xmrig | 1e589268b2c1bdc420d94cf67c05a111c46e512f11de1e57366aab0d3a451895

Analysis

max time kernel
129s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
Size

1.3MB
MD5

491a3d26f10c5922f8473cc14091be80
SHA1

a9e73e6457d7d45a03f91bcb9750c5ed900608ee
SHA256

1e589268b2c1bdc420d94cf67c05a111c46e512f11de1e57366aab0d3a451895
SHA512

9024fd4c6e210109069087dc3ee4b6d0f8e54da6406f38072eb99322bc1dcb695e29b5de93db6c2461f17478c65f945c31b01371062291e693ee6f2fbbc9599b
SSDEEP

24576:RVIl/WDGCi7/qkatXBF672E55I6PFw12TJ1tmyNJeo55TadLHYwU6l5/cyXAuF:ROdWCCi7/rahF3OioF5qdLF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/3956-13-0x00007FF6FE910000-0x00007FF6FEC61000-memory.dmp	xmrig
behavioral2/memory/3752-443-0x00007FF6FABE0000-0x00007FF6FAF31000-memory.dmp	xmrig
behavioral2/memory/3428-440-0x00007FF6017F0000-0x00007FF601B41000-memory.dmp	xmrig
behavioral2/memory/4780-681-0x00007FF78E200000-0x00007FF78E551000-memory.dmp	xmrig
behavioral2/memory/2120-687-0x00007FF6993F0000-0x00007FF699741000-memory.dmp	xmrig
behavioral2/memory/4368-2109-0x00007FF64AB40000-0x00007FF64AE91000-memory.dmp	xmrig
behavioral2/memory/3360-689-0x00007FF63EFC0000-0x00007FF63F311000-memory.dmp	xmrig
behavioral2/memory/3116-688-0x00007FF7F4BA0000-0x00007FF7F4EF1000-memory.dmp	xmrig
behavioral2/memory/2832-686-0x00007FF72C320000-0x00007FF72C671000-memory.dmp	xmrig
behavioral2/memory/3056-685-0x00007FF772950000-0x00007FF772CA1000-memory.dmp	xmrig
behavioral2/memory/2284-684-0x00007FF623C90000-0x00007FF623FE1000-memory.dmp	xmrig
behavioral2/memory/2052-683-0x00007FF7E6540000-0x00007FF7E6891000-memory.dmp	xmrig
behavioral2/memory/1864-682-0x00007FF7E1B90000-0x00007FF7E1EE1000-memory.dmp	xmrig
behavioral2/memory/2204-680-0x00007FF72A1C0000-0x00007FF72A511000-memory.dmp	xmrig
behavioral2/memory/2912-679-0x00007FF6DFBD0000-0x00007FF6DFF21000-memory.dmp	xmrig
behavioral2/memory/1004-678-0x00007FF61DBA0000-0x00007FF61DEF1000-memory.dmp	xmrig
behavioral2/memory/676-677-0x00007FF7567A0000-0x00007FF756AF1000-memory.dmp	xmrig
behavioral2/memory/3604-676-0x00007FF6A4B90000-0x00007FF6A4EE1000-memory.dmp	xmrig
behavioral2/memory/1964-675-0x00007FF7AACC0000-0x00007FF7AB011000-memory.dmp	xmrig
behavioral2/memory/4572-674-0x00007FF6A8B60000-0x00007FF6A8EB1000-memory.dmp	xmrig
behavioral2/memory/4848-343-0x00007FF66C060000-0x00007FF66C3B1000-memory.dmp	xmrig
behavioral2/memory/3668-265-0x00007FF7C4410000-0x00007FF7C4761000-memory.dmp	xmrig
behavioral2/memory/436-264-0x00007FF7D6A20000-0x00007FF7D6D71000-memory.dmp	xmrig
behavioral2/memory/4108-221-0x00007FF6D30B0000-0x00007FF6D3401000-memory.dmp	xmrig
behavioral2/memory/1128-73-0x00007FF6417C0000-0x00007FF641B11000-memory.dmp	xmrig
behavioral2/memory/1112-2206-0x00007FF7F3390000-0x00007FF7F36E1000-memory.dmp	xmrig
behavioral2/memory/1640-2207-0x00007FF764D50000-0x00007FF7650A1000-memory.dmp	xmrig
behavioral2/memory/1716-2208-0x00007FF6F2650000-0x00007FF6F29A1000-memory.dmp	xmrig
behavioral2/memory/2724-2209-0x00007FF6916C0000-0x00007FF691A11000-memory.dmp	xmrig
behavioral2/memory/1400-2210-0x00007FF73F980000-0x00007FF73FCD1000-memory.dmp	xmrig
behavioral2/memory/3956-2216-0x00007FF6FE910000-0x00007FF6FEC61000-memory.dmp	xmrig
behavioral2/memory/1112-2219-0x00007FF7F3390000-0x00007FF7F36E1000-memory.dmp	xmrig
behavioral2/memory/1128-2220-0x00007FF6417C0000-0x00007FF641B11000-memory.dmp	xmrig
behavioral2/memory/1640-2223-0x00007FF764D50000-0x00007FF7650A1000-memory.dmp	xmrig
behavioral2/memory/436-2226-0x00007FF7D6A20000-0x00007FF7D6D71000-memory.dmp	xmrig
behavioral2/memory/3056-2225-0x00007FF772950000-0x00007FF772CA1000-memory.dmp	xmrig
behavioral2/memory/3668-2228-0x00007FF7C4410000-0x00007FF7C4761000-memory.dmp	xmrig
behavioral2/memory/1716-2238-0x00007FF6F2650000-0x00007FF6F29A1000-memory.dmp	xmrig
behavioral2/memory/1964-2240-0x00007FF7AACC0000-0x00007FF7AB011000-memory.dmp	xmrig
behavioral2/memory/2912-2244-0x00007FF6DFBD0000-0x00007FF6DFF21000-memory.dmp	xmrig
behavioral2/memory/676-2246-0x00007FF7567A0000-0x00007FF756AF1000-memory.dmp	xmrig
behavioral2/memory/2204-2250-0x00007FF72A1C0000-0x00007FF72A511000-memory.dmp	xmrig
behavioral2/memory/3604-2248-0x00007FF6A4B90000-0x00007FF6A4EE1000-memory.dmp	xmrig
behavioral2/memory/1004-2242-0x00007FF61DBA0000-0x00007FF61DEF1000-memory.dmp	xmrig
behavioral2/memory/3428-2236-0x00007FF6017F0000-0x00007FF601B41000-memory.dmp	xmrig
behavioral2/memory/4108-2235-0x00007FF6D30B0000-0x00007FF6D3401000-memory.dmp	xmrig
behavioral2/memory/2724-2233-0x00007FF6916C0000-0x00007FF691A11000-memory.dmp	xmrig
behavioral2/memory/3116-2230-0x00007FF7F4BA0000-0x00007FF7F4EF1000-memory.dmp	xmrig
behavioral2/memory/3752-2267-0x00007FF6FABE0000-0x00007FF6FAF31000-memory.dmp	xmrig
behavioral2/memory/1864-2268-0x00007FF7E1B90000-0x00007FF7E1EE1000-memory.dmp	xmrig
behavioral2/memory/4848-2290-0x00007FF66C060000-0x00007FF66C3B1000-memory.dmp	xmrig
behavioral2/memory/3360-2283-0x00007FF63EFC0000-0x00007FF63F311000-memory.dmp	xmrig
behavioral2/memory/2832-2279-0x00007FF72C320000-0x00007FF72C671000-memory.dmp	xmrig
behavioral2/memory/2284-2272-0x00007FF623C90000-0x00007FF623FE1000-memory.dmp	xmrig
behavioral2/memory/2120-2265-0x00007FF6993F0000-0x00007FF699741000-memory.dmp	xmrig
behavioral2/memory/1400-2260-0x00007FF73F980000-0x00007FF73FCD1000-memory.dmp	xmrig
behavioral2/memory/4572-2257-0x00007FF6A8B60000-0x00007FF6A8EB1000-memory.dmp	xmrig
behavioral2/memory/2052-2262-0x00007FF7E6540000-0x00007FF7E6891000-memory.dmp	xmrig
behavioral2/memory/4780-2252-0x00007FF78E200000-0x00007FF78E551000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3956	kTmnqWO.exe
1112	EMJODVx.exe
3056	JypXhVF.exe
1640	nwzTzVm.exe
1128	dnSHctq.exe
2832	KXFlBqk.exe
2120	RtdvBlK.exe
1716	iQjmzez.exe
2724	zrMDVRJ.exe
1400	oVIoDGP.exe
4108	EwOSdDD.exe
436	gfrkASm.exe
3668	EdAGkwz.exe
3116	XBobzbu.exe
4848	kmKvSuQ.exe
3428	tWtTjCN.exe
3752	QlXKkFf.exe
4572	FccGqJo.exe
1964	FXMXoJP.exe
3604	fzdyQHJ.exe
676	zxjfjAG.exe
1004	ATKuUpG.exe
2912	JQymKrP.exe
2204	rGhYTcx.exe
3360	MVhPnSt.exe
4780	TfBcDlX.exe
1864	qptNyEq.exe
2052	ZaEEnsd.exe
2284	hOsoEsq.exe
4180	KhNasnr.exe
5020	uWcFzVP.exe
2708	oNBsFJe.exe
2108	EyTnVjZ.exe
4620	IxAHfSc.exe
3196	aELmxGk.exe
4632	HHBwRnj.exe
2152	diFiDLw.exe
1564	yOuGsjI.exe
3932	vbjsJjA.exe
2232	DaWawNn.exe
4104	YtCdTUt.exe
2932	xylbSyo.exe
4316	cAXEXgR.exe
1768	OmYHCFK.exe
2968	XHEcQvZ.exe
1660	HfSeOjC.exe
4736	MJnmnZz.exe
4120	TyLtFNL.exe
4712	cQACKTm.exe
4484	AkXiLto.exe
1500	VuoOXpk.exe
4964	ycNLaFK.exe
3616	EXVhoWp.exe
924	iGqDhOw.exe
3328	IsSRYHX.exe
4840	mYGrFoQ.exe
1156	GcBYbTj.exe
4624	HGjxKLG.exe
1152	ecrRbyD.exe
4976	ISWvWso.exe
1148	UbBFYME.exe
4772	LIoDTTm.exe
2960	kZFdtZx.exe
4432	nkUTHWS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4368-0-0x00007FF64AB40000-0x00007FF64AE91000-memory.dmp	upx
behavioral2/files/0x000a0000000233ea-4.dat	upx
behavioral2/files/0x00070000000233f3-8.dat	upx
behavioral2/memory/3956-13-0x00007FF6FE910000-0x00007FF6FEC61000-memory.dmp	upx
behavioral2/files/0x0007000000023400-91.dat	upx
behavioral2/memory/3752-443-0x00007FF6FABE0000-0x00007FF6FAF31000-memory.dmp	upx
behavioral2/memory/3428-440-0x00007FF6017F0000-0x00007FF601B41000-memory.dmp	upx
behavioral2/memory/4780-681-0x00007FF78E200000-0x00007FF78E551000-memory.dmp	upx
behavioral2/memory/2120-687-0x00007FF6993F0000-0x00007FF699741000-memory.dmp	upx
behavioral2/memory/4368-2109-0x00007FF64AB40000-0x00007FF64AE91000-memory.dmp	upx
behavioral2/memory/3360-689-0x00007FF63EFC0000-0x00007FF63F311000-memory.dmp	upx
behavioral2/memory/3116-688-0x00007FF7F4BA0000-0x00007FF7F4EF1000-memory.dmp	upx
behavioral2/memory/2832-686-0x00007FF72C320000-0x00007FF72C671000-memory.dmp	upx
behavioral2/memory/3056-685-0x00007FF772950000-0x00007FF772CA1000-memory.dmp	upx
behavioral2/memory/2284-684-0x00007FF623C90000-0x00007FF623FE1000-memory.dmp	upx
behavioral2/memory/2052-683-0x00007FF7E6540000-0x00007FF7E6891000-memory.dmp	upx
behavioral2/memory/1864-682-0x00007FF7E1B90000-0x00007FF7E1EE1000-memory.dmp	upx
behavioral2/memory/2204-680-0x00007FF72A1C0000-0x00007FF72A511000-memory.dmp	upx
behavioral2/memory/2912-679-0x00007FF6DFBD0000-0x00007FF6DFF21000-memory.dmp	upx
behavioral2/memory/1004-678-0x00007FF61DBA0000-0x00007FF61DEF1000-memory.dmp	upx
behavioral2/memory/676-677-0x00007FF7567A0000-0x00007FF756AF1000-memory.dmp	upx
behavioral2/memory/3604-676-0x00007FF6A4B90000-0x00007FF6A4EE1000-memory.dmp	upx
behavioral2/memory/1964-675-0x00007FF7AACC0000-0x00007FF7AB011000-memory.dmp	upx
behavioral2/memory/4572-674-0x00007FF6A8B60000-0x00007FF6A8EB1000-memory.dmp	upx
behavioral2/memory/4848-343-0x00007FF66C060000-0x00007FF66C3B1000-memory.dmp	upx
behavioral2/memory/3668-265-0x00007FF7C4410000-0x00007FF7C4761000-memory.dmp	upx
behavioral2/memory/436-264-0x00007FF7D6A20000-0x00007FF7D6D71000-memory.dmp	upx
behavioral2/memory/4108-221-0x00007FF6D30B0000-0x00007FF6D3401000-memory.dmp	upx
behavioral2/files/0x0007000000023418-206.dat	upx
behavioral2/files/0x0007000000023402-199.dat	upx
behavioral2/files/0x0007000000023401-197.dat	upx
behavioral2/files/0x0007000000023415-191.dat	upx
behavioral2/files/0x000700000002340c-190.dat	upx
behavioral2/files/0x0007000000023413-186.dat	upx
behavioral2/files/0x0007000000023411-184.dat	upx
behavioral2/memory/1400-178-0x00007FF73F980000-0x00007FF73FCD1000-memory.dmp	upx
behavioral2/files/0x0007000000023410-174.dat	upx
behavioral2/files/0x000700000002340f-172.dat	upx
behavioral2/files/0x000700000002340e-165.dat	upx
behavioral2/files/0x0007000000023407-162.dat	upx
behavioral2/files/0x0007000000023406-160.dat	upx
behavioral2/files/0x0007000000023403-154.dat	upx
behavioral2/files/0x000700000002340d-153.dat	upx
behavioral2/files/0x00070000000233f8-143.dat	upx
behavioral2/files/0x00070000000233fc-140.dat	upx
behavioral2/files/0x0007000000023417-198.dat	upx
behavioral2/files/0x0007000000023414-187.dat	upx
behavioral2/files/0x000700000002340b-122.dat	upx
behavioral2/files/0x00070000000233f6-119.dat	upx
behavioral2/files/0x00070000000233fa-118.dat	upx
behavioral2/files/0x0007000000023409-116.dat	upx
behavioral2/files/0x00070000000233ff-180.dat	upx
behavioral2/files/0x0007000000023408-108.dat	upx
behavioral2/files/0x0007000000023405-107.dat	upx
behavioral2/files/0x0007000000023404-106.dat	upx
behavioral2/memory/1716-103-0x00007FF6F2650000-0x00007FF6F29A1000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-150.dat	upx
behavioral2/files/0x00070000000233fb-133.dat	upx
behavioral2/files/0x000700000002340a-117.dat	upx
behavioral2/files/0x00070000000233fe-84.dat	upx
behavioral2/memory/2724-114-0x00007FF6916C0000-0x00007FF691A11000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-74.dat	upx
behavioral2/memory/1128-73-0x00007FF6417C0000-0x00007FF641B11000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-65.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hOsoEsq.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\WctLStr.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\BcaxMIY.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\wFHBBKP.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\YxZyJRa.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\AMeJSgm.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\lNSZgUi.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\IqumaOD.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\cNgVMgY.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\mdYEDhF.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\prmnhrv.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\ubFhwyU.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\iYXDCwi.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\HHTglwL.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\noxTufe.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\OnribKN.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\pPCejDt.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\KXFlBqk.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\oVIoDGP.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\IxAHfSc.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\CzJKJKx.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\VgBgKPM.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\KwaOoMQ.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\KjilyRN.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\nkUTHWS.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\HIxwXcC.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\VUHYUVp.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\ubtieXJ.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\YjArCbL.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\AShuaSd.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\fquUuPk.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\zCXjTDY.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\ATKuUpG.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\ASTjcfz.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\SvqBAWW.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\nWPfIVV.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\OWChhZJ.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\kYBoFKd.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\wIHscHV.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\dnslAwh.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\uxiIOCU.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\ssvuGNf.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\KrTBubd.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\wahbboS.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\TeNdovu.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\VjUtkXY.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\cYofyau.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\AizvHsv.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\ZvUcJFu.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\bTEMwMJ.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\OuXnDtL.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\AIFJQRI.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\RenNHzB.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\XtrIruQ.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\RNvaqsR.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\bfjzLMG.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\EFjUQWj.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\UbBFYME.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\vLsjoMN.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\YrmmAfI.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\dnSHctq.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\KkWdfUm.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\rtranEC.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
File created	C:\Windows\System\KZgbqAz.exe	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 3956	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	84
PID 4368 wrote to memory of 3956	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	84
PID 4368 wrote to memory of 1112	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	85
PID 4368 wrote to memory of 1112	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	85
PID 4368 wrote to memory of 1128	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	86
PID 4368 wrote to memory of 1128	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	86
PID 4368 wrote to memory of 3056	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	87
PID 4368 wrote to memory of 3056	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	87
PID 4368 wrote to memory of 1640	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	88
PID 4368 wrote to memory of 1640	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	88
PID 4368 wrote to memory of 2832	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	89
PID 4368 wrote to memory of 2832	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	89
PID 4368 wrote to memory of 1400	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	90
PID 4368 wrote to memory of 1400	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	90
PID 4368 wrote to memory of 4108	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	91
PID 4368 wrote to memory of 4108	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	91
PID 4368 wrote to memory of 436	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	92
PID 4368 wrote to memory of 436	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	92
PID 4368 wrote to memory of 2120	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	93
PID 4368 wrote to memory of 2120	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	93
PID 4368 wrote to memory of 1716	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	94
PID 4368 wrote to memory of 1716	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	94
PID 4368 wrote to memory of 2724	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	95
PID 4368 wrote to memory of 2724	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	95
PID 4368 wrote to memory of 3668	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	96
PID 4368 wrote to memory of 3668	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	96
PID 4368 wrote to memory of 3116	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	97
PID 4368 wrote to memory of 3116	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	97
PID 4368 wrote to memory of 4848	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	98
PID 4368 wrote to memory of 4848	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	98
PID 4368 wrote to memory of 3428	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	99
PID 4368 wrote to memory of 3428	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	99
PID 4368 wrote to memory of 3752	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	100
PID 4368 wrote to memory of 3752	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	100
PID 4368 wrote to memory of 4572	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	101
PID 4368 wrote to memory of 4572	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	101
PID 4368 wrote to memory of 1964	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	102
PID 4368 wrote to memory of 1964	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	102
PID 4368 wrote to memory of 3604	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	103
PID 4368 wrote to memory of 3604	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	103
PID 4368 wrote to memory of 676	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	104
PID 4368 wrote to memory of 676	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	104
PID 4368 wrote to memory of 1004	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	105
PID 4368 wrote to memory of 1004	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	105
PID 4368 wrote to memory of 2912	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	106
PID 4368 wrote to memory of 2912	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	106
PID 4368 wrote to memory of 2204	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	107
PID 4368 wrote to memory of 2204	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	107
PID 4368 wrote to memory of 3360	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	108
PID 4368 wrote to memory of 3360	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	108
PID 4368 wrote to memory of 4780	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	109
PID 4368 wrote to memory of 4780	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	109
PID 4368 wrote to memory of 1864	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	110
PID 4368 wrote to memory of 1864	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	110
PID 4368 wrote to memory of 2052	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	111
PID 4368 wrote to memory of 2052	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	111
PID 4368 wrote to memory of 2284	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	112
PID 4368 wrote to memory of 2284	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	112
PID 4368 wrote to memory of 4180	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	113
PID 4368 wrote to memory of 4180	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	113
PID 4368 wrote to memory of 5020	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	114
PID 4368 wrote to memory of 5020	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	114
PID 4368 wrote to memory of 2708	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	115
PID 4368 wrote to memory of 2708	4368	491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\491a3d26f10c5922f8473cc14091be80_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\System\kTmnqWO.exe
  C:\Windows\System\kTmnqWO.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\EMJODVx.exe
  C:\Windows\System\EMJODVx.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\dnSHctq.exe
  C:\Windows\System\dnSHctq.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\JypXhVF.exe
  C:\Windows\System\JypXhVF.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\nwzTzVm.exe
  C:\Windows\System\nwzTzVm.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\KXFlBqk.exe
  C:\Windows\System\KXFlBqk.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\oVIoDGP.exe
  C:\Windows\System\oVIoDGP.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\EwOSdDD.exe
  C:\Windows\System\EwOSdDD.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\gfrkASm.exe
  C:\Windows\System\gfrkASm.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\RtdvBlK.exe
  C:\Windows\System\RtdvBlK.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\iQjmzez.exe
  C:\Windows\System\iQjmzez.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\zrMDVRJ.exe
  C:\Windows\System\zrMDVRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\EdAGkwz.exe
  C:\Windows\System\EdAGkwz.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\XBobzbu.exe
  C:\Windows\System\XBobzbu.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\kmKvSuQ.exe
  C:\Windows\System\kmKvSuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\tWtTjCN.exe
  C:\Windows\System\tWtTjCN.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\QlXKkFf.exe
  C:\Windows\System\QlXKkFf.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\FccGqJo.exe
  C:\Windows\System\FccGqJo.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\FXMXoJP.exe
  C:\Windows\System\FXMXoJP.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\fzdyQHJ.exe
  C:\Windows\System\fzdyQHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\zxjfjAG.exe
  C:\Windows\System\zxjfjAG.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\ATKuUpG.exe
  C:\Windows\System\ATKuUpG.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\JQymKrP.exe
  C:\Windows\System\JQymKrP.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\rGhYTcx.exe
  C:\Windows\System\rGhYTcx.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\MVhPnSt.exe
  C:\Windows\System\MVhPnSt.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\TfBcDlX.exe
  C:\Windows\System\TfBcDlX.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\qptNyEq.exe
  C:\Windows\System\qptNyEq.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\ZaEEnsd.exe
  C:\Windows\System\ZaEEnsd.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\hOsoEsq.exe
  C:\Windows\System\hOsoEsq.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\KhNasnr.exe
  C:\Windows\System\KhNasnr.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\uWcFzVP.exe
  C:\Windows\System\uWcFzVP.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\oNBsFJe.exe
  C:\Windows\System\oNBsFJe.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\EyTnVjZ.exe
  C:\Windows\System\EyTnVjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\cQACKTm.exe
  C:\Windows\System\cQACKTm.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\IxAHfSc.exe
  C:\Windows\System\IxAHfSc.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\aELmxGk.exe
  C:\Windows\System\aELmxGk.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\HHBwRnj.exe
  C:\Windows\System\HHBwRnj.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\EXVhoWp.exe
  C:\Windows\System\EXVhoWp.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\diFiDLw.exe
  C:\Windows\System\diFiDLw.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\yOuGsjI.exe
  C:\Windows\System\yOuGsjI.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\vbjsJjA.exe
  C:\Windows\System\vbjsJjA.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\DaWawNn.exe
  C:\Windows\System\DaWawNn.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ecrRbyD.exe
  C:\Windows\System\ecrRbyD.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\YtCdTUt.exe
  C:\Windows\System\YtCdTUt.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\xylbSyo.exe
  C:\Windows\System\xylbSyo.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\cAXEXgR.exe
  C:\Windows\System\cAXEXgR.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\OmYHCFK.exe
  C:\Windows\System\OmYHCFK.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\XHEcQvZ.exe
  C:\Windows\System\XHEcQvZ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\HfSeOjC.exe
  C:\Windows\System\HfSeOjC.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\MJnmnZz.exe
  C:\Windows\System\MJnmnZz.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\TyLtFNL.exe
  C:\Windows\System\TyLtFNL.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\AkXiLto.exe
  C:\Windows\System\AkXiLto.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\VuoOXpk.exe
  C:\Windows\System\VuoOXpk.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ycNLaFK.exe
  C:\Windows\System\ycNLaFK.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\iGqDhOw.exe
  C:\Windows\System\iGqDhOw.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\IsSRYHX.exe
  C:\Windows\System\IsSRYHX.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\mYGrFoQ.exe
  C:\Windows\System\mYGrFoQ.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\GcBYbTj.exe
  C:\Windows\System\GcBYbTj.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\HGjxKLG.exe
  C:\Windows\System\HGjxKLG.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\ISWvWso.exe
  C:\Windows\System\ISWvWso.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\UbBFYME.exe
  C:\Windows\System\UbBFYME.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\LIoDTTm.exe
  C:\Windows\System\LIoDTTm.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\kZFdtZx.exe
  C:\Windows\System\kZFdtZx.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\nkUTHWS.exe
  C:\Windows\System\nkUTHWS.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\bmtdnmw.exe
  C:\Windows\System\bmtdnmw.exe
  2⤵
  PID:4388
- C:\Windows\System\cdHQCuH.exe
  C:\Windows\System\cdHQCuH.exe
  2⤵
  PID:1240
- C:\Windows\System\sgjBbAy.exe
  C:\Windows\System\sgjBbAy.exe
  2⤵
  PID:4296
- C:\Windows\System\rDASboT.exe
  C:\Windows\System\rDASboT.exe
  2⤵
  PID:2596
- C:\Windows\System\ceWWPNC.exe
  C:\Windows\System\ceWWPNC.exe
  2⤵
  PID:4168
- C:\Windows\System\znzwSjO.exe
  C:\Windows\System\znzwSjO.exe
  2⤵
  PID:1528
- C:\Windows\System\tbCRpEg.exe
  C:\Windows\System\tbCRpEg.exe
  2⤵
  PID:2332
- C:\Windows\System\xTibZrR.exe
  C:\Windows\System\xTibZrR.exe
  2⤵
  PID:1940
- C:\Windows\System\ASTjcfz.exe
  C:\Windows\System\ASTjcfz.exe
  2⤵
  PID:1740
- C:\Windows\System\JEiZSvI.exe
  C:\Windows\System\JEiZSvI.exe
  2⤵
  PID:5004
- C:\Windows\System\YQOifjB.exe
  C:\Windows\System\YQOifjB.exe
  2⤵
  PID:1140
- C:\Windows\System\ciVousV.exe
  C:\Windows\System\ciVousV.exe
  2⤵
  PID:4060
- C:\Windows\System\sNXKtdI.exe
  C:\Windows\System\sNXKtdI.exe
  2⤵
  PID:3764
- C:\Windows\System\KkWdfUm.exe
  C:\Windows\System\KkWdfUm.exe
  2⤵
  PID:2244
- C:\Windows\System\LxDmNAC.exe
  C:\Windows\System\LxDmNAC.exe
  2⤵
  PID:4216
- C:\Windows\System\jWdAjmx.exe
  C:\Windows\System\jWdAjmx.exe
  2⤵
  PID:3700
- C:\Windows\System\FmxPYjP.exe
  C:\Windows\System\FmxPYjP.exe
  2⤵
  PID:5132
- C:\Windows\System\EIdDXhH.exe
  C:\Windows\System\EIdDXhH.exe
  2⤵
  PID:5152
- C:\Windows\System\ixJfytM.exe
  C:\Windows\System\ixJfytM.exe
  2⤵
  PID:5172
- C:\Windows\System\TYSafCy.exe
  C:\Windows\System\TYSafCy.exe
  2⤵
  PID:5200
- C:\Windows\System\vYSwYaJ.exe
  C:\Windows\System\vYSwYaJ.exe
  2⤵
  PID:5220
- C:\Windows\System\JRroEIR.exe
  C:\Windows\System\JRroEIR.exe
  2⤵
  PID:5240
- C:\Windows\System\ktEffYj.exe
  C:\Windows\System\ktEffYj.exe
  2⤵
  PID:5260
- C:\Windows\System\zbngFzk.exe
  C:\Windows\System\zbngFzk.exe
  2⤵
  PID:5276
- C:\Windows\System\ubFhwyU.exe
  C:\Windows\System\ubFhwyU.exe
  2⤵
  PID:5300
- C:\Windows\System\PZJSPuG.exe
  C:\Windows\System\PZJSPuG.exe
  2⤵
  PID:5324
- C:\Windows\System\wYrtBUG.exe
  C:\Windows\System\wYrtBUG.exe
  2⤵
  PID:5344
- C:\Windows\System\XnsFhyc.exe
  C:\Windows\System\XnsFhyc.exe
  2⤵
  PID:5364
- C:\Windows\System\nwZPzfD.exe
  C:\Windows\System\nwZPzfD.exe
  2⤵
  PID:5384
- C:\Windows\System\LmIUYEl.exe
  C:\Windows\System\LmIUYEl.exe
  2⤵
  PID:5408
- C:\Windows\System\CcAjBCv.exe
  C:\Windows\System\CcAjBCv.exe
  2⤵
  PID:5424
- C:\Windows\System\EOKXSHB.exe
  C:\Windows\System\EOKXSHB.exe
  2⤵
  PID:5444
- C:\Windows\System\vudKLFk.exe
  C:\Windows\System\vudKLFk.exe
  2⤵
  PID:5464
- C:\Windows\System\psLkarn.exe
  C:\Windows\System\psLkarn.exe
  2⤵
  PID:5480
- C:\Windows\System\rtranEC.exe
  C:\Windows\System\rtranEC.exe
  2⤵
  PID:5504
- C:\Windows\System\PrfBPIL.exe
  C:\Windows\System\PrfBPIL.exe
  2⤵
  PID:5520
- C:\Windows\System\PNOGUwf.exe
  C:\Windows\System\PNOGUwf.exe
  2⤵
  PID:5544
- C:\Windows\System\EpfsHVY.exe
  C:\Windows\System\EpfsHVY.exe
  2⤵
  PID:5568
- C:\Windows\System\UkdNDeI.exe
  C:\Windows\System\UkdNDeI.exe
  2⤵
  PID:5588
- C:\Windows\System\EvcIevI.exe
  C:\Windows\System\EvcIevI.exe
  2⤵
  PID:5604
- C:\Windows\System\hyRdHRj.exe
  C:\Windows\System\hyRdHRj.exe
  2⤵
  PID:5640
- C:\Windows\System\NJzDpIh.exe
  C:\Windows\System\NJzDpIh.exe
  2⤵
  PID:5664
- C:\Windows\System\HIxwXcC.exe
  C:\Windows\System\HIxwXcC.exe
  2⤵
  PID:5680
- C:\Windows\System\iuEoOnE.exe
  C:\Windows\System\iuEoOnE.exe
  2⤵
  PID:5696
- C:\Windows\System\BhicAyI.exe
  C:\Windows\System\BhicAyI.exe
  2⤵
  PID:5712
- C:\Windows\System\tCMlyKE.exe
  C:\Windows\System\tCMlyKE.exe
  2⤵
  PID:5732
- C:\Windows\System\CzJKJKx.exe
  C:\Windows\System\CzJKJKx.exe
  2⤵
  PID:5752
- C:\Windows\System\bTEMwMJ.exe
  C:\Windows\System\bTEMwMJ.exe
  2⤵
  PID:5776
- C:\Windows\System\bpnsHfu.exe
  C:\Windows\System\bpnsHfu.exe
  2⤵
  PID:5804
- C:\Windows\System\crUMFsE.exe
  C:\Windows\System\crUMFsE.exe
  2⤵
  PID:5828
- C:\Windows\System\QmVthkK.exe
  C:\Windows\System\QmVthkK.exe
  2⤵
  PID:5852
- C:\Windows\System\PusFjev.exe
  C:\Windows\System\PusFjev.exe
  2⤵
  PID:5876
- C:\Windows\System\HtWyClC.exe
  C:\Windows\System\HtWyClC.exe
  2⤵
  PID:5900
- C:\Windows\System\aUWpDeq.exe
  C:\Windows\System\aUWpDeq.exe
  2⤵
  PID:5916
- C:\Windows\System\vChqRwX.exe
  C:\Windows\System\vChqRwX.exe
  2⤵
  PID:5936
- C:\Windows\System\RXpWghA.exe
  C:\Windows\System\RXpWghA.exe
  2⤵
  PID:5964
- C:\Windows\System\ppAgoBi.exe
  C:\Windows\System\ppAgoBi.exe
  2⤵
  PID:5980
- C:\Windows\System\hrEaeqb.exe
  C:\Windows\System\hrEaeqb.exe
  2⤵
  PID:6000
- C:\Windows\System\wJQkpUV.exe
  C:\Windows\System\wJQkpUV.exe
  2⤵
  PID:6024
- C:\Windows\System\AShuaSd.exe
  C:\Windows\System\AShuaSd.exe
  2⤵
  PID:6044
- C:\Windows\System\HMbhsDo.exe
  C:\Windows\System\HMbhsDo.exe
  2⤵
  PID:6060
- C:\Windows\System\KZgbqAz.exe
  C:\Windows\System\KZgbqAz.exe
  2⤵
  PID:6080
- C:\Windows\System\APdnfrZ.exe
  C:\Windows\System\APdnfrZ.exe
  2⤵
  PID:6100
- C:\Windows\System\WRgxAJt.exe
  C:\Windows\System\WRgxAJt.exe
  2⤵
  PID:6116
- C:\Windows\System\OkwAJaQ.exe
  C:\Windows\System\OkwAJaQ.exe
  2⤵
  PID:6132
- C:\Windows\System\lMozvqq.exe
  C:\Windows\System\lMozvqq.exe
  2⤵
  PID:2236
- C:\Windows\System\purNACd.exe
  C:\Windows\System\purNACd.exe
  2⤵
  PID:404
- C:\Windows\System\HfgpyEn.exe
  C:\Windows\System\HfgpyEn.exe
  2⤵
  PID:1424
- C:\Windows\System\LVCTJEl.exe
  C:\Windows\System\LVCTJEl.exe
  2⤵
  PID:3180
- C:\Windows\System\GDejZQa.exe
  C:\Windows\System\GDejZQa.exe
  2⤵
  PID:3384
- C:\Windows\System\CUEWPPE.exe
  C:\Windows\System\CUEWPPE.exe
  2⤵
  PID:3776
- C:\Windows\System\jiQeBqY.exe
  C:\Windows\System\jiQeBqY.exe
  2⤵
  PID:4500
- C:\Windows\System\rDnpmdx.exe
  C:\Windows\System\rDnpmdx.exe
  2⤵
  PID:1984
- C:\Windows\System\VVBlaLX.exe
  C:\Windows\System\VVBlaLX.exe
  2⤵
  PID:1144
- C:\Windows\System\PlEwXSg.exe
  C:\Windows\System\PlEwXSg.exe
  2⤵
  PID:2364
- C:\Windows\System\UbpEkXD.exe
  C:\Windows\System\UbpEkXD.exe
  2⤵
  PID:5232
- C:\Windows\System\wStUQNm.exe
  C:\Windows\System\wStUQNm.exe
  2⤵
  PID:5292
- C:\Windows\System\RmQrUaD.exe
  C:\Windows\System\RmQrUaD.exe
  2⤵
  PID:5356
- C:\Windows\System\WYoNxnm.exe
  C:\Windows\System\WYoNxnm.exe
  2⤵
  PID:2928
- C:\Windows\System\evoPvRU.exe
  C:\Windows\System\evoPvRU.exe
  2⤵
  PID:4860
- C:\Windows\System\ASeIGpp.exe
  C:\Windows\System\ASeIGpp.exe
  2⤵
  PID:1536
- C:\Windows\System\gxPNGwq.exe
  C:\Windows\System\gxPNGwq.exe
  2⤵
  PID:3064
- C:\Windows\System\TGMQfrO.exe
  C:\Windows\System\TGMQfrO.exe
  2⤵
  PID:2424
- C:\Windows\System\SvqBAWW.exe
  C:\Windows\System\SvqBAWW.exe
  2⤵
  PID:6160
- C:\Windows\System\DEbEfiL.exe
  C:\Windows\System\DEbEfiL.exe
  2⤵
  PID:6180
- C:\Windows\System\RWdWfLa.exe
  C:\Windows\System\RWdWfLa.exe
  2⤵
  PID:6204
- C:\Windows\System\uxiIOCU.exe
  C:\Windows\System\uxiIOCU.exe
  2⤵
  PID:6232
- C:\Windows\System\pwHWLxa.exe
  C:\Windows\System\pwHWLxa.exe
  2⤵
  PID:6248
- C:\Windows\System\HrFHWXF.exe
  C:\Windows\System\HrFHWXF.exe
  2⤵
  PID:6280
- C:\Windows\System\ghbyOSm.exe
  C:\Windows\System\ghbyOSm.exe
  2⤵
  PID:6300
- C:\Windows\System\khHHHPh.exe
  C:\Windows\System\khHHHPh.exe
  2⤵
  PID:6320
- C:\Windows\System\pHgtDMh.exe
  C:\Windows\System\pHgtDMh.exe
  2⤵
  PID:6336
- C:\Windows\System\XbUwcep.exe
  C:\Windows\System\XbUwcep.exe
  2⤵
  PID:6360
- C:\Windows\System\QLeOKFN.exe
  C:\Windows\System\QLeOKFN.exe
  2⤵
  PID:6412
- C:\Windows\System\dQEVgPU.exe
  C:\Windows\System\dQEVgPU.exe
  2⤵
  PID:6436
- C:\Windows\System\VgBgKPM.exe
  C:\Windows\System\VgBgKPM.exe
  2⤵
  PID:6452
- C:\Windows\System\xWUzxUR.exe
  C:\Windows\System\xWUzxUR.exe
  2⤵
  PID:6476
- C:\Windows\System\jsNoRfo.exe
  C:\Windows\System\jsNoRfo.exe
  2⤵
  PID:6492
- C:\Windows\System\ssvuGNf.exe
  C:\Windows\System\ssvuGNf.exe
  2⤵
  PID:6512
- C:\Windows\System\nEvzXKw.exe
  C:\Windows\System\nEvzXKw.exe
  2⤵
  PID:6532
- C:\Windows\System\AMeJSgm.exe
  C:\Windows\System\AMeJSgm.exe
  2⤵
  PID:6552
- C:\Windows\System\nBeriwR.exe
  C:\Windows\System\nBeriwR.exe
  2⤵
  PID:6572
- C:\Windows\System\asZwQtn.exe
  C:\Windows\System\asZwQtn.exe
  2⤵
  PID:6600
- C:\Windows\System\TwvUTNB.exe
  C:\Windows\System\TwvUTNB.exe
  2⤵
  PID:6616
- C:\Windows\System\VGrBAXZ.exe
  C:\Windows\System\VGrBAXZ.exe
  2⤵
  PID:6640
- C:\Windows\System\UGhiVRA.exe
  C:\Windows\System\UGhiVRA.exe
  2⤵
  PID:6656
- C:\Windows\System\NGOgipp.exe
  C:\Windows\System\NGOgipp.exe
  2⤵
  PID:6672
- C:\Windows\System\YrvmbOt.exe
  C:\Windows\System\YrvmbOt.exe
  2⤵
  PID:6696
- C:\Windows\System\OMwGpdE.exe
  C:\Windows\System\OMwGpdE.exe
  2⤵
  PID:6724
- C:\Windows\System\FvkVRsU.exe
  C:\Windows\System\FvkVRsU.exe
  2⤵
  PID:6748
- C:\Windows\System\UjfIJDW.exe
  C:\Windows\System\UjfIJDW.exe
  2⤵
  PID:6772
- C:\Windows\System\JUNhXIw.exe
  C:\Windows\System\JUNhXIw.exe
  2⤵
  PID:6788
- C:\Windows\System\XqhIBvh.exe
  C:\Windows\System\XqhIBvh.exe
  2⤵
  PID:6808
- C:\Windows\System\JVAnarh.exe
  C:\Windows\System\JVAnarh.exe
  2⤵
  PID:6832
- C:\Windows\System\faBnwae.exe
  C:\Windows\System\faBnwae.exe
  2⤵
  PID:6852
- C:\Windows\System\OvxZkZA.exe
  C:\Windows\System\OvxZkZA.exe
  2⤵
  PID:6872
- C:\Windows\System\PlaoNXx.exe
  C:\Windows\System\PlaoNXx.exe
  2⤵
  PID:6896
- C:\Windows\System\eSDTCzp.exe
  C:\Windows\System\eSDTCzp.exe
  2⤵
  PID:6916
- C:\Windows\System\rdZVvjY.exe
  C:\Windows\System\rdZVvjY.exe
  2⤵
  PID:6936
- C:\Windows\System\bSGBWKU.exe
  C:\Windows\System\bSGBWKU.exe
  2⤵
  PID:6960
- C:\Windows\System\fIXMYiD.exe
  C:\Windows\System\fIXMYiD.exe
  2⤵
  PID:6980
- C:\Windows\System\IOxBVDf.exe
  C:\Windows\System\IOxBVDf.exe
  2⤵
  PID:7008
- C:\Windows\System\yyEtfpR.exe
  C:\Windows\System\yyEtfpR.exe
  2⤵
  PID:7024
- C:\Windows\System\TFvIPUN.exe
  C:\Windows\System\TFvIPUN.exe
  2⤵
  PID:7044
- C:\Windows\System\TKAnXMk.exe
  C:\Windows\System\TKAnXMk.exe
  2⤵
  PID:7064
- C:\Windows\System\sstHiqe.exe
  C:\Windows\System\sstHiqe.exe
  2⤵
  PID:7080
- C:\Windows\System\HRZwTHw.exe
  C:\Windows\System\HRZwTHw.exe
  2⤵
  PID:7104
- C:\Windows\System\mbChUGQ.exe
  C:\Windows\System\mbChUGQ.exe
  2⤵
  PID:7120
- C:\Windows\System\MgLJEPG.exe
  C:\Windows\System\MgLJEPG.exe
  2⤵
  PID:7144
- C:\Windows\System\nmPgQZR.exe
  C:\Windows\System\nmPgQZR.exe
  2⤵
  PID:7160
- C:\Windows\System\asZyNih.exe
  C:\Windows\System\asZyNih.exe
  2⤵
  PID:4460
- C:\Windows\System\beUETkS.exe
  C:\Windows\System\beUETkS.exe
  2⤵
  PID:4416
- C:\Windows\System\XQVhHCl.exe
  C:\Windows\System\XQVhHCl.exe
  2⤵
  PID:772
- C:\Windows\System\pwoZxSo.exe
  C:\Windows\System\pwoZxSo.exe
  2⤵
  PID:5820
- C:\Windows\System\pcCeHfp.exe
  C:\Windows\System\pcCeHfp.exe
  2⤵
  PID:2324
- C:\Windows\System\imgWbUX.exe
  C:\Windows\System\imgWbUX.exe
  2⤵
  PID:5888
- C:\Windows\System\dznHYru.exe
  C:\Windows\System\dznHYru.exe
  2⤵
  PID:5932
- C:\Windows\System\LhCWaCe.exe
  C:\Windows\System\LhCWaCe.exe
  2⤵
  PID:2044
- C:\Windows\System\wyAvCEL.exe
  C:\Windows\System\wyAvCEL.exe
  2⤵
  PID:5392
- C:\Windows\System\HORVTar.exe
  C:\Windows\System\HORVTar.exe
  2⤵
  PID:1268
- C:\Windows\System\mAlzHjo.exe
  C:\Windows\System\mAlzHjo.exe
  2⤵
  PID:1880
- C:\Windows\System\vOfFyxL.exe
  C:\Windows\System\vOfFyxL.exe
  2⤵
  PID:3568
- C:\Windows\System\gBdMWOk.exe
  C:\Windows\System\gBdMWOk.exe
  2⤵
  PID:1872
- C:\Windows\System\egEPSuc.exe
  C:\Windows\System\egEPSuc.exe
  2⤵
  PID:5512
- C:\Windows\System\HQIZMIw.exe
  C:\Windows\System\HQIZMIw.exe
  2⤵
  PID:4980
- C:\Windows\System\aWTGppF.exe
  C:\Windows\System\aWTGppF.exe
  2⤵
  PID:5600
- C:\Windows\System\GRJCggL.exe
  C:\Windows\System\GRJCggL.exe
  2⤵
  PID:4600
- C:\Windows\System\MRrZdTk.exe
  C:\Windows\System\MRrZdTk.exe
  2⤵
  PID:5148
- C:\Windows\System\thqAZyG.exe
  C:\Windows\System\thqAZyG.exe
  2⤵
  PID:6380
- C:\Windows\System\ZhKfGzS.exe
  C:\Windows\System\ZhKfGzS.exe
  2⤵
  PID:6408
- C:\Windows\System\obcwWVV.exe
  C:\Windows\System\obcwWVV.exe
  2⤵
  PID:5948
- C:\Windows\System\reFerht.exe
  C:\Windows\System\reFerht.exe
  2⤵
  PID:6504
- C:\Windows\System\nuJFIlw.exe
  C:\Windows\System\nuJFIlw.exe
  2⤵
  PID:6548
- C:\Windows\System\OsmEEZu.exe
  C:\Windows\System\OsmEEZu.exe
  2⤵
  PID:6016
- C:\Windows\System\ENerNFV.exe
  C:\Windows\System\ENerNFV.exe
  2⤵
  PID:5336
- C:\Windows\System\uNRhPnc.exe
  C:\Windows\System\uNRhPnc.exe
  2⤵
  PID:7176
- C:\Windows\System\QrGbBXL.exe
  C:\Windows\System\QrGbBXL.exe
  2⤵
  PID:7192
- C:\Windows\System\fKxwwnL.exe
  C:\Windows\System\fKxwwnL.exe
  2⤵
  PID:7216
- C:\Windows\System\wDgeYUg.exe
  C:\Windows\System\wDgeYUg.exe
  2⤵
  PID:7232
- C:\Windows\System\YGGHCmv.exe
  C:\Windows\System\YGGHCmv.exe
  2⤵
  PID:7256
- C:\Windows\System\fAzFpvQ.exe
  C:\Windows\System\fAzFpvQ.exe
  2⤵
  PID:7272
- C:\Windows\System\FuZOstF.exe
  C:\Windows\System\FuZOstF.exe
  2⤵
  PID:7292
- C:\Windows\System\GxOIwRJ.exe
  C:\Windows\System\GxOIwRJ.exe
  2⤵
  PID:7308
- C:\Windows\System\KwaOoMQ.exe
  C:\Windows\System\KwaOoMQ.exe
  2⤵
  PID:7336
- C:\Windows\System\eoACTHi.exe
  C:\Windows\System\eoACTHi.exe
  2⤵
  PID:7352
- C:\Windows\System\KgQxugw.exe
  C:\Windows\System\KgQxugw.exe
  2⤵
  PID:7372
- C:\Windows\System\XbpOOln.exe
  C:\Windows\System\XbpOOln.exe
  2⤵
  PID:7388
- C:\Windows\System\CysZbmC.exe
  C:\Windows\System\CysZbmC.exe
  2⤵
  PID:7404
- C:\Windows\System\leqBdSd.exe
  C:\Windows\System\leqBdSd.exe
  2⤵
  PID:7428
- C:\Windows\System\JjJeUSb.exe
  C:\Windows\System\JjJeUSb.exe
  2⤵
  PID:7444
- C:\Windows\System\EEFqpIn.exe
  C:\Windows\System\EEFqpIn.exe
  2⤵
  PID:7464
- C:\Windows\System\pahsdGt.exe
  C:\Windows\System\pahsdGt.exe
  2⤵
  PID:7480
- C:\Windows\System\QEFqGbI.exe
  C:\Windows\System\QEFqGbI.exe
  2⤵
  PID:7508
- C:\Windows\System\xrdsOfv.exe
  C:\Windows\System\xrdsOfv.exe
  2⤵
  PID:7528
- C:\Windows\System\tZczDxR.exe
  C:\Windows\System\tZczDxR.exe
  2⤵
  PID:7548
- C:\Windows\System\TlkseGQ.exe
  C:\Windows\System\TlkseGQ.exe
  2⤵
  PID:7568
- C:\Windows\System\BJDlsoi.exe
  C:\Windows\System\BJDlsoi.exe
  2⤵
  PID:7592
- C:\Windows\System\rBhUmbi.exe
  C:\Windows\System\rBhUmbi.exe
  2⤵
  PID:7612
- C:\Windows\System\qfkSGyy.exe
  C:\Windows\System\qfkSGyy.exe
  2⤵
  PID:7632
- C:\Windows\System\cbJQLwX.exe
  C:\Windows\System\cbJQLwX.exe
  2⤵
  PID:7656
- C:\Windows\System\rKgQXnP.exe
  C:\Windows\System\rKgQXnP.exe
  2⤵
  PID:7676
- C:\Windows\System\lvRIqma.exe
  C:\Windows\System\lvRIqma.exe
  2⤵
  PID:7892
- C:\Windows\System\eLKHNqb.exe
  C:\Windows\System\eLKHNqb.exe
  2⤵
  PID:7908
- C:\Windows\System\KSxasaF.exe
  C:\Windows\System\KSxasaF.exe
  2⤵
  PID:7924
- C:\Windows\System\NOtkKIJ.exe
  C:\Windows\System\NOtkKIJ.exe
  2⤵
  PID:7940
- C:\Windows\System\YrMBTTy.exe
  C:\Windows\System\YrMBTTy.exe
  2⤵
  PID:7956
- C:\Windows\System\prFABbR.exe
  C:\Windows\System\prFABbR.exe
  2⤵
  PID:7972
- C:\Windows\System\SbmSlPz.exe
  C:\Windows\System\SbmSlPz.exe
  2⤵
  PID:7988
- C:\Windows\System\xImTNEw.exe
  C:\Windows\System\xImTNEw.exe
  2⤵
  PID:8004
- C:\Windows\System\JzyunIM.exe
  C:\Windows\System\JzyunIM.exe
  2⤵
  PID:8024
- C:\Windows\System\hhKykrV.exe
  C:\Windows\System\hhKykrV.exe
  2⤵
  PID:8044
- C:\Windows\System\jtiKLiX.exe
  C:\Windows\System\jtiKLiX.exe
  2⤵
  PID:8064
- C:\Windows\System\dTSThoz.exe
  C:\Windows\System\dTSThoz.exe
  2⤵
  PID:8088
- C:\Windows\System\KiMvUvc.exe
  C:\Windows\System\KiMvUvc.exe
  2⤵
  PID:8108
- C:\Windows\System\FLMdhNA.exe
  C:\Windows\System\FLMdhNA.exe
  2⤵
  PID:8128
- C:\Windows\System\SzbuMxa.exe
  C:\Windows\System\SzbuMxa.exe
  2⤵
  PID:8148
- C:\Windows\System\rYOJjGp.exe
  C:\Windows\System\rYOJjGp.exe
  2⤵
  PID:8168
- C:\Windows\System\yhmfmgt.exe
  C:\Windows\System\yhmfmgt.exe
  2⤵
  PID:8188
- C:\Windows\System\kuMarDJ.exe
  C:\Windows\System\kuMarDJ.exe
  2⤵
  PID:6072
- C:\Windows\System\jCLQpsd.exe
  C:\Windows\System\jCLQpsd.exe
  2⤵
  PID:5432
- C:\Windows\System\KCbBsjV.exe
  C:\Windows\System\KCbBsjV.exe
  2⤵
  PID:6760
- C:\Windows\System\aPWdlwE.exe
  C:\Windows\System\aPWdlwE.exe
  2⤵
  PID:6820
- C:\Windows\System\BVGwoIe.exe
  C:\Windows\System\BVGwoIe.exe
  2⤵
  PID:6892
- C:\Windows\System\lpWgIvq.exe
  C:\Windows\System\lpWgIvq.exe
  2⤵
  PID:6948
- C:\Windows\System\FKOElEu.exe
  C:\Windows\System\FKOElEu.exe
  2⤵
  PID:5536
- C:\Windows\System\vVCWmQU.exe
  C:\Windows\System\vVCWmQU.exe
  2⤵
  PID:5764
- C:\Windows\System\dpnGICA.exe
  C:\Windows\System\dpnGICA.exe
  2⤵
  PID:5720
- C:\Windows\System\IBflcmB.exe
  C:\Windows\System\IBflcmB.exe
  2⤵
  PID:2336
- C:\Windows\System\lNSZgUi.exe
  C:\Windows\System\lNSZgUi.exe
  2⤵
  PID:5620
- C:\Windows\System\YLKTvpw.exe
  C:\Windows\System\YLKTvpw.exe
  2⤵
  PID:6328
- C:\Windows\System\GspDPgN.exe
  C:\Windows\System\GspDPgN.exe
  2⤵
  PID:6420
- C:\Windows\System\GuEHEss.exe
  C:\Windows\System\GuEHEss.exe
  2⤵
  PID:6040
- C:\Windows\System\xSATDsN.exe
  C:\Windows\System\xSATDsN.exe
  2⤵
  PID:6108
- C:\Windows\System\vDzMSUE.exe
  C:\Windows\System\vDzMSUE.exe
  2⤵
  PID:6140
- C:\Windows\System\oUWQvBj.exe
  C:\Windows\System\oUWQvBj.exe
  2⤵
  PID:5040
- C:\Windows\System\HURULcU.exe
  C:\Windows\System\HURULcU.exe
  2⤵
  PID:5024
- C:\Windows\System\SrKTFIC.exe
  C:\Windows\System\SrKTFIC.exe
  2⤵
  PID:6152
- C:\Windows\System\BZcQuux.exe
  C:\Windows\System\BZcQuux.exe
  2⤵
  PID:6212
- C:\Windows\System\KjqMCZt.exe
  C:\Windows\System\KjqMCZt.exe
  2⤵
  PID:6268
- C:\Windows\System\amyFziB.exe
  C:\Windows\System\amyFziB.exe
  2⤵
  PID:6316
- C:\Windows\System\ezBfsyt.exe
  C:\Windows\System\ezBfsyt.exe
  2⤵
  PID:6460
- C:\Windows\System\WnMVwBv.exe
  C:\Windows\System\WnMVwBv.exe
  2⤵
  PID:6584
- C:\Windows\System\CoBLeSm.exe
  C:\Windows\System\CoBLeSm.exe
  2⤵
  PID:6712
- C:\Windows\System\DBhLZju.exe
  C:\Windows\System\DBhLZju.exe
  2⤵
  PID:6800
- C:\Windows\System\ocmSeip.exe
  C:\Windows\System\ocmSeip.exe
  2⤵
  PID:6912
- C:\Windows\System\NXXxdeq.exe
  C:\Windows\System\NXXxdeq.exe
  2⤵
  PID:7032
- C:\Windows\System\ZyTgynH.exe
  C:\Windows\System\ZyTgynH.exe
  2⤵
  PID:1136
- C:\Windows\System\puGPaYV.exe
  C:\Windows\System\puGPaYV.exe
  2⤵
  PID:6444
- C:\Windows\System\yoQhMlC.exe
  C:\Windows\System\yoQhMlC.exe
  2⤵
  PID:7452
- C:\Windows\System\nWPfIVV.exe
  C:\Windows\System\nWPfIVV.exe
  2⤵
  PID:7624
- C:\Windows\System\MctfCSu.exe
  C:\Windows\System\MctfCSu.exe
  2⤵
  PID:4028
- C:\Windows\System\zJcEqdu.exe
  C:\Windows\System\zJcEqdu.exe
  2⤵
  PID:4700
- C:\Windows\System\ckQczRT.exe
  C:\Windows\System\ckQczRT.exe
  2⤵
  PID:5912
- C:\Windows\System\agMMDku.exe
  C:\Windows\System\agMMDku.exe
  2⤵
  PID:5192
- C:\Windows\System\IqumaOD.exe
  C:\Windows\System\IqumaOD.exe
  2⤵
  PID:6564
- C:\Windows\System\xLcVkbr.exe
  C:\Windows\System\xLcVkbr.exe
  2⤵
  PID:7228
- C:\Windows\System\blUoxLQ.exe
  C:\Windows\System\blUoxLQ.exe
  2⤵
  PID:8208
- C:\Windows\System\vNOvcvn.exe
  C:\Windows\System\vNOvcvn.exe
  2⤵
  PID:8232
- C:\Windows\System\KWGxWXe.exe
  C:\Windows\System\KWGxWXe.exe
  2⤵
  PID:8256
- C:\Windows\System\LXCBvfR.exe
  C:\Windows\System\LXCBvfR.exe
  2⤵
  PID:8272
- C:\Windows\System\GfRZEiN.exe
  C:\Windows\System\GfRZEiN.exe
  2⤵
  PID:8288
- C:\Windows\System\edlPqjr.exe
  C:\Windows\System\edlPqjr.exe
  2⤵
  PID:8304
- C:\Windows\System\qIgXTNJ.exe
  C:\Windows\System\qIgXTNJ.exe
  2⤵
  PID:8324
- C:\Windows\System\xdWryfA.exe
  C:\Windows\System\xdWryfA.exe
  2⤵
  PID:8344
- C:\Windows\System\VjxBYLe.exe
  C:\Windows\System\VjxBYLe.exe
  2⤵
  PID:8364
- C:\Windows\System\zWKZTFA.exe
  C:\Windows\System\zWKZTFA.exe
  2⤵
  PID:8384
- C:\Windows\System\gzqQJWc.exe
  C:\Windows\System\gzqQJWc.exe
  2⤵
  PID:8400
- C:\Windows\System\eLKMWom.exe
  C:\Windows\System\eLKMWom.exe
  2⤵
  PID:8424
- C:\Windows\System\RPrbojS.exe
  C:\Windows\System\RPrbojS.exe
  2⤵
  PID:8448
- C:\Windows\System\CLBnkSu.exe
  C:\Windows\System\CLBnkSu.exe
  2⤵
  PID:8464
- C:\Windows\System\SllcpJl.exe
  C:\Windows\System\SllcpJl.exe
  2⤵
  PID:8488
- C:\Windows\System\IDYXpXb.exe
  C:\Windows\System\IDYXpXb.exe
  2⤵
  PID:8508
- C:\Windows\System\fquUuPk.exe
  C:\Windows\System\fquUuPk.exe
  2⤵
  PID:8528
- C:\Windows\System\hXKZuSj.exe
  C:\Windows\System\hXKZuSj.exe
  2⤵
  PID:8556
- C:\Windows\System\iUGqmfH.exe
  C:\Windows\System\iUGqmfH.exe
  2⤵
  PID:8572
- C:\Windows\System\lMotKFm.exe
  C:\Windows\System\lMotKFm.exe
  2⤵
  PID:8592
- C:\Windows\System\OpJIaOd.exe
  C:\Windows\System\OpJIaOd.exe
  2⤵
  PID:8616
- C:\Windows\System\zCXjTDY.exe
  C:\Windows\System\zCXjTDY.exe
  2⤵
  PID:8632
- C:\Windows\System\YrmmAfI.exe
  C:\Windows\System\YrmmAfI.exe
  2⤵
  PID:8648
- C:\Windows\System\kfbrbHJ.exe
  C:\Windows\System\kfbrbHJ.exe
  2⤵
  PID:8668
- C:\Windows\System\pklCzVF.exe
  C:\Windows\System\pklCzVF.exe
  2⤵
  PID:8692
- C:\Windows\System\XAJNYfD.exe
  C:\Windows\System\XAJNYfD.exe
  2⤵
  PID:8708
- C:\Windows\System\CiDOVMj.exe
  C:\Windows\System\CiDOVMj.exe
  2⤵
  PID:8728
- C:\Windows\System\EPIYubk.exe
  C:\Windows\System\EPIYubk.exe
  2⤵
  PID:8748
- C:\Windows\System\DTsGZeW.exe
  C:\Windows\System\DTsGZeW.exe
  2⤵
  PID:8768
- C:\Windows\System\JQIxSMH.exe
  C:\Windows\System\JQIxSMH.exe
  2⤵
  PID:8788
- C:\Windows\System\AIOKFwx.exe
  C:\Windows\System\AIOKFwx.exe
  2⤵
  PID:8812
- C:\Windows\System\XizoVYT.exe
  C:\Windows\System\XizoVYT.exe
  2⤵
  PID:8832
- C:\Windows\System\FJCfivs.exe
  C:\Windows\System\FJCfivs.exe
  2⤵
  PID:8864
- C:\Windows\System\LzxXaUU.exe
  C:\Windows\System\LzxXaUU.exe
  2⤵
  PID:8884
- C:\Windows\System\JLQTnLf.exe
  C:\Windows\System\JLQTnLf.exe
  2⤵
  PID:8900
- C:\Windows\System\isfMRsV.exe
  C:\Windows\System\isfMRsV.exe
  2⤵
  PID:8924
- C:\Windows\System\iMZhVEi.exe
  C:\Windows\System\iMZhVEi.exe
  2⤵
  PID:8948
- C:\Windows\System\wOGXrcb.exe
  C:\Windows\System\wOGXrcb.exe
  2⤵
  PID:8964
- C:\Windows\System\rHOQKeH.exe
  C:\Windows\System\rHOQKeH.exe
  2⤵
  PID:8992
- C:\Windows\System\DSNKAdm.exe
  C:\Windows\System\DSNKAdm.exe
  2⤵
  PID:9012
- C:\Windows\System\JrDvjUY.exe
  C:\Windows\System\JrDvjUY.exe
  2⤵
  PID:9036
- C:\Windows\System\dcxpXVH.exe
  C:\Windows\System\dcxpXVH.exe
  2⤵
  PID:9052
- C:\Windows\System\ULFjtNn.exe
  C:\Windows\System\ULFjtNn.exe
  2⤵
  PID:9076
- C:\Windows\System\QLjeJZb.exe
  C:\Windows\System\QLjeJZb.exe
  2⤵
  PID:9100
- C:\Windows\System\crCkGXZ.exe
  C:\Windows\System\crCkGXZ.exe
  2⤵
  PID:9116
- C:\Windows\System\BSVtaaZ.exe
  C:\Windows\System\BSVtaaZ.exe
  2⤵
  PID:9140
- C:\Windows\System\xJNzKIh.exe
  C:\Windows\System\xJNzKIh.exe
  2⤵
  PID:9164
- C:\Windows\System\mZGUNGA.exe
  C:\Windows\System\mZGUNGA.exe
  2⤵
  PID:9180
- C:\Windows\System\VkShXgc.exe
  C:\Windows\System\VkShXgc.exe
  2⤵
  PID:9204
- C:\Windows\System\ETWSJsC.exe
  C:\Windows\System\ETWSJsC.exe
  2⤵
  PID:7384
- C:\Windows\System\rgtIMNi.exe
  C:\Windows\System\rgtIMNi.exe
  2⤵
  PID:9296
- C:\Windows\System\owmdWAV.exe
  C:\Windows\System\owmdWAV.exe
  2⤵
  PID:9312
- C:\Windows\System\bPFzYPd.exe
  C:\Windows\System\bPFzYPd.exe
  2⤵
  PID:9328
- C:\Windows\System\ayPaehQ.exe
  C:\Windows\System\ayPaehQ.exe
  2⤵
  PID:9344
- C:\Windows\System\hYOpuMJ.exe
  C:\Windows\System\hYOpuMJ.exe
  2⤵
  PID:9360
- C:\Windows\System\qcahtYN.exe
  C:\Windows\System\qcahtYN.exe
  2⤵
  PID:9376
- C:\Windows\System\qlmZfVO.exe
  C:\Windows\System\qlmZfVO.exe
  2⤵
  PID:9392
- C:\Windows\System\HCFtTOx.exe
  C:\Windows\System\HCFtTOx.exe
  2⤵
  PID:9408
- C:\Windows\System\HAVVaDj.exe
  C:\Windows\System\HAVVaDj.exe
  2⤵
  PID:9424
- C:\Windows\System\FwioFcv.exe
  C:\Windows\System\FwioFcv.exe
  2⤵
  PID:9440
- C:\Windows\System\CZrrzCv.exe
  C:\Windows\System\CZrrzCv.exe
  2⤵
  PID:9456
- C:\Windows\System\kLJfwaV.exe
  C:\Windows\System\kLJfwaV.exe
  2⤵
  PID:9472
- C:\Windows\System\VdFXLGC.exe
  C:\Windows\System\VdFXLGC.exe
  2⤵
  PID:9488
- C:\Windows\System\conXEsK.exe
  C:\Windows\System\conXEsK.exe
  2⤵
  PID:9516
- C:\Windows\System\UCJHEKs.exe
  C:\Windows\System\UCJHEKs.exe
  2⤵
  PID:9540
- C:\Windows\System\RmHWvXK.exe
  C:\Windows\System\RmHWvXK.exe
  2⤵
  PID:9560
- C:\Windows\System\puDSKiq.exe
  C:\Windows\System\puDSKiq.exe
  2⤵
  PID:9580
- C:\Windows\System\kCuHAzB.exe
  C:\Windows\System\kCuHAzB.exe
  2⤵
  PID:9600
- C:\Windows\System\nsEllpi.exe
  C:\Windows\System\nsEllpi.exe
  2⤵
  PID:9628
- C:\Windows\System\mhnLwdF.exe
  C:\Windows\System\mhnLwdF.exe
  2⤵
  PID:9656
- C:\Windows\System\ASTewbp.exe
  C:\Windows\System\ASTewbp.exe
  2⤵
  PID:9676
- C:\Windows\System\qWHJerX.exe
  C:\Windows\System\qWHJerX.exe
  2⤵
  PID:9696
- C:\Windows\System\UlLscAF.exe
  C:\Windows\System\UlLscAF.exe
  2⤵
  PID:9716
- C:\Windows\System\kMoNBYZ.exe
  C:\Windows\System\kMoNBYZ.exe
  2⤵
  PID:9736
- C:\Windows\System\BFyNBSs.exe
  C:\Windows\System\BFyNBSs.exe
  2⤵
  PID:9756
- C:\Windows\System\bRpweZn.exe
  C:\Windows\System\bRpweZn.exe
  2⤵
  PID:9776
- C:\Windows\System\JrqaEWE.exe
  C:\Windows\System\JrqaEWE.exe
  2⤵
  PID:9796
- C:\Windows\System\dlcDkvT.exe
  C:\Windows\System\dlcDkvT.exe
  2⤵
  PID:9824
- C:\Windows\System\nzqlEle.exe
  C:\Windows\System\nzqlEle.exe
  2⤵
  PID:9844
- C:\Windows\System\dOXkhDm.exe
  C:\Windows\System\dOXkhDm.exe
  2⤵
  PID:9864
- C:\Windows\System\vWxTDhM.exe
  C:\Windows\System\vWxTDhM.exe
  2⤵
  PID:9892
- C:\Windows\System\JzzoxqU.exe
  C:\Windows\System\JzzoxqU.exe
  2⤵
  PID:9912
- C:\Windows\System\bRLbVoE.exe
  C:\Windows\System\bRLbVoE.exe
  2⤵
  PID:9936
- C:\Windows\System\kAkqDXq.exe
  C:\Windows\System\kAkqDXq.exe
  2⤵
  PID:9960
- C:\Windows\System\taYktNu.exe
  C:\Windows\System\taYktNu.exe
  2⤵
  PID:9980
- C:\Windows\System\UfUQuaj.exe
  C:\Windows\System\UfUQuaj.exe
  2⤵
  PID:10004
- C:\Windows\System\hTDECDI.exe
  C:\Windows\System\hTDECDI.exe
  2⤵
  PID:10024
- C:\Windows\System\ZJXcOJt.exe
  C:\Windows\System\ZJXcOJt.exe
  2⤵
  PID:10044
- C:\Windows\System\hFSyOSV.exe
  C:\Windows\System\hFSyOSV.exe
  2⤵
  PID:10064
- C:\Windows\System\PVAbDrv.exe
  C:\Windows\System\PVAbDrv.exe
  2⤵
  PID:10080
- C:\Windows\System\XadFguf.exe
  C:\Windows\System\XadFguf.exe
  2⤵
  PID:10100
- C:\Windows\System\LdCJGgb.exe
  C:\Windows\System\LdCJGgb.exe
  2⤵
  PID:10128
- C:\Windows\System\qzEjPnN.exe
  C:\Windows\System\qzEjPnN.exe
  2⤵
  PID:10148
- C:\Windows\System\OPzwXDL.exe
  C:\Windows\System\OPzwXDL.exe
  2⤵
  PID:10164
- C:\Windows\System\XDQeBhk.exe
  C:\Windows\System\XDQeBhk.exe
  2⤵
  PID:10188
- C:\Windows\System\ohMrMxx.exe
  C:\Windows\System\ohMrMxx.exe
  2⤵
  PID:10216
- C:\Windows\System\WctLStr.exe
  C:\Windows\System\WctLStr.exe
  2⤵
  PID:5924
- C:\Windows\System\OfPEAIK.exe
  C:\Windows\System\OfPEAIK.exe
  2⤵
  PID:5456
- C:\Windows\System\IASRYMf.exe
  C:\Windows\System\IASRYMf.exe
  2⤵
  PID:5784
- C:\Windows\System\OWChhZJ.exe
  C:\Windows\System\OWChhZJ.exe
  2⤵
  PID:5528
- C:\Windows\System\myLwuZc.exe
  C:\Windows\System\myLwuZc.exe
  2⤵
  PID:5440
- C:\Windows\System\xQBYAxf.exe
  C:\Windows\System\xQBYAxf.exe
  2⤵
  PID:6052
- C:\Windows\System\NMSEMvp.exe
  C:\Windows\System\NMSEMvp.exe
  2⤵
  PID:4016
- C:\Windows\System\ygWUFQr.exe
  C:\Windows\System\ygWUFQr.exe
  2⤵
  PID:5580
- C:\Windows\System\Wyhsrrj.exe
  C:\Windows\System\Wyhsrrj.exe
  2⤵
  PID:6200
- C:\Windows\System\KrTBubd.exe
  C:\Windows\System\KrTBubd.exe
  2⤵
  PID:6312
- C:\Windows\System\HhHGplu.exe
  C:\Windows\System\HhHGplu.exe
  2⤵
  PID:6780
- C:\Windows\System\lnrPHue.exe
  C:\Windows\System\lnrPHue.exe
  2⤵
  PID:6848
- C:\Windows\System\pqntker.exe
  C:\Windows\System\pqntker.exe
  2⤵
  PID:5096
- C:\Windows\System\iYXDCwi.exe
  C:\Windows\System\iYXDCwi.exe
  2⤵
  PID:1076
- C:\Windows\System\BXJvRxG.exe
  C:\Windows\System\BXJvRxG.exe
  2⤵
  PID:7244
- C:\Windows\System\gMjzIfp.exe
  C:\Windows\System\gMjzIfp.exe
  2⤵
  PID:8268
- C:\Windows\System\luSNhxO.exe
  C:\Windows\System\luSNhxO.exe
  2⤵
  PID:8340
- C:\Windows\System\wahbboS.exe
  C:\Windows\System\wahbboS.exe
  2⤵
  PID:8408
- C:\Windows\System\GqSMEpA.exe
  C:\Windows\System\GqSMEpA.exe
  2⤵
  PID:8496
- C:\Windows\System\WsdtbKQ.exe
  C:\Windows\System\WsdtbKQ.exe
  2⤵
  PID:7396
- C:\Windows\System\axtvzMf.exe
  C:\Windows\System\axtvzMf.exe
  2⤵
  PID:8564
- C:\Windows\System\wZiVazF.exe
  C:\Windows\System\wZiVazF.exe
  2⤵
  PID:7588
- C:\Windows\System\DGDkOEH.exe
  C:\Windows\System\DGDkOEH.exe
  2⤵
  PID:7600
- C:\Windows\System\zHaSqYD.exe
  C:\Windows\System\zHaSqYD.exe
  2⤵
  PID:8724
- C:\Windows\System\EWmPGUm.exe
  C:\Windows\System\EWmPGUm.exe
  2⤵
  PID:8824
- C:\Windows\System\rtYiPIe.exe
  C:\Windows\System\rtYiPIe.exe
  2⤵
  PID:8980
- C:\Windows\System\yfmakpm.exe
  C:\Windows\System\yfmakpm.exe
  2⤵
  PID:9028
- C:\Windows\System\NAmiygh.exe
  C:\Windows\System\NAmiygh.exe
  2⤵
  PID:10244
- C:\Windows\System\vENyvyh.exe
  C:\Windows\System\vENyvyh.exe
  2⤵
  PID:10264
- C:\Windows\System\oubowqk.exe
  C:\Windows\System\oubowqk.exe
  2⤵
  PID:10284
- C:\Windows\System\PVOuTtN.exe
  C:\Windows\System\PVOuTtN.exe
  2⤵
  PID:10316
- C:\Windows\System\uvCHtao.exe
  C:\Windows\System\uvCHtao.exe
  2⤵
  PID:10332
- C:\Windows\System\NUUkhnU.exe
  C:\Windows\System\NUUkhnU.exe
  2⤵
  PID:10352
- C:\Windows\System\xNcxYcz.exe
  C:\Windows\System\xNcxYcz.exe
  2⤵
  PID:10368
- C:\Windows\System\QsNbuWj.exe
  C:\Windows\System\QsNbuWj.exe
  2⤵
  PID:10388
- C:\Windows\System\GRkjQCN.exe
  C:\Windows\System\GRkjQCN.exe
  2⤵
  PID:10416
- C:\Windows\System\nbWAUMd.exe
  C:\Windows\System\nbWAUMd.exe
  2⤵
  PID:10432
- C:\Windows\System\IDuJuWm.exe
  C:\Windows\System\IDuJuWm.exe
  2⤵
  PID:10448
- C:\Windows\System\yZfCTny.exe
  C:\Windows\System\yZfCTny.exe
  2⤵
  PID:10468
- C:\Windows\System\xldjUMV.exe
  C:\Windows\System\xldjUMV.exe
  2⤵
  PID:10532
- C:\Windows\System\kwQYUpR.exe
  C:\Windows\System\kwQYUpR.exe
  2⤵
  PID:10548
- C:\Windows\System\BcaxMIY.exe
  C:\Windows\System\BcaxMIY.exe
  2⤵
  PID:10564
- C:\Windows\System\BnrGjTF.exe
  C:\Windows\System\BnrGjTF.exe
  2⤵
  PID:10584
- C:\Windows\System\OvKBlgI.exe
  C:\Windows\System\OvKBlgI.exe
  2⤵
  PID:10612
- C:\Windows\System\EgIYRSd.exe
  C:\Windows\System\EgIYRSd.exe
  2⤵
  PID:10632
- C:\Windows\System\EvpVLaj.exe
  C:\Windows\System\EvpVLaj.exe
  2⤵
  PID:10652
- C:\Windows\System\COqtXUG.exe
  C:\Windows\System\COqtXUG.exe
  2⤵
  PID:10672
- C:\Windows\System\RbedetS.exe
  C:\Windows\System\RbedetS.exe
  2⤵
  PID:10692
- C:\Windows\System\YumHKdR.exe
  C:\Windows\System\YumHKdR.exe
  2⤵
  PID:10708
- C:\Windows\System\rlwOBio.exe
  C:\Windows\System\rlwOBio.exe
  2⤵
  PID:10728
- C:\Windows\System\qRcXJeT.exe
  C:\Windows\System\qRcXJeT.exe
  2⤵
  PID:10752
- C:\Windows\System\phGsbfx.exe
  C:\Windows\System\phGsbfx.exe
  2⤵
  PID:10772
- C:\Windows\System\cNgVMgY.exe
  C:\Windows\System\cNgVMgY.exe
  2⤵
  PID:10792
- C:\Windows\System\rEkkLTy.exe
  C:\Windows\System\rEkkLTy.exe
  2⤵
  PID:10812
- C:\Windows\System\PTdfHWE.exe
  C:\Windows\System\PTdfHWE.exe
  2⤵
  PID:10832
- C:\Windows\System\pyoVnIo.exe
  C:\Windows\System\pyoVnIo.exe
  2⤵
  PID:10856
- C:\Windows\System\dHFukyl.exe
  C:\Windows\System\dHFukyl.exe
  2⤵
  PID:10876
- C:\Windows\System\ediQgnS.exe
  C:\Windows\System\ediQgnS.exe
  2⤵
  PID:10896
- C:\Windows\System\jQEEwUZ.exe
  C:\Windows\System\jQEEwUZ.exe
  2⤵
  PID:10916
- C:\Windows\System\HHTglwL.exe
  C:\Windows\System\HHTglwL.exe
  2⤵
  PID:10940
- C:\Windows\System\hKtHeYq.exe
  C:\Windows\System\hKtHeYq.exe
  2⤵
  PID:10960
- C:\Windows\System\ICVAjQu.exe
  C:\Windows\System\ICVAjQu.exe
  2⤵
  PID:10980
- C:\Windows\System\UHcApKs.exe
  C:\Windows\System\UHcApKs.exe
  2⤵
  PID:11004
- C:\Windows\System\rzpVsHG.exe
  C:\Windows\System\rzpVsHG.exe
  2⤵
  PID:11028
- C:\Windows\System\kYBoFKd.exe
  C:\Windows\System\kYBoFKd.exe
  2⤵
  PID:11048
- C:\Windows\System\tGLgjea.exe
  C:\Windows\System\tGLgjea.exe
  2⤵
  PID:11068
- C:\Windows\System\KXgGhaW.exe
  C:\Windows\System\KXgGhaW.exe
  2⤵
  PID:11088
- C:\Windows\System\SGDUQxi.exe
  C:\Windows\System\SGDUQxi.exe
  2⤵
  PID:11108
- C:\Windows\System\lXVYWOl.exe
  C:\Windows\System\lXVYWOl.exe
  2⤵
  PID:11132
- C:\Windows\System\PsSzjhy.exe
  C:\Windows\System\PsSzjhy.exe
  2⤵
  PID:11152
- C:\Windows\System\wFHBBKP.exe
  C:\Windows\System\wFHBBKP.exe
  2⤵
  PID:11176
- C:\Windows\System\xNXabbx.exe
  C:\Windows\System\xNXabbx.exe
  2⤵
  PID:11196
- C:\Windows\System\xwdnmRW.exe
  C:\Windows\System\xwdnmRW.exe
  2⤵
  PID:11216
- C:\Windows\System\SZJNWde.exe
  C:\Windows\System\SZJNWde.exe
  2⤵
  PID:11236
- C:\Windows\System\NuydtTC.exe
  C:\Windows\System\NuydtTC.exe
  2⤵
  PID:11256
- C:\Windows\System\tfSlQAl.exe
  C:\Windows\System\tfSlQAl.exe
  2⤵
  PID:7364
- C:\Windows\System\ObvdXuz.exe
  C:\Windows\System\ObvdXuz.exe
  2⤵
  PID:7036
- C:\Windows\System\cKvPxhu.exe
  C:\Windows\System\cKvPxhu.exe
  2⤵
  PID:7132
- C:\Windows\System\qiEpfNS.exe
  C:\Windows\System\qiEpfNS.exe
  2⤵
  PID:3376
- C:\Windows\System\qZMaoIo.exe
  C:\Windows\System\qZMaoIo.exe
  2⤵
  PID:9420
- C:\Windows\System\TsoaaIA.exe
  C:\Windows\System\TsoaaIA.exe
  2⤵
  PID:9452
- C:\Windows\System\FYJTeUR.exe
  C:\Windows\System\FYJTeUR.exe
  2⤵
  PID:9500
- C:\Windows\System\isrsRlY.exe
  C:\Windows\System\isrsRlY.exe
  2⤵
  PID:6168
- C:\Windows\System\pJzWTUc.exe
  C:\Windows\System\pJzWTUc.exe
  2⤵
  PID:5988
- C:\Windows\System\QRIQslb.exe
  C:\Windows\System\QRIQslb.exe
  2⤵
  PID:9752
- C:\Windows\System\sxOBtwb.exe
  C:\Windows\System\sxOBtwb.exe
  2⤵
  PID:6592
- C:\Windows\System\RSXdlyh.exe
  C:\Windows\System\RSXdlyh.exe
  2⤵
  PID:9840
- C:\Windows\System\OuXnDtL.exe
  C:\Windows\System\OuXnDtL.exe
  2⤵
  PID:7088
- C:\Windows\System\XswLPRi.exe
  C:\Windows\System\XswLPRi.exe
  2⤵
  PID:7152
- C:\Windows\System\FLHvXDG.exe
  C:\Windows\System\FLHvXDG.exe
  2⤵
  PID:10012
- C:\Windows\System\nwGuObb.exe
  C:\Windows\System\nwGuObb.exe
  2⤵
  PID:10072
- C:\Windows\System\lVHWrce.exe
  C:\Windows\System\lVHWrce.exe
  2⤵
  PID:8316
- C:\Windows\System\HWgEZMp.exe
  C:\Windows\System\HWgEZMp.exe
  2⤵
  PID:10116
- C:\Windows\System\YVgnUlA.exe
  C:\Windows\System\YVgnUlA.exe
  2⤵
  PID:7380
- C:\Windows\System\aphHObB.exe
  C:\Windows\System\aphHObB.exe
  2⤵
  PID:8480
- C:\Windows\System\HINYLpU.exe
  C:\Windows\System\HINYLpU.exe
  2⤵
  PID:11284
- C:\Windows\System\sOObynF.exe
  C:\Windows\System\sOObynF.exe
  2⤵
  PID:11304
- C:\Windows\System\dwNzldf.exe
  C:\Windows\System\dwNzldf.exe
  2⤵
  PID:11324
- C:\Windows\System\qFvYxGf.exe
  C:\Windows\System\qFvYxGf.exe
  2⤵
  PID:11340
- C:\Windows\System\adoduLy.exe
  C:\Windows\System\adoduLy.exe
  2⤵
  PID:11364
- C:\Windows\System\adlTDsL.exe
  C:\Windows\System\adlTDsL.exe
  2⤵
  PID:11384
- C:\Windows\System\CEoRyNQ.exe
  C:\Windows\System\CEoRyNQ.exe
  2⤵
  PID:11404
- C:\Windows\System\eMiUChG.exe
  C:\Windows\System\eMiUChG.exe
  2⤵
  PID:11432
- C:\Windows\System\LfGFzBo.exe
  C:\Windows\System\LfGFzBo.exe
  2⤵
  PID:11456
- C:\Windows\System\NHbWWkE.exe
  C:\Windows\System\NHbWWkE.exe
  2⤵
  PID:11480
- C:\Windows\System\UUMdEpt.exe
  C:\Windows\System\UUMdEpt.exe
  2⤵
  PID:11496
- C:\Windows\System\ZjgnGJF.exe
  C:\Windows\System\ZjgnGJF.exe
  2⤵
  PID:11520
- C:\Windows\System\ZluAAeW.exe
  C:\Windows\System\ZluAAeW.exe
  2⤵
  PID:11536
- C:\Windows\System\axvOTPA.exe
  C:\Windows\System\axvOTPA.exe
  2⤵
  PID:11552
- C:\Windows\System\FWhgapP.exe
  C:\Windows\System\FWhgapP.exe
  2⤵
  PID:11576
- C:\Windows\System\FRUuZtC.exe
  C:\Windows\System\FRUuZtC.exe
  2⤵
  PID:11596
- C:\Windows\System\EzBRZOp.exe
  C:\Windows\System\EzBRZOp.exe
  2⤵
  PID:11620
- C:\Windows\System\SCNtBnd.exe
  C:\Windows\System\SCNtBnd.exe
  2⤵
  PID:11636
- C:\Windows\System\JKSUziu.exe
  C:\Windows\System\JKSUziu.exe
  2⤵
  PID:11660
- C:\Windows\System\xrFfXRk.exe
  C:\Windows\System\xrFfXRk.exe
  2⤵
  PID:11680
- C:\Windows\System\ieDgDZR.exe
  C:\Windows\System\ieDgDZR.exe
  2⤵
  PID:11704
- C:\Windows\System\hGDARoR.exe
  C:\Windows\System\hGDARoR.exe
  2⤵
  PID:11724
- C:\Windows\System\TeNdovu.exe
  C:\Windows\System\TeNdovu.exe
  2⤵
  PID:11740
- C:\Windows\System\KFFhPfZ.exe
  C:\Windows\System\KFFhPfZ.exe
  2⤵
  PID:11756
- C:\Windows\System\MqEqVwN.exe
  C:\Windows\System\MqEqVwN.exe
  2⤵
  PID:11776
- C:\Windows\System\eSPRuZJ.exe
  C:\Windows\System\eSPRuZJ.exe
  2⤵
  PID:11800
- C:\Windows\System\YEtUhYj.exe
  C:\Windows\System\YEtUhYj.exe
  2⤵
  PID:11816
- C:\Windows\System\PMGOuTp.exe
  C:\Windows\System\PMGOuTp.exe
  2⤵
  PID:11832
- C:\Windows\System\sKeUTfq.exe
  C:\Windows\System\sKeUTfq.exe
  2⤵
  PID:11856
- C:\Windows\System\uDmTzKG.exe
  C:\Windows\System\uDmTzKG.exe
  2⤵
  PID:11876
- C:\Windows\System\gOxhOMd.exe
  C:\Windows\System\gOxhOMd.exe
  2⤵
  PID:11892
- C:\Windows\System\awCPPdj.exe
  C:\Windows\System\awCPPdj.exe
  2⤵
  PID:11916
- C:\Windows\System\yUeztWB.exe
  C:\Windows\System\yUeztWB.exe
  2⤵
  PID:11944
- C:\Windows\System\nBTYsZM.exe
  C:\Windows\System\nBTYsZM.exe
  2⤵
  PID:11960
- C:\Windows\System\KjGkPPE.exe
  C:\Windows\System\KjGkPPE.exe
  2⤵
  PID:11980
- C:\Windows\System\gOGeQZO.exe
  C:\Windows\System\gOGeQZO.exe
  2⤵
  PID:12004
- C:\Windows\System\ouGlHLG.exe
  C:\Windows\System\ouGlHLG.exe
  2⤵
  PID:12028
- C:\Windows\System\EqYGqAX.exe
  C:\Windows\System\EqYGqAX.exe
  2⤵
  PID:12052
- C:\Windows\System\aQdjlMO.exe
  C:\Windows\System\aQdjlMO.exe
  2⤵
  PID:12076
- C:\Windows\System\IWrEFUh.exe
  C:\Windows\System\IWrEFUh.exe
  2⤵
  PID:12096
- C:\Windows\System\noxTufe.exe
  C:\Windows\System\noxTufe.exe
  2⤵
  PID:12112
- C:\Windows\System\VUHYUVp.exe
  C:\Windows\System\VUHYUVp.exe
  2⤵
  PID:12132
- C:\Windows\System\JxzpOkw.exe
  C:\Windows\System\JxzpOkw.exe
  2⤵
  PID:12152
- C:\Windows\System\mdYEDhF.exe
  C:\Windows\System\mdYEDhF.exe
  2⤵
  PID:12168
- C:\Windows\System\xwWdwCF.exe
  C:\Windows\System\xwWdwCF.exe
  2⤵
  PID:12184
- C:\Windows\System\VjUtkXY.exe
  C:\Windows\System\VjUtkXY.exe
  2⤵
  PID:12204
- C:\Windows\System\ANKVTFy.exe
  C:\Windows\System\ANKVTFy.exe
  2⤵
  PID:12228
- C:\Windows\System\UKdtkQj.exe
  C:\Windows\System\UKdtkQj.exe
  2⤵
  PID:12252
- C:\Windows\System\mcJYJKa.exe
  C:\Windows\System\mcJYJKa.exe
  2⤵
  PID:12272
- C:\Windows\System\NPkgCWT.exe
  C:\Windows\System\NPkgCWT.exe
  2⤵
  PID:8588
- C:\Windows\System\ckITGFi.exe
  C:\Windows\System\ckITGFi.exe
  2⤵
  PID:7460
- C:\Windows\System\sXMrbmO.exe
  C:\Windows\System\sXMrbmO.exe
  2⤵
  PID:6648
- C:\Windows\System\laaRGcY.exe
  C:\Windows\System\laaRGcY.exe
  2⤵
  PID:8640
- C:\Windows\System\mEobdHs.exe
  C:\Windows\System\mEobdHs.exe
  2⤵
  PID:8800
- C:\Windows\System\EVdrvLA.exe
  C:\Windows\System\EVdrvLA.exe
  2⤵
  PID:8244
- C:\Windows\System\lZcTTmP.exe
  C:\Windows\System\lZcTTmP.exe
  2⤵
  PID:8828
- C:\Windows\System\VzzbWDp.exe
  C:\Windows\System\VzzbWDp.exe
  2⤵
  PID:8872
- C:\Windows\System\LfxAQBH.exe
  C:\Windows\System\LfxAQBH.exe
  2⤵
  PID:8676
- C:\Windows\System\DPmMmWc.exe
  C:\Windows\System\DPmMmWc.exe
  2⤵
  PID:9096
- C:\Windows\System\EkjfCKe.exe
  C:\Windows\System\EkjfCKe.exe
  2⤵
  PID:9136
- C:\Windows\System\SygnPmf.exe
  C:\Windows\System\SygnPmf.exe
  2⤵
  PID:8972
- C:\Windows\System\PejWwGs.exe
  C:\Windows\System\PejWwGs.exe
  2⤵
  PID:10276
- C:\Windows\System\eNozPGL.exe
  C:\Windows\System\eNozPGL.exe
  2⤵
  PID:10324
- C:\Windows\System\HqbRIvo.exe
  C:\Windows\System\HqbRIvo.exe
  2⤵
  PID:10464
- C:\Windows\System\QUAMjIi.exe
  C:\Windows\System\QUAMjIi.exe
  2⤵
  PID:7880
- C:\Windows\System\cxNHCeN.exe
  C:\Windows\System\cxNHCeN.exe
  2⤵
  PID:2400
- C:\Windows\System\kkmorUc.exe
  C:\Windows\System\kkmorUc.exe
  2⤵
  PID:7948
- C:\Windows\System\bhhRYHB.exe
  C:\Windows\System\bhhRYHB.exe
  2⤵
  PID:9264
- C:\Windows\System\yZeQEuT.exe
  C:\Windows\System\yZeQEuT.exe
  2⤵
  PID:8016
- C:\Windows\System\kanuggO.exe
  C:\Windows\System\kanuggO.exe
  2⤵
  PID:8040
- C:\Windows\System\ubtieXJ.exe
  C:\Windows\System\ubtieXJ.exe
  2⤵
  PID:8084
- C:\Windows\System\TYHoIDK.exe
  C:\Windows\System\TYHoIDK.exe
  2⤵
  PID:4112
- C:\Windows\System\RYnSLHO.exe
  C:\Windows\System\RYnSLHO.exe
  2⤵
  PID:8180
- C:\Windows\System\Tncucir.exe
  C:\Windows\System\Tncucir.exe
  2⤵
  PID:9292
- C:\Windows\System\LhSdpbR.exe
  C:\Windows\System\LhSdpbR.exe
  2⤵
  PID:4568
- C:\Windows\System\UlwzqLP.exe
  C:\Windows\System\UlwzqLP.exe
  2⤵
  PID:12560
- C:\Windows\System\qRHpprL.exe
  C:\Windows\System\qRHpprL.exe
  2⤵
  PID:12580
- C:\Windows\System\XgOkOEV.exe
  C:\Windows\System\XgOkOEV.exe
  2⤵
  PID:12600
- C:\Windows\System\XtrIruQ.exe
  C:\Windows\System\XtrIruQ.exe
  2⤵
  PID:12620
- C:\Windows\System\OFcwiNT.exe
  C:\Windows\System\OFcwiNT.exe
  2⤵
  PID:12640
- C:\Windows\System\eGcNJgR.exe
  C:\Windows\System\eGcNJgR.exe
  2⤵
  PID:12660
- C:\Windows\System\tPaAiZu.exe
  C:\Windows\System\tPaAiZu.exe
  2⤵
  PID:12688
- C:\Windows\System\RNvaqsR.exe
  C:\Windows\System\RNvaqsR.exe
  2⤵
  PID:12708
- C:\Windows\System\HUeCBwk.exe
  C:\Windows\System\HUeCBwk.exe
  2⤵
  PID:12728
- C:\Windows\System\BvBuCrM.exe
  C:\Windows\System\BvBuCrM.exe
  2⤵
  PID:12748
- C:\Windows\System\ezDsTUU.exe
  C:\Windows\System\ezDsTUU.exe
  2⤵
  PID:12768
- C:\Windows\System\gtpfPhq.exe
  C:\Windows\System\gtpfPhq.exe
  2⤵
  PID:12788
- C:\Windows\System\anAcbLZ.exe
  C:\Windows\System\anAcbLZ.exe
  2⤵
  PID:12808
- C:\Windows\System\mkUCAIY.exe
  C:\Windows\System\mkUCAIY.exe
  2⤵
  PID:12828
- C:\Windows\System\hVStqiy.exe
  C:\Windows\System\hVStqiy.exe
  2⤵
  PID:12856
- C:\Windows\System\iykdIGl.exe
  C:\Windows\System\iykdIGl.exe
  2⤵
  PID:12884
- C:\Windows\System\hcFIkuH.exe
  C:\Windows\System\hcFIkuH.exe
  2⤵
  PID:12904
- C:\Windows\System\ehHeBIJ.exe
  C:\Windows\System\ehHeBIJ.exe
  2⤵
  PID:12924
- C:\Windows\System\PrjfgQf.exe
  C:\Windows\System\PrjfgQf.exe
  2⤵
  PID:12944
- C:\Windows\System\wLzwVfp.exe
  C:\Windows\System\wLzwVfp.exe
  2⤵
  PID:12968
- C:\Windows\System\FVXwVej.exe
  C:\Windows\System\FVXwVej.exe
  2⤵
  PID:12992
- C:\Windows\System\AkndbKm.exe
  C:\Windows\System\AkndbKm.exe
  2⤵
  PID:13012
- C:\Windows\System\nygJtnq.exe
  C:\Windows\System\nygJtnq.exe
  2⤵
  PID:13036
- C:\Windows\System\jzBQMyF.exe
  C:\Windows\System\jzBQMyF.exe
  2⤵
  PID:13056
- C:\Windows\System\AOEvgUB.exe
  C:\Windows\System\AOEvgUB.exe
  2⤵
  PID:13076
- C:\Windows\System\XzTrgsf.exe
  C:\Windows\System\XzTrgsf.exe
  2⤵
  PID:13100
- C:\Windows\System\FkTpLHI.exe
  C:\Windows\System\FkTpLHI.exe
  2⤵
  PID:13120
- C:\Windows\System\GRmhSJy.exe
  C:\Windows\System\GRmhSJy.exe
  2⤵
  PID:13140
- C:\Windows\System\WMhgdNk.exe
  C:\Windows\System\WMhgdNk.exe
  2⤵
  PID:13160
- C:\Windows\System\lSeMvLE.exe
  C:\Windows\System\lSeMvLE.exe
  2⤵
  PID:13184
- C:\Windows\System\VYDftQd.exe
  C:\Windows\System\VYDftQd.exe
  2⤵
  PID:13200
- C:\Windows\System\TgpgsYY.exe
  C:\Windows\System\TgpgsYY.exe
  2⤵
  PID:13224
- C:\Windows\System\unXNRPG.exe
  C:\Windows\System\unXNRPG.exe
  2⤵
  PID:13240
- C:\Windows\System\GWhODSc.exe
  C:\Windows\System\GWhODSc.exe
  2⤵
  PID:13264
- C:\Windows\System\wFJluRg.exe
  C:\Windows\System\wFJluRg.exe
  2⤵
  PID:13284
- C:\Windows\System\UJjZMfz.exe
  C:\Windows\System\UJjZMfz.exe
  2⤵
  PID:13304
- C:\Windows\System\fvAedhD.exe
  C:\Windows\System\fvAedhD.exe
  2⤵
  PID:10660
- C:\Windows\System\CCjFsNC.exe
  C:\Windows\System\CCjFsNC.exe
  2⤵
  PID:10760
- C:\Windows\System\xPmZmvy.exe
  C:\Windows\System\xPmZmvy.exe
  2⤵
  PID:10888
- C:\Windows\System\OnribKN.exe
  C:\Windows\System\OnribKN.exe
  2⤵
  PID:11040
- C:\Windows\System\RqdWSHK.exe
  C:\Windows\System\RqdWSHK.exe
  2⤵
  PID:10576
- C:\Windows\System\iQAJViz.exe
  C:\Windows\System\iQAJViz.exe
  2⤵
  PID:9648
- C:\Windows\System\Cicbcaw.exe
  C:\Windows\System\Cicbcaw.exe
  2⤵
  PID:13320
- C:\Windows\System\WitmMBK.exe
  C:\Windows\System\WitmMBK.exe
  2⤵
  PID:13340
- C:\Windows\System\OycvgGa.exe
  C:\Windows\System\OycvgGa.exe
  2⤵
  PID:13364
- C:\Windows\System\DaIvhiJ.exe
  C:\Windows\System\DaIvhiJ.exe
  2⤵
  PID:13388
- C:\Windows\System\oivXUwv.exe
  C:\Windows\System\oivXUwv.exe
  2⤵
  PID:13412
- C:\Windows\System\EGFUFqE.exe
  C:\Windows\System\EGFUFqE.exe
  2⤵
  PID:13436
- C:\Windows\System\wDIPXSU.exe
  C:\Windows\System\wDIPXSU.exe
  2⤵
  PID:13516
- C:\Windows\System\JXCyWix.exe
  C:\Windows\System\JXCyWix.exe
  2⤵
  PID:13532
- C:\Windows\System\lhGLggs.exe
  C:\Windows\System\lhGLggs.exe
  2⤵
  PID:13568
- C:\Windows\System\pCdZVib.exe
  C:\Windows\System\pCdZVib.exe
  2⤵
  PID:13612
- C:\Windows\System\pwulheI.exe
  C:\Windows\System\pwulheI.exe
  2⤵
  PID:13680
- C:\Windows\System\bfjzLMG.exe
  C:\Windows\System\bfjzLMG.exe
  2⤵
  PID:13708
- C:\Windows\System\tlPVBzC.exe
  C:\Windows\System\tlPVBzC.exe
  2⤵
  PID:13728
- C:\Windows\System\uULeHSX.exe
  C:\Windows\System\uULeHSX.exe
  2⤵
  PID:13752
- C:\Windows\System\XnnpEMo.exe
  C:\Windows\System\XnnpEMo.exe
  2⤵
  PID:13768
- C:\Windows\System\DjyRpIb.exe
  C:\Windows\System\DjyRpIb.exe
  2⤵
  PID:13784
- C:\Windows\System\lRugutM.exe
  C:\Windows\System\lRugutM.exe
  2⤵
  PID:13804
- C:\Windows\System\bKjJZLL.exe
  C:\Windows\System\bKjJZLL.exe
  2⤵
  PID:13820
- C:\Windows\System\NAGFYbf.exe
  C:\Windows\System\NAGFYbf.exe
  2⤵
  PID:13836
- C:\Windows\System\iTpPUmx.exe
  C:\Windows\System\iTpPUmx.exe
  2⤵
  PID:13856
- C:\Windows\System\PTbXJeP.exe
  C:\Windows\System\PTbXJeP.exe
  2⤵
  PID:13872
- C:\Windows\System\cCYEcxS.exe
  C:\Windows\System\cCYEcxS.exe
  2⤵
  PID:13888
- C:\Windows\System\JSFjrCT.exe
  C:\Windows\System\JSFjrCT.exe
  2⤵
  PID:13908
- C:\Windows\System\wNHnqad.exe
  C:\Windows\System\wNHnqad.exe
  2⤵
  PID:13936
- C:\Windows\System\vixuWCc.exe
  C:\Windows\System\vixuWCc.exe
  2⤵
  PID:13964
- C:\Windows\System\TVyPcFw.exe
  C:\Windows\System\TVyPcFw.exe
  2⤵
  PID:14008
- C:\Windows\System\kueYSwk.exe
  C:\Windows\System\kueYSwk.exe
  2⤵
  PID:14040
- C:\Windows\System\HUIxSrc.exe
  C:\Windows\System\HUIxSrc.exe
  2⤵
  PID:14068
- C:\Windows\System\FdtiLAn.exe
  C:\Windows\System\FdtiLAn.exe
  2⤵
  PID:14096
- C:\Windows\System\ZHUjyxr.exe
  C:\Windows\System\ZHUjyxr.exe
  2⤵
  PID:14128
- C:\Windows\System\bYnJxLp.exe
  C:\Windows\System\bYnJxLp.exe
  2⤵
  PID:14144
- C:\Windows\System\VdmJYGc.exe
  C:\Windows\System\VdmJYGc.exe
  2⤵
  PID:14164
- C:\Windows\System\uhnPmRp.exe
  C:\Windows\System\uhnPmRp.exe
  2⤵
  PID:14184
- C:\Windows\System\GsrgGzu.exe
  C:\Windows\System\GsrgGzu.exe
  2⤵
  PID:14200
- C:\Windows\System\DlkoumW.exe
  C:\Windows\System\DlkoumW.exe
  2⤵
  PID:14304
- C:\Windows\System\YxZyJRa.exe
  C:\Windows\System\YxZyJRa.exe
  2⤵
  PID:14320
- C:\Windows\System\cYofyau.exe
  C:\Windows\System\cYofyau.exe
  2⤵
  PID:9416
- C:\Windows\System\uSYFogW.exe
  C:\Windows\System\uSYFogW.exe
  2⤵
  PID:9792
- C:\Windows\System\DlIqkGE.exe
  C:\Windows\System\DlIqkGE.exe
  2⤵
  PID:4760
- C:\Windows\System\lVDmRcl.exe
  C:\Windows\System\lVDmRcl.exe
  2⤵
  PID:6428
- C:\Windows\System\bKEOqLz.exe
  C:\Windows\System\bKEOqLz.exe
  2⤵
  PID:7156
- C:\Windows\System\ickBmsU.exe
  C:\Windows\System\ickBmsU.exe
  2⤵
  PID:7240
- C:\Windows\System\prmnhrv.exe
  C:\Windows\System\prmnhrv.exe
  2⤵
  PID:8548
- C:\Windows\System\xSUvGmW.exe
  C:\Windows\System\xSUvGmW.exe
  2⤵
  PID:11784
- C:\Windows\System\FgWrqUR.exe
  C:\Windows\System\FgWrqUR.exe
  2⤵
  PID:11888
- C:\Windows\System\WKJvmxT.exe
  C:\Windows\System\WKJvmxT.exe
  2⤵
  PID:10340
- C:\Windows\System\ImOvRca.exe
  C:\Windows\System\ImOvRca.exe
  2⤵
  PID:10396
- C:\Windows\System\TAiCNIw.exe
  C:\Windows\System\TAiCNIw.exe
  2⤵
  PID:10456
- C:\Windows\System\eRtrJGi.exe
  C:\Windows\System\eRtrJGi.exe
  2⤵
  PID:12300
- C:\Windows\System\YeWtvZO.exe
  C:\Windows\System\YeWtvZO.exe
  2⤵
  PID:14352
- C:\Windows\System\EDSWHwu.exe
  C:\Windows\System\EDSWHwu.exe
  2⤵
  PID:14376
- C:\Windows\System\dnslAwh.exe
  C:\Windows\System\dnslAwh.exe
  2⤵
  PID:14396
- C:\Windows\System\bdJfCKx.exe
  C:\Windows\System\bdJfCKx.exe
  2⤵
  PID:14420
- C:\Windows\System\AizvHsv.exe
  C:\Windows\System\AizvHsv.exe
  2⤵
  PID:14440
- C:\Windows\System\RfWvdKd.exe
  C:\Windows\System\RfWvdKd.exe
  2⤵
  PID:14460
- C:\Windows\System\gACKacE.exe
  C:\Windows\System\gACKacE.exe
  2⤵
  PID:14480
- C:\Windows\System\GyGgsDz.exe
  C:\Windows\System\GyGgsDz.exe
  2⤵
  PID:14500
- C:\Windows\System\iJhCIYY.exe
  C:\Windows\System\iJhCIYY.exe
  2⤵
  PID:14520
- C:\Windows\System\AIFJQRI.exe
  C:\Windows\System\AIFJQRI.exe
  2⤵
  PID:14540
- C:\Windows\System\BnEvbgE.exe
  C:\Windows\System\BnEvbgE.exe
  2⤵
  PID:14560
- C:\Windows\System\uXiDcaN.exe
  C:\Windows\System\uXiDcaN.exe
  2⤵
  PID:14580
- C:\Windows\System\nMbNSxu.exe
  C:\Windows\System\nMbNSxu.exe
  2⤵
  PID:14596
- C:\Windows\System\KjilyRN.exe
  C:\Windows\System\KjilyRN.exe
  2⤵
  PID:14612
- C:\Windows\System\YjArCbL.exe
  C:\Windows\System\YjArCbL.exe
  2⤵
  PID:14628
- C:\Windows\System\VendrqP.exe
  C:\Windows\System\VendrqP.exe
  2⤵
  PID:14644
- C:\Windows\System\gHcvlyY.exe
  C:\Windows\System\gHcvlyY.exe
  2⤵
  PID:14660
- C:\Windows\System\HaRsUQg.exe
  C:\Windows\System\HaRsUQg.exe
  2⤵
  PID:14688
- C:\Windows\System\YBQSKxz.exe
  C:\Windows\System\YBQSKxz.exe
  2⤵
  PID:14704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ATKuUpG.exe

Filesize
1.3MB

MD5
109d4276c9acfe9e9232c59a9cd183f0

SHA1
912356dfccf4160b40ad297705e22ec98980413f

SHA256
cc3a1748e97ffd273d9d1c9aaa54d798ee9d09b3c1f9f48251adcd5cfbda2bea

SHA512
42ee7988bd1974e4252febde584ca39ed6e0e1ae982044028e0ec159858a985344bbf6dff734389ffeaf59513a49b9257cf646e0b2f8dd2bf6bd235baf9e8200

Download Submit
C:\Windows\System\EMJODVx.exe

Filesize
1.3MB

MD5
cf2bd9b09bcf58ccf73e9a17b9d571f9

SHA1
e95f7a6bb9b09e3b4bd245704572f2d475512e17

SHA256
0c8e60ba4f65b7e515cff0c0bf47cdb5179634219c13b8b82dd258bb06187832

SHA512
dc6faaba29a9f9abe3511f1b6543d0c595b533fd58bde45a50967c15220fbb08f5d64c2ddd9fb0b5bce51299986462a13263779d076040e06cabb67444b08692

Download Submit
C:\Windows\System\EdAGkwz.exe

Filesize
1.3MB

MD5
829a5894e6f57fdfab903568bc411def

SHA1
46bf6a2fcf5670f647e1b98e4f1072c419ab8d9b

SHA256
9ebbf90e2e0c78e0ab33a8635ad980984ea7b754a145706839a07e86d141aeda

SHA512
a111f61fd83476352ca085e7b245bc2df4c64a5c5761c2159ea591c1834314efdaba28035cfd9cfa403a97c4875c2534938c9d7a4a76507f0bfae835f4b429ba

Download Submit
C:\Windows\System\EwOSdDD.exe

Filesize
1.3MB

MD5
dd9061d8c0af9bd88382a1e68f6aab9a

SHA1
2190da80c4eafe2588c901bdf3d9318ced6c6e49

SHA256
948335e74412c8dc265a7124b73b1ebb67780896b874471f98b63fe86f51a1cd

SHA512
f7b0dc26233509bcb1089d74a3fce0efb4aacfe14944b41f7bacc9811ba0ca7db296f26cf0827b6e2613ad69903bf0f16aa0ef4af78870360f56e58c038d8bd1

Download Submit
C:\Windows\System\EyTnVjZ.exe

Filesize
1.3MB

MD5
afb23220fc42d46ecef91612cafca197

SHA1
73d7087229921bd2f3c4a34a88ba33fde2a07389

SHA256
b8d69a05d206e3f2a5493444846ab19b0ac44dfc8cc4a3595f40ade187e903e8

SHA512
fa8f5f8aaa36fe46070de9a9198c73de54e7df685a828d040b681c3559b80cccf12e3b9f8bca946e2df4b6d5e19efd26f6e7c581d89e75bdd91068c39f89e103

Download Submit
C:\Windows\System\FXMXoJP.exe

Filesize
1.3MB

MD5
91cf37e922c6a07126a83aeb005a904d

SHA1
04d36e69ef823ef8ae6605315625168992106ad8

SHA256
40735f63940222d738ea226f8c4a8cebd330563fbe325e08eb3b6552d126436f

SHA512
d564872fdbb9ca0996f5806da64998c16b119f488db665e29a17914a2cf6815a418f87f7ca6282663f7f7e2bf80ce3f6deb2055070c5fbe4b1c6d75d465ffd74

Download Submit
C:\Windows\System\FccGqJo.exe

Filesize
1.3MB

MD5
775084eea20007bad0f9f5ae21db62f4

SHA1
e346592bbc4502f1c753a274aa628cf0d2ec0bd0

SHA256
176fc777f7117e437faffed21b1e17eb0cc3b5d93aa5ae5a9bbe183464460abe

SHA512
023d8206185f76a8d2dadccc674537c5764b39a04159ef65bba5b4b45d5c2aaf9323ae8995005f4befda4b03b456e901baaeeb5f514e7920f6f5f7010e3d2984

Download Submit
C:\Windows\System\HHBwRnj.exe

Filesize
1.3MB

MD5
abc80cdb82836f2a4d00bc11a5b3f38e

SHA1
5cab3f36a56e4c696e2d29dbdf6a141daab5c55c

SHA256
9999f3dfcb42daee1fb46c905bb1df0a458bf560967798deccd18643c6362a14

SHA512
93226629812b2325f697186210643488ec7bc7fb792edb835f96999637740dccc6495f85fe9a0c33934b88a1ca51f84d04f4e48984cd5961c4f8e342f7deaf7f

Download Submit
C:\Windows\System\IxAHfSc.exe

Filesize
1.3MB

MD5
0998b20d65dafca9319b4d8ac3426653

SHA1
1cfb8084ca79c5ece79ee6517285b32564ee8539

SHA256
1fcb6993a535f38fcec8c57ec8f7358343a38535174d38e473b1276ab360f600

SHA512
2ae23f8868d0befff062bb98a6b25fdf075e2e7bd327fc654e22c03ebbef697b4a709b45a8e9aa31e263d3ae4beb3b390d743206d5d398b69ffed49b3334ef68

Download Submit
C:\Windows\System\JQymKrP.exe

Filesize
1.3MB

MD5
c4502d016e4caac24acc9a0521705bea

SHA1
8e40b3d0424644d5fba8a581faca6da8464f6521

SHA256
ede7c60009f267ff6023117c052156f884d09ff1fc38ebc08e7cd7f1d62b6f68

SHA512
73ef64118610e715be59b0f418c94d36c58bcd0ecd94a10c4c83a32e617ae15e7e76d25cae691bc787292f5be9474f2470d657d34ae9153ed22e313296478a8c

Download Submit
C:\Windows\System\JypXhVF.exe

Filesize
1.3MB

MD5
1ea0441bf44322b772863e9697e65dd3

SHA1
52992d22018e3ae5243fc3d2b726938380625a19

SHA256
0023847a469e1f31d57ebddf90f766aeee1ae519210c114c48a84e14c7925c83

SHA512
b18554b892c12512e8764e0536f038e68f1b9712320dc447c573ffe6b8c3b15734db6078686cdfbef19f85a5337a3ec3f4b649d5cd3de3b59d3df9124487eaf5

Download Submit
C:\Windows\System\KXFlBqk.exe

Filesize
1.3MB

MD5
637e871b089940a2b7883377cc316e1f

SHA1
82604fa839aacea0e7abb2eb6f0652c44a7a3ca9

SHA256
a88b8147b91c6e50cb292e28359f8a9cb3be92217e4f6a977cdae66e6436f1a8

SHA512
f06cf8deffafb96a91884e7e00ed954d476a4b08da0315d515663d7f4ecab22bfcf17278f4d591d6365761054d5d7610a11fb4a42454313a40356dd3396c3e8b

Download Submit
C:\Windows\System\KhNasnr.exe

Filesize
1.3MB

MD5
2b18c6df48c357c8afddd16d21f7e162

SHA1
9e824324ca326348ce0d19bf5d3a67b368ae2118

SHA256
7cde3e4d1d80e1b244966a255c2991dd413b8c230b7fe9b7eac945be06ce304d

SHA512
c986d1018f2647992f09091d18b16b7d939cd10b6d0631a748bd23101e4964b643a3eaed4310bf04d0c1b4e5542c616dd703ce102c7142a78be7be54cce6420f

Download Submit
C:\Windows\System\MVhPnSt.exe

Filesize
1.3MB

MD5
84ad2930268b0d96d9e6b4b81bd7603d

SHA1
5d235fb9a0b1254d4b8eef623e8dcd331683be1d

SHA256
54492d53b4b81bc609839cca265a3bd03575e34cb551b72b8bd16d3ef700131c

SHA512
76d2d48c4639d526431cb7c66d90ff692b7c809e26e6d507fb4a5116be73deb5bb5a28f8bd6cadc8e281c3ea2bbfb782c7dacda5517774492f93ff149fc252a9

Download Submit
C:\Windows\System\QlXKkFf.exe

Filesize
1.3MB

MD5
b548df0cd0351d42a8639e894fb4e3af

SHA1
7a9715492fb5e9b984dd7a69f55d94a91d6cffea

SHA256
41c3fba5f2de0b2d69d610b82094514fc9ec0bf50dca8d5a4ca744946ba7fbc8

SHA512
1ae55f144f38243e6dae464779a0ae232a1c5d700ac338080e7357b8b6b00c0e23f53daf5413ade9bcad8a216e74ef3ad3e048c627165bff19ae282a3a87ef2f

Download Submit
C:\Windows\System\RtdvBlK.exe

Filesize
1.3MB

MD5
11c6f1d42ab2a0ba90561b1c6b7e5e6b

SHA1
dfdfed1f0a074a75e874c7899694fa1b6c424901

SHA256
6390511e1de192ab403bf0937f23203af6fdd76157cf365f02e5c00c80c128a0

SHA512
5f70866ed28e76bbf0c58e0d19fe1392f054a723d58949462b29045bbd3408f19cf2fca4a3abc0a124ea6b0e3f6250c942e46f26fcb6cc4e463cb233dc453417

Download Submit
C:\Windows\System\TfBcDlX.exe

Filesize
1.3MB

MD5
cd86d7ef51cdbbcf992fc63f80039dc2

SHA1
f0837213fe46f560498fbc6e6440e1480b4116b5

SHA256
3bea8a73fd6d7f2d3d31ce9c3619ea08468147ff9da07421d99222e359db6c72

SHA512
20968d1523b63eab4fda88646650e96ac1d02ef699f86bb124f9482757e980e192441795c06401ea93c53161032eef17be692d2bd155f722fd86327e07bd1f88

Download Submit
C:\Windows\System\XBobzbu.exe

Filesize
1.3MB

MD5
70fc09295d6c789f7ee8eb8544cd45ba

SHA1
239728a9702a4a270aa67648a7029ceb406df0c5

SHA256
deb7ec1715c2ef8c07e5657a065362c3068c984f061543db327381c534db9258

SHA512
6425fb95f85c18ac834c3f4b7a1aab6cf38da6f638060f6127d6ec6150adc4e075a7619fdbcad2a15a3123ac9ff49a9a6efe19820536c258b0ab6cc84d9cd8dd

Download Submit
C:\Windows\System\ZaEEnsd.exe

Filesize
1.3MB

MD5
271d085232405af49ec34bc96e5b994c

SHA1
b615363ed2746a445d038752d38af804bd683378

SHA256
ac643bb0186d67e278e368463162a735d7384a0a06594fe26e1cacae72c9258e

SHA512
59ea2146cd32e316710dba75ba60d3b61243167095e608db79c6e023e3b4703bbaf0304ecef71cf451246a4a729454747f67313e6c6601621db8aa9ccd64925c

Download Submit
C:\Windows\System\aELmxGk.exe

Filesize
1.3MB

MD5
041ad6936c830aac3d4c6260cb488a28

SHA1
2cacd06e3ddfa5a74512ba1f98cdf0b7f7f57cc8

SHA256
5a08ff7b45a3a99d2e6a970cc3409a8c7e346a413760229a2a7429b95775d923

SHA512
fc5de2a6e8b57a7b91c1c2d8f13623ee0befaf2dcae19606611aa93279bb00531f001b7ff4af45a110f20dcb09e04757de4e28b3e6c2e55074b94261454e182b

Download Submit
C:\Windows\System\diFiDLw.exe

Filesize
1.3MB

MD5
a686ea046c3ef27dca3d471ffd1384fa

SHA1
19249e887d58361d11761e40081784a6ea59d973

SHA256
c519cdc931087a65346dc4f95187db85cde8644e9b58f8ff535bbb0432e8bc35

SHA512
08c67b4b997bd983453aa22f527da0610bbb46f0480b9428012149bf141e8ae81c705c08309e0d4a2ae42e00e88ea9db3275c0f4ef5168adc78c914c32c3047e

Download Submit
C:\Windows\System\dnSHctq.exe

Filesize
1.3MB

MD5
860787c94729dfca7333b59083ed7ec5

SHA1
1a8113284048f13055d155a09200636549462edb

SHA256
ea7676e077efe5c4a626b11e75eef330d2bf9f3b4e202e26583a358b0613359a

SHA512
c1d48924f056d7843d091e99d085213b398f74310612261c774bf04f2a57cd34dda609827b949754859a4f3f2fdb30ed0ebd6395790edcb7d00fbcc888912567

Download Submit
C:\Windows\System\fzdyQHJ.exe

Filesize
1.3MB

MD5
1c1f3fb3b43ba23bf2ef9432e57667e3

SHA1
f22ac1298c195b833b03235b995f79dc38cd0806

SHA256
8111fa89826f23ac0fa764037da770584fcd4c412408e9a6af372d2e110fb762

SHA512
d4ef1cc64e9f56dd123e6371b3dd50b833dd695e5785d9819cd2cb9141d1925e99989ec670cb83b4ff230fde45de88ec3318a7d838582ffd404ca2a947571e48

Download Submit
C:\Windows\System\gfrkASm.exe

Filesize
1.3MB

MD5
24b3fd2f4f45f03c7e435441dd301ea9

SHA1
efd082000739e2a352d35f5015d71ccb20dc840b

SHA256
fbe5b3f594df06ad937ea850820151ce824700fd163a585ad981bcece8a9c494

SHA512
95ddc084a6e5f18a067a99e463d45810a3aa4c0fa067a7a3542447c4d734291c319a1ece1930994b51496d0fb2da1e239b04f4f92f450c3436492eff1f076cd0

Download Submit
C:\Windows\System\hOsoEsq.exe

Filesize
1.3MB

MD5
1c88fc6e1e46c22897299bcf71dd4f1d

SHA1
124bff3cda40c374141c9b273d3ba87e21d28a57

SHA256
4163ffe8885ff8c4fa4cf85b769253aac0631616f3f5b06754fd0f94bc508499

SHA512
32f7a96845aa41be2f12d30783533edaca339c0e7127d629e146b68351b2e108cc40d2eeb2a6c2640d56da489661da5e430da35b8144a1b9c99bbc8375a29b86

Download Submit
C:\Windows\System\iQjmzez.exe

Filesize
1.3MB

MD5
32d9bd60ce17ebfaddda141177874a9f

SHA1
2205ad3129dfeae90bd1edc34d941ffd20b383cc

SHA256
2a5a7ad2273c595723b48611c84b7b446c0b82a7273bf5079156ca0be92a63fd

SHA512
e32432f5b1229a1f2c63005c4473b72d5c3667e49ba0ec46f9cde9e0efa62d963ff1c82cdafdd750c856d1506419b0e0b19190b2da71b01000ffe8fac0958caf

Download Submit
C:\Windows\System\kTmnqWO.exe

Filesize
1.3MB

MD5
cbf983271d9eb9f85abf35a752ac641f

SHA1
c1fc38b37e8f0000742c77deb8082ff74414a82c

SHA256
80a6a86a9b9d96df0a7d6fc43a5bddae5d32486dcb2a95e6af57a83f395a4ece

SHA512
86843274c9994f1bdfc9ea5068185f76ff34d48b4403207fb129a82b882cf90d8ac17ac834ed15ed53d83312fb5fb338e2a7b631c629a5a36d711297ffedeaf7

Download Submit
C:\Windows\System\kmKvSuQ.exe

Filesize
1.3MB

MD5
ad835c6172e05e1c6d3d9f14b784a2e6

SHA1
9b3e01446f7eb9f1ceb5084c46e809cea9b59e2f

SHA256
1d83e34bdb5d61c76bbff1b4ca569f7a8639bbeb0105bd2ecf266a766f80115b

SHA512
d27ee397290d0cd77f5bd319194a40f9fc866580f3f70ec60ef35fc36e59401d604ddd71ca35483882d4ffa12c43f2410545457426f0b8871f7b4496b4e504b5

Download Submit
C:\Windows\System\nwzTzVm.exe

Filesize
1.3MB

MD5
e5bcbe6a005c462d7765801f9683d482

SHA1
7be1dca5599968a290131030d1b7bd0738201d34

SHA256
9d85558d7d0487e15fb5aa800d2c796740921b5e7237cc916f1d3f81008af42d

SHA512
0e443d4bc6aae8b049c1e76160d376385f2877de28133578683588f3203c0b13e5026f598e83074f54b5c912f80c08f3d6aae3cb539c6141174ffd586e8cc9a2

Download Submit
C:\Windows\System\oNBsFJe.exe

Filesize
1.3MB

MD5
a3dba2c6f488d00aa9df623b316259f0

SHA1
6af4e13f59fea983c0308c320df6102407e318ee

SHA256
44e0abdd7ec3ca8181b55670d9bb568668958c6ec721a1141bd49be0a3b6bfb4

SHA512
4ba1e68ef5c998dbe89ba42387531118ee96020c8653dacee0408113f4117276d3fb763c64718697baf918b7e0330e547281f2d2ac89b8e070286f60baba3a42

Download Submit
C:\Windows\System\oVIoDGP.exe

Filesize
1.3MB

MD5
5c780eaec7fd537796c379de38ca5c30

SHA1
6fecac25a9ba5d7b47cc01dbccd37b82421561b1

SHA256
831515ddcaec29934c1f5647ed40c3432701719455a5db6df6172e3bfb249829

SHA512
23bfc1d8ea9c907d4f0e97adf98a3d833cc060a265e8c409d0779cf445a7fa0dfc6b67941dcdeacfbf178be4854df7025d9cf0296cc2a588ed8c73ebfba95dff

Download Submit
C:\Windows\System\qptNyEq.exe

Filesize
1.3MB

MD5
6e5f001e0b956c832a75052012642874

SHA1
b02819b597c43da9a3b4b2d97db15dd000d37fb9

SHA256
98889f9a42c274e46e72a89fa2f1b1ea9de44bd61201250c7c3ded844d00cc08

SHA512
d4ea56dc62fadef9e11e14d0af5916ffe39efb77d3921992b902403131ea07c2df0de2ce63729c21a66cd386ce7a2181349c5ab2519b8908e10c689b5d095251

Download Submit
C:\Windows\System\rGhYTcx.exe

Filesize
1.3MB

MD5
c6ea99fae65e7c9e85e8677084199734

SHA1
51b9a5c61c6c3089f263d479e92d0326c4b19c9f

SHA256
915d38ed991d47085692bbcf7d5dcd3a51203c8b6a7f87bb2e121867e471c786

SHA512
b721d1c0174648ff7cfc2f22f9f3a48d20c01e60145ac5a56ee82dd364a7565b193df4a4009767b6c662d4fa520e78f1b068da023d0207dccf55dfab508a25bc

Download Submit
C:\Windows\System\tWtTjCN.exe

Filesize
1.3MB

MD5
c8121d25b973cdff752e196a8ed54e2d

SHA1
2652a491a4bd55a2ed745668f3df228be53ee7e4

SHA256
1d94c5e43bf1a98c613b2b0f93985386fdb486785c1df8d0b854c006c10b62e4

SHA512
8b6e78acf2783208130846d3d41ed7260b938b56d1bc1e1880492daa08684ad0efa97d8740e303167e13fab18515eda0482d59d0993d145ae8451c583efcf5b6

Download Submit
C:\Windows\System\uWcFzVP.exe

Filesize
1.3MB

MD5
488b91e94333062b8a7c251075e82054

SHA1
a5c73658474aedfa18e0d10fd283c83fddea5d02

SHA256
896b00f9740624bba7251a39b28030b0f03447bf9e0eb144d70639dc03eb978a

SHA512
10eba482f49986d7a0966805c83718ee8bfae01c9488f4ea4a7ae37f595024625ce9a00798c5fee39b6f26506a3e2849d0b2320b6b132697e96c5a7b6b185cca

Download Submit
C:\Windows\System\yOuGsjI.exe

Filesize
1.3MB

MD5
bc0f4fd69a55d08c0579c6519fa2f792

SHA1
45e433bbc208a42e3ac90214552e17c802f566d7

SHA256
00769596af6d9d2486b719dc52c2af620a314437dadda909a793c6fb1249471c

SHA512
426b9e1478c4155a64ef714439427fb171aa6a091efcdc9f34b893fabefcfdb608dc13716d9d8135fcb88fe48aa0dbf79efd46a97b268a316d50e9642f1c1b9f

Download Submit
C:\Windows\System\zrMDVRJ.exe

Filesize
1.3MB

MD5
801f7c4e6d51b23207fd78fc3201c553

SHA1
cdf8e1638f30b5cc5618b7bd96839b05a6ab1f2a

SHA256
bfdbdac62e5edcf439644dbd089c93ac4d687ed424720386e029a15e8431e81c

SHA512
f2ef86dd994943ddbf8b187fe4f86b30e7b372bdd8e19e3e1b4cbdeac44b2bad9618a876765aa771e963d24fe7608f262413aebe3578d85f264667e8b946c099

Download Submit
C:\Windows\System\zxjfjAG.exe

Filesize
1.3MB

MD5
cc6af1467f7890c1fd1c011bdd9561fc

SHA1
0f02a7509768589dab6ff62282c4e19b710f8070

SHA256
1a7e9d37824485e2e794d755ff1bdb94dd48a91f2646eab37d1c1e7fe35e6e40

SHA512
1dd2ae49634d639fe64804865eba21abcc16547b0256ddfa355e20c4bf3cbe1672510556f1c65d4db1dbcd115c6e312277b7f715480dbb975c40a887e0673b22

Download Submit
memory/436-2226-0x00007FF7D6A20000-0x00007FF7D6D71000-memory.dmp

Filesize
3.3MB

Download
memory/436-264-0x00007FF7D6A20000-0x00007FF7D6D71000-memory.dmp

Filesize
3.3MB

Download
memory/676-2246-0x00007FF7567A0000-0x00007FF756AF1000-memory.dmp

Filesize
3.3MB

Download
memory/676-677-0x00007FF7567A0000-0x00007FF756AF1000-memory.dmp

Filesize
3.3MB

Download
memory/1004-2242-0x00007FF61DBA0000-0x00007FF61DEF1000-memory.dmp

Filesize
3.3MB

Download
memory/1004-678-0x00007FF61DBA0000-0x00007FF61DEF1000-memory.dmp

Filesize
3.3MB

Download
memory/1112-2219-0x00007FF7F3390000-0x00007FF7F36E1000-memory.dmp

Filesize
3.3MB

Download
memory/1112-2206-0x00007FF7F3390000-0x00007FF7F36E1000-memory.dmp

Filesize
3.3MB

Download
memory/1112-23-0x00007FF7F3390000-0x00007FF7F36E1000-memory.dmp

Filesize
3.3MB

Download
memory/1128-2220-0x00007FF6417C0000-0x00007FF641B11000-memory.dmp

Filesize
3.3MB

Download
memory/1128-73-0x00007FF6417C0000-0x00007FF641B11000-memory.dmp

Filesize
3.3MB

Download
memory/1400-2260-0x00007FF73F980000-0x00007FF73FCD1000-memory.dmp

Filesize
3.3MB

Download
memory/1400-178-0x00007FF73F980000-0x00007FF73FCD1000-memory.dmp

Filesize
3.3MB

Download
memory/1400-2210-0x00007FF73F980000-0x00007FF73FCD1000-memory.dmp

Filesize
3.3MB

Download
memory/1640-2223-0x00007FF764D50000-0x00007FF7650A1000-memory.dmp

Filesize
3.3MB

Download
memory/1640-2207-0x00007FF764D50000-0x00007FF7650A1000-memory.dmp

Filesize
3.3MB

Download
memory/1640-41-0x00007FF764D50000-0x00007FF7650A1000-memory.dmp

Filesize
3.3MB

Download
memory/1716-2208-0x00007FF6F2650000-0x00007FF6F29A1000-memory.dmp

Filesize
3.3MB

Download
memory/1716-2238-0x00007FF6F2650000-0x00007FF6F29A1000-memory.dmp

Filesize
3.3MB

Download
memory/1716-103-0x00007FF6F2650000-0x00007FF6F29A1000-memory.dmp

Filesize
3.3MB

Download
memory/1864-682-0x00007FF7E1B90000-0x00007FF7E1EE1000-memory.dmp

Filesize
3.3MB

Download
memory/1864-2268-0x00007FF7E1B90000-0x00007FF7E1EE1000-memory.dmp

Filesize
3.3MB

Download
memory/1964-2240-0x00007FF7AACC0000-0x00007FF7AB011000-memory.dmp

Filesize
3.3MB

Download
memory/1964-675-0x00007FF7AACC0000-0x00007FF7AB011000-memory.dmp

Filesize
3.3MB

Download
memory/2052-683-0x00007FF7E6540000-0x00007FF7E6891000-memory.dmp

Filesize
3.3MB

Download
memory/2052-2262-0x00007FF7E6540000-0x00007FF7E6891000-memory.dmp

Filesize
3.3MB

Download
memory/2120-2265-0x00007FF6993F0000-0x00007FF699741000-memory.dmp

Filesize
3.3MB

Download
memory/2120-687-0x00007FF6993F0000-0x00007FF699741000-memory.dmp

Filesize
3.3MB

Download
memory/2204-680-0x00007FF72A1C0000-0x00007FF72A511000-memory.dmp

Filesize
3.3MB

Download
memory/2204-2250-0x00007FF72A1C0000-0x00007FF72A511000-memory.dmp

Filesize
3.3MB

Download
memory/2284-684-0x00007FF623C90000-0x00007FF623FE1000-memory.dmp

Filesize
3.3MB

Download
memory/2284-2272-0x00007FF623C90000-0x00007FF623FE1000-memory.dmp

Filesize
3.3MB

Download
memory/2724-114-0x00007FF6916C0000-0x00007FF691A11000-memory.dmp

Filesize
3.3MB

Download
memory/2724-2209-0x00007FF6916C0000-0x00007FF691A11000-memory.dmp

Filesize
3.3MB

Download
memory/2724-2233-0x00007FF6916C0000-0x00007FF691A11000-memory.dmp

Filesize
3.3MB

Download
memory/2832-2279-0x00007FF72C320000-0x00007FF72C671000-memory.dmp

Filesize
3.3MB

Download
memory/2832-686-0x00007FF72C320000-0x00007FF72C671000-memory.dmp

Filesize
3.3MB

Download
memory/2912-2244-0x00007FF6DFBD0000-0x00007FF6DFF21000-memory.dmp

Filesize
3.3MB

Download
memory/2912-679-0x00007FF6DFBD0000-0x00007FF6DFF21000-memory.dmp

Filesize
3.3MB

Download
memory/3056-685-0x00007FF772950000-0x00007FF772CA1000-memory.dmp

Filesize
3.3MB

Download
memory/3056-2225-0x00007FF772950000-0x00007FF772CA1000-memory.dmp

Filesize
3.3MB

Download
memory/3116-2230-0x00007FF7F4BA0000-0x00007FF7F4EF1000-memory.dmp

Filesize
3.3MB

Download
memory/3116-688-0x00007FF7F4BA0000-0x00007FF7F4EF1000-memory.dmp

Filesize
3.3MB

Download
memory/3360-2283-0x00007FF63EFC0000-0x00007FF63F311000-memory.dmp

Filesize
3.3MB

Download
memory/3360-689-0x00007FF63EFC0000-0x00007FF63F311000-memory.dmp

Filesize
3.3MB

Download
memory/3428-2236-0x00007FF6017F0000-0x00007FF601B41000-memory.dmp

Filesize
3.3MB

Download
memory/3428-440-0x00007FF6017F0000-0x00007FF601B41000-memory.dmp

Filesize
3.3MB

Download
memory/3604-2248-0x00007FF6A4B90000-0x00007FF6A4EE1000-memory.dmp

Filesize
3.3MB

Download
memory/3604-676-0x00007FF6A4B90000-0x00007FF6A4EE1000-memory.dmp

Filesize
3.3MB

Download
memory/3668-265-0x00007FF7C4410000-0x00007FF7C4761000-memory.dmp

Filesize
3.3MB

Download
memory/3668-2228-0x00007FF7C4410000-0x00007FF7C4761000-memory.dmp

Filesize
3.3MB

Download
memory/3752-443-0x00007FF6FABE0000-0x00007FF6FAF31000-memory.dmp

Filesize
3.3MB

Download
memory/3752-2267-0x00007FF6FABE0000-0x00007FF6FAF31000-memory.dmp

Filesize
3.3MB

Download
memory/3956-13-0x00007FF6FE910000-0x00007FF6FEC61000-memory.dmp

Filesize
3.3MB

Download
memory/3956-2216-0x00007FF6FE910000-0x00007FF6FEC61000-memory.dmp

Filesize
3.3MB

Download
memory/4108-221-0x00007FF6D30B0000-0x00007FF6D3401000-memory.dmp

Filesize
3.3MB

Download
memory/4108-2235-0x00007FF6D30B0000-0x00007FF6D3401000-memory.dmp

Filesize
3.3MB

Download
memory/4368-1-0x0000020A1F020000-0x0000020A1F030000-memory.dmp

Filesize
64KB

Download
memory/4368-2109-0x00007FF64AB40000-0x00007FF64AE91000-memory.dmp

Filesize
3.3MB

Download
memory/4368-0-0x00007FF64AB40000-0x00007FF64AE91000-memory.dmp

Filesize
3.3MB

Download
memory/4572-674-0x00007FF6A8B60000-0x00007FF6A8EB1000-memory.dmp

Filesize
3.3MB

Download
memory/4572-2257-0x00007FF6A8B60000-0x00007FF6A8EB1000-memory.dmp

Filesize
3.3MB

Download
memory/4780-681-0x00007FF78E200000-0x00007FF78E551000-memory.dmp

Filesize
3.3MB

Download
memory/4780-2252-0x00007FF78E200000-0x00007FF78E551000-memory.dmp

Filesize
3.3MB

Download
memory/4848-343-0x00007FF66C060000-0x00007FF66C3B1000-memory.dmp

Filesize
3.3MB

Download
memory/4848-2290-0x00007FF66C060000-0x00007FF66C3B1000-memory.dmp

Filesize
3.3MB

Download