xmrig | 525fc64571a63022ee34143f417d59ec8c0437d7462232a88784cffa76ba105c

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
Size

1.8MB
MD5

dcb71479cd7da429dde3f4f79105bec0
SHA1

0d5c83b96633a0725d0c41567d33a2ab3d66a3bb
SHA256

525fc64571a63022ee34143f417d59ec8c0437d7462232a88784cffa76ba105c
SHA512

5421b8b0c1e355f01932fbac7c962298d08b897c1aed01bc93ed94f6f5521ef9029ff1a5584963318c01aae933e71813a48583ad4876b756bfef8a8c3ffd9680
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9NcHFR:BemTLkNdfE0pZrm

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/796-0-0x00007FF76C0A0000-0x00007FF76C3F4000-memory.dmp	xmrig
behavioral2/files/0x000e000000023ba2-5.dat	xmrig
behavioral2/memory/3444-7-0x00007FF650F40000-0x00007FF651294000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bad-10.dat	xmrig
behavioral2/files/0x000a000000023bae-11.dat	xmrig
behavioral2/memory/512-14-0x00007FF6C5230000-0x00007FF6C5584000-memory.dmp	xmrig
behavioral2/files/0x000b000000023baa-23.dat	xmrig
behavioral2/files/0x000a000000023bb0-31.dat	xmrig
behavioral2/files/0x000a000000023bb2-44.dat	xmrig
behavioral2/files/0x0031000000023bb5-54.dat	xmrig
behavioral2/files/0x000a000000023bb1-60.dat	xmrig
behavioral2/files/0x000a000000023bb9-86.dat	xmrig
behavioral2/files/0x000a000000023bbe-111.dat	xmrig
behavioral2/files/0x000a000000023bca-166.dat	xmrig
behavioral2/memory/4456-713-0x00007FF79CEB0000-0x00007FF79D204000-memory.dmp	xmrig
behavioral2/memory/2096-709-0x00007FF7597F0000-0x00007FF759B44000-memory.dmp	xmrig
behavioral2/memory/4408-719-0x00007FF71C860000-0x00007FF71CBB4000-memory.dmp	xmrig
behavioral2/memory/4580-724-0x00007FF62A500000-0x00007FF62A854000-memory.dmp	xmrig
behavioral2/memory/2240-729-0x00007FF7AA710000-0x00007FF7AAA64000-memory.dmp	xmrig
behavioral2/memory/5080-741-0x00007FF64D7F0000-0x00007FF64DB44000-memory.dmp	xmrig
behavioral2/memory/1664-738-0x00007FF788600000-0x00007FF788954000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bcb-171.dat	xmrig
behavioral2/files/0x000a000000023bc9-161.dat	xmrig
behavioral2/files/0x000a000000023bc8-156.dat	xmrig
behavioral2/files/0x000a000000023bc7-151.dat	xmrig
behavioral2/files/0x000a000000023bc6-146.dat	xmrig
behavioral2/files/0x000a000000023bc5-141.dat	xmrig
behavioral2/files/0x000a000000023bc4-136.dat	xmrig
behavioral2/files/0x000a000000023bc3-131.dat	xmrig
behavioral2/files/0x000a000000023bc2-126.dat	xmrig
behavioral2/files/0x000a000000023bc0-121.dat	xmrig
behavioral2/files/0x000a000000023bbf-116.dat	xmrig
behavioral2/files/0x000a000000023bbd-106.dat	xmrig
behavioral2/files/0x000a000000023bbc-101.dat	xmrig
behavioral2/files/0x000a000000023bbb-96.dat	xmrig
behavioral2/files/0x000a000000023bba-91.dat	xmrig
behavioral2/files/0x000a000000023bb8-81.dat	xmrig
behavioral2/files/0x0031000000023bb6-79.dat	xmrig
behavioral2/files/0x000a000000023bb7-77.dat	xmrig
behavioral2/memory/924-71-0x00007FF76B3C0000-0x00007FF76B714000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb3-69.dat	xmrig
behavioral2/files/0x0031000000023bb4-64.dat	xmrig
behavioral2/memory/4240-63-0x00007FF766370000-0x00007FF7666C4000-memory.dmp	xmrig
behavioral2/memory/1220-57-0x00007FF6AB250000-0x00007FF6AB5A4000-memory.dmp	xmrig
behavioral2/memory/4952-49-0x00007FF7BF860000-0x00007FF7BFBB4000-memory.dmp	xmrig
behavioral2/memory/2160-46-0x00007FF6479B0000-0x00007FF647D04000-memory.dmp	xmrig
behavioral2/memory/1656-39-0x00007FF65CE90000-0x00007FF65D1E4000-memory.dmp	xmrig
behavioral2/memory/2608-35-0x00007FF7EB7D0000-0x00007FF7EBB24000-memory.dmp	xmrig
behavioral2/files/0x000a000000023baf-41.dat	xmrig
behavioral2/memory/4352-20-0x00007FF6109B0000-0x00007FF610D04000-memory.dmp	xmrig
behavioral2/memory/628-744-0x00007FF676500000-0x00007FF676854000-memory.dmp	xmrig
behavioral2/memory/2152-750-0x00007FF77C410000-0x00007FF77C764000-memory.dmp	xmrig
behavioral2/memory/3984-758-0x00007FF7CB4B0000-0x00007FF7CB804000-memory.dmp	xmrig
behavioral2/memory/3776-755-0x00007FF6F3A50000-0x00007FF6F3DA4000-memory.dmp	xmrig
behavioral2/memory/940-763-0x00007FF7F3E20000-0x00007FF7F4174000-memory.dmp	xmrig
behavioral2/memory/3400-769-0x00007FF7E1D40000-0x00007FF7E2094000-memory.dmp	xmrig
behavioral2/memory/1600-773-0x00007FF7927C0000-0x00007FF792B14000-memory.dmp	xmrig
behavioral2/memory/4464-779-0x00007FF7DC6B0000-0x00007FF7DCA04000-memory.dmp	xmrig
behavioral2/memory/4936-783-0x00007FF63F120000-0x00007FF63F474000-memory.dmp	xmrig
behavioral2/memory/2280-786-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	xmrig
behavioral2/memory/3512-785-0x00007FF76F490000-0x00007FF76F7E4000-memory.dmp	xmrig
behavioral2/memory/3392-777-0x00007FF79F130000-0x00007FF79F484000-memory.dmp	xmrig
behavioral2/memory/3444-2077-0x00007FF650F40000-0x00007FF651294000-memory.dmp	xmrig
behavioral2/memory/4352-2078-0x00007FF6109B0000-0x00007FF610D04000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3444	bsGBsmx.exe
512	QMwSOVz.exe
4352	yupEEXc.exe
2608	qgUXoUT.exe
1656	kJvsRTP.exe
2160	UvFVtte.exe
924	NEcbwef.exe
4952	TndYRog.exe
1220	FQyNrzS.exe
2096	LCzdbDj.exe
4240	dofKRfy.exe
4456	CTWytFW.exe
2280	jihcQVv.exe
4408	tyoFMXE.exe
4580	hIwSjMW.exe
2240	FMaajHc.exe
1664	bVhEIgr.exe
5080	bPMHcqi.exe
628	aFiLDmu.exe
2152	chFGCrT.exe
3776	SyjfaXH.exe
3984	nTnsZgP.exe
940	IzabJTH.exe
3400	sJNYXOu.exe
1600	bwSAPZl.exe
3392	ilVQTtj.exe
4464	QkmPDca.exe
4936	xLNTarH.exe
3512	aqZTnIU.exe
3784	pyOzODe.exe
2104	OycEVJO.exe
3764	ZwINkzQ.exe
1864	qDnnQfp.exe
1732	dHtHvMh.exe
2336	YSeAnyV.exe
2736	VuUgDOq.exe
212	jLwZZZQ.exe
4436	VKyeUDX.exe
1880	JWNkZIE.exe
2548	RBhODXW.exe
4432	KzCQAHz.exe
2580	dIByNQo.exe
1248	HzoBIIz.exe
4668	YJOPQHk.exe
2068	bGKnRlp.exe
4000	GphCsKT.exe
4644	RkhRffb.exe
1872	wJGfCqf.exe
1844	wSGKSuF.exe
2128	KbbGvlx.exe
1152	DeyexOU.exe
436	LFyVBbY.exe
4116	RkIxLAS.exe
4552	GoglKLa.exe
3552	hyykgvh.exe
4740	NPUnfSR.exe
3124	IfaeDkx.exe
1392	eqqOPYE.exe
3104	ZiSeOYn.exe
2904	teiHILM.exe
4184	JmUvfPT.exe
4944	HnpVfAS.exe
2016	FcGIbJJ.exe
4772	BVEzQCh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/796-0-0x00007FF76C0A0000-0x00007FF76C3F4000-memory.dmp	upx
behavioral2/files/0x000e000000023ba2-5.dat	upx
behavioral2/memory/3444-7-0x00007FF650F40000-0x00007FF651294000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-10.dat	upx
behavioral2/files/0x000a000000023bae-11.dat	upx
behavioral2/memory/512-14-0x00007FF6C5230000-0x00007FF6C5584000-memory.dmp	upx
behavioral2/files/0x000b000000023baa-23.dat	upx
behavioral2/files/0x000a000000023bb0-31.dat	upx
behavioral2/files/0x000a000000023bb2-44.dat	upx
behavioral2/files/0x0031000000023bb5-54.dat	upx
behavioral2/files/0x000a000000023bb1-60.dat	upx
behavioral2/files/0x000a000000023bb9-86.dat	upx
behavioral2/files/0x000a000000023bbe-111.dat	upx
behavioral2/files/0x000a000000023bca-166.dat	upx
behavioral2/memory/4456-713-0x00007FF79CEB0000-0x00007FF79D204000-memory.dmp	upx
behavioral2/memory/2096-709-0x00007FF7597F0000-0x00007FF759B44000-memory.dmp	upx
behavioral2/memory/4408-719-0x00007FF71C860000-0x00007FF71CBB4000-memory.dmp	upx
behavioral2/memory/4580-724-0x00007FF62A500000-0x00007FF62A854000-memory.dmp	upx
behavioral2/memory/2240-729-0x00007FF7AA710000-0x00007FF7AAA64000-memory.dmp	upx
behavioral2/memory/5080-741-0x00007FF64D7F0000-0x00007FF64DB44000-memory.dmp	upx
behavioral2/memory/1664-738-0x00007FF788600000-0x00007FF788954000-memory.dmp	upx
behavioral2/files/0x000a000000023bcb-171.dat	upx
behavioral2/files/0x000a000000023bc9-161.dat	upx
behavioral2/files/0x000a000000023bc8-156.dat	upx
behavioral2/files/0x000a000000023bc7-151.dat	upx
behavioral2/files/0x000a000000023bc6-146.dat	upx
behavioral2/files/0x000a000000023bc5-141.dat	upx
behavioral2/files/0x000a000000023bc4-136.dat	upx
behavioral2/files/0x000a000000023bc3-131.dat	upx
behavioral2/files/0x000a000000023bc2-126.dat	upx
behavioral2/files/0x000a000000023bc0-121.dat	upx
behavioral2/files/0x000a000000023bbf-116.dat	upx
behavioral2/files/0x000a000000023bbd-106.dat	upx
behavioral2/files/0x000a000000023bbc-101.dat	upx
behavioral2/files/0x000a000000023bbb-96.dat	upx
behavioral2/files/0x000a000000023bba-91.dat	upx
behavioral2/files/0x000a000000023bb8-81.dat	upx
behavioral2/files/0x0031000000023bb6-79.dat	upx
behavioral2/files/0x000a000000023bb7-77.dat	upx
behavioral2/memory/924-71-0x00007FF76B3C0000-0x00007FF76B714000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-69.dat	upx
behavioral2/files/0x0031000000023bb4-64.dat	upx
behavioral2/memory/4240-63-0x00007FF766370000-0x00007FF7666C4000-memory.dmp	upx
behavioral2/memory/1220-57-0x00007FF6AB250000-0x00007FF6AB5A4000-memory.dmp	upx
behavioral2/memory/4952-49-0x00007FF7BF860000-0x00007FF7BFBB4000-memory.dmp	upx
behavioral2/memory/2160-46-0x00007FF6479B0000-0x00007FF647D04000-memory.dmp	upx
behavioral2/memory/1656-39-0x00007FF65CE90000-0x00007FF65D1E4000-memory.dmp	upx
behavioral2/memory/2608-35-0x00007FF7EB7D0000-0x00007FF7EBB24000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-41.dat	upx
behavioral2/memory/4352-20-0x00007FF6109B0000-0x00007FF610D04000-memory.dmp	upx
behavioral2/memory/628-744-0x00007FF676500000-0x00007FF676854000-memory.dmp	upx
behavioral2/memory/2152-750-0x00007FF77C410000-0x00007FF77C764000-memory.dmp	upx
behavioral2/memory/3984-758-0x00007FF7CB4B0000-0x00007FF7CB804000-memory.dmp	upx
behavioral2/memory/3776-755-0x00007FF6F3A50000-0x00007FF6F3DA4000-memory.dmp	upx
behavioral2/memory/940-763-0x00007FF7F3E20000-0x00007FF7F4174000-memory.dmp	upx
behavioral2/memory/3400-769-0x00007FF7E1D40000-0x00007FF7E2094000-memory.dmp	upx
behavioral2/memory/1600-773-0x00007FF7927C0000-0x00007FF792B14000-memory.dmp	upx
behavioral2/memory/4464-779-0x00007FF7DC6B0000-0x00007FF7DCA04000-memory.dmp	upx
behavioral2/memory/4936-783-0x00007FF63F120000-0x00007FF63F474000-memory.dmp	upx
behavioral2/memory/2280-786-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	upx
behavioral2/memory/3512-785-0x00007FF76F490000-0x00007FF76F7E4000-memory.dmp	upx
behavioral2/memory/3392-777-0x00007FF79F130000-0x00007FF79F484000-memory.dmp	upx
behavioral2/memory/3444-2077-0x00007FF650F40000-0x00007FF651294000-memory.dmp	upx
behavioral2/memory/4352-2078-0x00007FF6109B0000-0x00007FF610D04000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HHxJeig.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\xlcGYls.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\INnPxFE.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\befQwfn.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\AuuHXkI.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\ORHUaXM.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\eInWDUh.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\otlqYJg.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\lxZHRfP.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\zDsCCDq.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\YWwnKCQ.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\nYaafgR.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\ybiKgiQ.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\yCJmPSG.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\vviPGLc.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\ZaLzPmQ.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\rIbDbhh.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\JGznCak.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\pAfzrpU.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\kMWxQtv.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\HIYAAek.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\FkrAFiD.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\LZJRvkK.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\NvXYAWg.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\IIGrUOd.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\JWrfEPa.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\YAgFAmz.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\fnKmdNt.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\AVmLiGq.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\dGBfXHg.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\aUclYWx.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\LktXBoI.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\CblDzFB.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\QMwSOVz.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\PwVUICa.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\HEdBxXo.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\rtVErhU.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\yCVtdIA.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\htxJPkv.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\uSaQSpm.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\YcOksMY.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\jLwZZZQ.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\gCXNhzS.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\luCZQsn.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\ndftzij.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\gcaDfcH.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\oGCyMZS.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\UsjvPBf.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\nEjmCti.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\RGNdsnv.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\culSCSe.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\JDpFRoN.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\iASbyTF.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\xoRFCkv.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\eNkBtNA.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\MfTYyvE.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\PAkBbKl.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\xzbIjbD.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\kQzjkWE.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\gexAgrG.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\OqLTZur.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\UdQaqzU.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\pWlMXdO.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
File created	C:\Windows\System\stjkudP.exe	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 3444	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	85
PID 796 wrote to memory of 3444	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	85
PID 796 wrote to memory of 512	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	86
PID 796 wrote to memory of 512	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	86
PID 796 wrote to memory of 4352	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	87
PID 796 wrote to memory of 4352	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	87
PID 796 wrote to memory of 2608	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	88
PID 796 wrote to memory of 2608	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	88
PID 796 wrote to memory of 1656	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	89
PID 796 wrote to memory of 1656	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	89
PID 796 wrote to memory of 2160	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	90
PID 796 wrote to memory of 2160	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	90
PID 796 wrote to memory of 924	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	91
PID 796 wrote to memory of 924	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	91
PID 796 wrote to memory of 4952	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	92
PID 796 wrote to memory of 4952	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	92
PID 796 wrote to memory of 1220	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	93
PID 796 wrote to memory of 1220	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	93
PID 796 wrote to memory of 2096	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	94
PID 796 wrote to memory of 2096	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	94
PID 796 wrote to memory of 4240	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	96
PID 796 wrote to memory of 4240	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	96
PID 796 wrote to memory of 4456	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	97
PID 796 wrote to memory of 4456	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	97
PID 796 wrote to memory of 2280	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	98
PID 796 wrote to memory of 2280	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	98
PID 796 wrote to memory of 4408	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	99
PID 796 wrote to memory of 4408	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	99
PID 796 wrote to memory of 4580	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	100
PID 796 wrote to memory of 4580	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	100
PID 796 wrote to memory of 2240	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	101
PID 796 wrote to memory of 2240	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	101
PID 796 wrote to memory of 1664	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	102
PID 796 wrote to memory of 1664	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	102
PID 796 wrote to memory of 5080	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	103
PID 796 wrote to memory of 5080	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	103
PID 796 wrote to memory of 628	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	104
PID 796 wrote to memory of 628	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	104
PID 796 wrote to memory of 2152	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	105
PID 796 wrote to memory of 2152	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	105
PID 796 wrote to memory of 3776	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	106
PID 796 wrote to memory of 3776	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	106
PID 796 wrote to memory of 3984	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	107
PID 796 wrote to memory of 3984	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	107
PID 796 wrote to memory of 940	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	108
PID 796 wrote to memory of 940	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	108
PID 796 wrote to memory of 3400	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	109
PID 796 wrote to memory of 3400	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	109
PID 796 wrote to memory of 1600	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	110
PID 796 wrote to memory of 1600	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	110
PID 796 wrote to memory of 3392	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	111
PID 796 wrote to memory of 3392	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	111
PID 796 wrote to memory of 4464	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	112
PID 796 wrote to memory of 4464	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	112
PID 796 wrote to memory of 4936	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	113
PID 796 wrote to memory of 4936	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	113
PID 796 wrote to memory of 3512	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	114
PID 796 wrote to memory of 3512	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	114
PID 796 wrote to memory of 3784	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	115
PID 796 wrote to memory of 3784	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	115
PID 796 wrote to memory of 2104	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	116
PID 796 wrote to memory of 2104	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	116
PID 796 wrote to memory of 3764	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	117
PID 796 wrote to memory of 3764	796	dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe	117

C:\Users\Admin\AppData\Local\Temp\dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\dcb71479cd7da429dde3f4f79105bec0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\System\bsGBsmx.exe
  C:\Windows\System\bsGBsmx.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\QMwSOVz.exe
  C:\Windows\System\QMwSOVz.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\yupEEXc.exe
  C:\Windows\System\yupEEXc.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\qgUXoUT.exe
  C:\Windows\System\qgUXoUT.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\kJvsRTP.exe
  C:\Windows\System\kJvsRTP.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\UvFVtte.exe
  C:\Windows\System\UvFVtte.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\NEcbwef.exe
  C:\Windows\System\NEcbwef.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\TndYRog.exe
  C:\Windows\System\TndYRog.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\FQyNrzS.exe
  C:\Windows\System\FQyNrzS.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\LCzdbDj.exe
  C:\Windows\System\LCzdbDj.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\dofKRfy.exe
  C:\Windows\System\dofKRfy.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\CTWytFW.exe
  C:\Windows\System\CTWytFW.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\jihcQVv.exe
  C:\Windows\System\jihcQVv.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\tyoFMXE.exe
  C:\Windows\System\tyoFMXE.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\hIwSjMW.exe
  C:\Windows\System\hIwSjMW.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\FMaajHc.exe
  C:\Windows\System\FMaajHc.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\bVhEIgr.exe
  C:\Windows\System\bVhEIgr.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\bPMHcqi.exe
  C:\Windows\System\bPMHcqi.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\aFiLDmu.exe
  C:\Windows\System\aFiLDmu.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\chFGCrT.exe
  C:\Windows\System\chFGCrT.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\SyjfaXH.exe
  C:\Windows\System\SyjfaXH.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\nTnsZgP.exe
  C:\Windows\System\nTnsZgP.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\IzabJTH.exe
  C:\Windows\System\IzabJTH.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\sJNYXOu.exe
  C:\Windows\System\sJNYXOu.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\bwSAPZl.exe
  C:\Windows\System\bwSAPZl.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ilVQTtj.exe
  C:\Windows\System\ilVQTtj.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\QkmPDca.exe
  C:\Windows\System\QkmPDca.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\xLNTarH.exe
  C:\Windows\System\xLNTarH.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\aqZTnIU.exe
  C:\Windows\System\aqZTnIU.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\pyOzODe.exe
  C:\Windows\System\pyOzODe.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\OycEVJO.exe
  C:\Windows\System\OycEVJO.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\ZwINkzQ.exe
  C:\Windows\System\ZwINkzQ.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\qDnnQfp.exe
  C:\Windows\System\qDnnQfp.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\dHtHvMh.exe
  C:\Windows\System\dHtHvMh.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\YSeAnyV.exe
  C:\Windows\System\YSeAnyV.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\VuUgDOq.exe
  C:\Windows\System\VuUgDOq.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\jLwZZZQ.exe
  C:\Windows\System\jLwZZZQ.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\VKyeUDX.exe
  C:\Windows\System\VKyeUDX.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\JWNkZIE.exe
  C:\Windows\System\JWNkZIE.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\RBhODXW.exe
  C:\Windows\System\RBhODXW.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\KzCQAHz.exe
  C:\Windows\System\KzCQAHz.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\dIByNQo.exe
  C:\Windows\System\dIByNQo.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\HzoBIIz.exe
  C:\Windows\System\HzoBIIz.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\YJOPQHk.exe
  C:\Windows\System\YJOPQHk.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\bGKnRlp.exe
  C:\Windows\System\bGKnRlp.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\GphCsKT.exe
  C:\Windows\System\GphCsKT.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\RkhRffb.exe
  C:\Windows\System\RkhRffb.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\wJGfCqf.exe
  C:\Windows\System\wJGfCqf.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\wSGKSuF.exe
  C:\Windows\System\wSGKSuF.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\KbbGvlx.exe
  C:\Windows\System\KbbGvlx.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\DeyexOU.exe
  C:\Windows\System\DeyexOU.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\LFyVBbY.exe
  C:\Windows\System\LFyVBbY.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\RkIxLAS.exe
  C:\Windows\System\RkIxLAS.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\GoglKLa.exe
  C:\Windows\System\GoglKLa.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\hyykgvh.exe
  C:\Windows\System\hyykgvh.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\NPUnfSR.exe
  C:\Windows\System\NPUnfSR.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\IfaeDkx.exe
  C:\Windows\System\IfaeDkx.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\eqqOPYE.exe
  C:\Windows\System\eqqOPYE.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\ZiSeOYn.exe
  C:\Windows\System\ZiSeOYn.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\teiHILM.exe
  C:\Windows\System\teiHILM.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\JmUvfPT.exe
  C:\Windows\System\JmUvfPT.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\HnpVfAS.exe
  C:\Windows\System\HnpVfAS.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\FcGIbJJ.exe
  C:\Windows\System\FcGIbJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\BVEzQCh.exe
  C:\Windows\System\BVEzQCh.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\zipDuGy.exe
  C:\Windows\System\zipDuGy.exe
  2⤵
  PID:4500
- C:\Windows\System\ItfRzoA.exe
  C:\Windows\System\ItfRzoA.exe
  2⤵
  PID:1536
- C:\Windows\System\YAgFAmz.exe
  C:\Windows\System\YAgFAmz.exe
  2⤵
  PID:5132
- C:\Windows\System\CHNrIiB.exe
  C:\Windows\System\CHNrIiB.exe
  2⤵
  PID:5160
- C:\Windows\System\bWqmLrO.exe
  C:\Windows\System\bWqmLrO.exe
  2⤵
  PID:5188
- C:\Windows\System\LFAlMro.exe
  C:\Windows\System\LFAlMro.exe
  2⤵
  PID:5216
- C:\Windows\System\KqiuAYG.exe
  C:\Windows\System\KqiuAYG.exe
  2⤵
  PID:5244
- C:\Windows\System\fDUmpOY.exe
  C:\Windows\System\fDUmpOY.exe
  2⤵
  PID:5272
- C:\Windows\System\qUTafda.exe
  C:\Windows\System\qUTafda.exe
  2⤵
  PID:5296
- C:\Windows\System\xFqEamX.exe
  C:\Windows\System\xFqEamX.exe
  2⤵
  PID:5328
- C:\Windows\System\ejRHJKw.exe
  C:\Windows\System\ejRHJKw.exe
  2⤵
  PID:5356
- C:\Windows\System\ujiJddN.exe
  C:\Windows\System\ujiJddN.exe
  2⤵
  PID:5384
- C:\Windows\System\Bbcmtwt.exe
  C:\Windows\System\Bbcmtwt.exe
  2⤵
  PID:5412
- C:\Windows\System\txUvEhA.exe
  C:\Windows\System\txUvEhA.exe
  2⤵
  PID:5440
- C:\Windows\System\eqtBXGv.exe
  C:\Windows\System\eqtBXGv.exe
  2⤵
  PID:5468
- C:\Windows\System\TqlKALJ.exe
  C:\Windows\System\TqlKALJ.exe
  2⤵
  PID:5496
- C:\Windows\System\dsKtBIe.exe
  C:\Windows\System\dsKtBIe.exe
  2⤵
  PID:5524
- C:\Windows\System\NnpXMyv.exe
  C:\Windows\System\NnpXMyv.exe
  2⤵
  PID:5552
- C:\Windows\System\NoSbMlh.exe
  C:\Windows\System\NoSbMlh.exe
  2⤵
  PID:5580
- C:\Windows\System\tvuTzTd.exe
  C:\Windows\System\tvuTzTd.exe
  2⤵
  PID:5608
- C:\Windows\System\HNDyzwA.exe
  C:\Windows\System\HNDyzwA.exe
  2⤵
  PID:5636
- C:\Windows\System\AKPbbuH.exe
  C:\Windows\System\AKPbbuH.exe
  2⤵
  PID:5664
- C:\Windows\System\UavJxCy.exe
  C:\Windows\System\UavJxCy.exe
  2⤵
  PID:5692
- C:\Windows\System\HUXfuqB.exe
  C:\Windows\System\HUXfuqB.exe
  2⤵
  PID:5720
- C:\Windows\System\wGdVPEJ.exe
  C:\Windows\System\wGdVPEJ.exe
  2⤵
  PID:5748
- C:\Windows\System\ccTOGvm.exe
  C:\Windows\System\ccTOGvm.exe
  2⤵
  PID:5776
- C:\Windows\System\pAfzrpU.exe
  C:\Windows\System\pAfzrpU.exe
  2⤵
  PID:5800
- C:\Windows\System\IloOGbu.exe
  C:\Windows\System\IloOGbu.exe
  2⤵
  PID:5832
- C:\Windows\System\QefacsU.exe
  C:\Windows\System\QefacsU.exe
  2⤵
  PID:5860
- C:\Windows\System\NPMxCai.exe
  C:\Windows\System\NPMxCai.exe
  2⤵
  PID:5888
- C:\Windows\System\eBwLDSZ.exe
  C:\Windows\System\eBwLDSZ.exe
  2⤵
  PID:5916
- C:\Windows\System\BgUVowb.exe
  C:\Windows\System\BgUVowb.exe
  2⤵
  PID:5944
- C:\Windows\System\YlgJNAs.exe
  C:\Windows\System\YlgJNAs.exe
  2⤵
  PID:5972
- C:\Windows\System\MIewoAW.exe
  C:\Windows\System\MIewoAW.exe
  2⤵
  PID:6000
- C:\Windows\System\eFgDDCH.exe
  C:\Windows\System\eFgDDCH.exe
  2⤵
  PID:6032
- C:\Windows\System\swGkvpe.exe
  C:\Windows\System\swGkvpe.exe
  2⤵
  PID:6132
- C:\Windows\System\ZfsXTFI.exe
  C:\Windows\System\ZfsXTFI.exe
  2⤵
  PID:2252
- C:\Windows\System\HIypPyD.exe
  C:\Windows\System\HIypPyD.exe
  2⤵
  PID:3380
- C:\Windows\System\TlGILBY.exe
  C:\Windows\System\TlGILBY.exe
  2⤵
  PID:3364
- C:\Windows\System\FFjlXTO.exe
  C:\Windows\System\FFjlXTO.exe
  2⤵
  PID:4920
- C:\Windows\System\AxCHZrU.exe
  C:\Windows\System\AxCHZrU.exe
  2⤵
  PID:4040
- C:\Windows\System\glwgOyV.exe
  C:\Windows\System\glwgOyV.exe
  2⤵
  PID:3192
- C:\Windows\System\HYVFKPb.exe
  C:\Windows\System\HYVFKPb.exe
  2⤵
  PID:1760
- C:\Windows\System\hnlgCRP.exe
  C:\Windows\System\hnlgCRP.exe
  2⤵
  PID:5140
- C:\Windows\System\hPoVgFi.exe
  C:\Windows\System\hPoVgFi.exe
  2⤵
  PID:5204
- C:\Windows\System\jWUyicc.exe
  C:\Windows\System\jWUyicc.exe
  2⤵
  PID:5264
- C:\Windows\System\dJARXdW.exe
  C:\Windows\System\dJARXdW.exe
  2⤵
  PID:5336
- C:\Windows\System\culSCSe.exe
  C:\Windows\System\culSCSe.exe
  2⤵
  PID:5400
- C:\Windows\System\FEZDXCi.exe
  C:\Windows\System\FEZDXCi.exe
  2⤵
  PID:5460
- C:\Windows\System\kQzjkWE.exe
  C:\Windows\System\kQzjkWE.exe
  2⤵
  PID:5532
- C:\Windows\System\uytvLmz.exe
  C:\Windows\System\uytvLmz.exe
  2⤵
  PID:5596
- C:\Windows\System\GmQmiDJ.exe
  C:\Windows\System\GmQmiDJ.exe
  2⤵
  PID:5656
- C:\Windows\System\EWtATpA.exe
  C:\Windows\System\EWtATpA.exe
  2⤵
  PID:5712
- C:\Windows\System\SSVQYqw.exe
  C:\Windows\System\SSVQYqw.exe
  2⤵
  PID:5792
- C:\Windows\System\WTaJpQQ.exe
  C:\Windows\System\WTaJpQQ.exe
  2⤵
  PID:5852
- C:\Windows\System\AfvonfT.exe
  C:\Windows\System\AfvonfT.exe
  2⤵
  PID:5924
- C:\Windows\System\lLtZwxd.exe
  C:\Windows\System\lLtZwxd.exe
  2⤵
  PID:5988
- C:\Windows\System\KnMnNeV.exe
  C:\Windows\System\KnMnNeV.exe
  2⤵
  PID:6056
- C:\Windows\System\kMWxQtv.exe
  C:\Windows\System\kMWxQtv.exe
  2⤵
  PID:1460
- C:\Windows\System\hhEEyym.exe
  C:\Windows\System\hhEEyym.exe
  2⤵
  PID:1796
- C:\Windows\System\yeUfBti.exe
  C:\Windows\System\yeUfBti.exe
  2⤵
  PID:1404
- C:\Windows\System\zijpNmK.exe
  C:\Windows\System\zijpNmK.exe
  2⤵
  PID:5180
- C:\Windows\System\XSOHhSu.exe
  C:\Windows\System\XSOHhSu.exe
  2⤵
  PID:5364
- C:\Windows\System\iQoriCa.exe
  C:\Windows\System\iQoriCa.exe
  2⤵
  PID:5488
- C:\Windows\System\cXkljon.exe
  C:\Windows\System\cXkljon.exe
  2⤵
  PID:6164
- C:\Windows\System\fnKmdNt.exe
  C:\Windows\System\fnKmdNt.exe
  2⤵
  PID:6192
- C:\Windows\System\OwdsxLR.exe
  C:\Windows\System\OwdsxLR.exe
  2⤵
  PID:6220
- C:\Windows\System\EVhwkmD.exe
  C:\Windows\System\EVhwkmD.exe
  2⤵
  PID:6248
- C:\Windows\System\PIODIij.exe
  C:\Windows\System\PIODIij.exe
  2⤵
  PID:6276
- C:\Windows\System\EzJkLfn.exe
  C:\Windows\System\EzJkLfn.exe
  2⤵
  PID:6304
- C:\Windows\System\BmOUbwO.exe
  C:\Windows\System\BmOUbwO.exe
  2⤵
  PID:6332
- C:\Windows\System\rnYChzf.exe
  C:\Windows\System\rnYChzf.exe
  2⤵
  PID:6360
- C:\Windows\System\pwzzyIc.exe
  C:\Windows\System\pwzzyIc.exe
  2⤵
  PID:6388
- C:\Windows\System\bsFayxB.exe
  C:\Windows\System\bsFayxB.exe
  2⤵
  PID:6416
- C:\Windows\System\oDqCafp.exe
  C:\Windows\System\oDqCafp.exe
  2⤵
  PID:6444
- C:\Windows\System\jTolUth.exe
  C:\Windows\System\jTolUth.exe
  2⤵
  PID:6472
- C:\Windows\System\LSFZZLB.exe
  C:\Windows\System\LSFZZLB.exe
  2⤵
  PID:6500
- C:\Windows\System\PwVUICa.exe
  C:\Windows\System\PwVUICa.exe
  2⤵
  PID:6528
- C:\Windows\System\kDqpqxh.exe
  C:\Windows\System\kDqpqxh.exe
  2⤵
  PID:6556
- C:\Windows\System\oJAUHyq.exe
  C:\Windows\System\oJAUHyq.exe
  2⤵
  PID:6584
- C:\Windows\System\oGCyMZS.exe
  C:\Windows\System\oGCyMZS.exe
  2⤵
  PID:6612
- C:\Windows\System\zJnipKe.exe
  C:\Windows\System\zJnipKe.exe
  2⤵
  PID:6640
- C:\Windows\System\PlmuSqT.exe
  C:\Windows\System\PlmuSqT.exe
  2⤵
  PID:6656
- C:\Windows\System\HoVxsgo.exe
  C:\Windows\System\HoVxsgo.exe
  2⤵
  PID:6684
- C:\Windows\System\lSovyMv.exe
  C:\Windows\System\lSovyMv.exe
  2⤵
  PID:6716
- C:\Windows\System\kwGdZxw.exe
  C:\Windows\System\kwGdZxw.exe
  2⤵
  PID:6748
- C:\Windows\System\GVaQMSh.exe
  C:\Windows\System\GVaQMSh.exe
  2⤵
  PID:6780
- C:\Windows\System\OopxOwO.exe
  C:\Windows\System\OopxOwO.exe
  2⤵
  PID:6808
- C:\Windows\System\zDsCCDq.exe
  C:\Windows\System\zDsCCDq.exe
  2⤵
  PID:6836
- C:\Windows\System\Rghznsc.exe
  C:\Windows\System\Rghznsc.exe
  2⤵
  PID:6864
- C:\Windows\System\HIYAAek.exe
  C:\Windows\System\HIYAAek.exe
  2⤵
  PID:6892
- C:\Windows\System\JDpFRoN.exe
  C:\Windows\System\JDpFRoN.exe
  2⤵
  PID:6920
- C:\Windows\System\prVTXYD.exe
  C:\Windows\System\prVTXYD.exe
  2⤵
  PID:6948
- C:\Windows\System\eflfuOT.exe
  C:\Windows\System\eflfuOT.exe
  2⤵
  PID:6972
- C:\Windows\System\beqBVVR.exe
  C:\Windows\System\beqBVVR.exe
  2⤵
  PID:7004
- C:\Windows\System\EGAkBEF.exe
  C:\Windows\System\EGAkBEF.exe
  2⤵
  PID:7032
- C:\Windows\System\YWwnKCQ.exe
  C:\Windows\System\YWwnKCQ.exe
  2⤵
  PID:7060
- C:\Windows\System\nHEynzO.exe
  C:\Windows\System\nHEynzO.exe
  2⤵
  PID:7088
- C:\Windows\System\INnPxFE.exe
  C:\Windows\System\INnPxFE.exe
  2⤵
  PID:7116
- C:\Windows\System\pyDJPlC.exe
  C:\Windows\System\pyDJPlC.exe
  2⤵
  PID:7144
- C:\Windows\System\yfweWrv.exe
  C:\Windows\System\yfweWrv.exe
  2⤵
  PID:5572
- C:\Windows\System\eVpRtaP.exe
  C:\Windows\System\eVpRtaP.exe
  2⤵
  PID:5756
- C:\Windows\System\vvSFHLY.exe
  C:\Windows\System\vvSFHLY.exe
  2⤵
  PID:5848
- C:\Windows\System\kypKYtY.exe
  C:\Windows\System\kypKYtY.exe
  2⤵
  PID:6020
- C:\Windows\System\EraPepS.exe
  C:\Windows\System\EraPepS.exe
  2⤵
  PID:452
- C:\Windows\System\MjEhVwY.exe
  C:\Windows\System\MjEhVwY.exe
  2⤵
  PID:5168
- C:\Windows\System\ezPbqot.exe
  C:\Windows\System\ezPbqot.exe
  2⤵
  PID:6148
- C:\Windows\System\XJnmzUn.exe
  C:\Windows\System\XJnmzUn.exe
  2⤵
  PID:6208
- C:\Windows\System\jajiQZN.exe
  C:\Windows\System\jajiQZN.exe
  2⤵
  PID:6268
- C:\Windows\System\xGVagHN.exe
  C:\Windows\System\xGVagHN.exe
  2⤵
  PID:6344
- C:\Windows\System\fuKtWoq.exe
  C:\Windows\System\fuKtWoq.exe
  2⤵
  PID:6404
- C:\Windows\System\bMxcowQ.exe
  C:\Windows\System\bMxcowQ.exe
  2⤵
  PID:6464
- C:\Windows\System\byWMiMY.exe
  C:\Windows\System\byWMiMY.exe
  2⤵
  PID:6516
- C:\Windows\System\iejLCQj.exe
  C:\Windows\System\iejLCQj.exe
  2⤵
  PID:6572
- C:\Windows\System\sjUXGdU.exe
  C:\Windows\System\sjUXGdU.exe
  2⤵
  PID:6628
- C:\Windows\System\DrlUStK.exe
  C:\Windows\System\DrlUStK.exe
  2⤵
  PID:6676
- C:\Windows\System\IVmwJUw.exe
  C:\Windows\System\IVmwJUw.exe
  2⤵
  PID:6740
- C:\Windows\System\wsenJxH.exe
  C:\Windows\System\wsenJxH.exe
  2⤵
  PID:6820
- C:\Windows\System\tvRhtvP.exe
  C:\Windows\System\tvRhtvP.exe
  2⤵
  PID:6880
- C:\Windows\System\mTnzUrL.exe
  C:\Windows\System\mTnzUrL.exe
  2⤵
  PID:6936
- C:\Windows\System\gCXNhzS.exe
  C:\Windows\System\gCXNhzS.exe
  2⤵
  PID:6992
- C:\Windows\System\RNLKJOQ.exe
  C:\Windows\System\RNLKJOQ.exe
  2⤵
  PID:7052
- C:\Windows\System\oHfSYFp.exe
  C:\Windows\System\oHfSYFp.exe
  2⤵
  PID:7128
- C:\Windows\System\XAYNUtx.exe
  C:\Windows\System\XAYNUtx.exe
  2⤵
  PID:7160
- C:\Windows\System\HEdBxXo.exe
  C:\Windows\System\HEdBxXo.exe
  2⤵
  PID:5820
- C:\Windows\System\BcetDZr.exe
  C:\Windows\System\BcetDZr.exe
  2⤵
  PID:4584
- C:\Windows\System\fzuWHVR.exe
  C:\Windows\System\fzuWHVR.exe
  2⤵
  PID:6180
- C:\Windows\System\bZBhuBp.exe
  C:\Windows\System\bZBhuBp.exe
  2⤵
  PID:6320
- C:\Windows\System\eEorzbi.exe
  C:\Windows\System\eEorzbi.exe
  2⤵
  PID:620
- C:\Windows\System\SmSSUKg.exe
  C:\Windows\System\SmSSUKg.exe
  2⤵
  PID:6600
- C:\Windows\System\nYaafgR.exe
  C:\Windows\System\nYaafgR.exe
  2⤵
  PID:6668
- C:\Windows\System\befQwfn.exe
  C:\Windows\System\befQwfn.exe
  2⤵
  PID:6796
- C:\Windows\System\OkvaGUb.exe
  C:\Windows\System\OkvaGUb.exe
  2⤵
  PID:3888
- C:\Windows\System\mPxMtoG.exe
  C:\Windows\System\mPxMtoG.exe
  2⤵
  PID:1340
- C:\Windows\System\NKeTRMC.exe
  C:\Windows\System\NKeTRMC.exe
  2⤵
  PID:2324
- C:\Windows\System\qxAdArk.exe
  C:\Windows\System\qxAdArk.exe
  2⤵
  PID:6140
- C:\Windows\System\iuihxlO.exe
  C:\Windows\System\iuihxlO.exe
  2⤵
  PID:468
- C:\Windows\System\cYxeUaW.exe
  C:\Windows\System\cYxeUaW.exe
  2⤵
  PID:6436
- C:\Windows\System\pApPwAV.exe
  C:\Windows\System\pApPwAV.exe
  2⤵
  PID:4376
- C:\Windows\System\uRCgXfB.exe
  C:\Windows\System\uRCgXfB.exe
  2⤵
  PID:6768
- C:\Windows\System\tFWvWov.exe
  C:\Windows\System\tFWvWov.exe
  2⤵
  PID:7192
- C:\Windows\System\KBmCbPP.exe
  C:\Windows\System\KBmCbPP.exe
  2⤵
  PID:7220
- C:\Windows\System\kfENtxv.exe
  C:\Windows\System\kfENtxv.exe
  2⤵
  PID:7248
- C:\Windows\System\JGwdQEg.exe
  C:\Windows\System\JGwdQEg.exe
  2⤵
  PID:7276
- C:\Windows\System\tYdrYvm.exe
  C:\Windows\System\tYdrYvm.exe
  2⤵
  PID:7304
- C:\Windows\System\pHxDAcT.exe
  C:\Windows\System\pHxDAcT.exe
  2⤵
  PID:7320
- C:\Windows\System\ZucniPA.exe
  C:\Windows\System\ZucniPA.exe
  2⤵
  PID:7348
- C:\Windows\System\TLvGgaX.exe
  C:\Windows\System\TLvGgaX.exe
  2⤵
  PID:7380
- C:\Windows\System\SDayzrI.exe
  C:\Windows\System\SDayzrI.exe
  2⤵
  PID:7412
- C:\Windows\System\UZUgOhJ.exe
  C:\Windows\System\UZUgOhJ.exe
  2⤵
  PID:7440
- C:\Windows\System\aKQeunI.exe
  C:\Windows\System\aKQeunI.exe
  2⤵
  PID:7476
- C:\Windows\System\kZrlwaS.exe
  C:\Windows\System\kZrlwaS.exe
  2⤵
  PID:7504
- C:\Windows\System\PkhkovH.exe
  C:\Windows\System\PkhkovH.exe
  2⤵
  PID:7552
- C:\Windows\System\SkIhVYx.exe
  C:\Windows\System\SkIhVYx.exe
  2⤵
  PID:7584
- C:\Windows\System\HKtgvqk.exe
  C:\Windows\System\HKtgvqk.exe
  2⤵
  PID:7648
- C:\Windows\System\XvBNRWA.exe
  C:\Windows\System\XvBNRWA.exe
  2⤵
  PID:7664
- C:\Windows\System\VacOrgo.exe
  C:\Windows\System\VacOrgo.exe
  2⤵
  PID:7696
- C:\Windows\System\YjshVUA.exe
  C:\Windows\System\YjshVUA.exe
  2⤵
  PID:7716
- C:\Windows\System\xjGoDct.exe
  C:\Windows\System\xjGoDct.exe
  2⤵
  PID:7736
- C:\Windows\System\jJtZkjV.exe
  C:\Windows\System\jJtZkjV.exe
  2⤵
  PID:7752
- C:\Windows\System\uGmZamY.exe
  C:\Windows\System\uGmZamY.exe
  2⤵
  PID:7772
- C:\Windows\System\ybiKgiQ.exe
  C:\Windows\System\ybiKgiQ.exe
  2⤵
  PID:7788
- C:\Windows\System\luCZQsn.exe
  C:\Windows\System\luCZQsn.exe
  2⤵
  PID:7816
- C:\Windows\System\zmbGifA.exe
  C:\Windows\System\zmbGifA.exe
  2⤵
  PID:7836
- C:\Windows\System\rtVErhU.exe
  C:\Windows\System\rtVErhU.exe
  2⤵
  PID:7884
- C:\Windows\System\HhChDQR.exe
  C:\Windows\System\HhChDQR.exe
  2⤵
  PID:7932
- C:\Windows\System\QwRKwnd.exe
  C:\Windows\System\QwRKwnd.exe
  2⤵
  PID:7976
- C:\Windows\System\LoviILQ.exe
  C:\Windows\System\LoviILQ.exe
  2⤵
  PID:8044
- C:\Windows\System\qnTuqko.exe
  C:\Windows\System\qnTuqko.exe
  2⤵
  PID:8080
- C:\Windows\System\WOYYuhH.exe
  C:\Windows\System\WOYYuhH.exe
  2⤵
  PID:8120
- C:\Windows\System\tHSnDMm.exe
  C:\Windows\System\tHSnDMm.exe
  2⤵
  PID:8164
- C:\Windows\System\iJQboEE.exe
  C:\Windows\System\iJQboEE.exe
  2⤵
  PID:6240
- C:\Windows\System\tOmhicf.exe
  C:\Windows\System\tOmhicf.exe
  2⤵
  PID:6432
- C:\Windows\System\htNaFug.exe
  C:\Windows\System\htNaFug.exe
  2⤵
  PID:6652
- C:\Windows\System\idWRYxb.exe
  C:\Windows\System\idWRYxb.exe
  2⤵
  PID:4176
- C:\Windows\System\aXprDqk.exe
  C:\Windows\System\aXprDqk.exe
  2⤵
  PID:7208
- C:\Windows\System\XzexNnX.exe
  C:\Windows\System\XzexNnX.exe
  2⤵
  PID:3132
- C:\Windows\System\fBXZigo.exe
  C:\Windows\System\fBXZigo.exe
  2⤵
  PID:7292
- C:\Windows\System\WqDNnbA.exe
  C:\Windows\System\WqDNnbA.exe
  2⤵
  PID:4780
- C:\Windows\System\mqYNbAz.exe
  C:\Windows\System\mqYNbAz.exe
  2⤵
  PID:7316
- C:\Windows\System\uxwOgbH.exe
  C:\Windows\System\uxwOgbH.exe
  2⤵
  PID:7368
- C:\Windows\System\cNEVyGa.exe
  C:\Windows\System\cNEVyGa.exe
  2⤵
  PID:7464
- C:\Windows\System\FyGKSKv.exe
  C:\Windows\System\FyGKSKv.exe
  2⤵
  PID:7488
- C:\Windows\System\UBQUXuu.exe
  C:\Windows\System\UBQUXuu.exe
  2⤵
  PID:7616
- C:\Windows\System\FkrAFiD.exe
  C:\Windows\System\FkrAFiD.exe
  2⤵
  PID:7660
- C:\Windows\System\AVmLiGq.exe
  C:\Windows\System\AVmLiGq.exe
  2⤵
  PID:7676
- C:\Windows\System\KUJUKkh.exe
  C:\Windows\System\KUJUKkh.exe
  2⤵
  PID:7784
- C:\Windows\System\uuUfVml.exe
  C:\Windows\System\uuUfVml.exe
  2⤵
  PID:7800
- C:\Windows\System\IrvGqnc.exe
  C:\Windows\System\IrvGqnc.exe
  2⤵
  PID:7896
- C:\Windows\System\oBNtABY.exe
  C:\Windows\System\oBNtABY.exe
  2⤵
  PID:7952
- C:\Windows\System\hLzdhVb.exe
  C:\Windows\System\hLzdhVb.exe
  2⤵
  PID:7960
- C:\Windows\System\camZwQD.exe
  C:\Windows\System\camZwQD.exe
  2⤵
  PID:8076
- C:\Windows\System\fTcJjLM.exe
  C:\Windows\System\fTcJjLM.exe
  2⤵
  PID:8156
- C:\Windows\System\cuDTRWu.exe
  C:\Windows\System\cuDTRWu.exe
  2⤵
  PID:7024
- C:\Windows\System\oakxPAg.exe
  C:\Windows\System\oakxPAg.exe
  2⤵
  PID:7420
- C:\Windows\System\cuctXpO.exe
  C:\Windows\System\cuctXpO.exe
  2⤵
  PID:7804
- C:\Windows\System\VckLmuS.exe
  C:\Windows\System\VckLmuS.exe
  2⤵
  PID:8068
- C:\Windows\System\KrUEHGN.exe
  C:\Windows\System\KrUEHGN.exe
  2⤵
  PID:5448
- C:\Windows\System\ndftzij.exe
  C:\Windows\System\ndftzij.exe
  2⤵
  PID:1124
- C:\Windows\System\FYpdMSU.exe
  C:\Windows\System\FYpdMSU.exe
  2⤵
  PID:7264
- C:\Windows\System\EYLqPqk.exe
  C:\Windows\System\EYLqPqk.exe
  2⤵
  PID:4940
- C:\Windows\System\gexAgrG.exe
  C:\Windows\System\gexAgrG.exe
  2⤵
  PID:7336
- C:\Windows\System\GjgXsoP.exe
  C:\Windows\System\GjgXsoP.exe
  2⤵
  PID:7548
- C:\Windows\System\Dbinema.exe
  C:\Windows\System\Dbinema.exe
  2⤵
  PID:7692
- C:\Windows\System\CdTbswA.exe
  C:\Windows\System\CdTbswA.exe
  2⤵
  PID:7808
- C:\Windows\System\zexladm.exe
  C:\Windows\System\zexladm.exe
  2⤵
  PID:8072
- C:\Windows\System\CWuFLay.exe
  C:\Windows\System\CWuFLay.exe
  2⤵
  PID:5964
- C:\Windows\System\WQwbSuW.exe
  C:\Windows\System\WQwbSuW.exe
  2⤵
  PID:7956
- C:\Windows\System\EQOsbmr.exe
  C:\Windows\System\EQOsbmr.exe
  2⤵
  PID:6544
- C:\Windows\System\qrEeweI.exe
  C:\Windows\System\qrEeweI.exe
  2⤵
  PID:7640
- C:\Windows\System\vlWSoms.exe
  C:\Windows\System\vlWSoms.exe
  2⤵
  PID:7812
- C:\Windows\System\MawgJVj.exe
  C:\Windows\System\MawgJVj.exe
  2⤵
  PID:3952
- C:\Windows\System\GaQUJxo.exe
  C:\Windows\System\GaQUJxo.exe
  2⤵
  PID:4244
- C:\Windows\System\XiULSfr.exe
  C:\Windows\System\XiULSfr.exe
  2⤵
  PID:7860
- C:\Windows\System\jHVpgRY.exe
  C:\Windows\System\jHVpgRY.exe
  2⤵
  PID:4232
- C:\Windows\System\aXSPPbl.exe
  C:\Windows\System\aXSPPbl.exe
  2⤵
  PID:4084
- C:\Windows\System\sHVJrVQ.exe
  C:\Windows\System\sHVJrVQ.exe
  2⤵
  PID:8216
- C:\Windows\System\iekpZwg.exe
  C:\Windows\System\iekpZwg.exe
  2⤵
  PID:8244
- C:\Windows\System\whDaoom.exe
  C:\Windows\System\whDaoom.exe
  2⤵
  PID:8284
- C:\Windows\System\TbYsPtM.exe
  C:\Windows\System\TbYsPtM.exe
  2⤵
  PID:8312
- C:\Windows\System\ytAEFuQ.exe
  C:\Windows\System\ytAEFuQ.exe
  2⤵
  PID:8328
- C:\Windows\System\ZdeHcrl.exe
  C:\Windows\System\ZdeHcrl.exe
  2⤵
  PID:8344
- C:\Windows\System\uPdvAdm.exe
  C:\Windows\System\uPdvAdm.exe
  2⤵
  PID:8400
- C:\Windows\System\qJjQBFd.exe
  C:\Windows\System\qJjQBFd.exe
  2⤵
  PID:8432
- C:\Windows\System\BdvXqmN.exe
  C:\Windows\System\BdvXqmN.exe
  2⤵
  PID:8460
- C:\Windows\System\gYRJmDx.exe
  C:\Windows\System\gYRJmDx.exe
  2⤵
  PID:8488
- C:\Windows\System\tQmGltd.exe
  C:\Windows\System\tQmGltd.exe
  2⤵
  PID:8516
- C:\Windows\System\HmFHNxG.exe
  C:\Windows\System\HmFHNxG.exe
  2⤵
  PID:8544
- C:\Windows\System\TUDYSCA.exe
  C:\Windows\System\TUDYSCA.exe
  2⤵
  PID:8572
- C:\Windows\System\uQOVFWD.exe
  C:\Windows\System\uQOVFWD.exe
  2⤵
  PID:8600
- C:\Windows\System\ytSSIfe.exe
  C:\Windows\System\ytSSIfe.exe
  2⤵
  PID:8628
- C:\Windows\System\SwLXdUL.exe
  C:\Windows\System\SwLXdUL.exe
  2⤵
  PID:8656
- C:\Windows\System\pWIBrMX.exe
  C:\Windows\System\pWIBrMX.exe
  2⤵
  PID:8672
- C:\Windows\System\BOpdlOc.exe
  C:\Windows\System\BOpdlOc.exe
  2⤵
  PID:8704
- C:\Windows\System\rouWGsy.exe
  C:\Windows\System\rouWGsy.exe
  2⤵
  PID:8724
- C:\Windows\System\wsvFxJN.exe
  C:\Windows\System\wsvFxJN.exe
  2⤵
  PID:8760
- C:\Windows\System\WfSKRSb.exe
  C:\Windows\System\WfSKRSb.exe
  2⤵
  PID:8792
- C:\Windows\System\bgDqyva.exe
  C:\Windows\System\bgDqyva.exe
  2⤵
  PID:8828
- C:\Windows\System\SQZtKvI.exe
  C:\Windows\System\SQZtKvI.exe
  2⤵
  PID:8856
- C:\Windows\System\sjhdojD.exe
  C:\Windows\System\sjhdojD.exe
  2⤵
  PID:8884
- C:\Windows\System\gjcncmy.exe
  C:\Windows\System\gjcncmy.exe
  2⤵
  PID:8912
- C:\Windows\System\BFAVHLz.exe
  C:\Windows\System\BFAVHLz.exe
  2⤵
  PID:8940
- C:\Windows\System\sJfdFET.exe
  C:\Windows\System\sJfdFET.exe
  2⤵
  PID:8968
- C:\Windows\System\iASbyTF.exe
  C:\Windows\System\iASbyTF.exe
  2⤵
  PID:8996
- C:\Windows\System\pezzJwZ.exe
  C:\Windows\System\pezzJwZ.exe
  2⤵
  PID:9012
- C:\Windows\System\VtSgHwC.exe
  C:\Windows\System\VtSgHwC.exe
  2⤵
  PID:9032
- C:\Windows\System\IMKPyjU.exe
  C:\Windows\System\IMKPyjU.exe
  2⤵
  PID:9056
- C:\Windows\System\JzKXDlo.exe
  C:\Windows\System\JzKXDlo.exe
  2⤵
  PID:9100
- C:\Windows\System\oRqPZSF.exe
  C:\Windows\System\oRqPZSF.exe
  2⤵
  PID:9124
- C:\Windows\System\qBSPltH.exe
  C:\Windows\System\qBSPltH.exe
  2⤵
  PID:9152
- C:\Windows\System\RBolRnN.exe
  C:\Windows\System\RBolRnN.exe
  2⤵
  PID:9172
- C:\Windows\System\PsyhxzS.exe
  C:\Windows\System\PsyhxzS.exe
  2⤵
  PID:9208
- C:\Windows\System\EMVENbb.exe
  C:\Windows\System\EMVENbb.exe
  2⤵
  PID:8208
- C:\Windows\System\FROtRCy.exe
  C:\Windows\System\FROtRCy.exe
  2⤵
  PID:8268
- C:\Windows\System\QWMwGuD.exe
  C:\Windows\System\QWMwGuD.exe
  2⤵
  PID:8336
- C:\Windows\System\MlETfyv.exe
  C:\Windows\System\MlETfyv.exe
  2⤵
  PID:8420
- C:\Windows\System\AuuHXkI.exe
  C:\Windows\System\AuuHXkI.exe
  2⤵
  PID:8504
- C:\Windows\System\GzgjYBe.exe
  C:\Windows\System\GzgjYBe.exe
  2⤵
  PID:8564
- C:\Windows\System\lpKrFzh.exe
  C:\Windows\System\lpKrFzh.exe
  2⤵
  PID:8624
- C:\Windows\System\rtHCmUS.exe
  C:\Windows\System\rtHCmUS.exe
  2⤵
  PID:8720
- C:\Windows\System\DeKeLSv.exe
  C:\Windows\System\DeKeLSv.exe
  2⤵
  PID:8744
- C:\Windows\System\oOJcMth.exe
  C:\Windows\System\oOJcMth.exe
  2⤵
  PID:8816
- C:\Windows\System\CLgIJVR.exe
  C:\Windows\System\CLgIJVR.exe
  2⤵
  PID:8924
- C:\Windows\System\TwrEKIz.exe
  C:\Windows\System\TwrEKIz.exe
  2⤵
  PID:9044
- C:\Windows\System\wJOIpwz.exe
  C:\Windows\System\wJOIpwz.exe
  2⤵
  PID:9080
- C:\Windows\System\opDYxKE.exe
  C:\Windows\System\opDYxKE.exe
  2⤵
  PID:9116
- C:\Windows\System\OOrIusI.exe
  C:\Windows\System\OOrIusI.exe
  2⤵
  PID:9160
- C:\Windows\System\VkIDRaY.exe
  C:\Windows\System\VkIDRaY.exe
  2⤵
  PID:9192
- C:\Windows\System\XOlFBEw.exe
  C:\Windows\System\XOlFBEw.exe
  2⤵
  PID:8240
- C:\Windows\System\lSnXlJV.exe
  C:\Windows\System\lSnXlJV.exe
  2⤵
  PID:8452
- C:\Windows\System\OsyNpEp.exe
  C:\Windows\System\OsyNpEp.exe
  2⤵
  PID:8528
- C:\Windows\System\yiBIlmK.exe
  C:\Windows\System\yiBIlmK.exe
  2⤵
  PID:8668
- C:\Windows\System\cguRqHQ.exe
  C:\Windows\System\cguRqHQ.exe
  2⤵
  PID:8872
- C:\Windows\System\jfkXnPf.exe
  C:\Windows\System\jfkXnPf.exe
  2⤵
  PID:9196
- C:\Windows\System\FxoTLtS.exe
  C:\Windows\System\FxoTLtS.exe
  2⤵
  PID:8392
- C:\Windows\System\bIHecyj.exe
  C:\Windows\System\bIHecyj.exe
  2⤵
  PID:9220
- C:\Windows\System\OqLTZur.exe
  C:\Windows\System\OqLTZur.exe
  2⤵
  PID:9236
- C:\Windows\System\zxzmvlV.exe
  C:\Windows\System\zxzmvlV.exe
  2⤵
  PID:9264
- C:\Windows\System\qiowqgF.exe
  C:\Windows\System\qiowqgF.exe
  2⤵
  PID:9284
- C:\Windows\System\LaqXRji.exe
  C:\Windows\System\LaqXRji.exe
  2⤵
  PID:9316
- C:\Windows\System\oubXBIr.exe
  C:\Windows\System\oubXBIr.exe
  2⤵
  PID:9336
- C:\Windows\System\WhAYHmy.exe
  C:\Windows\System\WhAYHmy.exe
  2⤵
  PID:9368
- C:\Windows\System\sMuamKe.exe
  C:\Windows\System\sMuamKe.exe
  2⤵
  PID:9404
- C:\Windows\System\BFFAKpJ.exe
  C:\Windows\System\BFFAKpJ.exe
  2⤵
  PID:9444
- C:\Windows\System\SmADVna.exe
  C:\Windows\System\SmADVna.exe
  2⤵
  PID:9464
- C:\Windows\System\Pjmlmuj.exe
  C:\Windows\System\Pjmlmuj.exe
  2⤵
  PID:9504
- C:\Windows\System\PuvWlWA.exe
  C:\Windows\System\PuvWlWA.exe
  2⤵
  PID:9528
- C:\Windows\System\EeJdrGy.exe
  C:\Windows\System\EeJdrGy.exe
  2⤵
  PID:9548
- C:\Windows\System\lbOhWof.exe
  C:\Windows\System\lbOhWof.exe
  2⤵
  PID:9588
- C:\Windows\System\yCVtdIA.exe
  C:\Windows\System\yCVtdIA.exe
  2⤵
  PID:9604
- C:\Windows\System\CDfUwau.exe
  C:\Windows\System\CDfUwau.exe
  2⤵
  PID:9644
- C:\Windows\System\YNmrIJU.exe
  C:\Windows\System\YNmrIJU.exe
  2⤵
  PID:9672
- C:\Windows\System\ooJWKSC.exe
  C:\Windows\System\ooJWKSC.exe
  2⤵
  PID:9700
- C:\Windows\System\DfgVeGR.exe
  C:\Windows\System\DfgVeGR.exe
  2⤵
  PID:9724
- C:\Windows\System\nMaLYNk.exe
  C:\Windows\System\nMaLYNk.exe
  2⤵
  PID:9748
- C:\Windows\System\wUTTPYN.exe
  C:\Windows\System\wUTTPYN.exe
  2⤵
  PID:9772
- C:\Windows\System\JtHlCxK.exe
  C:\Windows\System\JtHlCxK.exe
  2⤵
  PID:9800
- C:\Windows\System\LreIZBk.exe
  C:\Windows\System\LreIZBk.exe
  2⤵
  PID:9828
- C:\Windows\System\dGBfXHg.exe
  C:\Windows\System\dGBfXHg.exe
  2⤵
  PID:9856
- C:\Windows\System\nrlntsD.exe
  C:\Windows\System\nrlntsD.exe
  2⤵
  PID:9884
- C:\Windows\System\ndOhjfa.exe
  C:\Windows\System\ndOhjfa.exe
  2⤵
  PID:9912
- C:\Windows\System\qFoveBm.exe
  C:\Windows\System\qFoveBm.exe
  2⤵
  PID:9940
- C:\Windows\System\ohuZUqG.exe
  C:\Windows\System\ohuZUqG.exe
  2⤵
  PID:9972
- C:\Windows\System\ORHUaXM.exe
  C:\Windows\System\ORHUaXM.exe
  2⤵
  PID:9996
- C:\Windows\System\TuNUbTm.exe
  C:\Windows\System\TuNUbTm.exe
  2⤵
  PID:10024
- C:\Windows\System\FGuTaJy.exe
  C:\Windows\System\FGuTaJy.exe
  2⤵
  PID:10052
- C:\Windows\System\NicDpRs.exe
  C:\Windows\System\NicDpRs.exe
  2⤵
  PID:10080
- C:\Windows\System\QCWpuEo.exe
  C:\Windows\System\QCWpuEo.exe
  2⤵
  PID:10104
- C:\Windows\System\HpyFghl.exe
  C:\Windows\System\HpyFghl.exe
  2⤵
  PID:10120
- C:\Windows\System\QISUHOr.exe
  C:\Windows\System\QISUHOr.exe
  2⤵
  PID:10136
- C:\Windows\System\zKMgtwB.exe
  C:\Windows\System\zKMgtwB.exe
  2⤵
  PID:10156
- C:\Windows\System\TjUkFrh.exe
  C:\Windows\System\TjUkFrh.exe
  2⤵
  PID:10180
- C:\Windows\System\QOgzJnA.exe
  C:\Windows\System\QOgzJnA.exe
  2⤵
  PID:10204
- C:\Windows\System\Ijnpijy.exe
  C:\Windows\System\Ijnpijy.exe
  2⤵
  PID:10228
- C:\Windows\System\Ljjdacq.exe
  C:\Windows\System\Ljjdacq.exe
  2⤵
  PID:9256
- C:\Windows\System\RgqqZGX.exe
  C:\Windows\System\RgqqZGX.exe
  2⤵
  PID:9388
- C:\Windows\System\zlzliuJ.exe
  C:\Windows\System\zlzliuJ.exe
  2⤵
  PID:9432
- C:\Windows\System\UQWmdod.exe
  C:\Windows\System\UQWmdod.exe
  2⤵
  PID:9460
- C:\Windows\System\cJTPnUj.exe
  C:\Windows\System\cJTPnUj.exe
  2⤵
  PID:9584
- C:\Windows\System\IseLwqi.exe
  C:\Windows\System\IseLwqi.exe
  2⤵
  PID:9640
- C:\Windows\System\EgnBvSD.exe
  C:\Windows\System\EgnBvSD.exe
  2⤵
  PID:9684
- C:\Windows\System\MCuEhXJ.exe
  C:\Windows\System\MCuEhXJ.exe
  2⤵
  PID:9764
- C:\Windows\System\xExatdV.exe
  C:\Windows\System\xExatdV.exe
  2⤵
  PID:9820
- C:\Windows\System\HotbAEz.exe
  C:\Windows\System\HotbAEz.exe
  2⤵
  PID:9876
- C:\Windows\System\hIIHqir.exe
  C:\Windows\System\hIIHqir.exe
  2⤵
  PID:9952
- C:\Windows\System\fINgqli.exe
  C:\Windows\System\fINgqli.exe
  2⤵
  PID:10016
- C:\Windows\System\UsjvPBf.exe
  C:\Windows\System\UsjvPBf.exe
  2⤵
  PID:10064
- C:\Windows\System\pBJEtqI.exe
  C:\Windows\System\pBJEtqI.exe
  2⤵
  PID:10100
- C:\Windows\System\htxJPkv.exe
  C:\Windows\System\htxJPkv.exe
  2⤵
  PID:10116
- C:\Windows\System\gxsOgFB.exe
  C:\Windows\System\gxsOgFB.exe
  2⤵
  PID:10188
- C:\Windows\System\eDkwxaU.exe
  C:\Windows\System\eDkwxaU.exe
  2⤵
  PID:8592
- C:\Windows\System\VYuLnfW.exe
  C:\Windows\System\VYuLnfW.exe
  2⤵
  PID:9400
- C:\Windows\System\gtwdPTC.exe
  C:\Windows\System\gtwdPTC.exe
  2⤵
  PID:9628
- C:\Windows\System\BdXtnlJ.exe
  C:\Windows\System\BdXtnlJ.exe
  2⤵
  PID:9784
- C:\Windows\System\LZJRvkK.exe
  C:\Windows\System\LZJRvkK.exe
  2⤵
  PID:9936
- C:\Windows\System\ueeWnqR.exe
  C:\Windows\System\ueeWnqR.exe
  2⤵
  PID:10220
- C:\Windows\System\WqALoEC.exe
  C:\Windows\System\WqALoEC.exe
  2⤵
  PID:8228
- C:\Windows\System\UdQaqzU.exe
  C:\Windows\System\UdQaqzU.exe
  2⤵
  PID:9452
- C:\Windows\System\qvziAvq.exe
  C:\Windows\System\qvziAvq.exe
  2⤵
  PID:9896
- C:\Windows\System\cOBMwDA.exe
  C:\Windows\System\cOBMwDA.exe
  2⤵
  PID:9308
- C:\Windows\System\yXDtiux.exe
  C:\Windows\System\yXDtiux.exe
  2⤵
  PID:10196
- C:\Windows\System\AUgpbwM.exe
  C:\Windows\System\AUgpbwM.exe
  2⤵
  PID:10268
- C:\Windows\System\fpKbzIj.exe
  C:\Windows\System\fpKbzIj.exe
  2⤵
  PID:10284
- C:\Windows\System\UmDFLzW.exe
  C:\Windows\System\UmDFLzW.exe
  2⤵
  PID:10324
- C:\Windows\System\gwMseYW.exe
  C:\Windows\System\gwMseYW.exe
  2⤵
  PID:10344
- C:\Windows\System\eOdpekT.exe
  C:\Windows\System\eOdpekT.exe
  2⤵
  PID:10368
- C:\Windows\System\khGxmAJ.exe
  C:\Windows\System\khGxmAJ.exe
  2⤵
  PID:10400
- C:\Windows\System\cnBkQez.exe
  C:\Windows\System\cnBkQez.exe
  2⤵
  PID:10436
- C:\Windows\System\xoRFCkv.exe
  C:\Windows\System\xoRFCkv.exe
  2⤵
  PID:10468
- C:\Windows\System\GkxMJje.exe
  C:\Windows\System\GkxMJje.exe
  2⤵
  PID:10504
- C:\Windows\System\nEjmCti.exe
  C:\Windows\System\nEjmCti.exe
  2⤵
  PID:10532
- C:\Windows\System\WYjgWrT.exe
  C:\Windows\System\WYjgWrT.exe
  2⤵
  PID:10560
- C:\Windows\System\EZQsdKJ.exe
  C:\Windows\System\EZQsdKJ.exe
  2⤵
  PID:10588
- C:\Windows\System\nBdYSED.exe
  C:\Windows\System\nBdYSED.exe
  2⤵
  PID:10624
- C:\Windows\System\aUclYWx.exe
  C:\Windows\System\aUclYWx.exe
  2⤵
  PID:10644
- C:\Windows\System\gXqVaZs.exe
  C:\Windows\System\gXqVaZs.exe
  2⤵
  PID:10680
- C:\Windows\System\DOHTExs.exe
  C:\Windows\System\DOHTExs.exe
  2⤵
  PID:10696
- C:\Windows\System\lkZNfLg.exe
  C:\Windows\System\lkZNfLg.exe
  2⤵
  PID:10728
- C:\Windows\System\lLwgznX.exe
  C:\Windows\System\lLwgznX.exe
  2⤵
  PID:10760
- C:\Windows\System\eOXZvXe.exe
  C:\Windows\System\eOXZvXe.exe
  2⤵
  PID:10784
- C:\Windows\System\ceklmDu.exe
  C:\Windows\System\ceklmDu.exe
  2⤵
  PID:10828
- C:\Windows\System\JachSbW.exe
  C:\Windows\System\JachSbW.exe
  2⤵
  PID:10848
- C:\Windows\System\niypJBN.exe
  C:\Windows\System\niypJBN.exe
  2⤵
  PID:10872
- C:\Windows\System\bkuktrO.exe
  C:\Windows\System\bkuktrO.exe
  2⤵
  PID:10912
- C:\Windows\System\HYTipnI.exe
  C:\Windows\System\HYTipnI.exe
  2⤵
  PID:10932
- C:\Windows\System\XmMLTou.exe
  C:\Windows\System\XmMLTou.exe
  2⤵
  PID:10968
- C:\Windows\System\cmiOSGk.exe
  C:\Windows\System\cmiOSGk.exe
  2⤵
  PID:10996
- C:\Windows\System\gvUKuaQ.exe
  C:\Windows\System\gvUKuaQ.exe
  2⤵
  PID:11028
- C:\Windows\System\oAVVlZe.exe
  C:\Windows\System\oAVVlZe.exe
  2⤵
  PID:11044
- C:\Windows\System\ChQbvHG.exe
  C:\Windows\System\ChQbvHG.exe
  2⤵
  PID:11076
- C:\Windows\System\mspvjgk.exe
  C:\Windows\System\mspvjgk.exe
  2⤵
  PID:11108
- C:\Windows\System\UnGnJer.exe
  C:\Windows\System\UnGnJer.exe
  2⤵
  PID:11148
- C:\Windows\System\JgKuApH.exe
  C:\Windows\System\JgKuApH.exe
  2⤵
  PID:11164
- C:\Windows\System\galvHfs.exe
  C:\Windows\System\galvHfs.exe
  2⤵
  PID:11196
- C:\Windows\System\RGNdsnv.exe
  C:\Windows\System\RGNdsnv.exe
  2⤵
  PID:11224
- C:\Windows\System\MUXPAHw.exe
  C:\Windows\System\MUXPAHw.exe
  2⤵
  PID:11256
- C:\Windows\System\NpEXENn.exe
  C:\Windows\System\NpEXENn.exe
  2⤵
  PID:10280
- C:\Windows\System\SGYxIEk.exe
  C:\Windows\System\SGYxIEk.exe
  2⤵
  PID:10336
- C:\Windows\System\kTvWFpz.exe
  C:\Windows\System\kTvWFpz.exe
  2⤵
  PID:10412
- C:\Windows\System\xflUJeN.exe
  C:\Windows\System\xflUJeN.exe
  2⤵
  PID:10464
- C:\Windows\System\XLyEcEx.exe
  C:\Windows\System\XLyEcEx.exe
  2⤵
  PID:10520
- C:\Windows\System\BiQOFcE.exe
  C:\Windows\System\BiQOFcE.exe
  2⤵
  PID:10576
- C:\Windows\System\zedaTMD.exe
  C:\Windows\System\zedaTMD.exe
  2⤵
  PID:10664
- C:\Windows\System\YZJVKqU.exe
  C:\Windows\System\YZJVKqU.exe
  2⤵
  PID:10720
- C:\Windows\System\lhqMKlU.exe
  C:\Windows\System\lhqMKlU.exe
  2⤵
  PID:10808
- C:\Windows\System\pWlMXdO.exe
  C:\Windows\System\pWlMXdO.exe
  2⤵
  PID:10896
- C:\Windows\System\lpcsqrU.exe
  C:\Windows\System\lpcsqrU.exe
  2⤵
  PID:10948
- C:\Windows\System\piugaxp.exe
  C:\Windows\System\piugaxp.exe
  2⤵
  PID:11036
- C:\Windows\System\eInWDUh.exe
  C:\Windows\System\eInWDUh.exe
  2⤵
  PID:11104
- C:\Windows\System\cZzEeiA.exe
  C:\Windows\System\cZzEeiA.exe
  2⤵
  PID:11156
- C:\Windows\System\GgBGcia.exe
  C:\Windows\System\GgBGcia.exe
  2⤵
  PID:11236
- C:\Windows\System\rvwPCez.exe
  C:\Windows\System\rvwPCez.exe
  2⤵
  PID:10308
- C:\Windows\System\UMFvsFj.exe
  C:\Windows\System\UMFvsFj.exe
  2⤵
  PID:10428
- C:\Windows\System\AGjCwnF.exe
  C:\Windows\System\AGjCwnF.exe
  2⤵
  PID:10616
- C:\Windows\System\VJNKazK.exe
  C:\Windows\System\VJNKazK.exe
  2⤵
  PID:10844
- C:\Windows\System\mHOrlFt.exe
  C:\Windows\System\mHOrlFt.exe
  2⤵
  PID:10904
- C:\Windows\System\stjkudP.exe
  C:\Windows\System\stjkudP.exe
  2⤵
  PID:10988
- C:\Windows\System\Hvmkpfh.exe
  C:\Windows\System\Hvmkpfh.exe
  2⤵
  PID:11128
- C:\Windows\System\ldWKAEq.exe
  C:\Windows\System\ldWKAEq.exe
  2⤵
  PID:10388
- C:\Windows\System\NcdviRe.exe
  C:\Windows\System\NcdviRe.exe
  2⤵
  PID:10688
- C:\Windows\System\hUFoefJ.exe
  C:\Windows\System\hUFoefJ.exe
  2⤵
  PID:11100
- C:\Windows\System\EkIfkOo.exe
  C:\Windows\System\EkIfkOo.exe
  2⤵
  PID:10652
- C:\Windows\System\XNXbSgV.exe
  C:\Windows\System\XNXbSgV.exe
  2⤵
  PID:11276
- C:\Windows\System\yCJmPSG.exe
  C:\Windows\System\yCJmPSG.exe
  2⤵
  PID:11304
- C:\Windows\System\uNnpxyV.exe
  C:\Windows\System\uNnpxyV.exe
  2⤵
  PID:11332
- C:\Windows\System\bGkMKFk.exe
  C:\Windows\System\bGkMKFk.exe
  2⤵
  PID:11360
- C:\Windows\System\tfSiUWt.exe
  C:\Windows\System\tfSiUWt.exe
  2⤵
  PID:11388
- C:\Windows\System\JUkSkRE.exe
  C:\Windows\System\JUkSkRE.exe
  2⤵
  PID:11436
- C:\Windows\System\XdkuPZJ.exe
  C:\Windows\System\XdkuPZJ.exe
  2⤵
  PID:11456
- C:\Windows\System\ynzkbEK.exe
  C:\Windows\System\ynzkbEK.exe
  2⤵
  PID:11472
- C:\Windows\System\AEyVfoP.exe
  C:\Windows\System\AEyVfoP.exe
  2⤵
  PID:11488
- C:\Windows\System\hcAkCZp.exe
  C:\Windows\System\hcAkCZp.exe
  2⤵
  PID:11528
- C:\Windows\System\YfHlpjX.exe
  C:\Windows\System\YfHlpjX.exe
  2⤵
  PID:11560
- C:\Windows\System\bgvmONe.exe
  C:\Windows\System\bgvmONe.exe
  2⤵
  PID:11584
- C:\Windows\System\wNSdqZx.exe
  C:\Windows\System\wNSdqZx.exe
  2⤵
  PID:11612
- C:\Windows\System\LIneQqG.exe
  C:\Windows\System\LIneQqG.exe
  2⤵
  PID:11640
- C:\Windows\System\klpuQec.exe
  C:\Windows\System\klpuQec.exe
  2⤵
  PID:11668
- C:\Windows\System\MlilVTP.exe
  C:\Windows\System\MlilVTP.exe
  2⤵
  PID:11696
- C:\Windows\System\adSMadz.exe
  C:\Windows\System\adSMadz.exe
  2⤵
  PID:11724
- C:\Windows\System\UgAesrT.exe
  C:\Windows\System\UgAesrT.exe
  2⤵
  PID:11752
- C:\Windows\System\LgDprHf.exe
  C:\Windows\System\LgDprHf.exe
  2⤵
  PID:11768
- C:\Windows\System\otlqYJg.exe
  C:\Windows\System\otlqYJg.exe
  2⤵
  PID:11800
- C:\Windows\System\MNdyCDy.exe
  C:\Windows\System\MNdyCDy.exe
  2⤵
  PID:11824
- C:\Windows\System\gUwcFxJ.exe
  C:\Windows\System\gUwcFxJ.exe
  2⤵
  PID:11844
- C:\Windows\System\YHMsxqr.exe
  C:\Windows\System\YHMsxqr.exe
  2⤵
  PID:11864
- C:\Windows\System\qJDliFX.exe
  C:\Windows\System\qJDliFX.exe
  2⤵
  PID:11896
- C:\Windows\System\AaHeZqM.exe
  C:\Windows\System\AaHeZqM.exe
  2⤵
  PID:11924
- C:\Windows\System\eptyFAN.exe
  C:\Windows\System\eptyFAN.exe
  2⤵
  PID:11988
- C:\Windows\System\nwRyqTs.exe
  C:\Windows\System\nwRyqTs.exe
  2⤵
  PID:12004
- C:\Windows\System\uSaQSpm.exe
  C:\Windows\System\uSaQSpm.exe
  2⤵
  PID:12028
- C:\Windows\System\OeBqbnA.exe
  C:\Windows\System\OeBqbnA.exe
  2⤵
  PID:12044
- C:\Windows\System\ZjraQZn.exe
  C:\Windows\System\ZjraQZn.exe
  2⤵
  PID:12080
- C:\Windows\System\CWrHvEP.exe
  C:\Windows\System\CWrHvEP.exe
  2⤵
  PID:12128
- C:\Windows\System\ucjutoq.exe
  C:\Windows\System\ucjutoq.exe
  2⤵
  PID:12160
- C:\Windows\System\PKneSHj.exe
  C:\Windows\System\PKneSHj.exe
  2⤵
  PID:12176
- C:\Windows\System\VXLuQZf.exe
  C:\Windows\System\VXLuQZf.exe
  2⤵
  PID:12220
- C:\Windows\System\yNTxuEh.exe
  C:\Windows\System\yNTxuEh.exe
  2⤵
  PID:12248
- C:\Windows\System\yzeqGke.exe
  C:\Windows\System\yzeqGke.exe
  2⤵
  PID:12284
- C:\Windows\System\AOhmnjl.exe
  C:\Windows\System\AOhmnjl.exe
  2⤵
  PID:11300
- C:\Windows\System\oCqxuDm.exe
  C:\Windows\System\oCqxuDm.exe
  2⤵
  PID:11344
- C:\Windows\System\FgDSjpr.exe
  C:\Windows\System\FgDSjpr.exe
  2⤵
  PID:11404
- C:\Windows\System\vZmuTJN.exe
  C:\Windows\System\vZmuTJN.exe
  2⤵
  PID:11524
- C:\Windows\System\uIXRNla.exe
  C:\Windows\System\uIXRNla.exe
  2⤵
  PID:11512
- C:\Windows\System\fevqFbz.exe
  C:\Windows\System\fevqFbz.exe
  2⤵
  PID:11632
- C:\Windows\System\eDKhwdw.exe
  C:\Windows\System\eDKhwdw.exe
  2⤵
  PID:11688
- C:\Windows\System\LktXBoI.exe
  C:\Windows\System\LktXBoI.exe
  2⤵
  PID:11744
- C:\Windows\System\DjlGrsV.exe
  C:\Windows\System\DjlGrsV.exe
  2⤵
  PID:11836
- C:\Windows\System\fLJCKpQ.exe
  C:\Windows\System\fLJCKpQ.exe
  2⤵
  PID:11856
- C:\Windows\System\EhMvICF.exe
  C:\Windows\System\EhMvICF.exe
  2⤵
  PID:11952
- C:\Windows\System\amouedu.exe
  C:\Windows\System\amouedu.exe
  2⤵
  PID:12052
- C:\Windows\System\UHpsYbd.exe
  C:\Windows\System\UHpsYbd.exe
  2⤵
  PID:12204
- C:\Windows\System\ZmWVUEb.exe
  C:\Windows\System\ZmWVUEb.exe
  2⤵
  PID:10340
- C:\Windows\System\wRbsVeO.exe
  C:\Windows\System\wRbsVeO.exe
  2⤵
  PID:11444
- C:\Windows\System\eJQlvlu.exe
  C:\Windows\System\eJQlvlu.exe
  2⤵
  PID:11596
- C:\Windows\System\TAFWRxa.exe
  C:\Windows\System\TAFWRxa.exe
  2⤵
  PID:10708
- C:\Windows\System\dGwcheq.exe
  C:\Windows\System\dGwcheq.exe
  2⤵
  PID:12040
- C:\Windows\System\ljhdFmk.exe
  C:\Windows\System\ljhdFmk.exe
  2⤵
  PID:12236
- C:\Windows\System\Lwqlzor.exe
  C:\Windows\System\Lwqlzor.exe
  2⤵
  PID:11624
- C:\Windows\System\xYeuRcj.exe
  C:\Windows\System\xYeuRcj.exe
  2⤵
  PID:11376
- C:\Windows\System\paEPKNF.exe
  C:\Windows\System\paEPKNF.exe
  2⤵
  PID:12312
- C:\Windows\System\oWDMPqH.exe
  C:\Windows\System\oWDMPqH.exe
  2⤵
  PID:12336
- C:\Windows\System\bFgWyKC.exe
  C:\Windows\System\bFgWyKC.exe
  2⤵
  PID:12364
- C:\Windows\System\ChOudiY.exe
  C:\Windows\System\ChOudiY.exe
  2⤵
  PID:12392
- C:\Windows\System\YmEGayO.exe
  C:\Windows\System\YmEGayO.exe
  2⤵
  PID:12420
- C:\Windows\System\rhFaoaQ.exe
  C:\Windows\System\rhFaoaQ.exe
  2⤵
  PID:12456
- C:\Windows\System\gcaDfcH.exe
  C:\Windows\System\gcaDfcH.exe
  2⤵
  PID:12480
- C:\Windows\System\HoDXWAz.exe
  C:\Windows\System\HoDXWAz.exe
  2⤵
  PID:12504
- C:\Windows\System\eNkBtNA.exe
  C:\Windows\System\eNkBtNA.exe
  2⤵
  PID:12540
- C:\Windows\System\hkwvKsQ.exe
  C:\Windows\System\hkwvKsQ.exe
  2⤵
  PID:12568
- C:\Windows\System\MfTYyvE.exe
  C:\Windows\System\MfTYyvE.exe
  2⤵
  PID:12596
- C:\Windows\System\BBChFsk.exe
  C:\Windows\System\BBChFsk.exe
  2⤵
  PID:12644
- C:\Windows\System\BThYuup.exe
  C:\Windows\System\BThYuup.exe
  2⤵
  PID:12696
- C:\Windows\System\fZmEsbx.exe
  C:\Windows\System\fZmEsbx.exe
  2⤵
  PID:12724
- C:\Windows\System\ZNVxlYk.exe
  C:\Windows\System\ZNVxlYk.exe
  2⤵
  PID:12740
- C:\Windows\System\vviPGLc.exe
  C:\Windows\System\vviPGLc.exe
  2⤵
  PID:12764
- C:\Windows\System\TMlcfcL.exe
  C:\Windows\System\TMlcfcL.exe
  2⤵
  PID:12808
- C:\Windows\System\TvpfuKF.exe
  C:\Windows\System\TvpfuKF.exe
  2⤵
  PID:12840
- C:\Windows\System\WLDJMYu.exe
  C:\Windows\System\WLDJMYu.exe
  2⤵
  PID:12864
- C:\Windows\System\TxQpmmV.exe
  C:\Windows\System\TxQpmmV.exe
  2⤵
  PID:12896
- C:\Windows\System\scXRbJT.exe
  C:\Windows\System\scXRbJT.exe
  2⤵
  PID:12920
- C:\Windows\System\dtoNrzI.exe
  C:\Windows\System\dtoNrzI.exe
  2⤵
  PID:12944
- C:\Windows\System\dKbMiFH.exe
  C:\Windows\System\dKbMiFH.exe
  2⤵
  PID:12988
- C:\Windows\System\JYYxNDE.exe
  C:\Windows\System\JYYxNDE.exe
  2⤵
  PID:13016
- C:\Windows\System\bYYvWWw.exe
  C:\Windows\System\bYYvWWw.exe
  2⤵
  PID:13036
- C:\Windows\System\KonigBy.exe
  C:\Windows\System\KonigBy.exe
  2⤵
  PID:13072
- C:\Windows\System\toUOoAh.exe
  C:\Windows\System\toUOoAh.exe
  2⤵
  PID:13096
- C:\Windows\System\VqFrwIK.exe
  C:\Windows\System\VqFrwIK.exe
  2⤵
  PID:13116
- C:\Windows\System\VUaCAir.exe
  C:\Windows\System\VUaCAir.exe
  2⤵
  PID:13136
- C:\Windows\System\NvXYAWg.exe
  C:\Windows\System\NvXYAWg.exe
  2⤵
  PID:13168
- C:\Windows\System\HuSiLxW.exe
  C:\Windows\System\HuSiLxW.exe
  2⤵
  PID:13188
- C:\Windows\System\JwFNCuS.exe
  C:\Windows\System\JwFNCuS.exe
  2⤵
  PID:13216
- C:\Windows\System\udDgoil.exe
  C:\Windows\System\udDgoil.exe
  2⤵
  PID:13232
- C:\Windows\System\ThnDwdr.exe
  C:\Windows\System\ThnDwdr.exe
  2⤵
  PID:13256
- C:\Windows\System\CxHwyiI.exe
  C:\Windows\System\CxHwyiI.exe
  2⤵
  PID:13276
- C:\Windows\System\NpyrENH.exe
  C:\Windows\System\NpyrENH.exe
  2⤵
  PID:12332
- C:\Windows\System\aIasIuU.exe
  C:\Windows\System\aIasIuU.exe
  2⤵
  PID:12468
- C:\Windows\System\SSsNotZ.exe
  C:\Windows\System\SSsNotZ.exe
  2⤵
  PID:12500
- C:\Windows\System\ZBDCdfQ.exe
  C:\Windows\System\ZBDCdfQ.exe
  2⤵
  PID:12580
- C:\Windows\System\bOayLVI.exe
  C:\Windows\System\bOayLVI.exe
  2⤵
  PID:12704
- C:\Windows\System\IyEcyOc.exe
  C:\Windows\System\IyEcyOc.exe
  2⤵
  PID:12776
- C:\Windows\System\LfcCNiF.exe
  C:\Windows\System\LfcCNiF.exe
  2⤵
  PID:12788
- C:\Windows\System\OYeONeB.exe
  C:\Windows\System\OYeONeB.exe
  2⤵
  PID:12828
- C:\Windows\System\ckEAudM.exe
  C:\Windows\System\ckEAudM.exe
  2⤵
  PID:12912
- C:\Windows\System\wpyIgmW.exe
  C:\Windows\System\wpyIgmW.exe
  2⤵
  PID:13000
- C:\Windows\System\ytAaSes.exe
  C:\Windows\System\ytAaSes.exe
  2⤵
  PID:13064
- C:\Windows\System\siwqtwA.exe
  C:\Windows\System\siwqtwA.exe
  2⤵
  PID:13128
- C:\Windows\System\fFYPLfA.exe
  C:\Windows\System\fFYPLfA.exe
  2⤵
  PID:13208
- C:\Windows\System\yYMIsxa.exe
  C:\Windows\System\yYMIsxa.exe
  2⤵
  PID:13244
- C:\Windows\System\cHnApOS.exe
  C:\Windows\System\cHnApOS.exe
  2⤵
  PID:12304
- C:\Windows\System\CQpUcGY.exe
  C:\Windows\System\CQpUcGY.exe
  2⤵
  PID:12536
- C:\Windows\System\UbcmzKC.exe
  C:\Windows\System\UbcmzKC.exe
  2⤵
  PID:12684
- C:\Windows\System\aWVAIEX.exe
  C:\Windows\System\aWVAIEX.exe
  2⤵
  PID:12904
- C:\Windows\System\sdBFXjz.exe
  C:\Windows\System\sdBFXjz.exe
  2⤵
  PID:13024
- C:\Windows\System\yQwGkFZ.exe
  C:\Windows\System\yQwGkFZ.exe
  2⤵
  PID:13160
- C:\Windows\System\XfNqhjp.exe
  C:\Windows\System\XfNqhjp.exe
  2⤵
  PID:12356
- C:\Windows\System\OikLZLO.exe
  C:\Windows\System\OikLZLO.exe
  2⤵
  PID:11600
- C:\Windows\System\cTbPJbK.exe
  C:\Windows\System\cTbPJbK.exe
  2⤵
  PID:12908
- C:\Windows\System\OkIJbxJ.exe
  C:\Windows\System\OkIJbxJ.exe
  2⤵
  PID:12272
- C:\Windows\System\JKAVVgO.exe
  C:\Windows\System\JKAVVgO.exe
  2⤵
  PID:12632
- C:\Windows\System\KjkLlxP.exe
  C:\Windows\System\KjkLlxP.exe
  2⤵
  PID:13324
- C:\Windows\System\jUTPBRi.exe
  C:\Windows\System\jUTPBRi.exe
  2⤵
  PID:13348
- C:\Windows\System\iLlheYo.exe
  C:\Windows\System\iLlheYo.exe
  2⤵
  PID:13380
- C:\Windows\System\vcYcdQC.exe
  C:\Windows\System\vcYcdQC.exe
  2⤵
  PID:13428
- C:\Windows\System\CblDzFB.exe
  C:\Windows\System\CblDzFB.exe
  2⤵
  PID:13444
- C:\Windows\System\IokjimF.exe
  C:\Windows\System\IokjimF.exe
  2⤵
  PID:13472
- C:\Windows\System\oVYdYaA.exe
  C:\Windows\System\oVYdYaA.exe
  2⤵
  PID:13488
- C:\Windows\System\cLBTehi.exe
  C:\Windows\System\cLBTehi.exe
  2⤵
  PID:13512
- C:\Windows\System\jRbfQrx.exe
  C:\Windows\System\jRbfQrx.exe
  2⤵
  PID:13548
- C:\Windows\System\ptjbpTk.exe
  C:\Windows\System\ptjbpTk.exe
  2⤵
  PID:13572
- C:\Windows\System\PRUoodd.exe
  C:\Windows\System\PRUoodd.exe
  2⤵
  PID:13608
- C:\Windows\System\XpwosQk.exe
  C:\Windows\System\XpwosQk.exe
  2⤵
  PID:13632
- C:\Windows\System\AIqvzOf.exe
  C:\Windows\System\AIqvzOf.exe
  2⤵
  PID:13660
- C:\Windows\System\IIGrUOd.exe
  C:\Windows\System\IIGrUOd.exe
  2⤵
  PID:13696
- C:\Windows\System\rDkDhqR.exe
  C:\Windows\System\rDkDhqR.exe
  2⤵
  PID:13736
- C:\Windows\System\ulPtRMr.exe
  C:\Windows\System\ulPtRMr.exe
  2⤵
  PID:13764
- C:\Windows\System\tmYNpXF.exe
  C:\Windows\System\tmYNpXF.exe
  2⤵
  PID:13792
- C:\Windows\System\tcHeZeW.exe
  C:\Windows\System\tcHeZeW.exe
  2⤵
  PID:13820
- C:\Windows\System\TBAUCvp.exe
  C:\Windows\System\TBAUCvp.exe
  2⤵
  PID:13848
- C:\Windows\System\hHkAzWb.exe
  C:\Windows\System\hHkAzWb.exe
  2⤵
  PID:13864
- C:\Windows\System\LgkAABD.exe
  C:\Windows\System\LgkAABD.exe
  2⤵
  PID:13888
- C:\Windows\System\yAMPkge.exe
  C:\Windows\System\yAMPkge.exe
  2⤵
  PID:13924
- C:\Windows\System\DViUtBj.exe
  C:\Windows\System\DViUtBj.exe
  2⤵
  PID:13948
- C:\Windows\System\PBUEhsx.exe
  C:\Windows\System\PBUEhsx.exe
  2⤵
  PID:13968
- C:\Windows\System\ZaLzPmQ.exe
  C:\Windows\System\ZaLzPmQ.exe
  2⤵
  PID:13992
- C:\Windows\System\pgyYhhY.exe
  C:\Windows\System\pgyYhhY.exe
  2⤵
  PID:14016
- C:\Windows\System\qddlwGp.exe
  C:\Windows\System\qddlwGp.exe
  2⤵
  PID:14044
- C:\Windows\System\QIcovwj.exe
  C:\Windows\System\QIcovwj.exe
  2⤵
  PID:14080
- C:\Windows\System\PAkBbKl.exe
  C:\Windows\System\PAkBbKl.exe
  2⤵
  PID:14124
- C:\Windows\System\cAMQTdL.exe
  C:\Windows\System\cAMQTdL.exe
  2⤵
  PID:14140
- C:\Windows\System\ofRrzEK.exe
  C:\Windows\System\ofRrzEK.exe
  2⤵
  PID:14168
- C:\Windows\System\AGHwSuO.exe
  C:\Windows\System\AGHwSuO.exe
  2⤵
  PID:14200
- C:\Windows\System\aFVfGKP.exe
  C:\Windows\System\aFVfGKP.exe
  2⤵
  PID:14224
- C:\Windows\System\gOhEesK.exe
  C:\Windows\System\gOhEesK.exe
  2⤵
  PID:14268
- C:\Windows\System\vYaqBBw.exe
  C:\Windows\System\vYaqBBw.exe
  2⤵
  PID:14292
- C:\Windows\System\OqseSZr.exe
  C:\Windows\System\OqseSZr.exe
  2⤵
  PID:14320
- C:\Windows\System\rIbDbhh.exe
  C:\Windows\System\rIbDbhh.exe
  2⤵
  PID:13252
- C:\Windows\System\KUqjjvd.exe
  C:\Windows\System\KUqjjvd.exe
  2⤵
  PID:13344
- C:\Windows\System\Mynlxhu.exe
  C:\Windows\System\Mynlxhu.exe
  2⤵
  PID:13408
- C:\Windows\System\ynerIIw.exe
  C:\Windows\System\ynerIIw.exe
  2⤵
  PID:13500
- C:\Windows\System\nyOYMmg.exe
  C:\Windows\System\nyOYMmg.exe
  2⤵
  PID:13528
- C:\Windows\System\UCoWRSb.exe
  C:\Windows\System\UCoWRSb.exe
  2⤵
  PID:13600
- C:\Windows\System\hubxLyp.exe
  C:\Windows\System\hubxLyp.exe
  2⤵
  PID:13672
- C:\Windows\System\HHxJeig.exe
  C:\Windows\System\HHxJeig.exe
  2⤵
  PID:4064
- C:\Windows\System\YAHukTt.exe
  C:\Windows\System\YAHukTt.exe
  2⤵
  PID:4788
- C:\Windows\System\DZShOwA.exe
  C:\Windows\System\DZShOwA.exe
  2⤵
  PID:13752
- C:\Windows\System\zMFZMtQ.exe
  C:\Windows\System\zMFZMtQ.exe
  2⤵
  PID:13840
- C:\Windows\System\KGhtELY.exe
  C:\Windows\System\KGhtELY.exe
  2⤵
  PID:13880
- C:\Windows\System\gOGSxlt.exe
  C:\Windows\System\gOGSxlt.exe
  2⤵
  PID:13932
- C:\Windows\System\UGsnIkB.exe
  C:\Windows\System\UGsnIkB.exe
  2⤵
  PID:13984
- C:\Windows\System\ENQRYKu.exe
  C:\Windows\System\ENQRYKu.exe
  2⤵
  PID:14092
- C:\Windows\System\PwZLOZo.exe
  C:\Windows\System\PwZLOZo.exe
  2⤵
  PID:14136
- C:\Windows\System\zkTXfkq.exe
  C:\Windows\System\zkTXfkq.exe
  2⤵
  PID:14208
- C:\Windows\System\HJMhMBS.exe
  C:\Windows\System\HJMhMBS.exe
  2⤵
  PID:14332
- C:\Windows\System\XYzxXph.exe
  C:\Windows\System\XYzxXph.exe
  2⤵
  PID:13404
- C:\Windows\System\HKihSgJ.exe
  C:\Windows\System\HKihSgJ.exe
  2⤵
  PID:1108
- C:\Windows\System\UeqNYZR.exe
  C:\Windows\System\UeqNYZR.exe
  2⤵
  PID:4484
- C:\Windows\System\yfMcZWZ.exe
  C:\Windows\System\yfMcZWZ.exe
  2⤵
  PID:13676
- C:\Windows\System\njUYjAD.exe
  C:\Windows\System\njUYjAD.exe
  2⤵
  PID:13720
- C:\Windows\System\OHHqrZv.exe
  C:\Windows\System\OHHqrZv.exe
  2⤵
  PID:13964
- C:\Windows\System\RRUwmQt.exe
  C:\Windows\System\RRUwmQt.exe
  2⤵
  PID:14076
- C:\Windows\System\dmwJOfM.exe
  C:\Windows\System\dmwJOfM.exe
  2⤵
  PID:14308
- C:\Windows\System\IWGmeVg.exe
  C:\Windows\System\IWGmeVg.exe
  2⤵
  PID:13360
- C:\Windows\System\gQChBpH.exe
  C:\Windows\System\gQChBpH.exe
  2⤵
  PID:13564
- C:\Windows\System\GgJtPnj.exe
  C:\Windows\System\GgJtPnj.exe
  2⤵
  PID:13808
- C:\Windows\System\nxCYCJd.exe
  C:\Windows\System\nxCYCJd.exe
  2⤵
  PID:13876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CTWytFW.exe

Filesize
1.9MB

MD5
d6a0d4f1baaf60a5a5b73c2e895601ba

SHA1
a492c0e6e987f9d3f22cb84ac163ce3bb5427698

SHA256
775c71beaa477f212d832ebda56cc3b811486a646afa49baff0e53fa2865e028

SHA512
75041b5ed26671ea18c7f6663f246e6230cae7dee128851774ebe09d7fcae8fc04d04b7479dada443de492014787871aa7dd3f774f7b719d403f4a53ba84acec

Download Submit
C:\Windows\System\FMaajHc.exe

Filesize
1.9MB

MD5
d8888552f05b59108e74e86ee51f4a10

SHA1
ca6013ef417fdf656e11b380a1a2ef4599f6d0eb

SHA256
3bdce368b700ec32b811518ed358e0f7bda067d916d78940524ca23154518413

SHA512
2c24f83f4bb19075f6d0f80bdc8c2622a19a98f30dffbf9ec0948896eaa3e741ddc7d15f24cdb031b5f8aeee6986b39b9f23fefc0ebd2e60dbc4ce0b9ce2c462

Download Submit
C:\Windows\System\FQyNrzS.exe

Filesize
1.9MB

MD5
bce42721e54631edd7598f79796cec5a

SHA1
2dd389f620db98c04a48f735b575778cef0e7530

SHA256
03510b9bbfbd18d995b9151ee26b1fc252cc5a3daeb6edeab57870dabb4c74ec

SHA512
d1bcfab92c5b8ca14d2c9dceeffd7d7c1841494e82426c8d7efacdd963cd9fb2f1007a337aa5cfb17fc6bd2033e0031507c140b4477dc3d6cac564c97823f00a

Download Submit
C:\Windows\System\IzabJTH.exe

Filesize
1.9MB

MD5
8b00ced1e2ee9c38f4dd8e04491b7ade

SHA1
834985c1b7bd55561a43ef7c5779f1cb756d3904

SHA256
ef17641177c69eebb8299a0781c3af48f05d055d654b419d2e880b8cdc87da0d

SHA512
6e979e94bf96f102791298ee25dceaa6f8be8fa17735743ef2b0e843edf42e33ac1fda8ef559a832f10ceccb7e7c4bf2ca90408581d5bc567a65ba17f4c8f125

Download Submit
C:\Windows\System\LCzdbDj.exe

Filesize
1.9MB

MD5
4424ce0d246c7e03d82edd78bd693521

SHA1
7e5a60617abd8c9531883b343f1c0bf5cb9400b4

SHA256
422d7ca298ed6e56beddf7d83a1ee64579de89f4a131de8780962f7823285eee

SHA512
c07f523cf50ad5937183cdf32041ac1360a42d406c5c4b8b30ce0dc35ba803451b6494df84552076f10d8d510a84be6acc9d99d0ef009f4389ceafdfcef760f7

Download Submit
C:\Windows\System\NEcbwef.exe

Filesize
1.9MB

MD5
af65d6f61c20ae12933e173b9567e661

SHA1
e08c52d90310acae0862ac6db6b12c4c154d17b3

SHA256
d1e5dbf17dec905e40222e912978b7f023f31f7f511183d9977b1447384279f1

SHA512
9a701852d1aace02be55d0a3d4cb5d63dbd6bbff1e7d30255034d4fdcb68d73203c795e84b2720ddda9a70e7abd82e24769b85244af914a15734e544274cde20

Download Submit
C:\Windows\System\OycEVJO.exe

Filesize
1.9MB

MD5
204476efa1600307af24efcb14d7da55

SHA1
68ac4b5db2a9af7b77fb00e87ffcf34ffb6eb40b

SHA256
261cc36071f99d44a494acec5ebcf2d3ca3b81e12fbb7160f583d47e530cf264

SHA512
962fb69aeacdb4acff9e9832fbd559b2be49e92651467d40d279a7cac3a525ec88831f95aee4aee514c90299cddc55c7a2104dc59519a53f9a0cfe06207ed031

Download Submit
C:\Windows\System\QMwSOVz.exe

Filesize
1.8MB

MD5
30210fa7c3d4d4fe9073f0bd39b81f88

SHA1
9e96938bb58b8db700b22212961ca37dc3f738c4

SHA256
7df505bcf20492bb65b391968d6fd17befd17fd9d73f752b40ab6eaa3cafe93e

SHA512
8a82d8032b21083e04f4243bf1ba4a90f0316459399a79601100d0b047d8a4418d398d636d7c47ba674e57f40e83ab3d75ed8134ceed860e77d97fd53efa3e07

Download Submit
C:\Windows\System\QkmPDca.exe

Filesize
1.9MB

MD5
f5ac61b1b51c05fc0338aaec4aa5e2d2

SHA1
ef63a2f36c6b9f31aa4a2da07154a7b3581aa1e8

SHA256
52678f12a2b8615e43361f290a9e66020a846afdd173ed8ff481ee05d91165da

SHA512
4495c9af4c2b2410d2cbcad62602029fab17e712ed7e1576585a39b138536c5f3316db9f8fe77f4275f2c5bfb5464ef5640c818975d4821a4c5b06228766a535

Download Submit
C:\Windows\System\SyjfaXH.exe

Filesize
1.9MB

MD5
8f0e3028341ca879d7c680a6358be246

SHA1
0432922bc893cc79b37c27c5c570ab809a8acaba

SHA256
b04477d3227d928a846d6ab6f7bede696e6e0ab675fd1bfc43056183085b585c

SHA512
3588e703d0a5610ec8c1af85152d2c2636b6985280d0519803f190ebc3ecdeb66fc14061d73cb613cb5ce0c9d3a592d4338591fe5896cfba5b848da19d0ae9c9

Download Submit
C:\Windows\System\TndYRog.exe

Filesize
1.9MB

MD5
10317b47feb5fd8674486f0060801385

SHA1
fc6bb58c057ac8605e9ad0fc8eede8f766697f05

SHA256
7af9ba26098bf2dfe0358d432373525f4a6276e0929765aa3bd1e8cf9547a427

SHA512
3cce6975cb138e003225b3e2a3860b3ef3bfe643da5b8d130557867123e9d7df03307baec1241abbc182ab36c02cb3bc0f75d90c6d998df7624ffc48d1f137d9

Download Submit
C:\Windows\System\UvFVtte.exe

Filesize
1.9MB

MD5
afda56f0b7cd447357637cefb0a8cc1e

SHA1
8b9b9eabe53364e4a47655b013533beb7ba2e0a9

SHA256
3434190336edcae311f145ba19bdc82244536025116bb5c25c422cd437fd0b7a

SHA512
22238f1ea25e7a957880c88ef51324a402228a9b82322bcafae0421dd447fd3c652344f7887c6245f328945e0bca7aee3d2ef12b6d503f552b2e2ef4fa37927c

Download Submit
C:\Windows\System\ZwINkzQ.exe

Filesize
1.9MB

MD5
c2d1bbe56e54f09c8d66759f0e2c0de2

SHA1
dc8a5ccb6573a1ee7f5cafaf3ff4a4ca9ce233aa

SHA256
10f86de3d0e47aff60ec2d84a9205bb298d5fe5c2016abe905d783b614e7e069

SHA512
dc77baf9e2ba85de5460358da0ddef62fe352fc0f30c965c1d7c18698f7eccd95d853017f787aea209e619e44d32de4b607c3df8e96cba145500590f35dcebf9

Download Submit
C:\Windows\System\aFiLDmu.exe

Filesize
1.9MB

MD5
dcf90bd0fa2f3bb6c74a5dc3e80f95c7

SHA1
ea68f31976079fd329df38ef403e51a7ee770947

SHA256
185f92b3c9a488869d6da937a0459c7ea59a3fe031943731714086bcdf2a39d6

SHA512
d40b5ddd267b1dfda5519926d16d0216915dcaa1411495876f06c3b800f898e2da12ee84b5932ca266a5b9ff7438c485eb331bd7070856dfa846404820e0f4ec

Download Submit
C:\Windows\System\aqZTnIU.exe

Filesize
1.9MB

MD5
3d918f377bfbe701c1752545b6568302

SHA1
64b3d0ac6c309760335cf77279786f1b470da170

SHA256
d24900597a615c2aea0a704056367dc7d4e9a9e27fce128e0441390ace80df2f

SHA512
4b2be031e46005e523e506d52f55ad110780e7969c4df7d226125dd36d25880634aee2fac7962b2d950e336a504d69e124b7ccbd0d69553a1bc04eff0d84eb07

Download Submit
C:\Windows\System\bPMHcqi.exe

Filesize
1.9MB

MD5
db781b37d691a9dd8b2dd153f1c3331e

SHA1
fbc96deee8e73790ded48b3a2a1478da2cd0e76c

SHA256
dfc2d1273083720b547f00f494e14461b36bf68ba66c671ec287a02724a20789

SHA512
4f9c98bc056b9064990a6a596158b08974157ae008040ef0588da5abdc1118f5e8128a0883020c3291a413c0d161e97b6c9149cda880c0740738169765940577

Download Submit
C:\Windows\System\bVhEIgr.exe

Filesize
1.9MB

MD5
7e1f8c5f57d3a7e09460d5956470a784

SHA1
125afcda66548e92f9e25d9f2f538da6dcf2d2c9

SHA256
5191338e22ed43e06ba0eaa0e3bd2828fafa71f5898c38fca775a7c9941a42e3

SHA512
803f7e1b3df11cbee0160435cf6e658725f49a91360ef816f2067836109398655f8dba2dd7b4641d46668e0eb72f901d7684858111e844b6c987c00c8e20523e

Download Submit
C:\Windows\System\bsGBsmx.exe

Filesize
1.8MB

MD5
569fd4cec59878e9e8981a1f3b7ae9c4

SHA1
cba91fbd735a69e785837f2d314fdec9c3687112

SHA256
9c3e67a28eb2b4c05cb23465c8fb6f8dff27f567e97bc79b050ddcf3b6c1b76a

SHA512
11bb28935931b2a0d13b6a6c358a9b1f46d540a89458dfeecfd3ead9964339ed7fb6d23fe38ecb07a5a18523b7004449df860b96e2853d0b0b3b631cf47d9488

Download Submit
C:\Windows\System\bwSAPZl.exe

Filesize
1.9MB

MD5
2a8ace5daaa9019403c71c9f2ffb89c2

SHA1
67db0a088a39415ecb25f56c9155c7b41d5429b6

SHA256
b9c341c4fee0f502be97728df52cee5224a162a70201346294d29095f48f5b3d

SHA512
586e3bdae6dfcda9d4d0deadc08885d2a762f6a34ea09332e8f2ade42681dfe9c93bcbae9cfcea1b6745a9a343d40280cbb8e65469fd92e704b1296fe7335ec1

Download Submit
C:\Windows\System\chFGCrT.exe

Filesize
1.9MB

MD5
56cda6a7b39a3cc938fdaf777fd30e05

SHA1
bcf86aa4477ca6a0ae6f6c8d098b80afd4654a59

SHA256
516ac1ba64f7c0ef9f984cf0659a30c7f19fe7f06939658544a3c9a37ae0f611

SHA512
ee4663985534674feee2c154f6db9511f71296ddd9b436eff28c7c9e1bdb44afbd06d66e722a4ea9f4210acc36561f81d43b73e652961415fe0240a0fd71bbad

Download Submit
C:\Windows\System\dofKRfy.exe

Filesize
1.9MB

MD5
8039cb943af8fe035d90e06b4c676794

SHA1
c46990af0c06ced9f8ddeccf562ba48cace483fc

SHA256
21c8cd87b026156edeef6dd7113c2fb370422b8e725de30d0c920a4e183684f8

SHA512
f25edf19188e7dbbdaf4574637f36c1db8d4d6edad76ad9ffc2594d3872273d0a59cdda589367a3b066c0329bb60b05b1b4e76b77f1a19ff963cb3a9a1725c0f

Download Submit
C:\Windows\System\hIwSjMW.exe

Filesize
1.9MB

MD5
0f573e2ab64663785c909f56ca16f063

SHA1
087b26582c43f6543d0f13454177093b912ef7b3

SHA256
8a30fee021d920752df54f5f4d3d0a2358264058fddcc3300b9d8f695c7379bf

SHA512
15df57042acc4ebd3d75c2c069feedf72b4e55d1136d8b882b062f6d1a7bf5550ea643b5bc297d93f482f614fb91e937d68bab5ac7c005e0c4b040712cdd2fab

Download Submit
C:\Windows\System\ilVQTtj.exe

Filesize
1.9MB

MD5
94be7011ad5d597de65079e5aa9d4024

SHA1
3d1f701906e5a7ddc0ba91c01106a9dfa54e6850

SHA256
eb2d7a7b39ad0a40943a533102e63caa36746d001b7b993f2cf21394d28a4f98

SHA512
a9c6dfd5044b2241c19301954cbbc11bd59b9d5db33dcd201830f6e703394e92bbc367ccdc36b6d23f10fd6c51214be05c01d46346e1571a5e4978246fbe1dd5

Download Submit
C:\Windows\System\jihcQVv.exe

Filesize
1.9MB

MD5
4ece56b8a808b844834cede6fda700c6

SHA1
a0adb7d75270096810b2059ab7f6edc5b6ef7b30

SHA256
21b543230dd5b1dd798822c5ae2560c22c68e1c17b008b56d94432106527777e

SHA512
75ae69adf4337abd8e9765e60f746309a2e72c67e607a66d582d838e3b2d19112f25e7e361a0c58dc724afde25627ad53780302f3dca442e96fc2676f11e22e5

Download Submit
C:\Windows\System\kJvsRTP.exe

Filesize
1.8MB

MD5
e96ac1a598b8a775ef0cd18931c6f3b9

SHA1
37d0730efa26b3d7514460d2cd7329aa875acae5

SHA256
c23fcfbe6e3f1f8828370aefd8781cf0976033d9928bcc21e06ad3776c19bedb

SHA512
4408d226515264a18aba6ad776dd9a12270481287a6bcbeffbc354268651b9a517963673e1d63dd3d2be35128b9869caf88c647db720206f7bbe9e77fafe4a48

Download Submit
C:\Windows\System\nTnsZgP.exe

Filesize
1.9MB

MD5
a6002db7334fb5766e113e6d8c39b8af

SHA1
6a17a5a88a19f10b89f2ab1c91ea35c2140f87ee

SHA256
3e012236e1cfc57670862b0cc461e3d4c5eaccc042348a5ebdcf688096ca1ba8

SHA512
cb5a4d96b411391e43c314cd37e5aa5c12683f0d9ff46628972ad08505360e08a1843ee98b1fe276266c58550ea44681786768d0807c4411be473da1d8ffb781

Download Submit
C:\Windows\System\pyOzODe.exe

Filesize
1.9MB

MD5
160a098e74b703fcfef082171cdb8fa0

SHA1
2ecab28ba09311102269c9a884fefc4abe042f7d

SHA256
34d506aa81f7a8e95a7a3f6cf74f8d2feb4f97efc0d3682f85b970283ea40f23

SHA512
96d862591e0c74cac1e59c153363bf272df06a8adaa7bfac4a641ed16aff06acbdad79962cc6c7e858689cd6671dd510c78b778e1aef5d5691dc49af5ab29be8

Download Submit
C:\Windows\System\qgUXoUT.exe

Filesize
1.8MB

MD5
74000776e087f77ff133eb7b70cb84cd

SHA1
51c556132d8aee3add75eb7e7f05c1a3bafbe2d9

SHA256
bdd409d72489efed634838ea0c497029585ddb9b3a79d83c83966a5474879b38

SHA512
0e45f2bdf68a0fea624781c3e073858b960b6efca98531adf2771ec98493e1d5894b292219b6078dd360fde96ef1d720816de72565748f64c60e04b4ff945ab4

Download Submit
C:\Windows\System\sJNYXOu.exe

Filesize
1.9MB

MD5
bc2569ea82aec6e50a236b0bf37f3d5b

SHA1
e2b4cbdd1ffe3286cb1dbd65bffaae335122c1b8

SHA256
f5fe0d6ed5018b1191fe821f481ea2e4a8f6ef91e0e6d07b0b7fa082c998b0e2

SHA512
e2f11b57a49fa0ab524ec3f09355412817367c6365de2512c1816575139351ee4acd02a937973075c696b3c555379fde619f8b659ffb2cc2e1672c77660c97a5

Download Submit
C:\Windows\System\tyoFMXE.exe

Filesize
1.9MB

MD5
3def7c5178c982c7e3ad103d9162843e

SHA1
13816562d3db997547d6dc02c3a0661bd924f02d

SHA256
43fe736271027458a5f60d79dad11b9164f0a0b8f933c11416eaf099e448f3c4

SHA512
66c7714730a45b62484a2f8b3783c1542f83d091d7664a1941b81f3b29f8610d87d52f595e3fa2ff28a7c12c0a2b7af4e44025a85a51070a36f60684877114bc

Download Submit
C:\Windows\System\xLNTarH.exe

Filesize
1.9MB

MD5
a91f861124812bc7a6f333cba32853d7

SHA1
ca348832cf3c5bab46e6b8e6e245b8888fd571f7

SHA256
efcf3a7cb26ad7d322e5638ec51eb2bc9b514f5f91ffbcb2033e2da3f382f32f

SHA512
b6adfdc0cefe4dc5a92935c67484397694d039a29a54d6cbb7890e646e3aefb8bf0f29f55673f0d26761344eb0c7170dc804f362d1e6291c31cdaf9fcae812fc

Download Submit
C:\Windows\System\yupEEXc.exe

Filesize
1.8MB

MD5
0afd1615dcf5672aac8921f608a2cc76

SHA1
c87bd93d32707f2c79f8e4f1a0d18c53d6b356a0

SHA256
4e3e0c0b66c4fe246ab96e324d1fb6e7222ce003d120ac2568c5a2fd19985955

SHA512
cadacc202acc1aba84df1dd380004e875287e957e9d39e3f05bcbd2b7ae1837a82aec97aa7d7fa4c268521c45ba5b747397de692cc62a2d7be163894e4596e09

Download Submit
memory/512-14-0x00007FF6C5230000-0x00007FF6C5584000-memory.dmp

Filesize
3.3MB

Download
memory/512-2084-0x00007FF6C5230000-0x00007FF6C5584000-memory.dmp

Filesize
3.3MB

Download
memory/628-744-0x00007FF676500000-0x00007FF676854000-memory.dmp

Filesize
3.3MB

Download
memory/628-2101-0x00007FF676500000-0x00007FF676854000-memory.dmp

Filesize
3.3MB

Download
memory/796-1-0x000001FB890F0000-0x000001FB89100000-memory.dmp

Filesize
64KB

Download
memory/796-0-0x00007FF76C0A0000-0x00007FF76C3F4000-memory.dmp

Filesize
3.3MB

Download
memory/924-71-0x00007FF76B3C0000-0x00007FF76B714000-memory.dmp

Filesize
3.3MB

Download
memory/924-2095-0x00007FF76B3C0000-0x00007FF76B714000-memory.dmp

Filesize
3.3MB

Download
memory/940-2111-0x00007FF7F3E20000-0x00007FF7F4174000-memory.dmp

Filesize
3.3MB

Download
memory/940-763-0x00007FF7F3E20000-0x00007FF7F4174000-memory.dmp

Filesize
3.3MB

Download
memory/1220-2081-0x00007FF6AB250000-0x00007FF6AB5A4000-memory.dmp

Filesize
3.3MB

Download
memory/1220-57-0x00007FF6AB250000-0x00007FF6AB5A4000-memory.dmp

Filesize
3.3MB

Download
memory/1220-2090-0x00007FF6AB250000-0x00007FF6AB5A4000-memory.dmp

Filesize
3.3MB

Download
memory/1600-2104-0x00007FF7927C0000-0x00007FF792B14000-memory.dmp

Filesize
3.3MB

Download
memory/1600-773-0x00007FF7927C0000-0x00007FF792B14000-memory.dmp

Filesize
3.3MB

Download
memory/1656-39-0x00007FF65CE90000-0x00007FF65D1E4000-memory.dmp

Filesize
3.3MB

Download
memory/1656-2079-0x00007FF65CE90000-0x00007FF65D1E4000-memory.dmp

Filesize
3.3MB

Download
memory/1656-2088-0x00007FF65CE90000-0x00007FF65D1E4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-738-0x00007FF788600000-0x00007FF788954000-memory.dmp

Filesize
3.3MB

Download
memory/1664-2098-0x00007FF788600000-0x00007FF788954000-memory.dmp

Filesize
3.3MB

Download
memory/2096-709-0x00007FF7597F0000-0x00007FF759B44000-memory.dmp

Filesize
3.3MB

Download
memory/2096-2094-0x00007FF7597F0000-0x00007FF759B44000-memory.dmp

Filesize
3.3MB

Download
memory/2152-750-0x00007FF77C410000-0x00007FF77C764000-memory.dmp

Filesize
3.3MB

Download
memory/2152-2109-0x00007FF77C410000-0x00007FF77C764000-memory.dmp

Filesize
3.3MB

Download
memory/2160-2087-0x00007FF6479B0000-0x00007FF647D04000-memory.dmp

Filesize
3.3MB

Download
memory/2160-46-0x00007FF6479B0000-0x00007FF647D04000-memory.dmp

Filesize
3.3MB

Download
memory/2240-2099-0x00007FF7AA710000-0x00007FF7AAA64000-memory.dmp

Filesize
3.3MB

Download
memory/2240-729-0x00007FF7AA710000-0x00007FF7AAA64000-memory.dmp

Filesize
3.3MB

Download
memory/2280-2089-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2280-786-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-2085-0x00007FF7EB7D0000-0x00007FF7EBB24000-memory.dmp

Filesize
3.3MB

Download
memory/2608-35-0x00007FF7EB7D0000-0x00007FF7EBB24000-memory.dmp

Filesize
3.3MB

Download
memory/3392-2110-0x00007FF79F130000-0x00007FF79F484000-memory.dmp

Filesize
3.3MB

Download
memory/3392-777-0x00007FF79F130000-0x00007FF79F484000-memory.dmp

Filesize
3.3MB

Download
memory/3400-769-0x00007FF7E1D40000-0x00007FF7E2094000-memory.dmp

Filesize
3.3MB

Download
memory/3400-2106-0x00007FF7E1D40000-0x00007FF7E2094000-memory.dmp

Filesize
3.3MB

Download
memory/3444-2077-0x00007FF650F40000-0x00007FF651294000-memory.dmp

Filesize
3.3MB

Download
memory/3444-2083-0x00007FF650F40000-0x00007FF651294000-memory.dmp

Filesize
3.3MB

Download
memory/3444-7-0x00007FF650F40000-0x00007FF651294000-memory.dmp

Filesize
3.3MB

Download
memory/3512-2102-0x00007FF76F490000-0x00007FF76F7E4000-memory.dmp

Filesize
3.3MB

Download
memory/3512-785-0x00007FF76F490000-0x00007FF76F7E4000-memory.dmp

Filesize
3.3MB

Download
memory/3776-2108-0x00007FF6F3A50000-0x00007FF6F3DA4000-memory.dmp

Filesize
3.3MB

Download
memory/3776-755-0x00007FF6F3A50000-0x00007FF6F3DA4000-memory.dmp

Filesize
3.3MB

Download
memory/3984-758-0x00007FF7CB4B0000-0x00007FF7CB804000-memory.dmp

Filesize
3.3MB

Download
memory/3984-2107-0x00007FF7CB4B0000-0x00007FF7CB804000-memory.dmp

Filesize
3.3MB

Download
memory/4240-63-0x00007FF766370000-0x00007FF7666C4000-memory.dmp

Filesize
3.3MB

Download
memory/4240-2082-0x00007FF766370000-0x00007FF7666C4000-memory.dmp

Filesize
3.3MB

Download
memory/4240-2091-0x00007FF766370000-0x00007FF7666C4000-memory.dmp

Filesize
3.3MB

Download
memory/4352-20-0x00007FF6109B0000-0x00007FF610D04000-memory.dmp

Filesize
3.3MB

Download
memory/4352-2078-0x00007FF6109B0000-0x00007FF610D04000-memory.dmp

Filesize
3.3MB

Download
memory/4352-2086-0x00007FF6109B0000-0x00007FF610D04000-memory.dmp

Filesize
3.3MB

Download
memory/4408-719-0x00007FF71C860000-0x00007FF71CBB4000-memory.dmp

Filesize
3.3MB

Download
memory/4408-2093-0x00007FF71C860000-0x00007FF71CBB4000-memory.dmp

Filesize
3.3MB

Download
memory/4456-713-0x00007FF79CEB0000-0x00007FF79D204000-memory.dmp

Filesize
3.3MB

Download
memory/4456-2096-0x00007FF79CEB0000-0x00007FF79D204000-memory.dmp

Filesize
3.3MB

Download
memory/4464-779-0x00007FF7DC6B0000-0x00007FF7DCA04000-memory.dmp

Filesize
3.3MB

Download
memory/4464-2103-0x00007FF7DC6B0000-0x00007FF7DCA04000-memory.dmp

Filesize
3.3MB

Download
memory/4580-724-0x00007FF62A500000-0x00007FF62A854000-memory.dmp

Filesize
3.3MB

Download
memory/4580-2097-0x00007FF62A500000-0x00007FF62A854000-memory.dmp

Filesize
3.3MB

Download
memory/4936-783-0x00007FF63F120000-0x00007FF63F474000-memory.dmp

Filesize
3.3MB

Download
memory/4936-2105-0x00007FF63F120000-0x00007FF63F474000-memory.dmp

Filesize
3.3MB

Download
memory/4952-2092-0x00007FF7BF860000-0x00007FF7BFBB4000-memory.dmp

Filesize
3.3MB

Download
memory/4952-49-0x00007FF7BF860000-0x00007FF7BFBB4000-memory.dmp

Filesize
3.3MB

Download
memory/4952-2080-0x00007FF7BF860000-0x00007FF7BFBB4000-memory.dmp

Filesize
3.3MB

Download
memory/5080-741-0x00007FF64D7F0000-0x00007FF64DB44000-memory.dmp

Filesize
3.3MB

Download
memory/5080-2100-0x00007FF64D7F0000-0x00007FF64DB44000-memory.dmp

Filesize
3.3MB

Download