xmrig | 148e5d7f6d9956de7a0074a2844ed613a17efe6d3d81dcf495c6ae3ba953ceea

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
Size

2.1MB
MD5

87c4ffa459142ab6be0129ac1ee34090
SHA1

ccc5d4ac395423eb6ae502c2592ff5607cdffb31
SHA256

148e5d7f6d9956de7a0074a2844ed613a17efe6d3d81dcf495c6ae3ba953ceea
SHA512

96fa05b4de0ea79fcab05b85ba59a35d605295910e0956326afe6fb76c08c8113d466a122291c48f0b3ee3588384b873802ed8cfdb970e91b5232dd29fb74552
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXGv4rzq6c2HA63RXCa:BemTLkNdfE0pZrf

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4596-0-0x00007FF6F7010000-0x00007FF6F7364000-memory.dmp	xmrig
behavioral2/files/0x000f000000023230-5.dat	xmrig
behavioral2/memory/1304-8-0x00007FF7127A0000-0x00007FF712AF4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023245-11.dat	xmrig
behavioral2/files/0x0007000000023246-10.dat	xmrig
behavioral2/memory/3852-17-0x00007FF6937F0000-0x00007FF693B44000-memory.dmp	xmrig
behavioral2/files/0x0008000000023243-24.dat	xmrig
behavioral2/memory/5032-26-0x00007FF7F89C0000-0x00007FF7F8D14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023248-39.dat	xmrig
behavioral2/files/0x0007000000023249-41.dat	xmrig
behavioral2/memory/1568-42-0x00007FF6F5980000-0x00007FF6F5CD4000-memory.dmp	xmrig
behavioral2/memory/4848-38-0x00007FF6BEAB0000-0x00007FF6BEE04000-memory.dmp	xmrig
behavioral2/memory/496-32-0x00007FF77A980000-0x00007FF77ACD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023247-30.dat	xmrig
behavioral2/memory/4584-27-0x00007FF68F4F0000-0x00007FF68F844000-memory.dmp	xmrig
behavioral2/files/0x000700000002324a-48.dat	xmrig
behavioral2/memory/4636-50-0x00007FF6335F0000-0x00007FF633944000-memory.dmp	xmrig
behavioral2/files/0x000700000002324b-54.dat	xmrig
behavioral2/files/0x000700000002324d-62.dat	xmrig
behavioral2/files/0x000700000002324f-66.dat	xmrig
behavioral2/memory/336-72-0x00007FF71E750000-0x00007FF71EAA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023251-78.dat	xmrig
behavioral2/files/0x0007000000023250-81.dat	xmrig
behavioral2/memory/3928-83-0x00007FF7CDB40000-0x00007FF7CDE94000-memory.dmp	xmrig
behavioral2/memory/4344-84-0x00007FF7D7A40000-0x00007FF7D7D94000-memory.dmp	xmrig
behavioral2/memory/2300-82-0x00007FF7B4D40000-0x00007FF7B5094000-memory.dmp	xmrig
behavioral2/memory/4596-79-0x00007FF6F7010000-0x00007FF6F7364000-memory.dmp	xmrig
behavioral2/memory/4784-77-0x00007FF7D4DB0000-0x00007FF7D5104000-memory.dmp	xmrig
behavioral2/files/0x000700000002324c-64.dat	xmrig
behavioral2/memory/1936-60-0x00007FF6BD840000-0x00007FF6BDB94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023252-90.dat	xmrig
behavioral2/files/0x0007000000023253-97.dat	xmrig
behavioral2/memory/3852-100-0x00007FF6937F0000-0x00007FF693B44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023254-102.dat	xmrig
behavioral2/files/0x0007000000023255-107.dat	xmrig
behavioral2/files/0x0007000000023256-113.dat	xmrig
behavioral2/files/0x0007000000023257-117.dat	xmrig
behavioral2/files/0x0007000000023258-119.dat	xmrig
behavioral2/memory/5084-120-0x00007FF762040000-0x00007FF762394000-memory.dmp	xmrig
behavioral2/memory/2516-134-0x00007FF70D5E0000-0x00007FF70D934000-memory.dmp	xmrig
behavioral2/files/0x0007000000023259-137.dat	xmrig
behavioral2/memory/4904-141-0x00007FF76E130000-0x00007FF76E484000-memory.dmp	xmrig
behavioral2/memory/3516-144-0x00007FF771A10000-0x00007FF771D64000-memory.dmp	xmrig
behavioral2/memory/496-145-0x00007FF77A980000-0x00007FF77ACD4000-memory.dmp	xmrig
behavioral2/memory/404-143-0x00007FF6A4B70000-0x00007FF6A4EC4000-memory.dmp	xmrig
behavioral2/memory/4584-142-0x00007FF68F4F0000-0x00007FF68F844000-memory.dmp	xmrig
behavioral2/files/0x000700000002325a-139.dat	xmrig
behavioral2/memory/4208-136-0x00007FF751910000-0x00007FF751C64000-memory.dmp	xmrig
behavioral2/memory/4504-135-0x00007FF701390000-0x00007FF7016E4000-memory.dmp	xmrig
behavioral2/memory/5032-131-0x00007FF7F89C0000-0x00007FF7F8D14000-memory.dmp	xmrig
behavioral2/memory/2776-125-0x00007FF7495F0000-0x00007FF749944000-memory.dmp	xmrig
behavioral2/memory/4740-122-0x00007FF656E30000-0x00007FF657184000-memory.dmp	xmrig
behavioral2/memory/1304-96-0x00007FF7127A0000-0x00007FF712AF4000-memory.dmp	xmrig
behavioral2/files/0x000700000002325b-149.dat	xmrig
behavioral2/files/0x000700000002325c-152.dat	xmrig
behavioral2/files/0x000700000002325d-162.dat	xmrig
behavioral2/files/0x0007000000023262-176.dat	xmrig
behavioral2/memory/4848-180-0x00007FF6BEAB0000-0x00007FF6BEE04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023261-186.dat	xmrig
behavioral2/files/0x0007000000023263-193.dat	xmrig
behavioral2/files/0x0007000000023265-197.dat	xmrig
behavioral2/memory/5088-199-0x00007FF792F90000-0x00007FF7932E4000-memory.dmp	xmrig
behavioral2/memory/392-198-0x00007FF63DAD0000-0x00007FF63DE24000-memory.dmp	xmrig
behavioral2/memory/4792-196-0x00007FF651790000-0x00007FF651AE4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1304	PDwUeJL.exe
3852	YPOBtBC.exe
5032	XRzgPhH.exe
496	XZwaBGl.exe
4584	xCkcXqa.exe
4848	ndnpFdz.exe
1568	NFGKKOF.exe
4636	BFrmbIn.exe
1936	pmqDamI.exe
336	ppeRrCQ.exe
4784	vqostiB.exe
2300	KWhfMGj.exe
3928	lQstiHx.exe
4344	OcqSqyC.exe
5084	JEvojSF.exe
2516	QgSiZqC.exe
4504	StYSenl.exe
4208	ROxjGyE.exe
4740	UzShdFB.exe
2776	EyNkHkB.exe
4904	nmIbfMN.exe
3516	cnqlGUe.exe
404	VWRJGPR.exe
2408	KKUNaoY.exe
3184	NDmHQww.exe
1288	WAfBbgE.exe
4792	IwsBqSL.exe
392	SxudkCF.exe
5088	ytkpDbV.exe
4032	LkeSjsV.exe
1944	gDkvDiz.exe
2780	OWMpCbx.exe
3180	qDFcSUW.exe
1748	DUbadXo.exe
1888	YSzKMcQ.exe
2084	gxIWiYo.exe
464	XYfcTJl.exe
1676	JBzZnlb.exe
4284	bRdCDBb.exe
1248	OrUWyiB.exe
4808	stGgVqz.exe
3484	ViwxLTu.exe
4024	BOVFreW.exe
2400	DvvBDri.exe
3088	sLQvfCo.exe
5028	FurfSSQ.exe
1116	thnbVXa.exe
4612	odwqRWd.exe
2208	HlgEVcK.exe
1632	UJIWwws.exe
3856	VrZucIp.exe
4460	KDwoluj.exe
3564	hyyxiTM.exe
1960	kEMMcGY.exe
3016	rMMxsBr.exe
3356	SibKipY.exe
652	tdwqTQp.exe
4420	tlIOtjN.exe
3624	fBDTCca.exe
5100	VdOAaLe.exe
4828	FndBOdb.exe
2980	ewPnJmI.exe
4916	cpZGVtx.exe
224	PgaGyCE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4596-0-0x00007FF6F7010000-0x00007FF6F7364000-memory.dmp	upx
behavioral2/files/0x000f000000023230-5.dat	upx
behavioral2/memory/1304-8-0x00007FF7127A0000-0x00007FF712AF4000-memory.dmp	upx
behavioral2/files/0x0008000000023245-11.dat	upx
behavioral2/files/0x0007000000023246-10.dat	upx
behavioral2/memory/3852-17-0x00007FF6937F0000-0x00007FF693B44000-memory.dmp	upx
behavioral2/files/0x0008000000023243-24.dat	upx
behavioral2/memory/5032-26-0x00007FF7F89C0000-0x00007FF7F8D14000-memory.dmp	upx
behavioral2/files/0x0007000000023248-39.dat	upx
behavioral2/files/0x0007000000023249-41.dat	upx
behavioral2/memory/1568-42-0x00007FF6F5980000-0x00007FF6F5CD4000-memory.dmp	upx
behavioral2/memory/4848-38-0x00007FF6BEAB0000-0x00007FF6BEE04000-memory.dmp	upx
behavioral2/memory/496-32-0x00007FF77A980000-0x00007FF77ACD4000-memory.dmp	upx
behavioral2/files/0x0007000000023247-30.dat	upx
behavioral2/memory/4584-27-0x00007FF68F4F0000-0x00007FF68F844000-memory.dmp	upx
behavioral2/files/0x000700000002324a-48.dat	upx
behavioral2/memory/4636-50-0x00007FF6335F0000-0x00007FF633944000-memory.dmp	upx
behavioral2/files/0x000700000002324b-54.dat	upx
behavioral2/files/0x000700000002324d-62.dat	upx
behavioral2/files/0x000700000002324f-66.dat	upx
behavioral2/memory/336-72-0x00007FF71E750000-0x00007FF71EAA4000-memory.dmp	upx
behavioral2/files/0x0007000000023251-78.dat	upx
behavioral2/files/0x0007000000023250-81.dat	upx
behavioral2/memory/3928-83-0x00007FF7CDB40000-0x00007FF7CDE94000-memory.dmp	upx
behavioral2/memory/4344-84-0x00007FF7D7A40000-0x00007FF7D7D94000-memory.dmp	upx
behavioral2/memory/2300-82-0x00007FF7B4D40000-0x00007FF7B5094000-memory.dmp	upx
behavioral2/memory/4596-79-0x00007FF6F7010000-0x00007FF6F7364000-memory.dmp	upx
behavioral2/memory/4784-77-0x00007FF7D4DB0000-0x00007FF7D5104000-memory.dmp	upx
behavioral2/files/0x000700000002324c-64.dat	upx
behavioral2/memory/1936-60-0x00007FF6BD840000-0x00007FF6BDB94000-memory.dmp	upx
behavioral2/files/0x0007000000023252-90.dat	upx
behavioral2/files/0x0007000000023253-97.dat	upx
behavioral2/memory/3852-100-0x00007FF6937F0000-0x00007FF693B44000-memory.dmp	upx
behavioral2/files/0x0007000000023254-102.dat	upx
behavioral2/files/0x0007000000023255-107.dat	upx
behavioral2/files/0x0007000000023256-113.dat	upx
behavioral2/files/0x0007000000023257-117.dat	upx
behavioral2/files/0x0007000000023258-119.dat	upx
behavioral2/memory/5084-120-0x00007FF762040000-0x00007FF762394000-memory.dmp	upx
behavioral2/memory/2516-134-0x00007FF70D5E0000-0x00007FF70D934000-memory.dmp	upx
behavioral2/files/0x0007000000023259-137.dat	upx
behavioral2/memory/4904-141-0x00007FF76E130000-0x00007FF76E484000-memory.dmp	upx
behavioral2/memory/3516-144-0x00007FF771A10000-0x00007FF771D64000-memory.dmp	upx
behavioral2/memory/496-145-0x00007FF77A980000-0x00007FF77ACD4000-memory.dmp	upx
behavioral2/memory/404-143-0x00007FF6A4B70000-0x00007FF6A4EC4000-memory.dmp	upx
behavioral2/memory/4584-142-0x00007FF68F4F0000-0x00007FF68F844000-memory.dmp	upx
behavioral2/files/0x000700000002325a-139.dat	upx
behavioral2/memory/4208-136-0x00007FF751910000-0x00007FF751C64000-memory.dmp	upx
behavioral2/memory/4504-135-0x00007FF701390000-0x00007FF7016E4000-memory.dmp	upx
behavioral2/memory/5032-131-0x00007FF7F89C0000-0x00007FF7F8D14000-memory.dmp	upx
behavioral2/memory/2776-125-0x00007FF7495F0000-0x00007FF749944000-memory.dmp	upx
behavioral2/memory/4740-122-0x00007FF656E30000-0x00007FF657184000-memory.dmp	upx
behavioral2/memory/1304-96-0x00007FF7127A0000-0x00007FF712AF4000-memory.dmp	upx
behavioral2/files/0x000700000002325b-149.dat	upx
behavioral2/files/0x000700000002325c-152.dat	upx
behavioral2/files/0x000700000002325d-162.dat	upx
behavioral2/files/0x0007000000023262-176.dat	upx
behavioral2/memory/4848-180-0x00007FF6BEAB0000-0x00007FF6BEE04000-memory.dmp	upx
behavioral2/files/0x0007000000023261-186.dat	upx
behavioral2/files/0x0007000000023263-193.dat	upx
behavioral2/files/0x0007000000023265-197.dat	upx
behavioral2/memory/5088-199-0x00007FF792F90000-0x00007FF7932E4000-memory.dmp	upx
behavioral2/memory/392-198-0x00007FF63DAD0000-0x00007FF63DE24000-memory.dmp	upx
behavioral2/memory/4792-196-0x00007FF651790000-0x00007FF651AE4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lpzDeVs.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\BzcAoQS.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\JpTmnCW.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\vAMgVms.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\dZxVpYy.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\pFIanyf.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\INySEWW.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\Obotjhf.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\ESAsvhd.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\USEzBEL.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\jSXCJeI.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\qwQtzfV.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\JTNgOoW.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\muyBSpt.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\TaDqJxK.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\RpcSOZO.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\TuATWIn.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\pZhmrCH.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\VrZucIp.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\LhOWeQv.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\NgEediL.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\NzyGwST.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\axzsSZj.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\MbOXgMP.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\HmncJcA.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\zVESrim.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\qXQchrd.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\erFpOkY.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\TCbUphr.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\IEWnPkn.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\nJtIgWS.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\VeTfKXB.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\DDIRPnC.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\FZmWiwb.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\KBLTcCo.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\nWXkeJb.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\hCVJiWK.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\ntAGKSk.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\BaCYyni.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\XuSJuoW.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\TtTeOXA.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\sHZZqMn.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\dYMtkYp.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\QrzCgej.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\xCVwUMR.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\PeYcvAR.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\oNQgVYn.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\VmCitgX.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\bzjJREQ.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\tPDwvYm.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\DRfZkUB.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\dEnaDOf.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\VVOiPvN.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\oDtIDed.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\EcJHaxQ.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\IphLhTy.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\pmqDamI.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\mFpDZFJ.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\twWNtLp.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\CoWQghe.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\BSFMXMW.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\ALtcRNW.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\oNkWUNj.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
File created	C:\Windows\System\jqQqxGT.exe	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 1304	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	92
PID 4596 wrote to memory of 1304	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	92
PID 4596 wrote to memory of 3852	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	93
PID 4596 wrote to memory of 3852	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	93
PID 4596 wrote to memory of 5032	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	94
PID 4596 wrote to memory of 5032	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	94
PID 4596 wrote to memory of 496	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	95
PID 4596 wrote to memory of 496	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	95
PID 4596 wrote to memory of 4584	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	96
PID 4596 wrote to memory of 4584	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	96
PID 4596 wrote to memory of 4848	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	97
PID 4596 wrote to memory of 4848	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	97
PID 4596 wrote to memory of 1568	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	98
PID 4596 wrote to memory of 1568	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	98
PID 4596 wrote to memory of 4636	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	99
PID 4596 wrote to memory of 4636	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	99
PID 4596 wrote to memory of 1936	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	100
PID 4596 wrote to memory of 1936	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	100
PID 4596 wrote to memory of 336	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	101
PID 4596 wrote to memory of 336	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	101
PID 4596 wrote to memory of 4784	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	102
PID 4596 wrote to memory of 4784	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	102
PID 4596 wrote to memory of 2300	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	103
PID 4596 wrote to memory of 2300	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	103
PID 4596 wrote to memory of 3928	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	104
PID 4596 wrote to memory of 3928	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	104
PID 4596 wrote to memory of 4344	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	105
PID 4596 wrote to memory of 4344	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	105
PID 4596 wrote to memory of 5084	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	106
PID 4596 wrote to memory of 5084	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	106
PID 4596 wrote to memory of 2516	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	107
PID 4596 wrote to memory of 2516	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	107
PID 4596 wrote to memory of 4504	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	108
PID 4596 wrote to memory of 4504	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	108
PID 4596 wrote to memory of 4208	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	109
PID 4596 wrote to memory of 4208	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	109
PID 4596 wrote to memory of 4740	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	110
PID 4596 wrote to memory of 4740	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	110
PID 4596 wrote to memory of 2776	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	111
PID 4596 wrote to memory of 2776	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	111
PID 4596 wrote to memory of 4904	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	112
PID 4596 wrote to memory of 4904	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	112
PID 4596 wrote to memory of 3516	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	113
PID 4596 wrote to memory of 3516	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	113
PID 4596 wrote to memory of 404	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	114
PID 4596 wrote to memory of 404	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	114
PID 4596 wrote to memory of 2408	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	115
PID 4596 wrote to memory of 2408	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	115
PID 4596 wrote to memory of 3184	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	116
PID 4596 wrote to memory of 3184	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	116
PID 4596 wrote to memory of 1288	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	117
PID 4596 wrote to memory of 1288	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	117
PID 4596 wrote to memory of 4792	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	118
PID 4596 wrote to memory of 4792	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	118
PID 4596 wrote to memory of 392	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	119
PID 4596 wrote to memory of 392	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	119
PID 4596 wrote to memory of 5088	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	120
PID 4596 wrote to memory of 5088	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	120
PID 4596 wrote to memory of 4032	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	121
PID 4596 wrote to memory of 4032	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	121
PID 4596 wrote to memory of 1944	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	122
PID 4596 wrote to memory of 1944	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	122
PID 4596 wrote to memory of 2780	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	123
PID 4596 wrote to memory of 2780	4596	87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\87c4ffa459142ab6be0129ac1ee34090_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\System\PDwUeJL.exe
  C:\Windows\System\PDwUeJL.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\YPOBtBC.exe
  C:\Windows\System\YPOBtBC.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\XRzgPhH.exe
  C:\Windows\System\XRzgPhH.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\XZwaBGl.exe
  C:\Windows\System\XZwaBGl.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\xCkcXqa.exe
  C:\Windows\System\xCkcXqa.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\ndnpFdz.exe
  C:\Windows\System\ndnpFdz.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\NFGKKOF.exe
  C:\Windows\System\NFGKKOF.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\BFrmbIn.exe
  C:\Windows\System\BFrmbIn.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\pmqDamI.exe
  C:\Windows\System\pmqDamI.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\ppeRrCQ.exe
  C:\Windows\System\ppeRrCQ.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\vqostiB.exe
  C:\Windows\System\vqostiB.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\KWhfMGj.exe
  C:\Windows\System\KWhfMGj.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\lQstiHx.exe
  C:\Windows\System\lQstiHx.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\OcqSqyC.exe
  C:\Windows\System\OcqSqyC.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\JEvojSF.exe
  C:\Windows\System\JEvojSF.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\QgSiZqC.exe
  C:\Windows\System\QgSiZqC.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\StYSenl.exe
  C:\Windows\System\StYSenl.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\ROxjGyE.exe
  C:\Windows\System\ROxjGyE.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\UzShdFB.exe
  C:\Windows\System\UzShdFB.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\EyNkHkB.exe
  C:\Windows\System\EyNkHkB.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\nmIbfMN.exe
  C:\Windows\System\nmIbfMN.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\cnqlGUe.exe
  C:\Windows\System\cnqlGUe.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\VWRJGPR.exe
  C:\Windows\System\VWRJGPR.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\KKUNaoY.exe
  C:\Windows\System\KKUNaoY.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\NDmHQww.exe
  C:\Windows\System\NDmHQww.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\WAfBbgE.exe
  C:\Windows\System\WAfBbgE.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\IwsBqSL.exe
  C:\Windows\System\IwsBqSL.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\SxudkCF.exe
  C:\Windows\System\SxudkCF.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\ytkpDbV.exe
  C:\Windows\System\ytkpDbV.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\LkeSjsV.exe
  C:\Windows\System\LkeSjsV.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\gDkvDiz.exe
  C:\Windows\System\gDkvDiz.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\OWMpCbx.exe
  C:\Windows\System\OWMpCbx.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\qDFcSUW.exe
  C:\Windows\System\qDFcSUW.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\DUbadXo.exe
  C:\Windows\System\DUbadXo.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\YSzKMcQ.exe
  C:\Windows\System\YSzKMcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\gxIWiYo.exe
  C:\Windows\System\gxIWiYo.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\XYfcTJl.exe
  C:\Windows\System\XYfcTJl.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\JBzZnlb.exe
  C:\Windows\System\JBzZnlb.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\bRdCDBb.exe
  C:\Windows\System\bRdCDBb.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\OrUWyiB.exe
  C:\Windows\System\OrUWyiB.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\stGgVqz.exe
  C:\Windows\System\stGgVqz.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\ViwxLTu.exe
  C:\Windows\System\ViwxLTu.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\BOVFreW.exe
  C:\Windows\System\BOVFreW.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\DvvBDri.exe
  C:\Windows\System\DvvBDri.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\sLQvfCo.exe
  C:\Windows\System\sLQvfCo.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\FurfSSQ.exe
  C:\Windows\System\FurfSSQ.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\thnbVXa.exe
  C:\Windows\System\thnbVXa.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\odwqRWd.exe
  C:\Windows\System\odwqRWd.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\HlgEVcK.exe
  C:\Windows\System\HlgEVcK.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\UJIWwws.exe
  C:\Windows\System\UJIWwws.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\VrZucIp.exe
  C:\Windows\System\VrZucIp.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\KDwoluj.exe
  C:\Windows\System\KDwoluj.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\hyyxiTM.exe
  C:\Windows\System\hyyxiTM.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\kEMMcGY.exe
  C:\Windows\System\kEMMcGY.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\rMMxsBr.exe
  C:\Windows\System\rMMxsBr.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\SibKipY.exe
  C:\Windows\System\SibKipY.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\tdwqTQp.exe
  C:\Windows\System\tdwqTQp.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\tlIOtjN.exe
  C:\Windows\System\tlIOtjN.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\fBDTCca.exe
  C:\Windows\System\fBDTCca.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\VdOAaLe.exe
  C:\Windows\System\VdOAaLe.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\FndBOdb.exe
  C:\Windows\System\FndBOdb.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\ewPnJmI.exe
  C:\Windows\System\ewPnJmI.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\cpZGVtx.exe
  C:\Windows\System\cpZGVtx.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\PgaGyCE.exe
  C:\Windows\System\PgaGyCE.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\BBnDtBe.exe
  C:\Windows\System\BBnDtBe.exe
  2⤵
  PID:492
- C:\Windows\System\XKWAORX.exe
  C:\Windows\System\XKWAORX.exe
  2⤵
  PID:4520
- C:\Windows\System\RgFQsqW.exe
  C:\Windows\System\RgFQsqW.exe
  2⤵
  PID:3468
- C:\Windows\System\sHZZqMn.exe
  C:\Windows\System\sHZZqMn.exe
  2⤵
  PID:4416
- C:\Windows\System\beWYWbJ.exe
  C:\Windows\System\beWYWbJ.exe
  2⤵
  PID:1520
- C:\Windows\System\zrMYhOB.exe
  C:\Windows\System\zrMYhOB.exe
  2⤵
  PID:3880
- C:\Windows\System\YLUsqoR.exe
  C:\Windows\System\YLUsqoR.exe
  2⤵
  PID:3292
- C:\Windows\System\tUlcLdP.exe
  C:\Windows\System\tUlcLdP.exe
  2⤵
  PID:1776
- C:\Windows\System\qwrBpPp.exe
  C:\Windows\System\qwrBpPp.exe
  2⤵
  PID:2468
- C:\Windows\System\lpkHYAH.exe
  C:\Windows\System\lpkHYAH.exe
  2⤵
  PID:4984
- C:\Windows\System\vtRuMgX.exe
  C:\Windows\System\vtRuMgX.exe
  2⤵
  PID:656
- C:\Windows\System\fOEJkpF.exe
  C:\Windows\System\fOEJkpF.exe
  2⤵
  PID:1196
- C:\Windows\System\DXImstp.exe
  C:\Windows\System\DXImstp.exe
  2⤵
  PID:4948
- C:\Windows\System\ENEwffY.exe
  C:\Windows\System\ENEwffY.exe
  2⤵
  PID:5128
- C:\Windows\System\SjccNvt.exe
  C:\Windows\System\SjccNvt.exe
  2⤵
  PID:5160
- C:\Windows\System\xhFEbTT.exe
  C:\Windows\System\xhFEbTT.exe
  2⤵
  PID:5188
- C:\Windows\System\ALtcRNW.exe
  C:\Windows\System\ALtcRNW.exe
  2⤵
  PID:5208
- C:\Windows\System\tfbIUbD.exe
  C:\Windows\System\tfbIUbD.exe
  2⤵
  PID:5240
- C:\Windows\System\siLdack.exe
  C:\Windows\System\siLdack.exe
  2⤵
  PID:5264
- C:\Windows\System\ilpsoOT.exe
  C:\Windows\System\ilpsoOT.exe
  2⤵
  PID:5284
- C:\Windows\System\UEOtGJd.exe
  C:\Windows\System\UEOtGJd.exe
  2⤵
  PID:5312
- C:\Windows\System\UJFTfLV.exe
  C:\Windows\System\UJFTfLV.exe
  2⤵
  PID:5340
- C:\Windows\System\mZRszdA.exe
  C:\Windows\System\mZRszdA.exe
  2⤵
  PID:5372
- C:\Windows\System\bTEpTeN.exe
  C:\Windows\System\bTEpTeN.exe
  2⤵
  PID:5400
- C:\Windows\System\LhOWeQv.exe
  C:\Windows\System\LhOWeQv.exe
  2⤵
  PID:5436
- C:\Windows\System\bzQqqID.exe
  C:\Windows\System\bzQqqID.exe
  2⤵
  PID:5464
- C:\Windows\System\zfkDjdo.exe
  C:\Windows\System\zfkDjdo.exe
  2⤵
  PID:5492
- C:\Windows\System\VeTfKXB.exe
  C:\Windows\System\VeTfKXB.exe
  2⤵
  PID:5524
- C:\Windows\System\NTREuls.exe
  C:\Windows\System\NTREuls.exe
  2⤵
  PID:5544
- C:\Windows\System\TqnNykO.exe
  C:\Windows\System\TqnNykO.exe
  2⤵
  PID:5576
- C:\Windows\System\UljXuNd.exe
  C:\Windows\System\UljXuNd.exe
  2⤵
  PID:5608
- C:\Windows\System\fnMopTo.exe
  C:\Windows\System\fnMopTo.exe
  2⤵
  PID:5644
- C:\Windows\System\vKlggOz.exe
  C:\Windows\System\vKlggOz.exe
  2⤵
  PID:5672
- C:\Windows\System\hpxvXao.exe
  C:\Windows\System\hpxvXao.exe
  2⤵
  PID:5704
- C:\Windows\System\hPPUVbp.exe
  C:\Windows\System\hPPUVbp.exe
  2⤵
  PID:5728
- C:\Windows\System\TYpmndE.exe
  C:\Windows\System\TYpmndE.exe
  2⤵
  PID:5748
- C:\Windows\System\dYMtkYp.exe
  C:\Windows\System\dYMtkYp.exe
  2⤵
  PID:5780
- C:\Windows\System\kQahjMb.exe
  C:\Windows\System\kQahjMb.exe
  2⤵
  PID:5812
- C:\Windows\System\faOAwzv.exe
  C:\Windows\System\faOAwzv.exe
  2⤵
  PID:5832
- C:\Windows\System\awoCaxL.exe
  C:\Windows\System\awoCaxL.exe
  2⤵
  PID:5860
- C:\Windows\System\VqGGaKo.exe
  C:\Windows\System\VqGGaKo.exe
  2⤵
  PID:5892
- C:\Windows\System\yKyvGmC.exe
  C:\Windows\System\yKyvGmC.exe
  2⤵
  PID:5920
- C:\Windows\System\XdlYost.exe
  C:\Windows\System\XdlYost.exe
  2⤵
  PID:5948
- C:\Windows\System\gbFjAaE.exe
  C:\Windows\System\gbFjAaE.exe
  2⤵
  PID:5972
- C:\Windows\System\itVnFzk.exe
  C:\Windows\System\itVnFzk.exe
  2⤵
  PID:5992
- C:\Windows\System\jzbQVzO.exe
  C:\Windows\System\jzbQVzO.exe
  2⤵
  PID:6024
- C:\Windows\System\cBRRzyI.exe
  C:\Windows\System\cBRRzyI.exe
  2⤵
  PID:6048
- C:\Windows\System\jyDJSkH.exe
  C:\Windows\System\jyDJSkH.exe
  2⤵
  PID:6088
- C:\Windows\System\ncRwUsJ.exe
  C:\Windows\System\ncRwUsJ.exe
  2⤵
  PID:6120
- C:\Windows\System\fZcdvjO.exe
  C:\Windows\System\fZcdvjO.exe
  2⤵
  PID:6140
- C:\Windows\System\hcoFRaq.exe
  C:\Windows\System\hcoFRaq.exe
  2⤵
  PID:5156
- C:\Windows\System\YLQGwyn.exe
  C:\Windows\System\YLQGwyn.exe
  2⤵
  PID:5252
- C:\Windows\System\fvwLHpA.exe
  C:\Windows\System\fvwLHpA.exe
  2⤵
  PID:5320
- C:\Windows\System\qXQchrd.exe
  C:\Windows\System\qXQchrd.exe
  2⤵
  PID:5364
- C:\Windows\System\sdXozOK.exe
  C:\Windows\System\sdXozOK.exe
  2⤵
  PID:5388
- C:\Windows\System\fwJFTKs.exe
  C:\Windows\System\fwJFTKs.exe
  2⤵
  PID:5484
- C:\Windows\System\fDOomrp.exe
  C:\Windows\System\fDOomrp.exe
  2⤵
  PID:5520
- C:\Windows\System\IgszCHh.exe
  C:\Windows\System\IgszCHh.exe
  2⤵
  PID:5616
- C:\Windows\System\bzjJREQ.exe
  C:\Windows\System\bzjJREQ.exe
  2⤵
  PID:5652
- C:\Windows\System\QCCSSdn.exe
  C:\Windows\System\QCCSSdn.exe
  2⤵
  PID:5668
- C:\Windows\System\wOofdrB.exe
  C:\Windows\System\wOofdrB.exe
  2⤵
  PID:5796
- C:\Windows\System\udidxGx.exe
  C:\Windows\System\udidxGx.exe
  2⤵
  PID:5824
- C:\Windows\System\DcNTfGN.exe
  C:\Windows\System\DcNTfGN.exe
  2⤵
  PID:5876
- C:\Windows\System\Ryirrrf.exe
  C:\Windows\System\Ryirrrf.exe
  2⤵
  PID:5964
- C:\Windows\System\ESAsvhd.exe
  C:\Windows\System\ESAsvhd.exe
  2⤵
  PID:6000
- C:\Windows\System\MGyHzzq.exe
  C:\Windows\System\MGyHzzq.exe
  2⤵
  PID:6040
- C:\Windows\System\pIeKHoW.exe
  C:\Windows\System\pIeKHoW.exe
  2⤵
  PID:6132
- C:\Windows\System\BfXWDmO.exe
  C:\Windows\System\BfXWDmO.exe
  2⤵
  PID:5280
- C:\Windows\System\zHzllnZ.exe
  C:\Windows\System\zHzllnZ.exe
  2⤵
  PID:5276
- C:\Windows\System\kgQCdHK.exe
  C:\Windows\System\kgQCdHK.exe
  2⤵
  PID:5428
- C:\Windows\System\QzAZInl.exe
  C:\Windows\System\QzAZInl.exe
  2⤵
  PID:5148
- C:\Windows\System\MGerbwr.exe
  C:\Windows\System\MGerbwr.exe
  2⤵
  PID:5720
- C:\Windows\System\YsKOUMZ.exe
  C:\Windows\System\YsKOUMZ.exe
  2⤵
  PID:5936
- C:\Windows\System\YVuqtIc.exe
  C:\Windows\System\YVuqtIc.exe
  2⤵
  PID:5792
- C:\Windows\System\SlZyjPb.exe
  C:\Windows\System\SlZyjPb.exe
  2⤵
  PID:5220
- C:\Windows\System\wVBuvfH.exe
  C:\Windows\System\wVBuvfH.exe
  2⤵
  PID:5168
- C:\Windows\System\tLXhLxc.exe
  C:\Windows\System\tLXhLxc.exe
  2⤵
  PID:6164
- C:\Windows\System\bsAQTUi.exe
  C:\Windows\System\bsAQTUi.exe
  2⤵
  PID:6200
- C:\Windows\System\bQgrqwl.exe
  C:\Windows\System\bQgrqwl.exe
  2⤵
  PID:6224
- C:\Windows\System\FqTsStt.exe
  C:\Windows\System\FqTsStt.exe
  2⤵
  PID:6256
- C:\Windows\System\DDIRPnC.exe
  C:\Windows\System\DDIRPnC.exe
  2⤵
  PID:6280
- C:\Windows\System\zVQGXep.exe
  C:\Windows\System\zVQGXep.exe
  2⤵
  PID:6304
- C:\Windows\System\IpMHzVI.exe
  C:\Windows\System\IpMHzVI.exe
  2⤵
  PID:6332
- C:\Windows\System\yGGonle.exe
  C:\Windows\System\yGGonle.exe
  2⤵
  PID:6364
- C:\Windows\System\cZwbJYK.exe
  C:\Windows\System\cZwbJYK.exe
  2⤵
  PID:6384
- C:\Windows\System\tCNFkTJ.exe
  C:\Windows\System\tCNFkTJ.exe
  2⤵
  PID:6412
- C:\Windows\System\bhXffWi.exe
  C:\Windows\System\bhXffWi.exe
  2⤵
  PID:6432
- C:\Windows\System\uTzWwBx.exe
  C:\Windows\System\uTzWwBx.exe
  2⤵
  PID:6456
- C:\Windows\System\BaCYyni.exe
  C:\Windows\System\BaCYyni.exe
  2⤵
  PID:6484
- C:\Windows\System\QWFYVhD.exe
  C:\Windows\System\QWFYVhD.exe
  2⤵
  PID:6504
- C:\Windows\System\DVLCQXP.exe
  C:\Windows\System\DVLCQXP.exe
  2⤵
  PID:6528
- C:\Windows\System\PRXtiVy.exe
  C:\Windows\System\PRXtiVy.exe
  2⤵
  PID:6564
- C:\Windows\System\ItCVOat.exe
  C:\Windows\System\ItCVOat.exe
  2⤵
  PID:6592
- C:\Windows\System\TChyHIf.exe
  C:\Windows\System\TChyHIf.exe
  2⤵
  PID:6612
- C:\Windows\System\RSEyYoW.exe
  C:\Windows\System\RSEyYoW.exe
  2⤵
  PID:6640
- C:\Windows\System\eVglwFj.exe
  C:\Windows\System\eVglwFj.exe
  2⤵
  PID:6668
- C:\Windows\System\UMnvBgf.exe
  C:\Windows\System\UMnvBgf.exe
  2⤵
  PID:6696
- C:\Windows\System\yjHttnd.exe
  C:\Windows\System\yjHttnd.exe
  2⤵
  PID:6716
- C:\Windows\System\JttUIAk.exe
  C:\Windows\System\JttUIAk.exe
  2⤵
  PID:6740
- C:\Windows\System\HtARKhE.exe
  C:\Windows\System\HtARKhE.exe
  2⤵
  PID:6760
- C:\Windows\System\zpFmNoV.exe
  C:\Windows\System\zpFmNoV.exe
  2⤵
  PID:6788
- C:\Windows\System\XuSJuoW.exe
  C:\Windows\System\XuSJuoW.exe
  2⤵
  PID:6844
- C:\Windows\System\sRtJzOT.exe
  C:\Windows\System\sRtJzOT.exe
  2⤵
  PID:6908
- C:\Windows\System\AovQODH.exe
  C:\Windows\System\AovQODH.exe
  2⤵
  PID:6928
- C:\Windows\System\TtTeOXA.exe
  C:\Windows\System\TtTeOXA.exe
  2⤵
  PID:6952
- C:\Windows\System\GGjzBvM.exe
  C:\Windows\System\GGjzBvM.exe
  2⤵
  PID:6972
- C:\Windows\System\QANNJhl.exe
  C:\Windows\System\QANNJhl.exe
  2⤵
  PID:7004
- C:\Windows\System\mFpDZFJ.exe
  C:\Windows\System\mFpDZFJ.exe
  2⤵
  PID:7048
- C:\Windows\System\reKsMqx.exe
  C:\Windows\System\reKsMqx.exe
  2⤵
  PID:7068
- C:\Windows\System\GJGoREk.exe
  C:\Windows\System\GJGoREk.exe
  2⤵
  PID:7096
- C:\Windows\System\nLdZLlF.exe
  C:\Windows\System\nLdZLlF.exe
  2⤵
  PID:7132
- C:\Windows\System\PrCBnPC.exe
  C:\Windows\System\PrCBnPC.exe
  2⤵
  PID:7164
- C:\Windows\System\USEzBEL.exe
  C:\Windows\System\USEzBEL.exe
  2⤵
  PID:6172
- C:\Windows\System\YsMCaRK.exe
  C:\Windows\System\YsMCaRK.exe
  2⤵
  PID:6220
- C:\Windows\System\glPRnFO.exe
  C:\Windows\System\glPRnFO.exe
  2⤵
  PID:6276
- C:\Windows\System\tGaHLfX.exe
  C:\Windows\System\tGaHLfX.exe
  2⤵
  PID:6316
- C:\Windows\System\YZCGYpq.exe
  C:\Windows\System\YZCGYpq.exe
  2⤵
  PID:6420
- C:\Windows\System\OhJbEZG.exe
  C:\Windows\System\OhJbEZG.exe
  2⤵
  PID:6480
- C:\Windows\System\WAIiIsd.exe
  C:\Windows\System\WAIiIsd.exe
  2⤵
  PID:6604
- C:\Windows\System\CbmpRkO.exe
  C:\Windows\System\CbmpRkO.exe
  2⤵
  PID:6684
- C:\Windows\System\KmqSADY.exe
  C:\Windows\System\KmqSADY.exe
  2⤵
  PID:6620
- C:\Windows\System\CrVasee.exe
  C:\Windows\System\CrVasee.exe
  2⤵
  PID:6708
- C:\Windows\System\BmltAyg.exe
  C:\Windows\System\BmltAyg.exe
  2⤵
  PID:6784
- C:\Windows\System\DkcrIDb.exe
  C:\Windows\System\DkcrIDb.exe
  2⤵
  PID:6868
- C:\Windows\System\hGjPGqA.exe
  C:\Windows\System\hGjPGqA.exe
  2⤵
  PID:6916
- C:\Windows\System\qkziTGh.exe
  C:\Windows\System\qkziTGh.exe
  2⤵
  PID:7064
- C:\Windows\System\DajfwDs.exe
  C:\Windows\System\DajfwDs.exe
  2⤵
  PID:7080
- C:\Windows\System\hkdcwts.exe
  C:\Windows\System\hkdcwts.exe
  2⤵
  PID:1084
- C:\Windows\System\jsSdfNH.exe
  C:\Windows\System\jsSdfNH.exe
  2⤵
  PID:6248
- C:\Windows\System\AdpRSTi.exe
  C:\Windows\System\AdpRSTi.exe
  2⤵
  PID:6324
- C:\Windows\System\kHekRwL.exe
  C:\Windows\System\kHekRwL.exe
  2⤵
  PID:6356
- C:\Windows\System\jhWPKRU.exe
  C:\Windows\System\jhWPKRU.exe
  2⤵
  PID:6496
- C:\Windows\System\BzcAoQS.exe
  C:\Windows\System\BzcAoQS.exe
  2⤵
  PID:6960
- C:\Windows\System\JXwLzVv.exe
  C:\Windows\System\JXwLzVv.exe
  2⤵
  PID:7108
- C:\Windows\System\RYtOdpw.exe
  C:\Windows\System\RYtOdpw.exe
  2⤵
  PID:6176
- C:\Windows\System\CNPoQZS.exe
  C:\Windows\System\CNPoQZS.exe
  2⤵
  PID:6380
- C:\Windows\System\emOLRIh.exe
  C:\Windows\System\emOLRIh.exe
  2⤵
  PID:6540
- C:\Windows\System\RFPiPbn.exe
  C:\Windows\System\RFPiPbn.exe
  2⤵
  PID:6064
- C:\Windows\System\EcJHaxQ.exe
  C:\Windows\System\EcJHaxQ.exe
  2⤵
  PID:6584
- C:\Windows\System\qWvCZew.exe
  C:\Windows\System\qWvCZew.exe
  2⤵
  PID:7172
- C:\Windows\System\VfaESnc.exe
  C:\Windows\System\VfaESnc.exe
  2⤵
  PID:7200
- C:\Windows\System\ONhwlqQ.exe
  C:\Windows\System\ONhwlqQ.exe
  2⤵
  PID:7224
- C:\Windows\System\YHolaFs.exe
  C:\Windows\System\YHolaFs.exe
  2⤵
  PID:7244
- C:\Windows\System\nvGUOWl.exe
  C:\Windows\System\nvGUOWl.exe
  2⤵
  PID:7276
- C:\Windows\System\KtMaERC.exe
  C:\Windows\System\KtMaERC.exe
  2⤵
  PID:7312
- C:\Windows\System\EemNDOU.exe
  C:\Windows\System\EemNDOU.exe
  2⤵
  PID:7332
- C:\Windows\System\ppFGFge.exe
  C:\Windows\System\ppFGFge.exe
  2⤵
  PID:7360
- C:\Windows\System\KCtqYHn.exe
  C:\Windows\System\KCtqYHn.exe
  2⤵
  PID:7404
- C:\Windows\System\ibiHFWl.exe
  C:\Windows\System\ibiHFWl.exe
  2⤵
  PID:7424
- C:\Windows\System\TQUiGCj.exe
  C:\Windows\System\TQUiGCj.exe
  2⤵
  PID:7448
- C:\Windows\System\JLjohHp.exe
  C:\Windows\System\JLjohHp.exe
  2⤵
  PID:7476
- C:\Windows\System\EMmZGLe.exe
  C:\Windows\System\EMmZGLe.exe
  2⤵
  PID:7496
- C:\Windows\System\lNVRFXB.exe
  C:\Windows\System\lNVRFXB.exe
  2⤵
  PID:7516
- C:\Windows\System\eZBnZRV.exe
  C:\Windows\System\eZBnZRV.exe
  2⤵
  PID:7536
- C:\Windows\System\rkuSNyP.exe
  C:\Windows\System\rkuSNyP.exe
  2⤵
  PID:7560
- C:\Windows\System\jLXSNru.exe
  C:\Windows\System\jLXSNru.exe
  2⤵
  PID:7600
- C:\Windows\System\grLfLcb.exe
  C:\Windows\System\grLfLcb.exe
  2⤵
  PID:7624
- C:\Windows\System\nUsnCQA.exe
  C:\Windows\System\nUsnCQA.exe
  2⤵
  PID:7652
- C:\Windows\System\zNSwkfX.exe
  C:\Windows\System\zNSwkfX.exe
  2⤵
  PID:7676
- C:\Windows\System\TUbrQtJ.exe
  C:\Windows\System\TUbrQtJ.exe
  2⤵
  PID:7700
- C:\Windows\System\hsWWMGv.exe
  C:\Windows\System\hsWWMGv.exe
  2⤵
  PID:7728
- C:\Windows\System\qwQtzfV.exe
  C:\Windows\System\qwQtzfV.exe
  2⤵
  PID:7748
- C:\Windows\System\TiMGjrg.exe
  C:\Windows\System\TiMGjrg.exe
  2⤵
  PID:7780
- C:\Windows\System\vAMgVms.exe
  C:\Windows\System\vAMgVms.exe
  2⤵
  PID:7812
- C:\Windows\System\TGORfbk.exe
  C:\Windows\System\TGORfbk.exe
  2⤵
  PID:7840
- C:\Windows\System\HiXYHfp.exe
  C:\Windows\System\HiXYHfp.exe
  2⤵
  PID:7864
- C:\Windows\System\dZxVpYy.exe
  C:\Windows\System\dZxVpYy.exe
  2⤵
  PID:7884
- C:\Windows\System\RpGvbHE.exe
  C:\Windows\System\RpGvbHE.exe
  2⤵
  PID:7904
- C:\Windows\System\JWKexko.exe
  C:\Windows\System\JWKexko.exe
  2⤵
  PID:7928
- C:\Windows\System\QKgHVPX.exe
  C:\Windows\System\QKgHVPX.exe
  2⤵
  PID:7952
- C:\Windows\System\HIZuHMT.exe
  C:\Windows\System\HIZuHMT.exe
  2⤵
  PID:7976
- C:\Windows\System\pdKrTAi.exe
  C:\Windows\System\pdKrTAi.exe
  2⤵
  PID:8008
- C:\Windows\System\PEveQAs.exe
  C:\Windows\System\PEveQAs.exe
  2⤵
  PID:8040
- C:\Windows\System\etaYBNR.exe
  C:\Windows\System\etaYBNR.exe
  2⤵
  PID:8068
- C:\Windows\System\bwmRfse.exe
  C:\Windows\System\bwmRfse.exe
  2⤵
  PID:8100
- C:\Windows\System\nssORpP.exe
  C:\Windows\System\nssORpP.exe
  2⤵
  PID:8132
- C:\Windows\System\SpRNhhl.exe
  C:\Windows\System\SpRNhhl.exe
  2⤵
  PID:8160
- C:\Windows\System\kPLIaZk.exe
  C:\Windows\System\kPLIaZk.exe
  2⤵
  PID:6252
- C:\Windows\System\xrZGdbH.exe
  C:\Windows\System\xrZGdbH.exe
  2⤵
  PID:7220
- C:\Windows\System\IqqXQnT.exe
  C:\Windows\System\IqqXQnT.exe
  2⤵
  PID:7264
- C:\Windows\System\oHQWLbS.exe
  C:\Windows\System\oHQWLbS.exe
  2⤵
  PID:7320
- C:\Windows\System\GQkSGmH.exe
  C:\Windows\System\GQkSGmH.exe
  2⤵
  PID:7356
- C:\Windows\System\UJrOvZX.exe
  C:\Windows\System\UJrOvZX.exe
  2⤵
  PID:7440
- C:\Windows\System\LOHGHtK.exe
  C:\Windows\System\LOHGHtK.exe
  2⤵
  PID:7456
- C:\Windows\System\CUfvEjj.exe
  C:\Windows\System\CUfvEjj.exe
  2⤵
  PID:7512
- C:\Windows\System\aPFFaXs.exe
  C:\Windows\System\aPFFaXs.exe
  2⤵
  PID:7544
- C:\Windows\System\tIwaMed.exe
  C:\Windows\System\tIwaMed.exe
  2⤵
  PID:7684
- C:\Windows\System\aJgQcJv.exe
  C:\Windows\System\aJgQcJv.exe
  2⤵
  PID:7712
- C:\Windows\System\lWqXmAi.exe
  C:\Windows\System\lWqXmAi.exe
  2⤵
  PID:6216
- C:\Windows\System\DpJuArG.exe
  C:\Windows\System\DpJuArG.exe
  2⤵
  PID:7880
- C:\Windows\System\vqxLoIf.exe
  C:\Windows\System\vqxLoIf.exe
  2⤵
  PID:7968
- C:\Windows\System\EvYyuLe.exe
  C:\Windows\System\EvYyuLe.exe
  2⤵
  PID:8084
- C:\Windows\System\TpnNRZt.exe
  C:\Windows\System\TpnNRZt.exe
  2⤵
  PID:8032
- C:\Windows\System\fkYnZag.exe
  C:\Windows\System\fkYnZag.exe
  2⤵
  PID:7996
- C:\Windows\System\GemUBej.exe
  C:\Windows\System\GemUBej.exe
  2⤵
  PID:7376
- C:\Windows\System\GRzDrjZ.exe
  C:\Windows\System\GRzDrjZ.exe
  2⤵
  PID:7592
- C:\Windows\System\DocvxYB.exe
  C:\Windows\System\DocvxYB.exe
  2⤵
  PID:7788
- C:\Windows\System\UorfHqz.exe
  C:\Windows\System\UorfHqz.exe
  2⤵
  PID:8112
- C:\Windows\System\zIYSULb.exe
  C:\Windows\System\zIYSULb.exe
  2⤵
  PID:7900
- C:\Windows\System\WQQVRIa.exe
  C:\Windows\System\WQQVRIa.exe
  2⤵
  PID:7964
- C:\Windows\System\tqzSBpY.exe
  C:\Windows\System\tqzSBpY.exe
  2⤵
  PID:7720
- C:\Windows\System\xGkLpjT.exe
  C:\Windows\System\xGkLpjT.exe
  2⤵
  PID:8208
- C:\Windows\System\ggVJupK.exe
  C:\Windows\System\ggVJupK.exe
  2⤵
  PID:8232
- C:\Windows\System\BdoFhpd.exe
  C:\Windows\System\BdoFhpd.exe
  2⤵
  PID:8252
- C:\Windows\System\wrNtmIZ.exe
  C:\Windows\System\wrNtmIZ.exe
  2⤵
  PID:8276
- C:\Windows\System\qZcLdHN.exe
  C:\Windows\System\qZcLdHN.exe
  2⤵
  PID:8308
- C:\Windows\System\flXCdTb.exe
  C:\Windows\System\flXCdTb.exe
  2⤵
  PID:8340
- C:\Windows\System\cIAGqUL.exe
  C:\Windows\System\cIAGqUL.exe
  2⤵
  PID:8364
- C:\Windows\System\nBVGEjC.exe
  C:\Windows\System\nBVGEjC.exe
  2⤵
  PID:8384
- C:\Windows\System\vMDyjFA.exe
  C:\Windows\System\vMDyjFA.exe
  2⤵
  PID:8412
- C:\Windows\System\CYdOfsK.exe
  C:\Windows\System\CYdOfsK.exe
  2⤵
  PID:8452
- C:\Windows\System\SvSkRSB.exe
  C:\Windows\System\SvSkRSB.exe
  2⤵
  PID:8472
- C:\Windows\System\zkjvtJy.exe
  C:\Windows\System\zkjvtJy.exe
  2⤵
  PID:8504
- C:\Windows\System\JpTmnCW.exe
  C:\Windows\System\JpTmnCW.exe
  2⤵
  PID:8532
- C:\Windows\System\sPQNeBH.exe
  C:\Windows\System\sPQNeBH.exe
  2⤵
  PID:8556
- C:\Windows\System\NhNBVuk.exe
  C:\Windows\System\NhNBVuk.exe
  2⤵
  PID:8580
- C:\Windows\System\NVByCXU.exe
  C:\Windows\System\NVByCXU.exe
  2⤵
  PID:8612
- C:\Windows\System\MEMUSDI.exe
  C:\Windows\System\MEMUSDI.exe
  2⤵
  PID:8632
- C:\Windows\System\sbgMgvN.exe
  C:\Windows\System\sbgMgvN.exe
  2⤵
  PID:8656
- C:\Windows\System\XmKmfth.exe
  C:\Windows\System\XmKmfth.exe
  2⤵
  PID:8676
- C:\Windows\System\oNkWUNj.exe
  C:\Windows\System\oNkWUNj.exe
  2⤵
  PID:8704
- C:\Windows\System\soSeJpM.exe
  C:\Windows\System\soSeJpM.exe
  2⤵
  PID:8728
- C:\Windows\System\OdGFXaQ.exe
  C:\Windows\System\OdGFXaQ.exe
  2⤵
  PID:8752
- C:\Windows\System\USmWgDQ.exe
  C:\Windows\System\USmWgDQ.exe
  2⤵
  PID:8772
- C:\Windows\System\cRjPKVv.exe
  C:\Windows\System\cRjPKVv.exe
  2⤵
  PID:8792
- C:\Windows\System\MyRurIq.exe
  C:\Windows\System\MyRurIq.exe
  2⤵
  PID:8816
- C:\Windows\System\kYWkLBq.exe
  C:\Windows\System\kYWkLBq.exe
  2⤵
  PID:8836
- C:\Windows\System\IhuFKGT.exe
  C:\Windows\System\IhuFKGT.exe
  2⤵
  PID:8864
- C:\Windows\System\RqelhUs.exe
  C:\Windows\System\RqelhUs.exe
  2⤵
  PID:8896
- C:\Windows\System\LMfuzHH.exe
  C:\Windows\System\LMfuzHH.exe
  2⤵
  PID:8924
- C:\Windows\System\TwzAWPt.exe
  C:\Windows\System\TwzAWPt.exe
  2⤵
  PID:8948
- C:\Windows\System\dKlPtmb.exe
  C:\Windows\System\dKlPtmb.exe
  2⤵
  PID:8976
- C:\Windows\System\ciyiSJr.exe
  C:\Windows\System\ciyiSJr.exe
  2⤵
  PID:9008
- C:\Windows\System\erFpOkY.exe
  C:\Windows\System\erFpOkY.exe
  2⤵
  PID:9028
- C:\Windows\System\QcYBBFG.exe
  C:\Windows\System\QcYBBFG.exe
  2⤵
  PID:9060
- C:\Windows\System\EfFFpjX.exe
  C:\Windows\System\EfFFpjX.exe
  2⤵
  PID:9092
- C:\Windows\System\BuXpZzQ.exe
  C:\Windows\System\BuXpZzQ.exe
  2⤵
  PID:9112
- C:\Windows\System\yQLSDvq.exe
  C:\Windows\System\yQLSDvq.exe
  2⤵
  PID:9136
- C:\Windows\System\wSSogwa.exe
  C:\Windows\System\wSSogwa.exe
  2⤵
  PID:9164
- C:\Windows\System\xCVwUMR.exe
  C:\Windows\System\xCVwUMR.exe
  2⤵
  PID:9184
- C:\Windows\System\wiMfUpm.exe
  C:\Windows\System\wiMfUpm.exe
  2⤵
  PID:9212
- C:\Windows\System\XXGfKXo.exe
  C:\Windows\System\XXGfKXo.exe
  2⤵
  PID:8200
- C:\Windows\System\owHlcXB.exe
  C:\Windows\System\owHlcXB.exe
  2⤵
  PID:1200
- C:\Windows\System\OZLSzIq.exe
  C:\Windows\System\OZLSzIq.exe
  2⤵
  PID:7936
- C:\Windows\System\CQpzhrQ.exe
  C:\Windows\System\CQpzhrQ.exe
  2⤵
  PID:8480
- C:\Windows\System\CGdoLAf.exe
  C:\Windows\System\CGdoLAf.exe
  2⤵
  PID:8400
- C:\Windows\System\UFHjqTd.exe
  C:\Windows\System\UFHjqTd.exe
  2⤵
  PID:8520
- C:\Windows\System\vtPkyrE.exe
  C:\Windows\System\vtPkyrE.exe
  2⤵
  PID:8516
- C:\Windows\System\KsGCDHB.exe
  C:\Windows\System\KsGCDHB.exe
  2⤵
  PID:8672
- C:\Windows\System\EWgSNSt.exe
  C:\Windows\System\EWgSNSt.exe
  2⤵
  PID:8720
- C:\Windows\System\ILmkJhw.exe
  C:\Windows\System\ILmkJhw.exe
  2⤵
  PID:8860
- C:\Windows\System\jspnznG.exe
  C:\Windows\System\jspnznG.exe
  2⤵
  PID:8916
- C:\Windows\System\QKINUkA.exe
  C:\Windows\System\QKINUkA.exe
  2⤵
  PID:8768
- C:\Windows\System\cUtFcDK.exe
  C:\Windows\System\cUtFcDK.exe
  2⤵
  PID:9104
- C:\Windows\System\oIaaOpu.exe
  C:\Windows\System\oIaaOpu.exe
  2⤵
  PID:6444
- C:\Windows\System\eRTmlaC.exe
  C:\Windows\System\eRTmlaC.exe
  2⤵
  PID:8960
- C:\Windows\System\PAokrxK.exe
  C:\Windows\System\PAokrxK.exe
  2⤵
  PID:9172
- C:\Windows\System\kIPSFag.exe
  C:\Windows\System\kIPSFag.exe
  2⤵
  PID:7920
- C:\Windows\System\WSuBVDz.exe
  C:\Windows\System\WSuBVDz.exe
  2⤵
  PID:8404
- C:\Windows\System\hPiaoKi.exe
  C:\Windows\System\hPiaoKi.exe
  2⤵
  PID:7744
- C:\Windows\System\aFwAlCC.exe
  C:\Windows\System\aFwAlCC.exe
  2⤵
  PID:2012
- C:\Windows\System\WnHjuks.exe
  C:\Windows\System\WnHjuks.exe
  2⤵
  PID:8892
- C:\Windows\System\hCVJiWK.exe
  C:\Windows\System\hCVJiWK.exe
  2⤵
  PID:8780
- C:\Windows\System\FLEXLVk.exe
  C:\Windows\System\FLEXLVk.exe
  2⤵
  PID:8268
- C:\Windows\System\MJTNQnA.exe
  C:\Windows\System\MJTNQnA.exe
  2⤵
  PID:8988
- C:\Windows\System\PyYdoWg.exe
  C:\Windows\System\PyYdoWg.exe
  2⤵
  PID:9128
- C:\Windows\System\LwgErrH.exe
  C:\Windows\System\LwgErrH.exe
  2⤵
  PID:9224
- C:\Windows\System\pHpTgwx.exe
  C:\Windows\System\pHpTgwx.exe
  2⤵
  PID:9260
- C:\Windows\System\anTLfKE.exe
  C:\Windows\System\anTLfKE.exe
  2⤵
  PID:9284
- C:\Windows\System\zLgpdpK.exe
  C:\Windows\System\zLgpdpK.exe
  2⤵
  PID:9320
- C:\Windows\System\Swrjqsx.exe
  C:\Windows\System\Swrjqsx.exe
  2⤵
  PID:9344
- C:\Windows\System\TttZDlq.exe
  C:\Windows\System\TttZDlq.exe
  2⤵
  PID:9364
- C:\Windows\System\PMcoOme.exe
  C:\Windows\System\PMcoOme.exe
  2⤵
  PID:9392
- C:\Windows\System\NBjboqa.exe
  C:\Windows\System\NBjboqa.exe
  2⤵
  PID:9436
- C:\Windows\System\NIlzHIP.exe
  C:\Windows\System\NIlzHIP.exe
  2⤵
  PID:9456
- C:\Windows\System\YPMZoJG.exe
  C:\Windows\System\YPMZoJG.exe
  2⤵
  PID:9480
- C:\Windows\System\WWABueo.exe
  C:\Windows\System\WWABueo.exe
  2⤵
  PID:9508
- C:\Windows\System\kDtuLCE.exe
  C:\Windows\System\kDtuLCE.exe
  2⤵
  PID:9532
- C:\Windows\System\faDAquA.exe
  C:\Windows\System\faDAquA.exe
  2⤵
  PID:9572
- C:\Windows\System\pynRYkA.exe
  C:\Windows\System\pynRYkA.exe
  2⤵
  PID:9596
- C:\Windows\System\NQyNKHK.exe
  C:\Windows\System\NQyNKHK.exe
  2⤵
  PID:9624
- C:\Windows\System\EAUlrja.exe
  C:\Windows\System\EAUlrja.exe
  2⤵
  PID:9652
- C:\Windows\System\VVOiPvN.exe
  C:\Windows\System\VVOiPvN.exe
  2⤵
  PID:9680
- C:\Windows\System\zYqlonJ.exe
  C:\Windows\System\zYqlonJ.exe
  2⤵
  PID:9704
- C:\Windows\System\SzQnesZ.exe
  C:\Windows\System\SzQnesZ.exe
  2⤵
  PID:9724
- C:\Windows\System\uqlZmxE.exe
  C:\Windows\System\uqlZmxE.exe
  2⤵
  PID:9752
- C:\Windows\System\lUjdBhk.exe
  C:\Windows\System\lUjdBhk.exe
  2⤵
  PID:9776
- C:\Windows\System\TAIWRTI.exe
  C:\Windows\System\TAIWRTI.exe
  2⤵
  PID:9800
- C:\Windows\System\SFKoTzy.exe
  C:\Windows\System\SFKoTzy.exe
  2⤵
  PID:9832
- C:\Windows\System\APGQDEk.exe
  C:\Windows\System\APGQDEk.exe
  2⤵
  PID:9864
- C:\Windows\System\IhorrZm.exe
  C:\Windows\System\IhorrZm.exe
  2⤵
  PID:9888
- C:\Windows\System\houmtTS.exe
  C:\Windows\System\houmtTS.exe
  2⤵
  PID:9916
- C:\Windows\System\SPumdnl.exe
  C:\Windows\System\SPumdnl.exe
  2⤵
  PID:9944
- C:\Windows\System\FRbPmHJ.exe
  C:\Windows\System\FRbPmHJ.exe
  2⤵
  PID:9960
- C:\Windows\System\FdeDFpj.exe
  C:\Windows\System\FdeDFpj.exe
  2⤵
  PID:9976
- C:\Windows\System\rDncYiU.exe
  C:\Windows\System\rDncYiU.exe
  2⤵
  PID:10000
- C:\Windows\System\sfoASuK.exe
  C:\Windows\System\sfoASuK.exe
  2⤵
  PID:10028
- C:\Windows\System\JbtMfIH.exe
  C:\Windows\System\JbtMfIH.exe
  2⤵
  PID:10056
- C:\Windows\System\UsbRogo.exe
  C:\Windows\System\UsbRogo.exe
  2⤵
  PID:10084
- C:\Windows\System\EIJDdKz.exe
  C:\Windows\System\EIJDdKz.exe
  2⤵
  PID:10116
- C:\Windows\System\edzmqFW.exe
  C:\Windows\System\edzmqFW.exe
  2⤵
  PID:10148
- C:\Windows\System\XZTcPUn.exe
  C:\Windows\System\XZTcPUn.exe
  2⤵
  PID:10168
- C:\Windows\System\hHiCZzO.exe
  C:\Windows\System\hHiCZzO.exe
  2⤵
  PID:10192
- C:\Windows\System\uvrgfmx.exe
  C:\Windows\System\uvrgfmx.exe
  2⤵
  PID:10220
- C:\Windows\System\DaIbZxg.exe
  C:\Windows\System\DaIbZxg.exe
  2⤵
  PID:8572
- C:\Windows\System\UnYvvPY.exe
  C:\Windows\System\UnYvvPY.exe
  2⤵
  PID:4276
- C:\Windows\System\XeNNXBJ.exe
  C:\Windows\System\XeNNXBJ.exe
  2⤵
  PID:8544
- C:\Windows\System\muyBSpt.exe
  C:\Windows\System\muyBSpt.exe
  2⤵
  PID:9248
- C:\Windows\System\fadWNuP.exe
  C:\Windows\System\fadWNuP.exe
  2⤵
  PID:8668
- C:\Windows\System\sBfcWuj.exe
  C:\Windows\System\sBfcWuj.exe
  2⤵
  PID:9308
- C:\Windows\System\nyFOnAy.exe
  C:\Windows\System\nyFOnAy.exe
  2⤵
  PID:8700
- C:\Windows\System\WcwESIH.exe
  C:\Windows\System\WcwESIH.exe
  2⤵
  PID:9464
- C:\Windows\System\bKulYLz.exe
  C:\Windows\System\bKulYLz.exe
  2⤵
  PID:9372
- C:\Windows\System\ihHYkbL.exe
  C:\Windows\System\ihHYkbL.exe
  2⤵
  PID:9688
- C:\Windows\System\qecfiOU.exe
  C:\Windows\System\qecfiOU.exe
  2⤵
  PID:9296
- C:\Windows\System\QIAetxx.exe
  C:\Windows\System\QIAetxx.exe
  2⤵
  PID:9580
- C:\Windows\System\qPCwySZ.exe
  C:\Windows\System\qPCwySZ.exe
  2⤵
  PID:9640
- C:\Windows\System\qtjnCUF.exe
  C:\Windows\System\qtjnCUF.exe
  2⤵
  PID:9736
- C:\Windows\System\dQkQMfU.exe
  C:\Windows\System\dQkQMfU.exe
  2⤵
  PID:10068
- C:\Windows\System\mXVLNHf.exe
  C:\Windows\System\mXVLNHf.exe
  2⤵
  PID:9616
- C:\Windows\System\pFIanyf.exe
  C:\Windows\System\pFIanyf.exe
  2⤵
  PID:9936
- C:\Windows\System\QshGJBG.exe
  C:\Windows\System\QshGJBG.exe
  2⤵
  PID:9760
- C:\Windows\System\BtSDdye.exe
  C:\Windows\System\BtSDdye.exe
  2⤵
  PID:7484
- C:\Windows\System\YQmgalv.exe
  C:\Windows\System\YQmgalv.exe
  2⤵
  PID:10132
- C:\Windows\System\FqodnWF.exe
  C:\Windows\System\FqodnWF.exe
  2⤵
  PID:9696
- C:\Windows\System\ywEhImz.exe
  C:\Windows\System\ywEhImz.exe
  2⤵
  PID:9524
- C:\Windows\System\gCzrmRA.exe
  C:\Windows\System\gCzrmRA.exe
  2⤵
  PID:9272
- C:\Windows\System\OuArqIL.exe
  C:\Windows\System\OuArqIL.exe
  2⤵
  PID:9880
- C:\Windows\System\ItTPRcK.exe
  C:\Windows\System\ItTPRcK.exe
  2⤵
  PID:9672
- C:\Windows\System\UScAkOc.exe
  C:\Windows\System\UScAkOc.exe
  2⤵
  PID:10256
- C:\Windows\System\UQSFRLR.exe
  C:\Windows\System\UQSFRLR.exe
  2⤵
  PID:10284
- C:\Windows\System\hKhlNXp.exe
  C:\Windows\System\hKhlNXp.exe
  2⤵
  PID:10308
- C:\Windows\System\GntmIPp.exe
  C:\Windows\System\GntmIPp.exe
  2⤵
  PID:10340
- C:\Windows\System\gaHWXaS.exe
  C:\Windows\System\gaHWXaS.exe
  2⤵
  PID:10364
- C:\Windows\System\xyQKBNv.exe
  C:\Windows\System\xyQKBNv.exe
  2⤵
  PID:10392
- C:\Windows\System\hrulJon.exe
  C:\Windows\System\hrulJon.exe
  2⤵
  PID:10416
- C:\Windows\System\FslGaQN.exe
  C:\Windows\System\FslGaQN.exe
  2⤵
  PID:10448
- C:\Windows\System\mHIyZiC.exe
  C:\Windows\System\mHIyZiC.exe
  2⤵
  PID:10472
- C:\Windows\System\iPAhOxa.exe
  C:\Windows\System\iPAhOxa.exe
  2⤵
  PID:10500
- C:\Windows\System\yRQVxEK.exe
  C:\Windows\System\yRQVxEK.exe
  2⤵
  PID:10516
- C:\Windows\System\RoFswSw.exe
  C:\Windows\System\RoFswSw.exe
  2⤵
  PID:10552
- C:\Windows\System\osgUKli.exe
  C:\Windows\System\osgUKli.exe
  2⤵
  PID:10572
- C:\Windows\System\fGwroIl.exe
  C:\Windows\System\fGwroIl.exe
  2⤵
  PID:10600
- C:\Windows\System\nnFDcUi.exe
  C:\Windows\System\nnFDcUi.exe
  2⤵
  PID:10624
- C:\Windows\System\iJmsVgg.exe
  C:\Windows\System\iJmsVgg.exe
  2⤵
  PID:10644
- C:\Windows\System\SnXkpiA.exe
  C:\Windows\System\SnXkpiA.exe
  2⤵
  PID:10668
- C:\Windows\System\EwYaSZe.exe
  C:\Windows\System\EwYaSZe.exe
  2⤵
  PID:10692
- C:\Windows\System\IYkrHBw.exe
  C:\Windows\System\IYkrHBw.exe
  2⤵
  PID:10720
- C:\Windows\System\bJjAElE.exe
  C:\Windows\System\bJjAElE.exe
  2⤵
  PID:10748
- C:\Windows\System\sKNTBar.exe
  C:\Windows\System\sKNTBar.exe
  2⤵
  PID:10788
- C:\Windows\System\hSCtNds.exe
  C:\Windows\System\hSCtNds.exe
  2⤵
  PID:10808
- C:\Windows\System\RvCsvSf.exe
  C:\Windows\System\RvCsvSf.exe
  2⤵
  PID:10828
- C:\Windows\System\mPqsyRJ.exe
  C:\Windows\System\mPqsyRJ.exe
  2⤵
  PID:10860
- C:\Windows\System\fNSvjqo.exe
  C:\Windows\System\fNSvjqo.exe
  2⤵
  PID:10884
- C:\Windows\System\KnBYoyX.exe
  C:\Windows\System\KnBYoyX.exe
  2⤵
  PID:10924
- C:\Windows\System\XmTCvwd.exe
  C:\Windows\System\XmTCvwd.exe
  2⤵
  PID:10956
- C:\Windows\System\qopZkAY.exe
  C:\Windows\System\qopZkAY.exe
  2⤵
  PID:10980
- C:\Windows\System\Czmrfvr.exe
  C:\Windows\System\Czmrfvr.exe
  2⤵
  PID:11012
- C:\Windows\System\tFnYfod.exe
  C:\Windows\System\tFnYfod.exe
  2⤵
  PID:11044
- C:\Windows\System\zJhGrYu.exe
  C:\Windows\System\zJhGrYu.exe
  2⤵
  PID:11076
- C:\Windows\System\EHotMfF.exe
  C:\Windows\System\EHotMfF.exe
  2⤵
  PID:11100
- C:\Windows\System\IYFvNGv.exe
  C:\Windows\System\IYFvNGv.exe
  2⤵
  PID:11128
- C:\Windows\System\fkWdQlW.exe
  C:\Windows\System\fkWdQlW.exe
  2⤵
  PID:11152
- C:\Windows\System\UmAkcdr.exe
  C:\Windows\System\UmAkcdr.exe
  2⤵
  PID:11184
- C:\Windows\System\tPDwvYm.exe
  C:\Windows\System\tPDwvYm.exe
  2⤵
  PID:11204
- C:\Windows\System\ZUkxDSX.exe
  C:\Windows\System\ZUkxDSX.exe
  2⤵
  PID:10320
- C:\Windows\System\XNtrcTi.exe
  C:\Windows\System\XNtrcTi.exe
  2⤵
  PID:10484
- C:\Windows\System\NsYIvCj.exe
  C:\Windows\System\NsYIvCj.exe
  2⤵
  PID:10324
- C:\Windows\System\zXtuROk.exe
  C:\Windows\System\zXtuROk.exe
  2⤵
  PID:10640
- C:\Windows\System\wmmcxmb.exe
  C:\Windows\System\wmmcxmb.exe
  2⤵
  PID:10464
- C:\Windows\System\DQOtnuD.exe
  C:\Windows\System\DQOtnuD.exe
  2⤵
  PID:10840
- C:\Windows\System\ytjmSmf.exe
  C:\Windows\System\ytjmSmf.exe
  2⤵
  PID:10716
- C:\Windows\System\fkuFFLD.exe
  C:\Windows\System\fkuFFLD.exe
  2⤵
  PID:10972
- C:\Windows\System\lfTEYkv.exe
  C:\Windows\System\lfTEYkv.exe
  2⤵
  PID:10560
- C:\Windows\System\HuUseKT.exe
  C:\Windows\System\HuUseKT.exe
  2⤵
  PID:10620
- C:\Windows\System\zAbkCLf.exe
  C:\Windows\System\zAbkCLf.exe
  2⤵
  PID:11240
- C:\Windows\System\IqRkgcU.exe
  C:\Windows\System\IqRkgcU.exe
  2⤵
  PID:10024
- C:\Windows\System\WhCgwbG.exe
  C:\Windows\System\WhCgwbG.exe
  2⤵
  PID:10940
- C:\Windows\System\PFZXkof.exe
  C:\Windows\System\PFZXkof.exe
  2⤵
  PID:11064
- C:\Windows\System\JbFQtPM.exe
  C:\Windows\System\JbFQtPM.exe
  2⤵
  PID:11112
- C:\Windows\System\ibwYJyX.exe
  C:\Windows\System\ibwYJyX.exe
  2⤵
  PID:11148
- C:\Windows\System\ZlvhvtU.exe
  C:\Windows\System\ZlvhvtU.exe
  2⤵
  PID:11032
- C:\Windows\System\PeYcvAR.exe
  C:\Windows\System\PeYcvAR.exe
  2⤵
  PID:10384
- C:\Windows\System\NuvBFTH.exe
  C:\Windows\System\NuvBFTH.exe
  2⤵
  PID:10508
- C:\Windows\System\uwxYuGQ.exe
  C:\Windows\System\uwxYuGQ.exe
  2⤵
  PID:560
- C:\Windows\System\rzrQOyt.exe
  C:\Windows\System\rzrQOyt.exe
  2⤵
  PID:10460
- C:\Windows\System\rNpKPaC.exe
  C:\Windows\System\rNpKPaC.exe
  2⤵
  PID:11180
- C:\Windows\System\tiVeosv.exe
  C:\Windows\System\tiVeosv.exe
  2⤵
  PID:11272
- C:\Windows\System\aTfAZcp.exe
  C:\Windows\System\aTfAZcp.exe
  2⤵
  PID:11292
- C:\Windows\System\ywcvhcT.exe
  C:\Windows\System\ywcvhcT.exe
  2⤵
  PID:11316
- C:\Windows\System\HELkSES.exe
  C:\Windows\System\HELkSES.exe
  2⤵
  PID:11340
- C:\Windows\System\yWQwBml.exe
  C:\Windows\System\yWQwBml.exe
  2⤵
  PID:11368
- C:\Windows\System\JcaMkZl.exe
  C:\Windows\System\JcaMkZl.exe
  2⤵
  PID:11392
- C:\Windows\System\MfAVopJ.exe
  C:\Windows\System\MfAVopJ.exe
  2⤵
  PID:11416
- C:\Windows\System\FcNGLWM.exe
  C:\Windows\System\FcNGLWM.exe
  2⤵
  PID:11512
- C:\Windows\System\twWNtLp.exe
  C:\Windows\System\twWNtLp.exe
  2⤵
  PID:11552
- C:\Windows\System\QomaeJc.exe
  C:\Windows\System\QomaeJc.exe
  2⤵
  PID:11584
- C:\Windows\System\OsirDoW.exe
  C:\Windows\System\OsirDoW.exe
  2⤵
  PID:11616
- C:\Windows\System\ehsVorZ.exe
  C:\Windows\System\ehsVorZ.exe
  2⤵
  PID:11644
- C:\Windows\System\mYryHBN.exe
  C:\Windows\System\mYryHBN.exe
  2⤵
  PID:11672
- C:\Windows\System\KXUvOnr.exe
  C:\Windows\System\KXUvOnr.exe
  2⤵
  PID:11708
- C:\Windows\System\FdsaHHA.exe
  C:\Windows\System\FdsaHHA.exe
  2⤵
  PID:11728
- C:\Windows\System\Czjtbsr.exe
  C:\Windows\System\Czjtbsr.exe
  2⤵
  PID:11760
- C:\Windows\System\Edtcpnj.exe
  C:\Windows\System\Edtcpnj.exe
  2⤵
  PID:11784
- C:\Windows\System\RydwGYB.exe
  C:\Windows\System\RydwGYB.exe
  2⤵
  PID:11820
- C:\Windows\System\YLwlrmr.exe
  C:\Windows\System\YLwlrmr.exe
  2⤵
  PID:11848
- C:\Windows\System\YdehNWm.exe
  C:\Windows\System\YdehNWm.exe
  2⤵
  PID:11868
- C:\Windows\System\INySEWW.exe
  C:\Windows\System\INySEWW.exe
  2⤵
  PID:11900
- C:\Windows\System\sBzZiEB.exe
  C:\Windows\System\sBzZiEB.exe
  2⤵
  PID:11928
- C:\Windows\System\oDtIDed.exe
  C:\Windows\System\oDtIDed.exe
  2⤵
  PID:12080
- C:\Windows\System\STJzXBJ.exe
  C:\Windows\System\STJzXBJ.exe
  2⤵
  PID:12096
- C:\Windows\System\iWvgVne.exe
  C:\Windows\System\iWvgVne.exe
  2⤵
  PID:12112
- C:\Windows\System\aMnmgod.exe
  C:\Windows\System\aMnmgod.exe
  2⤵
  PID:12136
- C:\Windows\System\jJXsQfi.exe
  C:\Windows\System\jJXsQfi.exe
  2⤵
  PID:12156
- C:\Windows\System\dVLjQBP.exe
  C:\Windows\System\dVLjQBP.exe
  2⤵
  PID:12172
- C:\Windows\System\FdEetKX.exe
  C:\Windows\System\FdEetKX.exe
  2⤵
  PID:12196
- C:\Windows\System\WAIuscU.exe
  C:\Windows\System\WAIuscU.exe
  2⤵
  PID:12220
- C:\Windows\System\hPqrwmK.exe
  C:\Windows\System\hPqrwmK.exe
  2⤵
  PID:12244
- C:\Windows\System\jpStpuy.exe
  C:\Windows\System\jpStpuy.exe
  2⤵
  PID:12268
- C:\Windows\System\GtKpMBX.exe
  C:\Windows\System\GtKpMBX.exe
  2⤵
  PID:10488
- C:\Windows\System\pJwYJDV.exe
  C:\Windows\System\pJwYJDV.exe
  2⤵
  PID:10944
- C:\Windows\System\RryOvzg.exe
  C:\Windows\System\RryOvzg.exe
  2⤵
  PID:11172
- C:\Windows\System\kmyxPDz.exe
  C:\Windows\System\kmyxPDz.exe
  2⤵
  PID:10988
- C:\Windows\System\zWmpulC.exe
  C:\Windows\System\zWmpulC.exe
  2⤵
  PID:10540
- C:\Windows\System\tthaxJP.exe
  C:\Windows\System\tthaxJP.exe
  2⤵
  PID:11284
- C:\Windows\System\IolwwSJ.exe
  C:\Windows\System\IolwwSJ.exe
  2⤵
  PID:11360
- C:\Windows\System\tsQTNVf.exe
  C:\Windows\System\tsQTNVf.exe
  2⤵
  PID:11408
- C:\Windows\System\NbHktAS.exe
  C:\Windows\System\NbHktAS.exe
  2⤵
  PID:11520
- C:\Windows\System\DJeypGL.exe
  C:\Windows\System\DJeypGL.exe
  2⤵
  PID:11596
- C:\Windows\System\DpyUkYL.exe
  C:\Windows\System\DpyUkYL.exe
  2⤵
  PID:11572
- C:\Windows\System\uypsxmO.exe
  C:\Windows\System\uypsxmO.exe
  2⤵
  PID:11680
- C:\Windows\System\jWICwMm.exe
  C:\Windows\System\jWICwMm.exe
  2⤵
  PID:11744
- C:\Windows\System\DDlpQbN.exe
  C:\Windows\System\DDlpQbN.exe
  2⤵
  PID:8876
- C:\Windows\System\viYbQGj.exe
  C:\Windows\System\viYbQGj.exe
  2⤵
  PID:11896
- C:\Windows\System\TODjgoK.exe
  C:\Windows\System\TODjgoK.exe
  2⤵
  PID:1612
- C:\Windows\System\TCRbmzt.exe
  C:\Windows\System\TCRbmzt.exe
  2⤵
  PID:1984
- C:\Windows\System\NDuiFhV.exe
  C:\Windows\System\NDuiFhV.exe
  2⤵
  PID:12064
- C:\Windows\System\YnMLUiG.exe
  C:\Windows\System\YnMLUiG.exe
  2⤵
  PID:12124
- C:\Windows\System\oktZock.exe
  C:\Windows\System\oktZock.exe
  2⤵
  PID:12164
- C:\Windows\System\rPniDcJ.exe
  C:\Windows\System\rPniDcJ.exe
  2⤵
  PID:12212
- C:\Windows\System\eRcVbkJ.exe
  C:\Windows\System\eRcVbkJ.exe
  2⤵
  PID:12276
- C:\Windows\System\oNQgVYn.exe
  C:\Windows\System\oNQgVYn.exe
  2⤵
  PID:11248
- C:\Windows\System\SMiIqNC.exe
  C:\Windows\System\SMiIqNC.exe
  2⤵
  PID:11312
- C:\Windows\System\TwvIkyq.exe
  C:\Windows\System\TwvIkyq.exe
  2⤵
  PID:11492
- C:\Windows\System\QfBhUUv.exe
  C:\Windows\System\QfBhUUv.exe
  2⤵
  PID:11400
- C:\Windows\System\gmrqvZP.exe
  C:\Windows\System\gmrqvZP.exe
  2⤵
  PID:11836
- C:\Windows\System\myuZFWH.exe
  C:\Windows\System\myuZFWH.exe
  2⤵
  PID:11924
- C:\Windows\System\bpxMdsf.exe
  C:\Windows\System\bpxMdsf.exe
  2⤵
  PID:11864
- C:\Windows\System\diokjPN.exe
  C:\Windows\System\diokjPN.exe
  2⤵
  PID:12088
- C:\Windows\System\oHpzDBB.exe
  C:\Windows\System\oHpzDBB.exe
  2⤵
  PID:12148
- C:\Windows\System\fdUSYNE.exe
  C:\Windows\System\fdUSYNE.exe
  2⤵
  PID:12208
- C:\Windows\System\iHsKkXv.exe
  C:\Windows\System\iHsKkXv.exe
  2⤵
  PID:11332
- C:\Windows\System\CoWQghe.exe
  C:\Windows\System\CoWQghe.exe
  2⤵
  PID:11508
- C:\Windows\System\nJtIgWS.exe
  C:\Windows\System\nJtIgWS.exe
  2⤵
  PID:9788
- C:\Windows\System\vtUYMTY.exe
  C:\Windows\System\vtUYMTY.exe
  2⤵
  PID:12336
- C:\Windows\System\JNzahdn.exe
  C:\Windows\System\JNzahdn.exe
  2⤵
  PID:12372
- C:\Windows\System\iNSQTjP.exe
  C:\Windows\System\iNSQTjP.exe
  2⤵
  PID:12420
- C:\Windows\System\qAXqJyb.exe
  C:\Windows\System\qAXqJyb.exe
  2⤵
  PID:12436
- C:\Windows\System\TUTBJSG.exe
  C:\Windows\System\TUTBJSG.exe
  2⤵
  PID:12464
- C:\Windows\System\jDUlgak.exe
  C:\Windows\System\jDUlgak.exe
  2⤵
  PID:12504
- C:\Windows\System\SIfkdOE.exe
  C:\Windows\System\SIfkdOE.exe
  2⤵
  PID:12528
- C:\Windows\System\woIaaqS.exe
  C:\Windows\System\woIaaqS.exe
  2⤵
  PID:12544
- C:\Windows\System\HvYLglO.exe
  C:\Windows\System\HvYLglO.exe
  2⤵
  PID:12572
- C:\Windows\System\NGgIuUR.exe
  C:\Windows\System\NGgIuUR.exe
  2⤵
  PID:12588
- C:\Windows\System\hocQgml.exe
  C:\Windows\System\hocQgml.exe
  2⤵
  PID:12612
- C:\Windows\System\jTPvePb.exe
  C:\Windows\System\jTPvePb.exe
  2⤵
  PID:12628
- C:\Windows\System\hPeJsyt.exe
  C:\Windows\System\hPeJsyt.exe
  2⤵
  PID:12656
- C:\Windows\System\vzoykaX.exe
  C:\Windows\System\vzoykaX.exe
  2⤵
  PID:12684
- C:\Windows\System\dFRZtHo.exe
  C:\Windows\System\dFRZtHo.exe
  2⤵
  PID:12708
- C:\Windows\System\hwXqjCA.exe
  C:\Windows\System\hwXqjCA.exe
  2⤵
  PID:12728
- C:\Windows\System\BWWqkUv.exe
  C:\Windows\System\BWWqkUv.exe
  2⤵
  PID:12748
- C:\Windows\System\jqQqxGT.exe
  C:\Windows\System\jqQqxGT.exe
  2⤵
  PID:12768
- C:\Windows\System\SmxieJC.exe
  C:\Windows\System\SmxieJC.exe
  2⤵
  PID:12792
- C:\Windows\System\MSToStn.exe
  C:\Windows\System\MSToStn.exe
  2⤵
  PID:12808
- C:\Windows\System\yLmMXqK.exe
  C:\Windows\System\yLmMXqK.exe
  2⤵
  PID:12832
- C:\Windows\System\VyQQlKU.exe
  C:\Windows\System\VyQQlKU.exe
  2⤵
  PID:12852
- C:\Windows\System\MyeGLyI.exe
  C:\Windows\System\MyeGLyI.exe
  2⤵
  PID:12872
- C:\Windows\System\DRfZkUB.exe
  C:\Windows\System\DRfZkUB.exe
  2⤵
  PID:13032
- C:\Windows\System\iqJZeYH.exe
  C:\Windows\System\iqJZeYH.exe
  2⤵
  PID:13048
- C:\Windows\System\IMdBIJI.exe
  C:\Windows\System\IMdBIJI.exe
  2⤵
  PID:13080
- C:\Windows\System\HCkIlvW.exe
  C:\Windows\System\HCkIlvW.exe
  2⤵
  PID:13120
- C:\Windows\System\eBtgiUa.exe
  C:\Windows\System\eBtgiUa.exe
  2⤵
  PID:13180
- C:\Windows\System\XbaEkoL.exe
  C:\Windows\System\XbaEkoL.exe
  2⤵
  PID:13208
- C:\Windows\System\hjXDEil.exe
  C:\Windows\System\hjXDEil.exe
  2⤵
  PID:13244
- C:\Windows\System\mfTIWQg.exe
  C:\Windows\System\mfTIWQg.exe
  2⤵
  PID:13272
- C:\Windows\System\oeMkVfR.exe
  C:\Windows\System\oeMkVfR.exe
  2⤵
  PID:13296
- C:\Windows\System\VNuZCCo.exe
  C:\Windows\System\VNuZCCo.exe
  2⤵
  PID:11388
- C:\Windows\System\VXLdqgc.exe
  C:\Windows\System\VXLdqgc.exe
  2⤵
  PID:11892
- C:\Windows\System\joIhdKp.exe
  C:\Windows\System\joIhdKp.exe
  2⤵
  PID:11944
- C:\Windows\System\MVUSPMU.exe
  C:\Windows\System\MVUSPMU.exe
  2⤵
  PID:12348
- C:\Windows\System\NEiXSiN.exe
  C:\Windows\System\NEiXSiN.exe
  2⤵
  PID:4008
- C:\Windows\System\TBpDhEt.exe
  C:\Windows\System\TBpDhEt.exe
  2⤵
  PID:12448
- C:\Windows\System\AYBmsCK.exe
  C:\Windows\System\AYBmsCK.exe
  2⤵
  PID:12328
- C:\Windows\System\SQGfdGT.exe
  C:\Windows\System\SQGfdGT.exe
  2⤵
  PID:3348
- C:\Windows\System\NBXjZSB.exe
  C:\Windows\System\NBXjZSB.exe
  2⤵
  PID:1848
- C:\Windows\System\YsFhJgX.exe
  C:\Windows\System\YsFhJgX.exe
  2⤵
  PID:12788
- C:\Windows\System\YRJvdrl.exe
  C:\Windows\System\YRJvdrl.exe
  2⤵
  PID:12644
- C:\Windows\System\UqhKHpR.exe
  C:\Windows\System\UqhKHpR.exe
  2⤵
  PID:12516
- C:\Windows\System\REDOZNP.exe
  C:\Windows\System\REDOZNP.exe
  2⤵
  PID:12696
- C:\Windows\System\QFRDEQb.exe
  C:\Windows\System\QFRDEQb.exe
  2⤵
  PID:12740
- C:\Windows\System\JNdPWWB.exe
  C:\Windows\System\JNdPWWB.exe
  2⤵
  PID:12668
- C:\Windows\System\rhYxvkd.exe
  C:\Windows\System\rhYxvkd.exe
  2⤵
  PID:12888
- C:\Windows\System\iEoulWA.exe
  C:\Windows\System\iEoulWA.exe
  2⤵
  PID:12860
- C:\Windows\System\GatEMTJ.exe
  C:\Windows\System\GatEMTJ.exe
  2⤵
  PID:12924
- C:\Windows\System\lxeRwlq.exe
  C:\Windows\System\lxeRwlq.exe
  2⤵
  PID:13076
- C:\Windows\System\GwuducC.exe
  C:\Windows\System\GwuducC.exe
  2⤵
  PID:13064
- C:\Windows\System\YfDnugE.exe
  C:\Windows\System\YfDnugE.exe
  2⤵
  PID:13132
- C:\Windows\System\ugTcqsQ.exe
  C:\Windows\System\ugTcqsQ.exe
  2⤵
  PID:13156
- C:\Windows\System\CEmXcpY.exe
  C:\Windows\System\CEmXcpY.exe
  2⤵
  PID:12016
- C:\Windows\System\kSqxVyu.exe
  C:\Windows\System\kSqxVyu.exe
  2⤵
  PID:13268
- C:\Windows\System\eFlIKwA.exe
  C:\Windows\System\eFlIKwA.exe
  2⤵
  PID:11660
- C:\Windows\System\zfmISUq.exe
  C:\Windows\System\zfmISUq.exe
  2⤵
  PID:12492
- C:\Windows\System\YxYcTwl.exe
  C:\Windows\System\YxYcTwl.exe
  2⤵
  PID:12428
- C:\Windows\System\cYSOpeU.exe
  C:\Windows\System\cYSOpeU.exe
  2⤵
  PID:12432
- C:\Windows\System\WZaAvKr.exe
  C:\Windows\System\WZaAvKr.exe
  2⤵
  PID:12760
- C:\Windows\System\jVCanHD.exe
  C:\Windows\System\jVCanHD.exe
  2⤵
  PID:12624
- C:\Windows\System\slkdDvd.exe
  C:\Windows\System\slkdDvd.exe
  2⤵
  PID:12204
- C:\Windows\System\AFzcyNs.exe
  C:\Windows\System\AFzcyNs.exe
  2⤵
  PID:13324
- C:\Windows\System\IvbXEON.exe
  C:\Windows\System\IvbXEON.exe
  2⤵
  PID:13344
- C:\Windows\System\yJKhSzf.exe
  C:\Windows\System\yJKhSzf.exe
  2⤵
  PID:13368
- C:\Windows\System\gQgXcMh.exe
  C:\Windows\System\gQgXcMh.exe
  2⤵
  PID:13388
- C:\Windows\System\bpqdqNL.exe
  C:\Windows\System\bpqdqNL.exe
  2⤵
  PID:13424
- C:\Windows\System\JMIRpVo.exe
  C:\Windows\System\JMIRpVo.exe
  2⤵
  PID:13452
- C:\Windows\System\pRRftWj.exe
  C:\Windows\System\pRRftWj.exe
  2⤵
  PID:13472
- C:\Windows\System\StkKIJG.exe
  C:\Windows\System\StkKIJG.exe
  2⤵
  PID:13488
- C:\Windows\System\bbThQsK.exe
  C:\Windows\System\bbThQsK.exe
  2⤵
  PID:13504
- C:\Windows\System\YDzYIvv.exe
  C:\Windows\System\YDzYIvv.exe
  2⤵
  PID:13528
- C:\Windows\System\DwgAlRz.exe
  C:\Windows\System\DwgAlRz.exe
  2⤵
  PID:13548
- C:\Windows\System\MbOXgMP.exe
  C:\Windows\System\MbOXgMP.exe
  2⤵
  PID:13564
- C:\Windows\System\fZOJhUT.exe
  C:\Windows\System\fZOJhUT.exe
  2⤵
  PID:13596
- C:\Windows\System\vDgPtpJ.exe
  C:\Windows\System\vDgPtpJ.exe
  2⤵
  PID:13616
- C:\Windows\System\HbxQBlq.exe
  C:\Windows\System\HbxQBlq.exe
  2⤵
  PID:13644
- C:\Windows\System\HnwExNV.exe
  C:\Windows\System\HnwExNV.exe
  2⤵
  PID:13668
- C:\Windows\System\mjHCtaA.exe
  C:\Windows\System\mjHCtaA.exe
  2⤵
  PID:13684
- C:\Windows\System\vJrCfeT.exe
  C:\Windows\System\vJrCfeT.exe
  2⤵
  PID:13700
- C:\Windows\System\NUUATgV.exe
  C:\Windows\System\NUUATgV.exe
  2⤵
  PID:13724
- C:\Windows\System\aBFiFFy.exe
  C:\Windows\System\aBFiFFy.exe
  2⤵
  PID:13744
- C:\Windows\System\OqNKuly.exe
  C:\Windows\System\OqNKuly.exe
  2⤵
  PID:13768
- C:\Windows\System\FCaIlDU.exe
  C:\Windows\System\FCaIlDU.exe
  2⤵
  PID:13792
- C:\Windows\System\ARvscMq.exe
  C:\Windows\System\ARvscMq.exe
  2⤵
  PID:13816
- C:\Windows\System\BhsbEJE.exe
  C:\Windows\System\BhsbEJE.exe
  2⤵
  PID:13832
- C:\Windows\System\vkcosFn.exe
  C:\Windows\System\vkcosFn.exe
  2⤵
  PID:13848
- C:\Windows\System\AaxuCYV.exe
  C:\Windows\System\AaxuCYV.exe
  2⤵
  PID:13868
- C:\Windows\System\NzyGwST.exe
  C:\Windows\System\NzyGwST.exe
  2⤵
  PID:13888
- C:\Windows\System\UKptAaw.exe
  C:\Windows\System\UKptAaw.exe
  2⤵
  PID:13904
- C:\Windows\System\drACxgr.exe
  C:\Windows\System\drACxgr.exe
  2⤵
  PID:13928
- C:\Windows\System\JVnACoB.exe
  C:\Windows\System\JVnACoB.exe
  2⤵
  PID:13960
- C:\Windows\System\JTNgOoW.exe
  C:\Windows\System\JTNgOoW.exe
  2⤵
  PID:13992
- C:\Windows\System\JwpysUI.exe
  C:\Windows\System\JwpysUI.exe
  2⤵
  PID:14032
- C:\Windows\System\fnzKGnB.exe
  C:\Windows\System\fnzKGnB.exe
  2⤵
  PID:14056
- C:\Windows\System\SrkEUJp.exe
  C:\Windows\System\SrkEUJp.exe
  2⤵
  PID:14080
- C:\Windows\System\xdUTzMH.exe
  C:\Windows\System\xdUTzMH.exe
  2⤵
  PID:14104
- C:\Windows\System\BSFMXMW.exe
  C:\Windows\System\BSFMXMW.exe
  2⤵
  PID:14124
- C:\Windows\System\mWmSfQp.exe
  C:\Windows\System\mWmSfQp.exe
  2⤵
  PID:14160
- C:\Windows\System\bEHHvGc.exe
  C:\Windows\System\bEHHvGc.exe
  2⤵
  PID:14176
- C:\Windows\System\dWQZokU.exe
  C:\Windows\System\dWQZokU.exe
  2⤵
  PID:14204
- C:\Windows\System\nLwTsoH.exe
  C:\Windows\System\nLwTsoH.exe
  2⤵
  PID:14220
- C:\Windows\System\thgukwe.exe
  C:\Windows\System\thgukwe.exe
  2⤵
  PID:2288
- C:\Windows\System\xeiyAiT.exe
  C:\Windows\System\xeiyAiT.exe
  2⤵
  PID:12724
- C:\Windows\System\PStNCHy.exe
  C:\Windows\System\PStNCHy.exe
  2⤵
  PID:12844
- C:\Windows\System\SREIVkh.exe
  C:\Windows\System\SREIVkh.exe
  2⤵
  PID:13360
- C:\Windows\System\gDSLqRN.exe
  C:\Windows\System\gDSLqRN.exe
  2⤵
  PID:13356
- C:\Windows\System\qicjLjm.exe
  C:\Windows\System\qicjLjm.exe
  2⤵
  PID:3988
- C:\Windows\System\jSXCJeI.exe
  C:\Windows\System\jSXCJeI.exe
  2⤵
  PID:1532
- C:\Windows\System\dPlKgNf.exe
  C:\Windows\System\dPlKgNf.exe
  2⤵
  PID:13468
- C:\Windows\System\XyUnhzv.exe
  C:\Windows\System\XyUnhzv.exe
  2⤵
  PID:13812
- C:\Windows\System\IiYetwM.exe
  C:\Windows\System\IiYetwM.exe
  2⤵
  PID:13844
- C:\Windows\System\TuIMSpL.exe
  C:\Windows\System\TuIMSpL.exe
  2⤵
  PID:13072
- C:\Windows\System\gzhhESH.exe
  C:\Windows\System\gzhhESH.exe
  2⤵
  PID:13308
- C:\Windows\System\RIgMkZH.exe
  C:\Windows\System\RIgMkZH.exe
  2⤵
  PID:13288
- C:\Windows\System\gHfmNlv.exe
  C:\Windows\System\gHfmNlv.exe
  2⤵
  PID:12052
- C:\Windows\System\lFZbyzu.exe
  C:\Windows\System\lFZbyzu.exe
  2⤵
  PID:13804
- C:\Windows\System\uJuKZjn.exe
  C:\Windows\System\uJuKZjn.exe
  2⤵
  PID:13420
- C:\Windows\System\xAiouUE.exe
  C:\Windows\System\xAiouUE.exe
  2⤵
  PID:13656
- C:\Windows\System\Fdtmyqk.exe
  C:\Windows\System\Fdtmyqk.exe
  2⤵
  PID:14120
- C:\Windows\System\iaydUKq.exe
  C:\Windows\System\iaydUKq.exe
  2⤵
  PID:13860
- C:\Windows\System\PqWGhdM.exe
  C:\Windows\System\PqWGhdM.exe
  2⤵
  PID:14100
- C:\Windows\System\CUXnspP.exe
  C:\Windows\System\CUXnspP.exe
  2⤵
  PID:13100
- C:\Windows\System\ntAGKSk.exe
  C:\Windows\System\ntAGKSk.exe
  2⤵
  PID:3328
- C:\Windows\System\dOoBkGC.exe
  C:\Windows\System\dOoBkGC.exe
  2⤵
  PID:12556
- C:\Windows\System\ZLCXHrO.exe
  C:\Windows\System\ZLCXHrO.exe
  2⤵
  PID:13512
- C:\Windows\System\CnXziDj.exe
  C:\Windows\System\CnXziDj.exe
  2⤵
  PID:1952
- C:\Windows\System\VsIqbNa.exe
  C:\Windows\System\VsIqbNa.exe
  2⤵
  PID:14340
- C:\Windows\System\ygUhjzF.exe
  C:\Windows\System\ygUhjzF.exe
  2⤵
  PID:14364
- C:\Windows\System\SRTVvGy.exe
  C:\Windows\System\SRTVvGy.exe
  2⤵
  PID:14388
- C:\Windows\System\CKNhAXF.exe
  C:\Windows\System\CKNhAXF.exe
  2⤵
  PID:14412
- C:\Windows\System\VhWFNNR.exe
  C:\Windows\System\VhWFNNR.exe
  2⤵
  PID:14436
- C:\Windows\System\PRTxVVF.exe
  C:\Windows\System\PRTxVVF.exe
  2⤵
  PID:14452
- C:\Windows\System\ApUCsaZ.exe
  C:\Windows\System\ApUCsaZ.exe
  2⤵
  PID:14472
- C:\Windows\System\vbfiFKJ.exe
  C:\Windows\System\vbfiFKJ.exe
  2⤵
  PID:14488
- C:\Windows\System\axzsSZj.exe
  C:\Windows\System\axzsSZj.exe
  2⤵
  PID:14524
- C:\Windows\System\TCbUphr.exe
  C:\Windows\System\TCbUphr.exe
  2⤵
  PID:14580
- C:\Windows\System\wARpzbl.exe
  C:\Windows\System\wARpzbl.exe
  2⤵
  PID:14600
- C:\Windows\System\KXJkRMm.exe
  C:\Windows\System\KXJkRMm.exe
  2⤵
  PID:14628
- C:\Windows\System\fXiaQDS.exe
  C:\Windows\System\fXiaQDS.exe
  2⤵
  PID:14704
- C:\Windows\System\vCrQhVJ.exe
  C:\Windows\System\vCrQhVJ.exe
  2⤵
  PID:14720
- C:\Windows\System\vuDHhlL.exe
  C:\Windows\System\vuDHhlL.exe
  2⤵
  PID:14736
- C:\Windows\System\gBIwSup.exe
  C:\Windows\System\gBIwSup.exe
  2⤵
  PID:14772
- C:\Windows\System\hKSJvpq.exe
  C:\Windows\System\hKSJvpq.exe
  2⤵
  PID:14796
- C:\Windows\System\StpSxNm.exe
  C:\Windows\System\StpSxNm.exe
  2⤵
  PID:14820
- C:\Windows\System\dzXheCL.exe
  C:\Windows\System\dzXheCL.exe
  2⤵
  PID:14844
- C:\Windows\System\janlSIk.exe
  C:\Windows\System\janlSIk.exe
  2⤵
  PID:14876
- C:\Windows\System\LViEbhQ.exe
  C:\Windows\System\LViEbhQ.exe
  2⤵
  PID:14892
- C:\Windows\System\jFXfqzr.exe
  C:\Windows\System\jFXfqzr.exe
  2⤵
  PID:14924
- C:\Windows\System\MnXFJDh.exe
  C:\Windows\System\MnXFJDh.exe
  2⤵
  PID:14940
- C:\Windows\System\gZfCeaB.exe
  C:\Windows\System\gZfCeaB.exe
  2⤵
  PID:14964
- C:\Windows\System\TaDqJxK.exe
  C:\Windows\System\TaDqJxK.exe
  2⤵
  PID:15032
- C:\Windows\System\IphLhTy.exe
  C:\Windows\System\IphLhTy.exe
  2⤵
  PID:15128
- C:\Windows\System\lpzDeVs.exe
  C:\Windows\System\lpzDeVs.exe
  2⤵
  PID:15152
- C:\Windows\System\jxDdfFH.exe
  C:\Windows\System\jxDdfFH.exe
  2⤵
  PID:15356
- C:\Windows\System\cQDjKyq.exe
  C:\Windows\System\cQDjKyq.exe
  2⤵
  PID:13464
- C:\Windows\System\kkcHbit.exe
  C:\Windows\System\kkcHbit.exe
  2⤵
  PID:3560
- C:\Windows\System\HipFSjn.exe
  C:\Windows\System\HipFSjn.exe
  2⤵
  PID:1876
- C:\Windows\System\OzXQPZf.exe
  C:\Windows\System\OzXQPZf.exe
  2⤵
  PID:12304
- C:\Windows\System\KqkaXut.exe
  C:\Windows\System\KqkaXut.exe
  2⤵
  PID:14352
- C:\Windows\System\cKEkitc.exe
  C:\Windows\System\cKEkitc.exe
  2⤵
  PID:14380
- C:\Windows\System\UuIupHj.exe
  C:\Windows\System\UuIupHj.exe
  2⤵
  PID:14652
- C:\Windows\System\jjVLSLN.exe
  C:\Windows\System\jjVLSLN.exe
  2⤵
  PID:2576
- C:\Windows\System\OZSGlSH.exe
  C:\Windows\System\OZSGlSH.exe
  2⤵
  PID:3952
- C:\Windows\System\VAOvmBE.exe
  C:\Windows\System\VAOvmBE.exe
  2⤵
  PID:14656
- C:\Windows\System\lMNyHXN.exe
  C:\Windows\System\lMNyHXN.exe
  2⤵
  PID:14732
- C:\Windows\System\WRHvFtH.exe
  C:\Windows\System\WRHvFtH.exe
  2⤵
  PID:4188
- C:\Windows\System\vavQgtD.exe
  C:\Windows\System\vavQgtD.exe
  2⤵
  PID:15260
- C:\Windows\System\etKkmfY.exe
  C:\Windows\System\etKkmfY.exe
  2⤵
  PID:13912
- C:\Windows\System\juzBHiW.exe
  C:\Windows\System\juzBHiW.exe
  2⤵
  PID:5840
- C:\Windows\System\oJHREGu.exe
  C:\Windows\System\oJHREGu.exe
  2⤵
  PID:12228
- C:\Windows\System\wKGxfgF.exe
  C:\Windows\System\wKGxfgF.exe
  2⤵
  PID:13252
- C:\Windows\System\gcySwfy.exe
  C:\Windows\System\gcySwfy.exe
  2⤵
  PID:14560
- C:\Windows\System\hXEwzDn.exe
  C:\Windows\System\hXEwzDn.exe
  2⤵
  PID:14768
- C:\Windows\System\DRvJyNa.exe
  C:\Windows\System\DRvJyNa.exe
  2⤵
  PID:14596
- C:\Windows\System\MatiOjf.exe
  C:\Windows\System\MatiOjf.exe
  2⤵
  PID:12184
- C:\Windows\System\kEIXDeA.exe
  C:\Windows\System\kEIXDeA.exe
  2⤵
  PID:4196
- C:\Windows\System\ODmxhwM.exe
  C:\Windows\System\ODmxhwM.exe
  2⤵
  PID:14356
- C:\Windows\System\tEguKRx.exe
  C:\Windows\System\tEguKRx.exe
  2⤵
  PID:14992
- C:\Windows\System\SpogmEr.exe
  C:\Windows\System\SpogmEr.exe
  2⤵
  PID:15024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=756 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:14188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BFrmbIn.exe

Filesize
2.1MB

MD5
96ac76d8dd84c4366bc22e08ba7c4a1d

SHA1
0eb378344bf36a45daeb99b7c945a3c14a7e6b12

SHA256
65e49940e3159eb3b464e4e62faad32b634eba42382e01548ca51465a45f2b87

SHA512
32e73d4f3b9502e3fb967b625430a8d98e7610f29133be57cf95049e01f94d2dadd9c1a9984828582fff058cd3464d4d9525cc4e9df5911c5fe0ed7c696e55a2

Download Submit
C:\Windows\System\EyNkHkB.exe

Filesize
2.1MB

MD5
867ce48001467682b23932eafd26689d

SHA1
2ad3a9b3c32015e8ea7289d55fa82037d1ec1ff0

SHA256
6a456b90f087c39fbdb5b8ae875a513a2dd7f6cd413edb5dd5aded098c43eb7f

SHA512
ac68d500b113059fb4e062fb235c973d109d23f68fec618bda5921d296d433dbed41ac6bd9207efae2cbb0d88315a88177c8b0b70984c7dc51989fd96765600b

Download Submit
C:\Windows\System\IwsBqSL.exe

Filesize
2.1MB

MD5
79234d1621000f7e14e7954312450c38

SHA1
0b44cc6e5cf9a6e4b57716dd09de04157e66b816

SHA256
9a3f820ed7050953c337e671d8ae4e9b406bf3edcedbbd74117b497670f072df

SHA512
38cc060034755331792d4408cc5384af5d75a7b1404c9d4b9784e4a6ace3641e832855b18d8e3db9f84491cf3ba85319f46399ff661bd722417eba39e5f246c2

Download Submit
C:\Windows\System\JEvojSF.exe

Filesize
2.1MB

MD5
7ac0cf04ce2f0259207b8578565fecec

SHA1
333a4c842cf940c4c75fc1c66ead661b54814722

SHA256
9da2c25d5c4b133e9641144d1e76b0c6d80f043fce3c9b86c5739c0d0a5a0082

SHA512
0e8dfa5e4d94faffda8b2b6eb11dba46786beafe7216f3ac74f2f2951fb420bc2d690193aa438b3f803a9adc74139bfd72d2ef6e02aad4157f84e01084b49065

Download Submit
C:\Windows\System\KKUNaoY.exe

Filesize
2.1MB

MD5
fd7850e9c0ea31d92eea9b45cf054e43

SHA1
7b646c1b8ccf0f9c4fd93af083c389c4b0480936

SHA256
628333b9b74645c18879f63f0c2a716e6e684c9578eaf45a91c508b886d95abc

SHA512
9d4994d732b920767e47292289ba2f9b94db522845d6fcd182252d09f56b8dcfc33f01cf460911558c8349d6120d3b0d95a983ab3620bcce9fd4cca6639aa233

Download Submit
C:\Windows\System\KWhfMGj.exe

Filesize
2.1MB

MD5
9ae581939b40e79b829e6b0c146e94ef

SHA1
081f96187346304974d2d7acd5d88b1a29f84d66

SHA256
e219ac58ae5cb3c1decf8e7e892fcdb375cdd37848abae445efc0a2edea019f7

SHA512
a4e8603324b3e259dd0dfce52a9ff632a2e7b0be99417e3dfb29b61a41bda76be977de72ee0eb14ba2a52047b52be28a349b1eb326d6cf683b49720bcdfff61b

Download Submit
C:\Windows\System\LkeSjsV.exe

Filesize
2.1MB

MD5
bd49e6960dbfcfc61b47e0743f0a5f77

SHA1
384bce8c5b44797cf8dbcc985aa1884fb05e6b26

SHA256
6b8e6c55c930b72522f060cc17a029fabca9c025d8d26f5c4b50f77d8e07a06e

SHA512
4df9f1e28c1c638fda775bd47b62ea440037348f139d4a77eda5071ef798d71409e9331c2521214112098077b709c7c4eb63073ddbb0e00a991b2f6d93ca1a22

Download Submit
C:\Windows\System\NDmHQww.exe

Filesize
2.1MB

MD5
b962931043e2ec76fc0ec3f820a2d2a5

SHA1
df28eadbb7fb8a20c614f98ce8ff6fc82a1b97b3

SHA256
3efb3c6ddda5fc928014612cbb07f565865bd78b06433f2aa85d400234bde2cc

SHA512
273a2e6d9448d5266897a2ee43578fcc64d50c89abfa57f6208caf3478a3d9d7cfb68b17302170aa188bcbd9d7ad9f84c1e9a93bf1de8b0b85ec125c539edf98

Download Submit
C:\Windows\System\NFGKKOF.exe

Filesize
2.1MB

MD5
d7b5aafa31840e8205f87f10fbda9287

SHA1
6d69dd9d13eff17bd8a1e32eeb2724eeaaa07559

SHA256
aee8ac3646d5428bcfa6d4d950e743617d61ea87b9fc8365b338840a3d9e1011

SHA512
8c2502bc8cfa1cce1654c14e8778ee8e90cee43870ded3178988d30f2f9d9830a1a722ff05d550032aa8aaf543232695d21b1f562d80136d4168e9ad4d4925d1

Download Submit
C:\Windows\System\OWMpCbx.exe

Filesize
2.1MB

MD5
80b6cb2ae8b47e26a68bd2de556e8006

SHA1
54421e8c172389db40cf9ddc3df7a50d30896224

SHA256
662812ad3f64ad529dd3145ff7450c7d4b444d6940f651460fff47e9c2f0d05b

SHA512
263824b121cb3ef031ad5b79188d11fe233f90553975cc2f7223b6255821cf93e4a58e1f88e5621e54864fed5ad8113c7c8e3fa700be7c86bf3393b5254342e8

Download Submit
C:\Windows\System\OcqSqyC.exe

Filesize
2.1MB

MD5
a7bd0e9bbf60f63f22580d6e3c1524ee

SHA1
517487aecdea33cca49628088a0e087019b8917f

SHA256
d175841a9ca23c3b43af8fc8c1a3a68aeb308bd18949b8c34e524c390ac39af8

SHA512
9d494b215def01f165373ecc7a3faa77ad5d489a65bf031cf1e6335bdd4b9e7d9f093ecab24ad3cf7aa53d44c42223a0d9b08c3eea91e854effa074909c6b655

Download Submit
C:\Windows\System\PDwUeJL.exe

Filesize
2.1MB

MD5
e4847635063fadc194c91a0b27593ae8

SHA1
2e68bd2c663a5c083494b2f410512fe744bf0f62

SHA256
f9eab0ae7850a5bf9d42d88075ade85264a8f5e4a242519e6ee380b101aae140

SHA512
6835f7a44aff881f98c64eb77ce27d40970433c10abde1ab6ff9d70d0958658a0a1e5d168cec40190cde0182aedfd68efb7fe10360c45e4d7a640910d9bc2b24

Download Submit
C:\Windows\System\QgSiZqC.exe

Filesize
2.1MB

MD5
e2d386bc36636de62d51c9facec61dc6

SHA1
a4d3dcab4bdc9337ad5723a28d2385d4b82d0600

SHA256
0c4ecd2de4c93026fdb59f91fb020565e4c6c55741e4c01f3c8affdb0675640a

SHA512
6c22da82b51cf99fcb4cb71a783d2d9ca69159bcf081662b3563b71ce70f4cab344e59c452ee3e710e6a85e7e1cdcb58b9f0c97865e587b842e916dc404c7531

Download Submit
C:\Windows\System\ROxjGyE.exe

Filesize
2.1MB

MD5
c9fc277453ff740b16c4d3bb459706e0

SHA1
49c16aa7a2a0e02e77574295b3c8d37ca027606a

SHA256
ec039e45c0e6d09ac3c0e5d43ba1e300c26732804cb35d91a9b941ec7eda7be0

SHA512
776e5828838dc3f225abdd18fa2234c81ba130dc2e710601104743a1f246ddf6aae475c48bc9183cb654f7430f3d2efb8abed141908506ad341d1429d0fa7a4d

Download Submit
C:\Windows\System\StYSenl.exe

Filesize
2.1MB

MD5
dec6565a99a76ba87f18eea8ca691974

SHA1
9ef71dcbd415b4afce4f75e01c34e2469e74402b

SHA256
1479534d968eae4b29f2d9640be58d8bd2e42be0e9db3962e7a31f30f35ee20f

SHA512
4cf2629c1bd6d36c75a48c29984a7bbc35a13529142b2b7157dcf37b85d1de582ebededede183a2057d9ace7a3bd598dbd4a52b5fea8b707930e47cf2e6d3d0b

Download Submit
C:\Windows\System\SxudkCF.exe

Filesize
2.1MB

MD5
de0d48cb67f9200f9416e761b68d6453

SHA1
ea892bbcee1cd2baeb29ede7a04221544be4d572

SHA256
2b108184229db5ff40c0fe185147e047b8a5500df4fa30953b505cfc7f3892dd

SHA512
9ab6a88ac8d5529b09d841354576d8b5b056f53b4c62a6b5283e23b1936411a3fe588bd21e94d1e4264115eac7e2219203c3847071737a2f2434f6c7a1dea49c

Download Submit
C:\Windows\System\UzShdFB.exe

Filesize
2.1MB

MD5
faee8088595b7f6de6d42b1ee57a6fab

SHA1
c742cc071717b7e8f23e6e43b772a6aaa49c03a0

SHA256
d8c6433208dc528ba4e87f1ffadcf0eaf9b1c39a25539343419162adb314eba2

SHA512
2e7fa656313dde8d6f593e0bd9fca50bd274d8a379020fc94ba9bbd3d5604c13ff5297f1391f275f7e210060a67c841a1496542dd88369691e935a8feeb3aeb4

Download Submit
C:\Windows\System\VWRJGPR.exe

Filesize
2.1MB

MD5
8092b75cbd16f1813899e910015ea625

SHA1
47fbc01ce8b8519164b93ae4c1611da884f78df9

SHA256
3a8854ee7dd19598519f08c7c0bcf48aedf0367810d0a52a6a8e38e2a625ec32

SHA512
9c2534191ac77c0a20b3b7687794cee7cb32dfde8e995d0e4256bd620a95acc46f5912ccbc5e0dca72d2dc656b8002ebb2eb313136c53439890b14297d007286

Download Submit
C:\Windows\System\WAfBbgE.exe

Filesize
2.1MB

MD5
c2403ca89fde700048a83eb13c4e4d18

SHA1
0b6f1e4182d711930d23092b9901122c174b8ef9

SHA256
6c2d0f10d67cf64d1a3e4debeb50d0431052b8dd3de1587e02d7da502c347c3d

SHA512
0acf7dd0352ddc73a08de13f9c8b1aeacb33022f8285be0898f14e22b733b47427bb4bbea36c32107254ddc7877dae3470b96472da1a4266f3210f454054256c

Download Submit
C:\Windows\System\XRzgPhH.exe

Filesize
2.1MB

MD5
606aa4ce767782f3cddc1518dd9a1788

SHA1
9a2871a3d93515a4a2b5f861c66b85eca4afa74c

SHA256
e7538b6027d44068f817cf3034e94b1bd0c10dc7d844758dbe66670dc02df8f0

SHA512
9eed81c1674ef90bbc2f0eeaadd76dca4e8a5e6fab2cec17d987a7b8f8a5178244996c12a1421368285253f5a6ed781ee77e3afe1b15acc3b222bf0278c18454

Download Submit
C:\Windows\System\XZwaBGl.exe

Filesize
2.1MB

MD5
71c3945b6bb11166489a91c4b524d771

SHA1
2d0f51e25727cd0785740440d1d1e4d49fd55b02

SHA256
5b987a983c57ceea59ce24c983fbdec4d9e4f393098badeef8c4fa75e9e50556

SHA512
5a22413ac903df943674ad8660ff8edc7c5430dfcc094935c6b44260c53644b86ff13573409cbdaa1b8dc3dace5a7ec29830f60c9df36368c2207892041575b2

Download Submit
C:\Windows\System\YPOBtBC.exe

Filesize
2.1MB

MD5
fbbd3f56f31bd2b1d97ee5115674dc7d

SHA1
f5f3486491dbdac3b790eba6d54c606c194cdcdd

SHA256
e451134715525f67ff44efa4a503be92c5d22a1c744d1d0de5c5520c20c14029

SHA512
7333a60e041dcb82c7b50479ce69fff39ddecfb69fa8ff415659faaa3c931917a8257a2b644c10a64c9775d185ee73c60f8ec5b67e12503cdf8cbb0ff1eb1917

Download Submit
C:\Windows\System\cnqlGUe.exe

Filesize
2.1MB

MD5
c48d4cb67fc98bb9fa90022811aa3270

SHA1
8218e33d9b10daca789bb3b27d0609c9346e975c

SHA256
e9fe38374ae9e540ace3aa0bfbe9c58d811846fd3fc04adc3def5133baceeb38

SHA512
b61c2c5e6b9f85a190d8aee3ea7054ba804675dadc6134f0bf17e706cb0aa2a105a0e098655686d96ca4cea5f69c5300e05f9e3e16685f6e2e69171421219f34

Download Submit
C:\Windows\System\gDkvDiz.exe

Filesize
2.1MB

MD5
3f16eaaf8b54704bf7907e2709e4d78b

SHA1
42e1e2c3fc8fdda19407a1cdbe9205261d314770

SHA256
19710f63a1eeae0cff9a6eaa78a9d25b6e2ada850e1684a0acd5e695e4f81ba0

SHA512
35a9526cf29d07015424a5dfe564f08a39a3052a5836ecb7fc3e4f7dd23fc1e339f38d78f5233295af76396461d0446d0fcfa2e7ef5c252f0aa2e087bc641651

Download Submit
C:\Windows\System\lQstiHx.exe

Filesize
2.1MB

MD5
308f10ca3ef8c1e8dc49cb1b110d0397

SHA1
fae79c95d5ce80a53647471f7a16d890909314c6

SHA256
0a16b75c06962697834bda42f4c71527836115cb1bea6eed025fca8cad1c1e32

SHA512
28e281fc82a8b56b045c833988d543d222e03d185c2555440e474dd38e70955389c627ec865f2c12809347477a11a1564c8c0a57906ca591ebf61c1c74cfbc5a

Download Submit
C:\Windows\System\ndnpFdz.exe

Filesize
2.1MB

MD5
a4c0f0ad8247c5296c733cd501a0891d

SHA1
589ff85aeeddc941ecc3539980d7129fdeb311c8

SHA256
c0b7a7b17331ca78a8c46ab56ccd2df4e2284faaa083a25ff3527737497d0dc8

SHA512
0400c1d530af1225ee450a06b77c9702a8db4183a5a99c5ff1ee9a54eb84267d60b32f3c9a000481f266f30c2716e4186a0583747bf0c2baf67866dcadedd315

Download Submit
C:\Windows\System\nmIbfMN.exe

Filesize
2.1MB

MD5
14efae916bdb6b62836389d7d3327592

SHA1
6ee211fae40b043600dfab49648dbf6192f522fa

SHA256
c61edd850878dcbf0bffdf052d0f3c455db5aa3596f90b17468da5131abe6425

SHA512
257d904586c9a767fa2c2235e1232cb978762699018113ef8f949fc5c079f640607f845dcac8055925a8aa6db63a1aa74735db8687654e462f752dc10416cc33

Download Submit
C:\Windows\System\pmqDamI.exe

Filesize
2.1MB

MD5
1b387fed3f565d803a40fdd2ef2ec024

SHA1
0ada0af89b2eed0d6938065159acc93ebddf6485

SHA256
011d16e3f97fd4e59cbcc8f93c51002bda92bfb507d3787e8dcd605165188aa6

SHA512
5db0545a21548806e72c44eb35769fbd8f3d5088e8d6481d049abd3b9a87d8522cb2247b9596da380fafd3e5a35770b1bd96605ca6e39d48ceae412f373524ab

Download Submit
C:\Windows\System\ppeRrCQ.exe

Filesize
2.1MB

MD5
c9a2f0ad5df36f3c282e225775eb6896

SHA1
ceb70f5741900365f42db82f59dce1ada4d2813c

SHA256
963d42dd03fd780014d6abd06863f9c590b4bb66f6b4f12438108b329cbd7eca

SHA512
e11b3b1212d0c5eb02843d3e8039b2e0fa168e181ec1159cef86247eb03597ee499b99204ea62d05e39685e2889ba34f78cd41a446d7c1a712e53b621c0dc3dd

Download Submit
C:\Windows\System\qDFcSUW.exe

Filesize
2.1MB

MD5
f94fc1cfebb45637a8ea5f59daf2a748

SHA1
46bb31113ee64bfe1f0f5196dc1a86fcb498f9aa

SHA256
bfdff36b8fe667e95f541d16424c9ceb638f07a906105e6b47045d177167217a

SHA512
fedb973b437b2fcd5808c36be546c6a90ae987ad7d5649d418a55a8f0d63a697059c60ded831365b93a6b4a54e42f63c4e78bc409abd6f20e7ad8bf08033f01b

Download Submit
C:\Windows\System\vqostiB.exe

Filesize
2.1MB

MD5
f5e30d19a06520118985eacf954de6bd

SHA1
4e850b7aaa9f5f1a37ee1e12bf52197de439a39d

SHA256
d30f373b6e4838f12e8a960516e9f82f53c3cf3fd17da9641c21c99802a98dcb

SHA512
be2201be35fee81bbcd5f5dc70ca34c26e393da61070aaf79ea38beb90b4ef4be93a3f4de021155ea18e9eaacf96fcb5b1d39dc26b0bcf5a56bdb1edb2bd8895

Download Submit
C:\Windows\System\xCkcXqa.exe

Filesize
2.1MB

MD5
fbe307fa8a3feafce02cf90f6aa63713

SHA1
f149f46e86befe41727eeee1bb9c148b6a6e15f6

SHA256
f4a4a9cb6fb08623273356323b9609df4c936b726e0755c2ea5b0d17756a3ca1

SHA512
3413cdf1d613be650882c3fcb4046675c94c5da38b7460d6625997595d8d459f95b231e58b35c4b6f90baa797465c31945fd9c170083434f4864c92500881ffa

Download Submit
C:\Windows\System\ytkpDbV.exe

Filesize
2.1MB

MD5
32b297ba0a3ae87661a80152c815fd4d

SHA1
5950cdc7bcad858380f2c174582681fdeb757aba

SHA256
13e2a2ed3f0ce472218212afcae027947493164b4c4aa7fb6186a90ceb4d9c41

SHA512
f4bb66025e5fde19511715696171f4a516a4f70c7ada660a66307dc805eb6b0dbfd790ddcd399e4237ae66606d38bf8b9fc8db984687feef1d9be92c6ad51045

Download Submit
memory/336-1790-0x00007FF71E750000-0x00007FF71EAA4000-memory.dmp

Filesize
3.3MB

Download
memory/336-1899-0x00007FF71E750000-0x00007FF71EAA4000-memory.dmp

Filesize
3.3MB

Download
memory/336-72-0x00007FF71E750000-0x00007FF71EAA4000-memory.dmp

Filesize
3.3MB

Download
memory/392-198-0x00007FF63DAD0000-0x00007FF63DE24000-memory.dmp

Filesize
3.3MB

Download
memory/404-143-0x00007FF6A4B70000-0x00007FF6A4EC4000-memory.dmp

Filesize
3.3MB

Download
memory/404-2100-0x00007FF6A4B70000-0x00007FF6A4EC4000-memory.dmp

Filesize
3.3MB

Download
memory/496-32-0x00007FF77A980000-0x00007FF77ACD4000-memory.dmp

Filesize
3.3MB

Download
memory/496-1660-0x00007FF77A980000-0x00007FF77ACD4000-memory.dmp

Filesize
3.3MB

Download
memory/496-145-0x00007FF77A980000-0x00007FF77ACD4000-memory.dmp

Filesize
3.3MB

Download
memory/1288-187-0x00007FF65E340000-0x00007FF65E694000-memory.dmp

Filesize
3.3MB

Download
memory/1304-8-0x00007FF7127A0000-0x00007FF712AF4000-memory.dmp

Filesize
3.3MB

Download
memory/1304-1603-0x00007FF7127A0000-0x00007FF712AF4000-memory.dmp

Filesize
3.3MB

Download
memory/1304-96-0x00007FF7127A0000-0x00007FF712AF4000-memory.dmp

Filesize
3.3MB

Download
memory/1568-458-0x00007FF6F5980000-0x00007FF6F5CD4000-memory.dmp

Filesize
3.3MB

Download
memory/1568-1672-0x00007FF6F5980000-0x00007FF6F5CD4000-memory.dmp

Filesize
3.3MB

Download
memory/1568-42-0x00007FF6F5980000-0x00007FF6F5CD4000-memory.dmp

Filesize
3.3MB

Download
memory/1936-60-0x00007FF6BD840000-0x00007FF6BDB94000-memory.dmp

Filesize
3.3MB

Download
memory/1936-1928-0x00007FF6BD840000-0x00007FF6BDB94000-memory.dmp

Filesize
3.3MB

Download
memory/2300-1904-0x00007FF7B4D40000-0x00007FF7B5094000-memory.dmp

Filesize
3.3MB

Download
memory/2300-82-0x00007FF7B4D40000-0x00007FF7B5094000-memory.dmp

Filesize
3.3MB

Download
memory/2408-169-0x00007FF60D850000-0x00007FF60DBA4000-memory.dmp

Filesize
3.3MB

Download
memory/2516-134-0x00007FF70D5E0000-0x00007FF70D934000-memory.dmp

Filesize
3.3MB

Download
memory/2516-2043-0x00007FF70D5E0000-0x00007FF70D934000-memory.dmp

Filesize
3.3MB

Download
memory/2776-125-0x00007FF7495F0000-0x00007FF749944000-memory.dmp

Filesize
3.3MB

Download
memory/2776-2087-0x00007FF7495F0000-0x00007FF749944000-memory.dmp

Filesize
3.3MB

Download
memory/3184-174-0x00007FF6D8870000-0x00007FF6D8BC4000-memory.dmp

Filesize
3.3MB

Download
memory/3184-2348-0x00007FF6D8870000-0x00007FF6D8BC4000-memory.dmp

Filesize
3.3MB

Download
memory/3516-2085-0x00007FF771A10000-0x00007FF771D64000-memory.dmp

Filesize
3.3MB

Download
memory/3516-144-0x00007FF771A10000-0x00007FF771D64000-memory.dmp

Filesize
3.3MB

Download
memory/3852-100-0x00007FF6937F0000-0x00007FF693B44000-memory.dmp

Filesize
3.3MB

Download
memory/3852-1644-0x00007FF6937F0000-0x00007FF693B44000-memory.dmp

Filesize
3.3MB

Download
memory/3852-17-0x00007FF6937F0000-0x00007FF693B44000-memory.dmp

Filesize
3.3MB

Download
memory/3928-83-0x00007FF7CDB40000-0x00007FF7CDE94000-memory.dmp

Filesize
3.3MB

Download
memory/3928-2041-0x00007FF7CDB40000-0x00007FF7CDE94000-memory.dmp

Filesize
3.3MB

Download
memory/4208-136-0x00007FF751910000-0x00007FF751C64000-memory.dmp

Filesize
3.3MB

Download
memory/4208-2051-0x00007FF751910000-0x00007FF751C64000-memory.dmp

Filesize
3.3MB

Download
memory/4344-1880-0x00007FF7D7A40000-0x00007FF7D7D94000-memory.dmp

Filesize
3.3MB

Download
memory/4344-2034-0x00007FF7D7A40000-0x00007FF7D7D94000-memory.dmp

Filesize
3.3MB

Download
memory/4344-84-0x00007FF7D7A40000-0x00007FF7D7D94000-memory.dmp

Filesize
3.3MB

Download
memory/4504-2038-0x00007FF701390000-0x00007FF7016E4000-memory.dmp

Filesize
3.3MB

Download
memory/4504-135-0x00007FF701390000-0x00007FF7016E4000-memory.dmp

Filesize
3.3MB

Download
memory/4584-1659-0x00007FF68F4F0000-0x00007FF68F844000-memory.dmp

Filesize
3.3MB

Download
memory/4584-27-0x00007FF68F4F0000-0x00007FF68F844000-memory.dmp

Filesize
3.3MB

Download
memory/4584-142-0x00007FF68F4F0000-0x00007FF68F844000-memory.dmp

Filesize
3.3MB

Download
memory/4596-0-0x00007FF6F7010000-0x00007FF6F7364000-memory.dmp

Filesize
3.3MB

Download
memory/4596-79-0x00007FF6F7010000-0x00007FF6F7364000-memory.dmp

Filesize
3.3MB

Download
memory/4596-1-0x0000021A484F0000-0x0000021A48500000-memory.dmp

Filesize
64KB

Download
memory/4636-50-0x00007FF6335F0000-0x00007FF633944000-memory.dmp

Filesize
3.3MB

Download
memory/4636-1842-0x00007FF6335F0000-0x00007FF633944000-memory.dmp

Filesize
3.3MB

Download
memory/4740-2064-0x00007FF656E30000-0x00007FF657184000-memory.dmp

Filesize
3.3MB

Download
memory/4740-122-0x00007FF656E30000-0x00007FF657184000-memory.dmp

Filesize
3.3MB

Download
memory/4784-1896-0x00007FF7D4DB0000-0x00007FF7D5104000-memory.dmp

Filesize
3.3MB

Download
memory/4784-77-0x00007FF7D4DB0000-0x00007FF7D5104000-memory.dmp

Filesize
3.3MB

Download
memory/4792-196-0x00007FF651790000-0x00007FF651AE4000-memory.dmp

Filesize
3.3MB

Download
memory/4848-1679-0x00007FF6BEAB0000-0x00007FF6BEE04000-memory.dmp

Filesize
3.3MB

Download
memory/4848-180-0x00007FF6BEAB0000-0x00007FF6BEE04000-memory.dmp

Filesize
3.3MB

Download
memory/4848-38-0x00007FF6BEAB0000-0x00007FF6BEE04000-memory.dmp

Filesize
3.3MB

Download
memory/4904-2139-0x00007FF76E130000-0x00007FF76E484000-memory.dmp

Filesize
3.3MB

Download
memory/4904-141-0x00007FF76E130000-0x00007FF76E484000-memory.dmp

Filesize
3.3MB

Download
memory/5032-131-0x00007FF7F89C0000-0x00007FF7F8D14000-memory.dmp

Filesize
3.3MB

Download
memory/5032-1652-0x00007FF7F89C0000-0x00007FF7F8D14000-memory.dmp

Filesize
3.3MB

Download
memory/5032-26-0x00007FF7F89C0000-0x00007FF7F8D14000-memory.dmp

Filesize
3.3MB

Download
memory/5084-2049-0x00007FF762040000-0x00007FF762394000-memory.dmp

Filesize
3.3MB

Download
memory/5084-120-0x00007FF762040000-0x00007FF762394000-memory.dmp

Filesize
3.3MB

Download
memory/5088-199-0x00007FF792F90000-0x00007FF7932E4000-memory.dmp

Filesize
3.3MB

Download
memory/5088-2401-0x00007FF792F90000-0x00007FF7932E4000-memory.dmp

Filesize
3.3MB

Download