xmrig | a8b4423798c39eea6bff37c23d90af349d28b8522bcfeef2cc6e8031a111ea72

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2291d2a7d291570471772edb88c0c680_NEIKI.exe
Size

2.2MB
MD5

2291d2a7d291570471772edb88c0c680
SHA1

675d2af14357d78084cdbaffa7ccb044e9b5b97b
SHA256

a8b4423798c39eea6bff37c23d90af349d28b8522bcfeef2cc6e8031a111ea72
SHA512

3dddfb6f07813e428f8667fd7bfacd2203b52c476f36c9a75265817fbec6e2074b9b4b5bb0d761edeabc8c2913e310aa85cd36bca46e5cba990ff5f166ee7158
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQlqOllgK7Gabgm3+r:oemTLkNdfE0pZrQO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4492-0-0x00007FF603740000-0x00007FF603A94000-memory.dmp	xmrig
behavioral2/files/0x000b000000023b98-4.dat	xmrig
behavioral2/memory/4532-20-0x00007FF7CE040000-0x00007FF7CE394000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b9f-31.dat	xmrig
behavioral2/files/0x000a000000023ba1-34.dat	xmrig
behavioral2/files/0x000a000000023ba8-54.dat	xmrig
behavioral2/files/0x000a000000023bab-99.dat	xmrig
behavioral2/files/0x000a000000023bb2-128.dat	xmrig
behavioral2/files/0x000a000000023bae-143.dat	xmrig
behavioral2/files/0x000a000000023bb7-157.dat	xmrig
behavioral2/memory/388-161-0x00007FF6DE890000-0x00007FF6DEBE4000-memory.dmp	xmrig
behavioral2/memory/3688-167-0x00007FF7CA510000-0x00007FF7CA864000-memory.dmp	xmrig
behavioral2/memory/5048-173-0x00007FF7E09E0000-0x00007FF7E0D34000-memory.dmp	xmrig
behavioral2/memory/3088-176-0x00007FF729CB0000-0x00007FF72A004000-memory.dmp	xmrig
behavioral2/memory/2244-175-0x00007FF6EF1C0000-0x00007FF6EF514000-memory.dmp	xmrig
behavioral2/memory/2904-174-0x00007FF674D70000-0x00007FF6750C4000-memory.dmp	xmrig
behavioral2/memory/2560-172-0x00007FF624A10000-0x00007FF624D64000-memory.dmp	xmrig
behavioral2/memory/3492-171-0x00007FF7D14A0000-0x00007FF7D17F4000-memory.dmp	xmrig
behavioral2/memory/3460-170-0x00007FF705E80000-0x00007FF7061D4000-memory.dmp	xmrig
behavioral2/memory/4412-169-0x00007FF708B80000-0x00007FF708ED4000-memory.dmp	xmrig
behavioral2/memory/4912-168-0x00007FF6C8450000-0x00007FF6C87A4000-memory.dmp	xmrig
behavioral2/memory/4564-166-0x00007FF704590000-0x00007FF7048E4000-memory.dmp	xmrig
behavioral2/memory/4008-165-0x00007FF7293B0000-0x00007FF729704000-memory.dmp	xmrig
behavioral2/memory/3548-164-0x00007FF6514C0000-0x00007FF651814000-memory.dmp	xmrig
behavioral2/memory/3068-163-0x00007FF759E70000-0x00007FF75A1C4000-memory.dmp	xmrig
behavioral2/memory/2728-162-0x00007FF7B8730000-0x00007FF7B8A84000-memory.dmp	xmrig
behavioral2/memory/5100-160-0x00007FF761110000-0x00007FF761464000-memory.dmp	xmrig
behavioral2/memory/1180-159-0x00007FF780400000-0x00007FF780754000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb6-155.dat	xmrig
behavioral2/memory/316-154-0x00007FF7A2AF0000-0x00007FF7A2E44000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb5-152.dat	xmrig
behavioral2/files/0x000a000000023bb4-150.dat	xmrig
behavioral2/files/0x000a000000023bb3-148.dat	xmrig
behavioral2/memory/2308-145-0x00007FF74B0C0000-0x00007FF74B414000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb1-141.dat	xmrig
behavioral2/files/0x000a000000023bb0-139.dat	xmrig
behavioral2/memory/4108-135-0x00007FF7F2020000-0x00007FF7F2374000-memory.dmp	xmrig
behavioral2/memory/1888-134-0x00007FF7871D0000-0x00007FF787524000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bad-130.dat	xmrig
behavioral2/files/0x000a000000023bac-118.dat	xmrig
behavioral2/files/0x000a000000023baf-114.dat	xmrig
behavioral2/memory/760-113-0x00007FF697D30000-0x00007FF698084000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba5-97.dat	xmrig
behavioral2/files/0x000a000000023ba2-95.dat	xmrig
behavioral2/files/0x000a000000023ba7-93.dat	xmrig
behavioral2/files/0x000a000000023ba6-90.dat	xmrig
behavioral2/files/0x000a000000023ba0-89.dat	xmrig
behavioral2/memory/1992-82-0x00007FF7FEC30000-0x00007FF7FEF84000-memory.dmp	xmrig
behavioral2/files/0x000a000000023baa-80.dat	xmrig
behavioral2/files/0x000a000000023ba9-77.dat	xmrig
behavioral2/memory/3696-62-0x00007FF7B6560000-0x00007FF7B68B4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b9e-61.dat	xmrig
behavioral2/memory/2540-55-0x00007FF72A4F0000-0x00007FF72A844000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba3-52.dat	xmrig
behavioral2/files/0x000a000000023b9d-48.dat	xmrig
behavioral2/files/0x000a000000023ba4-65.dat	xmrig
behavioral2/memory/3000-40-0x00007FF7BFFD0000-0x00007FF7C0324000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b9c-26.dat	xmrig
behavioral2/memory/2532-8-0x00007FF62EBD0000-0x00007FF62EF24000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb8-179.dat	xmrig
behavioral2/files/0x000a000000023bb9-189.dat	xmrig
behavioral2/files/0x000b000000023b99-195.dat	xmrig
behavioral2/files/0x000a000000023bba-190.dat	xmrig
behavioral2/memory/4492-2066-0x00007FF603740000-0x00007FF603A94000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2532	eViYFRD.exe
4532	XQDeDQz.exe
3000	JDnGFpE.exe
2540	VOcuNMp.exe
3696	dTWzMwD.exe
1992	svFPzaC.exe
2560	FwYSpVl.exe
760	AJeqcNq.exe
1888	NcTBuOv.exe
4108	xZYIHad.exe
2308	bytriFp.exe
316	lFNJWYh.exe
1180	jCoADTP.exe
5048	rmTkxdR.exe
5100	IWrQWrB.exe
388	zYVrodE.exe
2728	kfOzgPk.exe
2904	PHZuBsX.exe
3068	DGbCbmC.exe
3548	FuVnxHa.exe
4008	hvFOsNA.exe
2244	hkZEEjx.exe
4564	uMpYEPZ.exe
3688	tTbUYvM.exe
4912	PbKWYwQ.exe
4412	ZElTSiB.exe
3460	KWKjInU.exe
3088	exKDIOZ.exe
3492	hfvUHiY.exe
2200	mNpEdHF.exe
452	BQDQKdP.exe
3676	IYhJnoB.exe
2688	qSXljhh.exe
3528	IcSoPLW.exe
3404	peZeHCt.exe
5024	hGsFZhC.exe
5092	bvifkrB.exe
3480	ZWbAKqc.exe
4324	IwDMZqm.exe
4264	vHKRSjw.exe
4508	KHRqCaS.exe
3220	sDIFFPy.exe
3520	NCFWqVU.exe
3852	yvqbESV.exe
2380	oLdcUfg.exe
2764	SJvNEON.exe
4916	AlnLaDQ.exe
1560	UFfyUMW.exe
2460	YYvTjDJ.exe
728	BnXmZbM.exe
776	aGxYhsq.exe
1208	wkbdOHG.exe
3900	PUpTDVC.exe
4032	ghRGQzr.exe
4552	sKMbAmH.exe
2384	IJbxOGm.exe
540	qqWaCWL.exe
2292	wqSJkVS.exe
5052	ULuwSwE.exe
1300	eUOOkrj.exe
2660	zgPfUcP.exe
3144	efVDogm.exe
3632	FHOqPlN.exe
1228	tzuopFl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4492-0-0x00007FF603740000-0x00007FF603A94000-memory.dmp	upx
behavioral2/files/0x000b000000023b98-4.dat	upx
behavioral2/memory/4532-20-0x00007FF7CE040000-0x00007FF7CE394000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-31.dat	upx
behavioral2/files/0x000a000000023ba1-34.dat	upx
behavioral2/files/0x000a000000023ba8-54.dat	upx
behavioral2/files/0x000a000000023bab-99.dat	upx
behavioral2/files/0x000a000000023bb2-128.dat	upx
behavioral2/files/0x000a000000023bae-143.dat	upx
behavioral2/files/0x000a000000023bb7-157.dat	upx
behavioral2/memory/388-161-0x00007FF6DE890000-0x00007FF6DEBE4000-memory.dmp	upx
behavioral2/memory/3688-167-0x00007FF7CA510000-0x00007FF7CA864000-memory.dmp	upx
behavioral2/memory/5048-173-0x00007FF7E09E0000-0x00007FF7E0D34000-memory.dmp	upx
behavioral2/memory/3088-176-0x00007FF729CB0000-0x00007FF72A004000-memory.dmp	upx
behavioral2/memory/2244-175-0x00007FF6EF1C0000-0x00007FF6EF514000-memory.dmp	upx
behavioral2/memory/2904-174-0x00007FF674D70000-0x00007FF6750C4000-memory.dmp	upx
behavioral2/memory/2560-172-0x00007FF624A10000-0x00007FF624D64000-memory.dmp	upx
behavioral2/memory/3492-171-0x00007FF7D14A0000-0x00007FF7D17F4000-memory.dmp	upx
behavioral2/memory/3460-170-0x00007FF705E80000-0x00007FF7061D4000-memory.dmp	upx
behavioral2/memory/4412-169-0x00007FF708B80000-0x00007FF708ED4000-memory.dmp	upx
behavioral2/memory/4912-168-0x00007FF6C8450000-0x00007FF6C87A4000-memory.dmp	upx
behavioral2/memory/4564-166-0x00007FF704590000-0x00007FF7048E4000-memory.dmp	upx
behavioral2/memory/4008-165-0x00007FF7293B0000-0x00007FF729704000-memory.dmp	upx
behavioral2/memory/3548-164-0x00007FF6514C0000-0x00007FF651814000-memory.dmp	upx
behavioral2/memory/3068-163-0x00007FF759E70000-0x00007FF75A1C4000-memory.dmp	upx
behavioral2/memory/2728-162-0x00007FF7B8730000-0x00007FF7B8A84000-memory.dmp	upx
behavioral2/memory/5100-160-0x00007FF761110000-0x00007FF761464000-memory.dmp	upx
behavioral2/memory/1180-159-0x00007FF780400000-0x00007FF780754000-memory.dmp	upx
behavioral2/files/0x000a000000023bb6-155.dat	upx
behavioral2/memory/316-154-0x00007FF7A2AF0000-0x00007FF7A2E44000-memory.dmp	upx
behavioral2/files/0x000a000000023bb5-152.dat	upx
behavioral2/files/0x000a000000023bb4-150.dat	upx
behavioral2/files/0x000a000000023bb3-148.dat	upx
behavioral2/memory/2308-145-0x00007FF74B0C0000-0x00007FF74B414000-memory.dmp	upx
behavioral2/files/0x000a000000023bb1-141.dat	upx
behavioral2/files/0x000a000000023bb0-139.dat	upx
behavioral2/memory/4108-135-0x00007FF7F2020000-0x00007FF7F2374000-memory.dmp	upx
behavioral2/memory/1888-134-0x00007FF7871D0000-0x00007FF787524000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-130.dat	upx
behavioral2/files/0x000a000000023bac-118.dat	upx
behavioral2/files/0x000a000000023baf-114.dat	upx
behavioral2/memory/760-113-0x00007FF697D30000-0x00007FF698084000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-97.dat	upx
behavioral2/files/0x000a000000023ba2-95.dat	upx
behavioral2/files/0x000a000000023ba7-93.dat	upx
behavioral2/files/0x000a000000023ba6-90.dat	upx
behavioral2/files/0x000a000000023ba0-89.dat	upx
behavioral2/memory/1992-82-0x00007FF7FEC30000-0x00007FF7FEF84000-memory.dmp	upx
behavioral2/files/0x000a000000023baa-80.dat	upx
behavioral2/files/0x000a000000023ba9-77.dat	upx
behavioral2/memory/3696-62-0x00007FF7B6560000-0x00007FF7B68B4000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-61.dat	upx
behavioral2/memory/2540-55-0x00007FF72A4F0000-0x00007FF72A844000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-52.dat	upx
behavioral2/files/0x000a000000023b9d-48.dat	upx
behavioral2/files/0x000a000000023ba4-65.dat	upx
behavioral2/memory/3000-40-0x00007FF7BFFD0000-0x00007FF7C0324000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-26.dat	upx
behavioral2/memory/2532-8-0x00007FF62EBD0000-0x00007FF62EF24000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-179.dat	upx
behavioral2/files/0x000a000000023bb9-189.dat	upx
behavioral2/files/0x000b000000023b99-195.dat	upx
behavioral2/files/0x000a000000023bba-190.dat	upx
behavioral2/memory/4492-2066-0x00007FF603740000-0x00007FF603A94000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wKicIAa.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\bKKAUPi.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\xGlpsNX.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\WKHqlkQ.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\tTbUYvM.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\LktByNw.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\JctnKOc.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\CVnURQu.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\nLvtrlR.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\bGGnXUR.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\owfzUsO.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\ULuwSwE.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\UjwjuSH.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\dUcMZVr.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\BgLYaCZ.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\KPHwrdz.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\peZeHCt.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\uCewsmE.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\FzdpVMq.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\LwybSgK.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\leFVETG.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\hYpeDZF.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\RemWrEh.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\mUAQwFK.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\lOARmaG.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\yJePhwJ.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\UMqRIYF.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\ZvYYgWU.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\DEUZeon.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\CRBfoDc.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\ZYJDarK.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\pDSipaN.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\BHcuiTN.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\PrzuCmH.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\FuminJA.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\NytuhWx.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\ykqXgKh.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\fTKQGPn.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\jVDANZN.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\HkdCCxw.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\sDIFFPy.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\hVtuYUg.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\mQtdSou.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\PvmGPCy.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\ySCMCId.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\ToYSQnP.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\ACaYkap.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\GjFdZFf.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\JJZsUva.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\DBHxshS.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\elEAbdj.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\KRkzCOC.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\sseGDhV.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\ZHAjzqS.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\tzuopFl.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\gvlDJSh.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\CpfPLLS.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\eCcDKMb.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\vZPcsEO.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\MSrLutl.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\HckykDJ.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\ixDyraq.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\cjtfXTS.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe
File created	C:\Windows\System\joOKNXD.exe	2291d2a7d291570471772edb88c0c680_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 2532	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	84
PID 4492 wrote to memory of 2532	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	84
PID 4492 wrote to memory of 4532	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	85
PID 4492 wrote to memory of 4532	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	85
PID 4492 wrote to memory of 3000	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	86
PID 4492 wrote to memory of 3000	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	86
PID 4492 wrote to memory of 2540	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	87
PID 4492 wrote to memory of 2540	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	87
PID 4492 wrote to memory of 3696	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	88
PID 4492 wrote to memory of 3696	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	88
PID 4492 wrote to memory of 1888	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	89
PID 4492 wrote to memory of 1888	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	89
PID 4492 wrote to memory of 1992	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	90
PID 4492 wrote to memory of 1992	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	90
PID 4492 wrote to memory of 316	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	91
PID 4492 wrote to memory of 316	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	91
PID 4492 wrote to memory of 2560	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	92
PID 4492 wrote to memory of 2560	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	92
PID 4492 wrote to memory of 760	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	93
PID 4492 wrote to memory of 760	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	93
PID 4492 wrote to memory of 5048	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	94
PID 4492 wrote to memory of 5048	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	94
PID 4492 wrote to memory of 4108	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	95
PID 4492 wrote to memory of 4108	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	95
PID 4492 wrote to memory of 2308	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	96
PID 4492 wrote to memory of 2308	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	96
PID 4492 wrote to memory of 1180	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	97
PID 4492 wrote to memory of 1180	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	97
PID 4492 wrote to memory of 5100	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	98
PID 4492 wrote to memory of 5100	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	98
PID 4492 wrote to memory of 388	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	99
PID 4492 wrote to memory of 388	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	99
PID 4492 wrote to memory of 2728	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	100
PID 4492 wrote to memory of 2728	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	100
PID 4492 wrote to memory of 2904	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	101
PID 4492 wrote to memory of 2904	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	101
PID 4492 wrote to memory of 3068	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	102
PID 4492 wrote to memory of 3068	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	102
PID 4492 wrote to memory of 3548	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	103
PID 4492 wrote to memory of 3548	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	103
PID 4492 wrote to memory of 4008	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	104
PID 4492 wrote to memory of 4008	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	104
PID 4492 wrote to memory of 2244	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	105
PID 4492 wrote to memory of 2244	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	105
PID 4492 wrote to memory of 4564	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	106
PID 4492 wrote to memory of 4564	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	106
PID 4492 wrote to memory of 3688	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	107
PID 4492 wrote to memory of 3688	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	107
PID 4492 wrote to memory of 4912	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	108
PID 4492 wrote to memory of 4912	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	108
PID 4492 wrote to memory of 4412	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	109
PID 4492 wrote to memory of 4412	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	109
PID 4492 wrote to memory of 3460	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	110
PID 4492 wrote to memory of 3460	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	110
PID 4492 wrote to memory of 3088	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	111
PID 4492 wrote to memory of 3088	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	111
PID 4492 wrote to memory of 3492	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	112
PID 4492 wrote to memory of 3492	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	112
PID 4492 wrote to memory of 2200	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	113
PID 4492 wrote to memory of 2200	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	113
PID 4492 wrote to memory of 452	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	114
PID 4492 wrote to memory of 452	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	114
PID 4492 wrote to memory of 3676	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	115
PID 4492 wrote to memory of 3676	4492	2291d2a7d291570471772edb88c0c680_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\2291d2a7d291570471772edb88c0c680_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\2291d2a7d291570471772edb88c0c680_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\System\eViYFRD.exe
  C:\Windows\System\eViYFRD.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\XQDeDQz.exe
  C:\Windows\System\XQDeDQz.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\JDnGFpE.exe
  C:\Windows\System\JDnGFpE.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\VOcuNMp.exe
  C:\Windows\System\VOcuNMp.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\dTWzMwD.exe
  C:\Windows\System\dTWzMwD.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\NcTBuOv.exe
  C:\Windows\System\NcTBuOv.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\svFPzaC.exe
  C:\Windows\System\svFPzaC.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\lFNJWYh.exe
  C:\Windows\System\lFNJWYh.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\FwYSpVl.exe
  C:\Windows\System\FwYSpVl.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\AJeqcNq.exe
  C:\Windows\System\AJeqcNq.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\rmTkxdR.exe
  C:\Windows\System\rmTkxdR.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\xZYIHad.exe
  C:\Windows\System\xZYIHad.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\bytriFp.exe
  C:\Windows\System\bytriFp.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\jCoADTP.exe
  C:\Windows\System\jCoADTP.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\IWrQWrB.exe
  C:\Windows\System\IWrQWrB.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\zYVrodE.exe
  C:\Windows\System\zYVrodE.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\kfOzgPk.exe
  C:\Windows\System\kfOzgPk.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\PHZuBsX.exe
  C:\Windows\System\PHZuBsX.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\DGbCbmC.exe
  C:\Windows\System\DGbCbmC.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\FuVnxHa.exe
  C:\Windows\System\FuVnxHa.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\hvFOsNA.exe
  C:\Windows\System\hvFOsNA.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\hkZEEjx.exe
  C:\Windows\System\hkZEEjx.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\uMpYEPZ.exe
  C:\Windows\System\uMpYEPZ.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\tTbUYvM.exe
  C:\Windows\System\tTbUYvM.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\PbKWYwQ.exe
  C:\Windows\System\PbKWYwQ.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\ZElTSiB.exe
  C:\Windows\System\ZElTSiB.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\KWKjInU.exe
  C:\Windows\System\KWKjInU.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\exKDIOZ.exe
  C:\Windows\System\exKDIOZ.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\hfvUHiY.exe
  C:\Windows\System\hfvUHiY.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\mNpEdHF.exe
  C:\Windows\System\mNpEdHF.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\BQDQKdP.exe
  C:\Windows\System\BQDQKdP.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\IYhJnoB.exe
  C:\Windows\System\IYhJnoB.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\qSXljhh.exe
  C:\Windows\System\qSXljhh.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\IcSoPLW.exe
  C:\Windows\System\IcSoPLW.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\peZeHCt.exe
  C:\Windows\System\peZeHCt.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\bvifkrB.exe
  C:\Windows\System\bvifkrB.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\hGsFZhC.exe
  C:\Windows\System\hGsFZhC.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\IwDMZqm.exe
  C:\Windows\System\IwDMZqm.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\ZWbAKqc.exe
  C:\Windows\System\ZWbAKqc.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\vHKRSjw.exe
  C:\Windows\System\vHKRSjw.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\KHRqCaS.exe
  C:\Windows\System\KHRqCaS.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\sDIFFPy.exe
  C:\Windows\System\sDIFFPy.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\NCFWqVU.exe
  C:\Windows\System\NCFWqVU.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\yvqbESV.exe
  C:\Windows\System\yvqbESV.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\oLdcUfg.exe
  C:\Windows\System\oLdcUfg.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\SJvNEON.exe
  C:\Windows\System\SJvNEON.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\AlnLaDQ.exe
  C:\Windows\System\AlnLaDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\UFfyUMW.exe
  C:\Windows\System\UFfyUMW.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\YYvTjDJ.exe
  C:\Windows\System\YYvTjDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\BnXmZbM.exe
  C:\Windows\System\BnXmZbM.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\aGxYhsq.exe
  C:\Windows\System\aGxYhsq.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\wkbdOHG.exe
  C:\Windows\System\wkbdOHG.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\PUpTDVC.exe
  C:\Windows\System\PUpTDVC.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\ghRGQzr.exe
  C:\Windows\System\ghRGQzr.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\sKMbAmH.exe
  C:\Windows\System\sKMbAmH.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\IJbxOGm.exe
  C:\Windows\System\IJbxOGm.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\qqWaCWL.exe
  C:\Windows\System\qqWaCWL.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\wqSJkVS.exe
  C:\Windows\System\wqSJkVS.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\ULuwSwE.exe
  C:\Windows\System\ULuwSwE.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\eUOOkrj.exe
  C:\Windows\System\eUOOkrj.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\zgPfUcP.exe
  C:\Windows\System\zgPfUcP.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\efVDogm.exe
  C:\Windows\System\efVDogm.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\FHOqPlN.exe
  C:\Windows\System\FHOqPlN.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\tzuopFl.exe
  C:\Windows\System\tzuopFl.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\vgyVged.exe
  C:\Windows\System\vgyVged.exe
  2⤵
  PID:2092
- C:\Windows\System\gZcXizL.exe
  C:\Windows\System\gZcXizL.exe
  2⤵
  PID:436
- C:\Windows\System\BGWCXAE.exe
  C:\Windows\System\BGWCXAE.exe
  2⤵
  PID:4864
- C:\Windows\System\ywsoGbA.exe
  C:\Windows\System\ywsoGbA.exe
  2⤵
  PID:2072
- C:\Windows\System\oGgqDUm.exe
  C:\Windows\System\oGgqDUm.exe
  2⤵
  PID:1432
- C:\Windows\System\UKMbDgr.exe
  C:\Windows\System\UKMbDgr.exe
  2⤵
  PID:4384
- C:\Windows\System\nkJcrnc.exe
  C:\Windows\System\nkJcrnc.exe
  2⤵
  PID:2084
- C:\Windows\System\aBIjCiD.exe
  C:\Windows\System\aBIjCiD.exe
  2⤵
  PID:4944
- C:\Windows\System\ZvYYgWU.exe
  C:\Windows\System\ZvYYgWU.exe
  2⤵
  PID:2636
- C:\Windows\System\kiHqZMZ.exe
  C:\Windows\System\kiHqZMZ.exe
  2⤵
  PID:2672
- C:\Windows\System\uCewsmE.exe
  C:\Windows\System\uCewsmE.exe
  2⤵
  PID:3588
- C:\Windows\System\sRYxkKU.exe
  C:\Windows\System\sRYxkKU.exe
  2⤵
  PID:2404
- C:\Windows\System\Vuiatqy.exe
  C:\Windows\System\Vuiatqy.exe
  2⤵
  PID:1140
- C:\Windows\System\TKliLHf.exe
  C:\Windows\System\TKliLHf.exe
  2⤵
  PID:2520
- C:\Windows\System\ACaYkap.exe
  C:\Windows\System\ACaYkap.exe
  2⤵
  PID:4372
- C:\Windows\System\BsFfDTj.exe
  C:\Windows\System\BsFfDTj.exe
  2⤵
  PID:456
- C:\Windows\System\fIvhIbz.exe
  C:\Windows\System\fIvhIbz.exe
  2⤵
  PID:3440
- C:\Windows\System\IGfhAFm.exe
  C:\Windows\System\IGfhAFm.exe
  2⤵
  PID:1956
- C:\Windows\System\Wddxvmy.exe
  C:\Windows\System\Wddxvmy.exe
  2⤵
  PID:1468
- C:\Windows\System\iBpxsiQ.exe
  C:\Windows\System\iBpxsiQ.exe
  2⤵
  PID:3396
- C:\Windows\System\tQPulfW.exe
  C:\Windows\System\tQPulfW.exe
  2⤵
  PID:5072
- C:\Windows\System\qIsbOzm.exe
  C:\Windows\System\qIsbOzm.exe
  2⤵
  PID:3864
- C:\Windows\System\INIiMLB.exe
  C:\Windows\System\INIiMLB.exe
  2⤵
  PID:2120
- C:\Windows\System\CpfPLLS.exe
  C:\Windows\System\CpfPLLS.exe
  2⤵
  PID:2612
- C:\Windows\System\WFCWtkk.exe
  C:\Windows\System\WFCWtkk.exe
  2⤵
  PID:1892
- C:\Windows\System\rMNffFY.exe
  C:\Windows\System\rMNffFY.exe
  2⤵
  PID:4584
- C:\Windows\System\HOfGkIT.exe
  C:\Windows\System\HOfGkIT.exe
  2⤵
  PID:3168
- C:\Windows\System\cgNSCil.exe
  C:\Windows\System\cgNSCil.exe
  2⤵
  PID:2312
- C:\Windows\System\AtZdNGR.exe
  C:\Windows\System\AtZdNGR.exe
  2⤵
  PID:5148
- C:\Windows\System\ZNhpzKK.exe
  C:\Windows\System\ZNhpzKK.exe
  2⤵
  PID:5168
- C:\Windows\System\uantMuz.exe
  C:\Windows\System\uantMuz.exe
  2⤵
  PID:5196
- C:\Windows\System\ZxieALv.exe
  C:\Windows\System\ZxieALv.exe
  2⤵
  PID:5224
- C:\Windows\System\FzdpVMq.exe
  C:\Windows\System\FzdpVMq.exe
  2⤵
  PID:5252
- C:\Windows\System\bwPrfFK.exe
  C:\Windows\System\bwPrfFK.exe
  2⤵
  PID:5268
- C:\Windows\System\ssgSagp.exe
  C:\Windows\System\ssgSagp.exe
  2⤵
  PID:5296
- C:\Windows\System\iLEVYpr.exe
  C:\Windows\System\iLEVYpr.exe
  2⤵
  PID:5324
- C:\Windows\System\WqYLCHo.exe
  C:\Windows\System\WqYLCHo.exe
  2⤵
  PID:5356
- C:\Windows\System\UATCBap.exe
  C:\Windows\System\UATCBap.exe
  2⤵
  PID:5384
- C:\Windows\System\UzjXiQD.exe
  C:\Windows\System\UzjXiQD.exe
  2⤵
  PID:5420
- C:\Windows\System\iSgPeVf.exe
  C:\Windows\System\iSgPeVf.exe
  2⤵
  PID:5448
- C:\Windows\System\aVKOOwO.exe
  C:\Windows\System\aVKOOwO.exe
  2⤵
  PID:5484
- C:\Windows\System\dEDhAfz.exe
  C:\Windows\System\dEDhAfz.exe
  2⤵
  PID:5504
- C:\Windows\System\ibquQkl.exe
  C:\Windows\System\ibquQkl.exe
  2⤵
  PID:5528
- C:\Windows\System\lvTCWni.exe
  C:\Windows\System\lvTCWni.exe
  2⤵
  PID:5560
- C:\Windows\System\xqyRwvm.exe
  C:\Windows\System\xqyRwvm.exe
  2⤵
  PID:5588
- C:\Windows\System\qehlyLB.exe
  C:\Windows\System\qehlyLB.exe
  2⤵
  PID:5616
- C:\Windows\System\eCcDKMb.exe
  C:\Windows\System\eCcDKMb.exe
  2⤵
  PID:5640
- C:\Windows\System\HipFtkY.exe
  C:\Windows\System\HipFtkY.exe
  2⤵
  PID:5672
- C:\Windows\System\ZffdClX.exe
  C:\Windows\System\ZffdClX.exe
  2⤵
  PID:5700
- C:\Windows\System\hVtuYUg.exe
  C:\Windows\System\hVtuYUg.exe
  2⤵
  PID:5716
- C:\Windows\System\LYvgIoj.exe
  C:\Windows\System\LYvgIoj.exe
  2⤵
  PID:5748
- C:\Windows\System\jIyrYFv.exe
  C:\Windows\System\jIyrYFv.exe
  2⤵
  PID:5784
- C:\Windows\System\HqxiGFa.exe
  C:\Windows\System\HqxiGFa.exe
  2⤵
  PID:5816
- C:\Windows\System\yGjeBuH.exe
  C:\Windows\System\yGjeBuH.exe
  2⤵
  PID:5840
- C:\Windows\System\CijPdvM.exe
  C:\Windows\System\CijPdvM.exe
  2⤵
  PID:5868
- C:\Windows\System\QvKOViU.exe
  C:\Windows\System\QvKOViU.exe
  2⤵
  PID:5884
- C:\Windows\System\dbWMLDk.exe
  C:\Windows\System\dbWMLDk.exe
  2⤵
  PID:5920
- C:\Windows\System\rLrsrCA.exe
  C:\Windows\System\rLrsrCA.exe
  2⤵
  PID:5940
- C:\Windows\System\iroGoXh.exe
  C:\Windows\System\iroGoXh.exe
  2⤵
  PID:5976
- C:\Windows\System\gmCnfvh.exe
  C:\Windows\System\gmCnfvh.exe
  2⤵
  PID:6012
- C:\Windows\System\JRwxOUk.exe
  C:\Windows\System\JRwxOUk.exe
  2⤵
  PID:6048
- C:\Windows\System\FuminJA.exe
  C:\Windows\System\FuminJA.exe
  2⤵
  PID:6080
- C:\Windows\System\FuxToBx.exe
  C:\Windows\System\FuxToBx.exe
  2⤵
  PID:6104
- C:\Windows\System\QoAAQiW.exe
  C:\Windows\System\QoAAQiW.exe
  2⤵
  PID:6132
- C:\Windows\System\QfKGasT.exe
  C:\Windows\System\QfKGasT.exe
  2⤵
  PID:964
- C:\Windows\System\WnVHylc.exe
  C:\Windows\System\WnVHylc.exe
  2⤵
  PID:5192
- C:\Windows\System\fbpsOTE.exe
  C:\Windows\System\fbpsOTE.exe
  2⤵
  PID:5264
- C:\Windows\System\kqRLhwy.exe
  C:\Windows\System\kqRLhwy.exe
  2⤵
  PID:5288
- C:\Windows\System\mPWgvsX.exe
  C:\Windows\System\mPWgvsX.exe
  2⤵
  PID:5380
- C:\Windows\System\iXCmXan.exe
  C:\Windows\System\iXCmXan.exe
  2⤵
  PID:5460
- C:\Windows\System\SmZxoNp.exe
  C:\Windows\System\SmZxoNp.exe
  2⤵
  PID:5512
- C:\Windows\System\cvyuajX.exe
  C:\Windows\System\cvyuajX.exe
  2⤵
  PID:5600
- C:\Windows\System\dayelUB.exe
  C:\Windows\System\dayelUB.exe
  2⤵
  PID:5648
- C:\Windows\System\CwYCeeV.exe
  C:\Windows\System\CwYCeeV.exe
  2⤵
  PID:5728
- C:\Windows\System\UENPQOr.exe
  C:\Windows\System\UENPQOr.exe
  2⤵
  PID:5800
- C:\Windows\System\LwybSgK.exe
  C:\Windows\System\LwybSgK.exe
  2⤵
  PID:5880
- C:\Windows\System\lzSAkXR.exe
  C:\Windows\System\lzSAkXR.exe
  2⤵
  PID:5952
- C:\Windows\System\cXvBWFd.exe
  C:\Windows\System\cXvBWFd.exe
  2⤵
  PID:5960
- C:\Windows\System\MhVkDyE.exe
  C:\Windows\System\MhVkDyE.exe
  2⤵
  PID:5996
- C:\Windows\System\thJqSvw.exe
  C:\Windows\System\thJqSvw.exe
  2⤵
  PID:6044
- C:\Windows\System\yJePhwJ.exe
  C:\Windows\System\yJePhwJ.exe
  2⤵
  PID:6096
- C:\Windows\System\TPYHDjq.exe
  C:\Windows\System\TPYHDjq.exe
  2⤵
  PID:5164
- C:\Windows\System\imziGyY.exe
  C:\Windows\System\imziGyY.exe
  2⤵
  PID:5412
- C:\Windows\System\fPuDqXt.exe
  C:\Windows\System\fPuDqXt.exe
  2⤵
  PID:5624
- C:\Windows\System\CKIEHBC.exe
  C:\Windows\System\CKIEHBC.exe
  2⤵
  PID:5848
- C:\Windows\System\KUdviom.exe
  C:\Windows\System\KUdviom.exe
  2⤵
  PID:5916
- C:\Windows\System\qdAiHhI.exe
  C:\Windows\System\qdAiHhI.exe
  2⤵
  PID:2828
- C:\Windows\System\VOitybN.exe
  C:\Windows\System\VOitybN.exe
  2⤵
  PID:5316
- C:\Windows\System\FCCKoav.exe
  C:\Windows\System\FCCKoav.exe
  2⤵
  PID:5796
- C:\Windows\System\TiLhAPc.exe
  C:\Windows\System\TiLhAPc.exe
  2⤵
  PID:5136
- C:\Windows\System\arPgLIH.exe
  C:\Windows\System\arPgLIH.exe
  2⤵
  PID:6088
- C:\Windows\System\SSSaeLJ.exe
  C:\Windows\System\SSSaeLJ.exe
  2⤵
  PID:6156
- C:\Windows\System\YZCAgZj.exe
  C:\Windows\System\YZCAgZj.exe
  2⤵
  PID:6184
- C:\Windows\System\ZgKajvm.exe
  C:\Windows\System\ZgKajvm.exe
  2⤵
  PID:6220
- C:\Windows\System\krlqoFH.exe
  C:\Windows\System\krlqoFH.exe
  2⤵
  PID:6236
- C:\Windows\System\pUtqZeO.exe
  C:\Windows\System\pUtqZeO.exe
  2⤵
  PID:6272
- C:\Windows\System\UjwjuSH.exe
  C:\Windows\System\UjwjuSH.exe
  2⤵
  PID:6292
- C:\Windows\System\gxPkbTb.exe
  C:\Windows\System\gxPkbTb.exe
  2⤵
  PID:6332
- C:\Windows\System\prqSYXC.exe
  C:\Windows\System\prqSYXC.exe
  2⤵
  PID:6360
- C:\Windows\System\SHzQuYt.exe
  C:\Windows\System\SHzQuYt.exe
  2⤵
  PID:6392
- C:\Windows\System\NMzYcNg.exe
  C:\Windows\System\NMzYcNg.exe
  2⤵
  PID:6420
- C:\Windows\System\lsEJgAk.exe
  C:\Windows\System\lsEJgAk.exe
  2⤵
  PID:6448
- C:\Windows\System\HckykDJ.exe
  C:\Windows\System\HckykDJ.exe
  2⤵
  PID:6476
- C:\Windows\System\UnmQuSA.exe
  C:\Windows\System\UnmQuSA.exe
  2⤵
  PID:6500
- C:\Windows\System\WYkndXR.exe
  C:\Windows\System\WYkndXR.exe
  2⤵
  PID:6532
- C:\Windows\System\IfJMvcK.exe
  C:\Windows\System\IfJMvcK.exe
  2⤵
  PID:6560
- C:\Windows\System\YeSANaD.exe
  C:\Windows\System\YeSANaD.exe
  2⤵
  PID:6592
- C:\Windows\System\NytuhWx.exe
  C:\Windows\System\NytuhWx.exe
  2⤵
  PID:6616
- C:\Windows\System\pKKMTQO.exe
  C:\Windows\System\pKKMTQO.exe
  2⤵
  PID:6636
- C:\Windows\System\nKbjGtl.exe
  C:\Windows\System\nKbjGtl.exe
  2⤵
  PID:6672
- C:\Windows\System\ELGQBQq.exe
  C:\Windows\System\ELGQBQq.exe
  2⤵
  PID:6688
- C:\Windows\System\gMmIyGn.exe
  C:\Windows\System\gMmIyGn.exe
  2⤵
  PID:6728
- C:\Windows\System\ORpbnlt.exe
  C:\Windows\System\ORpbnlt.exe
  2⤵
  PID:6756
- C:\Windows\System\LktByNw.exe
  C:\Windows\System\LktByNw.exe
  2⤵
  PID:6784
- C:\Windows\System\nQcvcbC.exe
  C:\Windows\System\nQcvcbC.exe
  2⤵
  PID:6808
- C:\Windows\System\ycNhVQc.exe
  C:\Windows\System\ycNhVQc.exe
  2⤵
  PID:6840
- C:\Windows\System\hpYEGwc.exe
  C:\Windows\System\hpYEGwc.exe
  2⤵
  PID:6856
- C:\Windows\System\xAauEmD.exe
  C:\Windows\System\xAauEmD.exe
  2⤵
  PID:6892
- C:\Windows\System\YGfltGU.exe
  C:\Windows\System\YGfltGU.exe
  2⤵
  PID:6932
- C:\Windows\System\GaFIIms.exe
  C:\Windows\System\GaFIIms.exe
  2⤵
  PID:6952
- C:\Windows\System\xRrrndt.exe
  C:\Windows\System\xRrrndt.exe
  2⤵
  PID:6980
- C:\Windows\System\MSXuvKn.exe
  C:\Windows\System\MSXuvKn.exe
  2⤵
  PID:7012
- C:\Windows\System\mGmHBVD.exe
  C:\Windows\System\mGmHBVD.exe
  2⤵
  PID:7040
- C:\Windows\System\HsbeVxe.exe
  C:\Windows\System\HsbeVxe.exe
  2⤵
  PID:7072
- C:\Windows\System\RgpSpPv.exe
  C:\Windows\System\RgpSpPv.exe
  2⤵
  PID:7096
- C:\Windows\System\AZghhfm.exe
  C:\Windows\System\AZghhfm.exe
  2⤵
  PID:7124
- C:\Windows\System\BNNVnyJ.exe
  C:\Windows\System\BNNVnyJ.exe
  2⤵
  PID:7156
- C:\Windows\System\IMFDPzr.exe
  C:\Windows\System\IMFDPzr.exe
  2⤵
  PID:6172
- C:\Windows\System\pRQQZkT.exe
  C:\Windows\System\pRQQZkT.exe
  2⤵
  PID:6228
- C:\Windows\System\KLhJKLB.exe
  C:\Windows\System\KLhJKLB.exe
  2⤵
  PID:6284
- C:\Windows\System\jRjcNxK.exe
  C:\Windows\System\jRjcNxK.exe
  2⤵
  PID:6372
- C:\Windows\System\JUnOaCQ.exe
  C:\Windows\System\JUnOaCQ.exe
  2⤵
  PID:6460
- C:\Windows\System\GuDcuzZ.exe
  C:\Windows\System\GuDcuzZ.exe
  2⤵
  PID:6508
- C:\Windows\System\JxWNhrl.exe
  C:\Windows\System\JxWNhrl.exe
  2⤵
  PID:6580
- C:\Windows\System\dDHeLxV.exe
  C:\Windows\System\dDHeLxV.exe
  2⤵
  PID:6632
- C:\Windows\System\xCfRKEM.exe
  C:\Windows\System\xCfRKEM.exe
  2⤵
  PID:6712
- C:\Windows\System\tEEVBMB.exe
  C:\Windows\System\tEEVBMB.exe
  2⤵
  PID:6776
- C:\Windows\System\HMkAjoS.exe
  C:\Windows\System\HMkAjoS.exe
  2⤵
  PID:6852
- C:\Windows\System\PoOhTWI.exe
  C:\Windows\System\PoOhTWI.exe
  2⤵
  PID:6908
- C:\Windows\System\PfQlbor.exe
  C:\Windows\System\PfQlbor.exe
  2⤵
  PID:6940
- C:\Windows\System\cGyIgHJ.exe
  C:\Windows\System\cGyIgHJ.exe
  2⤵
  PID:7024
- C:\Windows\System\ITahaIq.exe
  C:\Windows\System\ITahaIq.exe
  2⤵
  PID:7116
- C:\Windows\System\ckCNUtO.exe
  C:\Windows\System\ckCNUtO.exe
  2⤵
  PID:7164
- C:\Windows\System\vEDnNUO.exe
  C:\Windows\System\vEDnNUO.exe
  2⤵
  PID:6216
- C:\Windows\System\aNGupae.exe
  C:\Windows\System\aNGupae.exe
  2⤵
  PID:6356
- C:\Windows\System\MJpXWDT.exe
  C:\Windows\System\MJpXWDT.exe
  2⤵
  PID:6572
- C:\Windows\System\NFDWyFn.exe
  C:\Windows\System\NFDWyFn.exe
  2⤵
  PID:6644
- C:\Windows\System\QtEFyRZ.exe
  C:\Windows\System\QtEFyRZ.exe
  2⤵
  PID:6768
- C:\Windows\System\leFVETG.exe
  C:\Windows\System\leFVETG.exe
  2⤵
  PID:6884
- C:\Windows\System\DHyzcfJ.exe
  C:\Windows\System\DHyzcfJ.exe
  2⤵
  PID:7088
- C:\Windows\System\cJZOAZx.exe
  C:\Windows\System\cJZOAZx.exe
  2⤵
  PID:6488
- C:\Windows\System\SLnJZDx.exe
  C:\Windows\System\SLnJZDx.exe
  2⤵
  PID:6848
- C:\Windows\System\ovIbJNi.exe
  C:\Windows\System\ovIbJNi.exe
  2⤵
  PID:6472
- C:\Windows\System\NRhKCle.exe
  C:\Windows\System\NRhKCle.exe
  2⤵
  PID:7144
- C:\Windows\System\bGKIPIn.exe
  C:\Windows\System\bGKIPIn.exe
  2⤵
  PID:7192
- C:\Windows\System\hoLWgqQ.exe
  C:\Windows\System\hoLWgqQ.exe
  2⤵
  PID:7224
- C:\Windows\System\QWWKSQf.exe
  C:\Windows\System\QWWKSQf.exe
  2⤵
  PID:7248
- C:\Windows\System\gvlDJSh.exe
  C:\Windows\System\gvlDJSh.exe
  2⤵
  PID:7276
- C:\Windows\System\iTAsexO.exe
  C:\Windows\System\iTAsexO.exe
  2⤵
  PID:7304
- C:\Windows\System\CwfsyJm.exe
  C:\Windows\System\CwfsyJm.exe
  2⤵
  PID:7332
- C:\Windows\System\IwYBcBX.exe
  C:\Windows\System\IwYBcBX.exe
  2⤵
  PID:7360
- C:\Windows\System\wcCATBG.exe
  C:\Windows\System\wcCATBG.exe
  2⤵
  PID:7392
- C:\Windows\System\AowfrdI.exe
  C:\Windows\System\AowfrdI.exe
  2⤵
  PID:7420
- C:\Windows\System\ZvQsKZi.exe
  C:\Windows\System\ZvQsKZi.exe
  2⤵
  PID:7440
- C:\Windows\System\qUJkmug.exe
  C:\Windows\System\qUJkmug.exe
  2⤵
  PID:7476
- C:\Windows\System\GDaJlnW.exe
  C:\Windows\System\GDaJlnW.exe
  2⤵
  PID:7492
- C:\Windows\System\TFCqRcL.exe
  C:\Windows\System\TFCqRcL.exe
  2⤵
  PID:7512
- C:\Windows\System\btSsiKN.exe
  C:\Windows\System\btSsiKN.exe
  2⤵
  PID:7536
- C:\Windows\System\CZDIlwn.exe
  C:\Windows\System\CZDIlwn.exe
  2⤵
  PID:7568
- C:\Windows\System\isPGyvK.exe
  C:\Windows\System\isPGyvK.exe
  2⤵
  PID:7596
- C:\Windows\System\VmFRnwa.exe
  C:\Windows\System\VmFRnwa.exe
  2⤵
  PID:7628
- C:\Windows\System\IxgzHyk.exe
  C:\Windows\System\IxgzHyk.exe
  2⤵
  PID:7660
- C:\Windows\System\mQtdSou.exe
  C:\Windows\System\mQtdSou.exe
  2⤵
  PID:7700
- C:\Windows\System\XWrhPdo.exe
  C:\Windows\System\XWrhPdo.exe
  2⤵
  PID:7732
- C:\Windows\System\GjFdZFf.exe
  C:\Windows\System\GjFdZFf.exe
  2⤵
  PID:7748
- C:\Windows\System\DDOcDNU.exe
  C:\Windows\System\DDOcDNU.exe
  2⤵
  PID:7784
- C:\Windows\System\AvfySWJ.exe
  C:\Windows\System\AvfySWJ.exe
  2⤵
  PID:7812
- C:\Windows\System\jdtnZyy.exe
  C:\Windows\System\jdtnZyy.exe
  2⤵
  PID:7844
- C:\Windows\System\dxshoOV.exe
  C:\Windows\System\dxshoOV.exe
  2⤵
  PID:7868
- C:\Windows\System\SEyAgaE.exe
  C:\Windows\System\SEyAgaE.exe
  2⤵
  PID:7888
- C:\Windows\System\qaeMqID.exe
  C:\Windows\System\qaeMqID.exe
  2⤵
  PID:7912
- C:\Windows\System\UZCLRHd.exe
  C:\Windows\System\UZCLRHd.exe
  2⤵
  PID:7940
- C:\Windows\System\SiFvXyz.exe
  C:\Windows\System\SiFvXyz.exe
  2⤵
  PID:7968
- C:\Windows\System\eiCKIuh.exe
  C:\Windows\System\eiCKIuh.exe
  2⤵
  PID:8012
- C:\Windows\System\olpPxSd.exe
  C:\Windows\System\olpPxSd.exe
  2⤵
  PID:8044
- C:\Windows\System\TiGiaBP.exe
  C:\Windows\System\TiGiaBP.exe
  2⤵
  PID:8068
- C:\Windows\System\wKHXjuH.exe
  C:\Windows\System\wKHXjuH.exe
  2⤵
  PID:8084
- C:\Windows\System\pKxsklj.exe
  C:\Windows\System\pKxsklj.exe
  2⤵
  PID:8100
- C:\Windows\System\vcBZLGb.exe
  C:\Windows\System\vcBZLGb.exe
  2⤵
  PID:8116
- C:\Windows\System\oIbZsaz.exe
  C:\Windows\System\oIbZsaz.exe
  2⤵
  PID:8132
- C:\Windows\System\BPXAsOT.exe
  C:\Windows\System\BPXAsOT.exe
  2⤵
  PID:8156
- C:\Windows\System\nBJYGnu.exe
  C:\Windows\System\nBJYGnu.exe
  2⤵
  PID:8188
- C:\Windows\System\PvmGPCy.exe
  C:\Windows\System\PvmGPCy.exe
  2⤵
  PID:7216
- C:\Windows\System\VBvzSwR.exe
  C:\Windows\System\VBvzSwR.exe
  2⤵
  PID:7296
- C:\Windows\System\ZBYHcfd.exe
  C:\Windows\System\ZBYHcfd.exe
  2⤵
  PID:7368
- C:\Windows\System\yKCqidA.exe
  C:\Windows\System\yKCqidA.exe
  2⤵
  PID:7464
- C:\Windows\System\QOzruGk.exe
  C:\Windows\System\QOzruGk.exe
  2⤵
  PID:7616
- C:\Windows\System\kiGRpFH.exe
  C:\Windows\System\kiGRpFH.exe
  2⤵
  PID:7648
- C:\Windows\System\sXSJhzI.exe
  C:\Windows\System\sXSJhzI.exe
  2⤵
  PID:7712
- C:\Windows\System\wvbaaQG.exe
  C:\Windows\System\wvbaaQG.exe
  2⤵
  PID:7780
- C:\Windows\System\tNsFaGZ.exe
  C:\Windows\System\tNsFaGZ.exe
  2⤵
  PID:7836
- C:\Windows\System\Ceapwmp.exe
  C:\Windows\System\Ceapwmp.exe
  2⤵
  PID:7904
- C:\Windows\System\VFjhziF.exe
  C:\Windows\System\VFjhziF.exe
  2⤵
  PID:7956
- C:\Windows\System\KuoMSZz.exe
  C:\Windows\System\KuoMSZz.exe
  2⤵
  PID:8036
- C:\Windows\System\NfkDbLe.exe
  C:\Windows\System\NfkDbLe.exe
  2⤵
  PID:8092
- C:\Windows\System\dXHhtZr.exe
  C:\Windows\System\dXHhtZr.exe
  2⤵
  PID:8152
- C:\Windows\System\sqrfwMD.exe
  C:\Windows\System\sqrfwMD.exe
  2⤵
  PID:7232
- C:\Windows\System\AlRPEkV.exe
  C:\Windows\System\AlRPEkV.exe
  2⤵
  PID:7380
- C:\Windows\System\pVrVkaK.exe
  C:\Windows\System\pVrVkaK.exe
  2⤵
  PID:7520
- C:\Windows\System\XFYOVYy.exe
  C:\Windows\System\XFYOVYy.exe
  2⤵
  PID:7724
- C:\Windows\System\GRbJSYj.exe
  C:\Windows\System\GRbJSYj.exe
  2⤵
  PID:7808
- C:\Windows\System\qegdDlY.exe
  C:\Windows\System\qegdDlY.exe
  2⤵
  PID:8024
- C:\Windows\System\DEUZeon.exe
  C:\Windows\System\DEUZeon.exe
  2⤵
  PID:8148
- C:\Windows\System\cKZAQzX.exe
  C:\Windows\System\cKZAQzX.exe
  2⤵
  PID:7528
- C:\Windows\System\ixDyraq.exe
  C:\Windows\System\ixDyraq.exe
  2⤵
  PID:7864
- C:\Windows\System\xHgjkiD.exe
  C:\Windows\System\xHgjkiD.exe
  2⤵
  PID:7204
- C:\Windows\System\PgXRkGv.exe
  C:\Windows\System\PgXRkGv.exe
  2⤵
  PID:8108
- C:\Windows\System\pKtxfvF.exe
  C:\Windows\System\pKtxfvF.exe
  2⤵
  PID:8200
- C:\Windows\System\CfBvewV.exe
  C:\Windows\System\CfBvewV.exe
  2⤵
  PID:8216
- C:\Windows\System\fmCvEiO.exe
  C:\Windows\System\fmCvEiO.exe
  2⤵
  PID:8256
- C:\Windows\System\lBNzRXb.exe
  C:\Windows\System\lBNzRXb.exe
  2⤵
  PID:8272
- C:\Windows\System\EhtmdOP.exe
  C:\Windows\System\EhtmdOP.exe
  2⤵
  PID:8308
- C:\Windows\System\swjfWME.exe
  C:\Windows\System\swjfWME.exe
  2⤵
  PID:8340
- C:\Windows\System\eOlpvnb.exe
  C:\Windows\System\eOlpvnb.exe
  2⤵
  PID:8356
- C:\Windows\System\nbiHZtK.exe
  C:\Windows\System\nbiHZtK.exe
  2⤵
  PID:8380
- C:\Windows\System\KEgubyS.exe
  C:\Windows\System\KEgubyS.exe
  2⤵
  PID:8412
- C:\Windows\System\eDtwyfc.exe
  C:\Windows\System\eDtwyfc.exe
  2⤵
  PID:8448
- C:\Windows\System\oqqtlLO.exe
  C:\Windows\System\oqqtlLO.exe
  2⤵
  PID:8480
- C:\Windows\System\JNnikPq.exe
  C:\Windows\System\JNnikPq.exe
  2⤵
  PID:8508
- C:\Windows\System\bqBFAcX.exe
  C:\Windows\System\bqBFAcX.exe
  2⤵
  PID:8536
- C:\Windows\System\CRBfoDc.exe
  C:\Windows\System\CRBfoDc.exe
  2⤵
  PID:8564
- C:\Windows\System\pdyazXY.exe
  C:\Windows\System\pdyazXY.exe
  2⤵
  PID:8584
- C:\Windows\System\DjTmgGo.exe
  C:\Windows\System\DjTmgGo.exe
  2⤵
  PID:8620
- C:\Windows\System\amjSSTz.exe
  C:\Windows\System\amjSSTz.exe
  2⤵
  PID:8636
- C:\Windows\System\IIsVIZi.exe
  C:\Windows\System\IIsVIZi.exe
  2⤵
  PID:8664
- C:\Windows\System\IDwUjcu.exe
  C:\Windows\System\IDwUjcu.exe
  2⤵
  PID:8708
- C:\Windows\System\qILSanM.exe
  C:\Windows\System\qILSanM.exe
  2⤵
  PID:8732
- C:\Windows\System\YhUjDvH.exe
  C:\Windows\System\YhUjDvH.exe
  2⤵
  PID:8764
- C:\Windows\System\MnNzMPk.exe
  C:\Windows\System\MnNzMPk.exe
  2⤵
  PID:8800
- C:\Windows\System\JJZsUva.exe
  C:\Windows\System\JJZsUva.exe
  2⤵
  PID:8840
- C:\Windows\System\mFvuHFZ.exe
  C:\Windows\System\mFvuHFZ.exe
  2⤵
  PID:8868
- C:\Windows\System\dkZLcGd.exe
  C:\Windows\System\dkZLcGd.exe
  2⤵
  PID:8908
- C:\Windows\System\cIERAxe.exe
  C:\Windows\System\cIERAxe.exe
  2⤵
  PID:8948
- C:\Windows\System\dnsbNVu.exe
  C:\Windows\System\dnsbNVu.exe
  2⤵
  PID:8980
- C:\Windows\System\ZkzDGqv.exe
  C:\Windows\System\ZkzDGqv.exe
  2⤵
  PID:9008
- C:\Windows\System\LKHQJnf.exe
  C:\Windows\System\LKHQJnf.exe
  2⤵
  PID:9036
- C:\Windows\System\llrqUkW.exe
  C:\Windows\System\llrqUkW.exe
  2⤵
  PID:9056
- C:\Windows\System\IFumzFv.exe
  C:\Windows\System\IFumzFv.exe
  2⤵
  PID:9072
- C:\Windows\System\PStnuHQ.exe
  C:\Windows\System\PStnuHQ.exe
  2⤵
  PID:9104
- C:\Windows\System\pTsIdRA.exe
  C:\Windows\System\pTsIdRA.exe
  2⤵
  PID:9128
- C:\Windows\System\ZPntVwb.exe
  C:\Windows\System\ZPntVwb.exe
  2⤵
  PID:9164
- C:\Windows\System\UHtoduC.exe
  C:\Windows\System\UHtoduC.exe
  2⤵
  PID:9200
- C:\Windows\System\oqAjeAL.exe
  C:\Windows\System\oqAjeAL.exe
  2⤵
  PID:8244
- C:\Windows\System\EDTmprH.exe
  C:\Windows\System\EDTmprH.exe
  2⤵
  PID:8332
- C:\Windows\System\xxlzTfp.exe
  C:\Windows\System\xxlzTfp.exe
  2⤵
  PID:8388
- C:\Windows\System\oYgZJzG.exe
  C:\Windows\System\oYgZJzG.exe
  2⤵
  PID:8008
- C:\Windows\System\xhyBaRx.exe
  C:\Windows\System\xhyBaRx.exe
  2⤵
  PID:8532
- C:\Windows\System\GMBmeNN.exe
  C:\Windows\System\GMBmeNN.exe
  2⤵
  PID:8608
- C:\Windows\System\mSphfEB.exe
  C:\Windows\System\mSphfEB.exe
  2⤵
  PID:8676
- C:\Windows\System\MXjHPvc.exe
  C:\Windows\System\MXjHPvc.exe
  2⤵
  PID:8760
- C:\Windows\System\UMGNmdV.exe
  C:\Windows\System\UMGNmdV.exe
  2⤵
  PID:8808
- C:\Windows\System\DKcFekL.exe
  C:\Windows\System\DKcFekL.exe
  2⤵
  PID:8932
- C:\Windows\System\EjFgtry.exe
  C:\Windows\System\EjFgtry.exe
  2⤵
  PID:8976
- C:\Windows\System\VmjJbdW.exe
  C:\Windows\System\VmjJbdW.exe
  2⤵
  PID:9044
- C:\Windows\System\GKxpGtf.exe
  C:\Windows\System\GKxpGtf.exe
  2⤵
  PID:9136
- C:\Windows\System\OBlgyvE.exe
  C:\Windows\System\OBlgyvE.exe
  2⤵
  PID:9156
- C:\Windows\System\pAHcrJs.exe
  C:\Windows\System\pAHcrJs.exe
  2⤵
  PID:8236
- C:\Windows\System\KkkcvDL.exe
  C:\Windows\System\KkkcvDL.exe
  2⤵
  PID:8424
- C:\Windows\System\vRGJnOU.exe
  C:\Windows\System\vRGJnOU.exe
  2⤵
  PID:8628
- C:\Windows\System\hGsOqcj.exe
  C:\Windows\System\hGsOqcj.exe
  2⤵
  PID:8852
- C:\Windows\System\wIupqeX.exe
  C:\Windows\System\wIupqeX.exe
  2⤵
  PID:9004
- C:\Windows\System\KTGizEp.exe
  C:\Windows\System\KTGizEp.exe
  2⤵
  PID:9196
- C:\Windows\System\dsltskJ.exe
  C:\Windows\System\dsltskJ.exe
  2⤵
  PID:8560
- C:\Windows\System\NXbjAEJ.exe
  C:\Windows\System\NXbjAEJ.exe
  2⤵
  PID:9028
- C:\Windows\System\ZfWjqmw.exe
  C:\Windows\System\ZfWjqmw.exe
  2⤵
  PID:9116
- C:\Windows\System\PDUQrDz.exe
  C:\Windows\System\PDUQrDz.exe
  2⤵
  PID:9224
- C:\Windows\System\ffnXQIe.exe
  C:\Windows\System\ffnXQIe.exe
  2⤵
  PID:9240
- C:\Windows\System\hYpeDZF.exe
  C:\Windows\System\hYpeDZF.exe
  2⤵
  PID:9280
- C:\Windows\System\hciHghe.exe
  C:\Windows\System\hciHghe.exe
  2⤵
  PID:9312
- C:\Windows\System\zUIFMJV.exe
  C:\Windows\System\zUIFMJV.exe
  2⤵
  PID:9336
- C:\Windows\System\HorQmRv.exe
  C:\Windows\System\HorQmRv.exe
  2⤵
  PID:9356
- C:\Windows\System\nxlnoAR.exe
  C:\Windows\System\nxlnoAR.exe
  2⤵
  PID:9392
- C:\Windows\System\MpWsWrg.exe
  C:\Windows\System\MpWsWrg.exe
  2⤵
  PID:9436
- C:\Windows\System\mPyZjln.exe
  C:\Windows\System\mPyZjln.exe
  2⤵
  PID:9464
- C:\Windows\System\oKMCbJc.exe
  C:\Windows\System\oKMCbJc.exe
  2⤵
  PID:9480
- C:\Windows\System\UMqRIYF.exe
  C:\Windows\System\UMqRIYF.exe
  2⤵
  PID:9512
- C:\Windows\System\vbQPkjB.exe
  C:\Windows\System\vbQPkjB.exe
  2⤵
  PID:9552
- C:\Windows\System\wKicIAa.exe
  C:\Windows\System\wKicIAa.exe
  2⤵
  PID:9600
- C:\Windows\System\bnwqcLw.exe
  C:\Windows\System\bnwqcLw.exe
  2⤵
  PID:9636
- C:\Windows\System\iKyjLDa.exe
  C:\Windows\System\iKyjLDa.exe
  2⤵
  PID:9664
- C:\Windows\System\hXwDNgI.exe
  C:\Windows\System\hXwDNgI.exe
  2⤵
  PID:9684
- C:\Windows\System\IlxiJfx.exe
  C:\Windows\System\IlxiJfx.exe
  2⤵
  PID:9716
- C:\Windows\System\WHHrKQN.exe
  C:\Windows\System\WHHrKQN.exe
  2⤵
  PID:9756
- C:\Windows\System\kUBSBij.exe
  C:\Windows\System\kUBSBij.exe
  2⤵
  PID:9788
- C:\Windows\System\lxmEQvL.exe
  C:\Windows\System\lxmEQvL.exe
  2⤵
  PID:9812
- C:\Windows\System\RyNjLqY.exe
  C:\Windows\System\RyNjLqY.exe
  2⤵
  PID:9844
- C:\Windows\System\bsFBxSY.exe
  C:\Windows\System\bsFBxSY.exe
  2⤵
  PID:9868
- C:\Windows\System\gaDIFeF.exe
  C:\Windows\System\gaDIFeF.exe
  2⤵
  PID:9884
- C:\Windows\System\JctnKOc.exe
  C:\Windows\System\JctnKOc.exe
  2⤵
  PID:9916
- C:\Windows\System\sxxapje.exe
  C:\Windows\System\sxxapje.exe
  2⤵
  PID:9952
- C:\Windows\System\AFkZyTb.exe
  C:\Windows\System\AFkZyTb.exe
  2⤵
  PID:9992
- C:\Windows\System\dUKKxuI.exe
  C:\Windows\System\dUKKxuI.exe
  2⤵
  PID:10012
- C:\Windows\System\GvaudfQ.exe
  C:\Windows\System\GvaudfQ.exe
  2⤵
  PID:10040
- C:\Windows\System\AcoqKcc.exe
  C:\Windows\System\AcoqKcc.exe
  2⤵
  PID:10068
- C:\Windows\System\XuzPSCk.exe
  C:\Windows\System\XuzPSCk.exe
  2⤵
  PID:10112
- C:\Windows\System\VBLeMON.exe
  C:\Windows\System\VBLeMON.exe
  2⤵
  PID:10152
- C:\Windows\System\OZGIAjz.exe
  C:\Windows\System\OZGIAjz.exe
  2⤵
  PID:10180
- C:\Windows\System\BeHQsZw.exe
  C:\Windows\System\BeHQsZw.exe
  2⤵
  PID:10224
- C:\Windows\System\BgYpyFU.exe
  C:\Windows\System\BgYpyFU.exe
  2⤵
  PID:8864
- C:\Windows\System\CuiSCrg.exe
  C:\Windows\System\CuiSCrg.exe
  2⤵
  PID:8704
- C:\Windows\System\jUrNGgj.exe
  C:\Windows\System\jUrNGgj.exe
  2⤵
  PID:9376
- C:\Windows\System\VFCEXce.exe
  C:\Windows\System\VFCEXce.exe
  2⤵
  PID:9472
- C:\Windows\System\bKKAUPi.exe
  C:\Windows\System\bKKAUPi.exe
  2⤵
  PID:9492
- C:\Windows\System\YjRiZwj.exe
  C:\Windows\System\YjRiZwj.exe
  2⤵
  PID:9596
- C:\Windows\System\nGWWydh.exe
  C:\Windows\System\nGWWydh.exe
  2⤵
  PID:9676
- C:\Windows\System\vwBoRBd.exe
  C:\Windows\System\vwBoRBd.exe
  2⤵
  PID:9752
- C:\Windows\System\COmUVGp.exe
  C:\Windows\System\COmUVGp.exe
  2⤵
  PID:9840
- C:\Windows\System\XpMblaC.exe
  C:\Windows\System\XpMblaC.exe
  2⤵
  PID:9940
- C:\Windows\System\lrpGlZZ.exe
  C:\Windows\System\lrpGlZZ.exe
  2⤵
  PID:9984
- C:\Windows\System\DQGDkHz.exe
  C:\Windows\System\DQGDkHz.exe
  2⤵
  PID:10076
- C:\Windows\System\CafwUOK.exe
  C:\Windows\System\CafwUOK.exe
  2⤵
  PID:10176
- C:\Windows\System\tlOlaau.exe
  C:\Windows\System\tlOlaau.exe
  2⤵
  PID:9276
- C:\Windows\System\MhweCyq.exe
  C:\Windows\System\MhweCyq.exe
  2⤵
  PID:9428
- C:\Windows\System\RgEcTqn.exe
  C:\Windows\System\RgEcTqn.exe
  2⤵
  PID:9656
- C:\Windows\System\fLYxOUy.exe
  C:\Windows\System\fLYxOUy.exe
  2⤵
  PID:9824
- C:\Windows\System\SfLijKX.exe
  C:\Windows\System\SfLijKX.exe
  2⤵
  PID:10052
- C:\Windows\System\PTWHGYj.exe
  C:\Windows\System\PTWHGYj.exe
  2⤵
  PID:9404
- C:\Windows\System\QelsQAa.exe
  C:\Windows\System\QelsQAa.exe
  2⤵
  PID:10000
- C:\Windows\System\WHTWMOR.exe
  C:\Windows\System\WHTWMOR.exe
  2⤵
  PID:9960
- C:\Windows\System\RemWrEh.exe
  C:\Windows\System\RemWrEh.exe
  2⤵
  PID:10248
- C:\Windows\System\rtOuvQw.exe
  C:\Windows\System\rtOuvQw.exe
  2⤵
  PID:10264
- C:\Windows\System\ySCMCId.exe
  C:\Windows\System\ySCMCId.exe
  2⤵
  PID:10284
- C:\Windows\System\YFGZXVT.exe
  C:\Windows\System\YFGZXVT.exe
  2⤵
  PID:10300
- C:\Windows\System\CVnURQu.exe
  C:\Windows\System\CVnURQu.exe
  2⤵
  PID:10316
- C:\Windows\System\oROABRD.exe
  C:\Windows\System\oROABRD.exe
  2⤵
  PID:10336
- C:\Windows\System\nbSgPDb.exe
  C:\Windows\System\nbSgPDb.exe
  2⤵
  PID:10368
- C:\Windows\System\NTZeKvM.exe
  C:\Windows\System\NTZeKvM.exe
  2⤵
  PID:10396
- C:\Windows\System\gSpnzfK.exe
  C:\Windows\System\gSpnzfK.exe
  2⤵
  PID:10432
- C:\Windows\System\uGMjSMn.exe
  C:\Windows\System\uGMjSMn.exe
  2⤵
  PID:10456
- C:\Windows\System\ZwiJJaA.exe
  C:\Windows\System\ZwiJJaA.exe
  2⤵
  PID:10480
- C:\Windows\System\tUBkyJJ.exe
  C:\Windows\System\tUBkyJJ.exe
  2⤵
  PID:10520
- C:\Windows\System\OWSooZN.exe
  C:\Windows\System\OWSooZN.exe
  2⤵
  PID:10556
- C:\Windows\System\jaaNYRN.exe
  C:\Windows\System\jaaNYRN.exe
  2⤵
  PID:10592
- C:\Windows\System\jLnZTcR.exe
  C:\Windows\System\jLnZTcR.exe
  2⤵
  PID:10624
- C:\Windows\System\qDoPlxL.exe
  C:\Windows\System\qDoPlxL.exe
  2⤵
  PID:10656
- C:\Windows\System\URYkOVm.exe
  C:\Windows\System\URYkOVm.exe
  2⤵
  PID:10676
- C:\Windows\System\bRvdGSZ.exe
  C:\Windows\System\bRvdGSZ.exe
  2⤵
  PID:10712
- C:\Windows\System\pUzzPov.exe
  C:\Windows\System\pUzzPov.exe
  2⤵
  PID:10748
- C:\Windows\System\VAZsqPj.exe
  C:\Windows\System\VAZsqPj.exe
  2⤵
  PID:10788
- C:\Windows\System\flsYxsS.exe
  C:\Windows\System\flsYxsS.exe
  2⤵
  PID:10820
- C:\Windows\System\ZjfTxhV.exe
  C:\Windows\System\ZjfTxhV.exe
  2⤵
  PID:10860
- C:\Windows\System\ofhiKKB.exe
  C:\Windows\System\ofhiKKB.exe
  2⤵
  PID:10876
- C:\Windows\System\jCgyhPh.exe
  C:\Windows\System\jCgyhPh.exe
  2⤵
  PID:10892
- C:\Windows\System\kGuLPvo.exe
  C:\Windows\System\kGuLPvo.exe
  2⤵
  PID:10908
- C:\Windows\System\DBHxshS.exe
  C:\Windows\System\DBHxshS.exe
  2⤵
  PID:10940
- C:\Windows\System\HzBHgFY.exe
  C:\Windows\System\HzBHgFY.exe
  2⤵
  PID:10976
- C:\Windows\System\yIvKswR.exe
  C:\Windows\System\yIvKswR.exe
  2⤵
  PID:11008
- C:\Windows\System\hiSbEWC.exe
  C:\Windows\System\hiSbEWC.exe
  2⤵
  PID:11040
- C:\Windows\System\JhbePFG.exe
  C:\Windows\System\JhbePFG.exe
  2⤵
  PID:11072
- C:\Windows\System\HeLXAOB.exe
  C:\Windows\System\HeLXAOB.exe
  2⤵
  PID:11096
- C:\Windows\System\sFHIUQf.exe
  C:\Windows\System\sFHIUQf.exe
  2⤵
  PID:11124
- C:\Windows\System\MgRSRBs.exe
  C:\Windows\System\MgRSRBs.exe
  2⤵
  PID:11156
- C:\Windows\System\wdmgIba.exe
  C:\Windows\System\wdmgIba.exe
  2⤵
  PID:11196
- C:\Windows\System\IfjQpRS.exe
  C:\Windows\System\IfjQpRS.exe
  2⤵
  PID:11224
- C:\Windows\System\YnNuKqu.exe
  C:\Windows\System\YnNuKqu.exe
  2⤵
  PID:11244
- C:\Windows\System\KftaWrM.exe
  C:\Windows\System\KftaWrM.exe
  2⤵
  PID:10276
- C:\Windows\System\xGlpsNX.exe
  C:\Windows\System\xGlpsNX.exe
  2⤵
  PID:10352
- C:\Windows\System\qYtvjFk.exe
  C:\Windows\System\qYtvjFk.exe
  2⤵
  PID:10328
- C:\Windows\System\xbNwAwe.exe
  C:\Windows\System\xbNwAwe.exe
  2⤵
  PID:10468
- C:\Windows\System\kDwrjti.exe
  C:\Windows\System\kDwrjti.exe
  2⤵
  PID:10580
- C:\Windows\System\ersRAFS.exe
  C:\Windows\System\ersRAFS.exe
  2⤵
  PID:10544
- C:\Windows\System\sQoUNXG.exe
  C:\Windows\System\sQoUNXG.exe
  2⤵
  PID:10616
- C:\Windows\System\IabxiHS.exe
  C:\Windows\System\IabxiHS.exe
  2⤵
  PID:10776
- C:\Windows\System\VuKgieI.exe
  C:\Windows\System\VuKgieI.exe
  2⤵
  PID:10816
- C:\Windows\System\KrktaZM.exe
  C:\Windows\System\KrktaZM.exe
  2⤵
  PID:10832
- C:\Windows\System\QWhGiGy.exe
  C:\Windows\System\QWhGiGy.exe
  2⤵
  PID:10924
- C:\Windows\System\SpPFUQz.exe
  C:\Windows\System\SpPFUQz.exe
  2⤵
  PID:10956
- C:\Windows\System\egCqMXO.exe
  C:\Windows\System\egCqMXO.exe
  2⤵
  PID:11056
- C:\Windows\System\IvdhAZE.exe
  C:\Windows\System\IvdhAZE.exe
  2⤵
  PID:11112
- C:\Windows\System\adrwKmC.exe
  C:\Windows\System\adrwKmC.exe
  2⤵
  PID:11164
- C:\Windows\System\WjjjkcY.exe
  C:\Windows\System\WjjjkcY.exe
  2⤵
  PID:11232
- C:\Windows\System\LCrNLrA.exe
  C:\Windows\System\LCrNLrA.exe
  2⤵
  PID:10404
- C:\Windows\System\ykqXgKh.exe
  C:\Windows\System\ykqXgKh.exe
  2⤵
  PID:10416
- C:\Windows\System\QqXxYOJ.exe
  C:\Windows\System\QqXxYOJ.exe
  2⤵
  PID:10640
- C:\Windows\System\Yvhxcxb.exe
  C:\Windows\System\Yvhxcxb.exe
  2⤵
  PID:10844
- C:\Windows\System\KTSqvnJ.exe
  C:\Windows\System\KTSqvnJ.exe
  2⤵
  PID:10984
- C:\Windows\System\haOhFiM.exe
  C:\Windows\System\haOhFiM.exe
  2⤵
  PID:11216
- C:\Windows\System\HkmyoGZ.exe
  C:\Windows\System\HkmyoGZ.exe
  2⤵
  PID:10508
- C:\Windows\System\jIxYuik.exe
  C:\Windows\System\jIxYuik.exe
  2⤵
  PID:10888
- C:\Windows\System\ZiXAZYq.exe
  C:\Windows\System\ZiXAZYq.exe
  2⤵
  PID:3692
- C:\Windows\System\rHxTKCI.exe
  C:\Windows\System\rHxTKCI.exe
  2⤵
  PID:10808
- C:\Windows\System\VYnJggU.exe
  C:\Windows\System\VYnJggU.exe
  2⤵
  PID:11140
- C:\Windows\System\DAaLgwW.exe
  C:\Windows\System\DAaLgwW.exe
  2⤵
  PID:11292
- C:\Windows\System\KsOzFMn.exe
  C:\Windows\System\KsOzFMn.exe
  2⤵
  PID:11336
- C:\Windows\System\Tfkmbid.exe
  C:\Windows\System\Tfkmbid.exe
  2⤵
  PID:11364
- C:\Windows\System\OcBcbGn.exe
  C:\Windows\System\OcBcbGn.exe
  2⤵
  PID:11392
- C:\Windows\System\rfGEDIM.exe
  C:\Windows\System\rfGEDIM.exe
  2⤵
  PID:11408
- C:\Windows\System\vfjKqGA.exe
  C:\Windows\System\vfjKqGA.exe
  2⤵
  PID:11432
- C:\Windows\System\ZDjIrxp.exe
  C:\Windows\System\ZDjIrxp.exe
  2⤵
  PID:11452
- C:\Windows\System\toZAyil.exe
  C:\Windows\System\toZAyil.exe
  2⤵
  PID:11484
- C:\Windows\System\xOFfPst.exe
  C:\Windows\System\xOFfPst.exe
  2⤵
  PID:11520
- C:\Windows\System\CnKWfHb.exe
  C:\Windows\System\CnKWfHb.exe
  2⤵
  PID:11548
- C:\Windows\System\RvqqOKy.exe
  C:\Windows\System\RvqqOKy.exe
  2⤵
  PID:11588
- C:\Windows\System\HsBiiPV.exe
  C:\Windows\System\HsBiiPV.exe
  2⤵
  PID:11616
- C:\Windows\System\dHWzEQe.exe
  C:\Windows\System\dHWzEQe.exe
  2⤵
  PID:11632
- C:\Windows\System\DUovyuV.exe
  C:\Windows\System\DUovyuV.exe
  2⤵
  PID:11672
- C:\Windows\System\eVPLxLX.exe
  C:\Windows\System\eVPLxLX.exe
  2⤵
  PID:11688
- C:\Windows\System\QXKnnKS.exe
  C:\Windows\System\QXKnnKS.exe
  2⤵
  PID:11716
- C:\Windows\System\SfveCPB.exe
  C:\Windows\System\SfveCPB.exe
  2⤵
  PID:11748
- C:\Windows\System\ufiXENk.exe
  C:\Windows\System\ufiXENk.exe
  2⤵
  PID:11784
- C:\Windows\System\tXnAucW.exe
  C:\Windows\System\tXnAucW.exe
  2⤵
  PID:11812
- C:\Windows\System\EAVWKeO.exe
  C:\Windows\System\EAVWKeO.exe
  2⤵
  PID:11844
- C:\Windows\System\VIWlllq.exe
  C:\Windows\System\VIWlllq.exe
  2⤵
  PID:11872
- C:\Windows\System\nLvtrlR.exe
  C:\Windows\System\nLvtrlR.exe
  2⤵
  PID:11900
- C:\Windows\System\bGGnXUR.exe
  C:\Windows\System\bGGnXUR.exe
  2⤵
  PID:11928
- C:\Windows\System\zmAjrfq.exe
  C:\Windows\System\zmAjrfq.exe
  2⤵
  PID:11956
- C:\Windows\System\LMsHgst.exe
  C:\Windows\System\LMsHgst.exe
  2⤵
  PID:11984
- C:\Windows\System\YHihoMT.exe
  C:\Windows\System\YHihoMT.exe
  2⤵
  PID:12000
- C:\Windows\System\mMVBEms.exe
  C:\Windows\System\mMVBEms.exe
  2⤵
  PID:12040
- C:\Windows\System\LxaNoUl.exe
  C:\Windows\System\LxaNoUl.exe
  2⤵
  PID:12068
- C:\Windows\System\LRKkGgy.exe
  C:\Windows\System\LRKkGgy.exe
  2⤵
  PID:12084
- C:\Windows\System\moJlJAV.exe
  C:\Windows\System\moJlJAV.exe
  2⤵
  PID:12100
- C:\Windows\System\doGsooM.exe
  C:\Windows\System\doGsooM.exe
  2⤵
  PID:12132
- C:\Windows\System\YOUNdRb.exe
  C:\Windows\System\YOUNdRb.exe
  2⤵
  PID:12168
- C:\Windows\System\gBHIRLG.exe
  C:\Windows\System\gBHIRLG.exe
  2⤵
  PID:12208
- C:\Windows\System\uPHqknt.exe
  C:\Windows\System\uPHqknt.exe
  2⤵
  PID:12232
- C:\Windows\System\ZYJDarK.exe
  C:\Windows\System\ZYJDarK.exe
  2⤵
  PID:12264
- C:\Windows\System\kMPIDfN.exe
  C:\Windows\System\kMPIDfN.exe
  2⤵
  PID:10612
- C:\Windows\System\moAWSgf.exe
  C:\Windows\System\moAWSgf.exe
  2⤵
  PID:11332
- C:\Windows\System\naSOQmU.exe
  C:\Windows\System\naSOQmU.exe
  2⤵
  PID:11388
- C:\Windows\System\zlUJBhp.exe
  C:\Windows\System\zlUJBhp.exe
  2⤵
  PID:11464
- C:\Windows\System\pDSipaN.exe
  C:\Windows\System\pDSipaN.exe
  2⤵
  PID:11532
- C:\Windows\System\LwklHsn.exe
  C:\Windows\System\LwklHsn.exe
  2⤵
  PID:11584
- C:\Windows\System\lyxHvAN.exe
  C:\Windows\System\lyxHvAN.exe
  2⤵
  PID:11660
- C:\Windows\System\ZfFlNvW.exe
  C:\Windows\System\ZfFlNvW.exe
  2⤵
  PID:11736
- C:\Windows\System\gWRiUDa.exe
  C:\Windows\System\gWRiUDa.exe
  2⤵
  PID:11804
- C:\Windows\System\NRyrqNp.exe
  C:\Windows\System\NRyrqNp.exe
  2⤵
  PID:11892
- C:\Windows\System\sqaAkGv.exe
  C:\Windows\System\sqaAkGv.exe
  2⤵
  PID:11940
- C:\Windows\System\BhCShgk.exe
  C:\Windows\System\BhCShgk.exe
  2⤵
  PID:12028
- C:\Windows\System\MuPCOgc.exe
  C:\Windows\System\MuPCOgc.exe
  2⤵
  PID:12080
- C:\Windows\System\SwWXfzb.exe
  C:\Windows\System\SwWXfzb.exe
  2⤵
  PID:12124
- C:\Windows\System\tCekkVL.exe
  C:\Windows\System\tCekkVL.exe
  2⤵
  PID:1244
- C:\Windows\System\yBCTfRI.exe
  C:\Windows\System\yBCTfRI.exe
  2⤵
  PID:11384
- C:\Windows\System\tBuiCID.exe
  C:\Windows\System\tBuiCID.exe
  2⤵
  PID:11504
- C:\Windows\System\xRzhral.exe
  C:\Windows\System\xRzhral.exe
  2⤵
  PID:11612
- C:\Windows\System\bIPoydR.exe
  C:\Windows\System\bIPoydR.exe
  2⤵
  PID:11796
- C:\Windows\System\SBLMWUw.exe
  C:\Windows\System\SBLMWUw.exe
  2⤵
  PID:11976
- C:\Windows\System\vKQBkZs.exe
  C:\Windows\System\vKQBkZs.exe
  2⤵
  PID:12076
- C:\Windows\System\aPVtmhT.exe
  C:\Windows\System\aPVtmhT.exe
  2⤵
  PID:11288
- C:\Windows\System\NoSqPyE.exe
  C:\Windows\System\NoSqPyE.exe
  2⤵
  PID:11508
- C:\Windows\System\ToYSQnP.exe
  C:\Windows\System\ToYSQnP.exe
  2⤵
  PID:3680
- C:\Windows\System\dwyxsUm.exe
  C:\Windows\System\dwyxsUm.exe
  2⤵
  PID:11832
- C:\Windows\System\mnFVPLU.exe
  C:\Windows\System\mnFVPLU.exe
  2⤵
  PID:12064
- C:\Windows\System\YWMfdpM.exe
  C:\Windows\System\YWMfdpM.exe
  2⤵
  PID:4948
- C:\Windows\System\rGMsEXb.exe
  C:\Windows\System\rGMsEXb.exe
  2⤵
  PID:3664
- C:\Windows\System\QMPEdSW.exe
  C:\Windows\System\QMPEdSW.exe
  2⤵
  PID:12120
- C:\Windows\System\AECeidi.exe
  C:\Windows\System\AECeidi.exe
  2⤵
  PID:12324
- C:\Windows\System\xcVKPtG.exe
  C:\Windows\System\xcVKPtG.exe
  2⤵
  PID:12364
- C:\Windows\System\depRXNL.exe
  C:\Windows\System\depRXNL.exe
  2⤵
  PID:12380
- C:\Windows\System\yJVmKBb.exe
  C:\Windows\System\yJVmKBb.exe
  2⤵
  PID:12400
- C:\Windows\System\oidtPKd.exe
  C:\Windows\System\oidtPKd.exe
  2⤵
  PID:12444
- C:\Windows\System\QenECpZ.exe
  C:\Windows\System\QenECpZ.exe
  2⤵
  PID:12476
- C:\Windows\System\xXVwjgf.exe
  C:\Windows\System\xXVwjgf.exe
  2⤵
  PID:12496
- C:\Windows\System\aLAKuBg.exe
  C:\Windows\System\aLAKuBg.exe
  2⤵
  PID:12540
- C:\Windows\System\FgqtNPy.exe
  C:\Windows\System\FgqtNPy.exe
  2⤵
  PID:12572
- C:\Windows\System\NZCnuRq.exe
  C:\Windows\System\NZCnuRq.exe
  2⤵
  PID:12600
- C:\Windows\System\GCKbDnn.exe
  C:\Windows\System\GCKbDnn.exe
  2⤵
  PID:12624
- C:\Windows\System\FwVwUSB.exe
  C:\Windows\System\FwVwUSB.exe
  2⤵
  PID:12652
- C:\Windows\System\nryhDQk.exe
  C:\Windows\System\nryhDQk.exe
  2⤵
  PID:12688
- C:\Windows\System\ByAnvpQ.exe
  C:\Windows\System\ByAnvpQ.exe
  2⤵
  PID:12712
- C:\Windows\System\pXuKhfF.exe
  C:\Windows\System\pXuKhfF.exe
  2⤵
  PID:12752
- C:\Windows\System\sVbRTko.exe
  C:\Windows\System\sVbRTko.exe
  2⤵
  PID:12768
- C:\Windows\System\Gqqjefn.exe
  C:\Windows\System\Gqqjefn.exe
  2⤵
  PID:12808
- C:\Windows\System\fKLFRJn.exe
  C:\Windows\System\fKLFRJn.exe
  2⤵
  PID:12824
- C:\Windows\System\hGKdyeQ.exe
  C:\Windows\System\hGKdyeQ.exe
  2⤵
  PID:12856
- C:\Windows\System\bUhWzdd.exe
  C:\Windows\System\bUhWzdd.exe
  2⤵
  PID:12876
- C:\Windows\System\aaSsoqj.exe
  C:\Windows\System\aaSsoqj.exe
  2⤵
  PID:12896
- C:\Windows\System\sgDGYck.exe
  C:\Windows\System\sgDGYck.exe
  2⤵
  PID:12924
- C:\Windows\System\qJahMNz.exe
  C:\Windows\System\qJahMNz.exe
  2⤵
  PID:12956
- C:\Windows\System\nHiSFjY.exe
  C:\Windows\System\nHiSFjY.exe
  2⤵
  PID:12980
- C:\Windows\System\vvqAFDR.exe
  C:\Windows\System\vvqAFDR.exe
  2⤵
  PID:13008
- C:\Windows\System\GSJqUXv.exe
  C:\Windows\System\GSJqUXv.exe
  2⤵
  PID:13024
- C:\Windows\System\QRaYjmQ.exe
  C:\Windows\System\QRaYjmQ.exe
  2⤵
  PID:13044
- C:\Windows\System\nfkUTdS.exe
  C:\Windows\System\nfkUTdS.exe
  2⤵
  PID:13076
- C:\Windows\System\XVMxYPc.exe
  C:\Windows\System\XVMxYPc.exe
  2⤵
  PID:13124
- C:\Windows\System\gVEctLW.exe
  C:\Windows\System\gVEctLW.exe
  2⤵
  PID:13148
- C:\Windows\System\dfafjZR.exe
  C:\Windows\System\dfafjZR.exe
  2⤵
  PID:13164
- C:\Windows\System\OhgqKAm.exe
  C:\Windows\System\OhgqKAm.exe
  2⤵
  PID:13200
- C:\Windows\System\NJLEIcX.exe
  C:\Windows\System\NJLEIcX.exe
  2⤵
  PID:13228
- C:\Windows\System\mUAQwFK.exe
  C:\Windows\System\mUAQwFK.exe
  2⤵
  PID:13260
- C:\Windows\System\MNsKAPu.exe
  C:\Windows\System\MNsKAPu.exe
  2⤵
  PID:13284
- C:\Windows\System\UpQXgMc.exe
  C:\Windows\System\UpQXgMc.exe
  2⤵
  PID:11728
- C:\Windows\System\aKvJGih.exe
  C:\Windows\System\aKvJGih.exe
  2⤵
  PID:12376
- C:\Windows\System\YsrTQWC.exe
  C:\Windows\System\YsrTQWC.exe
  2⤵
  PID:12424
- C:\Windows\System\aMtNMyq.exe
  C:\Windows\System\aMtNMyq.exe
  2⤵
  PID:12492
- C:\Windows\System\fTKQGPn.exe
  C:\Windows\System\fTKQGPn.exe
  2⤵
  PID:12584
- C:\Windows\System\dUcMZVr.exe
  C:\Windows\System\dUcMZVr.exe
  2⤵
  PID:12664
- C:\Windows\System\bYUuizM.exe
  C:\Windows\System\bYUuizM.exe
  2⤵
  PID:12704
- C:\Windows\System\lMhcdcr.exe
  C:\Windows\System\lMhcdcr.exe
  2⤵
  PID:12764
- C:\Windows\System\AonEVMV.exe
  C:\Windows\System\AonEVMV.exe
  2⤵
  PID:12836
- C:\Windows\System\lOARmaG.exe
  C:\Windows\System\lOARmaG.exe
  2⤵
  PID:12916
- C:\Windows\System\kpkoYYm.exe
  C:\Windows\System\kpkoYYm.exe
  2⤵
  PID:12996
- C:\Windows\System\rHFPFZy.exe
  C:\Windows\System\rHFPFZy.exe
  2⤵
  PID:13056
- C:\Windows\System\DOAgWeG.exe
  C:\Windows\System\DOAgWeG.exe
  2⤵
  PID:13116
- C:\Windows\System\GDWmYfS.exe
  C:\Windows\System\GDWmYfS.exe
  2⤵
  PID:13088
- C:\Windows\System\XvYeoHl.exe
  C:\Windows\System\XvYeoHl.exe
  2⤵
  PID:13112
- C:\Windows\System\jVDANZN.exe
  C:\Windows\System\jVDANZN.exe
  2⤵
  PID:13208
- C:\Windows\System\QNGXoAH.exe
  C:\Windows\System\QNGXoAH.exe
  2⤵
  PID:13244
- C:\Windows\System\GqGNajm.exe
  C:\Windows\System\GqGNajm.exe
  2⤵
  PID:13276
- C:\Windows\System\owfzUsO.exe
  C:\Windows\System\owfzUsO.exe
  2⤵
  PID:12468
- C:\Windows\System\PFyJprG.exe
  C:\Windows\System\PFyJprG.exe
  2⤵
  PID:12616
- C:\Windows\System\VPIvzPV.exe
  C:\Windows\System\VPIvzPV.exe
  2⤵
  PID:12700
- C:\Windows\System\cjtfXTS.exe
  C:\Windows\System\cjtfXTS.exe
  2⤵
  PID:12972
- C:\Windows\System\aZcoUGl.exe
  C:\Windows\System\aZcoUGl.exe
  2⤵
  PID:13132
- C:\Windows\System\AwxHkbE.exe
  C:\Windows\System\AwxHkbE.exe
  2⤵
  PID:13188
- C:\Windows\System\fnfkqMu.exe
  C:\Windows\System\fnfkqMu.exe
  2⤵
  PID:13304
- C:\Windows\System\bjlFbwJ.exe
  C:\Windows\System\bjlFbwJ.exe
  2⤵
  PID:13068
- C:\Windows\System\kdiWALp.exe
  C:\Windows\System\kdiWALp.exe
  2⤵
  PID:12672
- C:\Windows\System\LpAWJRe.exe
  C:\Windows\System\LpAWJRe.exe
  2⤵
  PID:12452
- C:\Windows\System\ZhjSeFS.exe
  C:\Windows\System\ZhjSeFS.exe
  2⤵
  PID:13332
- C:\Windows\System\BgLYaCZ.exe
  C:\Windows\System\BgLYaCZ.exe
  2⤵
  PID:13364
- C:\Windows\System\bGgkdoy.exe
  C:\Windows\System\bGgkdoy.exe
  2⤵
  PID:13388
- C:\Windows\System\CAienyf.exe
  C:\Windows\System\CAienyf.exe
  2⤵
  PID:13428
- C:\Windows\System\auqgcDH.exe
  C:\Windows\System\auqgcDH.exe
  2⤵
  PID:13468
- C:\Windows\System\fXzlXso.exe
  C:\Windows\System\fXzlXso.exe
  2⤵
  PID:13500
- C:\Windows\System\JHSArKp.exe
  C:\Windows\System\JHSArKp.exe
  2⤵
  PID:13524
- C:\Windows\System\CcoxmoY.exe
  C:\Windows\System\CcoxmoY.exe
  2⤵
  PID:13556
- C:\Windows\System\dElzmDF.exe
  C:\Windows\System\dElzmDF.exe
  2⤵
  PID:13588
- C:\Windows\System\ZaZMaLm.exe
  C:\Windows\System\ZaZMaLm.exe
  2⤵
  PID:13628
- C:\Windows\System\LRRTCka.exe
  C:\Windows\System\LRRTCka.exe
  2⤵
  PID:13656
- C:\Windows\System\JKCzvkA.exe
  C:\Windows\System\JKCzvkA.exe
  2⤵
  PID:13684
- C:\Windows\System\jfGqwaL.exe
  C:\Windows\System\jfGqwaL.exe
  2⤵
  PID:13716
- C:\Windows\System\joOKNXD.exe
  C:\Windows\System\joOKNXD.exe
  2⤵
  PID:13744
- C:\Windows\System\CPUXuWS.exe
  C:\Windows\System\CPUXuWS.exe
  2⤵
  PID:13768
- C:\Windows\System\sseGDhV.exe
  C:\Windows\System\sseGDhV.exe
  2⤵
  PID:13796
- C:\Windows\System\elEAbdj.exe
  C:\Windows\System\elEAbdj.exe
  2⤵
  PID:13824
- C:\Windows\System\OlqgUMQ.exe
  C:\Windows\System\OlqgUMQ.exe
  2⤵
  PID:13856
- C:\Windows\System\STYmzRL.exe
  C:\Windows\System\STYmzRL.exe
  2⤵
  PID:13884
- C:\Windows\System\TnQpuUw.exe
  C:\Windows\System\TnQpuUw.exe
  2⤵
  PID:13912
- C:\Windows\System\bQhumBO.exe
  C:\Windows\System\bQhumBO.exe
  2⤵
  PID:13944
- C:\Windows\System\SZRacXB.exe
  C:\Windows\System\SZRacXB.exe
  2⤵
  PID:13972
- C:\Windows\System\gtkPrhi.exe
  C:\Windows\System\gtkPrhi.exe
  2⤵
  PID:14008
- C:\Windows\System\BHcuiTN.exe
  C:\Windows\System\BHcuiTN.exe
  2⤵
  PID:14024
- C:\Windows\System\ZpwkbDr.exe
  C:\Windows\System\ZpwkbDr.exe
  2⤵
  PID:14052
- C:\Windows\System\ngZuQYL.exe
  C:\Windows\System\ngZuQYL.exe
  2⤵
  PID:14080
- C:\Windows\System\WeXWpjd.exe
  C:\Windows\System\WeXWpjd.exe
  2⤵
  PID:14096
- C:\Windows\System\QQHCfGt.exe
  C:\Windows\System\QQHCfGt.exe
  2⤵
  PID:14132
- C:\Windows\System\vZPcsEO.exe
  C:\Windows\System\vZPcsEO.exe
  2⤵
  PID:14164
- C:\Windows\System\FSBoLCT.exe
  C:\Windows\System\FSBoLCT.exe
  2⤵
  PID:14192
- C:\Windows\System\dOBnWEf.exe
  C:\Windows\System\dOBnWEf.exe
  2⤵
  PID:14220
- C:\Windows\System\FKHftMB.exe
  C:\Windows\System\FKHftMB.exe
  2⤵
  PID:14236
- C:\Windows\System\qJsJrOm.exe
  C:\Windows\System\qJsJrOm.exe
  2⤵
  PID:14264
- C:\Windows\System\uEBlxrM.exe
  C:\Windows\System\uEBlxrM.exe
  2⤵
  PID:14280
- C:\Windows\System\oGIJgzF.exe
  C:\Windows\System\oGIJgzF.exe
  2⤵
  PID:14312
- C:\Windows\System\ubOuLLs.exe
  C:\Windows\System\ubOuLLs.exe
  2⤵
  PID:12892
- C:\Windows\System\MOVQSWx.exe
  C:\Windows\System\MOVQSWx.exe
  2⤵
  PID:13376
- C:\Windows\System\QNgLikp.exe
  C:\Windows\System\QNgLikp.exe
  2⤵
  PID:13340
- C:\Windows\System\pVuJDgs.exe
  C:\Windows\System\pVuJDgs.exe
  2⤵
  PID:13492
- C:\Windows\System\NqDCZZX.exe
  C:\Windows\System\NqDCZZX.exe
  2⤵
  PID:13580
- C:\Windows\System\PwpJgXa.exe
  C:\Windows\System\PwpJgXa.exe
  2⤵
  PID:13568
- C:\Windows\System\sIRGxYy.exe
  C:\Windows\System\sIRGxYy.exe
  2⤵
  PID:13696
- C:\Windows\System\MSrLutl.exe
  C:\Windows\System\MSrLutl.exe
  2⤵
  PID:13752
- C:\Windows\System\DrYBOdO.exe
  C:\Windows\System\DrYBOdO.exe
  2⤵
  PID:2172
- C:\Windows\System\MNTzpTg.exe
  C:\Windows\System\MNTzpTg.exe
  2⤵
  PID:13788
- C:\Windows\System\OpopnHY.exe
  C:\Windows\System\OpopnHY.exe
  2⤵
  PID:13880
- C:\Windows\System\DAXQGfL.exe
  C:\Windows\System\DAXQGfL.exe
  2⤵
  PID:13956
- C:\Windows\System\CQVxoDo.exe
  C:\Windows\System\CQVxoDo.exe
  2⤵
  PID:14020
- C:\Windows\System\IBcdyza.exe
  C:\Windows\System\IBcdyza.exe
  2⤵
  PID:14064
- C:\Windows\System\SWLVjBd.exe
  C:\Windows\System\SWLVjBd.exe
  2⤵
  PID:14120
- C:\Windows\System\rliZEAY.exe
  C:\Windows\System\rliZEAY.exe
  2⤵
  PID:14180
- C:\Windows\System\KPHwrdz.exe
  C:\Windows\System\KPHwrdz.exe
  2⤵
  PID:14252
- C:\Windows\System\vtHiEty.exe
  C:\Windows\System\vtHiEty.exe
  2⤵
  PID:12564
- C:\Windows\System\QIZFpnV.exe
  C:\Windows\System\QIZFpnV.exe
  2⤵
  PID:13420
- C:\Windows\System\cFtDoCB.exe
  C:\Windows\System\cFtDoCB.exe
  2⤵
  PID:13380
- C:\Windows\System\EVGYjoz.exe
  C:\Windows\System\EVGYjoz.exe
  2⤵
  PID:13712
- C:\Windows\System\sWiQHla.exe
  C:\Windows\System\sWiQHla.exe
  2⤵
  PID:13700
- C:\Windows\System\vXuVNao.exe
  C:\Windows\System\vXuVNao.exe
  2⤵
  PID:13848
- C:\Windows\System\mpyBRtz.exe
  C:\Windows\System\mpyBRtz.exe
  2⤵
  PID:14160
- C:\Windows\System\faNCbmR.exe
  C:\Windows\System\faNCbmR.exe
  2⤵
  PID:14212
- C:\Windows\System\dTxUSFh.exe
  C:\Windows\System\dTxUSFh.exe
  2⤵
  PID:14296
- C:\Windows\System\RFHMsVj.exe
  C:\Windows\System\RFHMsVj.exe
  2⤵
  PID:13932
- C:\Windows\System\vopxETB.exe
  C:\Windows\System\vopxETB.exe
  2⤵
  PID:14000
- C:\Windows\System\DHaQTUU.exe
  C:\Windows\System\DHaQTUU.exe
  2⤵
  PID:13652
- C:\Windows\System\VYeTHPv.exe
  C:\Windows\System\VYeTHPv.exe
  2⤵
  PID:14232
- C:\Windows\System\qjNEVKj.exe
  C:\Windows\System\qjNEVKj.exe
  2⤵
  PID:14356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AJeqcNq.exe

Filesize
2.2MB

MD5
57fb038065a1573b5f431cf4b2daf680

SHA1
7414d87dd2e6e683ad902470f473fced01504418

SHA256
aec12fee8c4874cb8d19860a94b154003656f6fdabf22a038f363641ad3938b0

SHA512
9789a39bf5f9ec77703c647a7079d2855e295719a5864dab22b8c3876e565964b94746692bec66d05d459c5b2a0da8290661a71eac3d8be2c24765d1cc9d3d35

Download Submit
C:\Windows\System\BQDQKdP.exe

Filesize
2.2MB

MD5
490f7b5fd8390144ec8cb0962c76bbec

SHA1
1ce4bc8daff4c47f0457feee73984cd7b3e6f70a

SHA256
b2cdd7feef21cb6693848d1b2c081a60c8e0f27ddcf530527b6f3769092edef6

SHA512
86014a3e36f733a1eb1e61d23d0778a753ee46203122d944293518f0b6a250c1cb90ad146e9b581f95a8bfe59fb58a42583362eeb4f3e7b8995dfb7af676cda4

Download Submit
C:\Windows\System\DGbCbmC.exe

Filesize
2.2MB

MD5
c6d28a0ef1ae839636b5bb29886f6a8b

SHA1
a30d2cdf1a0a65a62f5866f64070a6a5499ed948

SHA256
4c37d9b930845e2b1eacb3254120644794ea7d9d2e19dee273b84c9c8ef1c78c

SHA512
757d90a02f9c823df9c6a7eb6f312a738e63e9cd2fb7e2171f3687ccc4680c9ff27e9081577df0dc303ee729354b04b51286c7d0e9b5b88cf0cbed5ab3ff2503

Download Submit
C:\Windows\System\FuVnxHa.exe

Filesize
2.2MB

MD5
84d43bbc941548209cdf039b1062e34b

SHA1
882b3ae41172c3a9c089bcb16fd2b327a68c64cf

SHA256
0e930250f95fac803a5c365f7a801f9a178453c949761da670c46c08af6036f6

SHA512
c26bebc0b5c5321d4e3de69fac78f0a3ce86c67cbfcd0717d2b5915c089f6bfb8cf37beed9e9be6931545c0621acf33e7cc9ee5620a647b7f020b7a8df8c33f7

Download Submit
C:\Windows\System\FwYSpVl.exe

Filesize
2.2MB

MD5
ace9d157c09a5c834cb02d57d397afa1

SHA1
5c2e9549a9b6f43741705af639f563b15f294ffa

SHA256
2b8a9b2dbe139efd6d356a9df68e747ec89046f43520be730b23d80f0bfbddbb

SHA512
25b74639eccaff66b128950a7ad535f0481abafc88942596de1362bb8180e17a54aaea83f23959aad1f1a0a838c18e68192d6bb956d49677569a5af2c985665b

Download Submit
C:\Windows\System\IWrQWrB.exe

Filesize
2.2MB

MD5
8e1e71456e9fceec86d430a3d32e29b9

SHA1
b8d4acdd0d74a3ca95188696f3bcd23aa46f62ba

SHA256
3dfa1c45f02d10ecc462cedc7270f695ba185d97b24bd86fb654ae858e953d53

SHA512
902369efcb8fde56afc14b479dfe2ea5691bacbe0aec021884c3596fb13b8d5086f8a19043af5dd4e5fb0ff48d5755f95e58268c0431305df28e3fdd5e45b756

Download Submit
C:\Windows\System\IYhJnoB.exe

Filesize
2.2MB

MD5
a0b896cc03a695a9958f5742ca60e564

SHA1
87ff0cd55f1ad3109dd2172c5f2b423185eea515

SHA256
48ba6c1ca31fe3c6e26b2a76bf4e58abe83fad1f2cad37de79de174fb366f528

SHA512
b717b2e0d6babd27f513658710728ebddec8f206a479f79d0a4190792b4c6bfe1348d6e80dd137b3c91ba50786b041c4cc9b73980b50d928fb5691c5d5864103

Download Submit
C:\Windows\System\JDnGFpE.exe

Filesize
2.2MB

MD5
8ebef216970c10e070545701add4ce32

SHA1
039db0f5ec8a35fe73ae8eccb2bb62632acf18a6

SHA256
5eb60d022bc458d69b8b39a4412c99dd1e281c0862fd51557b0bab44b5e4816c

SHA512
4a106eeb4723019fb06696a745af86b24f401723988298533d566b82814e57b7355080439d70d9ebaca75fdaaff90b1dd90e371a05b76d27e8731db4b6cdfccf

Download Submit
C:\Windows\System\KWKjInU.exe

Filesize
2.2MB

MD5
a6f1100d69e9e1fd9a2e42a3601d9ebc

SHA1
93f1d16a9ec91c2251c9775f1a8e323fa4962d7e

SHA256
862475df362e8a9aa15d9a774167c4dd08cca0f4340f383bc5924da14f96a477

SHA512
a536006ad0ae3d2fdf4abc5cde989c9733259e1a23c8273251e375d8377bebfdc9a69b28c39d2ae87f292e15b8452e535c78a86a36e76159bb7de2ea5215c3b4

Download Submit
C:\Windows\System\NcTBuOv.exe

Filesize
2.2MB

MD5
7c29a4fdb0874753e381b6cffbd196ec

SHA1
83e2089247b43265390500367f189b6368b27599

SHA256
59b58f0afd352e3c31c09106952ce5f8fb78b733e0591266c2ea8a2d02ca38fe

SHA512
b91e39718ce38c1b29c168851b0ccddf33a80d1669af0366148d1960d65366c0f1c3e99f14c0c8ea1bdb671e860fac5e1480bdeeb32df2dc286d89885daa34bc

Download Submit
C:\Windows\System\PHZuBsX.exe

Filesize
2.2MB

MD5
38c2e3e8c19615196160a70a0eeb341c

SHA1
53d75d7b4e8ec19b30ef74a7a9d38ec0b8365f99

SHA256
2ed1336e0549537924453eb82d052eca07865e17a01535f55e52ef6b6acd045c

SHA512
c32bc31f121f3ca576e0f4be8a20e8789fe90b7bfc7e0b9f3f753bc8ee63c73300c50669b4bb857c75dcbe84e1a99dd95b34164f56477a7bd2b83746fb532b84

Download Submit
C:\Windows\System\PbKWYwQ.exe

Filesize
2.2MB

MD5
0cc4dabbe4f5d9949599424d40e26b20

SHA1
2dc22e4b51b892b8051ddb750d1091f04824f06d

SHA256
45063f4ff212c4c3df31466c1c57d8d048573a077bb6b18c12c3822ba163a323

SHA512
b4f5cb10bccf8d72e41e42f8af7d9f542140e9499953d17a3c582a8ebfd402a620161c9f9f85a8815a8b8353e2d9bc374943e49715216225d37558130dea085d

Download Submit
C:\Windows\System\VOcuNMp.exe

Filesize
2.2MB

MD5
bc7bd8b7a5222f54224599a23a45d6ed

SHA1
a00f136520c0884f26aef818fe88ec44d8085673

SHA256
b658a87426a2ef68eb634e7db704a0124f03e442657db7949d0bb02a28873319

SHA512
df7508a5741495bb8e8029ea2e0cb2049ddf15906ad42a2296aa8e9d4c24d9fbf4881b6773f2215ca776b15c9e9a476457cf99973a5a025a3f120cfa51356c62

Download Submit
C:\Windows\System\XQDeDQz.exe

Filesize
2.2MB

MD5
743bdef8c5cc38a8f79231e1b96380cf

SHA1
1979a6747ce81c78d5cb4ab4f07ce18da01fa2b3

SHA256
5783a8e09ff00263f70d8c133e7e536aaced9a418ad7135a5aaf82916545467b

SHA512
a73c5ee8318e7d482ce973a5a1e268e422f3b06bb48d71e0ec1139b1e40d0888e51f3e778bab381e566c3424936397e202f4b7cd006f4df4326895eb19173fd5

Download Submit
C:\Windows\System\ZElTSiB.exe

Filesize
2.2MB

MD5
bd2424d3367af9ab38e9e9364af92515

SHA1
f6689031f384968b3a01eadad34f27bfa2e55932

SHA256
bc80f2062dd9d1ad5999ebc7321c56c25d39b5e0112482346090a5767cc21070

SHA512
55e7125aae5631a90176d29aa008d5613e0d9190005499bcf4f6912afd14ed5c11dbd7c9c094626219895d98d5a104d07a7dc576257d724ec48dfcf15cfab0f5

Download Submit
C:\Windows\System\bytriFp.exe

Filesize
2.2MB

MD5
9cda524b315d91e25e8d5042db27ded9

SHA1
717ad0a240c09d19a4888221ca3c7f54408bbfc2

SHA256
4d9d5301d6e83534921c0ed16299283c78e531977ec522a8b6ec17bc8e1c0fa6

SHA512
bd76a8377414a0c36f51b0fcfa228bdda8cae736b5dfebec01b20946ba99976080f6b09059017829005b77fb07a67d78ea004f6560fec9b18d180e15d44c0804

Download Submit
C:\Windows\System\dTWzMwD.exe

Filesize
2.2MB

MD5
2be39ba3a3ea56213b8a9b2d609212b0

SHA1
a892f4b4937ac8cb130500091544a6f85697cf4a

SHA256
ba0b2b946a14b7bc94038a9072df185268352746bf147f1c1c4d7fe647638390

SHA512
5a3fa3b56c4af07bf3d0f5225bde53a3f9ad5d923921a7df793804d2a7b994697f68faa964fa831b93a5550d017042bee27ea141dab949539528dccbf9753bc2

Download Submit
C:\Windows\System\eViYFRD.exe

Filesize
2.2MB

MD5
92dc18e76c29069cc069a324ba3a4124

SHA1
43b507864ab725e3aff456a95af6823c8b5547e1

SHA256
c5af03b7e00558ccd2394f62a4a0075a4191af7691727531020ea5dd67524325

SHA512
6f43587af215f2ce9bd6f1053cb7b1cc3fdedaf97b6c3b85ddfd90acdb01985a306170e24fa3d67bf7b2f9fc09a3f927ff6d611a95091525a9279db1c2ce523c

Download Submit
C:\Windows\System\exKDIOZ.exe

Filesize
2.2MB

MD5
5b1ff45f3166fcd239e6358eebe9c79e

SHA1
ea96fc2533722a4f8ac3feb2ab3c16adcf035fe5

SHA256
eee6cd08057928ad20a48972c18dc47ef652d42cecc3d6b1acaeab9264b55b13

SHA512
895b7c84a0396d09bf6fc22fdb93a821e26ed4807e6cb22e45c8af1d197fe265e5e1d1eefba5ba48c350434f8b5252f1c060957c1e6c7a66a6648ec05e537c93

Download Submit
C:\Windows\System\hfvUHiY.exe

Filesize
2.2MB

MD5
ac0dd07d9882a33f22c27eb47ee935a5

SHA1
c747abb03bf42aa8b9673bcf0d331c48c866f6ff

SHA256
a13f50d003e8d6d94c881d6faee1701f6cdf4989797b348d67618ec15b4817fc

SHA512
6be8f41c2ace1f3199b8badd6661ee1d63954952641e18006a642b9f856c976707e49b4b8da5e60283f741c901c703928b9a85419d629cdf3e334ab48f3f911a

Download Submit
C:\Windows\System\hkZEEjx.exe

Filesize
2.2MB

MD5
2e9b40a130444f5a38544e1996a69080

SHA1
7fa5b17f644b5d116002a3c860e0e9b8b39459c4

SHA256
3a73093d3a17380d9de68b9c2e546cfebdd1669d068fef842d5faa69a457f432

SHA512
6332ee2222b5bbe0780c28b20755b9dd577fa24f8f8a1bd7edfd6f78ae9c0ea50fbd289aeba7b73799f8f8c3a188c4aca9fcc67c0ff6111fbdbc4614e444185c

Download Submit
C:\Windows\System\hvFOsNA.exe

Filesize
2.2MB

MD5
b2ad238d4dd8a6c2f36ee6137c505277

SHA1
096346ea0312e7653984d17c7ab248a7b6e71299

SHA256
3f52fdf5e2155a8374cdc960382ab927770df3076d969a68853191d5147fb4c4

SHA512
f6aea3061bf6f002840dec08fd340c5cdbbe5b27d78c8cba8bd92446cefb94d0eae1818ecf1bbf063dc55c09b78b9dcee3855ac18f58ded9157d32eb442a6cdb

Download Submit
C:\Windows\System\jCoADTP.exe

Filesize
2.2MB

MD5
4f04edd7b4fa7b242f84c931e9cdc452

SHA1
798e6dc9e87f4d1d754e695f3170bea9751e6834

SHA256
e94776aa00704818e28447ed31cb2344d4f18d3c9a2506a3114ba14a9b1baa9a

SHA512
049c7c2c7c70631f5665602ec48680e8c061aaf1020d8cee5658f7987b9ebca09db4b6ded6f1f523c939dc0d6e4d0960ee01be60d9747d4e5f87444d1dc3aa2b

Download Submit
C:\Windows\System\kfOzgPk.exe

Filesize
2.2MB

MD5
417667978591484817ef21e0a7656e28

SHA1
d9f1adf11389fa449373f13d07d2d8a17a85d3c0

SHA256
1a76375cd3c2ce4648dbcb2a5fe1243aa9bd3c56bc215e72852ff1f5d0c75d82

SHA512
055dcfa9ae73e22c251295b3446df02a4f5f9a9ff0b30f41548ca506031bb301bd232db7c15944e590a4925d96ca74058a6087e180957577e2fb9afa2f8bb8e1

Download Submit
C:\Windows\System\lFNJWYh.exe

Filesize
2.2MB

MD5
1d58c6f5ed2fd3ef1e083533e7a20e4b

SHA1
165d932c806ad45f500d27a738df405135f516d9

SHA256
36fc882cc1bedb8bb750518c54dbc741201f78bc4529ce86a9cdd95c07fd8b34

SHA512
e35f7cd9e6d1c168df3acd2967ef6d3999f0225e21289772b94cf2f66d6d464746ac8a1f156bf07e98f307ac3d68be4c32906f6d383216b51969c98d5f72988c

Download Submit
C:\Windows\System\mNpEdHF.exe

Filesize
2.2MB

MD5
6f08452a74070ee76ddfa9f6961a5745

SHA1
f9b2db3fd61b73a2437a17f5ebd4bbed4951065b

SHA256
3f95c618ccc31807ad703dbf1a1a684ec0d636ce20b996b677b4e2fbcb172da4

SHA512
36ae62b8d48b410d1f462b89804242a1ba8d43a87a6e7d8a2704bc7f23956e80c4aae15a73a5d5b46625e5e28189561a61e9438fff5d620c42f0740d09fbac82

Download Submit
C:\Windows\System\qSXljhh.exe

Filesize
2.2MB

MD5
0f651dbc01c5888a9b11b2e2767c194a

SHA1
9684f1ababb67342794e9e6bc71a0d8730866943

SHA256
219727d2c734c0ef714215ec494567c02ee04d3aa7c7e074a771ccfcaaf95653

SHA512
a92345cfaa919c01c3d31fa7194f4b2515c5f86e61574819c8b58f7456699e5a37ebdc25f47d7102bde21dc402e918c6ce7cb780341dbc90da97cdaaf8b48dd5

Download Submit
C:\Windows\System\rmTkxdR.exe

Filesize
2.2MB

MD5
1e11bb060ab9ae7275e0bd95a4daec8c

SHA1
63d2d43a336db05072191ed3810bb8c9bfa1a0f2

SHA256
b7facb6a22b3161a6e23c30f9e096b5411a21e5034ae430891647146d15ab539

SHA512
73932b443fd0a786a3782851236b462c017d63d1160e6720b3193d7e97c67a7aa81dbe442cf1aac02a7a03fd82e820e4d4c2d16391a9a61b864c28f1160d0bd2

Download Submit
C:\Windows\System\svFPzaC.exe

Filesize
2.2MB

MD5
f5177ac82f87f3dfec31c75434ca9a37

SHA1
54a6bea18a2a30fb6366bea7eefac0d612ae61b0

SHA256
2990ee6b59b649319e0b500eb2a4c37f37f5d2ff3ae2416946606a18ebd2e246

SHA512
4c33f7e2de5bdd7ff3c251bf10034dbed70597bad60368a6a2e94fec9f03b1caeeb333854bad985f0fbf8754befe99b935450d3a409be4abd8db359dc2c8a538

Download Submit
C:\Windows\System\tTbUYvM.exe

Filesize
2.2MB

MD5
95c4d47724391aa9fa120be0e512802d

SHA1
dfad2e88a0fd1edd11bd984160248dd569b786dd

SHA256
8ffa04e213f8423e09d0aeea8f9dff8936bd02bd4ef05baab6d0ef9a3f550158

SHA512
cc5733bc17a4b15e03b81099eaf5de3938afef4d45ff7c3cf6bc7d1b410f1dd89b7adb2c7c511103235785f0093b98a48458bdefdcc557bb5e9084d582b02000

Download Submit
C:\Windows\System\uMpYEPZ.exe

Filesize
2.2MB

MD5
934b7dc2b6e6f61fe2e4275208077f61

SHA1
365b74fe07bb6b4365566f2127744371f9a499a5

SHA256
fb990cd45e5b7e443c3e591d677a59cd5b4329f8e9f98f8dc07c14ab6f7f75d2

SHA512
bf1a2ddf16648e3b49c4347e9db15e8dc428c147a2459d710f5d25baddb651922a5d99d86b365f641a753c15e0983ef3c9d8a5f84ba514c7b17086edffc48c3a

Download Submit
C:\Windows\System\xZYIHad.exe

Filesize
2.2MB

MD5
bf4fc4177c05384db88ed4f963c5e7d5

SHA1
96fb766e642409a8f22c55bec2d2e607923755de

SHA256
9082774d56c7be6202637b933805fdd02b9bdb4f8747e52c9b0038e03559e309

SHA512
334cf632022449edc3afcf7c5cfe7c554ab0f22c8b31f3485961eac5b6a7571d802ed1a362a8d0fa21fca3e7fd619b8095333c83f4f625db83e68af9fe7dd22f

Download Submit
C:\Windows\System\zYVrodE.exe

Filesize
2.2MB

MD5
2b34af5ca1b31750a09b4c8b399a272b

SHA1
dc3eb81f69cc199e52f7fb77c4432ca0310ce067

SHA256
61a01e678f47fe14a0072cbcfca9c1441b61a0f55d3c7881ad49fe7c89522dce

SHA512
9e5afb9464032beb0595d1819c11213b6d8abb9bcb9fb68dd566d918c41f444fb0360622e96e757c14fea140de5cc62878346562187632fa93348af12a245877

Download Submit
memory/316-154-0x00007FF7A2AF0000-0x00007FF7A2E44000-memory.dmp

Filesize
3.3MB

Download
memory/316-2098-0x00007FF7A2AF0000-0x00007FF7A2E44000-memory.dmp

Filesize
3.3MB

Download
memory/388-2084-0x00007FF6DE890000-0x00007FF6DEBE4000-memory.dmp

Filesize
3.3MB

Download
memory/388-161-0x00007FF6DE890000-0x00007FF6DEBE4000-memory.dmp

Filesize
3.3MB

Download
memory/760-2076-0x00007FF697D30000-0x00007FF698084000-memory.dmp

Filesize
3.3MB

Download
memory/760-113-0x00007FF697D30000-0x00007FF698084000-memory.dmp

Filesize
3.3MB

Download
memory/1180-159-0x00007FF780400000-0x00007FF780754000-memory.dmp

Filesize
3.3MB

Download
memory/1180-2091-0x00007FF780400000-0x00007FF780754000-memory.dmp

Filesize
3.3MB

Download
memory/1888-134-0x00007FF7871D0000-0x00007FF787524000-memory.dmp

Filesize
3.3MB

Download
memory/1888-2082-0x00007FF7871D0000-0x00007FF787524000-memory.dmp

Filesize
3.3MB

Download
memory/1992-2078-0x00007FF7FEC30000-0x00007FF7FEF84000-memory.dmp

Filesize
3.3MB

Download
memory/1992-82-0x00007FF7FEC30000-0x00007FF7FEF84000-memory.dmp

Filesize
3.3MB

Download
memory/2244-2097-0x00007FF6EF1C0000-0x00007FF6EF514000-memory.dmp

Filesize
3.3MB

Download
memory/2244-175-0x00007FF6EF1C0000-0x00007FF6EF514000-memory.dmp

Filesize
3.3MB

Download
memory/2308-145-0x00007FF74B0C0000-0x00007FF74B414000-memory.dmp

Filesize
3.3MB

Download
memory/2308-2079-0x00007FF74B0C0000-0x00007FF74B414000-memory.dmp

Filesize
3.3MB

Download
memory/2532-2071-0x00007FF62EBD0000-0x00007FF62EF24000-memory.dmp

Filesize
3.3MB

Download
memory/2532-8-0x00007FF62EBD0000-0x00007FF62EF24000-memory.dmp

Filesize
3.3MB

Download
memory/2540-2068-0x00007FF72A4F0000-0x00007FF72A844000-memory.dmp

Filesize
3.3MB

Download
memory/2540-55-0x00007FF72A4F0000-0x00007FF72A844000-memory.dmp

Filesize
3.3MB

Download
memory/2540-2075-0x00007FF72A4F0000-0x00007FF72A844000-memory.dmp

Filesize
3.3MB

Download
memory/2560-2074-0x00007FF624A10000-0x00007FF624D64000-memory.dmp

Filesize
3.3MB

Download
memory/2560-172-0x00007FF624A10000-0x00007FF624D64000-memory.dmp

Filesize
3.3MB

Download
memory/2728-2080-0x00007FF7B8730000-0x00007FF7B8A84000-memory.dmp

Filesize
3.3MB

Download
memory/2728-162-0x00007FF7B8730000-0x00007FF7B8A84000-memory.dmp

Filesize
3.3MB

Download
memory/2904-2099-0x00007FF674D70000-0x00007FF6750C4000-memory.dmp

Filesize
3.3MB

Download
memory/2904-174-0x00007FF674D70000-0x00007FF6750C4000-memory.dmp

Filesize
3.3MB

Download
memory/3000-2073-0x00007FF7BFFD0000-0x00007FF7C0324000-memory.dmp

Filesize
3.3MB

Download
memory/3000-2070-0x00007FF7BFFD0000-0x00007FF7C0324000-memory.dmp

Filesize
3.3MB

Download
memory/3000-40-0x00007FF7BFFD0000-0x00007FF7C0324000-memory.dmp

Filesize
3.3MB

Download
memory/3068-163-0x00007FF759E70000-0x00007FF75A1C4000-memory.dmp

Filesize
3.3MB

Download
memory/3068-2089-0x00007FF759E70000-0x00007FF75A1C4000-memory.dmp

Filesize
3.3MB

Download
memory/3088-2090-0x00007FF729CB0000-0x00007FF72A004000-memory.dmp

Filesize
3.3MB

Download
memory/3088-176-0x00007FF729CB0000-0x00007FF72A004000-memory.dmp

Filesize
3.3MB

Download
memory/3460-170-0x00007FF705E80000-0x00007FF7061D4000-memory.dmp

Filesize
3.3MB

Download
memory/3460-2087-0x00007FF705E80000-0x00007FF7061D4000-memory.dmp

Filesize
3.3MB

Download
memory/3492-2088-0x00007FF7D14A0000-0x00007FF7D17F4000-memory.dmp

Filesize
3.3MB

Download
memory/3492-171-0x00007FF7D14A0000-0x00007FF7D17F4000-memory.dmp

Filesize
3.3MB

Download
memory/3548-164-0x00007FF6514C0000-0x00007FF651814000-memory.dmp

Filesize
3.3MB

Download
memory/3548-2096-0x00007FF6514C0000-0x00007FF651814000-memory.dmp

Filesize
3.3MB

Download
memory/3688-167-0x00007FF7CA510000-0x00007FF7CA864000-memory.dmp

Filesize
3.3MB

Download
memory/3688-2094-0x00007FF7CA510000-0x00007FF7CA864000-memory.dmp

Filesize
3.3MB

Download
memory/3696-2077-0x00007FF7B6560000-0x00007FF7B68B4000-memory.dmp

Filesize
3.3MB

Download
memory/3696-2069-0x00007FF7B6560000-0x00007FF7B68B4000-memory.dmp

Filesize
3.3MB

Download
memory/3696-62-0x00007FF7B6560000-0x00007FF7B68B4000-memory.dmp

Filesize
3.3MB

Download
memory/4008-165-0x00007FF7293B0000-0x00007FF729704000-memory.dmp

Filesize
3.3MB

Download
memory/4008-2086-0x00007FF7293B0000-0x00007FF729704000-memory.dmp

Filesize
3.3MB

Download
memory/4108-2083-0x00007FF7F2020000-0x00007FF7F2374000-memory.dmp

Filesize
3.3MB

Download
memory/4108-135-0x00007FF7F2020000-0x00007FF7F2374000-memory.dmp

Filesize
3.3MB

Download
memory/4412-169-0x00007FF708B80000-0x00007FF708ED4000-memory.dmp

Filesize
3.3MB

Download
memory/4412-2092-0x00007FF708B80000-0x00007FF708ED4000-memory.dmp

Filesize
3.3MB

Download
memory/4492-2066-0x00007FF603740000-0x00007FF603A94000-memory.dmp

Filesize
3.3MB

Download
memory/4492-1-0x000002B475510000-0x000002B475520000-memory.dmp

Filesize
64KB

Download
memory/4492-0-0x00007FF603740000-0x00007FF603A94000-memory.dmp

Filesize
3.3MB

Download
memory/4532-2072-0x00007FF7CE040000-0x00007FF7CE394000-memory.dmp

Filesize
3.3MB

Download
memory/4532-2067-0x00007FF7CE040000-0x00007FF7CE394000-memory.dmp

Filesize
3.3MB

Download
memory/4532-20-0x00007FF7CE040000-0x00007FF7CE394000-memory.dmp

Filesize
3.3MB

Download
memory/4564-2095-0x00007FF704590000-0x00007FF7048E4000-memory.dmp

Filesize
3.3MB

Download
memory/4564-166-0x00007FF704590000-0x00007FF7048E4000-memory.dmp

Filesize
3.3MB

Download
memory/4912-2093-0x00007FF6C8450000-0x00007FF6C87A4000-memory.dmp

Filesize
3.3MB

Download
memory/4912-168-0x00007FF6C8450000-0x00007FF6C87A4000-memory.dmp

Filesize
3.3MB

Download
memory/5048-2081-0x00007FF7E09E0000-0x00007FF7E0D34000-memory.dmp

Filesize
3.3MB

Download
memory/5048-173-0x00007FF7E09E0000-0x00007FF7E0D34000-memory.dmp

Filesize
3.3MB

Download
memory/5100-160-0x00007FF761110000-0x00007FF761464000-memory.dmp

Filesize
3.3MB

Download
memory/5100-2085-0x00007FF761110000-0x00007FF761464000-memory.dmp

Filesize
3.3MB

Download