xmrig | bd0874d811a15d9f30a67450a98b7b30a0ee79012d4a3227936aef710fddc43c

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
Size

1.5MB
MD5

3e08f51e979ce1a467f1919e5a891e90
SHA1

58f719c42166e7c7090b062a25e36560e1dfaea0
SHA256

bd0874d811a15d9f30a67450a98b7b30a0ee79012d4a3227936aef710fddc43c
SHA512

9c45a5b6f8b6a79b529715535bc2bed3d4dcfe1aacb609f3b2e58ec99c60a9390b199a7d8bec33e57d2f07d379d55364becf06412887a0791eb27ff6e6ed4a9c
SSDEEP

49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7i2:RWWBibaQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral2/memory/4960-208-0x00007FF70E760000-0x00007FF70EAB1000-memory.dmp	xmrig
behavioral2/memory/4012-315-0x00007FF62B8C0000-0x00007FF62BC11000-memory.dmp	xmrig
behavioral2/memory/4808-359-0x00007FF6F4020000-0x00007FF6F4371000-memory.dmp	xmrig
behavioral2/memory/4996-432-0x00007FF6C2BD0000-0x00007FF6C2F21000-memory.dmp	xmrig
behavioral2/memory/2620-478-0x00007FF61C2E0000-0x00007FF61C631000-memory.dmp	xmrig
behavioral2/memory/4780-508-0x00007FF7AA5D0000-0x00007FF7AA921000-memory.dmp	xmrig
behavioral2/memory/2572-509-0x00007FF687870000-0x00007FF687BC1000-memory.dmp	xmrig
behavioral2/memory/2076-507-0x00007FF615F80000-0x00007FF6162D1000-memory.dmp	xmrig
behavioral2/memory/2724-506-0x00007FF6AA520000-0x00007FF6AA871000-memory.dmp	xmrig
behavioral2/memory/4236-503-0x00007FF65DB30000-0x00007FF65DE81000-memory.dmp	xmrig
behavioral2/memory/752-502-0x00007FF6C8A90000-0x00007FF6C8DE1000-memory.dmp	xmrig
behavioral2/memory/3456-421-0x00007FF6FB9C0000-0x00007FF6FBD11000-memory.dmp	xmrig
behavioral2/memory/4520-420-0x00007FF6D0AE0000-0x00007FF6D0E31000-memory.dmp	xmrig
behavioral2/memory/3200-409-0x00007FF60BC00000-0x00007FF60BF51000-memory.dmp	xmrig
behavioral2/memory/4956-310-0x00007FF7479B0000-0x00007FF747D01000-memory.dmp	xmrig
behavioral2/memory/2588-290-0x00007FF77F2E0000-0x00007FF77F631000-memory.dmp	xmrig
behavioral2/memory/4268-250-0x00007FF79E660000-0x00007FF79E9B1000-memory.dmp	xmrig
behavioral2/memory/4104-249-0x00007FF617670000-0x00007FF6179C1000-memory.dmp	xmrig
behavioral2/memory/456-168-0x00007FF655FF0000-0x00007FF656341000-memory.dmp	xmrig
behavioral2/memory/4816-2144-0x00007FF6CAF10000-0x00007FF6CB261000-memory.dmp	xmrig
behavioral2/memory/736-2242-0x00007FF7D3B10000-0x00007FF7D3E61000-memory.dmp	xmrig
behavioral2/memory/4888-2243-0x00007FF7386C0000-0x00007FF738A11000-memory.dmp	xmrig
behavioral2/memory/208-2244-0x00007FF7E6010000-0x00007FF7E6361000-memory.dmp	xmrig
behavioral2/memory/3740-2245-0x00007FF719100000-0x00007FF719451000-memory.dmp	xmrig
behavioral2/memory/1892-2246-0x00007FF6BBB20000-0x00007FF6BBE71000-memory.dmp	xmrig
behavioral2/memory/4696-2248-0x00007FF7ECAF0000-0x00007FF7ECE41000-memory.dmp	xmrig
behavioral2/memory/1276-2249-0x00007FF752C20000-0x00007FF752F71000-memory.dmp	xmrig
behavioral2/memory/3768-2247-0x00007FF690000000-0x00007FF690351000-memory.dmp	xmrig
behavioral2/memory/736-2251-0x00007FF7D3B10000-0x00007FF7D3E61000-memory.dmp	xmrig
behavioral2/memory/208-2253-0x00007FF7E6010000-0x00007FF7E6361000-memory.dmp	xmrig
behavioral2/memory/4888-2255-0x00007FF7386C0000-0x00007FF738A11000-memory.dmp	xmrig
behavioral2/memory/3740-2257-0x00007FF719100000-0x00007FF719451000-memory.dmp	xmrig
behavioral2/memory/1892-2259-0x00007FF6BBB20000-0x00007FF6BBE71000-memory.dmp	xmrig
behavioral2/memory/4236-2263-0x00007FF65DB30000-0x00007FF65DE81000-memory.dmp	xmrig
behavioral2/memory/456-2270-0x00007FF655FF0000-0x00007FF656341000-memory.dmp	xmrig
behavioral2/memory/752-2271-0x00007FF6C8A90000-0x00007FF6C8DE1000-memory.dmp	xmrig
behavioral2/memory/3768-2267-0x00007FF690000000-0x00007FF690351000-memory.dmp	xmrig
behavioral2/memory/2724-2266-0x00007FF6AA520000-0x00007FF6AA871000-memory.dmp	xmrig
behavioral2/memory/4696-2262-0x00007FF7ECAF0000-0x00007FF7ECE41000-memory.dmp	xmrig
behavioral2/memory/4956-2278-0x00007FF7479B0000-0x00007FF747D01000-memory.dmp	xmrig
behavioral2/memory/2572-2294-0x00007FF687870000-0x00007FF687BC1000-memory.dmp	xmrig
behavioral2/memory/4520-2308-0x00007FF6D0AE0000-0x00007FF6D0E31000-memory.dmp	xmrig
behavioral2/memory/3456-2315-0x00007FF6FB9C0000-0x00007FF6FBD11000-memory.dmp	xmrig
behavioral2/memory/4104-2307-0x00007FF617670000-0x00007FF6179C1000-memory.dmp	xmrig
behavioral2/memory/4780-2306-0x00007FF7AA5D0000-0x00007FF7AA921000-memory.dmp	xmrig
behavioral2/memory/4012-2302-0x00007FF62B8C0000-0x00007FF62BC11000-memory.dmp	xmrig
behavioral2/memory/4808-2299-0x00007FF6F4020000-0x00007FF6F4371000-memory.dmp	xmrig
behavioral2/memory/3200-2296-0x00007FF60BC00000-0x00007FF60BF51000-memory.dmp	xmrig
behavioral2/memory/4996-2289-0x00007FF6C2BD0000-0x00007FF6C2F21000-memory.dmp	xmrig
behavioral2/memory/1056-2286-0x00007FF74EC60000-0x00007FF74EFB1000-memory.dmp	xmrig
behavioral2/memory/1276-2284-0x00007FF752C20000-0x00007FF752F71000-memory.dmp	xmrig
behavioral2/memory/4064-2282-0x00007FF63CC60000-0x00007FF63CFB1000-memory.dmp	xmrig
behavioral2/memory/4960-2280-0x00007FF70E760000-0x00007FF70EAB1000-memory.dmp	xmrig
behavioral2/memory/2588-2304-0x00007FF77F2E0000-0x00007FF77F631000-memory.dmp	xmrig
behavioral2/memory/2620-2276-0x00007FF61C2E0000-0x00007FF61C631000-memory.dmp	xmrig
behavioral2/memory/4268-2298-0x00007FF79E660000-0x00007FF79E9B1000-memory.dmp	xmrig
behavioral2/memory/2076-2274-0x00007FF615F80000-0x00007FF6162D1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
736	kkQUBDu.exe
4888	MOySDyp.exe
208	LWLOQpx.exe
3740	XKWExPk.exe
1892	DTptGNX.exe
3768	FKzGazl.exe
4064	PXiBzHi.exe
4696	atSdlFe.exe
752	WfIgvqW.exe
4236	eHVhKTh.exe
1276	iHCJXyD.exe
1056	SEQwTnD.exe
456	NHPziwE.exe
4960	iMdYryr.exe
4104	zFQlhiv.exe
2724	XSXUrUi.exe
4268	xakVcsv.exe
2076	sIxMXAy.exe
4780	nbongPj.exe
2588	NNIxUhU.exe
4956	kqBDHdA.exe
4012	cViMcIW.exe
2572	vfNzlAb.exe
4808	aSJNRyM.exe
3200	jRWcKtA.exe
4520	HbivrvG.exe
3456	ATxFewg.exe
4996	MqYWeDW.exe
2620	ZMruhNW.exe
2368	PagjvcD.exe
4016	CCWBkTP.exe
4508	xkyuySA.exe
2400	aoktvqU.exe
4928	JPRcabN.exe
3288	euttSrr.exe
4404	YjFhEvq.exe
2412	RVjlrCJ.exe
332	FkrxtUC.exe
4856	EbhzimW.exe
4620	zvNLbDp.exe
4908	SbphUDp.exe
4200	gbzfjRv.exe
964	tScQtPg.exe
448	RyGGWqs.exe
856	EwTTCKi.exe
2384	ikXKzGd.exe
4636	zBZObbp.exe
2020	bofTCRb.exe
4504	rrFpnAE.exe
1904	EQKKQCK.exe
5032	AegHJMN.exe
4776	uFmUiAE.exe
3992	XgQbspa.exe
1620	HOhGvtB.exe
3364	xeArMBF.exe
2460	GZqbXvG.exe
3532	SOdepFH.exe
1128	rqspGuj.exe
1940	gDtoOda.exe
3284	NXqAjYw.exe
392	tDxyToO.exe
3944	CjCUrpB.exe
4332	wBveYmI.exe
1532	bxgWBJS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4816-0-0x00007FF6CAF10000-0x00007FF6CB261000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/files/0x000700000002341f-25.dat	upx
behavioral2/files/0x000700000002342b-71.dat	upx
behavioral2/files/0x0007000000023428-112.dat	upx
behavioral2/files/0x000700000002342c-143.dat	upx
behavioral2/files/0x0007000000023435-140.dat	upx
behavioral2/files/0x000700000002343f-187.dat	upx
behavioral2/files/0x000700000002343e-185.dat	upx
behavioral2/files/0x0007000000023432-134.dat	upx
behavioral2/files/0x0007000000023431-133.dat	upx
behavioral2/files/0x000700000002343a-164.dat	upx
behavioral2/memory/1276-115-0x00007FF752C20000-0x00007FF752F71000-memory.dmp	upx
behavioral2/files/0x0007000000023437-146.dat	upx
behavioral2/files/0x0007000000023433-137.dat	upx
behavioral2/files/0x0007000000023427-102.dat	upx
behavioral2/files/0x0007000000023426-101.dat	upx
behavioral2/files/0x0007000000023430-94.dat	upx
behavioral2/files/0x000700000002342f-93.dat	upx
behavioral2/files/0x0007000000023421-91.dat	upx
behavioral2/files/0x000700000002342e-90.dat	upx
behavioral2/memory/4960-208-0x00007FF70E760000-0x00007FF70EAB1000-memory.dmp	upx
behavioral2/memory/4012-315-0x00007FF62B8C0000-0x00007FF62BC11000-memory.dmp	upx
behavioral2/memory/4808-359-0x00007FF6F4020000-0x00007FF6F4371000-memory.dmp	upx
behavioral2/memory/4996-432-0x00007FF6C2BD0000-0x00007FF6C2F21000-memory.dmp	upx
behavioral2/memory/2620-478-0x00007FF61C2E0000-0x00007FF61C631000-memory.dmp	upx
behavioral2/memory/4780-508-0x00007FF7AA5D0000-0x00007FF7AA921000-memory.dmp	upx
behavioral2/memory/2572-509-0x00007FF687870000-0x00007FF687BC1000-memory.dmp	upx
behavioral2/memory/2076-507-0x00007FF615F80000-0x00007FF6162D1000-memory.dmp	upx
behavioral2/memory/2724-506-0x00007FF6AA520000-0x00007FF6AA871000-memory.dmp	upx
behavioral2/memory/4236-503-0x00007FF65DB30000-0x00007FF65DE81000-memory.dmp	upx
behavioral2/memory/752-502-0x00007FF6C8A90000-0x00007FF6C8DE1000-memory.dmp	upx
behavioral2/memory/3456-421-0x00007FF6FB9C0000-0x00007FF6FBD11000-memory.dmp	upx
behavioral2/memory/4520-420-0x00007FF6D0AE0000-0x00007FF6D0E31000-memory.dmp	upx
behavioral2/memory/3200-409-0x00007FF60BC00000-0x00007FF60BF51000-memory.dmp	upx
behavioral2/memory/4956-310-0x00007FF7479B0000-0x00007FF747D01000-memory.dmp	upx
behavioral2/memory/2588-290-0x00007FF77F2E0000-0x00007FF77F631000-memory.dmp	upx
behavioral2/memory/4268-250-0x00007FF79E660000-0x00007FF79E9B1000-memory.dmp	upx
behavioral2/memory/4104-249-0x00007FF617670000-0x00007FF6179C1000-memory.dmp	upx
behavioral2/files/0x0007000000023442-202.dat	upx
behavioral2/files/0x0007000000023441-201.dat	upx
behavioral2/files/0x0007000000023434-193.dat	upx
behavioral2/files/0x0007000000023440-192.dat	upx
behavioral2/files/0x000700000002343d-175.dat	upx
behavioral2/files/0x000700000002343c-174.dat	upx
behavioral2/files/0x000700000002342d-170.dat	upx
behavioral2/memory/456-168-0x00007FF655FF0000-0x00007FF656341000-memory.dmp	upx
behavioral2/files/0x0007000000023439-162.dat	upx
behavioral2/files/0x0007000000023429-156.dat	upx
behavioral2/files/0x0007000000023438-147.dat	upx
behavioral2/memory/1056-124-0x00007FF74EC60000-0x00007FF74EFB1000-memory.dmp	upx
behavioral2/memory/4696-88-0x00007FF7ECAF0000-0x00007FF7ECE41000-memory.dmp	upx
behavioral2/files/0x0007000000023423-105.dat	upx
behavioral2/files/0x0007000000023425-87.dat	upx
behavioral2/files/0x0007000000023424-83.dat	upx
behavioral2/files/0x000700000002342a-75.dat	upx
behavioral2/memory/4064-72-0x00007FF63CC60000-0x00007FF63CFB1000-memory.dmp	upx
behavioral2/files/0x0007000000023422-86.dat	upx
behavioral2/files/0x0007000000023420-67.dat	upx
behavioral2/files/0x000700000002341e-78.dat	upx
behavioral2/memory/3768-63-0x00007FF690000000-0x00007FF690351000-memory.dmp	upx
behavioral2/memory/1892-61-0x00007FF6BBB20000-0x00007FF6BBE71000-memory.dmp	upx
behavioral2/memory/3740-47-0x00007FF719100000-0x00007FF719451000-memory.dmp	upx
behavioral2/files/0x000700000002341d-31.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VGYaVBY.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\StGJBoB.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\yqApyKf.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\RgCgnay.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\jOurBix.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\vEvYTPo.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\qftKfeb.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\DKYDdDB.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\fHHogWo.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\PpfCICc.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\PdAZwzP.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\VhWSjSI.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\qcZrRaJ.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\UgVqsll.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\MGWiuTc.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\DjXuoRE.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\jCukNhV.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\erwMWcG.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\YuBzQwc.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\RFYPLSC.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\ZkIAgwJ.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\mBnDvnd.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\BvySpUg.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\SGlcmjn.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\iLrkuxR.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\rrnjCqP.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\DhOTOBk.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\FZDFxRU.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\abVDLfE.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\MPKpBrX.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\xtkXibb.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\LnhlKNr.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\EqSkHVW.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\pWlweJx.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\UuGFNJh.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\LUJOgbB.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\AJNABbg.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\vqfkHAh.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\ixMoxds.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\MNzGxCs.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\ULzhQDg.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\tOUjXEg.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\pcxnfor.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\emqWMoO.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\zXyutTo.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\WVFOdBS.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\baaIGMT.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\laxbylM.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\rnYzkiq.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\bgqYrrb.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\zTNQcLn.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\FXojqqb.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\GAMxTFz.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\RNIPzBC.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\xlGOMHr.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\YRsFEbF.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\wNnxAEg.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\NHzyZhb.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\FceOGHL.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\parjGQh.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\jQxOdqJ.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\CthWRtO.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\nAYVNum.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
File created	C:\Windows\System\doSMSRt.exe	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 736	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	83
PID 4816 wrote to memory of 736	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	83
PID 4816 wrote to memory of 4888	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	84
PID 4816 wrote to memory of 4888	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	84
PID 4816 wrote to memory of 208	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	85
PID 4816 wrote to memory of 208	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	85
PID 4816 wrote to memory of 4064	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	86
PID 4816 wrote to memory of 4064	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	86
PID 4816 wrote to memory of 3740	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	87
PID 4816 wrote to memory of 3740	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	87
PID 4816 wrote to memory of 1892	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	88
PID 4816 wrote to memory of 1892	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	88
PID 4816 wrote to memory of 3768	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	89
PID 4816 wrote to memory of 3768	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	89
PID 4816 wrote to memory of 4696	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	90
PID 4816 wrote to memory of 4696	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	90
PID 4816 wrote to memory of 752	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	91
PID 4816 wrote to memory of 752	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	91
PID 4816 wrote to memory of 4236	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	92
PID 4816 wrote to memory of 4236	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	92
PID 4816 wrote to memory of 1276	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	93
PID 4816 wrote to memory of 1276	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	93
PID 4816 wrote to memory of 1056	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	94
PID 4816 wrote to memory of 1056	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	94
PID 4816 wrote to memory of 456	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	95
PID 4816 wrote to memory of 456	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	95
PID 4816 wrote to memory of 4960	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	96
PID 4816 wrote to memory of 4960	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	96
PID 4816 wrote to memory of 4104	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	97
PID 4816 wrote to memory of 4104	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	97
PID 4816 wrote to memory of 2724	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	98
PID 4816 wrote to memory of 2724	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	98
PID 4816 wrote to memory of 4268	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	99
PID 4816 wrote to memory of 4268	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	99
PID 4816 wrote to memory of 2076	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	100
PID 4816 wrote to memory of 2076	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	100
PID 4816 wrote to memory of 4780	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	101
PID 4816 wrote to memory of 4780	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	101
PID 4816 wrote to memory of 2588	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	102
PID 4816 wrote to memory of 2588	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	102
PID 4816 wrote to memory of 4956	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	103
PID 4816 wrote to memory of 4956	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	103
PID 4816 wrote to memory of 4012	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	104
PID 4816 wrote to memory of 4012	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	104
PID 4816 wrote to memory of 2572	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	105
PID 4816 wrote to memory of 2572	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	105
PID 4816 wrote to memory of 4808	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	106
PID 4816 wrote to memory of 4808	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	106
PID 4816 wrote to memory of 3200	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	107
PID 4816 wrote to memory of 3200	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	107
PID 4816 wrote to memory of 3288	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	108
PID 4816 wrote to memory of 3288	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	108
PID 4816 wrote to memory of 4520	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	109
PID 4816 wrote to memory of 4520	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	109
PID 4816 wrote to memory of 4908	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	110
PID 4816 wrote to memory of 4908	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	110
PID 4816 wrote to memory of 3456	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	111
PID 4816 wrote to memory of 3456	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	111
PID 4816 wrote to memory of 4996	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	112
PID 4816 wrote to memory of 4996	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	112
PID 4816 wrote to memory of 2620	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	113
PID 4816 wrote to memory of 2620	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	113
PID 4816 wrote to memory of 2368	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	114
PID 4816 wrote to memory of 2368	4816	3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3e08f51e979ce1a467f1919e5a891e90_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\System\kkQUBDu.exe
  C:\Windows\System\kkQUBDu.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\MOySDyp.exe
  C:\Windows\System\MOySDyp.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\LWLOQpx.exe
  C:\Windows\System\LWLOQpx.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\PXiBzHi.exe
  C:\Windows\System\PXiBzHi.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\XKWExPk.exe
  C:\Windows\System\XKWExPk.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\DTptGNX.exe
  C:\Windows\System\DTptGNX.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\FKzGazl.exe
  C:\Windows\System\FKzGazl.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\atSdlFe.exe
  C:\Windows\System\atSdlFe.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\WfIgvqW.exe
  C:\Windows\System\WfIgvqW.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\eHVhKTh.exe
  C:\Windows\System\eHVhKTh.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\iHCJXyD.exe
  C:\Windows\System\iHCJXyD.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\SEQwTnD.exe
  C:\Windows\System\SEQwTnD.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\NHPziwE.exe
  C:\Windows\System\NHPziwE.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\iMdYryr.exe
  C:\Windows\System\iMdYryr.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\zFQlhiv.exe
  C:\Windows\System\zFQlhiv.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\XSXUrUi.exe
  C:\Windows\System\XSXUrUi.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\xakVcsv.exe
  C:\Windows\System\xakVcsv.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\sIxMXAy.exe
  C:\Windows\System\sIxMXAy.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\nbongPj.exe
  C:\Windows\System\nbongPj.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\NNIxUhU.exe
  C:\Windows\System\NNIxUhU.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\kqBDHdA.exe
  C:\Windows\System\kqBDHdA.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\cViMcIW.exe
  C:\Windows\System\cViMcIW.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\vfNzlAb.exe
  C:\Windows\System\vfNzlAb.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\aSJNRyM.exe
  C:\Windows\System\aSJNRyM.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\jRWcKtA.exe
  C:\Windows\System\jRWcKtA.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\euttSrr.exe
  C:\Windows\System\euttSrr.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\HbivrvG.exe
  C:\Windows\System\HbivrvG.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\SbphUDp.exe
  C:\Windows\System\SbphUDp.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\ATxFewg.exe
  C:\Windows\System\ATxFewg.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\MqYWeDW.exe
  C:\Windows\System\MqYWeDW.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\ZMruhNW.exe
  C:\Windows\System\ZMruhNW.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\PagjvcD.exe
  C:\Windows\System\PagjvcD.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\EwTTCKi.exe
  C:\Windows\System\EwTTCKi.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\CCWBkTP.exe
  C:\Windows\System\CCWBkTP.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\xkyuySA.exe
  C:\Windows\System\xkyuySA.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\aoktvqU.exe
  C:\Windows\System\aoktvqU.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\JPRcabN.exe
  C:\Windows\System\JPRcabN.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\YjFhEvq.exe
  C:\Windows\System\YjFhEvq.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\RVjlrCJ.exe
  C:\Windows\System\RVjlrCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\FkrxtUC.exe
  C:\Windows\System\FkrxtUC.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\EbhzimW.exe
  C:\Windows\System\EbhzimW.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\zvNLbDp.exe
  C:\Windows\System\zvNLbDp.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\gbzfjRv.exe
  C:\Windows\System\gbzfjRv.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\tScQtPg.exe
  C:\Windows\System\tScQtPg.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\RyGGWqs.exe
  C:\Windows\System\RyGGWqs.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\ikXKzGd.exe
  C:\Windows\System\ikXKzGd.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\zBZObbp.exe
  C:\Windows\System\zBZObbp.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\bofTCRb.exe
  C:\Windows\System\bofTCRb.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\rrFpnAE.exe
  C:\Windows\System\rrFpnAE.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\EQKKQCK.exe
  C:\Windows\System\EQKKQCK.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\AegHJMN.exe
  C:\Windows\System\AegHJMN.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\uFmUiAE.exe
  C:\Windows\System\uFmUiAE.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\XgQbspa.exe
  C:\Windows\System\XgQbspa.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\HOhGvtB.exe
  C:\Windows\System\HOhGvtB.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\xeArMBF.exe
  C:\Windows\System\xeArMBF.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\GZqbXvG.exe
  C:\Windows\System\GZqbXvG.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\SOdepFH.exe
  C:\Windows\System\SOdepFH.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\rqspGuj.exe
  C:\Windows\System\rqspGuj.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\gDtoOda.exe
  C:\Windows\System\gDtoOda.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\NXqAjYw.exe
  C:\Windows\System\NXqAjYw.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\tDxyToO.exe
  C:\Windows\System\tDxyToO.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\CjCUrpB.exe
  C:\Windows\System\CjCUrpB.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\wBveYmI.exe
  C:\Windows\System\wBveYmI.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\bxgWBJS.exe
  C:\Windows\System\bxgWBJS.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\JpNWTad.exe
  C:\Windows\System\JpNWTad.exe
  2⤵
  PID:2192
- C:\Windows\System\sThefUd.exe
  C:\Windows\System\sThefUd.exe
  2⤵
  PID:4432
- C:\Windows\System\jXSXXtA.exe
  C:\Windows\System\jXSXXtA.exe
  2⤵
  PID:4420
- C:\Windows\System\epaGmxh.exe
  C:\Windows\System\epaGmxh.exe
  2⤵
  PID:4580
- C:\Windows\System\hgFkpwC.exe
  C:\Windows\System\hgFkpwC.exe
  2⤵
  PID:3092
- C:\Windows\System\vfBOxBW.exe
  C:\Windows\System\vfBOxBW.exe
  2⤵
  PID:2504
- C:\Windows\System\hPypXMj.exe
  C:\Windows\System\hPypXMj.exe
  2⤵
  PID:3228
- C:\Windows\System\qOAtymB.exe
  C:\Windows\System\qOAtymB.exe
  2⤵
  PID:1396
- C:\Windows\System\JvCofXA.exe
  C:\Windows\System\JvCofXA.exe
  2⤵
  PID:756
- C:\Windows\System\ZZAfwSK.exe
  C:\Windows\System\ZZAfwSK.exe
  2⤵
  PID:2632
- C:\Windows\System\ACoTDEe.exe
  C:\Windows\System\ACoTDEe.exe
  2⤵
  PID:1836
- C:\Windows\System\Xjyxnbi.exe
  C:\Windows\System\Xjyxnbi.exe
  2⤵
  PID:2636
- C:\Windows\System\VGYaVBY.exe
  C:\Windows\System\VGYaVBY.exe
  2⤵
  PID:4924
- C:\Windows\System\fCmWbjJ.exe
  C:\Windows\System\fCmWbjJ.exe
  2⤵
  PID:3400
- C:\Windows\System\rrnjCqP.exe
  C:\Windows\System\rrnjCqP.exe
  2⤵
  PID:1556
- C:\Windows\System\XXlBLBH.exe
  C:\Windows\System\XXlBLBH.exe
  2⤵
  PID:3688
- C:\Windows\System\tDRNLZZ.exe
  C:\Windows\System\tDRNLZZ.exe
  2⤵
  PID:4692
- C:\Windows\System\parjGQh.exe
  C:\Windows\System\parjGQh.exe
  2⤵
  PID:696
- C:\Windows\System\LTQKVEm.exe
  C:\Windows\System\LTQKVEm.exe
  2⤵
  PID:4884
- C:\Windows\System\rrebqOl.exe
  C:\Windows\System\rrebqOl.exe
  2⤵
  PID:3236
- C:\Windows\System\LoSRoHe.exe
  C:\Windows\System\LoSRoHe.exe
  2⤵
  PID:2700
- C:\Windows\System\WWDIIGI.exe
  C:\Windows\System\WWDIIGI.exe
  2⤵
  PID:3348
- C:\Windows\System\exJNEDC.exe
  C:\Windows\System\exJNEDC.exe
  2⤵
  PID:5128
- C:\Windows\System\DhOTOBk.exe
  C:\Windows\System\DhOTOBk.exe
  2⤵
  PID:5144
- C:\Windows\System\yTugcYK.exe
  C:\Windows\System\yTugcYK.exe
  2⤵
  PID:5180
- C:\Windows\System\CesDwNz.exe
  C:\Windows\System\CesDwNz.exe
  2⤵
  PID:5200
- C:\Windows\System\DhDEzEg.exe
  C:\Windows\System\DhDEzEg.exe
  2⤵
  PID:5252
- C:\Windows\System\yoUFqyD.exe
  C:\Windows\System\yoUFqyD.exe
  2⤵
  PID:5272
- C:\Windows\System\UpVHxDy.exe
  C:\Windows\System\UpVHxDy.exe
  2⤵
  PID:5292
- C:\Windows\System\MLSXQGs.exe
  C:\Windows\System\MLSXQGs.exe
  2⤵
  PID:5308
- C:\Windows\System\bLGnjDc.exe
  C:\Windows\System\bLGnjDc.exe
  2⤵
  PID:5332
- C:\Windows\System\jQxOdqJ.exe
  C:\Windows\System\jQxOdqJ.exe
  2⤵
  PID:5348
- C:\Windows\System\zJyIsXF.exe
  C:\Windows\System\zJyIsXF.exe
  2⤵
  PID:5376
- C:\Windows\System\mUiNUzZ.exe
  C:\Windows\System\mUiNUzZ.exe
  2⤵
  PID:5392
- C:\Windows\System\laxbylM.exe
  C:\Windows\System\laxbylM.exe
  2⤵
  PID:5408
- C:\Windows\System\HHjNNAc.exe
  C:\Windows\System\HHjNNAc.exe
  2⤵
  PID:5424
- C:\Windows\System\BYyOYhm.exe
  C:\Windows\System\BYyOYhm.exe
  2⤵
  PID:5440
- C:\Windows\System\qvkdKcZ.exe
  C:\Windows\System\qvkdKcZ.exe
  2⤵
  PID:5456
- C:\Windows\System\ZMXhNaq.exe
  C:\Windows\System\ZMXhNaq.exe
  2⤵
  PID:5472
- C:\Windows\System\BaVIzMm.exe
  C:\Windows\System\BaVIzMm.exe
  2⤵
  PID:5488
- C:\Windows\System\lYIQpqS.exe
  C:\Windows\System\lYIQpqS.exe
  2⤵
  PID:5504
- C:\Windows\System\vAdbfiZ.exe
  C:\Windows\System\vAdbfiZ.exe
  2⤵
  PID:5524
- C:\Windows\System\wSyXFnx.exe
  C:\Windows\System\wSyXFnx.exe
  2⤵
  PID:5544
- C:\Windows\System\WDeybDo.exe
  C:\Windows\System\WDeybDo.exe
  2⤵
  PID:5572
- C:\Windows\System\JXkhOCW.exe
  C:\Windows\System\JXkhOCW.exe
  2⤵
  PID:5596
- C:\Windows\System\zNBlwms.exe
  C:\Windows\System\zNBlwms.exe
  2⤵
  PID:5616
- C:\Windows\System\yEigvBV.exe
  C:\Windows\System\yEigvBV.exe
  2⤵
  PID:5636
- C:\Windows\System\IpPGQHX.exe
  C:\Windows\System\IpPGQHX.exe
  2⤵
  PID:5660
- C:\Windows\System\dhBcyqi.exe
  C:\Windows\System\dhBcyqi.exe
  2⤵
  PID:5684
- C:\Windows\System\UPtloFi.exe
  C:\Windows\System\UPtloFi.exe
  2⤵
  PID:5704
- C:\Windows\System\PjoVWjR.exe
  C:\Windows\System\PjoVWjR.exe
  2⤵
  PID:5748
- C:\Windows\System\HjwhHCt.exe
  C:\Windows\System\HjwhHCt.exe
  2⤵
  PID:5768
- C:\Windows\System\fOXvMAs.exe
  C:\Windows\System\fOXvMAs.exe
  2⤵
  PID:5788
- C:\Windows\System\DMxhrVz.exe
  C:\Windows\System\DMxhrVz.exe
  2⤵
  PID:5812
- C:\Windows\System\MPyOsfu.exe
  C:\Windows\System\MPyOsfu.exe
  2⤵
  PID:5832
- C:\Windows\System\PxHFsNf.exe
  C:\Windows\System\PxHFsNf.exe
  2⤵
  PID:5856
- C:\Windows\System\CadiVPz.exe
  C:\Windows\System\CadiVPz.exe
  2⤵
  PID:5876
- C:\Windows\System\lulFWbO.exe
  C:\Windows\System\lulFWbO.exe
  2⤵
  PID:5896
- C:\Windows\System\epxrBGX.exe
  C:\Windows\System\epxrBGX.exe
  2⤵
  PID:5920
- C:\Windows\System\WGSlquZ.exe
  C:\Windows\System\WGSlquZ.exe
  2⤵
  PID:5940
- C:\Windows\System\pWlweJx.exe
  C:\Windows\System\pWlweJx.exe
  2⤵
  PID:1908
- C:\Windows\System\XhBLXfw.exe
  C:\Windows\System\XhBLXfw.exe
  2⤵
  PID:1968
- C:\Windows\System\hVdVVdb.exe
  C:\Windows\System\hVdVVdb.exe
  2⤵
  PID:224
- C:\Windows\System\tnLvizj.exe
  C:\Windows\System\tnLvizj.exe
  2⤵
  PID:4356
- C:\Windows\System\nxjmFkM.exe
  C:\Windows\System\nxjmFkM.exe
  2⤵
  PID:2928
- C:\Windows\System\YRsFEbF.exe
  C:\Windows\System\YRsFEbF.exe
  2⤵
  PID:1528
- C:\Windows\System\ryZNsWJ.exe
  C:\Windows\System\ryZNsWJ.exe
  2⤵
  PID:2316
- C:\Windows\System\tUUyslQ.exe
  C:\Windows\System\tUUyslQ.exe
  2⤵
  PID:1268
- C:\Windows\System\sYQgZBO.exe
  C:\Windows\System\sYQgZBO.exe
  2⤵
  PID:2908
- C:\Windows\System\fPrtvgG.exe
  C:\Windows\System\fPrtvgG.exe
  2⤵
  PID:4112
- C:\Windows\System\ZceZiHa.exe
  C:\Windows\System\ZceZiHa.exe
  2⤵
  PID:3188
- C:\Windows\System\CtawRdW.exe
  C:\Windows\System\CtawRdW.exe
  2⤵
  PID:5372
- C:\Windows\System\anKyvjK.exe
  C:\Windows\System\anKyvjK.exe
  2⤵
  PID:5388
- C:\Windows\System\bRmdyMq.exe
  C:\Windows\System\bRmdyMq.exe
  2⤵
  PID:5420
- C:\Windows\System\acmwtSA.exe
  C:\Windows\System\acmwtSA.exe
  2⤵
  PID:5484
- C:\Windows\System\tzaEmaw.exe
  C:\Windows\System\tzaEmaw.exe
  2⤵
  PID:5532
- C:\Windows\System\sdNZFXD.exe
  C:\Windows\System\sdNZFXD.exe
  2⤵
  PID:5580
- C:\Windows\System\FVJqmeP.exe
  C:\Windows\System\FVJqmeP.exe
  2⤵
  PID:5624
- C:\Windows\System\MWgnqhf.exe
  C:\Windows\System\MWgnqhf.exe
  2⤵
  PID:5668
- C:\Windows\System\WnIWVOW.exe
  C:\Windows\System\WnIWVOW.exe
  2⤵
  PID:5820
- C:\Windows\System\BVHvCZP.exe
  C:\Windows\System\BVHvCZP.exe
  2⤵
  PID:5316
- C:\Windows\System\NCGGaJJ.exe
  C:\Windows\System\NCGGaJJ.exe
  2⤵
  PID:5340
- C:\Windows\System\FCcEPtv.exe
  C:\Windows\System\FCcEPtv.exe
  2⤵
  PID:5448
- C:\Windows\System\jhzyaBZ.exe
  C:\Windows\System\jhzyaBZ.exe
  2⤵
  PID:5516
- C:\Windows\System\RFYPLSC.exe
  C:\Windows\System\RFYPLSC.exe
  2⤵
  PID:5604
- C:\Windows\System\wzBaPib.exe
  C:\Windows\System\wzBaPib.exe
  2⤵
  PID:5656
- C:\Windows\System\FZDFxRU.exe
  C:\Windows\System\FZDFxRU.exe
  2⤵
  PID:5804
- C:\Windows\System\LNvRsaH.exe
  C:\Windows\System\LNvRsaH.exe
  2⤵
  PID:3060
- C:\Windows\System\uxAZyGp.exe
  C:\Windows\System\uxAZyGp.exe
  2⤵
  PID:6056
- C:\Windows\System\GVLMuuV.exe
  C:\Windows\System\GVLMuuV.exe
  2⤵
  PID:6160
- C:\Windows\System\ayNFlCP.exe
  C:\Windows\System\ayNFlCP.exe
  2⤵
  PID:6176
- C:\Windows\System\TmxYfMl.exe
  C:\Windows\System\TmxYfMl.exe
  2⤵
  PID:6192
- C:\Windows\System\QNGdQny.exe
  C:\Windows\System\QNGdQny.exe
  2⤵
  PID:6212
- C:\Windows\System\GvLHFgS.exe
  C:\Windows\System\GvLHFgS.exe
  2⤵
  PID:6228
- C:\Windows\System\fjUJzAj.exe
  C:\Windows\System\fjUJzAj.exe
  2⤵
  PID:6252
- C:\Windows\System\StGJBoB.exe
  C:\Windows\System\StGJBoB.exe
  2⤵
  PID:6268
- C:\Windows\System\kOXCFOY.exe
  C:\Windows\System\kOXCFOY.exe
  2⤵
  PID:6288
- C:\Windows\System\JEZQmox.exe
  C:\Windows\System\JEZQmox.exe
  2⤵
  PID:6312
- C:\Windows\System\ZaoQXpS.exe
  C:\Windows\System\ZaoQXpS.exe
  2⤵
  PID:6332
- C:\Windows\System\BqknaOT.exe
  C:\Windows\System\BqknaOT.exe
  2⤵
  PID:6456
- C:\Windows\System\BYcETix.exe
  C:\Windows\System\BYcETix.exe
  2⤵
  PID:6472
- C:\Windows\System\tsavcMN.exe
  C:\Windows\System\tsavcMN.exe
  2⤵
  PID:6496
- C:\Windows\System\OspSuwb.exe
  C:\Windows\System\OspSuwb.exe
  2⤵
  PID:6512
- C:\Windows\System\QKjzqUw.exe
  C:\Windows\System\QKjzqUw.exe
  2⤵
  PID:6536
- C:\Windows\System\SrFWqpi.exe
  C:\Windows\System\SrFWqpi.exe
  2⤵
  PID:6564
- C:\Windows\System\fAGqMlA.exe
  C:\Windows\System\fAGqMlA.exe
  2⤵
  PID:6580
- C:\Windows\System\OfuaVCW.exe
  C:\Windows\System\OfuaVCW.exe
  2⤵
  PID:6644
- C:\Windows\System\oSniUpk.exe
  C:\Windows\System\oSniUpk.exe
  2⤵
  PID:6664
- C:\Windows\System\HblrDGp.exe
  C:\Windows\System\HblrDGp.exe
  2⤵
  PID:6680
- C:\Windows\System\OGFyFkY.exe
  C:\Windows\System\OGFyFkY.exe
  2⤵
  PID:6696
- C:\Windows\System\KLazath.exe
  C:\Windows\System\KLazath.exe
  2⤵
  PID:6712
- C:\Windows\System\ZkIAgwJ.exe
  C:\Windows\System\ZkIAgwJ.exe
  2⤵
  PID:6728
- C:\Windows\System\ULzhQDg.exe
  C:\Windows\System\ULzhQDg.exe
  2⤵
  PID:6744
- C:\Windows\System\QYbPQID.exe
  C:\Windows\System\QYbPQID.exe
  2⤵
  PID:6760
- C:\Windows\System\FQgDQGP.exe
  C:\Windows\System\FQgDQGP.exe
  2⤵
  PID:6776
- C:\Windows\System\mBnDvnd.exe
  C:\Windows\System\mBnDvnd.exe
  2⤵
  PID:6792
- C:\Windows\System\XmTbhLr.exe
  C:\Windows\System\XmTbhLr.exe
  2⤵
  PID:6808
- C:\Windows\System\QlnJBGG.exe
  C:\Windows\System\QlnJBGG.exe
  2⤵
  PID:6824
- C:\Windows\System\YkBnbFy.exe
  C:\Windows\System\YkBnbFy.exe
  2⤵
  PID:6840
- C:\Windows\System\bjxzOQH.exe
  C:\Windows\System\bjxzOQH.exe
  2⤵
  PID:6856
- C:\Windows\System\uLQAwJj.exe
  C:\Windows\System\uLQAwJj.exe
  2⤵
  PID:6872
- C:\Windows\System\KIhxfWv.exe
  C:\Windows\System\KIhxfWv.exe
  2⤵
  PID:6888
- C:\Windows\System\jNFOFoe.exe
  C:\Windows\System\jNFOFoe.exe
  2⤵
  PID:6908
- C:\Windows\System\nPIgxMJ.exe
  C:\Windows\System\nPIgxMJ.exe
  2⤵
  PID:6928
- C:\Windows\System\EDyhWIu.exe
  C:\Windows\System\EDyhWIu.exe
  2⤵
  PID:6948
- C:\Windows\System\JhzzmUc.exe
  C:\Windows\System\JhzzmUc.exe
  2⤵
  PID:6972
- C:\Windows\System\TxdXtfe.exe
  C:\Windows\System\TxdXtfe.exe
  2⤵
  PID:6988
- C:\Windows\System\tLOkZGq.exe
  C:\Windows\System\tLOkZGq.exe
  2⤵
  PID:7008
- C:\Windows\System\aPLLdJz.exe
  C:\Windows\System\aPLLdJz.exe
  2⤵
  PID:7032
- C:\Windows\System\bzQduLS.exe
  C:\Windows\System\bzQduLS.exe
  2⤵
  PID:7060
- C:\Windows\System\aXIiVQM.exe
  C:\Windows\System\aXIiVQM.exe
  2⤵
  PID:7080
- C:\Windows\System\iMsDpPM.exe
  C:\Windows\System\iMsDpPM.exe
  2⤵
  PID:7100
- C:\Windows\System\pLgkSED.exe
  C:\Windows\System\pLgkSED.exe
  2⤵
  PID:5632
- C:\Windows\System\lxTSlld.exe
  C:\Windows\System\lxTSlld.exe
  2⤵
  PID:6556
- C:\Windows\System\beBTVZZ.exe
  C:\Windows\System\beBTVZZ.exe
  2⤵
  PID:5908
- C:\Windows\System\IiIyYbt.exe
  C:\Windows\System\IiIyYbt.exe
  2⤵
  PID:6184
- C:\Windows\System\AUBtStR.exe
  C:\Windows\System\AUBtStR.exe
  2⤵
  PID:6224
- C:\Windows\System\PYxKdbL.exe
  C:\Windows\System\PYxKdbL.exe
  2⤵
  PID:6276
- C:\Windows\System\WNcILhr.exe
  C:\Windows\System\WNcILhr.exe
  2⤵
  PID:6304
- C:\Windows\System\AQbUlEW.exe
  C:\Windows\System\AQbUlEW.exe
  2⤵
  PID:6576
- C:\Windows\System\OGLLOKY.exe
  C:\Windows\System\OGLLOKY.exe
  2⤵
  PID:6400
- C:\Windows\System\dIOcRUt.exe
  C:\Windows\System\dIOcRUt.exe
  2⤵
  PID:6440
- C:\Windows\System\zFTdNjX.exe
  C:\Windows\System\zFTdNjX.exe
  2⤵
  PID:6480
- C:\Windows\System\oWPmDkP.exe
  C:\Windows\System\oWPmDkP.exe
  2⤵
  PID:7188
- C:\Windows\System\mXYfffh.exe
  C:\Windows\System\mXYfffh.exe
  2⤵
  PID:7216
- C:\Windows\System\Nlgsfag.exe
  C:\Windows\System\Nlgsfag.exe
  2⤵
  PID:7232
- C:\Windows\System\fEEemrm.exe
  C:\Windows\System\fEEemrm.exe
  2⤵
  PID:7252
- C:\Windows\System\AIJnqYq.exe
  C:\Windows\System\AIJnqYq.exe
  2⤵
  PID:7268
- C:\Windows\System\aJtVqGB.exe
  C:\Windows\System\aJtVqGB.exe
  2⤵
  PID:7292
- C:\Windows\System\UuGFNJh.exe
  C:\Windows\System\UuGFNJh.exe
  2⤵
  PID:7316
- C:\Windows\System\OdfmmmX.exe
  C:\Windows\System\OdfmmmX.exe
  2⤵
  PID:7340
- C:\Windows\System\SJECTDU.exe
  C:\Windows\System\SJECTDU.exe
  2⤵
  PID:7356
- C:\Windows\System\rMEAOjL.exe
  C:\Windows\System\rMEAOjL.exe
  2⤵
  PID:7384
- C:\Windows\System\wmlWCFd.exe
  C:\Windows\System\wmlWCFd.exe
  2⤵
  PID:7412
- C:\Windows\System\gWzegot.exe
  C:\Windows\System\gWzegot.exe
  2⤵
  PID:7440
- C:\Windows\System\eZIPgBD.exe
  C:\Windows\System\eZIPgBD.exe
  2⤵
  PID:7456
- C:\Windows\System\akeKJsJ.exe
  C:\Windows\System\akeKJsJ.exe
  2⤵
  PID:7472
- C:\Windows\System\YViAFEA.exe
  C:\Windows\System\YViAFEA.exe
  2⤵
  PID:7700
- C:\Windows\System\cjHqnXS.exe
  C:\Windows\System\cjHqnXS.exe
  2⤵
  PID:7724
- C:\Windows\System\stbrSEm.exe
  C:\Windows\System\stbrSEm.exe
  2⤵
  PID:7748
- C:\Windows\System\FAPqxgg.exe
  C:\Windows\System\FAPqxgg.exe
  2⤵
  PID:7772
- C:\Windows\System\UytvcWH.exe
  C:\Windows\System\UytvcWH.exe
  2⤵
  PID:7796
- C:\Windows\System\DFTFpVP.exe
  C:\Windows\System\DFTFpVP.exe
  2⤵
  PID:7820
- C:\Windows\System\YybPnSD.exe
  C:\Windows\System\YybPnSD.exe
  2⤵
  PID:7840
- C:\Windows\System\zGZtblG.exe
  C:\Windows\System\zGZtblG.exe
  2⤵
  PID:7860
- C:\Windows\System\ZpRWRzo.exe
  C:\Windows\System\ZpRWRzo.exe
  2⤵
  PID:7884
- C:\Windows\System\IQJtXug.exe
  C:\Windows\System\IQJtXug.exe
  2⤵
  PID:7916
- C:\Windows\System\WdaeyFA.exe
  C:\Windows\System\WdaeyFA.exe
  2⤵
  PID:7932
- C:\Windows\System\MeByOuD.exe
  C:\Windows\System\MeByOuD.exe
  2⤵
  PID:7952
- C:\Windows\System\NaLtKgs.exe
  C:\Windows\System\NaLtKgs.exe
  2⤵
  PID:7968
- C:\Windows\System\FfaYiFo.exe
  C:\Windows\System\FfaYiFo.exe
  2⤵
  PID:7984
- C:\Windows\System\MlevICR.exe
  C:\Windows\System\MlevICR.exe
  2⤵
  PID:8004
- C:\Windows\System\ohCucfj.exe
  C:\Windows\System\ohCucfj.exe
  2⤵
  PID:8020
- C:\Windows\System\OYEshao.exe
  C:\Windows\System\OYEshao.exe
  2⤵
  PID:8036
- C:\Windows\System\DKYDdDB.exe
  C:\Windows\System\DKYDdDB.exe
  2⤵
  PID:8128
- C:\Windows\System\dSaPpTC.exe
  C:\Windows\System\dSaPpTC.exe
  2⤵
  PID:8156
- C:\Windows\System\QKjIReG.exe
  C:\Windows\System\QKjIReG.exe
  2⤵
  PID:8176
- C:\Windows\System\LBVlmYX.exe
  C:\Windows\System\LBVlmYX.exe
  2⤵
  PID:6520
- C:\Windows\System\WukJMnb.exe
  C:\Windows\System\WukJMnb.exe
  2⤵
  PID:6572
- C:\Windows\System\lNJrvfm.exe
  C:\Windows\System\lNJrvfm.exe
  2⤵
  PID:6656
- C:\Windows\System\dFTWvqM.exe
  C:\Windows\System\dFTWvqM.exe
  2⤵
  PID:6704
- C:\Windows\System\TEHbvet.exe
  C:\Windows\System\TEHbvet.exe
  2⤵
  PID:684
- C:\Windows\System\iriJVZD.exe
  C:\Windows\System\iriJVZD.exe
  2⤵
  PID:4748
- C:\Windows\System\yDuMdDp.exe
  C:\Windows\System\yDuMdDp.exe
  2⤵
  PID:4964
- C:\Windows\System\MgFvTBw.exe
  C:\Windows\System\MgFvTBw.exe
  2⤵
  PID:2064
- C:\Windows\System\Ctmkyoe.exe
  C:\Windows\System\Ctmkyoe.exe
  2⤵
  PID:372
- C:\Windows\System\jwloyOj.exe
  C:\Windows\System\jwloyOj.exe
  2⤵
  PID:6492
- C:\Windows\System\CUUpnfN.exe
  C:\Windows\System\CUUpnfN.exe
  2⤵
  PID:6152
- C:\Windows\System\ybKzUbm.exe
  C:\Windows\System\ybKzUbm.exe
  2⤵
  PID:6248
- C:\Windows\System\wNnxAEg.exe
  C:\Windows\System\wNnxAEg.exe
  2⤵
  PID:6296
- C:\Windows\System\iWIKNkZ.exe
  C:\Windows\System\iWIKNkZ.exe
  2⤵
  PID:6392
- C:\Windows\System\hmhAAhv.exe
  C:\Windows\System\hmhAAhv.exe
  2⤵
  PID:7172
- C:\Windows\System\SBuuJoG.exe
  C:\Windows\System\SBuuJoG.exe
  2⤵
  PID:7204
- C:\Windows\System\cnHvpzd.exe
  C:\Windows\System\cnHvpzd.exe
  2⤵
  PID:7260
- C:\Windows\System\oAwyQuG.exe
  C:\Windows\System\oAwyQuG.exe
  2⤵
  PID:7312
- C:\Windows\System\LFSBVVT.exe
  C:\Windows\System\LFSBVVT.exe
  2⤵
  PID:7788
- C:\Windows\System\tNwbBOU.exe
  C:\Windows\System\tNwbBOU.exe
  2⤵
  PID:7856
- C:\Windows\System\jCukNhV.exe
  C:\Windows\System\jCukNhV.exe
  2⤵
  PID:7960
- C:\Windows\System\lxKmTaf.exe
  C:\Windows\System\lxKmTaf.exe
  2⤵
  PID:7992
- C:\Windows\System\OvzBVXy.exe
  C:\Windows\System\OvzBVXy.exe
  2⤵
  PID:8028
- C:\Windows\System\btZKQdX.exe
  C:\Windows\System\btZKQdX.exe
  2⤵
  PID:8088
- C:\Windows\System\jBwjSjT.exe
  C:\Windows\System\jBwjSjT.exe
  2⤵
  PID:8112
- C:\Windows\System\yZyRnxF.exe
  C:\Windows\System\yZyRnxF.exe
  2⤵
  PID:8164
- C:\Windows\System\wdLCTMw.exe
  C:\Windows\System\wdLCTMw.exe
  2⤵
  PID:6532
- C:\Windows\System\jRYCNRP.exe
  C:\Windows\System\jRYCNRP.exe
  2⤵
  PID:6832
- C:\Windows\System\FgKDzFX.exe
  C:\Windows\System\FgKDzFX.exe
  2⤵
  PID:6904
- C:\Windows\System\WtAdjjP.exe
  C:\Windows\System\WtAdjjP.exe
  2⤵
  PID:3360
- C:\Windows\System\aIDmLTK.exe
  C:\Windows\System\aIDmLTK.exe
  2⤵
  PID:7092
- C:\Windows\System\RzToMwH.exe
  C:\Windows\System\RzToMwH.exe
  2⤵
  PID:4612
- C:\Windows\System\cHrVGtV.exe
  C:\Windows\System\cHrVGtV.exe
  2⤵
  PID:5416
- C:\Windows\System\MIdTuxn.exe
  C:\Windows\System\MIdTuxn.exe
  2⤵
  PID:1380
- C:\Windows\System\mfiuddi.exe
  C:\Windows\System\mfiuddi.exe
  2⤵
  PID:6368
- C:\Windows\System\WLjyDmV.exe
  C:\Windows\System\WLjyDmV.exe
  2⤵
  PID:6468
- C:\Windows\System\VoFxTro.exe
  C:\Windows\System\VoFxTro.exe
  2⤵
  PID:7224
- C:\Windows\System\QaCZupW.exe
  C:\Windows\System\QaCZupW.exe
  2⤵
  PID:4628
- C:\Windows\System\NTuDbMz.exe
  C:\Windows\System\NTuDbMz.exe
  2⤵
  PID:1296
- C:\Windows\System\SjusiGm.exe
  C:\Windows\System\SjusiGm.exe
  2⤵
  PID:4988
- C:\Windows\System\KTQDDIb.exe
  C:\Windows\System\KTQDDIb.exe
  2⤵
  PID:2884
- C:\Windows\System\OYFmkHS.exe
  C:\Windows\System\OYFmkHS.exe
  2⤵
  PID:7780
- C:\Windows\System\lsphrgW.exe
  C:\Windows\System\lsphrgW.exe
  2⤵
  PID:7940
- C:\Windows\System\ANDLDte.exe
  C:\Windows\System\ANDLDte.exe
  2⤵
  PID:8016
- C:\Windows\System\MvPyFIW.exe
  C:\Windows\System\MvPyFIW.exe
  2⤵
  PID:4920
- C:\Windows\System\ukhLWdq.exe
  C:\Windows\System\ukhLWdq.exe
  2⤵
  PID:6676
- C:\Windows\System\ZLMlcbS.exe
  C:\Windows\System\ZLMlcbS.exe
  2⤵
  PID:3948
- C:\Windows\System\sCsQtcr.exe
  C:\Windows\System\sCsQtcr.exe
  2⤵
  PID:2940
- C:\Windows\System\tgAuMgP.exe
  C:\Windows\System\tgAuMgP.exe
  2⤵
  PID:3248
- C:\Windows\System\xXSOFFO.exe
  C:\Windows\System\xXSOFFO.exe
  2⤵
  PID:6984
- C:\Windows\System\MTRQvQm.exe
  C:\Windows\System\MTRQvQm.exe
  2⤵
  PID:7980
- C:\Windows\System\BjraQoh.exe
  C:\Windows\System\BjraQoh.exe
  2⤵
  PID:7868
- C:\Windows\System\GjyvVkY.exe
  C:\Windows\System\GjyvVkY.exe
  2⤵
  PID:6880
- C:\Windows\System\zpnRWOg.exe
  C:\Windows\System\zpnRWOg.exe
  2⤵
  PID:904
- C:\Windows\System\gfsgYPr.exe
  C:\Windows\System\gfsgYPr.exe
  2⤵
  PID:3684
- C:\Windows\System\oRiEWyH.exe
  C:\Windows\System\oRiEWyH.exe
  2⤵
  PID:2444
- C:\Windows\System\brgAxoT.exe
  C:\Windows\System\brgAxoT.exe
  2⤵
  PID:5452
- C:\Windows\System\qqCyRtd.exe
  C:\Windows\System\qqCyRtd.exe
  2⤵
  PID:4204
- C:\Windows\System\gILaEqh.exe
  C:\Windows\System\gILaEqh.exe
  2⤵
  PID:6100
- C:\Windows\System\tOUjXEg.exe
  C:\Windows\System\tOUjXEg.exe
  2⤵
  PID:5964
- C:\Windows\System\DSIANFk.exe
  C:\Windows\System\DSIANFk.exe
  2⤵
  PID:4260
- C:\Windows\System\pOoOvtR.exe
  C:\Windows\System\pOoOvtR.exe
  2⤵
  PID:8200
- C:\Windows\System\fHHogWo.exe
  C:\Windows\System\fHHogWo.exe
  2⤵
  PID:8216
- C:\Windows\System\ppdMNkl.exe
  C:\Windows\System\ppdMNkl.exe
  2⤵
  PID:8240
- C:\Windows\System\CIgORNd.exe
  C:\Windows\System\CIgORNd.exe
  2⤵
  PID:8260
- C:\Windows\System\LUJOgbB.exe
  C:\Windows\System\LUJOgbB.exe
  2⤵
  PID:8280
- C:\Windows\System\KcRpJNj.exe
  C:\Windows\System\KcRpJNj.exe
  2⤵
  PID:8300
- C:\Windows\System\vHXZzDA.exe
  C:\Windows\System\vHXZzDA.exe
  2⤵
  PID:8320
- C:\Windows\System\GjVnYtM.exe
  C:\Windows\System\GjVnYtM.exe
  2⤵
  PID:8340
- C:\Windows\System\MOmIjzw.exe
  C:\Windows\System\MOmIjzw.exe
  2⤵
  PID:8364
- C:\Windows\System\AvUdyPl.exe
  C:\Windows\System\AvUdyPl.exe
  2⤵
  PID:8388
- C:\Windows\System\LyQtsHY.exe
  C:\Windows\System\LyQtsHY.exe
  2⤵
  PID:8408
- C:\Windows\System\twDatAY.exe
  C:\Windows\System\twDatAY.exe
  2⤵
  PID:8424
- C:\Windows\System\CthWRtO.exe
  C:\Windows\System\CthWRtO.exe
  2⤵
  PID:8452
- C:\Windows\System\iaHzEqC.exe
  C:\Windows\System\iaHzEqC.exe
  2⤵
  PID:8476
- C:\Windows\System\DuTTCSE.exe
  C:\Windows\System\DuTTCSE.exe
  2⤵
  PID:8492
- C:\Windows\System\AJNABbg.exe
  C:\Windows\System\AJNABbg.exe
  2⤵
  PID:8516
- C:\Windows\System\abVDLfE.exe
  C:\Windows\System\abVDLfE.exe
  2⤵
  PID:8540
- C:\Windows\System\rnYzkiq.exe
  C:\Windows\System\rnYzkiq.exe
  2⤵
  PID:8556
- C:\Windows\System\DHmfIFe.exe
  C:\Windows\System\DHmfIFe.exe
  2⤵
  PID:8584
- C:\Windows\System\xVjaxjq.exe
  C:\Windows\System\xVjaxjq.exe
  2⤵
  PID:8604
- C:\Windows\System\xDLDotS.exe
  C:\Windows\System\xDLDotS.exe
  2⤵
  PID:8624
- C:\Windows\System\SePlcZz.exe
  C:\Windows\System\SePlcZz.exe
  2⤵
  PID:8640
- C:\Windows\System\UpgmBme.exe
  C:\Windows\System\UpgmBme.exe
  2⤵
  PID:8660
- C:\Windows\System\zNGoJvR.exe
  C:\Windows\System\zNGoJvR.exe
  2⤵
  PID:8680
- C:\Windows\System\dwBgMZW.exe
  C:\Windows\System\dwBgMZW.exe
  2⤵
  PID:8704
- C:\Windows\System\vShbjDK.exe
  C:\Windows\System\vShbjDK.exe
  2⤵
  PID:8724
- C:\Windows\System\TnsARxm.exe
  C:\Windows\System\TnsARxm.exe
  2⤵
  PID:8748
- C:\Windows\System\vqfkHAh.exe
  C:\Windows\System\vqfkHAh.exe
  2⤵
  PID:8768
- C:\Windows\System\JbkNgNw.exe
  C:\Windows\System\JbkNgNw.exe
  2⤵
  PID:8792
- C:\Windows\System\VbZWgHb.exe
  C:\Windows\System\VbZWgHb.exe
  2⤵
  PID:8808
- C:\Windows\System\HsmHEJQ.exe
  C:\Windows\System\HsmHEJQ.exe
  2⤵
  PID:8836
- C:\Windows\System\fZvAAER.exe
  C:\Windows\System\fZvAAER.exe
  2⤵
  PID:8856
- C:\Windows\System\PpfCICc.exe
  C:\Windows\System\PpfCICc.exe
  2⤵
  PID:8880
- C:\Windows\System\isaCMDg.exe
  C:\Windows\System\isaCMDg.exe
  2⤵
  PID:8900
- C:\Windows\System\ESBXvja.exe
  C:\Windows\System\ESBXvja.exe
  2⤵
  PID:8916
- C:\Windows\System\tnuPFII.exe
  C:\Windows\System\tnuPFII.exe
  2⤵
  PID:8940
- C:\Windows\System\YGRRzNy.exe
  C:\Windows\System\YGRRzNy.exe
  2⤵
  PID:8960
- C:\Windows\System\pcxnfor.exe
  C:\Windows\System\pcxnfor.exe
  2⤵
  PID:8980
- C:\Windows\System\tUxvhCk.exe
  C:\Windows\System\tUxvhCk.exe
  2⤵
  PID:9000
- C:\Windows\System\bgqYrrb.exe
  C:\Windows\System\bgqYrrb.exe
  2⤵
  PID:9024
- C:\Windows\System\vTrytrF.exe
  C:\Windows\System\vTrytrF.exe
  2⤵
  PID:9052
- C:\Windows\System\XbzEoyo.exe
  C:\Windows\System\XbzEoyo.exe
  2⤵
  PID:9072
- C:\Windows\System\BvySpUg.exe
  C:\Windows\System\BvySpUg.exe
  2⤵
  PID:9100
- C:\Windows\System\HRjzRUs.exe
  C:\Windows\System\HRjzRUs.exe
  2⤵
  PID:9120
- C:\Windows\System\iIYmROA.exe
  C:\Windows\System\iIYmROA.exe
  2⤵
  PID:9144
- C:\Windows\System\hIVIypY.exe
  C:\Windows\System\hIVIypY.exe
  2⤵
  PID:9164
- C:\Windows\System\lhfDNnU.exe
  C:\Windows\System\lhfDNnU.exe
  2⤵
  PID:9192
- C:\Windows\System\ZWSPjBg.exe
  C:\Windows\System\ZWSPjBg.exe
  2⤵
  PID:9208
- C:\Windows\System\NyQfwlJ.exe
  C:\Windows\System\NyQfwlJ.exe
  2⤵
  PID:5152
- C:\Windows\System\hMBvTcs.exe
  C:\Windows\System\hMBvTcs.exe
  2⤵
  PID:4760
- C:\Windows\System\sNYfzfi.exe
  C:\Windows\System\sNYfzfi.exe
  2⤵
  PID:6752
- C:\Windows\System\eUgYtvi.exe
  C:\Windows\System\eUgYtvi.exe
  2⤵
  PID:8212
- C:\Windows\System\NnOaRWy.exe
  C:\Windows\System\NnOaRWy.exe
  2⤵
  PID:8332
- C:\Windows\System\RMkTtmW.exe
  C:\Windows\System\RMkTtmW.exe
  2⤵
  PID:8400
- C:\Windows\System\qvlrece.exe
  C:\Windows\System\qvlrece.exe
  2⤵
  PID:8488
- C:\Windows\System\dKKypMo.exe
  C:\Windows\System\dKKypMo.exe
  2⤵
  PID:8360
- C:\Windows\System\zKfnBoa.exe
  C:\Windows\System\zKfnBoa.exe
  2⤵
  PID:8272
- C:\Windows\System\Qrnlmxn.exe
  C:\Windows\System\Qrnlmxn.exe
  2⤵
  PID:8648
- C:\Windows\System\tuWfgRY.exe
  C:\Windows\System\tuWfgRY.exe
  2⤵
  PID:8700
- C:\Windows\System\DONjBVI.exe
  C:\Windows\System\DONjBVI.exe
  2⤵
  PID:8764
- C:\Windows\System\WTvUEVQ.exe
  C:\Windows\System\WTvUEVQ.exe
  2⤵
  PID:8844
- C:\Windows\System\qsCmSkO.exe
  C:\Windows\System\qsCmSkO.exe
  2⤵
  PID:8912
- C:\Windows\System\wiWJUuy.exe
  C:\Windows\System\wiWJUuy.exe
  2⤵
  PID:8956
- C:\Windows\System\lRzmjAs.exe
  C:\Windows\System\lRzmjAs.exe
  2⤵
  PID:9064
- C:\Windows\System\cDbpcFC.exe
  C:\Windows\System\cDbpcFC.exe
  2⤵
  PID:9108
- C:\Windows\System\FiMafBl.exe
  C:\Windows\System\FiMafBl.exe
  2⤵
  PID:8600
- C:\Windows\System\HdSeItb.exe
  C:\Windows\System\HdSeItb.exe
  2⤵
  PID:4544
- C:\Windows\System\nVHXpeJ.exe
  C:\Windows\System\nVHXpeJ.exe
  2⤵
  PID:9220
- C:\Windows\System\uwZPihy.exe
  C:\Windows\System\uwZPihy.exe
  2⤵
  PID:9244
- C:\Windows\System\vpPATqo.exe
  C:\Windows\System\vpPATqo.exe
  2⤵
  PID:9268
- C:\Windows\System\gbmsrcW.exe
  C:\Windows\System\gbmsrcW.exe
  2⤵
  PID:9292
- C:\Windows\System\zTNQcLn.exe
  C:\Windows\System\zTNQcLn.exe
  2⤵
  PID:9308
- C:\Windows\System\IdYuLIJ.exe
  C:\Windows\System\IdYuLIJ.exe
  2⤵
  PID:9332
- C:\Windows\System\JZhOAfj.exe
  C:\Windows\System\JZhOAfj.exe
  2⤵
  PID:9356
- C:\Windows\System\jcOvoRJ.exe
  C:\Windows\System\jcOvoRJ.exe
  2⤵
  PID:9372
- C:\Windows\System\MGYZOIP.exe
  C:\Windows\System\MGYZOIP.exe
  2⤵
  PID:9404
- C:\Windows\System\gllYMBn.exe
  C:\Windows\System\gllYMBn.exe
  2⤵
  PID:9424
- C:\Windows\System\TsTbgnO.exe
  C:\Windows\System\TsTbgnO.exe
  2⤵
  PID:9444
- C:\Windows\System\YPsgVHT.exe
  C:\Windows\System\YPsgVHT.exe
  2⤵
  PID:9464
- C:\Windows\System\mShOtgN.exe
  C:\Windows\System\mShOtgN.exe
  2⤵
  PID:9488
- C:\Windows\System\kBXVpsg.exe
  C:\Windows\System\kBXVpsg.exe
  2⤵
  PID:9508
- C:\Windows\System\FXojqqb.exe
  C:\Windows\System\FXojqqb.exe
  2⤵
  PID:9532
- C:\Windows\System\OTJNeiR.exe
  C:\Windows\System\OTJNeiR.exe
  2⤵
  PID:9552
- C:\Windows\System\SGzInda.exe
  C:\Windows\System\SGzInda.exe
  2⤵
  PID:9568
- C:\Windows\System\JNbutho.exe
  C:\Windows\System\JNbutho.exe
  2⤵
  PID:9584
- C:\Windows\System\uLprCzD.exe
  C:\Windows\System\uLprCzD.exe
  2⤵
  PID:9608
- C:\Windows\System\nAYVNum.exe
  C:\Windows\System\nAYVNum.exe
  2⤵
  PID:9624
- C:\Windows\System\UgVqsll.exe
  C:\Windows\System\UgVqsll.exe
  2⤵
  PID:9640
- C:\Windows\System\GMbqRbW.exe
  C:\Windows\System\GMbqRbW.exe
  2⤵
  PID:9660
- C:\Windows\System\zzQoGDz.exe
  C:\Windows\System\zzQoGDz.exe
  2⤵
  PID:9684
- C:\Windows\System\lSxIROx.exe
  C:\Windows\System\lSxIROx.exe
  2⤵
  PID:9712
- C:\Windows\System\doSMSRt.exe
  C:\Windows\System\doSMSRt.exe
  2⤵
  PID:9736
- C:\Windows\System\jUysJOe.exe
  C:\Windows\System\jUysJOe.exe
  2⤵
  PID:9756
- C:\Windows\System\kllnjNS.exe
  C:\Windows\System\kllnjNS.exe
  2⤵
  PID:9780
- C:\Windows\System\ixMoxds.exe
  C:\Windows\System\ixMoxds.exe
  2⤵
  PID:9800
- C:\Windows\System\qmbyPCj.exe
  C:\Windows\System\qmbyPCj.exe
  2⤵
  PID:9828
- C:\Windows\System\lfgZpDM.exe
  C:\Windows\System\lfgZpDM.exe
  2⤵
  PID:9856
- C:\Windows\System\OydJFer.exe
  C:\Windows\System\OydJFer.exe
  2⤵
  PID:9876
- C:\Windows\System\BPIsylg.exe
  C:\Windows\System\BPIsylg.exe
  2⤵
  PID:9900
- C:\Windows\System\GmAcePN.exe
  C:\Windows\System\GmAcePN.exe
  2⤵
  PID:9916
- C:\Windows\System\nMOxhks.exe
  C:\Windows\System\nMOxhks.exe
  2⤵
  PID:9936
- C:\Windows\System\xoiFwmI.exe
  C:\Windows\System\xoiFwmI.exe
  2⤵
  PID:9960
- C:\Windows\System\LLXXkPh.exe
  C:\Windows\System\LLXXkPh.exe
  2⤵
  PID:9976
- C:\Windows\System\qgxQDuK.exe
  C:\Windows\System\qgxQDuK.exe
  2⤵
  PID:10004
- C:\Windows\System\vZpYXLY.exe
  C:\Windows\System\vZpYXLY.exe
  2⤵
  PID:10024
- C:\Windows\System\LnhlKNr.exe
  C:\Windows\System\LnhlKNr.exe
  2⤵
  PID:10044
- C:\Windows\System\GAMxTFz.exe
  C:\Windows\System\GAMxTFz.exe
  2⤵
  PID:10064
- C:\Windows\System\DHSbYwS.exe
  C:\Windows\System\DHSbYwS.exe
  2⤵
  PID:10084
- C:\Windows\System\yASpPeE.exe
  C:\Windows\System\yASpPeE.exe
  2⤵
  PID:10104
- C:\Windows\System\TtPQjGj.exe
  C:\Windows\System\TtPQjGj.exe
  2⤵
  PID:10124
- C:\Windows\System\JwYkJqB.exe
  C:\Windows\System\JwYkJqB.exe
  2⤵
  PID:10148
- C:\Windows\System\DBLdFCy.exe
  C:\Windows\System\DBLdFCy.exe
  2⤵
  PID:10172
- C:\Windows\System\FQSUhwg.exe
  C:\Windows\System\FQSUhwg.exe
  2⤵
  PID:10192
- C:\Windows\System\InHwjBw.exe
  C:\Windows\System\InHwjBw.exe
  2⤵
  PID:10212
- C:\Windows\System\lEKoJhe.exe
  C:\Windows\System\lEKoJhe.exe
  2⤵
  PID:10236
- C:\Windows\System\hqkaXbv.exe
  C:\Windows\System\hqkaXbv.exe
  2⤵
  PID:8760
- C:\Windows\System\lWplDgV.exe
  C:\Windows\System\lWplDgV.exe
  2⤵
  PID:9156
- C:\Windows\System\EqSkHVW.exe
  C:\Windows\System\EqSkHVW.exe
  2⤵
  PID:8936
- C:\Windows\System\yhrImEt.exe
  C:\Windows\System\yhrImEt.exe
  2⤵
  PID:8988
- C:\Windows\System\cFkLvSk.exe
  C:\Windows\System\cFkLvSk.exe
  2⤵
  PID:8420
- C:\Windows\System\hEpqjtr.exe
  C:\Windows\System\hEpqjtr.exe
  2⤵
  PID:9284
- C:\Windows\System\QmljKoS.exe
  C:\Windows\System\QmljKoS.exe
  2⤵
  PID:9112
- C:\Windows\System\XPoQGeR.exe
  C:\Windows\System\XPoQGeR.exe
  2⤵
  PID:9384
- C:\Windows\System\PAidTPs.exe
  C:\Windows\System\PAidTPs.exe
  2⤵
  PID:9456
- C:\Windows\System\KIDBsLk.exe
  C:\Windows\System\KIDBsLk.exe
  2⤵
  PID:9188
- C:\Windows\System\xVLYwJC.exe
  C:\Windows\System\xVLYwJC.exe
  2⤵
  PID:4148
- C:\Windows\System\XcjCBdO.exe
  C:\Windows\System\XcjCBdO.exe
  2⤵
  PID:9172
- C:\Windows\System\URThldh.exe
  C:\Windows\System\URThldh.exe
  2⤵
  PID:8296
- C:\Windows\System\RojLnci.exe
  C:\Windows\System\RojLnci.exe
  2⤵
  PID:9620
- C:\Windows\System\fEiLLqz.exe
  C:\Windows\System\fEiLLqz.exe
  2⤵
  PID:8512
- C:\Windows\System\CSIFGIa.exe
  C:\Windows\System\CSIFGIa.exe
  2⤵
  PID:9672
- C:\Windows\System\DJyELDr.exe
  C:\Windows\System\DJyELDr.exe
  2⤵
  PID:9276
- C:\Windows\System\RGeglfo.exe
  C:\Windows\System\RGeglfo.exe
  2⤵
  PID:9840
- C:\Windows\System\KqnxLlJ.exe
  C:\Windows\System\KqnxLlJ.exe
  2⤵
  PID:9892
- C:\Windows\System\PyziFxy.exe
  C:\Windows\System\PyziFxy.exe
  2⤵
  PID:9472
- C:\Windows\System\YDDbnLC.exe
  C:\Windows\System\YDDbnLC.exe
  2⤵
  PID:10036
- C:\Windows\System\RRQxzES.exe
  C:\Windows\System\RRQxzES.exe
  2⤵
  PID:8740
- C:\Windows\System\dRDieIz.exe
  C:\Windows\System\dRDieIz.exe
  2⤵
  PID:10256
- C:\Windows\System\wbBIAoi.exe
  C:\Windows\System\wbBIAoi.exe
  2⤵
  PID:10280
- C:\Windows\System\RDpHnIJ.exe
  C:\Windows\System\RDpHnIJ.exe
  2⤵
  PID:10300
- C:\Windows\System\ZwmhBpP.exe
  C:\Windows\System\ZwmhBpP.exe
  2⤵
  PID:10324
- C:\Windows\System\xPCgvqz.exe
  C:\Windows\System\xPCgvqz.exe
  2⤵
  PID:10340
- C:\Windows\System\XfcgGsx.exe
  C:\Windows\System\XfcgGsx.exe
  2⤵
  PID:10360
- C:\Windows\System\AkvgovV.exe
  C:\Windows\System\AkvgovV.exe
  2⤵
  PID:10384
- C:\Windows\System\rHARlxb.exe
  C:\Windows\System\rHARlxb.exe
  2⤵
  PID:10400
- C:\Windows\System\GKTipsm.exe
  C:\Windows\System\GKTipsm.exe
  2⤵
  PID:10420
- C:\Windows\System\deyBTZB.exe
  C:\Windows\System\deyBTZB.exe
  2⤵
  PID:10444
- C:\Windows\System\NKHJNPg.exe
  C:\Windows\System\NKHJNPg.exe
  2⤵
  PID:10468
- C:\Windows\System\VleKnVT.exe
  C:\Windows\System\VleKnVT.exe
  2⤵
  PID:10488
- C:\Windows\System\HdyqgAT.exe
  C:\Windows\System\HdyqgAT.exe
  2⤵
  PID:10512
- C:\Windows\System\xeMLrPg.exe
  C:\Windows\System\xeMLrPg.exe
  2⤵
  PID:10532
- C:\Windows\System\OXGZqEJ.exe
  C:\Windows\System\OXGZqEJ.exe
  2⤵
  PID:10552
- C:\Windows\System\gkCLUXl.exe
  C:\Windows\System\gkCLUXl.exe
  2⤵
  PID:10576
- C:\Windows\System\uULBalj.exe
  C:\Windows\System\uULBalj.exe
  2⤵
  PID:10596
- C:\Windows\System\DxcikLo.exe
  C:\Windows\System\DxcikLo.exe
  2⤵
  PID:10616
- C:\Windows\System\SGlcmjn.exe
  C:\Windows\System\SGlcmjn.exe
  2⤵
  PID:10640
- C:\Windows\System\gvNzMji.exe
  C:\Windows\System\gvNzMji.exe
  2⤵
  PID:10660
- C:\Windows\System\LArKjho.exe
  C:\Windows\System\LArKjho.exe
  2⤵
  PID:10680
- C:\Windows\System\IIhhfuB.exe
  C:\Windows\System\IIhhfuB.exe
  2⤵
  PID:10704
- C:\Windows\System\igpHauB.exe
  C:\Windows\System\igpHauB.exe
  2⤵
  PID:10728
- C:\Windows\System\sALlEzt.exe
  C:\Windows\System\sALlEzt.exe
  2⤵
  PID:10756
- C:\Windows\System\wUtsgDB.exe
  C:\Windows\System\wUtsgDB.exe
  2⤵
  PID:10772
- C:\Windows\System\PohuMSn.exe
  C:\Windows\System\PohuMSn.exe
  2⤵
  PID:10788
- C:\Windows\System\ajPQkLE.exe
  C:\Windows\System\ajPQkLE.exe
  2⤵
  PID:10808
- C:\Windows\System\hsCqBBP.exe
  C:\Windows\System\hsCqBBP.exe
  2⤵
  PID:10832
- C:\Windows\System\aaCFojx.exe
  C:\Windows\System\aaCFojx.exe
  2⤵
  PID:10856
- C:\Windows\System\pFFHQxU.exe
  C:\Windows\System\pFFHQxU.exe
  2⤵
  PID:10876
- C:\Windows\System\OVWtVLB.exe
  C:\Windows\System\OVWtVLB.exe
  2⤵
  PID:10896
- C:\Windows\System\pXKIAGw.exe
  C:\Windows\System\pXKIAGw.exe
  2⤵
  PID:10916
- C:\Windows\System\rtvNFxc.exe
  C:\Windows\System\rtvNFxc.exe
  2⤵
  PID:10940
- C:\Windows\System\bhFCwwy.exe
  C:\Windows\System\bhFCwwy.exe
  2⤵
  PID:10968
- C:\Windows\System\ibpDYZD.exe
  C:\Windows\System\ibpDYZD.exe
  2⤵
  PID:10988
- C:\Windows\System\ROUoevT.exe
  C:\Windows\System\ROUoevT.exe
  2⤵
  PID:11008
- C:\Windows\System\emqWMoO.exe
  C:\Windows\System\emqWMoO.exe
  2⤵
  PID:11032
- C:\Windows\System\sNVPzNs.exe
  C:\Windows\System\sNVPzNs.exe
  2⤵
  PID:11056
- C:\Windows\System\GeKsSFV.exe
  C:\Windows\System\GeKsSFV.exe
  2⤵
  PID:11080
- C:\Windows\System\ajyfNGE.exe
  C:\Windows\System\ajyfNGE.exe
  2⤵
  PID:11096
- C:\Windows\System\PdAZwzP.exe
  C:\Windows\System\PdAZwzP.exe
  2⤵
  PID:11112
- C:\Windows\System\fBCbexp.exe
  C:\Windows\System\fBCbexp.exe
  2⤵
  PID:11128
- C:\Windows\System\gzcniHJ.exe
  C:\Windows\System\gzcniHJ.exe
  2⤵
  PID:11152
- C:\Windows\System\EAxhRvu.exe
  C:\Windows\System\EAxhRvu.exe
  2⤵
  PID:11172
- C:\Windows\System\gxmmgcq.exe
  C:\Windows\System\gxmmgcq.exe
  2⤵
  PID:11200
- C:\Windows\System\KeJMOtX.exe
  C:\Windows\System\KeJMOtX.exe
  2⤵
  PID:11228
- C:\Windows\System\xNjxUXQ.exe
  C:\Windows\System\xNjxUXQ.exe
  2⤵
  PID:11248
- C:\Windows\System\ELCcINQ.exe
  C:\Windows\System\ELCcINQ.exe
  2⤵
  PID:9580
- C:\Windows\System\uYQsWkj.exe
  C:\Windows\System\uYQsWkj.exe
  2⤵
  PID:10144
- C:\Windows\System\WUobraq.exe
  C:\Windows\System\WUobraq.exe
  2⤵
  PID:10208
- C:\Windows\System\yJjWVRF.exe
  C:\Windows\System\yJjWVRF.exe
  2⤵
  PID:8816
- C:\Windows\System\sOsyWsL.exe
  C:\Windows\System\sOsyWsL.exe
  2⤵
  PID:8564
- C:\Windows\System\NmiYshX.exe
  C:\Windows\System\NmiYshX.exe
  2⤵
  PID:9316
- C:\Windows\System\ZVVHbAp.exe
  C:\Windows\System\ZVVHbAp.exe
  2⤵
  PID:9824
- C:\Windows\System\FtWuVFV.exe
  C:\Windows\System\FtWuVFV.exe
  2⤵
  PID:9364
- C:\Windows\System\uWNGblX.exe
  C:\Windows\System\uWNGblX.exe
  2⤵
  PID:5016
- C:\Windows\System\DpDktvw.exe
  C:\Windows\System\DpDktvw.exe
  2⤵
  PID:9636
- C:\Windows\System\iXMGwqg.exe
  C:\Windows\System\iXMGwqg.exe
  2⤵
  PID:9724
- C:\Windows\System\vUdYtiE.exe
  C:\Windows\System\vUdYtiE.exe
  2⤵
  PID:9984
- C:\Windows\System\DHTclNl.exe
  C:\Windows\System\DHTclNl.exe
  2⤵
  PID:10016
- C:\Windows\System\yEiITsi.exe
  C:\Windows\System\yEiITsi.exe
  2⤵
  PID:8736
- C:\Windows\System\HDzAPjM.exe
  C:\Windows\System\HDzAPjM.exe
  2⤵
  PID:10296
- C:\Windows\System\voXzJGV.exe
  C:\Windows\System\voXzJGV.exe
  2⤵
  PID:10392
- C:\Windows\System\PqORaGc.exe
  C:\Windows\System\PqORaGc.exe
  2⤵
  PID:10452
- C:\Windows\System\lddaOup.exe
  C:\Windows\System\lddaOup.exe
  2⤵
  PID:10524
- C:\Windows\System\TbPduvz.exe
  C:\Windows\System\TbPduvz.exe
  2⤵
  PID:10548
- C:\Windows\System\iLrkuxR.exe
  C:\Windows\System\iLrkuxR.exe
  2⤵
  PID:10592
- C:\Windows\System\VhWSjSI.exe
  C:\Windows\System\VhWSjSI.exe
  2⤵
  PID:11268
- C:\Windows\System\tqjTSso.exe
  C:\Windows\System\tqjTSso.exe
  2⤵
  PID:11288
- C:\Windows\System\ilFDslx.exe
  C:\Windows\System\ilFDslx.exe
  2⤵
  PID:11312
- C:\Windows\System\EqstnCd.exe
  C:\Windows\System\EqstnCd.exe
  2⤵
  PID:11336
- C:\Windows\System\GazCpUj.exe
  C:\Windows\System\GazCpUj.exe
  2⤵
  PID:11356
- C:\Windows\System\CfzANSr.exe
  C:\Windows\System\CfzANSr.exe
  2⤵
  PID:11380
- C:\Windows\System\GXRmgOQ.exe
  C:\Windows\System\GXRmgOQ.exe
  2⤵
  PID:11400
- C:\Windows\System\TxjbhhY.exe
  C:\Windows\System\TxjbhhY.exe
  2⤵
  PID:11420
- C:\Windows\System\LwqhOOG.exe
  C:\Windows\System\LwqhOOG.exe
  2⤵
  PID:11448
- C:\Windows\System\FghzoMf.exe
  C:\Windows\System\FghzoMf.exe
  2⤵
  PID:11464
- C:\Windows\System\tmkBSIJ.exe
  C:\Windows\System\tmkBSIJ.exe
  2⤵
  PID:11488
- C:\Windows\System\JjJKDTW.exe
  C:\Windows\System\JjJKDTW.exe
  2⤵
  PID:11508
- C:\Windows\System\fdURaSs.exe
  C:\Windows\System\fdURaSs.exe
  2⤵
  PID:11532
- C:\Windows\System\wPSizmd.exe
  C:\Windows\System\wPSizmd.exe
  2⤵
  PID:11556
- C:\Windows\System\XJJVLGz.exe
  C:\Windows\System\XJJVLGz.exe
  2⤵
  PID:11576
- C:\Windows\System\zycXHBM.exe
  C:\Windows\System\zycXHBM.exe
  2⤵
  PID:11600
- C:\Windows\System\MNzGxCs.exe
  C:\Windows\System\MNzGxCs.exe
  2⤵
  PID:11620
- C:\Windows\System\gkweZkj.exe
  C:\Windows\System\gkweZkj.exe
  2⤵
  PID:11640
- C:\Windows\System\COTmuoJ.exe
  C:\Windows\System\COTmuoJ.exe
  2⤵
  PID:11660
- C:\Windows\System\bHNoZZI.exe
  C:\Windows\System\bHNoZZI.exe
  2⤵
  PID:11680
- C:\Windows\System\wXhvLqx.exe
  C:\Windows\System\wXhvLqx.exe
  2⤵
  PID:11708
- C:\Windows\System\KARKpMJ.exe
  C:\Windows\System\KARKpMJ.exe
  2⤵
  PID:11732
- C:\Windows\System\WVFOdBS.exe
  C:\Windows\System\WVFOdBS.exe
  2⤵
  PID:11752
- C:\Windows\System\hQmcLca.exe
  C:\Windows\System\hQmcLca.exe
  2⤵
  PID:11772
- C:\Windows\System\uKHyhmN.exe
  C:\Windows\System\uKHyhmN.exe
  2⤵
  PID:11792
- C:\Windows\System\NQDOAHu.exe
  C:\Windows\System\NQDOAHu.exe
  2⤵
  PID:11816
- C:\Windows\System\ZKbziAN.exe
  C:\Windows\System\ZKbziAN.exe
  2⤵
  PID:11840
- C:\Windows\System\MuOdTTx.exe
  C:\Windows\System\MuOdTTx.exe
  2⤵
  PID:11868
- C:\Windows\System\POpZEoL.exe
  C:\Windows\System\POpZEoL.exe
  2⤵
  PID:11884
- C:\Windows\System\WtlwWhH.exe
  C:\Windows\System\WtlwWhH.exe
  2⤵
  PID:11900
- C:\Windows\System\mbrVsOJ.exe
  C:\Windows\System\mbrVsOJ.exe
  2⤵
  PID:11916
- C:\Windows\System\Qyhelum.exe
  C:\Windows\System\Qyhelum.exe
  2⤵
  PID:11936
- C:\Windows\System\zXrXvgr.exe
  C:\Windows\System\zXrXvgr.exe
  2⤵
  PID:11952
- C:\Windows\System\qIACIqV.exe
  C:\Windows\System\qIACIqV.exe
  2⤵
  PID:11976
- C:\Windows\System\WZCnVQp.exe
  C:\Windows\System\WZCnVQp.exe
  2⤵
  PID:12004
- C:\Windows\System\yqApyKf.exe
  C:\Windows\System\yqApyKf.exe
  2⤵
  PID:12020
- C:\Windows\System\sugLpGY.exe
  C:\Windows\System\sugLpGY.exe
  2⤵
  PID:12040
- C:\Windows\System\kVOlyxX.exe
  C:\Windows\System\kVOlyxX.exe
  2⤵
  PID:12060
- C:\Windows\System\GNwLBQJ.exe
  C:\Windows\System\GNwLBQJ.exe
  2⤵
  PID:12088
- C:\Windows\System\erwMWcG.exe
  C:\Windows\System\erwMWcG.exe
  2⤵
  PID:12124
- C:\Windows\System\qcZrRaJ.exe
  C:\Windows\System\qcZrRaJ.exe
  2⤵
  PID:12148
- C:\Windows\System\oEMSYtu.exe
  C:\Windows\System\oEMSYtu.exe
  2⤵
  PID:12168
- C:\Windows\System\gRIzIfv.exe
  C:\Windows\System\gRIzIfv.exe
  2⤵
  PID:12188
- C:\Windows\System\OyhYpHV.exe
  C:\Windows\System\OyhYpHV.exe
  2⤵
  PID:12212
- C:\Windows\System\TGIOAnt.exe
  C:\Windows\System\TGIOAnt.exe
  2⤵
  PID:12236
- C:\Windows\System\csTgcAq.exe
  C:\Windows\System\csTgcAq.exe
  2⤵
  PID:12252
- C:\Windows\System\OueDjQv.exe
  C:\Windows\System\OueDjQv.exe
  2⤵
  PID:12276
- C:\Windows\System\woZctgI.exe
  C:\Windows\System\woZctgI.exe
  2⤵
  PID:4844
- C:\Windows\System\WXsLRrZ.exe
  C:\Windows\System\WXsLRrZ.exe
  2⤵
  PID:8996
- C:\Windows\System\eUUJoXk.exe
  C:\Windows\System\eUUJoXk.exe
  2⤵
  PID:10804
- C:\Windows\System\KgzfHcV.exe
  C:\Windows\System\KgzfHcV.exe
  2⤵
  PID:8672
- C:\Windows\System\OeDhhji.exe
  C:\Windows\System\OeDhhji.exe
  2⤵
  PID:11000
- C:\Windows\System\RFCvlNc.exe
  C:\Windows\System\RFCvlNc.exe
  2⤵
  PID:8396
- C:\Windows\System\mktIrcL.exe
  C:\Windows\System\mktIrcL.exe
  2⤵
  PID:9300
- C:\Windows\System\sZnhRrj.exe
  C:\Windows\System\sZnhRrj.exe
  2⤵
  PID:9432
- C:\Windows\System\dOsQgFC.exe
  C:\Windows\System\dOsQgFC.exe
  2⤵
  PID:10076
- C:\Windows\System\UPkgaJz.exe
  C:\Windows\System\UPkgaJz.exe
  2⤵
  PID:11240
- C:\Windows\System\baaIGMT.exe
  C:\Windows\System\baaIGMT.exe
  2⤵
  PID:8548
- C:\Windows\System\NzPpDCE.exe
  C:\Windows\System\NzPpDCE.exe
  2⤵
  PID:9340
- C:\Windows\System\XGytDvM.exe
  C:\Windows\System\XGytDvM.exe
  2⤵
  PID:9524
- C:\Windows\System\KQeMXDR.exe
  C:\Windows\System\KQeMXDR.exe
  2⤵
  PID:9932
- C:\Windows\System\LWLtbcG.exe
  C:\Windows\System\LWLtbcG.exe
  2⤵
  PID:10204
- C:\Windows\System\ifGlAsg.exe
  C:\Windows\System\ifGlAsg.exe
  2⤵
  PID:9540
- C:\Windows\System\uJsVuPX.exe
  C:\Windows\System\uJsVuPX.exe
  2⤵
  PID:10572
- C:\Windows\System\FZLnOIQ.exe
  C:\Windows\System\FZLnOIQ.exe
  2⤵
  PID:10652
- C:\Windows\System\lvuwPtZ.exe
  C:\Windows\System\lvuwPtZ.exe
  2⤵
  PID:11308
- C:\Windows\System\MGWiuTc.exe
  C:\Windows\System\MGWiuTc.exe
  2⤵
  PID:11348
- C:\Windows\System\hpCPELm.exe
  C:\Windows\System\hpCPELm.exe
  2⤵
  PID:11376
- C:\Windows\System\PCkJUJO.exe
  C:\Windows\System\PCkJUJO.exe
  2⤵
  PID:12308
- C:\Windows\System\NHzyZhb.exe
  C:\Windows\System\NHzyZhb.exe
  2⤵
  PID:12332
- C:\Windows\System\MImZnfs.exe
  C:\Windows\System\MImZnfs.exe
  2⤵
  PID:12352
- C:\Windows\System\BCfoeIp.exe
  C:\Windows\System\BCfoeIp.exe
  2⤵
  PID:12372
- C:\Windows\System\plugCPm.exe
  C:\Windows\System\plugCPm.exe
  2⤵
  PID:12392
- C:\Windows\System\pkmuoKb.exe
  C:\Windows\System\pkmuoKb.exe
  2⤵
  PID:12412
- C:\Windows\System\dwYGviA.exe
  C:\Windows\System\dwYGviA.exe
  2⤵
  PID:12436
- C:\Windows\System\NQusvAO.exe
  C:\Windows\System\NQusvAO.exe
  2⤵
  PID:12460
- C:\Windows\System\MrbkEoY.exe
  C:\Windows\System\MrbkEoY.exe
  2⤵
  PID:12484
- C:\Windows\System\aAhSBth.exe
  C:\Windows\System\aAhSBth.exe
  2⤵
  PID:12504
- C:\Windows\System\LVgmoMG.exe
  C:\Windows\System\LVgmoMG.exe
  2⤵
  PID:12532
- C:\Windows\System\uBgDFwu.exe
  C:\Windows\System\uBgDFwu.exe
  2⤵
  PID:12548
- C:\Windows\System\XqqgiUI.exe
  C:\Windows\System\XqqgiUI.exe
  2⤵
  PID:12572
- C:\Windows\System\ZEWsmGi.exe
  C:\Windows\System\ZEWsmGi.exe
  2⤵
  PID:12588
- C:\Windows\System\KfSaeKO.exe
  C:\Windows\System\KfSaeKO.exe
  2⤵
  PID:12608
- C:\Windows\System\xSfomXD.exe
  C:\Windows\System\xSfomXD.exe
  2⤵
  PID:12644
- C:\Windows\System\lSgCQnu.exe
  C:\Windows\System\lSgCQnu.exe
  2⤵
  PID:12664
- C:\Windows\System\rOMUCOP.exe
  C:\Windows\System\rOMUCOP.exe
  2⤵
  PID:12688
- C:\Windows\System\esDjibh.exe
  C:\Windows\System\esDjibh.exe
  2⤵
  PID:12704
- C:\Windows\System\cuCEntx.exe
  C:\Windows\System\cuCEntx.exe
  2⤵
  PID:12724
- C:\Windows\System\zTQFPTU.exe
  C:\Windows\System\zTQFPTU.exe
  2⤵
  PID:12748
- C:\Windows\System\RPzVixQ.exe
  C:\Windows\System\RPzVixQ.exe
  2⤵
  PID:12772
- C:\Windows\System\piSXYjc.exe
  C:\Windows\System\piSXYjc.exe
  2⤵
  PID:12796
- C:\Windows\System\OcHVMyM.exe
  C:\Windows\System\OcHVMyM.exe
  2⤵
  PID:12820
- C:\Windows\System\beWIrAj.exe
  C:\Windows\System\beWIrAj.exe
  2⤵
  PID:12840
- C:\Windows\System\wszsHFd.exe
  C:\Windows\System\wszsHFd.exe
  2⤵
  PID:12860
- C:\Windows\System\aGsRbWQ.exe
  C:\Windows\System\aGsRbWQ.exe
  2⤵
  PID:12876
- C:\Windows\System\afgZIAP.exe
  C:\Windows\System\afgZIAP.exe
  2⤵
  PID:12896
- C:\Windows\System\MiuhIGK.exe
  C:\Windows\System\MiuhIGK.exe
  2⤵
  PID:12916
- C:\Windows\System\PywMjaQ.exe
  C:\Windows\System\PywMjaQ.exe
  2⤵
  PID:12936
- C:\Windows\System\DjXuoRE.exe
  C:\Windows\System\DjXuoRE.exe
  2⤵
  PID:12960
- C:\Windows\System\MYzklPe.exe
  C:\Windows\System\MYzklPe.exe
  2⤵
  PID:12976
- C:\Windows\System\IegxrVX.exe
  C:\Windows\System\IegxrVX.exe
  2⤵
  PID:12992
- C:\Windows\System\JJcNyki.exe
  C:\Windows\System\JJcNyki.exe
  2⤵
  PID:13008
- C:\Windows\System\OLUxoap.exe
  C:\Windows\System\OLUxoap.exe
  2⤵
  PID:13028
- C:\Windows\System\rdMFwGZ.exe
  C:\Windows\System\rdMFwGZ.exe
  2⤵
  PID:13044
- C:\Windows\System\QzteuKb.exe
  C:\Windows\System\QzteuKb.exe
  2⤵
  PID:13068
- C:\Windows\System\WkIfQJn.exe
  C:\Windows\System\WkIfQJn.exe
  2⤵
  PID:13092
- C:\Windows\System\qDeGDRs.exe
  C:\Windows\System\qDeGDRs.exe
  2⤵
  PID:13116
- C:\Windows\System\BXdyRhF.exe
  C:\Windows\System\BXdyRhF.exe
  2⤵
  PID:13132
- C:\Windows\System\gGpXfwP.exe
  C:\Windows\System\gGpXfwP.exe
  2⤵
  PID:13152
- C:\Windows\System\NTqAjNz.exe
  C:\Windows\System\NTqAjNz.exe
  2⤵
  PID:13176
- C:\Windows\System\nVGtWtk.exe
  C:\Windows\System\nVGtWtk.exe
  2⤵
  PID:13196
- C:\Windows\System\laaQpXa.exe
  C:\Windows\System\laaQpXa.exe
  2⤵
  PID:13220
- C:\Windows\System\XLBzEOc.exe
  C:\Windows\System\XLBzEOc.exe
  2⤵
  PID:13236
- C:\Windows\System\RDrQngN.exe
  C:\Windows\System\RDrQngN.exe
  2⤵
  PID:13256
- C:\Windows\System\qPaLztE.exe
  C:\Windows\System\qPaLztE.exe
  2⤵
  PID:13276
- C:\Windows\System\lTytMgv.exe
  C:\Windows\System\lTytMgv.exe
  2⤵
  PID:13296
- C:\Windows\System\tYZBKjw.exe
  C:\Windows\System\tYZBKjw.exe
  2⤵
  PID:11396
- C:\Windows\System\RqnQDas.exe
  C:\Windows\System\RqnQDas.exe
  2⤵
  PID:11460
- C:\Windows\System\zcgVECa.exe
  C:\Windows\System\zcgVECa.exe
  2⤵
  PID:11568
- C:\Windows\System\nmDgllL.exe
  C:\Windows\System\nmDgllL.exe
  2⤵
  PID:11612
- C:\Windows\System\YeVrolQ.exe
  C:\Windows\System\YeVrolQ.exe
  2⤵
  PID:11672
- C:\Windows\System\BJhOwsw.exe
  C:\Windows\System\BJhOwsw.exe
  2⤵
  PID:11004
- C:\Windows\System\aOPvgSy.exe
  C:\Windows\System\aOPvgSy.exe
  2⤵
  PID:11800
- C:\Windows\System\AYORnjg.exe
  C:\Windows\System\AYORnjg.exe
  2⤵
  PID:11864
- C:\Windows\System\SCAXIzX.exe
  C:\Windows\System\SCAXIzX.exe
  2⤵
  PID:11924
- C:\Windows\System\RjhgePE.exe
  C:\Windows\System\RjhgePE.exe
  2⤵
  PID:11996
- C:\Windows\System\jYEaNgp.exe
  C:\Windows\System\jYEaNgp.exe
  2⤵
  PID:11216
- C:\Windows\System\dxWCvqr.exe
  C:\Windows\System\dxWCvqr.exe
  2⤵
  PID:10136
- C:\Windows\System\oQQDOqi.exe
  C:\Windows\System\oQQDOqi.exe
  2⤵
  PID:10232
- C:\Windows\System\HXLyARO.exe
  C:\Windows\System\HXLyARO.exe
  2⤵
  PID:12184
- C:\Windows\System\xaAlqqU.exe
  C:\Windows\System\xaAlqqU.exe
  2⤵
  PID:10412
- C:\Windows\System\TpTiFur.exe
  C:\Windows\System\TpTiFur.exe
  2⤵
  PID:10748
- C:\Windows\System\JDzqmlG.exe
  C:\Windows\System\JDzqmlG.exe
  2⤵
  PID:10336
- C:\Windows\System\ECmUQEs.exe
  C:\Windows\System\ECmUQEs.exe
  2⤵
  PID:9700
- C:\Windows\System\LWOmels.exe
  C:\Windows\System\LWOmels.exe
  2⤵
  PID:13320
- C:\Windows\System\ZqLcAge.exe
  C:\Windows\System\ZqLcAge.exe
  2⤵
  PID:13340
- C:\Windows\System\SVyikdQ.exe
  C:\Windows\System\SVyikdQ.exe
  2⤵
  PID:13360
- C:\Windows\System\dcxWzEc.exe
  C:\Windows\System\dcxWzEc.exe
  2⤵
  PID:13380
- C:\Windows\System\YuBzQwc.exe
  C:\Windows\System\YuBzQwc.exe
  2⤵
  PID:13404
- C:\Windows\System\yypsWHC.exe
  C:\Windows\System\yypsWHC.exe
  2⤵
  PID:13428
- C:\Windows\System\pFRmxQr.exe
  C:\Windows\System\pFRmxQr.exe
  2⤵
  PID:13448
- C:\Windows\System\ewoWJov.exe
  C:\Windows\System\ewoWJov.exe
  2⤵
  PID:13468
- C:\Windows\System\NCFZBcZ.exe
  C:\Windows\System\NCFZBcZ.exe
  2⤵
  PID:13492
- C:\Windows\System\VyLtVMH.exe
  C:\Windows\System\VyLtVMH.exe
  2⤵
  PID:13512
- C:\Windows\System\NVxGgYn.exe
  C:\Windows\System\NVxGgYn.exe
  2⤵
  PID:13540
- C:\Windows\System\ANfYLCl.exe
  C:\Windows\System\ANfYLCl.exe
  2⤵
  PID:13560
- C:\Windows\System\urouLVC.exe
  C:\Windows\System\urouLVC.exe
  2⤵
  PID:13576
- C:\Windows\System\MqPVWHN.exe
  C:\Windows\System\MqPVWHN.exe
  2⤵
  PID:13600
- C:\Windows\System\DNKsJTr.exe
  C:\Windows\System\DNKsJTr.exe
  2⤵
  PID:13616
- C:\Windows\System\vLEiwVL.exe
  C:\Windows\System\vLEiwVL.exe
  2⤵
  PID:13640
- C:\Windows\System\zXyutTo.exe
  C:\Windows\System\zXyutTo.exe
  2⤵
  PID:13660
- C:\Windows\System\dIpkIjn.exe
  C:\Windows\System\dIpkIjn.exe
  2⤵
  PID:13684
- C:\Windows\System\ePxtFJm.exe
  C:\Windows\System\ePxtFJm.exe
  2⤵
  PID:13708
- C:\Windows\System\BqgqQVN.exe
  C:\Windows\System\BqgqQVN.exe
  2⤵
  PID:13732
- C:\Windows\System\YMsOgeG.exe
  C:\Windows\System\YMsOgeG.exe
  2⤵
  PID:13752
- C:\Windows\System\aPHcoTQ.exe
  C:\Windows\System\aPHcoTQ.exe
  2⤵
  PID:13776
- C:\Windows\System\rvaBefi.exe
  C:\Windows\System\rvaBefi.exe
  2⤵
  PID:13800
- C:\Windows\System\KyZzufs.exe
  C:\Windows\System\KyZzufs.exe
  2⤵
  PID:13824
- C:\Windows\System\HtHTClP.exe
  C:\Windows\System\HtHTClP.exe
  2⤵
  PID:13848
- C:\Windows\System\CvYYfTq.exe
  C:\Windows\System\CvYYfTq.exe
  2⤵
  PID:13864
- C:\Windows\System\UwdrbYv.exe
  C:\Windows\System\UwdrbYv.exe
  2⤵
  PID:13884
- C:\Windows\System\luezupr.exe
  C:\Windows\System\luezupr.exe
  2⤵
  PID:13904
- C:\Windows\System\sYoJVyS.exe
  C:\Windows\System\sYoJVyS.exe
  2⤵
  PID:13932
- C:\Windows\System\OpRRLCx.exe
  C:\Windows\System\OpRRLCx.exe
  2⤵
  PID:13956
- C:\Windows\System\MPKpBrX.exe
  C:\Windows\System\MPKpBrX.exe
  2⤵
  PID:13976
- C:\Windows\System\NnGtGcO.exe
  C:\Windows\System\NnGtGcO.exe
  2⤵
  PID:14000
- C:\Windows\System\MdLcrCh.exe
  C:\Windows\System\MdLcrCh.exe
  2⤵
  PID:14020
- C:\Windows\System\DqltGYS.exe
  C:\Windows\System\DqltGYS.exe
  2⤵
  PID:12524
- C:\Windows\System\oUhYwmO.exe
  C:\Windows\System\oUhYwmO.exe
  2⤵
  PID:9912
- C:\Windows\System\FceOGHL.exe
  C:\Windows\System\FceOGHL.exe
  2⤵
  PID:11896
- C:\Windows\System\eYdZPcw.exe
  C:\Windows\System\eYdZPcw.exe
  2⤵
  PID:10180
- C:\Windows\System\ZBAUIGq.exe
  C:\Windows\System\ZBAUIGq.exe
  2⤵
  PID:13316
- C:\Windows\System\SXEdxgN.exe
  C:\Windows\System\SXEdxgN.exe
  2⤵
  PID:13400
- C:\Windows\System\RgCgnay.exe
  C:\Windows\System\RgCgnay.exe
  2⤵
  PID:11504

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:10704

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:9636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ATxFewg.exe

Filesize
1.6MB

MD5
12a7f0bdde8df153380eb1029b6af937

SHA1
cb3a05d44b19f2b1f0b6e6bacd627038ce55331c

SHA256
8139d3b330bd6b9f9955f99bd476804fe705da893beffa80d97d415a604de08c

SHA512
51771b15d2ec58b3fda4d393c5867994d9df5de91b0f7db0cd0b0636a6b6b4f5c2645e287a5d345b74c36a763f61edd78c9ec5f5dfd44046612f954fc08a1768

Download Submit
C:\Windows\System\CCWBkTP.exe

Filesize
1.6MB

MD5
5d7643cc931fe5d21154c222225129f7

SHA1
b7fab16f6debfe9c9186b005742c4adf6dc4a750

SHA256
3e0eece4486a516f09b6e4b770ac12faacb66fc66727d682adfa7f4ab6c7350d

SHA512
9f503869e7e15513c770b1335334dcb697c165e79eb010bdf7e30f5abf6752be2d94892d43db14a277e4dbf1f91237bfdca758abb4c180ffcdf1855f6f369f21

Download Submit
C:\Windows\System\DTptGNX.exe

Filesize
1.5MB

MD5
b02b377fa373cb426ce41f7563c5906b

SHA1
1dcadd4a1322dc47036a814d43d1d3de45eda08d

SHA256
1b511f20fc1c5740ff41cfe58fa777ad360eda0789986f3a0d3b62f8d3976386

SHA512
d18cefdffeb59c255ae35d46168a5b656d6d9cddef961ac0532e6723496e2e784d7e2f8a3fe2e1db179cf9c8d03ff98f4a33e4b7425800890734fc1a374cf3ec

Download Submit
C:\Windows\System\FKzGazl.exe

Filesize
1.5MB

MD5
9a84fa6e52296f81ba41b7224b6f6ae3

SHA1
fc531a9a5a817807f43010ee132d4536040f2429

SHA256
ef6d876b895b0b332eaf5f09bd569123c570ec63016137711076ae933c94de5b

SHA512
a906e9f239fd47a700068b72e982c0c6bc1f792e5e0cf4c28bec21672b9ebed193e5e4933789cc37b67c5c72a6f4f07309e124d06e003c3bdb74ca2705802940

Download Submit
C:\Windows\System\FkrxtUC.exe

Filesize
1.6MB

MD5
351e7b5e9bd77844b33f5a78594649da

SHA1
3c87a55f28b9c01e0c8042f310837c61f2d0ccee

SHA256
ab67beb77c17e7589fb0e11396bbab418bed19868707abb8680551e3b9a842ea

SHA512
5afe13fa5e43dfbd1142e8a1ff8cfb7f1df604e9a927ed0485fc4353708e2e1849ba5a1d3be9e5f025cb7bc5b2a5415226bfbf5df4d26b814dc9d96f5072c162

Download Submit
C:\Windows\System\HbivrvG.exe

Filesize
1.6MB

MD5
e2d4d93fc966686f55ff68d3e2bb5a42

SHA1
4034f56b6d0774711bd0858e8afd0dbe24848146

SHA256
879faf390f318c7ced79f5a29cae5fdcb76c41a803289eb2127dd52b34ca12ed

SHA512
45cb6049f896f9ecdee3a4ac1933c8983eec11e6aca1c2a48567b3e61c454fd5a92c523e9682321d9bc66be7f6c29dd998f543c1c361bdbf9ac0ee2c242b1a97

Download Submit
C:\Windows\System\JPRcabN.exe

Filesize
1.6MB

MD5
cc73e58c61d3818326b1b3c2a4a08744

SHA1
5a2b5a66c0668f6d94397d16c5aa5243ca9cdb9b

SHA256
a32e02c1d40253c16203537cd6bc99882c72c2568192c18b23a7f5e0fa5b78f1

SHA512
760d48f164514ffcb83863f5baeaedad60c6818dfe138a5eef6f136a0946be34840c292468accc9cbc89abd61eb44d3e137eedf5eb922a596cb3b5f5113c8fcb

Download Submit
C:\Windows\System\LWLOQpx.exe

Filesize
1.5MB

MD5
652f7331127dbfde34cf1828223f34c0

SHA1
2e1a0edc7d6b16a85858ad3c93bb677adfcab4f8

SHA256
eeb9025dcbd8a434afb29db072a61f94db2ad20677476f5c03767aa91162f77d

SHA512
7b5423ead47f60f262863b578fe8f658ea69524d1bc3dc82037b80035229da237a6188164f184c35b08ae9f4d67cf57bb642b66101c717c780001f93dee48b23

Download Submit
C:\Windows\System\MOySDyp.exe

Filesize
1.5MB

MD5
ef5829d99fb626bfe21339c8fcae64ae

SHA1
addab26e20de3d2515ce7b9039e666898b8f71f8

SHA256
93e993cd6ff29f9b7095c6641025f7ba0ad746b83e87a1c306aee12d06f0d116

SHA512
b3c791c92c0a7c3aed2b109429d15ea43a8ae5d5bcdacff5322065c0075c6ba4c37200d849e2c87a26a78f4c795070314fe4156900fff5742256405b337aa7e2

Download Submit
C:\Windows\System\MqYWeDW.exe

Filesize
1.6MB

MD5
021e9e98c67518959d045d5b628ab360

SHA1
e2d8d236ac1165045b86feabf6bb282018f05b34

SHA256
cec33c59a4775445871cd31576ea6f8ad047754e42c15024b1bac4a4eafa347d

SHA512
9acd0da25d4ef9596f546e4ed43d1f5071494d86a5e48432f429eb75c4569d0780865f53f0baa1bf765396a30d132c5e301122b921dab63729132e5abcd3bfb1

Download Submit
C:\Windows\System\NHPziwE.exe

Filesize
1.5MB

MD5
72623adadb16d98e5fac94122994d2b5

SHA1
e52e717f08be89da31eecf594d23685748bbd1b6

SHA256
354e2e3e306c2602625725cd8c9c1e7d738d099444c27e07779ec77200f9cdcb

SHA512
8f823d6cec6aa8561e78a8883c281ebac235e3f22e3b995df7b3b473cc8a62f764d16af5d0f5bb8b9af7b0213141dbc90f69e2b874a996c4d2d213f61712b88d

Download Submit
C:\Windows\System\NNIxUhU.exe

Filesize
1.5MB

MD5
b3d2038c2e2327a878e15de4dfeb44ec

SHA1
271589f7c723ddcca07bf3aedd932050b5246d88

SHA256
59012b65d6e55befbe91cbb4e6e6fbdc649774c950f6deeb6badf339fb0f6e36

SHA512
f50682140b908ffc52812dcd1e47125ffbc7a3e02178708daa7ced85cb6091abeec614172279ba359fc1d9dabe12375a2a317d3f6b984d145e0d187d0899dbe0

Download Submit
C:\Windows\System\PXiBzHi.exe

Filesize
1.5MB

MD5
3404858c3f418288fc8139ff74f78b9c

SHA1
2460bdd30d0d687c8c8e824e74123730d023ce49

SHA256
dac8fa31aee2a5019ce1261457e943386287f9fbd3a2b361173617b64b23f3f8

SHA512
5a4b862bda7f8d91bcf19363217825bf75ee59d1104c543438fbb5f96b2b5f327a20cc367b4a9712f01d6931bd0bcef03a3dccf13197bbf9d48465bbff8e7bf7

Download Submit
C:\Windows\System\PagjvcD.exe

Filesize
1.6MB

MD5
1afa387179b6d4ef61ca5ae0d1de1776

SHA1
6c25e9f7f85981b2258ac321a7e7aac25ad07060

SHA256
0e6998f083dd62e86c987128a9ed25e5f0f11887e21a76ebb284d79518f01eff

SHA512
9df13341318d77cd018d9ae299ce8419843c7822fdbe64befadfb97376af168f9346f05615d686db05fbec8c886a8a03f037192dcae53140864312dbcd7d40be

Download Submit
C:\Windows\System\RVjlrCJ.exe

Filesize
1.6MB

MD5
25ee5624d5aede34575b083c85e28aff

SHA1
9e858679faa8cebd3058fe2e30a3bc54546f1908

SHA256
24b813f080404b51c030d70855ed66a5f0058714841b86e4b768e6b2e69e680d

SHA512
0c0422d0caef1e8259e1cd0cf7904d131dea11eb7cdb258ea5afb9d7645c949589aed5d369953649d1286a2e060188bfcaaa1798d40df23ac389574a935c5e23

Download Submit
C:\Windows\System\SEQwTnD.exe

Filesize
1.5MB

MD5
2507855e29e3091ae74bd048f92566cd

SHA1
9181be7e4847940cc27af4602139ab5454fb44df

SHA256
798e764031f837cdb81c98fa9c812adf45ec177843a7d6cd393260b4f66f14e1

SHA512
c56eac730d60daf17e0c77942d13f03a6e213045919b18cf4868700e1768622df6386c6cb00136adb3d4237dd90819212b66adbb524822eb29957cbcf0024f72

Download Submit
C:\Windows\System\WfIgvqW.exe

Filesize
1.5MB

MD5
14bcda3117c5c0b4ac9887e9b18297b2

SHA1
9aa0c13a0ff080da02faf3bc6f79da36375fc1c0

SHA256
5765f7ee712cbd5ddb6f24aa1ebb1fcec674e181106ec86beb1ec7823c470b3a

SHA512
a3ac0068ba40b50bb5d39a4656daaf702c822ce01e3eab7d27bbb25c82f7091ee465d94e9389505ff93eacc73d141ce0fdf43d1555c2249fee2c01289e8c83d2

Download Submit
C:\Windows\System\XKWExPk.exe

Filesize
1.5MB

MD5
094764cf3f5c9af375d7ed696ed09dfa

SHA1
83de63e1c0e3921c577d0eb248218a09d7e71b92

SHA256
d9f08b492292e7e0fa8440b1fa8f40e26fb7361a3b0850cb7cce8497ce283655

SHA512
aaa9440987d18ba253d5f9ab83637e53867a2f9c26e605ef7bc887f732c43bcc72d1dd614abd00335d472c80da05a12041b893deee04d15b3ba4181d695e6d85

Download Submit
C:\Windows\System\XSXUrUi.exe

Filesize
1.5MB

MD5
ccee2492b913ff4842d485de24d6004a

SHA1
bb05b659d6fd51ad313f5c3a51fbe6b78c700993

SHA256
96c7c3a45b374ebdd500621676b7370db5ab0c8d25f8bda1e9641633dfb0e935

SHA512
abd3a7af7d700523f4d9d3146228b3647caca82f44c9fef3a12c4385f534c18463ec588e67f1afdb8dc2753d20399fc7602d852f8f5669ff883463d25daed370

Download Submit
C:\Windows\System\YjFhEvq.exe

Filesize
1.6MB

MD5
0908982ed5d1e3520829c998e4749ad9

SHA1
4076ecd82b1003189cab1a04e6c56ff64b05ddec

SHA256
8ea5bf478a3ce70f28643578801c152d871ed306939562049363b25594f73cc5

SHA512
9cfa9ee74b4f9cdb0763b00faee9a839f474d19aa89a4d20825c1851abcb26581d18c77d26fb6979d99e36d90f905cf610561a11de8681f4226696e7f606971b

Download Submit
C:\Windows\System\ZMruhNW.exe

Filesize
1.6MB

MD5
d8756629b1c0766d3029b0a9c55c6cd9

SHA1
775dce772ae2d6cd83c16dffeb4ade2ddd8df1f8

SHA256
17ab53a332297418a474384b03d395a61f9f062eb521f59c119e38b239934286

SHA512
2f696d2eef2ee69fe4904af0cf7de0a8171d6edc6d8ccb880c591ddc836086f65a4efbedb52c3e6f1f564ff05fd77d87799229dfca78b94e225fabe3993ab4b6

Download Submit
C:\Windows\System\aSJNRyM.exe

Filesize
1.6MB

MD5
811da5f22e2bece1673939f85947785c

SHA1
0a3f7c5d9c30d46f2e1442175807fbf6a14540ba

SHA256
2ffc56f75aa02b10f9c3c8f813b932d96f6d948a3febe2984b6b089c0b625125

SHA512
937e51e2dd3492a7ae442c691fa64ecbb42525c754abb83100e95773f62bc0b8d8df288270a35f08b4a6b3d89932b9727bf6d266d29ab0b2d75f859f09b6c3bb

Download Submit
C:\Windows\System\aoktvqU.exe

Filesize
1.6MB

MD5
1a0c14d4a633ebe656e3ac727581dc80

SHA1
3a56a8382993ca999ba5190da8b1228433d5039b

SHA256
84164eec778a4cc229037f8dd44380fdb160fa655741afe8c6618259ff834a63

SHA512
02d16ba631b189b2c8c3deb6269addbf4e1d23789b42cd172fdb6f8a1e835d45be591ccd48b28d9475b22252aeed2a06aeb4cfb506584333afb39143601f2cb7

Download Submit
C:\Windows\System\atSdlFe.exe

Filesize
1.5MB

MD5
aa9b0b11ff77f7dec8f646dc45c91285

SHA1
c443125de400760f25ff998307dcd6868dc89432

SHA256
7075a39fb182e3c7db4de1d138f64d9d06c4ab3d2b724eb7e28e27ef831fb6b9

SHA512
a33fe210f34a272c6749254168edfa67c9b4a75ce191b76c8eee6171b30ccca267217bb22f6cf9d6aebe0090e41914035c1eda7dbd92e0f54f815d3829a30542

Download Submit
C:\Windows\System\cViMcIW.exe

Filesize
1.6MB

MD5
f84f1c6d96cc4f851cce68c55b6592d8

SHA1
ff59ce75bfdf6a361624262b445e7d3bd06ec24b

SHA256
be19a8f0c12f55237f383a98b5de66ba44ca90c4cbb213fd05057cf9d7f72e7c

SHA512
8359a5ec350bb444652ec201a0cd876bf2cfc1386ac37f01d30b2a80a1f6e89a9a8957429c5ebf3dd3b018d83f59d89bd258eb3ad8da568ad43e6c5f3023c20d

Download Submit
C:\Windows\System\eHVhKTh.exe

Filesize
1.5MB

MD5
1bcfc0009ff4d23b34476a3cb78f4eb2

SHA1
475b07516103489fa407b597a1a6a76818255890

SHA256
5b4696099a1a867e3416e58b32f04cfd88d6c07d6e41d5ef61e74910ca4b1c4d

SHA512
ca4df29854630ee2b7d431db754aad988b19e4b158e94b5291e34ef337bce964efd24136c2be1992cf1e7ea9da182a97e283fbf9a8b8f8c04a626b2b5d72e6fd

Download Submit
C:\Windows\System\euttSrr.exe

Filesize
1.6MB

MD5
77a8696b5e3423108cba6246e6928ea2

SHA1
36902ac17470291e83c3cb3b89659d12ad9ddb5f

SHA256
bdfc5ccf0260dcd4523d9fecc5cb0af2f012d1c51cc6ced8d9cf22864198f470

SHA512
ae3724d250c970e3845dbe199335ec9f092be9d50334c01ec3783c00ccab903e80e27cf507443d83b6ba87484e733ec69a2c257a1cfb6a5d6578eb592b728d1d

Download Submit
C:\Windows\System\iHCJXyD.exe

Filesize
1.5MB

MD5
d910d965f4346ffd9b8a9cc7e6d97016

SHA1
28e030bccc684570ab7c6cc7f117bfa238dadc59

SHA256
ad66359c635d865f5e45d3c89b508d59e20d619c1d7c8f5e9bee7ce50f678068

SHA512
ee59a99afb564bbebfd4a8286fda2c42a8189d784f21e81eff0af3ccf7733fbdfc31121bdecf7ea600fb691d64326933edf9f9cbe36280ca799464945e0752dd

Download Submit
C:\Windows\System\iMdYryr.exe

Filesize
1.5MB

MD5
a78bbc1c897fb0d2352a62822c92afbd

SHA1
c2ad6fc9a8c6f89a71eb91d0904791c61485d075

SHA256
4af5ca53f8bfe408d64ccd0fdce905d14d1a2a639a3da5cd6d91a98c19e265d3

SHA512
7df5373a9a1984298ae228287fe0cd61faed20e5c6e40faecca2e363a5f4ec1b40fef5ca2ae5852acbbf69d0f034f121362d3c8478ef66dab74ddc3f227b7fb6

Download Submit
C:\Windows\System\jRWcKtA.exe

Filesize
1.6MB

MD5
3f0eee02958bd4e9de9fc8f35a4db9e1

SHA1
a1d1cc2ddb8df21804fa990deab6916b064cbe8e

SHA256
f05802ac6d6802bc79df7366c92ef94215c1131858b58f2c659433385edae12a

SHA512
78cb959b8d428265e1e4ce3b60563f13e0eae633e681aa23b31e4d11c65b6548f9acc1ad65b845b5db11b475d46688d5ad5aa6010f09ddc9faab80a37748b87d

Download Submit
C:\Windows\System\kkQUBDu.exe

Filesize
1.5MB

MD5
e7cca9bd9a7a6f97e20138da0c0011c3

SHA1
b722422f227d9d1392e9aca5cbd471330092b1f4

SHA256
46ef4a579c897ea8ae94fe9fcd47b888f2b29bd8bdcbbd3770682828f5c911cf

SHA512
28e57f20529e7f5e73d1065a1216abff4896b5f02dc823c88d385b87e9c08a3516835c560c36662bf675a58472fcb8466c7fb19da23d8dfc52685c98ba890f62

Download Submit
C:\Windows\System\kqBDHdA.exe

Filesize
1.5MB

MD5
11c75e6db01a68981cd3c15881c361ea

SHA1
babdbe7ea2132a20ade9947907c0735300203e15

SHA256
354c370b56c4a3bd3b6e23c1a22c90ccc3774205c4098c86bb0ed823984dfb6b

SHA512
c29c4c01e273a35584705d66a61e9162535f0f8d3ebc02273d3daa07bf6e698ee06cc1d04e4f3dfe0684e37accdef6c121deea133587becd3d02087e887626bb

Download Submit
C:\Windows\System\nbongPj.exe

Filesize
1.5MB

MD5
f43321ddf58d405e329b1078089a9ed0

SHA1
9b89acd411110d9852f1018afa3df7c844955aee

SHA256
ad3fbe1d6a76ed871afbf632323697e0801a0a3c9953f7ce795e54c34b152691

SHA512
dc6a69df5263a652f4fdf3d198e799746e5bf7f655a5f601d55d698e4e6a1526b319957678bd53729a5ea0265c0d4aa65a255a81ee88efc0473d2853a82631f7

Download Submit
C:\Windows\System\sIxMXAy.exe

Filesize
1.5MB

MD5
0b15259e98995b4309ee808845be108f

SHA1
70eeada384ef3bb09d9abf2fff1b09d68f3d728d

SHA256
c5911be2ab5c686c7772b73d57159a64edeef681b443249f22b302a69e82a630

SHA512
27736133775dc320be87d8c969b96215b90e363f3f2e7da21b441795631e0aa7671d6626261637b71e7f54693fcb9a348eb8162e1791afe5aa9ce737748d11d6

Download Submit
C:\Windows\System\vfNzlAb.exe

Filesize
1.6MB

MD5
e13695b8e56f590b6f27659340dcd08f

SHA1
6f75324377ff5927f2e5ae4f5d001817850d17c8

SHA256
3625bd189db9b1f4d80ea41b28c1e8e17001a5dd658975d090775959f0462a9a

SHA512
6e1cbc505a26e782f512181c60e39b480e56f2219121776b848e8c748e91c690c7017f6502b85a6100c7778e9e6d8b16473a1314de7cfa2f605594b8b7c4cb1e

Download Submit
C:\Windows\System\xakVcsv.exe

Filesize
1.5MB

MD5
dafdc584118a2fc83bb628e957e86468

SHA1
3abdf6a04b9f2ec4606127f165ef8abb28c0cd20

SHA256
3a6aa41a1ac25a4f79d6f8e06cf70e58bf48de36fd11eb3cfb6dc276d921313f

SHA512
7c521689cfe103d206f75dde762dc46888207a41dc474160af8c42d209797df34d08768ea7c8b3962bfa2437c3d2d00566cccd06fdf1c375eb384d6b00befc33

Download Submit
C:\Windows\System\xkyuySA.exe

Filesize
1.6MB

MD5
cc3e0a405e77196e21655accf8b24e3d

SHA1
3e924a598f35fe15165bf709fe3b3cea2a482ed5

SHA256
74e63e09ebb6fc61be0ec2f3ea6caf553311187ea3cb60aca6f9eacd8a87c686

SHA512
845ff329989684c75836c675d292f00c7bf9e85415b9022956734f5ba484bfd4605e19a612c9f75c23564134d2e75597f8ab202b2d7fce4be6089c0b2a6f3870

Download Submit
C:\Windows\System\zFQlhiv.exe

Filesize
1.5MB

MD5
217d90c1642860e7c233a5f472d7bc94

SHA1
e36a71ca3d7aae5972fe62caf72c589d09519f36

SHA256
47b46d41a1fefabfd9f764de52fd843ee8430f958f59600a3ed12c47e9073909

SHA512
1099b5470e940bc32842603fc4eaf0d94921857e9bd9534df9bcc9a16e66966b31a1d5a9f86b26a72f43b31ba2fd6784403df4710ba39b9a793f227237a19deb

Download Submit
memory/208-24-0x00007FF7E6010000-0x00007FF7E6361000-memory.dmp

Filesize
3.3MB

Download
memory/208-2253-0x00007FF7E6010000-0x00007FF7E6361000-memory.dmp

Filesize
3.3MB

Download
memory/208-2244-0x00007FF7E6010000-0x00007FF7E6361000-memory.dmp

Filesize
3.3MB

Download
memory/456-2270-0x00007FF655FF0000-0x00007FF656341000-memory.dmp

Filesize
3.3MB

Download
memory/456-168-0x00007FF655FF0000-0x00007FF656341000-memory.dmp

Filesize
3.3MB

Download
memory/736-2242-0x00007FF7D3B10000-0x00007FF7D3E61000-memory.dmp

Filesize
3.3MB

Download
memory/736-2251-0x00007FF7D3B10000-0x00007FF7D3E61000-memory.dmp

Filesize
3.3MB

Download
memory/736-9-0x00007FF7D3B10000-0x00007FF7D3E61000-memory.dmp

Filesize
3.3MB

Download
memory/752-502-0x00007FF6C8A90000-0x00007FF6C8DE1000-memory.dmp

Filesize
3.3MB

Download
memory/752-2271-0x00007FF6C8A90000-0x00007FF6C8DE1000-memory.dmp

Filesize
3.3MB

Download
memory/1056-124-0x00007FF74EC60000-0x00007FF74EFB1000-memory.dmp

Filesize
3.3MB

Download
memory/1056-2286-0x00007FF74EC60000-0x00007FF74EFB1000-memory.dmp

Filesize
3.3MB

Download
memory/1276-115-0x00007FF752C20000-0x00007FF752F71000-memory.dmp

Filesize
3.3MB

Download
memory/1276-2249-0x00007FF752C20000-0x00007FF752F71000-memory.dmp

Filesize
3.3MB

Download
memory/1276-2284-0x00007FF752C20000-0x00007FF752F71000-memory.dmp

Filesize
3.3MB

Download
memory/1892-2246-0x00007FF6BBB20000-0x00007FF6BBE71000-memory.dmp

Filesize
3.3MB

Download
memory/1892-2259-0x00007FF6BBB20000-0x00007FF6BBE71000-memory.dmp

Filesize
3.3MB

Download
memory/1892-61-0x00007FF6BBB20000-0x00007FF6BBE71000-memory.dmp

Filesize
3.3MB

Download
memory/2076-2274-0x00007FF615F80000-0x00007FF6162D1000-memory.dmp

Filesize
3.3MB

Download
memory/2076-507-0x00007FF615F80000-0x00007FF6162D1000-memory.dmp

Filesize
3.3MB

Download
memory/2572-509-0x00007FF687870000-0x00007FF687BC1000-memory.dmp

Filesize
3.3MB

Download
memory/2572-2294-0x00007FF687870000-0x00007FF687BC1000-memory.dmp

Filesize
3.3MB

Download
memory/2588-290-0x00007FF77F2E0000-0x00007FF77F631000-memory.dmp

Filesize
3.3MB

Download
memory/2588-2304-0x00007FF77F2E0000-0x00007FF77F631000-memory.dmp

Filesize
3.3MB

Download
memory/2620-478-0x00007FF61C2E0000-0x00007FF61C631000-memory.dmp

Filesize
3.3MB

Download
memory/2620-2276-0x00007FF61C2E0000-0x00007FF61C631000-memory.dmp

Filesize
3.3MB

Download
memory/2724-506-0x00007FF6AA520000-0x00007FF6AA871000-memory.dmp

Filesize
3.3MB

Download
memory/2724-2266-0x00007FF6AA520000-0x00007FF6AA871000-memory.dmp

Filesize
3.3MB

Download
memory/3200-2296-0x00007FF60BC00000-0x00007FF60BF51000-memory.dmp

Filesize
3.3MB

Download
memory/3200-409-0x00007FF60BC00000-0x00007FF60BF51000-memory.dmp

Filesize
3.3MB

Download
memory/3456-2315-0x00007FF6FB9C0000-0x00007FF6FBD11000-memory.dmp

Filesize
3.3MB

Download
memory/3456-421-0x00007FF6FB9C0000-0x00007FF6FBD11000-memory.dmp

Filesize
3.3MB

Download
memory/3740-2257-0x00007FF719100000-0x00007FF719451000-memory.dmp

Filesize
3.3MB

Download
memory/3740-2245-0x00007FF719100000-0x00007FF719451000-memory.dmp

Filesize
3.3MB

Download
memory/3740-47-0x00007FF719100000-0x00007FF719451000-memory.dmp

Filesize
3.3MB

Download
memory/3768-63-0x00007FF690000000-0x00007FF690351000-memory.dmp

Filesize
3.3MB

Download
memory/3768-2267-0x00007FF690000000-0x00007FF690351000-memory.dmp

Filesize
3.3MB

Download
memory/3768-2247-0x00007FF690000000-0x00007FF690351000-memory.dmp

Filesize
3.3MB

Download
memory/4012-315-0x00007FF62B8C0000-0x00007FF62BC11000-memory.dmp

Filesize
3.3MB

Download
memory/4012-2302-0x00007FF62B8C0000-0x00007FF62BC11000-memory.dmp

Filesize
3.3MB

Download
memory/4064-72-0x00007FF63CC60000-0x00007FF63CFB1000-memory.dmp

Filesize
3.3MB

Download
memory/4064-2282-0x00007FF63CC60000-0x00007FF63CFB1000-memory.dmp

Filesize
3.3MB

Download
memory/4104-249-0x00007FF617670000-0x00007FF6179C1000-memory.dmp

Filesize
3.3MB

Download
memory/4104-2307-0x00007FF617670000-0x00007FF6179C1000-memory.dmp

Filesize
3.3MB

Download
memory/4236-503-0x00007FF65DB30000-0x00007FF65DE81000-memory.dmp

Filesize
3.3MB

Download
memory/4236-2263-0x00007FF65DB30000-0x00007FF65DE81000-memory.dmp

Filesize
3.3MB

Download
memory/4268-2298-0x00007FF79E660000-0x00007FF79E9B1000-memory.dmp

Filesize
3.3MB

Download
memory/4268-250-0x00007FF79E660000-0x00007FF79E9B1000-memory.dmp

Filesize
3.3MB

Download
memory/4520-420-0x00007FF6D0AE0000-0x00007FF6D0E31000-memory.dmp

Filesize
3.3MB

Download
memory/4520-2308-0x00007FF6D0AE0000-0x00007FF6D0E31000-memory.dmp

Filesize
3.3MB

Download
memory/4696-88-0x00007FF7ECAF0000-0x00007FF7ECE41000-memory.dmp

Filesize
3.3MB

Download
memory/4696-2262-0x00007FF7ECAF0000-0x00007FF7ECE41000-memory.dmp

Filesize
3.3MB

Download
memory/4696-2248-0x00007FF7ECAF0000-0x00007FF7ECE41000-memory.dmp

Filesize
3.3MB

Download
memory/4780-2306-0x00007FF7AA5D0000-0x00007FF7AA921000-memory.dmp

Filesize
3.3MB

Download
memory/4780-508-0x00007FF7AA5D0000-0x00007FF7AA921000-memory.dmp

Filesize
3.3MB

Download
memory/4808-359-0x00007FF6F4020000-0x00007FF6F4371000-memory.dmp

Filesize
3.3MB

Download
memory/4808-2299-0x00007FF6F4020000-0x00007FF6F4371000-memory.dmp

Filesize
3.3MB

Download
memory/4816-2144-0x00007FF6CAF10000-0x00007FF6CB261000-memory.dmp

Filesize
3.3MB

Download
memory/4816-1-0x000002D85E0E0000-0x000002D85E0F0000-memory.dmp

Filesize
64KB

Download
memory/4816-0-0x00007FF6CAF10000-0x00007FF6CB261000-memory.dmp

Filesize
3.3MB

Download
memory/4888-11-0x00007FF7386C0000-0x00007FF738A11000-memory.dmp

Filesize
3.3MB

Download
memory/4888-2243-0x00007FF7386C0000-0x00007FF738A11000-memory.dmp

Filesize
3.3MB

Download
memory/4888-2255-0x00007FF7386C0000-0x00007FF738A11000-memory.dmp

Filesize
3.3MB

Download
memory/4956-2278-0x00007FF7479B0000-0x00007FF747D01000-memory.dmp

Filesize
3.3MB

Download
memory/4956-310-0x00007FF7479B0000-0x00007FF747D01000-memory.dmp

Filesize
3.3MB

Download
memory/4960-2280-0x00007FF70E760000-0x00007FF70EAB1000-memory.dmp

Filesize
3.3MB

Download
memory/4960-208-0x00007FF70E760000-0x00007FF70EAB1000-memory.dmp

Filesize
3.3MB

Download
memory/4996-432-0x00007FF6C2BD0000-0x00007FF6C2F21000-memory.dmp

Filesize
3.3MB

Download
memory/4996-2289-0x00007FF6C2BD0000-0x00007FF6C2F21000-memory.dmp

Filesize
3.3MB

Download