xmrig | 65fdf4e994985ea347052456eb1c79aaa155b06df3876cb416b35611eee97c0a

Analysis

max time kernel
28s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
Size 1.8MB
Sample240614-hyl8razbpd
SHA256 65fdf4e994985ea347052456eb1c79aaa155b06df3876cb416b35611eee97c0a
MD5 abb26f2eb0cef55f831ec1e46b018e20
SHA1 4fcccb6132490bcaa28d45877bdff4201a2588a7
SHA512 29e0a695860a25b9fc7a218bc0f0993763d671b618b050ea2fa06fc8a368ce1bbb24ec5efe22c98cff0ecc23c9dc2bc0d9bba21d1a39ed5bae3f251b5ee220e2
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkp:NABG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1004-57-0x00007FF7CF130000-0x00007FF7CF522000-memory.dmp	xmrig
behavioral2/memory/2428-62-0x00007FF7AF320000-0x00007FF7AF712000-memory.dmp	xmrig
behavioral2/memory/4516-117-0x00007FF78BE40000-0x00007FF78C232000-memory.dmp	xmrig
behavioral2/memory/4960-119-0x00007FF7FC470000-0x00007FF7FC862000-memory.dmp	xmrig
behavioral2/memory/4380-122-0x00007FF65D750000-0x00007FF65DB42000-memory.dmp	xmrig
behavioral2/memory/1232-460-0x00007FF6710C0000-0x00007FF6714B2000-memory.dmp	xmrig
behavioral2/memory/2900-473-0x00007FF780A70000-0x00007FF780E62000-memory.dmp	xmrig
behavioral2/memory/4596-479-0x00007FF7EC700000-0x00007FF7ECAF2000-memory.dmp	xmrig
behavioral2/memory/856-511-0x00007FF6FA7F0000-0x00007FF6FABE2000-memory.dmp	xmrig
behavioral2/memory/2392-494-0x00007FF70DEA0000-0x00007FF70E292000-memory.dmp	xmrig
behavioral2/memory/4892-493-0x00007FF690380000-0x00007FF690772000-memory.dmp	xmrig
behavioral2/memory/5112-109-0x00007FF606D30000-0x00007FF607122000-memory.dmp	xmrig
behavioral2/memory/4868-107-0x00007FF63E590000-0x00007FF63E982000-memory.dmp	xmrig
behavioral2/memory/4756-101-0x00007FF73DF60000-0x00007FF73E352000-memory.dmp	xmrig
behavioral2/memory/4444-99-0x00007FF702E40000-0x00007FF703232000-memory.dmp	xmrig
behavioral2/memory/1596-94-0x00007FF6A31B0000-0x00007FF6A35A2000-memory.dmp	xmrig
behavioral2/memory/4588-74-0x00007FF611ED0000-0x00007FF6122C2000-memory.dmp	xmrig
behavioral2/memory/2324-70-0x00007FF7DE230000-0x00007FF7DE622000-memory.dmp	xmrig
behavioral2/memory/728-63-0x00007FF7CAC70000-0x00007FF7CB062000-memory.dmp	xmrig
behavioral2/memory/1264-60-0x00007FF745B00000-0x00007FF745EF2000-memory.dmp	xmrig
behavioral2/memory/4752-2046-0x00007FF7DDB40000-0x00007FF7DDF32000-memory.dmp	xmrig
behavioral2/memory/2596-2048-0x00007FF659AA0000-0x00007FF659E92000-memory.dmp	xmrig
behavioral2/memory/1264-2119-0x00007FF745B00000-0x00007FF745EF2000-memory.dmp	xmrig
behavioral2/memory/728-2127-0x00007FF7CAC70000-0x00007FF7CB062000-memory.dmp	xmrig
behavioral2/memory/4868-2285-0x00007FF63E590000-0x00007FF63E982000-memory.dmp	xmrig
behavioral2/memory/4516-2284-0x00007FF78BE40000-0x00007FF78C232000-memory.dmp	xmrig
behavioral2/memory/4756-2286-0x00007FF73DF60000-0x00007FF73E352000-memory.dmp	xmrig
behavioral2/memory/1596-2267-0x00007FF6A31B0000-0x00007FF6A35A2000-memory.dmp	xmrig
behavioral2/memory/4588-2224-0x00007FF611ED0000-0x00007FF6122C2000-memory.dmp	xmrig
behavioral2/memory/4392-2174-0x00007FF6D7350000-0x00007FF6D7742000-memory.dmp	xmrig
behavioral2/memory/1432-5044-0x00007FF740FC0000-0x00007FF7413B2000-memory.dmp	xmrig
behavioral2/memory/4632-2872-0x00007FF7D4A40000-0x00007FF7D4E32000-memory.dmp	xmrig
behavioral2/memory/4596-2313-0x00007FF7EC700000-0x00007FF7ECAF2000-memory.dmp	xmrig
behavioral2/memory/4892-2311-0x00007FF690380000-0x00007FF690772000-memory.dmp	xmrig
behavioral2/memory/856-2338-0x00007FF6FA7F0000-0x00007FF6FABE2000-memory.dmp	xmrig
behavioral2/memory/1232-2302-0x00007FF6710C0000-0x00007FF6714B2000-memory.dmp	xmrig
behavioral2/memory/2900-2298-0x00007FF780A70000-0x00007FF780E62000-memory.dmp	xmrig
behavioral2/memory/2392-2309-0x00007FF70DEA0000-0x00007FF70E292000-memory.dmp	xmrig
behavioral2/memory/4960-2295-0x00007FF7FC470000-0x00007FF7FC862000-memory.dmp	xmrig
behavioral2/memory/5112-2294-0x00007FF606D30000-0x00007FF607122000-memory.dmp	xmrig
behavioral2/memory/4380-2292-0x00007FF65D750000-0x00007FF65DB42000-memory.dmp	xmrig
behavioral2/memory/2324-2105-0x00007FF7DE230000-0x00007FF7DE622000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	3600	powershell.exe
13	3600	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3600	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2596	eCtFStl.exe
4752	RubyupT.exe
2324	RTUvLHq.exe
1004	RxNgZMg.exe
1264	VrlQLiu.exe
2428	pMpgCoJ.exe
728	LRRjHEm.exe
4392	YyINtuX.exe
4588	aTEpnfU.exe
1596	NBfbAxD.exe
4444	jypihZc.exe
4868	kloXHcz.exe
4756	YtNsTEO.exe
5112	wJMQeBJ.exe
4632	xqVvVpz.exe
4516	duHSyQv.exe
4960	RRNULKp.exe
4380	ZhVqQjN.exe
1232	iemaxpf.exe
2900	VXrKlpb.exe
4596	fqHqcSK.exe
4892	FSWNPoP.exe
2392	goeCXfI.exe
856	OUKnCie.exe
2368	nCKnzqI.exe
4500	IfgAnCU.exe
4904	bjYreQD.exe
4364	UIWjfvv.exe
1324	EvyozVW.exe
2780	COpXOTn.exe
4948	tqvnPdf.exe
4260	fXhOqRU.exe
3168	qrUCGOm.exe
2520	DIUOwrZ.exe
1656	xHXkwQw.exe
2836	uvmnHkT.exe
3640	TcCGyXb.exe
2788	VpBfHzt.exe
4144	UFUAHjq.exe
632	ewscoiy.exe
2272	MdKroTV.exe
220	YGfMTyL.exe
2380	tscBFhg.exe
3524	wewsDRJ.exe
4256	ANBJuaV.exe
2264	MalWFOk.exe
1384	lbhQIsv.exe
4980	TDfkFLg.exe
5132	EFwUvjX.exe
5164	DmGQFSl.exe
5196	TTWmhlb.exe
5224	hsxIMyH.exe
5252	riupngO.exe
5280	jkSuNLv.exe
5308	yLoOxqH.exe
5336	BWrkMPK.exe
5364	LQlrxRm.exe
5392	LteptvC.exe
5432	enDOJYs.exe
5472	eavRjTG.exe
5500	BTEbYcj.exe
5516	hBJCxlL.exe
5544	DTUpYcp.exe
5572	OrIlqpn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1432-0-0x00007FF740FC0000-0x00007FF7413B2000-memory.dmp	upx
behavioral2/files/0x000f00000002325c-5.dat	upx
behavioral2/files/0x000700000002328c-8.dat	upx
behavioral2/memory/2596-11-0x00007FF659AA0000-0x00007FF659E92000-memory.dmp	upx
behavioral2/files/0x000800000002328b-17.dat	upx
behavioral2/files/0x000700000002328d-22.dat	upx
behavioral2/files/0x000700000002328e-34.dat	upx
behavioral2/files/0x0007000000023291-44.dat	upx
behavioral2/files/0x0008000000023289-49.dat	upx
behavioral2/files/0x000800000002328f-53.dat	upx
behavioral2/memory/1004-57-0x00007FF7CF130000-0x00007FF7CF522000-memory.dmp	upx
behavioral2/memory/2428-62-0x00007FF7AF320000-0x00007FF7AF712000-memory.dmp	upx
behavioral2/files/0x0007000000023292-73.dat	upx
behavioral2/files/0x0007000000023295-85.dat	upx
behavioral2/files/0x0007000000023294-88.dat	upx
behavioral2/files/0x0007000000023296-96.dat	upx
behavioral2/files/0x0007000000023297-102.dat	upx
behavioral2/memory/4632-104-0x00007FF7D4A40000-0x00007FF7D4E32000-memory.dmp	upx
behavioral2/memory/4516-117-0x00007FF78BE40000-0x00007FF78C232000-memory.dmp	upx
behavioral2/memory/4960-119-0x00007FF7FC470000-0x00007FF7FC862000-memory.dmp	upx
behavioral2/memory/4380-122-0x00007FF65D750000-0x00007FF65DB42000-memory.dmp	upx
behavioral2/files/0x000700000002329a-120.dat	upx
behavioral2/files/0x000700000002329d-138.dat	upx
behavioral2/files/0x000700000002329e-146.dat	upx
behavioral2/files/0x00070000000232a1-153.dat	upx
behavioral2/files/0x00070000000232a3-169.dat	upx
behavioral2/files/0x00070000000232a7-189.dat	upx
behavioral2/memory/1232-460-0x00007FF6710C0000-0x00007FF6714B2000-memory.dmp	upx
behavioral2/memory/2900-473-0x00007FF780A70000-0x00007FF780E62000-memory.dmp	upx
behavioral2/memory/4596-479-0x00007FF7EC700000-0x00007FF7ECAF2000-memory.dmp	upx
behavioral2/memory/856-511-0x00007FF6FA7F0000-0x00007FF6FABE2000-memory.dmp	upx
behavioral2/memory/2392-494-0x00007FF70DEA0000-0x00007FF70E292000-memory.dmp	upx
behavioral2/memory/4892-493-0x00007FF690380000-0x00007FF690772000-memory.dmp	upx
behavioral2/files/0x00070000000232a8-193.dat	upx
behavioral2/files/0x00070000000232a6-181.dat	upx
behavioral2/files/0x00070000000232a5-176.dat	upx
behavioral2/files/0x00070000000232a4-174.dat	upx
behavioral2/files/0x00070000000232a2-163.dat	upx
behavioral2/files/0x00070000000232a0-156.dat	upx
behavioral2/files/0x000700000002329f-151.dat	upx
behavioral2/files/0x000700000002329c-134.dat	upx
behavioral2/files/0x000700000002329b-129.dat	upx
behavioral2/files/0x0007000000023299-112.dat	upx
behavioral2/files/0x0007000000023298-110.dat	upx
behavioral2/memory/5112-109-0x00007FF606D30000-0x00007FF607122000-memory.dmp	upx
behavioral2/memory/4868-107-0x00007FF63E590000-0x00007FF63E982000-memory.dmp	upx
behavioral2/memory/4756-101-0x00007FF73DF60000-0x00007FF73E352000-memory.dmp	upx
behavioral2/memory/4444-99-0x00007FF702E40000-0x00007FF703232000-memory.dmp	upx
behavioral2/memory/1596-94-0x00007FF6A31B0000-0x00007FF6A35A2000-memory.dmp	upx
behavioral2/files/0x0007000000023293-83.dat	upx
behavioral2/memory/4588-74-0x00007FF611ED0000-0x00007FF6122C2000-memory.dmp	upx
behavioral2/memory/2324-70-0x00007FF7DE230000-0x00007FF7DE622000-memory.dmp	upx
behavioral2/memory/4392-65-0x00007FF6D7350000-0x00007FF6D7742000-memory.dmp	upx
behavioral2/files/0x0008000000023290-64.dat	upx
behavioral2/memory/728-63-0x00007FF7CAC70000-0x00007FF7CB062000-memory.dmp	upx
behavioral2/memory/1264-60-0x00007FF745B00000-0x00007FF745EF2000-memory.dmp	upx
behavioral2/memory/4752-14-0x00007FF7DDB40000-0x00007FF7DDF32000-memory.dmp	upx
behavioral2/memory/4752-2046-0x00007FF7DDB40000-0x00007FF7DDF32000-memory.dmp	upx
behavioral2/memory/2596-2048-0x00007FF659AA0000-0x00007FF659E92000-memory.dmp	upx
behavioral2/memory/1264-2119-0x00007FF745B00000-0x00007FF745EF2000-memory.dmp	upx
behavioral2/memory/728-2127-0x00007FF7CAC70000-0x00007FF7CB062000-memory.dmp	upx
behavioral2/memory/4868-2285-0x00007FF63E590000-0x00007FF63E982000-memory.dmp	upx
behavioral2/memory/4516-2284-0x00007FF78BE40000-0x00007FF78C232000-memory.dmp	upx
behavioral2/memory/4756-2286-0x00007FF73DF60000-0x00007FF73E352000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iQWrhXB.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\EyIYreM.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\CCSCNkW.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\NiIWwIG.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\MigwzAB.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\SqJvDLk.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\IvHhgJP.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\DXsuBkj.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\cTGorUK.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\Jpfmskf.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\xIAkmon.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\iYEeYhh.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\HTqHUvq.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\wJMQeBJ.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\PPgRFub.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\NspXiut.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\fpzyXEq.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\XZXOAwR.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\xDcOJKt.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\rlLdMNp.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\DnCeNIw.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\kSQaZNK.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\wCIEEtL.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\vsBohRo.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\wkuvJyi.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\fHbXdkT.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\aFOCbGs.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\cGgCeNW.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\aRitaki.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\xWTTZYo.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\LXjsiLA.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\ELIkLBP.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\VFtAFTG.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\VXrKlpb.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\jkSuNLv.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\zNHRDwW.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\qCyXKcl.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\GByTmuz.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\DNPofzB.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\vLGTYKS.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\qqQqFis.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\JkQpJTm.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\goeCXfI.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\OUKnCie.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\YiXTMVt.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\VJHVArl.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\rsHyimh.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\AJwVAEA.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\BvuXuzs.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\pkKKlGk.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\GrSpSdV.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\ezFaFrp.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\YtNsTEO.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\nYZLnez.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\gLHBJjg.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\jypihZc.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\iNRpViZ.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\xuWBwmR.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\knUAIkR.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\pjxhFwi.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\lKiEKkE.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\RrErpHu.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\jGHlpWY.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
File created	C:\Windows\System\MrTYsDA.exe	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3600	powershell.exe
3600	powershell.exe
3600	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeLockMemoryPrivilege	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 3600	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	92
PID 1432 wrote to memory of 3600	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	92
PID 1432 wrote to memory of 2596	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	93
PID 1432 wrote to memory of 2596	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	93
PID 1432 wrote to memory of 4752	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	94
PID 1432 wrote to memory of 4752	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	94
PID 1432 wrote to memory of 2324	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	95
PID 1432 wrote to memory of 2324	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	95
PID 1432 wrote to memory of 1004	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	96
PID 1432 wrote to memory of 1004	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	96
PID 1432 wrote to memory of 1264	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	97
PID 1432 wrote to memory of 1264	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	97
PID 1432 wrote to memory of 2428	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	98
PID 1432 wrote to memory of 2428	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	98
PID 1432 wrote to memory of 728	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	99
PID 1432 wrote to memory of 728	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	99
PID 1432 wrote to memory of 4392	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	100
PID 1432 wrote to memory of 4392	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	100
PID 1432 wrote to memory of 4588	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	101
PID 1432 wrote to memory of 4588	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	101
PID 1432 wrote to memory of 1596	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	102
PID 1432 wrote to memory of 1596	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	102
PID 1432 wrote to memory of 4444	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	103
PID 1432 wrote to memory of 4444	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	103
PID 1432 wrote to memory of 4868	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	104
PID 1432 wrote to memory of 4868	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	104
PID 1432 wrote to memory of 4756	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	105
PID 1432 wrote to memory of 4756	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	105
PID 1432 wrote to memory of 4632	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	106
PID 1432 wrote to memory of 4632	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	106
PID 1432 wrote to memory of 5112	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	107
PID 1432 wrote to memory of 5112	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	107
PID 1432 wrote to memory of 4516	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	108
PID 1432 wrote to memory of 4516	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	108
PID 1432 wrote to memory of 4960	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	109
PID 1432 wrote to memory of 4960	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	109
PID 1432 wrote to memory of 4380	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	110
PID 1432 wrote to memory of 4380	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	110
PID 1432 wrote to memory of 1232	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	111
PID 1432 wrote to memory of 1232	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	111
PID 1432 wrote to memory of 2900	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	112
PID 1432 wrote to memory of 2900	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	112
PID 1432 wrote to memory of 4596	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	113
PID 1432 wrote to memory of 4596	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	113
PID 1432 wrote to memory of 4892	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	114
PID 1432 wrote to memory of 4892	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	114
PID 1432 wrote to memory of 2392	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	115
PID 1432 wrote to memory of 2392	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	115
PID 1432 wrote to memory of 856	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	116
PID 1432 wrote to memory of 856	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	116
PID 1432 wrote to memory of 2368	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	117
PID 1432 wrote to memory of 2368	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	117
PID 1432 wrote to memory of 4500	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	118
PID 1432 wrote to memory of 4500	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	118
PID 1432 wrote to memory of 4904	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	119
PID 1432 wrote to memory of 4904	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	119
PID 1432 wrote to memory of 4364	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	120
PID 1432 wrote to memory of 4364	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	120
PID 1432 wrote to memory of 1324	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	121
PID 1432 wrote to memory of 1324	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	121
PID 1432 wrote to memory of 2780	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	122
PID 1432 wrote to memory of 2780	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	122
PID 1432 wrote to memory of 4948	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	123
PID 1432 wrote to memory of 4948	1432	abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\abb26f2eb0cef55f831ec1e46b018e20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\System\eCtFStl.exe
  C:\Windows\System\eCtFStl.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\RubyupT.exe
  C:\Windows\System\RubyupT.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\RTUvLHq.exe
  C:\Windows\System\RTUvLHq.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\RxNgZMg.exe
  C:\Windows\System\RxNgZMg.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\VrlQLiu.exe
  C:\Windows\System\VrlQLiu.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\pMpgCoJ.exe
  C:\Windows\System\pMpgCoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\LRRjHEm.exe
  C:\Windows\System\LRRjHEm.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\YyINtuX.exe
  C:\Windows\System\YyINtuX.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\aTEpnfU.exe
  C:\Windows\System\aTEpnfU.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\NBfbAxD.exe
  C:\Windows\System\NBfbAxD.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\jypihZc.exe
  C:\Windows\System\jypihZc.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\kloXHcz.exe
  C:\Windows\System\kloXHcz.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\YtNsTEO.exe
  C:\Windows\System\YtNsTEO.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\xqVvVpz.exe
  C:\Windows\System\xqVvVpz.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\wJMQeBJ.exe
  C:\Windows\System\wJMQeBJ.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\duHSyQv.exe
  C:\Windows\System\duHSyQv.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\RRNULKp.exe
  C:\Windows\System\RRNULKp.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\ZhVqQjN.exe
  C:\Windows\System\ZhVqQjN.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\iemaxpf.exe
  C:\Windows\System\iemaxpf.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\VXrKlpb.exe
  C:\Windows\System\VXrKlpb.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\fqHqcSK.exe
  C:\Windows\System\fqHqcSK.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\FSWNPoP.exe
  C:\Windows\System\FSWNPoP.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\goeCXfI.exe
  C:\Windows\System\goeCXfI.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\OUKnCie.exe
  C:\Windows\System\OUKnCie.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\nCKnzqI.exe
  C:\Windows\System\nCKnzqI.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\IfgAnCU.exe
  C:\Windows\System\IfgAnCU.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\bjYreQD.exe
  C:\Windows\System\bjYreQD.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\UIWjfvv.exe
  C:\Windows\System\UIWjfvv.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\EvyozVW.exe
  C:\Windows\System\EvyozVW.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\COpXOTn.exe
  C:\Windows\System\COpXOTn.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\tqvnPdf.exe
  C:\Windows\System\tqvnPdf.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\fXhOqRU.exe
  C:\Windows\System\fXhOqRU.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\qrUCGOm.exe
  C:\Windows\System\qrUCGOm.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\DIUOwrZ.exe
  C:\Windows\System\DIUOwrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\xHXkwQw.exe
  C:\Windows\System\xHXkwQw.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\uvmnHkT.exe
  C:\Windows\System\uvmnHkT.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\TcCGyXb.exe
  C:\Windows\System\TcCGyXb.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\VpBfHzt.exe
  C:\Windows\System\VpBfHzt.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\UFUAHjq.exe
  C:\Windows\System\UFUAHjq.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\ewscoiy.exe
  C:\Windows\System\ewscoiy.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\MdKroTV.exe
  C:\Windows\System\MdKroTV.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\YGfMTyL.exe
  C:\Windows\System\YGfMTyL.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\tscBFhg.exe
  C:\Windows\System\tscBFhg.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\wewsDRJ.exe
  C:\Windows\System\wewsDRJ.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\ANBJuaV.exe
  C:\Windows\System\ANBJuaV.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\MalWFOk.exe
  C:\Windows\System\MalWFOk.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\lbhQIsv.exe
  C:\Windows\System\lbhQIsv.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\TDfkFLg.exe
  C:\Windows\System\TDfkFLg.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\EFwUvjX.exe
  C:\Windows\System\EFwUvjX.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\DmGQFSl.exe
  C:\Windows\System\DmGQFSl.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\TTWmhlb.exe
  C:\Windows\System\TTWmhlb.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\hsxIMyH.exe
  C:\Windows\System\hsxIMyH.exe
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Windows\System\riupngO.exe
  C:\Windows\System\riupngO.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\jkSuNLv.exe
  C:\Windows\System\jkSuNLv.exe
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Windows\System\yLoOxqH.exe
  C:\Windows\System\yLoOxqH.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\BWrkMPK.exe
  C:\Windows\System\BWrkMPK.exe
  2⤵
  - Executes dropped EXE
  PID:5336
- C:\Windows\System\LQlrxRm.exe
  C:\Windows\System\LQlrxRm.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\LteptvC.exe
  C:\Windows\System\LteptvC.exe
  2⤵
  - Executes dropped EXE
  PID:5392
- C:\Windows\System\enDOJYs.exe
  C:\Windows\System\enDOJYs.exe
  2⤵
  - Executes dropped EXE
  PID:5432
- C:\Windows\System\eavRjTG.exe
  C:\Windows\System\eavRjTG.exe
  2⤵
  - Executes dropped EXE
  PID:5472
- C:\Windows\System\BTEbYcj.exe
  C:\Windows\System\BTEbYcj.exe
  2⤵
  - Executes dropped EXE
  PID:5500
- C:\Windows\System\hBJCxlL.exe
  C:\Windows\System\hBJCxlL.exe
  2⤵
  - Executes dropped EXE
  PID:5516
- C:\Windows\System\DTUpYcp.exe
  C:\Windows\System\DTUpYcp.exe
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Windows\System\OrIlqpn.exe
  C:\Windows\System\OrIlqpn.exe
  2⤵
  - Executes dropped EXE
  PID:5572
- C:\Windows\System\bigVIwS.exe
  C:\Windows\System\bigVIwS.exe
  2⤵
  PID:5596
- C:\Windows\System\uCXvQcm.exe
  C:\Windows\System\uCXvQcm.exe
  2⤵
  PID:5624
- C:\Windows\System\GYlTvJt.exe
  C:\Windows\System\GYlTvJt.exe
  2⤵
  PID:5644
- C:\Windows\System\oXwvaJT.exe
  C:\Windows\System\oXwvaJT.exe
  2⤵
  PID:5684
- C:\Windows\System\RrErpHu.exe
  C:\Windows\System\RrErpHu.exe
  2⤵
  PID:5720
- C:\Windows\System\qnWJSfH.exe
  C:\Windows\System\qnWJSfH.exe
  2⤵
  PID:5740
- C:\Windows\System\RmweCRD.exe
  C:\Windows\System\RmweCRD.exe
  2⤵
  PID:5768
- C:\Windows\System\AYJajTt.exe
  C:\Windows\System\AYJajTt.exe
  2⤵
  PID:5796
- C:\Windows\System\zNHRDwW.exe
  C:\Windows\System\zNHRDwW.exe
  2⤵
  PID:5820
- C:\Windows\System\ljffRAL.exe
  C:\Windows\System\ljffRAL.exe
  2⤵
  PID:5844
- C:\Windows\System\khEIyLh.exe
  C:\Windows\System\khEIyLh.exe
  2⤵
  PID:5868
- C:\Windows\System\AEJBMak.exe
  C:\Windows\System\AEJBMak.exe
  2⤵
  PID:5904
- C:\Windows\System\yGpULPz.exe
  C:\Windows\System\yGpULPz.exe
  2⤵
  PID:5928
- C:\Windows\System\EJZBSFo.exe
  C:\Windows\System\EJZBSFo.exe
  2⤵
  PID:5972
- C:\Windows\System\cdWoJOl.exe
  C:\Windows\System\cdWoJOl.exe
  2⤵
  PID:5992
- C:\Windows\System\DNPofzB.exe
  C:\Windows\System\DNPofzB.exe
  2⤵
  PID:6020
- C:\Windows\System\YgWAbzV.exe
  C:\Windows\System\YgWAbzV.exe
  2⤵
  PID:6040
- C:\Windows\System\oKwtcyo.exe
  C:\Windows\System\oKwtcyo.exe
  2⤵
  PID:6064
- C:\Windows\System\jGHlpWY.exe
  C:\Windows\System\jGHlpWY.exe
  2⤵
  PID:6092
- C:\Windows\System\kSibKdY.exe
  C:\Windows\System\kSibKdY.exe
  2⤵
  PID:6120
- C:\Windows\System\xDcOJKt.exe
  C:\Windows\System\xDcOJKt.exe
  2⤵
  PID:2796
- C:\Windows\System\DniQqgc.exe
  C:\Windows\System\DniQqgc.exe
  2⤵
  PID:2148
- C:\Windows\System\iNRpViZ.exe
  C:\Windows\System\iNRpViZ.exe
  2⤵
  PID:2336
- C:\Windows\System\wwSWDDI.exe
  C:\Windows\System\wwSWDDI.exe
  2⤵
  PID:5240
- C:\Windows\System\nbZnCCS.exe
  C:\Windows\System\nbZnCCS.exe
  2⤵
  PID:5268
- C:\Windows\System\vrIfYCl.exe
  C:\Windows\System\vrIfYCl.exe
  2⤵
  PID:5304
- C:\Windows\System\LNCHfTR.exe
  C:\Windows\System\LNCHfTR.exe
  2⤵
  PID:5352
- C:\Windows\System\zrHNKwA.exe
  C:\Windows\System\zrHNKwA.exe
  2⤵
  PID:3288
- C:\Windows\System\pFORdok.exe
  C:\Windows\System\pFORdok.exe
  2⤵
  PID:5452
- C:\Windows\System\QJWqHGw.exe
  C:\Windows\System\QJWqHGw.exe
  2⤵
  PID:5512
- C:\Windows\System\aGTKLbF.exe
  C:\Windows\System\aGTKLbF.exe
  2⤵
  PID:5556
- C:\Windows\System\ZWQoGzB.exe
  C:\Windows\System\ZWQoGzB.exe
  2⤵
  PID:5612
- C:\Windows\System\BvuXuzs.exe
  C:\Windows\System\BvuXuzs.exe
  2⤵
  PID:5676
- C:\Windows\System\Xkodhpu.exe
  C:\Windows\System\Xkodhpu.exe
  2⤵
  PID:5832
- C:\Windows\System\QdICPhk.exe
  C:\Windows\System\QdICPhk.exe
  2⤵
  PID:5864
- C:\Windows\System\PZtmGiG.exe
  C:\Windows\System\PZtmGiG.exe
  2⤵
  PID:5920
- C:\Windows\System\PCgUuUT.exe
  C:\Windows\System\PCgUuUT.exe
  2⤵
  PID:6004
- C:\Windows\System\bICsSzH.exe
  C:\Windows\System\bICsSzH.exe
  2⤵
  PID:6028
- C:\Windows\System\mgVhaHx.exe
  C:\Windows\System\mgVhaHx.exe
  2⤵
  PID:6048
- C:\Windows\System\BYmPWlB.exe
  C:\Windows\System\BYmPWlB.exe
  2⤵
  PID:6076
- C:\Windows\System\sEDKAYp.exe
  C:\Windows\System\sEDKAYp.exe
  2⤵
  PID:6136
- C:\Windows\System\LiSkCeb.exe
  C:\Windows\System\LiSkCeb.exe
  2⤵
  PID:2284
- C:\Windows\System\SqJvDLk.exe
  C:\Windows\System\SqJvDLk.exe
  2⤵
  PID:5296
- C:\Windows\System\MrTYsDA.exe
  C:\Windows\System\MrTYsDA.exe
  2⤵
  PID:5388
- C:\Windows\System\pfSzxvF.exe
  C:\Windows\System\pfSzxvF.exe
  2⤵
  PID:5444
- C:\Windows\System\ibPsWFc.exe
  C:\Windows\System\ibPsWFc.exe
  2⤵
  PID:3088
- C:\Windows\System\WvjlxWX.exe
  C:\Windows\System\WvjlxWX.exe
  2⤵
  PID:608
- C:\Windows\System\xBPdsii.exe
  C:\Windows\System\xBPdsii.exe
  2⤵
  PID:5760
- C:\Windows\System\EsRsFBs.exe
  C:\Windows\System\EsRsFBs.exe
  2⤵
  PID:4408
- C:\Windows\System\JMqQcoh.exe
  C:\Windows\System\JMqQcoh.exe
  2⤵
  PID:4820
- C:\Windows\System\LUlfZzB.exe
  C:\Windows\System\LUlfZzB.exe
  2⤵
  PID:5984
- C:\Windows\System\FAAZPTA.exe
  C:\Windows\System\FAAZPTA.exe
  2⤵
  PID:6008
- C:\Windows\System\dVKkJYB.exe
  C:\Windows\System\dVKkJYB.exe
  2⤵
  PID:6056
- C:\Windows\System\qCyXKcl.exe
  C:\Windows\System\qCyXKcl.exe
  2⤵
  PID:6104
- C:\Windows\System\DLVYjUb.exe
  C:\Windows\System\DLVYjUb.exe
  2⤵
  PID:6112
- C:\Windows\System\NHcRUWF.exe
  C:\Windows\System\NHcRUWF.exe
  2⤵
  PID:4508
- C:\Windows\System\OXBBMEX.exe
  C:\Windows\System\OXBBMEX.exe
  2⤵
  PID:1108
- C:\Windows\System\GtpcELe.exe
  C:\Windows\System\GtpcELe.exe
  2⤵
  PID:3656
- C:\Windows\System\WkJufLq.exe
  C:\Windows\System\WkJufLq.exe
  2⤵
  PID:4640
- C:\Windows\System\hTNVXfu.exe
  C:\Windows\System\hTNVXfu.exe
  2⤵
  PID:4324
- C:\Windows\System\cGgCeNW.exe
  C:\Windows\System\cGgCeNW.exe
  2⤵
  PID:5916
- C:\Windows\System\KiboVKX.exe
  C:\Windows\System\KiboVKX.exe
  2⤵
  PID:2088
- C:\Windows\System\GOEdznA.exe
  C:\Windows\System\GOEdznA.exe
  2⤵
  PID:6160
- C:\Windows\System\VZOvqGo.exe
  C:\Windows\System\VZOvqGo.exe
  2⤵
  PID:6192
- C:\Windows\System\IeGfiaU.exe
  C:\Windows\System\IeGfiaU.exe
  2⤵
  PID:6280
- C:\Windows\System\snsUgAB.exe
  C:\Windows\System\snsUgAB.exe
  2⤵
  PID:6296
- C:\Windows\System\cHTpoET.exe
  C:\Windows\System\cHTpoET.exe
  2⤵
  PID:6320
- C:\Windows\System\elXPbIE.exe
  C:\Windows\System\elXPbIE.exe
  2⤵
  PID:6344
- C:\Windows\System\GFdZzLO.exe
  C:\Windows\System\GFdZzLO.exe
  2⤵
  PID:6364
- C:\Windows\System\MuPenTK.exe
  C:\Windows\System\MuPenTK.exe
  2⤵
  PID:6384
- C:\Windows\System\ejDSloB.exe
  C:\Windows\System\ejDSloB.exe
  2⤵
  PID:6408
- C:\Windows\System\Jpfmskf.exe
  C:\Windows\System\Jpfmskf.exe
  2⤵
  PID:6428
- C:\Windows\System\jyCuXUN.exe
  C:\Windows\System\jyCuXUN.exe
  2⤵
  PID:6452
- C:\Windows\System\oPYqdba.exe
  C:\Windows\System\oPYqdba.exe
  2⤵
  PID:6472
- C:\Windows\System\xWDVhty.exe
  C:\Windows\System\xWDVhty.exe
  2⤵
  PID:6500
- C:\Windows\System\DDlUEjm.exe
  C:\Windows\System\DDlUEjm.exe
  2⤵
  PID:6576
- C:\Windows\System\NdvXkmp.exe
  C:\Windows\System\NdvXkmp.exe
  2⤵
  PID:6604
- C:\Windows\System\tBxhsrT.exe
  C:\Windows\System\tBxhsrT.exe
  2⤵
  PID:6628
- C:\Windows\System\rlLdMNp.exe
  C:\Windows\System\rlLdMNp.exe
  2⤵
  PID:6652
- C:\Windows\System\pueMQFb.exe
  C:\Windows\System\pueMQFb.exe
  2⤵
  PID:6708
- C:\Windows\System\GDEwzFf.exe
  C:\Windows\System\GDEwzFf.exe
  2⤵
  PID:6752
- C:\Windows\System\YlwLXWD.exe
  C:\Windows\System\YlwLXWD.exe
  2⤵
  PID:6772
- C:\Windows\System\hxXEkmk.exe
  C:\Windows\System\hxXEkmk.exe
  2⤵
  PID:6800
- C:\Windows\System\BVqAUsS.exe
  C:\Windows\System\BVqAUsS.exe
  2⤵
  PID:6824
- C:\Windows\System\rdoYAGc.exe
  C:\Windows\System\rdoYAGc.exe
  2⤵
  PID:6844
- C:\Windows\System\LlyNVXX.exe
  C:\Windows\System\LlyNVXX.exe
  2⤵
  PID:6860
- C:\Windows\System\FnsdMHo.exe
  C:\Windows\System\FnsdMHo.exe
  2⤵
  PID:6880
- C:\Windows\System\ffoAqlt.exe
  C:\Windows\System\ffoAqlt.exe
  2⤵
  PID:6900
- C:\Windows\System\JYzMJpZ.exe
  C:\Windows\System\JYzMJpZ.exe
  2⤵
  PID:6916
- C:\Windows\System\xuWBwmR.exe
  C:\Windows\System\xuWBwmR.exe
  2⤵
  PID:6940
- C:\Windows\System\EQifeGS.exe
  C:\Windows\System\EQifeGS.exe
  2⤵
  PID:6968
- C:\Windows\System\kyfMiUb.exe
  C:\Windows\System\kyfMiUb.exe
  2⤵
  PID:7032
- C:\Windows\System\uZDKuHV.exe
  C:\Windows\System\uZDKuHV.exe
  2⤵
  PID:7052
- C:\Windows\System\skFfwqL.exe
  C:\Windows\System\skFfwqL.exe
  2⤵
  PID:7072
- C:\Windows\System\XVXnlAK.exe
  C:\Windows\System\XVXnlAK.exe
  2⤵
  PID:7100
- C:\Windows\System\BgVBswt.exe
  C:\Windows\System\BgVBswt.exe
  2⤵
  PID:7152
- C:\Windows\System\PLYBzNT.exe
  C:\Windows\System\PLYBzNT.exe
  2⤵
  PID:4140
- C:\Windows\System\vLGTYKS.exe
  C:\Windows\System\vLGTYKS.exe
  2⤵
  PID:6172
- C:\Windows\System\RZLisug.exe
  C:\Windows\System\RZLisug.exe
  2⤵
  PID:5852
- C:\Windows\System\ezPbyCI.exe
  C:\Windows\System\ezPbyCI.exe
  2⤵
  PID:3228
- C:\Windows\System\IvHhgJP.exe
  C:\Windows\System\IvHhgJP.exe
  2⤵
  PID:2408
- C:\Windows\System\DnCeNIw.exe
  C:\Windows\System\DnCeNIw.exe
  2⤵
  PID:6200
- C:\Windows\System\CnqoFYO.exe
  C:\Windows\System\CnqoFYO.exe
  2⤵
  PID:6304
- C:\Windows\System\EexwqNZ.exe
  C:\Windows\System\EexwqNZ.exe
  2⤵
  PID:6400
- C:\Windows\System\PPgRFub.exe
  C:\Windows\System\PPgRFub.exe
  2⤵
  PID:6352
- C:\Windows\System\YemnHRG.exe
  C:\Windows\System\YemnHRG.exe
  2⤵
  PID:6640
- C:\Windows\System\YiXTMVt.exe
  C:\Windows\System\YiXTMVt.exe
  2⤵
  PID:3420
- C:\Windows\System\OkBhhnh.exe
  C:\Windows\System\OkBhhnh.exe
  2⤵
  PID:6596
- C:\Windows\System\nDFbCEY.exe
  C:\Windows\System\nDFbCEY.exe
  2⤵
  PID:6684
- C:\Windows\System\WJhyAbJ.exe
  C:\Windows\System\WJhyAbJ.exe
  2⤵
  PID:6872
- C:\Windows\System\mcPiqiU.exe
  C:\Windows\System\mcPiqiU.exe
  2⤵
  PID:6924
- C:\Windows\System\jtwhqBr.exe
  C:\Windows\System\jtwhqBr.exe
  2⤵
  PID:6932
- C:\Windows\System\vnuRARn.exe
  C:\Windows\System\vnuRARn.exe
  2⤵
  PID:7020
- C:\Windows\System\bhnIySW.exe
  C:\Windows\System\bhnIySW.exe
  2⤵
  PID:7048
- C:\Windows\System\nYZLnez.exe
  C:\Windows\System\nYZLnez.exe
  2⤵
  PID:3768
- C:\Windows\System\wvfnDLn.exe
  C:\Windows\System\wvfnDLn.exe
  2⤵
  PID:7160
- C:\Windows\System\HmYWhYY.exe
  C:\Windows\System\HmYWhYY.exe
  2⤵
  PID:324
- C:\Windows\System\kkdsroJ.exe
  C:\Windows\System\kkdsroJ.exe
  2⤵
  PID:4024
- C:\Windows\System\GKFKCAg.exe
  C:\Windows\System\GKFKCAg.exe
  2⤵
  PID:6560
- C:\Windows\System\OnOwOCU.exe
  C:\Windows\System\OnOwOCU.exe
  2⤵
  PID:6340
- C:\Windows\System\sPGFrtd.exe
  C:\Windows\System\sPGFrtd.exe
  2⤵
  PID:6436
- C:\Windows\System\pjxhFwi.exe
  C:\Windows\System\pjxhFwi.exe
  2⤵
  PID:2004
- C:\Windows\System\XCIOEiv.exe
  C:\Windows\System\XCIOEiv.exe
  2⤵
  PID:7016
- C:\Windows\System\tUjrDiX.exe
  C:\Windows\System\tUjrDiX.exe
  2⤵
  PID:7088
- C:\Windows\System\QPSFxyF.exe
  C:\Windows\System\QPSFxyF.exe
  2⤵
  PID:7144
- C:\Windows\System\NspXiut.exe
  C:\Windows\System\NspXiut.exe
  2⤵
  PID:3740
- C:\Windows\System\wKMarFd.exe
  C:\Windows\System\wKMarFd.exe
  2⤵
  PID:6788
- C:\Windows\System\lKiEKkE.exe
  C:\Windows\System\lKiEKkE.exe
  2⤵
  PID:6952
- C:\Windows\System\emYBJJc.exe
  C:\Windows\System\emYBJJc.exe
  2⤵
  PID:7044
- C:\Windows\System\rDGDmYr.exe
  C:\Windows\System\rDGDmYr.exe
  2⤵
  PID:6892
- C:\Windows\System\iQWrhXB.exe
  C:\Windows\System\iQWrhXB.exe
  2⤵
  PID:7212
- C:\Windows\System\qItUBlK.exe
  C:\Windows\System\qItUBlK.exe
  2⤵
  PID:7248
- C:\Windows\System\fpzyXEq.exe
  C:\Windows\System\fpzyXEq.exe
  2⤵
  PID:7276
- C:\Windows\System\iRjRMOH.exe
  C:\Windows\System\iRjRMOH.exe
  2⤵
  PID:7304
- C:\Windows\System\CICzNIt.exe
  C:\Windows\System\CICzNIt.exe
  2⤵
  PID:7328
- C:\Windows\System\yNXeTqg.exe
  C:\Windows\System\yNXeTqg.exe
  2⤵
  PID:7356
- C:\Windows\System\dbYgYmZ.exe
  C:\Windows\System\dbYgYmZ.exe
  2⤵
  PID:7372
- C:\Windows\System\VJHVArl.exe
  C:\Windows\System\VJHVArl.exe
  2⤵
  PID:7420
- C:\Windows\System\jJVJLkK.exe
  C:\Windows\System\jJVJLkK.exe
  2⤵
  PID:7464
- C:\Windows\System\YaBYCzK.exe
  C:\Windows\System\YaBYCzK.exe
  2⤵
  PID:7480
- C:\Windows\System\tWitxNG.exe
  C:\Windows\System\tWitxNG.exe
  2⤵
  PID:7500
- C:\Windows\System\dMEeTob.exe
  C:\Windows\System\dMEeTob.exe
  2⤵
  PID:7524
- C:\Windows\System\EyIYreM.exe
  C:\Windows\System\EyIYreM.exe
  2⤵
  PID:7540
- C:\Windows\System\oFOzDMk.exe
  C:\Windows\System\oFOzDMk.exe
  2⤵
  PID:7592
- C:\Windows\System\jaNmsSP.exe
  C:\Windows\System\jaNmsSP.exe
  2⤵
  PID:7612
- C:\Windows\System\NSaAYWh.exe
  C:\Windows\System\NSaAYWh.exe
  2⤵
  PID:7632
- C:\Windows\System\wNkmpTr.exe
  C:\Windows\System\wNkmpTr.exe
  2⤵
  PID:7652
- C:\Windows\System\hlNSmAx.exe
  C:\Windows\System\hlNSmAx.exe
  2⤵
  PID:7672
- C:\Windows\System\StJulCT.exe
  C:\Windows\System\StJulCT.exe
  2⤵
  PID:7692
- C:\Windows\System\qPJDtrb.exe
  C:\Windows\System\qPJDtrb.exe
  2⤵
  PID:7708
- C:\Windows\System\gQeqjvg.exe
  C:\Windows\System\gQeqjvg.exe
  2⤵
  PID:7724
- C:\Windows\System\nYbloyy.exe
  C:\Windows\System\nYbloyy.exe
  2⤵
  PID:7744
- C:\Windows\System\SSVSNBq.exe
  C:\Windows\System\SSVSNBq.exe
  2⤵
  PID:7764
- C:\Windows\System\VDCWOrd.exe
  C:\Windows\System\VDCWOrd.exe
  2⤵
  PID:7788
- C:\Windows\System\hmgmYqL.exe
  C:\Windows\System\hmgmYqL.exe
  2⤵
  PID:7804
- C:\Windows\System\gtrNftX.exe
  C:\Windows\System\gtrNftX.exe
  2⤵
  PID:7828
- C:\Windows\System\wsaydiS.exe
  C:\Windows\System\wsaydiS.exe
  2⤵
  PID:7844
- C:\Windows\System\vsBohRo.exe
  C:\Windows\System\vsBohRo.exe
  2⤵
  PID:7864
- C:\Windows\System\iRvQLLk.exe
  C:\Windows\System\iRvQLLk.exe
  2⤵
  PID:7888
- C:\Windows\System\pUwiYOh.exe
  C:\Windows\System\pUwiYOh.exe
  2⤵
  PID:7904
- C:\Windows\System\zHqssOk.exe
  C:\Windows\System\zHqssOk.exe
  2⤵
  PID:7928
- C:\Windows\System\EHJoWgH.exe
  C:\Windows\System\EHJoWgH.exe
  2⤵
  PID:7948
- C:\Windows\System\BrbmAvA.exe
  C:\Windows\System\BrbmAvA.exe
  2⤵
  PID:7968
- C:\Windows\System\DWlkOMe.exe
  C:\Windows\System\DWlkOMe.exe
  2⤵
  PID:7988
- C:\Windows\System\mGZOdez.exe
  C:\Windows\System\mGZOdez.exe
  2⤵
  PID:8008
- C:\Windows\System\CCSCNkW.exe
  C:\Windows\System\CCSCNkW.exe
  2⤵
  PID:8028
- C:\Windows\System\yvGnRUB.exe
  C:\Windows\System\yvGnRUB.exe
  2⤵
  PID:8048
- C:\Windows\System\oaGtkAo.exe
  C:\Windows\System\oaGtkAo.exe
  2⤵
  PID:8068
- C:\Windows\System\dXcRiYy.exe
  C:\Windows\System\dXcRiYy.exe
  2⤵
  PID:8088
- C:\Windows\System\ALQNHlJ.exe
  C:\Windows\System\ALQNHlJ.exe
  2⤵
  PID:8108
- C:\Windows\System\aAgrzoh.exe
  C:\Windows\System\aAgrzoh.exe
  2⤵
  PID:8128
- C:\Windows\System\OlmwPqE.exe
  C:\Windows\System\OlmwPqE.exe
  2⤵
  PID:8144
- C:\Windows\System\pFtHedy.exe
  C:\Windows\System\pFtHedy.exe
  2⤵
  PID:8164
- C:\Windows\System\KmimXSV.exe
  C:\Windows\System\KmimXSV.exe
  2⤵
  PID:8184
- C:\Windows\System\NYwdMJY.exe
  C:\Windows\System\NYwdMJY.exe
  2⤵
  PID:4488
- C:\Windows\System\LXjsiLA.exe
  C:\Windows\System\LXjsiLA.exe
  2⤵
  PID:7208
- C:\Windows\System\RiPbsnL.exe
  C:\Windows\System\RiPbsnL.exe
  2⤵
  PID:7288
- C:\Windows\System\OLyrebC.exe
  C:\Windows\System\OLyrebC.exe
  2⤵
  PID:7316
- C:\Windows\System\UFbPjRl.exe
  C:\Windows\System\UFbPjRl.exe
  2⤵
  PID:7416
- C:\Windows\System\NzayQwH.exe
  C:\Windows\System\NzayQwH.exe
  2⤵
  PID:7384
- C:\Windows\System\GCEAcYi.exe
  C:\Windows\System\GCEAcYi.exe
  2⤵
  PID:7456
- C:\Windows\System\kTIfhJC.exe
  C:\Windows\System\kTIfhJC.exe
  2⤵
  PID:7496
- C:\Windows\System\XNmKNXM.exe
  C:\Windows\System\XNmKNXM.exe
  2⤵
  PID:7564
- C:\Windows\System\MVDDkpr.exe
  C:\Windows\System\MVDDkpr.exe
  2⤵
  PID:7640
- C:\Windows\System\kamxsBF.exe
  C:\Windows\System\kamxsBF.exe
  2⤵
  PID:7648
- C:\Windows\System\NiIWwIG.exe
  C:\Windows\System\NiIWwIG.exe
  2⤵
  PID:7604
- C:\Windows\System\ELIkLBP.exe
  C:\Windows\System\ELIkLBP.exe
  2⤵
  PID:7732
- C:\Windows\System\tFVGEHf.exe
  C:\Windows\System\tFVGEHf.exe
  2⤵
  PID:7784
- C:\Windows\System\kzyeAIg.exe
  C:\Windows\System\kzyeAIg.exe
  2⤵
  PID:7756
- C:\Windows\System\ndCOQUx.exe
  C:\Windows\System\ndCOQUx.exe
  2⤵
  PID:7920
- C:\Windows\System\QyDErhU.exe
  C:\Windows\System\QyDErhU.exe
  2⤵
  PID:7980
- C:\Windows\System\tJXcwKg.exe
  C:\Windows\System\tJXcwKg.exe
  2⤵
  PID:8004
- C:\Windows\System\oPyhhrC.exe
  C:\Windows\System\oPyhhrC.exe
  2⤵
  PID:8060
- C:\Windows\System\GVnmosl.exe
  C:\Windows\System\GVnmosl.exe
  2⤵
  PID:8100
- C:\Windows\System\NLvQYKe.exe
  C:\Windows\System\NLvQYKe.exe
  2⤵
  PID:6536
- C:\Windows\System\VaraEwd.exe
  C:\Windows\System\VaraEwd.exe
  2⤵
  PID:7364
- C:\Windows\System\JnwmpFV.exe
  C:\Windows\System\JnwmpFV.exe
  2⤵
  PID:8204
- C:\Windows\System\KYLpXPW.exe
  C:\Windows\System\KYLpXPW.exe
  2⤵
  PID:8220
- C:\Windows\System\xGQNiHT.exe
  C:\Windows\System\xGQNiHT.exe
  2⤵
  PID:8240
- C:\Windows\System\oadMxvs.exe
  C:\Windows\System\oadMxvs.exe
  2⤵
  PID:8260
- C:\Windows\System\GByTmuz.exe
  C:\Windows\System\GByTmuz.exe
  2⤵
  PID:8280
- C:\Windows\System\qqQqFis.exe
  C:\Windows\System\qqQqFis.exe
  2⤵
  PID:8304
- C:\Windows\System\VCApMix.exe
  C:\Windows\System\VCApMix.exe
  2⤵
  PID:8324
- C:\Windows\System\AJwVAEA.exe
  C:\Windows\System\AJwVAEA.exe
  2⤵
  PID:8340
- C:\Windows\System\eVLGoce.exe
  C:\Windows\System\eVLGoce.exe
  2⤵
  PID:8364
- C:\Windows\System\ArnQGKK.exe
  C:\Windows\System\ArnQGKK.exe
  2⤵
  PID:8388
- C:\Windows\System\wjwrkCE.exe
  C:\Windows\System\wjwrkCE.exe
  2⤵
  PID:8404
- C:\Windows\System\bOzKcTZ.exe
  C:\Windows\System\bOzKcTZ.exe
  2⤵
  PID:8428
- C:\Windows\System\iexxSeM.exe
  C:\Windows\System\iexxSeM.exe
  2⤵
  PID:8444
- C:\Windows\System\fyuRQqr.exe
  C:\Windows\System\fyuRQqr.exe
  2⤵
  PID:8464
- C:\Windows\System\DUSmdcL.exe
  C:\Windows\System\DUSmdcL.exe
  2⤵
  PID:8484
- C:\Windows\System\YccelDe.exe
  C:\Windows\System\YccelDe.exe
  2⤵
  PID:8500
- C:\Windows\System\RUHbdOB.exe
  C:\Windows\System\RUHbdOB.exe
  2⤵
  PID:8524
- C:\Windows\System\kSQaZNK.exe
  C:\Windows\System\kSQaZNK.exe
  2⤵
  PID:8544
- C:\Windows\System\JeshWIi.exe
  C:\Windows\System\JeshWIi.exe
  2⤵
  PID:8568
- C:\Windows\System\DXsuBkj.exe
  C:\Windows\System\DXsuBkj.exe
  2⤵
  PID:8588
- C:\Windows\System\SDLqmsF.exe
  C:\Windows\System\SDLqmsF.exe
  2⤵
  PID:8608
- C:\Windows\System\ZFjKTYh.exe
  C:\Windows\System\ZFjKTYh.exe
  2⤵
  PID:8628
- C:\Windows\System\ypsoAhw.exe
  C:\Windows\System\ypsoAhw.exe
  2⤵
  PID:8648
- C:\Windows\System\vRCeohh.exe
  C:\Windows\System\vRCeohh.exe
  2⤵
  PID:8664
- C:\Windows\System\HRitWaK.exe
  C:\Windows\System\HRitWaK.exe
  2⤵
  PID:8684
- C:\Windows\System\ozsSLuD.exe
  C:\Windows\System\ozsSLuD.exe
  2⤵
  PID:8704
- C:\Windows\System\XRyjhwf.exe
  C:\Windows\System\XRyjhwf.exe
  2⤵
  PID:8728
- C:\Windows\System\NxslrgJ.exe
  C:\Windows\System\NxslrgJ.exe
  2⤵
  PID:8744
- C:\Windows\System\xIAkmon.exe
  C:\Windows\System\xIAkmon.exe
  2⤵
  PID:8764
- C:\Windows\System\WyqljKS.exe
  C:\Windows\System\WyqljKS.exe
  2⤵
  PID:8784
- C:\Windows\System\DXREOsv.exe
  C:\Windows\System\DXREOsv.exe
  2⤵
  PID:8804
- C:\Windows\System\wlSXPdr.exe
  C:\Windows\System\wlSXPdr.exe
  2⤵
  PID:8824
- C:\Windows\System\JkQpJTm.exe
  C:\Windows\System\JkQpJTm.exe
  2⤵
  PID:8852
- C:\Windows\System\DROGZqZ.exe
  C:\Windows\System\DROGZqZ.exe
  2⤵
  PID:8872
- C:\Windows\System\TGmwiyy.exe
  C:\Windows\System\TGmwiyy.exe
  2⤵
  PID:8896
- C:\Windows\System\kspieUa.exe
  C:\Windows\System\kspieUa.exe
  2⤵
  PID:8916
- C:\Windows\System\VyDHMHn.exe
  C:\Windows\System\VyDHMHn.exe
  2⤵
  PID:8940
- C:\Windows\System\KeDNiQL.exe
  C:\Windows\System\KeDNiQL.exe
  2⤵
  PID:8960
- C:\Windows\System\pkKKlGk.exe
  C:\Windows\System\pkKKlGk.exe
  2⤵
  PID:8980
- C:\Windows\System\SfTUZal.exe
  C:\Windows\System\SfTUZal.exe
  2⤵
  PID:9004
- C:\Windows\System\sBXlYTt.exe
  C:\Windows\System\sBXlYTt.exe
  2⤵
  PID:9020
- C:\Windows\System\YEfqeUy.exe
  C:\Windows\System\YEfqeUy.exe
  2⤵
  PID:9040
- C:\Windows\System\KdEpXFZ.exe
  C:\Windows\System\KdEpXFZ.exe
  2⤵
  PID:9068
- C:\Windows\System\aXPmZuB.exe
  C:\Windows\System\aXPmZuB.exe
  2⤵
  PID:9088
- C:\Windows\System\xxPzArN.exe
  C:\Windows\System\xxPzArN.exe
  2⤵
  PID:9112
- C:\Windows\System\GrSpSdV.exe
  C:\Windows\System\GrSpSdV.exe
  2⤵
  PID:9128
- C:\Windows\System\aRitaki.exe
  C:\Windows\System\aRitaki.exe
  2⤵
  PID:9148
- C:\Windows\System\NGBqhEd.exe
  C:\Windows\System\NGBqhEd.exe
  2⤵
  PID:9164
- C:\Windows\System\WAeYxss.exe
  C:\Windows\System\WAeYxss.exe
  2⤵
  PID:9184
- C:\Windows\System\XZXOAwR.exe
  C:\Windows\System\XZXOAwR.exe
  2⤵
  PID:9204
- C:\Windows\System\QVKHRTh.exe
  C:\Windows\System\QVKHRTh.exe
  2⤵
  PID:8076
- C:\Windows\System\ThRZwFO.exe
  C:\Windows\System\ThRZwFO.exe
  2⤵
  PID:7936
- C:\Windows\System\vuZThLe.exe
  C:\Windows\System\vuZThLe.exe
  2⤵
  PID:8124
- C:\Windows\System\SATSfVV.exe
  C:\Windows\System\SATSfVV.exe
  2⤵
  PID:8160
- C:\Windows\System\KlvCMBk.exe
  C:\Windows\System\KlvCMBk.exe
  2⤵
  PID:7912
- C:\Windows\System\XraqqJg.exe
  C:\Windows\System\XraqqJg.exe
  2⤵
  PID:7232
- C:\Windows\System\pBnSZhq.exe
  C:\Windows\System\pBnSZhq.exe
  2⤵
  PID:7824
- C:\Windows\System\wnvjfcq.exe
  C:\Windows\System\wnvjfcq.exe
  2⤵
  PID:8212
- C:\Windows\System\bZSsYrw.exe
  C:\Windows\System\bZSsYrw.exe
  2⤵
  PID:7668
- C:\Windows\System\qSyncQQ.exe
  C:\Windows\System\qSyncQQ.exe
  2⤵
  PID:8492
- C:\Windows\System\YrHSFeJ.exe
  C:\Windows\System\YrHSFeJ.exe
  2⤵
  PID:8560
- C:\Windows\System\SsgAvwe.exe
  C:\Windows\System\SsgAvwe.exe
  2⤵
  PID:8656
- C:\Windows\System\VcuhWJn.exe
  C:\Windows\System\VcuhWJn.exe
  2⤵
  PID:8712
- C:\Windows\System\vtQiTKz.exe
  C:\Windows\System\vtQiTKz.exe
  2⤵
  PID:7800
- C:\Windows\System\YPhBSro.exe
  C:\Windows\System\YPhBSro.exe
  2⤵
  PID:7444
- C:\Windows\System\xovJJii.exe
  C:\Windows\System\xovJJii.exe
  2⤵
  PID:8792
- C:\Windows\System\uHSUbFe.exe
  C:\Windows\System\uHSUbFe.exe
  2⤵
  PID:9240
- C:\Windows\System\LdsKqxV.exe
  C:\Windows\System\LdsKqxV.exe
  2⤵
  PID:9256
- C:\Windows\System\GPPHcZP.exe
  C:\Windows\System\GPPHcZP.exe
  2⤵
  PID:9284
- C:\Windows\System\wkuvJyi.exe
  C:\Windows\System\wkuvJyi.exe
  2⤵
  PID:9300
- C:\Windows\System\EpRnvoF.exe
  C:\Windows\System\EpRnvoF.exe
  2⤵
  PID:9320
- C:\Windows\System\jhjkDnX.exe
  C:\Windows\System\jhjkDnX.exe
  2⤵
  PID:9344
- C:\Windows\System\jmeuuQW.exe
  C:\Windows\System\jmeuuQW.exe
  2⤵
  PID:9364
- C:\Windows\System\NLiYxPF.exe
  C:\Windows\System\NLiYxPF.exe
  2⤵
  PID:9384
- C:\Windows\System\TnEkdHy.exe
  C:\Windows\System\TnEkdHy.exe
  2⤵
  PID:9404
- C:\Windows\System\jOjEMCN.exe
  C:\Windows\System\jOjEMCN.exe
  2⤵
  PID:9424
- C:\Windows\System\jpdFIjy.exe
  C:\Windows\System\jpdFIjy.exe
  2⤵
  PID:8384
- C:\Windows\System\tPbxzCA.exe
  C:\Windows\System\tPbxzCA.exe
  2⤵
  PID:8400
- C:\Windows\System\HZSvzxS.exe
  C:\Windows\System\HZSvzxS.exe
  2⤵
  PID:8508
- C:\Windows\System\JAOKcgZ.exe
  C:\Windows\System\JAOKcgZ.exe
  2⤵
  PID:9528
- C:\Windows\System\ZpTjsOX.exe
  C:\Windows\System\ZpTjsOX.exe
  2⤵
  PID:8720
- C:\Windows\System\xMmiCqF.exe
  C:\Windows\System\xMmiCqF.exe
  2⤵
  PID:9544
- C:\Windows\System\cTGorUK.exe
  C:\Windows\System\cTGorUK.exe
  2⤵
  PID:9556
- C:\Windows\System\gHHNoFb.exe
  C:\Windows\System\gHHNoFb.exe
  2⤵
  PID:8844
- C:\Windows\System\chceLNp.exe
  C:\Windows\System\chceLNp.exe
  2⤵
  PID:8880
- C:\Windows\System\GWaxDkM.exe
  C:\Windows\System\GWaxDkM.exe
  2⤵
  PID:9400
- C:\Windows\System\IPRtHYE.exe
  C:\Windows\System\IPRtHYE.exe
  2⤵
  PID:8968
- C:\Windows\System\EAtdOPt.exe
  C:\Windows\System\EAtdOPt.exe
  2⤵
  PID:9052
- C:\Windows\System\ODoLDFS.exe
  C:\Windows\System\ODoLDFS.exe
  2⤵
  PID:9096
- C:\Windows\System\UDeWSNL.exe
  C:\Windows\System\UDeWSNL.exe
  2⤵
  PID:9136
- C:\Windows\System\MEVTAPY.exe
  C:\Windows\System\MEVTAPY.exe
  2⤵
  PID:7532
- C:\Windows\System\yVpsBeF.exe
  C:\Windows\System\yVpsBeF.exe
  2⤵
  PID:7772
- C:\Windows\System\bQRqBxb.exe
  C:\Windows\System\bQRqBxb.exe
  2⤵
  PID:7896
- C:\Windows\System\MDZACMq.exe
  C:\Windows\System\MDZACMq.exe
  2⤵
  PID:9228
- C:\Windows\System\RmFiXRa.exe
  C:\Windows\System\RmFiXRa.exe
  2⤵
  PID:9312
- C:\Windows\System\vbIvtnZ.exe
  C:\Windows\System\vbIvtnZ.exe
  2⤵
  PID:9360
- C:\Windows\System\knUAIkR.exe
  C:\Windows\System\knUAIkR.exe
  2⤵
  PID:9632
- C:\Windows\System\rcpbumC.exe
  C:\Windows\System\rcpbumC.exe
  2⤵
  PID:9768
- C:\Windows\System\zWuFIak.exe
  C:\Windows\System\zWuFIak.exe
  2⤵
  PID:9612
- C:\Windows\System\hlhJGHU.exe
  C:\Windows\System\hlhJGHU.exe
  2⤵
  PID:9696
- C:\Windows\System\gGbSicu.exe
  C:\Windows\System\gGbSicu.exe
  2⤵
  PID:9744
- C:\Windows\System\kAUWjsd.exe
  C:\Windows\System\kAUWjsd.exe
  2⤵
  PID:9804
- C:\Windows\System\QWhoiwX.exe
  C:\Windows\System\QWhoiwX.exe
  2⤵
  PID:9840
- C:\Windows\System\IskdsoX.exe
  C:\Windows\System\IskdsoX.exe
  2⤵
  PID:9028
- C:\Windows\System\fHbXdkT.exe
  C:\Windows\System\fHbXdkT.exe
  2⤵
  PID:10132
- C:\Windows\System\MxowmLg.exe
  C:\Windows\System\MxowmLg.exe
  2⤵
  PID:10012
- C:\Windows\System\maAamAz.exe
  C:\Windows\System\maAamAz.exe
  2⤵
  PID:10140
- C:\Windows\System\PeJvuhi.exe
  C:\Windows\System\PeJvuhi.exe
  2⤵
  PID:10184
- C:\Windows\System\YRDwoVU.exe
  C:\Windows\System\YRDwoVU.exe
  2⤵
  PID:8236
- C:\Windows\System\CmwzHrM.exe
  C:\Windows\System\CmwzHrM.exe
  2⤵
  PID:9192
- C:\Windows\System\IvTrQQj.exe
  C:\Windows\System\IvTrQQj.exe
  2⤵
  PID:8868
- C:\Windows\System\ImTrXqN.exe
  C:\Windows\System\ImTrXqN.exe
  2⤵
  PID:6768
- C:\Windows\System\CkxjBAu.exe
  C:\Windows\System\CkxjBAu.exe
  2⤵
  PID:8440
- C:\Windows\System\JLpfLGq.exe
  C:\Windows\System\JLpfLGq.exe
  2⤵
  PID:8596
- C:\Windows\System\rQBhKKr.exe
  C:\Windows\System\rQBhKKr.exe
  2⤵
  PID:9120
- C:\Windows\System\ePIeaRU.exe
  C:\Windows\System\ePIeaRU.exe
  2⤵
  PID:9396
- C:\Windows\System\JiwGSvx.exe
  C:\Windows\System\JiwGSvx.exe
  2⤵
  PID:8740
- C:\Windows\System\LAdggWw.exe
  C:\Windows\System\LAdggWw.exe
  2⤵
  PID:7964
- C:\Windows\System\xWTTZYo.exe
  C:\Windows\System\xWTTZYo.exe
  2⤵
  PID:7780
- C:\Windows\System\vwHrcWa.exe
  C:\Windows\System\vwHrcWa.exe
  2⤵
  PID:8992
- C:\Windows\System\mBCuEvU.exe
  C:\Windows\System\mBCuEvU.exe
  2⤵
  PID:9124
- C:\Windows\System\rsHyimh.exe
  C:\Windows\System\rsHyimh.exe
  2⤵
  PID:8480
- C:\Windows\System\VFtAFTG.exe
  C:\Windows\System\VFtAFTG.exe
  2⤵
  PID:10256
- C:\Windows\System\jNqljWj.exe
  C:\Windows\System\jNqljWj.exe
  2⤵
  PID:10280
- C:\Windows\System\SEMEGIO.exe
  C:\Windows\System\SEMEGIO.exe
  2⤵
  PID:10296
- C:\Windows\System\biMVikc.exe
  C:\Windows\System\biMVikc.exe
  2⤵
  PID:10312
- C:\Windows\System\OQuEywk.exe
  C:\Windows\System\OQuEywk.exe
  2⤵
  PID:10332
- C:\Windows\System\XcVGXFS.exe
  C:\Windows\System\XcVGXFS.exe
  2⤵
  PID:10352
- C:\Windows\System\gqxzSof.exe
  C:\Windows\System\gqxzSof.exe
  2⤵
  PID:10368
- C:\Windows\System\CLmbhzs.exe
  C:\Windows\System\CLmbhzs.exe
  2⤵
  PID:10392
- C:\Windows\System\NVHgdMz.exe
  C:\Windows\System\NVHgdMz.exe
  2⤵
  PID:10408
- C:\Windows\System\ezFaFrp.exe
  C:\Windows\System\ezFaFrp.exe
  2⤵
  PID:10436
- C:\Windows\System\ogZQqVs.exe
  C:\Windows\System\ogZQqVs.exe
  2⤵
  PID:10452
- C:\Windows\System\aFOCbGs.exe
  C:\Windows\System\aFOCbGs.exe
  2⤵
  PID:10476
- C:\Windows\System\gLHBJjg.exe
  C:\Windows\System\gLHBJjg.exe
  2⤵
  PID:10492
- C:\Windows\System\sICPeVo.exe
  C:\Windows\System\sICPeVo.exe
  2⤵
  PID:10508
- C:\Windows\System\lZSRuvC.exe
  C:\Windows\System\lZSRuvC.exe
  2⤵
  PID:10524
- C:\Windows\System\tHhwFhv.exe
  C:\Windows\System\tHhwFhv.exe
  2⤵
  PID:10548
- C:\Windows\System\ccctGHR.exe
  C:\Windows\System\ccctGHR.exe
  2⤵
  PID:10628
- C:\Windows\System\UnjhXhe.exe
  C:\Windows\System\UnjhXhe.exe
  2⤵
  PID:10648
- C:\Windows\System\wRJWXCD.exe
  C:\Windows\System\wRJWXCD.exe
  2⤵
  PID:10672
- C:\Windows\System\vzyHQeJ.exe
  C:\Windows\System\vzyHQeJ.exe
  2⤵
  PID:10708
- C:\Windows\System\MAsCMXM.exe
  C:\Windows\System\MAsCMXM.exe
  2⤵
  PID:10728
- C:\Windows\System\FEogYjV.exe
  C:\Windows\System\FEogYjV.exe
  2⤵
  PID:10752
- C:\Windows\System\lAJeliV.exe
  C:\Windows\System\lAJeliV.exe
  2⤵
  PID:10768
- C:\Windows\System\wCIEEtL.exe
  C:\Windows\System\wCIEEtL.exe
  2⤵
  PID:10792
- C:\Windows\System\PFbFTdL.exe
  C:\Windows\System\PFbFTdL.exe
  2⤵
  PID:10816
- C:\Windows\System\lbrsCnj.exe
  C:\Windows\System\lbrsCnj.exe
  2⤵
  PID:10832
- C:\Windows\System\ZzpUpIG.exe
  C:\Windows\System\ZzpUpIG.exe
  2⤵
  PID:10860
- C:\Windows\System\wdKkBJf.exe
  C:\Windows\System\wdKkBJf.exe
  2⤵
  PID:10876
- C:\Windows\System\PXcCZQU.exe
  C:\Windows\System\PXcCZQU.exe
  2⤵
  PID:10904
- C:\Windows\System\EsIIwvm.exe
  C:\Windows\System\EsIIwvm.exe
  2⤵
  PID:10924
- C:\Windows\System\KckEmJG.exe
  C:\Windows\System\KckEmJG.exe
  2⤵
  PID:10944
- C:\Windows\System\uvhDyPd.exe
  C:\Windows\System\uvhDyPd.exe
  2⤵
  PID:10964
- C:\Windows\System\eszoEcr.exe
  C:\Windows\System\eszoEcr.exe
  2⤵
  PID:10988
- C:\Windows\System\szlFiQs.exe
  C:\Windows\System\szlFiQs.exe
  2⤵
  PID:11004
- C:\Windows\System\XxZgEkk.exe
  C:\Windows\System\XxZgEkk.exe
  2⤵
  PID:11024
- C:\Windows\System\bytDMKp.exe
  C:\Windows\System\bytDMKp.exe
  2⤵
  PID:11040
- C:\Windows\System\YWuXnmV.exe
  C:\Windows\System\YWuXnmV.exe
  2⤵
  PID:11056
- C:\Windows\System\MigwzAB.exe
  C:\Windows\System\MigwzAB.exe
  2⤵
  PID:11072
- C:\Windows\System\LkbetKj.exe
  C:\Windows\System\LkbetKj.exe
  2⤵
  PID:11088
- C:\Windows\System\iYEeYhh.exe
  C:\Windows\System\iYEeYhh.exe
  2⤵
  PID:11104
- C:\Windows\System\uZhEGlI.exe
  C:\Windows\System\uZhEGlI.exe
  2⤵
  PID:11128
- C:\Windows\System\HTqHUvq.exe
  C:\Windows\System\HTqHUvq.exe
  2⤵
  PID:11148
- C:\Windows\System\eulmFLm.exe
  C:\Windows\System\eulmFLm.exe
  2⤵
  PID:11168
- C:\Windows\System\SDPlbkH.exe
  C:\Windows\System\SDPlbkH.exe
  2⤵
  PID:11188
- C:\Windows\System\wLiFtze.exe
  C:\Windows\System\wLiFtze.exe
  2⤵
  PID:11212
- C:\Windows\System\cuBTshX.exe
  C:\Windows\System\cuBTshX.exe
  2⤵
  PID:11232
- C:\Windows\System\XYYolGA.exe
  C:\Windows\System\XYYolGA.exe
  2⤵
  PID:11252
- C:\Windows\System\wHELflA.exe
  C:\Windows\System\wHELflA.exe
  2⤵
  PID:9904
- C:\Windows\System\wDLkChj.exe
  C:\Windows\System\wDLkChj.exe
  2⤵
  PID:2384
- C:\Windows\System\ISlgfga.exe
  C:\Windows\System\ISlgfga.exe
  2⤵
  PID:9608
- C:\Windows\System\etPlKum.exe
  C:\Windows\System\etPlKum.exe
  2⤵
  PID:9332
- C:\Windows\System\XaQnoKz.exe
  C:\Windows\System\XaQnoKz.exe
  2⤵
  PID:9704
- C:\Windows\System\XfCPAbT.exe
  C:\Windows\System\XfCPAbT.exe
  2⤵
  PID:10228
- C:\Windows\System\tGZVNaq.exe
  C:\Windows\System\tGZVNaq.exe
  2⤵
  PID:10360
- C:\Windows\System\jahmIRn.exe
  C:\Windows\System\jahmIRn.exe
  2⤵
  PID:9296
- C:\Windows\System\BOvpTKI.exe
  C:\Windows\System\BOvpTKI.exe
  2⤵
  PID:10172
- C:\Windows\System\EEIYjTP.exe
  C:\Windows\System\EEIYjTP.exe
  2⤵
  PID:9444
- C:\Windows\System\uDZqDlZ.exe
  C:\Windows\System\uDZqDlZ.exe
  2⤵
  PID:8540
- C:\Windows\System\JGPqAJR.exe
  C:\Windows\System\JGPqAJR.exe
  2⤵
  PID:10400
- C:\Windows\System\dWUKbXP.exe
  C:\Windows\System\dWUKbXP.exe
  2⤵
  PID:10484
- C:\Windows\System\QZwykkE.exe
  C:\Windows\System\QZwykkE.exe
  2⤵
  PID:10516
- C:\Windows\System\neHVveu.exe
  C:\Windows\System\neHVveu.exe
  2⤵
  PID:8820
- C:\Windows\System\NaftLYh.exe
  C:\Windows\System\NaftLYh.exe
  2⤵
  PID:10568
- C:\Windows\System\VeLxuXe.exe
  C:\Windows\System\VeLxuXe.exe
  2⤵
  PID:9336
- C:\Windows\System\dpbdDSW.exe
  C:\Windows\System\dpbdDSW.exe
  2⤵
  PID:10804
- C:\Windows\System\ZSUCpou.exe
  C:\Windows\System\ZSUCpou.exe
  2⤵
  PID:10444
- C:\Windows\System\IYcXjcN.exe
  C:\Windows\System\IYcXjcN.exe
  2⤵
  PID:10500
- C:\Windows\System\ojRJDcI.exe
  C:\Windows\System\ojRJDcI.exe
  2⤵
  PID:11284
- C:\Windows\System\nFsHZwp.exe
  C:\Windows\System\nFsHZwp.exe
  2⤵
  PID:11308
- C:\Windows\System\CnCgoLC.exe
  C:\Windows\System\CnCgoLC.exe
  2⤵
  PID:11332
- C:\Windows\System\IOmdIBJ.exe
  C:\Windows\System\IOmdIBJ.exe
  2⤵
  PID:11356
- C:\Windows\System\OTdzRHQ.exe
  C:\Windows\System\OTdzRHQ.exe
  2⤵
  PID:11376
- C:\Windows\System\LzsxLJS.exe
  C:\Windows\System\LzsxLJS.exe
  2⤵
  PID:11396
- C:\Windows\System\WWcSjJc.exe
  C:\Windows\System\WWcSjJc.exe
  2⤵
  PID:11412
- C:\Windows\System\ReJmOjr.exe
  C:\Windows\System\ReJmOjr.exe
  2⤵
  PID:11432
- C:\Windows\System\ZjElBOJ.exe
  C:\Windows\System\ZjElBOJ.exe
  2⤵
  PID:11448
- C:\Windows\System\EqXtWNK.exe
  C:\Windows\System\EqXtWNK.exe
  2⤵
  PID:11472
- C:\Windows\System\AQdTeYD.exe
  C:\Windows\System\AQdTeYD.exe
  2⤵
  PID:11500
- C:\Windows\System\nfQsxnd.exe
  C:\Windows\System\nfQsxnd.exe
  2⤵
  PID:11516
- C:\Windows\System\YmDGWKK.exe
  C:\Windows\System\YmDGWKK.exe
  2⤵
  PID:11536
- C:\Windows\System\PVrIshq.exe
  C:\Windows\System\PVrIshq.exe
  2⤵
  PID:11556
- C:\Windows\System\RzuRtUV.exe
  C:\Windows\System\RzuRtUV.exe
  2⤵
  PID:11576
- C:\Windows\System\fkFJzIx.exe
  C:\Windows\System\fkFJzIx.exe
  2⤵
  PID:11596
- C:\Windows\System\XcDBASe.exe
  C:\Windows\System\XcDBASe.exe
  2⤵
  PID:11616
- C:\Windows\System\dRgkAQz.exe
  C:\Windows\System\dRgkAQz.exe
  2⤵
  PID:11632
- C:\Windows\System\MUVbRcj.exe
  C:\Windows\System\MUVbRcj.exe
  2⤵
  PID:11648
- C:\Windows\System\SNJkFfG.exe
  C:\Windows\System\SNJkFfG.exe
  2⤵
  PID:11668
- C:\Windows\System\dxyOKWm.exe
  C:\Windows\System\dxyOKWm.exe
  2⤵
  PID:11692
- C:\Windows\System\jLwONFm.exe
  C:\Windows\System\jLwONFm.exe
  2⤵
  PID:11712
- C:\Windows\System\UsxdadX.exe
  C:\Windows\System\UsxdadX.exe
  2⤵
  PID:11728
- C:\Windows\System\YhmWsxC.exe
  C:\Windows\System\YhmWsxC.exe
  2⤵
  PID:11744
- C:\Windows\System\qbgNiWV.exe
  C:\Windows\System\qbgNiWV.exe
  2⤵
  PID:11760
- C:\Windows\System\HZQZZoP.exe
  C:\Windows\System\HZQZZoP.exe
  2⤵
  PID:11780
- C:\Windows\System\TLOdfhh.exe
  C:\Windows\System\TLOdfhh.exe
  2⤵
  PID:11804
- C:\Windows\System\OXGgvdx.exe
  C:\Windows\System\OXGgvdx.exe
  2⤵
  PID:11824
- C:\Windows\System\wLjYWKo.exe
  C:\Windows\System\wLjYWKo.exe
  2⤵
  PID:11844
- C:\Windows\System\QxaSsoL.exe
  C:\Windows\System\QxaSsoL.exe
  2⤵
  PID:11868
- C:\Windows\System\bQFSVWr.exe
  C:\Windows\System\bQFSVWr.exe
  2⤵
  PID:11896
- C:\Windows\System\ZqewUVU.exe
  C:\Windows\System\ZqewUVU.exe
  2⤵
  PID:11916
- C:\Windows\System\eLPoEZf.exe
  C:\Windows\System\eLPoEZf.exe
  2⤵
  PID:11936
- C:\Windows\System\ntBfxIf.exe
  C:\Windows\System\ntBfxIf.exe
  2⤵
  PID:11956
- C:\Windows\System\IhhiqKi.exe
  C:\Windows\System\IhhiqKi.exe
  2⤵
  PID:11976
- C:\Windows\System\gMezorR.exe
  C:\Windows\System\gMezorR.exe
  2⤵
  PID:11996
- C:\Windows\System\DEzWHBJ.exe
  C:\Windows\System\DEzWHBJ.exe
  2⤵
  PID:12016
- C:\Windows\System\gdEwIxp.exe
  C:\Windows\System\gdEwIxp.exe
  2⤵
  PID:12044
- C:\Windows\System\VgqAtfw.exe
  C:\Windows\System\VgqAtfw.exe
  2⤵
  PID:12060
- C:\Windows\System\yCgnBZE.exe
  C:\Windows\System\yCgnBZE.exe
  2⤵
  PID:12080
- C:\Windows\System\ulbbBsE.exe
  C:\Windows\System\ulbbBsE.exe
  2⤵
  PID:12100
- C:\Windows\System\hpNFXKs.exe
  C:\Windows\System\hpNFXKs.exe
  2⤵
  PID:12124
- C:\Windows\System\QvBuksU.exe
  C:\Windows\System\QvBuksU.exe
  2⤵
  PID:12144
- C:\Windows\System\IGXsbzy.exe
  C:\Windows\System\IGXsbzy.exe
  2⤵
  PID:12160
- C:\Windows\System\iRkXIxW.exe
  C:\Windows\System\iRkXIxW.exe
  2⤵
  PID:12188
- C:\Windows\System\hsaQSAp.exe
  C:\Windows\System\hsaQSAp.exe
  2⤵
  PID:12208
- C:\Windows\System\VJmIFQh.exe
  C:\Windows\System\VJmIFQh.exe
  2⤵
  PID:12228
- C:\Windows\System\OoCQAoU.exe
  C:\Windows\System\OoCQAoU.exe
  2⤵
  PID:12244
- C:\Windows\System\JBSSjgK.exe
  C:\Windows\System\JBSSjgK.exe
  2⤵
  PID:12268
- C:\Windows\System\GZGDbeP.exe
  C:\Windows\System\GZGDbeP.exe
  2⤵
  PID:10304
- C:\Windows\System\xiiFEtx.exe
  C:\Windows\System\xiiFEtx.exe
  2⤵
  PID:11032
- C:\Windows\System\USPANBE.exe
  C:\Windows\System\USPANBE.exe
  2⤵
  PID:9224
- C:\Windows\System\wctAgYs.exe
  C:\Windows\System\wctAgYs.exe
  2⤵
  PID:11304
- C:\Windows\System\osbcVCB.exe
  C:\Windows\System\osbcVCB.exe
  2⤵
  PID:11404
- C:\Windows\System\qRANTZD.exe
  C:\Windows\System\qRANTZD.exe
  2⤵
  PID:10252
- C:\Windows\System\UaKwLJQ.exe
  C:\Windows\System\UaKwLJQ.exe
  2⤵
  PID:11572
- C:\Windows\System\vaZMBIV.exe
  C:\Windows\System\vaZMBIV.exe
  2⤵
  PID:11352
- C:\Windows\System\IqntRPX.exe
  C:\Windows\System\IqntRPX.exe
  2⤵
  PID:11372
- C:\Windows\System\BcPQOTU.exe
  C:\Windows\System\BcPQOTU.exe
  2⤵
  PID:11788
- C:\Windows\System\LHhnwSS.exe
  C:\Windows\System\LHhnwSS.exe
  2⤵
  PID:11156
- C:\Windows\System\OQndyxQ.exe
  C:\Windows\System\OQndyxQ.exe
  2⤵
  PID:11884
- C:\Windows\System\sapsOir.exe
  C:\Windows\System\sapsOir.exe
  2⤵
  PID:12304
- C:\Windows\System\AtMyVuF.exe
  C:\Windows\System\AtMyVuF.exe
  2⤵
  PID:12324
- C:\Windows\System\IVxDxyt.exe
  C:\Windows\System\IVxDxyt.exe
  2⤵
  PID:12344
- C:\Windows\System\GlooXMd.exe
  C:\Windows\System\GlooXMd.exe
  2⤵
  PID:12360
- C:\Windows\System\IlIsHfZ.exe
  C:\Windows\System\IlIsHfZ.exe
  2⤵
  PID:12444
- C:\Windows\System\faKHpah.exe
  C:\Windows\System\faKHpah.exe
  2⤵
  PID:12464
- C:\Windows\System\kFUlhrr.exe
  C:\Windows\System\kFUlhrr.exe
  2⤵
  PID:12488
- C:\Windows\System\ZqbHWQB.exe
  C:\Windows\System\ZqbHWQB.exe
  2⤵
  PID:12508
- C:\Windows\System\AhZUuhy.exe
  C:\Windows\System\AhZUuhy.exe
  2⤵
  PID:12532
- C:\Windows\System\LQApffQ.exe
  C:\Windows\System\LQApffQ.exe
  2⤵
  PID:12556
- C:\Windows\System\ooCaOEo.exe
  C:\Windows\System\ooCaOEo.exe
  2⤵
  PID:12572
- C:\Windows\System\JETDoOn.exe
  C:\Windows\System\JETDoOn.exe
  2⤵
  PID:12596
- C:\Windows\System\FQJBNos.exe
  C:\Windows\System\FQJBNos.exe
  2⤵
  PID:12620
- C:\Windows\System\nMChTCf.exe
  C:\Windows\System\nMChTCf.exe
  2⤵
  PID:12648
- C:\Windows\System\GOsmuLB.exe
  C:\Windows\System\GOsmuLB.exe
  2⤵
  PID:12664
- C:\Windows\System\deQkUhG.exe
  C:\Windows\System\deQkUhG.exe
  2⤵
  PID:12688
- C:\Windows\System\qfuIPRd.exe
  C:\Windows\System\qfuIPRd.exe
  2⤵
  PID:12712
- C:\Windows\System\PROINjN.exe
  C:\Windows\System\PROINjN.exe
  2⤵
  PID:12728
- C:\Windows\System\gwkELTo.exe
  C:\Windows\System\gwkELTo.exe
  2⤵
  PID:12752
- C:\Windows\System\qkJqevC.exe
  C:\Windows\System\qkJqevC.exe
  2⤵
  PID:12776
- C:\Windows\System\vcZZGSV.exe
  C:\Windows\System\vcZZGSV.exe
  2⤵
  PID:12800
- C:\Windows\System\hwGHXDj.exe
  C:\Windows\System\hwGHXDj.exe
  2⤵
  PID:12820
- C:\Windows\System\woWNwDe.exe
  C:\Windows\System\woWNwDe.exe
  2⤵
  PID:12844
- C:\Windows\System\FQLupRm.exe
  C:\Windows\System\FQLupRm.exe
  2⤵
  PID:12864
- C:\Windows\System\PtRpTfD.exe
  C:\Windows\System\PtRpTfD.exe
  2⤵
  PID:12884
- C:\Windows\System\afdGFnu.exe
  C:\Windows\System\afdGFnu.exe
  2⤵
  PID:12900
- C:\Windows\System\qTqOTcH.exe
  C:\Windows\System\qTqOTcH.exe
  2⤵
  PID:12920
- C:\Windows\System\NOrOZQH.exe
  C:\Windows\System\NOrOZQH.exe
  2⤵
  PID:12940
- C:\Windows\System\XVyTYfS.exe
  C:\Windows\System\XVyTYfS.exe
  2⤵
  PID:12956
- C:\Windows\System\IfsfnWy.exe
  C:\Windows\System\IfsfnWy.exe
  2⤵
  PID:12972
- C:\Windows\System\QoZQkwY.exe
  C:\Windows\System\QoZQkwY.exe
  2⤵
  PID:12988
- C:\Windows\System\YfErSot.exe
  C:\Windows\System\YfErSot.exe
  2⤵
  PID:13292
- C:\Windows\System\sJTNhNl.exe
  C:\Windows\System\sJTNhNl.exe
  2⤵
  PID:13308
- C:\Windows\System\SWUqrxN.exe
  C:\Windows\System\SWUqrxN.exe
  2⤵
  PID:11592
- C:\Windows\System\LeSQMkt.exe
  C:\Windows\System\LeSQMkt.exe
  2⤵
  PID:12276
- C:\Windows\System\GXHRzPF.exe
  C:\Windows\System\GXHRzPF.exe
  2⤵
  PID:11660
- C:\Windows\System\bFNuqVd.exe
  C:\Windows\System\bFNuqVd.exe
  2⤵
  PID:11740
- C:\Windows\System\rwhiWnZ.exe
  C:\Windows\System\rwhiWnZ.exe
  2⤵
  PID:11772
- C:\Windows\System\kkSlsdR.exe
  C:\Windows\System\kkSlsdR.exe
  2⤵
  PID:13236
- C:\Windows\System\WdIcFCV.exe
  C:\Windows\System\WdIcFCV.exe
  2⤵
  PID:908
- C:\Windows\System\tHDysgU.exe
  C:\Windows\System\tHDysgU.exe
  2⤵
  PID:11792
- C:\Windows\System\nUnGLti.exe
  C:\Windows\System\nUnGLti.exe
  2⤵
  PID:10972
- C:\Windows\System\euytCIK.exe
  C:\Windows\System\euytCIK.exe
  2⤵
  PID:11392
- C:\Windows\System\zWGWsXT.exe
  C:\Windows\System\zWGWsXT.exe
  2⤵
  PID:12096
- C:\Windows\System\oaiqVsG.exe
  C:\Windows\System\oaiqVsG.exe
  2⤵
  PID:11456
- C:\Windows\System\TKNHFLM.exe
  C:\Windows\System\TKNHFLM.exe
  2⤵
  PID:11384
- C:\Windows\System\WGhsSBt.exe
  C:\Windows\System\WGhsSBt.exe
  2⤵
  PID:12120
- C:\Windows\System\WViWaSV.exe
  C:\Windows\System\WViWaSV.exe
  2⤵
  PID:11564
- C:\Windows\System\NevmbiK.exe
  C:\Windows\System\NevmbiK.exe
  2⤵
  PID:3136
- C:\Windows\System\MRwjqnt.exe
  C:\Windows\System\MRwjqnt.exe
  2⤵
  PID:11408
- C:\Windows\System\VNjfeZs.exe
  C:\Windows\System\VNjfeZs.exe
  2⤵
  PID:11992
- C:\Windows\System\cROxRCM.exe
  C:\Windows\System\cROxRCM.exe
  2⤵
  PID:11340
- C:\Windows\System\hoyujGb.exe
  C:\Windows\System\hoyujGb.exe
  2⤵
  PID:12076
- C:\Windows\System\fEIbVvo.exe
  C:\Windows\System\fEIbVvo.exe
  2⤵
  PID:11276
- C:\Windows\System\mOeiGzb.exe
  C:\Windows\System\mOeiGzb.exe
  2⤵
  PID:12528
- C:\Windows\System\CVmsurG.exe
  C:\Windows\System\CVmsurG.exe
  2⤵
  PID:12516
- C:\Windows\System\NJKiBaE.exe
  C:\Windows\System\NJKiBaE.exe
  2⤵
  PID:12796
- C:\Windows\System\XmFMRsh.exe
  C:\Windows\System\XmFMRsh.exe
  2⤵
  PID:13220
- C:\Windows\System\WUuJgFf.exe
  C:\Windows\System\WUuJgFf.exe
  2⤵
  PID:12856
- C:\Windows\System\eVvgDmL.exe
  C:\Windows\System\eVvgDmL.exe
  2⤵
  PID:10584
- C:\Windows\System\KxpfKbQ.exe
  C:\Windows\System\KxpfKbQ.exe
  2⤵
  PID:12592
- C:\Windows\System\yjachek.exe
  C:\Windows\System\yjachek.exe
  2⤵
  PID:11464
- C:\Windows\System\FFjqxJY.exe
  C:\Windows\System\FFjqxJY.exe
  2⤵
  PID:12772
- C:\Windows\System\sWzfWIX.exe
  C:\Windows\System\sWzfWIX.exe
  2⤵
  PID:12072
- C:\Windows\System\jbemxbx.exe
  C:\Windows\System\jbemxbx.exe
  2⤵
  PID:2032
- C:\Windows\System\OuZGYNE.exe
  C:\Windows\System\OuZGYNE.exe
  2⤵
  PID:12420
- C:\Windows\System\uMQoqnB.exe
  C:\Windows\System\uMQoqnB.exe
  2⤵
  PID:10912
- C:\Windows\System\vqbyRIl.exe
  C:\Windows\System\vqbyRIl.exe
  2⤵
  PID:11528
- C:\Windows\System\SUCuctt.exe
  C:\Windows\System\SUCuctt.exe
  2⤵
  PID:8420
- C:\Windows\System\LhQkREB.exe
  C:\Windows\System\LhQkREB.exe
  2⤵
  PID:3708
- C:\Windows\System\atTBptl.exe
  C:\Windows\System\atTBptl.exe
  2⤵
  PID:11480
- C:\Windows\System\QDbFyLL.exe
  C:\Windows\System\QDbFyLL.exe
  2⤵
  PID:11688
- C:\Windows\System\LKOFcTa.exe
  C:\Windows\System\LKOFcTa.exe
  2⤵
  PID:11768
- C:\Windows\System\YxUZsNw.exe
  C:\Windows\System\YxUZsNw.exe
  2⤵
  PID:12784
- C:\Windows\System\tKwwBmM.exe
  C:\Windows\System\tKwwBmM.exe
  2⤵
  PID:11984
- C:\Windows\System\VARQEHf.exe
  C:\Windows\System\VARQEHf.exe
  2⤵
  PID:960
- C:\Windows\System\prMfXoX.exe
  C:\Windows\System\prMfXoX.exe
  2⤵
  PID:11320
- C:\Windows\System\ONfcTKl.exe
  C:\Windows\System\ONfcTKl.exe
  2⤵
  PID:12792
- C:\Windows\System\kpGsOpm.exe
  C:\Windows\System\kpGsOpm.exe
  2⤵
  PID:11924
- C:\Windows\System\PEDEChK.exe
  C:\Windows\System\PEDEChK.exe
  2⤵
  PID:12736
- C:\Windows\System\zYVEIHJ.exe
  C:\Windows\System\zYVEIHJ.exe
  2⤵
  PID:11364
- C:\Windows\System\wpUMqRx.exe
  C:\Windows\System\wpUMqRx.exe
  2⤵
  PID:5080
- C:\Windows\System\dtTYdTE.exe
  C:\Windows\System\dtTYdTE.exe
  2⤵
  PID:3996
- C:\Windows\System\wRuTxIc.exe
  C:\Windows\System\wRuTxIc.exe
  2⤵
  PID:1536
- C:\Windows\System\UIGNLwv.exe
  C:\Windows\System\UIGNLwv.exe
  2⤵
  PID:1968
- C:\Windows\System\JZkeCXD.exe
  C:\Windows\System\JZkeCXD.exe
  2⤵
  PID:3688
- C:\Windows\System\EgIhZml.exe
  C:\Windows\System\EgIhZml.exe
  2⤵
  PID:11420
- C:\Windows\System\aapsKkz.exe
  C:\Windows\System\aapsKkz.exe
  2⤵
  PID:2976
- C:\Windows\System\WWLmuhm.exe
  C:\Windows\System\WWLmuhm.exe
  2⤵
  PID:1436
- C:\Windows\System\QthzZll.exe
  C:\Windows\System\QthzZll.exe
  2⤵
  PID:12672
- C:\Windows\System\trSNVcf.exe
  C:\Windows\System\trSNVcf.exe
  2⤵
  PID:13164
- C:\Windows\System\UazfQAz.exe
  C:\Windows\System\UazfQAz.exe
  2⤵
  PID:1560
- C:\Windows\System\SLzvReJ.exe
  C:\Windows\System\SLzvReJ.exe
  2⤵
  PID:1368
- C:\Windows\System\dzXNFlu.exe
  C:\Windows\System\dzXNFlu.exe
  2⤵
  PID:7136
- C:\Windows\System\oNIkIxv.exe
  C:\Windows\System\oNIkIxv.exe
  2⤵
  PID:3612
- C:\Windows\System\epWmCVJ.exe
  C:\Windows\System\epWmCVJ.exe
  2⤵
  PID:6260
- C:\Windows\System\NlKoToE.exe
  C:\Windows\System\NlKoToE.exe
  2⤵
  PID:6420
- C:\Windows\System\wswhSyr.exe
  C:\Windows\System\wswhSyr.exe
  2⤵
  PID:6636
- C:\Windows\System\fNONUsY.exe
  C:\Windows\System\fNONUsY.exe
  2⤵
  PID:6672
- C:\Windows\System\VMixydN.exe
  C:\Windows\System\VMixydN.exe
  2⤵
  PID:11988
- C:\Windows\System\wOvqSVF.exe
  C:\Windows\System\wOvqSVF.exe
  2⤵
  PID:3796
- C:\Windows\System\wMLIKhZ.exe
  C:\Windows\System\wMLIKhZ.exe
  2⤵
  PID:12984
- C:\Windows\System\pfSsKPH.exe
  C:\Windows\System\pfSsKPH.exe
  2⤵
  PID:2228
- C:\Windows\System\LYakpRu.exe
  C:\Windows\System\LYakpRu.exe
  2⤵
  PID:6464
- C:\Windows\System\MLkqKNj.exe
  C:\Windows\System\MLkqKNj.exe
  2⤵
  PID:4452
- C:\Windows\System\lbHhimG.exe
  C:\Windows\System\lbHhimG.exe
  2⤵
  PID:5508
- C:\Windows\System\gntrLwc.exe
  C:\Windows\System\gntrLwc.exe
  2⤵
  PID:7264
- C:\Windows\System\JhZQBmO.exe
  C:\Windows\System\JhZQBmO.exe
  2⤵
  PID:11952
- C:\Windows\System\TKbxklm.exe
  C:\Windows\System\TKbxklm.exe
  2⤵
  PID:4008
- C:\Windows\System\BLtKiRw.exe
  C:\Windows\System\BLtKiRw.exe
  2⤵
  PID:912
- C:\Windows\System\hUBUKgy.exe
  C:\Windows\System\hUBUKgy.exe
  2⤵
  PID:4532
- C:\Windows\System\IohdPFH.exe
  C:\Windows\System\IohdPFH.exe
  2⤵
  PID:64
- C:\Windows\System\fuVfnjv.exe
  C:\Windows\System\fuVfnjv.exe
  2⤵
  PID:13336
- C:\Windows\System\yuVIrVH.exe
  C:\Windows\System\yuVIrVH.exe
  2⤵
  PID:13392
- C:\Windows\System\jqpCErd.exe
  C:\Windows\System\jqpCErd.exe
  2⤵
  PID:13420
- C:\Windows\System\uCNVgDJ.exe
  C:\Windows\System\uCNVgDJ.exe
  2⤵
  PID:13440
- C:\Windows\System\CELVuIy.exe
  C:\Windows\System\CELVuIy.exe
  2⤵
  PID:13460
- C:\Windows\System\oGtZqcO.exe
  C:\Windows\System\oGtZqcO.exe
  2⤵
  PID:13480
- C:\Windows\System\tEcRdDH.exe
  C:\Windows\System\tEcRdDH.exe
  2⤵
  PID:13500
- C:\Windows\System\cZHpiRg.exe
  C:\Windows\System\cZHpiRg.exe
  2⤵
  PID:13572
- C:\Windows\System\UniaZHR.exe
  C:\Windows\System\UniaZHR.exe
  2⤵
  PID:13612
- C:\Windows\System\aFScimt.exe
  C:\Windows\System\aFScimt.exe
  2⤵
  PID:13664
- C:\Windows\System\mcLTQuj.exe
  C:\Windows\System\mcLTQuj.exe
  2⤵
  PID:13680
- C:\Windows\System\utxyOFX.exe
  C:\Windows\System\utxyOFX.exe
  2⤵
  PID:13696
- C:\Windows\System\ohsDJaI.exe
  C:\Windows\System\ohsDJaI.exe
  2⤵
  PID:13728
- C:\Windows\System\WcmfWZQ.exe
  C:\Windows\System\WcmfWZQ.exe
  2⤵
  PID:14256
- C:\Windows\System\yCmmbyF.exe
  C:\Windows\System\yCmmbyF.exe
  2⤵
  PID:14272
- C:\Windows\System\shaJkka.exe
  C:\Windows\System\shaJkka.exe
  2⤵
  PID:14288
- C:\Windows\System\mtBkbyg.exe
  C:\Windows\System\mtBkbyg.exe
  2⤵
  PID:14304
- C:\Windows\System\soWAIBe.exe
  C:\Windows\System\soWAIBe.exe
  2⤵
  PID:14320
- C:\Windows\System\ADCmXZZ.exe
  C:\Windows\System\ADCmXZZ.exe
  2⤵
  PID:6812
- C:\Windows\System\hayiwiY.exe
  C:\Windows\System\hayiwiY.exe
  2⤵
  PID:5084
- C:\Windows\System\RmspezD.exe
  C:\Windows\System\RmspezD.exe
  2⤵
  PID:12708
- C:\Windows\System\FpUPpRm.exe
  C:\Windows\System\FpUPpRm.exe
  2⤵
  PID:4080
- C:\Windows\System\aFbUhRr.exe
  C:\Windows\System\aFbUhRr.exe
  2⤵
  PID:12948
- C:\Windows\System\gznDYfQ.exe
  C:\Windows\System\gznDYfQ.exe
  2⤵
  PID:3428
- C:\Windows\System\YEktAej.exe
  C:\Windows\System\YEktAej.exe
  2⤵
  PID:4968
- C:\Windows\System\UzFkpPx.exe
  C:\Windows\System\UzFkpPx.exe
  2⤵
  PID:3916
- C:\Windows\System\YxxqHvB.exe
  C:\Windows\System\YxxqHvB.exe
  2⤵
  PID:4004
- C:\Windows\System\XJLylxT.exe
  C:\Windows\System\XJLylxT.exe
  2⤵
  PID:3652
- C:\Windows\System\JnsAwon.exe
  C:\Windows\System\JnsAwon.exe
  2⤵
  PID:4168
- C:\Windows\System\lqAtsjr.exe
  C:\Windows\System\lqAtsjr.exe
  2⤵
  PID:13604
- C:\Windows\System\JGdZXub.exe
  C:\Windows\System\JGdZXub.exe
  2⤵
  PID:13788
- C:\Windows\System\QaBIAzD.exe
  C:\Windows\System\QaBIAzD.exe
  2⤵
  PID:13544
- C:\Windows\System\WQrTDuN.exe
  C:\Windows\System\WQrTDuN.exe
  2⤵
  PID:13592
- C:\Windows\System\JVOEiEW.exe
  C:\Windows\System\JVOEiEW.exe
  2⤵
  PID:13628
- C:\Windows\System\QfxTOKO.exe
  C:\Windows\System\QfxTOKO.exe
  2⤵
  PID:6492
- C:\Windows\System\FfYsqEI.exe
  C:\Windows\System\FfYsqEI.exe
  2⤵
  PID:13316
- C:\Windows\System\rhwHIJX.exe
  C:\Windows\System\rhwHIJX.exe
  2⤵
  PID:13352
- C:\Windows\System\KPpbxsS.exe
  C:\Windows\System\KPpbxsS.exe
  2⤵
  PID:13428
- C:\Windows\System\xVSpTfd.exe
  C:\Windows\System\xVSpTfd.exe
  2⤵
  PID:13524
- C:\Windows\System\inJcDDN.exe
  C:\Windows\System\inJcDDN.exe
  2⤵
  PID:13584
- C:\Windows\System\nmzkCqh.exe
  C:\Windows\System\nmzkCqh.exe
  2⤵
  PID:13676
- C:\Windows\System\kHrZijD.exe
  C:\Windows\System\kHrZijD.exe
  2⤵
  PID:13712
- C:\Windows\System\CXjVwPe.exe
  C:\Windows\System\CXjVwPe.exe
  2⤵
  PID:13740
- C:\Windows\System\pXjIUeI.exe
  C:\Windows\System\pXjIUeI.exe
  2⤵
  PID:13756
- C:\Windows\System\RAcadcl.exe
  C:\Windows\System\RAcadcl.exe
  2⤵
  PID:13784
- C:\Windows\System\eWETWwQ.exe
  C:\Windows\System\eWETWwQ.exe
  2⤵
  PID:13832
- C:\Windows\System\wfEHCOe.exe
  C:\Windows\System\wfEHCOe.exe
  2⤵
  PID:5216
- C:\Windows\System\PIWjqYE.exe
  C:\Windows\System\PIWjqYE.exe
  2⤵
  PID:5156
- C:\Windows\System\GMydONJ.exe
  C:\Windows\System\GMydONJ.exe
  2⤵
  PID:5176
- C:\Windows\System\OvxVdoA.exe
  C:\Windows\System\OvxVdoA.exe
  2⤵
  PID:13900
- C:\Windows\System\RgCYvpY.exe
  C:\Windows\System\RgCYvpY.exe
  2⤵
  PID:13908
- C:\Windows\System\epvxxap.exe
  C:\Windows\System\epvxxap.exe
  2⤵
  PID:13924
- C:\Windows\System\lzCsfwu.exe
  C:\Windows\System\lzCsfwu.exe
  2⤵
  PID:5524
- C:\Windows\System\FMaNWhK.exe
  C:\Windows\System\FMaNWhK.exe
  2⤵
  PID:5468
- C:\Windows\System\GeBkqAf.exe
  C:\Windows\System\GeBkqAf.exe
  2⤵
  PID:14000
- C:\Windows\System\ZlUVrHp.exe
  C:\Windows\System\ZlUVrHp.exe
  2⤵
  PID:13948
- C:\Windows\System\HqzLocx.exe
  C:\Windows\System\HqzLocx.exe
  2⤵
  PID:5672
- C:\Windows\System\lNwvsoz.exe
  C:\Windows\System\lNwvsoz.exe
  2⤵
  PID:5272
- C:\Windows\System\kxEiJgU.exe
  C:\Windows\System\kxEiJgU.exe
  2⤵
  PID:5664
- C:\Windows\System\bHWXuCk.exe
  C:\Windows\System\bHWXuCk.exe
  2⤵
  PID:5024
- C:\Windows\System\DTqGhea.exe
  C:\Windows\System\DTqGhea.exe
  2⤵
  PID:448
- C:\Windows\System\SrXSPNp.exe
  C:\Windows\System\SrXSPNp.exe
  2⤵
  PID:13964
- C:\Windows\System\slsaoSN.exe
  C:\Windows\System\slsaoSN.exe
  2⤵
  PID:13952
- C:\Windows\System\OHjQOZO.exe
  C:\Windows\System\OHjQOZO.exe
  2⤵
  PID:14044
- C:\Windows\System\uDMiFNM.exe
  C:\Windows\System\uDMiFNM.exe
  2⤵
  PID:6036
- C:\Windows\System\zkcTesY.exe
  C:\Windows\System\zkcTesY.exe
  2⤵
  PID:6100
- C:\Windows\System\gCOeMlT.exe
  C:\Windows\System\gCOeMlT.exe
  2⤵
  PID:6000
- C:\Windows\System\RUiQXNW.exe
  C:\Windows\System\RUiQXNW.exe
  2⤵
  PID:5440
- C:\Windows\System\ipaYSIm.exe
  C:\Windows\System\ipaYSIm.exe
  2⤵
  PID:4628
- C:\Windows\System\zOtftJS.exe
  C:\Windows\System\zOtftJS.exe
  2⤵
  PID:11628
- C:\Windows\System\gbgiarw.exe
  C:\Windows\System\gbgiarw.exe
  2⤵
  PID:1008
- C:\Windows\System\TEphpmp.exe
  C:\Windows\System\TEphpmp.exe
  2⤵
  PID:13400
- C:\Windows\System\BdteKvt.exe
  C:\Windows\System\BdteKvt.exe
  2⤵
  PID:1588
- C:\Windows\System\FEXkeRD.exe
  C:\Windows\System\FEXkeRD.exe
  2⤵
  PID:620
- C:\Windows\System\LnJGjYn.exe
  C:\Windows\System\LnJGjYn.exe
  2⤵
  PID:13856
- C:\Windows\System\DIuCjVu.exe
  C:\Windows\System\DIuCjVu.exe
  2⤵
  PID:13692
- C:\Windows\System\viDRYZK.exe
  C:\Windows\System\viDRYZK.exe
  2⤵
  PID:13708
- C:\Windows\System\lgENHzC.exe
  C:\Windows\System\lgENHzC.exe
  2⤵
  PID:13824
- C:\Windows\System\IXZEZOG.exe
  C:\Windows\System\IXZEZOG.exe
  2⤵
  PID:1276
- C:\Windows\System\vPegpZU.exe
  C:\Windows\System\vPegpZU.exe
  2⤵
  PID:14284
- C:\Windows\System\MxYHoIj.exe
  C:\Windows\System\MxYHoIj.exe
  2⤵
  PID:13896
- C:\Windows\System\PtQuKaP.exe
  C:\Windows\System\PtQuKaP.exe
  2⤵
  PID:2128
- C:\Windows\System\hPNOtzD.exe
  C:\Windows\System\hPNOtzD.exe
  2⤵
  PID:5288
- C:\Windows\System\RkPgrAw.exe
  C:\Windows\System\RkPgrAw.exe
  2⤵
  PID:5840
- C:\Windows\System\VZMiRwn.exe
  C:\Windows\System\VZMiRwn.exe
  2⤵
  PID:4556
- C:\Windows\System\AnxOEIm.exe
  C:\Windows\System\AnxOEIm.exe
  2⤵
  PID:5712
- C:\Windows\System\fBJVHyz.exe
  C:\Windows\System\fBJVHyz.exe
  2⤵
  PID:3536
- C:\Windows\System\TApEoRA.exe
  C:\Windows\System\TApEoRA.exe
  2⤵
  PID:4992
- C:\Windows\System\UDuVpAL.exe
  C:\Windows\System\UDuVpAL.exe
  2⤵
  PID:13548
- C:\Windows\System\ypAmjBG.exe
  C:\Windows\System\ypAmjBG.exe
  2⤵
  PID:13892
- C:\Windows\System\ItTiKUR.exe
  C:\Windows\System\ItTiKUR.exe
  2⤵
  PID:13840
- C:\Windows\System\FrYVaGB.exe
  C:\Windows\System\FrYVaGB.exe
  2⤵
  PID:5244
- C:\Windows\System\vwObOGf.exe
  C:\Windows\System\vwObOGf.exe
  2⤵
  PID:2604
- C:\Windows\System\onjeqhS.exe
  C:\Windows\System\onjeqhS.exe
  2⤵
  PID:6588
- C:\Windows\System\RetFxhZ.exe
  C:\Windows\System\RetFxhZ.exe
  2⤵
  PID:5380
- C:\Windows\System\yJJWyPt.exe
  C:\Windows\System\yJJWyPt.exe
  2⤵
  PID:14196
- C:\Windows\System\DbtJhRE.exe
  C:\Windows\System\DbtJhRE.exe
  2⤵
  PID:5776
- C:\Windows\System\OeRXZen.exe
  C:\Windows\System\OeRXZen.exe
  2⤵
  PID:13920
- C:\Windows\System\qhJRuge.exe
  C:\Windows\System\qhJRuge.exe
  2⤵
  PID:4076
- C:\Windows\System\qhWZonj.exe
  C:\Windows\System\qhWZonj.exe
  2⤵
  PID:7132
- C:\Windows\System\gQjLqhs.exe
  C:\Windows\System\gQjLqhs.exe
  2⤵
  PID:6564
- C:\Windows\System\mwGXnFi.exe
  C:\Windows\System\mwGXnFi.exe
  2⤵
  PID:6704
- C:\Windows\System\KxZcHNq.exe
  C:\Windows\System\KxZcHNq.exe
  2⤵
  PID:3912
- C:\Windows\System\VDblVDO.exe
  C:\Windows\System\VDblVDO.exe
  2⤵
  PID:2140
- C:\Windows\System\dEeLvfE.exe
  C:\Windows\System\dEeLvfE.exe
  2⤵
  PID:6396
- C:\Windows\System\AyRHzDR.exe
  C:\Windows\System\AyRHzDR.exe
  2⤵
  PID:13344
- C:\Windows\System\EpEgzjc.exe
  C:\Windows\System\EpEgzjc.exe
  2⤵
  PID:4528
- C:\Windows\System\kBxuLxC.exe
  C:\Windows\System\kBxuLxC.exe
  2⤵
  PID:13768
- C:\Windows\System\RnPUIgA.exe
  C:\Windows\System\RnPUIgA.exe
  2⤵
  PID:14236
- C:\Windows\System\iBfcjwN.exe
  C:\Windows\System\iBfcjwN.exe
  2⤵
  PID:5188
- C:\Windows\System\wcasibb.exe
  C:\Windows\System\wcasibb.exe
  2⤵
  PID:6084
- C:\Windows\System\XJRPCCx.exe
  C:\Windows\System\XJRPCCx.exe
  2⤵
  PID:5064
- C:\Windows\System\nuqcffL.exe
  C:\Windows\System\nuqcffL.exe
  2⤵
  PID:4160
- C:\Windows\System\FlDfpmt.exe
  C:\Windows\System\FlDfpmt.exe
  2⤵
  PID:6676
- C:\Windows\System\XSIdpja.exe
  C:\Windows\System\XSIdpja.exe
  2⤵
  PID:14244
- C:\Windows\System\TPuOnDi.exe
  C:\Windows\System\TPuOnDi.exe
  2⤵
  PID:14356
- C:\Windows\System\xcjXhuM.exe
  C:\Windows\System\xcjXhuM.exe
  2⤵
  PID:14372
- C:\Windows\System\EBfbcAM.exe
  C:\Windows\System\EBfbcAM.exe
  2⤵
  PID:14396
- C:\Windows\System\egCCNti.exe
  C:\Windows\System\egCCNti.exe
  2⤵
  PID:14412
- C:\Windows\System\yRlyxpA.exe
  C:\Windows\System\yRlyxpA.exe
  2⤵
  PID:14432
- C:\Windows\System\lFQSYDZ.exe
  C:\Windows\System\lFQSYDZ.exe
  2⤵
  PID:14468
- C:\Windows\System\aGPSbms.exe
  C:\Windows\System\aGPSbms.exe
  2⤵
  PID:14488
- C:\Windows\System\InLkUie.exe
  C:\Windows\System\InLkUie.exe
  2⤵
  PID:14512
- C:\Windows\System\UnkrGWp.exe
  C:\Windows\System\UnkrGWp.exe
  2⤵
  PID:14536
- C:\Windows\System\jnQlIqg.exe
  C:\Windows\System\jnQlIqg.exe
  2⤵
  PID:14576
- C:\Windows\System\HJBCJfL.exe
  C:\Windows\System\HJBCJfL.exe
  2⤵
  PID:14788
- C:\Windows\System\wBzpfyk.exe
  C:\Windows\System\wBzpfyk.exe
  2⤵
  PID:14820
- C:\Windows\System\mTFQsiW.exe
  C:\Windows\System\mTFQsiW.exe
  2⤵
  PID:14844
- C:\Windows\System\aSFZlsJ.exe
  C:\Windows\System\aSFZlsJ.exe
  2⤵
  PID:14948
- C:\Windows\System\mlmhKKL.exe
  C:\Windows\System\mlmhKKL.exe
  2⤵
  PID:14968
- C:\Windows\System\BqPTJPP.exe
  C:\Windows\System\BqPTJPP.exe
  2⤵
  PID:14984
- C:\Windows\System\FfkhYRp.exe
  C:\Windows\System\FfkhYRp.exe
  2⤵
  PID:15000
- C:\Windows\System\vKTBDXt.exe
  C:\Windows\System\vKTBDXt.exe
  2⤵
  PID:15016
- C:\Windows\System\EayuXIr.exe
  C:\Windows\System\EayuXIr.exe
  2⤵
  PID:15032
- C:\Windows\System\dzcBoVT.exe
  C:\Windows\System\dzcBoVT.exe
  2⤵
  PID:15048
- C:\Windows\System\MrCYYdH.exe
  C:\Windows\System\MrCYYdH.exe
  2⤵
  PID:15064
- C:\Windows\System\ouQcvqd.exe
  C:\Windows\System\ouQcvqd.exe
  2⤵
  PID:15096
- C:\Windows\System\RxCznLe.exe
  C:\Windows\System\RxCznLe.exe
  2⤵
  PID:15116
- C:\Windows\System\dtuFBpz.exe
  C:\Windows\System\dtuFBpz.exe
  2⤵
  PID:15204
- C:\Windows\System\sIjOllV.exe
  C:\Windows\System\sIjOllV.exe
  2⤵
  PID:15220
- C:\Windows\System\rqvBSDB.exe
  C:\Windows\System\rqvBSDB.exe
  2⤵
  PID:15236
- C:\Windows\System\aOuSBrq.exe
  C:\Windows\System\aOuSBrq.exe
  2⤵
  PID:15256
- C:\Windows\System\tvldZax.exe
  C:\Windows\System\tvldZax.exe
  2⤵
  PID:15272
- C:\Windows\System\UWYvPsQ.exe
  C:\Windows\System\UWYvPsQ.exe
  2⤵
  PID:15344
- C:\Windows\System\dCBhUgz.exe
  C:\Windows\System\dCBhUgz.exe
  2⤵
  PID:14036
- C:\Windows\System\jtLVzLt.exe
  C:\Windows\System\jtLVzLt.exe
  2⤵
  PID:5668
- C:\Windows\System\TUCiQAH.exe
  C:\Windows\System\TUCiQAH.exe
  2⤵
  PID:2556
- C:\Windows\System\QRMtMKJ.exe
  C:\Windows\System\QRMtMKJ.exe
  2⤵
  PID:1960
- C:\Windows\System\qJneoET.exe
  C:\Windows\System\qJneoET.exe
  2⤵
  PID:14556
- C:\Windows\System\CsOBeuf.exe
  C:\Windows\System\CsOBeuf.exe
  2⤵
  PID:2912
- C:\Windows\System\wntDYWt.exe
  C:\Windows\System\wntDYWt.exe
  2⤵
  PID:4676
- C:\Windows\System\THdAtRD.exe
  C:\Windows\System\THdAtRD.exe
  2⤵
  PID:7200
- C:\Windows\System\lDMEIaF.exe
  C:\Windows\System\lDMEIaF.exe
  2⤵
  PID:13580
- C:\Windows\System\QecQdlW.exe
  C:\Windows\System\QecQdlW.exe
  2⤵
  PID:6984
- C:\Windows\System\JpKhAMD.exe
  C:\Windows\System\JpKhAMD.exe
  2⤵
  PID:14188
- C:\Windows\System\XoFdVzO.exe
  C:\Windows\System\XoFdVzO.exe
  2⤵
  PID:6220
- C:\Windows\System\wXFHRXE.exe
  C:\Windows\System\wXFHRXE.exe
  2⤵
  PID:6180
- C:\Windows\System\vjyRcyb.exe
  C:\Windows\System\vjyRcyb.exe
  2⤵
  PID:14380
- C:\Windows\System\zMcLaxW.exe
  C:\Windows\System\zMcLaxW.exe
  2⤵
  PID:6248
- C:\Windows\System\YsHVBpS.exe
  C:\Windows\System\YsHVBpS.exe
  2⤵
  PID:15152
- C:\Windows\System\mUADECA.exe
  C:\Windows\System\mUADECA.exe
  2⤵
  PID:14648
- C:\Windows\System\JAySJeD.exe
  C:\Windows\System\JAySJeD.exe
  2⤵
  PID:7336
- C:\Windows\System\CzLMsgm.exe
  C:\Windows\System\CzLMsgm.exe
  2⤵
  PID:15324
- C:\Windows\System\ACBzedI.exe
  C:\Windows\System\ACBzedI.exe
  2⤵
  PID:7408
- C:\Windows\System\cDThpiP.exe
  C:\Windows\System\cDThpiP.exe
  2⤵
  PID:7488
- C:\Windows\System\wQsyiEh.exe
  C:\Windows\System\wQsyiEh.exe
  2⤵
  PID:7012
- C:\Windows\System\GGdONnf.exe
  C:\Windows\System\GGdONnf.exe
  2⤵
  PID:14996
- C:\Windows\System\OaNPznY.exe
  C:\Windows\System\OaNPznY.exe
  2⤵
  PID:5888
- C:\Windows\System\WYTRgSg.exe
  C:\Windows\System\WYTRgSg.exe
  2⤵
  PID:15080
- C:\Windows\System\kKJrvUT.exe
  C:\Windows\System\kKJrvUT.exe
  2⤵
  PID:15108
- C:\Windows\System\yeUPSha.exe
  C:\Windows\System\yeUPSha.exe
  2⤵
  PID:6404
- C:\Windows\System\LIGcBWB.exe
  C:\Windows\System\LIGcBWB.exe
  2⤵
  PID:904
- C:\Windows\System\bZVrPgy.exe
  C:\Windows\System\bZVrPgy.exe
  2⤵
  PID:15172
- C:\Windows\System\iNsPctK.exe
  C:\Windows\System\iNsPctK.exe
  2⤵
  PID:15200
- C:\Windows\System\UVRBRmR.exe
  C:\Windows\System\UVRBRmR.exe
  2⤵
  PID:9508
- C:\Windows\System\trUJUNC.exe
  C:\Windows\System\trUJUNC.exe
  2⤵
  PID:1404
- C:\Windows\System\mbJCeMh.exe
  C:\Windows\System\mbJCeMh.exe
  2⤵
  PID:13792
- C:\Windows\System\tvyEfvm.exe
  C:\Windows\System\tvyEfvm.exe
  2⤵
  PID:3976
- C:\Windows\System\VIuNsZD.exe
  C:\Windows\System\VIuNsZD.exe
  2⤵
  PID:13468
- C:\Windows\System\qZOjaLR.exe
  C:\Windows\System\qZOjaLR.exe
  2⤵
  PID:5968
- C:\Windows\System\mZlKjHI.exe
  C:\Windows\System\mZlKjHI.exe
  2⤵
  PID:6240
- C:\Windows\System\ooFikdI.exe
  C:\Windows\System\ooFikdI.exe
  2⤵
  PID:5088
- C:\Windows\System\auIpECn.exe
  C:\Windows\System\auIpECn.exe
  2⤵
  PID:6376
- C:\Windows\System\jgsrTyF.exe
  C:\Windows\System\jgsrTyF.exe
  2⤵
  PID:14140
- C:\Windows\System\oMPpHUL.exe
  C:\Windows\System\oMPpHUL.exe
  2⤵
  PID:14340
- C:\Windows\System\cpHfoDV.exe
  C:\Windows\System\cpHfoDV.exe
  2⤵
  PID:8116
- C:\Windows\System\jHDnYgh.exe
  C:\Windows\System\jHDnYgh.exe
  2⤵
  PID:7236
- C:\Windows\System\fQvCcow.exe
  C:\Windows\System\fQvCcow.exe
  2⤵
  PID:7916
- C:\Windows\System\gKCXFbh.exe
  C:\Windows\System\gKCXFbh.exe
  2⤵
  PID:7976
- C:\Windows\System\srEvLpj.exe
  C:\Windows\System\srEvLpj.exe
  2⤵
  PID:14368
- C:\Windows\System\vzBABbP.exe
  C:\Windows\System\vzBABbP.exe
  2⤵
  PID:9000
- C:\Windows\System\OOBXbzQ.exe
  C:\Windows\System\OOBXbzQ.exe
  2⤵
  PID:6556
- C:\Windows\System\LRkWUbi.exe
  C:\Windows\System\LRkWUbi.exe
  2⤵
  PID:7776
- C:\Windows\System\OlsueoT.exe
  C:\Windows\System\OlsueoT.exe
  2⤵
  PID:14600
- C:\Windows\System\PRRmiVp.exe
  C:\Windows\System\PRRmiVp.exe
  2⤵
  PID:14904
- C:\Windows\System\lqnThJf.exe
  C:\Windows\System\lqnThJf.exe
  2⤵
  PID:8724
- C:\Windows\System\ntHMMfV.exe
  C:\Windows\System\ntHMMfV.exe
  2⤵
  PID:7740
- C:\Windows\System\SwjTtHR.exe
  C:\Windows\System\SwjTtHR.exe
  2⤵
  PID:7388
- C:\Windows\System\jXeQhiy.exe
  C:\Windows\System\jXeQhiy.exe
  2⤵
  PID:8352
- C:\Windows\System\KaokWjr.exe
  C:\Windows\System\KaokWjr.exe
  2⤵
  PID:7448
- C:\Windows\System\IWYRLMw.exe
  C:\Windows\System\IWYRLMw.exe
  2⤵
  PID:8292
- C:\Windows\System\llLIliR.exe
  C:\Windows\System\llLIliR.exe
  2⤵
  PID:14420
- C:\Windows\System\DFCGWSN.exe
  C:\Windows\System\DFCGWSN.exe
  2⤵
  PID:9600
- C:\Windows\System\EwrnCfa.exe
  C:\Windows\System\EwrnCfa.exe
  2⤵
  PID:14776
- C:\Windows\System\GgGNLgI.exe
  C:\Windows\System\GgGNLgI.exe
  2⤵
  PID:7660
- C:\Windows\System\yTeOzlZ.exe
  C:\Windows\System\yTeOzlZ.exe
  2⤵
  PID:4760
- C:\Windows\System\VmtjOHp.exe
  C:\Windows\System\VmtjOHp.exe
  2⤵
  PID:1200
- C:\Windows\System\qIJmOLW.exe
  C:\Windows\System\qIJmOLW.exe
  2⤵
  PID:6720
- C:\Windows\System\zQUFaau.exe
  C:\Windows\System\zQUFaau.exe
  2⤵
  PID:14364
- C:\Windows\System\YfFkQpS.exe
  C:\Windows\System\YfFkQpS.exe
  2⤵
  PID:14408
- C:\Windows\System\YbDTOHr.exe
  C:\Windows\System\YbDTOHr.exe
  2⤵
  PID:8476
- C:\Windows\System\krIDwWX.exe
  C:\Windows\System\krIDwWX.exe
  2⤵
  PID:9792
- C:\Windows\System\PkJLSeG.exe
  C:\Windows\System\PkJLSeG.exe
  2⤵
  PID:9680
- C:\Windows\System\VYHuKyC.exe
  C:\Windows\System\VYHuKyC.exe
  2⤵
  PID:2156
- C:\Windows\System\gHnQehH.exe
  C:\Windows\System\gHnQehH.exe
  2⤵
  PID:14608
- C:\Windows\System\RfAYohp.exe
  C:\Windows\System\RfAYohp.exe
  2⤵
  PID:7428
- C:\Windows\System\UFCQRSX.exe
  C:\Windows\System\UFCQRSX.exe
  2⤵
  PID:9436
- C:\Windows\System\lrgSzsN.exe
  C:\Windows\System\lrgSzsN.exe
  2⤵
  PID:14860
- C:\Windows\System\Lpdhthi.exe
  C:\Windows\System\Lpdhthi.exe
  2⤵
  PID:9564
- C:\Windows\System\fWlHQrY.exe
  C:\Windows\System\fWlHQrY.exe
  2⤵
  PID:9724
- C:\Windows\System\sgjRjrO.exe
  C:\Windows\System\sgjRjrO.exe
  2⤵
  PID:10028
- C:\Windows\System\HSdPeaz.exe
  C:\Windows\System\HSdPeaz.exe
  2⤵
  PID:15268
- C:\Windows\System\frWPmwU.exe
  C:\Windows\System\frWPmwU.exe
  2⤵
  PID:9772
- C:\Windows\System\LYOvPej.exe
  C:\Windows\System\LYOvPej.exe
  2⤵
  PID:9736
- C:\Windows\System\nVmUsgC.exe
  C:\Windows\System\nVmUsgC.exe
  2⤵
  PID:9620
- C:\Windows\System\TYbGVYq.exe
  C:\Windows\System\TYbGVYq.exe
  2⤵
  PID:7284
- C:\Windows\System\jxtlIwU.exe
  C:\Windows\System\jxtlIwU.exe
  2⤵
  PID:6908
- C:\Windows\System\SBWJzfa.exe
  C:\Windows\System\SBWJzfa.exe
  2⤵
  PID:5192
- C:\Windows\System\ShSXmvG.exe
  C:\Windows\System\ShSXmvG.exe
  2⤵
  PID:10208
- C:\Windows\System\GOqgrnl.exe
  C:\Windows\System\GOqgrnl.exe
  2⤵
  PID:14352
- C:\Windows\System\WQgcWxF.exe
  C:\Windows\System\WQgcWxF.exe
  2⤵
  PID:13988
- C:\Windows\System\LBEBvTo.exe
  C:\Windows\System\LBEBvTo.exe
  2⤵
  PID:14980
- C:\Windows\System\wFUfPRI.exe
  C:\Windows\System\wFUfPRI.exe
  2⤵
  PID:9844
- C:\Windows\System\GlBaBWZ.exe
  C:\Windows\System\GlBaBWZ.exe
  2⤵
  PID:14732
- C:\Windows\System\OTswXDS.exe
  C:\Windows\System\OTswXDS.exe
  2⤵
  PID:15232
- C:\Windows\System\HADTDtm.exe
  C:\Windows\System\HADTDtm.exe
  2⤵
  PID:3948
- C:\Windows\System\bkeesZb.exe
  C:\Windows\System\bkeesZb.exe
  2⤵
  PID:15280
- C:\Windows\System\HFQtJST.exe
  C:\Windows\System\HFQtJST.exe
  2⤵
  PID:4616
- C:\Windows\System\NcMcVlL.exe
  C:\Windows\System\NcMcVlL.exe
  2⤵
  PID:1944
- C:\Windows\System\gTvmEOa.exe
  C:\Windows\System\gTvmEOa.exe
  2⤵
  PID:5000
- C:\Windows\System\lRFkKBH.exe
  C:\Windows\System\lRFkKBH.exe
  2⤵
  PID:14800
- C:\Windows\System\OgGlRvz.exe
  C:\Windows\System\OgGlRvz.exe
  2⤵
  PID:15288
- C:\Windows\System\wxMQuUb.exe
  C:\Windows\System\wxMQuUb.exe
  2⤵
  PID:11228
- C:\Windows\System\wSVgjZL.exe
  C:\Windows\System\wSVgjZL.exe
  2⤵
  PID:6272
- C:\Windows\System\WbnYVpV.exe
  C:\Windows\System\WbnYVpV.exe
  2⤵
  PID:7256
- C:\Windows\System\ZuQzLsW.exe
  C:\Windows\System\ZuQzLsW.exe
  2⤵
  PID:9520
- C:\Windows\System\VpCLSOK.exe
  C:\Windows\System\VpCLSOK.exe
  2⤵
  PID:9900
- C:\Windows\System\xUTCLnN.exe
  C:\Windows\System\xUTCLnN.exe
  2⤵
  PID:7240
- C:\Windows\System\XCefhkv.exe
  C:\Windows\System\XCefhkv.exe
  2⤵
  PID:6264
- C:\Windows\System\oljeWVp.exe
  C:\Windows\System\oljeWVp.exe
  2⤵
  PID:9936
- C:\Windows\System\MMQrUrj.exe
  C:\Windows\System\MMQrUrj.exe
  2⤵
  PID:10080
- C:\Windows\System\fszZXlz.exe
  C:\Windows\System\fszZXlz.exe
  2⤵
  PID:8932
- C:\Windows\System\hElwRBy.exe
  C:\Windows\System\hElwRBy.exe
  2⤵
  PID:7856
- C:\Windows\System\AGQwepd.exe
  C:\Windows\System\AGQwepd.exe
  2⤵
  PID:13372
- C:\Windows\System\wDIkisj.exe
  C:\Windows\System\wDIkisj.exe
  2⤵
  PID:7556
- C:\Windows\System\zEuZsnk.exe
  C:\Windows\System\zEuZsnk.exe
  2⤵
  PID:9920
- C:\Windows\System\efgfDxv.exe
  C:\Windows\System\efgfDxv.exe
  2⤵
  PID:6508
- C:\Windows\System\VlytYjt.exe
  C:\Windows\System\VlytYjt.exe
  2⤵
  PID:8180
- C:\Windows\System\sLgVWpx.exe
  C:\Windows\System\sLgVWpx.exe
  2⤵
  PID:8976
- C:\Windows\System\nVdsloY.exe
  C:\Windows\System\nVdsloY.exe
  2⤵
  PID:14552
- C:\Windows\System\YiBEloE.exe
  C:\Windows\System\YiBEloE.exe
  2⤵
  PID:10592
- C:\Windows\System\WEUyhME.exe
  C:\Windows\System\WEUyhME.exe
  2⤵
  PID:10636
- C:\Windows\System\GQEzrow.exe
  C:\Windows\System\GQEzrow.exe
  2⤵
  PID:10000
- C:\Windows\System\HtDNvbg.exe
  C:\Windows\System\HtDNvbg.exe
  2⤵
  PID:9800
- C:\Windows\System\eGjqrwm.exe
  C:\Windows\System\eGjqrwm.exe
  2⤵
  PID:3400
- C:\Windows\System\ynXNqkI.exe
  C:\Windows\System\ynXNqkI.exe
  2⤵
  PID:10588
- C:\Windows\System\xsBTeId.exe
  C:\Windows\System\xsBTeId.exe
  2⤵
  PID:14804
- C:\Windows\System\YTgjsHz.exe
  C:\Windows\System\YTgjsHz.exe
  2⤵
  PID:9560
- C:\Windows\System\rsdzhzn.exe
  C:\Windows\System\rsdzhzn.exe
  2⤵
  PID:8908
- C:\Windows\System\PTGTqfr.exe
  C:\Windows\System\PTGTqfr.exe
  2⤵
  PID:8200
- C:\Windows\System\wmCFUUS.exe
  C:\Windows\System\wmCFUUS.exe
  2⤵
  PID:9356
- C:\Windows\System\vvyzZza.exe
  C:\Windows\System\vvyzZza.exe
  2⤵
  PID:10540
- C:\Windows\System\kArLyVc.exe
  C:\Windows\System\kArLyVc.exe
  2⤵
  PID:14448
- C:\Windows\System\jtysUOe.exe
  C:\Windows\System\jtysUOe.exe
  2⤵
  PID:9912
- C:\Windows\System\okxAUyB.exe
  C:\Windows\System\okxAUyB.exe
  2⤵
  PID:13472
- C:\Windows\System\wexrfxw.exe
  C:\Windows\System\wexrfxw.exe
  2⤵
  PID:10376
- C:\Windows\System\ipGrQXD.exe
  C:\Windows\System\ipGrQXD.exe
  2⤵
  PID:10856
- C:\Windows\System\cXcbtUY.exe
  C:\Windows\System\cXcbtUY.exe
  2⤵
  PID:8156
- C:\Windows\System\aoAXMIb.exe
  C:\Windows\System\aoAXMIb.exe
  2⤵
  PID:9976
- C:\Windows\System\HfNFeje.exe
  C:\Windows\System\HfNFeje.exe
  2⤵
  PID:7960
- C:\Windows\System\zXudMjh.exe
  C:\Windows\System\zXudMjh.exe
  2⤵
  PID:10580
- C:\Windows\System\BaHyNfB.exe
  C:\Windows\System\BaHyNfB.exe
  2⤵
  PID:10448
- C:\Windows\System\VggpLPM.exe
  C:\Windows\System\VggpLPM.exe
  2⤵
  PID:10384
- C:\Windows\System\NUADvUH.exe
  C:\Windows\System\NUADvUH.exe
  2⤵
  PID:14872
- C:\Windows\System\bmLdKWC.exe
  C:\Windows\System\bmLdKWC.exe
  2⤵
  PID:10036
- C:\Windows\System\OQNZGTn.exe
  C:\Windows\System\OQNZGTn.exe
  2⤵
  PID:15132
- C:\Windows\System\VNbeCIa.exe
  C:\Windows\System\VNbeCIa.exe
  2⤵
  PID:1524
- C:\Windows\System\jENmnYD.exe
  C:\Windows\System\jENmnYD.exe
  2⤵
  PID:10788
- C:\Windows\System\PlmILIe.exe
  C:\Windows\System\PlmILIe.exe
  2⤵
  PID:15012
- C:\Windows\System\rROFNFv.exe
  C:\Windows\System\rROFNFv.exe
  2⤵
  PID:9892
- C:\Windows\System\HfRidla.exe
  C:\Windows\System\HfRidla.exe
  2⤵
  PID:13556
- C:\Windows\System\lEaSdgV.exe
  C:\Windows\System\lEaSdgV.exe
  2⤵
  PID:8600
- C:\Windows\System\JNoBaba.exe
  C:\Windows\System\JNoBaba.exe
  2⤵
  PID:3956
- C:\Windows\System\nrqfeXn.exe
  C:\Windows\System\nrqfeXn.exe
  2⤵
  PID:11064
- C:\Windows\System\QXCpAPn.exe
  C:\Windows\System\QXCpAPn.exe
  2⤵
  PID:2528
- C:\Windows\System\MEDYqgP.exe
  C:\Windows\System\MEDYqgP.exe
  2⤵
  PID:7260
- C:\Windows\System\mWXRYZM.exe
  C:\Windows\System\mWXRYZM.exe
  2⤵
  PID:11112
- C:\Windows\System\qONQiPZ.exe
  C:\Windows\System\qONQiPZ.exe
  2⤵
  PID:8780
- C:\Windows\System\zUOVaEp.exe
  C:\Windows\System\zUOVaEp.exe
  2⤵
  PID:10056
- C:\Windows\System\upLRlId.exe
  C:\Windows\System\upLRlId.exe
  2⤵
  PID:10984
- C:\Windows\System\KYKfAuR.exe
  C:\Windows\System\KYKfAuR.exe
  2⤵
  PID:10032
- C:\Windows\System\vdZXhVC.exe
  C:\Windows\System\vdZXhVC.exe
  2⤵
  PID:7900
- C:\Windows\System\kBDdIgS.exe
  C:\Windows\System\kBDdIgS.exe
  2⤵
  PID:11000
- C:\Windows\System\LLnwOdd.exe
  C:\Windows\System\LLnwOdd.exe
  2⤵
  PID:9592
- C:\Windows\System\IkLGFjl.exe
  C:\Windows\System\IkLGFjl.exe
  2⤵
  PID:11020
- C:\Windows\System\yymAjOu.exe
  C:\Windows\System\yymAjOu.exe
  2⤵
  PID:1288
- C:\Windows\System\ruCzxtC.exe
  C:\Windows\System\ruCzxtC.exe
  2⤵
  PID:9896
- C:\Windows\System\ZpTnEyD.exe
  C:\Windows\System\ZpTnEyD.exe
  2⤵
  PID:10156
- C:\Windows\System\cLnFPuO.exe
  C:\Windows\System\cLnFPuO.exe
  2⤵
  PID:15292
- C:\Windows\System\DTLBpEs.exe
  C:\Windows\System\DTLBpEs.exe
  2⤵
  PID:14716
- C:\Windows\System\CNycNhy.exe
  C:\Windows\System\CNycNhy.exe
  2⤵
  PID:9076
- C:\Windows\System\PrsJlmc.exe
  C:\Windows\System\PrsJlmc.exe
  2⤵
  PID:10624
- C:\Windows\System\OMKudCu.exe
  C:\Windows\System\OMKudCu.exe
  2⤵
  PID:9048
- C:\Windows\System\HKVEEkG.exe
  C:\Windows\System\HKVEEkG.exe
  2⤵
  PID:10428
- C:\Windows\System\kJCkGIN.exe
  C:\Windows\System\kJCkGIN.exe
  2⤵
  PID:3164
- C:\Windows\System\IOByuZi.exe
  C:\Windows\System\IOByuZi.exe
  2⤵
  PID:8316
- C:\Windows\System\ZTjwmZx.exe
  C:\Windows\System\ZTjwmZx.exe
  2⤵
  PID:14640
- C:\Windows\System\jgoYvHe.exe
  C:\Windows\System\jgoYvHe.exe
  2⤵
  PID:10100
- C:\Windows\System\bRnaUCR.exe
  C:\Windows\System\bRnaUCR.exe
  2⤵
  PID:9748
- C:\Windows\System\pukIDQQ.exe
  C:\Windows\System\pukIDQQ.exe
  2⤵
  PID:8376
- C:\Windows\System\oWmEITD.exe
  C:\Windows\System\oWmEITD.exe
  2⤵
  PID:9832
- C:\Windows\System\WbLWKmg.exe
  C:\Windows\System\WbLWKmg.exe
  2⤵
  PID:14248
- C:\Windows\System\IxkQpXr.exe
  C:\Windows\System\IxkQpXr.exe
  2⤵
  PID:10776
- C:\Windows\System\LODUYfi.exe
  C:\Windows\System\LODUYfi.exe
  2⤵
  PID:15376
- C:\Windows\System\qEmemcV.exe
  C:\Windows\System\qEmemcV.exe
  2⤵
  PID:15404
- C:\Windows\System\BjGhTvu.exe
  C:\Windows\System\BjGhTvu.exe
  2⤵
  PID:15424
- C:\Windows\System\YOZeIWn.exe
  C:\Windows\System\YOZeIWn.exe
  2⤵
  PID:15440
- C:\Windows\System\UjcijCB.exe
  C:\Windows\System\UjcijCB.exe
  2⤵
  PID:15464
- C:\Windows\System\gPOiVZn.exe
  C:\Windows\System\gPOiVZn.exe
  2⤵
  PID:15488
- C:\Windows\System\OPXEUBU.exe
  C:\Windows\System\OPXEUBU.exe
  2⤵
  PID:15508
- C:\Windows\System\cPyBITr.exe
  C:\Windows\System\cPyBITr.exe
  2⤵
  PID:15528
- C:\Windows\System\STvSGKW.exe
  C:\Windows\System\STvSGKW.exe
  2⤵
  PID:15544
- C:\Windows\System\OgPrIqD.exe
  C:\Windows\System\OgPrIqD.exe
  2⤵
  PID:15560
- C:\Windows\System\EeEfCHc.exe
  C:\Windows\System\EeEfCHc.exe
  2⤵
  PID:15580
- C:\Windows\System\wLzeqFX.exe
  C:\Windows\System\wLzeqFX.exe
  2⤵
  PID:15604
- C:\Windows\System\gAVByNM.exe
  C:\Windows\System\gAVByNM.exe
  2⤵
  PID:15632
- C:\Windows\System\JsLxwWh.exe
  C:\Windows\System\JsLxwWh.exe
  2⤵
  PID:15652
- C:\Windows\System\sgbDAjH.exe
  C:\Windows\System\sgbDAjH.exe
  2⤵
  PID:15672
- C:\Windows\System\LQAZoAt.exe
  C:\Windows\System\LQAZoAt.exe
  2⤵
  PID:15692
- C:\Windows\System\xygqvwC.exe
  C:\Windows\System\xygqvwC.exe
  2⤵
  PID:15720
- C:\Windows\System\HUWxJIB.exe
  C:\Windows\System\HUWxJIB.exe
  2⤵
  PID:15740
- C:\Windows\System\MSGZSkJ.exe
  C:\Windows\System\MSGZSkJ.exe
  2⤵
  PID:15764
- C:\Windows\System\uDoVDbn.exe
  C:\Windows\System\uDoVDbn.exe
  2⤵
  PID:15784
- C:\Windows\System\tWSqpfD.exe
  C:\Windows\System\tWSqpfD.exe
  2⤵
  PID:15800
- C:\Windows\System\ukuKtdO.exe
  C:\Windows\System\ukuKtdO.exe
  2⤵
  PID:15816
- C:\Windows\System\iyhBkhP.exe
  C:\Windows\System\iyhBkhP.exe
  2⤵
  PID:15832
- C:\Windows\System\YmwXUnG.exe
  C:\Windows\System\YmwXUnG.exe
  2⤵
  PID:15848
- C:\Windows\System\GxCuLfP.exe
  C:\Windows\System\GxCuLfP.exe
  2⤵
  PID:15864
- C:\Windows\System\wnrxUgb.exe
  C:\Windows\System\wnrxUgb.exe
  2⤵
  PID:15884
- C:\Windows\System\Ojlskax.exe
  C:\Windows\System\Ojlskax.exe
  2⤵
  PID:15904
- C:\Windows\System\hDwjuay.exe
  C:\Windows\System\hDwjuay.exe
  2⤵
  PID:15928
- C:\Windows\System\SzShwcW.exe
  C:\Windows\System\SzShwcW.exe
  2⤵
  PID:15948
- C:\Windows\System\wFSyzqi.exe
  C:\Windows\System\wFSyzqi.exe
  2⤵
  PID:15968
- C:\Windows\System\eMtiSSA.exe
  C:\Windows\System\eMtiSSA.exe
  2⤵
  PID:15984
- C:\Windows\System\bEhvVvG.exe
  C:\Windows\System\bEhvVvG.exe
  2⤵
  PID:16004
- C:\Windows\System\mSBhuVW.exe
  C:\Windows\System\mSBhuVW.exe
  2⤵
  PID:16024
- C:\Windows\System\rGkBnbH.exe
  C:\Windows\System\rGkBnbH.exe
  2⤵
  PID:16048
- C:\Windows\System\IUTvDZt.exe
  C:\Windows\System\IUTvDZt.exe
  2⤵
  PID:16064
- C:\Windows\System\dpfttBL.exe
  C:\Windows\System\dpfttBL.exe
  2⤵
  PID:16088
- C:\Windows\System\tWUjvrm.exe
  C:\Windows\System\tWUjvrm.exe
  2⤵
  PID:16108
- C:\Windows\System\IaDFeXi.exe
  C:\Windows\System\IaDFeXi.exe
  2⤵
  PID:16132
- C:\Windows\System\sxslQwt.exe
  C:\Windows\System\sxslQwt.exe
  2⤵
  PID:16152
- C:\Windows\System\QgVcoOf.exe
  C:\Windows\System\QgVcoOf.exe
  2⤵
  PID:16172
- C:\Windows\System\zUOGjfY.exe
  C:\Windows\System\zUOGjfY.exe
  2⤵
  PID:16188
- C:\Windows\System\OmSrlXc.exe
  C:\Windows\System\OmSrlXc.exe
  2⤵
  PID:16208
- C:\Windows\System\oQnfOZQ.exe
  C:\Windows\System\oQnfOZQ.exe
  2⤵
  PID:16232
- C:\Windows\System\OLlmwrW.exe
  C:\Windows\System\OLlmwrW.exe
  2⤵
  PID:16256
- C:\Windows\System\meAyOKL.exe
  C:\Windows\System\meAyOKL.exe
  2⤵
  PID:16280
- C:\Windows\System\DShMyXi.exe
  C:\Windows\System\DShMyXi.exe
  2⤵
  PID:16296
- C:\Windows\System\AfgFusJ.exe
  C:\Windows\System\AfgFusJ.exe
  2⤵
  PID:16316
- C:\Windows\System\XKayqHA.exe
  C:\Windows\System\XKayqHA.exe
  2⤵
  PID:16348
- C:\Windows\System\sqsJqDz.exe
  C:\Windows\System\sqsJqDz.exe
  2⤵
  PID:16364
- C:\Windows\System\gBvAcbs.exe
  C:\Windows\System\gBvAcbs.exe
  2⤵
  PID:7536
- C:\Windows\System\oUsIcfk.exe
  C:\Windows\System\oUsIcfk.exe
  2⤵
  PID:10308
- C:\Windows\System\JWyrnbX.exe
  C:\Windows\System\JWyrnbX.exe
  2⤵
  PID:11140
- C:\Windows\System\dGuxZqS.exe
  C:\Windows\System\dGuxZqS.exe
  2⤵
  PID:8512
- C:\Windows\System\FhrxYpI.exe
  C:\Windows\System\FhrxYpI.exe
  2⤵
  PID:10560
- C:\Windows\System\vOfEfOs.exe
  C:\Windows\System\vOfEfOs.exe
  2⤵
  PID:10960
- C:\Windows\System\FlBxuLy.exe
  C:\Windows\System\FlBxuLy.exe
  2⤵
  PID:16224
- C:\Windows\System\npXmNQL.exe
  C:\Windows\System\npXmNQL.exe
  2⤵
  PID:9236
- C:\Windows\System\bgMreus.exe
  C:\Windows\System\bgMreus.exe
  2⤵
  PID:1168
- C:\Windows\System\nihyefq.exe
  C:\Windows\System\nihyefq.exe
  2⤵
  PID:16020
- C:\Windows\System\QgpPWeb.exe
  C:\Windows\System\QgpPWeb.exe
  2⤵
  PID:12336
- C:\Windows\System\mgzUAPG.exe
  C:\Windows\System\mgzUAPG.exe
  2⤵
  PID:8988
- C:\Windows\System\DHZGzcP.exe
  C:\Windows\System\DHZGzcP.exe
  2⤵
  PID:13064
- C:\Windows\System\mHoDAUX.exe
  C:\Windows\System\mHoDAUX.exe
  2⤵
  PID:16288
- C:\Windows\System\MuMESmy.exe
  C:\Windows\System\MuMESmy.exe
  2⤵
  PID:13096
- C:\Windows\System\mkEnomd.exe
  C:\Windows\System\mkEnomd.exe
  2⤵
  PID:13200
- C:\Windows\System\jUTIvzP.exe
  C:\Windows\System\jUTIvzP.exe
  2⤵
  PID:12172
- C:\Windows\System\ZqNpjUA.exe
  C:\Windows\System\ZqNpjUA.exe
  2⤵
  PID:11220
- C:\Windows\System\vuGvqMj.exe
  C:\Windows\System\vuGvqMj.exe
  2⤵
  PID:11608
- C:\Windows\System\pxZoJqB.exe
  C:\Windows\System\pxZoJqB.exe
  2⤵
  PID:10668
- C:\Windows\System\mvaEhAn.exe
  C:\Windows\System\mvaEhAn.exe
  2⤵
  PID:15524
- C:\Windows\System\HJReNGh.exe
  C:\Windows\System\HJReNGh.exe
  2⤵
  PID:15592
- C:\Windows\System\uljcBkR.exe
  C:\Windows\System\uljcBkR.exe
  2⤵
  PID:10720
- C:\Windows\System\eBWkwAm.exe
  C:\Windows\System\eBWkwAm.exe
  2⤵
  PID:15748
- C:\Windows\System\wbgvjcN.exe
  C:\Windows\System\wbgvjcN.exe
  2⤵
  PID:15792
- C:\Windows\System\shGJxwo.exe
  C:\Windows\System\shGJxwo.exe
  2⤵
  PID:15840
- C:\Windows\System\SmbxsOa.exe
  C:\Windows\System\SmbxsOa.exe
  2⤵
  PID:15944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=41575285964992 --process=260 /prefetch:7 --thread=3996
1⤵
PID:12980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_z54yn0xq.h5d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z54yn0xq.h5d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

COpXOTn.exe

Path C:\Windows\System\COpXOTn.exe
Size 1.8MB
SHA256 2b6f856563f7fdc4f4b5fa37ce2869ecf05345b2645abb652454b3dcc370feae
MD5 312b86bbf8f579d1cb8c10d4e08b2dd5
SHA1 74e5a8e7197c764337d474e8b73ab25011dca617
SHA512 b8f0bb74bb9d4f6a720fc7f93111857d11617dfa5e03e467b43118bbae7e98c46cfa31ad15cb3fbe6f7a28496c6e380785ec7a1741aa5e9b318edc52bb7e7a35
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOk2:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

EvyozVW.exe

Path C:\Windows\System\EvyozVW.exe
Size 1.8MB
SHA256 904eaf1d693a4bd4619f76063e036df529655be53b0f3c1df548c3988ba3554f
MD5 ae38393aee55b9fe99cd3be74ebb3f48
SHA1 96d90dc59fcec527f2c5ce4f101d86e54f1a2608
SHA512 c9b04a99a114f81f4df8548a7a7a061d52e7ec9958a6c84de91d82235de47bfffeebdaf617d142940854f2b00c3f7b05e3b437b6bd7741136deb4520ef2abc81
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOk+:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSWNPoP.exe

Path C:\Windows\System\FSWNPoP.exe
Size 1.8MB
SHA256 7c59b63bfb387e7cbc1d218fd88012138cab5f90be8dd9625e59bd46e8bd8c8e
MD5 a4655f7a5efa32b54ca0fa55339303b0
SHA1 4764abe63c411fcccf8e8f59e11ba09bb8a296fb
SHA512 04cdcc7eb55f724537657328a22a6d02b28f0df170a9626b35f82de635347bc795397c24182423b807d96b04fc0827121221c49a743fa6cebb754dce3f9b9a9e
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkf:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

IfgAnCU.exe

Path C:\Windows\System\IfgAnCU.exe
Size 1.8MB
SHA256 d8a39a2ce3382858260763d4d7fb2ddf8d72c626c943c59af20536a95cace8ff
MD5 b915335fc1727a1a87fb2527631caf21
SHA1 a9ceec7e83588033332eba2695bb1f8cee2938a7
SHA512 8385b945199fc85a87db705354cc7fc3a2445ab64f1d31370c99805740ddd81a2aac2ee716aa357115c9c8cbe2fb1f8188ee25e42722bd143f78736528bc694d
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOky:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

LRRjHEm.exe

Path C:\Windows\System\LRRjHEm.exe
Size 1.8MB
SHA256 765ead5f02c4bf20707653fa65c451da67bce6aade08e0ec449d1d5711b0869e
MD5 6dada51364a2b489e79f1310a56bbd0b
SHA1 c40d3a73b1f654dd3cc9972e89876f0cb439257f
SHA512 ac1131fbdfba241d93ac8931a4d7e19be2a4c0a9fcfad9f18df2c98d5b6bb346515f38661be0b63eaee3fa59acf64111bae268b8df01008fef236ce4ae3c1b15
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkP:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

NBfbAxD.exe

Path C:\Windows\System\NBfbAxD.exe
Size 1.8MB
SHA256 abb6f58c74e3dcdb9f361bce31e2dbd9174f31d7043cced6ce8d776796be3c48
MD5 01d2acaf4f39589ac4104066d5cc21f9
SHA1 74bd8d0e5ef3500a1fce26c40046b4bc94547f38
SHA512 f5f608838455d9d4f0e0c58c3e9e222dac96a69cd979d91c6b46cb1f8098f4168000c853e8052d5b01f03dc1a4f9722f4d311c433f70de284abd8eb241816a83
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkV:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

OUKnCie.exe

Path C:\Windows\System\OUKnCie.exe
Size 1.8MB
SHA256 6ed2c0b0a2f25e756f701c9d7160d15cb83c92698e8fbb09168e8260e09e2ed6
MD5 ca46535793907afc53deb9d64f3acc85
SHA1 9639aa7d07e761f594503d0c80af49e50fca8ec2
SHA512 51bacd0f4aec0d2a74b2521454c59e7af5a5f99a10a68ba41a751c453bdb197233e502a7ad6fff783806348a29c82b1e962526f85179ae2b7fc55aac7d364396
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkh:NABM
MD5 SHA1 SHA512 SSDEEP

Submit Download

RRNULKp.exe

Path C:\Windows\System\RRNULKp.exe
Size 1.8MB
SHA256 535c7b5dd7ccb7fb91247a9c5cdce2085ff8aaafebd64ab5a19a18215dbbf871
MD5 0580f1f17c8968aec9af6cdeeb8e2502
SHA1 c709bc6cb89a68a2eee7e993f74638941219ce8f
SHA512 90dd98b39868a63def00c333145780c423bdbd2cb9260ca63f5cfc83b9dfc368a7d69a88d36f2cabaa9414c7849de1f8586b15f783a036f8dba24bd5f43b3070
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOki:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

RTUvLHq.exe

Path C:\Windows\System\RTUvLHq.exe
Size 1.8MB
SHA256 34dc45d8a9d330a8ab71a94b4ce8b7af2355a9f406f92bd07ca02900a6acdb73
MD5 d8c2f295c9b1bf37f7197e01a46ba4e9
SHA1 d178468aee22df24f6eb220597d544847ebacbbb
SHA512 ba1ab2c3cc30b9644b8f7d611adf47f9b6c70659278ee5ae27b15057761657b89d65ba18f78639635ed72e80fa9e4f6d4cb9a2f735a7ec4d36dae977db7f2953
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOki:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

RubyupT.exe

Path C:\Windows\System\RubyupT.exe
Size 1.8MB
SHA256 605bd280228333e107c72f525c5c06c5ddbb05515426b57e02b225d3d8c3dcb9
MD5 71ca86785c4be9683cdd67598cdb6100
SHA1 55f8ed2b54dc529ddedb841d40fcb1cb067b3ca9
SHA512 17c142ffe2b92fc9b8ef453e00de464254d9ca3b5e654037c5a94a946f03ddac2f3d75133ce9394227ab295eee86b5221141b3c60de6ec4ea95b23e792243971
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOku:NAB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

RxNgZMg.exe

Path C:\Windows\System\RxNgZMg.exe
Size 1.8MB
SHA256 cb4be4e604a255f12c88db8475fe02e32955819b521d8572ccfa50209f9cfc53
MD5 6c8bfe5334d0348db602c0055d1a892e
SHA1 aa3f1de164fc4e262283d0ddc38aa22eb5669629
SHA512 75d8884d0991d8d5442bfc7fd32d0d50dd8c1104d6848a5ad53a8141c997146e94d2d785ecff0e2e5bbda5b3b650804eff586d20eb69cd74edceb75917878ced
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkM:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

UIWjfvv.exe

Path C:\Windows\System\UIWjfvv.exe
Size 1.8MB
SHA256 97cbd3c90e490fcad7202b7c67954f9dca48719a3882878509f2cdb2917040ee
MD5 aa2a203875a74481204d1c2306a44d31
SHA1 b891fa6b4fa1fdb0d97e3de16105b5415790bf4f
SHA512 f60fe335746c6aa6eb44c7a323f99cb9aeb1e47e5a304af5afb95d4538e6bfec78de3ec314d7106f6119c0ef2cd3db60ccf3aba8a13892f51462b59b99d57bc8
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkg:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

VXrKlpb.exe

Path C:\Windows\System\VXrKlpb.exe
Size 1.8MB
SHA256 5a5ba83635d5e9d43fae63dee5eccc8cc821a139ca0b46c826eebac1b86d6a4e
MD5 e42aff4e99b243ccfffdc81eaeb938bf
SHA1 65362268bc13f9d5aec043225036afc2bf64fc8d
SHA512 2ee7b1a2941b86a0f3b2eb06af0b590d795811a174a9574048f186a2fab98641b1b7b9291497fff57e35b53b7de8d768f4f21ac6f1b92385b669d39ca68ffa4e
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOk4:NABl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VrlQLiu.exe

Path C:\Windows\System\VrlQLiu.exe
Size 1.8MB
SHA256 d7cadba2ad3b646a151ea7987cbf7a6cae42dd5961325927691c071c3662c609
MD5 964faa24069991de9e25c56c8d0ae59e
SHA1 1e8b435c748099610d6e573cadcb1a5017128212
SHA512 5b4adc6a228729e437fd68f431ec3f3efc3f733247b5a20f0ccf287f9e02f5245da71bd2e3149e6b1dd73b199ec07e23bf26fad31f6b487079d0df19c1f5a534
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkY:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

YtNsTEO.exe

Path C:\Windows\System\YtNsTEO.exe
Size 1.8MB
SHA256 0ffcd975cf39ad4dd1a4ab7ea72a6cefc100ad7f672226043764233cd878d54a
MD5 8338118d745bd5eb5021fb4bfd3ab690
SHA1 0d10a1153d4101749664daba090fec8cc1cdbdd6
SHA512 7a9c529f5ca0cd5ffc5ca8cb3cc37d8b98d88041b9b1394270562dacfcd2ef4fdd10851571fcb1d621be317d0df7fec9a193105755f4c7ff710c97a60937b850
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkv:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

YyINtuX.exe

Path C:\Windows\System\YyINtuX.exe
Size 1.8MB
SHA256 17811abee9e37b498f99221dc04303dfd1f5ae2f98b7cc50f6749cdff00d62d5
MD5 0080ba01c467b119a52a639bbb2dceae
SHA1 d358152f5c5bd0de8b77063ec905f088501437c0
SHA512 47d2093a22e98d811bf85e8b04dd2e194c2eb558b52b4c5cdd3f5840ba5ff78abd84fadd97254bcf2237977354bf253182c3988f13c63df4622fd80bd1168621
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkq:NAB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZhVqQjN.exe

Path C:\Windows\System\ZhVqQjN.exe
Size 1.8MB
SHA256 e445e35aa6be6f5b1a8aee5a92521ce2f66b86ef4eb1d9d6bb379f68494ac43f
MD5 8210031dcd5f1cca215a8bcb0309ca26
SHA1 978bf8d558312d349123e05bc81646531ae6a0bb
SHA512 cb13600678306553b0623c330053cd44d746f24639ab695375460ed0aae38b6471121952e52a4bb90425d8e03715abc7d5ffbe79f450c21ac2b96ea4cda29224
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkt:NABU
MD5 SHA1 SHA512 SSDEEP

Submit Download

aTEpnfU.exe

Path C:\Windows\System\aTEpnfU.exe
Size 1.8MB
SHA256 bb5a75d47fa722f25a2ead44ea624eb6de291d445047558db31bd73fb8a0b47d
MD5 015c680ffd0b87ea86fb011c4917298b
SHA1 853bc2eede5ebbce3fd6403b5d3d9d417c6c941b
SHA512 9c61efdbea4d9a6fd9982d9909c0fd26b50c157e84a82909cb202e568957416cdccdaad5dbdf77975202b0210fdd702b66b8afa90c64259c3b5cee4e27640854
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOk/:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

bjYreQD.exe

Path C:\Windows\System\bjYreQD.exe
Size 1.8MB
SHA256 6ac43f197ba75cf4307876b80537b88d58a36b95d589ba4677acd511c269b960
MD5 13dbbbfff0e0800afc6a0d63fa0156dd
SHA1 e471b0ed025c39a107729b22ccba027b8a99132d
SHA512 a0a78fcb609f52d8e4edf336785bf14e748ea7e2d53fe857b2ddceaa4fb508383d5e874739769684dd3acc2b0f3a1b94f690c81a97a83174c20c7978829066fc
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOke:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

duHSyQv.exe

Path C:\Windows\System\duHSyQv.exe
Size 1.8MB
SHA256 d02b2f075dce70d78c0940dda78f2ad4f9925cc286ad8aac3e4695caf61e3ebd
MD5 07caa75cf5c633f914510fb57375a41b
SHA1 b65197e4bba5e0146de3d0337db0443d9fa4bbe8
SHA512 ecf924b12bf26252ea9845814f3d5a1b54cd62c29abd7a3d6033d22f89423f28095b3c43cd9cf704abeb1e6a515e3b013ae28924788f57a958e83c08f5b55537
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkr:NAB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

eCtFStl.exe

Path C:\Windows\System\eCtFStl.exe
Size 1.8MB
SHA256 68b233e12fae29df325f46b26ffb21d860d80dac46f09450975a057194823f6c
MD5 b1cc35e037be571b492b5099bee45fd9
SHA1 49b29716521b73ce4e2b9a77f13d97270152f438
SHA512 be37f5e80b7cded93a5f80e7c720206e4541906d791f7f9bbc5935690ac23e4e311967d571b1ba32aff74d3f6ac0b56804d5484055c6a560038c9526abf42d32
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkI:NABj
MD5 SHA1 SHA512 SSDEEP

Submit Download

fXhOqRU.exe

Path C:\Windows\System\fXhOqRU.exe
Size 1.8MB
SHA256 e3c1464d7fa5fd7830650083583ffe611df89a94bf9a90ccb008b30fa81a8dc4
MD5 d64bc23b1c560f4c08841b63b9d535cb
SHA1 93273a108b60b4eaf41736bf11cfd88e9d605a8e
SHA512 107d73704f9ec5ae602c8295e059e6866d74bc761bc438b9b21d6f4fced1922d254ef203b9640e6eddd2d7c897a096994a8d2e8773ad3cf3682652d168cb20f5
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkE:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

fqHqcSK.exe

Path C:\Windows\System\fqHqcSK.exe
Size 1.8MB
SHA256 6fe24def76763fbcd9036fd0c460c416d36a0d582e95357c18260671a3c7bdd5
MD5 37e70fec3497246482b107d525f917b8
SHA1 e8468151dc556d95884dde9793c471bed13bb60f
SHA512 9d449442fdc9d91ee80610e04c5358dca08c7f6422c49f1b6b4219afa2a62ecc3df0ea5fb3fbc836d955415f9883ded4a095434905b3edddd7547062c4773153
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkC:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

goeCXfI.exe

Path C:\Windows\System\goeCXfI.exe
Size 1.8MB
SHA256 d067b2fd4e74886cdd6e31e0344d52b406c86878140b8e29533a6a0a3e92f5d1
MD5 652ed42a589165ca7681d55ecc8066ec
SHA1 4a4b1ae1125afdb7d1dc4497243d38c13f8ea737
SHA512 359afbc11f79ea2ab63cc39c01697dcfeaf03012ddfaf4d0eacaaabb880628a964e38a783c3b3c6567a7a5ecdf5c75c4fe2f0bb217ed0d42e1ae75d173abd633
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkc:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

iemaxpf.exe

Path C:\Windows\System\iemaxpf.exe
Size 1.8MB
SHA256 ac294b6fdc968e203c4c72e02167e8766667e1c512347eb4d9cf06299b8dc58c
MD5 e8c97130a5f66d5f8f55d95917b47f46
SHA1 388890359f65829660e4430eadd58ff4ce2266ad
SHA512 4c796ace9a599730fb7385dc660b0a4023c91cfa2b6556354f43a53280a1e3a49c8dca0b039ce3122f8ff066bca24e45a18f9f894cecbcc2b585d0af3d4ef944
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkH:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

jypihZc.exe

Path C:\Windows\System\jypihZc.exe
Size 1.8MB
SHA256 52c9d39a9c95bd34711a9c5e3a640469d9716d74cdedfe3ae3b3adb0d4d6db59
MD5 13e70b1b459a39acc78f0794d0712fa3
SHA1 e66160076f51e6c696c9ec305709a8e69eec8504
SHA512 fdb53b9b4a80dc9936993deb4406cf9b3ed2196d5996038e4ddd7b7a5a74ce280497f607f394d502d11936173eec1ca285b931c17aae21ac43109707d4f046aa
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkp:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

kloXHcz.exe

Path C:\Windows\System\kloXHcz.exe
Size 1.8MB
SHA256 2e0749a245fe9e43a36bd147d358dde763d45e0bff95f2bd8315bea233e878b2
MD5 cadf090cc16837eacde1aa65f6dc4a49
SHA1 59e915a81d0e8a3a8fda78106f92ab655a0f4f07
SHA512 2b7c10b52d7039e6390041ebe4f9085cc323f03256d206a41298b4615d1573616e66458de9e1749d0f36412d2aa7a1b0ac7304f949a551cd64b1b76b71afc4cd
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkf:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

nCKnzqI.exe

Path C:\Windows\System\nCKnzqI.exe
Size 1.8MB
SHA256 e06dcdf9e7ec6cb22f1c52aa07b0df3883dc9580ead6b7b98ec83b06c62befb5
MD5 929f4ce3969bb6cc1f97d5df5f802d0e
SHA1 e70e0d82a28c2f21812b593486b119fcda48b538
SHA512 62509d14f3873418081b85428c733bde0933551ce107987a5ce0a2d6c158edc07c1eb21a3af6f4f0bc3d6748f2f4444430277be3438e747e5f1743d1bb6c6129
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkB:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pMpgCoJ.exe

Path C:\Windows\System\pMpgCoJ.exe
Size 1.8MB
SHA256 dd2de5dd05ee1fdcc2a8015e9c3851e6a83645c1a03bca84ee5b1dd5f8af6f3c
MD5 873724e7bab3455c85063e6a57278e80
SHA1 807c5c7d2ac3ff48c7068eeb6deb7c4788896af3
SHA512 6af900b42a2b20fe14e37d2ca0deb1d4af8588ffaa6106df7415efd610d11c76dd50222e8e62e3e3d8067292e24e3fb393f86829bd2167d3d8da9e76074ffad3
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkO:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

tqvnPdf.exe

Path C:\Windows\System\tqvnPdf.exe
Size 1.8MB
SHA256 b232e12c6d9d73af12829442a00c0a0f5da23ff2bb2bac8e7c627045fd6d6b83
MD5 2e892c31c76d4e3dec4d86c16550782d
SHA1 c4bc668095f4c8b06c8b5666ac04a1d6785371c3
SHA512 fbfa9aed2ac29ff64d70f64633c501afbb8a77de73145cb38b7b0a806ac1d09ddcd7424b5f04e4c3b7e575be2dc42395492cebd788fd653331b7c5be7044ae21
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOkRB:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

wJMQeBJ.exe

Path C:\Windows\System\wJMQeBJ.exe
Size 1.8MB
SHA256 965aa12f5f779d0478d80aaab6a0f5f441b72fbc9b6641796663c147f770a862
MD5 774735350b71d8f7fbeff832969fa96b
SHA1 3edb80d28cd76ecc4a712ebc58a4e7db6f8a713e
SHA512 952e2f039dd056edc17aca1dbdc49d94d7f59184e095c61bb08887c73e8606f11d5a7bd1c13fba535aa08df806f8abe5bc1d663e001da685b4f8423175b53f04
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOk7:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

xqVvVpz.exe

Path C:\Windows\System\xqVvVpz.exe
Size 1.8MB
SHA256 52be516900e6726b2a39403a8464926633ba9720f83c08ade154573b48f44f93
MD5 35e849ba71932153f232257e4e4a04be
SHA1 acd01d673a51f3562d1a63f2d5867e3ecf931ddd
SHA512 1d26737521251738ddee7437ae3065a3cad1f16709874acf1ea03e93c3080a824dd4fc0ed11e5fd393d19a91029fec70be3a1c750641de1adc4aa648ff1c168c
SSDEEP 49152:Lz071uv4BPMkHC0IaSEzQR4iRFlX+IAD5qOk0:NAB5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/728-2127-0x00007FF7CAC70000-0x00007FF7CB062000-memory.dmp

Download

memory/728-63-0x00007FF7CAC70000-0x00007FF7CB062000-memory.dmp

Download

memory/856-511-0x00007FF6FA7F0000-0x00007FF6FABE2000-memory.dmp

Download

memory/856-2338-0x00007FF6FA7F0000-0x00007FF6FABE2000-memory.dmp

Download

memory/1004-57-0x00007FF7CF130000-0x00007FF7CF522000-memory.dmp

Download

memory/1232-460-0x00007FF6710C0000-0x00007FF6714B2000-memory.dmp

Download

memory/1232-2302-0x00007FF6710C0000-0x00007FF6714B2000-memory.dmp

Download

memory/1264-60-0x00007FF745B00000-0x00007FF745EF2000-memory.dmp

Download

memory/1264-2119-0x00007FF745B00000-0x00007FF745EF2000-memory.dmp

Download

memory/1432-5044-0x00007FF740FC0000-0x00007FF7413B2000-memory.dmp

Download

memory/1432-0-0x00007FF740FC0000-0x00007FF7413B2000-memory.dmp

Download

memory/1432-1-0x000001B4EE550000-0x000001B4EE560000-memory.dmp

Download

memory/1596-2267-0x00007FF6A31B0000-0x00007FF6A35A2000-memory.dmp

Download

memory/1596-94-0x00007FF6A31B0000-0x00007FF6A35A2000-memory.dmp

Download

memory/2324-70-0x00007FF7DE230000-0x00007FF7DE622000-memory.dmp

Download

memory/2324-2105-0x00007FF7DE230000-0x00007FF7DE622000-memory.dmp

Download

memory/2392-2309-0x00007FF70DEA0000-0x00007FF70E292000-memory.dmp

Download

memory/2392-494-0x00007FF70DEA0000-0x00007FF70E292000-memory.dmp

Download

memory/2428-62-0x00007FF7AF320000-0x00007FF7AF712000-memory.dmp

Download

memory/2596-2048-0x00007FF659AA0000-0x00007FF659E92000-memory.dmp

Download

memory/2596-11-0x00007FF659AA0000-0x00007FF659E92000-memory.dmp

Download

memory/2900-473-0x00007FF780A70000-0x00007FF780E62000-memory.dmp

Download

memory/2900-2298-0x00007FF780A70000-0x00007FF780E62000-memory.dmp

Download

memory/3600-54-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Download

memory/3600-15-0x00007FF9872D3000-0x00007FF9872D5000-memory.dmp

Download

memory/3600-38-0x000002087BEF0000-0x000002087BF12000-memory.dmp

Download

memory/3600-56-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Download

memory/3600-694-0x000002087D430000-0x000002087DBD6000-memory.dmp

Download

memory/3600-6017-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Download

memory/4380-122-0x00007FF65D750000-0x00007FF65DB42000-memory.dmp

Download

memory/4380-2292-0x00007FF65D750000-0x00007FF65DB42000-memory.dmp

Download

memory/4392-65-0x00007FF6D7350000-0x00007FF6D7742000-memory.dmp

Download

memory/4392-2174-0x00007FF6D7350000-0x00007FF6D7742000-memory.dmp

Download

memory/4444-99-0x00007FF702E40000-0x00007FF703232000-memory.dmp

Download

memory/4516-117-0x00007FF78BE40000-0x00007FF78C232000-memory.dmp

Download

memory/4516-2284-0x00007FF78BE40000-0x00007FF78C232000-memory.dmp

Download

memory/4588-74-0x00007FF611ED0000-0x00007FF6122C2000-memory.dmp

Download

memory/4588-2224-0x00007FF611ED0000-0x00007FF6122C2000-memory.dmp

Download

memory/4596-479-0x00007FF7EC700000-0x00007FF7ECAF2000-memory.dmp

Download

memory/4596-2313-0x00007FF7EC700000-0x00007FF7ECAF2000-memory.dmp

Download

memory/4632-104-0x00007FF7D4A40000-0x00007FF7D4E32000-memory.dmp

Download

memory/4632-2872-0x00007FF7D4A40000-0x00007FF7D4E32000-memory.dmp

Download

memory/4752-14-0x00007FF7DDB40000-0x00007FF7DDF32000-memory.dmp

Download

memory/4752-2046-0x00007FF7DDB40000-0x00007FF7DDF32000-memory.dmp

Download

memory/4756-2286-0x00007FF73DF60000-0x00007FF73E352000-memory.dmp

Download

memory/4756-101-0x00007FF73DF60000-0x00007FF73E352000-memory.dmp

Download

memory/4868-2285-0x00007FF63E590000-0x00007FF63E982000-memory.dmp

Download

memory/4868-107-0x00007FF63E590000-0x00007FF63E982000-memory.dmp

Download

memory/4892-2311-0x00007FF690380000-0x00007FF690772000-memory.dmp

Download

memory/4892-493-0x00007FF690380000-0x00007FF690772000-memory.dmp

Download

memory/4960-2295-0x00007FF7FC470000-0x00007FF7FC862000-memory.dmp

Download

memory/4960-119-0x00007FF7FC470000-0x00007FF7FC862000-memory.dmp

Download

memory/5112-2294-0x00007FF606D30000-0x00007FF607122000-memory.dmp

Download

memory/5112-109-0x00007FF606D30000-0x00007FF607122000-memory.dmp

Download