xmrig | 8565577bee2c556a3a96f4fa16ed2c2b0984cff288bfbc6a8a2fd1e6f8de6edc

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
Size

1.6MB
MD5

bd51cc42e6b832d1800a0f88dc3da110
SHA1

8bc9fc82091d293eee423a15e88decff2fff8e00
SHA256

8565577bee2c556a3a96f4fa16ed2c2b0984cff288bfbc6a8a2fd1e6f8de6edc
SHA512

26adce8fa2846af813e6c57574ec46482c70f6115813b2142c732e0aeb2649227a583c1b5da6a628443acc72281b167f6446323c18dc84657bdcca98dadc1b12
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727F15qbrund+fT+xLTlHLnEPr33Il+8F37XeB9bxO/Q:ROdWCCi7/rahlqOdg6VLEL3e7PI

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/2788-404-0x00007FF6EFF00000-0x00007FF6F0251000-memory.dmp	xmrig
behavioral2/memory/8-419-0x00007FF64C360000-0x00007FF64C6B1000-memory.dmp	xmrig
behavioral2/memory/2560-467-0x00007FF659210000-0x00007FF659561000-memory.dmp	xmrig
behavioral2/memory/1336-474-0x00007FF7BCF00000-0x00007FF7BD251000-memory.dmp	xmrig
behavioral2/memory/4868-475-0x00007FF6B89B0000-0x00007FF6B8D01000-memory.dmp	xmrig
behavioral2/memory/1060-473-0x00007FF671460000-0x00007FF6717B1000-memory.dmp	xmrig
behavioral2/memory/1032-472-0x00007FF76B710000-0x00007FF76BA61000-memory.dmp	xmrig
behavioral2/memory/1068-471-0x00007FF6C5BC0000-0x00007FF6C5F11000-memory.dmp	xmrig
behavioral2/memory/3520-470-0x00007FF7EC4F0000-0x00007FF7EC841000-memory.dmp	xmrig
behavioral2/memory/1872-469-0x00007FF7BDCC0000-0x00007FF7BE011000-memory.dmp	xmrig
behavioral2/memory/4148-468-0x00007FF70E4F0000-0x00007FF70E841000-memory.dmp	xmrig
behavioral2/memory/5052-461-0x00007FF67B5B0000-0x00007FF67B901000-memory.dmp	xmrig
behavioral2/memory/4644-460-0x00007FF6BC7D0000-0x00007FF6BCB21000-memory.dmp	xmrig
behavioral2/memory/4496-403-0x00007FF676A60000-0x00007FF676DB1000-memory.dmp	xmrig
behavioral2/memory/1492-369-0x00007FF798280000-0x00007FF7985D1000-memory.dmp	xmrig
behavioral2/memory/2196-322-0x00007FF6BD290000-0x00007FF6BD5E1000-memory.dmp	xmrig
behavioral2/memory/5020-321-0x00007FF6DD830000-0x00007FF6DDB81000-memory.dmp	xmrig
behavioral2/memory/2688-289-0x00007FF6E4130000-0x00007FF6E4481000-memory.dmp	xmrig
behavioral2/memory/3572-271-0x00007FF6050B0000-0x00007FF605401000-memory.dmp	xmrig
behavioral2/memory/3188-238-0x00007FF68AC70000-0x00007FF68AFC1000-memory.dmp	xmrig
behavioral2/memory/1284-235-0x00007FF7685F0000-0x00007FF768941000-memory.dmp	xmrig
behavioral2/memory/944-193-0x00007FF720540000-0x00007FF720891000-memory.dmp	xmrig
behavioral2/memory/1224-156-0x00007FF7A5350000-0x00007FF7A56A1000-memory.dmp	xmrig
behavioral2/memory/4388-155-0x00007FF7EB080000-0x00007FF7EB3D1000-memory.dmp	xmrig
behavioral2/memory/2904-119-0x00007FF73C540000-0x00007FF73C891000-memory.dmp	xmrig
behavioral2/memory/1480-62-0x00007FF7F02F0000-0x00007FF7F0641000-memory.dmp	xmrig
behavioral2/memory/1836-2105-0x00007FF68C830000-0x00007FF68CB81000-memory.dmp	xmrig
behavioral2/memory/4736-2221-0x00007FF73E480000-0x00007FF73E7D1000-memory.dmp	xmrig
behavioral2/memory/2156-2223-0x00007FF629730000-0x00007FF629A81000-memory.dmp	xmrig
behavioral2/memory/220-2225-0x00007FF7C0A40000-0x00007FF7C0D91000-memory.dmp	xmrig
behavioral2/memory/2156-2238-0x00007FF629730000-0x00007FF629A81000-memory.dmp	xmrig
behavioral2/memory/4736-2240-0x00007FF73E480000-0x00007FF73E7D1000-memory.dmp	xmrig
behavioral2/memory/4388-2247-0x00007FF7EB080000-0x00007FF7EB3D1000-memory.dmp	xmrig
behavioral2/memory/1480-2245-0x00007FF7F02F0000-0x00007FF7F0641000-memory.dmp	xmrig
behavioral2/memory/3520-2252-0x00007FF7EC4F0000-0x00007FF7EC841000-memory.dmp	xmrig
behavioral2/memory/5020-2254-0x00007FF6DD830000-0x00007FF6DDB81000-memory.dmp	xmrig
behavioral2/memory/1224-2256-0x00007FF7A5350000-0x00007FF7A56A1000-memory.dmp	xmrig
behavioral2/memory/2904-2250-0x00007FF73C540000-0x00007FF73C891000-memory.dmp	xmrig
behavioral2/memory/1284-2249-0x00007FF7685F0000-0x00007FF768941000-memory.dmp	xmrig
behavioral2/memory/1068-2243-0x00007FF6C5BC0000-0x00007FF6C5F11000-memory.dmp	xmrig
behavioral2/memory/1032-2258-0x00007FF76B710000-0x00007FF76BA61000-memory.dmp	xmrig
behavioral2/memory/5052-2298-0x00007FF67B5B0000-0x00007FF67B901000-memory.dmp	xmrig
behavioral2/memory/4148-2296-0x00007FF70E4F0000-0x00007FF70E841000-memory.dmp	xmrig
behavioral2/memory/2196-2294-0x00007FF6BD290000-0x00007FF6BD5E1000-memory.dmp	xmrig
behavioral2/memory/2788-2292-0x00007FF6EFF00000-0x00007FF6F0251000-memory.dmp	xmrig
behavioral2/memory/1060-2286-0x00007FF671460000-0x00007FF6717B1000-memory.dmp	xmrig
behavioral2/memory/1336-2283-0x00007FF7BCF00000-0x00007FF7BD251000-memory.dmp	xmrig
behavioral2/memory/944-2281-0x00007FF720540000-0x00007FF720891000-memory.dmp	xmrig
behavioral2/memory/4496-2280-0x00007FF676A60000-0x00007FF676DB1000-memory.dmp	xmrig
behavioral2/memory/3188-2276-0x00007FF68AC70000-0x00007FF68AFC1000-memory.dmp	xmrig
behavioral2/memory/3572-2274-0x00007FF6050B0000-0x00007FF605401000-memory.dmp	xmrig
behavioral2/memory/4868-2272-0x00007FF6B89B0000-0x00007FF6B8D01000-memory.dmp	xmrig
behavioral2/memory/1872-2290-0x00007FF7BDCC0000-0x00007FF7BE011000-memory.dmp	xmrig
behavioral2/memory/2688-2265-0x00007FF6E4130000-0x00007FF6E4481000-memory.dmp	xmrig
behavioral2/memory/2560-2263-0x00007FF659210000-0x00007FF659561000-memory.dmp	xmrig
behavioral2/memory/8-2278-0x00007FF64C360000-0x00007FF64C6B1000-memory.dmp	xmrig
behavioral2/memory/1492-2270-0x00007FF798280000-0x00007FF7985D1000-memory.dmp	xmrig
behavioral2/memory/4644-2266-0x00007FF6BC7D0000-0x00007FF6BCB21000-memory.dmp	xmrig
behavioral2/memory/220-2261-0x00007FF7C0A40000-0x00007FF7C0D91000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4736	WqscTSS.exe
2156	TuYgQjG.exe
3520	hVgoZUO.exe
1480	EsSdzeB.exe
220	SEYxftU.exe
1068	mJclguU.exe
2904	LscjugA.exe
4388	RFcKqAk.exe
1224	gHmYikB.exe
944	SwzysiL.exe
1032	qbwgwSM.exe
1060	wGKZWPu.exe
1284	oMkdAiq.exe
3188	pmfcSKV.exe
3572	XNcapTk.exe
2688	xfYVWyO.exe
5020	ObkxZjX.exe
1336	TaNgvcN.exe
2196	OBciGMJ.exe
1492	ebOVleI.exe
4496	TpysrAD.exe
2788	efsvsWs.exe
8	iSEMGiX.exe
4644	pGQNTbZ.exe
5052	LMdHfiE.exe
2560	hgCqahN.exe
4868	zReyzXg.exe
4148	CyhBsfa.exe
1872	fWSZcgH.exe
3016	LZYaEnt.exe
1508	KFWikoe.exe
1484	KgCHXzO.exe
4940	NbXegua.exe
4600	TzfqpXU.exe
1680	UYxifXd.exe
1660	jpmxdCB.exe
800	VTESgKL.exe
1640	SxBYcEE.exe
3528	pmEuFgL.exe
1608	mMZTPHG.exe
1216	cbrcdVU.exe
4392	ctovPds.exe
3764	KebTxLt.exe
4152	idOQUWZ.exe
2304	rtPsmCw.exe
2152	psHfPyJ.exe
2160	zzxJAMM.exe
4836	cfUNVLe.exe
2388	ztOXobp.exe
4848	SvJvYyl.exe
2000	AMdPBlh.exe
4976	JueMIsq.exe
3148	oLNYYtg.exe
3064	apfuCqT.exe
2684	ONBafEG.exe
1896	kDPZoei.exe
4356	TeAnBZg.exe
4336	inYTQAz.exe
2648	VXXGYNt.exe
4376	ymjAUMQ.exe
3112	dcxRCGi.exe
4640	AXIbRkp.exe
3316	ndZiPOQ.exe
404	cjtMfwP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1836-0-0x00007FF68C830000-0x00007FF68CB81000-memory.dmp	upx
behavioral2/files/0x0007000000023404-8.dat	upx
behavioral2/files/0x0007000000023414-150.dat	upx
behavioral2/memory/2788-404-0x00007FF6EFF00000-0x00007FF6F0251000-memory.dmp	upx
behavioral2/memory/8-419-0x00007FF64C360000-0x00007FF64C6B1000-memory.dmp	upx
behavioral2/memory/2560-467-0x00007FF659210000-0x00007FF659561000-memory.dmp	upx
behavioral2/memory/1336-474-0x00007FF7BCF00000-0x00007FF7BD251000-memory.dmp	upx
behavioral2/memory/4868-475-0x00007FF6B89B0000-0x00007FF6B8D01000-memory.dmp	upx
behavioral2/memory/1060-473-0x00007FF671460000-0x00007FF6717B1000-memory.dmp	upx
behavioral2/memory/1032-472-0x00007FF76B710000-0x00007FF76BA61000-memory.dmp	upx
behavioral2/memory/1068-471-0x00007FF6C5BC0000-0x00007FF6C5F11000-memory.dmp	upx
behavioral2/memory/3520-470-0x00007FF7EC4F0000-0x00007FF7EC841000-memory.dmp	upx
behavioral2/memory/1872-469-0x00007FF7BDCC0000-0x00007FF7BE011000-memory.dmp	upx
behavioral2/memory/4148-468-0x00007FF70E4F0000-0x00007FF70E841000-memory.dmp	upx
behavioral2/memory/5052-461-0x00007FF67B5B0000-0x00007FF67B901000-memory.dmp	upx
behavioral2/memory/4644-460-0x00007FF6BC7D0000-0x00007FF6BCB21000-memory.dmp	upx
behavioral2/memory/4496-403-0x00007FF676A60000-0x00007FF676DB1000-memory.dmp	upx
behavioral2/memory/1492-369-0x00007FF798280000-0x00007FF7985D1000-memory.dmp	upx
behavioral2/memory/2196-322-0x00007FF6BD290000-0x00007FF6BD5E1000-memory.dmp	upx
behavioral2/memory/5020-321-0x00007FF6DD830000-0x00007FF6DDB81000-memory.dmp	upx
behavioral2/memory/2688-289-0x00007FF6E4130000-0x00007FF6E4481000-memory.dmp	upx
behavioral2/memory/3572-271-0x00007FF6050B0000-0x00007FF605401000-memory.dmp	upx
behavioral2/memory/3188-238-0x00007FF68AC70000-0x00007FF68AFC1000-memory.dmp	upx
behavioral2/memory/1284-235-0x00007FF7685F0000-0x00007FF768941000-memory.dmp	upx
behavioral2/memory/944-193-0x00007FF720540000-0x00007FF720891000-memory.dmp	upx
behavioral2/files/0x0007000000023429-188.dat	upx
behavioral2/files/0x0007000000023421-185.dat	upx
behavioral2/files/0x0007000000023428-183.dat	upx
behavioral2/files/0x000700000002341f-177.dat	upx
behavioral2/files/0x0007000000023412-175.dat	upx
behavioral2/files/0x0007000000023426-174.dat	upx
behavioral2/files/0x0007000000023425-170.dat	upx
behavioral2/files/0x0007000000023410-165.dat	upx
behavioral2/files/0x0007000000023423-160.dat	upx
behavioral2/files/0x0007000000023422-159.dat	upx
behavioral2/files/0x0007000000023415-157.dat	upx
behavioral2/memory/1224-156-0x00007FF7A5350000-0x00007FF7A56A1000-memory.dmp	upx
behavioral2/memory/4388-155-0x00007FF7EB080000-0x00007FF7EB3D1000-memory.dmp	upx
behavioral2/files/0x0007000000023413-145.dat	upx
behavioral2/files/0x0007000000023420-143.dat	upx
behavioral2/files/0x0007000000023427-180.dat	upx
behavioral2/files/0x0007000000023419-139.dat	upx
behavioral2/files/0x000700000002341e-137.dat	upx
behavioral2/files/0x000700000002341d-129.dat	upx
behavioral2/files/0x0007000000023411-163.dat	upx
behavioral2/files/0x0007000000023424-161.dat	upx
behavioral2/files/0x0007000000023417-123.dat	upx
behavioral2/files/0x000700000002340e-122.dat	upx
behavioral2/memory/2904-119-0x00007FF73C540000-0x00007FF73C891000-memory.dmp	upx
behavioral2/files/0x000700000002341c-118.dat	upx
behavioral2/files/0x000700000002341b-117.dat	upx
behavioral2/files/0x000700000002340d-112.dat	upx
behavioral2/files/0x0007000000023418-102.dat	upx
behavioral2/files/0x000700000002340c-130.dat	upx
behavioral2/files/0x000700000002340b-95.dat	upx
behavioral2/memory/220-94-0x00007FF7C0A40000-0x00007FF7C0D91000-memory.dmp	upx
behavioral2/files/0x0007000000023416-88.dat	upx
behavioral2/files/0x000700000002341a-116.dat	upx
behavioral2/files/0x0007000000023409-76.dat	upx
behavioral2/files/0x000700000002340f-71.dat	upx
behavioral2/memory/1480-62-0x00007FF7F02F0000-0x00007FF7F0641000-memory.dmp	upx
behavioral2/files/0x000700000002340a-82.dat	upx
behavioral2/files/0x0007000000023407-56.dat	upx
behavioral2/memory/2156-50-0x00007FF629730000-0x00007FF629A81000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TAGrJnf.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\YePlFZF.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\oFayuYP.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\rQecepQ.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\mtfmJmn.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\BUVerCq.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\CgcpzeB.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\fWJsdXD.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\QgWZsna.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\TuYgQjG.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\zReyzXg.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\XrHtpbe.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\xovpSII.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\hxtCFWy.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\VFPvLOo.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\ztOXobp.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\swLVzem.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\vRMAFTJ.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\qifLjcR.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\gBKeVSR.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\OBciGMJ.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\gIoRvjh.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\UsaYbME.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\snnEgRu.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\yQqLhap.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\tJqCUwG.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\KcFXMvZ.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\uNsAbMW.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\psHfPyJ.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\WImpkWj.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\MNbqYqA.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\kCjMrax.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\AQcssdv.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\wRkZnpB.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\jYgUPtI.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\wtrKDCF.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\qhdpSzU.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\ISXWEnZ.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\sLjeeUI.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\jlDjvqU.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\CyhBsfa.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\huZYWQI.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\EGFLxkI.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\RQuMCDR.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\VaYowRX.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\LNbOvHk.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\hEqqaKV.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\hgRQrmn.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\CdCUaOB.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\RhABDAu.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\KFWikoe.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\HFwSFug.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\uznbyMr.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\gqGMCAx.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\TBQMWFs.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\FmAMVwF.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\KMNDktP.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\jjuQtov.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\QhKUcnC.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\TqDEYQm.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\aEWegOP.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\UYxifXd.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\tUMihwV.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
File created	C:\Windows\System\JpPOJjN.exe	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4736	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	84
PID 1836 wrote to memory of 4736	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	84
PID 1836 wrote to memory of 2156	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	85
PID 1836 wrote to memory of 2156	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	85
PID 1836 wrote to memory of 3520	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	86
PID 1836 wrote to memory of 3520	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	86
PID 1836 wrote to memory of 1480	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	87
PID 1836 wrote to memory of 1480	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	87
PID 1836 wrote to memory of 220	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	88
PID 1836 wrote to memory of 220	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	88
PID 1836 wrote to memory of 1068	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	89
PID 1836 wrote to memory of 1068	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	89
PID 1836 wrote to memory of 2904	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	90
PID 1836 wrote to memory of 2904	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	90
PID 1836 wrote to memory of 4388	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	91
PID 1836 wrote to memory of 4388	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	91
PID 1836 wrote to memory of 1224	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	92
PID 1836 wrote to memory of 1224	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	92
PID 1836 wrote to memory of 944	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	93
PID 1836 wrote to memory of 944	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	93
PID 1836 wrote to memory of 1032	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	94
PID 1836 wrote to memory of 1032	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	94
PID 1836 wrote to memory of 1060	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	95
PID 1836 wrote to memory of 1060	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	95
PID 1836 wrote to memory of 1284	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	96
PID 1836 wrote to memory of 1284	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	96
PID 1836 wrote to memory of 2196	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	97
PID 1836 wrote to memory of 2196	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	97
PID 1836 wrote to memory of 1492	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	98
PID 1836 wrote to memory of 1492	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	98
PID 1836 wrote to memory of 2788	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	99
PID 1836 wrote to memory of 2788	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	99
PID 1836 wrote to memory of 3188	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	100
PID 1836 wrote to memory of 3188	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	100
PID 1836 wrote to memory of 3572	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	101
PID 1836 wrote to memory of 3572	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	101
PID 1836 wrote to memory of 2688	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	102
PID 1836 wrote to memory of 2688	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	102
PID 1836 wrote to memory of 5020	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	103
PID 1836 wrote to memory of 5020	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	103
PID 1836 wrote to memory of 1336	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	104
PID 1836 wrote to memory of 1336	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	104
PID 1836 wrote to memory of 4496	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	105
PID 1836 wrote to memory of 4496	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	105
PID 1836 wrote to memory of 8	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	106
PID 1836 wrote to memory of 8	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	106
PID 1836 wrote to memory of 4644	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	107
PID 1836 wrote to memory of 4644	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	107
PID 1836 wrote to memory of 5052	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	108
PID 1836 wrote to memory of 5052	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	108
PID 1836 wrote to memory of 2560	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	109
PID 1836 wrote to memory of 2560	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	109
PID 1836 wrote to memory of 4868	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	110
PID 1836 wrote to memory of 4868	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	110
PID 1836 wrote to memory of 4148	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	111
PID 1836 wrote to memory of 4148	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	111
PID 1836 wrote to memory of 1872	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	112
PID 1836 wrote to memory of 1872	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	112
PID 1836 wrote to memory of 3016	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	113
PID 1836 wrote to memory of 3016	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	113
PID 1836 wrote to memory of 1508	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	114
PID 1836 wrote to memory of 1508	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	114
PID 1836 wrote to memory of 1484	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	115
PID 1836 wrote to memory of 1484	1836	bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bd51cc42e6b832d1800a0f88dc3da110_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\System\WqscTSS.exe
  C:\Windows\System\WqscTSS.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\TuYgQjG.exe
  C:\Windows\System\TuYgQjG.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\hVgoZUO.exe
  C:\Windows\System\hVgoZUO.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\EsSdzeB.exe
  C:\Windows\System\EsSdzeB.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\SEYxftU.exe
  C:\Windows\System\SEYxftU.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\mJclguU.exe
  C:\Windows\System\mJclguU.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\LscjugA.exe
  C:\Windows\System\LscjugA.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\RFcKqAk.exe
  C:\Windows\System\RFcKqAk.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\gHmYikB.exe
  C:\Windows\System\gHmYikB.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\SwzysiL.exe
  C:\Windows\System\SwzysiL.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\qbwgwSM.exe
  C:\Windows\System\qbwgwSM.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\wGKZWPu.exe
  C:\Windows\System\wGKZWPu.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\oMkdAiq.exe
  C:\Windows\System\oMkdAiq.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\OBciGMJ.exe
  C:\Windows\System\OBciGMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\ebOVleI.exe
  C:\Windows\System\ebOVleI.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\efsvsWs.exe
  C:\Windows\System\efsvsWs.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\pmfcSKV.exe
  C:\Windows\System\pmfcSKV.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\XNcapTk.exe
  C:\Windows\System\XNcapTk.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\xfYVWyO.exe
  C:\Windows\System\xfYVWyO.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ObkxZjX.exe
  C:\Windows\System\ObkxZjX.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\TaNgvcN.exe
  C:\Windows\System\TaNgvcN.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\TpysrAD.exe
  C:\Windows\System\TpysrAD.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\iSEMGiX.exe
  C:\Windows\System\iSEMGiX.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\pGQNTbZ.exe
  C:\Windows\System\pGQNTbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\LMdHfiE.exe
  C:\Windows\System\LMdHfiE.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\hgCqahN.exe
  C:\Windows\System\hgCqahN.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\zReyzXg.exe
  C:\Windows\System\zReyzXg.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\CyhBsfa.exe
  C:\Windows\System\CyhBsfa.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\fWSZcgH.exe
  C:\Windows\System\fWSZcgH.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\LZYaEnt.exe
  C:\Windows\System\LZYaEnt.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\KFWikoe.exe
  C:\Windows\System\KFWikoe.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\KgCHXzO.exe
  C:\Windows\System\KgCHXzO.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\NbXegua.exe
  C:\Windows\System\NbXegua.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\TzfqpXU.exe
  C:\Windows\System\TzfqpXU.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\UYxifXd.exe
  C:\Windows\System\UYxifXd.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\jpmxdCB.exe
  C:\Windows\System\jpmxdCB.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\VTESgKL.exe
  C:\Windows\System\VTESgKL.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\SxBYcEE.exe
  C:\Windows\System\SxBYcEE.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\pmEuFgL.exe
  C:\Windows\System\pmEuFgL.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\mMZTPHG.exe
  C:\Windows\System\mMZTPHG.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\cbrcdVU.exe
  C:\Windows\System\cbrcdVU.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\ctovPds.exe
  C:\Windows\System\ctovPds.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\KebTxLt.exe
  C:\Windows\System\KebTxLt.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\idOQUWZ.exe
  C:\Windows\System\idOQUWZ.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\rtPsmCw.exe
  C:\Windows\System\rtPsmCw.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\psHfPyJ.exe
  C:\Windows\System\psHfPyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\zzxJAMM.exe
  C:\Windows\System\zzxJAMM.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\cfUNVLe.exe
  C:\Windows\System\cfUNVLe.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\ndZiPOQ.exe
  C:\Windows\System\ndZiPOQ.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\ztOXobp.exe
  C:\Windows\System\ztOXobp.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\SvJvYyl.exe
  C:\Windows\System\SvJvYyl.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\gObtkre.exe
  C:\Windows\System\gObtkre.exe
  2⤵
  PID:3868
- C:\Windows\System\AMdPBlh.exe
  C:\Windows\System\AMdPBlh.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\JueMIsq.exe
  C:\Windows\System\JueMIsq.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\oLNYYtg.exe
  C:\Windows\System\oLNYYtg.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\apfuCqT.exe
  C:\Windows\System\apfuCqT.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ONBafEG.exe
  C:\Windows\System\ONBafEG.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\kDPZoei.exe
  C:\Windows\System\kDPZoei.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\bVtDEyl.exe
  C:\Windows\System\bVtDEyl.exe
  2⤵
  PID:1420
- C:\Windows\System\bpQlHEg.exe
  C:\Windows\System\bpQlHEg.exe
  2⤵
  PID:2140
- C:\Windows\System\TeAnBZg.exe
  C:\Windows\System\TeAnBZg.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\inYTQAz.exe
  C:\Windows\System\inYTQAz.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\VXXGYNt.exe
  C:\Windows\System\VXXGYNt.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\ymjAUMQ.exe
  C:\Windows\System\ymjAUMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\dcxRCGi.exe
  C:\Windows\System\dcxRCGi.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\AXIbRkp.exe
  C:\Windows\System\AXIbRkp.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\cjtMfwP.exe
  C:\Windows\System\cjtMfwP.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\zixllxo.exe
  C:\Windows\System\zixllxo.exe
  2⤵
  PID:1288
- C:\Windows\System\EUaEnPx.exe
  C:\Windows\System\EUaEnPx.exe
  2⤵
  PID:4488
- C:\Windows\System\zpIYupO.exe
  C:\Windows\System\zpIYupO.exe
  2⤵
  PID:3576
- C:\Windows\System\LMtlFyd.exe
  C:\Windows\System\LMtlFyd.exe
  2⤵
  PID:1620
- C:\Windows\System\zNvWMde.exe
  C:\Windows\System\zNvWMde.exe
  2⤵
  PID:2812
- C:\Windows\System\jROSPtH.exe
  C:\Windows\System\jROSPtH.exe
  2⤵
  PID:4972
- C:\Windows\System\deyZReJ.exe
  C:\Windows\System\deyZReJ.exe
  2⤵
  PID:1956
- C:\Windows\System\FuVMEEZ.exe
  C:\Windows\System\FuVMEEZ.exe
  2⤵
  PID:3620
- C:\Windows\System\gIoRvjh.exe
  C:\Windows\System\gIoRvjh.exe
  2⤵
  PID:1160
- C:\Windows\System\cYhqypO.exe
  C:\Windows\System\cYhqypO.exe
  2⤵
  PID:2660
- C:\Windows\System\qhdpSzU.exe
  C:\Windows\System\qhdpSzU.exe
  2⤵
  PID:884
- C:\Windows\System\IucLrYB.exe
  C:\Windows\System\IucLrYB.exe
  2⤵
  PID:4348
- C:\Windows\System\huZYWQI.exe
  C:\Windows\System\huZYWQI.exe
  2⤵
  PID:3416
- C:\Windows\System\jlDjvqU.exe
  C:\Windows\System\jlDjvqU.exe
  2⤵
  PID:1400
- C:\Windows\System\HFwSFug.exe
  C:\Windows\System\HFwSFug.exe
  2⤵
  PID:5224
- C:\Windows\System\VDTjtuF.exe
  C:\Windows\System\VDTjtuF.exe
  2⤵
  PID:5248
- C:\Windows\System\tpQNTXD.exe
  C:\Windows\System\tpQNTXD.exe
  2⤵
  PID:5272
- C:\Windows\System\ChFLKYq.exe
  C:\Windows\System\ChFLKYq.exe
  2⤵
  PID:5288
- C:\Windows\System\OjZKdip.exe
  C:\Windows\System\OjZKdip.exe
  2⤵
  PID:5312
- C:\Windows\System\NlhhkFl.exe
  C:\Windows\System\NlhhkFl.exe
  2⤵
  PID:5336
- C:\Windows\System\ZOOJgSH.exe
  C:\Windows\System\ZOOJgSH.exe
  2⤵
  PID:5368
- C:\Windows\System\tFFgYFG.exe
  C:\Windows\System\tFFgYFG.exe
  2⤵
  PID:5420
- C:\Windows\System\bXSavsk.exe
  C:\Windows\System\bXSavsk.exe
  2⤵
  PID:5448
- C:\Windows\System\mhVbfwz.exe
  C:\Windows\System\mhVbfwz.exe
  2⤵
  PID:5524
- C:\Windows\System\FmAMVwF.exe
  C:\Windows\System\FmAMVwF.exe
  2⤵
  PID:5540
- C:\Windows\System\WjHLlxf.exe
  C:\Windows\System\WjHLlxf.exe
  2⤵
  PID:5564
- C:\Windows\System\dcCcQLC.exe
  C:\Windows\System\dcCcQLC.exe
  2⤵
  PID:5592
- C:\Windows\System\SyaaxZY.exe
  C:\Windows\System\SyaaxZY.exe
  2⤵
  PID:5608
- C:\Windows\System\emBjrOl.exe
  C:\Windows\System\emBjrOl.exe
  2⤵
  PID:5628
- C:\Windows\System\bWxhaAI.exe
  C:\Windows\System\bWxhaAI.exe
  2⤵
  PID:5644
- C:\Windows\System\vpBTiDJ.exe
  C:\Windows\System\vpBTiDJ.exe
  2⤵
  PID:5664
- C:\Windows\System\DAYNVlp.exe
  C:\Windows\System\DAYNVlp.exe
  2⤵
  PID:5680
- C:\Windows\System\wsSauOt.exe
  C:\Windows\System\wsSauOt.exe
  2⤵
  PID:5700
- C:\Windows\System\YTttoNd.exe
  C:\Windows\System\YTttoNd.exe
  2⤵
  PID:5728
- C:\Windows\System\ZGqNCwn.exe
  C:\Windows\System\ZGqNCwn.exe
  2⤵
  PID:5744
- C:\Windows\System\FCrtdWk.exe
  C:\Windows\System\FCrtdWk.exe
  2⤵
  PID:5768
- C:\Windows\System\nWZyCLX.exe
  C:\Windows\System\nWZyCLX.exe
  2⤵
  PID:5784
- C:\Windows\System\YtFtcKy.exe
  C:\Windows\System\YtFtcKy.exe
  2⤵
  PID:5808
- C:\Windows\System\RHLGqGm.exe
  C:\Windows\System\RHLGqGm.exe
  2⤵
  PID:5828
- C:\Windows\System\OVtTjaD.exe
  C:\Windows\System\OVtTjaD.exe
  2⤵
  PID:5848
- C:\Windows\System\HjgfHaL.exe
  C:\Windows\System\HjgfHaL.exe
  2⤵
  PID:5964
- C:\Windows\System\mDWYQJo.exe
  C:\Windows\System\mDWYQJo.exe
  2⤵
  PID:5980
- C:\Windows\System\BvXRMRA.exe
  C:\Windows\System\BvXRMRA.exe
  2⤵
  PID:6008
- C:\Windows\System\jIbkyQE.exe
  C:\Windows\System\jIbkyQE.exe
  2⤵
  PID:6040
- C:\Windows\System\oOZnmqf.exe
  C:\Windows\System\oOZnmqf.exe
  2⤵
  PID:6060
- C:\Windows\System\nZizwAF.exe
  C:\Windows\System\nZizwAF.exe
  2⤵
  PID:6076
- C:\Windows\System\WXQldxH.exe
  C:\Windows\System\WXQldxH.exe
  2⤵
  PID:6096
- C:\Windows\System\lxKxXFv.exe
  C:\Windows\System\lxKxXFv.exe
  2⤵
  PID:6116
- C:\Windows\System\NBUnGJg.exe
  C:\Windows\System\NBUnGJg.exe
  2⤵
  PID:6136
- C:\Windows\System\EnCrCJb.exe
  C:\Windows\System\EnCrCJb.exe
  2⤵
  PID:2628
- C:\Windows\System\WSiuRdF.exe
  C:\Windows\System\WSiuRdF.exe
  2⤵
  PID:3944
- C:\Windows\System\gFMlLEC.exe
  C:\Windows\System\gFMlLEC.exe
  2⤵
  PID:1916
- C:\Windows\System\VaYowRX.exe
  C:\Windows\System\VaYowRX.exe
  2⤵
  PID:3844
- C:\Windows\System\JpPOJjN.exe
  C:\Windows\System\JpPOJjN.exe
  2⤵
  PID:2044
- C:\Windows\System\ISXWEnZ.exe
  C:\Windows\System\ISXWEnZ.exe
  2⤵
  PID:3020
- C:\Windows\System\PhEUKlJ.exe
  C:\Windows\System\PhEUKlJ.exe
  2⤵
  PID:4968
- C:\Windows\System\mZywugz.exe
  C:\Windows\System\mZywugz.exe
  2⤵
  PID:5324
- C:\Windows\System\FUjwaSM.exe
  C:\Windows\System\FUjwaSM.exe
  2⤵
  PID:5380
- C:\Windows\System\ZtNMNsX.exe
  C:\Windows\System\ZtNMNsX.exe
  2⤵
  PID:2392
- C:\Windows\System\gBEaolN.exe
  C:\Windows\System\gBEaolN.exe
  2⤵
  PID:4504
- C:\Windows\System\TYOVKpY.exe
  C:\Windows\System\TYOVKpY.exe
  2⤵
  PID:228
- C:\Windows\System\lMAKnVU.exe
  C:\Windows\System\lMAKnVU.exe
  2⤵
  PID:3372
- C:\Windows\System\AfgnmLp.exe
  C:\Windows\System\AfgnmLp.exe
  2⤵
  PID:5268
- C:\Windows\System\vICVhZl.exe
  C:\Windows\System\vICVhZl.exe
  2⤵
  PID:5780
- C:\Windows\System\SPpQZbG.exe
  C:\Windows\System\SPpQZbG.exe
  2⤵
  PID:5860
- C:\Windows\System\YgLNlnf.exe
  C:\Windows\System\YgLNlnf.exe
  2⤵
  PID:5140
- C:\Windows\System\dMezMfn.exe
  C:\Windows\System\dMezMfn.exe
  2⤵
  PID:5208
- C:\Windows\System\gTHblwC.exe
  C:\Windows\System\gTHblwC.exe
  2⤵
  PID:5284
- C:\Windows\System\jYJLvpF.exe
  C:\Windows\System\jYJLvpF.exe
  2⤵
  PID:6032
- C:\Windows\System\vSvXLjN.exe
  C:\Windows\System\vSvXLjN.exe
  2⤵
  PID:5436
- C:\Windows\System\vkkMPcw.exe
  C:\Windows\System\vkkMPcw.exe
  2⤵
  PID:6228
- C:\Windows\System\bRehsIw.exe
  C:\Windows\System\bRehsIw.exe
  2⤵
  PID:6244
- C:\Windows\System\iJgdfzb.exe
  C:\Windows\System\iJgdfzb.exe
  2⤵
  PID:6260
- C:\Windows\System\WFWVMKl.exe
  C:\Windows\System\WFWVMKl.exe
  2⤵
  PID:6276
- C:\Windows\System\qzUbJLj.exe
  C:\Windows\System\qzUbJLj.exe
  2⤵
  PID:6292
- C:\Windows\System\KfOjsRn.exe
  C:\Windows\System\KfOjsRn.exe
  2⤵
  PID:6308
- C:\Windows\System\vlRCgQe.exe
  C:\Windows\System\vlRCgQe.exe
  2⤵
  PID:6324
- C:\Windows\System\dPtVYmf.exe
  C:\Windows\System\dPtVYmf.exe
  2⤵
  PID:6340
- C:\Windows\System\BuMOlYo.exe
  C:\Windows\System\BuMOlYo.exe
  2⤵
  PID:6356
- C:\Windows\System\YjmnZYq.exe
  C:\Windows\System\YjmnZYq.exe
  2⤵
  PID:6372
- C:\Windows\System\RhtDAYv.exe
  C:\Windows\System\RhtDAYv.exe
  2⤵
  PID:6388
- C:\Windows\System\QpeKBho.exe
  C:\Windows\System\QpeKBho.exe
  2⤵
  PID:6404
- C:\Windows\System\qzvyxpK.exe
  C:\Windows\System\qzvyxpK.exe
  2⤵
  PID:6420
- C:\Windows\System\RuvSUUj.exe
  C:\Windows\System\RuvSUUj.exe
  2⤵
  PID:6436
- C:\Windows\System\nmgzqkH.exe
  C:\Windows\System\nmgzqkH.exe
  2⤵
  PID:6480
- C:\Windows\System\FQbkzzx.exe
  C:\Windows\System\FQbkzzx.exe
  2⤵
  PID:6540
- C:\Windows\System\BTWbZKd.exe
  C:\Windows\System\BTWbZKd.exe
  2⤵
  PID:6584
- C:\Windows\System\vNvBvfv.exe
  C:\Windows\System\vNvBvfv.exe
  2⤵
  PID:6604
- C:\Windows\System\SFwChhx.exe
  C:\Windows\System\SFwChhx.exe
  2⤵
  PID:6620
- C:\Windows\System\HLDSnla.exe
  C:\Windows\System\HLDSnla.exe
  2⤵
  PID:6636
- C:\Windows\System\pBpZOoG.exe
  C:\Windows\System\pBpZOoG.exe
  2⤵
  PID:6652
- C:\Windows\System\vRMAFTJ.exe
  C:\Windows\System\vRMAFTJ.exe
  2⤵
  PID:6680
- C:\Windows\System\xgNdboq.exe
  C:\Windows\System\xgNdboq.exe
  2⤵
  PID:6708
- C:\Windows\System\VPpjfWI.exe
  C:\Windows\System\VPpjfWI.exe
  2⤵
  PID:6736
- C:\Windows\System\aMmOItk.exe
  C:\Windows\System\aMmOItk.exe
  2⤵
  PID:6760
- C:\Windows\System\swLVzem.exe
  C:\Windows\System\swLVzem.exe
  2⤵
  PID:6784
- C:\Windows\System\KazjFPN.exe
  C:\Windows\System\KazjFPN.exe
  2⤵
  PID:6816
- C:\Windows\System\VHyGjuE.exe
  C:\Windows\System\VHyGjuE.exe
  2⤵
  PID:6836
- C:\Windows\System\VqECHlG.exe
  C:\Windows\System\VqECHlG.exe
  2⤵
  PID:6852
- C:\Windows\System\SUFOjMl.exe
  C:\Windows\System\SUFOjMl.exe
  2⤵
  PID:6872
- C:\Windows\System\WERJNSR.exe
  C:\Windows\System\WERJNSR.exe
  2⤵
  PID:6892
- C:\Windows\System\UwhaYAo.exe
  C:\Windows\System\UwhaYAo.exe
  2⤵
  PID:5736
- C:\Windows\System\YVtjmRy.exe
  C:\Windows\System\YVtjmRy.exe
  2⤵
  PID:5572
- C:\Windows\System\FAWtGPT.exe
  C:\Windows\System\FAWtGPT.exe
  2⤵
  PID:5308
- C:\Windows\System\wibmQWV.exe
  C:\Windows\System\wibmQWV.exe
  2⤵
  PID:5188
- C:\Windows\System\wWshzhl.exe
  C:\Windows\System\wWshzhl.exe
  2⤵
  PID:5836
- C:\Windows\System\KMNDktP.exe
  C:\Windows\System\KMNDktP.exe
  2⤵
  PID:1624
- C:\Windows\System\oOaSaMn.exe
  C:\Windows\System\oOaSaMn.exe
  2⤵
  PID:4464
- C:\Windows\System\TZFSOHh.exe
  C:\Windows\System\TZFSOHh.exe
  2⤵
  PID:5376
- C:\Windows\System\njhXzOi.exe
  C:\Windows\System\njhXzOi.exe
  2⤵
  PID:3836
- C:\Windows\System\kClYOub.exe
  C:\Windows\System\kClYOub.exe
  2⤵
  PID:2956
- C:\Windows\System\XGbPviX.exe
  C:\Windows\System\XGbPviX.exe
  2⤵
  PID:3480
- C:\Windows\System\XKvPyIG.exe
  C:\Windows\System\XKvPyIG.exe
  2⤵
  PID:3804
- C:\Windows\System\fieXowd.exe
  C:\Windows\System\fieXowd.exe
  2⤵
  PID:6048
- C:\Windows\System\gfcIgGA.exe
  C:\Windows\System\gfcIgGA.exe
  2⤵
  PID:6124
- C:\Windows\System\oJuVdPX.exe
  C:\Windows\System\oJuVdPX.exe
  2⤵
  PID:6072
- C:\Windows\System\HkwMOGa.exe
  C:\Windows\System\HkwMOGa.exe
  2⤵
  PID:6004
- C:\Windows\System\EvUxmuP.exe
  C:\Windows\System\EvUxmuP.exe
  2⤵
  PID:5408
- C:\Windows\System\idujQRz.exe
  C:\Windows\System\idujQRz.exe
  2⤵
  PID:6224
- C:\Windows\System\SZeXopq.exe
  C:\Windows\System\SZeXopq.exe
  2⤵
  PID:7176
- C:\Windows\System\nzVNqlC.exe
  C:\Windows\System\nzVNqlC.exe
  2⤵
  PID:7204
- C:\Windows\System\RDFxoVx.exe
  C:\Windows\System\RDFxoVx.exe
  2⤵
  PID:7416
- C:\Windows\System\hIXtwNu.exe
  C:\Windows\System\hIXtwNu.exe
  2⤵
  PID:7440
- C:\Windows\System\rVLyXcI.exe
  C:\Windows\System\rVLyXcI.exe
  2⤵
  PID:7464
- C:\Windows\System\kWVntnm.exe
  C:\Windows\System\kWVntnm.exe
  2⤵
  PID:7488
- C:\Windows\System\iSYdYhj.exe
  C:\Windows\System\iSYdYhj.exe
  2⤵
  PID:7512
- C:\Windows\System\KkTcAof.exe
  C:\Windows\System\KkTcAof.exe
  2⤵
  PID:7532
- C:\Windows\System\TqDEYQm.exe
  C:\Windows\System\TqDEYQm.exe
  2⤵
  PID:7556
- C:\Windows\System\LBPXwWP.exe
  C:\Windows\System\LBPXwWP.exe
  2⤵
  PID:7576
- C:\Windows\System\vNUufFg.exe
  C:\Windows\System\vNUufFg.exe
  2⤵
  PID:7600
- C:\Windows\System\rcFRAek.exe
  C:\Windows\System\rcFRAek.exe
  2⤵
  PID:7620
- C:\Windows\System\ZUfExSC.exe
  C:\Windows\System\ZUfExSC.exe
  2⤵
  PID:7640
- C:\Windows\System\tUjlKqq.exe
  C:\Windows\System\tUjlKqq.exe
  2⤵
  PID:7672
- C:\Windows\System\oYCnNdu.exe
  C:\Windows\System\oYCnNdu.exe
  2⤵
  PID:7688
- C:\Windows\System\DfmdJMB.exe
  C:\Windows\System\DfmdJMB.exe
  2⤵
  PID:7704
- C:\Windows\System\IUbPpep.exe
  C:\Windows\System\IUbPpep.exe
  2⤵
  PID:7720
- C:\Windows\System\jLazCrd.exe
  C:\Windows\System\jLazCrd.exe
  2⤵
  PID:7736
- C:\Windows\System\vemtLKk.exe
  C:\Windows\System\vemtLKk.exe
  2⤵
  PID:7752
- C:\Windows\System\XfhdCXO.exe
  C:\Windows\System\XfhdCXO.exe
  2⤵
  PID:7768
- C:\Windows\System\FrmPUDc.exe
  C:\Windows\System\FrmPUDc.exe
  2⤵
  PID:7864
- C:\Windows\System\bsRiUix.exe
  C:\Windows\System\bsRiUix.exe
  2⤵
  PID:7888
- C:\Windows\System\QKlDuSW.exe
  C:\Windows\System\QKlDuSW.exe
  2⤵
  PID:8008
- C:\Windows\System\uznbyMr.exe
  C:\Windows\System\uznbyMr.exe
  2⤵
  PID:8028
- C:\Windows\System\SbhQhYF.exe
  C:\Windows\System\SbhQhYF.exe
  2⤵
  PID:8052
- C:\Windows\System\tnUVocm.exe
  C:\Windows\System\tnUVocm.exe
  2⤵
  PID:8080
- C:\Windows\System\cYCHWNc.exe
  C:\Windows\System\cYCHWNc.exe
  2⤵
  PID:8100
- C:\Windows\System\mNlKIgn.exe
  C:\Windows\System\mNlKIgn.exe
  2⤵
  PID:8116
- C:\Windows\System\pGsuorc.exe
  C:\Windows\System\pGsuorc.exe
  2⤵
  PID:8132
- C:\Windows\System\UeeFcVI.exe
  C:\Windows\System\UeeFcVI.exe
  2⤵
  PID:8156
- C:\Windows\System\YtqDdWj.exe
  C:\Windows\System\YtqDdWj.exe
  2⤵
  PID:8176
- C:\Windows\System\tuBGQWj.exe
  C:\Windows\System\tuBGQWj.exe
  2⤵
  PID:6268
- C:\Windows\System\HtNIENN.exe
  C:\Windows\System\HtNIENN.exe
  2⤵
  PID:6304
- C:\Windows\System\erGjDmP.exe
  C:\Windows\System\erGjDmP.exe
  2⤵
  PID:6348
- C:\Windows\System\TALCVTe.exe
  C:\Windows\System\TALCVTe.exe
  2⤵
  PID:6396
- C:\Windows\System\VbTlzEN.exe
  C:\Windows\System\VbTlzEN.exe
  2⤵
  PID:3700
- C:\Windows\System\IaoBjxe.exe
  C:\Windows\System\IaoBjxe.exe
  2⤵
  PID:7100
- C:\Windows\System\LWsUZAt.exe
  C:\Windows\System\LWsUZAt.exe
  2⤵
  PID:7124
- C:\Windows\System\gqGMCAx.exe
  C:\Windows\System\gqGMCAx.exe
  2⤵
  PID:7164
- C:\Windows\System\LLnSPBx.exe
  C:\Windows\System\LLnSPBx.exe
  2⤵
  PID:5484
- C:\Windows\System\UcmaDcp.exe
  C:\Windows\System\UcmaDcp.exe
  2⤵
  PID:5160
- C:\Windows\System\ZNtvEPI.exe
  C:\Windows\System\ZNtvEPI.exe
  2⤵
  PID:1976
- C:\Windows\System\BoDsIhR.exe
  C:\Windows\System\BoDsIhR.exe
  2⤵
  PID:2052
- C:\Windows\System\CgcpzeB.exe
  C:\Windows\System\CgcpzeB.exe
  2⤵
  PID:4944
- C:\Windows\System\MsDnsuZ.exe
  C:\Windows\System\MsDnsuZ.exe
  2⤵
  PID:4460
- C:\Windows\System\AaxuAes.exe
  C:\Windows\System\AaxuAes.exe
  2⤵
  PID:6036
- C:\Windows\System\JaOdsSB.exe
  C:\Windows\System\JaOdsSB.exe
  2⤵
  PID:3104
- C:\Windows\System\ZIrIHik.exe
  C:\Windows\System\ZIrIHik.exe
  2⤵
  PID:7192
- C:\Windows\System\XTjfdaJ.exe
  C:\Windows\System\XTjfdaJ.exe
  2⤵
  PID:4492
- C:\Windows\System\qwDkoSf.exe
  C:\Windows\System\qwDkoSf.exe
  2⤵
  PID:7636
- C:\Windows\System\ZVmoacP.exe
  C:\Windows\System\ZVmoacP.exe
  2⤵
  PID:7436
- C:\Windows\System\nQQojMB.exe
  C:\Windows\System\nQQojMB.exe
  2⤵
  PID:7484
- C:\Windows\System\uKvrlHS.exe
  C:\Windows\System\uKvrlHS.exe
  2⤵
  PID:7540
- C:\Windows\System\JUxmwnV.exe
  C:\Windows\System\JUxmwnV.exe
  2⤵
  PID:7568
- C:\Windows\System\hAqNpoe.exe
  C:\Windows\System\hAqNpoe.exe
  2⤵
  PID:7612
- C:\Windows\System\gxGcjxM.exe
  C:\Windows\System\gxGcjxM.exe
  2⤵
  PID:7660
- C:\Windows\System\IIbWnlE.exe
  C:\Windows\System\IIbWnlE.exe
  2⤵
  PID:7700
- C:\Windows\System\mtfmJmn.exe
  C:\Windows\System\mtfmJmn.exe
  2⤵
  PID:7744
- C:\Windows\System\hWpsOEi.exe
  C:\Windows\System\hWpsOEi.exe
  2⤵
  PID:7788
- C:\Windows\System\LujFrbr.exe
  C:\Windows\System\LujFrbr.exe
  2⤵
  PID:7836
- C:\Windows\System\gQxcFiZ.exe
  C:\Windows\System\gQxcFiZ.exe
  2⤵
  PID:3068
- C:\Windows\System\fGLNNFO.exe
  C:\Windows\System\fGLNNFO.exe
  2⤵
  PID:7956
- C:\Windows\System\tTCwhYZ.exe
  C:\Windows\System\tTCwhYZ.exe
  2⤵
  PID:7980
- C:\Windows\System\sVFKhiu.exe
  C:\Windows\System\sVFKhiu.exe
  2⤵
  PID:2564
- C:\Windows\System\zRLOUEF.exe
  C:\Windows\System\zRLOUEF.exe
  2⤵
  PID:8020
- C:\Windows\System\QjqWqeN.exe
  C:\Windows\System\QjqWqeN.exe
  2⤵
  PID:8060
- C:\Windows\System\AaDgGeg.exe
  C:\Windows\System\AaDgGeg.exe
  2⤵
  PID:8092
- C:\Windows\System\muTZDum.exe
  C:\Windows\System\muTZDum.exe
  2⤵
  PID:8148
- C:\Windows\System\SnvdhoP.exe
  C:\Windows\System\SnvdhoP.exe
  2⤵
  PID:6252
- C:\Windows\System\bUIqZIm.exe
  C:\Windows\System\bUIqZIm.exe
  2⤵
  PID:6336
- C:\Windows\System\UOSoSWZ.exe
  C:\Windows\System\UOSoSWZ.exe
  2⤵
  PID:6672
- C:\Windows\System\nBmajsf.exe
  C:\Windows\System\nBmajsf.exe
  2⤵
  PID:2840
- C:\Windows\System\rIvcQGT.exe
  C:\Windows\System\rIvcQGT.exe
  2⤵
  PID:6800
- C:\Windows\System\siiYZYx.exe
  C:\Windows\System\siiYZYx.exe
  2⤵
  PID:6880
- C:\Windows\System\cthlqlq.exe
  C:\Windows\System\cthlqlq.exe
  2⤵
  PID:2312
- C:\Windows\System\WLuOjpN.exe
  C:\Windows\System\WLuOjpN.exe
  2⤵
  PID:2368
- C:\Windows\System\zHRkbge.exe
  C:\Windows\System\zHRkbge.exe
  2⤵
  PID:4420
- C:\Windows\System\eIYIuqA.exe
  C:\Windows\System\eIYIuqA.exe
  2⤵
  PID:3284
- C:\Windows\System\ZZOWmXb.exe
  C:\Windows\System\ZZOWmXb.exe
  2⤵
  PID:4776
- C:\Windows\System\yVsokTg.exe
  C:\Windows\System\yVsokTg.exe
  2⤵
  PID:528
- C:\Windows\System\fMwqyKX.exe
  C:\Windows\System\fMwqyKX.exe
  2⤵
  PID:3848
- C:\Windows\System\VQWYTnO.exe
  C:\Windows\System\VQWYTnO.exe
  2⤵
  PID:3216
- C:\Windows\System\zbaiDEK.exe
  C:\Windows\System\zbaiDEK.exe
  2⤵
  PID:2940
- C:\Windows\System\pmDBieE.exe
  C:\Windows\System\pmDBieE.exe
  2⤵
  PID:4540
- C:\Windows\System\tMAqGVB.exe
  C:\Windows\System\tMAqGVB.exe
  2⤵
  PID:5496
- C:\Windows\System\BUVerCq.exe
  C:\Windows\System\BUVerCq.exe
  2⤵
  PID:4260
- C:\Windows\System\EAqDYGM.exe
  C:\Windows\System\EAqDYGM.exe
  2⤵
  PID:6200
- C:\Windows\System\aEWegOP.exe
  C:\Windows\System\aEWegOP.exe
  2⤵
  PID:6212
- C:\Windows\System\uzfOGWx.exe
  C:\Windows\System\uzfOGWx.exe
  2⤵
  PID:3740
- C:\Windows\System\qHFeSJJ.exe
  C:\Windows\System\qHFeSJJ.exe
  2⤵
  PID:5532
- C:\Windows\System\joZBfHd.exe
  C:\Windows\System\joZBfHd.exe
  2⤵
  PID:5776
- C:\Windows\System\fWJsdXD.exe
  C:\Windows\System\fWJsdXD.exe
  2⤵
  PID:6068
- C:\Windows\System\SjuNhGl.exe
  C:\Windows\System\SjuNhGl.exe
  2⤵
  PID:7172
- C:\Windows\System\wWrgAfT.exe
  C:\Windows\System\wWrgAfT.exe
  2⤵
  PID:6112
- C:\Windows\System\xcjxJBF.exe
  C:\Windows\System\xcjxJBF.exe
  2⤵
  PID:7424
- C:\Windows\System\zSPVPXP.exe
  C:\Windows\System\zSPVPXP.exe
  2⤵
  PID:1332
- C:\Windows\System\OuaFWFR.exe
  C:\Windows\System\OuaFWFR.exe
  2⤵
  PID:7472
- C:\Windows\System\kmSrUjm.exe
  C:\Windows\System\kmSrUjm.exe
  2⤵
  PID:7728
- C:\Windows\System\aFjnkUw.exe
  C:\Windows\System\aFjnkUw.exe
  2⤵
  PID:7880
- C:\Windows\System\SMVwLtQ.exe
  C:\Windows\System\SMVwLtQ.exe
  2⤵
  PID:7696
- C:\Windows\System\ihNOsHX.exe
  C:\Windows\System\ihNOsHX.exe
  2⤵
  PID:7948
- C:\Windows\System\DAqLjFJ.exe
  C:\Windows\System\DAqLjFJ.exe
  2⤵
  PID:1084
- C:\Windows\System\svhUsqc.exe
  C:\Windows\System\svhUsqc.exe
  2⤵
  PID:8072
- C:\Windows\System\kmAyuzT.exe
  C:\Windows\System\kmAyuzT.exe
  2⤵
  PID:2064
- C:\Windows\System\HIYYrRt.exe
  C:\Windows\System\HIYYrRt.exe
  2⤵
  PID:8184
- C:\Windows\System\UfpCRgk.exe
  C:\Windows\System\UfpCRgk.exe
  2⤵
  PID:2436
- C:\Windows\System\YhITJmA.exe
  C:\Windows\System\YhITJmA.exe
  2⤵
  PID:688
- C:\Windows\System\TAGrJnf.exe
  C:\Windows\System\TAGrJnf.exe
  2⤵
  PID:7116
- C:\Windows\System\KezWjAF.exe
  C:\Windows\System\KezWjAF.exe
  2⤵
  PID:2004
- C:\Windows\System\wsckoBG.exe
  C:\Windows\System\wsckoBG.exe
  2⤵
  PID:3808
- C:\Windows\System\HxOgyAB.exe
  C:\Windows\System\HxOgyAB.exe
  2⤵
  PID:6240
- C:\Windows\System\SjNHEZM.exe
  C:\Windows\System\SjNHEZM.exe
  2⤵
  PID:7828
- C:\Windows\System\vjHfRLo.exe
  C:\Windows\System\vjHfRLo.exe
  2⤵
  PID:5192
- C:\Windows\System\BMJJyCs.exe
  C:\Windows\System\BMJJyCs.exe
  2⤵
  PID:2376
- C:\Windows\System\AgsbCNk.exe
  C:\Windows\System\AgsbCNk.exe
  2⤵
  PID:8216
- C:\Windows\System\NxOYcoT.exe
  C:\Windows\System\NxOYcoT.exe
  2⤵
  PID:8236
- C:\Windows\System\URCzmvh.exe
  C:\Windows\System\URCzmvh.exe
  2⤵
  PID:8260
- C:\Windows\System\dzQPOsv.exe
  C:\Windows\System\dzQPOsv.exe
  2⤵
  PID:8276
- C:\Windows\System\jrUriOO.exe
  C:\Windows\System\jrUriOO.exe
  2⤵
  PID:8300
- C:\Windows\System\vwTRiSL.exe
  C:\Windows\System\vwTRiSL.exe
  2⤵
  PID:8320
- C:\Windows\System\YPLLoyj.exe
  C:\Windows\System\YPLLoyj.exe
  2⤵
  PID:8340
- C:\Windows\System\WXUJjBg.exe
  C:\Windows\System\WXUJjBg.exe
  2⤵
  PID:8360
- C:\Windows\System\pSpqGbE.exe
  C:\Windows\System\pSpqGbE.exe
  2⤵
  PID:8388
- C:\Windows\System\OsUGfkB.exe
  C:\Windows\System\OsUGfkB.exe
  2⤵
  PID:8408
- C:\Windows\System\icCHUFx.exe
  C:\Windows\System\icCHUFx.exe
  2⤵
  PID:8428
- C:\Windows\System\fUKnkCP.exe
  C:\Windows\System\fUKnkCP.exe
  2⤵
  PID:8448
- C:\Windows\System\hFdlLXv.exe
  C:\Windows\System\hFdlLXv.exe
  2⤵
  PID:8476
- C:\Windows\System\YIQymVP.exe
  C:\Windows\System\YIQymVP.exe
  2⤵
  PID:8496
- C:\Windows\System\DKYDwAp.exe
  C:\Windows\System\DKYDwAp.exe
  2⤵
  PID:8520
- C:\Windows\System\ymlqcbj.exe
  C:\Windows\System\ymlqcbj.exe
  2⤵
  PID:8536
- C:\Windows\System\ehwUFdV.exe
  C:\Windows\System\ehwUFdV.exe
  2⤵
  PID:8556
- C:\Windows\System\biBMfjt.exe
  C:\Windows\System\biBMfjt.exe
  2⤵
  PID:8576
- C:\Windows\System\inWLxMm.exe
  C:\Windows\System\inWLxMm.exe
  2⤵
  PID:8596
- C:\Windows\System\NOufpjv.exe
  C:\Windows\System\NOufpjv.exe
  2⤵
  PID:8624
- C:\Windows\System\WImpkWj.exe
  C:\Windows\System\WImpkWj.exe
  2⤵
  PID:8644
- C:\Windows\System\CaFiuBg.exe
  C:\Windows\System\CaFiuBg.exe
  2⤵
  PID:8668
- C:\Windows\System\JnTIcmr.exe
  C:\Windows\System\JnTIcmr.exe
  2⤵
  PID:8696
- C:\Windows\System\BRvAWHt.exe
  C:\Windows\System\BRvAWHt.exe
  2⤵
  PID:8712
- C:\Windows\System\ciJsNsl.exe
  C:\Windows\System\ciJsNsl.exe
  2⤵
  PID:8732
- C:\Windows\System\tUMihwV.exe
  C:\Windows\System\tUMihwV.exe
  2⤵
  PID:8752
- C:\Windows\System\RMUIYDy.exe
  C:\Windows\System\RMUIYDy.exe
  2⤵
  PID:8776
- C:\Windows\System\CExMjgs.exe
  C:\Windows\System\CExMjgs.exe
  2⤵
  PID:8796
- C:\Windows\System\HsgIVZn.exe
  C:\Windows\System\HsgIVZn.exe
  2⤵
  PID:8820
- C:\Windows\System\kMeDATw.exe
  C:\Windows\System\kMeDATw.exe
  2⤵
  PID:8840
- C:\Windows\System\QPkewQz.exe
  C:\Windows\System\QPkewQz.exe
  2⤵
  PID:8860
- C:\Windows\System\gLfJTDX.exe
  C:\Windows\System\gLfJTDX.exe
  2⤵
  PID:8884
- C:\Windows\System\eMZQDPd.exe
  C:\Windows\System\eMZQDPd.exe
  2⤵
  PID:8904
- C:\Windows\System\TqrVpGK.exe
  C:\Windows\System\TqrVpGK.exe
  2⤵
  PID:8928
- C:\Windows\System\loIYbHx.exe
  C:\Windows\System\loIYbHx.exe
  2⤵
  PID:8948
- C:\Windows\System\rDMccUo.exe
  C:\Windows\System\rDMccUo.exe
  2⤵
  PID:8972
- C:\Windows\System\YQFekGZ.exe
  C:\Windows\System\YQFekGZ.exe
  2⤵
  PID:8992
- C:\Windows\System\YBVdbiY.exe
  C:\Windows\System\YBVdbiY.exe
  2⤵
  PID:9012
- C:\Windows\System\RvFNjef.exe
  C:\Windows\System\RvFNjef.exe
  2⤵
  PID:9036
- C:\Windows\System\ItoHLmw.exe
  C:\Windows\System\ItoHLmw.exe
  2⤵
  PID:9060
- C:\Windows\System\BEMEQOQ.exe
  C:\Windows\System\BEMEQOQ.exe
  2⤵
  PID:9076
- C:\Windows\System\BoLutOX.exe
  C:\Windows\System\BoLutOX.exe
  2⤵
  PID:9104
- C:\Windows\System\EXxnOtO.exe
  C:\Windows\System\EXxnOtO.exe
  2⤵
  PID:9128
- C:\Windows\System\PKMBTzT.exe
  C:\Windows\System\PKMBTzT.exe
  2⤵
  PID:9148
- C:\Windows\System\CBteBkq.exe
  C:\Windows\System\CBteBkq.exe
  2⤵
  PID:9172
- C:\Windows\System\dluGTbx.exe
  C:\Windows\System\dluGTbx.exe
  2⤵
  PID:9192
- C:\Windows\System\fOzqUaq.exe
  C:\Windows\System\fOzqUaq.exe
  2⤵
  PID:9208
- C:\Windows\System\WXvmfQo.exe
  C:\Windows\System\WXvmfQo.exe
  2⤵
  PID:6128
- C:\Windows\System\fOiCbeD.exe
  C:\Windows\System\fOiCbeD.exe
  2⤵
  PID:8088
- C:\Windows\System\sTOXpeX.exe
  C:\Windows\System\sTOXpeX.exe
  2⤵
  PID:7652
- C:\Windows\System\cGcuHNX.exe
  C:\Windows\System\cGcuHNX.exe
  2⤵
  PID:4228
- C:\Windows\System\LLwMZpj.exe
  C:\Windows\System\LLwMZpj.exe
  2⤵
  PID:7764
- C:\Windows\System\EGFLxkI.exe
  C:\Windows\System\EGFLxkI.exe
  2⤵
  PID:8228
- C:\Windows\System\bpJwhUj.exe
  C:\Windows\System\bpJwhUj.exe
  2⤵
  PID:6612
- C:\Windows\System\UsaYbME.exe
  C:\Windows\System\UsaYbME.exe
  2⤵
  PID:8332
- C:\Windows\System\snnEgRu.exe
  C:\Windows\System\snnEgRu.exe
  2⤵
  PID:8420
- C:\Windows\System\dxUQXeF.exe
  C:\Windows\System\dxUQXeF.exe
  2⤵
  PID:8464
- C:\Windows\System\BatpmAV.exe
  C:\Windows\System\BatpmAV.exe
  2⤵
  PID:8212
- C:\Windows\System\hWxVFLo.exe
  C:\Windows\System\hWxVFLo.exe
  2⤵
  PID:7712
- C:\Windows\System\MejixWY.exe
  C:\Windows\System\MejixWY.exe
  2⤵
  PID:2056
- C:\Windows\System\lvjSvKp.exe
  C:\Windows\System\lvjSvKp.exe
  2⤵
  PID:8688
- C:\Windows\System\FJKjSLV.exe
  C:\Windows\System\FJKjSLV.exe
  2⤵
  PID:8808
- C:\Windows\System\qSznVWM.exe
  C:\Windows\System\qSznVWM.exe
  2⤵
  PID:8856
- C:\Windows\System\watJjih.exe
  C:\Windows\System\watJjih.exe
  2⤵
  PID:8896
- C:\Windows\System\KLFsWIh.exe
  C:\Windows\System\KLFsWIh.exe
  2⤵
  PID:9236
- C:\Windows\System\ANcvAYR.exe
  C:\Windows\System\ANcvAYR.exe
  2⤵
  PID:9260
- C:\Windows\System\CeeHjgL.exe
  C:\Windows\System\CeeHjgL.exe
  2⤵
  PID:9280
- C:\Windows\System\XrHtpbe.exe
  C:\Windows\System\XrHtpbe.exe
  2⤵
  PID:9300
- C:\Windows\System\hkcwZYO.exe
  C:\Windows\System\hkcwZYO.exe
  2⤵
  PID:9328
- C:\Windows\System\FLoXoZH.exe
  C:\Windows\System\FLoXoZH.exe
  2⤵
  PID:9344
- C:\Windows\System\ixjcmyk.exe
  C:\Windows\System\ixjcmyk.exe
  2⤵
  PID:9368
- C:\Windows\System\qifLjcR.exe
  C:\Windows\System\qifLjcR.exe
  2⤵
  PID:9392
- C:\Windows\System\wmEmGEY.exe
  C:\Windows\System\wmEmGEY.exe
  2⤵
  PID:9420
- C:\Windows\System\qPTJPNv.exe
  C:\Windows\System\qPTJPNv.exe
  2⤵
  PID:9440
- C:\Windows\System\gTggudC.exe
  C:\Windows\System\gTggudC.exe
  2⤵
  PID:9464
- C:\Windows\System\YXtyUCH.exe
  C:\Windows\System\YXtyUCH.exe
  2⤵
  PID:9484
- C:\Windows\System\LNbOvHk.exe
  C:\Windows\System\LNbOvHk.exe
  2⤵
  PID:9504
- C:\Windows\System\yQqLhap.exe
  C:\Windows\System\yQqLhap.exe
  2⤵
  PID:9524
- C:\Windows\System\mCtRoLn.exe
  C:\Windows\System\mCtRoLn.exe
  2⤵
  PID:9552
- C:\Windows\System\MCJRhRc.exe
  C:\Windows\System\MCJRhRc.exe
  2⤵
  PID:9572
- C:\Windows\System\nUWRpHD.exe
  C:\Windows\System\nUWRpHD.exe
  2⤵
  PID:9596
- C:\Windows\System\RYUGHED.exe
  C:\Windows\System\RYUGHED.exe
  2⤵
  PID:9620
- C:\Windows\System\fhJRUkk.exe
  C:\Windows\System\fhJRUkk.exe
  2⤵
  PID:9640
- C:\Windows\System\FtQkyAR.exe
  C:\Windows\System\FtQkyAR.exe
  2⤵
  PID:9664
- C:\Windows\System\MNbqYqA.exe
  C:\Windows\System\MNbqYqA.exe
  2⤵
  PID:9684
- C:\Windows\System\wbfiCML.exe
  C:\Windows\System\wbfiCML.exe
  2⤵
  PID:9700
- C:\Windows\System\GlPKVnk.exe
  C:\Windows\System\GlPKVnk.exe
  2⤵
  PID:9720
- C:\Windows\System\raCIMyq.exe
  C:\Windows\System\raCIMyq.exe
  2⤵
  PID:9744
- C:\Windows\System\GnldVsq.exe
  C:\Windows\System\GnldVsq.exe
  2⤵
  PID:9768
- C:\Windows\System\CPBZBbk.exe
  C:\Windows\System\CPBZBbk.exe
  2⤵
  PID:9784
- C:\Windows\System\MHASLxB.exe
  C:\Windows\System\MHASLxB.exe
  2⤵
  PID:9808
- C:\Windows\System\tJqCUwG.exe
  C:\Windows\System\tJqCUwG.exe
  2⤵
  PID:9828
- C:\Windows\System\VtoSTHj.exe
  C:\Windows\System\VtoSTHj.exe
  2⤵
  PID:9852
- C:\Windows\System\QHTLoCy.exe
  C:\Windows\System\QHTLoCy.exe
  2⤵
  PID:9872
- C:\Windows\System\pLkjXBo.exe
  C:\Windows\System\pLkjXBo.exe
  2⤵
  PID:9896
- C:\Windows\System\ogxhpHM.exe
  C:\Windows\System\ogxhpHM.exe
  2⤵
  PID:9916
- C:\Windows\System\XBozQlZ.exe
  C:\Windows\System\XBozQlZ.exe
  2⤵
  PID:9932
- C:\Windows\System\Gtlgqmb.exe
  C:\Windows\System\Gtlgqmb.exe
  2⤵
  PID:9960
- C:\Windows\System\KmphyhF.exe
  C:\Windows\System\KmphyhF.exe
  2⤵
  PID:9980
- C:\Windows\System\DjbjVxQ.exe
  C:\Windows\System\DjbjVxQ.exe
  2⤵
  PID:10000
- C:\Windows\System\FSORfTD.exe
  C:\Windows\System\FSORfTD.exe
  2⤵
  PID:10024
- C:\Windows\System\dOneyEg.exe
  C:\Windows\System\dOneyEg.exe
  2⤵
  PID:10048
- C:\Windows\System\ugipxFK.exe
  C:\Windows\System\ugipxFK.exe
  2⤵
  PID:10068
- C:\Windows\System\iGUKiTT.exe
  C:\Windows\System\iGUKiTT.exe
  2⤵
  PID:10092
- C:\Windows\System\NgvQmUc.exe
  C:\Windows\System\NgvQmUc.exe
  2⤵
  PID:10116
- C:\Windows\System\bBDTQZL.exe
  C:\Windows\System\bBDTQZL.exe
  2⤵
  PID:10136
- C:\Windows\System\ShCQRlG.exe
  C:\Windows\System\ShCQRlG.exe
  2⤵
  PID:7528
- C:\Windows\System\MKFLQWp.exe
  C:\Windows\System\MKFLQWp.exe
  2⤵
  PID:8748
- C:\Windows\System\gFtCyfj.exe
  C:\Windows\System\gFtCyfj.exe
  2⤵
  PID:8468
- C:\Windows\System\RNYXHik.exe
  C:\Windows\System\RNYXHik.exe
  2⤵
  PID:8356
- C:\Windows\System\rbQljSt.exe
  C:\Windows\System\rbQljSt.exe
  2⤵
  PID:2060
- C:\Windows\System\VLahJNl.exe
  C:\Windows\System\VLahJNl.exe
  2⤵
  PID:9228
- C:\Windows\System\OPRhzXk.exe
  C:\Windows\System\OPRhzXk.exe
  2⤵
  PID:8488
- C:\Windows\System\ilgMaLJ.exe
  C:\Windows\System\ilgMaLJ.exe
  2⤵
  PID:3724
- C:\Windows\System\vdZgWrT.exe
  C:\Windows\System\vdZgWrT.exe
  2⤵
  PID:9412
- C:\Windows\System\ElyrkXm.exe
  C:\Windows\System\ElyrkXm.exe
  2⤵
  PID:9432
- C:\Windows\System\xMrqMff.exe
  C:\Windows\System\xMrqMff.exe
  2⤵
  PID:9084
- C:\Windows\System\YABTWXZ.exe
  C:\Windows\System\YABTWXZ.exe
  2⤵
  PID:9492
- C:\Windows\System\hBzIctr.exe
  C:\Windows\System\hBzIctr.exe
  2⤵
  PID:1368
- C:\Windows\System\EJHlOWY.exe
  C:\Windows\System\EJHlOWY.exe
  2⤵
  PID:8652
- C:\Windows\System\FyARtLL.exe
  C:\Windows\System\FyARtLL.exe
  2⤵
  PID:7148
- C:\Windows\System\rKCCxSX.exe
  C:\Windows\System\rKCCxSX.exe
  2⤵
  PID:9588
- C:\Windows\System\AQdLOBY.exe
  C:\Windows\System\AQdLOBY.exe
  2⤵
  PID:8708
- C:\Windows\System\NcCWvNF.exe
  C:\Windows\System\NcCWvNF.exe
  2⤵
  PID:8044
- C:\Windows\System\kXZneEd.exe
  C:\Windows\System\kXZneEd.exe
  2⤵
  PID:8836
- C:\Windows\System\aEbMljj.exe
  C:\Windows\System\aEbMljj.exe
  2⤵
  PID:10080
- C:\Windows\System\YiWBqkn.exe
  C:\Windows\System\YiWBqkn.exe
  2⤵
  PID:9296
- C:\Windows\System\kCjMrax.exe
  C:\Windows\System\kCjMrax.exe
  2⤵
  PID:8988
- C:\Windows\System\WaCWXtx.exe
  C:\Windows\System\WaCWXtx.exe
  2⤵
  PID:9116
- C:\Windows\System\vqRSPAe.exe
  C:\Windows\System\vqRSPAe.exe
  2⤵
  PID:10252
- C:\Windows\System\xgUBJkl.exe
  C:\Windows\System\xgUBJkl.exe
  2⤵
  PID:10272
- C:\Windows\System\tmaNAtb.exe
  C:\Windows\System\tmaNAtb.exe
  2⤵
  PID:10300
- C:\Windows\System\gjpgTjt.exe
  C:\Windows\System\gjpgTjt.exe
  2⤵
  PID:10324
- C:\Windows\System\tSkmwup.exe
  C:\Windows\System\tSkmwup.exe
  2⤵
  PID:10360
- C:\Windows\System\urmvMzy.exe
  C:\Windows\System\urmvMzy.exe
  2⤵
  PID:10392
- C:\Windows\System\ywMwKTt.exe
  C:\Windows\System\ywMwKTt.exe
  2⤵
  PID:10416
- C:\Windows\System\dWiLmPJ.exe
  C:\Windows\System\dWiLmPJ.exe
  2⤵
  PID:10436
- C:\Windows\System\fhvYFTg.exe
  C:\Windows\System\fhvYFTg.exe
  2⤵
  PID:10456
- C:\Windows\System\yoIxyAe.exe
  C:\Windows\System\yoIxyAe.exe
  2⤵
  PID:10480
- C:\Windows\System\hVsqFbg.exe
  C:\Windows\System\hVsqFbg.exe
  2⤵
  PID:10500
- C:\Windows\System\hEqqaKV.exe
  C:\Windows\System\hEqqaKV.exe
  2⤵
  PID:10524
- C:\Windows\System\jEruztR.exe
  C:\Windows\System\jEruztR.exe
  2⤵
  PID:10544
- C:\Windows\System\jjuQtov.exe
  C:\Windows\System\jjuQtov.exe
  2⤵
  PID:10564
- C:\Windows\System\zhLTUGm.exe
  C:\Windows\System\zhLTUGm.exe
  2⤵
  PID:10584
- C:\Windows\System\eLSHZSb.exe
  C:\Windows\System\eLSHZSb.exe
  2⤵
  PID:10608
- C:\Windows\System\nsBvZhN.exe
  C:\Windows\System\nsBvZhN.exe
  2⤵
  PID:10632
- C:\Windows\System\YePlFZF.exe
  C:\Windows\System\YePlFZF.exe
  2⤵
  PID:10656
- C:\Windows\System\coeTcje.exe
  C:\Windows\System\coeTcje.exe
  2⤵
  PID:10680
- C:\Windows\System\YTmqyzF.exe
  C:\Windows\System\YTmqyzF.exe
  2⤵
  PID:10704
- C:\Windows\System\hgRQrmn.exe
  C:\Windows\System\hgRQrmn.exe
  2⤵
  PID:10728
- C:\Windows\System\lbyhyrq.exe
  C:\Windows\System\lbyhyrq.exe
  2⤵
  PID:10760
- C:\Windows\System\iBGbqdK.exe
  C:\Windows\System\iBGbqdK.exe
  2⤵
  PID:10784
- C:\Windows\System\wIMPazl.exe
  C:\Windows\System\wIMPazl.exe
  2⤵
  PID:10804
- C:\Windows\System\OdSvvTA.exe
  C:\Windows\System\OdSvvTA.exe
  2⤵
  PID:10824
- C:\Windows\System\glrIZjo.exe
  C:\Windows\System\glrIZjo.exe
  2⤵
  PID:10848
- C:\Windows\System\CdCUaOB.exe
  C:\Windows\System\CdCUaOB.exe
  2⤵
  PID:10868
- C:\Windows\System\gkRqIVb.exe
  C:\Windows\System\gkRqIVb.exe
  2⤵
  PID:10888
- C:\Windows\System\fifNlGZ.exe
  C:\Windows\System\fifNlGZ.exe
  2⤵
  PID:10912
- C:\Windows\System\ILDWeTP.exe
  C:\Windows\System\ILDWeTP.exe
  2⤵
  PID:10932
- C:\Windows\System\wPZUuHI.exe
  C:\Windows\System\wPZUuHI.exe
  2⤵
  PID:10956
- C:\Windows\System\fCDnVRI.exe
  C:\Windows\System\fCDnVRI.exe
  2⤵
  PID:10976
- C:\Windows\System\eqsmuak.exe
  C:\Windows\System\eqsmuak.exe
  2⤵
  PID:11008
- C:\Windows\System\UGkRwXp.exe
  C:\Windows\System\UGkRwXp.exe
  2⤵
  PID:11028
- C:\Windows\System\lqlLCfa.exe
  C:\Windows\System\lqlLCfa.exe
  2⤵
  PID:11056
- C:\Windows\System\bWkXYvA.exe
  C:\Windows\System\bWkXYvA.exe
  2⤵
  PID:11076
- C:\Windows\System\EfBMGUt.exe
  C:\Windows\System\EfBMGUt.exe
  2⤵
  PID:11100
- C:\Windows\System\ycfOcVj.exe
  C:\Windows\System\ycfOcVj.exe
  2⤵
  PID:11124
- C:\Windows\System\NgZQxQF.exe
  C:\Windows\System\NgZQxQF.exe
  2⤵
  PID:11144
- C:\Windows\System\IIeRVtj.exe
  C:\Windows\System\IIeRVtj.exe
  2⤵
  PID:11164
- C:\Windows\System\OEQTddK.exe
  C:\Windows\System\OEQTddK.exe
  2⤵
  PID:11200
- C:\Windows\System\ptpkeQC.exe
  C:\Windows\System\ptpkeQC.exe
  2⤵
  PID:11224
- C:\Windows\System\fLJKNWt.exe
  C:\Windows\System\fLJKNWt.exe
  2⤵
  PID:11256
- C:\Windows\System\qrTdriE.exe
  C:\Windows\System\qrTdriE.exe
  2⤵
  PID:9656
- C:\Windows\System\PtZmcqx.exe
  C:\Windows\System\PtZmcqx.exe
  2⤵
  PID:8316
- C:\Windows\System\iMQcXMd.exe
  C:\Windows\System\iMQcXMd.exe
  2⤵
  PID:9800
- C:\Windows\System\AYnOKXO.exe
  C:\Windows\System\AYnOKXO.exe
  2⤵
  PID:9864
- C:\Windows\System\NxkiohH.exe
  C:\Windows\System\NxkiohH.exe
  2⤵
  PID:9908
- C:\Windows\System\BMPddYj.exe
  C:\Windows\System\BMPddYj.exe
  2⤵
  PID:9968
- C:\Windows\System\fPfWmxP.exe
  C:\Windows\System\fPfWmxP.exe
  2⤵
  PID:10060
- C:\Windows\System\Iwgagfn.exe
  C:\Windows\System\Iwgagfn.exe
  2⤵
  PID:10104
- C:\Windows\System\LXrvOJy.exe
  C:\Windows\System\LXrvOJy.exe
  2⤵
  PID:1256
- C:\Windows\System\crxsPrA.exe
  C:\Windows\System\crxsPrA.exe
  2⤵
  PID:8284
- C:\Windows\System\jJAaqAN.exe
  C:\Windows\System\jJAaqAN.exe
  2⤵
  PID:9020
- C:\Windows\System\phkpbcy.exe
  C:\Windows\System\phkpbcy.exe
  2⤵
  PID:9184
- C:\Windows\System\TXnwovG.exe
  C:\Windows\System\TXnwovG.exe
  2⤵
  PID:8296
- C:\Windows\System\OUFxrXw.exe
  C:\Windows\System\OUFxrXw.exe
  2⤵
  PID:9592
- C:\Windows\System\UduENUu.exe
  C:\Windows\System\UduENUu.exe
  2⤵
  PID:9612
- C:\Windows\System\ifEExOP.exe
  C:\Windows\System\ifEExOP.exe
  2⤵
  PID:10288
- C:\Windows\System\ftFvtCx.exe
  C:\Windows\System\ftFvtCx.exe
  2⤵
  PID:10308
- C:\Windows\System\aDraoAP.exe
  C:\Windows\System\aDraoAP.exe
  2⤵
  PID:10336
- C:\Windows\System\QhKUcnC.exe
  C:\Windows\System\QhKUcnC.exe
  2⤵
  PID:9712
- C:\Windows\System\gEKnFfB.exe
  C:\Windows\System\gEKnFfB.exe
  2⤵
  PID:9776
- C:\Windows\System\ZZbcdoy.exe
  C:\Windows\System\ZZbcdoy.exe
  2⤵
  PID:9928
- C:\Windows\System\Pivzotj.exe
  C:\Windows\System\Pivzotj.exe
  2⤵
  PID:9976
- C:\Windows\System\VJsnvAe.exe
  C:\Windows\System\VJsnvAe.exe
  2⤵
  PID:11272
- C:\Windows\System\RyYxAwq.exe
  C:\Windows\System\RyYxAwq.exe
  2⤵
  PID:11296
- C:\Windows\System\AQcssdv.exe
  C:\Windows\System\AQcssdv.exe
  2⤵
  PID:11316
- C:\Windows\System\XRPfMBl.exe
  C:\Windows\System\XRPfMBl.exe
  2⤵
  PID:11344
- C:\Windows\System\KqBPvTa.exe
  C:\Windows\System\KqBPvTa.exe
  2⤵
  PID:11364
- C:\Windows\System\sLLgDmZ.exe
  C:\Windows\System\sLLgDmZ.exe
  2⤵
  PID:11384
- C:\Windows\System\JOlIPkQ.exe
  C:\Windows\System\JOlIPkQ.exe
  2⤵
  PID:11408
- C:\Windows\System\YpdVhMJ.exe
  C:\Windows\System\YpdVhMJ.exe
  2⤵
  PID:11432
- C:\Windows\System\ZzxZpkN.exe
  C:\Windows\System\ZzxZpkN.exe
  2⤵
  PID:11452
- C:\Windows\System\cDucSHS.exe
  C:\Windows\System\cDucSHS.exe
  2⤵
  PID:11472
- C:\Windows\System\zNuFExx.exe
  C:\Windows\System\zNuFExx.exe
  2⤵
  PID:11496
- C:\Windows\System\vkFFLnL.exe
  C:\Windows\System\vkFFLnL.exe
  2⤵
  PID:11516
- C:\Windows\System\fkWRzDg.exe
  C:\Windows\System\fkWRzDg.exe
  2⤵
  PID:11536
- C:\Windows\System\zNikKrv.exe
  C:\Windows\System\zNikKrv.exe
  2⤵
  PID:11568
- C:\Windows\System\knbeCII.exe
  C:\Windows\System\knbeCII.exe
  2⤵
  PID:11588
- C:\Windows\System\ifnjmmD.exe
  C:\Windows\System\ifnjmmD.exe
  2⤵
  PID:11608
- C:\Windows\System\ycCcpNv.exe
  C:\Windows\System\ycCcpNv.exe
  2⤵
  PID:11628
- C:\Windows\System\WeXLWwY.exe
  C:\Windows\System\WeXLWwY.exe
  2⤵
  PID:11648
- C:\Windows\System\QgWZsna.exe
  C:\Windows\System\QgWZsna.exe
  2⤵
  PID:11668
- C:\Windows\System\dpPfYiR.exe
  C:\Windows\System\dpPfYiR.exe
  2⤵
  PID:11684
- C:\Windows\System\DOFRQBr.exe
  C:\Windows\System\DOFRQBr.exe
  2⤵
  PID:11704
- C:\Windows\System\SKYkOJS.exe
  C:\Windows\System\SKYkOJS.exe
  2⤵
  PID:11724
- C:\Windows\System\Dlvivsi.exe
  C:\Windows\System\Dlvivsi.exe
  2⤵
  PID:11744
- C:\Windows\System\YQqdReb.exe
  C:\Windows\System\YQqdReb.exe
  2⤵
  PID:11764
- C:\Windows\System\sAXEWmv.exe
  C:\Windows\System\sAXEWmv.exe
  2⤵
  PID:11784
- C:\Windows\System\xyOgQSq.exe
  C:\Windows\System\xyOgQSq.exe
  2⤵
  PID:11804
- C:\Windows\System\MpgqQff.exe
  C:\Windows\System\MpgqQff.exe
  2⤵
  PID:11828
- C:\Windows\System\IpQrLJS.exe
  C:\Windows\System\IpQrLJS.exe
  2⤵
  PID:11848
- C:\Windows\System\lqiZGww.exe
  C:\Windows\System\lqiZGww.exe
  2⤵
  PID:11868
- C:\Windows\System\xovpSII.exe
  C:\Windows\System\xovpSII.exe
  2⤵
  PID:11888
- C:\Windows\System\NHZZjIz.exe
  C:\Windows\System\NHZZjIz.exe
  2⤵
  PID:11908
- C:\Windows\System\KcFXMvZ.exe
  C:\Windows\System\KcFXMvZ.exe
  2⤵
  PID:11924
- C:\Windows\System\isgkRuY.exe
  C:\Windows\System\isgkRuY.exe
  2⤵
  PID:11948
- C:\Windows\System\vyXYtQt.exe
  C:\Windows\System\vyXYtQt.exe
  2⤵
  PID:11964
- C:\Windows\System\FYQgMQw.exe
  C:\Windows\System\FYQgMQw.exe
  2⤵
  PID:11984
- C:\Windows\System\SwyjiCH.exe
  C:\Windows\System\SwyjiCH.exe
  2⤵
  PID:12004
- C:\Windows\System\RhABDAu.exe
  C:\Windows\System\RhABDAu.exe
  2⤵
  PID:12024
- C:\Windows\System\hxtCFWy.exe
  C:\Windows\System\hxtCFWy.exe
  2⤵
  PID:12044
- C:\Windows\System\RooIELK.exe
  C:\Windows\System\RooIELK.exe
  2⤵
  PID:12064
- C:\Windows\System\iUvuNgd.exe
  C:\Windows\System\iUvuNgd.exe
  2⤵
  PID:12092
- C:\Windows\System\YrRYvgp.exe
  C:\Windows\System\YrRYvgp.exe
  2⤵
  PID:12112
- C:\Windows\System\SLVteVO.exe
  C:\Windows\System\SLVteVO.exe
  2⤵
  PID:12136
- C:\Windows\System\FqOoyeg.exe
  C:\Windows\System\FqOoyeg.exe
  2⤵
  PID:12160
- C:\Windows\System\oFayuYP.exe
  C:\Windows\System\oFayuYP.exe
  2⤵
  PID:12188
- C:\Windows\System\nogZTYL.exe
  C:\Windows\System\nogZTYL.exe
  2⤵
  PID:12208
- C:\Windows\System\ogVvtgH.exe
  C:\Windows\System\ogVvtgH.exe
  2⤵
  PID:12232
- C:\Windows\System\mSSMNKr.exe
  C:\Windows\System\mSSMNKr.exe
  2⤵
  PID:12252
- C:\Windows\System\wRkZnpB.exe
  C:\Windows\System\wRkZnpB.exe
  2⤵
  PID:12272
- C:\Windows\System\jaXrGEq.exe
  C:\Windows\System\jaXrGEq.exe
  2⤵
  PID:10688
- C:\Windows\System\zbNSgqC.exe
  C:\Windows\System\zbNSgqC.exe
  2⤵
  PID:10772
- C:\Windows\System\FNAQDod.exe
  C:\Windows\System\FNAQDod.exe
  2⤵
  PID:10816
- C:\Windows\System\LqUNwOV.exe
  C:\Windows\System\LqUNwOV.exe
  2⤵
  PID:10844
- C:\Windows\System\cSdwFBY.exe
  C:\Windows\System\cSdwFBY.exe
  2⤵
  PID:10884
- C:\Windows\System\rQecepQ.exe
  C:\Windows\System\rQecepQ.exe
  2⤵
  PID:8728
- C:\Windows\System\URKnAdD.exe
  C:\Windows\System\URKnAdD.exe
  2⤵
  PID:11000
- C:\Windows\System\mpFUMxd.exe
  C:\Windows\System\mpFUMxd.exe
  2⤵
  PID:9364
- C:\Windows\System\xHdYvCt.exe
  C:\Windows\System\xHdYvCt.exe
  2⤵
  PID:9480
- C:\Windows\System\ddNmExb.exe
  C:\Windows\System\ddNmExb.exe
  2⤵
  PID:11152
- C:\Windows\System\rOfLlpo.exe
  C:\Windows\System\rOfLlpo.exe
  2⤵
  PID:9844
- C:\Windows\System\dOslAAV.exe
  C:\Windows\System\dOslAAV.exe
  2⤵
  PID:11244
- C:\Windows\System\TBQMWFs.exe
  C:\Windows\System\TBQMWFs.exe
  2⤵
  PID:9360
- C:\Windows\System\RQuMCDR.exe
  C:\Windows\System\RQuMCDR.exe
  2⤵
  PID:8532
- C:\Windows\System\LBrxYJN.exe
  C:\Windows\System\LBrxYJN.exe
  2⤵
  PID:1392
- C:\Windows\System\oAOcTZP.exe
  C:\Windows\System\oAOcTZP.exe
  2⤵
  PID:8456
- C:\Windows\System\SJpsjpr.exe
  C:\Windows\System\SJpsjpr.exe
  2⤵
  PID:10424
- C:\Windows\System\fKSfNSy.exe
  C:\Windows\System\fKSfNSy.exe
  2⤵
  PID:10468
- C:\Windows\System\gvxCnIy.exe
  C:\Windows\System\gvxCnIy.exe
  2⤵
  PID:10400
- C:\Windows\System\FQjpNLK.exe
  C:\Windows\System\FQjpNLK.exe
  2⤵
  PID:10560
- C:\Windows\System\clMgvQj.exe
  C:\Windows\System\clMgvQj.exe
  2⤵
  PID:10628
- C:\Windows\System\VFPvLOo.exe
  C:\Windows\System\VFPvLOo.exe
  2⤵
  PID:11312
- C:\Windows\System\EWiLRkB.exe
  C:\Windows\System\EWiLRkB.exe
  2⤵
  PID:11356
- C:\Windows\System\CfBOlae.exe
  C:\Windows\System\CfBOlae.exe
  2⤵
  PID:11376
- C:\Windows\System\tgBoPkx.exe
  C:\Windows\System\tgBoPkx.exe
  2⤵
  PID:10920
- C:\Windows\System\JOTOcRG.exe
  C:\Windows\System\JOTOcRG.exe
  2⤵
  PID:10972
- C:\Windows\System\GbYLghh.exe
  C:\Windows\System\GbYLghh.exe
  2⤵
  PID:8548
- C:\Windows\System\asaVriC.exe
  C:\Windows\System\asaVriC.exe
  2⤵
  PID:8852
- C:\Windows\System\ChqCuMb.exe
  C:\Windows\System\ChqCuMb.exe
  2⤵
  PID:12304
- C:\Windows\System\jYgUPtI.exe
  C:\Windows\System\jYgUPtI.exe
  2⤵
  PID:12324
- C:\Windows\System\wWTSMYs.exe
  C:\Windows\System\wWTSMYs.exe
  2⤵
  PID:12352
- C:\Windows\System\irzqlrp.exe
  C:\Windows\System\irzqlrp.exe
  2⤵
  PID:12372
- C:\Windows\System\NhKfoOs.exe
  C:\Windows\System\NhKfoOs.exe
  2⤵
  PID:12396
- C:\Windows\System\qZkQgPz.exe
  C:\Windows\System\qZkQgPz.exe
  2⤵
  PID:12416
- C:\Windows\System\sbsbIMW.exe
  C:\Windows\System\sbsbIMW.exe
  2⤵
  PID:12440
- C:\Windows\System\vjMLakh.exe
  C:\Windows\System\vjMLakh.exe
  2⤵
  PID:12460
- C:\Windows\System\wtrKDCF.exe
  C:\Windows\System\wtrKDCF.exe
  2⤵
  PID:12484
- C:\Windows\System\KlvJVwp.exe
  C:\Windows\System\KlvJVwp.exe
  2⤵
  PID:12504
- C:\Windows\System\qOaipaA.exe
  C:\Windows\System\qOaipaA.exe
  2⤵
  PID:12524
- C:\Windows\System\aGDhBmi.exe
  C:\Windows\System\aGDhBmi.exe
  2⤵
  PID:12548
- C:\Windows\System\lSogldx.exe
  C:\Windows\System\lSogldx.exe
  2⤵
  PID:12568
- C:\Windows\System\UKOVLUh.exe
  C:\Windows\System\UKOVLUh.exe
  2⤵
  PID:12588
- C:\Windows\System\tkBdGWW.exe
  C:\Windows\System\tkBdGWW.exe
  2⤵
  PID:12608
- C:\Windows\System\gsbnpCR.exe
  C:\Windows\System\gsbnpCR.exe
  2⤵
  PID:12628
- C:\Windows\System\ZChGriq.exe
  C:\Windows\System\ZChGriq.exe
  2⤵
  PID:12648
- C:\Windows\System\SUzPQtU.exe
  C:\Windows\System\SUzPQtU.exe
  2⤵
  PID:12672
- C:\Windows\System\CRTLSkx.exe
  C:\Windows\System\CRTLSkx.exe
  2⤵
  PID:12696
- C:\Windows\System\LxvvBnJ.exe
  C:\Windows\System\LxvvBnJ.exe
  2⤵
  PID:12716
- C:\Windows\System\ZkmiQwP.exe
  C:\Windows\System\ZkmiQwP.exe
  2⤵
  PID:12736
- C:\Windows\System\KWhKEzG.exe
  C:\Windows\System\KWhKEzG.exe
  2⤵
  PID:12756
- C:\Windows\System\zZOUqZs.exe
  C:\Windows\System\zZOUqZs.exe
  2⤵
  PID:12776
- C:\Windows\System\bGIPXjX.exe
  C:\Windows\System\bGIPXjX.exe
  2⤵
  PID:12800
- C:\Windows\System\uNsAbMW.exe
  C:\Windows\System\uNsAbMW.exe
  2⤵
  PID:12824
- C:\Windows\System\ZAivBvT.exe
  C:\Windows\System\ZAivBvT.exe
  2⤵
  PID:12844
- C:\Windows\System\awJTxrY.exe
  C:\Windows\System\awJTxrY.exe
  2⤵
  PID:12868
- C:\Windows\System\isXwwwI.exe
  C:\Windows\System\isXwwwI.exe
  2⤵
  PID:12888
- C:\Windows\System\sLjeeUI.exe
  C:\Windows\System\sLjeeUI.exe
  2⤵
  PID:12912
- C:\Windows\System\TcQrEut.exe
  C:\Windows\System\TcQrEut.exe
  2⤵
  PID:12940
- C:\Windows\System\cIvVTFI.exe
  C:\Windows\System\cIvVTFI.exe
  2⤵
  PID:12964
- C:\Windows\System\oxbLZdA.exe
  C:\Windows\System\oxbLZdA.exe
  2⤵
  PID:12984
- C:\Windows\System\rNvfAHf.exe
  C:\Windows\System\rNvfAHf.exe
  2⤵
  PID:13012
- C:\Windows\System\caBHneg.exe
  C:\Windows\System\caBHneg.exe
  2⤵
  PID:13032
- C:\Windows\System\KzUebZl.exe
  C:\Windows\System\KzUebZl.exe
  2⤵
  PID:13052
- C:\Windows\System\gFbcAjC.exe
  C:\Windows\System\gFbcAjC.exe
  2⤵
  PID:9428
- C:\Windows\System\kQcTIuB.exe
  C:\Windows\System\kQcTIuB.exe
  2⤵
  PID:4424
- C:\Windows\System\JeBEpqv.exe
  C:\Windows\System\JeBEpqv.exe
  2⤵
  PID:12784
- C:\Windows\System\IlrYWnL.exe
  C:\Windows\System\IlrYWnL.exe
  2⤵
  PID:13004
- C:\Windows\System\oSXfWTo.exe
  C:\Windows\System\oSXfWTo.exe
  2⤵
  PID:12144
- C:\Windows\System\UyFIIgN.exe
  C:\Windows\System\UyFIIgN.exe
  2⤵
  PID:10264
- C:\Windows\System\hwTbgah.exe
  C:\Windows\System\hwTbgah.exe
  2⤵
  PID:12240
- C:\Windows\System\wKYAQpm.exe
  C:\Windows\System\wKYAQpm.exe
  2⤵
  PID:10016
- C:\Windows\System\anLirOV.exe
  C:\Windows\System\anLirOV.exe
  2⤵
  PID:10924
- C:\Windows\System\eAtcAdj.exe
  C:\Windows\System\eAtcAdj.exe
  2⤵
  PID:11508
- C:\Windows\System\SIzBbXI.exe
  C:\Windows\System\SIzBbXI.exe
  2⤵
  PID:11604
- C:\Windows\System\cQGBZTX.exe
  C:\Windows\System\cQGBZTX.exe
  2⤵
  PID:8292
- C:\Windows\System\HKzadWF.exe
  C:\Windows\System\HKzadWF.exe
  2⤵
  PID:12296
- C:\Windows\System\gFbZlwv.exe
  C:\Windows\System\gFbZlwv.exe
  2⤵
  PID:12412
- C:\Windows\System\vjJpOYt.exe
  C:\Windows\System\vjJpOYt.exe
  2⤵
  PID:12436
- C:\Windows\System\zEPmTAp.exe
  C:\Windows\System\zEPmTAp.exe
  2⤵
  PID:11880
- C:\Windows\System\RgYXSFs.exe
  C:\Windows\System\RgYXSFs.exe
  2⤵
  PID:13308
- C:\Windows\System\nWYIxpE.exe
  C:\Windows\System\nWYIxpE.exe
  2⤵
  PID:5004
- C:\Windows\System\AiAeWuz.exe
  C:\Windows\System\AiAeWuz.exe
  2⤵
  PID:11716
- C:\Windows\System\pRrAdbg.exe
  C:\Windows\System\pRrAdbg.exe
  2⤵
  PID:12244
- C:\Windows\System\BMqXySp.exe
  C:\Windows\System\BMqXySp.exe
  2⤵
  PID:13064
- C:\Windows\System\wPqqbwi.exe
  C:\Windows\System\wPqqbwi.exe
  2⤵
  PID:12952
- C:\Windows\System\UVBNOJn.exe
  C:\Windows\System\UVBNOJn.exe
  2⤵
  PID:12856
- C:\Windows\System\aOozfZX.exe
  C:\Windows\System\aOozfZX.exe
  2⤵
  PID:12728
- C:\Windows\System\AnyGPPS.exe
  C:\Windows\System\AnyGPPS.exe
  2⤵
  PID:9636
- C:\Windows\System\ubRynsI.exe
  C:\Windows\System\ubRynsI.exe
  2⤵
  PID:12840
- C:\Windows\System\qZsOPMA.exe
  C:\Windows\System\qZsOPMA.exe
  2⤵
  PID:11860
- C:\Windows\System\SggYjER.exe
  C:\Windows\System\SggYjER.exe
  2⤵
  PID:12032
- C:\Windows\System\XdmXTwz.exe
  C:\Windows\System\XdmXTwz.exe
  2⤵
  PID:12084
- C:\Windows\System\bCpkBIA.exe
  C:\Windows\System\bCpkBIA.exe
  2⤵
  PID:12268
- C:\Windows\System\YtSEizo.exe
  C:\Windows\System\YtSEizo.exe
  2⤵
  PID:13336
- C:\Windows\System\TWPwidk.exe
  C:\Windows\System\TWPwidk.exe
  2⤵
  PID:13392
- C:\Windows\System\GyVBLhu.exe
  C:\Windows\System\GyVBLhu.exe
  2⤵
  PID:13416
- C:\Windows\System\UXxZFyc.exe
  C:\Windows\System\UXxZFyc.exe
  2⤵
  PID:13444
- C:\Windows\System\hgdyIlw.exe
  C:\Windows\System\hgdyIlw.exe
  2⤵
  PID:13464
- C:\Windows\System\NksZGNa.exe
  C:\Windows\System\NksZGNa.exe
  2⤵
  PID:13488
- C:\Windows\System\fklMJYy.exe
  C:\Windows\System\fklMJYy.exe
  2⤵
  PID:13520
- C:\Windows\System\LzVtzkE.exe
  C:\Windows\System\LzVtzkE.exe
  2⤵
  PID:13540
- C:\Windows\System\iftNyoI.exe
  C:\Windows\System\iftNyoI.exe
  2⤵
  PID:13564
- C:\Windows\System\DUNEAnP.exe
  C:\Windows\System\DUNEAnP.exe
  2⤵
  PID:13592
- C:\Windows\System\EdhVjuw.exe
  C:\Windows\System\EdhVjuw.exe
  2⤵
  PID:13616
- C:\Windows\System\XmHDLUX.exe
  C:\Windows\System\XmHDLUX.exe
  2⤵
  PID:13636
- C:\Windows\System\QrFLXpZ.exe
  C:\Windows\System\QrFLXpZ.exe
  2⤵
  PID:13660
- C:\Windows\System\CevPKBw.exe
  C:\Windows\System\CevPKBw.exe
  2⤵
  PID:13684
- C:\Windows\System\PfHIklh.exe
  C:\Windows\System\PfHIklh.exe
  2⤵
  PID:13704
- C:\Windows\System\QuvfAnK.exe
  C:\Windows\System\QuvfAnK.exe
  2⤵
  PID:13732
- C:\Windows\System\gJADxJr.exe
  C:\Windows\System\gJADxJr.exe
  2⤵
  PID:13760
- C:\Windows\System\OXZjRiE.exe
  C:\Windows\System\OXZjRiE.exe
  2⤵
  PID:13780
- C:\Windows\System\FdrGJQF.exe
  C:\Windows\System\FdrGJQF.exe
  2⤵
  PID:13804
- C:\Windows\System\UKaAqzW.exe
  C:\Windows\System\UKaAqzW.exe
  2⤵
  PID:13828
- C:\Windows\System\ZSjNHoV.exe
  C:\Windows\System\ZSjNHoV.exe
  2⤵
  PID:13856
- C:\Windows\System\jTpXoyQ.exe
  C:\Windows\System\jTpXoyQ.exe
  2⤵
  PID:13876
- C:\Windows\System\ejsBBZd.exe
  C:\Windows\System\ejsBBZd.exe
  2⤵
  PID:13904
- C:\Windows\System\eGEZEbA.exe
  C:\Windows\System\eGEZEbA.exe
  2⤵
  PID:13924
- C:\Windows\System\yJUzjJE.exe
  C:\Windows\System\yJUzjJE.exe
  2⤵
  PID:13944
- C:\Windows\System\kczEhyX.exe
  C:\Windows\System\kczEhyX.exe
  2⤵
  PID:13968
- C:\Windows\System\KhVOBUS.exe
  C:\Windows\System\KhVOBUS.exe
  2⤵
  PID:13992
- C:\Windows\System\BRjEzHP.exe
  C:\Windows\System\BRjEzHP.exe
  2⤵
  PID:14016
- C:\Windows\System\aRfhLxG.exe
  C:\Windows\System\aRfhLxG.exe
  2⤵
  PID:14036
- C:\Windows\System\VsWOEpT.exe
  C:\Windows\System\VsWOEpT.exe
  2⤵
  PID:14060
- C:\Windows\System\GewFnPR.exe
  C:\Windows\System\GewFnPR.exe
  2⤵
  PID:14084
- C:\Windows\System\yzSGBnd.exe
  C:\Windows\System\yzSGBnd.exe
  2⤵
  PID:14108
- C:\Windows\System\pCresQA.exe
  C:\Windows\System\pCresQA.exe
  2⤵
  PID:14132
- C:\Windows\System\gBKeVSR.exe
  C:\Windows\System\gBKeVSR.exe
  2⤵
  PID:14156
- C:\Windows\System\ojAefYj.exe
  C:\Windows\System\ojAefYj.exe
  2⤵
  PID:14176
- C:\Windows\System\OsHTcZL.exe
  C:\Windows\System\OsHTcZL.exe
  2⤵
  PID:14208
- C:\Windows\System\JReGXIx.exe
  C:\Windows\System\JReGXIx.exe
  2⤵
  PID:14232
- C:\Windows\System\crIGImI.exe
  C:\Windows\System\crIGImI.exe
  2⤵
  PID:14256
- C:\Windows\System\wdOvBWM.exe
  C:\Windows\System\wdOvBWM.exe
  2⤵
  PID:14276
- C:\Windows\System\fzZVoxP.exe
  C:\Windows\System\fzZVoxP.exe
  2⤵
  PID:14296
- C:\Windows\System\ICpxZMa.exe
  C:\Windows\System\ICpxZMa.exe
  2⤵
  PID:14320
- C:\Windows\System\mrnmZTH.exe
  C:\Windows\System\mrnmZTH.exe
  2⤵
  PID:11108
- C:\Windows\System\roSUZAt.exe
  C:\Windows\System\roSUZAt.exe
  2⤵
  PID:3524

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:12756

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:13856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CyhBsfa.exe

Filesize
1.6MB

MD5
66827479327c1344f49c6644bfba8a35

SHA1
6def471e97fe38a7051646ce70c91c59d200b172

SHA256
2036a70b620d0043af81c7cea7cd62730ad5ef5603b46fb310ecd047892af92a

SHA512
ca2acb6aadd30d6c68631e51fdbcb5b381c79bc0360dd20d994c44179e68c1ee7ee306c4961c1358a0021015edf5e82355636a1e47ed95790330a31e0c32201d

Download Submit
C:\Windows\System\EsSdzeB.exe

Filesize
1.6MB

MD5
a189af38a3f6f2005843954e38c667fd

SHA1
d4a61f54d14bab80f235cbade3875cd5fcc455be

SHA256
3d86d294dec4d8a6102f175dfabdf51cf71dca1de5b890e2f9c271f3f640c2e8

SHA512
bd83869738ca923a1846ae35587e80ccc86215b311f5590f1281bbc65029bbf45b0e5f42b108acc581762571f5aeb35d2b89f2027d6d44dcaa49526e04936cb8

Download Submit
C:\Windows\System\KFWikoe.exe

Filesize
1.6MB

MD5
48afee716add4dea77516476d7369ab2

SHA1
cad530ea0c23131e6c5616479f992395e15755f2

SHA256
91a32e86cc95c0f42d6f5b449174d3ed99b0737ea8331b428748dbfa99f3a791

SHA512
b386b7756c0d75b3056a1e4232d9e5b71c44ca4aae4962616d68809b33cbf31bd61829b8c94f2244e23da11d11d7ab9a612e99d31e3602860bbd92e2f646be69

Download Submit
C:\Windows\System\KgCHXzO.exe

Filesize
1.6MB

MD5
a06785259354079918550a729bf19d00

SHA1
1c7ec34ff24e330396e7ebe8def02659e23bc752

SHA256
4cd14d30fd01c466ccc0ce406d84637e9fc9c7868c8f541d07adeb4611f6d87b

SHA512
70683ad98ba24dd020d3f2d7f6736a1c122c1cd53016d5a682f45386dae3345158f7eff97f09e65e0eb32000b11b6b203de598f7ca50b293a389721faba8cb5f

Download Submit
C:\Windows\System\LMdHfiE.exe

Filesize
1.6MB

MD5
242508763c0f3f870ee506884892fdd0

SHA1
1a276090f98c8ca3f9d17fbd0e83262e283a5b18

SHA256
b87309a4cfa71d3435fd958b13510c5ed9d077f7167b15aa2121a377b5a8f8d8

SHA512
674d0b84bd02340b6c845f29bb48ea5c8e24755f1ff4c672271830131470f18d6072ab861e3338ebae2ae00b005ceb26a7b4ae2c28192f0aea016c78e5a3e1ea

Download Submit
C:\Windows\System\LZYaEnt.exe

Filesize
1.6MB

MD5
f093f4ab416ed1f1d2cc63b8fb7e786b

SHA1
39d41c3aa3ace141b883ec56c6afc5a69a85d301

SHA256
15530dbb86ca1a43b93a691c20fab2e31a5d990f63825472f32f54b6601c974d

SHA512
20c52729eb2605173199e177c9bd723f4866bfc322f02788f7e925026ba1f78f550d08ee0b4ff8913caac0d5d90ba6875814a5c5553cb868b94a93feb074ff24

Download Submit
C:\Windows\System\LscjugA.exe

Filesize
1.6MB

MD5
4c3637b914338fef26c598c61ba11fe1

SHA1
6e2bcabe4fc1344eaf80508f8278009dc39261b4

SHA256
5eda5f3dd0c5e8f9053dfed27bbfa776857d3702dbcf084c0853dd2c87678221

SHA512
0348d1629fa36235d1629dde9261dfe964885223eb7d86750c5e1fa0f4462193ce8cd26723ae8d3a2d8e3c10fddfffcbb5c89b30c1267fe83b04b529dd43d7ed

Download Submit
C:\Windows\System\NbXegua.exe

Filesize
1.6MB

MD5
54a9c3981690a1023c54563f274efc96

SHA1
6bff8c226374cbad85bfb322a879b68b4b511a56

SHA256
b96a21ccee43a66ae7709a47a4704e96beaa1978e9ef000c4194a594c39417f1

SHA512
c0dfe665c167da563d8b9de992ec83807bc28043177832af2a2573ea6377609038e568f5686f6f32901e8811fc27f1e17ce9e863086017f2cb3e5f53f0050766

Download Submit
C:\Windows\System\OBciGMJ.exe

Filesize
1.6MB

MD5
6cee3baeb8fae3301b179f828e3eec55

SHA1
59997a0d77e9dd489a90198dcb5bfe13c44a1663

SHA256
5a0bf5a2cb38a22e6a3a32db46b2d36e9f42c127cfdef7b1463e86c8dff1346b

SHA512
8eda2d62bc5aec8235b2be0c0aba6009c4eff023305dfc14af59f6c38cb753a265607409d7464ec2cff4e2c2596c7181b7d97f7499cad082673cec5ed72b9211

Download Submit
C:\Windows\System\ObkxZjX.exe

Filesize
1.6MB

MD5
400db6ba36aea683262b263735b92861

SHA1
3989e71ea96b49f1c1a7703b6cb0d03c67a2355e

SHA256
50ba2149234d3c51e6c99a44d046f5786db8460f44671d3a74f9a46b60b16595

SHA512
5ea039b95b41db8c34b09dcc567da3b7ca3885541069339d4da9e48ab8d1cdb1a0d694ff604c4b1325b8831705ef5761c09e4208396799def8a7f3b8b1954309

Download Submit
C:\Windows\System\RFcKqAk.exe

Filesize
1.6MB

MD5
d8bd3ba2f8e814cf4cafa94fe3013faa

SHA1
5e213c34cd099e8c62b607b7070ba130616bc140

SHA256
289bc97a63fefba57b9f8ab06a947737f891282611e221cddf88c38d902715c4

SHA512
909a5685d952c8d6be5a2313cde32ee078c3960d329ed799e525acc05494564754df2091428505cbf2ac6ed9d7d970a5bce915eb75b8740cf8d0ad046609f98a

Download Submit
C:\Windows\System\SEYxftU.exe

Filesize
1.6MB

MD5
d05a2a9485e315314bc4df8cf02a9433

SHA1
8ff5d6aa6c948f51faf01078af3f57dcf8d0c4a6

SHA256
a9fffcb48f3f642f78f68f30d779ec45fa88e0d704f2979e5dc8abb5660a3bf5

SHA512
4aeb9c7cec8b1c38d11735515f04f5521fc040d3dd8a38933f4aa7dd691f1ec8628d9605733f886af0443e7a2d4b5fdfb900a15baeabe0bd73b5521a7174380a

Download Submit
C:\Windows\System\SwzysiL.exe

Filesize
1.6MB

MD5
59323eb5bfc4a5ffa53e375316594ad7

SHA1
53112d5e4d22a348fe3dfadc528328dd39e9783d

SHA256
687c56e32aaf0fef882cceb72a663d2ed1910da4fc45f61897fdfb66aeac25cf

SHA512
957d16706615784e7ce93bf8f8316d1cae0479ee56cd0afd923d403b94c17430475c05c786b7a41cfdaaa862c51dcc996313791276562d91a7b91433e9c4d2af

Download Submit
C:\Windows\System\SxBYcEE.exe

Filesize
1.6MB

MD5
03ed4cdd7521e5c5ba9335bbf393721a

SHA1
7a02bd52ddf17adb39fb3156324a78d69f35be01

SHA256
9867397effa6b817e1c2000b8e56122520999e0848e8f8d7269da9d2bdc992d6

SHA512
975a0bf404a98eb0b9d4f6d58916ede6069b35c2dc3e1f5ba77641e36d287b57365b67f5ec3fcaef7c15ce3bff64f8d32e986a69efa42ed154e73358317858ea

Download Submit
C:\Windows\System\TaNgvcN.exe

Filesize
1.6MB

MD5
ea37d2612bffc1066ec8f8eafd4119bb

SHA1
3fdddf381689e5da25981cbab531e87d328e22e5

SHA256
afa9ba9ae524d88d18623a7c2bdc67696a08554aafab9a4b98edaae0a657413c

SHA512
ca2006a147ebd3fe917dea707e889d37adf7ac0ba36847fe831f6fae85b7e76492486dac15d64d1414f5b8fa31c0661fa8fa0e8eea41f3778b7e29cf5091b2d6

Download Submit
C:\Windows\System\TpysrAD.exe

Filesize
1.6MB

MD5
5a0510d152f0abe86be77ca7b2b5ec90

SHA1
52cd15e56aa235a4571accf36c0d7b9963763c68

SHA256
c7cb1be0ec6bc61bb08d961ce18ef44d9e15b53d3b9f093159b7f329874202b0

SHA512
b130064a7bc6c51564e80e236eb22e5b927b009afa2b12b05fb8debe9d60c3f1fe97dc7706a8b5c837002494524e90e78ff0031b5c63f5b7e683aab20a747883

Download Submit
C:\Windows\System\TuYgQjG.exe

Filesize
1.6MB

MD5
f92a1139fc2bfa6c0b1bd6b4fea7ec0c

SHA1
2baae4928ce4e903182e8db39b5510e48f5650a8

SHA256
92faf09894f0c8993cab0aaa8d0f8c1944c15f02868efdecf3e0ae1441efc939

SHA512
1150b5ef0e3ed24bc994153cd80fcb40260b91cd97da1eab662f196068ccf401096dfd0f1f6bc023b57fe9813905b6dc7ec7573c4aec7704880630fa58a40216

Download Submit
C:\Windows\System\TzfqpXU.exe

Filesize
1.6MB

MD5
2479d78a945c9c43a195f675a81e52a1

SHA1
8a0cf567e4ce6a1eca55dfec870451266f73a463

SHA256
e35cd938b6fb14027f2183d06321a4ebca45d7b51bf580e1b874f1912ee1fee5

SHA512
12c3ffb20b4b491dbcdeb4766e2c6b88036207394411561c5703960809c7eccbd55731aafed7a160e4bae1d5c41690a4875d42825236a8b54aeeeb66af94c60e

Download Submit
C:\Windows\System\UYxifXd.exe

Filesize
1.6MB

MD5
618f60db6be183754ca20753de59034e

SHA1
e647d2d60278b41baac519dcb98b973e0a5a0b95

SHA256
f89626ad33f937d8571039adc2074529dd3182fec9fd7904a804f9caa187c43d

SHA512
c28877c0a3e965c3a0cc02f8cc3db19b4a38f56c0d59a08fa73451bc2acfb14512f98cbbe3a9b768f39e71ff22cd6986170bed4a9ebb8df925f0616d2a20f7a3

Download Submit
C:\Windows\System\VTESgKL.exe

Filesize
1.6MB

MD5
ec355a4d28c105ff624029f3ca2e7bd4

SHA1
53623078bac2b483576dfd5e82c9921e4d6d72fc

SHA256
1cc088d7e59449e5496b33cf0a3070d4834881c814b10f4127230de23adc1953

SHA512
588b4c83b3cabb8907799bb0250177e704ff92def4bc6945ad5809e7899c77cb0a7ec415a955c030475c7038c383e7287e781fcb1cf0ff4bceedb5975ff6115f

Download Submit
C:\Windows\System\WqscTSS.exe

Filesize
1.6MB

MD5
97795f8cc278bb9362573d9027f2850c

SHA1
0b93c7ddff39913b570f06ef7b1f8392f33d157c

SHA256
1d3feb0704c26d616304a1170d9f9b77142cc40725fa2e7320b651c22d3b35a8

SHA512
e823afc1ff7b2bb3350db5b9ec53c25a27566bd3459b0af8a54c2188a0b417abfaca66937de5d340590c422c2b739c1ff208f09c83af09267cd94f9a35d426b2

Download Submit
C:\Windows\System\XNcapTk.exe

Filesize
1.6MB

MD5
66fb2246246d2faed49462e20528af54

SHA1
2b643d63a5d8861417f943b6feac798a2ea16cac

SHA256
fc4f5c1a14df044a754b93d035b9f483a07eeaafc2340e3ac74227369f4cd7d1

SHA512
c8735139af1c3145b974e55a02c5cf40299029f01f55add82a4aefb297b924c78ec6e3c659bf531c535c656838a7eb23cb01a5619d06ef791e548f27f20e01a4

Download Submit
C:\Windows\System\ebOVleI.exe

Filesize
1.6MB

MD5
ff96314e4b71eeca9839e44d4c6b2523

SHA1
feb519c4dda841850809923cb4e269c151987c00

SHA256
7b988e71ff20c01e78f2ae6dddff6677edafb2614a0dfda7289f366e3bcedd79

SHA512
f00414ad40d086cb932c9495873f4763e6e7f991ecea4292e48a06552368303a6f9d5222449a49da47d3a721db20cbd639a00fc69456c70b45b9bc7334219613

Download Submit
C:\Windows\System\efsvsWs.exe

Filesize
1.6MB

MD5
869922c3fbda47b90a3fbc3bf0225d24

SHA1
428ccf77c97fd03757a1bc70536c38829af9d1a8

SHA256
158634d2957699f5322cdf58e2818a6ee3cda99ed030f17913bb5c6edabe109e

SHA512
24420ace658356e101b6aea0237dbf83e1058c64f7187eeafd1358478e3caea7edc6759ffc3dc7a9c8b7e4d4b7605dd3f99ed1236f997a741f941972a333933e

Download Submit
C:\Windows\System\fWSZcgH.exe

Filesize
1.6MB

MD5
2fed759c4f8da11fecbb10e0fcbb6789

SHA1
d74cfc83f4de5cd8a887f6cd7caabff388d26a36

SHA256
841cddda32afba82e0e8ca34c62dd1f9430b0cfa15ff1b26b4ed955a7edc3af1

SHA512
af61497c88b0dcfe272af9af668324aea40439ada5ec172ca926fd440fd0a0941c78fdaa4788f8a1b23501b1fb4ea9f12d0142432163fa8fd7eb11cda9c94edd

Download Submit
C:\Windows\System\gHmYikB.exe

Filesize
1.6MB

MD5
971d88aca175ab1626ca671cf9d6bf93

SHA1
ab5a5582cd18032b62ca1c982c67a97432cf1ba4

SHA256
bdca5b89de848d63e7934992d5329644d6fa558bc6d9549689e3a6a0825760ca

SHA512
49b80c0e9311d2f24a2f454a98f2d2c431367a508b6f4a804c1652516f5bc65b95ab502ddeeabc63ec53408deb1ba21c3db366e4644a64b7c63b8711abf81c67

Download Submit
C:\Windows\System\hVgoZUO.exe

Filesize
1.6MB

MD5
515fe6339f39a2aefde5fc13d5e7ee4c

SHA1
8620063ecbfb63936f7f4e42fdf46dba30046f5f

SHA256
884bed8c474e05ddc302fe2c5a3eabccf787305116dd82140a547b5d2a94c273

SHA512
39a5e9db17d383208730cc97b87ac5078f1d1e359bb15f1b558a1f09631192169add8f364ec935a74ada47e1cdc9661d8bce80b85e1bdb5dd2ac4d469d6f10ae

Download Submit
C:\Windows\System\hgCqahN.exe

Filesize
1.6MB

MD5
95459314c23865705a561b1dd975bca5

SHA1
dc6961bbf00e396291a36ca62abba7668a467969

SHA256
ead24d9b6710cc47267495145f8836c1e23adac68dfc88ebb087ba861685af9b

SHA512
422f6d8c088b8ac00100660c4036f5863ed583d42e9aab5544d86ec24197890066b2983b830928494369a0885542947d1c8e2067659dc52eee949f05ec433adb

Download Submit
C:\Windows\System\iSEMGiX.exe

Filesize
1.6MB

MD5
74c651217af2cb72d11c1850433c99e5

SHA1
c1ef4ce03a5796e05cfb644edc2e05453d4503be

SHA256
023ee73827115d15cacf2fbf9462d4d7e25a151c6a9a6c592d14afabf4193892

SHA512
6ee32a30ec0415b1933d642709b61a82c0a9b07f524a22c401cc84990dfaf37d43641f84aacdc60cc0fe201bea8b0d353d4e83286302757c4a6fad730f8434db

Download Submit
C:\Windows\System\jpmxdCB.exe

Filesize
1.6MB

MD5
27a8996af0680bc20eee9162c6c6883d

SHA1
23944f47ef0b5980030a20e910a0311a7639a1ab

SHA256
2b202fefb7746454a2b2e5a62e8d80d3e92d9ae03aacd950d44dfa3be0d84a4c

SHA512
95166045eb467355d0eb70ec9bf5066c57b99de38769077131b0e414d24062646e539bf68ab53a7dea6494d5702ab366f593e91a73806e1c10435c468cc1684e

Download Submit
C:\Windows\System\mJclguU.exe

Filesize
1.6MB

MD5
29884ad710b7994e2a7c87723a42a7a2

SHA1
879a4706b03d3c552a36a3e1c6fa067fff6329a3

SHA256
97a056949c1c4b3045f99be4c0456adb27f4843c49e8c4c449eb0f98408dbab8

SHA512
77772605f4f838d3afb8047dee98941a25d8e4a606a2de35b5ff50b4f783c4f0e556b015ea16decad2b07e9ba292138ca7ad0db3605d9e736816ef550e12d8bb

Download Submit
C:\Windows\System\oMkdAiq.exe

Filesize
1.6MB

MD5
4e48a15d5e9f6f48e1ae773293d856b1

SHA1
ddcb12459325bbbad989888cca3e057e102304c4

SHA256
e9091ecfd647d5eb9987b8b64a1a6b5d6734a383aa6f860dfefbbc2ee38453ac

SHA512
fbcd8db66570f9173163dc30c875be8df8a45e510576b03545b4a66836b404fdbab3d256fff08f71ac5da61c063f3ec48a1ccaa00ccd4cc471b530651fe3242c

Download Submit
C:\Windows\System\pGQNTbZ.exe

Filesize
1.6MB

MD5
835c6bf719f8981e4bd034f207c60200

SHA1
3c73b90877e56d9f776622722749bb3774cdc4f6

SHA256
ff277c5964a4bff744a58947ad36bfe500814207fb149f8cbf9a955b44996d1e

SHA512
c0914d776fa550372699e8838dd870f6be8e6e6adad24da1b323c4f14b5597fa9a29e124fd497737aac87ca887337419e3e994065ee36af9f92fcf1a277095b0

Download Submit
C:\Windows\System\pmEuFgL.exe

Filesize
1.6MB

MD5
f2259161b6179dd436762ba3fbf6b655

SHA1
1943eb27b24d29769ac1cf08fac309057702fae3

SHA256
50646803759fbce5497e8084ebeca3a4d73f0ba36a91e603201f22b621bc4dc2

SHA512
b57c45b9cf8b91330888adb082b7eb75bfb34ad953f5a9bcb08c0b811ebb205285ccbbb66210061830a2b3396d5128062d87a024dcd67f63f0f6f44aa1bf501d

Download Submit
C:\Windows\System\pmfcSKV.exe

Filesize
1.6MB

MD5
af171a5b54a79cded0a3cb6841f8d612

SHA1
7ddfdb6866b5ad86238e42c61837426b9c82b3a8

SHA256
2c03eca25e8b3cb1339ae2ec61a9ffd0575d8501bed61025ea3b74a4875baf8c

SHA512
4446db1404fc653952f7b6109497df1402abf43804f991f7340a9cd14618bf1e87f92719ef300e247f5ebdbe76f49f977e46fca06b8532247870326e3afe1a0c

Download Submit
C:\Windows\System\qbwgwSM.exe

Filesize
1.6MB

MD5
68c675dafad638eb8742ce48f216600a

SHA1
b0276c8085de47947fdb9d7abe72257927d0ca3a

SHA256
27da8ad91331559137a6c47ae0d07a97ef5bba619c198fde08b794a981e596b7

SHA512
16445463d1f1cf9bcd104df4ac145477df3ace0c9373516381f90d15f562960941ecb9feacaac2af89e8ec2e0b3fb477c9f2dba36930bc9bc2f6c07dd220c489

Download Submit
C:\Windows\System\wGKZWPu.exe

Filesize
1.6MB

MD5
4a994f4c89e1bd816a2e839013e2a68e

SHA1
d277e9f7ff46cf18a5c46b67a98b4fd39f9fa6d2

SHA256
34d2a7dd82929130315d04c7273139e10a6b1356c125bb708c4d26faaf6bed44

SHA512
bccf5b6b817ef40b26ca78e46804790510277e24772a579b31c44d8f83ca1f48ca92b0b55f1c8bb56c3424fa5e2523cb674311f954ebec1831de8434a097b5b2

Download Submit
C:\Windows\System\xfYVWyO.exe

Filesize
1.6MB

MD5
362de4f80b9dc0fb6d3720d60b62add0

SHA1
fa9a929f50775869c335c0ab4c0c4d98a2d20365

SHA256
63569f0822eb643fda6dd631da5106365146b65943767a252eb15f5d581db791

SHA512
720f85c747c2c3490cd3e1f672a4270c68e9b540286fb7127f776b03b2fdedb07f13c19522da5c79b24c659d8fb0951ccd0e35659d18d80355d5b760727e258f

Download Submit
C:\Windows\System\zReyzXg.exe

Filesize
1.6MB

MD5
605f738ca71bf0907458a245e1c6919e

SHA1
c82ae5acc57f360176523523288ec03c286f7245

SHA256
ebbc63510e8413fe3dc3091958049c8d3a906a7eb4704335942ffa0c842c2233

SHA512
7b8365b6a3f10e32d81a253ba20e1c29a3862c592b7a757259f2668273e8afbe53be50eca222d2d9d03e13c0127168a063de372abf0613a9dee8bc460a628d02

Download Submit
memory/8-2278-0x00007FF64C360000-0x00007FF64C6B1000-memory.dmp

Filesize
3.3MB

Download
memory/8-419-0x00007FF64C360000-0x00007FF64C6B1000-memory.dmp

Filesize
3.3MB

Download
memory/220-2225-0x00007FF7C0A40000-0x00007FF7C0D91000-memory.dmp

Filesize
3.3MB

Download
memory/220-94-0x00007FF7C0A40000-0x00007FF7C0D91000-memory.dmp

Filesize
3.3MB

Download
memory/220-2261-0x00007FF7C0A40000-0x00007FF7C0D91000-memory.dmp

Filesize
3.3MB

Download
memory/944-193-0x00007FF720540000-0x00007FF720891000-memory.dmp

Filesize
3.3MB

Download
memory/944-2281-0x00007FF720540000-0x00007FF720891000-memory.dmp

Filesize
3.3MB

Download
memory/1032-2258-0x00007FF76B710000-0x00007FF76BA61000-memory.dmp

Filesize
3.3MB

Download
memory/1032-472-0x00007FF76B710000-0x00007FF76BA61000-memory.dmp

Filesize
3.3MB

Download
memory/1060-473-0x00007FF671460000-0x00007FF6717B1000-memory.dmp

Filesize
3.3MB

Download
memory/1060-2286-0x00007FF671460000-0x00007FF6717B1000-memory.dmp

Filesize
3.3MB

Download
memory/1068-2243-0x00007FF6C5BC0000-0x00007FF6C5F11000-memory.dmp

Filesize
3.3MB

Download
memory/1068-471-0x00007FF6C5BC0000-0x00007FF6C5F11000-memory.dmp

Filesize
3.3MB

Download
memory/1224-2256-0x00007FF7A5350000-0x00007FF7A56A1000-memory.dmp

Filesize
3.3MB

Download
memory/1224-156-0x00007FF7A5350000-0x00007FF7A56A1000-memory.dmp

Filesize
3.3MB

Download
memory/1284-2249-0x00007FF7685F0000-0x00007FF768941000-memory.dmp

Filesize
3.3MB

Download
memory/1284-235-0x00007FF7685F0000-0x00007FF768941000-memory.dmp

Filesize
3.3MB

Download
memory/1336-2283-0x00007FF7BCF00000-0x00007FF7BD251000-memory.dmp

Filesize
3.3MB

Download
memory/1336-474-0x00007FF7BCF00000-0x00007FF7BD251000-memory.dmp

Filesize
3.3MB

Download
memory/1480-62-0x00007FF7F02F0000-0x00007FF7F0641000-memory.dmp

Filesize
3.3MB

Download
memory/1480-2245-0x00007FF7F02F0000-0x00007FF7F0641000-memory.dmp

Filesize
3.3MB

Download
memory/1492-2270-0x00007FF798280000-0x00007FF7985D1000-memory.dmp

Filesize
3.3MB

Download
memory/1492-369-0x00007FF798280000-0x00007FF7985D1000-memory.dmp

Filesize
3.3MB

Download
memory/1836-2105-0x00007FF68C830000-0x00007FF68CB81000-memory.dmp

Filesize
3.3MB

Download
memory/1836-1-0x000001BBAA2E0000-0x000001BBAA2F0000-memory.dmp

Filesize
64KB

Download
memory/1836-0-0x00007FF68C830000-0x00007FF68CB81000-memory.dmp

Filesize
3.3MB

Download
memory/1872-469-0x00007FF7BDCC0000-0x00007FF7BE011000-memory.dmp

Filesize
3.3MB

Download
memory/1872-2290-0x00007FF7BDCC0000-0x00007FF7BE011000-memory.dmp

Filesize
3.3MB

Download
memory/2156-50-0x00007FF629730000-0x00007FF629A81000-memory.dmp

Filesize
3.3MB

Download
memory/2156-2238-0x00007FF629730000-0x00007FF629A81000-memory.dmp

Filesize
3.3MB

Download
memory/2156-2223-0x00007FF629730000-0x00007FF629A81000-memory.dmp

Filesize
3.3MB

Download
memory/2196-322-0x00007FF6BD290000-0x00007FF6BD5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-2294-0x00007FF6BD290000-0x00007FF6BD5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2560-2263-0x00007FF659210000-0x00007FF659561000-memory.dmp

Filesize
3.3MB

Download
memory/2560-467-0x00007FF659210000-0x00007FF659561000-memory.dmp

Filesize
3.3MB

Download
memory/2688-289-0x00007FF6E4130000-0x00007FF6E4481000-memory.dmp

Filesize
3.3MB

Download
memory/2688-2265-0x00007FF6E4130000-0x00007FF6E4481000-memory.dmp

Filesize
3.3MB

Download
memory/2788-2292-0x00007FF6EFF00000-0x00007FF6F0251000-memory.dmp

Filesize
3.3MB

Download
memory/2788-404-0x00007FF6EFF00000-0x00007FF6F0251000-memory.dmp

Filesize
3.3MB

Download
memory/2904-119-0x00007FF73C540000-0x00007FF73C891000-memory.dmp

Filesize
3.3MB

Download
memory/2904-2250-0x00007FF73C540000-0x00007FF73C891000-memory.dmp

Filesize
3.3MB

Download
memory/3188-238-0x00007FF68AC70000-0x00007FF68AFC1000-memory.dmp

Filesize
3.3MB

Download
memory/3188-2276-0x00007FF68AC70000-0x00007FF68AFC1000-memory.dmp

Filesize
3.3MB

Download
memory/3520-2252-0x00007FF7EC4F0000-0x00007FF7EC841000-memory.dmp

Filesize
3.3MB

Download
memory/3520-470-0x00007FF7EC4F0000-0x00007FF7EC841000-memory.dmp

Filesize
3.3MB

Download
memory/3572-2274-0x00007FF6050B0000-0x00007FF605401000-memory.dmp

Filesize
3.3MB

Download
memory/3572-271-0x00007FF6050B0000-0x00007FF605401000-memory.dmp

Filesize
3.3MB

Download
memory/4148-2296-0x00007FF70E4F0000-0x00007FF70E841000-memory.dmp

Filesize
3.3MB

Download
memory/4148-468-0x00007FF70E4F0000-0x00007FF70E841000-memory.dmp

Filesize
3.3MB

Download
memory/4388-2247-0x00007FF7EB080000-0x00007FF7EB3D1000-memory.dmp

Filesize
3.3MB

Download
memory/4388-155-0x00007FF7EB080000-0x00007FF7EB3D1000-memory.dmp

Filesize
3.3MB

Download
memory/4496-2280-0x00007FF676A60000-0x00007FF676DB1000-memory.dmp

Filesize
3.3MB

Download
memory/4496-403-0x00007FF676A60000-0x00007FF676DB1000-memory.dmp

Filesize
3.3MB

Download
memory/4644-460-0x00007FF6BC7D0000-0x00007FF6BCB21000-memory.dmp

Filesize
3.3MB

Download
memory/4644-2266-0x00007FF6BC7D0000-0x00007FF6BCB21000-memory.dmp

Filesize
3.3MB

Download
memory/4736-23-0x00007FF73E480000-0x00007FF73E7D1000-memory.dmp

Filesize
3.3MB

Download
memory/4736-2221-0x00007FF73E480000-0x00007FF73E7D1000-memory.dmp

Filesize
3.3MB

Download
memory/4736-2240-0x00007FF73E480000-0x00007FF73E7D1000-memory.dmp

Filesize
3.3MB

Download
memory/4868-475-0x00007FF6B89B0000-0x00007FF6B8D01000-memory.dmp

Filesize
3.3MB

Download
memory/4868-2272-0x00007FF6B89B0000-0x00007FF6B8D01000-memory.dmp

Filesize
3.3MB

Download
memory/5020-321-0x00007FF6DD830000-0x00007FF6DDB81000-memory.dmp

Filesize
3.3MB

Download
memory/5020-2254-0x00007FF6DD830000-0x00007FF6DDB81000-memory.dmp

Filesize
3.3MB

Download
memory/5052-461-0x00007FF67B5B0000-0x00007FF67B901000-memory.dmp

Filesize
3.3MB

Download
memory/5052-2298-0x00007FF67B5B0000-0x00007FF67B901000-memory.dmp

Filesize
3.3MB

Download