xmrig | 9816d1113d85fc71302fbb0bb931d2420b531b33ff07bee1a21c3ad35ee8aa26

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
Size 2.8MB
Sample240612-c8ezjayhrf
SHA256 9816d1113d85fc71302fbb0bb931d2420b531b33ff07bee1a21c3ad35ee8aa26
MD5 18f9d9e1c32cb0b687e5580126caed80
SHA1 d24cc6b46e28e5f1c99f14752d3824f53edf1d97
SHA512 6a6011c753eaed83ffabbc8d511a2f201a6766f4e691af3523222bf02b4f2413863562d6e97bc6c315f4160e22860ef3d3b0db2c2b48ce2ac0b701c759c8f989
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf244:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ro
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4384-0-0x00007FF7562E0000-0x00007FF7566D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023402-8.dat	xmrig
behavioral2/files/0x00090000000233f3-9.dat	xmrig
behavioral2/files/0x0007000000023404-30.dat	xmrig
behavioral2/files/0x0007000000023403-21.dat	xmrig
behavioral2/files/0x000d000000023383-13.dat	xmrig
behavioral2/files/0x000700000002340a-62.dat	xmrig
behavioral2/files/0x0008000000023407-69.dat	xmrig
behavioral2/files/0x000700000002340b-77.dat	xmrig
behavioral2/files/0x000700000002340e-89.dat	xmrig
behavioral2/files/0x000700000002340f-97.dat	xmrig
behavioral2/files/0x0007000000023410-103.dat	xmrig
behavioral2/files/0x0007000000023413-114.dat	xmrig
behavioral2/files/0x0007000000023414-123.dat	xmrig
behavioral2/files/0x0007000000023416-133.dat	xmrig
behavioral2/files/0x000700000002341d-168.dat	xmrig
behavioral2/memory/5040-621-0x00007FF68A1F0000-0x00007FF68A5E6000-memory.dmp	xmrig
behavioral2/memory/2776-622-0x00007FF712A70000-0x00007FF712E66000-memory.dmp	xmrig
behavioral2/memory/4208-623-0x00007FF6AA8A0000-0x00007FF6AAC96000-memory.dmp	xmrig
behavioral2/memory/1900-624-0x00007FF650AE0000-0x00007FF650ED6000-memory.dmp	xmrig
behavioral2/memory/3500-625-0x00007FF768E50000-0x00007FF769246000-memory.dmp	xmrig
behavioral2/memory/1736-626-0x00007FF7EDC50000-0x00007FF7EE046000-memory.dmp	xmrig
behavioral2/memory/4836-627-0x00007FF718750000-0x00007FF718B46000-memory.dmp	xmrig
behavioral2/memory/1468-628-0x00007FF70E8B0000-0x00007FF70ECA6000-memory.dmp	xmrig
behavioral2/memory/3240-629-0x00007FF7EFC60000-0x00007FF7F0056000-memory.dmp	xmrig
behavioral2/memory/4808-630-0x00007FF6CCD60000-0x00007FF6CD156000-memory.dmp	xmrig
behavioral2/memory/4536-631-0x00007FF7A56B0000-0x00007FF7A5AA6000-memory.dmp	xmrig
behavioral2/memory/2108-639-0x00007FF712450000-0x00007FF712846000-memory.dmp	xmrig
behavioral2/memory/4256-646-0x00007FF63F290000-0x00007FF63F686000-memory.dmp	xmrig
behavioral2/memory/1744-655-0x00007FF780690000-0x00007FF780A86000-memory.dmp	xmrig
behavioral2/memory/4220-649-0x00007FF6A3710000-0x00007FF6A3B06000-memory.dmp	xmrig
behavioral2/memory/1404-660-0x00007FF7DC320000-0x00007FF7DC716000-memory.dmp	xmrig
behavioral2/memory/4484-664-0x00007FF6D8B20000-0x00007FF6D8F16000-memory.dmp	xmrig
behavioral2/memory/4036-666-0x00007FF785590000-0x00007FF785986000-memory.dmp	xmrig
behavioral2/memory/3088-678-0x00007FF65BE50000-0x00007FF65C246000-memory.dmp	xmrig
behavioral2/memory/908-681-0x00007FF6F6250000-0x00007FF6F6646000-memory.dmp	xmrig
behavioral2/memory/3420-669-0x00007FF714940000-0x00007FF714D36000-memory.dmp	xmrig
behavioral2/memory/2944-657-0x00007FF7CB9E0000-0x00007FF7CBDD6000-memory.dmp	xmrig
behavioral2/memory/1408-689-0x00007FF7ED630000-0x00007FF7EDA26000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-177.dat	xmrig
behavioral2/files/0x000700000002341f-174.dat	xmrig
behavioral2/files/0x000700000002341e-172.dat	xmrig
behavioral2/files/0x000700000002341c-162.dat	xmrig
behavioral2/files/0x000700000002341b-158.dat	xmrig
behavioral2/files/0x000700000002341a-152.dat	xmrig
behavioral2/files/0x0007000000023419-148.dat	xmrig
behavioral2/files/0x0007000000023418-142.dat	xmrig
behavioral2/files/0x0007000000023417-138.dat	xmrig
behavioral2/files/0x0007000000023415-128.dat	xmrig
behavioral2/files/0x0007000000023412-112.dat	xmrig
behavioral2/files/0x0007000000023411-108.dat	xmrig
behavioral2/files/0x000700000002340d-87.dat	xmrig
behavioral2/files/0x000700000002340c-83.dat	xmrig
behavioral2/files/0x0007000000023409-63.dat	xmrig
behavioral2/files/0x0008000000023408-58.dat	xmrig
behavioral2/files/0x0007000000023406-55.dat	xmrig
behavioral2/files/0x0007000000023405-45.dat	xmrig
behavioral2/memory/3316-44-0x00007FF771510000-0x00007FF771906000-memory.dmp	xmrig
behavioral2/memory/3088-1987-0x00007FF65BE50000-0x00007FF65C246000-memory.dmp	xmrig
behavioral2/memory/3316-1989-0x00007FF771510000-0x00007FF771906000-memory.dmp	xmrig
behavioral2/memory/2776-1988-0x00007FF712A70000-0x00007FF712E66000-memory.dmp	xmrig
behavioral2/memory/5040-1990-0x00007FF68A1F0000-0x00007FF68A5E6000-memory.dmp	xmrig
behavioral2/memory/4208-1991-0x00007FF6AA8A0000-0x00007FF6AAC96000-memory.dmp	xmrig
behavioral2/memory/908-1992-0x00007FF6F6250000-0x00007FF6F6646000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3040	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3088	ekdiXxc.exe
3316	MNcNSga.exe
5040	EIFZkPv.exe
2776	SihyadS.exe
4208	rKJGLcF.exe
908	vxkUsOH.exe
1408	FheGQmF.exe
1900	ROGlYki.exe
3500	AxLcbjY.exe
1736	CNmNGdb.exe
4836	zTxCBPh.exe
1468	ihMjXXg.exe
3240	zSbQutX.exe
4808	pehMfSV.exe
4536	RBOWzmO.exe
2108	CdtkCVT.exe
4256	cSpsppD.exe
4220	CXoGgct.exe
1744	JOxFqBG.exe
2944	cHdgHJU.exe
1404	nguZHRR.exe
4484	DrVWmws.exe
4036	LjPUlRD.exe
3420	FsWLaho.exe
2884	zMUvJqF.exe
5000	FKOqmxh.exe
4236	ZbnOPAf.exe
4856	vzGnShc.exe
1672	JxaRgxL.exe
3356	BPDGViL.exe
1076	ivwezEo.exe
3060	QpPWxVI.exe
3344	xPRBjPh.exe
4492	ZzsbPtI.exe
1796	dBPcwZR.exe
4520	idUzwpY.exe
4848	ajmqoaL.exe
2636	svRVMTv.exe
1568	CdQmJtw.exe
4268	czeZWNb.exe
1472	ZQrGFCd.exe
400	xJsUIJO.exe
3992	cthUbOE.exe
212	mYcQluo.exe
3792	lWogtSo.exe
4196	vVkYpLK.exe
4316	hAJhYqD.exe
3164	XBcoAAP.exe
3972	RPIPHgV.exe
3464	dvHqcgV.exe
3876	dNefGVb.exe
1960	dFdKQwF.exe
1728	nEwJrTg.exe
312	xHdiwbu.exe
452	uHxSVSM.exe
3096	qbZBbMr.exe
460	vxQIDwb.exe
1036	kpsbFrk.exe
1820	EXLKIvb.exe
860	icDjpiw.exe
3564	lXJDecN.exe
3416	MSegFHy.exe
1400	jTCVKvf.exe
2308	zFXNWFp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4384-0-0x00007FF7562E0000-0x00007FF7566D6000-memory.dmp	upx
behavioral2/files/0x0007000000023402-8.dat	upx
behavioral2/files/0x00090000000233f3-9.dat	upx
behavioral2/files/0x0007000000023404-30.dat	upx
behavioral2/files/0x0007000000023403-21.dat	upx
behavioral2/files/0x000d000000023383-13.dat	upx
behavioral2/files/0x000700000002340a-62.dat	upx
behavioral2/files/0x0008000000023407-69.dat	upx
behavioral2/files/0x000700000002340b-77.dat	upx
behavioral2/files/0x000700000002340e-89.dat	upx
behavioral2/files/0x000700000002340f-97.dat	upx
behavioral2/files/0x0007000000023410-103.dat	upx
behavioral2/files/0x0007000000023413-114.dat	upx
behavioral2/files/0x0007000000023414-123.dat	upx
behavioral2/files/0x0007000000023416-133.dat	upx
behavioral2/files/0x000700000002341d-168.dat	upx
behavioral2/memory/5040-621-0x00007FF68A1F0000-0x00007FF68A5E6000-memory.dmp	upx
behavioral2/memory/2776-622-0x00007FF712A70000-0x00007FF712E66000-memory.dmp	upx
behavioral2/memory/4208-623-0x00007FF6AA8A0000-0x00007FF6AAC96000-memory.dmp	upx
behavioral2/memory/1900-624-0x00007FF650AE0000-0x00007FF650ED6000-memory.dmp	upx
behavioral2/memory/3500-625-0x00007FF768E50000-0x00007FF769246000-memory.dmp	upx
behavioral2/memory/1736-626-0x00007FF7EDC50000-0x00007FF7EE046000-memory.dmp	upx
behavioral2/memory/4836-627-0x00007FF718750000-0x00007FF718B46000-memory.dmp	upx
behavioral2/memory/1468-628-0x00007FF70E8B0000-0x00007FF70ECA6000-memory.dmp	upx
behavioral2/memory/3240-629-0x00007FF7EFC60000-0x00007FF7F0056000-memory.dmp	upx
behavioral2/memory/4808-630-0x00007FF6CCD60000-0x00007FF6CD156000-memory.dmp	upx
behavioral2/memory/4536-631-0x00007FF7A56B0000-0x00007FF7A5AA6000-memory.dmp	upx
behavioral2/memory/2108-639-0x00007FF712450000-0x00007FF712846000-memory.dmp	upx
behavioral2/memory/4256-646-0x00007FF63F290000-0x00007FF63F686000-memory.dmp	upx
behavioral2/memory/1744-655-0x00007FF780690000-0x00007FF780A86000-memory.dmp	upx
behavioral2/memory/4220-649-0x00007FF6A3710000-0x00007FF6A3B06000-memory.dmp	upx
behavioral2/memory/1404-660-0x00007FF7DC320000-0x00007FF7DC716000-memory.dmp	upx
behavioral2/memory/4484-664-0x00007FF6D8B20000-0x00007FF6D8F16000-memory.dmp	upx
behavioral2/memory/4036-666-0x00007FF785590000-0x00007FF785986000-memory.dmp	upx
behavioral2/memory/3088-678-0x00007FF65BE50000-0x00007FF65C246000-memory.dmp	upx
behavioral2/memory/908-681-0x00007FF6F6250000-0x00007FF6F6646000-memory.dmp	upx
behavioral2/memory/3420-669-0x00007FF714940000-0x00007FF714D36000-memory.dmp	upx
behavioral2/memory/2944-657-0x00007FF7CB9E0000-0x00007FF7CBDD6000-memory.dmp	upx
behavioral2/memory/1408-689-0x00007FF7ED630000-0x00007FF7EDA26000-memory.dmp	upx
behavioral2/files/0x0007000000023420-177.dat	upx
behavioral2/files/0x000700000002341f-174.dat	upx
behavioral2/files/0x000700000002341e-172.dat	upx
behavioral2/files/0x000700000002341c-162.dat	upx
behavioral2/files/0x000700000002341b-158.dat	upx
behavioral2/files/0x000700000002341a-152.dat	upx
behavioral2/files/0x0007000000023419-148.dat	upx
behavioral2/files/0x0007000000023418-142.dat	upx
behavioral2/files/0x0007000000023417-138.dat	upx
behavioral2/files/0x0007000000023415-128.dat	upx
behavioral2/files/0x0007000000023412-112.dat	upx
behavioral2/files/0x0007000000023411-108.dat	upx
behavioral2/files/0x000700000002340d-87.dat	upx
behavioral2/files/0x000700000002340c-83.dat	upx
behavioral2/files/0x0007000000023409-63.dat	upx
behavioral2/files/0x0008000000023408-58.dat	upx
behavioral2/files/0x0007000000023406-55.dat	upx
behavioral2/files/0x0007000000023405-45.dat	upx
behavioral2/memory/3316-44-0x00007FF771510000-0x00007FF771906000-memory.dmp	upx
behavioral2/memory/3088-1987-0x00007FF65BE50000-0x00007FF65C246000-memory.dmp	upx
behavioral2/memory/3316-1989-0x00007FF771510000-0x00007FF771906000-memory.dmp	upx
behavioral2/memory/2776-1988-0x00007FF712A70000-0x00007FF712E66000-memory.dmp	upx
behavioral2/memory/5040-1990-0x00007FF68A1F0000-0x00007FF68A5E6000-memory.dmp	upx
behavioral2/memory/4208-1991-0x00007FF6AA8A0000-0x00007FF6AAC96000-memory.dmp	upx
behavioral2/memory/908-1992-0x00007FF6F6250000-0x00007FF6F6646000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WGECMFK.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\nZxOUfv.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\sTZbuaG.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\PHxwMlb.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\dNefGVb.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\qvZlrHE.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\PApiAkt.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\jzRLZwW.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\WkgQgUo.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\shMgigB.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\zVIQWfV.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\fEgvqsv.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\BBhYLLb.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\tnUSPtD.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\uSikBQf.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\AYgOIYS.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\noULIzT.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\udjPwlz.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\ZYliwAK.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\oeJagvV.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\jEVHHdO.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\YzfqarG.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\lwvTmQh.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\jeruutF.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\mgzdowm.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\LQMPApo.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\BqfIjcJ.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\VXOWhAK.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\HdeBpRU.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\qbZBbMr.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\HXQyVpL.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\WWBcszw.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\yPCqbDF.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\dlgxHiv.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\tkSKHmS.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\YeGQroy.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\uHxSVSM.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\wCajckE.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\dfHzBih.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\VYTqEJi.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\KSElMdJ.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\nKWuBcs.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\FxLHbKQ.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\BWQHauz.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\nDRdHpp.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\foDUwVf.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\MYWlaqc.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\spKwyEQ.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\RQMzZRF.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\RPIPHgV.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\ZAdDtcE.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\DFQOGRt.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\qysygYs.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\iVPZuib.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\fDDfCCA.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\OogThqd.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\TpXKILU.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\bPntxWc.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\zukyoCB.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\CPZuIsK.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\LcbqWgd.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\zFXNWFp.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\CgxPUhQ.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
File created	C:\Windows\System\gNCtNvB.exe	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3040	powershell.exe
3040	powershell.exe
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeLockMemoryPrivilege	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3040	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	85
PID 4384 wrote to memory of 3040	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	85
PID 4384 wrote to memory of 3088	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	86
PID 4384 wrote to memory of 3088	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	86
PID 4384 wrote to memory of 3316	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	87
PID 4384 wrote to memory of 3316	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	87
PID 4384 wrote to memory of 5040	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	88
PID 4384 wrote to memory of 5040	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	88
PID 4384 wrote to memory of 2776	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	89
PID 4384 wrote to memory of 2776	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	89
PID 4384 wrote to memory of 4208	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	90
PID 4384 wrote to memory of 4208	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	90
PID 4384 wrote to memory of 908	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	91
PID 4384 wrote to memory of 908	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	91
PID 4384 wrote to memory of 1408	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	92
PID 4384 wrote to memory of 1408	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	92
PID 4384 wrote to memory of 1900	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	93
PID 4384 wrote to memory of 1900	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	93
PID 4384 wrote to memory of 3500	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	94
PID 4384 wrote to memory of 3500	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	94
PID 4384 wrote to memory of 1736	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	95
PID 4384 wrote to memory of 1736	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	95
PID 4384 wrote to memory of 4836	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	96
PID 4384 wrote to memory of 4836	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	96
PID 4384 wrote to memory of 1468	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	97
PID 4384 wrote to memory of 1468	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	97
PID 4384 wrote to memory of 3240	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	98
PID 4384 wrote to memory of 3240	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	98
PID 4384 wrote to memory of 4808	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	99
PID 4384 wrote to memory of 4808	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	99
PID 4384 wrote to memory of 4536	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	100
PID 4384 wrote to memory of 4536	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	100
PID 4384 wrote to memory of 2108	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	101
PID 4384 wrote to memory of 2108	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	101
PID 4384 wrote to memory of 4256	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	102
PID 4384 wrote to memory of 4256	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	102
PID 4384 wrote to memory of 4220	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	103
PID 4384 wrote to memory of 4220	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	103
PID 4384 wrote to memory of 1744	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	104
PID 4384 wrote to memory of 1744	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	104
PID 4384 wrote to memory of 2944	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	105
PID 4384 wrote to memory of 2944	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	105
PID 4384 wrote to memory of 1404	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	106
PID 4384 wrote to memory of 1404	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	106
PID 4384 wrote to memory of 4484	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	107
PID 4384 wrote to memory of 4484	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	107
PID 4384 wrote to memory of 4036	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	108
PID 4384 wrote to memory of 4036	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	108
PID 4384 wrote to memory of 3420	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	109
PID 4384 wrote to memory of 3420	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	109
PID 4384 wrote to memory of 2884	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	110
PID 4384 wrote to memory of 2884	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	110
PID 4384 wrote to memory of 5000	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	111
PID 4384 wrote to memory of 5000	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	111
PID 4384 wrote to memory of 4236	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	112
PID 4384 wrote to memory of 4236	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	112
PID 4384 wrote to memory of 4856	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	113
PID 4384 wrote to memory of 4856	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	113
PID 4384 wrote to memory of 1672	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	114
PID 4384 wrote to memory of 1672	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	114
PID 4384 wrote to memory of 3356	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	115
PID 4384 wrote to memory of 3356	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	115
PID 4384 wrote to memory of 1076	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	116
PID 4384 wrote to memory of 1076	4384	18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18f9d9e1c32cb0b687e5580126caed80_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System\ekdiXxc.exe
  C:\Windows\System\ekdiXxc.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\MNcNSga.exe
  C:\Windows\System\MNcNSga.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\EIFZkPv.exe
  C:\Windows\System\EIFZkPv.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\SihyadS.exe
  C:\Windows\System\SihyadS.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\rKJGLcF.exe
  C:\Windows\System\rKJGLcF.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\vxkUsOH.exe
  C:\Windows\System\vxkUsOH.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\FheGQmF.exe
  C:\Windows\System\FheGQmF.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\ROGlYki.exe
  C:\Windows\System\ROGlYki.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\AxLcbjY.exe
  C:\Windows\System\AxLcbjY.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\CNmNGdb.exe
  C:\Windows\System\CNmNGdb.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\zTxCBPh.exe
  C:\Windows\System\zTxCBPh.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\ihMjXXg.exe
  C:\Windows\System\ihMjXXg.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\zSbQutX.exe
  C:\Windows\System\zSbQutX.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\pehMfSV.exe
  C:\Windows\System\pehMfSV.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\RBOWzmO.exe
  C:\Windows\System\RBOWzmO.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\CdtkCVT.exe
  C:\Windows\System\CdtkCVT.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\cSpsppD.exe
  C:\Windows\System\cSpsppD.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\CXoGgct.exe
  C:\Windows\System\CXoGgct.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\JOxFqBG.exe
  C:\Windows\System\JOxFqBG.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\cHdgHJU.exe
  C:\Windows\System\cHdgHJU.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\nguZHRR.exe
  C:\Windows\System\nguZHRR.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\DrVWmws.exe
  C:\Windows\System\DrVWmws.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\LjPUlRD.exe
  C:\Windows\System\LjPUlRD.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\FsWLaho.exe
  C:\Windows\System\FsWLaho.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\zMUvJqF.exe
  C:\Windows\System\zMUvJqF.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\FKOqmxh.exe
  C:\Windows\System\FKOqmxh.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\ZbnOPAf.exe
  C:\Windows\System\ZbnOPAf.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\vzGnShc.exe
  C:\Windows\System\vzGnShc.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\JxaRgxL.exe
  C:\Windows\System\JxaRgxL.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\BPDGViL.exe
  C:\Windows\System\BPDGViL.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\ivwezEo.exe
  C:\Windows\System\ivwezEo.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\QpPWxVI.exe
  C:\Windows\System\QpPWxVI.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\xPRBjPh.exe
  C:\Windows\System\xPRBjPh.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\ZzsbPtI.exe
  C:\Windows\System\ZzsbPtI.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\dBPcwZR.exe
  C:\Windows\System\dBPcwZR.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\idUzwpY.exe
  C:\Windows\System\idUzwpY.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\ajmqoaL.exe
  C:\Windows\System\ajmqoaL.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\svRVMTv.exe
  C:\Windows\System\svRVMTv.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\CdQmJtw.exe
  C:\Windows\System\CdQmJtw.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\czeZWNb.exe
  C:\Windows\System\czeZWNb.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\ZQrGFCd.exe
  C:\Windows\System\ZQrGFCd.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\xJsUIJO.exe
  C:\Windows\System\xJsUIJO.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\cthUbOE.exe
  C:\Windows\System\cthUbOE.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\mYcQluo.exe
  C:\Windows\System\mYcQluo.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\lWogtSo.exe
  C:\Windows\System\lWogtSo.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\vVkYpLK.exe
  C:\Windows\System\vVkYpLK.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\hAJhYqD.exe
  C:\Windows\System\hAJhYqD.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\XBcoAAP.exe
  C:\Windows\System\XBcoAAP.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\RPIPHgV.exe
  C:\Windows\System\RPIPHgV.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\dvHqcgV.exe
  C:\Windows\System\dvHqcgV.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\dNefGVb.exe
  C:\Windows\System\dNefGVb.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\dFdKQwF.exe
  C:\Windows\System\dFdKQwF.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\nEwJrTg.exe
  C:\Windows\System\nEwJrTg.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\xHdiwbu.exe
  C:\Windows\System\xHdiwbu.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\uHxSVSM.exe
  C:\Windows\System\uHxSVSM.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\qbZBbMr.exe
  C:\Windows\System\qbZBbMr.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\vxQIDwb.exe
  C:\Windows\System\vxQIDwb.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\kpsbFrk.exe
  C:\Windows\System\kpsbFrk.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\EXLKIvb.exe
  C:\Windows\System\EXLKIvb.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\icDjpiw.exe
  C:\Windows\System\icDjpiw.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\lXJDecN.exe
  C:\Windows\System\lXJDecN.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\MSegFHy.exe
  C:\Windows\System\MSegFHy.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\jTCVKvf.exe
  C:\Windows\System\jTCVKvf.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\zFXNWFp.exe
  C:\Windows\System\zFXNWFp.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\zeHMgBW.exe
  C:\Windows\System\zeHMgBW.exe
  2⤵
  PID:4272
- C:\Windows\System\zONtIru.exe
  C:\Windows\System\zONtIru.exe
  2⤵
  PID:3340
- C:\Windows\System\nSyLDrf.exe
  C:\Windows\System\nSyLDrf.exe
  2⤵
  PID:4740
- C:\Windows\System\RUrQPDL.exe
  C:\Windows\System\RUrQPDL.exe
  2⤵
  PID:388
- C:\Windows\System\RgbiQRP.exe
  C:\Windows\System\RgbiQRP.exe
  2⤵
  PID:376
- C:\Windows\System\TNIOVMl.exe
  C:\Windows\System\TNIOVMl.exe
  2⤵
  PID:684
- C:\Windows\System\wJAoWZq.exe
  C:\Windows\System\wJAoWZq.exe
  2⤵
  PID:5084
- C:\Windows\System\yjmHKNn.exe
  C:\Windows\System\yjmHKNn.exe
  2⤵
  PID:2460
- C:\Windows\System\tBuktYw.exe
  C:\Windows\System\tBuktYw.exe
  2⤵
  PID:2528
- C:\Windows\System\inftSXO.exe
  C:\Windows\System\inftSXO.exe
  2⤵
  PID:736
- C:\Windows\System\Gzhlgyz.exe
  C:\Windows\System\Gzhlgyz.exe
  2⤵
  PID:4924
- C:\Windows\System\wCajckE.exe
  C:\Windows\System\wCajckE.exe
  2⤵
  PID:2984
- C:\Windows\System\YDbsPot.exe
  C:\Windows\System\YDbsPot.exe
  2⤵
  PID:5128
- C:\Windows\System\kaDyYNV.exe
  C:\Windows\System\kaDyYNV.exe
  2⤵
  PID:5156
- C:\Windows\System\CgxPUhQ.exe
  C:\Windows\System\CgxPUhQ.exe
  2⤵
  PID:5180
- C:\Windows\System\qvZlrHE.exe
  C:\Windows\System\qvZlrHE.exe
  2⤵
  PID:5208
- C:\Windows\System\GCfbEbD.exe
  C:\Windows\System\GCfbEbD.exe
  2⤵
  PID:5236
- C:\Windows\System\TxQUSqG.exe
  C:\Windows\System\TxQUSqG.exe
  2⤵
  PID:5264
- C:\Windows\System\kDDmvpB.exe
  C:\Windows\System\kDDmvpB.exe
  2⤵
  PID:5296
- C:\Windows\System\QZqpMzB.exe
  C:\Windows\System\QZqpMzB.exe
  2⤵
  PID:5320
- C:\Windows\System\xDleILr.exe
  C:\Windows\System\xDleILr.exe
  2⤵
  PID:5348
- C:\Windows\System\jttYFsg.exe
  C:\Windows\System\jttYFsg.exe
  2⤵
  PID:5376
- C:\Windows\System\spKwyEQ.exe
  C:\Windows\System\spKwyEQ.exe
  2⤵
  PID:5404
- C:\Windows\System\RnUiMgy.exe
  C:\Windows\System\RnUiMgy.exe
  2⤵
  PID:5424
- C:\Windows\System\IeXkamF.exe
  C:\Windows\System\IeXkamF.exe
  2⤵
  PID:5452
- C:\Windows\System\XTecjKF.exe
  C:\Windows\System\XTecjKF.exe
  2⤵
  PID:5480
- C:\Windows\System\sWyDxLj.exe
  C:\Windows\System\sWyDxLj.exe
  2⤵
  PID:5508
- C:\Windows\System\ZCUBSxD.exe
  C:\Windows\System\ZCUBSxD.exe
  2⤵
  PID:5536
- C:\Windows\System\YzfqarG.exe
  C:\Windows\System\YzfqarG.exe
  2⤵
  PID:5564
- C:\Windows\System\gNCtNvB.exe
  C:\Windows\System\gNCtNvB.exe
  2⤵
  PID:5592
- C:\Windows\System\fDDfCCA.exe
  C:\Windows\System\fDDfCCA.exe
  2⤵
  PID:5620
- C:\Windows\System\RQMzZRF.exe
  C:\Windows\System\RQMzZRF.exe
  2⤵
  PID:5648
- C:\Windows\System\sVBHycV.exe
  C:\Windows\System\sVBHycV.exe
  2⤵
  PID:5676
- C:\Windows\System\GtkEAXY.exe
  C:\Windows\System\GtkEAXY.exe
  2⤵
  PID:5704
- C:\Windows\System\ijbGZHh.exe
  C:\Windows\System\ijbGZHh.exe
  2⤵
  PID:5732
- C:\Windows\System\KkMxHNY.exe
  C:\Windows\System\KkMxHNY.exe
  2⤵
  PID:5760
- C:\Windows\System\nlJVGYO.exe
  C:\Windows\System\nlJVGYO.exe
  2⤵
  PID:5788
- C:\Windows\System\CfeCDTf.exe
  C:\Windows\System\CfeCDTf.exe
  2⤵
  PID:5816
- C:\Windows\System\BkFxDpp.exe
  C:\Windows\System\BkFxDpp.exe
  2⤵
  PID:5844
- C:\Windows\System\vedvjcc.exe
  C:\Windows\System\vedvjcc.exe
  2⤵
  PID:5872
- C:\Windows\System\RWdnjQq.exe
  C:\Windows\System\RWdnjQq.exe
  2⤵
  PID:5900
- C:\Windows\System\ljNvdXy.exe
  C:\Windows\System\ljNvdXy.exe
  2⤵
  PID:5928
- C:\Windows\System\cplxAPI.exe
  C:\Windows\System\cplxAPI.exe
  2⤵
  PID:5956
- C:\Windows\System\DnJObXB.exe
  C:\Windows\System\DnJObXB.exe
  2⤵
  PID:5984
- C:\Windows\System\AoyEVgy.exe
  C:\Windows\System\AoyEVgy.exe
  2⤵
  PID:6012
- C:\Windows\System\RouEOBm.exe
  C:\Windows\System\RouEOBm.exe
  2⤵
  PID:6040
- C:\Windows\System\TUOCfLY.exe
  C:\Windows\System\TUOCfLY.exe
  2⤵
  PID:6068
- C:\Windows\System\ODdnCHi.exe
  C:\Windows\System\ODdnCHi.exe
  2⤵
  PID:6096
- C:\Windows\System\fHwBAwg.exe
  C:\Windows\System\fHwBAwg.exe
  2⤵
  PID:6124
- C:\Windows\System\EzNoWYC.exe
  C:\Windows\System\EzNoWYC.exe
  2⤵
  PID:4980
- C:\Windows\System\GcbchIi.exe
  C:\Windows\System\GcbchIi.exe
  2⤵
  PID:3264
- C:\Windows\System\XPnWXEB.exe
  C:\Windows\System\XPnWXEB.exe
  2⤵
  PID:4312
- C:\Windows\System\hLkXcWn.exe
  C:\Windows\System\hLkXcWn.exe
  2⤵
  PID:2464
- C:\Windows\System\yhOMZld.exe
  C:\Windows\System\yhOMZld.exe
  2⤵
  PID:3940
- C:\Windows\System\lwvTmQh.exe
  C:\Windows\System\lwvTmQh.exe
  2⤵
  PID:2316
- C:\Windows\System\EkhUUVx.exe
  C:\Windows\System\EkhUUVx.exe
  2⤵
  PID:5172
- C:\Windows\System\rqnDgks.exe
  C:\Windows\System\rqnDgks.exe
  2⤵
  PID:5232
- C:\Windows\System\zmUIMJy.exe
  C:\Windows\System\zmUIMJy.exe
  2⤵
  PID:5308
- C:\Windows\System\qiTpKuE.exe
  C:\Windows\System\qiTpKuE.exe
  2⤵
  PID:5364
- C:\Windows\System\Eepflqo.exe
  C:\Windows\System\Eepflqo.exe
  2⤵
  PID:5436
- C:\Windows\System\iPhsrFY.exe
  C:\Windows\System\iPhsrFY.exe
  2⤵
  PID:5496
- C:\Windows\System\yopVJAB.exe
  C:\Windows\System\yopVJAB.exe
  2⤵
  PID:5556
- C:\Windows\System\BQqqrOi.exe
  C:\Windows\System\BQqqrOi.exe
  2⤵
  PID:5632
- C:\Windows\System\nMNMnhQ.exe
  C:\Windows\System\nMNMnhQ.exe
  2⤵
  PID:5716
- C:\Windows\System\HBNpREF.exe
  C:\Windows\System\HBNpREF.exe
  2⤵
  PID:5752
- C:\Windows\System\WGECMFK.exe
  C:\Windows\System\WGECMFK.exe
  2⤵
  PID:5808
- C:\Windows\System\OOBavNz.exe
  C:\Windows\System\OOBavNz.exe
  2⤵
  PID:5884
- C:\Windows\System\enpNYIe.exe
  C:\Windows\System\enpNYIe.exe
  2⤵
  PID:5944
- C:\Windows\System\CKyvODI.exe
  C:\Windows\System\CKyvODI.exe
  2⤵
  PID:6000
- C:\Windows\System\SyjPaOn.exe
  C:\Windows\System\SyjPaOn.exe
  2⤵
  PID:6056
- C:\Windows\System\KSElMdJ.exe
  C:\Windows\System\KSElMdJ.exe
  2⤵
  PID:6116
- C:\Windows\System\coflCHo.exe
  C:\Windows\System\coflCHo.exe
  2⤵
  PID:1780
- C:\Windows\System\MCzKTNO.exe
  C:\Windows\System\MCzKTNO.exe
  2⤵
  PID:4592
- C:\Windows\System\iNBJASQ.exe
  C:\Windows\System\iNBJASQ.exe
  2⤵
  PID:5148
- C:\Windows\System\OjOtSfA.exe
  C:\Windows\System\OjOtSfA.exe
  2⤵
  PID:5284
- C:\Windows\System\DEWHCtJ.exe
  C:\Windows\System\DEWHCtJ.exe
  2⤵
  PID:5464
- C:\Windows\System\lPfkOtb.exe
  C:\Windows\System\lPfkOtb.exe
  2⤵
  PID:5604
- C:\Windows\System\SwtHpMt.exe
  C:\Windows\System\SwtHpMt.exe
  2⤵
  PID:4832
- C:\Windows\System\ZdLvZgr.exe
  C:\Windows\System\ZdLvZgr.exe
  2⤵
  PID:5972
- C:\Windows\System\ZRrSSew.exe
  C:\Windows\System\ZRrSSew.exe
  2⤵
  PID:6088
- C:\Windows\System\VLRdzss.exe
  C:\Windows\System\VLRdzss.exe
  2⤵
  PID:3248
- C:\Windows\System\sYJmbaz.exe
  C:\Windows\System\sYJmbaz.exe
  2⤵
  PID:4820
- C:\Windows\System\fEmkVDM.exe
  C:\Windows\System\fEmkVDM.exe
  2⤵
  PID:5400
- C:\Windows\System\KLZwKgU.exe
  C:\Windows\System\KLZwKgU.exe
  2⤵
  PID:5780
- C:\Windows\System\sZOSOfw.exe
  C:\Windows\System\sZOSOfw.exe
  2⤵
  PID:4768
- C:\Windows\System\NoAqsYN.exe
  C:\Windows\System\NoAqsYN.exe
  2⤵
  PID:6168
- C:\Windows\System\CNHDoKt.exe
  C:\Windows\System\CNHDoKt.exe
  2⤵
  PID:6196
- C:\Windows\System\AirKAsD.exe
  C:\Windows\System\AirKAsD.exe
  2⤵
  PID:6224
- C:\Windows\System\ABdAvWW.exe
  C:\Windows\System\ABdAvWW.exe
  2⤵
  PID:6252
- C:\Windows\System\GoPzfQx.exe
  C:\Windows\System\GoPzfQx.exe
  2⤵
  PID:6280
- C:\Windows\System\aNKBkIm.exe
  C:\Windows\System\aNKBkIm.exe
  2⤵
  PID:6308
- C:\Windows\System\tfVSDBf.exe
  C:\Windows\System\tfVSDBf.exe
  2⤵
  PID:6336
- C:\Windows\System\TdSIiSs.exe
  C:\Windows\System\TdSIiSs.exe
  2⤵
  PID:6360
- C:\Windows\System\qmxsplR.exe
  C:\Windows\System\qmxsplR.exe
  2⤵
  PID:6392
- C:\Windows\System\hupUtfB.exe
  C:\Windows\System\hupUtfB.exe
  2⤵
  PID:6420
- C:\Windows\System\CvDkomt.exe
  C:\Windows\System\CvDkomt.exe
  2⤵
  PID:6448
- C:\Windows\System\lmYvJta.exe
  C:\Windows\System\lmYvJta.exe
  2⤵
  PID:6476
- C:\Windows\System\vfeBTrg.exe
  C:\Windows\System\vfeBTrg.exe
  2⤵
  PID:6504
- C:\Windows\System\YWsZkYE.exe
  C:\Windows\System\YWsZkYE.exe
  2⤵
  PID:6532
- C:\Windows\System\EsQRbFB.exe
  C:\Windows\System\EsQRbFB.exe
  2⤵
  PID:6560
- C:\Windows\System\ZGkgJjF.exe
  C:\Windows\System\ZGkgJjF.exe
  2⤵
  PID:6588
- C:\Windows\System\VSenaCA.exe
  C:\Windows\System\VSenaCA.exe
  2⤵
  PID:6616
- C:\Windows\System\ZAdDtcE.exe
  C:\Windows\System\ZAdDtcE.exe
  2⤵
  PID:6644
- C:\Windows\System\DFQOGRt.exe
  C:\Windows\System\DFQOGRt.exe
  2⤵
  PID:6672
- C:\Windows\System\nKWuBcs.exe
  C:\Windows\System\nKWuBcs.exe
  2⤵
  PID:6700
- C:\Windows\System\ZlPVcze.exe
  C:\Windows\System\ZlPVcze.exe
  2⤵
  PID:6728
- C:\Windows\System\LZznbNr.exe
  C:\Windows\System\LZznbNr.exe
  2⤵
  PID:6756
- C:\Windows\System\GEVigUu.exe
  C:\Windows\System\GEVigUu.exe
  2⤵
  PID:6784
- C:\Windows\System\HKlIrEP.exe
  C:\Windows\System\HKlIrEP.exe
  2⤵
  PID:6812
- C:\Windows\System\ZtXuXQT.exe
  C:\Windows\System\ZtXuXQT.exe
  2⤵
  PID:6840
- C:\Windows\System\bhlBWMO.exe
  C:\Windows\System\bhlBWMO.exe
  2⤵
  PID:6868
- C:\Windows\System\WZjznIX.exe
  C:\Windows\System\WZjznIX.exe
  2⤵
  PID:6896
- C:\Windows\System\nxDjVfY.exe
  C:\Windows\System\nxDjVfY.exe
  2⤵
  PID:6924
- C:\Windows\System\LnVWxzi.exe
  C:\Windows\System\LnVWxzi.exe
  2⤵
  PID:6952
- C:\Windows\System\LakHnVI.exe
  C:\Windows\System\LakHnVI.exe
  2⤵
  PID:6980
- C:\Windows\System\iOgkHLn.exe
  C:\Windows\System\iOgkHLn.exe
  2⤵
  PID:7008
- C:\Windows\System\URFnMDV.exe
  C:\Windows\System\URFnMDV.exe
  2⤵
  PID:7036
- C:\Windows\System\NJKdjyQ.exe
  C:\Windows\System\NJKdjyQ.exe
  2⤵
  PID:7064
- C:\Windows\System\KvXnbGT.exe
  C:\Windows\System\KvXnbGT.exe
  2⤵
  PID:5260
- C:\Windows\System\RtbkshZ.exe
  C:\Windows\System\RtbkshZ.exe
  2⤵
  PID:6156
- C:\Windows\System\ugxAdDB.exe
  C:\Windows\System\ugxAdDB.exe
  2⤵
  PID:6208
- C:\Windows\System\OWydssv.exe
  C:\Windows\System\OWydssv.exe
  2⤵
  PID:6268
- C:\Windows\System\xxQWaUp.exe
  C:\Windows\System\xxQWaUp.exe
  2⤵
  PID:6348
- C:\Windows\System\bJaxOmd.exe
  C:\Windows\System\bJaxOmd.exe
  2⤵
  PID:6440
- C:\Windows\System\HyfeyDm.exe
  C:\Windows\System\HyfeyDm.exe
  2⤵
  PID:6520
- C:\Windows\System\PDXJllV.exe
  C:\Windows\System\PDXJllV.exe
  2⤵
  PID:6584
- C:\Windows\System\FPWhkdG.exe
  C:\Windows\System\FPWhkdG.exe
  2⤵
  PID:4552
- C:\Windows\System\srMUfvp.exe
  C:\Windows\System\srMUfvp.exe
  2⤵
  PID:3852
- C:\Windows\System\NOaZibx.exe
  C:\Windows\System\NOaZibx.exe
  2⤵
  PID:3528
- C:\Windows\System\pGUQaXR.exe
  C:\Windows\System\pGUQaXR.exe
  2⤵
  PID:372
- C:\Windows\System\yeJRlEO.exe
  C:\Windows\System\yeJRlEO.exe
  2⤵
  PID:6852
- C:\Windows\System\skdcuqV.exe
  C:\Windows\System\skdcuqV.exe
  2⤵
  PID:6908
- C:\Windows\System\knnILnw.exe
  C:\Windows\System\knnILnw.exe
  2⤵
  PID:7024
- C:\Windows\System\nZxOUfv.exe
  C:\Windows\System\nZxOUfv.exe
  2⤵
  PID:7056
- C:\Windows\System\GVAszcM.exe
  C:\Windows\System\GVAszcM.exe
  2⤵
  PID:4792
- C:\Windows\System\BBhYLLb.exe
  C:\Windows\System\BBhYLLb.exe
  2⤵
  PID:2380
- C:\Windows\System\OogThqd.exe
  C:\Windows\System\OogThqd.exe
  2⤵
  PID:4852
- C:\Windows\System\iHszYLN.exe
  C:\Windows\System\iHszYLN.exe
  2⤵
  PID:3820
- C:\Windows\System\FzMdmel.exe
  C:\Windows\System\FzMdmel.exe
  2⤵
  PID:900
- C:\Windows\System\BAyFbmj.exe
  C:\Windows\System\BAyFbmj.exe
  2⤵
  PID:6184
- C:\Windows\System\yKJJwEL.exe
  C:\Windows\System\yKJJwEL.exe
  2⤵
  PID:6572
- C:\Windows\System\JwVeDiq.exe
  C:\Windows\System\JwVeDiq.exe
  2⤵
  PID:6688
- C:\Windows\System\WAgRWjg.exe
  C:\Windows\System\WAgRWjg.exe
  2⤵
  PID:6800
- C:\Windows\System\hTxUYwk.exe
  C:\Windows\System\hTxUYwk.exe
  2⤵
  PID:3336
- C:\Windows\System\WBeWGwS.exe
  C:\Windows\System\WBeWGwS.exe
  2⤵
  PID:1816
- C:\Windows\System\ptghZju.exe
  C:\Windows\System\ptghZju.exe
  2⤵
  PID:1368
- C:\Windows\System\vQiTCfN.exe
  C:\Windows\System\vQiTCfN.exe
  2⤵
  PID:6188
- C:\Windows\System\awnufdM.exe
  C:\Windows\System\awnufdM.exe
  2⤵
  PID:988
- C:\Windows\System\TjLIKNH.exe
  C:\Windows\System\TjLIKNH.exe
  2⤵
  PID:1932
- C:\Windows\System\JkVmgfz.exe
  C:\Windows\System\JkVmgfz.exe
  2⤵
  PID:6548
- C:\Windows\System\GqAohwM.exe
  C:\Windows\System\GqAohwM.exe
  2⤵
  PID:1184
- C:\Windows\System\QokSbLI.exe
  C:\Windows\System\QokSbLI.exe
  2⤵
  PID:7176
- C:\Windows\System\qeKyEVw.exe
  C:\Windows\System\qeKyEVw.exe
  2⤵
  PID:7204
- C:\Windows\System\xAViURE.exe
  C:\Windows\System\xAViURE.exe
  2⤵
  PID:7232
- C:\Windows\System\dfHzBih.exe
  C:\Windows\System\dfHzBih.exe
  2⤵
  PID:7260
- C:\Windows\System\sRqiApd.exe
  C:\Windows\System\sRqiApd.exe
  2⤵
  PID:7288
- C:\Windows\System\eWzeHPq.exe
  C:\Windows\System\eWzeHPq.exe
  2⤵
  PID:7320
- C:\Windows\System\qAiVRaB.exe
  C:\Windows\System\qAiVRaB.exe
  2⤵
  PID:7340
- C:\Windows\System\CFCXYLo.exe
  C:\Windows\System\CFCXYLo.exe
  2⤵
  PID:7376
- C:\Windows\System\DSeDplU.exe
  C:\Windows\System\DSeDplU.exe
  2⤵
  PID:7404
- C:\Windows\System\nIDDlep.exe
  C:\Windows\System\nIDDlep.exe
  2⤵
  PID:7436
- C:\Windows\System\IpwnoZa.exe
  C:\Windows\System\IpwnoZa.exe
  2⤵
  PID:7464
- C:\Windows\System\JsjJuaP.exe
  C:\Windows\System\JsjJuaP.exe
  2⤵
  PID:7480
- C:\Windows\System\ohOYScz.exe
  C:\Windows\System\ohOYScz.exe
  2⤵
  PID:7508
- C:\Windows\System\XbBbbwe.exe
  C:\Windows\System\XbBbbwe.exe
  2⤵
  PID:7524
- C:\Windows\System\POqRyZm.exe
  C:\Windows\System\POqRyZm.exe
  2⤵
  PID:7548
- C:\Windows\System\gtYUUTM.exe
  C:\Windows\System\gtYUUTM.exe
  2⤵
  PID:7564
- C:\Windows\System\zzBFnMQ.exe
  C:\Windows\System\zzBFnMQ.exe
  2⤵
  PID:7604
- C:\Windows\System\UQaQjVM.exe
  C:\Windows\System\UQaQjVM.exe
  2⤵
  PID:7660
- C:\Windows\System\tmSZRRo.exe
  C:\Windows\System\tmSZRRo.exe
  2⤵
  PID:7688
- C:\Windows\System\PApiAkt.exe
  C:\Windows\System\PApiAkt.exe
  2⤵
  PID:7704
- C:\Windows\System\WHBuusV.exe
  C:\Windows\System\WHBuusV.exe
  2⤵
  PID:7744
- C:\Windows\System\iHSuItn.exe
  C:\Windows\System\iHSuItn.exe
  2⤵
  PID:7772
- C:\Windows\System\gILHQRZ.exe
  C:\Windows\System\gILHQRZ.exe
  2⤵
  PID:7796
- C:\Windows\System\ukwrldx.exe
  C:\Windows\System\ukwrldx.exe
  2⤵
  PID:7840
- C:\Windows\System\iLWzxSQ.exe
  C:\Windows\System\iLWzxSQ.exe
  2⤵
  PID:7872
- C:\Windows\System\tANmylI.exe
  C:\Windows\System\tANmylI.exe
  2⤵
  PID:7904
- C:\Windows\System\ivGFrfx.exe
  C:\Windows\System\ivGFrfx.exe
  2⤵
  PID:7936
- C:\Windows\System\FoXVfQx.exe
  C:\Windows\System\FoXVfQx.exe
  2⤵
  PID:7964
- C:\Windows\System\vrUGOGd.exe
  C:\Windows\System\vrUGOGd.exe
  2⤵
  PID:7992
- C:\Windows\System\HXQyVpL.exe
  C:\Windows\System\HXQyVpL.exe
  2⤵
  PID:8020
- C:\Windows\System\WWBcszw.exe
  C:\Windows\System\WWBcszw.exe
  2⤵
  PID:8048
- C:\Windows\System\OrYttgr.exe
  C:\Windows\System\OrYttgr.exe
  2⤵
  PID:8076
- C:\Windows\System\DVGRZSC.exe
  C:\Windows\System\DVGRZSC.exe
  2⤵
  PID:8104
- C:\Windows\System\jASQGHs.exe
  C:\Windows\System\jASQGHs.exe
  2⤵
  PID:8132
- C:\Windows\System\tnUSPtD.exe
  C:\Windows\System\tnUSPtD.exe
  2⤵
  PID:8160
- C:\Windows\System\jHtSZyV.exe
  C:\Windows\System\jHtSZyV.exe
  2⤵
  PID:8188
- C:\Windows\System\EGqqjJn.exe
  C:\Windows\System\EGqqjJn.exe
  2⤵
  PID:7224
- C:\Windows\System\smppPHn.exe
  C:\Windows\System\smppPHn.exe
  2⤵
  PID:7300
- C:\Windows\System\CMYkCiG.exe
  C:\Windows\System\CMYkCiG.exe
  2⤵
  PID:7356
- C:\Windows\System\bAtoGvn.exe
  C:\Windows\System\bAtoGvn.exe
  2⤵
  PID:7420
- C:\Windows\System\ZttFpjm.exe
  C:\Windows\System\ZttFpjm.exe
  2⤵
  PID:7448
- C:\Windows\System\FhaMIVa.exe
  C:\Windows\System\FhaMIVa.exe
  2⤵
  PID:7540
- C:\Windows\System\wJFSaof.exe
  C:\Windows\System\wJFSaof.exe
  2⤵
  PID:7612
- C:\Windows\System\hSWlypM.exe
  C:\Windows\System\hSWlypM.exe
  2⤵
  PID:7652
- C:\Windows\System\ZTFOPru.exe
  C:\Windows\System\ZTFOPru.exe
  2⤵
  PID:7696
- C:\Windows\System\eIAyKZf.exe
  C:\Windows\System\eIAyKZf.exe
  2⤵
  PID:7156
- C:\Windows\System\uSikBQf.exe
  C:\Windows\System\uSikBQf.exe
  2⤵
  PID:7836
- C:\Windows\System\wdjuNOt.exe
  C:\Windows\System\wdjuNOt.exe
  2⤵
  PID:7900
- C:\Windows\System\HJEEPAK.exe
  C:\Windows\System\HJEEPAK.exe
  2⤵
  PID:7956
- C:\Windows\System\JlzOfmV.exe
  C:\Windows\System\JlzOfmV.exe
  2⤵
  PID:8012
- C:\Windows\System\yczsDtd.exe
  C:\Windows\System\yczsDtd.exe
  2⤵
  PID:8064
- C:\Windows\System\ZCDOomg.exe
  C:\Windows\System\ZCDOomg.exe
  2⤵
  PID:8128
- C:\Windows\System\xplFNyK.exe
  C:\Windows\System\xplFNyK.exe
  2⤵
  PID:8172
- C:\Windows\System\flMHHQf.exe
  C:\Windows\System\flMHHQf.exe
  2⤵
  PID:7280
- C:\Windows\System\uFdUoXd.exe
  C:\Windows\System\uFdUoXd.exe
  2⤵
  PID:7392
- C:\Windows\System\mEZyfhV.exe
  C:\Windows\System\mEZyfhV.exe
  2⤵
  PID:7164
- C:\Windows\System\hsljrDu.exe
  C:\Windows\System\hsljrDu.exe
  2⤵
  PID:7644
- C:\Windows\System\hZqBBha.exe
  C:\Windows\System\hZqBBha.exe
  2⤵
  PID:7760
- C:\Windows\System\HvTweaV.exe
  C:\Windows\System\HvTweaV.exe
  2⤵
  PID:7928
- C:\Windows\System\CAnyqwK.exe
  C:\Windows\System\CAnyqwK.exe
  2⤵
  PID:6464
- C:\Windows\System\BuZrtit.exe
  C:\Windows\System\BuZrtit.exe
  2⤵
  PID:8152
- C:\Windows\System\dViKYcS.exe
  C:\Windows\System\dViKYcS.exe
  2⤵
  PID:820
- C:\Windows\System\gOCZbqm.exe
  C:\Windows\System\gOCZbqm.exe
  2⤵
  PID:6880
- C:\Windows\System\FxLHbKQ.exe
  C:\Windows\System\FxLHbKQ.exe
  2⤵
  PID:4556
- C:\Windows\System\cShDHbj.exe
  C:\Windows\System\cShDHbj.exe
  2⤵
  PID:6636
- C:\Windows\System\KRrDRgP.exe
  C:\Windows\System\KRrDRgP.exe
  2⤵
  PID:7888
- C:\Windows\System\EZgWAbh.exe
  C:\Windows\System\EZgWAbh.exe
  2⤵
  PID:7492
- C:\Windows\System\cBaaJqe.exe
  C:\Windows\System\cBaaJqe.exe
  2⤵
  PID:8200
- C:\Windows\System\whmAEUf.exe
  C:\Windows\System\whmAEUf.exe
  2⤵
  PID:8236
- C:\Windows\System\xAwZvuW.exe
  C:\Windows\System\xAwZvuW.exe
  2⤵
  PID:8264
- C:\Windows\System\UbnVCGb.exe
  C:\Windows\System\UbnVCGb.exe
  2⤵
  PID:8292
- C:\Windows\System\xzKpEEg.exe
  C:\Windows\System\xzKpEEg.exe
  2⤵
  PID:8312
- C:\Windows\System\ccnBAZi.exe
  C:\Windows\System\ccnBAZi.exe
  2⤵
  PID:8344
- C:\Windows\System\crQckuQ.exe
  C:\Windows\System\crQckuQ.exe
  2⤵
  PID:8376
- C:\Windows\System\qysygYs.exe
  C:\Windows\System\qysygYs.exe
  2⤵
  PID:8400
- C:\Windows\System\vqeRxWk.exe
  C:\Windows\System\vqeRxWk.exe
  2⤵
  PID:8424
- C:\Windows\System\iVPZuib.exe
  C:\Windows\System\iVPZuib.exe
  2⤵
  PID:8452
- C:\Windows\System\BIoPvzz.exe
  C:\Windows\System\BIoPvzz.exe
  2⤵
  PID:8480
- C:\Windows\System\jzRLZwW.exe
  C:\Windows\System\jzRLZwW.exe
  2⤵
  PID:8496
- C:\Windows\System\xFXPDKB.exe
  C:\Windows\System\xFXPDKB.exe
  2⤵
  PID:8512
- C:\Windows\System\KRfpSYi.exe
  C:\Windows\System\KRfpSYi.exe
  2⤵
  PID:8560
- C:\Windows\System\ujdxVBw.exe
  C:\Windows\System\ujdxVBw.exe
  2⤵
  PID:8592
- C:\Windows\System\hnLptoa.exe
  C:\Windows\System\hnLptoa.exe
  2⤵
  PID:8620
- C:\Windows\System\LDNBTlG.exe
  C:\Windows\System\LDNBTlG.exe
  2⤵
  PID:8648
- C:\Windows\System\KzvXUMx.exe
  C:\Windows\System\KzvXUMx.exe
  2⤵
  PID:8676
- C:\Windows\System\RcjYSQn.exe
  C:\Windows\System\RcjYSQn.exe
  2⤵
  PID:8704
- C:\Windows\System\AcvGOHQ.exe
  C:\Windows\System\AcvGOHQ.exe
  2⤵
  PID:8732
- C:\Windows\System\qRqXRBd.exe
  C:\Windows\System\qRqXRBd.exe
  2⤵
  PID:8760
- C:\Windows\System\qYOMKys.exe
  C:\Windows\System\qYOMKys.exe
  2⤵
  PID:8788
- C:\Windows\System\WBnVsnK.exe
  C:\Windows\System\WBnVsnK.exe
  2⤵
  PID:8816
- C:\Windows\System\yOEhLJX.exe
  C:\Windows\System\yOEhLJX.exe
  2⤵
  PID:8844
- C:\Windows\System\OmGxJEp.exe
  C:\Windows\System\OmGxJEp.exe
  2⤵
  PID:8872
- C:\Windows\System\jeruutF.exe
  C:\Windows\System\jeruutF.exe
  2⤵
  PID:8900
- C:\Windows\System\udjPwlz.exe
  C:\Windows\System\udjPwlz.exe
  2⤵
  PID:8928
- C:\Windows\System\yhwuqQy.exe
  C:\Windows\System\yhwuqQy.exe
  2⤵
  PID:8956
- C:\Windows\System\jBrSjNP.exe
  C:\Windows\System\jBrSjNP.exe
  2⤵
  PID:8992
- C:\Windows\System\xtieZxR.exe
  C:\Windows\System\xtieZxR.exe
  2⤵
  PID:9012
- C:\Windows\System\ehWeHaM.exe
  C:\Windows\System\ehWeHaM.exe
  2⤵
  PID:9040
- C:\Windows\System\EmwIcYL.exe
  C:\Windows\System\EmwIcYL.exe
  2⤵
  PID:9068
- C:\Windows\System\eJRTmng.exe
  C:\Windows\System\eJRTmng.exe
  2⤵
  PID:9100
- C:\Windows\System\ENdOEcO.exe
  C:\Windows\System\ENdOEcO.exe
  2⤵
  PID:9128
- C:\Windows\System\RoFEawX.exe
  C:\Windows\System\RoFEawX.exe
  2⤵
  PID:9160
- C:\Windows\System\fmkJiup.exe
  C:\Windows\System\fmkJiup.exe
  2⤵
  PID:9192
- C:\Windows\System\fWnhLZe.exe
  C:\Windows\System\fWnhLZe.exe
  2⤵
  PID:8196
- C:\Windows\System\CrCyhoC.exe
  C:\Windows\System\CrCyhoC.exe
  2⤵
  PID:8272
- C:\Windows\System\DOVNdvI.exe
  C:\Windows\System\DOVNdvI.exe
  2⤵
  PID:8332
- C:\Windows\System\kQTVxqk.exe
  C:\Windows\System\kQTVxqk.exe
  2⤵
  PID:8392
- C:\Windows\System\NuQKVgd.exe
  C:\Windows\System\NuQKVgd.exe
  2⤵
  PID:8464
- C:\Windows\System\xnQzxfk.exe
  C:\Windows\System\xnQzxfk.exe
  2⤵
  PID:8548
- C:\Windows\System\clrUXBx.exe
  C:\Windows\System\clrUXBx.exe
  2⤵
  PID:1576
- C:\Windows\System\HpGFPZp.exe
  C:\Windows\System\HpGFPZp.exe
  2⤵
  PID:8644
- C:\Windows\System\EYJnwpC.exe
  C:\Windows\System\EYJnwpC.exe
  2⤵
  PID:8720
- C:\Windows\System\NQVRZAA.exe
  C:\Windows\System\NQVRZAA.exe
  2⤵
  PID:7788
- C:\Windows\System\HauQdmW.exe
  C:\Windows\System\HauQdmW.exe
  2⤵
  PID:8836
- C:\Windows\System\aBNfnFw.exe
  C:\Windows\System\aBNfnFw.exe
  2⤵
  PID:8896
- C:\Windows\System\lwnfgYb.exe
  C:\Windows\System\lwnfgYb.exe
  2⤵
  PID:8968
- C:\Windows\System\PYfIjaT.exe
  C:\Windows\System\PYfIjaT.exe
  2⤵
  PID:9032
- C:\Windows\System\UYkRtOS.exe
  C:\Windows\System\UYkRtOS.exe
  2⤵
  PID:9092
- C:\Windows\System\eEIFlAl.exe
  C:\Windows\System\eEIFlAl.exe
  2⤵
  PID:9156
- C:\Windows\System\oRMGxnI.exe
  C:\Windows\System\oRMGxnI.exe
  2⤵
  PID:8224
- C:\Windows\System\WVKuJLI.exe
  C:\Windows\System\WVKuJLI.exe
  2⤵
  PID:8360
- C:\Windows\System\vzIettC.exe
  C:\Windows\System\vzIettC.exe
  2⤵
  PID:8448
- C:\Windows\System\wIXZpDX.exe
  C:\Windows\System\wIXZpDX.exe
  2⤵
  PID:3348
- C:\Windows\System\aHBuPrS.exe
  C:\Windows\System\aHBuPrS.exe
  2⤵
  PID:8752
- C:\Windows\System\KdSKGzw.exe
  C:\Windows\System\KdSKGzw.exe
  2⤵
  PID:8884
- C:\Windows\System\UTOchBx.exe
  C:\Windows\System\UTOchBx.exe
  2⤵
  PID:9024
- C:\Windows\System\kiySHQS.exe
  C:\Windows\System\kiySHQS.exe
  2⤵
  PID:9188
- C:\Windows\System\BGWJtDt.exe
  C:\Windows\System\BGWJtDt.exe
  2⤵
  PID:7336
- C:\Windows\System\kUIpqEO.exe
  C:\Windows\System\kUIpqEO.exe
  2⤵
  PID:8700
- C:\Windows\System\ItmLuvw.exe
  C:\Windows\System\ItmLuvw.exe
  2⤵
  PID:4872
- C:\Windows\System\IosiOeC.exe
  C:\Windows\System\IosiOeC.exe
  2⤵
  PID:8640
- C:\Windows\System\XzuyTPK.exe
  C:\Windows\System\XzuyTPK.exe
  2⤵
  PID:2232
- C:\Windows\System\fGRxlSH.exe
  C:\Windows\System\fGRxlSH.exe
  2⤵
  PID:9004
- C:\Windows\System\coWBtiy.exe
  C:\Windows\System\coWBtiy.exe
  2⤵
  PID:9236
- C:\Windows\System\UJenGCq.exe
  C:\Windows\System\UJenGCq.exe
  2⤵
  PID:9264
- C:\Windows\System\LGixPHd.exe
  C:\Windows\System\LGixPHd.exe
  2⤵
  PID:9292
- C:\Windows\System\hCptNDI.exe
  C:\Windows\System\hCptNDI.exe
  2⤵
  PID:9320
- C:\Windows\System\PRJdDKR.exe
  C:\Windows\System\PRJdDKR.exe
  2⤵
  PID:9348
- C:\Windows\System\DXcBtVI.exe
  C:\Windows\System\DXcBtVI.exe
  2⤵
  PID:9376
- C:\Windows\System\ovmSrbl.exe
  C:\Windows\System\ovmSrbl.exe
  2⤵
  PID:9404
- C:\Windows\System\mSEJpBX.exe
  C:\Windows\System\mSEJpBX.exe
  2⤵
  PID:9432
- C:\Windows\System\jdHoNLX.exe
  C:\Windows\System\jdHoNLX.exe
  2⤵
  PID:9460
- C:\Windows\System\pibudOO.exe
  C:\Windows\System\pibudOO.exe
  2⤵
  PID:9488
- C:\Windows\System\smAhWEr.exe
  C:\Windows\System\smAhWEr.exe
  2⤵
  PID:9516
- C:\Windows\System\WbmynGw.exe
  C:\Windows\System\WbmynGw.exe
  2⤵
  PID:9544
- C:\Windows\System\vvjZfwS.exe
  C:\Windows\System\vvjZfwS.exe
  2⤵
  PID:9572
- C:\Windows\System\lMAeyVD.exe
  C:\Windows\System\lMAeyVD.exe
  2⤵
  PID:9600
- C:\Windows\System\HOKlQcO.exe
  C:\Windows\System\HOKlQcO.exe
  2⤵
  PID:9628
- C:\Windows\System\nFdkiXt.exe
  C:\Windows\System\nFdkiXt.exe
  2⤵
  PID:9656
- C:\Windows\System\MZCrztF.exe
  C:\Windows\System\MZCrztF.exe
  2⤵
  PID:9684
- C:\Windows\System\bZpwnss.exe
  C:\Windows\System\bZpwnss.exe
  2⤵
  PID:9712
- C:\Windows\System\VYTqEJi.exe
  C:\Windows\System\VYTqEJi.exe
  2⤵
  PID:9740
- C:\Windows\System\TpXKILU.exe
  C:\Windows\System\TpXKILU.exe
  2⤵
  PID:9768
- C:\Windows\System\RonypdZ.exe
  C:\Windows\System\RonypdZ.exe
  2⤵
  PID:9796
- C:\Windows\System\lFvulsx.exe
  C:\Windows\System\lFvulsx.exe
  2⤵
  PID:9824
- C:\Windows\System\gjrhWlt.exe
  C:\Windows\System\gjrhWlt.exe
  2⤵
  PID:9852
- C:\Windows\System\ZLdAerS.exe
  C:\Windows\System\ZLdAerS.exe
  2⤵
  PID:9880
- C:\Windows\System\RWMUmrD.exe
  C:\Windows\System\RWMUmrD.exe
  2⤵
  PID:9908
- C:\Windows\System\UuSLjQV.exe
  C:\Windows\System\UuSLjQV.exe
  2⤵
  PID:9936
- C:\Windows\System\zwBOoWg.exe
  C:\Windows\System\zwBOoWg.exe
  2⤵
  PID:9964
- C:\Windows\System\XMPgyxf.exe
  C:\Windows\System\XMPgyxf.exe
  2⤵
  PID:9992
- C:\Windows\System\foZDFsY.exe
  C:\Windows\System\foZDFsY.exe
  2⤵
  PID:10020
- C:\Windows\System\bOtPTQZ.exe
  C:\Windows\System\bOtPTQZ.exe
  2⤵
  PID:10036
- C:\Windows\System\FuFFcRy.exe
  C:\Windows\System\FuFFcRy.exe
  2⤵
  PID:10080
- C:\Windows\System\GpMINSG.exe
  C:\Windows\System\GpMINSG.exe
  2⤵
  PID:10108
- C:\Windows\System\zzGgXDj.exe
  C:\Windows\System\zzGgXDj.exe
  2⤵
  PID:10136
- C:\Windows\System\WWjEiaQ.exe
  C:\Windows\System\WWjEiaQ.exe
  2⤵
  PID:10152
- C:\Windows\System\dGsxNPV.exe
  C:\Windows\System\dGsxNPV.exe
  2⤵
  PID:10188
- C:\Windows\System\YJxrIDR.exe
  C:\Windows\System\YJxrIDR.exe
  2⤵
  PID:10216
- C:\Windows\System\HMToPdj.exe
  C:\Windows\System\HMToPdj.exe
  2⤵
  PID:9232
- C:\Windows\System\bPntxWc.exe
  C:\Windows\System\bPntxWc.exe
  2⤵
  PID:9304
- C:\Windows\System\dNXXNAx.exe
  C:\Windows\System\dNXXNAx.exe
  2⤵
  PID:9368
- C:\Windows\System\uhqafvj.exe
  C:\Windows\System\uhqafvj.exe
  2⤵
  PID:9428
- C:\Windows\System\WJvveuj.exe
  C:\Windows\System\WJvveuj.exe
  2⤵
  PID:9484
- C:\Windows\System\etigFlA.exe
  C:\Windows\System\etigFlA.exe
  2⤵
  PID:9560
- C:\Windows\System\yPCqbDF.exe
  C:\Windows\System\yPCqbDF.exe
  2⤵
  PID:9592
- C:\Windows\System\DQqaCoV.exe
  C:\Windows\System\DQqaCoV.exe
  2⤵
  PID:9676
- C:\Windows\System\CGEJXtM.exe
  C:\Windows\System\CGEJXtM.exe
  2⤵
  PID:9736
- C:\Windows\System\qNHSqfe.exe
  C:\Windows\System\qNHSqfe.exe
  2⤵
  PID:9792
- C:\Windows\System\NzhJLoN.exe
  C:\Windows\System\NzhJLoN.exe
  2⤵
  PID:9864
- C:\Windows\System\wNFWlNI.exe
  C:\Windows\System\wNFWlNI.exe
  2⤵
  PID:9900
- C:\Windows\System\OPVckao.exe
  C:\Windows\System\OPVckao.exe
  2⤵
  PID:9988
- C:\Windows\System\AQyIbNa.exe
  C:\Windows\System\AQyIbNa.exe
  2⤵
  PID:10064
- C:\Windows\System\XgrAWtj.exe
  C:\Windows\System\XgrAWtj.exe
  2⤵
  PID:10128
- C:\Windows\System\Sinisqs.exe
  C:\Windows\System\Sinisqs.exe
  2⤵
  PID:10180
- C:\Windows\System\jzrjtMY.exe
  C:\Windows\System\jzrjtMY.exe
  2⤵
  PID:9260
- C:\Windows\System\mQNFCBY.exe
  C:\Windows\System\mQNFCBY.exe
  2⤵
  PID:9396
- C:\Windows\System\aKYuOjV.exe
  C:\Windows\System\aKYuOjV.exe
  2⤵
  PID:9540
- C:\Windows\System\QCSMoPT.exe
  C:\Windows\System\QCSMoPT.exe
  2⤵
  PID:9708
- C:\Windows\System\gMTMwje.exe
  C:\Windows\System\gMTMwje.exe
  2⤵
  PID:9836
- C:\Windows\System\rAKGTqr.exe
  C:\Windows\System\rAKGTqr.exe
  2⤵
  PID:9984
- C:\Windows\System\cYsSSYf.exe
  C:\Windows\System\cYsSSYf.exe
  2⤵
  PID:10144
- C:\Windows\System\gBwnukE.exe
  C:\Windows\System\gBwnukE.exe
  2⤵
  PID:9340
- C:\Windows\System\YDNiDph.exe
  C:\Windows\System\YDNiDph.exe
  2⤵
  PID:9180
- C:\Windows\System\DAynujb.exe
  C:\Windows\System\DAynujb.exe
  2⤵
  PID:9876
- C:\Windows\System\OcmCWua.exe
  C:\Windows\System\OcmCWua.exe
  2⤵
  PID:10104
- C:\Windows\System\MqfIKYc.exe
  C:\Windows\System\MqfIKYc.exe
  2⤵
  PID:4240
- C:\Windows\System\EpaBagl.exe
  C:\Windows\System\EpaBagl.exe
  2⤵
  PID:9512
- C:\Windows\System\CDhILqv.exe
  C:\Windows\System\CDhILqv.exe
  2⤵
  PID:10248
- C:\Windows\System\uPkYHXf.exe
  C:\Windows\System\uPkYHXf.exe
  2⤵
  PID:10276
- C:\Windows\System\ajRRlXc.exe
  C:\Windows\System\ajRRlXc.exe
  2⤵
  PID:10304
- C:\Windows\System\VjBzrRD.exe
  C:\Windows\System\VjBzrRD.exe
  2⤵
  PID:10320
- C:\Windows\System\ZgKBtEw.exe
  C:\Windows\System\ZgKBtEw.exe
  2⤵
  PID:10360
- C:\Windows\System\ikkoDyc.exe
  C:\Windows\System\ikkoDyc.exe
  2⤵
  PID:10388
- C:\Windows\System\UMPXJXJ.exe
  C:\Windows\System\UMPXJXJ.exe
  2⤵
  PID:10416
- C:\Windows\System\JdnuZBS.exe
  C:\Windows\System\JdnuZBS.exe
  2⤵
  PID:10444
- C:\Windows\System\VPERdAA.exe
  C:\Windows\System\VPERdAA.exe
  2⤵
  PID:10472
- C:\Windows\System\SctikxD.exe
  C:\Windows\System\SctikxD.exe
  2⤵
  PID:10500
- C:\Windows\System\vUKYOSU.exe
  C:\Windows\System\vUKYOSU.exe
  2⤵
  PID:10528
- C:\Windows\System\heRnlwt.exe
  C:\Windows\System\heRnlwt.exe
  2⤵
  PID:10544
- C:\Windows\System\qkHbabf.exe
  C:\Windows\System\qkHbabf.exe
  2⤵
  PID:10584
- C:\Windows\System\rAQxUYy.exe
  C:\Windows\System\rAQxUYy.exe
  2⤵
  PID:10612
- C:\Windows\System\GRmvYqX.exe
  C:\Windows\System\GRmvYqX.exe
  2⤵
  PID:10628
- C:\Windows\System\Ahiqtnn.exe
  C:\Windows\System\Ahiqtnn.exe
  2⤵
  PID:10660
- C:\Windows\System\UZrVxZe.exe
  C:\Windows\System\UZrVxZe.exe
  2⤵
  PID:10684
- C:\Windows\System\WkgQgUo.exe
  C:\Windows\System\WkgQgUo.exe
  2⤵
  PID:10716
- C:\Windows\System\HByMNya.exe
  C:\Windows\System\HByMNya.exe
  2⤵
  PID:10740
- C:\Windows\System\VkLRLLZ.exe
  C:\Windows\System\VkLRLLZ.exe
  2⤵
  PID:10768
- C:\Windows\System\dTfjNJN.exe
  C:\Windows\System\dTfjNJN.exe
  2⤵
  PID:10796
- C:\Windows\System\WAtWMJT.exe
  C:\Windows\System\WAtWMJT.exe
  2⤵
  PID:10836
- C:\Windows\System\ZpLhmlg.exe
  C:\Windows\System\ZpLhmlg.exe
  2⤵
  PID:10856
- C:\Windows\System\IHJtaWh.exe
  C:\Windows\System\IHJtaWh.exe
  2⤵
  PID:10896
- C:\Windows\System\fUCuBME.exe
  C:\Windows\System\fUCuBME.exe
  2⤵
  PID:10912
- C:\Windows\System\tleweXv.exe
  C:\Windows\System\tleweXv.exe
  2⤵
  PID:10952
- C:\Windows\System\FzyjGLI.exe
  C:\Windows\System\FzyjGLI.exe
  2⤵
  PID:10980
- C:\Windows\System\OBrPqWC.exe
  C:\Windows\System\OBrPqWC.exe
  2⤵
  PID:11008
- C:\Windows\System\PxTTASv.exe
  C:\Windows\System\PxTTASv.exe
  2⤵
  PID:11024
- C:\Windows\System\NDCkJhn.exe
  C:\Windows\System\NDCkJhn.exe
  2⤵
  PID:11044
- C:\Windows\System\KbhZCEf.exe
  C:\Windows\System\KbhZCEf.exe
  2⤵
  PID:11064
- C:\Windows\System\shMgigB.exe
  C:\Windows\System\shMgigB.exe
  2⤵
  PID:11096
- C:\Windows\System\rQtjTWN.exe
  C:\Windows\System\rQtjTWN.exe
  2⤵
  PID:11136
- C:\Windows\System\JvEPyQd.exe
  C:\Windows\System\JvEPyQd.exe
  2⤵
  PID:11176
- C:\Windows\System\xyRGQsT.exe
  C:\Windows\System\xyRGQsT.exe
  2⤵
  PID:11212
- C:\Windows\System\lPVyYfQ.exe
  C:\Windows\System\lPVyYfQ.exe
  2⤵
  PID:11240
- C:\Windows\System\LxPpsvg.exe
  C:\Windows\System\LxPpsvg.exe
  2⤵
  PID:4440
- C:\Windows\System\xQHtUlk.exe
  C:\Windows\System\xQHtUlk.exe
  2⤵
  PID:10336
- C:\Windows\System\poTIRnb.exe
  C:\Windows\System\poTIRnb.exe
  2⤵
  PID:10372
- C:\Windows\System\ghADTwb.exe
  C:\Windows\System\ghADTwb.exe
  2⤵
  PID:10436
- C:\Windows\System\bqYiCFE.exe
  C:\Windows\System\bqYiCFE.exe
  2⤵
  PID:10460
- C:\Windows\System\rVycqop.exe
  C:\Windows\System\rVycqop.exe
  2⤵
  PID:10568
- C:\Windows\System\prZYkPJ.exe
  C:\Windows\System\prZYkPJ.exe
  2⤵
  PID:10600
- C:\Windows\System\wPJlywz.exe
  C:\Windows\System\wPJlywz.exe
  2⤵
  PID:10676
- C:\Windows\System\XRKVGqs.exe
  C:\Windows\System\XRKVGqs.exe
  2⤵
  PID:10724
- C:\Windows\System\RpgIPFh.exe
  C:\Windows\System\RpgIPFh.exe
  2⤵
  PID:10820
- C:\Windows\System\GXhbjwL.exe
  C:\Windows\System\GXhbjwL.exe
  2⤵
  PID:10888
- C:\Windows\System\zVIQWfV.exe
  C:\Windows\System\zVIQWfV.exe
  2⤵
  PID:10924
- C:\Windows\System\jWfGlyQ.exe
  C:\Windows\System\jWfGlyQ.exe
  2⤵
  PID:10996
- C:\Windows\System\pZhFoKk.exe
  C:\Windows\System\pZhFoKk.exe
  2⤵
  PID:11108
- C:\Windows\System\KqSXWqA.exe
  C:\Windows\System\KqSXWqA.exe
  2⤵
  PID:11124
- C:\Windows\System\AYgOIYS.exe
  C:\Windows\System\AYgOIYS.exe
  2⤵
  PID:11224
- C:\Windows\System\DlcTOZQ.exe
  C:\Windows\System\DlcTOZQ.exe
  2⤵
  PID:5020
- C:\Windows\System\WBtDrpP.exe
  C:\Windows\System\WBtDrpP.exe
  2⤵
  PID:3532
- C:\Windows\System\dVlJaeM.exe
  C:\Windows\System\dVlJaeM.exe
  2⤵
  PID:7252
- C:\Windows\System\jJpwdzK.exe
  C:\Windows\System\jJpwdzK.exe
  2⤵
  PID:10400
- C:\Windows\System\YHcwbMR.exe
  C:\Windows\System\YHcwbMR.exe
  2⤵
  PID:10572
- C:\Windows\System\ZYliwAK.exe
  C:\Windows\System\ZYliwAK.exe
  2⤵
  PID:10752
- C:\Windows\System\IexSJUd.exe
  C:\Windows\System\IexSJUd.exe
  2⤵
  PID:10908
- C:\Windows\System\iHbLhTU.exe
  C:\Windows\System\iHbLhTU.exe
  2⤵
  PID:11080
- C:\Windows\System\vPoxBKK.exe
  C:\Windows\System\vPoxBKK.exe
  2⤵
  PID:11236
- C:\Windows\System\pBQzcGt.exe
  C:\Windows\System\pBQzcGt.exe
  2⤵
  PID:11256
- C:\Windows\System\zukyoCB.exe
  C:\Windows\System\zukyoCB.exe
  2⤵
  PID:10408
- C:\Windows\System\fZKdUMf.exe
  C:\Windows\System\fZKdUMf.exe
  2⤵
  PID:10904
- C:\Windows\System\GEDcfdU.exe
  C:\Windows\System\GEDcfdU.exe
  2⤵
  PID:10260
- C:\Windows\System\XxaVzqK.exe
  C:\Windows\System\XxaVzqK.exe
  2⤵
  PID:10880
- C:\Windows\System\AplWKEQ.exe
  C:\Windows\System\AplWKEQ.exe
  2⤵
  PID:10356
- C:\Windows\System\gMghnRG.exe
  C:\Windows\System\gMghnRG.exe
  2⤵
  PID:11284
- C:\Windows\System\DYRCLYX.exe
  C:\Windows\System\DYRCLYX.exe
  2⤵
  PID:11324
- C:\Windows\System\QYLGRuj.exe
  C:\Windows\System\QYLGRuj.exe
  2⤵
  PID:11352
- C:\Windows\System\RNasdcj.exe
  C:\Windows\System\RNasdcj.exe
  2⤵
  PID:11380
- C:\Windows\System\HYlEUcc.exe
  C:\Windows\System\HYlEUcc.exe
  2⤵
  PID:11396
- C:\Windows\System\UuIKBKe.exe
  C:\Windows\System\UuIKBKe.exe
  2⤵
  PID:11436
- C:\Windows\System\VBtJMHr.exe
  C:\Windows\System\VBtJMHr.exe
  2⤵
  PID:11464
- C:\Windows\System\HEbigHo.exe
  C:\Windows\System\HEbigHo.exe
  2⤵
  PID:11480
- C:\Windows\System\WuNvAGs.exe
  C:\Windows\System\WuNvAGs.exe
  2⤵
  PID:11508
- C:\Windows\System\mgzdowm.exe
  C:\Windows\System\mgzdowm.exe
  2⤵
  PID:11548
- C:\Windows\System\rlbyJCY.exe
  C:\Windows\System\rlbyJCY.exe
  2⤵
  PID:11576
- C:\Windows\System\LueBCtD.exe
  C:\Windows\System\LueBCtD.exe
  2⤵
  PID:11592
- C:\Windows\System\btrOeLc.exe
  C:\Windows\System\btrOeLc.exe
  2⤵
  PID:11620
- C:\Windows\System\DxogKlo.exe
  C:\Windows\System\DxogKlo.exe
  2⤵
  PID:11648
- C:\Windows\System\VRHkMvD.exe
  C:\Windows\System\VRHkMvD.exe
  2⤵
  PID:11688
- C:\Windows\System\IhBPkDv.exe
  C:\Windows\System\IhBPkDv.exe
  2⤵
  PID:11704
- C:\Windows\System\YSSXlQj.exe
  C:\Windows\System\YSSXlQj.exe
  2⤵
  PID:11744
- C:\Windows\System\dBsNwQF.exe
  C:\Windows\System\dBsNwQF.exe
  2⤵
  PID:11760
- C:\Windows\System\QkETByx.exe
  C:\Windows\System\QkETByx.exe
  2⤵
  PID:11780
- C:\Windows\System\vobFGqD.exe
  C:\Windows\System\vobFGqD.exe
  2⤵
  PID:11804
- C:\Windows\System\noULIzT.exe
  C:\Windows\System\noULIzT.exe
  2⤵
  PID:11848
- C:\Windows\System\xEOUvHx.exe
  C:\Windows\System\xEOUvHx.exe
  2⤵
  PID:11872
- C:\Windows\System\ZcDdtbv.exe
  C:\Windows\System\ZcDdtbv.exe
  2⤵
  PID:11904
- C:\Windows\System\oeJagvV.exe
  C:\Windows\System\oeJagvV.exe
  2⤵
  PID:11940
- C:\Windows\System\QTRposG.exe
  C:\Windows\System\QTRposG.exe
  2⤵
  PID:11968
- C:\Windows\System\CYaLkOE.exe
  C:\Windows\System\CYaLkOE.exe
  2⤵
  PID:11984
- C:\Windows\System\EMdXkiX.exe
  C:\Windows\System\EMdXkiX.exe
  2⤵
  PID:12024
- C:\Windows\System\oXasLmC.exe
  C:\Windows\System\oXasLmC.exe
  2⤵
  PID:12052
- C:\Windows\System\aLDJjOv.exe
  C:\Windows\System\aLDJjOv.exe
  2⤵
  PID:12080
- C:\Windows\System\DDvnYNP.exe
  C:\Windows\System\DDvnYNP.exe
  2⤵
  PID:12108
- C:\Windows\System\oTPoUFj.exe
  C:\Windows\System\oTPoUFj.exe
  2⤵
  PID:12136
- C:\Windows\System\HnBliuA.exe
  C:\Windows\System\HnBliuA.exe
  2⤵
  PID:12164
- C:\Windows\System\hZhziAx.exe
  C:\Windows\System\hZhziAx.exe
  2⤵
  PID:12184
- C:\Windows\System\zfJWdqm.exe
  C:\Windows\System\zfJWdqm.exe
  2⤵
  PID:12208
- C:\Windows\System\NqwjhFO.exe
  C:\Windows\System\NqwjhFO.exe
  2⤵
  PID:12236
- C:\Windows\System\LtQVXqh.exe
  C:\Windows\System\LtQVXqh.exe
  2⤵
  PID:12256
- C:\Windows\System\qYyDXJf.exe
  C:\Windows\System\qYyDXJf.exe
  2⤵
  PID:12276
- C:\Windows\System\jNiKkEB.exe
  C:\Windows\System\jNiKkEB.exe
  2⤵
  PID:11316
- C:\Windows\System\NkVIpZS.exe
  C:\Windows\System\NkVIpZS.exe
  2⤵
  PID:11388
- C:\Windows\System\rZQydnR.exe
  C:\Windows\System\rZQydnR.exe
  2⤵
  PID:11452
- C:\Windows\System\MepasnI.exe
  C:\Windows\System\MepasnI.exe
  2⤵
  PID:11520
- C:\Windows\System\cxuxVHc.exe
  C:\Windows\System\cxuxVHc.exe
  2⤵
  PID:11584
- C:\Windows\System\KaXjega.exe
  C:\Windows\System\KaXjega.exe
  2⤵
  PID:11604
- C:\Windows\System\ODciSuT.exe
  C:\Windows\System\ODciSuT.exe
  2⤵
  PID:11696
- C:\Windows\System\JWfsKlO.exe
  C:\Windows\System\JWfsKlO.exe
  2⤵
  PID:11752
- C:\Windows\System\BWQHauz.exe
  C:\Windows\System\BWQHauz.exe
  2⤵
  PID:11816
- C:\Windows\System\ZYKAuzi.exe
  C:\Windows\System\ZYKAuzi.exe
  2⤵
  PID:11884
- C:\Windows\System\vOKgqbz.exe
  C:\Windows\System\vOKgqbz.exe
  2⤵
  PID:11900
- C:\Windows\System\UrkrUvu.exe
  C:\Windows\System\UrkrUvu.exe
  2⤵
  PID:11980
- C:\Windows\System\dlgxHiv.exe
  C:\Windows\System\dlgxHiv.exe
  2⤵
  PID:12120
- C:\Windows\System\ODrJzNY.exe
  C:\Windows\System\ODrJzNY.exe
  2⤵
  PID:12192
- C:\Windows\System\UqHkUyp.exe
  C:\Windows\System\UqHkUyp.exe
  2⤵
  PID:12200
- C:\Windows\System\CplcfdS.exe
  C:\Windows\System\CplcfdS.exe
  2⤵
  PID:11268
- C:\Windows\System\nDRdHpp.exe
  C:\Windows\System\nDRdHpp.exe
  2⤵
  PID:11428
- C:\Windows\System\MFBMTQG.exe
  C:\Windows\System\MFBMTQG.exe
  2⤵
  PID:11568
- C:\Windows\System\AOnmmfd.exe
  C:\Windows\System\AOnmmfd.exe
  2⤵
  PID:11724
- C:\Windows\System\Dscevpk.exe
  C:\Windows\System\Dscevpk.exe
  2⤵
  PID:11836
- C:\Windows\System\atEPVOo.exe
  C:\Windows\System\atEPVOo.exe
  2⤵
  PID:11844
- C:\Windows\System\wRzsJRv.exe
  C:\Windows\System\wRzsJRv.exe
  2⤵
  PID:12100
- C:\Windows\System\EJIHdok.exe
  C:\Windows\System\EJIHdok.exe
  2⤵
  PID:11348
- C:\Windows\System\LQMPApo.exe
  C:\Windows\System\LQMPApo.exe
  2⤵
  PID:1216
- C:\Windows\System\pugGcAC.exe
  C:\Windows\System\pugGcAC.exe
  2⤵
  PID:11788
- C:\Windows\System\nVrifpW.exe
  C:\Windows\System\nVrifpW.exe
  2⤵
  PID:12204
- C:\Windows\System\qxGjNvr.exe
  C:\Windows\System\qxGjNvr.exe
  2⤵
  PID:11684
- C:\Windows\System\JiuRTDe.exe
  C:\Windows\System\JiuRTDe.exe
  2⤵
  PID:12016
- C:\Windows\System\wEBHziN.exe
  C:\Windows\System\wEBHziN.exe
  2⤵
  PID:12296
- C:\Windows\System\aZnhpBp.exe
  C:\Windows\System\aZnhpBp.exe
  2⤵
  PID:12312
- C:\Windows\System\XvEwlhv.exe
  C:\Windows\System\XvEwlhv.exe
  2⤵
  PID:12340
- C:\Windows\System\KwzSMxF.exe
  C:\Windows\System\KwzSMxF.exe
  2⤵
  PID:12384
- C:\Windows\System\MOLqFPS.exe
  C:\Windows\System\MOLqFPS.exe
  2⤵
  PID:12400
- C:\Windows\System\PvYrrcR.exe
  C:\Windows\System\PvYrrcR.exe
  2⤵
  PID:12428
- C:\Windows\System\vFBYnGD.exe
  C:\Windows\System\vFBYnGD.exe
  2⤵
  PID:12444
- C:\Windows\System\ZPxmfVV.exe
  C:\Windows\System\ZPxmfVV.exe
  2⤵
  PID:12464
- C:\Windows\System\jwUDbdc.exe
  C:\Windows\System\jwUDbdc.exe
  2⤵
  PID:12496
- C:\Windows\System\UjIsBOS.exe
  C:\Windows\System\UjIsBOS.exe
  2⤵
  PID:12516
- C:\Windows\System\vNVVtkf.exe
  C:\Windows\System\vNVVtkf.exe
  2⤵
  PID:12548
- C:\Windows\System\PRZyZNE.exe
  C:\Windows\System\PRZyZNE.exe
  2⤵
  PID:12584
- C:\Windows\System\cwAOQNk.exe
  C:\Windows\System\cwAOQNk.exe
  2⤵
  PID:12612
- C:\Windows\System\eBebYqI.exe
  C:\Windows\System\eBebYqI.exe
  2⤵
  PID:12664
- C:\Windows\System\wNailOM.exe
  C:\Windows\System\wNailOM.exe
  2⤵
  PID:12680
- C:\Windows\System\BqfIjcJ.exe
  C:\Windows\System\BqfIjcJ.exe
  2⤵
  PID:12716
- C:\Windows\System\FfOPcIE.exe
  C:\Windows\System\FfOPcIE.exe
  2⤵
  PID:12740
- C:\Windows\System\KlUFXsB.exe
  C:\Windows\System\KlUFXsB.exe
  2⤵
  PID:12764
- C:\Windows\System\nBbQqYT.exe
  C:\Windows\System\nBbQqYT.exe
  2⤵
  PID:12796
- C:\Windows\System\rQYGgWI.exe
  C:\Windows\System\rQYGgWI.exe
  2⤵
  PID:12832
- C:\Windows\System\NddohOg.exe
  C:\Windows\System\NddohOg.exe
  2⤵
  PID:12848
- C:\Windows\System\PcfsvTI.exe
  C:\Windows\System\PcfsvTI.exe
  2⤵
  PID:12876
- C:\Windows\System\GUmGYwB.exe
  C:\Windows\System\GUmGYwB.exe
  2⤵
  PID:12904
- C:\Windows\System\sUsnJgO.exe
  C:\Windows\System\sUsnJgO.exe
  2⤵
  PID:12980
- C:\Windows\System\sTZbuaG.exe
  C:\Windows\System\sTZbuaG.exe
  2⤵
  PID:13000
- C:\Windows\System\wLbYLFI.exe
  C:\Windows\System\wLbYLFI.exe
  2⤵
  PID:13020
- C:\Windows\System\kIZXkwM.exe
  C:\Windows\System\kIZXkwM.exe
  2⤵
  PID:13040
- C:\Windows\System\DpDcYPA.exe
  C:\Windows\System\DpDcYPA.exe
  2⤵
  PID:13076
- C:\Windows\System\ZonOZew.exe
  C:\Windows\System\ZonOZew.exe
  2⤵
  PID:13096
- C:\Windows\System\GIvQtBL.exe
  C:\Windows\System\GIvQtBL.exe
  2⤵
  PID:13148
- C:\Windows\System\VbFcUSi.exe
  C:\Windows\System\VbFcUSi.exe
  2⤵
  PID:13176
- C:\Windows\System\EGDBXzg.exe
  C:\Windows\System\EGDBXzg.exe
  2⤵
  PID:13204
- C:\Windows\System\qhkrAuI.exe
  C:\Windows\System\qhkrAuI.exe
  2⤵
  PID:13220
- C:\Windows\System\GvJhLJX.exe
  C:\Windows\System\GvJhLJX.exe
  2⤵
  PID:13252
- C:\Windows\System\qSNTjdt.exe
  C:\Windows\System\qSNTjdt.exe
  2⤵
  PID:13276
- C:\Windows\System\UsMGSuw.exe
  C:\Windows\System\UsMGSuw.exe
  2⤵
  PID:12292
- C:\Windows\System\qXAvegx.exe
  C:\Windows\System\qXAvegx.exe
  2⤵
  PID:12376
- C:\Windows\System\lZHLUpf.exe
  C:\Windows\System\lZHLUpf.exe
  2⤵
  PID:12420
- C:\Windows\System\OcMpgOd.exe
  C:\Windows\System\OcMpgOd.exe
  2⤵
  PID:12436
- C:\Windows\System\pfvmMij.exe
  C:\Windows\System\pfvmMij.exe
  2⤵
  PID:12528
- C:\Windows\System\HoaDwQR.exe
  C:\Windows\System\HoaDwQR.exe
  2⤵
  PID:12576
- C:\Windows\System\EJoGUep.exe
  C:\Windows\System\EJoGUep.exe
  2⤵
  PID:12640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ke1hl4na.1y2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ke1hl4na.1y2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AxLcbjY.exe

Path C:\Windows\System\AxLcbjY.exe
Size 2.8MB
SHA256 27194e3632bff8274a8a0506b73fe3b8f18598991601787774d0b7843838e4ac
MD5 db7fa8fcdacb36b1976b77c8fbf69943
SHA1 883a1f9a9e837873381173bcbdb0156657963dc0
SHA512 1cf6ac1f8068d2a45452b92e731a1c62861927d1d4b07abac029f8050f327f4f12d2a90f03630bc30f1891209544f7fd05bfb9c3da69b148291556203bb50939
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24i:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

BPDGViL.exe

Path C:\Windows\System\BPDGViL.exe
Size 2.8MB
SHA256 051ca8138d3337fcfce36c7c1f5c28b5077107514257b28f3c2d3c50ec751b37
MD5 e557375dd575bfa9ecd2806e052ed191
SHA1 f2b3d86aa9d89921f4ab247d37dd059822e32479
SHA512 a1a76bdd302a0afbf3740549fec9866cf26b50f89619d1c5e0086e91d6a5a447c6ec90b2a2acc884e434bf41e29270dc93d3b286ca539336806fc7d419508fc9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24F:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CNmNGdb.exe

Path C:\Windows\System\CNmNGdb.exe
Size 2.8MB
SHA256 95bc7ed7ee153b59d94929d73b3e51b91f308126abf38250ac5ced22736ae7dc
MD5 03d818d1728363c7ff43570d20f9bedb
SHA1 96b9363b01268eb95cc89f0c7835586bf273dac7
SHA512 7f0eccd5ed67ec77333d71a5abb37cbe14c12b0ded28194925f209deb653b889a87c722d5dd1510ab0b66765443813a0670a670151f244d1010e027a9fd89735
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24d:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

CXoGgct.exe

Path C:\Windows\System\CXoGgct.exe
Size 2.8MB
SHA256 1aa3dd9c66e5b5e77aeeea8cac71dc57735448b069b6d57a73ac5750ab84f585
MD5 bc88ace8a16fcc2d401d84c392509560
SHA1 496dbd6e1091c7102bad26b6ae615bd9c4a0480b
SHA512 c4576312915d409be9ff87e0d41b7106e64104b0795c62c4461a9984c54584b53651d419054e45c9658249da4e41da5a3e55960cdcdca49433545ff14c1f52fe
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24L:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

CdtkCVT.exe

Path C:\Windows\System\CdtkCVT.exe
Size 2.8MB
SHA256 da61dfe605861aff081a36f6b09c1521f0524ff612f46bb32b79adc14fe25fa0
MD5 4b926260998a00dfe5b144b6ba86ca3a
SHA1 d646f88266b28bf37fd0e22e4f9af6352c56ef80
SHA512 2c66e524e8b530ea4e5252f570aee3e5859c0cdc180fae9737145eb9ce2bad2ef375d11f197407986221fa81091226e39cfb7ab8c20764743450d7bf496553b9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24S:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

DrVWmws.exe

Path C:\Windows\System\DrVWmws.exe
Size 2.8MB
SHA256 b3263e75e7235c72a3966a43a2e1461ca32f0a885db3d0fc0c2eedccdb620b3b
MD5 2cf2ac05e8285130fb2e8088aafbf557
SHA1 d734e7e4cd0f1beddf8d2a0ed8a04e02399bf247
SHA512 4859e4ee54519015ebc2c4f8c98e00f528d8f61bb285004180b32e8d462b7c83ee8294c9999d73d20a30e3749c470485079f14a32bab381f2e67285a4b0fc0d8
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24T0:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

EIFZkPv.exe

Path C:\Windows\System\EIFZkPv.exe
Size 2.8MB
SHA256 54721c8cb5b11fefd8de106cd4af34a9ed802c2c1c158dcbc7a2b715457ed6c6
MD5 d2b187d851e8758511fbb97ca3fe86ac
SHA1 9753149bda468f6f6c64f9e764ce36c65a98adc0
SHA512 86a10268ed15513ad993f1773330085a4498b9b62eabd1d580a791b78c7b9acf6a11129d355a2341545a05fdd1e47fc3dcc7d9b2ac48df090aa420bdc7debff9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24f:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

FKOqmxh.exe

Path C:\Windows\System\FKOqmxh.exe
Size 2.8MB
SHA256 aa5c7514a678d50930c27ca9006ae8d931b6ed17332153e15dd200d0ec2fa87b
MD5 be77f0ede7ce0b527b69dff23b606f28
SHA1 5314db03a4cf74f55896d2b330f7b5a2c4c25894
SHA512 272317d9129391d86d26affd66778ae3af1abdd3df9dd6d57a343eaefd2d8f3923386af33070e221e4b1805f8f2d4aeb3c4f7dbc58770d078e10f17edcf4bc74
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf249:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

FheGQmF.exe

Path C:\Windows\System\FheGQmF.exe
Size 2.8MB
SHA256 6c6b99a71dace67d757dabe8e2b7438f077efc154b57c1d595424b2ba7fe02b2
MD5 d3aabdcf4ffea58b0807bc50829eaa81
SHA1 3428c545a8c3e13874385f03254059da7bccde7b
SHA512 8a256ac5683db0168225177058e181559937707fa0ce80807409b1082d3d6a103c09a5907d24ece1a3858a24ea38c376a1cbf93e5030c66ade2e5e6293711ff9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24M:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

FsWLaho.exe

Path C:\Windows\System\FsWLaho.exe
Size 2.8MB
SHA256 a58bf37db6b3c84d6787b0db89b76768758f54af2b92bf1562a55fd602a6af2d
MD5 648624cce0526dc7a230e5aec10cda28
SHA1 596cb28494d2b9bf4cf9f43e912ba0eca02f73a4
SHA512 5af965421bc44c12798f60f990944aca9a2aa0e5f9add47d2318e38bf7d60a5c85b893ae94b3308e4ccb004f6207caf961c9cce9f94a944bfb818355bab5eb69
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24y:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

JOxFqBG.exe

Path C:\Windows\System\JOxFqBG.exe
Size 2.8MB
SHA256 47623b3dad00dec88378f4c0d5f22e977b010c20a89134f0049528da39b826df
MD5 bb4587965476e0543a7f8e9b29de3046
SHA1 15b6bc3d537dcfb153d5d27e821b577c0ed714ea
SHA512 7a70477ecadb374390c9100a29ee1bb67ad36d4c1c0ef84f56e78f1f77f40946ff62d3bc43b369775b80137779103e8261bbeeae8ef8a4c6be191e9aed5161a0
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24F:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

JxaRgxL.exe

Path C:\Windows\System\JxaRgxL.exe
Size 2.8MB
SHA256 2dc3dd5504255684e10ae835bdc833ffaabf3ff2866fa75792b4733c0575d7d6
MD5 dede45f2a0ca377d5e078b0ac635893c
SHA1 aaf136b16a1931c50dd8bf32954a7a3013acdb2b
SHA512 46cc43e960a54a94afa8944c103627e7da7c5512df4f8d2ace0f7340918a831bf0a479c007ac3c4d21edbee04e775d8cb00049829ce7077ff374601418c2ee00
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24O:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjPUlRD.exe

Path C:\Windows\System\LjPUlRD.exe
Size 2.8MB
SHA256 17aad9418158185db770e84e2e8b601f84e17aa66df00038cd0a2d7b83814cfb
MD5 6915a53e68e0a408c874c918763bfef1
SHA1 144b6f33e3f6f98ffc79989dfd850eb321c5afa4
SHA512 33c228f517d1ed7a8a7a0d92a8027baf5d366a42553fd34fa58aa556738b10b2d591876fab99b850b36f133ab134cb0970fe432d20d97ef404e0d233ee715e7c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24f:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

MNcNSga.exe

Path C:\Windows\System\MNcNSga.exe
Size 2.8MB
SHA256 8c42dc0a178f77a807f8b21a4df0b8188053ad00f09e8221115004db2c52e6ba
MD5 ca64e5dc98fd81d37a6a2250df5a5063
SHA1 f6c038e7e1fc9a97b4d119e4c3f691a7365cfafc
SHA512 e2a7197c19c40dcb747946b2f3a72d1964ca083f10ff2282f1e565352a21bdc651f883d593f8d699427c81fa414424b166686ef600f3fd85f059ed566d85c1f6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24z:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

QpPWxVI.exe

Path C:\Windows\System\QpPWxVI.exe
Size 2.8MB
SHA256 e1b3b324ac7b2636e9748abde70e6acbfdb29672d84b75906da2fa2ce52e853c
MD5 66d98978b3b21f202fb437156049330c
SHA1 14e92bffe2577e1ecb5f2ebaec073f02ca4018be
SHA512 794045940343d2f1944a05e41a902fb5d14861c27a7331b29fe8965ccf675a62a480f7449d6d3180d9e28ed49afa7790851073ccd4e5304c86560d7ee103f2f0
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24w:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

RBOWzmO.exe

Path C:\Windows\System\RBOWzmO.exe
Size 2.8MB
SHA256 e58d234d7d165497360fc7e17a39083b557d279e4cfefdb2e1375b9de915f170
MD5 f396eb39e08d1f0f8d1200134fcf97f8
SHA1 66881c18f3013de56f9ed95141c17bed8d30dc65
SHA512 619b382054c92a32ba01eb186adf68d123c3201583ff77fcc0bf78a6d64be6c3e99a27047222191b9408d4753389fdf9a7f95af9987dbd3c369d96328cfa6c30
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24V:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

ROGlYki.exe

Path C:\Windows\System\ROGlYki.exe
Size 2.8MB
SHA256 8643fb3c8e57ed8f438942d9defba542a807fb94918a5d9c73bab25fc2bd521f
MD5 24891ee8302eab49b84254b4cfa57dbe
SHA1 4cbb8afaf6000f4932b3b2596c2d80ef2b3d45e5
SHA512 9d0afa9bda1df80131566471533c761cc9944829150e7288504f8f0b520e72dec7f9ea677260f697d50d22197ef05839caa05dd13e9a5eae69aa7f7837f43be1
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24Bk:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

SihyadS.exe

Path C:\Windows\System\SihyadS.exe
Size 2.8MB
SHA256 37552fd6c1a47f9c13038f791834525c5b4ed3a4f368ca06c36c29c301654a3e
MD5 914c945ecb4a8e97e53164d51f7017b3
SHA1 979ae5357094e7cccb687c5d1e3d3936931a9c62
SHA512 622e76e42911bd4ee78736e455baf8aad48634fbd00a9b55bde3e980c973245cb19439f5fec75d5db0f5803026e5576377027a2aa8f9109c707d428a0d627efb
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24E:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZbnOPAf.exe

Path C:\Windows\System\ZbnOPAf.exe
Size 2.8MB
SHA256 9e714c69c28c075a53df00e29e1e826ab10dbe19200feffddc0822c597c14704
MD5 2e392c936b550017cab69d13fb8d394e
SHA1 12ef975232892e9cc1ad06a2c5120298532ccd45
SHA512 29df0cab0bd56528350b1bed55b15d0dffc665ad23ce3c79f2f9de1fd20eea9898115a18c93cf96f4e6449464db5afcf96cadbde9f9970a7a17102a41f99d8eb
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24Z:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cHdgHJU.exe

Path C:\Windows\System\cHdgHJU.exe
Size 2.8MB
SHA256 248b36337bc0101964d00ac873fea0b7a9e804e21e479fe450ea809c5687b2bd
MD5 5f7917eee0b8eb2d4c0bb7b02d71eacc
SHA1 3f8368536325d22f0e905dff81d6a37daa1444d9
SHA512 369bddba00c903d773fdbc61c3365a051cb7ae8c7a49180b0ecec92b03f3ba3422003a26b70dc602e2c773c932f3c914669772ac2d0b3ca97889de8dd2b67d37
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf248:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

cSpsppD.exe

Path C:\Windows\System\cSpsppD.exe
Size 2.8MB
SHA256 760ebbf5a9e51cbf01897280a5af21d9b6920dbb6ab20557d766ead63a70cc6a
MD5 d2f9d5c32ecd5fd73d555eba9fce3a84
SHA1 263d0618e270473dbbd60950b60de580e8be7771
SHA512 8748ddbade61e9da576d1bdea4b5c1eda754b53226bc3298e5f99b527625dd4634df245ed49666cc23d21d59705d99aeffc18a1077e065e108e91ce6be30617f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24B:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ekdiXxc.exe

Path C:\Windows\System\ekdiXxc.exe
Size 2.8MB
SHA256 d12a3c0c6b9679480ca12ec631bace6856e2868c851bc99ced1d346b70e61909
MD5 daf36db2d6a2e47f95e775ca207d726a
SHA1 0b58877e46dd899058f65f111f0b41159ba18a12
SHA512 57fc9701a0d225694fca0f26ae179f0cba2fcb8c3817c9343771dac3089b599ee00b50ede01cb06e088d56ae919661d0bd3b938d19ebd9432bee7843a04a326d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24L:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ihMjXXg.exe

Path C:\Windows\System\ihMjXXg.exe
Size 2.8MB
SHA256 b9867912789e45228e2fc74d48fa40e2d74a7e58c123cf0fd2fb721a65ec57e2
MD5 88bccfa86f0cac849aa5c348e4e9355a
SHA1 7ac82a5cbb12cb9eb542744f68054c48776b0dfb
SHA512 5f139f8a68f7d8dff39d1ad37b2cd36e3ed2864063a4077cbab4f9c34f5dd27a35d7968b508720e64733814c8e3e3930794c538178d900fea5afcccbc8c9f70e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24C:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ivwezEo.exe

Path C:\Windows\System\ivwezEo.exe
Size 2.8MB
SHA256 edfb5fe00c387f6fd09dd594676ef5ad34ff162d41578cdba530e0f9f3d641d1
MD5 6171105c40b8b6caba3f5a9ff0c48719
SHA1 aca555adc64e3b8554de4e3a413d72c5e03ab775
SHA512 f1133b015483760e3cbd50a109c0b3388a6e38daf8230a2274b2fcc880b30703c372e8ac3bf42cbea5ea82f6cc2f4fc857a372cfb9e3f56b3c7ac0161e63a8c8
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf247:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

nguZHRR.exe

Path C:\Windows\System\nguZHRR.exe
Size 2.8MB
SHA256 2483fca5a3f841fda609ff7a6f1bfd14e13d8ff245004b94d140a3f203706adb
MD5 b19bd88e0fff1027830a09e90e409e91
SHA1 d59bdb8017053d1cd37d7587b90f0c8eb8d1d744
SHA512 5bb39ad2c65b4045aa9fa1e2091fa8590c44169e5a316b981f68f7856537850534bb0ff4d17799b00435fe3425490ac4a9865c75c11660e16c0c8f6a727a99a7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24M:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc
MD5 SHA1 SHA512 SSDEEP

Submit Download

pehMfSV.exe

Path C:\Windows\System\pehMfSV.exe
Size 2.8MB
SHA256 b20d7a86ac4db9d7eceb6048b043ff8c4dfec65b15a072c3105e7b7be2dfea0b
MD5 2fe35429eb78d2a6c8ba853799bcd5ba
SHA1 537ec33c270f7f45ad2a390cab3917a7aaeaf8ee
SHA512 49a779c473780a0b9fe7a5299d40f3574988c22d928e34daabb90aa83f0701cd6fa1b2f1cbb35ed7f8ef76a27eb62d497b1074b38e6a860cda8a20f0e17f930e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24W:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

rKJGLcF.exe

Path C:\Windows\System\rKJGLcF.exe
Size 2.8MB
SHA256 0cd3661758612c8523a8cb19371ebb002f2a8d6809109bbea6b925aaf23869f9
MD5 f6044c9d5fedd7616a62d58397055186
SHA1 54fa22e8e733945c69f5d1bd900fe7698328617f
SHA512 df2164c0ae21934f146b36bedaf80e025963b423e1b94053dbdc9baa67f8298e2f9b7ae54c422f1e56a95ff661e821589492bd0b980f19b33217f5bafd6686c6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24u:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

vxkUsOH.exe

Path C:\Windows\System\vxkUsOH.exe
Size 2.8MB
SHA256 9de9b754009dcf0d2648c2c9d04dfd91107b3235c42b860ccf5861463df6ccf9
MD5 b17b2bfb6400aee059b5b76cf36226ed
SHA1 12577a84e175e6f3431bd066b7ca78c76c5920d7
SHA512 e0bbb0f37dcd0db7b4fc62df4daf722e8c48e36e2421084a489e5ab8a31f2d006fb01c1550ee2e6dfb5f0c02ba0459c9d394f5057d5b44f3bbc3e01f44b781db
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24v:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

vzGnShc.exe

Path C:\Windows\System\vzGnShc.exe
Size 2.8MB
SHA256 d18356ccc505413a4332e7fd7526c1f6ad3fcd8a5b239d0da0b93c85e49f66f3
MD5 6ca55dade1f4ceb35720ea9d42d79d33
SHA1 f15fa86ad62077d28f004aac3e59df5175539834
SHA512 046dfd42a63bebe545b85506135e990d6d4099a4ffb17b5fbce0ec1d69007d98e824b644a74dd9173d909ec7cd16dc3c2ff72f070a40eb14d47e1fbc56110051
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24O:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

xPRBjPh.exe

Path C:\Windows\System\xPRBjPh.exe
Size 2.8MB
SHA256 86b7bbf2f5a6fe7dce1ef4f6e821e3ff1c7b4ac3414aae3c1e6fd56bd7474202
MD5 a7f57eb8e2f5a6f1325b0a935af6dc45
SHA1 b4dd04d1f826948708473ce9e613bc68fb7d9396
SHA512 7771b7d0da441aa9ceeea28290a6e0f89e02675df3858ba7eaf82f06c04bb8c6728f8de1a3c0d04854c91584a0f097bff98f95fbe7a6547c26093d503a389933
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24z:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

zMUvJqF.exe

Path C:\Windows\System\zMUvJqF.exe
Size 2.8MB
SHA256 99fc66ea174fc700e1352d597e6c5d64163581f142c897f78e3f25b4c10760a0
MD5 91f7de3976cbaf15941bdf0aa478716a
SHA1 31e7316e13a8f4558009a2d59bb3a3fce47ec04f
SHA512 b8cf3f856f578e77889640c010e217820da97c4bf472dc0d296b854fecd612ec6898ef300b4727458cec48c8f0a1f82a80b1996f446ed9db09b38ca5db9ccb13
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf24J:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zSbQutX.exe

Path C:\Windows\System\zSbQutX.exe
Size 2.8MB
SHA256 6cbca474cbe38d7d95ccda835702a7d86e51bb66a08ba435e081e0a51ca00752
MD5 77b7fe139686f2fe31afb0525b296989
SHA1 3dac75fd3e6ea6c8d0dfef4a275bfd5c77ff21b3
SHA512 040318e1bbf602313d81e9b0a91c34117baef27f444ad5a5627246e1496cbedac66912e027759cc91e9f13585aed523888d063438a6dc28757191f32270c41d3
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf249:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

zTxCBPh.exe

Path C:\Windows\System\zTxCBPh.exe
Size 2.8MB
SHA256 9cfddd47c6571e9af4aced74dc297ceddeae6c605c51ef96917520ea85c3142a
MD5 1980488191cb34d521817943278bd256
SHA1 892724f78437e8cdf9c758b101ebc66631635471
SHA512 61370f5279425590ce3dce5e3f99447338bf8649767886d03aa058a2b128a585325d4baf920cb540c0739b8dc8d6d6d1fe0c2e40b719dc5a433f55ac7bf5f6a9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbaMrf245:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/908-681-0x00007FF6F6250000-0x00007FF6F6646000-memory.dmp

Download

memory/908-1992-0x00007FF6F6250000-0x00007FF6F6646000-memory.dmp

Download

memory/1404-2007-0x00007FF7DC320000-0x00007FF7DC716000-memory.dmp

Download

memory/1404-660-0x00007FF7DC320000-0x00007FF7DC716000-memory.dmp

Download

memory/1408-689-0x00007FF7ED630000-0x00007FF7EDA26000-memory.dmp

Download

memory/1408-1994-0x00007FF7ED630000-0x00007FF7EDA26000-memory.dmp

Download

memory/1468-628-0x00007FF70E8B0000-0x00007FF70ECA6000-memory.dmp

Download

memory/1468-1999-0x00007FF70E8B0000-0x00007FF70ECA6000-memory.dmp

Download

memory/1736-1996-0x00007FF7EDC50000-0x00007FF7EE046000-memory.dmp

Download

memory/1736-626-0x00007FF7EDC50000-0x00007FF7EE046000-memory.dmp

Download

memory/1744-655-0x00007FF780690000-0x00007FF780A86000-memory.dmp

Download

memory/1744-2006-0x00007FF780690000-0x00007FF780A86000-memory.dmp

Download

memory/1900-1993-0x00007FF650AE0000-0x00007FF650ED6000-memory.dmp

Download

memory/1900-624-0x00007FF650AE0000-0x00007FF650ED6000-memory.dmp

Download

memory/2108-2002-0x00007FF712450000-0x00007FF712846000-memory.dmp

Download

memory/2108-639-0x00007FF712450000-0x00007FF712846000-memory.dmp

Download

memory/2776-622-0x00007FF712A70000-0x00007FF712E66000-memory.dmp

Download

memory/2776-1988-0x00007FF712A70000-0x00007FF712E66000-memory.dmp

Download

memory/2944-657-0x00007FF7CB9E0000-0x00007FF7CBDD6000-memory.dmp

Download

memory/2944-2005-0x00007FF7CB9E0000-0x00007FF7CBDD6000-memory.dmp

Download

memory/3040-5-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Download

memory/3040-23-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/3040-42-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Download

memory/3040-38-0x000001A789E70000-0x000001A789E92000-memory.dmp

Download

memory/3088-678-0x00007FF65BE50000-0x00007FF65C246000-memory.dmp

Download

memory/3088-1987-0x00007FF65BE50000-0x00007FF65C246000-memory.dmp

Download

memory/3240-629-0x00007FF7EFC60000-0x00007FF7F0056000-memory.dmp

Download

memory/3240-1998-0x00007FF7EFC60000-0x00007FF7F0056000-memory.dmp

Download

memory/3316-1989-0x00007FF771510000-0x00007FF771906000-memory.dmp

Download

memory/3316-44-0x00007FF771510000-0x00007FF771906000-memory.dmp

Download

memory/3420-2009-0x00007FF714940000-0x00007FF714D36000-memory.dmp

Download

memory/3420-669-0x00007FF714940000-0x00007FF714D36000-memory.dmp

Download

memory/3500-1995-0x00007FF768E50000-0x00007FF769246000-memory.dmp

Download

memory/3500-625-0x00007FF768E50000-0x00007FF769246000-memory.dmp

Download

memory/4036-666-0x00007FF785590000-0x00007FF785986000-memory.dmp

Download

memory/4036-2010-0x00007FF785590000-0x00007FF785986000-memory.dmp

Download

memory/4208-623-0x00007FF6AA8A0000-0x00007FF6AAC96000-memory.dmp

Download

memory/4208-1991-0x00007FF6AA8A0000-0x00007FF6AAC96000-memory.dmp

Download

memory/4220-2003-0x00007FF6A3710000-0x00007FF6A3B06000-memory.dmp

Download

memory/4220-649-0x00007FF6A3710000-0x00007FF6A3B06000-memory.dmp

Download

memory/4256-646-0x00007FF63F290000-0x00007FF63F686000-memory.dmp

Download

memory/4256-2004-0x00007FF63F290000-0x00007FF63F686000-memory.dmp

Download

memory/4384-1-0x0000024431EA0000-0x0000024431EB0000-memory.dmp

Download

memory/4384-0-0x00007FF7562E0000-0x00007FF7566D6000-memory.dmp

Download

memory/4484-664-0x00007FF6D8B20000-0x00007FF6D8F16000-memory.dmp

Download

memory/4484-2008-0x00007FF6D8B20000-0x00007FF6D8F16000-memory.dmp

Download

memory/4536-2001-0x00007FF7A56B0000-0x00007FF7A5AA6000-memory.dmp

Download

memory/4536-631-0x00007FF7A56B0000-0x00007FF7A5AA6000-memory.dmp

Download

memory/4808-1997-0x00007FF6CCD60000-0x00007FF6CD156000-memory.dmp

Download

memory/4808-630-0x00007FF6CCD60000-0x00007FF6CD156000-memory.dmp

Download

memory/4836-2000-0x00007FF718750000-0x00007FF718B46000-memory.dmp

Download

memory/4836-627-0x00007FF718750000-0x00007FF718B46000-memory.dmp

Download

memory/5040-1990-0x00007FF68A1F0000-0x00007FF68A5E6000-memory.dmp

Download

memory/5040-621-0x00007FF68A1F0000-0x00007FF68A5E6000-memory.dmp

Download