xmrig | 2535abcf2667b93fced1bab63e8a589a72d9369f691676042ebda7185191b216

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
Size

1.4MB
MD5

39eaf535b39a3767923f82d962830f80
SHA1

1b30e8ce7ae959a73f5c53e45a5bc15abe02da68
SHA256

2535abcf2667b93fced1bab63e8a589a72d9369f691676042ebda7185191b216
SHA512

b13c186081d672bb952ecea25904e4f646a4488d16eb2a94c4d9b65e9f676b317b7c97fdbc50bc2f96ba265d7e09dbca9f9c98122031b749061bfd448a2a2799
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727F15qbrund+fT+gsi0JT/kWi5lkrl:ROdWCCi7/rahlqOdgWqYl

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 56 IoCs

miner

resource	yara_rule
behavioral2/memory/3068-226-0x00007FF7F32E0000-0x00007FF7F3631000-memory.dmp	xmrig
behavioral2/memory/932-256-0x00007FF7C4680000-0x00007FF7C49D1000-memory.dmp	xmrig
behavioral2/memory/1632-265-0x00007FF789090000-0x00007FF7893E1000-memory.dmp	xmrig
behavioral2/memory/1416-272-0x00007FF6EBE50000-0x00007FF6EC1A1000-memory.dmp	xmrig
behavioral2/memory/1344-278-0x00007FF7D35B0000-0x00007FF7D3901000-memory.dmp	xmrig
behavioral2/memory/3876-282-0x00007FF6B8AD0000-0x00007FF6B8E21000-memory.dmp	xmrig
behavioral2/memory/3168-281-0x00007FF7B9770000-0x00007FF7B9AC1000-memory.dmp	xmrig
behavioral2/memory/2192-280-0x00007FF7AFCA0000-0x00007FF7AFFF1000-memory.dmp	xmrig
behavioral2/memory/1656-279-0x00007FF6CE260000-0x00007FF6CE5B1000-memory.dmp	xmrig
behavioral2/memory/520-277-0x00007FF714910000-0x00007FF714C61000-memory.dmp	xmrig
behavioral2/memory/4948-276-0x00007FF6D3380000-0x00007FF6D36D1000-memory.dmp	xmrig
behavioral2/memory/2172-275-0x00007FF619620000-0x00007FF619971000-memory.dmp	xmrig
behavioral2/memory/1032-274-0x00007FF6F8A90000-0x00007FF6F8DE1000-memory.dmp	xmrig
behavioral2/memory/2568-273-0x00007FF6E10D0000-0x00007FF6E1421000-memory.dmp	xmrig
behavioral2/memory/2400-271-0x00007FF6BE8B0000-0x00007FF6BEC01000-memory.dmp	xmrig
behavioral2/memory/4680-270-0x00007FF6BA8F0000-0x00007FF6BAC41000-memory.dmp	xmrig
behavioral2/memory/852-269-0x00007FF6D2090000-0x00007FF6D23E1000-memory.dmp	xmrig
behavioral2/memory/4272-268-0x00007FF618310000-0x00007FF618661000-memory.dmp	xmrig
behavioral2/memory/1624-267-0x00007FF731800000-0x00007FF731B51000-memory.dmp	xmrig
behavioral2/memory/436-266-0x00007FF6B6480000-0x00007FF6B67D1000-memory.dmp	xmrig
behavioral2/memory/1524-264-0x00007FF628670000-0x00007FF6289C1000-memory.dmp	xmrig
behavioral2/memory/4456-263-0x00007FF7F8910000-0x00007FF7F8C61000-memory.dmp	xmrig
behavioral2/memory/3808-218-0x00007FF6702C0000-0x00007FF670611000-memory.dmp	xmrig
behavioral2/memory/3328-207-0x00007FF626140000-0x00007FF626491000-memory.dmp	xmrig
behavioral2/memory/3024-148-0x00007FF6D3C10000-0x00007FF6D3F61000-memory.dmp	xmrig
behavioral2/memory/3980-83-0x00007FF6EED60000-0x00007FF6EF0B1000-memory.dmp	xmrig
behavioral2/memory/3940-2145-0x00007FF61E2F0000-0x00007FF61E641000-memory.dmp	xmrig
behavioral2/memory/668-2280-0x00007FF746120000-0x00007FF746471000-memory.dmp	xmrig
behavioral2/memory/3808-2282-0x00007FF6702C0000-0x00007FF670611000-memory.dmp	xmrig
behavioral2/memory/3024-2284-0x00007FF6D3C10000-0x00007FF6D3F61000-memory.dmp	xmrig
behavioral2/memory/3980-2286-0x00007FF6EED60000-0x00007FF6EF0B1000-memory.dmp	xmrig
behavioral2/memory/1656-2290-0x00007FF6CE260000-0x00007FF6CE5B1000-memory.dmp	xmrig
behavioral2/memory/3068-2292-0x00007FF7F32E0000-0x00007FF7F3631000-memory.dmp	xmrig
behavioral2/memory/2400-2294-0x00007FF6BE8B0000-0x00007FF6BEC01000-memory.dmp	xmrig
behavioral2/memory/1632-2296-0x00007FF789090000-0x00007FF7893E1000-memory.dmp	xmrig
behavioral2/memory/4680-2289-0x00007FF6BA8F0000-0x00007FF6BAC41000-memory.dmp	xmrig
behavioral2/memory/2568-2306-0x00007FF6E10D0000-0x00007FF6E1421000-memory.dmp	xmrig
behavioral2/memory/2192-2323-0x00007FF7AFCA0000-0x00007FF7AFFF1000-memory.dmp	xmrig
behavioral2/memory/852-2337-0x00007FF6D2090000-0x00007FF6D23E1000-memory.dmp	xmrig
behavioral2/memory/1416-2347-0x00007FF6EBE50000-0x00007FF6EC1A1000-memory.dmp	xmrig
behavioral2/memory/1524-2335-0x00007FF628670000-0x00007FF6289C1000-memory.dmp	xmrig
behavioral2/memory/4948-2334-0x00007FF6D3380000-0x00007FF6D36D1000-memory.dmp	xmrig
behavioral2/memory/1032-2331-0x00007FF6F8A90000-0x00007FF6F8DE1000-memory.dmp	xmrig
behavioral2/memory/436-2328-0x00007FF6B6480000-0x00007FF6B67D1000-memory.dmp	xmrig
behavioral2/memory/3876-2322-0x00007FF6B8AD0000-0x00007FF6B8E21000-memory.dmp	xmrig
behavioral2/memory/2868-2320-0x00007FF6E0000000-0x00007FF6E0351000-memory.dmp	xmrig
behavioral2/memory/932-2318-0x00007FF7C4680000-0x00007FF7C49D1000-memory.dmp	xmrig
behavioral2/memory/4456-2316-0x00007FF7F8910000-0x00007FF7F8C61000-memory.dmp	xmrig
behavioral2/memory/3328-2314-0x00007FF626140000-0x00007FF626491000-memory.dmp	xmrig
behavioral2/memory/4168-2312-0x00007FF659540000-0x00007FF659891000-memory.dmp	xmrig
behavioral2/memory/1344-2310-0x00007FF7D35B0000-0x00007FF7D3901000-memory.dmp	xmrig
behavioral2/memory/2172-2308-0x00007FF619620000-0x00007FF619971000-memory.dmp	xmrig
behavioral2/memory/520-2304-0x00007FF714910000-0x00007FF714C61000-memory.dmp	xmrig
behavioral2/memory/1624-2301-0x00007FF731800000-0x00007FF731B51000-memory.dmp	xmrig
behavioral2/memory/4272-2327-0x00007FF618310000-0x00007FF618661000-memory.dmp	xmrig
behavioral2/memory/3168-2302-0x00007FF7B9770000-0x00007FF7B9AC1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
668	ehEuUqm.exe
2868	YGfHcDq.exe
1656	bPRbaim.exe
4168	CrcFavk.exe
3980	jganePM.exe
3024	NscAfPV.exe
3328	UCpzvLv.exe
3808	IipIeeM.exe
3068	ZtXkkpx.exe
2192	XawBxDG.exe
932	BCENMaA.exe
4456	PtUnEmD.exe
1524	HUaMcAR.exe
1632	VDibBTW.exe
436	oevkBaO.exe
3168	JMZJZkG.exe
1624	QJujxiP.exe
4272	QaZpBNY.exe
852	xWTDMSm.exe
4680	HfkLyeX.exe
2400	XJFqhaW.exe
1416	UzKmwAA.exe
2568	iegQVyi.exe
1032	ysxXRff.exe
2172	rYlfpVJ.exe
3876	bPjGExQ.exe
4948	GVCtBZz.exe
520	chvozBh.exe
1344	CCykkFF.exe
5080	mQOGBci.exe
3044	ffFTxmF.exe
4944	AMFOjie.exe
1956	oYXOPZj.exe
452	psXToys.exe
1056	WmuZxYE.exe
3844	perpAWa.exe
512	ULbgHxs.exe
1580	oVwmMgg.exe
4180	pBQFaBF.exe
5004	SClFSYA.exe
4956	RdrpixB.exe
4696	pOpiytn.exe
3752	NEODEbm.exe
964	pFKgFiG.exe
3524	NugvGSH.exe
904	BagDsty.exe
1720	UemHKKs.exe
3916	ASmWpie.exe
4860	fHAoEdr.exe
5056	mZWpJQK.exe
3880	qGEfhuk.exe
4392	FCRrBcv.exe
4464	iktotdy.exe
3792	IKyJbpG.exe
1028	VCdeVHL.exe
3904	hXqaCVY.exe
2156	xcvqBXL.exe
1996	UgQJCwX.exe
4036	FaEXinA.exe
3324	AhqjJbE.exe
4080	BWawoJr.exe
3216	EVoZsKN.exe
2428	itkSUwe.exe
4568	jXGJjXS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3940-0-0x00007FF61E2F0000-0x00007FF61E641000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-6.dat	upx
behavioral2/files/0x00070000000233ff-8.dat	upx
behavioral2/files/0x0007000000023400-24.dat	upx
behavioral2/files/0x0007000000023401-25.dat	upx
behavioral2/files/0x0007000000023405-40.dat	upx
behavioral2/files/0x000700000002340a-107.dat	upx
behavioral2/files/0x0007000000023409-136.dat	upx
behavioral2/files/0x000700000002341f-182.dat	upx
behavioral2/memory/3068-226-0x00007FF7F32E0000-0x00007FF7F3631000-memory.dmp	upx
behavioral2/memory/932-256-0x00007FF7C4680000-0x00007FF7C49D1000-memory.dmp	upx
behavioral2/memory/1632-265-0x00007FF789090000-0x00007FF7893E1000-memory.dmp	upx
behavioral2/memory/1416-272-0x00007FF6EBE50000-0x00007FF6EC1A1000-memory.dmp	upx
behavioral2/memory/1344-278-0x00007FF7D35B0000-0x00007FF7D3901000-memory.dmp	upx
behavioral2/memory/3876-282-0x00007FF6B8AD0000-0x00007FF6B8E21000-memory.dmp	upx
behavioral2/memory/3168-281-0x00007FF7B9770000-0x00007FF7B9AC1000-memory.dmp	upx
behavioral2/memory/2192-280-0x00007FF7AFCA0000-0x00007FF7AFFF1000-memory.dmp	upx
behavioral2/memory/1656-279-0x00007FF6CE260000-0x00007FF6CE5B1000-memory.dmp	upx
behavioral2/memory/520-277-0x00007FF714910000-0x00007FF714C61000-memory.dmp	upx
behavioral2/memory/4948-276-0x00007FF6D3380000-0x00007FF6D36D1000-memory.dmp	upx
behavioral2/memory/2172-275-0x00007FF619620000-0x00007FF619971000-memory.dmp	upx
behavioral2/memory/1032-274-0x00007FF6F8A90000-0x00007FF6F8DE1000-memory.dmp	upx
behavioral2/memory/2568-273-0x00007FF6E10D0000-0x00007FF6E1421000-memory.dmp	upx
behavioral2/memory/2400-271-0x00007FF6BE8B0000-0x00007FF6BEC01000-memory.dmp	upx
behavioral2/memory/4680-270-0x00007FF6BA8F0000-0x00007FF6BAC41000-memory.dmp	upx
behavioral2/memory/852-269-0x00007FF6D2090000-0x00007FF6D23E1000-memory.dmp	upx
behavioral2/memory/4272-268-0x00007FF618310000-0x00007FF618661000-memory.dmp	upx
behavioral2/memory/1624-267-0x00007FF731800000-0x00007FF731B51000-memory.dmp	upx
behavioral2/memory/436-266-0x00007FF6B6480000-0x00007FF6B67D1000-memory.dmp	upx
behavioral2/memory/1524-264-0x00007FF628670000-0x00007FF6289C1000-memory.dmp	upx
behavioral2/memory/4456-263-0x00007FF7F8910000-0x00007FF7F8C61000-memory.dmp	upx
behavioral2/memory/3808-218-0x00007FF6702C0000-0x00007FF670611000-memory.dmp	upx
behavioral2/files/0x0007000000023422-206.dat	upx
behavioral2/files/0x000700000002340c-202.dat	upx
behavioral2/files/0x0007000000023414-198.dat	upx
behavioral2/files/0x0007000000023417-195.dat	upx
behavioral2/files/0x0007000000023415-190.dat	upx
behavioral2/files/0x0007000000023420-189.dat	upx
behavioral2/files/0x000700000002341c-176.dat	upx
behavioral2/files/0x000700000002341d-175.dat	upx
behavioral2/files/0x000700000002341b-171.dat	upx
behavioral2/files/0x000700000002341a-159.dat	upx
behavioral2/files/0x000700000002340e-155.dat	upx
behavioral2/files/0x000700000002340d-151.dat	upx
behavioral2/memory/3328-207-0x00007FF626140000-0x00007FF626491000-memory.dmp	upx
behavioral2/memory/3024-148-0x00007FF6D3C10000-0x00007FF6D3F61000-memory.dmp	upx
behavioral2/files/0x0007000000023416-146.dat	upx
behavioral2/files/0x000700000002340b-141.dat	upx
behavioral2/files/0x0007000000023412-128.dat	upx
behavioral2/files/0x0007000000023408-121.dat	upx
behavioral2/files/0x0007000000023407-119.dat	upx
behavioral2/files/0x0007000000023419-117.dat	upx
behavioral2/files/0x0007000000023418-114.dat	upx
behavioral2/files/0x0007000000023411-104.dat	upx
behavioral2/files/0x0007000000023410-99.dat	upx
behavioral2/files/0x00080000000233fe-96.dat	upx
behavioral2/files/0x0007000000023403-94.dat	upx
behavioral2/files/0x000700000002340f-92.dat	upx
behavioral2/files/0x0007000000023406-90.dat	upx
behavioral2/memory/3980-83-0x00007FF6EED60000-0x00007FF6EF0B1000-memory.dmp	upx
behavioral2/memory/4168-76-0x00007FF659540000-0x00007FF659891000-memory.dmp	upx
behavioral2/files/0x0007000000023413-106.dat	upx
behavioral2/files/0x0007000000023402-53.dat	upx
behavioral2/memory/2868-43-0x00007FF6E0000000-0x00007FF6E0351000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cnRByuP.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\kETzbpz.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\uviDqUm.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\rgelGEZ.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\NHiOYiz.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\WWmMuXi.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\lLsaFMk.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\QSMByeP.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\FYuccIE.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\tLluFhD.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\LXoSZwY.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\xcvqBXL.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\HDnZevz.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\JUgFjnh.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\coGoDNd.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\oWawTtL.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\nImZnyo.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\tsdelyj.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\dgXtKIm.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\mnOWLhb.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\qUzRhdV.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\bPjGExQ.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\DlVFeen.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\cpeEXpU.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\sGKpaCF.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\SsDTWUg.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\YivGjOA.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\eFbeuhh.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\MLEChEq.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\Ioqyhcr.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\aMuvIHo.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\fGzstiV.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\VDibBTW.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\dEelbPH.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\RSMmdEY.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\RuAbIIc.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\ehYmhGQ.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\adhwBMd.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\ovgupdc.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\OZIhEMZ.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\VIzksvv.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\jBbtfmn.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\LDGGSli.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\fsBGQeL.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\RVKJxJo.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\MyfqaVI.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\GeglJCn.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\gVUSHcY.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\jtCzJnq.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\bPmnaHp.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\xWTDMSm.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\fgKKSca.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\lEltdwM.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\SpSZCgb.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\weYwtRc.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\WlSFQkk.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\psXToys.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\tfjHKYr.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\LsPwbUQ.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\fqZAwQO.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\tbsgeev.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\iegQVyi.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\RPuSSlt.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
File created	C:\Windows\System\wHTTZKK.exe	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 668	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	83
PID 3940 wrote to memory of 668	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	83
PID 3940 wrote to memory of 2868	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	84
PID 3940 wrote to memory of 2868	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	84
PID 3940 wrote to memory of 1656	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	85
PID 3940 wrote to memory of 1656	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	85
PID 3940 wrote to memory of 4168	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	86
PID 3940 wrote to memory of 4168	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	86
PID 3940 wrote to memory of 3980	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	87
PID 3940 wrote to memory of 3980	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	87
PID 3940 wrote to memory of 3024	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	88
PID 3940 wrote to memory of 3024	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	88
PID 3940 wrote to memory of 3328	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	89
PID 3940 wrote to memory of 3328	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	89
PID 3940 wrote to memory of 3808	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	90
PID 3940 wrote to memory of 3808	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	90
PID 3940 wrote to memory of 3068	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	91
PID 3940 wrote to memory of 3068	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	91
PID 3940 wrote to memory of 2192	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	92
PID 3940 wrote to memory of 2192	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	92
PID 3940 wrote to memory of 932	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	93
PID 3940 wrote to memory of 932	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	93
PID 3940 wrote to memory of 4456	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	94
PID 3940 wrote to memory of 4456	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	94
PID 3940 wrote to memory of 1524	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	95
PID 3940 wrote to memory of 1524	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	95
PID 3940 wrote to memory of 1632	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	96
PID 3940 wrote to memory of 1632	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	96
PID 3940 wrote to memory of 436	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	97
PID 3940 wrote to memory of 436	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	97
PID 3940 wrote to memory of 3168	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	98
PID 3940 wrote to memory of 3168	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	98
PID 3940 wrote to memory of 1624	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	99
PID 3940 wrote to memory of 1624	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	99
PID 3940 wrote to memory of 4272	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	100
PID 3940 wrote to memory of 4272	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	100
PID 3940 wrote to memory of 852	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	101
PID 3940 wrote to memory of 852	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	101
PID 3940 wrote to memory of 4680	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	102
PID 3940 wrote to memory of 4680	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	102
PID 3940 wrote to memory of 2400	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	103
PID 3940 wrote to memory of 2400	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	103
PID 3940 wrote to memory of 1344	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	104
PID 3940 wrote to memory of 1344	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	104
PID 3940 wrote to memory of 1416	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	105
PID 3940 wrote to memory of 1416	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	105
PID 3940 wrote to memory of 2568	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	106
PID 3940 wrote to memory of 2568	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	106
PID 3940 wrote to memory of 1032	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	107
PID 3940 wrote to memory of 1032	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	107
PID 3940 wrote to memory of 5080	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	108
PID 3940 wrote to memory of 5080	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	108
PID 3940 wrote to memory of 2172	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	109
PID 3940 wrote to memory of 2172	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	109
PID 3940 wrote to memory of 3876	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	110
PID 3940 wrote to memory of 3876	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	110
PID 3940 wrote to memory of 4948	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	111
PID 3940 wrote to memory of 4948	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	111
PID 3940 wrote to memory of 520	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	112
PID 3940 wrote to memory of 520	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	112
PID 3940 wrote to memory of 3044	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	113
PID 3940 wrote to memory of 3044	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	113
PID 3940 wrote to memory of 4944	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	114
PID 3940 wrote to memory of 4944	3940	39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\39eaf535b39a3767923f82d962830f80_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\System\ehEuUqm.exe
  C:\Windows\System\ehEuUqm.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\YGfHcDq.exe
  C:\Windows\System\YGfHcDq.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\bPRbaim.exe
  C:\Windows\System\bPRbaim.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\CrcFavk.exe
  C:\Windows\System\CrcFavk.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\jganePM.exe
  C:\Windows\System\jganePM.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\NscAfPV.exe
  C:\Windows\System\NscAfPV.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\UCpzvLv.exe
  C:\Windows\System\UCpzvLv.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\IipIeeM.exe
  C:\Windows\System\IipIeeM.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\ZtXkkpx.exe
  C:\Windows\System\ZtXkkpx.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\XawBxDG.exe
  C:\Windows\System\XawBxDG.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\BCENMaA.exe
  C:\Windows\System\BCENMaA.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\PtUnEmD.exe
  C:\Windows\System\PtUnEmD.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\HUaMcAR.exe
  C:\Windows\System\HUaMcAR.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\VDibBTW.exe
  C:\Windows\System\VDibBTW.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\oevkBaO.exe
  C:\Windows\System\oevkBaO.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\JMZJZkG.exe
  C:\Windows\System\JMZJZkG.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\QJujxiP.exe
  C:\Windows\System\QJujxiP.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\QaZpBNY.exe
  C:\Windows\System\QaZpBNY.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\xWTDMSm.exe
  C:\Windows\System\xWTDMSm.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\HfkLyeX.exe
  C:\Windows\System\HfkLyeX.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\XJFqhaW.exe
  C:\Windows\System\XJFqhaW.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\CCykkFF.exe
  C:\Windows\System\CCykkFF.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\UzKmwAA.exe
  C:\Windows\System\UzKmwAA.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\iegQVyi.exe
  C:\Windows\System\iegQVyi.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\ysxXRff.exe
  C:\Windows\System\ysxXRff.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\mQOGBci.exe
  C:\Windows\System\mQOGBci.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\rYlfpVJ.exe
  C:\Windows\System\rYlfpVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\bPjGExQ.exe
  C:\Windows\System\bPjGExQ.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\GVCtBZz.exe
  C:\Windows\System\GVCtBZz.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\chvozBh.exe
  C:\Windows\System\chvozBh.exe
  2⤵
  - Executes dropped EXE
  PID:520
- C:\Windows\System\ffFTxmF.exe
  C:\Windows\System\ffFTxmF.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\AMFOjie.exe
  C:\Windows\System\AMFOjie.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\oYXOPZj.exe
  C:\Windows\System\oYXOPZj.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\ASmWpie.exe
  C:\Windows\System\ASmWpie.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\psXToys.exe
  C:\Windows\System\psXToys.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\WmuZxYE.exe
  C:\Windows\System\WmuZxYE.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\iktotdy.exe
  C:\Windows\System\iktotdy.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\perpAWa.exe
  C:\Windows\System\perpAWa.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\ULbgHxs.exe
  C:\Windows\System\ULbgHxs.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\oVwmMgg.exe
  C:\Windows\System\oVwmMgg.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\pBQFaBF.exe
  C:\Windows\System\pBQFaBF.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\SClFSYA.exe
  C:\Windows\System\SClFSYA.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\RdrpixB.exe
  C:\Windows\System\RdrpixB.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\pOpiytn.exe
  C:\Windows\System\pOpiytn.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\NEODEbm.exe
  C:\Windows\System\NEODEbm.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\pFKgFiG.exe
  C:\Windows\System\pFKgFiG.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\NugvGSH.exe
  C:\Windows\System\NugvGSH.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\BagDsty.exe
  C:\Windows\System\BagDsty.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\UemHKKs.exe
  C:\Windows\System\UemHKKs.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\fHAoEdr.exe
  C:\Windows\System\fHAoEdr.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\mZWpJQK.exe
  C:\Windows\System\mZWpJQK.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\qGEfhuk.exe
  C:\Windows\System\qGEfhuk.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\FCRrBcv.exe
  C:\Windows\System\FCRrBcv.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\IKyJbpG.exe
  C:\Windows\System\IKyJbpG.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\VCdeVHL.exe
  C:\Windows\System\VCdeVHL.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\hXqaCVY.exe
  C:\Windows\System\hXqaCVY.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\xcvqBXL.exe
  C:\Windows\System\xcvqBXL.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\UgQJCwX.exe
  C:\Windows\System\UgQJCwX.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\FaEXinA.exe
  C:\Windows\System\FaEXinA.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\AhqjJbE.exe
  C:\Windows\System\AhqjJbE.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\BWawoJr.exe
  C:\Windows\System\BWawoJr.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\EVoZsKN.exe
  C:\Windows\System\EVoZsKN.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\itkSUwe.exe
  C:\Windows\System\itkSUwe.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\jXGJjXS.exe
  C:\Windows\System\jXGJjXS.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\vsiDXNh.exe
  C:\Windows\System\vsiDXNh.exe
  2⤵
  PID:4844
- C:\Windows\System\uOyrUMU.exe
  C:\Windows\System\uOyrUMU.exe
  2⤵
  PID:844
- C:\Windows\System\ogKSkYO.exe
  C:\Windows\System\ogKSkYO.exe
  2⤵
  PID:1896
- C:\Windows\System\PvIgquF.exe
  C:\Windows\System\PvIgquF.exe
  2⤵
  PID:1728
- C:\Windows\System\lLsaFMk.exe
  C:\Windows\System\lLsaFMk.exe
  2⤵
  PID:1156
- C:\Windows\System\usteetc.exe
  C:\Windows\System\usteetc.exe
  2⤵
  PID:2016
- C:\Windows\System\pkRjwZJ.exe
  C:\Windows\System\pkRjwZJ.exe
  2⤵
  PID:3336
- C:\Windows\System\EaaXKeD.exe
  C:\Windows\System\EaaXKeD.exe
  2⤵
  PID:336
- C:\Windows\System\rLZTGeK.exe
  C:\Windows\System\rLZTGeK.exe
  2⤵
  PID:640
- C:\Windows\System\rLsEmxo.exe
  C:\Windows\System\rLsEmxo.exe
  2⤵
  PID:2360
- C:\Windows\System\hKVjmxd.exe
  C:\Windows\System\hKVjmxd.exe
  2⤵
  PID:3924
- C:\Windows\System\XvpzIXr.exe
  C:\Windows\System\XvpzIXr.exe
  2⤵
  PID:3456
- C:\Windows\System\MXOYGZB.exe
  C:\Windows\System\MXOYGZB.exe
  2⤵
  PID:1900
- C:\Windows\System\qNQaBuF.exe
  C:\Windows\System\qNQaBuF.exe
  2⤵
  PID:1940
- C:\Windows\System\dVsYGgA.exe
  C:\Windows\System\dVsYGgA.exe
  2⤵
  PID:2556
- C:\Windows\System\nImZnyo.exe
  C:\Windows\System\nImZnyo.exe
  2⤵
  PID:2368
- C:\Windows\System\fuFtDRg.exe
  C:\Windows\System\fuFtDRg.exe
  2⤵
  PID:620
- C:\Windows\System\JKWvjZN.exe
  C:\Windows\System\JKWvjZN.exe
  2⤵
  PID:3760
- C:\Windows\System\KGtXXGG.exe
  C:\Windows\System\KGtXXGG.exe
  2⤵
  PID:2152
- C:\Windows\System\MAjEjLQ.exe
  C:\Windows\System\MAjEjLQ.exe
  2⤵
  PID:412
- C:\Windows\System\OYwLHxH.exe
  C:\Windows\System\OYwLHxH.exe
  2⤵
  PID:4484
- C:\Windows\System\ldIbNMl.exe
  C:\Windows\System\ldIbNMl.exe
  2⤵
  PID:1488
- C:\Windows\System\QUwMgfY.exe
  C:\Windows\System\QUwMgfY.exe
  2⤵
  PID:2092
- C:\Windows\System\ksZesNP.exe
  C:\Windows\System\ksZesNP.exe
  2⤵
  PID:2044
- C:\Windows\System\rFdgiCO.exe
  C:\Windows\System\rFdgiCO.exe
  2⤵
  PID:3948
- C:\Windows\System\OPFpHac.exe
  C:\Windows\System\OPFpHac.exe
  2⤵
  PID:636
- C:\Windows\System\PdsNecF.exe
  C:\Windows\System\PdsNecF.exe
  2⤵
  PID:4124
- C:\Windows\System\yJOQDbH.exe
  C:\Windows\System\yJOQDbH.exe
  2⤵
  PID:216
- C:\Windows\System\YtcIrFt.exe
  C:\Windows\System\YtcIrFt.exe
  2⤵
  PID:4840
- C:\Windows\System\QSMByeP.exe
  C:\Windows\System\QSMByeP.exe
  2⤵
  PID:4760
- C:\Windows\System\KYnMkBE.exe
  C:\Windows\System\KYnMkBE.exe
  2⤵
  PID:2088
- C:\Windows\System\jQToDSZ.exe
  C:\Windows\System\jQToDSZ.exe
  2⤵
  PID:3088
- C:\Windows\System\exSTRHA.exe
  C:\Windows\System\exSTRHA.exe
  2⤵
  PID:624
- C:\Windows\System\WlSFQkk.exe
  C:\Windows\System\WlSFQkk.exe
  2⤵
  PID:2380
- C:\Windows\System\dRSGWsm.exe
  C:\Windows\System\dRSGWsm.exe
  2⤵
  PID:4488
- C:\Windows\System\BVmzFje.exe
  C:\Windows\System\BVmzFje.exe
  2⤵
  PID:2840
- C:\Windows\System\coGoDNd.exe
  C:\Windows\System\coGoDNd.exe
  2⤵
  PID:2692
- C:\Windows\System\cIrXhQO.exe
  C:\Windows\System\cIrXhQO.exe
  2⤵
  PID:4640
- C:\Windows\System\NpGhJIV.exe
  C:\Windows\System\NpGhJIV.exe
  2⤵
  PID:2536
- C:\Windows\System\bxOBEIN.exe
  C:\Windows\System\bxOBEIN.exe
  2⤵
  PID:1492
- C:\Windows\System\TbIhoDJ.exe
  C:\Windows\System\TbIhoDJ.exe
  2⤵
  PID:2176
- C:\Windows\System\TtlBaZD.exe
  C:\Windows\System\TtlBaZD.exe
  2⤵
  PID:1180
- C:\Windows\System\CFfpiXq.exe
  C:\Windows\System\CFfpiXq.exe
  2⤵
  PID:1212
- C:\Windows\System\tlgYOTG.exe
  C:\Windows\System\tlgYOTG.exe
  2⤵
  PID:3404
- C:\Windows\System\EPLDGxM.exe
  C:\Windows\System\EPLDGxM.exe
  2⤵
  PID:5128
- C:\Windows\System\uvjQOTB.exe
  C:\Windows\System\uvjQOTB.exe
  2⤵
  PID:5148
- C:\Windows\System\PEqnGri.exe
  C:\Windows\System\PEqnGri.exe
  2⤵
  PID:5172
- C:\Windows\System\TwJJQuR.exe
  C:\Windows\System\TwJJQuR.exe
  2⤵
  PID:5192
- C:\Windows\System\oWawTtL.exe
  C:\Windows\System\oWawTtL.exe
  2⤵
  PID:5216
- C:\Windows\System\LDGGSli.exe
  C:\Windows\System\LDGGSli.exe
  2⤵
  PID:5236
- C:\Windows\System\qNVZQEM.exe
  C:\Windows\System\qNVZQEM.exe
  2⤵
  PID:5256
- C:\Windows\System\xtovkfa.exe
  C:\Windows\System\xtovkfa.exe
  2⤵
  PID:5284
- C:\Windows\System\BOklICc.exe
  C:\Windows\System\BOklICc.exe
  2⤵
  PID:5304
- C:\Windows\System\tnYzzEU.exe
  C:\Windows\System\tnYzzEU.exe
  2⤵
  PID:5328
- C:\Windows\System\YsxhWQv.exe
  C:\Windows\System\YsxhWQv.exe
  2⤵
  PID:5344
- C:\Windows\System\eANEgUY.exe
  C:\Windows\System\eANEgUY.exe
  2⤵
  PID:5360
- C:\Windows\System\ymhIXzO.exe
  C:\Windows\System\ymhIXzO.exe
  2⤵
  PID:5388
- C:\Windows\System\pFiSdiN.exe
  C:\Windows\System\pFiSdiN.exe
  2⤵
  PID:5404
- C:\Windows\System\eFbeuhh.exe
  C:\Windows\System\eFbeuhh.exe
  2⤵
  PID:5432
- C:\Windows\System\KEUWhLD.exe
  C:\Windows\System\KEUWhLD.exe
  2⤵
  PID:5456
- C:\Windows\System\Pypvdav.exe
  C:\Windows\System\Pypvdav.exe
  2⤵
  PID:5472
- C:\Windows\System\pPnjttu.exe
  C:\Windows\System\pPnjttu.exe
  2⤵
  PID:5492
- C:\Windows\System\uBzaqqe.exe
  C:\Windows\System\uBzaqqe.exe
  2⤵
  PID:5512
- C:\Windows\System\ykvxAzt.exe
  C:\Windows\System\ykvxAzt.exe
  2⤵
  PID:5532
- C:\Windows\System\fsBGQeL.exe
  C:\Windows\System\fsBGQeL.exe
  2⤵
  PID:5552
- C:\Windows\System\asLCbms.exe
  C:\Windows\System\asLCbms.exe
  2⤵
  PID:5576
- C:\Windows\System\DZTMmzT.exe
  C:\Windows\System\DZTMmzT.exe
  2⤵
  PID:5696
- C:\Windows\System\jZhpQIZ.exe
  C:\Windows\System\jZhpQIZ.exe
  2⤵
  PID:5712
- C:\Windows\System\IpMUxvH.exe
  C:\Windows\System\IpMUxvH.exe
  2⤵
  PID:5736
- C:\Windows\System\ySKiGLt.exe
  C:\Windows\System\ySKiGLt.exe
  2⤵
  PID:5756
- C:\Windows\System\RPuSSlt.exe
  C:\Windows\System\RPuSSlt.exe
  2⤵
  PID:5780
- C:\Windows\System\dCEzKKu.exe
  C:\Windows\System\dCEzKKu.exe
  2⤵
  PID:5816
- C:\Windows\System\pyswZlG.exe
  C:\Windows\System\pyswZlG.exe
  2⤵
  PID:5844
- C:\Windows\System\qQTuMoc.exe
  C:\Windows\System\qQTuMoc.exe
  2⤵
  PID:5860
- C:\Windows\System\rQFEnFj.exe
  C:\Windows\System\rQFEnFj.exe
  2⤵
  PID:5884
- C:\Windows\System\jDuGBeN.exe
  C:\Windows\System\jDuGBeN.exe
  2⤵
  PID:5900
- C:\Windows\System\iWFkMzp.exe
  C:\Windows\System\iWFkMzp.exe
  2⤵
  PID:5924
- C:\Windows\System\EQoryhj.exe
  C:\Windows\System\EQoryhj.exe
  2⤵
  PID:5940
- C:\Windows\System\tpSnhdg.exe
  C:\Windows\System\tpSnhdg.exe
  2⤵
  PID:5964
- C:\Windows\System\lQaBkGP.exe
  C:\Windows\System\lQaBkGP.exe
  2⤵
  PID:5984
- C:\Windows\System\hQNxuDs.exe
  C:\Windows\System\hQNxuDs.exe
  2⤵
  PID:6004
- C:\Windows\System\cORetmD.exe
  C:\Windows\System\cORetmD.exe
  2⤵
  PID:6032
- C:\Windows\System\tlZHhCy.exe
  C:\Windows\System\tlZHhCy.exe
  2⤵
  PID:6052
- C:\Windows\System\hKfEtkj.exe
  C:\Windows\System\hKfEtkj.exe
  2⤵
  PID:6072
- C:\Windows\System\zmZfhyE.exe
  C:\Windows\System\zmZfhyE.exe
  2⤵
  PID:6104
- C:\Windows\System\kAigESM.exe
  C:\Windows\System\kAigESM.exe
  2⤵
  PID:6128
- C:\Windows\System\bbbISxg.exe
  C:\Windows\System\bbbISxg.exe
  2⤵
  PID:1236
- C:\Windows\System\YcGxrpV.exe
  C:\Windows\System\YcGxrpV.exe
  2⤵
  PID:3244
- C:\Windows\System\YHJyQfZ.exe
  C:\Windows\System\YHJyQfZ.exe
  2⤵
  PID:2496
- C:\Windows\System\QGHccqa.exe
  C:\Windows\System\QGHccqa.exe
  2⤵
  PID:1484
- C:\Windows\System\AlzDgha.exe
  C:\Windows\System\AlzDgha.exe
  2⤵
  PID:1264
- C:\Windows\System\FYuccIE.exe
  C:\Windows\System\FYuccIE.exe
  2⤵
  PID:4532
- C:\Windows\System\lpIDQOM.exe
  C:\Windows\System\lpIDQOM.exe
  2⤵
  PID:5144
- C:\Windows\System\ZBOULSw.exe
  C:\Windows\System\ZBOULSw.exe
  2⤵
  PID:5180
- C:\Windows\System\wHTTZKK.exe
  C:\Windows\System\wHTTZKK.exe
  2⤵
  PID:5268
- C:\Windows\System\fTXeiwO.exe
  C:\Windows\System\fTXeiwO.exe
  2⤵
  PID:2304
- C:\Windows\System\lEltdwM.exe
  C:\Windows\System\lEltdwM.exe
  2⤵
  PID:5380
- C:\Windows\System\pftdTmJ.exe
  C:\Windows\System\pftdTmJ.exe
  2⤵
  PID:5448
- C:\Windows\System\OZIhEMZ.exe
  C:\Windows\System\OZIhEMZ.exe
  2⤵
  PID:4436
- C:\Windows\System\LZzjdED.exe
  C:\Windows\System\LZzjdED.exe
  2⤵
  PID:5400
- C:\Windows\System\Zwylgiq.exe
  C:\Windows\System\Zwylgiq.exe
  2⤵
  PID:5484
- C:\Windows\System\SZdOddR.exe
  C:\Windows\System\SZdOddR.exe
  2⤵
  PID:5528
- C:\Windows\System\xFRBEap.exe
  C:\Windows\System\xFRBEap.exe
  2⤵
  PID:5656
- C:\Windows\System\rcCcPVP.exe
  C:\Windows\System\rcCcPVP.exe
  2⤵
  PID:5480
- C:\Windows\System\lCEDsMQ.exe
  C:\Windows\System\lCEDsMQ.exe
  2⤵
  PID:6012
- C:\Windows\System\SknOdzH.exe
  C:\Windows\System\SknOdzH.exe
  2⤵
  PID:6044
- C:\Windows\System\RVKJxJo.exe
  C:\Windows\System\RVKJxJo.exe
  2⤵
  PID:5572
- C:\Windows\System\BegLwgk.exe
  C:\Windows\System\BegLwgk.exe
  2⤵
  PID:5592
- C:\Windows\System\VJjXEXr.exe
  C:\Windows\System\VJjXEXr.exe
  2⤵
  PID:2528
- C:\Windows\System\LblTJLy.exe
  C:\Windows\System\LblTJLy.exe
  2⤵
  PID:5800
- C:\Windows\System\NWYUfog.exe
  C:\Windows\System\NWYUfog.exe
  2⤵
  PID:5908
- C:\Windows\System\GIYHbgw.exe
  C:\Windows\System\GIYHbgw.exe
  2⤵
  PID:5916
- C:\Windows\System\syPnJnw.exe
  C:\Windows\System\syPnJnw.exe
  2⤵
  PID:5140
- C:\Windows\System\UeWxofa.exe
  C:\Windows\System\UeWxofa.exe
  2⤵
  PID:5764
- C:\Windows\System\YsrZPVT.exe
  C:\Windows\System\YsrZPVT.exe
  2⤵
  PID:5768
- C:\Windows\System\USsuRjz.exe
  C:\Windows\System\USsuRjz.exe
  2⤵
  PID:5956
- C:\Windows\System\bGUsAdy.exe
  C:\Windows\System\bGUsAdy.exe
  2⤵
  PID:2120
- C:\Windows\System\yJenZaY.exe
  C:\Windows\System\yJenZaY.exe
  2⤵
  PID:5996
- C:\Windows\System\IUeDpki.exe
  C:\Windows\System\IUeDpki.exe
  2⤵
  PID:6068
- C:\Windows\System\ccDPDoc.exe
  C:\Windows\System\ccDPDoc.exe
  2⤵
  PID:5440
- C:\Windows\System\mMMvuyI.exe
  C:\Windows\System\mMMvuyI.exe
  2⤵
  PID:1724
- C:\Windows\System\HeTnQIM.exe
  C:\Windows\System\HeTnQIM.exe
  2⤵
  PID:2412
- C:\Windows\System\MLEChEq.exe
  C:\Windows\System\MLEChEq.exe
  2⤵
  PID:6160
- C:\Windows\System\FrSDiOf.exe
  C:\Windows\System\FrSDiOf.exe
  2⤵
  PID:6184
- C:\Windows\System\uJmzObo.exe
  C:\Windows\System\uJmzObo.exe
  2⤵
  PID:6204
- C:\Windows\System\RizbneS.exe
  C:\Windows\System\RizbneS.exe
  2⤵
  PID:6232
- C:\Windows\System\WWmMuXi.exe
  C:\Windows\System\WWmMuXi.exe
  2⤵
  PID:6248
- C:\Windows\System\XxXNFje.exe
  C:\Windows\System\XxXNFje.exe
  2⤵
  PID:6268
- C:\Windows\System\DBVPLqg.exe
  C:\Windows\System\DBVPLqg.exe
  2⤵
  PID:6288
- C:\Windows\System\MyfqaVI.exe
  C:\Windows\System\MyfqaVI.exe
  2⤵
  PID:6312
- C:\Windows\System\nxOAzcM.exe
  C:\Windows\System\nxOAzcM.exe
  2⤵
  PID:6332
- C:\Windows\System\sbadwFL.exe
  C:\Windows\System\sbadwFL.exe
  2⤵
  PID:6356
- C:\Windows\System\aWQOkWM.exe
  C:\Windows\System\aWQOkWM.exe
  2⤵
  PID:6372
- C:\Windows\System\fowlBLN.exe
  C:\Windows\System\fowlBLN.exe
  2⤵
  PID:6588
- C:\Windows\System\ZMfKvBt.exe
  C:\Windows\System\ZMfKvBt.exe
  2⤵
  PID:6608
- C:\Windows\System\Ioqyhcr.exe
  C:\Windows\System\Ioqyhcr.exe
  2⤵
  PID:6640
- C:\Windows\System\XBvnFkd.exe
  C:\Windows\System\XBvnFkd.exe
  2⤵
  PID:6660
- C:\Windows\System\OcdVdVY.exe
  C:\Windows\System\OcdVdVY.exe
  2⤵
  PID:6680
- C:\Windows\System\rNrSQvl.exe
  C:\Windows\System\rNrSQvl.exe
  2⤵
  PID:6700
- C:\Windows\System\PNdfsFP.exe
  C:\Windows\System\PNdfsFP.exe
  2⤵
  PID:6720
- C:\Windows\System\JIWkSiG.exe
  C:\Windows\System\JIWkSiG.exe
  2⤵
  PID:6744
- C:\Windows\System\VNsDOWH.exe
  C:\Windows\System\VNsDOWH.exe
  2⤵
  PID:6760
- C:\Windows\System\lLBkBtD.exe
  C:\Windows\System\lLBkBtD.exe
  2⤵
  PID:6780
- C:\Windows\System\GeglJCn.exe
  C:\Windows\System\GeglJCn.exe
  2⤵
  PID:6800
- C:\Windows\System\vbmiXob.exe
  C:\Windows\System\vbmiXob.exe
  2⤵
  PID:6824
- C:\Windows\System\gAWEzpd.exe
  C:\Windows\System\gAWEzpd.exe
  2⤵
  PID:6848
- C:\Windows\System\uwYXkQj.exe
  C:\Windows\System\uwYXkQj.exe
  2⤵
  PID:6872
- C:\Windows\System\hpnulsh.exe
  C:\Windows\System\hpnulsh.exe
  2⤵
  PID:6896
- C:\Windows\System\hCFzCzi.exe
  C:\Windows\System\hCFzCzi.exe
  2⤵
  PID:6920
- C:\Windows\System\KRtbZLi.exe
  C:\Windows\System\KRtbZLi.exe
  2⤵
  PID:6952
- C:\Windows\System\yzuuWze.exe
  C:\Windows\System\yzuuWze.exe
  2⤵
  PID:6980
- C:\Windows\System\KLNnhmA.exe
  C:\Windows\System\KLNnhmA.exe
  2⤵
  PID:7000
- C:\Windows\System\Niyzwnq.exe
  C:\Windows\System\Niyzwnq.exe
  2⤵
  PID:7024
- C:\Windows\System\bMnmtTR.exe
  C:\Windows\System\bMnmtTR.exe
  2⤵
  PID:7044
- C:\Windows\System\rFThJiM.exe
  C:\Windows\System\rFThJiM.exe
  2⤵
  PID:7088
- C:\Windows\System\jlGDzNk.exe
  C:\Windows\System\jlGDzNk.exe
  2⤵
  PID:7120
- C:\Windows\System\XbHeQNT.exe
  C:\Windows\System\XbHeQNT.exe
  2⤵
  PID:7136
- C:\Windows\System\RUgVmGz.exe
  C:\Windows\System\RUgVmGz.exe
  2⤵
  PID:7156
- C:\Windows\System\xSiJgrK.exe
  C:\Windows\System\xSiJgrK.exe
  2⤵
  PID:5520
- C:\Windows\System\lRnRRHD.exe
  C:\Windows\System\lRnRRHD.exe
  2⤵
  PID:5188
- C:\Windows\System\evxJewm.exe
  C:\Windows\System\evxJewm.exe
  2⤵
  PID:6156
- C:\Windows\System\NpOJaeU.exe
  C:\Windows\System\NpOJaeU.exe
  2⤵
  PID:5248
- C:\Windows\System\tEFoNRs.exe
  C:\Windows\System\tEFoNRs.exe
  2⤵
  PID:5720
- C:\Windows\System\dHZKjRb.exe
  C:\Windows\System\dHZKjRb.exe
  2⤵
  PID:6300
- C:\Windows\System\DmdRNcL.exe
  C:\Windows\System\DmdRNcL.exe
  2⤵
  PID:5932
- C:\Windows\System\YynfOJe.exe
  C:\Windows\System\YynfOJe.exe
  2⤵
  PID:6024
- C:\Windows\System\Vugvdfk.exe
  C:\Windows\System\Vugvdfk.exe
  2⤵
  PID:5640
- C:\Windows\System\QuUIGrG.exe
  C:\Windows\System\QuUIGrG.exe
  2⤵
  PID:4524
- C:\Windows\System\efmkNda.exe
  C:\Windows\System\efmkNda.exe
  2⤵
  PID:6200
- C:\Windows\System\bJMXMKv.exe
  C:\Windows\System\bJMXMKv.exe
  2⤵
  PID:6344
- C:\Windows\System\uMPNgpL.exe
  C:\Windows\System\uMPNgpL.exe
  2⤵
  PID:6388
- C:\Windows\System\kMIBktV.exe
  C:\Windows\System\kMIBktV.exe
  2⤵
  PID:6672
- C:\Windows\System\LCCjmfC.exe
  C:\Windows\System\LCCjmfC.exe
  2⤵
  PID:5948
- C:\Windows\System\MkEDtSS.exe
  C:\Windows\System\MkEDtSS.exe
  2⤵
  PID:7184
- C:\Windows\System\zunMinU.exe
  C:\Windows\System\zunMinU.exe
  2⤵
  PID:7204
- C:\Windows\System\ocSqWPo.exe
  C:\Windows\System\ocSqWPo.exe
  2⤵
  PID:7224
- C:\Windows\System\AIYgRkY.exe
  C:\Windows\System\AIYgRkY.exe
  2⤵
  PID:7252
- C:\Windows\System\vkVfmWD.exe
  C:\Windows\System\vkVfmWD.exe
  2⤵
  PID:7276
- C:\Windows\System\zirtVLX.exe
  C:\Windows\System\zirtVLX.exe
  2⤵
  PID:7292
- C:\Windows\System\CrxHcvW.exe
  C:\Windows\System\CrxHcvW.exe
  2⤵
  PID:7316
- C:\Windows\System\SIYGSBI.exe
  C:\Windows\System\SIYGSBI.exe
  2⤵
  PID:7344
- C:\Windows\System\OVORcnj.exe
  C:\Windows\System\OVORcnj.exe
  2⤵
  PID:7636
- C:\Windows\System\eIAyZjz.exe
  C:\Windows\System\eIAyZjz.exe
  2⤵
  PID:7652
- C:\Windows\System\QvXRxOx.exe
  C:\Windows\System\QvXRxOx.exe
  2⤵
  PID:7668
- C:\Windows\System\vAUBfkY.exe
  C:\Windows\System\vAUBfkY.exe
  2⤵
  PID:7696
- C:\Windows\System\XNznHDL.exe
  C:\Windows\System\XNznHDL.exe
  2⤵
  PID:7720
- C:\Windows\System\cHEeYoA.exe
  C:\Windows\System\cHEeYoA.exe
  2⤵
  PID:7736
- C:\Windows\System\PksntMP.exe
  C:\Windows\System\PksntMP.exe
  2⤵
  PID:7768
- C:\Windows\System\rvDyjDd.exe
  C:\Windows\System\rvDyjDd.exe
  2⤵
  PID:7788
- C:\Windows\System\orARCPQ.exe
  C:\Windows\System\orARCPQ.exe
  2⤵
  PID:7812
- C:\Windows\System\NIOQLnA.exe
  C:\Windows\System\NIOQLnA.exe
  2⤵
  PID:7832
- C:\Windows\System\SpSZCgb.exe
  C:\Windows\System\SpSZCgb.exe
  2⤵
  PID:7852
- C:\Windows\System\KnpTvyY.exe
  C:\Windows\System\KnpTvyY.exe
  2⤵
  PID:7880
- C:\Windows\System\EDStYZx.exe
  C:\Windows\System\EDStYZx.exe
  2⤵
  PID:7896
- C:\Windows\System\RgMzgZp.exe
  C:\Windows\System\RgMzgZp.exe
  2⤵
  PID:7920
- C:\Windows\System\ovgupdc.exe
  C:\Windows\System\ovgupdc.exe
  2⤵
  PID:7956
- C:\Windows\System\IyKtXKN.exe
  C:\Windows\System\IyKtXKN.exe
  2⤵
  PID:7984
- C:\Windows\System\zomVVbw.exe
  C:\Windows\System\zomVVbw.exe
  2⤵
  PID:8004
- C:\Windows\System\VJdRVIv.exe
  C:\Windows\System\VJdRVIv.exe
  2⤵
  PID:8028
- C:\Windows\System\kKuGEPg.exe
  C:\Windows\System\kKuGEPg.exe
  2⤵
  PID:8044
- C:\Windows\System\UKShHCq.exe
  C:\Windows\System\UKShHCq.exe
  2⤵
  PID:8084
- C:\Windows\System\LbhUpvQ.exe
  C:\Windows\System\LbhUpvQ.exe
  2⤵
  PID:8104
- C:\Windows\System\weYwtRc.exe
  C:\Windows\System\weYwtRc.exe
  2⤵
  PID:8132
- C:\Windows\System\GfvyQDP.exe
  C:\Windows\System\GfvyQDP.exe
  2⤵
  PID:8168
- C:\Windows\System\uNGRryc.exe
  C:\Windows\System\uNGRryc.exe
  2⤵
  PID:8188
- C:\Windows\System\RaEwqvO.exe
  C:\Windows\System\RaEwqvO.exe
  2⤵
  PID:5300
- C:\Windows\System\gVUSHcY.exe
  C:\Windows\System\gVUSHcY.exe
  2⤵
  PID:5728
- C:\Windows\System\ATJBJYD.exe
  C:\Windows\System\ATJBJYD.exe
  2⤵
  PID:6992
- C:\Windows\System\MIomaNk.exe
  C:\Windows\System\MIomaNk.exe
  2⤵
  PID:7016
- C:\Windows\System\WyyLkYo.exe
  C:\Windows\System\WyyLkYo.exe
  2⤵
  PID:6088
- C:\Windows\System\wqBcZXF.exe
  C:\Windows\System\wqBcZXF.exe
  2⤵
  PID:7132
- C:\Windows\System\FNpSvDe.exe
  C:\Windows\System\FNpSvDe.exe
  2⤵
  PID:5296
- C:\Windows\System\ZmIEOyo.exe
  C:\Windows\System\ZmIEOyo.exe
  2⤵
  PID:6324
- C:\Windows\System\MnEYvwe.exe
  C:\Windows\System\MnEYvwe.exe
  2⤵
  PID:4652
- C:\Windows\System\BbCCzke.exe
  C:\Windows\System\BbCCzke.exe
  2⤵
  PID:6692
- C:\Windows\System\ImGibIj.exe
  C:\Windows\System\ImGibIj.exe
  2⤵
  PID:1692
- C:\Windows\System\pSISSzC.exe
  C:\Windows\System\pSISSzC.exe
  2⤵
  PID:1680
- C:\Windows\System\sxSxKhp.exe
  C:\Windows\System\sxSxKhp.exe
  2⤵
  PID:7284
- C:\Windows\System\AXbvBJa.exe
  C:\Windows\System\AXbvBJa.exe
  2⤵
  PID:7052
- C:\Windows\System\BWLzeQH.exe
  C:\Windows\System\BWLzeQH.exe
  2⤵
  PID:6472
- C:\Windows\System\ulFOxse.exe
  C:\Windows\System\ulFOxse.exe
  2⤵
  PID:7392
- C:\Windows\System\IJHACgF.exe
  C:\Windows\System\IJHACgF.exe
  2⤵
  PID:796
- C:\Windows\System\ejTEwDF.exe
  C:\Windows\System\ejTEwDF.exe
  2⤵
  PID:7472
- C:\Windows\System\UDcnMbM.exe
  C:\Windows\System\UDcnMbM.exe
  2⤵
  PID:6636
- C:\Windows\System\YISAJoK.exe
  C:\Windows\System\YISAJoK.exe
  2⤵
  PID:6772
- C:\Windows\System\UNeoonP.exe
  C:\Windows\System\UNeoonP.exe
  2⤵
  PID:6840
- C:\Windows\System\KXMHmPU.exe
  C:\Windows\System\KXMHmPU.exe
  2⤵
  PID:6892
- C:\Windows\System\bJkuXBt.exe
  C:\Windows\System\bJkuXBt.exe
  2⤵
  PID:7596
- C:\Windows\System\CguOxfc.exe
  C:\Windows\System\CguOxfc.exe
  2⤵
  PID:6968
- C:\Windows\System\iUxrlAO.exe
  C:\Windows\System\iUxrlAO.exe
  2⤵
  PID:7664
- C:\Windows\System\tgczIsN.exe
  C:\Windows\System\tgczIsN.exe
  2⤵
  PID:6180
- C:\Windows\System\MwmDNjl.exe
  C:\Windows\System\MwmDNjl.exe
  2⤵
  PID:184
- C:\Windows\System\HkIegsD.exe
  C:\Windows\System\HkIegsD.exe
  2⤵
  PID:7760
- C:\Windows\System\heowiCE.exe
  C:\Windows\System\heowiCE.exe
  2⤵
  PID:7484
- C:\Windows\System\YWoRiqm.exe
  C:\Windows\System\YWoRiqm.exe
  2⤵
  PID:7840
- C:\Windows\System\HSKltso.exe
  C:\Windows\System\HSKltso.exe
  2⤵
  PID:7912
- C:\Windows\System\bHfoHUe.exe
  C:\Windows\System\bHfoHUe.exe
  2⤵
  PID:7520
- C:\Windows\System\xPGGWdQ.exe
  C:\Windows\System\xPGGWdQ.exe
  2⤵
  PID:8040
- C:\Windows\System\IDnSDCf.exe
  C:\Windows\System\IDnSDCf.exe
  2⤵
  PID:7192
- C:\Windows\System\SrOccMN.exe
  C:\Windows\System\SrOccMN.exe
  2⤵
  PID:7236
- C:\Windows\System\TnefPkO.exe
  C:\Windows\System\TnefPkO.exe
  2⤵
  PID:7268
- C:\Windows\System\YivGjOA.exe
  C:\Windows\System\YivGjOA.exe
  2⤵
  PID:6832
- C:\Windows\System\YPuKCbz.exe
  C:\Windows\System\YPuKCbz.exe
  2⤵
  PID:7328
- C:\Windows\System\jyiScdg.exe
  C:\Windows\System\jyiScdg.exe
  2⤵
  PID:8208
- C:\Windows\System\LWxBViy.exe
  C:\Windows\System\LWxBViy.exe
  2⤵
  PID:8228
- C:\Windows\System\JFJRWXE.exe
  C:\Windows\System\JFJRWXE.exe
  2⤵
  PID:8244
- C:\Windows\System\pJSnjNT.exe
  C:\Windows\System\pJSnjNT.exe
  2⤵
  PID:8268
- C:\Windows\System\GdWISRO.exe
  C:\Windows\System\GdWISRO.exe
  2⤵
  PID:8292
- C:\Windows\System\LZMJtpr.exe
  C:\Windows\System\LZMJtpr.exe
  2⤵
  PID:8312
- C:\Windows\System\pDtVhsD.exe
  C:\Windows\System\pDtVhsD.exe
  2⤵
  PID:8336
- C:\Windows\System\mDzeSNy.exe
  C:\Windows\System\mDzeSNy.exe
  2⤵
  PID:8352
- C:\Windows\System\RqcguBN.exe
  C:\Windows\System\RqcguBN.exe
  2⤵
  PID:8376
- C:\Windows\System\dEelbPH.exe
  C:\Windows\System\dEelbPH.exe
  2⤵
  PID:8400
- C:\Windows\System\cUxZXwx.exe
  C:\Windows\System\cUxZXwx.exe
  2⤵
  PID:8416
- C:\Windows\System\svjTCOw.exe
  C:\Windows\System\svjTCOw.exe
  2⤵
  PID:8444
- C:\Windows\System\uPvSKjd.exe
  C:\Windows\System\uPvSKjd.exe
  2⤵
  PID:8464
- C:\Windows\System\aWaUVdS.exe
  C:\Windows\System\aWaUVdS.exe
  2⤵
  PID:8484
- C:\Windows\System\xTLRifu.exe
  C:\Windows\System\xTLRifu.exe
  2⤵
  PID:8504
- C:\Windows\System\RSMmdEY.exe
  C:\Windows\System\RSMmdEY.exe
  2⤵
  PID:8524
- C:\Windows\System\rofefgH.exe
  C:\Windows\System\rofefgH.exe
  2⤵
  PID:8548
- C:\Windows\System\VZWAFkf.exe
  C:\Windows\System\VZWAFkf.exe
  2⤵
  PID:8568
- C:\Windows\System\CFtIeqd.exe
  C:\Windows\System\CFtIeqd.exe
  2⤵
  PID:8592
- C:\Windows\System\EAnmEir.exe
  C:\Windows\System\EAnmEir.exe
  2⤵
  PID:8612
- C:\Windows\System\TjIpCDO.exe
  C:\Windows\System\TjIpCDO.exe
  2⤵
  PID:8632
- C:\Windows\System\JwTMzvJ.exe
  C:\Windows\System\JwTMzvJ.exe
  2⤵
  PID:8652
- C:\Windows\System\OhMTiVl.exe
  C:\Windows\System\OhMTiVl.exe
  2⤵
  PID:8676
- C:\Windows\System\DurmpFM.exe
  C:\Windows\System\DurmpFM.exe
  2⤵
  PID:8696
- C:\Windows\System\MCXTjwx.exe
  C:\Windows\System\MCXTjwx.exe
  2⤵
  PID:8716
- C:\Windows\System\RUVJwwG.exe
  C:\Windows\System\RUVJwwG.exe
  2⤵
  PID:8736
- C:\Windows\System\iduwBjY.exe
  C:\Windows\System\iduwBjY.exe
  2⤵
  PID:8756
- C:\Windows\System\HhEsqCw.exe
  C:\Windows\System\HhEsqCw.exe
  2⤵
  PID:8772
- C:\Windows\System\XYZWSzE.exe
  C:\Windows\System\XYZWSzE.exe
  2⤵
  PID:8792
- C:\Windows\System\VFSYiMk.exe
  C:\Windows\System\VFSYiMk.exe
  2⤵
  PID:8816
- C:\Windows\System\tLluFhD.exe
  C:\Windows\System\tLluFhD.exe
  2⤵
  PID:8832
- C:\Windows\System\YSNQnDo.exe
  C:\Windows\System\YSNQnDo.exe
  2⤵
  PID:8848
- C:\Windows\System\EmWcCdh.exe
  C:\Windows\System\EmWcCdh.exe
  2⤵
  PID:8868
- C:\Windows\System\DlVFeen.exe
  C:\Windows\System\DlVFeen.exe
  2⤵
  PID:8896
- C:\Windows\System\JqdTLrt.exe
  C:\Windows\System\JqdTLrt.exe
  2⤵
  PID:8912
- C:\Windows\System\fxfhCnR.exe
  C:\Windows\System\fxfhCnR.exe
  2⤵
  PID:8940
- C:\Windows\System\VIzksvv.exe
  C:\Windows\System\VIzksvv.exe
  2⤵
  PID:8964
- C:\Windows\System\cErvpew.exe
  C:\Windows\System\cErvpew.exe
  2⤵
  PID:8988
- C:\Windows\System\bpXJaYh.exe
  C:\Windows\System\bpXJaYh.exe
  2⤵
  PID:9012
- C:\Windows\System\KsVVlNt.exe
  C:\Windows\System\KsVVlNt.exe
  2⤵
  PID:9040
- C:\Windows\System\bBJeYfk.exe
  C:\Windows\System\bBJeYfk.exe
  2⤵
  PID:9064
- C:\Windows\System\oWRxxBz.exe
  C:\Windows\System\oWRxxBz.exe
  2⤵
  PID:9084
- C:\Windows\System\rDOJkWV.exe
  C:\Windows\System\rDOJkWV.exe
  2⤵
  PID:9100
- C:\Windows\System\jxMVGSb.exe
  C:\Windows\System\jxMVGSb.exe
  2⤵
  PID:9120
- C:\Windows\System\JPtRqUu.exe
  C:\Windows\System\JPtRqUu.exe
  2⤵
  PID:9140
- C:\Windows\System\clLEuKa.exe
  C:\Windows\System\clLEuKa.exe
  2⤵
  PID:9160
- C:\Windows\System\YNEUexK.exe
  C:\Windows\System\YNEUexK.exe
  2⤵
  PID:9184
- C:\Windows\System\AUpburl.exe
  C:\Windows\System\AUpburl.exe
  2⤵
  PID:9204
- C:\Windows\System\cYuxxIm.exe
  C:\Windows\System\cYuxxIm.exe
  2⤵
  PID:6520
- C:\Windows\System\jtCzJnq.exe
  C:\Windows\System\jtCzJnq.exe
  2⤵
  PID:7376
- C:\Windows\System\HrJJNrt.exe
  C:\Windows\System\HrJJNrt.exe
  2⤵
  PID:1504
- C:\Windows\System\MjdtMnd.exe
  C:\Windows\System\MjdtMnd.exe
  2⤵
  PID:7428
- C:\Windows\System\pYFjTDp.exe
  C:\Windows\System\pYFjTDp.exe
  2⤵
  PID:4496
- C:\Windows\System\ovmnxqe.exe
  C:\Windows\System\ovmnxqe.exe
  2⤵
  PID:7448
- C:\Windows\System\ZCWNUkh.exe
  C:\Windows\System\ZCWNUkh.exe
  2⤵
  PID:228
- C:\Windows\System\YkOpBhi.exe
  C:\Windows\System\YkOpBhi.exe
  2⤵
  PID:7876
- C:\Windows\System\WSrDYLy.exe
  C:\Windows\System\WSrDYLy.exe
  2⤵
  PID:8140
- C:\Windows\System\VOjAIKD.exe
  C:\Windows\System\VOjAIKD.exe
  2⤵
  PID:7548
- C:\Windows\System\ZySOGeh.exe
  C:\Windows\System\ZySOGeh.exe
  2⤵
  PID:6940
- C:\Windows\System\RZHKlHg.exe
  C:\Windows\System\RZHKlHg.exe
  2⤵
  PID:1668
- C:\Windows\System\PKlCGZy.exe
  C:\Windows\System\PKlCGZy.exe
  2⤵
  PID:8224
- C:\Windows\System\ibosSHn.exe
  C:\Windows\System\ibosSHn.exe
  2⤵
  PID:8348
- C:\Windows\System\SCDhAIu.exe
  C:\Windows\System\SCDhAIu.exe
  2⤵
  PID:8408
- C:\Windows\System\vfjWUzU.exe
  C:\Windows\System\vfjWUzU.exe
  2⤵
  PID:3832
- C:\Windows\System\Qmdrqzg.exe
  C:\Windows\System\Qmdrqzg.exe
  2⤵
  PID:372
- C:\Windows\System\yCKAnpK.exe
  C:\Windows\System\yCKAnpK.exe
  2⤵
  PID:8556
- C:\Windows\System\FzqLQCs.exe
  C:\Windows\System\FzqLQCs.exe
  2⤵
  PID:7404
- C:\Windows\System\fodnLOJ.exe
  C:\Windows\System\fodnLOJ.exe
  2⤵
  PID:8608
- C:\Windows\System\RuAbIIc.exe
  C:\Windows\System\RuAbIIc.exe
  2⤵
  PID:8644
- C:\Windows\System\aXxPtNx.exe
  C:\Windows\System\aXxPtNx.exe
  2⤵
  PID:6600
- C:\Windows\System\IZOablQ.exe
  C:\Windows\System\IZOablQ.exe
  2⤵
  PID:7808
- C:\Windows\System\NCpmskd.exe
  C:\Windows\System\NCpmskd.exe
  2⤵
  PID:7860
- C:\Windows\System\mysUECN.exe
  C:\Windows\System\mysUECN.exe
  2⤵
  PID:6964
- C:\Windows\System\lNfZucO.exe
  C:\Windows\System\lNfZucO.exe
  2⤵
  PID:7368
- C:\Windows\System\bPmnaHp.exe
  C:\Windows\System\bPmnaHp.exe
  2⤵
  PID:6152
- C:\Windows\System\vUMEzVb.exe
  C:\Windows\System\vUMEzVb.exe
  2⤵
  PID:9232
- C:\Windows\System\UxSSOnb.exe
  C:\Windows\System\UxSSOnb.exe
  2⤵
  PID:9252
- C:\Windows\System\IyAkUPT.exe
  C:\Windows\System\IyAkUPT.exe
  2⤵
  PID:9268
- C:\Windows\System\MOXNwlQ.exe
  C:\Windows\System\MOXNwlQ.exe
  2⤵
  PID:9292
- C:\Windows\System\mrPVhYz.exe
  C:\Windows\System\mrPVhYz.exe
  2⤵
  PID:9316
- C:\Windows\System\qiCXsrZ.exe
  C:\Windows\System\qiCXsrZ.exe
  2⤵
  PID:9336
- C:\Windows\System\fcpnbbB.exe
  C:\Windows\System\fcpnbbB.exe
  2⤵
  PID:9352
- C:\Windows\System\tXBlefF.exe
  C:\Windows\System\tXBlefF.exe
  2⤵
  PID:9368
- C:\Windows\System\LIyxhLO.exe
  C:\Windows\System\LIyxhLO.exe
  2⤵
  PID:9384
- C:\Windows\System\CDRVscs.exe
  C:\Windows\System\CDRVscs.exe
  2⤵
  PID:9404
- C:\Windows\System\BscmVrY.exe
  C:\Windows\System\BscmVrY.exe
  2⤵
  PID:9424
- C:\Windows\System\PzNKtFX.exe
  C:\Windows\System\PzNKtFX.exe
  2⤵
  PID:9444
- C:\Windows\System\MQZAlyA.exe
  C:\Windows\System\MQZAlyA.exe
  2⤵
  PID:9464
- C:\Windows\System\PnLKCgX.exe
  C:\Windows\System\PnLKCgX.exe
  2⤵
  PID:9492
- C:\Windows\System\SwKGhiA.exe
  C:\Windows\System\SwKGhiA.exe
  2⤵
  PID:9516
- C:\Windows\System\ehYmhGQ.exe
  C:\Windows\System\ehYmhGQ.exe
  2⤵
  PID:9536
- C:\Windows\System\GdIzvrP.exe
  C:\Windows\System\GdIzvrP.exe
  2⤵
  PID:9556
- C:\Windows\System\BEbaOHS.exe
  C:\Windows\System\BEbaOHS.exe
  2⤵
  PID:9576
- C:\Windows\System\CAZdoTi.exe
  C:\Windows\System\CAZdoTi.exe
  2⤵
  PID:9596
- C:\Windows\System\HDnZevz.exe
  C:\Windows\System\HDnZevz.exe
  2⤵
  PID:9616
- C:\Windows\System\KWEsEgv.exe
  C:\Windows\System\KWEsEgv.exe
  2⤵
  PID:9640
- C:\Windows\System\bdVYfmr.exe
  C:\Windows\System\bdVYfmr.exe
  2⤵
  PID:9656
- C:\Windows\System\bIBuivG.exe
  C:\Windows\System\bIBuivG.exe
  2⤵
  PID:9680
- C:\Windows\System\HjFEtGi.exe
  C:\Windows\System\HjFEtGi.exe
  2⤵
  PID:9708
- C:\Windows\System\ZwwCOqv.exe
  C:\Windows\System\ZwwCOqv.exe
  2⤵
  PID:9728
- C:\Windows\System\jJOjJoT.exe
  C:\Windows\System\jJOjJoT.exe
  2⤵
  PID:9748
- C:\Windows\System\oCiKukJ.exe
  C:\Windows\System\oCiKukJ.exe
  2⤵
  PID:9776
- C:\Windows\System\zkPkBoS.exe
  C:\Windows\System\zkPkBoS.exe
  2⤵
  PID:9792
- C:\Windows\System\CBSrBCM.exe
  C:\Windows\System\CBSrBCM.exe
  2⤵
  PID:9808
- C:\Windows\System\EBjTvts.exe
  C:\Windows\System\EBjTvts.exe
  2⤵
  PID:9828
- C:\Windows\System\uxMJsfQ.exe
  C:\Windows\System\uxMJsfQ.exe
  2⤵
  PID:9848
- C:\Windows\System\aDuYMTU.exe
  C:\Windows\System\aDuYMTU.exe
  2⤵
  PID:9872
- C:\Windows\System\cQpVKgA.exe
  C:\Windows\System\cQpVKgA.exe
  2⤵
  PID:9892
- C:\Windows\System\ceoMIqJ.exe
  C:\Windows\System\ceoMIqJ.exe
  2⤵
  PID:9916
- C:\Windows\System\BsRzwsE.exe
  C:\Windows\System\BsRzwsE.exe
  2⤵
  PID:9940
- C:\Windows\System\VUSoUor.exe
  C:\Windows\System\VUSoUor.exe
  2⤵
  PID:9956
- C:\Windows\System\IleOure.exe
  C:\Windows\System\IleOure.exe
  2⤵
  PID:9976
- C:\Windows\System\ldCVESh.exe
  C:\Windows\System\ldCVESh.exe
  2⤵
  PID:10000
- C:\Windows\System\adhwBMd.exe
  C:\Windows\System\adhwBMd.exe
  2⤵
  PID:10020
- C:\Windows\System\kIxorUe.exe
  C:\Windows\System\kIxorUe.exe
  2⤵
  PID:10040
- C:\Windows\System\OontKSn.exe
  C:\Windows\System\OontKSn.exe
  2⤵
  PID:10068
- C:\Windows\System\zAkLFxW.exe
  C:\Windows\System\zAkLFxW.exe
  2⤵
  PID:10088
- C:\Windows\System\UnCxnQP.exe
  C:\Windows\System\UnCxnQP.exe
  2⤵
  PID:10112
- C:\Windows\System\TViPWSz.exe
  C:\Windows\System\TViPWSz.exe
  2⤵
  PID:10144
- C:\Windows\System\RgMBSAH.exe
  C:\Windows\System\RgMBSAH.exe
  2⤵
  PID:10160
- C:\Windows\System\cXygdcH.exe
  C:\Windows\System\cXygdcH.exe
  2⤵
  PID:10188
- C:\Windows\System\YNKNgtQ.exe
  C:\Windows\System\YNKNgtQ.exe
  2⤵
  PID:10204
- C:\Windows\System\kCiBbzh.exe
  C:\Windows\System\kCiBbzh.exe
  2⤵
  PID:10228
- C:\Windows\System\BBjhVog.exe
  C:\Windows\System\BBjhVog.exe
  2⤵
  PID:8080
- C:\Windows\System\NTDdYEE.exe
  C:\Windows\System\NTDdYEE.exe
  2⤵
  PID:7512
- C:\Windows\System\MoLzulH.exe
  C:\Windows\System\MoLzulH.exe
  2⤵
  PID:8156
- C:\Windows\System\qCWgsew.exe
  C:\Windows\System\qCWgsew.exe
  2⤵
  PID:8904
- C:\Windows\System\LzTvQNt.exe
  C:\Windows\System\LzTvQNt.exe
  2⤵
  PID:6928
- C:\Windows\System\tfjHKYr.exe
  C:\Windows\System\tfjHKYr.exe
  2⤵
  PID:9032
- C:\Windows\System\eeRbIoV.exe
  C:\Windows\System\eeRbIoV.exe
  2⤵
  PID:8280
- C:\Windows\System\TKjjtgn.exe
  C:\Windows\System\TKjjtgn.exe
  2⤵
  PID:8308
- C:\Windows\System\sbxVwjf.exe
  C:\Windows\System\sbxVwjf.exe
  2⤵
  PID:8332
- C:\Windows\System\yTMCBFP.exe
  C:\Windows\System\yTMCBFP.exe
  2⤵
  PID:9112
- C:\Windows\System\luewjNJ.exe
  C:\Windows\System\luewjNJ.exe
  2⤵
  PID:2676
- C:\Windows\System\JuVzpYZ.exe
  C:\Windows\System\JuVzpYZ.exe
  2⤵
  PID:9180
- C:\Windows\System\KsZDaTV.exe
  C:\Windows\System\KsZDaTV.exe
  2⤵
  PID:7388
- C:\Windows\System\sOQKURo.exe
  C:\Windows\System\sOQKURo.exe
  2⤵
  PID:3008
- C:\Windows\System\bQoFaKd.exe
  C:\Windows\System\bQoFaKd.exe
  2⤵
  PID:7544
- C:\Windows\System\hvNgWxj.exe
  C:\Windows\System\hvNgWxj.exe
  2⤵
  PID:8436
- C:\Windows\System\dReahGp.exe
  C:\Windows\System\dReahGp.exe
  2⤵
  PID:8684
- C:\Windows\System\ASxnWbL.exe
  C:\Windows\System\ASxnWbL.exe
  2⤵
  PID:5548
- C:\Windows\System\fgKKSca.exe
  C:\Windows\System\fgKKSca.exe
  2⤵
  PID:9224
- C:\Windows\System\cFRRJNu.exe
  C:\Windows\System\cFRRJNu.exe
  2⤵
  PID:9288
- C:\Windows\System\wTNRphy.exe
  C:\Windows\System\wTNRphy.exe
  2⤵
  PID:9324
- C:\Windows\System\lNKrOEu.exe
  C:\Windows\System\lNKrOEu.exe
  2⤵
  PID:10252
- C:\Windows\System\Wlnikyl.exe
  C:\Windows\System\Wlnikyl.exe
  2⤵
  PID:10272
- C:\Windows\System\wapESMD.exe
  C:\Windows\System\wapESMD.exe
  2⤵
  PID:10292
- C:\Windows\System\aMuvIHo.exe
  C:\Windows\System\aMuvIHo.exe
  2⤵
  PID:10320
- C:\Windows\System\cnRByuP.exe
  C:\Windows\System\cnRByuP.exe
  2⤵
  PID:10336
- C:\Windows\System\lMhqcaI.exe
  C:\Windows\System\lMhqcaI.exe
  2⤵
  PID:10356
- C:\Windows\System\dPJuJup.exe
  C:\Windows\System\dPJuJup.exe
  2⤵
  PID:10380
- C:\Windows\System\SeyHlUN.exe
  C:\Windows\System\SeyHlUN.exe
  2⤵
  PID:10408
- C:\Windows\System\FsgYgXC.exe
  C:\Windows\System\FsgYgXC.exe
  2⤵
  PID:10424
- C:\Windows\System\MKKyxCM.exe
  C:\Windows\System\MKKyxCM.exe
  2⤵
  PID:10440
- C:\Windows\System\tOCOXgT.exe
  C:\Windows\System\tOCOXgT.exe
  2⤵
  PID:10456
- C:\Windows\System\YvxIGPI.exe
  C:\Windows\System\YvxIGPI.exe
  2⤵
  PID:10488
- C:\Windows\System\bbcPJcY.exe
  C:\Windows\System\bbcPJcY.exe
  2⤵
  PID:10508
- C:\Windows\System\yHwzoxL.exe
  C:\Windows\System\yHwzoxL.exe
  2⤵
  PID:10532
- C:\Windows\System\pSjACeo.exe
  C:\Windows\System\pSjACeo.exe
  2⤵
  PID:10548
- C:\Windows\System\NFNdBiv.exe
  C:\Windows\System\NFNdBiv.exe
  2⤵
  PID:10568
- C:\Windows\System\OAMvxjv.exe
  C:\Windows\System\OAMvxjv.exe
  2⤵
  PID:10596
- C:\Windows\System\QhbTyZH.exe
  C:\Windows\System\QhbTyZH.exe
  2⤵
  PID:10616
- C:\Windows\System\fgjscga.exe
  C:\Windows\System\fgjscga.exe
  2⤵
  PID:10636
- C:\Windows\System\ORaAlYs.exe
  C:\Windows\System\ORaAlYs.exe
  2⤵
  PID:10660
- C:\Windows\System\TtjKqNI.exe
  C:\Windows\System\TtjKqNI.exe
  2⤵
  PID:10680
- C:\Windows\System\bahwgRg.exe
  C:\Windows\System\bahwgRg.exe
  2⤵
  PID:10700
- C:\Windows\System\QGqPRRU.exe
  C:\Windows\System\QGqPRRU.exe
  2⤵
  PID:10724
- C:\Windows\System\MRBhJEA.exe
  C:\Windows\System\MRBhJEA.exe
  2⤵
  PID:10744
- C:\Windows\System\tRSVgay.exe
  C:\Windows\System\tRSVgay.exe
  2⤵
  PID:10764
- C:\Windows\System\fcmJbCd.exe
  C:\Windows\System\fcmJbCd.exe
  2⤵
  PID:10784
- C:\Windows\System\sDzylXm.exe
  C:\Windows\System\sDzylXm.exe
  2⤵
  PID:10812
- C:\Windows\System\kETzbpz.exe
  C:\Windows\System\kETzbpz.exe
  2⤵
  PID:10836
- C:\Windows\System\odlvZOg.exe
  C:\Windows\System\odlvZOg.exe
  2⤵
  PID:10856
- C:\Windows\System\dQoQosl.exe
  C:\Windows\System\dQoQosl.exe
  2⤵
  PID:10876
- C:\Windows\System\UyBcVEz.exe
  C:\Windows\System\UyBcVEz.exe
  2⤵
  PID:10896
- C:\Windows\System\ytRyGFE.exe
  C:\Windows\System\ytRyGFE.exe
  2⤵
  PID:10920
- C:\Windows\System\GHiYVXY.exe
  C:\Windows\System\GHiYVXY.exe
  2⤵
  PID:10936
- C:\Windows\System\jASVVak.exe
  C:\Windows\System\jASVVak.exe
  2⤵
  PID:10956
- C:\Windows\System\pSVSbNN.exe
  C:\Windows\System\pSVSbNN.exe
  2⤵
  PID:10984
- C:\Windows\System\plNbOEp.exe
  C:\Windows\System\plNbOEp.exe
  2⤵
  PID:11004
- C:\Windows\System\svBnDID.exe
  C:\Windows\System\svBnDID.exe
  2⤵
  PID:11024
- C:\Windows\System\QXKuztf.exe
  C:\Windows\System\QXKuztf.exe
  2⤵
  PID:11048
- C:\Windows\System\KnOQrOS.exe
  C:\Windows\System\KnOQrOS.exe
  2⤵
  PID:11072
- C:\Windows\System\QjIdggI.exe
  C:\Windows\System\QjIdggI.exe
  2⤵
  PID:11092
- C:\Windows\System\KBBqfRu.exe
  C:\Windows\System\KBBqfRu.exe
  2⤵
  PID:11112
- C:\Windows\System\VLLiIJt.exe
  C:\Windows\System\VLLiIJt.exe
  2⤵
  PID:11140
- C:\Windows\System\YQbKdXv.exe
  C:\Windows\System\YQbKdXv.exe
  2⤵
  PID:11160
- C:\Windows\System\RhNlncz.exe
  C:\Windows\System\RhNlncz.exe
  2⤵
  PID:11180
- C:\Windows\System\NDLIlnG.exe
  C:\Windows\System\NDLIlnG.exe
  2⤵
  PID:11200
- C:\Windows\System\fGzstiV.exe
  C:\Windows\System\fGzstiV.exe
  2⤵
  PID:11224
- C:\Windows\System\IIjPIib.exe
  C:\Windows\System\IIjPIib.exe
  2⤵
  PID:11240
- C:\Windows\System\xSaLtoj.exe
  C:\Windows\System\xSaLtoj.exe
  2⤵
  PID:9360
- C:\Windows\System\ONTULsN.exe
  C:\Windows\System\ONTULsN.exe
  2⤵
  PID:8972
- C:\Windows\System\sRXmupC.exe
  C:\Windows\System\sRXmupC.exe
  2⤵
  PID:9664
- C:\Windows\System\yKFqPlo.exe
  C:\Windows\System\yKFqPlo.exe
  2⤵
  PID:9152
- C:\Windows\System\OUxxjKy.exe
  C:\Windows\System\OUxxjKy.exe
  2⤵
  PID:9176
- C:\Windows\System\JuXZVLy.exe
  C:\Windows\System\JuXZVLy.exe
  2⤵
  PID:8456
- C:\Windows\System\oeMSKnc.exe
  C:\Windows\System\oeMSKnc.exe
  2⤵
  PID:9856
- C:\Windows\System\kRTQyUr.exe
  C:\Windows\System\kRTQyUr.exe
  2⤵
  PID:9900
- C:\Windows\System\UiDjbUK.exe
  C:\Windows\System\UiDjbUK.exe
  2⤵
  PID:9932
- C:\Windows\System\gvheWkS.exe
  C:\Windows\System\gvheWkS.exe
  2⤵
  PID:9984
- C:\Windows\System\abXpROl.exe
  C:\Windows\System\abXpROl.exe
  2⤵
  PID:10036
- C:\Windows\System\bDcOgjk.exe
  C:\Windows\System\bDcOgjk.exe
  2⤵
  PID:8096
- C:\Windows\System\TMtzpDZ.exe
  C:\Windows\System\TMtzpDZ.exe
  2⤵
  PID:10100
- C:\Windows\System\RrpgFZu.exe
  C:\Windows\System\RrpgFZu.exe
  2⤵
  PID:4980
- C:\Windows\System\pyhtssQ.exe
  C:\Windows\System\pyhtssQ.exe
  2⤵
  PID:8372
- C:\Windows\System\WiytOGa.exe
  C:\Windows\System\WiytOGa.exe
  2⤵
  PID:10136
- C:\Windows\System\hPpVUbK.exe
  C:\Windows\System\hPpVUbK.exe
  2⤵
  PID:10224
- C:\Windows\System\LyXVNhO.exe
  C:\Windows\System\LyXVNhO.exe
  2⤵
  PID:1588
- C:\Windows\System\UmcxyjI.exe
  C:\Windows\System\UmcxyjI.exe
  2⤵
  PID:8024
- C:\Windows\System\zWmRhBE.exe
  C:\Windows\System\zWmRhBE.exe
  2⤵
  PID:6844
- C:\Windows\System\wqOusvZ.exe
  C:\Windows\System\wqOusvZ.exe
  2⤵
  PID:8788
- C:\Windows\System\LNYdIpu.exe
  C:\Windows\System\LNYdIpu.exe
  2⤵
  PID:3732
- C:\Windows\System\pNLIFYk.exe
  C:\Windows\System\pNLIFYk.exe
  2⤵
  PID:9244
- C:\Windows\System\hHglAcM.exe
  C:\Windows\System\hHglAcM.exe
  2⤵
  PID:11280
- C:\Windows\System\yXZNovv.exe
  C:\Windows\System\yXZNovv.exe
  2⤵
  PID:11300
- C:\Windows\System\KjBvXut.exe
  C:\Windows\System\KjBvXut.exe
  2⤵
  PID:11324
- C:\Windows\System\YbxnZDk.exe
  C:\Windows\System\YbxnZDk.exe
  2⤵
  PID:11352
- C:\Windows\System\IAVAKKh.exe
  C:\Windows\System\IAVAKKh.exe
  2⤵
  PID:11376
- C:\Windows\System\mObXqjM.exe
  C:\Windows\System\mObXqjM.exe
  2⤵
  PID:11396
- C:\Windows\System\YtQMwOn.exe
  C:\Windows\System\YtQMwOn.exe
  2⤵
  PID:11416
- C:\Windows\System\WAYHVOX.exe
  C:\Windows\System\WAYHVOX.exe
  2⤵
  PID:11432
- C:\Windows\System\WIGfuKp.exe
  C:\Windows\System\WIGfuKp.exe
  2⤵
  PID:11448
- C:\Windows\System\tsdelyj.exe
  C:\Windows\System\tsdelyj.exe
  2⤵
  PID:11464
- C:\Windows\System\cpEbROq.exe
  C:\Windows\System\cpEbROq.exe
  2⤵
  PID:11480
- C:\Windows\System\CBIEZoE.exe
  C:\Windows\System\CBIEZoE.exe
  2⤵
  PID:11496
- C:\Windows\System\cWxVFNd.exe
  C:\Windows\System\cWxVFNd.exe
  2⤵
  PID:11516
- C:\Windows\System\nWtdsxn.exe
  C:\Windows\System\nWtdsxn.exe
  2⤵
  PID:11540
- C:\Windows\System\dgXtKIm.exe
  C:\Windows\System\dgXtKIm.exe
  2⤵
  PID:11564
- C:\Windows\System\xyGHEhX.exe
  C:\Windows\System\xyGHEhX.exe
  2⤵
  PID:11588
- C:\Windows\System\sYvLIsK.exe
  C:\Windows\System\sYvLIsK.exe
  2⤵
  PID:11608
- C:\Windows\System\vcXIoXF.exe
  C:\Windows\System\vcXIoXF.exe
  2⤵
  PID:11628
- C:\Windows\System\tTqObGI.exe
  C:\Windows\System\tTqObGI.exe
  2⤵
  PID:11648
- C:\Windows\System\ZnyZyCX.exe
  C:\Windows\System\ZnyZyCX.exe
  2⤵
  PID:11672
- C:\Windows\System\mcEhUOu.exe
  C:\Windows\System\mcEhUOu.exe
  2⤵
  PID:11692
- C:\Windows\System\sZKPhlk.exe
  C:\Windows\System\sZKPhlk.exe
  2⤵
  PID:11708
- C:\Windows\System\qPBaSaI.exe
  C:\Windows\System\qPBaSaI.exe
  2⤵
  PID:11736
- C:\Windows\System\NJTXWsg.exe
  C:\Windows\System\NJTXWsg.exe
  2⤵
  PID:11752
- C:\Windows\System\BbsNxed.exe
  C:\Windows\System\BbsNxed.exe
  2⤵
  PID:11776
- C:\Windows\System\xkyWdza.exe
  C:\Windows\System\xkyWdza.exe
  2⤵
  PID:11800
- C:\Windows\System\emXtfXI.exe
  C:\Windows\System\emXtfXI.exe
  2⤵
  PID:11820
- C:\Windows\System\hilWIyc.exe
  C:\Windows\System\hilWIyc.exe
  2⤵
  PID:11844
- C:\Windows\System\JUKywEA.exe
  C:\Windows\System\JUKywEA.exe
  2⤵
  PID:11860
- C:\Windows\System\LsPwbUQ.exe
  C:\Windows\System\LsPwbUQ.exe
  2⤵
  PID:11880
- C:\Windows\System\yZJTQYV.exe
  C:\Windows\System\yZJTQYV.exe
  2⤵
  PID:11908
- C:\Windows\System\wNiRhlK.exe
  C:\Windows\System\wNiRhlK.exe
  2⤵
  PID:11924
- C:\Windows\System\rkUFYOF.exe
  C:\Windows\System\rkUFYOF.exe
  2⤵
  PID:11952
- C:\Windows\System\dGXeJCm.exe
  C:\Windows\System\dGXeJCm.exe
  2⤵
  PID:11968
- C:\Windows\System\XtMTflI.exe
  C:\Windows\System\XtMTflI.exe
  2⤵
  PID:11988
- C:\Windows\System\wXnfMzk.exe
  C:\Windows\System\wXnfMzk.exe
  2⤵
  PID:12016
- C:\Windows\System\PadtuxI.exe
  C:\Windows\System\PadtuxI.exe
  2⤵
  PID:12036
- C:\Windows\System\Zzzvunk.exe
  C:\Windows\System\Zzzvunk.exe
  2⤵
  PID:12056
- C:\Windows\System\uviDqUm.exe
  C:\Windows\System\uviDqUm.exe
  2⤵
  PID:12080
- C:\Windows\System\cuzwVLm.exe
  C:\Windows\System\cuzwVLm.exe
  2⤵
  PID:12100
- C:\Windows\System\XKbDoSn.exe
  C:\Windows\System\XKbDoSn.exe
  2⤵
  PID:12124
- C:\Windows\System\BbvYpMu.exe
  C:\Windows\System\BbvYpMu.exe
  2⤵
  PID:12144
- C:\Windows\System\SsnsSPu.exe
  C:\Windows\System\SsnsSPu.exe
  2⤵
  PID:12164
- C:\Windows\System\jLHhvfX.exe
  C:\Windows\System\jLHhvfX.exe
  2⤵
  PID:12192
- C:\Windows\System\ELPmLmU.exe
  C:\Windows\System\ELPmLmU.exe
  2⤵
  PID:12216
- C:\Windows\System\KCmPsNB.exe
  C:\Windows\System\KCmPsNB.exe
  2⤵
  PID:12240
- C:\Windows\System\lhgApaC.exe
  C:\Windows\System\lhgApaC.exe
  2⤵
  PID:12264
- C:\Windows\System\SLXrPph.exe
  C:\Windows\System\SLXrPph.exe
  2⤵
  PID:8112
- C:\Windows\System\QIoKLJt.exe
  C:\Windows\System\QIoKLJt.exe
  2⤵
  PID:9260
- C:\Windows\System\oiFbgav.exe
  C:\Windows\System\oiFbgav.exe
  2⤵
  PID:9332
- C:\Windows\System\ZmTMlBb.exe
  C:\Windows\System\ZmTMlBb.exe
  2⤵
  PID:10248
- C:\Windows\System\bIUgjjp.exe
  C:\Windows\System\bIUgjjp.exe
  2⤵
  PID:10352
- C:\Windows\System\phHHADA.exe
  C:\Windows\System\phHHADA.exe
  2⤵
  PID:10416
- C:\Windows\System\JIkifjg.exe
  C:\Windows\System\JIkifjg.exe
  2⤵
  PID:10476
- C:\Windows\System\fqZAwQO.exe
  C:\Windows\System\fqZAwQO.exe
  2⤵
  PID:10516
- C:\Windows\System\uGBcRHM.exe
  C:\Windows\System\uGBcRHM.exe
  2⤵
  PID:9532
- C:\Windows\System\CDiKjIh.exe
  C:\Windows\System\CDiKjIh.exe
  2⤵
  PID:9624
- C:\Windows\System\nFgkDeH.exe
  C:\Windows\System\nFgkDeH.exe
  2⤵
  PID:10752
- C:\Windows\System\FPwZvNA.exe
  C:\Windows\System\FPwZvNA.exe
  2⤵
  PID:10844
- C:\Windows\System\feTcKZZ.exe
  C:\Windows\System\feTcKZZ.exe
  2⤵
  PID:10916
- C:\Windows\System\ZkPkVAU.exe
  C:\Windows\System\ZkPkVAU.exe
  2⤵
  PID:10948
- C:\Windows\System\myLYiVo.exe
  C:\Windows\System\myLYiVo.exe
  2⤵
  PID:3380
- C:\Windows\System\oidFxGm.exe
  C:\Windows\System\oidFxGm.exe
  2⤵
  PID:11000
- C:\Windows\System\wMiIbiK.exe
  C:\Windows\System\wMiIbiK.exe
  2⤵
  PID:9908
- C:\Windows\System\jutxfoE.exe
  C:\Windows\System\jutxfoE.exe
  2⤵
  PID:9972
- C:\Windows\System\rLXsGfl.exe
  C:\Windows\System\rLXsGfl.exe
  2⤵
  PID:12312
- C:\Windows\System\wDvdzLy.exe
  C:\Windows\System\wDvdzLy.exe
  2⤵
  PID:12328
- C:\Windows\System\xsKIJFB.exe
  C:\Windows\System\xsKIJFB.exe
  2⤵
  PID:12360
- C:\Windows\System\DPxwTGR.exe
  C:\Windows\System\DPxwTGR.exe
  2⤵
  PID:12376
- C:\Windows\System\ryllUpr.exe
  C:\Windows\System\ryllUpr.exe
  2⤵
  PID:12396
- C:\Windows\System\OGaJDhe.exe
  C:\Windows\System\OGaJDhe.exe
  2⤵
  PID:12424
- C:\Windows\System\tmZucit.exe
  C:\Windows\System\tmZucit.exe
  2⤵
  PID:12444
- C:\Windows\System\gGbeVjr.exe
  C:\Windows\System\gGbeVjr.exe
  2⤵
  PID:12460
- C:\Windows\System\wRfuVyI.exe
  C:\Windows\System\wRfuVyI.exe
  2⤵
  PID:12480
- C:\Windows\System\GnMyDhE.exe
  C:\Windows\System\GnMyDhE.exe
  2⤵
  PID:12496
- C:\Windows\System\zpwhfJp.exe
  C:\Windows\System\zpwhfJp.exe
  2⤵
  PID:12512
- C:\Windows\System\sCjxMpu.exe
  C:\Windows\System\sCjxMpu.exe
  2⤵
  PID:12528
- C:\Windows\System\UssUGiI.exe
  C:\Windows\System\UssUGiI.exe
  2⤵
  PID:12548
- C:\Windows\System\UuKsOjo.exe
  C:\Windows\System\UuKsOjo.exe
  2⤵
  PID:12568
- C:\Windows\System\nMrVaIL.exe
  C:\Windows\System\nMrVaIL.exe
  2⤵
  PID:12592
- C:\Windows\System\ZEjaLjx.exe
  C:\Windows\System\ZEjaLjx.exe
  2⤵
  PID:12612
- C:\Windows\System\gqQOngG.exe
  C:\Windows\System\gqQOngG.exe
  2⤵
  PID:12632
- C:\Windows\System\mnOWLhb.exe
  C:\Windows\System\mnOWLhb.exe
  2⤵
  PID:12656
- C:\Windows\System\pghBhDm.exe
  C:\Windows\System\pghBhDm.exe
  2⤵
  PID:12672
- C:\Windows\System\cLCTYgF.exe
  C:\Windows\System\cLCTYgF.exe
  2⤵
  PID:12692
- C:\Windows\System\rgelGEZ.exe
  C:\Windows\System\rgelGEZ.exe
  2⤵
  PID:12724
- C:\Windows\System\BMgsvcV.exe
  C:\Windows\System\BMgsvcV.exe
  2⤵
  PID:12744
- C:\Windows\System\cwrUFrK.exe
  C:\Windows\System\cwrUFrK.exe
  2⤵
  PID:12772
- C:\Windows\System\IjJNyAv.exe
  C:\Windows\System\IjJNyAv.exe
  2⤵
  PID:12796
- C:\Windows\System\WOrFIvR.exe
  C:\Windows\System\WOrFIvR.exe
  2⤵
  PID:12820
- C:\Windows\System\GWVZHCE.exe
  C:\Windows\System\GWVZHCE.exe
  2⤵
  PID:12836
- C:\Windows\System\lkMHyWp.exe
  C:\Windows\System\lkMHyWp.exe
  2⤵
  PID:12856
- C:\Windows\System\JUgFjnh.exe
  C:\Windows\System\JUgFjnh.exe
  2⤵
  PID:12872
- C:\Windows\System\swnSClH.exe
  C:\Windows\System\swnSClH.exe
  2⤵
  PID:12892
- C:\Windows\System\VOfzNVr.exe
  C:\Windows\System\VOfzNVr.exe
  2⤵
  PID:12916
- C:\Windows\System\PFTaUEU.exe
  C:\Windows\System\PFTaUEU.exe
  2⤵
  PID:12936
- C:\Windows\System\tEgnUMZ.exe
  C:\Windows\System\tEgnUMZ.exe
  2⤵
  PID:12952
- C:\Windows\System\zIArZBk.exe
  C:\Windows\System\zIArZBk.exe
  2⤵
  PID:12976
- C:\Windows\System\gtVFgIg.exe
  C:\Windows\System\gtVFgIg.exe
  2⤵
  PID:13008
- C:\Windows\System\IbBwLtn.exe
  C:\Windows\System\IbBwLtn.exe
  2⤵
  PID:13024
- C:\Windows\System\lKvjDHA.exe
  C:\Windows\System\lKvjDHA.exe
  2⤵
  PID:13044
- C:\Windows\System\cpeEXpU.exe
  C:\Windows\System\cpeEXpU.exe
  2⤵
  PID:13064
- C:\Windows\System\xFvKzWR.exe
  C:\Windows\System\xFvKzWR.exe
  2⤵
  PID:13084
- C:\Windows\System\aCwuKfu.exe
  C:\Windows\System\aCwuKfu.exe
  2⤵
  PID:13112
- C:\Windows\System\kPSWfcj.exe
  C:\Windows\System\kPSWfcj.exe
  2⤵
  PID:13136
- C:\Windows\System\qUzRhdV.exe
  C:\Windows\System\qUzRhdV.exe
  2⤵
  PID:13156
- C:\Windows\System\iEXJmZZ.exe
  C:\Windows\System\iEXJmZZ.exe
  2⤵
  PID:13176
- C:\Windows\System\RUecDCx.exe
  C:\Windows\System\RUecDCx.exe
  2⤵
  PID:13204
- C:\Windows\System\iROZMOP.exe
  C:\Windows\System\iROZMOP.exe
  2⤵
  PID:13224
- C:\Windows\System\LBXXqby.exe
  C:\Windows\System\LBXXqby.exe
  2⤵
  PID:13244
- C:\Windows\System\bjALVfn.exe
  C:\Windows\System\bjALVfn.exe
  2⤵
  PID:13268
- C:\Windows\System\sGKpaCF.exe
  C:\Windows\System\sGKpaCF.exe
  2⤵
  PID:13292
- C:\Windows\System\GKrAXXU.exe
  C:\Windows\System\GKrAXXU.exe
  2⤵
  PID:11216
- C:\Windows\System\CqNcUtU.exe
  C:\Windows\System\CqNcUtU.exe
  2⤵
  PID:9476
- C:\Windows\System\ImNcSyO.exe
  C:\Windows\System\ImNcSyO.exe
  2⤵
  PID:8512
- C:\Windows\System\mpMtSMW.exe
  C:\Windows\System\mpMtSMW.exe
  2⤵
  PID:10008
- C:\Windows\System\LUcJZvC.exe
  C:\Windows\System\LUcJZvC.exe
  2⤵
  PID:7848
- C:\Windows\System\SZgfiKa.exe
  C:\Windows\System\SZgfiKa.exe
  2⤵
  PID:10156
- C:\Windows\System\MIDtetf.exe
  C:\Windows\System\MIDtetf.exe
  2⤵
  PID:9072
- C:\Windows\System\jbRsjqE.exe
  C:\Windows\System\jbRsjqE.exe
  2⤵
  PID:8324
- C:\Windows\System\fvsKDDm.exe
  C:\Windows\System\fvsKDDm.exe
  2⤵
  PID:8860
- C:\Windows\System\yXOoKqN.exe
  C:\Windows\System\yXOoKqN.exe
  2⤵
  PID:8708
- C:\Windows\System\bahHhso.exe
  C:\Windows\System\bahHhso.exe
  2⤵
  PID:6960
- C:\Windows\System\PZVbblx.exe
  C:\Windows\System\PZVbblx.exe
  2⤵
  PID:13324
- C:\Windows\System\uSltDOO.exe
  C:\Windows\System\uSltDOO.exe
  2⤵
  PID:13348
- C:\Windows\System\HqRriDh.exe
  C:\Windows\System\HqRriDh.exe
  2⤵
  PID:13372
- C:\Windows\System\aTdVtEv.exe
  C:\Windows\System\aTdVtEv.exe
  2⤵
  PID:13396
- C:\Windows\System\fAGaXmz.exe
  C:\Windows\System\fAGaXmz.exe
  2⤵
  PID:13412
- C:\Windows\System\uHVoVwA.exe
  C:\Windows\System\uHVoVwA.exe
  2⤵
  PID:13436
- C:\Windows\System\LXoSZwY.exe
  C:\Windows\System\LXoSZwY.exe
  2⤵
  PID:13456
- C:\Windows\System\csWBWgC.exe
  C:\Windows\System\csWBWgC.exe
  2⤵
  PID:13472
- C:\Windows\System\MPylUAC.exe
  C:\Windows\System\MPylUAC.exe
  2⤵
  PID:13500
- C:\Windows\System\JgpGeuQ.exe
  C:\Windows\System\JgpGeuQ.exe
  2⤵
  PID:13516
- C:\Windows\System\sTYwMHY.exe
  C:\Windows\System\sTYwMHY.exe
  2⤵
  PID:13532
- C:\Windows\System\KKryBWv.exe
  C:\Windows\System\KKryBWv.exe
  2⤵
  PID:13552
- C:\Windows\System\ZhqHcNK.exe
  C:\Windows\System\ZhqHcNK.exe
  2⤵
  PID:13568
- C:\Windows\System\gCTKsZG.exe
  C:\Windows\System\gCTKsZG.exe
  2⤵
  PID:13588
- C:\Windows\System\gptPVcd.exe
  C:\Windows\System\gptPVcd.exe
  2⤵
  PID:13608
- C:\Windows\System\ItxWyLU.exe
  C:\Windows\System\ItxWyLU.exe
  2⤵
  PID:13904
- C:\Windows\System\ZQiWOGT.exe
  C:\Windows\System\ZQiWOGT.exe
  2⤵
  PID:13948
- C:\Windows\System\XPPHYYa.exe
  C:\Windows\System\XPPHYYa.exe
  2⤵
  PID:13968
- C:\Windows\System\QUcNtlN.exe
  C:\Windows\System\QUcNtlN.exe
  2⤵
  PID:13992
- C:\Windows\System\sLfYGAj.exe
  C:\Windows\System\sLfYGAj.exe
  2⤵
  PID:14012
- C:\Windows\System\tbsgeev.exe
  C:\Windows\System\tbsgeev.exe
  2⤵
  PID:14040
- C:\Windows\System\DImapYY.exe
  C:\Windows\System\DImapYY.exe
  2⤵
  PID:14056
- C:\Windows\System\abzVVNI.exe
  C:\Windows\System\abzVVNI.exe
  2⤵
  PID:14080
- C:\Windows\System\tjWTMUG.exe
  C:\Windows\System\tjWTMUG.exe
  2⤵
  PID:14100
- C:\Windows\System\ukiBnKW.exe
  C:\Windows\System\ukiBnKW.exe
  2⤵
  PID:14120
- C:\Windows\System\pexDetj.exe
  C:\Windows\System\pexDetj.exe
  2⤵
  PID:14144
- C:\Windows\System\mHWZsTL.exe
  C:\Windows\System\mHWZsTL.exe
  2⤵
  PID:14164
- C:\Windows\System\rYesfzC.exe
  C:\Windows\System\rYesfzC.exe
  2⤵
  PID:14184
- C:\Windows\System\PHXbehO.exe
  C:\Windows\System\PHXbehO.exe
  2⤵
  PID:14208
- C:\Windows\System\MmdlWUW.exe
  C:\Windows\System\MmdlWUW.exe
  2⤵
  PID:14232
- C:\Windows\System\YLRpmgB.exe
  C:\Windows\System\YLRpmgB.exe
  2⤵
  PID:14252
- C:\Windows\System\RfruJNW.exe
  C:\Windows\System\RfruJNW.exe
  2⤵
  PID:14268
- C:\Windows\System\WcJUQIK.exe
  C:\Windows\System\WcJUQIK.exe
  2⤵
  PID:14288
- C:\Windows\System\FNydUlw.exe
  C:\Windows\System\FNydUlw.exe
  2⤵
  PID:14308
- C:\Windows\System\SsDTWUg.exe
  C:\Windows\System\SsDTWUg.exe
  2⤵
  PID:14328
- C:\Windows\System\OyIwtfi.exe
  C:\Windows\System\OyIwtfi.exe
  2⤵
  PID:10244
- C:\Windows\System\tBdCIKg.exe
  C:\Windows\System\tBdCIKg.exe
  2⤵
  PID:8920
- C:\Windows\System\BQApBDe.exe
  C:\Windows\System\BQApBDe.exe
  2⤵
  PID:10284
- C:\Windows\System\nFELpUn.exe
  C:\Windows\System\nFELpUn.exe
  2⤵
  PID:11456
- C:\Windows\System\NHiOYiz.exe
  C:\Windows\System\NHiOYiz.exe
  2⤵
  PID:11556
- C:\Windows\System\dDHJSNe.exe
  C:\Windows\System\dDHJSNe.exe
  2⤵
  PID:9440
- C:\Windows\System\PDtGHpq.exe
  C:\Windows\System\PDtGHpq.exe
  2⤵
  PID:11772
- C:\Windows\System\XRBndnD.exe
  C:\Windows\System\XRBndnD.exe
  2⤵
  PID:9568
- C:\Windows\System\pPERXVS.exe
  C:\Windows\System\pPERXVS.exe
  2⤵
  PID:10604
- C:\Windows\System\voalStg.exe
  C:\Windows\System\voalStg.exe
  2⤵
  PID:10632
- C:\Windows\System\azbmSHM.exe
  C:\Windows\System\azbmSHM.exe
  2⤵
  PID:9672
- C:\Windows\System\hcNSILB.exe
  C:\Windows\System\hcNSILB.exe
  2⤵
  PID:9716
- C:\Windows\System\Fachxyq.exe
  C:\Windows\System\Fachxyq.exe
  2⤵
  PID:12024
- C:\Windows\System\fgIArCb.exe
  C:\Windows\System\fgIArCb.exe
  2⤵
  PID:10792
- C:\Windows\System\HMpOjYo.exe
  C:\Windows\System\HMpOjYo.exe
  2⤵
  PID:12160
- C:\Windows\System\bpxNyAR.exe
  C:\Windows\System\bpxNyAR.exe
  2⤵
  PID:10892
- C:\Windows\System\zcLGgQI.exe
  C:\Windows\System\zcLGgQI.exe
  2⤵
  PID:11068
- C:\Windows\System\CFiSeuA.exe
  C:\Windows\System\CFiSeuA.exe
  2⤵
  PID:12072
- C:\Windows\System\lcttbyg.exe
  C:\Windows\System\lcttbyg.exe
  2⤵
  PID:11872

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv /5WeS0A5NEez3nvjn9e1zA.0.1
1⤵
PID:10248

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:12460

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:14308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AMFOjie.exe

Filesize
1.4MB

MD5
baaafa366df4a57617fe16ef7cc84edb

SHA1
6aed5407e431d2bb98240e00b91e8607ff1a23eb

SHA256
4ecbb46589d150335a1ef854f0a3fc29cb5d301b8046d907b75161a2f1047d52

SHA512
cd4c5bbde16a450ab9a531f20b9e5106aae75cd5f0854b04005958b098fd3fd09a7c1d32658c15b1774d2747fd5c0f44e31b0778f37da0a7cc5b9fd1a80bda04

Download Submit
C:\Windows\System\BCENMaA.exe

Filesize
1.4MB

MD5
f9d5c29be4414253ea41d83fdcecf8f2

SHA1
18c5efb9914480f8e24b414e07a840fc62a72fdc

SHA256
32d8f5a1f1b5ba96a234261d73b32510067e310c9cde827bf952ec3d858931cb

SHA512
b870e6425b536e1eb39a8ddd59557aad915b4337cb4ac0649faab5ff693afe47cda27161afb40d7512648a46ca5cc013098bf44f50a49ee499904436d5a509d7

Download Submit
C:\Windows\System\CCykkFF.exe

Filesize
1.4MB

MD5
ac68313c931bd755fb0a5fa0fdb63374

SHA1
21e60f635c5d176908048278e54ac0952d0a8076

SHA256
efcb9b661ee4a6d28cc49643c3fd62a401a20bc604d2fc3cc6e66557ef128801

SHA512
1cdb4e3f27f490f7f80aa037dcf191be1765ef0dcddd382214282a4e825894cdc70aa0935010aee94f1af2b29848f328b4fc21c45cd28f9b91d596e2d0c5e0d8

Download Submit
C:\Windows\System\CrcFavk.exe

Filesize
1.4MB

MD5
3b6675214a0abd99c39dfc770c364827

SHA1
ae25470fe26a4eaf51bdb56be09a24243cff64c0

SHA256
32bbc76e70b37ec30fc71b2f9fe2ad62d9f3e5388c8ec9673213e8760f08cdd9

SHA512
08e651d62d8fd5f4025994ddd8cfc0b314b95c17368b2dfc6deffa6e1e1e206d1940309123761d454ea80109f469e5d66513a44570bd8d94d92c2d77e5151d9d

Download Submit
C:\Windows\System\GVCtBZz.exe

Filesize
1.4MB

MD5
86a7540747f4fc4ed89dc496810321c1

SHA1
d793a8b784a6ff8b5e7b524aa74a8b7709b17780

SHA256
7b7fc0747e127f639fd4cc907b35eafce34664f062509238cd6fc360cc6f8834

SHA512
5d0137d19cb9d3fbb6461e8bb61c8cb8cb4816118e64272bd0ff619e833df0c46f99ac3090046ef9b2b570eac417fff71ed74e705a1f49971f6c78faf5e69548

Download Submit
C:\Windows\System\HUaMcAR.exe

Filesize
1.4MB

MD5
8bc3697419495c620ad3363adc013078

SHA1
d5ba7bac36564ae6bd2c6c7c471e9061cc21883d

SHA256
4430f5de6e3072b144e385864028b90ea93bf23760a0c0029ddd1ae6c296b530

SHA512
c8f456cc88a6223c93211482ad349c63892c0eb9f0581f15f0ee87192fc0f5d871afd5a69e144828b1440ae7d03a37bc859dbc91ad65100ad383a90c1bf0c342

Download Submit
C:\Windows\System\HfkLyeX.exe

Filesize
1.4MB

MD5
e72c8ec540253de082b063f4e3e8813b

SHA1
fcc4f768fa6748468318519acf10fb5e6ec7d369

SHA256
1f34532f3742b634cbf8fe8f5620865c5e8772c20fafdae6162da02c6af0d5e8

SHA512
f86d8ff25057d006a6d6d051e5a43677ef66fb9c03db3bacc2e1b79f0c0b0658b9021268fdca34ede60ecc3b21f6d55d5acd1133940d522f951771862fc13e19

Download Submit
C:\Windows\System\IipIeeM.exe

Filesize
1.4MB

MD5
8f3ac0c05998e3565b45da72a5129a98

SHA1
b07446d5ef311d771c66fbd3d8b15c2ec8c57e54

SHA256
8e29274020b1c95e4fc8603ed0bdd0ece040b1d82f0df5eec3efd5c4919cffbd

SHA512
095e5e4a5a5caf5d44712772e0e48d49d37323e9c7e220a7cf04ff7b07f37a721dfbe48c0fd95917fc349aff8dce1cf17278b16b7a6b7e4d24f344853a26fc42

Download Submit
C:\Windows\System\JMZJZkG.exe

Filesize
1.4MB

MD5
5717c50e6f04337ec7978ecea4ee23a0

SHA1
523267290310e1cf5f11e07cb56c32d7f0933f35

SHA256
00ad8980453fbe03ff29f5233b0d1893fadc2dc2f7f5eddd0ffcbf4ad4a37e2e

SHA512
f49e0a256a96d7be6ba8cb66ea5c8c6be8f9cecde310e98736cca05b2d961ead4ea33c48e6d1976fd8fa4dc320c270757fd85f41c79e0b6e2dcf6810bc48889e

Download Submit
C:\Windows\System\NscAfPV.exe

Filesize
1.4MB

MD5
c024fee44d4d667f67fc86305edbbcfa

SHA1
d09b1969c0d3431f1fa19dd75839583cc4195772

SHA256
1ed25def0141e70035b7e48c8e8a237b1b1011ff9c1cd1167bad822d5f836ecb

SHA512
d9f855314862fe0023cfaf93ac5162d1d61d32051f7f0dd41689c8406ed29c229d19d5b63557f135aaf73ad847b16610edfcd141d87514b4f229fa7b0f07e339

Download Submit
C:\Windows\System\PtUnEmD.exe

Filesize
1.4MB

MD5
cefbc5daac84bb7b540bc48239e0114e

SHA1
45b0cf238ee6bd68388a3eec853f7e8365ce13fd

SHA256
883c7f8a222dd63f54a1b04de6a8e2103c7a5573141e2f2fc2bcecdb629848aa

SHA512
e5209d7bbc67d39914265dccfadaa9e7cf7e9a0ff6490dc4bfffce64ed75eccf709fafb63c771462b78562a9c50632c0e402fc683f328aabb9d07655310233bd

Download Submit
C:\Windows\System\QJujxiP.exe

Filesize
1.4MB

MD5
2087732dd2196f4fa964e6991ce8983d

SHA1
02798c1314e8a25a7eaf8bdc99d533bd04453286

SHA256
e1ae5799b878f1bdb05bf825ce61da73995ccd4301b4f30c66e19e61131ab4ca

SHA512
4d6024844c68c695a284e8c6caf43be6f3ce40cdce5a4ba65a588fc609a4adde0178e42ddc1e532ab9db6192f4420e5487a4badc4008158f7762bedf903dafcd

Download Submit
C:\Windows\System\QaZpBNY.exe

Filesize
1.4MB

MD5
ded6667810a1e216e3c7762319454b68

SHA1
b453554239ef62a75ec91ece4a0cf685f6a064fd

SHA256
9ce325933ef4718b5535a35c9f84f94b558e84ad76d04745f5092cb9bdeaa63b

SHA512
66407a66ea23ef605f993ee7dc05b145e91bda3c5b92db0c7bf6b37cdfb5cdc9bd8d9f6ae661954ef54b27e0a74f182e4a50fc256f36953214b38c3abf0fb127

Download Submit
C:\Windows\System\UCpzvLv.exe

Filesize
1.4MB

MD5
07b60926ec0ef67df3fd4f4999130879

SHA1
739855416c37f7f4ed6700fce323210205c17bee

SHA256
39095009875d1e273806ee7e2b3530454e65234f0077de8e4af51adc267653c5

SHA512
652ff741c269301d05f44b41657f14e56cdf44b5ae950e2d3de670b4f7104ca4d0cbc2a8971c4133d8db628f2a8173907e7763fb64a2fbddeb905acdfb854849

Download Submit
C:\Windows\System\UzKmwAA.exe

Filesize
1.4MB

MD5
ec3e099b508d22e051f1585146545ace

SHA1
971bde49c0502a3783873d2200947049cb45e7f8

SHA256
7590161bac7188c1370aa1ddf605b588817b2a5d4801068fb20fe39911bbaeb2

SHA512
221fa4b4147acaa9064ab0d251ffda2a580301e671fe40a6466bf9c0559f54f93a8b266a5be3db8b043dc9be2b132c654e2c09037ea1af5834084c31cc72c2f3

Download Submit
C:\Windows\System\VDibBTW.exe

Filesize
1.4MB

MD5
7fc7ff99596b1cc1a8e721fb86202169

SHA1
823378d08d3e5a9f0addf9beecd109f78e790b88

SHA256
8247930ff90eed8af9ffcddd65c3d388d3494a4f54300504668a34cccb8b059a

SHA512
f03c7eb87539cb8f5eb6c6c139478493dcbe2fdb9bf7bf6c17c0da7f67f2cf487327b5abb37390fbc3507d65dc32f08f6268b69900ead724786f9ea78b7f4b71

Download Submit
C:\Windows\System\WmuZxYE.exe

Filesize
1.4MB

MD5
7b715b26746310284877ad9baa1e6168

SHA1
8144c55787bc37da30b512642ee9efd77c56e7b9

SHA256
1fc41be8948440010b6402fc8584b97a6321f0c95260dd09faeb808bb1e07d96

SHA512
10feccc1d4b029161c8583d2815a424a5e2e45bd41b95e17778b054cf0ce0a31cdba71deb9bbcc4158ff2b6f2b53c32326e03623281f2f9b1056364bc134f35a

Download Submit
C:\Windows\System\XJFqhaW.exe

Filesize
1.4MB

MD5
04562041f2d3bc4e989019a7d5072b1b

SHA1
822a949cfb2aa501641e8c000cd1ad02003098c8

SHA256
b40cdd3435bee726459af8b99422b661db2f7b69f6086bd75b0fbe836669ed17

SHA512
bdf9a5eea667cba2776d07dbb4e1c573a1e6ced105e4deda28c1d7560d1eaaafb240bcb3ac9564b7372cd6a93233f1742ed4a5786bf2dfd7ba5f2b43b224b614

Download Submit
C:\Windows\System\XawBxDG.exe

Filesize
1.4MB

MD5
34086e797d566bd7201e027a4d8e008c

SHA1
ccc6a86cbc70d5d84b55aaa7e574d7e216fe5840

SHA256
692c3f47cb0c0dc5fc38b315f58eb11cf44c1e8ee4908681836f862f7c57b588

SHA512
6d41317fb4cf9d0c23a1206641c44aa1e3693ff3440ba72efe2e1a863fcff60bf4bdd938b1e828733c8d760df6e742866598a8b1d6adcb2c86a28ddb96c708c4

Download Submit
C:\Windows\System\YGfHcDq.exe

Filesize
1.4MB

MD5
d1fcf616e12013e8a944b585cf46a882

SHA1
69357a62266c8e7aad14b41a0aa4b6e82e8a5673

SHA256
0033910b19a9e01a5d02eebc684dc0f68d389e800cf61206a9822afaf03c9556

SHA512
ff8682c013b7b7bf5b7084057e4a783c0cfbebdec2ff119044341bc075b37d8280d92e00f115b97873e46263b55c3907e042e90edca94769c3b3dbe064c1a58b

Download Submit
C:\Windows\System\ZtXkkpx.exe

Filesize
1.4MB

MD5
48b8ce244dd36d2d5111c50fa8c11122

SHA1
d86082d00881e8f5bb356ad3bfebaaea76c99f62

SHA256
a45e42a875bad606bbffbb2f9ee1d2fc3e9ec5d0555c286233231a8298da646e

SHA512
03b299facb06daed05bf14256c5bc1fcbce848c7f28856fd06f86e0770f32b3f8bf07a42816845516bad64c6c6de1d57b6d9115df553dc6c472b0fddb411080f

Download Submit
C:\Windows\System\bPRbaim.exe

Filesize
1.4MB

MD5
b79acf43a089cd3f8d991e1990f82c74

SHA1
bac32eb631f9b10714d76d989da67e2e79c3f407

SHA256
d3b087619cdbfca22ef34316ae4220c7ad7aa2f9140aa1d386f88a6f1544368b

SHA512
714a3a835ee4380a945183965dcb71a811ac7b5b9ed215b57c4941abc5398b15fb9cd5d46317dc9185593e3f2dd4e4dc1aabdb347b230ff0e6f4f66b06559832

Download Submit
C:\Windows\System\bPjGExQ.exe

Filesize
1.4MB

MD5
0bb225f09a04d5ba081124541a251fb0

SHA1
2c43bce26cb2332cd31f7ce9097d273c145b0c86

SHA256
82a7033ccc960778c097f46660dd95c022df312cb684e86d851dc523f7b7c6fb

SHA512
28290cf7e018430fcf22b21d7c9c5c56edeb711bbb057c993031b63476f6fe01898f05aecdce762e4a6a11d636ea467b8286d9d700a333c9220db873d5136847

Download Submit
C:\Windows\System\chvozBh.exe

Filesize
1.4MB

MD5
5a71a0edcdf5dac47124625d7b382000

SHA1
7f87ac640e8b307ff212ee27b5c92363b2299b89

SHA256
a8782d73908eece13ebeac4c2c3b9c94a012815fbaa0defaaca030d80fc29a6f

SHA512
aea0dff2c670d1233eb858ac11d2de2aecb3979954cbe19942a058882f73fac823f308c1fddab7a9119c5cfb42f989403ef301ae03c8576372a0604fe6ed44d4

Download Submit
C:\Windows\System\ehEuUqm.exe

Filesize
1.4MB

MD5
4f39b75fd1700c6edf46483bb7835aa5

SHA1
d6e396448518d8f62c795d9c85a6cc64e0450b88

SHA256
50e7efbe81f35cfac92684a81054722ea81e6c6669f8310a0da5b770e9193a07

SHA512
d8b51e91fe1394f62e0d87bd34cf22e2884d9a1436b4e9cfc04de8e635320067d4bb79b98774938a2e5852da5199d19e8b20530f1bad178575f9313650581f24

Download Submit
C:\Windows\System\ffFTxmF.exe

Filesize
1.4MB

MD5
983993362d9c25311b6280e788b482d3

SHA1
600d3ed4545e60b7c197760ae26bd8a81d1c7b95

SHA256
702100e7fa44ead74cfdd65d4811c2791ab113cccdce9fb6127db1c245b3054d

SHA512
97dd313684eaf0d1cf8b8b288c89f7f29c49f77c3db10e22bb6868af1e0f3a22109a8f5ec23da3c199a77684785b939b645200a66892489df0cc39a7e8550266

Download Submit
C:\Windows\System\iegQVyi.exe

Filesize
1.4MB

MD5
1c24885972e886a269f08c6cc53feac3

SHA1
70ea18dfb99a3b2d0a40054623a06aa676883bc1

SHA256
a57bf23095a00a4b572d9fd4cbc3291aeb1433f92d144a60ff0c1ae18b7c15ad

SHA512
c3ebfd40aa7776cec6b7381f23116077ea7a508d38060850515c94b0d861dc3b79e9c7b2d523b6cf1e9a8e98fe684a2dfaf13e0f626aac1b9629026a41785d46

Download Submit
C:\Windows\System\jganePM.exe

Filesize
1.4MB

MD5
deb87282767a874fd9f82e112d39add5

SHA1
14a3ef96e3095bee856ede89ee46f51c2184f842

SHA256
53b2d180961e59f8ef33dd3a20827b7345bb0eb2eb70c4b82234d53c2815fa37

SHA512
887498aadf763249b93cf494a6bd3e5c464a4fa86f6f64ba3a810c69bee6bf6515a1ef96571dd6ecbe21a4a8602968eb230bd1a91ad7f56be803f86f54dc1070

Download Submit
C:\Windows\System\mQOGBci.exe

Filesize
1.4MB

MD5
17ecfdac9979e35405f50638509f4957

SHA1
56bbbbdc38e9f485333a038f22b8b60c75b1ea28

SHA256
bde8d63a058ab0ad22aa4e6821d55e4216efaf9d15598dac167114ceda8c6dab

SHA512
9fc31660e1482c62cb6b1885b2b2cc38f12b45da732c6d23bde2f29c8b300f9879c97e3c030c5b897e338b6dc6225bdb32517b2e499e7fb76c8d13e567584fd9

Download Submit
C:\Windows\System\oYXOPZj.exe

Filesize
1.4MB

MD5
f94217df75db35438ce73200c4d852b7

SHA1
811728c4cea178a6b7f452fe39eea055146ea463

SHA256
15f49a9ab63af4a0f6c498f31dda86ef8c48ad666eeae4f9cca52c6565a234e0

SHA512
dbe8c575d72a6bccbfcd895e1af44f4d138126b2809200fd99205da90bf529e7525ccd54cf0eee4e200cb615f3cf813242375a5c8d7a0bb50737e6e46e4c4267

Download Submit
C:\Windows\System\oevkBaO.exe

Filesize
1.4MB

MD5
48259d8485ae4366215cecb629486622

SHA1
d85ec1adaf2d6e21765a4e124b4fb22395fb7c01

SHA256
dc9d74c89b4b942a085dbc9a5bbd5f692093284dd6b31aa815c2713bdc5e9732

SHA512
cefc8cf81413f40827931c64f5da8bae91cfd7c9122b7740738ec39de1c5d1caa79d43191382b7dfd4830bf9de414a88db801652b686435f3b6f9c47b49d9784

Download Submit
C:\Windows\System\perpAWa.exe

Filesize
1.4MB

MD5
fd8f161afb6350e5454baadfa5cd22d5

SHA1
6c5d602dafae2d71790b99b78bfd0a615f6a57db

SHA256
2f548548b5b8840dc1513f6cd946945e856330f5e66196573da277536d997e7e

SHA512
165fa0af07142e2f6c6d067d4daab072195d9a44f37e76923e7702d68f386a8269b4bf41f23b161dcf637575614f2ca3f32504ea4b46c65ab97d7acfe80a58a7

Download Submit
C:\Windows\System\psXToys.exe

Filesize
1.4MB

MD5
2ca2b85dfad3c494b549ce4f2a767647

SHA1
af9daa7164abeb81cb3132d00450de6fc6975349

SHA256
6a79d5efd54b6dba13aa919c26866d692b66120c67f5146f669a3858a081f542

SHA512
6493ca023e8eb46027bdd566f067ac8e5b8f400c454f33ace78ac6623bef4fd9b8f23079310cff9ea03324f6baf2f1795d078555588195a926071e08d673abe0

Download Submit
C:\Windows\System\rYlfpVJ.exe

Filesize
1.4MB

MD5
9252d370065defdbbf89db9cf7e06207

SHA1
d7b1b602fc896a09522defa7361149d0c05e39d8

SHA256
db1b82758e8986397712c4e2c566ef5384651388b9f59ffd8ab0b79c3153de09

SHA512
548c7b26ffa8bf69d5723a0067447e11759d5238dfbf2252ecfcb1858781bbaf96e2aea21e17962d4181ca5f15fb3d1d010fe216661fed4ee901a297b7ff8c25

Download Submit
C:\Windows\System\xWTDMSm.exe

Filesize
1.4MB

MD5
790cbc1f64edf06da792e2dbd0722f64

SHA1
9b59067a0201944750a0afabd78d037ae637dd42

SHA256
7a3ef4176516e4e44fc0773dc6d471ff434800af1e8ac63cef49de654eeb11de

SHA512
f932cc0fc752ba1ebb8f82a64fc5ff65cbb2ec2f5143e0ae9f6af5553263e6e7e28af0c3ec2e5fcd206f79f8d60f32a95081afd7a261659492d6a269a0bbeb85

Download Submit
C:\Windows\System\ysxXRff.exe

Filesize
1.4MB

MD5
f42e1815db03d3af8d0dff3ba4eb48cc

SHA1
a19f3f6da0ae0041bb30b4fe0ddd904da3d3085d

SHA256
f4907c159dce89e7a6b37e48c3567dd24b6b780842c5c39851e1e76a5d2bb48b

SHA512
5b966b93a47b13acc8e57ad3b87fcb7065b3f24b5bb1c0e848f51c8a1d2b174a5895e6afc1a025a6aad9ec7dd16b6d0cc9d2ba2e90d3767e6b2534af12346bbf

Download Submit
memory/436-266-0x00007FF6B6480000-0x00007FF6B67D1000-memory.dmp

Filesize
3.3MB

Download
memory/436-2328-0x00007FF6B6480000-0x00007FF6B67D1000-memory.dmp

Filesize
3.3MB

Download
memory/520-2304-0x00007FF714910000-0x00007FF714C61000-memory.dmp

Filesize
3.3MB

Download
memory/520-277-0x00007FF714910000-0x00007FF714C61000-memory.dmp

Filesize
3.3MB

Download
memory/668-20-0x00007FF746120000-0x00007FF746471000-memory.dmp

Filesize
3.3MB

Download
memory/668-2280-0x00007FF746120000-0x00007FF746471000-memory.dmp

Filesize
3.3MB

Download
memory/852-2337-0x00007FF6D2090000-0x00007FF6D23E1000-memory.dmp

Filesize
3.3MB

Download
memory/852-269-0x00007FF6D2090000-0x00007FF6D23E1000-memory.dmp

Filesize
3.3MB

Download
memory/932-2318-0x00007FF7C4680000-0x00007FF7C49D1000-memory.dmp

Filesize
3.3MB

Download
memory/932-256-0x00007FF7C4680000-0x00007FF7C49D1000-memory.dmp

Filesize
3.3MB

Download
memory/1032-2331-0x00007FF6F8A90000-0x00007FF6F8DE1000-memory.dmp

Filesize
3.3MB

Download
memory/1032-274-0x00007FF6F8A90000-0x00007FF6F8DE1000-memory.dmp

Filesize
3.3MB

Download
memory/1344-278-0x00007FF7D35B0000-0x00007FF7D3901000-memory.dmp

Filesize
3.3MB

Download
memory/1344-2310-0x00007FF7D35B0000-0x00007FF7D3901000-memory.dmp

Filesize
3.3MB

Download
memory/1416-272-0x00007FF6EBE50000-0x00007FF6EC1A1000-memory.dmp

Filesize
3.3MB

Download
memory/1416-2347-0x00007FF6EBE50000-0x00007FF6EC1A1000-memory.dmp

Filesize
3.3MB

Download
memory/1524-264-0x00007FF628670000-0x00007FF6289C1000-memory.dmp

Filesize
3.3MB

Download
memory/1524-2335-0x00007FF628670000-0x00007FF6289C1000-memory.dmp

Filesize
3.3MB

Download
memory/1624-267-0x00007FF731800000-0x00007FF731B51000-memory.dmp

Filesize
3.3MB

Download
memory/1624-2301-0x00007FF731800000-0x00007FF731B51000-memory.dmp

Filesize
3.3MB

Download
memory/1632-265-0x00007FF789090000-0x00007FF7893E1000-memory.dmp

Filesize
3.3MB

Download
memory/1632-2296-0x00007FF789090000-0x00007FF7893E1000-memory.dmp

Filesize
3.3MB

Download
memory/1656-279-0x00007FF6CE260000-0x00007FF6CE5B1000-memory.dmp

Filesize
3.3MB

Download
memory/1656-2290-0x00007FF6CE260000-0x00007FF6CE5B1000-memory.dmp

Filesize
3.3MB

Download
memory/2172-275-0x00007FF619620000-0x00007FF619971000-memory.dmp

Filesize
3.3MB

Download
memory/2172-2308-0x00007FF619620000-0x00007FF619971000-memory.dmp

Filesize
3.3MB

Download
memory/2192-280-0x00007FF7AFCA0000-0x00007FF7AFFF1000-memory.dmp

Filesize
3.3MB

Download
memory/2192-2323-0x00007FF7AFCA0000-0x00007FF7AFFF1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-2294-0x00007FF6BE8B0000-0x00007FF6BEC01000-memory.dmp

Filesize
3.3MB

Download
memory/2400-271-0x00007FF6BE8B0000-0x00007FF6BEC01000-memory.dmp

Filesize
3.3MB

Download
memory/2568-273-0x00007FF6E10D0000-0x00007FF6E1421000-memory.dmp

Filesize
3.3MB

Download
memory/2568-2306-0x00007FF6E10D0000-0x00007FF6E1421000-memory.dmp

Filesize
3.3MB

Download
memory/2868-43-0x00007FF6E0000000-0x00007FF6E0351000-memory.dmp

Filesize
3.3MB

Download
memory/2868-2320-0x00007FF6E0000000-0x00007FF6E0351000-memory.dmp

Filesize
3.3MB

Download
memory/3024-148-0x00007FF6D3C10000-0x00007FF6D3F61000-memory.dmp

Filesize
3.3MB

Download
memory/3024-2284-0x00007FF6D3C10000-0x00007FF6D3F61000-memory.dmp

Filesize
3.3MB

Download
memory/3068-226-0x00007FF7F32E0000-0x00007FF7F3631000-memory.dmp

Filesize
3.3MB

Download
memory/3068-2292-0x00007FF7F32E0000-0x00007FF7F3631000-memory.dmp

Filesize
3.3MB

Download
memory/3168-281-0x00007FF7B9770000-0x00007FF7B9AC1000-memory.dmp

Filesize
3.3MB

Download
memory/3168-2302-0x00007FF7B9770000-0x00007FF7B9AC1000-memory.dmp

Filesize
3.3MB

Download
memory/3328-2314-0x00007FF626140000-0x00007FF626491000-memory.dmp

Filesize
3.3MB

Download
memory/3328-207-0x00007FF626140000-0x00007FF626491000-memory.dmp

Filesize
3.3MB

Download
memory/3808-2282-0x00007FF6702C0000-0x00007FF670611000-memory.dmp

Filesize
3.3MB

Download
memory/3808-218-0x00007FF6702C0000-0x00007FF670611000-memory.dmp

Filesize
3.3MB

Download
memory/3876-2322-0x00007FF6B8AD0000-0x00007FF6B8E21000-memory.dmp

Filesize
3.3MB

Download
memory/3876-282-0x00007FF6B8AD0000-0x00007FF6B8E21000-memory.dmp

Filesize
3.3MB

Download
memory/3940-2145-0x00007FF61E2F0000-0x00007FF61E641000-memory.dmp

Filesize
3.3MB

Download
memory/3940-1-0x00000280FBE30000-0x00000280FBE40000-memory.dmp

Filesize
64KB

Download
memory/3940-0-0x00007FF61E2F0000-0x00007FF61E641000-memory.dmp

Filesize
3.3MB

Download
memory/3980-2286-0x00007FF6EED60000-0x00007FF6EF0B1000-memory.dmp

Filesize
3.3MB

Download
memory/3980-83-0x00007FF6EED60000-0x00007FF6EF0B1000-memory.dmp

Filesize
3.3MB

Download
memory/4168-76-0x00007FF659540000-0x00007FF659891000-memory.dmp

Filesize
3.3MB

Download
memory/4168-2312-0x00007FF659540000-0x00007FF659891000-memory.dmp

Filesize
3.3MB

Download
memory/4272-268-0x00007FF618310000-0x00007FF618661000-memory.dmp

Filesize
3.3MB

Download
memory/4272-2327-0x00007FF618310000-0x00007FF618661000-memory.dmp

Filesize
3.3MB

Download
memory/4456-2316-0x00007FF7F8910000-0x00007FF7F8C61000-memory.dmp

Filesize
3.3MB

Download
memory/4456-263-0x00007FF7F8910000-0x00007FF7F8C61000-memory.dmp

Filesize
3.3MB

Download
memory/4680-270-0x00007FF6BA8F0000-0x00007FF6BAC41000-memory.dmp

Filesize
3.3MB

Download
memory/4680-2289-0x00007FF6BA8F0000-0x00007FF6BAC41000-memory.dmp

Filesize
3.3MB

Download
memory/4948-276-0x00007FF6D3380000-0x00007FF6D36D1000-memory.dmp

Filesize
3.3MB

Download
memory/4948-2334-0x00007FF6D3380000-0x00007FF6D36D1000-memory.dmp

Filesize
3.3MB

Download