xmrig | 06036f90b51a789b961e5971896086fd4d45916befb2774eb1f0750d3eea0a3a

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
Size

2.3MB
MD5

889f9dd859f5cb90df23d20c4797f760
SHA1

15555cbd9807bb53d417e4aca3a20d6a224e9571
SHA256

06036f90b51a789b961e5971896086fd4d45916befb2774eb1f0750d3eea0a3a
SHA512

54ea0729ded72b49e4657c1783839185adfee2a21f0c28fd6676e3ad0143f728df614d186e8ae4bac77aa3b111c9633e2961657822bd0a5961fe078f97c3f84e
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+A4VBqxGLI9er:BemTLkNdfE0pZrX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5032-0-0x00007FF6694F0000-0x00007FF669844000-memory.dmp	xmrig
behavioral2/files/0x0008000000023409-5.dat	xmrig
behavioral2/memory/4948-12-0x00007FF7D51B0000-0x00007FF7D5504000-memory.dmp	xmrig
behavioral2/memory/1760-26-0x00007FF724070000-0x00007FF7243C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-33.dat	xmrig
behavioral2/files/0x0007000000023411-37.dat	xmrig
behavioral2/memory/4420-40-0x00007FF65F090000-0x00007FF65F3E4000-memory.dmp	xmrig
behavioral2/memory/4256-45-0x00007FF74A8D0000-0x00007FF74AC24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-53.dat	xmrig
behavioral2/files/0x0007000000023413-51.dat	xmrig
behavioral2/memory/4956-48-0x00007FF70A270000-0x00007FF70A5C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-39.dat	xmrig
behavioral2/files/0x0007000000023410-36.dat	xmrig
behavioral2/memory/2856-35-0x00007FF6E4830000-0x00007FF6E4B84000-memory.dmp	xmrig
behavioral2/memory/2608-30-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-20.dat	xmrig
behavioral2/memory/2980-19-0x00007FF6C6BF0000-0x00007FF6C6F44000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-14.dat	xmrig
behavioral2/memory/3700-55-0x00007FF779280000-0x00007FF7795D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-59.dat	xmrig
behavioral2/memory/4228-66-0x00007FF7FCC00000-0x00007FF7FCF54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-68.dat	xmrig
behavioral2/files/0x0007000000023416-67.dat	xmrig
behavioral2/memory/3452-78-0x00007FF77DA70000-0x00007FF77DDC4000-memory.dmp	xmrig
behavioral2/memory/4708-86-0x00007FF69F890000-0x00007FF69FBE4000-memory.dmp	xmrig
behavioral2/memory/1776-91-0x00007FF7D8200000-0x00007FF7D8554000-memory.dmp	xmrig
behavioral2/memory/5036-96-0x00007FF6071C0000-0x00007FF607514000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-97.dat	xmrig
behavioral2/memory/1560-95-0x00007FF7E01E0000-0x00007FF7E0534000-memory.dmp	xmrig
behavioral2/memory/4752-94-0x00007FF64C370000-0x00007FF64C6C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-85.dat	xmrig
behavioral2/files/0x0007000000023419-83.dat	xmrig
behavioral2/files/0x0007000000023418-82.dat	xmrig
behavioral2/files/0x000700000002341c-101.dat	xmrig
behavioral2/memory/5032-103-0x00007FF6694F0000-0x00007FF669844000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-121.dat	xmrig
behavioral2/files/0x0007000000023421-123.dat	xmrig
behavioral2/memory/5020-118-0x00007FF629460000-0x00007FF6297B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341f-117.dat	xmrig
behavioral2/memory/4940-114-0x00007FF641ED0000-0x00007FF642224000-memory.dmp	xmrig
behavioral2/files/0x000700000002341d-112.dat	xmrig
behavioral2/memory/4948-106-0x00007FF7D51B0000-0x00007FF7D5504000-memory.dmp	xmrig
behavioral2/memory/4116-130-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp	xmrig
behavioral2/memory/2980-129-0x00007FF6C6BF0000-0x00007FF6C6F44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-136.dat	xmrig
behavioral2/memory/4640-139-0x00007FF7B0190000-0x00007FF7B04E4000-memory.dmp	xmrig
behavioral2/memory/2856-142-0x00007FF6E4830000-0x00007FF6E4B84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-144.dat	xmrig
behavioral2/memory/1500-143-0x00007FF705A90000-0x00007FF705DE4000-memory.dmp	xmrig
behavioral2/memory/2608-141-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp	xmrig
behavioral2/memory/1760-140-0x00007FF724070000-0x00007FF7243C4000-memory.dmp	xmrig
behavioral2/memory/3128-138-0x00007FF6D7CE0000-0x00007FF6D8034000-memory.dmp	xmrig
behavioral2/memory/496-135-0x00007FF67A860000-0x00007FF67ABB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-151.dat	xmrig
behavioral2/files/0x001900000002293b-160.dat	xmrig
behavioral2/memory/3248-164-0x00007FF7B8CA0000-0x00007FF7B8FF4000-memory.dmp	xmrig
behavioral2/memory/3184-169-0x00007FF65B780000-0x00007FF65BAD4000-memory.dmp	xmrig
behavioral2/memory/4956-181-0x00007FF70A270000-0x00007FF70A5C4000-memory.dmp	xmrig
behavioral2/memory/3296-184-0x00007FF75C050000-0x00007FF75C3A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-200.dat	xmrig
behavioral2/files/0x0007000000023425-198.dat	xmrig
behavioral2/files/0x0007000000023426-195.dat	xmrig
behavioral2/files/0x000b00000002337d-190.dat	xmrig
behavioral2/files/0x0005000000022ac6-182.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4948	hAyyKNs.exe
2980	JSltOog.exe
1760	CXkTYKJ.exe
4420	ZHBOLPm.exe
2608	AsCpztt.exe
4256	zARLodQ.exe
2856	TeVkcZl.exe
4956	ftIvaiA.exe
3700	xkSKrkc.exe
4228	yqrpKVh.exe
3452	FdRymWG.exe
4708	bCaKhsG.exe
4752	VsZBIeK.exe
1560	qISUblH.exe
1776	lAwycAL.exe
5036	VwNjNsO.exe
4940	RElpqJu.exe
4116	YdbAutH.exe
5020	RXripYi.exe
4640	mXCKFWy.exe
496	FtqWwBX.exe
3128	GBTclzw.exe
1500	slBicIA.exe
2232	pkesFUo.exe
3184	NBhcsNJ.exe
3248	RapsRJd.exe
4972	JHRpkZu.exe
2832	tsZqDBS.exe
3296	kfyzCqs.exe
2748	lVlhZiz.exe
4916	VgtCDYv.exe
432	gGgeJgR.exe
2604	YKkLSRC.exe
2076	WjoSoPJ.exe
3564	PqjWjoE.exe
2892	dNHsKcn.exe
1508	uXxgjhx.exe
4912	skJlqoh.exe
3228	LpPFxWy.exe
4756	VjVcwJg.exe
3840	VhYdafV.exe
1464	uWmdYlr.exe
4376	YfVJPhb.exe
556	GXUzyHK.exe
1820	wjyOxDm.exe
4088	gNJxcxe.exe
3580	oMcbRqR.exe
3340	VinpTqA.exe
560	kxmsaXO.exe
4368	NldBuPK.exe
1016	szWmyes.exe
3576	yFUziLK.exe
4652	DdOImKE.exe
2712	HJqBoZb.exe
5024	IJkltuf.exe
2836	jxGeZjx.exe
3096	yGgaZPz.exe
3164	YBFhvAf.exe
4176	XKxHBwI.exe
64	uLJKQwb.exe
4080	bkFJRXN.exe
5152	azAzOYp.exe
5180	XChNdZT.exe
5208	IsAzQax.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5032-0-0x00007FF6694F0000-0x00007FF669844000-memory.dmp	upx
behavioral2/files/0x0008000000023409-5.dat	upx
behavioral2/memory/4948-12-0x00007FF7D51B0000-0x00007FF7D5504000-memory.dmp	upx
behavioral2/memory/1760-26-0x00007FF724070000-0x00007FF7243C4000-memory.dmp	upx
behavioral2/files/0x000700000002340f-33.dat	upx
behavioral2/files/0x0007000000023411-37.dat	upx
behavioral2/memory/4420-40-0x00007FF65F090000-0x00007FF65F3E4000-memory.dmp	upx
behavioral2/memory/4256-45-0x00007FF74A8D0000-0x00007FF74AC24000-memory.dmp	upx
behavioral2/files/0x0007000000023414-53.dat	upx
behavioral2/files/0x0007000000023413-51.dat	upx
behavioral2/memory/4956-48-0x00007FF70A270000-0x00007FF70A5C4000-memory.dmp	upx
behavioral2/files/0x0007000000023412-39.dat	upx
behavioral2/files/0x0007000000023410-36.dat	upx
behavioral2/memory/2856-35-0x00007FF6E4830000-0x00007FF6E4B84000-memory.dmp	upx
behavioral2/memory/2608-30-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp	upx
behavioral2/files/0x000700000002340e-20.dat	upx
behavioral2/memory/2980-19-0x00007FF6C6BF0000-0x00007FF6C6F44000-memory.dmp	upx
behavioral2/files/0x000700000002340d-14.dat	upx
behavioral2/memory/3700-55-0x00007FF779280000-0x00007FF7795D4000-memory.dmp	upx
behavioral2/files/0x0007000000023415-59.dat	upx
behavioral2/memory/4228-66-0x00007FF7FCC00000-0x00007FF7FCF54000-memory.dmp	upx
behavioral2/files/0x0007000000023417-68.dat	upx
behavioral2/files/0x0007000000023416-67.dat	upx
behavioral2/memory/3452-78-0x00007FF77DA70000-0x00007FF77DDC4000-memory.dmp	upx
behavioral2/memory/4708-86-0x00007FF69F890000-0x00007FF69FBE4000-memory.dmp	upx
behavioral2/memory/1776-91-0x00007FF7D8200000-0x00007FF7D8554000-memory.dmp	upx
behavioral2/memory/5036-96-0x00007FF6071C0000-0x00007FF607514000-memory.dmp	upx
behavioral2/files/0x000700000002341b-97.dat	upx
behavioral2/memory/1560-95-0x00007FF7E01E0000-0x00007FF7E0534000-memory.dmp	upx
behavioral2/memory/4752-94-0x00007FF64C370000-0x00007FF64C6C4000-memory.dmp	upx
behavioral2/files/0x000700000002341a-85.dat	upx
behavioral2/files/0x0007000000023419-83.dat	upx
behavioral2/files/0x0007000000023418-82.dat	upx
behavioral2/files/0x000700000002341c-101.dat	upx
behavioral2/memory/5032-103-0x00007FF6694F0000-0x00007FF669844000-memory.dmp	upx
behavioral2/files/0x0007000000023420-121.dat	upx
behavioral2/files/0x0007000000023421-123.dat	upx
behavioral2/memory/5020-118-0x00007FF629460000-0x00007FF6297B4000-memory.dmp	upx
behavioral2/files/0x000700000002341f-117.dat	upx
behavioral2/memory/4940-114-0x00007FF641ED0000-0x00007FF642224000-memory.dmp	upx
behavioral2/files/0x000700000002341d-112.dat	upx
behavioral2/memory/4948-106-0x00007FF7D51B0000-0x00007FF7D5504000-memory.dmp	upx
behavioral2/memory/4116-130-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp	upx
behavioral2/memory/2980-129-0x00007FF6C6BF0000-0x00007FF6C6F44000-memory.dmp	upx
behavioral2/files/0x0007000000023422-136.dat	upx
behavioral2/memory/4640-139-0x00007FF7B0190000-0x00007FF7B04E4000-memory.dmp	upx
behavioral2/memory/2856-142-0x00007FF6E4830000-0x00007FF6E4B84000-memory.dmp	upx
behavioral2/files/0x0007000000023423-144.dat	upx
behavioral2/memory/1500-143-0x00007FF705A90000-0x00007FF705DE4000-memory.dmp	upx
behavioral2/memory/2608-141-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp	upx
behavioral2/memory/1760-140-0x00007FF724070000-0x00007FF7243C4000-memory.dmp	upx
behavioral2/memory/3128-138-0x00007FF6D7CE0000-0x00007FF6D8034000-memory.dmp	upx
behavioral2/memory/496-135-0x00007FF67A860000-0x00007FF67ABB4000-memory.dmp	upx
behavioral2/files/0x0007000000023424-151.dat	upx
behavioral2/files/0x001900000002293b-160.dat	upx
behavioral2/memory/3248-164-0x00007FF7B8CA0000-0x00007FF7B8FF4000-memory.dmp	upx
behavioral2/memory/3184-169-0x00007FF65B780000-0x00007FF65BAD4000-memory.dmp	upx
behavioral2/memory/4956-181-0x00007FF70A270000-0x00007FF70A5C4000-memory.dmp	upx
behavioral2/memory/3296-184-0x00007FF75C050000-0x00007FF75C3A4000-memory.dmp	upx
behavioral2/files/0x0007000000023427-200.dat	upx
behavioral2/files/0x0007000000023425-198.dat	upx
behavioral2/files/0x0007000000023426-195.dat	upx
behavioral2/files/0x000b00000002337d-190.dat	upx
behavioral2/files/0x0005000000022ac6-182.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yjMXLde.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\kSJJYST.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\jtiERvV.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\XLQkIRF.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\EnTJCUy.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\FdRymWG.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\YiZNeSg.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\IrAZKLX.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\gjxrQDR.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\IVTRucV.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\XwFfDgF.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\FQHpwSs.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\CTehFlE.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\ogqTFRb.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\FqvcpMM.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\iuZGBSW.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\CkPmQCK.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\hdAXQiS.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\kYirGvx.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\zDosNny.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\YmPrWFg.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\qInhlCL.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\acwPEWU.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\QHzxMIu.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\EqkEzrB.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\MisawTQ.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\TeVkcZl.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\pkesFUo.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\PtlbtQq.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\rsrSIzM.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\GsLfNdy.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\MEDTkGr.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\ziWXBOa.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\lkJaCgu.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\uXxgjhx.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\qbWkoIc.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\JBPufTj.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\gtvtoTn.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\Djarvpc.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\BBUklZj.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\wVCPcTf.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\karYkwN.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\WLwGNQB.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\uhvDkHF.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\YIrJkKK.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\ZtByHdE.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\TUThSKz.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\qIpSgfp.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\szWmyes.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\BfmiWie.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\DzigDxC.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\YPJdqwH.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\NeIyFvQ.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\BBhdaZY.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\fTuYPLt.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\AaYCGqI.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\uLJKQwb.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\pDVxbvH.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\HSNsxVO.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\DnXpyki.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\NrgtVMe.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\nFeTHFO.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\MxKDlhp.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
File created	C:\Windows\System\KxbgcDY.exe	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4948	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	83
PID 5032 wrote to memory of 4948	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	83
PID 5032 wrote to memory of 2980	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	84
PID 5032 wrote to memory of 2980	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	84
PID 5032 wrote to memory of 1760	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	85
PID 5032 wrote to memory of 1760	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	85
PID 5032 wrote to memory of 4420	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	86
PID 5032 wrote to memory of 4420	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	86
PID 5032 wrote to memory of 2608	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	87
PID 5032 wrote to memory of 2608	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	87
PID 5032 wrote to memory of 4256	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	88
PID 5032 wrote to memory of 4256	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	88
PID 5032 wrote to memory of 2856	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	89
PID 5032 wrote to memory of 2856	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	89
PID 5032 wrote to memory of 4956	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	90
PID 5032 wrote to memory of 4956	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	90
PID 5032 wrote to memory of 3700	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	91
PID 5032 wrote to memory of 3700	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	91
PID 5032 wrote to memory of 4228	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	94
PID 5032 wrote to memory of 4228	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	94
PID 5032 wrote to memory of 3452	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	95
PID 5032 wrote to memory of 3452	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	95
PID 5032 wrote to memory of 4708	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	96
PID 5032 wrote to memory of 4708	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	96
PID 5032 wrote to memory of 4752	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	97
PID 5032 wrote to memory of 4752	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	97
PID 5032 wrote to memory of 1560	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	98
PID 5032 wrote to memory of 1560	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	98
PID 5032 wrote to memory of 1776	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	99
PID 5032 wrote to memory of 1776	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	99
PID 5032 wrote to memory of 5036	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	100
PID 5032 wrote to memory of 5036	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	100
PID 5032 wrote to memory of 4940	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	101
PID 5032 wrote to memory of 4940	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	101
PID 5032 wrote to memory of 4116	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	103
PID 5032 wrote to memory of 4116	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	103
PID 5032 wrote to memory of 5020	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	104
PID 5032 wrote to memory of 5020	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	104
PID 5032 wrote to memory of 4640	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	105
PID 5032 wrote to memory of 4640	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	105
PID 5032 wrote to memory of 496	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	106
PID 5032 wrote to memory of 496	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	106
PID 5032 wrote to memory of 3128	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	107
PID 5032 wrote to memory of 3128	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	107
PID 5032 wrote to memory of 1500	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	109
PID 5032 wrote to memory of 1500	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	109
PID 5032 wrote to memory of 2232	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	112
PID 5032 wrote to memory of 2232	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	112
PID 5032 wrote to memory of 3184	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	113
PID 5032 wrote to memory of 3184	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	113
PID 5032 wrote to memory of 3248	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	114
PID 5032 wrote to memory of 3248	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	114
PID 5032 wrote to memory of 2832	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	115
PID 5032 wrote to memory of 2832	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	115
PID 5032 wrote to memory of 4972	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	116
PID 5032 wrote to memory of 4972	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	116
PID 5032 wrote to memory of 3296	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	117
PID 5032 wrote to memory of 3296	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	117
PID 5032 wrote to memory of 2748	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	119
PID 5032 wrote to memory of 2748	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	119
PID 5032 wrote to memory of 4916	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	120
PID 5032 wrote to memory of 4916	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	120
PID 5032 wrote to memory of 432	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	121
PID 5032 wrote to memory of 432	5032	889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\889f9dd859f5cb90df23d20c4797f760_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\System\hAyyKNs.exe
  C:\Windows\System\hAyyKNs.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\JSltOog.exe
  C:\Windows\System\JSltOog.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\CXkTYKJ.exe
  C:\Windows\System\CXkTYKJ.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ZHBOLPm.exe
  C:\Windows\System\ZHBOLPm.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\AsCpztt.exe
  C:\Windows\System\AsCpztt.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\zARLodQ.exe
  C:\Windows\System\zARLodQ.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\TeVkcZl.exe
  C:\Windows\System\TeVkcZl.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\ftIvaiA.exe
  C:\Windows\System\ftIvaiA.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\xkSKrkc.exe
  C:\Windows\System\xkSKrkc.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\yqrpKVh.exe
  C:\Windows\System\yqrpKVh.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\FdRymWG.exe
  C:\Windows\System\FdRymWG.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\bCaKhsG.exe
  C:\Windows\System\bCaKhsG.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\VsZBIeK.exe
  C:\Windows\System\VsZBIeK.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\qISUblH.exe
  C:\Windows\System\qISUblH.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\lAwycAL.exe
  C:\Windows\System\lAwycAL.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\VwNjNsO.exe
  C:\Windows\System\VwNjNsO.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\RElpqJu.exe
  C:\Windows\System\RElpqJu.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\YdbAutH.exe
  C:\Windows\System\YdbAutH.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\RXripYi.exe
  C:\Windows\System\RXripYi.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\mXCKFWy.exe
  C:\Windows\System\mXCKFWy.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\FtqWwBX.exe
  C:\Windows\System\FtqWwBX.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\GBTclzw.exe
  C:\Windows\System\GBTclzw.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\slBicIA.exe
  C:\Windows\System\slBicIA.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\pkesFUo.exe
  C:\Windows\System\pkesFUo.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\NBhcsNJ.exe
  C:\Windows\System\NBhcsNJ.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\RapsRJd.exe
  C:\Windows\System\RapsRJd.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\tsZqDBS.exe
  C:\Windows\System\tsZqDBS.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\JHRpkZu.exe
  C:\Windows\System\JHRpkZu.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\kfyzCqs.exe
  C:\Windows\System\kfyzCqs.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\lVlhZiz.exe
  C:\Windows\System\lVlhZiz.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\VgtCDYv.exe
  C:\Windows\System\VgtCDYv.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\gGgeJgR.exe
  C:\Windows\System\gGgeJgR.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\YKkLSRC.exe
  C:\Windows\System\YKkLSRC.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\WjoSoPJ.exe
  C:\Windows\System\WjoSoPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\PqjWjoE.exe
  C:\Windows\System\PqjWjoE.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\dNHsKcn.exe
  C:\Windows\System\dNHsKcn.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\uXxgjhx.exe
  C:\Windows\System\uXxgjhx.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\skJlqoh.exe
  C:\Windows\System\skJlqoh.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\LpPFxWy.exe
  C:\Windows\System\LpPFxWy.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\VjVcwJg.exe
  C:\Windows\System\VjVcwJg.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\VhYdafV.exe
  C:\Windows\System\VhYdafV.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\uWmdYlr.exe
  C:\Windows\System\uWmdYlr.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\YfVJPhb.exe
  C:\Windows\System\YfVJPhb.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\GXUzyHK.exe
  C:\Windows\System\GXUzyHK.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\wjyOxDm.exe
  C:\Windows\System\wjyOxDm.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\gNJxcxe.exe
  C:\Windows\System\gNJxcxe.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\oMcbRqR.exe
  C:\Windows\System\oMcbRqR.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\VinpTqA.exe
  C:\Windows\System\VinpTqA.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\kxmsaXO.exe
  C:\Windows\System\kxmsaXO.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\NldBuPK.exe
  C:\Windows\System\NldBuPK.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\szWmyes.exe
  C:\Windows\System\szWmyes.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\yFUziLK.exe
  C:\Windows\System\yFUziLK.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\DdOImKE.exe
  C:\Windows\System\DdOImKE.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\HJqBoZb.exe
  C:\Windows\System\HJqBoZb.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\IJkltuf.exe
  C:\Windows\System\IJkltuf.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\jxGeZjx.exe
  C:\Windows\System\jxGeZjx.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\yGgaZPz.exe
  C:\Windows\System\yGgaZPz.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\YBFhvAf.exe
  C:\Windows\System\YBFhvAf.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\XKxHBwI.exe
  C:\Windows\System\XKxHBwI.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\uLJKQwb.exe
  C:\Windows\System\uLJKQwb.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\bkFJRXN.exe
  C:\Windows\System\bkFJRXN.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\azAzOYp.exe
  C:\Windows\System\azAzOYp.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\XChNdZT.exe
  C:\Windows\System\XChNdZT.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\IsAzQax.exe
  C:\Windows\System\IsAzQax.exe
  2⤵
  - Executes dropped EXE
  PID:5208
- C:\Windows\System\znueWDW.exe
  C:\Windows\System\znueWDW.exe
  2⤵
  PID:5236
- C:\Windows\System\JLdlyxP.exe
  C:\Windows\System\JLdlyxP.exe
  2⤵
  PID:5264
- C:\Windows\System\mVlQivQ.exe
  C:\Windows\System\mVlQivQ.exe
  2⤵
  PID:5292
- C:\Windows\System\kSxxDke.exe
  C:\Windows\System\kSxxDke.exe
  2⤵
  PID:5320
- C:\Windows\System\cIIBewM.exe
  C:\Windows\System\cIIBewM.exe
  2⤵
  PID:5348
- C:\Windows\System\hUsxpHs.exe
  C:\Windows\System\hUsxpHs.exe
  2⤵
  PID:5376
- C:\Windows\System\ZhkweRr.exe
  C:\Windows\System\ZhkweRr.exe
  2⤵
  PID:5404
- C:\Windows\System\iPeeJTu.exe
  C:\Windows\System\iPeeJTu.exe
  2⤵
  PID:5432
- C:\Windows\System\BaBvupV.exe
  C:\Windows\System\BaBvupV.exe
  2⤵
  PID:5460
- C:\Windows\System\tGvEHSi.exe
  C:\Windows\System\tGvEHSi.exe
  2⤵
  PID:5488
- C:\Windows\System\YUxPYzM.exe
  C:\Windows\System\YUxPYzM.exe
  2⤵
  PID:5516
- C:\Windows\System\UdZmkdM.exe
  C:\Windows\System\UdZmkdM.exe
  2⤵
  PID:5544
- C:\Windows\System\fNVJmEK.exe
  C:\Windows\System\fNVJmEK.exe
  2⤵
  PID:5572
- C:\Windows\System\hCxVrYw.exe
  C:\Windows\System\hCxVrYw.exe
  2⤵
  PID:5600
- C:\Windows\System\bwlAzlK.exe
  C:\Windows\System\bwlAzlK.exe
  2⤵
  PID:5628
- C:\Windows\System\QgsUWRY.exe
  C:\Windows\System\QgsUWRY.exe
  2⤵
  PID:5656
- C:\Windows\System\zDosNny.exe
  C:\Windows\System\zDosNny.exe
  2⤵
  PID:5684
- C:\Windows\System\yOGvvDo.exe
  C:\Windows\System\yOGvvDo.exe
  2⤵
  PID:5712
- C:\Windows\System\yccoKzh.exe
  C:\Windows\System\yccoKzh.exe
  2⤵
  PID:5740
- C:\Windows\System\QssNyaq.exe
  C:\Windows\System\QssNyaq.exe
  2⤵
  PID:5768
- C:\Windows\System\XpaNcQy.exe
  C:\Windows\System\XpaNcQy.exe
  2⤵
  PID:5796
- C:\Windows\System\YtPOJlu.exe
  C:\Windows\System\YtPOJlu.exe
  2⤵
  PID:5824
- C:\Windows\System\EVSKNVB.exe
  C:\Windows\System\EVSKNVB.exe
  2⤵
  PID:5852
- C:\Windows\System\KubPFew.exe
  C:\Windows\System\KubPFew.exe
  2⤵
  PID:5880
- C:\Windows\System\mkhJfUW.exe
  C:\Windows\System\mkhJfUW.exe
  2⤵
  PID:5908
- C:\Windows\System\ITtvgDR.exe
  C:\Windows\System\ITtvgDR.exe
  2⤵
  PID:5936
- C:\Windows\System\vUcELYe.exe
  C:\Windows\System\vUcELYe.exe
  2⤵
  PID:5964
- C:\Windows\System\PHWyGAs.exe
  C:\Windows\System\PHWyGAs.exe
  2⤵
  PID:5992
- C:\Windows\System\VjQKiVN.exe
  C:\Windows\System\VjQKiVN.exe
  2⤵
  PID:6020
- C:\Windows\System\YIpbsbI.exe
  C:\Windows\System\YIpbsbI.exe
  2⤵
  PID:6048
- C:\Windows\System\bUnDZtk.exe
  C:\Windows\System\bUnDZtk.exe
  2⤵
  PID:6076
- C:\Windows\System\wRMOeoU.exe
  C:\Windows\System\wRMOeoU.exe
  2⤵
  PID:6104
- C:\Windows\System\ZTewRGD.exe
  C:\Windows\System\ZTewRGD.exe
  2⤵
  PID:6132
- C:\Windows\System\ZrEPkIh.exe
  C:\Windows\System\ZrEPkIh.exe
  2⤵
  PID:2360
- C:\Windows\System\acwkZER.exe
  C:\Windows\System\acwkZER.exe
  2⤵
  PID:4304
- C:\Windows\System\PtlbtQq.exe
  C:\Windows\System\PtlbtQq.exe
  2⤵
  PID:4636
- C:\Windows\System\HgJQJaK.exe
  C:\Windows\System\HgJQJaK.exe
  2⤵
  PID:2556
- C:\Windows\System\YmPrWFg.exe
  C:\Windows\System\YmPrWFg.exe
  2⤵
  PID:5144
- C:\Windows\System\inEfkqF.exe
  C:\Windows\System\inEfkqF.exe
  2⤵
  PID:5220
- C:\Windows\System\ykPcHff.exe
  C:\Windows\System\ykPcHff.exe
  2⤵
  PID:5280
- C:\Windows\System\FSQYCNL.exe
  C:\Windows\System\FSQYCNL.exe
  2⤵
  PID:5340
- C:\Windows\System\WTjySDP.exe
  C:\Windows\System\WTjySDP.exe
  2⤵
  PID:5416
- C:\Windows\System\MHRJbEn.exe
  C:\Windows\System\MHRJbEn.exe
  2⤵
  PID:5472
- C:\Windows\System\DhgOuKG.exe
  C:\Windows\System\DhgOuKG.exe
  2⤵
  PID:5532
- C:\Windows\System\xueijSy.exe
  C:\Windows\System\xueijSy.exe
  2⤵
  PID:5588
- C:\Windows\System\mKQtENB.exe
  C:\Windows\System\mKQtENB.exe
  2⤵
  PID:5648
- C:\Windows\System\AdcFktT.exe
  C:\Windows\System\AdcFktT.exe
  2⤵
  PID:3996
- C:\Windows\System\KnXiFIx.exe
  C:\Windows\System\KnXiFIx.exe
  2⤵
  PID:5780
- C:\Windows\System\Quskfde.exe
  C:\Windows\System\Quskfde.exe
  2⤵
  PID:5840
- C:\Windows\System\jNgqTdH.exe
  C:\Windows\System\jNgqTdH.exe
  2⤵
  PID:5900
- C:\Windows\System\fuemQFk.exe
  C:\Windows\System\fuemQFk.exe
  2⤵
  PID:5976
- C:\Windows\System\CAhTFmS.exe
  C:\Windows\System\CAhTFmS.exe
  2⤵
  PID:6036
- C:\Windows\System\uOoKvnu.exe
  C:\Windows\System\uOoKvnu.exe
  2⤵
  PID:6092
- C:\Windows\System\bOBSLKs.exe
  C:\Windows\System\bOBSLKs.exe
  2⤵
  PID:2728
- C:\Windows\System\wdBLQIC.exe
  C:\Windows\System\wdBLQIC.exe
  2⤵
  PID:4284
- C:\Windows\System\bOeCZJy.exe
  C:\Windows\System\bOeCZJy.exe
  2⤵
  PID:5172
- C:\Windows\System\wYRxlnN.exe
  C:\Windows\System\wYRxlnN.exe
  2⤵
  PID:5312
- C:\Windows\System\szSrXty.exe
  C:\Windows\System\szSrXty.exe
  2⤵
  PID:4448
- C:\Windows\System\yPhcfVa.exe
  C:\Windows\System\yPhcfVa.exe
  2⤵
  PID:5564
- C:\Windows\System\ASuJLIT.exe
  C:\Windows\System\ASuJLIT.exe
  2⤵
  PID:5732
- C:\Windows\System\qInhlCL.exe
  C:\Windows\System\qInhlCL.exe
  2⤵
  PID:5868
- C:\Windows\System\dyxbSlI.exe
  C:\Windows\System\dyxbSlI.exe
  2⤵
  PID:5952
- C:\Windows\System\TMdnidU.exe
  C:\Windows\System\TMdnidU.exe
  2⤵
  PID:6064
- C:\Windows\System\dpKuGsC.exe
  C:\Windows\System\dpKuGsC.exe
  2⤵
  PID:4192
- C:\Windows\System\eWCzRPG.exe
  C:\Windows\System\eWCzRPG.exe
  2⤵
  PID:5252
- C:\Windows\System\rKRvKGL.exe
  C:\Windows\System\rKRvKGL.exe
  2⤵
  PID:3472
- C:\Windows\System\oekTwKF.exe
  C:\Windows\System\oekTwKF.exe
  2⤵
  PID:5892
- C:\Windows\System\AgFkZPw.exe
  C:\Windows\System\AgFkZPw.exe
  2⤵
  PID:6120
- C:\Windows\System\XzmsWLU.exe
  C:\Windows\System\XzmsWLU.exe
  2⤵
  PID:6172
- C:\Windows\System\bPBwJiG.exe
  C:\Windows\System\bPBwJiG.exe
  2⤵
  PID:6204
- C:\Windows\System\oktUPew.exe
  C:\Windows\System\oktUPew.exe
  2⤵
  PID:6232
- C:\Windows\System\CWfXLoi.exe
  C:\Windows\System\CWfXLoi.exe
  2⤵
  PID:6260
- C:\Windows\System\qbWkoIc.exe
  C:\Windows\System\qbWkoIc.exe
  2⤵
  PID:6288
- C:\Windows\System\SoOxLGJ.exe
  C:\Windows\System\SoOxLGJ.exe
  2⤵
  PID:6312
- C:\Windows\System\gpLOCoi.exe
  C:\Windows\System\gpLOCoi.exe
  2⤵
  PID:6340
- C:\Windows\System\tHprFdp.exe
  C:\Windows\System\tHprFdp.exe
  2⤵
  PID:6368
- C:\Windows\System\wmAHlXi.exe
  C:\Windows\System\wmAHlXi.exe
  2⤵
  PID:6400
- C:\Windows\System\ozwrANx.exe
  C:\Windows\System\ozwrANx.exe
  2⤵
  PID:6428
- C:\Windows\System\ibQDMnE.exe
  C:\Windows\System\ibQDMnE.exe
  2⤵
  PID:6456
- C:\Windows\System\ZWKTuoQ.exe
  C:\Windows\System\ZWKTuoQ.exe
  2⤵
  PID:6484
- C:\Windows\System\KtBQBol.exe
  C:\Windows\System\KtBQBol.exe
  2⤵
  PID:6512
- C:\Windows\System\DRppkpF.exe
  C:\Windows\System\DRppkpF.exe
  2⤵
  PID:6540
- C:\Windows\System\QPxdrah.exe
  C:\Windows\System\QPxdrah.exe
  2⤵
  PID:6568
- C:\Windows\System\lYnJAzt.exe
  C:\Windows\System\lYnJAzt.exe
  2⤵
  PID:6596
- C:\Windows\System\cPZrkjr.exe
  C:\Windows\System\cPZrkjr.exe
  2⤵
  PID:6624
- C:\Windows\System\mkQzLEL.exe
  C:\Windows\System\mkQzLEL.exe
  2⤵
  PID:6652
- C:\Windows\System\cYtaJkC.exe
  C:\Windows\System\cYtaJkC.exe
  2⤵
  PID:6680
- C:\Windows\System\ZOXsJMR.exe
  C:\Windows\System\ZOXsJMR.exe
  2⤵
  PID:6764
- C:\Windows\System\kqTWLgd.exe
  C:\Windows\System\kqTWLgd.exe
  2⤵
  PID:6792
- C:\Windows\System\BSnZWRm.exe
  C:\Windows\System\BSnZWRm.exe
  2⤵
  PID:6808
- C:\Windows\System\DeSMTzb.exe
  C:\Windows\System\DeSMTzb.exe
  2⤵
  PID:6832
- C:\Windows\System\FyPvipp.exe
  C:\Windows\System\FyPvipp.exe
  2⤵
  PID:6864
- C:\Windows\System\juiQKlj.exe
  C:\Windows\System\juiQKlj.exe
  2⤵
  PID:6892
- C:\Windows\System\YCuxJGZ.exe
  C:\Windows\System\YCuxJGZ.exe
  2⤵
  PID:6928
- C:\Windows\System\aneoxsJ.exe
  C:\Windows\System\aneoxsJ.exe
  2⤵
  PID:6988
- C:\Windows\System\zzYQqME.exe
  C:\Windows\System\zzYQqME.exe
  2⤵
  PID:7016
- C:\Windows\System\Grpxuov.exe
  C:\Windows\System\Grpxuov.exe
  2⤵
  PID:7044
- C:\Windows\System\jMzLVNW.exe
  C:\Windows\System\jMzLVNW.exe
  2⤵
  PID:7072
- C:\Windows\System\QHzxMIu.exe
  C:\Windows\System\QHzxMIu.exe
  2⤵
  PID:7100
- C:\Windows\System\BBpOLSA.exe
  C:\Windows\System\BBpOLSA.exe
  2⤵
  PID:7116
- C:\Windows\System\nsPWPTt.exe
  C:\Windows\System\nsPWPTt.exe
  2⤵
  PID:7144
- C:\Windows\System\ErbSBmy.exe
  C:\Windows\System\ErbSBmy.exe
  2⤵
  PID:6124
- C:\Windows\System\QmpuWYz.exe
  C:\Windows\System\QmpuWYz.exe
  2⤵
  PID:4188
- C:\Windows\System\qCfbGMn.exe
  C:\Windows\System\qCfbGMn.exe
  2⤵
  PID:6168
- C:\Windows\System\KAdXIop.exe
  C:\Windows\System\KAdXIop.exe
  2⤵
  PID:4740
- C:\Windows\System\hhjvJtV.exe
  C:\Windows\System\hhjvJtV.exe
  2⤵
  PID:6308
- C:\Windows\System\RVhMbmt.exe
  C:\Windows\System\RVhMbmt.exe
  2⤵
  PID:3368
- C:\Windows\System\MfZNsCJ.exe
  C:\Windows\System\MfZNsCJ.exe
  2⤵
  PID:6416
- C:\Windows\System\gyMaKEf.exe
  C:\Windows\System\gyMaKEf.exe
  2⤵
  PID:6448
- C:\Windows\System\pDVxbvH.exe
  C:\Windows\System\pDVxbvH.exe
  2⤵
  PID:2844
- C:\Windows\System\hGpMIOk.exe
  C:\Windows\System\hGpMIOk.exe
  2⤵
  PID:6532
- C:\Windows\System\UOTpwaI.exe
  C:\Windows\System\UOTpwaI.exe
  2⤵
  PID:6584
- C:\Windows\System\JyPgDIx.exe
  C:\Windows\System\JyPgDIx.exe
  2⤵
  PID:3932
- C:\Windows\System\DTahQDG.exe
  C:\Windows\System\DTahQDG.exe
  2⤵
  PID:2400
- C:\Windows\System\lIyBREQ.exe
  C:\Windows\System\lIyBREQ.exe
  2⤵
  PID:1340
- C:\Windows\System\mBGgPet.exe
  C:\Windows\System\mBGgPet.exe
  2⤵
  PID:6644
- C:\Windows\System\LxYPlkt.exe
  C:\Windows\System\LxYPlkt.exe
  2⤵
  PID:6720
- C:\Windows\System\zYENEcZ.exe
  C:\Windows\System\zYENEcZ.exe
  2⤵
  PID:6816
- C:\Windows\System\oIYBdMc.exe
  C:\Windows\System\oIYBdMc.exe
  2⤵
  PID:5108
- C:\Windows\System\dhqFNLk.exe
  C:\Windows\System\dhqFNLk.exe
  2⤵
  PID:6916
- C:\Windows\System\NePtGki.exe
  C:\Windows\System\NePtGki.exe
  2⤵
  PID:6980
- C:\Windows\System\KnawAxG.exe
  C:\Windows\System\KnawAxG.exe
  2⤵
  PID:3628
- C:\Windows\System\HSNsxVO.exe
  C:\Windows\System\HSNsxVO.exe
  2⤵
  PID:7036
- C:\Windows\System\iZkUYGZ.exe
  C:\Windows\System\iZkUYGZ.exe
  2⤵
  PID:7088
- C:\Windows\System\olIglhG.exe
  C:\Windows\System\olIglhG.exe
  2⤵
  PID:6012
- C:\Windows\System\FwWMIQO.exe
  C:\Windows\System\FwWMIQO.exe
  2⤵
  PID:6248
- C:\Windows\System\wFbIJiw.exe
  C:\Windows\System\wFbIJiw.exe
  2⤵
  PID:6364
- C:\Windows\System\hHvQNKZ.exe
  C:\Windows\System\hHvQNKZ.exe
  2⤵
  PID:6472
- C:\Windows\System\AIgFVxm.exe
  C:\Windows\System\AIgFVxm.exe
  2⤵
  PID:6612
- C:\Windows\System\EqkEzrB.exe
  C:\Windows\System\EqkEzrB.exe
  2⤵
  PID:4352
- C:\Windows\System\YHzZbSD.exe
  C:\Windows\System\YHzZbSD.exe
  2⤵
  PID:6804
- C:\Windows\System\UGXruse.exe
  C:\Windows\System\UGXruse.exe
  2⤵
  PID:6964
- C:\Windows\System\YPWqeuV.exe
  C:\Windows\System\YPWqeuV.exe
  2⤵
  PID:6996
- C:\Windows\System\NqfHCev.exe
  C:\Windows\System\NqfHCev.exe
  2⤵
  PID:7128
- C:\Windows\System\PynUtJv.exe
  C:\Windows\System\PynUtJv.exe
  2⤵
  PID:5504
- C:\Windows\System\BDrMutj.exe
  C:\Windows\System\BDrMutj.exe
  2⤵
  PID:1748
- C:\Windows\System\aEIVvZj.exe
  C:\Windows\System\aEIVvZj.exe
  2⤵
  PID:4696
- C:\Windows\System\CLAEAGl.exe
  C:\Windows\System\CLAEAGl.exe
  2⤵
  PID:2180
- C:\Windows\System\TXAYkUK.exe
  C:\Windows\System\TXAYkUK.exe
  2⤵
  PID:3144
- C:\Windows\System\itSlTeS.exe
  C:\Windows\System\itSlTeS.exe
  2⤵
  PID:6672
- C:\Windows\System\mCaLcRs.exe
  C:\Windows\System\mCaLcRs.exe
  2⤵
  PID:1496
- C:\Windows\System\rYtigUU.exe
  C:\Windows\System\rYtigUU.exe
  2⤵
  PID:2964
- C:\Windows\System\UqUqwXN.exe
  C:\Windows\System\UqUqwXN.exe
  2⤵
  PID:7180
- C:\Windows\System\xyneLEV.exe
  C:\Windows\System\xyneLEV.exe
  2⤵
  PID:7212
- C:\Windows\System\FQHpwSs.exe
  C:\Windows\System\FQHpwSs.exe
  2⤵
  PID:7244
- C:\Windows\System\GOuWWfs.exe
  C:\Windows\System\GOuWWfs.exe
  2⤵
  PID:7276
- C:\Windows\System\NrgtVMe.exe
  C:\Windows\System\NrgtVMe.exe
  2⤵
  PID:7304
- C:\Windows\System\nQPmhWw.exe
  C:\Windows\System\nQPmhWw.exe
  2⤵
  PID:7332
- C:\Windows\System\ePfLodw.exe
  C:\Windows\System\ePfLodw.exe
  2⤵
  PID:7356
- C:\Windows\System\MMSuTVj.exe
  C:\Windows\System\MMSuTVj.exe
  2⤵
  PID:7392
- C:\Windows\System\gDIzvUJ.exe
  C:\Windows\System\gDIzvUJ.exe
  2⤵
  PID:7424
- C:\Windows\System\XfKAVKn.exe
  C:\Windows\System\XfKAVKn.exe
  2⤵
  PID:7452
- C:\Windows\System\dsaEyOE.exe
  C:\Windows\System\dsaEyOE.exe
  2⤵
  PID:7480
- C:\Windows\System\QLVVZHM.exe
  C:\Windows\System\QLVVZHM.exe
  2⤵
  PID:7508
- C:\Windows\System\RuffLBK.exe
  C:\Windows\System\RuffLBK.exe
  2⤵
  PID:7532
- C:\Windows\System\jtiERvV.exe
  C:\Windows\System\jtiERvV.exe
  2⤵
  PID:7568
- C:\Windows\System\EunkxEm.exe
  C:\Windows\System\EunkxEm.exe
  2⤵
  PID:7596
- C:\Windows\System\oQRcQmM.exe
  C:\Windows\System\oQRcQmM.exe
  2⤵
  PID:7624
- C:\Windows\System\ECqTPkk.exe
  C:\Windows\System\ECqTPkk.exe
  2⤵
  PID:7652
- C:\Windows\System\sNDtHzV.exe
  C:\Windows\System\sNDtHzV.exe
  2⤵
  PID:7680
- C:\Windows\System\GLiKhlH.exe
  C:\Windows\System\GLiKhlH.exe
  2⤵
  PID:7708
- C:\Windows\System\CTehFlE.exe
  C:\Windows\System\CTehFlE.exe
  2⤵
  PID:7736
- C:\Windows\System\rclAKvp.exe
  C:\Windows\System\rclAKvp.exe
  2⤵
  PID:7752
- C:\Windows\System\DhtmShC.exe
  C:\Windows\System\DhtmShC.exe
  2⤵
  PID:7780
- C:\Windows\System\JMVLBvA.exe
  C:\Windows\System\JMVLBvA.exe
  2⤵
  PID:7820
- C:\Windows\System\YMXqFGz.exe
  C:\Windows\System\YMXqFGz.exe
  2⤵
  PID:7848
- C:\Windows\System\zsbkNQY.exe
  C:\Windows\System\zsbkNQY.exe
  2⤵
  PID:7876
- C:\Windows\System\oObZpNB.exe
  C:\Windows\System\oObZpNB.exe
  2⤵
  PID:7908
- C:\Windows\System\OkffgGp.exe
  C:\Windows\System\OkffgGp.exe
  2⤵
  PID:7936
- C:\Windows\System\JBPufTj.exe
  C:\Windows\System\JBPufTj.exe
  2⤵
  PID:7952
- C:\Windows\System\ZsMujQH.exe
  C:\Windows\System\ZsMujQH.exe
  2⤵
  PID:7996
- C:\Windows\System\dpilscX.exe
  C:\Windows\System\dpilscX.exe
  2⤵
  PID:8020
- C:\Windows\System\FdxjxGO.exe
  C:\Windows\System\FdxjxGO.exe
  2⤵
  PID:8048
- C:\Windows\System\oMuyfmo.exe
  C:\Windows\System\oMuyfmo.exe
  2⤵
  PID:8064
- C:\Windows\System\tvQHLFp.exe
  C:\Windows\System\tvQHLFp.exe
  2⤵
  PID:8092
- C:\Windows\System\IqJqfDj.exe
  C:\Windows\System\IqJqfDj.exe
  2⤵
  PID:8120
- C:\Windows\System\meMVBNX.exe
  C:\Windows\System\meMVBNX.exe
  2⤵
  PID:8148
- C:\Windows\System\hWHTFYN.exe
  C:\Windows\System\hWHTFYN.exe
  2⤵
  PID:8176
- C:\Windows\System\BfmiWie.exe
  C:\Windows\System\BfmiWie.exe
  2⤵
  PID:7200
- C:\Windows\System\GzlhrHX.exe
  C:\Windows\System\GzlhrHX.exe
  2⤵
  PID:4624
- C:\Windows\System\zhovzAx.exe
  C:\Windows\System\zhovzAx.exe
  2⤵
  PID:7316
- C:\Windows\System\HcljPoB.exe
  C:\Windows\System\HcljPoB.exe
  2⤵
  PID:7380
- C:\Windows\System\XLQkIRF.exe
  C:\Windows\System\XLQkIRF.exe
  2⤵
  PID:7448
- C:\Windows\System\aREyVZW.exe
  C:\Windows\System\aREyVZW.exe
  2⤵
  PID:7556
- C:\Windows\System\rwHlumb.exe
  C:\Windows\System\rwHlumb.exe
  2⤵
  PID:7640
- C:\Windows\System\OINEkIy.exe
  C:\Windows\System\OINEkIy.exe
  2⤵
  PID:7704
- C:\Windows\System\KHUaLpH.exe
  C:\Windows\System\KHUaLpH.exe
  2⤵
  PID:7764
- C:\Windows\System\skEUIJf.exe
  C:\Windows\System\skEUIJf.exe
  2⤵
  PID:7856
- C:\Windows\System\kQdpgYp.exe
  C:\Windows\System\kQdpgYp.exe
  2⤵
  PID:7928
- C:\Windows\System\VBtRJBX.exe
  C:\Windows\System\VBtRJBX.exe
  2⤵
  PID:8040
- C:\Windows\System\QxVvqBf.exe
  C:\Windows\System\QxVvqBf.exe
  2⤵
  PID:8104
- C:\Windows\System\fPXMsfI.exe
  C:\Windows\System\fPXMsfI.exe
  2⤵
  PID:8164
- C:\Windows\System\zuDzroB.exe
  C:\Windows\System\zuDzroB.exe
  2⤵
  PID:8188
- C:\Windows\System\GMCkfzs.exe
  C:\Windows\System\GMCkfzs.exe
  2⤵
  PID:7352
- C:\Windows\System\XPVehly.exe
  C:\Windows\System\XPVehly.exe
  2⤵
  PID:7524
- C:\Windows\System\gjCIEuH.exe
  C:\Windows\System\gjCIEuH.exe
  2⤵
  PID:7724
- C:\Windows\System\DsdqGsz.exe
  C:\Windows\System\DsdqGsz.exe
  2⤵
  PID:8016
- C:\Windows\System\Dtbjaxo.exe
  C:\Windows\System\Dtbjaxo.exe
  2⤵
  PID:7700
- C:\Windows\System\KkaCqey.exe
  C:\Windows\System\KkaCqey.exe
  2⤵
  PID:7176
- C:\Windows\System\SyvidGV.exe
  C:\Windows\System\SyvidGV.exe
  2⤵
  PID:8196
- C:\Windows\System\PBqEIPq.exe
  C:\Windows\System\PBqEIPq.exe
  2⤵
  PID:8228
- C:\Windows\System\jcFvIpK.exe
  C:\Windows\System\jcFvIpK.exe
  2⤵
  PID:8256
- C:\Windows\System\YPJdqwH.exe
  C:\Windows\System\YPJdqwH.exe
  2⤵
  PID:8288
- C:\Windows\System\LDpLIwR.exe
  C:\Windows\System\LDpLIwR.exe
  2⤵
  PID:8328
- C:\Windows\System\OXLOGXE.exe
  C:\Windows\System\OXLOGXE.exe
  2⤵
  PID:8364
- C:\Windows\System\qQYpSkP.exe
  C:\Windows\System\qQYpSkP.exe
  2⤵
  PID:8380
- C:\Windows\System\DhlBBwF.exe
  C:\Windows\System\DhlBBwF.exe
  2⤵
  PID:8396
- C:\Windows\System\WHvOYbH.exe
  C:\Windows\System\WHvOYbH.exe
  2⤵
  PID:8412
- C:\Windows\System\ERymhtK.exe
  C:\Windows\System\ERymhtK.exe
  2⤵
  PID:8436
- C:\Windows\System\HcnNboE.exe
  C:\Windows\System\HcnNboE.exe
  2⤵
  PID:8460
- C:\Windows\System\MdnriGV.exe
  C:\Windows\System\MdnriGV.exe
  2⤵
  PID:8480
- C:\Windows\System\pDAIQue.exe
  C:\Windows\System\pDAIQue.exe
  2⤵
  PID:8508
- C:\Windows\System\asIuknT.exe
  C:\Windows\System\asIuknT.exe
  2⤵
  PID:8536
- C:\Windows\System\baOJGsz.exe
  C:\Windows\System\baOJGsz.exe
  2⤵
  PID:8664
- C:\Windows\System\niwQnug.exe
  C:\Windows\System\niwQnug.exe
  2⤵
  PID:8684
- C:\Windows\System\OylONnu.exe
  C:\Windows\System\OylONnu.exe
  2⤵
  PID:8720
- C:\Windows\System\nFeTHFO.exe
  C:\Windows\System\nFeTHFO.exe
  2⤵
  PID:8748
- C:\Windows\System\JNisboY.exe
  C:\Windows\System\JNisboY.exe
  2⤵
  PID:8772
- C:\Windows\System\mzrIMOd.exe
  C:\Windows\System\mzrIMOd.exe
  2⤵
  PID:8808
- C:\Windows\System\lfaPhbE.exe
  C:\Windows\System\lfaPhbE.exe
  2⤵
  PID:8828
- C:\Windows\System\rjXzNvj.exe
  C:\Windows\System\rjXzNvj.exe
  2⤵
  PID:8852
- C:\Windows\System\UBAzhHn.exe
  C:\Windows\System\UBAzhHn.exe
  2⤵
  PID:8876
- C:\Windows\System\HccdnWz.exe
  C:\Windows\System\HccdnWz.exe
  2⤵
  PID:8912
- C:\Windows\System\HWVhwCf.exe
  C:\Windows\System\HWVhwCf.exe
  2⤵
  PID:8948
- C:\Windows\System\rTXFnzl.exe
  C:\Windows\System\rTXFnzl.exe
  2⤵
  PID:8976
- C:\Windows\System\AUvyRhM.exe
  C:\Windows\System\AUvyRhM.exe
  2⤵
  PID:9004
- C:\Windows\System\QyjesqU.exe
  C:\Windows\System\QyjesqU.exe
  2⤵
  PID:9048
- C:\Windows\System\hInrQee.exe
  C:\Windows\System\hInrQee.exe
  2⤵
  PID:9100
- C:\Windows\System\lvCObrx.exe
  C:\Windows\System\lvCObrx.exe
  2⤵
  PID:9120
- C:\Windows\System\xdRaoPr.exe
  C:\Windows\System\xdRaoPr.exe
  2⤵
  PID:9144
- C:\Windows\System\SNjgrxN.exe
  C:\Windows\System\SNjgrxN.exe
  2⤵
  PID:9172
- C:\Windows\System\IzuFMVT.exe
  C:\Windows\System\IzuFMVT.exe
  2⤵
  PID:9200
- C:\Windows\System\DtOInxN.exe
  C:\Windows\System\DtOInxN.exe
  2⤵
  PID:8216
- C:\Windows\System\MbdzaMn.exe
  C:\Windows\System\MbdzaMn.exe
  2⤵
  PID:8276
- C:\Windows\System\HtOSAev.exe
  C:\Windows\System\HtOSAev.exe
  2⤵
  PID:8312
- C:\Windows\System\vbteqXs.exe
  C:\Windows\System\vbteqXs.exe
  2⤵
  PID:8348
- C:\Windows\System\tlCkcga.exe
  C:\Windows\System\tlCkcga.exe
  2⤵
  PID:8420
- C:\Windows\System\TgdzSvo.exe
  C:\Windows\System\TgdzSvo.exe
  2⤵
  PID:8652
- C:\Windows\System\iXjrcVM.exe
  C:\Windows\System\iXjrcVM.exe
  2⤵
  PID:8632
- C:\Windows\System\zgrmGMM.exe
  C:\Windows\System\zgrmGMM.exe
  2⤵
  PID:8656
- C:\Windows\System\zSKrdvk.exe
  C:\Windows\System\zSKrdvk.exe
  2⤵
  PID:8704
- C:\Windows\System\lPbMntW.exe
  C:\Windows\System\lPbMntW.exe
  2⤵
  PID:8836
- C:\Windows\System\zAkVQot.exe
  C:\Windows\System\zAkVQot.exe
  2⤵
  PID:8900
- C:\Windows\System\SApjdLg.exe
  C:\Windows\System\SApjdLg.exe
  2⤵
  PID:8960
- C:\Windows\System\EnTJCUy.exe
  C:\Windows\System\EnTJCUy.exe
  2⤵
  PID:9036
- C:\Windows\System\XpfzIqo.exe
  C:\Windows\System\XpfzIqo.exe
  2⤵
  PID:9140
- C:\Windows\System\PFJcBcS.exe
  C:\Windows\System\PFJcBcS.exe
  2⤵
  PID:8076
- C:\Windows\System\gTqyNeO.exe
  C:\Windows\System\gTqyNeO.exe
  2⤵
  PID:9192
- C:\Windows\System\VJXigvG.exe
  C:\Windows\System\VJXigvG.exe
  2⤵
  PID:8404
- C:\Windows\System\QLMqBjE.exe
  C:\Windows\System\QLMqBjE.exe
  2⤵
  PID:8640
- C:\Windows\System\MxKDlhp.exe
  C:\Windows\System\MxKDlhp.exe
  2⤵
  PID:8760
- C:\Windows\System\HXoZxOw.exe
  C:\Windows\System\HXoZxOw.exe
  2⤵
  PID:8988
- C:\Windows\System\uIUugDS.exe
  C:\Windows\System\uIUugDS.exe
  2⤵
  PID:7800
- C:\Windows\System\hGVyTAP.exe
  C:\Windows\System\hGVyTAP.exe
  2⤵
  PID:8636
- C:\Windows\System\BOhOheJ.exe
  C:\Windows\System\BOhOheJ.exe
  2⤵
  PID:8820
- C:\Windows\System\noXnLYh.exe
  C:\Windows\System\noXnLYh.exe
  2⤵
  PID:9184
- C:\Windows\System\qbbhkdX.exe
  C:\Windows\System\qbbhkdX.exe
  2⤵
  PID:8532
- C:\Windows\System\rsrSIzM.exe
  C:\Windows\System\rsrSIzM.exe
  2⤵
  PID:8304
- C:\Windows\System\vwuVQEr.exe
  C:\Windows\System\vwuVQEr.exe
  2⤵
  PID:9244
- C:\Windows\System\cEPdRiL.exe
  C:\Windows\System\cEPdRiL.exe
  2⤵
  PID:9268
- C:\Windows\System\cYMRHJf.exe
  C:\Windows\System\cYMRHJf.exe
  2⤵
  PID:9296
- C:\Windows\System\ZbHDQBU.exe
  C:\Windows\System\ZbHDQBU.exe
  2⤵
  PID:9332
- C:\Windows\System\JFmghso.exe
  C:\Windows\System\JFmghso.exe
  2⤵
  PID:9360
- C:\Windows\System\NiqEAeM.exe
  C:\Windows\System\NiqEAeM.exe
  2⤵
  PID:9400
- C:\Windows\System\wVCPcTf.exe
  C:\Windows\System\wVCPcTf.exe
  2⤵
  PID:9420
- C:\Windows\System\ruNYJMx.exe
  C:\Windows\System\ruNYJMx.exe
  2⤵
  PID:9444
- C:\Windows\System\XBRgUTK.exe
  C:\Windows\System\XBRgUTK.exe
  2⤵
  PID:9472
- C:\Windows\System\ocAikRI.exe
  C:\Windows\System\ocAikRI.exe
  2⤵
  PID:9512
- C:\Windows\System\FqvcpMM.exe
  C:\Windows\System\FqvcpMM.exe
  2⤵
  PID:9540
- C:\Windows\System\FcbFiSp.exe
  C:\Windows\System\FcbFiSp.exe
  2⤵
  PID:9560
- C:\Windows\System\CjvNpLo.exe
  C:\Windows\System\CjvNpLo.exe
  2⤵
  PID:9592
- C:\Windows\System\yJaCtWi.exe
  C:\Windows\System\yJaCtWi.exe
  2⤵
  PID:9616
- C:\Windows\System\XbCjQOH.exe
  C:\Windows\System\XbCjQOH.exe
  2⤵
  PID:9636
- C:\Windows\System\GsLfNdy.exe
  C:\Windows\System\GsLfNdy.exe
  2⤵
  PID:9660
- C:\Windows\System\lodsUMg.exe
  C:\Windows\System\lodsUMg.exe
  2⤵
  PID:9712
- C:\Windows\System\XafGxJX.exe
  C:\Windows\System\XafGxJX.exe
  2⤵
  PID:9732
- C:\Windows\System\FasLUpW.exe
  C:\Windows\System\FasLUpW.exe
  2⤵
  PID:9760
- C:\Windows\System\RNulOdp.exe
  C:\Windows\System\RNulOdp.exe
  2⤵
  PID:9788
- C:\Windows\System\IMuPeGG.exe
  C:\Windows\System\IMuPeGG.exe
  2⤵
  PID:9804
- C:\Windows\System\ofSLJEL.exe
  C:\Windows\System\ofSLJEL.exe
  2⤵
  PID:9840
- C:\Windows\System\NzzyqDH.exe
  C:\Windows\System\NzzyqDH.exe
  2⤵
  PID:9876
- C:\Windows\System\ENKKSho.exe
  C:\Windows\System\ENKKSho.exe
  2⤵
  PID:9912
- C:\Windows\System\karYkwN.exe
  C:\Windows\System\karYkwN.exe
  2⤵
  PID:9940
- C:\Windows\System\saKuoBD.exe
  C:\Windows\System\saKuoBD.exe
  2⤵
  PID:9956
- C:\Windows\System\ImSJFJw.exe
  C:\Windows\System\ImSJFJw.exe
  2⤵
  PID:9980
- C:\Windows\System\QGIfRjo.exe
  C:\Windows\System\QGIfRjo.exe
  2⤵
  PID:10004
- C:\Windows\System\uWONFJt.exe
  C:\Windows\System\uWONFJt.exe
  2⤵
  PID:10024
- C:\Windows\System\ogqTFRb.exe
  C:\Windows\System\ogqTFRb.exe
  2⤵
  PID:10052
- C:\Windows\System\AiCgSWv.exe
  C:\Windows\System\AiCgSWv.exe
  2⤵
  PID:10104
- C:\Windows\System\cWQeOtQ.exe
  C:\Windows\System\cWQeOtQ.exe
  2⤵
  PID:10132
- C:\Windows\System\kufbPph.exe
  C:\Windows\System\kufbPph.exe
  2⤵
  PID:10160
- C:\Windows\System\DzigDxC.exe
  C:\Windows\System\DzigDxC.exe
  2⤵
  PID:10192
- C:\Windows\System\rfHxZnX.exe
  C:\Windows\System\rfHxZnX.exe
  2⤵
  PID:10220
- C:\Windows\System\RtAbRSu.exe
  C:\Windows\System\RtAbRSu.exe
  2⤵
  PID:8904
- C:\Windows\System\xHMMvAY.exe
  C:\Windows\System\xHMMvAY.exe
  2⤵
  PID:9232
- C:\Windows\System\SatgjpX.exe
  C:\Windows\System\SatgjpX.exe
  2⤵
  PID:9316
- C:\Windows\System\sNqxIxc.exe
  C:\Windows\System\sNqxIxc.exe
  2⤵
  PID:9388
- C:\Windows\System\FWbgRFQ.exe
  C:\Windows\System\FWbgRFQ.exe
  2⤵
  PID:9468
- C:\Windows\System\nPYIQvM.exe
  C:\Windows\System\nPYIQvM.exe
  2⤵
  PID:9524
- C:\Windows\System\QQiTuUQ.exe
  C:\Windows\System\QQiTuUQ.exe
  2⤵
  PID:1724
- C:\Windows\System\LOCTnBu.exe
  C:\Windows\System\LOCTnBu.exe
  2⤵
  PID:9644
- C:\Windows\System\qAxazOY.exe
  C:\Windows\System\qAxazOY.exe
  2⤵
  PID:9692
- C:\Windows\System\jnIUuPX.exe
  C:\Windows\System\jnIUuPX.exe
  2⤵
  PID:9744
- C:\Windows\System\zLkpZdl.exe
  C:\Windows\System\zLkpZdl.exe
  2⤵
  PID:9796
- C:\Windows\System\cVkVTXt.exe
  C:\Windows\System\cVkVTXt.exe
  2⤵
  PID:9872
- C:\Windows\System\XmKXwqU.exe
  C:\Windows\System\XmKXwqU.exe
  2⤵
  PID:9952
- C:\Windows\System\bCxwyFp.exe
  C:\Windows\System\bCxwyFp.exe
  2⤵
  PID:10012
- C:\Windows\System\uhulxwx.exe
  C:\Windows\System\uhulxwx.exe
  2⤵
  PID:10124
- C:\Windows\System\IqRRUfk.exe
  C:\Windows\System\IqRRUfk.exe
  2⤵
  PID:10176
- C:\Windows\System\IdDrctq.exe
  C:\Windows\System\IdDrctq.exe
  2⤵
  PID:9228
- C:\Windows\System\IfrwZMt.exe
  C:\Windows\System\IfrwZMt.exe
  2⤵
  PID:9384
- C:\Windows\System\ZbrwdrD.exe
  C:\Windows\System\ZbrwdrD.exe
  2⤵
  PID:9488
- C:\Windows\System\SmlflVh.exe
  C:\Windows\System\SmlflVh.exe
  2⤵
  PID:9632
- C:\Windows\System\tgdrKWI.exe
  C:\Windows\System\tgdrKWI.exe
  2⤵
  PID:9780
- C:\Windows\System\DdvaMYk.exe
  C:\Windows\System\DdvaMYk.exe
  2⤵
  PID:9856
- C:\Windows\System\RdVqRks.exe
  C:\Windows\System\RdVqRks.exe
  2⤵
  PID:10044
- C:\Windows\System\SqfIVtQ.exe
  C:\Windows\System\SqfIVtQ.exe
  2⤵
  PID:10216
- C:\Windows\System\JbSprse.exe
  C:\Windows\System\JbSprse.exe
  2⤵
  PID:9460
- C:\Windows\System\KBeirMv.exe
  C:\Windows\System\KBeirMv.exe
  2⤵
  PID:9972
- C:\Windows\System\JvugKhL.exe
  C:\Windows\System\JvugKhL.exe
  2⤵
  PID:9344
- C:\Windows\System\BokpPrg.exe
  C:\Windows\System\BokpPrg.exe
  2⤵
  PID:10152
- C:\Windows\System\uhvDkHF.exe
  C:\Windows\System\uhvDkHF.exe
  2⤵
  PID:10248
- C:\Windows\System\yvCXbyI.exe
  C:\Windows\System\yvCXbyI.exe
  2⤵
  PID:10276
- C:\Windows\System\ZpgOPnG.exe
  C:\Windows\System\ZpgOPnG.exe
  2⤵
  PID:10304
- C:\Windows\System\DRmCTXn.exe
  C:\Windows\System\DRmCTXn.exe
  2⤵
  PID:10332
- C:\Windows\System\cNYFQin.exe
  C:\Windows\System\cNYFQin.exe
  2⤵
  PID:10352
- C:\Windows\System\QGkudIp.exe
  C:\Windows\System\QGkudIp.exe
  2⤵
  PID:10376
- C:\Windows\System\KsYQQaR.exe
  C:\Windows\System\KsYQQaR.exe
  2⤵
  PID:10416
- C:\Windows\System\Utzyekn.exe
  C:\Windows\System\Utzyekn.exe
  2⤵
  PID:10440
- C:\Windows\System\taUzanY.exe
  C:\Windows\System\taUzanY.exe
  2⤵
  PID:10472
- C:\Windows\System\QUvCvyN.exe
  C:\Windows\System\QUvCvyN.exe
  2⤵
  PID:10500
- C:\Windows\System\yVBRdzO.exe
  C:\Windows\System\yVBRdzO.exe
  2⤵
  PID:10528
- C:\Windows\System\GKWRRRZ.exe
  C:\Windows\System\GKWRRRZ.exe
  2⤵
  PID:10556
- C:\Windows\System\YIrJkKK.exe
  C:\Windows\System\YIrJkKK.exe
  2⤵
  PID:10584
- C:\Windows\System\xhKqzAe.exe
  C:\Windows\System\xhKqzAe.exe
  2⤵
  PID:10612
- C:\Windows\System\kqxoSAK.exe
  C:\Windows\System\kqxoSAK.exe
  2⤵
  PID:10628
- C:\Windows\System\GoECJlD.exe
  C:\Windows\System\GoECJlD.exe
  2⤵
  PID:10664
- C:\Windows\System\kBqoaxY.exe
  C:\Windows\System\kBqoaxY.exe
  2⤵
  PID:10696
- C:\Windows\System\gdGgxtx.exe
  C:\Windows\System\gdGgxtx.exe
  2⤵
  PID:10712
- C:\Windows\System\ipOhtxq.exe
  C:\Windows\System\ipOhtxq.exe
  2⤵
  PID:10748
- C:\Windows\System\GHkfpCb.exe
  C:\Windows\System\GHkfpCb.exe
  2⤵
  PID:10764
- C:\Windows\System\ASkddSX.exe
  C:\Windows\System\ASkddSX.exe
  2⤵
  PID:10784
- C:\Windows\System\siAlGHX.exe
  C:\Windows\System\siAlGHX.exe
  2⤵
  PID:10820
- C:\Windows\System\kpnzhNE.exe
  C:\Windows\System\kpnzhNE.exe
  2⤵
  PID:10852
- C:\Windows\System\GbNlIxz.exe
  C:\Windows\System\GbNlIxz.exe
  2⤵
  PID:10872
- C:\Windows\System\iuZGBSW.exe
  C:\Windows\System\iuZGBSW.exe
  2⤵
  PID:10908
- C:\Windows\System\RTVbkBD.exe
  C:\Windows\System\RTVbkBD.exe
  2⤵
  PID:10948
- C:\Windows\System\mwIdZYs.exe
  C:\Windows\System\mwIdZYs.exe
  2⤵
  PID:10964
- C:\Windows\System\IrAZKLX.exe
  C:\Windows\System\IrAZKLX.exe
  2⤵
  PID:10996
- C:\Windows\System\RLSEagV.exe
  C:\Windows\System\RLSEagV.exe
  2⤵
  PID:11024
- C:\Windows\System\xslBSqy.exe
  C:\Windows\System\xslBSqy.exe
  2⤵
  PID:11052
- C:\Windows\System\LsakmnT.exe
  C:\Windows\System\LsakmnT.exe
  2⤵
  PID:11092
- C:\Windows\System\SllnQgU.exe
  C:\Windows\System\SllnQgU.exe
  2⤵
  PID:11108
- C:\Windows\System\ZKIkLYe.exe
  C:\Windows\System\ZKIkLYe.exe
  2⤵
  PID:11148
- C:\Windows\System\hrjKmzj.exe
  C:\Windows\System\hrjKmzj.exe
  2⤵
  PID:11176
- C:\Windows\System\FSBiJRh.exe
  C:\Windows\System\FSBiJRh.exe
  2⤵
  PID:11192
- C:\Windows\System\btCNwGS.exe
  C:\Windows\System\btCNwGS.exe
  2⤵
  PID:11224
- C:\Windows\System\uhIIYKN.exe
  C:\Windows\System\uhIIYKN.exe
  2⤵
  PID:11252
- C:\Windows\System\UYKpJFv.exe
  C:\Windows\System\UYKpJFv.exe
  2⤵
  PID:10272
- C:\Windows\System\anqJuow.exe
  C:\Windows\System\anqJuow.exe
  2⤵
  PID:1524
- C:\Windows\System\BRozivZ.exe
  C:\Windows\System\BRozivZ.exe
  2⤵
  PID:2680
- C:\Windows\System\jXAiIau.exe
  C:\Windows\System\jXAiIau.exe
  2⤵
  PID:10360
- C:\Windows\System\dbcOUwB.exe
  C:\Windows\System\dbcOUwB.exe
  2⤵
  PID:10392
- C:\Windows\System\KxbgcDY.exe
  C:\Windows\System\KxbgcDY.exe
  2⤵
  PID:10456
- C:\Windows\System\qFxFmWs.exe
  C:\Windows\System\qFxFmWs.exe
  2⤵
  PID:10512
- C:\Windows\System\WYeMWin.exe
  C:\Windows\System\WYeMWin.exe
  2⤵
  PID:10568
- C:\Windows\System\wDyhnbp.exe
  C:\Windows\System\wDyhnbp.exe
  2⤵
  PID:10640
- C:\Windows\System\KJMfkZk.exe
  C:\Windows\System\KJMfkZk.exe
  2⤵
  PID:10684
- C:\Windows\System\hYIrTtk.exe
  C:\Windows\System\hYIrTtk.exe
  2⤵
  PID:10760
- C:\Windows\System\wOVNemm.exe
  C:\Windows\System\wOVNemm.exe
  2⤵
  PID:10832
- C:\Windows\System\dKGpzeS.exe
  C:\Windows\System\dKGpzeS.exe
  2⤵
  PID:10868
- C:\Windows\System\eqMEkrg.exe
  C:\Windows\System\eqMEkrg.exe
  2⤵
  PID:10940
- C:\Windows\System\yrSJDOr.exe
  C:\Windows\System\yrSJDOr.exe
  2⤵
  PID:10984
- C:\Windows\System\QpTbJer.exe
  C:\Windows\System\QpTbJer.exe
  2⤵
  PID:11036
- C:\Windows\System\whqlSKD.exe
  C:\Windows\System\whqlSKD.exe
  2⤵
  PID:11168
- C:\Windows\System\osEVZXt.exe
  C:\Windows\System\osEVZXt.exe
  2⤵
  PID:11236
- C:\Windows\System\YDwpfsC.exe
  C:\Windows\System\YDwpfsC.exe
  2⤵
  PID:10320
- C:\Windows\System\vSqrnFo.exe
  C:\Windows\System\vSqrnFo.exe
  2⤵
  PID:10340
- C:\Windows\System\tifMqLs.exe
  C:\Windows\System\tifMqLs.exe
  2⤵
  PID:10412
- C:\Windows\System\cGQYrtX.exe
  C:\Windows\System\cGQYrtX.exe
  2⤵
  PID:10648
- C:\Windows\System\NeIyFvQ.exe
  C:\Windows\System\NeIyFvQ.exe
  2⤵
  PID:10740
- C:\Windows\System\igYwSel.exe
  C:\Windows\System\igYwSel.exe
  2⤵
  PID:10884
- C:\Windows\System\DVMCCwX.exe
  C:\Windows\System\DVMCCwX.exe
  2⤵
  PID:11004
- C:\Windows\System\CrLBxVO.exe
  C:\Windows\System\CrLBxVO.exe
  2⤵
  PID:11160
- C:\Windows\System\hRmkTzt.exe
  C:\Windows\System\hRmkTzt.exe
  2⤵
  PID:10368
- C:\Windows\System\fLaHxiX.exe
  C:\Windows\System\fLaHxiX.exe
  2⤵
  PID:10552
- C:\Windows\System\WzmQtku.exe
  C:\Windows\System\WzmQtku.exe
  2⤵
  PID:11048
- C:\Windows\System\phyZouJ.exe
  C:\Windows\System\phyZouJ.exe
  2⤵
  PID:10484
- C:\Windows\System\oXzCgYh.exe
  C:\Windows\System\oXzCgYh.exe
  2⤵
  PID:11100
- C:\Windows\System\KzTOClh.exe
  C:\Windows\System\KzTOClh.exe
  2⤵
  PID:10924
- C:\Windows\System\vjelUFG.exe
  C:\Windows\System\vjelUFG.exe
  2⤵
  PID:11284
- C:\Windows\System\yjMXLde.exe
  C:\Windows\System\yjMXLde.exe
  2⤵
  PID:11320
- C:\Windows\System\RMNLWHb.exe
  C:\Windows\System\RMNLWHb.exe
  2⤵
  PID:11340
- C:\Windows\System\FEjdLxJ.exe
  C:\Windows\System\FEjdLxJ.exe
  2⤵
  PID:11400
- C:\Windows\System\vhZvxdx.exe
  C:\Windows\System\vhZvxdx.exe
  2⤵
  PID:11432
- C:\Windows\System\kWfZkKO.exe
  C:\Windows\System\kWfZkKO.exe
  2⤵
  PID:11452
- C:\Windows\System\FkVokqQ.exe
  C:\Windows\System\FkVokqQ.exe
  2⤵
  PID:11480
- C:\Windows\System\vrBXAnm.exe
  C:\Windows\System\vrBXAnm.exe
  2⤵
  PID:11508
- C:\Windows\System\MuGMnWH.exe
  C:\Windows\System\MuGMnWH.exe
  2⤵
  PID:11536
- C:\Windows\System\fImxHbv.exe
  C:\Windows\System\fImxHbv.exe
  2⤵
  PID:11560
- C:\Windows\System\NNGplma.exe
  C:\Windows\System\NNGplma.exe
  2⤵
  PID:11596
- C:\Windows\System\vYsnQBT.exe
  C:\Windows\System\vYsnQBT.exe
  2⤵
  PID:11620
- C:\Windows\System\ZoWivGz.exe
  C:\Windows\System\ZoWivGz.exe
  2⤵
  PID:11636
- C:\Windows\System\sfHAqeu.exe
  C:\Windows\System\sfHAqeu.exe
  2⤵
  PID:11668
- C:\Windows\System\BJLKRjR.exe
  C:\Windows\System\BJLKRjR.exe
  2⤵
  PID:11720
- C:\Windows\System\CMfedGU.exe
  C:\Windows\System\CMfedGU.exe
  2⤵
  PID:11748
- C:\Windows\System\owoxluH.exe
  C:\Windows\System\owoxluH.exe
  2⤵
  PID:11776
- C:\Windows\System\ZNGuxZr.exe
  C:\Windows\System\ZNGuxZr.exe
  2⤵
  PID:11804
- C:\Windows\System\UwZOvSi.exe
  C:\Windows\System\UwZOvSi.exe
  2⤵
  PID:11820
- C:\Windows\System\xhzJUql.exe
  C:\Windows\System\xhzJUql.exe
  2⤵
  PID:11856
- C:\Windows\System\kBXkZBS.exe
  C:\Windows\System\kBXkZBS.exe
  2⤵
  PID:11876
- C:\Windows\System\VpnJDBV.exe
  C:\Windows\System\VpnJDBV.exe
  2⤵
  PID:11896
- C:\Windows\System\dSBraZT.exe
  C:\Windows\System\dSBraZT.exe
  2⤵
  PID:11920
- C:\Windows\System\JTNNOyJ.exe
  C:\Windows\System\JTNNOyJ.exe
  2⤵
  PID:11960
- C:\Windows\System\YhCdstK.exe
  C:\Windows\System\YhCdstK.exe
  2⤵
  PID:11992
- C:\Windows\System\xBhHnld.exe
  C:\Windows\System\xBhHnld.exe
  2⤵
  PID:12020
- C:\Windows\System\ncuAoeE.exe
  C:\Windows\System\ncuAoeE.exe
  2⤵
  PID:12036
- C:\Windows\System\hAbdwrM.exe
  C:\Windows\System\hAbdwrM.exe
  2⤵
  PID:12064
- C:\Windows\System\BjWIBtC.exe
  C:\Windows\System\BjWIBtC.exe
  2⤵
  PID:12104
- C:\Windows\System\okqFZzm.exe
  C:\Windows\System\okqFZzm.exe
  2⤵
  PID:12144
- C:\Windows\System\GsMRKJm.exe
  C:\Windows\System\GsMRKJm.exe
  2⤵
  PID:12168
- C:\Windows\System\mYNTNge.exe
  C:\Windows\System\mYNTNge.exe
  2⤵
  PID:12192
- C:\Windows\System\soJnBTZ.exe
  C:\Windows\System\soJnBTZ.exe
  2⤵
  PID:12228
- C:\Windows\System\txfhacO.exe
  C:\Windows\System\txfhacO.exe
  2⤵
  PID:12244
- C:\Windows\System\WgDlnzL.exe
  C:\Windows\System\WgDlnzL.exe
  2⤵
  PID:12272
- C:\Windows\System\MdEMvCN.exe
  C:\Windows\System\MdEMvCN.exe
  2⤵
  PID:11332
- C:\Windows\System\iNIuttQ.exe
  C:\Windows\System\iNIuttQ.exe
  2⤵
  PID:11408
- C:\Windows\System\YddjRbu.exe
  C:\Windows\System\YddjRbu.exe
  2⤵
  PID:11464
- C:\Windows\System\kKPJqmT.exe
  C:\Windows\System\kKPJqmT.exe
  2⤵
  PID:11516
- C:\Windows\System\tXQUsYc.exe
  C:\Windows\System\tXQUsYc.exe
  2⤵
  PID:11592
- C:\Windows\System\tuxTzkO.exe
  C:\Windows\System\tuxTzkO.exe
  2⤵
  PID:11652
- C:\Windows\System\fDjPnJg.exe
  C:\Windows\System\fDjPnJg.exe
  2⤵
  PID:11740
- C:\Windows\System\CWpPqUT.exe
  C:\Windows\System\CWpPqUT.exe
  2⤵
  PID:11800
- C:\Windows\System\CkPmQCK.exe
  C:\Windows\System\CkPmQCK.exe
  2⤵
  PID:11848
- C:\Windows\System\psmIJPF.exe
  C:\Windows\System\psmIJPF.exe
  2⤵
  PID:11972
- C:\Windows\System\LqnwEzv.exe
  C:\Windows\System\LqnwEzv.exe
  2⤵
  PID:12004
- C:\Windows\System\yeCrdhc.exe
  C:\Windows\System\yeCrdhc.exe
  2⤵
  PID:12076
- C:\Windows\System\VkgBdsM.exe
  C:\Windows\System\VkgBdsM.exe
  2⤵
  PID:12120
- C:\Windows\System\wHaHeKZ.exe
  C:\Windows\System\wHaHeKZ.exe
  2⤵
  PID:12216
- C:\Windows\System\JeblSzF.exe
  C:\Windows\System\JeblSzF.exe
  2⤵
  PID:11280
- C:\Windows\System\rHcgrWD.exe
  C:\Windows\System\rHcgrWD.exe
  2⤵
  PID:11376
- C:\Windows\System\gamBEHp.exe
  C:\Windows\System\gamBEHp.exe
  2⤵
  PID:11656
- C:\Windows\System\FtOxBNx.exe
  C:\Windows\System\FtOxBNx.exe
  2⤵
  PID:11772
- C:\Windows\System\WEninGp.exe
  C:\Windows\System\WEninGp.exe
  2⤵
  PID:11868
- C:\Windows\System\NXJiNck.exe
  C:\Windows\System\NXJiNck.exe
  2⤵
  PID:12092
- C:\Windows\System\SEkrfZS.exe
  C:\Windows\System\SEkrfZS.exe
  2⤵
  PID:12260
- C:\Windows\System\MEDTkGr.exe
  C:\Windows\System\MEDTkGr.exe
  2⤵
  PID:5104
- C:\Windows\System\EiIHIVy.exe
  C:\Windows\System\EiIHIVy.exe
  2⤵
  PID:11608
- C:\Windows\System\sqRRqhQ.exe
  C:\Windows\System\sqRRqhQ.exe
  2⤵
  PID:11952
- C:\Windows\System\CoVdmsG.exe
  C:\Windows\System\CoVdmsG.exe
  2⤵
  PID:11556
- C:\Windows\System\hdAXQiS.exe
  C:\Windows\System\hdAXQiS.exe
  2⤵
  PID:11492
- C:\Windows\System\FlGrHfa.exe
  C:\Windows\System\FlGrHfa.exe
  2⤵
  PID:12316
- C:\Windows\System\sbjxQkf.exe
  C:\Windows\System\sbjxQkf.exe
  2⤵
  PID:12344
- C:\Windows\System\dAXFGuq.exe
  C:\Windows\System\dAXFGuq.exe
  2⤵
  PID:12372
- C:\Windows\System\bbGliAh.exe
  C:\Windows\System\bbGliAh.exe
  2⤵
  PID:12400
- C:\Windows\System\zgxoTgA.exe
  C:\Windows\System\zgxoTgA.exe
  2⤵
  PID:12432
- C:\Windows\System\PvczIIN.exe
  C:\Windows\System\PvczIIN.exe
  2⤵
  PID:12464
- C:\Windows\System\jbMykHC.exe
  C:\Windows\System\jbMykHC.exe
  2⤵
  PID:12500
- C:\Windows\System\JLGOgnz.exe
  C:\Windows\System\JLGOgnz.exe
  2⤵
  PID:12520
- C:\Windows\System\FWmSFzz.exe
  C:\Windows\System\FWmSFzz.exe
  2⤵
  PID:12552
- C:\Windows\System\GcjpLKj.exe
  C:\Windows\System\GcjpLKj.exe
  2⤵
  PID:12572
- C:\Windows\System\zGPQClZ.exe
  C:\Windows\System\zGPQClZ.exe
  2⤵
  PID:12612
- C:\Windows\System\PzsaZuk.exe
  C:\Windows\System\PzsaZuk.exe
  2⤵
  PID:12628
- C:\Windows\System\dTrMcge.exe
  C:\Windows\System\dTrMcge.exe
  2⤵
  PID:12656
- C:\Windows\System\RZWVaMk.exe
  C:\Windows\System\RZWVaMk.exe
  2⤵
  PID:12680
- C:\Windows\System\BBhdaZY.exe
  C:\Windows\System\BBhdaZY.exe
  2⤵
  PID:12712
- C:\Windows\System\tJJLVql.exe
  C:\Windows\System\tJJLVql.exe
  2⤵
  PID:12736
- C:\Windows\System\ztVAZdw.exe
  C:\Windows\System\ztVAZdw.exe
  2⤵
  PID:12760
- C:\Windows\System\VEUHqsE.exe
  C:\Windows\System\VEUHqsE.exe
  2⤵
  PID:12804
- C:\Windows\System\lhTEQTb.exe
  C:\Windows\System\lhTEQTb.exe
  2⤵
  PID:12836
- C:\Windows\System\EdFgRGu.exe
  C:\Windows\System\EdFgRGu.exe
  2⤵
  PID:12856
- C:\Windows\System\xDxqyZb.exe
  C:\Windows\System\xDxqyZb.exe
  2⤵
  PID:12896
- C:\Windows\System\rkdLwkt.exe
  C:\Windows\System\rkdLwkt.exe
  2⤵
  PID:12924
- C:\Windows\System\bKFePKR.exe
  C:\Windows\System\bKFePKR.exe
  2⤵
  PID:12956
- C:\Windows\System\YVUcueZ.exe
  C:\Windows\System\YVUcueZ.exe
  2⤵
  PID:12984
- C:\Windows\System\UOMaAch.exe
  C:\Windows\System\UOMaAch.exe
  2⤵
  PID:13016
- C:\Windows\System\YiZNeSg.exe
  C:\Windows\System\YiZNeSg.exe
  2⤵
  PID:13040
- C:\Windows\System\OvZbcCw.exe
  C:\Windows\System\OvZbcCw.exe
  2⤵
  PID:13064
- C:\Windows\System\jqkvVKa.exe
  C:\Windows\System\jqkvVKa.exe
  2⤵
  PID:13100
- C:\Windows\System\UwQpoLr.exe
  C:\Windows\System\UwQpoLr.exe
  2⤵
  PID:13116
- C:\Windows\System\YicUGjb.exe
  C:\Windows\System\YicUGjb.exe
  2⤵
  PID:13152
- C:\Windows\System\oDtohmg.exe
  C:\Windows\System\oDtohmg.exe
  2⤵
  PID:13184
- C:\Windows\System\PXghQWa.exe
  C:\Windows\System\PXghQWa.exe
  2⤵
  PID:13212
- C:\Windows\System\iuYELzf.exe
  C:\Windows\System\iuYELzf.exe
  2⤵
  PID:13240
- C:\Windows\System\OdyyBPA.exe
  C:\Windows\System\OdyyBPA.exe
  2⤵
  PID:13268
- C:\Windows\System\DzvpBMD.exe
  C:\Windows\System\DzvpBMD.exe
  2⤵
  PID:13296
- C:\Windows\System\TwNJvzW.exe
  C:\Windows\System\TwNJvzW.exe
  2⤵
  PID:12312
- C:\Windows\System\xxGExul.exe
  C:\Windows\System\xxGExul.exe
  2⤵
  PID:12356
- C:\Windows\System\HDmNGtD.exe
  C:\Windows\System\HDmNGtD.exe
  2⤵
  PID:12392
- C:\Windows\System\YRvwOid.exe
  C:\Windows\System\YRvwOid.exe
  2⤵
  PID:4200
- C:\Windows\System\sMigOtY.exe
  C:\Windows\System\sMigOtY.exe
  2⤵
  PID:12584
- C:\Windows\System\ZtByHdE.exe
  C:\Windows\System\ZtByHdE.exe
  2⤵
  PID:12640
- C:\Windows\System\shooFyr.exe
  C:\Windows\System\shooFyr.exe
  2⤵
  PID:12700
- C:\Windows\System\VenkfbV.exe
  C:\Windows\System\VenkfbV.exe
  2⤵
  PID:12772
- C:\Windows\System\yhFFgXC.exe
  C:\Windows\System\yhFFgXC.exe
  2⤵
  PID:12828
- C:\Windows\System\mUZOCkl.exe
  C:\Windows\System\mUZOCkl.exe
  2⤵
  PID:12908
- C:\Windows\System\cYsLWht.exe
  C:\Windows\System\cYsLWht.exe
  2⤵
  PID:12968
- C:\Windows\System\TUThSKz.exe
  C:\Windows\System\TUThSKz.exe
  2⤵
  PID:3456
- C:\Windows\System\EHYafzY.exe
  C:\Windows\System\EHYafzY.exe
  2⤵
  PID:13052
- C:\Windows\System\zJsYKdt.exe
  C:\Windows\System\zJsYKdt.exe
  2⤵
  PID:13112
- C:\Windows\System\gjxrQDR.exe
  C:\Windows\System\gjxrQDR.exe
  2⤵
  PID:13180
- C:\Windows\System\yDLfjQX.exe
  C:\Windows\System\yDLfjQX.exe
  2⤵
  PID:13252
- C:\Windows\System\BkEtory.exe
  C:\Windows\System\BkEtory.exe
  2⤵
  PID:11816
- C:\Windows\System\onhrGzZ.exe
  C:\Windows\System\onhrGzZ.exe
  2⤵
  PID:12460
- C:\Windows\System\tTVLWQj.exe
  C:\Windows\System\tTVLWQj.exe
  2⤵
  PID:12564
- C:\Windows\System\uoZqqUE.exe
  C:\Windows\System\uoZqqUE.exe
  2⤵
  PID:12748
- C:\Windows\System\bmZAkDf.exe
  C:\Windows\System\bmZAkDf.exe
  2⤵
  PID:12888
- C:\Windows\System\hxoxZar.exe
  C:\Windows\System\hxoxZar.exe
  2⤵
  PID:13008
- C:\Windows\System\USBAWdx.exe
  C:\Windows\System\USBAWdx.exe
  2⤵
  PID:13096
- C:\Windows\System\bYcMFWj.exe
  C:\Windows\System\bYcMFWj.exe
  2⤵
  PID:13160
- C:\Windows\System\BvkZEdS.exe
  C:\Windows\System\BvkZEdS.exe
  2⤵
  PID:12528
- C:\Windows\System\JVApbcc.exe
  C:\Windows\System\JVApbcc.exe
  2⤵
  PID:13004
- C:\Windows\System\cKKeLoH.exe
  C:\Windows\System\cKKeLoH.exe
  2⤵
  PID:13088
- C:\Windows\System\HmmKbbK.exe
  C:\Windows\System\HmmKbbK.exe
  2⤵
  PID:12708
- C:\Windows\System\uVatLrv.exe
  C:\Windows\System\uVatLrv.exe
  2⤵
  PID:13316
- C:\Windows\System\KZKPARH.exe
  C:\Windows\System\KZKPARH.exe
  2⤵
  PID:13336
- C:\Windows\System\pJmOpZb.exe
  C:\Windows\System\pJmOpZb.exe
  2⤵
  PID:13364
- C:\Windows\System\UhngtlS.exe
  C:\Windows\System\UhngtlS.exe
  2⤵
  PID:13404
- C:\Windows\System\iHmlttw.exe
  C:\Windows\System\iHmlttw.exe
  2⤵
  PID:13420
- C:\Windows\System\nfoISPc.exe
  C:\Windows\System\nfoISPc.exe
  2⤵
  PID:13460
- C:\Windows\System\kSJJYST.exe
  C:\Windows\System\kSJJYST.exe
  2⤵
  PID:13480
- C:\Windows\System\jMlxipN.exe
  C:\Windows\System\jMlxipN.exe
  2⤵
  PID:13512
- C:\Windows\System\kLzgPFV.exe
  C:\Windows\System\kLzgPFV.exe
  2⤵
  PID:13540
- C:\Windows\System\ziWXBOa.exe
  C:\Windows\System\ziWXBOa.exe
  2⤵
  PID:13564
- C:\Windows\System\xtTavSw.exe
  C:\Windows\System\xtTavSw.exe
  2⤵
  PID:13604
- C:\Windows\System\XVLLOaQ.exe
  C:\Windows\System\XVLLOaQ.exe
  2⤵
  PID:13620
- C:\Windows\System\CsSlyog.exe
  C:\Windows\System\CsSlyog.exe
  2⤵
  PID:13660
- C:\Windows\System\NdnuZKB.exe
  C:\Windows\System\NdnuZKB.exe
  2⤵
  PID:13688
- C:\Windows\System\IVTRucV.exe
  C:\Windows\System\IVTRucV.exe
  2⤵
  PID:13716
- C:\Windows\System\sgOKcMV.exe
  C:\Windows\System\sgOKcMV.exe
  2⤵
  PID:13732
- C:\Windows\System\ufHifCl.exe
  C:\Windows\System\ufHifCl.exe
  2⤵
  PID:13760
- C:\Windows\System\lvIlrCp.exe
  C:\Windows\System\lvIlrCp.exe
  2⤵
  PID:13788
- C:\Windows\System\hxtLbYQ.exe
  C:\Windows\System\hxtLbYQ.exe
  2⤵
  PID:13816
- C:\Windows\System\QSseJqe.exe
  C:\Windows\System\QSseJqe.exe
  2⤵
  PID:13856
- C:\Windows\System\JWLxEQA.exe
  C:\Windows\System\JWLxEQA.exe
  2⤵
  PID:13884
- C:\Windows\System\EqzmzFI.exe
  C:\Windows\System\EqzmzFI.exe
  2⤵
  PID:13912
- C:\Windows\System\xDvgkQW.exe
  C:\Windows\System\xDvgkQW.exe
  2⤵
  PID:13936
- C:\Windows\System\asteDda.exe
  C:\Windows\System\asteDda.exe
  2⤵
  PID:13968
- C:\Windows\System\zbsPfZy.exe
  C:\Windows\System\zbsPfZy.exe
  2⤵
  PID:13996
- C:\Windows\System\bLZAAwY.exe
  C:\Windows\System\bLZAAwY.exe
  2⤵
  PID:14020
- C:\Windows\System\SvlNzvu.exe
  C:\Windows\System\SvlNzvu.exe
  2⤵
  PID:14052
- C:\Windows\System\GOatIkG.exe
  C:\Windows\System\GOatIkG.exe
  2⤵
  PID:14080
- C:\Windows\System\avnlQIk.exe
  C:\Windows\System\avnlQIk.exe
  2⤵
  PID:14100
- C:\Windows\System\eFCOWEf.exe
  C:\Windows\System\eFCOWEf.exe
  2⤵
  PID:14124
- C:\Windows\System\GADKSVZ.exe
  C:\Windows\System\GADKSVZ.exe
  2⤵
  PID:14140
- C:\Windows\System\UUmWmcF.exe
  C:\Windows\System\UUmWmcF.exe
  2⤵
  PID:14160
- C:\Windows\System\DSlsvHk.exe
  C:\Windows\System\DSlsvHk.exe
  2⤵
  PID:14196
- C:\Windows\System\RzYUTos.exe
  C:\Windows\System\RzYUTos.exe
  2⤵
  PID:14224
- C:\Windows\System\tgSDoRe.exe
  C:\Windows\System\tgSDoRe.exe
  2⤵
  PID:14252
- C:\Windows\System\wSTVuZz.exe
  C:\Windows\System\wSTVuZz.exe
  2⤵
  PID:14268
- C:\Windows\System\LYaDzNm.exe
  C:\Windows\System\LYaDzNm.exe
  2⤵
  PID:14296
- C:\Windows\System\IvdxJhl.exe
  C:\Windows\System\IvdxJhl.exe
  2⤵
  PID:14332
- C:\Windows\System\RFvYDYO.exe
  C:\Windows\System\RFvYDYO.exe
  2⤵
  PID:13324
- C:\Windows\System\JfajOxK.exe
  C:\Windows\System\JfajOxK.exe
  2⤵
  PID:13400
- C:\Windows\System\RBImHBe.exe
  C:\Windows\System\RBImHBe.exe
  2⤵
  PID:13432
- C:\Windows\System\XxxNwlQ.exe
  C:\Windows\System\XxxNwlQ.exe
  2⤵
  PID:13496
- C:\Windows\System\iJQGhqF.exe
  C:\Windows\System\iJQGhqF.exe
  2⤵
  PID:13560
- C:\Windows\System\YQbtYFR.exe
  C:\Windows\System\YQbtYFR.exe
  2⤵
  PID:13644
- C:\Windows\System\fTuYPLt.exe
  C:\Windows\System\fTuYPLt.exe
  2⤵
  PID:13700
- C:\Windows\System\nuXXWYP.exe
  C:\Windows\System\nuXXWYP.exe
  2⤵
  PID:13748
- C:\Windows\System\dObjRfS.exe
  C:\Windows\System\dObjRfS.exe
  2⤵
  PID:13804
- C:\Windows\System\uhDDUNe.exe
  C:\Windows\System\uhDDUNe.exe
  2⤵
  PID:13852
- C:\Windows\System\kYirGvx.exe
  C:\Windows\System\kYirGvx.exe
  2⤵
  PID:13932
- C:\Windows\System\MBFxLUN.exe
  C:\Windows\System\MBFxLUN.exe
  2⤵
  PID:13980
- C:\Windows\System\EZUGjtc.exe
  C:\Windows\System\EZUGjtc.exe
  2⤵
  PID:14040
- C:\Windows\System\LiiJfWq.exe
  C:\Windows\System\LiiJfWq.exe
  2⤵
  PID:14108
- C:\Windows\System\VoqkYuy.exe
  C:\Windows\System\VoqkYuy.exe
  2⤵
  PID:14180
- C:\Windows\System\NJHQbuX.exe
  C:\Windows\System\NJHQbuX.exe
  2⤵
  PID:14168
- C:\Windows\System\bKTffhO.exe
  C:\Windows\System\bKTffhO.exe
  2⤵
  PID:14292
- C:\Windows\System\jTvFDCL.exe
  C:\Windows\System\jTvFDCL.exe
  2⤵
  PID:14264
- C:\Windows\System\LcGazlH.exe
  C:\Windows\System\LcGazlH.exe
  2⤵
  PID:1036
- C:\Windows\System\sVaJlrX.exe
  C:\Windows\System\sVaJlrX.exe
  2⤵
  PID:13476
- C:\Windows\System\AaYCGqI.exe
  C:\Windows\System\AaYCGqI.exe
  2⤵
  PID:14136
- C:\Windows\System\UHKUaUy.exe
  C:\Windows\System\UHKUaUy.exe
  2⤵
  PID:13328
- C:\Windows\System\jVJzJeo.exe
  C:\Windows\System\jVJzJeo.exe
  2⤵
  PID:12452
- C:\Windows\System\njIFXLi.exe
  C:\Windows\System\njIFXLi.exe
  2⤵
  PID:2128
- C:\Windows\System\fBjIPhR.exe
  C:\Windows\System\fBjIPhR.exe
  2⤵
  PID:3868
- C:\Windows\System\WZnlwpA.exe
  C:\Windows\System\WZnlwpA.exe
  2⤵
  PID:13552
- C:\Windows\System\FeKtHIp.exe
  C:\Windows\System\FeKtHIp.exe
  2⤵
  PID:4920
- C:\Windows\System\TwsXfNu.exe
  C:\Windows\System\TwsXfNu.exe
  2⤵
  PID:3520
- C:\Windows\System\hJceqIY.exe
  C:\Windows\System\hJceqIY.exe
  2⤵
  PID:2100
- C:\Windows\System\LSdQplF.exe
  C:\Windows\System\LSdQplF.exe
  2⤵
  PID:3696
- C:\Windows\System\aHgDijx.exe
  C:\Windows\System\aHgDijx.exe
  2⤵
  PID:14088
- C:\Windows\System\UkCrSJd.exe
  C:\Windows\System\UkCrSJd.exe
  2⤵
  PID:14176
- C:\Windows\System\xAqDWGo.exe
  C:\Windows\System\xAqDWGo.exe
  2⤵
  PID:13756
- C:\Windows\System\tztITel.exe
  C:\Windows\System\tztITel.exe
  2⤵
  PID:3936
- C:\Windows\System\CpKBGLB.exe
  C:\Windows\System\CpKBGLB.exe
  2⤵
  PID:14236
- C:\Windows\System\JlzFHqI.exe
  C:\Windows\System\JlzFHqI.exe
  2⤵
  PID:14340
- C:\Windows\System\CkvduWe.exe
  C:\Windows\System\CkvduWe.exe
  2⤵
  PID:14368
- C:\Windows\System\WLwGNQB.exe
  C:\Windows\System\WLwGNQB.exe
  2⤵
  PID:14388
- C:\Windows\System\qsekYnm.exe
  C:\Windows\System\qsekYnm.exe
  2⤵
  PID:14424
- C:\Windows\System\UnyLXGm.exe
  C:\Windows\System\UnyLXGm.exe
  2⤵
  PID:14452
- C:\Windows\System\UYcqQJm.exe
  C:\Windows\System\UYcqQJm.exe
  2⤵
  PID:14512
- C:\Windows\System\OEhRSrY.exe
  C:\Windows\System\OEhRSrY.exe
  2⤵
  PID:14536
- C:\Windows\System\CSpoOSn.exe
  C:\Windows\System\CSpoOSn.exe
  2⤵
  PID:14568
- C:\Windows\System\AcAiDMS.exe
  C:\Windows\System\AcAiDMS.exe
  2⤵
  PID:14596
- C:\Windows\System\qIpSgfp.exe
  C:\Windows\System\qIpSgfp.exe
  2⤵
  PID:14616
- C:\Windows\System\bOetUrx.exe
  C:\Windows\System\bOetUrx.exe
  2⤵
  PID:14652
- C:\Windows\System\qeqyVwq.exe
  C:\Windows\System\qeqyVwq.exe
  2⤵
  PID:14676
- C:\Windows\System\Ivkgrgq.exe
  C:\Windows\System\Ivkgrgq.exe
  2⤵
  PID:14708
- C:\Windows\System\TTxLuVn.exe
  C:\Windows\System\TTxLuVn.exe
  2⤵
  PID:14744
- C:\Windows\System\osZVWhs.exe
  C:\Windows\System\osZVWhs.exe
  2⤵
  PID:14764
- C:\Windows\System\NGDAUlo.exe
  C:\Windows\System\NGDAUlo.exe
  2⤵
  PID:14780
- C:\Windows\System\KbnCpii.exe
  C:\Windows\System\KbnCpii.exe
  2⤵
  PID:14816
- C:\Windows\System\yHffMzp.exe
  C:\Windows\System\yHffMzp.exe
  2⤵
  PID:14840
- C:\Windows\System\LxMFifM.exe
  C:\Windows\System\LxMFifM.exe
  2⤵
  PID:14860
- C:\Windows\System\yfXrFza.exe
  C:\Windows\System\yfXrFza.exe
  2⤵
  PID:14892
- C:\Windows\System\iTmFXNY.exe
  C:\Windows\System\iTmFXNY.exe
  2⤵
  PID:14912
- C:\Windows\System\ndHMUlC.exe
  C:\Windows\System\ndHMUlC.exe
  2⤵
  PID:14936
- C:\Windows\System\CKKHTeL.exe
  C:\Windows\System\CKKHTeL.exe
  2⤵
  PID:14964
- C:\Windows\System\VqFumcG.exe
  C:\Windows\System\VqFumcG.exe
  2⤵
  PID:14996
- C:\Windows\System\UgEENuT.exe
  C:\Windows\System\UgEENuT.exe
  2⤵
  PID:15016
- C:\Windows\System\dEaSjfC.exe
  C:\Windows\System\dEaSjfC.exe
  2⤵
  PID:15040
- C:\Windows\System\xczlqsG.exe
  C:\Windows\System\xczlqsG.exe
  2⤵
  PID:15068
- C:\Windows\System\TnFLSAV.exe
  C:\Windows\System\TnFLSAV.exe
  2⤵
  PID:15088
- C:\Windows\System\dyTVBjT.exe
  C:\Windows\System\dyTVBjT.exe
  2⤵
  PID:15116
- C:\Windows\System\WPJFbEw.exe
  C:\Windows\System\WPJFbEw.exe
  2⤵
  PID:15136
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15136 -s 248
    3⤵
    PID:4980
- C:\Windows\System\BcbiiiD.exe
  C:\Windows\System\BcbiiiD.exe
  2⤵
  PID:15356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AsCpztt.exe

Filesize
2.3MB

MD5
da35eb10b8c8b3a6c4e1c35c27db8895

SHA1
f48164ea367d74145e990b1b846e9fc5bdad45f5

SHA256
2c077ae17d0e69746723be2466a60f420fb7001042336e789eb0ebcd4a15c493

SHA512
b65670e3264f2c237354f073adf1e8dab65ad03a192d536aab7378bb75b07d6f49503d29f60dc319f7e893554569d467f8bd668e1ad19ae9a461873c61c6eb9d

Download Submit
C:\Windows\System\CXkTYKJ.exe

Filesize
2.3MB

MD5
5b6a23b066466fdc9c8c6e88e7cfb3f9

SHA1
3cb47fbf4bef9c0969e57eef7fed21d0849683d1

SHA256
225547b27afb50fbd6fbea346d242fcd3f2a09dd28ce1bf54ee6fa5179c1af6d

SHA512
6cb026a3d6cfd2c15944c785c38baadddad5c4140b111eaee0c35b03e381c22a60f6180891f964cef072d167c5734fd0be4bb63cb800cf3a385fee7a9f3d3f41

Download Submit
C:\Windows\System\FdRymWG.exe

Filesize
2.3MB

MD5
69f34c7b83c5bf38fb61634a6cd5c1ef

SHA1
7cefa420fd3fa9eb9623f2802c9d308e535a2cb4

SHA256
eab98059e2ec9fc2fff826f62fb2457f7b90d5b2d94c4e25141ca423c2fdc1f6

SHA512
5ca14ff682653def7c4d7c5d2355d3f87faf634f6a331793cb5c54f3f298ac45572cc255d7283516bfe28b7be909986afb281a9c37173bbe5a89372f4d9f3a77

Download Submit
C:\Windows\System\FtqWwBX.exe

Filesize
2.3MB

MD5
ac54f7b14f124c62744840db543922a0

SHA1
f879881184195b81fe01186f8eb9d8bd9282b4c5

SHA256
17a4d7888c5034ad0800e9e7be9a3b2ab73e5ebf4dfdaaeaba7c69b49239a9fa

SHA512
237bfbf1482539599b7a625fa6477a30524f7ecdd68303be5b2d31101eb0b032957fa9f71b428efbc47499d0a674da2cdfd6bda540fee47d0286f023bdd021a0

Download Submit
C:\Windows\System\GBTclzw.exe

Filesize
2.3MB

MD5
31302bc5244be3a0e6b695292cbc45ba

SHA1
59ee6f2dd76629677a237a46079e2f73844c4687

SHA256
5d593404a99c9e93e07a92f434fe99d6ff23db0c4808789fe1c8f12fa2d918a4

SHA512
5d839a96cd9c5a9035c77fa3a84a56dd89b6c86fa3ec9ffb499da78100d1e5acd2fa5bb8b9b52e28d19495fecdbf0e1c099752619c4f59d5dfca9413197e0452

Download Submit
C:\Windows\System\JHRpkZu.exe

Filesize
2.3MB

MD5
bb53e0f29aed4da7bf1db57a534a2dca

SHA1
af0dcb17973d0ff735e1d9b0f983a588c02db0c7

SHA256
b6c47b22dd2e95def4e71e9bf383ce186eb3e2eab66160bca73cbc4abde1c19c

SHA512
4b4d163a272a22bc9c0ee1373ad969954baa6aa9292850309240c3716df50fb7f3af28c38c2b8dcd36da80d8d5c232a13d0da9a1f652e50d4e8d3fee3f5a0821

Download Submit
C:\Windows\System\JSltOog.exe

Filesize
2.3MB

MD5
52e1d0f7c8cb3a028cef274421e8688c

SHA1
264e658c732215f4fefc3c9bcef278726f0bba93

SHA256
388a55f7ca14180519175a59d290f37b1daa4898f61eb44e82e0cb2ad3ab552d

SHA512
939ad53324e43b8ffa95547874958d686387f379aac5a56f165cc8c4132e2ddff43fc887f70d9ee8dcf093847ed7b8b8b2087a7415489093972eab78b5723a57

Download Submit
C:\Windows\System\NBhcsNJ.exe

Filesize
2.3MB

MD5
45024a61b438c0ef1a1362bb8a9a13b7

SHA1
280974f9a3d3a3f870398f0308dfe473aeb7f00d

SHA256
89ca5677694de7f37dc902da997e93597fbc42e8f7d841f284cbd0ce6e507a41

SHA512
de887514edc1db99f9207649f32dd02b7e597658be543303d729ea50870005f7f41268f4f8d444b92d567ca4088cb0b165114b91a8f837aa3d5da0d847cb6879

Download Submit
C:\Windows\System\RElpqJu.exe

Filesize
2.3MB

MD5
5f4580553a2b08ee6e043b0f3a4fe987

SHA1
e9dc0439f8edb0fd18bd04d9dbba44eac8f49ba3

SHA256
018094b29fd0d6679ddb1dd1efe2b1a7be912dee3023c06abcd9690aced7a349

SHA512
16e2c5e11c241068a0ff0c612fa51d881bf2e6938a3f51f468a3f6267c7cc55ecef85a15acc7eeeb02377f02885e640f5207a24d90690aa102a8e42b388ed962

Download Submit
C:\Windows\System\RXripYi.exe

Filesize
2.3MB

MD5
53c9c5edd3c9bc0f3949677b34044a8b

SHA1
b55118dbdb19b9e9b7b02c678ea1320a0ebe0b8a

SHA256
0e75007ddfe324209cd85afa9b733358b33083a51b0ec180ba72d928350d33c5

SHA512
298a0ec025723182d0be7f320a7b95b3428d933c0d55c710c65c2fdc4b3f46de9ea7035b6589890b3859270bc592ae188b797f9018e76ea8dbfa21405e81f51f

Download Submit
C:\Windows\System\RapsRJd.exe

Filesize
2.3MB

MD5
c928bed9d6dec596eeb4108ec5c8b546

SHA1
3ebcce5ddaadb80cc0f50172d5fbaa172367d603

SHA256
8d1c000ad9f162e2a7eb813647926a4be3724bfd655c8dcfbf38baf2c501d077

SHA512
39610bf6f54db963c57c4980816c4730ec442b0bdaa923b00e563aeb2c2ab057f323c959df60e98ecfe3fe0badc71bc7a231edf9a164cb480c5f9e3fb0d706ec

Download Submit
C:\Windows\System\TeVkcZl.exe

Filesize
2.3MB

MD5
0c365eb4a22d31907d04f791c3a0df80

SHA1
2568a8d5ca3b94686597c52185d365ae3086c4f4

SHA256
8cc80b29979884820341f6fc5a57d90b651921b23933bee22a10779bb275545d

SHA512
feb9d1c770615660f4d8d8fd827cbdb5900852fba7a0bf6b0b0a46910475401e88f2cf465be0ec386bf6bd8ef05b8eb052dbd78ab058cad6273a842bc5681155

Download Submit
C:\Windows\System\VgtCDYv.exe

Filesize
2.3MB

MD5
8af1b6d8551acfd7d2625b56407778f0

SHA1
92c23e09d360e9ba1db9b51dc81c1ee61753c486

SHA256
fb786b74f3a73e1c44b3150384c6862837c9098cad4e58b8e516acbf729c80ab

SHA512
cd29ffda41866e425290a85cc223566986a269171116c589c38a42c932e07cccc351444dff5c72d60feb2515c257f8eb03d13a34e4b1a329eb61f34459c42812

Download Submit
C:\Windows\System\VsZBIeK.exe

Filesize
2.3MB

MD5
6571b52f1936d93aaa36d42a5f150b68

SHA1
726b54371be5941982cf23c0d22600dbf502dbfb

SHA256
87f3355cc61110f6c79e1ad3279867e66456b7396be1014123ffe6577cae4ade

SHA512
b707407583dc8dec56c9ff04b5afd0acedd148d219a66c1d750881796eec27e5c08b5eef23559fd29df2ee6c27c3fd03f98a8bad7abc37de2e86315345f25927

Download Submit
C:\Windows\System\VwNjNsO.exe

Filesize
2.3MB

MD5
45f41cc969573838fbbba910b5f40f70

SHA1
1daa8ec3233603ad8949903c05169624034c2897

SHA256
b993c7643b32ac516803d556f6a3c46cf686d3bba20e0ca2be0a023c530052b3

SHA512
725c22c4676c480b00e008dbbe1f4c6b6c42d5a76f7516582df0cb4def59874e3b63283f650c8dc63b35d353aa41a0dc6022eda4ab716978eec9722f2f037b91

Download Submit
C:\Windows\System\YKkLSRC.exe

Filesize
2.3MB

MD5
cd4f45101ba85625345074afc130db83

SHA1
bddbae0c1bd35241a591b90ae67129d0fff9fc7b

SHA256
2b4e3558cb89c37c198813763905466bf7080cd63c80212fac340efb891c856b

SHA512
466cfeb3424395b3a827c0d0bec1989cef280e3a1f2713c3687e6bc7070781a51ba4e03a9a74fcd4c4cf920433a21bb7fa90810c9a07b48b3358f2dafb9631d3

Download Submit
C:\Windows\System\YdbAutH.exe

Filesize
2.3MB

MD5
bc819c780ab912602b37ffe3e20aa50a

SHA1
6a625d7e06bf28d7e3a298c29f8c117430c56128

SHA256
395775460db70b97616a68d758d52326cf769acf48126d6d9900e9a412540cdc

SHA512
099c34a82fa3d57741e5eb838828164bf19576d60f38ea88ff0041a41844278c9ad805b8d9dff0df1356b2de774c35c84b32d5332fb63d1e5e3de7424fa90e24

Download Submit
C:\Windows\System\ZHBOLPm.exe

Filesize
2.3MB

MD5
af47290ab4a330f6da0cc5d4249da344

SHA1
75bae6644a836e90fa44147b7cfd1caf586d0319

SHA256
54639bf731ee9641a517d4c7c483f64c971c4ca0d3dbf5b22628b2a46f4f8df8

SHA512
8fee0eaaf127bd985c9c4462efd1e5321c3a7f68853c30dd1e2e70cd6b837e9cf7c7332d92b0075adeb32fdc067841663d07698aa5d9d2933943dad280a6d158

Download Submit
C:\Windows\System\bCaKhsG.exe

Filesize
2.3MB

MD5
ea9d47a8cf81641f951c356244f00815

SHA1
04749a46f0550504051bb7629ad324bccd852a91

SHA256
7651a1eb34d34247ec71f21cab70c0b679ca67fb0ed7bab6c0d7002b49dd06e7

SHA512
8888e45085d625610f8f26d5fcea2a5bebb9f676ee8854069faf107223f784370123b8d80445903e0ccef3b044475fade74765592b1a92fbb03b35af4b352cbf

Download Submit
C:\Windows\System\ftIvaiA.exe

Filesize
2.3MB

MD5
ee0ccb57bfad29a79405e6135377759e

SHA1
9887048f2443e9792de1127d3ae71232a6c3a027

SHA256
98bd4a103e3e921509ad605e1a981ced0dc5e6c7560bff5148aeefa9684cb251

SHA512
7fd2a7d8131e5cae78e2569c6d2c8a1294f37965f54a051f1abaa04ab33f1f5b36b9eec9fc5b0665fa7f86d108cf5cdcc507662d401b291cc1d8b32d128f04c8

Download Submit
C:\Windows\System\gGgeJgR.exe

Filesize
2.3MB

MD5
7334741526d8b02de8814d5b6e68ec0d

SHA1
2ee64b2331c105d3266fc9c9a18e3825065e5712

SHA256
d08a017c363d26866e79c67a99a5ecd1cfac336a578af7a82b81446f8f7480a5

SHA512
ef411751a17140c27621b3eb6044eafc0dacb99277d4c4221945a8dc3b68cc1782edd318865b485e6ee5ffb133a42b232178c2372fdfcf265e664d6cb865eac8

Download Submit
C:\Windows\System\hAyyKNs.exe

Filesize
2.3MB

MD5
577e2c5e94105c4e4a784bab8c858705

SHA1
2432843f8f0877e15a68d8c958e5a99f3777f8e7

SHA256
25a251d50ace3fc54e278a4db9f5e2a5390265f0f20a19540afd32cb3f4ce093

SHA512
fd6083a1c5bb85e49fa183b8aada9efd27ea06309d57614605a67491f89576a263598292f7c085216c081ac2adc9ae8d4f567025343fe02521c3ad387d6f3d21

Download Submit
C:\Windows\System\kfyzCqs.exe

Filesize
2.3MB

MD5
6c5e308fb2b40b55c337afbe0f3ef4f8

SHA1
096e498aeed2b083d8ff18f993b2da5c802af95d

SHA256
76aab837f38c87c6630612efe0b4a5810f5e4a9dc0552cbb7606edfadf1a140b

SHA512
ca663d48cb1a985e9c0c2c247b6c40fb15b1b71446444adaf9570c666496c19c613edd67456febca5bf8428bf0521917b075f0479c6016822655e7ab8dfe8302

Download Submit
C:\Windows\System\lAwycAL.exe

Filesize
2.3MB

MD5
d01052145101f338e0e0bc69cbded394

SHA1
a3c690fd8ca2caec6c35e541b20b2fa8e356a209

SHA256
3b4e2ea29e81bee0abffe648f9f1fe2d60e4c65f0dbbd0514604f455dd3f13ca

SHA512
369308cd379818f342e6cf62555ca6c358eb49ae936261b100bc614c8e12d5cd12ed1ee7322116eb9a3e1947213f2d9e0873ff549d2125843012c5cfce03347a

Download Submit
C:\Windows\System\lVlhZiz.exe

Filesize
2.3MB

MD5
173959a2a9aafb93810d3aea920ae38a

SHA1
7b169f925b3ada0c58000eca0a2f70e1f7c9e97a

SHA256
8fa0275187ec531983c2379433f1b51f9b24b880aab57d0d1235b29fee634964

SHA512
a2d8f2e2d7e70b8cfa9f691ee8ac26a8fa93ef97e1d7887c42b3b2588c128bcee89a282bf98bcf10a72c09134ec7a9921ff86381d183ddeab637fb66fdacc053

Download Submit
C:\Windows\System\mXCKFWy.exe

Filesize
2.3MB

MD5
8ab28bb5fd010b077becfeb4c8ad7ddf

SHA1
435c5ccf82051b33817591d42a3a26acdc3c421d

SHA256
fc4e01d28cac552e03390efa9b22a5bdf2c23bf0eac6546527166721b6374ad4

SHA512
a3161388374e072eed855c2233f9ad05dcbce3f730e4b72059816250326a93d155485f1f4837b29645b0d8e45e0563a0501248e3e45e29c5e85038d5255fcd1c

Download Submit
C:\Windows\System\pkesFUo.exe

Filesize
2.3MB

MD5
29df23c2c8a594d772d7268aec6c9f88

SHA1
a9f38098d8413ddf40f71ec49573f90218b50939

SHA256
1ebad3deacd3c5ff432b150a4ffa2886b07a05ec8f4faef95681db2224230b06

SHA512
d26068f42696a93f4d7e1c610ac1fa0ea82be5022af30ea95b4d4964c0b53e946eb1c85f065bb28d10b674121f6e2ec6046f8c6688f952337bd630b5ce6a93b9

Download Submit
C:\Windows\System\qISUblH.exe

Filesize
2.3MB

MD5
85e1ddca99123a1bcabdb474f3c206f6

SHA1
2a26ce072aab0a5fe8f51c1a70607b13015cbaab

SHA256
a27e0337601885f857cd58ca1164442e2a1012cadbe9f583da3320e073c30cdb

SHA512
36ad748712ae9a6868e30ca21839094e1a881781569ba827d4470d24882817e2920e11ba63cc462d1b5e278aeb1cd9c31e36be7b158c656c344a3eef619ce651

Download Submit
C:\Windows\System\slBicIA.exe

Filesize
2.3MB

MD5
97df25fcd34cabd4f2570b5b03087f4a

SHA1
b6cc6e9683ce4db1483970590870234c308d72f4

SHA256
41e830eca377ff76d66856f6870cd79b149102257bf9ea0d276058e20fba8db2

SHA512
52817b3cbb4f12112b28cc125c0076870d366e698f82739504331413f0583a709e6abf35662011958ee28903652f5be77861657eeb7a928e9d22a6804cf93c23

Download Submit
C:\Windows\System\tsZqDBS.exe

Filesize
2.3MB

MD5
675f036740cafa51b0b86e290967a9ec

SHA1
84cafaf2814b09217529eb941fc462b2b4e441a0

SHA256
1d8f5f88433d221106a305223bc8cd9e4bff20a659c742066df402097c0eba71

SHA512
7c5af4db6e37b00a1b3063695e2298d3b9bfe280a834d0ef2ddf4f4b92c7e5b9dc3ee5b3724468aef9e20d8c8aa29898ae016fd9d607fe92632f41d669636568

Download Submit
C:\Windows\System\xkSKrkc.exe

Filesize
2.3MB

MD5
e51cf532ffd1c303f2f1baac65fbfe63

SHA1
827600f847e1a174ae1a0342022709b41c599c94

SHA256
b92122cc7afc0ef248f52d8838cc4363bde3be13f5c06ebf8bb758fd674c3dd3

SHA512
71dcf0f52d8c3fb835630ea704b1780270ea373c490c2ee17056068b3c551e9b7d971cc4c9961094816cb1bad335c859ee49995ac512fb7d23b6eb86c4f4847f

Download Submit
C:\Windows\System\yqrpKVh.exe

Filesize
2.3MB

MD5
8827926a38c36a25deaf91402040c91b

SHA1
909c9a94381308a54974897d904cdb5cb813b07d

SHA256
81796bc46bc34cbdff5de3c58b4880f101ad05888e6bd2f65c5cf285ca5e7984

SHA512
9b22166e4e326fb0a2d4fec7b32e82c60879226b61762ec53b6f5cf033523c76cda2850a4a198228b8e7557f1ab994ab145698963bbf8f96e69da048733346f3

Download Submit
C:\Windows\System\zARLodQ.exe

Filesize
2.3MB

MD5
01f760dc5a3d41c09f79b4b131730765

SHA1
2a3004995cb2ab6d88281925e7bd6eea3ea1abb2

SHA256
bcc3da5f9a0f1da8c7f42b5f4bc4f65ecd3f66339c450bb79847226d36a658e1

SHA512
d4fb684ab112aa0f810db5a44736f895b6838610eb5f2bab8f48604c988c7a891dd69e88d92cadf34718d90e61584c70657eaf8016e9c2f0cce6eb0e2d76309c

Download Submit
memory/496-135-0x00007FF67A860000-0x00007FF67ABB4000-memory.dmp

Filesize
3.3MB

Download
memory/496-2247-0x00007FF67A860000-0x00007FF67ABB4000-memory.dmp

Filesize
3.3MB

Download
memory/1500-143-0x00007FF705A90000-0x00007FF705DE4000-memory.dmp

Filesize
3.3MB

Download
memory/1500-2224-0x00007FF705A90000-0x00007FF705DE4000-memory.dmp

Filesize
3.3MB

Download
memory/1500-2251-0x00007FF705A90000-0x00007FF705DE4000-memory.dmp

Filesize
3.3MB

Download
memory/1560-95-0x00007FF7E01E0000-0x00007FF7E0534000-memory.dmp

Filesize
3.3MB

Download
memory/1560-2241-0x00007FF7E01E0000-0x00007FF7E0534000-memory.dmp

Filesize
3.3MB

Download
memory/1760-140-0x00007FF724070000-0x00007FF7243C4000-memory.dmp

Filesize
3.3MB

Download
memory/1760-2227-0x00007FF724070000-0x00007FF7243C4000-memory.dmp

Filesize
3.3MB

Download
memory/1760-26-0x00007FF724070000-0x00007FF7243C4000-memory.dmp

Filesize
3.3MB

Download
memory/1776-930-0x00007FF7D8200000-0x00007FF7D8554000-memory.dmp

Filesize
3.3MB

Download
memory/1776-2244-0x00007FF7D8200000-0x00007FF7D8554000-memory.dmp

Filesize
3.3MB

Download
memory/1776-91-0x00007FF7D8200000-0x00007FF7D8554000-memory.dmp

Filesize
3.3MB

Download
memory/2232-2253-0x00007FF758A20000-0x00007FF758D74000-memory.dmp

Filesize
3.3MB

Download
memory/2232-161-0x00007FF758A20000-0x00007FF758D74000-memory.dmp

Filesize
3.3MB

Download
memory/2608-2228-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-30-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-141-0x00007FF77A870000-0x00007FF77ABC4000-memory.dmp

Filesize
3.3MB

Download
memory/2832-2255-0x00007FF7C1970000-0x00007FF7C1CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2832-2236-0x00007FF7C1970000-0x00007FF7C1CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2832-174-0x00007FF7C1970000-0x00007FF7C1CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2856-2232-0x00007FF6E4830000-0x00007FF6E4B84000-memory.dmp

Filesize
3.3MB

Download
memory/2856-142-0x00007FF6E4830000-0x00007FF6E4B84000-memory.dmp

Filesize
3.3MB

Download
memory/2856-35-0x00007FF6E4830000-0x00007FF6E4B84000-memory.dmp

Filesize
3.3MB

Download
memory/2980-19-0x00007FF6C6BF0000-0x00007FF6C6F44000-memory.dmp

Filesize
3.3MB

Download
memory/2980-2226-0x00007FF6C6BF0000-0x00007FF6C6F44000-memory.dmp

Filesize
3.3MB

Download
memory/2980-129-0x00007FF6C6BF0000-0x00007FF6C6F44000-memory.dmp

Filesize
3.3MB

Download
memory/3128-2250-0x00007FF6D7CE0000-0x00007FF6D8034000-memory.dmp

Filesize
3.3MB

Download
memory/3128-2223-0x00007FF6D7CE0000-0x00007FF6D8034000-memory.dmp

Filesize
3.3MB

Download
memory/3128-138-0x00007FF6D7CE0000-0x00007FF6D8034000-memory.dmp

Filesize
3.3MB

Download
memory/3184-169-0x00007FF65B780000-0x00007FF65BAD4000-memory.dmp

Filesize
3.3MB

Download
memory/3184-2235-0x00007FF65B780000-0x00007FF65BAD4000-memory.dmp

Filesize
3.3MB

Download
memory/3184-2254-0x00007FF65B780000-0x00007FF65BAD4000-memory.dmp

Filesize
3.3MB

Download
memory/3248-2258-0x00007FF7B8CA0000-0x00007FF7B8FF4000-memory.dmp

Filesize
3.3MB

Download
memory/3248-164-0x00007FF7B8CA0000-0x00007FF7B8FF4000-memory.dmp

Filesize
3.3MB

Download
memory/3248-2234-0x00007FF7B8CA0000-0x00007FF7B8FF4000-memory.dmp

Filesize
3.3MB

Download
memory/3296-2257-0x00007FF75C050000-0x00007FF75C3A4000-memory.dmp

Filesize
3.3MB

Download
memory/3296-184-0x00007FF75C050000-0x00007FF75C3A4000-memory.dmp

Filesize
3.3MB

Download
memory/3296-2252-0x00007FF75C050000-0x00007FF75C3A4000-memory.dmp

Filesize
3.3MB

Download
memory/3452-2240-0x00007FF77DA70000-0x00007FF77DDC4000-memory.dmp

Filesize
3.3MB

Download
memory/3452-924-0x00007FF77DA70000-0x00007FF77DDC4000-memory.dmp

Filesize
3.3MB

Download
memory/3452-78-0x00007FF77DA70000-0x00007FF77DDC4000-memory.dmp

Filesize
3.3MB

Download
memory/3700-55-0x00007FF779280000-0x00007FF7795D4000-memory.dmp

Filesize
3.3MB

Download
memory/3700-2231-0x00007FF779280000-0x00007FF7795D4000-memory.dmp

Filesize
3.3MB

Download
memory/4116-2246-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp

Filesize
3.3MB

Download
memory/4116-130-0x00007FF6BD230000-0x00007FF6BD584000-memory.dmp

Filesize
3.3MB

Download
memory/4228-922-0x00007FF7FCC00000-0x00007FF7FCF54000-memory.dmp

Filesize
3.3MB

Download
memory/4228-66-0x00007FF7FCC00000-0x00007FF7FCF54000-memory.dmp

Filesize
3.3MB

Download
memory/4228-2238-0x00007FF7FCC00000-0x00007FF7FCF54000-memory.dmp

Filesize
3.3MB

Download
memory/4256-45-0x00007FF74A8D0000-0x00007FF74AC24000-memory.dmp

Filesize
3.3MB

Download
memory/4256-154-0x00007FF74A8D0000-0x00007FF74AC24000-memory.dmp

Filesize
3.3MB

Download
memory/4256-2229-0x00007FF74A8D0000-0x00007FF74AC24000-memory.dmp

Filesize
3.3MB

Download
memory/4420-168-0x00007FF65F090000-0x00007FF65F3E4000-memory.dmp

Filesize
3.3MB

Download
memory/4420-2230-0x00007FF65F090000-0x00007FF65F3E4000-memory.dmp

Filesize
3.3MB

Download
memory/4420-40-0x00007FF65F090000-0x00007FF65F3E4000-memory.dmp

Filesize
3.3MB

Download
memory/4640-2248-0x00007FF7B0190000-0x00007FF7B04E4000-memory.dmp

Filesize
3.3MB

Download
memory/4640-139-0x00007FF7B0190000-0x00007FF7B04E4000-memory.dmp

Filesize
3.3MB

Download
memory/4708-86-0x00007FF69F890000-0x00007FF69FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/4708-2239-0x00007FF69F890000-0x00007FF69FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/4752-2242-0x00007FF64C370000-0x00007FF64C6C4000-memory.dmp

Filesize
3.3MB

Download
memory/4752-94-0x00007FF64C370000-0x00007FF64C6C4000-memory.dmp

Filesize
3.3MB

Download
memory/4940-114-0x00007FF641ED0000-0x00007FF642224000-memory.dmp

Filesize
3.3MB

Download
memory/4940-2245-0x00007FF641ED0000-0x00007FF642224000-memory.dmp

Filesize
3.3MB

Download
memory/4948-2225-0x00007FF7D51B0000-0x00007FF7D5504000-memory.dmp

Filesize
3.3MB

Download
memory/4948-12-0x00007FF7D51B0000-0x00007FF7D5504000-memory.dmp

Filesize
3.3MB

Download
memory/4948-106-0x00007FF7D51B0000-0x00007FF7D5504000-memory.dmp

Filesize
3.3MB

Download
memory/4956-181-0x00007FF70A270000-0x00007FF70A5C4000-memory.dmp

Filesize
3.3MB

Download
memory/4956-48-0x00007FF70A270000-0x00007FF70A5C4000-memory.dmp

Filesize
3.3MB

Download
memory/4956-2233-0x00007FF70A270000-0x00007FF70A5C4000-memory.dmp

Filesize
3.3MB

Download
memory/4972-2237-0x00007FF694220000-0x00007FF694574000-memory.dmp

Filesize
3.3MB

Download
memory/4972-2256-0x00007FF694220000-0x00007FF694574000-memory.dmp

Filesize
3.3MB

Download
memory/4972-176-0x00007FF694220000-0x00007FF694574000-memory.dmp

Filesize
3.3MB

Download
memory/5020-118-0x00007FF629460000-0x00007FF6297B4000-memory.dmp

Filesize
3.3MB

Download
memory/5020-2249-0x00007FF629460000-0x00007FF6297B4000-memory.dmp

Filesize
3.3MB

Download
memory/5020-2056-0x00007FF629460000-0x00007FF6297B4000-memory.dmp

Filesize
3.3MB

Download
memory/5032-103-0x00007FF6694F0000-0x00007FF669844000-memory.dmp

Filesize
3.3MB

Download
memory/5032-1-0x000001BAD1730000-0x000001BAD1740000-memory.dmp

Filesize
64KB

Download
memory/5032-0-0x00007FF6694F0000-0x00007FF669844000-memory.dmp

Filesize
3.3MB

Download
memory/5036-1684-0x00007FF6071C0000-0x00007FF607514000-memory.dmp

Filesize
3.3MB

Download
memory/5036-2243-0x00007FF6071C0000-0x00007FF607514000-memory.dmp

Filesize
3.3MB

Download
memory/5036-96-0x00007FF6071C0000-0x00007FF607514000-memory.dmp

Filesize
3.3MB

Download