xmrig | 359916b3dfbbd462bd69a99b244c75d555283ebb76cc9dd280b95673713f4ef9

Analysis

max time kernel
122s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
Size

2.1MB
MD5

b68fe5b31950d0a499d45df1861ba480
SHA1

754b313ec19a90c4723cf6d330d0adb74d32a1f4
SHA256

359916b3dfbbd462bd69a99b244c75d555283ebb76cc9dd280b95673713f4ef9
SHA512

4ba396c5fea8c958ee8f828c2c4d04ee26e85481e2b532efec32e25b10032579eb2aa066b95f4341103124e528f7913cb34fab4210e11ae5eabb253dc65ca809
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQW/zaZTqWQi:BemTLkNdfE0pZrQz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4016-0-0x00007FF72FDE0000-0x00007FF730134000-memory.dmp	xmrig
behavioral2/files/0x000d000000023b24-4.dat	xmrig
behavioral2/memory/5048-8-0x00007FF621910000-0x00007FF621C64000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b8a-13.dat	xmrig
behavioral2/files/0x000b000000023b86-14.dat	xmrig
behavioral2/files/0x000a000000023b8b-21.dat	xmrig
behavioral2/files/0x000a000000023b8e-39.dat	xmrig
behavioral2/files/0x000a000000023b90-50.dat	xmrig
behavioral2/files/0x000a000000023b93-73.dat	xmrig
behavioral2/files/0x000a000000023b97-88.dat	xmrig
behavioral2/files/0x000a000000023b99-103.dat	xmrig
behavioral2/files/0x000a000000023b9c-119.dat	xmrig
behavioral2/files/0x000a000000023ba0-139.dat	xmrig
behavioral2/memory/1952-791-0x00007FF785060000-0x00007FF7853B4000-memory.dmp	xmrig
behavioral2/memory/2064-792-0x00007FF60F430000-0x00007FF60F784000-memory.dmp	xmrig
behavioral2/memory/3128-794-0x00007FF787130000-0x00007FF787484000-memory.dmp	xmrig
behavioral2/memory/1816-795-0x00007FF75BE60000-0x00007FF75C1B4000-memory.dmp	xmrig
behavioral2/memory/3356-796-0x00007FF65F870000-0x00007FF65FBC4000-memory.dmp	xmrig
behavioral2/memory/388-799-0x00007FF61DC50000-0x00007FF61DFA4000-memory.dmp	xmrig
behavioral2/memory/4600-798-0x00007FF624800000-0x00007FF624B54000-memory.dmp	xmrig
behavioral2/memory/3096-800-0x00007FF7B2B80000-0x00007FF7B2ED4000-memory.dmp	xmrig
behavioral2/memory/2120-802-0x00007FF7760C0000-0x00007FF776414000-memory.dmp	xmrig
behavioral2/memory/2732-801-0x00007FF660960000-0x00007FF660CB4000-memory.dmp	xmrig
behavioral2/memory/4756-803-0x00007FF7CB5C0000-0x00007FF7CB914000-memory.dmp	xmrig
behavioral2/memory/900-805-0x00007FF60EC70000-0x00007FF60EFC4000-memory.dmp	xmrig
behavioral2/memory/4796-804-0x00007FF6E0E60000-0x00007FF6E11B4000-memory.dmp	xmrig
behavioral2/memory/4204-797-0x00007FF7B64D0000-0x00007FF7B6824000-memory.dmp	xmrig
behavioral2/memory/3944-793-0x00007FF7BCF50000-0x00007FF7BD2A4000-memory.dmp	xmrig
behavioral2/memory/3140-806-0x00007FF792930000-0x00007FF792C84000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba8-173.dat	xmrig
behavioral2/files/0x000a000000023ba6-169.dat	xmrig
behavioral2/files/0x000a000000023ba7-168.dat	xmrig
behavioral2/files/0x000a000000023ba5-164.dat	xmrig
behavioral2/files/0x000a000000023ba4-156.dat	xmrig
behavioral2/files/0x000a000000023ba3-154.dat	xmrig
behavioral2/files/0x000a000000023ba2-149.dat	xmrig
behavioral2/files/0x000a000000023ba1-143.dat	xmrig
behavioral2/files/0x000a000000023b9f-134.dat	xmrig
behavioral2/files/0x000a000000023b9e-129.dat	xmrig
behavioral2/files/0x000a000000023b9d-124.dat	xmrig
behavioral2/files/0x000a000000023b9b-113.dat	xmrig
behavioral2/files/0x000a000000023b9a-109.dat	xmrig
behavioral2/files/0x000a000000023b98-99.dat	xmrig
behavioral2/files/0x000a000000023b96-89.dat	xmrig
behavioral2/files/0x000a000000023b95-83.dat	xmrig
behavioral2/files/0x000a000000023b94-79.dat	xmrig
behavioral2/files/0x000a000000023b92-69.dat	xmrig
behavioral2/files/0x000a000000023b91-61.dat	xmrig
behavioral2/memory/2100-60-0x00007FF693D80000-0x00007FF6940D4000-memory.dmp	xmrig
behavioral2/memory/3176-57-0x00007FF7836B0000-0x00007FF783A04000-memory.dmp	xmrig
behavioral2/memory/4480-56-0x00007FF771850000-0x00007FF771BA4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b8f-54.dat	xmrig
behavioral2/memory/1392-49-0x00007FF752000000-0x00007FF752354000-memory.dmp	xmrig
behavioral2/memory/1212-46-0x00007FF7749C0000-0x00007FF774D14000-memory.dmp	xmrig
behavioral2/memory/3444-42-0x00007FF75F460000-0x00007FF75F7B4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b8d-37.dat	xmrig
behavioral2/files/0x000a000000023b8c-30.dat	xmrig
behavioral2/memory/3496-22-0x00007FF7807F0000-0x00007FF780B44000-memory.dmp	xmrig
behavioral2/memory/4656-20-0x00007FF64C260000-0x00007FF64C5B4000-memory.dmp	xmrig
behavioral2/memory/2720-17-0x00007FF6CBC10000-0x00007FF6CBF64000-memory.dmp	xmrig
behavioral2/memory/372-833-0x00007FF7EE600000-0x00007FF7EE954000-memory.dmp	xmrig
behavioral2/memory/3692-847-0x00007FF6ED8B0000-0x00007FF6EDC04000-memory.dmp	xmrig
behavioral2/memory/3212-838-0x00007FF7C9090000-0x00007FF7C93E4000-memory.dmp	xmrig
behavioral2/memory/5048-2124-0x00007FF621910000-0x00007FF621C64000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5048	OgxhUav.exe
2720	zPdVULi.exe
4656	qFcltif.exe
3496	LgmfNKm.exe
3444	TZGNJKC.exe
1212	kuWlvQY.exe
1392	nagvcaF.exe
4480	HxUvwVg.exe
3176	iDPYkkc.exe
2100	LVabtnU.exe
1952	znFbcOk.exe
2064	BadIYcE.exe
3944	nRmkatr.exe
3128	qsbwOqt.exe
1816	qKkKxAT.exe
3356	yZGrZyo.exe
4204	fnvgtrO.exe
4600	KgaMExy.exe
388	UPUDltw.exe
3096	iLAUNXs.exe
2732	mILtkaW.exe
2120	lgaaDGH.exe
4756	rxVTnak.exe
4796	LXRYUuL.exe
900	EpdpVmU.exe
3140	HzLtmAN.exe
372	BCrcsye.exe
3212	TLOetyg.exe
3692	hyorfjr.exe
3508	IeSJTpf.exe
2476	hQadbHu.exe
4444	PnBqgFY.exe
1792	txcVooc.exe
4120	fFlHxlZ.exe
4768	ScGHajT.exe
2240	lJpaDov.exe
3104	tOTevUh.exe
712	iOicoIA.exe
664	ZKOpSfV.exe
548	xGxlgkN.exe
3456	eQbDYyL.exe
4420	AeEdGpG.exe
2748	BQImQBg.exe
2700	NvVwHcD.exe
3880	TPJbnwD.exe
3964	msOjNto.exe
628	fdGiqaO.exe
1140	ztdGEhO.exe
4916	zoRUIjM.exe
4608	KraSOJF.exe
728	JYIClWe.exe
4888	yFgkjTi.exe
4856	dyOJdyP.exe
4132	rsPmYoc.exe
1772	FqaKwVj.exe
3728	hZONRst.exe
3076	bVZrSoQ.exe
4484	ErtgKrY.exe
1076	wTHRazP.exe
4792	VGfwgiz.exe
3484	tFzmuhj.exe
4692	kmcgYek.exe
2424	YTwyQTW.exe
3388	doKcWKE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4016-0-0x00007FF72FDE0000-0x00007FF730134000-memory.dmp	upx
behavioral2/files/0x000d000000023b24-4.dat	upx
behavioral2/memory/5048-8-0x00007FF621910000-0x00007FF621C64000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-13.dat	upx
behavioral2/files/0x000b000000023b86-14.dat	upx
behavioral2/files/0x000a000000023b8b-21.dat	upx
behavioral2/files/0x000a000000023b8e-39.dat	upx
behavioral2/files/0x000a000000023b90-50.dat	upx
behavioral2/files/0x000a000000023b93-73.dat	upx
behavioral2/files/0x000a000000023b97-88.dat	upx
behavioral2/files/0x000a000000023b99-103.dat	upx
behavioral2/files/0x000a000000023b9c-119.dat	upx
behavioral2/files/0x000a000000023ba0-139.dat	upx
behavioral2/memory/1952-791-0x00007FF785060000-0x00007FF7853B4000-memory.dmp	upx
behavioral2/memory/2064-792-0x00007FF60F430000-0x00007FF60F784000-memory.dmp	upx
behavioral2/memory/3128-794-0x00007FF787130000-0x00007FF787484000-memory.dmp	upx
behavioral2/memory/1816-795-0x00007FF75BE60000-0x00007FF75C1B4000-memory.dmp	upx
behavioral2/memory/3356-796-0x00007FF65F870000-0x00007FF65FBC4000-memory.dmp	upx
behavioral2/memory/388-799-0x00007FF61DC50000-0x00007FF61DFA4000-memory.dmp	upx
behavioral2/memory/4600-798-0x00007FF624800000-0x00007FF624B54000-memory.dmp	upx
behavioral2/memory/3096-800-0x00007FF7B2B80000-0x00007FF7B2ED4000-memory.dmp	upx
behavioral2/memory/2120-802-0x00007FF7760C0000-0x00007FF776414000-memory.dmp	upx
behavioral2/memory/2732-801-0x00007FF660960000-0x00007FF660CB4000-memory.dmp	upx
behavioral2/memory/4756-803-0x00007FF7CB5C0000-0x00007FF7CB914000-memory.dmp	upx
behavioral2/memory/900-805-0x00007FF60EC70000-0x00007FF60EFC4000-memory.dmp	upx
behavioral2/memory/4796-804-0x00007FF6E0E60000-0x00007FF6E11B4000-memory.dmp	upx
behavioral2/memory/4204-797-0x00007FF7B64D0000-0x00007FF7B6824000-memory.dmp	upx
behavioral2/memory/3944-793-0x00007FF7BCF50000-0x00007FF7BD2A4000-memory.dmp	upx
behavioral2/memory/3140-806-0x00007FF792930000-0x00007FF792C84000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-173.dat	upx
behavioral2/files/0x000a000000023ba6-169.dat	upx
behavioral2/files/0x000a000000023ba7-168.dat	upx
behavioral2/files/0x000a000000023ba5-164.dat	upx
behavioral2/files/0x000a000000023ba4-156.dat	upx
behavioral2/files/0x000a000000023ba3-154.dat	upx
behavioral2/files/0x000a000000023ba2-149.dat	upx
behavioral2/files/0x000a000000023ba1-143.dat	upx
behavioral2/files/0x000a000000023b9f-134.dat	upx
behavioral2/files/0x000a000000023b9e-129.dat	upx
behavioral2/files/0x000a000000023b9d-124.dat	upx
behavioral2/files/0x000a000000023b9b-113.dat	upx
behavioral2/files/0x000a000000023b9a-109.dat	upx
behavioral2/files/0x000a000000023b98-99.dat	upx
behavioral2/files/0x000a000000023b96-89.dat	upx
behavioral2/files/0x000a000000023b95-83.dat	upx
behavioral2/files/0x000a000000023b94-79.dat	upx
behavioral2/files/0x000a000000023b92-69.dat	upx
behavioral2/files/0x000a000000023b91-61.dat	upx
behavioral2/memory/2100-60-0x00007FF693D80000-0x00007FF6940D4000-memory.dmp	upx
behavioral2/memory/3176-57-0x00007FF7836B0000-0x00007FF783A04000-memory.dmp	upx
behavioral2/memory/4480-56-0x00007FF771850000-0x00007FF771BA4000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-54.dat	upx
behavioral2/memory/1392-49-0x00007FF752000000-0x00007FF752354000-memory.dmp	upx
behavioral2/memory/1212-46-0x00007FF7749C0000-0x00007FF774D14000-memory.dmp	upx
behavioral2/memory/3444-42-0x00007FF75F460000-0x00007FF75F7B4000-memory.dmp	upx
behavioral2/files/0x000a000000023b8d-37.dat	upx
behavioral2/files/0x000a000000023b8c-30.dat	upx
behavioral2/memory/3496-22-0x00007FF7807F0000-0x00007FF780B44000-memory.dmp	upx
behavioral2/memory/4656-20-0x00007FF64C260000-0x00007FF64C5B4000-memory.dmp	upx
behavioral2/memory/2720-17-0x00007FF6CBC10000-0x00007FF6CBF64000-memory.dmp	upx
behavioral2/memory/372-833-0x00007FF7EE600000-0x00007FF7EE954000-memory.dmp	upx
behavioral2/memory/3692-847-0x00007FF6ED8B0000-0x00007FF6EDC04000-memory.dmp	upx
behavioral2/memory/3212-838-0x00007FF7C9090000-0x00007FF7C93E4000-memory.dmp	upx
behavioral2/memory/5048-2124-0x00007FF621910000-0x00007FF621C64000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BFfUydb.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\kKKdqlt.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\CJFbAAJ.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\umXRyXZ.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\lgNgevO.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\puRjveP.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\zhwXwiO.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\UDpbgXS.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\QCPHbTk.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\FNTrlYR.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\TIVZegN.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\WphDYkQ.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\XUNaRYh.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\LePuEzt.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\bVjHlgU.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\xSlxnXr.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\yXFpYZG.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\dANDBhN.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\cqngdEB.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\CRNgsqp.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\CMAoMQG.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\QUWjGzi.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\JecBFOP.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\NUIxyiB.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\LkoAjfB.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\eVaSkTd.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\QElrXMs.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\VmSOgZp.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\tEqVWaY.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\ksGUvXB.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\EFvLUlS.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\VMmTBOB.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\TeWPtaN.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\YUNvSzN.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\Nltrdxu.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\CfJomHL.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\ALxTQeX.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\LgmfNKm.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\nQYwSUy.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\OjDIcyj.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\AOHUNZz.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\HcoPGpU.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\mPGuCJV.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\KfDNlxw.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\QPQuCZR.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\yhcWhLE.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\DPPuUvy.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\rpGuLCr.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\bpzXBbT.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\iDPYkkc.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\RmouyzR.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\pXoXqkV.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\xVlfTWg.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\rYFwvbQ.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\aYIbdvN.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\RoMBjUy.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\vMqkUjd.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\AjhBPyo.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\blrvJDs.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\IIpOBeX.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\AJpxEmG.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\HOgAWRk.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\fdGiqaO.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
File created	C:\Windows\System\mvQXoMZ.exe	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 5048	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	84
PID 4016 wrote to memory of 5048	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	84
PID 4016 wrote to memory of 2720	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	85
PID 4016 wrote to memory of 2720	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	85
PID 4016 wrote to memory of 4656	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	86
PID 4016 wrote to memory of 4656	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	86
PID 4016 wrote to memory of 3496	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	87
PID 4016 wrote to memory of 3496	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	87
PID 4016 wrote to memory of 3444	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	88
PID 4016 wrote to memory of 3444	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	88
PID 4016 wrote to memory of 1212	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	89
PID 4016 wrote to memory of 1212	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	89
PID 4016 wrote to memory of 1392	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	90
PID 4016 wrote to memory of 1392	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	90
PID 4016 wrote to memory of 4480	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	91
PID 4016 wrote to memory of 4480	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	91
PID 4016 wrote to memory of 3176	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	92
PID 4016 wrote to memory of 3176	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	92
PID 4016 wrote to memory of 2100	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	93
PID 4016 wrote to memory of 2100	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	93
PID 4016 wrote to memory of 1952	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	94
PID 4016 wrote to memory of 1952	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	94
PID 4016 wrote to memory of 2064	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	95
PID 4016 wrote to memory of 2064	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	95
PID 4016 wrote to memory of 3944	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	96
PID 4016 wrote to memory of 3944	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	96
PID 4016 wrote to memory of 3128	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	97
PID 4016 wrote to memory of 3128	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	97
PID 4016 wrote to memory of 1816	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	98
PID 4016 wrote to memory of 1816	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	98
PID 4016 wrote to memory of 3356	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	99
PID 4016 wrote to memory of 3356	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	99
PID 4016 wrote to memory of 4204	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	100
PID 4016 wrote to memory of 4204	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	100
PID 4016 wrote to memory of 4600	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	101
PID 4016 wrote to memory of 4600	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	101
PID 4016 wrote to memory of 388	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	102
PID 4016 wrote to memory of 388	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	102
PID 4016 wrote to memory of 3096	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	103
PID 4016 wrote to memory of 3096	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	103
PID 4016 wrote to memory of 2732	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	104
PID 4016 wrote to memory of 2732	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	104
PID 4016 wrote to memory of 2120	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	105
PID 4016 wrote to memory of 2120	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	105
PID 4016 wrote to memory of 4756	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	106
PID 4016 wrote to memory of 4756	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	106
PID 4016 wrote to memory of 4796	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	107
PID 4016 wrote to memory of 4796	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	107
PID 4016 wrote to memory of 900	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	108
PID 4016 wrote to memory of 900	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	108
PID 4016 wrote to memory of 3140	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	109
PID 4016 wrote to memory of 3140	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	109
PID 4016 wrote to memory of 372	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	110
PID 4016 wrote to memory of 372	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	110
PID 4016 wrote to memory of 3212	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	111
PID 4016 wrote to memory of 3212	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	111
PID 4016 wrote to memory of 3692	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	112
PID 4016 wrote to memory of 3692	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	112
PID 4016 wrote to memory of 3508	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	113
PID 4016 wrote to memory of 3508	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	113
PID 4016 wrote to memory of 2476	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	114
PID 4016 wrote to memory of 2476	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	114
PID 4016 wrote to memory of 4444	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	115
PID 4016 wrote to memory of 4444	4016	b68fe5b31950d0a499d45df1861ba480_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\b68fe5b31950d0a499d45df1861ba480_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\b68fe5b31950d0a499d45df1861ba480_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\System\OgxhUav.exe
  C:\Windows\System\OgxhUav.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\zPdVULi.exe
  C:\Windows\System\zPdVULi.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\qFcltif.exe
  C:\Windows\System\qFcltif.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\LgmfNKm.exe
  C:\Windows\System\LgmfNKm.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\TZGNJKC.exe
  C:\Windows\System\TZGNJKC.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\kuWlvQY.exe
  C:\Windows\System\kuWlvQY.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\nagvcaF.exe
  C:\Windows\System\nagvcaF.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\HxUvwVg.exe
  C:\Windows\System\HxUvwVg.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\iDPYkkc.exe
  C:\Windows\System\iDPYkkc.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\LVabtnU.exe
  C:\Windows\System\LVabtnU.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\znFbcOk.exe
  C:\Windows\System\znFbcOk.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\BadIYcE.exe
  C:\Windows\System\BadIYcE.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\nRmkatr.exe
  C:\Windows\System\nRmkatr.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\qsbwOqt.exe
  C:\Windows\System\qsbwOqt.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\qKkKxAT.exe
  C:\Windows\System\qKkKxAT.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\yZGrZyo.exe
  C:\Windows\System\yZGrZyo.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\fnvgtrO.exe
  C:\Windows\System\fnvgtrO.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\KgaMExy.exe
  C:\Windows\System\KgaMExy.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\UPUDltw.exe
  C:\Windows\System\UPUDltw.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\iLAUNXs.exe
  C:\Windows\System\iLAUNXs.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\mILtkaW.exe
  C:\Windows\System\mILtkaW.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\lgaaDGH.exe
  C:\Windows\System\lgaaDGH.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\rxVTnak.exe
  C:\Windows\System\rxVTnak.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\LXRYUuL.exe
  C:\Windows\System\LXRYUuL.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\EpdpVmU.exe
  C:\Windows\System\EpdpVmU.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\HzLtmAN.exe
  C:\Windows\System\HzLtmAN.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\BCrcsye.exe
  C:\Windows\System\BCrcsye.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\TLOetyg.exe
  C:\Windows\System\TLOetyg.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\hyorfjr.exe
  C:\Windows\System\hyorfjr.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\IeSJTpf.exe
  C:\Windows\System\IeSJTpf.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\hQadbHu.exe
  C:\Windows\System\hQadbHu.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\PnBqgFY.exe
  C:\Windows\System\PnBqgFY.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\txcVooc.exe
  C:\Windows\System\txcVooc.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\fFlHxlZ.exe
  C:\Windows\System\fFlHxlZ.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\ScGHajT.exe
  C:\Windows\System\ScGHajT.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\lJpaDov.exe
  C:\Windows\System\lJpaDov.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\tOTevUh.exe
  C:\Windows\System\tOTevUh.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\iOicoIA.exe
  C:\Windows\System\iOicoIA.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\ZKOpSfV.exe
  C:\Windows\System\ZKOpSfV.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\xGxlgkN.exe
  C:\Windows\System\xGxlgkN.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\eQbDYyL.exe
  C:\Windows\System\eQbDYyL.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\AeEdGpG.exe
  C:\Windows\System\AeEdGpG.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\BQImQBg.exe
  C:\Windows\System\BQImQBg.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\NvVwHcD.exe
  C:\Windows\System\NvVwHcD.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\TPJbnwD.exe
  C:\Windows\System\TPJbnwD.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\msOjNto.exe
  C:\Windows\System\msOjNto.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\fdGiqaO.exe
  C:\Windows\System\fdGiqaO.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\ztdGEhO.exe
  C:\Windows\System\ztdGEhO.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\zoRUIjM.exe
  C:\Windows\System\zoRUIjM.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\KraSOJF.exe
  C:\Windows\System\KraSOJF.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\JYIClWe.exe
  C:\Windows\System\JYIClWe.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\yFgkjTi.exe
  C:\Windows\System\yFgkjTi.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\dyOJdyP.exe
  C:\Windows\System\dyOJdyP.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\rsPmYoc.exe
  C:\Windows\System\rsPmYoc.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\FqaKwVj.exe
  C:\Windows\System\FqaKwVj.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\hZONRst.exe
  C:\Windows\System\hZONRst.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\bVZrSoQ.exe
  C:\Windows\System\bVZrSoQ.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\ErtgKrY.exe
  C:\Windows\System\ErtgKrY.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\wTHRazP.exe
  C:\Windows\System\wTHRazP.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\VGfwgiz.exe
  C:\Windows\System\VGfwgiz.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\tFzmuhj.exe
  C:\Windows\System\tFzmuhj.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\kmcgYek.exe
  C:\Windows\System\kmcgYek.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\YTwyQTW.exe
  C:\Windows\System\YTwyQTW.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\doKcWKE.exe
  C:\Windows\System\doKcWKE.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\QzwSMLL.exe
  C:\Windows\System\QzwSMLL.exe
  2⤵
  PID:1252
- C:\Windows\System\kKKdqlt.exe
  C:\Windows\System\kKKdqlt.exe
  2⤵
  PID:1724
- C:\Windows\System\XyeGEmF.exe
  C:\Windows\System\XyeGEmF.exe
  2⤵
  PID:3636
- C:\Windows\System\yXFpYZG.exe
  C:\Windows\System\yXFpYZG.exe
  2⤵
  PID:2328
- C:\Windows\System\OOpBwbh.exe
  C:\Windows\System\OOpBwbh.exe
  2⤵
  PID:2416
- C:\Windows\System\uvclBQK.exe
  C:\Windows\System\uvclBQK.exe
  2⤵
  PID:3712
- C:\Windows\System\DPNrMvu.exe
  C:\Windows\System\DPNrMvu.exe
  2⤵
  PID:4036
- C:\Windows\System\lgNgevO.exe
  C:\Windows\System\lgNgevO.exe
  2⤵
  PID:700
- C:\Windows\System\HoSBBkk.exe
  C:\Windows\System\HoSBBkk.exe
  2⤵
  PID:2164
- C:\Windows\System\CYrTiHT.exe
  C:\Windows\System\CYrTiHT.exe
  2⤵
  PID:2448
- C:\Windows\System\WgkIwWE.exe
  C:\Windows\System\WgkIwWE.exe
  2⤵
  PID:4636
- C:\Windows\System\Uslzuvh.exe
  C:\Windows\System\Uslzuvh.exe
  2⤵
  PID:4308
- C:\Windows\System\fZOKlyg.exe
  C:\Windows\System\fZOKlyg.exe
  2⤵
  PID:5144
- C:\Windows\System\yfgkldJ.exe
  C:\Windows\System\yfgkldJ.exe
  2⤵
  PID:5172
- C:\Windows\System\bPzmQeJ.exe
  C:\Windows\System\bPzmQeJ.exe
  2⤵
  PID:5200
- C:\Windows\System\sGHmlXS.exe
  C:\Windows\System\sGHmlXS.exe
  2⤵
  PID:5228
- C:\Windows\System\pXTjCQd.exe
  C:\Windows\System\pXTjCQd.exe
  2⤵
  PID:5256
- C:\Windows\System\UDlFHyI.exe
  C:\Windows\System\UDlFHyI.exe
  2⤵
  PID:5284
- C:\Windows\System\YCvrnOE.exe
  C:\Windows\System\YCvrnOE.exe
  2⤵
  PID:5312
- C:\Windows\System\fjPXPVg.exe
  C:\Windows\System\fjPXPVg.exe
  2⤵
  PID:5340
- C:\Windows\System\ENXBLBM.exe
  C:\Windows\System\ENXBLBM.exe
  2⤵
  PID:5368
- C:\Windows\System\YnDQSDX.exe
  C:\Windows\System\YnDQSDX.exe
  2⤵
  PID:5396
- C:\Windows\System\gZlThUk.exe
  C:\Windows\System\gZlThUk.exe
  2⤵
  PID:5424
- C:\Windows\System\OucGrUI.exe
  C:\Windows\System\OucGrUI.exe
  2⤵
  PID:5452
- C:\Windows\System\DhiGBYU.exe
  C:\Windows\System\DhiGBYU.exe
  2⤵
  PID:5480
- C:\Windows\System\ojYrGcQ.exe
  C:\Windows\System\ojYrGcQ.exe
  2⤵
  PID:5508
- C:\Windows\System\zMWrKnC.exe
  C:\Windows\System\zMWrKnC.exe
  2⤵
  PID:5536
- C:\Windows\System\QHGcNOQ.exe
  C:\Windows\System\QHGcNOQ.exe
  2⤵
  PID:5564
- C:\Windows\System\TuKrbWS.exe
  C:\Windows\System\TuKrbWS.exe
  2⤵
  PID:5592
- C:\Windows\System\KbOUwtP.exe
  C:\Windows\System\KbOUwtP.exe
  2⤵
  PID:5620
- C:\Windows\System\XnzjUyz.exe
  C:\Windows\System\XnzjUyz.exe
  2⤵
  PID:5648
- C:\Windows\System\BLTpZYQ.exe
  C:\Windows\System\BLTpZYQ.exe
  2⤵
  PID:5676
- C:\Windows\System\WKRMAgP.exe
  C:\Windows\System\WKRMAgP.exe
  2⤵
  PID:5704
- C:\Windows\System\dPZiwEo.exe
  C:\Windows\System\dPZiwEo.exe
  2⤵
  PID:5732
- C:\Windows\System\ksgUOTe.exe
  C:\Windows\System\ksgUOTe.exe
  2⤵
  PID:5760
- C:\Windows\System\LPaeeSR.exe
  C:\Windows\System\LPaeeSR.exe
  2⤵
  PID:5788
- C:\Windows\System\aVTfkXX.exe
  C:\Windows\System\aVTfkXX.exe
  2⤵
  PID:5816
- C:\Windows\System\ntrqrzl.exe
  C:\Windows\System\ntrqrzl.exe
  2⤵
  PID:5844
- C:\Windows\System\fTraItW.exe
  C:\Windows\System\fTraItW.exe
  2⤵
  PID:5876
- C:\Windows\System\rQsazWH.exe
  C:\Windows\System\rQsazWH.exe
  2⤵
  PID:5900
- C:\Windows\System\BCiCrXU.exe
  C:\Windows\System\BCiCrXU.exe
  2⤵
  PID:5964
- C:\Windows\System\xmlmXPr.exe
  C:\Windows\System\xmlmXPr.exe
  2⤵
  PID:5980
- C:\Windows\System\HitMvIq.exe
  C:\Windows\System\HitMvIq.exe
  2⤵
  PID:5996
- C:\Windows\System\SVxvHIU.exe
  C:\Windows\System\SVxvHIU.exe
  2⤵
  PID:6024
- C:\Windows\System\EOwBvxv.exe
  C:\Windows\System\EOwBvxv.exe
  2⤵
  PID:6052
- C:\Windows\System\zXTfKdB.exe
  C:\Windows\System\zXTfKdB.exe
  2⤵
  PID:6076
- C:\Windows\System\AszQdQP.exe
  C:\Windows\System\AszQdQP.exe
  2⤵
  PID:6104
- C:\Windows\System\bPaacZt.exe
  C:\Windows\System\bPaacZt.exe
  2⤵
  PID:6124
- C:\Windows\System\RmouyzR.exe
  C:\Windows\System\RmouyzR.exe
  2⤵
  PID:4000
- C:\Windows\System\FJoiHfD.exe
  C:\Windows\System\FJoiHfD.exe
  2⤵
  PID:4092
- C:\Windows\System\NvqBdDZ.exe
  C:\Windows\System\NvqBdDZ.exe
  2⤵
  PID:2156
- C:\Windows\System\evhJBwN.exe
  C:\Windows\System\evhJBwN.exe
  2⤵
  PID:3248
- C:\Windows\System\toHOvrr.exe
  C:\Windows\System\toHOvrr.exe
  2⤵
  PID:3856
- C:\Windows\System\RGlaQAy.exe
  C:\Windows\System\RGlaQAy.exe
  2⤵
  PID:1432
- C:\Windows\System\UKCzEEc.exe
  C:\Windows\System\UKCzEEc.exe
  2⤵
  PID:5128
- C:\Windows\System\QPQuCZR.exe
  C:\Windows\System\QPQuCZR.exe
  2⤵
  PID:5184
- C:\Windows\System\aCiNbfM.exe
  C:\Windows\System\aCiNbfM.exe
  2⤵
  PID:5248
- C:\Windows\System\bdPoJpV.exe
  C:\Windows\System\bdPoJpV.exe
  2⤵
  PID:5324
- C:\Windows\System\gyPFQqN.exe
  C:\Windows\System\gyPFQqN.exe
  2⤵
  PID:5388
- C:\Windows\System\PLmzuvQ.exe
  C:\Windows\System\PLmzuvQ.exe
  2⤵
  PID:5440
- C:\Windows\System\HcgJnwG.exe
  C:\Windows\System\HcgJnwG.exe
  2⤵
  PID:5500
- C:\Windows\System\LkoAjfB.exe
  C:\Windows\System\LkoAjfB.exe
  2⤵
  PID:5576
- C:\Windows\System\dUnCoNF.exe
  C:\Windows\System\dUnCoNF.exe
  2⤵
  PID:5636
- C:\Windows\System\RFUIvrJ.exe
  C:\Windows\System\RFUIvrJ.exe
  2⤵
  PID:5696
- C:\Windows\System\omuMZlR.exe
  C:\Windows\System\omuMZlR.exe
  2⤵
  PID:5772
- C:\Windows\System\OTVUOcQ.exe
  C:\Windows\System\OTVUOcQ.exe
  2⤵
  PID:5828
- C:\Windows\System\hmOaFCw.exe
  C:\Windows\System\hmOaFCw.exe
  2⤵
  PID:5892
- C:\Windows\System\HvoNTvD.exe
  C:\Windows\System\HvoNTvD.exe
  2⤵
  PID:5920
- C:\Windows\System\JFVchYB.exe
  C:\Windows\System\JFVchYB.exe
  2⤵
  PID:6016
- C:\Windows\System\PYGplmJ.exe
  C:\Windows\System\PYGplmJ.exe
  2⤵
  PID:6092
- C:\Windows\System\xvypQmY.exe
  C:\Windows\System\xvypQmY.exe
  2⤵
  PID:2160
- C:\Windows\System\PRPlqSU.exe
  C:\Windows\System\PRPlqSU.exe
  2⤵
  PID:1056
- C:\Windows\System\ziPgTfi.exe
  C:\Windows\System\ziPgTfi.exe
  2⤵
  PID:1616
- C:\Windows\System\twqWyWG.exe
  C:\Windows\System\twqWyWG.exe
  2⤵
  PID:5160
- C:\Windows\System\jDOMOXg.exe
  C:\Windows\System\jDOMOXg.exe
  2⤵
  PID:5300
- C:\Windows\System\WphDYkQ.exe
  C:\Windows\System\WphDYkQ.exe
  2⤵
  PID:5468
- C:\Windows\System\IfbsuTc.exe
  C:\Windows\System\IfbsuTc.exe
  2⤵
  PID:6148
- C:\Windows\System\FWxxkOj.exe
  C:\Windows\System\FWxxkOj.exe
  2⤵
  PID:6176
- C:\Windows\System\eVaSkTd.exe
  C:\Windows\System\eVaSkTd.exe
  2⤵
  PID:6204
- C:\Windows\System\vMYkhpz.exe
  C:\Windows\System\vMYkhpz.exe
  2⤵
  PID:6232
- C:\Windows\System\nUjHAcF.exe
  C:\Windows\System\nUjHAcF.exe
  2⤵
  PID:6260
- C:\Windows\System\IYLhRzO.exe
  C:\Windows\System\IYLhRzO.exe
  2⤵
  PID:6288
- C:\Windows\System\hcQqNbz.exe
  C:\Windows\System\hcQqNbz.exe
  2⤵
  PID:6316
- C:\Windows\System\TSJqOVx.exe
  C:\Windows\System\TSJqOVx.exe
  2⤵
  PID:6344
- C:\Windows\System\swBQpsR.exe
  C:\Windows\System\swBQpsR.exe
  2⤵
  PID:6372
- C:\Windows\System\pHjLXaN.exe
  C:\Windows\System\pHjLXaN.exe
  2⤵
  PID:6400
- C:\Windows\System\ZxdYMAq.exe
  C:\Windows\System\ZxdYMAq.exe
  2⤵
  PID:6428
- C:\Windows\System\dANDBhN.exe
  C:\Windows\System\dANDBhN.exe
  2⤵
  PID:6456
- C:\Windows\System\cqngdEB.exe
  C:\Windows\System\cqngdEB.exe
  2⤵
  PID:6484
- C:\Windows\System\CFOPMXH.exe
  C:\Windows\System\CFOPMXH.exe
  2⤵
  PID:6512
- C:\Windows\System\qdbwjUW.exe
  C:\Windows\System\qdbwjUW.exe
  2⤵
  PID:6540
- C:\Windows\System\zYEzVpG.exe
  C:\Windows\System\zYEzVpG.exe
  2⤵
  PID:6568
- C:\Windows\System\lophKeR.exe
  C:\Windows\System\lophKeR.exe
  2⤵
  PID:6596
- C:\Windows\System\qhSQhYE.exe
  C:\Windows\System\qhSQhYE.exe
  2⤵
  PID:6624
- C:\Windows\System\DPjeNoV.exe
  C:\Windows\System\DPjeNoV.exe
  2⤵
  PID:6652
- C:\Windows\System\FtGmVfn.exe
  C:\Windows\System\FtGmVfn.exe
  2⤵
  PID:6680
- C:\Windows\System\KrBhNmE.exe
  C:\Windows\System\KrBhNmE.exe
  2⤵
  PID:6708
- C:\Windows\System\YefRCWi.exe
  C:\Windows\System\YefRCWi.exe
  2⤵
  PID:6736
- C:\Windows\System\WnjEVTE.exe
  C:\Windows\System\WnjEVTE.exe
  2⤵
  PID:6764
- C:\Windows\System\LArYlPR.exe
  C:\Windows\System\LArYlPR.exe
  2⤵
  PID:6788
- C:\Windows\System\nxcYlqk.exe
  C:\Windows\System\nxcYlqk.exe
  2⤵
  PID:6820
- C:\Windows\System\TsreiIj.exe
  C:\Windows\System\TsreiIj.exe
  2⤵
  PID:6848
- C:\Windows\System\XXIxLNB.exe
  C:\Windows\System\XXIxLNB.exe
  2⤵
  PID:6876
- C:\Windows\System\lgFikdo.exe
  C:\Windows\System\lgFikdo.exe
  2⤵
  PID:6904
- C:\Windows\System\WvvFArf.exe
  C:\Windows\System\WvvFArf.exe
  2⤵
  PID:6932
- C:\Windows\System\LQZbCgg.exe
  C:\Windows\System\LQZbCgg.exe
  2⤵
  PID:6960
- C:\Windows\System\aiPaNHT.exe
  C:\Windows\System\aiPaNHT.exe
  2⤵
  PID:6988
- C:\Windows\System\puRjveP.exe
  C:\Windows\System\puRjveP.exe
  2⤵
  PID:7016
- C:\Windows\System\VbvjVaz.exe
  C:\Windows\System\VbvjVaz.exe
  2⤵
  PID:7048
- C:\Windows\System\fKwITTo.exe
  C:\Windows\System\fKwITTo.exe
  2⤵
  PID:7072
- C:\Windows\System\nwHkdUK.exe
  C:\Windows\System\nwHkdUK.exe
  2⤵
  PID:7100
- C:\Windows\System\BCROTct.exe
  C:\Windows\System\BCROTct.exe
  2⤵
  PID:7128
- C:\Windows\System\CRNgsqp.exe
  C:\Windows\System\CRNgsqp.exe
  2⤵
  PID:7156
- C:\Windows\System\NRkVmck.exe
  C:\Windows\System\NRkVmck.exe
  2⤵
  PID:5688
- C:\Windows\System\iwRQToA.exe
  C:\Windows\System\iwRQToA.exe
  2⤵
  PID:5856
- C:\Windows\System\CJFbAAJ.exe
  C:\Windows\System\CJFbAAJ.exe
  2⤵
  PID:5992
- C:\Windows\System\XEaPZQy.exe
  C:\Windows\System\XEaPZQy.exe
  2⤵
  PID:6120
- C:\Windows\System\enDYMhn.exe
  C:\Windows\System\enDYMhn.exe
  2⤵
  PID:680
- C:\Windows\System\mVuYlxy.exe
  C:\Windows\System\mVuYlxy.exe
  2⤵
  PID:5380
- C:\Windows\System\fQgHRHe.exe
  C:\Windows\System\fQgHRHe.exe
  2⤵
  PID:6164
- C:\Windows\System\lOnsyEO.exe
  C:\Windows\System\lOnsyEO.exe
  2⤵
  PID:6224
- C:\Windows\System\jEqKTiy.exe
  C:\Windows\System\jEqKTiy.exe
  2⤵
  PID:6280
- C:\Windows\System\lspkcNK.exe
  C:\Windows\System\lspkcNK.exe
  2⤵
  PID:6356
- C:\Windows\System\IMxGRzW.exe
  C:\Windows\System\IMxGRzW.exe
  2⤵
  PID:6412
- C:\Windows\System\JCevkEV.exe
  C:\Windows\System\JCevkEV.exe
  2⤵
  PID:6472
- C:\Windows\System\tKIsbrI.exe
  C:\Windows\System\tKIsbrI.exe
  2⤵
  PID:6532
- C:\Windows\System\ZeJwGCr.exe
  C:\Windows\System\ZeJwGCr.exe
  2⤵
  PID:6608
- C:\Windows\System\nQYwSUy.exe
  C:\Windows\System\nQYwSUy.exe
  2⤵
  PID:6668
- C:\Windows\System\IAMDiqZ.exe
  C:\Windows\System\IAMDiqZ.exe
  2⤵
  PID:6724
- C:\Windows\System\lqWmBuq.exe
  C:\Windows\System\lqWmBuq.exe
  2⤵
  PID:6776
- C:\Windows\System\DfAmNGN.exe
  C:\Windows\System\DfAmNGN.exe
  2⤵
  PID:6836
- C:\Windows\System\bfutbPR.exe
  C:\Windows\System\bfutbPR.exe
  2⤵
  PID:6896
- C:\Windows\System\gbTvRlI.exe
  C:\Windows\System\gbTvRlI.exe
  2⤵
  PID:6952
- C:\Windows\System\zhwXwiO.exe
  C:\Windows\System\zhwXwiO.exe
  2⤵
  PID:7008
- C:\Windows\System\yYiJtDX.exe
  C:\Windows\System\yYiJtDX.exe
  2⤵
  PID:936
- C:\Windows\System\ygTkhEh.exe
  C:\Windows\System\ygTkhEh.exe
  2⤵
  PID:7140
- C:\Windows\System\NbVMxYK.exe
  C:\Windows\System\NbVMxYK.exe
  2⤵
  PID:5796
- C:\Windows\System\pgaBZiF.exe
  C:\Windows\System\pgaBZiF.exe
  2⤵
  PID:6068
- C:\Windows\System\QElrXMs.exe
  C:\Windows\System\QElrXMs.exe
  2⤵
  PID:5240
- C:\Windows\System\CfJomHL.exe
  C:\Windows\System\CfJomHL.exe
  2⤵
  PID:6248
- C:\Windows\System\qnRxubo.exe
  C:\Windows\System\qnRxubo.exe
  2⤵
  PID:2552
- C:\Windows\System\fYFGgZz.exe
  C:\Windows\System\fYFGgZz.exe
  2⤵
  PID:6524
- C:\Windows\System\NSAMZKn.exe
  C:\Windows\System\NSAMZKn.exe
  2⤵
  PID:2492
- C:\Windows\System\LVUBrWI.exe
  C:\Windows\System\LVUBrWI.exe
  2⤵
  PID:6808
- C:\Windows\System\SVXRGZv.exe
  C:\Windows\System\SVXRGZv.exe
  2⤵
  PID:6944
- C:\Windows\System\EwhMKtz.exe
  C:\Windows\System\EwhMKtz.exe
  2⤵
  PID:7064
- C:\Windows\System\GdCQUVR.exe
  C:\Windows\System\GdCQUVR.exe
  2⤵
  PID:7192
- C:\Windows\System\aisvRXU.exe
  C:\Windows\System\aisvRXU.exe
  2⤵
  PID:7220
- C:\Windows\System\DJpOyzu.exe
  C:\Windows\System\DJpOyzu.exe
  2⤵
  PID:7248
- C:\Windows\System\VqPPMOM.exe
  C:\Windows\System\VqPPMOM.exe
  2⤵
  PID:7276
- C:\Windows\System\IAobDzN.exe
  C:\Windows\System\IAobDzN.exe
  2⤵
  PID:7304
- C:\Windows\System\VHvLBHl.exe
  C:\Windows\System\VHvLBHl.exe
  2⤵
  PID:7332
- C:\Windows\System\kLTLyPo.exe
  C:\Windows\System\kLTLyPo.exe
  2⤵
  PID:7360
- C:\Windows\System\gyqIhTK.exe
  C:\Windows\System\gyqIhTK.exe
  2⤵
  PID:7388
- C:\Windows\System\tLFxnVV.exe
  C:\Windows\System\tLFxnVV.exe
  2⤵
  PID:7416
- C:\Windows\System\BxzTyat.exe
  C:\Windows\System\BxzTyat.exe
  2⤵
  PID:7444
- C:\Windows\System\gBuzUGg.exe
  C:\Windows\System\gBuzUGg.exe
  2⤵
  PID:7472
- C:\Windows\System\iHyBcFn.exe
  C:\Windows\System\iHyBcFn.exe
  2⤵
  PID:7500
- C:\Windows\System\iWUnjfF.exe
  C:\Windows\System\iWUnjfF.exe
  2⤵
  PID:7528
- C:\Windows\System\kuHXwHW.exe
  C:\Windows\System\kuHXwHW.exe
  2⤵
  PID:7556
- C:\Windows\System\BHEKjWH.exe
  C:\Windows\System\BHEKjWH.exe
  2⤵
  PID:7584
- C:\Windows\System\HhqPWUA.exe
  C:\Windows\System\HhqPWUA.exe
  2⤵
  PID:7612
- C:\Windows\System\MHDvqPN.exe
  C:\Windows\System\MHDvqPN.exe
  2⤵
  PID:7640
- C:\Windows\System\Pmzomau.exe
  C:\Windows\System\Pmzomau.exe
  2⤵
  PID:7668
- C:\Windows\System\hPnMINZ.exe
  C:\Windows\System\hPnMINZ.exe
  2⤵
  PID:7696
- C:\Windows\System\KLHOHYq.exe
  C:\Windows\System\KLHOHYq.exe
  2⤵
  PID:7724
- C:\Windows\System\pEElDHq.exe
  C:\Windows\System\pEElDHq.exe
  2⤵
  PID:7752
- C:\Windows\System\NKEJtIB.exe
  C:\Windows\System\NKEJtIB.exe
  2⤵
  PID:7780
- C:\Windows\System\lBNSAhT.exe
  C:\Windows\System\lBNSAhT.exe
  2⤵
  PID:7808
- C:\Windows\System\poCzQyQ.exe
  C:\Windows\System\poCzQyQ.exe
  2⤵
  PID:7836
- C:\Windows\System\pJPLdud.exe
  C:\Windows\System\pJPLdud.exe
  2⤵
  PID:7864
- C:\Windows\System\HtMdFqM.exe
  C:\Windows\System\HtMdFqM.exe
  2⤵
  PID:7888
- C:\Windows\System\XKNvXTO.exe
  C:\Windows\System\XKNvXTO.exe
  2⤵
  PID:7920
- C:\Windows\System\KNJXSoZ.exe
  C:\Windows\System\KNJXSoZ.exe
  2⤵
  PID:7948
- C:\Windows\System\cTvwuqz.exe
  C:\Windows\System\cTvwuqz.exe
  2⤵
  PID:7976
- C:\Windows\System\nkVNsbv.exe
  C:\Windows\System\nkVNsbv.exe
  2⤵
  PID:8004
- C:\Windows\System\FcLgCSF.exe
  C:\Windows\System\FcLgCSF.exe
  2⤵
  PID:8152
- C:\Windows\System\NUSAUpl.exe
  C:\Windows\System\NUSAUpl.exe
  2⤵
  PID:8180
- C:\Windows\System\QPWCAVG.exe
  C:\Windows\System\QPWCAVG.exe
  2⤵
  PID:5612
- C:\Windows\System\DXFagVG.exe
  C:\Windows\System\DXFagVG.exe
  2⤵
  PID:6044
- C:\Windows\System\VmSOgZp.exe
  C:\Windows\System\VmSOgZp.exe
  2⤵
  PID:6192
- C:\Windows\System\mgVyxdB.exe
  C:\Windows\System\mgVyxdB.exe
  2⤵
  PID:6444
- C:\Windows\System\WlxvjtK.exe
  C:\Windows\System\WlxvjtK.exe
  2⤵
  PID:6640
- C:\Windows\System\LjBbDdy.exe
  C:\Windows\System\LjBbDdy.exe
  2⤵
  PID:6752
- C:\Windows\System\WHzoRcG.exe
  C:\Windows\System\WHzoRcG.exe
  2⤵
  PID:6920
- C:\Windows\System\YimkQcG.exe
  C:\Windows\System\YimkQcG.exe
  2⤵
  PID:7176
- C:\Windows\System\bvwLMAD.exe
  C:\Windows\System\bvwLMAD.exe
  2⤵
  PID:7204
- C:\Windows\System\wJjnwBq.exe
  C:\Windows\System\wJjnwBq.exe
  2⤵
  PID:7260
- C:\Windows\System\YlWonML.exe
  C:\Windows\System\YlWonML.exe
  2⤵
  PID:7348
- C:\Windows\System\RUPqfVQ.exe
  C:\Windows\System\RUPqfVQ.exe
  2⤵
  PID:7404
- C:\Windows\System\jLPrcYd.exe
  C:\Windows\System\jLPrcYd.exe
  2⤵
  PID:7576
- C:\Windows\System\xVOqAGz.exe
  C:\Windows\System\xVOqAGz.exe
  2⤵
  PID:7628
- C:\Windows\System\ZoZXwJm.exe
  C:\Windows\System\ZoZXwJm.exe
  2⤵
  PID:7656
- C:\Windows\System\lPMXvhk.exe
  C:\Windows\System\lPMXvhk.exe
  2⤵
  PID:7708
- C:\Windows\System\OjDIcyj.exe
  C:\Windows\System\OjDIcyj.exe
  2⤵
  PID:7764
- C:\Windows\System\mvQXoMZ.exe
  C:\Windows\System\mvQXoMZ.exe
  2⤵
  PID:4844
- C:\Windows\System\NvrcTWK.exe
  C:\Windows\System\NvrcTWK.exe
  2⤵
  PID:4500
- C:\Windows\System\hKymVxk.exe
  C:\Windows\System\hKymVxk.exe
  2⤵
  PID:7852
- C:\Windows\System\uxGBniJ.exe
  C:\Windows\System\uxGBniJ.exe
  2⤵
  PID:7880
- C:\Windows\System\lOdnnbS.exe
  C:\Windows\System\lOdnnbS.exe
  2⤵
  PID:3432
- C:\Windows\System\KlOtNXn.exe
  C:\Windows\System\KlOtNXn.exe
  2⤵
  PID:7936
- C:\Windows\System\eBNiGpb.exe
  C:\Windows\System\eBNiGpb.exe
  2⤵
  PID:4628
- C:\Windows\System\qfSxHJD.exe
  C:\Windows\System\qfSxHJD.exe
  2⤵
  PID:8056
- C:\Windows\System\aWAimcp.exe
  C:\Windows\System\aWAimcp.exe
  2⤵
  PID:1316
- C:\Windows\System\gJBFgNf.exe
  C:\Windows\System\gJBFgNf.exe
  2⤵
  PID:8076
- C:\Windows\System\Pgmlhnd.exe
  C:\Windows\System\Pgmlhnd.exe
  2⤵
  PID:8080
- C:\Windows\System\qUGIGzK.exe
  C:\Windows\System\qUGIGzK.exe
  2⤵
  PID:8136
- C:\Windows\System\zANFrsZ.exe
  C:\Windows\System\zANFrsZ.exe
  2⤵
  PID:6312
- C:\Windows\System\lyqTFxL.exe
  C:\Windows\System\lyqTFxL.exe
  2⤵
  PID:7236
- C:\Windows\System\YSKyxGY.exe
  C:\Windows\System\YSKyxGY.exe
  2⤵
  PID:6888
- C:\Windows\System\AjhBPyo.exe
  C:\Windows\System\AjhBPyo.exe
  2⤵
  PID:7292
- C:\Windows\System\zmFxwYQ.exe
  C:\Windows\System\zmFxwYQ.exe
  2⤵
  PID:1224
- C:\Windows\System\sciLRfK.exe
  C:\Windows\System\sciLRfK.exe
  2⤵
  PID:2404
- C:\Windows\System\gxiFxxp.exe
  C:\Windows\System\gxiFxxp.exe
  2⤵
  PID:1640
- C:\Windows\System\RITGnnq.exe
  C:\Windows\System\RITGnnq.exe
  2⤵
  PID:4896
- C:\Windows\System\aVPfZxV.exe
  C:\Windows\System\aVPfZxV.exe
  2⤵
  PID:7824
- C:\Windows\System\XknsHsw.exe
  C:\Windows\System\XknsHsw.exe
  2⤵
  PID:7904
- C:\Windows\System\blrvJDs.exe
  C:\Windows\System\blrvJDs.exe
  2⤵
  PID:4436
- C:\Windows\System\tEqVWaY.exe
  C:\Windows\System\tEqVWaY.exe
  2⤵
  PID:2624
- C:\Windows\System\SiZRrYq.exe
  C:\Windows\System\SiZRrYq.exe
  2⤵
  PID:4900
- C:\Windows\System\bAhYoKm.exe
  C:\Windows\System\bAhYoKm.exe
  2⤵
  PID:8108
- C:\Windows\System\vBxTqrU.exe
  C:\Windows\System\vBxTqrU.exe
  2⤵
  PID:1124
- C:\Windows\System\AOHUNZz.exe
  C:\Windows\System\AOHUNZz.exe
  2⤵
  PID:2040
- C:\Windows\System\ZMVfNKN.exe
  C:\Windows\System\ZMVfNKN.exe
  2⤵
  PID:7320
- C:\Windows\System\StkdVoD.exe
  C:\Windows\System\StkdVoD.exe
  2⤵
  PID:1596
- C:\Windows\System\zBbPdTC.exe
  C:\Windows\System\zBbPdTC.exe
  2⤵
  PID:4476
- C:\Windows\System\cWRpecW.exe
  C:\Windows\System\cWRpecW.exe
  2⤵
  PID:7232
- C:\Windows\System\ksGUvXB.exe
  C:\Windows\System\ksGUvXB.exe
  2⤵
  PID:8160
- C:\Windows\System\zkrPesB.exe
  C:\Windows\System\zkrPesB.exe
  2⤵
  PID:3180
- C:\Windows\System\DDuIjdQ.exe
  C:\Windows\System\DDuIjdQ.exe
  2⤵
  PID:8204
- C:\Windows\System\qVYxrDw.exe
  C:\Windows\System\qVYxrDw.exe
  2⤵
  PID:8220
- C:\Windows\System\UDpbgXS.exe
  C:\Windows\System\UDpbgXS.exe
  2⤵
  PID:8256
- C:\Windows\System\QTxzqCp.exe
  C:\Windows\System\QTxzqCp.exe
  2⤵
  PID:8276
- C:\Windows\System\UGtORYk.exe
  C:\Windows\System\UGtORYk.exe
  2⤵
  PID:8316
- C:\Windows\System\Nltrdxu.exe
  C:\Windows\System\Nltrdxu.exe
  2⤵
  PID:8352
- C:\Windows\System\XzvzmRj.exe
  C:\Windows\System\XzvzmRj.exe
  2⤵
  PID:8372
- C:\Windows\System\pXoXqkV.exe
  C:\Windows\System\pXoXqkV.exe
  2⤵
  PID:8412
- C:\Windows\System\IIpOBeX.exe
  C:\Windows\System\IIpOBeX.exe
  2⤵
  PID:8428
- C:\Windows\System\ZvvGMiR.exe
  C:\Windows\System\ZvvGMiR.exe
  2⤵
  PID:8468
- C:\Windows\System\NgPSkrK.exe
  C:\Windows\System\NgPSkrK.exe
  2⤵
  PID:8484
- C:\Windows\System\rnEteFM.exe
  C:\Windows\System\rnEteFM.exe
  2⤵
  PID:8516
- C:\Windows\System\GtVlVXC.exe
  C:\Windows\System\GtVlVXC.exe
  2⤵
  PID:8544
- C:\Windows\System\OwIfQHF.exe
  C:\Windows\System\OwIfQHF.exe
  2⤵
  PID:8568
- C:\Windows\System\wIxjQQC.exe
  C:\Windows\System\wIxjQQC.exe
  2⤵
  PID:8584
- C:\Windows\System\IeYNTHj.exe
  C:\Windows\System\IeYNTHj.exe
  2⤵
  PID:8608
- C:\Windows\System\khSWjzd.exe
  C:\Windows\System\khSWjzd.exe
  2⤵
  PID:8628
- C:\Windows\System\lFsHJuA.exe
  C:\Windows\System\lFsHJuA.exe
  2⤵
  PID:8652
- C:\Windows\System\kUUSPji.exe
  C:\Windows\System\kUUSPji.exe
  2⤵
  PID:8680
- C:\Windows\System\msHAEuL.exe
  C:\Windows\System\msHAEuL.exe
  2⤵
  PID:8716
- C:\Windows\System\piZVjKi.exe
  C:\Windows\System\piZVjKi.exe
  2⤵
  PID:8748
- C:\Windows\System\ZxpMZnI.exe
  C:\Windows\System\ZxpMZnI.exe
  2⤵
  PID:8804
- C:\Windows\System\SiJNAdg.exe
  C:\Windows\System\SiJNAdg.exe
  2⤵
  PID:8820
- C:\Windows\System\AnjJcUl.exe
  C:\Windows\System\AnjJcUl.exe
  2⤵
  PID:8860
- C:\Windows\System\cWaRRBN.exe
  C:\Windows\System\cWaRRBN.exe
  2⤵
  PID:8880
- C:\Windows\System\cBkzmlm.exe
  C:\Windows\System\cBkzmlm.exe
  2⤵
  PID:8904
- C:\Windows\System\INxwxUb.exe
  C:\Windows\System\INxwxUb.exe
  2⤵
  PID:8940
- C:\Windows\System\CjqkuPV.exe
  C:\Windows\System\CjqkuPV.exe
  2⤵
  PID:8972
- C:\Windows\System\pmLYjLS.exe
  C:\Windows\System\pmLYjLS.exe
  2⤵
  PID:9000
- C:\Windows\System\yhcWhLE.exe
  C:\Windows\System\yhcWhLE.exe
  2⤵
  PID:9028
- C:\Windows\System\HzGeNYL.exe
  C:\Windows\System\HzGeNYL.exe
  2⤵
  PID:9044
- C:\Windows\System\aQwUUYZ.exe
  C:\Windows\System\aQwUUYZ.exe
  2⤵
  PID:9084
- C:\Windows\System\tsjvyVI.exe
  C:\Windows\System\tsjvyVI.exe
  2⤵
  PID:9128
- C:\Windows\System\FaGSeTw.exe
  C:\Windows\System\FaGSeTw.exe
  2⤵
  PID:9148
- C:\Windows\System\VZYhLuq.exe
  C:\Windows\System\VZYhLuq.exe
  2⤵
  PID:9176
- C:\Windows\System\KfDUUAu.exe
  C:\Windows\System\KfDUUAu.exe
  2⤵
  PID:9212
- C:\Windows\System\HcoPGpU.exe
  C:\Windows\System\HcoPGpU.exe
  2⤵
  PID:7324
- C:\Windows\System\YdgzmjZ.exe
  C:\Windows\System\YdgzmjZ.exe
  2⤵
  PID:8252
- C:\Windows\System\XQDxmko.exe
  C:\Windows\System\XQDxmko.exe
  2⤵
  PID:8328
- C:\Windows\System\nFbYtqi.exe
  C:\Windows\System\nFbYtqi.exe
  2⤵
  PID:8420
- C:\Windows\System\NTxpGKU.exe
  C:\Windows\System\NTxpGKU.exe
  2⤵
  PID:8496
- C:\Windows\System\ZFrkcLr.exe
  C:\Windows\System\ZFrkcLr.exe
  2⤵
  PID:8532
- C:\Windows\System\MlENLSR.exe
  C:\Windows\System\MlENLSR.exe
  2⤵
  PID:8596
- C:\Windows\System\KvtHxCo.exe
  C:\Windows\System\KvtHxCo.exe
  2⤵
  PID:8644
- C:\Windows\System\KdMzzMo.exe
  C:\Windows\System\KdMzzMo.exe
  2⤵
  PID:8708
- C:\Windows\System\DPPuUvy.exe
  C:\Windows\System\DPPuUvy.exe
  2⤵
  PID:8852
- C:\Windows\System\HafIVOL.exe
  C:\Windows\System\HafIVOL.exe
  2⤵
  PID:8896
- C:\Windows\System\BtMbmKe.exe
  C:\Windows\System\BtMbmKe.exe
  2⤵
  PID:8956
- C:\Windows\System\xVlfTWg.exe
  C:\Windows\System\xVlfTWg.exe
  2⤵
  PID:9024
- C:\Windows\System\xcCLkSE.exe
  C:\Windows\System\xcCLkSE.exe
  2⤵
  PID:9124
- C:\Windows\System\nlZpujQ.exe
  C:\Windows\System\nlZpujQ.exe
  2⤵
  PID:9196
- C:\Windows\System\sUDNpOv.exe
  C:\Windows\System\sUDNpOv.exe
  2⤵
  PID:4936
- C:\Windows\System\eFCZkuV.exe
  C:\Windows\System\eFCZkuV.exe
  2⤵
  PID:8424
- C:\Windows\System\mPHsbzP.exe
  C:\Windows\System\mPHsbzP.exe
  2⤵
  PID:9156
- C:\Windows\System\KEzjmVd.exe
  C:\Windows\System\KEzjmVd.exe
  2⤵
  PID:8696
- C:\Windows\System\rYFwvbQ.exe
  C:\Windows\System\rYFwvbQ.exe
  2⤵
  PID:8812
- C:\Windows\System\gsLTKAf.exe
  C:\Windows\System\gsLTKAf.exe
  2⤵
  PID:8984
- C:\Windows\System\EFvLUlS.exe
  C:\Windows\System\EFvLUlS.exe
  2⤵
  PID:9036
- C:\Windows\System\egebJOX.exe
  C:\Windows\System\egebJOX.exe
  2⤵
  PID:8068
- C:\Windows\System\aGeRExs.exe
  C:\Windows\System\aGeRExs.exe
  2⤵
  PID:8460
- C:\Windows\System\zHRPeWP.exe
  C:\Windows\System\zHRPeWP.exe
  2⤵
  PID:8900
- C:\Windows\System\sfNSRor.exe
  C:\Windows\System\sfNSRor.exe
  2⤵
  PID:8268
- C:\Windows\System\heWxclK.exe
  C:\Windows\System\heWxclK.exe
  2⤵
  PID:9220
- C:\Windows\System\XTNNyUB.exe
  C:\Windows\System\XTNNyUB.exe
  2⤵
  PID:9256
- C:\Windows\System\byNnRdn.exe
  C:\Windows\System\byNnRdn.exe
  2⤵
  PID:9276
- C:\Windows\System\WqAvnZc.exe
  C:\Windows\System\WqAvnZc.exe
  2⤵
  PID:9292
- C:\Windows\System\dJDMZib.exe
  C:\Windows\System\dJDMZib.exe
  2⤵
  PID:9332
- C:\Windows\System\AduaEUB.exe
  C:\Windows\System\AduaEUB.exe
  2⤵
  PID:9360
- C:\Windows\System\seaEQSI.exe
  C:\Windows\System\seaEQSI.exe
  2⤵
  PID:9388
- C:\Windows\System\WfchmJO.exe
  C:\Windows\System\WfchmJO.exe
  2⤵
  PID:9408
- C:\Windows\System\mlGHdZz.exe
  C:\Windows\System\mlGHdZz.exe
  2⤵
  PID:9448
- C:\Windows\System\YXQFFNI.exe
  C:\Windows\System\YXQFFNI.exe
  2⤵
  PID:9476
- C:\Windows\System\orAzxDH.exe
  C:\Windows\System\orAzxDH.exe
  2⤵
  PID:9512
- C:\Windows\System\gnWJCEg.exe
  C:\Windows\System\gnWJCEg.exe
  2⤵
  PID:9536
- C:\Windows\System\QCPHbTk.exe
  C:\Windows\System\QCPHbTk.exe
  2⤵
  PID:9572
- C:\Windows\System\ritUeOo.exe
  C:\Windows\System\ritUeOo.exe
  2⤵
  PID:9592
- C:\Windows\System\HYieEBC.exe
  C:\Windows\System\HYieEBC.exe
  2⤵
  PID:9624
- C:\Windows\System\RMMnOse.exe
  C:\Windows\System\RMMnOse.exe
  2⤵
  PID:9644
- C:\Windows\System\rLAoQyD.exe
  C:\Windows\System\rLAoQyD.exe
  2⤵
  PID:9672
- C:\Windows\System\XILrkAh.exe
  C:\Windows\System\XILrkAh.exe
  2⤵
  PID:9720
- C:\Windows\System\QfjHGTi.exe
  C:\Windows\System\QfjHGTi.exe
  2⤵
  PID:9740
- C:\Windows\System\flSJwSr.exe
  C:\Windows\System\flSJwSr.exe
  2⤵
  PID:9768
- C:\Windows\System\iPAcapp.exe
  C:\Windows\System\iPAcapp.exe
  2⤵
  PID:9796
- C:\Windows\System\tNTPkGu.exe
  C:\Windows\System\tNTPkGu.exe
  2⤵
  PID:9824
- C:\Windows\System\PEIcJQW.exe
  C:\Windows\System\PEIcJQW.exe
  2⤵
  PID:9864
- C:\Windows\System\oRUxKOF.exe
  C:\Windows\System\oRUxKOF.exe
  2⤵
  PID:9892
- C:\Windows\System\GbiUsnM.exe
  C:\Windows\System\GbiUsnM.exe
  2⤵
  PID:9908
- C:\Windows\System\IHSwcFL.exe
  C:\Windows\System\IHSwcFL.exe
  2⤵
  PID:9936
- C:\Windows\System\udxFqDp.exe
  C:\Windows\System\udxFqDp.exe
  2⤵
  PID:9976
- C:\Windows\System\ULaMxQI.exe
  C:\Windows\System\ULaMxQI.exe
  2⤵
  PID:10004
- C:\Windows\System\HaeMYWD.exe
  C:\Windows\System\HaeMYWD.exe
  2⤵
  PID:10020
- C:\Windows\System\piTfRqR.exe
  C:\Windows\System\piTfRqR.exe
  2⤵
  PID:10060
- C:\Windows\System\pcxnuyL.exe
  C:\Windows\System\pcxnuyL.exe
  2⤵
  PID:10088
- C:\Windows\System\CRXrdfI.exe
  C:\Windows\System\CRXrdfI.exe
  2⤵
  PID:10104
- C:\Windows\System\HLnmPOy.exe
  C:\Windows\System\HLnmPOy.exe
  2⤵
  PID:10132
- C:\Windows\System\DIXgcRC.exe
  C:\Windows\System\DIXgcRC.exe
  2⤵
  PID:10160
- C:\Windows\System\dqMYrcu.exe
  C:\Windows\System\dqMYrcu.exe
  2⤵
  PID:10188
- C:\Windows\System\mLNBtOs.exe
  C:\Windows\System\mLNBtOs.exe
  2⤵
  PID:10212
- C:\Windows\System\yDpSKxH.exe
  C:\Windows\System\yDpSKxH.exe
  2⤵
  PID:8704
- C:\Windows\System\URHXJAa.exe
  C:\Windows\System\URHXJAa.exe
  2⤵
  PID:9236
- C:\Windows\System\GZNKcVq.exe
  C:\Windows\System\GZNKcVq.exe
  2⤵
  PID:9312
- C:\Windows\System\XQUrXkQ.exe
  C:\Windows\System\XQUrXkQ.exe
  2⤵
  PID:9372
- C:\Windows\System\wGhlbtR.exe
  C:\Windows\System\wGhlbtR.exe
  2⤵
  PID:9468
- C:\Windows\System\CYniRbs.exe
  C:\Windows\System\CYniRbs.exe
  2⤵
  PID:9560
- C:\Windows\System\TuFXwIF.exe
  C:\Windows\System\TuFXwIF.exe
  2⤵
  PID:9580
- C:\Windows\System\ILoNusx.exe
  C:\Windows\System\ILoNusx.exe
  2⤵
  PID:9708
- C:\Windows\System\aYIbdvN.exe
  C:\Windows\System\aYIbdvN.exe
  2⤵
  PID:9760
- C:\Windows\System\qdcgNyf.exe
  C:\Windows\System\qdcgNyf.exe
  2⤵
  PID:9820
- C:\Windows\System\cPwzcqo.exe
  C:\Windows\System\cPwzcqo.exe
  2⤵
  PID:9920
- C:\Windows\System\CySSnpv.exe
  C:\Windows\System\CySSnpv.exe
  2⤵
  PID:9968
- C:\Windows\System\lqwIObS.exe
  C:\Windows\System\lqwIObS.exe
  2⤵
  PID:10012
- C:\Windows\System\PkxbviG.exe
  C:\Windows\System\PkxbviG.exe
  2⤵
  PID:10124
- C:\Windows\System\tUozOto.exe
  C:\Windows\System\tUozOto.exe
  2⤵
  PID:10172
- C:\Windows\System\MsQtJbs.exe
  C:\Windows\System\MsQtJbs.exe
  2⤵
  PID:8836
- C:\Windows\System\hzkbbhD.exe
  C:\Windows\System\hzkbbhD.exe
  2⤵
  PID:9288
- C:\Windows\System\gCOUnnW.exe
  C:\Windows\System\gCOUnnW.exe
  2⤵
  PID:9328
- C:\Windows\System\SMDvNPP.exe
  C:\Windows\System\SMDvNPP.exe
  2⤵
  PID:9620
- C:\Windows\System\rYXvuJB.exe
  C:\Windows\System\rYXvuJB.exe
  2⤵
  PID:9792
- C:\Windows\System\ENMnIwN.exe
  C:\Windows\System\ENMnIwN.exe
  2⤵
  PID:9948
- C:\Windows\System\nbTbcvy.exe
  C:\Windows\System\nbTbcvy.exe
  2⤵
  PID:10084
- C:\Windows\System\raKPWgH.exe
  C:\Windows\System\raKPWgH.exe
  2⤵
  PID:10208
- C:\Windows\System\rpGuLCr.exe
  C:\Windows\System\rpGuLCr.exe
  2⤵
  PID:9244
- C:\Windows\System\TvbdTKl.exe
  C:\Windows\System\TvbdTKl.exe
  2⤵
  PID:9716
- C:\Windows\System\czlanbw.exe
  C:\Windows\System\czlanbw.exe
  2⤵
  PID:10056
- C:\Windows\System\cUaHrUd.exe
  C:\Windows\System\cUaHrUd.exe
  2⤵
  PID:9684
- C:\Windows\System\UqCHylY.exe
  C:\Windows\System\UqCHylY.exe
  2⤵
  PID:10260
- C:\Windows\System\IIpgGbI.exe
  C:\Windows\System\IIpgGbI.exe
  2⤵
  PID:10288
- C:\Windows\System\XUNaRYh.exe
  C:\Windows\System\XUNaRYh.exe
  2⤵
  PID:10328
- C:\Windows\System\OGbmLSP.exe
  C:\Windows\System\OGbmLSP.exe
  2⤵
  PID:10356
- C:\Windows\System\JvLqtWx.exe
  C:\Windows\System\JvLqtWx.exe
  2⤵
  PID:10384
- C:\Windows\System\aOqhllX.exe
  C:\Windows\System\aOqhllX.exe
  2⤵
  PID:10412
- C:\Windows\System\sPyqrsC.exe
  C:\Windows\System\sPyqrsC.exe
  2⤵
  PID:10440
- C:\Windows\System\kNMZKUH.exe
  C:\Windows\System\kNMZKUH.exe
  2⤵
  PID:10468
- C:\Windows\System\DgRbLcG.exe
  C:\Windows\System\DgRbLcG.exe
  2⤵
  PID:10484
- C:\Windows\System\QXssMwE.exe
  C:\Windows\System\QXssMwE.exe
  2⤵
  PID:10512
- C:\Windows\System\sAuPWvD.exe
  C:\Windows\System\sAuPWvD.exe
  2⤵
  PID:10548
- C:\Windows\System\efvBdxc.exe
  C:\Windows\System\efvBdxc.exe
  2⤵
  PID:10568
- C:\Windows\System\tjZhBRW.exe
  C:\Windows\System\tjZhBRW.exe
  2⤵
  PID:10596
- C:\Windows\System\MKsMwTi.exe
  C:\Windows\System\MKsMwTi.exe
  2⤵
  PID:10624
- C:\Windows\System\KaFrytW.exe
  C:\Windows\System\KaFrytW.exe
  2⤵
  PID:10664
- C:\Windows\System\CRhGOTC.exe
  C:\Windows\System\CRhGOTC.exe
  2⤵
  PID:10692
- C:\Windows\System\NtWaXak.exe
  C:\Windows\System\NtWaXak.exe
  2⤵
  PID:10720
- C:\Windows\System\FVjvmZt.exe
  C:\Windows\System\FVjvmZt.exe
  2⤵
  PID:10748
- C:\Windows\System\Xtlkjma.exe
  C:\Windows\System\Xtlkjma.exe
  2⤵
  PID:10764
- C:\Windows\System\UJzVBdZ.exe
  C:\Windows\System\UJzVBdZ.exe
  2⤵
  PID:10800
- C:\Windows\System\HZwPjMP.exe
  C:\Windows\System\HZwPjMP.exe
  2⤵
  PID:10836
- C:\Windows\System\EMSVcbI.exe
  C:\Windows\System\EMSVcbI.exe
  2⤵
  PID:10860
- C:\Windows\System\qWCGdzr.exe
  C:\Windows\System\qWCGdzr.exe
  2⤵
  PID:10876
- C:\Windows\System\VMmTBOB.exe
  C:\Windows\System\VMmTBOB.exe
  2⤵
  PID:10904
- C:\Windows\System\jnYtBul.exe
  C:\Windows\System\jnYtBul.exe
  2⤵
  PID:10928
- C:\Windows\System\qNPcejN.exe
  C:\Windows\System\qNPcejN.exe
  2⤵
  PID:10964
- C:\Windows\System\ltnzjRo.exe
  C:\Windows\System\ltnzjRo.exe
  2⤵
  PID:11000
- C:\Windows\System\qLvSZjS.exe
  C:\Windows\System\qLvSZjS.exe
  2⤵
  PID:11032
- C:\Windows\System\WFOWdtE.exe
  C:\Windows\System\WFOWdtE.exe
  2⤵
  PID:11060
- C:\Windows\System\DupUGIL.exe
  C:\Windows\System\DupUGIL.exe
  2⤵
  PID:11080
- C:\Windows\System\nNLHZnX.exe
  C:\Windows\System\nNLHZnX.exe
  2⤵
  PID:11104
- C:\Windows\System\rbYKQxM.exe
  C:\Windows\System\rbYKQxM.exe
  2⤵
  PID:11144
- C:\Windows\System\DTbfkEV.exe
  C:\Windows\System\DTbfkEV.exe
  2⤵
  PID:11164
- C:\Windows\System\BfMLxCn.exe
  C:\Windows\System\BfMLxCn.exe
  2⤵
  PID:11188
- C:\Windows\System\lKQrKnA.exe
  C:\Windows\System\lKQrKnA.exe
  2⤵
  PID:11216
- C:\Windows\System\zzQeuwG.exe
  C:\Windows\System\zzQeuwG.exe
  2⤵
  PID:11256
- C:\Windows\System\CMAoMQG.exe
  C:\Windows\System\CMAoMQG.exe
  2⤵
  PID:10252
- C:\Windows\System\zuvqbpS.exe
  C:\Windows\System\zuvqbpS.exe
  2⤵
  PID:10320
- C:\Windows\System\prPoqtM.exe
  C:\Windows\System\prPoqtM.exe
  2⤵
  PID:10372
- C:\Windows\System\wBQNJCf.exe
  C:\Windows\System\wBQNJCf.exe
  2⤵
  PID:10452
- C:\Windows\System\vuOzile.exe
  C:\Windows\System\vuOzile.exe
  2⤵
  PID:10524
- C:\Windows\System\bhXnAdI.exe
  C:\Windows\System\bhXnAdI.exe
  2⤵
  PID:10564
- C:\Windows\System\WsMMbcv.exe
  C:\Windows\System\WsMMbcv.exe
  2⤵
  PID:10656
- C:\Windows\System\DSQhzjb.exe
  C:\Windows\System\DSQhzjb.exe
  2⤵
  PID:10716
- C:\Windows\System\AFpkFrB.exe
  C:\Windows\System\AFpkFrB.exe
  2⤵
  PID:10760
- C:\Windows\System\shGFdtF.exe
  C:\Windows\System\shGFdtF.exe
  2⤵
  PID:10824
- C:\Windows\System\cGySqkD.exe
  C:\Windows\System\cGySqkD.exe
  2⤵
  PID:10896
- C:\Windows\System\KHBvLEU.exe
  C:\Windows\System\KHBvLEU.exe
  2⤵
  PID:10972
- C:\Windows\System\uiiUuLA.exe
  C:\Windows\System\uiiUuLA.exe
  2⤵
  PID:11012
- C:\Windows\System\qehJvtA.exe
  C:\Windows\System\qehJvtA.exe
  2⤵
  PID:11100
- C:\Windows\System\NeXFmZS.exe
  C:\Windows\System\NeXFmZS.exe
  2⤵
  PID:11152
- C:\Windows\System\QUWjGzi.exe
  C:\Windows\System\QUWjGzi.exe
  2⤵
  PID:11212
- C:\Windows\System\qcmwXCd.exe
  C:\Windows\System\qcmwXCd.exe
  2⤵
  PID:10276
- C:\Windows\System\rsFEyXe.exe
  C:\Windows\System\rsFEyXe.exe
  2⤵
  PID:10436
- C:\Windows\System\WnRkCiA.exe
  C:\Windows\System\WnRkCiA.exe
  2⤵
  PID:10560
- C:\Windows\System\TpVrVTQ.exe
  C:\Windows\System\TpVrVTQ.exe
  2⤵
  PID:9116
- C:\Windows\System\FTMAVOD.exe
  C:\Windows\System\FTMAVOD.exe
  2⤵
  PID:10844
- C:\Windows\System\ALxTQeX.exe
  C:\Windows\System\ALxTQeX.exe
  2⤵
  PID:10984
- C:\Windows\System\goyhsDX.exe
  C:\Windows\System\goyhsDX.exe
  2⤵
  PID:11140
- C:\Windows\System\cRoNLdh.exe
  C:\Windows\System\cRoNLdh.exe
  2⤵
  PID:10120
- C:\Windows\System\YdcDzOm.exe
  C:\Windows\System\YdcDzOm.exe
  2⤵
  PID:10612
- C:\Windows\System\igTuVOC.exe
  C:\Windows\System\igTuVOC.exe
  2⤵
  PID:11044
- C:\Windows\System\thnczcA.exe
  C:\Windows\System\thnczcA.exe
  2⤵
  PID:11228
- C:\Windows\System\umXRyXZ.exe
  C:\Windows\System\umXRyXZ.exe
  2⤵
  PID:11096
- C:\Windows\System\NjBSiyU.exe
  C:\Windows\System\NjBSiyU.exe
  2⤵
  PID:11268
- C:\Windows\System\KLsjteY.exe
  C:\Windows\System\KLsjteY.exe
  2⤵
  PID:11316
- C:\Windows\System\jbnSvTQ.exe
  C:\Windows\System\jbnSvTQ.exe
  2⤵
  PID:11344
- C:\Windows\System\TeWPtaN.exe
  C:\Windows\System\TeWPtaN.exe
  2⤵
  PID:11372
- C:\Windows\System\iQSSvMI.exe
  C:\Windows\System\iQSSvMI.exe
  2⤵
  PID:11400
- C:\Windows\System\LJsoYUq.exe
  C:\Windows\System\LJsoYUq.exe
  2⤵
  PID:11428
- C:\Windows\System\OByLaTh.exe
  C:\Windows\System\OByLaTh.exe
  2⤵
  PID:11456
- C:\Windows\System\RhPieOC.exe
  C:\Windows\System\RhPieOC.exe
  2⤵
  PID:11484
- C:\Windows\System\VjPFKcu.exe
  C:\Windows\System\VjPFKcu.exe
  2⤵
  PID:11512
- C:\Windows\System\gSKODlI.exe
  C:\Windows\System\gSKODlI.exe
  2⤵
  PID:11540
- C:\Windows\System\kAWAFEZ.exe
  C:\Windows\System\kAWAFEZ.exe
  2⤵
  PID:11556
- C:\Windows\System\YymHOGk.exe
  C:\Windows\System\YymHOGk.exe
  2⤵
  PID:11576
- C:\Windows\System\RjESQfx.exe
  C:\Windows\System\RjESQfx.exe
  2⤵
  PID:11612
- C:\Windows\System\sInHQnr.exe
  C:\Windows\System\sInHQnr.exe
  2⤵
  PID:11640
- C:\Windows\System\QhdDjqN.exe
  C:\Windows\System\QhdDjqN.exe
  2⤵
  PID:11672
- C:\Windows\System\owhpyhW.exe
  C:\Windows\System\owhpyhW.exe
  2⤵
  PID:11708
- C:\Windows\System\pRyUTgh.exe
  C:\Windows\System\pRyUTgh.exe
  2⤵
  PID:11724
- C:\Windows\System\lPGjLrm.exe
  C:\Windows\System\lPGjLrm.exe
  2⤵
  PID:11752
- C:\Windows\System\kTvIqoM.exe
  C:\Windows\System\kTvIqoM.exe
  2⤵
  PID:11784
- C:\Windows\System\dOXJpFK.exe
  C:\Windows\System\dOXJpFK.exe
  2⤵
  PID:11820
- C:\Windows\System\JBCOIgC.exe
  C:\Windows\System\JBCOIgC.exe
  2⤵
  PID:11852
- C:\Windows\System\bvauhBq.exe
  C:\Windows\System\bvauhBq.exe
  2⤵
  PID:11880
- C:\Windows\System\WnwCvMh.exe
  C:\Windows\System\WnwCvMh.exe
  2⤵
  PID:11908
- C:\Windows\System\omJmYkA.exe
  C:\Windows\System\omJmYkA.exe
  2⤵
  PID:11936
- C:\Windows\System\vMCYiyg.exe
  C:\Windows\System\vMCYiyg.exe
  2⤵
  PID:11964
- C:\Windows\System\sKoZbRj.exe
  C:\Windows\System\sKoZbRj.exe
  2⤵
  PID:11992
- C:\Windows\System\aZpBIiZ.exe
  C:\Windows\System\aZpBIiZ.exe
  2⤵
  PID:12020
- C:\Windows\System\leMMItc.exe
  C:\Windows\System\leMMItc.exe
  2⤵
  PID:12048
- C:\Windows\System\rbTJSAt.exe
  C:\Windows\System\rbTJSAt.exe
  2⤵
  PID:12076
- C:\Windows\System\YwVDzia.exe
  C:\Windows\System\YwVDzia.exe
  2⤵
  PID:12104
- C:\Windows\System\bpzXBbT.exe
  C:\Windows\System\bpzXBbT.exe
  2⤵
  PID:12120
- C:\Windows\System\ddIssUU.exe
  C:\Windows\System\ddIssUU.exe
  2⤵
  PID:12152
- C:\Windows\System\oThiVZJ.exe
  C:\Windows\System\oThiVZJ.exe
  2⤵
  PID:12180
- C:\Windows\System\yvoRZxG.exe
  C:\Windows\System\yvoRZxG.exe
  2⤵
  PID:12208
- C:\Windows\System\ESCtPNR.exe
  C:\Windows\System\ESCtPNR.exe
  2⤵
  PID:12236
- C:\Windows\System\TVMmBHD.exe
  C:\Windows\System\TVMmBHD.exe
  2⤵
  PID:12276
- C:\Windows\System\AtrdpPO.exe
  C:\Windows\System\AtrdpPO.exe
  2⤵
  PID:11276
- C:\Windows\System\BYPVzQa.exe
  C:\Windows\System\BYPVzQa.exe
  2⤵
  PID:11332
- C:\Windows\System\QVjljBg.exe
  C:\Windows\System\QVjljBg.exe
  2⤵
  PID:11388
- C:\Windows\System\LDhTpiU.exe
  C:\Windows\System\LDhTpiU.exe
  2⤵
  PID:11472
- C:\Windows\System\jWhpZTz.exe
  C:\Windows\System\jWhpZTz.exe
  2⤵
  PID:11020
- C:\Windows\System\kTVFefI.exe
  C:\Windows\System\kTVFefI.exe
  2⤵
  PID:11568
- C:\Windows\System\bTqYoCY.exe
  C:\Windows\System\bTqYoCY.exe
  2⤵
  PID:11628
- C:\Windows\System\BFfUydb.exe
  C:\Windows\System\BFfUydb.exe
  2⤵
  PID:11692
- C:\Windows\System\YbtzBxT.exe
  C:\Windows\System\YbtzBxT.exe
  2⤵
  PID:11748
- C:\Windows\System\estewoQ.exe
  C:\Windows\System\estewoQ.exe
  2⤵
  PID:11780
- C:\Windows\System\RoMBjUy.exe
  C:\Windows\System\RoMBjUy.exe
  2⤵
  PID:11832
- C:\Windows\System\JecBFOP.exe
  C:\Windows\System\JecBFOP.exe
  2⤵
  PID:11876
- C:\Windows\System\vlQGKpV.exe
  C:\Windows\System\vlQGKpV.exe
  2⤵
  PID:12016
- C:\Windows\System\qTxkCav.exe
  C:\Windows\System\qTxkCav.exe
  2⤵
  PID:12060
- C:\Windows\System\MmmHDFx.exe
  C:\Windows\System\MmmHDFx.exe
  2⤵
  PID:12140
- C:\Windows\System\NUIxyiB.exe
  C:\Windows\System\NUIxyiB.exe
  2⤵
  PID:12220
- C:\Windows\System\eFUEZfd.exe
  C:\Windows\System\eFUEZfd.exe
  2⤵
  PID:12232
- C:\Windows\System\WusAEGw.exe
  C:\Windows\System\WusAEGw.exe
  2⤵
  PID:11364
- C:\Windows\System\fosZeHH.exe
  C:\Windows\System\fosZeHH.exe
  2⤵
  PID:11508
- C:\Windows\System\tZVDTPc.exe
  C:\Windows\System\tZVDTPc.exe
  2⤵
  PID:11584
- C:\Windows\System\XMSFWcN.exe
  C:\Windows\System\XMSFWcN.exe
  2⤵
  PID:11808
- C:\Windows\System\YkpVohe.exe
  C:\Windows\System\YkpVohe.exe
  2⤵
  PID:11932
- C:\Windows\System\GPnWLcX.exe
  C:\Windows\System\GPnWLcX.exe
  2⤵
  PID:12172
- C:\Windows\System\dHJzAYU.exe
  C:\Windows\System\dHJzAYU.exe
  2⤵
  PID:11292
- C:\Windows\System\xliBsVS.exe
  C:\Windows\System\xliBsVS.exe
  2⤵
  PID:1868
- C:\Windows\System\lGwnAKn.exe
  C:\Windows\System\lGwnAKn.exe
  2⤵
  PID:12176
- C:\Windows\System\BqFYXWX.exe
  C:\Windows\System\BqFYXWX.exe
  2⤵
  PID:11600
- C:\Windows\System\MbzSzCV.exe
  C:\Windows\System\MbzSzCV.exe
  2⤵
  PID:12040
- C:\Windows\System\bzehIHP.exe
  C:\Windows\System\bzehIHP.exe
  2⤵
  PID:12316
- C:\Windows\System\WxmgQXK.exe
  C:\Windows\System\WxmgQXK.exe
  2⤵
  PID:12332
- C:\Windows\System\McWCznr.exe
  C:\Windows\System\McWCznr.exe
  2⤵
  PID:12360
- C:\Windows\System\TWnSYkh.exe
  C:\Windows\System\TWnSYkh.exe
  2⤵
  PID:12388
- C:\Windows\System\dOEktdl.exe
  C:\Windows\System\dOEktdl.exe
  2⤵
  PID:12424
- C:\Windows\System\FNTrlYR.exe
  C:\Windows\System\FNTrlYR.exe
  2⤵
  PID:12444
- C:\Windows\System\TIVZegN.exe
  C:\Windows\System\TIVZegN.exe
  2⤵
  PID:12472
- C:\Windows\System\PwldVJA.exe
  C:\Windows\System\PwldVJA.exe
  2⤵
  PID:12512
- C:\Windows\System\MzXhvLq.exe
  C:\Windows\System\MzXhvLq.exe
  2⤵
  PID:12540
- C:\Windows\System\nhLFjzA.exe
  C:\Windows\System\nhLFjzA.exe
  2⤵
  PID:12568
- C:\Windows\System\BxsAMiW.exe
  C:\Windows\System\BxsAMiW.exe
  2⤵
  PID:12596
- C:\Windows\System\QCFfLxU.exe
  C:\Windows\System\QCFfLxU.exe
  2⤵
  PID:12624
- C:\Windows\System\QragQwl.exe
  C:\Windows\System\QragQwl.exe
  2⤵
  PID:12652
- C:\Windows\System\xtLBCXw.exe
  C:\Windows\System\xtLBCXw.exe
  2⤵
  PID:12680
- C:\Windows\System\AtVZxNm.exe
  C:\Windows\System\AtVZxNm.exe
  2⤵
  PID:12708
- C:\Windows\System\wJLnCXR.exe
  C:\Windows\System\wJLnCXR.exe
  2⤵
  PID:12736
- C:\Windows\System\ODXKNuR.exe
  C:\Windows\System\ODXKNuR.exe
  2⤵
  PID:12768
- C:\Windows\System\QtIsqzw.exe
  C:\Windows\System\QtIsqzw.exe
  2⤵
  PID:12804
- C:\Windows\System\NoAvCWV.exe
  C:\Windows\System\NoAvCWV.exe
  2⤵
  PID:12820
- C:\Windows\System\CAbZJQw.exe
  C:\Windows\System\CAbZJQw.exe
  2⤵
  PID:12848
- C:\Windows\System\LSzboyK.exe
  C:\Windows\System\LSzboyK.exe
  2⤵
  PID:12872
- C:\Windows\System\mszhUoA.exe
  C:\Windows\System\mszhUoA.exe
  2⤵
  PID:12904
- C:\Windows\System\IJTodex.exe
  C:\Windows\System\IJTodex.exe
  2⤵
  PID:12932
- C:\Windows\System\cqOfunq.exe
  C:\Windows\System\cqOfunq.exe
  2⤵
  PID:12960
- C:\Windows\System\YSdKbBc.exe
  C:\Windows\System\YSdKbBc.exe
  2⤵
  PID:13000
- C:\Windows\System\ksQsWZU.exe
  C:\Windows\System\ksQsWZU.exe
  2⤵
  PID:13016
- C:\Windows\System\UjVhsWu.exe
  C:\Windows\System\UjVhsWu.exe
  2⤵
  PID:13044
- C:\Windows\System\vtyLEmk.exe
  C:\Windows\System\vtyLEmk.exe
  2⤵
  PID:13072
- C:\Windows\System\KlLWjFg.exe
  C:\Windows\System\KlLWjFg.exe
  2⤵
  PID:13112
- C:\Windows\System\NAHtakZ.exe
  C:\Windows\System\NAHtakZ.exe
  2⤵
  PID:13140
- C:\Windows\System\uprdiFw.exe
  C:\Windows\System\uprdiFw.exe
  2⤵
  PID:13168
- C:\Windows\System\nUqAXHg.exe
  C:\Windows\System\nUqAXHg.exe
  2⤵
  PID:13196
- C:\Windows\System\eeEQVag.exe
  C:\Windows\System\eeEQVag.exe
  2⤵
  PID:13224
- C:\Windows\System\mAsMcJi.exe
  C:\Windows\System\mAsMcJi.exe
  2⤵
  PID:13240
- C:\Windows\System\jUaSGvm.exe
  C:\Windows\System\jUaSGvm.exe
  2⤵
  PID:13268
- C:\Windows\System\CPUagEZ.exe
  C:\Windows\System\CPUagEZ.exe
  2⤵
  PID:13308
- C:\Windows\System\dKtPypY.exe
  C:\Windows\System\dKtPypY.exe
  2⤵
  PID:12328
- C:\Windows\System\YUNvSzN.exe
  C:\Windows\System\YUNvSzN.exe
  2⤵
  PID:12372
- C:\Windows\System\Ccqsyvt.exe
  C:\Windows\System\Ccqsyvt.exe
  2⤵
  PID:12440
- C:\Windows\System\zqjIHGs.exe
  C:\Windows\System\zqjIHGs.exe
  2⤵
  PID:12508
- C:\Windows\System\YUybplR.exe
  C:\Windows\System\YUybplR.exe
  2⤵
  PID:12552
- C:\Windows\System\lGGdMfq.exe
  C:\Windows\System\lGGdMfq.exe
  2⤵
  PID:12612
- C:\Windows\System\sYjwMAm.exe
  C:\Windows\System\sYjwMAm.exe
  2⤵
  PID:12672
- C:\Windows\System\fxhtqpE.exe
  C:\Windows\System\fxhtqpE.exe
  2⤵
  PID:12792
- C:\Windows\System\WZBgVJz.exe
  C:\Windows\System\WZBgVJz.exe
  2⤵
  PID:12844
- C:\Windows\System\WSHyOeb.exe
  C:\Windows\System\WSHyOeb.exe
  2⤵
  PID:12944
- C:\Windows\System\xldJVPl.exe
  C:\Windows\System\xldJVPl.exe
  2⤵
  PID:12988
- C:\Windows\System\tiNTxUG.exe
  C:\Windows\System\tiNTxUG.exe
  2⤵
  PID:13056
- C:\Windows\System\kCIzuPu.exe
  C:\Windows\System\kCIzuPu.exe
  2⤵
  PID:13124
- C:\Windows\System\cfJXFpE.exe
  C:\Windows\System\cfJXFpE.exe
  2⤵
  PID:13212
- C:\Windows\System\wbIkflv.exe
  C:\Windows\System\wbIkflv.exe
  2⤵
  PID:12292
- C:\Windows\System\xQxASTG.exe
  C:\Windows\System\xQxASTG.exe
  2⤵
  PID:5952
- C:\Windows\System\AJpxEmG.exe
  C:\Windows\System\AJpxEmG.exe
  2⤵
  PID:12500
- C:\Windows\System\KmMfMwq.exe
  C:\Windows\System\KmMfMwq.exe
  2⤵
  PID:12724
- C:\Windows\System\vOqTHPg.exe
  C:\Windows\System\vOqTHPg.exe
  2⤵
  PID:12920
- C:\Windows\System\LePuEzt.exe
  C:\Windows\System\LePuEzt.exe
  2⤵
  PID:13032
- C:\Windows\System\qwLcRai.exe
  C:\Windows\System\qwLcRai.exe
  2⤵
  PID:13188
- C:\Windows\System\KWWkZiI.exe
  C:\Windows\System\KWWkZiI.exe
  2⤵
  PID:13256
- C:\Windows\System\hVSzctk.exe
  C:\Windows\System\hVSzctk.exe
  2⤵
  PID:4848
- C:\Windows\System\UuubCSl.exe
  C:\Windows\System\UuubCSl.exe
  2⤵
  PID:1620
- C:\Windows\System\HOgAWRk.exe
  C:\Windows\System\HOgAWRk.exe
  2⤵
  PID:12648
- C:\Windows\System\wrCHDiE.exe
  C:\Windows\System\wrCHDiE.exe
  2⤵
  PID:12816
- C:\Windows\System\HUaERff.exe
  C:\Windows\System\HUaERff.exe
  2⤵
  PID:13152
- C:\Windows\System\zSMTXOl.exe
  C:\Windows\System\zSMTXOl.exe
  2⤵
  PID:4464
- C:\Windows\System\FEUjiQr.exe
  C:\Windows\System\FEUjiQr.exe
  2⤵
  PID:2436
- C:\Windows\System\lscWInp.exe
  C:\Windows\System\lscWInp.exe
  2⤵
  PID:13008
- C:\Windows\System\eTOcevW.exe
  C:\Windows\System\eTOcevW.exe
  2⤵
  PID:2968
- C:\Windows\System\JaVZEUH.exe
  C:\Windows\System\JaVZEUH.exe
  2⤵
  PID:13316
- C:\Windows\System\EjSONcf.exe
  C:\Windows\System\EjSONcf.exe
  2⤵
  PID:13356
- C:\Windows\System\MMLlVbI.exe
  C:\Windows\System\MMLlVbI.exe
  2⤵
  PID:13384
- C:\Windows\System\KytZWaD.exe
  C:\Windows\System\KytZWaD.exe
  2⤵
  PID:13400
- C:\Windows\System\hNcYzLy.exe
  C:\Windows\System\hNcYzLy.exe
  2⤵
  PID:13428
- C:\Windows\System\PWVIrrJ.exe
  C:\Windows\System\PWVIrrJ.exe
  2⤵
  PID:13456
- C:\Windows\System\xzpBIkf.exe
  C:\Windows\System\xzpBIkf.exe
  2⤵
  PID:13484
- C:\Windows\System\bVjHlgU.exe
  C:\Windows\System\bVjHlgU.exe
  2⤵
  PID:13524
- C:\Windows\System\OODNZKb.exe
  C:\Windows\System\OODNZKb.exe
  2⤵
  PID:13552
- C:\Windows\System\uDHDIzT.exe
  C:\Windows\System\uDHDIzT.exe
  2⤵
  PID:13568
- C:\Windows\System\zDxPPDp.exe
  C:\Windows\System\zDxPPDp.exe
  2⤵
  PID:13600
- C:\Windows\System\flIYfak.exe
  C:\Windows\System\flIYfak.exe
  2⤵
  PID:13636
- C:\Windows\System\QYSUHBk.exe
  C:\Windows\System\QYSUHBk.exe
  2⤵
  PID:13652
- C:\Windows\System\IrFSiou.exe
  C:\Windows\System\IrFSiou.exe
  2⤵
  PID:13680
- C:\Windows\System\ywtuFVP.exe
  C:\Windows\System\ywtuFVP.exe
  2⤵
  PID:13724
- C:\Windows\System\HPexaAd.exe
  C:\Windows\System\HPexaAd.exe
  2⤵
  PID:13764
- C:\Windows\System\ZuKDGgU.exe
  C:\Windows\System\ZuKDGgU.exe
  2⤵
  PID:13792
- C:\Windows\System\DawVqXw.exe
  C:\Windows\System\DawVqXw.exe
  2⤵
  PID:13808
- C:\Windows\System\CQaYpWm.exe
  C:\Windows\System\CQaYpWm.exe
  2⤵
  PID:13836
- C:\Windows\System\FCtCkGH.exe
  C:\Windows\System\FCtCkGH.exe
  2⤵
  PID:13852
- C:\Windows\System\BsknKZc.exe
  C:\Windows\System\BsknKZc.exe
  2⤵
  PID:13892
- C:\Windows\System\BuWfOpn.exe
  C:\Windows\System\BuWfOpn.exe
  2⤵
  PID:13932
- C:\Windows\System\POMTdAy.exe
  C:\Windows\System\POMTdAy.exe
  2⤵
  PID:13948
- C:\Windows\System\rsOVfDO.exe
  C:\Windows\System\rsOVfDO.exe
  2⤵
  PID:13980
- C:\Windows\System\PrnvoAy.exe
  C:\Windows\System\PrnvoAy.exe
  2⤵
  PID:14012
- C:\Windows\System\kHyLtEV.exe
  C:\Windows\System\kHyLtEV.exe
  2⤵
  PID:14036
- C:\Windows\System\XSGLTmA.exe
  C:\Windows\System\XSGLTmA.exe
  2⤵
  PID:14068
- C:\Windows\System\LUyYIVL.exe
  C:\Windows\System\LUyYIVL.exe
  2⤵
  PID:14100
- C:\Windows\System\rqiccSg.exe
  C:\Windows\System\rqiccSg.exe
  2⤵
  PID:14132
- C:\Windows\System\xSlxnXr.exe
  C:\Windows\System\xSlxnXr.exe
  2⤵
  PID:14160
- C:\Windows\System\UgowBYc.exe
  C:\Windows\System\UgowBYc.exe
  2⤵
  PID:14180
- C:\Windows\System\oxjiNFi.exe
  C:\Windows\System\oxjiNFi.exe
  2⤵
  PID:14212
- C:\Windows\System\EdXQYLS.exe
  C:\Windows\System\EdXQYLS.exe
  2⤵
  PID:14240
- C:\Windows\System\lkXyjVL.exe
  C:\Windows\System\lkXyjVL.exe
  2⤵
  PID:14260
- C:\Windows\System\fqldXPE.exe
  C:\Windows\System\fqldXPE.exe
  2⤵
  PID:14296
- C:\Windows\System\LCpMoXY.exe
  C:\Windows\System\LCpMoXY.exe
  2⤵
  PID:14328
- C:\Windows\System\UkzQUDg.exe
  C:\Windows\System\UkzQUDg.exe
  2⤵
  PID:13368
- C:\Windows\System\NcRQdHO.exe
  C:\Windows\System\NcRQdHO.exe
  2⤵
  PID:13420
- C:\Windows\System\LNPeHxh.exe
  C:\Windows\System\LNPeHxh.exe
  2⤵
  PID:13560
- C:\Windows\System\qednWxP.exe
  C:\Windows\System\qednWxP.exe
  2⤵
  PID:13624
- C:\Windows\System\PtPPmvw.exe
  C:\Windows\System\PtPPmvw.exe
  2⤵
  PID:13672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BCrcsye.exe

Filesize
2.1MB

MD5
55c5e994bc313bc0a9b74eae33545942

SHA1
b2cf1c785826ef39ba6e7562551e4401bf19e493

SHA256
256a0e20878a4b3dabd616a78f1e8c8c456842894ee9ba30a865679aeec4dab9

SHA512
db942e10c47a868ffcbb6d72b5f7b5ce5de74618efdff0d5400f62838aa3cd6060664bbd43a753dc127078eb075225f1290f16b5462eb28d496907ee488064f0

Download Submit
C:\Windows\System\BadIYcE.exe

Filesize
2.1MB

MD5
f0e7797898021a1776b861125ea3dad1

SHA1
8a1c500c8d9faf240a737ac9fc676ab3d2bb4b3a

SHA256
1b7972709aa7fd4c5e4618346c4697451f65a14b11108de4cf251f480a9484e5

SHA512
2574d3052d9a0c793b87ec1867f827e5ae0ea4a80e8add241a1b756719838af1b5cd61de960945682b19d2f5a9639eaf09f45f2ec284a66e42d7b1cd5acda980

Download Submit
C:\Windows\System\EpdpVmU.exe

Filesize
2.1MB

MD5
04a43929a6457f3ac8bc9bdef1c6ba8d

SHA1
24306cdd7fddba7b4730e9a219d9c8162d6cd257

SHA256
833021e28be43473e1936d916dd37a9e4ea7c4457b2f435aa362593b2e8024b9

SHA512
5517785d232ca8664f5d521761d938c7310b90288ab2d0c69a843bbbea1ec11873e7d4f1b3cd582582569a511aadcfd30953a3b3f9ce44c1984a9819a5c83ebf

Download Submit
C:\Windows\System\HxUvwVg.exe

Filesize
2.1MB

MD5
289c4ffab39f7051266a99f19ea0e598

SHA1
8f28282c816695b0f69966bbb9494e22b8956f53

SHA256
758bdadb6dc73ccb59d43cdfb85ea1a41a55c4e207e5cb9f9a0cd47adb7a7564

SHA512
d48761274b8f9dddcb488f978fac3b8d24b49a26353fb5bb99b836d0f5ff757c4f32a8533224a07da0135de56eeafe93adbfda54f6383e43a0d2f6723144ba19

Download Submit
C:\Windows\System\HzLtmAN.exe

Filesize
2.1MB

MD5
2bfbcf83ce7e2111962ecb149680bbfd

SHA1
70f8559530787a35c01c971364d0b48ccb93a0d2

SHA256
bf724520529e807cf196e96c1b220f807ab4756ae8e2c239bcf2df88cf54f73a

SHA512
192d7aaa188eb5121250a96c58520f300c1291ae3a6bd7760a1400d1e9ba063714056663f053797254cfe6cc378c085cc3044fdca4e063ea534b7bf925431846

Download Submit
C:\Windows\System\IeSJTpf.exe

Filesize
2.1MB

MD5
5bcebef3ec9fe452836f5aee94c5d451

SHA1
c9322cad317c4fa1a6b324b9bc2d6db59c1f833f

SHA256
56537010c1bcd6887b1e7ac263f3368a2418ce61395c4ca5524c60e2a5cad4f6

SHA512
1b7fa10f6e2644cad08ee951f4a6f72057ca8506545f1998213b5c2e40f0b2188418921b78878be77e7df5dfc02d98fe9ea06403a330209d6043730ea026936b

Download Submit
C:\Windows\System\KgaMExy.exe

Filesize
2.1MB

MD5
69d0b1d66cc08306ba430368128dd82b

SHA1
b58f2247b730576abc66cdae1f7cd08e0ae1bbaa

SHA256
2d786da373c316eb9fc342c4120fc2712d538d95e44e2e7758589b89f3ccb045

SHA512
8ca6318674184d405683222dc0391dcaac8b9c3041481b35ac07ea8a02e05a64e1887c905ad75b9b76d61c2f5924b9d32bca57cfdcf4a57714ebf6f5b0b76c24

Download Submit
C:\Windows\System\LVabtnU.exe

Filesize
2.1MB

MD5
7642926e2d6cc552e7d4fbe5c8987a67

SHA1
910e19b88e7ac01112ab49418d914318d1c28c95

SHA256
1caf3ee301c9ce3ca7e4386117863926019f82951f40d1783b4ea8f8aeb3dc64

SHA512
a294af5c2293a5df8a08f3ec2fa801bc74cf799c76ff7c1d597bfa22487ab3abdec3dcd1a7849376a554259bbb498902055cbade74d9934209d821555f0d7d7b

Download Submit
C:\Windows\System\LXRYUuL.exe

Filesize
2.1MB

MD5
f57fc589c1559a651d11e312b5100506

SHA1
1aa3f57b0ed9a0759ec30d8aadc2fd6f28cca0f1

SHA256
bbd191061d9ecfe770539f93004336e5e25174dca77e570d79c4427f8ebbe131

SHA512
9bc184a0783c7bd9e217877b78ce07a8325d757926cd7a9ae5a686dffb9c51c9120d9ec2cb1dbd8a49f7f996a3c25607fd3d60be255f5fbb0a9dfce14709e5a3

Download Submit
C:\Windows\System\LgmfNKm.exe

Filesize
2.1MB

MD5
4980fe95aecb592c3a79f8540c32a979

SHA1
6c3186d20fb19ab4f4ca042cc97da140914fd3dc

SHA256
2c88168ef26b241c4c6e77d82a505495ec466424dce917200634f3d647295c7a

SHA512
7b6fa2683ae9054914477d114f2d795132bb1afe652d7d85db7727be8312ca035feb51f715dcf3b5bf3a71dce583d33f7f8f3f456a473647a088dd8e3d9341dc

Download Submit
C:\Windows\System\OgxhUav.exe

Filesize
2.1MB

MD5
f83f1213db8e8b918f57547f624fcc5c

SHA1
033817304e48a3febab4df0ba7ac0309ede97573

SHA256
9841b2b6bb5854e3b9403af568191817702e27e54dde6fded3771e32e6080acf

SHA512
e4ed15ad891cb06dd92d19d4b147eb547ab016f89f217aad19db900d76512c5b22db93893878af98a4d172c31743dbd1b764919917e27d6af55899cf07ba50de

Download Submit
C:\Windows\System\PnBqgFY.exe

Filesize
2.1MB

MD5
0df38ce874811e977b6d4d51ca154ea9

SHA1
8df8ea87a8d10ee7ba831393ba7f425785e16712

SHA256
d222822f14d7ffed0bfdd5d2fe59fe422a5e9f4e909d94b1551853a2d9336dfe

SHA512
13faaaecef66253e69916ae3b4f899fa6e5207b10619bb92b1a271c9639a315ad6d8f708af5bbedf744630d7840a00285ea0c329aea9fb73665d7695fd37e3db

Download Submit
C:\Windows\System\TLOetyg.exe

Filesize
2.1MB

MD5
799c45a270b464f361fd57a062b34b53

SHA1
29b95a6a257a1bc05c602cb34e7dbb7a99ca4dea

SHA256
60ddb7edecdaaa550d975b9318ee78fb8fde2f86b3079e224a010551d894b20b

SHA512
206f697e6d7deb4b9a1a75badedf378df7a3ccbe07e900471f60f423d4f1626c86646deb365fb9c50274646104f40b4d486a95ad5979c9b24bb767f99b6dd954

Download Submit
C:\Windows\System\TZGNJKC.exe

Filesize
2.1MB

MD5
111e541e3166e89db60d65b69117d625

SHA1
16727dfc8dbf4132c39d90a61a243c4df5dfa266

SHA256
a3f829fc0606f9a9ef6a19e5ec9e5407235c390fd58e2e352f012f93814a9800

SHA512
4ae0c427521a17997da4fdbef983e720f40d4f494799478b00b184658cccbd84c9a74e6902d5887031afbf5b2f6cdaf37bdcd516deebdcb3fdc80419f7de5dd5

Download Submit
C:\Windows\System\UPUDltw.exe

Filesize
2.1MB

MD5
baf35dcf4e95cd5a53a0d8cbe6bd7e9c

SHA1
f7df2cf497a49e38a2bb25afb5a88c9c8c70b581

SHA256
00f6f0178845fc237c8234610be3f40ff432180c4efe396647ff0515b95e2a8a

SHA512
75312864de7e1d7a26d85b03bc869ca797724f01e254210b721b8a548bd9d4b0bcf81dd9d080c25fb865b78918dc2b7cee07c8c89afb8b9fbb5f3b21efa45234

Download Submit
C:\Windows\System\fnvgtrO.exe

Filesize
2.1MB

MD5
512cd816eed47a263f8214ddd2d29026

SHA1
27485c7ef47afc1b0f97a05cf933708e12b908dc

SHA256
9aa853936609a9a002bb1e7417a9b40cdc3b890ecb016369996c42803785ad3b

SHA512
b6b1b177afcce2c9366347e05c18f0f3f7909e77855a389a5784f2cc0f5a0d14fa554fdf78a46ae5206d4f16e95fc0f1b17b57abdb1028fcf051a53f8cf615ba

Download Submit
C:\Windows\System\hQadbHu.exe

Filesize
2.1MB

MD5
ef94621c6fc869cfb93954fc34159ccc

SHA1
feef1656ba4d9c47be45be8c9c637c7b2466cf5a

SHA256
c3a532a682c2c3de16bfc816213c1c35f70b85b11799e5c08f57562bb627dcdc

SHA512
72add1fa0820cc2feea3b24e2010ee16b4947357edd9fefc0628d8bb8c94c1ed72cb5f9e6acc73cee6654eff690c5c7b03e6c6b3c5884293f35b81b6ebb833f6

Download Submit
C:\Windows\System\hyorfjr.exe

Filesize
2.1MB

MD5
c45941309a9cb4ac3ef99886d3c46985

SHA1
ce83c8a6116f7b8f4dadc12dce3b260a4c9eb6cc

SHA256
88068ffd5861f2af9e054c7c95d89509cd064e8772f34b4c1507c68646a9fd40

SHA512
2ad58e7ab156307777c8adfd8dbf3e8037be7e800343bf65889b917e15d1eca44de62fcfd6f89f20b7429aa36a6b3dbf0844ad87543fb5101cf2586b6525ae8b

Download Submit
C:\Windows\System\iDPYkkc.exe

Filesize
2.1MB

MD5
f6b5713f795636dcdf59fc780d96a03d

SHA1
ea15b49dcd60c6644560ebe26a53a2f7bea5a1fa

SHA256
0eaae5c3d0bf057ce97e8b31c828a9b54d89edfc9e7f7094667c47b173cec80c

SHA512
608d737aaa042d22b36be499fcea76d433333a9e5a978e91b7ba9ab184ad2dbd6f4a4a467e16f88902be8fda10db7c6deea752ac4cfae50c5a0dfd83e49d633f

Download Submit
C:\Windows\System\iLAUNXs.exe

Filesize
2.1MB

MD5
cdf6b978e45c2e72d114770874d28271

SHA1
cb22475ec0706f1eed5d71f629310c7b39b740c2

SHA256
2e850283406e1058fbd565af189178af8286111f05517135a0182c7438b91651

SHA512
c35b41793dd6b91129df19ef432d4633873d55ea749298b2d6e906afde4b728f4fadcf8e2debdeb76b271339e9031d5c241d7eab7726f463f1b2f37a8f5897bf

Download Submit
C:\Windows\System\kuWlvQY.exe

Filesize
2.1MB

MD5
07bd2a6d3d918517d8e54720b756a7f0

SHA1
1111aa0692d0ede61e89e782453c52021a374333

SHA256
f367c0d02a197ba8e1091872c85d2e2aefd99022735fd8d4df3a5f599c5aa195

SHA512
45542bec1c7274a4dd82e16f201e769937da568199bc7d1edd07d4f214dd74bb91f107e9a61bde5c6be36b17155b5e6123880a2290d7490bb5e1edf1989d10cc

Download Submit
C:\Windows\System\lgaaDGH.exe

Filesize
2.1MB

MD5
a4a0c421a1fc87ac62754f507d683b1c

SHA1
c8a3fa96d637db4bb359d9ed64222bb79cad1706

SHA256
57993c366a36b13e645d1d1702678917bbcbead6aca3bb497cd3b272e868f5f6

SHA512
6a567d9b1ec248217ce57ae7e911f6b5d74bb8b6ee31ef7756700b6fba94eb846908a91a54bb3f7cd16da999a04a102ca5a75f4605075de73f6f5819b0d7fdc6

Download Submit
C:\Windows\System\mILtkaW.exe

Filesize
2.1MB

MD5
c778f76d2a0d2913be77e94356022e63

SHA1
541eb3054ebbf70ba9ac1afe26bd0e5fc1393506

SHA256
9ff943553f86ad221336f45e40457931945b87d59065fcb055effcde7466a52b

SHA512
f77c6181e028d91e0d10fe5f6bfc5e164f9b188caea0156c88fb14092a300e09f2289b47cfe65d81c107ee8cc15f9e9e59138dac9c7428dbd236bff3e8573ef0

Download Submit
C:\Windows\System\nRmkatr.exe

Filesize
2.1MB

MD5
04fb7e304454f05a2d26e5e9cbb6e966

SHA1
3cb6c84e0646b4c87229326189e47c0c4e522354

SHA256
e2f6bb2b874920073252dc6fcb2e8514492d263359868a3d4e78ccf7588fcdb1

SHA512
4f0aff340d3f9d75689503be6131a1b2d33ce6ae9d446f4cfe9f84a4aa6f328d2a651479db518c48e8ef150f512385bda16c043abaf91ddf4b62a9cae35a8339

Download Submit
C:\Windows\System\nagvcaF.exe

Filesize
2.1MB

MD5
1424e1eca646040fe6ab7e16ebb2a3df

SHA1
cb5559288bfcec812fe572c1f243f969f96a8183

SHA256
dfe0682871cf4f43ca172bc30365cd7093f51ba508cb3d82ef165e4008b91abd

SHA512
423b3f103a8617d32b1ab940d93a4e96dd2a171113762df1428625033864a61fc6eed31cc3085928b7481b008be967da0bd05a825c94eccc80b38bbbbf7fead7

Download Submit
C:\Windows\System\qFcltif.exe

Filesize
2.1MB

MD5
2b012e50585c6d66374265854878cfd1

SHA1
010006c7b2e3668c5c88fece3cc85b6451a690c0

SHA256
6828abf24d9cd7aaaeb71e0c6a0edd63ec89cb6b2325deb5b9a381b7e7b73112

SHA512
05dc98842177067dc393671b9ce242918cf924416b2aff5b127bccc3f246b347ac6fa0e1f2b1b276ba36c3ab94e800d6b6526446e366dd1b9db71cdde60f3de3

Download Submit
C:\Windows\System\qKkKxAT.exe

Filesize
2.1MB

MD5
1b924bbe0f5b551c48d30860d24b9aaf

SHA1
b5e17729400fe340214e6ae69b5441e75aa94fc5

SHA256
c22d0ee9a8936ac96f9129bcb698554a12e19f46205ae1f60eb99190cffd2e00

SHA512
1e922e8441c1f967d5d7335c3556670ff31851a44f5463e5aba18093d40758d8fc17f9ec8451a71bd0b3e50f8779ff4072e01d9c2e90f9ae69714bb5bb3818ae

Download Submit
C:\Windows\System\qsbwOqt.exe

Filesize
2.1MB

MD5
2f2f7908a159544aa9bf0cbd0fe864fd

SHA1
dc1bdb9d1b7bd7d113b029708e17edc31f35f0d8

SHA256
9bdd7d5c4ff8fa013b3ee0284bb153ff5f6c8e8731a8cd4e618efb67645fc52d

SHA512
1101541763e56b841b90d74f57a5884c8758217afa6e4b73c3ece5cf4bd4601d2c48ed666b4eb7200cdacdcc2435c4b66542acca81249772a37e04babf5e8156

Download Submit
C:\Windows\System\rxVTnak.exe

Filesize
2.1MB

MD5
c6088560ebf982455be91d31c596114f

SHA1
57f62cefb93fcb6cb2832d8c028b558873e8fcb2

SHA256
372b63e3cfe674a45915dd35bf923f0300fd821943b79306a0fac095feaee100

SHA512
dc24e87a9641f420e6951216af38450a0a7ed1b381f892f0b63d629956a9ccb08acf561bdc1080c94c6046e54d419f6f746e96895e192bd54fa1170f8768cff7

Download Submit
C:\Windows\System\txcVooc.exe

Filesize
2.1MB

MD5
8c7a399f3e50d403dfa397f4edeaf13d

SHA1
50e1ee0e2f8e0809a955cc34c10483d4e6fe6d99

SHA256
a22534602b2e1ccd90995d0636834cbb5239f68b306fcf5e428213a4b8da51d8

SHA512
1b73bffbce1a69621249e18bd2917659199287a95a7f5370f7c070b668630a5aa54084422d4ae258b995ea46b9a84965d8e1975d0c36c5558bb29ce540033ce7

Download Submit
C:\Windows\System\yZGrZyo.exe

Filesize
2.1MB

MD5
e9f75c0a95e92a8963652a6199af9486

SHA1
04f062be2cc0c00022c8c5b59b151030f1f21f4d

SHA256
9085bf95bed323bb31f48bbb549413b2eba5e6e8fb8abf6c2eb40fb7b61e94a0

SHA512
48b9eb168e2d5ea619aaf9391240143c7e668b7d3b5f00768af8b0e05d904af8f5a570c11598f413b79dde24ebaa121668c339d9c42bb0215ec3ae904334d72b

Download Submit
C:\Windows\System\zPdVULi.exe

Filesize
2.1MB

MD5
d89fca17072c580f84ea6e132486706c

SHA1
9bf447149f7aeed8343e21d4a0925a53f7b2d63b

SHA256
045a82234d1134bae216c6c2f2ee8f0e39740bb66adb62a2ad9eec7f8ece4563

SHA512
707841c2fc69c3f4339b97ee1cbe5c2dd2c54d6e6c21ea2a4a147ca9055f49dcccd2c0747ab116c922f1b193f21bc405f304a961a425654448d0f6367a68cc73

Download Submit
C:\Windows\System\znFbcOk.exe

Filesize
2.1MB

MD5
77ad764bf5cf9ade4db68a8cef41ea18

SHA1
fdb19579d319daa5344ef5c1a43e2c094b047ade

SHA256
6ef62615c5944d3936c04ea48e86977b773695413ccfe4fb3828280ab8a83c1d

SHA512
4775b2a30573dfbed218e6d71cb8162197355868c785071f76fcb2418d41ca64eefb5698b20893c2fdc63de8925ede1f7242bdf794fab4a302fc5e1ea1fc11ba

Download Submit
memory/372-833-0x00007FF7EE600000-0x00007FF7EE954000-memory.dmp

Filesize
3.3MB

Download
memory/372-2156-0x00007FF7EE600000-0x00007FF7EE954000-memory.dmp

Filesize
3.3MB

Download
memory/388-799-0x00007FF61DC50000-0x00007FF61DFA4000-memory.dmp

Filesize
3.3MB

Download
memory/388-2146-0x00007FF61DC50000-0x00007FF61DFA4000-memory.dmp

Filesize
3.3MB

Download
memory/900-2158-0x00007FF60EC70000-0x00007FF60EFC4000-memory.dmp

Filesize
3.3MB

Download
memory/900-805-0x00007FF60EC70000-0x00007FF60EFC4000-memory.dmp

Filesize
3.3MB

Download
memory/1212-46-0x00007FF7749C0000-0x00007FF774D14000-memory.dmp

Filesize
3.3MB

Download
memory/1212-2136-0x00007FF7749C0000-0x00007FF774D14000-memory.dmp

Filesize
3.3MB

Download
memory/1392-49-0x00007FF752000000-0x00007FF752354000-memory.dmp

Filesize
3.3MB

Download
memory/1392-2127-0x00007FF752000000-0x00007FF752354000-memory.dmp

Filesize
3.3MB

Download
memory/1392-2139-0x00007FF752000000-0x00007FF752354000-memory.dmp

Filesize
3.3MB

Download
memory/1816-2149-0x00007FF75BE60000-0x00007FF75C1B4000-memory.dmp

Filesize
3.3MB

Download
memory/1816-795-0x00007FF75BE60000-0x00007FF75C1B4000-memory.dmp

Filesize
3.3MB

Download
memory/1952-2142-0x00007FF785060000-0x00007FF7853B4000-memory.dmp

Filesize
3.3MB

Download
memory/1952-791-0x00007FF785060000-0x00007FF7853B4000-memory.dmp

Filesize
3.3MB

Download
memory/2064-2141-0x00007FF60F430000-0x00007FF60F784000-memory.dmp

Filesize
3.3MB

Download
memory/2064-792-0x00007FF60F430000-0x00007FF60F784000-memory.dmp

Filesize
3.3MB

Download
memory/2100-60-0x00007FF693D80000-0x00007FF6940D4000-memory.dmp

Filesize
3.3MB

Download
memory/2100-2130-0x00007FF693D80000-0x00007FF6940D4000-memory.dmp

Filesize
3.3MB

Download
memory/2100-2137-0x00007FF693D80000-0x00007FF6940D4000-memory.dmp

Filesize
3.3MB

Download
memory/2120-2151-0x00007FF7760C0000-0x00007FF776414000-memory.dmp

Filesize
3.3MB

Download
memory/2120-802-0x00007FF7760C0000-0x00007FF776414000-memory.dmp

Filesize
3.3MB

Download
memory/2720-2132-0x00007FF6CBC10000-0x00007FF6CBF64000-memory.dmp

Filesize
3.3MB

Download
memory/2720-17-0x00007FF6CBC10000-0x00007FF6CBF64000-memory.dmp

Filesize
3.3MB

Download
memory/2732-2150-0x00007FF660960000-0x00007FF660CB4000-memory.dmp

Filesize
3.3MB

Download
memory/2732-801-0x00007FF660960000-0x00007FF660CB4000-memory.dmp

Filesize
3.3MB

Download
memory/3096-2145-0x00007FF7B2B80000-0x00007FF7B2ED4000-memory.dmp

Filesize
3.3MB

Download
memory/3096-800-0x00007FF7B2B80000-0x00007FF7B2ED4000-memory.dmp

Filesize
3.3MB

Download
memory/3128-2144-0x00007FF787130000-0x00007FF787484000-memory.dmp

Filesize
3.3MB

Download
memory/3128-794-0x00007FF787130000-0x00007FF787484000-memory.dmp

Filesize
3.3MB

Download
memory/3140-806-0x00007FF792930000-0x00007FF792C84000-memory.dmp

Filesize
3.3MB

Download
memory/3140-2155-0x00007FF792930000-0x00007FF792C84000-memory.dmp

Filesize
3.3MB

Download
memory/3176-2138-0x00007FF7836B0000-0x00007FF783A04000-memory.dmp

Filesize
3.3MB

Download
memory/3176-2129-0x00007FF7836B0000-0x00007FF783A04000-memory.dmp

Filesize
3.3MB

Download
memory/3176-57-0x00007FF7836B0000-0x00007FF783A04000-memory.dmp

Filesize
3.3MB

Download
memory/3212-838-0x00007FF7C9090000-0x00007FF7C93E4000-memory.dmp

Filesize
3.3MB

Download
memory/3212-2154-0x00007FF7C9090000-0x00007FF7C93E4000-memory.dmp

Filesize
3.3MB

Download
memory/3356-2148-0x00007FF65F870000-0x00007FF65FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/3356-796-0x00007FF65F870000-0x00007FF65FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/3444-2134-0x00007FF75F460000-0x00007FF75F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/3444-42-0x00007FF75F460000-0x00007FF75F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/3496-2133-0x00007FF7807F0000-0x00007FF780B44000-memory.dmp

Filesize
3.3MB

Download
memory/3496-2126-0x00007FF7807F0000-0x00007FF780B44000-memory.dmp

Filesize
3.3MB

Download
memory/3496-22-0x00007FF7807F0000-0x00007FF780B44000-memory.dmp

Filesize
3.3MB

Download
memory/3692-2153-0x00007FF6ED8B0000-0x00007FF6EDC04000-memory.dmp

Filesize
3.3MB

Download
memory/3692-847-0x00007FF6ED8B0000-0x00007FF6EDC04000-memory.dmp

Filesize
3.3MB

Download
memory/3944-2143-0x00007FF7BCF50000-0x00007FF7BD2A4000-memory.dmp

Filesize
3.3MB

Download
memory/3944-793-0x00007FF7BCF50000-0x00007FF7BD2A4000-memory.dmp

Filesize
3.3MB

Download
memory/4016-1-0x0000012AF01C0000-0x0000012AF01D0000-memory.dmp

Filesize
64KB

Download
memory/4016-0-0x00007FF72FDE0000-0x00007FF730134000-memory.dmp

Filesize
3.3MB

Download
memory/4204-797-0x00007FF7B64D0000-0x00007FF7B6824000-memory.dmp

Filesize
3.3MB

Download
memory/4204-2152-0x00007FF7B64D0000-0x00007FF7B6824000-memory.dmp

Filesize
3.3MB

Download
memory/4480-2140-0x00007FF771850000-0x00007FF771BA4000-memory.dmp

Filesize
3.3MB

Download
memory/4480-2128-0x00007FF771850000-0x00007FF771BA4000-memory.dmp

Filesize
3.3MB

Download
memory/4480-56-0x00007FF771850000-0x00007FF771BA4000-memory.dmp

Filesize
3.3MB

Download
memory/4600-798-0x00007FF624800000-0x00007FF624B54000-memory.dmp

Filesize
3.3MB

Download
memory/4600-2147-0x00007FF624800000-0x00007FF624B54000-memory.dmp

Filesize
3.3MB

Download
memory/4656-2125-0x00007FF64C260000-0x00007FF64C5B4000-memory.dmp

Filesize
3.3MB

Download
memory/4656-20-0x00007FF64C260000-0x00007FF64C5B4000-memory.dmp

Filesize
3.3MB

Download
memory/4656-2135-0x00007FF64C260000-0x00007FF64C5B4000-memory.dmp

Filesize
3.3MB

Download
memory/4756-2159-0x00007FF7CB5C0000-0x00007FF7CB914000-memory.dmp

Filesize
3.3MB

Download
memory/4756-803-0x00007FF7CB5C0000-0x00007FF7CB914000-memory.dmp

Filesize
3.3MB

Download
memory/4796-804-0x00007FF6E0E60000-0x00007FF6E11B4000-memory.dmp

Filesize
3.3MB

Download
memory/4796-2157-0x00007FF6E0E60000-0x00007FF6E11B4000-memory.dmp

Filesize
3.3MB

Download
memory/5048-2124-0x00007FF621910000-0x00007FF621C64000-memory.dmp

Filesize
3.3MB

Download
memory/5048-8-0x00007FF621910000-0x00007FF621C64000-memory.dmp

Filesize
3.3MB

Download
memory/5048-2131-0x00007FF621910000-0x00007FF621C64000-memory.dmp

Filesize
3.3MB

Download