\zpRcMLS.exe
  2⤵
  PID:5376
- C:\Windows\System\JYTXxAD.exe
  C:\Windows\System\JYTXxAD.exe
  2⤵
  PID:5412
- C:\Windows\System\JDfUnZo.exe
  C:\Windows\System\JDfUnZo.exe
  2⤵
  PID:5432
- C:\Windows\System\WOOXwtn.exe
  C:\Windows\System\WOOXwtn.exe
  2⤵
  PID:5472
- C:\Windows\System\hCtdcmv.exe
  C:\Windows\System\hCtdcmv.exe
  2⤵
  PID:5504
- C:\Windows\System\GYFFpny.exe
  C:\Windows\System\GYFFpny.exe
  2⤵
  PID:5580
- C:\Windows\System\ijhTSOC.exe
  C:\Windows\System\ijhTSOC.exe
  2⤵
  PID:5596
- C:\Windows\System\hOYpTIE.exe
  C:\Windows\System\hOYpTIE.exe
  2⤵
  PID:5620
- C:\Windows\System\PCkJosk.exe
  C:\Windows\System\PCkJosk.exe
  2⤵
  PID:5660
- C:\Windows\System\SBquEyd.exe
  C:\Windows\System\SBquEyd.exe
  2⤵
  PID:5680
- C:\Windows\System\XdQkOSw.exe
  C:\Windows\System\XdQkOSw.exe
  2⤵
  PID:5700
- C:\Windows\System\gfOxJMW.exe
  C:\Windows\System\gfOxJMW.exe
  2⤵
  PID:5724
- C:\Windows\System\HKdhWgv.exe
  C:\Windows\System\HKdhWgv.exe
  2⤵
  PID:5752
- C:\Windows\System\kNifRZi.exe
  C:\Windows\System\kNifRZi.exe
  2⤵
  PID:5780
- C:\Windows\System\UzQBkEg.exe
  C:\Windows\System\UzQBkEg.exe
  2⤵
  PID:5832
- C:\Windows\System\FUOkEVJ.exe
  C:\Windows\System\FUOkEVJ.exe
  2⤵
  PID:5868
- C:\Windows\System\NBcWKsD.exe
  C:\Windows\System\NBcWKsD.exe
  2⤵
  PID:5884
- C:\Windows\System\jZGgxDi.exe
  C:\Windows\System\jZGgxDi.exe
  2⤵
  PID:5932
- C:\Windows\System\DbOisNL.exe
  C:\Windows\System\DbOisNL.exe
  2⤵
  PID:5956
- C:\Windows\System\UNJlGso.exe
  C:\Windows\System\UNJlGso.exe
  2⤵
  PID:5988
- C:\Windows\System\IeqyuPA.exe
  C:\Windows\System\IeqyuPA.exe
  2⤵
  PID:6020
- C:\Windows\System\xdbvcvP.exe
  C:\Windows\System\xdbvcvP.exe
  2⤵
  PID:6036
- C:\Windows\System\NAqTfxd.exe
  C:\Windows\System\NAqTfxd.exe
  2⤵
  PID:6076
- C:\Windows\System\DQlfoyi.exe
  C:\Windows\System\DQlfoyi.exe
  2⤵
  PID:6120
- C:\Windows\System\nDtjJDn.exe
  C:\Windows\System\nDtjJDn.exe
  2⤵
  PID:3500
- C:\Windows\System\FCgyVDA.exe
  C:\Windows\System\FCgyVDA.exe
  2⤵
  PID:1820
- C:\Windows\System\oXcpCnF.exe
  C:\Windows\System\oXcpCnF.exe
  2⤵
  PID:5184
- C:\Windows\System\uUmVqdu.exe
  C:\Windows\System\uUmVqdu.exe
  2⤵
  PID:5224
- C:\Windows\System\gTNrboL.exe
  C:\Windows\System\gTNrboL.exe
  2⤵
  PID:5244
- C:\Windows\System\GBlMoNE.exe
  C:\Windows\System\GBlMoNE.exe
  2⤵
  PID:2272
- C:\Windows\System\FFeUxqc.exe
  C:\Windows\System\FFeUxqc.exe
  2⤵
  PID:5368
- C:\Windows\System\sDQTOov.exe
  C:\Windows\System\sDQTOov.exe
  2⤵
  PID:5488
- C:\Windows\System\vwYstlX.exe
  C:\Windows\System\vwYstlX.exe
  2⤵
  PID:5532
- C:\Windows\System\fihYIBV.exe
  C:\Windows\System\fihYIBV.exe
  2⤵
  PID:1528
- C:\Windows\System\FgtcRFM.exe
  C:\Windows\System\FgtcRFM.exe
  2⤵
  PID:3356
- C:\Windows\System\vKCTzyI.exe
  C:\Windows\System\vKCTzyI.exe
  2⤵
  PID:5588
- C:\Windows\System\dJTatlu.exe
  C:\Windows\System\dJTatlu.exe
  2⤵
  PID:5628
- C:\Windows\System\iRMuUQU.exe
  C:\Windows\System\iRMuUQU.exe
  2⤵
  PID:5128
- C:\Windows\System\kCkmwrf.exe
  C:\Windows\System\kCkmwrf.exe
  2⤵
  PID:5448
- C:\Windows\System\ahqOSoL.exe
  C:\Windows\System\ahqOSoL.exe
  2⤵
  PID:5736
- C:\Windows\System\tRbMfVM.exe
  C:\Windows\System\tRbMfVM.exe
  2⤵
  PID:5772
- C:\Windows\System\rHcPanU.exe
  C:\Windows\System\rHcPanU.exe
  2⤵
  PID:5848
- C:\Windows\System\VBiEUEr.exe
  C:\Windows\System\VBiEUEr.exe
  2⤵
  PID:5904
- C:\Windows\System\JHVXkAC.exe
  C:\Windows\System\JHVXkAC.exe
  2⤵
  PID:5964
- C:\Windows\System\yqhfUIh.exe
  C:\Windows\System\yqhfUIh.exe
  2⤵
  PID:5564
- C:\Windows\System\FELGYzJ.exe
  C:\Windows\System\FELGYzJ.exe
  2⤵
  PID:6064
- C:\Windows\System\lEZpfXZ.exe
  C:\Windows\System\lEZpfXZ.exe
  2⤵
  PID:6132
- C:\Windows\System\KOzCwtq.exe
  C:\Windows\System\KOzCwtq.exe
  2⤵
  PID:2160
- C:\Windows\System\ZgvHJoy.exe
  C:\Windows\System\ZgvHJoy.exe
  2⤵
  PID:5304
- C:\Windows\System\HeXiQkr.exe
  C:\Windows\System\HeXiQkr.exe
  2⤵
  PID:5460
- C:\Windows\System\tTERldg.exe
  C:\Windows\System\tTERldg.exe
  2⤵
  PID:5516
- C:\Windows\System\RKsXTYc.exe
  C:\Windows\System\RKsXTYc.exe
  2⤵
  PID:5592
- C:\Windows\System\rkssxtL.exe
  C:\Windows\System\rkssxtL.exe
  2⤵
  PID:5672
- C:\Windows\System\WVCYqRE.exe
  C:\Windows\System\WVCYqRE.exe
  2⤵
  PID:5468
- C:\Windows\System\hEZNisR.exe
  C:\Windows\System\hEZNisR.exe
  2⤵
  PID:6140
- C:\Windows\System\RrmlKqY.exe
  C:\Windows\System\RrmlKqY.exe
  2⤵
  PID:5424
- C:\Windows\System\BguIlIc.exe
  C:\Windows\System\BguIlIc.exe
  2⤵
  PID:5200
- C:\Windows\System\RfSgOMA.exe
  C:\Windows\System\RfSgOMA.exe
  2⤵
  PID:5352
- C:\Windows\System\aBckfVY.exe
  C:\Windows\System\aBckfVY.exe
  2⤵
  PID:5880
- C:\Windows\System\BqZtgzV.exe
  C:\Windows\System\BqZtgzV.exe
  2⤵
  PID:6152
- C:\Windows\System\UBNmwfL.exe
  C:\Windows\System\UBNmwfL.exe
  2⤵
  PID:6184
- C:\Windows\System\oxNZJmK.exe
  C:\Windows\System\oxNZJmK.exe
  2⤵
  PID:6224
- C:\Windows\System\WobVdhk.exe
  C:\Windows\System\WobVdhk.exe
  2⤵
  PID:6240
- C:\Windows\System\KGQgiGP.exe
  C:\Windows\System\KGQgiGP.exe
  2⤵
  PID:6292
- C:\Windows\System\JmIsppY.exe
  C:\Windows\System\JmIsppY.exe
  2⤵
  PID:6316
- C:\Windows\System\ykFhgIZ.exe
  C:\Windows\System\ykFhgIZ.exe
  2⤵
  PID:6336
- C:\Windows\System\pfITTeK.exe
  C:\Windows\System\pfITTeK.exe
  2⤵
  PID:6356
- C:\Windows\System\jwCvmUx.exe
  C:\Windows\System\jwCvmUx.exe
  2⤵
  PID:6380
- C:\Windows\System\dwkcAaM.exe
  C:\Windows\System\dwkcAaM.exe
  2⤵
  PID:6408
- C:\Windows\System\NEnXVeC.exe
  C:\Windows\System\NEnXVeC.exe
  2⤵
  PID:6448
- C:\Windows\System\PmvLVQA.exe
  C:\Windows\System\PmvLVQA.exe
  2⤵
  PID:6464
- C:\Windows\System\wCzBTsy.exe
  C:\Windows\System\wCzBTsy.exe
  2⤵
  PID:6484
- C:\Windows\System\trtPUwe.exe
  C:\Windows\System\trtPUwe.exe
  2⤵
  PID:6504
- C:\Windows\System\YcToleL.exe
  C:\Windows\System\YcToleL.exe
  2⤵
  PID:6536
- C:\Windows\System\ovLEYnr.exe
  C:\Windows\System\ovLEYnr.exe
  2⤵
  PID:6556
- C:\Windows\System\bJRUcIk.exe
  C:\Windows\System\bJRUcIk.exe
  2⤵
  PID:6584
- C:\Windows\System\yRhpvPl.exe
  C:\Windows\System\yRhpvPl.exe
  2⤵
  PID:6600
- C:\Windows\System\xrzVezx.exe
  C:\Windows\System\xrzVezx.exe
  2⤵
  PID:6620
- C:\Windows\System\NuqIGLS.exe
  C:\Windows\System\NuqIGLS.exe
  2⤵
  PID:6636
- C:\Windows\System\UkDwazO.exe
  C:\Windows\System\UkDwazO.exe
  2⤵
  PID:6660
- C:\Windows\System\ZRjWKQY.exe
  C:\Windows\System\ZRjWKQY.exe
  2⤵
  PID:6684
- C:\Windows\System\VRvDKWr.exe
  C:\Windows\System\VRvDKWr.exe
  2⤵
  PID:6712
- C:\Windows\System\VSGpOHo.exe
  C:\Windows\System\VSGpOHo.exe
  2⤵
  PID:6732
- C:\Windows\System\phPThbZ.exe
  C:\Windows\System\phPThbZ.exe
  2⤵
  PID:6752
- C:\Windows\System\kQSdrNn.exe
  C:\Windows\System\kQSdrNn.exe
  2⤵
  PID:6776
- C:\Windows\System\OdFFEdn.exe
  C:\Windows\System\OdFFEdn.exe
  2⤵
  PID:6796
- C:\Windows\System\haNeyVk.exe
  C:\Windows\System\haNeyVk.exe
  2⤵
  PID:6820
- C:\Windows\System\rlTjutU.exe
  C:\Windows\System\rlTjutU.exe
  2⤵
  PID:6840
- C:\Windows\System\jtwDeIH.exe
  C:\Windows\System\jtwDeIH.exe
  2⤵
  PID:6860
- C:\Windows\System\ZqEpdDV.exe
  C:\Windows\System\ZqEpdDV.exe
  2⤵
  PID:6880
- C:\Windows\System\fdGRHOU.exe
  C:\Windows\System\fdGRHOU.exe
  2⤵
  PID:6904
- C:\Windows\System\dznhphx.exe
  C:\Windows\System\dznhphx.exe
  2⤵
  PID:6924
- C:\Windows\System\WNJGrLv.exe
  C:\Windows\System\WNJGrLv.exe
  2⤵
  PID:6944
- C:\Windows\System\OATQYjT.exe
  C:\Windows\System\OATQYjT.exe
  2⤵
  PID:6964
- C:\Windows\System\Hriarbr.exe
  C:\Windows\System\Hriarbr.exe
  2⤵
  PID:6984
- C:\Windows\System\DnPXhsL.exe
  C:\Windows\System\DnPXhsL.exe
  2⤵
  PID:7008
- C:\Windows\System\OEMAdch.exe
  C:\Windows\System\OEMAdch.exe
  2⤵
  PID:7028
- C:\Windows\System\VtqOERb.exe
  C:\Windows\System\VtqOERb.exe
  2⤵
  PID:7052
- C:\Windows\System\CEaEubv.exe
  C:\Windows\System\CEaEubv.exe
  2⤵
  PID:7116
- C:\Windows\System\AaUCGMm.exe
  C:\Windows\System\AaUCGMm.exe
  2⤵
  PID:7136
- C:\Windows\System\foXTUrV.exe
  C:\Windows\System\foXTUrV.exe
  2⤵
  PID:2536
- C:\Windows\System\pzsfoOq.exe
  C:\Windows\System\pzsfoOq.exe
  2⤵
  PID:6720
- C:\Windows\System\tgKBIuZ.exe
  C:\Windows\System\tgKBIuZ.exe
  2⤵
  PID:6648
- C:\Windows\System\hIjRvgu.exe
  C:\Windows\System\hIjRvgu.exe
  2⤵
  PID:6596
- C:\Windows\System\zjpBUsF.exe
  C:\Windows\System\zjpBUsF.exe
  2⤵
  PID:6808
- C:\Windows\System\rXJayBQ.exe
  C:\Windows\System\rXJayBQ.exe
  2⤵
  PID:6676
- C:\Windows\System\IlmjaAx.exe
  C:\Windows\System\IlmjaAx.exe
  2⤵
  PID:6708
- C:\Windows\System\CpEXRtF.exe
  C:\Windows\System\CpEXRtF.exe
  2⤵
  PID:6788
- C:\Windows\System\RQfPqrn.exe
  C:\Windows\System\RQfPqrn.exe
  2⤵
  PID:7024
- C:\Windows\System\Dqclval.exe
  C:\Windows\System\Dqclval.exe
  2⤵
  PID:6856
- C:\Windows\System\hnoRUYY.exe
  C:\Windows\System\hnoRUYY.exe
  2⤵
  PID:6888
- C:\Windows\System\bTJriBd.exe
  C:\Windows\System\bTJriBd.exe
  2⤵
  PID:6936
- C:\Windows\System\OspvoVU.exe
  C:\Windows\System\OspvoVU.exe
  2⤵
  PID:6952
- C:\Windows\System\eiyFaLU.exe
  C:\Windows\System\eiyFaLU.exe
  2⤵
  PID:7004
- C:\Windows\System\MqQQdVF.exe
  C:\Windows\System\MqQQdVF.exe
  2⤵
  PID:7144
- C:\Windows\System\lkcMLGn.exe
  C:\Windows\System\lkcMLGn.exe
  2⤵
  PID:5676
- C:\Windows\System\xzVcANc.exe
  C:\Windows\System\xzVcANc.exe
  2⤵
  PID:6276
- C:\Windows\System\efuEaKn.exe
  C:\Windows\System\efuEaKn.exe
  2⤵
  PID:6552
- C:\Windows\System\GRraigM.exe
  C:\Windows\System\GRraigM.exe
  2⤵
  PID:6612
- C:\Windows\System\VWuxJxp.exe
  C:\Windows\System\VWuxJxp.exe
  2⤵
  PID:6724
- C:\Windows\System\kwqfnjg.exe
  C:\Windows\System\kwqfnjg.exe
  2⤵
  PID:7020
- C:\Windows\System\jIbdRPr.exe
  C:\Windows\System\jIbdRPr.exe
  2⤵
  PID:6772
- C:\Windows\System\guBfkjG.exe
  C:\Windows\System\guBfkjG.exe
  2⤵
  PID:7188
- C:\Windows\System\ltFtRQe.exe
  C:\Windows\System\ltFtRQe.exe
  2⤵
  PID:7208
- C:\Windows\System\yysAxby.exe
  C:\Windows\System\yysAxby.exe
  2⤵
  PID:7232
- C:\Windows\System\mkDVFJb.exe
  C:\Windows\System\mkDVFJb.exe
  2⤵
  PID:7248
- C:\Windows\System\SPblPkJ.exe
  C:\Windows\System\SPblPkJ.exe
  2⤵
  PID:7272
- C:\Windows\System\HjfNsIo.exe
  C:\Windows\System\HjfNsIo.exe
  2⤵
  PID:7296
- C:\Windows\System\OrEZMqP.exe
  C:\Windows\System\OrEZMqP.exe
  2⤵
  PID:7324
- C:\Windows\System\AmszBEC.exe
  C:\Windows\System\AmszBEC.exe
  2⤵
  PID:7340
- C:\Windows\System\HPpkLhl.exe
  C:\Windows\System\HPpkLhl.exe
  2⤵
  PID:7360
- C:\Windows\System\WKKsAhp.exe
  C:\Windows\System\WKKsAhp.exe
  2⤵
  PID:7380
- C:\Windows\System\mVADuOp.exe
  C:\Windows\System\mVADuOp.exe
  2⤵
  PID:7404
- C:\Windows\System\CdICiAX.exe
  C:\Windows\System\CdICiAX.exe
  2⤵
  PID:7440
- C:\Windows\System\BAkVDTW.exe
  C:\Windows\System\BAkVDTW.exe
  2⤵
  PID:7456
- C:\Windows\System\gAnbOAd.exe
  C:\Windows\System\gAnbOAd.exe
  2⤵
  PID:7480
- C:\Windows\System\yjheVlC.exe
  C:\Windows\System\yjheVlC.exe
  2⤵
  PID:7504
- C:\Windows\System\XeqVhDX.exe
  C:\Windows\System\XeqVhDX.exe
  2⤵
  PID:7528
- C:\Windows\System\TCZxrSL.exe
  C:\Windows\System\TCZxrSL.exe
  2⤵
  PID:7556
- C:\Windows\System\ZEogArw.exe
  C:\Windows\System\ZEogArw.exe
  2⤵
  PID:7576
- C:\Windows\System\BjmRGVL.exe
  C:\Windows\System\BjmRGVL.exe
  2⤵
  PID:7596
- C:\Windows\System\EJQYXUx.exe
  C:\Windows\System\EJQYXUx.exe
  2⤵
  PID:7684
- C:\Windows\System\YfVOSyj.exe
  C:\Windows\System\YfVOSyj.exe
  2⤵
  PID:7708
- C:\Windows\System\bXufnRn.exe
  C:\Windows\System\bXufnRn.exe
  2⤵
  PID:7732
- C:\Windows\System\sFNyOHe.exe
  C:\Windows\System\sFNyOHe.exe
  2⤵
  PID:7768
- C:\Windows\System\xoFtBVk.exe
  C:\Windows\System\xoFtBVk.exe
  2⤵
  PID:7792
- C:\Windows\System\lZiMQoL.exe
  C:\Windows\System\lZiMQoL.exe
  2⤵
  PID:7816
- C:\Windows\System\NRdLJhH.exe
  C:\Windows\System\NRdLJhH.exe
  2⤵
  PID:7840
- C:\Windows\System\qkAnSPe.exe
  C:\Windows\System\qkAnSPe.exe
  2⤵
  PID:7860
- C:\Windows\System\eNHhoyw.exe
  C:\Windows\System\eNHhoyw.exe
  2⤵
  PID:7880
- C:\Windows\System\WTmfftm.exe
  C:\Windows\System\WTmfftm.exe
  2⤵
  PID:7896
- C:\Windows\System\bTynSUZ.exe
  C:\Windows\System\bTynSUZ.exe
  2⤵
  PID:7924
- C:\Windows\System\EAyQkyG.exe
  C:\Windows\System\EAyQkyG.exe
  2⤵
  PID:7944
- C:\Windows\System\Zhyksou.exe
  C:\Windows\System\Zhyksou.exe
  2⤵
  PID:7964
- C:\Windows\System\VUsSBcN.exe
  C:\Windows\System\VUsSBcN.exe
  2⤵
  PID:7984
- C:\Windows\System\jXiiIWK.exe
  C:\Windows\System\jXiiIWK.exe
  2⤵
  PID:8000
- C:\Windows\System\VsKlGfu.exe
  C:\Windows\System\VsKlGfu.exe
  2⤵
  PID:8024
- C:\Windows\System\CTVsSUx.exe
  C:\Windows\System\CTVsSUx.exe
  2⤵
  PID:8040
- C:\Windows\System\BDyAUYe.exe
  C:\Windows\System\BDyAUYe.exe
  2⤵
  PID:8056
- C:\Windows\System\XRYemoe.exe
  C:\Windows\System\XRYemoe.exe
  2⤵
  PID:8072
- C:\Windows\System\ldDexSt.exe
  C:\Windows\System\ldDexSt.exe
  2⤵
  PID:8108
- C:\Windows\System\QXEnHZQ.exe
  C:\Windows\System\QXEnHZQ.exe
  2⤵
  PID:8128
- C:\Windows\System\eQbFFcP.exe
  C:\Windows\System\eQbFFcP.exe
  2⤵
  PID:8148
- C:\Windows\System\emKGRwh.exe
  C:\Windows\System\emKGRwh.exe
  2⤵
  PID:8168
- C:\Windows\System\PmYnmpQ.exe
  C:\Windows\System\PmYnmpQ.exe
  2⤵
  PID:8188
- C:\Windows\System\JlEdtbK.exe
  C:\Windows\System\JlEdtbK.exe
  2⤵
  PID:2872
- C:\Windows\System\fxxPHEv.exe
  C:\Windows\System\fxxPHEv.exe
  2⤵
  PID:6372
- C:\Windows\System\RhTHXsU.exe
  C:\Windows\System\RhTHXsU.exe
  2⤵
  PID:7064
- C:\Windows\System\DyHWghP.exe
  C:\Windows\System\DyHWghP.exe
  2⤵
  PID:7312
- C:\Windows\System\vVFpCYW.exe
  C:\Windows\System\vVFpCYW.exe
  2⤵
  PID:7388
- C:\Windows\System\PCeqRiV.exe
  C:\Windows\System\PCeqRiV.exe
  2⤵
  PID:7268
- C:\Windows\System\xMLPDZV.exe
  C:\Windows\System\xMLPDZV.exe
  2⤵
  PID:8180
- C:\Windows\System\ZRHKuRR.exe
  C:\Windows\System\ZRHKuRR.exe
  2⤵
  PID:7760
- C:\Windows\System\oQUILYF.exe
  C:\Windows\System\oQUILYF.exe
  2⤵
  PID:7352
- C:\Windows\System\CBgxPFS.exe
  C:\Windows\System\CBgxPFS.exe
  2⤵
  PID:3364
- C:\Windows\System\QXpIKcE.exe
  C:\Windows\System\QXpIKcE.exe
  2⤵
  PID:7468
- C:\Windows\System\uHbMSlv.exe
  C:\Windows\System\uHbMSlv.exe
  2⤵
  PID:7808
- C:\Windows\System\BInnXjQ.exe
  C:\Windows\System\BInnXjQ.exe
  2⤵
  PID:7348
- C:\Windows\System\dJQtaPp.exe
  C:\Windows\System\dJQtaPp.exe
  2⤵
  PID:7244
- C:\Windows\System\JXjrHTJ.exe
  C:\Windows\System\JXjrHTJ.exe
  2⤵
  PID:7588
- C:\Windows\System\dcAUrud.exe
  C:\Windows\System\dcAUrud.exe
  2⤵
  PID:7396
- C:\Windows\System\WpFnalr.exe
  C:\Windows\System\WpFnalr.exe
  2⤵
  PID:7908
- C:\Windows\System\zYCzNjG.exe
  C:\Windows\System\zYCzNjG.exe
  2⤵
  PID:6352
- C:\Windows\System\aoswPRS.exe
  C:\Windows\System\aoswPRS.exe
  2⤵
  PID:3492
- C:\Windows\System\lpSHhtl.exe
  C:\Windows\System\lpSHhtl.exe
  2⤵
  PID:8220
- C:\Windows\System\ikGNfJC.exe
  C:\Windows\System\ikGNfJC.exe
  2⤵
  PID:8236
- C:\Windows\System\FKxbTsC.exe
  C:\Windows\System\FKxbTsC.exe
  2⤵
  PID:8256
- C:\Windows\System\AZITfjP.exe
  C:\Windows\System\AZITfjP.exe
  2⤵
  PID:8272
- C:\Windows\System\xJQadeN.exe
  C:\Windows\System\xJQadeN.exe
  2⤵
  PID:8288
- C:\Windows\System\mbAmknB.exe
  C:\Windows\System\mbAmknB.exe
  2⤵
  PID:8304
- C:\Windows\System\agoQzTO.exe
  C:\Windows\System\agoQzTO.exe
  2⤵
  PID:8320
- C:\Windows\System\ZihiRiw.exe
  C:\Windows\System\ZihiRiw.exe
  2⤵
  PID:8340
- C:\Windows\System\qHDLapj.exe
  C:\Windows\System\qHDLapj.exe
  2⤵
  PID:8356
- C:\Windows\System\rzdUBoc.exe
  C:\Windows\System\rzdUBoc.exe
  2⤵
  PID:8384
- C:\Windows\System\sTepUXW.exe
  C:\Windows\System\sTepUXW.exe
  2⤵
  PID:8416
- C:\Windows\System\MRFLXkH.exe
  C:\Windows\System\MRFLXkH.exe
  2⤵
  PID:8436
- C:\Windows\System\YreoXrl.exe
  C:\Windows\System\YreoXrl.exe
  2⤵
  PID:8452
- C:\Windows\System\ONarvAN.exe
  C:\Windows\System\ONarvAN.exe
  2⤵
  PID:8468
- C:\Windows\System\cgxTLuX.exe
  C:\Windows\System\cgxTLuX.exe
  2⤵
  PID:8484
- C:\Windows\System\ogSxrEf.exe
  C:\Windows\System\ogSxrEf.exe
  2⤵
  PID:8500
- C:\Windows\System\usdCeNg.exe
  C:\Windows\System\usdCeNg.exe
  2⤵
  PID:8516
- C:\Windows\System\qxCxULM.exe
  C:\Windows\System\qxCxULM.exe
  2⤵
  PID:8532
- C:\Windows\System\gwHbSDW.exe
  C:\Windows\System\gwHbSDW.exe
  2⤵
  PID:8548
- C:\Windows\System\OCbMcHd.exe
  C:\Windows\System\OCbMcHd.exe
  2⤵
  PID:8568
- C:\Windows\System\FGlLXoh.exe
  C:\Windows\System\FGlLXoh.exe
  2⤵
  PID:8584
- C:\Windows\System\moUJtDi.exe
  C:\Windows\System\moUJtDi.exe
  2⤵
  PID:8608
- C:\Windows\System\rCmaFtz.exe
  C:\Windows\System\rCmaFtz.exe
  2⤵
  PID:8648
- C:\Windows\System\TrrGzbM.exe
  C:\Windows\System\TrrGzbM.exe
  2⤵
  PID:8668
- C:\Windows\System\dEHYbXy.exe
  C:\Windows\System\dEHYbXy.exe
  2⤵
  PID:8736
- C:\Windows\System\IBojLks.exe
  C:\Windows\System\IBojLks.exe
  2⤵
  PID:8760
- C:\Windows\System\cpldrDL.exe
  C:\Windows\System\cpldrDL.exe
  2⤵
  PID:8776
- C:\Windows\System\wWGwdMw.exe
  C:\Windows\System\wWGwdMw.exe
  2⤵
  PID:8796
- C:\Windows\System\oKrMfBR.exe
  C:\Windows\System\oKrMfBR.exe
  2⤵
  PID:8820
- C:\Windows\System\BGAtooX.exe
  C:\Windows\System\BGAtooX.exe
  2⤵
  PID:8840
- C:\Windows\System\QxgXjYo.exe
  C:\Windows\System\QxgXjYo.exe
  2⤵
  PID:8860
- C:\Windows\System\JMvNdPm.exe
  C:\Windows\System\JMvNdPm.exe
  2⤵
  PID:8884
- C:\Windows\System\RDYnaDS.exe
  C:\Windows\System\RDYnaDS.exe
  2⤵
  PID:8904
- C:\Windows\System\WWCSNwG.exe
  C:\Windows\System\WWCSNwG.exe
  2⤵
  PID:8920
- C:\Windows\System\xyiEEng.exe
  C:\Windows\System\xyiEEng.exe
  2⤵
  PID:8940
- C:\Windows\System\nDOUhSZ.exe
  C:\Windows\System\nDOUhSZ.exe
  2⤵
  PID:8960
- C:\Windows\System\giWinWt.exe
  C:\Windows\System\giWinWt.exe
  2⤵
  PID:8980
- C:\Windows\System\XuqeIOE.exe
  C:\Windows\System\XuqeIOE.exe
  2⤵
  PID:8996
- C:\Windows\System\AukpTdp.exe
  C:\Windows\System\AukpTdp.exe
  2⤵
  PID:9016
- C:\Windows\System\TdWomsQ.exe
  C:\Windows\System\TdWomsQ.exe
  2⤵
  PID:9032
- C:\Windows\System\uOiNPOe.exe
  C:\Windows\System\uOiNPOe.exe
  2⤵
  PID:9048
- C:\Windows\System\jKwsoql.exe
  C:\Windows\System\jKwsoql.exe
  2⤵
  PID:9064
- C:\Windows\System\QsDrQyQ.exe
  C:\Windows\System\QsDrQyQ.exe
  2⤵
  PID:9080
- C:\Windows\System\sLXrUxp.exe
  C:\Windows\System\sLXrUxp.exe
  2⤵
  PID:9100
- C:\Windows\System\TdDmarG.exe
  C:\Windows\System\TdDmarG.exe
  2⤵
  PID:9128
- C:\Windows\System\tMTUTyQ.exe
  C:\Windows\System\tMTUTyQ.exe
  2⤵
  PID:9148
- C:\Windows\System\uIaxJHI.exe
  C:\Windows\System\uIaxJHI.exe
  2⤵
  PID:9172
- C:\Windows\System\ZMoIGJN.exe
  C:\Windows\System\ZMoIGJN.exe
  2⤵
  PID:9188
- C:\Windows\System\SRJxqYw.exe
  C:\Windows\System\SRJxqYw.exe
  2⤵
  PID:9212
- C:\Windows\System\FOyioiF.exe
  C:\Windows\System\FOyioiF.exe
  2⤵
  PID:7452
- C:\Windows\System\geuvlqe.exe
  C:\Windows\System\geuvlqe.exe
  2⤵
  PID:1540
- C:\Windows\System\bLxstmz.exe
  C:\Windows\System\bLxstmz.exe
  2⤵
  PID:1988
- C:\Windows\System\tzREFYP.exe
  C:\Windows\System\tzREFYP.exe
  2⤵
  PID:4820
- C:\Windows\System\sHExTcA.exe
  C:\Windows\System\sHExTcA.exe
  2⤵
  PID:8016
- C:\Windows\System\btVDuSh.exe
  C:\Windows\System\btVDuSh.exe
  2⤵
  PID:4484
- C:\Windows\System\TQLstVj.exe
  C:\Windows\System\TQLstVj.exe
  2⤵
  PID:3436
- C:\Windows\System\VTNmGes.exe
  C:\Windows\System\VTNmGes.exe
  2⤵
  PID:8248
- C:\Windows\System\GwxMqCc.exe
  C:\Windows\System\GwxMqCc.exe
  2⤵
  PID:8476
- C:\Windows\System\FAPObfS.exe
  C:\Windows\System\FAPObfS.exe
  2⤵
  PID:8376
- C:\Windows\System\HdyCMZs.exe
  C:\Windows\System\HdyCMZs.exe
  2⤵
  PID:8620
- C:\Windows\System\NbYXUGZ.exe
  C:\Windows\System\NbYXUGZ.exe
  2⤵
  PID:8680
- C:\Windows\System\QQQqzXp.exe
  C:\Windows\System\QQQqzXp.exe
  2⤵
  PID:8316
- C:\Windows\System\RSEjazw.exe
  C:\Windows\System\RSEjazw.exe
  2⤵
  PID:8492
- C:\Windows\System\Qfzisgv.exe
  C:\Windows\System\Qfzisgv.exe
  2⤵
  PID:8496
- C:\Windows\System\QdmYbgU.exe
  C:\Windows\System\QdmYbgU.exe
  2⤵
  PID:8576
- C:\Windows\System\SGuRfYQ.exe
  C:\Windows\System\SGuRfYQ.exe
  2⤵
  PID:8660
- C:\Windows\System\JjcTiGc.exe
  C:\Windows\System\JjcTiGc.exe
  2⤵
  PID:8812
- C:\Windows\System\BosSVUH.exe
  C:\Windows\System\BosSVUH.exe
  2⤵
  PID:8892
- C:\Windows\System\xmrfoKM.exe
  C:\Windows\System\xmrfoKM.exe
  2⤵
  PID:8540
- C:\Windows\System\JWhURyN.exe
  C:\Windows\System\JWhURyN.exe
  2⤵
  PID:8592
- C:\Windows\System\UMDmmCy.exe
  C:\Windows\System\UMDmmCy.exe
  2⤵
  PID:9056
- C:\Windows\System\UTgloUZ.exe
  C:\Windows\System\UTgloUZ.exe
  2⤵
  PID:9232
- C:\Windows\System\gQKSWul.exe
  C:\Windows\System\gQKSWul.exe
  2⤵
  PID:9252
- C:\Windows\System\itwUIlZ.exe
  C:\Windows\System\itwUIlZ.exe
  2⤵
  PID:9404
- C:\Windows\System\oDmYVXV.exe
  C:\Windows\System\oDmYVXV.exe
  2⤵
  PID:9524
- C:\Windows\System\VDgCTZz.exe
  C:\Windows\System\VDgCTZz.exe
  2⤵
  PID:9544
- C:\Windows\System\qMaJPfi.exe
  C:\Windows\System\qMaJPfi.exe
  2⤵
  PID:9564
- C:\Windows\System\RabUteq.exe
  C:\Windows\System\RabUteq.exe
  2⤵
  PID:9584
- C:\Windows\System\zmxIGFs.exe
  C:\Windows\System\zmxIGFs.exe
  2⤵
  PID:9604
- C:\Windows\System\hSSuXtE.exe
  C:\Windows\System\hSSuXtE.exe
  2⤵
  PID:9620
- C:\Windows\System\MoAPsov.exe
  C:\Windows\System\MoAPsov.exe
  2⤵
  PID:9640
- C:\Windows\System\ZvwQdgE.exe
  C:\Windows\System\ZvwQdgE.exe
  2⤵
  PID:9656
- C:\Windows\System\sHMSWie.exe
  C:\Windows\System\sHMSWie.exe
  2⤵
  PID:9672
- C:\Windows\System\BdZaoqQ.exe
  C:\Windows\System\BdZaoqQ.exe
  2⤵
  PID:9688
- C:\Windows\System\iMudHOL.exe
  C:\Windows\System\iMudHOL.exe
  2⤵
  PID:9712
- C:\Windows\System\jyUSMIC.exe
  C:\Windows\System\jyUSMIC.exe
  2⤵
  PID:9744
- C:\Windows\System\mnJeeoz.exe
  C:\Windows\System\mnJeeoz.exe
  2⤵
  PID:9760
- C:\Windows\System\XOdDZxU.exe
  C:\Windows\System\XOdDZxU.exe
  2⤵
  PID:9776
- C:\Windows\System\JcBepSM.exe
  C:\Windows\System\JcBepSM.exe
  2⤵
  PID:9792
- C:\Windows\System\tcikDIM.exe
  C:\Windows\System\tcikDIM.exe
  2⤵
  PID:9812
- C:\Windows\System\NgpfWBZ.exe
  C:\Windows\System\NgpfWBZ.exe
  2⤵
  PID:9832
- C:\Windows\System\ByHtOKZ.exe
  C:\Windows\System\ByHtOKZ.exe
  2⤵
  PID:9848
- C:\Windows\System\iiApowf.exe
  C:\Windows\System\iiApowf.exe
  2⤵
  PID:9868
- C:\Windows\System\uCxLeFs.exe
  C:\Windows\System\uCxLeFs.exe
  2⤵
  PID:9492
- C:\Windows\System\SWMTuMK.exe
  C:\Windows\System\SWMTuMK.exe
  2⤵
  PID:9592
- C:\Windows\System\PLVvPLa.exe
  C:\Windows\System\PLVvPLa.exe
  2⤵
  PID:9628
- C:\Windows\System\rZlupVT.exe
  C:\Windows\System\rZlupVT.exe
  2⤵
  PID:9668
- C:\Windows\System\IFjvltu.exe
  C:\Windows\System\IFjvltu.exe
  2⤵
  PID:4668
- C:\Windows\System\UZXYftB.exe
  C:\Windows\System\UZXYftB.exe
  2⤵
  PID:9496
- C:\Windows\System\iaZvRIJ.exe
  C:\Windows\System\iaZvRIJ.exe
  2⤵
  PID:3648
- C:\Windows\System\AjLajGz.exe
  C:\Windows\System\AjLajGz.exe
  2⤵
  PID:9736
- C:\Windows\System\ExGAOjN.exe
  C:\Windows\System\ExGAOjN.exe
  2⤵
  PID:9540
- C:\Windows\System\gGMQeaH.exe
  C:\Windows\System\gGMQeaH.exe
  2⤵
  PID:5048
- C:\Windows\System\kImVBIC.exe
  C:\Windows\System\kImVBIC.exe
  2⤵
  PID:9648
- C:\Windows\System\FvpVUpJ.exe
  C:\Windows\System\FvpVUpJ.exe
  2⤵
  PID:9696
- C:\Windows\System\OkqbIGe.exe
  C:\Windows\System\OkqbIGe.exe
  2⤵
  PID:9768
- C:\Windows\System\BBPPrfM.exe
  C:\Windows\System\BBPPrfM.exe
  2⤵
  PID:9936
- C:\Windows\System\cHUNIqA.exe
  C:\Windows\System\cHUNIqA.exe
  2⤵
  PID:9972
- C:\Windows\System\HznQBic.exe
  C:\Windows\System\HznQBic.exe
  2⤵
  PID:10008
- C:\Windows\System\XWeAGfP.exe
  C:\Windows\System\XWeAGfP.exe
  2⤵
  PID:8784
- C:\Windows\System\OlIlxKZ.exe
  C:\Windows\System\OlIlxKZ.exe
  2⤵
  PID:9860
- C:\Windows\System\atvdDdb.exe
  C:\Windows\System\atvdDdb.exe
  2⤵
  PID:9924
- C:\Windows\System\kTulIpm.exe
  C:\Windows\System\kTulIpm.exe
  2⤵
  PID:9268
- C:\Windows\System\vcQXoxn.exe
  C:\Windows\System\vcQXoxn.exe
  2⤵
  PID:8852
- C:\Windows\System\frBoNwN.exe
  C:\Windows\System\frBoNwN.exe
  2⤵
  PID:8564
- C:\Windows\System\sWHfAWr.exe
  C:\Windows\System\sWHfAWr.exe
  2⤵
  PID:10148
- C:\Windows\System\igsRzPI.exe
  C:\Windows\System\igsRzPI.exe
  2⤵
  PID:9220
- C:\Windows\System\SJXjAjU.exe
  C:\Windows\System\SJXjAjU.exe
  2⤵
  PID:9184
- C:\Windows\System\VTBRSLz.exe
  C:\Windows\System\VTBRSLz.exe
  2⤵
  PID:8724
- C:\Windows\System\xoeHrdV.exe
  C:\Windows\System\xoeHrdV.exe
  2⤵
  PID:8684
- C:\Windows\System\iXvdFOm.exe
  C:\Windows\System\iXvdFOm.exe
  2⤵
  PID:9096
- C:\Windows\System\yihdDeI.exe
  C:\Windows\System\yihdDeI.exe
  2⤵
  PID:9316
- C:\Windows\System\YMahtNR.exe
  C:\Windows\System\YMahtNR.exe
  2⤵
  PID:5000
- C:\Windows\System\fItmhSc.exe
  C:\Windows\System\fItmhSc.exe
  2⤵
  PID:9380
- C:\Windows\System\KEaJTSJ.exe
  C:\Windows\System\KEaJTSJ.exe
  2⤵
  PID:456
- C:\Windows\System\gqnScSl.exe
  C:\Windows\System\gqnScSl.exe
  2⤵
  PID:9664
- C:\Windows\System\kFWLKDi.exe
  C:\Windows\System\kFWLKDi.exe
  2⤵
  PID:9680
- C:\Windows\System\aZQTrrX.exe
  C:\Windows\System\aZQTrrX.exe
  2⤵
  PID:9984
- C:\Windows\System\imteLSc.exe
  C:\Windows\System\imteLSc.exe
  2⤵
  PID:9912
- C:\Windows\System\CbUXzbC.exe
  C:\Windows\System\CbUXzbC.exe
  2⤵
  PID:9788
- C:\Windows\System\PcXtFHn.exe
  C:\Windows\System\PcXtFHn.exe
  2⤵
  PID:10172
- C:\Windows\System\iAqNcHg.exe
  C:\Windows\System\iAqNcHg.exe
  2⤵
  PID:8228
- C:\Windows\System\lByHNum.exe
  C:\Windows\System\lByHNum.exe
  2⤵
  PID:10028
- C:\Windows\System\fKBrOIq.exe
  C:\Windows\System\fKBrOIq.exe
  2⤵
  PID:10116
- C:\Windows\System\WtEwzdm.exe
  C:\Windows\System\WtEwzdm.exe
  2⤵
  PID:9120
- C:\Windows\System\XfUYuel.exe
  C:\Windows\System\XfUYuel.exe
  2⤵
  PID:10244
- C:\Windows\System\tVEbuZl.exe
  C:\Windows\System\tVEbuZl.exe
  2⤵
  PID:10264
- C:\Windows\System\qShXttt.exe
  C:\Windows\System\qShXttt.exe
  2⤵
  PID:10280
- C:\Windows\System\acCgbIl.exe
  C:\Windows\System\acCgbIl.exe
  2⤵
  PID:10296
- C:\Windows\System\ImGLIAA.exe
  C:\Windows\System\ImGLIAA.exe
  2⤵
  PID:10316
- C:\Windows\System\JrPoFEB.exe
  C:\Windows\System\JrPoFEB.exe
  2⤵
  PID:10336
- C:\Windows\System\mirTseM.exe
  C:\Windows\System\mirTseM.exe
  2⤵
  PID:10356
- C:\Windows\System\DOSMbUZ.exe
  C:\Windows\System\DOSMbUZ.exe
  2⤵
  PID:10376
- C:\Windows\System\OqHmuVR.exe
  C:\Windows\System\OqHmuVR.exe
  2⤵
  PID:10396
- C:\Windows\System\xVfaewU.exe
  C:\Windows\System\xVfaewU.exe
  2⤵
  PID:10424
- C:\Windows\System\ayXqZhc.exe
  C:\Windows\System\ayXqZhc.exe
  2⤵
  PID:10440
- C:\Windows\System\reZWDAb.exe
  C:\Windows\System\reZWDAb.exe
  2⤵
  PID:10464
- C:\Windows\System\LQfxFaQ.exe
  C:\Windows\System\LQfxFaQ.exe
  2⤵
  PID:10480
- C:\Windows\System\DEASato.exe
  C:\Windows\System\DEASato.exe
  2⤵
  PID:10500
- C:\Windows\System\PgjUvnz.exe
  C:\Windows\System\PgjUvnz.exe
  2⤵
  PID:10520
- C:\Windows\System\WuROCzv.exe
  C:\Windows\System\WuROCzv.exe
  2⤵
  PID:10688
- C:\Windows\System\BPlYGXA.exe
  C:\Windows\System\BPlYGXA.exe
  2⤵
  PID:10712
- C:\Windows\System\TEqeDjr.exe
  C:\Windows\System\TEqeDjr.exe
  2⤵
  PID:10740
- C:\Windows\System\WNcEiAM.exe
  C:\Windows\System\WNcEiAM.exe
  2⤵
  PID:10760
- C:\Windows\System\VgTSiAV.exe
  C:\Windows\System\VgTSiAV.exe
  2⤵
  PID:10780
- C:\Windows\System\dbYcAtd.exe
  C:\Windows\System\dbYcAtd.exe
  2⤵
  PID:10804
- C:\Windows\System\FELwfOY.exe
  C:\Windows\System\FELwfOY.exe
  2⤵
  PID:10832
- C:\Windows\System\qvGmEQS.exe
  C:\Windows\System\qvGmEQS.exe
  2⤵
  PID:10852
- C:\Windows\System\FwiGTgQ.exe
  C:\Windows\System\FwiGTgQ.exe
  2⤵
  PID:10868
- C:\Windows\System\VzlXfiq.exe
  C:\Windows\System\VzlXfiq.exe
  2⤵
  PID:10884
- C:\Windows\System\toGXZWa.exe
  C:\Windows\System\toGXZWa.exe
  2⤵
  PID:10908
- C:\Windows\System\fWWfsKy.exe
  C:\Windows\System\fWWfsKy.exe
  2⤵
  PID:10932
- C:\Windows\System\RoAIzZT.exe
  C:\Windows\System\RoAIzZT.exe
  2⤵
  PID:10980
- C:\Windows\System\YCUEjBb.exe
  C:\Windows\System\YCUEjBb.exe
  2⤵
  PID:11004
- C:\Windows\System\EJNCKmN.exe
  C:\Windows\System\EJNCKmN.exe
  2⤵
  PID:11024
- C:\Windows\System\fJGkeCb.exe
  C:\Windows\System\fJGkeCb.exe
  2⤵
  PID:11048
- C:\Windows\System\UhWHuPg.exe
  C:\Windows\System\UhWHuPg.exe
  2⤵
  PID:11068
- C:\Windows\System\ZwjWHNg.exe
  C:\Windows\System\ZwjWHNg.exe
  2⤵
  PID:11096
- C:\Windows\System\bEfGPdK.exe
  C:\Windows\System\bEfGPdK.exe
  2⤵
  PID:11112
- C:\Windows\System\Ovxmbnf.exe
  C:\Windows\System\Ovxmbnf.exe
  2⤵
  PID:11132
- C:\Windows\System\lxvnDup.exe
  C:\Windows\System\lxvnDup.exe
  2⤵
  PID:11152
- C:\Windows\System\KgcMdIz.exe
  C:\Windows\System\KgcMdIz.exe
  2⤵
  PID:11172
- C:\Windows\System\JTVNrgO.exe
  C:\Windows\System\JTVNrgO.exe
  2⤵
  PID:11192
- C:\Windows\System\TlotdLc.exe
  C:\Windows\System\TlotdLc.exe
  2⤵
  PID:11212
- C:\Windows\System\ekQhQtB.exe
  C:\Windows\System\ekQhQtB.exe
  2⤵
  PID:11232
- C:\Windows\System\QRjcHCU.exe
  C:\Windows\System\QRjcHCU.exe
  2⤵
  PID:11252
- C:\Windows\System\MijCTsd.exe
  C:\Windows\System\MijCTsd.exe
  2⤵
  PID:9784
- C:\Windows\System\VZZrnoQ.exe
  C:\Windows\System\VZZrnoQ.exe
  2⤵
  PID:9244
- C:\Windows\System\pQUXLlp.exe
  C:\Windows\System\pQUXLlp.exe
  2⤵
  PID:10324
- C:\Windows\System\LlhyYrg.exe
  C:\Windows\System\LlhyYrg.exe
  2⤵
  PID:10432
- C:\Windows\System\wLdyvVF.exe
  C:\Windows\System\wLdyvVF.exe
  2⤵
  PID:9880
- C:\Windows\System\iHeidLa.exe
  C:\Windows\System\iHeidLa.exe
  2⤵
  PID:8332
- C:\Windows\System\zPJNqYk.exe
  C:\Windows\System\zPJNqYk.exe
  2⤵
  PID:10636
- C:\Windows\System\dmPxvtO.exe
  C:\Windows\System\dmPxvtO.exe
  2⤵
  PID:10776
- C:\Windows\System\iUEBeMq.exe
  C:\Windows\System\iUEBeMq.exe
  2⤵
  PID:2516
- C:\Windows\System\AKfIjqr.exe
  C:\Windows\System\AKfIjqr.exe
  2⤵
  PID:10588
- C:\Windows\System\lPVILVF.exe
  C:\Windows\System\lPVILVF.exe
  2⤵
  PID:10608
- C:\Windows\System\fzDMXAn.exe
  C:\Windows\System\fzDMXAn.exe
  2⤵
  PID:10824
- C:\Windows\System\fDVSmHh.exe
  C:\Windows\System\fDVSmHh.exe
  2⤵
  PID:10880
- C:\Windows\System\MZhfXcq.exe
  C:\Windows\System\MZhfXcq.exe
  2⤵
  PID:10684
- C:\Windows\System\HLfRFXL.exe
  C:\Windows\System\HLfRFXL.exe
  2⤵
  PID:10704
- C:\Windows\System\JpLzwXv.exe
  C:\Windows\System\JpLzwXv.exe
  2⤵
  PID:11088
- C:\Windows\System\vrotvya.exe
  C:\Windows\System\vrotvya.exe
  2⤵
  PID:11120
- C:\Windows\System\WRgNAmT.exe
  C:\Windows\System\WRgNAmT.exe
  2⤵
  PID:11208
- C:\Windows\System\kxedhCc.exe
  C:\Windows\System\kxedhCc.exe
  2⤵
  PID:8544
- C:\Windows\System\QEpmscr.exe
  C:\Windows\System\QEpmscr.exe
  2⤵
  PID:10388
- C:\Windows\System\ZykbpeM.exe
  C:\Windows\System\ZykbpeM.exe
  2⤵
  PID:11148
- C:\Windows\System\HpFLfAu.exe
  C:\Windows\System\HpFLfAu.exe
  2⤵
  PID:11260
- C:\Windows\System\whGgjwW.exe
  C:\Windows\System\whGgjwW.exe
  2⤵
  PID:10920
- C:\Windows\System\yMueDok.exe
  C:\Windows\System\yMueDok.exe
  2⤵
  PID:10192
- C:\Windows\System\YPWdPXa.exe
  C:\Windows\System\YPWdPXa.exe
  2⤵
  PID:3400
- C:\Windows\System\PBrhJye.exe
  C:\Windows\System\PBrhJye.exe
  2⤵
  PID:10332
- C:\Windows\System\XZlpFsz.exe
  C:\Windows\System\XZlpFsz.exe
  2⤵
  PID:11404
- C:\Windows\System\qlBVppu.exe
  C:\Windows\System\qlBVppu.exe
  2⤵
  PID:11424
- C:\Windows\System\NAqnOUV.exe
  C:\Windows\System\NAqnOUV.exe
  2⤵
  PID:11440
- C:\Windows\System\SXQSQJX.exe
  C:\Windows\System\SXQSQJX.exe
  2⤵
  PID:11460
- C:\Windows\System\PQFPDfh.exe
  C:\Windows\System\PQFPDfh.exe
  2⤵
  PID:11488
- C:\Windows\System\gVCtDWu.exe
  C:\Windows\System\gVCtDWu.exe
  2⤵
  PID:11508
- C:\Windows\System\MCKpZim.exe
  C:\Windows\System\MCKpZim.exe
  2⤵
  PID:11540
- C:\Windows\System\iMEoriw.exe
  C:\Windows\System\iMEoriw.exe
  2⤵
  PID:11556
- C:\Windows\System\dVyLsfX.exe
  C:\Windows\System\dVyLsfX.exe
  2⤵
  PID:11580
- C:\Windows\System\sTgWHlG.exe
  C:\Windows\System\sTgWHlG.exe
  2⤵
  PID:11608
- C:\Windows\System\ddICMAY.exe
  C:\Windows\System\ddICMAY.exe
  2⤵
  PID:11632
- C:\Windows\System\FHSkCBJ.exe
  C:\Windows\System\FHSkCBJ.exe
  2⤵
  PID:11652
- C:\Windows\System\XPPsVXe.exe
  C:\Windows\System\XPPsVXe.exe
  2⤵
  PID:11668
- C:\Windows\System\XSzbtKP.exe
  C:\Windows\System\XSzbtKP.exe
  2⤵
  PID:11684
- C:\Windows\System\gprbqRg.exe
  C:\Windows\System\gprbqRg.exe
  2⤵
  PID:11704
- C:\Windows\System\MhpvUnr.exe
  C:\Windows\System\MhpvUnr.exe
  2⤵
  PID:11724
- C:\Windows\System\YviXjNC.exe
  C:\Windows\System\YviXjNC.exe
  2⤵
  PID:11772
- C:\Windows\System\IwEUCLy.exe
  C:\Windows\System\IwEUCLy.exe
  2⤵
  PID:11792
- C:\Windows\System\NRLPIVC.exe
  C:\Windows\System\NRLPIVC.exe
  2⤵
  PID:11808
- C:\Windows\System\BYCCKse.exe
  C:\Windows\System\BYCCKse.exe
  2⤵
  PID:11824
- C:\Windows\System\RFlkjkZ.exe
  C:\Windows\System\RFlkjkZ.exe
  2⤵
  PID:11840
- C:\Windows\System\EGmTOuS.exe
  C:\Windows\System\EGmTOuS.exe
  2⤵
  PID:11856
- C:\Windows\System\hnPFxFD.exe
  C:\Windows\System\hnPFxFD.exe
  2⤵
  PID:11876
- C:\Windows\System\KKOWhDW.exe
  C:\Windows\System\KKOWhDW.exe
  2⤵
  PID:11892
- C:\Windows\System\SDFKMHW.exe
  C:\Windows\System\SDFKMHW.exe
  2⤵
  PID:11916
- C:\Windows\System\sqOdhnn.exe
  C:\Windows\System\sqOdhnn.exe
  2⤵
  PID:11944
- C:\Windows\System\dtuRrae.exe
  C:\Windows\System\dtuRrae.exe
  2⤵
  PID:11960
- C:\Windows\System\ZgOlCSz.exe
  C:\Windows\System\ZgOlCSz.exe
  2⤵
  PID:11984
- C:\Windows\System\VuZpiES.exe
  C:\Windows\System\VuZpiES.exe
  2⤵
  PID:12000
- C:\Windows\System\HCaFXxx.exe
  C:\Windows\System\HCaFXxx.exe
  2⤵
  PID:12024
- C:\Windows\System\EJpoeLE.exe
  C:\Windows\System\EJpoeLE.exe
  2⤵
  PID:12040
- C:\Windows\System\LVmYYMb.exe
  C:\Windows\System\LVmYYMb.exe
  2⤵
  PID:12120
- C:\Windows\System\fCulsjn.exe
  C:\Windows\System\fCulsjn.exe
  2⤵
  PID:12140
- C:\Windows\System\fhQxGMV.exe
  C:\Windows\System\fhQxGMV.exe
  2⤵
  PID:12156
- C:\Windows\System\KxtOrjn.exe
  C:\Windows\System\KxtOrjn.exe
  2⤵
  PID:12180
- C:\Windows\System\CkWHhgG.exe
  C:\Windows\System\CkWHhgG.exe
  2⤵
  PID:12200
- C:\Windows\System\bSFLxMt.exe
  C:\Windows\System\bSFLxMt.exe
  2⤵
  PID:10072
- C:\Windows\System\iOxDCic.exe
  C:\Windows\System\iOxDCic.exe
  2⤵
  PID:10516
- C:\Windows\System\XZrwWyq.exe
  C:\Windows\System\XZrwWyq.exe
  2⤵
  PID:10136
- C:\Windows\System\pIupNPK.exe
  C:\Windows\System\pIupNPK.exe
  2⤵
  PID:11020
- C:\Windows\System\apvjILr.exe
  C:\Windows\System\apvjILr.exe
  2⤵
  PID:11356
- C:\Windows\System\tcyLADL.exe
  C:\Windows\System\tcyLADL.exe
  2⤵
  PID:2920
- C:\Windows\System\WYoZKYN.exe
  C:\Windows\System\WYoZKYN.exe
  2⤵
  PID:11480
- C:\Windows\System\qSVKfhx.exe
  C:\Windows\System\qSVKfhx.exe
  2⤵
  PID:10640
- C:\Windows\System\mKgpQmJ.exe
  C:\Windows\System\mKgpQmJ.exe
  2⤵
  PID:11628
- C:\Windows\System\ReBOFZT.exe
  C:\Windows\System\ReBOFZT.exe
  2⤵
  PID:10572
- C:\Windows\System\AowXvkM.exe
  C:\Windows\System\AowXvkM.exe
  2⤵
  PID:9596
- C:\Windows\System\yxiXCNe.exe
  C:\Windows\System\yxiXCNe.exe
  2⤵
  PID:11500
- C:\Windows\System\BDDtiYv.exe
  C:\Windows\System\BDDtiYv.exe
  2⤵
  PID:12100
- C:\Windows\System\hJNORpL.exe
  C:\Windows\System\hJNORpL.exe
  2⤵
  PID:12208
- C:\Windows\System\NRyqfcY.exe
  C:\Windows\System\NRyqfcY.exe
  2⤵
  PID:11648
- C:\Windows\System\ecPKeIx.exe
  C:\Windows\System\ecPKeIx.exe
  2⤵
  PID:12240
- C:\Windows\System\nfFmqHQ.exe
  C:\Windows\System\nfFmqHQ.exe
  2⤵
  PID:11320
- C:\Windows\System\IbbbBLa.exe
  C:\Windows\System\IbbbBLa.exe
  2⤵
  PID:11804
- C:\Windows\System\bkGtHcy.exe
  C:\Windows\System\bkGtHcy.exe
  2⤵
  PID:11868
- C:\Windows\System\wRVVdZp.exe
  C:\Windows\System\wRVVdZp.exe
  2⤵
  PID:12296
- C:\Windows\System\LmUliDu.exe
  C:\Windows\System\LmUliDu.exe
  2⤵
  PID:12316
- C:\Windows\System\GsfIhEH.exe
  C:\Windows\System\GsfIhEH.exe
  2⤵
  PID:12336
- C:\Windows\System\bKbVsSx.exe
  C:\Windows\System\bKbVsSx.exe
  2⤵
  PID:12360
- C:\Windows\System\GtdtdKG.exe
  C:\Windows\System\GtdtdKG.exe
  2⤵
  PID:12380
- C:\Windows\System\DLuUyoR.exe
  C:\Windows\System\DLuUyoR.exe
  2⤵
  PID:12404
- C:\Windows\System\Psyrizn.exe
  C:\Windows\System\Psyrizn.exe
  2⤵
  PID:12436
- C:\Windows\System\KAwnAqa.exe
  C:\Windows\System\KAwnAqa.exe
  2⤵
  PID:12468
- C:\Windows\System\AKPefHa.exe
  C:\Windows\System\AKPefHa.exe
  2⤵
  PID:12488
- C:\Windows\System\nNNjgqG.exe
  C:\Windows\System\nNNjgqG.exe
  2⤵
  PID:12516
- C:\Windows\System\HEbwiZL.exe
  C:\Windows\System\HEbwiZL.exe
  2⤵
  PID:12536
- C:\Windows\System\BHiRWtI.exe
  C:\Windows\System\BHiRWtI.exe
  2⤵
  PID:12560
- C:\Windows\System\pMIbQVE.exe
  C:\Windows\System\pMIbQVE.exe
  2⤵
  PID:12584
- C:\Windows\System\UFdNauB.exe
  C:\Windows\System\UFdNauB.exe
  2⤵
  PID:12604
- C:\Windows\System\fpXfnfK.exe
  C:\Windows\System\fpXfnfK.exe
  2⤵
  PID:12628
- C:\Windows\System\zPQCljm.exe
  C:\Windows\System\zPQCljm.exe
  2⤵
  PID:12644
- C:\Windows\System\wofQNfb.exe
  C:\Windows\System\wofQNfb.exe
  2⤵
  PID:12664
- C:\Windows\System\xYeSqFz.exe
  C:\Windows\System\xYeSqFz.exe
  2⤵
  PID:12684
- C:\Windows\System\DStDyee.exe
  C:\Windows\System\DStDyee.exe
  2⤵
  PID:12704
- C:\Windows\System\XZmZsHh.exe
  C:\Windows\System\XZmZsHh.exe
  2⤵
  PID:12724
- C:\Windows\System\NJURHsJ.exe
  C:\Windows\System\NJURHsJ.exe
  2⤵
  PID:12740
- C:\Windows\System\cuCBCKh.exe
  C:\Windows\System\cuCBCKh.exe
  2⤵
  PID:12756
- C:\Windows\System\pnqCfom.exe
  C:\Windows\System\pnqCfom.exe
  2⤵
  PID:12776
- C:\Windows\System\MxghinS.exe
  C:\Windows\System\MxghinS.exe
  2⤵
  PID:12792
- C:\Windows\System\eGHJErC.exe
  C:\Windows\System\eGHJErC.exe
  2⤵
  PID:12816
- C:\Windows\System\VvAwAxx.exe
  C:\Windows\System\VvAwAxx.exe
  2⤵
  PID:12832
- C:\Windows\System\pYcKhTp.exe
  C:\Windows\System\pYcKhTp.exe
  2⤵
  PID:12848
- C:\Windows\System\hDxEBYz.exe
  C:\Windows\System\hDxEBYz.exe
  2⤵
  PID:12864
- C:\Windows\System\uVGTpPU.exe
  C:\Windows\System\uVGTpPU.exe
  2⤵
  PID:12880
- C:\Windows\System\NIapRdB.exe
  C:\Windows\System\NIapRdB.exe
  2⤵
  PID:12896
- C:\Windows\System\MvmawKp.exe
  C:\Windows\System\MvmawKp.exe
  2⤵
  PID:12912
- C:\Windows\System\IKjMmKx.exe
  C:\Windows\System\IKjMmKx.exe
  2⤵
  PID:12928
- C:\Windows\System\hrUIJYx.exe
  C:\Windows\System\hrUIJYx.exe
  2⤵
  PID:12948
- C:\Windows\System\AaJtNDz.exe
  C:\Windows\System\AaJtNDz.exe
  2⤵
  PID:12964
- C:\Windows\System\nrEsYPw.exe
  C:\Windows\System\nrEsYPw.exe
  2⤵
  PID:12984
- C:\Windows\System\DocHbKE.exe
  C:\Windows\System\DocHbKE.exe
  2⤵
  PID:13008
- C:\Windows\System\JYGPOFo.exe
  C:\Windows\System\JYGPOFo.exe
  2⤵
  PID:13028
- C:\Windows\System\nZGXYqH.exe
  C:\Windows\System\nZGXYqH.exe
  2⤵
  PID:13048
- C:\Windows\System\mPTsRNW.exe
  C:\Windows\System\mPTsRNW.exe
  2⤵
  PID:13068
- C:\Windows\System\HjOXJAc.exe
  C:\Windows\System\HjOXJAc.exe
  2⤵
  PID:13088
- C:\Windows\System\lNtBIdq.exe
  C:\Windows\System\lNtBIdq.exe
  2⤵
  PID:13108
- C:\Windows\System\EDpbOCv.exe
  C:\Windows\System\EDpbOCv.exe
  2⤵
  PID:13136
- C:\Windows\System\PCgqQbc.exe
  C:\Windows\System\PCgqQbc.exe
  2⤵
  PID:13152
- C:\Windows\System\dFmxKKw.exe
  C:\Windows\System\dFmxKKw.exe
  2⤵
  PID:13176
- C:\Windows\System\YxgDsGJ.exe
  C:\Windows\System\YxgDsGJ.exe
  2⤵
  PID:11080
- C:\Windows\System\jPUefzz.exe
  C:\Windows\System\jPUefzz.exe
  2⤵
  PID:12188
- C:\Windows\System\MFobEhy.exe
  C:\Windows\System\MFobEhy.exe
  2⤵
  PID:11624
- C:\Windows\System\FTNvifl.exe
  C:\Windows\System\FTNvifl.exe
  2⤵
  PID:11680
- C:\Windows\System\XpyZdWk.exe
  C:\Windows\System\XpyZdWk.exe
  2⤵
  PID:13228
- C:\Windows\System\XuYEohn.exe
  C:\Windows\System\XuYEohn.exe
  2⤵
  PID:13200
- C:\Windows\System\xbrpwpb.exe
  C:\Windows\System\xbrpwpb.exe
  2⤵
  PID:10232
- C:\Windows\System\yrHEtnM.exe
  C:\Windows\System\yrHEtnM.exe
  2⤵
  PID:684
- C:\Windows\System\vQDkhTU.exe
  C:\Windows\System\vQDkhTU.exe
  2⤵
  PID:6048
- C:\Windows\System\lkVJVUB.exe
  C:\Windows\System\lkVJVUB.exe
  2⤵
  PID:12944
- C:\Windows\System\GXbJYvv.exe
  C:\Windows\System\GXbJYvv.exe
  2⤵
  PID:6100
- C:\Windows\System\IBvfSgj.exe
  C:\Windows\System\IBvfSgj.exe
  2⤵
  PID:4448
- C:\Windows\System\RgNMQuq.exe
  C:\Windows\System\RgNMQuq.exe
  2⤵
  PID:12752
- C:\Windows\System\oYoIVmH.exe
  C:\Windows\System\oYoIVmH.exe
  2⤵
  PID:5164
- C:\Windows\System\jgYMhex.exe
  C:\Windows\System\jgYMhex.exe
  2⤵
  PID:12348
- C:\Windows\System\ovXIqRo.exe
  C:\Windows\System\ovXIqRo.exe
  2⤵
  PID:11384
- C:\Windows\System\JIPkksN.exe
  C:\Windows\System\JIPkksN.exe
  2⤵
  PID:13196
- C:\Windows\System\PyuKRmf.exe
  C:\Windows\System\PyuKRmf.exe
  2⤵
  PID:13000
- C:\Windows\System\lasfCqD.exe
  C:\Windows\System\lasfCqD.exe
  2⤵
  PID:12324
- C:\Windows\System\yspPmtB.exe
  C:\Windows\System\yspPmtB.exe
  2⤵
  PID:4932
- C:\Windows\System\qfLHFCg.exe
  C:\Windows\System\qfLHFCg.exe
  2⤵
  PID:12660
- C:\Windows\System\VAMKaoj.exe
  C:\Windows\System\VAMKaoj.exe
  2⤵
  PID:11912
- C:\Windows\System\GQFWskk.exe
  C:\Windows\System\GQFWskk.exe
  2⤵
  PID:3744
- C:\Windows\System\gZoxOLg.exe
  C:\Windows\System\gZoxOLg.exe
  2⤵
  PID:4336
- C:\Windows\System\IJJIlxa.exe
  C:\Windows\System\IJJIlxa.exe
  2⤵
  PID:408
- C:\Windows\System\KpRLzuC.exe
  C:\Windows\System\KpRLzuC.exe
  2⤵
  PID:1840
- C:\Windows\System\AhbpNKx.exe
  C:\Windows\System\AhbpNKx.exe
  2⤵
  PID:4848
- C:\Windows\System\xIMiCdF.exe
  C:\Windows\System\xIMiCdF.exe
  2⤵
  PID:1220
- C:\Windows\System\BBCDgUN.exe
  C:\Windows\System\BBCDgUN.exe
  2⤵
  PID:4912
- C:\Windows\System\EpMTWig.exe
  C:\Windows\System\EpMTWig.exe
  2⤵
  PID:3924
- C:\Windows\System\nuWZTGD.exe
  C:\Windows\System\nuWZTGD.exe
  2⤵
  PID:10564
- C:\Windows\System\kuNeaSo.exe
  C:\Windows\System\kuNeaSo.exe
  2⤵
  PID:548
- C:\Windows\System\HrLXXtN.exe
  C:\Windows\System\HrLXXtN.exe
  2⤵
  PID:12784
- C:\Windows\System\nWHfsYo.exe
  C:\Windows\System\nWHfsYo.exe
  2⤵
  PID:11696
- C:\Windows\System\mNrukyl.exe
  C:\Windows\System\mNrukyl.exe
  2⤵
  PID:948
- C:\Windows\System\sBtHpex.exe
  C:\Windows\System\sBtHpex.exe
  2⤵
  PID:11616
- C:\Windows\System\SPFnjsL.exe
  C:\Windows\System\SPFnjsL.exe
  2⤵
  PID:6148
- C:\Windows\System\xGjWihw.exe
  C:\Windows\System\xGjWihw.exe
  2⤵
  PID:6164
- C:\Windows\System\ZDAYDPW.exe
  C:\Windows\System\ZDAYDPW.exe
  2⤵
  PID:6200
- C:\Windows\System\gNQclID.exe
  C:\Windows\System\gNQclID.exe
  2⤵
  PID:6248
- C:\Windows\System\EqYikfc.exe
  C:\Windows\System\EqYikfc.exe
  2⤵
  PID:6280
- C:\Windows\System\gcjMaOx.exe
  C:\Windows\System\gcjMaOx.exe
  2⤵
  PID:6480
- C:\Windows\System\rHonFgY.exe
  C:\Windows\System\rHonFgY.exe
  2⤵
  PID:6644
- C:\Windows\System\LeJlSvt.exe
  C:\Windows\System\LeJlSvt.exe
  2⤵
  PID:6680
- C:\Windows\System\SKPapHk.exe
  C:\Windows\System\SKPapHk.exe
  2⤵
  PID:6740
- C:\Windows\System\TOVrrZE.exe
  C:\Windows\System\TOVrrZE.exe
  2⤵
  PID:6828
- C:\Windows\System\jOgXqOm.exe
  C:\Windows\System\jOgXqOm.exe
  2⤵
  PID:6892
- C:\Windows\System\OqxugkL.exe
  C:\Windows\System\OqxugkL.exe
  2⤵
  PID:7088
- C:\Windows\System\urgczzL.exe
  C:\Windows\System\urgczzL.exe
  2⤵
  PID:2888
- C:\Windows\System\WUNKVeK.exe
  C:\Windows\System\WUNKVeK.exe
  2⤵
  PID:5288
- C:\Windows\System\vuotvBY.exe
  C:\Windows\System\vuotvBY.exe
  2⤵
  PID:6456
- C:\Windows\System\AvwuqQM.exe
  C:\Windows\System\AvwuqQM.exe
  2⤵
  PID:6328
- C:\Windows\System\BNcITbl.exe
  C:\Windows\System\BNcITbl.exe
  2⤵
  PID:6376
- C:\Windows\System\URACjrT.exe
  C:\Windows\System\URACjrT.exe
  2⤵
  PID:6472
- C:\Windows\System\wbJXNPG.exe
  C:\Windows\System\wbJXNPG.exe
  2⤵
  PID:6232
- C:\Windows\System\AhGgAXi.exe
  C:\Windows\System\AhGgAXi.exe
  2⤵
  PID:6332
- C:\Windows\System\gQqPXJV.exe
  C:\Windows\System\gQqPXJV.exe
  2⤵
  PID:1520
- C:\Windows\System\JgncsJO.exe
  C:\Windows\System\JgncsJO.exe
  2⤵
  PID:4404
- C:\Windows\System\DwffWYe.exe
  C:\Windows\System\DwffWYe.exe
  2⤵
  PID:13204
- C:\Windows\System\JdIhrHq.exe
  C:\Windows\System\JdIhrHq.exe
  2⤵
  PID:12748
- C:\Windows\System\WGXAhfQ.exe
  C:\Windows\System\WGXAhfQ.exe
  2⤵
  PID:2280
- C:\Windows\System\uVkxGth.exe
  C:\Windows\System\uVkxGth.exe
  2⤵
  PID:4704
- C:\Windows\System\McPDpUS.exe
  C:\Windows\System\McPDpUS.exe
  2⤵
  PID:12768
- C:\Windows\System\yJvhTiA.exe
  C:\Windows\System\yJvhTiA.exe
  2⤵
  PID:3900
- C:\Windows\System\OKDgefr.exe
  C:\Windows\System\OKDgefr.exe
  2⤵
  PID:4756
- C:\Windows\System\HaWHQgs.exe
  C:\Windows\System\HaWHQgs.exe
  2⤵
  PID:12716
- C:\Windows\System\DDiRHcS.exe
  C:\Windows\System\DDiRHcS.exe
  2⤵
  PID:11996
- C:\Windows\System\CaNNJqH.exe
  C:\Windows\System\CaNNJqH.exe
  2⤵
  PID:1436
- C:\Windows\System\NaEgzJD.exe
  C:\Windows\System\NaEgzJD.exe
  2⤵
  PID:4468
- C:\Windows\System\UJIxIpz.exe
  C:\Windows\System\UJIxIpz.exe
  2⤵
  PID:4152
- C:\Windows\System\kKrBbUJ.exe
  C:\Windows\System\kKrBbUJ.exe
  2⤵
  PID:4804
- C:\Windows\System\ODfYokc.exe
  C:\Windows\System\ODfYokc.exe
  2⤵
  PID:5132
- C:\Windows\System\jFduDxE.exe
  C:\Windows\System\jFduDxE.exe
  2⤵
  PID:11660
- C:\Windows\System\YTQoAcy.exe
  C:\Windows\System\YTQoAcy.exe
  2⤵
  PID:12388
- C:\Windows\System\lOMZMse.exe
  C:\Windows\System\lOMZMse.exe
  2⤵
  PID:4548
- C:\Windows\System\PnqgzDF.exe
  C:\Windows\System\PnqgzDF.exe
  2⤵
  PID:13124
- C:\Windows\System\CvtxkIX.exe
  C:\Windows\System\CvtxkIX.exe
  2⤵
  PID:3320
- C:\Windows\System\kktQyJn.exe
  C:\Windows\System\kktQyJn.exe
  2⤵
  PID:12636
- C:\Windows\System\DlDQxjT.exe
  C:\Windows\System\DlDQxjT.exe
  2⤵
  PID:6196
- C:\Windows\System\buJBMRu.exe
  C:\Windows\System\buJBMRu.exe
  2⤵
  PID:6368
- C:\Windows\System\GKQyLSD.exe
  C:\Windows\System\GKQyLSD.exe
  2⤵
  PID:6444
- C:\Windows\System\YiFjqCB.exe
  C:\Windows\System\YiFjqCB.exe
  2⤵
  PID:5340
- C:\Windows\System\XSHkdED.exe
  C:\Windows\System\XSHkdED.exe
  2⤵
  PID:6404
- C:\Windows\System\TuteUnY.exe
  C:\Windows\System\TuteUnY.exe
  2⤵
  PID:6256
- C:\Windows\System\HmxttOb.exe
  C:\Windows\System\HmxttOb.exe
  2⤵
  PID:6580
- C:\Windows\System\IUHMlwW.exe
  C:\Windows\System\IUHMlwW.exe
  2⤵
  PID:5512
- C:\Windows\System\IXkAmMe.exe
  C:\Windows\System\IXkAmMe.exe
  2⤵
  PID:6008
- C:\Windows\System\bZSPLSo.exe
  C:\Windows\System\bZSPLSo.exe
  2⤵
  PID:12804
- C:\Windows\System\xOiXAUN.exe
  C:\Windows\System\xOiXAUN.exe
  2⤵
  PID:6300
- C:\Windows\System\XcaDoWf.exe
  C:\Windows\System\XcaDoWf.exe
  2⤵
  PID:12376
- C:\Windows\System\cIXDAEz.exe
  C:\Windows\System\cIXDAEz.exe
  2⤵
  PID:7036
- C:\Windows\System\kthIKYj.exe
  C:\Windows\System\kthIKYj.exe
  2⤵
  PID:6308
- C:\Windows\System\oaXQIxx.exe
  C:\Windows\System\oaXQIxx.exe
  2⤵
  PID:6220
- C:\Windows\System\quKCcfa.exe
  C:\Windows\System\quKCcfa.exe
  2⤵
  PID:4296
- C:\Windows\System\EdQsTlj.exe
  C:\Windows\System\EdQsTlj.exe
  2⤵
  PID:12712
- C:\Windows\System\aRokJaW.exe
  C:\Windows\System\aRokJaW.exe
  2⤵
  PID:4376
- C:\Windows\System\lEfJsDg.exe
  C:\Windows\System\lEfJsDg.exe
  2⤵
  PID:4924
- C:\Windows\System\vbMmbZe.exe
  C:\Windows\System\vbMmbZe.exe
  2⤵
  PID:4028
- C:\Windows\System\yLvIDJj.exe
  C:\Windows\System\yLvIDJj.exe
  2⤵
  PID:1648
- C:\Windows\System\XxSCdPt.exe
  C:\Windows\System\XxSCdPt.exe
  2⤵
  PID:2424
- C:\Windows\System\TfLLTRJ.exe
  C:\Windows\System\TfLLTRJ.exe
  2⤵
  PID:13736
- C:\Windows\System\NnIOCYc.exe
  C:\Windows\System\NnIOCYc.exe
  2⤵
  PID:14144
- C:\Windows\System\tRicUxZ.exe
  C:\Windows\System\tRicUxZ.exe
  2⤵
  PID:14164
- C:\Windows\System\mTJiofr.exe
  C:\Windows\System\mTJiofr.exe
  2⤵
  PID:14180
- C:\Windows\System\JiTvKMu.exe
  C:\Windows\System\JiTvKMu.exe
  2⤵
  PID:14204
- C:\Windows\System\DgRAlQA.exe
  C:\Windows\System\DgRAlQA.exe
  2⤵
  PID:14292
- C:\Windows\System\LDoOpBp.exe
  C:\Windows\System\LDoOpBp.exe
  2⤵
  PID:5372
- C:\Windows\System\QmzUHVv.exe
  C:\Windows\System\QmzUHVv.exe
  2⤵
  PID:12844
- C:\Windows\System\ZLkOiAv.exe
  C:\Windows\System\ZLkOiAv.exe
  2⤵
  PID:11784
- C:\Windows\System\LlaQGsB.exe
  C:\Windows\System\LlaQGsB.exe
  2⤵
  PID:6424
- C:\Windows\System\IbbddHr.exe
  C:\Windows\System\IbbddHr.exe
  2⤵
  PID:5524
- C:\Windows\System\iVVlBoN.exe
  C:\Windows\System\iVVlBoN.exe
  2⤵
  PID:13388
- C:\Windows\System\UsuYXQx.exe
  C:\Windows\System\UsuYXQx.exe
  2⤵
  PID:13468
- C:\Windows\System\xEUMkYm.exe
  C:\Windows\System\xEUMkYm.exe
  2⤵
  PID:13540
- C:\Windows\System\NArVuvW.exe
  C:\Windows\System\NArVuvW.exe
  2⤵
  PID:12856
- C:\Windows\System\KMCEQzs.exe
  C:\Windows\System\KMCEQzs.exe
  2⤵
  PID:13348
- C:\Windows\System\VkNnQNg.exe
  C:\Windows\System\VkNnQNg.exe
  2⤵
  PID:3156
- C:\Windows\System\QTOiDNf.exe
  C:\Windows\System\QTOiDNf.exe
  2⤵
  PID:13496
- C:\Windows\System\mjtquYO.exe
  C:\Windows\System\mjtquYO.exe
  2⤵
  PID:13504
- C:\Windows\System\yBimiqB.exe
  C:\Windows\System\yBimiqB.exe
  2⤵
  PID:9808
- C:\Windows\System\WqOomLW.exe
  C:\Windows\System\WqOomLW.exe
  2⤵
  PID:13700
- C:\Windows\System\HVSvTtn.exe
  C:\Windows\System\HVSvTtn.exe
  2⤵
  PID:13548
- C:\Windows\System\PjEfKwr.exe
  C:\Windows\System\PjEfKwr.exe
  2⤵
  PID:13680
- C:\Windows\System\TXHhrXn.exe
  C:\Windows\System\TXHhrXn.exe
  2⤵
  PID:13668
- C:\Windows\System\GImJVDv.exe
  C:\Windows\System\GImJVDv.exe
  2⤵
  PID:13636
- C:\Windows\System\LURPjfV.exe
  C:\Windows\System\LURPjfV.exe
  2⤵
  PID:13708
- C:\Windows\System\fneNqqX.exe
  C:\Windows\System\fneNqqX.exe
  2⤵
  PID:13800
- C:\Windows\System\hJQlOHG.exe
  C:\Windows\System\hJQlOHG.exe
  2⤵
  PID:12112
- C:\Windows\System\ucXokIC.exe
  C:\Windows\System\ucXokIC.exe
  2⤵
  PID:5688
- C:\Windows\System\pOliCkP.exe
  C:\Windows\System\pOliCkP.exe
  2⤵
  PID:13784
- C:\Windows\System\iwjwnaI.exe
  C:\Windows\System\iwjwnaI.exe
  2⤵
  PID:6060
- C:\Windows\System\QnZVBxM.exe
  C:\Windows\System\QnZVBxM.exe
  2⤵
  PID:13076
- C:\Windows\System\FgZGudA.exe
  C:\Windows\System\FgZGudA.exe
  2⤵
  PID:5952
- C:\Windows\System\UEBgZtd.exe
  C:\Windows\System\UEBgZtd.exe
  2⤵
  PID:5748
- C:\Windows\System\YwZWyQp.exe
  C:\Windows\System\YwZWyQp.exe
  2⤵
  PID:13772
- C:\Windows\System\tCUcMYm.exe
  C:\Windows\System\tCUcMYm.exe
  2⤵
  PID:12344
- C:\Windows\System\ENIqmpz.exe
  C:\Windows\System\ENIqmpz.exe
  2⤵
  PID:12700
- C:\Windows\System\jsAswWY.exe
  C:\Windows\System\jsAswWY.exe
  2⤵
  PID:7156
- C:\Windows\System\aRGwCeC.exe
  C:\Windows\System\aRGwCeC.exe
  2⤵
  PID:13888
- C:\Windows\System\sQzEZPy.exe
  C:\Windows\System\sQzEZPy.exe
  2⤵
  PID:5300
- C:\Windows\System\XUAAChg.exe
  C:\Windows\System\XUAAChg.exe
  2⤵
  PID:5668
- C:\Windows\System\SFhTDGD.exe
  C:\Windows\System\SFhTDGD.exe
  2⤵
  PID:13904
- C:\Windows\System\gJykHWi.exe
  C:\Windows\System\gJykHWi.exe
  2⤵
  PID:1508
- C:\Windows\System\AAgtPEM.exe
  C:\Windows\System\AAgtPEM.exe
  2⤵
  PID:13896
- C:\Windows\System\RpRuvgc.exe
  C:\Windows\System\RpRuvgc.exe
  2⤵
  PID:6032
- C:\Windows\System\EUfegBo.exe
  C:\Windows\System\EUfegBo.exe
  2⤵
  PID:5924
- C:\Windows\System\pzSkUtt.exe
  C:\Windows\System\pzSkUtt.exe
  2⤵
  PID:6000
- C:\Windows\System\bpLSYmg.exe
  C:\Windows\System\bpLSYmg.exe
  2⤵
  PID:13968
- C:\Windows\System\DPbCUfN.exe
  C:\Windows\System\DPbCUfN.exe
  2⤵
  PID:6084
- C:\Windows\System\hsHflsL.exe
  C:\Windows\System\hsHflsL.exe
  2⤵
  PID:5656
- C:\Windows\System\jtBtMwt.exe
  C:\Windows\System\jtBtMwt.exe
  2⤵
  PID:5408
- C:\Windows\System\SdHyXUO.exe
  C:\Windows\System\SdHyXUO.exe
  2⤵
  PID:14060
- C:\Windows\System\EAwsNOL.exe
  C:\Windows\System\EAwsNOL.exe
  2⤵
  PID:14100
- C:\Windows\System\FDACbMA.exe
  C:\Windows\System\FDACbMA.exe
  2⤵
  PID:7108
- C:\Windows\System\LxLKnsv.exe
  C:\Windows\System\LxLKnsv.exe
  2⤵
  PID:14196
- C:\Windows\System\hmdoKUH.exe
  C:\Windows\System\hmdoKUH.exe
  2⤵
  PID:13188
- C:\Windows\System\gcFfVVu.exe
  C:\Windows\System\gcFfVVu.exe
  2⤵
  PID:13412
- C:\Windows\System\sNOyaUN.exe
  C:\Windows\System\sNOyaUN.exe
  2⤵
  PID:13328
- C:\Windows\System\IPnxlCX.exe
  C:\Windows\System\IPnxlCX.exe
  2⤵
  PID:6216
- C:\Windows\System\MsRyAgl.exe
  C:\Windows\System\MsRyAgl.exe
  2⤵
  PID:4656
- C:\Windows\System\yPQKAYM.exe
  C:\Windows\System\yPQKAYM.exe
  2⤵
  PID:13384
- C:\Windows\System\sKoJCVD.exe
  C:\Windows\System\sKoJCVD.exe
  2⤵
  PID:13520
- C:\Windows\System\kRjVzNi.exe
  C:\Windows\System\kRjVzNi.exe
  2⤵
  PID:13556
- C:\Windows\System\ZiZculp.exe
  C:\Windows\System\ZiZculp.exe
  2⤵
  PID:13276
- C:\Windows\System\gmwGXek.exe
  C:\Windows\System\gmwGXek.exe
  2⤵
  PID:6976
- C:\Windows\System\peHJPlx.exe
  C:\Windows\System\peHJPlx.exe
  2⤵
  PID:13572
- C:\Windows\System\vnpViti.exe
  C:\Windows\System\vnpViti.exe
  2⤵
  PID:756
- C:\Windows\System\EfQexwJ.exe
  C:\Windows\System\EfQexwJ.exe
  2⤵
  PID:5612
- C:\Windows\System\mmkeGOY.exe
  C:\Windows\System\mmkeGOY.exe
  2⤵
  PID:7632
- C:\Windows\System\iEZbJjs.exe
  C:\Windows\System\iEZbJjs.exe
  2⤵
  PID:7668
- C:\Windows\System\emNrIRE.exe
  C:\Windows\System\emNrIRE.exe
  2⤵
  PID:6096
- C:\Windows\System\etKWtHW.exe
  C:\Windows\System\etKWtHW.exe
  2⤵
  PID:7420
- C:\Windows\System\FMTYFDx.exe
  C:\Windows\System\FMTYFDx.exe
  2⤵
  PID:5356
- C:\Windows\System\FzyHVXZ.exe
  C:\Windows\System\FzyHVXZ.exe
  2⤵
  PID:13920
- C:\Windows\System\YiBIGnd.exe
  C:\Windows\System\YiBIGnd.exe
  2⤵
  PID:3068
- C:\Windows\System\lrarGYC.exe
  C:\Windows\System\lrarGYC.exe
  2⤵
  PID:7752
- C:\Windows\System\DtDVQGe.exe
  C:\Windows\System\DtDVQGe.exe
  2⤵
  PID:5636
- C:\Windows\System\gJrLKqz.exe
  C:\Windows\System\gJrLKqz.exe
  2⤵
  PID:13120
- C:\Windows\System\DgGmwnM.exe
  C:\Windows\System\DgGmwnM.exe
  2⤵
  PID:4380
- C:\Windows\System\MJYydSc.exe
  C:\Windows\System\MJYydSc.exe
  2⤵
  PID:5928
- C:\Windows\System\snNkEQG.exe
  C:\Windows\System\snNkEQG.exe
  2⤵
  PID:5256
- C:\Windows\System\bzHFIVX.exe
  C:\Windows\System\bzHFIVX.exe
  2⤵
  PID:5136
- C:\Windows\System\UQxwNdo.exe
  C:\Windows\System\UQxwNdo.exe
  2⤵
  PID:13360
- C:\Windows\System\wwZIXjK.exe
  C:\Windows\System\wwZIXjK.exe
  2⤵
  PID:14092
- C:\Windows\System\sdazvGB.exe
  C:\Windows\System\sdazvGB.exe
  2⤵
  PID:14116
- C:\Windows\System\SfXRNMP.exe
  C:\Windows\System\SfXRNMP.exe
  2⤵
  PID:6916
- C:\Windows\System\bfVQaAa.exe
  C:\Windows\System\bfVQaAa.exe
  2⤵
  PID:14176
- C:\Windows\System\eeVUeOG.exe
  C:\Windows\System\eeVUeOG.exe
  2⤵
  PID:2976
- C:\Windows\System\OCnNdAR.exe
  C:\Windows\System\OCnNdAR.exe
  2⤵
  PID:14084
- C:\Windows\System\dptkfzV.exe
  C:\Windows\System\dptkfzV.exe
  2⤵
  PID:6652
- C:\Windows\System\PXicHqg.exe
  C:\Windows\System\PXicHqg.exe
  2⤵
  PID:6744
- C:\Windows\System\aKzZHNW.exe
  C:\Windows\System\aKzZHNW.exe
  2⤵
  PID:7240
- C:\Windows\System\FeNjTcp.exe
  C:\Windows\System\FeNjTcp.exe
  2⤵
  PID:952
- C:\Windows\System\zpRVSjm.exe
  C:\Windows\System\zpRVSjm.exe
  2⤵
  PID:2196
- C:\Windows\System\JchrepW.exe
  C:\Windows\System\JchrepW.exe
  2⤵
  PID:14332
- C:\Windows\System\dGSeiBf.exe
  C:\Windows\System\dGSeiBf.exe
  2⤵
  PID:14256
- C:\Windows\System\dDFLeXS.exe
  C:\Windows\System\dDFLeXS.exe
  2⤵
  PID:664
- C:\Windows\System\Vcblkwi.exe
  C:\Windows\System\Vcblkwi.exe
  2⤵
  PID:7128
- C:\Windows\System\JiqLcpV.exe
  C:\Windows\System\JiqLcpV.exe
  2⤵
  PID:4108
- C:\Windows\System\VwYTLFd.exe
  C:\Windows\System\VwYTLFd.exe
  2⤵
  PID:14268
- C:\Windows\System\oZGVWbc.exe
  C:\Windows\System\oZGVWbc.exe
  2⤵
  PID:6520
- C:\Windows\System\xFehVHA.exe
  C:\Windows\System\xFehVHA.exe
  2⤵
  PID:7332
- C:\Windows\System\NpJixQE.exe
  C:\Windows\System\NpJixQE.exe
  2⤵
  PID:7848
- C:\Windows\System\efrqHaP.exe
  C:\Windows\System\efrqHaP.exe
  2⤵
  PID:14260
- C:\Windows\System\VgfwkTQ.exe
  C:\Windows\System\VgfwkTQ.exe
  2⤵
  PID:7856
- C:\Windows\System\XmafilK.exe
  C:\Windows\System\XmafilK.exe
  2⤵
  PID:7764
- C:\Windows\System\RpjNuRU.exe
  C:\Windows\System\RpjNuRU.exe
  2⤵
  PID:13460
- C:\Windows\System\jDURZiU.exe
  C:\Windows\System\jDURZiU.exe
  2⤵
  PID:7112
- C:\Windows\System\UkdkSEl.exe
  C:\Windows\System\UkdkSEl.exe
  2⤵
  PID:5148
- C:\Windows\System\NHWHNkD.exe
  C:\Windows\System\NHWHNkD.exe
  2⤵
  PID:7148
- C:\Windows\System\qCBoixR.exe
  C:\Windows\System\qCBoixR.exe
  2⤵
  PID:14252
- C:\Windows\System\iEBmzgQ.exe
  C:\Windows\System\iEBmzgQ.exe
  2⤵
  PID:13660
- C:\Windows\System\KCNFEPm.exe
  C:\Windows\System\KCNFEPm.exe
  2⤵
  PID:7904
- C:\Windows\System\GWzYEjL.exe
  C:\Windows\System\GWzYEjL.exe
  2⤵
  PID:13760
- C:\Windows\System\ImOfPXd.exe
  C:\Windows\System\ImOfPXd.exe
  2⤵
  PID:7488
- C:\Windows\System\iDygLPw.exe
  C:\Windows\System\iDygLPw.exe
  2⤵
  PID:13628
- C:\Windows\System\JbxwCBE.exe
  C:\Windows\System\JbxwCBE.exe
  2⤵
  PID:13992
- C:\Windows\System\glCFlco.exe
  C:\Windows\System\glCFlco.exe
  2⤵
  PID:7496
- C:\Windows\System\ziuwZyl.exe
  C:\Windows\System\ziuwZyl.exe
  2⤵
  PID:6260
- C:\Windows\System\PkRApgJ.exe
  C:\Windows\System\PkRApgJ.exe
  2⤵
  PID:8096
- C:\Windows\System\JcOqzGR.exe
  C:\Windows\System\JcOqzGR.exe
  2⤵
  PID:13900
- C:\Windows\System\BVDzuxj.exe
  C:\Windows\System\BVDzuxj.exe
  2⤵
  PID:7044
- C:\Windows\System\JhXeUVU.exe
  C:\Windows\System\JhXeUVU.exe
  2⤵
  PID:7620
- C:\Windows\System\SfnwtnV.exe
  C:\Windows\System\SfnwtnV.exe
  2⤵
  PID:14120
- C:\Windows\System\nuJrgTP.exe
  C:\Windows\System\nuJrgTP.exe
  2⤵
  PID:13492
- C:\Windows\System\QYRDZMD.exe
  C:\Windows\System\QYRDZMD.exe
  2⤵
  PID:5332
- C:\Windows\System\xopnRzZ.exe
  C:\Windows\System\xopnRzZ.exe
  2⤵
  PID:764
- C:\Windows\System\YGZUdzA.exe
  C:\Windows\System\YGZUdzA.exe
  2⤵
  PID:13064
- C:\Windows\System\UyvcUyK.exe
  C:\Windows\System\UyvcUyK.exe
  2⤵
  PID:6912
- C:\Windows\System\bbJUcCK.exe
  C:\Windows\System\bbJUcCK.exe
  2⤵
  PID:14248
- C:\Windows\System\vFUjJfU.exe
  C:\Windows\System\vFUjJfU.exe
  2⤵
  PID:7828
- C:\Windows\System\rPdUrFl.exe
  C:\Windows\System\rPdUrFl.exe
  2⤵
  PID:7996
- C:\Windows\System\ROvgZIj.exe
  C:\Windows\System\ROvgZIj.exe
  2⤵
  PID:10860
- C:\Windows\System\EGScuVj.exe
  C:\Windows\System\EGScuVj.exe
  2⤵
  PID:5004
- C:\Windows\System\JSaKlER.exe
  C:\Windows\System\JSaKlER.exe
  2⤵
  PID:13432
- C:\Windows\System\fwQJiWV.exe
  C:\Windows\System\fwQJiWV.exe
  2⤵
  PID:7680
- C:\Windows\System\sSKfaVi.exe
  C:\Windows\System\sSKfaVi.exe
  2⤵
  PID:7572
- C:\Windows\System\cEJbbEO.exe
  C:\Windows\System\cEJbbEO.exe
  2⤵
  PID:13368
- C:\Windows\System\SExnvZL.exe
  C:\Windows\System\SExnvZL.exe
  2⤵
  PID:9312
- C:\Windows\System\cjpcNbi.exe
  C:\Windows\System\cjpcNbi.exe
  2⤵
  PID:9272
- C:\Windows\System\fmrxRkQ.exe
  C:\Windows\System\fmrxRkQ.exe
  2⤵
  PID:14344
- C:\Windows\System\kTygxID.exe
  C:\Windows\System\kTygxID.exe
  2⤵
  PID:14364
- C:\Windows\System\KZlplzt.exe
  C:\Windows\System\KZlplzt.exe
  2⤵
  PID:14388
- C:\Windows\System\QJZXyfl.exe
  C:\Windows\System\QJZXyfl.exe
  2⤵
  PID:14624
- C:\Windows\System\faZjQiq.exe
  C:\Windows\System\faZjQiq.exe
  2⤵
  PID:14640
- C:\Windows\System\FzXwlbr.exe
  C:\Windows\System\FzXwlbr.exe
  2⤵
  PID:14660
- C:\Windows\System\AxvPFEG.exe
  C:\Windows\System\AxvPFEG.exe
  2⤵
  PID:14680
- C:\Windows\System\XppdOae.exe
  C:\Windows\System\XppdOae.exe
  2⤵
  PID:14704
- C:\Windows\System\DABubOw.exe
  C:\Windows\System\DABubOw.exe
  2⤵
  PID:14724
- C:\Windows\System\RxHKICP.exe
  C:\Windows\System\RxHKICP.exe
  2⤵
  PID:14740
- C:\Windows\System\jBDbkCI.exe
  C:\Windows\System\jBDbkCI.exe
  2⤵
  PID:14768
- C:\Windows\System\Lrjkkvm.exe
  C:\Windows\System\Lrjkkvm.exe
  2⤵
  PID:14796
- C:\Windows\System\tIayytC.exe
  C:\Windows\System\tIayytC.exe
  2⤵
  PID:14816
- C:\Windows\System\NtPVWxC.exe
  C:\Windows\System\NtPVWxC.exe
  2⤵
  PID:14840
- C:\Windows\System\BLNTcsR.exe
  C:\Windows\System\BLNTcsR.exe
  2⤵
  PID:14872
- C:\Windows\System\chInJSZ.exe
  C:\Windows\System\chInJSZ.exe
  2⤵
  PID:14900
- C:\Windows\System\fiitxxA.exe
  C:\Windows\System\fiitxxA.exe
  2⤵
  PID:14924
- C:\Windows\System\AteCAyo.exe
  C:\Windows\System\AteCAyo.exe
  2⤵
  PID:15104
- C:\Windows\System\bGfRbnf.exe
  C:\Windows\System\bGfRbnf.exe
  2⤵
  PID:15124
- C:\Windows\System\YghoXFP.exe
  C:\Windows\System\YghoXFP.exe
  2⤵
  PID:15152
- C:\Windows\System\VABqxVQ.exe
  C:\Windows\System\VABqxVQ.exe
  2⤵
  PID:15172
- C:\Windows\System\QzYmDAU.exe
  C:\Windows\System\QzYmDAU.exe
  2⤵
  PID:15196
- C:\Windows\System\HXitzvp.exe
  C:\Windows\System\HXitzvp.exe
  2⤵
  PID:15212
- C:\Windows\System\RvdJFRS.exe
  C:\Windows\System\RvdJFRS.exe
  2⤵
  PID:15228
- C:\Windows\System\GhLPtyx.exe
  C:\Windows\System\GhLPtyx.exe
  2⤵
  PID:15244
- C:\Windows\System\aftXoyq.exe
  C:\Windows\System\aftXoyq.exe
  2⤵
  PID:15260
- C:\Windows\System\vKNvDxY.exe
  C:\Windows\System\vKNvDxY.exe
  2⤵
  PID:15276
- C:\Windows\System\FZmREKx.exe
  C:\Windows\System\FZmREKx.exe
  2⤵
  PID:15292
- C:\Windows\System\GlHToUi.exe
  C:\Windows\System\GlHToUi.exe
  2⤵
  PID:15312
- C:\Windows\System\xfSnkWZ.exe
  C:\Windows\System\xfSnkWZ.exe
  2⤵
  PID:15328
- C:\Windows\System\otHzhVu.exe
  C:\Windows\System\otHzhVu.exe
  2⤵
  PID:15344
- C:\Windows\System\JngLlak.exe
  C:\Windows\System\JngLlak.exe
  2⤵
  PID:6836
- C:\Windows\System\ZLIXoyc.exe
  C:\Windows\System\ZLIXoyc.exe
  2⤵
  PID:9168
- C:\Windows\System\WEOnfJM.exe
  C:\Windows\System\WEOnfJM.exe
  2⤵
  PID:8052
- C:\Windows\System\eeompMz.exe
  C:\Windows\System\eeompMz.exe
  2⤵
  PID:8732
- C:\Windows\System\eKBhGjt.exe
  C:\Windows\System\eKBhGjt.exe
  2⤵
  PID:9356
- C:\Windows\System\JGIpNDm.exe
  C:\Windows\System\JGIpNDm.exe
  2⤵
  PID:7292
- C:\Windows\System\IuLJSYs.exe
  C:\Windows\System\IuLJSYs.exe
  2⤵
  PID:9456
- C:\Windows\System\jFiKiuV.exe
  C:\Windows\System\jFiKiuV.exe
  2⤵
  PID:9240
- C:\Windows\System\iSqsIqt.exe
  C:\Windows\System\iSqsIqt.exe
  2⤵
  PID:8408
- C:\Windows\System\PNaLmNB.exe
  C:\Windows\System\PNaLmNB.exe
  2⤵
  PID:8460
- C:\Windows\System\vgKfJsj.exe
  C:\Windows\System\vgKfJsj.exe
  2⤵
  PID:9464
- C:\Windows\System\rIbUXaD.exe
  C:\Windows\System\rIbUXaD.exe
  2⤵
  PID:1256
- C:\Windows\System\yQzcTam.exe
  C:\Windows\System\yQzcTam.exe
  2⤵
  PID:8880
- C:\Windows\System\aeRObLf.exe
  C:\Windows\System\aeRObLf.exe
  2⤵
  PID:13964
- C:\Windows\System\vMboFvu.exe
  C:\Windows\System\vMboFvu.exe
  2⤵
  PID:6044
- C:\Windows\System\rGNrzKx.exe
  C:\Windows\System\rGNrzKx.exe
  2⤵
  PID:9424
- C:\Windows\System\PWCXMuv.exe
  C:\Windows\System\PWCXMuv.exe
  2⤵
  PID:14360
- C:\Windows\System\FcxXlTf.exe
  C:\Windows\System\FcxXlTf.exe
  2⤵
  PID:14404
- C:\Windows\System\TiOXRaO.exe
  C:\Windows\System\TiOXRaO.exe
  2⤵
  PID:14372
- C:\Windows\System\xYvAABf.exe
  C:\Windows\System\xYvAABf.exe
  2⤵
  PID:14584
- C:\Windows\System\TWYvcWA.exe
  C:\Windows\System\TWYvcWA.exe
  2⤵
  PID:9888
- C:\Windows\System\sDZovtr.exe
  C:\Windows\System\sDZovtr.exe
  2⤵
  PID:14420
- C:\Windows\System\brlPAFg.exe
  C:\Windows\System\brlPAFg.exe
  2⤵
  PID:14436
- C:\Windows\System\clJwGOX.exe
  C:\Windows\System\clJwGOX.exe
  2⤵
  PID:14496
- C:\Windows\System\JwWtLgk.exe
  C:\Windows\System\JwWtLgk.exe
  2⤵
  PID:9136
- C:\Windows\System\FVdaoEn.exe
  C:\Windows\System\FVdaoEn.exe
  2⤵
  PID:9976
- C:\Windows\System\xlHkiTQ.exe
  C:\Windows\System\xlHkiTQ.exe
  2⤵
  PID:9908
- C:\Windows\System\zfZUnuJ.exe
  C:\Windows\System\zfZUnuJ.exe
  2⤵
  PID:14732
- C:\Windows\System\BGgovHF.exe
  C:\Windows\System\BGgovHF.exe
  2⤵
  PID:14668
- C:\Windows\System\HqSYZyZ.exe
  C:\Windows\System\HqSYZyZ.exe
  2⤵
  PID:14896
- C:\Windows\System\VYGHxNH.exe
  C:\Windows\System\VYGHxNH.exe
  2⤵
  PID:14932
- C:\Windows\System\edMnAva.exe
  C:\Windows\System\edMnAva.exe
  2⤵
  PID:14752
- C:\Windows\System\iwPPhVd.exe
  C:\Windows\System\iwPPhVd.exe
  2⤵
  PID:10036
- C:\Windows\System\sOSKxIT.exe
  C:\Windows\System\sOSKxIT.exe
  2⤵
  PID:8816
- C:\Windows\System\qSHqeNh.exe
  C:\Windows\System\qSHqeNh.exe
  2⤵
  PID:15032
- C:\Windows\System\sfYDbBZ.exe
  C:\Windows\System\sfYDbBZ.exe
  2⤵
  PID:14976
- C:\Windows\System\pNEVPgG.exe
  C:\Windows\System\pNEVPgG.exe
  2⤵
  PID:15168
- C:\Windows\System\WWylHfa.exe
  C:\Windows\System\WWylHfa.exe
  2⤵
  PID:15192
- C:\Windows\System\otaHZug.exe
  C:\Windows\System\otaHZug.exe
  2⤵
  PID:8328
- C:\Windows\System\mwLVnoY.exe
  C:\Windows\System\mwLVnoY.exe
  2⤵
  PID:8448
- C:\Windows\System\FHxQigw.exe
  C:\Windows\System\FHxQigw.exe
  2⤵
  PID:10084
- C:\Windows\System\olfWXjU.exe
  C:\Windows\System\olfWXjU.exe
  2⤵
  PID:9276
- C:\Windows\System\rRlFlDN.exe
  C:\Windows\System\rRlFlDN.exe
  2⤵
  PID:8280
- C:\Windows\System\uzxMvQx.exe
  C:\Windows\System\uzxMvQx.exe
  2⤵
  PID:8856
- C:\Windows\System\pwSQyJq.exe
  C:\Windows\System\pwSQyJq.exe
  2⤵
  PID:9896
- C:\Windows\System\IsxKZsR.exe
  C:\Windows\System\IsxKZsR.exe
  2⤵
  PID:7888
- C:\Windows\System\HbwRxPo.exe
  C:\Windows\System\HbwRxPo.exe
  2⤵
  PID:14380
- C:\Windows\System\UmjKoXT.exe
  C:\Windows\System\UmjKoXT.exe
  2⤵
  PID:8772
- C:\Windows\System\dSFclya.exe
  C:\Windows\System\dSFclya.exe
  2⤵
  PID:8936
- C:\Windows\System\taxIjHX.exe
  C:\Windows\System\taxIjHX.exe
  2⤵
  PID:9012
- C:\Windows\System\QfDKncE.exe
  C:\Windows\System\QfDKncE.exe
  2⤵
  PID:14852
- C:\Windows\System\hUiVFQu.exe
  C:\Windows\System\hUiVFQu.exe
  2⤵
  PID:10180
- C:\Windows\System\dBHeIfQ.exe
  C:\Windows\System\dBHeIfQ.exe
  2⤵
  PID:9968
- C:\Windows\System\ApHTgur.exe
  C:\Windows\System\ApHTgur.exe
  2⤵
  PID:1076
- C:\Windows\System\MdvLhdW.exe
  C:\Windows\System\MdvLhdW.exe
  2⤵
  PID:7644
- C:\Windows\System\DbsKEKu.exe
  C:\Windows\System\DbsKEKu.exe
  2⤵
  PID:15256
- C:\Windows\System\RzWYjIG.exe
  C:\Windows\System\RzWYjIG.exe
  2⤵
  PID:15272
- C:\Windows\System\JrWKUKj.exe
  C:\Windows\System\JrWKUKj.exe
  2⤵
  PID:4432
- C:\Windows\System\UDtrclC.exe
  C:\Windows\System\UDtrclC.exe
  2⤵
  PID:9288
- C:\Windows\System\twudOAb.exe
  C:\Windows\System\twudOAb.exe
  2⤵
  PID:15068
- C:\Windows\System\mCjQVXL.exe
  C:\Windows\System\mCjQVXL.exe
  2⤵
  PID:9264
- C:\Windows\System\PPzzFZD.exe
  C:\Windows\System\PPzzFZD.exe
  2⤵
  PID:14776
- C:\Windows\System\lOVTmAI.exe
  C:\Windows\System\lOVTmAI.exe
  2⤵
  PID:14352
- C:\Windows\System\pblAQOF.exe
  C:\Windows\System\pblAQOF.exe
  2⤵
  PID:9320
- C:\Windows\System\XJRjSie.exe
  C:\Windows\System\XJRjSie.exe
  2⤵
  PID:9292
- C:\Windows\System\PEiGyAa.exe
  C:\Windows\System\PEiGyAa.exe
  2⤵
  PID:10196
- C:\Windows\System\vRrdayw.exe
  C:\Windows\System\vRrdayw.exe
  2⤵
  PID:14636
- C:\Windows\System\ySgbyuv.exe
  C:\Windows\System\ySgbyuv.exe
  2⤵
  PID:10124
- C:\Windows\System\dDnFtzb.exe
  C:\Windows\System\dDnFtzb.exe
  2⤵
  PID:8212
- C:\Windows\System\jXzjJtl.exe
  C:\Windows\System\jXzjJtl.exe
  2⤵
  PID:3716
- C:\Windows\System\YmdCBpJ.exe
  C:\Windows\System\YmdCBpJ.exe
  2⤵
  PID:10012
- C:\Windows\System\EIndZGK.exe
  C:\Windows\System\EIndZGK.exe
  2⤵
  PID:15040
- C:\Windows\System\eTWWDkp.exe
  C:\Windows\System\eTWWDkp.exe
  2⤵
  PID:15320
- C:\Windows\System\vSRDJCk.exe
  C:\Windows\System\vSRDJCk.exe
  2⤵
  PID:15352
- C:\Windows\System\NtNTrjM.exe
  C:\Windows\System\NtNTrjM.exe
  2⤵
  PID:8792
- C:\Windows\System\WDviYam.exe
  C:\Windows\System\WDviYam.exe
  2⤵
  PID:14024
- C:\Windows\System\rJscNQZ.exe
  C:\Windows\System\rJscNQZ.exe
  2⤵
  PID:15064
- C:\Windows\System\bgwhpKg.exe
  C:\Windows\System\bgwhpKg.exe
  2⤵
  PID:14792
- C:\Windows\System\sHRVQKy.exe
  C:\Windows\System\sHRVQKy.exe
  2⤵
  PID:8992
- C:\Windows\System\zDGpNDz.exe
  C:\Windows\System\zDGpNDz.exe
  2⤵
  PID:14912
- C:\Windows\System\QrNxtvH.exe
  C:\Windows\System\QrNxtvH.exe
  2⤵
  PID:9820
- C:\Windows\System\FRHgEfT.exe
  C:\Windows\System\FRHgEfT.exe
  2⤵
  PID:9384
- C:\Windows\System\ZiDOgvI.exe
  C:\Windows\System\ZiDOgvI.exe
  2⤵
  PID:9260
- C:\Windows\System\FhWnOxH.exe
  C:\Windows\System\FhWnOxH.exe
  2⤵
  PID:10092
- C:\Windows\System\pVlDSXh.exe
  C:\Windows\System\pVlDSXh.exe
  2⤵
  PID:14948
- C:\Windows\System\DKJikIO.exe
  C:\Windows\System\DKJikIO.exe
  2⤵
  PID:4720
- C:\Windows\System\UvsugoO.exe
  C:\Windows\System\UvsugoO.exe
  2⤵
  PID:14756
- C:\Windows\System\TJUWgGm.exe
  C:\Windows\System\TJUWgGm.exe
  2⤵
  PID:8208
- C:\Windows\System\qPDzZPF.exe
  C:\Windows\System\qPDzZPF.exe
  2⤵
  PID:10552
- C:\Windows\System\IrGZHRL.exe
  C:\Windows\System\IrGZHRL.exe
  2⤵
  PID:10560
- C:\Windows\System\qlFlrDw.exe
  C:\Windows\System\qlFlrDw.exe
  2⤵
  PID:15016
- C:\Windows\System\FeYTzXf.exe
  C:\Windows\System\FeYTzXf.exe
  2⤵
  PID:8160
- C:\Windows\System\giPHMhu.exe
  C:\Windows\System\giPHMhu.exe
  2⤵
  PID:8372
- C:\Windows\System\FnuUxqQ.exe
  C:\Windows\System\FnuUxqQ.exe
  2⤵
  PID:10676
- C:\Windows\System\MbmLfQp.exe
  C:\Windows\System\MbmLfQp.exe
  2⤵
  PID:15100
- C:\Windows\System\DpOSgLV.exe
  C:\Windows\System\DpOSgLV.exe
  2⤵
  PID:14400
- C:\Windows\System\kyjMraC.exe
  C:\Windows\System\kyjMraC.exe
  2⤵
  PID:8364
- C:\Windows\System\bRTfANW.exe
  C:\Windows\System\bRTfANW.exe
  2⤵
  PID:10100
- C:\Windows\System\RezXQGO.exe
  C:\Windows\System\RezXQGO.exe
  2⤵
  PID:4056
- C:\Windows\System\KTFmuuT.exe
  C:\Windows\System\KTFmuuT.exe
  2⤵
  PID:12976
- C:\Windows\System\QTuOrKg.exe
  C:\Windows\System\QTuOrKg.exe
  2⤵
  PID:13104
- C:\Windows\System\wEUAvjz.exe
  C:\Windows\System\wEUAvjz.exe
  2⤵
  PID:9800
- C:\Windows\System\ZCMqxxG.exe
  C:\Windows\System\ZCMqxxG.exe
  2⤵
  PID:9416
- C:\Windows\System\NmucuVn.exe
  C:\Windows\System\NmucuVn.exe
  2⤵
  PID:9160
- C:\Windows\System\OGKSMWV.exe
  C:\Windows\System\OGKSMWV.exe
  2⤵
  PID:10460
- C:\Windows\System\bKjyKRE.exe
  C:\Windows\System\bKjyKRE.exe
  2⤵
  PID:8916
- C:\Windows\System\VaDyzXV.exe
  C:\Windows\System\VaDyzXV.exe
  2⤵
  PID:8832
- C:\Windows\System\VzcfMlM.exe
  C:\Windows\System\VzcfMlM.exe
  2⤵
  PID:10020
- C:\Windows\System\FjdAjYD.exe
  C:\Windows\System\FjdAjYD.exe
  2⤵
  PID:15364
- C:\Windows\System\jposGrv.exe
  C:\Windows\System\jposGrv.exe
  2⤵
  PID:15388
- C:\Windows\System\qprOoTO.exe
  C:\Windows\System\qprOoTO.exe
  2⤵
  PID:15412
- C:\Windows\System\ZEfeYvy.exe
  C:\Windows\System\ZEfeYvy.exe
  2⤵
  PID:15440
- C:\Windows\System\CDSDWdq.exe
  C:\Windows\System\CDSDWdq.exe
  2⤵
  PID:15468
- C:\Windows\System\WxnTRPk.exe
  C:\Windows\System\WxnTRPk.exe
  2⤵
  PID:15504
- C:\Windows\System\tVFnIpu.exe
  C:\Windows\System\tVFnIpu.exe
  2⤵
  PID:15524
- C:\Windows\System\jcJbqoc.exe
  C:\Windows\System\jcJbqoc.exe
  2⤵
  PID:15564
- C:\Windows\System\LNkLEmR.exe
  C:\Windows\System\LNkLEmR.exe
  2⤵
  PID:15584
- C:\Windows\System\kYoWyeK.exe
  C:\Windows\System\kYoWyeK.exe
  2⤵
  PID:15656
- C:\Windows\System\eaeETzV.exe
  C:\Windows\System\eaeETzV.exe
  2⤵
  PID:15428
- C:\Windows\System\RuZguHD.exe
  C:\Windows\System\RuZguHD.exe
  2⤵
  PID:10772
- C:\Windows\System\xgMKgig.exe
  C:\Windows\System\xgMKgig.exe
  2⤵
  PID:15996
- C:\Windows\System\iwMAaXa.exe
  C:\Windows\System\iwMAaXa.exe
  2⤵
  PID:9200
- C:\Windows\System\ZHdyOTe.exe
  C:\Windows\System\ZHdyOTe.exe
  2⤵
  PID:12444
- C:\Windows\System\nfnKejV.exe
  C:\Windows\System\nfnKejV.exe
  2⤵
  PID:15748
- C:\Windows\System\IjXTlNm.exe
  C:\Windows\System\IjXTlNm.exe
  2⤵
  PID:16088
- C:\Windows\System\LKDCkZz.exe
  C:\Windows\System\LKDCkZz.exe
  2⤵
  PID:10404
- C:\Windows\System\PJOLPrN.exe
  C:\Windows\System\PJOLPrN.exe
  2⤵
  PID:10752
- C:\Windows\System\LVOBydd.exe
  C:\Windows\System\LVOBydd.exe
  2⤵
  PID:15820
- C:\Windows\System\BbnlFVm.exe
  C:\Windows\System\BbnlFVm.exe
  2⤵
  PID:10152
- C:\Windows\System\nxnBUAa.exe
  C:\Windows\System\nxnBUAa.exe
  2⤵
  PID:10420
- C:\Windows\System\PYMtoBe.exe
  C:\Windows\System\PYMtoBe.exe
  2⤵
  PID:9248
- C:\Windows\System\OUFugfT.exe
  C:\Windows\System\OUFugfT.exe
  2⤵
  PID:9300
- C:\Windows\System\kXgBHQp.exe
  C:\Windows\System\kXgBHQp.exe
  2⤵
  PID:8300
- C:\Windows\System\lJDIiTS.exe
  C:\Windows\System\lJDIiTS.exe
  2⤵
  PID:9932
- C:\Windows\System\ulOvizv.exe
  C:\Windows\System\ulOvizv.exe
  2⤵
  PID:15188
- C:\Windows\System\iuMnfQI.exe
  C:\Windows\System\iuMnfQI.exe
  2⤵
  PID:15992
- C:\Windows\System\hEnKYpf.exe
  C:\Windows\System\hEnKYpf.exe
  2⤵
  PID:15520
- C:\Windows\System\sWSKBZq.exe
  C:\Windows\System\sWSKBZq.exe
  2⤵
  PID:15492
- C:\Windows\System\fSWdKEk.exe
  C:\Windows\System\fSWdKEk.exe
  2⤵
  PID:16048
- C:\Windows\System\lchytgZ.exe
  C:\Windows\System\lchytgZ.exe
  2⤵
  PID:16100
- C:\Windows\System\OwQYObA.exe
  C:\Windows\System\OwQYObA.exe
  2⤵
  PID:15420
- C:\Windows\System\LgYuskz.exe
  C:\Windows\System\LgYuskz.exe
  2⤵
  PID:9684
- C:\Windows\System\qoWuevW.exe
  C:\Windows\System\qoWuevW.exe
  2⤵
  PID:16144
- C:\Windows\System\RCmuraW.exe
  C:\Windows\System\RCmuraW.exe
  2⤵
  PID:15856
- C:\Windows\System\pJNNHkP.exe
  C:\Windows\System\pJNNHkP.exe
  2⤵
  PID:16084
- C:\Windows\System\KmhRINH.exe
  C:\Windows\System\KmhRINH.exe
  2⤵
  PID:10476
- C:\Windows\System\LjSWTkA.exe
  C:\Windows\System\LjSWTkA.exe
  2⤵
  PID:10256
- C:\Windows\System\kbWRFpG.exe
  C:\Windows\System\kbWRFpG.exe
  2⤵
  PID:12084
- C:\Windows\System\QvRbxUD.exe
  C:\Windows\System\QvRbxUD.exe
  2⤵
  PID:15896
- C:\Windows\System\qZNSSBX.exe
  C:\Windows\System\qZNSSBX.exe
  2⤵
  PID:11692
- C:\Windows\System\DuluYZK.exe
  C:\Windows\System\DuluYZK.exe
  2⤵
  PID:12272
- C:\Windows\System\gIbcVKV.exe
  C:\Windows\System\gIbcVKV.exe
  2⤵
  PID:16096
- C:\Windows\System\gjqwsRF.exe
  C:\Windows\System\gjqwsRF.exe
  2⤵
  PID:12460
- C:\Windows\System\TkJshmw.exe
  C:\Windows\System\TkJshmw.exe
  2⤵
  PID:11288
- C:\Windows\System\rKslJHD.exe
  C:\Windows\System\rKslJHD.exe
  2⤵
  PID:12256
- C:\Windows\System\LuLpUIF.exe
  C:\Windows\System\LuLpUIF.exe
  2⤵
  PID:12936
- C:\Windows\System\lqFOEPf.exe
  C:\Windows\System\lqFOEPf.exe
  2⤵
  PID:10720
- C:\Windows\System\odXhzNY.exe
  C:\Windows\System\odXhzNY.exe
  2⤵
  PID:9420
- C:\Windows\System\kRsLobs.exe
  C:\Windows\System\kRsLobs.exe
  2⤵
  PID:15304
- C:\Windows\System\XYqusgt.exe
  C:\Windows\System\XYqusgt.exe
  2⤵
  PID:10132
- C:\Windows\System\FhDMbri.exe
  C:\Windows\System\FhDMbri.exe
  2⤵
  PID:9368
- C:\Windows\System\UgzggYi.exe
  C:\Windows\System\UgzggYi.exe
  2⤵
  PID:10412
- C:\Windows\System\nUVzIdS.exe
  C:\Windows\System\nUVzIdS.exe
  2⤵
  PID:11304
- C:\Windows\System\PbGgkzU.exe
  C:\Windows\System\PbGgkzU.exe
  2⤵
  PID:11108
- C:\Windows\System\JFiYfOf.exe
  C:\Windows\System\JFiYfOf.exe
  2⤵
  PID:9304
- C:\Windows\System\SniGpuk.exe
  C:\Windows\System\SniGpuk.exe
  2⤵
  PID:9484
- C:\Windows\System\rrQeUad.exe
  C:\Windows\System\rrQeUad.exe
  2⤵
  PID:15848
- C:\Windows\System\mcMzkTj.exe
  C:\Windows\System\mcMzkTj.exe
  2⤵
  PID:11800
- C:\Windows\System\bObJQCk.exe
  C:\Windows\System\bObJQCk.exe
  2⤵
  PID:13172
- C:\Windows\System\fWixNcC.exe
  C:\Windows\System\fWixNcC.exe
  2⤵
  PID:10956
- C:\Windows\System\rFOJPnI.exe
  C:\Windows\System\rFOJPnI.exe
  2⤵
  PID:12464
- C:\Windows\System\UAQMjOu.exe
  C:\Windows\System\UAQMjOu.exe
  2⤵
  PID:16156
- C:\Windows\System\HaSUNAQ.exe
  C:\Windows\System\HaSUNAQ.exe
  2⤵
  PID:8012
- C:\Windows\System\VHogAtI.exe
  C:\Windows\System\VHogAtI.exe
  2⤵
  PID:15592
- C:\Windows\System\zTRvSgU.exe
  C:\Windows\System\zTRvSgU.exe
  2⤵
  PID:11244
- C:\Windows\System\nVKCMsd.exe
  C:\Windows\System\nVKCMsd.exe
  2⤵
  PID:10660
- C:\Windows\System\mhVHebV.exe
  C:\Windows\System\mhVHebV.exe
  2⤵
  PID:15688
- C:\Windows\System\kjYOmLN.exe
  C:\Windows\System\kjYOmLN.exe
  2⤵
  PID:16292
- C:\Windows\System\xZIjaxo.exe
  C:\Windows\System\xZIjaxo.exe
  2⤵
  PID:9040
- C:\Windows\System\EVxgHAQ.exe
  C:\Windows\System\EVxgHAQ.exe
  2⤵
  PID:11188
- C:\Windows\System\XxPtour.exe
  C:\Windows\System\XxPtour.exe
  2⤵
  PID:12656
- C:\Windows\System\OMnHVxH.exe
  C:\Windows\System\OMnHVxH.exe
  2⤵
  PID:11928
- C:\Windows\System\SWuyAiB.exe
  C:\Windows\System\SWuyAiB.exe
  2⤵
  PID:13232
- C:\Windows\System\QNFmLkN.exe
  C:\Windows\System\QNFmLkN.exe
  2⤵
  PID:13080
- C:\Windows\System\YLrmScS.exe
  C:\Windows\System\YLrmScS.exe
  2⤵
  PID:12172
- C:\Windows\System\MZMXQqR.exe
  C:\Windows\System\MZMXQqR.exe
  2⤵
  PID:1964
- C:\Windows\System\SIyHJJE.exe
  C:\Windows\System\SIyHJJE.exe
  2⤵
  PID:11344
- C:\Windows\System\hjNZgVG.exe
  C:\Windows\System\hjNZgVG.exe
  2⤵
  PID:12476
- C:\Windows\System\IOqelMV.exe
  C:\Windows\System\IOqelMV.exe
  2⤵
  PID:11936
- C:\Windows\System\LKletrV.exe
  C:\Windows\System\LKletrV.exe
  2⤵
  PID:13248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:9504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_orbbth43.1k4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ATPAXUa.exe

Filesize
1.6MB

MD5
38f6a85672d41b293f009820d13a37f8

SHA1
fc0d98439a4745a69448d963f5699f96d6e0535d

SHA256
bd2614be56bc33968588919bbd0f754e050251dd930e8b397299d6908087f2c8

SHA512
891aebd254fb6366b8ad90361ae77f8ee0407c575f0ef17b9552707bd0074ca4172e4baa85cef5ca938163cc2a207ce9ee43fd83b1eb657c0094ff30346e7654

Download Submit
C:\Windows\System\DYOJdEB.exe

Filesize
1.6MB

MD5
c750c6a46604e8b3322c4624f84b6f21

SHA1
e7730ced7c011556f0f68a628d00e342409aed0e

SHA256
bd36a3944563952420f5067035f201b70a74879cd0bd54c11a58bb4d9ebe592a

SHA512
e05902f1fc29f9b2c32648327c3137cfb6aec533ccae3244a774287c0e5451c307b5e26806145620bf4fae3f264b061120145aa67ed09efba3731751c4133c0d

Download Submit
C:\Windows\System\EVxRIME.exe

Filesize
1.6MB

MD5
c8989975c3f8c02d2a1171736f8659fa

SHA1
5024e7bf0a85b62e546092a5d1d3ce656ccea86c

SHA256
8c1279d9744d81400f5740de5ee6840c8ef1cc308905182fe16c20ef3f409e12

SHA512
fe309cfc48616a5a71f34a2029c189278dac59d2165b9dd2768d27aafc73310ebaa5df487a798ce47467996e6eff3408c5c9c78585612f59b3de5abb89747aa2

Download Submit
C:\Windows\System\HzMylCL.exe

Filesize
1.6MB

MD5
63f7de4e28444e837f2378366054a9c3

SHA1
69464d4bfb56d82280cd06a43907400440747ee8

SHA256
6f69b8819fca6f7cc545428698d74ca64e87e447194366643f970893463ac4f8

SHA512
1e0fd5a9d20edc19425c63775e560bbdb8e04706780b1d88d08153874ef58f7824b09fcbbe42f9d51872f3e666d853250d394a1f94637b246df2b61b88ca6a7a

Download Submit
C:\Windows\System\JOAHEYl.exe

Filesize
1.6MB

MD5
57ad7c3691ba8ac2333da566768056b4

SHA1
ffff7534c8e37b7f12ecbd25660ab34bed8da903

SHA256
7480d09a004e6cee3bef6fef12095c7e71e06f80286d59e832803fb70aec7f11

SHA512
71349c6add03b449e4dc6408d5352457036d4856d9060ed7ca819ea261379cf70ff54f2c70a9cf7db5c861703d9d5bace2a752b37efe021257b7dbbd9ccd24e9

Download Submit
C:\Windows\System\JUZEXcA.exe

Filesize
1.6MB

MD5
4f174e936027369363197a99679d1e89

SHA1
6e4c5948e012ba1a524accb88fd8cc8e4cf3f42d

SHA256
5aa2d6ce3f18ea589bfda5501310648ef995caa7fee42f4302977eb5cd9e08ae

SHA512
b9c65ffe8abfc23acb8689a0b8d31dfdafae87df8b2e4fe0cca2f6cbcc56532ce3b23c15bbab3ec7d3e2cd620c8c2622fb16f55096d77ef919412effa64c2b48

Download Submit
C:\Windows\System\JdjnEKQ.exe

Filesize
1.6MB

MD5
82d1986c7124385b22af2b7e888ab5be

SHA1
f0c038bee59c662fb163f6cab479a3086ee4f924

SHA256
92112cf1f07d983c3b409042b05b8eb350cf60139e90b189bb634ec256bdf27c

SHA512
a9803bacc77a1d96bb83da583eca4c7863e3722723989e0ce146fbf2daae69335b7ffdbae3e60f918974932b690647be4b9ae1563ead311752fab09adab7752d

Download Submit
C:\Windows\System\KMKEVtc.exe

Filesize
1.6MB

MD5
f8f1881532e2f78da7ed35cc05e19755

SHA1
e55d0bc6aa3e48ad041e36bd5995749fdc1c9cbf

SHA256
bb8d3f55992f15f9568be37166b1cabeffb051a7cca6cdf3377d6bac4ec7bddb

SHA512
26e29340ea76ea96f3603bac10d1fef1f5050cfe6efd7b36732788a14b3f1f1b9253b3acceb36d0fd93af29452992ffb22512eb7a9b16246db64e8d46782e385

Download Submit
C:\Windows\System\LQcuSzh.exe

Filesize
1.6MB

MD5
ff82e36e177b8a29818d1aa1c5fb3cb8

SHA1
c05e2a1361c6ebb8c3fbda9d3d828b02438e4aac

SHA256
fc7a09507a156be157bf9e0030c72ab1ff6be99f56d8a3b4ea303c574938a2ef

SHA512
5e46c08168e44a124db184dc927d438f26d456850066765e3c4a06f940220711b7452011328259f55c6ca77f14eb1db4a7f7c865976bde06f4df0b468f87d750

Download Submit
C:\Windows\System\NgDUdiv.exe

Filesize
1.6MB

MD5
cfb3561155083392cebe0672ce99a67c

SHA1
e02841f3d56cfe2eeb6ba9752952ada61da537cd

SHA256
483144987ac716e9377b65621d16ee143425b2b94d796cb3d62fce3fcd3137ef

SHA512
ae4b9235b833c96a5351d257608c076220b32243c947b1313ebcba9628bead18e6dd0a4520ee5d21eefbf79e303fd174baebb8a1837e5bc37a3e257ec98bb5a5

Download Submit
C:\Windows\System\NvdlkAu.exe

Filesize
1.6MB

MD5
f359a37912c07e3bc589a59331d36b90

SHA1
bce28aa5e5d7497b444582ef41bdf21943e9929d

SHA256
48458a9ab316a6fa8fd09e202174ee563d601b4b31007dd3c4628f89b67fba65

SHA512
085d0b25bbb541743ab5e46a8d2783fcb5c36f057921fc4d7496c55f030d8774d7ad2f1d52d9863c24f0bd0ba7581952d0a4360f63117863a1fb7c6bab9fead5

Download Submit
C:\Windows\System\PVUxjej.exe

Filesize
1.6MB

MD5
72d4c64cc3e29e8eb07ac84ead623f11

SHA1
1f2f1bf38ff3296a16989d18ca264904ac941a3d

SHA256
d70df4fb192a357fe9399425d1f710c15a5b6ddc073d460eea2c6bde57012d3c

SHA512
ff80d9174e331eacb0488f289a46a64fdb7a667fbea6235bcb1b5ae0dab059fe5eeb460588ec8b9abddbdf7bcb2cd58d20bda4581423adedef6475cfd6182248

Download Submit
C:\Windows\System\QOurlss.exe

Filesize
1.6MB

MD5
717eaedfbe23afa0c6db41c64049d4bf

SHA1
8fb84d0a5e895004a5bfd0d86985b77c978e8b02

SHA256
a0149f57dcf65714125997eb90fdc92f2ca35a6972d2d824a61d3c4254a798bf

SHA512
db6bf21df65c9850d0c0632f182ad2c6a80b6d4d364f2c51294a6d882eb28d8a073e72bac3587ac7727e2169efd461318066863f564d486fa4ef5952edb5604e

Download Submit
C:\Windows\System\QvNGoze.exe

Filesize
1.6MB

MD5
6e51e13f9964e82a6b21374daa6fd64c

SHA1
b9a771832980212e44d3b407a30c2342544d0abe

SHA256
bee3d110aa9ffcb31d22109fb12274a21d20554118cc825d224ec1707cbfcf09

SHA512
70dd75af2a2a2ab2af74b1f5a58e6cbde5aeb910152d6e78dc1bffde1766812e0c4428435a9e9045be1f000d3d9daf5f34bf89ba0a52d86ef03f31755db9aadf

Download Submit
C:\Windows\System\SRNypDh.exe

Filesize
1.6MB

MD5
be86ae46f24ec125ce8118d94fe28848

SHA1
ac1be891bf8e55afe4fc052e92e8fd0b7294f8ec

SHA256
2b0ad3e1a647dd4242ac7a91c74bc352185f0ae247156bb71be1ac4fdaf2089f

SHA512
50acf7da875d1a4bcc97719314fdf4911b1d0e9310f979e2d41b7393801786b6d4401dbf150ce9690c572efecbad8a54362f649f0294b59ea25fb10aa848b0a0

Download Submit
C:\Windows\System\SwpCWMi.exe

Filesize
1.6MB

MD5
4ffd04ebae59685a0a0606b2751c6a4f

SHA1
1698895487e3bd32f37fbb8d52dd68550627c84f

SHA256
4b03ec2c02833bbd8b705797d9613e013302ba70fb8ddada5d1ec2dc941ef5fd

SHA512
091115e904681bed652ed52dc8a4f1ede6782eb249d8fad409980e08714dc6ef7116416de9b337fc4e1d52b398d0c6f0fe81cc074867c6ceac4f742df10981a0

Download Submit
C:\Windows\System\TuTIdGE.exe

Filesize
1.6MB

MD5
e6f8e3fae3fbbcad7632d9ba9e11ab15

SHA1
7e8e78133a1c8ce64f57efc26c04833ceeca3ffe

SHA256
efce2b48c9bc730b18c3a951755ee7b8d52ee42bc2950f299a42b33d7cf6ff6f

SHA512
b756b8083ae6495fd7f54c363f03a80060c79e95538a642638cc1f665e18bb5626b251acc93fe9330b83bfb09a76eda9a952aacc542c5d1c202ac27b4f872a0a

Download Submit
C:\Windows\System\UaFILaw.exe

Filesize
1.6MB

MD5
b9d5b032746e72e549ee2ee258256479

SHA1
8ec0932dfbb96d0ee16f251826e5c87a12660dce

SHA256
1a554905ea1b5e1872a9101ef2f5e3643359a65f46c65b5aa63753f82c8a9687

SHA512
ffd52ebb804c65e8ec997c438c9acaab6ebb1acf61a620ba230bb344d7768db92741504ed515d810f11aeee4dfd45dfb9b1dd7a132e44f8ea11704f8ede1c420

Download Submit
C:\Windows\System\WBQPToR.exe

Filesize
1.6MB

MD5
c46f734b7e046fef5c354ceec08e0a24

SHA1
a8e34aa0da687599e8b2f01d0a4b3bd1fa22b80a

SHA256
0dac698ffb5940787640dcb459c7f74e02d0abf67049ef00bed8883d244cacc8

SHA512
a9ae049d0b083e7e890a56324b23204d1f6b57b17f5145df42af991391dbdfc42ca7f008e44278dff8e0ac809e60d8a0accc405238ca1fb44ca8007fcdcce0d9

Download Submit
C:\Windows\System\XhCAzyN.exe

Filesize
1.6MB

MD5
850b25edc5ef805f7be53e91870d25d0

SHA1
e6bd91f0d8c907b2ba9dfa6957c8d82120038082

SHA256
e0d67f873efbb27e302b845b2570c3278157f0c00204ef03752618edeb74469f

SHA512
2ae503085409478ae1d13224a2d7c46c2c5bbb65b4729583fef9dcfc3382b8452ad268dfefa7c216409ec2a94bd10820ceeab1ce8d91f29525afc1aa126cee41

Download Submit
C:\Windows\System\YDlCFqE.exe

Filesize
1.6MB

MD5
ba61415098cdb5ba5a3fdacaa9d07675

SHA1
cc3b17a363d3b5ad4661ea892cbac98ed704a862

SHA256
5563df49805a436f1f9a1cb5f4df75e692405519394a0da1253a4696f31feea6

SHA512
eaad964c4c6e2e7985c53412eac49f23e5808d2c6c0d500eeed8f75e842010bfbe305dc3eedb132f782fc1771d7197cd772b48af306f29712b76f9bf61a2f2e1

Download Submit
C:\Windows\System\YMJVtqi.exe

Filesize
1.6MB

MD5
cfcc588738707b4a59373e5a921db63f

SHA1
9e8c3a9e538c1e4568339415e689d5bf463e567c

SHA256
b812b3c62d6c040b702390aef39cbe1be15e926a12859bf79ffb4d0e736f3a17

SHA512
2c5f13677a26385f63b05c27c0a3209cf076a100f8ef0ab5f85afeb2483bc929a965fe2bdabdaadffdbfe11187a0612716670bb26ad3bed6d1085b3a573f5325

Download Submit
C:\Windows\System\ZRDHsjs.exe

Filesize
1.6MB

MD5
bd0914e20d0a9c3b4ef9caeb3b4edb49

SHA1
a175c22b0e0c1c22994392031c9531a71db3c761

SHA256
8eb3886e17051d466430111aa4935fef7a02a20408a191c4b653f72803ab3d85

SHA512
d7805ff8baf6e1d67a4f44b9f227d67f51a76c758ef44ff6e3d8576d1a61cd83102f54aba80086be856930ee1fbf465f61e5114a9564c3a6fe96389273ecbd51

Download Submit
C:\Windows\System\ZeEZzSN.exe

Filesize
1.6MB

MD5
ac120840849f1c9526db85872287f889

SHA1
dc1dedca28a9a78c0dd69e2759318837ffdcd6e4

SHA256
d665ee027eabb1521628b6f803f39e045c88880bf1566918ed5e087b9dfd7ff2

SHA512
b37d691c89d750d30ddeb5f374a9da28b756a455641954d73ade429393ad7ba4537261051fa90f45cf5139cbe0a081cd381b63b3e3eafbdad6c40ff91d5628c7

Download Submit
C:\Windows\System\aGIKBVT.exe

Filesize
1.6MB

MD5
60d815469fa0d2e200b3ebadc2539b7b

SHA1
40da495ba810886235d0bca23d3080fdc8fd6b3c

SHA256
378b1fb687d39480a6e50e0048218771fa95f7856295009950094343eff3692d

SHA512
6ef71f12009cfc6e913a7188d747d30e3edbf273b932e593585f977aac706708e920e228d344721289ba2337fd13ac1418c9accd3b49a50a1ce8e5ba49b4ee0a

Download Submit
C:\Windows\System\aGmnQRg.exe

Filesize
1.6MB

MD5
b32cce4b500a10bd1dcdd987775d4ac6

SHA1
3e52d04282bb829611d41caccf440c49873e9ae3

SHA256
86f9df7e71a04d40ce4e15181ba832fdf48109a342beb394f62f19fdac31f33f

SHA512
5f62afb7f72bfb879870f715071bfcc1263e7e98793852a925a0d5dd8afb195f52993e52b73617d2863dcf379d6c06c3c9333821e96aaeb7de03490b84e70ebb

Download Submit
C:\Windows\System\hBryxSk.exe

Filesize
1.6MB

MD5
1725ff44cf66c18e2697fd139a1a5cee

SHA1
55031377037a1679d974cd62806388069b9f046f

SHA256
bc19289d3304b78eadd7001a17c9aac0b6831351ec883fc4ccc10b74644bc8fd

SHA512
34cf273b25fa6f4e895780659543c09632a861f2f0c0515ff89eb59a77cefefe18b4684f0b740108228bcc000096bf83d8026c53dbb89bf9669b8d901f0659e2

Download Submit
C:\Windows\System\iLZCdvX.exe

Filesize
1.6MB

MD5
dda2de9bc6b7b43ce6c845452e8b2354

SHA1
ef6ad2664889ab0fc6e14ada507a1c141894ae87

SHA256
89107b5b32f7e6bc1fc3a90ae5f625fd0a8d7e68bfe70187c00b0d8965c42750

SHA512
ed2d16cb0e5aff563117b802f074c4f63cdef05da9322c24aac2160ecae6f3dd8ce08dce009afcc4b3582c3b728e6e8716dad7fe9f2b1cba0b342fcab7e3746b

Download Submit
C:\Windows\System\pVYPiwg.exe

Filesize
1.6MB

MD5
5c3afb74a40ae89b08a4910e1ae795e0

SHA1
b7f8dc5f2ad1ead4eda1c11f79e64c2bf2faf8a0

SHA256
f2e0ba7d072911568f6acaccb8cfb00572fb96c1cefbbde5e498534251056f25

SHA512
7f1b1654c3c77b6c6c500ce43a9dbe08b728b226ae31a9cf72fbbea00dd8b0d01fde0d5eb0db9c05665ba470d4d4170d1f21b0e1e84e7b55a20ea6da457ee9af

Download Submit
C:\Windows\System\poqGiVm.exe

Filesize
1.6MB

MD5
e422a14684efc22f29d230a4cdea8667

SHA1
06ffe98b635261f4aafb60063e66bd4e0ff59dfe

SHA256
b7cae75eee66e12beca6507a8b32cfe80b96997833dcf09a0b1529e18304cd5d

SHA512
4baad8bd300d737a95f93cdf6ad4cb6bb26dc8d5e5971e047d9667d3595a35e8ae0713b8a4ccc6797b257c2ba528b4618e0819be98d5c12803ecf3d1047c575c

Download Submit
C:\Windows\System\sTAmIpI.exe

Filesize
1.6MB

MD5
5a6b6a4662ae3ce009c39dd32ac01e26

SHA1
4550a4bb63326dc88e48fbac38498020e3d744eb

SHA256
ed1da87551cb448ab96345954a4fcdf5699b572e766ae3cc126015ad025a18a2

SHA512
2cfa430d14db42ed1a729d740a17ddd0c794c79a6fc66310b1a449c3cb918cc4bcf5bcc1fab34f951327737867807700b2be8685af5b9cef7f72a2aed2851a73

Download Submit
C:\Windows\System\wwtQqFu.exe

Filesize
1.6MB

MD5
131d5359cfeb988a13808a91bd854607

SHA1
dfb8710a7b0da0c48e0089bfd3ba18ed6998250b

SHA256
ae928b8d6489935186509206191c0aa6290945824c512cccbf82b9515b6e0b43

SHA512
49e9f134e2dc32a464a7e69433fe0f7602f55eef52c01655cb776f8ed9ce5c4763de9e2ae18ad4315f188819c3de6235a9cb3bc0ac25311d9df15ac69dd840c6

Download Submit
C:\Windows\System\zCaTlIH.exe

Filesize
1.6MB

MD5
0b26c0336243890a37ca30a0303bbbea

SHA1
fb731c73024b31c9616fa8ce071fae4cd9d70981

SHA256
f568892378592aedf99cf7044c85883288a6c17388839210dca8cc9d94f42303

SHA512
cb90735e0a12f07ac0b7c530138ce6e659f5fd4e86f4f98e9877317d9e97f24444bae42113794865bb0d03b3d420407638012038b6fb4ddf1e6b576867f05e2d

Download Submit
memory/416-59-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/416-60-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/416-3-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp

Filesize
8KB

Download
memory/416-15-0x000001D07F080000-0x000001D07F0A2000-memory.dmp

Filesize
136KB

Download
memory/416-131-0x000001D07FB20000-0x000001D0802C6000-memory.dmp

Filesize
7.6MB

Download
memory/512-307-0x00007FF77B8B0000-0x00007FF77BCA2000-memory.dmp

Filesize
3.9MB

Download
memory/512-2122-0x00007FF77B8B0000-0x00007FF77BCA2000-memory.dmp

Filesize
3.9MB

Download
memory/840-78-0x00007FF69C070000-0x00007FF69C462000-memory.dmp

Filesize
3.9MB

Download
memory/840-1675-0x00007FF69C070000-0x00007FF69C462000-memory.dmp

Filesize
3.9MB

Download
memory/1396-2115-0x00007FF7323C0000-0x00007FF7327B2000-memory.dmp

Filesize
3.9MB

Download
memory/1396-311-0x00007FF7323C0000-0x00007FF7327B2000-memory.dmp

Filesize
3.9MB

Download
memory/1428-314-0x00007FF637990000-0x00007FF637D82000-memory.dmp

Filesize
3.9MB

Download
memory/1428-2120-0x00007FF637990000-0x00007FF637D82000-memory.dmp

Filesize
3.9MB

Download
memory/1608-268-0x00007FF72F390000-0x00007FF72F782000-memory.dmp

Filesize
3.9MB

Download
memory/2032-2081-0x00007FF6FE300000-0x00007FF6FE6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-310-0x00007FF6FE300000-0x00007FF6FE6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-332-0x00007FF638CD0000-0x00007FF6390C2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-2125-0x00007FF638CD0000-0x00007FF6390C2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-2124-0x00007FF77A2A0000-0x00007FF77A692000-memory.dmp

Filesize
3.9MB

Download
memory/2564-352-0x00007FF77A2A0000-0x00007FF77A692000-memory.dmp

Filesize
3.9MB

Download
memory/2676-349-0x00007FF6E7CE0000-0x00007FF6E80D2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-1960-0x00007FF6E7CE0000-0x00007FF6E80D2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-269-0x00007FF663FB0000-0x00007FF6643A2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-1538-0x00007FF663FB0000-0x00007FF6643A2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-320-0x00007FF6E0950000-0x00007FF6E0D42000-memory.dmp

Filesize
3.9MB

Download
memory/3152-2116-0x00007FF6E0950000-0x00007FF6E0D42000-memory.dmp

Filesize
3.9MB

Download
memory/3192-81-0x00007FF6EABC0000-0x00007FF6EAFB2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-1666-0x00007FF6EABC0000-0x00007FF6EAFB2000-memory.dmp

Filesize
3.9MB

Download
memory/3448-2117-0x00007FF7A41F0000-0x00007FF7A45E2000-memory.dmp

Filesize
3.9MB

Download
memory/3448-329-0x00007FF7A41F0000-0x00007FF7A45E2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-1691-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp

Filesize
3.9MB

Download
memory/3528-295-0x00007FF6A44A0000-0x00007FF6A4892000-memory.dmp

Filesize
3.9MB

Download
memory/3636-340-0x00007FF60A5A0000-0x00007FF60A992000-memory.dmp

Filesize
3.9MB

Download
memory/3636-2126-0x00007FF60A5A0000-0x00007FF60A992000-memory.dmp

Filesize
3.9MB

Download
memory/3640-335-0x00007FF767E10000-0x00007FF768202000-memory.dmp

Filesize
3.9MB

Download
memory/3640-2119-0x00007FF767E10000-0x00007FF768202000-memory.dmp

Filesize
3.9MB

Download
memory/3908-1568-0x00007FF68EE60000-0x00007FF68F252000-memory.dmp

Filesize
3.9MB

Download
memory/3908-61-0x00007FF68EE60000-0x00007FF68F252000-memory.dmp

Filesize
3.9MB

Download
memory/3956-341-0x00007FF6D3170000-0x00007FF6D3562000-memory.dmp

Filesize
3.9MB

Download
memory/3956-2123-0x00007FF6D3170000-0x00007FF6D3562000-memory.dmp

Filesize
3.9MB

Download
memory/3992-326-0x00007FF78FE10000-0x00007FF790202000-memory.dmp

Filesize
3.9MB

Download
memory/3992-2118-0x00007FF78FE10000-0x00007FF790202000-memory.dmp

Filesize
3.9MB

Download
memory/4024-337-0x00007FF6BDD50000-0x00007FF6BE142000-memory.dmp

Filesize
3.9MB

Download
memory/4024-2121-0x00007FF6BDD50000-0x00007FF6BE142000-memory.dmp

Filesize
3.9MB

Download
memory/4180-67-0x00007FF79E5F0000-0x00007FF79E9E2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-1635-0x00007FF79E5F0000-0x00007FF79E9E2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-0-0x00007FF638180000-0x00007FF638572000-memory.dmp

Filesize
3.9MB

Download
memory/4504-74-0x00007FF638180000-0x00007FF638572000-memory.dmp

Filesize
3.9MB

Download
memory/4504-1-0x00000179C0960000-0x00000179C0970000-memory.dmp

Filesize
64KB

Download
memory/4692-1803-0x00007FF69F2F0000-0x00007FF69F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/4692-289-0x00007FF69F2F0000-0x00007FF69F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/4944-1745-0x00007FF6EE830000-0x00007FF6EEC22000-memory.dmp

Filesize
3.9MB

Download
memory/4944-347-0x00007FF6EE830000-0x00007FF6EEC22000-memory.dmp

Filesize
3.9MB

Download
memory/5036-1792-0x00007FF7A09C0000-0x00007FF7A0DB2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-267-0x00007FF7A09C0000-0x00007FF7A0DB2000-memory.dmp

Filesize
3.9MB

Download
memory/5052-73-0x00007FF6B0770000-0x00007FF6B0B62000-memory.dmp

Filesize
3.9MB

Download
memory/5052-1629-0x00007FF6B0770000-0x00007FF6B0B62000-memory.dmp

Filesize
3.9MB

Download