xmrig | bb2e99ecd9407a235caeefbde64e2c9be676456cb0bcc7824149aee4ff29e846

Analysis

max time kernel
132s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
Size

2.1MB
MD5

6258171bf17a5537a9aab06c7c35e330
SHA1

a0884275da0db8c7c72e76e9f6cbb46ba1fd9045
SHA256

bb2e99ecd9407a235caeefbde64e2c9be676456cb0bcc7824149aee4ff29e846
SHA512

8653cc6152b0940512048393b451a4fdad93914be454a6a446c7e050be35de83fc35b2cdf6c0348fe2a6d1c9f8b363f5473517ad6b010afa934a5ffd35960a16
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlUNFMgxc2uhCUy8+A:BemTLkNdfE0pZrl

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2060-0-0x00007FF7E74A0000-0x00007FF7E77F4000-memory.dmp	xmrig
behavioral2/files/0x000b000000023bac-5.dat	xmrig
behavioral2/files/0x000a000000023bb1-8.dat	xmrig
behavioral2/memory/4480-11-0x00007FF67CDC0000-0x00007FF67D114000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb2-17.dat	xmrig
behavioral2/files/0x000a000000023bb0-12.dat	xmrig
behavioral2/memory/3348-28-0x00007FF714880000-0x00007FF714BD4000-memory.dmp	xmrig
behavioral2/memory/312-33-0x00007FF604DD0000-0x00007FF605124000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb3-40.dat	xmrig
behavioral2/files/0x0031000000023bb7-48.dat	xmrig
behavioral2/files/0x000a000000023bbb-66.dat	xmrig
behavioral2/files/0x000a000000023bbc-75.dat	xmrig
behavioral2/files/0x000a000000023bbf-89.dat	xmrig
behavioral2/files/0x000a000000023bc2-103.dat	xmrig
behavioral2/memory/4872-128-0x00007FF656C50000-0x00007FF656FA4000-memory.dmp	xmrig
behavioral2/memory/332-144-0x00007FF7D4210000-0x00007FF7D4564000-memory.dmp	xmrig
behavioral2/memory/892-148-0x00007FF6B3700000-0x00007FF6B3A54000-memory.dmp	xmrig
behavioral2/memory/1196-153-0x00007FF736800000-0x00007FF736B54000-memory.dmp	xmrig
behavioral2/memory/3740-158-0x00007FF61C770000-0x00007FF61CAC4000-memory.dmp	xmrig
behavioral2/memory/2312-157-0x00007FF668050000-0x00007FF6683A4000-memory.dmp	xmrig
behavioral2/memory/4632-156-0x00007FF64E510000-0x00007FF64E864000-memory.dmp	xmrig
behavioral2/memory/3484-155-0x00007FF62AF70000-0x00007FF62B2C4000-memory.dmp	xmrig
behavioral2/memory/1908-154-0x00007FF62EFE0000-0x00007FF62F334000-memory.dmp	xmrig
behavioral2/memory/4884-152-0x00007FF6A62C0000-0x00007FF6A6614000-memory.dmp	xmrig
behavioral2/memory/4276-151-0x00007FF65BF40000-0x00007FF65C294000-memory.dmp	xmrig
behavioral2/memory/816-150-0x00007FF716670000-0x00007FF7169C4000-memory.dmp	xmrig
behavioral2/memory/2008-149-0x00007FF65FB90000-0x00007FF65FEE4000-memory.dmp	xmrig
behavioral2/memory/3440-147-0x00007FF618680000-0x00007FF6189D4000-memory.dmp	xmrig
behavioral2/memory/4396-146-0x00007FF70E8C0000-0x00007FF70EC14000-memory.dmp	xmrig
behavioral2/memory/3828-145-0x00007FF628CC0000-0x00007FF629014000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bc8-142.dat	xmrig
behavioral2/files/0x000a000000023bc7-140.dat	xmrig
behavioral2/files/0x000a000000023bc6-138.dat	xmrig
behavioral2/files/0x000a000000023bc5-136.dat	xmrig
behavioral2/memory/3204-135-0x00007FF781060000-0x00007FF7813B4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bc4-133.dat	xmrig
behavioral2/files/0x000a000000023bc1-129.dat	xmrig
behavioral2/files/0x000a000000023bc0-125.dat	xmrig
behavioral2/files/0x000a000000023bbe-119.dat	xmrig
behavioral2/files/0x000a000000023bbd-116.dat	xmrig
behavioral2/memory/5108-115-0x00007FF731D40000-0x00007FF732094000-memory.dmp	xmrig
behavioral2/memory/4972-111-0x00007FF73F330000-0x00007FF73F684000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bc3-110.dat	xmrig
behavioral2/memory/2740-92-0x00007FF7175C0000-0x00007FF717914000-memory.dmp	xmrig
behavioral2/memory/1576-78-0x00007FF789060000-0x00007FF7893B4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bba-73.dat	xmrig
behavioral2/files/0x000a000000023bb9-67.dat	xmrig
behavioral2/files/0x0031000000023bb8-56.dat	xmrig
behavioral2/files/0x0031000000023bb6-54.dat	xmrig
behavioral2/files/0x000a000000023bb5-46.dat	xmrig
behavioral2/files/0x000a000000023bb4-44.dat	xmrig
behavioral2/memory/4456-36-0x00007FF6A9C00000-0x00007FF6A9F54000-memory.dmp	xmrig
behavioral2/memory/2660-20-0x00007FF7133B0000-0x00007FF713704000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bc9-162.dat	xmrig
behavioral2/files/0x000a000000023bca-166.dat	xmrig
behavioral2/memory/3920-171-0x00007FF62EBD0000-0x00007FF62EF24000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bcb-175.dat	xmrig
behavioral2/files/0x000b000000023bad-178.dat	xmrig
behavioral2/files/0x000a000000023bcd-189.dat	xmrig
behavioral2/files/0x000a000000023bce-193.dat	xmrig
behavioral2/files/0x000a000000023bcc-192.dat	xmrig
behavioral2/memory/1084-182-0x00007FF7E3CB0000-0x00007FF7E4004000-memory.dmp	xmrig
behavioral2/memory/3124-222-0x00007FF7B71D0000-0x00007FF7B7524000-memory.dmp	xmrig
behavioral2/memory/2060-2066-0x00007FF7E74A0000-0x00007FF7E77F4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4480	WzKgNum.exe
2660	ySuJJKj.exe
312	EsmBogf.exe
3348	IbTohpz.exe
4456	mkvzlvM.exe
1908	rhUffwZ.exe
1576	kSpDyzJ.exe
3484	SntDdRt.exe
2740	aQQMJGF.exe
4972	iTjuRYH.exe
5108	uzlHCSy.exe
4872	mvPSEfR.exe
3204	VoRzCjn.exe
332	lFssOSO.exe
4632	SOTIPgT.exe
3828	uihhqyk.exe
4396	gdPzzBW.exe
2312	ASBElko.exe
3440	wtFNZri.exe
892	qoKkeSc.exe
2008	QMFeNSL.exe
816	tviZpWP.exe
3740	krWBBSs.exe
4276	QbvODiN.exe
4884	tjZdhpC.exe
1196	yrogcow.exe
3920	HYEUSUV.exe
1084	WEqnWyH.exe
3124	ffGQvTW.exe
2404	BnFGKnY.exe
4184	JTIBNlE.exe
1676	IDMJaIx.exe
4512	goWuCfQ.exe
4004	lKzpgGC.exe
3172	qjpCgKQ.exe
3132	DTFQgWk.exe
4700	PvtMdCj.exe
2160	SIOezTv.exe
1608	YNTHfKR.exe
3948	oUMVCDy.exe
4076	EIBVobS.exe
4684	WLznQKm.exe
4832	EValHeW.exe
1768	XBjlbQt.exe
2944	smPAMvb.exe
2624	yOBzmYu.exe
4328	UvFqjkt.exe
4312	wDAKSmV.exe
2308	JbqsSNw.exe
5116	BhiaMjk.exe
3664	iXhUiOc.exe
1484	OyWfIIX.exe
2972	iqUIWit.exe
2432	UyEIPHG.exe
948	rMSFSvQ.exe
2648	obTjYLn.exe
2816	rnCFqXY.exe
4136	QAdOAZU.exe
4560	vTiyQCe.exe
5048	XaKIngJ.exe
4668	sroPRLj.exe
3044	cutFibz.exe
624	XQSqjsa.exe
4552	ZiNlEgk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2060-0-0x00007FF7E74A0000-0x00007FF7E77F4000-memory.dmp	upx
behavioral2/files/0x000b000000023bac-5.dat	upx
behavioral2/files/0x000a000000023bb1-8.dat	upx
behavioral2/memory/4480-11-0x00007FF67CDC0000-0x00007FF67D114000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-17.dat	upx
behavioral2/files/0x000a000000023bb0-12.dat	upx
behavioral2/memory/3348-28-0x00007FF714880000-0x00007FF714BD4000-memory.dmp	upx
behavioral2/memory/312-33-0x00007FF604DD0000-0x00007FF605124000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-40.dat	upx
behavioral2/files/0x0031000000023bb7-48.dat	upx
behavioral2/files/0x000a000000023bbb-66.dat	upx
behavioral2/files/0x000a000000023bbc-75.dat	upx
behavioral2/files/0x000a000000023bbf-89.dat	upx
behavioral2/files/0x000a000000023bc2-103.dat	upx
behavioral2/memory/4872-128-0x00007FF656C50000-0x00007FF656FA4000-memory.dmp	upx
behavioral2/memory/332-144-0x00007FF7D4210000-0x00007FF7D4564000-memory.dmp	upx
behavioral2/memory/892-148-0x00007FF6B3700000-0x00007FF6B3A54000-memory.dmp	upx
behavioral2/memory/1196-153-0x00007FF736800000-0x00007FF736B54000-memory.dmp	upx
behavioral2/memory/3740-158-0x00007FF61C770000-0x00007FF61CAC4000-memory.dmp	upx
behavioral2/memory/2312-157-0x00007FF668050000-0x00007FF6683A4000-memory.dmp	upx
behavioral2/memory/4632-156-0x00007FF64E510000-0x00007FF64E864000-memory.dmp	upx
behavioral2/memory/3484-155-0x00007FF62AF70000-0x00007FF62B2C4000-memory.dmp	upx
behavioral2/memory/1908-154-0x00007FF62EFE0000-0x00007FF62F334000-memory.dmp	upx
behavioral2/memory/4884-152-0x00007FF6A62C0000-0x00007FF6A6614000-memory.dmp	upx
behavioral2/memory/4276-151-0x00007FF65BF40000-0x00007FF65C294000-memory.dmp	upx
behavioral2/memory/816-150-0x00007FF716670000-0x00007FF7169C4000-memory.dmp	upx
behavioral2/memory/2008-149-0x00007FF65FB90000-0x00007FF65FEE4000-memory.dmp	upx
behavioral2/memory/3440-147-0x00007FF618680000-0x00007FF6189D4000-memory.dmp	upx
behavioral2/memory/4396-146-0x00007FF70E8C0000-0x00007FF70EC14000-memory.dmp	upx
behavioral2/memory/3828-145-0x00007FF628CC0000-0x00007FF629014000-memory.dmp	upx
behavioral2/files/0x000a000000023bc8-142.dat	upx
behavioral2/files/0x000a000000023bc7-140.dat	upx
behavioral2/files/0x000a000000023bc6-138.dat	upx
behavioral2/files/0x000a000000023bc5-136.dat	upx
behavioral2/memory/3204-135-0x00007FF781060000-0x00007FF7813B4000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-133.dat	upx
behavioral2/files/0x000a000000023bc1-129.dat	upx
behavioral2/files/0x000a000000023bc0-125.dat	upx
behavioral2/files/0x000a000000023bbe-119.dat	upx
behavioral2/files/0x000a000000023bbd-116.dat	upx
behavioral2/memory/5108-115-0x00007FF731D40000-0x00007FF732094000-memory.dmp	upx
behavioral2/memory/4972-111-0x00007FF73F330000-0x00007FF73F684000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-110.dat	upx
behavioral2/memory/2740-92-0x00007FF7175C0000-0x00007FF717914000-memory.dmp	upx
behavioral2/memory/1576-78-0x00007FF789060000-0x00007FF7893B4000-memory.dmp	upx
behavioral2/files/0x000a000000023bba-73.dat	upx
behavioral2/files/0x000a000000023bb9-67.dat	upx
behavioral2/files/0x0031000000023bb8-56.dat	upx
behavioral2/files/0x0031000000023bb6-54.dat	upx
behavioral2/files/0x000a000000023bb5-46.dat	upx
behavioral2/files/0x000a000000023bb4-44.dat	upx
behavioral2/memory/4456-36-0x00007FF6A9C00000-0x00007FF6A9F54000-memory.dmp	upx
behavioral2/memory/2660-20-0x00007FF7133B0000-0x00007FF713704000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-162.dat	upx
behavioral2/files/0x000a000000023bca-166.dat	upx
behavioral2/memory/3920-171-0x00007FF62EBD0000-0x00007FF62EF24000-memory.dmp	upx
behavioral2/files/0x000a000000023bcb-175.dat	upx
behavioral2/files/0x000b000000023bad-178.dat	upx
behavioral2/files/0x000a000000023bcd-189.dat	upx
behavioral2/files/0x000a000000023bce-193.dat	upx
behavioral2/files/0x000a000000023bcc-192.dat	upx
behavioral2/memory/1084-182-0x00007FF7E3CB0000-0x00007FF7E4004000-memory.dmp	upx
behavioral2/memory/3124-222-0x00007FF7B71D0000-0x00007FF7B7524000-memory.dmp	upx
behavioral2/memory/2060-2066-0x00007FF7E74A0000-0x00007FF7E77F4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\krWBBSs.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\AsHBalc.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\KbmpEox.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\diBfqKO.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\NINzPgA.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\lPeETVM.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\qfirFoZ.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\dlmaoJN.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\axYkbbG.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\iqUIWit.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\MtisCpp.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\JGtZyuf.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\TjqBPUp.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\mXfPpBI.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\qoKkeSc.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\tjZdhpC.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\KqfFOsQ.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\xNtAdat.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\HKMHmGv.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\AkcUNXp.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\ufRhzvu.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\NKnyyIJ.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\srBgEjs.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\VcOOtKo.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\iBQkgxj.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\PvtMdCj.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\ybZXdZH.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\dKGUENI.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\QQuAIoM.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\DZScoyU.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\UtHiSwQ.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\tgSueia.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\LFOyXwK.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\DmrwrEr.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\PMNHKdE.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\ifXkWEu.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\QgHzEBu.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\EyNNykc.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\BnFGKnY.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\cKQYmWr.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\VciqDob.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\qeqDwwb.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\QmLNaUI.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\YtHlcYB.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\YQwHAei.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\mUVybPh.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\qhbfDrp.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\extvMPo.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\zlZhVNj.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\LhHyRTx.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\lFssOSO.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\nnKGGJo.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\qNTiNDZ.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\cQfOzDq.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\syFuUkD.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\llJGAzs.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\RTxeZDn.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\ffIESLK.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\flzBbYR.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\EnoTbhM.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\oZLfMTt.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\RukXMBN.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\BheUnZf.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
File created	C:\Windows\System\XaKIngJ.exe	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4480	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	84
PID 2060 wrote to memory of 4480	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	84
PID 2060 wrote to memory of 2660	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	85
PID 2060 wrote to memory of 2660	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	85
PID 2060 wrote to memory of 4456	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	86
PID 2060 wrote to memory of 4456	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	86
PID 2060 wrote to memory of 312	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	87
PID 2060 wrote to memory of 312	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	87
PID 2060 wrote to memory of 3348	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	88
PID 2060 wrote to memory of 3348	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	88
PID 2060 wrote to memory of 1908	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	89
PID 2060 wrote to memory of 1908	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	89
PID 2060 wrote to memory of 1576	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	90
PID 2060 wrote to memory of 1576	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	90
PID 2060 wrote to memory of 3484	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	91
PID 2060 wrote to memory of 3484	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	91
PID 2060 wrote to memory of 2740	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	92
PID 2060 wrote to memory of 2740	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	92
PID 2060 wrote to memory of 4972	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	93
PID 2060 wrote to memory of 4972	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	93
PID 2060 wrote to memory of 5108	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	94
PID 2060 wrote to memory of 5108	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	94
PID 2060 wrote to memory of 4872	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	95
PID 2060 wrote to memory of 4872	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	95
PID 2060 wrote to memory of 3204	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	96
PID 2060 wrote to memory of 3204	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	96
PID 2060 wrote to memory of 332	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	97
PID 2060 wrote to memory of 332	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	97
PID 2060 wrote to memory of 4632	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	98
PID 2060 wrote to memory of 4632	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	98
PID 2060 wrote to memory of 3828	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	99
PID 2060 wrote to memory of 3828	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	99
PID 2060 wrote to memory of 4396	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	100
PID 2060 wrote to memory of 4396	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	100
PID 2060 wrote to memory of 2312	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	101
PID 2060 wrote to memory of 2312	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	101
PID 2060 wrote to memory of 3440	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	102
PID 2060 wrote to memory of 3440	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	102
PID 2060 wrote to memory of 892	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	103
PID 2060 wrote to memory of 892	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	103
PID 2060 wrote to memory of 2008	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	104
PID 2060 wrote to memory of 2008	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	104
PID 2060 wrote to memory of 816	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	105
PID 2060 wrote to memory of 816	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	105
PID 2060 wrote to memory of 3740	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	106
PID 2060 wrote to memory of 3740	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	106
PID 2060 wrote to memory of 4276	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	107
PID 2060 wrote to memory of 4276	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	107
PID 2060 wrote to memory of 4884	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	108
PID 2060 wrote to memory of 4884	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	108
PID 2060 wrote to memory of 1196	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	109
PID 2060 wrote to memory of 1196	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	109
PID 2060 wrote to memory of 3920	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	110
PID 2060 wrote to memory of 3920	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	110
PID 2060 wrote to memory of 1084	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	111
PID 2060 wrote to memory of 1084	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	111
PID 2060 wrote to memory of 3124	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	112
PID 2060 wrote to memory of 3124	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	112
PID 2060 wrote to memory of 2404	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	113
PID 2060 wrote to memory of 2404	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	113
PID 2060 wrote to memory of 4184	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	114
PID 2060 wrote to memory of 4184	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	114
PID 2060 wrote to memory of 1676	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	115
PID 2060 wrote to memory of 1676	2060	6258171bf17a5537a9aab06c7c35e330_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\6258171bf17a5537a9aab06c7c35e330_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\6258171bf17a5537a9aab06c7c35e330_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\System\WzKgNum.exe
  C:\Windows\System\WzKgNum.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\ySuJJKj.exe
  C:\Windows\System\ySuJJKj.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\mkvzlvM.exe
  C:\Windows\System\mkvzlvM.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\EsmBogf.exe
  C:\Windows\System\EsmBogf.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\IbTohpz.exe
  C:\Windows\System\IbTohpz.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\rhUffwZ.exe
  C:\Windows\System\rhUffwZ.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\kSpDyzJ.exe
  C:\Windows\System\kSpDyzJ.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\SntDdRt.exe
  C:\Windows\System\SntDdRt.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\aQQMJGF.exe
  C:\Windows\System\aQQMJGF.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\iTjuRYH.exe
  C:\Windows\System\iTjuRYH.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\uzlHCSy.exe
  C:\Windows\System\uzlHCSy.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\mvPSEfR.exe
  C:\Windows\System\mvPSEfR.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\VoRzCjn.exe
  C:\Windows\System\VoRzCjn.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\lFssOSO.exe
  C:\Windows\System\lFssOSO.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\SOTIPgT.exe
  C:\Windows\System\SOTIPgT.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\uihhqyk.exe
  C:\Windows\System\uihhqyk.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\gdPzzBW.exe
  C:\Windows\System\gdPzzBW.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\ASBElko.exe
  C:\Windows\System\ASBElko.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\wtFNZri.exe
  C:\Windows\System\wtFNZri.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\qoKkeSc.exe
  C:\Windows\System\qoKkeSc.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\QMFeNSL.exe
  C:\Windows\System\QMFeNSL.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\tviZpWP.exe
  C:\Windows\System\tviZpWP.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\krWBBSs.exe
  C:\Windows\System\krWBBSs.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\QbvODiN.exe
  C:\Windows\System\QbvODiN.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\tjZdhpC.exe
  C:\Windows\System\tjZdhpC.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\yrogcow.exe
  C:\Windows\System\yrogcow.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\HYEUSUV.exe
  C:\Windows\System\HYEUSUV.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\WEqnWyH.exe
  C:\Windows\System\WEqnWyH.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\ffGQvTW.exe
  C:\Windows\System\ffGQvTW.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\BnFGKnY.exe
  C:\Windows\System\BnFGKnY.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\JTIBNlE.exe
  C:\Windows\System\JTIBNlE.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\IDMJaIx.exe
  C:\Windows\System\IDMJaIx.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\goWuCfQ.exe
  C:\Windows\System\goWuCfQ.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\lKzpgGC.exe
  C:\Windows\System\lKzpgGC.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\qjpCgKQ.exe
  C:\Windows\System\qjpCgKQ.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\DTFQgWk.exe
  C:\Windows\System\DTFQgWk.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\PvtMdCj.exe
  C:\Windows\System\PvtMdCj.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\SIOezTv.exe
  C:\Windows\System\SIOezTv.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\YNTHfKR.exe
  C:\Windows\System\YNTHfKR.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\oUMVCDy.exe
  C:\Windows\System\oUMVCDy.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\EIBVobS.exe
  C:\Windows\System\EIBVobS.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\WLznQKm.exe
  C:\Windows\System\WLznQKm.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\EValHeW.exe
  C:\Windows\System\EValHeW.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\XBjlbQt.exe
  C:\Windows\System\XBjlbQt.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\smPAMvb.exe
  C:\Windows\System\smPAMvb.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\yOBzmYu.exe
  C:\Windows\System\yOBzmYu.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\UvFqjkt.exe
  C:\Windows\System\UvFqjkt.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\wDAKSmV.exe
  C:\Windows\System\wDAKSmV.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\JbqsSNw.exe
  C:\Windows\System\JbqsSNw.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\BhiaMjk.exe
  C:\Windows\System\BhiaMjk.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\iXhUiOc.exe
  C:\Windows\System\iXhUiOc.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\OyWfIIX.exe
  C:\Windows\System\OyWfIIX.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\iqUIWit.exe
  C:\Windows\System\iqUIWit.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\UyEIPHG.exe
  C:\Windows\System\UyEIPHG.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\rMSFSvQ.exe
  C:\Windows\System\rMSFSvQ.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\obTjYLn.exe
  C:\Windows\System\obTjYLn.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\rnCFqXY.exe
  C:\Windows\System\rnCFqXY.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\QAdOAZU.exe
  C:\Windows\System\QAdOAZU.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\vTiyQCe.exe
  C:\Windows\System\vTiyQCe.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\XaKIngJ.exe
  C:\Windows\System\XaKIngJ.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\sroPRLj.exe
  C:\Windows\System\sroPRLj.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\cutFibz.exe
  C:\Windows\System\cutFibz.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\XQSqjsa.exe
  C:\Windows\System\XQSqjsa.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\ZiNlEgk.exe
  C:\Windows\System\ZiNlEgk.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\CYvrVOA.exe
  C:\Windows\System\CYvrVOA.exe
  2⤵
  PID:1660
- C:\Windows\System\kIhbYtM.exe
  C:\Windows\System\kIhbYtM.exe
  2⤵
  PID:2384
- C:\Windows\System\BQqkstj.exe
  C:\Windows\System\BQqkstj.exe
  2⤵
  PID:2576
- C:\Windows\System\yzlDQCj.exe
  C:\Windows\System\yzlDQCj.exe
  2⤵
  PID:1352
- C:\Windows\System\OoTdkmN.exe
  C:\Windows\System\OoTdkmN.exe
  2⤵
  PID:3752
- C:\Windows\System\llJGAzs.exe
  C:\Windows\System\llJGAzs.exe
  2⤵
  PID:4208
- C:\Windows\System\wnqmLRn.exe
  C:\Windows\System\wnqmLRn.exe
  2⤵
  PID:3872
- C:\Windows\System\gpvgHoT.exe
  C:\Windows\System\gpvgHoT.exe
  2⤵
  PID:2872
- C:\Windows\System\gwQDxsi.exe
  C:\Windows\System\gwQDxsi.exe
  2⤵
  PID:716
- C:\Windows\System\LjDsFVw.exe
  C:\Windows\System\LjDsFVw.exe
  2⤵
  PID:812
- C:\Windows\System\ybZXdZH.exe
  C:\Windows\System\ybZXdZH.exe
  2⤵
  PID:4492
- C:\Windows\System\HKMHmGv.exe
  C:\Windows\System\HKMHmGv.exe
  2⤵
  PID:972
- C:\Windows\System\LFOyXwK.exe
  C:\Windows\System\LFOyXwK.exe
  2⤵
  PID:744
- C:\Windows\System\UUIWfcw.exe
  C:\Windows\System\UUIWfcw.exe
  2⤵
  PID:3008
- C:\Windows\System\RxyZVVX.exe
  C:\Windows\System\RxyZVVX.exe
  2⤵
  PID:2328
- C:\Windows\System\XnjPhcK.exe
  C:\Windows\System\XnjPhcK.exe
  2⤵
  PID:1560
- C:\Windows\System\NPlrwwu.exe
  C:\Windows\System\NPlrwwu.exe
  2⤵
  PID:3344
- C:\Windows\System\AsHBalc.exe
  C:\Windows\System\AsHBalc.exe
  2⤵
  PID:4464
- C:\Windows\System\eCFHBoG.exe
  C:\Windows\System\eCFHBoG.exe
  2⤵
  PID:1448
- C:\Windows\System\YGOIihW.exe
  C:\Windows\System\YGOIihW.exe
  2⤵
  PID:1980
- C:\Windows\System\HHOSdPb.exe
  C:\Windows\System\HHOSdPb.exe
  2⤵
  PID:4164
- C:\Windows\System\hbiRIgV.exe
  C:\Windows\System\hbiRIgV.exe
  2⤵
  PID:4624
- C:\Windows\System\atyOxoe.exe
  C:\Windows\System\atyOxoe.exe
  2⤵
  PID:3292
- C:\Windows\System\stgeHej.exe
  C:\Windows\System\stgeHej.exe
  2⤵
  PID:4816
- C:\Windows\System\YBhrrOr.exe
  C:\Windows\System\YBhrrOr.exe
  2⤵
  PID:664
- C:\Windows\System\GzPGUkO.exe
  C:\Windows\System\GzPGUkO.exe
  2⤵
  PID:1476
- C:\Windows\System\RRAQIWe.exe
  C:\Windows\System\RRAQIWe.exe
  2⤵
  PID:2212
- C:\Windows\System\JQKiiVt.exe
  C:\Windows\System\JQKiiVt.exe
  2⤵
  PID:1816
- C:\Windows\System\nnKGGJo.exe
  C:\Windows\System\nnKGGJo.exe
  2⤵
  PID:2628
- C:\Windows\System\KLxihpC.exe
  C:\Windows\System\KLxihpC.exe
  2⤵
  PID:1760
- C:\Windows\System\hmhzaha.exe
  C:\Windows\System\hmhzaha.exe
  2⤵
  PID:2644
- C:\Windows\System\djcOSrl.exe
  C:\Windows\System\djcOSrl.exe
  2⤵
  PID:5156
- C:\Windows\System\MMBRMzB.exe
  C:\Windows\System\MMBRMzB.exe
  2⤵
  PID:5180
- C:\Windows\System\IwqQpKo.exe
  C:\Windows\System\IwqQpKo.exe
  2⤵
  PID:5208
- C:\Windows\System\yHUfGAM.exe
  C:\Windows\System\yHUfGAM.exe
  2⤵
  PID:5236
- C:\Windows\System\KqfFOsQ.exe
  C:\Windows\System\KqfFOsQ.exe
  2⤵
  PID:5264
- C:\Windows\System\dKGUENI.exe
  C:\Windows\System\dKGUENI.exe
  2⤵
  PID:5308
- C:\Windows\System\pnaRmNq.exe
  C:\Windows\System\pnaRmNq.exe
  2⤵
  PID:5328
- C:\Windows\System\SfJkXJd.exe
  C:\Windows\System\SfJkXJd.exe
  2⤵
  PID:5360
- C:\Windows\System\vLSXOrV.exe
  C:\Windows\System\vLSXOrV.exe
  2⤵
  PID:5400
- C:\Windows\System\wJeCbrF.exe
  C:\Windows\System\wJeCbrF.exe
  2⤵
  PID:5428
- C:\Windows\System\mFBkdmi.exe
  C:\Windows\System\mFBkdmi.exe
  2⤵
  PID:5468
- C:\Windows\System\vLAfDUF.exe
  C:\Windows\System\vLAfDUF.exe
  2⤵
  PID:5484
- C:\Windows\System\PZpkgQx.exe
  C:\Windows\System\PZpkgQx.exe
  2⤵
  PID:5512
- C:\Windows\System\oKHHjpz.exe
  C:\Windows\System\oKHHjpz.exe
  2⤵
  PID:5548
- C:\Windows\System\rGimJMd.exe
  C:\Windows\System\rGimJMd.exe
  2⤵
  PID:5576
- C:\Windows\System\UZSyzVp.exe
  C:\Windows\System\UZSyzVp.exe
  2⤵
  PID:5600
- C:\Windows\System\gqADVYG.exe
  C:\Windows\System\gqADVYG.exe
  2⤵
  PID:5632
- C:\Windows\System\LwUYtAw.exe
  C:\Windows\System\LwUYtAw.exe
  2⤵
  PID:5664
- C:\Windows\System\GmkMrZF.exe
  C:\Windows\System\GmkMrZF.exe
  2⤵
  PID:5692
- C:\Windows\System\VMUvIkB.exe
  C:\Windows\System\VMUvIkB.exe
  2⤵
  PID:5708
- C:\Windows\System\AfxrGus.exe
  C:\Windows\System\AfxrGus.exe
  2⤵
  PID:5748
- C:\Windows\System\dbTWOio.exe
  C:\Windows\System\dbTWOio.exe
  2⤵
  PID:5768
- C:\Windows\System\gernEBX.exe
  C:\Windows\System\gernEBX.exe
  2⤵
  PID:5804
- C:\Windows\System\fjzYBXX.exe
  C:\Windows\System\fjzYBXX.exe
  2⤵
  PID:5832
- C:\Windows\System\sVggmsx.exe
  C:\Windows\System\sVggmsx.exe
  2⤵
  PID:5852
- C:\Windows\System\tGbDcvn.exe
  C:\Windows\System\tGbDcvn.exe
  2⤵
  PID:5880
- C:\Windows\System\fmuGwUl.exe
  C:\Windows\System\fmuGwUl.exe
  2⤵
  PID:5904
- C:\Windows\System\pmINWry.exe
  C:\Windows\System\pmINWry.exe
  2⤵
  PID:5924
- C:\Windows\System\xffQPIN.exe
  C:\Windows\System\xffQPIN.exe
  2⤵
  PID:5952
- C:\Windows\System\FvnCqDC.exe
  C:\Windows\System\FvnCqDC.exe
  2⤵
  PID:5976
- C:\Windows\System\DLlqoki.exe
  C:\Windows\System\DLlqoki.exe
  2⤵
  PID:6004
- C:\Windows\System\IXtslMJ.exe
  C:\Windows\System\IXtslMJ.exe
  2⤵
  PID:6044
- C:\Windows\System\eAnUZmg.exe
  C:\Windows\System\eAnUZmg.exe
  2⤵
  PID:6080
- C:\Windows\System\PXJePXF.exe
  C:\Windows\System\PXJePXF.exe
  2⤵
  PID:6116
- C:\Windows\System\wmobziC.exe
  C:\Windows\System\wmobziC.exe
  2⤵
  PID:6140
- C:\Windows\System\fosypwD.exe
  C:\Windows\System\fosypwD.exe
  2⤵
  PID:5164
- C:\Windows\System\OEKcQUL.exe
  C:\Windows\System\OEKcQUL.exe
  2⤵
  PID:5192
- C:\Windows\System\rxOYEAA.exe
  C:\Windows\System\rxOYEAA.exe
  2⤵
  PID:5200
- C:\Windows\System\UEJLBBO.exe
  C:\Windows\System\UEJLBBO.exe
  2⤵
  PID:5260
- C:\Windows\System\wWcUPvo.exe
  C:\Windows\System\wWcUPvo.exe
  2⤵
  PID:5372
- C:\Windows\System\ocNHBUX.exe
  C:\Windows\System\ocNHBUX.exe
  2⤵
  PID:5448
- C:\Windows\System\yHCmzij.exe
  C:\Windows\System\yHCmzij.exe
  2⤵
  PID:5504
- C:\Windows\System\niRnLxD.exe
  C:\Windows\System\niRnLxD.exe
  2⤵
  PID:5568
- C:\Windows\System\hkVQhjx.exe
  C:\Windows\System\hkVQhjx.exe
  2⤵
  PID:5628
- C:\Windows\System\NfKHSwB.exe
  C:\Windows\System\NfKHSwB.exe
  2⤵
  PID:5700
- C:\Windows\System\RaSDlzu.exe
  C:\Windows\System\RaSDlzu.exe
  2⤵
  PID:5824
- C:\Windows\System\HJfbiXl.exe
  C:\Windows\System\HJfbiXl.exe
  2⤵
  PID:5848
- C:\Windows\System\taCaHGW.exe
  C:\Windows\System\taCaHGW.exe
  2⤵
  PID:5912
- C:\Windows\System\yQgSYFS.exe
  C:\Windows\System\yQgSYFS.exe
  2⤵
  PID:5964
- C:\Windows\System\LWSfJAO.exe
  C:\Windows\System\LWSfJAO.exe
  2⤵
  PID:6016
- C:\Windows\System\eFZgMDO.exe
  C:\Windows\System\eFZgMDO.exe
  2⤵
  PID:6056
- C:\Windows\System\HbsrGHU.exe
  C:\Windows\System\HbsrGHU.exe
  2⤵
  PID:6124
- C:\Windows\System\fCrQhkz.exe
  C:\Windows\System\fCrQhkz.exe
  2⤵
  PID:5176
- C:\Windows\System\pGvqVqV.exe
  C:\Windows\System\pGvqVqV.exe
  2⤵
  PID:5324
- C:\Windows\System\tCEfmVq.exe
  C:\Windows\System\tCEfmVq.exe
  2⤵
  PID:5544
- C:\Windows\System\NJbmHJn.exe
  C:\Windows\System\NJbmHJn.exe
  2⤵
  PID:5788
- C:\Windows\System\eeZcLQO.exe
  C:\Windows\System\eeZcLQO.exe
  2⤵
  PID:6024
- C:\Windows\System\dpKvosQ.exe
  C:\Windows\System\dpKvosQ.exe
  2⤵
  PID:5416
- C:\Windows\System\YOetoOR.exe
  C:\Windows\System\YOetoOR.exe
  2⤵
  PID:5840
- C:\Windows\System\HqjpDaR.exe
  C:\Windows\System\HqjpDaR.exe
  2⤵
  PID:5148
- C:\Windows\System\OXgctfD.exe
  C:\Windows\System\OXgctfD.exe
  2⤵
  PID:5944
- C:\Windows\System\yDsRCak.exe
  C:\Windows\System\yDsRCak.exe
  2⤵
  PID:6172
- C:\Windows\System\DmrwrEr.exe
  C:\Windows\System\DmrwrEr.exe
  2⤵
  PID:6208
- C:\Windows\System\SfbFUtJ.exe
  C:\Windows\System\SfbFUtJ.exe
  2⤵
  PID:6244
- C:\Windows\System\BqPfDkv.exe
  C:\Windows\System\BqPfDkv.exe
  2⤵
  PID:6280
- C:\Windows\System\NieDgAq.exe
  C:\Windows\System\NieDgAq.exe
  2⤵
  PID:6304
- C:\Windows\System\JeMsPAP.exe
  C:\Windows\System\JeMsPAP.exe
  2⤵
  PID:6320
- C:\Windows\System\pkGGZxJ.exe
  C:\Windows\System\pkGGZxJ.exe
  2⤵
  PID:6352
- C:\Windows\System\KzeeOWE.exe
  C:\Windows\System\KzeeOWE.exe
  2⤵
  PID:6384
- C:\Windows\System\ZNrxvie.exe
  C:\Windows\System\ZNrxvie.exe
  2⤵
  PID:6408
- C:\Windows\System\ckwWIjg.exe
  C:\Windows\System\ckwWIjg.exe
  2⤵
  PID:6432
- C:\Windows\System\JfQzCVQ.exe
  C:\Windows\System\JfQzCVQ.exe
  2⤵
  PID:6460
- C:\Windows\System\sBLWfYG.exe
  C:\Windows\System\sBLWfYG.exe
  2⤵
  PID:6500
- C:\Windows\System\EhxnFrU.exe
  C:\Windows\System\EhxnFrU.exe
  2⤵
  PID:6540
- C:\Windows\System\qXNlutw.exe
  C:\Windows\System\qXNlutw.exe
  2⤵
  PID:6564
- C:\Windows\System\ZiCqzpf.exe
  C:\Windows\System\ZiCqzpf.exe
  2⤵
  PID:6604
- C:\Windows\System\PfUCwdN.exe
  C:\Windows\System\PfUCwdN.exe
  2⤵
  PID:6640
- C:\Windows\System\SHLMXig.exe
  C:\Windows\System\SHLMXig.exe
  2⤵
  PID:6672
- C:\Windows\System\QwlAsps.exe
  C:\Windows\System\QwlAsps.exe
  2⤵
  PID:6696
- C:\Windows\System\QAVGtOc.exe
  C:\Windows\System\QAVGtOc.exe
  2⤵
  PID:6728
- C:\Windows\System\WeTtRbF.exe
  C:\Windows\System\WeTtRbF.exe
  2⤵
  PID:6760
- C:\Windows\System\daLHvcn.exe
  C:\Windows\System\daLHvcn.exe
  2⤵
  PID:6796
- C:\Windows\System\NINzPgA.exe
  C:\Windows\System\NINzPgA.exe
  2⤵
  PID:6836
- C:\Windows\System\YenLvMH.exe
  C:\Windows\System\YenLvMH.exe
  2⤵
  PID:6864
- C:\Windows\System\neduCxN.exe
  C:\Windows\System\neduCxN.exe
  2⤵
  PID:6900
- C:\Windows\System\OYqKvYJ.exe
  C:\Windows\System\OYqKvYJ.exe
  2⤵
  PID:6924
- C:\Windows\System\JQcFLKU.exe
  C:\Windows\System\JQcFLKU.exe
  2⤵
  PID:6952
- C:\Windows\System\MIVlfTW.exe
  C:\Windows\System\MIVlfTW.exe
  2⤵
  PID:6972
- C:\Windows\System\AuYGBHt.exe
  C:\Windows\System\AuYGBHt.exe
  2⤵
  PID:6996
- C:\Windows\System\bjJGAvm.exe
  C:\Windows\System\bjJGAvm.exe
  2⤵
  PID:7020
- C:\Windows\System\NYrQwJv.exe
  C:\Windows\System\NYrQwJv.exe
  2⤵
  PID:7052
- C:\Windows\System\eRSEmib.exe
  C:\Windows\System\eRSEmib.exe
  2⤵
  PID:7092
- C:\Windows\System\zveQpxs.exe
  C:\Windows\System\zveQpxs.exe
  2⤵
  PID:7116
- C:\Windows\System\mfeWxNC.exe
  C:\Windows\System\mfeWxNC.exe
  2⤵
  PID:7148
- C:\Windows\System\nPgKxVZ.exe
  C:\Windows\System\nPgKxVZ.exe
  2⤵
  PID:5624
- C:\Windows\System\FHatZIP.exe
  C:\Windows\System\FHatZIP.exe
  2⤵
  PID:6200
- C:\Windows\System\ploASqt.exe
  C:\Windows\System\ploASqt.exe
  2⤵
  PID:6296
- C:\Windows\System\AkcUNXp.exe
  C:\Windows\System\AkcUNXp.exe
  2⤵
  PID:6368
- C:\Windows\System\DhiTkta.exe
  C:\Windows\System\DhiTkta.exe
  2⤵
  PID:6400
- C:\Windows\System\nhNteKh.exe
  C:\Windows\System\nhNteKh.exe
  2⤵
  PID:6580
- C:\Windows\System\Ckooyaf.exe
  C:\Windows\System\Ckooyaf.exe
  2⤵
  PID:6620
- C:\Windows\System\jSpLYYR.exe
  C:\Windows\System\jSpLYYR.exe
  2⤵
  PID:6712
- C:\Windows\System\QQuAIoM.exe
  C:\Windows\System\QQuAIoM.exe
  2⤵
  PID:6820
- C:\Windows\System\xXoipUt.exe
  C:\Windows\System\xXoipUt.exe
  2⤵
  PID:6852
- C:\Windows\System\zTmKEDN.exe
  C:\Windows\System\zTmKEDN.exe
  2⤵
  PID:6916
- C:\Windows\System\MIWYQcs.exe
  C:\Windows\System\MIWYQcs.exe
  2⤵
  PID:7012
- C:\Windows\System\qCkilCY.exe
  C:\Windows\System\qCkilCY.exe
  2⤵
  PID:7044
- C:\Windows\System\WVsyhmB.exe
  C:\Windows\System\WVsyhmB.exe
  2⤵
  PID:7108
- C:\Windows\System\gaSLtnq.exe
  C:\Windows\System\gaSLtnq.exe
  2⤵
  PID:7136
- C:\Windows\System\lPeETVM.exe
  C:\Windows\System\lPeETVM.exe
  2⤵
  PID:6312
- C:\Windows\System\DInXbyq.exe
  C:\Windows\System\DInXbyq.exe
  2⤵
  PID:6472
- C:\Windows\System\BhrNWfK.exe
  C:\Windows\System\BhrNWfK.exe
  2⤵
  PID:6656
- C:\Windows\System\MyxXZXf.exe
  C:\Windows\System\MyxXZXf.exe
  2⤵
  PID:6816
- C:\Windows\System\lsIdowZ.exe
  C:\Windows\System\lsIdowZ.exe
  2⤵
  PID:7036
- C:\Windows\System\HaGzmoe.exe
  C:\Windows\System\HaGzmoe.exe
  2⤵
  PID:5936
- C:\Windows\System\zUuLzgz.exe
  C:\Windows\System\zUuLzgz.exe
  2⤵
  PID:6692
- C:\Windows\System\KkWmWvL.exe
  C:\Windows\System\KkWmWvL.exe
  2⤵
  PID:7128
- C:\Windows\System\JBsoefo.exe
  C:\Windows\System\JBsoefo.exe
  2⤵
  PID:6908
- C:\Windows\System\CnXFPXq.exe
  C:\Windows\System\CnXFPXq.exe
  2⤵
  PID:7176
- C:\Windows\System\wkKhUzk.exe
  C:\Windows\System\wkKhUzk.exe
  2⤵
  PID:7212
- C:\Windows\System\mQdjwoz.exe
  C:\Windows\System\mQdjwoz.exe
  2⤵
  PID:7248
- C:\Windows\System\tAxzDqd.exe
  C:\Windows\System\tAxzDqd.exe
  2⤵
  PID:7288
- C:\Windows\System\mKotFHu.exe
  C:\Windows\System\mKotFHu.exe
  2⤵
  PID:7316
- C:\Windows\System\yPzDWQx.exe
  C:\Windows\System\yPzDWQx.exe
  2⤵
  PID:7356
- C:\Windows\System\HYnlfes.exe
  C:\Windows\System\HYnlfes.exe
  2⤵
  PID:7380
- C:\Windows\System\ATbaipp.exe
  C:\Windows\System\ATbaipp.exe
  2⤵
  PID:7400
- C:\Windows\System\aHauznA.exe
  C:\Windows\System\aHauznA.exe
  2⤵
  PID:7432
- C:\Windows\System\ADfViBH.exe
  C:\Windows\System\ADfViBH.exe
  2⤵
  PID:7468
- C:\Windows\System\sxOCVIb.exe
  C:\Windows\System\sxOCVIb.exe
  2⤵
  PID:7492
- C:\Windows\System\zSQkeJS.exe
  C:\Windows\System\zSQkeJS.exe
  2⤵
  PID:7532
- C:\Windows\System\GhGNVsE.exe
  C:\Windows\System\GhGNVsE.exe
  2⤵
  PID:7568
- C:\Windows\System\aobOgLM.exe
  C:\Windows\System\aobOgLM.exe
  2⤵
  PID:7588
- C:\Windows\System\eVENZQj.exe
  C:\Windows\System\eVENZQj.exe
  2⤵
  PID:7612
- C:\Windows\System\YQwHAei.exe
  C:\Windows\System\YQwHAei.exe
  2⤵
  PID:7636
- C:\Windows\System\QPImMWh.exe
  C:\Windows\System\QPImMWh.exe
  2⤵
  PID:7664
- C:\Windows\System\BxkiTVH.exe
  C:\Windows\System\BxkiTVH.exe
  2⤵
  PID:7688
- C:\Windows\System\dwdSAEI.exe
  C:\Windows\System\dwdSAEI.exe
  2⤵
  PID:7724
- C:\Windows\System\RTxeZDn.exe
  C:\Windows\System\RTxeZDn.exe
  2⤵
  PID:7760
- C:\Windows\System\AUOPhWv.exe
  C:\Windows\System\AUOPhWv.exe
  2⤵
  PID:7788
- C:\Windows\System\qhbfDrp.exe
  C:\Windows\System\qhbfDrp.exe
  2⤵
  PID:7812
- C:\Windows\System\EvFzaWw.exe
  C:\Windows\System\EvFzaWw.exe
  2⤵
  PID:7844
- C:\Windows\System\DsaGYpv.exe
  C:\Windows\System\DsaGYpv.exe
  2⤵
  PID:7880
- C:\Windows\System\PBieZOb.exe
  C:\Windows\System\PBieZOb.exe
  2⤵
  PID:7896
- C:\Windows\System\puNmaDj.exe
  C:\Windows\System\puNmaDj.exe
  2⤵
  PID:7924
- C:\Windows\System\MtisCpp.exe
  C:\Windows\System\MtisCpp.exe
  2⤵
  PID:7960
- C:\Windows\System\wbApDHb.exe
  C:\Windows\System\wbApDHb.exe
  2⤵
  PID:7988
- C:\Windows\System\DZScoyU.exe
  C:\Windows\System\DZScoyU.exe
  2⤵
  PID:8020
- C:\Windows\System\xXecOmA.exe
  C:\Windows\System\xXecOmA.exe
  2⤵
  PID:8052
- C:\Windows\System\jXPsNId.exe
  C:\Windows\System\jXPsNId.exe
  2⤵
  PID:8080
- C:\Windows\System\ulFKswP.exe
  C:\Windows\System\ulFKswP.exe
  2⤵
  PID:8116
- C:\Windows\System\CzyCVEZ.exe
  C:\Windows\System\CzyCVEZ.exe
  2⤵
  PID:8148
- C:\Windows\System\mUVybPh.exe
  C:\Windows\System\mUVybPh.exe
  2⤵
  PID:8180
- C:\Windows\System\uwgWQFj.exe
  C:\Windows\System\uwgWQFj.exe
  2⤵
  PID:7192
- C:\Windows\System\avNvXzg.exe
  C:\Windows\System\avNvXzg.exe
  2⤵
  PID:7256
- C:\Windows\System\GZDjCES.exe
  C:\Windows\System\GZDjCES.exe
  2⤵
  PID:7284
- C:\Windows\System\NsfVJnn.exe
  C:\Windows\System\NsfVJnn.exe
  2⤵
  PID:7364
- C:\Windows\System\fJCHGab.exe
  C:\Windows\System\fJCHGab.exe
  2⤵
  PID:7444
- C:\Windows\System\EnoTbhM.exe
  C:\Windows\System\EnoTbhM.exe
  2⤵
  PID:7504
- C:\Windows\System\DVQJpCM.exe
  C:\Windows\System\DVQJpCM.exe
  2⤵
  PID:7488
- C:\Windows\System\bSxZYIx.exe
  C:\Windows\System\bSxZYIx.exe
  2⤵
  PID:7604
- C:\Windows\System\zbJZcNf.exe
  C:\Windows\System\zbJZcNf.exe
  2⤵
  PID:7716
- C:\Windows\System\SvxABAd.exe
  C:\Windows\System\SvxABAd.exe
  2⤵
  PID:7708
- C:\Windows\System\ZrwVsrw.exe
  C:\Windows\System\ZrwVsrw.exe
  2⤵
  PID:7828
- C:\Windows\System\aJvlzBd.exe
  C:\Windows\System\aJvlzBd.exe
  2⤵
  PID:7916
- C:\Windows\System\WehvKkW.exe
  C:\Windows\System\WehvKkW.exe
  2⤵
  PID:7940
- C:\Windows\System\RzEcUXc.exe
  C:\Windows\System\RzEcUXc.exe
  2⤵
  PID:8028
- C:\Windows\System\kuIUdeB.exe
  C:\Windows\System\kuIUdeB.exe
  2⤵
  PID:8140
- C:\Windows\System\jOZGOKa.exe
  C:\Windows\System\jOZGOKa.exe
  2⤵
  PID:8188
- C:\Windows\System\xabbsEo.exe
  C:\Windows\System\xabbsEo.exe
  2⤵
  PID:6512
- C:\Windows\System\XjfZLWs.exe
  C:\Windows\System\XjfZLWs.exe
  2⤵
  PID:7332
- C:\Windows\System\fOSnriG.exe
  C:\Windows\System\fOSnriG.exe
  2⤵
  PID:7560
- C:\Windows\System\JmXhqAf.exe
  C:\Windows\System\JmXhqAf.exe
  2⤵
  PID:7624
- C:\Windows\System\DnwtLSX.exe
  C:\Windows\System\DnwtLSX.exe
  2⤵
  PID:7868
- C:\Windows\System\PMNHKdE.exe
  C:\Windows\System\PMNHKdE.exe
  2⤵
  PID:7984
- C:\Windows\System\otwyDpD.exe
  C:\Windows\System\otwyDpD.exe
  2⤵
  PID:8096
- C:\Windows\System\WWrgFcE.exe
  C:\Windows\System\WWrgFcE.exe
  2⤵
  PID:6780
- C:\Windows\System\pIeEBYO.exe
  C:\Windows\System\pIeEBYO.exe
  2⤵
  PID:7632
- C:\Windows\System\gnLntPc.exe
  C:\Windows\System\gnLntPc.exe
  2⤵
  PID:8060
- C:\Windows\System\KUbUJjz.exe
  C:\Windows\System\KUbUJjz.exe
  2⤵
  PID:7544
- C:\Windows\System\lmBZRvE.exe
  C:\Windows\System\lmBZRvE.exe
  2⤵
  PID:7232
- C:\Windows\System\eIXYOmb.exe
  C:\Windows\System\eIXYOmb.exe
  2⤵
  PID:8232
- C:\Windows\System\MINHESR.exe
  C:\Windows\System\MINHESR.exe
  2⤵
  PID:8260
- C:\Windows\System\kCgSyBr.exe
  C:\Windows\System\kCgSyBr.exe
  2⤵
  PID:8276
- C:\Windows\System\kkvUrZt.exe
  C:\Windows\System\kkvUrZt.exe
  2⤵
  PID:8312
- C:\Windows\System\aGtDqKu.exe
  C:\Windows\System\aGtDqKu.exe
  2⤵
  PID:8344
- C:\Windows\System\aNtmZMR.exe
  C:\Windows\System\aNtmZMR.exe
  2⤵
  PID:8364
- C:\Windows\System\eamiPBQ.exe
  C:\Windows\System\eamiPBQ.exe
  2⤵
  PID:8392
- C:\Windows\System\tgSHTYT.exe
  C:\Windows\System\tgSHTYT.exe
  2⤵
  PID:8416
- C:\Windows\System\sWAaLNB.exe
  C:\Windows\System\sWAaLNB.exe
  2⤵
  PID:8444
- C:\Windows\System\srBgEjs.exe
  C:\Windows\System\srBgEjs.exe
  2⤵
  PID:8484
- C:\Windows\System\kJDnOuV.exe
  C:\Windows\System\kJDnOuV.exe
  2⤵
  PID:8500
- C:\Windows\System\SchMetp.exe
  C:\Windows\System\SchMetp.exe
  2⤵
  PID:8528
- C:\Windows\System\pVNOjVd.exe
  C:\Windows\System\pVNOjVd.exe
  2⤵
  PID:8544
- C:\Windows\System\NcsxQaW.exe
  C:\Windows\System\NcsxQaW.exe
  2⤵
  PID:8572
- C:\Windows\System\FIUvwiP.exe
  C:\Windows\System\FIUvwiP.exe
  2⤵
  PID:8612
- C:\Windows\System\uwoHIMY.exe
  C:\Windows\System\uwoHIMY.exe
  2⤵
  PID:8628
- C:\Windows\System\jyDMTOT.exe
  C:\Windows\System\jyDMTOT.exe
  2⤵
  PID:8656
- C:\Windows\System\mzpyBsb.exe
  C:\Windows\System\mzpyBsb.exe
  2⤵
  PID:8696
- C:\Windows\System\lUyCfJD.exe
  C:\Windows\System\lUyCfJD.exe
  2⤵
  PID:8724
- C:\Windows\System\ZtKZspV.exe
  C:\Windows\System\ZtKZspV.exe
  2⤵
  PID:8752
- C:\Windows\System\PPFQWWE.exe
  C:\Windows\System\PPFQWWE.exe
  2⤵
  PID:8780
- C:\Windows\System\vMbpQjN.exe
  C:\Windows\System\vMbpQjN.exe
  2⤵
  PID:8808
- C:\Windows\System\UOyfgMg.exe
  C:\Windows\System\UOyfgMg.exe
  2⤵
  PID:8836
- C:\Windows\System\FdIVpMW.exe
  C:\Windows\System\FdIVpMW.exe
  2⤵
  PID:8864
- C:\Windows\System\uKDbfDb.exe
  C:\Windows\System\uKDbfDb.exe
  2⤵
  PID:8892
- C:\Windows\System\fpaNZZD.exe
  C:\Windows\System\fpaNZZD.exe
  2⤵
  PID:8920
- C:\Windows\System\KDwDYba.exe
  C:\Windows\System\KDwDYba.exe
  2⤵
  PID:8968
- C:\Windows\System\ifXkWEu.exe
  C:\Windows\System\ifXkWEu.exe
  2⤵
  PID:8996
- C:\Windows\System\kFIATFz.exe
  C:\Windows\System\kFIATFz.exe
  2⤵
  PID:9028
- C:\Windows\System\zViSOvW.exe
  C:\Windows\System\zViSOvW.exe
  2⤵
  PID:9060
- C:\Windows\System\czXtxqS.exe
  C:\Windows\System\czXtxqS.exe
  2⤵
  PID:9096
- C:\Windows\System\dQEqiDG.exe
  C:\Windows\System\dQEqiDG.exe
  2⤵
  PID:9120
- C:\Windows\System\DjmGuPh.exe
  C:\Windows\System\DjmGuPh.exe
  2⤵
  PID:9156
- C:\Windows\System\cKQYmWr.exe
  C:\Windows\System\cKQYmWr.exe
  2⤵
  PID:9188
- C:\Windows\System\QtVTxOl.exe
  C:\Windows\System\QtVTxOl.exe
  2⤵
  PID:7756
- C:\Windows\System\IVvumbn.exe
  C:\Windows\System\IVvumbn.exe
  2⤵
  PID:8220
- C:\Windows\System\mGoqscy.exe
  C:\Windows\System\mGoqscy.exe
  2⤵
  PID:8300
- C:\Windows\System\Odqzgfm.exe
  C:\Windows\System\Odqzgfm.exe
  2⤵
  PID:8384
- C:\Windows\System\BLzmUNo.exe
  C:\Windows\System\BLzmUNo.exe
  2⤵
  PID:8436
- C:\Windows\System\rPovOrH.exe
  C:\Windows\System\rPovOrH.exe
  2⤵
  PID:8456
- C:\Windows\System\DZkxxPS.exe
  C:\Windows\System\DZkxxPS.exe
  2⤵
  PID:8560
- C:\Windows\System\ijilLHo.exe
  C:\Windows\System\ijilLHo.exe
  2⤵
  PID:8620
- C:\Windows\System\VVmYHjq.exe
  C:\Windows\System\VVmYHjq.exe
  2⤵
  PID:8672
- C:\Windows\System\OuCgNQv.exe
  C:\Windows\System\OuCgNQv.exe
  2⤵
  PID:8768
- C:\Windows\System\nZxcixA.exe
  C:\Windows\System\nZxcixA.exe
  2⤵
  PID:8796
- C:\Windows\System\okscrtx.exe
  C:\Windows\System\okscrtx.exe
  2⤵
  PID:8884
- C:\Windows\System\VKGnqmk.exe
  C:\Windows\System\VKGnqmk.exe
  2⤵
  PID:8916
- C:\Windows\System\TecKize.exe
  C:\Windows\System\TecKize.exe
  2⤵
  PID:8984
- C:\Windows\System\XWiNdSl.exe
  C:\Windows\System\XWiNdSl.exe
  2⤵
  PID:9104
- C:\Windows\System\OUemRoY.exe
  C:\Windows\System\OUemRoY.exe
  2⤵
  PID:9132
- C:\Windows\System\tCMLaxy.exe
  C:\Windows\System\tCMLaxy.exe
  2⤵
  PID:8216
- C:\Windows\System\mnQKJhy.exe
  C:\Windows\System\mnQKJhy.exe
  2⤵
  PID:8356
- C:\Windows\System\lJEVozh.exe
  C:\Windows\System\lJEVozh.exe
  2⤵
  PID:8400
- C:\Windows\System\DgOlZsQ.exe
  C:\Windows\System\DgOlZsQ.exe
  2⤵
  PID:8508
- C:\Windows\System\LyYlasa.exe
  C:\Windows\System\LyYlasa.exe
  2⤵
  PID:8716
- C:\Windows\System\IUGSUEq.exe
  C:\Windows\System\IUGSUEq.exe
  2⤵
  PID:8644
- C:\Windows\System\wnzrnNI.exe
  C:\Windows\System\wnzrnNI.exe
  2⤵
  PID:8904
- C:\Windows\System\shISZqV.exe
  C:\Windows\System\shISZqV.exe
  2⤵
  PID:9172
- C:\Windows\System\RhfAKYH.exe
  C:\Windows\System\RhfAKYH.exe
  2⤵
  PID:9200
- C:\Windows\System\IZwmqlb.exe
  C:\Windows\System\IZwmqlb.exe
  2⤵
  PID:8580
- C:\Windows\System\ItenvjX.exe
  C:\Windows\System\ItenvjX.exe
  2⤵
  PID:8304
- C:\Windows\System\olhIZjH.exe
  C:\Windows\System\olhIZjH.exe
  2⤵
  PID:8268
- C:\Windows\System\AefeUUG.exe
  C:\Windows\System\AefeUUG.exe
  2⤵
  PID:9236
- C:\Windows\System\WDfPTRD.exe
  C:\Windows\System\WDfPTRD.exe
  2⤵
  PID:9264
- C:\Windows\System\azhhlpz.exe
  C:\Windows\System\azhhlpz.exe
  2⤵
  PID:9304
- C:\Windows\System\ywtbnHo.exe
  C:\Windows\System\ywtbnHo.exe
  2⤵
  PID:9332
- C:\Windows\System\WrqCUKr.exe
  C:\Windows\System\WrqCUKr.exe
  2⤵
  PID:9356
- C:\Windows\System\VDdpqbl.exe
  C:\Windows\System\VDdpqbl.exe
  2⤵
  PID:9388
- C:\Windows\System\rQUEwLi.exe
  C:\Windows\System\rQUEwLi.exe
  2⤵
  PID:9424
- C:\Windows\System\AnkUeOp.exe
  C:\Windows\System\AnkUeOp.exe
  2⤵
  PID:9444
- C:\Windows\System\cmggNBN.exe
  C:\Windows\System\cmggNBN.exe
  2⤵
  PID:9468
- C:\Windows\System\apRjLWf.exe
  C:\Windows\System\apRjLWf.exe
  2⤵
  PID:9500
- C:\Windows\System\qvHdCQZ.exe
  C:\Windows\System\qvHdCQZ.exe
  2⤵
  PID:9516
- C:\Windows\System\vHzvtyN.exe
  C:\Windows\System\vHzvtyN.exe
  2⤵
  PID:9544
- C:\Windows\System\UaNDvVl.exe
  C:\Windows\System\UaNDvVl.exe
  2⤵
  PID:9584
- C:\Windows\System\hwMPBhe.exe
  C:\Windows\System\hwMPBhe.exe
  2⤵
  PID:9604
- C:\Windows\System\pZfHdco.exe
  C:\Windows\System\pZfHdco.exe
  2⤵
  PID:9652
- C:\Windows\System\IwKofja.exe
  C:\Windows\System\IwKofja.exe
  2⤵
  PID:9668
- C:\Windows\System\eaCGsLT.exe
  C:\Windows\System\eaCGsLT.exe
  2⤵
  PID:9700
- C:\Windows\System\llNtBra.exe
  C:\Windows\System\llNtBra.exe
  2⤵
  PID:9724
- C:\Windows\System\YtHlcYB.exe
  C:\Windows\System\YtHlcYB.exe
  2⤵
  PID:9752
- C:\Windows\System\WTFCiXb.exe
  C:\Windows\System\WTFCiXb.exe
  2⤵
  PID:9768
- C:\Windows\System\WEgoxQH.exe
  C:\Windows\System\WEgoxQH.exe
  2⤵
  PID:9804
- C:\Windows\System\SHWGyJU.exe
  C:\Windows\System\SHWGyJU.exe
  2⤵
  PID:9840
- C:\Windows\System\pSKGReW.exe
  C:\Windows\System\pSKGReW.exe
  2⤵
  PID:9864
- C:\Windows\System\RurGZDS.exe
  C:\Windows\System\RurGZDS.exe
  2⤵
  PID:9892
- C:\Windows\System\DAdrrRP.exe
  C:\Windows\System\DAdrrRP.exe
  2⤵
  PID:9928
- C:\Windows\System\vMdMHbE.exe
  C:\Windows\System\vMdMHbE.exe
  2⤵
  PID:9948
- C:\Windows\System\MyzCvMx.exe
  C:\Windows\System\MyzCvMx.exe
  2⤵
  PID:9980
- C:\Windows\System\KfMuLMJ.exe
  C:\Windows\System\KfMuLMJ.exe
  2⤵
  PID:10012
- C:\Windows\System\ufkqGoc.exe
  C:\Windows\System\ufkqGoc.exe
  2⤵
  PID:10032
- C:\Windows\System\cdjNYmU.exe
  C:\Windows\System\cdjNYmU.exe
  2⤵
  PID:10060
- C:\Windows\System\mRvNBzu.exe
  C:\Windows\System\mRvNBzu.exe
  2⤵
  PID:10088
- C:\Windows\System\DOanDjg.exe
  C:\Windows\System\DOanDjg.exe
  2⤵
  PID:10108
- C:\Windows\System\HALMjwe.exe
  C:\Windows\System\HALMjwe.exe
  2⤵
  PID:10140
- C:\Windows\System\PqFZHxF.exe
  C:\Windows\System\PqFZHxF.exe
  2⤵
  PID:10172
- C:\Windows\System\HILeunB.exe
  C:\Windows\System\HILeunB.exe
  2⤵
  PID:10200
- C:\Windows\System\VcOOtKo.exe
  C:\Windows\System\VcOOtKo.exe
  2⤵
  PID:10228
- C:\Windows\System\qNTiNDZ.exe
  C:\Windows\System\qNTiNDZ.exe
  2⤵
  PID:9224
- C:\Windows\System\LdaRrfd.exe
  C:\Windows\System\LdaRrfd.exe
  2⤵
  PID:9260
- C:\Windows\System\BMbUdCL.exe
  C:\Windows\System\BMbUdCL.exe
  2⤵
  PID:9324
- C:\Windows\System\extvMPo.exe
  C:\Windows\System\extvMPo.exe
  2⤵
  PID:9376
- C:\Windows\System\TBqrjJD.exe
  C:\Windows\System\TBqrjJD.exe
  2⤵
  PID:9436
- C:\Windows\System\XrwGjUu.exe
  C:\Windows\System\XrwGjUu.exe
  2⤵
  PID:9568
- C:\Windows\System\rHwegcQ.exe
  C:\Windows\System\rHwegcQ.exe
  2⤵
  PID:9592
- C:\Windows\System\evcpXHG.exe
  C:\Windows\System\evcpXHG.exe
  2⤵
  PID:9632
- C:\Windows\System\CLZlPwA.exe
  C:\Windows\System\CLZlPwA.exe
  2⤵
  PID:9716
- C:\Windows\System\VZIitwE.exe
  C:\Windows\System\VZIitwE.exe
  2⤵
  PID:9764
- C:\Windows\System\fqVnRzq.exe
  C:\Windows\System\fqVnRzq.exe
  2⤵
  PID:9856
- C:\Windows\System\DYpoouA.exe
  C:\Windows\System\DYpoouA.exe
  2⤵
  PID:9936
- C:\Windows\System\EhLjAkp.exe
  C:\Windows\System\EhLjAkp.exe
  2⤵
  PID:10004
- C:\Windows\System\budlZLd.exe
  C:\Windows\System\budlZLd.exe
  2⤵
  PID:10044
- C:\Windows\System\VciqDob.exe
  C:\Windows\System\VciqDob.exe
  2⤵
  PID:10124
- C:\Windows\System\yeMBXPu.exe
  C:\Windows\System\yeMBXPu.exe
  2⤵
  PID:10192
- C:\Windows\System\ftiZwsv.exe
  C:\Windows\System\ftiZwsv.exe
  2⤵
  PID:8740
- C:\Windows\System\pWFFDrW.exe
  C:\Windows\System\pWFFDrW.exe
  2⤵
  PID:9400
- C:\Windows\System\YYQDRYn.exe
  C:\Windows\System\YYQDRYn.exe
  2⤵
  PID:9508
- C:\Windows\System\rkaUKmM.exe
  C:\Windows\System\rkaUKmM.exe
  2⤵
  PID:9620
- C:\Windows\System\duFpaAP.exe
  C:\Windows\System\duFpaAP.exe
  2⤵
  PID:9832
- C:\Windows\System\BRAvGBf.exe
  C:\Windows\System\BRAvGBf.exe
  2⤵
  PID:9940
- C:\Windows\System\oQkQaEU.exe
  C:\Windows\System\oQkQaEU.exe
  2⤵
  PID:10056
- C:\Windows\System\wyLLyGA.exe
  C:\Windows\System\wyLLyGA.exe
  2⤵
  PID:3212
- C:\Windows\System\XXwGwvv.exe
  C:\Windows\System\XXwGwvv.exe
  2⤵
  PID:2652
- C:\Windows\System\TaWvSPB.exe
  C:\Windows\System\TaWvSPB.exe
  2⤵
  PID:9744
- C:\Windows\System\qfirFoZ.exe
  C:\Windows\System\qfirFoZ.exe
  2⤵
  PID:10028
- C:\Windows\System\oZLfMTt.exe
  C:\Windows\System\oZLfMTt.exe
  2⤵
  PID:9288
- C:\Windows\System\gzTdxzC.exe
  C:\Windows\System\gzTdxzC.exe
  2⤵
  PID:10152
- C:\Windows\System\mFEXuYf.exe
  C:\Windows\System\mFEXuYf.exe
  2⤵
  PID:9276
- C:\Windows\System\LDlNuUO.exe
  C:\Windows\System\LDlNuUO.exe
  2⤵
  PID:10260
- C:\Windows\System\mPpcKbM.exe
  C:\Windows\System\mPpcKbM.exe
  2⤵
  PID:10276
- C:\Windows\System\JOXRcMC.exe
  C:\Windows\System\JOXRcMC.exe
  2⤵
  PID:10312
- C:\Windows\System\usZmOiN.exe
  C:\Windows\System\usZmOiN.exe
  2⤵
  PID:10344
- C:\Windows\System\sifSvdY.exe
  C:\Windows\System\sifSvdY.exe
  2⤵
  PID:10360
- C:\Windows\System\DQHhCdQ.exe
  C:\Windows\System\DQHhCdQ.exe
  2⤵
  PID:10408
- C:\Windows\System\JGZwwsn.exe
  C:\Windows\System\JGZwwsn.exe
  2⤵
  PID:10440
- C:\Windows\System\CfLphXE.exe
  C:\Windows\System\CfLphXE.exe
  2⤵
  PID:10464
- C:\Windows\System\tqHETbO.exe
  C:\Windows\System\tqHETbO.exe
  2⤵
  PID:10484
- C:\Windows\System\wXtTEPb.exe
  C:\Windows\System\wXtTEPb.exe
  2⤵
  PID:10508
- C:\Windows\System\Yylyvgg.exe
  C:\Windows\System\Yylyvgg.exe
  2⤵
  PID:10544
- C:\Windows\System\JGtZyuf.exe
  C:\Windows\System\JGtZyuf.exe
  2⤵
  PID:10580
- C:\Windows\System\cJtlBqx.exe
  C:\Windows\System\cJtlBqx.exe
  2⤵
  PID:10596
- C:\Windows\System\XnlveUd.exe
  C:\Windows\System\XnlveUd.exe
  2⤵
  PID:10624
- C:\Windows\System\XVjvYRt.exe
  C:\Windows\System\XVjvYRt.exe
  2⤵
  PID:10652
- C:\Windows\System\mxqoqYO.exe
  C:\Windows\System\mxqoqYO.exe
  2⤵
  PID:10668
- C:\Windows\System\mqqaLLc.exe
  C:\Windows\System\mqqaLLc.exe
  2⤵
  PID:10684
- C:\Windows\System\dusUUFb.exe
  C:\Windows\System\dusUUFb.exe
  2⤵
  PID:10708
- C:\Windows\System\wORSdfo.exe
  C:\Windows\System\wORSdfo.exe
  2⤵
  PID:10728
- C:\Windows\System\vYLOspx.exe
  C:\Windows\System\vYLOspx.exe
  2⤵
  PID:10764
- C:\Windows\System\xlKdUkR.exe
  C:\Windows\System\xlKdUkR.exe
  2⤵
  PID:10800
- C:\Windows\System\nKsrVEw.exe
  C:\Windows\System\nKsrVEw.exe
  2⤵
  PID:10828
- C:\Windows\System\FqlxHoD.exe
  C:\Windows\System\FqlxHoD.exe
  2⤵
  PID:10856
- C:\Windows\System\frdYpAP.exe
  C:\Windows\System\frdYpAP.exe
  2⤵
  PID:10880
- C:\Windows\System\zlZhVNj.exe
  C:\Windows\System\zlZhVNj.exe
  2⤵
  PID:10912
- C:\Windows\System\fUrPJtx.exe
  C:\Windows\System\fUrPJtx.exe
  2⤵
  PID:10952
- C:\Windows\System\qOOVbJN.exe
  C:\Windows\System\qOOVbJN.exe
  2⤵
  PID:10988
- C:\Windows\System\rJYGtvO.exe
  C:\Windows\System\rJYGtvO.exe
  2⤵
  PID:11024
- C:\Windows\System\jpwQfzw.exe
  C:\Windows\System\jpwQfzw.exe
  2⤵
  PID:11052
- C:\Windows\System\vVMuITa.exe
  C:\Windows\System\vVMuITa.exe
  2⤵
  PID:11080
- C:\Windows\System\lWzbhcH.exe
  C:\Windows\System\lWzbhcH.exe
  2⤵
  PID:11108
- C:\Windows\System\csfGpJS.exe
  C:\Windows\System\csfGpJS.exe
  2⤵
  PID:11208
- C:\Windows\System\BUeKhyY.exe
  C:\Windows\System\BUeKhyY.exe
  2⤵
  PID:11228
- C:\Windows\System\NaXKwhg.exe
  C:\Windows\System\NaXKwhg.exe
  2⤵
  PID:11260
- C:\Windows\System\JQGhOCQ.exe
  C:\Windows\System\JQGhOCQ.exe
  2⤵
  PID:10268
- C:\Windows\System\qrjnPfX.exe
  C:\Windows\System\qrjnPfX.exe
  2⤵
  PID:10308
- C:\Windows\System\feSHWVy.exe
  C:\Windows\System\feSHWVy.exe
  2⤵
  PID:10428
- C:\Windows\System\TjqBPUp.exe
  C:\Windows\System\TjqBPUp.exe
  2⤵
  PID:10504
- C:\Windows\System\TXhVeeM.exe
  C:\Windows\System\TXhVeeM.exe
  2⤵
  PID:10560
- C:\Windows\System\aSgbdvS.exe
  C:\Windows\System\aSgbdvS.exe
  2⤵
  PID:10664
- C:\Windows\System\ATpucNG.exe
  C:\Windows\System\ATpucNG.exe
  2⤵
  PID:10724
- C:\Windows\System\VPRNouB.exe
  C:\Windows\System\VPRNouB.exe
  2⤵
  PID:10840
- C:\Windows\System\FfaGzZG.exe
  C:\Windows\System\FfaGzZG.exe
  2⤵
  PID:10872
- C:\Windows\System\RukXMBN.exe
  C:\Windows\System\RukXMBN.exe
  2⤵
  PID:10920
- C:\Windows\System\BopcxgV.exe
  C:\Windows\System\BopcxgV.exe
  2⤵
  PID:11036
- C:\Windows\System\XRzeATT.exe
  C:\Windows\System\XRzeATT.exe
  2⤵
  PID:11064
- C:\Windows\System\WvQgObH.exe
  C:\Windows\System\WvQgObH.exe
  2⤵
  PID:11120
- C:\Windows\System\RvlVwJF.exe
  C:\Windows\System\RvlVwJF.exe
  2⤵
  PID:4704
- C:\Windows\System\cQfOzDq.exe
  C:\Windows\System\cQfOzDq.exe
  2⤵
  PID:11244
- C:\Windows\System\gwWtGku.exe
  C:\Windows\System\gwWtGku.exe
  2⤵
  PID:10288
- C:\Windows\System\BaZbqjz.exe
  C:\Windows\System\BaZbqjz.exe
  2⤵
  PID:10476
- C:\Windows\System\QgHzEBu.exe
  C:\Windows\System\QgHzEBu.exe
  2⤵
  PID:10520
- C:\Windows\System\tHgreLT.exe
  C:\Windows\System\tHgreLT.exe
  2⤵
  PID:10788
- C:\Windows\System\kRgHBYP.exe
  C:\Windows\System\kRgHBYP.exe
  2⤵
  PID:11068
- C:\Windows\System\feqFfyy.exe
  C:\Windows\System\feqFfyy.exe
  2⤵
  PID:11220
- C:\Windows\System\dvSWFxx.exe
  C:\Windows\System\dvSWFxx.exe
  2⤵
  PID:10248
- C:\Windows\System\BEXkfDI.exe
  C:\Windows\System\BEXkfDI.exe
  2⤵
  PID:5096
- C:\Windows\System\KcxlSsY.exe
  C:\Windows\System\KcxlSsY.exe
  2⤵
  PID:11268
- C:\Windows\System\aamycHu.exe
  C:\Windows\System\aamycHu.exe
  2⤵
  PID:11308
- C:\Windows\System\qeqDwwb.exe
  C:\Windows\System\qeqDwwb.exe
  2⤵
  PID:11328
- C:\Windows\System\nJiIYPN.exe
  C:\Windows\System\nJiIYPN.exe
  2⤵
  PID:11360
- C:\Windows\System\VXUqugT.exe
  C:\Windows\System\VXUqugT.exe
  2⤵
  PID:11384
- C:\Windows\System\AlnCZcM.exe
  C:\Windows\System\AlnCZcM.exe
  2⤵
  PID:11412
- C:\Windows\System\EPlUOdp.exe
  C:\Windows\System\EPlUOdp.exe
  2⤵
  PID:11444
- C:\Windows\System\FqSQOIW.exe
  C:\Windows\System\FqSQOIW.exe
  2⤵
  PID:11468
- C:\Windows\System\ZjELtUS.exe
  C:\Windows\System\ZjELtUS.exe
  2⤵
  PID:11496
- C:\Windows\System\MvcbDHB.exe
  C:\Windows\System\MvcbDHB.exe
  2⤵
  PID:11540
- C:\Windows\System\kbPxOYY.exe
  C:\Windows\System\kbPxOYY.exe
  2⤵
  PID:11568
- C:\Windows\System\HRWVPen.exe
  C:\Windows\System\HRWVPen.exe
  2⤵
  PID:11608
- C:\Windows\System\GzVlsvr.exe
  C:\Windows\System\GzVlsvr.exe
  2⤵
  PID:11648
- C:\Windows\System\tqiUwQO.exe
  C:\Windows\System\tqiUwQO.exe
  2⤵
  PID:11684
- C:\Windows\System\AwNojBb.exe
  C:\Windows\System\AwNojBb.exe
  2⤵
  PID:11716
- C:\Windows\System\IUVWzWN.exe
  C:\Windows\System\IUVWzWN.exe
  2⤵
  PID:11740
- C:\Windows\System\wIeEDLb.exe
  C:\Windows\System\wIeEDLb.exe
  2⤵
  PID:11768
- C:\Windows\System\ZPvougc.exe
  C:\Windows\System\ZPvougc.exe
  2⤵
  PID:11796
- C:\Windows\System\BCAdimQ.exe
  C:\Windows\System\BCAdimQ.exe
  2⤵
  PID:11832
- C:\Windows\System\dhSAZqf.exe
  C:\Windows\System\dhSAZqf.exe
  2⤵
  PID:11868
- C:\Windows\System\jTSJrlU.exe
  C:\Windows\System\jTSJrlU.exe
  2⤵
  PID:11892
- C:\Windows\System\pIjopeM.exe
  C:\Windows\System\pIjopeM.exe
  2⤵
  PID:11928
- C:\Windows\System\WGigkfL.exe
  C:\Windows\System\WGigkfL.exe
  2⤵
  PID:11956
- C:\Windows\System\dlmaoJN.exe
  C:\Windows\System\dlmaoJN.exe
  2⤵
  PID:11992
- C:\Windows\System\LKcebJi.exe
  C:\Windows\System\LKcebJi.exe
  2⤵
  PID:12028
- C:\Windows\System\nZLHkCw.exe
  C:\Windows\System\nZLHkCw.exe
  2⤵
  PID:12056
- C:\Windows\System\xSmqAub.exe
  C:\Windows\System\xSmqAub.exe
  2⤵
  PID:12088
- C:\Windows\System\EhZKAkO.exe
  C:\Windows\System\EhZKAkO.exe
  2⤵
  PID:12112
- C:\Windows\System\TNTjowt.exe
  C:\Windows\System\TNTjowt.exe
  2⤵
  PID:12140
- C:\Windows\System\GEfoESl.exe
  C:\Windows\System\GEfoESl.exe
  2⤵
  PID:12164
- C:\Windows\System\OrRtwHN.exe
  C:\Windows\System\OrRtwHN.exe
  2⤵
  PID:12192
- C:\Windows\System\PSIqdeN.exe
  C:\Windows\System\PSIqdeN.exe
  2⤵
  PID:12228
- C:\Windows\System\aJxlBUq.exe
  C:\Windows\System\aJxlBUq.exe
  2⤵
  PID:12260
- C:\Windows\System\DnRrynz.exe
  C:\Windows\System\DnRrynz.exe
  2⤵
  PID:11072
- C:\Windows\System\GUvNhFw.exe
  C:\Windows\System\GUvNhFw.exe
  2⤵
  PID:11368
- C:\Windows\System\LNKfXZC.exe
  C:\Windows\System\LNKfXZC.exe
  2⤵
  PID:10692
- C:\Windows\System\QmLNaUI.exe
  C:\Windows\System\QmLNaUI.exe
  2⤵
  PID:11428
- C:\Windows\System\NcHwNuW.exe
  C:\Windows\System\NcHwNuW.exe
  2⤵
  PID:11552
- C:\Windows\System\rGEfisJ.exe
  C:\Windows\System\rGEfisJ.exe
  2⤵
  PID:11660
- C:\Windows\System\bymkaCX.exe
  C:\Windows\System\bymkaCX.exe
  2⤵
  PID:11700
- C:\Windows\System\jTIjAZE.exe
  C:\Windows\System\jTIjAZE.exe
  2⤵
  PID:11760
- C:\Windows\System\xMiaHwX.exe
  C:\Windows\System\xMiaHwX.exe
  2⤵
  PID:11632
- C:\Windows\System\bPtoesQ.exe
  C:\Windows\System\bPtoesQ.exe
  2⤵
  PID:11840
- C:\Windows\System\jZQiAve.exe
  C:\Windows\System\jZQiAve.exe
  2⤵
  PID:11936
- C:\Windows\System\IfAfowe.exe
  C:\Windows\System\IfAfowe.exe
  2⤵
  PID:12036
- C:\Windows\System\mqktyWW.exe
  C:\Windows\System\mqktyWW.exe
  2⤵
  PID:12220
- C:\Windows\System\AGgMfJU.exe
  C:\Windows\System\AGgMfJU.exe
  2⤵
  PID:12100
- C:\Windows\System\qtzeAis.exe
  C:\Windows\System\qtzeAis.exe
  2⤵
  PID:12256
- C:\Windows\System\mUGPVqm.exe
  C:\Windows\System\mUGPVqm.exe
  2⤵
  PID:11160
- C:\Windows\System\sFwOBfv.exe
  C:\Windows\System\sFwOBfv.exe
  2⤵
  PID:11316
- C:\Windows\System\xNtAdat.exe
  C:\Windows\System\xNtAdat.exe
  2⤵
  PID:10292
- C:\Windows\System\xyIKtfL.exe
  C:\Windows\System\xyIKtfL.exe
  2⤵
  PID:11636
- C:\Windows\System\flmXale.exe
  C:\Windows\System\flmXale.exe
  2⤵
  PID:11792
- C:\Windows\System\aekeqNf.exe
  C:\Windows\System\aekeqNf.exe
  2⤵
  PID:12276
- C:\Windows\System\TgVNQZo.exe
  C:\Windows\System\TgVNQZo.exe
  2⤵
  PID:12016
- C:\Windows\System\vuCqyBT.exe
  C:\Windows\System\vuCqyBT.exe
  2⤵
  PID:12292
- C:\Windows\System\JprCVTj.exe
  C:\Windows\System\JprCVTj.exe
  2⤵
  PID:12324
- C:\Windows\System\oZqDiSn.exe
  C:\Windows\System\oZqDiSn.exe
  2⤵
  PID:12360
- C:\Windows\System\dfHIHzR.exe
  C:\Windows\System\dfHIHzR.exe
  2⤵
  PID:12388
- C:\Windows\System\BybhogJ.exe
  C:\Windows\System\BybhogJ.exe
  2⤵
  PID:12408
- C:\Windows\System\axYkbbG.exe
  C:\Windows\System\axYkbbG.exe
  2⤵
  PID:12440
- C:\Windows\System\CujjcLn.exe
  C:\Windows\System\CujjcLn.exe
  2⤵
  PID:12472
- C:\Windows\System\PskBwsZ.exe
  C:\Windows\System\PskBwsZ.exe
  2⤵
  PID:12508
- C:\Windows\System\nuXDjar.exe
  C:\Windows\System\nuXDjar.exe
  2⤵
  PID:12536
- C:\Windows\System\zBLIQgS.exe
  C:\Windows\System\zBLIQgS.exe
  2⤵
  PID:12568
- C:\Windows\System\tgSueia.exe
  C:\Windows\System\tgSueia.exe
  2⤵
  PID:12604
- C:\Windows\System\ZfUWBmM.exe
  C:\Windows\System\ZfUWBmM.exe
  2⤵
  PID:12632
- C:\Windows\System\SflGXQf.exe
  C:\Windows\System\SflGXQf.exe
  2⤵
  PID:12652
- C:\Windows\System\mDCRycJ.exe
  C:\Windows\System\mDCRycJ.exe
  2⤵
  PID:12680
- C:\Windows\System\tPOfPvY.exe
  C:\Windows\System\tPOfPvY.exe
  2⤵
  PID:12708
- C:\Windows\System\FMSqGBZ.exe
  C:\Windows\System\FMSqGBZ.exe
  2⤵
  PID:12736
- C:\Windows\System\zbBSZws.exe
  C:\Windows\System\zbBSZws.exe
  2⤵
  PID:12764
- C:\Windows\System\TXfWSsC.exe
  C:\Windows\System\TXfWSsC.exe
  2⤵
  PID:12792
- C:\Windows\System\cyMUBVA.exe
  C:\Windows\System\cyMUBVA.exe
  2⤵
  PID:12820
- C:\Windows\System\iEOMYqT.exe
  C:\Windows\System\iEOMYqT.exe
  2⤵
  PID:12864
- C:\Windows\System\VfNOftA.exe
  C:\Windows\System\VfNOftA.exe
  2⤵
  PID:12880
- C:\Windows\System\qwAkgqa.exe
  C:\Windows\System\qwAkgqa.exe
  2⤵
  PID:12916
- C:\Windows\System\rOvGsnX.exe
  C:\Windows\System\rOvGsnX.exe
  2⤵
  PID:12948
- C:\Windows\System\xKWYxmc.exe
  C:\Windows\System\xKWYxmc.exe
  2⤵
  PID:12976
- C:\Windows\System\JLkeOad.exe
  C:\Windows\System\JLkeOad.exe
  2⤵
  PID:13012
- C:\Windows\System\XoreWsB.exe
  C:\Windows\System\XoreWsB.exe
  2⤵
  PID:13040
- C:\Windows\System\uWWWjfr.exe
  C:\Windows\System\uWWWjfr.exe
  2⤵
  PID:13068
- C:\Windows\System\SMgxMDI.exe
  C:\Windows\System\SMgxMDI.exe
  2⤵
  PID:13096
- C:\Windows\System\ZdDYhXH.exe
  C:\Windows\System\ZdDYhXH.exe
  2⤵
  PID:13132
- C:\Windows\System\cmEFDae.exe
  C:\Windows\System\cmEFDae.exe
  2⤵
  PID:13152
- C:\Windows\System\TLsLjdl.exe
  C:\Windows\System\TLsLjdl.exe
  2⤵
  PID:13180
- C:\Windows\System\MzSBOYG.exe
  C:\Windows\System\MzSBOYG.exe
  2⤵
  PID:13204
- C:\Windows\System\gHHZNsz.exe
  C:\Windows\System\gHHZNsz.exe
  2⤵
  PID:13232
- C:\Windows\System\zWDCfcW.exe
  C:\Windows\System\zWDCfcW.exe
  2⤵
  PID:13252
- C:\Windows\System\mXfPpBI.exe
  C:\Windows\System\mXfPpBI.exe
  2⤵
  PID:13276
- C:\Windows\System\IfbYuuk.exe
  C:\Windows\System\IfbYuuk.exe
  2⤵
  PID:12180
- C:\Windows\System\JUpYYmI.exe
  C:\Windows\System\JUpYYmI.exe
  2⤵
  PID:11784
- C:\Windows\System\DuryVJx.exe
  C:\Windows\System\DuryVJx.exe
  2⤵
  PID:11920
- C:\Windows\System\tHeAJVx.exe
  C:\Windows\System\tHeAJVx.exe
  2⤵
  PID:12308
- C:\Windows\System\rHUfEAI.exe
  C:\Windows\System\rHUfEAI.exe
  2⤵
  PID:12460
- C:\Windows\System\nQNTJwe.exe
  C:\Windows\System\nQNTJwe.exe
  2⤵
  PID:12564
- C:\Windows\System\ZHetkpx.exe
  C:\Windows\System\ZHetkpx.exe
  2⤵
  PID:12464
- C:\Windows\System\wmCdEsP.exe
  C:\Windows\System\wmCdEsP.exe
  2⤵
  PID:12524
- C:\Windows\System\aQMALrF.exe
  C:\Windows\System\aQMALrF.exe
  2⤵
  PID:12668
- C:\Windows\System\WhLsCdf.exe
  C:\Windows\System\WhLsCdf.exe
  2⤵
  PID:12752
- C:\Windows\System\qpoWogB.exe
  C:\Windows\System\qpoWogB.exe
  2⤵
  PID:12836
- C:\Windows\System\YyaGAqu.exe
  C:\Windows\System\YyaGAqu.exe
  2⤵
  PID:12928
- C:\Windows\System\uHAedhp.exe
  C:\Windows\System\uHAedhp.exe
  2⤵
  PID:12904
- C:\Windows\System\hBQCiNZ.exe
  C:\Windows\System\hBQCiNZ.exe
  2⤵
  PID:13032
- C:\Windows\System\chRpFAP.exe
  C:\Windows\System\chRpFAP.exe
  2⤵
  PID:13056
- C:\Windows\System\diBfqKO.exe
  C:\Windows\System\diBfqKO.exe
  2⤵
  PID:13172
- C:\Windows\System\nddZzAx.exe
  C:\Windows\System\nddZzAx.exe
  2⤵
  PID:12208
- C:\Windows\System\uDzzLLE.exe
  C:\Windows\System\uDzzLLE.exe
  2⤵
  PID:13300
- C:\Windows\System\iBQkgxj.exe
  C:\Windows\System\iBQkgxj.exe
  2⤵
  PID:12616
- C:\Windows\System\MkXpKca.exe
  C:\Windows\System\MkXpKca.exe
  2⤵
  PID:12700
- C:\Windows\System\ARXrixv.exe
  C:\Windows\System\ARXrixv.exe
  2⤵
  PID:12580
- C:\Windows\System\wdMIKYx.exe
  C:\Windows\System\wdMIKYx.exe
  2⤵
  PID:12784
- C:\Windows\System\utnGTJg.exe
  C:\Windows\System\utnGTJg.exe
  2⤵
  PID:13124
- C:\Windows\System\EyNNykc.exe
  C:\Windows\System\EyNNykc.exe
  2⤵
  PID:13196
- C:\Windows\System\aWMvprV.exe
  C:\Windows\System\aWMvprV.exe
  2⤵
  PID:12560
- C:\Windows\System\ARvpOUt.exe
  C:\Windows\System\ARvpOUt.exe
  2⤵
  PID:12500
- C:\Windows\System\ceEADaA.exe
  C:\Windows\System\ceEADaA.exe
  2⤵
  PID:13340
- C:\Windows\System\pCBOVJx.exe
  C:\Windows\System\pCBOVJx.exe
  2⤵
  PID:13384
- C:\Windows\System\zdgbxjz.exe
  C:\Windows\System\zdgbxjz.exe
  2⤵
  PID:13404
- C:\Windows\System\KbmpEox.exe
  C:\Windows\System\KbmpEox.exe
  2⤵
  PID:13420
- C:\Windows\System\pnHcJsG.exe
  C:\Windows\System\pnHcJsG.exe
  2⤵
  PID:13440
- C:\Windows\System\kKlLVeK.exe
  C:\Windows\System\kKlLVeK.exe
  2⤵
  PID:13472
- C:\Windows\System\ipEMdmY.exe
  C:\Windows\System\ipEMdmY.exe
  2⤵
  PID:13496
- C:\Windows\System\UmCXnDQ.exe
  C:\Windows\System\UmCXnDQ.exe
  2⤵
  PID:13520
- C:\Windows\System\wzxlQyA.exe
  C:\Windows\System\wzxlQyA.exe
  2⤵
  PID:13556
- C:\Windows\System\dqLlZBx.exe
  C:\Windows\System\dqLlZBx.exe
  2⤵
  PID:13576
- C:\Windows\System\syFuUkD.exe
  C:\Windows\System\syFuUkD.exe
  2⤵
  PID:13608
- C:\Windows\System\GSsRqSK.exe
  C:\Windows\System\GSsRqSK.exe
  2⤵
  PID:13644
- C:\Windows\System\ffIESLK.exe
  C:\Windows\System\ffIESLK.exe
  2⤵
  PID:13676
- C:\Windows\System\ZoYIceo.exe
  C:\Windows\System\ZoYIceo.exe
  2⤵
  PID:13700
- C:\Windows\System\uPPksAp.exe
  C:\Windows\System\uPPksAp.exe
  2⤵
  PID:13728
- C:\Windows\System\TWvNrEO.exe
  C:\Windows\System\TWvNrEO.exe
  2⤵
  PID:13756
- C:\Windows\System\glKasEK.exe
  C:\Windows\System\glKasEK.exe
  2⤵
  PID:13788
- C:\Windows\System\KFlmBot.exe
  C:\Windows\System\KFlmBot.exe
  2⤵
  PID:13820
- C:\Windows\System\FuLqTby.exe
  C:\Windows\System\FuLqTby.exe
  2⤵
  PID:13856
- C:\Windows\System\KmKMmHK.exe
  C:\Windows\System\KmKMmHK.exe
  2⤵
  PID:13876
- C:\Windows\System\vzanqyr.exe
  C:\Windows\System\vzanqyr.exe
  2⤵
  PID:13912
- C:\Windows\System\FgVYKHL.exe
  C:\Windows\System\FgVYKHL.exe
  2⤵
  PID:13932
- C:\Windows\System\mfnysNi.exe
  C:\Windows\System\mfnysNi.exe
  2⤵
  PID:13956
- C:\Windows\System\JpXPAWn.exe
  C:\Windows\System\JpXPAWn.exe
  2⤵
  PID:13984
- C:\Windows\System\uEJqAxs.exe
  C:\Windows\System\uEJqAxs.exe
  2⤵
  PID:14012
- C:\Windows\System\AzLdBwe.exe
  C:\Windows\System\AzLdBwe.exe
  2⤵
  PID:14044
- C:\Windows\System\NorxEJa.exe
  C:\Windows\System\NorxEJa.exe
  2⤵
  PID:14068
- C:\Windows\System\pcRjfxI.exe
  C:\Windows\System\pcRjfxI.exe
  2⤵
  PID:14104
- C:\Windows\System\UtHiSwQ.exe
  C:\Windows\System\UtHiSwQ.exe
  2⤵
  PID:14132
- C:\Windows\System\MMXqvnC.exe
  C:\Windows\System\MMXqvnC.exe
  2⤵
  PID:14160
- C:\Windows\System\vMuRaMg.exe
  C:\Windows\System\vMuRaMg.exe
  2⤵
  PID:14196
- C:\Windows\System\XpMGWTt.exe
  C:\Windows\System\XpMGWTt.exe
  2⤵
  PID:14220
- C:\Windows\System\JCZypcI.exe
  C:\Windows\System\JCZypcI.exe
  2⤵
  PID:14244
- C:\Windows\System\zSDLFWY.exe
  C:\Windows\System\zSDLFWY.exe
  2⤵
  PID:14268
- C:\Windows\System\hYpIlHr.exe
  C:\Windows\System\hYpIlHr.exe
  2⤵
  PID:14288
- C:\Windows\System\YiSEgPk.exe
  C:\Windows\System\YiSEgPk.exe
  2⤵
  PID:14312
- C:\Windows\System\mKhLTMr.exe
  C:\Windows\System\mKhLTMr.exe
  2⤵
  PID:14332
- C:\Windows\System\OXAGpRH.exe
  C:\Windows\System\OXAGpRH.exe
  2⤵
  PID:13084
- C:\Windows\System\HCduETE.exe
  C:\Windows\System\HCduETE.exe
  2⤵
  PID:13064
- C:\Windows\System\JEUmpzU.exe
  C:\Windows\System\JEUmpzU.exe
  2⤵
  PID:13336
- C:\Windows\System\nkVgFeu.exe
  C:\Windows\System\nkVgFeu.exe
  2⤵
  PID:11408
- C:\Windows\System\ypcdryi.exe
  C:\Windows\System\ypcdryi.exe
  2⤵
  PID:13468
- C:\Windows\System\UyfCgjI.exe
  C:\Windows\System\UyfCgjI.exe
  2⤵
  PID:13540
- C:\Windows\System\YVITPBP.exe
  C:\Windows\System\YVITPBP.exe
  2⤵
  PID:13512
- C:\Windows\System\GFEqphN.exe
  C:\Windows\System\GFEqphN.exe
  2⤵
  PID:13708
- C:\Windows\System\irEBtiM.exe
  C:\Windows\System\irEBtiM.exe
  2⤵
  PID:13992
- C:\Windows\System\HrqWYJm.exe
  C:\Windows\System\HrqWYJm.exe
  2⤵
  PID:14128
- C:\Windows\System\flzBbYR.exe
  C:\Windows\System\flzBbYR.exe
  2⤵
  PID:4852
- C:\Windows\System\NjvnkRi.exe
  C:\Windows\System\NjvnkRi.exe
  2⤵
  PID:14112
- C:\Windows\System\KhhlJhE.exe
  C:\Windows\System\KhhlJhE.exe
  2⤵
  PID:14284
- C:\Windows\System\eWxewkT.exe
  C:\Windows\System\eWxewkT.exe
  2⤵
  PID:14260
- C:\Windows\System\kDzbFlT.exe
  C:\Windows\System\kDzbFlT.exe
  2⤵
  PID:14328
- C:\Windows\System\LXSkKxn.exe
  C:\Windows\System\LXSkKxn.exe
  2⤵
  PID:12584
- C:\Windows\System\WnALwMs.exe
  C:\Windows\System\WnALwMs.exe
  2⤵
  PID:13492
- C:\Windows\System\pSnULJG.exe
  C:\Windows\System\pSnULJG.exe
  2⤵
  PID:13588
- C:\Windows\System\MSAWKFw.exe
  C:\Windows\System\MSAWKFw.exe
  2⤵
  PID:13796
- C:\Windows\System\BheUnZf.exe
  C:\Windows\System\BheUnZf.exe
  2⤵
  PID:13772
- C:\Windows\System\EuFikYf.exe
  C:\Windows\System\EuFikYf.exe
  2⤵
  PID:14008
- C:\Windows\System\LBeCxnw.exe
  C:\Windows\System\LBeCxnw.exe
  2⤵
  PID:13972
- C:\Windows\System\jQOCyVG.exe
  C:\Windows\System\jQOCyVG.exe
  2⤵
  PID:13980
- C:\Windows\System\UhDupeA.exe
  C:\Windows\System\UhDupeA.exe
  2⤵
  PID:13748
- C:\Windows\System\gEmHhqI.exe
  C:\Windows\System\gEmHhqI.exe
  2⤵
  PID:14172
- C:\Windows\System\QKVyzHJ.exe
  C:\Windows\System\QKVyzHJ.exe
  2⤵
  PID:13628
- C:\Windows\System\ufRhzvu.exe
  C:\Windows\System\ufRhzvu.exe
  2⤵
  PID:13776
- C:\Windows\System\WuLTXbG.exe
  C:\Windows\System\WuLTXbG.exe
  2⤵
  PID:13904
- C:\Windows\System\KdEyiLl.exe
  C:\Windows\System\KdEyiLl.exe
  2⤵
  PID:13484
- C:\Windows\System\NKnyyIJ.exe
  C:\Windows\System\NKnyyIJ.exe
  2⤵
  PID:14064
- C:\Windows\System\Ptkmkry.exe
  C:\Windows\System\Ptkmkry.exe
  2⤵
  PID:208
- C:\Windows\System\HBIPFTS.exe
  C:\Windows\System\HBIPFTS.exe
  2⤵
  PID:13780
- C:\Windows\System\MhxaWJe.exe
  C:\Windows\System\MhxaWJe.exe
  2⤵
  PID:14348
- C:\Windows\System\jpTPyZO.exe
  C:\Windows\System\jpTPyZO.exe
  2⤵
  PID:14376
- C:\Windows\System\pBhCahF.exe
  C:\Windows\System\pBhCahF.exe
  2⤵
  PID:14408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ASBElko.exe

Filesize
2.1MB

MD5
d6e41ab36ec8c26d56fc6d0496ee64dc

SHA1
c93304bc3e37b5ccf075165f90d6a65fb1254b77

SHA256
f7d86b4fe3ed91811c67d9870919a184226b1573081246074c7796dd97143db2

SHA512
ddf192294657837f276b6c8a99b27276ed0c49f45b8438a9203503ecfc1d7563b6b45ad9073620739fed2dddabcefd2f5ada8567ba4c098e6a010f42620f6590

Download Submit
C:\Windows\System\BnFGKnY.exe

Filesize
2.1MB

MD5
4a59e5c177ea6502de51984c7a585eb8

SHA1
7155339294a12c4cafb71461f621b0e1301d7198

SHA256
02e4fb6adcbbeeb8724e136ab30b38483a65879f49a662b130b1838fb2b081b9

SHA512
85deb854244d014227c9d22acfae02d5f6d983fcd7ce658228f168efe668a7607a6568acc323c2280c22eaee3ed52d8be309d0ac6141c71bf7411bbbac4ff41c

Download Submit
C:\Windows\System\EsmBogf.exe

Filesize
2.1MB

MD5
44f328893e624f30c7f06ba0c8d68101

SHA1
9d9528cea048be54af3d60cb440c043b1e061364

SHA256
0b6b3829de6e0b9b3497b1d0a44a1dedc9aae1cd5d829abe81602d751448ff0f

SHA512
418e523e78dee5c29e51c7a4b5b1d9eca0e7dfd55af5fa3156b875afd56505417030dff42c8b3733bec397b8c24e6ff338083a1e11875ddf4156481124bb0627

Download Submit
C:\Windows\System\HYEUSUV.exe

Filesize
2.1MB

MD5
d485712a055f2f452733f95f0de128a7

SHA1
ce88eebf26076b0fd29b7799b284c07cf947024a

SHA256
d5648344768a708aa16fe3e6a0d76b43d8441cc13a70b553d121e348d77387ff

SHA512
5317fbbc963111812333693144874304eca8e0d0a9badb0ef1028fbbdac521a8bb4e42fdb21506f6171a6ca8fbbb5df4df62e43a40d16c1f66efdfba23a96d28

Download Submit
C:\Windows\System\IDMJaIx.exe

Filesize
2.1MB

MD5
767104b56dbf6c22f8584b854ca5da07

SHA1
b8884262aa9575c41703832ab0c0e4ea893594e0

SHA256
27a042d6e7fed78a0b00003358a7be63ea0f5628c77b8e63bfc5838d2a8f9b44

SHA512
002feb1bf40366cbee8ad225781a202e1f0711b745ffaec84444c4bec835f54196bab83f3b6a4f4ef7ee80decb9b7136830f8416d384b3eea5c406d9ef41382d

Download Submit
C:\Windows\System\IbTohpz.exe

Filesize
2.1MB

MD5
abaad4885b7069ee7c51edc9a68dadd9

SHA1
254cd17d95055121d6356335ee4e2e3a77e87471

SHA256
7d3e582b17cb3efe2c50a81b3ae4dce4a6da774537e0670bbe009380fa425282

SHA512
1c8c3f69b59856de164d5736ff9cbc185007c5bdaba96fb77c9c504d266cee644dfa39e63fd09763d56c1da14318467d2c6956539a5e1b2f4295de0d99766843

Download Submit
C:\Windows\System\JTIBNlE.exe

Filesize
2.1MB

MD5
bf9d6de2fad0c8352edd4163c37d8274

SHA1
a41438f529d8253781a981679c81d0fd9ccbb52b

SHA256
7adfc1eb3389075aa1f4e426f0ce5cb7527a60f4b8ffcee6b9f6c0b00286fb32

SHA512
7ccba3dfb90218e7ee5521fd8885c50696d951ebeac248067d96b97eee9126ea8422c3b05925e69c23dd135613e8ccc1500f27955d50c7ffd95aa9533560ed43

Download Submit
C:\Windows\System\QMFeNSL.exe

Filesize
2.1MB

MD5
7de613d3e1510636ce50ba3d9f9d1726

SHA1
6c9b1e25ff68f3700acc05e9f834217bf823145f

SHA256
227e59ad533605e5c610696192b80f7b59886c262c0c6c0b1f332229117a9bcc

SHA512
76afd9045fab26368e928c1111d72a5e4c2655460d978b4efa04c1785808a7206cafc44566919d4b75335db6d3bb327327721e76c8ec5708a3b6ddac5b3c88fb

Download Submit
C:\Windows\System\QbvODiN.exe

Filesize
2.1MB

MD5
ad6bfdb5ce0e2c692fd4239ea7d807ba

SHA1
2325ff44cf1f3e10bb9b8bb04f7fbffb8af33cb0

SHA256
e0be5d12374ad3f4494fa6b7f26e27056ad704fbb046a354a1c497d67c8cc0c4

SHA512
c5d9a22616b13c234f0125b3af6f0b52550a09eea675bdac8f2f6530b90a3f68a262341c534524a501c161d0a0037a21d79fb0a4218ea46a303d85e9523b1f0e

Download Submit
C:\Windows\System\SOTIPgT.exe

Filesize
2.1MB

MD5
579be0f4abbd6c0f5dc2c9645f0b5a91

SHA1
fbcf93f0a1c83cca63abe62035ad9f58e5a6fe23

SHA256
1ebebf04374ceb81c7076b3870528b00f14106d135d8d76e6c51888d11b625a0

SHA512
231efe2a98b9de9548dd296f5dd47c080f14215ca28fa89250ba2c4e152bff59f43aa81cbaaaae5b6455eac2fdf7cee076b9e36f0435527ed0620ec79db32b9f

Download Submit
C:\Windows\System\SntDdRt.exe

Filesize
2.1MB

MD5
6cbbec06fef08cb4ac389c29a2b6d4bf

SHA1
b3620a0d6cd2719f7f0e74e62bcb64ec9aa037ae

SHA256
692d29bfab0eecacc2b3bddf58aa43121058be246b42bbb300ccb31c181ceb29

SHA512
07c0b123e7de9e92723d3898ca9385d91caf497d813ea8a0f538165bc802b6de32dfdce5d1cd89b460c20ccfd96696d6754f8bc7821568d95cab89ea278616a8

Download Submit
C:\Windows\System\VoRzCjn.exe

Filesize
2.1MB

MD5
40acb9e2ec5f2f80903d72292b59a16b

SHA1
8cf8fe50f4a78aa24326bc965f6c48a50ffa492f

SHA256
e67741014af5d6c17c569faa8753ec6a0041b17d70bab9da19a8783b3940e88d

SHA512
78630f8dda54a0f1b5c100131f523c1fdca5eafa15d1678dad6a0a0e59b52e55b27053708d6497417774117ebcbe1be2849f0cef7b316b50d85255a706dd8628

Download Submit
C:\Windows\System\WEqnWyH.exe

Filesize
2.1MB

MD5
36984525cdb4670f4af8928d46525a9e

SHA1
ad9b09a040e71ee6ec22d33a237b447a2ea322b6

SHA256
9e529d4683a4482b1e61494c5570096df9226fd82e649292b1b7f6c8501c6bc3

SHA512
11a5666b999ad3a7387398e6787525dd96cf69958b4b178718be457683465e72cd55922da41cdd32c425e0aa30aca292d6eb4bac150fcd9bb9441bbf37f478e2

Download Submit
C:\Windows\System\WzKgNum.exe

Filesize
2.1MB

MD5
155b0f87c8dfad985d77ed60da8d76fc

SHA1
863ed238c7ac7bf887251d0fb94bb5dbbcd5fb3d

SHA256
741def3098c9dde5b008c2229e86fedba3f1533d51db3c872ca0c1e87795e043

SHA512
4672e839babcbca620128912b5c5d241ba91a8d5794bcf1d2de3879b181a265055242fb0f2c5621cfdd250d2e2fda0c532068728566c3a13c0c1e80ec1e8d129

Download Submit
C:\Windows\System\aQQMJGF.exe

Filesize
2.1MB

MD5
cffe95536d428b72dd807171d2135402

SHA1
d088349231e1507fc37072b31ffd5ce182521984

SHA256
0ca598cc2f448d0dea2f2fd37396f4855181f35cba9f4acc0e4cb3415b9f46d2

SHA512
b54e774c60f31aaee35c056a36f178d1f393ac938c8c11ff3ea50336308db8f7d85efdd01ecae86f36c8906fd03933ab32cb057be3b3b24b39fe5137117a9109

Download Submit
C:\Windows\System\ffGQvTW.exe

Filesize
2.1MB

MD5
162c5b996388183d00b3ce11569d1032

SHA1
e5a87ccb589b6b4305b907ef47ff80672cc5f35d

SHA256
6dd35b9ca6ed059f8892f46219969697bd43515b69da5d511c347a278d7a9e65

SHA512
edffc05a7cf281f595b7bb30bedab3fc64d220da51554ff19ecf5582d477e20c0d881ccb0267802d198eb62c551b0eebdd5bc957641ab43844aac0b9252872c9

Download Submit
C:\Windows\System\gdPzzBW.exe

Filesize
2.1MB

MD5
8c96809530a6d502c9865996615206aa

SHA1
cb4037e04b61b5251831114704f4c4bd9848aa7d

SHA256
e29502faa19c15a777dca25592934aa559abfb5abdcd38991a15ca16c036ba3b

SHA512
2a5e46ab88277ee9042e663905a6feb4645c6afc69df5e7f6a5af59786414550df08d327442d8f3c9189f02c0b9a2cfbf3b0757db483390ee592663d0f8b76d5

Download Submit
C:\Windows\System\goWuCfQ.exe

Filesize
2.1MB

MD5
293804ceff2d28e235aaf6d5f5094f5d

SHA1
67d461fc04085872c830dcbb6ae6743603b56d05

SHA256
73d0929d430ddef27ced9d2864f5baacc8fb53040c35c1f8df129876e76c68fa

SHA512
cd1e133c66a22caad70f332578aeb2ea0e347253532b29fd4aaef08585448017332641fc15aa16532ef15e929b21373fc12a5f21d4bbaecabdb2a1eb7101d918

Download Submit
C:\Windows\System\iTjuRYH.exe

Filesize
2.1MB

MD5
d7560531ff445994810b5e5e856637e1

SHA1
efaba6ebd65c6d65a58574fe03201fc6f8a739e8

SHA256
9f47bfa13396c1bf6a4ca2c70c57986e9a269508fcc7c7eac2bf11da795c43a7

SHA512
690d36decde8c9b44f8f6aeb6970e111e5e21fa410515d10934a4b0f7fa73c51780319f71004034a404b834b1c53e730a869cb2fcbca9dc6cff2dfdc88ab5539

Download Submit
C:\Windows\System\kSpDyzJ.exe

Filesize
2.1MB

MD5
b45714423e152461286f4800dcdb0d23

SHA1
652081121c05a598b68baa22cc44d7ea64717cba

SHA256
78ebdd9265a9ee19d5e77ee10dfc82a631af176de32ea7a7fa6990c4549bd2de

SHA512
f47db451328da444823858a07c81081c40774af2d3258d11d3512103c6f5838d4c24af30c7041acd89f39372c13aa84a728cce04098bdba79ce3d8cf1245bf5d

Download Submit
C:\Windows\System\krWBBSs.exe

Filesize
2.1MB

MD5
8550c40d9ea14edde045e9b01e403a47

SHA1
2c2569a77d9851a6590f207d80fad86d2373ed52

SHA256
3affe3793175d96172c052b9809aca85b0ac059e11c63cce53e219863607b997

SHA512
2bfb0f51b4db658b00f922df4d228c49d73662e895c4e686a829946d94074d5a6828b87207c61c7d3359177b4e691c346b5b4c5ab09a439018fb04d44769df32

Download Submit
C:\Windows\System\lFssOSO.exe

Filesize
2.1MB

MD5
e4ca216509b0142175dcd60a08b42d65

SHA1
fab5bcacd8a406ad9ef4307ea8ef411c32a6ee37

SHA256
7c54f8f78d0ae390d0b91c60750b57e17a9eef7ea70a431e841b457576a924fe

SHA512
ebdd155b037b34fdf8c85de781225d41211d858e740137d68b25c043b61874b607ca055ce47d48b0d1209f826adad24fbc5945d50c35f37cc824c1c4559ebee8

Download Submit
C:\Windows\System\mkvzlvM.exe

Filesize
2.1MB

MD5
8f22f486306f5beebe8cc945809a434b

SHA1
20215f8d644937a7031288ba1a34db00f4242112

SHA256
daa77967325260ec4c55fca90445f28b93209f8c0ae959dc2681dfca312885f1

SHA512
2be0ee46e7466c135b05e435c8ee2f2fd0de2cc4435894aff2cbe389a4c60570853a0b0d616fb5bfb5d4f38eca062e86d94d2d0072d8501d89920ef1b6c74cb8

Download Submit
C:\Windows\System\mvPSEfR.exe

Filesize
2.1MB

MD5
31b5361e90386c52611a4403d64b9d41

SHA1
a1e010a42949ca6e20902a6da2e5ff98acfc359f

SHA256
c146b6f60ed8b60af0fdbb29dbc9aad0ffa71ed3b1f68849eb012ef97f1a4cb5

SHA512
1cfab4be50725091ea953f48e044278368eb71d4972ff79fd4d6b601f26526b0b62482d270eaa76696d447b9897a0e5eb7f0a961e271c619cfab8dfdacd50ce1

Download Submit
C:\Windows\System\qoKkeSc.exe

Filesize
2.1MB

MD5
a615e7f08a704dd165779a4f6224f785

SHA1
8449c6d8ba3fdf988a8a61add719518b81a7e715

SHA256
121c4d3121422aaf2b7b84e87925e637fbe30548a546b08a591116696eea7b96

SHA512
86f8353606719df75e4a6c5e7b4497d24ae7c1cc75d9e8559b1eb11910bde53790901fa3cd5e5a564cf3432eabf1be02fd4559521454b8c49fcc8d150718f97a

Download Submit
C:\Windows\System\rhUffwZ.exe

Filesize
2.1MB

MD5
d1fe54393bc18f8f50ddb882ebe0a443

SHA1
723e22f7d5eec040dd2d69a7f980a06c76d5c1b8

SHA256
0a12d6aebe6bce09bbc57559d5d7419bc045cdccb7f15c1e5f194d8700869ab1

SHA512
bbe75b9222f781d6d36ce2a38ccc581edd5a6736982e6775284dfa3eb6be4666cc093ad840b8bd651ff095e4d7f7f41dbebdcc768b4db4b650a5f1434c1f6317

Download Submit
C:\Windows\System\tjZdhpC.exe

Filesize
2.1MB

MD5
3e43d3675a360ed19a6682dede84d0f1

SHA1
6c0b3dd7e2fca282b8fa87f0b7dca29dd781d646

SHA256
6cca7f98d0b4b602358135ea8b7e51add14f587505f185a52af58e79700d07bd

SHA512
585bd98a2a937f0b5df42068a77a0041d3a69ee7d218d7f1b4b796fcf1e0353f7f8efedfa1483ffb970422ed9df7ff3955d085dc48f20a76792d64250d5df8e9

Download Submit
C:\Windows\System\tviZpWP.exe

Filesize
2.1MB

MD5
c5988be1443ddc39d1022163becfabb7

SHA1
1143d35b858d1e06de432d10d85f9cfaabb2c037

SHA256
cac18273375611315ac0906a2a716985c4648aabc56aac15ad20daf629a3b58e

SHA512
f125a35b2f2966fe9517e4d8d507cfd36a852a920fec49a50c6ffd0ca5b4a42e6128c33db5d5e314cc5a3d5ef3de6e040a2a8ce57ea502626a2206b4a40579e4

Download Submit
C:\Windows\System\uihhqyk.exe

Filesize
2.1MB

MD5
cf0d875d723b792eece7960fa5d138c1

SHA1
993aee11dc5979fcc131bef3c3ecc73aa678d790

SHA256
5df116ca87b25d1759c2d547b4957100998edf4e3e7a9cf9a7d9715c199a77b7

SHA512
77b4c5f9e4acb69286f7b1daa99f5d2ee8c8be3e21b0451286dcd20d42373e9c4659d209169708ce1ee59c7e4bf6735638d8e7b01b901f1b2d606afe312113cb

Download Submit
C:\Windows\System\uzlHCSy.exe

Filesize
2.1MB

MD5
c5ffb106a22a71a1b4aeddd16a27048a

SHA1
79bb5522bcb50eb2c89f5dd4ce9f1fb53c1504d7

SHA256
5a92f712bc30217d6d2b729afac5bb70397384e85adc3cf5772066b64b6aed3c

SHA512
b831d8be55df5113e7d1469a330b6d3182330342ad863844222366186c9812e7568c462c3077670b79dd6530b1fc2c5997048076bb902b3e306d3008e04d6934

Download Submit
C:\Windows\System\wtFNZri.exe

Filesize
2.1MB

MD5
323d2826935667a9f1af6aacdbeba8e3

SHA1
bfa3ecd9bfd0e0cfc308cded57c0763a95a6c456

SHA256
5ca27e629ddcda2a9d3026632320f339904e7dff6a5a2e383ed6de9fb8f1cdcb

SHA512
2e709b6f08bc667c33fde37487dd32d53e05903d4eff4f4d6e60d1e08a37512aa2d848e785040eb34f039ebf6cf6e0d2a858e4b646b2eb9791c00fce140233aa

Download Submit
C:\Windows\System\ySuJJKj.exe

Filesize
2.1MB

MD5
56cb59a833d4e7116f04a41f3faffcc6

SHA1
a2c2ccc92a26142cd124c74959e8316863bf773c

SHA256
4964f3251c51d34f6cebdb048ed3511bb85c397588ee7b6d2370943f588a938a

SHA512
b82e7f91c1e801d73d94f82b7c4bdf92fcb41276c9032377049dc18e26b0bd856e72b3842b0dfea83caae8ba6d60907df4306a55eb8c604b4378f97c80fd6dcd

Download Submit
C:\Windows\System\yrogcow.exe

Filesize
2.1MB

MD5
367ff120da9daf866614c7ea7a8cc6b6

SHA1
d5f5eccc8ff7dae72af7e834617a05992281a704

SHA256
fbde34a6bfc5f3c4bddec49c37a70496fa859dac86cbb301a736cd76de31cbed

SHA512
8b5ae1e4799dfa0f40e6ec051e2a53ad998d0d202a5fa37108be7a6ae92f86c438c20e07f8e2ae0d495ac13bddb68a20d35b445d0a1527048b1fe11e3c49bfdb

Download Submit
memory/312-2083-0x00007FF604DD0000-0x00007FF605124000-memory.dmp

Filesize
3.3MB

Download
memory/312-2070-0x00007FF604DD0000-0x00007FF605124000-memory.dmp

Filesize
3.3MB

Download
memory/312-33-0x00007FF604DD0000-0x00007FF605124000-memory.dmp

Filesize
3.3MB

Download
memory/332-2095-0x00007FF7D4210000-0x00007FF7D4564000-memory.dmp

Filesize
3.3MB

Download
memory/332-144-0x00007FF7D4210000-0x00007FF7D4564000-memory.dmp

Filesize
3.3MB

Download
memory/816-2087-0x00007FF716670000-0x00007FF7169C4000-memory.dmp

Filesize
3.3MB

Download
memory/816-150-0x00007FF716670000-0x00007FF7169C4000-memory.dmp

Filesize
3.3MB

Download
memory/892-2085-0x00007FF6B3700000-0x00007FF6B3A54000-memory.dmp

Filesize
3.3MB

Download
memory/892-148-0x00007FF6B3700000-0x00007FF6B3A54000-memory.dmp

Filesize
3.3MB

Download
memory/1084-182-0x00007FF7E3CB0000-0x00007FF7E4004000-memory.dmp

Filesize
3.3MB

Download
memory/1084-2099-0x00007FF7E3CB0000-0x00007FF7E4004000-memory.dmp

Filesize
3.3MB

Download
memory/1196-2097-0x00007FF736800000-0x00007FF736B54000-memory.dmp

Filesize
3.3MB

Download
memory/1196-153-0x00007FF736800000-0x00007FF736B54000-memory.dmp

Filesize
3.3MB

Download
memory/1576-78-0x00007FF789060000-0x00007FF7893B4000-memory.dmp

Filesize
3.3MB

Download
memory/1576-2071-0x00007FF789060000-0x00007FF7893B4000-memory.dmp

Filesize
3.3MB

Download
memory/1576-2080-0x00007FF789060000-0x00007FF7893B4000-memory.dmp

Filesize
3.3MB

Download
memory/1908-2081-0x00007FF62EFE0000-0x00007FF62F334000-memory.dmp

Filesize
3.3MB

Download
memory/1908-154-0x00007FF62EFE0000-0x00007FF62F334000-memory.dmp

Filesize
3.3MB

Download
memory/2008-149-0x00007FF65FB90000-0x00007FF65FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2008-2093-0x00007FF65FB90000-0x00007FF65FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2060-0-0x00007FF7E74A0000-0x00007FF7E77F4000-memory.dmp

Filesize
3.3MB

Download
memory/2060-2066-0x00007FF7E74A0000-0x00007FF7E77F4000-memory.dmp

Filesize
3.3MB

Download
memory/2060-1-0x0000015E70300000-0x0000015E70310000-memory.dmp

Filesize
64KB

Download
memory/2312-157-0x00007FF668050000-0x00007FF6683A4000-memory.dmp

Filesize
3.3MB

Download
memory/2312-2094-0x00007FF668050000-0x00007FF6683A4000-memory.dmp

Filesize
3.3MB

Download
memory/2660-20-0x00007FF7133B0000-0x00007FF713704000-memory.dmp

Filesize
3.3MB

Download
memory/2660-2068-0x00007FF7133B0000-0x00007FF713704000-memory.dmp

Filesize
3.3MB

Download
memory/2660-2073-0x00007FF7133B0000-0x00007FF713704000-memory.dmp

Filesize
3.3MB

Download
memory/2740-2079-0x00007FF7175C0000-0x00007FF717914000-memory.dmp

Filesize
3.3MB

Download
memory/2740-92-0x00007FF7175C0000-0x00007FF717914000-memory.dmp

Filesize
3.3MB

Download
memory/3124-2100-0x00007FF7B71D0000-0x00007FF7B7524000-memory.dmp

Filesize
3.3MB

Download
memory/3124-222-0x00007FF7B71D0000-0x00007FF7B7524000-memory.dmp

Filesize
3.3MB

Download
memory/3204-135-0x00007FF781060000-0x00007FF7813B4000-memory.dmp

Filesize
3.3MB

Download
memory/3204-2090-0x00007FF781060000-0x00007FF7813B4000-memory.dmp

Filesize
3.3MB

Download
memory/3348-28-0x00007FF714880000-0x00007FF714BD4000-memory.dmp

Filesize
3.3MB

Download
memory/3348-2069-0x00007FF714880000-0x00007FF714BD4000-memory.dmp

Filesize
3.3MB

Download
memory/3348-2082-0x00007FF714880000-0x00007FF714BD4000-memory.dmp

Filesize
3.3MB

Download
memory/3440-147-0x00007FF618680000-0x00007FF6189D4000-memory.dmp

Filesize
3.3MB

Download
memory/3440-2096-0x00007FF618680000-0x00007FF6189D4000-memory.dmp

Filesize
3.3MB

Download
memory/3484-2077-0x00007FF62AF70000-0x00007FF62B2C4000-memory.dmp

Filesize
3.3MB

Download
memory/3484-155-0x00007FF62AF70000-0x00007FF62B2C4000-memory.dmp

Filesize
3.3MB

Download
memory/3740-158-0x00007FF61C770000-0x00007FF61CAC4000-memory.dmp

Filesize
3.3MB

Download
memory/3740-2088-0x00007FF61C770000-0x00007FF61CAC4000-memory.dmp

Filesize
3.3MB

Download
memory/3828-2091-0x00007FF628CC0000-0x00007FF629014000-memory.dmp

Filesize
3.3MB

Download
memory/3828-145-0x00007FF628CC0000-0x00007FF629014000-memory.dmp

Filesize
3.3MB

Download
memory/3920-171-0x00007FF62EBD0000-0x00007FF62EF24000-memory.dmp

Filesize
3.3MB

Download
memory/3920-2098-0x00007FF62EBD0000-0x00007FF62EF24000-memory.dmp

Filesize
3.3MB

Download
memory/4276-151-0x00007FF65BF40000-0x00007FF65C294000-memory.dmp

Filesize
3.3MB

Download
memory/4276-2086-0x00007FF65BF40000-0x00007FF65C294000-memory.dmp

Filesize
3.3MB

Download
memory/4396-146-0x00007FF70E8C0000-0x00007FF70EC14000-memory.dmp

Filesize
3.3MB

Download
memory/4396-2084-0x00007FF70E8C0000-0x00007FF70EC14000-memory.dmp

Filesize
3.3MB

Download
memory/4456-2074-0x00007FF6A9C00000-0x00007FF6A9F54000-memory.dmp

Filesize
3.3MB

Download
memory/4456-36-0x00007FF6A9C00000-0x00007FF6A9F54000-memory.dmp

Filesize
3.3MB

Download
memory/4480-2072-0x00007FF67CDC0000-0x00007FF67D114000-memory.dmp

Filesize
3.3MB

Download
memory/4480-2067-0x00007FF67CDC0000-0x00007FF67D114000-memory.dmp

Filesize
3.3MB

Download
memory/4480-11-0x00007FF67CDC0000-0x00007FF67D114000-memory.dmp

Filesize
3.3MB

Download
memory/4632-2092-0x00007FF64E510000-0x00007FF64E864000-memory.dmp

Filesize
3.3MB

Download
memory/4632-156-0x00007FF64E510000-0x00007FF64E864000-memory.dmp

Filesize
3.3MB

Download
memory/4872-2075-0x00007FF656C50000-0x00007FF656FA4000-memory.dmp

Filesize
3.3MB

Download
memory/4872-128-0x00007FF656C50000-0x00007FF656FA4000-memory.dmp

Filesize
3.3MB

Download
memory/4884-152-0x00007FF6A62C0000-0x00007FF6A6614000-memory.dmp

Filesize
3.3MB

Download
memory/4884-2089-0x00007FF6A62C0000-0x00007FF6A6614000-memory.dmp

Filesize
3.3MB

Download
memory/4972-111-0x00007FF73F330000-0x00007FF73F684000-memory.dmp

Filesize
3.3MB

Download
memory/4972-2078-0x00007FF73F330000-0x00007FF73F684000-memory.dmp

Filesize
3.3MB

Download
memory/5108-2076-0x00007FF731D40000-0x00007FF732094000-memory.dmp

Filesize
3.3MB

Download
memory/5108-115-0x00007FF731D40000-0x00007FF732094000-memory.dmp

Filesize
3.3MB

Download