xmrig | 3bdf28882f63db1e4be29a32a3c073fa638377ce2eba28754638d7a3971f53f1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
Size 2.8MB
Sample240528-lktx8aec3y
SHA256 3bdf28882f63db1e4be29a32a3c073fa638377ce2eba28754638d7a3971f53f1
MD5 3d89926a36747243f7fc4cf57f14a600
SHA1 580aef7fa95719ca51484e89f6412e5fef411033
SHA512 42731b849d186e62736650c57f1435eb9c56f088d4b7419f7fd2b1700af6e9377303e98859fcb3e3c4863406f0c8eae50d5262c9d0a24a5d5eb96d0d422f5413
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBN:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2452-0-0x00007FF65A9B0000-0x00007FF65ADA6000-memory.dmp	xmrig
behavioral2/files/0x000700000002328e-6.dat	xmrig
behavioral2/files/0x000700000002342d-8.dat	xmrig
behavioral2/files/0x000700000002342c-9.dat	xmrig
behavioral2/files/0x000700000002342e-30.dat	xmrig
behavioral2/files/0x0007000000023432-41.dat	xmrig
behavioral2/files/0x0008000000023431-47.dat	xmrig
behavioral2/files/0x0007000000023433-53.dat	xmrig
behavioral2/memory/1540-54-0x00007FF68AE20000-0x00007FF68B216000-memory.dmp	xmrig
behavioral2/memory/3488-61-0x00007FF611C10000-0x00007FF612006000-memory.dmp	xmrig
behavioral2/memory/4708-62-0x00007FF74A8C0000-0x00007FF74ACB6000-memory.dmp	xmrig
behavioral2/memory/1164-65-0x00007FF7A44F0000-0x00007FF7A48E6000-memory.dmp	xmrig
behavioral2/memory/3192-67-0x00007FF6C0F70000-0x00007FF6C1366000-memory.dmp	xmrig
behavioral2/memory/2408-69-0x00007FF77D420000-0x00007FF77D816000-memory.dmp	xmrig
behavioral2/memory/2876-68-0x00007FF7DF5A0000-0x00007FF7DF996000-memory.dmp	xmrig
behavioral2/memory/4068-66-0x00007FF75B450000-0x00007FF75B846000-memory.dmp	xmrig
behavioral2/files/0x0008000000023430-63.dat	xmrig
behavioral2/memory/876-56-0x00007FF6B7820000-0x00007FF6B7C16000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-40.dat	xmrig
behavioral2/files/0x0007000000023434-75.dat	xmrig
behavioral2/files/0x0007000000023437-90.dat	xmrig
behavioral2/files/0x0007000000023438-104.dat	xmrig
behavioral2/files/0x000700000002343a-109.dat	xmrig
behavioral2/files/0x0007000000023439-117.dat	xmrig
behavioral2/files/0x000700000002343d-127.dat	xmrig
behavioral2/memory/2256-131-0x00007FF62F570000-0x00007FF62F966000-memory.dmp	xmrig
behavioral2/memory/3816-133-0x00007FF647F30000-0x00007FF648326000-memory.dmp	xmrig
behavioral2/memory/1848-135-0x00007FF6D1630000-0x00007FF6D1A26000-memory.dmp	xmrig
behavioral2/memory/3588-139-0x00007FF76F790000-0x00007FF76FB86000-memory.dmp	xmrig
behavioral2/memory/5040-140-0x00007FF6099C0000-0x00007FF609DB6000-memory.dmp	xmrig
behavioral2/files/0x000700000002343e-138.dat	xmrig
behavioral2/files/0x000700000002343c-137.dat	xmrig
behavioral2/memory/2520-134-0x00007FF703750000-0x00007FF703B46000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-124.dat	xmrig
behavioral2/memory/2968-121-0x00007FF720B30000-0x00007FF720F26000-memory.dmp	xmrig
behavioral2/memory/1980-119-0x00007FF6A50F0000-0x00007FF6A54E6000-memory.dmp	xmrig
behavioral2/memory/4568-114-0x00007FF6A89A0000-0x00007FF6A8D96000-memory.dmp	xmrig
behavioral2/memory/4024-105-0x00007FF7E05F0000-0x00007FF7E09E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023436-98.dat	xmrig
behavioral2/files/0x0007000000023435-97.dat	xmrig
behavioral2/memory/4656-93-0x00007FF716150000-0x00007FF716546000-memory.dmp	xmrig
behavioral2/files/0x0009000000023425-88.dat	xmrig
behavioral2/memory/752-79-0x00007FF6E4BA0000-0x00007FF6E4F96000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-230.dat	xmrig
behavioral2/memory/976-245-0x00007FF6E6220000-0x00007FF6E6616000-memory.dmp	xmrig
behavioral2/memory/4588-250-0x00007FF7BE820000-0x00007FF7BEC16000-memory.dmp	xmrig
behavioral2/files/0x0007000000023463-252.dat	xmrig
behavioral2/files/0x000700000002345e-255.dat	xmrig
behavioral2/files/0x0007000000023462-259.dat	xmrig
behavioral2/files/0x000700000002345f-257.dat	xmrig
behavioral2/files/0x0007000000023464-267.dat	xmrig
behavioral2/memory/1456-254-0x00007FF75A7E0000-0x00007FF75ABD6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023466-289.dat	xmrig
behavioral2/files/0x000700000002346c-310.dat	xmrig
behavioral2/files/0x0007000000023474-322.dat	xmrig
behavioral2/files/0x0007000000023477-330.dat	xmrig
behavioral2/files/0x0007000000023479-335.dat	xmrig
behavioral2/memory/2452-745-0x00007FF65A9B0000-0x00007FF65ADA6000-memory.dmp	xmrig
behavioral2/memory/4656-1808-0x00007FF716150000-0x00007FF716546000-memory.dmp	xmrig
behavioral2/memory/4024-1812-0x00007FF7E05F0000-0x00007FF7E09E6000-memory.dmp	xmrig
behavioral2/memory/2520-2309-0x00007FF703750000-0x00007FF703B46000-memory.dmp	xmrig
behavioral2/memory/1848-2311-0x00007FF6D1630000-0x00007FF6D1A26000-memory.dmp	xmrig
behavioral2/memory/1540-4582-0x00007FF68AE20000-0x00007FF68B216000-memory.dmp	xmrig
behavioral2/memory/876-4614-0x00007FF6B7820000-0x00007FF6B7C16000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
5	2476	powershell.exe
7	2476	powershell.exe
15	2476	powershell.exe
16	2476	powershell.exe
18	2476	powershell.exe
27	2476	powershell.exe
28	2476	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2476	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4068	QuTCMYN.exe
1540	ylusOpH.exe
876	NfdSEke.exe
3192	GBjAdyf.exe
3488	WaTVMoe.exe
4708	ABusexm.exe
1164	jGqPsbo.exe
2876	AZfIIQn.exe
2408	DNDKwlx.exe
752	SwMUjYw.exe
4656	cpRReZD.exe
4568	xDgFaWC.exe
1980	ArPxLXH.exe
4024	HMgaoqA.exe
2968	MLCIsPS.exe
3588	hZYzqHX.exe
2256	VdrHrjP.exe
3816	MzttrCa.exe
5040	AcIZRRr.exe
2520	AzehwCb.exe
1848	LgImueF.exe
976	lVmScCp.exe
4588	bbpXqcI.exe
1456	LRTzoes.exe
1468	bQywoxw.exe
5000	hfUHIub.exe
4632	xYHfrFt.exe
3448	lYZWzPK.exe
2944	yrZRDgi.exe
1824	JwrIVpx.exe
1228	LLtAreI.exe
5092	iDvJljt.exe
3776	nstlegh.exe
872	KSxtvtK.exe
220	ipOWVad.exe
3396	TNRlRCf.exe
4108	gXeIxec.exe
1660	ujTzYLE.exe
4424	XSXxOGx.exe
816	MMsNACf.exe
1360	FFFQTSR.exe
8	EyLGwMS.exe
4748	DiAQffr.exe
1864	MxuEUgI.exe
3340	AUUxEzz.exe
3196	JjNfxJU.exe
4032	YHbPGNw.exe
744	JXfAext.exe
2868	irTaPKX.exe
3228	anEglkG.exe
4344	IuNpuWk.exe
4580	gEJsemD.exe
1328	MOvGbZb.exe
3136	JrEdXGP.exe
1868	UHmOcCa.exe
4924	hvjGaKp.exe
3252	jVdyazE.exe
4980	GSjBTqH.exe
1900	LiizCTL.exe
3256	OsBcDbX.exe
4232	wKRbCyQ.exe
228	rInTiru.exe
2984	JTcjfTK.exe
3768	dLLflnW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2452-0-0x00007FF65A9B0000-0x00007FF65ADA6000-memory.dmp	upx
behavioral2/files/0x000700000002328e-6.dat	upx
behavioral2/files/0x000700000002342d-8.dat	upx
behavioral2/files/0x000700000002342c-9.dat	upx
behavioral2/files/0x000700000002342e-30.dat	upx
behavioral2/files/0x0007000000023432-41.dat	upx
behavioral2/files/0x0008000000023431-47.dat	upx
behavioral2/files/0x0007000000023433-53.dat	upx
behavioral2/memory/1540-54-0x00007FF68AE20000-0x00007FF68B216000-memory.dmp	upx
behavioral2/memory/3488-61-0x00007FF611C10000-0x00007FF612006000-memory.dmp	upx
behavioral2/memory/4708-62-0x00007FF74A8C0000-0x00007FF74ACB6000-memory.dmp	upx
behavioral2/memory/1164-65-0x00007FF7A44F0000-0x00007FF7A48E6000-memory.dmp	upx
behavioral2/memory/3192-67-0x00007FF6C0F70000-0x00007FF6C1366000-memory.dmp	upx
behavioral2/memory/2408-69-0x00007FF77D420000-0x00007FF77D816000-memory.dmp	upx
behavioral2/memory/2876-68-0x00007FF7DF5A0000-0x00007FF7DF996000-memory.dmp	upx
behavioral2/memory/4068-66-0x00007FF75B450000-0x00007FF75B846000-memory.dmp	upx
behavioral2/files/0x0008000000023430-63.dat	upx
behavioral2/memory/876-56-0x00007FF6B7820000-0x00007FF6B7C16000-memory.dmp	upx
behavioral2/files/0x000700000002342f-40.dat	upx
behavioral2/files/0x0007000000023434-75.dat	upx
behavioral2/files/0x0007000000023437-90.dat	upx
behavioral2/files/0x0007000000023438-104.dat	upx
behavioral2/files/0x000700000002343a-109.dat	upx
behavioral2/files/0x0007000000023439-117.dat	upx
behavioral2/files/0x000700000002343d-127.dat	upx
behavioral2/memory/2256-131-0x00007FF62F570000-0x00007FF62F966000-memory.dmp	upx
behavioral2/memory/3816-133-0x00007FF647F30000-0x00007FF648326000-memory.dmp	upx
behavioral2/memory/1848-135-0x00007FF6D1630000-0x00007FF6D1A26000-memory.dmp	upx
behavioral2/memory/3588-139-0x00007FF76F790000-0x00007FF76FB86000-memory.dmp	upx
behavioral2/memory/5040-140-0x00007FF6099C0000-0x00007FF609DB6000-memory.dmp	upx
behavioral2/files/0x000700000002343e-138.dat	upx
behavioral2/files/0x000700000002343c-137.dat	upx
behavioral2/memory/2520-134-0x00007FF703750000-0x00007FF703B46000-memory.dmp	upx
behavioral2/files/0x000700000002343b-124.dat	upx
behavioral2/memory/2968-121-0x00007FF720B30000-0x00007FF720F26000-memory.dmp	upx
behavioral2/memory/1980-119-0x00007FF6A50F0000-0x00007FF6A54E6000-memory.dmp	upx
behavioral2/memory/4568-114-0x00007FF6A89A0000-0x00007FF6A8D96000-memory.dmp	upx
behavioral2/memory/4024-105-0x00007FF7E05F0000-0x00007FF7E09E6000-memory.dmp	upx
behavioral2/files/0x0007000000023436-98.dat	upx
behavioral2/files/0x0007000000023435-97.dat	upx
behavioral2/memory/4656-93-0x00007FF716150000-0x00007FF716546000-memory.dmp	upx
behavioral2/files/0x0009000000023425-88.dat	upx
behavioral2/memory/752-79-0x00007FF6E4BA0000-0x00007FF6E4F96000-memory.dmp	upx
behavioral2/files/0x000700000002343f-230.dat	upx
behavioral2/memory/976-245-0x00007FF6E6220000-0x00007FF6E6616000-memory.dmp	upx
behavioral2/memory/4588-250-0x00007FF7BE820000-0x00007FF7BEC16000-memory.dmp	upx
behavioral2/files/0x0007000000023463-252.dat	upx
behavioral2/files/0x000700000002345e-255.dat	upx
behavioral2/files/0x0007000000023462-259.dat	upx
behavioral2/files/0x000700000002345f-257.dat	upx
behavioral2/files/0x0007000000023464-267.dat	upx
behavioral2/memory/1456-254-0x00007FF75A7E0000-0x00007FF75ABD6000-memory.dmp	upx
behavioral2/files/0x0007000000023466-289.dat	upx
behavioral2/files/0x000700000002346c-310.dat	upx
behavioral2/files/0x0007000000023474-322.dat	upx
behavioral2/files/0x0007000000023477-330.dat	upx
behavioral2/files/0x0007000000023479-335.dat	upx
behavioral2/memory/2452-745-0x00007FF65A9B0000-0x00007FF65ADA6000-memory.dmp	upx
behavioral2/memory/4656-1808-0x00007FF716150000-0x00007FF716546000-memory.dmp	upx
behavioral2/memory/4024-1812-0x00007FF7E05F0000-0x00007FF7E09E6000-memory.dmp	upx
behavioral2/memory/2520-2309-0x00007FF703750000-0x00007FF703B46000-memory.dmp	upx
behavioral2/memory/1848-2311-0x00007FF6D1630000-0x00007FF6D1A26000-memory.dmp	upx
behavioral2/memory/1540-4582-0x00007FF68AE20000-0x00007FF68B216000-memory.dmp	upx
behavioral2/memory/876-4614-0x00007FF6B7820000-0x00007FF6B7C16000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\usnJqnW.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\aKbWWyF.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\kyOOuch.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\qJwXdVW.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\VOPYGLu.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\cDKsnRk.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\AiQxBFg.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\SDXsEoB.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\NizBiJn.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\YWQvThl.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\fGmVSvY.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\BfNXQLP.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\ijepgCj.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\wZXmUef.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\srsHbVl.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\FdeoWcb.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\OHxQmHN.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\wGyvBXa.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\segREFb.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\lJtZYhx.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\eBrZmSY.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\lGusQQE.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\cVZIHmW.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\KNFjhhG.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\krWmmAw.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\sSxXPcu.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\crrgmeX.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\YggHLHK.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\zGwIafW.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\oIzkBZs.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\sbbnYCw.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\XclhnMO.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\GAxPVut.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\kJGsYGB.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\kCzuhCc.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\VxdXSnA.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\PvjtMTm.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\ZOZpeNb.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\MtsEWmD.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\PoSokey.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\LoEdUXm.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\SbcQqkJ.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\mDQHdkV.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\eVkGiUG.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\ZFnJOCl.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\HNTTxlX.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\TQpXtAf.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\yEIfYXI.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\xkbcUDV.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\sXxXrDY.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\MJketJi.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\aVwaKyE.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\scNnZxT.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\kOgDcoV.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\kobRjhg.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\UAvxjMF.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\LFFuQpM.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\vmyQEPb.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\ydBTaOA.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\DIKOTBJ.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\MmxlDxl.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\dOXcqJE.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\BYweOmx.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
File created	C:\Windows\System\oinhrFo.exe	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2476	powershell.exe
2476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeLockMemoryPrivilege	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2476	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	86
PID 2452 wrote to memory of 2476	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	86
PID 2452 wrote to memory of 4068	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	87
PID 2452 wrote to memory of 4068	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	87
PID 2452 wrote to memory of 1540	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	88
PID 2452 wrote to memory of 1540	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	88
PID 2452 wrote to memory of 876	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	89
PID 2452 wrote to memory of 876	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	89
PID 2452 wrote to memory of 3192	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	90
PID 2452 wrote to memory of 3192	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	90
PID 2452 wrote to memory of 3488	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	91
PID 2452 wrote to memory of 3488	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	91
PID 2452 wrote to memory of 4708	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	92
PID 2452 wrote to memory of 4708	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	92
PID 2452 wrote to memory of 1164	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	93
PID 2452 wrote to memory of 1164	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	93
PID 2452 wrote to memory of 2876	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	94
PID 2452 wrote to memory of 2876	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	94
PID 2452 wrote to memory of 2408	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	95
PID 2452 wrote to memory of 2408	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	95
PID 2452 wrote to memory of 752	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	96
PID 2452 wrote to memory of 752	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	96
PID 2452 wrote to memory of 4656	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	97
PID 2452 wrote to memory of 4656	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	97
PID 2452 wrote to memory of 4568	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	98
PID 2452 wrote to memory of 4568	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	98
PID 2452 wrote to memory of 1980	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	99
PID 2452 wrote to memory of 1980	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	99
PID 2452 wrote to memory of 4024	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	100
PID 2452 wrote to memory of 4024	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	100
PID 2452 wrote to memory of 2968	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	101
PID 2452 wrote to memory of 2968	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	101
PID 2452 wrote to memory of 3588	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	102
PID 2452 wrote to memory of 3588	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	102
PID 2452 wrote to memory of 2256	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	103
PID 2452 wrote to memory of 2256	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	103
PID 2452 wrote to memory of 3816	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	104
PID 2452 wrote to memory of 3816	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	104
PID 2452 wrote to memory of 5040	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	105
PID 2452 wrote to memory of 5040	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	105
PID 2452 wrote to memory of 2520	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	106
PID 2452 wrote to memory of 2520	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	106
PID 2452 wrote to memory of 1848	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	107
PID 2452 wrote to memory of 1848	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	107
PID 2452 wrote to memory of 976	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	108
PID 2452 wrote to memory of 976	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	108
PID 2452 wrote to memory of 4588	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	109
PID 2452 wrote to memory of 4588	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	109
PID 2452 wrote to memory of 1456	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	110
PID 2452 wrote to memory of 1456	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	110
PID 2452 wrote to memory of 1468	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	111
PID 2452 wrote to memory of 1468	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	111
PID 2452 wrote to memory of 5000	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	112
PID 2452 wrote to memory of 5000	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	112
PID 2452 wrote to memory of 4632	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	114
PID 2452 wrote to memory of 4632	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	114
PID 2452 wrote to memory of 3448	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	115
PID 2452 wrote to memory of 3448	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	115
PID 2452 wrote to memory of 2944	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	116
PID 2452 wrote to memory of 2944	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	116
PID 2452 wrote to memory of 1824	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	118
PID 2452 wrote to memory of 1824	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	118
PID 2452 wrote to memory of 1228	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	120
PID 2452 wrote to memory of 1228	2452	3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe	120

C:\Users\Admin\AppData\Local\Temp\3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3d89926a36747243f7fc4cf57f14a600_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\System\QuTCMYN.exe
  C:\Windows\System\QuTCMYN.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\ylusOpH.exe
  C:\Windows\System\ylusOpH.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\NfdSEke.exe
  C:\Windows\System\NfdSEke.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\GBjAdyf.exe
  C:\Windows\System\GBjAdyf.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\WaTVMoe.exe
  C:\Windows\System\WaTVMoe.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\ABusexm.exe
  C:\Windows\System\ABusexm.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\jGqPsbo.exe
  C:\Windows\System\jGqPsbo.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\AZfIIQn.exe
  C:\Windows\System\AZfIIQn.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\DNDKwlx.exe
  C:\Windows\System\DNDKwlx.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\SwMUjYw.exe
  C:\Windows\System\SwMUjYw.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\cpRReZD.exe
  C:\Windows\System\cpRReZD.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\xDgFaWC.exe
  C:\Windows\System\xDgFaWC.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\ArPxLXH.exe
  C:\Windows\System\ArPxLXH.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\HMgaoqA.exe
  C:\Windows\System\HMgaoqA.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\MLCIsPS.exe
  C:\Windows\System\MLCIsPS.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\hZYzqHX.exe
  C:\Windows\System\hZYzqHX.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\VdrHrjP.exe
  C:\Windows\System\VdrHrjP.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\MzttrCa.exe
  C:\Windows\System\MzttrCa.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\AcIZRRr.exe
  C:\Windows\System\AcIZRRr.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\AzehwCb.exe
  C:\Windows\System\AzehwCb.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\LgImueF.exe
  C:\Windows\System\LgImueF.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\lVmScCp.exe
  C:\Windows\System\lVmScCp.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\bbpXqcI.exe
  C:\Windows\System\bbpXqcI.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\LRTzoes.exe
  C:\Windows\System\LRTzoes.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\bQywoxw.exe
  C:\Windows\System\bQywoxw.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\hfUHIub.exe
  C:\Windows\System\hfUHIub.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\xYHfrFt.exe
  C:\Windows\System\xYHfrFt.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\lYZWzPK.exe
  C:\Windows\System\lYZWzPK.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\yrZRDgi.exe
  C:\Windows\System\yrZRDgi.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\JwrIVpx.exe
  C:\Windows\System\JwrIVpx.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\LLtAreI.exe
  C:\Windows\System\LLtAreI.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\iDvJljt.exe
  C:\Windows\System\iDvJljt.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\nstlegh.exe
  C:\Windows\System\nstlegh.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\KSxtvtK.exe
  C:\Windows\System\KSxtvtK.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\ipOWVad.exe
  C:\Windows\System\ipOWVad.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\TNRlRCf.exe
  C:\Windows\System\TNRlRCf.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\gXeIxec.exe
  C:\Windows\System\gXeIxec.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\ujTzYLE.exe
  C:\Windows\System\ujTzYLE.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\XSXxOGx.exe
  C:\Windows\System\XSXxOGx.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\MMsNACf.exe
  C:\Windows\System\MMsNACf.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\FFFQTSR.exe
  C:\Windows\System\FFFQTSR.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\EyLGwMS.exe
  C:\Windows\System\EyLGwMS.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\DiAQffr.exe
  C:\Windows\System\DiAQffr.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\MxuEUgI.exe
  C:\Windows\System\MxuEUgI.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\AUUxEzz.exe
  C:\Windows\System\AUUxEzz.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\JjNfxJU.exe
  C:\Windows\System\JjNfxJU.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\YHbPGNw.exe
  C:\Windows\System\YHbPGNw.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\JXfAext.exe
  C:\Windows\System\JXfAext.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\irTaPKX.exe
  C:\Windows\System\irTaPKX.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\anEglkG.exe
  C:\Windows\System\anEglkG.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\IuNpuWk.exe
  C:\Windows\System\IuNpuWk.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\gEJsemD.exe
  C:\Windows\System\gEJsemD.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\MOvGbZb.exe
  C:\Windows\System\MOvGbZb.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\JrEdXGP.exe
  C:\Windows\System\JrEdXGP.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\UHmOcCa.exe
  C:\Windows\System\UHmOcCa.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\hvjGaKp.exe
  C:\Windows\System\hvjGaKp.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\jVdyazE.exe
  C:\Windows\System\jVdyazE.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\GSjBTqH.exe
  C:\Windows\System\GSjBTqH.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\LiizCTL.exe
  C:\Windows\System\LiizCTL.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\OsBcDbX.exe
  C:\Windows\System\OsBcDbX.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\wKRbCyQ.exe
  C:\Windows\System\wKRbCyQ.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\rInTiru.exe
  C:\Windows\System\rInTiru.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\JTcjfTK.exe
  C:\Windows\System\JTcjfTK.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\dLLflnW.exe
  C:\Windows\System\dLLflnW.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\zSjaomq.exe
  C:\Windows\System\zSjaomq.exe
  2⤵
  PID:4084
- C:\Windows\System\vSkbYGc.exe
  C:\Windows\System\vSkbYGc.exe
  2⤵
  PID:4836
- C:\Windows\System\cbvoIVs.exe
  C:\Windows\System\cbvoIVs.exe
  2⤵
  PID:4596
- C:\Windows\System\QZpVtpW.exe
  C:\Windows\System\QZpVtpW.exe
  2⤵
  PID:3728
- C:\Windows\System\UJXLNPm.exe
  C:\Windows\System\UJXLNPm.exe
  2⤵
  PID:3860
- C:\Windows\System\dyaYxPq.exe
  C:\Windows\System\dyaYxPq.exe
  2⤵
  PID:2588
- C:\Windows\System\XKCUknw.exe
  C:\Windows\System\XKCUknw.exe
  2⤵
  PID:1280
- C:\Windows\System\LjdtyjQ.exe
  C:\Windows\System\LjdtyjQ.exe
  2⤵
  PID:656
- C:\Windows\System\MJKNVSH.exe
  C:\Windows\System\MJKNVSH.exe
  2⤵
  PID:4892
- C:\Windows\System\EwTVDxA.exe
  C:\Windows\System\EwTVDxA.exe
  2⤵
  PID:4432
- C:\Windows\System\ixSzhhG.exe
  C:\Windows\System\ixSzhhG.exe
  2⤵
  PID:1400
- C:\Windows\System\mvbgJsx.exe
  C:\Windows\System\mvbgJsx.exe
  2⤵
  PID:3724
- C:\Windows\System\EApKTcw.exe
  C:\Windows\System\EApKTcw.exe
  2⤵
  PID:4276
- C:\Windows\System\kcWogHx.exe
  C:\Windows\System\kcWogHx.exe
  2⤵
  PID:4564
- C:\Windows\System\jdeSwMR.exe
  C:\Windows\System\jdeSwMR.exe
  2⤵
  PID:4480
- C:\Windows\System\dNGvlyU.exe
  C:\Windows\System\dNGvlyU.exe
  2⤵
  PID:2496
- C:\Windows\System\liIaEVp.exe
  C:\Windows\System\liIaEVp.exe
  2⤵
  PID:2140
- C:\Windows\System\KgEDjOk.exe
  C:\Windows\System\KgEDjOk.exe
  2⤵
  PID:3108
- C:\Windows\System\vitwprE.exe
  C:\Windows\System\vitwprE.exe
  2⤵
  PID:5212
- C:\Windows\System\qiqXjDd.exe
  C:\Windows\System\qiqXjDd.exe
  2⤵
  PID:5236
- C:\Windows\System\iBrxNTu.exe
  C:\Windows\System\iBrxNTu.exe
  2⤵
  PID:5268
- C:\Windows\System\vriZYzC.exe
  C:\Windows\System\vriZYzC.exe
  2⤵
  PID:5292
- C:\Windows\System\lcTEgYl.exe
  C:\Windows\System\lcTEgYl.exe
  2⤵
  PID:5332
- C:\Windows\System\znKmMLD.exe
  C:\Windows\System\znKmMLD.exe
  2⤵
  PID:5356
- C:\Windows\System\SKPAzXM.exe
  C:\Windows\System\SKPAzXM.exe
  2⤵
  PID:5392
- C:\Windows\System\SQxTaWF.exe
  C:\Windows\System\SQxTaWF.exe
  2⤵
  PID:5412
- C:\Windows\System\FItFkUa.exe
  C:\Windows\System\FItFkUa.exe
  2⤵
  PID:5448
- C:\Windows\System\BKxKMrx.exe
  C:\Windows\System\BKxKMrx.exe
  2⤵
  PID:5472
- C:\Windows\System\zDjsdTo.exe
  C:\Windows\System\zDjsdTo.exe
  2⤵
  PID:5508
- C:\Windows\System\wmWDTan.exe
  C:\Windows\System\wmWDTan.exe
  2⤵
  PID:5548
- C:\Windows\System\XOuGwXY.exe
  C:\Windows\System\XOuGwXY.exe
  2⤵
  PID:5576
- C:\Windows\System\rxZhlYm.exe
  C:\Windows\System\rxZhlYm.exe
  2⤵
  PID:5624
- C:\Windows\System\CUMVyLW.exe
  C:\Windows\System\CUMVyLW.exe
  2⤵
  PID:5652
- C:\Windows\System\ItrHrdX.exe
  C:\Windows\System\ItrHrdX.exe
  2⤵
  PID:5680
- C:\Windows\System\CnIPnSf.exe
  C:\Windows\System\CnIPnSf.exe
  2⤵
  PID:5732
- C:\Windows\System\tlFnWHu.exe
  C:\Windows\System\tlFnWHu.exe
  2⤵
  PID:5764
- C:\Windows\System\RkTGaRL.exe
  C:\Windows\System\RkTGaRL.exe
  2⤵
  PID:5792
- C:\Windows\System\jgBjQGI.exe
  C:\Windows\System\jgBjQGI.exe
  2⤵
  PID:5820
- C:\Windows\System\VUfUplS.exe
  C:\Windows\System\VUfUplS.exe
  2⤵
  PID:5872
- C:\Windows\System\EgVRnjg.exe
  C:\Windows\System\EgVRnjg.exe
  2⤵
  PID:5892
- C:\Windows\System\DLgefTh.exe
  C:\Windows\System\DLgefTh.exe
  2⤵
  PID:5932
- C:\Windows\System\CKYWMtI.exe
  C:\Windows\System\CKYWMtI.exe
  2⤵
  PID:5964
- C:\Windows\System\PVuHKXo.exe
  C:\Windows\System\PVuHKXo.exe
  2⤵
  PID:5988
- C:\Windows\System\LchGSaA.exe
  C:\Windows\System\LchGSaA.exe
  2⤵
  PID:6020
- C:\Windows\System\BuRkKeI.exe
  C:\Windows\System\BuRkKeI.exe
  2⤵
  PID:6072
- C:\Windows\System\AajksYC.exe
  C:\Windows\System\AajksYC.exe
  2⤵
  PID:6104
- C:\Windows\System\sRyerYz.exe
  C:\Windows\System\sRyerYz.exe
  2⤵
  PID:6136
- C:\Windows\System\EWHMtdj.exe
  C:\Windows\System\EWHMtdj.exe
  2⤵
  PID:2888
- C:\Windows\System\eIKnklM.exe
  C:\Windows\System\eIKnklM.exe
  2⤵
  PID:2692
- C:\Windows\System\hFGYnvM.exe
  C:\Windows\System\hFGYnvM.exe
  2⤵
  PID:5160
- C:\Windows\System\fGxtnXN.exe
  C:\Windows\System\fGxtnXN.exe
  2⤵
  PID:5228
- C:\Windows\System\JjcTGJt.exe
  C:\Windows\System\JjcTGJt.exe
  2⤵
  PID:5344
- C:\Windows\System\VnQhpGi.exe
  C:\Windows\System\VnQhpGi.exe
  2⤵
  PID:5376
- C:\Windows\System\DZWdwlz.exe
  C:\Windows\System\DZWdwlz.exe
  2⤵
  PID:5436
- C:\Windows\System\oDveOut.exe
  C:\Windows\System\oDveOut.exe
  2⤵
  PID:5464
- C:\Windows\System\ieZvrpA.exe
  C:\Windows\System\ieZvrpA.exe
  2⤵
  PID:5584
- C:\Windows\System\XWWoARu.exe
  C:\Windows\System\XWWoARu.exe
  2⤵
  PID:5568
- C:\Windows\System\JzqJdez.exe
  C:\Windows\System\JzqJdez.exe
  2⤵
  PID:5672
- C:\Windows\System\uOtYoTy.exe
  C:\Windows\System\uOtYoTy.exe
  2⤵
  PID:5728
- C:\Windows\System\nEFjXGw.exe
  C:\Windows\System\nEFjXGw.exe
  2⤵
  PID:5788
- C:\Windows\System\GQSIiUe.exe
  C:\Windows\System\GQSIiUe.exe
  2⤵
  PID:5924
- C:\Windows\System\cYrIjPy.exe
  C:\Windows\System\cYrIjPy.exe
  2⤵
  PID:5972
- C:\Windows\System\FKzClGV.exe
  C:\Windows\System\FKzClGV.exe
  2⤵
  PID:6000
- C:\Windows\System\ApejdIY.exe
  C:\Windows\System\ApejdIY.exe
  2⤵
  PID:6048
- C:\Windows\System\FOUvdXV.exe
  C:\Windows\System\FOUvdXV.exe
  2⤵
  PID:6120
- C:\Windows\System\NihzqNm.exe
  C:\Windows\System\NihzqNm.exe
  2⤵
  PID:5144
- C:\Windows\System\ciQSLwG.exe
  C:\Windows\System\ciQSLwG.exe
  2⤵
  PID:5320
- C:\Windows\System\CtgLXUR.exe
  C:\Windows\System\CtgLXUR.exe
  2⤵
  PID:5460
- C:\Windows\System\wCZFPkP.exe
  C:\Windows\System\wCZFPkP.exe
  2⤵
  PID:5612
- C:\Windows\System\hTDlWkN.exe
  C:\Windows\System\hTDlWkN.exe
  2⤵
  PID:5196
- C:\Windows\System\TKOvepe.exe
  C:\Windows\System\TKOvepe.exe
  2⤵
  PID:5704
- C:\Windows\System\IJCnvvi.exe
  C:\Windows\System\IJCnvvi.exe
  2⤵
  PID:5836
- C:\Windows\System\kaKvXXU.exe
  C:\Windows\System\kaKvXXU.exe
  2⤵
  PID:5956
- C:\Windows\System\oEyCamh.exe
  C:\Windows\System\oEyCamh.exe
  2⤵
  PID:6040
- C:\Windows\System\tbBqPaR.exe
  C:\Windows\System\tbBqPaR.exe
  2⤵
  PID:3668
- C:\Windows\System\DkCSuOh.exe
  C:\Windows\System\DkCSuOh.exe
  2⤵
  PID:5224
- C:\Windows\System\Kvhvemp.exe
  C:\Windows\System\Kvhvemp.exe
  2⤵
  PID:5520
- C:\Windows\System\pdJkxic.exe
  C:\Windows\System\pdJkxic.exe
  2⤵
  PID:5712
- C:\Windows\System\iQIDtBa.exe
  C:\Windows\System\iQIDtBa.exe
  2⤵
  PID:6128
- C:\Windows\System\TnYiTqk.exe
  C:\Windows\System\TnYiTqk.exe
  2⤵
  PID:6180
- C:\Windows\System\oIpwfpR.exe
  C:\Windows\System\oIpwfpR.exe
  2⤵
  PID:6208
- C:\Windows\System\CsKlCLq.exe
  C:\Windows\System\CsKlCLq.exe
  2⤵
  PID:6224
- C:\Windows\System\OzAOAap.exe
  C:\Windows\System\OzAOAap.exe
  2⤵
  PID:6296
- C:\Windows\System\rPznMje.exe
  C:\Windows\System\rPznMje.exe
  2⤵
  PID:6328
- C:\Windows\System\iBlHLAv.exe
  C:\Windows\System\iBlHLAv.exe
  2⤵
  PID:6356
- C:\Windows\System\wSfCXsa.exe
  C:\Windows\System\wSfCXsa.exe
  2⤵
  PID:6384
- C:\Windows\System\LTYDJYR.exe
  C:\Windows\System\LTYDJYR.exe
  2⤵
  PID:6408
- C:\Windows\System\JlYhPZa.exe
  C:\Windows\System\JlYhPZa.exe
  2⤵
  PID:6440
- C:\Windows\System\TVryMpG.exe
  C:\Windows\System\TVryMpG.exe
  2⤵
  PID:6464
- C:\Windows\System\kxhqYDY.exe
  C:\Windows\System\kxhqYDY.exe
  2⤵
  PID:6484
- C:\Windows\System\vAyCmUX.exe
  C:\Windows\System\vAyCmUX.exe
  2⤵
  PID:6500
- C:\Windows\System\XFGEnZo.exe
  C:\Windows\System\XFGEnZo.exe
  2⤵
  PID:6524
- C:\Windows\System\DesDynG.exe
  C:\Windows\System\DesDynG.exe
  2⤵
  PID:6568
- C:\Windows\System\vuObrOE.exe
  C:\Windows\System\vuObrOE.exe
  2⤵
  PID:6588
- C:\Windows\System\THIpGnq.exe
  C:\Windows\System\THIpGnq.exe
  2⤵
  PID:6644
- C:\Windows\System\pPOGkRS.exe
  C:\Windows\System\pPOGkRS.exe
  2⤵
  PID:6664
- C:\Windows\System\lJfIABB.exe
  C:\Windows\System\lJfIABB.exe
  2⤵
  PID:6692
- C:\Windows\System\TWzZiqN.exe
  C:\Windows\System\TWzZiqN.exe
  2⤵
  PID:6708
- C:\Windows\System\vcAfYDF.exe
  C:\Windows\System\vcAfYDF.exe
  2⤵
  PID:6748
- C:\Windows\System\vKfnkPP.exe
  C:\Windows\System\vKfnkPP.exe
  2⤵
  PID:6776
- C:\Windows\System\PVCIzmn.exe
  C:\Windows\System\PVCIzmn.exe
  2⤵
  PID:6804
- C:\Windows\System\ECEaNMu.exe
  C:\Windows\System\ECEaNMu.exe
  2⤵
  PID:6836
- C:\Windows\System\nQEuCTJ.exe
  C:\Windows\System\nQEuCTJ.exe
  2⤵
  PID:6852
- C:\Windows\System\hbtouyS.exe
  C:\Windows\System\hbtouyS.exe
  2⤵
  PID:6892
- C:\Windows\System\RjILtLn.exe
  C:\Windows\System\RjILtLn.exe
  2⤵
  PID:6908
- C:\Windows\System\wGgjnXf.exe
  C:\Windows\System\wGgjnXf.exe
  2⤵
  PID:6928
- C:\Windows\System\uPfNolt.exe
  C:\Windows\System\uPfNolt.exe
  2⤵
  PID:6972
- C:\Windows\System\mPNjxPm.exe
  C:\Windows\System\mPNjxPm.exe
  2⤵
  PID:7004
- C:\Windows\System\wXwffDV.exe
  C:\Windows\System\wXwffDV.exe
  2⤵
  PID:7020
- C:\Windows\System\fJyvQfi.exe
  C:\Windows\System\fJyvQfi.exe
  2⤵
  PID:7060
- C:\Windows\System\TBOQFiL.exe
  C:\Windows\System\TBOQFiL.exe
  2⤵
  PID:7088
- C:\Windows\System\Qslfrya.exe
  C:\Windows\System\Qslfrya.exe
  2⤵
  PID:7116
- C:\Windows\System\RWZBETM.exe
  C:\Windows\System\RWZBETM.exe
  2⤵
  PID:7144
- C:\Windows\System\OLUgwCr.exe
  C:\Windows\System\OLUgwCr.exe
  2⤵
  PID:7160
- C:\Windows\System\sNQSUgT.exe
  C:\Windows\System\sNQSUgT.exe
  2⤵
  PID:6168
- C:\Windows\System\qgwwonp.exe
  C:\Windows\System\qgwwonp.exe
  2⤵
  PID:6248
- C:\Windows\System\ULjEjJK.exe
  C:\Windows\System\ULjEjJK.exe
  2⤵
  PID:6284
- C:\Windows\System\oAJLnTK.exe
  C:\Windows\System\oAJLnTK.exe
  2⤵
  PID:6348
- C:\Windows\System\LNJklNK.exe
  C:\Windows\System\LNJklNK.exe
  2⤵
  PID:6496
- C:\Windows\System\RpSxUSY.exe
  C:\Windows\System\RpSxUSY.exe
  2⤵
  PID:6576
- C:\Windows\System\nLvpQCd.exe
  C:\Windows\System\nLvpQCd.exe
  2⤵
  PID:6600
- C:\Windows\System\HnTMbnZ.exe
  C:\Windows\System\HnTMbnZ.exe
  2⤵
  PID:5952
- C:\Windows\System\qNMitQp.exe
  C:\Windows\System\qNMitQp.exe
  2⤵
  PID:6688
- C:\Windows\System\MOihdUw.exe
  C:\Windows\System\MOihdUw.exe
  2⤵
  PID:6740
- C:\Windows\System\ypKtJKI.exe
  C:\Windows\System\ypKtJKI.exe
  2⤵
  PID:6848
- C:\Windows\System\xiPQOjs.exe
  C:\Windows\System\xiPQOjs.exe
  2⤵
  PID:6900
- C:\Windows\System\lDnrgni.exe
  C:\Windows\System\lDnrgni.exe
  2⤵
  PID:6992
- C:\Windows\System\xaNgMKo.exe
  C:\Windows\System\xaNgMKo.exe
  2⤵
  PID:7076
- C:\Windows\System\cYhTMvw.exe
  C:\Windows\System\cYhTMvw.exe
  2⤵
  PID:7128
- C:\Windows\System\hVpYrpE.exe
  C:\Windows\System\hVpYrpE.exe
  2⤵
  PID:6200
- C:\Windows\System\WMLtKYB.exe
  C:\Windows\System\WMLtKYB.exe
  2⤵
  PID:6380
- C:\Windows\System\wXMYqNJ.exe
  C:\Windows\System\wXMYqNJ.exe
  2⤵
  PID:6632
- C:\Windows\System\lXynUlp.exe
  C:\Windows\System\lXynUlp.exe
  2⤵
  PID:6828
- C:\Windows\System\KiwNZoz.exe
  C:\Windows\System\KiwNZoz.exe
  2⤵
  PID:6984
- C:\Windows\System\aogIBnX.exe
  C:\Windows\System\aogIBnX.exe
  2⤵
  PID:1688
- C:\Windows\System\emtwwEd.exe
  C:\Windows\System\emtwwEd.exe
  2⤵
  PID:6704
- C:\Windows\System\XsHyUvT.exe
  C:\Windows\System\XsHyUvT.exe
  2⤵
  PID:6320
- C:\Windows\System\SfSzpFP.exe
  C:\Windows\System\SfSzpFP.exe
  2⤵
  PID:7184
- C:\Windows\System\iJjxlMF.exe
  C:\Windows\System\iJjxlMF.exe
  2⤵
  PID:7232
- C:\Windows\System\cduhAvl.exe
  C:\Windows\System\cduhAvl.exe
  2⤵
  PID:7260
- C:\Windows\System\VWnkVRW.exe
  C:\Windows\System\VWnkVRW.exe
  2⤵
  PID:7288
- C:\Windows\System\yXwqctS.exe
  C:\Windows\System\yXwqctS.exe
  2⤵
  PID:7308
- C:\Windows\System\FoGhYoq.exe
  C:\Windows\System\FoGhYoq.exe
  2⤵
  PID:7352
- C:\Windows\System\mRMyxca.exe
  C:\Windows\System\mRMyxca.exe
  2⤵
  PID:7396
- C:\Windows\System\IHSvbJw.exe
  C:\Windows\System\IHSvbJw.exe
  2⤵
  PID:7424
- C:\Windows\System\IvDbVhu.exe
  C:\Windows\System\IvDbVhu.exe
  2⤵
  PID:7468
- C:\Windows\System\wjuBDir.exe
  C:\Windows\System\wjuBDir.exe
  2⤵
  PID:7504
- C:\Windows\System\PIdaPLm.exe
  C:\Windows\System\PIdaPLm.exe
  2⤵
  PID:7532
- C:\Windows\System\osBGxvl.exe
  C:\Windows\System\osBGxvl.exe
  2⤵
  PID:7564
- C:\Windows\System\pSBxeXs.exe
  C:\Windows\System\pSBxeXs.exe
  2⤵
  PID:7588
- C:\Windows\System\EfPZjrY.exe
  C:\Windows\System\EfPZjrY.exe
  2⤵
  PID:7612
- C:\Windows\System\hdsZqgC.exe
  C:\Windows\System\hdsZqgC.exe
  2⤵
  PID:7652
- C:\Windows\System\tVNCLNH.exe
  C:\Windows\System\tVNCLNH.exe
  2⤵
  PID:7684
- C:\Windows\System\IYMuKQI.exe
  C:\Windows\System\IYMuKQI.exe
  2⤵
  PID:7712
- C:\Windows\System\iKmQPmB.exe
  C:\Windows\System\iKmQPmB.exe
  2⤵
  PID:7752
- C:\Windows\System\eBrhATt.exe
  C:\Windows\System\eBrhATt.exe
  2⤵
  PID:7780
- C:\Windows\System\PBDCXlp.exe
  C:\Windows\System\PBDCXlp.exe
  2⤵
  PID:7796
- C:\Windows\System\ZSqSoWT.exe
  C:\Windows\System\ZSqSoWT.exe
  2⤵
  PID:7840
- C:\Windows\System\vQGnHCC.exe
  C:\Windows\System\vQGnHCC.exe
  2⤵
  PID:7868
- C:\Windows\System\ofKjvYA.exe
  C:\Windows\System\ofKjvYA.exe
  2⤵
  PID:7884
- C:\Windows\System\DzPlAPT.exe
  C:\Windows\System\DzPlAPT.exe
  2⤵
  PID:7900
- C:\Windows\System\srfvNAj.exe
  C:\Windows\System\srfvNAj.exe
  2⤵
  PID:7936
- C:\Windows\System\qUKgwaN.exe
  C:\Windows\System\qUKgwaN.exe
  2⤵
  PID:7968
- C:\Windows\System\dxlwEWP.exe
  C:\Windows\System\dxlwEWP.exe
  2⤵
  PID:8000
- C:\Windows\System\rWpCUBn.exe
  C:\Windows\System\rWpCUBn.exe
  2⤵
  PID:8044
- C:\Windows\System\cqIOJez.exe
  C:\Windows\System\cqIOJez.exe
  2⤵
  PID:8076
- C:\Windows\System\pwFCsRL.exe
  C:\Windows\System\pwFCsRL.exe
  2⤵
  PID:8120
- C:\Windows\System\hJkopJN.exe
  C:\Windows\System\hJkopJN.exe
  2⤵
  PID:8136
- C:\Windows\System\ePtZUaI.exe
  C:\Windows\System\ePtZUaI.exe
  2⤵
  PID:8168
- C:\Windows\System\tAechuf.exe
  C:\Windows\System\tAechuf.exe
  2⤵
  PID:7244
- C:\Windows\System\dUmkeEP.exe
  C:\Windows\System\dUmkeEP.exe
  2⤵
  PID:7300
- C:\Windows\System\oXBOCkK.exe
  C:\Windows\System\oXBOCkK.exe
  2⤵
  PID:7324
- C:\Windows\System\ULCeQcH.exe
  C:\Windows\System\ULCeQcH.exe
  2⤵
  PID:7444
- C:\Windows\System\xqJBSiR.exe
  C:\Windows\System\xqJBSiR.exe
  2⤵
  PID:7524
- C:\Windows\System\xZarRTv.exe
  C:\Windows\System\xZarRTv.exe
  2⤵
  PID:7580
- C:\Windows\System\mezbdIa.exe
  C:\Windows\System\mezbdIa.exe
  2⤵
  PID:7672
- C:\Windows\System\MeRyFwi.exe
  C:\Windows\System\MeRyFwi.exe
  2⤵
  PID:7744
- C:\Windows\System\gHnRBjP.exe
  C:\Windows\System\gHnRBjP.exe
  2⤵
  PID:7788
- C:\Windows\System\KWJmsnS.exe
  C:\Windows\System\KWJmsnS.exe
  2⤵
  PID:7876
- C:\Windows\System\TCEAUsU.exe
  C:\Windows\System\TCEAUsU.exe
  2⤵
  PID:7892
- C:\Windows\System\ldxXFgO.exe
  C:\Windows\System\ldxXFgO.exe
  2⤵
  PID:8028
- C:\Windows\System\pZJbsQM.exe
  C:\Windows\System\pZJbsQM.exe
  2⤵
  PID:8096
- C:\Windows\System\DTIJOwS.exe
  C:\Windows\System\DTIJOwS.exe
  2⤵
  PID:8164
- C:\Windows\System\NjlaUYk.exe
  C:\Windows\System\NjlaUYk.exe
  2⤵
  PID:7220
- C:\Windows\System\SKRcNOk.exe
  C:\Windows\System\SKRcNOk.exe
  2⤵
  PID:7316
- C:\Windows\System\tnXYxeD.exe
  C:\Windows\System\tnXYxeD.exe
  2⤵
  PID:7644
- C:\Windows\System\YvkcyiG.exe
  C:\Windows\System\YvkcyiG.exe
  2⤵
  PID:7832
- C:\Windows\System\UJHwYFG.exe
  C:\Windows\System\UJHwYFG.exe
  2⤵
  PID:7912
- C:\Windows\System\jlduMer.exe
  C:\Windows\System\jlduMer.exe
  2⤵
  PID:8068
- C:\Windows\System\ZFnJOCl.exe
  C:\Windows\System\ZFnJOCl.exe
  2⤵
  PID:7416
- C:\Windows\System\gpsOqwy.exe
  C:\Windows\System\gpsOqwy.exe
  2⤵
  PID:7704
- C:\Windows\System\vmqNDhI.exe
  C:\Windows\System\vmqNDhI.exe
  2⤵
  PID:7916
- C:\Windows\System\SDLBoyp.exe
  C:\Windows\System\SDLBoyp.exe
  2⤵
  PID:7856
- C:\Windows\System\HMEkIJb.exe
  C:\Windows\System\HMEkIJb.exe
  2⤵
  PID:8220
- C:\Windows\System\Wuxgops.exe
  C:\Windows\System\Wuxgops.exe
  2⤵
  PID:8244
- C:\Windows\System\SHUHfql.exe
  C:\Windows\System\SHUHfql.exe
  2⤵
  PID:8272
- C:\Windows\System\MWSlEEQ.exe
  C:\Windows\System\MWSlEEQ.exe
  2⤵
  PID:8300
- C:\Windows\System\qqOXZDH.exe
  C:\Windows\System\qqOXZDH.exe
  2⤵
  PID:8340
- C:\Windows\System\yjFbfUb.exe
  C:\Windows\System\yjFbfUb.exe
  2⤵
  PID:8368
- C:\Windows\System\ylXCUKI.exe
  C:\Windows\System\ylXCUKI.exe
  2⤵
  PID:8396
- C:\Windows\System\mbowKBt.exe
  C:\Windows\System\mbowKBt.exe
  2⤵
  PID:8424
- C:\Windows\System\ZlGUwhp.exe
  C:\Windows\System\ZlGUwhp.exe
  2⤵
  PID:8456
- C:\Windows\System\UlDcjcR.exe
  C:\Windows\System\UlDcjcR.exe
  2⤵
  PID:8472
- C:\Windows\System\scnHYGG.exe
  C:\Windows\System\scnHYGG.exe
  2⤵
  PID:8500
- C:\Windows\System\isoJIRN.exe
  C:\Windows\System\isoJIRN.exe
  2⤵
  PID:8520
- C:\Windows\System\eCvTVOS.exe
  C:\Windows\System\eCvTVOS.exe
  2⤵
  PID:8556
- C:\Windows\System\TNUOJPV.exe
  C:\Windows\System\TNUOJPV.exe
  2⤵
  PID:8580
- C:\Windows\System\zKeqDOM.exe
  C:\Windows\System\zKeqDOM.exe
  2⤵
  PID:8612
- C:\Windows\System\ujFZFEm.exe
  C:\Windows\System\ujFZFEm.exe
  2⤵
  PID:8628
- C:\Windows\System\HdqpAsG.exe
  C:\Windows\System\HdqpAsG.exe
  2⤵
  PID:8692
- C:\Windows\System\vuznJTC.exe
  C:\Windows\System\vuznJTC.exe
  2⤵
  PID:8720
- C:\Windows\System\kuPKLVg.exe
  C:\Windows\System\kuPKLVg.exe
  2⤵
  PID:8748
- C:\Windows\System\jXVRvTM.exe
  C:\Windows\System\jXVRvTM.exe
  2⤵
  PID:8764
- C:\Windows\System\yLzCYOu.exe
  C:\Windows\System\yLzCYOu.exe
  2⤵
  PID:8804
- C:\Windows\System\WBBZKQp.exe
  C:\Windows\System\WBBZKQp.exe
  2⤵
  PID:8832
- C:\Windows\System\KhWBQxK.exe
  C:\Windows\System\KhWBQxK.exe
  2⤵
  PID:8860
- C:\Windows\System\WTnATdX.exe
  C:\Windows\System\WTnATdX.exe
  2⤵
  PID:8888
- C:\Windows\System\OnhGoIw.exe
  C:\Windows\System\OnhGoIw.exe
  2⤵
  PID:8920
- C:\Windows\System\YTAeLMM.exe
  C:\Windows\System\YTAeLMM.exe
  2⤵
  PID:8944
- C:\Windows\System\EyobaDo.exe
  C:\Windows\System\EyobaDo.exe
  2⤵
  PID:8972
- C:\Windows\System\mWglwLU.exe
  C:\Windows\System\mWglwLU.exe
  2⤵
  PID:9000
- C:\Windows\System\DIHjvsJ.exe
  C:\Windows\System\DIHjvsJ.exe
  2⤵
  PID:9016
- C:\Windows\System\izogRJG.exe
  C:\Windows\System\izogRJG.exe
  2⤵
  PID:9056
- C:\Windows\System\xbkEuLy.exe
  C:\Windows\System\xbkEuLy.exe
  2⤵
  PID:9084
- C:\Windows\System\wzLQpoH.exe
  C:\Windows\System\wzLQpoH.exe
  2⤵
  PID:9112
- C:\Windows\System\KDYlsUi.exe
  C:\Windows\System\KDYlsUi.exe
  2⤵
  PID:9140
- C:\Windows\System\izXRJtY.exe
  C:\Windows\System\izXRJtY.exe
  2⤵
  PID:9168
- C:\Windows\System\OdrkKdi.exe
  C:\Windows\System\OdrkKdi.exe
  2⤵
  PID:9196
- C:\Windows\System\FZlEZQw.exe
  C:\Windows\System\FZlEZQw.exe
  2⤵
  PID:8204
- C:\Windows\System\zKgdCen.exe
  C:\Windows\System\zKgdCen.exe
  2⤵
  PID:8256
- C:\Windows\System\KFkAYFY.exe
  C:\Windows\System\KFkAYFY.exe
  2⤵
  PID:8292
- C:\Windows\System\BftgHCB.exe
  C:\Windows\System\BftgHCB.exe
  2⤵
  PID:8364
- C:\Windows\System\ntmaZkP.exe
  C:\Windows\System\ntmaZkP.exe
  2⤵
  PID:8444
- C:\Windows\System\HODhYic.exe
  C:\Windows\System\HODhYic.exe
  2⤵
  PID:8540
- C:\Windows\System\DQgDoEC.exe
  C:\Windows\System\DQgDoEC.exe
  2⤵
  PID:8576
- C:\Windows\System\KpKHhnt.exe
  C:\Windows\System\KpKHhnt.exe
  2⤵
  PID:8620
- C:\Windows\System\BzmFZPW.exe
  C:\Windows\System\BzmFZPW.exe
  2⤵
  PID:8688
- C:\Windows\System\boRkNzX.exe
  C:\Windows\System\boRkNzX.exe
  2⤵
  PID:8756
- C:\Windows\System\sjbtKfx.exe
  C:\Windows\System\sjbtKfx.exe
  2⤵
  PID:8824
- C:\Windows\System\qaeXvLv.exe
  C:\Windows\System\qaeXvLv.exe
  2⤵
  PID:8884
- C:\Windows\System\HiOMrZv.exe
  C:\Windows\System\HiOMrZv.exe
  2⤵
  PID:8956
- C:\Windows\System\kLCFuVP.exe
  C:\Windows\System\kLCFuVP.exe
  2⤵
  PID:9012
- C:\Windows\System\OLZDBjt.exe
  C:\Windows\System\OLZDBjt.exe
  2⤵
  PID:9080
- C:\Windows\System\LVwRVsh.exe
  C:\Windows\System\LVwRVsh.exe
  2⤵
  PID:9152
- C:\Windows\System\TrFqCNf.exe
  C:\Windows\System\TrFqCNf.exe
  2⤵
  PID:7336
- C:\Windows\System\yvKaqxB.exe
  C:\Windows\System\yvKaqxB.exe
  2⤵
  PID:7648
- C:\Windows\System\Ffbwkpd.exe
  C:\Windows\System\Ffbwkpd.exe
  2⤵
  PID:8468
- C:\Windows\System\bdXkRrE.exe
  C:\Windows\System\bdXkRrE.exe
  2⤵
  PID:8592
- C:\Windows\System\lejFMtt.exe
  C:\Windows\System\lejFMtt.exe
  2⤵
  PID:8744
- C:\Windows\System\OVisWil.exe
  C:\Windows\System\OVisWil.exe
  2⤵
  PID:8912
- C:\Windows\System\cYQGeFz.exe
  C:\Windows\System\cYQGeFz.exe
  2⤵
  PID:9068
- C:\Windows\System\ABxCpJT.exe
  C:\Windows\System\ABxCpJT.exe
  2⤵
  PID:9208
- C:\Windows\System\qYSXfDD.exe
  C:\Windows\System\qYSXfDD.exe
  2⤵
  PID:8420
- C:\Windows\System\JtMdEAQ.exe
  C:\Windows\System\JtMdEAQ.exe
  2⤵
  PID:8992
- C:\Windows\System\YkZAlkt.exe
  C:\Windows\System\YkZAlkt.exe
  2⤵
  PID:8348
- C:\Windows\System\vSVOxuc.exe
  C:\Windows\System\vSVOxuc.exe
  2⤵
  PID:9240
- C:\Windows\System\PjKhmQZ.exe
  C:\Windows\System\PjKhmQZ.exe
  2⤵
  PID:9268
- C:\Windows\System\uhVcIHy.exe
  C:\Windows\System\uhVcIHy.exe
  2⤵
  PID:9296
- C:\Windows\System\bPGGufp.exe
  C:\Windows\System\bPGGufp.exe
  2⤵
  PID:9324
- C:\Windows\System\TrFgOWD.exe
  C:\Windows\System\TrFgOWD.exe
  2⤵
  PID:9352
- C:\Windows\System\xhsLFMf.exe
  C:\Windows\System\xhsLFMf.exe
  2⤵
  PID:9380
- C:\Windows\System\pHtivNq.exe
  C:\Windows\System\pHtivNq.exe
  2⤵
  PID:9408
- C:\Windows\System\pHcoxkJ.exe
  C:\Windows\System\pHcoxkJ.exe
  2⤵
  PID:9436
- C:\Windows\System\joUwIts.exe
  C:\Windows\System\joUwIts.exe
  2⤵
  PID:9464
- C:\Windows\System\BkpnxPi.exe
  C:\Windows\System\BkpnxPi.exe
  2⤵
  PID:9492
- C:\Windows\System\qeQViKY.exe
  C:\Windows\System\qeQViKY.exe
  2⤵
  PID:9520
- C:\Windows\System\NFbjsIW.exe
  C:\Windows\System\NFbjsIW.exe
  2⤵
  PID:9548
- C:\Windows\System\kRovdBL.exe
  C:\Windows\System\kRovdBL.exe
  2⤵
  PID:9576
- C:\Windows\System\hlcqPCk.exe
  C:\Windows\System\hlcqPCk.exe
  2⤵
  PID:9604
- C:\Windows\System\VzoNrPF.exe
  C:\Windows\System\VzoNrPF.exe
  2⤵
  PID:9632
- C:\Windows\System\WAwxPZS.exe
  C:\Windows\System\WAwxPZS.exe
  2⤵
  PID:9660
- C:\Windows\System\uivmYmu.exe
  C:\Windows\System\uivmYmu.exe
  2⤵
  PID:9688
- C:\Windows\System\RMssMai.exe
  C:\Windows\System\RMssMai.exe
  2⤵
  PID:9716
- C:\Windows\System\DiHIqNu.exe
  C:\Windows\System\DiHIqNu.exe
  2⤵
  PID:9744
- C:\Windows\System\klmCrlq.exe
  C:\Windows\System\klmCrlq.exe
  2⤵
  PID:9772
- C:\Windows\System\sqOZZPY.exe
  C:\Windows\System\sqOZZPY.exe
  2⤵
  PID:9800
- C:\Windows\System\csiEAgn.exe
  C:\Windows\System\csiEAgn.exe
  2⤵
  PID:9828
- C:\Windows\System\XxxuDEV.exe
  C:\Windows\System\XxxuDEV.exe
  2⤵
  PID:9856
- C:\Windows\System\OzBmbJh.exe
  C:\Windows\System\OzBmbJh.exe
  2⤵
  PID:9884
- C:\Windows\System\BHjleSX.exe
  C:\Windows\System\BHjleSX.exe
  2⤵
  PID:9912
- C:\Windows\System\CdCwljR.exe
  C:\Windows\System\CdCwljR.exe
  2⤵
  PID:9940
- C:\Windows\System\JBZbBAB.exe
  C:\Windows\System\JBZbBAB.exe
  2⤵
  PID:9968
- C:\Windows\System\OcxYXYD.exe
  C:\Windows\System\OcxYXYD.exe
  2⤵
  PID:9996
- C:\Windows\System\WEfsiLr.exe
  C:\Windows\System\WEfsiLr.exe
  2⤵
  PID:10024
- C:\Windows\System\FzFZYvo.exe
  C:\Windows\System\FzFZYvo.exe
  2⤵
  PID:10052
- C:\Windows\System\lKcugay.exe
  C:\Windows\System\lKcugay.exe
  2⤵
  PID:10080
- C:\Windows\System\FWoiFGc.exe
  C:\Windows\System\FWoiFGc.exe
  2⤵
  PID:10108
- C:\Windows\System\QOZxgYF.exe
  C:\Windows\System\QOZxgYF.exe
  2⤵
  PID:10136
- C:\Windows\System\eXoVQMu.exe
  C:\Windows\System\eXoVQMu.exe
  2⤵
  PID:10164
- C:\Windows\System\qiZcOEG.exe
  C:\Windows\System\qiZcOEG.exe
  2⤵
  PID:10192
- C:\Windows\System\lRjBdip.exe
  C:\Windows\System\lRjBdip.exe
  2⤵
  PID:10220
- C:\Windows\System\fxiGtOf.exe
  C:\Windows\System\fxiGtOf.exe
  2⤵
  PID:9236
- C:\Windows\System\IHFmRcR.exe
  C:\Windows\System\IHFmRcR.exe
  2⤵
  PID:9312
- C:\Windows\System\ncFGUKt.exe
  C:\Windows\System\ncFGUKt.exe
  2⤵
  PID:9376
- C:\Windows\System\GQWReNM.exe
  C:\Windows\System\GQWReNM.exe
  2⤵
  PID:9432
- C:\Windows\System\IbpHZct.exe
  C:\Windows\System\IbpHZct.exe
  2⤵
  PID:9504
- C:\Windows\System\AokMPOF.exe
  C:\Windows\System\AokMPOF.exe
  2⤵
  PID:9568
- C:\Windows\System\aqyOCIJ.exe
  C:\Windows\System\aqyOCIJ.exe
  2⤵
  PID:9628
- C:\Windows\System\WosOlRO.exe
  C:\Windows\System\WosOlRO.exe
  2⤵
  PID:9700
- C:\Windows\System\wUIaRmD.exe
  C:\Windows\System\wUIaRmD.exe
  2⤵
  PID:9764
- C:\Windows\System\ZlZZtzN.exe
  C:\Windows\System\ZlZZtzN.exe
  2⤵
  PID:9824
- C:\Windows\System\RfaSSXw.exe
  C:\Windows\System\RfaSSXw.exe
  2⤵
  PID:9896
- C:\Windows\System\FSVVqTN.exe
  C:\Windows\System\FSVVqTN.exe
  2⤵
  PID:9960
- C:\Windows\System\XCZHsjI.exe
  C:\Windows\System\XCZHsjI.exe
  2⤵
  PID:10020
- C:\Windows\System\xQzZgYz.exe
  C:\Windows\System\xQzZgYz.exe
  2⤵
  PID:10096
- C:\Windows\System\xGzhqsE.exe
  C:\Windows\System\xGzhqsE.exe
  2⤵
  PID:10180
- C:\Windows\System\wbggpEJ.exe
  C:\Windows\System\wbggpEJ.exe
  2⤵
  PID:9220
- C:\Windows\System\rtmxYzt.exe
  C:\Windows\System\rtmxYzt.exe
  2⤵
  PID:9364
- C:\Windows\System\zpsdbWF.exe
  C:\Windows\System\zpsdbWF.exe
  2⤵
  PID:9224
- C:\Windows\System\OWnKecz.exe
  C:\Windows\System\OWnKecz.exe
  2⤵
  PID:9684
- C:\Windows\System\EcDVwVa.exe
  C:\Windows\System\EcDVwVa.exe
  2⤵
  PID:9812
- C:\Windows\System\rVXqgDq.exe
  C:\Windows\System\rVXqgDq.exe
  2⤵
  PID:9988
- C:\Windows\System\LYDRBjV.exe
  C:\Windows\System\LYDRBjV.exe
  2⤵
  PID:10072
- C:\Windows\System\weflvOQ.exe
  C:\Windows\System\weflvOQ.exe
  2⤵
  PID:10212
- C:\Windows\System\acmIKdQ.exe
  C:\Windows\System\acmIKdQ.exe
  2⤵
  PID:9428
- C:\Windows\System\segREFb.exe
  C:\Windows\System\segREFb.exe
  2⤵
  PID:9936
- C:\Windows\System\DqBJpZE.exe
  C:\Windows\System\DqBJpZE.exe
  2⤵
  PID:9344
- C:\Windows\System\QzKfbFq.exe
  C:\Windows\System\QzKfbFq.exe
  2⤵
  PID:10204
- C:\Windows\System\qVqjRHC.exe
  C:\Windows\System\qVqjRHC.exe
  2⤵
  PID:10260
- C:\Windows\System\VEXbzjd.exe
  C:\Windows\System\VEXbzjd.exe
  2⤵
  PID:10288
- C:\Windows\System\MYqwuiL.exe
  C:\Windows\System\MYqwuiL.exe
  2⤵
  PID:10316
- C:\Windows\System\rmMdJvS.exe
  C:\Windows\System\rmMdJvS.exe
  2⤵
  PID:10344
- C:\Windows\System\qydhwOq.exe
  C:\Windows\System\qydhwOq.exe
  2⤵
  PID:10372
- C:\Windows\System\gsDDKRT.exe
  C:\Windows\System\gsDDKRT.exe
  2⤵
  PID:10400
- C:\Windows\System\njlpsdT.exe
  C:\Windows\System\njlpsdT.exe
  2⤵
  PID:10428
- C:\Windows\System\wVkMaSc.exe
  C:\Windows\System\wVkMaSc.exe
  2⤵
  PID:10456
- C:\Windows\System\XcrDSkO.exe
  C:\Windows\System\XcrDSkO.exe
  2⤵
  PID:10484
- C:\Windows\System\GPjWEOM.exe
  C:\Windows\System\GPjWEOM.exe
  2⤵
  PID:10512
- C:\Windows\System\XRDZOsp.exe
  C:\Windows\System\XRDZOsp.exe
  2⤵
  PID:10540
- C:\Windows\System\cuBGMQH.exe
  C:\Windows\System\cuBGMQH.exe
  2⤵
  PID:10568
- C:\Windows\System\fMQOleA.exe
  C:\Windows\System\fMQOleA.exe
  2⤵
  PID:10596
- C:\Windows\System\jCuxsAC.exe
  C:\Windows\System\jCuxsAC.exe
  2⤵
  PID:10624
- C:\Windows\System\BRGMdkn.exe
  C:\Windows\System\BRGMdkn.exe
  2⤵
  PID:10652
- C:\Windows\System\tAtKjDX.exe
  C:\Windows\System\tAtKjDX.exe
  2⤵
  PID:10680
- C:\Windows\System\PnHKrmC.exe
  C:\Windows\System\PnHKrmC.exe
  2⤵
  PID:10708
- C:\Windows\System\KqzWVmC.exe
  C:\Windows\System\KqzWVmC.exe
  2⤵
  PID:10736
- C:\Windows\System\PuXuyzh.exe
  C:\Windows\System\PuXuyzh.exe
  2⤵
  PID:10764
- C:\Windows\System\WugiEmf.exe
  C:\Windows\System\WugiEmf.exe
  2⤵
  PID:10792
- C:\Windows\System\SmAFVly.exe
  C:\Windows\System\SmAFVly.exe
  2⤵
  PID:10820
- C:\Windows\System\zmKVxQr.exe
  C:\Windows\System\zmKVxQr.exe
  2⤵
  PID:10848
- C:\Windows\System\HdvcpiP.exe
  C:\Windows\System\HdvcpiP.exe
  2⤵
  PID:10876
- C:\Windows\System\vstLoxn.exe
  C:\Windows\System\vstLoxn.exe
  2⤵
  PID:10904
- C:\Windows\System\PKBamxD.exe
  C:\Windows\System\PKBamxD.exe
  2⤵
  PID:10932
- C:\Windows\System\lFfAwtN.exe
  C:\Windows\System\lFfAwtN.exe
  2⤵
  PID:10960
- C:\Windows\System\zBxGpZe.exe
  C:\Windows\System\zBxGpZe.exe
  2⤵
  PID:10988
- C:\Windows\System\OeTjmVL.exe
  C:\Windows\System\OeTjmVL.exe
  2⤵
  PID:11016
- C:\Windows\System\CMEWjtj.exe
  C:\Windows\System\CMEWjtj.exe
  2⤵
  PID:11036
- C:\Windows\System\nwmeoeH.exe
  C:\Windows\System\nwmeoeH.exe
  2⤵
  PID:11072
- C:\Windows\System\TnkoYPJ.exe
  C:\Windows\System\TnkoYPJ.exe
  2⤵
  PID:11100
- C:\Windows\System\aGGveLp.exe
  C:\Windows\System\aGGveLp.exe
  2⤵
  PID:11128
- C:\Windows\System\knYeaTg.exe
  C:\Windows\System\knYeaTg.exe
  2⤵
  PID:11156
- C:\Windows\System\ZQoCeWh.exe
  C:\Windows\System\ZQoCeWh.exe
  2⤵
  PID:11184
- C:\Windows\System\ndSNJHD.exe
  C:\Windows\System\ndSNJHD.exe
  2⤵
  PID:11212
- C:\Windows\System\QMImAGq.exe
  C:\Windows\System\QMImAGq.exe
  2⤵
  PID:11240
- C:\Windows\System\UKOaEIS.exe
  C:\Windows\System\UKOaEIS.exe
  2⤵
  PID:10252
- C:\Windows\System\wnaeaWr.exe
  C:\Windows\System\wnaeaWr.exe
  2⤵
  PID:10312
- C:\Windows\System\FtLIQOv.exe
  C:\Windows\System\FtLIQOv.exe
  2⤵
  PID:10384
- C:\Windows\System\GmipEZS.exe
  C:\Windows\System\GmipEZS.exe
  2⤵
  PID:10448
- C:\Windows\System\PQKvNEK.exe
  C:\Windows\System\PQKvNEK.exe
  2⤵
  PID:10508
- C:\Windows\System\ojDbOvG.exe
  C:\Windows\System\ojDbOvG.exe
  2⤵
  PID:10584
- C:\Windows\System\IwbpvTG.exe
  C:\Windows\System\IwbpvTG.exe
  2⤵
  PID:10644
- C:\Windows\System\zGUcXme.exe
  C:\Windows\System\zGUcXme.exe
  2⤵
  PID:10704
- C:\Windows\System\vOXuGjq.exe
  C:\Windows\System\vOXuGjq.exe
  2⤵
  PID:10776
- C:\Windows\System\VrmPnbs.exe
  C:\Windows\System\VrmPnbs.exe
  2⤵
  PID:10844
- C:\Windows\System\yLXIdcR.exe
  C:\Windows\System\yLXIdcR.exe
  2⤵
  PID:10916
- C:\Windows\System\afLlJTH.exe
  C:\Windows\System\afLlJTH.exe
  2⤵
  PID:10980
- C:\Windows\System\bCjDKVY.exe
  C:\Windows\System\bCjDKVY.exe
  2⤵
  PID:11048
- C:\Windows\System\exWwBQV.exe
  C:\Windows\System\exWwBQV.exe
  2⤵
  PID:11112
- C:\Windows\System\HHpwWjB.exe
  C:\Windows\System\HHpwWjB.exe
  2⤵
  PID:11176
- C:\Windows\System\NEKGaMt.exe
  C:\Windows\System\NEKGaMt.exe
  2⤵
  PID:11232
- C:\Windows\System\XapRAmN.exe
  C:\Windows\System\XapRAmN.exe
  2⤵
  PID:10308
- C:\Windows\System\CeYeEZc.exe
  C:\Windows\System\CeYeEZc.exe
  2⤵
  PID:10476
- C:\Windows\System\AFGEIxT.exe
  C:\Windows\System\AFGEIxT.exe
  2⤵
  PID:10616
- C:\Windows\System\eJQxgHx.exe
  C:\Windows\System\eJQxgHx.exe
  2⤵
  PID:10760
- C:\Windows\System\yqsPuRq.exe
  C:\Windows\System\yqsPuRq.exe
  2⤵
  PID:10928
- C:\Windows\System\kcjIEUk.exe
  C:\Windows\System\kcjIEUk.exe
  2⤵
  PID:11092
- C:\Windows\System\xeSindT.exe
  C:\Windows\System\xeSindT.exe
  2⤵
  PID:11228
- C:\Windows\System\jTmRAcc.exe
  C:\Windows\System\jTmRAcc.exe
  2⤵
  PID:10536
- C:\Windows\System\lPrXeTu.exe
  C:\Windows\System\lPrXeTu.exe
  2⤵
  PID:10872
- C:\Windows\System\PQrXkPR.exe
  C:\Windows\System\PQrXkPR.exe
  2⤵
  PID:11208
- C:\Windows\System\VIQGTMN.exe
  C:\Windows\System\VIQGTMN.exe
  2⤵
  PID:11028
- C:\Windows\System\fVJskKb.exe
  C:\Windows\System\fVJskKb.exe
  2⤵
  PID:10840
- C:\Windows\System\tyhszOe.exe
  C:\Windows\System\tyhszOe.exe
  2⤵
  PID:11296
- C:\Windows\System\IqAFlWD.exe
  C:\Windows\System\IqAFlWD.exe
  2⤵
  PID:11332
- C:\Windows\System\VOCYLaE.exe
  C:\Windows\System\VOCYLaE.exe
  2⤵
  PID:11396
- C:\Windows\System\qGTRcfP.exe
  C:\Windows\System\qGTRcfP.exe
  2⤵
  PID:11444
- C:\Windows\System\zVfARWD.exe
  C:\Windows\System\zVfARWD.exe
  2⤵
  PID:11460
- C:\Windows\System\wHlUfff.exe
  C:\Windows\System\wHlUfff.exe
  2⤵
  PID:11516
- C:\Windows\System\TcELkLr.exe
  C:\Windows\System\TcELkLr.exe
  2⤵
  PID:11564
- C:\Windows\System\TsUBniU.exe
  C:\Windows\System\TsUBniU.exe
  2⤵
  PID:11592
- C:\Windows\System\BDXNASt.exe
  C:\Windows\System\BDXNASt.exe
  2⤵
  PID:11624
- C:\Windows\System\XMdkgbZ.exe
  C:\Windows\System\XMdkgbZ.exe
  2⤵
  PID:11652
- C:\Windows\System\NgmpJJr.exe
  C:\Windows\System\NgmpJJr.exe
  2⤵
  PID:11688
- C:\Windows\System\QeAfNnj.exe
  C:\Windows\System\QeAfNnj.exe
  2⤵
  PID:11716
- C:\Windows\System\GyhtigG.exe
  C:\Windows\System\GyhtigG.exe
  2⤵
  PID:11752
- C:\Windows\System\yMsaVhc.exe
  C:\Windows\System\yMsaVhc.exe
  2⤵
  PID:11772
- C:\Windows\System\XgPeKob.exe
  C:\Windows\System\XgPeKob.exe
  2⤵
  PID:11788
- C:\Windows\System\sjSkwuP.exe
  C:\Windows\System\sjSkwuP.exe
  2⤵
  PID:11808
- C:\Windows\System\gkIRECd.exe
  C:\Windows\System\gkIRECd.exe
  2⤵
  PID:11868
- C:\Windows\System\XYxXekG.exe
  C:\Windows\System\XYxXekG.exe
  2⤵
  PID:11908
- C:\Windows\System\BqTagES.exe
  C:\Windows\System\BqTagES.exe
  2⤵
  PID:11936
- C:\Windows\System\yCvdihZ.exe
  C:\Windows\System\yCvdihZ.exe
  2⤵
  PID:11964
- C:\Windows\System\uHowCuu.exe
  C:\Windows\System\uHowCuu.exe
  2⤵
  PID:11992
- C:\Windows\System\DAuQGPN.exe
  C:\Windows\System\DAuQGPN.exe
  2⤵
  PID:12020
- C:\Windows\System\TZurhmg.exe
  C:\Windows\System\TZurhmg.exe
  2⤵
  PID:12048
- C:\Windows\System\KllLOmg.exe
  C:\Windows\System\KllLOmg.exe
  2⤵
  PID:12076
- C:\Windows\System\DjuMHoU.exe
  C:\Windows\System\DjuMHoU.exe
  2⤵
  PID:12104
- C:\Windows\System\cWONdNz.exe
  C:\Windows\System\cWONdNz.exe
  2⤵
  PID:12132
- C:\Windows\System\zepjSSW.exe
  C:\Windows\System\zepjSSW.exe
  2⤵
  PID:12160
- C:\Windows\System\cWgDWYV.exe
  C:\Windows\System\cWgDWYV.exe
  2⤵
  PID:12188
- C:\Windows\System\QKOBjnn.exe
  C:\Windows\System\QKOBjnn.exe
  2⤵
  PID:12216
- C:\Windows\System\YJdTrYb.exe
  C:\Windows\System\YJdTrYb.exe
  2⤵
  PID:12244
- C:\Windows\System\CWlcwtS.exe
  C:\Windows\System\CWlcwtS.exe
  2⤵
  PID:12276
- C:\Windows\System\LXtuKyH.exe
  C:\Windows\System\LXtuKyH.exe
  2⤵
  PID:11308
- C:\Windows\System\WJBZhrv.exe
  C:\Windows\System\WJBZhrv.exe
  2⤵
  PID:11452
- C:\Windows\System\TdKTThJ.exe
  C:\Windows\System\TdKTThJ.exe
  2⤵
  PID:11560
- C:\Windows\System\PXwqLxA.exe
  C:\Windows\System\PXwqLxA.exe
  2⤵
  PID:11696
- C:\Windows\System\oGBVCNL.exe
  C:\Windows\System\oGBVCNL.exe
  2⤵
  PID:11784
- C:\Windows\System\qDrjcXA.exe
  C:\Windows\System\qDrjcXA.exe
  2⤵
  PID:11852
- C:\Windows\System\kWqltSC.exe
  C:\Windows\System\kWqltSC.exe
  2⤵
  PID:11928
- C:\Windows\System\QBUSIcS.exe
  C:\Windows\System\QBUSIcS.exe
  2⤵
  PID:11984
- C:\Windows\System\USgfSPW.exe
  C:\Windows\System\USgfSPW.exe
  2⤵
  PID:12044
- C:\Windows\System\CJWEuKb.exe
  C:\Windows\System\CJWEuKb.exe
  2⤵
  PID:12120
- C:\Windows\System\FykPIPn.exe
  C:\Windows\System\FykPIPn.exe
  2⤵
  PID:12184
- C:\Windows\System\ANukEGB.exe
  C:\Windows\System\ANukEGB.exe
  2⤵
  PID:12232
- C:\Windows\System\aBFxlmN.exe
  C:\Windows\System\aBFxlmN.exe
  2⤵
  PID:11360
- C:\Windows\System\FIlNCiS.exe
  C:\Windows\System\FIlNCiS.exe
  2⤵
  PID:11576
- C:\Windows\System\aoEmXEf.exe
  C:\Windows\System\aoEmXEf.exe
  2⤵
  PID:11836
- C:\Windows\System\kkbIwim.exe
  C:\Windows\System\kkbIwim.exe
  2⤵
  PID:12040
- C:\Windows\System\ewVjtBU.exe
  C:\Windows\System\ewVjtBU.exe
  2⤵
  PID:12148
- C:\Windows\System\kgqXhjS.exe
  C:\Windows\System\kgqXhjS.exe
  2⤵
  PID:11748
- C:\Windows\System\CPOcBjD.exe
  C:\Windows\System\CPOcBjD.exe
  2⤵
  PID:10812
- C:\Windows\System\kfPtJNy.exe
  C:\Windows\System\kfPtJNy.exe
  2⤵
  PID:12204
- C:\Windows\System\tdJHNpn.exe
  C:\Windows\System\tdJHNpn.exe
  2⤵
  PID:11976
- C:\Windows\System\UIpOzxC.exe
  C:\Windows\System\UIpOzxC.exe
  2⤵
  PID:12304
- C:\Windows\System\dcyyKOl.exe
  C:\Windows\System\dcyyKOl.exe
  2⤵
  PID:12332
- C:\Windows\System\rcKAkJO.exe
  C:\Windows\System\rcKAkJO.exe
  2⤵
  PID:12360
- C:\Windows\System\lXWmLZt.exe
  C:\Windows\System\lXWmLZt.exe
  2⤵
  PID:12388
- C:\Windows\System\IpRttsI.exe
  C:\Windows\System\IpRttsI.exe
  2⤵
  PID:12416
- C:\Windows\System\XLoCDGG.exe
  C:\Windows\System\XLoCDGG.exe
  2⤵
  PID:12448
- C:\Windows\System\TJHhzlI.exe
  C:\Windows\System\TJHhzlI.exe
  2⤵
  PID:12476
- C:\Windows\System\tTVFYTV.exe
  C:\Windows\System\tTVFYTV.exe
  2⤵
  PID:12504
- C:\Windows\System\JFyJRRZ.exe
  C:\Windows\System\JFyJRRZ.exe
  2⤵
  PID:12532
- C:\Windows\System\mHLHGFm.exe
  C:\Windows\System\mHLHGFm.exe
  2⤵
  PID:12556
- C:\Windows\System\pgNgQte.exe
  C:\Windows\System\pgNgQte.exe
  2⤵
  PID:12576
- C:\Windows\System\CoYKHNW.exe
  C:\Windows\System\CoYKHNW.exe
  2⤵
  PID:12604
- C:\Windows\System\npgIjnZ.exe
  C:\Windows\System\npgIjnZ.exe
  2⤵
  PID:12636
- C:\Windows\System\NGviGFN.exe
  C:\Windows\System\NGviGFN.exe
  2⤵
  PID:12660
- C:\Windows\System\WNurWOL.exe
  C:\Windows\System\WNurWOL.exe
  2⤵
  PID:12700
- C:\Windows\System\egESAMM.exe
  C:\Windows\System\egESAMM.exe
  2⤵
  PID:12720
- C:\Windows\System\ZnvUTMN.exe
  C:\Windows\System\ZnvUTMN.exe
  2⤵
  PID:12756
- C:\Windows\System\MyjobQg.exe
  C:\Windows\System\MyjobQg.exe
  2⤵
  PID:12784
- C:\Windows\System\IIiujeo.exe
  C:\Windows\System\IIiujeo.exe
  2⤵
  PID:12812
- C:\Windows\System\VkgDGGf.exe
  C:\Windows\System\VkgDGGf.exe
  2⤵
  PID:12840
- C:\Windows\System\ryzEsnj.exe
  C:\Windows\System\ryzEsnj.exe
  2⤵
  PID:12868
- C:\Windows\System\psFOqaX.exe
  C:\Windows\System\psFOqaX.exe
  2⤵
  PID:12896
- C:\Windows\System\LvWrtww.exe
  C:\Windows\System\LvWrtww.exe
  2⤵
  PID:12924
- C:\Windows\System\CwSdybX.exe
  C:\Windows\System\CwSdybX.exe
  2⤵
  PID:12956
- C:\Windows\System\DbQZGMV.exe
  C:\Windows\System\DbQZGMV.exe
  2⤵
  PID:12984
- C:\Windows\System\FQDMktM.exe
  C:\Windows\System\FQDMktM.exe
  2⤵
  PID:13012
- C:\Windows\System\SmnjEQo.exe
  C:\Windows\System\SmnjEQo.exe
  2⤵
  PID:13040
- C:\Windows\System\yLJVIUa.exe
  C:\Windows\System\yLJVIUa.exe
  2⤵
  PID:13068
- C:\Windows\System\JSFaDVG.exe
  C:\Windows\System\JSFaDVG.exe
  2⤵
  PID:13096
- C:\Windows\System\LVaryPO.exe
  C:\Windows\System\LVaryPO.exe
  2⤵
  PID:13124
- C:\Windows\System\yeUUZHb.exe
  C:\Windows\System\yeUUZHb.exe
  2⤵
  PID:13152
- C:\Windows\System\rNUbPYQ.exe
  C:\Windows\System\rNUbPYQ.exe
  2⤵
  PID:13184
- C:\Windows\System\LzTzjHs.exe
  C:\Windows\System\LzTzjHs.exe
  2⤵
  PID:13212
- C:\Windows\System\uXjdZOK.exe
  C:\Windows\System\uXjdZOK.exe
  2⤵
  PID:13240
- C:\Windows\System\ZofztaR.exe
  C:\Windows\System\ZofztaR.exe
  2⤵
  PID:13268
- C:\Windows\System\KXVNyxA.exe
  C:\Windows\System\KXVNyxA.exe
  2⤵
  PID:13296
- C:\Windows\System\KtcYhrk.exe
  C:\Windows\System\KtcYhrk.exe
  2⤵
  PID:12316
- C:\Windows\System\jyPduaW.exe
  C:\Windows\System\jyPduaW.exe
  2⤵
  PID:12376
- C:\Windows\System\CwSddGM.exe
  C:\Windows\System\CwSddGM.exe
  2⤵
  PID:12440
- C:\Windows\System\opcEunw.exe
  C:\Windows\System\opcEunw.exe
  2⤵
  PID:12488
- C:\Windows\System\sgnPySA.exe
  C:\Windows\System\sgnPySA.exe
  2⤵
  PID:12568
- C:\Windows\System\YSRuwJB.exe
  C:\Windows\System\YSRuwJB.exe
  2⤵
  PID:12616
- C:\Windows\System\jouUrAI.exe
  C:\Windows\System\jouUrAI.exe
  2⤵
  PID:12684
- C:\Windows\System\YBUTbpo.exe
  C:\Windows\System\YBUTbpo.exe
  2⤵
  PID:12772
- C:\Windows\System\oEyaVud.exe
  C:\Windows\System\oEyaVud.exe
  2⤵
  PID:12824
- C:\Windows\System\LZXlEud.exe
  C:\Windows\System\LZXlEud.exe
  2⤵
  PID:12888
- C:\Windows\System\ojzuaOu.exe
  C:\Windows\System\ojzuaOu.exe
  2⤵
  PID:12976
- C:\Windows\System\ZqikjVx.exe
  C:\Windows\System\ZqikjVx.exe
  2⤵
  PID:13024
- C:\Windows\System\NWfxePW.exe
  C:\Windows\System\NWfxePW.exe
  2⤵
  PID:13088
- C:\Windows\System\gObdplb.exe
  C:\Windows\System\gObdplb.exe
  2⤵
  PID:2152
- C:\Windows\System\whrRygB.exe
  C:\Windows\System\whrRygB.exe
  2⤵
  PID:13144
- C:\Windows\System\mnDyegM.exe
  C:\Windows\System\mnDyegM.exe
  2⤵
  PID:13208
- C:\Windows\System\GXiSMTm.exe
  C:\Windows\System\GXiSMTm.exe
  2⤵
  PID:13280
- C:\Windows\System\cnMQIgt.exe
  C:\Windows\System\cnMQIgt.exe
  2⤵
  PID:12352
- C:\Windows\System\PTSlsNz.exe
  C:\Windows\System\PTSlsNz.exe
  2⤵
  PID:12524
- C:\Windows\System\XPsDOzv.exe
  C:\Windows\System\XPsDOzv.exe
  2⤵
  PID:12688
- C:\Windows\System\NkRsKLg.exe
  C:\Windows\System\NkRsKLg.exe
  2⤵
  PID:12852
- C:\Windows\System\WiAQYAB.exe
  C:\Windows\System\WiAQYAB.exe
  2⤵
  PID:12936
- C:\Windows\System\kwaoApn.exe
  C:\Windows\System\kwaoApn.exe
  2⤵
  PID:3576
- C:\Windows\System\fiQDzTw.exe
  C:\Windows\System\fiQDzTw.exe
  2⤵
  PID:13236
- C:\Windows\System\VSRFkbv.exe
  C:\Windows\System\VSRFkbv.exe
  2⤵
  PID:12464
- C:\Windows\System\UkEsFKu.exe
  C:\Windows\System\UkEsFKu.exe
  2⤵
  PID:11316
- C:\Windows\System\lAOUiql.exe
  C:\Windows\System\lAOUiql.exe
  2⤵
  PID:13116
- C:\Windows\System\UdSXQji.exe
  C:\Windows\System\UdSXQji.exe
  2⤵
  PID:6288
- C:\Windows\System\KWTzWFD.exe
  C:\Windows\System\KWTzWFD.exe
  2⤵
  PID:6192
- C:\Windows\System\kgtcGHp.exe
  C:\Windows\System\kgtcGHp.exe
  2⤵
  PID:13308
- C:\Windows\System\ALhjUWd.exe
  C:\Windows\System\ALhjUWd.exe
  2⤵
  PID:13176
- C:\Windows\System\ENFpsyU.exe
  C:\Windows\System\ENFpsyU.exe
  2⤵
  PID:1624
- C:\Windows\System\BJnciNB.exe
  C:\Windows\System\BJnciNB.exe
  2⤵
  PID:6240
- C:\Windows\System\ktBgyad.exe
  C:\Windows\System\ktBgyad.exe
  2⤵
  PID:13328
- C:\Windows\System\IeUnRtX.exe
  C:\Windows\System\IeUnRtX.exe
  2⤵
  PID:13360
- C:\Windows\System\semGQnG.exe
  C:\Windows\System\semGQnG.exe
  2⤵
  PID:13388
- C:\Windows\System\sDkMwdt.exe
  C:\Windows\System\sDkMwdt.exe
  2⤵
  PID:13416
- C:\Windows\System\gTMdSxF.exe
  C:\Windows\System\gTMdSxF.exe
  2⤵
  PID:13444
- C:\Windows\System\zgYeNGE.exe
  C:\Windows\System\zgYeNGE.exe
  2⤵
  PID:13472
- C:\Windows\System\IJXqvwk.exe
  C:\Windows\System\IJXqvwk.exe
  2⤵
  PID:13500
- C:\Windows\System\gcjewTC.exe
  C:\Windows\System\gcjewTC.exe
  2⤵
  PID:13528
- C:\Windows\System\MWJYTGo.exe
  C:\Windows\System\MWJYTGo.exe
  2⤵
  PID:13556
- C:\Windows\System\eGIPPRR.exe
  C:\Windows\System\eGIPPRR.exe
  2⤵
  PID:13584
- C:\Windows\System\FyzoMVb.exe
  C:\Windows\System\FyzoMVb.exe
  2⤵
  PID:13756
- C:\Windows\System\LrPUfUo.exe
  C:\Windows\System\LrPUfUo.exe
  2⤵
  PID:13776
- C:\Windows\System\FTIdgyF.exe
  C:\Windows\System\FTIdgyF.exe
  2⤵
  PID:13804
- C:\Windows\System\fCSpSJp.exe
  C:\Windows\System\fCSpSJp.exe
  2⤵
  PID:13824
- C:\Windows\System\sgOpdtQ.exe
  C:\Windows\System\sgOpdtQ.exe
  2⤵
  PID:13868
- C:\Windows\System\RlQXCym.exe
  C:\Windows\System\RlQXCym.exe
  2⤵
  PID:13884
- C:\Windows\System\NSaKuzG.exe
  C:\Windows\System\NSaKuzG.exe
  2⤵
  PID:7496
- C:\Windows\System\byLTJkg.exe
  C:\Windows\System\byLTJkg.exe
  2⤵
  PID:13908
- C:\Windows\System\LUXIqsr.exe
  C:\Windows\System\LUXIqsr.exe
  2⤵
  PID:14128
- C:\Windows\System\sYVEuNZ.exe
  C:\Windows\System\sYVEuNZ.exe
  2⤵
  PID:13728
- C:\Windows\System\OtCuohQ.exe
  C:\Windows\System\OtCuohQ.exe
  2⤵
  PID:1520
- C:\Windows\System\knEOsRN.exe
  C:\Windows\System\knEOsRN.exe
  2⤵
  PID:14296
- C:\Windows\System\dJrHhoa.exe
  C:\Windows\System\dJrHhoa.exe
  2⤵
  PID:13864
- C:\Windows\System\esaIrGB.exe
  C:\Windows\System\esaIrGB.exe
  2⤵
  PID:14016
- C:\Windows\System\DjAvTWq.exe
  C:\Windows\System\DjAvTWq.exe
  2⤵
  PID:14048
- C:\Windows\System\NxeQqkz.exe
  C:\Windows\System\NxeQqkz.exe
  2⤵
  PID:7180
- C:\Windows\System\QYgmeQh.exe
  C:\Windows\System\QYgmeQh.exe
  2⤵
  PID:2100
- C:\Windows\System\gjBHCOw.exe
  C:\Windows\System\gjBHCOw.exe
  2⤵
  PID:14276
- C:\Windows\System\UfkBCmq.exe
  C:\Windows\System\UfkBCmq.exe
  2⤵
  PID:14304
- C:\Windows\System\WWwWAyx.exe
  C:\Windows\System\WWwWAyx.exe
  2⤵
  PID:5048
- C:\Windows\System\KCmUPlz.exe
  C:\Windows\System\KCmUPlz.exe
  2⤵
  PID:13916
- C:\Windows\System\ggdWjwa.exe
  C:\Windows\System\ggdWjwa.exe
  2⤵
  PID:5832
- C:\Windows\System\SaNSmkx.exe
  C:\Windows\System\SaNSmkx.exe
  2⤵
  PID:13972
- C:\Windows\System\deunpKV.exe
  C:\Windows\System\deunpKV.exe
  2⤵
  PID:5028
- C:\Windows\System\wyscbHt.exe
  C:\Windows\System\wyscbHt.exe
  2⤵
  PID:14088
- C:\Windows\System\hJHUFxL.exe
  C:\Windows\System\hJHUFxL.exe
  2⤵
  PID:4396
- C:\Windows\System\OBaBnYd.exe
  C:\Windows\System\OBaBnYd.exe
  2⤵
  PID:13676
- C:\Windows\System\cJjEsdF.exe
  C:\Windows\System\cJjEsdF.exe
  2⤵
  PID:7540
- C:\Windows\System\dsbqUMK.exe
  C:\Windows\System\dsbqUMK.exe
  2⤵
  PID:13740
- C:\Windows\System\ZGxtZUB.exe
  C:\Windows\System\ZGxtZUB.exe
  2⤵
  PID:5804
- C:\Windows\System\yMvQJSo.exe
  C:\Windows\System\yMvQJSo.exe
  2⤵
  PID:2744
- C:\Windows\System\DjUATNR.exe
  C:\Windows\System\DjUATNR.exe
  2⤵
  PID:684
- C:\Windows\System\XIFHvNE.exe
  C:\Windows\System\XIFHvNE.exe
  2⤵
  PID:8412
- C:\Windows\System\jlIDqST.exe
  C:\Windows\System\jlIDqST.exe
  2⤵
  PID:8652
- C:\Windows\System\ghGVtRa.exe
  C:\Windows\System\ghGVtRa.exe
  2⤵
  PID:5504
- C:\Windows\System\YeCaAzl.exe
  C:\Windows\System\YeCaAzl.exe
  2⤵
  PID:7196
- C:\Windows\System\kNdCSMK.exe
  C:\Windows\System\kNdCSMK.exe
  2⤵
  PID:9948
- C:\Windows\System\DFLrjLv.exe
  C:\Windows\System\DFLrjLv.exe
  2⤵
  PID:7440
- C:\Windows\System\LzOtyOS.exe
  C:\Windows\System\LzOtyOS.exe
  2⤵
  PID:5696
- C:\Windows\System\sDAGVWa.exe
  C:\Windows\System\sDAGVWa.exe
  2⤵
  PID:13692
- C:\Windows\System\HUoqcTM.exe
  C:\Windows\System\HUoqcTM.exe
  2⤵
  PID:9456
- C:\Windows\System\YTgQRQj.exe
  C:\Windows\System\YTgQRQj.exe
  2⤵
  PID:13704
- C:\Windows\System\OzBQDZc.exe
  C:\Windows\System\OzBQDZc.exe
  2⤵
  PID:2376
- C:\Windows\System\pUxybbh.exe
  C:\Windows\System\pUxybbh.exe
  2⤵
  PID:2284
- C:\Windows\System\zneMCGk.exe
  C:\Windows\System\zneMCGk.exe
  2⤵
  PID:9848
- C:\Windows\System\UAFUiTR.exe
  C:\Windows\System\UAFUiTR.exe
  2⤵
  PID:10016
- C:\Windows\System\UQQcPRK.exe
  C:\Windows\System\UQQcPRK.exe
  2⤵
  PID:10216
- C:\Windows\System\DsuRFkw.exe
  C:\Windows\System\DsuRFkw.exe
  2⤵
  PID:9288
- C:\Windows\System\UTXoobx.exe
  C:\Windows\System\UTXoobx.exe
  2⤵
  PID:7664
- C:\Windows\System\AGeYmid.exe
  C:\Windows\System\AGeYmid.exe
  2⤵
  PID:6172
- C:\Windows\System\NcUMfFD.exe
  C:\Windows\System\NcUMfFD.exe
  2⤵
  PID:7736
- C:\Windows\System\gpmmToj.exe
  C:\Windows\System\gpmmToj.exe
  2⤵
  PID:13744
- C:\Windows\System\SpoZuSn.exe
  C:\Windows\System\SpoZuSn.exe
  2⤵
  PID:6236
- C:\Windows\System\BtbNwIj.exe
  C:\Windows\System\BtbNwIj.exe
  2⤵
  PID:6340
- C:\Windows\System\iQkBqmE.exe
  C:\Windows\System\iQkBqmE.exe
  2⤵
  PID:7804
- C:\Windows\System\EpeYCmt.exe
  C:\Windows\System\EpeYCmt.exe
  2⤵
  PID:6392
- C:\Windows\System\eIVsAZV.exe
  C:\Windows\System\eIVsAZV.exe
  2⤵
  PID:9816
- C:\Windows\System\vzzJfHi.exe
  C:\Windows\System\vzzJfHi.exe
  2⤵
  PID:6536
- C:\Windows\System\dukkvhX.exe
  C:\Windows\System\dukkvhX.exe
  2⤵
  PID:3056
- C:\Windows\System\PJeOjUs.exe
  C:\Windows\System\PJeOjUs.exe
  2⤵
  PID:9792
- C:\Windows\System\GJsDNOR.exe
  C:\Windows\System\GJsDNOR.exe
  2⤵
  PID:7920
- C:\Windows\System\tkMHPhh.exe
  C:\Windows\System\tkMHPhh.exe
  2⤵
  PID:6624
- C:\Windows\System\bDAuPjh.exe
  C:\Windows\System\bDAuPjh.exe
  2⤵
  PID:4100
- C:\Windows\System\OQhwiYb.exe
  C:\Windows\System\OQhwiYb.exe
  2⤵
  PID:5948
- C:\Windows\System\KcnbWoI.exe
  C:\Windows\System\KcnbWoI.exe
  2⤵
  PID:6636
- C:\Windows\System\YwsAgft.exe
  C:\Windows\System\YwsAgft.exe
  2⤵
  PID:6680
- C:\Windows\System\UHrkJjZ.exe
  C:\Windows\System\UHrkJjZ.exe
  2⤵
  PID:10360
- C:\Windows\System\ZlXWVJe.exe
  C:\Windows\System\ZlXWVJe.exe
  2⤵
  PID:2572
- C:\Windows\System\bsKjJdT.exe
  C:\Windows\System\bsKjJdT.exe
  2⤵
  PID:10408
- C:\Windows\System\xqrtwOy.exe
  C:\Windows\System\xqrtwOy.exe
  2⤵
  PID:2208
- C:\Windows\System\ZnImahs.exe
  C:\Windows\System\ZnImahs.exe
  2⤵
  PID:6032
- C:\Windows\System\LQzZpie.exe
  C:\Windows\System\LQzZpie.exe
  2⤵
  PID:10464
- C:\Windows\System\OfXsuuI.exe
  C:\Windows\System\OfXsuuI.exe
  2⤵
  PID:10492
- C:\Windows\System\HOGohhX.exe
  C:\Windows\System\HOGohhX.exe
  2⤵
  PID:2552
- C:\Windows\System\swsswkL.exe
  C:\Windows\System\swsswkL.exe
  2⤵
  PID:7216
- C:\Windows\System\pzyuhax.exe
  C:\Windows\System\pzyuhax.exe
  2⤵
  PID:10580
- C:\Windows\System\RgZMhqY.exe
  C:\Windows\System\RgZMhqY.exe
  2⤵
  PID:6880
- C:\Windows\System\MQttdGC.exe
  C:\Windows\System\MQttdGC.exe
  2⤵
  PID:1128
- C:\Windows\System\tVwUGaI.exe
  C:\Windows\System\tVwUGaI.exe
  2⤵
  PID:7380
- C:\Windows\System\EUAneqY.exe
  C:\Windows\System\EUAneqY.exe
  2⤵
  PID:4584
- C:\Windows\System\vWVfnoe.exe
  C:\Windows\System\vWVfnoe.exe
  2⤵
  PID:892
- C:\Windows\System\zPRSwHv.exe
  C:\Windows\System\zPRSwHv.exe
  2⤵
  PID:7516
- C:\Windows\System\pqnRtbe.exe
  C:\Windows\System\pqnRtbe.exe
  2⤵
  PID:10688
- C:\Windows\System\mMBmNZT.exe
  C:\Windows\System\mMBmNZT.exe
  2⤵
  PID:2372
- C:\Windows\System\DMqcavu.exe
  C:\Windows\System\DMqcavu.exe
  2⤵
  PID:4576
- C:\Windows\System\zOXgUYv.exe
  C:\Windows\System\zOXgUYv.exe
  2⤵
  PID:4620
- C:\Windows\System\ZeLeNtO.exe
  C:\Windows\System\ZeLeNtO.exe
  2⤵
  PID:10780
- C:\Windows\System\CzIfofK.exe
  C:\Windows\System\CzIfofK.exe
  2⤵
  PID:1216
- C:\Windows\System\idSCwmk.exe
  C:\Windows\System\idSCwmk.exe
  2⤵
  PID:4208
- C:\Windows\System\HMDYCCc.exe
  C:\Windows\System\HMDYCCc.exe
  2⤵
  PID:7068
- C:\Windows\System\SHPutyA.exe
  C:\Windows\System\SHPutyA.exe
  2⤵
  PID:7808
- C:\Windows\System\ZxjBhJH.exe
  C:\Windows\System\ZxjBhJH.exe
  2⤵
  PID:5220
- C:\Windows\System\uFkHHFO.exe
  C:\Windows\System\uFkHHFO.exe
  2⤵
  PID:1656
- C:\Windows\System\WgxUQxP.exe
  C:\Windows\System\WgxUQxP.exe
  2⤵
  PID:10912
- C:\Windows\System\BzQXKnG.exe
  C:\Windows\System\BzQXKnG.exe
  2⤵
  PID:10948
- C:\Windows\System\dmFDytV.exe
  C:\Windows\System\dmFDytV.exe
  2⤵
  PID:1064
- C:\Windows\System\wVpONTN.exe
  C:\Windows\System\wVpONTN.exe
  2⤵
  PID:10996
- C:\Windows\System\NOThWam.exe
  C:\Windows\System\NOThWam.exe
  2⤵
  PID:5900
- C:\Windows\System\RrUOBWR.exe
  C:\Windows\System\RrUOBWR.exe
  2⤵
  PID:11064
- C:\Windows\System\mrHrKGK.exe
  C:\Windows\System\mrHrKGK.exe
  2⤵
  PID:2328
- C:\Windows\System\dROLxlf.exe
  C:\Windows\System\dROLxlf.exe
  2⤵
  PID:7464
- C:\Windows\System\PCjaBOi.exe
  C:\Windows\System\PCjaBOi.exe
  2⤵
  PID:7280
- C:\Windows\System\JlOtDdF.exe
  C:\Windows\System\JlOtDdF.exe
  2⤵
  PID:11172
- C:\Windows\System\CMavwCL.exe
  C:\Windows\System\CMavwCL.exe
  2⤵
  PID:316
- C:\Windows\System\XHotZKF.exe
  C:\Windows\System\XHotZKF.exe
  2⤵
  PID:14168
- C:\Windows\System\eLpapcd.exe
  C:\Windows\System\eLpapcd.exe
  2⤵
  PID:1844
- C:\Windows\System\MSVuqxn.exe
  C:\Windows\System\MSVuqxn.exe
  2⤵
  PID:14196
- C:\Windows\System\qQExjhQ.exe
  C:\Windows\System\qQExjhQ.exe
  2⤵
  PID:6436
- C:\Windows\System\kFrEKpW.exe
  C:\Windows\System\kFrEKpW.exe
  2⤵
  PID:10336
- C:\Windows\System\JYmZHGT.exe
  C:\Windows\System\JYmZHGT.exe
  2⤵
  PID:7192
- C:\Windows\System\AjbVfTA.exe
  C:\Windows\System\AjbVfTA.exe
  2⤵
  PID:14208
- C:\Windows\System\yITdmGd.exe
  C:\Windows\System\yITdmGd.exe
  2⤵
  PID:10480
- C:\Windows\System\OWSrzqc.exe
  C:\Windows\System\OWSrzqc.exe
  2⤵
  PID:5676
- C:\Windows\System\OavgAzW.exe
  C:\Windows\System\OavgAzW.exe
  2⤵
  PID:7776
- C:\Windows\System\KixDmVR.exe
  C:\Windows\System\KixDmVR.exe
  2⤵
  PID:5756
- C:\Windows\System\PPoOnYr.exe
  C:\Windows\System\PPoOnYr.exe
  2⤵
  PID:10728
- C:\Windows\System\lTkrNyg.exe
  C:\Windows\System\lTkrNyg.exe
  2⤵
  PID:6832
- C:\Windows\System\aKbWWyF.exe
  C:\Windows\System\aKbWWyF.exe
  2⤵
  PID:10788
- C:\Windows\System\xrzmLMJ.exe
  C:\Windows\System\xrzmLMJ.exe
  2⤵
  PID:10868
- C:\Windows\System\nWFbaLD.exe
  C:\Windows\System\nWFbaLD.exe
  2⤵
  PID:14220
- C:\Windows\System\GRNBnSV.exe
  C:\Windows\System\GRNBnSV.exe
  2⤵
  PID:8308
- C:\Windows\System\ZVfDumO.exe
  C:\Windows\System\ZVfDumO.exe
  2⤵
  PID:5180
- C:\Windows\System\YlKySXp.exe
  C:\Windows\System\YlKySXp.exe
  2⤵
  PID:11084
- C:\Windows\System\XSAtonw.exe
  C:\Windows\System\XSAtonw.exe
  2⤵
  PID:11148
- C:\Windows\System\wEGbRHb.exe
  C:\Windows\System\wEGbRHb.exe
  2⤵
  PID:14256
- C:\Windows\System\STCTDBC.exe
  C:\Windows\System\STCTDBC.exe
  2⤵
  PID:14272
- C:\Windows\System\YBUqTVb.exe
  C:\Windows\System\YBUqTVb.exe
  2⤵
  PID:8452
- C:\Windows\System\DigAcpE.exe
  C:\Windows\System\DigAcpE.exe
  2⤵
  PID:14312
- C:\Windows\System\BRWQlOS.exe
  C:\Windows\System\BRWQlOS.exe
  2⤵
  PID:13324
- C:\Windows\System\UoXxPlz.exe
  C:\Windows\System\UoXxPlz.exe
  2⤵
  PID:10672
- C:\Windows\System\ZNsSqkq.exe
  C:\Windows\System\ZNsSqkq.exe
  2⤵
  PID:6256
- C:\Windows\System\rYZbSbZ.exe
  C:\Windows\System\rYZbSbZ.exe
  2⤵
  PID:13432
- C:\Windows\System\LwkixXB.exe
  C:\Windows\System\LwkixXB.exe
  2⤵
  PID:13436
- C:\Windows\System\IHqNrQe.exe
  C:\Windows\System\IHqNrQe.exe
  2⤵
  PID:11168
- C:\Windows\System\BUUtreY.exe
  C:\Windows\System\BUUtreY.exe
  2⤵
  PID:7136
- C:\Windows\System\ZAmrpaT.exe
  C:\Windows\System\ZAmrpaT.exe
  2⤵
  PID:10300
- C:\Windows\System\ngpPRrw.exe
  C:\Windows\System\ngpPRrw.exe
  2⤵
  PID:6112
- C:\Windows\System\mbwpkXn.exe
  C:\Windows\System\mbwpkXn.exe
  2⤵
  PID:8680
- C:\Windows\System\aWgwctj.exe
  C:\Windows\System\aWgwctj.exe
  2⤵
  PID:5248
- C:\Windows\System\dmdGOXw.exe
  C:\Windows\System\dmdGOXw.exe
  2⤵
  PID:7208
- C:\Windows\System\iiaSbBQ.exe
  C:\Windows\System\iiaSbBQ.exe
  2⤵
  PID:8728
- C:\Windows\System\rdFOJEP.exe
  C:\Windows\System\rdFOJEP.exe
  2⤵
  PID:13568
- C:\Windows\System\SNNhUhk.exe
  C:\Windows\System\SNNhUhk.exe
  2⤵
  PID:7284
- C:\Windows\System\UKUTacp.exe
  C:\Windows\System\UKUTacp.exe
  2⤵
  PID:8772
- C:\Windows\System\cUrjmSd.exe
  C:\Windows\System\cUrjmSd.exe
  2⤵
  PID:13612
- C:\Windows\System\gWRACAU.exe
  C:\Windows\System\gWRACAU.exe
  2⤵
  PID:13636
- C:\Windows\System\IinAzeo.exe
  C:\Windows\System\IinAzeo.exe
  2⤵
  PID:11600
- C:\Windows\System\ejZOeLV.exe
  C:\Windows\System\ejZOeLV.exe
  2⤵
  PID:7368
- C:\Windows\System\rkQeEuP.exe
  C:\Windows\System\rkQeEuP.exe
  2⤵
  PID:11668
- C:\Windows\System\kLfjqzD.exe
  C:\Windows\System\kLfjqzD.exe
  2⤵
  PID:5600
- C:\Windows\System\PchcSfg.exe
  C:\Windows\System\PchcSfg.exe
  2⤵
  PID:11708
- C:\Windows\System\ZIJQsVC.exe
  C:\Windows\System\ZIJQsVC.exe
  2⤵
  PID:8960
- C:\Windows\System\zPApQBq.exe
  C:\Windows\System\zPApQBq.exe
  2⤵
  PID:9100
- C:\Windows\System\FydtbnW.exe
  C:\Windows\System\FydtbnW.exe
  2⤵
  PID:9184
- C:\Windows\System\GGRWRpI.exe
  C:\Windows\System\GGRWRpI.exe
  2⤵
  PID:8228
- C:\Windows\System\UgdZWvL.exe
  C:\Windows\System\UgdZWvL.exe
  2⤵
  PID:8484
- C:\Windows\System\gsOhMmZ.exe
  C:\Windows\System\gsOhMmZ.exe
  2⤵
  PID:8660
- C:\Windows\System\pBaxXgL.exe
  C:\Windows\System\pBaxXgL.exe
  2⤵
  PID:11828
- C:\Windows\System\fOqisPm.exe
  C:\Windows\System\fOqisPm.exe
  2⤵
  PID:8908
- C:\Windows\System\rFbAXJi.exe
  C:\Windows\System\rFbAXJi.exe
  2⤵
  PID:11924
- C:\Windows\System\KhwYINA.exe
  C:\Windows\System\KhwYINA.exe
  2⤵
  PID:8232
- C:\Windows\System\VhWrNwl.exe
  C:\Windows\System\VhWrNwl.exe
  2⤵
  PID:8848
- C:\Windows\System\UzEgVpB.exe
  C:\Windows\System\UzEgVpB.exe
  2⤵
  PID:9108
- C:\Windows\System\JsPUBqv.exe
  C:\Windows\System\JsPUBqv.exe
  2⤵
  PID:8876
- C:\Windows\System\cvemMdA.exe
  C:\Windows\System\cvemMdA.exe
  2⤵
  PID:9256
- C:\Windows\System\TyTIhIU.exe
  C:\Windows\System\TyTIhIU.exe
  2⤵
  PID:12036
- C:\Windows\System\NxxZoGu.exe
  C:\Windows\System\NxxZoGu.exe
  2⤵
  PID:12056
- C:\Windows\System\IcaKSiF.exe
  C:\Windows\System\IcaKSiF.exe
  2⤵
  PID:9476
- C:\Windows\System\OkwjqlA.exe
  C:\Windows\System\OkwjqlA.exe
  2⤵
  PID:9556
- C:\Windows\System\ChgSaNg.exe
  C:\Windows\System\ChgSaNg.exe
  2⤵
  PID:9648
- C:\Windows\System\qQWIfDc.exe
  C:\Windows\System\qQWIfDc.exe
  2⤵
  PID:9696
- C:\Windows\System\xWnWoGU.exe
  C:\Windows\System\xWnWoGU.exe
  2⤵
  PID:9780
- C:\Windows\System\VXlYlqo.exe
  C:\Windows\System\VXlYlqo.exe
  2⤵
  PID:9900
- C:\Windows\System\rfVLing.exe
  C:\Windows\System\rfVLing.exe
  2⤵
  PID:9976
- C:\Windows\System\GndpPtW.exe
  C:\Windows\System\GndpPtW.exe
  2⤵
  PID:12224
- C:\Windows\System\EAtWGqc.exe
  C:\Windows\System\EAtWGqc.exe
  2⤵
  PID:10152
- C:\Windows\System\ufDMDJY.exe
  C:\Windows\System\ufDMDJY.exe
  2⤵
  PID:10008
- C:\Windows\System\CwyQOjp.exe
  C:\Windows\System\CwyQOjp.exe
  2⤵
  PID:11496
- C:\Windows\System\DYvucIW.exe
  C:\Windows\System\DYvucIW.exe
  2⤵
  PID:5688
- C:\Windows\System\wbRFCXB.exe
  C:\Windows\System\wbRFCXB.exe
  2⤵
  PID:11640
- C:\Windows\System\PWVNCjx.exe
  C:\Windows\System\PWVNCjx.exe
  2⤵
  PID:4228
- C:\Windows\System\CwzDuFz.exe
  C:\Windows\System\CwzDuFz.exe
  2⤵
  PID:7500
- C:\Windows\System\bjBJNGX.exe
  C:\Windows\System\bjBJNGX.exe
  2⤵
  PID:2132
- C:\Windows\System\OnmHrBl.exe
  C:\Windows\System\OnmHrBl.exe
  2⤵
  PID:1132
- C:\Windows\System\wTlEFrC.exe
  C:\Windows\System\wTlEFrC.exe
  2⤵
  PID:9736
- C:\Windows\System\hISPBgc.exe
  C:\Windows\System\hISPBgc.exe
  2⤵
  PID:13816
- C:\Windows\System\IwoceDK.exe
  C:\Windows\System\IwoceDK.exe
  2⤵
  PID:5388
- C:\Windows\System\AkGiOBV.exe
  C:\Windows\System\AkGiOBV.exe
  2⤵
  PID:12200
- C:\Windows\System\DrVXklQ.exe
  C:\Windows\System\DrVXklQ.exe
  2⤵
  PID:3092
- C:\Windows\System\HSJoUWG.exe
  C:\Windows\System\HSJoUWG.exe
  2⤵
  PID:11988
- C:\Windows\System\vNIYLHt.exe
  C:\Windows\System\vNIYLHt.exe
  2⤵
  PID:10132
- C:\Windows\System\vbgWgwp.exe
  C:\Windows\System\vbgWgwp.exe
  2⤵
  PID:12368
- C:\Windows\System\tcMnXsN.exe
  C:\Windows\System\tcMnXsN.exe
  2⤵
  PID:9584
- C:\Windows\System\HCuwWvb.exe
  C:\Windows\System\HCuwWvb.exe
  2⤵
  PID:12624
- C:\Windows\System\SPXIeuy.exe
  C:\Windows\System\SPXIeuy.exe
  2⤵
  PID:12728
- C:\Windows\System\ABSaYUh.exe
  C:\Windows\System\ABSaYUh.exe
  2⤵
  PID:12804
- C:\Windows\System\wkUFvLa.exe
  C:\Windows\System\wkUFvLa.exe
  2⤵
  PID:12912
- C:\Windows\System\fTBUwXy.exe
  C:\Windows\System\fTBUwXy.exe
  2⤵
  PID:12992
- C:\Windows\System\DPSafrZ.exe
  C:\Windows\System\DPSafrZ.exe
  2⤵
  PID:13104
- C:\Windows\System\HAitoPm.exe
  C:\Windows\System\HAitoPm.exe
  2⤵
  PID:13192
- C:\Windows\System\DiKIsIC.exe
  C:\Windows\System\DiKIsIC.exe
  2⤵
  PID:13304
- C:\Windows\System\XNNIjmJ.exe
  C:\Windows\System\XNNIjmJ.exe
  2⤵
  PID:12444
- C:\Windows\System\JcOdaUC.exe
  C:\Windows\System\JcOdaUC.exe
  2⤵
  PID:12740
- C:\Windows\System\LqYpOZt.exe
  C:\Windows\System\LqYpOZt.exe
  2⤵
  PID:3536
- C:\Windows\System\skAxnnT.exe
  C:\Windows\System\skAxnnT.exe
  2⤵
  PID:5780
- C:\Windows\System\XOjEfkM.exe
  C:\Windows\System\XOjEfkM.exe
  2⤵
  PID:12860
- C:\Windows\System\IqMACJO.exe
  C:\Windows\System\IqMACJO.exe
  2⤵
  PID:6232
- C:\Windows\System\lHIcpPg.exe
  C:\Windows\System\lHIcpPg.exe
  2⤵
  PID:6364
- C:\Windows\System\IsPeypB.exe
  C:\Windows\System\IsPeypB.exe
  2⤵
  PID:3232
- C:\Windows\System\cPcFMdD.exe
  C:\Windows\System\cPcFMdD.exe
  2⤵
  PID:3656
- C:\Windows\System\omsMDXB.exe
  C:\Windows\System\omsMDXB.exe
  2⤵
  PID:14044
- C:\Windows\System\wHQgMJR.exe
  C:\Windows\System\wHQgMJR.exe
  2⤵
  PID:1440
- C:\Windows\System\IowIQVy.exe
  C:\Windows\System\IowIQVy.exe
  2⤵
  PID:12296
- C:\Windows\System\QgkLrEK.exe
  C:\Windows\System\QgkLrEK.exe
  2⤵
  PID:11284
- C:\Windows\System\krXhzAy.exe
  C:\Windows\System\krXhzAy.exe
  2⤵
  PID:12916
- C:\Windows\System\QROaXId.exe
  C:\Windows\System\QROaXId.exe
  2⤵
  PID:12300
- C:\Windows\System\OCtjFHq.exe
  C:\Windows\System\OCtjFHq.exe
  2⤵
  PID:5976
- C:\Windows\System\SCOZQXy.exe
  C:\Windows\System\SCOZQXy.exe
  2⤵
  PID:10324
- C:\Windows\System\ZBouzZL.exe
  C:\Windows\System\ZBouzZL.exe
  2⤵
  PID:12692
- C:\Windows\System\MFvrftR.exe
  C:\Windows\System\MFvrftR.exe
  2⤵
  PID:5492
- C:\Windows\System\brGXkFk.exe
  C:\Windows\System\brGXkFk.exe
  2⤵
  PID:6720
- C:\Windows\System\weUKwYq.exe
  C:\Windows\System\weUKwYq.exe
  2⤵
  PID:13404
- C:\Windows\System\TefICSk.exe
  C:\Windows\System\TefICSk.exe
  2⤵
  PID:13456
- C:\Windows\System\ustyWei.exe
  C:\Windows\System\ustyWei.exe
  2⤵
  PID:5084
- C:\Windows\System\CnSoDyD.exe
  C:\Windows\System\CnSoDyD.exe
  2⤵
  PID:6816
- C:\Windows\System\HaEMsWx.exe
  C:\Windows\System\HaEMsWx.exe
  2⤵
  PID:3040
- C:\Windows\System\vmJvcPt.exe
  C:\Windows\System\vmJvcPt.exe
  2⤵
  PID:10520
- C:\Windows\System\bOJPdNl.exe
  C:\Windows\System\bOJPdNl.exe
  2⤵
  PID:4868
- C:\Windows\System\edcmBgF.exe
  C:\Windows\System\edcmBgF.exe
  2⤵
  PID:3948
- C:\Windows\System\uKLuAQl.exe
  C:\Windows\System\uKLuAQl.exe
  2⤵
  PID:1212
- C:\Windows\System\KjoTcKY.exe
  C:\Windows\System\KjoTcKY.exe
  2⤵
  PID:6964
- C:\Windows\System\CcPmqpC.exe
  C:\Windows\System\CcPmqpC.exe
  2⤵
  PID:2624
- C:\Windows\System\HrfgncI.exe
  C:\Windows\System\HrfgncI.exe
  2⤵
  PID:10696
- C:\Windows\System\hAXQXtc.exe
  C:\Windows\System\hAXQXtc.exe
  2⤵
  PID:6652
- C:\Windows\System\lmsqafE.exe
  C:\Windows\System\lmsqafE.exe
  2⤵
  PID:7696
- C:\Windows\System\SqiSkTZ.exe
  C:\Windows\System\SqiSkTZ.exe
  2⤵
  PID:4636
- C:\Windows\System\GkctaoU.exe
  C:\Windows\System\GkctaoU.exe
  2⤵
  PID:5140
- C:\Windows\System\oCRlPeg.exe
  C:\Windows\System\oCRlPeg.exe
  2⤵
  PID:3216
- C:\Windows\System\FVibfii.exe
  C:\Windows\System\FVibfii.exe
  2⤵
  PID:10884
- C:\Windows\System\KnNjDQr.exe
  C:\Windows\System\KnNjDQr.exe
  2⤵
  PID:10920
- C:\Windows\System\hyMcTfd.exe
  C:\Windows\System\hyMcTfd.exe
  2⤵
  PID:7924
- C:\Windows\System\NrBiAsU.exe
  C:\Windows\System\NrBiAsU.exe
  2⤵
  PID:5776
- C:\Windows\System\tReubvz.exe
  C:\Windows\System\tReubvz.exe
  2⤵
  PID:3572
- C:\Windows\System\XUhbOPX.exe
  C:\Windows\System\XUhbOPX.exe
  2⤵
  PID:8008
- C:\Windows\System\uPYfumI.exe
  C:\Windows\System\uPYfumI.exe
  2⤵
  PID:428
- C:\Windows\System\SZQRvmM.exe
  C:\Windows\System\SZQRvmM.exe
  2⤵
  PID:11200
- C:\Windows\System\fqKMmPG.exe
  C:\Windows\System\fqKMmPG.exe
  2⤵
  PID:5516
- C:\Windows\System\ZwEPfxW.exe
  C:\Windows\System\ZwEPfxW.exe
  2⤵
  PID:14192
- C:\Windows\System\pbHdczp.exe
  C:\Windows\System\pbHdczp.exe
  2⤵
  PID:8180
- C:\Windows\System\bdozEuK.exe
  C:\Windows\System\bdozEuK.exe
  2⤵
  PID:11004
- C:\Windows\System\PTPTZoy.exe
  C:\Windows\System\PTPTZoy.exe
  2⤵
  PID:10396
- C:\Windows\System\gIzZnnQ.exe
  C:\Windows\System\gIzZnnQ.exe
  2⤵
  PID:5668
- C:\Windows\System\FddwogB.exe
  C:\Windows\System\FddwogB.exe
  2⤵
  PID:8480
- C:\Windows\System\ktZywud.exe
  C:\Windows\System\ktZywud.exe
  2⤵
  PID:8608
- C:\Windows\System\IaDZTke.exe
  C:\Windows\System\IaDZTke.exe
  2⤵
  PID:10816
- C:\Windows\System\bAqUKwM.exe
  C:\Windows\System\bAqUKwM.exe
  2⤵
  PID:6940
- C:\Windows\System\sZNYyNd.exe
  C:\Windows\System\sZNYyNd.exe
  2⤵
  PID:11008
- C:\Windows\System\wGnqREQ.exe
  C:\Windows\System\wGnqREQ.exe
  2⤵
  PID:14236
- C:\Windows\System\TsWbcKq.exe
  C:\Windows\System\TsWbcKq.exe
  2⤵
  PID:11260
- C:\Windows\System\msaJydm.exe
  C:\Windows\System\msaJydm.exe
  2⤵
  PID:14324
- C:\Windows\System\QMQNPIu.exe
  C:\Windows\System\QMQNPIu.exe
  2⤵
  PID:10440
- C:\Windows\System\rbmRoTk.exe
  C:\Windows\System\rbmRoTk.exe
  2⤵
  PID:6088
- C:\Windows\System\oIwZHDg.exe
  C:\Windows\System\oIwZHDg.exe
  2⤵
  PID:13464
- C:\Windows\System\JIMnyXV.exe
  C:\Windows\System\JIMnyXV.exe
  2⤵
  PID:6132
- C:\Windows\System\VFzkPAE.exe
  C:\Windows\System\VFzkPAE.exe
  2⤵
  PID:7204
- C:\Windows\System\HhuSugD.exe
  C:\Windows\System\HhuSugD.exe
  2⤵
  PID:13876
- C:\Windows\System\ThRKbpA.exe
  C:\Windows\System\ThRKbpA.exe
  2⤵
  PID:5288
- C:\Windows\System\PVheXem.exe
  C:\Windows\System\PVheXem.exe
  2⤵
  PID:1924
- C:\Windows\System\JJkEVWp.exe
  C:\Windows\System\JJkEVWp.exe
  2⤵
  PID:7344
- C:\Windows\System\qbprfaP.exe
  C:\Windows\System\qbprfaP.exe
  2⤵
  PID:8868
- C:\Windows\System\VpDewgY.exe
  C:\Windows\System\VpDewgY.exe
  2⤵
  PID:11728
- C:\Windows\System\VUKBxfi.exe
  C:\Windows\System\VUKBxfi.exe
  2⤵
  PID:9148
- C:\Windows\System\VxgvKjC.exe
  C:\Windows\System\VxgvKjC.exe
  2⤵
  PID:8464
- C:\Windows\System\xZSMCRX.exe
  C:\Windows\System\xZSMCRX.exe
  2⤵
  PID:11876
- C:\Windows\System\LhhQaFl.exe
  C:\Windows\System\LhhQaFl.exe
  2⤵
  PID:9164
- C:\Windows\System\cuxVGGr.exe
  C:\Windows\System\cuxVGGr.exe
  2⤵
  PID:8940
- C:\Windows\System\dAJjzjZ.exe
  C:\Windows\System\dAJjzjZ.exe
  2⤵
  PID:8820
- C:\Windows\System\VltzamM.exe
  C:\Windows\System\VltzamM.exe
  2⤵
  PID:9424
- C:\Windows\System\rgPZtSq.exe
  C:\Windows\System\rgPZtSq.exe
  2⤵
  PID:9620
- C:\Windows\System\oSJFrVM.exe
  C:\Windows\System\oSJFrVM.exe
  2⤵
  PID:9752
- C:\Windows\System\cjykfez.exe
  C:\Windows\System\cjykfez.exe
  2⤵
  PID:9956
- C:\Windows\System\FEawgff.exe
  C:\Windows\System\FEawgff.exe
  2⤵
  PID:10208
- C:\Windows\System\dcMPGHQ.exe
  C:\Windows\System\dcMPGHQ.exe
  2⤵
  PID:11540
- C:\Windows\System\XcjkBXs.exe
  C:\Windows\System\XcjkBXs.exe
  2⤵
  PID:1548
- C:\Windows\System\BFiPmai.exe
  C:\Windows\System\BFiPmai.exe
  2⤵
  PID:1716
- C:\Windows\System\vTeACul.exe
  C:\Windows\System\vTeACul.exe
  2⤵
  PID:12128
- C:\Windows\System\KdXMgRG.exe
  C:\Windows\System\KdXMgRG.exe
  2⤵
  PID:11948
- C:\Windows\System\kziInlF.exe
  C:\Windows\System\kziInlF.exe
  2⤵
  PID:11680
- C:\Windows\System\APznSfc.exe
  C:\Windows\System\APznSfc.exe
  2⤵
  PID:12292
- C:\Windows\System\zJpnDDm.exe
  C:\Windows\System\zJpnDDm.exe
  2⤵
  PID:12456
- C:\Windows\System\vZriBhI.exe
  C:\Windows\System\vZriBhI.exe
  2⤵
  PID:12736
- C:\Windows\System\CtjIhYh.exe
  C:\Windows\System\CtjIhYh.exe
  2⤵
  PID:12964
- C:\Windows\System\RKcKwMI.exe
  C:\Windows\System\RKcKwMI.exe
  2⤵
  PID:12600
- C:\Windows\System\GichElV.exe
  C:\Windows\System\GichElV.exe
  2⤵
  PID:13276
- C:\Windows\System\xqRQciv.exe
  C:\Windows\System\xqRQciv.exe
  2⤵
  PID:12652
- C:\Windows\System\poNXAVf.exe
  C:\Windows\System\poNXAVf.exe
  2⤵
  PID:5616
- C:\Windows\System\aUlEoqB.exe
  C:\Windows\System\aUlEoqB.exe
  2⤵
  PID:13952
- C:\Windows\System\lpJlsVN.exe
  C:\Windows\System\lpJlsVN.exe
  2⤵
  PID:7812
- C:\Windows\System\IbQCccM.exe
  C:\Windows\System\IbQCccM.exe
  2⤵
  PID:13036
- C:\Windows\System\ZTLZxAI.exe
  C:\Windows\System\ZTLZxAI.exe
  2⤵
  PID:12404
- C:\Windows\System\cyUSWMI.exe
  C:\Windows\System\cyUSWMI.exe
  2⤵
  PID:10304
- C:\Windows\System\dsSEzfv.exe
  C:\Windows\System\dsSEzfv.exe
  2⤵
  PID:6312
- C:\Windows\System\ThKcfLH.exe
  C:\Windows\System\ThKcfLH.exe
  2⤵
  PID:13064
- C:\Windows\System\JSBMbAt.exe
  C:\Windows\System\JSBMbAt.exe
  2⤵
  PID:13424
- C:\Windows\System\hZPPntr.exe
  C:\Windows\System\hZPPntr.exe
  2⤵
  PID:14152
- C:\Windows\System\NMzLyId.exe
  C:\Windows\System\NMzLyId.exe
  2⤵
  PID:6544
- C:\Windows\System\aqmTgMW.exe
  C:\Windows\System\aqmTgMW.exe
  2⤵
  PID:1352
- C:\Windows\System\gzkjmGr.exe
  C:\Windows\System\gzkjmGr.exe
  2⤵
  PID:4236
- C:\Windows\System\wNjTEam.exe
  C:\Windows\System\wNjTEam.exe
  2⤵
  PID:1492
- C:\Windows\System\zCvwTRT.exe
  C:\Windows\System\zCvwTRT.exe
  2⤵
  PID:6792
- C:\Windows\System\xNqcMka.exe
  C:\Windows\System\xNqcMka.exe
  2⤵
  PID:4140
- C:\Windows\System\sxXYkiS.exe
  C:\Windows\System\sxXYkiS.exe
  2⤵
  PID:4336
- C:\Windows\System\DdRhcrg.exe
  C:\Windows\System\DdRhcrg.exe
  2⤵
  PID:3348
- C:\Windows\System\HTGJOcm.exe
  C:\Windows\System\HTGJOcm.exe
  2⤵
  PID:7456
- C:\Windows\System\vdgLint.exe
  C:\Windows\System\vdgLint.exe
  2⤵
  PID:14184
- C:\Windows\System\dxDoFZT.exe
  C:\Windows\System\dxDoFZT.exe
  2⤵
  PID:4220
- C:\Windows\System\LHGGfSE.exe
  C:\Windows\System\LHGGfSE.exe
  2⤵
  PID:8156
- C:\Windows\System\VXPQSiD.exe
  C:\Windows\System\VXPQSiD.exe
  2⤵
  PID:2172
- C:\Windows\System\oONRotL.exe
  C:\Windows\System\oONRotL.exe
  2⤵
  PID:5148
- C:\Windows\System\EtQfaWL.exe
  C:\Windows\System\EtQfaWL.exe
  2⤵
  PID:14300
- C:\Windows\System\pcGwRuP.exe
  C:\Windows\System\pcGwRuP.exe
  2⤵
  PID:13460
- C:\Windows\System\DzwOopO.exe
  C:\Windows\System\DzwOopO.exe
  2⤵
  PID:2856
- C:\Windows\System\RFzfcgc.exe
  C:\Windows\System\RFzfcgc.exe
  2⤵
  PID:8676
- C:\Windows\System\LlBFvWc.exe
  C:\Windows\System\LlBFvWc.exe
  2⤵
  PID:14032
- C:\Windows\System\RPuhmPJ.exe
  C:\Windows\System\RPuhmPJ.exe
  2⤵
  PID:11492
- C:\Windows\System\GvgWxqu.exe
  C:\Windows\System\GvgWxqu.exe
  2⤵
  PID:13648
- C:\Windows\System\yeJUQrz.exe
  C:\Windows\System\yeJUQrz.exe
  2⤵
  PID:8952
- C:\Windows\System\cbKGpkD.exe
  C:\Windows\System\cbKGpkD.exe
  2⤵
  PID:8572
- C:\Windows\System\BzqXiYc.exe
  C:\Windows\System\BzqXiYc.exe
  2⤵
  PID:9104
- C:\Windows\System\UXhqVJn.exe
  C:\Windows\System\UXhqVJn.exe
  2⤵
  PID:8548
- C:\Windows\System\mjZLBTd.exe
  C:\Windows\System\mjZLBTd.exe
  2⤵
  PID:12144
- C:\Windows\System\BoKeTuh.exe
  C:\Windows\System\BoKeTuh.exe
  2⤵
  PID:12252
- C:\Windows\System\vqcPNfW.exe
  C:\Windows\System\vqcPNfW.exe
  2⤵
  PID:11588
- C:\Windows\System\dnROiFm.exe
  C:\Windows\System\dnROiFm.exe
  2⤵
  PID:9868
- C:\Windows\System\gioGbTL.exe
  C:\Windows\System\gioGbTL.exe
  2⤵
  PID:11920
- C:\Windows\System\aIBvIeg.exe
  C:\Windows\System\aIBvIeg.exe
  2⤵
  PID:12648
- C:\Windows\System\hMXHCFx.exe
  C:\Windows\System\hMXHCFx.exe
  2⤵
  PID:12552
- C:\Windows\System\lEESIoY.exe
  C:\Windows\System\lEESIoY.exe
  2⤵
  PID:5156
- C:\Windows\System\mwgdWNU.exe
  C:\Windows\System\mwgdWNU.exe
  2⤵
  PID:13964
- C:\Windows\System\SNqIQWB.exe
  C:\Windows\System\SNqIQWB.exe
  2⤵
  PID:3784
- C:\Windows\System\pXDqEqj.exe
  C:\Windows\System\pXDqEqj.exe
  2⤵
  PID:6264
- C:\Windows\System\JWxBnVJ.exe
  C:\Windows\System\JWxBnVJ.exe
  2⤵
  PID:13508
- C:\Windows\System\USzLarz.exe
  C:\Windows\System\USzLarz.exe
  2⤵
  PID:10576
- C:\Windows\System\ruxwOPJ.exe
  C:\Windows\System\ruxwOPJ.exe
  2⤵
  PID:4988
- C:\Windows\System\vGRUcrJ.exe
  C:\Windows\System\vGRUcrJ.exe
  2⤵
  PID:5032
- C:\Windows\System\mPNFBeh.exe
  C:\Windows\System\mPNFBeh.exe
  2⤵
  PID:8024
- C:\Windows\System\tuRpkSN.exe
  C:\Windows\System\tuRpkSN.exe
  2⤵
  PID:3084
- C:\Windows\System\LMbMzpM.exe
  C:\Windows\System\LMbMzpM.exe
  2⤵
  PID:1244
- C:\Windows\System\sXIfxUr.exe
  C:\Windows\System\sXIfxUr.exe
  2⤵
  PID:884
- C:\Windows\System\vnWyjiG.exe
  C:\Windows\System\vnWyjiG.exe
  2⤵
  PID:7012
- C:\Windows\System\mFXDuEq.exe
  C:\Windows\System\mFXDuEq.exe
  2⤵
  PID:5420
- C:\Windows\System\LmrgmmT.exe
  C:\Windows\System\LmrgmmT.exe
  2⤵
  PID:10748
- C:\Windows\System\gszoJIO.exe
  C:\Windows\System\gszoJIO.exe
  2⤵
  PID:3264
- C:\Windows\System\NJNsWrx.exe
  C:\Windows\System\NJNsWrx.exe
  2⤵
  PID:952
- C:\Windows\System\mkCTEWa.exe
  C:\Windows\System\mkCTEWa.exe
  2⤵
  PID:8536
- C:\Windows\System\wmEINfl.exe
  C:\Windows\System\wmEINfl.exe
  2⤵
  PID:9808
- C:\Windows\System\IvwbdRX.exe
  C:\Windows\System\IvwbdRX.exe
  2⤵
  PID:12264
- C:\Windows\System\BWOoeoc.exe
  C:\Windows\System\BWOoeoc.exe
  2⤵
  PID:12792
- C:\Windows\System\PveAhSn.exe
  C:\Windows\System\PveAhSn.exe
  2⤵
  PID:12920
- C:\Windows\System\zHoQIDm.exe
  C:\Windows\System\zHoQIDm.exe
  2⤵
  PID:2784
- C:\Windows\System\bieGJAf.exe
  C:\Windows\System\bieGJAf.exe
  2⤵
  PID:7252
- C:\Windows\System\AEWthYw.exe
  C:\Windows\System\AEWthYw.exe
  2⤵
  PID:13936
- C:\Windows\System\rYMyfPq.exe
  C:\Windows\System\rYMyfPq.exe
  2⤵
  PID:6396
- C:\Windows\System\jxrSOIz.exe
  C:\Windows\System\jxrSOIz.exe
  2⤵
  PID:2184
- C:\Windows\System\tORUrSj.exe
  C:\Windows\System\tORUrSj.exe
  2⤵
  PID:4852
- C:\Windows\System\XbJYcpp.exe
  C:\Windows\System\XbJYcpp.exe
  2⤵
  PID:1796
- C:\Windows\System\zvxsbXB.exe
  C:\Windows\System\zvxsbXB.exe
  2⤵
  PID:13604
- C:\Windows\System\YwuihRO.exe
  C:\Windows\System\YwuihRO.exe
  2⤵
  PID:12084
- C:\Windows\System\UzicLiC.exe
  C:\Windows\System\UzicLiC.exe
  2⤵
  PID:12512
- C:\Windows\System\wmkqFjq.exe
  C:\Windows\System\wmkqFjq.exe
  2⤵
  PID:5916
- C:\Windows\System\sLrEUbV.exe
  C:\Windows\System\sLrEUbV.exe
  2⤵
  PID:7040
- C:\Windows\System\bQPyGMw.exe
  C:\Windows\System\bQPyGMw.exe
  2⤵
  PID:1632
- C:\Windows\System\jqECgoo.exe
  C:\Windows\System\jqECgoo.exe
  2⤵
  PID:14260
- C:\Windows\System\MWnkZmO.exe
  C:\Windows\System\MWnkZmO.exe
  2⤵
  PID:11860
- C:\Windows\System\ZniwxZM.exe
  C:\Windows\System\ZniwxZM.exe
  2⤵
  PID:4524
- C:\Windows\System\UBYdkeZ.exe
  C:\Windows\System\UBYdkeZ.exe
  2⤵
  PID:5080
- C:\Windows\System\QdOkPPx.exe
  C:\Windows\System\QdOkPPx.exe
  2⤵
  PID:9360
- C:\Windows\System\dXrRiRi.exe
  C:\Windows\System\dXrRiRi.exe
  2⤵
  PID:1292
- C:\Windows\System\LPynxDE.exe
  C:\Windows\System\LPynxDE.exe
  2⤵
  PID:1552
- C:\Windows\System\lpOFOaQ.exe
  C:\Windows\System\lpOFOaQ.exe
  2⤵
  PID:4740
- C:\Windows\System\adtgMRX.exe
  C:\Windows\System\adtgMRX.exe
  2⤵
  PID:11676
- C:\Windows\System\TJBjSRw.exe
  C:\Windows\System\TJBjSRw.exe
  2⤵
  PID:14344
- C:\Windows\System\NmSjgNB.exe
  C:\Windows\System\NmSjgNB.exe
  2⤵
  PID:14372
- C:\Windows\System\FxQuUFB.exe
  C:\Windows\System\FxQuUFB.exe
  2⤵
  PID:14400
- C:\Windows\System\VUpHYKt.exe
  C:\Windows\System\VUpHYKt.exe
  2⤵
  PID:14428
- C:\Windows\System\sWMBAiJ.exe
  C:\Windows\System\sWMBAiJ.exe
  2⤵
  PID:14456
- C:\Windows\System\DOwkart.exe
  C:\Windows\System\DOwkart.exe
  2⤵
  PID:14484
- C:\Windows\System\uHDtxTP.exe
  C:\Windows\System\uHDtxTP.exe
  2⤵
  PID:14516
- C:\Windows\System\eapKKnb.exe
  C:\Windows\System\eapKKnb.exe
  2⤵
  PID:14544
- C:\Windows\System\qKrToNv.exe
  C:\Windows\System\qKrToNv.exe
  2⤵
  PID:14572
- C:\Windows\System\bRypEnk.exe
  C:\Windows\System\bRypEnk.exe
  2⤵
  PID:14600
- C:\Windows\System\CmemiKc.exe
  C:\Windows\System\CmemiKc.exe
  2⤵
  PID:14628
- C:\Windows\System\fSZQtAw.exe
  C:\Windows\System\fSZQtAw.exe
  2⤵
  PID:14656
- C:\Windows\System\sufmYek.exe
  C:\Windows\System\sufmYek.exe
  2⤵
  PID:14684
- C:\Windows\System\RfGCGeV.exe
  C:\Windows\System\RfGCGeV.exe
  2⤵
  PID:14712
- C:\Windows\System\JeqdUSV.exe
  C:\Windows\System\JeqdUSV.exe
  2⤵
  PID:14740
- C:\Windows\System\gfKcPVC.exe
  C:\Windows\System\gfKcPVC.exe
  2⤵
  PID:14768
- C:\Windows\System\VnWaWeg.exe
  C:\Windows\System\VnWaWeg.exe
  2⤵
  PID:14796
- C:\Windows\System\dDIdhnk.exe
  C:\Windows\System\dDIdhnk.exe
  2⤵
  PID:15320
- C:\Windows\System\EWzYrWG.exe
  C:\Windows\System\EWzYrWG.exe
  2⤵
  PID:15356
- C:\Windows\System\nwnKyvZ.exe
  C:\Windows\System\nwnKyvZ.exe
  2⤵
  PID:14868
- C:\Windows\System\lXusySW.exe
  C:\Windows\System\lXusySW.exe
  2⤵
  PID:7328
- C:\Windows\System\ymhVall.exe
  C:\Windows\System\ymhVall.exe
  2⤵
  PID:14692
- C:\Windows\System\DeGITqh.exe
  C:\Windows\System\DeGITqh.exe
  2⤵
  PID:64
- C:\Windows\System\MfbTqiB.exe
  C:\Windows\System\MfbTqiB.exe
  2⤵
  PID:7772
- C:\Windows\System\xYCvcbq.exe
  C:\Windows\System\xYCvcbq.exe
  2⤵
  PID:14816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_lfhafer5.vfp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lfhafer5.vfp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ABusexm.exe

Path C:\Windows\System\ABusexm.exe
Size 2.8MB
SHA256 baa9776680bc7244074ff85d87e14fc48e2b1de804fadd9b2d21e506e21743d4
MD5 8d7ab8fdb7285ebce557049fc2f7e865
SHA1 6eb92a3e37af8e8689c329fc96571b9d012e17c7
SHA512 f1e523a514427e2714107ce484ec3693ca38da40b033382d4855fe3b9e0771525ca0711b7329fcbcb51e68abbb374ded62cd0fe1197e8f2636074a38f04ca5d8
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBb:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AZfIIQn.exe

Path C:\Windows\System\AZfIIQn.exe
Size 2.8MB
SHA256 4cae5e1d9a5c10910ed8516ad6beaa7219340588caab5657529db3fe1d24743a
MD5 fbd75688f583d5d12df60d9529d3d08d
SHA1 a99cdc14c31f651b905a61fbe114517ae6ef961f
SHA512 5fc8c41d81ae127ff8d3d8eb4387b16ab309df845a352ad6ce609e281010654a1fc3c3e959552225db1309ee9385306b1a6eee4559dfe5614df4953d1f82c824
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBj:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

AcIZRRr.exe

Path C:\Windows\System\AcIZRRr.exe
Size 2.8MB
SHA256 85c52afe1959d25f73a72fccaba51c4cec41e9f5e589861a6197099bfbc35414
MD5 6673d9f014300abab909bfde1c6faa41
SHA1 d209a1bdb3b44eca2cad6af1060076f6a32783bb
SHA512 1b87203b34d5ff990950c26383f8585bcc980b29769d2fd68b2b51c8c0f1a40bac40f7ad7bd875dfe30111dcb0f752b605cdf17558ac1836e67d99ce97d3abc5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB/:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ArPxLXH.exe

Path C:\Windows\System\ArPxLXH.exe
Size 2.8MB
SHA256 d90ed5a0d1a66627c1fa026a0595943fa859046a08a16e10dcf845c48ff688b0
MD5 eaa27663ea95cc23afe6b37fa7ffa386
SHA1 c8e93eaa88d0224f3a35ba0d0954fe96bbe07303
SHA512 8e78a89be32df3d287db9b79d0bbfeac012bc65a166d3826d0605fe5047956dff7f6f70023b180c585b4f31fb951a069a5ff028ad09ab4fade5d30e8250c9805
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBM:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

AzehwCb.exe

Path C:\Windows\System\AzehwCb.exe
Size 2.8MB
SHA256 c147605f01f8e4f8b06126bc723f6964a852ca37180217d3d497931516d59d84
MD5 4e6bbb30cecae456cb398cb32db0e7f8
SHA1 e219027aa6c49dd123e835102ebcbbe0ffb668a4
SHA512 df4bd59d68f65545e8a15dab9c3ed966f873ba7b0fb9440492f496be9afafbfb2ffb49f38a052daa15fd1193ec2f399a31b94c4b31e3a39ce87d71d86f2ac953
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB0:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

DNDKwlx.exe

Path C:\Windows\System\DNDKwlx.exe
Size 2.8MB
SHA256 f0f5bcd79ddcb6c565f07b4a7e360ef39cda04a507d1cebc1060545ff0323616
MD5 94c52d9984d44a62dc6b1400dec96309
SHA1 f7eb213818c388913024c8ee69a04522e8ba7bc4
SHA512 9fd8f5e9912bb671ee842a1869a7b2ac861081dde8a1f446d88c4bfcdb0d2af9041000e4c79890b15c17972d3f8425797de49d8430981a155fa6da7a752cc0cd
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBM:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

GBjAdyf.exe

Path C:\Windows\System\GBjAdyf.exe
Size 2.8MB
SHA256 f8b64fef6085140784f98564405e5da13f188f7a4568faf959d5e8fef01380ad
MD5 9158469f703f843fc59dd8026a554f79
SHA1 994530349b67a75397b4678ca132047afe6e5a61
SHA512 b4bda182e9d6273793e1e684c88e0d6355f766c4917b45485f3fea8983af39c2dd59af76131a8ef842dcaa573d70b5ea803f4e6ba1ee4a3ccac225005a8e8ac6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBO:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

HMgaoqA.exe

Path C:\Windows\System\HMgaoqA.exe
Size 2.8MB
SHA256 76ec27123c9e3899c684ac04400344099aae0f77d5c0cc53842af748c1c58eff
MD5 ed5abbf22cc83402fe277820f88c8738
SHA1 52f9933b748c059d415c86934160d3f2042bc357
SHA512 823765328cf8574b324399d2c7a49fa64684ec8368fc58d8eef3718d37b6ff79881f08686fbbff82fd8ab78dfba38efd513cb729661b1a0d6d2525631721ce3d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBU:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

JwrIVpx.exe

Path C:\Windows\System\JwrIVpx.exe
Size 2.9MB
SHA256 3e462e65e19731a7bff3af126121bd431264d9d25b359e7b9d9743f4a6e72869
MD5 21d58ef5e9a5681eb8df828dc0703fbc
SHA1 05960df4e031222d3b3e3c8d6e5684cc5b731ca7
SHA512 4b9d497c2e105acb434adaf454f543221c9a17bdca273111dd8965203b137cf687f668904fd097f4cdbf9ca1eba6b27245765de1689df1365b9a7a7a0436ecc8
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBs:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

LLtAreI.exe

Path C:\Windows\System\LLtAreI.exe
Size 2.9MB
SHA256 4c8e6717260f33d5c229a8f0c433838a6de0218223865fa78b780d66a23cefd5
MD5 1031400ab9ca73e3565700d8bee2813d
SHA1 1168ca825cb9953d3f8685dc4d49c7e1aef8a48b
SHA512 cb79e9b04aaffb86894d647415672a7b01d3e6cade06db1b822cc93d156c8064faf265a73d20de4411b36010c7181e7ce0bed4110838f02b49d86b42c4d248f7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBw:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

LRTzoes.exe

Path C:\Windows\System\LRTzoes.exe
Size 2.8MB
SHA256 afbe8a8259156d5ea8ca68eaa1abeac805e905534ef7d66f8547aaff43d28c77
MD5 2271e263b417b770ac456b4667d80ceb
SHA1 13da1fbc10038500db0f24f7650b46687be0e5d2
SHA512 e05d41289b1fe3996e4dd670e44fff9b01b8e694297d9e636f5c3f10eb944be061ac03ee8ffe844c2b485f292774ead0eacb159132101c56d2eee40e6a09759c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBy:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

LgImueF.exe

Path C:\Windows\System\LgImueF.exe
Size 2.8MB
SHA256 5d04e01d33d2bd3909cb8e125ddf3ca8f8e227b096b01b11c3a060636dabb280
MD5 6297d87d04b32b5a9d14a546226c3985
SHA1 99c7534aaae0fb415713f66d15d8f08a051b836e
SHA512 45d64f4d742f24f8ef46ce66591fb014f3a8c49b94851022fd480c236a81f57fd28bc34a37626ce2629833105913df8f7414f4b9ce9dde8a1e13cd5db82ffbf5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBe:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

MLCIsPS.exe

Path C:\Windows\System\MLCIsPS.exe
Size 2.8MB
SHA256 4a158625a2d8c40e23781ebdd0a17d28b2453503d65d0b753d3b2c2c05c572a1
MD5 c13b86f1b9d5c1f65599b592420b5523
SHA1 3ccbbd41cfa90f052df208a633dd2cef9beb9965
SHA512 cffac8d06fff5dd59747daa12fa49bd129a4ea7405c8511e66dd60bb6f4a1187e18d27a356bb5d472ecc3cf8ea6341b70f4358d251a063cc500dae7576506f6a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBI:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RM
MD5 SHA1 SHA512 SSDEEP

Submit Download

MzttrCa.exe

Path C:\Windows\System\MzttrCa.exe
Size 2.8MB
SHA256 a01cefee2fe4ec2edea56d6c81241d4fe2fad3092a4cabbd04a382b79fab1702
MD5 86d46915de85597930cc649d602029ed
SHA1 c3554803b55612baf15139303d691f86fcd99569
SHA512 6800aec90d0ae4879e61bd2a0a56426acd30fbd6c30b05002023e1839a3729d19e65207c6e2118412db402e18145cb742d37bba95f8a7078c607f229f8977901
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBu:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

NfdSEke.exe

Path C:\Windows\System\NfdSEke.exe
Size 2.8MB
SHA256 636cf2b208bc77e386be8ebc176842cbd9481ff8535ca22d45d52d86c18fd04e
MD5 db2094645c8e4df50a391d99a39c6952
SHA1 a7ca20d54893a1aab9f3424e2268382db9696e05
SHA512 ae06531dcdb062e65f4aac4eb53e9f89a7c0cf451fb8e83d986c86ac69822c987f1a5c44ddc6ead8446fcd2a0eb223c0e017ce6e87d2153e47ea748dfc789adf
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBI:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

QuTCMYN.exe

Path C:\Windows\System\QuTCMYN.exe
Size 2.8MB
SHA256 fdbb732b22e3a2419aa7550b7a1c6e069ffc825523a71ef11140f47bd46ecb16
MD5 02fdcf97245a90d7cd6affa3ac4c57fd
SHA1 2dc605e9c3b0dc17b15bb9d91b17f4bf6988d8a4
SHA512 c05b952e47b1282615b12204a29399d5eda6ccadafd13f27f686999a2303d88a350be6fd04547226ab253bcd7e15d565ec5b23627e92fd3f1182aee56ae9aa73
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBP:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

SwMUjYw.exe

Path C:\Windows\System\SwMUjYw.exe
Size 2.8MB
SHA256 0a5cd56f8a658273af48a4ce45b26cd2434d2d3ab88752c88766b31955cdc0f1
MD5 bf1f3fdf9a0d3e6035dc4b7df50bafb6
SHA1 99f7357ff8739e3dff9c9575a655b8a25ae92783
SHA512 99035b161bf08114b743e8706c8de59a0de87185b0583a6a9848bb11ead1bed398b3dc2cde5d5d0f2911b50a7d192466813eb94c198255ed302f7aba7ef1a6c1
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBK:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

VdrHrjP.exe

Path C:\Windows\System\VdrHrjP.exe
Size 2.8MB
SHA256 36e42783d35235f2912539e4b3d8f47c0aabb5acf2dddc4dba0fc4c2fd573c51
MD5 63f7d7fcd54285a573d02160f93cf784
SHA1 b3ce951856a4e7f3ef659108c07dc3ecd1a0c68b
SHA512 b09196aebc79199b1713a0c6413d6380e99ce1d5110d74fe701ebeb33797d4b611e0676fd79f2ed7170143613642cfc5163a13c1dbdd3afc1152324e192b07b6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBa:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaTVMoe.exe

Path C:\Windows\System\WaTVMoe.exe
Size 2.8MB
SHA256 350b116051acce3cc739ef07bce6043ebf9d69754604e249b5bbb143dcc69a36
MD5 d4c5f231f1793d633abca2ba1d944795
SHA1 c24e527f20bdc0bb12c7dd0590300f61f2f868c6
SHA512 795e4dc0def20467d1d1dbf0b950551dfc13a73bc348dea6cef332f517f1bf81622b64add1470fc0b6177d3ab88226bbb77060c07d63369dc84575b4919e34f2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBE:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

bNETvts.exe

Path C:\Windows\System\bNETvts.exe
Size 18B
SHA256 c14bc0d583a2e28b394647d06f8fa7c0ff4cba50b7739e8641ff8669f7856a43
MD5 d4c53945d0b50cca8ee3c39950f75a96
SHA1 b80a0451cdd1f089663f9ee7b74d1e73ad057fdf
SHA512 298bc37c5e19145fc001cebfa843e38909335e86d2dcf1fd6f1a57c9dd72abb4d7c4e4ca9f9b743b79fd750b428a6154b00b7c45d2e633fde4a9fab32fec45b0
MD5 SHA1 SHA512

Submit Download

bQywoxw.exe

Path C:\Windows\System\bQywoxw.exe
Size 2.8MB
SHA256 1201c7b8bf043a08812133dfdafdc7f2b2b06bcd8c126d2905f59594122a6368
MD5 d592093fd86d74c3ff778ae159b299f0
SHA1 78f8f5a9dd7b215b949be08088c1620fce672b68
SHA512 0a94cf9228014dd398580535b921533610a4967398957a834a86deb48c97fcb305d49b5cdb23b6e9d4a026b2d17bcf1df2a457463c6d058cd14478933373daae
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBO:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbpXqcI.exe

Path C:\Windows\System\bbpXqcI.exe
Size 2.8MB
SHA256 a0089ad7998b6a862f0078004240fd4920d8509de125106952461b7cb8e4ac92
MD5 9e95f1032a1dd93a815b19e4eb83bf79
SHA1 dcdbe2c7d314f770da61201458f3cac2070396c6
SHA512 34850a18ea38b01820d181c2a2601fb44a1141c2c67e43588f6fc05e33f927e491910cfa5244b55451908f96b7c6e17091b73a9731e66fd2b040e3a984615aaa
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBN:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpRReZD.exe

Path C:\Windows\System\cpRReZD.exe
Size 2.8MB
SHA256 610d05c8e469490890c7a1b9b834b05f1471ecef8b9dfed7f481e39e6f62457a
MD5 e00b354e32e269b080f80264d203f70b
SHA1 cfaee5135ae616c2b45ad67393bc492c2e783a0f
SHA512 792933b093aa3a0aa6bb86bd60f46f1e4f4e846dfd9111fea6f1dcd6d7f76044c89913a9caf8e28f7e65c322a939f6562167f2c2747c9c29a329737b02520699
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBy:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

dRTSTfU.exe

Path C:\Windows\System\dRTSTfU.exe
Size 8B
SHA256 ada8e0c66fd35906bd1beeda81d420b6e5f6b475841d10e62bd6374afbeacb69
MD5 69a2459cf267ca53a07e1000877ec5f5
SHA1 6180fdab39e41b082a5f032106ea0881035fc630
SHA512 856cc19353d1aa3d8ce28f9d4a1fe10bf85ecb48b19883b3993f89b4192a7bd4dbaf2f158bd3e246dfcbb6a46252185b62c3e867aadc7a9e5bf0721b6b86c55b
MD5 SHA1 SHA512

Submit Download

hZYzqHX.exe

Path C:\Windows\System\hZYzqHX.exe
Size 2.8MB
SHA256 043e69aaeed441c16cb9afb3c8093ff41809d4919c67d2d0e5f7d6723b87fd60
MD5 04a993974c08ae22b9442521830d803e
SHA1 111e0f3331271ca0193f20ed8555a23adbae86b1
SHA512 37e0ff4c76f503ec8362bb48ffe39be98d4c727eaa71873cd0539e7a91d66cd26e4404cd0314e9be051f3afdba6857f599d25abc92ccf6ce1151755b87d29bd6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB1:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

hfUHIub.exe

Path C:\Windows\System\hfUHIub.exe
Size 2.8MB
SHA256 8b32f4e56af867e087481c25eb8735c5df7bbfa43fc9e67e0559361d139eb0e1
MD5 92904c9525829b53d273addac228437b
SHA1 475de380aa9ebe9ff76db6d60ba8b0bae8e0f136
SHA512 b4a505a162c88c8ba113661629a08b8b592b1ca32270fd673c4e98d3deae49d4ce76a481fc46d4b741393457d31b500c731ec37b36745336775c6fee1aabcb4e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iDvJljt.exe

Path C:\Windows\System\iDvJljt.exe
Size 2.9MB
SHA256 f0b55a968c5a04ff9e39414e42895f900e1d9343bf2c3fa1d616360596c9b6d6
MD5 075973e11a1543ef606f17251c649771
SHA1 d5d0ee6168315ada37c0d0d76fbbe07c0aa30104
SHA512 5914482bda55d6a81824718ac928c56f12e10ce9d76e439d960a971848a3341931d2c794f85b1c98accdbfa79d64749a71996e0278c95dd45330863b5862fc77
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBx:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

jGqPsbo.exe

Path C:\Windows\System\jGqPsbo.exe
Size 2.8MB
SHA256 9fc4875f61fe7c0afd0d4180b6f14b183f6ce63070fb85b62eb3dbe0ed205065
MD5 8bf0ed63122aff4a4f4d4153b75c915c
SHA1 3406012d64a5ecc4615de12a2b6f235a1cd2c08f
SHA512 c7224e6b0a1978bcbe60dc28402b2626cd2eba31d4d76b9e08986f73d71fd2a7ff39cd58b9f479985713044bb12a7b0a1e255de2a0426ee893a6c0fb20f9392a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBB:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd
MD5 SHA1 SHA512 SSDEEP

Submit Download

lVmScCp.exe

Path C:\Windows\System\lVmScCp.exe
Size 2.8MB
SHA256 c8d64874a4046890fcd6c870f5e61aad9471eafdc182dac20cddedaceb58d150
MD5 fe431809168aa1e994bde0153886586b
SHA1 588154280801e8aa5996ebb26a85caf5ae2c384a
SHA512 841590524a73ef4e382db6d548e0bad754724df2484ce9ea6dd4d88423769adff17b096c2187b8344d31551d747b7e47cb9fe08550f679a3e2adb4e1e3f1de4f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB/:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

lYZWzPK.exe

Path C:\Windows\System\lYZWzPK.exe
Size 2.9MB
SHA256 70557b958dfe022fc354c852648cbc5f98af14f65ce134d734537dafdeda7470
MD5 6dd0bc2cd0d234da0566246a7a97d4f0
SHA1 c6c819e03cdbb9595f7db6b546b0e7e685bc7c1d
SHA512 385bb26ade73a651d8c13df259086a805ba82930cb893ff2f8343e9248186e77a9d5b686578b94a2d720d86d1663741c563a53fe07bf22298235a51268bc070c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB6:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

xDgFaWC.exe

Path C:\Windows\System\xDgFaWC.exe
Size 2.8MB
SHA256 04958e842c87d167addca3b27dd911bb11f16c2fe5384700292b37858b30ed37
MD5 33ab4cff6cf6522f9327db76da80ac6f
SHA1 8d3324f0288893e6eafeed6d05ac4288e0c99495
SHA512 827c494dee8417b87ba9c9d80f2895b63d54c07ce7fe00be2edbb9b1e48d76ac8c51630710be2d1b66e08656549bcf09253cd7ac2228d3ffc235f8ed5331c6a3
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXB9:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

xYHfrFt.exe

Path C:\Windows\System\xYHfrFt.exe
Size 2.8MB
SHA256 7bd4fe381f336cd10b82194e639434f06949b1156d7790812e3cf4c079cb9e5f
MD5 410043cf40dddc23364cc1acba9ac73c
SHA1 900fa20c7073bf202de0564cbf8a0a66032734ed
SHA512 f33451891e7e82fade57a3b1bc14d07439aabf5afc34f62c05e22c4df7ff5cefa935395f21759a867a03991079445488d2548ff679154d24f1324abf0b19d820
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBe:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylusOpH.exe

Path C:\Windows\System\ylusOpH.exe
Size 2.8MB
SHA256 79de910793d008ce9321292e915183423594e0d3212f5b69bb0511690923aa2a
MD5 835ae32b3ff8322fefb1049ccf14c146
SHA1 eb3206f2bdfe29f71130af295f8130956e7ab38e
SHA512 16d8c9aa6c05ddd3df9edabbc7e52aeb5c4c571c45695230631b5046fc5dc204757ed220a53be17c4cdd1c00e8c2124e3b1aea7501a98a5f313ea8dab7b3aa66
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBv:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

yrZRDgi.exe

Path C:\Windows\System\yrZRDgi.exe
Size 2.9MB
SHA256 2c362daaca84e46435cdd1eb2dfed984c98bd5aa4caddb7b4b66691746d59a4b
MD5 f9479ba384b045b879726399c55ec5e6
SHA1 03a55c6d32ff14714c4d4790f06ab21247ecf376
SHA512 f76b43198e535d8d28c8666cd5f28d5c937251b07071ff5890eef0e5721a48af494ba640ed1c2d6c70bfd1d133c1c264f33c6e274e89b9e63c51ac44a6b3b867
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZXBm:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ry
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/752-79-0x00007FF6E4BA0000-0x00007FF6E4F96000-memory.dmp

Download

memory/876-56-0x00007FF6B7820000-0x00007FF6B7C16000-memory.dmp

Download

memory/876-4614-0x00007FF6B7820000-0x00007FF6B7C16000-memory.dmp

Download

memory/976-245-0x00007FF6E6220000-0x00007FF6E6616000-memory.dmp

Download

memory/1164-65-0x00007FF7A44F0000-0x00007FF7A48E6000-memory.dmp

Download

memory/1456-6221-0x00007FF75A7E0000-0x00007FF75ABD6000-memory.dmp

Download

memory/1456-254-0x00007FF75A7E0000-0x00007FF75ABD6000-memory.dmp

Download

memory/1540-4582-0x00007FF68AE20000-0x00007FF68B216000-memory.dmp

Download

memory/1540-54-0x00007FF68AE20000-0x00007FF68B216000-memory.dmp

Download

memory/1848-135-0x00007FF6D1630000-0x00007FF6D1A26000-memory.dmp

Download

memory/1848-2311-0x00007FF6D1630000-0x00007FF6D1A26000-memory.dmp

Download

memory/1980-119-0x00007FF6A50F0000-0x00007FF6A54E6000-memory.dmp

Download

memory/1980-5317-0x00007FF6A50F0000-0x00007FF6A54E6000-memory.dmp

Download

memory/2256-131-0x00007FF62F570000-0x00007FF62F966000-memory.dmp

Download

memory/2408-69-0x00007FF77D420000-0x00007FF77D816000-memory.dmp

Download

memory/2452-1-0x0000024D1FCC0000-0x0000024D1FCD0000-memory.dmp

Download

memory/2452-745-0x00007FF65A9B0000-0x00007FF65ADA6000-memory.dmp

Download

memory/2452-0-0x00007FF65A9B0000-0x00007FF65ADA6000-memory.dmp

Download

memory/2476-48-0x00007FFFA3D00000-0x00007FFFA47C1000-memory.dmp

Download

memory/2476-27-0x000001B4BFE30000-0x000001B4BFE52000-memory.dmp

Download

memory/2476-17-0x00007FFFA3D00000-0x00007FFFA47C1000-memory.dmp

Download

memory/2476-1147-0x00007FFFA3D03000-0x00007FFFA3D05000-memory.dmp

Download

memory/2476-3-0x00007FFFA3D03000-0x00007FFFA3D05000-memory.dmp

Download

memory/2476-753-0x00007FFFA3D00000-0x00007FFFA47C1000-memory.dmp

Download

memory/2476-233-0x000001B4BFE60000-0x000001B4C007C000-memory.dmp

Download

memory/2476-70-0x000001B4C0C70000-0x000001B4C1416000-memory.dmp

Download

memory/2520-2309-0x00007FF703750000-0x00007FF703B46000-memory.dmp

Download

memory/2520-134-0x00007FF703750000-0x00007FF703B46000-memory.dmp

Download

memory/2876-68-0x00007FF7DF5A0000-0x00007FF7DF996000-memory.dmp

Download

memory/2968-121-0x00007FF720B30000-0x00007FF720F26000-memory.dmp

Download

memory/2968-5324-0x00007FF720B30000-0x00007FF720F26000-memory.dmp

Download

memory/3192-67-0x00007FF6C0F70000-0x00007FF6C1366000-memory.dmp

Download

memory/3488-61-0x00007FF611C10000-0x00007FF612006000-memory.dmp

Download

memory/3588-139-0x00007FF76F790000-0x00007FF76FB86000-memory.dmp

Download

memory/3588-5327-0x00007FF76F790000-0x00007FF76FB86000-memory.dmp

Download

memory/3816-133-0x00007FF647F30000-0x00007FF648326000-memory.dmp

Download

memory/4024-1812-0x00007FF7E05F0000-0x00007FF7E09E6000-memory.dmp

Download

memory/4024-105-0x00007FF7E05F0000-0x00007FF7E09E6000-memory.dmp

Download

memory/4068-66-0x00007FF75B450000-0x00007FF75B846000-memory.dmp

Download

memory/4568-114-0x00007FF6A89A0000-0x00007FF6A8D96000-memory.dmp

Download

memory/4588-250-0x00007FF7BE820000-0x00007FF7BEC16000-memory.dmp

Download

memory/4656-93-0x00007FF716150000-0x00007FF716546000-memory.dmp

Download

memory/4656-1808-0x00007FF716150000-0x00007FF716546000-memory.dmp

Download

memory/4708-62-0x00007FF74A8C0000-0x00007FF74ACB6000-memory.dmp

Download

memory/5040-140-0x00007FF6099C0000-0x00007FF609DB6000-memory.dmp

Download