xmrig | a69bb5748cbf347d969035ee0961954f08d2eb926cae1e0bbfda6a89697a52f2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
Size 1.4MB
Sample240527-1hjf2aba2s
SHA256 a69bb5748cbf347d969035ee0961954f08d2eb926cae1e0bbfda6a89697a52f2
MD5 1d660e34ce3f9558a560065dc665d810
SHA1 6da0ea4baf37cc7f480a346cd9786170ea731f14
SHA512 0871969e1d481ea765f4ccee34d54e366f804eff2e8adc7f04e826dac3e1d330d3a3797910c254030f6f3a5e83a8f30a8f32ea81503c1086b717ffa9b33eb969
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/IT6:Lz071uv4BPMkHC0IlnASEx/R2uWGT6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 9716 created 4332	9716	WerFaultSecure.exe	78

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/2752-512-0x00007FF7A5820000-0x00007FF7A5C12000-memory.dmp	xmrig
behavioral2/memory/628-682-0x00007FF683000000-0x00007FF6833F2000-memory.dmp	xmrig
behavioral2/memory/1248-817-0x00007FF64FD00000-0x00007FF6500F2000-memory.dmp	xmrig
behavioral2/memory/4044-823-0x00007FF75BD90000-0x00007FF75C182000-memory.dmp	xmrig
behavioral2/memory/4336-827-0x00007FF648890000-0x00007FF648C82000-memory.dmp	xmrig
behavioral2/memory/3008-3135-0x00007FF6BF990000-0x00007FF6BFD82000-memory.dmp	xmrig
behavioral2/memory/1776-3152-0x00007FF79E150000-0x00007FF79E542000-memory.dmp	xmrig
behavioral2/memory/640-3154-0x00007FF65C1B0000-0x00007FF65C5A2000-memory.dmp	xmrig
behavioral2/memory/1536-3156-0x00007FF7BD220000-0x00007FF7BD612000-memory.dmp	xmrig
behavioral2/memory/2752-3159-0x00007FF7A5820000-0x00007FF7A5C12000-memory.dmp	xmrig
behavioral2/memory/2004-3162-0x00007FF6AB300000-0x00007FF6AB6F2000-memory.dmp	xmrig
behavioral2/memory/4912-3164-0x00007FF7C45D0000-0x00007FF7C49C2000-memory.dmp	xmrig
behavioral2/memory/1248-3160-0x00007FF64FD00000-0x00007FF6500F2000-memory.dmp	xmrig
behavioral2/memory/4044-3171-0x00007FF75BD90000-0x00007FF75C182000-memory.dmp	xmrig
behavioral2/memory/3216-3178-0x00007FF61E690000-0x00007FF61EA82000-memory.dmp	xmrig
behavioral2/memory/3196-3184-0x00007FF6D9880000-0x00007FF6D9C72000-memory.dmp	xmrig
behavioral2/memory/4284-3185-0x00007FF63E600000-0x00007FF63E9F2000-memory.dmp	xmrig
behavioral2/memory/3240-3187-0x00007FF620510000-0x00007FF620902000-memory.dmp	xmrig
behavioral2/memory/2308-3201-0x00007FF7B2310000-0x00007FF7B2702000-memory.dmp	xmrig
behavioral2/memory/1736-3181-0x00007FF67E760000-0x00007FF67EB52000-memory.dmp	xmrig
behavioral2/memory/4576-3176-0x00007FF7E0200000-0x00007FF7E05F2000-memory.dmp	xmrig
behavioral2/memory/5092-3174-0x00007FF63DB80000-0x00007FF63DF72000-memory.dmp	xmrig
behavioral2/memory/1696-3168-0x00007FF719FC0000-0x00007FF71A3B2000-memory.dmp	xmrig
behavioral2/memory/628-3166-0x00007FF683000000-0x00007FF6833F2000-memory.dmp	xmrig
behavioral2/memory/3708-3149-0x00007FF7BAD60000-0x00007FF7BB152000-memory.dmp	xmrig
behavioral2/memory/4504-3146-0x00007FF618C80000-0x00007FF619072000-memory.dmp	xmrig
behavioral2/memory/2732-3140-0x00007FF6D6450000-0x00007FF6D6842000-memory.dmp	xmrig
behavioral2/memory/3140-3129-0x00007FF790F40000-0x00007FF791332000-memory.dmp	xmrig
behavioral2/memory/4336-3124-0x00007FF648890000-0x00007FF648C82000-memory.dmp	xmrig
behavioral2/memory/640-829-0x00007FF65C1B0000-0x00007FF65C5A2000-memory.dmp	xmrig
behavioral2/memory/3708-828-0x00007FF7BAD60000-0x00007FF7BB152000-memory.dmp	xmrig
behavioral2/memory/2308-826-0x00007FF7B2310000-0x00007FF7B2702000-memory.dmp	xmrig
behavioral2/memory/5092-825-0x00007FF63DB80000-0x00007FF63DF72000-memory.dmp	xmrig
behavioral2/memory/3240-824-0x00007FF620510000-0x00007FF620902000-memory.dmp	xmrig
behavioral2/memory/3196-822-0x00007FF6D9880000-0x00007FF6D9C72000-memory.dmp	xmrig
behavioral2/memory/4912-821-0x00007FF7C45D0000-0x00007FF7C49C2000-memory.dmp	xmrig
behavioral2/memory/4284-820-0x00007FF63E600000-0x00007FF63E9F2000-memory.dmp	xmrig
behavioral2/memory/2004-819-0x00007FF6AB300000-0x00007FF6AB6F2000-memory.dmp	xmrig
behavioral2/memory/1736-818-0x00007FF67E760000-0x00007FF67EB52000-memory.dmp	xmrig
behavioral2/memory/4576-816-0x00007FF7E0200000-0x00007FF7E05F2000-memory.dmp	xmrig
behavioral2/memory/1696-812-0x00007FF719FC0000-0x00007FF71A3B2000-memory.dmp	xmrig
behavioral2/memory/1536-414-0x00007FF7BD220000-0x00007FF7BD612000-memory.dmp	xmrig
behavioral2/memory/3216-411-0x00007FF61E690000-0x00007FF61EA82000-memory.dmp	xmrig
behavioral2/memory/4504-322-0x00007FF618C80000-0x00007FF619072000-memory.dmp	xmrig
behavioral2/memory/1776-321-0x00007FF79E150000-0x00007FF79E542000-memory.dmp	xmrig
behavioral2/memory/3008-258-0x00007FF6BF990000-0x00007FF6BFD82000-memory.dmp	xmrig
behavioral2/memory/2732-209-0x00007FF6D6450000-0x00007FF6D6842000-memory.dmp	xmrig
behavioral2/memory/3140-78-0x00007FF790F40000-0x00007FF791332000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3480	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4336	xBeOfqn.exe
3140	oOIFYOL.exe
2732	LlMkmYD.exe
3008	bhikejx.exe
1776	rCimfUM.exe
4504	NXguobA.exe
3216	fpHybIB.exe
1536	mMpOZwa.exe
2752	fbXVZDL.exe
3708	hbPVRyn.exe
628	neOVBqj.exe
1696	OsJHgCy.exe
4576	uOMHOKd.exe
1248	LbMODWb.exe
1736	XEKjSvx.exe
2004	YhgkDBL.exe
4284	vSNwdSo.exe
4912	WHrBXJe.exe
3196	riGNOyJ.exe
640	oHHlxVM.exe
4044	koBiWMi.exe
3240	zsyTgjR.exe
5092	RJWVIwP.exe
2308	TpcKQup.exe
2228	kSxBWeZ.exe
1756	VDZzWjz.exe
1928	brcBqUP.exe
1304	cBQtTLk.exe
3544	wSoYBJs.exe
1608	pfUPVmO.exe
2948	CpdKJfS.exe
5016	VtKbXDP.exe
2268	DzTDtDl.exe
4052	tgGpzOa.exe
4092	EIhHkpE.exe
920	wrcCutd.exe
4944	CparhIR.exe
396	XcdRdSM.exe
1436	JGyZvcT.exe
3848	zbAghEk.exe
1308	wJNygzR.exe
2884	aKywofA.exe
4636	AKjXlLJ.exe
3468	qRVELrd.exe
2844	SJdnegp.exe
3276	qTwaGpB.exe
1408	PTiXfUt.exe
3212	NJiFAQp.exe
3460	iEVWnjv.exe
4264	jTmgFaq.exe
3504	mBGsAZv.exe
3444	RcCMLOD.exe
4088	CDhXCmx.exe
60	uIqgplU.exe
3988	xqJLoxB.exe
1300	MGUFdnG.exe
1584	OHddxGA.exe
4768	dYsrwCS.exe
1232	nqpZCIC.exe
5084	DGczCDp.exe
3032	xeZHVvN.exe
2044	aIRNyet.exe
4948	maDiWia.exe
2744	zuBuIEh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4852-0-0x00007FF79A9D0000-0x00007FF79ADC2000-memory.dmp	upx
behavioral2/files/0x0005000000023266-6.dat	upx
behavioral2/files/0x0008000000023412-8.dat	upx
behavioral2/files/0x00090000000233e0-28.dat	upx
behavioral2/files/0x0007000000023413-22.dat	upx
behavioral2/files/0x0007000000023418-46.dat	upx
behavioral2/files/0x000700000002341f-74.dat	upx
behavioral2/files/0x0007000000023435-185.dat	upx
behavioral2/memory/2752-512-0x00007FF7A5820000-0x00007FF7A5C12000-memory.dmp	upx
behavioral2/memory/628-682-0x00007FF683000000-0x00007FF6833F2000-memory.dmp	upx
behavioral2/memory/1248-817-0x00007FF64FD00000-0x00007FF6500F2000-memory.dmp	upx
behavioral2/memory/4044-823-0x00007FF75BD90000-0x00007FF75C182000-memory.dmp	upx
behavioral2/memory/4336-827-0x00007FF648890000-0x00007FF648C82000-memory.dmp	upx
behavioral2/memory/3008-3135-0x00007FF6BF990000-0x00007FF6BFD82000-memory.dmp	upx
behavioral2/memory/1776-3152-0x00007FF79E150000-0x00007FF79E542000-memory.dmp	upx
behavioral2/memory/640-3154-0x00007FF65C1B0000-0x00007FF65C5A2000-memory.dmp	upx
behavioral2/memory/1536-3156-0x00007FF7BD220000-0x00007FF7BD612000-memory.dmp	upx
behavioral2/memory/2752-3159-0x00007FF7A5820000-0x00007FF7A5C12000-memory.dmp	upx
behavioral2/memory/2004-3162-0x00007FF6AB300000-0x00007FF6AB6F2000-memory.dmp	upx
behavioral2/memory/4912-3164-0x00007FF7C45D0000-0x00007FF7C49C2000-memory.dmp	upx
behavioral2/memory/1248-3160-0x00007FF64FD00000-0x00007FF6500F2000-memory.dmp	upx
behavioral2/memory/4044-3171-0x00007FF75BD90000-0x00007FF75C182000-memory.dmp	upx
behavioral2/memory/3216-3178-0x00007FF61E690000-0x00007FF61EA82000-memory.dmp	upx
behavioral2/memory/3196-3184-0x00007FF6D9880000-0x00007FF6D9C72000-memory.dmp	upx
behavioral2/memory/4284-3185-0x00007FF63E600000-0x00007FF63E9F2000-memory.dmp	upx
behavioral2/memory/3240-3187-0x00007FF620510000-0x00007FF620902000-memory.dmp	upx
behavioral2/memory/2308-3201-0x00007FF7B2310000-0x00007FF7B2702000-memory.dmp	upx
behavioral2/memory/1736-3181-0x00007FF67E760000-0x00007FF67EB52000-memory.dmp	upx
behavioral2/memory/4576-3176-0x00007FF7E0200000-0x00007FF7E05F2000-memory.dmp	upx
behavioral2/memory/5092-3174-0x00007FF63DB80000-0x00007FF63DF72000-memory.dmp	upx
behavioral2/memory/1696-3168-0x00007FF719FC0000-0x00007FF71A3B2000-memory.dmp	upx
behavioral2/memory/628-3166-0x00007FF683000000-0x00007FF6833F2000-memory.dmp	upx
behavioral2/memory/3708-3149-0x00007FF7BAD60000-0x00007FF7BB152000-memory.dmp	upx
behavioral2/memory/4504-3146-0x00007FF618C80000-0x00007FF619072000-memory.dmp	upx
behavioral2/memory/2732-3140-0x00007FF6D6450000-0x00007FF6D6842000-memory.dmp	upx
behavioral2/memory/3140-3129-0x00007FF790F40000-0x00007FF791332000-memory.dmp	upx
behavioral2/memory/4336-3124-0x00007FF648890000-0x00007FF648C82000-memory.dmp	upx
behavioral2/memory/640-829-0x00007FF65C1B0000-0x00007FF65C5A2000-memory.dmp	upx
behavioral2/memory/3708-828-0x00007FF7BAD60000-0x00007FF7BB152000-memory.dmp	upx
behavioral2/memory/2308-826-0x00007FF7B2310000-0x00007FF7B2702000-memory.dmp	upx
behavioral2/memory/5092-825-0x00007FF63DB80000-0x00007FF63DF72000-memory.dmp	upx
behavioral2/memory/3240-824-0x00007FF620510000-0x00007FF620902000-memory.dmp	upx
behavioral2/memory/3196-822-0x00007FF6D9880000-0x00007FF6D9C72000-memory.dmp	upx
behavioral2/memory/4912-821-0x00007FF7C45D0000-0x00007FF7C49C2000-memory.dmp	upx
behavioral2/memory/4284-820-0x00007FF63E600000-0x00007FF63E9F2000-memory.dmp	upx
behavioral2/memory/2004-819-0x00007FF6AB300000-0x00007FF6AB6F2000-memory.dmp	upx
behavioral2/memory/1736-818-0x00007FF67E760000-0x00007FF67EB52000-memory.dmp	upx
behavioral2/memory/4576-816-0x00007FF7E0200000-0x00007FF7E05F2000-memory.dmp	upx
behavioral2/memory/1696-812-0x00007FF719FC0000-0x00007FF71A3B2000-memory.dmp	upx
behavioral2/memory/1536-414-0x00007FF7BD220000-0x00007FF7BD612000-memory.dmp	upx
behavioral2/memory/3216-411-0x00007FF61E690000-0x00007FF61EA82000-memory.dmp	upx
behavioral2/memory/4504-322-0x00007FF618C80000-0x00007FF619072000-memory.dmp	upx
behavioral2/memory/1776-321-0x00007FF79E150000-0x00007FF79E542000-memory.dmp	upx
behavioral2/memory/3008-258-0x00007FF6BF990000-0x00007FF6BFD82000-memory.dmp	upx
behavioral2/memory/2732-209-0x00007FF6D6450000-0x00007FF6D6842000-memory.dmp	upx
behavioral2/files/0x0007000000023437-198.dat	upx
behavioral2/files/0x000700000002342b-197.dat	upx
behavioral2/files/0x000700000002342a-195.dat	upx
behavioral2/files/0x000700000002341c-187.dat	upx
behavioral2/files/0x0007000000023436-186.dat	upx
behavioral2/files/0x0007000000023434-181.dat	upx
behavioral2/files/0x0007000000023426-176.dat	upx
behavioral2/files/0x0007000000023428-173.dat	upx
behavioral2/files/0x0007000000023433-172.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\erbIBwg.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\NHnRxxI.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\YOusFza.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\hYIrQkN.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\CZqzMug.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\tohHuLI.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\GZPWYOH.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\zsyTgjR.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\uQciFgo.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\jqagDAx.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\rnWgFDG.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\UjHPEZV.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\NaqlRYF.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\bzRfLQr.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\JZEJwyF.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\CQMzdBd.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\QNOpQfY.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\ducBXey.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\EFJlUSD.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\BYaOQWb.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\gdIbzPu.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\QMSGlxA.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\AvQvzJP.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\dhcwlLr.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\feOEOyd.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\WHJoSxR.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\uYbeguJ.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\zeIZMWJ.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\ilNgYcc.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\XuMnAYX.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\TykfQrs.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\TtKrkmq.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\NoUzexP.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\oCSoaHz.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\MgQXkQB.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\PMNXqZa.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\OvLPleP.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\jBkisgc.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\wQodTeX.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\fpHybIB.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\SLQnQLQ.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\RpsYFJv.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\xSwocqL.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\YIwdtdv.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\RHWuGPR.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\LEdipER.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\MiWdsqD.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\dvxNXbb.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\YjernuW.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\IflSctO.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\bvpixZh.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\seIIxek.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\yBcNFPq.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\EexUrCd.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\AscTKhC.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\SCnYgsF.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\UDLrHau.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\icyqYyJ.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\qRVELrd.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\zdkZHAz.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\xsMHfeF.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\QRXNcTo.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\KVdkazz.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
File created	C:\Windows\System\CiLbLkr.exe	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3480	powershell.exe
3480	powershell.exe
3480	powershell.exe
8408	WerFaultSecure.exe
8408	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
Token: SeDebugPrivilege	3480	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3480	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	82
PID 4852 wrote to memory of 3480	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	82
PID 4852 wrote to memory of 4336	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	83
PID 4852 wrote to memory of 4336	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	83
PID 4852 wrote to memory of 3140	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	84
PID 4852 wrote to memory of 3140	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	84
PID 4852 wrote to memory of 2732	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	85
PID 4852 wrote to memory of 2732	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	85
PID 4852 wrote to memory of 3008	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	86
PID 4852 wrote to memory of 3008	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	86
PID 4852 wrote to memory of 1776	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	87
PID 4852 wrote to memory of 1776	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	87
PID 4852 wrote to memory of 4504	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	88
PID 4852 wrote to memory of 4504	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	88
PID 4852 wrote to memory of 3216	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	89
PID 4852 wrote to memory of 3216	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	89
PID 4852 wrote to memory of 1536	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	90
PID 4852 wrote to memory of 1536	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	90
PID 4852 wrote to memory of 2752	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	91
PID 4852 wrote to memory of 2752	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	91
PID 4852 wrote to memory of 3708	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	92
PID 4852 wrote to memory of 3708	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	92
PID 4852 wrote to memory of 628	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	93
PID 4852 wrote to memory of 628	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	93
PID 4852 wrote to memory of 1696	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	94
PID 4852 wrote to memory of 1696	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	94
PID 4852 wrote to memory of 4576	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	95
PID 4852 wrote to memory of 4576	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	95
PID 4852 wrote to memory of 1248	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	96
PID 4852 wrote to memory of 1248	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	96
PID 4852 wrote to memory of 1736	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	97
PID 4852 wrote to memory of 1736	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	97
PID 4852 wrote to memory of 2004	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	98
PID 4852 wrote to memory of 2004	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	98
PID 4852 wrote to memory of 4284	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	99
PID 4852 wrote to memory of 4284	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	99
PID 4852 wrote to memory of 4912	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	100
PID 4852 wrote to memory of 4912	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	100
PID 4852 wrote to memory of 3196	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	101
PID 4852 wrote to memory of 3196	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	101
PID 4852 wrote to memory of 640	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	102
PID 4852 wrote to memory of 640	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	102
PID 4852 wrote to memory of 4044	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	103
PID 4852 wrote to memory of 4044	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	103
PID 4852 wrote to memory of 3240	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	104
PID 4852 wrote to memory of 3240	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	104
PID 4852 wrote to memory of 2948	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	105
PID 4852 wrote to memory of 2948	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	105
PID 4852 wrote to memory of 2228	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	106
PID 4852 wrote to memory of 2228	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	106
PID 4852 wrote to memory of 5092	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	107
PID 4852 wrote to memory of 5092	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	107
PID 4852 wrote to memory of 2308	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	108
PID 4852 wrote to memory of 2308	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	108
PID 4852 wrote to memory of 920	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	109
PID 4852 wrote to memory of 920	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	109
PID 4852 wrote to memory of 4944	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	110
PID 4852 wrote to memory of 4944	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	110
PID 4852 wrote to memory of 1756	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	111
PID 4852 wrote to memory of 1756	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	111
PID 4852 wrote to memory of 1928	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	112
PID 4852 wrote to memory of 1928	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	112
PID 4852 wrote to memory of 1304	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	113
PID 4852 wrote to memory of 1304	4852	1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe	113

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:4332
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4332 -s 1148
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:8408

C:\Users\Admin\AppData\Local\Temp\1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1d660e34ce3f9558a560065dc665d810_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- C:\Windows\System\xBeOfqn.exe
  C:\Windows\System\xBeOfqn.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\oOIFYOL.exe
  C:\Windows\System\oOIFYOL.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\LlMkmYD.exe
  C:\Windows\System\LlMkmYD.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\bhikejx.exe
  C:\Windows\System\bhikejx.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\rCimfUM.exe
  C:\Windows\System\rCimfUM.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\NXguobA.exe
  C:\Windows\System\NXguobA.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\fpHybIB.exe
  C:\Windows\System\fpHybIB.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\mMpOZwa.exe
  C:\Windows\System\mMpOZwa.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\fbXVZDL.exe
  C:\Windows\System\fbXVZDL.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\hbPVRyn.exe
  C:\Windows\System\hbPVRyn.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\neOVBqj.exe
  C:\Windows\System\neOVBqj.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\OsJHgCy.exe
  C:\Windows\System\OsJHgCy.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\uOMHOKd.exe
  C:\Windows\System\uOMHOKd.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\LbMODWb.exe
  C:\Windows\System\LbMODWb.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\XEKjSvx.exe
  C:\Windows\System\XEKjSvx.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\YhgkDBL.exe
  C:\Windows\System\YhgkDBL.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\vSNwdSo.exe
  C:\Windows\System\vSNwdSo.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\WHrBXJe.exe
  C:\Windows\System\WHrBXJe.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\riGNOyJ.exe
  C:\Windows\System\riGNOyJ.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\oHHlxVM.exe
  C:\Windows\System\oHHlxVM.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\koBiWMi.exe
  C:\Windows\System\koBiWMi.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\zsyTgjR.exe
  C:\Windows\System\zsyTgjR.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\CpdKJfS.exe
  C:\Windows\System\CpdKJfS.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\kSxBWeZ.exe
  C:\Windows\System\kSxBWeZ.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\RJWVIwP.exe
  C:\Windows\System\RJWVIwP.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\TpcKQup.exe
  C:\Windows\System\TpcKQup.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\wrcCutd.exe
  C:\Windows\System\wrcCutd.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\CparhIR.exe
  C:\Windows\System\CparhIR.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\VDZzWjz.exe
  C:\Windows\System\VDZzWjz.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\brcBqUP.exe
  C:\Windows\System\brcBqUP.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\cBQtTLk.exe
  C:\Windows\System\cBQtTLk.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\wSoYBJs.exe
  C:\Windows\System\wSoYBJs.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\aKywofA.exe
  C:\Windows\System\aKywofA.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\AKjXlLJ.exe
  C:\Windows\System\AKjXlLJ.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\pfUPVmO.exe
  C:\Windows\System\pfUPVmO.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\VtKbXDP.exe
  C:\Windows\System\VtKbXDP.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\DzTDtDl.exe
  C:\Windows\System\DzTDtDl.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\tgGpzOa.exe
  C:\Windows\System\tgGpzOa.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\EIhHkpE.exe
  C:\Windows\System\EIhHkpE.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\XcdRdSM.exe
  C:\Windows\System\XcdRdSM.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\RcCMLOD.exe
  C:\Windows\System\RcCMLOD.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\uIqgplU.exe
  C:\Windows\System\uIqgplU.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\JGyZvcT.exe
  C:\Windows\System\JGyZvcT.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\zbAghEk.exe
  C:\Windows\System\zbAghEk.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\wJNygzR.exe
  C:\Windows\System\wJNygzR.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\qRVELrd.exe
  C:\Windows\System\qRVELrd.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\SJdnegp.exe
  C:\Windows\System\SJdnegp.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\qTwaGpB.exe
  C:\Windows\System\qTwaGpB.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\PTiXfUt.exe
  C:\Windows\System\PTiXfUt.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\zXWnVzL.exe
  C:\Windows\System\zXWnVzL.exe
  2⤵
  PID:4964
- C:\Windows\System\NJiFAQp.exe
  C:\Windows\System\NJiFAQp.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\iEVWnjv.exe
  C:\Windows\System\iEVWnjv.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\jTmgFaq.exe
  C:\Windows\System\jTmgFaq.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\mBGsAZv.exe
  C:\Windows\System\mBGsAZv.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\CDhXCmx.exe
  C:\Windows\System\CDhXCmx.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\xqJLoxB.exe
  C:\Windows\System\xqJLoxB.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\MGUFdnG.exe
  C:\Windows\System\MGUFdnG.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\OHddxGA.exe
  C:\Windows\System\OHddxGA.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\AzjXIkG.exe
  C:\Windows\System\AzjXIkG.exe
  2⤵
  PID:1384
- C:\Windows\System\dYsrwCS.exe
  C:\Windows\System\dYsrwCS.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\nqpZCIC.exe
  C:\Windows\System\nqpZCIC.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\ObKSLsK.exe
  C:\Windows\System\ObKSLsK.exe
  2⤵
  PID:4572
- C:\Windows\System\DGczCDp.exe
  C:\Windows\System\DGczCDp.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\xeZHVvN.exe
  C:\Windows\System\xeZHVvN.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\aIRNyet.exe
  C:\Windows\System\aIRNyet.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\maDiWia.exe
  C:\Windows\System\maDiWia.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\zuBuIEh.exe
  C:\Windows\System\zuBuIEh.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\BGoBNBH.exe
  C:\Windows\System\BGoBNBH.exe
  2⤵
  PID:2324
- C:\Windows\System\zocyBXY.exe
  C:\Windows\System\zocyBXY.exe
  2⤵
  PID:1388
- C:\Windows\System\EOcbIdu.exe
  C:\Windows\System\EOcbIdu.exe
  2⤵
  PID:5088
- C:\Windows\System\XIqLJyz.exe
  C:\Windows\System\XIqLJyz.exe
  2⤵
  PID:3068
- C:\Windows\System\zLXffsL.exe
  C:\Windows\System\zLXffsL.exe
  2⤵
  PID:1180
- C:\Windows\System\WSYfsXu.exe
  C:\Windows\System\WSYfsXu.exe
  2⤵
  PID:1228
- C:\Windows\System\tHbLbiS.exe
  C:\Windows\System\tHbLbiS.exe
  2⤵
  PID:468
- C:\Windows\System\WJvVHvJ.exe
  C:\Windows\System\WJvVHvJ.exe
  2⤵
  PID:4980
- C:\Windows\System\WdMFFxX.exe
  C:\Windows\System\WdMFFxX.exe
  2⤵
  PID:3464
- C:\Windows\System\DhCUaKx.exe
  C:\Windows\System\DhCUaKx.exe
  2⤵
  PID:3084
- C:\Windows\System\qctClqV.exe
  C:\Windows\System\qctClqV.exe
  2⤵
  PID:556
- C:\Windows\System\WYxlJvV.exe
  C:\Windows\System\WYxlJvV.exe
  2⤵
  PID:4952
- C:\Windows\System\tDwpKIR.exe
  C:\Windows\System\tDwpKIR.exe
  2⤵
  PID:3696
- C:\Windows\System\MqcIPIZ.exe
  C:\Windows\System\MqcIPIZ.exe
  2⤵
  PID:4496
- C:\Windows\System\uRYapwm.exe
  C:\Windows\System\uRYapwm.exe
  2⤵
  PID:4856
- C:\Windows\System\TTiqbGq.exe
  C:\Windows\System\TTiqbGq.exe
  2⤵
  PID:5124
- C:\Windows\System\UjLpgbm.exe
  C:\Windows\System\UjLpgbm.exe
  2⤵
  PID:5140
- C:\Windows\System\xLpiUFf.exe
  C:\Windows\System\xLpiUFf.exe
  2⤵
  PID:5160
- C:\Windows\System\pkutSmK.exe
  C:\Windows\System\pkutSmK.exe
  2⤵
  PID:5180
- C:\Windows\System\aeJQtcz.exe
  C:\Windows\System\aeJQtcz.exe
  2⤵
  PID:5200
- C:\Windows\System\jXxCZoC.exe
  C:\Windows\System\jXxCZoC.exe
  2⤵
  PID:5248
- C:\Windows\System\ciIZNqZ.exe
  C:\Windows\System\ciIZNqZ.exe
  2⤵
  PID:5272
- C:\Windows\System\uYbeguJ.exe
  C:\Windows\System\uYbeguJ.exe
  2⤵
  PID:5288
- C:\Windows\System\KhYlCto.exe
  C:\Windows\System\KhYlCto.exe
  2⤵
  PID:5308
- C:\Windows\System\TtKrkmq.exe
  C:\Windows\System\TtKrkmq.exe
  2⤵
  PID:5324
- C:\Windows\System\sXJpLFD.exe
  C:\Windows\System\sXJpLFD.exe
  2⤵
  PID:5348
- C:\Windows\System\DnJSXrl.exe
  C:\Windows\System\DnJSXrl.exe
  2⤵
  PID:5364
- C:\Windows\System\nDnAPkX.exe
  C:\Windows\System\nDnAPkX.exe
  2⤵
  PID:5388
- C:\Windows\System\GOSNQNl.exe
  C:\Windows\System\GOSNQNl.exe
  2⤵
  PID:5404
- C:\Windows\System\hiwaCBU.exe
  C:\Windows\System\hiwaCBU.exe
  2⤵
  PID:5424
- C:\Windows\System\UYlUKmH.exe
  C:\Windows\System\UYlUKmH.exe
  2⤵
  PID:5448
- C:\Windows\System\jWHWnsE.exe
  C:\Windows\System\jWHWnsE.exe
  2⤵
  PID:5468
- C:\Windows\System\hflwQrP.exe
  C:\Windows\System\hflwQrP.exe
  2⤵
  PID:5492
- C:\Windows\System\HpmYUon.exe
  C:\Windows\System\HpmYUon.exe
  2⤵
  PID:5508
- C:\Windows\System\BwIqtVo.exe
  C:\Windows\System\BwIqtVo.exe
  2⤵
  PID:5532
- C:\Windows\System\fygyunH.exe
  C:\Windows\System\fygyunH.exe
  2⤵
  PID:5552
- C:\Windows\System\iRJmChn.exe
  C:\Windows\System\iRJmChn.exe
  2⤵
  PID:5568
- C:\Windows\System\fZznadn.exe
  C:\Windows\System\fZznadn.exe
  2⤵
  PID:5592
- C:\Windows\System\KwCcMOV.exe
  C:\Windows\System\KwCcMOV.exe
  2⤵
  PID:5608
- C:\Windows\System\nYzdCqS.exe
  C:\Windows\System\nYzdCqS.exe
  2⤵
  PID:5636
- C:\Windows\System\ePyodfa.exe
  C:\Windows\System\ePyodfa.exe
  2⤵
  PID:5652
- C:\Windows\System\nVtPAzE.exe
  C:\Windows\System\nVtPAzE.exe
  2⤵
  PID:5672
- C:\Windows\System\AQhQRLU.exe
  C:\Windows\System\AQhQRLU.exe
  2⤵
  PID:5696
- C:\Windows\System\veFYKqt.exe
  C:\Windows\System\veFYKqt.exe
  2⤵
  PID:5716
- C:\Windows\System\jxdyLVd.exe
  C:\Windows\System\jxdyLVd.exe
  2⤵
  PID:5732
- C:\Windows\System\VEDmGrc.exe
  C:\Windows\System\VEDmGrc.exe
  2⤵
  PID:5760
- C:\Windows\System\hzRhOAq.exe
  C:\Windows\System\hzRhOAq.exe
  2⤵
  PID:5776
- C:\Windows\System\YIhSszR.exe
  C:\Windows\System\YIhSszR.exe
  2⤵
  PID:5800
- C:\Windows\System\LdRGQCT.exe
  C:\Windows\System\LdRGQCT.exe
  2⤵
  PID:5820
- C:\Windows\System\IRiVgkw.exe
  C:\Windows\System\IRiVgkw.exe
  2⤵
  PID:5836
- C:\Windows\System\xSHxAuL.exe
  C:\Windows\System\xSHxAuL.exe
  2⤵
  PID:5860
- C:\Windows\System\arRHTnz.exe
  C:\Windows\System\arRHTnz.exe
  2⤵
  PID:5876
- C:\Windows\System\aJrFptq.exe
  C:\Windows\System\aJrFptq.exe
  2⤵
  PID:5900
- C:\Windows\System\qlOquxM.exe
  C:\Windows\System\qlOquxM.exe
  2⤵
  PID:5916
- C:\Windows\System\ChJzhSK.exe
  C:\Windows\System\ChJzhSK.exe
  2⤵
  PID:5940
- C:\Windows\System\KFYtspL.exe
  C:\Windows\System\KFYtspL.exe
  2⤵
  PID:6004
- C:\Windows\System\oPPsDos.exe
  C:\Windows\System\oPPsDos.exe
  2⤵
  PID:6028
- C:\Windows\System\csofKGa.exe
  C:\Windows\System\csofKGa.exe
  2⤵
  PID:6044
- C:\Windows\System\pGPwHrx.exe
  C:\Windows\System\pGPwHrx.exe
  2⤵
  PID:6068
- C:\Windows\System\yhgdZrP.exe
  C:\Windows\System\yhgdZrP.exe
  2⤵
  PID:6088
- C:\Windows\System\nJHPRAR.exe
  C:\Windows\System\nJHPRAR.exe
  2⤵
  PID:6104
- C:\Windows\System\ONcLiNM.exe
  C:\Windows\System\ONcLiNM.exe
  2⤵
  PID:6124
- C:\Windows\System\kCvPKcs.exe
  C:\Windows\System\kCvPKcs.exe
  2⤵
  PID:3624
- C:\Windows\System\gzSBJNu.exe
  C:\Windows\System\gzSBJNu.exe
  2⤵
  PID:3732
- C:\Windows\System\rAEaYmh.exe
  C:\Windows\System\rAEaYmh.exe
  2⤵
  PID:4512
- C:\Windows\System\DqYuptZ.exe
  C:\Windows\System\DqYuptZ.exe
  2⤵
  PID:3584
- C:\Windows\System\IezLAGq.exe
  C:\Windows\System\IezLAGq.exe
  2⤵
  PID:4208
- C:\Windows\System\cEQTuUi.exe
  C:\Windows\System\cEQTuUi.exe
  2⤵
  PID:4532
- C:\Windows\System\kKKUbZC.exe
  C:\Windows\System\kKKUbZC.exe
  2⤵
  PID:4720
- C:\Windows\System\PhdkGKC.exe
  C:\Windows\System\PhdkGKC.exe
  2⤵
  PID:1472
- C:\Windows\System\STcySIU.exe
  C:\Windows\System\STcySIU.exe
  2⤵
  PID:4460
- C:\Windows\System\xjMDzJe.exe
  C:\Windows\System\xjMDzJe.exe
  2⤵
  PID:720
- C:\Windows\System\chtmmIe.exe
  C:\Windows\System\chtmmIe.exe
  2⤵
  PID:4540
- C:\Windows\System\lrxmVcI.exe
  C:\Windows\System\lrxmVcI.exe
  2⤵
  PID:5396
- C:\Windows\System\PqZPmKN.exe
  C:\Windows\System\PqZPmKN.exe
  2⤵
  PID:4604
- C:\Windows\System\EDHuHPr.exe
  C:\Windows\System\EDHuHPr.exe
  2⤵
  PID:1680
- C:\Windows\System\LJtjwpO.exe
  C:\Windows\System\LJtjwpO.exe
  2⤵
  PID:5544
- C:\Windows\System\jUDCVxW.exe
  C:\Windows\System\jUDCVxW.exe
  2⤵
  PID:5576
- C:\Windows\System\iXWJtgR.exe
  C:\Windows\System\iXWJtgR.exe
  2⤵
  PID:2496
- C:\Windows\System\LowwOrG.exe
  C:\Windows\System\LowwOrG.exe
  2⤵
  PID:5684
- C:\Windows\System\PxtQTVM.exe
  C:\Windows\System\PxtQTVM.exe
  2⤵
  PID:5740
- C:\Windows\System\OaiqAYv.exe
  C:\Windows\System\OaiqAYv.exe
  2⤵
  PID:5748
- C:\Windows\System\RBNmItA.exe
  C:\Windows\System\RBNmItA.exe
  2⤵
  PID:5816
- C:\Windows\System\xaEeGhB.exe
  C:\Windows\System\xaEeGhB.exe
  2⤵
  PID:5912
- C:\Windows\System\CsClJUW.exe
  C:\Windows\System\CsClJUW.exe
  2⤵
  PID:6168
- C:\Windows\System\hEFDLEo.exe
  C:\Windows\System\hEFDLEo.exe
  2⤵
  PID:6184
- C:\Windows\System\WCvHZrF.exe
  C:\Windows\System\WCvHZrF.exe
  2⤵
  PID:6208
- C:\Windows\System\IWNJTjT.exe
  C:\Windows\System\IWNJTjT.exe
  2⤵
  PID:6228
- C:\Windows\System\JGIyoEU.exe
  C:\Windows\System\JGIyoEU.exe
  2⤵
  PID:6248
- C:\Windows\System\MHmkvWf.exe
  C:\Windows\System\MHmkvWf.exe
  2⤵
  PID:6264
- C:\Windows\System\oMemwqE.exe
  C:\Windows\System\oMemwqE.exe
  2⤵
  PID:6292
- C:\Windows\System\IXZaLSg.exe
  C:\Windows\System\IXZaLSg.exe
  2⤵
  PID:6308
- C:\Windows\System\IREDFAm.exe
  C:\Windows\System\IREDFAm.exe
  2⤵
  PID:6324
- C:\Windows\System\xsMHfeF.exe
  C:\Windows\System\xsMHfeF.exe
  2⤵
  PID:6340
- C:\Windows\System\kBPahTx.exe
  C:\Windows\System\kBPahTx.exe
  2⤵
  PID:6356
- C:\Windows\System\aBiJCQB.exe
  C:\Windows\System\aBiJCQB.exe
  2⤵
  PID:6380
- C:\Windows\System\fGLbsPA.exe
  C:\Windows\System\fGLbsPA.exe
  2⤵
  PID:6396
- C:\Windows\System\PWWLZup.exe
  C:\Windows\System\PWWLZup.exe
  2⤵
  PID:6412
- C:\Windows\System\CZxBMQG.exe
  C:\Windows\System\CZxBMQG.exe
  2⤵
  PID:6432
- C:\Windows\System\YKabTBO.exe
  C:\Windows\System\YKabTBO.exe
  2⤵
  PID:6448
- C:\Windows\System\BiKYWFW.exe
  C:\Windows\System\BiKYWFW.exe
  2⤵
  PID:6476
- C:\Windows\System\rkHJVQz.exe
  C:\Windows\System\rkHJVQz.exe
  2⤵
  PID:6500
- C:\Windows\System\nnodZNN.exe
  C:\Windows\System\nnodZNN.exe
  2⤵
  PID:6516
- C:\Windows\System\SqasPRV.exe
  C:\Windows\System\SqasPRV.exe
  2⤵
  PID:6540
- C:\Windows\System\QtHeuha.exe
  C:\Windows\System\QtHeuha.exe
  2⤵
  PID:6556
- C:\Windows\System\PlOhazb.exe
  C:\Windows\System\PlOhazb.exe
  2⤵
  PID:6576
- C:\Windows\System\MSNrKTA.exe
  C:\Windows\System\MSNrKTA.exe
  2⤵
  PID:6592
- C:\Windows\System\JpBAXXR.exe
  C:\Windows\System\JpBAXXR.exe
  2⤵
  PID:6624
- C:\Windows\System\ovLWtLU.exe
  C:\Windows\System\ovLWtLU.exe
  2⤵
  PID:6648
- C:\Windows\System\NqAAOSH.exe
  C:\Windows\System\NqAAOSH.exe
  2⤵
  PID:6668
- C:\Windows\System\beqTubZ.exe
  C:\Windows\System\beqTubZ.exe
  2⤵
  PID:6692
- C:\Windows\System\azBMCDp.exe
  C:\Windows\System\azBMCDp.exe
  2⤵
  PID:6708
- C:\Windows\System\jAlEACN.exe
  C:\Windows\System\jAlEACN.exe
  2⤵
  PID:6728
- C:\Windows\System\OoncBjC.exe
  C:\Windows\System\OoncBjC.exe
  2⤵
  PID:6748
- C:\Windows\System\OMIccLc.exe
  C:\Windows\System\OMIccLc.exe
  2⤵
  PID:6768
- C:\Windows\System\rtXxHcC.exe
  C:\Windows\System\rtXxHcC.exe
  2⤵
  PID:6788
- C:\Windows\System\rQXsdAm.exe
  C:\Windows\System\rQXsdAm.exe
  2⤵
  PID:6812
- C:\Windows\System\WCrmEfE.exe
  C:\Windows\System\WCrmEfE.exe
  2⤵
  PID:6828
- C:\Windows\System\SjWGYEj.exe
  C:\Windows\System\SjWGYEj.exe
  2⤵
  PID:6852
- C:\Windows\System\gylXDkD.exe
  C:\Windows\System\gylXDkD.exe
  2⤵
  PID:6872
- C:\Windows\System\SXhMXKn.exe
  C:\Windows\System\SXhMXKn.exe
  2⤵
  PID:6892
- C:\Windows\System\CJUrRNl.exe
  C:\Windows\System\CJUrRNl.exe
  2⤵
  PID:6908
- C:\Windows\System\ZJfpIZc.exe
  C:\Windows\System\ZJfpIZc.exe
  2⤵
  PID:6932
- C:\Windows\System\YFoizOi.exe
  C:\Windows\System\YFoizOi.exe
  2⤵
  PID:6948
- C:\Windows\System\hcODPDj.exe
  C:\Windows\System\hcODPDj.exe
  2⤵
  PID:6972
- C:\Windows\System\zbTnqcQ.exe
  C:\Windows\System\zbTnqcQ.exe
  2⤵
  PID:6992
- C:\Windows\System\yJIJErl.exe
  C:\Windows\System\yJIJErl.exe
  2⤵
  PID:7008
- C:\Windows\System\lsgozUj.exe
  C:\Windows\System\lsgozUj.exe
  2⤵
  PID:7032
- C:\Windows\System\ewglqAx.exe
  C:\Windows\System\ewglqAx.exe
  2⤵
  PID:7052
- C:\Windows\System\EvwTYAg.exe
  C:\Windows\System\EvwTYAg.exe
  2⤵
  PID:7076
- C:\Windows\System\nsJmcjL.exe
  C:\Windows\System\nsJmcjL.exe
  2⤵
  PID:7092
- C:\Windows\System\RfpxEJq.exe
  C:\Windows\System\RfpxEJq.exe
  2⤵
  PID:7108
- C:\Windows\System\ddKehQN.exe
  C:\Windows\System\ddKehQN.exe
  2⤵
  PID:7132
- C:\Windows\System\CjBHlcT.exe
  C:\Windows\System\CjBHlcT.exe
  2⤵
  PID:7148
- C:\Windows\System\PuOlpjC.exe
  C:\Windows\System\PuOlpjC.exe
  2⤵
  PID:4452
- C:\Windows\System\YZvFltS.exe
  C:\Windows\System\YZvFltS.exe
  2⤵
  PID:2100
- C:\Windows\System\QOGFfjm.exe
  C:\Windows\System\QOGFfjm.exe
  2⤵
  PID:5064
- C:\Windows\System\SUhlKUK.exe
  C:\Windows\System\SUhlKUK.exe
  2⤵
  PID:1976
- C:\Windows\System\OjwsgCS.exe
  C:\Windows\System\OjwsgCS.exe
  2⤵
  PID:5356
- C:\Windows\System\HeYNpqS.exe
  C:\Windows\System\HeYNpqS.exe
  2⤵
  PID:5008
- C:\Windows\System\APLCwQq.exe
  C:\Windows\System\APLCwQq.exe
  2⤵
  PID:3284
- C:\Windows\System\YrpDPSw.exe
  C:\Windows\System\YrpDPSw.exe
  2⤵
  PID:5644
- C:\Windows\System\GlSYYye.exe
  C:\Windows\System\GlSYYye.exe
  2⤵
  PID:5768
- C:\Windows\System\IVCjPme.exe
  C:\Windows\System\IVCjPme.exe
  2⤵
  PID:5152
- C:\Windows\System\bBuytCY.exe
  C:\Windows\System\bBuytCY.exe
  2⤵
  PID:5188
- C:\Windows\System\cYvbGhy.exe
  C:\Windows\System\cYvbGhy.exe
  2⤵
  PID:5884
- C:\Windows\System\zdkZHAz.exe
  C:\Windows\System\zdkZHAz.exe
  2⤵
  PID:5908
- C:\Windows\System\ZmqmPdR.exe
  C:\Windows\System\ZmqmPdR.exe
  2⤵
  PID:7184
- C:\Windows\System\hMdQYld.exe
  C:\Windows\System\hMdQYld.exe
  2⤵
  PID:7208
- C:\Windows\System\BQyoxmk.exe
  C:\Windows\System\BQyoxmk.exe
  2⤵
  PID:7224
- C:\Windows\System\KQFIFek.exe
  C:\Windows\System\KQFIFek.exe
  2⤵
  PID:7240
- C:\Windows\System\ibjpXPZ.exe
  C:\Windows\System\ibjpXPZ.exe
  2⤵
  PID:7260
- C:\Windows\System\CWRbQxL.exe
  C:\Windows\System\CWRbQxL.exe
  2⤵
  PID:7280
- C:\Windows\System\TydocEO.exe
  C:\Windows\System\TydocEO.exe
  2⤵
  PID:7308
- C:\Windows\System\UyyQJAo.exe
  C:\Windows\System\UyyQJAo.exe
  2⤵
  PID:7328
- C:\Windows\System\jIyakLF.exe
  C:\Windows\System\jIyakLF.exe
  2⤵
  PID:7344
- C:\Windows\System\KfsWcLa.exe
  C:\Windows\System\KfsWcLa.exe
  2⤵
  PID:7364
- C:\Windows\System\oqcbxmw.exe
  C:\Windows\System\oqcbxmw.exe
  2⤵
  PID:7396
- C:\Windows\System\gyjwalV.exe
  C:\Windows\System\gyjwalV.exe
  2⤵
  PID:7412
- C:\Windows\System\orrcsth.exe
  C:\Windows\System\orrcsth.exe
  2⤵
  PID:7436
- C:\Windows\System\jnQuJSK.exe
  C:\Windows\System\jnQuJSK.exe
  2⤵
  PID:7460
- C:\Windows\System\wLHmlOm.exe
  C:\Windows\System\wLHmlOm.exe
  2⤵
  PID:7476
- C:\Windows\System\uXdGuXZ.exe
  C:\Windows\System\uXdGuXZ.exe
  2⤵
  PID:7500
- C:\Windows\System\jHPCxOz.exe
  C:\Windows\System\jHPCxOz.exe
  2⤵
  PID:7516
- C:\Windows\System\UKJOrPF.exe
  C:\Windows\System\UKJOrPF.exe
  2⤵
  PID:7540
- C:\Windows\System\tIiuHmt.exe
  C:\Windows\System\tIiuHmt.exe
  2⤵
  PID:7556
- C:\Windows\System\MmmycJk.exe
  C:\Windows\System\MmmycJk.exe
  2⤵
  PID:7580
- C:\Windows\System\NYxxCSn.exe
  C:\Windows\System\NYxxCSn.exe
  2⤵
  PID:7596
- C:\Windows\System\fhvHLgy.exe
  C:\Windows\System\fhvHLgy.exe
  2⤵
  PID:7620
- C:\Windows\System\voFMGWM.exe
  C:\Windows\System\voFMGWM.exe
  2⤵
  PID:7644
- C:\Windows\System\nNLdkGy.exe
  C:\Windows\System\nNLdkGy.exe
  2⤵
  PID:7668
- C:\Windows\System\CiLbLkr.exe
  C:\Windows\System\CiLbLkr.exe
  2⤵
  PID:7684
- C:\Windows\System\dFyDaWh.exe
  C:\Windows\System\dFyDaWh.exe
  2⤵
  PID:7704
- C:\Windows\System\fTDUCQs.exe
  C:\Windows\System\fTDUCQs.exe
  2⤵
  PID:7724
- C:\Windows\System\VqwPHgO.exe
  C:\Windows\System\VqwPHgO.exe
  2⤵
  PID:7744
- C:\Windows\System\NFDzStQ.exe
  C:\Windows\System\NFDzStQ.exe
  2⤵
  PID:7764
- C:\Windows\System\YIwdtdv.exe
  C:\Windows\System\YIwdtdv.exe
  2⤵
  PID:7780
- C:\Windows\System\XeazsZK.exe
  C:\Windows\System\XeazsZK.exe
  2⤵
  PID:7848
- C:\Windows\System\hYIrQkN.exe
  C:\Windows\System\hYIrQkN.exe
  2⤵
  PID:7872
- C:\Windows\System\rVBTIAi.exe
  C:\Windows\System\rVBTIAi.exe
  2⤵
  PID:7888
- C:\Windows\System\EuIfbAY.exe
  C:\Windows\System\EuIfbAY.exe
  2⤵
  PID:7908
- C:\Windows\System\plvYVEZ.exe
  C:\Windows\System\plvYVEZ.exe
  2⤵
  PID:7932
- C:\Windows\System\mVcmYYU.exe
  C:\Windows\System\mVcmYYU.exe
  2⤵
  PID:7948
- C:\Windows\System\yOwhjcv.exe
  C:\Windows\System\yOwhjcv.exe
  2⤵
  PID:7976
- C:\Windows\System\qOqXLXW.exe
  C:\Windows\System\qOqXLXW.exe
  2⤵
  PID:7992
- C:\Windows\System\UytvNGs.exe
  C:\Windows\System\UytvNGs.exe
  2⤵
  PID:8016
- C:\Windows\System\kPihVYZ.exe
  C:\Windows\System\kPihVYZ.exe
  2⤵
  PID:8036
- C:\Windows\System\JXylBZh.exe
  C:\Windows\System\JXylBZh.exe
  2⤵
  PID:8068
- C:\Windows\System\rXuQPMI.exe
  C:\Windows\System\rXuQPMI.exe
  2⤵
  PID:8088
- C:\Windows\System\TDIqail.exe
  C:\Windows\System\TDIqail.exe
  2⤵
  PID:8104
- C:\Windows\System\oYHHsAR.exe
  C:\Windows\System\oYHHsAR.exe
  2⤵
  PID:8128
- C:\Windows\System\BkwkkgC.exe
  C:\Windows\System\BkwkkgC.exe
  2⤵
  PID:8148
- C:\Windows\System\LKuetZN.exe
  C:\Windows\System\LKuetZN.exe
  2⤵
  PID:8164
- C:\Windows\System\QYOANlC.exe
  C:\Windows\System\QYOANlC.exe
  2⤵
  PID:8180
- C:\Windows\System\zzfDNsJ.exe
  C:\Windows\System\zzfDNsJ.exe
  2⤵
  PID:6244
- C:\Windows\System\bbeWmXs.exe
  C:\Windows\System\bbeWmXs.exe
  2⤵
  PID:5240
- C:\Windows\System\qrjQCpG.exe
  C:\Windows\System\qrjQCpG.exe
  2⤵
  PID:6372
- C:\Windows\System\zeIZMWJ.exe
  C:\Windows\System\zeIZMWJ.exe
  2⤵
  PID:5340
- C:\Windows\System\cAZNtcq.exe
  C:\Windows\System\cAZNtcq.exe
  2⤵
  PID:5412
- C:\Windows\System\fffAOri.exe
  C:\Windows\System\fffAOri.exe
  2⤵
  PID:2384
- C:\Windows\System\bQKfAtX.exe
  C:\Windows\System\bQKfAtX.exe
  2⤵
  PID:6532
- C:\Windows\System\EBWExtH.exe
  C:\Windows\System\EBWExtH.exe
  2⤵
  PID:4632
- C:\Windows\System\vwCrDhQ.exe
  C:\Windows\System\vwCrDhQ.exe
  2⤵
  PID:5528
- C:\Windows\System\JkgHcpm.exe
  C:\Windows\System\JkgHcpm.exe
  2⤵
  PID:5604
- C:\Windows\System\BIiZlER.exe
  C:\Windows\System\BIiZlER.exe
  2⤵
  PID:4232
- C:\Windows\System\PYyfBKI.exe
  C:\Windows\System\PYyfBKI.exe
  2⤵
  PID:6780
- C:\Windows\System\WFKTxVg.exe
  C:\Windows\System\WFKTxVg.exe
  2⤵
  PID:6632
- C:\Windows\System\NZmOKLs.exe
  C:\Windows\System\NZmOKLs.exe
  2⤵
  PID:6584
- C:\Windows\System\ySKeAPh.exe
  C:\Windows\System\ySKeAPh.exe
  2⤵
  PID:2748
- C:\Windows\System\heSkuDE.exe
  C:\Windows\System\heSkuDE.exe
  2⤵
  PID:6864
- C:\Windows\System\bpdflCb.exe
  C:\Windows\System\bpdflCb.exe
  2⤵
  PID:7088
- C:\Windows\System\sdboAZh.exe
  C:\Windows\System\sdboAZh.exe
  2⤵
  PID:4468
- C:\Windows\System\gxIjldg.exe
  C:\Windows\System\gxIjldg.exe
  2⤵
  PID:5668
- C:\Windows\System\rmlDybC.exe
  C:\Windows\System\rmlDybC.exe
  2⤵
  PID:892
- C:\Windows\System\mGzaCKT.exe
  C:\Windows\System\mGzaCKT.exe
  2⤵
  PID:2984
- C:\Windows\System\szKGxQW.exe
  C:\Windows\System\szKGxQW.exe
  2⤵
  PID:5844
- C:\Windows\System\NjyXkvo.exe
  C:\Windows\System\NjyXkvo.exe
  2⤵
  PID:5888
- C:\Windows\System\zdUAcLr.exe
  C:\Windows\System\zdUAcLr.exe
  2⤵
  PID:7216
- C:\Windows\System\aTlYKzR.exe
  C:\Windows\System\aTlYKzR.exe
  2⤵
  PID:7232
- C:\Windows\System\IfOEwEr.exe
  C:\Windows\System\IfOEwEr.exe
  2⤵
  PID:7372
- C:\Windows\System\FGpqRNt.exe
  C:\Windows\System\FGpqRNt.exe
  2⤵
  PID:5976
- C:\Windows\System\IDfFYLQ.exe
  C:\Windows\System\IDfFYLQ.exe
  2⤵
  PID:7536
- C:\Windows\System\IzgCdhp.exe
  C:\Windows\System\IzgCdhp.exe
  2⤵
  PID:6000
- C:\Windows\System\rWRwMMs.exe
  C:\Windows\System\rWRwMMs.exe
  2⤵
  PID:7632
- C:\Windows\System\tZoGGpS.exe
  C:\Windows\System\tZoGGpS.exe
  2⤵
  PID:6056
- C:\Windows\System\NIpVHoG.exe
  C:\Windows\System\NIpVHoG.exe
  2⤵
  PID:7660
- C:\Windows\System\UDEzwNy.exe
  C:\Windows\System\UDEzwNy.exe
  2⤵
  PID:7736
- C:\Windows\System\YKDMfjl.exe
  C:\Windows\System\YKDMfjl.exe
  2⤵
  PID:8200
- C:\Windows\System\raAIGeK.exe
  C:\Windows\System\raAIGeK.exe
  2⤵
  PID:8220
- C:\Windows\System\pGBxWIP.exe
  C:\Windows\System\pGBxWIP.exe
  2⤵
  PID:8236
- C:\Windows\System\htiICrK.exe
  C:\Windows\System\htiICrK.exe
  2⤵
  PID:8260
- C:\Windows\System\MxVSIZH.exe
  C:\Windows\System\MxVSIZH.exe
  2⤵
  PID:8468
- C:\Windows\System\MjGGNKU.exe
  C:\Windows\System\MjGGNKU.exe
  2⤵
  PID:8484
- C:\Windows\System\zfRcAah.exe
  C:\Windows\System\zfRcAah.exe
  2⤵
  PID:8500
- C:\Windows\System\PJVujdo.exe
  C:\Windows\System\PJVujdo.exe
  2⤵
  PID:8516
- C:\Windows\System\JcpYwJx.exe
  C:\Windows\System\JcpYwJx.exe
  2⤵
  PID:8532
- C:\Windows\System\vKyNhvG.exe
  C:\Windows\System\vKyNhvG.exe
  2⤵
  PID:8548
- C:\Windows\System\jFmDiKq.exe
  C:\Windows\System\jFmDiKq.exe
  2⤵
  PID:8564
- C:\Windows\System\bwYifqH.exe
  C:\Windows\System\bwYifqH.exe
  2⤵
  PID:8892
- C:\Windows\System\IflSctO.exe
  C:\Windows\System\IflSctO.exe
  2⤵
  PID:8916
- C:\Windows\System\suyRSwW.exe
  C:\Windows\System\suyRSwW.exe
  2⤵
  PID:8932
- C:\Windows\System\BgdzFsW.exe
  C:\Windows\System\BgdzFsW.exe
  2⤵
  PID:8948
- C:\Windows\System\qhXcVoo.exe
  C:\Windows\System\qhXcVoo.exe
  2⤵
  PID:8964
- C:\Windows\System\xqKWBwL.exe
  C:\Windows\System\xqKWBwL.exe
  2⤵
  PID:8980
- C:\Windows\System\xcdXbmK.exe
  C:\Windows\System\xcdXbmK.exe
  2⤵
  PID:8996
- C:\Windows\System\aCCxHBX.exe
  C:\Windows\System\aCCxHBX.exe
  2⤵
  PID:9012
- C:\Windows\System\WDzuDtQ.exe
  C:\Windows\System\WDzuDtQ.exe
  2⤵
  PID:9028
- C:\Windows\System\AqnESOa.exe
  C:\Windows\System\AqnESOa.exe
  2⤵
  PID:9044
- C:\Windows\System\MdukIMH.exe
  C:\Windows\System\MdukIMH.exe
  2⤵
  PID:9060
- C:\Windows\System\GrLjIEx.exe
  C:\Windows\System\GrLjIEx.exe
  2⤵
  PID:9076
- C:\Windows\System\xiBTvBb.exe
  C:\Windows\System\xiBTvBb.exe
  2⤵
  PID:9092
- C:\Windows\System\nPUHQDy.exe
  C:\Windows\System\nPUHQDy.exe
  2⤵
  PID:9112
- C:\Windows\System\WxvmKqJ.exe
  C:\Windows\System\WxvmKqJ.exe
  2⤵
  PID:9128
- C:\Windows\System\AkgvWwE.exe
  C:\Windows\System\AkgvWwE.exe
  2⤵
  PID:9148
- C:\Windows\System\CDCeGrp.exe
  C:\Windows\System\CDCeGrp.exe
  2⤵
  PID:9208
- C:\Windows\System\GcEZzCF.exe
  C:\Windows\System\GcEZzCF.exe
  2⤵
  PID:6512
- C:\Windows\System\qBYKgVn.exe
  C:\Windows\System\qBYKgVn.exe
  2⤵
  PID:4968
- C:\Windows\System\NstOTfs.exe
  C:\Windows\System\NstOTfs.exe
  2⤵
  PID:6224
- C:\Windows\System\uQciFgo.exe
  C:\Windows\System\uQciFgo.exe
  2⤵
  PID:7588
- C:\Windows\System\zcmSAfm.exe
  C:\Windows\System\zcmSAfm.exe
  2⤵
  PID:6588
- C:\Windows\System\HBpPgzX.exe
  C:\Windows\System\HBpPgzX.exe
  2⤵
  PID:6684
- C:\Windows\System\aryGvcQ.exe
  C:\Windows\System\aryGvcQ.exe
  2⤵
  PID:6796
- C:\Windows\System\VXVZfbi.exe
  C:\Windows\System\VXVZfbi.exe
  2⤵
  PID:6888
- C:\Windows\System\WwkvUqI.exe
  C:\Windows\System\WwkvUqI.exe
  2⤵
  PID:6928
- C:\Windows\System\TYxoBzp.exe
  C:\Windows\System\TYxoBzp.exe
  2⤵
  PID:6964
- C:\Windows\System\WSUYuor.exe
  C:\Windows\System\WSUYuor.exe
  2⤵
  PID:7004
- C:\Windows\System\OgPJVgv.exe
  C:\Windows\System\OgPJVgv.exe
  2⤵
  PID:4000
- C:\Windows\System\VHvwzjg.exe
  C:\Windows\System\VHvwzjg.exe
  2⤵
  PID:7064
- C:\Windows\System\TBjRlFs.exe
  C:\Windows\System\TBjRlFs.exe
  2⤵
  PID:7116
- C:\Windows\System\UbWtzCE.exe
  C:\Windows\System\UbWtzCE.exe
  2⤵
  PID:4872
- C:\Windows\System\DWEUruU.exe
  C:\Windows\System\DWEUruU.exe
  2⤵
  PID:5212
- C:\Windows\System\uNvZMdt.exe
  C:\Windows\System\uNvZMdt.exe
  2⤵
  PID:7248
- C:\Windows\System\Lgyhrvb.exe
  C:\Windows\System\Lgyhrvb.exe
  2⤵
  PID:7336
- C:\Windows\System\rPXLsbp.exe
  C:\Windows\System\rPXLsbp.exe
  2⤵
  PID:7404
- C:\Windows\System\OgNfgpZ.exe
  C:\Windows\System\OgNfgpZ.exe
  2⤵
  PID:7432
- C:\Windows\System\xZcRcxn.exe
  C:\Windows\System\xZcRcxn.exe
  2⤵
  PID:7468
- C:\Windows\System\jUIXkxB.exe
  C:\Windows\System\jUIXkxB.exe
  2⤵
  PID:7524
- C:\Windows\System\yNwKEnc.exe
  C:\Windows\System\yNwKEnc.exe
  2⤵
  PID:6456
- C:\Windows\System\evXliMk.exe
  C:\Windows\System\evXliMk.exe
  2⤵
  PID:6916
- C:\Windows\System\aPLUAPW.exe
  C:\Windows\System\aPLUAPW.exe
  2⤵
  PID:7592
- C:\Windows\System\CJyxNXR.exe
  C:\Windows\System\CJyxNXR.exe
  2⤵
  PID:8292
- C:\Windows\System\DkoNqps.exe
  C:\Windows\System\DkoNqps.exe
  2⤵
  PID:6260
- C:\Windows\System\WwHMrww.exe
  C:\Windows\System\WwHMrww.exe
  2⤵
  PID:5300
- C:\Windows\System\YXpFFAj.exe
  C:\Windows\System\YXpFFAj.exe
  2⤵
  PID:5420
- C:\Windows\System\HIWahMI.exe
  C:\Windows\System\HIWahMI.exe
  2⤵
  PID:880
- C:\Windows\System\PVcCeKB.exe
  C:\Windows\System\PVcCeKB.exe
  2⤵
  PID:6744
- C:\Windows\System\xceevOk.exe
  C:\Windows\System\xceevOk.exe
  2⤵
  PID:3488
- C:\Windows\System\GLxdKtW.exe
  C:\Windows\System\GLxdKtW.exe
  2⤵
  PID:6740
- C:\Windows\System\yVDuXPK.exe
  C:\Windows\System\yVDuXPK.exe
  2⤵
  PID:6848
- C:\Windows\System\RRxSGPl.exe
  C:\Windows\System\RRxSGPl.exe
  2⤵
  PID:7156
- C:\Windows\System\LBSyHno.exe
  C:\Windows\System\LBSyHno.exe
  2⤵
  PID:2992
- C:\Windows\System\vSeBloT.exe
  C:\Windows\System\vSeBloT.exe
  2⤵
  PID:5148
- C:\Windows\System\vmFUYfG.exe
  C:\Windows\System\vmFUYfG.exe
  2⤵
  PID:5924
- C:\Windows\System\PCKLBWD.exe
  C:\Windows\System\PCKLBWD.exe
  2⤵
  PID:7356
- C:\Windows\System\OvLPleP.exe
  C:\Windows\System\OvLPleP.exe
  2⤵
  PID:7508
- C:\Windows\System\bmPIvxD.exe
  C:\Windows\System\bmPIvxD.exe
  2⤵
  PID:6024
- C:\Windows\System\MyBNObv.exe
  C:\Windows\System\MyBNObv.exe
  2⤵
  PID:6080
- C:\Windows\System\nidcYTs.exe
  C:\Windows\System\nidcYTs.exe
  2⤵
  PID:6464
- C:\Windows\System\BkeNlMo.exe
  C:\Windows\System\BkeNlMo.exe
  2⤵
  PID:8252
- C:\Windows\System\SQykFJp.exe
  C:\Windows\System\SQykFJp.exe
  2⤵
  PID:9004
- C:\Windows\System\grPDaqa.exe
  C:\Windows\System\grPDaqa.exe
  2⤵
  PID:3956
- C:\Windows\System\qcfoPQm.exe
  C:\Windows\System\qcfoPQm.exe
  2⤵
  PID:9224
- C:\Windows\System\VTMTpCm.exe
  C:\Windows\System\VTMTpCm.exe
  2⤵
  PID:9240
- C:\Windows\System\jpIOJKX.exe
  C:\Windows\System\jpIOJKX.exe
  2⤵
  PID:9260
- C:\Windows\System\GtDDrin.exe
  C:\Windows\System\GtDDrin.exe
  2⤵
  PID:9280
- C:\Windows\System\rlWfYAZ.exe
  C:\Windows\System\rlWfYAZ.exe
  2⤵
  PID:9300
- C:\Windows\System\SwpcFUc.exe
  C:\Windows\System\SwpcFUc.exe
  2⤵
  PID:9316
- C:\Windows\System\kJeZWDt.exe
  C:\Windows\System\kJeZWDt.exe
  2⤵
  PID:9336
- C:\Windows\System\OlkIdaA.exe
  C:\Windows\System\OlkIdaA.exe
  2⤵
  PID:9356
- C:\Windows\System\xEwVFWy.exe
  C:\Windows\System\xEwVFWy.exe
  2⤵
  PID:9376
- C:\Windows\System\mgPDUgz.exe
  C:\Windows\System\mgPDUgz.exe
  2⤵
  PID:9392
- C:\Windows\System\SGoonKr.exe
  C:\Windows\System\SGoonKr.exe
  2⤵
  PID:9412
- C:\Windows\System\IXpLoYN.exe
  C:\Windows\System\IXpLoYN.exe
  2⤵
  PID:9428
- C:\Windows\System\EsSVRIJ.exe
  C:\Windows\System\EsSVRIJ.exe
  2⤵
  PID:9448
- C:\Windows\System\IqGUATt.exe
  C:\Windows\System\IqGUATt.exe
  2⤵
  PID:9468
- C:\Windows\System\XwgMnFB.exe
  C:\Windows\System\XwgMnFB.exe
  2⤵
  PID:9484
- C:\Windows\System\AWuoyWN.exe
  C:\Windows\System\AWuoyWN.exe
  2⤵
  PID:9500
- C:\Windows\System\gPIvKar.exe
  C:\Windows\System\gPIvKar.exe
  2⤵
  PID:9524
- C:\Windows\System\gtrSnXT.exe
  C:\Windows\System\gtrSnXT.exe
  2⤵
  PID:9540
- C:\Windows\System\rAyKAhj.exe
  C:\Windows\System\rAyKAhj.exe
  2⤵
  PID:9560
- C:\Windows\System\IStNfVS.exe
  C:\Windows\System\IStNfVS.exe
  2⤵
  PID:9580
- C:\Windows\System\WNlcEzA.exe
  C:\Windows\System\WNlcEzA.exe
  2⤵
  PID:9596
- C:\Windows\System\jPnNaHl.exe
  C:\Windows\System\jPnNaHl.exe
  2⤵
  PID:9616
- C:\Windows\System\dMQAigR.exe
  C:\Windows\System\dMQAigR.exe
  2⤵
  PID:9632
- C:\Windows\System\ZOgnRPT.exe
  C:\Windows\System\ZOgnRPT.exe
  2⤵
  PID:9652
- C:\Windows\System\vantmlQ.exe
  C:\Windows\System\vantmlQ.exe
  2⤵
  PID:9672
- C:\Windows\System\SRfurns.exe
  C:\Windows\System\SRfurns.exe
  2⤵
  PID:9688
- C:\Windows\System\ZRazhbZ.exe
  C:\Windows\System\ZRazhbZ.exe
  2⤵
  PID:9708
- C:\Windows\System\aiXgTAA.exe
  C:\Windows\System\aiXgTAA.exe
  2⤵
  PID:9728
- C:\Windows\System\YiAMyYu.exe
  C:\Windows\System\YiAMyYu.exe
  2⤵
  PID:9744
- C:\Windows\System\QVQtHyj.exe
  C:\Windows\System\QVQtHyj.exe
  2⤵
  PID:9764
- C:\Windows\System\PMNXqZa.exe
  C:\Windows\System\PMNXqZa.exe
  2⤵
  PID:9784
- C:\Windows\System\oOxWHll.exe
  C:\Windows\System\oOxWHll.exe
  2⤵
  PID:9804
- C:\Windows\System\IEduZRW.exe
  C:\Windows\System\IEduZRW.exe
  2⤵
  PID:9820
- C:\Windows\System\XinJItn.exe
  C:\Windows\System\XinJItn.exe
  2⤵
  PID:9840
- C:\Windows\System\vgBGLJO.exe
  C:\Windows\System\vgBGLJO.exe
  2⤵
  PID:9860
- C:\Windows\System\GNFeSLS.exe
  C:\Windows\System\GNFeSLS.exe
  2⤵
  PID:9876
- C:\Windows\System\BkgddUN.exe
  C:\Windows\System\BkgddUN.exe
  2⤵
  PID:9896
- C:\Windows\System\mwhiuiH.exe
  C:\Windows\System\mwhiuiH.exe
  2⤵
  PID:9916
- C:\Windows\System\wOvpSYu.exe
  C:\Windows\System\wOvpSYu.exe
  2⤵
  PID:9932
- C:\Windows\System\bkqURXa.exe
  C:\Windows\System\bkqURXa.exe
  2⤵
  PID:9952
- C:\Windows\System\gCGqSYA.exe
  C:\Windows\System\gCGqSYA.exe
  2⤵
  PID:9968
- C:\Windows\System\uUIoYYI.exe
  C:\Windows\System\uUIoYYI.exe
  2⤵
  PID:9988
- C:\Windows\System\cDgiPbN.exe
  C:\Windows\System\cDgiPbN.exe
  2⤵
  PID:10004
- C:\Windows\System\daEutEw.exe
  C:\Windows\System\daEutEw.exe
  2⤵
  PID:10024
- C:\Windows\System\zmuWWrg.exe
  C:\Windows\System\zmuWWrg.exe
  2⤵
  PID:10044
- C:\Windows\System\kgUqlGr.exe
  C:\Windows\System\kgUqlGr.exe
  2⤵
  PID:10060
- C:\Windows\System\BFDRKYP.exe
  C:\Windows\System\BFDRKYP.exe
  2⤵
  PID:10080
- C:\Windows\System\uJpmqVd.exe
  C:\Windows\System\uJpmqVd.exe
  2⤵
  PID:10100
- C:\Windows\System\EFJlUSD.exe
  C:\Windows\System\EFJlUSD.exe
  2⤵
  PID:10116
- C:\Windows\System\dQhCKKy.exe
  C:\Windows\System\dQhCKKy.exe
  2⤵
  PID:10136
- C:\Windows\System\lhxzCPo.exe
  C:\Windows\System\lhxzCPo.exe
  2⤵
  PID:10156
- C:\Windows\System\xzigkxL.exe
  C:\Windows\System\xzigkxL.exe
  2⤵
  PID:10176
- C:\Windows\System\GpZigQf.exe
  C:\Windows\System\GpZigQf.exe
  2⤵
  PID:10192
- C:\Windows\System\RcDDZFD.exe
  C:\Windows\System\RcDDZFD.exe
  2⤵
  PID:10212
- C:\Windows\System\BsUVTEU.exe
  C:\Windows\System\BsUVTEU.exe
  2⤵
  PID:10232
- C:\Windows\System\iZnsbqS.exe
  C:\Windows\System\iZnsbqS.exe
  2⤵
  PID:10256
- C:\Windows\System\HLDzoPw.exe
  C:\Windows\System\HLDzoPw.exe
  2⤵
  PID:10272
- C:\Windows\System\DdReqnv.exe
  C:\Windows\System\DdReqnv.exe
  2⤵
  PID:10292
- C:\Windows\System\rDeWxvu.exe
  C:\Windows\System\rDeWxvu.exe
  2⤵
  PID:10312
- C:\Windows\System\RKihzFS.exe
  C:\Windows\System\RKihzFS.exe
  2⤵
  PID:10328
- C:\Windows\System\zsLgLKP.exe
  C:\Windows\System\zsLgLKP.exe
  2⤵
  PID:10348
- C:\Windows\System\KoaeXCV.exe
  C:\Windows\System\KoaeXCV.exe
  2⤵
  PID:10368
- C:\Windows\System\lBmbJtu.exe
  C:\Windows\System\lBmbJtu.exe
  2⤵
  PID:10384
- C:\Windows\System\mfpiZWN.exe
  C:\Windows\System\mfpiZWN.exe
  2⤵
  PID:10404
- C:\Windows\System\CCsYbmm.exe
  C:\Windows\System\CCsYbmm.exe
  2⤵
  PID:10432
- C:\Windows\System\wNZctsZ.exe
  C:\Windows\System\wNZctsZ.exe
  2⤵
  PID:10448
- C:\Windows\System\uWJbDJj.exe
  C:\Windows\System\uWJbDJj.exe
  2⤵
  PID:10464
- C:\Windows\System\SCnYgsF.exe
  C:\Windows\System\SCnYgsF.exe
  2⤵
  PID:10480
- C:\Windows\System\tmIkKSn.exe
  C:\Windows\System\tmIkKSn.exe
  2⤵
  PID:10496
- C:\Windows\System\fxGmerd.exe
  C:\Windows\System\fxGmerd.exe
  2⤵
  PID:10512
- C:\Windows\System\KVVGfmE.exe
  C:\Windows\System\KVVGfmE.exe
  2⤵
  PID:10528
- C:\Windows\System\ozBBJnA.exe
  C:\Windows\System\ozBBJnA.exe
  2⤵
  PID:10544
- C:\Windows\System\dLyrMyO.exe
  C:\Windows\System\dLyrMyO.exe
  2⤵
  PID:10564
- C:\Windows\System\iRksnYR.exe
  C:\Windows\System\iRksnYR.exe
  2⤵
  PID:10580
- C:\Windows\System\EqetOvY.exe
  C:\Windows\System\EqetOvY.exe
  2⤵
  PID:10600
- C:\Windows\System\KCIKsRc.exe
  C:\Windows\System\KCIKsRc.exe
  2⤵
  PID:10620
- C:\Windows\System\icyqYyJ.exe
  C:\Windows\System\icyqYyJ.exe
  2⤵
  PID:10636
- C:\Windows\System\hlPHBoV.exe
  C:\Windows\System\hlPHBoV.exe
  2⤵
  PID:10656
- C:\Windows\System\ujYDqvw.exe
  C:\Windows\System\ujYDqvw.exe
  2⤵
  PID:10676
- C:\Windows\System\bglnBIY.exe
  C:\Windows\System\bglnBIY.exe
  2⤵
  PID:10692
- C:\Windows\System\SYyqjXA.exe
  C:\Windows\System\SYyqjXA.exe
  2⤵
  PID:10712
- C:\Windows\System\bvpixZh.exe
  C:\Windows\System\bvpixZh.exe
  2⤵
  PID:10732
- C:\Windows\System\svRMvLY.exe
  C:\Windows\System\svRMvLY.exe
  2⤵
  PID:10748
- C:\Windows\System\IQZniJC.exe
  C:\Windows\System\IQZniJC.exe
  2⤵
  PID:10768
- C:\Windows\System\HwuEPFY.exe
  C:\Windows\System\HwuEPFY.exe
  2⤵
  PID:10784
- C:\Windows\System\qTaOuXy.exe
  C:\Windows\System\qTaOuXy.exe
  2⤵
  PID:10808
- C:\Windows\System\uFuQYoW.exe
  C:\Windows\System\uFuQYoW.exe
  2⤵
  PID:10828
- C:\Windows\System\KbtzvNS.exe
  C:\Windows\System\KbtzvNS.exe
  2⤵
  PID:10844
- C:\Windows\System\PKDLFOu.exe
  C:\Windows\System\PKDLFOu.exe
  2⤵
  PID:10860
- C:\Windows\System\XuKUCtW.exe
  C:\Windows\System\XuKUCtW.exe
  2⤵
  PID:10884
- C:\Windows\System\QVRcrmO.exe
  C:\Windows\System\QVRcrmO.exe
  2⤵
  PID:10900
- C:\Windows\System\yuEewxB.exe
  C:\Windows\System\yuEewxB.exe
  2⤵
  PID:10920
- C:\Windows\System\GKshDCs.exe
  C:\Windows\System\GKshDCs.exe
  2⤵
  PID:10940
- C:\Windows\System\zsHUWsI.exe
  C:\Windows\System\zsHUWsI.exe
  2⤵
  PID:10956
- C:\Windows\System\jOXhUjG.exe
  C:\Windows\System\jOXhUjG.exe
  2⤵
  PID:10976
- C:\Windows\System\KunLESy.exe
  C:\Windows\System\KunLESy.exe
  2⤵
  PID:10996
- C:\Windows\System\JWQpENB.exe
  C:\Windows\System\JWQpENB.exe
  2⤵
  PID:11012
- C:\Windows\System\AWLuDNp.exe
  C:\Windows\System\AWLuDNp.exe
  2⤵
  PID:11032
- C:\Windows\System\Yrovtvm.exe
  C:\Windows\System\Yrovtvm.exe
  2⤵
  PID:11052
- C:\Windows\System\riXzKLv.exe
  C:\Windows\System\riXzKLv.exe
  2⤵
  PID:11068
- C:\Windows\System\zZedbTN.exe
  C:\Windows\System\zZedbTN.exe
  2⤵
  PID:11088
- C:\Windows\System\lNHzRHH.exe
  C:\Windows\System\lNHzRHH.exe
  2⤵
  PID:11108
- C:\Windows\System\hCegPne.exe
  C:\Windows\System\hCegPne.exe
  2⤵
  PID:11128
- C:\Windows\System\quFCUfi.exe
  C:\Windows\System\quFCUfi.exe
  2⤵
  PID:11148
- C:\Windows\System\UgbiVkA.exe
  C:\Windows\System\UgbiVkA.exe
  2⤵
  PID:11164
- C:\Windows\System\WllokNI.exe
  C:\Windows\System\WllokNI.exe
  2⤵
  PID:11184
- C:\Windows\System\SevJbdE.exe
  C:\Windows\System\SevJbdE.exe
  2⤵
  PID:11204
- C:\Windows\System\eHyyuvT.exe
  C:\Windows\System\eHyyuvT.exe
  2⤵
  PID:11220
- C:\Windows\System\PMxBIMc.exe
  C:\Windows\System\PMxBIMc.exe
  2⤵
  PID:11240
- C:\Windows\System\UpwDOfA.exe
  C:\Windows\System\UpwDOfA.exe
  2⤵
  PID:11260
- C:\Windows\System\ZxcIHDB.exe
  C:\Windows\System\ZxcIHDB.exe
  2⤵
  PID:11280
- C:\Windows\System\BOFXurd.exe
  C:\Windows\System\BOFXurd.exe
  2⤵
  PID:11300
- C:\Windows\System\LeSDvZe.exe
  C:\Windows\System\LeSDvZe.exe
  2⤵
  PID:11320
- C:\Windows\System\egtqQiH.exe
  C:\Windows\System\egtqQiH.exe
  2⤵
  PID:11336
- C:\Windows\System\sauFwrM.exe
  C:\Windows\System\sauFwrM.exe
  2⤵
  PID:11356
- C:\Windows\System\VKrdSTe.exe
  C:\Windows\System\VKrdSTe.exe
  2⤵
  PID:11376
- C:\Windows\System\TwbEcKE.exe
  C:\Windows\System\TwbEcKE.exe
  2⤵
  PID:11392
- C:\Windows\System\utsEMOr.exe
  C:\Windows\System\utsEMOr.exe
  2⤵
  PID:11412
- C:\Windows\System\JMKjdzV.exe
  C:\Windows\System\JMKjdzV.exe
  2⤵
  PID:11432
- C:\Windows\System\JkiUJyw.exe
  C:\Windows\System\JkiUJyw.exe
  2⤵
  PID:11448
- C:\Windows\System\uufXzcS.exe
  C:\Windows\System\uufXzcS.exe
  2⤵
  PID:11468
- C:\Windows\System\xesmuWi.exe
  C:\Windows\System\xesmuWi.exe
  2⤵
  PID:11488
- C:\Windows\System\GDGNIWk.exe
  C:\Windows\System\GDGNIWk.exe
  2⤵
  PID:11504
- C:\Windows\System\VJXFFpn.exe
  C:\Windows\System\VJXFFpn.exe
  2⤵
  PID:11524
- C:\Windows\System\DGCmDnp.exe
  C:\Windows\System\DGCmDnp.exe
  2⤵
  PID:11544
- C:\Windows\System\lpdTOMe.exe
  C:\Windows\System\lpdTOMe.exe
  2⤵
  PID:11564
- C:\Windows\System\qFVIKEM.exe
  C:\Windows\System\qFVIKEM.exe
  2⤵
  PID:11580
- C:\Windows\System\oXUlSsn.exe
  C:\Windows\System\oXUlSsn.exe
  2⤵
  PID:11600
- C:\Windows\System\dkojMTD.exe
  C:\Windows\System\dkojMTD.exe
  2⤵
  PID:11616
- C:\Windows\System\aqIufTz.exe
  C:\Windows\System\aqIufTz.exe
  2⤵
  PID:11636
- C:\Windows\System\RTTsMhq.exe
  C:\Windows\System\RTTsMhq.exe
  2⤵
  PID:11656
- C:\Windows\System\NVPHGxo.exe
  C:\Windows\System\NVPHGxo.exe
  2⤵
  PID:11672
- C:\Windows\System\rmDGxeA.exe
  C:\Windows\System\rmDGxeA.exe
  2⤵
  PID:11692
- C:\Windows\System\DkGbfmE.exe
  C:\Windows\System\DkGbfmE.exe
  2⤵
  PID:11712
- C:\Windows\System\nXnaAdZ.exe
  C:\Windows\System\nXnaAdZ.exe
  2⤵
  PID:11728
- C:\Windows\System\qTKHTlP.exe
  C:\Windows\System\qTKHTlP.exe
  2⤵
  PID:11748
- C:\Windows\System\pRSDCFL.exe
  C:\Windows\System\pRSDCFL.exe
  2⤵
  PID:11768
- C:\Windows\System\Hlrmgea.exe
  C:\Windows\System\Hlrmgea.exe
  2⤵
  PID:11784
- C:\Windows\System\DxBKMWs.exe
  C:\Windows\System\DxBKMWs.exe
  2⤵
  PID:11804
- C:\Windows\System\eSVXhox.exe
  C:\Windows\System\eSVXhox.exe
  2⤵
  PID:11824
- C:\Windows\System\MfjNNFo.exe
  C:\Windows\System\MfjNNFo.exe
  2⤵
  PID:11844
- C:\Windows\System\wdfJPNr.exe
  C:\Windows\System\wdfJPNr.exe
  2⤵
  PID:11860
- C:\Windows\System\uAPxhNY.exe
  C:\Windows\System\uAPxhNY.exe
  2⤵
  PID:11880
- C:\Windows\System\WhiDuTS.exe
  C:\Windows\System\WhiDuTS.exe
  2⤵
  PID:11900
- C:\Windows\System\WaQDHUu.exe
  C:\Windows\System\WaQDHUu.exe
  2⤵
  PID:11920
- C:\Windows\System\CxPvShi.exe
  C:\Windows\System\CxPvShi.exe
  2⤵
  PID:11936
- C:\Windows\System\FmZaYdw.exe
  C:\Windows\System\FmZaYdw.exe
  2⤵
  PID:11956
- C:\Windows\System\NoUzexP.exe
  C:\Windows\System\NoUzexP.exe
  2⤵
  PID:11976
- C:\Windows\System\wUMzwYn.exe
  C:\Windows\System\wUMzwYn.exe
  2⤵
  PID:11992
- C:\Windows\System\YVQxXaA.exe
  C:\Windows\System\YVQxXaA.exe
  2⤵
  PID:12012
- C:\Windows\System\FbngGbo.exe
  C:\Windows\System\FbngGbo.exe
  2⤵
  PID:12032
- C:\Windows\System\wkWkAIU.exe
  C:\Windows\System\wkWkAIU.exe
  2⤵
  PID:12052
- C:\Windows\System\hLuvkrd.exe
  C:\Windows\System\hLuvkrd.exe
  2⤵
  PID:12068
- C:\Windows\System\oARqrdH.exe
  C:\Windows\System\oARqrdH.exe
  2⤵
  PID:12088
- C:\Windows\System\MlWNIiu.exe
  C:\Windows\System\MlWNIiu.exe
  2⤵
  PID:12104
- C:\Windows\System\xzgWWee.exe
  C:\Windows\System\xzgWWee.exe
  2⤵
  PID:12120
- C:\Windows\System\RCyHraS.exe
  C:\Windows\System\RCyHraS.exe
  2⤵
  PID:12136
- C:\Windows\System\BYaOQWb.exe
  C:\Windows\System\BYaOQWb.exe
  2⤵
  PID:12152
- C:\Windows\System\xWAJcwW.exe
  C:\Windows\System\xWAJcwW.exe
  2⤵
  PID:12168
- C:\Windows\System\wCTYWUS.exe
  C:\Windows\System\wCTYWUS.exe
  2⤵
  PID:12184
- C:\Windows\System\BxJTmXV.exe
  C:\Windows\System\BxJTmXV.exe
  2⤵
  PID:12200
- C:\Windows\System\wGsEYnj.exe
  C:\Windows\System\wGsEYnj.exe
  2⤵
  PID:12216
- C:\Windows\System\JCVYhiZ.exe
  C:\Windows\System\JCVYhiZ.exe
  2⤵
  PID:12236
- C:\Windows\System\vuXltiw.exe
  C:\Windows\System\vuXltiw.exe
  2⤵
  PID:12256
- C:\Windows\System\hJOhAYE.exe
  C:\Windows\System\hJOhAYE.exe
  2⤵
  PID:12272
- C:\Windows\System\ilNgYcc.exe
  C:\Windows\System\ilNgYcc.exe
  2⤵
  PID:12296
- C:\Windows\System\ITUtUtz.exe
  C:\Windows\System\ITUtUtz.exe
  2⤵
  PID:12316
- C:\Windows\System\qlEgSBk.exe
  C:\Windows\System\qlEgSBk.exe
  2⤵
  PID:12332
- C:\Windows\System\GwTIHnu.exe
  C:\Windows\System\GwTIHnu.exe
  2⤵
  PID:12352
- C:\Windows\System\zdgUaEf.exe
  C:\Windows\System\zdgUaEf.exe
  2⤵
  PID:12372
- C:\Windows\System\hRmkxNF.exe
  C:\Windows\System\hRmkxNF.exe
  2⤵
  PID:12392
- C:\Windows\System\GPLouTc.exe
  C:\Windows\System\GPLouTc.exe
  2⤵
  PID:12408
- C:\Windows\System\UCxjoam.exe
  C:\Windows\System\UCxjoam.exe
  2⤵
  PID:12428
- C:\Windows\System\iMQeMHi.exe
  C:\Windows\System\iMQeMHi.exe
  2⤵
  PID:12448
- C:\Windows\System\DDVZkXg.exe
  C:\Windows\System\DDVZkXg.exe
  2⤵
  PID:12464
- C:\Windows\System\DjDpoDF.exe
  C:\Windows\System\DjDpoDF.exe
  2⤵
  PID:12484
- C:\Windows\System\gCRMtAC.exe
  C:\Windows\System\gCRMtAC.exe
  2⤵
  PID:12504
- C:\Windows\System\LjfIbZs.exe
  C:\Windows\System\LjfIbZs.exe
  2⤵
  PID:12520
- C:\Windows\System\ECtAMVQ.exe
  C:\Windows\System\ECtAMVQ.exe
  2⤵
  PID:12540
- C:\Windows\System\wPgUvcW.exe
  C:\Windows\System\wPgUvcW.exe
  2⤵
  PID:12560
- C:\Windows\System\svaqjad.exe
  C:\Windows\System\svaqjad.exe
  2⤵
  PID:12580
- C:\Windows\System\cwXiHrk.exe
  C:\Windows\System\cwXiHrk.exe
  2⤵
  PID:12596
- C:\Windows\System\elPUrvf.exe
  C:\Windows\System\elPUrvf.exe
  2⤵
  PID:12616
- C:\Windows\System\NeauhYC.exe
  C:\Windows\System\NeauhYC.exe
  2⤵
  PID:12632
- C:\Windows\System\jqagDAx.exe
  C:\Windows\System\jqagDAx.exe
  2⤵
  PID:12652
- C:\Windows\System\eTZHEuN.exe
  C:\Windows\System\eTZHEuN.exe
  2⤵
  PID:12672
- C:\Windows\System\ejjkyLi.exe
  C:\Windows\System\ejjkyLi.exe
  2⤵
  PID:12692
- C:\Windows\System\DYXSHmy.exe
  C:\Windows\System\DYXSHmy.exe
  2⤵
  PID:12712
- C:\Windows\System\XXzkeGO.exe
  C:\Windows\System\XXzkeGO.exe
  2⤵
  PID:12728
- C:\Windows\System\dQXSNld.exe
  C:\Windows\System\dQXSNld.exe
  2⤵
  PID:12752
- C:\Windows\System\llXEkHr.exe
  C:\Windows\System\llXEkHr.exe
  2⤵
  PID:12772
- C:\Windows\System\GvhJKzZ.exe
  C:\Windows\System\GvhJKzZ.exe
  2⤵
  PID:12792
- C:\Windows\System\FpTwsbe.exe
  C:\Windows\System\FpTwsbe.exe
  2⤵
  PID:12816
- C:\Windows\System\hEUMnPU.exe
  C:\Windows\System\hEUMnPU.exe
  2⤵
  PID:12836
- C:\Windows\System\UcWWXfZ.exe
  C:\Windows\System\UcWWXfZ.exe
  2⤵
  PID:12856
- C:\Windows\System\txdVHqs.exe
  C:\Windows\System\txdVHqs.exe
  2⤵
  PID:12876
- C:\Windows\System\dSDYrHQ.exe
  C:\Windows\System\dSDYrHQ.exe
  2⤵
  PID:12896
- C:\Windows\System\BQZaEFz.exe
  C:\Windows\System\BQZaEFz.exe
  2⤵
  PID:12916
- C:\Windows\System\BDhEaje.exe
  C:\Windows\System\BDhEaje.exe
  2⤵
  PID:12936
- C:\Windows\System\vwcVbqW.exe
  C:\Windows\System\vwcVbqW.exe
  2⤵
  PID:12964
- C:\Windows\System\eESnYZK.exe
  C:\Windows\System\eESnYZK.exe
  2⤵
  PID:13020
- C:\Windows\System\TdaBTeC.exe
  C:\Windows\System\TdaBTeC.exe
  2⤵
  PID:13044
- C:\Windows\System\xAiwDCf.exe
  C:\Windows\System\xAiwDCf.exe
  2⤵
  PID:13064
- C:\Windows\System\hhSmeoK.exe
  C:\Windows\System\hhSmeoK.exe
  2⤵
  PID:13080
- C:\Windows\System\SDKoUie.exe
  C:\Windows\System\SDKoUie.exe
  2⤵
  PID:13168
- C:\Windows\System\FGyaBZl.exe
  C:\Windows\System\FGyaBZl.exe
  2⤵
  PID:13204
- C:\Windows\System\luphIWG.exe
  C:\Windows\System\luphIWG.exe
  2⤵
  PID:13224
- C:\Windows\System\ZNQfFET.exe
  C:\Windows\System\ZNQfFET.exe
  2⤵
  PID:13248
- C:\Windows\System\AONfAQY.exe
  C:\Windows\System\AONfAQY.exe
  2⤵
  PID:13276
- C:\Windows\System\EqPRxau.exe
  C:\Windows\System\EqPRxau.exe
  2⤵
  PID:13292
- C:\Windows\System\LAGFEKj.exe
  C:\Windows\System\LAGFEKj.exe
  2⤵
  PID:6824
- C:\Windows\System\NaqlRYF.exe
  C:\Windows\System\NaqlRYF.exe
  2⤵
  PID:7028
- C:\Windows\System\ZzcQfph.exe
  C:\Windows\System\ZzcQfph.exe
  2⤵
  PID:7448
- C:\Windows\System\jkBfcso.exe
  C:\Windows\System\jkBfcso.exe
  2⤵
  PID:8476
- C:\Windows\System\tnvitKf.exe
  C:\Windows\System\tnvitKf.exe
  2⤵
  PID:748
- C:\Windows\System\uYtFLYp.exe
  C:\Windows\System\uYtFLYp.exe
  2⤵
  PID:8956
- C:\Windows\System\krxugnk.exe
  C:\Windows\System\krxugnk.exe
  2⤵
  PID:8228
- C:\Windows\System\StGxlOf.exe
  C:\Windows\System\StGxlOf.exe
  2⤵
  PID:13320
- C:\Windows\System\jlbHLoV.exe
  C:\Windows\System\jlbHLoV.exe
  2⤵
  PID:13336
- C:\Windows\System\iBPNHSh.exe
  C:\Windows\System\iBPNHSh.exe
  2⤵
  PID:13352
- C:\Windows\System\rRFNtHW.exe
  C:\Windows\System\rRFNtHW.exe
  2⤵
  PID:13368
- C:\Windows\System\yliGpEU.exe
  C:\Windows\System\yliGpEU.exe
  2⤵
  PID:10380
- C:\Windows\System\eRVXBpT.exe
  C:\Windows\System\eRVXBpT.exe
  2⤵
  PID:10816
- C:\Windows\System\bVFijCE.exe
  C:\Windows\System\bVFijCE.exe
  2⤵
  PID:10896
- C:\Windows\System\dtChQhY.exe
  C:\Windows\System\dtChQhY.exe
  2⤵
  PID:9776
- C:\Windows\System\JbcAsmF.exe
  C:\Windows\System\JbcAsmF.exe
  2⤵
  PID:9832
- C:\Windows\System\qWWPZVV.exe
  C:\Windows\System\qWWPZVV.exe
  2⤵
  PID:9872
- C:\Windows\System\GUYWnzu.exe
  C:\Windows\System\GUYWnzu.exe
  2⤵
  PID:9908
- C:\Windows\System\sywgUxP.exe
  C:\Windows\System\sywgUxP.exe
  2⤵
  PID:11172
- C:\Windows\System\kHUPiSG.exe
  C:\Windows\System\kHUPiSG.exe
  2⤵
  PID:11644
- C:\Windows\System\jlCnqiu.exe
  C:\Windows\System\jlCnqiu.exe
  2⤵
  PID:11720
- C:\Windows\System\dmRmwud.exe
  C:\Windows\System\dmRmwud.exe
  2⤵
  PID:11764
- C:\Windows\System\VmTIlUP.exe
  C:\Windows\System\VmTIlUP.exe
  2⤵
  PID:12788
- C:\Windows\System\icoxjxg.exe
  C:\Windows\System\icoxjxg.exe
  2⤵
  PID:12848
- C:\Windows\System\qlJlXFy.exe
  C:\Windows\System\qlJlXFy.exe
  2⤵
  PID:14040
- C:\Windows\System\XqTTCyu.exe
  C:\Windows\System\XqTTCyu.exe
  2⤵
  PID:14060
- C:\Windows\System\pkBhinO.exe
  C:\Windows\System\pkBhinO.exe
  2⤵
  PID:14108
- C:\Windows\System\exZgtYL.exe
  C:\Windows\System\exZgtYL.exe
  2⤵
  PID:14236
- C:\Windows\System\FnKNReb.exe
  C:\Windows\System\FnKNReb.exe
  2⤵
  PID:13076
- C:\Windows\System\jhuiKmS.exe
  C:\Windows\System\jhuiKmS.exe
  2⤵
  PID:6704
- C:\Windows\System\vhHFogO.exe
  C:\Windows\System\vhHFogO.exe
  2⤵
  PID:9328
- C:\Windows\System\QniesbG.exe
  C:\Windows\System\QniesbG.exe
  2⤵
  PID:13364
- C:\Windows\System\EGnnYvV.exe
  C:\Windows\System\EGnnYvV.exe
  2⤵
  PID:13396
- C:\Windows\System\mvDcWMJ.exe
  C:\Windows\System\mvDcWMJ.exe
  2⤵
  PID:13412
- C:\Windows\System\EyJSSfC.exe
  C:\Windows\System\EyJSSfC.exe
  2⤵
  PID:13588
- C:\Windows\System\vLSgzBf.exe
  C:\Windows\System\vLSgzBf.exe
  2⤵
  PID:13608
- C:\Windows\System\NydoSzd.exe
  C:\Windows\System\NydoSzd.exe
  2⤵
  PID:13660
- C:\Windows\System\sMNPvKu.exe
  C:\Windows\System\sMNPvKu.exe
  2⤵
  PID:13756
- C:\Windows\System\YbxxtzJ.exe
  C:\Windows\System\YbxxtzJ.exe
  2⤵
  PID:13828
- C:\Windows\System\nBnhEEu.exe
  C:\Windows\System\nBnhEEu.exe
  2⤵
  PID:13892
- C:\Windows\System\HyoOdFj.exe
  C:\Windows\System\HyoOdFj.exe
  2⤵
  PID:13940
- C:\Windows\System\JuQaoDE.exe
  C:\Windows\System\JuQaoDE.exe
  2⤵
  PID:13964
- C:\Windows\System\ySgIhGG.exe
  C:\Windows\System\ySgIhGG.exe
  2⤵
  PID:14004
- C:\Windows\System\OwMMrbJ.exe
  C:\Windows\System\OwMMrbJ.exe
  2⤵
  PID:14076
- C:\Windows\System\OUKstBd.exe
  C:\Windows\System\OUKstBd.exe
  2⤵
  PID:14140
- C:\Windows\System\jxJSxhZ.exe
  C:\Windows\System\jxJSxhZ.exe
  2⤵
  PID:14160
- C:\Windows\System\iZpYlgk.exe
  C:\Windows\System\iZpYlgk.exe
  2⤵
  PID:14176
- C:\Windows\System\IlmTZUg.exe
  C:\Windows\System\IlmTZUg.exe
  2⤵
  PID:11008
- C:\Windows\System\AWBcmXv.exe
  C:\Windows\System\AWBcmXv.exe
  2⤵
  PID:11060
- C:\Windows\System\vJwFsho.exe
  C:\Windows\System\vJwFsho.exe
  2⤵
  PID:11160
- C:\Windows\System\Sxacecm.exe
  C:\Windows\System\Sxacecm.exe
  2⤵
  PID:2456
- C:\Windows\System\GxNpzGB.exe
  C:\Windows\System\GxNpzGB.exe
  2⤵
  PID:10760
- C:\Windows\System\fjHSZQb.exe
  C:\Windows\System\fjHSZQb.exe
  2⤵
  PID:4180
- C:\Windows\System\YakFnKU.exe
  C:\Windows\System\YakFnKU.exe
  2⤵
  PID:11200
- C:\Windows\System\RXbpHqy.exe
  C:\Windows\System\RXbpHqy.exe
  2⤵
  PID:14300
- C:\Windows\System\ZxBsiWx.exe
  C:\Windows\System\ZxBsiWx.exe
  2⤵
  PID:9512
- C:\Windows\System\VzHhQrA.exe
  C:\Windows\System\VzHhQrA.exe
  2⤵
  PID:9904
- C:\Windows\System\ZNpACFE.exe
  C:\Windows\System\ZNpACFE.exe
  2⤵
  PID:10148
- C:\Windows\System\HeOeHti.exe
  C:\Windows\System\HeOeHti.exe
  2⤵
  PID:10336
- C:\Windows\System\beOPlII.exe
  C:\Windows\System\beOPlII.exe
  2⤵
  PID:10476
- C:\Windows\System\OiIRGJm.exe
  C:\Windows\System\OiIRGJm.exe
  2⤵
  PID:11736
- C:\Windows\System\YOusFza.exe
  C:\Windows\System\YOusFza.exe
  2⤵
  PID:11816
- C:\Windows\System\YhSAIlu.exe
  C:\Windows\System\YhSAIlu.exe
  2⤵
  PID:12004
- C:\Windows\System\eySaQDj.exe
  C:\Windows\System\eySaQDj.exe
  2⤵
  PID:12048
- C:\Windows\System\tXXEKEs.exe
  C:\Windows\System\tXXEKEs.exe
  2⤵
  PID:12528
- C:\Windows\System\tohHuLI.exe
  C:\Windows\System\tohHuLI.exe
  2⤵
  PID:10932
- C:\Windows\System\wmMMpfO.exe
  C:\Windows\System\wmMMpfO.exe
  2⤵
  PID:1496
- C:\Windows\System\rgoJjic.exe
  C:\Windows\System\rgoJjic.exe
  2⤵
  PID:11444
- C:\Windows\System\qBpkVdx.exe
  C:\Windows\System\qBpkVdx.exe
  2⤵
  PID:11968
- C:\Windows\System\PMYFIiF.exe
  C:\Windows\System\PMYFIiF.exe
  2⤵
  PID:12348
- C:\Windows\System\pxOskAG.exe
  C:\Windows\System\pxOskAG.exe
  2⤵
  PID:12144
- C:\Windows\System\ylmRrcI.exe
  C:\Windows\System\ylmRrcI.exe
  2⤵
  PID:4524
- C:\Windows\System\iOZvddR.exe
  C:\Windows\System\iOZvddR.exe
  2⤵
  PID:2288
- C:\Windows\System\NAgtwrP.exe
  C:\Windows\System\NAgtwrP.exe
  2⤵
  PID:12668
- C:\Windows\System\xnMsguU.exe
  C:\Windows\System\xnMsguU.exe
  2⤵
  PID:12552
- C:\Windows\System\GPpkIma.exe
  C:\Windows\System\GPpkIma.exe
  2⤵
  PID:2660
- C:\Windows\System\RUdsBGM.exe
  C:\Windows\System\RUdsBGM.exe
  2⤵
  PID:9084
- C:\Windows\System\mIdjCwM.exe
  C:\Windows\System\mIdjCwM.exe
  2⤵
  PID:13456
- C:\Windows\System\dmAPATy.exe
  C:\Windows\System\dmAPATy.exe
  2⤵
  PID:6988
- C:\Windows\System\tQZBaRl.exe
  C:\Windows\System\tQZBaRl.exe
  2⤵
  PID:11812
- C:\Windows\System\aUqxbcc.exe
  C:\Windows\System\aUqxbcc.exe
  2⤵
  PID:4640
- C:\Windows\System\cZnLLnl.exe
  C:\Windows\System\cZnLLnl.exe
  2⤵
  PID:8512
- C:\Windows\System\lMguXTb.exe
  C:\Windows\System\lMguXTb.exe
  2⤵
  PID:8944
- C:\Windows\System\fwKrTCL.exe
  C:\Windows\System\fwKrTCL.exe
  2⤵
  PID:3312
- C:\Windows\System\NEaBPPM.exe
  C:\Windows\System\NEaBPPM.exe
  2⤵
  PID:10740
- C:\Windows\System\KAvYfDL.exe
  C:\Windows\System\KAvYfDL.exe
  2⤵
  PID:13544
- C:\Windows\System\hkHpjez.exe
  C:\Windows\System\hkHpjez.exe
  2⤵
  PID:13668
- C:\Windows\System\XMvpzeH.exe
  C:\Windows\System\XMvpzeH.exe
  2⤵
  PID:13868
- C:\Windows\System\WhvHZSC.exe
  C:\Windows\System\WhvHZSC.exe
  2⤵
  PID:11560
- C:\Windows\System\VeHYEBg.exe
  C:\Windows\System\VeHYEBg.exe
  2⤵
  PID:14104
- C:\Windows\System\NLaIRXC.exe
  C:\Windows\System\NLaIRXC.exe
  2⤵
  PID:2264
- C:\Windows\System\FItQlfV.exe
  C:\Windows\System\FItQlfV.exe
  2⤵
  PID:7104
- C:\Windows\System\qVffHVl.exe
  C:\Windows\System\qVffHVl.exe
  2⤵
  PID:4060
- C:\Windows\System\bsynOQP.exe
  C:\Windows\System\bsynOQP.exe
  2⤵
  PID:3108
- C:\Windows\System\IOsYlRz.exe
  C:\Windows\System\IOsYlRz.exe
  2⤵
  PID:2480
- C:\Windows\System\neqnfia.exe
  C:\Windows\System\neqnfia.exe
  2⤵
  PID:6608
- C:\Windows\System\qJEqgxX.exe
  C:\Windows\System\qJEqgxX.exe
  2⤵
  PID:6040
- C:\Windows\System\OniSXDn.exe
  C:\Windows\System\OniSXDn.exe
  2⤵
  PID:10244
- C:\Windows\System\beyRYhU.exe
  C:\Windows\System\beyRYhU.exe
  2⤵
  PID:10560
- C:\Windows\System\KNOqUBv.exe
  C:\Windows\System\KNOqUBv.exe
  2⤵
  PID:13036
- C:\Windows\System\mxKKdTs.exe
  C:\Windows\System\mxKKdTs.exe
  2⤵
  PID:9736
- C:\Windows\System\WHJoSxR.exe
  C:\Windows\System\WHJoSxR.exe
  2⤵
  PID:11596
- C:\Windows\System\NzAuYRG.exe
  C:\Windows\System\NzAuYRG.exe
  2⤵
  PID:11760
- C:\Windows\System\RXSzqSJ.exe
  C:\Windows\System\RXSzqSJ.exe
  2⤵
  PID:11868
- C:\Windows\System\gAkdIgC.exe
  C:\Windows\System\gAkdIgC.exe
  2⤵
  PID:9856
- C:\Windows\System\uQQRvaL.exe
  C:\Windows\System\uQQRvaL.exe
  2⤵
  PID:9940
- C:\Windows\System\SzHWltE.exe
  C:\Windows\System\SzHWltE.exe
  2⤵
  PID:12536
- C:\Windows\System\fAsYABG.exe
  C:\Windows\System\fAsYABG.exe
  2⤵
  PID:13028
- C:\Windows\System\UKpciqa.exe
  C:\Windows\System\UKpciqa.exe
  2⤵
  PID:10616
- C:\Windows\System\oXuwxFU.exe
  C:\Windows\System\oXuwxFU.exe
  2⤵
  PID:10868
- C:\Windows\System\gscljqX.exe
  C:\Windows\System\gscljqX.exe
  2⤵
  PID:8556
- C:\Windows\System\QFhHbrw.exe
  C:\Windows\System\QFhHbrw.exe
  2⤵
  PID:10804
- C:\Windows\System\dxCPsEF.exe
  C:\Windows\System\dxCPsEF.exe
  2⤵
  PID:13436
- C:\Windows\System\tcCaRrM.exe
  C:\Windows\System\tcCaRrM.exe
  2⤵
  PID:14316
- C:\Windows\System\ebxUyHX.exe
  C:\Windows\System\ebxUyHX.exe
  2⤵
  PID:13408
- C:\Windows\System\hYqkBgF.exe
  C:\Windows\System\hYqkBgF.exe
  2⤵
  PID:10764
- C:\Windows\System\pxXQQiL.exe
  C:\Windows\System\pxXQQiL.exe
  2⤵
  PID:13116
- C:\Windows\System\MiWdsqD.exe
  C:\Windows\System\MiWdsqD.exe
  2⤵
  PID:11044
- C:\Windows\System\LGmIumB.exe
  C:\Windows\System\LGmIumB.exe
  2⤵
  PID:13512
- C:\Windows\System\etbGSCl.exe
  C:\Windows\System\etbGSCl.exe
  2⤵
  PID:11588
- C:\Windows\System\uoRfEzu.exe
  C:\Windows\System\uoRfEzu.exe
  2⤵
  PID:11852
- C:\Windows\System\wQodTeX.exe
  C:\Windows\System\wQodTeX.exe
  2⤵
  PID:12568
- C:\Windows\System\qQBYTni.exe
  C:\Windows\System\qQBYTni.exe
  2⤵
  PID:9772
- C:\Windows\System\NPsMFPh.exe
  C:\Windows\System\NPsMFPh.exe
  2⤵
  PID:11312
- C:\Windows\System\oQZGFHV.exe
  C:\Windows\System\oQZGFHV.exe
  2⤵
  PID:9644
- C:\Windows\System\ygQWzbO.exe
  C:\Windows\System\ygQWzbO.exe
  2⤵
  PID:12784
- C:\Windows\System\faGBjdy.exe
  C:\Windows\System\faGBjdy.exe
  2⤵
  PID:10364
- C:\Windows\System\jhRtzbN.exe
  C:\Windows\System\jhRtzbN.exe
  2⤵
  PID:1524
- C:\Windows\System\GcbbRsy.exe
  C:\Windows\System\GcbbRsy.exe
  2⤵
  PID:14280
- C:\Windows\System\KzzWrMz.exe
  C:\Windows\System\KzzWrMz.exe
  2⤵
  PID:12344
- C:\Windows\System\itoCHaL.exe
  C:\Windows\System\itoCHaL.exe
  2⤵
  PID:10820
- C:\Windows\System\HYOusDX.exe
  C:\Windows\System\HYOusDX.exe
  2⤵
  PID:11688
- C:\Windows\System\FysOgcK.exe
  C:\Windows\System\FysOgcK.exe
  2⤵
  PID:9456
- C:\Windows\System\IvutGVa.exe
  C:\Windows\System\IvutGVa.exe
  2⤵
  PID:14020
- C:\Windows\System\DmrRCQw.exe
  C:\Windows\System\DmrRCQw.exe
  2⤵
  PID:14156
- C:\Windows\System\nCuQPcL.exe
  C:\Windows\System\nCuQPcL.exe
  2⤵
  PID:12264
- C:\Windows\System\XlvSbHq.exe
  C:\Windows\System\XlvSbHq.exe
  2⤵
  PID:9976
- C:\Windows\System\ECHBoFq.exe
  C:\Windows\System\ECHBoFq.exe
  2⤵
  PID:12640
- C:\Windows\System\dYJmKxd.exe
  C:\Windows\System\dYJmKxd.exe
  2⤵
  PID:9520
- C:\Windows\System\WRNzkCN.exe
  C:\Windows\System\WRNzkCN.exe
  2⤵
  PID:13132
- C:\Windows\System\zHoRpVh.exe
  C:\Windows\System\zHoRpVh.exe
  2⤵
  PID:10076
- C:\Windows\System\RNZYhvE.exe
  C:\Windows\System\RNZYhvE.exe
  2⤵
  PID:12076
- C:\Windows\System\UrnCAPx.exe
  C:\Windows\System\UrnCAPx.exe
  2⤵
  PID:11252
- C:\Windows\System\vcmiOQt.exe
  C:\Windows\System\vcmiOQt.exe
  2⤵
  PID:12704
- C:\Windows\System\TqvKRza.exe
  C:\Windows\System\TqvKRza.exe
  2⤵
  PID:14136
- C:\Windows\System\WNCopZA.exe
  C:\Windows\System\WNCopZA.exe
  2⤵
  PID:14048
- C:\Windows\System\wnOEVgt.exe
  C:\Windows\System\wnOEVgt.exe
  2⤵
  PID:12500
- C:\Windows\System\myhOtfn.exe
  C:\Windows\System\myhOtfn.exe
  2⤵
  PID:10880
- C:\Windows\System\aKedlsr.exe
  C:\Windows\System\aKedlsr.exe
  2⤵
  PID:9592
- C:\Windows\System\zZAZSnF.exe
  C:\Windows\System\zZAZSnF.exe
  2⤵
  PID:8924
- C:\Windows\System\NeuWaqp.exe
  C:\Windows\System\NeuWaqp.exe
  2⤵
  PID:13444
- C:\Windows\System\jNMZvge.exe
  C:\Windows\System\jNMZvge.exe
  2⤵
  PID:10780
- C:\Windows\System\hdbkrVN.exe
  C:\Windows\System\hdbkrVN.exe
  2⤵
  PID:12416
- C:\Windows\System\LnFxUFE.exe
  C:\Windows\System\LnFxUFE.exe
  2⤵
  PID:5752
- C:\Windows\System\VwkNuzS.exe
  C:\Windows\System\VwkNuzS.exe
  2⤵
  PID:212
- C:\Windows\System\xdrbEfe.exe
  C:\Windows\System\xdrbEfe.exe
  2⤵
  PID:13860
- C:\Windows\System\SpaFxwD.exe
  C:\Windows\System\SpaFxwD.exe
  2⤵
  PID:11272
- C:\Windows\System\bvMzNbW.exe
  C:\Windows\System\bvMzNbW.exe
  2⤵
  PID:10628
- C:\Windows\System\JYIgcKo.exe
  C:\Windows\System\JYIgcKo.exe
  2⤵
  PID:13600
- C:\Windows\System\SZCTPXB.exe
  C:\Windows\System\SZCTPXB.exe
  2⤵
  PID:13404
- C:\Windows\System\uSHpZiP.exe
  C:\Windows\System\uSHpZiP.exe
  2⤵
  PID:10700
- C:\Windows\System\VpvHICL.exe
  C:\Windows\System\VpvHICL.exe
  2⤵
  PID:10928
- C:\Windows\System\mxWXJmK.exe
  C:\Windows\System\mxWXJmK.exe
  2⤵
  PID:10720
- C:\Windows\System\cLtjwpN.exe
  C:\Windows\System\cLtjwpN.exe
  2⤵
  PID:10356
- C:\Windows\System\GcPGtdj.exe
  C:\Windows\System\GcPGtdj.exe
  2⤵
  PID:13784
- C:\Windows\System\npoxsUu.exe
  C:\Windows\System\npoxsUu.exe
  2⤵
  PID:13480
- C:\Windows\System\CXsNeSv.exe
  C:\Windows\System\CXsNeSv.exe
  2⤵
  PID:10524
- C:\Windows\System\UBjLpvQ.exe
  C:\Windows\System\UBjLpvQ.exe
  2⤵
  PID:13616
- C:\Windows\System\ImCLbmr.exe
  C:\Windows\System\ImCLbmr.exe
  2⤵
  PID:13260

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 616 -p 8016 -ip 8016
1⤵
PID:13116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 508 -p 12428 -ip 12428
1⤵
PID:13444

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4332 -i 4332 -h 432 -j 748 -s 184 -d 12572
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:9716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_zfqu5wem.4yr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zfqu5wem.4yr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

CparhIR.exe

Path C:\Windows\System\CparhIR.exe
Size 1.4MB
SHA256 f5daa9dd5e6737ed4a6cc8b121bdb5017698f21681fc03bd13d8f110302fd3b6
MD5 de4a906a7d6a7a1d1ddae946cd3d8d88
SHA1 11d68ddc9b17350baf8ea544a8c37c7201854049
SHA512 c2e0668654ccbc48627d6c6f4640c92d673a209c164c26b44b05ef3e43662b405f3dd67204a4e943aba7059454ff9805f696deaf516affd838ee5911581e1691
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITy:Lz071uv4BPMkHC0IlnASEx/R2uWGTy
MD5 SHA1 SHA512 SSDEEP

Submit Download

CpdKJfS.exe

Path C:\Windows\System\CpdKJfS.exe
Size 1.4MB
SHA256 e4703f05d7bfe88cb2d2effebc81aa27a4c6ab633f915dd301f785029ba3a2b6
MD5 4bc9dc4afaa03c29891560e0c8850f4b
SHA1 19cc3d088ee0e917bd19147e588c9b2d74bd09b0
SHA512 f055095d13e46a3e8f4ad146ae326e6d5379c7f18d66eb63800e94d90b66600f62255d3094d84395c0af15c07a3b1ac8200394f972969fee3ae898ab98ffbac2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITw6:Lz071uv4BPMkHC0IlnASEx/R2uWGT/
MD5 SHA1 SHA512 SSDEEP

Submit Download

DzTDtDl.exe

Path C:\Windows\System\DzTDtDl.exe
Size 1.4MB
SHA256 c0717a9092f1a636beb4271f695f7a03db4d976f1dea18c26c8e5bb77183fc67
MD5 440232f8f009a79ed111ad29716d704a
SHA1 8b8a8b75d00c9f8f4b11151a453e90ea6116972c
SHA512 4b0bf0c171cd5de2c9d1986147b444b85f449f32db4adf65222dd2992b2fadfc1c807d99e053733f875bba61e9821816f5ead8efe9543cfc28658e719efc2e4a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITHK:Lz071uv4BPMkHC0IlnASEx/R2uWGTq
MD5 SHA1 SHA512 SSDEEP

Submit Download

EIhHkpE.exe

Path C:\Windows\System\EIhHkpE.exe
Size 1.4MB
SHA256 7aab7f242eb2055d70192582465f0e5b30eb04397bd5e88d70e0fb9af60151cb
MD5 4b19b61a7010a001e0dab46ce46ceee4
SHA1 995442c4c79be324d9cadf34fec1b596f38c35a7
SHA512 3aed991db03e65602aa2d167dc5a0a23096c0fa4f95c23e211e25ec4c7e8c6db836332600b91181777f05d0c6814be81d8a5f7de7e81af554ab50c13eb657f41
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITT:Lz071uv4BPMkHC0IlnASEx/R2uWGTT
MD5 SHA1 SHA512 SSDEEP

Submit Download

JGyZvcT.exe

Path C:\Windows\System\JGyZvcT.exe
Size 1.4MB
SHA256 76a0ea7859cb62237567835116c6a16b346725a7bfe5475b9d74964cf2ff1f7b
MD5 719fc8fea37b793737b345b6472dde44
SHA1 20cf396dfb2f9385a3c982a11456e2e4851ae529
SHA512 58d1a84ac62077f8762e51e92b99577d314c0ba53ea3cefd3f8694b137983d910e95a230fdb953a48f0ae6b8a4c46491ae2d545eb044a8351c1a85aa694a7309
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/IT3:Lz071uv4BPMkHC0IlnASEx/R2uWGT3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LbMODWb.exe

Path C:\Windows\System\LbMODWb.exe
Size 1.4MB
SHA256 f27194ee233baab3d57378be1c911dcea0d41d8a2b0aa270dd37992dd5104d86
MD5 ddb861af91ec4d64c811f279864b14b6
SHA1 361b206964f99086aa2d18ede40ac7100ec87b54
SHA512 4768e528f8aa6ce98fa4020b4f81f988e9d90bef4fd025dd332a5765a8e463408adc8cc4730ef9e2ef6ae717152b0888980e1df4e3cc30f3685545494b03aa5a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITm:Lz071uv4BPMkHC0IlnASEx/R2uWGTm
MD5 SHA1 SHA512 SSDEEP

Submit Download

LlMkmYD.exe

Path C:\Windows\System\LlMkmYD.exe
Size 1.4MB
SHA256 d6dbb342d84abc5933b2635d373f99ca1b9e7b6b704b28edc50743e0cfafd4db
MD5 8f9ac94539c94fe0bcc3e9162c881d78
SHA1 1da81ef7245bfce2008cbaa7fdfe2a811903df6c
SHA512 fc6142baae95c176069495080cb5cbe97a88482a00717c7b9982c79c13cf774a5785367ce476cd69e6aa08a87ccd57fb262729ad1a613906f20f0b4ddd91934d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITK:Lz071uv4BPMkHC0IlnASEx/R2uWGTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

MgQXkQB.exe

Path C:\Windows\System\MgQXkQB.exe
Size 8B
SHA256 4443ea8760d035c6b4f05df6df4c7e7ad9c5afa8dead954bce57dab5a5afcf1e
MD5 66bd487d69202ef8b2b1bb2e1931ebf3
SHA1 6297e827d2cc12ba96555851f82fc059665704b0
SHA512 9e09fc0a19c454ee0cecdc74d2823aed9c4a94ebbcd2ca5a3004beafcda66afd0bc9b7ffcaee69b05991566849eedce2fe3d3b28ecd596511f3194e8d04c5acc
MD5 SHA1 SHA512

Submit Download

NXguobA.exe

Path C:\Windows\System\NXguobA.exe
Size 1.4MB
SHA256 ce47c487cb081e20efe14804468feb48dbc914ce8054c161f332b2c51d1324e4
MD5 3baba61bee52502717a561f5e0e1293f
SHA1 f358d48135ae6675e3e3281c4bb12453976d8c7f
SHA512 b1ef8fa54eb0d6b5f1d95d4b1ff7b38ec4468803723c224f32ddc0249b2d7c9c9be33bd02dc5b49655928b1bf31e82637813fba75017ba981a41ca9ea548cb2a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITw:Lz071uv4BPMkHC0IlnASEx/R2uWGTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

OsJHgCy.exe

Path C:\Windows\System\OsJHgCy.exe
Size 1.4MB
SHA256 2cedadb1bcfa723404f397f3e8e6479806d21fec2ed5e60e49cef281fb4c2214
MD5 cdd1e54b0d2c497b3d67db4e5955a2f5
SHA1 977ee8c67ffa27db43d60071d46bdbe311010e45
SHA512 18da325d91269c1abb6a9d066dfb91574337740446738b7f051a7f13d35b467b8a887c735be9a4b656acbf6feab1af243c095f0e3c2c384198f99e4608b40a26
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/IT1:Lz071uv4BPMkHC0IlnASEx/R2uWGT1
MD5 SHA1 SHA512 SSDEEP

Submit Download

RJWVIwP.exe

Path C:\Windows\System\RJWVIwP.exe
Size 1.4MB
SHA256 17719a4baaa54da4c107089fcc814e9163e92cad1d49ed03545b50163e65ea34
MD5 9fe77a06bc3ab512e888eff9e4e9fbdd
SHA1 239fc3c40f9aa85d520a82807212b675e4447f91
SHA512 20af0349fc19290ae97373fe4b47a20b1b14ba0492144a17389b3f5846c05bea0d37e220df250dd63cb0862b707125b0981317ffaefc2366bc01d55f93e6cbda
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITQ:Lz071uv4BPMkHC0IlnASEx/R2uWGTQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TpcKQup.exe

Path C:\Windows\System\TpcKQup.exe
Size 1.4MB
SHA256 808d3fd6996f8de5caf2a17f274de863f816d9637800c7fecf46b42597028af7
MD5 6467e61c5ba12b91b61da4c1ef8f5ab3
SHA1 048fae1e17dc31e51f118c8baa82fb013e4fec42
SHA512 03d172dd700d06e3be6b1c3a7afe44a3287ff18336c3295f774f285e87add2605c91d6b9815501e13debdcff664b18159769715784fa727762b5a16c2b2ea6fe
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITJ:Lz071uv4BPMkHC0IlnASEx/R2uWGTJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VDZzWjz.exe

Path C:\Windows\System\VDZzWjz.exe
Size 1.4MB
SHA256 7410439e902c81fe2d919ffd1176dd82eeb81fbb94c749da484893275060e194
MD5 65ccf16738499e0b89db59989d58f4d5
SHA1 1a379e059c551dfdd4a35c7759229d9ebe82b350
SHA512 ec5037c306d06e62812dcb35519d1e6d2aebba5496ea1928f8b9548facb06e3a894c75005abe4ccd85e06848c1d6ed56492cd2d0ce0cc3ee166d4df83694b183
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/IT0:Lz071uv4BPMkHC0IlnASEx/R2uWGT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

VtKbXDP.exe

Path C:\Windows\System\VtKbXDP.exe
Size 1.4MB
SHA256 313bc7ce058ab7f23c67fb2aec128d31eb1804aae110b7ca8064ae928fb4c190
MD5 c1f5ae38cdd08a79e909fbe38a432773
SHA1 de259056780c76d09c15508c30c2c204f7912809
SHA512 739ed30c766046b28862c66bf8a35aaeee910c426284f47c3be2cf25b388d0b041744c542daef0f5fc81f2f9093deaa4177f32b226a27c4934bf6f335d5aceab
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITS/:Lz071uv4BPMkHC0IlnASEx/R2uWGTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

WHrBXJe.exe

Path C:\Windows\System\WHrBXJe.exe
Size 1.4MB
SHA256 10902119160ef31a5afffc0c909ab68b8a570dee0ad0308e3796dd49b71a929e
MD5 8be43ed8a97913d4ad7acb2069b28237
SHA1 cbf3f71779db9c3cb3e1f420357d3a1420869e8b
SHA512 c0567b64c69618ba404ceb5c3543cf8304ef200bb7f95259e43757a07e9569d77c54a5613488375bd6e77918e8a7f457dda795754c81e5451203e70d02225a65
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITx:Lz071uv4BPMkHC0IlnASEx/R2uWGTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

XEKjSvx.exe

Path C:\Windows\System\XEKjSvx.exe
Size 1.4MB
SHA256 154b2ca47688e126f0b1038557d2c7d7e2ef85234887cfbd6b03613b6c3dbd2b
MD5 17030f6b56cfc4c5f9937df7b8eba144
SHA1 346033778d2bd05abb7caac88b69c8747b8b8eca
SHA512 2484cd07b1d1157817531f0383f6e4ead717d92d022f23197c2caa911823b5bcb95f1e9ba4d4024949fdb0610869e0390b3c57d9d292a8d7921bfea9faeeaebe
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITJ:Lz071uv4BPMkHC0IlnASEx/R2uWGTJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

XcdRdSM.exe

Path C:\Windows\System\XcdRdSM.exe
Size 1.4MB
SHA256 b8b1e988c2481dbee91059f89211fcc5d114626e09d04c22869a3f45d934f35d
MD5 bdd4d44c835f97bb81cd4fda0267c519
SHA1 b5876b997703553a1696d69f7bbba219ce169dfb
SHA512 3908addc3aca4739bf7dc2f0b7f237b5c5b50248d4e6b527faca6d7887befa3b63721565bfb6dead6cf0022ce9aa902146b5fc783528e3e176da3674c2a85859
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITbG:Lz071uv4BPMkHC0IlnASEx/R2uWGTbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

YhgkDBL.exe

Path C:\Windows\System\YhgkDBL.exe
Size 1.4MB
SHA256 8924082b2668ecc3a8b0525a420f220dfc8a7a1ad800d219396bf07413e0616e
MD5 cc1b7541117efef6f725e5f175650514
SHA1 2dd73d5bc7765976fcc709ab15bbbe11ff154cfb
SHA512 2c30165803a7d5d62cafd26625cf58af04577ba8d381c0d0bef40b4f987ae48f93213032a89bb3f702aa848b476819bc250071ddb44e8a45ad0ee221d75f7a53
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITT6:Lz071uv4BPMkHC0IlnASEx/R2uWGTO
MD5 SHA1 SHA512 SSDEEP

Submit Download

bhikejx.exe

Path C:\Windows\System\bhikejx.exe
Size 1.4MB
SHA256 3eef6183da4f4560d0997b90f85585597d4b7edde6439a5817377e8902ba3a92
MD5 0092f69f75f09f5b88c0bcd1dee612a8
SHA1 936bfb64eb4d052dc1d775d1451a19b482026b4d
SHA512 4cfb6f8911bca7d418ac3595a2a46ec8e72c96ca1eb816c4e64a4ab73f141f4aa7639a9b17a2b1629f56fa415dd4e69a62be1a438898e7a56c9d3c3f9129216a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITK:Lz071uv4BPMkHC0IlnASEx/R2uWGTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

brcBqUP.exe

Path C:\Windows\System\brcBqUP.exe
Size 1.4MB
SHA256 b4fae4d06b963a994ed36a67242c9f8a4f792ea9b6d95ba0040b38e6ce9a94e5
MD5 6cdf660a7431e39b7a221e02728a8b02
SHA1 716f3d0ae6aba1046dc11aed0060f9fb395ebfbf
SHA512 a6b8ab3de25cd07f54ac7e77e6d169f75c34cfc4958440fe71ae32889809282e9c928d9ed2868ca70db699da62f83974ed8e0e3cf6dc5a2b7b7d2ad620e508c6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITU:Lz071uv4BPMkHC0IlnASEx/R2uWGTU
MD5 SHA1 SHA512 SSDEEP

Submit Download

cBQtTLk.exe

Path C:\Windows\System\cBQtTLk.exe
Size 1.4MB
SHA256 a188b9241acbaed03de0175fbcd756eb31bd30a879e063a888a6b7675d0840ae
MD5 f3c0016cc0f212e05c239d85b46dac36
SHA1 e273636314361837706641f8069a964730252c83
SHA512 6ae53a4001c68d1c10b221d56b2e8baf7993d3fd2c9fc970366973529046aae70ee5d6e80136974102bd3e316f52bdbe519803f8baa5b22fa3c9d9319eac0c7e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITwy:Lz071uv4BPMkHC0IlnASEx/R2uWGTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbXVZDL.exe

Path C:\Windows\System\fbXVZDL.exe
Size 1.4MB
SHA256 545a259ee1b32500d0f576f517efb6e35dde94886a31a8529bfcc1ccadc8469c
MD5 8f5859d72cc8ca96a15f3ae9113c71ad
SHA1 adffa00945da5e1ac54f57d9af4bfaacf085a2f7
SHA512 8eaeb8ec2ada9ecdd5223126584142377c42d51db2ed06459aa5812d96313839aa41e71d3b6f086bdf56a6592f94aed7646056ac85be8aa851d4a144aca9feb7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITZx:Lz071uv4BPMkHC0IlnASEx/R2uWGTZx
MD5 SHA1 SHA512 SSDEEP

Submit Download

fpHybIB.exe

Path C:\Windows\System\fpHybIB.exe
Size 1.4MB
SHA256 1893021bedb850bb19e9d847071adbc31dba8b518d6240ec253a2d0e2040e5d6
MD5 a86ff20f50bce610db3d97451cd7733d
SHA1 4910c78ba4367f5579932e228ac4ee732e1a8361
SHA512 912ed1f67a160f6df25b104e82e6e18dbadcf63d3e6dcd57082bb555204ebdef0329808aee5117c22c64cd0396c805ab12c250e7b8058cb232052ebeb6f2f949
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITL:Lz071uv4BPMkHC0IlnASEx/R2uWGTL
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbPVRyn.exe

Path C:\Windows\System\hbPVRyn.exe
Size 1.4MB
SHA256 c2731f9505af354b6fdfdaa8696ab0d39307313c07b653f9f921752f81a84c0f
MD5 ac641c26b923ea9a965a360d5dfc1bc1
SHA1 bb66718a70317fbe6e2b99c0533311b70520854f
SHA512 e4dab69ac174baa8681d587b89615d926287b032fd310859989f8cc86db6a4eb358a3d21d62ec3c2324c1d3fc08c81188796fb517a96fee928756a06a7ab9bfb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITs:Lz071uv4BPMkHC0IlnASEx/R2uWGTs
MD5 SHA1 SHA512 SSDEEP

Submit Download

kSxBWeZ.exe

Path C:\Windows\System\kSxBWeZ.exe
Size 1.4MB
SHA256 a5cb6204832322e09f261689b55d77ba7748e70053154cd6001c34e53dd69014
MD5 c682d31ae64334514cb74eb9ba72a923
SHA1 9634cd4776785aaa9dfe673b3e5a4c23ce86d77b
SHA512 c5dcf9a178b5c170fdef4b6990c459bbba4cdbb7be73f586f89f0c812c0b01b3ed7f8ee59ce8a48be0202dc481dfaf08842b9e35f5f504006ae2fb3bb1140446
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITw:Lz071uv4BPMkHC0IlnASEx/R2uWGTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

koBiWMi.exe

Path C:\Windows\System\koBiWMi.exe
Size 1.4MB
SHA256 8c6d18a36e6666a02c9811aaf696b52aa4b014024b25235793a6c3e9feff186e
MD5 6b9e4358005c43044e31751f9ab01e8c
SHA1 de5e9c3dba6f37481152e4c52909757fb87abe2f
SHA512 2d808371641148cd07030471f69f77cd11187bbc844894fb54d07ba0f9dbb7af464a3005897e76a381151b749d63a3dea6804a3399a8b721845dd07eb8b99700
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITm:Lz071uv4BPMkHC0IlnASEx/R2uWGTm
MD5 SHA1 SHA512 SSDEEP

Submit Download

mMpOZwa.exe

Path C:\Windows\System\mMpOZwa.exe
Size 1.4MB
SHA256 e2d2c3e66b1c94d028f8d5b3b0f4d5bc71385fda5400cd2c434f47788ad5a55a
MD5 e414fed9abaf503043c13369ff35499e
SHA1 9766873281ea8734cf06a45e685ab307f59aca87
SHA512 27881d01cc2946f77136d425b7c570ca3a65d2d68aefc002df492f83c09406da14ee575bdfd5a9753564784dfb74db4e0d64a1a1fe405d832d47da48a46d351b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITw:Lz071uv4BPMkHC0IlnASEx/R2uWGTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

neOVBqj.exe

Path C:\Windows\System\neOVBqj.exe
Size 1.4MB
SHA256 a79689d58ae16a17f311dfb36d0122b049d1d76cfe1a123b352ce5ddb70ad560
MD5 91edc209ddd742e1f22278bfe3b8c7f6
SHA1 10d139e0a7a7cee03b7dc51a17fd240ada7d9941
SHA512 c65e199951c45f8f64661eb7cf1a1749686d5024c39a3803c595ac9fec343328aef2f72cf4ced5d07a05b938e831c289f90d93ef6b95a26a9425bf10c9478b69
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/IT9:Lz071uv4BPMkHC0IlnASEx/R2uWGT9
MD5 SHA1 SHA512 SSDEEP

Submit Download

oHHlxVM.exe

Path C:\Windows\System\oHHlxVM.exe
Size 1.4MB
SHA256 f285dedff96b78bd906db4f421b4178585f9247f262500c65b08b32c4d4f8e8b
MD5 03714906e348f6bce89df7d08e54db62
SHA1 766d13a5a10098bd079e6a0af67dfc47aaace7e9
SHA512 28a64064a52e81afdd08329e65d1839043ca8d778088072b45a4ad92ea673b0d834df6426bed65359d2973823dfeecd477dccf77770c5dfa055cd2aa1732b969
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITD:Lz071uv4BPMkHC0IlnASEx/R2uWGTD
MD5 SHA1 SHA512 SSDEEP

Submit Download

oOIFYOL.exe

Path C:\Windows\System\oOIFYOL.exe
Size 1.4MB
SHA256 1768194500396ec68e6a76a39397d639d235e37c83f69e17aaddaa48cbc03afc
MD5 329939e758fea0f0aff701e11a7f1a8d
SHA1 0fd40fadf78e9c34a4ce97b45a634fd77d640b72
SHA512 a418423f682465587c76d19a1cd8cf3658cb81e6e964fe333f6cbcbb16087b625290266fd01d43afcfb7efcb50ca10f22107d5c2b36bb111e1ac260eefa0b907
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITC:Lz071uv4BPMkHC0IlnASEx/R2uWGTC
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfUPVmO.exe

Path C:\Windows\System\pfUPVmO.exe
Size 1.4MB
SHA256 f70b2f7f7b114d16d61acf268032dc3424cea99481146b5b01e92926a22d6f24
MD5 ce4638050bb93946d3b77a26e08a7039
SHA1 69a749b932aeac7dcc1433bca3b1c50aa2189dd4
SHA512 38b192fe93d1fb3a512c039e95056be49cb7062abceb32ec503c74c15a5c6b2634d21ca269777112c21773b200720a4a3f3e70e769cc0877ad2dc1d7fa4aafda
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITK:Lz071uv4BPMkHC0IlnASEx/R2uWGTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

rCimfUM.exe

Path C:\Windows\System\rCimfUM.exe
Size 1.4MB
SHA256 a1e82c5447d88263aae72fce621abd2dd8927f99e9f6ddc83a0780a9c7660f69
MD5 4dacd1ac3554bfb81c2bcc0a59757f4c
SHA1 b4ab6d2074cc9650f29d2a5360092f0a6e28af78
SHA512 a5af1aef6ff9a1e24148906f965d2fe56c3c24f6d6fc029a3862244cf0b3a9730b85a9813ab6bd448307bf90b37d8da366f55af5c3061dd6ecde0075fd2fe899
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITn:Lz071uv4BPMkHC0IlnASEx/R2uWGTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

riGNOyJ.exe

Path C:\Windows\System\riGNOyJ.exe
Size 1.4MB
SHA256 fdfd15970725d15f01aecda95b712c922815a367080450d1680aba2a36868fc8
MD5 ded5ffa4aa1fe8e9835d92782d7ce4a4
SHA1 b712bc7d04b75496ec2d7cc4fa15596bf3a4734d
SHA512 bbe0feb304db72769801f5b7d1c6c2e68e7483b9b7fb7f39e67143a73819fddc2a3d25ce9edfbc270d80336326c487a40352920af2dd28ad2f3e6fd9b5a352d1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/IT2+:Lz071uv4BPMkHC0IlnASEx/R2uWGTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

tgGpzOa.exe

Path C:\Windows\System\tgGpzOa.exe
Size 1.4MB
SHA256 39b7a915eac213d148059c4b577c1de46850985762d1c8b53b481b672926d8bd
MD5 b0824f39ae6f547059fab83b72125714
SHA1 1e62c621c8607a382cd7ee40c492a9751e29a752
SHA512 d2857dd17256a6e0725ad4c8e40fd5478c8a904fc5d243bd8da420dc2ca43f8d37cac157123ba71c3b8168fc2bc406dba42e52acf6c0dac721c7e7ebac29dd43
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITn:Lz071uv4BPMkHC0IlnASEx/R2uWGTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

uOMHOKd.exe

Path C:\Windows\System\uOMHOKd.exe
Size 1.4MB
SHA256 891a00310b006964708cc7f5397c9e535e4595a1f827500c448004f270b755f4
MD5 13071e72418a125433a621be1264b552
SHA1 deda1b7e3b5ffee5a8a4ccef6122aaad1d3b08c5
SHA512 48f460bccd81068083c810cf43be11f39c72f3410b494cd84bc961440438ef5bcbe604b1a649e8beab7eba4792ba25b99347de7f9b1dce4ae43da3d40642280c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITC:Lz071uv4BPMkHC0IlnASEx/R2uWGTC
MD5 SHA1 SHA512 SSDEEP

Submit Download

vSNwdSo.exe

Path C:\Windows\System\vSNwdSo.exe
Size 1.4MB
SHA256 dbfd8dc8dc41b3283eb89ee52965715f6bca64487b3b5054ed0c31d09c3b7a32
MD5 4a63788ff748ee2e22d33191ffbd3a73
SHA1 051f43154f37418b802b765af356bb324c6bc39d
SHA512 0e0ad79e392e2435b0a585659605a212d18237ec3d30d44c13fe427e5e64dd8aa2f4acb047867596d690c8e602cbbd4f9f05215b9cc24e4bf85d804c1eb46798
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITh:Lz071uv4BPMkHC0IlnASEx/R2uWGTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

wSoYBJs.exe

Path C:\Windows\System\wSoYBJs.exe
Size 1.4MB
SHA256 be8a8035c8a3ead703e98c0f80a3781be44ec0e5436d77759b8eaeb661b82b56
MD5 6eed3017ca76e2eab768eb8f207e8cf4
SHA1 0ad2b5fd69f1c615a383ebe794386c2b29c4c763
SHA512 cadb37ff0c1de3de371314cec4523c466cfe4346dec8c4a037f68bf1882ab613241b07cf1a738d9fbb358fde82fae6064b570578abcd4ca42bb151c5a9e41b59
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/IT7:Lz071uv4BPMkHC0IlnASEx/R2uWGT7
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrcCutd.exe

Path C:\Windows\System\wrcCutd.exe
Size 1.4MB
SHA256 8c6cd932bcadf43122987cfda32db33cab17981f3fa6e1c8e80c9697c90381b9
MD5 8c00e3cf867cb80a7b41c6230ed81f9d
SHA1 42e1e257ce4ea356fa3705d0ef9271e7ae0da387
SHA512 ba603793bb1f6732fae678e0422dbe8eb5fd28cf96dfca913d3fa9584e80c6daf12dec31a9dd1ea41c606330bf43de7f6b8eecc96da4eebc88344f7787d0b22c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITL:Lz071uv4BPMkHC0IlnASEx/R2uWGTL
MD5 SHA1 SHA512 SSDEEP

Submit Download

xBeOfqn.exe

Path C:\Windows\System\xBeOfqn.exe
Size 1.4MB
SHA256 6b27de4562f01dd3e44209606003b89102acc3d06cf612c8bdd3109be60ad19a
MD5 0b61b8da8ae66c2ad2089ca1f5f8037e
SHA1 de4de1b72529d7247f1c744ca9ef1d8f625d53ee
SHA512 d76bb6e6e355e41f89e49798a8e48a1eebe11a96c455517ad3e6848538bd72c9b3e4495840935c0c0c0f0905a6af4a95f1ae54d7a8f335a5b6e9a3fd89b7b342
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITI:Lz071uv4BPMkHC0IlnASEx/R2uWGTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

zsyTgjR.exe

Path C:\Windows\System\zsyTgjR.exe
Size 1.4MB
SHA256 a62d804f4eca499369ffa416a6255996a48f21e6705e6f4d633b50f4f53569bf
MD5 f35afb36230f1857f5302786e4c2bf1e
SHA1 a347c25669b3dbbe2424b89530cc9cbf2ae4af8a
SHA512 7b87b3f7fa927d1075c9aa897a2d18cf7739c8e962458c92ed9e4e751f7c42ff24ed9cd034eeb0a41b25b69ccf52c021b4c400389719ebc86138ec04f2c06838
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B3/ITnK:Lz071uv4BPMkHC0IlnASEx/R2uWGTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-3166-0x00007FF683000000-0x00007FF6833F2000-memory.dmp

Download

memory/628-682-0x00007FF683000000-0x00007FF6833F2000-memory.dmp

Download

memory/640-829-0x00007FF65C1B0000-0x00007FF65C5A2000-memory.dmp

Download

memory/640-3154-0x00007FF65C1B0000-0x00007FF65C5A2000-memory.dmp

Download

memory/1248-3160-0x00007FF64FD00000-0x00007FF6500F2000-memory.dmp

Download

memory/1248-817-0x00007FF64FD00000-0x00007FF6500F2000-memory.dmp

Download

memory/1536-414-0x00007FF7BD220000-0x00007FF7BD612000-memory.dmp

Download

memory/1536-3156-0x00007FF7BD220000-0x00007FF7BD612000-memory.dmp

Download

memory/1696-3168-0x00007FF719FC0000-0x00007FF71A3B2000-memory.dmp

Download

memory/1696-812-0x00007FF719FC0000-0x00007FF71A3B2000-memory.dmp

Download

memory/1736-818-0x00007FF67E760000-0x00007FF67EB52000-memory.dmp

Download

memory/1736-3181-0x00007FF67E760000-0x00007FF67EB52000-memory.dmp

Download

memory/1776-3152-0x00007FF79E150000-0x00007FF79E542000-memory.dmp

Download

memory/1776-321-0x00007FF79E150000-0x00007FF79E542000-memory.dmp

Download

memory/2004-3162-0x00007FF6AB300000-0x00007FF6AB6F2000-memory.dmp

Download

memory/2004-819-0x00007FF6AB300000-0x00007FF6AB6F2000-memory.dmp

Download

memory/2308-826-0x00007FF7B2310000-0x00007FF7B2702000-memory.dmp

Download

memory/2308-3201-0x00007FF7B2310000-0x00007FF7B2702000-memory.dmp

Download

memory/2732-209-0x00007FF6D6450000-0x00007FF6D6842000-memory.dmp

Download

memory/2732-3140-0x00007FF6D6450000-0x00007FF6D6842000-memory.dmp

Download

memory/2752-512-0x00007FF7A5820000-0x00007FF7A5C12000-memory.dmp

Download

memory/2752-3159-0x00007FF7A5820000-0x00007FF7A5C12000-memory.dmp

Download

memory/3008-3135-0x00007FF6BF990000-0x00007FF6BFD82000-memory.dmp

Download

memory/3008-258-0x00007FF6BF990000-0x00007FF6BFD82000-memory.dmp

Download

memory/3140-78-0x00007FF790F40000-0x00007FF791332000-memory.dmp

Download

memory/3140-3129-0x00007FF790F40000-0x00007FF791332000-memory.dmp

Download

memory/3196-822-0x00007FF6D9880000-0x00007FF6D9C72000-memory.dmp

Download

memory/3196-3184-0x00007FF6D9880000-0x00007FF6D9C72000-memory.dmp

Download

memory/3216-3178-0x00007FF61E690000-0x00007FF61EA82000-memory.dmp

Download

memory/3216-411-0x00007FF61E690000-0x00007FF61EA82000-memory.dmp

Download

memory/3240-3187-0x00007FF620510000-0x00007FF620902000-memory.dmp

Download

memory/3240-824-0x00007FF620510000-0x00007FF620902000-memory.dmp

Download

memory/3480-53-0x00007FF81B080000-0x00007FF81BB41000-memory.dmp

Download

memory/3480-148-0x00007FF81B080000-0x00007FF81BB41000-memory.dmp

Download

memory/3480-2058-0x00007FF81B080000-0x00007FF81BB41000-memory.dmp

Download

memory/3480-245-0x000001C847110000-0x000001C847132000-memory.dmp

Download

memory/3480-5-0x00007FF81B083000-0x00007FF81B085000-memory.dmp

Download

memory/3708-828-0x00007FF7BAD60000-0x00007FF7BB152000-memory.dmp

Download

memory/3708-3149-0x00007FF7BAD60000-0x00007FF7BB152000-memory.dmp

Download

memory/4044-3171-0x00007FF75BD90000-0x00007FF75C182000-memory.dmp

Download

memory/4044-823-0x00007FF75BD90000-0x00007FF75C182000-memory.dmp

Download

memory/4284-820-0x00007FF63E600000-0x00007FF63E9F2000-memory.dmp

Download

memory/4284-3185-0x00007FF63E600000-0x00007FF63E9F2000-memory.dmp

Download

memory/4336-3124-0x00007FF648890000-0x00007FF648C82000-memory.dmp

Download

memory/4336-827-0x00007FF648890000-0x00007FF648C82000-memory.dmp

Download

memory/4504-3146-0x00007FF618C80000-0x00007FF619072000-memory.dmp

Download

memory/4504-322-0x00007FF618C80000-0x00007FF619072000-memory.dmp

Download

memory/4576-3176-0x00007FF7E0200000-0x00007FF7E05F2000-memory.dmp

Download

memory/4576-816-0x00007FF7E0200000-0x00007FF7E05F2000-memory.dmp

Download

memory/4852-0-0x00007FF79A9D0000-0x00007FF79ADC2000-memory.dmp

Download

memory/4852-1-0x00000250D3540000-0x00000250D3550000-memory.dmp

Download

memory/4912-3164-0x00007FF7C45D0000-0x00007FF7C49C2000-memory.dmp

Download

memory/4912-821-0x00007FF7C45D0000-0x00007FF7C49C2000-memory.dmp

Download

memory/5092-3174-0x00007FF63DB80000-0x00007FF63DF72000-memory.dmp

Download

memory/5092-825-0x00007FF63DB80000-0x00007FF63DF72000-memory.dmp

Download