xmrig | a8785582069a78084b7e6b4d90422d666c884d8915f8253a7986165eb03851d6

Analysis

max time kernel
116s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
Size

1.6MB
MD5

792c8ac3de0a08e94d9ee9d7ba421f90
SHA1

2518a6fd278b382b808d603fa6d5c25219c2846a
SHA256

a8785582069a78084b7e6b4d90422d666c884d8915f8253a7986165eb03851d6
SHA512

afae153204002d100c37f4a0d62f04c00be1c30b1f95e8c2b2ab1b7c17d4705d1a344a1f2cf0430c12f0301a5536b6fb4e942f8e6d0ac24fce19b4df996ecba5
SSDEEP

49152:ROdWCCi7/raU56uL3pgrCEdMeb7UDlwwiq0IOb:RWWBib356utgx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral2/memory/3200-53-0x00007FF745F10000-0x00007FF746261000-memory.dmp	xmrig
behavioral2/memory/1072-52-0x00007FF68C630000-0x00007FF68C981000-memory.dmp	xmrig
behavioral2/memory/4004-48-0x00007FF74AAC0000-0x00007FF74AE11000-memory.dmp	xmrig
behavioral2/memory/1520-16-0x00007FF68E3F0000-0x00007FF68E741000-memory.dmp	xmrig
behavioral2/memory/2264-506-0x00007FF6A05E0000-0x00007FF6A0931000-memory.dmp	xmrig
behavioral2/memory/3260-519-0x00007FF7AC860000-0x00007FF7ACBB1000-memory.dmp	xmrig
behavioral2/memory/4348-532-0x00007FF689D30000-0x00007FF68A081000-memory.dmp	xmrig
behavioral2/memory/2836-547-0x00007FF61C3F0000-0x00007FF61C741000-memory.dmp	xmrig
behavioral2/memory/3340-576-0x00007FF633340000-0x00007FF633691000-memory.dmp	xmrig
behavioral2/memory/4484-577-0x00007FF6D09D0000-0x00007FF6D0D21000-memory.dmp	xmrig
behavioral2/memory/1300-586-0x00007FF7C8F00000-0x00007FF7C9251000-memory.dmp	xmrig
behavioral2/memory/376-597-0x00007FF76F470000-0x00007FF76F7C1000-memory.dmp	xmrig
behavioral2/memory/1124-604-0x00007FF6C4F90000-0x00007FF6C52E1000-memory.dmp	xmrig
behavioral2/memory/3968-622-0x00007FF747800000-0x00007FF747B51000-memory.dmp	xmrig
behavioral2/memory/4780-617-0x00007FF76E8B0000-0x00007FF76EC01000-memory.dmp	xmrig
behavioral2/memory/2036-611-0x00007FF6DB070000-0x00007FF6DB3C1000-memory.dmp	xmrig
behavioral2/memory/1660-610-0x00007FF791D60000-0x00007FF7920B1000-memory.dmp	xmrig
behavioral2/memory/812-603-0x00007FF60D810000-0x00007FF60DB61000-memory.dmp	xmrig
behavioral2/memory/3300-587-0x00007FF6C6FC0000-0x00007FF6C7311000-memory.dmp	xmrig
behavioral2/memory/1340-563-0x00007FF6BB740000-0x00007FF6BBA91000-memory.dmp	xmrig
behavioral2/memory/4520-552-0x00007FF70B890000-0x00007FF70BBE1000-memory.dmp	xmrig
behavioral2/memory/4208-538-0x00007FF616690000-0x00007FF6169E1000-memory.dmp	xmrig
behavioral2/memory/4080-531-0x00007FF6F7FF0000-0x00007FF6F8341000-memory.dmp	xmrig
behavioral2/memory/1016-523-0x00007FF6063E0000-0x00007FF606731000-memory.dmp	xmrig
behavioral2/memory/3068-2189-0x00007FF633500000-0x00007FF633851000-memory.dmp	xmrig
behavioral2/memory/2316-2201-0x00007FF6E3CE0000-0x00007FF6E4031000-memory.dmp	xmrig
behavioral2/memory/856-2223-0x00007FF6E4D60000-0x00007FF6E50B1000-memory.dmp	xmrig
behavioral2/memory/692-2224-0x00007FF6283A0000-0x00007FF6286F1000-memory.dmp	xmrig
behavioral2/memory/1816-2227-0x00007FF602B40000-0x00007FF602E91000-memory.dmp	xmrig
behavioral2/memory/1520-2231-0x00007FF68E3F0000-0x00007FF68E741000-memory.dmp	xmrig
behavioral2/memory/3068-2233-0x00007FF633500000-0x00007FF633851000-memory.dmp	xmrig
behavioral2/memory/2316-2235-0x00007FF6E3CE0000-0x00007FF6E4031000-memory.dmp	xmrig
behavioral2/memory/856-2237-0x00007FF6E4D60000-0x00007FF6E50B1000-memory.dmp	xmrig
behavioral2/memory/692-2239-0x00007FF6283A0000-0x00007FF6286F1000-memory.dmp	xmrig
behavioral2/memory/4004-2241-0x00007FF74AAC0000-0x00007FF74AE11000-memory.dmp	xmrig
behavioral2/memory/1072-2243-0x00007FF68C630000-0x00007FF68C981000-memory.dmp	xmrig
behavioral2/memory/3200-2245-0x00007FF745F10000-0x00007FF746261000-memory.dmp	xmrig
behavioral2/memory/1816-2247-0x00007FF602B40000-0x00007FF602E91000-memory.dmp	xmrig
behavioral2/memory/2264-2285-0x00007FF6A05E0000-0x00007FF6A0931000-memory.dmp	xmrig
behavioral2/memory/3260-2287-0x00007FF7AC860000-0x00007FF7ACBB1000-memory.dmp	xmrig
behavioral2/memory/4080-2292-0x00007FF6F7FF0000-0x00007FF6F8341000-memory.dmp	xmrig
behavioral2/memory/4348-2290-0x00007FF689D30000-0x00007FF68A081000-memory.dmp	xmrig
behavioral2/memory/1016-2293-0x00007FF6063E0000-0x00007FF606731000-memory.dmp	xmrig
behavioral2/memory/4520-2299-0x00007FF70B890000-0x00007FF70BBE1000-memory.dmp	xmrig
behavioral2/memory/1340-2301-0x00007FF6BB740000-0x00007FF6BBA91000-memory.dmp	xmrig
behavioral2/memory/4208-2297-0x00007FF616690000-0x00007FF6169E1000-memory.dmp	xmrig
behavioral2/memory/3340-2303-0x00007FF633340000-0x00007FF633691000-memory.dmp	xmrig
behavioral2/memory/2836-2295-0x00007FF61C3F0000-0x00007FF61C741000-memory.dmp	xmrig
behavioral2/memory/4484-2305-0x00007FF6D09D0000-0x00007FF6D0D21000-memory.dmp	xmrig
behavioral2/memory/4780-2321-0x00007FF76E8B0000-0x00007FF76EC01000-memory.dmp	xmrig
behavioral2/memory/3968-2323-0x00007FF747800000-0x00007FF747B51000-memory.dmp	xmrig
behavioral2/memory/376-2319-0x00007FF76F470000-0x00007FF76F7C1000-memory.dmp	xmrig
behavioral2/memory/3300-2317-0x00007FF6C6FC0000-0x00007FF6C7311000-memory.dmp	xmrig
behavioral2/memory/2036-2316-0x00007FF6DB070000-0x00007FF6DB3C1000-memory.dmp	xmrig
behavioral2/memory/1300-2308-0x00007FF7C8F00000-0x00007FF7C9251000-memory.dmp	xmrig
behavioral2/memory/1124-2313-0x00007FF6C4F90000-0x00007FF6C52E1000-memory.dmp	xmrig
behavioral2/memory/812-2312-0x00007FF60D810000-0x00007FF60DB61000-memory.dmp	xmrig
behavioral2/memory/1660-2310-0x00007FF791D60000-0x00007FF7920B1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3068	PNGUWVv.exe
1520	UaBUNQl.exe
2316	cyZBcih.exe
856	eTGAmYb.exe
692	nHPbCEk.exe
4004	ebbebWP.exe
1072	nWfPagq.exe
3200	PwbOAiR.exe
1816	SHmBrMM.exe
2264	OPWgHol.exe
3260	LeLsSZn.exe
1016	bEnbhbV.exe
4080	OxmycpO.exe
4348	NGYOFzC.exe
4208	UEAlttM.exe
2836	PztHkbf.exe
4520	CExXjLN.exe
1340	rVqDcnD.exe
3340	pQAROrd.exe
4484	HkrLhfG.exe
1300	jTvmYGU.exe
3300	IJxJTmV.exe
376	dyYpJWx.exe
812	pOytzQP.exe
1124	lgsEQuw.exe
1660	hJttQJG.exe
2036	WQIEaez.exe
4780	wtcNyCl.exe
3968	lLozalW.exe
1732	Ydsqqjd.exe
4644	GDeytcg.exe
532	PcaqpVp.exe
3128	OxiGaIA.exe
4304	LLFrfFb.exe
4308	KVUfGqR.exe
1924	pGvUDtR.exe
2096	gXYPGUj.exe
2412	YEMdDoj.exe
3528	tssBuFw.exe
5064	pPxRJbE.exe
1684	sBAaTcD.exe
3804	pFYQcPt.exe
4508	hcGVkYU.exe
3532	JXaPfXb.exe
4504	SFVCDZM.exe
4912	ASnbEor.exe
1148	euNtTkd.exe
4256	PBAwXBP.exe
1272	ZIZqznT.exe
3640	SLTEZrf.exe
2912	UGVmsHF.exe
2980	YXkReLp.exe
2268	DCoBTXw.exe
632	yJZROZt.exe
976	UWwHift.exe
1104	SJJirMk.exe
1548	VukjCzO.exe
932	KRCnfbe.exe
1536	rDObqNN.exe
4848	ZDpSusu.exe
4428	sYUlHVu.exe
2108	kXnbFkf.exe
404	FNWAvFS.exe
3660	ClZRKrj.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3828-0-0x00007FF7BE400000-0x00007FF7BE751000-memory.dmp	upx
behavioral2/files/0x0009000000023470-5.dat	upx
behavioral2/memory/3068-6-0x00007FF633500000-0x00007FF633851000-memory.dmp	upx
behavioral2/files/0x0007000000023477-13.dat	upx
behavioral2/files/0x0007000000023478-15.dat	upx
behavioral2/files/0x0007000000023479-27.dat	upx
behavioral2/files/0x000700000002347c-38.dat	upx
behavioral2/files/0x000700000002347d-43.dat	upx
behavioral2/memory/3200-53-0x00007FF745F10000-0x00007FF746261000-memory.dmp	upx
behavioral2/files/0x000700000002347e-55.dat	upx
behavioral2/memory/1816-54-0x00007FF602B40000-0x00007FF602E91000-memory.dmp	upx
behavioral2/memory/1072-52-0x00007FF68C630000-0x00007FF68C981000-memory.dmp	upx
behavioral2/memory/4004-48-0x00007FF74AAC0000-0x00007FF74AE11000-memory.dmp	upx
behavioral2/files/0x000700000002347b-41.dat	upx
behavioral2/files/0x000700000002347a-33.dat	upx
behavioral2/memory/692-32-0x00007FF6283A0000-0x00007FF6286F1000-memory.dmp	upx
behavioral2/memory/856-30-0x00007FF6E4D60000-0x00007FF6E50B1000-memory.dmp	upx
behavioral2/memory/2316-17-0x00007FF6E3CE0000-0x00007FF6E4031000-memory.dmp	upx
behavioral2/memory/1520-16-0x00007FF68E3F0000-0x00007FF68E741000-memory.dmp	upx
behavioral2/files/0x000700000002347f-63.dat	upx
behavioral2/files/0x0009000000023474-73.dat	upx
behavioral2/files/0x0007000000023483-82.dat	upx
behavioral2/files/0x0007000000023484-90.dat	upx
behavioral2/files/0x0007000000023487-97.dat	upx
behavioral2/files/0x0007000000023489-107.dat	upx
behavioral2/files/0x000700000002348b-117.dat	upx
behavioral2/files/0x0007000000023490-142.dat	upx
behavioral2/files/0x0007000000023491-155.dat	upx
behavioral2/files/0x0007000000023495-167.dat	upx
behavioral2/memory/2264-506-0x00007FF6A05E0000-0x00007FF6A0931000-memory.dmp	upx
behavioral2/memory/3260-519-0x00007FF7AC860000-0x00007FF7ACBB1000-memory.dmp	upx
behavioral2/memory/4348-532-0x00007FF689D30000-0x00007FF68A081000-memory.dmp	upx
behavioral2/memory/2836-547-0x00007FF61C3F0000-0x00007FF61C741000-memory.dmp	upx
behavioral2/memory/3340-576-0x00007FF633340000-0x00007FF633691000-memory.dmp	upx
behavioral2/memory/4484-577-0x00007FF6D09D0000-0x00007FF6D0D21000-memory.dmp	upx
behavioral2/memory/1300-586-0x00007FF7C8F00000-0x00007FF7C9251000-memory.dmp	upx
behavioral2/memory/376-597-0x00007FF76F470000-0x00007FF76F7C1000-memory.dmp	upx
behavioral2/memory/1124-604-0x00007FF6C4F90000-0x00007FF6C52E1000-memory.dmp	upx
behavioral2/memory/3968-622-0x00007FF747800000-0x00007FF747B51000-memory.dmp	upx
behavioral2/memory/4780-617-0x00007FF76E8B0000-0x00007FF76EC01000-memory.dmp	upx
behavioral2/memory/2036-611-0x00007FF6DB070000-0x00007FF6DB3C1000-memory.dmp	upx
behavioral2/memory/1660-610-0x00007FF791D60000-0x00007FF7920B1000-memory.dmp	upx
behavioral2/memory/812-603-0x00007FF60D810000-0x00007FF60DB61000-memory.dmp	upx
behavioral2/memory/3300-587-0x00007FF6C6FC0000-0x00007FF6C7311000-memory.dmp	upx
behavioral2/memory/1340-563-0x00007FF6BB740000-0x00007FF6BBA91000-memory.dmp	upx
behavioral2/memory/4520-552-0x00007FF70B890000-0x00007FF70BBE1000-memory.dmp	upx
behavioral2/memory/4208-538-0x00007FF616690000-0x00007FF6169E1000-memory.dmp	upx
behavioral2/memory/4080-531-0x00007FF6F7FF0000-0x00007FF6F8341000-memory.dmp	upx
behavioral2/memory/1016-523-0x00007FF6063E0000-0x00007FF606731000-memory.dmp	upx
behavioral2/files/0x0007000000023496-172.dat	upx
behavioral2/files/0x0007000000023494-170.dat	upx
behavioral2/files/0x0007000000023493-165.dat	upx
behavioral2/files/0x0007000000023492-160.dat	upx
behavioral2/files/0x000700000002348f-145.dat	upx
behavioral2/files/0x000700000002348e-140.dat	upx
behavioral2/files/0x000700000002348d-135.dat	upx
behavioral2/files/0x000700000002348c-130.dat	upx
behavioral2/files/0x000700000002348a-120.dat	upx
behavioral2/files/0x0007000000023488-110.dat	upx
behavioral2/files/0x0007000000023486-100.dat	upx
behavioral2/files/0x0007000000023485-95.dat	upx
behavioral2/files/0x0007000000023482-78.dat	upx
behavioral2/files/0x0007000000023481-68.dat	upx
behavioral2/memory/3068-2189-0x00007FF633500000-0x00007FF633851000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UnNdjIx.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\jAYQJqb.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\xBaXPUB.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\CZQLpZI.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\rVYBOpi.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\SFVCDZM.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\FNWAvFS.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\FtOyoWY.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\kIVcHKa.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\ZMyxvni.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\fYZGmKt.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\UewpVfQ.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\NhiRZyQ.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\GYYIBFN.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\OahQaoT.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\gCWyUCB.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\YEMdDoj.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\lIseQCK.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\CgLDDJj.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\ZPOyBtO.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\JweAvrs.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\ZIZqznT.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\KRCnfbe.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\Ydsqqjd.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\pPxRJbE.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\hnSYahS.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\jPacJxW.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\xqlXUSp.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\cAdtYQe.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\fryeQxO.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\hHxqxsY.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\FOjqIuE.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\EOdtnPM.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\yJwLvSq.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\jrYXjIy.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\QKNnoqu.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\CQAJSHA.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\ZHihxEM.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\gjRBuhy.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\SbFHJYB.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\SPbtLut.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\LlTguhx.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\RweARGQ.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\LzupRRm.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\eisbYGC.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\CScOkrp.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\IPnjNrN.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\NGYOFzC.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\YXkReLp.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\LzSkHlO.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\vWCWRxj.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\HoikMUc.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\oROFgse.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\UYrbeas.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\lvcbVSL.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\iqkxIRU.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\FKBEDPo.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\RqIwilf.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\zMLjfZu.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\OPWgHol.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\dyYpJWx.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\gOvhyoo.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\qOTHYtv.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
File created	C:\Windows\System\uPaGshW.exe	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3068	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	84
PID 3828 wrote to memory of 3068	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	84
PID 3828 wrote to memory of 1520	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	85
PID 3828 wrote to memory of 1520	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	85
PID 3828 wrote to memory of 2316	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	86
PID 3828 wrote to memory of 2316	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	86
PID 3828 wrote to memory of 856	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	87
PID 3828 wrote to memory of 856	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	87
PID 3828 wrote to memory of 692	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	88
PID 3828 wrote to memory of 692	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	88
PID 3828 wrote to memory of 4004	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	89
PID 3828 wrote to memory of 4004	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	89
PID 3828 wrote to memory of 1072	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	90
PID 3828 wrote to memory of 1072	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	90
PID 3828 wrote to memory of 3200	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	91
PID 3828 wrote to memory of 3200	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	91
PID 3828 wrote to memory of 1816	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	92
PID 3828 wrote to memory of 1816	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	92
PID 3828 wrote to memory of 2264	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	93
PID 3828 wrote to memory of 2264	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	93
PID 3828 wrote to memory of 3260	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	94
PID 3828 wrote to memory of 3260	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	94
PID 3828 wrote to memory of 1016	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	95
PID 3828 wrote to memory of 1016	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	95
PID 3828 wrote to memory of 4080	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	96
PID 3828 wrote to memory of 4080	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	96
PID 3828 wrote to memory of 4348	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	97
PID 3828 wrote to memory of 4348	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	97
PID 3828 wrote to memory of 4208	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	98
PID 3828 wrote to memory of 4208	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	98
PID 3828 wrote to memory of 2836	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	99
PID 3828 wrote to memory of 2836	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	99
PID 3828 wrote to memory of 4520	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	100
PID 3828 wrote to memory of 4520	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	100
PID 3828 wrote to memory of 1340	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	101
PID 3828 wrote to memory of 1340	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	101
PID 3828 wrote to memory of 3340	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	102
PID 3828 wrote to memory of 3340	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	102
PID 3828 wrote to memory of 4484	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	103
PID 3828 wrote to memory of 4484	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	103
PID 3828 wrote to memory of 1300	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	104
PID 3828 wrote to memory of 1300	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	104
PID 3828 wrote to memory of 3300	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	105
PID 3828 wrote to memory of 3300	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	105
PID 3828 wrote to memory of 376	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	106
PID 3828 wrote to memory of 376	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	106
PID 3828 wrote to memory of 812	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	107
PID 3828 wrote to memory of 812	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	107
PID 3828 wrote to memory of 1124	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	108
PID 3828 wrote to memory of 1124	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	108
PID 3828 wrote to memory of 1660	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	109
PID 3828 wrote to memory of 1660	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	109
PID 3828 wrote to memory of 2036	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	110
PID 3828 wrote to memory of 2036	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	110
PID 3828 wrote to memory of 4780	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	111
PID 3828 wrote to memory of 4780	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	111
PID 3828 wrote to memory of 3968	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	112
PID 3828 wrote to memory of 3968	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	112
PID 3828 wrote to memory of 1732	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	113
PID 3828 wrote to memory of 1732	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	113
PID 3828 wrote to memory of 4644	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	114
PID 3828 wrote to memory of 4644	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	114
PID 3828 wrote to memory of 532	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	115
PID 3828 wrote to memory of 532	3828	792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\792c8ac3de0a08e94d9ee9d7ba421f90_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\System\PNGUWVv.exe
  C:\Windows\System\PNGUWVv.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\UaBUNQl.exe
  C:\Windows\System\UaBUNQl.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\cyZBcih.exe
  C:\Windows\System\cyZBcih.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\eTGAmYb.exe
  C:\Windows\System\eTGAmYb.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\nHPbCEk.exe
  C:\Windows\System\nHPbCEk.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\ebbebWP.exe
  C:\Windows\System\ebbebWP.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\nWfPagq.exe
  C:\Windows\System\nWfPagq.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\PwbOAiR.exe
  C:\Windows\System\PwbOAiR.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\SHmBrMM.exe
  C:\Windows\System\SHmBrMM.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\OPWgHol.exe
  C:\Windows\System\OPWgHol.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\LeLsSZn.exe
  C:\Windows\System\LeLsSZn.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\bEnbhbV.exe
  C:\Windows\System\bEnbhbV.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\OxmycpO.exe
  C:\Windows\System\OxmycpO.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\NGYOFzC.exe
  C:\Windows\System\NGYOFzC.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\UEAlttM.exe
  C:\Windows\System\UEAlttM.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\PztHkbf.exe
  C:\Windows\System\PztHkbf.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\CExXjLN.exe
  C:\Windows\System\CExXjLN.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\rVqDcnD.exe
  C:\Windows\System\rVqDcnD.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\pQAROrd.exe
  C:\Windows\System\pQAROrd.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\HkrLhfG.exe
  C:\Windows\System\HkrLhfG.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\jTvmYGU.exe
  C:\Windows\System\jTvmYGU.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\IJxJTmV.exe
  C:\Windows\System\IJxJTmV.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\dyYpJWx.exe
  C:\Windows\System\dyYpJWx.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\pOytzQP.exe
  C:\Windows\System\pOytzQP.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\lgsEQuw.exe
  C:\Windows\System\lgsEQuw.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\hJttQJG.exe
  C:\Windows\System\hJttQJG.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\WQIEaez.exe
  C:\Windows\System\WQIEaez.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\wtcNyCl.exe
  C:\Windows\System\wtcNyCl.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\lLozalW.exe
  C:\Windows\System\lLozalW.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\Ydsqqjd.exe
  C:\Windows\System\Ydsqqjd.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\GDeytcg.exe
  C:\Windows\System\GDeytcg.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\PcaqpVp.exe
  C:\Windows\System\PcaqpVp.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\OxiGaIA.exe
  C:\Windows\System\OxiGaIA.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\LLFrfFb.exe
  C:\Windows\System\LLFrfFb.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\KVUfGqR.exe
  C:\Windows\System\KVUfGqR.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\pGvUDtR.exe
  C:\Windows\System\pGvUDtR.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\gXYPGUj.exe
  C:\Windows\System\gXYPGUj.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\YEMdDoj.exe
  C:\Windows\System\YEMdDoj.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\tssBuFw.exe
  C:\Windows\System\tssBuFw.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\pPxRJbE.exe
  C:\Windows\System\pPxRJbE.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\sBAaTcD.exe
  C:\Windows\System\sBAaTcD.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\pFYQcPt.exe
  C:\Windows\System\pFYQcPt.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\hcGVkYU.exe
  C:\Windows\System\hcGVkYU.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\JXaPfXb.exe
  C:\Windows\System\JXaPfXb.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\SFVCDZM.exe
  C:\Windows\System\SFVCDZM.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\ASnbEor.exe
  C:\Windows\System\ASnbEor.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\euNtTkd.exe
  C:\Windows\System\euNtTkd.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\PBAwXBP.exe
  C:\Windows\System\PBAwXBP.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\ZIZqznT.exe
  C:\Windows\System\ZIZqznT.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\SLTEZrf.exe
  C:\Windows\System\SLTEZrf.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\UGVmsHF.exe
  C:\Windows\System\UGVmsHF.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\YXkReLp.exe
  C:\Windows\System\YXkReLp.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\DCoBTXw.exe
  C:\Windows\System\DCoBTXw.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\yJZROZt.exe
  C:\Windows\System\yJZROZt.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\UWwHift.exe
  C:\Windows\System\UWwHift.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\SJJirMk.exe
  C:\Windows\System\SJJirMk.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\VukjCzO.exe
  C:\Windows\System\VukjCzO.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\KRCnfbe.exe
  C:\Windows\System\KRCnfbe.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\rDObqNN.exe
  C:\Windows\System\rDObqNN.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\ZDpSusu.exe
  C:\Windows\System\ZDpSusu.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\sYUlHVu.exe
  C:\Windows\System\sYUlHVu.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\kXnbFkf.exe
  C:\Windows\System\kXnbFkf.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\FNWAvFS.exe
  C:\Windows\System\FNWAvFS.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\ClZRKrj.exe
  C:\Windows\System\ClZRKrj.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\shGfySR.exe
  C:\Windows\System\shGfySR.exe
  2⤵
  PID:5100
- C:\Windows\System\HnAoTle.exe
  C:\Windows\System\HnAoTle.exe
  2⤵
  PID:3800
- C:\Windows\System\hnSYahS.exe
  C:\Windows\System\hnSYahS.exe
  2⤵
  PID:3324
- C:\Windows\System\CogzJuK.exe
  C:\Windows\System\CogzJuK.exe
  2⤵
  PID:3024
- C:\Windows\System\suFGADy.exe
  C:\Windows\System\suFGADy.exe
  2⤵
  PID:3136
- C:\Windows\System\jsQtHCy.exe
  C:\Windows\System\jsQtHCy.exe
  2⤵
  PID:3856
- C:\Windows\System\QZDaacU.exe
  C:\Windows\System\QZDaacU.exe
  2⤵
  PID:4052
- C:\Windows\System\eisbYGC.exe
  C:\Windows\System\eisbYGC.exe
  2⤵
  PID:4280
- C:\Windows\System\cjYJwkR.exe
  C:\Windows\System\cjYJwkR.exe
  2⤵
  PID:3044
- C:\Windows\System\FnlmxGj.exe
  C:\Windows\System\FnlmxGj.exe
  2⤵
  PID:4964
- C:\Windows\System\bMbKTXB.exe
  C:\Windows\System\bMbKTXB.exe
  2⤵
  PID:4100
- C:\Windows\System\kDPxAVS.exe
  C:\Windows\System\kDPxAVS.exe
  2⤵
  PID:4956
- C:\Windows\System\igvvwpv.exe
  C:\Windows\System\igvvwpv.exe
  2⤵
  PID:1464
- C:\Windows\System\SaaYoOn.exe
  C:\Windows\System\SaaYoOn.exe
  2⤵
  PID:1596
- C:\Windows\System\EJIzDBf.exe
  C:\Windows\System\EJIzDBf.exe
  2⤵
  PID:4472
- C:\Windows\System\DzjapXG.exe
  C:\Windows\System\DzjapXG.exe
  2⤵
  PID:3948
- C:\Windows\System\JQuzRYa.exe
  C:\Windows\System\JQuzRYa.exe
  2⤵
  PID:2436
- C:\Windows\System\rWRwfJG.exe
  C:\Windows\System\rWRwfJG.exe
  2⤵
  PID:400
- C:\Windows\System\dgukaFD.exe
  C:\Windows\System\dgukaFD.exe
  2⤵
  PID:2452
- C:\Windows\System\gyQFDLa.exe
  C:\Windows\System\gyQFDLa.exe
  2⤵
  PID:5148
- C:\Windows\System\EpAmhsy.exe
  C:\Windows\System\EpAmhsy.exe
  2⤵
  PID:5176
- C:\Windows\System\RJskIqr.exe
  C:\Windows\System\RJskIqr.exe
  2⤵
  PID:5200
- C:\Windows\System\qZimHjY.exe
  C:\Windows\System\qZimHjY.exe
  2⤵
  PID:5240
- C:\Windows\System\okjESEj.exe
  C:\Windows\System\okjESEj.exe
  2⤵
  PID:5268
- C:\Windows\System\mhIVPea.exe
  C:\Windows\System\mhIVPea.exe
  2⤵
  PID:5296
- C:\Windows\System\DzNVrxy.exe
  C:\Windows\System\DzNVrxy.exe
  2⤵
  PID:5316
- C:\Windows\System\xekUtqw.exe
  C:\Windows\System\xekUtqw.exe
  2⤵
  PID:5344
- C:\Windows\System\NMyMjRf.exe
  C:\Windows\System\NMyMjRf.exe
  2⤵
  PID:5368
- C:\Windows\System\GCsCRqF.exe
  C:\Windows\System\GCsCRqF.exe
  2⤵
  PID:5400
- C:\Windows\System\xTgfUOO.exe
  C:\Windows\System\xTgfUOO.exe
  2⤵
  PID:5424
- C:\Windows\System\tYbBkdW.exe
  C:\Windows\System\tYbBkdW.exe
  2⤵
  PID:5456
- C:\Windows\System\AvDAVoN.exe
  C:\Windows\System\AvDAVoN.exe
  2⤵
  PID:5484
- C:\Windows\System\PTWAHvH.exe
  C:\Windows\System\PTWAHvH.exe
  2⤵
  PID:5508
- C:\Windows\System\LzSkHlO.exe
  C:\Windows\System\LzSkHlO.exe
  2⤵
  PID:5536
- C:\Windows\System\ftybKRV.exe
  C:\Windows\System\ftybKRV.exe
  2⤵
  PID:5568
- C:\Windows\System\BIuavlN.exe
  C:\Windows\System\BIuavlN.exe
  2⤵
  PID:5592
- C:\Windows\System\UnNdjIx.exe
  C:\Windows\System\UnNdjIx.exe
  2⤵
  PID:5620
- C:\Windows\System\xGhIMfb.exe
  C:\Windows\System\xGhIMfb.exe
  2⤵
  PID:5652
- C:\Windows\System\YPeKQxp.exe
  C:\Windows\System\YPeKQxp.exe
  2⤵
  PID:5680
- C:\Windows\System\QnMbyKT.exe
  C:\Windows\System\QnMbyKT.exe
  2⤵
  PID:5704
- C:\Windows\System\HpVwScz.exe
  C:\Windows\System\HpVwScz.exe
  2⤵
  PID:5732
- C:\Windows\System\jiGpqOm.exe
  C:\Windows\System\jiGpqOm.exe
  2⤵
  PID:5760
- C:\Windows\System\QxVXZou.exe
  C:\Windows\System\QxVXZou.exe
  2⤵
  PID:5792
- C:\Windows\System\UZsGMZH.exe
  C:\Windows\System\UZsGMZH.exe
  2⤵
  PID:5820
- C:\Windows\System\aCWtUYT.exe
  C:\Windows\System\aCWtUYT.exe
  2⤵
  PID:5844
- C:\Windows\System\LyLbmvm.exe
  C:\Windows\System\LyLbmvm.exe
  2⤵
  PID:5872
- C:\Windows\System\mtBzVHh.exe
  C:\Windows\System\mtBzVHh.exe
  2⤵
  PID:5904
- C:\Windows\System\thWJnOb.exe
  C:\Windows\System\thWJnOb.exe
  2⤵
  PID:5928
- C:\Windows\System\llGplWJ.exe
  C:\Windows\System\llGplWJ.exe
  2⤵
  PID:5956
- C:\Windows\System\CHLzlgo.exe
  C:\Windows\System\CHLzlgo.exe
  2⤵
  PID:5984
- C:\Windows\System\AzMNFNY.exe
  C:\Windows\System\AzMNFNY.exe
  2⤵
  PID:6012
- C:\Windows\System\AKVydZK.exe
  C:\Windows\System\AKVydZK.exe
  2⤵
  PID:6040
- C:\Windows\System\PNjUOuv.exe
  C:\Windows\System\PNjUOuv.exe
  2⤵
  PID:6072
- C:\Windows\System\CyUAtEQ.exe
  C:\Windows\System\CyUAtEQ.exe
  2⤵
  PID:6100
- C:\Windows\System\bAkOeIS.exe
  C:\Windows\System\bAkOeIS.exe
  2⤵
  PID:6128
- C:\Windows\System\XWnaTHu.exe
  C:\Windows\System\XWnaTHu.exe
  2⤵
  PID:2460
- C:\Windows\System\wWXnMEX.exe
  C:\Windows\System\wWXnMEX.exe
  2⤵
  PID:2812
- C:\Windows\System\SPsuWsz.exe
  C:\Windows\System\SPsuWsz.exe
  2⤵
  PID:2968
- C:\Windows\System\kuajfzN.exe
  C:\Windows\System\kuajfzN.exe
  2⤵
  PID:1352
- C:\Windows\System\YdxPOTT.exe
  C:\Windows\System\YdxPOTT.exe
  2⤵
  PID:4492
- C:\Windows\System\OlZZUgX.exe
  C:\Windows\System\OlZZUgX.exe
  2⤵
  PID:5168
- C:\Windows\System\zghlCPj.exe
  C:\Windows\System\zghlCPj.exe
  2⤵
  PID:5236
- C:\Windows\System\jrYXjIy.exe
  C:\Windows\System\jrYXjIy.exe
  2⤵
  PID:5308
- C:\Windows\System\xkBTpUM.exe
  C:\Windows\System\xkBTpUM.exe
  2⤵
  PID:5364
- C:\Windows\System\HgCdwgY.exe
  C:\Windows\System\HgCdwgY.exe
  2⤵
  PID:5420
- C:\Windows\System\LZlGJFz.exe
  C:\Windows\System\LZlGJFz.exe
  2⤵
  PID:5496
- C:\Windows\System\GhFpwYo.exe
  C:\Windows\System\GhFpwYo.exe
  2⤵
  PID:5556
- C:\Windows\System\arjudQy.exe
  C:\Windows\System\arjudQy.exe
  2⤵
  PID:5636
- C:\Windows\System\HOCIQvU.exe
  C:\Windows\System\HOCIQvU.exe
  2⤵
  PID:5692
- C:\Windows\System\UnGrpjy.exe
  C:\Windows\System\UnGrpjy.exe
  2⤵
  PID:5752
- C:\Windows\System\gOvhyoo.exe
  C:\Windows\System\gOvhyoo.exe
  2⤵
  PID:5812
- C:\Windows\System\htsSGYD.exe
  C:\Windows\System\htsSGYD.exe
  2⤵
  PID:5888
- C:\Windows\System\NjSwqoR.exe
  C:\Windows\System\NjSwqoR.exe
  2⤵
  PID:5944
- C:\Windows\System\xsmBLGU.exe
  C:\Windows\System\xsmBLGU.exe
  2⤵
  PID:6000
- C:\Windows\System\VidaYkr.exe
  C:\Windows\System\VidaYkr.exe
  2⤵
  PID:6056
- C:\Windows\System\YcniTEu.exe
  C:\Windows\System\YcniTEu.exe
  2⤵
  PID:2124
- C:\Windows\System\DfZbbLY.exe
  C:\Windows\System\DfZbbLY.exe
  2⤵
  PID:3320
- C:\Windows\System\LpxDpoa.exe
  C:\Windows\System\LpxDpoa.exe
  2⤵
  PID:4292
- C:\Windows\System\bVAhKKg.exe
  C:\Windows\System\bVAhKKg.exe
  2⤵
  PID:1204
- C:\Windows\System\lIseQCK.exe
  C:\Windows\System\lIseQCK.exe
  2⤵
  PID:5160
- C:\Windows\System\sCbGIOJ.exe
  C:\Windows\System\sCbGIOJ.exe
  2⤵
  PID:5472
- C:\Windows\System\ENeIMpl.exe
  C:\Windows\System\ENeIMpl.exe
  2⤵
  PID:5552
- C:\Windows\System\ewnZtOw.exe
  C:\Windows\System\ewnZtOw.exe
  2⤵
  PID:5612
- C:\Windows\System\QvJKegQ.exe
  C:\Windows\System\QvJKegQ.exe
  2⤵
  PID:5668
- C:\Windows\System\qwXMwdN.exe
  C:\Windows\System\qwXMwdN.exe
  2⤵
  PID:5748
- C:\Windows\System\QoirHjS.exe
  C:\Windows\System\QoirHjS.exe
  2⤵
  PID:5808
- C:\Windows\System\KbUKqsQ.exe
  C:\Windows\System\KbUKqsQ.exe
  2⤵
  PID:4908
- C:\Windows\System\tzGckWG.exe
  C:\Windows\System\tzGckWG.exe
  2⤵
  PID:2364
- C:\Windows\System\vponocy.exe
  C:\Windows\System\vponocy.exe
  2⤵
  PID:6032
- C:\Windows\System\FpSPKPD.exe
  C:\Windows\System\FpSPKPD.exe
  2⤵
  PID:2644
- C:\Windows\System\RWXvmEt.exe
  C:\Windows\System\RWXvmEt.exe
  2⤵
  PID:4324
- C:\Windows\System\lqkjtFP.exe
  C:\Windows\System\lqkjtFP.exe
  2⤵
  PID:4840
- C:\Windows\System\AVGWLJQ.exe
  C:\Windows\System\AVGWLJQ.exe
  2⤵
  PID:4368
- C:\Windows\System\aaBPTCh.exe
  C:\Windows\System\aaBPTCh.exe
  2⤵
  PID:3600
- C:\Windows\System\jAYQJqb.exe
  C:\Windows\System\jAYQJqb.exe
  2⤵
  PID:5392
- C:\Windows\System\iwOFvSO.exe
  C:\Windows\System\iwOFvSO.exe
  2⤵
  PID:392
- C:\Windows\System\WXySpjg.exe
  C:\Windows\System\WXySpjg.exe
  2⤵
  PID:5140
- C:\Windows\System\XTsHfMU.exe
  C:\Windows\System\XTsHfMU.exe
  2⤵
  PID:6084
- C:\Windows\System\NhiRZyQ.exe
  C:\Windows\System\NhiRZyQ.exe
  2⤵
  PID:1312
- C:\Windows\System\IsgpviG.exe
  C:\Windows\System\IsgpviG.exe
  2⤵
  PID:6152
- C:\Windows\System\pwsqnOP.exe
  C:\Windows\System\pwsqnOP.exe
  2⤵
  PID:6184
- C:\Windows\System\pDeJaOg.exe
  C:\Windows\System\pDeJaOg.exe
  2⤵
  PID:6208
- C:\Windows\System\GbUyMlI.exe
  C:\Windows\System\GbUyMlI.exe
  2⤵
  PID:6232
- C:\Windows\System\sEkfWPf.exe
  C:\Windows\System\sEkfWPf.exe
  2⤵
  PID:6252
- C:\Windows\System\ukptnFW.exe
  C:\Windows\System\ukptnFW.exe
  2⤵
  PID:6320
- C:\Windows\System\azNvnAM.exe
  C:\Windows\System\azNvnAM.exe
  2⤵
  PID:6336
- C:\Windows\System\YQmtBCE.exe
  C:\Windows\System\YQmtBCE.exe
  2⤵
  PID:6360
- C:\Windows\System\GRmRWYq.exe
  C:\Windows\System\GRmRWYq.exe
  2⤵
  PID:6388
- C:\Windows\System\cUGlkKS.exe
  C:\Windows\System\cUGlkKS.exe
  2⤵
  PID:6464
- C:\Windows\System\usDjymc.exe
  C:\Windows\System\usDjymc.exe
  2⤵
  PID:6500
- C:\Windows\System\BTVcduk.exe
  C:\Windows\System\BTVcduk.exe
  2⤵
  PID:6556
- C:\Windows\System\yrFwmCO.exe
  C:\Windows\System\yrFwmCO.exe
  2⤵
  PID:6628
- C:\Windows\System\zArwBuO.exe
  C:\Windows\System\zArwBuO.exe
  2⤵
  PID:6664
- C:\Windows\System\skhLccZ.exe
  C:\Windows\System\skhLccZ.exe
  2⤵
  PID:6688
- C:\Windows\System\xFCnits.exe
  C:\Windows\System\xFCnits.exe
  2⤵
  PID:6708
- C:\Windows\System\cIPEsst.exe
  C:\Windows\System\cIPEsst.exe
  2⤵
  PID:6728
- C:\Windows\System\kANtZwO.exe
  C:\Windows\System\kANtZwO.exe
  2⤵
  PID:6752
- C:\Windows\System\JPaXsUt.exe
  C:\Windows\System\JPaXsUt.exe
  2⤵
  PID:6832
- C:\Windows\System\YqsAoJm.exe
  C:\Windows\System\YqsAoJm.exe
  2⤵
  PID:6848
- C:\Windows\System\sHTzPdP.exe
  C:\Windows\System\sHTzPdP.exe
  2⤵
  PID:6872
- C:\Windows\System\PqFmDeK.exe
  C:\Windows\System\PqFmDeK.exe
  2⤵
  PID:6900
- C:\Windows\System\bZlLYQj.exe
  C:\Windows\System\bZlLYQj.exe
  2⤵
  PID:6920
- C:\Windows\System\qGnsonq.exe
  C:\Windows\System\qGnsonq.exe
  2⤵
  PID:6948
- C:\Windows\System\NOFEuLK.exe
  C:\Windows\System\NOFEuLK.exe
  2⤵
  PID:6972
- C:\Windows\System\JfoScTA.exe
  C:\Windows\System\JfoScTA.exe
  2⤵
  PID:7000
- C:\Windows\System\tXHzkop.exe
  C:\Windows\System\tXHzkop.exe
  2⤵
  PID:7028
- C:\Windows\System\BMJFcjo.exe
  C:\Windows\System\BMJFcjo.exe
  2⤵
  PID:7112
- C:\Windows\System\qtAObkM.exe
  C:\Windows\System\qtAObkM.exe
  2⤵
  PID:7132
- C:\Windows\System\atqrfSi.exe
  C:\Windows\System\atqrfSi.exe
  2⤵
  PID:7148
- C:\Windows\System\YcRNGDv.exe
  C:\Windows\System\YcRNGDv.exe
  2⤵
  PID:7164
- C:\Windows\System\BzGEIIy.exe
  C:\Windows\System\BzGEIIy.exe
  2⤵
  PID:5360
- C:\Windows\System\IFxgWrB.exe
  C:\Windows\System\IFxgWrB.exe
  2⤵
  PID:2780
- C:\Windows\System\qnYrIjS.exe
  C:\Windows\System\qnYrIjS.exe
  2⤵
  PID:1868
- C:\Windows\System\wNXobpl.exe
  C:\Windows\System\wNXobpl.exe
  2⤵
  PID:5980
- C:\Windows\System\wmrbcdm.exe
  C:\Windows\System\wmrbcdm.exe
  2⤵
  PID:6332
- C:\Windows\System\WsJrEsR.exe
  C:\Windows\System\WsJrEsR.exe
  2⤵
  PID:6216
- C:\Windows\System\mNJrRpO.exe
  C:\Windows\System\mNJrRpO.exe
  2⤵
  PID:6240
- C:\Windows\System\fGBybCy.exe
  C:\Windows\System\fGBybCy.exe
  2⤵
  PID:6452
- C:\Windows\System\bwdkLfR.exe
  C:\Windows\System\bwdkLfR.exe
  2⤵
  PID:6660
- C:\Windows\System\sAUvkbz.exe
  C:\Windows\System\sAUvkbz.exe
  2⤵
  PID:6896
- C:\Windows\System\trREVcV.exe
  C:\Windows\System\trREVcV.exe
  2⤵
  PID:6864
- C:\Windows\System\bnbwrkz.exe
  C:\Windows\System\bnbwrkz.exe
  2⤵
  PID:6824
- C:\Windows\System\qkRimck.exe
  C:\Windows\System\qkRimck.exe
  2⤵
  PID:6676
- C:\Windows\System\jeyrbrF.exe
  C:\Windows\System\jeyrbrF.exe
  2⤵
  PID:6996
- C:\Windows\System\WDFhoML.exe
  C:\Windows\System\WDFhoML.exe
  2⤵
  PID:7064
- C:\Windows\System\acMEFsM.exe
  C:\Windows\System\acMEFsM.exe
  2⤵
  PID:6160
- C:\Windows\System\ccWnXOG.exe
  C:\Windows\System\ccWnXOG.exe
  2⤵
  PID:6368
- C:\Windows\System\wSPDydg.exe
  C:\Windows\System\wSPDydg.exe
  2⤵
  PID:6584
- C:\Windows\System\qYYreIU.exe
  C:\Windows\System\qYYreIU.exe
  2⤵
  PID:7124
- C:\Windows\System\DGkdLJR.exe
  C:\Windows\System\DGkdLJR.exe
  2⤵
  PID:1648
- C:\Windows\System\VQeeHWD.exe
  C:\Windows\System\VQeeHWD.exe
  2⤵
  PID:6308
- C:\Windows\System\beneBAB.exe
  C:\Windows\System\beneBAB.exe
  2⤵
  PID:6416
- C:\Windows\System\nQpkVuU.exe
  C:\Windows\System\nQpkVuU.exe
  2⤵
  PID:6304
- C:\Windows\System\FrVaDAI.exe
  C:\Windows\System\FrVaDAI.exe
  2⤵
  PID:6456
- C:\Windows\System\yegTqKi.exe
  C:\Windows\System\yegTqKi.exe
  2⤵
  PID:6844
- C:\Windows\System\wjOCspR.exe
  C:\Windows\System\wjOCspR.exe
  2⤵
  PID:6696
- C:\Windows\System\QaSBJrz.exe
  C:\Windows\System\QaSBJrz.exe
  2⤵
  PID:6988
- C:\Windows\System\GVJrHjH.exe
  C:\Windows\System\GVJrHjH.exe
  2⤵
  PID:5868
- C:\Windows\System\ZfGuXkn.exe
  C:\Windows\System\ZfGuXkn.exe
  2⤵
  PID:5356
- C:\Windows\System\dAzDYjL.exe
  C:\Windows\System\dAzDYjL.exe
  2⤵
  PID:6868
- C:\Windows\System\hGbshAf.exe
  C:\Windows\System\hGbshAf.exe
  2⤵
  PID:6960
- C:\Windows\System\VsoTNRP.exe
  C:\Windows\System\VsoTNRP.exe
  2⤵
  PID:6408
- C:\Windows\System\FVcgTeM.exe
  C:\Windows\System\FVcgTeM.exe
  2⤵
  PID:5468
- C:\Windows\System\irOnwLS.exe
  C:\Windows\System\irOnwLS.exe
  2⤵
  PID:7172
- C:\Windows\System\axqjnvt.exe
  C:\Windows\System\axqjnvt.exe
  2⤵
  PID:7188
- C:\Windows\System\YiMjFGM.exe
  C:\Windows\System\YiMjFGM.exe
  2⤵
  PID:7236
- C:\Windows\System\nvqyoqV.exe
  C:\Windows\System\nvqyoqV.exe
  2⤵
  PID:7256
- C:\Windows\System\uqHVOvS.exe
  C:\Windows\System\uqHVOvS.exe
  2⤵
  PID:7280
- C:\Windows\System\YJqGYWu.exe
  C:\Windows\System\YJqGYWu.exe
  2⤵
  PID:7300
- C:\Windows\System\lVjmDcu.exe
  C:\Windows\System\lVjmDcu.exe
  2⤵
  PID:7348
- C:\Windows\System\ZnWGATm.exe
  C:\Windows\System\ZnWGATm.exe
  2⤵
  PID:7400
- C:\Windows\System\KQoABwr.exe
  C:\Windows\System\KQoABwr.exe
  2⤵
  PID:7420
- C:\Windows\System\bKcHseB.exe
  C:\Windows\System\bKcHseB.exe
  2⤵
  PID:7440
- C:\Windows\System\zZoruux.exe
  C:\Windows\System\zZoruux.exe
  2⤵
  PID:7472
- C:\Windows\System\XnaOeKp.exe
  C:\Windows\System\XnaOeKp.exe
  2⤵
  PID:7500
- C:\Windows\System\PVbosFy.exe
  C:\Windows\System\PVbosFy.exe
  2⤵
  PID:7520
- C:\Windows\System\QvoLZng.exe
  C:\Windows\System\QvoLZng.exe
  2⤵
  PID:7564
- C:\Windows\System\zNRwPCK.exe
  C:\Windows\System\zNRwPCK.exe
  2⤵
  PID:7600
- C:\Windows\System\IYSFGIb.exe
  C:\Windows\System\IYSFGIb.exe
  2⤵
  PID:7620
- C:\Windows\System\LFIplTH.exe
  C:\Windows\System\LFIplTH.exe
  2⤵
  PID:7648
- C:\Windows\System\SQWrnkN.exe
  C:\Windows\System\SQWrnkN.exe
  2⤵
  PID:7672
- C:\Windows\System\AewBQEE.exe
  C:\Windows\System\AewBQEE.exe
  2⤵
  PID:7692
- C:\Windows\System\FOJirEP.exe
  C:\Windows\System\FOJirEP.exe
  2⤵
  PID:7716
- C:\Windows\System\nhmSCeB.exe
  C:\Windows\System\nhmSCeB.exe
  2⤵
  PID:7748
- C:\Windows\System\IwAxPIT.exe
  C:\Windows\System\IwAxPIT.exe
  2⤵
  PID:7776
- C:\Windows\System\dcLRBCE.exe
  C:\Windows\System\dcLRBCE.exe
  2⤵
  PID:7796
- C:\Windows\System\qOTHYtv.exe
  C:\Windows\System\qOTHYtv.exe
  2⤵
  PID:7844
- C:\Windows\System\SOVlowr.exe
  C:\Windows\System\SOVlowr.exe
  2⤵
  PID:7864
- C:\Windows\System\tpNiDsJ.exe
  C:\Windows\System\tpNiDsJ.exe
  2⤵
  PID:7896
- C:\Windows\System\rcmJilK.exe
  C:\Windows\System\rcmJilK.exe
  2⤵
  PID:7916
- C:\Windows\System\WAmLGfg.exe
  C:\Windows\System\WAmLGfg.exe
  2⤵
  PID:7980
- C:\Windows\System\DqkDwqJ.exe
  C:\Windows\System\DqkDwqJ.exe
  2⤵
  PID:8012
- C:\Windows\System\pVzljVf.exe
  C:\Windows\System\pVzljVf.exe
  2⤵
  PID:8032
- C:\Windows\System\OwGqDwR.exe
  C:\Windows\System\OwGqDwR.exe
  2⤵
  PID:8060
- C:\Windows\System\tahkgcz.exe
  C:\Windows\System\tahkgcz.exe
  2⤵
  PID:8088
- C:\Windows\System\eNwSXWN.exe
  C:\Windows\System\eNwSXWN.exe
  2⤵
  PID:8104
- C:\Windows\System\mgpHHJw.exe
  C:\Windows\System\mgpHHJw.exe
  2⤵
  PID:8140
- C:\Windows\System\reolDLl.exe
  C:\Windows\System\reolDLl.exe
  2⤵
  PID:8160
- C:\Windows\System\edgdnCG.exe
  C:\Windows\System\edgdnCG.exe
  2⤵
  PID:8188
- C:\Windows\System\cAdtYQe.exe
  C:\Windows\System\cAdtYQe.exe
  2⤵
  PID:7212
- C:\Windows\System\BZvaJLi.exe
  C:\Windows\System\BZvaJLi.exe
  2⤵
  PID:7228
- C:\Windows\System\RExojYw.exe
  C:\Windows\System\RExojYw.exe
  2⤵
  PID:7288
- C:\Windows\System\jkofOxn.exe
  C:\Windows\System\jkofOxn.exe
  2⤵
  PID:7376
- C:\Windows\System\SKAIOTf.exe
  C:\Windows\System\SKAIOTf.exe
  2⤵
  PID:7408
- C:\Windows\System\ccYadwu.exe
  C:\Windows\System\ccYadwu.exe
  2⤵
  PID:7416
- C:\Windows\System\ODmCGEa.exe
  C:\Windows\System\ODmCGEa.exe
  2⤵
  PID:7508
- C:\Windows\System\QKNnoqu.exe
  C:\Windows\System\QKNnoqu.exe
  2⤵
  PID:7640
- C:\Windows\System\vsTKFHZ.exe
  C:\Windows\System\vsTKFHZ.exe
  2⤵
  PID:7772
- C:\Windows\System\jfSPhzW.exe
  C:\Windows\System\jfSPhzW.exe
  2⤵
  PID:7976
- C:\Windows\System\GbRPRBj.exe
  C:\Windows\System\GbRPRBj.exe
  2⤵
  PID:8040
- C:\Windows\System\zRvalsI.exe
  C:\Windows\System\zRvalsI.exe
  2⤵
  PID:8056
- C:\Windows\System\isYoHXW.exe
  C:\Windows\System\isYoHXW.exe
  2⤵
  PID:8100
- C:\Windows\System\fRzEYZL.exe
  C:\Windows\System\fRzEYZL.exe
  2⤵
  PID:8180
- C:\Windows\System\kyKXIMV.exe
  C:\Windows\System\kyKXIMV.exe
  2⤵
  PID:7180
- C:\Windows\System\QrMWgdX.exe
  C:\Windows\System\QrMWgdX.exe
  2⤵
  PID:7340
- C:\Windows\System\GLCSOAR.exe
  C:\Windows\System\GLCSOAR.exe
  2⤵
  PID:7704
- C:\Windows\System\qFBMMNg.exe
  C:\Windows\System\qFBMMNg.exe
  2⤵
  PID:7616
- C:\Windows\System\drPzALR.exe
  C:\Windows\System\drPzALR.exe
  2⤵
  PID:7840
- C:\Windows\System\AGXQaND.exe
  C:\Windows\System\AGXQaND.exe
  2⤵
  PID:8124
- C:\Windows\System\mulBcfR.exe
  C:\Windows\System\mulBcfR.exe
  2⤵
  PID:8132
- C:\Windows\System\UCIJivf.exe
  C:\Windows\System\UCIJivf.exe
  2⤵
  PID:7296
- C:\Windows\System\lBGyNUH.exe
  C:\Windows\System\lBGyNUH.exe
  2⤵
  PID:7740
- C:\Windows\System\poTIFKg.exe
  C:\Windows\System\poTIFKg.exe
  2⤵
  PID:8024
- C:\Windows\System\ZOCKJzY.exe
  C:\Windows\System\ZOCKJzY.exe
  2⤵
  PID:7452
- C:\Windows\System\GXLBRhI.exe
  C:\Windows\System\GXLBRhI.exe
  2⤵
  PID:8208
- C:\Windows\System\DqvdbWb.exe
  C:\Windows\System\DqvdbWb.exe
  2⤵
  PID:8244
- C:\Windows\System\FPZBYRg.exe
  C:\Windows\System\FPZBYRg.exe
  2⤵
  PID:8284
- C:\Windows\System\kBpRDFM.exe
  C:\Windows\System\kBpRDFM.exe
  2⤵
  PID:8300
- C:\Windows\System\lWSLpOj.exe
  C:\Windows\System\lWSLpOj.exe
  2⤵
  PID:8328
- C:\Windows\System\vghwdDV.exe
  C:\Windows\System\vghwdDV.exe
  2⤵
  PID:8368
- C:\Windows\System\DZIiOAB.exe
  C:\Windows\System\DZIiOAB.exe
  2⤵
  PID:8392
- C:\Windows\System\UQAcwKe.exe
  C:\Windows\System\UQAcwKe.exe
  2⤵
  PID:8412
- C:\Windows\System\xBaXPUB.exe
  C:\Windows\System\xBaXPUB.exe
  2⤵
  PID:8460
- C:\Windows\System\abzkrMc.exe
  C:\Windows\System\abzkrMc.exe
  2⤵
  PID:8476
- C:\Windows\System\sznQSqg.exe
  C:\Windows\System\sznQSqg.exe
  2⤵
  PID:8492
- C:\Windows\System\SaLyWEd.exe
  C:\Windows\System\SaLyWEd.exe
  2⤵
  PID:8528
- C:\Windows\System\GxHqyVl.exe
  C:\Windows\System\GxHqyVl.exe
  2⤵
  PID:8560
- C:\Windows\System\sEpiYmf.exe
  C:\Windows\System\sEpiYmf.exe
  2⤵
  PID:8588
- C:\Windows\System\gpSikrA.exe
  C:\Windows\System\gpSikrA.exe
  2⤵
  PID:8608
- C:\Windows\System\NXraSuq.exe
  C:\Windows\System\NXraSuq.exe
  2⤵
  PID:8648
- C:\Windows\System\dsutPoZ.exe
  C:\Windows\System\dsutPoZ.exe
  2⤵
  PID:8668
- C:\Windows\System\jLfkoXr.exe
  C:\Windows\System\jLfkoXr.exe
  2⤵
  PID:8684
- C:\Windows\System\QEgOhir.exe
  C:\Windows\System\QEgOhir.exe
  2⤵
  PID:8704
- C:\Windows\System\ZMyxvni.exe
  C:\Windows\System\ZMyxvni.exe
  2⤵
  PID:8732
- C:\Windows\System\VJobQDo.exe
  C:\Windows\System\VJobQDo.exe
  2⤵
  PID:8772
- C:\Windows\System\NLbnaJK.exe
  C:\Windows\System\NLbnaJK.exe
  2⤵
  PID:8792
- C:\Windows\System\dxRzuGP.exe
  C:\Windows\System\dxRzuGP.exe
  2⤵
  PID:8816
- C:\Windows\System\uPaGshW.exe
  C:\Windows\System\uPaGshW.exe
  2⤵
  PID:8852
- C:\Windows\System\NQyLkTO.exe
  C:\Windows\System\NQyLkTO.exe
  2⤵
  PID:8888
- C:\Windows\System\lwQRFTN.exe
  C:\Windows\System\lwQRFTN.exe
  2⤵
  PID:8932
- C:\Windows\System\ibpjrqY.exe
  C:\Windows\System\ibpjrqY.exe
  2⤵
  PID:8956
- C:\Windows\System\uFllytD.exe
  C:\Windows\System\uFllytD.exe
  2⤵
  PID:8980
- C:\Windows\System\WpQWtcX.exe
  C:\Windows\System\WpQWtcX.exe
  2⤵
  PID:9008
- C:\Windows\System\fYZGmKt.exe
  C:\Windows\System\fYZGmKt.exe
  2⤵
  PID:9032
- C:\Windows\System\aGAttYW.exe
  C:\Windows\System\aGAttYW.exe
  2⤵
  PID:9048
- C:\Windows\System\GkaZgTS.exe
  C:\Windows\System\GkaZgTS.exe
  2⤵
  PID:9068
- C:\Windows\System\qkPiIUV.exe
  C:\Windows\System\qkPiIUV.exe
  2⤵
  PID:9088
- C:\Windows\System\VIuZCHy.exe
  C:\Windows\System\VIuZCHy.exe
  2⤵
  PID:9112
- C:\Windows\System\eejWXid.exe
  C:\Windows\System\eejWXid.exe
  2⤵
  PID:9128
- C:\Windows\System\HYGfnzM.exe
  C:\Windows\System\HYGfnzM.exe
  2⤵
  PID:9148
- C:\Windows\System\sWcxpSm.exe
  C:\Windows\System\sWcxpSm.exe
  2⤵
  PID:9168
- C:\Windows\System\FtOyoWY.exe
  C:\Windows\System\FtOyoWY.exe
  2⤵
  PID:7612
- C:\Windows\System\QKUOPsJ.exe
  C:\Windows\System\QKUOPsJ.exe
  2⤵
  PID:8264
- C:\Windows\System\nFTZcmY.exe
  C:\Windows\System\nFTZcmY.exe
  2⤵
  PID:8320
- C:\Windows\System\DJuwTFU.exe
  C:\Windows\System\DJuwTFU.exe
  2⤵
  PID:3972
- C:\Windows\System\lHlZSAO.exe
  C:\Windows\System\lHlZSAO.exe
  2⤵
  PID:8424
- C:\Windows\System\gAsQIqR.exe
  C:\Windows\System\gAsQIqR.exe
  2⤵
  PID:5028
- C:\Windows\System\svwMdMN.exe
  C:\Windows\System\svwMdMN.exe
  2⤵
  PID:8524
- C:\Windows\System\ZdVeyeg.exe
  C:\Windows\System\ZdVeyeg.exe
  2⤵
  PID:8568
- C:\Windows\System\wqVrzxj.exe
  C:\Windows\System\wqVrzxj.exe
  2⤵
  PID:8632
- C:\Windows\System\lqSQiJi.exe
  C:\Windows\System\lqSQiJi.exe
  2⤵
  PID:8656
- C:\Windows\System\cjaXixR.exe
  C:\Windows\System\cjaXixR.exe
  2⤵
  PID:8788
- C:\Windows\System\bJcpDXQ.exe
  C:\Windows\System\bJcpDXQ.exe
  2⤵
  PID:8952
- C:\Windows\System\ePJrgWm.exe
  C:\Windows\System\ePJrgWm.exe
  2⤵
  PID:9060
- C:\Windows\System\jPacJxW.exe
  C:\Windows\System\jPacJxW.exe
  2⤵
  PID:9176
- C:\Windows\System\gBOoBxG.exe
  C:\Windows\System\gBOoBxG.exe
  2⤵
  PID:8168
- C:\Windows\System\hGojhqf.exe
  C:\Windows\System\hGojhqf.exe
  2⤵
  PID:9188
- C:\Windows\System\FBFtibL.exe
  C:\Windows\System\FBFtibL.exe
  2⤵
  PID:8204
- C:\Windows\System\ReDOyUq.exe
  C:\Windows\System\ReDOyUq.exe
  2⤵
  PID:8292
- C:\Windows\System\zDgvpiN.exe
  C:\Windows\System\zDgvpiN.exe
  2⤵
  PID:8404
- C:\Windows\System\oROFgse.exe
  C:\Windows\System\oROFgse.exe
  2⤵
  PID:1088
- C:\Windows\System\fryeQxO.exe
  C:\Windows\System\fryeQxO.exe
  2⤵
  PID:8456
- C:\Windows\System\XjwMNEk.exe
  C:\Windows\System\XjwMNEk.exe
  2⤵
  PID:8628
- C:\Windows\System\YXnHGcs.exe
  C:\Windows\System\YXnHGcs.exe
  2⤵
  PID:8808
- C:\Windows\System\KkIKiae.exe
  C:\Windows\System\KkIKiae.exe
  2⤵
  PID:8944
- C:\Windows\System\KJnRzed.exe
  C:\Windows\System\KJnRzed.exe
  2⤵
  PID:8972
- C:\Windows\System\ZHdmNlf.exe
  C:\Windows\System\ZHdmNlf.exe
  2⤵
  PID:9164
- C:\Windows\System\GYYIBFN.exe
  C:\Windows\System\GYYIBFN.exe
  2⤵
  PID:8448
- C:\Windows\System\bPPinDA.exe
  C:\Windows\System\bPPinDA.exe
  2⤵
  PID:8832
- C:\Windows\System\HwzZQci.exe
  C:\Windows\System\HwzZQci.exe
  2⤵
  PID:9000
- C:\Windows\System\rxQAEnE.exe
  C:\Windows\System\rxQAEnE.exe
  2⤵
  PID:9236
- C:\Windows\System\khAqjfz.exe
  C:\Windows\System\khAqjfz.exe
  2⤵
  PID:9308
- C:\Windows\System\qcjUGIV.exe
  C:\Windows\System\qcjUGIV.exe
  2⤵
  PID:9328
- C:\Windows\System\AFfpvER.exe
  C:\Windows\System\AFfpvER.exe
  2⤵
  PID:9380
- C:\Windows\System\CWXZwSG.exe
  C:\Windows\System\CWXZwSG.exe
  2⤵
  PID:9400
- C:\Windows\System\kvnwpHd.exe
  C:\Windows\System\kvnwpHd.exe
  2⤵
  PID:9424
- C:\Windows\System\xoDTrPa.exe
  C:\Windows\System\xoDTrPa.exe
  2⤵
  PID:9448
- C:\Windows\System\xSVbRFC.exe
  C:\Windows\System\xSVbRFC.exe
  2⤵
  PID:9468
- C:\Windows\System\zrzsUJW.exe
  C:\Windows\System\zrzsUJW.exe
  2⤵
  PID:9496
- C:\Windows\System\NGBEzFC.exe
  C:\Windows\System\NGBEzFC.exe
  2⤵
  PID:9536
- C:\Windows\System\PRdLorM.exe
  C:\Windows\System\PRdLorM.exe
  2⤵
  PID:9556
- C:\Windows\System\oHStnvH.exe
  C:\Windows\System\oHStnvH.exe
  2⤵
  PID:9580
- C:\Windows\System\ZWHXXsA.exe
  C:\Windows\System\ZWHXXsA.exe
  2⤵
  PID:9608
- C:\Windows\System\QmZSKyu.exe
  C:\Windows\System\QmZSKyu.exe
  2⤵
  PID:9624
- C:\Windows\System\UYrbeas.exe
  C:\Windows\System\UYrbeas.exe
  2⤵
  PID:9668
- C:\Windows\System\EZvpNux.exe
  C:\Windows\System\EZvpNux.exe
  2⤵
  PID:9716
- C:\Windows\System\EgYkfSr.exe
  C:\Windows\System\EgYkfSr.exe
  2⤵
  PID:9740
- C:\Windows\System\SqEZukv.exe
  C:\Windows\System\SqEZukv.exe
  2⤵
  PID:9764
- C:\Windows\System\xaMMhFX.exe
  C:\Windows\System\xaMMhFX.exe
  2⤵
  PID:9812
- C:\Windows\System\JEFlxuF.exe
  C:\Windows\System\JEFlxuF.exe
  2⤵
  PID:9832
- C:\Windows\System\gGdBTGx.exe
  C:\Windows\System\gGdBTGx.exe
  2⤵
  PID:9848
- C:\Windows\System\zKoYdPQ.exe
  C:\Windows\System\zKoYdPQ.exe
  2⤵
  PID:9868
- C:\Windows\System\ZrBhmrA.exe
  C:\Windows\System\ZrBhmrA.exe
  2⤵
  PID:9892
- C:\Windows\System\NoCiwOK.exe
  C:\Windows\System\NoCiwOK.exe
  2⤵
  PID:9908
- C:\Windows\System\EMONGKW.exe
  C:\Windows\System\EMONGKW.exe
  2⤵
  PID:9932
- C:\Windows\System\kWSJCLk.exe
  C:\Windows\System\kWSJCLk.exe
  2⤵
  PID:9984
- C:\Windows\System\skpFHOU.exe
  C:\Windows\System\skpFHOU.exe
  2⤵
  PID:10012
- C:\Windows\System\XjYTXca.exe
  C:\Windows\System\XjYTXca.exe
  2⤵
  PID:10032
- C:\Windows\System\BTuGJtj.exe
  C:\Windows\System\BTuGJtj.exe
  2⤵
  PID:10048
- C:\Windows\System\NCXBzSn.exe
  C:\Windows\System\NCXBzSn.exe
  2⤵
  PID:10072
- C:\Windows\System\WhQvmUh.exe
  C:\Windows\System\WhQvmUh.exe
  2⤵
  PID:10104
- C:\Windows\System\JEAdBtT.exe
  C:\Windows\System\JEAdBtT.exe
  2⤵
  PID:10128
- C:\Windows\System\YWLSRHT.exe
  C:\Windows\System\YWLSRHT.exe
  2⤵
  PID:10148
- C:\Windows\System\nRBQjDt.exe
  C:\Windows\System\nRBQjDt.exe
  2⤵
  PID:10180
- C:\Windows\System\rFptupc.exe
  C:\Windows\System\rFptupc.exe
  2⤵
  PID:10204
- C:\Windows\System\SnILOpp.exe
  C:\Windows\System\SnILOpp.exe
  2⤵
  PID:10220
- C:\Windows\System\dScvJzp.exe
  C:\Windows\System\dScvJzp.exe
  2⤵
  PID:8756
- C:\Windows\System\DWzijmW.exe
  C:\Windows\System\DWzijmW.exe
  2⤵
  PID:9144
- C:\Windows\System\hHxqxsY.exe
  C:\Windows\System\hHxqxsY.exe
  2⤵
  PID:9228
- C:\Windows\System\aKWygXQ.exe
  C:\Windows\System\aKWygXQ.exe
  2⤵
  PID:9348
- C:\Windows\System\uQzCFyf.exe
  C:\Windows\System\uQzCFyf.exe
  2⤵
  PID:9416
- C:\Windows\System\kzRMtJl.exe
  C:\Windows\System\kzRMtJl.exe
  2⤵
  PID:9524
- C:\Windows\System\qPkkNPd.exe
  C:\Windows\System\qPkkNPd.exe
  2⤵
  PID:9660
- C:\Windows\System\ObowkCf.exe
  C:\Windows\System\ObowkCf.exe
  2⤵
  PID:9728
- C:\Windows\System\AwSAGMk.exe
  C:\Windows\System\AwSAGMk.exe
  2⤵
  PID:9808
- C:\Windows\System\SWTGuip.exe
  C:\Windows\System\SWTGuip.exe
  2⤵
  PID:9864
- C:\Windows\System\eqxjLfM.exe
  C:\Windows\System\eqxjLfM.exe
  2⤵
  PID:9916
- C:\Windows\System\AEiVvUS.exe
  C:\Windows\System\AEiVvUS.exe
  2⤵
  PID:9928
- C:\Windows\System\YGzTxQE.exe
  C:\Windows\System\YGzTxQE.exe
  2⤵
  PID:10008
- C:\Windows\System\JQkwNEF.exe
  C:\Windows\System\JQkwNEF.exe
  2⤵
  PID:10060
- C:\Windows\System\PbQngJa.exe
  C:\Windows\System\PbQngJa.exe
  2⤵
  PID:10100
- C:\Windows\System\lvcbVSL.exe
  C:\Windows\System\lvcbVSL.exe
  2⤵
  PID:10144
- C:\Windows\System\OahQaoT.exe
  C:\Windows\System\OahQaoT.exe
  2⤵
  PID:10236
- C:\Windows\System\QhnKUIc.exe
  C:\Windows\System\QhnKUIc.exe
  2⤵
  PID:10200
- C:\Windows\System\ekbBMwz.exe
  C:\Windows\System\ekbBMwz.exe
  2⤵
  PID:9372
- C:\Windows\System\CLwmHSr.exe
  C:\Windows\System\CLwmHSr.exe
  2⤵
  PID:9648
- C:\Windows\System\LlTguhx.exe
  C:\Windows\System\LlTguhx.exe
  2⤵
  PID:9820
- C:\Windows\System\MMWlknQ.exe
  C:\Windows\System\MMWlknQ.exe
  2⤵
  PID:9788
- C:\Windows\System\pOHlQwG.exe
  C:\Windows\System\pOHlQwG.exe
  2⤵
  PID:9956
- C:\Windows\System\IzkUrtA.exe
  C:\Windows\System\IzkUrtA.exe
  2⤵
  PID:10040
- C:\Windows\System\cNTzyFJ.exe
  C:\Windows\System\cNTzyFJ.exe
  2⤵
  PID:10136
- C:\Windows\System\EufHgCa.exe
  C:\Windows\System\EufHgCa.exe
  2⤵
  PID:10160
- C:\Windows\System\XagvdZl.exe
  C:\Windows\System\XagvdZl.exe
  2⤵
  PID:9280
- C:\Windows\System\EDeWwGJ.exe
  C:\Windows\System\EDeWwGJ.exe
  2⤵
  PID:9572
- C:\Windows\System\RXgAgbs.exe
  C:\Windows\System\RXgAgbs.exe
  2⤵
  PID:9680
- C:\Windows\System\ckznrja.exe
  C:\Windows\System\ckznrja.exe
  2⤵
  PID:10276
- C:\Windows\System\vHDyflv.exe
  C:\Windows\System\vHDyflv.exe
  2⤵
  PID:10344
- C:\Windows\System\hgMNtyj.exe
  C:\Windows\System\hgMNtyj.exe
  2⤵
  PID:10368
- C:\Windows\System\JhdgsBG.exe
  C:\Windows\System\JhdgsBG.exe
  2⤵
  PID:10472
- C:\Windows\System\AekjKzh.exe
  C:\Windows\System\AekjKzh.exe
  2⤵
  PID:10508
- C:\Windows\System\cFUHUWh.exe
  C:\Windows\System\cFUHUWh.exe
  2⤵
  PID:10588
- C:\Windows\System\gSSXfaA.exe
  C:\Windows\System\gSSXfaA.exe
  2⤵
  PID:10620
- C:\Windows\System\AcJtwBA.exe
  C:\Windows\System\AcJtwBA.exe
  2⤵
  PID:10636
- C:\Windows\System\IlYGyHh.exe
  C:\Windows\System\IlYGyHh.exe
  2⤵
  PID:10660
- C:\Windows\System\VdNxEDY.exe
  C:\Windows\System\VdNxEDY.exe
  2⤵
  PID:10676
- C:\Windows\System\zMLjfZu.exe
  C:\Windows\System\zMLjfZu.exe
  2⤵
  PID:10736
- C:\Windows\System\MGMzzWk.exe
  C:\Windows\System\MGMzzWk.exe
  2⤵
  PID:10768
- C:\Windows\System\JyRHaEO.exe
  C:\Windows\System\JyRHaEO.exe
  2⤵
  PID:10784
- C:\Windows\System\bqdBqhp.exe
  C:\Windows\System\bqdBqhp.exe
  2⤵
  PID:10828
- C:\Windows\System\mIZHhsC.exe
  C:\Windows\System\mIZHhsC.exe
  2⤵
  PID:10848
- C:\Windows\System\GpqQohf.exe
  C:\Windows\System\GpqQohf.exe
  2⤵
  PID:10868
- C:\Windows\System\HjGJeZP.exe
  C:\Windows\System\HjGJeZP.exe
  2⤵
  PID:10896
- C:\Windows\System\roPzoFD.exe
  C:\Windows\System\roPzoFD.exe
  2⤵
  PID:10916
- C:\Windows\System\ZbQepEa.exe
  C:\Windows\System\ZbQepEa.exe
  2⤵
  PID:10936
- C:\Windows\System\KmaBaKF.exe
  C:\Windows\System\KmaBaKF.exe
  2⤵
  PID:10964
- C:\Windows\System\pSxUeYm.exe
  C:\Windows\System\pSxUeYm.exe
  2⤵
  PID:11020
- C:\Windows\System\bxMjCAr.exe
  C:\Windows\System\bxMjCAr.exe
  2⤵
  PID:11040
- C:\Windows\System\bNHVPxg.exe
  C:\Windows\System\bNHVPxg.exe
  2⤵
  PID:11056
- C:\Windows\System\bGAlnkH.exe
  C:\Windows\System\bGAlnkH.exe
  2⤵
  PID:11092
- C:\Windows\System\qtTFLWs.exe
  C:\Windows\System\qtTFLWs.exe
  2⤵
  PID:11132
- C:\Windows\System\DVxRvPC.exe
  C:\Windows\System\DVxRvPC.exe
  2⤵
  PID:11152
- C:\Windows\System\tVjHSTR.exe
  C:\Windows\System\tVjHSTR.exe
  2⤵
  PID:11180
- C:\Windows\System\cvkffDB.exe
  C:\Windows\System\cvkffDB.exe
  2⤵
  PID:11228
- C:\Windows\System\OhBTCIU.exe
  C:\Windows\System\OhBTCIU.exe
  2⤵
  PID:11260
- C:\Windows\System\CZQLpZI.exe
  C:\Windows\System\CZQLpZI.exe
  2⤵
  PID:10252
- C:\Windows\System\rxrfiGV.exe
  C:\Windows\System\rxrfiGV.exe
  2⤵
  PID:9596
- C:\Windows\System\vHADiPK.exe
  C:\Windows\System\vHADiPK.exe
  2⤵
  PID:10308
- C:\Windows\System\iqkxIRU.exe
  C:\Windows\System\iqkxIRU.exe
  2⤵
  PID:10332
- C:\Windows\System\yEYrqDP.exe
  C:\Windows\System\yEYrqDP.exe
  2⤵
  PID:10444
- C:\Windows\System\CEJXBRE.exe
  C:\Windows\System\CEJXBRE.exe
  2⤵
  PID:10480
- C:\Windows\System\ZRRkruI.exe
  C:\Windows\System\ZRRkruI.exe
  2⤵
  PID:10360
- C:\Windows\System\UkRupRo.exe
  C:\Windows\System\UkRupRo.exe
  2⤵
  PID:10388
- C:\Windows\System\ZDMwpsi.exe
  C:\Windows\System\ZDMwpsi.exe
  2⤵
  PID:10496
- C:\Windows\System\HitGyFq.exe
  C:\Windows\System\HitGyFq.exe
  2⤵
  PID:10540
- C:\Windows\System\lOofVIm.exe
  C:\Windows\System\lOofVIm.exe
  2⤵
  PID:10580
- C:\Windows\System\QFKDamT.exe
  C:\Windows\System\QFKDamT.exe
  2⤵
  PID:10632
- C:\Windows\System\hytrLDf.exe
  C:\Windows\System\hytrLDf.exe
  2⤵
  PID:10672
- C:\Windows\System\SbPgvEQ.exe
  C:\Windows\System\SbPgvEQ.exe
  2⤵
  PID:10760
- C:\Windows\System\sRXoXdM.exe
  C:\Windows\System\sRXoXdM.exe
  2⤵
  PID:10888
- C:\Windows\System\RuGSFml.exe
  C:\Windows\System\RuGSFml.exe
  2⤵
  PID:10972
- C:\Windows\System\QibcDsq.exe
  C:\Windows\System\QibcDsq.exe
  2⤵
  PID:11008
- C:\Windows\System\aplYYuF.exe
  C:\Windows\System\aplYYuF.exe
  2⤵
  PID:11080
- C:\Windows\System\DReXoGe.exe
  C:\Windows\System\DReXoGe.exe
  2⤵
  PID:11176
- C:\Windows\System\NqiINQV.exe
  C:\Windows\System\NqiINQV.exe
  2⤵
  PID:11240
- C:\Windows\System\EiRhDfR.exe
  C:\Windows\System\EiRhDfR.exe
  2⤵
  PID:10124
- C:\Windows\System\YHLYefG.exe
  C:\Windows\System\YHLYefG.exe
  2⤵
  PID:10352
- C:\Windows\System\aFgrjAa.exe
  C:\Windows\System\aFgrjAa.exe
  2⤵
  PID:10364
- C:\Windows\System\zCZnWXY.exe
  C:\Windows\System\zCZnWXY.exe
  2⤵
  PID:10536
- C:\Windows\System\mxMAihN.exe
  C:\Windows\System\mxMAihN.exe
  2⤵
  PID:10424
- C:\Windows\System\CwwItOI.exe
  C:\Windows\System\CwwItOI.exe
  2⤵
  PID:10924
- C:\Windows\System\ozMbjEb.exe
  C:\Windows\System\ozMbjEb.exe
  2⤵
  PID:10864
- C:\Windows\System\giImnmj.exe
  C:\Windows\System\giImnmj.exe
  2⤵
  PID:11048
- C:\Windows\System\ZsLSDYq.exe
  C:\Windows\System\ZsLSDYq.exe
  2⤵
  PID:11108
- C:\Windows\System\wwpecgv.exe
  C:\Windows\System\wwpecgv.exe
  2⤵
  PID:10460
- C:\Windows\System\lGBMMFk.exe
  C:\Windows\System\lGBMMFk.exe
  2⤵
  PID:10404
- C:\Windows\System\wqJTidP.exe
  C:\Windows\System\wqJTidP.exe
  2⤵
  PID:10608
- C:\Windows\System\SbFHJYB.exe
  C:\Windows\System\SbFHJYB.exe
  2⤵
  PID:11124
- C:\Windows\System\SPbtLut.exe
  C:\Windows\System\SPbtLut.exe
  2⤵
  PID:10548
- C:\Windows\System\pvvuiCY.exe
  C:\Windows\System\pvvuiCY.exe
  2⤵
  PID:11284
- C:\Windows\System\SKOLZuy.exe
  C:\Windows\System\SKOLZuy.exe
  2⤵
  PID:11304
- C:\Windows\System\xHdLzQm.exe
  C:\Windows\System\xHdLzQm.exe
  2⤵
  PID:11344
- C:\Windows\System\ZKyBpUT.exe
  C:\Windows\System\ZKyBpUT.exe
  2⤵
  PID:11372
- C:\Windows\System\CrgDlVn.exe
  C:\Windows\System\CrgDlVn.exe
  2⤵
  PID:11392
- C:\Windows\System\qmjfSJV.exe
  C:\Windows\System\qmjfSJV.exe
  2⤵
  PID:11444
- C:\Windows\System\KBJSXmq.exe
  C:\Windows\System\KBJSXmq.exe
  2⤵
  PID:11460
- C:\Windows\System\USoqsla.exe
  C:\Windows\System\USoqsla.exe
  2⤵
  PID:11492
- C:\Windows\System\FpBAMJT.exe
  C:\Windows\System\FpBAMJT.exe
  2⤵
  PID:11516
- C:\Windows\System\dfTTWxv.exe
  C:\Windows\System\dfTTWxv.exe
  2⤵
  PID:11536
- C:\Windows\System\FOjqIuE.exe
  C:\Windows\System\FOjqIuE.exe
  2⤵
  PID:11580
- C:\Windows\System\ljsqsna.exe
  C:\Windows\System\ljsqsna.exe
  2⤵
  PID:11612
- C:\Windows\System\XZlLQwZ.exe
  C:\Windows\System\XZlLQwZ.exe
  2⤵
  PID:11636
- C:\Windows\System\jrjuNBD.exe
  C:\Windows\System\jrjuNBD.exe
  2⤵
  PID:11660
- C:\Windows\System\RXXujAs.exe
  C:\Windows\System\RXXujAs.exe
  2⤵
  PID:11692
- C:\Windows\System\tIWvgtA.exe
  C:\Windows\System\tIWvgtA.exe
  2⤵
  PID:11708
- C:\Windows\System\lGvxYus.exe
  C:\Windows\System\lGvxYus.exe
  2⤵
  PID:11732
- C:\Windows\System\aOgdPfh.exe
  C:\Windows\System\aOgdPfh.exe
  2⤵
  PID:11752
- C:\Windows\System\ZHbUmwK.exe
  C:\Windows\System\ZHbUmwK.exe
  2⤵
  PID:11780
- C:\Windows\System\PUXPJzq.exe
  C:\Windows\System\PUXPJzq.exe
  2⤵
  PID:11804
- C:\Windows\System\UxHSpzn.exe
  C:\Windows\System\UxHSpzn.exe
  2⤵
  PID:11828
- C:\Windows\System\UewpVfQ.exe
  C:\Windows\System\UewpVfQ.exe
  2⤵
  PID:11860
- C:\Windows\System\ROvQuol.exe
  C:\Windows\System\ROvQuol.exe
  2⤵
  PID:11880
- C:\Windows\System\dKeWQBN.exe
  C:\Windows\System\dKeWQBN.exe
  2⤵
  PID:11948
- C:\Windows\System\XVAinxh.exe
  C:\Windows\System\XVAinxh.exe
  2⤵
  PID:11968
- C:\Windows\System\LvDQNFm.exe
  C:\Windows\System\LvDQNFm.exe
  2⤵
  PID:11992
- C:\Windows\System\YSPyfSs.exe
  C:\Windows\System\YSPyfSs.exe
  2⤵
  PID:12012
- C:\Windows\System\vpqzVza.exe
  C:\Windows\System\vpqzVza.exe
  2⤵
  PID:12032
- C:\Windows\System\tROEyiu.exe
  C:\Windows\System\tROEyiu.exe
  2⤵
  PID:12092
- C:\Windows\System\QZiuzVO.exe
  C:\Windows\System\QZiuzVO.exe
  2⤵
  PID:12108
- C:\Windows\System\QolnCSA.exe
  C:\Windows\System\QolnCSA.exe
  2⤵
  PID:12136
- C:\Windows\System\VHVnTBC.exe
  C:\Windows\System\VHVnTBC.exe
  2⤵
  PID:12160
- C:\Windows\System\HpsiulY.exe
  C:\Windows\System\HpsiulY.exe
  2⤵
  PID:12208
- C:\Windows\System\gEXBzHW.exe
  C:\Windows\System\gEXBzHW.exe
  2⤵
  PID:12232
- C:\Windows\System\zwZudcN.exe
  C:\Windows\System\zwZudcN.exe
  2⤵
  PID:12252
- C:\Windows\System\WfTTpWF.exe
  C:\Windows\System\WfTTpWF.exe
  2⤵
  PID:12272
- C:\Windows\System\QKmkDOY.exe
  C:\Windows\System\QKmkDOY.exe
  2⤵
  PID:11296
- C:\Windows\System\Gipmffq.exe
  C:\Windows\System\Gipmffq.exe
  2⤵
  PID:11356
- C:\Windows\System\NOzVGcy.exe
  C:\Windows\System\NOzVGcy.exe
  2⤵
  PID:11388
- C:\Windows\System\SXHjaNk.exe
  C:\Windows\System\SXHjaNk.exe
  2⤵
  PID:11408
- C:\Windows\System\lzzIxkA.exe
  C:\Windows\System\lzzIxkA.exe
  2⤵
  PID:11488
- C:\Windows\System\vWCWRxj.exe
  C:\Windows\System\vWCWRxj.exe
  2⤵
  PID:11552
- C:\Windows\System\pVsAMVV.exe
  C:\Windows\System\pVsAMVV.exe
  2⤵
  PID:11568
- C:\Windows\System\uSicyjI.exe
  C:\Windows\System\uSicyjI.exe
  2⤵
  PID:11704
- C:\Windows\System\ydYzplm.exe
  C:\Windows\System\ydYzplm.exe
  2⤵
  PID:11788
- C:\Windows\System\yvfAkZG.exe
  C:\Windows\System\yvfAkZG.exe
  2⤵
  PID:11916
- C:\Windows\System\ZQdNhpy.exe
  C:\Windows\System\ZQdNhpy.exe
  2⤵
  PID:11960
- C:\Windows\System\yLLVBqV.exe
  C:\Windows\System\yLLVBqV.exe
  2⤵
  PID:12044
- C:\Windows\System\CQAJSHA.exe
  C:\Windows\System\CQAJSHA.exe
  2⤵
  PID:12084
- C:\Windows\System\gmsTTUY.exe
  C:\Windows\System\gmsTTUY.exe
  2⤵
  PID:12148
- C:\Windows\System\BxBEhXh.exe
  C:\Windows\System\BxBEhXh.exe
  2⤵
  PID:12200
- C:\Windows\System\eCCwnMz.exe
  C:\Windows\System\eCCwnMz.exe
  2⤵
  PID:12260
- C:\Windows\System\EnTdcJE.exe
  C:\Windows\System\EnTdcJE.exe
  2⤵
  PID:11280
- C:\Windows\System\CdpdDSJ.exe
  C:\Windows\System\CdpdDSJ.exe
  2⤵
  PID:11416
- C:\Windows\System\Klpvpqy.exe
  C:\Windows\System\Klpvpqy.exe
  2⤵
  PID:11456
- C:\Windows\System\MCKPOcC.exe
  C:\Windows\System\MCKPOcC.exe
  2⤵
  PID:11856
- C:\Windows\System\HaYPTfM.exe
  C:\Windows\System\HaYPTfM.exe
  2⤵
  PID:12060
- C:\Windows\System\WkjfAhM.exe
  C:\Windows\System\WkjfAhM.exe
  2⤵
  PID:10576
- C:\Windows\System\aMeZQLZ.exe
  C:\Windows\System\aMeZQLZ.exe
  2⤵
  PID:8216
- C:\Windows\System\zjWMSQf.exe
  C:\Windows\System\zjWMSQf.exe
  2⤵
  PID:11772
- C:\Windows\System\yOjMDeq.exe
  C:\Windows\System\yOjMDeq.exe
  2⤵
  PID:12008
- C:\Windows\System\EOdtnPM.exe
  C:\Windows\System\EOdtnPM.exe
  2⤵
  PID:12216
- C:\Windows\System\AHOPyjL.exe
  C:\Windows\System\AHOPyjL.exe
  2⤵
  PID:12292
- C:\Windows\System\ZHihxEM.exe
  C:\Windows\System\ZHihxEM.exe
  2⤵
  PID:12320
- C:\Windows\System\CScOkrp.exe
  C:\Windows\System\CScOkrp.exe
  2⤵
  PID:12356
- C:\Windows\System\seRTczE.exe
  C:\Windows\System\seRTczE.exe
  2⤵
  PID:12392
- C:\Windows\System\pzqQOuN.exe
  C:\Windows\System\pzqQOuN.exe
  2⤵
  PID:12416
- C:\Windows\System\AKUgKrB.exe
  C:\Windows\System\AKUgKrB.exe
  2⤵
  PID:12432
- C:\Windows\System\vfPFbBL.exe
  C:\Windows\System\vfPFbBL.exe
  2⤵
  PID:12452
- C:\Windows\System\BzAcEvt.exe
  C:\Windows\System\BzAcEvt.exe
  2⤵
  PID:12492
- C:\Windows\System\bzKtWmJ.exe
  C:\Windows\System\bzKtWmJ.exe
  2⤵
  PID:12520
- C:\Windows\System\yLJhcDZ.exe
  C:\Windows\System\yLJhcDZ.exe
  2⤵
  PID:12540
- C:\Windows\System\IsiUfvV.exe
  C:\Windows\System\IsiUfvV.exe
  2⤵
  PID:12560
- C:\Windows\System\dvZkPfu.exe
  C:\Windows\System\dvZkPfu.exe
  2⤵
  PID:12580
- C:\Windows\System\dPzIzgY.exe
  C:\Windows\System\dPzIzgY.exe
  2⤵
  PID:12600
- C:\Windows\System\iFpHqqh.exe
  C:\Windows\System\iFpHqqh.exe
  2⤵
  PID:12620
- C:\Windows\System\VqmSTvA.exe
  C:\Windows\System\VqmSTvA.exe
  2⤵
  PID:12680
- C:\Windows\System\CgLDDJj.exe
  C:\Windows\System\CgLDDJj.exe
  2⤵
  PID:12712
- C:\Windows\System\aKxnBUx.exe
  C:\Windows\System\aKxnBUx.exe
  2⤵
  PID:12748
- C:\Windows\System\qUcBmEd.exe
  C:\Windows\System\qUcBmEd.exe
  2⤵
  PID:12768
- C:\Windows\System\GAlkEqk.exe
  C:\Windows\System\GAlkEqk.exe
  2⤵
  PID:12800
- C:\Windows\System\RweARGQ.exe
  C:\Windows\System\RweARGQ.exe
  2⤵
  PID:12824
- C:\Windows\System\xSyioqK.exe
  C:\Windows\System\xSyioqK.exe
  2⤵
  PID:12864
- C:\Windows\System\pQKEEyw.exe
  C:\Windows\System\pQKEEyw.exe
  2⤵
  PID:12884
- C:\Windows\System\IajidQk.exe
  C:\Windows\System\IajidQk.exe
  2⤵
  PID:12912
- C:\Windows\System\crpoAli.exe
  C:\Windows\System\crpoAli.exe
  2⤵
  PID:12936
- C:\Windows\System\rlqpYmh.exe
  C:\Windows\System\rlqpYmh.exe
  2⤵
  PID:12968
- C:\Windows\System\JoroNNC.exe
  C:\Windows\System\JoroNNC.exe
  2⤵
  PID:12992
- C:\Windows\System\UgHxbRu.exe
  C:\Windows\System\UgHxbRu.exe
  2⤵
  PID:13012
- C:\Windows\System\IQMnUhN.exe
  C:\Windows\System\IQMnUhN.exe
  2⤵
  PID:13036
- C:\Windows\System\qHmpOJi.exe
  C:\Windows\System\qHmpOJi.exe
  2⤵
  PID:13060
- C:\Windows\System\AwhHOrt.exe
  C:\Windows\System\AwhHOrt.exe
  2⤵
  PID:13104
- C:\Windows\System\CRsIdVl.exe
  C:\Windows\System\CRsIdVl.exe
  2⤵
  PID:13120
- C:\Windows\System\PVlfsMv.exe
  C:\Windows\System\PVlfsMv.exe
  2⤵
  PID:13176
- C:\Windows\System\aRiTjQD.exe
  C:\Windows\System\aRiTjQD.exe
  2⤵
  PID:13204
- C:\Windows\System\FKBEDPo.exe
  C:\Windows\System\FKBEDPo.exe
  2⤵
  PID:13220
- C:\Windows\System\ZPOyBtO.exe
  C:\Windows\System\ZPOyBtO.exe
  2⤵
  PID:13248
- C:\Windows\System\WuChSKJ.exe
  C:\Windows\System\WuChSKJ.exe
  2⤵
  PID:13276
- C:\Windows\System\Bsomkbw.exe
  C:\Windows\System\Bsomkbw.exe
  2⤵
  PID:13308
- C:\Windows\System\AlVSPos.exe
  C:\Windows\System\AlVSPos.exe
  2⤵
  PID:12304
- C:\Windows\System\GOnsLOj.exe
  C:\Windows\System\GOnsLOj.exe
  2⤵
  PID:12340
- C:\Windows\System\CpIZTIU.exe
  C:\Windows\System\CpIZTIU.exe
  2⤵
  PID:12412
- C:\Windows\System\UUaGsVs.exe
  C:\Windows\System\UUaGsVs.exe
  2⤵
  PID:12508
- C:\Windows\System\CQuCKEj.exe
  C:\Windows\System\CQuCKEj.exe
  2⤵
  PID:12536
- C:\Windows\System\mqAMvDL.exe
  C:\Windows\System\mqAMvDL.exe
  2⤵
  PID:12572
- C:\Windows\System\lmDBQoC.exe
  C:\Windows\System\lmDBQoC.exe
  2⤵
  PID:12704
- C:\Windows\System\CYJrpGL.exe
  C:\Windows\System\CYJrpGL.exe
  2⤵
  PID:12760
- C:\Windows\System\kIVcHKa.exe
  C:\Windows\System\kIVcHKa.exe
  2⤵
  PID:12796
- C:\Windows\System\fwRnUHK.exe
  C:\Windows\System\fwRnUHK.exe
  2⤵
  PID:12856
- C:\Windows\System\nArrpOa.exe
  C:\Windows\System\nArrpOa.exe
  2⤵
  PID:12948
- C:\Windows\System\GBjSgvt.exe
  C:\Windows\System\GBjSgvt.exe
  2⤵
  PID:13000
- C:\Windows\System\fyqsgwh.exe
  C:\Windows\System\fyqsgwh.exe
  2⤵
  PID:13028
- C:\Windows\System\vpvtDSH.exe
  C:\Windows\System\vpvtDSH.exe
  2⤵
  PID:13096
- C:\Windows\System\KGKGKdt.exe
  C:\Windows\System\KGKGKdt.exe
  2⤵
  PID:13228
- C:\Windows\System\Hkjajqh.exe
  C:\Windows\System\Hkjajqh.exe
  2⤵
  PID:13268
- C:\Windows\System\gjRBuhy.exe
  C:\Windows\System\gjRBuhy.exe
  2⤵
  PID:12128
- C:\Windows\System\KEFfLXL.exe
  C:\Windows\System\KEFfLXL.exe
  2⤵
  PID:12424
- C:\Windows\System\Dojxjfl.exe
  C:\Windows\System\Dojxjfl.exe
  2⤵
  PID:12484
- C:\Windows\System\kbqaCEV.exe
  C:\Windows\System\kbqaCEV.exe
  2⤵
  PID:12612
- C:\Windows\System\CJWUSsb.exe
  C:\Windows\System\CJWUSsb.exe
  2⤵
  PID:2380
- C:\Windows\System\imdpHse.exe
  C:\Windows\System\imdpHse.exe
  2⤵
  PID:516
- C:\Windows\System\UMWvWpn.exe
  C:\Windows\System\UMWvWpn.exe
  2⤵
  PID:13068
- C:\Windows\System\sMjpAwB.exe
  C:\Windows\System\sMjpAwB.exe
  2⤵
  PID:13144
- C:\Windows\System\qlvRxAV.exe
  C:\Windows\System\qlvRxAV.exe
  2⤵
  PID:13240
- C:\Windows\System\bcZoozy.exe
  C:\Windows\System\bcZoozy.exe
  2⤵
  PID:12588
- C:\Windows\System\qWrpPoO.exe
  C:\Windows\System\qWrpPoO.exe
  2⤵
  PID:13316
- C:\Windows\System\OdviQgi.exe
  C:\Windows\System\OdviQgi.exe
  2⤵
  PID:13332
- C:\Windows\System\VkfLfKA.exe
  C:\Windows\System\VkfLfKA.exe
  2⤵
  PID:13352
- C:\Windows\System\IPnjNrN.exe
  C:\Windows\System\IPnjNrN.exe
  2⤵
  PID:13372
- C:\Windows\System\tgkLwYg.exe
  C:\Windows\System\tgkLwYg.exe
  2⤵
  PID:13408
- C:\Windows\System\JLcQwfr.exe
  C:\Windows\System\JLcQwfr.exe
  2⤵
  PID:13440
- C:\Windows\System\qRqgYjK.exe
  C:\Windows\System\qRqgYjK.exe
  2⤵
  PID:13468
- C:\Windows\System\yrGWfyJ.exe
  C:\Windows\System\yrGWfyJ.exe
  2⤵
  PID:13488
- C:\Windows\System\hQMsSKC.exe
  C:\Windows\System\hQMsSKC.exe
  2⤵
  PID:13512
- C:\Windows\System\sgHwCjj.exe
  C:\Windows\System\sgHwCjj.exe
  2⤵
  PID:13528
- C:\Windows\System\oxrzrjv.exe
  C:\Windows\System\oxrzrjv.exe
  2⤵
  PID:13544
- C:\Windows\System\IuXjBro.exe
  C:\Windows\System\IuXjBro.exe
  2⤵
  PID:13576
- C:\Windows\System\NecshjH.exe
  C:\Windows\System\NecshjH.exe
  2⤵
  PID:13596
- C:\Windows\System\PtSzRgQ.exe
  C:\Windows\System\PtSzRgQ.exe
  2⤵
  PID:13616
- C:\Windows\System\GSqxFSm.exe
  C:\Windows\System\GSqxFSm.exe
  2⤵
  PID:13652
- C:\Windows\System\VmHhDXR.exe
  C:\Windows\System\VmHhDXR.exe
  2⤵
  PID:13708
- C:\Windows\System\NpiNYvD.exe
  C:\Windows\System\NpiNYvD.exe
  2⤵
  PID:13748
- C:\Windows\System\yUXflUR.exe
  C:\Windows\System\yUXflUR.exe
  2⤵
  PID:13772
- C:\Windows\System\LRtBnKT.exe
  C:\Windows\System\LRtBnKT.exe
  2⤵
  PID:13792
- C:\Windows\System\bzGxjJZ.exe
  C:\Windows\System\bzGxjJZ.exe
  2⤵
  PID:13812
- C:\Windows\System\XkUGBVC.exe
  C:\Windows\System\XkUGBVC.exe
  2⤵
  PID:13852
- C:\Windows\System\KaLuVSS.exe
  C:\Windows\System\KaLuVSS.exe
  2⤵
  PID:13896
- C:\Windows\System\CzZkbyk.exe
  C:\Windows\System\CzZkbyk.exe
  2⤵
  PID:13920
- C:\Windows\System\cOwxPaS.exe
  C:\Windows\System\cOwxPaS.exe
  2⤵
  PID:13948
- C:\Windows\System\CVXttlc.exe
  C:\Windows\System\CVXttlc.exe
  2⤵
  PID:13964
- C:\Windows\System\vrqmvcK.exe
  C:\Windows\System\vrqmvcK.exe
  2⤵
  PID:13992
- C:\Windows\System\abbABPw.exe
  C:\Windows\System\abbABPw.exe
  2⤵
  PID:14044
- C:\Windows\System\OkHeiHk.exe
  C:\Windows\System\OkHeiHk.exe
  2⤵
  PID:14064
- C:\Windows\System\fwBlVOj.exe
  C:\Windows\System\fwBlVOj.exe
  2⤵
  PID:14112
- C:\Windows\System\YRUOPVQ.exe
  C:\Windows\System\YRUOPVQ.exe
  2⤵
  PID:14132
- C:\Windows\System\YZhSTfr.exe
  C:\Windows\System\YZhSTfr.exe
  2⤵
  PID:14156
- C:\Windows\System\hVmQCZa.exe
  C:\Windows\System\hVmQCZa.exe
  2⤵
  PID:14176
- C:\Windows\System\gCWyUCB.exe
  C:\Windows\System\gCWyUCB.exe
  2⤵
  PID:14204
- C:\Windows\System\rhDiqbM.exe
  C:\Windows\System\rhDiqbM.exe
  2⤵
  PID:14228
- C:\Windows\System\etQXegq.exe
  C:\Windows\System\etQXegq.exe
  2⤵
  PID:14268
- C:\Windows\System\XWqMzhR.exe
  C:\Windows\System\XWqMzhR.exe
  2⤵
  PID:14292
- C:\Windows\System\iSSNfJi.exe
  C:\Windows\System\iSSNfJi.exe
  2⤵
  PID:14312
- C:\Windows\System\YJxdtBX.exe
  C:\Windows\System\YJxdtBX.exe
  2⤵
  PID:12408
- C:\Windows\System\itvpBWu.exe
  C:\Windows\System\itvpBWu.exe
  2⤵
  PID:13024
- C:\Windows\System\wRQwlQM.exe
  C:\Windows\System\wRQwlQM.exe
  2⤵
  PID:1164
- C:\Windows\System\bxIxSHq.exe
  C:\Windows\System\bxIxSHq.exe
  2⤵
  PID:13324
- C:\Windows\System\KQmiLCl.exe
  C:\Windows\System\KQmiLCl.exe
  2⤵
  PID:13448
- C:\Windows\System\sukywmO.exe
  C:\Windows\System\sukywmO.exe
  2⤵
  PID:13520
- C:\Windows\System\JJLtpdW.exe
  C:\Windows\System\JJLtpdW.exe
  2⤵
  PID:13536
- C:\Windows\System\qoRHRAO.exe
  C:\Windows\System\qoRHRAO.exe
  2⤵
  PID:13568
- C:\Windows\System\ENpLFRd.exe
  C:\Windows\System\ENpLFRd.exe
  2⤵
  PID:13660
- C:\Windows\System\GAJfdGe.exe
  C:\Windows\System\GAJfdGe.exe
  2⤵
  PID:13684
- C:\Windows\System\QhLpQxl.exe
  C:\Windows\System\QhLpQxl.exe
  2⤵
  PID:13736
- C:\Windows\System\RqIwilf.exe
  C:\Windows\System\RqIwilf.exe
  2⤵
  PID:13956
- C:\Windows\System\aIlekOd.exe
  C:\Windows\System\aIlekOd.exe
  2⤵
  PID:13960
- C:\Windows\System\dpscnBx.exe
  C:\Windows\System\dpscnBx.exe
  2⤵
  PID:14040
- C:\Windows\System\JipnTwp.exe
  C:\Windows\System\JipnTwp.exe
  2⤵
  PID:14148
- C:\Windows\System\XvMpeKA.exe
  C:\Windows\System\XvMpeKA.exe
  2⤵
  PID:14264
- C:\Windows\System\KsfcTrl.exe
  C:\Windows\System\KsfcTrl.exe
  2⤵
  PID:14248
- C:\Windows\System\cUgRKjK.exe
  C:\Windows\System\cUgRKjK.exe
  2⤵
  PID:3940
- C:\Windows\System\IrQtTld.exe
  C:\Windows\System\IrQtTld.exe
  2⤵
  PID:13344
- C:\Windows\System\xAzSOvF.exe
  C:\Windows\System\xAzSOvF.exe
  2⤵
  PID:11812
- C:\Windows\System\KgEEPbq.exe
  C:\Windows\System\KgEEPbq.exe
  2⤵
  PID:13560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CExXjLN.exe

Filesize
1.6MB

MD5
6211e68e8d79316c9de956e1e11ce024

SHA1
61dd7a155b759af4736dcc1608b8a3b1300c3ae6

SHA256
fa9f6bc6acb6a0b4c6ee1e146c28c4ea4464b85326b9a2396161d3b85fb3343b

SHA512
c05726007b01cb2edb63171fa98c1d6bc8a49e8188e096ba260da5f7b7507bd9977085e7fe0ca5c2fcf0d35170ecf8b8c5cbdc92da9faae35017c974944b68e7

Download Submit
C:\Windows\System\GDeytcg.exe

Filesize
1.6MB

MD5
833f3633313c3df779b6240af89fbb7c

SHA1
a0c7646d71511112678bce5ec0c177bf73957196

SHA256
49fd97da9583621e7274b2fda563e2514bb878db8eb248c3156d14345b901f1b

SHA512
de8cc392fc93ef914ace21add409ce0fccd615e38a255e361a91a00b51ccbf811e428fb3ab79454bad0e0ae733a0a4095da78529bae8e164fb11dc410e04b024

Download Submit
C:\Windows\System\HkrLhfG.exe

Filesize
1.6MB

MD5
29809e6f921b0a25d2ee03d6ec6eeb4d

SHA1
a6946c19a91311e5a09e8477134b359a1ede2ec3

SHA256
039d6351239ea85f45c88abdd0ae20383e4179fef028dab52b4a1fc7fa1b67b8

SHA512
df9864eb51c8571aa68ccbf1a5b9348cc141be134ae53967830c516450bc51df2b08643ff73e4f0ce08afe61d7646b8a544feccc02a37622b819062b4bfe076e

Download Submit
C:\Windows\System\IJxJTmV.exe

Filesize
1.6MB

MD5
f79aa3a385ccfadbc4a5c404a72e73f2

SHA1
1e4947dc51c0087948769a612014b2c24ed37c0f

SHA256
a154f156ca0f08eff721745a4412047d2c7f2575b957b82dfd53aa7bbd5232dd

SHA512
9d59145448277a24688c5f147ece0d3e91bf5b8e4d00cd9e092b838710ee9dbd4c69862990740fd1e3a1f4dec0cf63bfbdc9f8caa07469e01332cc4c37fd45e6

Download Submit
C:\Windows\System\LeLsSZn.exe

Filesize
1.6MB

MD5
9dc6be2a1eb274015898b477d53bd38a

SHA1
56a8ac29038cb7e5d8bf146d4f06764b2e4d4426

SHA256
f9eeb9e8f70c3cb1c17f6f1c48f6a05284521c099a5059afd32b1d2456816edb

SHA512
708d3c04db260bda566c2f3782bfd124c692e29fab93deb5adc8ecfabeb323a9774813e502c1484cdcd2f8face870195b9f470c436aaa1c10aa39aa9244453c3

Download Submit
C:\Windows\System\NGYOFzC.exe

Filesize
1.6MB

MD5
ec1b67d9850f484890bfdda4af2dbc70

SHA1
a5b484b7b9db2a04fe3ed1a4922f4e59495e7f22

SHA256
496bf2ba4ff90c84bfdefe02ab796f5527d3bc69b389c5ec829c2fabba65a254

SHA512
e35695ecbe4654ccca1502b230d206564e2e1cad6c64fc6459c1e23f9e2ed484678efee5405431c041e26d6570cd6d022ff318d065b0ab6a08a5a15af4a849fa

Download Submit
C:\Windows\System\OPWgHol.exe

Filesize
1.6MB

MD5
cc252ec941d88ba43fdcecb317fb0ca0

SHA1
a58e5de302fef5e6d91c38b65814d4a064336c50

SHA256
17f2795f9877892c079ba7c92da7c7d14e0511def46efb3df459202be1aa2ef3

SHA512
571e1b8c97d65c2490e5fa67f9a05bbcc111c9c80a5520bcc9b449f783635163c89e8953b3d16dc3609ccc43cd8ab009fb4c523df8809370e54acddfad951ba4

Download Submit
C:\Windows\System\OxiGaIA.exe

Filesize
1.6MB

MD5
6ee8644ed27096727a12c4b36f32b715

SHA1
39da719e96d3fe400d6df3f5df69657c0ebd784d

SHA256
d5eb50529293e853c08f4f1c9da880e7680a79a35c7a6d39a709b575aaf39b14

SHA512
d602d3ec1b70e23c338faed85b5b4007fde5fc3d258b688550316fc28c8064d839aabc4de016070f735d617ff2eb0e61dda586515799b46cb894956417f8374f

Download Submit
C:\Windows\System\OxmycpO.exe

Filesize
1.6MB

MD5
fb53c0e62e42733ed5ef5e795c4a91be

SHA1
d973b57eb66b1046926a355269cc39b837b63c3c

SHA256
d27848f0292c02e651714636c88f14dbc04cd01fa27e7c4d3e53be9f3739ba33

SHA512
0783bb955bd573c5842cc6f62b864379dacdd5d44872fb9389e4e7b008fa69cb7c495e6943d287809981c6acc1b368ce132c14396acf527ea490a835bbd34a94

Download Submit
C:\Windows\System\PNGUWVv.exe

Filesize
1.6MB

MD5
f552768fb250c595f043c497e9901a63

SHA1
d9c2de7f2265ef7e710c5ce04ffe3741452e6853

SHA256
007e675cf8da7eec5a6708e9c679bb832420a1ba7751fab953a4661c5fb1a3f3

SHA512
0dd491a209b69547455a3a537f955786cbcc154cc52ca37a5916d6cd497320818c22ecdb49dbed1a1af5428cba16936682c844a3534ce30ecfba5817c8a8aea2

Download Submit
C:\Windows\System\PcaqpVp.exe

Filesize
1.6MB

MD5
f8b3057b41679fce83beef3bf759b5b9

SHA1
ecb3c8701e7272bf72dcc1f49700e0825d0f9a09

SHA256
4d50cba00c73998de3a60325c9877902a8d55ec3f97f632a96101c4656457520

SHA512
28c39984ec8154df09f17774d88676da130d47093844f892012e6d8faac53075d3e1862f6573d18d884f3dc5c2f91afdb359176561e95035f1085eda86dc9e29

Download Submit
C:\Windows\System\PwbOAiR.exe

Filesize
1.6MB

MD5
95c634548b26c8788e181a0f624a989c

SHA1
842cd33d8038f19bc54eacaa90c63ccb27abb77d

SHA256
6ba07d37877158fab1a5248c2bdd1457d500f65b3d790e1f4bce32e851213541

SHA512
6d85416b262de0d30e440d519111907f4ca1ffba2f4e9cd71d7ba69cb003ec9365b0264d645a0cb8fee62c0366f4962fba43c234ac8b27255ca27809b3ff42f0

Download Submit
C:\Windows\System\PztHkbf.exe

Filesize
1.6MB

MD5
4be9f7680ce88bcb686e3b96bd27ba32

SHA1
b59fdf1c578a147dca7b275bc550762991715fef

SHA256
d7b2b549549b59b5336512af06bc02d2d547a18b3a999c0fd0190f5125d6b2e8

SHA512
871fa51c0a2ffd5fde5baf5891d5250f2297ae37c173bdd8c73532b7d5b55a3d2422be40a4da078a874fc32ad79bf65fcf8e0568ccd8406d71db290cc6313295

Download Submit
C:\Windows\System\SHmBrMM.exe

Filesize
1.6MB

MD5
ecfe2bb10fe29bcd400728a1afffc817

SHA1
de57e7b9b96f915df65557e350029062beec4d32

SHA256
52872b33cc4dabd59f972959e0ebc5768827bd4d9397a7be514328cc9d1f36b3

SHA512
402f9524666da5f266adfd2923039b331e24ebc45cd9910f580435f755eede3c1147cfc33cedad3ac4f51b4af8f9e3661f43c26c16e61d55f9d382d00ee66b33

Download Submit
C:\Windows\System\UEAlttM.exe

Filesize
1.6MB

MD5
08616e72c1447dc52f92802b82f53365

SHA1
28814b9f6eaf873853b31fd185bf24915fd0818e

SHA256
f59b0a655d64a9831f46a302e5ff5cb9085344f99a1fe694a443a465042805a8

SHA512
f0e7d4cf048073c2cf1270e1d9832bc64b9e31300edf818c516986f588b6c77e18c88f998ff4f4b460c68a1d83468cfb26fb127e88d8766f3e36ce1852ff0f82

Download Submit
C:\Windows\System\UaBUNQl.exe

Filesize
1.6MB

MD5
156ce19b2ce4f442b0ec9c35d06fa537

SHA1
45fafc85a2175de2e210086f6ea5c8096035276c

SHA256
f94a90612725318e718648845a32a6820044c3083bf44783e085238d280b420c

SHA512
7c0b15a666032c064dcb68d020baae0ed6d625793c92c6265b3733dd3140173a8aabd28b0c1c78517fa57fc3c377284e13ba1a152e01415e93be5a9075afae5a

Download Submit
C:\Windows\System\WQIEaez.exe

Filesize
1.6MB

MD5
b9968e1a7902091fd71e52cb42630e19

SHA1
8a722a59891ac23232ec07fa5b29ef165508e517

SHA256
d30184d69845dc70b7e97786ace81f607754b907c9acd46a909eb626fe32f626

SHA512
691f6721fa20222fd2a78851239803f3955547be4f8a3ead9c12c8bbd80b0a116739861d9e6f9c752692f567543a2fe43a333bc5bb8b2d0c5ee64e5561c257d9

Download Submit
C:\Windows\System\Ydsqqjd.exe

Filesize
1.6MB

MD5
c905fe6ab9527a03d5d3736e2a5239ec

SHA1
eae0aae8e0e9f38296c21955107e5e55dda6aced

SHA256
502c7f3081aab8dd1658cb7672566caa7a83a21ff00b528a4de794c5726f83ca

SHA512
7db254e620ac38183232adbf80e318599d39bb132a6488ceaf0a3e6113d43e6bb6135910a1a6768376908bdd7430476e4d5a6f5c64ca5beabcb1796362c9ec0f

Download Submit
C:\Windows\System\bEnbhbV.exe

Filesize
1.6MB

MD5
65a306ef7069c0839aa9e3a77e4b9420

SHA1
55c5d37835dfa28f6b4e07a37e3597cbcc59c8cc

SHA256
96a4bc683d6b942acb4354db0d6b264eb3e920948d391d9ede54bd82b2648420

SHA512
c9378af4b9f3f22096660ac46f493be602d000f703cdd6540af8402b01ca9e838ace7868d813f28a330de3cf4ebcf956d9e9e645744df51251d273101caa9f07

Download Submit
C:\Windows\System\cyZBcih.exe

Filesize
1.6MB

MD5
851361e03524c48affdab079cef8bb78

SHA1
16e6c436248a957926f125b4fe3f85e56a16ee7d

SHA256
d4e0fdb639582077814e97dfe90e46d787be8737c36981fe924c5c98ed9e72b5

SHA512
6363f99cc03fedcedb4a53e7d6d4e565bf7327f8ab8d289eceaa45afa49d799440a034a387fdc71efd73d7c700975832dc2012612df3b37e2f57b9f6d2ac288a

Download Submit
C:\Windows\System\dyYpJWx.exe

Filesize
1.6MB

MD5
0d33e4a3ab125188395a4c73c7155175

SHA1
6edc746f2552d476202b64d662428e07690cbd57

SHA256
3c05e13ef60684c5fe880effbca0255a5b65a41f93a7f499d77bf81bfa91029d

SHA512
60ecdae17ae5f4655a9bd9c33cdffcd25a0bd816a8fa4f0c1c5edbd9c3f2729d4da1de6ef7b890a55b34a5567ddc81fd4d92fb093d9de8625473661fee042f34

Download Submit
C:\Windows\System\eTGAmYb.exe

Filesize
1.6MB

MD5
e85666ebd5f342a263ad2122a2ab1604

SHA1
aee8bf26bfc1186c3ade4a7aab2b7b0f4a9881a6

SHA256
6a97802be3f6917185a6db2f5fe612e32321bcf02186f172d254f5764449cc71

SHA512
351affbe9275727f92db30eb3737df202e130481140610b6230fab40533545b5e0cfd5870dadce67de9acc7b4523e1556af2fd45871ce04275513e364d6ea69b

Download Submit
C:\Windows\System\ebbebWP.exe

Filesize
1.6MB

MD5
8b3145c5312283259082a1a93fc9d084

SHA1
e66f9b91ac93d00787b8bf1e8d4ee55e46212710

SHA256
fa50f9758c7d07d14887cc10b57c5c7ec7e80e4dbb0e3b135e3750607f760420

SHA512
c8b14568de390b91f201d1fb78f79a22493896c1fabd8b845170b36f9b3d2b807ea09cd051d3b41f7f73a24c26002df6cc4f090fd5f44a71b29d6b5d1fa9989a

Download Submit
C:\Windows\System\hJttQJG.exe

Filesize
1.6MB

MD5
d5c8f5ca6d79e13c7c700a46231501c1

SHA1
d3e6834f74e75379225f5827cbdc522c17e13aaf

SHA256
a2b0cb0df330f1961f26f015e234264ab8e9ad9f9f67794b0ec125552989e14a

SHA512
b9a78bf8aacadad290f82aef63f899c14896f53009d6f500ee58cc385bfcba35802119d05d6f99a43655b76455606c739ae2dd64913aa7aea10d6fbc68cecc78

Download Submit
C:\Windows\System\jTvmYGU.exe

Filesize
1.6MB

MD5
8aee6167b0da33dfe985b0645a2e22cb

SHA1
54956ac7d32737206728a40fdf46ea091c7d59f2

SHA256
b7e986a40f12bfd47e7875184e50dd24d8791a4ee95d226926316102ec5b13ef

SHA512
7000963acd5dce4d20189472387d20eb1664d3ade3c1d28e0dcdfb0c280913e6adc0dd420a6b411900fb5572caf1e4b15247ff431a74f512e452491582e092cc

Download Submit
C:\Windows\System\lLozalW.exe

Filesize
1.6MB

MD5
1a9b065640a94f57f712ca154376af0f

SHA1
8c0b71cd86c392f93579daaea9f49a079ff6792e

SHA256
c74792c27a3f434fc13d1cc4b0c6b1bfb1066ec5872e756a38aea203a92569cd

SHA512
9179e7ab9cfc87ee21b8d96611aff5ce5151b3f3a99040974d4b4a27f4643b73096262cbbcda16ad7a4d4b9cd0e7e7364edb3bf69fc2a91d010f80fbfb0c0ac8

Download Submit
C:\Windows\System\lgsEQuw.exe

Filesize
1.6MB

MD5
24f07504b633d57aa7b218ce4d16e98f

SHA1
edb974250ef5ce8c354cfacd2cbc5e3cd75e4936

SHA256
6f452c9cbffcd0f453d5fb985c47f8b851777a0ee72210bbf48c3bf8da1a9254

SHA512
5d8bbe44cb75d222bdcfcb17cb20bdb3d922077b51fc516bce0fa62fa2194f0d471f48970bbb5ae48c6f028b586e99a0677cb5e4abd562b027d01040f2b496cb

Download Submit
C:\Windows\System\nHPbCEk.exe

Filesize
1.6MB

MD5
fb61c90106075ee2fcd6467e55c0f4a0

SHA1
1945b1d760648b58897a31e5d4343e85311c0e25

SHA256
9d698c1925b3b54db0a56d4f81acce3539743a5abd32d2fe0be216bb2e0755e8

SHA512
de2c08539e942434dacd639cdf5366f6cf9ce6ad9b9b3c6f119fbc8d39f95a9a03b43ab1561534eacedccbb1d9a1e1ecaf28eb0b5693fb0d0bbdbe9d58892eeb

Download Submit
C:\Windows\System\nWfPagq.exe

Filesize
1.6MB

MD5
efc3e0e8dd49e73f2426d55b663ae176

SHA1
cdb329bcce8ba74b427659e369d0ec616e75f05c

SHA256
836238fd2ec9da602e6a5cc1bdb19688861d38ebda3ef8e47e7170ef9ee5da50

SHA512
5e1c4bd1658aa98a1604c98d60253a23087e717a21045e5b71b10632b34036d3be0e7f87ba568b80950b1b2ed9d7ba88da6b6eb481c1eda895db2b0344076ce2

Download Submit
C:\Windows\System\pOytzQP.exe

Filesize
1.6MB

MD5
694e5e81cce585a0ce089ee80aea8a3b

SHA1
a52fa235cdd8a2269c72d13d638bd6e8f09d5922

SHA256
7ff94e8c68211c9d0db5fe21a358a43796c39f24dd3f4f2a9b175fe3a4dccb0a

SHA512
87a2d0160131ffe9850bd84939485d52ff4995e9b8d0ae286a568b0746a04e664a635892b2eed4bb26b2b62d079796bb853560445045d2d962cd1cb8a43cd743

Download Submit
C:\Windows\System\pQAROrd.exe

Filesize
1.6MB

MD5
0f6b65125730d2678c9cfcc333a54857

SHA1
51516430096873a1a541be3e1b74dc96f28b7baa

SHA256
3cecf6c7928c90505f1444234061bd50065dcfe4026c9614a94b800015bea8d9

SHA512
e67f38ec03c517add836d3e83508cdd0356ed2cf627650d9bf78354a6d57f1db350dee5c26d60a243b37856bdfbef35ec2c53490320115e624fb1de6baee7a43

Download Submit
C:\Windows\System\rVqDcnD.exe

Filesize
1.6MB

MD5
2dc1210ea28a9ecd5b9e181c25c8c2e1

SHA1
58654cddab094305bfdb8867a47de851d1a15b8f

SHA256
39cb5899a239b5ff0bd9be52276e04ff7f4c478b6f82bc5800268376449ce522

SHA512
5fa672544f503fc2c6e03241a86466f42269954b876f3b86c8d026814daed000a8e2008035f5d827191158ee8db2858f3ea62d242264eaa748aa8b301d0dbdb9

Download Submit
C:\Windows\System\wtcNyCl.exe

Filesize
1.6MB

MD5
9cc45f3c483c8b1b4216f5048c7d6dcf

SHA1
28d9ab38ae80eec76155f8489b26af6de1659220

SHA256
fcf3953ea3c47a15d0a5bb85d577551271b98ec8a8f04db952b0369d86885ce4

SHA512
a17b542c8aad41fcd5a8979ccd7cccd8707c57d2d531978cb5d6088a5926458d2a9027e2619e1c354b8b3447a55eee9cd0e171a737b6bae6ca7ce50fbfa7be50

Download Submit
memory/376-597-0x00007FF76F470000-0x00007FF76F7C1000-memory.dmp

Filesize
3.3MB

Download
memory/376-2319-0x00007FF76F470000-0x00007FF76F7C1000-memory.dmp

Filesize
3.3MB

Download
memory/692-2239-0x00007FF6283A0000-0x00007FF6286F1000-memory.dmp

Filesize
3.3MB

Download
memory/692-2224-0x00007FF6283A0000-0x00007FF6286F1000-memory.dmp

Filesize
3.3MB

Download
memory/692-32-0x00007FF6283A0000-0x00007FF6286F1000-memory.dmp

Filesize
3.3MB

Download
memory/812-603-0x00007FF60D810000-0x00007FF60DB61000-memory.dmp

Filesize
3.3MB

Download
memory/812-2312-0x00007FF60D810000-0x00007FF60DB61000-memory.dmp

Filesize
3.3MB

Download
memory/856-2237-0x00007FF6E4D60000-0x00007FF6E50B1000-memory.dmp

Filesize
3.3MB

Download
memory/856-30-0x00007FF6E4D60000-0x00007FF6E50B1000-memory.dmp

Filesize
3.3MB

Download
memory/856-2223-0x00007FF6E4D60000-0x00007FF6E50B1000-memory.dmp

Filesize
3.3MB

Download
memory/1016-2293-0x00007FF6063E0000-0x00007FF606731000-memory.dmp

Filesize
3.3MB

Download
memory/1016-523-0x00007FF6063E0000-0x00007FF606731000-memory.dmp

Filesize
3.3MB

Download
memory/1072-52-0x00007FF68C630000-0x00007FF68C981000-memory.dmp

Filesize
3.3MB

Download
memory/1072-2243-0x00007FF68C630000-0x00007FF68C981000-memory.dmp

Filesize
3.3MB

Download
memory/1124-604-0x00007FF6C4F90000-0x00007FF6C52E1000-memory.dmp

Filesize
3.3MB

Download
memory/1124-2313-0x00007FF6C4F90000-0x00007FF6C52E1000-memory.dmp

Filesize
3.3MB

Download
memory/1300-2308-0x00007FF7C8F00000-0x00007FF7C9251000-memory.dmp

Filesize
3.3MB

Download
memory/1300-586-0x00007FF7C8F00000-0x00007FF7C9251000-memory.dmp

Filesize
3.3MB

Download
memory/1340-563-0x00007FF6BB740000-0x00007FF6BBA91000-memory.dmp

Filesize
3.3MB

Download
memory/1340-2301-0x00007FF6BB740000-0x00007FF6BBA91000-memory.dmp

Filesize
3.3MB

Download
memory/1520-2231-0x00007FF68E3F0000-0x00007FF68E741000-memory.dmp

Filesize
3.3MB

Download
memory/1520-16-0x00007FF68E3F0000-0x00007FF68E741000-memory.dmp

Filesize
3.3MB

Download
memory/1660-2310-0x00007FF791D60000-0x00007FF7920B1000-memory.dmp

Filesize
3.3MB

Download
memory/1660-610-0x00007FF791D60000-0x00007FF7920B1000-memory.dmp

Filesize
3.3MB

Download
memory/1816-2227-0x00007FF602B40000-0x00007FF602E91000-memory.dmp

Filesize
3.3MB

Download
memory/1816-54-0x00007FF602B40000-0x00007FF602E91000-memory.dmp

Filesize
3.3MB

Download
memory/1816-2247-0x00007FF602B40000-0x00007FF602E91000-memory.dmp

Filesize
3.3MB

Download
memory/2036-2316-0x00007FF6DB070000-0x00007FF6DB3C1000-memory.dmp

Filesize
3.3MB

Download
memory/2036-611-0x00007FF6DB070000-0x00007FF6DB3C1000-memory.dmp

Filesize
3.3MB

Download
memory/2264-2285-0x00007FF6A05E0000-0x00007FF6A0931000-memory.dmp

Filesize
3.3MB

Download
memory/2264-506-0x00007FF6A05E0000-0x00007FF6A0931000-memory.dmp

Filesize
3.3MB

Download
memory/2316-2235-0x00007FF6E3CE0000-0x00007FF6E4031000-memory.dmp

Filesize
3.3MB

Download
memory/2316-2201-0x00007FF6E3CE0000-0x00007FF6E4031000-memory.dmp

Filesize
3.3MB

Download
memory/2316-17-0x00007FF6E3CE0000-0x00007FF6E4031000-memory.dmp

Filesize
3.3MB

Download
memory/2836-547-0x00007FF61C3F0000-0x00007FF61C741000-memory.dmp

Filesize
3.3MB

Download
memory/2836-2295-0x00007FF61C3F0000-0x00007FF61C741000-memory.dmp

Filesize
3.3MB

Download
memory/3068-2233-0x00007FF633500000-0x00007FF633851000-memory.dmp

Filesize
3.3MB

Download
memory/3068-6-0x00007FF633500000-0x00007FF633851000-memory.dmp

Filesize
3.3MB

Download
memory/3068-2189-0x00007FF633500000-0x00007FF633851000-memory.dmp

Filesize
3.3MB

Download
memory/3200-53-0x00007FF745F10000-0x00007FF746261000-memory.dmp

Filesize
3.3MB

Download
memory/3200-2245-0x00007FF745F10000-0x00007FF746261000-memory.dmp

Filesize
3.3MB

Download
memory/3260-519-0x00007FF7AC860000-0x00007FF7ACBB1000-memory.dmp

Filesize
3.3MB

Download
memory/3260-2287-0x00007FF7AC860000-0x00007FF7ACBB1000-memory.dmp

Filesize
3.3MB

Download
memory/3300-587-0x00007FF6C6FC0000-0x00007FF6C7311000-memory.dmp

Filesize
3.3MB

Download
memory/3300-2317-0x00007FF6C6FC0000-0x00007FF6C7311000-memory.dmp

Filesize
3.3MB

Download
memory/3340-2303-0x00007FF633340000-0x00007FF633691000-memory.dmp

Filesize
3.3MB

Download
memory/3340-576-0x00007FF633340000-0x00007FF633691000-memory.dmp

Filesize
3.3MB

Download
memory/3828-0-0x00007FF7BE400000-0x00007FF7BE751000-memory.dmp

Filesize
3.3MB

Download
memory/3828-1-0x000001D708090000-0x000001D7080A0000-memory.dmp

Filesize
64KB

Download
memory/3968-2323-0x00007FF747800000-0x00007FF747B51000-memory.dmp

Filesize
3.3MB

Download
memory/3968-622-0x00007FF747800000-0x00007FF747B51000-memory.dmp

Filesize
3.3MB

Download
memory/4004-2241-0x00007FF74AAC0000-0x00007FF74AE11000-memory.dmp

Filesize
3.3MB

Download
memory/4004-48-0x00007FF74AAC0000-0x00007FF74AE11000-memory.dmp

Filesize
3.3MB

Download
memory/4080-531-0x00007FF6F7FF0000-0x00007FF6F8341000-memory.dmp

Filesize
3.3MB

Download
memory/4080-2292-0x00007FF6F7FF0000-0x00007FF6F8341000-memory.dmp

Filesize
3.3MB

Download
memory/4208-2297-0x00007FF616690000-0x00007FF6169E1000-memory.dmp

Filesize
3.3MB

Download
memory/4208-538-0x00007FF616690000-0x00007FF6169E1000-memory.dmp

Filesize
3.3MB

Download
memory/4348-532-0x00007FF689D30000-0x00007FF68A081000-memory.dmp

Filesize
3.3MB

Download
memory/4348-2290-0x00007FF689D30000-0x00007FF68A081000-memory.dmp

Filesize
3.3MB

Download
memory/4484-2305-0x00007FF6D09D0000-0x00007FF6D0D21000-memory.dmp

Filesize
3.3MB

Download
memory/4484-577-0x00007FF6D09D0000-0x00007FF6D0D21000-memory.dmp

Filesize
3.3MB

Download
memory/4520-2299-0x00007FF70B890000-0x00007FF70BBE1000-memory.dmp

Filesize
3.3MB

Download
memory/4520-552-0x00007FF70B890000-0x00007FF70BBE1000-memory.dmp

Filesize
3.3MB

Download
memory/4780-2321-0x00007FF76E8B0000-0x00007FF76EC01000-memory.dmp

Filesize
3.3MB

Download
memory/4780-617-0x00007FF76E8B0000-0x00007FF76EC01000-memory.dmp

Filesize
3.3MB

Download