xmrig | 6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2

Analysis

max time kernel
96s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
Size

2.5MB
MD5

b50b642e49d8007c591591fd6885ea70
SHA1

656d71c8b3062b970abcdf5651f7973a3a565866
SHA256

6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2
SHA512

b6cc172e2c6d0cf272b56a4a68ee0d2bc5c830d908567c7fb54f98c2848eb248d1da84546a5f810ba92625d1916b3bf10e8f2ba3e4d3a00a8abf2165814f656f
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQUUvXjVTXptRmKWXkO1t7XSXRB96:BemTLkNdfE0pZrQu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1504-0-0x00007FF6C2E50000-0x00007FF6C31A4000-memory.dmp	xmrig
behavioral2/files/0x00090000000233ed-5.dat	xmrig
behavioral2/files/0x00070000000233f1-10.dat	xmrig
behavioral2/files/0x00070000000233f6-38.dat	xmrig
behavioral2/files/0x00070000000233f9-58.dat	xmrig
behavioral2/files/0x00070000000233fb-67.dat	xmrig
behavioral2/files/0x00070000000233fc-82.dat	xmrig
behavioral2/files/0x00070000000233fd-110.dat	xmrig
behavioral2/files/0x0007000000023402-128.dat	xmrig
behavioral2/files/0x0007000000023406-150.dat	xmrig
behavioral2/files/0x000700000002340b-180.dat	xmrig
behavioral2/files/0x0007000000023404-192.dat	xmrig
behavioral2/memory/4704-270-0x00007FF6B70D0000-0x00007FF6B7424000-memory.dmp	xmrig
behavioral2/memory/4548-281-0x00007FF7409A0000-0x00007FF740CF4000-memory.dmp	xmrig
behavioral2/memory/3092-280-0x00007FF729D50000-0x00007FF72A0A4000-memory.dmp	xmrig
behavioral2/memory/4692-279-0x00007FF6FF270000-0x00007FF6FF5C4000-memory.dmp	xmrig
behavioral2/memory/732-278-0x00007FF7F02C0000-0x00007FF7F0614000-memory.dmp	xmrig
behavioral2/memory/2580-265-0x00007FF750CE0000-0x00007FF751034000-memory.dmp	xmrig
behavioral2/memory/5044-264-0x00007FF658160000-0x00007FF6584B4000-memory.dmp	xmrig
behavioral2/memory/1692-262-0x00007FF6F9770000-0x00007FF6F9AC4000-memory.dmp	xmrig
behavioral2/memory/1096-261-0x00007FF717400000-0x00007FF717754000-memory.dmp	xmrig
behavioral2/memory/4748-218-0x00007FF687E90000-0x00007FF6881E4000-memory.dmp	xmrig
behavioral2/memory/116-188-0x00007FF62B340000-0x00007FF62B694000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-185.dat	xmrig
behavioral2/files/0x0007000000023410-179.dat	xmrig
behavioral2/files/0x000700000002340f-177.dat	xmrig
behavioral2/files/0x000700000002340a-176.dat	xmrig
behavioral2/files/0x0007000000023409-172.dat	xmrig
behavioral2/memory/4472-194-0x00007FF7223A0000-0x00007FF7226F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-169.dat	xmrig
behavioral2/files/0x000700000002340e-168.dat	xmrig
behavioral2/files/0x0007000000023413-191.dat	xmrig
behavioral2/memory/1640-159-0x00007FF75B820000-0x00007FF75BB74000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-152.dat	xmrig
behavioral2/files/0x0007000000023405-144.dat	xmrig
behavioral2/files/0x000700000002340d-165.dat	xmrig
behavioral2/files/0x0007000000023403-142.dat	xmrig
behavioral2/files/0x00070000000233ff-141.dat	xmrig
behavioral2/memory/1584-162-0x00007FF7D25C0000-0x00007FF7D2914000-memory.dmp	xmrig
behavioral2/memory/1740-139-0x00007FF69AAD0000-0x00007FF69AE24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023400-134.dat	xmrig
behavioral2/memory/1504-944-0x00007FF6C2E50000-0x00007FF6C31A4000-memory.dmp	xmrig
behavioral2/memory/1776-2121-0x00007FF735C50000-0x00007FF735FA4000-memory.dmp	xmrig
behavioral2/memory/4988-2123-0x00007FF7D0480000-0x00007FF7D07D4000-memory.dmp	xmrig
behavioral2/memory/3916-2124-0x00007FF605CA0000-0x00007FF605FF4000-memory.dmp	xmrig
behavioral2/memory/3468-2125-0x00007FF7B83F0000-0x00007FF7B8744000-memory.dmp	xmrig
behavioral2/memory/2716-2126-0x00007FF6D4CB0000-0x00007FF6D5004000-memory.dmp	xmrig
behavioral2/memory/1640-2128-0x00007FF75B820000-0x00007FF75BB74000-memory.dmp	xmrig
behavioral2/memory/1328-2127-0x00007FF677E00000-0x00007FF678154000-memory.dmp	xmrig
behavioral2/memory/4908-2122-0x00007FF6D6E10000-0x00007FF6D7164000-memory.dmp	xmrig
behavioral2/memory/1740-2131-0x00007FF69AAD0000-0x00007FF69AE24000-memory.dmp	xmrig
behavioral2/memory/448-2130-0x00007FF7CC330000-0x00007FF7CC684000-memory.dmp	xmrig
behavioral2/memory/4780-2129-0x00007FF7DDA50000-0x00007FF7DDDA4000-memory.dmp	xmrig
behavioral2/memory/1328-126-0x00007FF677E00000-0x00007FF678154000-memory.dmp	xmrig
behavioral2/files/0x0007000000023401-124.dat	xmrig
behavioral2/files/0x0007000000023407-120.dat	xmrig
behavioral2/memory/2716-119-0x00007FF6D4CB0000-0x00007FF6D5004000-memory.dmp	xmrig
behavioral2/memory/3468-107-0x00007FF7B83F0000-0x00007FF7B8744000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-93.dat	xmrig
behavioral2/memory/448-90-0x00007FF7CC330000-0x00007FF7CC684000-memory.dmp	xmrig
behavioral2/memory/4780-83-0x00007FF7DDA50000-0x00007FF7DDDA4000-memory.dmp	xmrig
behavioral2/memory/1480-80-0x00007FF71C1D0000-0x00007FF71C524000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f7-65.dat	xmrig
behavioral2/files/0x00070000000233fa-62.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2912	fFpuPHp.exe
4552	TIYikuc.exe
400	hmWEeyE.exe
5032	sULsBZe.exe
1776	jMqiCIQ.exe
4908	ukurtkp.exe
4988	TYVksun.exe
5044	XhMxzYF.exe
3916	dEkeMAc.exe
2580	cJWfmhG.exe
1480	EDmUoPu.exe
4704	lQwPwvs.exe
4780	XVcVftj.exe
448	acVHwpH.exe
3468	JdKobMb.exe
732	dygoWDs.exe
2716	KEqzdZY.exe
1328	okvbrwA.exe
1740	iCXABId.exe
1640	mYIYOYV.exe
4692	CYdeufz.exe
1584	JFwOjOQ.exe
116	qmTYAGB.exe
3092	iTRmrMY.exe
4472	FiZeJYW.exe
4748	ZJfZoXm.exe
1096	MNItAGw.exe
4548	RbHNTJR.exe
1692	fOhhiND.exe
2780	NKRQHaP.exe
1232	mawSRBG.exe
2108	KgFEQaL.exe
760	GoQRPYY.exe
4968	TOmIkCN.exe
4092	sQYTOcV.exe
4952	ekWLejf.exe
692	VTnnvcl.exe
2864	ZJRlhuC.exe
312	nraMJxE.exe
2324	HgHEqVk.exe
2292	agdDkxt.exe
4520	wrREjUK.exe
3960	QxJonZi.exe
2948	NkzVfbx.exe
3336	nPgaVzl.exe
3692	eNILQYA.exe
2888	SleACau.exe
4212	gQhfoJM.exe
4412	SYiprDY.exe
3348	SadmtWj.exe
2956	HqHAFIE.exe
3620	sbiyeTZ.exe
3556	LfcNSsG.exe
4772	CROgRXK.exe
3904	IbNkHvQ.exe
4920	caNrwSL.exe
4540	sBBFdcl.exe
2820	dGgzWGr.exe
2312	oGVmhTy.exe
5116	HuVBPMh.exe
1192	EeNnDOg.exe
4592	OFAcqmc.exe
2152	QMpktGB.exe
2608	HEClBkZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1504-0-0x00007FF6C2E50000-0x00007FF6C31A4000-memory.dmp	upx
behavioral2/files/0x00090000000233ed-5.dat	upx
behavioral2/files/0x00070000000233f1-10.dat	upx
behavioral2/files/0x00070000000233f6-38.dat	upx
behavioral2/files/0x00070000000233f9-58.dat	upx
behavioral2/files/0x00070000000233fb-67.dat	upx
behavioral2/files/0x00070000000233fc-82.dat	upx
behavioral2/files/0x00070000000233fd-110.dat	upx
behavioral2/files/0x0007000000023402-128.dat	upx
behavioral2/files/0x0007000000023406-150.dat	upx
behavioral2/files/0x000700000002340b-180.dat	upx
behavioral2/files/0x0007000000023404-192.dat	upx
behavioral2/memory/4704-270-0x00007FF6B70D0000-0x00007FF6B7424000-memory.dmp	upx
behavioral2/memory/4548-281-0x00007FF7409A0000-0x00007FF740CF4000-memory.dmp	upx
behavioral2/memory/3092-280-0x00007FF729D50000-0x00007FF72A0A4000-memory.dmp	upx
behavioral2/memory/4692-279-0x00007FF6FF270000-0x00007FF6FF5C4000-memory.dmp	upx
behavioral2/memory/732-278-0x00007FF7F02C0000-0x00007FF7F0614000-memory.dmp	upx
behavioral2/memory/2580-265-0x00007FF750CE0000-0x00007FF751034000-memory.dmp	upx
behavioral2/memory/5044-264-0x00007FF658160000-0x00007FF6584B4000-memory.dmp	upx
behavioral2/memory/1692-262-0x00007FF6F9770000-0x00007FF6F9AC4000-memory.dmp	upx
behavioral2/memory/1096-261-0x00007FF717400000-0x00007FF717754000-memory.dmp	upx
behavioral2/memory/4748-218-0x00007FF687E90000-0x00007FF6881E4000-memory.dmp	upx
behavioral2/memory/116-188-0x00007FF62B340000-0x00007FF62B694000-memory.dmp	upx
behavioral2/files/0x0007000000023411-185.dat	upx
behavioral2/files/0x0007000000023410-179.dat	upx
behavioral2/files/0x000700000002340f-177.dat	upx
behavioral2/files/0x000700000002340a-176.dat	upx
behavioral2/files/0x0007000000023409-172.dat	upx
behavioral2/memory/4472-194-0x00007FF7223A0000-0x00007FF7226F4000-memory.dmp	upx
behavioral2/files/0x0007000000023408-169.dat	upx
behavioral2/files/0x000700000002340e-168.dat	upx
behavioral2/files/0x0007000000023413-191.dat	upx
behavioral2/memory/1640-159-0x00007FF75B820000-0x00007FF75BB74000-memory.dmp	upx
behavioral2/files/0x000700000002340c-152.dat	upx
behavioral2/files/0x0007000000023405-144.dat	upx
behavioral2/files/0x000700000002340d-165.dat	upx
behavioral2/files/0x0007000000023403-142.dat	upx
behavioral2/files/0x00070000000233ff-141.dat	upx
behavioral2/memory/1584-162-0x00007FF7D25C0000-0x00007FF7D2914000-memory.dmp	upx
behavioral2/memory/1740-139-0x00007FF69AAD0000-0x00007FF69AE24000-memory.dmp	upx
behavioral2/files/0x0007000000023400-134.dat	upx
behavioral2/memory/1504-944-0x00007FF6C2E50000-0x00007FF6C31A4000-memory.dmp	upx
behavioral2/memory/1776-2121-0x00007FF735C50000-0x00007FF735FA4000-memory.dmp	upx
behavioral2/memory/4988-2123-0x00007FF7D0480000-0x00007FF7D07D4000-memory.dmp	upx
behavioral2/memory/3916-2124-0x00007FF605CA0000-0x00007FF605FF4000-memory.dmp	upx
behavioral2/memory/3468-2125-0x00007FF7B83F0000-0x00007FF7B8744000-memory.dmp	upx
behavioral2/memory/2716-2126-0x00007FF6D4CB0000-0x00007FF6D5004000-memory.dmp	upx
behavioral2/memory/1640-2128-0x00007FF75B820000-0x00007FF75BB74000-memory.dmp	upx
behavioral2/memory/1328-2127-0x00007FF677E00000-0x00007FF678154000-memory.dmp	upx
behavioral2/memory/4908-2122-0x00007FF6D6E10000-0x00007FF6D7164000-memory.dmp	upx
behavioral2/memory/1740-2131-0x00007FF69AAD0000-0x00007FF69AE24000-memory.dmp	upx
behavioral2/memory/448-2130-0x00007FF7CC330000-0x00007FF7CC684000-memory.dmp	upx
behavioral2/memory/4780-2129-0x00007FF7DDA50000-0x00007FF7DDDA4000-memory.dmp	upx
behavioral2/memory/1328-126-0x00007FF677E00000-0x00007FF678154000-memory.dmp	upx
behavioral2/files/0x0007000000023401-124.dat	upx
behavioral2/files/0x0007000000023407-120.dat	upx
behavioral2/memory/2716-119-0x00007FF6D4CB0000-0x00007FF6D5004000-memory.dmp	upx
behavioral2/memory/3468-107-0x00007FF7B83F0000-0x00007FF7B8744000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-93.dat	upx
behavioral2/memory/448-90-0x00007FF7CC330000-0x00007FF7CC684000-memory.dmp	upx
behavioral2/memory/4780-83-0x00007FF7DDA50000-0x00007FF7DDDA4000-memory.dmp	upx
behavioral2/memory/1480-80-0x00007FF71C1D0000-0x00007FF71C524000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-65.dat	upx
behavioral2/files/0x00070000000233fa-62.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OGjCLjL.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\YFQuDMd.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\UKZxEuO.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\LVyKYgT.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\CYdeufz.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\oOSfGKq.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\cLEwEIV.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\eKrnIeB.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\RnCQMIK.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\iTRmrMY.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\dFonvTm.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\JeOHDYt.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\YRERAAr.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\iGSRCxp.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\sPPGBDl.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\MewHWNx.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\lZQgqbC.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\dugWyUn.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\wyLSQuz.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\upDYjsX.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\uWkfRSC.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\QMbjJEZ.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\NoiMnpR.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\jpivkOB.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\dNqevTr.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\WSPQrtz.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\XdPlMZw.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\BmGpBVK.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\mURQUAp.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\lJYlUYW.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\rshMnFL.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\OFHFIBu.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\FFqnpXo.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\NKRQHaP.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\WQTdeRm.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\viRfWOp.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\oQlzkEA.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\mKHmdfz.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\dEuMLDW.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\dqbUJfP.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\REaaiGS.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\fFSrVAw.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\EhyHiFi.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\bPThGyC.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\gYWbxMb.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\UacbYSM.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\dbjTkDc.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\pIKDUFw.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\yMmVkiN.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\AhyNDkz.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\DzGmmSA.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\RAVvLCI.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\fvHpvLR.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\zNbIyCT.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\nkZtVxH.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\WlRXINp.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\dsCgICa.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\LvASuUq.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\TxwZNvO.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\XczLiua.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\lTzLnnH.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\BUigAjK.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\sbiyeTZ.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
File created	C:\Windows\System\PcEOPzS.exe	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2912	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	81
PID 1504 wrote to memory of 2912	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	81
PID 1504 wrote to memory of 4552	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	82
PID 1504 wrote to memory of 4552	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	82
PID 1504 wrote to memory of 400	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	83
PID 1504 wrote to memory of 400	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	83
PID 1504 wrote to memory of 5032	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	84
PID 1504 wrote to memory of 5032	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	84
PID 1504 wrote to memory of 1776	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	85
PID 1504 wrote to memory of 1776	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	85
PID 1504 wrote to memory of 4908	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	86
PID 1504 wrote to memory of 4908	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	86
PID 1504 wrote to memory of 4988	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	87
PID 1504 wrote to memory of 4988	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	87
PID 1504 wrote to memory of 5044	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	88
PID 1504 wrote to memory of 5044	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	88
PID 1504 wrote to memory of 3916	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	89
PID 1504 wrote to memory of 3916	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	89
PID 1504 wrote to memory of 2580	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	90
PID 1504 wrote to memory of 2580	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	90
PID 1504 wrote to memory of 1480	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	91
PID 1504 wrote to memory of 1480	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	91
PID 1504 wrote to memory of 4704	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	92
PID 1504 wrote to memory of 4704	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	92
PID 1504 wrote to memory of 4780	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	93
PID 1504 wrote to memory of 4780	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	93
PID 1504 wrote to memory of 448	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	94
PID 1504 wrote to memory of 448	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	94
PID 1504 wrote to memory of 3468	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	95
PID 1504 wrote to memory of 3468	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	95
PID 1504 wrote to memory of 1328	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	96
PID 1504 wrote to memory of 1328	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	96
PID 1504 wrote to memory of 1740	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	97
PID 1504 wrote to memory of 1740	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	97
PID 1504 wrote to memory of 732	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	98
PID 1504 wrote to memory of 732	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	98
PID 1504 wrote to memory of 2716	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	99
PID 1504 wrote to memory of 2716	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	99
PID 1504 wrote to memory of 1640	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	100
PID 1504 wrote to memory of 1640	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	100
PID 1504 wrote to memory of 3092	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	101
PID 1504 wrote to memory of 3092	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	101
PID 1504 wrote to memory of 4692	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	102
PID 1504 wrote to memory of 4692	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	102
PID 1504 wrote to memory of 1584	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	103
PID 1504 wrote to memory of 1584	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	103
PID 1504 wrote to memory of 116	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	104
PID 1504 wrote to memory of 116	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	104
PID 1504 wrote to memory of 4472	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	105
PID 1504 wrote to memory of 4472	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	105
PID 1504 wrote to memory of 4748	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	106
PID 1504 wrote to memory of 4748	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	106
PID 1504 wrote to memory of 1096	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	107
PID 1504 wrote to memory of 1096	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	107
PID 1504 wrote to memory of 4548	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	108
PID 1504 wrote to memory of 4548	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	108
PID 1504 wrote to memory of 1692	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	109
PID 1504 wrote to memory of 1692	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	109
PID 1504 wrote to memory of 2780	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	110
PID 1504 wrote to memory of 2780	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	110
PID 1504 wrote to memory of 1232	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	111
PID 1504 wrote to memory of 1232	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	111
PID 1504 wrote to memory of 2108	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	112
PID 1504 wrote to memory of 2108	1504	6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe	112

C:\Users\Admin\AppData\Local\Temp\6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6c11fddce14d22663d4a23cf72a8ce3f0017d536ff303921ea3ed988960b36b2_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\System\fFpuPHp.exe
  C:\Windows\System\fFpuPHp.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\TIYikuc.exe
  C:\Windows\System\TIYikuc.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\hmWEeyE.exe
  C:\Windows\System\hmWEeyE.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\sULsBZe.exe
  C:\Windows\System\sULsBZe.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\jMqiCIQ.exe
  C:\Windows\System\jMqiCIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ukurtkp.exe
  C:\Windows\System\ukurtkp.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\TYVksun.exe
  C:\Windows\System\TYVksun.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\XhMxzYF.exe
  C:\Windows\System\XhMxzYF.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\dEkeMAc.exe
  C:\Windows\System\dEkeMAc.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\cJWfmhG.exe
  C:\Windows\System\cJWfmhG.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\EDmUoPu.exe
  C:\Windows\System\EDmUoPu.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\lQwPwvs.exe
  C:\Windows\System\lQwPwvs.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\XVcVftj.exe
  C:\Windows\System\XVcVftj.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\acVHwpH.exe
  C:\Windows\System\acVHwpH.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\JdKobMb.exe
  C:\Windows\System\JdKobMb.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\okvbrwA.exe
  C:\Windows\System\okvbrwA.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\iCXABId.exe
  C:\Windows\System\iCXABId.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\dygoWDs.exe
  C:\Windows\System\dygoWDs.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\KEqzdZY.exe
  C:\Windows\System\KEqzdZY.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\mYIYOYV.exe
  C:\Windows\System\mYIYOYV.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\iTRmrMY.exe
  C:\Windows\System\iTRmrMY.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\CYdeufz.exe
  C:\Windows\System\CYdeufz.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\JFwOjOQ.exe
  C:\Windows\System\JFwOjOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\qmTYAGB.exe
  C:\Windows\System\qmTYAGB.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\FiZeJYW.exe
  C:\Windows\System\FiZeJYW.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\ZJfZoXm.exe
  C:\Windows\System\ZJfZoXm.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\MNItAGw.exe
  C:\Windows\System\MNItAGw.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\RbHNTJR.exe
  C:\Windows\System\RbHNTJR.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\fOhhiND.exe
  C:\Windows\System\fOhhiND.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\NKRQHaP.exe
  C:\Windows\System\NKRQHaP.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\mawSRBG.exe
  C:\Windows\System\mawSRBG.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\KgFEQaL.exe
  C:\Windows\System\KgFEQaL.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\GoQRPYY.exe
  C:\Windows\System\GoQRPYY.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\TOmIkCN.exe
  C:\Windows\System\TOmIkCN.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\HgHEqVk.exe
  C:\Windows\System\HgHEqVk.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\sQYTOcV.exe
  C:\Windows\System\sQYTOcV.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\ekWLejf.exe
  C:\Windows\System\ekWLejf.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\VTnnvcl.exe
  C:\Windows\System\VTnnvcl.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\ZJRlhuC.exe
  C:\Windows\System\ZJRlhuC.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\nraMJxE.exe
  C:\Windows\System\nraMJxE.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\agdDkxt.exe
  C:\Windows\System\agdDkxt.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\wrREjUK.exe
  C:\Windows\System\wrREjUK.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\QxJonZi.exe
  C:\Windows\System\QxJonZi.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\NkzVfbx.exe
  C:\Windows\System\NkzVfbx.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\nPgaVzl.exe
  C:\Windows\System\nPgaVzl.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\eNILQYA.exe
  C:\Windows\System\eNILQYA.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\SleACau.exe
  C:\Windows\System\SleACau.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\gQhfoJM.exe
  C:\Windows\System\gQhfoJM.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\SYiprDY.exe
  C:\Windows\System\SYiprDY.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\SadmtWj.exe
  C:\Windows\System\SadmtWj.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\HqHAFIE.exe
  C:\Windows\System\HqHAFIE.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\sbiyeTZ.exe
  C:\Windows\System\sbiyeTZ.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\LfcNSsG.exe
  C:\Windows\System\LfcNSsG.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\CROgRXK.exe
  C:\Windows\System\CROgRXK.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\IbNkHvQ.exe
  C:\Windows\System\IbNkHvQ.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\caNrwSL.exe
  C:\Windows\System\caNrwSL.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\sBBFdcl.exe
  C:\Windows\System\sBBFdcl.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\dGgzWGr.exe
  C:\Windows\System\dGgzWGr.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\oGVmhTy.exe
  C:\Windows\System\oGVmhTy.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\HuVBPMh.exe
  C:\Windows\System\HuVBPMh.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\EeNnDOg.exe
  C:\Windows\System\EeNnDOg.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\OFAcqmc.exe
  C:\Windows\System\OFAcqmc.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\QMpktGB.exe
  C:\Windows\System\QMpktGB.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\HEClBkZ.exe
  C:\Windows\System\HEClBkZ.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\PptiEKr.exe
  C:\Windows\System\PptiEKr.exe
  2⤵
  PID:3592
- C:\Windows\System\jVkdXOc.exe
  C:\Windows\System\jVkdXOc.exe
  2⤵
  PID:3836
- C:\Windows\System\xoAdpMQ.exe
  C:\Windows\System\xoAdpMQ.exe
  2⤵
  PID:2344
- C:\Windows\System\tlrPIWt.exe
  C:\Windows\System\tlrPIWt.exe
  2⤵
  PID:1920
- C:\Windows\System\UtFsFMA.exe
  C:\Windows\System\UtFsFMA.exe
  2⤵
  PID:2604
- C:\Windows\System\WoCJtfR.exe
  C:\Windows\System\WoCJtfR.exe
  2⤵
  PID:2500
- C:\Windows\System\cvfSqPt.exe
  C:\Windows\System\cvfSqPt.exe
  2⤵
  PID:3100
- C:\Windows\System\ymSyMQs.exe
  C:\Windows\System\ymSyMQs.exe
  2⤵
  PID:4604
- C:\Windows\System\pDReyKk.exe
  C:\Windows\System\pDReyKk.exe
  2⤵
  PID:4020
- C:\Windows\System\NhaEzTe.exe
  C:\Windows\System\NhaEzTe.exe
  2⤵
  PID:4620
- C:\Windows\System\oFIhQYl.exe
  C:\Windows\System\oFIhQYl.exe
  2⤵
  PID:4420
- C:\Windows\System\dFonvTm.exe
  C:\Windows\System\dFonvTm.exe
  2⤵
  PID:1936
- C:\Windows\System\gqSJbEa.exe
  C:\Windows\System\gqSJbEa.exe
  2⤵
  PID:2968
- C:\Windows\System\dFNlSzL.exe
  C:\Windows\System\dFNlSzL.exe
  2⤵
  PID:4576
- C:\Windows\System\csnMohc.exe
  C:\Windows\System\csnMohc.exe
  2⤵
  PID:2548
- C:\Windows\System\lTkKKvY.exe
  C:\Windows\System\lTkKKvY.exe
  2⤵
  PID:4872
- C:\Windows\System\udqazXS.exe
  C:\Windows\System\udqazXS.exe
  2⤵
  PID:3252
- C:\Windows\System\yuVtxTc.exe
  C:\Windows\System\yuVtxTc.exe
  2⤵
  PID:4640
- C:\Windows\System\WQTdeRm.exe
  C:\Windows\System\WQTdeRm.exe
  2⤵
  PID:1256
- C:\Windows\System\NGtDsCE.exe
  C:\Windows\System\NGtDsCE.exe
  2⤵
  PID:2612
- C:\Windows\System\lPcuFjE.exe
  C:\Windows\System\lPcuFjE.exe
  2⤵
  PID:4300
- C:\Windows\System\hPEavuJ.exe
  C:\Windows\System\hPEavuJ.exe
  2⤵
  PID:2660
- C:\Windows\System\LsJnQXh.exe
  C:\Windows\System\LsJnQXh.exe
  2⤵
  PID:4836
- C:\Windows\System\KtcHsSg.exe
  C:\Windows\System\KtcHsSg.exe
  2⤵
  PID:3680
- C:\Windows\System\RQeNVaA.exe
  C:\Windows\System\RQeNVaA.exe
  2⤵
  PID:3636
- C:\Windows\System\Qtqqarb.exe
  C:\Windows\System\Qtqqarb.exe
  2⤵
  PID:2960
- C:\Windows\System\HHgKeJk.exe
  C:\Windows\System\HHgKeJk.exe
  2⤵
  PID:2396
- C:\Windows\System\BgrQlSO.exe
  C:\Windows\System\BgrQlSO.exe
  2⤵
  PID:5004
- C:\Windows\System\djJUuQy.exe
  C:\Windows\System\djJUuQy.exe
  2⤵
  PID:1700
- C:\Windows\System\kjFFUrl.exe
  C:\Windows\System\kjFFUrl.exe
  2⤵
  PID:4788
- C:\Windows\System\kEQwDml.exe
  C:\Windows\System\kEQwDml.exe
  2⤵
  PID:4632
- C:\Windows\System\UBOszEu.exe
  C:\Windows\System\UBOszEu.exe
  2⤵
  PID:1672
- C:\Windows\System\zsozZEQ.exe
  C:\Windows\System\zsozZEQ.exe
  2⤵
  PID:1676
- C:\Windows\System\EczGFIP.exe
  C:\Windows\System\EczGFIP.exe
  2⤵
  PID:4860
- C:\Windows\System\QzCVTlG.exe
  C:\Windows\System\QzCVTlG.exe
  2⤵
  PID:4408
- C:\Windows\System\FBwAeVR.exe
  C:\Windows\System\FBwAeVR.exe
  2⤵
  PID:3376
- C:\Windows\System\qwASqeY.exe
  C:\Windows\System\qwASqeY.exe
  2⤵
  PID:4076
- C:\Windows\System\WSPQrtz.exe
  C:\Windows\System\WSPQrtz.exe
  2⤵
  PID:3460
- C:\Windows\System\JNpnWSw.exe
  C:\Windows\System\JNpnWSw.exe
  2⤵
  PID:3472
- C:\Windows\System\fECEbbJ.exe
  C:\Windows\System\fECEbbJ.exe
  2⤵
  PID:1164
- C:\Windows\System\EkJTtWY.exe
  C:\Windows\System\EkJTtWY.exe
  2⤵
  PID:3988
- C:\Windows\System\bWJGsyu.exe
  C:\Windows\System\bWJGsyu.exe
  2⤵
  PID:3192
- C:\Windows\System\jmanYel.exe
  C:\Windows\System\jmanYel.exe
  2⤵
  PID:2024
- C:\Windows\System\XjeBKyo.exe
  C:\Windows\System\XjeBKyo.exe
  2⤵
  PID:2304
- C:\Windows\System\NQsdPUv.exe
  C:\Windows\System\NQsdPUv.exe
  2⤵
  PID:3584
- C:\Windows\System\jIyFaAr.exe
  C:\Windows\System\jIyFaAr.exe
  2⤵
  PID:1928
- C:\Windows\System\BnzHQwV.exe
  C:\Windows\System\BnzHQwV.exe
  2⤵
  PID:4136
- C:\Windows\System\sdpPcIY.exe
  C:\Windows\System\sdpPcIY.exe
  2⤵
  PID:5144
- C:\Windows\System\mHZFbDW.exe
  C:\Windows\System\mHZFbDW.exe
  2⤵
  PID:5172
- C:\Windows\System\NzIjuUS.exe
  C:\Windows\System\NzIjuUS.exe
  2⤵
  PID:5200
- C:\Windows\System\fPOaUSl.exe
  C:\Windows\System\fPOaUSl.exe
  2⤵
  PID:5228
- C:\Windows\System\SZcbSFR.exe
  C:\Windows\System\SZcbSFR.exe
  2⤵
  PID:5256
- C:\Windows\System\IGHlxKe.exe
  C:\Windows\System\IGHlxKe.exe
  2⤵
  PID:5288
- C:\Windows\System\dEuMLDW.exe
  C:\Windows\System\dEuMLDW.exe
  2⤵
  PID:5316
- C:\Windows\System\ELpFarU.exe
  C:\Windows\System\ELpFarU.exe
  2⤵
  PID:5340
- C:\Windows\System\hPjqfkl.exe
  C:\Windows\System\hPjqfkl.exe
  2⤵
  PID:5372
- C:\Windows\System\ydpYxZz.exe
  C:\Windows\System\ydpYxZz.exe
  2⤵
  PID:5400
- C:\Windows\System\XdPlMZw.exe
  C:\Windows\System\XdPlMZw.exe
  2⤵
  PID:5428
- C:\Windows\System\OUpJSOH.exe
  C:\Windows\System\OUpJSOH.exe
  2⤵
  PID:5456
- C:\Windows\System\qdtxgHa.exe
  C:\Windows\System\qdtxgHa.exe
  2⤵
  PID:5480
- C:\Windows\System\wHrpljC.exe
  C:\Windows\System\wHrpljC.exe
  2⤵
  PID:5512
- C:\Windows\System\bPThGyC.exe
  C:\Windows\System\bPThGyC.exe
  2⤵
  PID:5540
- C:\Windows\System\pZiVwsx.exe
  C:\Windows\System\pZiVwsx.exe
  2⤵
  PID:5564
- C:\Windows\System\YTnDbJl.exe
  C:\Windows\System\YTnDbJl.exe
  2⤵
  PID:5596
- C:\Windows\System\wpuqDLp.exe
  C:\Windows\System\wpuqDLp.exe
  2⤵
  PID:5624
- C:\Windows\System\tISyKVF.exe
  C:\Windows\System\tISyKVF.exe
  2⤵
  PID:5652
- C:\Windows\System\XowyYVg.exe
  C:\Windows\System\XowyYVg.exe
  2⤵
  PID:5680
- C:\Windows\System\neUCRfX.exe
  C:\Windows\System\neUCRfX.exe
  2⤵
  PID:5704
- C:\Windows\System\UdPkdvG.exe
  C:\Windows\System\UdPkdvG.exe
  2⤵
  PID:5728
- C:\Windows\System\zzqxOlB.exe
  C:\Windows\System\zzqxOlB.exe
  2⤵
  PID:5760
- C:\Windows\System\eldhyOn.exe
  C:\Windows\System\eldhyOn.exe
  2⤵
  PID:5796
- C:\Windows\System\vogukoY.exe
  C:\Windows\System\vogukoY.exe
  2⤵
  PID:5828
- C:\Windows\System\tZgatFq.exe
  C:\Windows\System\tZgatFq.exe
  2⤵
  PID:5844
- C:\Windows\System\XalTwSW.exe
  C:\Windows\System\XalTwSW.exe
  2⤵
  PID:5860
- C:\Windows\System\ehFJVGd.exe
  C:\Windows\System\ehFJVGd.exe
  2⤵
  PID:5880
- C:\Windows\System\NNegQls.exe
  C:\Windows\System\NNegQls.exe
  2⤵
  PID:5916
- C:\Windows\System\rtvAbna.exe
  C:\Windows\System\rtvAbna.exe
  2⤵
  PID:5956
- C:\Windows\System\EmmvjJu.exe
  C:\Windows\System\EmmvjJu.exe
  2⤵
  PID:5984
- C:\Windows\System\KKBZGQw.exe
  C:\Windows\System\KKBZGQw.exe
  2⤵
  PID:6024
- C:\Windows\System\MewHWNx.exe
  C:\Windows\System\MewHWNx.exe
  2⤵
  PID:6044
- C:\Windows\System\iwdMknR.exe
  C:\Windows\System\iwdMknR.exe
  2⤵
  PID:6072
- C:\Windows\System\idaJdeR.exe
  C:\Windows\System\idaJdeR.exe
  2⤵
  PID:6100
- C:\Windows\System\DmIKLUd.exe
  C:\Windows\System\DmIKLUd.exe
  2⤵
  PID:6132
- C:\Windows\System\zsLLhlJ.exe
  C:\Windows\System\zsLLhlJ.exe
  2⤵
  PID:5156
- C:\Windows\System\dhLEUOZ.exe
  C:\Windows\System\dhLEUOZ.exe
  2⤵
  PID:5216
- C:\Windows\System\lZQgqbC.exe
  C:\Windows\System\lZQgqbC.exe
  2⤵
  PID:5304
- C:\Windows\System\gxMBaad.exe
  C:\Windows\System\gxMBaad.exe
  2⤵
  PID:5380
- C:\Windows\System\NuXyZSM.exe
  C:\Windows\System\NuXyZSM.exe
  2⤵
  PID:5440
- C:\Windows\System\RqJEsWt.exe
  C:\Windows\System\RqJEsWt.exe
  2⤵
  PID:5496
- C:\Windows\System\lPgNQGs.exe
  C:\Windows\System\lPgNQGs.exe
  2⤵
  PID:5584
- C:\Windows\System\PcEOPzS.exe
  C:\Windows\System\PcEOPzS.exe
  2⤵
  PID:5688
- C:\Windows\System\VJVEJID.exe
  C:\Windows\System\VJVEJID.exe
  2⤵
  PID:5772
- C:\Windows\System\ptAmqKq.exe
  C:\Windows\System\ptAmqKq.exe
  2⤵
  PID:5856
- C:\Windows\System\bInKEbv.exe
  C:\Windows\System\bInKEbv.exe
  2⤵
  PID:5940
- C:\Windows\System\htVXTEy.exe
  C:\Windows\System\htVXTEy.exe
  2⤵
  PID:5996
- C:\Windows\System\TnTvSVu.exe
  C:\Windows\System\TnTvSVu.exe
  2⤵
  PID:6040
- C:\Windows\System\IIlaWeb.exe
  C:\Windows\System\IIlaWeb.exe
  2⤵
  PID:6112
- C:\Windows\System\bbnHeVO.exe
  C:\Windows\System\bbnHeVO.exe
  2⤵
  PID:5212
- C:\Windows\System\HkEhAAx.exe
  C:\Windows\System\HkEhAAx.exe
  2⤵
  PID:5392
- C:\Windows\System\DxhaRgZ.exe
  C:\Windows\System\DxhaRgZ.exe
  2⤵
  PID:5572
- C:\Windows\System\VTegiOq.exe
  C:\Windows\System\VTegiOq.exe
  2⤵
  PID:5756
- C:\Windows\System\COQGevQ.exe
  C:\Windows\System\COQGevQ.exe
  2⤵
  PID:5912
- C:\Windows\System\sRrWZbt.exe
  C:\Windows\System\sRrWZbt.exe
  2⤵
  PID:6032
- C:\Windows\System\lbFvilb.exe
  C:\Windows\System\lbFvilb.exe
  2⤵
  PID:6096
- C:\Windows\System\mURQUAp.exe
  C:\Windows\System\mURQUAp.exe
  2⤵
  PID:5272
- C:\Windows\System\dSvfhpv.exe
  C:\Windows\System\dSvfhpv.exe
  2⤵
  PID:5668
- C:\Windows\System\VFnwkYe.exe
  C:\Windows\System\VFnwkYe.exe
  2⤵
  PID:5152
- C:\Windows\System\NpXaeCl.exe
  C:\Windows\System\NpXaeCl.exe
  2⤵
  PID:6160
- C:\Windows\System\pLDEdNJ.exe
  C:\Windows\System\pLDEdNJ.exe
  2⤵
  PID:6192
- C:\Windows\System\ADSXaGC.exe
  C:\Windows\System\ADSXaGC.exe
  2⤵
  PID:6212
- C:\Windows\System\gVmODIK.exe
  C:\Windows\System\gVmODIK.exe
  2⤵
  PID:6248
- C:\Windows\System\yfhuEyy.exe
  C:\Windows\System\yfhuEyy.exe
  2⤵
  PID:6276
- C:\Windows\System\qGGKAMb.exe
  C:\Windows\System\qGGKAMb.exe
  2⤵
  PID:6304
- C:\Windows\System\ZfqzQNJ.exe
  C:\Windows\System\ZfqzQNJ.exe
  2⤵
  PID:6328
- C:\Windows\System\qxAenvC.exe
  C:\Windows\System\qxAenvC.exe
  2⤵
  PID:6360
- C:\Windows\System\NzOhnVs.exe
  C:\Windows\System\NzOhnVs.exe
  2⤵
  PID:6388
- C:\Windows\System\vbthntw.exe
  C:\Windows\System\vbthntw.exe
  2⤵
  PID:6408
- C:\Windows\System\JeOHDYt.exe
  C:\Windows\System\JeOHDYt.exe
  2⤵
  PID:6440
- C:\Windows\System\gbqgQAA.exe
  C:\Windows\System\gbqgQAA.exe
  2⤵
  PID:6472
- C:\Windows\System\VJEXRKj.exe
  C:\Windows\System\VJEXRKj.exe
  2⤵
  PID:6500
- C:\Windows\System\QtmAewL.exe
  C:\Windows\System\QtmAewL.exe
  2⤵
  PID:6528
- C:\Windows\System\HyFVLAH.exe
  C:\Windows\System\HyFVLAH.exe
  2⤵
  PID:6556
- C:\Windows\System\mjYasAd.exe
  C:\Windows\System\mjYasAd.exe
  2⤵
  PID:6584
- C:\Windows\System\YrphLNa.exe
  C:\Windows\System\YrphLNa.exe
  2⤵
  PID:6612
- C:\Windows\System\leXOHnE.exe
  C:\Windows\System\leXOHnE.exe
  2⤵
  PID:6640
- C:\Windows\System\IuzTJQE.exe
  C:\Windows\System\IuzTJQE.exe
  2⤵
  PID:6668
- C:\Windows\System\fiLWZbc.exe
  C:\Windows\System\fiLWZbc.exe
  2⤵
  PID:6700
- C:\Windows\System\XczLiua.exe
  C:\Windows\System\XczLiua.exe
  2⤵
  PID:6724
- C:\Windows\System\RczjpmK.exe
  C:\Windows\System\RczjpmK.exe
  2⤵
  PID:6752
- C:\Windows\System\epYyuFj.exe
  C:\Windows\System\epYyuFj.exe
  2⤵
  PID:6776
- C:\Windows\System\gGolnim.exe
  C:\Windows\System\gGolnim.exe
  2⤵
  PID:6804
- C:\Windows\System\NTNexTo.exe
  C:\Windows\System\NTNexTo.exe
  2⤵
  PID:6836
- C:\Windows\System\iWwTwuI.exe
  C:\Windows\System\iWwTwuI.exe
  2⤵
  PID:6868
- C:\Windows\System\EGsdWcj.exe
  C:\Windows\System\EGsdWcj.exe
  2⤵
  PID:6892
- C:\Windows\System\gexkUyX.exe
  C:\Windows\System\gexkUyX.exe
  2⤵
  PID:6920
- C:\Windows\System\WzxUhbl.exe
  C:\Windows\System\WzxUhbl.exe
  2⤵
  PID:6948
- C:\Windows\System\lTzLnnH.exe
  C:\Windows\System\lTzLnnH.exe
  2⤵
  PID:6980
- C:\Windows\System\clwyiQM.exe
  C:\Windows\System\clwyiQM.exe
  2⤵
  PID:7016
- C:\Windows\System\ffdkhLW.exe
  C:\Windows\System\ffdkhLW.exe
  2⤵
  PID:7044
- C:\Windows\System\COZhHpN.exe
  C:\Windows\System\COZhHpN.exe
  2⤵
  PID:7072
- C:\Windows\System\QtvFPyH.exe
  C:\Windows\System\QtvFPyH.exe
  2⤵
  PID:7116
- C:\Windows\System\bSdaiGY.exe
  C:\Windows\System\bSdaiGY.exe
  2⤵
  PID:7160
- C:\Windows\System\pcMqHdD.exe
  C:\Windows\System\pcMqHdD.exe
  2⤵
  PID:6180
- C:\Windows\System\aMAXqqv.exe
  C:\Windows\System\aMAXqqv.exe
  2⤵
  PID:6288
- C:\Windows\System\WfLIztD.exe
  C:\Windows\System\WfLIztD.exe
  2⤵
  PID:6344
- C:\Windows\System\wNZUUpj.exe
  C:\Windows\System\wNZUUpj.exe
  2⤵
  PID:6428
- C:\Windows\System\nRbSgLV.exe
  C:\Windows\System\nRbSgLV.exe
  2⤵
  PID:6508
- C:\Windows\System\mGGTMmG.exe
  C:\Windows\System\mGGTMmG.exe
  2⤵
  PID:6624
- C:\Windows\System\XMpEPYz.exe
  C:\Windows\System\XMpEPYz.exe
  2⤵
  PID:6712
- C:\Windows\System\BrxCLiS.exe
  C:\Windows\System\BrxCLiS.exe
  2⤵
  PID:6824
- C:\Windows\System\yXsEXqk.exe
  C:\Windows\System\yXsEXqk.exe
  2⤵
  PID:6928
- C:\Windows\System\ShiHdFd.exe
  C:\Windows\System\ShiHdFd.exe
  2⤵
  PID:7012
- C:\Windows\System\JEIokXZ.exe
  C:\Windows\System\JEIokXZ.exe
  2⤵
  PID:7064
- C:\Windows\System\NChTbRX.exe
  C:\Windows\System\NChTbRX.exe
  2⤵
  PID:7152
- C:\Windows\System\ymnYYpA.exe
  C:\Windows\System\ymnYYpA.exe
  2⤵
  PID:6168
- C:\Windows\System\uJkQvEH.exe
  C:\Windows\System\uJkQvEH.exe
  2⤵
  PID:6400
- C:\Windows\System\PEyuehs.exe
  C:\Windows\System\PEyuehs.exe
  2⤵
  PID:6688
- C:\Windows\System\eVxclDs.exe
  C:\Windows\System\eVxclDs.exe
  2⤵
  PID:7056
- C:\Windows\System\bSYWFYb.exe
  C:\Windows\System\bSYWFYb.exe
  2⤵
  PID:5968
- C:\Windows\System\tvXMZWg.exe
  C:\Windows\System\tvXMZWg.exe
  2⤵
  PID:6684
- C:\Windows\System\hDASsBl.exe
  C:\Windows\System\hDASsBl.exe
  2⤵
  PID:6368
- C:\Windows\System\otCmgeX.exe
  C:\Windows\System\otCmgeX.exe
  2⤵
  PID:7180
- C:\Windows\System\UahPGva.exe
  C:\Windows\System\UahPGva.exe
  2⤵
  PID:7216
- C:\Windows\System\oOIUFwD.exe
  C:\Windows\System\oOIUFwD.exe
  2⤵
  PID:7264
- C:\Windows\System\CHXIFJx.exe
  C:\Windows\System\CHXIFJx.exe
  2⤵
  PID:7288
- C:\Windows\System\fJPIqzQ.exe
  C:\Windows\System\fJPIqzQ.exe
  2⤵
  PID:7320
- C:\Windows\System\MIVSSeN.exe
  C:\Windows\System\MIVSSeN.exe
  2⤵
  PID:7352
- C:\Windows\System\aXEJFDD.exe
  C:\Windows\System\aXEJFDD.exe
  2⤵
  PID:7372
- C:\Windows\System\gEvZEYa.exe
  C:\Windows\System\gEvZEYa.exe
  2⤵
  PID:7404
- C:\Windows\System\JcBHWGZ.exe
  C:\Windows\System\JcBHWGZ.exe
  2⤵
  PID:7432
- C:\Windows\System\oViAlQY.exe
  C:\Windows\System\oViAlQY.exe
  2⤵
  PID:7460
- C:\Windows\System\QbQsUFC.exe
  C:\Windows\System\QbQsUFC.exe
  2⤵
  PID:7488
- C:\Windows\System\TcNInpd.exe
  C:\Windows\System\TcNInpd.exe
  2⤵
  PID:7516
- C:\Windows\System\dZLiAJM.exe
  C:\Windows\System\dZLiAJM.exe
  2⤵
  PID:7540
- C:\Windows\System\LXKVNFu.exe
  C:\Windows\System\LXKVNFu.exe
  2⤵
  PID:7576
- C:\Windows\System\fQMXYrh.exe
  C:\Windows\System\fQMXYrh.exe
  2⤵
  PID:7596
- C:\Windows\System\SosAMnT.exe
  C:\Windows\System\SosAMnT.exe
  2⤵
  PID:7628
- C:\Windows\System\sHzVZmG.exe
  C:\Windows\System\sHzVZmG.exe
  2⤵
  PID:7656
- C:\Windows\System\bBxhHzJ.exe
  C:\Windows\System\bBxhHzJ.exe
  2⤵
  PID:7684
- C:\Windows\System\vEWUbXn.exe
  C:\Windows\System\vEWUbXn.exe
  2⤵
  PID:7716
- C:\Windows\System\BhfPCLm.exe
  C:\Windows\System\BhfPCLm.exe
  2⤵
  PID:7740
- C:\Windows\System\NgQotnj.exe
  C:\Windows\System\NgQotnj.exe
  2⤵
  PID:7768
- C:\Windows\System\zKBrXsm.exe
  C:\Windows\System\zKBrXsm.exe
  2⤵
  PID:7792
- C:\Windows\System\rMZfAPD.exe
  C:\Windows\System\rMZfAPD.exe
  2⤵
  PID:7824
- C:\Windows\System\jskYtcD.exe
  C:\Windows\System\jskYtcD.exe
  2⤵
  PID:7856
- C:\Windows\System\WMdoNDq.exe
  C:\Windows\System\WMdoNDq.exe
  2⤵
  PID:7888
- C:\Windows\System\owPylao.exe
  C:\Windows\System\owPylao.exe
  2⤵
  PID:7912
- C:\Windows\System\vVzqEfx.exe
  C:\Windows\System\vVzqEfx.exe
  2⤵
  PID:7940
- C:\Windows\System\sivRZTE.exe
  C:\Windows\System\sivRZTE.exe
  2⤵
  PID:7968
- C:\Windows\System\dEwFFAM.exe
  C:\Windows\System\dEwFFAM.exe
  2⤵
  PID:7992
- C:\Windows\System\dDebpYa.exe
  C:\Windows\System\dDebpYa.exe
  2⤵
  PID:8024
- C:\Windows\System\gjveNzk.exe
  C:\Windows\System\gjveNzk.exe
  2⤵
  PID:8052
- C:\Windows\System\yMmVkiN.exe
  C:\Windows\System\yMmVkiN.exe
  2⤵
  PID:8076
- C:\Windows\System\QPBZJji.exe
  C:\Windows\System\QPBZJji.exe
  2⤵
  PID:8108
- C:\Windows\System\mFnXrCB.exe
  C:\Windows\System\mFnXrCB.exe
  2⤵
  PID:8136
- C:\Windows\System\CzQfyAc.exe
  C:\Windows\System\CzQfyAc.exe
  2⤵
  PID:8160
- C:\Windows\System\uNtFglo.exe
  C:\Windows\System\uNtFglo.exe
  2⤵
  PID:8188
- C:\Windows\System\hdvdrIh.exe
  C:\Windows\System\hdvdrIh.exe
  2⤵
  PID:7228
- C:\Windows\System\BUigAjK.exe
  C:\Windows\System\BUigAjK.exe
  2⤵
  PID:7296
- C:\Windows\System\AoKVdnu.exe
  C:\Windows\System\AoKVdnu.exe
  2⤵
  PID:7364
- C:\Windows\System\CoLdDxY.exe
  C:\Windows\System\CoLdDxY.exe
  2⤵
  PID:7424
- C:\Windows\System\nqRybxv.exe
  C:\Windows\System\nqRybxv.exe
  2⤵
  PID:7496
- C:\Windows\System\RCwlqkU.exe
  C:\Windows\System\RCwlqkU.exe
  2⤵
  PID:7560
- C:\Windows\System\uWkfRSC.exe
  C:\Windows\System\uWkfRSC.exe
  2⤵
  PID:7620
- C:\Windows\System\OGbNDEN.exe
  C:\Windows\System\OGbNDEN.exe
  2⤵
  PID:7676
- C:\Windows\System\emchHgR.exe
  C:\Windows\System\emchHgR.exe
  2⤵
  PID:7756
- C:\Windows\System\shEYWTh.exe
  C:\Windows\System\shEYWTh.exe
  2⤵
  PID:7816
- C:\Windows\System\hrSBKYD.exe
  C:\Windows\System\hrSBKYD.exe
  2⤵
  PID:7896
- C:\Windows\System\WlRXINp.exe
  C:\Windows\System\WlRXINp.exe
  2⤵
  PID:7956
- C:\Windows\System\sacRMQy.exe
  C:\Windows\System\sacRMQy.exe
  2⤵
  PID:8016
- C:\Windows\System\lNqYOlW.exe
  C:\Windows\System\lNqYOlW.exe
  2⤵
  PID:8072
- C:\Windows\System\tXqglNq.exe
  C:\Windows\System\tXqglNq.exe
  2⤵
  PID:8152
- C:\Windows\System\oOSfGKq.exe
  C:\Windows\System\oOSfGKq.exe
  2⤵
  PID:7248
- C:\Windows\System\FpnNGma.exe
  C:\Windows\System\FpnNGma.exe
  2⤵
  PID:7392
- C:\Windows\System\kkxzSUy.exe
  C:\Windows\System\kkxzSUy.exe
  2⤵
  PID:7532
- C:\Windows\System\dugWyUn.exe
  C:\Windows\System\dugWyUn.exe
  2⤵
  PID:7672
- C:\Windows\System\edJJaKI.exe
  C:\Windows\System\edJJaKI.exe
  2⤵
  PID:7868
- C:\Windows\System\GTBzZjs.exe
  C:\Windows\System\GTBzZjs.exe
  2⤵
  PID:8004
- C:\Windows\System\rFhlmfU.exe
  C:\Windows\System\rFhlmfU.exe
  2⤵
  PID:8180
- C:\Windows\System\WREybyy.exe
  C:\Windows\System\WREybyy.exe
  2⤵
  PID:7452
- C:\Windows\System\UtXZKnW.exe
  C:\Windows\System\UtXZKnW.exe
  2⤵
  PID:7664
- C:\Windows\System\pslrdWQ.exe
  C:\Windows\System\pslrdWQ.exe
  2⤵
  PID:7904
- C:\Windows\System\NaLCBiP.exe
  C:\Windows\System\NaLCBiP.exe
  2⤵
  PID:7196
- C:\Windows\System\dsCgICa.exe
  C:\Windows\System\dsCgICa.exe
  2⤵
  PID:7340
- C:\Windows\System\aafGpCm.exe
  C:\Windows\System\aafGpCm.exe
  2⤵
  PID:8228
- C:\Windows\System\EUVwxjw.exe
  C:\Windows\System\EUVwxjw.exe
  2⤵
  PID:8264
- C:\Windows\System\UGqwDZn.exe
  C:\Windows\System\UGqwDZn.exe
  2⤵
  PID:8296
- C:\Windows\System\eKrnIeB.exe
  C:\Windows\System\eKrnIeB.exe
  2⤵
  PID:8328
- C:\Windows\System\dYenxUi.exe
  C:\Windows\System\dYenxUi.exe
  2⤵
  PID:8356
- C:\Windows\System\gYWbxMb.exe
  C:\Windows\System\gYWbxMb.exe
  2⤵
  PID:8380
- C:\Windows\System\kTkDmqg.exe
  C:\Windows\System\kTkDmqg.exe
  2⤵
  PID:8408
- C:\Windows\System\AhyNDkz.exe
  C:\Windows\System\AhyNDkz.exe
  2⤵
  PID:8440
- C:\Windows\System\jTOHXOq.exe
  C:\Windows\System\jTOHXOq.exe
  2⤵
  PID:8464
- C:\Windows\System\HHjdowV.exe
  C:\Windows\System\HHjdowV.exe
  2⤵
  PID:8496
- C:\Windows\System\ebNTVpX.exe
  C:\Windows\System\ebNTVpX.exe
  2⤵
  PID:8524
- C:\Windows\System\qlqKtgh.exe
  C:\Windows\System\qlqKtgh.exe
  2⤵
  PID:8552
- C:\Windows\System\HrCUVly.exe
  C:\Windows\System\HrCUVly.exe
  2⤵
  PID:8580
- C:\Windows\System\CzhKoCo.exe
  C:\Windows\System\CzhKoCo.exe
  2⤵
  PID:8604
- C:\Windows\System\OgKuJAW.exe
  C:\Windows\System\OgKuJAW.exe
  2⤵
  PID:8632
- C:\Windows\System\ViWPgAh.exe
  C:\Windows\System\ViWPgAh.exe
  2⤵
  PID:8668
- C:\Windows\System\KmquaDy.exe
  C:\Windows\System\KmquaDy.exe
  2⤵
  PID:8688
- C:\Windows\System\VOclXXQ.exe
  C:\Windows\System\VOclXXQ.exe
  2⤵
  PID:8716
- C:\Windows\System\OaOLSsA.exe
  C:\Windows\System\OaOLSsA.exe
  2⤵
  PID:8748
- C:\Windows\System\CFfrVbQ.exe
  C:\Windows\System\CFfrVbQ.exe
  2⤵
  PID:8776
- C:\Windows\System\UFcLJUm.exe
  C:\Windows\System\UFcLJUm.exe
  2⤵
  PID:8804
- C:\Windows\System\FanNaQP.exe
  C:\Windows\System\FanNaQP.exe
  2⤵
  PID:8836
- C:\Windows\System\bldypRc.exe
  C:\Windows\System\bldypRc.exe
  2⤵
  PID:8864
- C:\Windows\System\LagqXoc.exe
  C:\Windows\System\LagqXoc.exe
  2⤵
  PID:8888
- C:\Windows\System\FjDVrma.exe
  C:\Windows\System\FjDVrma.exe
  2⤵
  PID:8916
- C:\Windows\System\mEhSnFT.exe
  C:\Windows\System\mEhSnFT.exe
  2⤵
  PID:8948
- C:\Windows\System\IaAgXQI.exe
  C:\Windows\System\IaAgXQI.exe
  2⤵
  PID:8972
- C:\Windows\System\hTtvPAQ.exe
  C:\Windows\System\hTtvPAQ.exe
  2⤵
  PID:9000
- C:\Windows\System\GAmTXzN.exe
  C:\Windows\System\GAmTXzN.exe
  2⤵
  PID:9032
- C:\Windows\System\auWkgFg.exe
  C:\Windows\System\auWkgFg.exe
  2⤵
  PID:9060
- C:\Windows\System\DzGmmSA.exe
  C:\Windows\System\DzGmmSA.exe
  2⤵
  PID:9084
- C:\Windows\System\jnuvIDn.exe
  C:\Windows\System\jnuvIDn.exe
  2⤵
  PID:9112
- C:\Windows\System\bKGTuIM.exe
  C:\Windows\System\bKGTuIM.exe
  2⤵
  PID:9140
- C:\Windows\System\hXxGxSW.exe
  C:\Windows\System\hXxGxSW.exe
  2⤵
  PID:9172
- C:\Windows\System\viRfWOp.exe
  C:\Windows\System\viRfWOp.exe
  2⤵
  PID:9200
- C:\Windows\System\onwoCnD.exe
  C:\Windows\System\onwoCnD.exe
  2⤵
  PID:8236
- C:\Windows\System\wxYFksR.exe
  C:\Windows\System\wxYFksR.exe
  2⤵
  PID:8260
- C:\Windows\System\OwTPXqa.exe
  C:\Windows\System\OwTPXqa.exe
  2⤵
  PID:8320
- C:\Windows\System\nQwVSXt.exe
  C:\Windows\System\nQwVSXt.exe
  2⤵
  PID:7840
- C:\Windows\System\XjpNmVG.exe
  C:\Windows\System\XjpNmVG.exe
  2⤵
  PID:8448
- C:\Windows\System\OBwjlib.exe
  C:\Windows\System\OBwjlib.exe
  2⤵
  PID:8516
- C:\Windows\System\EweecmD.exe
  C:\Windows\System\EweecmD.exe
  2⤵
  PID:8572
- C:\Windows\System\ifOFncL.exe
  C:\Windows\System\ifOFncL.exe
  2⤵
  PID:8644
- C:\Windows\System\XFNCABp.exe
  C:\Windows\System\XFNCABp.exe
  2⤵
  PID:8708
- C:\Windows\System\kmNEbFt.exe
  C:\Windows\System\kmNEbFt.exe
  2⤵
  PID:8760
- C:\Windows\System\RKBNrwt.exe
  C:\Windows\System\RKBNrwt.exe
  2⤵
  PID:8844
- C:\Windows\System\XOdWrmG.exe
  C:\Windows\System\XOdWrmG.exe
  2⤵
  PID:8908
- C:\Windows\System\TsTmWFr.exe
  C:\Windows\System\TsTmWFr.exe
  2⤵
  PID:8968
- C:\Windows\System\GLgUnWW.exe
  C:\Windows\System\GLgUnWW.exe
  2⤵
  PID:9040
- C:\Windows\System\iSKtzKH.exe
  C:\Windows\System\iSKtzKH.exe
  2⤵
  PID:9104
- C:\Windows\System\ZDABvHs.exe
  C:\Windows\System\ZDABvHs.exe
  2⤵
  PID:9180
- C:\Windows\System\sEwJExR.exe
  C:\Windows\System\sEwJExR.exe
  2⤵
  PID:8208
- C:\Windows\System\WYbtBry.exe
  C:\Windows\System\WYbtBry.exe
  2⤵
  PID:8372
- C:\Windows\System\ZqaonnI.exe
  C:\Windows\System\ZqaonnI.exe
  2⤵
  PID:8508
- C:\Windows\System\GVvHPof.exe
  C:\Windows\System\GVvHPof.exe
  2⤵
  PID:8676
- C:\Windows\System\yMdAbHD.exe
  C:\Windows\System\yMdAbHD.exe
  2⤵
  PID:8872
- C:\Windows\System\OGjCLjL.exe
  C:\Windows\System\OGjCLjL.exe
  2⤵
  PID:9096
- C:\Windows\System\SeZiXdp.exe
  C:\Windows\System\SeZiXdp.exe
  2⤵
  PID:8348
- C:\Windows\System\miWNIgM.exe
  C:\Windows\System\miWNIgM.exe
  2⤵
  PID:8816
- C:\Windows\System\PMWTVBk.exe
  C:\Windows\System\PMWTVBk.exe
  2⤵
  PID:8316
- C:\Windows\System\uUXiSIS.exe
  C:\Windows\System\uUXiSIS.exe
  2⤵
  PID:8288
- C:\Windows\System\pQhafiT.exe
  C:\Windows\System\pQhafiT.exe
  2⤵
  PID:9232
- C:\Windows\System\UqkjgdS.exe
  C:\Windows\System\UqkjgdS.exe
  2⤵
  PID:9260
- C:\Windows\System\cfhbXOi.exe
  C:\Windows\System\cfhbXOi.exe
  2⤵
  PID:9288
- C:\Windows\System\vZwCbpD.exe
  C:\Windows\System\vZwCbpD.exe
  2⤵
  PID:9316
- C:\Windows\System\mEOVbfn.exe
  C:\Windows\System\mEOVbfn.exe
  2⤵
  PID:9344
- C:\Windows\System\iAlwsTG.exe
  C:\Windows\System\iAlwsTG.exe
  2⤵
  PID:9372
- C:\Windows\System\UhMvwiG.exe
  C:\Windows\System\UhMvwiG.exe
  2⤵
  PID:9400
- C:\Windows\System\iHRQBGn.exe
  C:\Windows\System\iHRQBGn.exe
  2⤵
  PID:9428
- C:\Windows\System\ReHnWrp.exe
  C:\Windows\System\ReHnWrp.exe
  2⤵
  PID:9456
- C:\Windows\System\cWJAvwq.exe
  C:\Windows\System\cWJAvwq.exe
  2⤵
  PID:9484
- C:\Windows\System\JtrMqUF.exe
  C:\Windows\System\JtrMqUF.exe
  2⤵
  PID:9512
- C:\Windows\System\BmGpBVK.exe
  C:\Windows\System\BmGpBVK.exe
  2⤵
  PID:9540
- C:\Windows\System\bEvthZZ.exe
  C:\Windows\System\bEvthZZ.exe
  2⤵
  PID:9568
- C:\Windows\System\tLDkapq.exe
  C:\Windows\System\tLDkapq.exe
  2⤵
  PID:9596
- C:\Windows\System\NOWBXCA.exe
  C:\Windows\System\NOWBXCA.exe
  2⤵
  PID:9624
- C:\Windows\System\NTWqoBT.exe
  C:\Windows\System\NTWqoBT.exe
  2⤵
  PID:9652
- C:\Windows\System\DMQPrFc.exe
  C:\Windows\System\DMQPrFc.exe
  2⤵
  PID:9680
- C:\Windows\System\ZdwCjZJ.exe
  C:\Windows\System\ZdwCjZJ.exe
  2⤵
  PID:9708
- C:\Windows\System\OFHFIBu.exe
  C:\Windows\System\OFHFIBu.exe
  2⤵
  PID:9740
- C:\Windows\System\OjSVWyQ.exe
  C:\Windows\System\OjSVWyQ.exe
  2⤵
  PID:9768
- C:\Windows\System\dqbUJfP.exe
  C:\Windows\System\dqbUJfP.exe
  2⤵
  PID:9796
- C:\Windows\System\nBpbVXd.exe
  C:\Windows\System\nBpbVXd.exe
  2⤵
  PID:9824
- C:\Windows\System\NulLxsN.exe
  C:\Windows\System\NulLxsN.exe
  2⤵
  PID:9864
- C:\Windows\System\WbvKUCb.exe
  C:\Windows\System\WbvKUCb.exe
  2⤵
  PID:9880
- C:\Windows\System\dbjTkDc.exe
  C:\Windows\System\dbjTkDc.exe
  2⤵
  PID:9908
- C:\Windows\System\DkRKBbN.exe
  C:\Windows\System\DkRKBbN.exe
  2⤵
  PID:9936
- C:\Windows\System\dpTsKlt.exe
  C:\Windows\System\dpTsKlt.exe
  2⤵
  PID:9964
- C:\Windows\System\weTDrps.exe
  C:\Windows\System\weTDrps.exe
  2⤵
  PID:9992
- C:\Windows\System\RxIqyTx.exe
  C:\Windows\System\RxIqyTx.exe
  2⤵
  PID:10020
- C:\Windows\System\ySFVVlZ.exe
  C:\Windows\System\ySFVVlZ.exe
  2⤵
  PID:10048
- C:\Windows\System\QYFdQOu.exe
  C:\Windows\System\QYFdQOu.exe
  2⤵
  PID:10076
- C:\Windows\System\lAUsCDY.exe
  C:\Windows\System\lAUsCDY.exe
  2⤵
  PID:10104
- C:\Windows\System\ITKcZUH.exe
  C:\Windows\System\ITKcZUH.exe
  2⤵
  PID:10132
- C:\Windows\System\mPcZKSQ.exe
  C:\Windows\System\mPcZKSQ.exe
  2⤵
  PID:10160
- C:\Windows\System\kRnDMfj.exe
  C:\Windows\System\kRnDMfj.exe
  2⤵
  PID:10188
- C:\Windows\System\JNcahEC.exe
  C:\Windows\System\JNcahEC.exe
  2⤵
  PID:10216
- C:\Windows\System\jUsSZYP.exe
  C:\Windows\System\jUsSZYP.exe
  2⤵
  PID:9224
- C:\Windows\System\REaaiGS.exe
  C:\Windows\System\REaaiGS.exe
  2⤵
  PID:9280
- C:\Windows\System\yuKGHLt.exe
  C:\Windows\System\yuKGHLt.exe
  2⤵
  PID:9340
- C:\Windows\System\AvXckmz.exe
  C:\Windows\System\AvXckmz.exe
  2⤵
  PID:9412
- C:\Windows\System\TOYwlWC.exe
  C:\Windows\System\TOYwlWC.exe
  2⤵
  PID:9448
- C:\Windows\System\pNXyHUW.exe
  C:\Windows\System\pNXyHUW.exe
  2⤵
  PID:9508
- C:\Windows\System\pPPPDYC.exe
  C:\Windows\System\pPPPDYC.exe
  2⤵
  PID:9564
- C:\Windows\System\jGfiVfy.exe
  C:\Windows\System\jGfiVfy.exe
  2⤵
  PID:9672
- C:\Windows\System\joqYmLM.exe
  C:\Windows\System\joqYmLM.exe
  2⤵
  PID:9736
- C:\Windows\System\AhfwrMo.exe
  C:\Windows\System\AhfwrMo.exe
  2⤵
  PID:9808
- C:\Windows\System\kMLpiZP.exe
  C:\Windows\System\kMLpiZP.exe
  2⤵
  PID:9872
- C:\Windows\System\fvHpvLR.exe
  C:\Windows\System\fvHpvLR.exe
  2⤵
  PID:9932
- C:\Windows\System\VRCmglF.exe
  C:\Windows\System\VRCmglF.exe
  2⤵
  PID:10004
- C:\Windows\System\LvASuUq.exe
  C:\Windows\System\LvASuUq.exe
  2⤵
  PID:10068
- C:\Windows\System\jmMOKSh.exe
  C:\Windows\System\jmMOKSh.exe
  2⤵
  PID:10128
- C:\Windows\System\fsVNMJK.exe
  C:\Windows\System\fsVNMJK.exe
  2⤵
  PID:10200
- C:\Windows\System\uqDUDIg.exe
  C:\Windows\System\uqDUDIg.exe
  2⤵
  PID:8736
- C:\Windows\System\vvJRhNg.exe
  C:\Windows\System\vvJRhNg.exe
  2⤵
  PID:9396
- C:\Windows\System\fAandvP.exe
  C:\Windows\System\fAandvP.exe
  2⤵
  PID:9560
- C:\Windows\System\bhKiQEc.exe
  C:\Windows\System\bhKiQEc.exe
  2⤵
  PID:9720
- C:\Windows\System\RDPMvnK.exe
  C:\Windows\System\RDPMvnK.exe
  2⤵
  PID:9848
- C:\Windows\System\wxnYOKY.exe
  C:\Windows\System\wxnYOKY.exe
  2⤵
  PID:10032
- C:\Windows\System\RMxNoVX.exe
  C:\Windows\System\RMxNoVX.exe
  2⤵
  PID:10180
- C:\Windows\System\zzysSpg.exe
  C:\Windows\System\zzysSpg.exe
  2⤵
  PID:9368
- C:\Windows\System\TWYoOnH.exe
  C:\Windows\System\TWYoOnH.exe
  2⤵
  PID:9700
- C:\Windows\System\HRajydK.exe
  C:\Windows\System\HRajydK.exe
  2⤵
  PID:10096
- C:\Windows\System\QDwmJuh.exe
  C:\Windows\System\QDwmJuh.exe
  2⤵
  PID:9620
- C:\Windows\System\zwnqvaH.exe
  C:\Windows\System\zwnqvaH.exe
  2⤵
  PID:9476
- C:\Windows\System\MDbGrce.exe
  C:\Windows\System\MDbGrce.exe
  2⤵
  PID:10260
- C:\Windows\System\exeQcOU.exe
  C:\Windows\System\exeQcOU.exe
  2⤵
  PID:10288
- C:\Windows\System\IImpqpD.exe
  C:\Windows\System\IImpqpD.exe
  2⤵
  PID:10316
- C:\Windows\System\YbajERb.exe
  C:\Windows\System\YbajERb.exe
  2⤵
  PID:10344
- C:\Windows\System\dbPUtnr.exe
  C:\Windows\System\dbPUtnr.exe
  2⤵
  PID:10372
- C:\Windows\System\VroaiRt.exe
  C:\Windows\System\VroaiRt.exe
  2⤵
  PID:10404
- C:\Windows\System\KFejjnW.exe
  C:\Windows\System\KFejjnW.exe
  2⤵
  PID:10432
- C:\Windows\System\dswsicC.exe
  C:\Windows\System\dswsicC.exe
  2⤵
  PID:10460
- C:\Windows\System\CYEfVgH.exe
  C:\Windows\System\CYEfVgH.exe
  2⤵
  PID:10488
- C:\Windows\System\goeVDMH.exe
  C:\Windows\System\goeVDMH.exe
  2⤵
  PID:10512
- C:\Windows\System\wajWNoY.exe
  C:\Windows\System\wajWNoY.exe
  2⤵
  PID:10544
- C:\Windows\System\QcjYwqM.exe
  C:\Windows\System\QcjYwqM.exe
  2⤵
  PID:10572
- C:\Windows\System\tDiFbNP.exe
  C:\Windows\System\tDiFbNP.exe
  2⤵
  PID:10600
- C:\Windows\System\DQAEzpI.exe
  C:\Windows\System\DQAEzpI.exe
  2⤵
  PID:10628
- C:\Windows\System\kHWVMZC.exe
  C:\Windows\System\kHWVMZC.exe
  2⤵
  PID:10668
- C:\Windows\System\NRlPuQO.exe
  C:\Windows\System\NRlPuQO.exe
  2⤵
  PID:10684
- C:\Windows\System\xhMMzlb.exe
  C:\Windows\System\xhMMzlb.exe
  2⤵
  PID:10712
- C:\Windows\System\wlzcjfq.exe
  C:\Windows\System\wlzcjfq.exe
  2⤵
  PID:10740
- C:\Windows\System\JWfytCE.exe
  C:\Windows\System\JWfytCE.exe
  2⤵
  PID:10768
- C:\Windows\System\rQPkthW.exe
  C:\Windows\System\rQPkthW.exe
  2⤵
  PID:10800
- C:\Windows\System\ODeKPrH.exe
  C:\Windows\System\ODeKPrH.exe
  2⤵
  PID:10828
- C:\Windows\System\yOIyhXT.exe
  C:\Windows\System\yOIyhXT.exe
  2⤵
  PID:10856
- C:\Windows\System\UacbYSM.exe
  C:\Windows\System\UacbYSM.exe
  2⤵
  PID:10884
- C:\Windows\System\lyisYCZ.exe
  C:\Windows\System\lyisYCZ.exe
  2⤵
  PID:10912
- C:\Windows\System\JsYFwvn.exe
  C:\Windows\System\JsYFwvn.exe
  2⤵
  PID:10940
- C:\Windows\System\zWzfvPd.exe
  C:\Windows\System\zWzfvPd.exe
  2⤵
  PID:10968
- C:\Windows\System\edJsxhY.exe
  C:\Windows\System\edJsxhY.exe
  2⤵
  PID:10996
- C:\Windows\System\vpBlkDF.exe
  C:\Windows\System\vpBlkDF.exe
  2⤵
  PID:11024
- C:\Windows\System\mczFAlM.exe
  C:\Windows\System\mczFAlM.exe
  2⤵
  PID:11052
- C:\Windows\System\mkEEPNf.exe
  C:\Windows\System\mkEEPNf.exe
  2⤵
  PID:11080
- C:\Windows\System\PVqkfZi.exe
  C:\Windows\System\PVqkfZi.exe
  2⤵
  PID:11108
- C:\Windows\System\PBFEoiv.exe
  C:\Windows\System\PBFEoiv.exe
  2⤵
  PID:11136
- C:\Windows\System\JwKIYph.exe
  C:\Windows\System\JwKIYph.exe
  2⤵
  PID:11164
- C:\Windows\System\UGOYbIU.exe
  C:\Windows\System\UGOYbIU.exe
  2⤵
  PID:11192
- C:\Windows\System\DIQurqp.exe
  C:\Windows\System\DIQurqp.exe
  2⤵
  PID:11220
- C:\Windows\System\WjainJo.exe
  C:\Windows\System\WjainJo.exe
  2⤵
  PID:11248
- C:\Windows\System\wfXoUCx.exe
  C:\Windows\System\wfXoUCx.exe
  2⤵
  PID:10272
- C:\Windows\System\mIbIJGg.exe
  C:\Windows\System\mIbIJGg.exe
  2⤵
  PID:10336
- C:\Windows\System\whYxnlz.exe
  C:\Windows\System\whYxnlz.exe
  2⤵
  PID:10400
- C:\Windows\System\yrcFNQz.exe
  C:\Windows\System\yrcFNQz.exe
  2⤵
  PID:10472
- C:\Windows\System\QMbjJEZ.exe
  C:\Windows\System\QMbjJEZ.exe
  2⤵
  PID:10532
- C:\Windows\System\zNbIyCT.exe
  C:\Windows\System\zNbIyCT.exe
  2⤵
  PID:10596
- C:\Windows\System\lptohqf.exe
  C:\Windows\System\lptohqf.exe
  2⤵
  PID:10652
- C:\Windows\System\cGTVETU.exe
  C:\Windows\System\cGTVETU.exe
  2⤵
  PID:10732
- C:\Windows\System\JRNosji.exe
  C:\Windows\System\JRNosji.exe
  2⤵
  PID:10796
- C:\Windows\System\lJYlUYW.exe
  C:\Windows\System\lJYlUYW.exe
  2⤵
  PID:10868
- C:\Windows\System\FrzlyjR.exe
  C:\Windows\System\FrzlyjR.exe
  2⤵
  PID:10932
- C:\Windows\System\YRERAAr.exe
  C:\Windows\System\YRERAAr.exe
  2⤵
  PID:10992
- C:\Windows\System\oQlzkEA.exe
  C:\Windows\System\oQlzkEA.exe
  2⤵
  PID:11064
- C:\Windows\System\yzHJTHi.exe
  C:\Windows\System\yzHJTHi.exe
  2⤵
  PID:11128
- C:\Windows\System\FWAFLWf.exe
  C:\Windows\System\FWAFLWf.exe
  2⤵
  PID:11188
- C:\Windows\System\jpivkOB.exe
  C:\Windows\System\jpivkOB.exe
  2⤵
  PID:11260
- C:\Windows\System\kxXNHGr.exe
  C:\Windows\System\kxXNHGr.exe
  2⤵
  PID:10384
- C:\Windows\System\QBFTPyk.exe
  C:\Windows\System\QBFTPyk.exe
  2⤵
  PID:10528
- C:\Windows\System\WUCSteg.exe
  C:\Windows\System\WUCSteg.exe
  2⤵
  PID:10696
- C:\Windows\System\GHcprpK.exe
  C:\Windows\System\GHcprpK.exe
  2⤵
  PID:10848
- C:\Windows\System\pAhtUbD.exe
  C:\Windows\System\pAhtUbD.exe
  2⤵
  PID:10988
- C:\Windows\System\ulXRrJj.exe
  C:\Windows\System\ulXRrJj.exe
  2⤵
  PID:11156
- C:\Windows\System\fVVFFDJ.exe
  C:\Windows\System\fVVFFDJ.exe
  2⤵
  PID:10328
- C:\Windows\System\HnZHLhd.exe
  C:\Windows\System\HnZHLhd.exe
  2⤵
  PID:10392
- C:\Windows\System\rwdcxof.exe
  C:\Windows\System\rwdcxof.exe
  2⤵
  PID:10980
- C:\Windows\System\jGtEsSh.exe
  C:\Windows\System\jGtEsSh.exe
  2⤵
  PID:10504
- C:\Windows\System\VijBLcy.exe
  C:\Windows\System\VijBLcy.exe
  2⤵
  PID:11244
- C:\Windows\System\COBlbzp.exe
  C:\Windows\System\COBlbzp.exe
  2⤵
  PID:11120
- C:\Windows\System\kGeqRjn.exe
  C:\Windows\System\kGeqRjn.exe
  2⤵
  PID:11296
- C:\Windows\System\YFQuDMd.exe
  C:\Windows\System\YFQuDMd.exe
  2⤵
  PID:11324
- C:\Windows\System\iGSRCxp.exe
  C:\Windows\System\iGSRCxp.exe
  2⤵
  PID:11352
- C:\Windows\System\Kdllffx.exe
  C:\Windows\System\Kdllffx.exe
  2⤵
  PID:11380
- C:\Windows\System\Trberfo.exe
  C:\Windows\System\Trberfo.exe
  2⤵
  PID:11408
- C:\Windows\System\rwKfUaK.exe
  C:\Windows\System\rwKfUaK.exe
  2⤵
  PID:11436
- C:\Windows\System\xwpAcmV.exe
  C:\Windows\System\xwpAcmV.exe
  2⤵
  PID:11464
- C:\Windows\System\rnhXiau.exe
  C:\Windows\System\rnhXiau.exe
  2⤵
  PID:11496
- C:\Windows\System\glfoWWH.exe
  C:\Windows\System\glfoWWH.exe
  2⤵
  PID:11524
- C:\Windows\System\IWZokGT.exe
  C:\Windows\System\IWZokGT.exe
  2⤵
  PID:11552
- C:\Windows\System\BdOaRMM.exe
  C:\Windows\System\BdOaRMM.exe
  2⤵
  PID:11580
- C:\Windows\System\TuSQNwV.exe
  C:\Windows\System\TuSQNwV.exe
  2⤵
  PID:11608
- C:\Windows\System\ejpDJNm.exe
  C:\Windows\System\ejpDJNm.exe
  2⤵
  PID:11636
- C:\Windows\System\rPULIci.exe
  C:\Windows\System\rPULIci.exe
  2⤵
  PID:11664
- C:\Windows\System\HAAVbGL.exe
  C:\Windows\System\HAAVbGL.exe
  2⤵
  PID:11700
- C:\Windows\System\zwXqJTL.exe
  C:\Windows\System\zwXqJTL.exe
  2⤵
  PID:11728
- C:\Windows\System\SGdpCzu.exe
  C:\Windows\System\SGdpCzu.exe
  2⤵
  PID:11764
- C:\Windows\System\UVHGpjT.exe
  C:\Windows\System\UVHGpjT.exe
  2⤵
  PID:11808
- C:\Windows\System\StmiJSr.exe
  C:\Windows\System\StmiJSr.exe
  2⤵
  PID:11852
- C:\Windows\System\XFRMljO.exe
  C:\Windows\System\XFRMljO.exe
  2⤵
  PID:11896
- C:\Windows\System\dfbPlSQ.exe
  C:\Windows\System\dfbPlSQ.exe
  2⤵
  PID:11912
- C:\Windows\System\UApgpqC.exe
  C:\Windows\System\UApgpqC.exe
  2⤵
  PID:11952
- C:\Windows\System\wOkMQuH.exe
  C:\Windows\System\wOkMQuH.exe
  2⤵
  PID:12004
- C:\Windows\System\THAkXbo.exe
  C:\Windows\System\THAkXbo.exe
  2⤵
  PID:12036
- C:\Windows\System\NoiMnpR.exe
  C:\Windows\System\NoiMnpR.exe
  2⤵
  PID:12072
- C:\Windows\System\nECAoVw.exe
  C:\Windows\System\nECAoVw.exe
  2⤵
  PID:12104
- C:\Windows\System\wveToVx.exe
  C:\Windows\System\wveToVx.exe
  2⤵
  PID:12140
- C:\Windows\System\JPLcclN.exe
  C:\Windows\System\JPLcclN.exe
  2⤵
  PID:12172
- C:\Windows\System\pBAnTSg.exe
  C:\Windows\System\pBAnTSg.exe
  2⤵
  PID:12200
- C:\Windows\System\ZrbWhyv.exe
  C:\Windows\System\ZrbWhyv.exe
  2⤵
  PID:12232
- C:\Windows\System\eWQAJea.exe
  C:\Windows\System\eWQAJea.exe
  2⤵
  PID:12256
- C:\Windows\System\fEteLQz.exe
  C:\Windows\System\fEteLQz.exe
  2⤵
  PID:12272
- C:\Windows\System\TxwZNvO.exe
  C:\Windows\System\TxwZNvO.exe
  2⤵
  PID:11280
- C:\Windows\System\fJZtrHX.exe
  C:\Windows\System\fJZtrHX.exe
  2⤵
  PID:11336
- C:\Windows\System\tBMsqdP.exe
  C:\Windows\System\tBMsqdP.exe
  2⤵
  PID:11400
- C:\Windows\System\QBNqLLA.exe
  C:\Windows\System\QBNqLLA.exe
  2⤵
  PID:11508
- C:\Windows\System\zwwlhzx.exe
  C:\Windows\System\zwwlhzx.exe
  2⤵
  PID:11548
- C:\Windows\System\NmGsddc.exe
  C:\Windows\System\NmGsddc.exe
  2⤵
  PID:11628
- C:\Windows\System\vIrIdZn.exe
  C:\Windows\System\vIrIdZn.exe
  2⤵
  PID:11748
- C:\Windows\System\nkZtVxH.exe
  C:\Windows\System\nkZtVxH.exe
  2⤵
  PID:11840
- C:\Windows\System\dNqevTr.exe
  C:\Windows\System\dNqevTr.exe
  2⤵
  PID:11968
- C:\Windows\System\ydQXqWn.exe
  C:\Windows\System\ydQXqWn.exe
  2⤵
  PID:12048
- C:\Windows\System\LVuzSIJ.exe
  C:\Windows\System\LVuzSIJ.exe
  2⤵
  PID:12116
- C:\Windows\System\NqUREIN.exe
  C:\Windows\System\NqUREIN.exe
  2⤵
  PID:12184
- C:\Windows\System\YsrvZLq.exe
  C:\Windows\System\YsrvZLq.exe
  2⤵
  PID:12216
- C:\Windows\System\sHvVBbE.exe
  C:\Windows\System\sHvVBbE.exe
  2⤵
  PID:11268
- C:\Windows\System\CtneUaC.exe
  C:\Windows\System\CtneUaC.exe
  2⤵
  PID:11520
- C:\Windows\System\LBEQIkG.exe
  C:\Windows\System\LBEQIkG.exe
  2⤵
  PID:11572
- C:\Windows\System\kXVNdNR.exe
  C:\Windows\System\kXVNdNR.exe
  2⤵
  PID:11776
- C:\Windows\System\qjMeOcA.exe
  C:\Windows\System\qjMeOcA.exe
  2⤵
  PID:11908
- C:\Windows\System\QfbijKz.exe
  C:\Windows\System\QfbijKz.exe
  2⤵
  PID:12168
- C:\Windows\System\YNxNNEb.exe
  C:\Windows\System\YNxNNEb.exe
  2⤵
  PID:11428
- C:\Windows\System\dhutTnr.exe
  C:\Windows\System\dhutTnr.exe
  2⤵
  PID:11696
- C:\Windows\System\WUgYcnq.exe
  C:\Windows\System\WUgYcnq.exe
  2⤵
  PID:12092
- C:\Windows\System\NQGVmrp.exe
  C:\Windows\System\NQGVmrp.exe
  2⤵
  PID:11984
- C:\Windows\System\riKiXdm.exe
  C:\Windows\System\riKiXdm.exe
  2⤵
  PID:12320
- C:\Windows\System\WIbioyj.exe
  C:\Windows\System\WIbioyj.exe
  2⤵
  PID:12360
- C:\Windows\System\IhhuKhW.exe
  C:\Windows\System\IhhuKhW.exe
  2⤵
  PID:12388
- C:\Windows\System\SwDjmNo.exe
  C:\Windows\System\SwDjmNo.exe
  2⤵
  PID:12416
- C:\Windows\System\sPPGBDl.exe
  C:\Windows\System\sPPGBDl.exe
  2⤵
  PID:12444
- C:\Windows\System\pIKDUFw.exe
  C:\Windows\System\pIKDUFw.exe
  2⤵
  PID:12472
- C:\Windows\System\UoTnGip.exe
  C:\Windows\System\UoTnGip.exe
  2⤵
  PID:12500
- C:\Windows\System\GoMskUR.exe
  C:\Windows\System\GoMskUR.exe
  2⤵
  PID:12528
- C:\Windows\System\vSDiYPk.exe
  C:\Windows\System\vSDiYPk.exe
  2⤵
  PID:12556
- C:\Windows\System\fFSrVAw.exe
  C:\Windows\System\fFSrVAw.exe
  2⤵
  PID:12584
- C:\Windows\System\DwkNYwB.exe
  C:\Windows\System\DwkNYwB.exe
  2⤵
  PID:12612
- C:\Windows\System\HeCDNnk.exe
  C:\Windows\System\HeCDNnk.exe
  2⤵
  PID:12640
- C:\Windows\System\UmFYYWD.exe
  C:\Windows\System\UmFYYWD.exe
  2⤵
  PID:12668
- C:\Windows\System\LwSDdqW.exe
  C:\Windows\System\LwSDdqW.exe
  2⤵
  PID:12696
- C:\Windows\System\vTHeyrQ.exe
  C:\Windows\System\vTHeyrQ.exe
  2⤵
  PID:12724
- C:\Windows\System\zSFxHSb.exe
  C:\Windows\System\zSFxHSb.exe
  2⤵
  PID:12752
- C:\Windows\System\irlIufu.exe
  C:\Windows\System\irlIufu.exe
  2⤵
  PID:12780
- C:\Windows\System\NqzVxGX.exe
  C:\Windows\System\NqzVxGX.exe
  2⤵
  PID:12808
- C:\Windows\System\wsNqYdP.exe
  C:\Windows\System\wsNqYdP.exe
  2⤵
  PID:12840
- C:\Windows\System\wtAcwgZ.exe
  C:\Windows\System\wtAcwgZ.exe
  2⤵
  PID:12868
- C:\Windows\System\poJERoC.exe
  C:\Windows\System\poJERoC.exe
  2⤵
  PID:12896
- C:\Windows\System\EhyHiFi.exe
  C:\Windows\System\EhyHiFi.exe
  2⤵
  PID:12924
- C:\Windows\System\hcnkhvh.exe
  C:\Windows\System\hcnkhvh.exe
  2⤵
  PID:12952
- C:\Windows\System\aEXCwss.exe
  C:\Windows\System\aEXCwss.exe
  2⤵
  PID:12980
- C:\Windows\System\IFFYLNo.exe
  C:\Windows\System\IFFYLNo.exe
  2⤵
  PID:13008
- C:\Windows\System\ECMAWyj.exe
  C:\Windows\System\ECMAWyj.exe
  2⤵
  PID:13036
- C:\Windows\System\jxFNlZf.exe
  C:\Windows\System\jxFNlZf.exe
  2⤵
  PID:13064
- C:\Windows\System\hppsWJs.exe
  C:\Windows\System\hppsWJs.exe
  2⤵
  PID:13092
- C:\Windows\System\UKZxEuO.exe
  C:\Windows\System\UKZxEuO.exe
  2⤵
  PID:13120
- C:\Windows\System\DUYyjBK.exe
  C:\Windows\System\DUYyjBK.exe
  2⤵
  PID:13148
- C:\Windows\System\DYOMxtC.exe
  C:\Windows\System\DYOMxtC.exe
  2⤵
  PID:13176
- C:\Windows\System\LBZirQR.exe
  C:\Windows\System\LBZirQR.exe
  2⤵
  PID:13204
- C:\Windows\System\ztNrOHo.exe
  C:\Windows\System\ztNrOHo.exe
  2⤵
  PID:13232
- C:\Windows\System\GIdYkQX.exe
  C:\Windows\System\GIdYkQX.exe
  2⤵
  PID:13260
- C:\Windows\System\UpSTOVq.exe
  C:\Windows\System\UpSTOVq.exe
  2⤵
  PID:13288
- C:\Windows\System\RnCQMIK.exe
  C:\Windows\System\RnCQMIK.exe
  2⤵
  PID:11316
- C:\Windows\System\UwvgCWI.exe
  C:\Windows\System\UwvgCWI.exe
  2⤵
  PID:436
- C:\Windows\System\ivUrqqd.exe
  C:\Windows\System\ivUrqqd.exe
  2⤵
  PID:12384
- C:\Windows\System\RAVvLCI.exe
  C:\Windows\System\RAVvLCI.exe
  2⤵
  PID:12456
- C:\Windows\System\dOnAgdd.exe
  C:\Windows\System\dOnAgdd.exe
  2⤵
  PID:12520
- C:\Windows\System\NYEymfh.exe
  C:\Windows\System\NYEymfh.exe
  2⤵
  PID:12580
- C:\Windows\System\JZGCwLC.exe
  C:\Windows\System\JZGCwLC.exe
  2⤵
  PID:12636
- C:\Windows\System\FQWKFss.exe
  C:\Windows\System\FQWKFss.exe
  2⤵
  PID:12744
- C:\Windows\System\skQTGUr.exe
  C:\Windows\System\skQTGUr.exe
  2⤵
  PID:12776
- C:\Windows\System\uKCfhob.exe
  C:\Windows\System\uKCfhob.exe
  2⤵
  PID:12880
- C:\Windows\System\EaFJlAW.exe
  C:\Windows\System\EaFJlAW.exe
  2⤵
  PID:12920
- C:\Windows\System\SNJXNzE.exe
  C:\Windows\System\SNJXNzE.exe
  2⤵
  PID:13020
- C:\Windows\System\BOEItef.exe
  C:\Windows\System\BOEItef.exe
  2⤵
  PID:13084
- C:\Windows\System\lPlIqaU.exe
  C:\Windows\System\lPlIqaU.exe
  2⤵
  PID:13136
- C:\Windows\System\rirKbEw.exe
  C:\Windows\System\rirKbEw.exe
  2⤵
  PID:13216
- C:\Windows\System\QMvaNwi.exe
  C:\Windows\System\QMvaNwi.exe
  2⤵
  PID:13280
- C:\Windows\System\jSZhjJV.exe
  C:\Windows\System\jSZhjJV.exe
  2⤵
  PID:1808
- C:\Windows\System\aJqODfd.exe
  C:\Windows\System\aJqODfd.exe
  2⤵
  PID:12484
- C:\Windows\System\GBcdTra.exe
  C:\Windows\System\GBcdTra.exe
  2⤵
  PID:12604
- C:\Windows\System\xaOLbiY.exe
  C:\Windows\System\xaOLbiY.exe
  2⤵
  PID:12736
- C:\Windows\System\zzYPYkm.exe
  C:\Windows\System\zzYPYkm.exe
  2⤵
  PID:12916
- C:\Windows\System\RXvNJdR.exe
  C:\Windows\System\RXvNJdR.exe
  2⤵
  PID:13048
- C:\Windows\System\nlysZHK.exe
  C:\Windows\System\nlysZHK.exe
  2⤵
  PID:13196
- C:\Windows\System\hPanPGW.exe
  C:\Windows\System\hPanPGW.exe
  2⤵
  PID:12316
- C:\Windows\System\njlZIZY.exe
  C:\Windows\System\njlZIZY.exe
  2⤵
  PID:12632
- C:\Windows\System\ZKFMBAQ.exe
  C:\Windows\System\ZKFMBAQ.exe
  2⤵
  PID:13004
- C:\Windows\System\vPRPTcM.exe
  C:\Windows\System\vPRPTcM.exe
  2⤵
  PID:12296
- C:\Windows\System\LxHIuUs.exe
  C:\Windows\System\LxHIuUs.exe
  2⤵
  PID:13132
- C:\Windows\System\pLEdmmE.exe
  C:\Windows\System\pLEdmmE.exe
  2⤵
  PID:12992
- C:\Windows\System\OUHLqRq.exe
  C:\Windows\System\OUHLqRq.exe
  2⤵
  PID:13340
- C:\Windows\System\asPAqWy.exe
  C:\Windows\System\asPAqWy.exe
  2⤵
  PID:13368
- C:\Windows\System\foLdTrw.exe
  C:\Windows\System\foLdTrw.exe
  2⤵
  PID:13396
- C:\Windows\System\ExtrwOH.exe
  C:\Windows\System\ExtrwOH.exe
  2⤵
  PID:13424
- C:\Windows\System\lyRyPWw.exe
  C:\Windows\System\lyRyPWw.exe
  2⤵
  PID:13452
- C:\Windows\System\hRWcLqF.exe
  C:\Windows\System\hRWcLqF.exe
  2⤵
  PID:13480
- C:\Windows\System\kjVaMqG.exe
  C:\Windows\System\kjVaMqG.exe
  2⤵
  PID:13508
- C:\Windows\System\DmKJqKg.exe
  C:\Windows\System\DmKJqKg.exe
  2⤵
  PID:13536
- C:\Windows\System\GzECFXA.exe
  C:\Windows\System\GzECFXA.exe
  2⤵
  PID:13564
- C:\Windows\System\zbIRvrr.exe
  C:\Windows\System\zbIRvrr.exe
  2⤵
  PID:13592
- C:\Windows\System\myiQfyl.exe
  C:\Windows\System\myiQfyl.exe
  2⤵
  PID:13620
- C:\Windows\System\JohcxCM.exe
  C:\Windows\System\JohcxCM.exe
  2⤵
  PID:13648
- C:\Windows\System\VnObrkU.exe
  C:\Windows\System\VnObrkU.exe
  2⤵
  PID:13676
- C:\Windows\System\RjgujNJ.exe
  C:\Windows\System\RjgujNJ.exe
  2⤵
  PID:13704
- C:\Windows\System\VPPxozP.exe
  C:\Windows\System\VPPxozP.exe
  2⤵
  PID:13732
- C:\Windows\System\xcOfgcU.exe
  C:\Windows\System\xcOfgcU.exe
  2⤵
  PID:13760
- C:\Windows\System\QstsDoQ.exe
  C:\Windows\System\QstsDoQ.exe
  2⤵
  PID:13792
- C:\Windows\System\XDRvOMe.exe
  C:\Windows\System\XDRvOMe.exe
  2⤵
  PID:13820
- C:\Windows\System\xlKeipl.exe
  C:\Windows\System\xlKeipl.exe
  2⤵
  PID:13848
- C:\Windows\System\VvhujfT.exe
  C:\Windows\System\VvhujfT.exe
  2⤵
  PID:13876
- C:\Windows\System\tBFlumV.exe
  C:\Windows\System\tBFlumV.exe
  2⤵
  PID:13904
- C:\Windows\System\BNzCcBD.exe
  C:\Windows\System\BNzCcBD.exe
  2⤵
  PID:13932
- C:\Windows\System\haJnaqq.exe
  C:\Windows\System\haJnaqq.exe
  2⤵
  PID:13960
- C:\Windows\System\ZIfHPQL.exe
  C:\Windows\System\ZIfHPQL.exe
  2⤵
  PID:13988
- C:\Windows\System\HkuMyjC.exe
  C:\Windows\System\HkuMyjC.exe
  2⤵
  PID:14016
- C:\Windows\System\mKHmdfz.exe
  C:\Windows\System\mKHmdfz.exe
  2⤵
  PID:14044
- C:\Windows\System\LZLcsQH.exe
  C:\Windows\System\LZLcsQH.exe
  2⤵
  PID:14072
- C:\Windows\System\GLuhCRV.exe
  C:\Windows\System\GLuhCRV.exe
  2⤵
  PID:14100
- C:\Windows\System\xONmkuN.exe
  C:\Windows\System\xONmkuN.exe
  2⤵
  PID:14128
- C:\Windows\System\yqIMtwK.exe
  C:\Windows\System\yqIMtwK.exe
  2⤵
  PID:14156
- C:\Windows\System\FFqnpXo.exe
  C:\Windows\System\FFqnpXo.exe
  2⤵
  PID:14184
- C:\Windows\System\XIcsnMC.exe
  C:\Windows\System\XIcsnMC.exe
  2⤵
  PID:14212
- C:\Windows\System\KRqdWvR.exe
  C:\Windows\System\KRqdWvR.exe
  2⤵
  PID:14240
- C:\Windows\System\rshMnFL.exe
  C:\Windows\System\rshMnFL.exe
  2⤵
  PID:14268
- C:\Windows\System\MWoRSuH.exe
  C:\Windows\System\MWoRSuH.exe
  2⤵
  PID:14296
- C:\Windows\System\PxhsTjk.exe
  C:\Windows\System\PxhsTjk.exe
  2⤵
  PID:14324
- C:\Windows\System\LhIkiYT.exe
  C:\Windows\System\LhIkiYT.exe
  2⤵
  PID:12836
- C:\Windows\System\FDsGFDw.exe
  C:\Windows\System\FDsGFDw.exe
  2⤵
  PID:13352
- C:\Windows\System\EKuHRZh.exe
  C:\Windows\System\EKuHRZh.exe
  2⤵
  PID:13472
- C:\Windows\System\EGssSyM.exe
  C:\Windows\System\EGssSyM.exe
  2⤵
  PID:13556
- C:\Windows\System\dyXtkxE.exe
  C:\Windows\System\dyXtkxE.exe
  2⤵
  PID:13616
- C:\Windows\System\PJKQyIB.exe
  C:\Windows\System\PJKQyIB.exe
  2⤵
  PID:13672
- C:\Windows\System\EuIXtqp.exe
  C:\Windows\System\EuIXtqp.exe
  2⤵
  PID:13744
- C:\Windows\System\yBuuWmI.exe
  C:\Windows\System\yBuuWmI.exe
  2⤵
  PID:13788
- C:\Windows\System\zbwYtuy.exe
  C:\Windows\System\zbwYtuy.exe
  2⤵
  PID:13860
- C:\Windows\System\vuogZAb.exe
  C:\Windows\System\vuogZAb.exe
  2⤵
  PID:13924
- C:\Windows\System\peCgtWi.exe
  C:\Windows\System\peCgtWi.exe
  2⤵
  PID:13984
- C:\Windows\System\MwGQvBK.exe
  C:\Windows\System\MwGQvBK.exe
  2⤵
  PID:14040
- C:\Windows\System\qTopSrf.exe
  C:\Windows\System\qTopSrf.exe
  2⤵
  PID:14112
- C:\Windows\System\YCxWmiE.exe
  C:\Windows\System\YCxWmiE.exe
  2⤵
  PID:14176
- C:\Windows\System\XDSiKMg.exe
  C:\Windows\System\XDSiKMg.exe
  2⤵
  PID:14236
- C:\Windows\System\ZJQydCi.exe
  C:\Windows\System\ZJQydCi.exe
  2⤵
  PID:14308
- C:\Windows\System\LYhjTro.exe
  C:\Windows\System\LYhjTro.exe
  2⤵
  PID:13364
- C:\Windows\System\ivEOtes.exe
  C:\Windows\System\ivEOtes.exe
  2⤵
  PID:13492
- C:\Windows\System\cLEwEIV.exe
  C:\Windows\System\cLEwEIV.exe
  2⤵
  PID:13716
- C:\Windows\System\AxLoKPs.exe
  C:\Windows\System\AxLoKPs.exe
  2⤵
  PID:13840
- C:\Windows\System\NTFNiMy.exe
  C:\Windows\System\NTFNiMy.exe
  2⤵
  PID:13916
- C:\Windows\System\zrkHfji.exe
  C:\Windows\System\zrkHfji.exe
  2⤵
  PID:14012
- C:\Windows\System\JqFQLyC.exe
  C:\Windows\System\JqFQLyC.exe
  2⤵
  PID:14152
- C:\Windows\System\XnOTlgO.exe
  C:\Windows\System\XnOTlgO.exe
  2⤵
  PID:14292
- C:\Windows\System\RdaMaZs.exe
  C:\Windows\System\RdaMaZs.exe
  2⤵
  PID:13668
- C:\Windows\System\IiCoote.exe
  C:\Windows\System\IiCoote.exe
  2⤵
  PID:14288
- C:\Windows\System\CLcWwAs.exe
  C:\Windows\System\CLcWwAs.exe
  2⤵
  PID:13900
- C:\Windows\System\wyLSQuz.exe
  C:\Windows\System\wyLSQuz.exe
  2⤵
  PID:14092
- C:\Windows\System\uTDIFQO.exe
  C:\Windows\System\uTDIFQO.exe
  2⤵
  PID:14412
- C:\Windows\System\vcorgqY.exe
  C:\Windows\System\vcorgqY.exe
  2⤵
  PID:14428
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14428 -s 248
    3⤵
    PID:14844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CYdeufz.exe

Filesize
2.5MB

MD5
8f97e5adc5af28e3bf54b440ee3e3620

SHA1
a1929470e50d2c2b5a0dafefdba655791cf8ee66

SHA256
9cb25ef7297db13e4131713128af8398618b542a058afccd6ad36f2c6320a4d1

SHA512
c0344959f65caf238ae4bedae3ece2f942ef394ce632a17c5df68cd63bbb4c5eb9d75b17d08e70a2d0f0fbb0fd133b9ea0399029e931bd5fbde3eb515d2e4e68

Download Submit
C:\Windows\System\EDmUoPu.exe

Filesize
2.5MB

MD5
e7551fa43bb627f8b7e0f3f9e58d9e98

SHA1
e658bac2d0b48bb699b49717b804faaa1e3a5949

SHA256
6f1319f4baadcfabd0f1b8ff628b9eb06068beec8b8e8389b2a0da061ffba120

SHA512
9406369cadfad609d642f4f90dc34d123446834176b29feb0ab8854dae884bd2b1326e81b8e336d0f1763848947fdbbdc694879f7cffe01425deec98fc4161aa

Download Submit
C:\Windows\System\FiZeJYW.exe

Filesize
2.5MB

MD5
a9288d65e53a88c44c119f870e6cf0cd

SHA1
2b4584dfb1fe5a0c1b5e46337b5ac8a948c70751

SHA256
02b0421cb1d16292762ee4fe2d551ed846284a389c41a3812abd0f79c1892ee2

SHA512
be2f0f3233b15550642baaff7a2eb87ea7d0451363eb3f1ba9db6d6d2110b867e1fb9b185bdbb762dc2aee9ff7568c3fd45bc810ec2360fda1e983820e8b98f4

Download Submit
C:\Windows\System\GoQRPYY.exe

Filesize
2.5MB

MD5
d9b4f99b72b76b2dc94a2963c8d680a0

SHA1
ed8a93de791cf034bf886fd1cd2534569ef37a88

SHA256
0dcffd0f3278202022cfb7f52358e2e6dcec56b61a526f46cec88bd0e8620a42

SHA512
25843c8be1952aa4a534556892d025ee0fb39b7ddfb2ab4fde87aea6afae1eded28aacba9d50ff9c6ddb8db3f6d2c0663bd37d990d9edbf6c33cbb31d702a14c

Download Submit
C:\Windows\System\JFwOjOQ.exe

Filesize
2.5MB

MD5
c7a174adbcac95eeb01cf0ce99d44fef

SHA1
fd76cb32be2862b6c8db4e27ac4e8f83fc84b2ba

SHA256
cd6b8bb6fe834d959acd59812d3584e83d840a6303fddf22ad12fe1c344a613a

SHA512
aa84c15016d31ba9db8ae97e2748e6bff776d1a9c7149277e8ef7874fe1f4e4ba34635fcafa7edb0511cc8d7d134677d0d6cc0b21177458f5ff1f60681a6337e

Download Submit
C:\Windows\System\JdKobMb.exe

Filesize
2.5MB

MD5
1743001fe9e10fcf24784406c61bc216

SHA1
8826576ae35c22e5205256bd50a48c074060f1a7

SHA256
39da1d9ce4e67f10dacdda2804e665f4a8158b78d04717239890df3715535ede

SHA512
d15865948dcd71f706ff1633be8c8fac1923038b348668b588006ec5a13d32227d477a2889a0808b87be31fe703b20aa1568b61448208ba56983d26027344064

Download Submit
C:\Windows\System\KEqzdZY.exe

Filesize
2.5MB

MD5
3981eed7d2139128a5012fa1b0fc1672

SHA1
fa1c7c07fc85d4e2ccdd540de283ce8e34a46d25

SHA256
cf0835ad7532e69795cc68890165f4e6239cf48f4d8dda21e0ebb18ba58f949c

SHA512
2207ed51053125db7acdd9da9d7f3c93a1b23e032dd63e780f898ecd26f6a4e6a3b6bcef04c003ad500f971ef2288ba0d7efef2fbafdab4823743891b726ce9e

Download Submit
C:\Windows\System\KgFEQaL.exe

Filesize
2.5MB

MD5
9068500e404e79ebad71a7f126493632

SHA1
ae4dcc0973e4c09ab5903c6eaf908569f232505a

SHA256
2ff60b2136177bc756746c76b4a204e6720af5edf1edc2301d5fecf3e922305d

SHA512
6574d13236ce8b35c849b474c93ef15977fa5aa0944abc245b8feb546df0502919a4cad3f6bc76530e6b891f9441374a52a25fda868b12eb65ff65284638d85c

Download Submit
C:\Windows\System\MNItAGw.exe

Filesize
2.5MB

MD5
822ad925b959fe8081fca945fe217fc6

SHA1
a9e94d430b31d2c0eb2814610c9a2ba229e24a7b

SHA256
560a50beec2b8c4b78d9cbcc5ad17ab51f35493a3a11c611e8940acca882eebc

SHA512
ef36a619639be14049fdf7313eda9a4a53479bac6ac1d075e6b35cd88b631729719f53bc91f41df206576609e3de75eb275bfb812fd5f0b38a1daab47c01d49e

Download Submit
C:\Windows\System\NKRQHaP.exe

Filesize
2.5MB

MD5
7742920e0c7df4b1cebd5d679bacfe47

SHA1
e4e14646e4821beef6df4459e6defec011e401e4

SHA256
0096ef40431beef53fd80b0043e2b2f6bd379f398a979a9a0b0c736174748897

SHA512
c858a411f890dd584f29082d8d7e2c9b552c28ed9460a5e3405f84cd379b1146711b4bfa3255384c5d660fa8dca6ec75a4a49e90e920c9a7dffd870b311639a3

Download Submit
C:\Windows\System\RbHNTJR.exe

Filesize
2.5MB

MD5
3361fe54febe634c1399dc8a578eda82

SHA1
88c0872c5858b59e2bf9ce95e982eb2ee9107ca0

SHA256
8358c627f6c83339756da8309a3151ceeba2ee53096edf01c4258de348f74f65

SHA512
7c8970b652a93239620495c4026ee4c3d7935c4b8e9ea1ec8ae8f1d06871fdb9a8431be0e9035614f3526cdd4b47e428ee1d29afa0953853ce455dc89487e607

Download Submit
C:\Windows\System\TIYikuc.exe

Filesize
2.5MB

MD5
b5c3ce92f4139321a54481635baabf5c

SHA1
eb3b50b6630eb9887e5f3b527e88ecdce1a5160a

SHA256
c7ad1a76cacd87ed9f432e04ad2ad7c2c85f6aa49573034aa0f6ecfec4a944fb

SHA512
dc6d7abd5151cdc7a2d8c870201ea023eb51c59fbdb7f56db5b51b19e390e1e271eed2cedbb67f8c59856238c458c24ad2c8a3f8ab21563b30e59907645691da

Download Submit
C:\Windows\System\TOmIkCN.exe

Filesize
2.5MB

MD5
fa0786a935505ea52588b6daa56d6ef6

SHA1
6e81af110b250362d9ee2a41b3f48ce5c1154807

SHA256
8609f53de831b23d8d340ee646591e41ebe333fc5583b57b718fca18ce3edfbb

SHA512
8322c55aca813e01a1a65085d93b35e8592194b868a9da705f75e3a38ad8dc665af8b41ac5a010050db693b8804483afd883e493d1452ffb30ad77cfe2c26298

Download Submit
C:\Windows\System\TYVksun.exe

Filesize
2.5MB

MD5
e981763da3d7b50a5866159a0f9bbc72

SHA1
06699d7cb661c64a4f46e601c4c5ce6f99bdadd7

SHA256
38e11ba1b77770b4ff000e280e5517964d3f37994f669b21b01a54ec7248a909

SHA512
8e1ac96c16b6cc24ea47254c8d6babc581eeca2c035dc741cbe18814b43318217b77f67b5df506074543cfd0d76557b0866f78566048b475e42f458324ee3e56

Download Submit
C:\Windows\System\XVcVftj.exe

Filesize
2.5MB

MD5
79e355b5d3223de01615eaa5cf1e3735

SHA1
3c3adcb531defdf6d05f161da42d5eb05cb76c8d

SHA256
532a3b04085ff47ab1d8556ef27cfed73db9c73dc1f529d8c13cf318037c8e33

SHA512
711f96a38a0f55ddacdfc0aed184631e132b1752dc37a2e26b4bf1fbb254a7571b49e5ff3de52ca6f2334a5f7cc1eb08aa2fb0d41b1e24cbb749688986aaa65b

Download Submit
C:\Windows\System\XhMxzYF.exe

Filesize
2.5MB

MD5
870229024436d7dcfab5c3d0a72c7efe

SHA1
a10d105de301465067cd08a6c17ddffbf273c70d

SHA256
a969e28294ffc18472731e4c800b51c6095c31496ba506fd4dbe19d54c4a368c

SHA512
ba4f9c4fe654783747d40515fda583f5abde245939b765115fa7e65ce007cb3aa903e1a441e437a8cf89e1854d9762213288a5ccc6328ecc495c275f3c6be275

Download Submit
C:\Windows\System\ZJfZoXm.exe

Filesize
2.5MB

MD5
89fe398543ae3a1dc2847fb1c6bf0256

SHA1
27e7e77271558197b933f060666094be45150d1a

SHA256
89951296a85b842ef1a9ffa0ebad54e7a3abf7e1ebcd3ffae661ee1693483663

SHA512
cb4b2695524779d238f8f7e1fdd8077924b95cf856066c9b4642a472a1eb6c35ed9594e371aadc1742eb2e01159bdf7b0edaa02696882d65f74bf6a16d43ee6d

Download Submit
C:\Windows\System\acVHwpH.exe

Filesize
2.5MB

MD5
8c0fd3139c021b4b8e53ce5688fb21d6

SHA1
534d322eccf9fd67a99b70db2f3908fb8476d545

SHA256
d01fdb01c9de28af00508138873b06e42a928cdad6174cb9a76d453a59f4fd68

SHA512
b7b9458bad15690c4bf4aa17f285d6dc0c6cffa6744f9e3fdff0856865e926f46b4cafc5a93c61821aa8043b6570c6ffb1823be9976c3d6f7883d6d5b359ab7a

Download Submit
C:\Windows\System\cJWfmhG.exe

Filesize
2.5MB

MD5
b0c84b2a4bdb60cff45b593347a85ca2

SHA1
6bb7a02afeb153b2319a55c42c3ab3bed497c443

SHA256
43e0ee9df7a467bc272a46368bb83900d0a83279403ee242d1e2c0f22a82fb3c

SHA512
2ff18ce020b7f1912f357aa2a05d26f5139ca1e67627eaef8763cedc4cf6d28aee7a746517b3a01b23d94a85fd08d8c7ee6aa8ea25db65085e3ee31651f83236

Download Submit
C:\Windows\System\dEkeMAc.exe

Filesize
2.5MB

MD5
11ff63a52be58afc24c752ef129f9b8d

SHA1
0bfa6d892e8104c7e50d73ecd11cb1902537179a

SHA256
8f4204b0d51c32ac321d7b16fcf6183665a86819e006362f2927cab2631e7880

SHA512
81da00a05c8ae322ded1a91b79140f3f88a35727e6c4535037ab9b86e9492d2b0b709bfa0b293b20e3d7f13ca644922b674522c38aace50e625e07066fd749ad

Download Submit
C:\Windows\System\dygoWDs.exe

Filesize
2.5MB

MD5
7fa3ec58892b22d2180e88bc214dcf47

SHA1
f8d3c8992365efc8662fbaadab9514845cb9626d

SHA256
29f53cd7f3523d31616e1089ffc86e9b8236267e3d116e64d79a56a749d06ebc

SHA512
180cb29e0e061e0e289ce83054cd284f472c6cc21c8a3b386569045340e19871ebb2fbd3d04c17c8db80e680fa471c95bf7a8f6cbb5ba669057866e4e6055d33

Download Submit
C:\Windows\System\fFpuPHp.exe

Filesize
2.5MB

MD5
bc899076ec797a4bd7b795aa398f7062

SHA1
e17959b31d3fd774367f92790cb385a14fcd5ad8

SHA256
7f0705ddf3122af23b6227e15a3356feccdf67b731a6a82d898de61bed90f5f3

SHA512
47dec2d0c77f4bfe78585a4bff035f1ac684688d7fae0541c0eb40f81b34a2f74620e000b40fc9b9570b0a4f76c9dc7c78c8a4269e05351526e97770859bcc62

Download Submit
C:\Windows\System\fOhhiND.exe

Filesize
2.5MB

MD5
d68b0ccaaf5fedcb73acf5a55753877e

SHA1
6532aad42042c843da200e3be5c158234a1a26bc

SHA256
3aa8280ea8a3c5451f97b1f429cb79a37f51c319c661518cfb61cc1e6c9f51da

SHA512
0212f6520882505f74ea720c5620a416982bf1a76173d473accaba91e8abc42ccde5c02953717803c6382ad409cfd23a798c992fec7315711da964b17993b310

Download Submit
C:\Windows\System\hmWEeyE.exe

Filesize
2.5MB

MD5
d437ae14167f42a4ef00822a32d4a86f

SHA1
5ba83325b6d554198e36f90fb0031889f361c195

SHA256
bd9def70998ff4995b0c6708a988919c1dea83ae27ac7846c501b28160eb2c1f

SHA512
175d3359373c96825e839bfb40b7995f3009b912c971f658c19d93b3f877b5a860ebfcc584ef797cf7bb2477a1bbcec201978e5c61ec9ee810350e5eee59460a

Download Submit
C:\Windows\System\iCXABId.exe

Filesize
2.5MB

MD5
c55815d31061e5e643a9850ff4954fbb

SHA1
07a3f1fba3ef8b53d3527bbd9d48f5916d652e1e

SHA256
06c834b33da5816f35c78399f41a86b64bfd9674315f5c0707c9664b779fa191

SHA512
ea7581f7fdc0eb48330512c8aa7a1dfa08402181542ba045ec5603bb957b51d6767026e27e189c987e0d6e2219b78c3cd6af3adeb8332328500bc791e321ddd1

Download Submit
C:\Windows\System\iTRmrMY.exe

Filesize
2.5MB

MD5
e69b68dd1cb3a5947d305a29e3d0d72a

SHA1
40d176564f5cfbe5da3e214059254e9307fe2944

SHA256
c17c2913d49c439f8c839d7de01e6d2d2cb67b71005326dc897ffedc050b8d45

SHA512
736d70b54ba12a07634f9c848d5b87154bcc1ea144441a072be26e25ff0f365a467f78d38c273f3a998c2ebc403f2b5e2ce5cb8f6752d47ed193e7e4e655697f

Download Submit
C:\Windows\System\jMqiCIQ.exe

Filesize
2.5MB

MD5
3fae6e4f25c0271f003e2dfd2847d983

SHA1
0dbbb7791c8ee49045a696261dd05913a7a8980e

SHA256
7e01bc631c22eb407361f54744b500420dc6abda2ade238ef839369b6150ffbd

SHA512
fde6d1e2e0522532b5ebc988f94790ba9d519e8146b82984f620d8c96e730c9e1c1b5ff573e9f64cbd83c2a7c5ca8b56ed351a35d340229b7f4e7dc096ddeddc

Download Submit
C:\Windows\System\lQwPwvs.exe

Filesize
2.5MB

MD5
a19c35e4f2c26bcbad1a22c022b22acc

SHA1
477ffe87069b100ec22a82b7f8ec66e2de111e09

SHA256
8cffc31128140539be4c0c8dda89057ffaa08da976460e99be45b75222a6b9f9

SHA512
65dabc53d685a5abc9e71b2c700673b701a45c257dee57b13c3bd08be1c2069a6fd177449ad13f165291756f2438e73a9ceb89a15eb42673bf05db0a911a85de

Download Submit
C:\Windows\System\mYIYOYV.exe

Filesize
2.5MB

MD5
618661b82fb9f6f4e9c86a466aab6afb

SHA1
3c1dbcc71dd89697a386cd50ef1c6be6d08d85f5

SHA256
6d56709a6d5c19b6f7bce638fa631007d4d70066c2959083fce4e318541ca647

SHA512
a2faf6dcf464c7c0cfebd2962e69904d3943f757fe8e47d9b7b29024aede0e9e06db11566e32871a3ec55aeab7400871e98a673ccee4f35ac5da6d8ac5a47763

Download Submit
C:\Windows\System\mawSRBG.exe

Filesize
2.5MB

MD5
b9980f973a8ba3b83104742502593349

SHA1
9dd19c413a6ff2c6cdf5027b33285c0211f79943

SHA256
6c65c2ebf6aeaee0b2b8989c5e9002b3a5392d56c74e3ac6ce57f56c889f1503

SHA512
5bb31de98379f45ce238ee9fe8e26aad30956de9af220e0e8871c9ecad6351f03d543e524ea44e4d1ff43cad3f8a66ad9bcb7ce5e3bb292d5e226a278b1651f8

Download Submit
C:\Windows\System\okvbrwA.exe

Filesize
2.5MB

MD5
dfe8b7bd349c99c68e184be26825b00d

SHA1
b85bbba32da0be41a52be8bd47e3e79c6674fad3

SHA256
6df4a49e0b914f47f3bd35bf289550a413ec931005e1b9cf4cfd79d84b93ba52

SHA512
f583549c11bdcf1e4a897fbe3103368662b0c35d857cba821fffcb53e749506b5ba4211f2b811b8f3c3339a3bb049063e7eae6caab820d92cdcba090baf3e67e

Download Submit
C:\Windows\System\qmTYAGB.exe

Filesize
2.5MB

MD5
5f9de1cf972849c608acb9172656108e

SHA1
c8175caa86e7a9ea86bd94fd6c3b1872a31cc343

SHA256
8d7ff88d16b578d64301327ef1b10c8509017ef1c4666518d863a88e61365fcc

SHA512
abd69de6f6b3adbc4a0a7f03b1abe08c07b77b694b4169aa3d567b9a4170c2bc0cfbfc9959f7d6206d796d7271d3aa81d3b3616347ae4ad1f300b50205bdde23

Download Submit
C:\Windows\System\sQYTOcV.exe

Filesize
2.5MB

MD5
31443c56582b0a871d5ab79fc6916856

SHA1
c6304c3f5afac84310bcdacbc883d4b86b03cfde

SHA256
a79cae0f6e9150b4fd8b541b3b73180f8b0f27b7e5291cb578851b4077927468

SHA512
dc14a24a30a93ba34e15f0ee1816ad9ded5675b52653d77b913bffb8112097dbaf950e48b59196fa5fd9dc4cfa50102d73637ab7889b031c41b36e6ef655c9bf

Download Submit
C:\Windows\System\sULsBZe.exe

Filesize
2.5MB

MD5
c3d8513e76faf723bd09406067b4b418

SHA1
9a11bf8fa815333044eb2c7070dcf5ddbec3f535

SHA256
073b79885161c39beb2f174dcfeaa62460b0acbc7994d9fef4aee67d0071b0f9

SHA512
3c39537f1a13121541bdb4c556ced82eb68c3ccc36b9f483142bbfd72d35782811b5ec886651751f31470f31c2e6afa5b67923155cc0b8f40346c4cf842f971d

Download Submit
C:\Windows\System\ukurtkp.exe

Filesize
2.5MB

MD5
2e4d474023adf90f0d0b98f36218ee49

SHA1
ed822f1d7961ea5f76517526efeff090ed1008be

SHA256
da86eac035150a5bbeb09132a0318de8ba6effd1632c8a821bc8ac3879f68d5d

SHA512
794dd5f7a132e0380425e9650abc4454997b0f91a7a3bc139d23dbc1ccf4fcde4b902046f5a48e8e83ae86766f95107038bff2d131528004e814c83c5ea4cbf7

Download Submit
memory/116-2146-0x00007FF62B340000-0x00007FF62B694000-memory.dmp

Filesize
3.3MB

Download
memory/116-188-0x00007FF62B340000-0x00007FF62B694000-memory.dmp

Filesize
3.3MB

Download
memory/400-25-0x00007FF74F860000-0x00007FF74FBB4000-memory.dmp

Filesize
3.3MB

Download
memory/400-2134-0x00007FF74F860000-0x00007FF74FBB4000-memory.dmp

Filesize
3.3MB

Download
memory/448-90-0x00007FF7CC330000-0x00007FF7CC684000-memory.dmp

Filesize
3.3MB

Download
memory/448-2130-0x00007FF7CC330000-0x00007FF7CC684000-memory.dmp

Filesize
3.3MB

Download
memory/448-2149-0x00007FF7CC330000-0x00007FF7CC684000-memory.dmp

Filesize
3.3MB

Download
memory/732-2147-0x00007FF7F02C0000-0x00007FF7F0614000-memory.dmp

Filesize
3.3MB

Download
memory/732-278-0x00007FF7F02C0000-0x00007FF7F0614000-memory.dmp

Filesize
3.3MB

Download
memory/1096-2158-0x00007FF717400000-0x00007FF717754000-memory.dmp

Filesize
3.3MB

Download
memory/1096-261-0x00007FF717400000-0x00007FF717754000-memory.dmp

Filesize
3.3MB

Download
memory/1328-126-0x00007FF677E00000-0x00007FF678154000-memory.dmp

Filesize
3.3MB

Download
memory/1328-2127-0x00007FF677E00000-0x00007FF678154000-memory.dmp

Filesize
3.3MB

Download
memory/1328-2150-0x00007FF677E00000-0x00007FF678154000-memory.dmp

Filesize
3.3MB

Download
memory/1480-80-0x00007FF71C1D0000-0x00007FF71C524000-memory.dmp

Filesize
3.3MB

Download
memory/1480-2141-0x00007FF71C1D0000-0x00007FF71C524000-memory.dmp

Filesize
3.3MB

Download
memory/1504-0-0x00007FF6C2E50000-0x00007FF6C31A4000-memory.dmp

Filesize
3.3MB

Download
memory/1504-1-0x000001E7308D0000-0x000001E7308E0000-memory.dmp

Filesize
64KB

Download
memory/1504-944-0x00007FF6C2E50000-0x00007FF6C31A4000-memory.dmp

Filesize
3.3MB

Download
memory/1584-2154-0x00007FF7D25C0000-0x00007FF7D2914000-memory.dmp

Filesize
3.3MB

Download
memory/1584-162-0x00007FF7D25C0000-0x00007FF7D2914000-memory.dmp

Filesize
3.3MB

Download
memory/1640-2151-0x00007FF75B820000-0x00007FF75BB74000-memory.dmp

Filesize
3.3MB

Download
memory/1640-2128-0x00007FF75B820000-0x00007FF75BB74000-memory.dmp

Filesize
3.3MB

Download
memory/1640-159-0x00007FF75B820000-0x00007FF75BB74000-memory.dmp

Filesize
3.3MB

Download
memory/1692-2155-0x00007FF6F9770000-0x00007FF6F9AC4000-memory.dmp

Filesize
3.3MB

Download
memory/1692-262-0x00007FF6F9770000-0x00007FF6F9AC4000-memory.dmp

Filesize
3.3MB

Download
memory/1740-139-0x00007FF69AAD0000-0x00007FF69AE24000-memory.dmp

Filesize
3.3MB

Download
memory/1740-2153-0x00007FF69AAD0000-0x00007FF69AE24000-memory.dmp

Filesize
3.3MB

Download
memory/1740-2131-0x00007FF69AAD0000-0x00007FF69AE24000-memory.dmp

Filesize
3.3MB

Download
memory/1776-34-0x00007FF735C50000-0x00007FF735FA4000-memory.dmp

Filesize
3.3MB

Download
memory/1776-2121-0x00007FF735C50000-0x00007FF735FA4000-memory.dmp

Filesize
3.3MB

Download
memory/1776-2136-0x00007FF735C50000-0x00007FF735FA4000-memory.dmp

Filesize
3.3MB

Download
memory/2580-2140-0x00007FF750CE0000-0x00007FF751034000-memory.dmp

Filesize
3.3MB

Download
memory/2580-265-0x00007FF750CE0000-0x00007FF751034000-memory.dmp

Filesize
3.3MB

Download
memory/2716-119-0x00007FF6D4CB0000-0x00007FF6D5004000-memory.dmp

Filesize
3.3MB

Download
memory/2716-2126-0x00007FF6D4CB0000-0x00007FF6D5004000-memory.dmp

Filesize
3.3MB

Download
memory/2716-2148-0x00007FF6D4CB0000-0x00007FF6D5004000-memory.dmp

Filesize
3.3MB

Download
memory/2912-8-0x00007FF6FDF30000-0x00007FF6FE284000-memory.dmp

Filesize
3.3MB

Download
memory/2912-2132-0x00007FF6FDF30000-0x00007FF6FE284000-memory.dmp

Filesize
3.3MB

Download
memory/3092-2160-0x00007FF729D50000-0x00007FF72A0A4000-memory.dmp

Filesize
3.3MB

Download
memory/3092-280-0x00007FF729D50000-0x00007FF72A0A4000-memory.dmp

Filesize
3.3MB

Download
memory/3468-2145-0x00007FF7B83F0000-0x00007FF7B8744000-memory.dmp

Filesize
3.3MB

Download
memory/3468-107-0x00007FF7B83F0000-0x00007FF7B8744000-memory.dmp

Filesize
3.3MB

Download
memory/3468-2125-0x00007FF7B83F0000-0x00007FF7B8744000-memory.dmp

Filesize
3.3MB

Download
memory/3916-2139-0x00007FF605CA0000-0x00007FF605FF4000-memory.dmp

Filesize
3.3MB

Download
memory/3916-55-0x00007FF605CA0000-0x00007FF605FF4000-memory.dmp

Filesize
3.3MB

Download
memory/3916-2124-0x00007FF605CA0000-0x00007FF605FF4000-memory.dmp

Filesize
3.3MB

Download
memory/4472-194-0x00007FF7223A0000-0x00007FF7226F4000-memory.dmp

Filesize
3.3MB

Download
memory/4472-2156-0x00007FF7223A0000-0x00007FF7226F4000-memory.dmp

Filesize
3.3MB

Download
memory/4548-2159-0x00007FF7409A0000-0x00007FF740CF4000-memory.dmp

Filesize
3.3MB

Download
memory/4548-281-0x00007FF7409A0000-0x00007FF740CF4000-memory.dmp

Filesize
3.3MB

Download
memory/4552-2133-0x00007FF652700000-0x00007FF652A54000-memory.dmp

Filesize
3.3MB

Download
memory/4552-17-0x00007FF652700000-0x00007FF652A54000-memory.dmp

Filesize
3.3MB

Download
memory/4692-279-0x00007FF6FF270000-0x00007FF6FF5C4000-memory.dmp

Filesize
3.3MB

Download
memory/4692-2152-0x00007FF6FF270000-0x00007FF6FF5C4000-memory.dmp

Filesize
3.3MB

Download
memory/4704-270-0x00007FF6B70D0000-0x00007FF6B7424000-memory.dmp

Filesize
3.3MB

Download
memory/4704-2144-0x00007FF6B70D0000-0x00007FF6B7424000-memory.dmp

Filesize
3.3MB

Download
memory/4748-218-0x00007FF687E90000-0x00007FF6881E4000-memory.dmp

Filesize
3.3MB

Download
memory/4748-2157-0x00007FF687E90000-0x00007FF6881E4000-memory.dmp

Filesize
3.3MB

Download
memory/4780-2129-0x00007FF7DDA50000-0x00007FF7DDDA4000-memory.dmp

Filesize
3.3MB

Download
memory/4780-2143-0x00007FF7DDA50000-0x00007FF7DDDA4000-memory.dmp

Filesize
3.3MB

Download
memory/4780-83-0x00007FF7DDA50000-0x00007FF7DDDA4000-memory.dmp

Filesize
3.3MB

Download
memory/4908-43-0x00007FF6D6E10000-0x00007FF6D7164000-memory.dmp

Filesize
3.3MB

Download
memory/4908-2122-0x00007FF6D6E10000-0x00007FF6D7164000-memory.dmp

Filesize
3.3MB

Download
memory/4908-2137-0x00007FF6D6E10000-0x00007FF6D7164000-memory.dmp

Filesize
3.3MB

Download
memory/4988-50-0x00007FF7D0480000-0x00007FF7D07D4000-memory.dmp

Filesize
3.3MB

Download
memory/4988-2138-0x00007FF7D0480000-0x00007FF7D07D4000-memory.dmp

Filesize
3.3MB

Download
memory/4988-2123-0x00007FF7D0480000-0x00007FF7D07D4000-memory.dmp

Filesize
3.3MB

Download
memory/5032-2135-0x00007FF678330000-0x00007FF678684000-memory.dmp

Filesize
3.3MB

Download
memory/5032-29-0x00007FF678330000-0x00007FF678684000-memory.dmp

Filesize
3.3MB

Download
memory/5044-264-0x00007FF658160000-0x00007FF6584B4000-memory.dmp

Filesize
3.3MB

Download
memory/5044-2142-0x00007FF658160000-0x00007FF6584B4000-memory.dmp

Filesize
3.3MB

Download