xmrig | f4db716082de84e4d84f5d82b0a2e18ff9d24c577f6f8f2118687ea86a6b7b85

Analysis

max time kernel
112s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
Size

2.1MB
MD5

3c2a3ef799c5216f6aeb69c07d437b30
SHA1

205c6259c5bcf9af7e9ddde1a182eb71f7f4f9bf
SHA256

f4db716082de84e4d84f5d82b0a2e18ff9d24c577f6f8f2118687ea86a6b7b85
SHA512

5bec039b2a5953055c3b29516a916752310c30b14109c2836d9350a9e5d1235990bfba6468ab83343d5afa7b0e91be02d3067219c69fac3d5876f7d81bb7981f
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIlMmGo9MID+:BemTLkNdfE0pZrg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4404-0-0x00007FF67CD10000-0x00007FF67D064000-memory.dmp	xmrig
behavioral2/files/0x0007000000023440-13.dat	xmrig
behavioral2/files/0x000700000002344a-55.dat	xmrig
behavioral2/files/0x0007000000023444-66.dat	xmrig
behavioral2/files/0x0007000000023449-67.dat	xmrig
behavioral2/files/0x0007000000023450-91.dat	xmrig
behavioral2/files/0x0007000000023452-141.dat	xmrig
behavioral2/files/0x000700000002345c-140.dat	xmrig
behavioral2/files/0x0007000000023458-162.dat	xmrig
behavioral2/memory/2992-182-0x00007FF6CCAA0000-0x00007FF6CCDF4000-memory.dmp	xmrig
behavioral2/memory/1868-192-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	xmrig
behavioral2/memory/2548-198-0x00007FF6274A0000-0x00007FF6277F4000-memory.dmp	xmrig
behavioral2/memory/1696-206-0x00007FF710CA0000-0x00007FF710FF4000-memory.dmp	xmrig
behavioral2/memory/3760-208-0x00007FF719510000-0x00007FF719864000-memory.dmp	xmrig
behavioral2/memory/3436-207-0x00007FF653970000-0x00007FF653CC4000-memory.dmp	xmrig
behavioral2/memory/924-205-0x00007FF6C7570000-0x00007FF6C78C4000-memory.dmp	xmrig
behavioral2/memory/5004-204-0x00007FF658160000-0x00007FF6584B4000-memory.dmp	xmrig
behavioral2/memory/2788-203-0x00007FF78AB20000-0x00007FF78AE74000-memory.dmp	xmrig
behavioral2/memory/2036-202-0x00007FF6E8760000-0x00007FF6E8AB4000-memory.dmp	xmrig
behavioral2/memory/1200-201-0x00007FF679ED0000-0x00007FF67A224000-memory.dmp	xmrig
behavioral2/memory/3720-200-0x00007FF7FE820000-0x00007FF7FEB74000-memory.dmp	xmrig
behavioral2/memory/4236-199-0x00007FF7BFA90000-0x00007FF7BFDE4000-memory.dmp	xmrig
behavioral2/memory/2772-197-0x00007FF6CAFF0000-0x00007FF6CB344000-memory.dmp	xmrig
behavioral2/memory/884-196-0x00007FF66A470000-0x00007FF66A7C4000-memory.dmp	xmrig
behavioral2/memory/1700-191-0x00007FF7E92A0000-0x00007FF7E95F4000-memory.dmp	xmrig
behavioral2/memory/768-187-0x00007FF6D6860000-0x00007FF6D6BB4000-memory.dmp	xmrig
behavioral2/memory/3184-183-0x00007FF634510000-0x00007FF634864000-memory.dmp	xmrig
behavioral2/files/0x000700000002345f-177.dat	xmrig
behavioral2/files/0x000700000002345b-175.dat	xmrig
behavioral2/files/0x000a000000023439-174.dat	xmrig
behavioral2/files/0x000700000002345e-170.dat	xmrig
behavioral2/files/0x000700000002345a-169.dat	xmrig
behavioral2/memory/3512-166-0x00007FF6FCDD0000-0x00007FF6FD124000-memory.dmp	xmrig
behavioral2/files/0x000700000002344e-158.dat	xmrig
behavioral2/files/0x0007000000023457-154.dat	xmrig
behavioral2/memory/2908-145-0x00007FF718A40000-0x00007FF718D94000-memory.dmp	xmrig
behavioral2/memory/3616-144-0x00007FF74BEB0000-0x00007FF74C204000-memory.dmp	xmrig
behavioral2/files/0x0007000000023455-133.dat	xmrig
behavioral2/files/0x0007000000023454-151.dat	xmrig
behavioral2/files/0x000700000002344f-148.dat	xmrig
behavioral2/files/0x0007000000023453-146.dat	xmrig
behavioral2/memory/1896-130-0x00007FF742C90000-0x00007FF742FE4000-memory.dmp	xmrig
behavioral2/memory/1580-128-0x00007FF6DB250000-0x00007FF6DB5A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023459-127.dat	xmrig
behavioral2/files/0x000700000002344d-123.dat	xmrig
behavioral2/files/0x0007000000023456-118.dat	xmrig
behavioral2/files/0x000700000002345d-143.dat	xmrig
behavioral2/files/0x000700000002344c-116.dat	xmrig
behavioral2/memory/2084-104-0x00007FF6E57B0000-0x00007FF6E5B04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023451-100.dat	xmrig
behavioral2/files/0x0007000000023447-83.dat	xmrig
behavioral2/files/0x0007000000023448-81.dat	xmrig
behavioral2/files/0x000700000002344b-79.dat	xmrig
behavioral2/memory/3556-76-0x00007FF7AD940000-0x00007FF7ADC94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023445-72.dat	xmrig
behavioral2/files/0x0007000000023446-59.dat	xmrig
behavioral2/memory/1540-52-0x00007FF6D45B0000-0x00007FF6D4904000-memory.dmp	xmrig
behavioral2/memory/3560-58-0x00007FF7BAFB0000-0x00007FF7BB304000-memory.dmp	xmrig
behavioral2/files/0x0007000000023443-40.dat	xmrig
behavioral2/files/0x0007000000023442-34.dat	xmrig
behavioral2/memory/3788-27-0x00007FF60C560000-0x00007FF60C8B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023441-19.dat	xmrig
behavioral2/memory/2412-10-0x00007FF74C6C0000-0x00007FF74CA14000-memory.dmp	xmrig
behavioral2/files/0x0009000000023434-6.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2412	gZFfjtW.exe
3788	wobEztw.exe
1540	udXVhoU.exe
2036	oOWswwc.exe
3560	UZDOSUn.exe
2788	HNOKXgk.exe
3556	Iaimalf.exe
2084	zsoguWM.exe
1580	AhwPZzo.exe
1896	QGniqLw.exe
3616	TBimirH.exe
5004	XczBRSJ.exe
2908	lFTArmr.exe
3512	VgDoCRr.exe
924	OLejUAE.exe
1696	VXntADh.exe
2992	sAMMcQS.exe
3184	NfKsfCp.exe
768	qcrJEAf.exe
3436	LPuUFnI.exe
1700	ErYFUID.exe
1868	LEhwcBS.exe
884	qpbAecH.exe
2772	BaCkCqq.exe
2548	iAOwfGq.exe
4236	xKAmkap.exe
3720	VPGqqsU.exe
3760	NGECiZX.exe
1200	MVTWjSs.exe
688	AXzxIIz.exe
2296	PUdNYGe.exe
2452	YtLQiba.exe
4092	HQytMso.exe
3212	blrJabN.exe
4540	mJbCfPq.exe
4700	cCPZcXb.exe
3700	Lnzspog.exe
4676	aKkPZCG.exe
4996	NXvTmcb.exe
4008	TczUJFf.exe
3236	zYgoUoz.exe
1008	hhRLLQH.exe
2092	dNjruYV.exe
5092	lqaboIc.exe
3476	EqnjOXv.exe
2604	fZuvoMd.exe
2576	dWJiixj.exe
1732	eIvjOBB.exe
2264	bgBjVfH.exe
432	ztptike.exe
4132	ZkpeSIK.exe
2152	NEdxSDc.exe
1184	Rtnxiuq.exe
1304	yWqNvnC.exe
748	BeYLIqh.exe
1160	JSqItTw.exe
1936	EEhyVDh.exe
4636	FRZXOyB.exe
2416	ZjevYnD.exe
4516	TehRgUq.exe
2344	UpgmRtq.exe
3416	TYrNpkR.exe
556	ogTrBaD.exe
2952	PwpWjwd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4404-0-0x00007FF67CD10000-0x00007FF67D064000-memory.dmp	upx
behavioral2/files/0x0007000000023440-13.dat	upx
behavioral2/files/0x000700000002344a-55.dat	upx
behavioral2/files/0x0007000000023444-66.dat	upx
behavioral2/files/0x0007000000023449-67.dat	upx
behavioral2/files/0x0007000000023450-91.dat	upx
behavioral2/files/0x0007000000023452-141.dat	upx
behavioral2/files/0x000700000002345c-140.dat	upx
behavioral2/files/0x0007000000023458-162.dat	upx
behavioral2/memory/2992-182-0x00007FF6CCAA0000-0x00007FF6CCDF4000-memory.dmp	upx
behavioral2/memory/1868-192-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	upx
behavioral2/memory/2548-198-0x00007FF6274A0000-0x00007FF6277F4000-memory.dmp	upx
behavioral2/memory/1696-206-0x00007FF710CA0000-0x00007FF710FF4000-memory.dmp	upx
behavioral2/memory/3760-208-0x00007FF719510000-0x00007FF719864000-memory.dmp	upx
behavioral2/memory/3436-207-0x00007FF653970000-0x00007FF653CC4000-memory.dmp	upx
behavioral2/memory/924-205-0x00007FF6C7570000-0x00007FF6C78C4000-memory.dmp	upx
behavioral2/memory/5004-204-0x00007FF658160000-0x00007FF6584B4000-memory.dmp	upx
behavioral2/memory/2788-203-0x00007FF78AB20000-0x00007FF78AE74000-memory.dmp	upx
behavioral2/memory/2036-202-0x00007FF6E8760000-0x00007FF6E8AB4000-memory.dmp	upx
behavioral2/memory/1200-201-0x00007FF679ED0000-0x00007FF67A224000-memory.dmp	upx
behavioral2/memory/3720-200-0x00007FF7FE820000-0x00007FF7FEB74000-memory.dmp	upx
behavioral2/memory/4236-199-0x00007FF7BFA90000-0x00007FF7BFDE4000-memory.dmp	upx
behavioral2/memory/2772-197-0x00007FF6CAFF0000-0x00007FF6CB344000-memory.dmp	upx
behavioral2/memory/884-196-0x00007FF66A470000-0x00007FF66A7C4000-memory.dmp	upx
behavioral2/memory/1700-191-0x00007FF7E92A0000-0x00007FF7E95F4000-memory.dmp	upx
behavioral2/memory/768-187-0x00007FF6D6860000-0x00007FF6D6BB4000-memory.dmp	upx
behavioral2/memory/3184-183-0x00007FF634510000-0x00007FF634864000-memory.dmp	upx
behavioral2/files/0x000700000002345f-177.dat	upx
behavioral2/files/0x000700000002345b-175.dat	upx
behavioral2/files/0x000a000000023439-174.dat	upx
behavioral2/files/0x000700000002345e-170.dat	upx
behavioral2/files/0x000700000002345a-169.dat	upx
behavioral2/memory/3512-166-0x00007FF6FCDD0000-0x00007FF6FD124000-memory.dmp	upx
behavioral2/files/0x000700000002344e-158.dat	upx
behavioral2/files/0x0007000000023457-154.dat	upx
behavioral2/memory/2908-145-0x00007FF718A40000-0x00007FF718D94000-memory.dmp	upx
behavioral2/memory/3616-144-0x00007FF74BEB0000-0x00007FF74C204000-memory.dmp	upx
behavioral2/files/0x0007000000023455-133.dat	upx
behavioral2/files/0x0007000000023454-151.dat	upx
behavioral2/files/0x000700000002344f-148.dat	upx
behavioral2/files/0x0007000000023453-146.dat	upx
behavioral2/memory/1896-130-0x00007FF742C90000-0x00007FF742FE4000-memory.dmp	upx
behavioral2/memory/1580-128-0x00007FF6DB250000-0x00007FF6DB5A4000-memory.dmp	upx
behavioral2/files/0x0007000000023459-127.dat	upx
behavioral2/files/0x000700000002344d-123.dat	upx
behavioral2/files/0x0007000000023456-118.dat	upx
behavioral2/files/0x000700000002345d-143.dat	upx
behavioral2/files/0x000700000002344c-116.dat	upx
behavioral2/memory/2084-104-0x00007FF6E57B0000-0x00007FF6E5B04000-memory.dmp	upx
behavioral2/files/0x0007000000023451-100.dat	upx
behavioral2/files/0x0007000000023447-83.dat	upx
behavioral2/files/0x0007000000023448-81.dat	upx
behavioral2/files/0x000700000002344b-79.dat	upx
behavioral2/memory/3556-76-0x00007FF7AD940000-0x00007FF7ADC94000-memory.dmp	upx
behavioral2/files/0x0007000000023445-72.dat	upx
behavioral2/files/0x0007000000023446-59.dat	upx
behavioral2/memory/1540-52-0x00007FF6D45B0000-0x00007FF6D4904000-memory.dmp	upx
behavioral2/memory/3560-58-0x00007FF7BAFB0000-0x00007FF7BB304000-memory.dmp	upx
behavioral2/files/0x0007000000023443-40.dat	upx
behavioral2/files/0x0007000000023442-34.dat	upx
behavioral2/memory/3788-27-0x00007FF60C560000-0x00007FF60C8B4000-memory.dmp	upx
behavioral2/files/0x0007000000023441-19.dat	upx
behavioral2/memory/2412-10-0x00007FF74C6C0000-0x00007FF74CA14000-memory.dmp	upx
behavioral2/files/0x0009000000023434-6.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jqcIaXQ.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\YwcwQHM.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\LIUSOlA.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\SOPbQvl.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\upPNmBo.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\VXntADh.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\MKPgjvo.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\cAxEmQz.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\bZTFbvv.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\TncEHtr.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\pSevoHI.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\BmjHyUD.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\ybFpUmK.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\tTgKyoM.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\FNaYxZW.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\HNOKXgk.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\UpgmRtq.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\kefCnus.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\zsoguWM.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\BwELdac.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\TYfOXkA.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\toeObvE.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\uPKFrDs.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\DswvREp.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\vgiRWMj.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\fRIPLNv.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\bbyChew.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\eWxeWLU.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\PwpWjwd.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\xFShYSV.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\EZUmNqP.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\XlgBxfL.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\zSvubae.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\EocuyEO.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\ssSNLNF.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\NIHSHSG.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\TBimirH.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\XczBRSJ.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\ePOKbcF.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\cxgnyaD.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\vcTELLm.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\fRShZZz.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\YHOMaWg.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\VtCHncK.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\abbYbzJ.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\TbeHSdC.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\JEgQIAn.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\nMqYqEw.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\nHyKNkp.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\oOWswwc.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\zSuumib.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\oceHLpO.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\FRZXOyB.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\FGVEKhO.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\pmdFUrj.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\MegMukc.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\plzyujV.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\nkniZCe.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\uHEdgqa.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\EcgERIX.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\zsWxQJA.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\jVNXANW.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\aiZzGuE.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
File created	C:\Windows\System\PHevBsA.exe	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 2412	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	83
PID 4404 wrote to memory of 2412	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	83
PID 4404 wrote to memory of 3788	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	84
PID 4404 wrote to memory of 3788	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	84
PID 4404 wrote to memory of 1540	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	85
PID 4404 wrote to memory of 1540	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	85
PID 4404 wrote to memory of 2788	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	86
PID 4404 wrote to memory of 2788	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	86
PID 4404 wrote to memory of 2036	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	87
PID 4404 wrote to memory of 2036	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	87
PID 4404 wrote to memory of 3560	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	88
PID 4404 wrote to memory of 3560	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	88
PID 4404 wrote to memory of 3556	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	89
PID 4404 wrote to memory of 3556	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	89
PID 4404 wrote to memory of 2084	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	90
PID 4404 wrote to memory of 2084	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	90
PID 4404 wrote to memory of 1580	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	91
PID 4404 wrote to memory of 1580	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	91
PID 4404 wrote to memory of 1896	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	92
PID 4404 wrote to memory of 1896	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	92
PID 4404 wrote to memory of 3616	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	93
PID 4404 wrote to memory of 3616	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	93
PID 4404 wrote to memory of 5004	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	94
PID 4404 wrote to memory of 5004	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	94
PID 4404 wrote to memory of 2908	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	95
PID 4404 wrote to memory of 2908	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	95
PID 4404 wrote to memory of 1696	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	96
PID 4404 wrote to memory of 1696	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	96
PID 4404 wrote to memory of 3512	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	97
PID 4404 wrote to memory of 3512	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	97
PID 4404 wrote to memory of 924	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	98
PID 4404 wrote to memory of 924	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	98
PID 4404 wrote to memory of 1700	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	99
PID 4404 wrote to memory of 1700	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	99
PID 4404 wrote to memory of 2992	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	100
PID 4404 wrote to memory of 2992	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	100
PID 4404 wrote to memory of 3184	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	101
PID 4404 wrote to memory of 3184	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	101
PID 4404 wrote to memory of 768	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	102
PID 4404 wrote to memory of 768	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	102
PID 4404 wrote to memory of 3436	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	103
PID 4404 wrote to memory of 3436	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	103
PID 4404 wrote to memory of 1868	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	104
PID 4404 wrote to memory of 1868	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	104
PID 4404 wrote to memory of 884	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	105
PID 4404 wrote to memory of 884	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	105
PID 4404 wrote to memory of 2772	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	106
PID 4404 wrote to memory of 2772	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	106
PID 4404 wrote to memory of 2548	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	107
PID 4404 wrote to memory of 2548	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	107
PID 4404 wrote to memory of 4236	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	108
PID 4404 wrote to memory of 4236	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	108
PID 4404 wrote to memory of 3720	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	109
PID 4404 wrote to memory of 3720	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	109
PID 4404 wrote to memory of 3760	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	110
PID 4404 wrote to memory of 3760	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	110
PID 4404 wrote to memory of 1200	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	111
PID 4404 wrote to memory of 1200	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	111
PID 4404 wrote to memory of 688	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	112
PID 4404 wrote to memory of 688	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	112
PID 4404 wrote to memory of 2296	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	113
PID 4404 wrote to memory of 2296	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	113
PID 4404 wrote to memory of 2452	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	114
PID 4404 wrote to memory of 2452	4404	3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe	114

C:\Users\Admin\AppData\Local\Temp\3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\3c2a3ef799c5216f6aeb69c07d437b30_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\System\gZFfjtW.exe
  C:\Windows\System\gZFfjtW.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\wobEztw.exe
  C:\Windows\System\wobEztw.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\udXVhoU.exe
  C:\Windows\System\udXVhoU.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\HNOKXgk.exe
  C:\Windows\System\HNOKXgk.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\oOWswwc.exe
  C:\Windows\System\oOWswwc.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\UZDOSUn.exe
  C:\Windows\System\UZDOSUn.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\Iaimalf.exe
  C:\Windows\System\Iaimalf.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\zsoguWM.exe
  C:\Windows\System\zsoguWM.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\AhwPZzo.exe
  C:\Windows\System\AhwPZzo.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\QGniqLw.exe
  C:\Windows\System\QGniqLw.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\TBimirH.exe
  C:\Windows\System\TBimirH.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\XczBRSJ.exe
  C:\Windows\System\XczBRSJ.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\lFTArmr.exe
  C:\Windows\System\lFTArmr.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\VXntADh.exe
  C:\Windows\System\VXntADh.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\VgDoCRr.exe
  C:\Windows\System\VgDoCRr.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\OLejUAE.exe
  C:\Windows\System\OLejUAE.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\ErYFUID.exe
  C:\Windows\System\ErYFUID.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\sAMMcQS.exe
  C:\Windows\System\sAMMcQS.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\NfKsfCp.exe
  C:\Windows\System\NfKsfCp.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\qcrJEAf.exe
  C:\Windows\System\qcrJEAf.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\LPuUFnI.exe
  C:\Windows\System\LPuUFnI.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\LEhwcBS.exe
  C:\Windows\System\LEhwcBS.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\qpbAecH.exe
  C:\Windows\System\qpbAecH.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\BaCkCqq.exe
  C:\Windows\System\BaCkCqq.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\iAOwfGq.exe
  C:\Windows\System\iAOwfGq.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\xKAmkap.exe
  C:\Windows\System\xKAmkap.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\VPGqqsU.exe
  C:\Windows\System\VPGqqsU.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\NGECiZX.exe
  C:\Windows\System\NGECiZX.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\MVTWjSs.exe
  C:\Windows\System\MVTWjSs.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\AXzxIIz.exe
  C:\Windows\System\AXzxIIz.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\PUdNYGe.exe
  C:\Windows\System\PUdNYGe.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\YtLQiba.exe
  C:\Windows\System\YtLQiba.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\HQytMso.exe
  C:\Windows\System\HQytMso.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\blrJabN.exe
  C:\Windows\System\blrJabN.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\mJbCfPq.exe
  C:\Windows\System\mJbCfPq.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\cCPZcXb.exe
  C:\Windows\System\cCPZcXb.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\Lnzspog.exe
  C:\Windows\System\Lnzspog.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\aKkPZCG.exe
  C:\Windows\System\aKkPZCG.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\NXvTmcb.exe
  C:\Windows\System\NXvTmcb.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\TczUJFf.exe
  C:\Windows\System\TczUJFf.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\zYgoUoz.exe
  C:\Windows\System\zYgoUoz.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\hhRLLQH.exe
  C:\Windows\System\hhRLLQH.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\dNjruYV.exe
  C:\Windows\System\dNjruYV.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\lqaboIc.exe
  C:\Windows\System\lqaboIc.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\EqnjOXv.exe
  C:\Windows\System\EqnjOXv.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\fZuvoMd.exe
  C:\Windows\System\fZuvoMd.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\dWJiixj.exe
  C:\Windows\System\dWJiixj.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\eIvjOBB.exe
  C:\Windows\System\eIvjOBB.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\bgBjVfH.exe
  C:\Windows\System\bgBjVfH.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\ztptike.exe
  C:\Windows\System\ztptike.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\ZkpeSIK.exe
  C:\Windows\System\ZkpeSIK.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\NEdxSDc.exe
  C:\Windows\System\NEdxSDc.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\Rtnxiuq.exe
  C:\Windows\System\Rtnxiuq.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\yWqNvnC.exe
  C:\Windows\System\yWqNvnC.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\BeYLIqh.exe
  C:\Windows\System\BeYLIqh.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\JSqItTw.exe
  C:\Windows\System\JSqItTw.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\EEhyVDh.exe
  C:\Windows\System\EEhyVDh.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\FRZXOyB.exe
  C:\Windows\System\FRZXOyB.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\ZjevYnD.exe
  C:\Windows\System\ZjevYnD.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\TehRgUq.exe
  C:\Windows\System\TehRgUq.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\UpgmRtq.exe
  C:\Windows\System\UpgmRtq.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\TYrNpkR.exe
  C:\Windows\System\TYrNpkR.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\ogTrBaD.exe
  C:\Windows\System\ogTrBaD.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\PwpWjwd.exe
  C:\Windows\System\PwpWjwd.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\UfQhTTZ.exe
  C:\Windows\System\UfQhTTZ.exe
  2⤵
  PID:2436
- C:\Windows\System\gSaPMSw.exe
  C:\Windows\System\gSaPMSw.exe
  2⤵
  PID:4576
- C:\Windows\System\WdsJsnd.exe
  C:\Windows\System\WdsJsnd.exe
  2⤵
  PID:5072
- C:\Windows\System\wwNaiJJ.exe
  C:\Windows\System\wwNaiJJ.exe
  2⤵
  PID:868
- C:\Windows\System\hruYJTR.exe
  C:\Windows\System\hruYJTR.exe
  2⤵
  PID:3812
- C:\Windows\System\XWylFMM.exe
  C:\Windows\System\XWylFMM.exe
  2⤵
  PID:1040
- C:\Windows\System\sTInLrT.exe
  C:\Windows\System\sTInLrT.exe
  2⤵
  PID:1628
- C:\Windows\System\nrYkqLC.exe
  C:\Windows\System\nrYkqLC.exe
  2⤵
  PID:2024
- C:\Windows\System\WWyEWCT.exe
  C:\Windows\System\WWyEWCT.exe
  2⤵
  PID:2712
- C:\Windows\System\ASHpUrK.exe
  C:\Windows\System\ASHpUrK.exe
  2⤵
  PID:2976
- C:\Windows\System\zMDgxMJ.exe
  C:\Windows\System\zMDgxMJ.exe
  2⤵
  PID:1960
- C:\Windows\System\NLYSgqV.exe
  C:\Windows\System\NLYSgqV.exe
  2⤵
  PID:2260
- C:\Windows\System\ZndQDZI.exe
  C:\Windows\System\ZndQDZI.exe
  2⤵
  PID:1780
- C:\Windows\System\cXEvrjx.exe
  C:\Windows\System\cXEvrjx.exe
  2⤵
  PID:1824
- C:\Windows\System\RuiLmTt.exe
  C:\Windows\System\RuiLmTt.exe
  2⤵
  PID:5064
- C:\Windows\System\ozsGGNx.exe
  C:\Windows\System\ozsGGNx.exe
  2⤵
  PID:4992
- C:\Windows\System\MWdIybv.exe
  C:\Windows\System\MWdIybv.exe
  2⤵
  PID:2596
- C:\Windows\System\ygAauPR.exe
  C:\Windows\System\ygAauPR.exe
  2⤵
  PID:4440
- C:\Windows\System\UCqgSlL.exe
  C:\Windows\System\UCqgSlL.exe
  2⤵
  PID:4224
- C:\Windows\System\peWdzQu.exe
  C:\Windows\System\peWdzQu.exe
  2⤵
  PID:436
- C:\Windows\System\FExBOqD.exe
  C:\Windows\System\FExBOqD.exe
  2⤵
  PID:4844
- C:\Windows\System\KmWxxyH.exe
  C:\Windows\System\KmWxxyH.exe
  2⤵
  PID:3624
- C:\Windows\System\YzsIrFY.exe
  C:\Windows\System\YzsIrFY.exe
  2⤵
  PID:5012
- C:\Windows\System\mLjSvJL.exe
  C:\Windows\System\mLjSvJL.exe
  2⤵
  PID:832
- C:\Windows\System\cKfYzYz.exe
  C:\Windows\System\cKfYzYz.exe
  2⤵
  PID:3044
- C:\Windows\System\BEdhQBD.exe
  C:\Windows\System\BEdhQBD.exe
  2⤵
  PID:5144
- C:\Windows\System\QYEnjEa.exe
  C:\Windows\System\QYEnjEa.exe
  2⤵
  PID:5172
- C:\Windows\System\UrwmczB.exe
  C:\Windows\System\UrwmczB.exe
  2⤵
  PID:5196
- C:\Windows\System\uUmZAXg.exe
  C:\Windows\System\uUmZAXg.exe
  2⤵
  PID:5224
- C:\Windows\System\cwjtjyk.exe
  C:\Windows\System\cwjtjyk.exe
  2⤵
  PID:5256
- C:\Windows\System\PLeOSNZ.exe
  C:\Windows\System\PLeOSNZ.exe
  2⤵
  PID:5288
- C:\Windows\System\TupYnoV.exe
  C:\Windows\System\TupYnoV.exe
  2⤵
  PID:5312
- C:\Windows\System\VGbhDiG.exe
  C:\Windows\System\VGbhDiG.exe
  2⤵
  PID:5348
- C:\Windows\System\mAhbLxW.exe
  C:\Windows\System\mAhbLxW.exe
  2⤵
  PID:5388
- C:\Windows\System\AtPtuEP.exe
  C:\Windows\System\AtPtuEP.exe
  2⤵
  PID:5428
- C:\Windows\System\zIVjhEj.exe
  C:\Windows\System\zIVjhEj.exe
  2⤵
  PID:5452
- C:\Windows\System\oSvVkJX.exe
  C:\Windows\System\oSvVkJX.exe
  2⤵
  PID:5496
- C:\Windows\System\aeqIeGV.exe
  C:\Windows\System\aeqIeGV.exe
  2⤵
  PID:5524
- C:\Windows\System\VZhsEBE.exe
  C:\Windows\System\VZhsEBE.exe
  2⤵
  PID:5560
- C:\Windows\System\xALvxwR.exe
  C:\Windows\System\xALvxwR.exe
  2⤵
  PID:5576
- C:\Windows\System\gaqFWWM.exe
  C:\Windows\System\gaqFWWM.exe
  2⤵
  PID:5596
- C:\Windows\System\inBvCgA.exe
  C:\Windows\System\inBvCgA.exe
  2⤵
  PID:5628
- C:\Windows\System\BKFNvwF.exe
  C:\Windows\System\BKFNvwF.exe
  2⤵
  PID:5668
- C:\Windows\System\XDjlwSZ.exe
  C:\Windows\System\XDjlwSZ.exe
  2⤵
  PID:5700
- C:\Windows\System\DEsGJrQ.exe
  C:\Windows\System\DEsGJrQ.exe
  2⤵
  PID:5736
- C:\Windows\System\CpIQszC.exe
  C:\Windows\System\CpIQszC.exe
  2⤵
  PID:5760
- C:\Windows\System\PHevBsA.exe
  C:\Windows\System\PHevBsA.exe
  2⤵
  PID:5800
- C:\Windows\System\YHOMaWg.exe
  C:\Windows\System\YHOMaWg.exe
  2⤵
  PID:5828
- C:\Windows\System\RBcEeyd.exe
  C:\Windows\System\RBcEeyd.exe
  2⤵
  PID:5856
- C:\Windows\System\UFYGYkp.exe
  C:\Windows\System\UFYGYkp.exe
  2⤵
  PID:5884
- C:\Windows\System\PngGkVM.exe
  C:\Windows\System\PngGkVM.exe
  2⤵
  PID:5912
- C:\Windows\System\JtKbMnO.exe
  C:\Windows\System\JtKbMnO.exe
  2⤵
  PID:5940
- C:\Windows\System\wgHHMQD.exe
  C:\Windows\System\wgHHMQD.exe
  2⤵
  PID:5968
- C:\Windows\System\iEirXYi.exe
  C:\Windows\System\iEirXYi.exe
  2⤵
  PID:6000
- C:\Windows\System\qBdjRpU.exe
  C:\Windows\System\qBdjRpU.exe
  2⤵
  PID:6024
- C:\Windows\System\ZrmNxwt.exe
  C:\Windows\System\ZrmNxwt.exe
  2⤵
  PID:6052
- C:\Windows\System\egCievH.exe
  C:\Windows\System\egCievH.exe
  2⤵
  PID:6080
- C:\Windows\System\lWLeDVB.exe
  C:\Windows\System\lWLeDVB.exe
  2⤵
  PID:6108
- C:\Windows\System\xfVRXGT.exe
  C:\Windows\System\xfVRXGT.exe
  2⤵
  PID:6136
- C:\Windows\System\VFZSzsJ.exe
  C:\Windows\System\VFZSzsJ.exe
  2⤵
  PID:5164
- C:\Windows\System\hNqzZrO.exe
  C:\Windows\System\hNqzZrO.exe
  2⤵
  PID:5236
- C:\Windows\System\rHApwIT.exe
  C:\Windows\System\rHApwIT.exe
  2⤵
  PID:5340
- C:\Windows\System\pqyxKxd.exe
  C:\Windows\System\pqyxKxd.exe
  2⤵
  PID:5412
- C:\Windows\System\ujwXSEu.exe
  C:\Windows\System\ujwXSEu.exe
  2⤵
  PID:5480
- C:\Windows\System\ggrutNK.exe
  C:\Windows\System\ggrutNK.exe
  2⤵
  PID:5556
- C:\Windows\System\tucApyl.exe
  C:\Windows\System\tucApyl.exe
  2⤵
  PID:5640
- C:\Windows\System\LyOnDuT.exe
  C:\Windows\System\LyOnDuT.exe
  2⤵
  PID:5684
- C:\Windows\System\sVBGijk.exe
  C:\Windows\System\sVBGijk.exe
  2⤵
  PID:5772
- C:\Windows\System\rYsqCEa.exe
  C:\Windows\System\rYsqCEa.exe
  2⤵
  PID:5840
- C:\Windows\System\AWiDBkW.exe
  C:\Windows\System\AWiDBkW.exe
  2⤵
  PID:5904
- C:\Windows\System\YXyYifB.exe
  C:\Windows\System\YXyYifB.exe
  2⤵
  PID:5936
- C:\Windows\System\vwrppsw.exe
  C:\Windows\System\vwrppsw.exe
  2⤵
  PID:6020
- C:\Windows\System\XOMkgOw.exe
  C:\Windows\System\XOMkgOw.exe
  2⤵
  PID:6100
- C:\Windows\System\eCASliE.exe
  C:\Windows\System\eCASliE.exe
  2⤵
  PID:5152
- C:\Windows\System\gXRDrvH.exe
  C:\Windows\System\gXRDrvH.exe
  2⤵
  PID:5296
- C:\Windows\System\KBCDsiU.exe
  C:\Windows\System\KBCDsiU.exe
  2⤵
  PID:5508
- C:\Windows\System\CuOyHyB.exe
  C:\Windows\System\CuOyHyB.exe
  2⤵
  PID:5656
- C:\Windows\System\PdukHff.exe
  C:\Windows\System\PdukHff.exe
  2⤵
  PID:5820
- C:\Windows\System\lOIhLuF.exe
  C:\Windows\System\lOIhLuF.exe
  2⤵
  PID:5992
- C:\Windows\System\vUwzisW.exe
  C:\Windows\System\vUwzisW.exe
  2⤵
  PID:1712
- C:\Windows\System\LXefWnN.exe
  C:\Windows\System\LXefWnN.exe
  2⤵
  PID:5440
- C:\Windows\System\xMWFTkd.exe
  C:\Windows\System\xMWFTkd.exe
  2⤵
  PID:5932
- C:\Windows\System\JarHfve.exe
  C:\Windows\System\JarHfve.exe
  2⤵
  PID:5384
- C:\Windows\System\bWpVMcc.exe
  C:\Windows\System\bWpVMcc.exe
  2⤵
  PID:6064
- C:\Windows\System\QtyEfwP.exe
  C:\Windows\System\QtyEfwP.exe
  2⤵
  PID:6152
- C:\Windows\System\rDwFkoi.exe
  C:\Windows\System\rDwFkoi.exe
  2⤵
  PID:6184
- C:\Windows\System\QElDZqk.exe
  C:\Windows\System\QElDZqk.exe
  2⤵
  PID:6216
- C:\Windows\System\toeObvE.exe
  C:\Windows\System\toeObvE.exe
  2⤵
  PID:6252
- C:\Windows\System\CXIAFSx.exe
  C:\Windows\System\CXIAFSx.exe
  2⤵
  PID:6304
- C:\Windows\System\ynYFOrx.exe
  C:\Windows\System\ynYFOrx.exe
  2⤵
  PID:6324
- C:\Windows\System\kefCnus.exe
  C:\Windows\System\kefCnus.exe
  2⤵
  PID:6356
- C:\Windows\System\KnNeAKm.exe
  C:\Windows\System\KnNeAKm.exe
  2⤵
  PID:6404
- C:\Windows\System\GMvJohA.exe
  C:\Windows\System\GMvJohA.exe
  2⤵
  PID:6436
- C:\Windows\System\IwUBqJg.exe
  C:\Windows\System\IwUBqJg.exe
  2⤵
  PID:6472
- C:\Windows\System\KEbaeRF.exe
  C:\Windows\System\KEbaeRF.exe
  2⤵
  PID:6512
- C:\Windows\System\jHhTgEw.exe
  C:\Windows\System\jHhTgEw.exe
  2⤵
  PID:6536
- C:\Windows\System\ylosPxy.exe
  C:\Windows\System\ylosPxy.exe
  2⤵
  PID:6576
- C:\Windows\System\hYuXLmf.exe
  C:\Windows\System\hYuXLmf.exe
  2⤵
  PID:6604
- C:\Windows\System\TqNGUEF.exe
  C:\Windows\System\TqNGUEF.exe
  2⤵
  PID:6636
- C:\Windows\System\otuRAyl.exe
  C:\Windows\System\otuRAyl.exe
  2⤵
  PID:6672
- C:\Windows\System\qtCHeKr.exe
  C:\Windows\System\qtCHeKr.exe
  2⤵
  PID:6716
- C:\Windows\System\uejcNXj.exe
  C:\Windows\System\uejcNXj.exe
  2⤵
  PID:6752
- C:\Windows\System\MKPgjvo.exe
  C:\Windows\System\MKPgjvo.exe
  2⤵
  PID:6788
- C:\Windows\System\wZlbfWP.exe
  C:\Windows\System\wZlbfWP.exe
  2⤵
  PID:6832
- C:\Windows\System\lbgiJYi.exe
  C:\Windows\System\lbgiJYi.exe
  2⤵
  PID:6856
- C:\Windows\System\QiYoUKg.exe
  C:\Windows\System\QiYoUKg.exe
  2⤵
  PID:6892
- C:\Windows\System\DYUmXya.exe
  C:\Windows\System\DYUmXya.exe
  2⤵
  PID:6928
- C:\Windows\System\UyFBJNZ.exe
  C:\Windows\System\UyFBJNZ.exe
  2⤵
  PID:6960
- C:\Windows\System\brLzMdh.exe
  C:\Windows\System\brLzMdh.exe
  2⤵
  PID:6992
- C:\Windows\System\gBVpNpQ.exe
  C:\Windows\System\gBVpNpQ.exe
  2⤵
  PID:7012
- C:\Windows\System\MnazYbX.exe
  C:\Windows\System\MnazYbX.exe
  2⤵
  PID:7036
- C:\Windows\System\MXzhUwL.exe
  C:\Windows\System\MXzhUwL.exe
  2⤵
  PID:7064
- C:\Windows\System\JaQxNiC.exe
  C:\Windows\System\JaQxNiC.exe
  2⤵
  PID:7088
- C:\Windows\System\xStUdnB.exe
  C:\Windows\System\xStUdnB.exe
  2⤵
  PID:7128
- C:\Windows\System\bXQvdEv.exe
  C:\Windows\System\bXQvdEv.exe
  2⤵
  PID:7164
- C:\Windows\System\JYPdXgv.exe
  C:\Windows\System\JYPdXgv.exe
  2⤵
  PID:6164
- C:\Windows\System\LnmHCRN.exe
  C:\Windows\System\LnmHCRN.exe
  2⤵
  PID:6248
- C:\Windows\System\lwihcOU.exe
  C:\Windows\System\lwihcOU.exe
  2⤵
  PID:6340
- C:\Windows\System\qIaGjRh.exe
  C:\Windows\System\qIaGjRh.exe
  2⤵
  PID:6416
- C:\Windows\System\mBJIwfi.exe
  C:\Windows\System\mBJIwfi.exe
  2⤵
  PID:6504
- C:\Windows\System\cKnVQXO.exe
  C:\Windows\System\cKnVQXO.exe
  2⤵
  PID:6572
- C:\Windows\System\qHfskmd.exe
  C:\Windows\System\qHfskmd.exe
  2⤵
  PID:6660
- C:\Windows\System\GqSZFvQ.exe
  C:\Windows\System\GqSZFvQ.exe
  2⤵
  PID:6764
- C:\Windows\System\buqFPNm.exe
  C:\Windows\System\buqFPNm.exe
  2⤵
  PID:6848
- C:\Windows\System\bxJOtfG.exe
  C:\Windows\System\bxJOtfG.exe
  2⤵
  PID:6952
- C:\Windows\System\WwUxhtX.exe
  C:\Windows\System\WwUxhtX.exe
  2⤵
  PID:6984
- C:\Windows\System\aiVgkGd.exe
  C:\Windows\System\aiVgkGd.exe
  2⤵
  PID:7032
- C:\Windows\System\nukXYAT.exe
  C:\Windows\System\nukXYAT.exe
  2⤵
  PID:7116
- C:\Windows\System\ePOKbcF.exe
  C:\Windows\System\ePOKbcF.exe
  2⤵
  PID:6148
- C:\Windows\System\uiULdcG.exe
  C:\Windows\System\uiULdcG.exe
  2⤵
  PID:6396
- C:\Windows\System\QPLvRjI.exe
  C:\Windows\System\QPLvRjI.exe
  2⤵
  PID:6628
- C:\Windows\System\zlMtLBp.exe
  C:\Windows\System\zlMtLBp.exe
  2⤵
  PID:6884
- C:\Windows\System\SJPsJbk.exe
  C:\Windows\System\SJPsJbk.exe
  2⤵
  PID:7084
- C:\Windows\System\FliNDln.exe
  C:\Windows\System\FliNDln.exe
  2⤵
  PID:6460
- C:\Windows\System\rpMQVfJ.exe
  C:\Windows\System\rpMQVfJ.exe
  2⤵
  PID:6748
- C:\Windows\System\Rdownrq.exe
  C:\Windows\System\Rdownrq.exe
  2⤵
  PID:4040
- C:\Windows\System\PsCtkrA.exe
  C:\Windows\System\PsCtkrA.exe
  2⤵
  PID:6712
- C:\Windows\System\NggBdcm.exe
  C:\Windows\System\NggBdcm.exe
  2⤵
  PID:7192
- C:\Windows\System\GjRsZNR.exe
  C:\Windows\System\GjRsZNR.exe
  2⤵
  PID:7232
- C:\Windows\System\DePsqzt.exe
  C:\Windows\System\DePsqzt.exe
  2⤵
  PID:7260
- C:\Windows\System\VZIdhqb.exe
  C:\Windows\System\VZIdhqb.exe
  2⤵
  PID:7296
- C:\Windows\System\YhvIVlD.exe
  C:\Windows\System\YhvIVlD.exe
  2⤵
  PID:7320
- C:\Windows\System\XtPTRxD.exe
  C:\Windows\System\XtPTRxD.exe
  2⤵
  PID:7352
- C:\Windows\System\zSuumib.exe
  C:\Windows\System\zSuumib.exe
  2⤵
  PID:7380
- C:\Windows\System\JrcKTjV.exe
  C:\Windows\System\JrcKTjV.exe
  2⤵
  PID:7408
- C:\Windows\System\lZuKIkJ.exe
  C:\Windows\System\lZuKIkJ.exe
  2⤵
  PID:7436
- C:\Windows\System\nerbMUk.exe
  C:\Windows\System\nerbMUk.exe
  2⤵
  PID:7464
- C:\Windows\System\PhkktOE.exe
  C:\Windows\System\PhkktOE.exe
  2⤵
  PID:7492
- C:\Windows\System\pjWYCEe.exe
  C:\Windows\System\pjWYCEe.exe
  2⤵
  PID:7524
- C:\Windows\System\MSShIaT.exe
  C:\Windows\System\MSShIaT.exe
  2⤵
  PID:7548
- C:\Windows\System\oceHLpO.exe
  C:\Windows\System\oceHLpO.exe
  2⤵
  PID:7584
- C:\Windows\System\dujISgC.exe
  C:\Windows\System\dujISgC.exe
  2⤵
  PID:7608
- C:\Windows\System\frBjosm.exe
  C:\Windows\System\frBjosm.exe
  2⤵
  PID:7644
- C:\Windows\System\wyBfcEj.exe
  C:\Windows\System\wyBfcEj.exe
  2⤵
  PID:7668
- C:\Windows\System\ucFmTyS.exe
  C:\Windows\System\ucFmTyS.exe
  2⤵
  PID:7700
- C:\Windows\System\fBlWBVw.exe
  C:\Windows\System\fBlWBVw.exe
  2⤵
  PID:7736
- C:\Windows\System\vouPfTp.exe
  C:\Windows\System\vouPfTp.exe
  2⤵
  PID:7764
- C:\Windows\System\qShUHst.exe
  C:\Windows\System\qShUHst.exe
  2⤵
  PID:7788
- C:\Windows\System\IsgWPWM.exe
  C:\Windows\System\IsgWPWM.exe
  2⤵
  PID:7820
- C:\Windows\System\QNfbLbD.exe
  C:\Windows\System\QNfbLbD.exe
  2⤵
  PID:7844
- C:\Windows\System\CghWQsM.exe
  C:\Windows\System\CghWQsM.exe
  2⤵
  PID:7872
- C:\Windows\System\pUZIyyc.exe
  C:\Windows\System\pUZIyyc.exe
  2⤵
  PID:7908
- C:\Windows\System\bwBxJuq.exe
  C:\Windows\System\bwBxJuq.exe
  2⤵
  PID:7932
- C:\Windows\System\VNTCwId.exe
  C:\Windows\System\VNTCwId.exe
  2⤵
  PID:7968
- C:\Windows\System\GxDLrxG.exe
  C:\Windows\System\GxDLrxG.exe
  2⤵
  PID:7988
- C:\Windows\System\cAxEmQz.exe
  C:\Windows\System\cAxEmQz.exe
  2⤵
  PID:8016
- C:\Windows\System\nSBELyp.exe
  C:\Windows\System\nSBELyp.exe
  2⤵
  PID:8044
- C:\Windows\System\kyYRdmG.exe
  C:\Windows\System\kyYRdmG.exe
  2⤵
  PID:8072
- C:\Windows\System\lmOyJOW.exe
  C:\Windows\System\lmOyJOW.exe
  2⤵
  PID:8100
- C:\Windows\System\jqcIaXQ.exe
  C:\Windows\System\jqcIaXQ.exe
  2⤵
  PID:8128
- C:\Windows\System\JyqnOkC.exe
  C:\Windows\System\JyqnOkC.exe
  2⤵
  PID:8156
- C:\Windows\System\XYeKTAn.exe
  C:\Windows\System\XYeKTAn.exe
  2⤵
  PID:8184
- C:\Windows\System\knhpaWO.exe
  C:\Windows\System\knhpaWO.exe
  2⤵
  PID:7224
- C:\Windows\System\ZvHSzJZ.exe
  C:\Windows\System\ZvHSzJZ.exe
  2⤵
  PID:7280
- C:\Windows\System\TxHfBOh.exe
  C:\Windows\System\TxHfBOh.exe
  2⤵
  PID:7348
- C:\Windows\System\QnGdhym.exe
  C:\Windows\System\QnGdhym.exe
  2⤵
  PID:7420
- C:\Windows\System\ZhDFQqt.exe
  C:\Windows\System\ZhDFQqt.exe
  2⤵
  PID:7484
- C:\Windows\System\UDcMhER.exe
  C:\Windows\System\UDcMhER.exe
  2⤵
  PID:7544
- C:\Windows\System\nkniZCe.exe
  C:\Windows\System\nkniZCe.exe
  2⤵
  PID:7620
- C:\Windows\System\fKxCnSS.exe
  C:\Windows\System\fKxCnSS.exe
  2⤵
  PID:7688
- C:\Windows\System\YnyAfhv.exe
  C:\Windows\System\YnyAfhv.exe
  2⤵
  PID:7772
- C:\Windows\System\geyDfoU.exe
  C:\Windows\System\geyDfoU.exe
  2⤵
  PID:7836
- C:\Windows\System\dpnRiFQ.exe
  C:\Windows\System\dpnRiFQ.exe
  2⤵
  PID:7720
- C:\Windows\System\hYhwnhf.exe
  C:\Windows\System\hYhwnhf.exe
  2⤵
  PID:7952
- C:\Windows\System\EvcMvIc.exe
  C:\Windows\System\EvcMvIc.exe
  2⤵
  PID:8012
- C:\Windows\System\FdSOLNu.exe
  C:\Windows\System\FdSOLNu.exe
  2⤵
  PID:8084
- C:\Windows\System\IDNCJrE.exe
  C:\Windows\System\IDNCJrE.exe
  2⤵
  PID:8152
- C:\Windows\System\XxzBJGa.exe
  C:\Windows\System\XxzBJGa.exe
  2⤵
  PID:7184
- C:\Windows\System\eyTXDlz.exe
  C:\Windows\System\eyTXDlz.exe
  2⤵
  PID:7332
- C:\Windows\System\sHNQqvS.exe
  C:\Windows\System\sHNQqvS.exe
  2⤵
  PID:7512
- C:\Windows\System\OZcNHWb.exe
  C:\Windows\System\OZcNHWb.exe
  2⤵
  PID:7652
- C:\Windows\System\VzrvleE.exe
  C:\Windows\System\VzrvleE.exe
  2⤵
  PID:7828
- C:\Windows\System\YIBPPIT.exe
  C:\Windows\System\YIBPPIT.exe
  2⤵
  PID:7980
- C:\Windows\System\ZyNLkNX.exe
  C:\Windows\System\ZyNLkNX.exe
  2⤵
  PID:8124
- C:\Windows\System\DQPQuqK.exe
  C:\Windows\System\DQPQuqK.exe
  2⤵
  PID:7308
- C:\Windows\System\lYIsJIZ.exe
  C:\Windows\System\lYIsJIZ.exe
  2⤵
  PID:7756
- C:\Windows\System\ybFpUmK.exe
  C:\Windows\System\ybFpUmK.exe
  2⤵
  PID:8068
- C:\Windows\System\KWKTdHq.exe
  C:\Windows\System\KWKTdHq.exe
  2⤵
  PID:7256
- C:\Windows\System\oWOwWwA.exe
  C:\Windows\System\oWOwWwA.exe
  2⤵
  PID:7604
- C:\Windows\System\nenFNdZ.exe
  C:\Windows\System\nenFNdZ.exe
  2⤵
  PID:7460
- C:\Windows\System\edIpoIJ.exe
  C:\Windows\System\edIpoIJ.exe
  2⤵
  PID:8236
- C:\Windows\System\FVyVwAF.exe
  C:\Windows\System\FVyVwAF.exe
  2⤵
  PID:8268
- C:\Windows\System\BwELdac.exe
  C:\Windows\System\BwELdac.exe
  2⤵
  PID:8304
- C:\Windows\System\SZFglAk.exe
  C:\Windows\System\SZFglAk.exe
  2⤵
  PID:8340
- C:\Windows\System\YxNuGMk.exe
  C:\Windows\System\YxNuGMk.exe
  2⤵
  PID:8368
- C:\Windows\System\tRhVzus.exe
  C:\Windows\System\tRhVzus.exe
  2⤵
  PID:8404
- C:\Windows\System\xTaNNVE.exe
  C:\Windows\System\xTaNNVE.exe
  2⤵
  PID:8432
- C:\Windows\System\UAjuVTU.exe
  C:\Windows\System\UAjuVTU.exe
  2⤵
  PID:8468
- C:\Windows\System\GdxUVgv.exe
  C:\Windows\System\GdxUVgv.exe
  2⤵
  PID:8492
- C:\Windows\System\uHEdgqa.exe
  C:\Windows\System\uHEdgqa.exe
  2⤵
  PID:8520
- C:\Windows\System\vvcUQXj.exe
  C:\Windows\System\vvcUQXj.exe
  2⤵
  PID:8548
- C:\Windows\System\YOcTUIy.exe
  C:\Windows\System\YOcTUIy.exe
  2⤵
  PID:8572
- C:\Windows\System\ClnGlLO.exe
  C:\Windows\System\ClnGlLO.exe
  2⤵
  PID:8600
- C:\Windows\System\EcgERIX.exe
  C:\Windows\System\EcgERIX.exe
  2⤵
  PID:8632
- C:\Windows\System\CXDlDPC.exe
  C:\Windows\System\CXDlDPC.exe
  2⤵
  PID:8664
- C:\Windows\System\WhHPoPL.exe
  C:\Windows\System\WhHPoPL.exe
  2⤵
  PID:8688
- C:\Windows\System\TeSKLrV.exe
  C:\Windows\System\TeSKLrV.exe
  2⤵
  PID:8716
- C:\Windows\System\ruJihDS.exe
  C:\Windows\System\ruJihDS.exe
  2⤵
  PID:8744
- C:\Windows\System\tPaIlmV.exe
  C:\Windows\System\tPaIlmV.exe
  2⤵
  PID:8772
- C:\Windows\System\vqWZPEM.exe
  C:\Windows\System\vqWZPEM.exe
  2⤵
  PID:8800
- C:\Windows\System\QZLWVDN.exe
  C:\Windows\System\QZLWVDN.exe
  2⤵
  PID:8828
- C:\Windows\System\UvtApEt.exe
  C:\Windows\System\UvtApEt.exe
  2⤵
  PID:8860
- C:\Windows\System\qiRaUjl.exe
  C:\Windows\System\qiRaUjl.exe
  2⤵
  PID:8888
- C:\Windows\System\GjvYqBS.exe
  C:\Windows\System\GjvYqBS.exe
  2⤵
  PID:8916
- C:\Windows\System\tVrkuQR.exe
  C:\Windows\System\tVrkuQR.exe
  2⤵
  PID:8948
- C:\Windows\System\vxqjRUN.exe
  C:\Windows\System\vxqjRUN.exe
  2⤵
  PID:8976
- C:\Windows\System\dWbdmrE.exe
  C:\Windows\System\dWbdmrE.exe
  2⤵
  PID:9012
- C:\Windows\System\lzNrVLg.exe
  C:\Windows\System\lzNrVLg.exe
  2⤵
  PID:9040
- C:\Windows\System\utyMoGm.exe
  C:\Windows\System\utyMoGm.exe
  2⤵
  PID:9068
- C:\Windows\System\aQHrTGh.exe
  C:\Windows\System\aQHrTGh.exe
  2⤵
  PID:9096
- C:\Windows\System\wYjYkBx.exe
  C:\Windows\System\wYjYkBx.exe
  2⤵
  PID:9124
- C:\Windows\System\VAmlalk.exe
  C:\Windows\System\VAmlalk.exe
  2⤵
  PID:9152
- C:\Windows\System\jIcyqeB.exe
  C:\Windows\System\jIcyqeB.exe
  2⤵
  PID:9180
- C:\Windows\System\MivpOTR.exe
  C:\Windows\System\MivpOTR.exe
  2⤵
  PID:9208
- C:\Windows\System\ppVvAQT.exe
  C:\Windows\System\ppVvAQT.exe
  2⤵
  PID:8204
- C:\Windows\System\mJUiaMf.exe
  C:\Windows\System\mJUiaMf.exe
  2⤵
  PID:8260
- C:\Windows\System\CDkljCA.exe
  C:\Windows\System\CDkljCA.exe
  2⤵
  PID:8324
- C:\Windows\System\NfZySJs.exe
  C:\Windows\System\NfZySJs.exe
  2⤵
  PID:8420
- C:\Windows\System\bfkurTI.exe
  C:\Windows\System\bfkurTI.exe
  2⤵
  PID:4968
- C:\Windows\System\mHgKWmF.exe
  C:\Windows\System\mHgKWmF.exe
  2⤵
  PID:8508
- C:\Windows\System\ADihMYq.exe
  C:\Windows\System\ADihMYq.exe
  2⤵
  PID:8584
- C:\Windows\System\oJaxoQW.exe
  C:\Windows\System\oJaxoQW.exe
  2⤵
  PID:8700
- C:\Windows\System\lxjiMjE.exe
  C:\Windows\System\lxjiMjE.exe
  2⤵
  PID:8764
- C:\Windows\System\lbOHwoP.exe
  C:\Windows\System\lbOHwoP.exe
  2⤵
  PID:8824
- C:\Windows\System\igJbTjU.exe
  C:\Windows\System\igJbTjU.exe
  2⤵
  PID:8908
- C:\Windows\System\NfOgKLb.exe
  C:\Windows\System\NfOgKLb.exe
  2⤵
  PID:8988
- C:\Windows\System\nlZQbnJ.exe
  C:\Windows\System\nlZQbnJ.exe
  2⤵
  PID:9080
- C:\Windows\System\QvkiFit.exe
  C:\Windows\System\QvkiFit.exe
  2⤵
  PID:9148
- C:\Windows\System\UPxLAqx.exe
  C:\Windows\System\UPxLAqx.exe
  2⤵
  PID:8180
- C:\Windows\System\JLWfNIa.exe
  C:\Windows\System\JLWfNIa.exe
  2⤵
  PID:8312
- C:\Windows\System\XQuhtGx.exe
  C:\Windows\System\XQuhtGx.exe
  2⤵
  PID:3860
- C:\Windows\System\jvPQjIL.exe
  C:\Windows\System\jvPQjIL.exe
  2⤵
  PID:8568
- C:\Windows\System\eDzhpff.exe
  C:\Windows\System\eDzhpff.exe
  2⤵
  PID:8792
- C:\Windows\System\VtePAFS.exe
  C:\Windows\System\VtePAFS.exe
  2⤵
  PID:8968
- C:\Windows\System\hDXLHYz.exe
  C:\Windows\System\hDXLHYz.exe
  2⤵
  PID:9136
- C:\Windows\System\AjkedPq.exe
  C:\Windows\System\AjkedPq.exe
  2⤵
  PID:8300
- C:\Windows\System\FVlTTkv.exe
  C:\Windows\System\FVlTTkv.exe
  2⤵
  PID:8388
- C:\Windows\System\SzllOoZ.exe
  C:\Windows\System\SzllOoZ.exe
  2⤵
  PID:8964
- C:\Windows\System\PHsnmUg.exe
  C:\Windows\System\PHsnmUg.exe
  2⤵
  PID:8440
- C:\Windows\System\zxPzBLq.exe
  C:\Windows\System\zxPzBLq.exe
  2⤵
  PID:9204
- C:\Windows\System\byGrSuX.exe
  C:\Windows\System\byGrSuX.exe
  2⤵
  PID:9224
- C:\Windows\System\RGekNVn.exe
  C:\Windows\System\RGekNVn.exe
  2⤵
  PID:9256
- C:\Windows\System\hVBQvts.exe
  C:\Windows\System\hVBQvts.exe
  2⤵
  PID:9280
- C:\Windows\System\nEcolRj.exe
  C:\Windows\System\nEcolRj.exe
  2⤵
  PID:9308
- C:\Windows\System\wcWEaBd.exe
  C:\Windows\System\wcWEaBd.exe
  2⤵
  PID:9336
- C:\Windows\System\OkBDSvD.exe
  C:\Windows\System\OkBDSvD.exe
  2⤵
  PID:9368
- C:\Windows\System\GJRftNj.exe
  C:\Windows\System\GJRftNj.exe
  2⤵
  PID:9408
- C:\Windows\System\trnAsvZ.exe
  C:\Windows\System\trnAsvZ.exe
  2⤵
  PID:9436
- C:\Windows\System\pCDJvhi.exe
  C:\Windows\System\pCDJvhi.exe
  2⤵
  PID:9464
- C:\Windows\System\FinRHdF.exe
  C:\Windows\System\FinRHdF.exe
  2⤵
  PID:9504
- C:\Windows\System\JUxGFuG.exe
  C:\Windows\System\JUxGFuG.exe
  2⤵
  PID:9544
- C:\Windows\System\GTJUTed.exe
  C:\Windows\System\GTJUTed.exe
  2⤵
  PID:9576
- C:\Windows\System\LSbSAJn.exe
  C:\Windows\System\LSbSAJn.exe
  2⤵
  PID:9604
- C:\Windows\System\BGBJSvG.exe
  C:\Windows\System\BGBJSvG.exe
  2⤵
  PID:9640
- C:\Windows\System\LpgvWdG.exe
  C:\Windows\System\LpgvWdG.exe
  2⤵
  PID:9668
- C:\Windows\System\zSvubae.exe
  C:\Windows\System\zSvubae.exe
  2⤵
  PID:9700
- C:\Windows\System\cYzWGNi.exe
  C:\Windows\System\cYzWGNi.exe
  2⤵
  PID:9716
- C:\Windows\System\bgKbjkF.exe
  C:\Windows\System\bgKbjkF.exe
  2⤵
  PID:9744
- C:\Windows\System\YwcwQHM.exe
  C:\Windows\System\YwcwQHM.exe
  2⤵
  PID:9784
- C:\Windows\System\ggszxJp.exe
  C:\Windows\System\ggszxJp.exe
  2⤵
  PID:9816
- C:\Windows\System\iLUIAzG.exe
  C:\Windows\System\iLUIAzG.exe
  2⤵
  PID:9852
- C:\Windows\System\XrGQNwg.exe
  C:\Windows\System\XrGQNwg.exe
  2⤵
  PID:9880
- C:\Windows\System\MegMukc.exe
  C:\Windows\System\MegMukc.exe
  2⤵
  PID:9908
- C:\Windows\System\nCvsiJf.exe
  C:\Windows\System\nCvsiJf.exe
  2⤵
  PID:9936
- C:\Windows\System\TbeHSdC.exe
  C:\Windows\System\TbeHSdC.exe
  2⤵
  PID:9964
- C:\Windows\System\YLGbcRa.exe
  C:\Windows\System\YLGbcRa.exe
  2⤵
  PID:9992
- C:\Windows\System\uMaJbto.exe
  C:\Windows\System\uMaJbto.exe
  2⤵
  PID:10020
- C:\Windows\System\KjFMUlq.exe
  C:\Windows\System\KjFMUlq.exe
  2⤵
  PID:10048
- C:\Windows\System\LIUSOlA.exe
  C:\Windows\System\LIUSOlA.exe
  2⤵
  PID:10076
- C:\Windows\System\FGVEKhO.exe
  C:\Windows\System\FGVEKhO.exe
  2⤵
  PID:10104
- C:\Windows\System\vEAqCLy.exe
  C:\Windows\System\vEAqCLy.exe
  2⤵
  PID:10132
- C:\Windows\System\ADqwfrQ.exe
  C:\Windows\System\ADqwfrQ.exe
  2⤵
  PID:10160
- C:\Windows\System\QuHHHau.exe
  C:\Windows\System\QuHHHau.exe
  2⤵
  PID:10188
- C:\Windows\System\vbZWZcR.exe
  C:\Windows\System\vbZWZcR.exe
  2⤵
  PID:10204
- C:\Windows\System\VtCHncK.exe
  C:\Windows\System\VtCHncK.exe
  2⤵
  PID:9248
- C:\Windows\System\ISKKiXT.exe
  C:\Windows\System\ISKKiXT.exe
  2⤵
  PID:9300
- C:\Windows\System\xFShYSV.exe
  C:\Windows\System\xFShYSV.exe
  2⤵
  PID:9380
- C:\Windows\System\FbErmRl.exe
  C:\Windows\System\FbErmRl.exe
  2⤵
  PID:9476
- C:\Windows\System\uVLEtWH.exe
  C:\Windows\System\uVLEtWH.exe
  2⤵
  PID:9572
- C:\Windows\System\QoaePAp.exe
  C:\Windows\System\QoaePAp.exe
  2⤵
  PID:9660
- C:\Windows\System\pMmubwu.exe
  C:\Windows\System\pMmubwu.exe
  2⤵
  PID:9708
- C:\Windows\System\BCzJyGN.exe
  C:\Windows\System\BCzJyGN.exe
  2⤵
  PID:9780
- C:\Windows\System\dCxdjoW.exe
  C:\Windows\System\dCxdjoW.exe
  2⤵
  PID:9848
- C:\Windows\System\oxMMFdp.exe
  C:\Windows\System\oxMMFdp.exe
  2⤵
  PID:9864
- C:\Windows\System\qzWRSpV.exe
  C:\Windows\System\qzWRSpV.exe
  2⤵
  PID:9832
- C:\Windows\System\dItgWCO.exe
  C:\Windows\System\dItgWCO.exe
  2⤵
  PID:9960
- C:\Windows\System\gTuIzCn.exe
  C:\Windows\System\gTuIzCn.exe
  2⤵
  PID:10044
- C:\Windows\System\NiUvWaq.exe
  C:\Windows\System\NiUvWaq.exe
  2⤵
  PID:10128
- C:\Windows\System\ddRjWEy.exe
  C:\Windows\System\ddRjWEy.exe
  2⤵
  PID:10200
- C:\Windows\System\uPKFrDs.exe
  C:\Windows\System\uPKFrDs.exe
  2⤵
  PID:9276
- C:\Windows\System\dXmSwYE.exe
  C:\Windows\System\dXmSwYE.exe
  2⤵
  PID:9352
- C:\Windows\System\JikalZX.exe
  C:\Windows\System\JikalZX.exe
  2⤵
  PID:9596
- C:\Windows\System\mBmFdoX.exe
  C:\Windows\System\mBmFdoX.exe
  2⤵
  PID:9776
- C:\Windows\System\aSYlrNX.exe
  C:\Windows\System\aSYlrNX.exe
  2⤵
  PID:4140
- C:\Windows\System\fGmxkPC.exe
  C:\Windows\System\fGmxkPC.exe
  2⤵
  PID:9988
- C:\Windows\System\SAAWHTn.exe
  C:\Windows\System\SAAWHTn.exe
  2⤵
  PID:10180
- C:\Windows\System\opiZabA.exe
  C:\Windows\System\opiZabA.exe
  2⤵
  PID:9396
- C:\Windows\System\tWbKocB.exe
  C:\Windows\System\tWbKocB.exe
  2⤵
  PID:9344
- C:\Windows\System\nMCoNiB.exe
  C:\Windows\System\nMCoNiB.exe
  2⤵
  PID:10016
- C:\Windows\System\EZUmNqP.exe
  C:\Windows\System\EZUmNqP.exe
  2⤵
  PID:9628
- C:\Windows\System\gANeVtk.exe
  C:\Windows\System\gANeVtk.exe
  2⤵
  PID:9320
- C:\Windows\System\rlXQTiW.exe
  C:\Windows\System\rlXQTiW.exe
  2⤵
  PID:10268
- C:\Windows\System\oiHfdxe.exe
  C:\Windows\System\oiHfdxe.exe
  2⤵
  PID:10296
- C:\Windows\System\zlfFVni.exe
  C:\Windows\System\zlfFVni.exe
  2⤵
  PID:10324
- C:\Windows\System\iykvbSh.exe
  C:\Windows\System\iykvbSh.exe
  2⤵
  PID:10352
- C:\Windows\System\vgiRWMj.exe
  C:\Windows\System\vgiRWMj.exe
  2⤵
  PID:10380
- C:\Windows\System\KPTfWjT.exe
  C:\Windows\System\KPTfWjT.exe
  2⤵
  PID:10408
- C:\Windows\System\obHslsu.exe
  C:\Windows\System\obHslsu.exe
  2⤵
  PID:10436
- C:\Windows\System\yOZYIHX.exe
  C:\Windows\System\yOZYIHX.exe
  2⤵
  PID:10464
- C:\Windows\System\QjXWfZa.exe
  C:\Windows\System\QjXWfZa.exe
  2⤵
  PID:10492
- C:\Windows\System\LrsFAnd.exe
  C:\Windows\System\LrsFAnd.exe
  2⤵
  PID:10524
- C:\Windows\System\KQpjBhY.exe
  C:\Windows\System\KQpjBhY.exe
  2⤵
  PID:10552
- C:\Windows\System\GvAxKJz.exe
  C:\Windows\System\GvAxKJz.exe
  2⤵
  PID:10584
- C:\Windows\System\UPZkkgL.exe
  C:\Windows\System\UPZkkgL.exe
  2⤵
  PID:10616
- C:\Windows\System\JXtrrvn.exe
  C:\Windows\System\JXtrrvn.exe
  2⤵
  PID:10644
- C:\Windows\System\FLKLUQn.exe
  C:\Windows\System\FLKLUQn.exe
  2⤵
  PID:10672
- C:\Windows\System\GhYzYHZ.exe
  C:\Windows\System\GhYzYHZ.exe
  2⤵
  PID:10700
- C:\Windows\System\QdPTkje.exe
  C:\Windows\System\QdPTkje.exe
  2⤵
  PID:10728
- C:\Windows\System\kbGkgml.exe
  C:\Windows\System\kbGkgml.exe
  2⤵
  PID:10756
- C:\Windows\System\lATEoFw.exe
  C:\Windows\System\lATEoFw.exe
  2⤵
  PID:10784
- C:\Windows\System\cEVLDlu.exe
  C:\Windows\System\cEVLDlu.exe
  2⤵
  PID:10812
- C:\Windows\System\tTgKyoM.exe
  C:\Windows\System\tTgKyoM.exe
  2⤵
  PID:10844
- C:\Windows\System\JLGyezY.exe
  C:\Windows\System\JLGyezY.exe
  2⤵
  PID:10872
- C:\Windows\System\fksiFCn.exe
  C:\Windows\System\fksiFCn.exe
  2⤵
  PID:10900
- C:\Windows\System\IupCCvi.exe
  C:\Windows\System\IupCCvi.exe
  2⤵
  PID:10928
- C:\Windows\System\gwemslz.exe
  C:\Windows\System\gwemslz.exe
  2⤵
  PID:10956
- C:\Windows\System\xKQxvMu.exe
  C:\Windows\System\xKQxvMu.exe
  2⤵
  PID:10984
- C:\Windows\System\NwESiCg.exe
  C:\Windows\System\NwESiCg.exe
  2⤵
  PID:11012
- C:\Windows\System\reTyTzW.exe
  C:\Windows\System\reTyTzW.exe
  2⤵
  PID:11040
- C:\Windows\System\kxvpIyG.exe
  C:\Windows\System\kxvpIyG.exe
  2⤵
  PID:11064
- C:\Windows\System\abbYbzJ.exe
  C:\Windows\System\abbYbzJ.exe
  2⤵
  PID:11096
- C:\Windows\System\uWVEtjF.exe
  C:\Windows\System\uWVEtjF.exe
  2⤵
  PID:11124
- C:\Windows\System\JXuPCOQ.exe
  C:\Windows\System\JXuPCOQ.exe
  2⤵
  PID:11152
- C:\Windows\System\tMeKLQE.exe
  C:\Windows\System\tMeKLQE.exe
  2⤵
  PID:11180
- C:\Windows\System\zsWxQJA.exe
  C:\Windows\System\zsWxQJA.exe
  2⤵
  PID:11208
- C:\Windows\System\GaAMaPT.exe
  C:\Windows\System\GaAMaPT.exe
  2⤵
  PID:11236
- C:\Windows\System\PoPYyVq.exe
  C:\Windows\System\PoPYyVq.exe
  2⤵
  PID:9928
- C:\Windows\System\KxQRFzz.exe
  C:\Windows\System\KxQRFzz.exe
  2⤵
  PID:10308
- C:\Windows\System\EocuyEO.exe
  C:\Windows\System\EocuyEO.exe
  2⤵
  PID:10372
- C:\Windows\System\fSxplTu.exe
  C:\Windows\System\fSxplTu.exe
  2⤵
  PID:10448
- C:\Windows\System\yItsTKM.exe
  C:\Windows\System\yItsTKM.exe
  2⤵
  PID:10516
- C:\Windows\System\UMnEdmS.exe
  C:\Windows\System\UMnEdmS.exe
  2⤵
  PID:10580
- C:\Windows\System\glDrVIo.exe
  C:\Windows\System\glDrVIo.exe
  2⤵
  PID:10656
- C:\Windows\System\iykZwdR.exe
  C:\Windows\System\iykZwdR.exe
  2⤵
  PID:10720
- C:\Windows\System\xGaVuRj.exe
  C:\Windows\System\xGaVuRj.exe
  2⤵
  PID:10780
- C:\Windows\System\HwNtvnp.exe
  C:\Windows\System\HwNtvnp.exe
  2⤵
  PID:10864
- C:\Windows\System\uJDYXli.exe
  C:\Windows\System\uJDYXli.exe
  2⤵
  PID:10912
- C:\Windows\System\srdlcOc.exe
  C:\Windows\System\srdlcOc.exe
  2⤵
  PID:10952
- C:\Windows\System\jGmsFgP.exe
  C:\Windows\System\jGmsFgP.exe
  2⤵
  PID:11024
- C:\Windows\System\nfPdYDT.exe
  C:\Windows\System\nfPdYDT.exe
  2⤵
  PID:11088
- C:\Windows\System\MVfIcMD.exe
  C:\Windows\System\MVfIcMD.exe
  2⤵
  PID:11164
- C:\Windows\System\RsyjlSH.exe
  C:\Windows\System\RsyjlSH.exe
  2⤵
  PID:11228
- C:\Windows\System\BTgRFUk.exe
  C:\Windows\System\BTgRFUk.exe
  2⤵
  PID:10292
- C:\Windows\System\tlamMTa.exe
  C:\Windows\System\tlamMTa.exe
  2⤵
  PID:9424
- C:\Windows\System\dYQQnXN.exe
  C:\Windows\System\dYQQnXN.exe
  2⤵
  PID:10512
- C:\Windows\System\aGDXJbR.exe
  C:\Windows\System\aGDXJbR.exe
  2⤵
  PID:10504
- C:\Windows\System\sesfoef.exe
  C:\Windows\System\sesfoef.exe
  2⤵
  PID:9364
- C:\Windows\System\nmFsHks.exe
  C:\Windows\System\nmFsHks.exe
  2⤵
  PID:10824
- C:\Windows\System\pQPHfna.exe
  C:\Windows\System\pQPHfna.exe
  2⤵
  PID:10996
- C:\Windows\System\wIFNPSd.exe
  C:\Windows\System\wIFNPSd.exe
  2⤵
  PID:11204
- C:\Windows\System\OcinWpZ.exe
  C:\Windows\System\OcinWpZ.exe
  2⤵
  PID:10364
- C:\Windows\System\JeswMoO.exe
  C:\Windows\System\JeswMoO.exe
  2⤵
  PID:10948
- C:\Windows\System\MnBEjFx.exe
  C:\Windows\System\MnBEjFx.exe
  2⤵
  PID:10576
- C:\Windows\System\ZvFrTUt.exe
  C:\Windows\System\ZvFrTUt.exe
  2⤵
  PID:10604
- C:\Windows\System\ndwhYDc.exe
  C:\Windows\System\ndwhYDc.exe
  2⤵
  PID:10096
- C:\Windows\System\lQnyzfb.exe
  C:\Windows\System\lQnyzfb.exe
  2⤵
  PID:11284
- C:\Windows\System\HaJBPNs.exe
  C:\Windows\System\HaJBPNs.exe
  2⤵
  PID:11316
- C:\Windows\System\TAXfTTE.exe
  C:\Windows\System\TAXfTTE.exe
  2⤵
  PID:11340
- C:\Windows\System\tucdzMn.exe
  C:\Windows\System\tucdzMn.exe
  2⤵
  PID:11368
- C:\Windows\System\RBaecvY.exe
  C:\Windows\System\RBaecvY.exe
  2⤵
  PID:11404
- C:\Windows\System\hACyyBs.exe
  C:\Windows\System\hACyyBs.exe
  2⤵
  PID:11436
- C:\Windows\System\SCIVTZd.exe
  C:\Windows\System\SCIVTZd.exe
  2⤵
  PID:11460
- C:\Windows\System\zjHXomm.exe
  C:\Windows\System\zjHXomm.exe
  2⤵
  PID:11492
- C:\Windows\System\XXInAVF.exe
  C:\Windows\System\XXInAVF.exe
  2⤵
  PID:11528
- C:\Windows\System\ueBAqgg.exe
  C:\Windows\System\ueBAqgg.exe
  2⤵
  PID:11556
- C:\Windows\System\XnTnrlx.exe
  C:\Windows\System\XnTnrlx.exe
  2⤵
  PID:11584
- C:\Windows\System\tNXLBjR.exe
  C:\Windows\System\tNXLBjR.exe
  2⤵
  PID:11612
- C:\Windows\System\eOHryID.exe
  C:\Windows\System\eOHryID.exe
  2⤵
  PID:11640
- C:\Windows\System\UAQwixO.exe
  C:\Windows\System\UAQwixO.exe
  2⤵
  PID:11668
- C:\Windows\System\KPRUkFZ.exe
  C:\Windows\System\KPRUkFZ.exe
  2⤵
  PID:11696
- C:\Windows\System\tMawNCq.exe
  C:\Windows\System\tMawNCq.exe
  2⤵
  PID:11724
- C:\Windows\System\VEcqthH.exe
  C:\Windows\System\VEcqthH.exe
  2⤵
  PID:11764
- C:\Windows\System\feWHGNI.exe
  C:\Windows\System\feWHGNI.exe
  2⤵
  PID:11812
- C:\Windows\System\SuvSWlM.exe
  C:\Windows\System\SuvSWlM.exe
  2⤵
  PID:11852
- C:\Windows\System\RotaTQG.exe
  C:\Windows\System\RotaTQG.exe
  2⤵
  PID:11892
- C:\Windows\System\mZrtOIu.exe
  C:\Windows\System\mZrtOIu.exe
  2⤵
  PID:11920
- C:\Windows\System\pCvoGon.exe
  C:\Windows\System\pCvoGon.exe
  2⤵
  PID:11948
- C:\Windows\System\DFWKFlx.exe
  C:\Windows\System\DFWKFlx.exe
  2⤵
  PID:11976
- C:\Windows\System\CFjUtNr.exe
  C:\Windows\System\CFjUtNr.exe
  2⤵
  PID:12004
- C:\Windows\System\vKbzeEW.exe
  C:\Windows\System\vKbzeEW.exe
  2⤵
  PID:12032
- C:\Windows\System\TfLEfXp.exe
  C:\Windows\System\TfLEfXp.exe
  2⤵
  PID:12060
- C:\Windows\System\flBsrDu.exe
  C:\Windows\System\flBsrDu.exe
  2⤵
  PID:12088
- C:\Windows\System\dVqDOCP.exe
  C:\Windows\System\dVqDOCP.exe
  2⤵
  PID:12116
- C:\Windows\System\XOITBIU.exe
  C:\Windows\System\XOITBIU.exe
  2⤵
  PID:12144
- C:\Windows\System\ZqAapap.exe
  C:\Windows\System\ZqAapap.exe
  2⤵
  PID:12172
- C:\Windows\System\IHfzhJZ.exe
  C:\Windows\System\IHfzhJZ.exe
  2⤵
  PID:12200
- C:\Windows\System\JEgQIAn.exe
  C:\Windows\System\JEgQIAn.exe
  2⤵
  PID:12228
- C:\Windows\System\OrZiLuN.exe
  C:\Windows\System\OrZiLuN.exe
  2⤵
  PID:12256
- C:\Windows\System\IAbaSBC.exe
  C:\Windows\System\IAbaSBC.exe
  2⤵
  PID:12284
- C:\Windows\System\nMqYqEw.exe
  C:\Windows\System\nMqYqEw.exe
  2⤵
  PID:11304
- C:\Windows\System\rywmHTW.exe
  C:\Windows\System\rywmHTW.exe
  2⤵
  PID:11376
- C:\Windows\System\RxeHFHM.exe
  C:\Windows\System\RxeHFHM.exe
  2⤵
  PID:11432
- C:\Windows\System\TSfxvNw.exe
  C:\Windows\System\TSfxvNw.exe
  2⤵
  PID:11500
- C:\Windows\System\sZZNXaV.exe
  C:\Windows\System\sZZNXaV.exe
  2⤵
  PID:10856
- C:\Windows\System\SOPbQvl.exe
  C:\Windows\System\SOPbQvl.exe
  2⤵
  PID:11568
- C:\Windows\System\AzEJbGL.exe
  C:\Windows\System\AzEJbGL.exe
  2⤵
  PID:11632
- C:\Windows\System\wClnpDN.exe
  C:\Windows\System\wClnpDN.exe
  2⤵
  PID:11692
- C:\Windows\System\aeqQHnA.exe
  C:\Windows\System\aeqQHnA.exe
  2⤵
  PID:10840
- C:\Windows\System\PwHSMdl.exe
  C:\Windows\System\PwHSMdl.exe
  2⤵
  PID:11864
- C:\Windows\System\ZtXUWxC.exe
  C:\Windows\System\ZtXUWxC.exe
  2⤵
  PID:11932
- C:\Windows\System\DmcycDI.exe
  C:\Windows\System\DmcycDI.exe
  2⤵
  PID:11996
- C:\Windows\System\VJFniGs.exe
  C:\Windows\System\VJFniGs.exe
  2⤵
  PID:12056
- C:\Windows\System\UHufZfy.exe
  C:\Windows\System\UHufZfy.exe
  2⤵
  PID:12128
- C:\Windows\System\WjzTFbP.exe
  C:\Windows\System\WjzTFbP.exe
  2⤵
  PID:12192
- C:\Windows\System\VxiBtgu.exe
  C:\Windows\System\VxiBtgu.exe
  2⤵
  PID:12252
- C:\Windows\System\cxgnyaD.exe
  C:\Windows\System\cxgnyaD.exe
  2⤵
  PID:11268
- C:\Windows\System\jCBpGii.exe
  C:\Windows\System\jCBpGii.exe
  2⤵
  PID:11424
- C:\Windows\System\USXWzYb.exe
  C:\Windows\System\USXWzYb.exe
  2⤵
  PID:11512
- C:\Windows\System\dIJSPCp.exe
  C:\Windows\System\dIJSPCp.exe
  2⤵
  PID:11844
- C:\Windows\System\FTkyocb.exe
  C:\Windows\System\FTkyocb.exe
  2⤵
  PID:11988
- C:\Windows\System\dOuNvym.exe
  C:\Windows\System\dOuNvym.exe
  2⤵
  PID:12084
- C:\Windows\System\vekaHKZ.exe
  C:\Windows\System\vekaHKZ.exe
  2⤵
  PID:2620
- C:\Windows\System\jPzXAVz.exe
  C:\Windows\System\jPzXAVz.exe
  2⤵
  PID:12280
- C:\Windows\System\VKbiRuB.exe
  C:\Windows\System\VKbiRuB.exe
  2⤵
  PID:756
- C:\Windows\System\anIiBaK.exe
  C:\Windows\System\anIiBaK.exe
  2⤵
  PID:672
- C:\Windows\System\jQJqCMd.exe
  C:\Windows\System\jQJqCMd.exe
  2⤵
  PID:4784
- C:\Windows\System\cApJfoY.exe
  C:\Windows\System\cApJfoY.exe
  2⤵
  PID:11552
- C:\Windows\System\XuwzBZG.exe
  C:\Windows\System\XuwzBZG.exe
  2⤵
  PID:11968
- C:\Windows\System\KRcwslG.exe
  C:\Windows\System\KRcwslG.exe
  2⤵
  PID:12240
- C:\Windows\System\BPOwjih.exe
  C:\Windows\System\BPOwjih.exe
  2⤵
  PID:11356
- C:\Windows\System\CGMdVba.exe
  C:\Windows\System\CGMdVba.exe
  2⤵
  PID:5380
- C:\Windows\System\upPNmBo.exe
  C:\Windows\System\upPNmBo.exe
  2⤵
  PID:12156
- C:\Windows\System\SavoSxq.exe
  C:\Windows\System\SavoSxq.exe
  2⤵
  PID:11388
- C:\Windows\System\BBnmbzX.exe
  C:\Windows\System\BBnmbzX.exe
  2⤵
  PID:700
- C:\Windows\System\TncEHtr.exe
  C:\Windows\System\TncEHtr.exe
  2⤵
  PID:12320
- C:\Windows\System\ZugYpms.exe
  C:\Windows\System\ZugYpms.exe
  2⤵
  PID:12348
- C:\Windows\System\WiehRGY.exe
  C:\Windows\System\WiehRGY.exe
  2⤵
  PID:12376
- C:\Windows\System\jnaCvoI.exe
  C:\Windows\System\jnaCvoI.exe
  2⤵
  PID:12404
- C:\Windows\System\KpcGDPX.exe
  C:\Windows\System\KpcGDPX.exe
  2⤵
  PID:12432
- C:\Windows\System\vZlxeRR.exe
  C:\Windows\System\vZlxeRR.exe
  2⤵
  PID:12460
- C:\Windows\System\ZrYWXMf.exe
  C:\Windows\System\ZrYWXMf.exe
  2⤵
  PID:12500
- C:\Windows\System\bgdaVYu.exe
  C:\Windows\System\bgdaVYu.exe
  2⤵
  PID:12516
- C:\Windows\System\uRPwGUH.exe
  C:\Windows\System\uRPwGUH.exe
  2⤵
  PID:12544
- C:\Windows\System\HYurwsO.exe
  C:\Windows\System\HYurwsO.exe
  2⤵
  PID:12572
- C:\Windows\System\zJMJDVo.exe
  C:\Windows\System\zJMJDVo.exe
  2⤵
  PID:12600
- C:\Windows\System\GAHkFCE.exe
  C:\Windows\System\GAHkFCE.exe
  2⤵
  PID:12628
- C:\Windows\System\bhcrarX.exe
  C:\Windows\System\bhcrarX.exe
  2⤵
  PID:12656
- C:\Windows\System\vCvHhtT.exe
  C:\Windows\System\vCvHhtT.exe
  2⤵
  PID:12684
- C:\Windows\System\HRLuCZC.exe
  C:\Windows\System\HRLuCZC.exe
  2⤵
  PID:12712
- C:\Windows\System\jVNXANW.exe
  C:\Windows\System\jVNXANW.exe
  2⤵
  PID:12740
- C:\Windows\System\kHpFWlX.exe
  C:\Windows\System\kHpFWlX.exe
  2⤵
  PID:12768
- C:\Windows\System\ZWugzvD.exe
  C:\Windows\System\ZWugzvD.exe
  2⤵
  PID:12796
- C:\Windows\System\qWMOyCH.exe
  C:\Windows\System\qWMOyCH.exe
  2⤵
  PID:12824
- C:\Windows\System\nZPpjlJ.exe
  C:\Windows\System\nZPpjlJ.exe
  2⤵
  PID:12852
- C:\Windows\System\CMvQmVQ.exe
  C:\Windows\System\CMvQmVQ.exe
  2⤵
  PID:12880
- C:\Windows\System\vMayOdX.exe
  C:\Windows\System\vMayOdX.exe
  2⤵
  PID:12908
- C:\Windows\System\zQQAdhE.exe
  C:\Windows\System\zQQAdhE.exe
  2⤵
  PID:12936
- C:\Windows\System\VlChjjM.exe
  C:\Windows\System\VlChjjM.exe
  2⤵
  PID:12964
- C:\Windows\System\qvyQnyO.exe
  C:\Windows\System\qvyQnyO.exe
  2⤵
  PID:12992
- C:\Windows\System\DQwzoIZ.exe
  C:\Windows\System\DQwzoIZ.exe
  2⤵
  PID:13020
- C:\Windows\System\BDOpuSU.exe
  C:\Windows\System\BDOpuSU.exe
  2⤵
  PID:13048
- C:\Windows\System\EvKIGrn.exe
  C:\Windows\System\EvKIGrn.exe
  2⤵
  PID:13068
- C:\Windows\System\CYtNzRM.exe
  C:\Windows\System\CYtNzRM.exe
  2⤵
  PID:13092
- C:\Windows\System\fRIPLNv.exe
  C:\Windows\System\fRIPLNv.exe
  2⤵
  PID:13124
- C:\Windows\System\ABIOEni.exe
  C:\Windows\System\ABIOEni.exe
  2⤵
  PID:13164
- C:\Windows\System\UsdBfnu.exe
  C:\Windows\System\UsdBfnu.exe
  2⤵
  PID:13188
- C:\Windows\System\pSevoHI.exe
  C:\Windows\System\pSevoHI.exe
  2⤵
  PID:13208
- C:\Windows\System\WugDVEU.exe
  C:\Windows\System\WugDVEU.exe
  2⤵
  PID:13248
- C:\Windows\System\GraxZtY.exe
  C:\Windows\System\GraxZtY.exe
  2⤵
  PID:13276
- C:\Windows\System\pVcpwcg.exe
  C:\Windows\System\pVcpwcg.exe
  2⤵
  PID:13304
- C:\Windows\System\crxFAaC.exe
  C:\Windows\System\crxFAaC.exe
  2⤵
  PID:12332
- C:\Windows\System\aNJDylQ.exe
  C:\Windows\System\aNJDylQ.exe
  2⤵
  PID:12396
- C:\Windows\System\hPkMqXn.exe
  C:\Windows\System\hPkMqXn.exe
  2⤵
  PID:12456
- C:\Windows\System\SMFWSYm.exe
  C:\Windows\System\SMFWSYm.exe
  2⤵
  PID:12528
- C:\Windows\System\aeKYjOY.exe
  C:\Windows\System\aeKYjOY.exe
  2⤵
  PID:12596
- C:\Windows\System\TYfOXkA.exe
  C:\Windows\System\TYfOXkA.exe
  2⤵
  PID:12652
- C:\Windows\System\bbyChew.exe
  C:\Windows\System\bbyChew.exe
  2⤵
  PID:12724
- C:\Windows\System\ScIDgtQ.exe
  C:\Windows\System\ScIDgtQ.exe
  2⤵
  PID:12788
- C:\Windows\System\TMDINrZ.exe
  C:\Windows\System\TMDINrZ.exe
  2⤵
  PID:12848
- C:\Windows\System\aECCPTg.exe
  C:\Windows\System\aECCPTg.exe
  2⤵
  PID:12920
- C:\Windows\System\JpEijCZ.exe
  C:\Windows\System\JpEijCZ.exe
  2⤵
  PID:12984
- C:\Windows\System\mqbqfxG.exe
  C:\Windows\System\mqbqfxG.exe
  2⤵
  PID:13040
- C:\Windows\System\oanzIxK.exe
  C:\Windows\System\oanzIxK.exe
  2⤵
  PID:13112
- C:\Windows\System\plzyujV.exe
  C:\Windows\System\plzyujV.exe
  2⤵
  PID:13180
- C:\Windows\System\dInikae.exe
  C:\Windows\System\dInikae.exe
  2⤵
  PID:13232
- C:\Windows\System\LbhIyPW.exe
  C:\Windows\System\LbhIyPW.exe
  2⤵
  PID:4020
- C:\Windows\System\vPpAQLc.exe
  C:\Windows\System\vPpAQLc.exe
  2⤵
  PID:12444
- C:\Windows\System\hPEokKn.exe
  C:\Windows\System\hPEokKn.exe
  2⤵
  PID:12640
- C:\Windows\System\HXZnTOz.exe
  C:\Windows\System\HXZnTOz.exe
  2⤵
  PID:12760
- C:\Windows\System\FNaYxZW.exe
  C:\Windows\System\FNaYxZW.exe
  2⤵
  PID:12900
- C:\Windows\System\LhwsYoo.exe
  C:\Windows\System\LhwsYoo.exe
  2⤵
  PID:13044
- C:\Windows\System\jBiUCEU.exe
  C:\Windows\System\jBiUCEU.exe
  2⤵
  PID:13200
- C:\Windows\System\XkEuSIu.exe
  C:\Windows\System\XkEuSIu.exe
  2⤵
  PID:12388
- C:\Windows\System\NSCJZUL.exe
  C:\Windows\System\NSCJZUL.exe
  2⤵
  PID:12704
- C:\Windows\System\nHyKNkp.exe
  C:\Windows\System\nHyKNkp.exe
  2⤵
  PID:13032
- C:\Windows\System\IELKuWC.exe
  C:\Windows\System\IELKuWC.exe
  2⤵
  PID:12556
- C:\Windows\System\fIHsVMg.exe
  C:\Windows\System\fIHsVMg.exe
  2⤵
  PID:13300
- C:\Windows\System\JTTygQt.exe
  C:\Windows\System\JTTygQt.exe
  2⤵
  PID:13320
- C:\Windows\System\NRjqmsM.exe
  C:\Windows\System\NRjqmsM.exe
  2⤵
  PID:13348
- C:\Windows\System\VbRdGcD.exe
  C:\Windows\System\VbRdGcD.exe
  2⤵
  PID:13376
- C:\Windows\System\RwRDbeN.exe
  C:\Windows\System\RwRDbeN.exe
  2⤵
  PID:13404
- C:\Windows\System\BcuaWqH.exe
  C:\Windows\System\BcuaWqH.exe
  2⤵
  PID:13432
- C:\Windows\System\HAVMjVS.exe
  C:\Windows\System\HAVMjVS.exe
  2⤵
  PID:13460
- C:\Windows\System\KFAIPde.exe
  C:\Windows\System\KFAIPde.exe
  2⤵
  PID:13492
- C:\Windows\System\KHPMAXp.exe
  C:\Windows\System\KHPMAXp.exe
  2⤵
  PID:13520
- C:\Windows\System\cUztFxG.exe
  C:\Windows\System\cUztFxG.exe
  2⤵
  PID:13548
- C:\Windows\System\vcTELLm.exe
  C:\Windows\System\vcTELLm.exe
  2⤵
  PID:13576
- C:\Windows\System\aiZzGuE.exe
  C:\Windows\System\aiZzGuE.exe
  2⤵
  PID:13604
- C:\Windows\System\ssSNLNF.exe
  C:\Windows\System\ssSNLNF.exe
  2⤵
  PID:13632
- C:\Windows\System\lJgadGM.exe
  C:\Windows\System\lJgadGM.exe
  2⤵
  PID:13660
- C:\Windows\System\XlgBxfL.exe
  C:\Windows\System\XlgBxfL.exe
  2⤵
  PID:13688
- C:\Windows\System\ncLQVGv.exe
  C:\Windows\System\ncLQVGv.exe
  2⤵
  PID:13716
- C:\Windows\System\quHRoVi.exe
  C:\Windows\System\quHRoVi.exe
  2⤵
  PID:13744
- C:\Windows\System\ukgcGbo.exe
  C:\Windows\System\ukgcGbo.exe
  2⤵
  PID:13772
- C:\Windows\System\zSzmUfS.exe
  C:\Windows\System\zSzmUfS.exe
  2⤵
  PID:13800
- C:\Windows\System\DswvREp.exe
  C:\Windows\System\DswvREp.exe
  2⤵
  PID:13828
- C:\Windows\System\KFWzbAU.exe
  C:\Windows\System\KFWzbAU.exe
  2⤵
  PID:13848
- C:\Windows\System\PYpAMZQ.exe
  C:\Windows\System\PYpAMZQ.exe
  2⤵
  PID:13872
- C:\Windows\System\OOiPoKU.exe
  C:\Windows\System\OOiPoKU.exe
  2⤵
  PID:13892
- C:\Windows\System\DGgzJsK.exe
  C:\Windows\System\DGgzJsK.exe
  2⤵
  PID:13928
- C:\Windows\System\atgQvOR.exe
  C:\Windows\System\atgQvOR.exe
  2⤵
  PID:13968
- C:\Windows\System\GPnqPaO.exe
  C:\Windows\System\GPnqPaO.exe
  2⤵
  PID:14004
- C:\Windows\System\rCnemqO.exe
  C:\Windows\System\rCnemqO.exe
  2⤵
  PID:14024
- C:\Windows\System\DRGZKTR.exe
  C:\Windows\System\DRGZKTR.exe
  2⤵
  PID:14052
- C:\Windows\System\IRAFuqM.exe
  C:\Windows\System\IRAFuqM.exe
  2⤵
  PID:14080
- C:\Windows\System\XriHAyF.exe
  C:\Windows\System\XriHAyF.exe
  2⤵
  PID:14108
- C:\Windows\System\JWWdnDL.exe
  C:\Windows\System\JWWdnDL.exe
  2⤵
  PID:14136
- C:\Windows\System\LAmSWMg.exe
  C:\Windows\System\LAmSWMg.exe
  2⤵
  PID:14164
- C:\Windows\System\DdRTcmP.exe
  C:\Windows\System\DdRTcmP.exe
  2⤵
  PID:14192
- C:\Windows\System\BmjHyUD.exe
  C:\Windows\System\BmjHyUD.exe
  2⤵
  PID:14232
- C:\Windows\System\SygVnlq.exe
  C:\Windows\System\SygVnlq.exe
  2⤵
  PID:14252
- C:\Windows\System\wjMXBkb.exe
  C:\Windows\System\wjMXBkb.exe
  2⤵
  PID:14280
- C:\Windows\System\MixzkQd.exe
  C:\Windows\System\MixzkQd.exe
  2⤵
  PID:13012
- C:\Windows\System\HVtOYxp.exe
  C:\Windows\System\HVtOYxp.exe
  2⤵
  PID:13344
- C:\Windows\System\BVsYGDE.exe
  C:\Windows\System\BVsYGDE.exe
  2⤵
  PID:13416
- C:\Windows\System\onfdrwn.exe
  C:\Windows\System\onfdrwn.exe
  2⤵
  PID:13484
- C:\Windows\System\pKWwCMF.exe
  C:\Windows\System\pKWwCMF.exe
  2⤵
  PID:13544
- C:\Windows\System\uZIFqzL.exe
  C:\Windows\System\uZIFqzL.exe
  2⤵
  PID:13616
- C:\Windows\System\NIHSHSG.exe
  C:\Windows\System\NIHSHSG.exe
  2⤵
  PID:13708
- C:\Windows\System\DcDTTmI.exe
  C:\Windows\System\DcDTTmI.exe
  2⤵
  PID:13756
- C:\Windows\System\WuqYYvD.exe
  C:\Windows\System\WuqYYvD.exe
  2⤵
  PID:2720
- C:\Windows\System\MZkNTGp.exe
  C:\Windows\System\MZkNTGp.exe
  2⤵
  PID:13796
- C:\Windows\System\vBPpUht.exe
  C:\Windows\System\vBPpUht.exe
  2⤵
  PID:13868
- C:\Windows\System\smkRuwY.exe
  C:\Windows\System\smkRuwY.exe
  2⤵
  PID:13924
- C:\Windows\System\tlaBKeD.exe
  C:\Windows\System\tlaBKeD.exe
  2⤵
  PID:13948
- C:\Windows\System\bEwhFzg.exe
  C:\Windows\System\bEwhFzg.exe
  2⤵
  PID:14016
- C:\Windows\System\BnpDOGS.exe
  C:\Windows\System\BnpDOGS.exe
  2⤵
  PID:14040
- C:\Windows\System\irktsRj.exe
  C:\Windows\System\irktsRj.exe
  2⤵
  PID:14132
- C:\Windows\System\UpRzyiR.exe
  C:\Windows\System\UpRzyiR.exe
  2⤵
  PID:14176
- C:\Windows\System\kQEtArv.exe
  C:\Windows\System\kQEtArv.exe
  2⤵
  PID:14240
- C:\Windows\System\wjAvoSO.exe
  C:\Windows\System\wjAvoSO.exe
  2⤵
  PID:14276
- C:\Windows\System\pmdFUrj.exe
  C:\Windows\System\pmdFUrj.exe
  2⤵
  PID:13396
- C:\Windows\System\VAYRQNs.exe
  C:\Windows\System\VAYRQNs.exe
  2⤵
  PID:13572
- C:\Windows\System\dwwBJqN.exe
  C:\Windows\System\dwwBJqN.exe
  2⤵
  PID:13740
- C:\Windows\System\asosmFL.exe
  C:\Windows\System\asosmFL.exe
  2⤵
  PID:13768
- C:\Windows\System\DlJuaWq.exe
  C:\Windows\System\DlJuaWq.exe
  2⤵
  PID:13916
- C:\Windows\System\vKAFMHc.exe
  C:\Windows\System\vKAFMHc.exe
  2⤵
  PID:14036
- C:\Windows\System\DLRrXAd.exe
  C:\Windows\System\DLRrXAd.exe
  2⤵
  PID:14156
- C:\Windows\System\AsOlNLb.exe
  C:\Windows\System\AsOlNLb.exe
  2⤵
  PID:13516
- C:\Windows\System\hrrrbZW.exe
  C:\Windows\System\hrrrbZW.exe
  2⤵
  PID:13824
- C:\Windows\System\ihKXOGC.exe
  C:\Windows\System\ihKXOGC.exe
  2⤵
  PID:4356
- C:\Windows\System\cgYlZFh.exe
  C:\Windows\System\cgYlZFh.exe
  2⤵
  PID:13656
- C:\Windows\System\epekZpL.exe
  C:\Windows\System\epekZpL.exe
  2⤵
  PID:14100
- C:\Windows\System\HMZYOKC.exe
  C:\Windows\System\HMZYOKC.exe
  2⤵
  PID:14348
- C:\Windows\System\bZTFbvv.exe
  C:\Windows\System\bZTFbvv.exe
  2⤵
  PID:14376
- C:\Windows\System\bOhAAOO.exe
  C:\Windows\System\bOhAAOO.exe
  2⤵
  PID:14396

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:9364

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:10840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AXzxIIz.exe

Filesize
2.1MB

MD5
c3c099faa3334991d6d817120c93df41

SHA1
077740707831416f706a11f189bfc88fa35b0f75

SHA256
c295a87d93987cd731c25bfac499b4af7cf151464c0959fd3c69b9835db2e7e2

SHA512
be12ecc2b2c5119214615131614ff8caaca70df5b2f10a6687644bd387e1fb0999964a951eb959b20e40a4bae08e5ba617e2e81734250ecd5f124aafe7ac0149

Download Submit
C:\Windows\System\AhwPZzo.exe

Filesize
2.1MB

MD5
810ba96cdd85a53f96f1728a9aba59e3

SHA1
03e4cb471d002565ba6471ab3095cac94de7684c

SHA256
a0df2f0b561934d2f8b47feb5cbc9278a70b490af41e9d9c09ff959a9fef7d47

SHA512
221d38b9ba3b1c181193cd825aac20badaa6ec0074bb51fcf086c5b8e4d1788df6cee33bd0bc698bfc05e7fcffb1e16262897830bdfccdf0fc0e7943375d1882

Download Submit
C:\Windows\System\BaCkCqq.exe

Filesize
2.1MB

MD5
0e2ccdd99161ede7d097c68e0eed5401

SHA1
9d58fc0c9a76131841a144cce938a45456f542df

SHA256
1e53e02d3f0934c367810d78fa3d386ae02ce72ce02d998aa80cb549dd1a3222

SHA512
0a40b7c4cbfaf81d268b16a6fc913fb4c1119a4bf44ba7ea14e89ad4b237f5f50c6b3a3da3d10d8bb8236d4e3885a9c051baefdfcfa88fe82f838232c4bdf736

Download Submit
C:\Windows\System\ErYFUID.exe

Filesize
2.1MB

MD5
c595386ddc99b251ca8dd30b4aa4dfc2

SHA1
1fd8f2f6b238ce4032ab5786b79d1484e0f34dbb

SHA256
b59c5340f04056ee151b903011bf8637e3158a49413b0e09fc7ce06f19db9bfc

SHA512
d44916c3d54ffed38da422ec9d9cdf1c0a48aef072f902807d9b78eb67dcb5aa2af6492708ca258d02df5b659084575ceb0a2faf46c4293c2c0b47b1f1b89168

Download Submit
C:\Windows\System\HNOKXgk.exe

Filesize
2.1MB

MD5
3ce63bb0fc682ff7d513626c9ed35bc1

SHA1
88c117c65642465a68a15206a62db3e85f4019f1

SHA256
970e61c82f3913375a41b98a633b8d1f3c9365c29beef86280fb6895b6d1f800

SHA512
495b1de6fb690d025349689f7c778d70131431c993e29a1c504a6da092479248df7a79dbecf21bd1a01b5eefefb305c49b186f453f6e97ec90d70cbce7f9076a

Download Submit
C:\Windows\System\HQytMso.exe

Filesize
2.1MB

MD5
cdf94520b855e63451e9eea25673f31e

SHA1
81d6ab9a4692f002fd114b3a9a1d265996f6682f

SHA256
27ed7e26f68648e661fb982428ef8e0ce1aa3067c0d8183cfd3ede7b2d5e8168

SHA512
7fcf202c0ca13ac744344843bbebca5836c31c3014a86116c971f9fa78d04f992e3188565110016226a9147449543cb53b003dc85faba7e22623697a369d0e4b

Download Submit
C:\Windows\System\Iaimalf.exe

Filesize
2.1MB

MD5
84031ecd8cc69eeb87150259dbee547f

SHA1
e5b5b86dbc5da6b8525acb873c2fc155740d8adc

SHA256
1db0a8d9aec51fe2481cb493c2505da3c7f363e2d3ab78b2805de3b93283e01f

SHA512
0f680012e4c1627dab07a9eb4456f97c9b39a58b405dc7adfc1f2e6cf452903c05bd29c80da9b9567d36f6a592e3cc18ce99172336c8bfb765c9e0631b15f821

Download Submit
C:\Windows\System\LEhwcBS.exe

Filesize
2.1MB

MD5
519db7b9b8b40eb9beafd3422ad57377

SHA1
1653a8a658b1c97ddf9ceae0c34f5c483e68a1cd

SHA256
fbb4ec161cd61a54cf858f0cef1a463c201526c45ad175aba9cae8f5aa183162

SHA512
d56ad2041c81ae83ebe06c024319f740c7e959fa8e26fd1490a1e7567d6971e5d7404f6cb4f38a92969109d5db514aeb79c1880afd4523625a198a272f14ed62

Download Submit
C:\Windows\System\LPuUFnI.exe

Filesize
2.1MB

MD5
645b5cb6e20e6c42b73000538956b1dc

SHA1
f32cbe2a1c9b86fc32b018b5531fab421251ca94

SHA256
f7d5b73df3b0fd7cf6e332a9b9b97d75bb893279845d22550c61bdc21d5a2b0d

SHA512
af732c2e20ae3c618d8dc546feafee6f972608d8b2e7a3cf6c8359c51d6d8a01308f3e857d9aab0e26e1463d38b3c05c9fb5f05739a4c11767d458fb9664e26f

Download Submit
C:\Windows\System\MVTWjSs.exe

Filesize
2.1MB

MD5
06e56e231d641c73db892e8c0fa16ade

SHA1
4784b8f54d59d0aaea2485abce9f255c5aa90a74

SHA256
81f4e3178e8fa93a63d0bb17a16f809287cb380b1d2f0d3a2263a9fa707bbd2b

SHA512
a1fb11f1b847aef177e5499c7cf9a40a0962273b1954f4b2f6c4d4466b1a4f93b872c6353211dd43add59f0c67f9fac842092d06efe368dc3e835c6d9ac8663a

Download Submit
C:\Windows\System\NGECiZX.exe

Filesize
2.1MB

MD5
6e38e0333911d3ac27e1e8269f3837d8

SHA1
a8f864dc17355ba2714835625641eb23780beb07

SHA256
cc0664c4958e73a7e79e71678aec1b40dbfc1d63bc6b29f4b135f2d0ca8772b0

SHA512
fc31bea37dc84c63a58e4fd396cafef8f2c8d7d30f23494f93915256c4075b1956dbff0e40efa111b32640fc85b1ffddc9b0f7683c653fe9bbb91f919300daa7

Download Submit
C:\Windows\System\NfKsfCp.exe

Filesize
2.1MB

MD5
868f9e034a7ac4229e283f8c1adfa56a

SHA1
9f6a4889d6af6bd71271325992d6e0e90b7c0668

SHA256
d72041d01b298645b5ceba7d4aed2f8df98fc6b02495fe89f02b2601bb31043e

SHA512
03afe21af2d49b973804fbcfe8a9241bf57763d29d0913783543024535d7fabdda5e17c9334229ca6960180df30be5831027f849cc744c54b57b4fc4559f8525

Download Submit
C:\Windows\System\OLejUAE.exe

Filesize
2.1MB

MD5
adb4b0471475b36d3ca7dc5aab31ce76

SHA1
8d0b6d45fa2d06205056e207f1656cad9454fb39

SHA256
97aa0e2849f3d289f39d395a33cbce9c7b333ee53c01cac3e98f6d64550d44d2

SHA512
62dd10b0df106ef23e3676487393322125ebe63b72999f7babcd0ef1888d1d0dc94f8bae2a4de62c046cb863e265a19ffeba6139bfd9176c88c8717bb33fbfd3

Download Submit
C:\Windows\System\PUdNYGe.exe

Filesize
2.1MB

MD5
7cc17f12f1b2ec8b7de757e7f4f903b7

SHA1
58133e003bd37fc0f5b596ab085c3b64dd2995bc

SHA256
5947106ea12814b9aacdea81c3e6a24b24eb4ba117230a624049964ea6a85985

SHA512
bf12c476ae1531ad8f7216e13be8d47a2a862d2f3325b9b54e8a0b26df79f083b4ab9a55f34081a80262a71ff2d10b7a5f9657ab0dce066e631ce3be59a2a62d

Download Submit
C:\Windows\System\QGniqLw.exe

Filesize
2.1MB

MD5
b3e212ff66aa20eb0c634112d39493cc

SHA1
a5a11ee160d927b1c190ec46f1d7486b0ece705e

SHA256
ed43a5450d19f2aa67065dbd8d98dc452e37fead0cf460cd3f13ac6534f2c52b

SHA512
6fb9c679b66fdb308d2af664f0617272e224b7ea67718c0d5e7204ceeb83a32ac7cc8f0d5c972ddbc9418a97d781596e5d60441a44e28088c5ac1e2218ee8789

Download Submit
C:\Windows\System\TBimirH.exe

Filesize
2.1MB

MD5
7087c72472ea538f8fd2786944e51fd2

SHA1
16f953e7bdbd57f10de83eaf38c4fc13891b3b44

SHA256
116d77cf893c775258b823c210cbf213f5500a9af128210ba8c099ff7cea9e8c

SHA512
2b2a3abee19651b30f2988b923059f1bee1de17c418fce5fbe8a6c2b8ca51e828ff901d066ab7772dffdb0070d7bfb0ac3e919705751642e5116fd36b5baac03

Download Submit
C:\Windows\System\UZDOSUn.exe

Filesize
2.1MB

MD5
6a707c7e79b45e2eb7ca30f01d51d950

SHA1
05495756f3e99df9791fcf2be1db308d7312d84d

SHA256
10ea0d95737aa56c070ae6bb7428e8aa8953f0916a026d186452c5295684eab7

SHA512
f40ea6ddaf3ccdd19c0a10c986c9623df1aea4bd0e054156f5ab5bce508fba565d83ca70b895c998802cc6c92829058c2b071d3592a0203e4982f4e4f209284c

Download Submit
C:\Windows\System\VPGqqsU.exe

Filesize
2.1MB

MD5
43287d8413ef41a6f074affa29ee290e

SHA1
5478ba359d9be462f9782f7c81e147e421eda826

SHA256
8f6204323615b37db61aa6e8d4b9429c1b543d7263d0451b770cce527bb9eb53

SHA512
99240849fedfe90e41ca3f91b8b97f1522b8fef71ac2129fd540227c0afec5e1436e3690a872528e13239034c8c35679900d63f906c235d8b0ee2003fd51acad

Download Submit
C:\Windows\System\VXntADh.exe

Filesize
2.1MB

MD5
a9576f3c50bddc1e47f8bcffe8a049b7

SHA1
98adc222d9e164942913e541052a2c9add058362

SHA256
cc93c3e30552c99024aa1b639fb0414925dc2a21e9c5f37aa23a28f76eec1caa

SHA512
a7a138f33b51a2e093ca4471c884c282fcb8e9e9ac63db425c7e90b45595d6b59933ebff2d81c318a361f18918ac2dd7bd8e9e112052bcd4f3ddd6e552510c73

Download Submit
C:\Windows\System\VgDoCRr.exe

Filesize
2.1MB

MD5
5353591f43c13f1ff9d53c91fce8b6f0

SHA1
dfe78767c9c9dfc09a4a3ffdff7e12b642f5f738

SHA256
96c5bb2b77228ee3d14bccafb4ba75f516023ac5fd9d96ed5f3f3fd3584e9f75

SHA512
978c5a776e36f3a2cd3017399c1be9cd6c68aef5c94e2e5cd973e7ecbc8988be746f44fdc03c6bdeb3cc80f42fb3db4cb2848da2bfcb84be5e87afb31ed812e7

Download Submit
C:\Windows\System\XczBRSJ.exe

Filesize
2.1MB

MD5
5f6eb79722c97b170deae339d58095ee

SHA1
b4fbc13a6560dab14decb288827cb528ac87ee2a

SHA256
331500d8f8a4f94992d9a34fa16b98671117534ce0e277b545c2cfe07fab0ed6

SHA512
8092436b18eedf36e9cc3450c03579ff02bc5521cc47fb664e71f666e099a64203324518b1fc5ebe3e5868b7a62d8bb3fa0aeb6596b8d342318ac3d44063e870

Download Submit
C:\Windows\System\YtLQiba.exe

Filesize
2.1MB

MD5
c1d3c363c703526714ba093527742012

SHA1
0a1ed7979fc6f897c48ceea481afc9a828b3c3b2

SHA256
50c664d33f71be377698ce52b52b8ba828e3c73f2b9e1363ac7dfed81a27fdb4

SHA512
0e48632cabb0d605d666f5e0160160d9f383221a5612ef981218952e25c7f0cd31fe3141f8532d9caf623fa10609f8b5b46606b4c6874c52bc4bfa7ff7dd28d0

Download Submit
C:\Windows\System\blrJabN.exe

Filesize
2.1MB

MD5
44c210634af7b168480ee82f01cbf32c

SHA1
d50007a2c00ffbd2ab6dad161482ebbfbb9d433b

SHA256
e674b6074d41b9a12cbf14c7adad6383781c9973169330ed488e2677aa13300e

SHA512
9701af68add23a6ebf9248b54cfc54a337e83b092e16f593e59f09922c12578129a738e4292eee5ae0518e8e23312d86ae6a5f7e8c995102d17a981d7cfc657a

Download Submit
C:\Windows\System\gZFfjtW.exe

Filesize
2.1MB

MD5
5bc84d0f90cd70ba45231d5742f707db

SHA1
6d1d02a3fee715acccf54c6b22d4293b5c68c39e

SHA256
e36bbde738afb5c1338a4eb4a10f01f9f1ae391d6ea3e8d8fc44378a9c92e32c

SHA512
2e2f874287ee9b8cbbe815cc6906000ab6173b838cf7a118dea4d7bb7907e16cbaf8db1c0b9ff2df2546cf5d6060a3cc321ee95074d94e263a0cf1788d63ca9b

Download Submit
C:\Windows\System\iAOwfGq.exe

Filesize
2.1MB

MD5
2687f561fdcf2a13d81b697725d83429

SHA1
2b86689f5502856840032cfd3b545e6af4f7494b

SHA256
f5ff860e21196fbb14a69571a5e502b83cc216f6b6bd444c0b0d366f2064a006

SHA512
480e93a4faf8da83a2ba42ff5c1cd6a5839e42074dc4e634df507aeb9bc5c82ebc91bc56a2c2cee06507790a025e2075150ec85b8a4f2b6b020da9d0c5b92e99

Download Submit
C:\Windows\System\lFTArmr.exe

Filesize
2.1MB

MD5
f470ad6a68e4d717688dca590f2abb41

SHA1
ca9b74e20a0534d2c89d9b233aff831354998220

SHA256
f11f4bb347847d49206c23e153068a90269a31012fdcf6e49df105d44e62ed70

SHA512
42dbe0da2a7e888bebeeec34b9d0c41a362dd25b7ee22bae04ea55934b0c83ef5824fb3f224c44b27018dc34880862eaca70a8d3f2e242859a4d1c2eb0464496

Download Submit
C:\Windows\System\oOWswwc.exe

Filesize
2.1MB

MD5
8256417e91918eb43e837bae8e1ef344

SHA1
21f325c0233591bf3b775093c8da0ced0b831cac

SHA256
608be8db8d5ca86f74aae0a638d4e66070cb5e7486547097e56cb761e962e124

SHA512
172b4a2b999af15aca175bfdf868ad450e182ab5c3964c5e18f8dc5bea91c1916c09e0cd506f52b44788819e78220afd6fe36502b4ec1bf7e711905d3a25a466

Download Submit
C:\Windows\System\qcrJEAf.exe

Filesize
2.1MB

MD5
842ba16eef225aac0bc11118503455cd

SHA1
56a29042f0db8207529de497d158be7b98b01992

SHA256
91ae4998f2b23d38c51892990039d68118781d5b675fce62fd189b1d74627657

SHA512
9ce5611bcea22af33b1f3b5dbde39547711e174c7c89cf1d5cec22243a17a92c5cd0540c674955f049adfd9f7049b2223e41888e9a06238de1da04bca73c0b1d

Download Submit
C:\Windows\System\qpbAecH.exe

Filesize
2.1MB

MD5
9b4ddb06ca1aabda91eeb2e121e67cac

SHA1
ea20573663661b014e67835daa29da7a1090af93

SHA256
309a690a2ef4fff4ccb69a4f79ccd1e708544a0dcb79286ca5d2731273d820c0

SHA512
9109636c30a11d4db5b7f7baaac4c789cac463d0dd140508b9519588a7a9bd40b12314e44ffe821d2590f27d53427abb371224e5dc7bac954979f595785c9343

Download Submit
C:\Windows\System\sAMMcQS.exe

Filesize
2.1MB

MD5
c9a5e6581374a4a19bdbb2095d427c49

SHA1
99dc8096aa365ba57b5760cf0290ee0bf6030c22

SHA256
b740d4584af805aca3388314c4ac3e1d94b607162c65ea3807bde543f773b0b1

SHA512
858b067634fed5aaa1ce87afe704914e8571abd2a5e9c13afbdd735bc65482a23bbacb664b977475cf4bc736cae8809017b242f6d994fdce48cff080a6a87681

Download Submit
C:\Windows\System\udXVhoU.exe

Filesize
2.1MB

MD5
8a09492b0b33ed27844aa97ddc2cbaba

SHA1
8e9595bc48cf53d177e065354c7b63633f5ba695

SHA256
66dff24c9c12a41de2f15ed1ccb50c26da2d61eef757dbe2750a6c2f7eb7e3a9

SHA512
351482da3ee12505bce82b0356ddb3e41c2dcd2ca42b4f058b6e419a2ed1aa12fb9f0eeb825f6633ccebfa052fda0e50461fc2471874b4c90753a41e63835aa2

Download Submit
C:\Windows\System\wobEztw.exe

Filesize
2.1MB

MD5
78499c18bd090a14f69e13b5fd84f532

SHA1
e912a1482c6c59486ede32ca50593175fbe06ca0

SHA256
d4ef4137ae84fc2d13c9d4657ee4dd4eb8bd9f1770b95f8aa994fd5d73b0b2f7

SHA512
abdfff374c04bd4822f3cd22641f3836f9f4204d5c21630a35c6c7032ca3c7747a7ae4b76593247330fd69e39d3368f82dac34273d02bf2a21fa72e575f04691

Download Submit
C:\Windows\System\xKAmkap.exe

Filesize
2.1MB

MD5
b7f8bd2a0115a7cf56dd1deb8b9b52c1

SHA1
a88208f53b1f2694972b218f8a1bb88b843187c5

SHA256
5469babc818c53c0e2e94cbb478c052a2be77096699abe72f9fa028b12e31173

SHA512
bcfe9fb96856aa8c62541f3974b55ebbbb2ed162c48af2283f80ab464fef09cf425601fc615f339ade285c69570e804482af5db2b445c896a71381d651106144

Download Submit
C:\Windows\System\zsoguWM.exe

Filesize
2.1MB

MD5
295a855bddd1edbfa56903b6b7acfa96

SHA1
16a3c913ffe98119c65a70d30c2ec2f162f0b160

SHA256
6795738ea3f23571d2bb8e2ffe39c0f964922221c2173b2001194319ac1e064b

SHA512
eb5ee49df2ac08cbfca9e712311a4c029047a0084a906b2f44275d1057981012df6640bfad2d110bd8ec526657cc2396c8040b67ef4668f8da08ef72931d91db

Download Submit
memory/768-2101-0x00007FF6D6860000-0x00007FF6D6BB4000-memory.dmp

Filesize
3.3MB

Download
memory/768-187-0x00007FF6D6860000-0x00007FF6D6BB4000-memory.dmp

Filesize
3.3MB

Download
memory/884-196-0x00007FF66A470000-0x00007FF66A7C4000-memory.dmp

Filesize
3.3MB

Download
memory/884-2105-0x00007FF66A470000-0x00007FF66A7C4000-memory.dmp

Filesize
3.3MB

Download
memory/924-2098-0x00007FF6C7570000-0x00007FF6C78C4000-memory.dmp

Filesize
3.3MB

Download
memory/924-205-0x00007FF6C7570000-0x00007FF6C78C4000-memory.dmp

Filesize
3.3MB

Download
memory/1200-2110-0x00007FF679ED0000-0x00007FF67A224000-memory.dmp

Filesize
3.3MB

Download
memory/1200-201-0x00007FF679ED0000-0x00007FF67A224000-memory.dmp

Filesize
3.3MB

Download
memory/1540-2084-0x00007FF6D45B0000-0x00007FF6D4904000-memory.dmp

Filesize
3.3MB

Download
memory/1540-52-0x00007FF6D45B0000-0x00007FF6D4904000-memory.dmp

Filesize
3.3MB

Download
memory/1580-128-0x00007FF6DB250000-0x00007FF6DB5A4000-memory.dmp

Filesize
3.3MB

Download
memory/1580-2081-0x00007FF6DB250000-0x00007FF6DB5A4000-memory.dmp

Filesize
3.3MB

Download
memory/1580-2096-0x00007FF6DB250000-0x00007FF6DB5A4000-memory.dmp

Filesize
3.3MB

Download
memory/1696-2094-0x00007FF710CA0000-0x00007FF710FF4000-memory.dmp

Filesize
3.3MB

Download
memory/1696-206-0x00007FF710CA0000-0x00007FF710FF4000-memory.dmp

Filesize
3.3MB

Download
memory/1700-191-0x00007FF7E92A0000-0x00007FF7E95F4000-memory.dmp

Filesize
3.3MB

Download
memory/1700-2109-0x00007FF7E92A0000-0x00007FF7E95F4000-memory.dmp

Filesize
3.3MB

Download
memory/1868-2108-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp

Filesize
3.3MB

Download
memory/1868-192-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp

Filesize
3.3MB

Download
memory/1896-2095-0x00007FF742C90000-0x00007FF742FE4000-memory.dmp

Filesize
3.3MB

Download
memory/1896-130-0x00007FF742C90000-0x00007FF742FE4000-memory.dmp

Filesize
3.3MB

Download
memory/2036-2086-0x00007FF6E8760000-0x00007FF6E8AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2036-202-0x00007FF6E8760000-0x00007FF6E8AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2084-2087-0x00007FF6E57B0000-0x00007FF6E5B04000-memory.dmp

Filesize
3.3MB

Download
memory/2084-104-0x00007FF6E57B0000-0x00007FF6E5B04000-memory.dmp

Filesize
3.3MB

Download
memory/2412-2077-0x00007FF74C6C0000-0x00007FF74CA14000-memory.dmp

Filesize
3.3MB

Download
memory/2412-10-0x00007FF74C6C0000-0x00007FF74CA14000-memory.dmp

Filesize
3.3MB

Download
memory/2412-2082-0x00007FF74C6C0000-0x00007FF74CA14000-memory.dmp

Filesize
3.3MB

Download
memory/2548-198-0x00007FF6274A0000-0x00007FF6277F4000-memory.dmp

Filesize
3.3MB

Download
memory/2548-2099-0x00007FF6274A0000-0x00007FF6277F4000-memory.dmp

Filesize
3.3MB

Download
memory/2772-2093-0x00007FF6CAFF0000-0x00007FF6CB344000-memory.dmp

Filesize
3.3MB

Download
memory/2772-197-0x00007FF6CAFF0000-0x00007FF6CB344000-memory.dmp

Filesize
3.3MB

Download
memory/2788-203-0x00007FF78AB20000-0x00007FF78AE74000-memory.dmp

Filesize
3.3MB

Download
memory/2788-2085-0x00007FF78AB20000-0x00007FF78AE74000-memory.dmp

Filesize
3.3MB

Download
memory/2908-145-0x00007FF718A40000-0x00007FF718D94000-memory.dmp

Filesize
3.3MB

Download
memory/2908-2089-0x00007FF718A40000-0x00007FF718D94000-memory.dmp

Filesize
3.3MB

Download
memory/2992-182-0x00007FF6CCAA0000-0x00007FF6CCDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2992-2104-0x00007FF6CCAA0000-0x00007FF6CCDF4000-memory.dmp

Filesize
3.3MB

Download
memory/3184-2092-0x00007FF634510000-0x00007FF634864000-memory.dmp

Filesize
3.3MB

Download
memory/3184-183-0x00007FF634510000-0x00007FF634864000-memory.dmp

Filesize
3.3MB

Download
memory/3436-2100-0x00007FF653970000-0x00007FF653CC4000-memory.dmp

Filesize
3.3MB

Download
memory/3436-207-0x00007FF653970000-0x00007FF653CC4000-memory.dmp

Filesize
3.3MB

Download
memory/3512-2102-0x00007FF6FCDD0000-0x00007FF6FD124000-memory.dmp

Filesize
3.3MB

Download
memory/3512-166-0x00007FF6FCDD0000-0x00007FF6FD124000-memory.dmp

Filesize
3.3MB

Download
memory/3556-2091-0x00007FF7AD940000-0x00007FF7ADC94000-memory.dmp

Filesize
3.3MB

Download
memory/3556-76-0x00007FF7AD940000-0x00007FF7ADC94000-memory.dmp

Filesize
3.3MB

Download
memory/3556-2080-0x00007FF7AD940000-0x00007FF7ADC94000-memory.dmp

Filesize
3.3MB

Download
memory/3560-58-0x00007FF7BAFB0000-0x00007FF7BB304000-memory.dmp

Filesize
3.3MB

Download
memory/3560-2088-0x00007FF7BAFB0000-0x00007FF7BB304000-memory.dmp

Filesize
3.3MB

Download
memory/3560-2079-0x00007FF7BAFB0000-0x00007FF7BB304000-memory.dmp

Filesize
3.3MB

Download
memory/3616-2090-0x00007FF74BEB0000-0x00007FF74C204000-memory.dmp

Filesize
3.3MB

Download
memory/3616-144-0x00007FF74BEB0000-0x00007FF74C204000-memory.dmp

Filesize
3.3MB

Download
memory/3720-2107-0x00007FF7FE820000-0x00007FF7FEB74000-memory.dmp

Filesize
3.3MB

Download
memory/3720-200-0x00007FF7FE820000-0x00007FF7FEB74000-memory.dmp

Filesize
3.3MB

Download
memory/3760-208-0x00007FF719510000-0x00007FF719864000-memory.dmp

Filesize
3.3MB

Download
memory/3760-2106-0x00007FF719510000-0x00007FF719864000-memory.dmp

Filesize
3.3MB

Download
memory/3788-2078-0x00007FF60C560000-0x00007FF60C8B4000-memory.dmp

Filesize
3.3MB

Download
memory/3788-27-0x00007FF60C560000-0x00007FF60C8B4000-memory.dmp

Filesize
3.3MB

Download
memory/3788-2083-0x00007FF60C560000-0x00007FF60C8B4000-memory.dmp

Filesize
3.3MB

Download
memory/4236-199-0x00007FF7BFA90000-0x00007FF7BFDE4000-memory.dmp

Filesize
3.3MB

Download
memory/4236-2097-0x00007FF7BFA90000-0x00007FF7BFDE4000-memory.dmp

Filesize
3.3MB

Download
memory/4404-1-0x000001FE27580000-0x000001FE27590000-memory.dmp

Filesize
64KB

Download
memory/4404-0-0x00007FF67CD10000-0x00007FF67D064000-memory.dmp

Filesize
3.3MB

Download
memory/4404-2076-0x00007FF67CD10000-0x00007FF67D064000-memory.dmp

Filesize
3.3MB

Download
memory/5004-2103-0x00007FF658160000-0x00007FF6584B4000-memory.dmp

Filesize
3.3MB

Download
memory/5004-204-0x00007FF658160000-0x00007FF6584B4000-memory.dmp

Filesize
3.3MB

Download