xmrig | 251fd567173ad7687e58b77556300ff421c944447cdc82756d55c81926d2bb68

Analysis

max time kernel
92s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
Size

1.4MB
MD5

5f4d6499868dec059916358c3d248720
SHA1

8ced779d30d5d1c835b393819b324f60db61d381
SHA256

251fd567173ad7687e58b77556300ff421c944447cdc82756d55c81926d2bb68
SHA512

6439eb934e6c23b65311957528f294e215fb716201fd66b46cbbac309f5efe805734f4172149fbdcb1be2ea2fe05fa30a110d8ace75eab9f15518d3f875e4a8a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6rdwwvit:Lz071uv4BPMkFfdk2afGwwvY

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3628-734-0x00007FF775070000-0x00007FF775462000-memory.dmp	xmrig
behavioral2/memory/4476-737-0x00007FF6B6DF0000-0x00007FF6B71E2000-memory.dmp	xmrig
behavioral2/memory/3680-739-0x00007FF7A78B0000-0x00007FF7A7CA2000-memory.dmp	xmrig
behavioral2/memory/4944-740-0x00007FF6437C0000-0x00007FF643BB2000-memory.dmp	xmrig
behavioral2/memory/4712-1220-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp	xmrig
behavioral2/memory/316-1215-0x00007FF7F7BF0000-0x00007FF7F7FE2000-memory.dmp	xmrig
behavioral2/memory/116-1501-0x00007FF74EBB0000-0x00007FF74EFA2000-memory.dmp	xmrig
behavioral2/memory/1192-1783-0x00007FF783640000-0x00007FF783A32000-memory.dmp	xmrig
behavioral2/memory/224-1849-0x00007FF771690000-0x00007FF771A82000-memory.dmp	xmrig
behavioral2/memory/4908-1847-0x00007FF78A5A0000-0x00007FF78A992000-memory.dmp	xmrig
behavioral2/memory/1840-738-0x00007FF6A6890000-0x00007FF6A6C82000-memory.dmp	xmrig
behavioral2/memory/4824-736-0x00007FF6D2540000-0x00007FF6D2932000-memory.dmp	xmrig
behavioral2/memory/3440-735-0x00007FF751FF0000-0x00007FF7523E2000-memory.dmp	xmrig
behavioral2/memory/4888-733-0x00007FF7D0580000-0x00007FF7D0972000-memory.dmp	xmrig
behavioral2/memory/2432-732-0x00007FF7B04E0000-0x00007FF7B08D2000-memory.dmp	xmrig
behavioral2/memory/3216-574-0x00007FF7754D0000-0x00007FF7758C2000-memory.dmp	xmrig
behavioral2/memory/3972-565-0x00007FF7C11B0000-0x00007FF7C15A2000-memory.dmp	xmrig
behavioral2/memory/3548-457-0x00007FF6CB8A0000-0x00007FF6CBC92000-memory.dmp	xmrig
behavioral2/memory/564-347-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp	xmrig
behavioral2/memory/3924-289-0x00007FF7B0480000-0x00007FF7B0872000-memory.dmp	xmrig
behavioral2/memory/4356-247-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp	xmrig
behavioral2/memory/2572-236-0x00007FF643980000-0x00007FF643D72000-memory.dmp	xmrig
behavioral2/memory/4352-169-0x00007FF6B3360000-0x00007FF6B3752000-memory.dmp	xmrig
behavioral2/memory/4840-2800-0x00007FF60F760000-0x00007FF60FB52000-memory.dmp	xmrig
behavioral2/memory/4840-2802-0x00007FF60F760000-0x00007FF60FB52000-memory.dmp	xmrig
behavioral2/memory/1192-2804-0x00007FF783640000-0x00007FF783A32000-memory.dmp	xmrig
behavioral2/memory/2572-2806-0x00007FF643980000-0x00007FF643D72000-memory.dmp	xmrig
behavioral2/memory/4352-2809-0x00007FF6B3360000-0x00007FF6B3752000-memory.dmp	xmrig
behavioral2/memory/4356-2810-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp	xmrig
behavioral2/memory/3972-2812-0x00007FF7C11B0000-0x00007FF7C15A2000-memory.dmp	xmrig
behavioral2/memory/4908-2816-0x00007FF78A5A0000-0x00007FF78A992000-memory.dmp	xmrig
behavioral2/memory/4888-2818-0x00007FF7D0580000-0x00007FF7D0972000-memory.dmp	xmrig
behavioral2/memory/3924-2815-0x00007FF7B0480000-0x00007FF7B0872000-memory.dmp	xmrig
behavioral2/memory/3628-2821-0x00007FF775070000-0x00007FF775462000-memory.dmp	xmrig
behavioral2/memory/4944-2838-0x00007FF6437C0000-0x00007FF643BB2000-memory.dmp	xmrig
behavioral2/memory/1840-2846-0x00007FF6A6890000-0x00007FF6A6C82000-memory.dmp	xmrig
behavioral2/memory/3680-2849-0x00007FF7A78B0000-0x00007FF7A7CA2000-memory.dmp	xmrig
behavioral2/memory/4712-2852-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp	xmrig
behavioral2/memory/4824-2844-0x00007FF6D2540000-0x00007FF6D2932000-memory.dmp	xmrig
behavioral2/memory/3440-2841-0x00007FF751FF0000-0x00007FF7523E2000-memory.dmp	xmrig
behavioral2/memory/564-2837-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp	xmrig
behavioral2/memory/316-2835-0x00007FF7F7BF0000-0x00007FF7F7FE2000-memory.dmp	xmrig
behavioral2/memory/224-2830-0x00007FF771690000-0x00007FF771A82000-memory.dmp	xmrig
behavioral2/memory/2432-2826-0x00007FF7B04E0000-0x00007FF7B08D2000-memory.dmp	xmrig
behavioral2/memory/4476-2833-0x00007FF6B6DF0000-0x00007FF6B71E2000-memory.dmp	xmrig
behavioral2/memory/3216-2828-0x00007FF7754D0000-0x00007FF7758C2000-memory.dmp	xmrig
behavioral2/memory/3548-2824-0x00007FF6CB8A0000-0x00007FF6CBC92000-memory.dmp	xmrig
behavioral2/memory/116-2870-0x00007FF74EBB0000-0x00007FF74EFA2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
396	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4840	PugPssY.exe
1192	YVkLpME.exe
4352	GbAuVmr.exe
4908	vVmdTpY.exe
2572	pStXTtB.exe
4356	sYEJaOG.exe
3924	ETYQbhd.exe
564	kQmPjbm.exe
3548	UjycKNq.exe
3972	LYfKKmF.exe
3216	PmRvvcG.exe
2432	cuIUHfa.exe
4888	SviJnsH.exe
3628	wuxijNB.exe
3440	GiVxXWW.exe
4824	ERPhNSB.exe
4476	QwQzbho.exe
1840	WPXpdwn.exe
3680	YBgRBku.exe
4944	oJEocKP.exe
316	ObeiEtC.exe
4712	kVcOzTv.exe
116	nNccNNl.exe
224	SqldrSM.exe
2344	aRZKtwK.exe
4120	HWtqvTV.exe
4916	EGPoaiQ.exe
4004	CkMNaDN.exe
1816	klcHXYh.exe
656	KVwinXu.exe
1304	azpjsDR.exe
4260	IsgkcJn.exe
1536	JuNFTCV.exe
2492	WguoqGn.exe
4568	kwXKfuc.exe
4072	prjHIsU.exe
1436	aTYNfMM.exe
4924	YiWBTuy.exe
2900	zAxUQKI.exe
3136	HsbkOQh.exe
3132	LXLxpRg.exe
4464	wTmAQht.exe
3500	dmaxfSU.exe
368	zlqDleT.exe
4900	GOGAbZe.exe
4896	hDyhWBu.exe
5076	zLNAYOQ.exe
680	woYoDVF.exe
1408	YiwxbrJ.exe
3256	WGFATBc.exe
1312	icGEdQl.exe
1508	MTskcRY.exe
4040	xFjpqrU.exe
2916	DUvTKWj.exe
1076	BcUCszS.exe
960	HBlepIl.exe
3600	FKilOzg.exe
2856	WVXZWuJ.exe
4768	PuBBlZd.exe
3112	nTVBMYN.exe
2416	qOQPCBb.exe
3904	vesTtuN.exe
5124	drwUqWP.exe
5140	GmazGXU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3936-0-0x00007FF6BFC90000-0x00007FF6C0082000-memory.dmp	upx
behavioral2/files/0x0007000000023298-6.dat	upx
behavioral2/files/0x000800000002343b-10.dat	upx
behavioral2/files/0x000700000002343f-8.dat	upx
behavioral2/files/0x0007000000023441-37.dat	upx
behavioral2/files/0x0007000000023448-61.dat	upx
behavioral2/files/0x0007000000023447-53.dat	upx
behavioral2/files/0x0007000000023449-120.dat	upx
behavioral2/files/0x000700000002345d-197.dat	upx
behavioral2/memory/3628-734-0x00007FF775070000-0x00007FF775462000-memory.dmp	upx
behavioral2/memory/4476-737-0x00007FF6B6DF0000-0x00007FF6B71E2000-memory.dmp	upx
behavioral2/memory/3680-739-0x00007FF7A78B0000-0x00007FF7A7CA2000-memory.dmp	upx
behavioral2/memory/4944-740-0x00007FF6437C0000-0x00007FF643BB2000-memory.dmp	upx
behavioral2/memory/4712-1220-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp	upx
behavioral2/memory/316-1215-0x00007FF7F7BF0000-0x00007FF7F7FE2000-memory.dmp	upx
behavioral2/memory/116-1501-0x00007FF74EBB0000-0x00007FF74EFA2000-memory.dmp	upx
behavioral2/memory/1192-1783-0x00007FF783640000-0x00007FF783A32000-memory.dmp	upx
behavioral2/memory/224-1849-0x00007FF771690000-0x00007FF771A82000-memory.dmp	upx
behavioral2/memory/4908-1847-0x00007FF78A5A0000-0x00007FF78A992000-memory.dmp	upx
behavioral2/memory/1840-738-0x00007FF6A6890000-0x00007FF6A6C82000-memory.dmp	upx
behavioral2/memory/4824-736-0x00007FF6D2540000-0x00007FF6D2932000-memory.dmp	upx
behavioral2/memory/3440-735-0x00007FF751FF0000-0x00007FF7523E2000-memory.dmp	upx
behavioral2/memory/4888-733-0x00007FF7D0580000-0x00007FF7D0972000-memory.dmp	upx
behavioral2/memory/2432-732-0x00007FF7B04E0000-0x00007FF7B08D2000-memory.dmp	upx
behavioral2/memory/3216-574-0x00007FF7754D0000-0x00007FF7758C2000-memory.dmp	upx
behavioral2/memory/3972-565-0x00007FF7C11B0000-0x00007FF7C15A2000-memory.dmp	upx
behavioral2/memory/3548-457-0x00007FF6CB8A0000-0x00007FF6CBC92000-memory.dmp	upx
behavioral2/memory/564-347-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp	upx
behavioral2/memory/3924-289-0x00007FF7B0480000-0x00007FF7B0872000-memory.dmp	upx
behavioral2/memory/4356-247-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp	upx
behavioral2/memory/2572-236-0x00007FF643980000-0x00007FF643D72000-memory.dmp	upx
behavioral2/files/0x000700000002345a-161.dat	upx
behavioral2/files/0x0007000000023462-207.dat	upx
behavioral2/files/0x0007000000023461-206.dat	upx
behavioral2/files/0x0007000000023460-205.dat	upx
behavioral2/files/0x0007000000023450-203.dat	upx
behavioral2/files/0x000700000002345f-202.dat	upx
behavioral2/files/0x000700000002345e-201.dat	upx
behavioral2/files/0x000700000002344f-191.dat	upx
behavioral2/files/0x000700000002344d-187.dat	upx
behavioral2/files/0x000700000002345c-179.dat	upx
behavioral2/files/0x000700000002344c-178.dat	upx
behavioral2/memory/4352-169-0x00007FF6B3360000-0x00007FF6B3752000-memory.dmp	upx
behavioral2/files/0x000700000002345b-166.dat	upx
behavioral2/files/0x0007000000023459-160.dat	upx
behavioral2/files/0x0007000000023458-152.dat	upx
behavioral2/files/0x000700000002344e-141.dat	upx
behavioral2/files/0x0007000000023451-137.dat	upx
behavioral2/files/0x0007000000023456-132.dat	upx
behavioral2/files/0x0007000000023445-131.dat	upx
behavioral2/files/0x0007000000023455-126.dat	upx
behavioral2/files/0x0007000000023454-112.dat	upx
behavioral2/files/0x0007000000023453-107.dat	upx
behavioral2/files/0x0007000000023452-103.dat	upx
behavioral2/files/0x000700000002344a-97.dat	upx
behavioral2/files/0x0007000000023444-94.dat	upx
behavioral2/files/0x0007000000023446-88.dat	upx
behavioral2/files/0x0007000000023443-85.dat	upx
behavioral2/files/0x000700000002344b-100.dat	upx
behavioral2/files/0x0007000000023440-66.dat	upx
behavioral2/memory/4840-22-0x00007FF60F760000-0x00007FF60FB52000-memory.dmp	upx
behavioral2/files/0x0007000000023442-31.dat	upx
behavioral2/memory/4840-2800-0x00007FF60F760000-0x00007FF60FB52000-memory.dmp	upx
behavioral2/memory/4840-2802-0x00007FF60F760000-0x00007FF60FB52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AYoRcfw.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\efttKgX.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\ANIKbyL.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\nUnPeOF.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\XtOTviF.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\vVJLlRQ.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\pahfLar.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\PbotKjO.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\oXsKvYW.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\qMAGjNr.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\GzDTnfM.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\iQveJvB.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\sVmErSf.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\fQxTmVE.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\PrGnQQx.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\YQHBQQE.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\WquvjgA.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\CwQFOfO.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\YNyMuor.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\YgKZTQD.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\qCCutML.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\BUaPYme.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\YQVThhH.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\YGQTHNi.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\abtHsMZ.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\tHCjrWs.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\AOdeIxQ.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\UhyUtXb.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\uzUvSwh.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\FfPvQqT.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\VyZBlgW.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\VFZRxsb.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\sqWHgLc.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\QkaTUne.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\NmnxpPT.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\zNmpKsq.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\rmNQERQ.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\JHUedcB.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\nTvGSLw.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\yiAnlaJ.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\GKZqMaw.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\PcNozOg.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\WAMQzre.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\vPAgWyb.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\luISnSt.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\NJveZuh.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\ZkziezY.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\vACvUXC.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\dJzmcbL.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\fTWmQLG.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\APNruCE.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\JJFsgMh.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\BSGOPpp.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\lsIbScF.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\nNXUpaz.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\uCdObEC.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\MTABowI.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\vsWuMeM.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\nXcziXi.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\JCkxGkH.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\fHqdCNo.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\QBIXRxr.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\bvGZJkS.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
File created	C:\Windows\System\JlAFOGr.exe	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
396	powershell.exe
396	powershell.exe
396	powershell.exe
396	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
Token: SeDebugPrivilege	396	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 396	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	85
PID 3936 wrote to memory of 396	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	85
PID 3936 wrote to memory of 4840	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	86
PID 3936 wrote to memory of 4840	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	86
PID 3936 wrote to memory of 1192	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	87
PID 3936 wrote to memory of 1192	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	87
PID 3936 wrote to memory of 4352	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	88
PID 3936 wrote to memory of 4352	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	88
PID 3936 wrote to memory of 4908	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	89
PID 3936 wrote to memory of 4908	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	89
PID 3936 wrote to memory of 4356	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	90
PID 3936 wrote to memory of 4356	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	90
PID 3936 wrote to memory of 2572	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	91
PID 3936 wrote to memory of 2572	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	91
PID 3936 wrote to memory of 3924	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	92
PID 3936 wrote to memory of 3924	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	92
PID 3936 wrote to memory of 564	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	93
PID 3936 wrote to memory of 564	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	93
PID 3936 wrote to memory of 3548	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	94
PID 3936 wrote to memory of 3548	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	94
PID 3936 wrote to memory of 4888	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	95
PID 3936 wrote to memory of 4888	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	95
PID 3936 wrote to memory of 3972	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	96
PID 3936 wrote to memory of 3972	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	96
PID 3936 wrote to memory of 3216	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	97
PID 3936 wrote to memory of 3216	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	97
PID 3936 wrote to memory of 2432	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	98
PID 3936 wrote to memory of 2432	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	98
PID 3936 wrote to memory of 316	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	99
PID 3936 wrote to memory of 316	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	99
PID 3936 wrote to memory of 3628	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	100
PID 3936 wrote to memory of 3628	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	100
PID 3936 wrote to memory of 3440	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	101
PID 3936 wrote to memory of 3440	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	101
PID 3936 wrote to memory of 4824	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	102
PID 3936 wrote to memory of 4824	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	102
PID 3936 wrote to memory of 4476	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	103
PID 3936 wrote to memory of 4476	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	103
PID 3936 wrote to memory of 1840	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	104
PID 3936 wrote to memory of 1840	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	104
PID 3936 wrote to memory of 3680	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	105
PID 3936 wrote to memory of 3680	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	105
PID 3936 wrote to memory of 4944	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	106
PID 3936 wrote to memory of 4944	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	106
PID 3936 wrote to memory of 4712	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	107
PID 3936 wrote to memory of 4712	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	107
PID 3936 wrote to memory of 116	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	108
PID 3936 wrote to memory of 116	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	108
PID 3936 wrote to memory of 224	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	109
PID 3936 wrote to memory of 224	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	109
PID 3936 wrote to memory of 2344	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	110
PID 3936 wrote to memory of 2344	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	110
PID 3936 wrote to memory of 4120	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	111
PID 3936 wrote to memory of 4120	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	111
PID 3936 wrote to memory of 4924	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	112
PID 3936 wrote to memory of 4924	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	112
PID 3936 wrote to memory of 4916	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	113
PID 3936 wrote to memory of 4916	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	113
PID 3936 wrote to memory of 4004	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	114
PID 3936 wrote to memory of 4004	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	114
PID 3936 wrote to memory of 1816	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	115
PID 3936 wrote to memory of 1816	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	115
PID 3936 wrote to memory of 656	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	116
PID 3936 wrote to memory of 656	3936	5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5f4d6499868dec059916358c3d248720_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System\PugPssY.exe
  C:\Windows\System\PugPssY.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\YVkLpME.exe
  C:\Windows\System\YVkLpME.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\GbAuVmr.exe
  C:\Windows\System\GbAuVmr.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\vVmdTpY.exe
  C:\Windows\System\vVmdTpY.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\sYEJaOG.exe
  C:\Windows\System\sYEJaOG.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\pStXTtB.exe
  C:\Windows\System\pStXTtB.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ETYQbhd.exe
  C:\Windows\System\ETYQbhd.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\kQmPjbm.exe
  C:\Windows\System\kQmPjbm.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\UjycKNq.exe
  C:\Windows\System\UjycKNq.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\SviJnsH.exe
  C:\Windows\System\SviJnsH.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\LYfKKmF.exe
  C:\Windows\System\LYfKKmF.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\PmRvvcG.exe
  C:\Windows\System\PmRvvcG.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\cuIUHfa.exe
  C:\Windows\System\cuIUHfa.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\ObeiEtC.exe
  C:\Windows\System\ObeiEtC.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\wuxijNB.exe
  C:\Windows\System\wuxijNB.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\GiVxXWW.exe
  C:\Windows\System\GiVxXWW.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\ERPhNSB.exe
  C:\Windows\System\ERPhNSB.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\QwQzbho.exe
  C:\Windows\System\QwQzbho.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\WPXpdwn.exe
  C:\Windows\System\WPXpdwn.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\YBgRBku.exe
  C:\Windows\System\YBgRBku.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\oJEocKP.exe
  C:\Windows\System\oJEocKP.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\kVcOzTv.exe
  C:\Windows\System\kVcOzTv.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\nNccNNl.exe
  C:\Windows\System\nNccNNl.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\SqldrSM.exe
  C:\Windows\System\SqldrSM.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\aRZKtwK.exe
  C:\Windows\System\aRZKtwK.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\HWtqvTV.exe
  C:\Windows\System\HWtqvTV.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\YiWBTuy.exe
  C:\Windows\System\YiWBTuy.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\EGPoaiQ.exe
  C:\Windows\System\EGPoaiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\CkMNaDN.exe
  C:\Windows\System\CkMNaDN.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\klcHXYh.exe
  C:\Windows\System\klcHXYh.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\KVwinXu.exe
  C:\Windows\System\KVwinXu.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\azpjsDR.exe
  C:\Windows\System\azpjsDR.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\IsgkcJn.exe
  C:\Windows\System\IsgkcJn.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\JuNFTCV.exe
  C:\Windows\System\JuNFTCV.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\WguoqGn.exe
  C:\Windows\System\WguoqGn.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\kwXKfuc.exe
  C:\Windows\System\kwXKfuc.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\prjHIsU.exe
  C:\Windows\System\prjHIsU.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\aTYNfMM.exe
  C:\Windows\System\aTYNfMM.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\zAxUQKI.exe
  C:\Windows\System\zAxUQKI.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\HsbkOQh.exe
  C:\Windows\System\HsbkOQh.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\LXLxpRg.exe
  C:\Windows\System\LXLxpRg.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\wTmAQht.exe
  C:\Windows\System\wTmAQht.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\dmaxfSU.exe
  C:\Windows\System\dmaxfSU.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\zlqDleT.exe
  C:\Windows\System\zlqDleT.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\GOGAbZe.exe
  C:\Windows\System\GOGAbZe.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\hDyhWBu.exe
  C:\Windows\System\hDyhWBu.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\zLNAYOQ.exe
  C:\Windows\System\zLNAYOQ.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\woYoDVF.exe
  C:\Windows\System\woYoDVF.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\qOQPCBb.exe
  C:\Windows\System\qOQPCBb.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\YiwxbrJ.exe
  C:\Windows\System\YiwxbrJ.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\WGFATBc.exe
  C:\Windows\System\WGFATBc.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\icGEdQl.exe
  C:\Windows\System\icGEdQl.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\MTskcRY.exe
  C:\Windows\System\MTskcRY.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\xFjpqrU.exe
  C:\Windows\System\xFjpqrU.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\DUvTKWj.exe
  C:\Windows\System\DUvTKWj.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\BcUCszS.exe
  C:\Windows\System\BcUCszS.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\wGKLBud.exe
  C:\Windows\System\wGKLBud.exe
  2⤵
  PID:4796
- C:\Windows\System\HBlepIl.exe
  C:\Windows\System\HBlepIl.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\FKilOzg.exe
  C:\Windows\System\FKilOzg.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\WVXZWuJ.exe
  C:\Windows\System\WVXZWuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\PuBBlZd.exe
  C:\Windows\System\PuBBlZd.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\nTVBMYN.exe
  C:\Windows\System\nTVBMYN.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\cGaYgfw.exe
  C:\Windows\System\cGaYgfw.exe
  2⤵
  PID:1708
- C:\Windows\System\bJxApDo.exe
  C:\Windows\System\bJxApDo.exe
  2⤵
  PID:4704
- C:\Windows\System\vesTtuN.exe
  C:\Windows\System\vesTtuN.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\drwUqWP.exe
  C:\Windows\System\drwUqWP.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\GmazGXU.exe
  C:\Windows\System\GmazGXU.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\NDPJvrt.exe
  C:\Windows\System\NDPJvrt.exe
  2⤵
  PID:5156
- C:\Windows\System\qpaGfhV.exe
  C:\Windows\System\qpaGfhV.exe
  2⤵
  PID:5176
- C:\Windows\System\svhlzPu.exe
  C:\Windows\System\svhlzPu.exe
  2⤵
  PID:5192
- C:\Windows\System\OcElZCs.exe
  C:\Windows\System\OcElZCs.exe
  2⤵
  PID:5224
- C:\Windows\System\ADAUBBG.exe
  C:\Windows\System\ADAUBBG.exe
  2⤵
  PID:5244
- C:\Windows\System\FwFYIfd.exe
  C:\Windows\System\FwFYIfd.exe
  2⤵
  PID:5260
- C:\Windows\System\blsCkUN.exe
  C:\Windows\System\blsCkUN.exe
  2⤵
  PID:5284
- C:\Windows\System\mYqpynA.exe
  C:\Windows\System\mYqpynA.exe
  2⤵
  PID:5300
- C:\Windows\System\mLZUqcg.exe
  C:\Windows\System\mLZUqcg.exe
  2⤵
  PID:5320
- C:\Windows\System\wXeiiMH.exe
  C:\Windows\System\wXeiiMH.exe
  2⤵
  PID:5336
- C:\Windows\System\RkeCPmW.exe
  C:\Windows\System\RkeCPmW.exe
  2⤵
  PID:5364
- C:\Windows\System\ZukRnfY.exe
  C:\Windows\System\ZukRnfY.exe
  2⤵
  PID:5388
- C:\Windows\System\LoCyhVS.exe
  C:\Windows\System\LoCyhVS.exe
  2⤵
  PID:5408
- C:\Windows\System\zanYoyp.exe
  C:\Windows\System\zanYoyp.exe
  2⤵
  PID:5424
- C:\Windows\System\yYzbgds.exe
  C:\Windows\System\yYzbgds.exe
  2⤵
  PID:5452
- C:\Windows\System\BoSvoVf.exe
  C:\Windows\System\BoSvoVf.exe
  2⤵
  PID:5468
- C:\Windows\System\LuriMuw.exe
  C:\Windows\System\LuriMuw.exe
  2⤵
  PID:5496
- C:\Windows\System\hyEDwCm.exe
  C:\Windows\System\hyEDwCm.exe
  2⤵
  PID:5512
- C:\Windows\System\JDgCYvG.exe
  C:\Windows\System\JDgCYvG.exe
  2⤵
  PID:5544
- C:\Windows\System\ksmURcw.exe
  C:\Windows\System\ksmURcw.exe
  2⤵
  PID:5564
- C:\Windows\System\XnOxAFh.exe
  C:\Windows\System\XnOxAFh.exe
  2⤵
  PID:5588
- C:\Windows\System\vtaNkIh.exe
  C:\Windows\System\vtaNkIh.exe
  2⤵
  PID:5608
- C:\Windows\System\yzKDQOd.exe
  C:\Windows\System\yzKDQOd.exe
  2⤵
  PID:5624
- C:\Windows\System\qYhzEOP.exe
  C:\Windows\System\qYhzEOP.exe
  2⤵
  PID:5668
- C:\Windows\System\ORkpvUC.exe
  C:\Windows\System\ORkpvUC.exe
  2⤵
  PID:5688
- C:\Windows\System\jeNuwfb.exe
  C:\Windows\System\jeNuwfb.exe
  2⤵
  PID:5708
- C:\Windows\System\yRNnPzW.exe
  C:\Windows\System\yRNnPzW.exe
  2⤵
  PID:5728
- C:\Windows\System\VPLXUzk.exe
  C:\Windows\System\VPLXUzk.exe
  2⤵
  PID:5744
- C:\Windows\System\zmvlgri.exe
  C:\Windows\System\zmvlgri.exe
  2⤵
  PID:5780
- C:\Windows\System\MUrnhYx.exe
  C:\Windows\System\MUrnhYx.exe
  2⤵
  PID:5796
- C:\Windows\System\hqZZJip.exe
  C:\Windows\System\hqZZJip.exe
  2⤵
  PID:5824
- C:\Windows\System\icEAdpd.exe
  C:\Windows\System\icEAdpd.exe
  2⤵
  PID:5844
- C:\Windows\System\oXmdPRF.exe
  C:\Windows\System\oXmdPRF.exe
  2⤵
  PID:5892
- C:\Windows\System\pjjqgnm.exe
  C:\Windows\System\pjjqgnm.exe
  2⤵
  PID:5916
- C:\Windows\System\bITprLh.exe
  C:\Windows\System\bITprLh.exe
  2⤵
  PID:5932
- C:\Windows\System\FnyaYlp.exe
  C:\Windows\System\FnyaYlp.exe
  2⤵
  PID:5956
- C:\Windows\System\aVAsQwV.exe
  C:\Windows\System\aVAsQwV.exe
  2⤵
  PID:5996
- C:\Windows\System\ebQJIuR.exe
  C:\Windows\System\ebQJIuR.exe
  2⤵
  PID:6012
- C:\Windows\System\jFpTXBu.exe
  C:\Windows\System\jFpTXBu.exe
  2⤵
  PID:6032
- C:\Windows\System\qxTlnbX.exe
  C:\Windows\System\qxTlnbX.exe
  2⤵
  PID:6052
- C:\Windows\System\iEbZCVi.exe
  C:\Windows\System\iEbZCVi.exe
  2⤵
  PID:6068
- C:\Windows\System\qMAGjNr.exe
  C:\Windows\System\qMAGjNr.exe
  2⤵
  PID:6104
- C:\Windows\System\QmGCatZ.exe
  C:\Windows\System\QmGCatZ.exe
  2⤵
  PID:4616
- C:\Windows\System\ewLpwyH.exe
  C:\Windows\System\ewLpwyH.exe
  2⤵
  PID:3352
- C:\Windows\System\rWPafEc.exe
  C:\Windows\System\rWPafEc.exe
  2⤵
  PID:3280
- C:\Windows\System\zgfIveg.exe
  C:\Windows\System\zgfIveg.exe
  2⤵
  PID:4620
- C:\Windows\System\RMTRlRi.exe
  C:\Windows\System\RMTRlRi.exe
  2⤵
  PID:1200
- C:\Windows\System\NJQJuht.exe
  C:\Windows\System\NJQJuht.exe
  2⤵
  PID:4300
- C:\Windows\System\TORrcXL.exe
  C:\Windows\System\TORrcXL.exe
  2⤵
  PID:2228
- C:\Windows\System\jnaAKpq.exe
  C:\Windows\System\jnaAKpq.exe
  2⤵
  PID:2464
- C:\Windows\System\oTbLSNU.exe
  C:\Windows\System\oTbLSNU.exe
  2⤵
  PID:2320
- C:\Windows\System\oiaAgYB.exe
  C:\Windows\System\oiaAgYB.exe
  2⤵
  PID:5032
- C:\Windows\System\gntFqls.exe
  C:\Windows\System\gntFqls.exe
  2⤵
  PID:3516
- C:\Windows\System\iAMjWaC.exe
  C:\Windows\System\iAMjWaC.exe
  2⤵
  PID:4524
- C:\Windows\System\XhhthbE.exe
  C:\Windows\System\XhhthbE.exe
  2⤵
  PID:1932
- C:\Windows\System\kbLZFnt.exe
  C:\Windows\System\kbLZFnt.exe
  2⤵
  PID:4512
- C:\Windows\System\pyijVjh.exe
  C:\Windows\System\pyijVjh.exe
  2⤵
  PID:1628
- C:\Windows\System\sOluEbT.exe
  C:\Windows\System\sOluEbT.exe
  2⤵
  PID:4628
- C:\Windows\System\xlLtKzX.exe
  C:\Windows\System\xlLtKzX.exe
  2⤵
  PID:4316
- C:\Windows\System\iYcjMTW.exe
  C:\Windows\System\iYcjMTW.exe
  2⤵
  PID:5560
- C:\Windows\System\FTuEMPj.exe
  C:\Windows\System\FTuEMPj.exe
  2⤵
  PID:1272
- C:\Windows\System\RHhgWjq.exe
  C:\Windows\System\RHhgWjq.exe
  2⤵
  PID:6164
- C:\Windows\System\RkBslgE.exe
  C:\Windows\System\RkBslgE.exe
  2⤵
  PID:6180
- C:\Windows\System\BLAblZn.exe
  C:\Windows\System\BLAblZn.exe
  2⤵
  PID:6208
- C:\Windows\System\VyhGiUW.exe
  C:\Windows\System\VyhGiUW.exe
  2⤵
  PID:6228
- C:\Windows\System\rAgrOFy.exe
  C:\Windows\System\rAgrOFy.exe
  2⤵
  PID:6244
- C:\Windows\System\shIwWoy.exe
  C:\Windows\System\shIwWoy.exe
  2⤵
  PID:6260
- C:\Windows\System\UGXjiVA.exe
  C:\Windows\System\UGXjiVA.exe
  2⤵
  PID:6284
- C:\Windows\System\OZFYbzL.exe
  C:\Windows\System\OZFYbzL.exe
  2⤵
  PID:6300
- C:\Windows\System\kTvREHQ.exe
  C:\Windows\System\kTvREHQ.exe
  2⤵
  PID:6320
- C:\Windows\System\XmZLGgt.exe
  C:\Windows\System\XmZLGgt.exe
  2⤵
  PID:6344
- C:\Windows\System\JhVLgUB.exe
  C:\Windows\System\JhVLgUB.exe
  2⤵
  PID:6368
- C:\Windows\System\KdUXIGC.exe
  C:\Windows\System\KdUXIGC.exe
  2⤵
  PID:6404
- C:\Windows\System\gysnCyl.exe
  C:\Windows\System\gysnCyl.exe
  2⤵
  PID:6424
- C:\Windows\System\ZaXMxlL.exe
  C:\Windows\System\ZaXMxlL.exe
  2⤵
  PID:6448
- C:\Windows\System\KcERqjK.exe
  C:\Windows\System\KcERqjK.exe
  2⤵
  PID:6472
- C:\Windows\System\LJaaFQg.exe
  C:\Windows\System\LJaaFQg.exe
  2⤵
  PID:6488
- C:\Windows\System\rUBvVRu.exe
  C:\Windows\System\rUBvVRu.exe
  2⤵
  PID:6520
- C:\Windows\System\rGjmqZn.exe
  C:\Windows\System\rGjmqZn.exe
  2⤵
  PID:6536
- C:\Windows\System\rdlwtLy.exe
  C:\Windows\System\rdlwtLy.exe
  2⤵
  PID:6556
- C:\Windows\System\uooIxWi.exe
  C:\Windows\System\uooIxWi.exe
  2⤵
  PID:6576
- C:\Windows\System\iyUhIXY.exe
  C:\Windows\System\iyUhIXY.exe
  2⤵
  PID:6600
- C:\Windows\System\zijPPlq.exe
  C:\Windows\System\zijPPlq.exe
  2⤵
  PID:6616
- C:\Windows\System\vsWuMeM.exe
  C:\Windows\System\vsWuMeM.exe
  2⤵
  PID:6632
- C:\Windows\System\SbioWJs.exe
  C:\Windows\System\SbioWJs.exe
  2⤵
  PID:6652
- C:\Windows\System\RaNezoI.exe
  C:\Windows\System\RaNezoI.exe
  2⤵
  PID:6676
- C:\Windows\System\kKkDLxr.exe
  C:\Windows\System\kKkDLxr.exe
  2⤵
  PID:6704
- C:\Windows\System\eoAxyyj.exe
  C:\Windows\System\eoAxyyj.exe
  2⤵
  PID:6720
- C:\Windows\System\mZkfctv.exe
  C:\Windows\System\mZkfctv.exe
  2⤵
  PID:6744
- C:\Windows\System\fTWmQLG.exe
  C:\Windows\System\fTWmQLG.exe
  2⤵
  PID:6772
- C:\Windows\System\BJMAXyS.exe
  C:\Windows\System\BJMAXyS.exe
  2⤵
  PID:6800
- C:\Windows\System\hmRKEFe.exe
  C:\Windows\System\hmRKEFe.exe
  2⤵
  PID:6824
- C:\Windows\System\XwCrazw.exe
  C:\Windows\System\XwCrazw.exe
  2⤵
  PID:6840
- C:\Windows\System\YiTXZLu.exe
  C:\Windows\System\YiTXZLu.exe
  2⤵
  PID:6860
- C:\Windows\System\lQmhUXb.exe
  C:\Windows\System\lQmhUXb.exe
  2⤵
  PID:6876
- C:\Windows\System\VmmBEZm.exe
  C:\Windows\System\VmmBEZm.exe
  2⤵
  PID:6900
- C:\Windows\System\vmolVzm.exe
  C:\Windows\System\vmolVzm.exe
  2⤵
  PID:6916
- C:\Windows\System\XqXwJbe.exe
  C:\Windows\System\XqXwJbe.exe
  2⤵
  PID:6936
- C:\Windows\System\yiAnlaJ.exe
  C:\Windows\System\yiAnlaJ.exe
  2⤵
  PID:6952
- C:\Windows\System\YgKZTQD.exe
  C:\Windows\System\YgKZTQD.exe
  2⤵
  PID:6984
- C:\Windows\System\YUGsXgU.exe
  C:\Windows\System\YUGsXgU.exe
  2⤵
  PID:7008
- C:\Windows\System\JDvrCWq.exe
  C:\Windows\System\JDvrCWq.exe
  2⤵
  PID:7024
- C:\Windows\System\lBVlMVJ.exe
  C:\Windows\System\lBVlMVJ.exe
  2⤵
  PID:7044
- C:\Windows\System\rWPpLcz.exe
  C:\Windows\System\rWPpLcz.exe
  2⤵
  PID:7060
- C:\Windows\System\XkLVaqq.exe
  C:\Windows\System\XkLVaqq.exe
  2⤵
  PID:7080
- C:\Windows\System\ttCHDlH.exe
  C:\Windows\System\ttCHDlH.exe
  2⤵
  PID:7096
- C:\Windows\System\InctNEQ.exe
  C:\Windows\System\InctNEQ.exe
  2⤵
  PID:7120
- C:\Windows\System\mRjwfwe.exe
  C:\Windows\System\mRjwfwe.exe
  2⤵
  PID:7136
- C:\Windows\System\UCxMlTp.exe
  C:\Windows\System\UCxMlTp.exe
  2⤵
  PID:7164
- C:\Windows\System\GKZqMaw.exe
  C:\Windows\System\GKZqMaw.exe
  2⤵
  PID:440
- C:\Windows\System\KwaETIW.exe
  C:\Windows\System\KwaETIW.exe
  2⤵
  PID:5048
- C:\Windows\System\SbnDzRV.exe
  C:\Windows\System\SbnDzRV.exe
  2⤵
  PID:496
- C:\Windows\System\xtlotpp.exe
  C:\Windows\System\xtlotpp.exe
  2⤵
  PID:3288
- C:\Windows\System\WzsNlTT.exe
  C:\Windows\System\WzsNlTT.exe
  2⤵
  PID:5972
- C:\Windows\System\Vfpzalo.exe
  C:\Windows\System\Vfpzalo.exe
  2⤵
  PID:5148
- C:\Windows\System\zozPINW.exe
  C:\Windows\System\zozPINW.exe
  2⤵
  PID:6024
- C:\Windows\System\PYSEkHo.exe
  C:\Windows\System\PYSEkHo.exe
  2⤵
  PID:5580
- C:\Windows\System\sTxVaBC.exe
  C:\Windows\System\sTxVaBC.exe
  2⤵
  PID:5276
- C:\Windows\System\nXcziXi.exe
  C:\Windows\System\nXcziXi.exe
  2⤵
  PID:5344
- C:\Windows\System\GHUNicr.exe
  C:\Windows\System\GHUNicr.exe
  2⤵
  PID:5380
- C:\Windows\System\dhnGzzl.exe
  C:\Windows\System\dhnGzzl.exe
  2⤵
  PID:5188
- C:\Windows\System\cIWasmo.exe
  C:\Windows\System\cIWasmo.exe
  2⤵
  PID:944
- C:\Windows\System\xEDjfcC.exe
  C:\Windows\System\xEDjfcC.exe
  2⤵
  PID:3540
- C:\Windows\System\BvxVcrQ.exe
  C:\Windows\System\BvxVcrQ.exe
  2⤵
  PID:5764
- C:\Windows\System\XoWIlcM.exe
  C:\Windows\System\XoWIlcM.exe
  2⤵
  PID:6196
- C:\Windows\System\odVDZHc.exe
  C:\Windows\System\odVDZHc.exe
  2⤵
  PID:5792
- C:\Windows\System\lAxYIvL.exe
  C:\Windows\System\lAxYIvL.exe
  2⤵
  PID:5460
- C:\Windows\System\ciWkZPF.exe
  C:\Windows\System\ciWkZPF.exe
  2⤵
  PID:5860
- C:\Windows\System\qCSNoDL.exe
  C:\Windows\System\qCSNoDL.exe
  2⤵
  PID:6444
- C:\Windows\System\ffKXlFe.exe
  C:\Windows\System\ffKXlFe.exe
  2⤵
  PID:6500
- C:\Windows\System\lQYcMIf.exe
  C:\Windows\System\lQYcMIf.exe
  2⤵
  PID:6592
- C:\Windows\System\wdYvCKT.exe
  C:\Windows\System\wdYvCKT.exe
  2⤵
  PID:7176
- C:\Windows\System\AFrgThf.exe
  C:\Windows\System\AFrgThf.exe
  2⤵
  PID:7200
- C:\Windows\System\gNncAaT.exe
  C:\Windows\System\gNncAaT.exe
  2⤵
  PID:7224
- C:\Windows\System\vhDXVcC.exe
  C:\Windows\System\vhDXVcC.exe
  2⤵
  PID:7244
- C:\Windows\System\zybdvVk.exe
  C:\Windows\System\zybdvVk.exe
  2⤵
  PID:7260
- C:\Windows\System\nHEoSOn.exe
  C:\Windows\System\nHEoSOn.exe
  2⤵
  PID:7276
- C:\Windows\System\CFuIvpV.exe
  C:\Windows\System\CFuIvpV.exe
  2⤵
  PID:7296
- C:\Windows\System\ShaQqcI.exe
  C:\Windows\System\ShaQqcI.exe
  2⤵
  PID:7312
- C:\Windows\System\xeTPxnF.exe
  C:\Windows\System\xeTPxnF.exe
  2⤵
  PID:7336
- C:\Windows\System\jBTtpcn.exe
  C:\Windows\System\jBTtpcn.exe
  2⤵
  PID:7352
- C:\Windows\System\kzOJpWW.exe
  C:\Windows\System\kzOJpWW.exe
  2⤵
  PID:7380
- C:\Windows\System\XEKZduw.exe
  C:\Windows\System\XEKZduw.exe
  2⤵
  PID:7396
- C:\Windows\System\kMsNOeL.exe
  C:\Windows\System\kMsNOeL.exe
  2⤵
  PID:7420
- C:\Windows\System\HvzbKhI.exe
  C:\Windows\System\HvzbKhI.exe
  2⤵
  PID:7444
- C:\Windows\System\qtgASww.exe
  C:\Windows\System\qtgASww.exe
  2⤵
  PID:7464
- C:\Windows\System\GxQCubK.exe
  C:\Windows\System\GxQCubK.exe
  2⤵
  PID:7488
- C:\Windows\System\mRpamac.exe
  C:\Windows\System\mRpamac.exe
  2⤵
  PID:7504
- C:\Windows\System\slLrRGR.exe
  C:\Windows\System\slLrRGR.exe
  2⤵
  PID:7524
- C:\Windows\System\QPnUIqa.exe
  C:\Windows\System\QPnUIqa.exe
  2⤵
  PID:7552
- C:\Windows\System\NkOoaUI.exe
  C:\Windows\System\NkOoaUI.exe
  2⤵
  PID:7568
- C:\Windows\System\aQXPBDR.exe
  C:\Windows\System\aQXPBDR.exe
  2⤵
  PID:7592
- C:\Windows\System\OlqnLIh.exe
  C:\Windows\System\OlqnLIh.exe
  2⤵
  PID:7608
- C:\Windows\System\HXiygcA.exe
  C:\Windows\System\HXiygcA.exe
  2⤵
  PID:7632
- C:\Windows\System\VCZfGCD.exe
  C:\Windows\System\VCZfGCD.exe
  2⤵
  PID:7656
- C:\Windows\System\aZcSnCQ.exe
  C:\Windows\System\aZcSnCQ.exe
  2⤵
  PID:7672
- C:\Windows\System\SwIRRQE.exe
  C:\Windows\System\SwIRRQE.exe
  2⤵
  PID:7700
- C:\Windows\System\WECplUo.exe
  C:\Windows\System\WECplUo.exe
  2⤵
  PID:7716
- C:\Windows\System\sZKtYIc.exe
  C:\Windows\System\sZKtYIc.exe
  2⤵
  PID:7736
- C:\Windows\System\nHYBpik.exe
  C:\Windows\System\nHYBpik.exe
  2⤵
  PID:7760
- C:\Windows\System\SmQbDEr.exe
  C:\Windows\System\SmQbDEr.exe
  2⤵
  PID:7776
- C:\Windows\System\tDjDTEs.exe
  C:\Windows\System\tDjDTEs.exe
  2⤵
  PID:7800
- C:\Windows\System\BBXKCSy.exe
  C:\Windows\System\BBXKCSy.exe
  2⤵
  PID:7820
- C:\Windows\System\FJsKAQB.exe
  C:\Windows\System\FJsKAQB.exe
  2⤵
  PID:7836
- C:\Windows\System\NqwcDxJ.exe
  C:\Windows\System\NqwcDxJ.exe
  2⤵
  PID:7868
- C:\Windows\System\lhYDHdC.exe
  C:\Windows\System\lhYDHdC.exe
  2⤵
  PID:7888
- C:\Windows\System\mrJDBWm.exe
  C:\Windows\System\mrJDBWm.exe
  2⤵
  PID:7912
- C:\Windows\System\qGoRoyp.exe
  C:\Windows\System\qGoRoyp.exe
  2⤵
  PID:7928
- C:\Windows\System\gtUfROO.exe
  C:\Windows\System\gtUfROO.exe
  2⤵
  PID:7944
- C:\Windows\System\LFXsBms.exe
  C:\Windows\System\LFXsBms.exe
  2⤵
  PID:7968
- C:\Windows\System\CUhJodH.exe
  C:\Windows\System\CUhJodH.exe
  2⤵
  PID:7988
- C:\Windows\System\QgNxpIx.exe
  C:\Windows\System\QgNxpIx.exe
  2⤵
  PID:8004
- C:\Windows\System\RJUtAPw.exe
  C:\Windows\System\RJUtAPw.exe
  2⤵
  PID:8032
- C:\Windows\System\yJwWMBF.exe
  C:\Windows\System\yJwWMBF.exe
  2⤵
  PID:8052
- C:\Windows\System\tSWimng.exe
  C:\Windows\System\tSWimng.exe
  2⤵
  PID:8072
- C:\Windows\System\zAqHNmb.exe
  C:\Windows\System\zAqHNmb.exe
  2⤵
  PID:8096
- C:\Windows\System\BIDyRtj.exe
  C:\Windows\System\BIDyRtj.exe
  2⤵
  PID:8124
- C:\Windows\System\zNmpKsq.exe
  C:\Windows\System\zNmpKsq.exe
  2⤵
  PID:8148
- C:\Windows\System\jShJALb.exe
  C:\Windows\System\jShJALb.exe
  2⤵
  PID:8172
- C:\Windows\System\fXfzYxM.exe
  C:\Windows\System\fXfzYxM.exe
  2⤵
  PID:8188
- C:\Windows\System\FfPvQqT.exe
  C:\Windows\System\FfPvQqT.exe
  2⤵
  PID:5620
- C:\Windows\System\IavMdqv.exe
  C:\Windows\System\IavMdqv.exe
  2⤵
  PID:6692
- C:\Windows\System\WFsdHTl.exe
  C:\Windows\System\WFsdHTl.exe
  2⤵
  PID:3088
- C:\Windows\System\rmNQERQ.exe
  C:\Windows\System\rmNQERQ.exe
  2⤵
  PID:4116
- C:\Windows\System\hnWPkKZ.exe
  C:\Windows\System\hnWPkKZ.exe
  2⤵
  PID:2580
- C:\Windows\System\jNvKVdn.exe
  C:\Windows\System\jNvKVdn.exe
  2⤵
  PID:1836
- C:\Windows\System\abtHsMZ.exe
  C:\Windows\System\abtHsMZ.exe
  2⤵
  PID:6812
- C:\Windows\System\EuHsjZa.exe
  C:\Windows\System\EuHsjZa.exe
  2⤵
  PID:5432
- C:\Windows\System\TQjXStE.exe
  C:\Windows\System\TQjXStE.exe
  2⤵
  PID:5724
- C:\Windows\System\IXHMQRu.exe
  C:\Windows\System\IXHMQRu.exe
  2⤵
  PID:5736
- C:\Windows\System\TeKYxKh.exe
  C:\Windows\System\TeKYxKh.exe
  2⤵
  PID:5416
- C:\Windows\System\dgZzOKQ.exe
  C:\Windows\System\dgZzOKQ.exe
  2⤵
  PID:7000
- C:\Windows\System\faVGpSE.exe
  C:\Windows\System\faVGpSE.exe
  2⤵
  PID:7072
- C:\Windows\System\uTcnxSj.exe
  C:\Windows\System\uTcnxSj.exe
  2⤵
  PID:6272
- C:\Windows\System\zfSeFCY.exe
  C:\Windows\System\zfSeFCY.exe
  2⤵
  PID:6316
- C:\Windows\System\iEHdqSf.exe
  C:\Windows\System\iEHdqSf.exe
  2⤵
  PID:6624
- C:\Windows\System\JJFsgMh.exe
  C:\Windows\System\JJFsgMh.exe
  2⤵
  PID:6664
- C:\Windows\System\ZFNsXYN.exe
  C:\Windows\System\ZFNsXYN.exe
  2⤵
  PID:3744
- C:\Windows\System\tPBfZdu.exe
  C:\Windows\System\tPBfZdu.exe
  2⤵
  PID:4160
- C:\Windows\System\cZGyXge.exe
  C:\Windows\System\cZGyXge.exe
  2⤵
  PID:5552
- C:\Windows\System\BSGOPpp.exe
  C:\Windows\System\BSGOPpp.exe
  2⤵
  PID:6152
- C:\Windows\System\gJnphMw.exe
  C:\Windows\System\gJnphMw.exe
  2⤵
  PID:7128
- C:\Windows\System\AsgJHot.exe
  C:\Windows\System\AsgJHot.exe
  2⤵
  PID:4732
- C:\Windows\System\lsIbScF.exe
  C:\Windows\System\lsIbScF.exe
  2⤵
  PID:8044
- C:\Windows\System\pjwFrRB.exe
  C:\Windows\System\pjwFrRB.exe
  2⤵
  PID:6360
- C:\Windows\System\CWIMlWj.exe
  C:\Windows\System\CWIMlWj.exe
  2⤵
  PID:6416
- C:\Windows\System\iICUdTG.exe
  C:\Windows\System\iICUdTG.exe
  2⤵
  PID:1756
- C:\Windows\System\kWMuUFm.exe
  C:\Windows\System\kWMuUFm.exe
  2⤵
  PID:6608
- C:\Windows\System\tGpMqPq.exe
  C:\Windows\System\tGpMqPq.exe
  2⤵
  PID:6644
- C:\Windows\System\BvEBBrq.exe
  C:\Windows\System\BvEBBrq.exe
  2⤵
  PID:4460
- C:\Windows\System\PObfwnl.exe
  C:\Windows\System\PObfwnl.exe
  2⤵
  PID:6852
- C:\Windows\System\KWFjftc.exe
  C:\Windows\System\KWFjftc.exe
  2⤵
  PID:7036
- C:\Windows\System\CuEZtXd.exe
  C:\Windows\System\CuEZtXd.exe
  2⤵
  PID:5924
- C:\Windows\System\MMSQNqN.exe
  C:\Windows\System\MMSQNqN.exe
  2⤵
  PID:7216
- C:\Windows\System\JRQPalu.exe
  C:\Windows\System\JRQPalu.exe
  2⤵
  PID:7256
- C:\Windows\System\VlStGJF.exe
  C:\Windows\System\VlStGJF.exe
  2⤵
  PID:7292
- C:\Windows\System\njatKKj.exe
  C:\Windows\System\njatKKj.exe
  2⤵
  PID:7332
- C:\Windows\System\hGXCSxM.exe
  C:\Windows\System\hGXCSxM.exe
  2⤵
  PID:7376
- C:\Windows\System\PHknIKV.exe
  C:\Windows\System\PHknIKV.exe
  2⤵
  PID:7416
- C:\Windows\System\QslMqpW.exe
  C:\Windows\System\QslMqpW.exe
  2⤵
  PID:7452
- C:\Windows\System\gTzalCv.exe
  C:\Windows\System\gTzalCv.exe
  2⤵
  PID:7500
- C:\Windows\System\seTkvPK.exe
  C:\Windows\System\seTkvPK.exe
  2⤵
  PID:7544
- C:\Windows\System\mEPsFBC.exe
  C:\Windows\System\mEPsFBC.exe
  2⤵
  PID:7588
- C:\Windows\System\IuDcyft.exe
  C:\Windows\System\IuDcyft.exe
  2⤵
  PID:7628
- C:\Windows\System\WquvjgA.exe
  C:\Windows\System\WquvjgA.exe
  2⤵
  PID:7668
- C:\Windows\System\SPfIilt.exe
  C:\Windows\System\SPfIilt.exe
  2⤵
  PID:7772
- C:\Windows\System\OgBTnuX.exe
  C:\Windows\System\OgBTnuX.exe
  2⤵
  PID:7880
- C:\Windows\System\jOkotcz.exe
  C:\Windows\System\jOkotcz.exe
  2⤵
  PID:7996
- C:\Windows\System\CiCXoDE.exe
  C:\Windows\System\CiCXoDE.exe
  2⤵
  PID:8140
- C:\Windows\System\fmXMAaz.exe
  C:\Windows\System\fmXMAaz.exe
  2⤵
  PID:4052
- C:\Windows\System\SEBpAjB.exe
  C:\Windows\System\SEBpAjB.exe
  2⤵
  PID:6968
- C:\Windows\System\xEesfha.exe
  C:\Windows\System\xEesfha.exe
  2⤵
  PID:8196
- C:\Windows\System\fCDOfUC.exe
  C:\Windows\System\fCDOfUC.exe
  2⤵
  PID:8228
- C:\Windows\System\tLRQIwg.exe
  C:\Windows\System\tLRQIwg.exe
  2⤵
  PID:8256
- C:\Windows\System\ECTfOBW.exe
  C:\Windows\System\ECTfOBW.exe
  2⤵
  PID:8272
- C:\Windows\System\WPVwaPo.exe
  C:\Windows\System\WPVwaPo.exe
  2⤵
  PID:8288
- C:\Windows\System\pLjHtcR.exe
  C:\Windows\System\pLjHtcR.exe
  2⤵
  PID:8304
- C:\Windows\System\HdeUnax.exe
  C:\Windows\System\HdeUnax.exe
  2⤵
  PID:8324
- C:\Windows\System\QgqBXXI.exe
  C:\Windows\System\QgqBXXI.exe
  2⤵
  PID:8344
- C:\Windows\System\TjZwYnX.exe
  C:\Windows\System\TjZwYnX.exe
  2⤵
  PID:8364
- C:\Windows\System\JHUedcB.exe
  C:\Windows\System\JHUedcB.exe
  2⤵
  PID:8380
- C:\Windows\System\caUpvzP.exe
  C:\Windows\System\caUpvzP.exe
  2⤵
  PID:8400
- C:\Windows\System\eDvsxln.exe
  C:\Windows\System\eDvsxln.exe
  2⤵
  PID:8416
- C:\Windows\System\kzwVvHG.exe
  C:\Windows\System\kzwVvHG.exe
  2⤵
  PID:8436
- C:\Windows\System\mFcFYiz.exe
  C:\Windows\System\mFcFYiz.exe
  2⤵
  PID:8456
- C:\Windows\System\tSscgOc.exe
  C:\Windows\System\tSscgOc.exe
  2⤵
  PID:8472
- C:\Windows\System\Mcwyyvm.exe
  C:\Windows\System\Mcwyyvm.exe
  2⤵
  PID:8488
- C:\Windows\System\QzScfbT.exe
  C:\Windows\System\QzScfbT.exe
  2⤵
  PID:8504
- C:\Windows\System\jTfVMTp.exe
  C:\Windows\System\jTfVMTp.exe
  2⤵
  PID:8524
- C:\Windows\System\FpodDNA.exe
  C:\Windows\System\FpodDNA.exe
  2⤵
  PID:8540
- C:\Windows\System\InpQvLJ.exe
  C:\Windows\System\InpQvLJ.exe
  2⤵
  PID:8560
- C:\Windows\System\hGkNEqg.exe
  C:\Windows\System\hGkNEqg.exe
  2⤵
  PID:8576
- C:\Windows\System\TWUSUnp.exe
  C:\Windows\System\TWUSUnp.exe
  2⤵
  PID:8596
- C:\Windows\System\mCLumyL.exe
  C:\Windows\System\mCLumyL.exe
  2⤵
  PID:8616
- C:\Windows\System\tHCjrWs.exe
  C:\Windows\System\tHCjrWs.exe
  2⤵
  PID:8632
- C:\Windows\System\yZznZaq.exe
  C:\Windows\System\yZznZaq.exe
  2⤵
  PID:8652
- C:\Windows\System\GDuhdOy.exe
  C:\Windows\System\GDuhdOy.exe
  2⤵
  PID:8672
- C:\Windows\System\UXHrvUv.exe
  C:\Windows\System\UXHrvUv.exe
  2⤵
  PID:8688
- C:\Windows\System\SOrmBHh.exe
  C:\Windows\System\SOrmBHh.exe
  2⤵
  PID:8708
- C:\Windows\System\EssIsBz.exe
  C:\Windows\System\EssIsBz.exe
  2⤵
  PID:8728
- C:\Windows\System\xybrOgd.exe
  C:\Windows\System\xybrOgd.exe
  2⤵
  PID:8744
- C:\Windows\System\XpZPxVJ.exe
  C:\Windows\System\XpZPxVJ.exe
  2⤵
  PID:8764
- C:\Windows\System\nTvGSLw.exe
  C:\Windows\System\nTvGSLw.exe
  2⤵
  PID:8780
- C:\Windows\System\wPOnEXp.exe
  C:\Windows\System\wPOnEXp.exe
  2⤵
  PID:8800
- C:\Windows\System\xmzGLXc.exe
  C:\Windows\System\xmzGLXc.exe
  2⤵
  PID:8820
- C:\Windows\System\hReltwM.exe
  C:\Windows\System\hReltwM.exe
  2⤵
  PID:8836
- C:\Windows\System\rArfGkK.exe
  C:\Windows\System\rArfGkK.exe
  2⤵
  PID:8856
- C:\Windows\System\qzPsXtQ.exe
  C:\Windows\System\qzPsXtQ.exe
  2⤵
  PID:8876
- C:\Windows\System\GolDCih.exe
  C:\Windows\System\GolDCih.exe
  2⤵
  PID:8896
- C:\Windows\System\SSBIPNY.exe
  C:\Windows\System\SSBIPNY.exe
  2⤵
  PID:8916
- C:\Windows\System\ouOGKNH.exe
  C:\Windows\System\ouOGKNH.exe
  2⤵
  PID:8932
- C:\Windows\System\fODuodD.exe
  C:\Windows\System\fODuodD.exe
  2⤵
  PID:8952
- C:\Windows\System\UucfJYN.exe
  C:\Windows\System\UucfJYN.exe
  2⤵
  PID:8972
- C:\Windows\System\HrUjxNG.exe
  C:\Windows\System\HrUjxNG.exe
  2⤵
  PID:8988
- C:\Windows\System\xKkptpl.exe
  C:\Windows\System\xKkptpl.exe
  2⤵
  PID:9008
- C:\Windows\System\gwIeDjv.exe
  C:\Windows\System\gwIeDjv.exe
  2⤵
  PID:9028
- C:\Windows\System\SldPWZq.exe
  C:\Windows\System\SldPWZq.exe
  2⤵
  PID:9044
- C:\Windows\System\aDERVZA.exe
  C:\Windows\System\aDERVZA.exe
  2⤵
  PID:9064
- C:\Windows\System\BUaPYme.exe
  C:\Windows\System\BUaPYme.exe
  2⤵
  PID:9084
- C:\Windows\System\DONufnX.exe
  C:\Windows\System\DONufnX.exe
  2⤵
  PID:9100
- C:\Windows\System\uEAcPiN.exe
  C:\Windows\System\uEAcPiN.exe
  2⤵
  PID:9120
- C:\Windows\System\rbFdZrP.exe
  C:\Windows\System\rbFdZrP.exe
  2⤵
  PID:9140
- C:\Windows\System\VyZBlgW.exe
  C:\Windows\System\VyZBlgW.exe
  2⤵
  PID:9156
- C:\Windows\System\HhdkfPI.exe
  C:\Windows\System\HhdkfPI.exe
  2⤵
  PID:9176
- C:\Windows\System\VVaHikH.exe
  C:\Windows\System\VVaHikH.exe
  2⤵
  PID:9196
- C:\Windows\System\sFHFctz.exe
  C:\Windows\System\sFHFctz.exe
  2⤵
  PID:9212
- C:\Windows\System\XvInLcf.exe
  C:\Windows\System\XvInLcf.exe
  2⤵
  PID:9236
- C:\Windows\System\YQVThhH.exe
  C:\Windows\System\YQVThhH.exe
  2⤵
  PID:9256
- C:\Windows\System\AAGYDeR.exe
  C:\Windows\System\AAGYDeR.exe
  2⤵
  PID:9272
- C:\Windows\System\qGXGWnw.exe
  C:\Windows\System\qGXGWnw.exe
  2⤵
  PID:9292
- C:\Windows\System\kgVuvUQ.exe
  C:\Windows\System\kgVuvUQ.exe
  2⤵
  PID:9308
- C:\Windows\System\xkmoCKh.exe
  C:\Windows\System\xkmoCKh.exe
  2⤵
  PID:9328
- C:\Windows\System\dJMmrxN.exe
  C:\Windows\System\dJMmrxN.exe
  2⤵
  PID:9348
- C:\Windows\System\ClkHXaB.exe
  C:\Windows\System\ClkHXaB.exe
  2⤵
  PID:9364
- C:\Windows\System\dYRmYZi.exe
  C:\Windows\System\dYRmYZi.exe
  2⤵
  PID:9384
- C:\Windows\System\DNLLvEh.exe
  C:\Windows\System\DNLLvEh.exe
  2⤵
  PID:9404
- C:\Windows\System\LYRiFNe.exe
  C:\Windows\System\LYRiFNe.exe
  2⤵
  PID:9420
- C:\Windows\System\doYwgKB.exe
  C:\Windows\System\doYwgKB.exe
  2⤵
  PID:9440
- C:\Windows\System\wcgKncm.exe
  C:\Windows\System\wcgKncm.exe
  2⤵
  PID:9460
- C:\Windows\System\CKbwqJH.exe
  C:\Windows\System\CKbwqJH.exe
  2⤵
  PID:9476
- C:\Windows\System\APNruCE.exe
  C:\Windows\System\APNruCE.exe
  2⤵
  PID:9496
- C:\Windows\System\xVVoBqi.exe
  C:\Windows\System\xVVoBqi.exe
  2⤵
  PID:9516
- C:\Windows\System\yHiXRjO.exe
  C:\Windows\System\yHiXRjO.exe
  2⤵
  PID:9532
- C:\Windows\System\iExwIJa.exe
  C:\Windows\System\iExwIJa.exe
  2⤵
  PID:9552
- C:\Windows\System\DYWoHOo.exe
  C:\Windows\System\DYWoHOo.exe
  2⤵
  PID:9572
- C:\Windows\System\fBvMFCi.exe
  C:\Windows\System\fBvMFCi.exe
  2⤵
  PID:9588
- C:\Windows\System\CAbhmAT.exe
  C:\Windows\System\CAbhmAT.exe
  2⤵
  PID:9608
- C:\Windows\System\ynscdcQ.exe
  C:\Windows\System\ynscdcQ.exe
  2⤵
  PID:9628
- C:\Windows\System\qidTiqK.exe
  C:\Windows\System\qidTiqK.exe
  2⤵
  PID:9644
- C:\Windows\System\PyKzhky.exe
  C:\Windows\System\PyKzhky.exe
  2⤵
  PID:9664
- C:\Windows\System\BzgMaVa.exe
  C:\Windows\System\BzgMaVa.exe
  2⤵
  PID:9680
- C:\Windows\System\vHTCHxN.exe
  C:\Windows\System\vHTCHxN.exe
  2⤵
  PID:9700
- C:\Windows\System\fPOdrTN.exe
  C:\Windows\System\fPOdrTN.exe
  2⤵
  PID:9716
- C:\Windows\System\PUJcudL.exe
  C:\Windows\System\PUJcudL.exe
  2⤵
  PID:9736
- C:\Windows\System\fjTfOkI.exe
  C:\Windows\System\fjTfOkI.exe
  2⤵
  PID:9756
- C:\Windows\System\vnaclRa.exe
  C:\Windows\System\vnaclRa.exe
  2⤵
  PID:9772
- C:\Windows\System\qHJJsCR.exe
  C:\Windows\System\qHJJsCR.exe
  2⤵
  PID:9792
- C:\Windows\System\ENJaruV.exe
  C:\Windows\System\ENJaruV.exe
  2⤵
  PID:9812
- C:\Windows\System\FbDuKLe.exe
  C:\Windows\System\FbDuKLe.exe
  2⤵
  PID:9828
- C:\Windows\System\lYNukap.exe
  C:\Windows\System\lYNukap.exe
  2⤵
  PID:9848
- C:\Windows\System\CkxhZOj.exe
  C:\Windows\System\CkxhZOj.exe
  2⤵
  PID:9868
- C:\Windows\System\edxuWaM.exe
  C:\Windows\System\edxuWaM.exe
  2⤵
  PID:9884
- C:\Windows\System\HuGHgCm.exe
  C:\Windows\System\HuGHgCm.exe
  2⤵
  PID:9904
- C:\Windows\System\nwTdGzf.exe
  C:\Windows\System\nwTdGzf.exe
  2⤵
  PID:9924
- C:\Windows\System\AbdCxhv.exe
  C:\Windows\System\AbdCxhv.exe
  2⤵
  PID:9940
- C:\Windows\System\qmniKsQ.exe
  C:\Windows\System\qmniKsQ.exe
  2⤵
  PID:9956
- C:\Windows\System\gOpdluQ.exe
  C:\Windows\System\gOpdluQ.exe
  2⤵
  PID:9972
- C:\Windows\System\gPZoniz.exe
  C:\Windows\System\gPZoniz.exe
  2⤵
  PID:9988
- C:\Windows\System\xmKPuoq.exe
  C:\Windows\System\xmKPuoq.exe
  2⤵
  PID:10008
- C:\Windows\System\Zzwhytv.exe
  C:\Windows\System\Zzwhytv.exe
  2⤵
  PID:10024
- C:\Windows\System\jVRcEWk.exe
  C:\Windows\System\jVRcEWk.exe
  2⤵
  PID:10044
- C:\Windows\System\RjIXTIn.exe
  C:\Windows\System\RjIXTIn.exe
  2⤵
  PID:10060
- C:\Windows\System\XgemSMc.exe
  C:\Windows\System\XgemSMc.exe
  2⤵
  PID:10080
- C:\Windows\System\vbnfJad.exe
  C:\Windows\System\vbnfJad.exe
  2⤵
  PID:10100
- C:\Windows\System\OHiIwkT.exe
  C:\Windows\System\OHiIwkT.exe
  2⤵
  PID:10116
- C:\Windows\System\OFXGVla.exe
  C:\Windows\System\OFXGVla.exe
  2⤵
  PID:10136
- C:\Windows\System\ZbeArjH.exe
  C:\Windows\System\ZbeArjH.exe
  2⤵
  PID:10156
- C:\Windows\System\oJVYapc.exe
  C:\Windows\System\oJVYapc.exe
  2⤵
  PID:10172
- C:\Windows\System\rgfRBqF.exe
  C:\Windows\System\rgfRBqF.exe
  2⤵
  PID:10192
- C:\Windows\System\urBSrzI.exe
  C:\Windows\System\urBSrzI.exe
  2⤵
  PID:10212
- C:\Windows\System\ujjVsUO.exe
  C:\Windows\System\ujjVsUO.exe
  2⤵
  PID:10228
- C:\Windows\System\QSctgPI.exe
  C:\Windows\System\QSctgPI.exe
  2⤵
  PID:10252
- C:\Windows\System\TmAdObV.exe
  C:\Windows\System\TmAdObV.exe
  2⤵
  PID:10272
- C:\Windows\System\gZQCiVk.exe
  C:\Windows\System\gZQCiVk.exe
  2⤵
  PID:10288
- C:\Windows\System\STYtgdU.exe
  C:\Windows\System\STYtgdU.exe
  2⤵
  PID:10308
- C:\Windows\System\wfuwQSv.exe
  C:\Windows\System\wfuwQSv.exe
  2⤵
  PID:10328
- C:\Windows\System\VsQRFND.exe
  C:\Windows\System\VsQRFND.exe
  2⤵
  PID:10344
- C:\Windows\System\chTtgcP.exe
  C:\Windows\System\chTtgcP.exe
  2⤵
  PID:10364
- C:\Windows\System\adFPQnG.exe
  C:\Windows\System\adFPQnG.exe
  2⤵
  PID:10384
- C:\Windows\System\RZUchCp.exe
  C:\Windows\System\RZUchCp.exe
  2⤵
  PID:10404
- C:\Windows\System\XUpqXfJ.exe
  C:\Windows\System\XUpqXfJ.exe
  2⤵
  PID:10424
- C:\Windows\System\DlEKJok.exe
  C:\Windows\System\DlEKJok.exe
  2⤵
  PID:10444
- C:\Windows\System\CVMDiuH.exe
  C:\Windows\System\CVMDiuH.exe
  2⤵
  PID:10460
- C:\Windows\System\NHgzzGR.exe
  C:\Windows\System\NHgzzGR.exe
  2⤵
  PID:10480
- C:\Windows\System\XpqqSpp.exe
  C:\Windows\System\XpqqSpp.exe
  2⤵
  PID:10500
- C:\Windows\System\lramVfL.exe
  C:\Windows\System\lramVfL.exe
  2⤵
  PID:10516
- C:\Windows\System\sjjRaIA.exe
  C:\Windows\System\sjjRaIA.exe
  2⤵
  PID:10536
- C:\Windows\System\NkzMeku.exe
  C:\Windows\System\NkzMeku.exe
  2⤵
  PID:10556
- C:\Windows\System\LbpzJAB.exe
  C:\Windows\System\LbpzJAB.exe
  2⤵
  PID:10572
- C:\Windows\System\EVEqwst.exe
  C:\Windows\System\EVEqwst.exe
  2⤵
  PID:10592
- C:\Windows\System\ATtFmdG.exe
  C:\Windows\System\ATtFmdG.exe
  2⤵
  PID:10612
- C:\Windows\System\tHeUtFB.exe
  C:\Windows\System\tHeUtFB.exe
  2⤵
  PID:10632
- C:\Windows\System\hznQDpp.exe
  C:\Windows\System\hznQDpp.exe
  2⤵
  PID:10648
- C:\Windows\System\vWzuhNb.exe
  C:\Windows\System\vWzuhNb.exe
  2⤵
  PID:10668
- C:\Windows\System\HOpIAMF.exe
  C:\Windows\System\HOpIAMF.exe
  2⤵
  PID:10684
- C:\Windows\System\cqvdHVf.exe
  C:\Windows\System\cqvdHVf.exe
  2⤵
  PID:10704
- C:\Windows\System\reWkfYa.exe
  C:\Windows\System\reWkfYa.exe
  2⤵
  PID:10724
- C:\Windows\System\MJgQdQy.exe
  C:\Windows\System\MJgQdQy.exe
  2⤵
  PID:10740
- C:\Windows\System\GdnXlqC.exe
  C:\Windows\System\GdnXlqC.exe
  2⤵
  PID:10760
- C:\Windows\System\CbhDhSY.exe
  C:\Windows\System\CbhDhSY.exe
  2⤵
  PID:10780
- C:\Windows\System\bWxYCnE.exe
  C:\Windows\System\bWxYCnE.exe
  2⤵
  PID:10796
- C:\Windows\System\NwmmefG.exe
  C:\Windows\System\NwmmefG.exe
  2⤵
  PID:10816
- C:\Windows\System\uhuBVrn.exe
  C:\Windows\System\uhuBVrn.exe
  2⤵
  PID:10836
- C:\Windows\System\eMDbZNv.exe
  C:\Windows\System\eMDbZNv.exe
  2⤵
  PID:10852
- C:\Windows\System\JENsMyM.exe
  C:\Windows\System\JENsMyM.exe
  2⤵
  PID:10872
- C:\Windows\System\eVwNAkw.exe
  C:\Windows\System\eVwNAkw.exe
  2⤵
  PID:10896
- C:\Windows\System\jAfnCRl.exe
  C:\Windows\System\jAfnCRl.exe
  2⤵
  PID:10912
- C:\Windows\System\XtOTviF.exe
  C:\Windows\System\XtOTviF.exe
  2⤵
  PID:10936
- C:\Windows\System\rIjEUUf.exe
  C:\Windows\System\rIjEUUf.exe
  2⤵
  PID:10952
- C:\Windows\System\mADwqDV.exe
  C:\Windows\System\mADwqDV.exe
  2⤵
  PID:10972
- C:\Windows\System\IKiDppq.exe
  C:\Windows\System\IKiDppq.exe
  2⤵
  PID:10992
- C:\Windows\System\PNyXrcr.exe
  C:\Windows\System\PNyXrcr.exe
  2⤵
  PID:11008
- C:\Windows\System\FxYgWQx.exe
  C:\Windows\System\FxYgWQx.exe
  2⤵
  PID:11032
- C:\Windows\System\giwcxDf.exe
  C:\Windows\System\giwcxDf.exe
  2⤵
  PID:11048
- C:\Windows\System\bmDqvQd.exe
  C:\Windows\System\bmDqvQd.exe
  2⤵
  PID:11072
- C:\Windows\System\rdQpOdI.exe
  C:\Windows\System\rdQpOdI.exe
  2⤵
  PID:11088
- C:\Windows\System\gnOarAf.exe
  C:\Windows\System\gnOarAf.exe
  2⤵
  PID:11200
- C:\Windows\System\cRAQrDT.exe
  C:\Windows\System\cRAQrDT.exe
  2⤵
  PID:11388
- C:\Windows\System\amsUhSY.exe
  C:\Windows\System\amsUhSY.exe
  2⤵
  PID:11408
- C:\Windows\System\vPAgWyb.exe
  C:\Windows\System\vPAgWyb.exe
  2⤵
  PID:11424
- C:\Windows\System\YUsUYpL.exe
  C:\Windows\System\YUsUYpL.exe
  2⤵
  PID:11444
- C:\Windows\System\WGQhKWv.exe
  C:\Windows\System\WGQhKWv.exe
  2⤵
  PID:11460
- C:\Windows\System\jrKmEXc.exe
  C:\Windows\System\jrKmEXc.exe
  2⤵
  PID:11488
- C:\Windows\System\JAeVnmY.exe
  C:\Windows\System\JAeVnmY.exe
  2⤵
  PID:11564
- C:\Windows\System\teNOKTp.exe
  C:\Windows\System\teNOKTp.exe
  2⤵
  PID:11616
- C:\Windows\System\ILUPWJT.exe
  C:\Windows\System\ILUPWJT.exe
  2⤵
  PID:11636
- C:\Windows\System\PWngHGg.exe
  C:\Windows\System\PWngHGg.exe
  2⤵
  PID:11656
- C:\Windows\System\sgcaSCG.exe
  C:\Windows\System\sgcaSCG.exe
  2⤵
  PID:11680
- C:\Windows\System\aHClnkw.exe
  C:\Windows\System\aHClnkw.exe
  2⤵
  PID:11704
- C:\Windows\System\EvSKXuk.exe
  C:\Windows\System\EvSKXuk.exe
  2⤵
  PID:11720
- C:\Windows\System\OMiaQwi.exe
  C:\Windows\System\OMiaQwi.exe
  2⤵
  PID:11796
- C:\Windows\System\hjNNYBx.exe
  C:\Windows\System\hjNNYBx.exe
  2⤵
  PID:11860
- C:\Windows\System\LOVuguq.exe
  C:\Windows\System\LOVuguq.exe
  2⤵
  PID:11876
- C:\Windows\System\yeTstxk.exe
  C:\Windows\System\yeTstxk.exe
  2⤵
  PID:11896
- C:\Windows\System\ZoEGMLw.exe
  C:\Windows\System\ZoEGMLw.exe
  2⤵
  PID:11916
- C:\Windows\System\wdlhWjj.exe
  C:\Windows\System\wdlhWjj.exe
  2⤵
  PID:11932
- C:\Windows\System\NSOgeaq.exe
  C:\Windows\System\NSOgeaq.exe
  2⤵
  PID:11952
- C:\Windows\System\oXzGVZC.exe
  C:\Windows\System\oXzGVZC.exe
  2⤵
  PID:11972
- C:\Windows\System\SCywkDW.exe
  C:\Windows\System\SCywkDW.exe
  2⤵
  PID:11988
- C:\Windows\System\gxHiNZl.exe
  C:\Windows\System\gxHiNZl.exe
  2⤵
  PID:12004
- C:\Windows\System\pkBvdAJ.exe
  C:\Windows\System\pkBvdAJ.exe
  2⤵
  PID:12020
- C:\Windows\System\SbPgzzh.exe
  C:\Windows\System\SbPgzzh.exe
  2⤵
  PID:12036
- C:\Windows\System\dgIrDnP.exe
  C:\Windows\System\dgIrDnP.exe
  2⤵
  PID:12052
- C:\Windows\System\nNXUpaz.exe
  C:\Windows\System\nNXUpaz.exe
  2⤵
  PID:12068
- C:\Windows\System\fzGIYaO.exe
  C:\Windows\System\fzGIYaO.exe
  2⤵
  PID:12084
- C:\Windows\System\VEuRCzb.exe
  C:\Windows\System\VEuRCzb.exe
  2⤵
  PID:12104
- C:\Windows\System\WkkvgSZ.exe
  C:\Windows\System\WkkvgSZ.exe
  2⤵
  PID:12128
- C:\Windows\System\XvkMelT.exe
  C:\Windows\System\XvkMelT.exe
  2⤵
  PID:12148
- C:\Windows\System\fyWoMob.exe
  C:\Windows\System\fyWoMob.exe
  2⤵
  PID:12164
- C:\Windows\System\CyxKrGJ.exe
  C:\Windows\System\CyxKrGJ.exe
  2⤵
  PID:12184
- C:\Windows\System\iHxzvzR.exe
  C:\Windows\System\iHxzvzR.exe
  2⤵
  PID:12200
- C:\Windows\System\Soduoxz.exe
  C:\Windows\System\Soduoxz.exe
  2⤵
  PID:12216
- C:\Windows\System\xQNUDka.exe
  C:\Windows\System\xQNUDka.exe
  2⤵
  PID:12236
- C:\Windows\System\YPRQaBE.exe
  C:\Windows\System\YPRQaBE.exe
  2⤵
  PID:12252
- C:\Windows\System\aefUVQz.exe
  C:\Windows\System\aefUVQz.exe
  2⤵
  PID:12268
- C:\Windows\System\MhQsotv.exe
  C:\Windows\System\MhQsotv.exe
  2⤵
  PID:12284
- C:\Windows\System\fCviiFE.exe
  C:\Windows\System\fCviiFE.exe
  2⤵
  PID:7832
- C:\Windows\System\Vzylswm.exe
  C:\Windows\System\Vzylswm.exe
  2⤵
  PID:8080
- C:\Windows\System\wTsscqQ.exe
  C:\Windows\System\wTsscqQ.exe
  2⤵
  PID:8356
- C:\Windows\System\MIXffex.exe
  C:\Windows\System\MIXffex.exe
  2⤵
  PID:8464
- C:\Windows\System\rTmZLys.exe
  C:\Windows\System\rTmZLys.exe
  2⤵
  PID:8552
- C:\Windows\System\ZAgHQvQ.exe
  C:\Windows\System\ZAgHQvQ.exe
  2⤵
  PID:8700
- C:\Windows\System\ayyUGFR.exe
  C:\Windows\System\ayyUGFR.exe
  2⤵
  PID:8752
- C:\Windows\System\EoUSOWT.exe
  C:\Windows\System\EoUSOWT.exe
  2⤵
  PID:8776
- C:\Windows\System\mQCEAQc.exe
  C:\Windows\System\mQCEAQc.exe
  2⤵
  PID:8908
- C:\Windows\System\ltSgytc.exe
  C:\Windows\System\ltSgytc.exe
  2⤵
  PID:8964
- C:\Windows\System\czkitwm.exe
  C:\Windows\System\czkitwm.exe
  2⤵
  PID:9080
- C:\Windows\System\miCkBtE.exe
  C:\Windows\System\miCkBtE.exe
  2⤵
  PID:9248
- C:\Windows\System\YkddGFo.exe
  C:\Windows\System\YkddGFo.exe
  2⤵
  PID:9324
- C:\Windows\System\gCKPmYW.exe
  C:\Windows\System\gCKPmYW.exe
  2⤵
  PID:9360
- C:\Windows\System\MVOivui.exe
  C:\Windows\System\MVOivui.exe
  2⤵
  PID:9392
- C:\Windows\System\vgMBkEI.exe
  C:\Windows\System\vgMBkEI.exe
  2⤵
  PID:12292
- C:\Windows\System\YaCaZDT.exe
  C:\Windows\System\YaCaZDT.exe
  2⤵
  PID:12308
- C:\Windows\System\qCCutML.exe
  C:\Windows\System\qCCutML.exe
  2⤵
  PID:12328
- C:\Windows\System\ZUHpvpe.exe
  C:\Windows\System\ZUHpvpe.exe
  2⤵
  PID:12348
- C:\Windows\System\AuUiGcK.exe
  C:\Windows\System\AuUiGcK.exe
  2⤵
  PID:12364
- C:\Windows\System\cGFarCn.exe
  C:\Windows\System\cGFarCn.exe
  2⤵
  PID:12384
- C:\Windows\System\yzLjWIL.exe
  C:\Windows\System\yzLjWIL.exe
  2⤵
  PID:12400
- C:\Windows\System\GFSGNUW.exe
  C:\Windows\System\GFSGNUW.exe
  2⤵
  PID:12420
- C:\Windows\System\GBujjFS.exe
  C:\Windows\System\GBujjFS.exe
  2⤵
  PID:12436
- C:\Windows\System\vVJLlRQ.exe
  C:\Windows\System\vVJLlRQ.exe
  2⤵
  PID:12452
- C:\Windows\System\BzAYGmo.exe
  C:\Windows\System\BzAYGmo.exe
  2⤵
  PID:12472
- C:\Windows\System\bUSyanG.exe
  C:\Windows\System\bUSyanG.exe
  2⤵
  PID:12488
- C:\Windows\System\UpKXmuu.exe
  C:\Windows\System\UpKXmuu.exe
  2⤵
  PID:12504
- C:\Windows\System\zFSipsb.exe
  C:\Windows\System\zFSipsb.exe
  2⤵
  PID:12520
- C:\Windows\System\QUMVPDp.exe
  C:\Windows\System\QUMVPDp.exe
  2⤵
  PID:12536
- C:\Windows\System\VwpvVYP.exe
  C:\Windows\System\VwpvVYP.exe
  2⤵
  PID:12552
- C:\Windows\System\fPIQiQX.exe
  C:\Windows\System\fPIQiQX.exe
  2⤵
  PID:12568
- C:\Windows\System\rkbdDKb.exe
  C:\Windows\System\rkbdDKb.exe
  2⤵
  PID:12588
- C:\Windows\System\AANyUqe.exe
  C:\Windows\System\AANyUqe.exe
  2⤵
  PID:12604
- C:\Windows\System\qOweJpq.exe
  C:\Windows\System\qOweJpq.exe
  2⤵
  PID:12620
- C:\Windows\System\bCHAyUX.exe
  C:\Windows\System\bCHAyUX.exe
  2⤵
  PID:12636
- C:\Windows\System\OeOOEMb.exe
  C:\Windows\System\OeOOEMb.exe
  2⤵
  PID:12652
- C:\Windows\System\Yjypxcb.exe
  C:\Windows\System\Yjypxcb.exe
  2⤵
  PID:12668
- C:\Windows\System\FOoFtUA.exe
  C:\Windows\System\FOoFtUA.exe
  2⤵
  PID:12688
- C:\Windows\System\AnqZfNb.exe
  C:\Windows\System\AnqZfNb.exe
  2⤵
  PID:12708
- C:\Windows\System\YdQJDAq.exe
  C:\Windows\System\YdQJDAq.exe
  2⤵
  PID:12728
- C:\Windows\System\TmoLbLE.exe
  C:\Windows\System\TmoLbLE.exe
  2⤵
  PID:12748
- C:\Windows\System\LjqvEvo.exe
  C:\Windows\System\LjqvEvo.exe
  2⤵
  PID:12768
- C:\Windows\System\xFNkrmq.exe
  C:\Windows\System\xFNkrmq.exe
  2⤵
  PID:12788
- C:\Windows\System\KpFyfVd.exe
  C:\Windows\System\KpFyfVd.exe
  2⤵
  PID:12804
- C:\Windows\System\QLDiGNf.exe
  C:\Windows\System\QLDiGNf.exe
  2⤵
  PID:12820
- C:\Windows\System\YOLIPDN.exe
  C:\Windows\System\YOLIPDN.exe
  2⤵
  PID:12836
- C:\Windows\System\bulYghu.exe
  C:\Windows\System\bulYghu.exe
  2⤵
  PID:12856
- C:\Windows\System\HkNazKy.exe
  C:\Windows\System\HkNazKy.exe
  2⤵
  PID:12872
- C:\Windows\System\chlpiJY.exe
  C:\Windows\System\chlpiJY.exe
  2⤵
  PID:12888
- C:\Windows\System\MlTPULG.exe
  C:\Windows\System\MlTPULG.exe
  2⤵
  PID:12904
- C:\Windows\System\uCdObEC.exe
  C:\Windows\System\uCdObEC.exe
  2⤵
  PID:12920
- C:\Windows\System\NJveZuh.exe
  C:\Windows\System\NJveZuh.exe
  2⤵
  PID:12936
- C:\Windows\System\rWBHdHw.exe
  C:\Windows\System\rWBHdHw.exe
  2⤵
  PID:12952
- C:\Windows\System\rffZNPC.exe
  C:\Windows\System\rffZNPC.exe
  2⤵
  PID:12968
- C:\Windows\System\wSFcBNo.exe
  C:\Windows\System\wSFcBNo.exe
  2⤵
  PID:12984
- C:\Windows\System\EEMvlGI.exe
  C:\Windows\System\EEMvlGI.exe
  2⤵
  PID:13000
- C:\Windows\System\YiJTJgT.exe
  C:\Windows\System\YiJTJgT.exe
  2⤵
  PID:13016
- C:\Windows\System\KqDFBnx.exe
  C:\Windows\System\KqDFBnx.exe
  2⤵
  PID:13036
- C:\Windows\System\EAsCNBp.exe
  C:\Windows\System\EAsCNBp.exe
  2⤵
  PID:13052
- C:\Windows\System\KTaUGMG.exe
  C:\Windows\System\KTaUGMG.exe
  2⤵
  PID:13068
- C:\Windows\System\LMPihyl.exe
  C:\Windows\System\LMPihyl.exe
  2⤵
  PID:13088
- C:\Windows\System\pODiQhT.exe
  C:\Windows\System\pODiQhT.exe
  2⤵
  PID:13108
- C:\Windows\System\SGHfnxr.exe
  C:\Windows\System\SGHfnxr.exe
  2⤵
  PID:13128
- C:\Windows\System\iiOXgAQ.exe
  C:\Windows\System\iiOXgAQ.exe
  2⤵
  PID:13144
- C:\Windows\System\UQOCGau.exe
  C:\Windows\System\UQOCGau.exe
  2⤵
  PID:13164
- C:\Windows\System\MLfrNmS.exe
  C:\Windows\System\MLfrNmS.exe
  2⤵
  PID:13184
- C:\Windows\System\KWRkDWu.exe
  C:\Windows\System\KWRkDWu.exe
  2⤵
  PID:13200
- C:\Windows\System\uriessh.exe
  C:\Windows\System\uriessh.exe
  2⤵
  PID:13220
- C:\Windows\System\VZImDzF.exe
  C:\Windows\System\VZImDzF.exe
  2⤵
  PID:13240
- C:\Windows\System\TwHWyjY.exe
  C:\Windows\System\TwHWyjY.exe
  2⤵
  PID:13256
- C:\Windows\System\VbLIAvx.exe
  C:\Windows\System\VbLIAvx.exe
  2⤵
  PID:13276
- C:\Windows\System\JnsiOYU.exe
  C:\Windows\System\JnsiOYU.exe
  2⤵
  PID:13292
- C:\Windows\System\PQcFRSj.exe
  C:\Windows\System\PQcFRSj.exe
  2⤵
  PID:13308
- C:\Windows\System\ukRvWXv.exe
  C:\Windows\System\ukRvWXv.exe
  2⤵
  PID:9860
- C:\Windows\System\osnIwny.exe
  C:\Windows\System\osnIwny.exe
  2⤵
  PID:9936
- C:\Windows\System\uiZVVYq.exe
  C:\Windows\System\uiZVVYq.exe
  2⤵
  PID:10052
- C:\Windows\System\lqbFOAR.exe
  C:\Windows\System\lqbFOAR.exe
  2⤵
  PID:10224
- C:\Windows\System\nvgLUiG.exe
  C:\Windows\System\nvgLUiG.exe
  2⤵
  PID:10264
- C:\Windows\System\uHJbzeS.exe
  C:\Windows\System\uHJbzeS.exe
  2⤵
  PID:10304
- C:\Windows\System\OUGGxUT.exe
  C:\Windows\System\OUGGxUT.exe
  2⤵
  PID:10340
- C:\Windows\System\YhbJDzi.exe
  C:\Windows\System\YhbJDzi.exe
  2⤵
  PID:10372
- C:\Windows\System\hdEWylE.exe
  C:\Windows\System\hdEWylE.exe
  2⤵
  PID:10432
- C:\Windows\System\SnxfQsU.exe
  C:\Windows\System\SnxfQsU.exe
  2⤵
  PID:10456
- C:\Windows\System\KFHoWsf.exe
  C:\Windows\System\KFHoWsf.exe
  2⤵
  PID:10568
- C:\Windows\System\XSSxFTd.exe
  C:\Windows\System\XSSxFTd.exe
  2⤵
  PID:10768
- C:\Windows\System\ZkziezY.exe
  C:\Windows\System\ZkziezY.exe
  2⤵
  PID:10804
- C:\Windows\System\lTlJdtG.exe
  C:\Windows\System\lTlJdtG.exe
  2⤵
  PID:10828
- C:\Windows\System\DjSxxMa.exe
  C:\Windows\System\DjSxxMa.exe
  2⤵
  PID:10868
- C:\Windows\System\sVdmubA.exe
  C:\Windows\System\sVdmubA.exe
  2⤵
  PID:7144
- C:\Windows\System\LYVIUuq.exe
  C:\Windows\System\LYVIUuq.exe
  2⤵
  PID:8468
- C:\Windows\System\XcHkQVG.exe
  C:\Windows\System\XcHkQVG.exe
  2⤵
  PID:8736
- C:\Windows\System\FQpcaRK.exe
  C:\Windows\System\FQpcaRK.exe
  2⤵
  PID:8852
- C:\Windows\System\lUjUMtR.exe
  C:\Windows\System\lUjUMtR.exe
  2⤵
  PID:12160
- C:\Windows\System\RXWhaRh.exe
  C:\Windows\System\RXWhaRh.exe
  2⤵
  PID:12180
- C:\Windows\System\hZHHSmo.exe
  C:\Windows\System\hZHHSmo.exe
  2⤵
  PID:12192
- C:\Windows\System\jyvPnAU.exe
  C:\Windows\System\jyvPnAU.exe
  2⤵
  PID:12212
- C:\Windows\System\uKBNJpe.exe
  C:\Windows\System\uKBNJpe.exe
  2⤵
  PID:9036
- C:\Windows\System\USBfsxn.exe
  C:\Windows\System\USBfsxn.exe
  2⤵
  PID:9060
- C:\Windows\System\vwcHttw.exe
  C:\Windows\System\vwcHttw.exe
  2⤵
  PID:9072
- C:\Windows\System\BTifhIx.exe
  C:\Windows\System\BTifhIx.exe
  2⤵
  PID:9204
- C:\Windows\System\gWeMmqN.exe
  C:\Windows\System\gWeMmqN.exe
  2⤵
  PID:9264
- C:\Windows\System\wZsbUjL.exe
  C:\Windows\System\wZsbUjL.exe
  2⤵
  PID:7712
- C:\Windows\System\PlDZbDA.exe
  C:\Windows\System\PlDZbDA.exe
  2⤵
  PID:8720
- C:\Windows\System\WoWekFj.exe
  C:\Windows\System\WoWekFj.exe
  2⤵
  PID:13332
- C:\Windows\System\FuABkXx.exe
  C:\Windows\System\FuABkXx.exe
  2⤵
  PID:13352
- C:\Windows\System\YtLQCXS.exe
  C:\Windows\System\YtLQCXS.exe
  2⤵
  PID:13372
- C:\Windows\System\GVElzOw.exe
  C:\Windows\System\GVElzOw.exe
  2⤵
  PID:13720
- C:\Windows\System\QLckkYl.exe
  C:\Windows\System\QLckkYl.exe
  2⤵
  PID:13752
- C:\Windows\System\UCFRAAA.exe
  C:\Windows\System\UCFRAAA.exe
  2⤵
  PID:13784
- C:\Windows\System\SQvbxbA.exe
  C:\Windows\System\SQvbxbA.exe
  2⤵
  PID:13800
- C:\Windows\System\MMMIHzQ.exe
  C:\Windows\System\MMMIHzQ.exe
  2⤵
  PID:13816
- C:\Windows\System\jGEikdV.exe
  C:\Windows\System\jGEikdV.exe
  2⤵
  PID:13756
- C:\Windows\System\aKvSmQV.exe
  C:\Windows\System\aKvSmQV.exe
  2⤵
  PID:3968
- C:\Windows\System\GzyZQSo.exe
  C:\Windows\System\GzyZQSo.exe
  2⤵
  PID:2868
- C:\Windows\System\WbOgstc.exe
  C:\Windows\System\WbOgstc.exe
  2⤵
  PID:13916
- C:\Windows\System\SYUipvu.exe
  C:\Windows\System\SYUipvu.exe
  2⤵
  PID:4124
- C:\Windows\System\owrMXEC.exe
  C:\Windows\System\owrMXEC.exe
  2⤵
  PID:13956
- C:\Windows\System\wGBlmwK.exe
  C:\Windows\System\wGBlmwK.exe
  2⤵
  PID:1860
- C:\Windows\System\eCPyNYT.exe
  C:\Windows\System\eCPyNYT.exe
  2⤵
  PID:13856
- C:\Windows\System\taXhMBE.exe
  C:\Windows\System\taXhMBE.exe
  2⤵
  PID:13972
- C:\Windows\System\QzvSPOZ.exe
  C:\Windows\System\QzvSPOZ.exe
  2⤵
  PID:13900
- C:\Windows\System\auVprtI.exe
  C:\Windows\System\auVprtI.exe
  2⤵
  PID:14276
- C:\Windows\System\BQSKLwX.exe
  C:\Windows\System\BQSKLwX.exe
  2⤵
  PID:14308
- C:\Windows\System\uyWSnRd.exe
  C:\Windows\System\uyWSnRd.exe
  2⤵
  PID:12776
- C:\Windows\System\hxNqguc.exe
  C:\Windows\System\hxNqguc.exe
  2⤵
  PID:13272
- C:\Windows\System\mnzwcMY.exe
  C:\Windows\System\mnzwcMY.exe
  2⤵
  PID:14140
- C:\Windows\System\ORKrPBf.exe
  C:\Windows\System\ORKrPBf.exe
  2⤵
  PID:7368
- C:\Windows\System\wLmafic.exe
  C:\Windows\System\wLmafic.exe
  2⤵
  PID:7536
- C:\Windows\System\WQQeBmn.exe
  C:\Windows\System\WQQeBmn.exe
  2⤵
  PID:14004
- C:\Windows\System\otRBqhD.exe
  C:\Windows\System\otRBqhD.exe
  2⤵
  PID:14060
- C:\Windows\System\gMZWiAk.exe
  C:\Windows\System\gMZWiAk.exe
  2⤵
  PID:9672
- C:\Windows\System\uSjINrK.exe
  C:\Windows\System\uSjINrK.exe
  2⤵
  PID:4632
- C:\Windows\System\xpEdeDh.exe
  C:\Windows\System\xpEdeDh.exe
  2⤵
  PID:9376
- C:\Windows\System\NxGzJPn.exe
  C:\Windows\System\NxGzJPn.exe
  2⤵
  PID:9724
- C:\Windows\System\gxttHbo.exe
  C:\Windows\System\gxttHbo.exe
  2⤵
  PID:9980
- C:\Windows\System\gmKUdIp.exe
  C:\Windows\System\gmKUdIp.exe
  2⤵
  PID:9880
- C:\Windows\System\qenuguh.exe
  C:\Windows\System\qenuguh.exe
  2⤵
  PID:10164
- C:\Windows\System\EReDqwv.exe
  C:\Windows\System\EReDqwv.exe
  2⤵
  PID:14144
- C:\Windows\System\KeBGELM.exe
  C:\Windows\System\KeBGELM.exe
  2⤵
  PID:12784
- C:\Windows\System\beLAVik.exe
  C:\Windows\System\beLAVik.exe
  2⤵
  PID:12980
- C:\Windows\System\HupFOBQ.exe
  C:\Windows\System\HupFOBQ.exe
  2⤵
  PID:8928
- C:\Windows\System\RipgXQH.exe
  C:\Windows\System\RipgXQH.exe
  2⤵
  PID:4396
- C:\Windows\System\ykcudru.exe
  C:\Windows\System\ykcudru.exe
  2⤵
  PID:13760
- C:\Windows\System\LNPlugH.exe
  C:\Windows\System\LNPlugH.exe
  2⤵
  PID:13852
- C:\Windows\System\eRaxsjg.exe
  C:\Windows\System\eRaxsjg.exe
  2⤵
  PID:11888
- C:\Windows\System\wBraZHc.exe
  C:\Windows\System\wBraZHc.exe
  2⤵
  PID:12392
- C:\Windows\System\lWOffkz.exe
  C:\Windows\System\lWOffkz.exe
  2⤵
  PID:13380
- C:\Windows\System\zdldjis.exe
  C:\Windows\System\zdldjis.exe
  2⤵
  PID:13416
- C:\Windows\System\NeptKia.exe
  C:\Windows\System\NeptKia.exe
  2⤵
  PID:13988
- C:\Windows\System\oDzWsEQ.exe
  C:\Windows\System\oDzWsEQ.exe
  2⤵
  PID:4440
- C:\Windows\System\LDUQxno.exe
  C:\Windows\System\LDUQxno.exe
  2⤵
  PID:3368
- C:\Windows\System\JihbXYY.exe
  C:\Windows\System\JihbXYY.exe
  2⤵
  PID:13792
- C:\Windows\System\QdAuWFj.exe
  C:\Windows\System\QdAuWFj.exe
  2⤵
  PID:14176
- C:\Windows\System\bvLFplq.exe
  C:\Windows\System\bvLFplq.exe
  2⤵
  PID:13992
- C:\Windows\System\gtwsxPG.exe
  C:\Windows\System\gtwsxPG.exe
  2⤵
  PID:14204
- C:\Windows\System\VJbEVuI.exe
  C:\Windows\System\VJbEVuI.exe
  2⤵
  PID:4636
- C:\Windows\System\uIeFyxi.exe
  C:\Windows\System\uIeFyxi.exe
  2⤵
  PID:14120
- C:\Windows\System\YVjPPle.exe
  C:\Windows\System\YVjPPle.exe
  2⤵
  PID:5600
- C:\Windows\System\KborsIt.exe
  C:\Windows\System\KborsIt.exe
  2⤵
  PID:13180
- C:\Windows\System\JNuQPTf.exe
  C:\Windows\System\JNuQPTf.exe
  2⤵
  PID:12032
- C:\Windows\System\eZjxcRO.exe
  C:\Windows\System\eZjxcRO.exe
  2⤵
  PID:14232
- C:\Windows\System\mGfQmcu.exe
  C:\Windows\System\mGfQmcu.exe
  2⤵
  PID:13084
- C:\Windows\System\aZKMZEH.exe
  C:\Windows\System\aZKMZEH.exe
  2⤵
  PID:11728
- C:\Windows\System\jIEsAfD.exe
  C:\Windows\System\jIEsAfD.exe
  2⤵
  PID:13368
- C:\Windows\System\leAMBxf.exe
  C:\Windows\System\leAMBxf.exe
  2⤵
  PID:13432
- C:\Windows\System\IaPOkPN.exe
  C:\Windows\System\IaPOkPN.exe
  2⤵
  PID:13748
- C:\Windows\System\JaNxxay.exe
  C:\Windows\System\JaNxxay.exe
  2⤵
  PID:10392
- C:\Windows\System\GTzwneo.exe
  C:\Windows\System\GTzwneo.exe
  2⤵
  PID:10584
- C:\Windows\System\JuTgLWy.exe
  C:\Windows\System\JuTgLWy.exe
  2⤵
  PID:13780
- C:\Windows\System\ucjNRAO.exe
  C:\Windows\System\ucjNRAO.exe
  2⤵
  PID:14052
- C:\Windows\System\RyYvoQN.exe
  C:\Windows\System\RyYvoQN.exe
  2⤵
  PID:12800
- C:\Windows\System\bMKeiIE.exe
  C:\Windows\System\bMKeiIE.exe
  2⤵
  PID:12676
- C:\Windows\System\zwQYOHc.exe
  C:\Windows\System\zwQYOHc.exe
  2⤵
  PID:12700
- C:\Windows\System\SPpBesP.exe
  C:\Windows\System\SPpBesP.exe
  2⤵
  PID:9512
- C:\Windows\System\fORBqfL.exe
  C:\Windows\System\fORBqfL.exe
  2⤵
  PID:14316
- C:\Windows\System\BHnNiMh.exe
  C:\Windows\System\BHnNiMh.exe
  2⤵
  PID:13768
- C:\Windows\System\avFpBqn.exe
  C:\Windows\System\avFpBqn.exe
  2⤵
  PID:13704
- C:\Windows\System\otxTsOw.exe
  C:\Windows\System\otxTsOw.exe
  2⤵
  PID:13156
- C:\Windows\System\aMKSWgI.exe
  C:\Windows\System\aMKSWgI.exe
  2⤵
  PID:7236
- C:\Windows\System\ZpXuVeV.exe
  C:\Windows\System\ZpXuVeV.exe
  2⤵
  PID:11440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jsfbdb0s.dik.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CkMNaDN.exe

Filesize
1.4MB

MD5
4377c649cf1334bd6ed56c3f98758e3e

SHA1
6eda09d1092fbc6871e05a7b79ebee7d1c621cd8

SHA256
1f212785db4b354d39d91862e91f8ce2b35540a2e8a6dfc14fd5343b5c182dd9

SHA512
264528cc3f6d1f663adbd3f44ca86e59dbe179c391383380f40b3d2ed6857e3ac6d4273a6e7976ee7e959d15a74ce546a14c2644375c90b1ba52338317842730

Download Submit
C:\Windows\System\EGPoaiQ.exe

Filesize
1.4MB

MD5
687d356d9918255b30ef5c332beb3ed6

SHA1
53391607d232737fb7d3a89d78b6f0b0eee92641

SHA256
bb22ca6f2a1e0f401c445972eb642bf35b49af701aec863f0973b0d7f1e0bff0

SHA512
0251d3c339d6dee4f8dcf95e686d97a7bfbfaae2a5fc51df3903c7987f79694332748a02066bb8fb3d17ec598924662f9864a79026e10e29862214e62d550ca6

Download Submit
C:\Windows\System\ERPhNSB.exe

Filesize
1.4MB

MD5
0aabf6955af5ec0d7cdb64b0b736655b

SHA1
1abd082ec8b1f97be3028f44ab18699bab34c3f2

SHA256
cfafe515bd375c8bfe0feab3d448413f3f309d387f38663ff5d1ccc604604caa

SHA512
30558b12913e5220f7bba9bfd7d4c5a3cc94fadd2f8ab595d0a50dbf203b0df6565c789461ff51afa6b42882a578cbee5cf603f4c30d2e792587738972e686ab

Download Submit
C:\Windows\System\ETYQbhd.exe

Filesize
1.4MB

MD5
26d4a14ed77d841bf1422a29d6362b62

SHA1
5c05157070c1518af7e5dbcdd56aed4bdaf7df12

SHA256
5def9cee58e25509581d7ae0a095795dcc765101918c20b1b40f7c584a5a1d99

SHA512
152a62e6aa97fc2b115019751a3bbeb999299c6a8e4a1bc883b7d9c343b9ab86c69eacb92a8a7d0bf02bc3f35b901709c41635acc85eb1527d09fc9f0f5f4f48

Download Submit
C:\Windows\System\GbAuVmr.exe

Filesize
1.4MB

MD5
4d0cfc2cb799316407dd60f569e24d4e

SHA1
61b102262fc90e27fdc4932a5c7e1e86ce0c823b

SHA256
cac49fe6da433de5cfc2296befeb810ad9df0bc1f3f81af46b48095636256cc1

SHA512
4b6c0a620976c294f4442a77ff430b8c151e169bc09ea01a52698997b7b644fab50421bac3de127fefc613923203811ceb3fe86c6786b6dda940a3103bf8820d

Download Submit
C:\Windows\System\GiVxXWW.exe

Filesize
1.4MB

MD5
978be8f5054e908ba0bad0eb43e780dc

SHA1
bdbb8bfec574d36a6054f52dc7fb2e3b34376c12

SHA256
219312b3b166d4771a417568c22e87fec6c392501ad7a8c1b0e8fda731e42803

SHA512
d431320b0692115e478a6995843fbda13f93d0498aee6eba8db1dc8ad15c9ae8593a23eba773c7fb5036cc38f31c543c929cebe8a6a02608c76da39116661e9f

Download Submit
C:\Windows\System\HWtqvTV.exe

Filesize
1.4MB

MD5
5c4faa819df9df125b331591f084e7d8

SHA1
a8709b04532bc0e400ccba9f0d89b9876ed47883

SHA256
6ecea13c1cb712657d5812c1b6e9073d7f68ac5bbefcda9e84cd56c5e5dd20f8

SHA512
f7b486a6b25a94e26ab287cc58f3b4bbbace3a3a4f440e9a7fdf45bb9675cb55063fd6cf577be008f2ad150d6b8177152442168bbbe1cf744dc0cf952b36d450

Download Submit
C:\Windows\System\IsgkcJn.exe

Filesize
1.4MB

MD5
557a6257dec4501ac9873d336c92879f

SHA1
a28577aea088ea5683d70958cdbeb29fda4e7400

SHA256
9467551aab447e44e89fe51607b5f3206550ebe477d7bcf0e76aab019ae22de5

SHA512
e8138f0c231b3e7940b5bd4150dfd5e4343a807bf72951be1f5ee30f36f554e077d56e94ab107e19ed99e05b335ea2e91ed1fab34ca291cfeee36a4424fdb996

Download Submit
C:\Windows\System\JuNFTCV.exe

Filesize
1.4MB

MD5
69651c7d6019436e8d1e2bc45a96a959

SHA1
e34d1cec9e2e225ca7bb052c16d36dde6e016e5f

SHA256
7490ac57dad88a556c605cae09386f9d8dcc2978b70fabe1100fee3caf8d66d7

SHA512
cb18dc953ef2ac775b3edf8583b75ecc9e17fd7ae67e7cff116024205ea0ad1856f44beaea855fd3e86090ce4a9980ffe39a83cd3a23f60b1cf0859bfa8fd264

Download Submit
C:\Windows\System\KVwinXu.exe

Filesize
1.4MB

MD5
86fe7da9a44f86f703c0a286c40a9839

SHA1
d88501c47b14935c4fc13f4c7eb48ce65042a413

SHA256
77e93544a83f43b71af1abf711ebaa79e32435bff79393c6cc0ee2c51c713792

SHA512
74834970b328b223d3fce67357740616470884aa5d2f4d98a51a6f35e411d3b31016bd0ce1f99f9ac290fc347db46d1afb06c890abe1f1590671ba13a26b2176

Download Submit
C:\Windows\System\LYfKKmF.exe

Filesize
1.4MB

MD5
7e0e533c31ccccef1345d8e25a963346

SHA1
8a0228419ad4d9ec79f9c06efa463a90cfab6f41

SHA256
c67cbf47c7fdf21aff984c346c2fdd2f39c2916277e9ae2866decc025f3d9b66

SHA512
c2bfc121fa02795ad23008c37bce184db50cd3c7d006b172e6fee5ef097d29dab6e2ccf02da3f0f8024c02ef1953963a6eb1a30aa4f3657d448afd6e1aa717d4

Download Submit
C:\Windows\System\ObeiEtC.exe

Filesize
1.4MB

MD5
83e61959d3b1e0b73bf4c4c0518802fe

SHA1
ef490d28f556c5c0497154ca85046696a7188f39

SHA256
05e30c7910b4da7328ce8ddb4ac8d794176515604aa8e509ac2ff3a7a21459f8

SHA512
b4cd5aba6c78a9221e62630675a38261e1cb7c536abc828a82c2337c365d6a6c6b71b253e88f3652b4960b5d449df4b2896d8ece799b7405c56f768316b21c2a

Download Submit
C:\Windows\System\PmRvvcG.exe

Filesize
1.4MB

MD5
39fa5e0cf5729cae78d699a5251f59b0

SHA1
aac3913cda4ef0457b42516ac19a49f5709eedda

SHA256
e88bb80a4093e5f5a9c4012ee3c0a9550c3b424ab38d96e8a0374578e03faa75

SHA512
5d9d713a015846ec0aac5b52b75571390800e7b8b6220e17f5bb14e59ca61ee69859428eb15b4ab7ba486d7112779f5869585cf5460d406fe00be9649fc1e29e

Download Submit
C:\Windows\System\PugPssY.exe

Filesize
1.4MB

MD5
3476815fc3258741122cf23ae87c22d8

SHA1
73221821621875e37969009b4135408add94b3e7

SHA256
e48e18f8c7dd937127e7fcfb712ae9584f8d0c6f19bfc0ad62a7277037caa3ed

SHA512
3f19cf026666cbd83102c312ac04a49b6dd037ac94f0f357ff72b403623aeda1a55ac35f21991014ef60ef761a92e1a6bc03ab82b37d67ffcff0249450915299

Download Submit
C:\Windows\System\QwQzbho.exe

Filesize
1.4MB

MD5
87cf39b51f30e8e9908b8e3a5d3e304d

SHA1
f657e3b0fe98e4152d55543b6d8eb354b1fc385f

SHA256
fb4540a10a06276e7abd7aac6f16b85b3d0cf76a510be0e9cb2c060618d4a08e

SHA512
c30fad9751acef1af549c920c4f4c62037e3f1b297367d457985b922bad7c9c8acbf8d738baccd45f93c89ae53142c296e5ea25a3392755b400cf27a08430e8b

Download Submit
C:\Windows\System\SqldrSM.exe

Filesize
1.4MB

MD5
2d36a0c2c36177b4f6daead714a1a9fa

SHA1
a30eaac1910931e851696a32fc5aa62519fe40dc

SHA256
b3df1adc7d29e05dd11e77c40f444a875df714bb7d16208e70ea321b8d512a7a

SHA512
13a67a4b4645cfc2850f516642644905b872108b5e8e77d9f0305039720d5bdf4085d17aade1a8fc803e813046112f19c77728585c996429fa3794b4089503f0

Download Submit
C:\Windows\System\SviJnsH.exe

Filesize
1.4MB

MD5
2c0eb8394547f536aa7391c88944b26f

SHA1
87c938c26ce5cfe5a0852b4b481530637c764690

SHA256
63e6c22ca71066d8414040a3726d58c2cc465641e3eb430a9aeef973364224e4

SHA512
e0480c5d1e5aef9108394c82b7009fa19793c21286be6ecee3ccc05e0df86effbb22e199d6290fb2f297caf8cf8c9115705f7e9a98d5d1f0425db062b045b9d5

Download Submit
C:\Windows\System\UjycKNq.exe

Filesize
1.4MB

MD5
7febff1051811c0a6a06a43222e59bce

SHA1
531fcd905fe17ab61fb723fc06081291e5ecc641

SHA256
b3cfada02b075265e767b3d5ae7a1ca9dcc2dadcf9526a1b47db21ae189b303c

SHA512
225836f59bda38480e3f2b42429f68a063af2c662f42f12e296888b356a5dc56139c921dd26414bfc99e789eb975d82c04574f49cc18dcdd1497d5cab7f6464d

Download Submit
C:\Windows\System\WPXpdwn.exe

Filesize
1.4MB

MD5
8c78f097cd852c47b3d05e5664027484

SHA1
4a8f6a947bdabc091650b40bda4d67e91aec46d8

SHA256
2e56f1a18bb6ef47c7811199033b970d288846bf2af6d540595d43f2a5bf1b04

SHA512
cf1cb77d786188873f2470b135dae87325c403d1361c53275fb9afa5848ec845ebb5c51539d80239e4ba4204a0397e6bea4e59036d6d8af7df7dab94a66cd38b

Download Submit
C:\Windows\System\WguoqGn.exe

Filesize
1.4MB

MD5
3a0ae076c559f2241feb9cc9385a7cb8

SHA1
bf9c13414c468d0d34717ca588720bb0da4d7b3a

SHA256
671974c379d2ccd2dd8d32b9301f8a7a66b4c03d1a84dd90f5304ff83d43717a

SHA512
0f6584b837b301c5f7ee2d209512fff394c5f3e0ca3bc35354ec9fcb7a5f39795cd0e5c8042baf5f70ca01d83a2e5c44acc67cb8d1bee5cc6055d7ff8325ab72

Download Submit
C:\Windows\System\YBgRBku.exe

Filesize
1.4MB

MD5
d102ece5f422b6886b294996b50093c5

SHA1
2b14af88d4649bc577fd238377c3938a6b912d3b

SHA256
f94251cde2159d703cfdbec0f862e8bda361cda7978f605e989dd6e16d08da99

SHA512
c6cc537e34adfec35311cc2d0e819b4126ac9589a08d61601a413afe86bed146a34bb7bc36fc40c524c11fa2c2ab126b34946daa82b73c01e0cd142f0b74cfe6

Download Submit
C:\Windows\System\YQHBQQE.exe

Filesize
8B

MD5
8df5d7cea6f17e33b828ee09a4f8c91e

SHA1
6aaff1a3a288a0aba2a3023d517e314fe986f730

SHA256
cebffee933f857324d8ea2bd5fb8dad33034c7e30f8e9b644e83274baeadc1d6

SHA512
aee4f16c452925a2700f8c6c545adb516dd855069c67839327087aebe75765ec2637a168ea26305bfaf7ca090b0abc3820134331985dd395f3751e82867cb7ea

Download Submit
C:\Windows\System\YVkLpME.exe

Filesize
1.4MB

MD5
aacf14c84d93c77eaa31226a1f288ca2

SHA1
a798cd28c2ac076769984b31608f2f1857b146b1

SHA256
c27c5f4e335e6d3dd16e1d3fd6091d00d429f1ca4adcfd219c015a4514a66a7e

SHA512
b88bfe250842b3be98f23ff0a351410d63f826f1e08789f0af99293d8cefb8d0019f9e19164144b746216997b3025f4ebe14cf953dd83a540cf4f3163365c525

Download Submit
C:\Windows\System\aRZKtwK.exe

Filesize
1.4MB

MD5
fc66c20ba2d0e73e4a5d83c1b63299e5

SHA1
2fbfbaa92853f8ac8477e03263e2aaed96dc9838

SHA256
0d92507f01b21c3bb0b7ee8d1cb70cf9e3afed949a841d7d0ea79d80e3ba496a

SHA512
f14892483f44919d19a6b00e19c12ab70a29625a999b70d236e0b8467ad276aa17f52dcf052fd210e8ba77c9502b22c64f6213e855ea2b389ef6e241178bbc08

Download Submit
C:\Windows\System\aTYNfMM.exe

Filesize
1.4MB

MD5
c0f6ff4bab886de7928ea45bfc699c40

SHA1
ba7d427567c6dc6340d355b834bf05df36efa1d7

SHA256
c19ec96bbdfa09dea0e94e5c070267f69bb5a9fb3e594aa02cf9c10e19826de7

SHA512
4ade02401ed359a20fd1141509f8fc0153a34e54f28a3a707696a2175bdc1130e5b239f07ffc886cf30ffa95099bc80aa4cb8954d2f1711a54358a2dabba34e4

Download Submit
C:\Windows\System\azpjsDR.exe

Filesize
1.4MB

MD5
b151788b1b86ab50aaf29e0b9e1697e5

SHA1
0af142ddb3c30f1f116822c9bd0c404e823c259d

SHA256
a81a75c2ef8a6e65dfdd573d2f974728bbe5cddde1380f4c6dcaa120e61c82a4

SHA512
e0b5684a8a76e99430a51bfc110ddf958ab9898f5b86cea8b306d29922d8ba011a61b42045bf65e65f69f089457b06d9a595de7746a20de18e37f1b2167645c4

Download Submit
C:\Windows\System\cuIUHfa.exe

Filesize
1.4MB

MD5
a716837c0cfc4d6c331393d2fd152fad

SHA1
05959450bfe401ac8d6011066f530940df76dbf1

SHA256
9d95ca9a509e54549a4a7b012d26ca77ce00d6d6b4962bb90a38dd876a4c8992

SHA512
de22c16132cf47ccf4654cb33fa2b9119ee074bcad44bfbb40dbc92c88f5159dbba3cba89316758bed0ffbe5afc29737d3a1d1c15a580293622c28ea87372643

Download Submit
C:\Windows\System\kQmPjbm.exe

Filesize
1.4MB

MD5
8ad26c3d408fe2922e34a0a0e1c4617c

SHA1
381cd74cfa2ac905d76ee75225af66895e30d576

SHA256
8c2e17f5b9d58d9631aefca74154a53755a0578607b2768952e33c15c6caa3d2

SHA512
44b0a77e8f502cf9156339c4ae651259da32478eb08ecbd0321e69598ea109d092f867fdaae2a4af4f4c16da9684dc46bfcb2877ce0f216abd4bcbc84b844179

Download Submit
C:\Windows\System\kVcOzTv.exe

Filesize
1.4MB

MD5
7e5ca3692f82aec27da22c44f16c0aa2

SHA1
f923ffdd1c2a231eef4f92366c3164af61d73b7b

SHA256
bc01ebf226b0d8f3a2e4d36b231ff70fb9f23f451de732085a5998975cbb584d

SHA512
fe1fc7ba56fecaea5f0acdd29154c5ce1fcb240a57a4cfa4a5713908fccb289fbfea357c16d8fb1cbd40fbeb65baad50fea0731fe88f762e1e9edf1d1e8fbe69

Download Submit
C:\Windows\System\klcHXYh.exe

Filesize
1.4MB

MD5
638bfbddc3057b60796bcf43d13646d2

SHA1
19142d51387f820da4582f0c9a27c87c7d351e20

SHA256
a00a49fd52d2436351c7e36782baae0af208d82c849100ec7a4a680720252c28

SHA512
e0780ac3e8c068e8ad0c15da2fedc82c3ec9cae0e054c17cfafd548642dc50504de216dadff989d95f02e00a1d8446235309b3bfc5be48a22e6219e9e2c27f9d

Download Submit
C:\Windows\System\kwXKfuc.exe

Filesize
1.4MB

MD5
5e3622bc9ae4bb3b99dd293907c7ec23

SHA1
7cd96d6338080f2aea40213b5120a407c986a128

SHA256
0c4e6b32dddb3afbcf020521fc7f88855e2280c2224acc6ef700b2ecdbb66b5d

SHA512
d6fec17d74a8f1e3d8c2a9ecdd4559a36fa2ae1be853cda8b1b5492ac9c0ac4768381544ce44f19e323a04c228a6a7ff2082959e906a9d699892f09761aabba4

Download Submit
C:\Windows\System\nNccNNl.exe

Filesize
1.4MB

MD5
e737e489119ebcbdf1f8ac0164f253ad

SHA1
2f8b35b71f36b1bd7ab733e356d8461f89696d38

SHA256
18ec972a71c32ed37a7d1a8cb5c31b40099e245cdc99ab0798f9d192b7c59b8b

SHA512
b7bb80a32c32c0fcdcd37c1370be531e52a25c6a592f2b2ff666a6ae3db711fa119efbcb2abddc1f648a31a290cb1b7641213998acd545d7d083522931a3fbee

Download Submit
C:\Windows\System\oJEocKP.exe

Filesize
1.4MB

MD5
18fe32bb7f3676204b137320ef7e5445

SHA1
a86c8e94e51871a4186ec08bf117ec5b07962953

SHA256
33c825bf7d6d9d137b0721d623bf2143130caff25ca552fbee8f9ac1022c5645

SHA512
d637997389149de3c32d99a09928c648b498a37e0a130b0e17641aace20700dd3930517a3c7b5f873cc487dd17ffd56d8f5c5f01e1f9af6a941c4c140dc502ed

Download Submit
C:\Windows\System\pStXTtB.exe

Filesize
1.4MB

MD5
16b423f9e95911986be5fc736d9ae5c0

SHA1
7e5595cf212b51640b8ce98b5748cbb8b7d2dac5

SHA256
5d73880bd83cbd28156c2890d8b82cf3161d776d781d3415a176851f011c45a4

SHA512
fd4dcfec8dac7e2647cca6688c5085bdb90f8742e575733ac191b3f22bc6cedd84a52ecf765582e7ce57d1e335e139b16add68a6cf5983e05a8324a8c2bc42c0

Download Submit
C:\Windows\System\prjHIsU.exe

Filesize
1.4MB

MD5
9d606e99c0e4859df97db762ae328f1d

SHA1
c53b1e6d736690f317bb10a5f2ebd7e36e5c52db

SHA256
7be99b49bec9c1cf53705f692ef5ab313f93b694a58abd3640bd73945040ff30

SHA512
f512150df19780ed2ab0f7cc2bc6520e0a24231e71d11573a5f8d8d97556138392eb5ddaf0f989c622e421a9bc758147e5e4f4278629f698c6fb21677beae678

Download Submit
C:\Windows\System\sYEJaOG.exe

Filesize
1.4MB

MD5
92cd2c6c1d431ac938d8a4022f99425a

SHA1
9bfb85b2ac7627a65af0afc13e055751aab64ff7

SHA256
e44d49056310972bdd5cea9527554501517321edb32713f8327e29b4126a4247

SHA512
d48b31de97d4336afe5daebc9bdb5d38597b12fc7cd9ba80df46fcc14d0f47f1926dd6f183ac5dc3576a5346a6505eb23770f75f86a497a09167fa616a38d284

Download Submit
C:\Windows\System\vVmdTpY.exe

Filesize
1.4MB

MD5
f930820df9c1ba7041d86c39b07b9a00

SHA1
8db7877cfd9011f20d9fe995fc5618030e3a58f1

SHA256
64085d3efad98941516b090d8297b0dda5428224fa3cf812136b3781b78ed434

SHA512
9bf7b8e6b1dd31c2298b29d1887c9bf4eb31bf1b5090b2a54a5e522164b5ee4e7bbeb16f3bbcc44441c526bae4eea29a37e790ab97099b28884bd7033b1804bc

Download Submit
C:\Windows\System\wuxijNB.exe

Filesize
1.4MB

MD5
5d918f277f155af2b18a39b5b9cbb73e

SHA1
5a6ae54e5c775ad482f157e0488f59659bd9ee47

SHA256
1615a2e10ce8e3858179d1e8179bd0e221f2d79dd209c1f86743a9282f4234f1

SHA512
b546d3c83c07bd8c230b33b62654db44c4640ca57c86ae1535f06d5b3f6a266c283c8999d684ddf4cba2a2a4f078337630b4265300cb68cdc9e4792207bf02d7

Download Submit
memory/116-1501-0x00007FF74EBB0000-0x00007FF74EFA2000-memory.dmp

Filesize
3.9MB

Download
memory/116-2870-0x00007FF74EBB0000-0x00007FF74EFA2000-memory.dmp

Filesize
3.9MB

Download
memory/224-2830-0x00007FF771690000-0x00007FF771A82000-memory.dmp

Filesize
3.9MB

Download
memory/224-1849-0x00007FF771690000-0x00007FF771A82000-memory.dmp

Filesize
3.9MB

Download
memory/316-2835-0x00007FF7F7BF0000-0x00007FF7F7FE2000-memory.dmp

Filesize
3.9MB

Download
memory/316-1215-0x00007FF7F7BF0000-0x00007FF7F7FE2000-memory.dmp

Filesize
3.9MB

Download
memory/396-3-0x00007FF900193000-0x00007FF900195000-memory.dmp

Filesize
8KB

Download
memory/396-108-0x00007FF900190000-0x00007FF900C51000-memory.dmp

Filesize
10.8MB

Download
memory/396-227-0x0000015473500000-0x0000015473522000-memory.dmp

Filesize
136KB

Download
memory/564-347-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp

Filesize
3.9MB

Download
memory/564-2837-0x00007FF7152E0000-0x00007FF7156D2000-memory.dmp

Filesize
3.9MB

Download
memory/1192-2804-0x00007FF783640000-0x00007FF783A32000-memory.dmp

Filesize
3.9MB

Download
memory/1192-1783-0x00007FF783640000-0x00007FF783A32000-memory.dmp

Filesize
3.9MB

Download
memory/1840-2846-0x00007FF6A6890000-0x00007FF6A6C82000-memory.dmp

Filesize
3.9MB

Download
memory/1840-738-0x00007FF6A6890000-0x00007FF6A6C82000-memory.dmp

Filesize
3.9MB

Download
memory/2432-2826-0x00007FF7B04E0000-0x00007FF7B08D2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-732-0x00007FF7B04E0000-0x00007FF7B08D2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-2806-0x00007FF643980000-0x00007FF643D72000-memory.dmp

Filesize
3.9MB

Download
memory/2572-236-0x00007FF643980000-0x00007FF643D72000-memory.dmp

Filesize
3.9MB

Download
memory/3216-2828-0x00007FF7754D0000-0x00007FF7758C2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-574-0x00007FF7754D0000-0x00007FF7758C2000-memory.dmp

Filesize
3.9MB

Download
memory/3440-735-0x00007FF751FF0000-0x00007FF7523E2000-memory.dmp

Filesize
3.9MB

Download
memory/3440-2841-0x00007FF751FF0000-0x00007FF7523E2000-memory.dmp

Filesize
3.9MB

Download
memory/3548-2824-0x00007FF6CB8A0000-0x00007FF6CBC92000-memory.dmp

Filesize
3.9MB

Download
memory/3548-457-0x00007FF6CB8A0000-0x00007FF6CBC92000-memory.dmp

Filesize
3.9MB

Download
memory/3628-734-0x00007FF775070000-0x00007FF775462000-memory.dmp

Filesize
3.9MB

Download
memory/3628-2821-0x00007FF775070000-0x00007FF775462000-memory.dmp

Filesize
3.9MB

Download
memory/3680-739-0x00007FF7A78B0000-0x00007FF7A7CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3680-2849-0x00007FF7A78B0000-0x00007FF7A7CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3924-2815-0x00007FF7B0480000-0x00007FF7B0872000-memory.dmp

Filesize
3.9MB

Download
memory/3924-289-0x00007FF7B0480000-0x00007FF7B0872000-memory.dmp

Filesize
3.9MB

Download
memory/3936-1-0x0000018E41D20000-0x0000018E41D30000-memory.dmp

Filesize
64KB

Download
memory/3936-0-0x00007FF6BFC90000-0x00007FF6C0082000-memory.dmp

Filesize
3.9MB

Download
memory/3972-2812-0x00007FF7C11B0000-0x00007FF7C15A2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-565-0x00007FF7C11B0000-0x00007FF7C15A2000-memory.dmp

Filesize
3.9MB

Download
memory/4352-2809-0x00007FF6B3360000-0x00007FF6B3752000-memory.dmp

Filesize
3.9MB

Download
memory/4352-169-0x00007FF6B3360000-0x00007FF6B3752000-memory.dmp

Filesize
3.9MB

Download
memory/4356-2810-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp

Filesize
3.9MB

Download
memory/4356-247-0x00007FF7723E0000-0x00007FF7727D2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-737-0x00007FF6B6DF0000-0x00007FF6B71E2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-2833-0x00007FF6B6DF0000-0x00007FF6B71E2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-1220-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-2852-0x00007FF655ED0000-0x00007FF6562C2000-memory.dmp

Filesize
3.9MB

Download
memory/4824-2844-0x00007FF6D2540000-0x00007FF6D2932000-memory.dmp

Filesize
3.9MB

Download
memory/4824-736-0x00007FF6D2540000-0x00007FF6D2932000-memory.dmp

Filesize
3.9MB

Download
memory/4840-2802-0x00007FF60F760000-0x00007FF60FB52000-memory.dmp

Filesize
3.9MB

Download
memory/4840-2800-0x00007FF60F760000-0x00007FF60FB52000-memory.dmp

Filesize
3.9MB

Download
memory/4840-22-0x00007FF60F760000-0x00007FF60FB52000-memory.dmp

Filesize
3.9MB

Download
memory/4888-2818-0x00007FF7D0580000-0x00007FF7D0972000-memory.dmp

Filesize
3.9MB

Download
memory/4888-733-0x00007FF7D0580000-0x00007FF7D0972000-memory.dmp

Filesize
3.9MB

Download
memory/4908-1847-0x00007FF78A5A0000-0x00007FF78A992000-memory.dmp

Filesize
3.9MB

Download
memory/4908-2816-0x00007FF78A5A0000-0x00007FF78A992000-memory.dmp

Filesize
3.9MB

Download
memory/4944-2838-0x00007FF6437C0000-0x00007FF643BB2000-memory.dmp

Filesize
3.9MB

Download
memory/4944-740-0x00007FF6437C0000-0x00007FF643BB2000-memory.dmp

Filesize
3.9MB

Download