xmrig | 52aba1cf4fdd15a6afca4c3497889b28113fd89fefdd398a80d7a11860146e7d

Analysis

max time kernel
125s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

261c7966cc7d00bd71948354572a96e0_NEIKI.exe
Size

1.7MB
MD5

261c7966cc7d00bd71948354572a96e0
SHA1

2f0ffb31a560b07dc314253d8e148f2a9741db73
SHA256

52aba1cf4fdd15a6afca4c3497889b28113fd89fefdd398a80d7a11860146e7d
SHA512

f2c9c4ae786e8f8bd3efd3b074850e169816d5ee83ec11824010c7f105635408d92f325232cb109e59e74870b17a99d817a34d73b159db2a211f64cbb2d55259
SSDEEP

24576:RVIl/WDGCi7/qkatuBF672l6i2Ncb2ygupgrnACAmZ/NwFC31G3AcMxA7DELKcWH:ROdWCCi7/raU56uL3pgrCEdMKPFop

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 55 IoCs

miner

resource	yara_rule
behavioral2/memory/4388-221-0x00007FF725C40000-0x00007FF725F91000-memory.dmp	xmrig
behavioral2/memory/4580-243-0x00007FF78FE80000-0x00007FF7901D1000-memory.dmp	xmrig
behavioral2/memory/4004-259-0x00007FF6D5970000-0x00007FF6D5CC1000-memory.dmp	xmrig
behavioral2/memory/800-267-0x00007FF6796D0000-0x00007FF679A21000-memory.dmp	xmrig
behavioral2/memory/3320-285-0x00007FF76B190000-0x00007FF76B4E1000-memory.dmp	xmrig
behavioral2/memory/1524-287-0x00007FF732950000-0x00007FF732CA1000-memory.dmp	xmrig
behavioral2/memory/4668-286-0x00007FF635BF0000-0x00007FF635F41000-memory.dmp	xmrig
behavioral2/memory/2244-284-0x00007FF7ADBB0000-0x00007FF7ADF01000-memory.dmp	xmrig
behavioral2/memory/1880-283-0x00007FF72FF70000-0x00007FF7302C1000-memory.dmp	xmrig
behavioral2/memory/2588-282-0x00007FF6CB550000-0x00007FF6CB8A1000-memory.dmp	xmrig
behavioral2/memory/4348-281-0x00007FF7F8D00000-0x00007FF7F9051000-memory.dmp	xmrig
behavioral2/memory/4436-277-0x00007FF6E5930000-0x00007FF6E5C81000-memory.dmp	xmrig
behavioral2/memory/2352-276-0x00007FF7AEF30000-0x00007FF7AF281000-memory.dmp	xmrig
behavioral2/memory/1400-266-0x00007FF759650000-0x00007FF7599A1000-memory.dmp	xmrig
behavioral2/memory/3648-258-0x00007FF7A68F0000-0x00007FF7A6C41000-memory.dmp	xmrig
behavioral2/memory/1668-220-0x00007FF77C040000-0x00007FF77C391000-memory.dmp	xmrig
behavioral2/memory/4132-198-0x00007FF663610000-0x00007FF663961000-memory.dmp	xmrig
behavioral2/memory/1500-24-0x00007FF6C73F0000-0x00007FF6C7741000-memory.dmp	xmrig
behavioral2/memory/888-2122-0x00007FF710A20000-0x00007FF710D71000-memory.dmp	xmrig
behavioral2/memory/3568-2254-0x00007FF703FA0000-0x00007FF7042F1000-memory.dmp	xmrig
behavioral2/memory/3568-2257-0x00007FF703FA0000-0x00007FF7042F1000-memory.dmp	xmrig
behavioral2/memory/2876-2264-0x00007FF73E220000-0x00007FF73E571000-memory.dmp	xmrig
behavioral2/memory/1500-2266-0x00007FF6C73F0000-0x00007FF6C7741000-memory.dmp	xmrig
behavioral2/memory/1436-2262-0x00007FF753030000-0x00007FF753381000-memory.dmp	xmrig
behavioral2/memory/2816-2274-0x00007FF733A20000-0x00007FF733D71000-memory.dmp	xmrig
behavioral2/memory/2448-2273-0x00007FF6476E0000-0x00007FF647A31000-memory.dmp	xmrig
behavioral2/memory/1216-2267-0x00007FF74BDB0000-0x00007FF74C101000-memory.dmp	xmrig
behavioral2/memory/4704-2258-0x00007FF683F20000-0x00007FF684271000-memory.dmp	xmrig
behavioral2/memory/2816-2256-0x00007FF733A20000-0x00007FF733D71000-memory.dmp	xmrig
behavioral2/memory/2312-2279-0x00007FF633CA0000-0x00007FF633FF1000-memory.dmp	xmrig
behavioral2/memory/2588-2281-0x00007FF6CB550000-0x00007FF6CB8A1000-memory.dmp	xmrig
behavioral2/memory/2708-2284-0x00007FF6F5B90000-0x00007FF6F5EE1000-memory.dmp	xmrig
behavioral2/memory/2876-2286-0x00007FF73E220000-0x00007FF73E571000-memory.dmp	xmrig
behavioral2/memory/4704-2282-0x00007FF683F20000-0x00007FF684271000-memory.dmp	xmrig
behavioral2/memory/1436-2277-0x00007FF753030000-0x00007FF753381000-memory.dmp	xmrig
behavioral2/memory/4388-2337-0x00007FF725C40000-0x00007FF725F91000-memory.dmp	xmrig
behavioral2/memory/3648-2335-0x00007FF7A68F0000-0x00007FF7A6C41000-memory.dmp	xmrig
behavioral2/memory/4580-2331-0x00007FF78FE80000-0x00007FF7901D1000-memory.dmp	xmrig
behavioral2/memory/3320-2328-0x00007FF76B190000-0x00007FF76B4E1000-memory.dmp	xmrig
behavioral2/memory/4668-2323-0x00007FF635BF0000-0x00007FF635F41000-memory.dmp	xmrig
behavioral2/memory/1880-2321-0x00007FF72FF70000-0x00007FF7302C1000-memory.dmp	xmrig
behavioral2/memory/1216-2319-0x00007FF74BDB0000-0x00007FF74C101000-memory.dmp	xmrig
behavioral2/memory/2244-2317-0x00007FF7ADBB0000-0x00007FF7ADF01000-memory.dmp	xmrig
behavioral2/memory/4004-2314-0x00007FF6D5970000-0x00007FF6D5CC1000-memory.dmp	xmrig
behavioral2/memory/1400-2311-0x00007FF759650000-0x00007FF7599A1000-memory.dmp	xmrig
behavioral2/memory/800-2309-0x00007FF6796D0000-0x00007FF679A21000-memory.dmp	xmrig
behavioral2/memory/4436-2308-0x00007FF6E5930000-0x00007FF6E5C81000-memory.dmp	xmrig
behavioral2/memory/1652-2301-0x00007FF7D9320000-0x00007FF7D9671000-memory.dmp	xmrig
behavioral2/memory/4348-2326-0x00007FF7F8D00000-0x00007FF7F9051000-memory.dmp	xmrig
behavioral2/memory/4132-2298-0x00007FF663610000-0x00007FF663961000-memory.dmp	xmrig
behavioral2/memory/1668-2296-0x00007FF77C040000-0x00007FF77C391000-memory.dmp	xmrig
behavioral2/memory/1524-2292-0x00007FF732950000-0x00007FF732CA1000-memory.dmp	xmrig
behavioral2/memory/2448-2316-0x00007FF6476E0000-0x00007FF647A31000-memory.dmp	xmrig
behavioral2/memory/1676-2295-0x00007FF7331E0000-0x00007FF733531000-memory.dmp	xmrig
behavioral2/memory/2352-2291-0x00007FF7AEF30000-0x00007FF7AF281000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3568	HSjfKmc.exe
1500	JqCmUpe.exe
2816	IFMaRse.exe
2312	SYAMUyg.exe
2588	FYUDNFr.exe
4704	MXZMqql.exe
2708	JtFRrrL.exe
1436	kCtSebY.exe
1880	DZnScky.exe
2876	qjBhsLX.exe
2244	yAdrqhX.exe
1216	TcDtuXe.exe
2448	ZnfdTNu.exe
3320	vfJqGMk.exe
1676	WpuERWz.exe
1652	xaachFo.exe
4132	dnCjVrB.exe
1668	cyoFYhf.exe
4668	vEGLeqI.exe
1524	szNxctA.exe
4388	WwZbcay.exe
4580	eEPkOSy.exe
3648	rTbYZSV.exe
4004	rvbhPqJ.exe
1400	OLQCfVp.exe
800	xqQPBMR.exe
2352	fusuaqj.exe
4436	MQSkIHq.exe
4348	qCpDTiJ.exe
1516	KdmGpMd.exe
3700	QmwCdXy.exe
1592	fsIcqFP.exe
3456	IjFyKkb.exe
3332	HpcibPT.exe
5072	yrVxJYy.exe
3660	QQCwBpN.exe
3644	mohFTPw.exe
1728	fUMTUwI.exe
4980	zmiKbaa.exe
2020	YWYrWxR.exe
1016	vxfxbvI.exe
1404	bSlDoZG.exe
3944	pxKCnob.exe
3552	jFJfaOJ.exe
2820	HuFihhy.exe
384	pVmnVLi.exe
1944	HcCurVp.exe
2824	rsktuek.exe
4476	wJMNmff.exe
1692	ReEBoXE.exe
4652	RWXUDAq.exe
4936	QWdqpNe.exe
3272	UmLMzOr.exe
2656	RuEuMmo.exe
1480	aWKIffD.exe
2600	sjzvOao.exe
4720	HpBijRG.exe
1136	MbbCeeg.exe
1076	IEefbNu.exe
3496	FFFBGrN.exe
4624	sfUbSZw.exe
336	KRmxgoR.exe
400	UCsMMor.exe
1508	xEyNogi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/888-0-0x00007FF710A20000-0x00007FF710D71000-memory.dmp	upx
behavioral2/files/0x0007000000023440-19.dat	upx
behavioral2/files/0x0007000000023442-52.dat	upx
behavioral2/files/0x0007000000023441-48.dat	upx
behavioral2/memory/2708-47-0x00007FF6F5B90000-0x00007FF6F5EE1000-memory.dmp	upx
behavioral2/files/0x0007000000023448-59.dat	upx
behavioral2/memory/4704-46-0x00007FF683F20000-0x00007FF684271000-memory.dmp	upx
behavioral2/files/0x0007000000023446-45.dat	upx
behavioral2/files/0x0007000000023445-44.dat	upx
behavioral2/files/0x0007000000023443-55.dat	upx
behavioral2/files/0x0007000000023452-116.dat	upx
behavioral2/files/0x0007000000023461-170.dat	upx
behavioral2/memory/4388-221-0x00007FF725C40000-0x00007FF725F91000-memory.dmp	upx
behavioral2/memory/4580-243-0x00007FF78FE80000-0x00007FF7901D1000-memory.dmp	upx
behavioral2/memory/4004-259-0x00007FF6D5970000-0x00007FF6D5CC1000-memory.dmp	upx
behavioral2/memory/800-267-0x00007FF6796D0000-0x00007FF679A21000-memory.dmp	upx
behavioral2/memory/3320-285-0x00007FF76B190000-0x00007FF76B4E1000-memory.dmp	upx
behavioral2/memory/1524-287-0x00007FF732950000-0x00007FF732CA1000-memory.dmp	upx
behavioral2/memory/4668-286-0x00007FF635BF0000-0x00007FF635F41000-memory.dmp	upx
behavioral2/memory/2244-284-0x00007FF7ADBB0000-0x00007FF7ADF01000-memory.dmp	upx
behavioral2/memory/1880-283-0x00007FF72FF70000-0x00007FF7302C1000-memory.dmp	upx
behavioral2/memory/2588-282-0x00007FF6CB550000-0x00007FF6CB8A1000-memory.dmp	upx
behavioral2/memory/4348-281-0x00007FF7F8D00000-0x00007FF7F9051000-memory.dmp	upx
behavioral2/memory/4436-277-0x00007FF6E5930000-0x00007FF6E5C81000-memory.dmp	upx
behavioral2/memory/2352-276-0x00007FF7AEF30000-0x00007FF7AF281000-memory.dmp	upx
behavioral2/memory/1400-266-0x00007FF759650000-0x00007FF7599A1000-memory.dmp	upx
behavioral2/memory/3648-258-0x00007FF7A68F0000-0x00007FF7A6C41000-memory.dmp	upx
behavioral2/memory/1668-220-0x00007FF77C040000-0x00007FF77C391000-memory.dmp	upx
behavioral2/memory/4132-198-0x00007FF663610000-0x00007FF663961000-memory.dmp	upx
behavioral2/files/0x0007000000023459-190.dat	upx
behavioral2/files/0x0007000000023458-186.dat	upx
behavioral2/files/0x000700000002344e-184.dat	upx
behavioral2/files/0x000700000002344b-178.dat	upx
behavioral2/files/0x0007000000023457-174.dat	upx
behavioral2/files/0x0007000000023456-172.dat	upx
behavioral2/files/0x0007000000023462-171.dat	upx
behavioral2/files/0x0007000000023454-169.dat	upx
behavioral2/files/0x0007000000023453-167.dat	upx
behavioral2/files/0x000700000002345f-165.dat	upx
behavioral2/memory/1652-164-0x00007FF7D9320000-0x00007FF7D9671000-memory.dmp	upx
behavioral2/memory/1676-163-0x00007FF7331E0000-0x00007FF733531000-memory.dmp	upx
behavioral2/files/0x000700000002344c-149.dat	upx
behavioral2/files/0x0007000000023460-168.dat	upx
behavioral2/files/0x000700000002345e-146.dat	upx
behavioral2/files/0x000700000002345d-144.dat	upx
behavioral2/memory/2448-142-0x00007FF6476E0000-0x00007FF647A31000-memory.dmp	upx
behavioral2/files/0x000700000002345c-141.dat	upx
behavioral2/files/0x000700000002345b-140.dat	upx
behavioral2/files/0x000700000002344f-156.dat	upx
behavioral2/files/0x000700000002344d-155.dat	upx
behavioral2/files/0x0007000000023451-139.dat	upx
behavioral2/files/0x000700000002345a-138.dat	upx
behavioral2/files/0x0007000000023449-131.dat	upx
behavioral2/files/0x0007000000023447-129.dat	upx
behavioral2/files/0x0007000000023455-128.dat	upx
behavioral2/memory/1216-110-0x00007FF74BDB0000-0x00007FF74C101000-memory.dmp	upx
behavioral2/files/0x0007000000023450-104.dat	upx
behavioral2/files/0x000700000002344a-79.dat	upx
behavioral2/memory/2876-76-0x00007FF73E220000-0x00007FF73E571000-memory.dmp	upx
behavioral2/memory/1436-73-0x00007FF753030000-0x00007FF753381000-memory.dmp	upx
behavioral2/files/0x0007000000023444-67.dat	upx
behavioral2/memory/2312-38-0x00007FF633CA0000-0x00007FF633FF1000-memory.dmp	upx
behavioral2/memory/2816-35-0x00007FF733A20000-0x00007FF733D71000-memory.dmp	upx
behavioral2/memory/1500-24-0x00007FF6C73F0000-0x00007FF6C7741000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xaachFo.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\GVsHgqt.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\KqybhFh.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\mnljute.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\MwvhFCb.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\MvBwjIh.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\jAAgZPc.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\EjjITck.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\JMzpbUf.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\sMXsFEF.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\BVFAuAU.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\mXdArsH.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\vEGLeqI.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\zYORzla.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\SozjFIE.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\parxgyi.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\LoyHGuB.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\JqnRSpy.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\gPgLNuM.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\JqCmUpe.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\uIUavtT.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\ScNxLkD.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\SwGEnuq.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\aWKIffD.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\ZWyqQaa.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\bCUnibb.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\IlCnYnE.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\ATxRucQ.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\FubNDMu.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\dnCjVrB.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\hLZoMAC.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\zoPhcIz.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\wTEjhQF.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\inJuKhj.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\aaPPRqH.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\VWmjfNx.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\lTzSCXk.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\EVhwCdZ.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\NdizmQU.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\mgKwVre.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\AqhfYsl.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\UQQBfcx.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\oHOXAjh.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\SlWJFQK.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\qXNOJUg.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\wNaLVup.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\LpisKVJ.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\IPExZIo.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\suawIPu.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\zsuMSIY.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\tYZkYwG.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\HpBijRG.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\rdzyOIP.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\hFiJLWR.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\niCLyGM.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\vwOAuql.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\MVjvVVc.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\HdLgHIa.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\wyYAVcv.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\joxgzvs.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\dsLxreg.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\TTQStiz.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\qnRJoym.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe
File created	C:\Windows\System\Garpiou.exe	261c7966cc7d00bd71948354572a96e0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 3568	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	81
PID 888 wrote to memory of 3568	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	81
PID 888 wrote to memory of 1500	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	82
PID 888 wrote to memory of 1500	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	82
PID 888 wrote to memory of 2816	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	83
PID 888 wrote to memory of 2816	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	83
PID 888 wrote to memory of 2312	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	84
PID 888 wrote to memory of 2312	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	84
PID 888 wrote to memory of 2588	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	85
PID 888 wrote to memory of 2588	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	85
PID 888 wrote to memory of 4704	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	86
PID 888 wrote to memory of 4704	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	86
PID 888 wrote to memory of 2708	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	87
PID 888 wrote to memory of 2708	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	87
PID 888 wrote to memory of 1436	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	88
PID 888 wrote to memory of 1436	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	88
PID 888 wrote to memory of 1880	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	89
PID 888 wrote to memory of 1880	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	89
PID 888 wrote to memory of 2876	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	90
PID 888 wrote to memory of 2876	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	90
PID 888 wrote to memory of 1216	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	91
PID 888 wrote to memory of 1216	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	91
PID 888 wrote to memory of 2244	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	92
PID 888 wrote to memory of 2244	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	92
PID 888 wrote to memory of 2448	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	93
PID 888 wrote to memory of 2448	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	93
PID 888 wrote to memory of 3320	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	94
PID 888 wrote to memory of 3320	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	94
PID 888 wrote to memory of 800	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	95
PID 888 wrote to memory of 800	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	95
PID 888 wrote to memory of 1676	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	96
PID 888 wrote to memory of 1676	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	96
PID 888 wrote to memory of 1652	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	97
PID 888 wrote to memory of 1652	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	97
PID 888 wrote to memory of 4132	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	98
PID 888 wrote to memory of 4132	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	98
PID 888 wrote to memory of 1668	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	99
PID 888 wrote to memory of 1668	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	99
PID 888 wrote to memory of 4668	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	100
PID 888 wrote to memory of 4668	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	100
PID 888 wrote to memory of 1516	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	101
PID 888 wrote to memory of 1516	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	101
PID 888 wrote to memory of 1524	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	102
PID 888 wrote to memory of 1524	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	102
PID 888 wrote to memory of 4388	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	103
PID 888 wrote to memory of 4388	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	103
PID 888 wrote to memory of 4580	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	104
PID 888 wrote to memory of 4580	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	104
PID 888 wrote to memory of 3648	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	105
PID 888 wrote to memory of 3648	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	105
PID 888 wrote to memory of 4004	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	106
PID 888 wrote to memory of 4004	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	106
PID 888 wrote to memory of 1400	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	107
PID 888 wrote to memory of 1400	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	107
PID 888 wrote to memory of 2352	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	108
PID 888 wrote to memory of 2352	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	108
PID 888 wrote to memory of 4436	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	109
PID 888 wrote to memory of 4436	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	109
PID 888 wrote to memory of 4348	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	110
PID 888 wrote to memory of 4348	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	110
PID 888 wrote to memory of 3700	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	111
PID 888 wrote to memory of 3700	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	111
PID 888 wrote to memory of 1592	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	112
PID 888 wrote to memory of 1592	888	261c7966cc7d00bd71948354572a96e0_NEIKI.exe	112

C:\Users\Admin\AppData\Local\Temp\261c7966cc7d00bd71948354572a96e0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\261c7966cc7d00bd71948354572a96e0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\System\HSjfKmc.exe
  C:\Windows\System\HSjfKmc.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\JqCmUpe.exe
  C:\Windows\System\JqCmUpe.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\IFMaRse.exe
  C:\Windows\System\IFMaRse.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\SYAMUyg.exe
  C:\Windows\System\SYAMUyg.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\FYUDNFr.exe
  C:\Windows\System\FYUDNFr.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\MXZMqql.exe
  C:\Windows\System\MXZMqql.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\JtFRrrL.exe
  C:\Windows\System\JtFRrrL.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\kCtSebY.exe
  C:\Windows\System\kCtSebY.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\DZnScky.exe
  C:\Windows\System\DZnScky.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\qjBhsLX.exe
  C:\Windows\System\qjBhsLX.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\TcDtuXe.exe
  C:\Windows\System\TcDtuXe.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\yAdrqhX.exe
  C:\Windows\System\yAdrqhX.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\ZnfdTNu.exe
  C:\Windows\System\ZnfdTNu.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\vfJqGMk.exe
  C:\Windows\System\vfJqGMk.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\xqQPBMR.exe
  C:\Windows\System\xqQPBMR.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\WpuERWz.exe
  C:\Windows\System\WpuERWz.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\xaachFo.exe
  C:\Windows\System\xaachFo.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\dnCjVrB.exe
  C:\Windows\System\dnCjVrB.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\cyoFYhf.exe
  C:\Windows\System\cyoFYhf.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\vEGLeqI.exe
  C:\Windows\System\vEGLeqI.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\KdmGpMd.exe
  C:\Windows\System\KdmGpMd.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\szNxctA.exe
  C:\Windows\System\szNxctA.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\WwZbcay.exe
  C:\Windows\System\WwZbcay.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\eEPkOSy.exe
  C:\Windows\System\eEPkOSy.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\rTbYZSV.exe
  C:\Windows\System\rTbYZSV.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\rvbhPqJ.exe
  C:\Windows\System\rvbhPqJ.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\OLQCfVp.exe
  C:\Windows\System\OLQCfVp.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\fusuaqj.exe
  C:\Windows\System\fusuaqj.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\MQSkIHq.exe
  C:\Windows\System\MQSkIHq.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\qCpDTiJ.exe
  C:\Windows\System\qCpDTiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\QmwCdXy.exe
  C:\Windows\System\QmwCdXy.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\fsIcqFP.exe
  C:\Windows\System\fsIcqFP.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\IjFyKkb.exe
  C:\Windows\System\IjFyKkb.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\HpcibPT.exe
  C:\Windows\System\HpcibPT.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\yrVxJYy.exe
  C:\Windows\System\yrVxJYy.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\QQCwBpN.exe
  C:\Windows\System\QQCwBpN.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\mohFTPw.exe
  C:\Windows\System\mohFTPw.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\fUMTUwI.exe
  C:\Windows\System\fUMTUwI.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\zmiKbaa.exe
  C:\Windows\System\zmiKbaa.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\YWYrWxR.exe
  C:\Windows\System\YWYrWxR.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\vxfxbvI.exe
  C:\Windows\System\vxfxbvI.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\bSlDoZG.exe
  C:\Windows\System\bSlDoZG.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\pxKCnob.exe
  C:\Windows\System\pxKCnob.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\jFJfaOJ.exe
  C:\Windows\System\jFJfaOJ.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\HuFihhy.exe
  C:\Windows\System\HuFihhy.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\pVmnVLi.exe
  C:\Windows\System\pVmnVLi.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\HcCurVp.exe
  C:\Windows\System\HcCurVp.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\rsktuek.exe
  C:\Windows\System\rsktuek.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\wJMNmff.exe
  C:\Windows\System\wJMNmff.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\ReEBoXE.exe
  C:\Windows\System\ReEBoXE.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\RWXUDAq.exe
  C:\Windows\System\RWXUDAq.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\QWdqpNe.exe
  C:\Windows\System\QWdqpNe.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\UmLMzOr.exe
  C:\Windows\System\UmLMzOr.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\RuEuMmo.exe
  C:\Windows\System\RuEuMmo.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\aWKIffD.exe
  C:\Windows\System\aWKIffD.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\sjzvOao.exe
  C:\Windows\System\sjzvOao.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\HpBijRG.exe
  C:\Windows\System\HpBijRG.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\MbbCeeg.exe
  C:\Windows\System\MbbCeeg.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\IEefbNu.exe
  C:\Windows\System\IEefbNu.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\FFFBGrN.exe
  C:\Windows\System\FFFBGrN.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\sfUbSZw.exe
  C:\Windows\System\sfUbSZw.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\KRmxgoR.exe
  C:\Windows\System\KRmxgoR.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\UCsMMor.exe
  C:\Windows\System\UCsMMor.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\xEyNogi.exe
  C:\Windows\System\xEyNogi.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\plrWqkP.exe
  C:\Windows\System\plrWqkP.exe
  2⤵
  PID:2576
- C:\Windows\System\GVsHgqt.exe
  C:\Windows\System\GVsHgqt.exe
  2⤵
  PID:1700
- C:\Windows\System\QCQrUJn.exe
  C:\Windows\System\QCQrUJn.exe
  2⤵
  PID:4844
- C:\Windows\System\fEkxlVn.exe
  C:\Windows\System\fEkxlVn.exe
  2⤵
  PID:4152
- C:\Windows\System\mwToSFE.exe
  C:\Windows\System\mwToSFE.exe
  2⤵
  PID:3544
- C:\Windows\System\wOrPiui.exe
  C:\Windows\System\wOrPiui.exe
  2⤵
  PID:1992
- C:\Windows\System\sqqPXRv.exe
  C:\Windows\System\sqqPXRv.exe
  2⤵
  PID:2836
- C:\Windows\System\KkwEWqP.exe
  C:\Windows\System\KkwEWqP.exe
  2⤵
  PID:3876
- C:\Windows\System\JjZOGwk.exe
  C:\Windows\System\JjZOGwk.exe
  2⤵
  PID:4948
- C:\Windows\System\VnBIeJD.exe
  C:\Windows\System\VnBIeJD.exe
  2⤵
  PID:1968
- C:\Windows\System\VtbNidr.exe
  C:\Windows\System\VtbNidr.exe
  2⤵
  PID:408
- C:\Windows\System\pVvsFLp.exe
  C:\Windows\System\pVvsFLp.exe
  2⤵
  PID:2168
- C:\Windows\System\CWYpYdH.exe
  C:\Windows\System\CWYpYdH.exe
  2⤵
  PID:3652
- C:\Windows\System\UlUSSoE.exe
  C:\Windows\System\UlUSSoE.exe
  2⤵
  PID:2272
- C:\Windows\System\hhZIKtq.exe
  C:\Windows\System\hhZIKtq.exe
  2⤵
  PID:3960
- C:\Windows\System\NgJgLUk.exe
  C:\Windows\System\NgJgLUk.exe
  2⤵
  PID:5108
- C:\Windows\System\Garpiou.exe
  C:\Windows\System\Garpiou.exe
  2⤵
  PID:4684
- C:\Windows\System\aYHzEbO.exe
  C:\Windows\System\aYHzEbO.exe
  2⤵
  PID:4404
- C:\Windows\System\fDGThrk.exe
  C:\Windows\System\fDGThrk.exe
  2⤵
  PID:1488
- C:\Windows\System\UXtxCMs.exe
  C:\Windows\System\UXtxCMs.exe
  2⤵
  PID:1168
- C:\Windows\System\bOjREtL.exe
  C:\Windows\System\bOjREtL.exe
  2⤵
  PID:4884
- C:\Windows\System\ungOhil.exe
  C:\Windows\System\ungOhil.exe
  2⤵
  PID:5192
- C:\Windows\System\wIvAuyH.exe
  C:\Windows\System\wIvAuyH.exe
  2⤵
  PID:5208
- C:\Windows\System\hLEpVnX.exe
  C:\Windows\System\hLEpVnX.exe
  2⤵
  PID:5224
- C:\Windows\System\sXeEtkj.exe
  C:\Windows\System\sXeEtkj.exe
  2⤵
  PID:5248
- C:\Windows\System\cPEQJaP.exe
  C:\Windows\System\cPEQJaP.exe
  2⤵
  PID:5276
- C:\Windows\System\uyHeznR.exe
  C:\Windows\System\uyHeznR.exe
  2⤵
  PID:5344
- C:\Windows\System\NNPSfaS.exe
  C:\Windows\System\NNPSfaS.exe
  2⤵
  PID:5360
- C:\Windows\System\GcqONOg.exe
  C:\Windows\System\GcqONOg.exe
  2⤵
  PID:5376
- C:\Windows\System\yOautxd.exe
  C:\Windows\System\yOautxd.exe
  2⤵
  PID:5396
- C:\Windows\System\aqIKyGH.exe
  C:\Windows\System\aqIKyGH.exe
  2⤵
  PID:5412
- C:\Windows\System\JgtbbEc.exe
  C:\Windows\System\JgtbbEc.exe
  2⤵
  PID:5428
- C:\Windows\System\ByUcOgV.exe
  C:\Windows\System\ByUcOgV.exe
  2⤵
  PID:5444
- C:\Windows\System\weKzsDY.exe
  C:\Windows\System\weKzsDY.exe
  2⤵
  PID:5460
- C:\Windows\System\WyCOFfE.exe
  C:\Windows\System\WyCOFfE.exe
  2⤵
  PID:5476
- C:\Windows\System\fcuLKFA.exe
  C:\Windows\System\fcuLKFA.exe
  2⤵
  PID:5500
- C:\Windows\System\NoewnnY.exe
  C:\Windows\System\NoewnnY.exe
  2⤵
  PID:5520
- C:\Windows\System\JTRoPky.exe
  C:\Windows\System\JTRoPky.exe
  2⤵
  PID:5540
- C:\Windows\System\SSoktTB.exe
  C:\Windows\System\SSoktTB.exe
  2⤵
  PID:5556
- C:\Windows\System\WxnmGax.exe
  C:\Windows\System\WxnmGax.exe
  2⤵
  PID:5584
- C:\Windows\System\BCCGPWs.exe
  C:\Windows\System\BCCGPWs.exe
  2⤵
  PID:5720
- C:\Windows\System\DCEEcOx.exe
  C:\Windows\System\DCEEcOx.exe
  2⤵
  PID:5748
- C:\Windows\System\lcYsKjP.exe
  C:\Windows\System\lcYsKjP.exe
  2⤵
  PID:5788
- C:\Windows\System\eUEFrLy.exe
  C:\Windows\System\eUEFrLy.exe
  2⤵
  PID:5804
- C:\Windows\System\gSpJurU.exe
  C:\Windows\System\gSpJurU.exe
  2⤵
  PID:5820
- C:\Windows\System\yRevjrg.exe
  C:\Windows\System\yRevjrg.exe
  2⤵
  PID:5840
- C:\Windows\System\mDFqPXH.exe
  C:\Windows\System\mDFqPXH.exe
  2⤵
  PID:5948
- C:\Windows\System\DWBjbgh.exe
  C:\Windows\System\DWBjbgh.exe
  2⤵
  PID:6000
- C:\Windows\System\jdrBXQR.exe
  C:\Windows\System\jdrBXQR.exe
  2⤵
  PID:6044
- C:\Windows\System\mkZFIpm.exe
  C:\Windows\System\mkZFIpm.exe
  2⤵
  PID:6060
- C:\Windows\System\LotFbsY.exe
  C:\Windows\System\LotFbsY.exe
  2⤵
  PID:6076
- C:\Windows\System\HlyuUlH.exe
  C:\Windows\System\HlyuUlH.exe
  2⤵
  PID:6092
- C:\Windows\System\mDippbw.exe
  C:\Windows\System\mDippbw.exe
  2⤵
  PID:6108
- C:\Windows\System\WDeerNV.exe
  C:\Windows\System\WDeerNV.exe
  2⤵
  PID:6124
- C:\Windows\System\BrZymTJ.exe
  C:\Windows\System\BrZymTJ.exe
  2⤵
  PID:6140
- C:\Windows\System\TkklulC.exe
  C:\Windows\System\TkklulC.exe
  2⤵
  PID:4672
- C:\Windows\System\FweLJXy.exe
  C:\Windows\System\FweLJXy.exe
  2⤵
  PID:4056
- C:\Windows\System\LmebGLq.exe
  C:\Windows\System\LmebGLq.exe
  2⤵
  PID:5088
- C:\Windows\System\ZKYNyzd.exe
  C:\Windows\System\ZKYNyzd.exe
  2⤵
  PID:5132
- C:\Windows\System\kuZBorB.exe
  C:\Windows\System\kuZBorB.exe
  2⤵
  PID:5172
- C:\Windows\System\uIUavtT.exe
  C:\Windows\System\uIUavtT.exe
  2⤵
  PID:5232
- C:\Windows\System\fPEoYuX.exe
  C:\Windows\System\fPEoYuX.exe
  2⤵
  PID:5292
- C:\Windows\System\dmoGNcQ.exe
  C:\Windows\System\dmoGNcQ.exe
  2⤵
  PID:5384
- C:\Windows\System\gbCJTwa.exe
  C:\Windows\System\gbCJTwa.exe
  2⤵
  PID:5420
- C:\Windows\System\xYlnxEq.exe
  C:\Windows\System\xYlnxEq.exe
  2⤵
  PID:5452
- C:\Windows\System\BfFMqtq.exe
  C:\Windows\System\BfFMqtq.exe
  2⤵
  PID:5484
- C:\Windows\System\IuZPkHO.exe
  C:\Windows\System\IuZPkHO.exe
  2⤵
  PID:5532
- C:\Windows\System\wEzneqT.exe
  C:\Windows\System\wEzneqT.exe
  2⤵
  PID:5592
- C:\Windows\System\ubOxAlw.exe
  C:\Windows\System\ubOxAlw.exe
  2⤵
  PID:5640
- C:\Windows\System\QJnDEos.exe
  C:\Windows\System\QJnDEos.exe
  2⤵
  PID:5680
- C:\Windows\System\YgQenZb.exe
  C:\Windows\System\YgQenZb.exe
  2⤵
  PID:5728
- C:\Windows\System\EYuDiyh.exe
  C:\Windows\System\EYuDiyh.exe
  2⤵
  PID:5836
- C:\Windows\System\fyhZsie.exe
  C:\Windows\System\fyhZsie.exe
  2⤵
  PID:5932
- C:\Windows\System\PXmLIml.exe
  C:\Windows\System\PXmLIml.exe
  2⤵
  PID:5812
- C:\Windows\System\zYORzla.exe
  C:\Windows\System\zYORzla.exe
  2⤵
  PID:5956
- C:\Windows\System\lijOTTM.exe
  C:\Windows\System\lijOTTM.exe
  2⤵
  PID:2572
- C:\Windows\System\mXNMuCR.exe
  C:\Windows\System\mXNMuCR.exe
  2⤵
  PID:3868
- C:\Windows\System\PjVfujk.exe
  C:\Windows\System\PjVfujk.exe
  2⤵
  PID:1600
- C:\Windows\System\SozjFIE.exe
  C:\Windows\System\SozjFIE.exe
  2⤵
  PID:6088
- C:\Windows\System\SCgoLjj.exe
  C:\Windows\System\SCgoLjj.exe
  2⤵
  PID:2668
- C:\Windows\System\wqRQWvg.exe
  C:\Windows\System\wqRQWvg.exe
  2⤵
  PID:956
- C:\Windows\System\PYjnYzx.exe
  C:\Windows\System\PYjnYzx.exe
  2⤵
  PID:4660
- C:\Windows\System\yPvEWpq.exe
  C:\Windows\System\yPvEWpq.exe
  2⤵
  PID:1344
- C:\Windows\System\KqybhFh.exe
  C:\Windows\System\KqybhFh.exe
  2⤵
  PID:1448
- C:\Windows\System\mCIzgXT.exe
  C:\Windows\System\mCIzgXT.exe
  2⤵
  PID:4856
- C:\Windows\System\ZAFBEah.exe
  C:\Windows\System\ZAFBEah.exe
  2⤵
  PID:4740
- C:\Windows\System\jEvKvJH.exe
  C:\Windows\System\jEvKvJH.exe
  2⤵
  PID:4428
- C:\Windows\System\EheuxYC.exe
  C:\Windows\System\EheuxYC.exe
  2⤵
  PID:6068
- C:\Windows\System\ukoOQFR.exe
  C:\Windows\System\ukoOQFR.exe
  2⤵
  PID:4956
- C:\Windows\System\sFlnYDb.exe
  C:\Windows\System\sFlnYDb.exe
  2⤵
  PID:4776
- C:\Windows\System\xMTuthP.exe
  C:\Windows\System\xMTuthP.exe
  2⤵
  PID:4184
- C:\Windows\System\BEUnWtg.exe
  C:\Windows\System\BEUnWtg.exe
  2⤵
  PID:1068
- C:\Windows\System\IDKZywo.exe
  C:\Windows\System\IDKZywo.exe
  2⤵
  PID:3980
- C:\Windows\System\wOhHWyl.exe
  C:\Windows\System\wOhHWyl.exe
  2⤵
  PID:4836
- C:\Windows\System\FavQrfD.exe
  C:\Windows\System\FavQrfD.exe
  2⤵
  PID:6084
- C:\Windows\System\ySThgIo.exe
  C:\Windows\System\ySThgIo.exe
  2⤵
  PID:5156
- C:\Windows\System\LWlvNWY.exe
  C:\Windows\System\LWlvNWY.exe
  2⤵
  PID:5244
- C:\Windows\System\DJzPFna.exe
  C:\Windows\System\DJzPFna.exe
  2⤵
  PID:5372
- C:\Windows\System\lTzSCXk.exe
  C:\Windows\System\lTzSCXk.exe
  2⤵
  PID:5368
- C:\Windows\System\npbVprE.exe
  C:\Windows\System\npbVprE.exe
  2⤵
  PID:5832
- C:\Windows\System\mePXvgv.exe
  C:\Windows\System\mePXvgv.exe
  2⤵
  PID:3824
- C:\Windows\System\pIFfRQk.exe
  C:\Windows\System\pIFfRQk.exe
  2⤵
  PID:852
- C:\Windows\System\LOzkiGT.exe
  C:\Windows\System\LOzkiGT.exe
  2⤵
  PID:4568
- C:\Windows\System\gyJcvIj.exe
  C:\Windows\System\gyJcvIj.exe
  2⤵
  PID:920
- C:\Windows\System\kLUyyDw.exe
  C:\Windows\System\kLUyyDw.exe
  2⤵
  PID:1984
- C:\Windows\System\bBrFtdm.exe
  C:\Windows\System\bBrFtdm.exe
  2⤵
  PID:4940
- C:\Windows\System\fjVmOGN.exe
  C:\Windows\System\fjVmOGN.exe
  2⤵
  PID:3768
- C:\Windows\System\XfRHWDO.exe
  C:\Windows\System\XfRHWDO.exe
  2⤵
  PID:1040
- C:\Windows\System\MwvhFCb.exe
  C:\Windows\System\MwvhFCb.exe
  2⤵
  PID:5112
- C:\Windows\System\eRZlVoq.exe
  C:\Windows\System\eRZlVoq.exe
  2⤵
  PID:6132
- C:\Windows\System\tjHzmMh.exe
  C:\Windows\System\tjHzmMh.exe
  2⤵
  PID:4780
- C:\Windows\System\qjCBdLL.exe
  C:\Windows\System\qjCBdLL.exe
  2⤵
  PID:6036
- C:\Windows\System\UepKTsz.exe
  C:\Windows\System\UepKTsz.exe
  2⤵
  PID:6152
- C:\Windows\System\SlWJFQK.exe
  C:\Windows\System\SlWJFQK.exe
  2⤵
  PID:6172
- C:\Windows\System\BRGumIX.exe
  C:\Windows\System\BRGumIX.exe
  2⤵
  PID:6196
- C:\Windows\System\wVikbrv.exe
  C:\Windows\System\wVikbrv.exe
  2⤵
  PID:6220
- C:\Windows\System\PKqhUdn.exe
  C:\Windows\System\PKqhUdn.exe
  2⤵
  PID:6244
- C:\Windows\System\TIWvKuO.exe
  C:\Windows\System\TIWvKuO.exe
  2⤵
  PID:6264
- C:\Windows\System\NSKRxxA.exe
  C:\Windows\System\NSKRxxA.exe
  2⤵
  PID:6284
- C:\Windows\System\lHOaydC.exe
  C:\Windows\System\lHOaydC.exe
  2⤵
  PID:6308
- C:\Windows\System\vPwyKHq.exe
  C:\Windows\System\vPwyKHq.exe
  2⤵
  PID:6328
- C:\Windows\System\MvBwjIh.exe
  C:\Windows\System\MvBwjIh.exe
  2⤵
  PID:6352
- C:\Windows\System\VnBeaGS.exe
  C:\Windows\System\VnBeaGS.exe
  2⤵
  PID:6376
- C:\Windows\System\QQMTBdO.exe
  C:\Windows\System\QQMTBdO.exe
  2⤵
  PID:6396
- C:\Windows\System\jAAgZPc.exe
  C:\Windows\System\jAAgZPc.exe
  2⤵
  PID:6416
- C:\Windows\System\BBgqPeV.exe
  C:\Windows\System\BBgqPeV.exe
  2⤵
  PID:6440
- C:\Windows\System\bHGyRfh.exe
  C:\Windows\System\bHGyRfh.exe
  2⤵
  PID:6464
- C:\Windows\System\fMlZPgh.exe
  C:\Windows\System\fMlZPgh.exe
  2⤵
  PID:6484
- C:\Windows\System\WgRdwTd.exe
  C:\Windows\System\WgRdwTd.exe
  2⤵
  PID:6512
- C:\Windows\System\YEXdMjy.exe
  C:\Windows\System\YEXdMjy.exe
  2⤵
  PID:6532
- C:\Windows\System\mpuaFhj.exe
  C:\Windows\System\mpuaFhj.exe
  2⤵
  PID:6564
- C:\Windows\System\DdXHRaL.exe
  C:\Windows\System\DdXHRaL.exe
  2⤵
  PID:6584
- C:\Windows\System\NZVisKi.exe
  C:\Windows\System\NZVisKi.exe
  2⤵
  PID:6608
- C:\Windows\System\CeapKUG.exe
  C:\Windows\System\CeapKUG.exe
  2⤵
  PID:6624
- C:\Windows\System\qXNOJUg.exe
  C:\Windows\System\qXNOJUg.exe
  2⤵
  PID:6648
- C:\Windows\System\NPIloeY.exe
  C:\Windows\System\NPIloeY.exe
  2⤵
  PID:6668
- C:\Windows\System\DBjJYDs.exe
  C:\Windows\System\DBjJYDs.exe
  2⤵
  PID:6692
- C:\Windows\System\UxTWwBF.exe
  C:\Windows\System\UxTWwBF.exe
  2⤵
  PID:6712
- C:\Windows\System\XtCYJEM.exe
  C:\Windows\System\XtCYJEM.exe
  2⤵
  PID:6732
- C:\Windows\System\CsRxEuK.exe
  C:\Windows\System\CsRxEuK.exe
  2⤵
  PID:6756
- C:\Windows\System\mvmPNXC.exe
  C:\Windows\System\mvmPNXC.exe
  2⤵
  PID:6776
- C:\Windows\System\KNFeREQ.exe
  C:\Windows\System\KNFeREQ.exe
  2⤵
  PID:6796
- C:\Windows\System\wUMTAnG.exe
  C:\Windows\System\wUMTAnG.exe
  2⤵
  PID:6816
- C:\Windows\System\CGjwXKZ.exe
  C:\Windows\System\CGjwXKZ.exe
  2⤵
  PID:6836
- C:\Windows\System\vIGUJru.exe
  C:\Windows\System\vIGUJru.exe
  2⤵
  PID:6860
- C:\Windows\System\rWwiqky.exe
  C:\Windows\System\rWwiqky.exe
  2⤵
  PID:6880
- C:\Windows\System\jVdgdDX.exe
  C:\Windows\System\jVdgdDX.exe
  2⤵
  PID:6900
- C:\Windows\System\hCBcXAi.exe
  C:\Windows\System\hCBcXAi.exe
  2⤵
  PID:6916
- C:\Windows\System\BYKCmxt.exe
  C:\Windows\System\BYKCmxt.exe
  2⤵
  PID:6944
- C:\Windows\System\JeANGsu.exe
  C:\Windows\System\JeANGsu.exe
  2⤵
  PID:6964
- C:\Windows\System\cZVqMiw.exe
  C:\Windows\System\cZVqMiw.exe
  2⤵
  PID:6988
- C:\Windows\System\puLHemj.exe
  C:\Windows\System\puLHemj.exe
  2⤵
  PID:7008
- C:\Windows\System\FKIquRQ.exe
  C:\Windows\System\FKIquRQ.exe
  2⤵
  PID:7032
- C:\Windows\System\raOuUte.exe
  C:\Windows\System\raOuUte.exe
  2⤵
  PID:7052
- C:\Windows\System\HsXhDQW.exe
  C:\Windows\System\HsXhDQW.exe
  2⤵
  PID:7076
- C:\Windows\System\FUwahzX.exe
  C:\Windows\System\FUwahzX.exe
  2⤵
  PID:7092
- C:\Windows\System\YIynsEb.exe
  C:\Windows\System\YIynsEb.exe
  2⤵
  PID:7116
- C:\Windows\System\jfuFPCq.exe
  C:\Windows\System\jfuFPCq.exe
  2⤵
  PID:7136
- C:\Windows\System\ezpvuTc.exe
  C:\Windows\System\ezpvuTc.exe
  2⤵
  PID:7160
- C:\Windows\System\eSoOPQu.exe
  C:\Windows\System\eSoOPQu.exe
  2⤵
  PID:5756
- C:\Windows\System\uSQEbyn.exe
  C:\Windows\System\uSQEbyn.exe
  2⤵
  PID:5288
- C:\Windows\System\hLZoMAC.exe
  C:\Windows\System\hLZoMAC.exe
  2⤵
  PID:4644
- C:\Windows\System\PrwVQgr.exe
  C:\Windows\System\PrwVQgr.exe
  2⤵
  PID:740
- C:\Windows\System\ZGPXAdE.exe
  C:\Windows\System\ZGPXAdE.exe
  2⤵
  PID:6180
- C:\Windows\System\PHBxNJU.exe
  C:\Windows\System\PHBxNJU.exe
  2⤵
  PID:6236
- C:\Windows\System\REeAGZO.exe
  C:\Windows\System\REeAGZO.exe
  2⤵
  PID:5980
- C:\Windows\System\djdNDkq.exe
  C:\Windows\System\djdNDkq.exe
  2⤵
  PID:6148
- C:\Windows\System\cDkBqag.exe
  C:\Windows\System\cDkBqag.exe
  2⤵
  PID:6448
- C:\Windows\System\wcjGQQI.exe
  C:\Windows\System\wcjGQQI.exe
  2⤵
  PID:6812
- C:\Windows\System\RrCynfN.exe
  C:\Windows\System\RrCynfN.exe
  2⤵
  PID:6548
- C:\Windows\System\psvPHyd.exe
  C:\Windows\System\psvPHyd.exe
  2⤵
  PID:6636
- C:\Windows\System\Rbccodz.exe
  C:\Windows\System\Rbccodz.exe
  2⤵
  PID:7124
- C:\Windows\System\vhIUotZ.exe
  C:\Windows\System\vhIUotZ.exe
  2⤵
  PID:7180
- C:\Windows\System\OaBBhFs.exe
  C:\Windows\System\OaBBhFs.exe
  2⤵
  PID:7204
- C:\Windows\System\WvaDgIu.exe
  C:\Windows\System\WvaDgIu.exe
  2⤵
  PID:7228
- C:\Windows\System\wiAKNns.exe
  C:\Windows\System\wiAKNns.exe
  2⤵
  PID:7252
- C:\Windows\System\NvlqZGx.exe
  C:\Windows\System\NvlqZGx.exe
  2⤵
  PID:7284
- C:\Windows\System\xVKcnzk.exe
  C:\Windows\System\xVKcnzk.exe
  2⤵
  PID:7300
- C:\Windows\System\awkeFRF.exe
  C:\Windows\System\awkeFRF.exe
  2⤵
  PID:7328
- C:\Windows\System\qKoXIIM.exe
  C:\Windows\System\qKoXIIM.exe
  2⤵
  PID:7352
- C:\Windows\System\IoBhsHg.exe
  C:\Windows\System\IoBhsHg.exe
  2⤵
  PID:7372
- C:\Windows\System\eeYuYNv.exe
  C:\Windows\System\eeYuYNv.exe
  2⤵
  PID:7392
- C:\Windows\System\OllyrNX.exe
  C:\Windows\System\OllyrNX.exe
  2⤵
  PID:7412
- C:\Windows\System\yRPeYho.exe
  C:\Windows\System\yRPeYho.exe
  2⤵
  PID:7436
- C:\Windows\System\qTRmiKW.exe
  C:\Windows\System\qTRmiKW.exe
  2⤵
  PID:7460
- C:\Windows\System\QDsUiuK.exe
  C:\Windows\System\QDsUiuK.exe
  2⤵
  PID:7484
- C:\Windows\System\NeXbLho.exe
  C:\Windows\System\NeXbLho.exe
  2⤵
  PID:7504
- C:\Windows\System\xCkbpOe.exe
  C:\Windows\System\xCkbpOe.exe
  2⤵
  PID:7528
- C:\Windows\System\jnlOAYz.exe
  C:\Windows\System\jnlOAYz.exe
  2⤵
  PID:7544
- C:\Windows\System\NkiBhlL.exe
  C:\Windows\System\NkiBhlL.exe
  2⤵
  PID:7568
- C:\Windows\System\mMLcosS.exe
  C:\Windows\System\mMLcosS.exe
  2⤵
  PID:7600
- C:\Windows\System\dcEoRJO.exe
  C:\Windows\System\dcEoRJO.exe
  2⤵
  PID:7624
- C:\Windows\System\cRvwJpP.exe
  C:\Windows\System\cRvwJpP.exe
  2⤵
  PID:7640
- C:\Windows\System\CbxJfvH.exe
  C:\Windows\System\CbxJfvH.exe
  2⤵
  PID:7660
- C:\Windows\System\wOXScQO.exe
  C:\Windows\System\wOXScQO.exe
  2⤵
  PID:7688
- C:\Windows\System\bDiZnUD.exe
  C:\Windows\System\bDiZnUD.exe
  2⤵
  PID:7708
- C:\Windows\System\HdpOkIl.exe
  C:\Windows\System\HdpOkIl.exe
  2⤵
  PID:7732
- C:\Windows\System\RTSEbHI.exe
  C:\Windows\System\RTSEbHI.exe
  2⤵
  PID:7756
- C:\Windows\System\EWEhDhM.exe
  C:\Windows\System\EWEhDhM.exe
  2⤵
  PID:7776
- C:\Windows\System\lhjyzyK.exe
  C:\Windows\System\lhjyzyK.exe
  2⤵
  PID:7800
- C:\Windows\System\gRjaYCj.exe
  C:\Windows\System\gRjaYCj.exe
  2⤵
  PID:7824
- C:\Windows\System\wyYAVcv.exe
  C:\Windows\System\wyYAVcv.exe
  2⤵
  PID:7848
- C:\Windows\System\CSybxpv.exe
  C:\Windows\System\CSybxpv.exe
  2⤵
  PID:7876
- C:\Windows\System\gyRGsUN.exe
  C:\Windows\System\gyRGsUN.exe
  2⤵
  PID:7908
- C:\Windows\System\VNjSpxF.exe
  C:\Windows\System\VNjSpxF.exe
  2⤵
  PID:7928
- C:\Windows\System\vtzymMU.exe
  C:\Windows\System\vtzymMU.exe
  2⤵
  PID:7952
- C:\Windows\System\rdzyOIP.exe
  C:\Windows\System\rdzyOIP.exe
  2⤵
  PID:7972
- C:\Windows\System\WgbnZyg.exe
  C:\Windows\System\WgbnZyg.exe
  2⤵
  PID:8000
- C:\Windows\System\XRRePvU.exe
  C:\Windows\System\XRRePvU.exe
  2⤵
  PID:8024
- C:\Windows\System\GDhtlpd.exe
  C:\Windows\System\GDhtlpd.exe
  2⤵
  PID:8048
- C:\Windows\System\MKwYxWK.exe
  C:\Windows\System\MKwYxWK.exe
  2⤵
  PID:8072
- C:\Windows\System\dzuCkDr.exe
  C:\Windows\System\dzuCkDr.exe
  2⤵
  PID:8088
- C:\Windows\System\rdLIVod.exe
  C:\Windows\System\rdLIVod.exe
  2⤵
  PID:8116
- C:\Windows\System\iMBXQhn.exe
  C:\Windows\System\iMBXQhn.exe
  2⤵
  PID:8136
- C:\Windows\System\aeWkvCg.exe
  C:\Windows\System\aeWkvCg.exe
  2⤵
  PID:8152
- C:\Windows\System\SRhIgBy.exe
  C:\Windows\System\SRhIgBy.exe
  2⤵
  PID:8172
- C:\Windows\System\pItPMnS.exe
  C:\Windows\System\pItPMnS.exe
  2⤵
  PID:5564
- C:\Windows\System\VJfMJPf.exe
  C:\Windows\System\VJfMJPf.exe
  2⤵
  PID:4336
- C:\Windows\System\EjjITck.exe
  C:\Windows\System\EjjITck.exe
  2⤵
  PID:6472
- C:\Windows\System\fNdjPTR.exe
  C:\Windows\System\fNdjPTR.exe
  2⤵
  PID:6392
- C:\Windows\System\zoPhcIz.exe
  C:\Windows\System\zoPhcIz.exe
  2⤵
  PID:6976
- C:\Windows\System\vUZxrkS.exe
  C:\Windows\System\vUZxrkS.exe
  2⤵
  PID:7020
- C:\Windows\System\HZwbJaV.exe
  C:\Windows\System\HZwbJaV.exe
  2⤵
  PID:7060
- C:\Windows\System\WyFjoRG.exe
  C:\Windows\System\WyFjoRG.exe
  2⤵
  PID:7100
- C:\Windows\System\vLqiYNa.exe
  C:\Windows\System\vLqiYNa.exe
  2⤵
  PID:6232
- C:\Windows\System\HHHgseF.exe
  C:\Windows\System\HHHgseF.exe
  2⤵
  PID:3684
- C:\Windows\System\tylgvdf.exe
  C:\Windows\System\tylgvdf.exe
  2⤵
  PID:7308
- C:\Windows\System\HUEoqMk.exe
  C:\Windows\System\HUEoqMk.exe
  2⤵
  PID:220
- C:\Windows\System\mnyvoTT.exe
  C:\Windows\System\mnyvoTT.exe
  2⤵
  PID:7448
- C:\Windows\System\CJaiHWk.exe
  C:\Windows\System\CJaiHWk.exe
  2⤵
  PID:6704
- C:\Windows\System\sZtQyhw.exe
  C:\Windows\System\sZtQyhw.exe
  2⤵
  PID:6740
- C:\Windows\System\UOaHdVu.exe
  C:\Windows\System\UOaHdVu.exe
  2⤵
  PID:7240
- C:\Windows\System\KfIBpuE.exe
  C:\Windows\System\KfIBpuE.exe
  2⤵
  PID:7636
- C:\Windows\System\vjdeOne.exe
  C:\Windows\System\vjdeOne.exe
  2⤵
  PID:7280
- C:\Windows\System\qPxEITM.exe
  C:\Windows\System\qPxEITM.exe
  2⤵
  PID:6432
- C:\Windows\System\YENySiI.exe
  C:\Windows\System\YENySiI.exe
  2⤵
  PID:7296
- C:\Windows\System\uNZOtCd.exe
  C:\Windows\System\uNZOtCd.exe
  2⤵
  PID:7400
- C:\Windows\System\DAcaRcX.exe
  C:\Windows\System\DAcaRcX.exe
  2⤵
  PID:7916
- C:\Windows\System\AMcIeuo.exe
  C:\Windows\System\AMcIeuo.exe
  2⤵
  PID:7980
- C:\Windows\System\tUxHxPC.exe
  C:\Windows\System\tUxHxPC.exe
  2⤵
  PID:7472
- C:\Windows\System\kuGCfTb.exe
  C:\Windows\System\kuGCfTb.exe
  2⤵
  PID:7536
- C:\Windows\System\MLzqKHo.exe
  C:\Windows\System\MLzqKHo.exe
  2⤵
  PID:8068
- C:\Windows\System\zOzyRHZ.exe
  C:\Windows\System\zOzyRHZ.exe
  2⤵
  PID:8124
- C:\Windows\System\YjdwZAZ.exe
  C:\Windows\System\YjdwZAZ.exe
  2⤵
  PID:8164
- C:\Windows\System\XIdBRGw.exe
  C:\Windows\System\XIdBRGw.exe
  2⤵
  PID:6852
- C:\Windows\System\BYUvlTM.exe
  C:\Windows\System\BYUvlTM.exe
  2⤵
  PID:6476
- C:\Windows\System\ohrdEZJ.exe
  C:\Windows\System\ohrdEZJ.exe
  2⤵
  PID:8200
- C:\Windows\System\OOVnTOY.exe
  C:\Windows\System\OOVnTOY.exe
  2⤵
  PID:8224
- C:\Windows\System\DgEYRzq.exe
  C:\Windows\System\DgEYRzq.exe
  2⤵
  PID:8248
- C:\Windows\System\kKLIZde.exe
  C:\Windows\System\kKLIZde.exe
  2⤵
  PID:8276
- C:\Windows\System\EVhwCdZ.exe
  C:\Windows\System\EVhwCdZ.exe
  2⤵
  PID:8296
- C:\Windows\System\fxvRtaD.exe
  C:\Windows\System\fxvRtaD.exe
  2⤵
  PID:8328
- C:\Windows\System\yMZbgnV.exe
  C:\Windows\System\yMZbgnV.exe
  2⤵
  PID:8356
- C:\Windows\System\SoSeLLG.exe
  C:\Windows\System\SoSeLLG.exe
  2⤵
  PID:8380
- C:\Windows\System\WiBAaID.exe
  C:\Windows\System\WiBAaID.exe
  2⤵
  PID:8396
- C:\Windows\System\WzMrsya.exe
  C:\Windows\System\WzMrsya.exe
  2⤵
  PID:8416
- C:\Windows\System\bSAhuWT.exe
  C:\Windows\System\bSAhuWT.exe
  2⤵
  PID:8440
- C:\Windows\System\ERPgIOb.exe
  C:\Windows\System\ERPgIOb.exe
  2⤵
  PID:8460
- C:\Windows\System\NuUxggU.exe
  C:\Windows\System\NuUxggU.exe
  2⤵
  PID:8480
- C:\Windows\System\cVeAwBT.exe
  C:\Windows\System\cVeAwBT.exe
  2⤵
  PID:8496
- C:\Windows\System\EYtZZeH.exe
  C:\Windows\System\EYtZZeH.exe
  2⤵
  PID:8512
- C:\Windows\System\lgBunRm.exe
  C:\Windows\System\lgBunRm.exe
  2⤵
  PID:8536
- C:\Windows\System\sOZcYRl.exe
  C:\Windows\System\sOZcYRl.exe
  2⤵
  PID:8556
- C:\Windows\System\EBKDfTi.exe
  C:\Windows\System\EBKDfTi.exe
  2⤵
  PID:8584
- C:\Windows\System\SSiizUF.exe
  C:\Windows\System\SSiizUF.exe
  2⤵
  PID:8604
- C:\Windows\System\DldWbcf.exe
  C:\Windows\System\DldWbcf.exe
  2⤵
  PID:8624
- C:\Windows\System\hECmJeo.exe
  C:\Windows\System\hECmJeo.exe
  2⤵
  PID:8652
- C:\Windows\System\otrVrMk.exe
  C:\Windows\System\otrVrMk.exe
  2⤵
  PID:8676
- C:\Windows\System\mCBcjvm.exe
  C:\Windows\System\mCBcjvm.exe
  2⤵
  PID:8696
- C:\Windows\System\hFiJLWR.exe
  C:\Windows\System\hFiJLWR.exe
  2⤵
  PID:8720
- C:\Windows\System\cObavrx.exe
  C:\Windows\System\cObavrx.exe
  2⤵
  PID:8748
- C:\Windows\System\ZWyqQaa.exe
  C:\Windows\System\ZWyqQaa.exe
  2⤵
  PID:8772
- C:\Windows\System\YsCqtdC.exe
  C:\Windows\System\YsCqtdC.exe
  2⤵
  PID:8792
- C:\Windows\System\suawIPu.exe
  C:\Windows\System\suawIPu.exe
  2⤵
  PID:8812
- C:\Windows\System\fFGsuGP.exe
  C:\Windows\System\fFGsuGP.exe
  2⤵
  PID:8836
- C:\Windows\System\rEtSIfA.exe
  C:\Windows\System\rEtSIfA.exe
  2⤵
  PID:8856
- C:\Windows\System\klFBgjA.exe
  C:\Windows\System\klFBgjA.exe
  2⤵
  PID:8876
- C:\Windows\System\wTEjhQF.exe
  C:\Windows\System\wTEjhQF.exe
  2⤵
  PID:8900
- C:\Windows\System\ZUQLqtx.exe
  C:\Windows\System\ZUQLqtx.exe
  2⤵
  PID:8924
- C:\Windows\System\SPHcgAb.exe
  C:\Windows\System\SPHcgAb.exe
  2⤵
  PID:8944
- C:\Windows\System\GfNFUvc.exe
  C:\Windows\System\GfNFUvc.exe
  2⤵
  PID:8964
- C:\Windows\System\WPYezWB.exe
  C:\Windows\System\WPYezWB.exe
  2⤵
  PID:8988
- C:\Windows\System\wMObMMo.exe
  C:\Windows\System\wMObMMo.exe
  2⤵
  PID:9012
- C:\Windows\System\NmptHmw.exe
  C:\Windows\System\NmptHmw.exe
  2⤵
  PID:9036
- C:\Windows\System\WrXSEJx.exe
  C:\Windows\System\WrXSEJx.exe
  2⤵
  PID:9060
- C:\Windows\System\wmKjBNe.exe
  C:\Windows\System\wmKjBNe.exe
  2⤵
  PID:9080
- C:\Windows\System\mXtdbPS.exe
  C:\Windows\System\mXtdbPS.exe
  2⤵
  PID:9096
- C:\Windows\System\gMbQdjN.exe
  C:\Windows\System\gMbQdjN.exe
  2⤵
  PID:9116
- C:\Windows\System\oxVGIvJ.exe
  C:\Windows\System\oxVGIvJ.exe
  2⤵
  PID:9144
- C:\Windows\System\UflzpEG.exe
  C:\Windows\System\UflzpEG.exe
  2⤵
  PID:9168
- C:\Windows\System\ZTivnvx.exe
  C:\Windows\System\ZTivnvx.exe
  2⤵
  PID:9196
- C:\Windows\System\HmYynrc.exe
  C:\Windows\System\HmYynrc.exe
  2⤵
  PID:9212
- C:\Windows\System\txMNsFc.exe
  C:\Windows\System\txMNsFc.exe
  2⤵
  PID:7808
- C:\Windows\System\hDUOeBi.exe
  C:\Windows\System\hDUOeBi.exe
  2⤵
  PID:7856
- C:\Windows\System\kjvFQsv.exe
  C:\Windows\System\kjvFQsv.exe
  2⤵
  PID:7516
- C:\Windows\System\avVcupX.exe
  C:\Windows\System\avVcupX.exe
  2⤵
  PID:7188
- C:\Windows\System\YKgFVER.exe
  C:\Windows\System\YKgFVER.exe
  2⤵
  PID:7864
- C:\Windows\System\IGMxLzd.exe
  C:\Windows\System\IGMxLzd.exe
  2⤵
  PID:8132
- C:\Windows\System\mxHVABk.exe
  C:\Windows\System\mxHVABk.exe
  2⤵
  PID:7500
- C:\Windows\System\gJYhyuY.exe
  C:\Windows\System\gJYhyuY.exe
  2⤵
  PID:7028
- C:\Windows\System\DUKIvub.exe
  C:\Windows\System\DUKIvub.exe
  2⤵
  PID:7652
- C:\Windows\System\NWVdraN.exe
  C:\Windows\System\NWVdraN.exe
  2⤵
  PID:7044
- C:\Windows\System\bCUnibb.exe
  C:\Windows\System\bCUnibb.exe
  2⤵
  PID:8256
- C:\Windows\System\BtjwXsT.exe
  C:\Windows\System\BtjwXsT.exe
  2⤵
  PID:8340
- C:\Windows\System\EoqdUGx.exe
  C:\Windows\System\EoqdUGx.exe
  2⤵
  PID:8436
- C:\Windows\System\NgkBLvX.exe
  C:\Windows\System\NgkBLvX.exe
  2⤵
  PID:8528
- C:\Windows\System\inJuKhj.exe
  C:\Windows\System\inJuKhj.exe
  2⤵
  PID:8592
- C:\Windows\System\wIrHBGy.exe
  C:\Windows\System\wIrHBGy.exe
  2⤵
  PID:7764
- C:\Windows\System\WPAUXSJ.exe
  C:\Windows\System\WPAUXSJ.exe
  2⤵
  PID:9236
- C:\Windows\System\CvqyCct.exe
  C:\Windows\System\CvqyCct.exe
  2⤵
  PID:9256
- C:\Windows\System\PtiZELg.exe
  C:\Windows\System\PtiZELg.exe
  2⤵
  PID:9276
- C:\Windows\System\WJnDPkz.exe
  C:\Windows\System\WJnDPkz.exe
  2⤵
  PID:9300
- C:\Windows\System\lFVfPjf.exe
  C:\Windows\System\lFVfPjf.exe
  2⤵
  PID:9320
- C:\Windows\System\zsuMSIY.exe
  C:\Windows\System\zsuMSIY.exe
  2⤵
  PID:9344
- C:\Windows\System\ytjVpdE.exe
  C:\Windows\System\ytjVpdE.exe
  2⤵
  PID:9364
- C:\Windows\System\OZokjUU.exe
  C:\Windows\System\OZokjUU.exe
  2⤵
  PID:9388
- C:\Windows\System\AspEFaQ.exe
  C:\Windows\System\AspEFaQ.exe
  2⤵
  PID:9412
- C:\Windows\System\joxgzvs.exe
  C:\Windows\System\joxgzvs.exe
  2⤵
  PID:9432
- C:\Windows\System\HxphfGE.exe
  C:\Windows\System\HxphfGE.exe
  2⤵
  PID:9452
- C:\Windows\System\ugLuzUv.exe
  C:\Windows\System\ugLuzUv.exe
  2⤵
  PID:9476
- C:\Windows\System\boSUCFa.exe
  C:\Windows\System\boSUCFa.exe
  2⤵
  PID:9504
- C:\Windows\System\EBBMRHd.exe
  C:\Windows\System\EBBMRHd.exe
  2⤵
  PID:9532
- C:\Windows\System\hYyzQsn.exe
  C:\Windows\System\hYyzQsn.exe
  2⤵
  PID:9552
- C:\Windows\System\TEpJZpv.exe
  C:\Windows\System\TEpJZpv.exe
  2⤵
  PID:9576
- C:\Windows\System\MeIZglD.exe
  C:\Windows\System\MeIZglD.exe
  2⤵
  PID:9600
- C:\Windows\System\CieYSSA.exe
  C:\Windows\System\CieYSSA.exe
  2⤵
  PID:9616
- C:\Windows\System\oPUGgne.exe
  C:\Windows\System\oPUGgne.exe
  2⤵
  PID:9644
- C:\Windows\System\KkpsUlD.exe
  C:\Windows\System\KkpsUlD.exe
  2⤵
  PID:9664
- C:\Windows\System\ZPaqZZz.exe
  C:\Windows\System\ZPaqZZz.exe
  2⤵
  PID:9688
- C:\Windows\System\KoPEewx.exe
  C:\Windows\System\KoPEewx.exe
  2⤵
  PID:9712
- C:\Windows\System\KSSwTDs.exe
  C:\Windows\System\KSSwTDs.exe
  2⤵
  PID:9740
- C:\Windows\System\ABYiJzm.exe
  C:\Windows\System\ABYiJzm.exe
  2⤵
  PID:9756
- C:\Windows\System\rqKKpXh.exe
  C:\Windows\System\rqKKpXh.exe
  2⤵
  PID:9772
- C:\Windows\System\wBYkgfR.exe
  C:\Windows\System\wBYkgfR.exe
  2⤵
  PID:9792
- C:\Windows\System\VIWbvJM.exe
  C:\Windows\System\VIWbvJM.exe
  2⤵
  PID:9808
- C:\Windows\System\HCCtAgi.exe
  C:\Windows\System\HCCtAgi.exe
  2⤵
  PID:9836
- C:\Windows\System\TPFTFWU.exe
  C:\Windows\System\TPFTFWU.exe
  2⤵
  PID:9856
- C:\Windows\System\hIbGVSh.exe
  C:\Windows\System\hIbGVSh.exe
  2⤵
  PID:9876
- C:\Windows\System\enwgEvq.exe
  C:\Windows\System\enwgEvq.exe
  2⤵
  PID:9896
- C:\Windows\System\FeSHfbx.exe
  C:\Windows\System\FeSHfbx.exe
  2⤵
  PID:9920
- C:\Windows\System\MbjGprs.exe
  C:\Windows\System\MbjGprs.exe
  2⤵
  PID:9948
- C:\Windows\System\fmyEUiq.exe
  C:\Windows\System\fmyEUiq.exe
  2⤵
  PID:9968
- C:\Windows\System\UzRgYWy.exe
  C:\Windows\System\UzRgYWy.exe
  2⤵
  PID:9996
- C:\Windows\System\tvBrsxb.exe
  C:\Windows\System\tvBrsxb.exe
  2⤵
  PID:10016
- C:\Windows\System\waPpsrv.exe
  C:\Windows\System\waPpsrv.exe
  2⤵
  PID:10032
- C:\Windows\System\eUaPSSa.exe
  C:\Windows\System\eUaPSSa.exe
  2⤵
  PID:10056
- C:\Windows\System\wMTlZJK.exe
  C:\Windows\System\wMTlZJK.exe
  2⤵
  PID:10080
- C:\Windows\System\JMzpbUf.exe
  C:\Windows\System\JMzpbUf.exe
  2⤵
  PID:10100
- C:\Windows\System\cAYDGKm.exe
  C:\Windows\System\cAYDGKm.exe
  2⤵
  PID:10124
- C:\Windows\System\SpKGLxj.exe
  C:\Windows\System\SpKGLxj.exe
  2⤵
  PID:10144
- C:\Windows\System\KalNEzH.exe
  C:\Windows\System\KalNEzH.exe
  2⤵
  PID:10164
- C:\Windows\System\OEtYnuB.exe
  C:\Windows\System\OEtYnuB.exe
  2⤵
  PID:10184
- C:\Windows\System\LvHsjrY.exe
  C:\Windows\System\LvHsjrY.exe
  2⤵
  PID:10208
- C:\Windows\System\gkzaAjl.exe
  C:\Windows\System\gkzaAjl.exe
  2⤵
  PID:10228
- C:\Windows\System\parxgyi.exe
  C:\Windows\System\parxgyi.exe
  2⤵
  PID:8704
- C:\Windows\System\UaKKzgA.exe
  C:\Windows\System\UaKKzgA.exe
  2⤵
  PID:8760
- C:\Windows\System\byWSJET.exe
  C:\Windows\System\byWSJET.exe
  2⤵
  PID:8108
- C:\Windows\System\VWIUljw.exe
  C:\Windows\System\VWIUljw.exe
  2⤵
  PID:8868
- C:\Windows\System\JCbTquq.exe
  C:\Windows\System\JCbTquq.exe
  2⤵
  PID:6164
- C:\Windows\System\wrIwDVW.exe
  C:\Windows\System\wrIwDVW.exe
  2⤵
  PID:3864
- C:\Windows\System\oZFKZUx.exe
  C:\Windows\System\oZFKZUx.exe
  2⤵
  PID:7196
- C:\Windows\System\MLsdcgv.exe
  C:\Windows\System\MLsdcgv.exe
  2⤵
  PID:9068
- C:\Windows\System\tKVpoWD.exe
  C:\Windows\System\tKVpoWD.exe
  2⤵
  PID:6336
- C:\Windows\System\lrWbGwd.exe
  C:\Windows\System\lrWbGwd.exe
  2⤵
  PID:8324
- C:\Windows\System\ktEqaob.exe
  C:\Windows\System\ktEqaob.exe
  2⤵
  PID:8348
- C:\Windows\System\phUmRWo.exe
  C:\Windows\System\phUmRWo.exe
  2⤵
  PID:9176
- C:\Windows\System\LoyHGuB.exe
  C:\Windows\System\LoyHGuB.exe
  2⤵
  PID:7344
- C:\Windows\System\lINwFym.exe
  C:\Windows\System\lINwFym.exe
  2⤵
  PID:8412
- C:\Windows\System\BklRAcL.exe
  C:\Windows\System\BklRAcL.exe
  2⤵
  PID:7940
- C:\Windows\System\qvOfosz.exe
  C:\Windows\System\qvOfosz.exe
  2⤵
  PID:5548
- C:\Windows\System\YmHpRgT.exe
  C:\Windows\System\YmHpRgT.exe
  2⤵
  PID:8492
- C:\Windows\System\dDjfoGw.exe
  C:\Windows\System\dDjfoGw.exe
  2⤵
  PID:8236
- C:\Windows\System\fwgPCOF.exe
  C:\Windows\System\fwgPCOF.exe
  2⤵
  PID:8376
- C:\Windows\System\MnvOpHb.exe
  C:\Windows\System\MnvOpHb.exe
  2⤵
  PID:8456
- C:\Windows\System\AqwGIXb.exe
  C:\Windows\System\AqwGIXb.exe
  2⤵
  PID:8664
- C:\Windows\System\MjZuMyb.exe
  C:\Windows\System\MjZuMyb.exe
  2⤵
  PID:8732
- C:\Windows\System\UnYAsGI.exe
  C:\Windows\System\UnYAsGI.exe
  2⤵
  PID:7492
- C:\Windows\System\gAqTYAs.exe
  C:\Windows\System\gAqTYAs.exe
  2⤵
  PID:7580
- C:\Windows\System\ndxZBSS.exe
  C:\Windows\System\ndxZBSS.exe
  2⤵
  PID:8848
- C:\Windows\System\rVHEJNp.exe
  C:\Windows\System\rVHEJNp.exe
  2⤵
  PID:8916
- C:\Windows\System\lLKFHhq.exe
  C:\Windows\System\lLKFHhq.exe
  2⤵
  PID:8956
- C:\Windows\System\OJRsXOf.exe
  C:\Windows\System\OJRsXOf.exe
  2⤵
  PID:9684
- C:\Windows\System\ekAngHx.exe
  C:\Windows\System\ekAngHx.exe
  2⤵
  PID:10248
- C:\Windows\System\dobgIfO.exe
  C:\Windows\System\dobgIfO.exe
  2⤵
  PID:10984
- C:\Windows\System\gPblpjd.exe
  C:\Windows\System\gPblpjd.exe
  2⤵
  PID:11016
- C:\Windows\System\rsXaIwR.exe
  C:\Windows\System\rsXaIwR.exe
  2⤵
  PID:11036
- C:\Windows\System\ExXheZp.exe
  C:\Windows\System\ExXheZp.exe
  2⤵
  PID:11064
- C:\Windows\System\KbGkRsj.exe
  C:\Windows\System\KbGkRsj.exe
  2⤵
  PID:11084
- C:\Windows\System\kqssUQS.exe
  C:\Windows\System\kqssUQS.exe
  2⤵
  PID:11116
- C:\Windows\System\YtpZwJj.exe
  C:\Windows\System\YtpZwJj.exe
  2⤵
  PID:11148
- C:\Windows\System\ScNxLkD.exe
  C:\Windows\System\ScNxLkD.exe
  2⤵
  PID:11176
- C:\Windows\System\UxwIjIz.exe
  C:\Windows\System\UxwIjIz.exe
  2⤵
  PID:11204
- C:\Windows\System\ZVFhyIG.exe
  C:\Windows\System\ZVFhyIG.exe
  2⤵
  PID:11232
- C:\Windows\System\TAMxGxC.exe
  C:\Windows\System\TAMxGxC.exe
  2⤵
  PID:11260
- C:\Windows\System\buimSKO.exe
  C:\Windows\System\buimSKO.exe
  2⤵
  PID:9820
- C:\Windows\System\SReMmYd.exe
  C:\Windows\System\SReMmYd.exe
  2⤵
  PID:7816
- C:\Windows\System\LkcoRaC.exe
  C:\Windows\System\LkcoRaC.exe
  2⤵
  PID:10068
- C:\Windows\System\oqEyvXm.exe
  C:\Windows\System\oqEyvXm.exe
  2⤵
  PID:8552
- C:\Windows\System\kCoyKSi.exe
  C:\Windows\System\kCoyKSi.exe
  2⤵
  PID:10224
- C:\Windows\System\wMeTWuA.exe
  C:\Windows\System\wMeTWuA.exe
  2⤵
  PID:8060
- C:\Windows\System\CfOyxlD.exe
  C:\Windows\System\CfOyxlD.exe
  2⤵
  PID:8768
- C:\Windows\System\FNsUTan.exe
  C:\Windows\System\FNsUTan.exe
  2⤵
  PID:9380
- C:\Windows\System\EQXzncv.exe
  C:\Windows\System\EQXzncv.exe
  2⤵
  PID:9424
- C:\Windows\System\xVyaixC.exe
  C:\Windows\System\xVyaixC.exe
  2⤵
  PID:2300
- C:\Windows\System\jAFnLvT.exe
  C:\Windows\System\jAFnLvT.exe
  2⤵
  PID:8832
- C:\Windows\System\gmZPTbT.exe
  C:\Windows\System\gmZPTbT.exe
  2⤵
  PID:9732
- C:\Windows\System\aaPPRqH.exe
  C:\Windows\System\aaPPRqH.exe
  2⤵
  PID:9124
- C:\Windows\System\bXPXWNU.exe
  C:\Windows\System\bXPXWNU.exe
  2⤵
  PID:7084
- C:\Windows\System\ESQbThZ.exe
  C:\Windows\System\ESQbThZ.exe
  2⤵
  PID:10092
- C:\Windows\System\RzDkbGd.exe
  C:\Windows\System\RzDkbGd.exe
  2⤵
  PID:6972
- C:\Windows\System\OLnzMyW.exe
  C:\Windows\System\OLnzMyW.exe
  2⤵
  PID:7924
- C:\Windows\System\qvXiLoi.exe
  C:\Windows\System\qvXiLoi.exe
  2⤵
  PID:8996
- C:\Windows\System\tkIvdsh.exe
  C:\Windows\System\tkIvdsh.exe
  2⤵
  PID:9160
- C:\Windows\System\WQjPBnX.exe
  C:\Windows\System\WQjPBnX.exe
  2⤵
  PID:9448
- C:\Windows\System\TyfbgFp.exe
  C:\Windows\System\TyfbgFp.exe
  2⤵
  PID:9512
- C:\Windows\System\bcjwnRD.exe
  C:\Windows\System\bcjwnRD.exe
  2⤵
  PID:9292
- C:\Windows\System\niCLyGM.exe
  C:\Windows\System\niCLyGM.exe
  2⤵
  PID:9352
- C:\Windows\System\XphRTzG.exe
  C:\Windows\System\XphRTzG.exe
  2⤵
  PID:9656
- C:\Windows\System\fdBjSBF.exe
  C:\Windows\System\fdBjSBF.exe
  2⤵
  PID:8936
- C:\Windows\System\NdizmQU.exe
  C:\Windows\System\NdizmQU.exe
  2⤵
  PID:9720
- C:\Windows\System\IGgvzAU.exe
  C:\Windows\System\IGgvzAU.exe
  2⤵
  PID:9804
- C:\Windows\System\hJGLiHz.exe
  C:\Windows\System\hJGLiHz.exe
  2⤵
  PID:11280
- C:\Windows\System\sxpfPvl.exe
  C:\Windows\System\sxpfPvl.exe
  2⤵
  PID:11308
- C:\Windows\System\dOLYiyP.exe
  C:\Windows\System\dOLYiyP.exe
  2⤵
  PID:11328
- C:\Windows\System\gGFuAiG.exe
  C:\Windows\System\gGFuAiG.exe
  2⤵
  PID:11348
- C:\Windows\System\rvzEbRC.exe
  C:\Windows\System\rvzEbRC.exe
  2⤵
  PID:11372
- C:\Windows\System\wiAMBZk.exe
  C:\Windows\System\wiAMBZk.exe
  2⤵
  PID:11388
- C:\Windows\System\TuFNZxH.exe
  C:\Windows\System\TuFNZxH.exe
  2⤵
  PID:11404
- C:\Windows\System\vwOAuql.exe
  C:\Windows\System\vwOAuql.exe
  2⤵
  PID:11420
- C:\Windows\System\uNxEilH.exe
  C:\Windows\System\uNxEilH.exe
  2⤵
  PID:11436
- C:\Windows\System\oLKJxYH.exe
  C:\Windows\System\oLKJxYH.exe
  2⤵
  PID:11460
- C:\Windows\System\HWOQNsb.exe
  C:\Windows\System\HWOQNsb.exe
  2⤵
  PID:11480
- C:\Windows\System\nkVnYxO.exe
  C:\Windows\System\nkVnYxO.exe
  2⤵
  PID:11496
- C:\Windows\System\mGTMPyB.exe
  C:\Windows\System\mGTMPyB.exe
  2⤵
  PID:11524
- C:\Windows\System\mgKwVre.exe
  C:\Windows\System\mgKwVre.exe
  2⤵
  PID:11560
- C:\Windows\System\LeaxyeJ.exe
  C:\Windows\System\LeaxyeJ.exe
  2⤵
  PID:11588
- C:\Windows\System\wZsmnTv.exe
  C:\Windows\System\wZsmnTv.exe
  2⤵
  PID:11644
- C:\Windows\System\rDJTzhU.exe
  C:\Windows\System\rDJTzhU.exe
  2⤵
  PID:11668
- C:\Windows\System\igTWmqK.exe
  C:\Windows\System\igTWmqK.exe
  2⤵
  PID:11688
- C:\Windows\System\affxiNK.exe
  C:\Windows\System\affxiNK.exe
  2⤵
  PID:11708
- C:\Windows\System\IlCnYnE.exe
  C:\Windows\System\IlCnYnE.exe
  2⤵
  PID:11736
- C:\Windows\System\tuZeXgC.exe
  C:\Windows\System\tuZeXgC.exe
  2⤵
  PID:11756
- C:\Windows\System\PrfgjYx.exe
  C:\Windows\System\PrfgjYx.exe
  2⤵
  PID:11780
- C:\Windows\System\giobZkq.exe
  C:\Windows\System\giobZkq.exe
  2⤵
  PID:11804
- C:\Windows\System\WYrKLaO.exe
  C:\Windows\System\WYrKLaO.exe
  2⤵
  PID:11836
- C:\Windows\System\OTUyZIV.exe
  C:\Windows\System\OTUyZIV.exe
  2⤵
  PID:11856
- C:\Windows\System\BIhMLjO.exe
  C:\Windows\System\BIhMLjO.exe
  2⤵
  PID:11880
- C:\Windows\System\jXDmaeU.exe
  C:\Windows\System\jXDmaeU.exe
  2⤵
  PID:11896
- C:\Windows\System\beyTzvB.exe
  C:\Windows\System\beyTzvB.exe
  2⤵
  PID:11928
- C:\Windows\System\quRhcyv.exe
  C:\Windows\System\quRhcyv.exe
  2⤵
  PID:11956
- C:\Windows\System\OtBzRbt.exe
  C:\Windows\System\OtBzRbt.exe
  2⤵
  PID:11972
- C:\Windows\System\GkhggpQ.exe
  C:\Windows\System\GkhggpQ.exe
  2⤵
  PID:11996
- C:\Windows\System\WJYaQUq.exe
  C:\Windows\System\WJYaQUq.exe
  2⤵
  PID:12016
- C:\Windows\System\wNaLVup.exe
  C:\Windows\System\wNaLVup.exe
  2⤵
  PID:12040
- C:\Windows\System\JKwiNAg.exe
  C:\Windows\System\JKwiNAg.exe
  2⤵
  PID:12068
- C:\Windows\System\IpLYubR.exe
  C:\Windows\System\IpLYubR.exe
  2⤵
  PID:12092
- C:\Windows\System\WkCFOWB.exe
  C:\Windows\System\WkCFOWB.exe
  2⤵
  PID:12116
- C:\Windows\System\wUKxTLU.exe
  C:\Windows\System\wUKxTLU.exe
  2⤵
  PID:12132
- C:\Windows\System\LpisKVJ.exe
  C:\Windows\System\LpisKVJ.exe
  2⤵
  PID:12156
- C:\Windows\System\JurnjQx.exe
  C:\Windows\System\JurnjQx.exe
  2⤵
  PID:12176
- C:\Windows\System\rlahtzt.exe
  C:\Windows\System\rlahtzt.exe
  2⤵
  PID:12200
- C:\Windows\System\ZcOBVtK.exe
  C:\Windows\System\ZcOBVtK.exe
  2⤵
  PID:12228
- C:\Windows\System\MVjvVVc.exe
  C:\Windows\System\MVjvVVc.exe
  2⤵
  PID:12248
- C:\Windows\System\otyUYkg.exe
  C:\Windows\System\otyUYkg.exe
  2⤵
  PID:12276
- C:\Windows\System\PXVbIzN.exe
  C:\Windows\System\PXVbIzN.exe
  2⤵
  PID:9884
- C:\Windows\System\gFOlvlz.exe
  C:\Windows\System\gFOlvlz.exe
  2⤵
  PID:9960
- C:\Windows\System\xDlqLiW.exe
  C:\Windows\System\xDlqLiW.exe
  2⤵
  PID:10024
- C:\Windows\System\tUfLnKo.exe
  C:\Windows\System\tUfLnKo.exe
  2⤵
  PID:10120
- C:\Windows\System\KjnIqlw.exe
  C:\Windows\System\KjnIqlw.exe
  2⤵
  PID:10916
- C:\Windows\System\BSfnhih.exe
  C:\Windows\System\BSfnhih.exe
  2⤵
  PID:10216
- C:\Windows\System\gWMPtII.exe
  C:\Windows\System\gWMPtII.exe
  2⤵
  PID:10460
- C:\Windows\System\EYNSROY.exe
  C:\Windows\System\EYNSROY.exe
  2⤵
  PID:8852
- C:\Windows\System\MDqPFNI.exe
  C:\Windows\System\MDqPFNI.exe
  2⤵
  PID:7128
- C:\Windows\System\ApdBgTW.exe
  C:\Windows\System\ApdBgTW.exe
  2⤵
  PID:9052
- C:\Windows\System\sMXsFEF.exe
  C:\Windows\System\sMXsFEF.exe
  2⤵
  PID:10528
- C:\Windows\System\wuVpZyZ.exe
  C:\Windows\System\wuVpZyZ.exe
  2⤵
  PID:11212
- C:\Windows\System\lrNkVyh.exe
  C:\Windows\System\lrNkVyh.exe
  2⤵
  PID:11228
- C:\Windows\System\SAXdRwA.exe
  C:\Windows\System\SAXdRwA.exe
  2⤵
  PID:7560
- C:\Windows\System\BOKeLuO.exe
  C:\Windows\System\BOKeLuO.exe
  2⤵
  PID:8388
- C:\Windows\System\rppoHQs.exe
  C:\Windows\System\rppoHQs.exe
  2⤵
  PID:10180
- C:\Windows\System\YSAUngj.exe
  C:\Windows\System\YSAUngj.exe
  2⤵
  PID:8716
- C:\Windows\System\lsEvXzl.exe
  C:\Windows\System\lsEvXzl.exe
  2⤵
  PID:7792
- C:\Windows\System\JqnRSpy.exe
  C:\Windows\System\JqnRSpy.exe
  2⤵
  PID:8576
- C:\Windows\System\cKYydOx.exe
  C:\Windows\System\cKYydOx.exe
  2⤵
  PID:9828
- C:\Windows\System\AMODzZX.exe
  C:\Windows\System\AMODzZX.exe
  2⤵
  PID:2840
- C:\Windows\System\PdaIPyZ.exe
  C:\Windows\System\PdaIPyZ.exe
  2⤵
  PID:10028
- C:\Windows\System\LRRlmeY.exe
  C:\Windows\System\LRRlmeY.exe
  2⤵
  PID:8984
- C:\Windows\System\NbDoqzu.exe
  C:\Windows\System\NbDoqzu.exe
  2⤵
  PID:10608
- C:\Windows\System\CHbnxTL.exe
  C:\Windows\System\CHbnxTL.exe
  2⤵
  PID:9748
- C:\Windows\System\CWvqvHQ.exe
  C:\Windows\System\CWvqvHQ.exe
  2⤵
  PID:11316
- C:\Windows\System\pMekbcz.exe
  C:\Windows\System\pMekbcz.exe
  2⤵
  PID:11356
- C:\Windows\System\DhXeDUQ.exe
  C:\Windows\System\DhXeDUQ.exe
  2⤵
  PID:11428
- C:\Windows\System\yKLxLFO.exe
  C:\Windows\System\yKLxLFO.exe
  2⤵
  PID:10308
- C:\Windows\System\nZYAmaB.exe
  C:\Windows\System\nZYAmaB.exe
  2⤵
  PID:10348
- C:\Windows\System\CaFAPxO.exe
  C:\Windows\System\CaFAPxO.exe
  2⤵
  PID:10816
- C:\Windows\System\ZaMMOai.exe
  C:\Windows\System\ZaMMOai.exe
  2⤵
  PID:11652
- C:\Windows\System\uhjWWww.exe
  C:\Windows\System\uhjWWww.exe
  2⤵
  PID:10956
- C:\Windows\System\NasOboq.exe
  C:\Windows\System\NasOboq.exe
  2⤵
  PID:11704
- C:\Windows\System\GhgnanW.exe
  C:\Windows\System\GhgnanW.exe
  2⤵
  PID:10992
- C:\Windows\System\HdLgHIa.exe
  C:\Windows\System\HdLgHIa.exe
  2⤵
  PID:11752
- C:\Windows\System\EHYkxJj.exe
  C:\Windows\System\EHYkxJj.exe
  2⤵
  PID:10500
- C:\Windows\System\LMeTxGi.exe
  C:\Windows\System\LMeTxGi.exe
  2⤵
  PID:11108
- C:\Windows\System\AqhfYsl.exe
  C:\Windows\System\AqhfYsl.exe
  2⤵
  PID:11868
- C:\Windows\System\nSNkFNC.exe
  C:\Windows\System\nSNkFNC.exe
  2⤵
  PID:11908
- C:\Windows\System\ZkFforZ.exe
  C:\Windows\System\ZkFforZ.exe
  2⤵
  PID:12292
- C:\Windows\System\pEhQXCy.exe
  C:\Windows\System\pEhQXCy.exe
  2⤵
  PID:12308
- C:\Windows\System\KoinuOe.exe
  C:\Windows\System\KoinuOe.exe
  2⤵
  PID:12328
- C:\Windows\System\TnLKxGD.exe
  C:\Windows\System\TnLKxGD.exe
  2⤵
  PID:12352
- C:\Windows\System\dsLxreg.exe
  C:\Windows\System\dsLxreg.exe
  2⤵
  PID:12380
- C:\Windows\System\PZhpLkc.exe
  C:\Windows\System\PZhpLkc.exe
  2⤵
  PID:12404
- C:\Windows\System\GYMJupk.exe
  C:\Windows\System\GYMJupk.exe
  2⤵
  PID:12424
- C:\Windows\System\dcPziOU.exe
  C:\Windows\System\dcPziOU.exe
  2⤵
  PID:12444
- C:\Windows\System\GyuTIWk.exe
  C:\Windows\System\GyuTIWk.exe
  2⤵
  PID:12468
- C:\Windows\System\cKYzdMH.exe
  C:\Windows\System\cKYzdMH.exe
  2⤵
  PID:12484
- C:\Windows\System\QPGBVFz.exe
  C:\Windows\System\QPGBVFz.exe
  2⤵
  PID:12504
- C:\Windows\System\oMKeGEQ.exe
  C:\Windows\System\oMKeGEQ.exe
  2⤵
  PID:12524
- C:\Windows\System\MCcceZI.exe
  C:\Windows\System\MCcceZI.exe
  2⤵
  PID:12540
- C:\Windows\System\QdqzJTc.exe
  C:\Windows\System\QdqzJTc.exe
  2⤵
  PID:12560
- C:\Windows\System\JQZsKfp.exe
  C:\Windows\System\JQZsKfp.exe
  2⤵
  PID:12580
- C:\Windows\System\sIGUvfS.exe
  C:\Windows\System\sIGUvfS.exe
  2⤵
  PID:12596
- C:\Windows\System\xztXVvQ.exe
  C:\Windows\System\xztXVvQ.exe
  2⤵
  PID:12620
- C:\Windows\System\cxjyqZt.exe
  C:\Windows\System\cxjyqZt.exe
  2⤵
  PID:12640
- C:\Windows\System\iaDdjsj.exe
  C:\Windows\System\iaDdjsj.exe
  2⤵
  PID:12664
- C:\Windows\System\JUVdazA.exe
  C:\Windows\System\JUVdazA.exe
  2⤵
  PID:12688
- C:\Windows\System\JMDuHgb.exe
  C:\Windows\System\JMDuHgb.exe
  2⤵
  PID:12708
- C:\Windows\System\sKTFvWH.exe
  C:\Windows\System\sKTFvWH.exe
  2⤵
  PID:12724
- C:\Windows\System\JhANCbT.exe
  C:\Windows\System\JhANCbT.exe
  2⤵
  PID:12752
- C:\Windows\System\DhuSjze.exe
  C:\Windows\System\DhuSjze.exe
  2⤵
  PID:12768
- C:\Windows\System\tkjhaMI.exe
  C:\Windows\System\tkjhaMI.exe
  2⤵
  PID:12784
- C:\Windows\System\HnzCjWU.exe
  C:\Windows\System\HnzCjWU.exe
  2⤵
  PID:12800
- C:\Windows\System\NJwkYkI.exe
  C:\Windows\System\NJwkYkI.exe
  2⤵
  PID:12820
- C:\Windows\System\PMPxMRh.exe
  C:\Windows\System\PMPxMRh.exe
  2⤵
  PID:12844
- C:\Windows\System\rJJkebf.exe
  C:\Windows\System\rJJkebf.exe
  2⤵
  PID:12864
- C:\Windows\System\cALZfgy.exe
  C:\Windows\System\cALZfgy.exe
  2⤵
  PID:12884
- C:\Windows\System\vfnlQdO.exe
  C:\Windows\System\vfnlQdO.exe
  2⤵
  PID:12908
- C:\Windows\System\lBXAYwW.exe
  C:\Windows\System\lBXAYwW.exe
  2⤵
  PID:12928
- C:\Windows\System\GtqIihj.exe
  C:\Windows\System\GtqIihj.exe
  2⤵
  PID:12948
- C:\Windows\System\OCHNjAN.exe
  C:\Windows\System\OCHNjAN.exe
  2⤵
  PID:12964
- C:\Windows\System\hkoNmjx.exe
  C:\Windows\System\hkoNmjx.exe
  2⤵
  PID:12988
- C:\Windows\System\splSaMx.exe
  C:\Windows\System\splSaMx.exe
  2⤵
  PID:13004
- C:\Windows\System\YceHmGo.exe
  C:\Windows\System\YceHmGo.exe
  2⤵
  PID:13024
- C:\Windows\System\AZhpcAp.exe
  C:\Windows\System\AZhpcAp.exe
  2⤵
  PID:13048
- C:\Windows\System\gPgLNuM.exe
  C:\Windows\System\gPgLNuM.exe
  2⤵
  PID:13080
- C:\Windows\System\KGfjRsz.exe
  C:\Windows\System\KGfjRsz.exe
  2⤵
  PID:13104
- C:\Windows\System\mOoLcIj.exe
  C:\Windows\System\mOoLcIj.exe
  2⤵
  PID:13120
- C:\Windows\System\ytuFxrS.exe
  C:\Windows\System\ytuFxrS.exe
  2⤵
  PID:13140
- C:\Windows\System\WNsiDml.exe
  C:\Windows\System\WNsiDml.exe
  2⤵
  PID:13156
- C:\Windows\System\BncfqbZ.exe
  C:\Windows\System\BncfqbZ.exe
  2⤵
  PID:13176
- C:\Windows\System\TVAHXaF.exe
  C:\Windows\System\TVAHXaF.exe
  2⤵
  PID:13192
- C:\Windows\System\WBcXTIU.exe
  C:\Windows\System\WBcXTIU.exe
  2⤵
  PID:13208
- C:\Windows\System\wOsAFfo.exe
  C:\Windows\System\wOsAFfo.exe
  2⤵
  PID:13224
- C:\Windows\System\oYGEgxU.exe
  C:\Windows\System\oYGEgxU.exe
  2⤵
  PID:13244
- C:\Windows\System\Nobpuzo.exe
  C:\Windows\System\Nobpuzo.exe
  2⤵
  PID:13268
- C:\Windows\System\PbHIsWE.exe
  C:\Windows\System\PbHIsWE.exe
  2⤵
  PID:13284
- C:\Windows\System\GcAXXsM.exe
  C:\Windows\System\GcAXXsM.exe
  2⤵
  PID:13304
- C:\Windows\System\TBHwUSZ.exe
  C:\Windows\System\TBHwUSZ.exe
  2⤵
  PID:12148
- C:\Windows\System\ATxRucQ.exe
  C:\Windows\System\ATxRucQ.exe
  2⤵
  PID:8268
- C:\Windows\System\WxKFRnw.exe
  C:\Windows\System\WxKFRnw.exe
  2⤵
  PID:9752
- C:\Windows\System\amtRgYY.exe
  C:\Windows\System\amtRgYY.exe
  2⤵
  PID:6772
- C:\Windows\System\axnHAyo.exe
  C:\Windows\System\axnHAyo.exe
  2⤵
  PID:9568
- C:\Windows\System\TSkjYer.exe
  C:\Windows\System\TSkjYer.exe
  2⤵
  PID:11300
- C:\Windows\System\PqmDgzl.exe
  C:\Windows\System\PqmDgzl.exe
  2⤵
  PID:11004
- C:\Windows\System\ecrRUks.exe
  C:\Windows\System\ecrRUks.exe
  2⤵
  PID:6424
- C:\Windows\System\bKBBjAE.exe
  C:\Windows\System\bKBBjAE.exe
  2⤵
  PID:10836
- C:\Windows\System\bdwqDfp.exe
  C:\Windows\System\bdwqDfp.exe
  2⤵
  PID:11224
- C:\Windows\System\NCdXOlf.exe
  C:\Windows\System\NCdXOlf.exe
  2⤵
  PID:7900
- C:\Windows\System\YVxdtkJ.exe
  C:\Windows\System\YVxdtkJ.exe
  2⤵
  PID:1240
- C:\Windows\System\PkIWmBR.exe
  C:\Windows\System\PkIWmBR.exe
  2⤵
  PID:11044
- C:\Windows\System\zYOFvOi.exe
  C:\Windows\System\zYOFvOi.exe
  2⤵
  PID:8020
- C:\Windows\System\Vvdysfc.exe
  C:\Windows\System\Vvdysfc.exe
  2⤵
  PID:8168
- C:\Windows\System\FnkaBJO.exe
  C:\Windows\System\FnkaBJO.exe
  2⤵
  PID:9472
- C:\Windows\System\PdwosvF.exe
  C:\Windows\System\PdwosvF.exe
  2⤵
  PID:11336
- C:\Windows\System\IPExZIo.exe
  C:\Windows\System\IPExZIo.exe
  2⤵
  PID:11916
- C:\Windows\System\VYAeIPr.exe
  C:\Windows\System\VYAeIPr.exe
  2⤵
  PID:11948
- C:\Windows\System\ouVREqe.exe
  C:\Windows\System\ouVREqe.exe
  2⤵
  PID:11520
- C:\Windows\System\Vsjkefu.exe
  C:\Windows\System\Vsjkefu.exe
  2⤵
  PID:10972
- C:\Windows\System\zuaEIXo.exe
  C:\Windows\System\zuaEIXo.exe
  2⤵
  PID:8316
- C:\Windows\System\NlCFvoJ.exe
  C:\Windows\System\NlCFvoJ.exe
  2⤵
  PID:12112
- C:\Windows\System\YAIaKwf.exe
  C:\Windows\System\YAIaKwf.exe
  2⤵
  PID:12396
- C:\Windows\System\DmOVrHR.exe
  C:\Windows\System\DmOVrHR.exe
  2⤵
  PID:12440
- C:\Windows\System\xSgiFSx.exe
  C:\Windows\System\xSgiFSx.exe
  2⤵
  PID:12480
- C:\Windows\System\CiPgxZv.exe
  C:\Windows\System\CiPgxZv.exe
  2⤵
  PID:12216
- C:\Windows\System\mXdArsH.exe
  C:\Windows\System\mXdArsH.exe
  2⤵
  PID:12568
- C:\Windows\System\SyiPJrE.exe
  C:\Windows\System\SyiPJrE.exe
  2⤵
  PID:10400
- C:\Windows\System\IDumwST.exe
  C:\Windows\System\IDumwST.exe
  2⤵
  PID:9572
- C:\Windows\System\XSVuxUg.exe
  C:\Windows\System\XSVuxUg.exe
  2⤵
  PID:8844
- C:\Windows\System\UqHeRsz.exe
  C:\Windows\System\UqHeRsz.exe
  2⤵
  PID:9768
- C:\Windows\System\WiisxtD.exe
  C:\Windows\System\WiisxtD.exe
  2⤵
  PID:13316
- C:\Windows\System\mnljute.exe
  C:\Windows\System\mnljute.exe
  2⤵
  PID:13340
- C:\Windows\System\nVBAolA.exe
  C:\Windows\System\nVBAolA.exe
  2⤵
  PID:13364
- C:\Windows\System\HJkxzQh.exe
  C:\Windows\System\HJkxzQh.exe
  2⤵
  PID:13388
- C:\Windows\System\FQuTkba.exe
  C:\Windows\System\FQuTkba.exe
  2⤵
  PID:13416
- C:\Windows\System\USmJXfG.exe
  C:\Windows\System\USmJXfG.exe
  2⤵
  PID:13436
- C:\Windows\System\MzFDQzA.exe
  C:\Windows\System\MzFDQzA.exe
  2⤵
  PID:13468
- C:\Windows\System\FaDSfHs.exe
  C:\Windows\System\FaDSfHs.exe
  2⤵
  PID:13492
- C:\Windows\System\OdFxUfj.exe
  C:\Windows\System\OdFxUfj.exe
  2⤵
  PID:13516
- C:\Windows\System\YGvwABY.exe
  C:\Windows\System\YGvwABY.exe
  2⤵
  PID:13540
- C:\Windows\System\IiJZLJc.exe
  C:\Windows\System\IiJZLJc.exe
  2⤵
  PID:13564
- C:\Windows\System\kggQCdv.exe
  C:\Windows\System\kggQCdv.exe
  2⤵
  PID:13588
- C:\Windows\System\IYmSlHV.exe
  C:\Windows\System\IYmSlHV.exe
  2⤵
  PID:13608
- C:\Windows\System\FPlDCWe.exe
  C:\Windows\System\FPlDCWe.exe
  2⤵
  PID:13632
- C:\Windows\System\upMZfST.exe
  C:\Windows\System\upMZfST.exe
  2⤵
  PID:13656
- C:\Windows\System\NbgmUKU.exe
  C:\Windows\System\NbgmUKU.exe
  2⤵
  PID:13672
- C:\Windows\System\AmYkXEw.exe
  C:\Windows\System\AmYkXEw.exe
  2⤵
  PID:13696
- C:\Windows\System\OEjzEtC.exe
  C:\Windows\System\OEjzEtC.exe
  2⤵
  PID:13716
- C:\Windows\System\bOxLamq.exe
  C:\Windows\System\bOxLamq.exe
  2⤵
  PID:13744
- C:\Windows\System\UQQBfcx.exe
  C:\Windows\System\UQQBfcx.exe
  2⤵
  PID:13760
- C:\Windows\System\MZZSYBY.exe
  C:\Windows\System\MZZSYBY.exe
  2⤵
  PID:13788
- C:\Windows\System\ZLunMTP.exe
  C:\Windows\System\ZLunMTP.exe
  2⤵
  PID:13812
- C:\Windows\System\jmNvQNZ.exe
  C:\Windows\System\jmNvQNZ.exe
  2⤵
  PID:13836
- C:\Windows\System\CninoLa.exe
  C:\Windows\System\CninoLa.exe
  2⤵
  PID:13860
- C:\Windows\System\WVTVnbG.exe
  C:\Windows\System\WVTVnbG.exe
  2⤵
  PID:13880
- C:\Windows\System\hMGDNnA.exe
  C:\Windows\System\hMGDNnA.exe
  2⤵
  PID:13904
- C:\Windows\System\miVriMz.exe
  C:\Windows\System\miVriMz.exe
  2⤵
  PID:13932
- C:\Windows\System\NDcpPcb.exe
  C:\Windows\System\NDcpPcb.exe
  2⤵
  PID:13956
- C:\Windows\System\iedPCAX.exe
  C:\Windows\System\iedPCAX.exe
  2⤵
  PID:13976
- C:\Windows\System\xmtdiuB.exe
  C:\Windows\System\xmtdiuB.exe
  2⤵
  PID:13996
- C:\Windows\System\IjjOute.exe
  C:\Windows\System\IjjOute.exe
  2⤵
  PID:14020
- C:\Windows\System\eMDxgZv.exe
  C:\Windows\System\eMDxgZv.exe
  2⤵
  PID:14040
- C:\Windows\System\RyogJDr.exe
  C:\Windows\System\RyogJDr.exe
  2⤵
  PID:14064
- C:\Windows\System\hHXSdAV.exe
  C:\Windows\System\hHXSdAV.exe
  2⤵
  PID:14084
- C:\Windows\System\KfVgzVP.exe
  C:\Windows\System\KfVgzVP.exe
  2⤵
  PID:14104
- C:\Windows\System\vPQAkmf.exe
  C:\Windows\System\vPQAkmf.exe
  2⤵
  PID:14128

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:11004

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:13176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DZnScky.exe

Filesize
1.7MB

MD5
2f6e4f32d7ef4411f5e448dd1cacd9b9

SHA1
a895cc2c9478df11a3c4981419639f13c18c47bf

SHA256
1c15fba0c76f7d366ccf73309a690632e7905f0a571570cc8af0ab06c387135d

SHA512
7fe4e1a7a602e71815bce5f6977ce2b9664eca8c9fb75a3a41c897a719a9ddea0c0f1eff142642e3c2f6c6453f61ff4df1d471430d1848ef47cff007dbe91d5d

Download Submit
C:\Windows\System\FYUDNFr.exe

Filesize
1.7MB

MD5
ea2c5e12b3d14f5f9d12bf125643a0b2

SHA1
9b7a570125390c725927ab8b1fd3fcbd4fdd2a4e

SHA256
729b09ddb03e50dbe243391122db8e7e678445e7f821b7d55a50489374f1ac02

SHA512
5883b6c5993b948975c888a20f862dcf6bff866cd77a874e000b965230163cc193407c33b0b2f3f79e84e4dc7e92e0ac0c06acbdcb2e4b9f19590cf846648013

Download Submit
C:\Windows\System\HSjfKmc.exe

Filesize
1.7MB

MD5
39e5d178e5c5f81c47ea59849791958a

SHA1
b40ec359255e8ecc848d28d4381f29fd89ee05f0

SHA256
9115e3b06be1d7786f5d71bf343fefb9325610aecf7c436a7426c8e9b4aea923

SHA512
9dbe23d4d35debda76857c7784646234bcfd5cb4a5327b67e213c04fc1969a95fc2724c80c4672d88923cee48e6af0bf20212563d76bd255a7ed9454890af924

Download Submit
C:\Windows\System\HpcibPT.exe

Filesize
1.7MB

MD5
4ee7ef0078effb89590646fad8215449

SHA1
348f01717e4bc14c1136fd97ce0b8fd879651984

SHA256
d7f9272b1d3faf4c1c52f3cbf3ed66b3c4a48ad4dcbc04a339df6a9adc97058f

SHA512
2577608d85bec1bc35e201da96917b97c29dc33d2436ebb0e2b1a53132e00bce7696480b9332ea22ba7ff4b866e2fddce94a13f6d0653f7b48e9d94e2f070277

Download Submit
C:\Windows\System\IFMaRse.exe

Filesize
1.7MB

MD5
7e39709e518ec7d5b88ab29709477cde

SHA1
e3455529a88ab87eb426dc6d363588edeb242d00

SHA256
ed1b320cb2a8cbd219842275681f9b76105319dd4932cb22d5c2d9d30c7fe58a

SHA512
b73ce73b9363b822eeb592c15c49773cd3e1ccbeea6188256ac82b03a60a6bc1f06478596d48e49990006af17f38baa7f0aa361e718faac341b72ca94320d4a6

Download Submit
C:\Windows\System\IjFyKkb.exe

Filesize
1.7MB

MD5
844cf40b2b1c84ab732f2c9701086dad

SHA1
f183de5f51b10fa26de0f6d6b8da5873e7356d3f

SHA256
75fda15a77a5ae7321992989d1c1331fe46e4b256dde4e83f7cddd93299a3727

SHA512
2508a20f78ac6c72c83a84fff0a77558ae3b900f24d9677ea8313cbba532d6b3293be637284a5706e30741727511c6b5856ad463a693c5070d132ee877e3b0b4

Download Submit
C:\Windows\System\JqCmUpe.exe

Filesize
1.7MB

MD5
3cd52b526bb536d23598cfbe0e53c081

SHA1
5d81b1f25f3f27e20c45277a4422e289d71538be

SHA256
2c42ae92dc98a7f817a4cd7822389590e7e7062ab84628fc6f75c0079895a5e7

SHA512
b6bf350751804f3ca66c5f4bccad009ae9c48ef6a3d0da6935f88dc9df45674114df159dcaf550c482a1aad3ce29b8e68c5fd06e7650f255ea7bd32a6953b8bf

Download Submit
C:\Windows\System\JtFRrrL.exe

Filesize
1.7MB

MD5
44c8e937b9ace0d910b440ebc0212ecc

SHA1
0ff3d06f334bdda044810bf3717b5f628dc6c735

SHA256
d4cc464ff44e55970b83c2adf4a91b19956d55dd7cb604aa2a2b2e056fd782ef

SHA512
129a54212be25f6812c45c6dddbde195a3cb9eb59dea34be616beb6b01836d7fa996a81347bb2b9e2888c6ec7e7e37afdd6a070f234176d6c0f70963725d0623

Download Submit
C:\Windows\System\KdmGpMd.exe

Filesize
1.7MB

MD5
f6ca1ccd481b8889443cfc8e337738e7

SHA1
b229615f49d4a9fa4e3e21dd6d25704ef731a6ec

SHA256
2cdcc56d6f2779455f4911098aecf53eedad21a6251cf60eb81334e762147641

SHA512
68c782261a736e10c862b0ee81163e42c0b7014d9b3fb1fa2e89ed316e4466ddee1aad837017864ca05e00740bb8d585222414fd826d9af64d17954818f31def

Download Submit
C:\Windows\System\MQSkIHq.exe

Filesize
1.7MB

MD5
5ce52f58332cd1727e0fe20eef052f2b

SHA1
0a5004842db36777e3b4cd49674f2344403deaf0

SHA256
d8035efc6ffa9cc6dba1a09410ed21c273c833526276c1e41e87253dbae596f2

SHA512
0ad762a0358976e9b6f4763b3b94138fcd348960910d1017c47a6f5c3ba65ac1c80f37b353d8b19875ba174fbe175f76136eb36dcb64129bcb075768f0d8eae7

Download Submit
C:\Windows\System\MXZMqql.exe

Filesize
1.7MB

MD5
4757f2a6cbd5fb7e73ba83c2984b1a04

SHA1
b54257b232e37ba9abdf21040ba55ccc5b5a4c20

SHA256
7cb1933fbcc671102361c9248d4eccf1349478f23ad9115f745ce73d269fd967

SHA512
5bc14576f17b66f22ef3e0ce7919457d60219ca32b49cb8a4a1d80e9a41a3a3bba981ae3ef10baa8e37d1e04e850e54f25a3c72ed59857d9cfab3c391558601e

Download Submit
C:\Windows\System\OLQCfVp.exe

Filesize
1.7MB

MD5
0876ab26202a36cd0d7104ca87cfe390

SHA1
a3db4c8c2aa2fe7aa52a3ab9baf672c9bfc9aa04

SHA256
928534a861b3081c29a169aceaa7efe8b6c60eb637bb9b8d9d31bb417e05ad73

SHA512
00d88993934f13070aa1b2abb8e03eecd99e57bb3d1c76f266b6368025755c3500d601dee1d951f72de39531df440f0a1e7ff7c17d3904948e63ee549b973639

Download Submit
C:\Windows\System\QQCwBpN.exe

Filesize
1.7MB

MD5
7e63ca6024ec2abe2c02837488942f6d

SHA1
d13b17881b69138eeb46a595969fb0933e6d6c09

SHA256
c4e8f26df5425406f15d76b4553c1b0f1c57063f48ec3d78de6c8a312610c59b

SHA512
22d5b33d1d08eacc16cd9c3daa2754d00fbe0e28ea256fd1e37c3a875fbce33d982071affad167a79824511c5271cc47cb4d0b2910b0882bf328b66d5dbd1211

Download Submit
C:\Windows\System\QmwCdXy.exe

Filesize
1.7MB

MD5
c7f2eebd87f92b731eeb1f39cb828045

SHA1
f026f98e2abe62795af6e75edc9addf975b0d8ee

SHA256
5749303850ab5c861307e0c15f8380b86363f8f7a0801617481f5df75a0a6c51

SHA512
fd935b3c204b87897280f2627ee7a6e0379d063fbe0f002648bf95514c13d64502a154338570027bad6ba7170d400f74b007866178c16ec6c810bfde0dd4d298

Download Submit
C:\Windows\System\SYAMUyg.exe

Filesize
1.7MB

MD5
e903498a7efb2e077776c0bfd60cc8d1

SHA1
9c2d26f86533aae358d751cccc79dc19af9e0120

SHA256
6c147facce09e907a1ffe0cf3b23a63334ab41165732ad464fd5991ce372bc07

SHA512
64c513dc6047a465f63603cd55e531a8ec56d9a1342e93e149a346151e259ebf81d03d78fc6457b342e62f62adf248f3193a68369f7db2bfbba40fc9d2395d61

Download Submit
C:\Windows\System\TcDtuXe.exe

Filesize
1.7MB

MD5
08afb80e95b6c2ae3bbdf3579ef289f7

SHA1
cc681b0b54df30d138c6619bdd09fc64f5cb19d6

SHA256
89774da36e28f79056cf0af439a09f673d790de4b59986f967112571f1ed88ac

SHA512
c471efa91415d768b72197319edd41c55abd01bd0eb10c55567c415a9bb019c939b827732c1f7a69dcb45a284c938d2d07a47bc7b214826c238e3bb44541f58c

Download Submit
C:\Windows\System\WpuERWz.exe

Filesize
1.7MB

MD5
5396a957503f5cb9986673563f8dde21

SHA1
09736666602fafd1eec31f68e745a3b520d914bd

SHA256
b20da0ff2fa1c2b24f08682ac46d77064c62b5b686a9bec1ef45ea8ac561b46c

SHA512
ca71cd27409b5aa513fb64b9b034286dbfd8e293eefd543401c90e2bd043727b25e76484eb5d709716438b977e2727413fa6e6c14df75ab21744b434a610d022

Download Submit
C:\Windows\System\WwZbcay.exe

Filesize
1.7MB

MD5
d5e99ec319063549ae5ee39431de6c51

SHA1
cfb1d25ae074f7467a9b4aa64f2b8381021408e2

SHA256
94925159fbd75f2c97ba734f850c17ae405e6153276a414ae0c2f3fc9cc15101

SHA512
6eb0158481a826b9f141514b9324635c1cdb589b84af3714a220598bb54e101f32c5020841233dfdf3127474f1721f0195c2c6a11789ec1deb4469df78dad025

Download Submit
C:\Windows\System\ZnfdTNu.exe

Filesize
1.7MB

MD5
ca55245dd0e1b1bd29fb18ff268673ab

SHA1
cfb9e6808aa9813afb4f4f4c9aa2109302830d57

SHA256
d6c71a13c69e3016febe9e268f9ac76979bfa6d046ba54cb25fc09df3371034d

SHA512
37474db0a2e46bc1f852c443cab306725c69d54f2d1748985f253bb87e66b6f117f4831fd3bc57829d800b84961f7f34b0a601551d77f84d83425f3d0cd97c20

Download Submit
C:\Windows\System\cyoFYhf.exe

Filesize
1.7MB

MD5
1ed35c99cfa16486707001b91155af05

SHA1
a29f994efc33a25875f94fde4ce4e0521877abb3

SHA256
45895aaa1884af864713fee8e17c7334c482db08c42ce0ddf54f42792a7a683e

SHA512
b3b81e77ad94bfa32ae1984a717a11af5367a6169a62545a3fbc6c1bb3d5de0e423e48c2bf389721141391b7dd667a6993221f06735e011aaaec571c0b6af4ec

Download Submit
C:\Windows\System\dnCjVrB.exe

Filesize
1.7MB

MD5
31746a129780b0839b94d33a4c673816

SHA1
08121bdeb3ebf66f613c328d1ae3bcbf82723d19

SHA256
ac5a52709b17b8f313dc825c96b19089543ae027276ccfccd5a8337956669868

SHA512
69ac71e740c32851a5101976afc0f392a1c56ac3d1afbfd6f5bef65c9574013c6f0d71a2ce324c8443de3272a84b50d37cc9179b8bc29104b5a4841b59a23fc3

Download Submit
C:\Windows\System\eEPkOSy.exe

Filesize
1.7MB

MD5
faed7022a0d4961c87790c7968015f38

SHA1
705b7742cd759b608bfb89980d4de59d96fd3d90

SHA256
8e0c6c37e3ae32525272cbe98f6e30a4d2d7f7180230f8551241e2688eba9c68

SHA512
6c31b93cab7cc7c134d07f3279d1d1dd0725d9169aeac894402f90583ec3fcac72a604bda7470341fc0e4dad6f657019c62d4f633dd280735f8cf5f8f4c1a886

Download Submit
C:\Windows\System\fUMTUwI.exe

Filesize
1.7MB

MD5
f92155d85c9903c3b9fcbc21eb691c58

SHA1
15abd5a7e7ff9cc7ca9d94c569581311a704b8a8

SHA256
d96a4a20440f94fe0dec11bedf7422adfaf326cf6f542efe71b7a90128ba9f65

SHA512
bf8f8d2b66456db48c8bc26550e0d37f32a645e94d9ffc259a3ac0bb43b700c5921d9a7346e87e7b42cb287293fb3af21a0d404d103711bfd96da2948870b50c

Download Submit
C:\Windows\System\fsIcqFP.exe

Filesize
1.7MB

MD5
d818f506ae1386948976b02f4ff47090

SHA1
1e883a7bec77dc63219331a9521211f7d5784414

SHA256
4e04c9f3de9d49a596168678cc8732a8ca8b221e8b455e391014b01db0ee750a

SHA512
91d8d21701d2a30d41c87a9206a7b26afad1a135e73fc21856ecb52226820d75fd139907d0e6f4ad7821c44dd2f048f31b32fd1d9d0ea286013cc9fbd8aa6fdd

Download Submit
C:\Windows\System\fusuaqj.exe

Filesize
1.7MB

MD5
529100230f9e07da6831bb4717e76eca

SHA1
e798ed4d630caf49577717e9ab88f75f7c1e9364

SHA256
e800c962db79fda4e5be24787a42eeb2f643ed9c538edc246009bb0af7f46e9a

SHA512
a76681ce27cdba6de4cdd59817258c9915455827cef427d8f5f431d4228ab358d4eefe13639ef0ccd030e8ac5c8bdaff5d8e446981ceb4073d9860c06103ceb2

Download Submit
C:\Windows\System\kCtSebY.exe

Filesize
1.7MB

MD5
5db6be915847344f3df7009b61bb2840

SHA1
e073c8972a65099d2432865c2bd4b27e4ca7470e

SHA256
ebcf2d8a7f75262b3e8213d7902145e7628ead04aecc979b557fd0e96bf50495

SHA512
96047f15c866f3c9a7231e4b3bfdfe2d5164c40e0e3bc14eab59e25faa05db574bcde0a2c5f4c04c95638711e96a74a63d19af1a9ffad4fbd699353b01d9be1a

Download Submit
C:\Windows\System\mohFTPw.exe

Filesize
1.7MB

MD5
d283ab3ab6bfcf9715a76994a4c2619e

SHA1
9b7e72011926f57705507c489fc96f9726be5d38

SHA256
087d78f7a15e8d9e7fb3a1e51e94ab1e881cbd00e96829d44badad1bb94874b5

SHA512
6322f4d479f235d5f8fa1f6feeb6536e2ae9e9867357ce92ed8b87bedb1b14d3634d228b1f3d6a39dbc31d29a40ee5cc39265bf74c028323d7e97d0470bd0cd7

Download Submit
C:\Windows\System\qCpDTiJ.exe

Filesize
1.7MB

MD5
c30337f3fe0dc5a9f686392c3a1bf550

SHA1
5c1ab4223651c795ff415d1d125fefda5c54b26b

SHA256
f496529447b27fbc3d6112bd77e207dbd6ce491966bdb63d060ed3fa02a4554f

SHA512
53c382fcf469866b6fb25843da21657c4412e1a2a8c9df26d2540d94c64eaf0cffe2527b2a89c3fac72a13eb54996d6e9538755fc7246e16162390b0c9db08d5

Download Submit
C:\Windows\System\qjBhsLX.exe

Filesize
1.7MB

MD5
d39268f0e630b2a708fa712055603ef3

SHA1
1f56229a44b7704a37b49647f803ccfb82641f6f

SHA256
a6724c0e7db62a58a3b5d9db12a3ac8bf28534d8a5d11daca16049aeda398b0a

SHA512
d57c07296de070aa8a97c7fee3da3edbe578cfe7a10dd76150a859b817ac608443dd58a7809818167f8a388d4b38cd6bbf71aa600bb8ef762cfb383f7a2bb603

Download Submit
C:\Windows\System\rTbYZSV.exe

Filesize
1.7MB

MD5
39e84b62452004547f7fec463445af38

SHA1
cdf06685b6fd7bf78f4828a0fd057b1880d8abeb

SHA256
71bf7e88cdb9c786dd7feb605a2022de3690ef1989a04aa82b198f5481ba9dd3

SHA512
a094f82ec4621993c4f18ad10624fdedf1106bab966e0fbda9137a0d14183e8c1df80073a9583c848763f4e138d9fd57057d24af3fd3a8849755fd3511f5ff5b

Download Submit
C:\Windows\System\rvbhPqJ.exe

Filesize
1.7MB

MD5
bbc2534bdfaa722b16c696664ac1a55f

SHA1
d8a093fdef901aca198659f519b1606698de4b1e

SHA256
c8cb24f822023e9f2e3b93e2a3bc70e2967c34ba366f2850cc2110cd88aa1593

SHA512
7d27b7f30acfdb7c86a27bec1a8ef9d9b5781cc318b66009752ab3b83ca5b5831354a6a3b5a7331a7b25568f1afe258f939e75e083fb18b3df5b1cb2db7e7c1a

Download Submit
C:\Windows\System\szNxctA.exe

Filesize
1.7MB

MD5
5eff9f512b3a06412627355a365e1d53

SHA1
7822518bff4cbedc3acada9f1c8c753801d48b3d

SHA256
0ee723881d6fcf2f8b545a2ee56c1f60648f21c2444e00e2f183940e8e8e7505

SHA512
e948457d9579ed5ada96909ea83949e87b84ee953ad0c15b8666c9968fd1f57e8c9adad353d04a17f93ff99a597069c87165f3f935fab19eaed8de7326418a27

Download Submit
C:\Windows\System\vEGLeqI.exe

Filesize
1.7MB

MD5
b692a4f9f794dbb53ce7c4e339dd6dca

SHA1
c751a8799a9290c21e9c4446a9c90bc280109499

SHA256
d44a0f05179dc9d7b92429eb349b2739aaddc41d54ad8a81915c7070315746ba

SHA512
6fad027d0d761c61be5510d328f6904fec2b8e20eb72cf305d6fd471856829c26fa85f099eb2bc0410c30150508f72c5cc990122fe7c69f4da240a256376e774

Download Submit
C:\Windows\System\vfJqGMk.exe

Filesize
1.7MB

MD5
77c7aa51c0526ab1e568f729ae7819f6

SHA1
46151bd1e4c5dc70bffd332a964a663da68599ed

SHA256
83ed89d70097743a056fdecbeed81b1b8ed5f141f281cc220fd7beae9b5b19d5

SHA512
be78826c3b716dcab13051417bf6855da8a379ef4dab07b6efb9d3dc8a63fecf01f9933c883b1353013dec2a8422e21511b95770184673ca9487de25205552fe

Download Submit
C:\Windows\System\xaachFo.exe

Filesize
1.7MB

MD5
8079aecd39f98c4df354a3f6e2548cf0

SHA1
8509996480ec591df5b48d39ea31e2e1393d04a3

SHA256
e147a9e116095ce38fd8b6d9d7da8df487a7240cf65c6b97a0c6f32eebff5f84

SHA512
377c17be4c0a03fa47b9c19e5af8527e77510ecfa98b1b91497c72dca4923b6a1eb597787bb564505dad9d7e5cdc81cca4cf5418c73b5a7f33df4a1529591c8a

Download Submit
C:\Windows\System\xqQPBMR.exe

Filesize
1.7MB

MD5
ef9cfcc20f9a1d29d72c60c484935b12

SHA1
25c14cbb9a73ae71bb905e2c94540d0d1cd65138

SHA256
1aaba9da9ae387ac0e50a113c719aef0886ba269b6f9edc06faf222620b140da

SHA512
88b3f20556b81e4cfc7b37d0fc8affc2be4b9f5ca8320729bba0be7b14da1ed73a95e649ddcfe42637c49750337f32bbfd4f848fe63ca989f718aa7da7e163b4

Download Submit
C:\Windows\System\yAdrqhX.exe

Filesize
1.7MB

MD5
abb12ba304993ea1314074c7ed6fc960

SHA1
d31f5a0eb22536b0081982de985ad3898679cf9b

SHA256
a7a980e5732fb975bb8f0778d6874bdafabb2f8becaf48cd4e7c316337015e8f

SHA512
b1666bb6325b8242d00f801b9e4b0df1e200bfcf62733d6982198d16f931cb293283f7dbd32477b0529056822693acbcee4f2b5e0d9806286372a37e4aab515a

Download Submit
C:\Windows\System\yrVxJYy.exe

Filesize
1.7MB

MD5
8d85825110a8cf4febe2804df5167371

SHA1
793106553fbbab3cbf87f6452525cc0f3235d49a

SHA256
09c0a0e1e5342c0f7cd07c743f582336b14d0ed16a4170c213840f16158fb32c

SHA512
682f947bb57995a27784addf768cd08e22afb87deba69b55d5369d0bee8b04df469c8bed6b262de53737b3f39e31d70ee0feb47eaa6cb3b4e13bc90207425aad

Download Submit
memory/800-2309-0x00007FF6796D0000-0x00007FF679A21000-memory.dmp

Filesize
3.3MB

Download
memory/800-267-0x00007FF6796D0000-0x00007FF679A21000-memory.dmp

Filesize
3.3MB

Download
memory/888-0-0x00007FF710A20000-0x00007FF710D71000-memory.dmp

Filesize
3.3MB

Download
memory/888-1-0x000002667B710000-0x000002667B720000-memory.dmp

Filesize
64KB

Download
memory/888-2122-0x00007FF710A20000-0x00007FF710D71000-memory.dmp

Filesize
3.3MB

Download
memory/1216-2319-0x00007FF74BDB0000-0x00007FF74C101000-memory.dmp

Filesize
3.3MB

Download
memory/1216-110-0x00007FF74BDB0000-0x00007FF74C101000-memory.dmp

Filesize
3.3MB

Download
memory/1216-2267-0x00007FF74BDB0000-0x00007FF74C101000-memory.dmp

Filesize
3.3MB

Download
memory/1400-2311-0x00007FF759650000-0x00007FF7599A1000-memory.dmp

Filesize
3.3MB

Download
memory/1400-266-0x00007FF759650000-0x00007FF7599A1000-memory.dmp

Filesize
3.3MB

Download
memory/1436-2277-0x00007FF753030000-0x00007FF753381000-memory.dmp

Filesize
3.3MB

Download
memory/1436-2262-0x00007FF753030000-0x00007FF753381000-memory.dmp

Filesize
3.3MB

Download
memory/1436-73-0x00007FF753030000-0x00007FF753381000-memory.dmp

Filesize
3.3MB

Download
memory/1500-24-0x00007FF6C73F0000-0x00007FF6C7741000-memory.dmp

Filesize
3.3MB

Download
memory/1500-2266-0x00007FF6C73F0000-0x00007FF6C7741000-memory.dmp

Filesize
3.3MB

Download
memory/1524-287-0x00007FF732950000-0x00007FF732CA1000-memory.dmp

Filesize
3.3MB

Download
memory/1524-2292-0x00007FF732950000-0x00007FF732CA1000-memory.dmp

Filesize
3.3MB

Download
memory/1652-2301-0x00007FF7D9320000-0x00007FF7D9671000-memory.dmp

Filesize
3.3MB

Download
memory/1652-164-0x00007FF7D9320000-0x00007FF7D9671000-memory.dmp

Filesize
3.3MB

Download
memory/1668-220-0x00007FF77C040000-0x00007FF77C391000-memory.dmp

Filesize
3.3MB

Download
memory/1668-2296-0x00007FF77C040000-0x00007FF77C391000-memory.dmp

Filesize
3.3MB

Download
memory/1676-163-0x00007FF7331E0000-0x00007FF733531000-memory.dmp

Filesize
3.3MB

Download
memory/1676-2295-0x00007FF7331E0000-0x00007FF733531000-memory.dmp

Filesize
3.3MB

Download
memory/1880-2321-0x00007FF72FF70000-0x00007FF7302C1000-memory.dmp

Filesize
3.3MB

Download
memory/1880-283-0x00007FF72FF70000-0x00007FF7302C1000-memory.dmp

Filesize
3.3MB

Download
memory/2244-2317-0x00007FF7ADBB0000-0x00007FF7ADF01000-memory.dmp

Filesize
3.3MB

Download
memory/2244-284-0x00007FF7ADBB0000-0x00007FF7ADF01000-memory.dmp

Filesize
3.3MB

Download
memory/2312-2279-0x00007FF633CA0000-0x00007FF633FF1000-memory.dmp

Filesize
3.3MB

Download
memory/2312-38-0x00007FF633CA0000-0x00007FF633FF1000-memory.dmp

Filesize
3.3MB

Download
memory/2352-276-0x00007FF7AEF30000-0x00007FF7AF281000-memory.dmp

Filesize
3.3MB

Download
memory/2352-2291-0x00007FF7AEF30000-0x00007FF7AF281000-memory.dmp

Filesize
3.3MB

Download
memory/2448-2316-0x00007FF6476E0000-0x00007FF647A31000-memory.dmp

Filesize
3.3MB

Download
memory/2448-142-0x00007FF6476E0000-0x00007FF647A31000-memory.dmp

Filesize
3.3MB

Download
memory/2448-2273-0x00007FF6476E0000-0x00007FF647A31000-memory.dmp

Filesize
3.3MB

Download
memory/2588-282-0x00007FF6CB550000-0x00007FF6CB8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2588-2281-0x00007FF6CB550000-0x00007FF6CB8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2708-47-0x00007FF6F5B90000-0x00007FF6F5EE1000-memory.dmp

Filesize
3.3MB

Download
memory/2708-2284-0x00007FF6F5B90000-0x00007FF6F5EE1000-memory.dmp

Filesize
3.3MB

Download
memory/2816-2256-0x00007FF733A20000-0x00007FF733D71000-memory.dmp

Filesize
3.3MB

Download
memory/2816-35-0x00007FF733A20000-0x00007FF733D71000-memory.dmp

Filesize
3.3MB

Download
memory/2816-2274-0x00007FF733A20000-0x00007FF733D71000-memory.dmp

Filesize
3.3MB

Download
memory/2876-76-0x00007FF73E220000-0x00007FF73E571000-memory.dmp

Filesize
3.3MB

Download
memory/2876-2264-0x00007FF73E220000-0x00007FF73E571000-memory.dmp

Filesize
3.3MB

Download
memory/2876-2286-0x00007FF73E220000-0x00007FF73E571000-memory.dmp

Filesize
3.3MB

Download
memory/3320-285-0x00007FF76B190000-0x00007FF76B4E1000-memory.dmp

Filesize
3.3MB

Download
memory/3320-2328-0x00007FF76B190000-0x00007FF76B4E1000-memory.dmp

Filesize
3.3MB

Download
memory/3568-10-0x00007FF703FA0000-0x00007FF7042F1000-memory.dmp

Filesize
3.3MB

Download
memory/3568-2257-0x00007FF703FA0000-0x00007FF7042F1000-memory.dmp

Filesize
3.3MB

Download
memory/3568-2254-0x00007FF703FA0000-0x00007FF7042F1000-memory.dmp

Filesize
3.3MB

Download
memory/3648-258-0x00007FF7A68F0000-0x00007FF7A6C41000-memory.dmp

Filesize
3.3MB

Download
memory/3648-2335-0x00007FF7A68F0000-0x00007FF7A6C41000-memory.dmp

Filesize
3.3MB

Download
memory/4004-259-0x00007FF6D5970000-0x00007FF6D5CC1000-memory.dmp

Filesize
3.3MB

Download
memory/4004-2314-0x00007FF6D5970000-0x00007FF6D5CC1000-memory.dmp

Filesize
3.3MB

Download
memory/4132-198-0x00007FF663610000-0x00007FF663961000-memory.dmp

Filesize
3.3MB

Download
memory/4132-2298-0x00007FF663610000-0x00007FF663961000-memory.dmp

Filesize
3.3MB

Download
memory/4348-2326-0x00007FF7F8D00000-0x00007FF7F9051000-memory.dmp

Filesize
3.3MB

Download
memory/4348-281-0x00007FF7F8D00000-0x00007FF7F9051000-memory.dmp

Filesize
3.3MB

Download
memory/4388-221-0x00007FF725C40000-0x00007FF725F91000-memory.dmp

Filesize
3.3MB

Download
memory/4388-2337-0x00007FF725C40000-0x00007FF725F91000-memory.dmp

Filesize
3.3MB

Download
memory/4436-277-0x00007FF6E5930000-0x00007FF6E5C81000-memory.dmp

Filesize
3.3MB

Download
memory/4436-2308-0x00007FF6E5930000-0x00007FF6E5C81000-memory.dmp

Filesize
3.3MB

Download
memory/4580-2331-0x00007FF78FE80000-0x00007FF7901D1000-memory.dmp

Filesize
3.3MB

Download
memory/4580-243-0x00007FF78FE80000-0x00007FF7901D1000-memory.dmp

Filesize
3.3MB

Download
memory/4668-2323-0x00007FF635BF0000-0x00007FF635F41000-memory.dmp

Filesize
3.3MB

Download
memory/4668-286-0x00007FF635BF0000-0x00007FF635F41000-memory.dmp

Filesize
3.3MB

Download
memory/4704-46-0x00007FF683F20000-0x00007FF684271000-memory.dmp

Filesize
3.3MB

Download
memory/4704-2282-0x00007FF683F20000-0x00007FF684271000-memory.dmp

Filesize
3.3MB

Download
memory/4704-2258-0x00007FF683F20000-0x00007FF684271000-memory.dmp

Filesize
3.3MB

Download