xmrig | d4fb0bca2939420a12e8034409e3a12c413ff06797ac83e4a63369c9a7f5b424

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
Size

2.1MB
MD5

007d04bd8c53992a86f7335f1ed267b0
SHA1

82f4eb1be309391dabc0e9f0d17f687314a871a8
SHA256

d4fb0bca2939420a12e8034409e3a12c413ff06797ac83e4a63369c9a7f5b424
SHA512

ff30be05e90cb81d2c2da7ecaa6e6c01a753f03d44eaf97d6d0f3eb09bb8f4fe335b64f58cf7d6116f1fa7a0ed359a1c31b4a770188eec9713def42688092265
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICb5Trec2a/1ASmV:BemTLkNdfE0pZrP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4660-0-0x00007FF7A1ED0000-0x00007FF7A2224000-memory.dmp	xmrig
behavioral2/files/0x000b000000023b92-5.dat	xmrig
behavioral2/files/0x000a000000023b96-13.dat	xmrig
behavioral2/files/0x000a000000023b99-24.dat	xmrig
behavioral2/files/0x000a000000023b98-23.dat	xmrig
behavioral2/memory/2116-32-0x00007FF76E8C0000-0x00007FF76EC14000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b97-31.dat	xmrig
behavioral2/files/0x000a000000023b9a-25.dat	xmrig
behavioral2/memory/4928-26-0x00007FF7F8860000-0x00007FF7F8BB4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b9b-34.dat	xmrig
behavioral2/memory/4412-16-0x00007FF6894E0000-0x00007FF689834000-memory.dmp	xmrig
behavioral2/memory/3708-66-0x00007FF6558B0000-0x00007FF655C04000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b9e-65.dat	xmrig
behavioral2/memory/2712-61-0x00007FF7220C0000-0x00007FF722414000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba0-58.dat	xmrig
behavioral2/files/0x000a000000023b9f-56.dat	xmrig
behavioral2/memory/4484-45-0x00007FF669090000-0x00007FF6693E4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b9d-43.dat	xmrig
behavioral2/files/0x000a000000023b9c-39.dat	xmrig
behavioral2/memory/4764-67-0x00007FF72ACB0000-0x00007FF72B004000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba4-97.dat	xmrig
behavioral2/files/0x000a000000023ba9-109.dat	xmrig
behavioral2/files/0x000a000000023bad-140.dat	xmrig
behavioral2/files/0x000a000000023baf-158.dat	xmrig
behavioral2/files/0x000a000000023bb2-172.dat	xmrig
behavioral2/files/0x000a000000023bb7-192.dat	xmrig
behavioral2/memory/388-200-0x00007FF7FEF90000-0x00007FF7FF2E4000-memory.dmp	xmrig
behavioral2/memory/968-212-0x00007FF77ED10000-0x00007FF77F064000-memory.dmp	xmrig
behavioral2/memory/3628-217-0x00007FF666140000-0x00007FF666494000-memory.dmp	xmrig
behavioral2/memory/1168-218-0x00007FF6375C0000-0x00007FF637914000-memory.dmp	xmrig
behavioral2/memory/1344-216-0x00007FF75F0D0000-0x00007FF75F424000-memory.dmp	xmrig
behavioral2/memory/4376-215-0x00007FF6122F0000-0x00007FF612644000-memory.dmp	xmrig
behavioral2/memory/5040-214-0x00007FF641400000-0x00007FF641754000-memory.dmp	xmrig
behavioral2/memory/3060-213-0x00007FF6D6450000-0x00007FF6D67A4000-memory.dmp	xmrig
behavioral2/memory/3888-211-0x00007FF677190000-0x00007FF6774E4000-memory.dmp	xmrig
behavioral2/memory/4440-210-0x00007FF6F79C0000-0x00007FF6F7D14000-memory.dmp	xmrig
behavioral2/memory/4704-209-0x00007FF716D50000-0x00007FF7170A4000-memory.dmp	xmrig
behavioral2/memory/3204-199-0x00007FF755CC0000-0x00007FF756014000-memory.dmp	xmrig
behavioral2/memory/1996-194-0x00007FF6BE980000-0x00007FF6BECD4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb6-191.dat	xmrig
behavioral2/files/0x000a000000023bb5-190.dat	xmrig
behavioral2/memory/1088-189-0x00007FF6945D0000-0x00007FF694924000-memory.dmp	xmrig
behavioral2/memory/4640-182-0x00007FF65E630000-0x00007FF65E984000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb4-179.dat	xmrig
behavioral2/files/0x000a000000023bb3-176.dat	xmrig
behavioral2/files/0x000a000000023bb1-169.dat	xmrig
behavioral2/memory/2176-164-0x00007FF606510000-0x00007FF606864000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bae-155.dat	xmrig
behavioral2/memory/4260-152-0x00007FF6688C0000-0x00007FF668C14000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bab-150.dat	xmrig
behavioral2/files/0x000a000000023bb0-148.dat	xmrig
behavioral2/memory/1648-145-0x00007FF678F10000-0x00007FF679264000-memory.dmp	xmrig
behavioral2/files/0x000b000000023b93-141.dat	xmrig
behavioral2/files/0x000a000000023ba5-138.dat	xmrig
behavioral2/files/0x000a000000023baa-133.dat	xmrig
behavioral2/files/0x000a000000023ba8-132.dat	xmrig
behavioral2/files/0x000a000000023ba7-131.dat	xmrig
behavioral2/memory/4624-128-0x00007FF6DC7F0000-0x00007FF6DCB44000-memory.dmp	xmrig
behavioral2/memory/2904-125-0x00007FF69EA30000-0x00007FF69ED84000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba6-121.dat	xmrig
behavioral2/files/0x000a000000023bac-119.dat	xmrig
behavioral2/memory/532-113-0x00007FF6AFED0000-0x00007FF6B0224000-memory.dmp	xmrig
behavioral2/memory/1968-102-0x00007FF63C510000-0x00007FF63C864000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba3-95.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4412	cpAqkMa.exe
1968	eATnmZa.exe
4928	YYsQhuX.exe
532	rLFOhVc.exe
2116	PrHxqwH.exe
4484	gbprOhN.exe
2904	ZGqEIWV.exe
2712	zTduOSy.exe
3708	OpKieCj.exe
4624	YYkLFlJ.exe
4764	FGUaRxJ.exe
1648	njOEtus.exe
5040	fiknFZU.exe
4260	WbVEPXy.exe
2176	idjVmFf.exe
4640	YPpIPCy.exe
4376	ijWYHaN.exe
1088	VHSkfjz.exe
1996	oyiULGs.exe
3204	pyrZozb.exe
388	FsRcsvc.exe
4704	hAptsGB.exe
1344	CAnxjQb.exe
4440	ltNFxFf.exe
3888	jznkSbu.exe
3628	mGCAFKu.exe
968	CWcVPsS.exe
3060	OBlaNjZ.exe
1168	SWrUEej.exe
3836	vPXTOfL.exe
1932	waJYBiL.exe
552	IxczISW.exe
3684	wqdyHJQ.exe
1808	YKDkPEG.exe
4148	TlmabVH.exe
3940	gjGPvvM.exe
2876	kKJGVnv.exe
3624	wWtyZRS.exe
1492	auQfksh.exe
4132	VSRuJPh.exe
4028	okunwtT.exe
4868	TLnoZtw.exe
3480	WWZeFcv.exe
2144	qGomAxS.exe
2960	ZpQHJaO.exe
4252	ebGYeRe.exe
4380	vhmvQPe.exe
5004	wcTxvzA.exe
3956	aVEvcWk.exe
2708	pNCkJma.exe
2488	hrQLIXe.exe
948	pEwpYEa.exe
4548	pcoshly.exe
3556	YxBWcmt.exe
412	AKGUBvg.exe
4244	BrhTsSa.exe
2260	WVZAbfk.exe
208	gLEFevQ.exe
684	euKmoVh.exe
4992	jIKrbTD.exe
956	iIEGhPS.exe
4512	xtunCnG.exe
3976	ZvtqgnH.exe
4968	IZxOejS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4660-0-0x00007FF7A1ED0000-0x00007FF7A2224000-memory.dmp	upx
behavioral2/files/0x000b000000023b92-5.dat	upx
behavioral2/files/0x000a000000023b96-13.dat	upx
behavioral2/files/0x000a000000023b99-24.dat	upx
behavioral2/files/0x000a000000023b98-23.dat	upx
behavioral2/memory/2116-32-0x00007FF76E8C0000-0x00007FF76EC14000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-31.dat	upx
behavioral2/files/0x000a000000023b9a-25.dat	upx
behavioral2/memory/4928-26-0x00007FF7F8860000-0x00007FF7F8BB4000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-34.dat	upx
behavioral2/memory/4412-16-0x00007FF6894E0000-0x00007FF689834000-memory.dmp	upx
behavioral2/memory/3708-66-0x00007FF6558B0000-0x00007FF655C04000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-65.dat	upx
behavioral2/memory/2712-61-0x00007FF7220C0000-0x00007FF722414000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-58.dat	upx
behavioral2/files/0x000a000000023b9f-56.dat	upx
behavioral2/memory/4484-45-0x00007FF669090000-0x00007FF6693E4000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-43.dat	upx
behavioral2/files/0x000a000000023b9c-39.dat	upx
behavioral2/memory/4764-67-0x00007FF72ACB0000-0x00007FF72B004000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-97.dat	upx
behavioral2/files/0x000a000000023ba9-109.dat	upx
behavioral2/files/0x000a000000023bad-140.dat	upx
behavioral2/files/0x000a000000023baf-158.dat	upx
behavioral2/files/0x000a000000023bb2-172.dat	upx
behavioral2/files/0x000a000000023bb7-192.dat	upx
behavioral2/memory/388-200-0x00007FF7FEF90000-0x00007FF7FF2E4000-memory.dmp	upx
behavioral2/memory/968-212-0x00007FF77ED10000-0x00007FF77F064000-memory.dmp	upx
behavioral2/memory/3628-217-0x00007FF666140000-0x00007FF666494000-memory.dmp	upx
behavioral2/memory/1168-218-0x00007FF6375C0000-0x00007FF637914000-memory.dmp	upx
behavioral2/memory/1344-216-0x00007FF75F0D0000-0x00007FF75F424000-memory.dmp	upx
behavioral2/memory/4376-215-0x00007FF6122F0000-0x00007FF612644000-memory.dmp	upx
behavioral2/memory/5040-214-0x00007FF641400000-0x00007FF641754000-memory.dmp	upx
behavioral2/memory/3060-213-0x00007FF6D6450000-0x00007FF6D67A4000-memory.dmp	upx
behavioral2/memory/3888-211-0x00007FF677190000-0x00007FF6774E4000-memory.dmp	upx
behavioral2/memory/4440-210-0x00007FF6F79C0000-0x00007FF6F7D14000-memory.dmp	upx
behavioral2/memory/4704-209-0x00007FF716D50000-0x00007FF7170A4000-memory.dmp	upx
behavioral2/memory/3204-199-0x00007FF755CC0000-0x00007FF756014000-memory.dmp	upx
behavioral2/memory/1996-194-0x00007FF6BE980000-0x00007FF6BECD4000-memory.dmp	upx
behavioral2/files/0x000a000000023bb6-191.dat	upx
behavioral2/files/0x000a000000023bb5-190.dat	upx
behavioral2/memory/1088-189-0x00007FF6945D0000-0x00007FF694924000-memory.dmp	upx
behavioral2/memory/4640-182-0x00007FF65E630000-0x00007FF65E984000-memory.dmp	upx
behavioral2/files/0x000a000000023bb4-179.dat	upx
behavioral2/files/0x000a000000023bb3-176.dat	upx
behavioral2/files/0x000a000000023bb1-169.dat	upx
behavioral2/memory/2176-164-0x00007FF606510000-0x00007FF606864000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-155.dat	upx
behavioral2/memory/4260-152-0x00007FF6688C0000-0x00007FF668C14000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-150.dat	upx
behavioral2/files/0x000a000000023bb0-148.dat	upx
behavioral2/memory/1648-145-0x00007FF678F10000-0x00007FF679264000-memory.dmp	upx
behavioral2/files/0x000b000000023b93-141.dat	upx
behavioral2/files/0x000a000000023ba5-138.dat	upx
behavioral2/files/0x000a000000023baa-133.dat	upx
behavioral2/files/0x000a000000023ba8-132.dat	upx
behavioral2/files/0x000a000000023ba7-131.dat	upx
behavioral2/memory/4624-128-0x00007FF6DC7F0000-0x00007FF6DCB44000-memory.dmp	upx
behavioral2/memory/2904-125-0x00007FF69EA30000-0x00007FF69ED84000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-121.dat	upx
behavioral2/files/0x000a000000023bac-119.dat	upx
behavioral2/memory/532-113-0x00007FF6AFED0000-0x00007FF6B0224000-memory.dmp	upx
behavioral2/memory/1968-102-0x00007FF63C510000-0x00007FF63C864000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-95.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CAnxjQb.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\FoMHvtl.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\IvTYKCi.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\ntiLAQd.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\JbPkFzO.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\nHGkKMp.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\HZeugeJ.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\CNGDQGN.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\kcvdHQI.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\XCXBHpk.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\ycPtPje.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\CaOnFgd.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\eATnmZa.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\UrlqKPY.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\UbugCkK.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\CYOeizr.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\vckKldh.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\LHnBjLR.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\rBLLHyp.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\HShoYkq.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\xONehfk.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\cTTiHQw.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\HTxBtSc.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\yrGgmej.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\REArwda.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\XGPIMwk.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\CvMbIoF.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\TTxKMiV.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\DRBeWol.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\dNeyswz.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\ucJrIGD.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\YRYsiXe.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\bfMsRFt.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\leoglFA.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\ebGYeRe.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\whcVxQj.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\jFboUJW.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\qHyxujQ.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\waJYBiL.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\VRsIVrb.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\sPJPmYS.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\tUyaSbq.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\MtroxDL.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\acpGvjU.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\HnjDTcz.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\hvsQTHx.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\HXEyrdI.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\wFxtIZR.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\fkbVVFZ.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\VSRuJPh.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\kJtoIFX.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\xaIXVmk.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\heHtyIA.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\szFHooD.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\wNsuIkZ.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\fbeYYDG.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\tZjXBnQ.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\XkVoHhE.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\oXVSuUq.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\gFkrMeb.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\ZAmHlsP.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\cMmFShK.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\bSjZOQb.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
File created	C:\Windows\System\wqdyHJQ.exe	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4412	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	84
PID 4660 wrote to memory of 4412	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	84
PID 4660 wrote to memory of 4928	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	85
PID 4660 wrote to memory of 4928	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	85
PID 4660 wrote to memory of 1968	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	86
PID 4660 wrote to memory of 1968	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	86
PID 4660 wrote to memory of 532	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	87
PID 4660 wrote to memory of 532	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	87
PID 4660 wrote to memory of 2116	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	88
PID 4660 wrote to memory of 2116	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	88
PID 4660 wrote to memory of 4484	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	89
PID 4660 wrote to memory of 4484	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	89
PID 4660 wrote to memory of 2904	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	90
PID 4660 wrote to memory of 2904	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	90
PID 4660 wrote to memory of 2712	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	91
PID 4660 wrote to memory of 2712	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	91
PID 4660 wrote to memory of 3708	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	92
PID 4660 wrote to memory of 3708	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	92
PID 4660 wrote to memory of 1648	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	93
PID 4660 wrote to memory of 1648	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	93
PID 4660 wrote to memory of 4624	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	94
PID 4660 wrote to memory of 4624	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	94
PID 4660 wrote to memory of 4764	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	95
PID 4660 wrote to memory of 4764	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	95
PID 4660 wrote to memory of 5040	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	96
PID 4660 wrote to memory of 5040	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	96
PID 4660 wrote to memory of 4260	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	97
PID 4660 wrote to memory of 4260	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	97
PID 4660 wrote to memory of 2176	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	98
PID 4660 wrote to memory of 2176	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	98
PID 4660 wrote to memory of 4640	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	99
PID 4660 wrote to memory of 4640	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	99
PID 4660 wrote to memory of 4376	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	100
PID 4660 wrote to memory of 4376	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	100
PID 4660 wrote to memory of 1344	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	101
PID 4660 wrote to memory of 1344	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	101
PID 4660 wrote to memory of 1088	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	102
PID 4660 wrote to memory of 1088	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	102
PID 4660 wrote to memory of 1996	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	103
PID 4660 wrote to memory of 1996	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	103
PID 4660 wrote to memory of 3204	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	104
PID 4660 wrote to memory of 3204	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	104
PID 4660 wrote to memory of 388	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	105
PID 4660 wrote to memory of 388	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	105
PID 4660 wrote to memory of 4704	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	106
PID 4660 wrote to memory of 4704	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	106
PID 4660 wrote to memory of 4440	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	107
PID 4660 wrote to memory of 4440	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	107
PID 4660 wrote to memory of 3888	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	108
PID 4660 wrote to memory of 3888	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	108
PID 4660 wrote to memory of 3628	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	109
PID 4660 wrote to memory of 3628	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	109
PID 4660 wrote to memory of 968	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	110
PID 4660 wrote to memory of 968	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	110
PID 4660 wrote to memory of 3060	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	111
PID 4660 wrote to memory of 3060	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	111
PID 4660 wrote to memory of 1168	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	112
PID 4660 wrote to memory of 1168	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	112
PID 4660 wrote to memory of 3836	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	113
PID 4660 wrote to memory of 3836	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	113
PID 4660 wrote to memory of 1932	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	114
PID 4660 wrote to memory of 1932	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	114
PID 4660 wrote to memory of 552	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	115
PID 4660 wrote to memory of 552	4660	007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\007d04bd8c53992a86f7335f1ed267b0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\System\cpAqkMa.exe
  C:\Windows\System\cpAqkMa.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\YYsQhuX.exe
  C:\Windows\System\YYsQhuX.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\eATnmZa.exe
  C:\Windows\System\eATnmZa.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\rLFOhVc.exe
  C:\Windows\System\rLFOhVc.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\PrHxqwH.exe
  C:\Windows\System\PrHxqwH.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\gbprOhN.exe
  C:\Windows\System\gbprOhN.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\ZGqEIWV.exe
  C:\Windows\System\ZGqEIWV.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\zTduOSy.exe
  C:\Windows\System\zTduOSy.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\OpKieCj.exe
  C:\Windows\System\OpKieCj.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\njOEtus.exe
  C:\Windows\System\njOEtus.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\YYkLFlJ.exe
  C:\Windows\System\YYkLFlJ.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\FGUaRxJ.exe
  C:\Windows\System\FGUaRxJ.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\fiknFZU.exe
  C:\Windows\System\fiknFZU.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\WbVEPXy.exe
  C:\Windows\System\WbVEPXy.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\idjVmFf.exe
  C:\Windows\System\idjVmFf.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\YPpIPCy.exe
  C:\Windows\System\YPpIPCy.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\ijWYHaN.exe
  C:\Windows\System\ijWYHaN.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\CAnxjQb.exe
  C:\Windows\System\CAnxjQb.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\VHSkfjz.exe
  C:\Windows\System\VHSkfjz.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\oyiULGs.exe
  C:\Windows\System\oyiULGs.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\pyrZozb.exe
  C:\Windows\System\pyrZozb.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\FsRcsvc.exe
  C:\Windows\System\FsRcsvc.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\hAptsGB.exe
  C:\Windows\System\hAptsGB.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\ltNFxFf.exe
  C:\Windows\System\ltNFxFf.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\jznkSbu.exe
  C:\Windows\System\jznkSbu.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\mGCAFKu.exe
  C:\Windows\System\mGCAFKu.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\CWcVPsS.exe
  C:\Windows\System\CWcVPsS.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\OBlaNjZ.exe
  C:\Windows\System\OBlaNjZ.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\SWrUEej.exe
  C:\Windows\System\SWrUEej.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\vPXTOfL.exe
  C:\Windows\System\vPXTOfL.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\waJYBiL.exe
  C:\Windows\System\waJYBiL.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\IxczISW.exe
  C:\Windows\System\IxczISW.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\wqdyHJQ.exe
  C:\Windows\System\wqdyHJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\YKDkPEG.exe
  C:\Windows\System\YKDkPEG.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\TlmabVH.exe
  C:\Windows\System\TlmabVH.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\gjGPvvM.exe
  C:\Windows\System\gjGPvvM.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\kKJGVnv.exe
  C:\Windows\System\kKJGVnv.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\wWtyZRS.exe
  C:\Windows\System\wWtyZRS.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\auQfksh.exe
  C:\Windows\System\auQfksh.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\VSRuJPh.exe
  C:\Windows\System\VSRuJPh.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\okunwtT.exe
  C:\Windows\System\okunwtT.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\TLnoZtw.exe
  C:\Windows\System\TLnoZtw.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\WWZeFcv.exe
  C:\Windows\System\WWZeFcv.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\qGomAxS.exe
  C:\Windows\System\qGomAxS.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\ZpQHJaO.exe
  C:\Windows\System\ZpQHJaO.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\ebGYeRe.exe
  C:\Windows\System\ebGYeRe.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\vhmvQPe.exe
  C:\Windows\System\vhmvQPe.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\wcTxvzA.exe
  C:\Windows\System\wcTxvzA.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\aVEvcWk.exe
  C:\Windows\System\aVEvcWk.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\pNCkJma.exe
  C:\Windows\System\pNCkJma.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\hrQLIXe.exe
  C:\Windows\System\hrQLIXe.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\pEwpYEa.exe
  C:\Windows\System\pEwpYEa.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\pcoshly.exe
  C:\Windows\System\pcoshly.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\YxBWcmt.exe
  C:\Windows\System\YxBWcmt.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\AKGUBvg.exe
  C:\Windows\System\AKGUBvg.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\BrhTsSa.exe
  C:\Windows\System\BrhTsSa.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\WVZAbfk.exe
  C:\Windows\System\WVZAbfk.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\gLEFevQ.exe
  C:\Windows\System\gLEFevQ.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\euKmoVh.exe
  C:\Windows\System\euKmoVh.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\jIKrbTD.exe
  C:\Windows\System\jIKrbTD.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\iIEGhPS.exe
  C:\Windows\System\iIEGhPS.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\xtunCnG.exe
  C:\Windows\System\xtunCnG.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\ZvtqgnH.exe
  C:\Windows\System\ZvtqgnH.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\IZxOejS.exe
  C:\Windows\System\IZxOejS.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\ZLwamsl.exe
  C:\Windows\System\ZLwamsl.exe
  2⤵
  PID:2304
- C:\Windows\System\GaoumnL.exe
  C:\Windows\System\GaoumnL.exe
  2⤵
  PID:2808
- C:\Windows\System\REArwda.exe
  C:\Windows\System\REArwda.exe
  2⤵
  PID:4676
- C:\Windows\System\ttpDWLj.exe
  C:\Windows\System\ttpDWLj.exe
  2⤵
  PID:1544
- C:\Windows\System\dvwllFp.exe
  C:\Windows\System\dvwllFp.exe
  2⤵
  PID:696
- C:\Windows\System\BdGokfx.exe
  C:\Windows\System\BdGokfx.exe
  2⤵
  PID:1012
- C:\Windows\System\bFvpUIG.exe
  C:\Windows\System\bFvpUIG.exe
  2⤵
  PID:5036
- C:\Windows\System\eKZBXDB.exe
  C:\Windows\System\eKZBXDB.exe
  2⤵
  PID:2508
- C:\Windows\System\YbuWVXC.exe
  C:\Windows\System\YbuWVXC.exe
  2⤵
  PID:2804
- C:\Windows\System\omPTQxw.exe
  C:\Windows\System\omPTQxw.exe
  2⤵
  PID:4788
- C:\Windows\System\ghrHyKP.exe
  C:\Windows\System\ghrHyKP.exe
  2⤵
  PID:3120
- C:\Windows\System\usFHLxV.exe
  C:\Windows\System\usFHLxV.exe
  2⤵
  PID:4160
- C:\Windows\System\MCGhPnz.exe
  C:\Windows\System\MCGhPnz.exe
  2⤵
  PID:2924
- C:\Windows\System\DbBoQNg.exe
  C:\Windows\System\DbBoQNg.exe
  2⤵
  PID:4536
- C:\Windows\System\zSSYBqd.exe
  C:\Windows\System\zSSYBqd.exe
  2⤵
  PID:3116
- C:\Windows\System\aRJIxbF.exe
  C:\Windows\System\aRJIxbF.exe
  2⤵
  PID:4388
- C:\Windows\System\kJtoIFX.exe
  C:\Windows\System\kJtoIFX.exe
  2⤵
  PID:2036
- C:\Windows\System\Odyrzqa.exe
  C:\Windows\System\Odyrzqa.exe
  2⤵
  PID:1780
- C:\Windows\System\Qgdicmo.exe
  C:\Windows\System\Qgdicmo.exe
  2⤵
  PID:2076
- C:\Windows\System\ZTOQMps.exe
  C:\Windows\System\ZTOQMps.exe
  2⤵
  PID:540
- C:\Windows\System\vZPzhpc.exe
  C:\Windows\System\vZPzhpc.exe
  2⤵
  PID:2744
- C:\Windows\System\mWICzgO.exe
  C:\Windows\System\mWICzgO.exe
  2⤵
  PID:1100
- C:\Windows\System\ZkyULsu.exe
  C:\Windows\System\ZkyULsu.exe
  2⤵
  PID:1032
- C:\Windows\System\BLYnEnQ.exe
  C:\Windows\System\BLYnEnQ.exe
  2⤵
  PID:3616
- C:\Windows\System\kHbuzUO.exe
  C:\Windows\System\kHbuzUO.exe
  2⤵
  PID:4424
- C:\Windows\System\eVaTLIL.exe
  C:\Windows\System\eVaTLIL.exe
  2⤵
  PID:2532
- C:\Windows\System\kcvdHQI.exe
  C:\Windows\System\kcvdHQI.exe
  2⤵
  PID:888
- C:\Windows\System\xUaJfiV.exe
  C:\Windows\System\xUaJfiV.exe
  2⤵
  PID:2664
- C:\Windows\System\BlEpIih.exe
  C:\Windows\System\BlEpIih.exe
  2⤵
  PID:2848
- C:\Windows\System\aNSpRpi.exe
  C:\Windows\System\aNSpRpi.exe
  2⤵
  PID:3168
- C:\Windows\System\GzzjFKV.exe
  C:\Windows\System\GzzjFKV.exe
  2⤵
  PID:4784
- C:\Windows\System\DxOhfYr.exe
  C:\Windows\System\DxOhfYr.exe
  2⤵
  PID:2552
- C:\Windows\System\tAUazdf.exe
  C:\Windows\System\tAUazdf.exe
  2⤵
  PID:5136
- C:\Windows\System\QfvjaCb.exe
  C:\Windows\System\QfvjaCb.exe
  2⤵
  PID:5172
- C:\Windows\System\nGnvvBf.exe
  C:\Windows\System\nGnvvBf.exe
  2⤵
  PID:5200
- C:\Windows\System\akIkSpv.exe
  C:\Windows\System\akIkSpv.exe
  2⤵
  PID:5232
- C:\Windows\System\VRsIVrb.exe
  C:\Windows\System\VRsIVrb.exe
  2⤵
  PID:5260
- C:\Windows\System\RrAmQjW.exe
  C:\Windows\System\RrAmQjW.exe
  2⤵
  PID:5288
- C:\Windows\System\aOKxsEr.exe
  C:\Windows\System\aOKxsEr.exe
  2⤵
  PID:5324
- C:\Windows\System\atBBYdB.exe
  C:\Windows\System\atBBYdB.exe
  2⤵
  PID:5348
- C:\Windows\System\cvLdqUE.exe
  C:\Windows\System\cvLdqUE.exe
  2⤵
  PID:5384
- C:\Windows\System\QYZtEjX.exe
  C:\Windows\System\QYZtEjX.exe
  2⤵
  PID:5428
- C:\Windows\System\ZZuEygU.exe
  C:\Windows\System\ZZuEygU.exe
  2⤵
  PID:5468
- C:\Windows\System\xseIOqk.exe
  C:\Windows\System\xseIOqk.exe
  2⤵
  PID:5500
- C:\Windows\System\gViptdS.exe
  C:\Windows\System\gViptdS.exe
  2⤵
  PID:5536
- C:\Windows\System\aUKheZa.exe
  C:\Windows\System\aUKheZa.exe
  2⤵
  PID:5576
- C:\Windows\System\hBBekFd.exe
  C:\Windows\System\hBBekFd.exe
  2⤵
  PID:5592
- C:\Windows\System\RolnNAV.exe
  C:\Windows\System\RolnNAV.exe
  2⤵
  PID:5628
- C:\Windows\System\sPJPmYS.exe
  C:\Windows\System\sPJPmYS.exe
  2⤵
  PID:5644
- C:\Windows\System\WlhDXRH.exe
  C:\Windows\System\WlhDXRH.exe
  2⤵
  PID:5672
- C:\Windows\System\ZpOBojv.exe
  C:\Windows\System\ZpOBojv.exe
  2⤵
  PID:5712
- C:\Windows\System\LHnBjLR.exe
  C:\Windows\System\LHnBjLR.exe
  2⤵
  PID:5740
- C:\Windows\System\TtZNPPF.exe
  C:\Windows\System\TtZNPPF.exe
  2⤵
  PID:5764
- C:\Windows\System\OazERvX.exe
  C:\Windows\System\OazERvX.exe
  2⤵
  PID:5808
- C:\Windows\System\GzUsjDS.exe
  C:\Windows\System\GzUsjDS.exe
  2⤵
  PID:5832
- C:\Windows\System\qBoxKdJ.exe
  C:\Windows\System\qBoxKdJ.exe
  2⤵
  PID:5860
- C:\Windows\System\NKpPTWp.exe
  C:\Windows\System\NKpPTWp.exe
  2⤵
  PID:5900
- C:\Windows\System\EIaWtco.exe
  C:\Windows\System\EIaWtco.exe
  2⤵
  PID:5928
- C:\Windows\System\ghngIYK.exe
  C:\Windows\System\ghngIYK.exe
  2⤵
  PID:5944
- C:\Windows\System\QIfcgUB.exe
  C:\Windows\System\QIfcgUB.exe
  2⤵
  PID:5960
- C:\Windows\System\qndQDEJ.exe
  C:\Windows\System\qndQDEJ.exe
  2⤵
  PID:6000
- C:\Windows\System\qQOnkUz.exe
  C:\Windows\System\qQOnkUz.exe
  2⤵
  PID:6024
- C:\Windows\System\vbiVGrx.exe
  C:\Windows\System\vbiVGrx.exe
  2⤵
  PID:6040
- C:\Windows\System\VnJatkK.exe
  C:\Windows\System\VnJatkK.exe
  2⤵
  PID:6056
- C:\Windows\System\OgexIUk.exe
  C:\Windows\System\OgexIUk.exe
  2⤵
  PID:6088
- C:\Windows\System\qjwOfdR.exe
  C:\Windows\System\qjwOfdR.exe
  2⤵
  PID:6108
- C:\Windows\System\yJBtSTX.exe
  C:\Windows\System\yJBtSTX.exe
  2⤵
  PID:6128
- C:\Windows\System\QCaYbaN.exe
  C:\Windows\System\QCaYbaN.exe
  2⤵
  PID:5180
- C:\Windows\System\VXhNtFE.exe
  C:\Windows\System\VXhNtFE.exe
  2⤵
  PID:5244
- C:\Windows\System\ahAscBs.exe
  C:\Windows\System\ahAscBs.exe
  2⤵
  PID:5372
- C:\Windows\System\RySFYaW.exe
  C:\Windows\System\RySFYaW.exe
  2⤵
  PID:5520
- C:\Windows\System\sdlxUGB.exe
  C:\Windows\System\sdlxUGB.exe
  2⤵
  PID:4772
- C:\Windows\System\uAAFqlx.exe
  C:\Windows\System\uAAFqlx.exe
  2⤵
  PID:5336
- C:\Windows\System\UVPCXeu.exe
  C:\Windows\System\UVPCXeu.exe
  2⤵
  PID:5588
- C:\Windows\System\iyOrXSS.exe
  C:\Windows\System\iyOrXSS.exe
  2⤵
  PID:5636
- C:\Windows\System\LAXnVQB.exe
  C:\Windows\System\LAXnVQB.exe
  2⤵
  PID:5728
- C:\Windows\System\caULlQX.exe
  C:\Windows\System\caULlQX.exe
  2⤵
  PID:5852
- C:\Windows\System\FiuAjQP.exe
  C:\Windows\System\FiuAjQP.exe
  2⤵
  PID:5884
- C:\Windows\System\ZtnWCzI.exe
  C:\Windows\System\ZtnWCzI.exe
  2⤵
  PID:5980
- C:\Windows\System\GzIxzSl.exe
  C:\Windows\System\GzIxzSl.exe
  2⤵
  PID:6036
- C:\Windows\System\GGtsvsk.exe
  C:\Windows\System\GGtsvsk.exe
  2⤵
  PID:6124
- C:\Windows\System\gqZPWvf.exe
  C:\Windows\System\gqZPWvf.exe
  2⤵
  PID:5340
- C:\Windows\System\laLBTHP.exe
  C:\Windows\System\laLBTHP.exe
  2⤵
  PID:5312
- C:\Windows\System\jSLXcxP.exe
  C:\Windows\System\jSLXcxP.exe
  2⤵
  PID:5284
- C:\Windows\System\QPuGuxx.exe
  C:\Windows\System\QPuGuxx.exe
  2⤵
  PID:5700
- C:\Windows\System\prhXilQ.exe
  C:\Windows\System\prhXilQ.exe
  2⤵
  PID:5912
- C:\Windows\System\dnQdZmW.exe
  C:\Windows\System\dnQdZmW.exe
  2⤵
  PID:6032
- C:\Windows\System\omCeYYs.exe
  C:\Windows\System\omCeYYs.exe
  2⤵
  PID:5128
- C:\Windows\System\FoMHvtl.exe
  C:\Windows\System\FoMHvtl.exe
  2⤵
  PID:5544
- C:\Windows\System\tUyaSbq.exe
  C:\Windows\System\tUyaSbq.exe
  2⤵
  PID:5972
- C:\Windows\System\JlSWMic.exe
  C:\Windows\System\JlSWMic.exe
  2⤵
  PID:5276
- C:\Windows\System\chXvztF.exe
  C:\Windows\System\chXvztF.exe
  2⤵
  PID:5476
- C:\Windows\System\qFxjtwl.exe
  C:\Windows\System\qFxjtwl.exe
  2⤵
  PID:6160
- C:\Windows\System\qxvrXrw.exe
  C:\Windows\System\qxvrXrw.exe
  2⤵
  PID:6196
- C:\Windows\System\tjOKLGq.exe
  C:\Windows\System\tjOKLGq.exe
  2⤵
  PID:6220
- C:\Windows\System\AZYkrHh.exe
  C:\Windows\System\AZYkrHh.exe
  2⤵
  PID:6236
- C:\Windows\System\vHpwyFu.exe
  C:\Windows\System\vHpwyFu.exe
  2⤵
  PID:6252
- C:\Windows\System\FVjMmZx.exe
  C:\Windows\System\FVjMmZx.exe
  2⤵
  PID:6280
- C:\Windows\System\OikNPAF.exe
  C:\Windows\System\OikNPAF.exe
  2⤵
  PID:6296
- C:\Windows\System\FvgsUAV.exe
  C:\Windows\System\FvgsUAV.exe
  2⤵
  PID:6332
- C:\Windows\System\IvTYKCi.exe
  C:\Windows\System\IvTYKCi.exe
  2⤵
  PID:6364
- C:\Windows\System\XiFWCZx.exe
  C:\Windows\System\XiFWCZx.exe
  2⤵
  PID:6404
- C:\Windows\System\vQqbrYa.exe
  C:\Windows\System\vQqbrYa.exe
  2⤵
  PID:6448
- C:\Windows\System\EFVaMlh.exe
  C:\Windows\System\EFVaMlh.exe
  2⤵
  PID:6472
- C:\Windows\System\qNiuzod.exe
  C:\Windows\System\qNiuzod.exe
  2⤵
  PID:6508
- C:\Windows\System\farfQfs.exe
  C:\Windows\System\farfQfs.exe
  2⤵
  PID:6544
- C:\Windows\System\XIrLori.exe
  C:\Windows\System\XIrLori.exe
  2⤵
  PID:6572
- C:\Windows\System\pRtSDvG.exe
  C:\Windows\System\pRtSDvG.exe
  2⤵
  PID:6612
- C:\Windows\System\thIwCLn.exe
  C:\Windows\System\thIwCLn.exe
  2⤵
  PID:6644
- C:\Windows\System\VIEiFxr.exe
  C:\Windows\System\VIEiFxr.exe
  2⤵
  PID:6680
- C:\Windows\System\bnoHWWr.exe
  C:\Windows\System\bnoHWWr.exe
  2⤵
  PID:6712
- C:\Windows\System\xImCoWk.exe
  C:\Windows\System\xImCoWk.exe
  2⤵
  PID:6740
- C:\Windows\System\LvUbbjH.exe
  C:\Windows\System\LvUbbjH.exe
  2⤵
  PID:6768
- C:\Windows\System\xaIXVmk.exe
  C:\Windows\System\xaIXVmk.exe
  2⤵
  PID:6796
- C:\Windows\System\vqLtpur.exe
  C:\Windows\System\vqLtpur.exe
  2⤵
  PID:6812
- C:\Windows\System\ZJzUEPw.exe
  C:\Windows\System\ZJzUEPw.exe
  2⤵
  PID:6852
- C:\Windows\System\vFmKgux.exe
  C:\Windows\System\vFmKgux.exe
  2⤵
  PID:6884
- C:\Windows\System\lNKERQl.exe
  C:\Windows\System\lNKERQl.exe
  2⤵
  PID:6912
- C:\Windows\System\BvDbpPM.exe
  C:\Windows\System\BvDbpPM.exe
  2⤵
  PID:6944
- C:\Windows\System\TgzZDLp.exe
  C:\Windows\System\TgzZDLp.exe
  2⤵
  PID:6968
- C:\Windows\System\ERHizlN.exe
  C:\Windows\System\ERHizlN.exe
  2⤵
  PID:6984
- C:\Windows\System\emEIAmF.exe
  C:\Windows\System\emEIAmF.exe
  2⤵
  PID:7020
- C:\Windows\System\QArrOJp.exe
  C:\Windows\System\QArrOJp.exe
  2⤵
  PID:7048
- C:\Windows\System\GPuvnBL.exe
  C:\Windows\System\GPuvnBL.exe
  2⤵
  PID:7080
- C:\Windows\System\RaNiOLV.exe
  C:\Windows\System\RaNiOLV.exe
  2⤵
  PID:7096
- C:\Windows\System\whcVxQj.exe
  C:\Windows\System\whcVxQj.exe
  2⤵
  PID:7132
- C:\Windows\System\aycjicy.exe
  C:\Windows\System\aycjicy.exe
  2⤵
  PID:7156
- C:\Windows\System\mNkARfH.exe
  C:\Windows\System\mNkARfH.exe
  2⤵
  PID:6188
- C:\Windows\System\MSNrskq.exe
  C:\Windows\System\MSNrskq.exe
  2⤵
  PID:6228
- C:\Windows\System\dBXPaio.exe
  C:\Windows\System\dBXPaio.exe
  2⤵
  PID:6292
- C:\Windows\System\KquzZiO.exe
  C:\Windows\System\KquzZiO.exe
  2⤵
  PID:6372
- C:\Windows\System\LowPKQD.exe
  C:\Windows\System\LowPKQD.exe
  2⤵
  PID:6440
- C:\Windows\System\XoWrmbt.exe
  C:\Windows\System\XoWrmbt.exe
  2⤵
  PID:6540
- C:\Windows\System\IzoIrMD.exe
  C:\Windows\System\IzoIrMD.exe
  2⤵
  PID:6608
- C:\Windows\System\MBzzqcS.exe
  C:\Windows\System\MBzzqcS.exe
  2⤵
  PID:6692
- C:\Windows\System\YcoqqLS.exe
  C:\Windows\System\YcoqqLS.exe
  2⤵
  PID:6736
- C:\Windows\System\mmnbNeA.exe
  C:\Windows\System\mmnbNeA.exe
  2⤵
  PID:6764
- C:\Windows\System\HBKLjly.exe
  C:\Windows\System\HBKLjly.exe
  2⤵
  PID:6804
- C:\Windows\System\jQwkhcj.exe
  C:\Windows\System\jQwkhcj.exe
  2⤵
  PID:6904
- C:\Windows\System\tZjXBnQ.exe
  C:\Windows\System\tZjXBnQ.exe
  2⤵
  PID:6996
- C:\Windows\System\ryyXFzF.exe
  C:\Windows\System\ryyXFzF.exe
  2⤵
  PID:7040
- C:\Windows\System\TTxKMiV.exe
  C:\Windows\System\TTxKMiV.exe
  2⤵
  PID:7128
- C:\Windows\System\DKJuRtW.exe
  C:\Windows\System\DKJuRtW.exe
  2⤵
  PID:6268
- C:\Windows\System\aVPrPDK.exe
  C:\Windows\System\aVPrPDK.exe
  2⤵
  PID:6344
- C:\Windows\System\yVnXdvG.exe
  C:\Windows\System\yVnXdvG.exe
  2⤵
  PID:6584
- C:\Windows\System\VnrfHBu.exe
  C:\Windows\System\VnrfHBu.exe
  2⤵
  PID:6752
- C:\Windows\System\EvkFGyn.exe
  C:\Windows\System\EvkFGyn.exe
  2⤵
  PID:6836
- C:\Windows\System\BmCqnYl.exe
  C:\Windows\System\BmCqnYl.exe
  2⤵
  PID:6956
- C:\Windows\System\HKxyogR.exe
  C:\Windows\System\HKxyogR.exe
  2⤵
  PID:7076
- C:\Windows\System\YxvPKPy.exe
  C:\Windows\System\YxvPKPy.exe
  2⤵
  PID:6324
- C:\Windows\System\zEASyky.exe
  C:\Windows\System\zEASyky.exe
  2⤵
  PID:6760
- C:\Windows\System\OkFrgjR.exe
  C:\Windows\System\OkFrgjR.exe
  2⤵
  PID:7108
- C:\Windows\System\WwXfKuv.exe
  C:\Windows\System\WwXfKuv.exe
  2⤵
  PID:7200
- C:\Windows\System\KAabJdu.exe
  C:\Windows\System\KAabJdu.exe
  2⤵
  PID:7228
- C:\Windows\System\JKgXROh.exe
  C:\Windows\System\JKgXROh.exe
  2⤵
  PID:7248
- C:\Windows\System\FRHURAg.exe
  C:\Windows\System\FRHURAg.exe
  2⤵
  PID:7288
- C:\Windows\System\zYuuaJq.exe
  C:\Windows\System\zYuuaJq.exe
  2⤵
  PID:7304
- C:\Windows\System\ekZjfKK.exe
  C:\Windows\System\ekZjfKK.exe
  2⤵
  PID:7336
- C:\Windows\System\MtroxDL.exe
  C:\Windows\System\MtroxDL.exe
  2⤵
  PID:7368
- C:\Windows\System\keNBQJO.exe
  C:\Windows\System\keNBQJO.exe
  2⤵
  PID:7388
- C:\Windows\System\KsPuvpo.exe
  C:\Windows\System\KsPuvpo.exe
  2⤵
  PID:7408
- C:\Windows\System\OjahvTp.exe
  C:\Windows\System\OjahvTp.exe
  2⤵
  PID:7432
- C:\Windows\System\TbRgANx.exe
  C:\Windows\System\TbRgANx.exe
  2⤵
  PID:7468
- C:\Windows\System\gwSTUDy.exe
  C:\Windows\System\gwSTUDy.exe
  2⤵
  PID:7500
- C:\Windows\System\GaGkrzd.exe
  C:\Windows\System\GaGkrzd.exe
  2⤵
  PID:7540
- C:\Windows\System\ljUpqsT.exe
  C:\Windows\System\ljUpqsT.exe
  2⤵
  PID:7560
- C:\Windows\System\gdIHBFj.exe
  C:\Windows\System\gdIHBFj.exe
  2⤵
  PID:7596
- C:\Windows\System\KokHAMI.exe
  C:\Windows\System\KokHAMI.exe
  2⤵
  PID:7640
- C:\Windows\System\vUmOKzN.exe
  C:\Windows\System\vUmOKzN.exe
  2⤵
  PID:7668
- C:\Windows\System\Fnxuopz.exe
  C:\Windows\System\Fnxuopz.exe
  2⤵
  PID:7696
- C:\Windows\System\boXnDgJ.exe
  C:\Windows\System\boXnDgJ.exe
  2⤵
  PID:7720
- C:\Windows\System\ZEGCSQP.exe
  C:\Windows\System\ZEGCSQP.exe
  2⤵
  PID:7744
- C:\Windows\System\ReVNkLW.exe
  C:\Windows\System\ReVNkLW.exe
  2⤵
  PID:7784
- C:\Windows\System\GWsHKiC.exe
  C:\Windows\System\GWsHKiC.exe
  2⤵
  PID:7816
- C:\Windows\System\CfegbYJ.exe
  C:\Windows\System\CfegbYJ.exe
  2⤵
  PID:7860
- C:\Windows\System\gQjHoqU.exe
  C:\Windows\System\gQjHoqU.exe
  2⤵
  PID:7880
- C:\Windows\System\PpdVqjo.exe
  C:\Windows\System\PpdVqjo.exe
  2⤵
  PID:7916
- C:\Windows\System\XzuEcWs.exe
  C:\Windows\System\XzuEcWs.exe
  2⤵
  PID:7948
- C:\Windows\System\IYtZGGY.exe
  C:\Windows\System\IYtZGGY.exe
  2⤵
  PID:7976
- C:\Windows\System\zVVRUiX.exe
  C:\Windows\System\zVVRUiX.exe
  2⤵
  PID:8004
- C:\Windows\System\xyLFjbL.exe
  C:\Windows\System\xyLFjbL.exe
  2⤵
  PID:8028
- C:\Windows\System\NqDwbxr.exe
  C:\Windows\System\NqDwbxr.exe
  2⤵
  PID:8056
- C:\Windows\System\VJQltvC.exe
  C:\Windows\System\VJQltvC.exe
  2⤵
  PID:8084
- C:\Windows\System\CutuKrD.exe
  C:\Windows\System\CutuKrD.exe
  2⤵
  PID:8112
- C:\Windows\System\webTUJi.exe
  C:\Windows\System\webTUJi.exe
  2⤵
  PID:8144
- C:\Windows\System\mHNfHzk.exe
  C:\Windows\System\mHNfHzk.exe
  2⤵
  PID:8184
- C:\Windows\System\TELrDRd.exe
  C:\Windows\System\TELrDRd.exe
  2⤵
  PID:6808
- C:\Windows\System\QLuJtbs.exe
  C:\Windows\System\QLuJtbs.exe
  2⤵
  PID:7212
- C:\Windows\System\LmiOWdD.exe
  C:\Windows\System\LmiOWdD.exe
  2⤵
  PID:7284
- C:\Windows\System\jZDPRVX.exe
  C:\Windows\System\jZDPRVX.exe
  2⤵
  PID:7384
- C:\Windows\System\ujowwwb.exe
  C:\Windows\System\ujowwwb.exe
  2⤵
  PID:7444
- C:\Windows\System\BDXDKHm.exe
  C:\Windows\System\BDXDKHm.exe
  2⤵
  PID:7556
- C:\Windows\System\reKlvos.exe
  C:\Windows\System\reKlvos.exe
  2⤵
  PID:7636
- C:\Windows\System\DsOmZdJ.exe
  C:\Windows\System\DsOmZdJ.exe
  2⤵
  PID:7736
- C:\Windows\System\dSiThwa.exe
  C:\Windows\System\dSiThwa.exe
  2⤵
  PID:7756
- C:\Windows\System\acpGvjU.exe
  C:\Windows\System\acpGvjU.exe
  2⤵
  PID:7856
- C:\Windows\System\VgTeQrf.exe
  C:\Windows\System\VgTeQrf.exe
  2⤵
  PID:7928
- C:\Windows\System\ibmrRKS.exe
  C:\Windows\System\ibmrRKS.exe
  2⤵
  PID:8016
- C:\Windows\System\oXppTCB.exe
  C:\Windows\System\oXppTCB.exe
  2⤵
  PID:8104
- C:\Windows\System\aoDdJfe.exe
  C:\Windows\System\aoDdJfe.exe
  2⤵
  PID:6668
- C:\Windows\System\OTEdkHC.exe
  C:\Windows\System\OTEdkHC.exe
  2⤵
  PID:7300
- C:\Windows\System\BQmEsXX.exe
  C:\Windows\System\BQmEsXX.exe
  2⤵
  PID:7592
- C:\Windows\System\ntiLAQd.exe
  C:\Windows\System\ntiLAQd.exe
  2⤵
  PID:7872
- C:\Windows\System\cJBVkHb.exe
  C:\Windows\System\cJBVkHb.exe
  2⤵
  PID:8068
- C:\Windows\System\grncwww.exe
  C:\Windows\System\grncwww.exe
  2⤵
  PID:7236
- C:\Windows\System\qKGgZxX.exe
  C:\Windows\System\qKGgZxX.exe
  2⤵
  PID:7360
- C:\Windows\System\eypPMag.exe
  C:\Windows\System\eypPMag.exe
  2⤵
  PID:8024
- C:\Windows\System\rXSufvB.exe
  C:\Windows\System\rXSufvB.exe
  2⤵
  PID:8204
- C:\Windows\System\ayiJFSf.exe
  C:\Windows\System\ayiJFSf.exe
  2⤵
  PID:8240
- C:\Windows\System\IAxwEhq.exe
  C:\Windows\System\IAxwEhq.exe
  2⤵
  PID:8268
- C:\Windows\System\DRBeWol.exe
  C:\Windows\System\DRBeWol.exe
  2⤵
  PID:8300
- C:\Windows\System\EdbDQMM.exe
  C:\Windows\System\EdbDQMM.exe
  2⤵
  PID:8316
- C:\Windows\System\RZbDnoi.exe
  C:\Windows\System\RZbDnoi.exe
  2⤵
  PID:8336
- C:\Windows\System\fZrXOwk.exe
  C:\Windows\System\fZrXOwk.exe
  2⤵
  PID:8368
- C:\Windows\System\ALiRBWR.exe
  C:\Windows\System\ALiRBWR.exe
  2⤵
  PID:8396
- C:\Windows\System\iWjwFsk.exe
  C:\Windows\System\iWjwFsk.exe
  2⤵
  PID:8436
- C:\Windows\System\EyfWDAF.exe
  C:\Windows\System\EyfWDAF.exe
  2⤵
  PID:8472
- C:\Windows\System\WnxNNJX.exe
  C:\Windows\System\WnxNNJX.exe
  2⤵
  PID:8492
- C:\Windows\System\TECSvBg.exe
  C:\Windows\System\TECSvBg.exe
  2⤵
  PID:8512
- C:\Windows\System\JeQQvcf.exe
  C:\Windows\System\JeQQvcf.exe
  2⤵
  PID:8528
- C:\Windows\System\izCSoPZ.exe
  C:\Windows\System\izCSoPZ.exe
  2⤵
  PID:8556
- C:\Windows\System\vAhTWkE.exe
  C:\Windows\System\vAhTWkE.exe
  2⤵
  PID:8592
- C:\Windows\System\Ulagxsw.exe
  C:\Windows\System\Ulagxsw.exe
  2⤵
  PID:8620
- C:\Windows\System\eCpKdZb.exe
  C:\Windows\System\eCpKdZb.exe
  2⤵
  PID:8656
- C:\Windows\System\pkHzHdS.exe
  C:\Windows\System\pkHzHdS.exe
  2⤵
  PID:8684
- C:\Windows\System\VyxYEDL.exe
  C:\Windows\System\VyxYEDL.exe
  2⤵
  PID:8712
- C:\Windows\System\bQpYaku.exe
  C:\Windows\System\bQpYaku.exe
  2⤵
  PID:8732
- C:\Windows\System\YoNRTdT.exe
  C:\Windows\System\YoNRTdT.exe
  2⤵
  PID:8764
- C:\Windows\System\jQwSFOf.exe
  C:\Windows\System\jQwSFOf.exe
  2⤵
  PID:8796
- C:\Windows\System\UKFXBKy.exe
  C:\Windows\System\UKFXBKy.exe
  2⤵
  PID:8832
- C:\Windows\System\KnDXJVB.exe
  C:\Windows\System\KnDXJVB.exe
  2⤵
  PID:8864
- C:\Windows\System\ycnWFkY.exe
  C:\Windows\System\ycnWFkY.exe
  2⤵
  PID:8900
- C:\Windows\System\mWQUbzm.exe
  C:\Windows\System\mWQUbzm.exe
  2⤵
  PID:8920
- C:\Windows\System\SAKSFmf.exe
  C:\Windows\System\SAKSFmf.exe
  2⤵
  PID:8952
- C:\Windows\System\ibHkynK.exe
  C:\Windows\System\ibHkynK.exe
  2⤵
  PID:8984
- C:\Windows\System\qxBiUOQ.exe
  C:\Windows\System\qxBiUOQ.exe
  2⤵
  PID:9020
- C:\Windows\System\IGSGmhu.exe
  C:\Windows\System\IGSGmhu.exe
  2⤵
  PID:9052
- C:\Windows\System\bqGmlmm.exe
  C:\Windows\System\bqGmlmm.exe
  2⤵
  PID:9088
- C:\Windows\System\duRXntz.exe
  C:\Windows\System\duRXntz.exe
  2⤵
  PID:9124
- C:\Windows\System\NZolodG.exe
  C:\Windows\System\NZolodG.exe
  2⤵
  PID:9160
- C:\Windows\System\rBLLHyp.exe
  C:\Windows\System\rBLLHyp.exe
  2⤵
  PID:9180
- C:\Windows\System\ktEWPHx.exe
  C:\Windows\System\ktEWPHx.exe
  2⤵
  PID:9200
- C:\Windows\System\wWqScFD.exe
  C:\Windows\System\wWqScFD.exe
  2⤵
  PID:8200
- C:\Windows\System\ubgyPKN.exe
  C:\Windows\System\ubgyPKN.exe
  2⤵
  PID:8260
- C:\Windows\System\GinxyDD.exe
  C:\Windows\System\GinxyDD.exe
  2⤵
  PID:8352
- C:\Windows\System\deazjvw.exe
  C:\Windows\System\deazjvw.exe
  2⤵
  PID:8432
- C:\Windows\System\dNeyswz.exe
  C:\Windows\System\dNeyswz.exe
  2⤵
  PID:8480
- C:\Windows\System\gtPkRxH.exe
  C:\Windows\System\gtPkRxH.exe
  2⤵
  PID:8572
- C:\Windows\System\AZQgZIu.exe
  C:\Windows\System\AZQgZIu.exe
  2⤵
  PID:8608
- C:\Windows\System\eoWoLWI.exe
  C:\Windows\System\eoWoLWI.exe
  2⤵
  PID:8676
- C:\Windows\System\JbPkFzO.exe
  C:\Windows\System\JbPkFzO.exe
  2⤵
  PID:8820
- C:\Windows\System\vuYLacN.exe
  C:\Windows\System\vuYLacN.exe
  2⤵
  PID:8824
- C:\Windows\System\jBCfCwn.exe
  C:\Windows\System\jBCfCwn.exe
  2⤵
  PID:8908
- C:\Windows\System\mOUdrRq.exe
  C:\Windows\System\mOUdrRq.exe
  2⤵
  PID:8972
- C:\Windows\System\nKlpehL.exe
  C:\Windows\System\nKlpehL.exe
  2⤵
  PID:9036
- C:\Windows\System\vyNfwOq.exe
  C:\Windows\System\vyNfwOq.exe
  2⤵
  PID:9136
- C:\Windows\System\OVRNkQG.exe
  C:\Windows\System\OVRNkQG.exe
  2⤵
  PID:8168
- C:\Windows\System\HCNBIKb.exe
  C:\Windows\System\HCNBIKb.exe
  2⤵
  PID:8284
- C:\Windows\System\OjyENdY.exe
  C:\Windows\System\OjyENdY.exe
  2⤵
  PID:7260
- C:\Windows\System\LHiwwSR.exe
  C:\Windows\System\LHiwwSR.exe
  2⤵
  PID:8568
- C:\Windows\System\ZJDOapD.exe
  C:\Windows\System\ZJDOapD.exe
  2⤵
  PID:8744
- C:\Windows\System\qxVkdkY.exe
  C:\Windows\System\qxVkdkY.exe
  2⤵
  PID:8876
- C:\Windows\System\EeZGOJB.exe
  C:\Windows\System\EeZGOJB.exe
  2⤵
  PID:9120
- C:\Windows\System\QzmQEor.exe
  C:\Windows\System\QzmQEor.exe
  2⤵
  PID:8328
- C:\Windows\System\uprdRBI.exe
  C:\Windows\System\uprdRBI.exe
  2⤵
  PID:8680
- C:\Windows\System\dURTROu.exe
  C:\Windows\System\dURTROu.exe
  2⤵
  PID:9112
- C:\Windows\System\pXEnQGt.exe
  C:\Windows\System\pXEnQGt.exe
  2⤵
  PID:8884
- C:\Windows\System\DTpeRqO.exe
  C:\Windows\System\DTpeRqO.exe
  2⤵
  PID:9232
- C:\Windows\System\IjsGtjm.exe
  C:\Windows\System\IjsGtjm.exe
  2⤵
  PID:9252
- C:\Windows\System\xLYxnzk.exe
  C:\Windows\System\xLYxnzk.exe
  2⤵
  PID:9276
- C:\Windows\System\qznGpcR.exe
  C:\Windows\System\qznGpcR.exe
  2⤵
  PID:9304
- C:\Windows\System\EppqMwi.exe
  C:\Windows\System\EppqMwi.exe
  2⤵
  PID:9332
- C:\Windows\System\udjKYSH.exe
  C:\Windows\System\udjKYSH.exe
  2⤵
  PID:9352
- C:\Windows\System\uJTLtAA.exe
  C:\Windows\System\uJTLtAA.exe
  2⤵
  PID:9372
- C:\Windows\System\nHGkKMp.exe
  C:\Windows\System\nHGkKMp.exe
  2⤵
  PID:9392
- C:\Windows\System\HShoYkq.exe
  C:\Windows\System\HShoYkq.exe
  2⤵
  PID:9424
- C:\Windows\System\afNKyXU.exe
  C:\Windows\System\afNKyXU.exe
  2⤵
  PID:9444
- C:\Windows\System\QAdtMhh.exe
  C:\Windows\System\QAdtMhh.exe
  2⤵
  PID:9484
- C:\Windows\System\XkVoHhE.exe
  C:\Windows\System\XkVoHhE.exe
  2⤵
  PID:9520
- C:\Windows\System\BFYzKPI.exe
  C:\Windows\System\BFYzKPI.exe
  2⤵
  PID:9560
- C:\Windows\System\Demgihn.exe
  C:\Windows\System\Demgihn.exe
  2⤵
  PID:9596
- C:\Windows\System\BLMUGbX.exe
  C:\Windows\System\BLMUGbX.exe
  2⤵
  PID:9628
- C:\Windows\System\AKjKuKs.exe
  C:\Windows\System\AKjKuKs.exe
  2⤵
  PID:9644
- C:\Windows\System\vyHDLca.exe
  C:\Windows\System\vyHDLca.exe
  2⤵
  PID:9672
- C:\Windows\System\HXJXvMO.exe
  C:\Windows\System\HXJXvMO.exe
  2⤵
  PID:9708
- C:\Windows\System\drfBYfl.exe
  C:\Windows\System\drfBYfl.exe
  2⤵
  PID:9740
- C:\Windows\System\FXWgHcU.exe
  C:\Windows\System\FXWgHcU.exe
  2⤵
  PID:9768
- C:\Windows\System\zmKxjTW.exe
  C:\Windows\System\zmKxjTW.exe
  2⤵
  PID:9792
- C:\Windows\System\YWobWyj.exe
  C:\Windows\System\YWobWyj.exe
  2⤵
  PID:9820
- C:\Windows\System\PMXEuFO.exe
  C:\Windows\System\PMXEuFO.exe
  2⤵
  PID:9836
- C:\Windows\System\uVVyxlp.exe
  C:\Windows\System\uVVyxlp.exe
  2⤵
  PID:9852
- C:\Windows\System\hVyuZYw.exe
  C:\Windows\System\hVyuZYw.exe
  2⤵
  PID:9880
- C:\Windows\System\mvGorDy.exe
  C:\Windows\System\mvGorDy.exe
  2⤵
  PID:9916
- C:\Windows\System\fLjpjVs.exe
  C:\Windows\System\fLjpjVs.exe
  2⤵
  PID:9952
- C:\Windows\System\dwTRjxW.exe
  C:\Windows\System\dwTRjxW.exe
  2⤵
  PID:9976
- C:\Windows\System\IHBWbHi.exe
  C:\Windows\System\IHBWbHi.exe
  2⤵
  PID:10016
- C:\Windows\System\EtIrMGd.exe
  C:\Windows\System\EtIrMGd.exe
  2⤵
  PID:10048
- C:\Windows\System\JyWrnAV.exe
  C:\Windows\System\JyWrnAV.exe
  2⤵
  PID:10076
- C:\Windows\System\obKemxl.exe
  C:\Windows\System\obKemxl.exe
  2⤵
  PID:10112
- C:\Windows\System\jIRxxkZ.exe
  C:\Windows\System\jIRxxkZ.exe
  2⤵
  PID:10128
- C:\Windows\System\JTLFZxs.exe
  C:\Windows\System\JTLFZxs.exe
  2⤵
  PID:10156
- C:\Windows\System\pspsXnx.exe
  C:\Windows\System\pspsXnx.exe
  2⤵
  PID:10184
- C:\Windows\System\xONehfk.exe
  C:\Windows\System\xONehfk.exe
  2⤵
  PID:10216
- C:\Windows\System\QxADlVa.exe
  C:\Windows\System\QxADlVa.exe
  2⤵
  PID:8584
- C:\Windows\System\PPPXUBp.exe
  C:\Windows\System\PPPXUBp.exe
  2⤵
  PID:9264
- C:\Windows\System\XGdhrHQ.exe
  C:\Windows\System\XGdhrHQ.exe
  2⤵
  PID:9324
- C:\Windows\System\WAOZbpv.exe
  C:\Windows\System\WAOZbpv.exe
  2⤵
  PID:9360
- C:\Windows\System\iXRXUGW.exe
  C:\Windows\System\iXRXUGW.exe
  2⤵
  PID:9432
- C:\Windows\System\CPbypRw.exe
  C:\Windows\System\CPbypRw.exe
  2⤵
  PID:9532
- C:\Windows\System\hoPRjwR.exe
  C:\Windows\System\hoPRjwR.exe
  2⤵
  PID:9588
- C:\Windows\System\CPCTNMc.exe
  C:\Windows\System\CPCTNMc.exe
  2⤵
  PID:9636
- C:\Windows\System\orokpZI.exe
  C:\Windows\System\orokpZI.exe
  2⤵
  PID:9684
- C:\Windows\System\VSzEMcN.exe
  C:\Windows\System\VSzEMcN.exe
  2⤵
  PID:9760
- C:\Windows\System\EqDlcPu.exe
  C:\Windows\System\EqDlcPu.exe
  2⤵
  PID:9828
- C:\Windows\System\NDaToay.exe
  C:\Windows\System\NDaToay.exe
  2⤵
  PID:9900
- C:\Windows\System\nGMUJCF.exe
  C:\Windows\System\nGMUJCF.exe
  2⤵
  PID:9992
- C:\Windows\System\KlhUfCd.exe
  C:\Windows\System\KlhUfCd.exe
  2⤵
  PID:10072
- C:\Windows\System\uWeRcKl.exe
  C:\Windows\System\uWeRcKl.exe
  2⤵
  PID:10140
- C:\Windows\System\EfIsyST.exe
  C:\Windows\System\EfIsyST.exe
  2⤵
  PID:10200
- C:\Windows\System\vcHECgs.exe
  C:\Windows\System\vcHECgs.exe
  2⤵
  PID:9296
- C:\Windows\System\iypscBz.exe
  C:\Windows\System\iypscBz.exe
  2⤵
  PID:9476
- C:\Windows\System\jUHBYlP.exe
  C:\Windows\System\jUHBYlP.exe
  2⤵
  PID:9584
- C:\Windows\System\eEduSDU.exe
  C:\Windows\System\eEduSDU.exe
  2⤵
  PID:9800
- C:\Windows\System\IbuweBy.exe
  C:\Windows\System\IbuweBy.exe
  2⤵
  PID:9944
- C:\Windows\System\XeDoFNR.exe
  C:\Windows\System\XeDoFNR.exe
  2⤵
  PID:10144
- C:\Windows\System\xpyNIbl.exe
  C:\Windows\System\xpyNIbl.exe
  2⤵
  PID:9288
- C:\Windows\System\FUuDIPP.exe
  C:\Windows\System\FUuDIPP.exe
  2⤵
  PID:9616
- C:\Windows\System\srMlEsd.exe
  C:\Windows\System\srMlEsd.exe
  2⤵
  PID:10212
- C:\Windows\System\UirFsHF.exe
  C:\Windows\System\UirFsHF.exe
  2⤵
  PID:10256
- C:\Windows\System\HnjDTcz.exe
  C:\Windows\System\HnjDTcz.exe
  2⤵
  PID:10296
- C:\Windows\System\ucJrIGD.exe
  C:\Windows\System\ucJrIGD.exe
  2⤵
  PID:10324
- C:\Windows\System\XnivZak.exe
  C:\Windows\System\XnivZak.exe
  2⤵
  PID:10352
- C:\Windows\System\fgwdKEU.exe
  C:\Windows\System\fgwdKEU.exe
  2⤵
  PID:10380
- C:\Windows\System\WCYtNCR.exe
  C:\Windows\System\WCYtNCR.exe
  2⤵
  PID:10408
- C:\Windows\System\GjLMQaa.exe
  C:\Windows\System\GjLMQaa.exe
  2⤵
  PID:10436
- C:\Windows\System\LQjctMl.exe
  C:\Windows\System\LQjctMl.exe
  2⤵
  PID:10464
- C:\Windows\System\byGGehz.exe
  C:\Windows\System\byGGehz.exe
  2⤵
  PID:10492
- C:\Windows\System\zjkTkQQ.exe
  C:\Windows\System\zjkTkQQ.exe
  2⤵
  PID:10524
- C:\Windows\System\TVrnDhi.exe
  C:\Windows\System\TVrnDhi.exe
  2⤵
  PID:10552
- C:\Windows\System\zOxXmMX.exe
  C:\Windows\System\zOxXmMX.exe
  2⤵
  PID:10580
- C:\Windows\System\heHtyIA.exe
  C:\Windows\System\heHtyIA.exe
  2⤵
  PID:10608
- C:\Windows\System\xNobMrh.exe
  C:\Windows\System\xNobMrh.exe
  2⤵
  PID:10636
- C:\Windows\System\GrWSwnL.exe
  C:\Windows\System\GrWSwnL.exe
  2⤵
  PID:10664
- C:\Windows\System\HkSzFIO.exe
  C:\Windows\System\HkSzFIO.exe
  2⤵
  PID:10692
- C:\Windows\System\ytRKBDs.exe
  C:\Windows\System\ytRKBDs.exe
  2⤵
  PID:10720
- C:\Windows\System\iaCkzPc.exe
  C:\Windows\System\iaCkzPc.exe
  2⤵
  PID:10748
- C:\Windows\System\gbEfdMj.exe
  C:\Windows\System\gbEfdMj.exe
  2⤵
  PID:10764
- C:\Windows\System\IXHJFXU.exe
  C:\Windows\System\IXHJFXU.exe
  2⤵
  PID:10796
- C:\Windows\System\UrlqKPY.exe
  C:\Windows\System\UrlqKPY.exe
  2⤵
  PID:10832
- C:\Windows\System\fQerYiW.exe
  C:\Windows\System\fQerYiW.exe
  2⤵
  PID:10860
- C:\Windows\System\Ljovkxw.exe
  C:\Windows\System\Ljovkxw.exe
  2⤵
  PID:10888
- C:\Windows\System\HDSANfP.exe
  C:\Windows\System\HDSANfP.exe
  2⤵
  PID:10916
- C:\Windows\System\MxMyzmE.exe
  C:\Windows\System\MxMyzmE.exe
  2⤵
  PID:10932
- C:\Windows\System\TqxhwRP.exe
  C:\Windows\System\TqxhwRP.exe
  2⤵
  PID:10972
- C:\Windows\System\fKsQQBe.exe
  C:\Windows\System\fKsQQBe.exe
  2⤵
  PID:11000
- C:\Windows\System\OlQzZTB.exe
  C:\Windows\System\OlQzZTB.exe
  2⤵
  PID:11028
- C:\Windows\System\oCQIyjm.exe
  C:\Windows\System\oCQIyjm.exe
  2⤵
  PID:11044
- C:\Windows\System\ISShjbx.exe
  C:\Windows\System\ISShjbx.exe
  2⤵
  PID:11084
- C:\Windows\System\wfRvtyi.exe
  C:\Windows\System\wfRvtyi.exe
  2⤵
  PID:11112
- C:\Windows\System\VDjnRrV.exe
  C:\Windows\System\VDjnRrV.exe
  2⤵
  PID:11140
- C:\Windows\System\YTNEPSU.exe
  C:\Windows\System\YTNEPSU.exe
  2⤵
  PID:11168
- C:\Windows\System\rAfetts.exe
  C:\Windows\System\rAfetts.exe
  2⤵
  PID:11196
- C:\Windows\System\oXVSuUq.exe
  C:\Windows\System\oXVSuUq.exe
  2⤵
  PID:11224
- C:\Windows\System\hVjrshp.exe
  C:\Windows\System\hVjrshp.exe
  2⤵
  PID:11252
- C:\Windows\System\RvHEwEv.exe
  C:\Windows\System\RvHEwEv.exe
  2⤵
  PID:10056
- C:\Windows\System\zxZyEwo.exe
  C:\Windows\System\zxZyEwo.exe
  2⤵
  PID:10292
- C:\Windows\System\dtPwqNV.exe
  C:\Windows\System\dtPwqNV.exe
  2⤵
  PID:10336
- C:\Windows\System\jakPDgP.exe
  C:\Windows\System\jakPDgP.exe
  2⤵
  PID:10372
- C:\Windows\System\FLxTrFF.exe
  C:\Windows\System\FLxTrFF.exe
  2⤵
  PID:10420
- C:\Windows\System\BwepYxY.exe
  C:\Windows\System\BwepYxY.exe
  2⤵
  PID:10536
- C:\Windows\System\finpych.exe
  C:\Windows\System\finpych.exe
  2⤵
  PID:10572
- C:\Windows\System\DVoaIGY.exe
  C:\Windows\System\DVoaIGY.exe
  2⤵
  PID:10660
- C:\Windows\System\FMWIpIv.exe
  C:\Windows\System\FMWIpIv.exe
  2⤵
  PID:10744
- C:\Windows\System\CjJyFKm.exe
  C:\Windows\System\CjJyFKm.exe
  2⤵
  PID:10784
- C:\Windows\System\jcsulJJ.exe
  C:\Windows\System\jcsulJJ.exe
  2⤵
  PID:10856
- C:\Windows\System\DiZEFju.exe
  C:\Windows\System\DiZEFju.exe
  2⤵
  PID:10912
- C:\Windows\System\jmkvFvI.exe
  C:\Windows\System\jmkvFvI.exe
  2⤵
  PID:10984
- C:\Windows\System\EUvMGbC.exe
  C:\Windows\System\EUvMGbC.exe
  2⤵
  PID:11040
- C:\Windows\System\szFHooD.exe
  C:\Windows\System\szFHooD.exe
  2⤵
  PID:11124
- C:\Windows\System\PVZwLUh.exe
  C:\Windows\System\PVZwLUh.exe
  2⤵
  PID:11180
- C:\Windows\System\gFkrMeb.exe
  C:\Windows\System\gFkrMeb.exe
  2⤵
  PID:11244
- C:\Windows\System\zsuUHHM.exe
  C:\Windows\System\zsuUHHM.exe
  2⤵
  PID:10284
- C:\Windows\System\WDBbEfz.exe
  C:\Windows\System\WDBbEfz.exe
  2⤵
  PID:10404
- C:\Windows\System\GPVGxPI.exe
  C:\Windows\System\GPVGxPI.exe
  2⤵
  PID:10716
- C:\Windows\System\rcPXfNU.exe
  C:\Windows\System\rcPXfNU.exe
  2⤵
  PID:10848
- C:\Windows\System\kXhrtGt.exe
  C:\Windows\System\kXhrtGt.exe
  2⤵
  PID:11036
- C:\Windows\System\kRohvXd.exe
  C:\Windows\System\kRohvXd.exe
  2⤵
  PID:11160
- C:\Windows\System\hqrkgYW.exe
  C:\Windows\System\hqrkgYW.exe
  2⤵
  PID:11216
- C:\Windows\System\IzKqwkp.exe
  C:\Windows\System\IzKqwkp.exe
  2⤵
  PID:10448
- C:\Windows\System\erEdSKn.exe
  C:\Windows\System\erEdSKn.exe
  2⤵
  PID:10924
- C:\Windows\System\rkNyBKG.exe
  C:\Windows\System\rkNyBKG.exe
  2⤵
  PID:11236
- C:\Windows\System\KfKOxCd.exe
  C:\Windows\System\KfKOxCd.exe
  2⤵
  PID:10392
- C:\Windows\System\mllcPQu.exe
  C:\Windows\System\mllcPQu.exe
  2⤵
  PID:11080
- C:\Windows\System\QPFoSMx.exe
  C:\Windows\System\QPFoSMx.exe
  2⤵
  PID:11284
- C:\Windows\System\iCyxkVi.exe
  C:\Windows\System\iCyxkVi.exe
  2⤵
  PID:11316
- C:\Windows\System\XScOjGS.exe
  C:\Windows\System\XScOjGS.exe
  2⤵
  PID:11344
- C:\Windows\System\wNsuIkZ.exe
  C:\Windows\System\wNsuIkZ.exe
  2⤵
  PID:11372
- C:\Windows\System\WMlsBBS.exe
  C:\Windows\System\WMlsBBS.exe
  2⤵
  PID:11388
- C:\Windows\System\zxsNmYv.exe
  C:\Windows\System\zxsNmYv.exe
  2⤵
  PID:11408
- C:\Windows\System\oTcmXud.exe
  C:\Windows\System\oTcmXud.exe
  2⤵
  PID:11432
- C:\Windows\System\ZaOGqxD.exe
  C:\Windows\System\ZaOGqxD.exe
  2⤵
  PID:11464
- C:\Windows\System\ysBEbXR.exe
  C:\Windows\System\ysBEbXR.exe
  2⤵
  PID:11500
- C:\Windows\System\JzvfQRZ.exe
  C:\Windows\System\JzvfQRZ.exe
  2⤵
  PID:11540
- C:\Windows\System\cTTiHQw.exe
  C:\Windows\System\cTTiHQw.exe
  2⤵
  PID:11564
- C:\Windows\System\HVceTfu.exe
  C:\Windows\System\HVceTfu.exe
  2⤵
  PID:11584
- C:\Windows\System\eERAUFm.exe
  C:\Windows\System\eERAUFm.exe
  2⤵
  PID:11616
- C:\Windows\System\axkLjWx.exe
  C:\Windows\System\axkLjWx.exe
  2⤵
  PID:11640
- C:\Windows\System\zvvkzPl.exe
  C:\Windows\System\zvvkzPl.exe
  2⤵
  PID:11676
- C:\Windows\System\OZnyllp.exe
  C:\Windows\System\OZnyllp.exe
  2⤵
  PID:11708
- C:\Windows\System\KOsZFNi.exe
  C:\Windows\System\KOsZFNi.exe
  2⤵
  PID:11736
- C:\Windows\System\GdJVVVG.exe
  C:\Windows\System\GdJVVVG.exe
  2⤵
  PID:11764
- C:\Windows\System\zHVnDLS.exe
  C:\Windows\System\zHVnDLS.exe
  2⤵
  PID:11796
- C:\Windows\System\HXAxaMc.exe
  C:\Windows\System\HXAxaMc.exe
  2⤵
  PID:11820
- C:\Windows\System\KOjITlu.exe
  C:\Windows\System\KOjITlu.exe
  2⤵
  PID:11836
- C:\Windows\System\ZeLiEuc.exe
  C:\Windows\System\ZeLiEuc.exe
  2⤵
  PID:11880
- C:\Windows\System\xbxRQiK.exe
  C:\Windows\System\xbxRQiK.exe
  2⤵
  PID:11896
- C:\Windows\System\hvsQTHx.exe
  C:\Windows\System\hvsQTHx.exe
  2⤵
  PID:11932
- C:\Windows\System\GRnzHMu.exe
  C:\Windows\System\GRnzHMu.exe
  2⤵
  PID:11952
- C:\Windows\System\zTnAvmo.exe
  C:\Windows\System\zTnAvmo.exe
  2⤵
  PID:11988
- C:\Windows\System\kbUeIuV.exe
  C:\Windows\System\kbUeIuV.exe
  2⤵
  PID:12012
- C:\Windows\System\QxNtWMg.exe
  C:\Windows\System\QxNtWMg.exe
  2⤵
  PID:12036
- C:\Windows\System\AUYBuCO.exe
  C:\Windows\System\AUYBuCO.exe
  2⤵
  PID:12060
- C:\Windows\System\ETpAgDu.exe
  C:\Windows\System\ETpAgDu.exe
  2⤵
  PID:12084
- C:\Windows\System\tXFJgqm.exe
  C:\Windows\System\tXFJgqm.exe
  2⤵
  PID:12104
- C:\Windows\System\ofPMsun.exe
  C:\Windows\System\ofPMsun.exe
  2⤵
  PID:12136
- C:\Windows\System\jWjJosR.exe
  C:\Windows\System\jWjJosR.exe
  2⤵
  PID:12164
- C:\Windows\System\HXEyrdI.exe
  C:\Windows\System\HXEyrdI.exe
  2⤵
  PID:12192
- C:\Windows\System\EZeEqnR.exe
  C:\Windows\System\EZeEqnR.exe
  2⤵
  PID:12224
- C:\Windows\System\MUrpAIV.exe
  C:\Windows\System\MUrpAIV.exe
  2⤵
  PID:12244
- C:\Windows\System\qTsTUNG.exe
  C:\Windows\System\qTsTUNG.exe
  2⤵
  PID:11276
- C:\Windows\System\rqTBZTV.exe
  C:\Windows\System\rqTBZTV.exe
  2⤵
  PID:11336
- C:\Windows\System\UePlJFK.exe
  C:\Windows\System\UePlJFK.exe
  2⤵
  PID:11404
- C:\Windows\System\fKACEYp.exe
  C:\Windows\System\fKACEYp.exe
  2⤵
  PID:11424
- C:\Windows\System\CBbiJcO.exe
  C:\Windows\System\CBbiJcO.exe
  2⤵
  PID:11548
- C:\Windows\System\iYPuCNF.exe
  C:\Windows\System\iYPuCNF.exe
  2⤵
  PID:11580
- C:\Windows\System\QKUIqOt.exe
  C:\Windows\System\QKUIqOt.exe
  2⤵
  PID:11700
- C:\Windows\System\aNVPCyE.exe
  C:\Windows\System\aNVPCyE.exe
  2⤵
  PID:11808
- C:\Windows\System\YJpDhoG.exe
  C:\Windows\System\YJpDhoG.exe
  2⤵
  PID:11832
- C:\Windows\System\BWjtfuh.exe
  C:\Windows\System\BWjtfuh.exe
  2⤵
  PID:11912
- C:\Windows\System\EBKZSgf.exe
  C:\Windows\System\EBKZSgf.exe
  2⤵
  PID:11948
- C:\Windows\System\hfqplHz.exe
  C:\Windows\System\hfqplHz.exe
  2⤵
  PID:11996
- C:\Windows\System\XGPIMwk.exe
  C:\Windows\System\XGPIMwk.exe
  2⤵
  PID:12116
- C:\Windows\System\CvMbIoF.exe
  C:\Windows\System\CvMbIoF.exe
  2⤵
  PID:12092
- C:\Windows\System\YOwDEKR.exe
  C:\Windows\System\YOwDEKR.exe
  2⤵
  PID:12232
- C:\Windows\System\QJvrroc.exe
  C:\Windows\System\QJvrroc.exe
  2⤵
  PID:12272
- C:\Windows\System\YIErlse.exe
  C:\Windows\System\YIErlse.exe
  2⤵
  PID:11416
- C:\Windows\System\YULQJsS.exe
  C:\Windows\System\YULQJsS.exe
  2⤵
  PID:11604
- C:\Windows\System\YhimEox.exe
  C:\Windows\System\YhimEox.exe
  2⤵
  PID:11572
- C:\Windows\System\wRnNguo.exe
  C:\Windows\System\wRnNguo.exe
  2⤵
  PID:11848
- C:\Windows\System\EJLCyCs.exe
  C:\Windows\System\EJLCyCs.exe
  2⤵
  PID:12000
- C:\Windows\System\dTblxuw.exe
  C:\Windows\System\dTblxuw.exe
  2⤵
  PID:12188
- C:\Windows\System\fbeYYDG.exe
  C:\Windows\System\fbeYYDG.exe
  2⤵
  PID:12240
- C:\Windows\System\sUZyMMW.exe
  C:\Windows\System\sUZyMMW.exe
  2⤵
  PID:11624
- C:\Windows\System\DEIseMs.exe
  C:\Windows\System\DEIseMs.exe
  2⤵
  PID:11720
- C:\Windows\System\JSOsIJI.exe
  C:\Windows\System\JSOsIJI.exe
  2⤵
  PID:12256
- C:\Windows\System\zXAxGyD.exe
  C:\Windows\System\zXAxGyD.exe
  2⤵
  PID:11488
- C:\Windows\System\oqExvqv.exe
  C:\Windows\System\oqExvqv.exe
  2⤵
  PID:12300
- C:\Windows\System\QPjyROR.exe
  C:\Windows\System\QPjyROR.exe
  2⤵
  PID:12320
- C:\Windows\System\cEHwWJr.exe
  C:\Windows\System\cEHwWJr.exe
  2⤵
  PID:12348
- C:\Windows\System\saEJNaI.exe
  C:\Windows\System\saEJNaI.exe
  2⤵
  PID:12388
- C:\Windows\System\MCwHydr.exe
  C:\Windows\System\MCwHydr.exe
  2⤵
  PID:12408
- C:\Windows\System\YzkaMgm.exe
  C:\Windows\System\YzkaMgm.exe
  2⤵
  PID:12432
- C:\Windows\System\wZaqnCz.exe
  C:\Windows\System\wZaqnCz.exe
  2⤵
  PID:12464
- C:\Windows\System\lJGuVan.exe
  C:\Windows\System\lJGuVan.exe
  2⤵
  PID:12500
- C:\Windows\System\fnEABsa.exe
  C:\Windows\System\fnEABsa.exe
  2⤵
  PID:12520
- C:\Windows\System\UehmScw.exe
  C:\Windows\System\UehmScw.exe
  2⤵
  PID:12536
- C:\Windows\System\uBChWTh.exe
  C:\Windows\System\uBChWTh.exe
  2⤵
  PID:12588
- C:\Windows\System\JSKQjAt.exe
  C:\Windows\System\JSKQjAt.exe
  2⤵
  PID:12612
- C:\Windows\System\fFFUYYG.exe
  C:\Windows\System\fFFUYYG.exe
  2⤵
  PID:12644
- C:\Windows\System\YRYsiXe.exe
  C:\Windows\System\YRYsiXe.exe
  2⤵
  PID:12672
- C:\Windows\System\WExjBlz.exe
  C:\Windows\System\WExjBlz.exe
  2⤵
  PID:12704
- C:\Windows\System\ymnGbtz.exe
  C:\Windows\System\ymnGbtz.exe
  2⤵
  PID:12732
- C:\Windows\System\LMeatTK.exe
  C:\Windows\System\LMeatTK.exe
  2⤵
  PID:12772
- C:\Windows\System\gGKgbuL.exe
  C:\Windows\System\gGKgbuL.exe
  2⤵
  PID:12792
- C:\Windows\System\vvatVoM.exe
  C:\Windows\System\vvatVoM.exe
  2⤵
  PID:12820
- C:\Windows\System\Ktxrirb.exe
  C:\Windows\System\Ktxrirb.exe
  2⤵
  PID:12852
- C:\Windows\System\MHuuKLN.exe
  C:\Windows\System\MHuuKLN.exe
  2⤵
  PID:12880
- C:\Windows\System\FbhogIX.exe
  C:\Windows\System\FbhogIX.exe
  2⤵
  PID:12920
- C:\Windows\System\HSgvrnb.exe
  C:\Windows\System\HSgvrnb.exe
  2⤵
  PID:12952
- C:\Windows\System\mkAbwaC.exe
  C:\Windows\System\mkAbwaC.exe
  2⤵
  PID:12992
- C:\Windows\System\PTHlWnZ.exe
  C:\Windows\System\PTHlWnZ.exe
  2⤵
  PID:13028
- C:\Windows\System\AcpbbkC.exe
  C:\Windows\System\AcpbbkC.exe
  2⤵
  PID:13056
- C:\Windows\System\tURQISk.exe
  C:\Windows\System\tURQISk.exe
  2⤵
  PID:13080
- C:\Windows\System\HTxBtSc.exe
  C:\Windows\System\HTxBtSc.exe
  2⤵
  PID:13104
- C:\Windows\System\PdSnKoo.exe
  C:\Windows\System\PdSnKoo.exe
  2⤵
  PID:13140
- C:\Windows\System\yHfLDxP.exe
  C:\Windows\System\yHfLDxP.exe
  2⤵
  PID:13160
- C:\Windows\System\pmzQPwe.exe
  C:\Windows\System\pmzQPwe.exe
  2⤵
  PID:13176
- C:\Windows\System\YnLBDnx.exe
  C:\Windows\System\YnLBDnx.exe
  2⤵
  PID:13196
- C:\Windows\System\VlUcUCm.exe
  C:\Windows\System\VlUcUCm.exe
  2⤵
  PID:13232
- C:\Windows\System\zTOiQxQ.exe
  C:\Windows\System\zTOiQxQ.exe
  2⤵
  PID:13268
- C:\Windows\System\YjiQhZc.exe
  C:\Windows\System\YjiQhZc.exe
  2⤵
  PID:13288
- C:\Windows\System\XCXBHpk.exe
  C:\Windows\System\XCXBHpk.exe
  2⤵
  PID:12056
- C:\Windows\System\lNLThjL.exe
  C:\Windows\System\lNLThjL.exe
  2⤵
  PID:12312
- C:\Windows\System\uArqWmE.exe
  C:\Windows\System\uArqWmE.exe
  2⤵
  PID:12332
- C:\Windows\System\wFxtIZR.exe
  C:\Windows\System\wFxtIZR.exe
  2⤵
  PID:12400
- C:\Windows\System\LTLLgQD.exe
  C:\Windows\System\LTLLgQD.exe
  2⤵
  PID:12516
- C:\Windows\System\aaNcFME.exe
  C:\Windows\System\aaNcFME.exe
  2⤵
  PID:12556
- C:\Windows\System\prPFrWq.exe
  C:\Windows\System\prPFrWq.exe
  2⤵
  PID:12636
- C:\Windows\System\UbugCkK.exe
  C:\Windows\System\UbugCkK.exe
  2⤵
  PID:12700
- C:\Windows\System\xASuvql.exe
  C:\Windows\System\xASuvql.exe
  2⤵
  PID:12812
- C:\Windows\System\OXADYOO.exe
  C:\Windows\System\OXADYOO.exe
  2⤵
  PID:12860
- C:\Windows\System\HZeugeJ.exe
  C:\Windows\System\HZeugeJ.exe
  2⤵
  PID:12900
- C:\Windows\System\wXknNXF.exe
  C:\Windows\System\wXknNXF.exe
  2⤵
  PID:12968
- C:\Windows\System\AwisAuR.exe
  C:\Windows\System\AwisAuR.exe
  2⤵
  PID:13052
- C:\Windows\System\gLOOYju.exe
  C:\Windows\System\gLOOYju.exe
  2⤵
  PID:4924
- C:\Windows\System\tMytmbr.exe
  C:\Windows\System\tMytmbr.exe
  2⤵
  PID:13224
- C:\Windows\System\mvyZJGl.exe
  C:\Windows\System\mvyZJGl.exe
  2⤵
  PID:13300
- C:\Windows\System\iBYlTAA.exe
  C:\Windows\System\iBYlTAA.exe
  2⤵
  PID:11728
- C:\Windows\System\DxNxxAm.exe
  C:\Windows\System\DxNxxAm.exe
  2⤵
  PID:12444
- C:\Windows\System\muLAqVM.exe
  C:\Windows\System\muLAqVM.exe
  2⤵
  PID:12548
- C:\Windows\System\fkbVVFZ.exe
  C:\Windows\System\fkbVVFZ.exe
  2⤵
  PID:13000
- C:\Windows\System\YEHSYUg.exe
  C:\Windows\System\YEHSYUg.exe
  2⤵
  PID:13192
- C:\Windows\System\WhgScTk.exe
  C:\Windows\System\WhgScTk.exe
  2⤵
  PID:12944
- C:\Windows\System\ngMKETB.exe
  C:\Windows\System\ngMKETB.exe
  2⤵
  PID:13248
- C:\Windows\System\xcKuIOZ.exe
  C:\Windows\System\xcKuIOZ.exe
  2⤵
  PID:13336
- C:\Windows\System\GGOWPGN.exe
  C:\Windows\System\GGOWPGN.exe
  2⤵
  PID:13360
- C:\Windows\System\eicaxXc.exe
  C:\Windows\System\eicaxXc.exe
  2⤵
  PID:13376
- C:\Windows\System\cKmahHJ.exe
  C:\Windows\System\cKmahHJ.exe
  2⤵
  PID:13400
- C:\Windows\System\kOAeOga.exe
  C:\Windows\System\kOAeOga.exe
  2⤵
  PID:13440
- C:\Windows\System\TrtpYkX.exe
  C:\Windows\System\TrtpYkX.exe
  2⤵
  PID:13480
- C:\Windows\System\ztKWTQf.exe
  C:\Windows\System\ztKWTQf.exe
  2⤵
  PID:13500
- C:\Windows\System\TTlRFmK.exe
  C:\Windows\System\TTlRFmK.exe
  2⤵
  PID:13520
- C:\Windows\System\RXrJQAi.exe
  C:\Windows\System\RXrJQAi.exe
  2⤵
  PID:13544
- C:\Windows\System\CNGDQGN.exe
  C:\Windows\System\CNGDQGN.exe
  2⤵
  PID:13584
- C:\Windows\System\zXnJZVW.exe
  C:\Windows\System\zXnJZVW.exe
  2⤵
  PID:13612
- C:\Windows\System\eFtvhTK.exe
  C:\Windows\System\eFtvhTK.exe
  2⤵
  PID:13644
- C:\Windows\System\rHuyHwL.exe
  C:\Windows\System\rHuyHwL.exe
  2⤵
  PID:13680
- C:\Windows\System\AYiTYkO.exe
  C:\Windows\System\AYiTYkO.exe
  2⤵
  PID:13696
- C:\Windows\System\ungyTwt.exe
  C:\Windows\System\ungyTwt.exe
  2⤵
  PID:13728
- C:\Windows\System\JYhFuDM.exe
  C:\Windows\System\JYhFuDM.exe
  2⤵
  PID:13756
- C:\Windows\System\ZAmHlsP.exe
  C:\Windows\System\ZAmHlsP.exe
  2⤵
  PID:13788
- C:\Windows\System\fQrpOZq.exe
  C:\Windows\System\fQrpOZq.exe
  2⤵
  PID:13820
- C:\Windows\System\CYOeizr.exe
  C:\Windows\System\CYOeizr.exe
  2⤵
  PID:13840
- C:\Windows\System\DYsnqdB.exe
  C:\Windows\System\DYsnqdB.exe
  2⤵
  PID:13876
- C:\Windows\System\LSGTisN.exe
  C:\Windows\System\LSGTisN.exe
  2⤵
  PID:13900
- C:\Windows\System\zlzlrUh.exe
  C:\Windows\System\zlzlrUh.exe
  2⤵
  PID:13936
- C:\Windows\System\QYuhjRK.exe
  C:\Windows\System\QYuhjRK.exe
  2⤵
  PID:13964
- C:\Windows\System\KWTrCkg.exe
  C:\Windows\System\KWTrCkg.exe
  2⤵
  PID:14000
- C:\Windows\System\mxSdvCv.exe
  C:\Windows\System\mxSdvCv.exe
  2⤵
  PID:14020
- C:\Windows\System\OdmTBDY.exe
  C:\Windows\System\OdmTBDY.exe
  2⤵
  PID:14048
- C:\Windows\System\MDlsgkA.exe
  C:\Windows\System\MDlsgkA.exe
  2⤵
  PID:14076
- C:\Windows\System\ajNjQnW.exe
  C:\Windows\System\ajNjQnW.exe
  2⤵
  PID:14104
- C:\Windows\System\jFboUJW.exe
  C:\Windows\System\jFboUJW.exe
  2⤵
  PID:14136
- C:\Windows\System\Cpbachk.exe
  C:\Windows\System\Cpbachk.exe
  2⤵
  PID:14160
- C:\Windows\System\hJDuXct.exe
  C:\Windows\System\hJDuXct.exe
  2⤵
  PID:14188
- C:\Windows\System\IHmbbbU.exe
  C:\Windows\System\IHmbbbU.exe
  2⤵
  PID:14208
- C:\Windows\System\qegqBvl.exe
  C:\Windows\System\qegqBvl.exe
  2⤵
  PID:14224
- C:\Windows\System\yxtXZJs.exe
  C:\Windows\System\yxtXZJs.exe
  2⤵
  PID:14240
- C:\Windows\System\RgOebxi.exe
  C:\Windows\System\RgOebxi.exe
  2⤵
  PID:14260
- C:\Windows\System\UdTJggI.exe
  C:\Windows\System\UdTJggI.exe
  2⤵
  PID:14288
- C:\Windows\System\iUqXoxK.exe
  C:\Windows\System\iUqXoxK.exe
  2⤵
  PID:14312
- C:\Windows\System\prItEip.exe
  C:\Windows\System\prItEip.exe
  2⤵
  PID:14328
- C:\Windows\System\mxiuzCg.exe
  C:\Windows\System\mxiuzCg.exe
  2⤵
  PID:13072
- C:\Windows\System\YyqMYYc.exe
  C:\Windows\System\YyqMYYc.exe
  2⤵
  PID:12888
- C:\Windows\System\MvAPTTh.exe
  C:\Windows\System\MvAPTTh.exe
  2⤵
  PID:13468
- C:\Windows\System\LeeUWDf.exe
  C:\Windows\System\LeeUWDf.exe
  2⤵
  PID:13488
- C:\Windows\System\BGmaSnE.exe
  C:\Windows\System\BGmaSnE.exe
  2⤵
  PID:13476
- C:\Windows\System\KKNlrQO.exe
  C:\Windows\System\KKNlrQO.exe
  2⤵
  PID:13424
- C:\Windows\System\Hyoosvh.exe
  C:\Windows\System\Hyoosvh.exe
  2⤵
  PID:13556
- C:\Windows\System\tQRabBl.exe
  C:\Windows\System\tQRabBl.exe
  2⤵
  PID:13628
- C:\Windows\System\VVHiEEr.exe
  C:\Windows\System\VVHiEEr.exe
  2⤵
  PID:3260
- C:\Windows\System\PdXpFKD.exe
  C:\Windows\System\PdXpFKD.exe
  2⤵
  PID:13860
- C:\Windows\System\dpZLXdZ.exe
  C:\Windows\System\dpZLXdZ.exe
  2⤵
  PID:4568
- C:\Windows\System\sJuizbq.exe
  C:\Windows\System\sJuizbq.exe
  2⤵
  PID:13924
- C:\Windows\System\cMmFShK.exe
  C:\Windows\System\cMmFShK.exe
  2⤵
  PID:14008
- C:\Windows\System\mEJlOoZ.exe
  C:\Windows\System\mEJlOoZ.exe
  2⤵
  PID:14016
- C:\Windows\System\HhHYcYs.exe
  C:\Windows\System\HhHYcYs.exe
  2⤵
  PID:14280
- C:\Windows\System\TfGYmfM.exe
  C:\Windows\System\TfGYmfM.exe
  2⤵
  PID:14324
- C:\Windows\System\cUDuewc.exe
  C:\Windows\System\cUDuewc.exe
  2⤵
  PID:14232
- C:\Windows\System\uqpzqhb.exe
  C:\Windows\System\uqpzqhb.exe
  2⤵
  PID:12756
- C:\Windows\System\BLIIumH.exe
  C:\Windows\System\BLIIumH.exe
  2⤵
  PID:14176
- C:\Windows\System\EmXqpqD.exe
  C:\Windows\System\EmXqpqD.exe
  2⤵
  PID:14284
- C:\Windows\System\kFcfxSO.exe
  C:\Windows\System\kFcfxSO.exe
  2⤵
  PID:13368
- C:\Windows\System\MOwpuOO.exe
  C:\Windows\System\MOwpuOO.exe
  2⤵
  PID:1632
- C:\Windows\System\TdENTuw.exe
  C:\Windows\System\TdENTuw.exe
  2⤵
  PID:2640
- C:\Windows\System\bfMsRFt.exe
  C:\Windows\System\bfMsRFt.exe
  2⤵
  PID:13828
- C:\Windows\System\EqPavkU.exe
  C:\Windows\System\EqPavkU.exe
  2⤵
  PID:13800
- C:\Windows\System\FbBzbTA.exe
  C:\Windows\System\FbBzbTA.exe
  2⤵
  PID:14344
- C:\Windows\System\ntkRLdz.exe
  C:\Windows\System\ntkRLdz.exe
  2⤵
  PID:14364
- C:\Windows\System\uHgbQus.exe
  C:\Windows\System\uHgbQus.exe
  2⤵
  PID:14388
- C:\Windows\System\LPOsuPZ.exe
  C:\Windows\System\LPOsuPZ.exe
  2⤵
  PID:14420
- C:\Windows\System\zzSszCl.exe
  C:\Windows\System\zzSszCl.exe
  2⤵
  PID:14444
- C:\Windows\System\HYkvifb.exe
  C:\Windows\System\HYkvifb.exe
  2⤵
  PID:14476
- C:\Windows\System\GfdeaYF.exe
  C:\Windows\System\GfdeaYF.exe
  2⤵
  PID:14680
- C:\Windows\System\ycPtPje.exe
  C:\Windows\System\ycPtPje.exe
  2⤵
  PID:14700
- C:\Windows\System\fpXnAOE.exe
  C:\Windows\System\fpXnAOE.exe
  2⤵
  PID:14728
- C:\Windows\System\oeWWZmr.exe
  C:\Windows\System\oeWWZmr.exe
  2⤵
  PID:14768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CAnxjQb.exe

Filesize
2.1MB

MD5
0ec88017058d42244e3b05e91c83f68a

SHA1
6822671baf323c742eedd2caffa17fae55571202

SHA256
da1dc83a30849831d84b3949600493cab3112ee91cdea99a281a6dbec748b2be

SHA512
756f7955029501f21bd92f04068bf69ce68ec82505cbee8f929940eef4be4bd1335d6decc6371116c206b8fe472d75aef515443b31b1a608c6990a9e13a2dd5f

Download Submit
C:\Windows\System\CWcVPsS.exe

Filesize
2.1MB

MD5
90b4dd45a5c8124fd80fd0fe756a4ddc

SHA1
11b5daf7558e77cb78d29c5e1c52d9379c2cc0ff

SHA256
d4ad558eb080f92fe72f80744ff57db8e8e8addc0998b3cb6e3038ebd185b08b

SHA512
829a096307482d625144f83e9d80c405c4437f8609fb8dd5cbc7b36ed7abe8638732db1b074ab2ece4bdab144292ccb36d49729ae1e2354ee8e744688cdb00e9

Download Submit
C:\Windows\System\FGUaRxJ.exe

Filesize
2.1MB

MD5
03b0a942cc6d9690ac528454faebb55e

SHA1
9b31364e3ab47f2f412a96b3e800a27c9ff1877d

SHA256
5279abef167335415e857a2d15f3a6cffb2470f167a9eb95d9783a6e3b28df87

SHA512
870450798e4b12f216a8c9db1ebaeaaf5db26a2f9f411e1e6d9174b5927c16b520a24d3cef84753ef6ddae8de66b3935d995c46a63e6726c4332bd8b10c55502

Download Submit
C:\Windows\System\FsRcsvc.exe

Filesize
2.1MB

MD5
9ef92bb3c8ba69cbe88503a889b374ef

SHA1
2c9139f6ae9a1ebd56986c3ba2cfc2f589cab1e9

SHA256
4d990882ba2e2855a488b7b37bf0731b1534e0601524b7a76b8d4d03c06774cd

SHA512
2a782439fda61786d2067d04f67dc3bfdf4f479082f44682de755cbe309e42e051f861d1c027f73bbf34df4670d810d706a36ab860d3b5fcfc40d606fa7cd0ab

Download Submit
C:\Windows\System\IxczISW.exe

Filesize
2.1MB

MD5
21b47ea59616a9cbf453bda5e1915ebd

SHA1
34adfd549c6696a7f017d4b47b4d8297e7c4376d

SHA256
bb1c1c7ce42424e909652916e6ac17628bb8ee6ac2d21812489d06080d50787e

SHA512
613bd6876e0fae93aa686c7298260fe332e362e749c926f28d5c6cbf569a14c0c5ecedb1418ee6fe2e1196765851dda2c7cb499604620644e1ebea4bc681bff3

Download Submit
C:\Windows\System\OBlaNjZ.exe

Filesize
2.1MB

MD5
5e1fc605327fe92caa171f275a10a98f

SHA1
d3685dfe11185672ae0ff52430922bba47558b76

SHA256
52f06107a1c2de657d81d87f36c400924c873eded9d102d09fe5b120140375ea

SHA512
4f8096b197614cab405e83e830cffbbe2470b7693477db1c207499aff08ce2dad1212cf7b4c69153d3ece63830532d621077676ffc3bb8d8d25ec0c16c8f1839

Download Submit
C:\Windows\System\OpKieCj.exe

Filesize
2.1MB

MD5
28ce5df6b862c5609b636c48e07d5423

SHA1
060d3cf3a8bd73761196d05f15db3deee153e43b

SHA256
f60791b55e9c8aec534c3f669033f5f67c323fef13f1b8a4c45cbab94a5ecae5

SHA512
dd0bcd240bb8c67342b2d1ad9e970d6caede7521b0e0c42ccc0b5953c8c4e9998f03135af0f8374c15577c33a332a96373973f6befdcb7a4ddaaf4a2a3af7531

Download Submit
C:\Windows\System\PrHxqwH.exe

Filesize
2.1MB

MD5
01ce3175dee55b9fbfdae1e75ba24c6b

SHA1
dcdf571759fe60ce888c66fafe8e291fcffbc54e

SHA256
344cd57edf5ef81903ecc3f9fd5ac9626bffd2583064317bed37ea969f1aa4f9

SHA512
f4c3c7d711e91020dbd6ecf7baa792507cf2b31795e3a6aa164d16db4fcaaa52e5d867ce77e0a2e24a4cb79f38d6cb9f2615bfeb6b4de9bf11b888689ff2ad08

Download Submit
C:\Windows\System\SWrUEej.exe

Filesize
2.1MB

MD5
3c442ea538b11576481c00f2d1a3519e

SHA1
a2e8765f2677aa14dd759793ae90787c8199e9d7

SHA256
2f2cf87c5224cf4420837af8ca4ecb9e0ba0542d32f06395cdc06a287ed47dfa

SHA512
898ec37db622676cd8d9fffaacc9c28ee8728ffa8b3cc0b5a8242e9ffc67b34ba6a51811a5be98283740c0ed73a01903b2827650d63891e444adb73a983d0945

Download Submit
C:\Windows\System\TlmabVH.exe

Filesize
2.1MB

MD5
b37228e6c34c3c720a07dde9955b31b9

SHA1
eb4b6adefcdebe175635dffcd3c0e1f1b0a4981e

SHA256
58f1b8c1f90bd0c0a74cb3c79c119dfbb87cefe3f0dc3e960d29521267361c4a

SHA512
f743b6170550b784d0671cae53166317d0351fcefb375d915e9c2cc060e80d5b4aae273f415bd56f3f159b9d8674fda1d5a6a9526b25863f5dbad79fe5db7bbb

Download Submit
C:\Windows\System\VHSkfjz.exe

Filesize
2.1MB

MD5
ea45d35cfdff2d0939747bd816578252

SHA1
f8bbfb854f5a9ce09e73742b5b5a733b11888910

SHA256
d3492622ec27fa396e8c7fdc78d3cfe5b46b88ccbc04b9b58955260640538245

SHA512
53df6cce6457a319ce826fc3723c76a745ab5de7d333b3e7b8dc4261525bf66b4705e054c1a50a9278778e9134bbe9b71dc7eec30ccaa1819afda00b77ebd43c

Download Submit
C:\Windows\System\WbVEPXy.exe

Filesize
2.1MB

MD5
eeb6442cc939efaac0cf58cb8081635e

SHA1
37d4a4785a5d4ac9f08436db527a4bbaa3b79200

SHA256
0d15ac3b5e3f2b7afc7cc2d7938dd20177aeee7add31ed64fc66df4b6a9783ed

SHA512
bf911259ac1ff9ea5db4c8d76e0b4648c09745bf475035c162c7a70ac2b929d1822e0093bd6fb86ce056ef00adf08914171895d51e4ba4d58ad4a9debbac2aca

Download Submit
C:\Windows\System\YKDkPEG.exe

Filesize
2.1MB

MD5
8c8def13b8ec97e95d06a49fa0a67111

SHA1
42de0c224facb1dadf0d6f49efaf5e96978153fb

SHA256
dd2aa44e706fce66427bd79417d8cf866ec18eeb0e01332e4a79c2056a449630

SHA512
e9f2baa08be93dd90b3e3f81712675c198289ab29efb58404c3865a88f254e8951f7e628b4a6e672f00308d91247e87759d414c9295f6e23929e11c5b69a642a

Download Submit
C:\Windows\System\YPpIPCy.exe

Filesize
2.1MB

MD5
5ceff82dd0904410469252bb101efa77

SHA1
2432224c9f594eed2ce61905ac95b365302d024e

SHA256
76ea5b575ce5c4f3b737f6f56bb53bf8e9c8a6504bf88b0a16266ba9fb9a560b

SHA512
949707ff42687a607a48e945766ad1875911367a21ba08d720ce46ea451ab9364ff6c63e09cd4be2b50efe4141e85d9c2290d2d557441dbca58f1370e5dfb63d

Download Submit
C:\Windows\System\YYkLFlJ.exe

Filesize
2.1MB

MD5
d6179fe571af75b07ea6bb0558ac34e6

SHA1
b8859dec2779e0fd8d3c72cc63c876dad0464260

SHA256
175ac0e8c3ba694181cb16b16c61efe2172cf4961b50d3f2df580ad7fa2ba7bd

SHA512
0345a24f20eb3471828fb28c579040e93e752f9606fe6db0335d4747eec5eec6a901f871368255c124427317fe73922bd97d39ee414f18f1e680daaa8220fcce

Download Submit
C:\Windows\System\YYsQhuX.exe

Filesize
2.1MB

MD5
3dd597d4cfb976692a672a370d2f78ff

SHA1
cd01a10ae10c437f197e16feee959e9e5fd92a7d

SHA256
602f907d5cddd6ff0f3a9bcf5e8a84285780ec0cae28390f6d55d20b7fb00381

SHA512
ada336dc6a2d07686c5f0b39fb30476105ffbcbdc89684b75ddafa893592571eb7b3a2bc587d944da31dd89b2c8f0cf19d6ab12c0ca716ede1fc29e532aeabb6

Download Submit
C:\Windows\System\ZGqEIWV.exe

Filesize
2.1MB

MD5
f44479e746e6e99ef0de761add0fa2a9

SHA1
ec26deb604c74adb9d2daa0ceeb3091d4305b59a

SHA256
0bd87b6a5447a035c260bbee380e3885ae1e4a81bfa7be85ce75dbdb90812991

SHA512
308864c9be308404d363bd7c19b78e7dc69e5395e3cc79e91173e9f0c79d3d8fc2eaf6c2ade1f39d846170d79c9b29d5e5c3c6aef93092fe055883a6572c26be

Download Submit
C:\Windows\System\cpAqkMa.exe

Filesize
2.1MB

MD5
4d9bc293c75184998005a6bfd7345b31

SHA1
8cb290ec48330c2a99956ff4a0dc0d8622788ae1

SHA256
04c89fa8c4102b4b373caa312be15a14f3bce7abbe28fc7391d49483bfa0be8b

SHA512
dc7703aeab34d19fbb74bf989f9640611ee618acf5197529a03a492bdf13d2b2e8d2a30afa96bcb85ffdbba86237451dbbc6234afb6b9bc3b0d845a281d4f3d8

Download Submit
C:\Windows\System\eATnmZa.exe

Filesize
2.1MB

MD5
d6ce6d8a9fdb68d08535f04f33772b3e

SHA1
4a9eb5dbc754890d78ccdd9e884a2b36655c7a4e

SHA256
0192a189da12ca5de6c8fc16d98fee23bbf39c932437f3f1608d84f4f1365765

SHA512
8fae54a14146dbd8e9af546fb5483632425c3bdc57b111afb39f30c36d5f08546a261886fb23028a410eb9831c148585d723af3022c62c887491eda155334920

Download Submit
C:\Windows\System\fiknFZU.exe

Filesize
2.1MB

MD5
7a4d2c3dfdc2aff5a53d6827872eb1f1

SHA1
8d64e020a0a54d2e811b49ad9392770bd7718ad0

SHA256
92e7c1a587e5539dff1c84f56a2302184fabc6ef81bd315259273d0d92116abb

SHA512
cf9556bd8bc14fe77275291ef26fc86082b57c31960c620394ef455a96f8c0a0702caecebdd35b814a2a8bd40b6ae700559a9ce3ebbc020beaa265706f96dafc

Download Submit
C:\Windows\System\gbprOhN.exe

Filesize
2.1MB

MD5
5efdcd17b0ce5a7da4992acd4f718bb3

SHA1
c090a29138d9e6dfd6802cb7ad37d97fd701fa2e

SHA256
146ac92b8b375b43828f8412c3b9765617fd8d5b5f25c76dac198432d571123f

SHA512
ec6ad308aeb7332e24a1e4442010b6238b4f743ac0368d24c27c5580d57c37c4e2f8a0feb3b9493467a8fc174d75549dbdb16f1cbdd06e37f7595b4e121402c6

Download Submit
C:\Windows\System\gjGPvvM.exe

Filesize
2.1MB

MD5
1457ac0edd52763a6ff846275619fead

SHA1
5e8d5f2cbf0437e25a1333c0cd1ea8bd408313a6

SHA256
47cb919d1ab840526f2289a8117cb01c30525a3d3e69f4f2c8ddb2dc0e30122c

SHA512
205eed2168d45b60ec657ea52dfcb87b8ddaa3c09067e593151b0016f365c92cd99ecc4d79f0d48f2c56143a8efaf67c4abe8c8f0825f183a996144c2282ed19

Download Submit
C:\Windows\System\hAptsGB.exe

Filesize
2.1MB

MD5
1883de3ea81d4871d6bc796a7a99ee39

SHA1
61be68c9920712ab85afe73671b9fd985d37f649

SHA256
6565351c59bc2e2b3172046520326fe15e7c9a78a1316df1aefb9f6f1d5aab98

SHA512
0c07dad34f52c3a5e176aa3956e6387dfb3d952ba2e682e87b2e847da53d33ffc4c09693a6047b9a1231f3cf6856c636a1aef3db8fad6069e77e6fa8de5e1178

Download Submit
C:\Windows\System\idjVmFf.exe

Filesize
2.1MB

MD5
aa5071f50e84d7b5d7f7a48c6c615dc0

SHA1
a1e29d0275aaebf20300319244c097db1d35cd72

SHA256
f8838e816ad44d51c3daa3200d671f23488d794bfa57ff98d067479472e90b7b

SHA512
f5378c76aa8655777ae22cf259efdeee58410ef267f0e22cca5adb271f77a2b281732f2f59ef3403dbf483ad4c016d3ea06db76a8ce2523675dcb3cdbf5e7e3f

Download Submit
C:\Windows\System\ijWYHaN.exe

Filesize
2.1MB

MD5
6de5fae1f96a5aea66825ba2b50b6b64

SHA1
df6381786bf8ee60b8df996798e636f896f9eb1a

SHA256
ad7c8539fb455d7867552e243b2d130aa83a596254c14fc1bef5844f4a01facc

SHA512
2fd04acd9addffe966ede2e775d18916f1286e33d05eb22569ba0ad045c32c56c2a775420a4821aed355191be75e9835c97162d5e318f98806145b51238bbd89

Download Submit
C:\Windows\System\jznkSbu.exe

Filesize
2.1MB

MD5
06e4100e54a2f1a9184c680e57856b9b

SHA1
358c2bd91d7bfdfca86fc0a9cc64b6a8698381a8

SHA256
4448555bbe171e80be788eb7038a5977814d232df193d9c519db0d2339d30a75

SHA512
c289ab0c478b31037f150cc765609b854296b3a5a5d9d8721f592cd3fa34b24bcd8d2e366f5f19948b5b1f104e627fe1f16c251d6e657e6ea5ec8d4332ed76df

Download Submit
C:\Windows\System\ltNFxFf.exe

Filesize
2.1MB

MD5
34b2651003419356f521c5a3ab1a499e

SHA1
ae06a5438dc512957596ad9501ca5eb8c57ff792

SHA256
1481eacac10e2387532d1657eec3dd5df3f43ca930b232085d2323b79ac76e75

SHA512
895a1261f3cbb9446d83db51aa19b12f4807f917f25ee43278d835d756c12ee769f974ba902ecd0eade4e49d6fdade49ea33d9a06088f81171647a28a4d7cd2e

Download Submit
C:\Windows\System\mGCAFKu.exe

Filesize
2.1MB

MD5
734bc8393f3e6a564debbf2571d13244

SHA1
0869beeae1d2e7579ec50d2829e927e915a88b77

SHA256
23085b6788cbfa55e8f49b25c5092f7cef404a202525b6e7f55e89d233d644a3

SHA512
daced0a3363e61ef11e0856854275f71af3c5c42c933724dc12096aed98d6d92800d33d0501ac124a924ac5be4fbd686a322439dc8e7ef20681a5533e35ec213

Download Submit
C:\Windows\System\njOEtus.exe

Filesize
2.1MB

MD5
d6702da2e51ded01f3bb76ff80500400

SHA1
a62f86db4e527168e62c323459bcb5b7cda73ed7

SHA256
8ee631f5cda13319efc2d259716e3d640f9bad10585e0820fd310bff06758d08

SHA512
9c794b1eb30ca98655defbdb8514159f1c5af1a6d11498a183d38f84ca0c2eaf718ea885a1d8fcb4be7c2bb3cf5ac215bd91dbdcf18ce9cb1e30a9de21d6b2b8

Download Submit
C:\Windows\System\oyiULGs.exe

Filesize
2.1MB

MD5
c7ba784b93ce88c5b1a6081f65f61d78

SHA1
ccfd03b909faa389c0e5882fbc5dca346f120c75

SHA256
d80c2d34e35ec525e7f140dad607852eec33cfd88c7df851c6a7f66f4c70456d

SHA512
8a7bfd1f9241e8afc2897491a0381b7e715ce83e5897b63f6834f4dc09e9b8a781678467e2bbcb51aade5d0b7003bb2ac4980224f867249b43f90f94bdafa2b9

Download Submit
C:\Windows\System\pyrZozb.exe

Filesize
2.1MB

MD5
e5ceb27f6627a5f05ab200cd5c40933b

SHA1
2dc77076adb67efbd113ff529a2fde28b8b6752f

SHA256
242cc3a62b1cd19ddcdc573bd63abb1f8f201a90c11b714b18e568465391c421

SHA512
06636b371ab3d0f16be993f276f9300da0142dcb1306354e0727d7024b42b9fb818767bb4388dac5cc399fff4197185d7b0869567e1cc77152ed3c551b76c385

Download Submit
C:\Windows\System\rLFOhVc.exe

Filesize
2.1MB

MD5
67fc4e08b251d19012e92ab0d2d16cae

SHA1
1eea9401a2324877f1e6340df15a640cd4f4a01a

SHA256
073e1865d6cb47f5eb4f888f39c9d5e6ea422341276537f0a02ad9567799877a

SHA512
9a2e93b10a51fdeeb90b192861642bc2af88daa22c5a6a8380f33ba207800137cb29250de5f260fb00279988d8c95ba88742a18d23adb1dc09564ef6faa62c91

Download Submit
C:\Windows\System\vPXTOfL.exe

Filesize
2.1MB

MD5
571059e846c0966bbded338be404247c

SHA1
ff6b42d4fda6e77e4aa503a272e8fe73e644b5ef

SHA256
e92816fa5fd05f77ee820fbdd387ec5f0478f8f7b977c53ca0c763c52fa7c454

SHA512
b1d3e18404603823cf5bef1474fabc87d6ab004c77f694a0d8913df74fd4b2f071a4c07b32b460f415cc53a4f237252dcdafee8d920bfd02e57ca0742ea453f4

Download Submit
C:\Windows\System\waJYBiL.exe

Filesize
2.1MB

MD5
f0a0a40b2e94d979febeeebec6d5a5bb

SHA1
73ca3f754734b2deefd8b33045b23d8f3721b42d

SHA256
f59bd044a7242652d1fce06aab0bfda76c385fc1fdca05e83333ed57d67f5ba9

SHA512
43055bc925e1c7e1a4959fb740453f44282df4981ea66a456cdb833886dcf46cf0b99f094574c17d81ceb0490851eea519894cdb6dd1c3390767fc495e7d41fe

Download Submit
C:\Windows\System\wqdyHJQ.exe

Filesize
2.1MB

MD5
8bc2d0d4aa8e65f6ca8653802cc344ec

SHA1
46c6dafeeed9a2b296441822406fab7156aab849

SHA256
d6e54ce59556fc39269cd1dead44f38bd2ef75cbff8f8195ea2f635030ff56c0

SHA512
1b5684c9b0920ebb7a490b7e236aacf7c8055ae38e447180ca36de6368232885cfb6bde692fcc0179dd340d4f79cf391d3ef28861033fa2ee508fb8b62b7c560

Download Submit
C:\Windows\System\zTduOSy.exe

Filesize
2.1MB

MD5
622491860cec28c753762cdb831d102f

SHA1
e253a1661596c7b438113ca810da5af2c2e9351b

SHA256
1be38faed17b93c6af740f51e02e10036bf83c73f6e51187f90dd9493712c1ed

SHA512
5acb6e9fd1bc5898389534cf5c3400e5bc8f7af9b8e479f2a5560927373f1bd903310fa02401d4819df70485b4697b2622bf587db0e68cd3c5d242e4e9c16755

Download Submit
memory/388-2182-0x00007FF7FEF90000-0x00007FF7FF2E4000-memory.dmp

Filesize
3.3MB

Download
memory/388-200-0x00007FF7FEF90000-0x00007FF7FF2E4000-memory.dmp

Filesize
3.3MB

Download
memory/532-113-0x00007FF6AFED0000-0x00007FF6B0224000-memory.dmp

Filesize
3.3MB

Download
memory/532-2161-0x00007FF6AFED0000-0x00007FF6B0224000-memory.dmp

Filesize
3.3MB

Download
memory/968-2173-0x00007FF77ED10000-0x00007FF77F064000-memory.dmp

Filesize
3.3MB

Download
memory/968-212-0x00007FF77ED10000-0x00007FF77F064000-memory.dmp

Filesize
3.3MB

Download
memory/1088-189-0x00007FF6945D0000-0x00007FF694924000-memory.dmp

Filesize
3.3MB

Download
memory/1088-2177-0x00007FF6945D0000-0x00007FF694924000-memory.dmp

Filesize
3.3MB

Download
memory/1168-2185-0x00007FF6375C0000-0x00007FF637914000-memory.dmp

Filesize
3.3MB

Download
memory/1168-218-0x00007FF6375C0000-0x00007FF637914000-memory.dmp

Filesize
3.3MB

Download
memory/1344-2184-0x00007FF75F0D0000-0x00007FF75F424000-memory.dmp

Filesize
3.3MB

Download
memory/1344-216-0x00007FF75F0D0000-0x00007FF75F424000-memory.dmp

Filesize
3.3MB

Download
memory/1648-2164-0x00007FF678F10000-0x00007FF679264000-memory.dmp

Filesize
3.3MB

Download
memory/1648-145-0x00007FF678F10000-0x00007FF679264000-memory.dmp

Filesize
3.3MB

Download
memory/1968-102-0x00007FF63C510000-0x00007FF63C864000-memory.dmp

Filesize
3.3MB

Download
memory/1968-2159-0x00007FF63C510000-0x00007FF63C864000-memory.dmp

Filesize
3.3MB

Download
memory/1996-2183-0x00007FF6BE980000-0x00007FF6BECD4000-memory.dmp

Filesize
3.3MB

Download
memory/1996-194-0x00007FF6BE980000-0x00007FF6BECD4000-memory.dmp

Filesize
3.3MB

Download
memory/2116-2155-0x00007FF76E8C0000-0x00007FF76EC14000-memory.dmp

Filesize
3.3MB

Download
memory/2116-2163-0x00007FF76E8C0000-0x00007FF76EC14000-memory.dmp

Filesize
3.3MB

Download
memory/2116-32-0x00007FF76E8C0000-0x00007FF76EC14000-memory.dmp

Filesize
3.3MB

Download
memory/2176-2172-0x00007FF606510000-0x00007FF606864000-memory.dmp

Filesize
3.3MB

Download
memory/2176-164-0x00007FF606510000-0x00007FF606864000-memory.dmp

Filesize
3.3MB

Download
memory/2712-61-0x00007FF7220C0000-0x00007FF722414000-memory.dmp

Filesize
3.3MB

Download
memory/2712-2153-0x00007FF7220C0000-0x00007FF722414000-memory.dmp

Filesize
3.3MB

Download
memory/2712-2167-0x00007FF7220C0000-0x00007FF722414000-memory.dmp

Filesize
3.3MB

Download
memory/2904-125-0x00007FF69EA30000-0x00007FF69ED84000-memory.dmp

Filesize
3.3MB

Download
memory/2904-2166-0x00007FF69EA30000-0x00007FF69ED84000-memory.dmp

Filesize
3.3MB

Download
memory/3060-213-0x00007FF6D6450000-0x00007FF6D67A4000-memory.dmp

Filesize
3.3MB

Download
memory/3060-2176-0x00007FF6D6450000-0x00007FF6D67A4000-memory.dmp

Filesize
3.3MB

Download
memory/3204-199-0x00007FF755CC0000-0x00007FF756014000-memory.dmp

Filesize
3.3MB

Download
memory/3204-2175-0x00007FF755CC0000-0x00007FF756014000-memory.dmp

Filesize
3.3MB

Download
memory/3628-2181-0x00007FF666140000-0x00007FF666494000-memory.dmp

Filesize
3.3MB

Download
memory/3628-217-0x00007FF666140000-0x00007FF666494000-memory.dmp

Filesize
3.3MB

Download
memory/3708-2165-0x00007FF6558B0000-0x00007FF655C04000-memory.dmp

Filesize
3.3MB

Download
memory/3708-66-0x00007FF6558B0000-0x00007FF655C04000-memory.dmp

Filesize
3.3MB

Download
memory/3708-2154-0x00007FF6558B0000-0x00007FF655C04000-memory.dmp

Filesize
3.3MB

Download
memory/3888-211-0x00007FF677190000-0x00007FF6774E4000-memory.dmp

Filesize
3.3MB

Download
memory/3888-2180-0x00007FF677190000-0x00007FF6774E4000-memory.dmp

Filesize
3.3MB

Download
memory/4260-152-0x00007FF6688C0000-0x00007FF668C14000-memory.dmp

Filesize
3.3MB

Download
memory/4260-2170-0x00007FF6688C0000-0x00007FF668C14000-memory.dmp

Filesize
3.3MB

Download
memory/4376-215-0x00007FF6122F0000-0x00007FF612644000-memory.dmp

Filesize
3.3MB

Download
memory/4376-2178-0x00007FF6122F0000-0x00007FF612644000-memory.dmp

Filesize
3.3MB

Download
memory/4412-2157-0x00007FF6894E0000-0x00007FF689834000-memory.dmp

Filesize
3.3MB

Download
memory/4412-16-0x00007FF6894E0000-0x00007FF689834000-memory.dmp

Filesize
3.3MB

Download
memory/4440-2179-0x00007FF6F79C0000-0x00007FF6F7D14000-memory.dmp

Filesize
3.3MB

Download
memory/4440-210-0x00007FF6F79C0000-0x00007FF6F7D14000-memory.dmp

Filesize
3.3MB

Download
memory/4484-45-0x00007FF669090000-0x00007FF6693E4000-memory.dmp

Filesize
3.3MB

Download
memory/4484-2162-0x00007FF669090000-0x00007FF6693E4000-memory.dmp

Filesize
3.3MB

Download
memory/4624-128-0x00007FF6DC7F0000-0x00007FF6DCB44000-memory.dmp

Filesize
3.3MB

Download
memory/4624-2160-0x00007FF6DC7F0000-0x00007FF6DCB44000-memory.dmp

Filesize
3.3MB

Download
memory/4640-2169-0x00007FF65E630000-0x00007FF65E984000-memory.dmp

Filesize
3.3MB

Download
memory/4640-182-0x00007FF65E630000-0x00007FF65E984000-memory.dmp

Filesize
3.3MB

Download
memory/4660-0-0x00007FF7A1ED0000-0x00007FF7A2224000-memory.dmp

Filesize
3.3MB

Download
memory/4660-1-0x00000142E6620000-0x00000142E6630000-memory.dmp

Filesize
64KB

Download
memory/4660-2151-0x00007FF7A1ED0000-0x00007FF7A2224000-memory.dmp

Filesize
3.3MB

Download
memory/4704-209-0x00007FF716D50000-0x00007FF7170A4000-memory.dmp

Filesize
3.3MB

Download
memory/4704-2174-0x00007FF716D50000-0x00007FF7170A4000-memory.dmp

Filesize
3.3MB

Download
memory/4764-67-0x00007FF72ACB0000-0x00007FF72B004000-memory.dmp

Filesize
3.3MB

Download
memory/4764-2171-0x00007FF72ACB0000-0x00007FF72B004000-memory.dmp

Filesize
3.3MB

Download
memory/4764-2156-0x00007FF72ACB0000-0x00007FF72B004000-memory.dmp

Filesize
3.3MB

Download
memory/4928-26-0x00007FF7F8860000-0x00007FF7F8BB4000-memory.dmp

Filesize
3.3MB

Download
memory/4928-2158-0x00007FF7F8860000-0x00007FF7F8BB4000-memory.dmp

Filesize
3.3MB

Download
memory/4928-2152-0x00007FF7F8860000-0x00007FF7F8BB4000-memory.dmp

Filesize
3.3MB

Download
memory/5040-214-0x00007FF641400000-0x00007FF641754000-memory.dmp

Filesize
3.3MB

Download
memory/5040-2168-0x00007FF641400000-0x00007FF641754000-memory.dmp

Filesize
3.3MB

Download