xmrig | cd1a9863093bc5bbb5dac42fd0b9c427c8937a380144efd522f91d3e818b80d7

Analysis

max time kernel
129s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
Size

2.0MB
MD5

2ff11dd9abdb28a3c03db3a4ca606fb0
SHA1

16f2573097e7f647d5354715a5d44059262ed810
SHA256

cd1a9863093bc5bbb5dac42fd0b9c427c8937a380144efd522f91d3e818b80d7
SHA512

f056a2c4b6d99c70814365672e92969df7093b5f5a0b684d329e072289c75357fdf3c23e42f8ad02e7a3bd9341e32e88b0e49e898fdea9cdb72e366faec45037
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQwNU6ff91mW:BemTLkNdfE0pZrQy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3828-0-0x00007FF7551A0000-0x00007FF7554F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002347a-20.dat	xmrig
behavioral2/files/0x000700000002347c-28.dat	xmrig
behavioral2/files/0x0007000000023478-35.dat	xmrig
behavioral2/files/0x000700000002347b-44.dat	xmrig
behavioral2/files/0x0007000000023480-60.dat	xmrig
behavioral2/files/0x000700000002347f-66.dat	xmrig
behavioral2/memory/4320-76-0x00007FF602660000-0x00007FF6029B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023488-122.dat	xmrig
behavioral2/files/0x000700000002348c-138.dat	xmrig
behavioral2/files/0x000700000002348f-157.dat	xmrig
behavioral2/files/0x0007000000023492-178.dat	xmrig
behavioral2/files/0x0007000000023496-202.dat	xmrig
behavioral2/files/0x0007000000023494-200.dat	xmrig
behavioral2/files/0x0007000000023495-197.dat	xmrig
behavioral2/files/0x0007000000023493-195.dat	xmrig
behavioral2/memory/5012-194-0x00007FF64E300000-0x00007FF64E654000-memory.dmp	xmrig
behavioral2/memory/1788-188-0x00007FF6347C0000-0x00007FF634B14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023491-183.dat	xmrig
behavioral2/memory/2896-182-0x00007FF741240000-0x00007FF741594000-memory.dmp	xmrig
behavioral2/memory/1104-181-0x00007FF62FCB0000-0x00007FF630004000-memory.dmp	xmrig
behavioral2/files/0x0007000000023490-176.dat	xmrig
behavioral2/memory/3296-175-0x00007FF791430000-0x00007FF791784000-memory.dmp	xmrig
behavioral2/memory/3260-169-0x00007FF77A160000-0x00007FF77A4B4000-memory.dmp	xmrig
behavioral2/memory/3612-168-0x00007FF63E550000-0x00007FF63E8A4000-memory.dmp	xmrig
behavioral2/memory/1496-167-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp	xmrig
behavioral2/files/0x000700000002348e-162.dat	xmrig
behavioral2/memory/2948-161-0x00007FF697440000-0x00007FF697794000-memory.dmp	xmrig
behavioral2/memory/1124-160-0x00007FF60A560000-0x00007FF60A8B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002348d-155.dat	xmrig
behavioral2/memory/648-154-0x00007FF60BF50000-0x00007FF60C2A4000-memory.dmp	xmrig
behavioral2/memory/4320-153-0x00007FF602660000-0x00007FF6029B4000-memory.dmp	xmrig
behavioral2/memory/4032-147-0x00007FF6CE930000-0x00007FF6CEC84000-memory.dmp	xmrig
behavioral2/files/0x000700000002348b-142.dat	xmrig
behavioral2/memory/4676-141-0x00007FF761260000-0x00007FF7615B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002348a-136.dat	xmrig
behavioral2/memory/4196-135-0x00007FF6F1090000-0x00007FF6F13E4000-memory.dmp	xmrig
behavioral2/memory/1664-134-0x00007FF757A80000-0x00007FF757DD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023489-129.dat	xmrig
behavioral2/memory/3340-128-0x00007FF74AF50000-0x00007FF74B2A4000-memory.dmp	xmrig
behavioral2/memory/3416-127-0x00007FF6550F0000-0x00007FF655444000-memory.dmp	xmrig
behavioral2/memory/1876-121-0x00007FF73C2E0000-0x00007FF73C634000-memory.dmp	xmrig
behavioral2/memory/4604-120-0x00007FF68F350000-0x00007FF68F6A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023487-115.dat	xmrig
behavioral2/memory/1892-114-0x00007FF788D00000-0x00007FF789054000-memory.dmp	xmrig
behavioral2/files/0x0007000000023486-109.dat	xmrig
behavioral2/memory/844-108-0x00007FF62A110000-0x00007FF62A464000-memory.dmp	xmrig
behavioral2/memory/3828-107-0x00007FF7551A0000-0x00007FF7554F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023485-102.dat	xmrig
behavioral2/memory/5012-101-0x00007FF64E300000-0x00007FF64E654000-memory.dmp	xmrig
behavioral2/files/0x0007000000023484-96.dat	xmrig
behavioral2/memory/1104-95-0x00007FF62FCB0000-0x00007FF630004000-memory.dmp	xmrig
behavioral2/files/0x0007000000023483-90.dat	xmrig
behavioral2/memory/3260-89-0x00007FF77A160000-0x00007FF77A4B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023482-84.dat	xmrig
behavioral2/memory/1496-83-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023481-78.dat	xmrig
behavioral2/memory/2948-77-0x00007FF697440000-0x00007FF697794000-memory.dmp	xmrig
behavioral2/memory/1040-70-0x00007FF778EC0000-0x00007FF779214000-memory.dmp	xmrig
behavioral2/memory/3640-64-0x00007FF7D1330000-0x00007FF7D1684000-memory.dmp	xmrig
behavioral2/memory/1072-63-0x00007FF7A2D50000-0x00007FF7A30A4000-memory.dmp	xmrig
behavioral2/memory/4528-59-0x00007FF7368B0000-0x00007FF736C04000-memory.dmp	xmrig
behavioral2/memory/4376-58-0x00007FF7630F0000-0x00007FF763444000-memory.dmp	xmrig
behavioral2/files/0x000700000002347e-52.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1664	BZcDnwg.exe
2360	NFcRifC.exe
2600	lcXAONK.exe
4604	FBoUMaI.exe
3416	JiZZKIU.exe
4376	AdvMICr.exe
4528	irLkEZb.exe
3640	JnTmaMZ.exe
1072	HoIxNSZ.exe
1040	KOKGFAs.exe
4320	WkLOmtA.exe
2948	rkFCCRf.exe
1496	Vhlrxfk.exe
3260	oLJqINT.exe
1104	enhpdVN.exe
5012	VLTfbpV.exe
844	XLhegoH.exe
1892	nPEfrRU.exe
1876	FIXNYXv.exe
3340	ASuEMpt.exe
4196	EEyRhPL.exe
4676	zyujaYa.exe
4032	nchEFzx.exe
648	rWCOwGY.exe
1124	onaQdXD.exe
3612	bKRTAOA.exe
3296	cEmerzs.exe
2896	JKHnQAn.exe
1788	FgLXhSh.exe
4644	fKOBjFl.exe
4924	tpyvhNv.exe
3252	SDNGsfs.exe
3140	rKzFMMd.exe
1924	vmOCIVA.exe
396	hklXqCc.exe
452	vmJvZPP.exe
4416	taPZcZp.exe
4268	bzdOJZe.exe
3104	pJMSTCu.exe
436	vkLgSXH.exe
2660	qSoUIwZ.exe
3772	nOsXTpf.exe
912	UDiMcth.exe
264	ubsJZKw.exe
4144	QXpoztQ.exe
2084	ddJSlVU.exe
2316	obJiBKJ.exe
1668	bJixHBc.exe
3036	pTNtYRT.exe
3996	jaFnVlo.exe
4476	wWJEoiI.exe
4564	yCBmJJR.exe
1620	hpFDBdW.exe
4324	ReYwDQl.exe
2456	sMZDOeF.exe
512	gahLEmo.exe
1224	WCjfIhf.exe
2532	sjXdemR.exe
1976	SzFZVGf.exe
2696	wyPfIJg.exe
4328	TDjiHRS.exe
1460	SzdPzwM.exe
1000	yIPCVdL.exe
4504	hjAyhTZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3828-0-0x00007FF7551A0000-0x00007FF7554F4000-memory.dmp	upx
behavioral2/files/0x000700000002347a-20.dat	upx
behavioral2/files/0x000700000002347c-28.dat	upx
behavioral2/files/0x0007000000023478-35.dat	upx
behavioral2/files/0x000700000002347b-44.dat	upx
behavioral2/files/0x0007000000023480-60.dat	upx
behavioral2/files/0x000700000002347f-66.dat	upx
behavioral2/memory/4320-76-0x00007FF602660000-0x00007FF6029B4000-memory.dmp	upx
behavioral2/files/0x0007000000023488-122.dat	upx
behavioral2/files/0x000700000002348c-138.dat	upx
behavioral2/files/0x000700000002348f-157.dat	upx
behavioral2/files/0x0007000000023492-178.dat	upx
behavioral2/files/0x0007000000023496-202.dat	upx
behavioral2/files/0x0007000000023494-200.dat	upx
behavioral2/files/0x0007000000023495-197.dat	upx
behavioral2/files/0x0007000000023493-195.dat	upx
behavioral2/memory/5012-194-0x00007FF64E300000-0x00007FF64E654000-memory.dmp	upx
behavioral2/memory/1788-188-0x00007FF6347C0000-0x00007FF634B14000-memory.dmp	upx
behavioral2/files/0x0007000000023491-183.dat	upx
behavioral2/memory/2896-182-0x00007FF741240000-0x00007FF741594000-memory.dmp	upx
behavioral2/memory/1104-181-0x00007FF62FCB0000-0x00007FF630004000-memory.dmp	upx
behavioral2/files/0x0007000000023490-176.dat	upx
behavioral2/memory/3296-175-0x00007FF791430000-0x00007FF791784000-memory.dmp	upx
behavioral2/memory/3260-169-0x00007FF77A160000-0x00007FF77A4B4000-memory.dmp	upx
behavioral2/memory/3612-168-0x00007FF63E550000-0x00007FF63E8A4000-memory.dmp	upx
behavioral2/memory/1496-167-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp	upx
behavioral2/files/0x000700000002348e-162.dat	upx
behavioral2/memory/2948-161-0x00007FF697440000-0x00007FF697794000-memory.dmp	upx
behavioral2/memory/1124-160-0x00007FF60A560000-0x00007FF60A8B4000-memory.dmp	upx
behavioral2/files/0x000700000002348d-155.dat	upx
behavioral2/memory/648-154-0x00007FF60BF50000-0x00007FF60C2A4000-memory.dmp	upx
behavioral2/memory/4320-153-0x00007FF602660000-0x00007FF6029B4000-memory.dmp	upx
behavioral2/memory/4032-147-0x00007FF6CE930000-0x00007FF6CEC84000-memory.dmp	upx
behavioral2/files/0x000700000002348b-142.dat	upx
behavioral2/memory/4676-141-0x00007FF761260000-0x00007FF7615B4000-memory.dmp	upx
behavioral2/files/0x000700000002348a-136.dat	upx
behavioral2/memory/4196-135-0x00007FF6F1090000-0x00007FF6F13E4000-memory.dmp	upx
behavioral2/memory/1664-134-0x00007FF757A80000-0x00007FF757DD4000-memory.dmp	upx
behavioral2/files/0x0007000000023489-129.dat	upx
behavioral2/memory/3340-128-0x00007FF74AF50000-0x00007FF74B2A4000-memory.dmp	upx
behavioral2/memory/3416-127-0x00007FF6550F0000-0x00007FF655444000-memory.dmp	upx
behavioral2/memory/1876-121-0x00007FF73C2E0000-0x00007FF73C634000-memory.dmp	upx
behavioral2/memory/4604-120-0x00007FF68F350000-0x00007FF68F6A4000-memory.dmp	upx
behavioral2/files/0x0007000000023487-115.dat	upx
behavioral2/memory/1892-114-0x00007FF788D00000-0x00007FF789054000-memory.dmp	upx
behavioral2/files/0x0007000000023486-109.dat	upx
behavioral2/memory/844-108-0x00007FF62A110000-0x00007FF62A464000-memory.dmp	upx
behavioral2/memory/3828-107-0x00007FF7551A0000-0x00007FF7554F4000-memory.dmp	upx
behavioral2/files/0x0007000000023485-102.dat	upx
behavioral2/memory/5012-101-0x00007FF64E300000-0x00007FF64E654000-memory.dmp	upx
behavioral2/files/0x0007000000023484-96.dat	upx
behavioral2/memory/1104-95-0x00007FF62FCB0000-0x00007FF630004000-memory.dmp	upx
behavioral2/files/0x0007000000023483-90.dat	upx
behavioral2/memory/3260-89-0x00007FF77A160000-0x00007FF77A4B4000-memory.dmp	upx
behavioral2/files/0x0007000000023482-84.dat	upx
behavioral2/memory/1496-83-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp	upx
behavioral2/files/0x0007000000023481-78.dat	upx
behavioral2/memory/2948-77-0x00007FF697440000-0x00007FF697794000-memory.dmp	upx
behavioral2/memory/1040-70-0x00007FF778EC0000-0x00007FF779214000-memory.dmp	upx
behavioral2/memory/3640-64-0x00007FF7D1330000-0x00007FF7D1684000-memory.dmp	upx
behavioral2/memory/1072-63-0x00007FF7A2D50000-0x00007FF7A30A4000-memory.dmp	upx
behavioral2/memory/4528-59-0x00007FF7368B0000-0x00007FF736C04000-memory.dmp	upx
behavioral2/memory/4376-58-0x00007FF7630F0000-0x00007FF763444000-memory.dmp	upx
behavioral2/files/0x000700000002347e-52.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ShfjmrC.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\eiIRfDH.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\eoJaXNW.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\obJiBKJ.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\TqlcxOW.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\ANToRyy.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\zVBNrph.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\gTJmstD.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\CDvgDMf.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\LJPdetO.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\woDYKGn.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\eNGufFL.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\xRtsmks.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\ShvjaDX.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\kuELPMY.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\yNmForI.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\krySFOE.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\zxAgZvb.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\pmkNtvY.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\MdcbBgm.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\fEhsAWc.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\knqhHvN.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\ACQtShT.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\uHkETIg.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\tVntkdD.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZGPtPJU.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\lAzhjPL.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\YGpovIo.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\iVocjse.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\bsBPjkB.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\UFkVgnt.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\BZcDnwg.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\pGBzKvh.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\gSoTXWC.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\czDxbdR.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\RdIujRr.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\VpCDHBY.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\rMYrxil.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\NHGgAMC.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\hpFDBdW.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\RHhihuW.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\ELUZPBC.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\AvjXeae.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\aPKDvig.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\RHZIirR.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\jmBwcGE.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\eeZLRpZ.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\juASwLe.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\KbIiQIe.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\nbtsqAM.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\yNGAZja.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\bxiseDH.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\wlkKDUi.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\OrjTDHO.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\itEodgJ.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\axTnYTG.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\SQUDXGh.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\cuTkfUm.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\ePfMYcc.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\xOwMwmP.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\QglwDLg.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\VPiFJYU.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\pCfggKH.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
File created	C:\Windows\System\MffmqML.exe	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 1664	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	84
PID 3828 wrote to memory of 1664	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	84
PID 3828 wrote to memory of 2360	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	85
PID 3828 wrote to memory of 2360	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	85
PID 3828 wrote to memory of 2600	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	86
PID 3828 wrote to memory of 2600	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	86
PID 3828 wrote to memory of 4604	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	87
PID 3828 wrote to memory of 4604	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	87
PID 3828 wrote to memory of 3416	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	88
PID 3828 wrote to memory of 3416	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	88
PID 3828 wrote to memory of 4376	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	89
PID 3828 wrote to memory of 4376	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	89
PID 3828 wrote to memory of 4528	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	90
PID 3828 wrote to memory of 4528	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	90
PID 3828 wrote to memory of 3640	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	91
PID 3828 wrote to memory of 3640	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	91
PID 3828 wrote to memory of 1072	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	92
PID 3828 wrote to memory of 1072	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	92
PID 3828 wrote to memory of 1040	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	93
PID 3828 wrote to memory of 1040	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	93
PID 3828 wrote to memory of 4320	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	94
PID 3828 wrote to memory of 4320	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	94
PID 3828 wrote to memory of 2948	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	95
PID 3828 wrote to memory of 2948	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	95
PID 3828 wrote to memory of 1496	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	96
PID 3828 wrote to memory of 1496	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	96
PID 3828 wrote to memory of 3260	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	97
PID 3828 wrote to memory of 3260	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	97
PID 3828 wrote to memory of 1104	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	98
PID 3828 wrote to memory of 1104	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	98
PID 3828 wrote to memory of 5012	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	99
PID 3828 wrote to memory of 5012	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	99
PID 3828 wrote to memory of 844	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	100
PID 3828 wrote to memory of 844	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	100
PID 3828 wrote to memory of 1892	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	101
PID 3828 wrote to memory of 1892	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	101
PID 3828 wrote to memory of 1876	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	102
PID 3828 wrote to memory of 1876	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	102
PID 3828 wrote to memory of 3340	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	103
PID 3828 wrote to memory of 3340	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	103
PID 3828 wrote to memory of 4196	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	104
PID 3828 wrote to memory of 4196	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	104
PID 3828 wrote to memory of 4676	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	105
PID 3828 wrote to memory of 4676	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	105
PID 3828 wrote to memory of 4032	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	106
PID 3828 wrote to memory of 4032	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	106
PID 3828 wrote to memory of 648	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	107
PID 3828 wrote to memory of 648	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	107
PID 3828 wrote to memory of 1124	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	108
PID 3828 wrote to memory of 1124	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	108
PID 3828 wrote to memory of 3612	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	109
PID 3828 wrote to memory of 3612	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	109
PID 3828 wrote to memory of 3296	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	110
PID 3828 wrote to memory of 3296	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	110
PID 3828 wrote to memory of 2896	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	111
PID 3828 wrote to memory of 2896	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	111
PID 3828 wrote to memory of 1788	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	112
PID 3828 wrote to memory of 1788	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	112
PID 3828 wrote to memory of 4644	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	113
PID 3828 wrote to memory of 4644	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	113
PID 3828 wrote to memory of 4924	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	114
PID 3828 wrote to memory of 4924	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	114
PID 3828 wrote to memory of 3252	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	115
PID 3828 wrote to memory of 3252	3828	2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2ff11dd9abdb28a3c03db3a4ca606fb0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\System\BZcDnwg.exe
  C:\Windows\System\BZcDnwg.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\NFcRifC.exe
  C:\Windows\System\NFcRifC.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\lcXAONK.exe
  C:\Windows\System\lcXAONK.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\FBoUMaI.exe
  C:\Windows\System\FBoUMaI.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\JiZZKIU.exe
  C:\Windows\System\JiZZKIU.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\AdvMICr.exe
  C:\Windows\System\AdvMICr.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\irLkEZb.exe
  C:\Windows\System\irLkEZb.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\JnTmaMZ.exe
  C:\Windows\System\JnTmaMZ.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\HoIxNSZ.exe
  C:\Windows\System\HoIxNSZ.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\KOKGFAs.exe
  C:\Windows\System\KOKGFAs.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\WkLOmtA.exe
  C:\Windows\System\WkLOmtA.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\rkFCCRf.exe
  C:\Windows\System\rkFCCRf.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\Vhlrxfk.exe
  C:\Windows\System\Vhlrxfk.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\oLJqINT.exe
  C:\Windows\System\oLJqINT.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\enhpdVN.exe
  C:\Windows\System\enhpdVN.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\VLTfbpV.exe
  C:\Windows\System\VLTfbpV.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\XLhegoH.exe
  C:\Windows\System\XLhegoH.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\nPEfrRU.exe
  C:\Windows\System\nPEfrRU.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\FIXNYXv.exe
  C:\Windows\System\FIXNYXv.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\ASuEMpt.exe
  C:\Windows\System\ASuEMpt.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\EEyRhPL.exe
  C:\Windows\System\EEyRhPL.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\zyujaYa.exe
  C:\Windows\System\zyujaYa.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\nchEFzx.exe
  C:\Windows\System\nchEFzx.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\rWCOwGY.exe
  C:\Windows\System\rWCOwGY.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\onaQdXD.exe
  C:\Windows\System\onaQdXD.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\bKRTAOA.exe
  C:\Windows\System\bKRTAOA.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\cEmerzs.exe
  C:\Windows\System\cEmerzs.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\JKHnQAn.exe
  C:\Windows\System\JKHnQAn.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\FgLXhSh.exe
  C:\Windows\System\FgLXhSh.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\fKOBjFl.exe
  C:\Windows\System\fKOBjFl.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\tpyvhNv.exe
  C:\Windows\System\tpyvhNv.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\SDNGsfs.exe
  C:\Windows\System\SDNGsfs.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\rKzFMMd.exe
  C:\Windows\System\rKzFMMd.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\vmOCIVA.exe
  C:\Windows\System\vmOCIVA.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\hklXqCc.exe
  C:\Windows\System\hklXqCc.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\vmJvZPP.exe
  C:\Windows\System\vmJvZPP.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\taPZcZp.exe
  C:\Windows\System\taPZcZp.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\bzdOJZe.exe
  C:\Windows\System\bzdOJZe.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\pJMSTCu.exe
  C:\Windows\System\pJMSTCu.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\vkLgSXH.exe
  C:\Windows\System\vkLgSXH.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\qSoUIwZ.exe
  C:\Windows\System\qSoUIwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\nOsXTpf.exe
  C:\Windows\System\nOsXTpf.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\UDiMcth.exe
  C:\Windows\System\UDiMcth.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\ubsJZKw.exe
  C:\Windows\System\ubsJZKw.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\QXpoztQ.exe
  C:\Windows\System\QXpoztQ.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\ddJSlVU.exe
  C:\Windows\System\ddJSlVU.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\obJiBKJ.exe
  C:\Windows\System\obJiBKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\bJixHBc.exe
  C:\Windows\System\bJixHBc.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\pTNtYRT.exe
  C:\Windows\System\pTNtYRT.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\jaFnVlo.exe
  C:\Windows\System\jaFnVlo.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\wWJEoiI.exe
  C:\Windows\System\wWJEoiI.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\yCBmJJR.exe
  C:\Windows\System\yCBmJJR.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\hpFDBdW.exe
  C:\Windows\System\hpFDBdW.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\ReYwDQl.exe
  C:\Windows\System\ReYwDQl.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\sMZDOeF.exe
  C:\Windows\System\sMZDOeF.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\gahLEmo.exe
  C:\Windows\System\gahLEmo.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\WCjfIhf.exe
  C:\Windows\System\WCjfIhf.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\sjXdemR.exe
  C:\Windows\System\sjXdemR.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\SzFZVGf.exe
  C:\Windows\System\SzFZVGf.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\wyPfIJg.exe
  C:\Windows\System\wyPfIJg.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\TDjiHRS.exe
  C:\Windows\System\TDjiHRS.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\SzdPzwM.exe
  C:\Windows\System\SzdPzwM.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\yIPCVdL.exe
  C:\Windows\System\yIPCVdL.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\hjAyhTZ.exe
  C:\Windows\System\hjAyhTZ.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\pRlKIMY.exe
  C:\Windows\System\pRlKIMY.exe
  2⤵
  PID:3220
- C:\Windows\System\UATKLrS.exe
  C:\Windows\System\UATKLrS.exe
  2⤵
  PID:5140
- C:\Windows\System\AImYNmC.exe
  C:\Windows\System\AImYNmC.exe
  2⤵
  PID:5168
- C:\Windows\System\FFAPGtu.exe
  C:\Windows\System\FFAPGtu.exe
  2⤵
  PID:5196
- C:\Windows\System\AmnyacM.exe
  C:\Windows\System\AmnyacM.exe
  2⤵
  PID:5224
- C:\Windows\System\tLpJyTh.exe
  C:\Windows\System\tLpJyTh.exe
  2⤵
  PID:5256
- C:\Windows\System\eHHqdKi.exe
  C:\Windows\System\eHHqdKi.exe
  2⤵
  PID:5280
- C:\Windows\System\XUofQHI.exe
  C:\Windows\System\XUofQHI.exe
  2⤵
  PID:5316
- C:\Windows\System\OwrRAsK.exe
  C:\Windows\System\OwrRAsK.exe
  2⤵
  PID:5344
- C:\Windows\System\gAfnqqD.exe
  C:\Windows\System\gAfnqqD.exe
  2⤵
  PID:5364
- C:\Windows\System\GFgXeGV.exe
  C:\Windows\System\GFgXeGV.exe
  2⤵
  PID:5388
- C:\Windows\System\fvhAsOA.exe
  C:\Windows\System\fvhAsOA.exe
  2⤵
  PID:5420
- C:\Windows\System\neRYhmc.exe
  C:\Windows\System\neRYhmc.exe
  2⤵
  PID:5444
- C:\Windows\System\fuZyIPe.exe
  C:\Windows\System\fuZyIPe.exe
  2⤵
  PID:5472
- C:\Windows\System\bEyxQuD.exe
  C:\Windows\System\bEyxQuD.exe
  2⤵
  PID:5504
- C:\Windows\System\udoPhUL.exe
  C:\Windows\System\udoPhUL.exe
  2⤵
  PID:5532
- C:\Windows\System\PvxWyIH.exe
  C:\Windows\System\PvxWyIH.exe
  2⤵
  PID:5560
- C:\Windows\System\GksPNNt.exe
  C:\Windows\System\GksPNNt.exe
  2⤵
  PID:5588
- C:\Windows\System\unsbCue.exe
  C:\Windows\System\unsbCue.exe
  2⤵
  PID:5612
- C:\Windows\System\KbIiQIe.exe
  C:\Windows\System\KbIiQIe.exe
  2⤵
  PID:5640
- C:\Windows\System\HozgWtj.exe
  C:\Windows\System\HozgWtj.exe
  2⤵
  PID:5668
- C:\Windows\System\UuMyxmB.exe
  C:\Windows\System\UuMyxmB.exe
  2⤵
  PID:5696
- C:\Windows\System\xHZgkCN.exe
  C:\Windows\System\xHZgkCN.exe
  2⤵
  PID:5724
- C:\Windows\System\qtDeMFg.exe
  C:\Windows\System\qtDeMFg.exe
  2⤵
  PID:5752
- C:\Windows\System\knqhHvN.exe
  C:\Windows\System\knqhHvN.exe
  2⤵
  PID:5784
- C:\Windows\System\DGDhrwt.exe
  C:\Windows\System\DGDhrwt.exe
  2⤵
  PID:5812
- C:\Windows\System\xgUUNZH.exe
  C:\Windows\System\xgUUNZH.exe
  2⤵
  PID:5840
- C:\Windows\System\zZPsAoZ.exe
  C:\Windows\System\zZPsAoZ.exe
  2⤵
  PID:5864
- C:\Windows\System\gGMTTxu.exe
  C:\Windows\System\gGMTTxu.exe
  2⤵
  PID:5892
- C:\Windows\System\bNyjpit.exe
  C:\Windows\System\bNyjpit.exe
  2⤵
  PID:5928
- C:\Windows\System\TgSQNIN.exe
  C:\Windows\System\TgSQNIN.exe
  2⤵
  PID:5952
- C:\Windows\System\flVwOdd.exe
  C:\Windows\System\flVwOdd.exe
  2⤵
  PID:5980
- C:\Windows\System\OvRIYEf.exe
  C:\Windows\System\OvRIYEf.exe
  2⤵
  PID:6008
- C:\Windows\System\tCgPKLb.exe
  C:\Windows\System\tCgPKLb.exe
  2⤵
  PID:6036
- C:\Windows\System\YUKANYc.exe
  C:\Windows\System\YUKANYc.exe
  2⤵
  PID:6064
- C:\Windows\System\CiimWPc.exe
  C:\Windows\System\CiimWPc.exe
  2⤵
  PID:6088
- C:\Windows\System\WRKNoMW.exe
  C:\Windows\System\WRKNoMW.exe
  2⤵
  PID:6120
- C:\Windows\System\OIAQrSn.exe
  C:\Windows\System\OIAQrSn.exe
  2⤵
  PID:1516
- C:\Windows\System\WizKulh.exe
  C:\Windows\System\WizKulh.exe
  2⤵
  PID:3604
- C:\Windows\System\pmiOJcu.exe
  C:\Windows\System\pmiOJcu.exe
  2⤵
  PID:3916
- C:\Windows\System\GweOGAP.exe
  C:\Windows\System\GweOGAP.exe
  2⤵
  PID:4928
- C:\Windows\System\SHNHSeY.exe
  C:\Windows\System\SHNHSeY.exe
  2⤵
  PID:4576
- C:\Windows\System\qPowbGz.exe
  C:\Windows\System\qPowbGz.exe
  2⤵
  PID:3832
- C:\Windows\System\HvAqhWF.exe
  C:\Windows\System\HvAqhWF.exe
  2⤵
  PID:2436
- C:\Windows\System\mRkKsCE.exe
  C:\Windows\System\mRkKsCE.exe
  2⤵
  PID:3880
- C:\Windows\System\xOwMwmP.exe
  C:\Windows\System\xOwMwmP.exe
  2⤵
  PID:5124
- C:\Windows\System\AMTeYgC.exe
  C:\Windows\System\AMTeYgC.exe
  2⤵
  PID:5184
- C:\Windows\System\mBLkjjH.exe
  C:\Windows\System\mBLkjjH.exe
  2⤵
  PID:5240
- C:\Windows\System\kemRtiJ.exe
  C:\Windows\System\kemRtiJ.exe
  2⤵
  PID:5300
- C:\Windows\System\vALYUqU.exe
  C:\Windows\System\vALYUqU.exe
  2⤵
  PID:5380
- C:\Windows\System\yGMqrqu.exe
  C:\Windows\System\yGMqrqu.exe
  2⤵
  PID:5440
- C:\Windows\System\fXcYtYs.exe
  C:\Windows\System\fXcYtYs.exe
  2⤵
  PID:5516
- C:\Windows\System\iMfBsGc.exe
  C:\Windows\System\iMfBsGc.exe
  2⤵
  PID:5572
- C:\Windows\System\Jeneirq.exe
  C:\Windows\System\Jeneirq.exe
  2⤵
  PID:5636
- C:\Windows\System\aVRVPkG.exe
  C:\Windows\System\aVRVPkG.exe
  2⤵
  PID:5712
- C:\Windows\System\zxAgZvb.exe
  C:\Windows\System\zxAgZvb.exe
  2⤵
  PID:5772
- C:\Windows\System\kIOLggt.exe
  C:\Windows\System\kIOLggt.exe
  2⤵
  PID:5832
- C:\Windows\System\lVZzjUv.exe
  C:\Windows\System\lVZzjUv.exe
  2⤵
  PID:5908
- C:\Windows\System\RyAiaYH.exe
  C:\Windows\System\RyAiaYH.exe
  2⤵
  PID:5964
- C:\Windows\System\qCPOZIu.exe
  C:\Windows\System\qCPOZIu.exe
  2⤵
  PID:6028
- C:\Windows\System\TqlcxOW.exe
  C:\Windows\System\TqlcxOW.exe
  2⤵
  PID:6168
- C:\Windows\System\LwdnnfU.exe
  C:\Windows\System\LwdnnfU.exe
  2⤵
  PID:6196
- C:\Windows\System\mnsfYIn.exe
  C:\Windows\System\mnsfYIn.exe
  2⤵
  PID:6224
- C:\Windows\System\nbtsqAM.exe
  C:\Windows\System\nbtsqAM.exe
  2⤵
  PID:6252
- C:\Windows\System\PBgCwoR.exe
  C:\Windows\System\PBgCwoR.exe
  2⤵
  PID:6276
- C:\Windows\System\yQggGLR.exe
  C:\Windows\System\yQggGLR.exe
  2⤵
  PID:6304
- C:\Windows\System\XpVKBaF.exe
  C:\Windows\System\XpVKBaF.exe
  2⤵
  PID:6332
- C:\Windows\System\SZPumml.exe
  C:\Windows\System\SZPumml.exe
  2⤵
  PID:6360
- C:\Windows\System\uXKNEKH.exe
  C:\Windows\System\uXKNEKH.exe
  2⤵
  PID:6388
- C:\Windows\System\jDSyoFx.exe
  C:\Windows\System\jDSyoFx.exe
  2⤵
  PID:6416
- C:\Windows\System\gSVMucy.exe
  C:\Windows\System\gSVMucy.exe
  2⤵
  PID:6444
- C:\Windows\System\RHhihuW.exe
  C:\Windows\System\RHhihuW.exe
  2⤵
  PID:6476
- C:\Windows\System\XPxgIDj.exe
  C:\Windows\System\XPxgIDj.exe
  2⤵
  PID:6500
- C:\Windows\System\OnkzkPV.exe
  C:\Windows\System\OnkzkPV.exe
  2⤵
  PID:6528
- C:\Windows\System\RUaKTDE.exe
  C:\Windows\System\RUaKTDE.exe
  2⤵
  PID:6556
- C:\Windows\System\Bhcfxxx.exe
  C:\Windows\System\Bhcfxxx.exe
  2⤵
  PID:6588
- C:\Windows\System\ighXvNH.exe
  C:\Windows\System\ighXvNH.exe
  2⤵
  PID:6616
- C:\Windows\System\vNrTYyR.exe
  C:\Windows\System\vNrTYyR.exe
  2⤵
  PID:6644
- C:\Windows\System\qYUViRR.exe
  C:\Windows\System\qYUViRR.exe
  2⤵
  PID:6672
- C:\Windows\System\anONEGs.exe
  C:\Windows\System\anONEGs.exe
  2⤵
  PID:6696
- C:\Windows\System\FxEjiWg.exe
  C:\Windows\System\FxEjiWg.exe
  2⤵
  PID:6724
- C:\Windows\System\CGAVVkk.exe
  C:\Windows\System\CGAVVkk.exe
  2⤵
  PID:6752
- C:\Windows\System\sveKSnA.exe
  C:\Windows\System\sveKSnA.exe
  2⤵
  PID:6780
- C:\Windows\System\JzlEgMj.exe
  C:\Windows\System\JzlEgMj.exe
  2⤵
  PID:6808
- C:\Windows\System\RJyacbt.exe
  C:\Windows\System\RJyacbt.exe
  2⤵
  PID:6840
- C:\Windows\System\LtowYlc.exe
  C:\Windows\System\LtowYlc.exe
  2⤵
  PID:6868
- C:\Windows\System\IiYozzy.exe
  C:\Windows\System\IiYozzy.exe
  2⤵
  PID:6896
- C:\Windows\System\QZhBOTy.exe
  C:\Windows\System\QZhBOTy.exe
  2⤵
  PID:6924
- C:\Windows\System\OhAXsoc.exe
  C:\Windows\System\OhAXsoc.exe
  2⤵
  PID:6948
- C:\Windows\System\yzVyHCs.exe
  C:\Windows\System\yzVyHCs.exe
  2⤵
  PID:6976
- C:\Windows\System\GhXYcjk.exe
  C:\Windows\System\GhXYcjk.exe
  2⤵
  PID:7008
- C:\Windows\System\OvndnVw.exe
  C:\Windows\System\OvndnVw.exe
  2⤵
  PID:7032
- C:\Windows\System\bdgpGEh.exe
  C:\Windows\System\bdgpGEh.exe
  2⤵
  PID:7064
- C:\Windows\System\RTZqLDd.exe
  C:\Windows\System\RTZqLDd.exe
  2⤵
  PID:7088
- C:\Windows\System\ivgGrAA.exe
  C:\Windows\System\ivgGrAA.exe
  2⤵
  PID:7120
- C:\Windows\System\TsWxBNC.exe
  C:\Windows\System\TsWxBNC.exe
  2⤵
  PID:7148
- C:\Windows\System\jyBsExu.exe
  C:\Windows\System\jyBsExu.exe
  2⤵
  PID:6056
- C:\Windows\System\PjTnyda.exe
  C:\Windows\System\PjTnyda.exe
  2⤵
  PID:6112
- C:\Windows\System\iGwzKGS.exe
  C:\Windows\System\iGwzKGS.exe
  2⤵
  PID:5024
- C:\Windows\System\exiVvtG.exe
  C:\Windows\System\exiVvtG.exe
  2⤵
  PID:1312
- C:\Windows\System\qtNLACn.exe
  C:\Windows\System\qtNLACn.exe
  2⤵
  PID:3216
- C:\Windows\System\vwuFRRl.exe
  C:\Windows\System\vwuFRRl.exe
  2⤵
  PID:5164
- C:\Windows\System\RSNWpiF.exe
  C:\Windows\System\RSNWpiF.exe
  2⤵
  PID:5340
- C:\Windows\System\yWmCTET.exe
  C:\Windows\System\yWmCTET.exe
  2⤵
  PID:5468
- C:\Windows\System\HAHEnqE.exe
  C:\Windows\System\HAHEnqE.exe
  2⤵
  PID:5628
- C:\Windows\System\uIzSjjH.exe
  C:\Windows\System\uIzSjjH.exe
  2⤵
  PID:5800
- C:\Windows\System\jNKKDrs.exe
  C:\Windows\System\jNKKDrs.exe
  2⤵
  PID:5944
- C:\Windows\System\OrCbZjb.exe
  C:\Windows\System\OrCbZjb.exe
  2⤵
  PID:6160
- C:\Windows\System\QzWizKq.exe
  C:\Windows\System\QzWizKq.exe
  2⤵
  PID:6216
- C:\Windows\System\aCSzJQO.exe
  C:\Windows\System\aCSzJQO.exe
  2⤵
  PID:6292
- C:\Windows\System\lfDKRjb.exe
  C:\Windows\System\lfDKRjb.exe
  2⤵
  PID:6352
- C:\Windows\System\knpxGMN.exe
  C:\Windows\System\knpxGMN.exe
  2⤵
  PID:6412
- C:\Windows\System\dcqyWFV.exe
  C:\Windows\System\dcqyWFV.exe
  2⤵
  PID:6492
- C:\Windows\System\ySqadXj.exe
  C:\Windows\System\ySqadXj.exe
  2⤵
  PID:6552
- C:\Windows\System\zPIXbVn.exe
  C:\Windows\System\zPIXbVn.exe
  2⤵
  PID:6608
- C:\Windows\System\RXmeNlj.exe
  C:\Windows\System\RXmeNlj.exe
  2⤵
  PID:6688
- C:\Windows\System\qktGBbs.exe
  C:\Windows\System\qktGBbs.exe
  2⤵
  PID:6748
- C:\Windows\System\yYZEcuA.exe
  C:\Windows\System\yYZEcuA.exe
  2⤵
  PID:6804
- C:\Windows\System\qhDXvbX.exe
  C:\Windows\System\qhDXvbX.exe
  2⤵
  PID:6880
- C:\Windows\System\FOoIbCZ.exe
  C:\Windows\System\FOoIbCZ.exe
  2⤵
  PID:6940
- C:\Windows\System\ewETjMI.exe
  C:\Windows\System\ewETjMI.exe
  2⤵
  PID:7000
- C:\Windows\System\PNYujqI.exe
  C:\Windows\System\PNYujqI.exe
  2⤵
  PID:7076
- C:\Windows\System\oWbhgqS.exe
  C:\Windows\System\oWbhgqS.exe
  2⤵
  PID:7136
- C:\Windows\System\uCqhfjp.exe
  C:\Windows\System\uCqhfjp.exe
  2⤵
  PID:6132
- C:\Windows\System\maArVOZ.exe
  C:\Windows\System\maArVOZ.exe
  2⤵
  PID:3008
- C:\Windows\System\mYngHHB.exe
  C:\Windows\System\mYngHHB.exe
  2⤵
  PID:5276
- C:\Windows\System\xBjcfco.exe
  C:\Windows\System\xBjcfco.exe
  2⤵
  PID:5604
- C:\Windows\System\NwyPMsq.exe
  C:\Windows\System\NwyPMsq.exe
  2⤵
  PID:5884
- C:\Windows\System\WstqTCW.exe
  C:\Windows\System\WstqTCW.exe
  2⤵
  PID:6264
- C:\Windows\System\MahwWRG.exe
  C:\Windows\System\MahwWRG.exe
  2⤵
  PID:6408
- C:\Windows\System\dXxOfxL.exe
  C:\Windows\System\dXxOfxL.exe
  2⤵
  PID:6544
- C:\Windows\System\FUFtrIh.exe
  C:\Windows\System\FUFtrIh.exe
  2⤵
  PID:6716
- C:\Windows\System\tNuqocF.exe
  C:\Windows\System\tNuqocF.exe
  2⤵
  PID:6856
- C:\Windows\System\Hetwadx.exe
  C:\Windows\System\Hetwadx.exe
  2⤵
  PID:6992
- C:\Windows\System\AQqGeTb.exe
  C:\Windows\System\AQqGeTb.exe
  2⤵
  PID:1548
- C:\Windows\System\OrjTDHO.exe
  C:\Windows\System\OrjTDHO.exe
  2⤵
  PID:7176
- C:\Windows\System\JFJEGPS.exe
  C:\Windows\System\JFJEGPS.exe
  2⤵
  PID:7204
- C:\Windows\System\DfWRIzK.exe
  C:\Windows\System\DfWRIzK.exe
  2⤵
  PID:7224
- C:\Windows\System\swsPqoL.exe
  C:\Windows\System\swsPqoL.exe
  2⤵
  PID:7260
- C:\Windows\System\gmmuLRb.exe
  C:\Windows\System\gmmuLRb.exe
  2⤵
  PID:7292
- C:\Windows\System\PbDkTmE.exe
  C:\Windows\System\PbDkTmE.exe
  2⤵
  PID:7320
- C:\Windows\System\dCYPIDw.exe
  C:\Windows\System\dCYPIDw.exe
  2⤵
  PID:7348
- C:\Windows\System\CvulzMF.exe
  C:\Windows\System\CvulzMF.exe
  2⤵
  PID:7376
- C:\Windows\System\uDRttqL.exe
  C:\Windows\System\uDRttqL.exe
  2⤵
  PID:7404
- C:\Windows\System\VfJHbBG.exe
  C:\Windows\System\VfJHbBG.exe
  2⤵
  PID:7432
- C:\Windows\System\UoJNffT.exe
  C:\Windows\System\UoJNffT.exe
  2⤵
  PID:7460
- C:\Windows\System\pBccLsI.exe
  C:\Windows\System\pBccLsI.exe
  2⤵
  PID:7488
- C:\Windows\System\XzUenpB.exe
  C:\Windows\System\XzUenpB.exe
  2⤵
  PID:7516
- C:\Windows\System\bIBFMbf.exe
  C:\Windows\System\bIBFMbf.exe
  2⤵
  PID:7544
- C:\Windows\System\HbHGaGM.exe
  C:\Windows\System\HbHGaGM.exe
  2⤵
  PID:7572
- C:\Windows\System\xbhoRRs.exe
  C:\Windows\System\xbhoRRs.exe
  2⤵
  PID:7600
- C:\Windows\System\raDFtVr.exe
  C:\Windows\System\raDFtVr.exe
  2⤵
  PID:7624
- C:\Windows\System\tHlFMLP.exe
  C:\Windows\System\tHlFMLP.exe
  2⤵
  PID:7656
- C:\Windows\System\iyYsJfT.exe
  C:\Windows\System\iyYsJfT.exe
  2⤵
  PID:7684
- C:\Windows\System\PonlFgw.exe
  C:\Windows\System\PonlFgw.exe
  2⤵
  PID:7712
- C:\Windows\System\ngBpjDj.exe
  C:\Windows\System\ngBpjDj.exe
  2⤵
  PID:7740
- C:\Windows\System\eNGufFL.exe
  C:\Windows\System\eNGufFL.exe
  2⤵
  PID:7768
- C:\Windows\System\ANToRyy.exe
  C:\Windows\System\ANToRyy.exe
  2⤵
  PID:7796
- C:\Windows\System\ThFnadM.exe
  C:\Windows\System\ThFnadM.exe
  2⤵
  PID:7824
- C:\Windows\System\PMQnjpY.exe
  C:\Windows\System\PMQnjpY.exe
  2⤵
  PID:7848
- C:\Windows\System\hYMrHzK.exe
  C:\Windows\System\hYMrHzK.exe
  2⤵
  PID:7880
- C:\Windows\System\ttCsvti.exe
  C:\Windows\System\ttCsvti.exe
  2⤵
  PID:7904
- C:\Windows\System\EQKIdmn.exe
  C:\Windows\System\EQKIdmn.exe
  2⤵
  PID:7936
- C:\Windows\System\QglwDLg.exe
  C:\Windows\System\QglwDLg.exe
  2⤵
  PID:7964
- C:\Windows\System\GttzPju.exe
  C:\Windows\System\GttzPju.exe
  2⤵
  PID:7988
- C:\Windows\System\SHruWtv.exe
  C:\Windows\System\SHruWtv.exe
  2⤵
  PID:8020
- C:\Windows\System\lWBCLgS.exe
  C:\Windows\System\lWBCLgS.exe
  2⤵
  PID:8048
- C:\Windows\System\LOiQtbb.exe
  C:\Windows\System\LOiQtbb.exe
  2⤵
  PID:8076
- C:\Windows\System\CsOmbFr.exe
  C:\Windows\System\CsOmbFr.exe
  2⤵
  PID:8104
- C:\Windows\System\pGBzKvh.exe
  C:\Windows\System\pGBzKvh.exe
  2⤵
  PID:8128
- C:\Windows\System\XzVCgiw.exe
  C:\Windows\System\XzVCgiw.exe
  2⤵
  PID:8160
- C:\Windows\System\WqLocJC.exe
  C:\Windows\System\WqLocJC.exe
  2⤵
  PID:8184
- C:\Windows\System\GXeInNm.exe
  C:\Windows\System\GXeInNm.exe
  2⤵
  PID:5432
- C:\Windows\System\VxSlzrH.exe
  C:\Windows\System\VxSlzrH.exe
  2⤵
  PID:6208
- C:\Windows\System\heZbvws.exe
  C:\Windows\System\heZbvws.exe
  2⤵
  PID:6520
- C:\Windows\System\itEodgJ.exe
  C:\Windows\System\itEodgJ.exe
  2⤵
  PID:6916
- C:\Windows\System\PNlLKUk.exe
  C:\Windows\System\PNlLKUk.exe
  2⤵
  PID:3096
- C:\Windows\System\NdqLXTg.exe
  C:\Windows\System\NdqLXTg.exe
  2⤵
  PID:7244
- C:\Windows\System\gVliVvK.exe
  C:\Windows\System\gVliVvK.exe
  2⤵
  PID:7304
- C:\Windows\System\RKWoczj.exe
  C:\Windows\System\RKWoczj.exe
  2⤵
  PID:7364
- C:\Windows\System\ShlYwfy.exe
  C:\Windows\System\ShlYwfy.exe
  2⤵
  PID:7420
- C:\Windows\System\hOWWuUG.exe
  C:\Windows\System\hOWWuUG.exe
  2⤵
  PID:7476
- C:\Windows\System\wVsVfPt.exe
  C:\Windows\System\wVsVfPt.exe
  2⤵
  PID:7556
- C:\Windows\System\PLZOXON.exe
  C:\Windows\System\PLZOXON.exe
  2⤵
  PID:7616
- C:\Windows\System\PTUbllM.exe
  C:\Windows\System\PTUbllM.exe
  2⤵
  PID:7672
- C:\Windows\System\HKvwcnw.exe
  C:\Windows\System\HKvwcnw.exe
  2⤵
  PID:7732
- C:\Windows\System\PjPlgeP.exe
  C:\Windows\System\PjPlgeP.exe
  2⤵
  PID:7808
- C:\Windows\System\AokHMQh.exe
  C:\Windows\System\AokHMQh.exe
  2⤵
  PID:7868
- C:\Windows\System\ELUZPBC.exe
  C:\Windows\System\ELUZPBC.exe
  2⤵
  PID:7928
- C:\Windows\System\mzEwWUm.exe
  C:\Windows\System\mzEwWUm.exe
  2⤵
  PID:8004
- C:\Windows\System\Evuylym.exe
  C:\Windows\System\Evuylym.exe
  2⤵
  PID:8064
- C:\Windows\System\rHopgbW.exe
  C:\Windows\System\rHopgbW.exe
  2⤵
  PID:8124
- C:\Windows\System\zGJZbJs.exe
  C:\Windows\System\zGJZbJs.exe
  2⤵
  PID:5060
- C:\Windows\System\axTnYTG.exe
  C:\Windows\System\axTnYTG.exe
  2⤵
  PID:6464
- C:\Windows\System\jSipzrv.exe
  C:\Windows\System\jSipzrv.exe
  2⤵
  PID:7112
- C:\Windows\System\aBtUPTy.exe
  C:\Windows\System\aBtUPTy.exe
  2⤵
  PID:1968
- C:\Windows\System\CNPdddV.exe
  C:\Windows\System\CNPdddV.exe
  2⤵
  PID:7392
- C:\Windows\System\xdvBPhR.exe
  C:\Windows\System\xdvBPhR.exe
  2⤵
  PID:7528
- C:\Windows\System\xRtsmks.exe
  C:\Windows\System\xRtsmks.exe
  2⤵
  PID:2992
- C:\Windows\System\TkWmasF.exe
  C:\Windows\System\TkWmasF.exe
  2⤵
  PID:7780
- C:\Windows\System\UCUcNMI.exe
  C:\Windows\System\UCUcNMI.exe
  2⤵
  PID:7920
- C:\Windows\System\AsMhpbN.exe
  C:\Windows\System\AsMhpbN.exe
  2⤵
  PID:8220
- C:\Windows\System\ShvjaDX.exe
  C:\Windows\System\ShvjaDX.exe
  2⤵
  PID:8248
- C:\Windows\System\KnCEkJa.exe
  C:\Windows\System\KnCEkJa.exe
  2⤵
  PID:8272
- C:\Windows\System\FHgPwHk.exe
  C:\Windows\System\FHgPwHk.exe
  2⤵
  PID:8304
- C:\Windows\System\FjUQXRx.exe
  C:\Windows\System\FjUQXRx.exe
  2⤵
  PID:8328
- C:\Windows\System\JFGysJx.exe
  C:\Windows\System\JFGysJx.exe
  2⤵
  PID:8360
- C:\Windows\System\SQUDXGh.exe
  C:\Windows\System\SQUDXGh.exe
  2⤵
  PID:8384
- C:\Windows\System\OwdgDtw.exe
  C:\Windows\System\OwdgDtw.exe
  2⤵
  PID:8416
- C:\Windows\System\DArrKUn.exe
  C:\Windows\System\DArrKUn.exe
  2⤵
  PID:8444
- C:\Windows\System\xPbUOYX.exe
  C:\Windows\System\xPbUOYX.exe
  2⤵
  PID:8472
- C:\Windows\System\iVGIOXX.exe
  C:\Windows\System\iVGIOXX.exe
  2⤵
  PID:8500
- C:\Windows\System\JfMnKzP.exe
  C:\Windows\System\JfMnKzP.exe
  2⤵
  PID:8524
- C:\Windows\System\tpFJoLJ.exe
  C:\Windows\System\tpFJoLJ.exe
  2⤵
  PID:8544
- C:\Windows\System\QMlszbO.exe
  C:\Windows\System\QMlszbO.exe
  2⤵
  PID:8568
- C:\Windows\System\gxuwKBP.exe
  C:\Windows\System\gxuwKBP.exe
  2⤵
  PID:8608
- C:\Windows\System\OEEvBKb.exe
  C:\Windows\System\OEEvBKb.exe
  2⤵
  PID:8640
- C:\Windows\System\wBkRFQv.exe
  C:\Windows\System\wBkRFQv.exe
  2⤵
  PID:8668
- C:\Windows\System\HPrNccL.exe
  C:\Windows\System\HPrNccL.exe
  2⤵
  PID:8696
- C:\Windows\System\tgOeRCP.exe
  C:\Windows\System\tgOeRCP.exe
  2⤵
  PID:8720
- C:\Windows\System\krUoyuv.exe
  C:\Windows\System\krUoyuv.exe
  2⤵
  PID:8752
- C:\Windows\System\BlnrCWI.exe
  C:\Windows\System\BlnrCWI.exe
  2⤵
  PID:8776
- C:\Windows\System\FqJoIbo.exe
  C:\Windows\System\FqJoIbo.exe
  2⤵
  PID:8808
- C:\Windows\System\yNGAZja.exe
  C:\Windows\System\yNGAZja.exe
  2⤵
  PID:8836
- C:\Windows\System\YqOfWTa.exe
  C:\Windows\System\YqOfWTa.exe
  2⤵
  PID:8864
- C:\Windows\System\LoWcNki.exe
  C:\Windows\System\LoWcNki.exe
  2⤵
  PID:8888
- C:\Windows\System\RAJDJGT.exe
  C:\Windows\System\RAJDJGT.exe
  2⤵
  PID:8920
- C:\Windows\System\vpLDfXS.exe
  C:\Windows\System\vpLDfXS.exe
  2⤵
  PID:8948
- C:\Windows\System\uveJncT.exe
  C:\Windows\System\uveJncT.exe
  2⤵
  PID:8976
- C:\Windows\System\DhqQPCe.exe
  C:\Windows\System\DhqQPCe.exe
  2⤵
  PID:9004
- C:\Windows\System\zAMGpzk.exe
  C:\Windows\System\zAMGpzk.exe
  2⤵
  PID:9040
- C:\Windows\System\ofTRCGa.exe
  C:\Windows\System\ofTRCGa.exe
  2⤵
  PID:9072
- C:\Windows\System\TrJYrwW.exe
  C:\Windows\System\TrJYrwW.exe
  2⤵
  PID:9100
- C:\Windows\System\ICoqyqG.exe
  C:\Windows\System\ICoqyqG.exe
  2⤵
  PID:9116
- C:\Windows\System\MzIpHFC.exe
  C:\Windows\System\MzIpHFC.exe
  2⤵
  PID:9144
- C:\Windows\System\sUCYuZF.exe
  C:\Windows\System\sUCYuZF.exe
  2⤵
  PID:9172
- C:\Windows\System\zweshwF.exe
  C:\Windows\System\zweshwF.exe
  2⤵
  PID:9200
- C:\Windows\System\lcRksPz.exe
  C:\Windows\System\lcRksPz.exe
  2⤵
  PID:8032
- C:\Windows\System\ObrvcRa.exe
  C:\Windows\System\ObrvcRa.exe
  2⤵
  PID:8116
- C:\Windows\System\nkHWrsM.exe
  C:\Windows\System\nkHWrsM.exe
  2⤵
  PID:6188
- C:\Windows\System\rKGHiBN.exe
  C:\Windows\System\rKGHiBN.exe
  2⤵
  PID:1932
- C:\Windows\System\LmiDAmo.exe
  C:\Windows\System\LmiDAmo.exe
  2⤵
  PID:7452
- C:\Windows\System\xQaXJBt.exe
  C:\Windows\System\xQaXJBt.exe
  2⤵
  PID:7724
- C:\Windows\System\jsJSTeA.exe
  C:\Windows\System\jsJSTeA.exe
  2⤵
  PID:8212
- C:\Windows\System\xXpVdyo.exe
  C:\Windows\System\xXpVdyo.exe
  2⤵
  PID:8268
- C:\Windows\System\iHpBMCh.exe
  C:\Windows\System\iHpBMCh.exe
  2⤵
  PID:8320
- C:\Windows\System\DnvMTNc.exe
  C:\Windows\System\DnvMTNc.exe
  2⤵
  PID:8376
- C:\Windows\System\RSqyRUs.exe
  C:\Windows\System\RSqyRUs.exe
  2⤵
  PID:8432
- C:\Windows\System\JKHbzzI.exe
  C:\Windows\System\JKHbzzI.exe
  2⤵
  PID:4628
- C:\Windows\System\AvjXeae.exe
  C:\Windows\System\AvjXeae.exe
  2⤵
  PID:8556
- C:\Windows\System\FdnEWCL.exe
  C:\Windows\System\FdnEWCL.exe
  2⤵
  PID:8624
- C:\Windows\System\rOMCkGd.exe
  C:\Windows\System\rOMCkGd.exe
  2⤵
  PID:8680
- C:\Windows\System\iVocjse.exe
  C:\Windows\System\iVocjse.exe
  2⤵
  PID:8740
- C:\Windows\System\MhEZZbE.exe
  C:\Windows\System\MhEZZbE.exe
  2⤵
  PID:8796
- C:\Windows\System\mnPPnxI.exe
  C:\Windows\System\mnPPnxI.exe
  2⤵
  PID:8852
- C:\Windows\System\gPzFGFU.exe
  C:\Windows\System\gPzFGFU.exe
  2⤵
  PID:8884
- C:\Windows\System\xAEtlRf.exe
  C:\Windows\System\xAEtlRf.exe
  2⤵
  PID:8936
- C:\Windows\System\bsBPjkB.exe
  C:\Windows\System\bsBPjkB.exe
  2⤵
  PID:8996
- C:\Windows\System\kPjFkIm.exe
  C:\Windows\System\kPjFkIm.exe
  2⤵
  PID:9060
- C:\Windows\System\ESbrXff.exe
  C:\Windows\System\ESbrXff.exe
  2⤵
  PID:9112
- C:\Windows\System\UVEGYIQ.exe
  C:\Windows\System\UVEGYIQ.exe
  2⤵
  PID:9184
- C:\Windows\System\gSoTXWC.exe
  C:\Windows\System\gSoTXWC.exe
  2⤵
  PID:2644
- C:\Windows\System\slnimpe.exe
  C:\Windows\System\slnimpe.exe
  2⤵
  PID:6800
- C:\Windows\System\zOJMbkr.exe
  C:\Windows\System\zOJMbkr.exe
  2⤵
  PID:7588
- C:\Windows\System\OCJoXCI.exe
  C:\Windows\System\OCJoXCI.exe
  2⤵
  PID:8204
- C:\Windows\System\kaEDsln.exe
  C:\Windows\System\kaEDsln.exe
  2⤵
  PID:4680
- C:\Windows\System\YcbAAZT.exe
  C:\Windows\System\YcbAAZT.exe
  2⤵
  PID:2124
- C:\Windows\System\IuBrIUV.exe
  C:\Windows\System\IuBrIUV.exe
  2⤵
  PID:8484
- C:\Windows\System\mxjIrni.exe
  C:\Windows\System\mxjIrni.exe
  2⤵
  PID:8592
- C:\Windows\System\urihOza.exe
  C:\Windows\System\urihOza.exe
  2⤵
  PID:8736
- C:\Windows\System\YqkOZPl.exe
  C:\Windows\System\YqkOZPl.exe
  2⤵
  PID:4500
- C:\Windows\System\NGzwnVh.exe
  C:\Windows\System\NGzwnVh.exe
  2⤵
  PID:8828
- C:\Windows\System\lAzhjPL.exe
  C:\Windows\System\lAzhjPL.exe
  2⤵
  PID:8880
- C:\Windows\System\hpevLpL.exe
  C:\Windows\System\hpevLpL.exe
  2⤵
  PID:9032
- C:\Windows\System\CTyuvrU.exe
  C:\Windows\System\CTyuvrU.exe
  2⤵
  PID:9156
- C:\Windows\System\eTyuVrX.exe
  C:\Windows\System\eTyuVrX.exe
  2⤵
  PID:4212
- C:\Windows\System\uUVHNRZ.exe
  C:\Windows\System\uUVHNRZ.exe
  2⤵
  PID:7336
- C:\Windows\System\xJpLyqS.exe
  C:\Windows\System\xJpLyqS.exe
  2⤵
  PID:1948
- C:\Windows\System\gQAAIvd.exe
  C:\Windows\System\gQAAIvd.exe
  2⤵
  PID:8536
- C:\Windows\System\GIttdNF.exe
  C:\Windows\System\GIttdNF.exe
  2⤵
  PID:8768
- C:\Windows\System\hQaxhnk.exe
  C:\Windows\System\hQaxhnk.exe
  2⤵
  PID:9220
- C:\Windows\System\DNkbqnD.exe
  C:\Windows\System\DNkbqnD.exe
  2⤵
  PID:9244
- C:\Windows\System\foEDxnY.exe
  C:\Windows\System\foEDxnY.exe
  2⤵
  PID:9276
- C:\Windows\System\hvyboiz.exe
  C:\Windows\System\hvyboiz.exe
  2⤵
  PID:9304
- C:\Windows\System\eOuBKSH.exe
  C:\Windows\System\eOuBKSH.exe
  2⤵
  PID:9332
- C:\Windows\System\wFuOHjy.exe
  C:\Windows\System\wFuOHjy.exe
  2⤵
  PID:9360
- C:\Windows\System\RuPWWOU.exe
  C:\Windows\System\RuPWWOU.exe
  2⤵
  PID:9388
- C:\Windows\System\ZbRHqlO.exe
  C:\Windows\System\ZbRHqlO.exe
  2⤵
  PID:9416
- C:\Windows\System\BvKTxTb.exe
  C:\Windows\System\BvKTxTb.exe
  2⤵
  PID:9444
- C:\Windows\System\kFfCaXE.exe
  C:\Windows\System\kFfCaXE.exe
  2⤵
  PID:9472
- C:\Windows\System\zVBNrph.exe
  C:\Windows\System\zVBNrph.exe
  2⤵
  PID:9500
- C:\Windows\System\ERfjfgW.exe
  C:\Windows\System\ERfjfgW.exe
  2⤵
  PID:9524
- C:\Windows\System\pmkNtvY.exe
  C:\Windows\System\pmkNtvY.exe
  2⤵
  PID:9552
- C:\Windows\System\xuYCMwm.exe
  C:\Windows\System\xuYCMwm.exe
  2⤵
  PID:9584
- C:\Windows\System\vKdOKXC.exe
  C:\Windows\System\vKdOKXC.exe
  2⤵
  PID:9612
- C:\Windows\System\IqZHIHz.exe
  C:\Windows\System\IqZHIHz.exe
  2⤵
  PID:9636
- C:\Windows\System\JBNeDVO.exe
  C:\Windows\System\JBNeDVO.exe
  2⤵
  PID:9668
- C:\Windows\System\WXnMksN.exe
  C:\Windows\System\WXnMksN.exe
  2⤵
  PID:9696
- C:\Windows\System\AEotgXf.exe
  C:\Windows\System\AEotgXf.exe
  2⤵
  PID:9720
- C:\Windows\System\nhtalRQ.exe
  C:\Windows\System\nhtalRQ.exe
  2⤵
  PID:9748
- C:\Windows\System\oeXOxhD.exe
  C:\Windows\System\oeXOxhD.exe
  2⤵
  PID:9776
- C:\Windows\System\zZnrpRJ.exe
  C:\Windows\System\zZnrpRJ.exe
  2⤵
  PID:9804
- C:\Windows\System\IAPggEV.exe
  C:\Windows\System\IAPggEV.exe
  2⤵
  PID:9836
- C:\Windows\System\ARzhqza.exe
  C:\Windows\System\ARzhqza.exe
  2⤵
  PID:9860
- C:\Windows\System\BJuoifi.exe
  C:\Windows\System\BJuoifi.exe
  2⤵
  PID:9892
- C:\Windows\System\hPboVxj.exe
  C:\Windows\System\hPboVxj.exe
  2⤵
  PID:9920
- C:\Windows\System\dEIOCNS.exe
  C:\Windows\System\dEIOCNS.exe
  2⤵
  PID:9948
- C:\Windows\System\HFXsNyG.exe
  C:\Windows\System\HFXsNyG.exe
  2⤵
  PID:9964
- C:\Windows\System\YGpovIo.exe
  C:\Windows\System\YGpovIo.exe
  2⤵
  PID:10060
- C:\Windows\System\ZbKYdhp.exe
  C:\Windows\System\ZbKYdhp.exe
  2⤵
  PID:10084
- C:\Windows\System\MENeTDD.exe
  C:\Windows\System\MENeTDD.exe
  2⤵
  PID:10104
- C:\Windows\System\eGEcIZi.exe
  C:\Windows\System\eGEcIZi.exe
  2⤵
  PID:10124
- C:\Windows\System\AwMrhyZ.exe
  C:\Windows\System\AwMrhyZ.exe
  2⤵
  PID:10148
- C:\Windows\System\ACQtShT.exe
  C:\Windows\System\ACQtShT.exe
  2⤵
  PID:10164
- C:\Windows\System\TQVplcJ.exe
  C:\Windows\System\TQVplcJ.exe
  2⤵
  PID:10188
- C:\Windows\System\sTDZkIS.exe
  C:\Windows\System\sTDZkIS.exe
  2⤵
  PID:10204
- C:\Windows\System\QQhqMFV.exe
  C:\Windows\System\QQhqMFV.exe
  2⤵
  PID:10224
- C:\Windows\System\LCiWIHS.exe
  C:\Windows\System\LCiWIHS.exe
  2⤵
  PID:2172
- C:\Windows\System\VPiFJYU.exe
  C:\Windows\System\VPiFJYU.exe
  2⤵
  PID:9088
- C:\Windows\System\pXqjZvG.exe
  C:\Windows\System\pXqjZvG.exe
  2⤵
  PID:5860
- C:\Windows\System\dQepgKq.exe
  C:\Windows\System\dQepgKq.exe
  2⤵
  PID:8372
- C:\Windows\System\QlEqxMK.exe
  C:\Windows\System\QlEqxMK.exe
  2⤵
  PID:8772
- C:\Windows\System\pEJcugM.exe
  C:\Windows\System\pEJcugM.exe
  2⤵
  PID:9288
- C:\Windows\System\wWZKygo.exe
  C:\Windows\System\wWZKygo.exe
  2⤵
  PID:9348
- C:\Windows\System\priplvW.exe
  C:\Windows\System\priplvW.exe
  2⤵
  PID:2216
- C:\Windows\System\tjbcQJQ.exe
  C:\Windows\System\tjbcQJQ.exe
  2⤵
  PID:9484
- C:\Windows\System\YUAdhoU.exe
  C:\Windows\System\YUAdhoU.exe
  2⤵
  PID:9516
- C:\Windows\System\zRFryPw.exe
  C:\Windows\System\zRFryPw.exe
  2⤵
  PID:9596
- C:\Windows\System\hSJppeE.exe
  C:\Windows\System\hSJppeE.exe
  2⤵
  PID:9632
- C:\Windows\System\sZDMhHT.exe
  C:\Windows\System\sZDMhHT.exe
  2⤵
  PID:9660
- C:\Windows\System\uXDIozp.exe
  C:\Windows\System\uXDIozp.exe
  2⤵
  PID:9684
- C:\Windows\System\odqjYvV.exe
  C:\Windows\System\odqjYvV.exe
  2⤵
  PID:2204
- C:\Windows\System\aPKDvig.exe
  C:\Windows\System\aPKDvig.exe
  2⤵
  PID:3048
- C:\Windows\System\RaPmMfc.exe
  C:\Windows\System\RaPmMfc.exe
  2⤵
  PID:9908
- C:\Windows\System\WqCDyKu.exe
  C:\Windows\System\WqCDyKu.exe
  2⤵
  PID:5008
- C:\Windows\System\sZUaBsg.exe
  C:\Windows\System\sZUaBsg.exe
  2⤵
  PID:10016
- C:\Windows\System\mDtqitm.exe
  C:\Windows\System\mDtqitm.exe
  2⤵
  PID:2244
- C:\Windows\System\rTdNWRZ.exe
  C:\Windows\System\rTdNWRZ.exe
  2⤵
  PID:5004
- C:\Windows\System\qoiidBc.exe
  C:\Windows\System\qoiidBc.exe
  2⤵
  PID:4224
- C:\Windows\System\soBYfLu.exe
  C:\Windows\System\soBYfLu.exe
  2⤵
  PID:10144
- C:\Windows\System\DGacuLH.exe
  C:\Windows\System\DGacuLH.exe
  2⤵
  PID:10136
- C:\Windows\System\uFIavyU.exe
  C:\Windows\System\uFIavyU.exe
  2⤵
  PID:10220
- C:\Windows\System\ezKxqcx.exe
  C:\Windows\System\ezKxqcx.exe
  2⤵
  PID:3052
- C:\Windows\System\LkhkJoW.exe
  C:\Windows\System\LkhkJoW.exe
  2⤵
  PID:7896
- C:\Windows\System\SMDMMdV.exe
  C:\Windows\System\SMDMMdV.exe
  2⤵
  PID:4164
- C:\Windows\System\dPpMZVJ.exe
  C:\Windows\System\dPpMZVJ.exe
  2⤵
  PID:9324
- C:\Windows\System\bptjXpf.exe
  C:\Windows\System\bptjXpf.exe
  2⤵
  PID:9628
- C:\Windows\System\nCsBSoE.exe
  C:\Windows\System\nCsBSoE.exe
  2⤵
  PID:9744
- C:\Windows\System\oBhoMJg.exe
  C:\Windows\System\oBhoMJg.exe
  2⤵
  PID:9624
- C:\Windows\System\czDxbdR.exe
  C:\Windows\System\czDxbdR.exe
  2⤵
  PID:9820
- C:\Windows\System\TFkAvHy.exe
  C:\Windows\System\TFkAvHy.exe
  2⤵
  PID:4488
- C:\Windows\System\kfpoMeI.exe
  C:\Windows\System\kfpoMeI.exe
  2⤵
  PID:5076
- C:\Windows\System\MjFPDVk.exe
  C:\Windows\System\MjFPDVk.exe
  2⤵
  PID:10096
- C:\Windows\System\ouItscN.exe
  C:\Windows\System\ouItscN.exe
  2⤵
  PID:9212
- C:\Windows\System\XHlBuzu.exe
  C:\Windows\System\XHlBuzu.exe
  2⤵
  PID:8660
- C:\Windows\System\HNJCKZS.exe
  C:\Windows\System\HNJCKZS.exe
  2⤵
  PID:9408
- C:\Windows\System\zWCjcKP.exe
  C:\Windows\System\zWCjcKP.exe
  2⤵
  PID:9800
- C:\Windows\System\BqZXULm.exe
  C:\Windows\System\BqZXULm.exe
  2⤵
  PID:1732
- C:\Windows\System\knpjvAc.exe
  C:\Windows\System\knpjvAc.exe
  2⤵
  PID:3668
- C:\Windows\System\cuTkfUm.exe
  C:\Windows\System\cuTkfUm.exe
  2⤵
  PID:10232
- C:\Windows\System\ZShQTHK.exe
  C:\Windows\System\ZShQTHK.exe
  2⤵
  PID:1612
- C:\Windows\System\UEbLzZu.exe
  C:\Windows\System\UEbLzZu.exe
  2⤵
  PID:10236
- C:\Windows\System\jadkrMO.exe
  C:\Windows\System\jadkrMO.exe
  2⤵
  PID:10296
- C:\Windows\System\IFpfrrp.exe
  C:\Windows\System\IFpfrrp.exe
  2⤵
  PID:10324
- C:\Windows\System\FtAfWqI.exe
  C:\Windows\System\FtAfWqI.exe
  2⤵
  PID:10340
- C:\Windows\System\XNrqhbT.exe
  C:\Windows\System\XNrqhbT.exe
  2⤵
  PID:10368
- C:\Windows\System\UAdoFDV.exe
  C:\Windows\System\UAdoFDV.exe
  2⤵
  PID:10396
- C:\Windows\System\RCobCUC.exe
  C:\Windows\System\RCobCUC.exe
  2⤵
  PID:10416
- C:\Windows\System\UEYJVWs.exe
  C:\Windows\System\UEYJVWs.exe
  2⤵
  PID:10460
- C:\Windows\System\rGsfJCc.exe
  C:\Windows\System\rGsfJCc.exe
  2⤵
  PID:10480
- C:\Windows\System\cSyflpp.exe
  C:\Windows\System\cSyflpp.exe
  2⤵
  PID:10520
- C:\Windows\System\sGkXffU.exe
  C:\Windows\System\sGkXffU.exe
  2⤵
  PID:10548
- C:\Windows\System\LvKNfie.exe
  C:\Windows\System\LvKNfie.exe
  2⤵
  PID:10568
- C:\Windows\System\dSCLONB.exe
  C:\Windows\System\dSCLONB.exe
  2⤵
  PID:10604
- C:\Windows\System\bxiseDH.exe
  C:\Windows\System\bxiseDH.exe
  2⤵
  PID:10620
- C:\Windows\System\XvOkxFe.exe
  C:\Windows\System\XvOkxFe.exe
  2⤵
  PID:10640
- C:\Windows\System\FMUzqOv.exe
  C:\Windows\System\FMUzqOv.exe
  2⤵
  PID:10672
- C:\Windows\System\cutBIvi.exe
  C:\Windows\System\cutBIvi.exe
  2⤵
  PID:10712
- C:\Windows\System\gcapyGO.exe
  C:\Windows\System\gcapyGO.exe
  2⤵
  PID:10744
- C:\Windows\System\SnEdIUT.exe
  C:\Windows\System\SnEdIUT.exe
  2⤵
  PID:10772
- C:\Windows\System\txjCypu.exe
  C:\Windows\System\txjCypu.exe
  2⤵
  PID:10800
- C:\Windows\System\MySHyHy.exe
  C:\Windows\System\MySHyHy.exe
  2⤵
  PID:10816
- C:\Windows\System\RhlnmdP.exe
  C:\Windows\System\RhlnmdP.exe
  2⤵
  PID:10844
- C:\Windows\System\GJtjqbG.exe
  C:\Windows\System\GJtjqbG.exe
  2⤵
  PID:10868
- C:\Windows\System\fDGtSoy.exe
  C:\Windows\System\fDGtSoy.exe
  2⤵
  PID:10900
- C:\Windows\System\hvfPzHK.exe
  C:\Windows\System\hvfPzHK.exe
  2⤵
  PID:10940
- C:\Windows\System\uHkETIg.exe
  C:\Windows\System\uHkETIg.exe
  2⤵
  PID:10956
- C:\Windows\System\hBFmxLC.exe
  C:\Windows\System\hBFmxLC.exe
  2⤵
  PID:10976
- C:\Windows\System\ZJYnDle.exe
  C:\Windows\System\ZJYnDle.exe
  2⤵
  PID:11008
- C:\Windows\System\gTJmstD.exe
  C:\Windows\System\gTJmstD.exe
  2⤵
  PID:11028
- C:\Windows\System\mvXbMkf.exe
  C:\Windows\System\mvXbMkf.exe
  2⤵
  PID:11052
- C:\Windows\System\bNedzBv.exe
  C:\Windows\System\bNedzBv.exe
  2⤵
  PID:11108
- C:\Windows\System\NkYJOSl.exe
  C:\Windows\System\NkYJOSl.exe
  2⤵
  PID:11136
- C:\Windows\System\wlkKDUi.exe
  C:\Windows\System\wlkKDUi.exe
  2⤵
  PID:11164
- C:\Windows\System\fAYFBbq.exe
  C:\Windows\System\fAYFBbq.exe
  2⤵
  PID:11180
- C:\Windows\System\GrSWIva.exe
  C:\Windows\System\GrSWIva.exe
  2⤵
  PID:11220
- C:\Windows\System\DTGhtdP.exe
  C:\Windows\System\DTGhtdP.exe
  2⤵
  PID:11248
- C:\Windows\System\ZQmzzQK.exe
  C:\Windows\System\ZQmzzQK.exe
  2⤵
  PID:10200
- C:\Windows\System\JSekajk.exe
  C:\Windows\System\JSekajk.exe
  2⤵
  PID:10276
- C:\Windows\System\Gltfxxt.exe
  C:\Windows\System\Gltfxxt.exe
  2⤵
  PID:10336
- C:\Windows\System\MdcbBgm.exe
  C:\Windows\System\MdcbBgm.exe
  2⤵
  PID:10440
- C:\Windows\System\ELEmyId.exe
  C:\Windows\System\ELEmyId.exe
  2⤵
  PID:10476
- C:\Windows\System\pCfggKH.exe
  C:\Windows\System\pCfggKH.exe
  2⤵
  PID:10532
- C:\Windows\System\AUPjBxv.exe
  C:\Windows\System\AUPjBxv.exe
  2⤵
  PID:10576
- C:\Windows\System\nRDUdoq.exe
  C:\Windows\System\nRDUdoq.exe
  2⤵
  PID:10660
- C:\Windows\System\xrlFAvH.exe
  C:\Windows\System\xrlFAvH.exe
  2⤵
  PID:10732
- C:\Windows\System\VNWBqid.exe
  C:\Windows\System\VNWBqid.exe
  2⤵
  PID:10812
- C:\Windows\System\Daeizeq.exe
  C:\Windows\System\Daeizeq.exe
  2⤵
  PID:10832
- C:\Windows\System\ISfaLIf.exe
  C:\Windows\System\ISfaLIf.exe
  2⤵
  PID:10888
- C:\Windows\System\ShfjmrC.exe
  C:\Windows\System\ShfjmrC.exe
  2⤵
  PID:10972
- C:\Windows\System\KAfeynu.exe
  C:\Windows\System\KAfeynu.exe
  2⤵
  PID:11048
- C:\Windows\System\ijJqjKm.exe
  C:\Windows\System\ijJqjKm.exe
  2⤵
  PID:11092
- C:\Windows\System\ViRNPzd.exe
  C:\Windows\System\ViRNPzd.exe
  2⤵
  PID:11172
- C:\Windows\System\mRDgjNw.exe
  C:\Windows\System\mRDgjNw.exe
  2⤵
  PID:11244
- C:\Windows\System\jjMaUcw.exe
  C:\Windows\System\jjMaUcw.exe
  2⤵
  PID:10308
- C:\Windows\System\WflEQWx.exe
  C:\Windows\System\WflEQWx.exe
  2⤵
  PID:10444
- C:\Windows\System\duqfVfr.exe
  C:\Windows\System\duqfVfr.exe
  2⤵
  PID:10588
- C:\Windows\System\VpCDHBY.exe
  C:\Windows\System\VpCDHBY.exe
  2⤵
  PID:10728
- C:\Windows\System\ISyqIYV.exe
  C:\Windows\System\ISyqIYV.exe
  2⤵
  PID:10908
- C:\Windows\System\bMneVsq.exe
  C:\Windows\System\bMneVsq.exe
  2⤵
  PID:11024
- C:\Windows\System\WYAgJLc.exe
  C:\Windows\System\WYAgJLc.exe
  2⤵
  PID:11216
- C:\Windows\System\eiIRfDH.exe
  C:\Windows\System\eiIRfDH.exe
  2⤵
  PID:10556
- C:\Windows\System\zTYjYzA.exe
  C:\Windows\System\zTYjYzA.exe
  2⤵
  PID:10616
- C:\Windows\System\EnGDhAN.exe
  C:\Windows\System\EnGDhAN.exe
  2⤵
  PID:11100
- C:\Windows\System\WmTrenT.exe
  C:\Windows\System\WmTrenT.exe
  2⤵
  PID:10504
- C:\Windows\System\BXYgMqn.exe
  C:\Windows\System\BXYgMqn.exe
  2⤵
  PID:11284
- C:\Windows\System\GtiRXMI.exe
  C:\Windows\System\GtiRXMI.exe
  2⤵
  PID:11316
- C:\Windows\System\vlpgACu.exe
  C:\Windows\System\vlpgACu.exe
  2⤵
  PID:11348
- C:\Windows\System\VxeBRCX.exe
  C:\Windows\System\VxeBRCX.exe
  2⤵
  PID:11380
- C:\Windows\System\QRuZxHB.exe
  C:\Windows\System\QRuZxHB.exe
  2⤵
  PID:11396
- C:\Windows\System\aHXxJMV.exe
  C:\Windows\System\aHXxJMV.exe
  2⤵
  PID:11456
- C:\Windows\System\ZpFrMJd.exe
  C:\Windows\System\ZpFrMJd.exe
  2⤵
  PID:11480
- C:\Windows\System\VmZDciS.exe
  C:\Windows\System\VmZDciS.exe
  2⤵
  PID:11508
- C:\Windows\System\kmqNiDg.exe
  C:\Windows\System\kmqNiDg.exe
  2⤵
  PID:11524
- C:\Windows\System\wwViqob.exe
  C:\Windows\System\wwViqob.exe
  2⤵
  PID:11568
- C:\Windows\System\CNqRBhn.exe
  C:\Windows\System\CNqRBhn.exe
  2⤵
  PID:11584
- C:\Windows\System\pwIkUiD.exe
  C:\Windows\System\pwIkUiD.exe
  2⤵
  PID:11604
- C:\Windows\System\DAJavvO.exe
  C:\Windows\System\DAJavvO.exe
  2⤵
  PID:11628
- C:\Windows\System\XZpjsbT.exe
  C:\Windows\System\XZpjsbT.exe
  2⤵
  PID:11664
- C:\Windows\System\wBFeIBp.exe
  C:\Windows\System\wBFeIBp.exe
  2⤵
  PID:11692
- C:\Windows\System\kMXIPUt.exe
  C:\Windows\System\kMXIPUt.exe
  2⤵
  PID:11708
- C:\Windows\System\nIDTcpU.exe
  C:\Windows\System\nIDTcpU.exe
  2⤵
  PID:11744
- C:\Windows\System\dNNecnG.exe
  C:\Windows\System\dNNecnG.exe
  2⤵
  PID:11788
- C:\Windows\System\eqswkmJ.exe
  C:\Windows\System\eqswkmJ.exe
  2⤵
  PID:11816
- C:\Windows\System\aSxcDJy.exe
  C:\Windows\System\aSxcDJy.exe
  2⤵
  PID:11852
- C:\Windows\System\HRScwpt.exe
  C:\Windows\System\HRScwpt.exe
  2⤵
  PID:11880
- C:\Windows\System\nPudvID.exe
  C:\Windows\System\nPudvID.exe
  2⤵
  PID:11904
- C:\Windows\System\qUKeRHc.exe
  C:\Windows\System\qUKeRHc.exe
  2⤵
  PID:11928
- C:\Windows\System\KqpiIny.exe
  C:\Windows\System\KqpiIny.exe
  2⤵
  PID:11944
- C:\Windows\System\ByLmEFx.exe
  C:\Windows\System\ByLmEFx.exe
  2⤵
  PID:11964
- C:\Windows\System\aKTjVuy.exe
  C:\Windows\System\aKTjVuy.exe
  2⤵
  PID:12024
- C:\Windows\System\oYrxsOV.exe
  C:\Windows\System\oYrxsOV.exe
  2⤵
  PID:12068
- C:\Windows\System\RNTWCHZ.exe
  C:\Windows\System\RNTWCHZ.exe
  2⤵
  PID:12084
- C:\Windows\System\cmaADhK.exe
  C:\Windows\System\cmaADhK.exe
  2⤵
  PID:12108
- C:\Windows\System\eoJaXNW.exe
  C:\Windows\System\eoJaXNW.exe
  2⤵
  PID:12128
- C:\Windows\System\urDFJTc.exe
  C:\Windows\System\urDFJTc.exe
  2⤵
  PID:12148
- C:\Windows\System\oKdSXEm.exe
  C:\Windows\System\oKdSXEm.exe
  2⤵
  PID:12172
- C:\Windows\System\HnNLHoY.exe
  C:\Windows\System\HnNLHoY.exe
  2⤵
  PID:12200
- C:\Windows\System\IZGpwjp.exe
  C:\Windows\System\IZGpwjp.exe
  2⤵
  PID:12236
- C:\Windows\System\igVRzEX.exe
  C:\Windows\System\igVRzEX.exe
  2⤵
  PID:12252
- C:\Windows\System\PkmYZaO.exe
  C:\Windows\System\PkmYZaO.exe
  2⤵
  PID:12268
- C:\Windows\System\XltwMfN.exe
  C:\Windows\System\XltwMfN.exe
  2⤵
  PID:10924
- C:\Windows\System\BxcJtwX.exe
  C:\Windows\System\BxcJtwX.exe
  2⤵
  PID:11304
- C:\Windows\System\MKGyKVG.exe
  C:\Windows\System\MKGyKVG.exe
  2⤵
  PID:11332
- C:\Windows\System\jWDEIBn.exe
  C:\Windows\System\jWDEIBn.exe
  2⤵
  PID:11376
- C:\Windows\System\hXJkIeh.exe
  C:\Windows\System\hXJkIeh.exe
  2⤵
  PID:11492
- C:\Windows\System\YZVByCN.exe
  C:\Windows\System\YZVByCN.exe
  2⤵
  PID:11576
- C:\Windows\System\WjvufAA.exe
  C:\Windows\System\WjvufAA.exe
  2⤵
  PID:11672
- C:\Windows\System\IZljhgx.exe
  C:\Windows\System\IZljhgx.exe
  2⤵
  PID:11756
- C:\Windows\System\KtGIopS.exe
  C:\Windows\System\KtGIopS.exe
  2⤵
  PID:11776
- C:\Windows\System\aXEGHxZ.exe
  C:\Windows\System\aXEGHxZ.exe
  2⤵
  PID:11860
- C:\Windows\System\cNEJqfA.exe
  C:\Windows\System\cNEJqfA.exe
  2⤵
  PID:11916
- C:\Windows\System\jvxhiUp.exe
  C:\Windows\System\jvxhiUp.exe
  2⤵
  PID:12004
- C:\Windows\System\zBxEUoB.exe
  C:\Windows\System\zBxEUoB.exe
  2⤵
  PID:12076
- C:\Windows\System\RgCaUvn.exe
  C:\Windows\System\RgCaUvn.exe
  2⤵
  PID:12168
- C:\Windows\System\rMYrxil.exe
  C:\Windows\System\rMYrxil.exe
  2⤵
  PID:12260
- C:\Windows\System\GgmQwIg.exe
  C:\Windows\System\GgmQwIg.exe
  2⤵
  PID:11296
- C:\Windows\System\uamMLBM.exe
  C:\Windows\System\uamMLBM.exe
  2⤵
  PID:11440
- C:\Windows\System\EByABPy.exe
  C:\Windows\System\EByABPy.exe
  2⤵
  PID:11496
- C:\Windows\System\kZtJdhp.exe
  C:\Windows\System\kZtJdhp.exe
  2⤵
  PID:11616
- C:\Windows\System\bQSQObx.exe
  C:\Windows\System\bQSQObx.exe
  2⤵
  PID:11844
- C:\Windows\System\tQcDRxm.exe
  C:\Windows\System\tQcDRxm.exe
  2⤵
  PID:11940
- C:\Windows\System\MffmqML.exe
  C:\Windows\System\MffmqML.exe
  2⤵
  PID:12196
- C:\Windows\System\hqrtPRs.exe
  C:\Windows\System\hqrtPRs.exe
  2⤵
  PID:12244
- C:\Windows\System\kuELPMY.exe
  C:\Windows\System\kuELPMY.exe
  2⤵
  PID:11548
- C:\Windows\System\FoubvoA.exe
  C:\Windows\System\FoubvoA.exe
  2⤵
  PID:12144
- C:\Windows\System\jmBwcGE.exe
  C:\Windows\System\jmBwcGE.exe
  2⤵
  PID:12016
- C:\Windows\System\bdSAveK.exe
  C:\Windows\System\bdSAveK.exe
  2⤵
  PID:11552
- C:\Windows\System\pFXBFbF.exe
  C:\Windows\System\pFXBFbF.exe
  2⤵
  PID:12296
- C:\Windows\System\OvZUDtC.exe
  C:\Windows\System\OvZUDtC.exe
  2⤵
  PID:12332
- C:\Windows\System\FRUwFnp.exe
  C:\Windows\System\FRUwFnp.exe
  2⤵
  PID:12360
- C:\Windows\System\vTDttWX.exe
  C:\Windows\System\vTDttWX.exe
  2⤵
  PID:12376
- C:\Windows\System\wGhGaNU.exe
  C:\Windows\System\wGhGaNU.exe
  2⤵
  PID:12400
- C:\Windows\System\jozgFsN.exe
  C:\Windows\System\jozgFsN.exe
  2⤵
  PID:12424
- C:\Windows\System\OCeSQyy.exe
  C:\Windows\System\OCeSQyy.exe
  2⤵
  PID:12456
- C:\Windows\System\tVntkdD.exe
  C:\Windows\System\tVntkdD.exe
  2⤵
  PID:12484
- C:\Windows\System\TjJICXd.exe
  C:\Windows\System\TjJICXd.exe
  2⤵
  PID:12516
- C:\Windows\System\xfVUsqH.exe
  C:\Windows\System\xfVUsqH.exe
  2⤵
  PID:12556
- C:\Windows\System\fEhsAWc.exe
  C:\Windows\System\fEhsAWc.exe
  2⤵
  PID:12576
- C:\Windows\System\rMMcSMS.exe
  C:\Windows\System\rMMcSMS.exe
  2⤵
  PID:12600
- C:\Windows\System\XjLpjaD.exe
  C:\Windows\System\XjLpjaD.exe
  2⤵
  PID:12624
- C:\Windows\System\GuzVjNs.exe
  C:\Windows\System\GuzVjNs.exe
  2⤵
  PID:12652
- C:\Windows\System\FIfaCVI.exe
  C:\Windows\System\FIfaCVI.exe
  2⤵
  PID:12688
- C:\Windows\System\QMBuUfr.exe
  C:\Windows\System\QMBuUfr.exe
  2⤵
  PID:12720
- C:\Windows\System\BPkckCA.exe
  C:\Windows\System\BPkckCA.exe
  2⤵
  PID:12740
- C:\Windows\System\eeZLRpZ.exe
  C:\Windows\System\eeZLRpZ.exe
  2⤵
  PID:12760
- C:\Windows\System\OcYBoTY.exe
  C:\Windows\System\OcYBoTY.exe
  2⤵
  PID:12788
- C:\Windows\System\gFvTjoQ.exe
  C:\Windows\System\gFvTjoQ.exe
  2⤵
  PID:12804
- C:\Windows\System\PVMENEo.exe
  C:\Windows\System\PVMENEo.exe
  2⤵
  PID:12836
- C:\Windows\System\HIAaxgK.exe
  C:\Windows\System\HIAaxgK.exe
  2⤵
  PID:12864
- C:\Windows\System\XQVbrHg.exe
  C:\Windows\System\XQVbrHg.exe
  2⤵
  PID:12904
- C:\Windows\System\OYrKtSN.exe
  C:\Windows\System\OYrKtSN.exe
  2⤵
  PID:12964
- C:\Windows\System\nMaeFkU.exe
  C:\Windows\System\nMaeFkU.exe
  2⤵
  PID:12980
- C:\Windows\System\ELEniDi.exe
  C:\Windows\System\ELEniDi.exe
  2⤵
  PID:13008
- C:\Windows\System\ePfMYcc.exe
  C:\Windows\System\ePfMYcc.exe
  2⤵
  PID:13024
- C:\Windows\System\lhlhSzJ.exe
  C:\Windows\System\lhlhSzJ.exe
  2⤵
  PID:13068
- C:\Windows\System\hmvkkPu.exe
  C:\Windows\System\hmvkkPu.exe
  2⤵
  PID:13084
- C:\Windows\System\OkROiPJ.exe
  C:\Windows\System\OkROiPJ.exe
  2⤵
  PID:13112
- C:\Windows\System\fJCxlHD.exe
  C:\Windows\System\fJCxlHD.exe
  2⤵
  PID:13140
- C:\Windows\System\RFBHQTg.exe
  C:\Windows\System\RFBHQTg.exe
  2⤵
  PID:13164
- C:\Windows\System\sPRmDzU.exe
  C:\Windows\System\sPRmDzU.exe
  2⤵
  PID:13196
- C:\Windows\System\yNmForI.exe
  C:\Windows\System\yNmForI.exe
  2⤵
  PID:13244
- C:\Windows\System\loEzViz.exe
  C:\Windows\System\loEzViz.exe
  2⤵
  PID:13264
- C:\Windows\System\vASdqzB.exe
  C:\Windows\System\vASdqzB.exe
  2⤵
  PID:13304
- C:\Windows\System\WxTCSvX.exe
  C:\Windows\System\WxTCSvX.exe
  2⤵
  PID:12292
- C:\Windows\System\XFFuSCU.exe
  C:\Windows\System\XFFuSCU.exe
  2⤵
  PID:12352
- C:\Windows\System\kepStqS.exe
  C:\Windows\System\kepStqS.exe
  2⤵
  PID:12420
- C:\Windows\System\qNcncZc.exe
  C:\Windows\System\qNcncZc.exe
  2⤵
  PID:12500
- C:\Windows\System\pHkOaDY.exe
  C:\Windows\System\pHkOaDY.exe
  2⤵
  PID:12540
- C:\Windows\System\yRqZjjz.exe
  C:\Windows\System\yRqZjjz.exe
  2⤵
  PID:12592
- C:\Windows\System\TNvbpSx.exe
  C:\Windows\System\TNvbpSx.exe
  2⤵
  PID:12672
- C:\Windows\System\NNSsUkK.exe
  C:\Windows\System\NNSsUkK.exe
  2⤵
  PID:12704
- C:\Windows\System\bigfLXu.exe
  C:\Windows\System\bigfLXu.exe
  2⤵
  PID:12884
- C:\Windows\System\sysLQYG.exe
  C:\Windows\System\sysLQYG.exe
  2⤵
  PID:12860
- C:\Windows\System\pzJbLeX.exe
  C:\Windows\System\pzJbLeX.exe
  2⤵
  PID:12992
- C:\Windows\System\LUWKjzJ.exe
  C:\Windows\System\LUWKjzJ.exe
  2⤵
  PID:13056
- C:\Windows\System\BIBDVJk.exe
  C:\Windows\System\BIBDVJk.exe
  2⤵
  PID:13156
- C:\Windows\System\ouHXoAv.exe
  C:\Windows\System\ouHXoAv.exe
  2⤵
  PID:13152
- C:\Windows\System\LBecfPy.exe
  C:\Windows\System\LBecfPy.exe
  2⤵
  PID:13236
- C:\Windows\System\aMeVSHE.exe
  C:\Windows\System\aMeVSHE.exe
  2⤵
  PID:11952
- C:\Windows\System\yzzBrQe.exe
  C:\Windows\System\yzzBrQe.exe
  2⤵
  PID:12472
- C:\Windows\System\TajXerp.exe
  C:\Windows\System\TajXerp.exe
  2⤵
  PID:12608
- C:\Windows\System\mdnGFfO.exe
  C:\Windows\System\mdnGFfO.exe
  2⤵
  PID:12796
- C:\Windows\System\WbHElUE.exe
  C:\Windows\System\WbHElUE.exe
  2⤵
  PID:13020
- C:\Windows\System\jVBIEch.exe
  C:\Windows\System\jVBIEch.exe
  2⤵
  PID:13096
- C:\Windows\System\wtPiTMS.exe
  C:\Windows\System\wtPiTMS.exe
  2⤵
  PID:13276
- C:\Windows\System\oQKkDTY.exe
  C:\Windows\System\oQKkDTY.exe
  2⤵
  PID:12548
- C:\Windows\System\MThtJSJ.exe
  C:\Windows\System\MThtJSJ.exe
  2⤵
  PID:12800
- C:\Windows\System\KeUXMob.exe
  C:\Windows\System\KeUXMob.exe
  2⤵
  PID:13108
- C:\Windows\System\OKylyPm.exe
  C:\Windows\System\OKylyPm.exe
  2⤵
  PID:13316
- C:\Windows\System\VQdlIrM.exe
  C:\Windows\System\VQdlIrM.exe
  2⤵
  PID:13352
- C:\Windows\System\ygezgkZ.exe
  C:\Windows\System\ygezgkZ.exe
  2⤵
  PID:13376
- C:\Windows\System\CDvgDMf.exe
  C:\Windows\System\CDvgDMf.exe
  2⤵
  PID:13396
- C:\Windows\System\jdjGjsX.exe
  C:\Windows\System\jdjGjsX.exe
  2⤵
  PID:13420
- C:\Windows\System\zyWZQSE.exe
  C:\Windows\System\zyWZQSE.exe
  2⤵
  PID:13452
- C:\Windows\System\ZtrvOfp.exe
  C:\Windows\System\ZtrvOfp.exe
  2⤵
  PID:13468
- C:\Windows\System\UFkVgnt.exe
  C:\Windows\System\UFkVgnt.exe
  2⤵
  PID:13500
- C:\Windows\System\AprMYiI.exe
  C:\Windows\System\AprMYiI.exe
  2⤵
  PID:13524
- C:\Windows\System\nnZXfFr.exe
  C:\Windows\System\nnZXfFr.exe
  2⤵
  PID:13548
- C:\Windows\System\QaeVmsz.exe
  C:\Windows\System\QaeVmsz.exe
  2⤵
  PID:13568
- C:\Windows\System\rXDuApo.exe
  C:\Windows\System\rXDuApo.exe
  2⤵
  PID:13584
- C:\Windows\System\RtQilNA.exe
  C:\Windows\System\RtQilNA.exe
  2⤵
  PID:13612
- C:\Windows\System\VUhPgTr.exe
  C:\Windows\System\VUhPgTr.exe
  2⤵
  PID:13632
- C:\Windows\System\JWgrHFu.exe
  C:\Windows\System\JWgrHFu.exe
  2⤵
  PID:13660
- C:\Windows\System\NHGgAMC.exe
  C:\Windows\System\NHGgAMC.exe
  2⤵
  PID:13696
- C:\Windows\System\vOHEzhK.exe
  C:\Windows\System\vOHEzhK.exe
  2⤵
  PID:13724
- C:\Windows\System\dmXVUwq.exe
  C:\Windows\System\dmXVUwq.exe
  2⤵
  PID:13752
- C:\Windows\System\TlRBKRX.exe
  C:\Windows\System\TlRBKRX.exe
  2⤵
  PID:13780
- C:\Windows\System\DioJAWL.exe
  C:\Windows\System\DioJAWL.exe
  2⤵
  PID:13816
- C:\Windows\System\BicpXIA.exe
  C:\Windows\System\BicpXIA.exe
  2⤵
  PID:13840
- C:\Windows\System\OQXnuWp.exe
  C:\Windows\System\OQXnuWp.exe
  2⤵
  PID:13860
- C:\Windows\System\fqUnhzb.exe
  C:\Windows\System\fqUnhzb.exe
  2⤵
  PID:13884
- C:\Windows\System\HkDjgVJ.exe
  C:\Windows\System\HkDjgVJ.exe
  2⤵
  PID:13900
- C:\Windows\System\pxhrmxn.exe
  C:\Windows\System\pxhrmxn.exe
  2⤵
  PID:13920
- C:\Windows\System\honBrDi.exe
  C:\Windows\System\honBrDi.exe
  2⤵
  PID:13944
- C:\Windows\System\Ruldfkh.exe
  C:\Windows\System\Ruldfkh.exe
  2⤵
  PID:13960
- C:\Windows\System\KkyuKxd.exe
  C:\Windows\System\KkyuKxd.exe
  2⤵
  PID:13984
- C:\Windows\System\EYqPxPO.exe
  C:\Windows\System\EYqPxPO.exe
  2⤵
  PID:14004
- C:\Windows\System\RFDPWJM.exe
  C:\Windows\System\RFDPWJM.exe
  2⤵
  PID:14036
- C:\Windows\System\nuphsNF.exe
  C:\Windows\System\nuphsNF.exe
  2⤵
  PID:14064
- C:\Windows\System\lobUHni.exe
  C:\Windows\System\lobUHni.exe
  2⤵
  PID:14092
- C:\Windows\System\JZWlReO.exe
  C:\Windows\System\JZWlReO.exe
  2⤵
  PID:14108
- C:\Windows\System\ONhcyyU.exe
  C:\Windows\System\ONhcyyU.exe
  2⤵
  PID:14132
- C:\Windows\System\wNkTqLj.exe
  C:\Windows\System\wNkTqLj.exe
  2⤵
  PID:14160
- C:\Windows\System\dvEXPfG.exe
  C:\Windows\System\dvEXPfG.exe
  2⤵
  PID:14180
- C:\Windows\System\RdIujRr.exe
  C:\Windows\System\RdIujRr.exe
  2⤵
  PID:14208
- C:\Windows\System\tozLfYY.exe
  C:\Windows\System\tozLfYY.exe
  2⤵
  PID:14240
- C:\Windows\System\GfukJXw.exe
  C:\Windows\System\GfukJXw.exe
  2⤵
  PID:14272
- C:\Windows\System\RMoalSW.exe
  C:\Windows\System\RMoalSW.exe
  2⤵
  PID:14288
- C:\Windows\System\wAlrfuN.exe
  C:\Windows\System\wAlrfuN.exe
  2⤵
  PID:14308
- C:\Windows\System\XndXMKN.exe
  C:\Windows\System\XndXMKN.exe
  2⤵
  PID:12852
- C:\Windows\System\fEPuQjq.exe
  C:\Windows\System\fEPuQjq.exe
  2⤵
  PID:13288
- C:\Windows\System\wHvTMWS.exe
  C:\Windows\System\wHvTMWS.exe
  2⤵
  PID:13336
- C:\Windows\System\qXrcIMX.exe
  C:\Windows\System\qXrcIMX.exe
  2⤵
  PID:13480
- C:\Windows\System\ZWFAxtz.exe
  C:\Windows\System\ZWFAxtz.exe
  2⤵
  PID:13440
- C:\Windows\System\qeTrFlg.exe
  C:\Windows\System\qeTrFlg.exe
  2⤵
  PID:13492
- C:\Windows\System\LJPdetO.exe
  C:\Windows\System\LJPdetO.exe
  2⤵
  PID:2380
- C:\Windows\System\sSOKklv.exe
  C:\Windows\System\sSOKklv.exe
  2⤵
  PID:13652
- C:\Windows\System\RHZIirR.exe
  C:\Windows\System\RHZIirR.exe
  2⤵
  PID:13544
- C:\Windows\System\DJQKCaB.exe
  C:\Windows\System\DJQKCaB.exe
  2⤵
  PID:13692
- C:\Windows\System\kAQSPLo.exe
  C:\Windows\System\kAQSPLo.exe
  2⤵
  PID:13736
- C:\Windows\System\NUDpWvg.exe
  C:\Windows\System\NUDpWvg.exe
  2⤵
  PID:3940
- C:\Windows\System\yThFzyB.exe
  C:\Windows\System\yThFzyB.exe
  2⤵
  PID:13716
- C:\Windows\System\ufzmylL.exe
  C:\Windows\System\ufzmylL.exe
  2⤵
  PID:13876
- C:\Windows\System\uMgpQUm.exe
  C:\Windows\System\uMgpQUm.exe
  2⤵
  PID:13972
- C:\Windows\System\eJnSpue.exe
  C:\Windows\System\eJnSpue.exe
  2⤵
  PID:13936
- C:\Windows\System\ShKspIB.exe
  C:\Windows\System\ShKspIB.exe
  2⤵
  PID:14100
- C:\Windows\System\jbliJlt.exe
  C:\Windows\System\jbliJlt.exe
  2⤵
  PID:14140
- C:\Windows\System\IaWlkDd.exe
  C:\Windows\System\IaWlkDd.exe
  2⤵
  PID:14192
- C:\Windows\System\fvPmgmC.exe
  C:\Windows\System\fvPmgmC.exe
  2⤵
  PID:14236
- C:\Windows\System\fHEVxpz.exe
  C:\Windows\System\fHEVxpz.exe
  2⤵
  PID:14300
- C:\Windows\System\ZXadDUg.exe
  C:\Windows\System\ZXadDUg.exe
  2⤵
  PID:13392
- C:\Windows\System\veQCFvU.exe
  C:\Windows\System\veQCFvU.exe
  2⤵
  PID:13436
- C:\Windows\System\MLJcZaF.exe
  C:\Windows\System\MLJcZaF.exe
  2⤵
  PID:14328
- C:\Windows\System\ZebOUJB.exe
  C:\Windows\System\ZebOUJB.exe
  2⤵
  PID:13628
- C:\Windows\System\woDYKGn.exe
  C:\Windows\System\woDYKGn.exe
  2⤵
  PID:13952
- C:\Windows\System\BFAbpny.exe
  C:\Windows\System\BFAbpny.exe
  2⤵
  PID:14340
- C:\Windows\System\krySFOE.exe
  C:\Windows\System\krySFOE.exe
  2⤵
  PID:14356
- C:\Windows\System\NdhgNLG.exe
  C:\Windows\System\NdhgNLG.exe
  2⤵
  PID:14380

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:14340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ASuEMpt.exe

Filesize
2.0MB

MD5
733aeeaa6a1ee767e5682f62945280b7

SHA1
bcd9b03738b76c17d0adb52ecf55fdddac40cd8b

SHA256
cfe353336c10a4e029a4347a8730e057046b3e5f292abc622dcc773773ad3f7d

SHA512
3ce58c6d996f2598fe81f6726b16c62026b84d5dc9581cbcb7c3a6f9fe4be1a4e281eb2ea4cf49a3a61be80fcd3627f8a02ffb0823672e22d7e40b5bab54a5fa

Download Submit
C:\Windows\System\AdvMICr.exe

Filesize
2.0MB

MD5
d5764c06c0e1af7eed80401255661ffe

SHA1
66e736d056cf433986eac39b7b53543e1181f066

SHA256
e971d08515d7a92ae131a02582b13700aa25fafbdad0edcace832931bc79d8f9

SHA512
db624f70a3639217e33ec35e168ce5e25422abd292bb86cd546af0af02b3d37cfeb96b73175bde8be486a0b2ad7e6ae7dfdf9e923119665b9c7c8b48879deb54

Download Submit
C:\Windows\System\BZcDnwg.exe

Filesize
2.0MB

MD5
413e491c3e23409915616523a0b186af

SHA1
c3c63a0e408f35f4c5665e4860ffe9982d924663

SHA256
20e04cd0ae190f2221d0eb4bd94523d06ff83326c25c4f5828bff5a414016ff4

SHA512
ee148f5ff7dd3e6706cb7b62c06895ce5761d58f9d5505cf1d7a252cc57113bcc9e2dcce8e50613b9c51130bad7ba02b5cf6a325978747b321869dc7855035da

Download Submit
C:\Windows\System\EEyRhPL.exe

Filesize
2.0MB

MD5
3f504c786fcfaf13149d04066b543bdd

SHA1
1af0f6d3e0c3c301439e039145b7019d8b3af3ca

SHA256
b5a8fae5cf6826d1d026587c096970df6e9da5f87c846c0b91317f8930ccb8b7

SHA512
de92522e9f6c14839cde57610b14473635d463e068a91335ee0727f05dae2a773e5c8bd0ac5ac5724798751bcde590c231afd32635bc2c52df9cc63044cadadf

Download Submit
C:\Windows\System\FBoUMaI.exe

Filesize
2.0MB

MD5
f9cda6efe88b4297109679b228e4e227

SHA1
5b50e70836140388b62dd7d95474b11dbb03ce8f

SHA256
582c9a661dc15db39165ba25483fbf122d8a65ebf84aaed60af3b313d040f96f

SHA512
ca3cdeee9df65fca0e56276d85223f1bb4096cd3f2cad8158d633cb86c5b97fbc29799bfe4c27b66318d8d99b0fb0e38d847e495d9dbfae6b54ef7af35042b16

Download Submit
C:\Windows\System\FIXNYXv.exe

Filesize
2.0MB

MD5
63ebb42ca7db6242ea8eea1901503bd2

SHA1
258c7a24af6e33e9a8ef56bb2e0f3310d944aa35

SHA256
cc65719a21624ba8d166382aeaa3a3e34d6c05bb6be4aa4660247f4ff36600d3

SHA512
691b32193e0f03c8e02fca58372167ac8e0998be52fbfadafcd24f846981e4a69f45907368f4302f41df378f02f0706845947e0dcc1b86797b51153c8f2f6bd1

Download Submit
C:\Windows\System\FgLXhSh.exe

Filesize
2.0MB

MD5
9796105412c651debce420ada0a44a35

SHA1
406e0a2a0e8c56cb9910e7af6950965805c547a2

SHA256
4240dae7cc42b3b62720fa28d2353de99a7ef461ca58be54e5a75761b7b6ef26

SHA512
9e113bfe6b9a59b6802bed9f8d42aafe3fb376d67a5b66cfad8cd7725992c1dfdc5dc9ca96a9f85ae1385d5224ab74ae22f37e7507280f920f1300716d70edfb

Download Submit
C:\Windows\System\HoIxNSZ.exe

Filesize
2.0MB

MD5
4a293a4fa7803fde2e9391b8f26c63de

SHA1
9004a4b299ecf11f3836ae331767603ea62a9f88

SHA256
668273997571d774fa56d8649324fdf518eb3722985e9555736564bd2f250a5b

SHA512
6eb0d400225502b23a032d3d59161bf7c1e8256f1af357e553348f092b6ba0dad0e7e8db0eed107c736c8212a96dcf7ff80f1ea2ed5d8cd6728c7aa32cff6941

Download Submit
C:\Windows\System\JKHnQAn.exe

Filesize
2.0MB

MD5
abebd14be5b57d9d6736c15ad1fb0834

SHA1
35c34bf78276507ffdc2ccfad9617263f6d0479e

SHA256
1bd2707a98365ce8f668b6b24f1b40de6218b70e76dd6f483516aa4d10467a0d

SHA512
b7344e7efb0b100ce9dc8801333d49fa9fe4910710e9ce5fc3827e16b1cde24723b330065495f76f4dfffbf0c82367817223e59af3d6cab07b3ca6d8930dcb0f

Download Submit
C:\Windows\System\JiZZKIU.exe

Filesize
2.0MB

MD5
edfcab95d39275063efb73b17464fff5

SHA1
5c0fd1a6c313e3e94aa64a416647363ab28d986d

SHA256
b9054798490bed6f729e98490190a0264bc80772ca858e233dc52bfb379ff7d8

SHA512
5ddb2f21b7008fc85339039a28c5daa9766f050470453d4050f5aa85d89b54f54b813fff7457835cf9a87115024e6f8a439ff3a8c2521d3e127d0314982338b7

Download Submit
C:\Windows\System\JnTmaMZ.exe

Filesize
2.0MB

MD5
40d78771998c861c63210739c98d858e

SHA1
5a8e686f26411c136c08db9acdfe8cdb611db026

SHA256
9066055b82104ba7ff446a026173677d211568f6a071995745dac9e7b695efcb

SHA512
009f91ac4509acb19bf5f3e46f908268ff820ea058d83f5ca40214a4d6ae6b598c3318108bcdf6c6b0bba7cdf897092fcd7dee860f93766c11aed1efd10b8583

Download Submit
C:\Windows\System\KOKGFAs.exe

Filesize
2.0MB

MD5
3911e8bb730adfef75793737890d3f8c

SHA1
ad0d4a52229171324b139c2bebbeb2407c434268

SHA256
bb1b8e6b04f18d1c165690d4301f14aa670e8000976742cb37098242203721c8

SHA512
34985a36a5c9e2ee80f2dd9dbf5111154e0927d2fb087bb0e9d0d8f037925543daf28c1d6cd47ef1bff4f492fcee7848ece130719fb479294cd49c019e5d7719

Download Submit
C:\Windows\System\NFcRifC.exe

Filesize
2.0MB

MD5
3f27d66f8cdb3efedc2a7f2542afb3e5

SHA1
cb667e6416e5cc6af09414c7fba42df1544bb372

SHA256
ce20e0abfbac976c95c8347af449ade46554a192a139e5989c684b54d2e7e30a

SHA512
3c9f9def3075de9be277d21480b0df6d6f067880905f577cebbd6604dcefceb479e254d5bef2425e3a47a0df7940b72f9eb569d172c737bd4814cbf49dc04eea

Download Submit
C:\Windows\System\SDNGsfs.exe

Filesize
2.0MB

MD5
d4b29ec1a1f8609de5583061e5db177c

SHA1
744116c2e172b02f5e66c2598757f706d5458118

SHA256
246f359224e96d939ae7f79db1080e8f6d706a0052b384ee39cd39ba01bf7248

SHA512
3ad81bfea00e34b794fec61b9ffed9200b2e3dcb063ee7420191be076de99d3a00cf5a02aa13fdc1367f60b0b9958e3132bb92b756aba4ea2c3388124308aa97

Download Submit
C:\Windows\System\VLTfbpV.exe

Filesize
2.0MB

MD5
7f56ad4660a0180db0b602dee4a3460c

SHA1
240761ab68dc4ff0d4fb7b409e67e7f811712edc

SHA256
a55e033b84fd008252b278b4716d06b9703e8edee7a351c7574614dd04c189d7

SHA512
4b171923aa579ba9370a799b1a633b15a2fd2e132d7c9bfa2066208178ff918ffadcefbd482adc9ee6af68d24fe30faebff38e14900eadb810cc6b0b2ef5126b

Download Submit
C:\Windows\System\Vhlrxfk.exe

Filesize
2.0MB

MD5
6d3bdfdcc19f671c8bc16e6a8cf78c4a

SHA1
1793a9eda53e860058070d4a005ff6e5fcd53455

SHA256
2512c387900b22b3f1320d865df5c6975c88e3f2e889d20faed6a044c85acaac

SHA512
29ccc89b3382881739dc5d3dde8710263fdba875f644748b246d360651e9801549117d4a1fb27c565669b01a758526a80a36fb02f6d31f7c7a040c850732e8a0

Download Submit
C:\Windows\System\WkLOmtA.exe

Filesize
2.0MB

MD5
8ed85c6326ed50df111fa737455780b0

SHA1
d7468c0e28e644ffe1110fdf2b6b908d56583b75

SHA256
e8f98f9dfd07e8df74eb25040e73e3341356e7bd5864b9b925a641c61e2d4279

SHA512
95930841e63a0f0fcf18a11e63a78182b1ed4904b99546e0876fe13694b5bd669311a0def759cdba8ddc9647c9b94f49b69634ce55353674a4cc5ba47c9013a6

Download Submit
C:\Windows\System\XLhegoH.exe

Filesize
2.0MB

MD5
d684f8d01879bc543b59d4f0d46e051a

SHA1
4de5b869b0262eadc60f048ed19d491896b2b794

SHA256
5a5cc78a018498e8580d18b836500db25b8c85c4bc966514978346f07efdb6ee

SHA512
ee94948ef6b091bfcdf721dbe9d212e4087218a0ce5e649bbeb979166de65066fbb1fc0524fa2ba72cbb951236ce735f1d51c5829cbc27e27604ad38f1c35259

Download Submit
C:\Windows\System\bKRTAOA.exe

Filesize
2.0MB

MD5
a48f36c58dd994d6f042c7d86d37fbb3

SHA1
4657de235ecc94769fbb2889294da416e479e35e

SHA256
7815371f14771b9a22795b75ffe47c7f03e5c0f2556457779a7fc5d229833fde

SHA512
cabce7dca87bc49067526ee5748d52472328c289f35bb8d108c7d84549f7f4b23d4dddc5b5e489135a34cb449026cd15bc994fe49fc513b3bee3eb8f38dc712e

Download Submit
C:\Windows\System\cEmerzs.exe

Filesize
2.0MB

MD5
0ff18f697fc7ece72c056beb1faecb30

SHA1
a0b6d39c36b29690040a8fdc42a09fa276d4c385

SHA256
4d4f276ec0444da4d6f70fe8e50899fd4829ea6d1aede3737ee73684fb67d998

SHA512
d65966e5e2aab63bcc01e043716c23b81d86a8fd2c1c0d5343735acdc592ddde92baa13851036e01b2d48bdd37c4c58cdc4c9cf5511f002867842d7b8c8c6f0f

Download Submit
C:\Windows\System\enhpdVN.exe

Filesize
2.0MB

MD5
672c13f318c6ace5ddfad8fe97b952c1

SHA1
045339979bb1e08a7a0e6a721d8867dd06e0882b

SHA256
c64df50f1a81343179e609257911319a826678e441243cc660cabff0b5ba704f

SHA512
03a76491bd42773bab2ec423038357b7531f0e730362a32cc81780be047b49765704138a6c7455504330caacd6b8b3366474137a62528c1b443ffeb54fec58a5

Download Submit
C:\Windows\System\fKOBjFl.exe

Filesize
2.0MB

MD5
e7a68aba8c6c4529d2ac4797baf29b64

SHA1
2af98c829f34cf5bdc53d62ed95fa78ffc2854ad

SHA256
bba6a648e37827391483f57020668e83c292dc5213f6f95c1a98c76d8887624e

SHA512
33e5a5a4a84cd4fe12b854315af3a7e26dbb65b3b990946669b2323e62ebc6859c1f030ab91c5c40db8ee58a8618543f932eec1b40b6fb1f6fe8f51e2a1fb02e

Download Submit
C:\Windows\System\irLkEZb.exe

Filesize
2.0MB

MD5
bfc1c102cce7b2758004942808ecc645

SHA1
cd862947f3368ec45213749077880e576e4bb9cc

SHA256
983c12a3963190e0bfb5fbea59315f0df5bb5b2a3e9e6da58bd43115fa22ebff

SHA512
9950f7b838813514344a8fc354742f3a8d3df6d4c1c7561ea61ce3940d709fb98a20f1fbbc4f024f54ba33e3686dd9405d94ce51efaa07c150fb9f2499daf2cd

Download Submit
C:\Windows\System\lcXAONK.exe

Filesize
2.0MB

MD5
f8963b33669ecb6bc8733bbf23f07cf6

SHA1
c967ee49c802a0788b7c78d4edaf6d912308e9b2

SHA256
efdef077f65ab02044001f61b7982b539517afd2a0ea9349782b7fdc1ad58405

SHA512
c8268f7e31e0bae8cc7c9950ea007c7573a6f231d82f9f8188b3619a4f50e14467a3fbdf4d16ac9dd4601ca5a556346c20d0bb650f93cc64993bff9a071bbf72

Download Submit
C:\Windows\System\nPEfrRU.exe

Filesize
2.0MB

MD5
c360de276e848e93849515db938fdaa7

SHA1
ec4fb37cf2ccf7dbf64ae5df0c2742f1f2e725d0

SHA256
48abfae3df91c5f45e9f0ed1cfa81fa512f519a7549f91f650ac2db0ca96b620

SHA512
ce0a1d207867231527270e0046d5eebf50128599b7e4086a2c950b79a3cec8bd3c8cc818962c8601c8dafac8c6dddfa7086f5e997706114080f32c57afe6626d

Download Submit
C:\Windows\System\nchEFzx.exe

Filesize
2.0MB

MD5
f70e691a5528c3f7088b4c879d741f56

SHA1
791d512fd7bbb01fd7147545a4b1365fef2c32fe

SHA256
f91e0a38918cd8d3d7b4bb08fa1ff81ab9ecaf86eb29bec8eb5bdb50ad9301e4

SHA512
9e86989d071ebb28296d74fbe802f8e5e6f5c5e3cd01c964ee3dbf231dd22b1917e88367886112d469daf5acc08cdd6c6395ec1e96ef18a44f415a8b36a6a80c

Download Submit
C:\Windows\System\oLJqINT.exe

Filesize
2.0MB

MD5
e74fcc9a8e3795fe9377b529b8530d3f

SHA1
59017066b06cd0a519d5d22bc517e0a3441c83c2

SHA256
0143ab76d3d81242ee6465253042461df140607bba60211c47c6287e1b07c198

SHA512
f1e6c189d0fd52112f81728a158c48721c9c515ab3b577fb95edbdb47315e670bd2b03ed5a6d35bf9bee1e07428d3db39a427c8691b4a99292b40f5979059ac9

Download Submit
C:\Windows\System\onaQdXD.exe

Filesize
2.0MB

MD5
7de9c68ff6efe5affe703c4822d3560a

SHA1
a17c82268e1ef27635462a5b748edaa2f12e8cc0

SHA256
dc37f3b47f8ebb8d5d066cdae0dfddc7e35e94fbd8acf6be1155362fbfc7ea7e

SHA512
d3dd872dc736d306ab24256d77a1fc2c6689ec653ea881b096f441fe4a6f8d6d0b452e2d45d6c2210f8252482151fbef826f0e07dd6a542271b618cd49fe4b60

Download Submit
C:\Windows\System\rKzFMMd.exe

Filesize
2.0MB

MD5
367af96e4657bb89f35b144548731c32

SHA1
4de0b8629cd8baf845e90a608aac32de408e2015

SHA256
33341b70616c94de3ad36e84875b8705633edb7f602a67720bff90a3c5dff19c

SHA512
c8ff59e861f37bf8eba42931ccd59d7456df55c9cc42408f08968ff37312a6b9601f6b6e49eb989ce454b46c9e46c9447aaf3a937a3c2f73757e48dd21db1677

Download Submit
C:\Windows\System\rWCOwGY.exe

Filesize
2.0MB

MD5
7186706aae8eb243e0f5efde823cb780

SHA1
b9c5143e19cd11fe35ecb2312d1e2be67b719608

SHA256
c876c25f105bb31ad08525bc00c75d3d0ff7d9b2f2a392f54b3d21f67988d677

SHA512
be5f3e02e38c97cd8f1b41f394b134a1773e984bdc308975c589598bc854581efd40a7043ad82004114ac4a25e128559b1412b2c6372c98df832fd6390b5b664

Download Submit
C:\Windows\System\rkFCCRf.exe

Filesize
2.0MB

MD5
5b76deed5cf019fd9b680ae3ec4c9632

SHA1
b6edd44e994bec44f0ac5bdec3db945cf01eacbf

SHA256
258d2a5a2cbbf9b0544f9c9157d4a4583c3270b7b9948505198df0bcf732a8ad

SHA512
291f0851bcd7eb46668c3a9e880862d7f207a8090d247a79ec7c53b57ccdc7bcbfbcfe32fc2b863c77127b239cf283af1b3138806902404460be85d66239d929

Download Submit
C:\Windows\System\tpyvhNv.exe

Filesize
2.0MB

MD5
63869d70dfc6b8fcbd9ea7801cf2e436

SHA1
655844c6392596abfcddaa26be4239335c159b3a

SHA256
7bba5270c0ddf1b45ea10a3a11a6c75b89b9dbc83c2912d9e59548212d949a5b

SHA512
931ab633fd00c25fc5a3e61eda60c8222fb9e51567706854550f43a376059bc58b8b4c2c83f2341b8459cda93929cbd4821c2ba1d14f1da17c9829865adff187

Download Submit
C:\Windows\System\zyujaYa.exe

Filesize
2.0MB

MD5
0549fe69df7f8309a237a064064f0f77

SHA1
fd37d0ce5c8fc2b13caab7c951fb9fb812c70120

SHA256
3047487c710d243838d33e1e8c6ef551d79d778b1af7fb96577fa13bc16fa1ed

SHA512
670b16e7110ddaa08baece8048411c1a8f8aab90b5edfa2630a9ded49ea6c4238cc617d667ca77ec896ebea5c16e9fc7d6944755006a32b06e02582626a17ee2

Download Submit
memory/648-2188-0x00007FF60BF50000-0x00007FF60C2A4000-memory.dmp

Filesize
3.3MB

Download
memory/648-154-0x00007FF60BF50000-0x00007FF60C2A4000-memory.dmp

Filesize
3.3MB

Download
memory/648-2218-0x00007FF60BF50000-0x00007FF60C2A4000-memory.dmp

Filesize
3.3MB

Download
memory/844-2180-0x00007FF62A110000-0x00007FF62A464000-memory.dmp

Filesize
3.3MB

Download
memory/844-108-0x00007FF62A110000-0x00007FF62A464000-memory.dmp

Filesize
3.3MB

Download
memory/844-2206-0x00007FF62A110000-0x00007FF62A464000-memory.dmp

Filesize
3.3MB

Download
memory/1040-2199-0x00007FF778EC0000-0x00007FF779214000-memory.dmp

Filesize
3.3MB

Download
memory/1040-70-0x00007FF778EC0000-0x00007FF779214000-memory.dmp

Filesize
3.3MB

Download
memory/1072-63-0x00007FF7A2D50000-0x00007FF7A30A4000-memory.dmp

Filesize
3.3MB

Download
memory/1072-2197-0x00007FF7A2D50000-0x00007FF7A30A4000-memory.dmp

Filesize
3.3MB

Download
memory/1104-95-0x00007FF62FCB0000-0x00007FF630004000-memory.dmp

Filesize
3.3MB

Download
memory/1104-181-0x00007FF62FCB0000-0x00007FF630004000-memory.dmp

Filesize
3.3MB

Download
memory/1104-2205-0x00007FF62FCB0000-0x00007FF630004000-memory.dmp

Filesize
3.3MB

Download
memory/1124-160-0x00007FF60A560000-0x00007FF60A8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1124-2217-0x00007FF60A560000-0x00007FF60A8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1124-2187-0x00007FF60A560000-0x00007FF60A8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1496-2202-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp

Filesize
3.3MB

Download
memory/1496-167-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp

Filesize
3.3MB

Download
memory/1496-83-0x00007FF7498F0000-0x00007FF749C44000-memory.dmp

Filesize
3.3MB

Download
memory/1664-134-0x00007FF757A80000-0x00007FF757DD4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-2191-0x00007FF757A80000-0x00007FF757DD4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-15-0x00007FF757A80000-0x00007FF757DD4000-memory.dmp

Filesize
3.3MB

Download
memory/1788-188-0x00007FF6347C0000-0x00007FF634B14000-memory.dmp

Filesize
3.3MB

Download
memory/1788-2213-0x00007FF6347C0000-0x00007FF634B14000-memory.dmp

Filesize
3.3MB

Download
memory/1876-121-0x00007FF73C2E0000-0x00007FF73C634000-memory.dmp

Filesize
3.3MB

Download
memory/1876-2182-0x00007FF73C2E0000-0x00007FF73C634000-memory.dmp

Filesize
3.3MB

Download
memory/1876-2210-0x00007FF73C2E0000-0x00007FF73C634000-memory.dmp

Filesize
3.3MB

Download
memory/1892-114-0x00007FF788D00000-0x00007FF789054000-memory.dmp

Filesize
3.3MB

Download
memory/1892-2181-0x00007FF788D00000-0x00007FF789054000-memory.dmp

Filesize
3.3MB

Download
memory/1892-2207-0x00007FF788D00000-0x00007FF789054000-memory.dmp

Filesize
3.3MB

Download
memory/2360-2190-0x00007FF6F92E0000-0x00007FF6F9634000-memory.dmp

Filesize
3.3MB

Download
memory/2360-43-0x00007FF6F92E0000-0x00007FF6F9634000-memory.dmp

Filesize
3.3MB

Download
memory/2600-50-0x00007FF7DE910000-0x00007FF7DEC64000-memory.dmp

Filesize
3.3MB

Download
memory/2600-2192-0x00007FF7DE910000-0x00007FF7DEC64000-memory.dmp

Filesize
3.3MB

Download
memory/2896-182-0x00007FF741240000-0x00007FF741594000-memory.dmp

Filesize
3.3MB

Download
memory/2896-2214-0x00007FF741240000-0x00007FF741594000-memory.dmp

Filesize
3.3MB

Download
memory/2948-2201-0x00007FF697440000-0x00007FF697794000-memory.dmp

Filesize
3.3MB

Download
memory/2948-77-0x00007FF697440000-0x00007FF697794000-memory.dmp

Filesize
3.3MB

Download
memory/2948-161-0x00007FF697440000-0x00007FF697794000-memory.dmp

Filesize
3.3MB

Download
memory/3260-2204-0x00007FF77A160000-0x00007FF77A4B4000-memory.dmp

Filesize
3.3MB

Download
memory/3260-169-0x00007FF77A160000-0x00007FF77A4B4000-memory.dmp

Filesize
3.3MB

Download
memory/3260-89-0x00007FF77A160000-0x00007FF77A4B4000-memory.dmp

Filesize
3.3MB

Download
memory/3296-2216-0x00007FF791430000-0x00007FF791784000-memory.dmp

Filesize
3.3MB

Download
memory/3296-175-0x00007FF791430000-0x00007FF791784000-memory.dmp

Filesize
3.3MB

Download
memory/3340-2209-0x00007FF74AF50000-0x00007FF74B2A4000-memory.dmp

Filesize
3.3MB

Download
memory/3340-128-0x00007FF74AF50000-0x00007FF74B2A4000-memory.dmp

Filesize
3.3MB

Download
memory/3340-2183-0x00007FF74AF50000-0x00007FF74B2A4000-memory.dmp

Filesize
3.3MB

Download
memory/3416-32-0x00007FF6550F0000-0x00007FF655444000-memory.dmp

Filesize
3.3MB

Download
memory/3416-2195-0x00007FF6550F0000-0x00007FF655444000-memory.dmp

Filesize
3.3MB

Download
memory/3416-127-0x00007FF6550F0000-0x00007FF655444000-memory.dmp

Filesize
3.3MB

Download
memory/3612-2215-0x00007FF63E550000-0x00007FF63E8A4000-memory.dmp

Filesize
3.3MB

Download
memory/3612-168-0x00007FF63E550000-0x00007FF63E8A4000-memory.dmp

Filesize
3.3MB

Download
memory/3612-2189-0x00007FF63E550000-0x00007FF63E8A4000-memory.dmp

Filesize
3.3MB

Download
memory/3640-64-0x00007FF7D1330000-0x00007FF7D1684000-memory.dmp

Filesize
3.3MB

Download
memory/3640-2196-0x00007FF7D1330000-0x00007FF7D1684000-memory.dmp

Filesize
3.3MB

Download
memory/3828-0-0x00007FF7551A0000-0x00007FF7554F4000-memory.dmp

Filesize
3.3MB

Download
memory/3828-1-0x000002F2988F0000-0x000002F298900000-memory.dmp

Filesize
64KB

Download
memory/3828-107-0x00007FF7551A0000-0x00007FF7554F4000-memory.dmp

Filesize
3.3MB

Download
memory/4032-147-0x00007FF6CE930000-0x00007FF6CEC84000-memory.dmp

Filesize
3.3MB

Download
memory/4032-2186-0x00007FF6CE930000-0x00007FF6CEC84000-memory.dmp

Filesize
3.3MB

Download
memory/4032-2211-0x00007FF6CE930000-0x00007FF6CEC84000-memory.dmp

Filesize
3.3MB

Download
memory/4196-2184-0x00007FF6F1090000-0x00007FF6F13E4000-memory.dmp

Filesize
3.3MB

Download
memory/4196-2208-0x00007FF6F1090000-0x00007FF6F13E4000-memory.dmp

Filesize
3.3MB

Download
memory/4196-135-0x00007FF6F1090000-0x00007FF6F13E4000-memory.dmp

Filesize
3.3MB

Download
memory/4320-76-0x00007FF602660000-0x00007FF6029B4000-memory.dmp

Filesize
3.3MB

Download
memory/4320-153-0x00007FF602660000-0x00007FF6029B4000-memory.dmp

Filesize
3.3MB

Download
memory/4320-2200-0x00007FF602660000-0x00007FF6029B4000-memory.dmp

Filesize
3.3MB

Download
memory/4376-2198-0x00007FF7630F0000-0x00007FF763444000-memory.dmp

Filesize
3.3MB

Download
memory/4376-58-0x00007FF7630F0000-0x00007FF763444000-memory.dmp

Filesize
3.3MB

Download
memory/4528-2194-0x00007FF7368B0000-0x00007FF736C04000-memory.dmp

Filesize
3.3MB

Download
memory/4528-59-0x00007FF7368B0000-0x00007FF736C04000-memory.dmp

Filesize
3.3MB

Download
memory/4604-21-0x00007FF68F350000-0x00007FF68F6A4000-memory.dmp

Filesize
3.3MB

Download
memory/4604-2193-0x00007FF68F350000-0x00007FF68F6A4000-memory.dmp

Filesize
3.3MB

Download
memory/4604-120-0x00007FF68F350000-0x00007FF68F6A4000-memory.dmp

Filesize
3.3MB

Download
memory/4676-2185-0x00007FF761260000-0x00007FF7615B4000-memory.dmp

Filesize
3.3MB

Download
memory/4676-2212-0x00007FF761260000-0x00007FF7615B4000-memory.dmp

Filesize
3.3MB

Download
memory/4676-141-0x00007FF761260000-0x00007FF7615B4000-memory.dmp

Filesize
3.3MB

Download
memory/5012-2203-0x00007FF64E300000-0x00007FF64E654000-memory.dmp

Filesize
3.3MB

Download
memory/5012-194-0x00007FF64E300000-0x00007FF64E654000-memory.dmp

Filesize
3.3MB

Download
memory/5012-101-0x00007FF64E300000-0x00007FF64E654000-memory.dmp

Filesize
3.3MB

Download