xmrig | 0932954f1044b09830955eb375f2659e3a9eb7480682d86bcdf830832e29914e

Analysis

max time kernel
137s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
Size

2.1MB
MD5

bc6c54617c0acbe97b16864d039801c0
SHA1

0c38b93f3cd7f94dc7c8f153fbdfef11f585ff1c
SHA256

0932954f1044b09830955eb375f2659e3a9eb7480682d86bcdf830832e29914e
SHA512

7445d2829bb24e6c7503d8343351341f2ab04684f491a4af61608269e8f682eb6c12f6192040a991e182a2da24df019dfe8899d6693949574c77cd1921567f78
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmSd7Df3rR6ousH:BemTLkNdfE0pZr4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4904-0-0x00007FF6F21F0000-0x00007FF6F2544000-memory.dmp	xmrig
behavioral2/files/0x000c000000023b90-11.dat	xmrig
behavioral2/files/0x000a000000023b9e-20.dat	xmrig
behavioral2/files/0x000a000000023b9f-21.dat	xmrig
behavioral2/files/0x000a000000023ba1-32.dat	xmrig
behavioral2/files/0x000a000000023ba2-39.dat	xmrig
behavioral2/memory/5048-44-0x00007FF6C1560000-0x00007FF6C18B4000-memory.dmp	xmrig
behavioral2/memory/400-58-0x00007FF7E1A00000-0x00007FF7E1D54000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba5-62.dat	xmrig
behavioral2/memory/4640-65-0x00007FF6CA890000-0x00007FF6CABE4000-memory.dmp	xmrig
behavioral2/memory/3620-68-0x00007FF6E2BE0000-0x00007FF6E2F34000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba6-71.dat	xmrig
behavioral2/files/0x000a000000023ba7-79.dat	xmrig
behavioral2/files/0x000a000000023baa-89.dat	xmrig
behavioral2/files/0x000a000000023bad-110.dat	xmrig
behavioral2/files/0x000a000000023bb0-125.dat	xmrig
behavioral2/files/0x000a000000023bb3-140.dat	xmrig
behavioral2/files/0x000a000000023bb8-165.dat	xmrig
behavioral2/memory/1396-322-0x00007FF6D6360000-0x00007FF6D66B4000-memory.dmp	xmrig
behavioral2/memory/1780-323-0x00007FF70C0F0000-0x00007FF70C444000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bbb-174.dat	xmrig
behavioral2/files/0x000a000000023bb9-170.dat	xmrig
behavioral2/files/0x000a000000023bba-169.dat	xmrig
behavioral2/files/0x000a000000023bb7-160.dat	xmrig
behavioral2/files/0x000a000000023bb6-155.dat	xmrig
behavioral2/files/0x000a000000023bb5-150.dat	xmrig
behavioral2/files/0x000a000000023bb4-145.dat	xmrig
behavioral2/files/0x000a000000023bb2-135.dat	xmrig
behavioral2/files/0x000a000000023bb1-130.dat	xmrig
behavioral2/files/0x000a000000023baf-119.dat	xmrig
behavioral2/files/0x000a000000023bae-115.dat	xmrig
behavioral2/files/0x000a000000023bac-104.dat	xmrig
behavioral2/files/0x000a000000023bab-100.dat	xmrig
behavioral2/files/0x000a000000023ba9-90.dat	xmrig
behavioral2/files/0x000a000000023ba8-85.dat	xmrig
behavioral2/memory/2888-63-0x00007FF76B1F0000-0x00007FF76B544000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba3-61.dat	xmrig
behavioral2/files/0x000a000000023ba4-60.dat	xmrig
behavioral2/memory/4388-59-0x00007FF79BB10000-0x00007FF79BE64000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba0-47.dat	xmrig
behavioral2/files/0x000a000000023b9d-42.dat	xmrig
behavioral2/memory/4916-37-0x00007FF60E2E0000-0x00007FF60E634000-memory.dmp	xmrig
behavioral2/memory/3336-33-0x00007FF7CD4F0000-0x00007FF7CD844000-memory.dmp	xmrig
behavioral2/memory/5044-26-0x00007FF685900000-0x00007FF685C54000-memory.dmp	xmrig
behavioral2/memory/1388-23-0x00007FF7240B0000-0x00007FF724404000-memory.dmp	xmrig
behavioral2/files/0x000c000000023b40-18.dat	xmrig
behavioral2/memory/1552-15-0x00007FF6EC040000-0x00007FF6EC394000-memory.dmp	xmrig
behavioral2/memory/2436-324-0x00007FF743B10000-0x00007FF743E64000-memory.dmp	xmrig
behavioral2/memory/4028-326-0x00007FF7F3FC0000-0x00007FF7F4314000-memory.dmp	xmrig
behavioral2/memory/2344-327-0x00007FF776010000-0x00007FF776364000-memory.dmp	xmrig
behavioral2/memory/4772-328-0x00007FF7F51F0000-0x00007FF7F5544000-memory.dmp	xmrig
behavioral2/memory/4564-325-0x00007FF759290000-0x00007FF7595E4000-memory.dmp	xmrig
behavioral2/memory/4608-333-0x00007FF7DBE30000-0x00007FF7DC184000-memory.dmp	xmrig
behavioral2/memory/1812-336-0x00007FF7EA1D0000-0x00007FF7EA524000-memory.dmp	xmrig
behavioral2/memory/3764-340-0x00007FF656EA0000-0x00007FF6571F4000-memory.dmp	xmrig
behavioral2/memory/2984-343-0x00007FF792290000-0x00007FF7925E4000-memory.dmp	xmrig
behavioral2/memory/640-368-0x00007FF7C16B0000-0x00007FF7C1A04000-memory.dmp	xmrig
behavioral2/memory/2012-365-0x00007FF66ADA0000-0x00007FF66B0F4000-memory.dmp	xmrig
behavioral2/memory/2520-359-0x00007FF658F10000-0x00007FF659264000-memory.dmp	xmrig
behavioral2/memory/3944-356-0x00007FF6BF750000-0x00007FF6BFAA4000-memory.dmp	xmrig
behavioral2/memory/1116-353-0x00007FF778DD0000-0x00007FF779124000-memory.dmp	xmrig
behavioral2/memory/1776-349-0x00007FF724940000-0x00007FF724C94000-memory.dmp	xmrig
behavioral2/memory/3224-346-0x00007FF69A2E0000-0x00007FF69A634000-memory.dmp	xmrig
behavioral2/memory/4904-2114-0x00007FF6F21F0000-0x00007FF6F2544000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1552	EWtiyzU.exe
1388	QKKaPZF.exe
5048	qpcNYCV.exe
5044	lQyMbHi.exe
3336	NvwutWu.exe
400	nXXsSoj.exe
4916	dNUqKJw.exe
4640	mFzGPao.exe
3620	jfUULrE.exe
4388	rOsCCKj.exe
2888	xGpvpzS.exe
1396	nqUzXjS.exe
1780	ooooydA.exe
2436	lKvxwVT.exe
4564	HXdqNRV.exe
4028	SCYQTgy.exe
2344	vahxvEH.exe
4772	nPfvZrN.exe
4608	NocnVRH.exe
1812	AtrXxmC.exe
3764	QfPovgj.exe
2984	lOpZgSl.exe
3224	tqrJZlI.exe
1776	UXQHVxQ.exe
1116	LqSiJxj.exe
3944	gSyHqHT.exe
2520	ulCnaaO.exe
2012	MngEHFk.exe
640	HeJYrPi.exe
2948	DcxVwZA.exe
3740	hiBycNh.exe
4980	quXJtCZ.exe
3420	lpBSQUV.exe
1088	nOvovyD.exe
2496	vftEuDe.exe
4468	MfBymAh.exe
4124	sULxwuu.exe
1988	EHGdmHt.exe
4712	pOwHeFB.exe
2696	qZnDrOr.exe
2516	ftxkiNm.exe
3836	TxiGWjB.exe
888	GruVCaF.exe
4684	SiBhWSD.exe
3128	wgrVMss.exe
4588	ONNKfWU.exe
264	DaXNFJt.exe
4244	jsuEqSB.exe
2204	JzYXwwA.exe
2100	dFYuagD.exe
4524	uDtDIPw.exe
1504	VyQSogP.exe
4092	LVRJjiw.exe
5064	iIsYLpH.exe
3252	clEgHfL.exe
536	AhnebMr.exe
992	AMHzMya.exe
808	EZUVaic.exe
1660	fjgJCrZ.exe
1956	wwOOtVi.exe
2512	OQkRTGi.exe
4404	kdpkxSI.exe
3412	iCnDvAx.exe
2444	cipduFB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4904-0-0x00007FF6F21F0000-0x00007FF6F2544000-memory.dmp	upx
behavioral2/files/0x000c000000023b90-11.dat	upx
behavioral2/files/0x000a000000023b9e-20.dat	upx
behavioral2/files/0x000a000000023b9f-21.dat	upx
behavioral2/files/0x000a000000023ba1-32.dat	upx
behavioral2/files/0x000a000000023ba2-39.dat	upx
behavioral2/memory/5048-44-0x00007FF6C1560000-0x00007FF6C18B4000-memory.dmp	upx
behavioral2/memory/400-58-0x00007FF7E1A00000-0x00007FF7E1D54000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-62.dat	upx
behavioral2/memory/4640-65-0x00007FF6CA890000-0x00007FF6CABE4000-memory.dmp	upx
behavioral2/memory/3620-68-0x00007FF6E2BE0000-0x00007FF6E2F34000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-71.dat	upx
behavioral2/files/0x000a000000023ba7-79.dat	upx
behavioral2/files/0x000a000000023baa-89.dat	upx
behavioral2/files/0x000a000000023bad-110.dat	upx
behavioral2/files/0x000a000000023bb0-125.dat	upx
behavioral2/files/0x000a000000023bb3-140.dat	upx
behavioral2/files/0x000a000000023bb8-165.dat	upx
behavioral2/memory/1396-322-0x00007FF6D6360000-0x00007FF6D66B4000-memory.dmp	upx
behavioral2/memory/1780-323-0x00007FF70C0F0000-0x00007FF70C444000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-174.dat	upx
behavioral2/files/0x000a000000023bb9-170.dat	upx
behavioral2/files/0x000a000000023bba-169.dat	upx
behavioral2/files/0x000a000000023bb7-160.dat	upx
behavioral2/files/0x000a000000023bb6-155.dat	upx
behavioral2/files/0x000a000000023bb5-150.dat	upx
behavioral2/files/0x000a000000023bb4-145.dat	upx
behavioral2/files/0x000a000000023bb2-135.dat	upx
behavioral2/files/0x000a000000023bb1-130.dat	upx
behavioral2/files/0x000a000000023baf-119.dat	upx
behavioral2/files/0x000a000000023bae-115.dat	upx
behavioral2/files/0x000a000000023bac-104.dat	upx
behavioral2/files/0x000a000000023bab-100.dat	upx
behavioral2/files/0x000a000000023ba9-90.dat	upx
behavioral2/files/0x000a000000023ba8-85.dat	upx
behavioral2/memory/2888-63-0x00007FF76B1F0000-0x00007FF76B544000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-61.dat	upx
behavioral2/files/0x000a000000023ba4-60.dat	upx
behavioral2/memory/4388-59-0x00007FF79BB10000-0x00007FF79BE64000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-47.dat	upx
behavioral2/files/0x000a000000023b9d-42.dat	upx
behavioral2/memory/4916-37-0x00007FF60E2E0000-0x00007FF60E634000-memory.dmp	upx
behavioral2/memory/3336-33-0x00007FF7CD4F0000-0x00007FF7CD844000-memory.dmp	upx
behavioral2/memory/5044-26-0x00007FF685900000-0x00007FF685C54000-memory.dmp	upx
behavioral2/memory/1388-23-0x00007FF7240B0000-0x00007FF724404000-memory.dmp	upx
behavioral2/files/0x000c000000023b40-18.dat	upx
behavioral2/memory/1552-15-0x00007FF6EC040000-0x00007FF6EC394000-memory.dmp	upx
behavioral2/memory/2436-324-0x00007FF743B10000-0x00007FF743E64000-memory.dmp	upx
behavioral2/memory/4028-326-0x00007FF7F3FC0000-0x00007FF7F4314000-memory.dmp	upx
behavioral2/memory/2344-327-0x00007FF776010000-0x00007FF776364000-memory.dmp	upx
behavioral2/memory/4772-328-0x00007FF7F51F0000-0x00007FF7F5544000-memory.dmp	upx
behavioral2/memory/4564-325-0x00007FF759290000-0x00007FF7595E4000-memory.dmp	upx
behavioral2/memory/4608-333-0x00007FF7DBE30000-0x00007FF7DC184000-memory.dmp	upx
behavioral2/memory/1812-336-0x00007FF7EA1D0000-0x00007FF7EA524000-memory.dmp	upx
behavioral2/memory/3764-340-0x00007FF656EA0000-0x00007FF6571F4000-memory.dmp	upx
behavioral2/memory/2984-343-0x00007FF792290000-0x00007FF7925E4000-memory.dmp	upx
behavioral2/memory/640-368-0x00007FF7C16B0000-0x00007FF7C1A04000-memory.dmp	upx
behavioral2/memory/2012-365-0x00007FF66ADA0000-0x00007FF66B0F4000-memory.dmp	upx
behavioral2/memory/2520-359-0x00007FF658F10000-0x00007FF659264000-memory.dmp	upx
behavioral2/memory/3944-356-0x00007FF6BF750000-0x00007FF6BFAA4000-memory.dmp	upx
behavioral2/memory/1116-353-0x00007FF778DD0000-0x00007FF779124000-memory.dmp	upx
behavioral2/memory/1776-349-0x00007FF724940000-0x00007FF724C94000-memory.dmp	upx
behavioral2/memory/3224-346-0x00007FF69A2E0000-0x00007FF69A634000-memory.dmp	upx
behavioral2/memory/4904-2114-0x00007FF6F21F0000-0x00007FF6F2544000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NocnVRH.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\GgFXogL.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\icqGMsx.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\zGmCwgZ.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\WJRaSjE.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\wvLfVuJ.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\PxODtul.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\UVlUvOS.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\ZhEFMJV.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\kVBCTTp.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\UuZEhxC.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\RTHpkJK.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\ftVOKXO.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\orIFtJw.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\GhEMkPx.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\IhgxLQz.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\xDENXfp.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\otEqLqz.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\fjgJCrZ.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\TiaKObv.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\DGmteAs.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\OuiAQTv.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\OQkRTGi.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\dDafZta.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\UIajvRj.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\AMHzMya.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\NyICGwT.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\LfuBtLN.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\FKZisrz.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\XUUBOwn.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\PgguLoC.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\dNGppQH.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\WeqACcw.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\rbMlPYa.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\EKxdMxj.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\fvNLefr.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\nWBrWCy.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\WSickNd.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\GgziuNX.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\LENZDBy.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\ARfpNOl.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\AhQgwZe.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\ulCnaaO.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\qRoPbfG.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\zraqmcn.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\tjGddZC.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\jSwGVaL.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\uDtDIPw.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\SycbtZW.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\IOeRkWp.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\ODpSmyC.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\dtcJlta.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\yotLFMv.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\OSVMuvJ.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\kydEShY.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\CveQtxG.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\pPsVQvt.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\kWpAYmB.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\EDEkHWr.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\mdQylZR.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\qpcNYCV.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\SnOrfSn.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\hesKPSB.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
File created	C:\Windows\System\TonUSbR.exe	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1552	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	85
PID 4904 wrote to memory of 1552	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	85
PID 4904 wrote to memory of 1388	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	86
PID 4904 wrote to memory of 1388	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	86
PID 4904 wrote to memory of 3336	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	87
PID 4904 wrote to memory of 3336	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	87
PID 4904 wrote to memory of 5048	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	88
PID 4904 wrote to memory of 5048	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	88
PID 4904 wrote to memory of 5044	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	89
PID 4904 wrote to memory of 5044	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	89
PID 4904 wrote to memory of 400	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	90
PID 4904 wrote to memory of 400	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	90
PID 4904 wrote to memory of 4916	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	91
PID 4904 wrote to memory of 4916	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	91
PID 4904 wrote to memory of 4640	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	92
PID 4904 wrote to memory of 4640	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	92
PID 4904 wrote to memory of 4388	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	93
PID 4904 wrote to memory of 4388	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	93
PID 4904 wrote to memory of 3620	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	94
PID 4904 wrote to memory of 3620	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	94
PID 4904 wrote to memory of 2888	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	95
PID 4904 wrote to memory of 2888	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	95
PID 4904 wrote to memory of 1396	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	96
PID 4904 wrote to memory of 1396	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	96
PID 4904 wrote to memory of 1780	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	97
PID 4904 wrote to memory of 1780	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	97
PID 4904 wrote to memory of 2436	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	98
PID 4904 wrote to memory of 2436	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	98
PID 4904 wrote to memory of 4564	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	99
PID 4904 wrote to memory of 4564	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	99
PID 4904 wrote to memory of 4028	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	100
PID 4904 wrote to memory of 4028	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	100
PID 4904 wrote to memory of 2344	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	101
PID 4904 wrote to memory of 2344	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	101
PID 4904 wrote to memory of 4772	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	102
PID 4904 wrote to memory of 4772	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	102
PID 4904 wrote to memory of 4608	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	103
PID 4904 wrote to memory of 4608	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	103
PID 4904 wrote to memory of 1812	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	104
PID 4904 wrote to memory of 1812	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	104
PID 4904 wrote to memory of 3764	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	105
PID 4904 wrote to memory of 3764	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	105
PID 4904 wrote to memory of 2984	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	106
PID 4904 wrote to memory of 2984	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	106
PID 4904 wrote to memory of 3224	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	107
PID 4904 wrote to memory of 3224	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	107
PID 4904 wrote to memory of 1776	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	108
PID 4904 wrote to memory of 1776	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	108
PID 4904 wrote to memory of 1116	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	109
PID 4904 wrote to memory of 1116	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	109
PID 4904 wrote to memory of 3944	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	110
PID 4904 wrote to memory of 3944	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	110
PID 4904 wrote to memory of 2520	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	111
PID 4904 wrote to memory of 2520	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	111
PID 4904 wrote to memory of 2012	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	112
PID 4904 wrote to memory of 2012	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	112
PID 4904 wrote to memory of 640	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	113
PID 4904 wrote to memory of 640	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	113
PID 4904 wrote to memory of 2948	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	114
PID 4904 wrote to memory of 2948	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	114
PID 4904 wrote to memory of 3740	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	115
PID 4904 wrote to memory of 3740	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	115
PID 4904 wrote to memory of 4980	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	116
PID 4904 wrote to memory of 4980	4904	bc6c54617c0acbe97b16864d039801c0_NEIKI.exe	116

C:\Users\Admin\AppData\Local\Temp\bc6c54617c0acbe97b16864d039801c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\bc6c54617c0acbe97b16864d039801c0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\System\EWtiyzU.exe
  C:\Windows\System\EWtiyzU.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\QKKaPZF.exe
  C:\Windows\System\QKKaPZF.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\NvwutWu.exe
  C:\Windows\System\NvwutWu.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\qpcNYCV.exe
  C:\Windows\System\qpcNYCV.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\lQyMbHi.exe
  C:\Windows\System\lQyMbHi.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\nXXsSoj.exe
  C:\Windows\System\nXXsSoj.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\dNUqKJw.exe
  C:\Windows\System\dNUqKJw.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\mFzGPao.exe
  C:\Windows\System\mFzGPao.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\rOsCCKj.exe
  C:\Windows\System\rOsCCKj.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\jfUULrE.exe
  C:\Windows\System\jfUULrE.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\xGpvpzS.exe
  C:\Windows\System\xGpvpzS.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\nqUzXjS.exe
  C:\Windows\System\nqUzXjS.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\ooooydA.exe
  C:\Windows\System\ooooydA.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\lKvxwVT.exe
  C:\Windows\System\lKvxwVT.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\HXdqNRV.exe
  C:\Windows\System\HXdqNRV.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\SCYQTgy.exe
  C:\Windows\System\SCYQTgy.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\vahxvEH.exe
  C:\Windows\System\vahxvEH.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\nPfvZrN.exe
  C:\Windows\System\nPfvZrN.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\NocnVRH.exe
  C:\Windows\System\NocnVRH.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\AtrXxmC.exe
  C:\Windows\System\AtrXxmC.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\QfPovgj.exe
  C:\Windows\System\QfPovgj.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\lOpZgSl.exe
  C:\Windows\System\lOpZgSl.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\tqrJZlI.exe
  C:\Windows\System\tqrJZlI.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\UXQHVxQ.exe
  C:\Windows\System\UXQHVxQ.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\LqSiJxj.exe
  C:\Windows\System\LqSiJxj.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\gSyHqHT.exe
  C:\Windows\System\gSyHqHT.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\ulCnaaO.exe
  C:\Windows\System\ulCnaaO.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\MngEHFk.exe
  C:\Windows\System\MngEHFk.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\HeJYrPi.exe
  C:\Windows\System\HeJYrPi.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\DcxVwZA.exe
  C:\Windows\System\DcxVwZA.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\hiBycNh.exe
  C:\Windows\System\hiBycNh.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\quXJtCZ.exe
  C:\Windows\System\quXJtCZ.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\lpBSQUV.exe
  C:\Windows\System\lpBSQUV.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\nOvovyD.exe
  C:\Windows\System\nOvovyD.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\vftEuDe.exe
  C:\Windows\System\vftEuDe.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\MfBymAh.exe
  C:\Windows\System\MfBymAh.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\sULxwuu.exe
  C:\Windows\System\sULxwuu.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\EHGdmHt.exe
  C:\Windows\System\EHGdmHt.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\pOwHeFB.exe
  C:\Windows\System\pOwHeFB.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\qZnDrOr.exe
  C:\Windows\System\qZnDrOr.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ftxkiNm.exe
  C:\Windows\System\ftxkiNm.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\TxiGWjB.exe
  C:\Windows\System\TxiGWjB.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\GruVCaF.exe
  C:\Windows\System\GruVCaF.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\SiBhWSD.exe
  C:\Windows\System\SiBhWSD.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\wgrVMss.exe
  C:\Windows\System\wgrVMss.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\ONNKfWU.exe
  C:\Windows\System\ONNKfWU.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\DaXNFJt.exe
  C:\Windows\System\DaXNFJt.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\jsuEqSB.exe
  C:\Windows\System\jsuEqSB.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\JzYXwwA.exe
  C:\Windows\System\JzYXwwA.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\dFYuagD.exe
  C:\Windows\System\dFYuagD.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\uDtDIPw.exe
  C:\Windows\System\uDtDIPw.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\VyQSogP.exe
  C:\Windows\System\VyQSogP.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\LVRJjiw.exe
  C:\Windows\System\LVRJjiw.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\iIsYLpH.exe
  C:\Windows\System\iIsYLpH.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\clEgHfL.exe
  C:\Windows\System\clEgHfL.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\AhnebMr.exe
  C:\Windows\System\AhnebMr.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\AMHzMya.exe
  C:\Windows\System\AMHzMya.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\EZUVaic.exe
  C:\Windows\System\EZUVaic.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\fjgJCrZ.exe
  C:\Windows\System\fjgJCrZ.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\wwOOtVi.exe
  C:\Windows\System\wwOOtVi.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\OQkRTGi.exe
  C:\Windows\System\OQkRTGi.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\kdpkxSI.exe
  C:\Windows\System\kdpkxSI.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\iCnDvAx.exe
  C:\Windows\System\iCnDvAx.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\cipduFB.exe
  C:\Windows\System\cipduFB.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\dEFDdsD.exe
  C:\Windows\System\dEFDdsD.exe
  2⤵
  PID:2896
- C:\Windows\System\RVhBqAi.exe
  C:\Windows\System\RVhBqAi.exe
  2⤵
  PID:4372
- C:\Windows\System\UVlUvOS.exe
  C:\Windows\System\UVlUvOS.exe
  2⤵
  PID:3612
- C:\Windows\System\SBmDkZK.exe
  C:\Windows\System\SBmDkZK.exe
  2⤵
  PID:5116
- C:\Windows\System\yxroEhS.exe
  C:\Windows\System\yxroEhS.exe
  2⤵
  PID:3992
- C:\Windows\System\Ugxuthc.exe
  C:\Windows\System\Ugxuthc.exe
  2⤵
  PID:2792
- C:\Windows\System\ybyCMOR.exe
  C:\Windows\System\ybyCMOR.exe
  2⤵
  PID:1692
- C:\Windows\System\sNJZJRZ.exe
  C:\Windows\System\sNJZJRZ.exe
  2⤵
  PID:4064
- C:\Windows\System\blretQC.exe
  C:\Windows\System\blretQC.exe
  2⤵
  PID:4652
- C:\Windows\System\oDmdxEU.exe
  C:\Windows\System\oDmdxEU.exe
  2⤵
  PID:3876
- C:\Windows\System\mVjtXJU.exe
  C:\Windows\System\mVjtXJU.exe
  2⤵
  PID:4356
- C:\Windows\System\TiaKObv.exe
  C:\Windows\System\TiaKObv.exe
  2⤵
  PID:2268
- C:\Windows\System\WeqACcw.exe
  C:\Windows\System\WeqACcw.exe
  2⤵
  PID:5000
- C:\Windows\System\HiTZbzH.exe
  C:\Windows\System\HiTZbzH.exe
  2⤵
  PID:844
- C:\Windows\System\AXrqGRz.exe
  C:\Windows\System\AXrqGRz.exe
  2⤵
  PID:5140
- C:\Windows\System\ttcXdPK.exe
  C:\Windows\System\ttcXdPK.exe
  2⤵
  PID:5168
- C:\Windows\System\YGyjtMk.exe
  C:\Windows\System\YGyjtMk.exe
  2⤵
  PID:5196
- C:\Windows\System\QFvWdYb.exe
  C:\Windows\System\QFvWdYb.exe
  2⤵
  PID:5224
- C:\Windows\System\NzoXBkr.exe
  C:\Windows\System\NzoXBkr.exe
  2⤵
  PID:5252
- C:\Windows\System\KsEoYzu.exe
  C:\Windows\System\KsEoYzu.exe
  2⤵
  PID:5340
- C:\Windows\System\sXNWLjc.exe
  C:\Windows\System\sXNWLjc.exe
  2⤵
  PID:5384
- C:\Windows\System\xYcNPXM.exe
  C:\Windows\System\xYcNPXM.exe
  2⤵
  PID:5432
- C:\Windows\System\bZGvNWP.exe
  C:\Windows\System\bZGvNWP.exe
  2⤵
  PID:5460
- C:\Windows\System\juXjBpz.exe
  C:\Windows\System\juXjBpz.exe
  2⤵
  PID:5480
- C:\Windows\System\nGrUVkw.exe
  C:\Windows\System\nGrUVkw.exe
  2⤵
  PID:5516
- C:\Windows\System\SOSRiwe.exe
  C:\Windows\System\SOSRiwe.exe
  2⤵
  PID:5536
- C:\Windows\System\okWyyeS.exe
  C:\Windows\System\okWyyeS.exe
  2⤵
  PID:5556
- C:\Windows\System\QxUOfBg.exe
  C:\Windows\System\QxUOfBg.exe
  2⤵
  PID:5596
- C:\Windows\System\qzZDspc.exe
  C:\Windows\System\qzZDspc.exe
  2⤵
  PID:5628
- C:\Windows\System\OyDfRoC.exe
  C:\Windows\System\OyDfRoC.exe
  2⤵
  PID:5660
- C:\Windows\System\SHUkpRx.exe
  C:\Windows\System\SHUkpRx.exe
  2⤵
  PID:5700
- C:\Windows\System\oHTzinO.exe
  C:\Windows\System\oHTzinO.exe
  2⤵
  PID:5724
- C:\Windows\System\rndUpeJ.exe
  C:\Windows\System\rndUpeJ.exe
  2⤵
  PID:5760
- C:\Windows\System\SmLFlDG.exe
  C:\Windows\System\SmLFlDG.exe
  2⤵
  PID:5804
- C:\Windows\System\kpifblM.exe
  C:\Windows\System\kpifblM.exe
  2⤵
  PID:5832
- C:\Windows\System\mvDQFpS.exe
  C:\Windows\System\mvDQFpS.exe
  2⤵
  PID:5856
- C:\Windows\System\KsXUWIm.exe
  C:\Windows\System\KsXUWIm.exe
  2⤵
  PID:5904
- C:\Windows\System\mEsnHab.exe
  C:\Windows\System\mEsnHab.exe
  2⤵
  PID:5932
- C:\Windows\System\pSnxZsc.exe
  C:\Windows\System\pSnxZsc.exe
  2⤵
  PID:5952
- C:\Windows\System\LilgxDF.exe
  C:\Windows\System\LilgxDF.exe
  2⤵
  PID:5992
- C:\Windows\System\iZaeJvL.exe
  C:\Windows\System\iZaeJvL.exe
  2⤵
  PID:6008
- C:\Windows\System\BoPLFIh.exe
  C:\Windows\System\BoPLFIh.exe
  2⤵
  PID:6044
- C:\Windows\System\ntrrScj.exe
  C:\Windows\System\ntrrScj.exe
  2⤵
  PID:6068
- C:\Windows\System\tIWbwNL.exe
  C:\Windows\System\tIWbwNL.exe
  2⤵
  PID:6096
- C:\Windows\System\YHBCAiy.exe
  C:\Windows\System\YHBCAiy.exe
  2⤵
  PID:6124
- C:\Windows\System\IMSsXfT.exe
  C:\Windows\System\IMSsXfT.exe
  2⤵
  PID:2376
- C:\Windows\System\WOVGQWw.exe
  C:\Windows\System\WOVGQWw.exe
  2⤵
  PID:1952
- C:\Windows\System\iGZORlZ.exe
  C:\Windows\System\iGZORlZ.exe
  2⤵
  PID:5156
- C:\Windows\System\nmZilRq.exe
  C:\Windows\System\nmZilRq.exe
  2⤵
  PID:4496
- C:\Windows\System\csZTJDn.exe
  C:\Windows\System\csZTJDn.exe
  2⤵
  PID:5072
- C:\Windows\System\ZMOoIYK.exe
  C:\Windows\System\ZMOoIYK.exe
  2⤵
  PID:1656
- C:\Windows\System\DJtkYSg.exe
  C:\Windows\System\DJtkYSg.exe
  2⤵
  PID:5308
- C:\Windows\System\QgmHRqt.exe
  C:\Windows\System\QgmHRqt.exe
  2⤵
  PID:4572
- C:\Windows\System\wDKkNPK.exe
  C:\Windows\System\wDKkNPK.exe
  2⤵
  PID:2340
- C:\Windows\System\tTpgrsE.exe
  C:\Windows\System\tTpgrsE.exe
  2⤵
  PID:1684
- C:\Windows\System\pqLDCTY.exe
  C:\Windows\System\pqLDCTY.exe
  2⤵
  PID:1652
- C:\Windows\System\nPKEpQm.exe
  C:\Windows\System\nPKEpQm.exe
  2⤵
  PID:3928
- C:\Windows\System\XVPTLKk.exe
  C:\Windows\System\XVPTLKk.exe
  2⤵
  PID:5112
- C:\Windows\System\plLcnsW.exe
  C:\Windows\System\plLcnsW.exe
  2⤵
  PID:3980
- C:\Windows\System\QvYrtts.exe
  C:\Windows\System\QvYrtts.exe
  2⤵
  PID:1488
- C:\Windows\System\rjYuHWm.exe
  C:\Windows\System\rjYuHWm.exe
  2⤵
  PID:1492
- C:\Windows\System\OSVMuvJ.exe
  C:\Windows\System\OSVMuvJ.exe
  2⤵
  PID:5056
- C:\Windows\System\NviZzZd.exe
  C:\Windows\System\NviZzZd.exe
  2⤵
  PID:5372
- C:\Windows\System\KCZGUpq.exe
  C:\Windows\System\KCZGUpq.exe
  2⤵
  PID:5496
- C:\Windows\System\MfUKwng.exe
  C:\Windows\System\MfUKwng.exe
  2⤵
  PID:5504
- C:\Windows\System\WFhIHrO.exe
  C:\Windows\System\WFhIHrO.exe
  2⤵
  PID:5588
- C:\Windows\System\rJgtLJP.exe
  C:\Windows\System\rJgtLJP.exe
  2⤵
  PID:5672
- C:\Windows\System\oJfudGM.exe
  C:\Windows\System\oJfudGM.exe
  2⤵
  PID:5396
- C:\Windows\System\PBHWrba.exe
  C:\Windows\System\PBHWrba.exe
  2⤵
  PID:5752
- C:\Windows\System\Xtftplq.exe
  C:\Windows\System\Xtftplq.exe
  2⤵
  PID:5492
- C:\Windows\System\uhzfchn.exe
  C:\Windows\System\uhzfchn.exe
  2⤵
  PID:5912
- C:\Windows\System\jfcQLEh.exe
  C:\Windows\System\jfcQLEh.exe
  2⤵
  PID:5944
- C:\Windows\System\dDafZta.exe
  C:\Windows\System\dDafZta.exe
  2⤵
  PID:6004
- C:\Windows\System\WtyhKGE.exe
  C:\Windows\System\WtyhKGE.exe
  2⤵
  PID:6056
- C:\Windows\System\TujTIqp.exe
  C:\Windows\System\TujTIqp.exe
  2⤵
  PID:2608
- C:\Windows\System\SycbtZW.exe
  C:\Windows\System\SycbtZW.exe
  2⤵
  PID:5212
- C:\Windows\System\FKVCZAV.exe
  C:\Windows\System\FKVCZAV.exe
  2⤵
  PID:4840
- C:\Windows\System\kjvJrrk.exe
  C:\Windows\System\kjvJrrk.exe
  2⤵
  PID:5304
- C:\Windows\System\FfisMXr.exe
  C:\Windows\System\FfisMXr.exe
  2⤵
  PID:4872
- C:\Windows\System\wuuFJCO.exe
  C:\Windows\System\wuuFJCO.exe
  2⤵
  PID:4248
- C:\Windows\System\DVablfu.exe
  C:\Windows\System\DVablfu.exe
  2⤵
  PID:3152
- C:\Windows\System\VdtJfpO.exe
  C:\Windows\System\VdtJfpO.exe
  2⤵
  PID:5548
- C:\Windows\System\mZSBIjY.exe
  C:\Windows\System\mZSBIjY.exe
  2⤵
  PID:5696
- C:\Windows\System\mfoGXtk.exe
  C:\Windows\System\mfoGXtk.exe
  2⤵
  PID:5780
- C:\Windows\System\oFlTyOp.exe
  C:\Windows\System\oFlTyOp.exe
  2⤵
  PID:5828
- C:\Windows\System\UbipAvc.exe
  C:\Windows\System\UbipAvc.exe
  2⤵
  PID:6060
- C:\Windows\System\Xhpfihj.exe
  C:\Windows\System\Xhpfihj.exe
  2⤵
  PID:5128
- C:\Windows\System\ewvRbuF.exe
  C:\Windows\System\ewvRbuF.exe
  2⤵
  PID:5976
- C:\Windows\System\prUXymP.exe
  C:\Windows\System\prUXymP.exe
  2⤵
  PID:3588
- C:\Windows\System\FNUCUtR.exe
  C:\Windows\System\FNUCUtR.exe
  2⤵
  PID:5644
- C:\Windows\System\miMNprv.exe
  C:\Windows\System\miMNprv.exe
  2⤵
  PID:5964
- C:\Windows\System\rbMlPYa.exe
  C:\Windows\System\rbMlPYa.exe
  2⤵
  PID:6104
- C:\Windows\System\ZStVQqW.exe
  C:\Windows\System\ZStVQqW.exe
  2⤵
  PID:3484
- C:\Windows\System\cdZhmlS.exe
  C:\Windows\System\cdZhmlS.exe
  2⤵
  PID:5784
- C:\Windows\System\aEknATW.exe
  C:\Windows\System\aEknATW.exe
  2⤵
  PID:5692
- C:\Windows\System\fvNLefr.exe
  C:\Windows\System\fvNLefr.exe
  2⤵
  PID:6160
- C:\Windows\System\IqcDKGb.exe
  C:\Windows\System\IqcDKGb.exe
  2⤵
  PID:6180
- C:\Windows\System\Nfcmako.exe
  C:\Windows\System\Nfcmako.exe
  2⤵
  PID:6204
- C:\Windows\System\FzmVrKO.exe
  C:\Windows\System\FzmVrKO.exe
  2⤵
  PID:6240
- C:\Windows\System\RzQYMnZ.exe
  C:\Windows\System\RzQYMnZ.exe
  2⤵
  PID:6276
- C:\Windows\System\vbCGLau.exe
  C:\Windows\System\vbCGLau.exe
  2⤵
  PID:6308
- C:\Windows\System\nWBrWCy.exe
  C:\Windows\System\nWBrWCy.exe
  2⤵
  PID:6352
- C:\Windows\System\IOeRkWp.exe
  C:\Windows\System\IOeRkWp.exe
  2⤵
  PID:6368
- C:\Windows\System\ItlIiUM.exe
  C:\Windows\System\ItlIiUM.exe
  2⤵
  PID:6388
- C:\Windows\System\PaWFpvH.exe
  C:\Windows\System\PaWFpvH.exe
  2⤵
  PID:6424
- C:\Windows\System\DRKrLmR.exe
  C:\Windows\System\DRKrLmR.exe
  2⤵
  PID:6452
- C:\Windows\System\VFOVctA.exe
  C:\Windows\System\VFOVctA.exe
  2⤵
  PID:6480
- C:\Windows\System\DOSjcGU.exe
  C:\Windows\System\DOSjcGU.exe
  2⤵
  PID:6508
- C:\Windows\System\ajRSyjs.exe
  C:\Windows\System\ajRSyjs.exe
  2⤵
  PID:6524
- C:\Windows\System\MvoUrWv.exe
  C:\Windows\System\MvoUrWv.exe
  2⤵
  PID:6552
- C:\Windows\System\ouYYxJc.exe
  C:\Windows\System\ouYYxJc.exe
  2⤵
  PID:6584
- C:\Windows\System\WWlLSFY.exe
  C:\Windows\System\WWlLSFY.exe
  2⤵
  PID:6620
- C:\Windows\System\TOVqSdd.exe
  C:\Windows\System\TOVqSdd.exe
  2⤵
  PID:6636
- C:\Windows\System\sZjTqWH.exe
  C:\Windows\System\sZjTqWH.exe
  2⤵
  PID:6664
- C:\Windows\System\kydEShY.exe
  C:\Windows\System\kydEShY.exe
  2⤵
  PID:6700
- C:\Windows\System\VUVPKau.exe
  C:\Windows\System\VUVPKau.exe
  2⤵
  PID:6744
- C:\Windows\System\peFcRFG.exe
  C:\Windows\System\peFcRFG.exe
  2⤵
  PID:6776
- C:\Windows\System\pBYFznX.exe
  C:\Windows\System\pBYFznX.exe
  2⤵
  PID:6792
- C:\Windows\System\hhaaYyE.exe
  C:\Windows\System\hhaaYyE.exe
  2⤵
  PID:6828
- C:\Windows\System\mRwPQCs.exe
  C:\Windows\System\mRwPQCs.exe
  2⤵
  PID:6848
- C:\Windows\System\NyICGwT.exe
  C:\Windows\System\NyICGwT.exe
  2⤵
  PID:6888
- C:\Windows\System\KyofnXD.exe
  C:\Windows\System\KyofnXD.exe
  2⤵
  PID:6904
- C:\Windows\System\wGAWjwa.exe
  C:\Windows\System\wGAWjwa.exe
  2⤵
  PID:6932
- C:\Windows\System\PLaQpDw.exe
  C:\Windows\System\PLaQpDw.exe
  2⤵
  PID:6964
- C:\Windows\System\UrNyOdq.exe
  C:\Windows\System\UrNyOdq.exe
  2⤵
  PID:6988
- C:\Windows\System\fnwuDLT.exe
  C:\Windows\System\fnwuDLT.exe
  2⤵
  PID:7024
- C:\Windows\System\iIFALEr.exe
  C:\Windows\System\iIFALEr.exe
  2⤵
  PID:7056
- C:\Windows\System\pxmSGxP.exe
  C:\Windows\System\pxmSGxP.exe
  2⤵
  PID:7084
- C:\Windows\System\iRrxfom.exe
  C:\Windows\System\iRrxfom.exe
  2⤵
  PID:7112
- C:\Windows\System\XEvGvCu.exe
  C:\Windows\System\XEvGvCu.exe
  2⤵
  PID:7128
- C:\Windows\System\WjswSYj.exe
  C:\Windows\System\WjswSYj.exe
  2⤵
  PID:7160
- C:\Windows\System\pJNKmuj.exe
  C:\Windows\System\pJNKmuj.exe
  2⤵
  PID:6196
- C:\Windows\System\mnIDRVq.exe
  C:\Windows\System\mnIDRVq.exe
  2⤵
  PID:6228
- C:\Windows\System\BHgBpjv.exe
  C:\Windows\System\BHgBpjv.exe
  2⤵
  PID:6296
- C:\Windows\System\gWkljCX.exe
  C:\Windows\System\gWkljCX.exe
  2⤵
  PID:6376
- C:\Windows\System\nAMqLzB.exe
  C:\Windows\System\nAMqLzB.exe
  2⤵
  PID:6444
- C:\Windows\System\pmEtOkE.exe
  C:\Windows\System\pmEtOkE.exe
  2⤵
  PID:6492
- C:\Windows\System\kBDAdoY.exe
  C:\Windows\System\kBDAdoY.exe
  2⤵
  PID:6568
- C:\Windows\System\ptssQYT.exe
  C:\Windows\System\ptssQYT.exe
  2⤵
  PID:6608
- C:\Windows\System\PBCFdRK.exe
  C:\Windows\System\PBCFdRK.exe
  2⤵
  PID:6716
- C:\Windows\System\xYakHLM.exe
  C:\Windows\System\xYakHLM.exe
  2⤵
  PID:6760
- C:\Windows\System\UIajvRj.exe
  C:\Windows\System\UIajvRj.exe
  2⤵
  PID:6844
- C:\Windows\System\LsoyHkw.exe
  C:\Windows\System\LsoyHkw.exe
  2⤵
  PID:6920
- C:\Windows\System\YCCSURB.exe
  C:\Windows\System\YCCSURB.exe
  2⤵
  PID:6976
- C:\Windows\System\YdCAdcy.exe
  C:\Windows\System\YdCAdcy.exe
  2⤵
  PID:7104
- C:\Windows\System\XHMaIyI.exe
  C:\Windows\System\XHMaIyI.exe
  2⤵
  PID:2544
- C:\Windows\System\ssSrCXE.exe
  C:\Windows\System\ssSrCXE.exe
  2⤵
  PID:7156
- C:\Windows\System\tuopySD.exe
  C:\Windows\System\tuopySD.exe
  2⤵
  PID:6332
- C:\Windows\System\WSickNd.exe
  C:\Windows\System\WSickNd.exe
  2⤵
  PID:6564
- C:\Windows\System\GFwnYch.exe
  C:\Windows\System\GFwnYch.exe
  2⤵
  PID:6604
- C:\Windows\System\qRoPbfG.exe
  C:\Windows\System\qRoPbfG.exe
  2⤵
  PID:6736
- C:\Windows\System\GgFXogL.exe
  C:\Windows\System\GgFXogL.exe
  2⤵
  PID:6944
- C:\Windows\System\qEYXsVj.exe
  C:\Windows\System\qEYXsVj.exe
  2⤵
  PID:7140
- C:\Windows\System\FFEmBKs.exe
  C:\Windows\System\FFEmBKs.exe
  2⤵
  PID:6464
- C:\Windows\System\llMrugv.exe
  C:\Windows\System\llMrugv.exe
  2⤵
  PID:6804
- C:\Windows\System\ZhEFMJV.exe
  C:\Windows\System\ZhEFMJV.exe
  2⤵
  PID:6328
- C:\Windows\System\RIcvWAw.exe
  C:\Windows\System\RIcvWAw.exe
  2⤵
  PID:7004
- C:\Windows\System\AoChfrv.exe
  C:\Windows\System\AoChfrv.exe
  2⤵
  PID:7180
- C:\Windows\System\wJSemjY.exe
  C:\Windows\System\wJSemjY.exe
  2⤵
  PID:7204
- C:\Windows\System\iRZLcPT.exe
  C:\Windows\System\iRZLcPT.exe
  2⤵
  PID:7244
- C:\Windows\System\PprPMZW.exe
  C:\Windows\System\PprPMZW.exe
  2⤵
  PID:7260
- C:\Windows\System\RzydZJO.exe
  C:\Windows\System\RzydZJO.exe
  2⤵
  PID:7304
- C:\Windows\System\yejPFEk.exe
  C:\Windows\System\yejPFEk.exe
  2⤵
  PID:7320
- C:\Windows\System\cDRszju.exe
  C:\Windows\System\cDRszju.exe
  2⤵
  PID:7356
- C:\Windows\System\KQdDSgN.exe
  C:\Windows\System\KQdDSgN.exe
  2⤵
  PID:7388
- C:\Windows\System\irWAgBc.exe
  C:\Windows\System\irWAgBc.exe
  2⤵
  PID:7404
- C:\Windows\System\OeNlJSI.exe
  C:\Windows\System\OeNlJSI.exe
  2⤵
  PID:7428
- C:\Windows\System\emGkyRG.exe
  C:\Windows\System\emGkyRG.exe
  2⤵
  PID:7448
- C:\Windows\System\zraqmcn.exe
  C:\Windows\System\zraqmcn.exe
  2⤵
  PID:7488
- C:\Windows\System\icqGMsx.exe
  C:\Windows\System\icqGMsx.exe
  2⤵
  PID:7536
- C:\Windows\System\LfuBtLN.exe
  C:\Windows\System\LfuBtLN.exe
  2⤵
  PID:7556
- C:\Windows\System\ssVPgaM.exe
  C:\Windows\System\ssVPgaM.exe
  2⤵
  PID:7588
- C:\Windows\System\HmLdzhy.exe
  C:\Windows\System\HmLdzhy.exe
  2⤵
  PID:7616
- C:\Windows\System\nVFoQog.exe
  C:\Windows\System\nVFoQog.exe
  2⤵
  PID:7644
- C:\Windows\System\ALRLeXy.exe
  C:\Windows\System\ALRLeXy.exe
  2⤵
  PID:7660
- C:\Windows\System\KlAUCQw.exe
  C:\Windows\System\KlAUCQw.exe
  2⤵
  PID:7688
- C:\Windows\System\CJoIIzB.exe
  C:\Windows\System\CJoIIzB.exe
  2⤵
  PID:7716
- C:\Windows\System\cYUGeNL.exe
  C:\Windows\System\cYUGeNL.exe
  2⤵
  PID:7748
- C:\Windows\System\kLhHLvW.exe
  C:\Windows\System\kLhHLvW.exe
  2⤵
  PID:7780
- C:\Windows\System\RjNGQwG.exe
  C:\Windows\System\RjNGQwG.exe
  2⤵
  PID:7820
- C:\Windows\System\nBNroYv.exe
  C:\Windows\System\nBNroYv.exe
  2⤵
  PID:7836
- C:\Windows\System\YUGzWly.exe
  C:\Windows\System\YUGzWly.exe
  2⤵
  PID:7856
- C:\Windows\System\rHCNhXx.exe
  C:\Windows\System\rHCNhXx.exe
  2⤵
  PID:7904
- C:\Windows\System\MBTuQaU.exe
  C:\Windows\System\MBTuQaU.exe
  2⤵
  PID:7932
- C:\Windows\System\dhuVIHj.exe
  C:\Windows\System\dhuVIHj.exe
  2⤵
  PID:7948
- C:\Windows\System\iezDNEV.exe
  C:\Windows\System\iezDNEV.exe
  2⤵
  PID:7964
- C:\Windows\System\zNaTmxy.exe
  C:\Windows\System\zNaTmxy.exe
  2⤵
  PID:7988
- C:\Windows\System\cbTbSTe.exe
  C:\Windows\System\cbTbSTe.exe
  2⤵
  PID:8016
- C:\Windows\System\OhAVgBy.exe
  C:\Windows\System\OhAVgBy.exe
  2⤵
  PID:8036
- C:\Windows\System\LYHoVtv.exe
  C:\Windows\System\LYHoVtv.exe
  2⤵
  PID:8068
- C:\Windows\System\JysNJhC.exe
  C:\Windows\System\JysNJhC.exe
  2⤵
  PID:8128
- C:\Windows\System\JqEGZmX.exe
  C:\Windows\System\JqEGZmX.exe
  2⤵
  PID:8144
- C:\Windows\System\bEmyQEq.exe
  C:\Windows\System\bEmyQEq.exe
  2⤵
  PID:8184
- C:\Windows\System\qkejGCa.exe
  C:\Windows\System\qkejGCa.exe
  2⤵
  PID:7200
- C:\Windows\System\mbGLMYr.exe
  C:\Windows\System\mbGLMYr.exe
  2⤵
  PID:7252
- C:\Windows\System\VtNnEDE.exe
  C:\Windows\System\VtNnEDE.exe
  2⤵
  PID:7316
- C:\Windows\System\kLCIeLh.exe
  C:\Windows\System\kLCIeLh.exe
  2⤵
  PID:7400
- C:\Windows\System\GkwXLWl.exe
  C:\Windows\System\GkwXLWl.exe
  2⤵
  PID:7444
- C:\Windows\System\FBsxopw.exe
  C:\Windows\System\FBsxopw.exe
  2⤵
  PID:7508
- C:\Windows\System\bWneGyB.exe
  C:\Windows\System\bWneGyB.exe
  2⤵
  PID:7604
- C:\Windows\System\sRCczlk.exe
  C:\Windows\System\sRCczlk.exe
  2⤵
  PID:7652
- C:\Windows\System\zzqDbaf.exe
  C:\Windows\System\zzqDbaf.exe
  2⤵
  PID:7680
- C:\Windows\System\TiTsOOY.exe
  C:\Windows\System\TiTsOOY.exe
  2⤵
  PID:7760
- C:\Windows\System\PxgYxch.exe
  C:\Windows\System\PxgYxch.exe
  2⤵
  PID:7828
- C:\Windows\System\RnZpHnw.exe
  C:\Windows\System\RnZpHnw.exe
  2⤵
  PID:7872
- C:\Windows\System\aEdqYqT.exe
  C:\Windows\System\aEdqYqT.exe
  2⤵
  PID:7928
- C:\Windows\System\FgdGyOf.exe
  C:\Windows\System\FgdGyOf.exe
  2⤵
  PID:8052
- C:\Windows\System\tnzKRFo.exe
  C:\Windows\System\tnzKRFo.exe
  2⤵
  PID:8024
- C:\Windows\System\holKlbb.exe
  C:\Windows\System\holKlbb.exe
  2⤵
  PID:8120
- C:\Windows\System\JfdTzXZ.exe
  C:\Windows\System\JfdTzXZ.exe
  2⤵
  PID:7284
- C:\Windows\System\KiDceeP.exe
  C:\Windows\System\KiDceeP.exe
  2⤵
  PID:7384
- C:\Windows\System\KGgqmhr.exe
  C:\Windows\System\KGgqmhr.exe
  2⤵
  PID:7472
- C:\Windows\System\YopnBZq.exe
  C:\Windows\System\YopnBZq.exe
  2⤵
  PID:7580
- C:\Windows\System\igimOnt.exe
  C:\Windows\System\igimOnt.exe
  2⤵
  PID:7736
- C:\Windows\System\zJilwiZ.exe
  C:\Windows\System\zJilwiZ.exe
  2⤵
  PID:8028
- C:\Windows\System\KedDLhB.exe
  C:\Windows\System\KedDLhB.exe
  2⤵
  PID:8088
- C:\Windows\System\KRgtiip.exe
  C:\Windows\System\KRgtiip.exe
  2⤵
  PID:7288
- C:\Windows\System\tYtWkvO.exe
  C:\Windows\System\tYtWkvO.exe
  2⤵
  PID:7672
- C:\Windows\System\FjdsmZH.exe
  C:\Windows\System\FjdsmZH.exe
  2⤵
  PID:8008
- C:\Windows\System\SzoeZAx.exe
  C:\Windows\System\SzoeZAx.exe
  2⤵
  PID:7076
- C:\Windows\System\RzoHbRq.exe
  C:\Windows\System\RzoHbRq.exe
  2⤵
  PID:7636
- C:\Windows\System\XzPzhse.exe
  C:\Windows\System\XzPzhse.exe
  2⤵
  PID:8212
- C:\Windows\System\lytHexI.exe
  C:\Windows\System\lytHexI.exe
  2⤵
  PID:8244
- C:\Windows\System\WlfCVMH.exe
  C:\Windows\System\WlfCVMH.exe
  2⤵
  PID:8268
- C:\Windows\System\RvJdDZb.exe
  C:\Windows\System\RvJdDZb.exe
  2⤵
  PID:8304
- C:\Windows\System\OwTvnrv.exe
  C:\Windows\System\OwTvnrv.exe
  2⤵
  PID:8324
- C:\Windows\System\Bjuvilm.exe
  C:\Windows\System\Bjuvilm.exe
  2⤵
  PID:8364
- C:\Windows\System\BnSekGw.exe
  C:\Windows\System\BnSekGw.exe
  2⤵
  PID:8380
- C:\Windows\System\tXbTADZ.exe
  C:\Windows\System\tXbTADZ.exe
  2⤵
  PID:8408
- C:\Windows\System\oNziQuK.exe
  C:\Windows\System\oNziQuK.exe
  2⤵
  PID:8436
- C:\Windows\System\euPvdsk.exe
  C:\Windows\System\euPvdsk.exe
  2⤵
  PID:8456
- C:\Windows\System\FKZisrz.exe
  C:\Windows\System\FKZisrz.exe
  2⤵
  PID:8488
- C:\Windows\System\SQCEkUG.exe
  C:\Windows\System\SQCEkUG.exe
  2⤵
  PID:8520
- C:\Windows\System\NGkUfqo.exe
  C:\Windows\System\NGkUfqo.exe
  2⤵
  PID:8552
- C:\Windows\System\aTXtdBi.exe
  C:\Windows\System\aTXtdBi.exe
  2⤵
  PID:8580
- C:\Windows\System\HSNlIzR.exe
  C:\Windows\System\HSNlIzR.exe
  2⤵
  PID:8616
- C:\Windows\System\SnOrfSn.exe
  C:\Windows\System\SnOrfSn.exe
  2⤵
  PID:8632
- C:\Windows\System\twyhBHs.exe
  C:\Windows\System\twyhBHs.exe
  2⤵
  PID:8660
- C:\Windows\System\iHHvnyO.exe
  C:\Windows\System\iHHvnyO.exe
  2⤵
  PID:8692
- C:\Windows\System\PVwXFoS.exe
  C:\Windows\System\PVwXFoS.exe
  2⤵
  PID:8724
- C:\Windows\System\gJcenHc.exe
  C:\Windows\System\gJcenHc.exe
  2⤵
  PID:8740
- C:\Windows\System\UuZEhxC.exe
  C:\Windows\System\UuZEhxC.exe
  2⤵
  PID:8772
- C:\Windows\System\xiDBfVA.exe
  C:\Windows\System\xiDBfVA.exe
  2⤵
  PID:8808
- C:\Windows\System\MKUbaMz.exe
  C:\Windows\System\MKUbaMz.exe
  2⤵
  PID:8828
- C:\Windows\System\hPTyqcj.exe
  C:\Windows\System\hPTyqcj.exe
  2⤵
  PID:8848
- C:\Windows\System\FOPeSGi.exe
  C:\Windows\System\FOPeSGi.exe
  2⤵
  PID:8884
- C:\Windows\System\oRGGfxf.exe
  C:\Windows\System\oRGGfxf.exe
  2⤵
  PID:8912
- C:\Windows\System\LgHUeVD.exe
  C:\Windows\System\LgHUeVD.exe
  2⤵
  PID:8940
- C:\Windows\System\hQMknHL.exe
  C:\Windows\System\hQMknHL.exe
  2⤵
  PID:8956
- C:\Windows\System\GgziuNX.exe
  C:\Windows\System\GgziuNX.exe
  2⤵
  PID:9004
- C:\Windows\System\zFCobeG.exe
  C:\Windows\System\zFCobeG.exe
  2⤵
  PID:9028
- C:\Windows\System\YfFLMFK.exe
  C:\Windows\System\YfFLMFK.exe
  2⤵
  PID:9052
- C:\Windows\System\BSlHMpN.exe
  C:\Windows\System\BSlHMpN.exe
  2⤵
  PID:9068
- C:\Windows\System\FdakwJh.exe
  C:\Windows\System\FdakwJh.exe
  2⤵
  PID:9096
- C:\Windows\System\cXuGKsT.exe
  C:\Windows\System\cXuGKsT.exe
  2⤵
  PID:9128
- C:\Windows\System\lZNAEuC.exe
  C:\Windows\System\lZNAEuC.exe
  2⤵
  PID:9168
- C:\Windows\System\OLEsZJQ.exe
  C:\Windows\System\OLEsZJQ.exe
  2⤵
  PID:9192
- C:\Windows\System\JTTbEZl.exe
  C:\Windows\System\JTTbEZl.exe
  2⤵
  PID:7520
- C:\Windows\System\npKGEwG.exe
  C:\Windows\System\npKGEwG.exe
  2⤵
  PID:8292
- C:\Windows\System\LuKJvfj.exe
  C:\Windows\System\LuKJvfj.exe
  2⤵
  PID:8336
- C:\Windows\System\AZvEVeI.exe
  C:\Windows\System\AZvEVeI.exe
  2⤵
  PID:8392
- C:\Windows\System\JOJZMQY.exe
  C:\Windows\System\JOJZMQY.exe
  2⤵
  PID:8424
- C:\Windows\System\ArEFxOH.exe
  C:\Windows\System\ArEFxOH.exe
  2⤵
  PID:8512
- C:\Windows\System\QXOfTqk.exe
  C:\Windows\System\QXOfTqk.exe
  2⤵
  PID:8576
- C:\Windows\System\iMLUNwp.exe
  C:\Windows\System\iMLUNwp.exe
  2⤵
  PID:8628
- C:\Windows\System\TTTVbES.exe
  C:\Windows\System\TTTVbES.exe
  2⤵
  PID:8764
- C:\Windows\System\uhPIHAk.exe
  C:\Windows\System\uhPIHAk.exe
  2⤵
  PID:8804
- C:\Windows\System\dmdYqAx.exe
  C:\Windows\System\dmdYqAx.exe
  2⤵
  PID:8864
- C:\Windows\System\KaRwGXL.exe
  C:\Windows\System\KaRwGXL.exe
  2⤵
  PID:8936
- C:\Windows\System\nJXyWMV.exe
  C:\Windows\System\nJXyWMV.exe
  2⤵
  PID:8972
- C:\Windows\System\dgSzGzz.exe
  C:\Windows\System\dgSzGzz.exe
  2⤵
  PID:9036
- C:\Windows\System\SrClxZH.exe
  C:\Windows\System\SrClxZH.exe
  2⤵
  PID:9120
- C:\Windows\System\XUUBOwn.exe
  C:\Windows\System\XUUBOwn.exe
  2⤵
  PID:9152
- C:\Windows\System\lBgTZJy.exe
  C:\Windows\System\lBgTZJy.exe
  2⤵
  PID:8264
- C:\Windows\System\ZeeMBCL.exe
  C:\Windows\System\ZeeMBCL.exe
  2⤵
  PID:8344
- C:\Windows\System\CBnPnme.exe
  C:\Windows\System\CBnPnme.exe
  2⤵
  PID:8652
- C:\Windows\System\OBuaLQl.exe
  C:\Windows\System\OBuaLQl.exe
  2⤵
  PID:8716
- C:\Windows\System\RTHpkJK.exe
  C:\Windows\System\RTHpkJK.exe
  2⤵
  PID:8820
- C:\Windows\System\zlEAmQP.exe
  C:\Windows\System\zlEAmQP.exe
  2⤵
  PID:9064
- C:\Windows\System\HWWLRCS.exe
  C:\Windows\System\HWWLRCS.exe
  2⤵
  PID:9148
- C:\Windows\System\JWTHJKB.exe
  C:\Windows\System\JWTHJKB.exe
  2⤵
  PID:8476
- C:\Windows\System\KFQgWQs.exe
  C:\Windows\System\KFQgWQs.exe
  2⤵
  PID:8784
- C:\Windows\System\hfkQNmO.exe
  C:\Windows\System\hfkQNmO.exe
  2⤵
  PID:9012
- C:\Windows\System\lVzVzdr.exe
  C:\Windows\System\lVzVzdr.exe
  2⤵
  PID:8464
- C:\Windows\System\mJhbmXf.exe
  C:\Windows\System\mJhbmXf.exe
  2⤵
  PID:9244
- C:\Windows\System\UyXZQTa.exe
  C:\Windows\System\UyXZQTa.exe
  2⤵
  PID:9272
- C:\Windows\System\loTaqpe.exe
  C:\Windows\System\loTaqpe.exe
  2⤵
  PID:9288
- C:\Windows\System\CveQtxG.exe
  C:\Windows\System\CveQtxG.exe
  2⤵
  PID:9316
- C:\Windows\System\imbXGgW.exe
  C:\Windows\System\imbXGgW.exe
  2⤵
  PID:9348
- C:\Windows\System\HYRZcso.exe
  C:\Windows\System\HYRZcso.exe
  2⤵
  PID:9372
- C:\Windows\System\oSSzSHv.exe
  C:\Windows\System\oSSzSHv.exe
  2⤵
  PID:9412
- C:\Windows\System\BAqhhaL.exe
  C:\Windows\System\BAqhhaL.exe
  2⤵
  PID:9440
- C:\Windows\System\tAyiNhv.exe
  C:\Windows\System\tAyiNhv.exe
  2⤵
  PID:9468
- C:\Windows\System\JHfZUpz.exe
  C:\Windows\System\JHfZUpz.exe
  2⤵
  PID:9496
- C:\Windows\System\hSVGbxq.exe
  C:\Windows\System\hSVGbxq.exe
  2⤵
  PID:9512
- C:\Windows\System\MAyEEgl.exe
  C:\Windows\System\MAyEEgl.exe
  2⤵
  PID:9552
- C:\Windows\System\ftVOKXO.exe
  C:\Windows\System\ftVOKXO.exe
  2⤵
  PID:9572
- C:\Windows\System\dtrdpVT.exe
  C:\Windows\System\dtrdpVT.exe
  2⤵
  PID:9596
- C:\Windows\System\xdCgjDm.exe
  C:\Windows\System\xdCgjDm.exe
  2⤵
  PID:9624
- C:\Windows\System\hIkjKzM.exe
  C:\Windows\System\hIkjKzM.exe
  2⤵
  PID:9652
- C:\Windows\System\lSPUVkI.exe
  C:\Windows\System\lSPUVkI.exe
  2⤵
  PID:9680
- C:\Windows\System\JbawLls.exe
  C:\Windows\System\JbawLls.exe
  2⤵
  PID:9708
- C:\Windows\System\UIgVWwb.exe
  C:\Windows\System\UIgVWwb.exe
  2⤵
  PID:9748
- C:\Windows\System\lIhmOzh.exe
  C:\Windows\System\lIhmOzh.exe
  2⤵
  PID:9764
- C:\Windows\System\ctHSTxw.exe
  C:\Windows\System\ctHSTxw.exe
  2⤵
  PID:9804
- C:\Windows\System\iFBeygZ.exe
  C:\Windows\System\iFBeygZ.exe
  2⤵
  PID:9820
- C:\Windows\System\OHHbZzV.exe
  C:\Windows\System\OHHbZzV.exe
  2⤵
  PID:9860
- C:\Windows\System\xuMaxOm.exe
  C:\Windows\System\xuMaxOm.exe
  2⤵
  PID:9876
- C:\Windows\System\IGKEenW.exe
  C:\Windows\System\IGKEenW.exe
  2⤵
  PID:9892
- C:\Windows\System\ZhRzuMo.exe
  C:\Windows\System\ZhRzuMo.exe
  2⤵
  PID:9920
- C:\Windows\System\PXWHqmb.exe
  C:\Windows\System\PXWHqmb.exe
  2⤵
  PID:9936
- C:\Windows\System\bihxMsC.exe
  C:\Windows\System\bihxMsC.exe
  2⤵
  PID:9968
- C:\Windows\System\ODpSmyC.exe
  C:\Windows\System\ODpSmyC.exe
  2⤵
  PID:10012
- C:\Windows\System\QMxMRfx.exe
  C:\Windows\System\QMxMRfx.exe
  2⤵
  PID:10056
- C:\Windows\System\vscnjPB.exe
  C:\Windows\System\vscnjPB.exe
  2⤵
  PID:10080
- C:\Windows\System\SzesvRD.exe
  C:\Windows\System\SzesvRD.exe
  2⤵
  PID:10096
- C:\Windows\System\cRUsDRE.exe
  C:\Windows\System\cRUsDRE.exe
  2⤵
  PID:10116
- C:\Windows\System\hqIljDM.exe
  C:\Windows\System\hqIljDM.exe
  2⤵
  PID:10136
- C:\Windows\System\dtcJlta.exe
  C:\Windows\System\dtcJlta.exe
  2⤵
  PID:10164
- C:\Windows\System\uyLuUnC.exe
  C:\Windows\System\uyLuUnC.exe
  2⤵
  PID:10192
- C:\Windows\System\MtGDuhj.exe
  C:\Windows\System\MtGDuhj.exe
  2⤵
  PID:10212
- C:\Windows\System\wEWKYdM.exe
  C:\Windows\System\wEWKYdM.exe
  2⤵
  PID:9280
- C:\Windows\System\cuDbrUJ.exe
  C:\Windows\System\cuDbrUJ.exe
  2⤵
  PID:9308
- C:\Windows\System\kCWxyYY.exe
  C:\Windows\System\kCWxyYY.exe
  2⤵
  PID:9392
- C:\Windows\System\shwHLFz.exe
  C:\Windows\System\shwHLFz.exe
  2⤵
  PID:9460
- C:\Windows\System\LENZDBy.exe
  C:\Windows\System\LENZDBy.exe
  2⤵
  PID:9540
- C:\Windows\System\OdsrHlY.exe
  C:\Windows\System\OdsrHlY.exe
  2⤵
  PID:9612
- C:\Windows\System\adoOjVE.exe
  C:\Windows\System\adoOjVE.exe
  2⤵
  PID:9668
- C:\Windows\System\PfkmHFM.exe
  C:\Windows\System\PfkmHFM.exe
  2⤵
  PID:9732
- C:\Windows\System\nOJuCXZ.exe
  C:\Windows\System\nOJuCXZ.exe
  2⤵
  PID:9792
- C:\Windows\System\WvhSGWI.exe
  C:\Windows\System\WvhSGWI.exe
  2⤵
  PID:9836
- C:\Windows\System\yyGSsXW.exe
  C:\Windows\System\yyGSsXW.exe
  2⤵
  PID:9904
- C:\Windows\System\rCLbIrK.exe
  C:\Windows\System\rCLbIrK.exe
  2⤵
  PID:9980
- C:\Windows\System\eLWXAtx.exe
  C:\Windows\System\eLWXAtx.exe
  2⤵
  PID:10036
- C:\Windows\System\bpLtPiF.exe
  C:\Windows\System\bpLtPiF.exe
  2⤵
  PID:10172
- C:\Windows\System\ccGfAwJ.exe
  C:\Windows\System\ccGfAwJ.exe
  2⤵
  PID:10224
- C:\Windows\System\FYHVYvr.exe
  C:\Windows\System\FYHVYvr.exe
  2⤵
  PID:9224
- C:\Windows\System\wGouWKn.exe
  C:\Windows\System\wGouWKn.exe
  2⤵
  PID:9312
- C:\Windows\System\AYWDGKh.exe
  C:\Windows\System\AYWDGKh.exe
  2⤵
  PID:9508
- C:\Windows\System\JdKGJCd.exe
  C:\Windows\System\JdKGJCd.exe
  2⤵
  PID:9700
- C:\Windows\System\KLcXdQt.exe
  C:\Windows\System\KLcXdQt.exe
  2⤵
  PID:8896
- C:\Windows\System\iaUyOoY.exe
  C:\Windows\System\iaUyOoY.exe
  2⤵
  PID:9928
- C:\Windows\System\mSpYlEO.exe
  C:\Windows\System\mSpYlEO.exe
  2⤵
  PID:10188
- C:\Windows\System\FotaiEr.exe
  C:\Windows\System\FotaiEr.exe
  2⤵
  PID:8672
- C:\Windows\System\ubKfhIG.exe
  C:\Windows\System\ubKfhIG.exe
  2⤵
  PID:9812
- C:\Windows\System\HEBqnJm.exe
  C:\Windows\System\HEBqnJm.exe
  2⤵
  PID:10108
- C:\Windows\System\GJQPurh.exe
  C:\Windows\System\GJQPurh.exe
  2⤵
  PID:9704
- C:\Windows\System\nPRMOkX.exe
  C:\Windows\System\nPRMOkX.exe
  2⤵
  PID:9484
- C:\Windows\System\HtNSRJr.exe
  C:\Windows\System\HtNSRJr.exe
  2⤵
  PID:10252
- C:\Windows\System\oBvgsUF.exe
  C:\Windows\System\oBvgsUF.exe
  2⤵
  PID:10268
- C:\Windows\System\blBZbAi.exe
  C:\Windows\System\blBZbAi.exe
  2⤵
  PID:10296
- C:\Windows\System\nvfhrpB.exe
  C:\Windows\System\nvfhrpB.exe
  2⤵
  PID:10328
- C:\Windows\System\xJVPKVi.exe
  C:\Windows\System\xJVPKVi.exe
  2⤵
  PID:10360
- C:\Windows\System\hesKPSB.exe
  C:\Windows\System\hesKPSB.exe
  2⤵
  PID:10392
- C:\Windows\System\wIIyAFI.exe
  C:\Windows\System\wIIyAFI.exe
  2⤵
  PID:10420
- C:\Windows\System\bwepmNp.exe
  C:\Windows\System\bwepmNp.exe
  2⤵
  PID:10460
- C:\Windows\System\ZfPxQoG.exe
  C:\Windows\System\ZfPxQoG.exe
  2⤵
  PID:10476
- C:\Windows\System\ARfpNOl.exe
  C:\Windows\System\ARfpNOl.exe
  2⤵
  PID:10504
- C:\Windows\System\OTGfVXN.exe
  C:\Windows\System\OTGfVXN.exe
  2⤵
  PID:10540
- C:\Windows\System\UPIMYKN.exe
  C:\Windows\System\UPIMYKN.exe
  2⤵
  PID:10560
- C:\Windows\System\qKcqtLj.exe
  C:\Windows\System\qKcqtLj.exe
  2⤵
  PID:10592
- C:\Windows\System\eyYGxzl.exe
  C:\Windows\System\eyYGxzl.exe
  2⤵
  PID:10616
- C:\Windows\System\ViPKQNW.exe
  C:\Windows\System\ViPKQNW.exe
  2⤵
  PID:10632
- C:\Windows\System\JeyrQwA.exe
  C:\Windows\System\JeyrQwA.exe
  2⤵
  PID:10664
- C:\Windows\System\NUiFeuV.exe
  C:\Windows\System\NUiFeuV.exe
  2⤵
  PID:10700
- C:\Windows\System\srCzmgH.exe
  C:\Windows\System\srCzmgH.exe
  2⤵
  PID:10728
- C:\Windows\System\UwMrhQi.exe
  C:\Windows\System\UwMrhQi.exe
  2⤵
  PID:10760
- C:\Windows\System\bMVQuDv.exe
  C:\Windows\System\bMVQuDv.exe
  2⤵
  PID:10796
- C:\Windows\System\vpNDTGF.exe
  C:\Windows\System\vpNDTGF.exe
  2⤵
  PID:10824
- C:\Windows\System\ojCqWoQ.exe
  C:\Windows\System\ojCqWoQ.exe
  2⤵
  PID:10856
- C:\Windows\System\kqUnmMV.exe
  C:\Windows\System\kqUnmMV.exe
  2⤵
  PID:10884
- C:\Windows\System\RNadNaT.exe
  C:\Windows\System\RNadNaT.exe
  2⤵
  PID:10900
- C:\Windows\System\kksGJnF.exe
  C:\Windows\System\kksGJnF.exe
  2⤵
  PID:10928
- C:\Windows\System\YcJQjFn.exe
  C:\Windows\System\YcJQjFn.exe
  2⤵
  PID:10956
- C:\Windows\System\dVatJNR.exe
  C:\Windows\System\dVatJNR.exe
  2⤵
  PID:10996
- C:\Windows\System\rpdGUEx.exe
  C:\Windows\System\rpdGUEx.exe
  2⤵
  PID:11024
- C:\Windows\System\bmuUeLa.exe
  C:\Windows\System\bmuUeLa.exe
  2⤵
  PID:11040
- C:\Windows\System\RmYZXcG.exe
  C:\Windows\System\RmYZXcG.exe
  2⤵
  PID:11068
- C:\Windows\System\gNPaZlc.exe
  C:\Windows\System\gNPaZlc.exe
  2⤵
  PID:11100
- C:\Windows\System\rQeCyLJ.exe
  C:\Windows\System\rQeCyLJ.exe
  2⤵
  PID:11132
- C:\Windows\System\AhQgwZe.exe
  C:\Windows\System\AhQgwZe.exe
  2⤵
  PID:11164
- C:\Windows\System\lvWLLnV.exe
  C:\Windows\System\lvWLLnV.exe
  2⤵
  PID:11180
- C:\Windows\System\oqyFYJW.exe
  C:\Windows\System\oqyFYJW.exe
  2⤵
  PID:11208
- C:\Windows\System\zGmCwgZ.exe
  C:\Windows\System\zGmCwgZ.exe
  2⤵
  PID:11236
- C:\Windows\System\hQHvZbs.exe
  C:\Windows\System\hQHvZbs.exe
  2⤵
  PID:11252
- C:\Windows\System\IzjQOsL.exe
  C:\Windows\System\IzjQOsL.exe
  2⤵
  PID:10304
- C:\Windows\System\yotLFMv.exe
  C:\Windows\System\yotLFMv.exe
  2⤵
  PID:10384
- C:\Windows\System\MrVJSYO.exe
  C:\Windows\System\MrVJSYO.exe
  2⤵
  PID:10452
- C:\Windows\System\pPsVQvt.exe
  C:\Windows\System\pPsVQvt.exe
  2⤵
  PID:10516
- C:\Windows\System\UmgWWfE.exe
  C:\Windows\System\UmgWWfE.exe
  2⤵
  PID:10572
- C:\Windows\System\XXfeZHi.exe
  C:\Windows\System\XXfeZHi.exe
  2⤵
  PID:10652
- C:\Windows\System\AaLEGFW.exe
  C:\Windows\System\AaLEGFW.exe
  2⤵
  PID:10684
- C:\Windows\System\WiVcCoM.exe
  C:\Windows\System\WiVcCoM.exe
  2⤵
  PID:10780
- C:\Windows\System\EKxdMxj.exe
  C:\Windows\System\EKxdMxj.exe
  2⤵
  PID:10816
- C:\Windows\System\mXtrsgI.exe
  C:\Windows\System\mXtrsgI.exe
  2⤵
  PID:10872
- C:\Windows\System\aiKweox.exe
  C:\Windows\System\aiKweox.exe
  2⤵
  PID:10948
- C:\Windows\System\pYWJIfc.exe
  C:\Windows\System\pYWJIfc.exe
  2⤵
  PID:11032
- C:\Windows\System\xYrlHIG.exe
  C:\Windows\System\xYrlHIG.exe
  2⤵
  PID:11084
- C:\Windows\System\tuYocjZ.exe
  C:\Windows\System\tuYocjZ.exe
  2⤵
  PID:11148
- C:\Windows\System\OUAhRoH.exe
  C:\Windows\System\OUAhRoH.exe
  2⤵
  PID:11228
- C:\Windows\System\NcFXyde.exe
  C:\Windows\System\NcFXyde.exe
  2⤵
  PID:10244
- C:\Windows\System\ZcSIdUE.exe
  C:\Windows\System\ZcSIdUE.exe
  2⤵
  PID:10448
- C:\Windows\System\gollres.exe
  C:\Windows\System\gollres.exe
  2⤵
  PID:10536
- C:\Windows\System\GIZGnTH.exe
  C:\Windows\System\GIZGnTH.exe
  2⤵
  PID:10792
- C:\Windows\System\KkIwFAE.exe
  C:\Windows\System\KkIwFAE.exe
  2⤵
  PID:10840
- C:\Windows\System\rNkoCGN.exe
  C:\Windows\System\rNkoCGN.exe
  2⤵
  PID:11080
- C:\Windows\System\MSHtVam.exe
  C:\Windows\System\MSHtVam.exe
  2⤵
  PID:11116
- C:\Windows\System\sEpoNxE.exe
  C:\Windows\System\sEpoNxE.exe
  2⤵
  PID:10624
- C:\Windows\System\KQwUVEp.exe
  C:\Windows\System\KQwUVEp.exe
  2⤵
  PID:10952
- C:\Windows\System\aFLXifj.exe
  C:\Windows\System\aFLXifj.exe
  2⤵
  PID:10520
- C:\Windows\System\fxDNykw.exe
  C:\Windows\System\fxDNykw.exe
  2⤵
  PID:10352
- C:\Windows\System\DJIhCmN.exe
  C:\Windows\System\DJIhCmN.exe
  2⤵
  PID:10868
- C:\Windows\System\WbdcBTs.exe
  C:\Windows\System\WbdcBTs.exe
  2⤵
  PID:11304
- C:\Windows\System\jAnlUQA.exe
  C:\Windows\System\jAnlUQA.exe
  2⤵
  PID:11332
- C:\Windows\System\kDqpAEP.exe
  C:\Windows\System\kDqpAEP.exe
  2⤵
  PID:11360
- C:\Windows\System\RedBgug.exe
  C:\Windows\System\RedBgug.exe
  2⤵
  PID:11388
- C:\Windows\System\LoSTqIY.exe
  C:\Windows\System\LoSTqIY.exe
  2⤵
  PID:11416
- C:\Windows\System\juFiNQV.exe
  C:\Windows\System\juFiNQV.exe
  2⤵
  PID:11432
- C:\Windows\System\cUfrRDI.exe
  C:\Windows\System\cUfrRDI.exe
  2⤵
  PID:11468
- C:\Windows\System\IRBCVaA.exe
  C:\Windows\System\IRBCVaA.exe
  2⤵
  PID:11488
- C:\Windows\System\WJRaSjE.exe
  C:\Windows\System\WJRaSjE.exe
  2⤵
  PID:11516
- C:\Windows\System\KDeDaqE.exe
  C:\Windows\System\KDeDaqE.exe
  2⤵
  PID:11548
- C:\Windows\System\mzrYcIG.exe
  C:\Windows\System\mzrYcIG.exe
  2⤵
  PID:11584
- C:\Windows\System\BlAkaXq.exe
  C:\Windows\System\BlAkaXq.exe
  2⤵
  PID:11612
- C:\Windows\System\JovnQdL.exe
  C:\Windows\System\JovnQdL.exe
  2⤵
  PID:11628
- C:\Windows\System\HSnRMND.exe
  C:\Windows\System\HSnRMND.exe
  2⤵
  PID:11664
- C:\Windows\System\llWDDQO.exe
  C:\Windows\System\llWDDQO.exe
  2⤵
  PID:11692
- C:\Windows\System\EtUQeoG.exe
  C:\Windows\System\EtUQeoG.exe
  2⤵
  PID:11716
- C:\Windows\System\JPKthoR.exe
  C:\Windows\System\JPKthoR.exe
  2⤵
  PID:11740
- C:\Windows\System\JqecpGb.exe
  C:\Windows\System\JqecpGb.exe
  2⤵
  PID:11780
- C:\Windows\System\GtZjACH.exe
  C:\Windows\System\GtZjACH.exe
  2⤵
  PID:11808
- C:\Windows\System\SzNZYLo.exe
  C:\Windows\System\SzNZYLo.exe
  2⤵
  PID:11836
- C:\Windows\System\oFrZXEd.exe
  C:\Windows\System\oFrZXEd.exe
  2⤵
  PID:11852
- C:\Windows\System\auEelHu.exe
  C:\Windows\System\auEelHu.exe
  2⤵
  PID:11880
- C:\Windows\System\uPrHJzW.exe
  C:\Windows\System\uPrHJzW.exe
  2⤵
  PID:11908
- C:\Windows\System\sFNdJQt.exe
  C:\Windows\System\sFNdJQt.exe
  2⤵
  PID:11948
- C:\Windows\System\sIaCCjg.exe
  C:\Windows\System\sIaCCjg.exe
  2⤵
  PID:11968
- C:\Windows\System\qbBXdYc.exe
  C:\Windows\System\qbBXdYc.exe
  2⤵
  PID:12004
- C:\Windows\System\yUVZBSR.exe
  C:\Windows\System\yUVZBSR.exe
  2⤵
  PID:12032
- C:\Windows\System\DGmteAs.exe
  C:\Windows\System\DGmteAs.exe
  2⤵
  PID:12060
- C:\Windows\System\qNSDKCM.exe
  C:\Windows\System\qNSDKCM.exe
  2⤵
  PID:12088
- C:\Windows\System\wCeCgpX.exe
  C:\Windows\System\wCeCgpX.exe
  2⤵
  PID:12148
- C:\Windows\System\iNEEeue.exe
  C:\Windows\System\iNEEeue.exe
  2⤵
  PID:12184
- C:\Windows\System\jwyxZbq.exe
  C:\Windows\System\jwyxZbq.exe
  2⤵
  PID:12224
- C:\Windows\System\EkVcMNw.exe
  C:\Windows\System\EkVcMNw.exe
  2⤵
  PID:12244
- C:\Windows\System\TcXuPGr.exe
  C:\Windows\System\TcXuPGr.exe
  2⤵
  PID:12272
- C:\Windows\System\vQzKzGA.exe
  C:\Windows\System\vQzKzGA.exe
  2⤵
  PID:11292
- C:\Windows\System\VngmiZD.exe
  C:\Windows\System\VngmiZD.exe
  2⤵
  PID:11404
- C:\Windows\System\UUIcfbv.exe
  C:\Windows\System\UUIcfbv.exe
  2⤵
  PID:11452
- C:\Windows\System\xANKDIB.exe
  C:\Windows\System\xANKDIB.exe
  2⤵
  PID:11500
- C:\Windows\System\xhKnhYa.exe
  C:\Windows\System\xhKnhYa.exe
  2⤵
  PID:11596
- C:\Windows\System\SQJLOya.exe
  C:\Windows\System\SQJLOya.exe
  2⤵
  PID:11648
- C:\Windows\System\yEZujaC.exe
  C:\Windows\System\yEZujaC.exe
  2⤵
  PID:11736
- C:\Windows\System\TonUSbR.exe
  C:\Windows\System\TonUSbR.exe
  2⤵
  PID:11760
- C:\Windows\System\qGqVYai.exe
  C:\Windows\System\qGqVYai.exe
  2⤵
  PID:11864
- C:\Windows\System\zJYRPZM.exe
  C:\Windows\System\zJYRPZM.exe
  2⤵
  PID:7072
- C:\Windows\System\LWJAqOW.exe
  C:\Windows\System\LWJAqOW.exe
  2⤵
  PID:11940
- C:\Windows\System\GtGNEgV.exe
  C:\Windows\System\GtGNEgV.exe
  2⤵
  PID:12000
- C:\Windows\System\HEysNfn.exe
  C:\Windows\System\HEysNfn.exe
  2⤵
  PID:12072
- C:\Windows\System\gPOIRbW.exe
  C:\Windows\System\gPOIRbW.exe
  2⤵
  PID:12160
- C:\Windows\System\ItDHXzq.exe
  C:\Windows\System\ItDHXzq.exe
  2⤵
  PID:12232
- C:\Windows\System\FhZsnMp.exe
  C:\Windows\System\FhZsnMp.exe
  2⤵
  PID:12296
- C:\Windows\System\ZecgWyG.exe
  C:\Windows\System\ZecgWyG.exe
  2⤵
  PID:12328
- C:\Windows\System\yKcZJss.exe
  C:\Windows\System\yKcZJss.exe
  2⤵
  PID:12344
- C:\Windows\System\UcHVhsy.exe
  C:\Windows\System\UcHVhsy.exe
  2⤵
  PID:12368
- C:\Windows\System\xhVhjew.exe
  C:\Windows\System\xhVhjew.exe
  2⤵
  PID:12424
- C:\Windows\System\lWwedSK.exe
  C:\Windows\System\lWwedSK.exe
  2⤵
  PID:12452
- C:\Windows\System\OwTzVai.exe
  C:\Windows\System\OwTzVai.exe
  2⤵
  PID:12468
- C:\Windows\System\ivGIIYj.exe
  C:\Windows\System\ivGIIYj.exe
  2⤵
  PID:12500
- C:\Windows\System\tUocJyT.exe
  C:\Windows\System\tUocJyT.exe
  2⤵
  PID:12536
- C:\Windows\System\wvLfVuJ.exe
  C:\Windows\System\wvLfVuJ.exe
  2⤵
  PID:12552
- C:\Windows\System\PjXZPPg.exe
  C:\Windows\System\PjXZPPg.exe
  2⤵
  PID:12588
- C:\Windows\System\sqzSiyu.exe
  C:\Windows\System\sqzSiyu.exe
  2⤵
  PID:12608
- C:\Windows\System\sADmMgT.exe
  C:\Windows\System\sADmMgT.exe
  2⤵
  PID:12628
- C:\Windows\System\NLGKoWG.exe
  C:\Windows\System\NLGKoWG.exe
  2⤵
  PID:12656
- C:\Windows\System\mIFbmtM.exe
  C:\Windows\System\mIFbmtM.exe
  2⤵
  PID:12704
- C:\Windows\System\orIFtJw.exe
  C:\Windows\System\orIFtJw.exe
  2⤵
  PID:12720
- C:\Windows\System\kbCqAJy.exe
  C:\Windows\System\kbCqAJy.exe
  2⤵
  PID:12748
- C:\Windows\System\kVnvCHq.exe
  C:\Windows\System\kVnvCHq.exe
  2⤵
  PID:12772
- C:\Windows\System\vONVvPi.exe
  C:\Windows\System\vONVvPi.exe
  2⤵
  PID:12804
- C:\Windows\System\TzrlMxH.exe
  C:\Windows\System\TzrlMxH.exe
  2⤵
  PID:12832
- C:\Windows\System\SBoVmdh.exe
  C:\Windows\System\SBoVmdh.exe
  2⤵
  PID:12860
- C:\Windows\System\tJIYAVU.exe
  C:\Windows\System\tJIYAVU.exe
  2⤵
  PID:12900
- C:\Windows\System\bKgkHRo.exe
  C:\Windows\System\bKgkHRo.exe
  2⤵
  PID:12928
- C:\Windows\System\wQVvneV.exe
  C:\Windows\System\wQVvneV.exe
  2⤵
  PID:12944
- C:\Windows\System\ehBBEri.exe
  C:\Windows\System\ehBBEri.exe
  2⤵
  PID:12960
- C:\Windows\System\tUoCHqJ.exe
  C:\Windows\System\tUoCHqJ.exe
  2⤵
  PID:13012
- C:\Windows\System\yVefWVW.exe
  C:\Windows\System\yVefWVW.exe
  2⤵
  PID:13040
- C:\Windows\System\iNBBQWE.exe
  C:\Windows\System\iNBBQWE.exe
  2⤵
  PID:13056
- C:\Windows\System\poXQqEV.exe
  C:\Windows\System\poXQqEV.exe
  2⤵
  PID:13088
- C:\Windows\System\PxODtul.exe
  C:\Windows\System\PxODtul.exe
  2⤵
  PID:13116
- C:\Windows\System\ysyWFqd.exe
  C:\Windows\System\ysyWFqd.exe
  2⤵
  PID:13168
- C:\Windows\System\GhEMkPx.exe
  C:\Windows\System\GhEMkPx.exe
  2⤵
  PID:13192
- C:\Windows\System\JlNepqt.exe
  C:\Windows\System\JlNepqt.exe
  2⤵
  PID:13216
- C:\Windows\System\kWpAYmB.exe
  C:\Windows\System\kWpAYmB.exe
  2⤵
  PID:13244
- C:\Windows\System\BUEJybK.exe
  C:\Windows\System\BUEJybK.exe
  2⤵
  PID:13268
- C:\Windows\System\stZUFNF.exe
  C:\Windows\System\stZUFNF.exe
  2⤵
  PID:11296
- C:\Windows\System\awwtazs.exe
  C:\Windows\System\awwtazs.exe
  2⤵
  PID:11576
- C:\Windows\System\likWLlN.exe
  C:\Windows\System\likWLlN.exe
  2⤵
  PID:11820
- C:\Windows\System\VxzLqJZ.exe
  C:\Windows\System\VxzLqJZ.exe
  2⤵
  PID:11956
- C:\Windows\System\ZaDRLjr.exe
  C:\Windows\System\ZaDRLjr.exe
  2⤵
  PID:12144
- C:\Windows\System\mWdzjFn.exe
  C:\Windows\System\mWdzjFn.exe
  2⤵
  PID:12256
- C:\Windows\System\hvbWFNq.exe
  C:\Windows\System\hvbWFNq.exe
  2⤵
  PID:12340
- C:\Windows\System\dCRIEcy.exe
  C:\Windows\System\dCRIEcy.exe
  2⤵
  PID:12436
- C:\Windows\System\wRyITnb.exe
  C:\Windows\System\wRyITnb.exe
  2⤵
  PID:12516
- C:\Windows\System\fEcBTfA.exe
  C:\Windows\System\fEcBTfA.exe
  2⤵
  PID:12568
- C:\Windows\System\dSmFqTA.exe
  C:\Windows\System\dSmFqTA.exe
  2⤵
  PID:12644
- C:\Windows\System\xByumyr.exe
  C:\Windows\System\xByumyr.exe
  2⤵
  PID:12732
- C:\Windows\System\uxxKfRm.exe
  C:\Windows\System\uxxKfRm.exe
  2⤵
  PID:12796
- C:\Windows\System\QCwCQqn.exe
  C:\Windows\System\QCwCQqn.exe
  2⤵
  PID:12936
- C:\Windows\System\suYooSf.exe
  C:\Windows\System\suYooSf.exe
  2⤵
  PID:13008
- C:\Windows\System\oPvVrSy.exe
  C:\Windows\System\oPvVrSy.exe
  2⤵
  PID:13076
- C:\Windows\System\hPlyHVz.exe
  C:\Windows\System\hPlyHVz.exe
  2⤵
  PID:13188
- C:\Windows\System\avwCjkH.exe
  C:\Windows\System\avwCjkH.exe
  2⤵
  PID:13264
- C:\Windows\System\koQJEcA.exe
  C:\Windows\System\koQJEcA.exe
  2⤵
  PID:11400
- C:\Windows\System\vwwKEuH.exe
  C:\Windows\System\vwwKEuH.exe
  2⤵
  PID:11380
- C:\Windows\System\MmQiltw.exe
  C:\Windows\System\MmQiltw.exe
  2⤵
  PID:12308
- C:\Windows\System\IeqHeaP.exe
  C:\Windows\System\IeqHeaP.exe
  2⤵
  PID:12396
- C:\Windows\System\EdZuwwL.exe
  C:\Windows\System\EdZuwwL.exe
  2⤵
  PID:12596
- C:\Windows\System\yGyaDAe.exe
  C:\Windows\System\yGyaDAe.exe
  2⤵
  PID:2580
- C:\Windows\System\spNEmFi.exe
  C:\Windows\System\spNEmFi.exe
  2⤵
  PID:12800
- C:\Windows\System\ImxDXWL.exe
  C:\Windows\System\ImxDXWL.exe
  2⤵
  PID:13052
- C:\Windows\System\dgFkwBi.exe
  C:\Windows\System\dgFkwBi.exe
  2⤵
  PID:13288
- C:\Windows\System\NLdUUIo.exe
  C:\Windows\System\NLdUUIo.exe
  2⤵
  PID:11768
- C:\Windows\System\DHSTUTg.exe
  C:\Windows\System\DHSTUTg.exe
  2⤵
  PID:12292
- C:\Windows\System\BrWpPbG.exe
  C:\Windows\System\BrWpPbG.exe
  2⤵
  PID:12616
- C:\Windows\System\nPvZkbd.exe
  C:\Windows\System\nPvZkbd.exe
  2⤵
  PID:12740
- C:\Windows\System\BWNRHQZ.exe
  C:\Windows\System\BWNRHQZ.exe
  2⤵
  PID:4492
- C:\Windows\System\dAhxxej.exe
  C:\Windows\System\dAhxxej.exe
  2⤵
  PID:12564
- C:\Windows\System\jQyBLED.exe
  C:\Windows\System\jQyBLED.exe
  2⤵
  PID:3160
- C:\Windows\System\ObeGzGo.exe
  C:\Windows\System\ObeGzGo.exe
  2⤵
  PID:13336
- C:\Windows\System\ocBxlYD.exe
  C:\Windows\System\ocBxlYD.exe
  2⤵
  PID:13364
- C:\Windows\System\LcdHGoV.exe
  C:\Windows\System\LcdHGoV.exe
  2⤵
  PID:13388
- C:\Windows\System\jnQIWYS.exe
  C:\Windows\System\jnQIWYS.exe
  2⤵
  PID:13408
- C:\Windows\System\aDUuyEd.exe
  C:\Windows\System\aDUuyEd.exe
  2⤵
  PID:13432
- C:\Windows\System\OTLCgRk.exe
  C:\Windows\System\OTLCgRk.exe
  2⤵
  PID:13476
- C:\Windows\System\pLwhbCA.exe
  C:\Windows\System\pLwhbCA.exe
  2⤵
  PID:13508
- C:\Windows\System\AOZhRWY.exe
  C:\Windows\System\AOZhRWY.exe
  2⤵
  PID:13532
- C:\Windows\System\sgsbRjY.exe
  C:\Windows\System\sgsbRjY.exe
  2⤵
  PID:13572
- C:\Windows\System\YvzOqfw.exe
  C:\Windows\System\YvzOqfw.exe
  2⤵
  PID:13588
- C:\Windows\System\IhgxLQz.exe
  C:\Windows\System\IhgxLQz.exe
  2⤵
  PID:13624
- C:\Windows\System\wLdRmJB.exe
  C:\Windows\System\wLdRmJB.exe
  2⤵
  PID:13660
- C:\Windows\System\uvcdhnG.exe
  C:\Windows\System\uvcdhnG.exe
  2⤵
  PID:13676
- C:\Windows\System\ulTXZoU.exe
  C:\Windows\System\ulTXZoU.exe
  2⤵
  PID:13720
- C:\Windows\System\uLjgloc.exe
  C:\Windows\System\uLjgloc.exe
  2⤵
  PID:13748
- C:\Windows\System\mZBrZfZ.exe
  C:\Windows\System\mZBrZfZ.exe
  2⤵
  PID:13776
- C:\Windows\System\GRrRecM.exe
  C:\Windows\System\GRrRecM.exe
  2⤵
  PID:13804
- C:\Windows\System\mHbYzmO.exe
  C:\Windows\System\mHbYzmO.exe
  2⤵
  PID:13820
- C:\Windows\System\eSqfmlm.exe
  C:\Windows\System\eSqfmlm.exe
  2⤵
  PID:13848
- C:\Windows\System\xDENXfp.exe
  C:\Windows\System\xDENXfp.exe
  2⤵
  PID:13876
- C:\Windows\System\OMIqLrB.exe
  C:\Windows\System\OMIqLrB.exe
  2⤵
  PID:13904
- C:\Windows\System\gblBBjC.exe
  C:\Windows\System\gblBBjC.exe
  2⤵
  PID:13936
- C:\Windows\System\tjGddZC.exe
  C:\Windows\System\tjGddZC.exe
  2⤵
  PID:13968
- C:\Windows\System\MwNxKva.exe
  C:\Windows\System\MwNxKva.exe
  2⤵
  PID:13996
- C:\Windows\System\hEwGSII.exe
  C:\Windows\System\hEwGSII.exe
  2⤵
  PID:14024
- C:\Windows\System\ueEKlqW.exe
  C:\Windows\System\ueEKlqW.exe
  2⤵
  PID:14052
- C:\Windows\System\Ukgpsxk.exe
  C:\Windows\System\Ukgpsxk.exe
  2⤵
  PID:14080
- C:\Windows\System\sZwlpAQ.exe
  C:\Windows\System\sZwlpAQ.exe
  2⤵
  PID:14128
- C:\Windows\System\DfQJJwY.exe
  C:\Windows\System\DfQJJwY.exe
  2⤵
  PID:14156
- C:\Windows\System\OXkUpvb.exe
  C:\Windows\System\OXkUpvb.exe
  2⤵
  PID:14172
- C:\Windows\System\zWDEfvA.exe
  C:\Windows\System\zWDEfvA.exe
  2⤵
  PID:14212
- C:\Windows\System\CAyTKjW.exe
  C:\Windows\System\CAyTKjW.exe
  2⤵
  PID:14240
- C:\Windows\System\lAioUrZ.exe
  C:\Windows\System\lAioUrZ.exe
  2⤵
  PID:14272
- C:\Windows\System\NFgtAzT.exe
  C:\Windows\System\NFgtAzT.exe
  2⤵
  PID:14288
- C:\Windows\System\GCpcBvN.exe
  C:\Windows\System\GCpcBvN.exe
  2⤵
  PID:14328
- C:\Windows\System\BmZkmkb.exe
  C:\Windows\System\BmZkmkb.exe
  2⤵
  PID:13316
- C:\Windows\System\bJxzWex.exe
  C:\Windows\System\bJxzWex.exe
  2⤵
  PID:13380
- C:\Windows\System\jXWqPQH.exe
  C:\Windows\System\jXWqPQH.exe
  2⤵
  PID:13416
- C:\Windows\System\wMKlpug.exe
  C:\Windows\System\wMKlpug.exe
  2⤵
  PID:13524
- C:\Windows\System\vUFAFFw.exe
  C:\Windows\System\vUFAFFw.exe
  2⤵
  PID:13568
- C:\Windows\System\kNCdYlG.exe
  C:\Windows\System\kNCdYlG.exe
  2⤵
  PID:13648
- C:\Windows\System\iqBzbXH.exe
  C:\Windows\System\iqBzbXH.exe
  2⤵
  PID:13668
- C:\Windows\System\jhWAQVL.exe
  C:\Windows\System\jhWAQVL.exe
  2⤵
  PID:13796
- C:\Windows\System\zbtHmhd.exe
  C:\Windows\System\zbtHmhd.exe
  2⤵
  PID:13812
- C:\Windows\System\XAEDBzx.exe
  C:\Windows\System\XAEDBzx.exe
  2⤵
  PID:13892
- C:\Windows\System\bMfHKDf.exe
  C:\Windows\System\bMfHKDf.exe
  2⤵
  PID:13956
- C:\Windows\System\OWOSLVZ.exe
  C:\Windows\System\OWOSLVZ.exe
  2⤵
  PID:14048
- C:\Windows\System\YVOqSQI.exe
  C:\Windows\System\YVOqSQI.exe
  2⤵
  PID:14108
- C:\Windows\System\QdPPlwx.exe
  C:\Windows\System\QdPPlwx.exe
  2⤵
  PID:14168
- C:\Windows\System\TheqVIS.exe
  C:\Windows\System\TheqVIS.exe
  2⤵
  PID:14208
- C:\Windows\System\zfwVBBh.exe
  C:\Windows\System\zfwVBBh.exe
  2⤵
  PID:14300
- C:\Windows\System\BoNLjuX.exe
  C:\Windows\System\BoNLjuX.exe
  2⤵
  PID:13384
- C:\Windows\System\FrvsQsq.exe
  C:\Windows\System\FrvsQsq.exe
  2⤵
  PID:13468
- C:\Windows\System\CNiGhkk.exe
  C:\Windows\System\CNiGhkk.exe
  2⤵
  PID:13580
- C:\Windows\System\LZVSPXH.exe
  C:\Windows\System\LZVSPXH.exe
  2⤵
  PID:13740
- C:\Windows\System\zVmEJJU.exe
  C:\Windows\System\zVmEJJU.exe
  2⤵
  PID:13896
- C:\Windows\System\ziybScx.exe
  C:\Windows\System\ziybScx.exe
  2⤵
  PID:14036
- C:\Windows\System\hwZmsLc.exe
  C:\Windows\System\hwZmsLc.exe
  2⤵
  PID:12544
- C:\Windows\System\bEyzMkN.exe
  C:\Windows\System\bEyzMkN.exe
  2⤵
  PID:14284
- C:\Windows\System\jQWSkgo.exe
  C:\Windows\System\jQWSkgo.exe
  2⤵
  PID:13428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AtrXxmC.exe

Filesize
2.1MB

MD5
50937798b7ae8a7ff8d6282156582667

SHA1
206b1520679148da0e6331236ea5ca202d1afc27

SHA256
6329069d554b2588677aab1ec1c6ce61135cafc9a4b878edcfb16dacefe616d6

SHA512
1b248f5fc72f1be197f7a8f513acdfa253ed4decff72fee9a7232aa5423a3b0db91c5822000e71524104380b9a1e459df45f38eaab05536355d619fb1b729b39

Download Submit
C:\Windows\System\DcxVwZA.exe

Filesize
2.1MB

MD5
3d062c994f94caa0be81513b0cad0e28

SHA1
570d8bfd3edc8324d885a8047a7c20adab8abf78

SHA256
61623c201b6d6c32738a00c6180f7d7eb9ab06c7dcf4f2bab3d50bfac3b81918

SHA512
1ab04f6d88ada111bef58fac3f9d27b6cf1383f1c564d105801b3621fb85b0776825dbe5d31a7f5eb9f18aa81576be5ab30779e493af3369151bbdad3825a7a7

Download Submit
C:\Windows\System\EWtiyzU.exe

Filesize
2.1MB

MD5
047c1b99aef2daa60fdfb8a05e3b92b0

SHA1
ecff340d75a3f5ab8e0f3f105366ed46bcb92ceb

SHA256
5550fb52a21341f245feb8d9600db477a9d85415d9bc64e7f837c3aa88206734

SHA512
1c5c149f2491c91a812b3afff012fcea3597191c829a025796c0c21f902117407761abe1e530fc5b6348032b6c27fd4a4275ad86a3ca59390ef4526137b8a6ba

Download Submit
C:\Windows\System\HXdqNRV.exe

Filesize
2.1MB

MD5
df51f32f64bb5bfe16cd57b0fb5053d8

SHA1
f20e220b0c52b8e0f3672c8c39c7c55919830ec1

SHA256
2c55ae5d8e32a77219e25335b43ec8f2eab96deeaf672402bdf0fadeee0c455a

SHA512
47d908c90d9ec86d70548aa5835d688a32cbafa80339412d1bf53bcef2e4ce1d62519bebb10aba0c279d57091bb7770a327e25167aad7ccf3507e8b52ddb149b

Download Submit
C:\Windows\System\HeJYrPi.exe

Filesize
2.1MB

MD5
476b3a4c7e9d93a2d45f7a64e2c0a2da

SHA1
b573c9a34b19d4980eeccb6143c3921e7700e5fc

SHA256
07a240b7f5e3f54b275837512dc419bb7e1d4f675aa01f9d602ebfbaf137a041

SHA512
ffffabfd1f8f8ecb8cd5f872d1052d9dd9b91b4000646d8918466ed974695307bb432d1b895cca4f3d1a9a6ae35b3737423557d00f2e2bcbbec5c9bf7d99407f

Download Submit
C:\Windows\System\LqSiJxj.exe

Filesize
2.1MB

MD5
ab3ae062a46242025360e623e580924d

SHA1
e62489752082a041abc54785f0e5e4094c4d9a68

SHA256
60267aabee3d419e0f7baacba41117611f3618735fc10699078994113da521f2

SHA512
67fc61f45ba0cf224c7ec2e635897a8be73701279d0c7ff322442b3b61cb922a75e6bc2439277b04ba946bf24ff42a31b4944ddc753f08c5594cdcdee6b94be2

Download Submit
C:\Windows\System\MngEHFk.exe

Filesize
2.1MB

MD5
a691f9b0b73d6426abcc9f56616cf303

SHA1
c1a5116c1181edb239fc03ff43fe28083ff64fb1

SHA256
1460a742f47c861152a14659113f83df031248f3f7be18233d4d616ad0602310

SHA512
e1cc3e8057e03eae0787a63c259f62fbd277ba94855996588f1e257290780e2116ae8178b889a2a9d9278e28a581b526497b01088dbc6ab01e119cd360e52cd3

Download Submit
C:\Windows\System\NocnVRH.exe

Filesize
2.1MB

MD5
d564386423204c0366eefbc25cf7d2a0

SHA1
dd5626a8eadb9248e461883991b657560eb99490

SHA256
5f127b3934eadb799a0663fca08f0532105ba1457daaec78a62ab1cb9d217aed

SHA512
3b735602d450efcb3b922bbb6167cdced10a8e09cb9a60cc5da8591c5da30f1217d4555f28aa3d9c877c5d9ea0c4d961ce2e8905d55ea79fb3c545534226fcef

Download Submit
C:\Windows\System\NvwutWu.exe

Filesize
2.1MB

MD5
a12676eb1c4e4b5e27f4743efe349db0

SHA1
23c7f7abe2a6ca9b7b319391194010594dfcc19d

SHA256
55e88f7232635977dd18daa2a18823778db4058a9160d7103bc0b6ae62d70ada

SHA512
364d69586cb06c6a2ba55f6169174fa6a56cbae8d572caf88b2746f9374d38475d4f457266a4fbc9b6b21d2889913abd9c72a6feba178142b6bbdbb23c7cae22

Download Submit
C:\Windows\System\QKKaPZF.exe

Filesize
2.1MB

MD5
7867ba224d57acc4cb5f55217a61452a

SHA1
c653c5695b4fdf864c4e2a7dc0460eea5b03b642

SHA256
97b76e92fc6bc5e12883846a0cd405d8e136b0054b3f33674e40ce7ec2234a0e

SHA512
953ed8c968ff489e63775e650f871a0c7e98c8cf15c7e0dc4a2516ff9f76477c47bded144b2ac4b808acef5896f42c2ff90534eb1e455b9ada0f2bf754b06769

Download Submit
C:\Windows\System\QfPovgj.exe

Filesize
2.1MB

MD5
34e10374adaffdbd90877d31e4d704c0

SHA1
c2bd3e70b4bfe1d9b3859477dec312636d838965

SHA256
49e261826f7075f1999404f7d5530113a630678dbf987aaa541636df9d12504b

SHA512
d66ee901bf429477142d3af372c7530ea696cdf752fa05e0bf452de34f0a39c7d88ccd204d3b62b3f187af070ff6bf30e1a05e3f98f77056d864f5b46baa37ec

Download Submit
C:\Windows\System\SCYQTgy.exe

Filesize
2.1MB

MD5
cc7397f94c022ff9818bcd901882eee1

SHA1
abde186edc89346844855aaeebb5c0cfcd7723f5

SHA256
fd5ecc62e9dab8eea78c31e6e5ecb0d794fff13cd6c8277745c633141dc99e40

SHA512
224c645facc1f7745a378853dfe588d66972633a6279b81eaf56e1dcad60d74af47a12fee45562dcd4579a2d6bdcd486dab31e43901a3452656f88a8d8e8291f

Download Submit
C:\Windows\System\UXQHVxQ.exe

Filesize
2.1MB

MD5
0f624854fdcea2c945cda612f3c1ec72

SHA1
faebf3fe52de78648017b36a6fc90c89e23e22a4

SHA256
f57d2875bfb183d56e66252a81535c71fb1a5c3580bc7574ffe6258aba33121d

SHA512
f544264514eec7ca62a1cd089bdae3d5001d8bb001d0e63bbca0b93c8e9ff18b953398bfd01bd6b2efb7df17c1c1ad0e98a10da2e03477f1167f4667317554c0

Download Submit
C:\Windows\System\dNUqKJw.exe

Filesize
2.1MB

MD5
c93c6774dbaec188e5058d76cf68b89f

SHA1
5f52aff900b4d7726027c40ac97f112f15129371

SHA256
7e02944e076a2c1908f3c732fd50bc8f208598db7982f8cb71ea33bbf2b8f3c4

SHA512
c07a426bdfe0c77adeae042f5b87cababd12b8694c694af18e09a790f604d2684c9e3e0dc7177195d6b96b9f872bff533e2083644d3755a4db09423f73dad1e9

Download Submit
C:\Windows\System\gSyHqHT.exe

Filesize
2.1MB

MD5
43297e4aa99c3baa2ac7dae94d783220

SHA1
5f649b3aef09661e2a594b11c7e9fa5756cb170b

SHA256
eb621ffd2ba83cd7392c0c4d2c058235cd3124f2d08fa634d02e6aa5cc46ad15

SHA512
8cd6059f6c28b583e52a865993656f3d5793479992d38fcbbfbcf4f085d73eb0cd2441a549c18b38485cdc7669451e610c9936ed68bfe5cefea334be1362194c

Download Submit
C:\Windows\System\hiBycNh.exe

Filesize
2.1MB

MD5
0fee09ff6ead5a8a81349387de81161d

SHA1
e2510e5127fc7b16873c73b3d3f32ffa347815ed

SHA256
c84edffe322225061c88e46405918591c1e275c2f7736dfe0c590e8293c15019

SHA512
410ce21623272344b2a6137ff82a931f1b4e3a6099fefa5e715219334d37b01a5a3a3fb41269eb4c5f1e919acb899d3c5b2b19dae52f2d6b1498c7c78b5a2fa2

Download Submit
C:\Windows\System\jfUULrE.exe

Filesize
2.1MB

MD5
9ea1a444d0d4f406d49d980d92f8ae51

SHA1
c2267aa402b390e64e5fafc55a850f0124811cd2

SHA256
96d676a054a8a582ed1bc80930bc691805f444f69b75060db7860011eb3ffe5e

SHA512
f4baa37ef66464b53b6ff94e945ff6e9b713a820270a1f89c2384cc4a1913b21992e34a70be6d0a73aa0cbe5ca61194b84c279d9ac1f30741b1d0581f6d39fdf

Download Submit
C:\Windows\System\lKvxwVT.exe

Filesize
2.1MB

MD5
e97af1808e7b111ec2954fe6f30d988b

SHA1
ca4006b049f6b2d2675d7e04872a90db2681cf19

SHA256
3005f72ea843a0d4cbf568667cd9839e84bb121578e02cb6df92239c6875525f

SHA512
96b74acb0f2e45296793abbbdc0bc524b2dd1a03862932fa50fb63e2de6af06d61f47e3773831520ca53c54a3057db87a84d7341926ae3a0f1b29c13be50bc2d

Download Submit
C:\Windows\System\lOpZgSl.exe

Filesize
2.1MB

MD5
1ab99842ae736924217d1589737272ff

SHA1
4f78d89caf26a5b876bc1df7d30468ae13052d62

SHA256
36c483dc51508c171f28786eda06c7642aedfc28ac97dcf355a63ab10a0f21d9

SHA512
f49e2be412f8939774ea5ab5ed541afa32d48ea7e1c3511f754e119409cf186c4283c3937a2ce74571e59169a9cf421f0e22c7c7423c3053e4694c824f1a25ad

Download Submit
C:\Windows\System\lQyMbHi.exe

Filesize
2.1MB

MD5
c3744afae7992db28edfdf290453d58a

SHA1
0cf7dc82faabd70a410b253ffdb1ec1fe7550084

SHA256
b634d6e04c097848303299243948c5d0a048da819106d46f1a4cce1e9a74cac9

SHA512
a86c9b73ea5cc166bf37daab72bc185ff3dd93606666f50dd6ef98e048d01e680b2d531c00a93a76894b10074ee44d61c2f8952558923c31630d5445c267e2a0

Download Submit
C:\Windows\System\lpBSQUV.exe

Filesize
2.1MB

MD5
5741089b291650e0e611a4cd2f241143

SHA1
cc6e61e30947904e2f52ad00f787ec1f60d7b1c0

SHA256
39dd4bf83b305ee2964f3b9eb9617998fcc98080ea652101309c7ec741574279

SHA512
ffc2eacf8029ea75e1d5436da2d341b9c00e4833087afecb7f1d1caaa5d502f801787b4575153168b6714287a767de623d24f6757b6c4d9b70af36598f7ac7b8

Download Submit
C:\Windows\System\mFzGPao.exe

Filesize
2.1MB

MD5
09afa610c19344849f6c6d4502c20d9e

SHA1
5a3c3af9f3c3e644225760354f4ffa5da772e0fb

SHA256
7492c865e4374933bb00110e8bf9884b8d9fefe906372437e1493a9d3618997a

SHA512
cc2bbebb57645cd1550970bf12176cb55fce7f04c02651356248782a67a978781829f61c36b27446887af720e9fc82f6b957ae1e65fb863d229f10e0c3edc796

Download Submit
C:\Windows\System\nPfvZrN.exe

Filesize
2.1MB

MD5
26abd5e8985ec365dffb53270c9bfc8c

SHA1
69ffa638563f1886cfda925b45c0ce6f8cbf5fc6

SHA256
d6afc6b67db4d822aaef352615f992c77e0b7e61c74264a6c56c012a57331a2f

SHA512
38f418fc94a1b392b7ecf8ef57c12b72a9101788fb910d9610d18b8d932bb637355ccbf2bcb8d29746273b6b4a1cdf72196a6635300fc67a443f1f57919ce1ed

Download Submit
C:\Windows\System\nXXsSoj.exe

Filesize
2.1MB

MD5
3691615b450185b6953747493721e716

SHA1
599efc296108f71e463312fe0de6aff6d7a60c4c

SHA256
f818bbb89e514fcec2ad02142eadd78487a0529d4b57e6470a5e6ffdc7bfd80d

SHA512
3f557c79d17e292400140246ac291c3221b2e094c0999154495c21d91bcb97c4babd35d66dc31fb6660b9a02328dd1f07e6b8c3fe16ed3d26cdf087c6a5451fb

Download Submit
C:\Windows\System\nqUzXjS.exe

Filesize
2.1MB

MD5
eb5f30da4333cae13249eb738c59cc15

SHA1
f31c2f54de8227efc3c862074ba5145e292f1224

SHA256
c7c9030cfb94d0ba45050f55cf0ad20e988bbee8eaf80bdda01c3b60127956a7

SHA512
5109f7316f60935817983eea92b8c2aa82e9a9e202754990ae135ae0904d467b153e0121d413e4586260b458fb7d214da495422cdb06c1cdf8c5ba56d3530ff5

Download Submit
C:\Windows\System\ooooydA.exe

Filesize
2.1MB

MD5
5cb11017dd0bf1ed2605842f89cebea4

SHA1
5d0c60a926a7eb18eec49580f8498d5d499ef8c3

SHA256
238e9f300b594625d50a7bcc582df57a7d7b2b94c1184774fbd1b8c92371e0a8

SHA512
c02528f5068d1df57a148cac4372d9a1db45056a2185c7e59717389eb8e880735e47bdeadcbb985aad59c44588f7821baa02a10b52da3aa3d0c35c55bc6d14b6

Download Submit
C:\Windows\System\qpcNYCV.exe

Filesize
2.1MB

MD5
3bb92907677b00fc85e57e2537fb98ba

SHA1
44ef1da686b7c217b200b48599d1bf6fc62a9840

SHA256
86081f4bfef5d5cfa73a374d745a30a4967e75f4b425cdd740a33c39c04f4487

SHA512
7ceee443e81cf79b2d440f92d638561b4a7b0a64a3670810f85e9fa75201c72d1e8ba132e9a388aa28f6f8151f3b791339e8f5cda202e5010eb2abac7428a264

Download Submit
C:\Windows\System\quXJtCZ.exe

Filesize
2.1MB

MD5
9d2cac85fa245963315707b0f1aa792f

SHA1
2bc79ff4deb90a4ee921630284c332a280ec264f

SHA256
d3c54ef0f3f32c146651c0e66f22aabf6f6655c32c7b4e155803fd92c5910983

SHA512
7f6ac9bc2713061488bf976e04c8e7472b9692d963c9bae5adc9521cc8188b1c9a415712d2dd3e7ae4490da71e5799f3fb0b48cbc7469d9e7b5208fd345cbf4a

Download Submit
C:\Windows\System\rOsCCKj.exe

Filesize
2.1MB

MD5
0e377b2a733fc19408c67350a0078b0e

SHA1
2c6efcef98c75d4e4ce77756de53297b520462d3

SHA256
7fb771a618fe0b9e831d60944f3b0acc4975420937e73c347b465f3adc3942be

SHA512
53727d5143da1991343c688f02e19b58f28a0ae9a0dece466a9a7b38c1ea45d0d71079361186477924498ed71c3c4988624a1c68cbbb942fd966af8049282065

Download Submit
C:\Windows\System\tqrJZlI.exe

Filesize
2.1MB

MD5
5e9a4b00d13f58d653c67461d58b8c13

SHA1
377e881b1ac8efe3a5e3be0c7588aa4ace8c14a9

SHA256
c39ecde29913316f1fff6f796dd4734e72720d500fe6c9e5347dfe1c93e5fb9b

SHA512
1163f281ccf8b21a1c4b53aa357471976fc3782b1388dc5263018b6005dc755b5937bf7675db30a13591c562f21a91c565a251e4844672de5eccee4ba6a6bfe8

Download Submit
C:\Windows\System\ulCnaaO.exe

Filesize
2.1MB

MD5
6efd965927f903206d902c97ae963724

SHA1
57685a57538d72b5a1a9aa18136f2d68f4ed0d55

SHA256
eb752b480c44683fcfaca6dc7891389c79c19d9f2e09d6063ac804ff8ce4edb1

SHA512
2e62f6077a952dcfde714558b1ab2e265a90917b458ad59623bcca4b154a4c7f9887bac696fd4ccd8db4ad061b62e58a87f5c265e9cca3df8a8d480d4b3a312b

Download Submit
C:\Windows\System\vahxvEH.exe

Filesize
2.1MB

MD5
96acb7b9309c5f3f14bf37bb498a3984

SHA1
2eedc7b7b97a4f1ff36506f53beba6ef19c713cf

SHA256
58f5b19edc823e528a7965301610aa8937a5a1bfc3a78549ae06800fba942e8d

SHA512
4d03542b096de7c845eb7cbb31f9caad798b639a7278f4ba2ae8d3e64c6e94bc12195e189ccd9cea6b2aefae87fc38913307e3510881454ac32d74b3705864cd

Download Submit
C:\Windows\System\xGpvpzS.exe

Filesize
2.1MB

MD5
c082b509240e098328557c6bd82a4064

SHA1
e5feaa14461599684eda8fdaa4f683d6c392d6fe

SHA256
7eff043f5e39c4b59d5bde83f929bcf71fd42d11c60a9698421d4343ef3086d5

SHA512
afc4038a8393dbc7fec03e8f1b179cf3e56b3bcb4b7fdafc91aa3933fa02a44a5dcfbb8e805e1b92285c2f2d66cc40eff236e7989e99ddfe352eba50c8803384

Download Submit
memory/400-58-0x00007FF7E1A00000-0x00007FF7E1D54000-memory.dmp

Filesize
3.3MB

Download
memory/400-2118-0x00007FF7E1A00000-0x00007FF7E1D54000-memory.dmp

Filesize
3.3MB

Download
memory/400-2127-0x00007FF7E1A00000-0x00007FF7E1D54000-memory.dmp

Filesize
3.3MB

Download
memory/640-2147-0x00007FF7C16B0000-0x00007FF7C1A04000-memory.dmp

Filesize
3.3MB

Download
memory/640-368-0x00007FF7C16B0000-0x00007FF7C1A04000-memory.dmp

Filesize
3.3MB

Download
memory/1116-2141-0x00007FF778DD0000-0x00007FF779124000-memory.dmp

Filesize
3.3MB

Download
memory/1116-353-0x00007FF778DD0000-0x00007FF779124000-memory.dmp

Filesize
3.3MB

Download
memory/1388-23-0x00007FF7240B0000-0x00007FF724404000-memory.dmp

Filesize
3.3MB

Download
memory/1388-2121-0x00007FF7240B0000-0x00007FF724404000-memory.dmp

Filesize
3.3MB

Download
memory/1396-2129-0x00007FF6D6360000-0x00007FF6D66B4000-memory.dmp

Filesize
3.3MB

Download
memory/1396-322-0x00007FF6D6360000-0x00007FF6D66B4000-memory.dmp

Filesize
3.3MB

Download
memory/1552-2122-0x00007FF6EC040000-0x00007FF6EC394000-memory.dmp

Filesize
3.3MB

Download
memory/1552-15-0x00007FF6EC040000-0x00007FF6EC394000-memory.dmp

Filesize
3.3MB

Download
memory/1776-2142-0x00007FF724940000-0x00007FF724C94000-memory.dmp

Filesize
3.3MB

Download
memory/1776-349-0x00007FF724940000-0x00007FF724C94000-memory.dmp

Filesize
3.3MB

Download
memory/1780-2130-0x00007FF70C0F0000-0x00007FF70C444000-memory.dmp

Filesize
3.3MB

Download
memory/1780-323-0x00007FF70C0F0000-0x00007FF70C444000-memory.dmp

Filesize
3.3MB

Download
memory/1812-336-0x00007FF7EA1D0000-0x00007FF7EA524000-memory.dmp

Filesize
3.3MB

Download
memory/1812-2131-0x00007FF7EA1D0000-0x00007FF7EA524000-memory.dmp

Filesize
3.3MB

Download
memory/2012-365-0x00007FF66ADA0000-0x00007FF66B0F4000-memory.dmp

Filesize
3.3MB

Download
memory/2012-2145-0x00007FF66ADA0000-0x00007FF66B0F4000-memory.dmp

Filesize
3.3MB

Download
memory/2344-327-0x00007FF776010000-0x00007FF776364000-memory.dmp

Filesize
3.3MB

Download
memory/2344-2133-0x00007FF776010000-0x00007FF776364000-memory.dmp

Filesize
3.3MB

Download
memory/2436-324-0x00007FF743B10000-0x00007FF743E64000-memory.dmp

Filesize
3.3MB

Download
memory/2436-2132-0x00007FF743B10000-0x00007FF743E64000-memory.dmp

Filesize
3.3MB

Download
memory/2520-359-0x00007FF658F10000-0x00007FF659264000-memory.dmp

Filesize
3.3MB

Download
memory/2520-2148-0x00007FF658F10000-0x00007FF659264000-memory.dmp

Filesize
3.3MB

Download
memory/2888-2134-0x00007FF76B1F0000-0x00007FF76B544000-memory.dmp

Filesize
3.3MB

Download
memory/2888-63-0x00007FF76B1F0000-0x00007FF76B544000-memory.dmp

Filesize
3.3MB

Download
memory/2888-2120-0x00007FF76B1F0000-0x00007FF76B544000-memory.dmp

Filesize
3.3MB

Download
memory/2984-343-0x00007FF792290000-0x00007FF7925E4000-memory.dmp

Filesize
3.3MB

Download
memory/2984-2144-0x00007FF792290000-0x00007FF7925E4000-memory.dmp

Filesize
3.3MB

Download
memory/3224-2143-0x00007FF69A2E0000-0x00007FF69A634000-memory.dmp

Filesize
3.3MB

Download
memory/3224-346-0x00007FF69A2E0000-0x00007FF69A634000-memory.dmp

Filesize
3.3MB

Download
memory/3336-2125-0x00007FF7CD4F0000-0x00007FF7CD844000-memory.dmp

Filesize
3.3MB

Download
memory/3336-2115-0x00007FF7CD4F0000-0x00007FF7CD844000-memory.dmp

Filesize
3.3MB

Download
memory/3336-33-0x00007FF7CD4F0000-0x00007FF7CD844000-memory.dmp

Filesize
3.3MB

Download
memory/3620-68-0x00007FF6E2BE0000-0x00007FF6E2F34000-memory.dmp

Filesize
3.3MB

Download
memory/3620-2146-0x00007FF6E2BE0000-0x00007FF6E2F34000-memory.dmp

Filesize
3.3MB

Download
memory/3764-340-0x00007FF656EA0000-0x00007FF6571F4000-memory.dmp

Filesize
3.3MB

Download
memory/3764-2138-0x00007FF656EA0000-0x00007FF6571F4000-memory.dmp

Filesize
3.3MB

Download
memory/3944-356-0x00007FF6BF750000-0x00007FF6BFAA4000-memory.dmp

Filesize
3.3MB

Download
memory/3944-2149-0x00007FF6BF750000-0x00007FF6BFAA4000-memory.dmp

Filesize
3.3MB

Download
memory/4028-326-0x00007FF7F3FC0000-0x00007FF7F4314000-memory.dmp

Filesize
3.3MB

Download
memory/4028-2136-0x00007FF7F3FC0000-0x00007FF7F4314000-memory.dmp

Filesize
3.3MB

Download
memory/4388-2119-0x00007FF79BB10000-0x00007FF79BE64000-memory.dmp

Filesize
3.3MB

Download
memory/4388-59-0x00007FF79BB10000-0x00007FF79BE64000-memory.dmp

Filesize
3.3MB

Download
memory/4388-2135-0x00007FF79BB10000-0x00007FF79BE64000-memory.dmp

Filesize
3.3MB

Download
memory/4564-325-0x00007FF759290000-0x00007FF7595E4000-memory.dmp

Filesize
3.3MB

Download
memory/4564-2137-0x00007FF759290000-0x00007FF7595E4000-memory.dmp

Filesize
3.3MB

Download
memory/4608-333-0x00007FF7DBE30000-0x00007FF7DC184000-memory.dmp

Filesize
3.3MB

Download
memory/4608-2139-0x00007FF7DBE30000-0x00007FF7DC184000-memory.dmp

Filesize
3.3MB

Download
memory/4640-65-0x00007FF6CA890000-0x00007FF6CABE4000-memory.dmp

Filesize
3.3MB

Download
memory/4640-2126-0x00007FF6CA890000-0x00007FF6CABE4000-memory.dmp

Filesize
3.3MB

Download
memory/4772-328-0x00007FF7F51F0000-0x00007FF7F5544000-memory.dmp

Filesize
3.3MB

Download
memory/4772-2140-0x00007FF7F51F0000-0x00007FF7F5544000-memory.dmp

Filesize
3.3MB

Download
memory/4904-1-0x0000026919DE0000-0x0000026919DF0000-memory.dmp

Filesize
64KB

Download
memory/4904-2114-0x00007FF6F21F0000-0x00007FF6F2544000-memory.dmp

Filesize
3.3MB

Download
memory/4904-0-0x00007FF6F21F0000-0x00007FF6F2544000-memory.dmp

Filesize
3.3MB

Download
memory/4916-2128-0x00007FF60E2E0000-0x00007FF60E634000-memory.dmp

Filesize
3.3MB

Download
memory/4916-37-0x00007FF60E2E0000-0x00007FF60E634000-memory.dmp

Filesize
3.3MB

Download
memory/4916-2117-0x00007FF60E2E0000-0x00007FF60E634000-memory.dmp

Filesize
3.3MB

Download
memory/5044-2116-0x00007FF685900000-0x00007FF685C54000-memory.dmp

Filesize
3.3MB

Download
memory/5044-26-0x00007FF685900000-0x00007FF685C54000-memory.dmp

Filesize
3.3MB

Download
memory/5044-2124-0x00007FF685900000-0x00007FF685C54000-memory.dmp

Filesize
3.3MB

Download
memory/5048-2123-0x00007FF6C1560000-0x00007FF6C18B4000-memory.dmp

Filesize
3.3MB

Download
memory/5048-44-0x00007FF6C1560000-0x00007FF6C18B4000-memory.dmp

Filesize
3.3MB

Download