xmrig | 9fbc69455c5815d1baa8aa5424f5edf60c74f616121795365128b05e20b3f8b8

Analysis

max time kernel
95s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33b400852055ca8451e623c1067a1350_NEIKI.exe
Size

2.1MB
MD5

33b400852055ca8451e623c1067a1350
SHA1

2045d4b16f624872b1941f8fc322558cab3b2244
SHA256

9fbc69455c5815d1baa8aa5424f5edf60c74f616121795365128b05e20b3f8b8
SHA512

3f2bafd93f615183e3483c6a5de4f33a46dacea75b083cb3fe5f0d0c6464e16499a91de443f9a73deb6ba145cf3761effe62079b485003f1c6552b051fef1bdc
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbbnlD5/xFGxOX:BemTLkNdfE0pZr6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5016-0-0x00007FF7B8160000-0x00007FF7B84B4000-memory.dmp	xmrig
behavioral2/files/0x000a000000021677-5.dat	xmrig
behavioral2/files/0x00080000000233f9-8.dat	xmrig
behavioral2/memory/4236-6-0x00007FF6002F0000-0x00007FF600644000-memory.dmp	xmrig
behavioral2/files/0x00080000000233fc-11.dat	xmrig
behavioral2/memory/2196-12-0x00007FF6012C0000-0x00007FF601614000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-28.dat	xmrig
behavioral2/files/0x00070000000233fd-30.dat	xmrig
behavioral2/memory/3912-41-0x00007FF6583A0000-0x00007FF6586F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023400-44.dat	xmrig
behavioral2/memory/1920-47-0x00007FF735060000-0x00007FF7353B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023402-61.dat	xmrig
behavioral2/files/0x0007000000023404-67.dat	xmrig
behavioral2/files/0x000700000002340d-116.dat	xmrig
behavioral2/files/0x000700000002340f-126.dat	xmrig
behavioral2/files/0x0007000000023414-151.dat	xmrig
behavioral2/files/0x0007000000023418-165.dat	xmrig
behavioral2/memory/1344-520-0x00007FF76EA70000-0x00007FF76EDC4000-memory.dmp	xmrig
behavioral2/memory/1916-524-0x00007FF784000000-0x00007FF784354000-memory.dmp	xmrig
behavioral2/memory/4192-529-0x00007FF7CEFD0000-0x00007FF7CF324000-memory.dmp	xmrig
behavioral2/memory/3212-535-0x00007FF7937A0000-0x00007FF793AF4000-memory.dmp	xmrig
behavioral2/memory/1992-539-0x00007FF704400000-0x00007FF704754000-memory.dmp	xmrig
behavioral2/memory/1904-532-0x00007FF7D3B70000-0x00007FF7D3EC4000-memory.dmp	xmrig
behavioral2/memory/3612-386-0x00007FF77DE10000-0x00007FF77E164000-memory.dmp	xmrig
behavioral2/memory/3252-548-0x00007FF6A7D20000-0x00007FF6A8074000-memory.dmp	xmrig
behavioral2/memory/3552-555-0x00007FF6AD6A0000-0x00007FF6AD9F4000-memory.dmp	xmrig
behavioral2/memory/4280-568-0x00007FF6F2270000-0x00007FF6F25C4000-memory.dmp	xmrig
behavioral2/memory/1680-577-0x00007FF677E40000-0x00007FF678194000-memory.dmp	xmrig
behavioral2/memory/2464-576-0x00007FF62DA60000-0x00007FF62DDB4000-memory.dmp	xmrig
behavioral2/memory/3364-580-0x00007FF6DF280000-0x00007FF6DF5D4000-memory.dmp	xmrig
behavioral2/memory/5104-584-0x00007FF6EFC40000-0x00007FF6EFF94000-memory.dmp	xmrig
behavioral2/memory/2668-573-0x00007FF74AA70000-0x00007FF74ADC4000-memory.dmp	xmrig
behavioral2/memory/1092-564-0x00007FF7A3F70000-0x00007FF7A42C4000-memory.dmp	xmrig
behavioral2/memory/3940-589-0x00007FF724310000-0x00007FF724664000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-170.dat	xmrig
behavioral2/files/0x0007000000023417-166.dat	xmrig
behavioral2/files/0x0007000000023416-161.dat	xmrig
behavioral2/files/0x0007000000023415-158.dat	xmrig
behavioral2/files/0x0007000000023413-146.dat	xmrig
behavioral2/files/0x0007000000023412-140.dat	xmrig
behavioral2/files/0x0007000000023411-136.dat	xmrig
behavioral2/files/0x0007000000023410-131.dat	xmrig
behavioral2/files/0x000700000002340e-120.dat	xmrig
behavioral2/files/0x000700000002340c-111.dat	xmrig
behavioral2/files/0x000700000002340b-106.dat	xmrig
behavioral2/files/0x000700000002340a-100.dat	xmrig
behavioral2/files/0x0007000000023409-96.dat	xmrig
behavioral2/files/0x0007000000023408-91.dat	xmrig
behavioral2/files/0x0007000000023407-85.dat	xmrig
behavioral2/files/0x0007000000023406-81.dat	xmrig
behavioral2/files/0x0007000000023405-75.dat	xmrig
behavioral2/files/0x0007000000023403-65.dat	xmrig
behavioral2/files/0x0007000000023401-53.dat	xmrig
behavioral2/files/0x00070000000233ff-45.dat	xmrig
behavioral2/memory/2112-40-0x00007FF633450000-0x00007FF6337A4000-memory.dmp	xmrig
behavioral2/memory/4488-32-0x00007FF7DBDF0000-0x00007FF7DC144000-memory.dmp	xmrig
behavioral2/files/0x00080000000233fa-34.dat	xmrig
behavioral2/memory/1924-25-0x00007FF7A6EC0000-0x00007FF7A7214000-memory.dmp	xmrig
behavioral2/memory/1416-600-0x00007FF6FCAA0000-0x00007FF6FCDF4000-memory.dmp	xmrig
behavioral2/memory/392-606-0x00007FF76AB40000-0x00007FF76AE94000-memory.dmp	xmrig
behavioral2/memory/912-612-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	xmrig
behavioral2/memory/2552-614-0x00007FF6D4130000-0x00007FF6D4484000-memory.dmp	xmrig
behavioral2/memory/3304-603-0x00007FF68F1F0000-0x00007FF68F544000-memory.dmp	xmrig
behavioral2/memory/5016-1680-0x00007FF7B8160000-0x00007FF7B84B4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4236	EnRQIGA.exe
2196	mWYRMfd.exe
1924	mudDCOh.exe
2112	sHMkrUa.exe
4488	CcrheEZ.exe
3912	TRrbrbH.exe
1920	ZByVUlH.exe
3612	swBePuN.exe
2552	ZdiAHQm.exe
1344	PjAhHod.exe
1916	kvQXRFm.exe
4192	pVNXAGu.exe
1904	jTULeiy.exe
3212	wpqATau.exe
1992	JKCkTPv.exe
3252	yNuOyFq.exe
3552	ooGnunp.exe
1092	wkfNQHe.exe
4280	VfNNrVE.exe
2668	kycrDpw.exe
2464	ivycesQ.exe
1680	nIfucvh.exe
3364	FyxslZZ.exe
5104	lBXYiXU.exe
3940	CMDqvuU.exe
1416	gGjHHtr.exe
3304	uDnjiSy.exe
392	rDNDmbj.exe
912	PAqmzWD.exe
4348	pUBBXkX.exe
1512	TnZnHNl.exe
1580	SyyqJcX.exe
1840	jGFqYlP.exe
3792	TejlXKc.exe
4776	fEeLHKg.exe
4004	RqBBBPf.exe
2520	TZdvLfU.exe
3300	EIhobAT.exe
4060	PhBDuKi.exe
2756	fgnWaPs.exe
3148	UvRpHME.exe
4956	QkNprWR.exe
1824	GwfExHp.exe
2428	OSaHOnE.exe
1692	LbODYgb.exe
4104	AysxGtP.exe
2988	VkJbTGv.exe
1004	uEasoFd.exe
4948	AdoZSvU.exe
3480	BUZTGFl.exe
4368	HHuSVxx.exe
220	OosPKWp.exe
3224	Sivvavz.exe
740	pGeRPxc.exe
3120	svHLDwY.exe
856	sCkQYrj.exe
3448	ApWPybM.exe
3668	rnGfZGa.exe
4624	KtvLMHo.exe
2704	smCNXxq.exe
1928	uVTFQSc.exe
4100	HhazeGt.exe
3740	fvpwPsn.exe
2504	BvxZpby.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5016-0-0x00007FF7B8160000-0x00007FF7B84B4000-memory.dmp	upx
behavioral2/files/0x000a000000021677-5.dat	upx
behavioral2/files/0x00080000000233f9-8.dat	upx
behavioral2/memory/4236-6-0x00007FF6002F0000-0x00007FF600644000-memory.dmp	upx
behavioral2/files/0x00080000000233fc-11.dat	upx
behavioral2/memory/2196-12-0x00007FF6012C0000-0x00007FF601614000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-28.dat	upx
behavioral2/files/0x00070000000233fd-30.dat	upx
behavioral2/memory/3912-41-0x00007FF6583A0000-0x00007FF6586F4000-memory.dmp	upx
behavioral2/files/0x0007000000023400-44.dat	upx
behavioral2/memory/1920-47-0x00007FF735060000-0x00007FF7353B4000-memory.dmp	upx
behavioral2/files/0x0007000000023402-61.dat	upx
behavioral2/files/0x0007000000023404-67.dat	upx
behavioral2/files/0x000700000002340d-116.dat	upx
behavioral2/files/0x000700000002340f-126.dat	upx
behavioral2/files/0x0007000000023414-151.dat	upx
behavioral2/files/0x0007000000023418-165.dat	upx
behavioral2/memory/1344-520-0x00007FF76EA70000-0x00007FF76EDC4000-memory.dmp	upx
behavioral2/memory/1916-524-0x00007FF784000000-0x00007FF784354000-memory.dmp	upx
behavioral2/memory/4192-529-0x00007FF7CEFD0000-0x00007FF7CF324000-memory.dmp	upx
behavioral2/memory/3212-535-0x00007FF7937A0000-0x00007FF793AF4000-memory.dmp	upx
behavioral2/memory/1992-539-0x00007FF704400000-0x00007FF704754000-memory.dmp	upx
behavioral2/memory/1904-532-0x00007FF7D3B70000-0x00007FF7D3EC4000-memory.dmp	upx
behavioral2/memory/3612-386-0x00007FF77DE10000-0x00007FF77E164000-memory.dmp	upx
behavioral2/memory/3252-548-0x00007FF6A7D20000-0x00007FF6A8074000-memory.dmp	upx
behavioral2/memory/3552-555-0x00007FF6AD6A0000-0x00007FF6AD9F4000-memory.dmp	upx
behavioral2/memory/4280-568-0x00007FF6F2270000-0x00007FF6F25C4000-memory.dmp	upx
behavioral2/memory/1680-577-0x00007FF677E40000-0x00007FF678194000-memory.dmp	upx
behavioral2/memory/2464-576-0x00007FF62DA60000-0x00007FF62DDB4000-memory.dmp	upx
behavioral2/memory/3364-580-0x00007FF6DF280000-0x00007FF6DF5D4000-memory.dmp	upx
behavioral2/memory/5104-584-0x00007FF6EFC40000-0x00007FF6EFF94000-memory.dmp	upx
behavioral2/memory/2668-573-0x00007FF74AA70000-0x00007FF74ADC4000-memory.dmp	upx
behavioral2/memory/1092-564-0x00007FF7A3F70000-0x00007FF7A42C4000-memory.dmp	upx
behavioral2/memory/3940-589-0x00007FF724310000-0x00007FF724664000-memory.dmp	upx
behavioral2/files/0x0007000000023419-170.dat	upx
behavioral2/files/0x0007000000023417-166.dat	upx
behavioral2/files/0x0007000000023416-161.dat	upx
behavioral2/files/0x0007000000023415-158.dat	upx
behavioral2/files/0x0007000000023413-146.dat	upx
behavioral2/files/0x0007000000023412-140.dat	upx
behavioral2/files/0x0007000000023411-136.dat	upx
behavioral2/files/0x0007000000023410-131.dat	upx
behavioral2/files/0x000700000002340e-120.dat	upx
behavioral2/files/0x000700000002340c-111.dat	upx
behavioral2/files/0x000700000002340b-106.dat	upx
behavioral2/files/0x000700000002340a-100.dat	upx
behavioral2/files/0x0007000000023409-96.dat	upx
behavioral2/files/0x0007000000023408-91.dat	upx
behavioral2/files/0x0007000000023407-85.dat	upx
behavioral2/files/0x0007000000023406-81.dat	upx
behavioral2/files/0x0007000000023405-75.dat	upx
behavioral2/files/0x0007000000023403-65.dat	upx
behavioral2/files/0x0007000000023401-53.dat	upx
behavioral2/files/0x00070000000233ff-45.dat	upx
behavioral2/memory/2112-40-0x00007FF633450000-0x00007FF6337A4000-memory.dmp	upx
behavioral2/memory/4488-32-0x00007FF7DBDF0000-0x00007FF7DC144000-memory.dmp	upx
behavioral2/files/0x00080000000233fa-34.dat	upx
behavioral2/memory/1924-25-0x00007FF7A6EC0000-0x00007FF7A7214000-memory.dmp	upx
behavioral2/memory/1416-600-0x00007FF6FCAA0000-0x00007FF6FCDF4000-memory.dmp	upx
behavioral2/memory/392-606-0x00007FF76AB40000-0x00007FF76AE94000-memory.dmp	upx
behavioral2/memory/912-612-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp	upx
behavioral2/memory/2552-614-0x00007FF6D4130000-0x00007FF6D4484000-memory.dmp	upx
behavioral2/memory/3304-603-0x00007FF68F1F0000-0x00007FF68F544000-memory.dmp	upx
behavioral2/memory/5016-1680-0x00007FF7B8160000-0x00007FF7B84B4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LwWFmuz.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\WBFgVJT.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\lgCiknI.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\yqBYfuJ.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\cyYoSub.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\qwXfvJB.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\ajTPwnS.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\keNaklL.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\WumGXIf.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\LunOnOt.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\IVUTUit.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\eACtYYC.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\zBGpasv.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\rCYFwbj.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\WNgQWtl.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\KqsomSv.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\fGheVnF.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\FmPlTzA.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\dakrQte.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\VUxdMyg.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\WTfWTwj.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\ZgkHFqI.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\kuuzlVa.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\hkttmnl.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\bIqZuqi.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\fJBbLIe.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\xqQWTkb.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\ZByVUlH.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\SwwXmZW.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\RlPFcEV.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\WvMbWbZ.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\BBRijQv.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\wpqATau.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\pGeRPxc.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\hwKPJnq.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\NDdkENC.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\mcjdKUo.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\gEdkXxs.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\OpRwJqO.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\oQrHYhq.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\XWUzcrE.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\CBSjons.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\fmcbkzO.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\OoJlAjm.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\rujSTCz.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\JPuIhXI.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\UOZPoSS.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\qjGQwaY.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\PLezbgl.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\pTiDRMK.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\GwfExHp.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\pEeSjxe.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\XRElqpc.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\gpstHRA.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\AWCeiYM.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\WqMIGtU.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\NLcqyUk.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\rnGfZGa.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\OpvgqiW.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\QqWmLMA.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\oIzchOf.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\xrmSdXv.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\PrCatfq.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe
File created	C:\Windows\System\jxkuTGb.exe	33b400852055ca8451e623c1067a1350_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4236	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	82
PID 5016 wrote to memory of 4236	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	82
PID 5016 wrote to memory of 2196	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	83
PID 5016 wrote to memory of 2196	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	83
PID 5016 wrote to memory of 1924	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	86
PID 5016 wrote to memory of 1924	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	86
PID 5016 wrote to memory of 2112	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	87
PID 5016 wrote to memory of 2112	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	87
PID 5016 wrote to memory of 4488	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	88
PID 5016 wrote to memory of 4488	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	88
PID 5016 wrote to memory of 3912	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	89
PID 5016 wrote to memory of 3912	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	89
PID 5016 wrote to memory of 1920	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	90
PID 5016 wrote to memory of 1920	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	90
PID 5016 wrote to memory of 3612	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	91
PID 5016 wrote to memory of 3612	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	91
PID 5016 wrote to memory of 2552	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	92
PID 5016 wrote to memory of 2552	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	92
PID 5016 wrote to memory of 1344	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	93
PID 5016 wrote to memory of 1344	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	93
PID 5016 wrote to memory of 1916	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	94
PID 5016 wrote to memory of 1916	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	94
PID 5016 wrote to memory of 4192	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	95
PID 5016 wrote to memory of 4192	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	95
PID 5016 wrote to memory of 1904	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	96
PID 5016 wrote to memory of 1904	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	96
PID 5016 wrote to memory of 3212	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	97
PID 5016 wrote to memory of 3212	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	97
PID 5016 wrote to memory of 1992	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	98
PID 5016 wrote to memory of 1992	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	98
PID 5016 wrote to memory of 3252	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	99
PID 5016 wrote to memory of 3252	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	99
PID 5016 wrote to memory of 3552	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	100
PID 5016 wrote to memory of 3552	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	100
PID 5016 wrote to memory of 1092	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	101
PID 5016 wrote to memory of 1092	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	101
PID 5016 wrote to memory of 4280	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	102
PID 5016 wrote to memory of 4280	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	102
PID 5016 wrote to memory of 2668	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	103
PID 5016 wrote to memory of 2668	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	103
PID 5016 wrote to memory of 2464	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	104
PID 5016 wrote to memory of 2464	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	104
PID 5016 wrote to memory of 1680	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	105
PID 5016 wrote to memory of 1680	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	105
PID 5016 wrote to memory of 3364	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	106
PID 5016 wrote to memory of 3364	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	106
PID 5016 wrote to memory of 5104	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	107
PID 5016 wrote to memory of 5104	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	107
PID 5016 wrote to memory of 3940	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	108
PID 5016 wrote to memory of 3940	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	108
PID 5016 wrote to memory of 1416	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	109
PID 5016 wrote to memory of 1416	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	109
PID 5016 wrote to memory of 3304	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	110
PID 5016 wrote to memory of 3304	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	110
PID 5016 wrote to memory of 392	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	111
PID 5016 wrote to memory of 392	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	111
PID 5016 wrote to memory of 912	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	112
PID 5016 wrote to memory of 912	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	112
PID 5016 wrote to memory of 4348	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	113
PID 5016 wrote to memory of 4348	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	113
PID 5016 wrote to memory of 1512	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	114
PID 5016 wrote to memory of 1512	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	114
PID 5016 wrote to memory of 1580	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	115
PID 5016 wrote to memory of 1580	5016	33b400852055ca8451e623c1067a1350_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\33b400852055ca8451e623c1067a1350_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\33b400852055ca8451e623c1067a1350_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\System\EnRQIGA.exe
  C:\Windows\System\EnRQIGA.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\mWYRMfd.exe
  C:\Windows\System\mWYRMfd.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\mudDCOh.exe
  C:\Windows\System\mudDCOh.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\sHMkrUa.exe
  C:\Windows\System\sHMkrUa.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\CcrheEZ.exe
  C:\Windows\System\CcrheEZ.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\TRrbrbH.exe
  C:\Windows\System\TRrbrbH.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\ZByVUlH.exe
  C:\Windows\System\ZByVUlH.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\swBePuN.exe
  C:\Windows\System\swBePuN.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ZdiAHQm.exe
  C:\Windows\System\ZdiAHQm.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\PjAhHod.exe
  C:\Windows\System\PjAhHod.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\kvQXRFm.exe
  C:\Windows\System\kvQXRFm.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\pVNXAGu.exe
  C:\Windows\System\pVNXAGu.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\jTULeiy.exe
  C:\Windows\System\jTULeiy.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\wpqATau.exe
  C:\Windows\System\wpqATau.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\JKCkTPv.exe
  C:\Windows\System\JKCkTPv.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\yNuOyFq.exe
  C:\Windows\System\yNuOyFq.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\ooGnunp.exe
  C:\Windows\System\ooGnunp.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\wkfNQHe.exe
  C:\Windows\System\wkfNQHe.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\VfNNrVE.exe
  C:\Windows\System\VfNNrVE.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\kycrDpw.exe
  C:\Windows\System\kycrDpw.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ivycesQ.exe
  C:\Windows\System\ivycesQ.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\nIfucvh.exe
  C:\Windows\System\nIfucvh.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\FyxslZZ.exe
  C:\Windows\System\FyxslZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\lBXYiXU.exe
  C:\Windows\System\lBXYiXU.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\CMDqvuU.exe
  C:\Windows\System\CMDqvuU.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\gGjHHtr.exe
  C:\Windows\System\gGjHHtr.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\uDnjiSy.exe
  C:\Windows\System\uDnjiSy.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\rDNDmbj.exe
  C:\Windows\System\rDNDmbj.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\PAqmzWD.exe
  C:\Windows\System\PAqmzWD.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\pUBBXkX.exe
  C:\Windows\System\pUBBXkX.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\TnZnHNl.exe
  C:\Windows\System\TnZnHNl.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\SyyqJcX.exe
  C:\Windows\System\SyyqJcX.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\jGFqYlP.exe
  C:\Windows\System\jGFqYlP.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\TejlXKc.exe
  C:\Windows\System\TejlXKc.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\fEeLHKg.exe
  C:\Windows\System\fEeLHKg.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\RqBBBPf.exe
  C:\Windows\System\RqBBBPf.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\TZdvLfU.exe
  C:\Windows\System\TZdvLfU.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\EIhobAT.exe
  C:\Windows\System\EIhobAT.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\PhBDuKi.exe
  C:\Windows\System\PhBDuKi.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\fgnWaPs.exe
  C:\Windows\System\fgnWaPs.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\UvRpHME.exe
  C:\Windows\System\UvRpHME.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\QkNprWR.exe
  C:\Windows\System\QkNprWR.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\GwfExHp.exe
  C:\Windows\System\GwfExHp.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\OSaHOnE.exe
  C:\Windows\System\OSaHOnE.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\LbODYgb.exe
  C:\Windows\System\LbODYgb.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\AysxGtP.exe
  C:\Windows\System\AysxGtP.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\VkJbTGv.exe
  C:\Windows\System\VkJbTGv.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\uEasoFd.exe
  C:\Windows\System\uEasoFd.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\AdoZSvU.exe
  C:\Windows\System\AdoZSvU.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\BUZTGFl.exe
  C:\Windows\System\BUZTGFl.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\HHuSVxx.exe
  C:\Windows\System\HHuSVxx.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\OosPKWp.exe
  C:\Windows\System\OosPKWp.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\Sivvavz.exe
  C:\Windows\System\Sivvavz.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\pGeRPxc.exe
  C:\Windows\System\pGeRPxc.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\svHLDwY.exe
  C:\Windows\System\svHLDwY.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\sCkQYrj.exe
  C:\Windows\System\sCkQYrj.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\ApWPybM.exe
  C:\Windows\System\ApWPybM.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\rnGfZGa.exe
  C:\Windows\System\rnGfZGa.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\KtvLMHo.exe
  C:\Windows\System\KtvLMHo.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\smCNXxq.exe
  C:\Windows\System\smCNXxq.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\uVTFQSc.exe
  C:\Windows\System\uVTFQSc.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\HhazeGt.exe
  C:\Windows\System\HhazeGt.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\fvpwPsn.exe
  C:\Windows\System\fvpwPsn.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\BvxZpby.exe
  C:\Windows\System\BvxZpby.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\UTDApDe.exe
  C:\Windows\System\UTDApDe.exe
  2⤵
  PID:2532
- C:\Windows\System\wUNHhvx.exe
  C:\Windows\System\wUNHhvx.exe
  2⤵
  PID:1032
- C:\Windows\System\IUKiowN.exe
  C:\Windows\System\IUKiowN.exe
  2⤵
  PID:1420
- C:\Windows\System\zeCkIAe.exe
  C:\Windows\System\zeCkIAe.exe
  2⤵
  PID:3696
- C:\Windows\System\zTOLaoA.exe
  C:\Windows\System\zTOLaoA.exe
  2⤵
  PID:4672
- C:\Windows\System\jRqTTHa.exe
  C:\Windows\System\jRqTTHa.exe
  2⤵
  PID:4568
- C:\Windows\System\ySMqrKQ.exe
  C:\Windows\System\ySMqrKQ.exe
  2⤵
  PID:3952
- C:\Windows\System\prLASMq.exe
  C:\Windows\System\prLASMq.exe
  2⤵
  PID:1432
- C:\Windows\System\ioxGceO.exe
  C:\Windows\System\ioxGceO.exe
  2⤵
  PID:1772
- C:\Windows\System\WTfWTwj.exe
  C:\Windows\System\WTfWTwj.exe
  2⤵
  PID:612
- C:\Windows\System\PpbPjSx.exe
  C:\Windows\System\PpbPjSx.exe
  2⤵
  PID:784
- C:\Windows\System\xivHMpI.exe
  C:\Windows\System\xivHMpI.exe
  2⤵
  PID:1428
- C:\Windows\System\jBXJBQd.exe
  C:\Windows\System\jBXJBQd.exe
  2⤵
  PID:2444
- C:\Windows\System\cYwSCzq.exe
  C:\Windows\System\cYwSCzq.exe
  2⤵
  PID:4332
- C:\Windows\System\dVbNVUA.exe
  C:\Windows\System\dVbNVUA.exe
  2⤵
  PID:2344
- C:\Windows\System\FqXiGvb.exe
  C:\Windows\System\FqXiGvb.exe
  2⤵
  PID:2664
- C:\Windows\System\nJlWYvX.exe
  C:\Windows\System\nJlWYvX.exe
  2⤵
  PID:3180
- C:\Windows\System\ZgkHFqI.exe
  C:\Windows\System\ZgkHFqI.exe
  2⤵
  PID:2360
- C:\Windows\System\XuYrgJF.exe
  C:\Windows\System\XuYrgJF.exe
  2⤵
  PID:2488
- C:\Windows\System\YSmEfea.exe
  C:\Windows\System\YSmEfea.exe
  2⤵
  PID:2284
- C:\Windows\System\ccQZOXI.exe
  C:\Windows\System\ccQZOXI.exe
  2⤵
  PID:4656
- C:\Windows\System\XvcddyM.exe
  C:\Windows\System\XvcddyM.exe
  2⤵
  PID:4664
- C:\Windows\System\aiSJDhn.exe
  C:\Windows\System\aiSJDhn.exe
  2⤵
  PID:4508
- C:\Windows\System\MQsyRRw.exe
  C:\Windows\System\MQsyRRw.exe
  2⤵
  PID:4452
- C:\Windows\System\gvNlbhV.exe
  C:\Windows\System\gvNlbhV.exe
  2⤵
  PID:4152
- C:\Windows\System\qOvJNRJ.exe
  C:\Windows\System\qOvJNRJ.exe
  2⤵
  PID:4056
- C:\Windows\System\khmziGZ.exe
  C:\Windows\System\khmziGZ.exe
  2⤵
  PID:5140
- C:\Windows\System\ELRXmGR.exe
  C:\Windows\System\ELRXmGR.exe
  2⤵
  PID:5172
- C:\Windows\System\ZFRIWqd.exe
  C:\Windows\System\ZFRIWqd.exe
  2⤵
  PID:5200
- C:\Windows\System\OmqvAQM.exe
  C:\Windows\System\OmqvAQM.exe
  2⤵
  PID:5228
- C:\Windows\System\qwXfvJB.exe
  C:\Windows\System\qwXfvJB.exe
  2⤵
  PID:5256
- C:\Windows\System\FBetsYq.exe
  C:\Windows\System\FBetsYq.exe
  2⤵
  PID:5288
- C:\Windows\System\fkpzSqc.exe
  C:\Windows\System\fkpzSqc.exe
  2⤵
  PID:5312
- C:\Windows\System\LwWFmuz.exe
  C:\Windows\System\LwWFmuz.exe
  2⤵
  PID:5336
- C:\Windows\System\faNkNZk.exe
  C:\Windows\System\faNkNZk.exe
  2⤵
  PID:5364
- C:\Windows\System\tYwdnGx.exe
  C:\Windows\System\tYwdnGx.exe
  2⤵
  PID:5396
- C:\Windows\System\rqAtgKH.exe
  C:\Windows\System\rqAtgKH.exe
  2⤵
  PID:5424
- C:\Windows\System\pnptzHs.exe
  C:\Windows\System\pnptzHs.exe
  2⤵
  PID:5452
- C:\Windows\System\KameEYD.exe
  C:\Windows\System\KameEYD.exe
  2⤵
  PID:5480
- C:\Windows\System\CSzejVg.exe
  C:\Windows\System\CSzejVg.exe
  2⤵
  PID:5504
- C:\Windows\System\gHuGAUk.exe
  C:\Windows\System\gHuGAUk.exe
  2⤵
  PID:5536
- C:\Windows\System\zdkWkpk.exe
  C:\Windows\System\zdkWkpk.exe
  2⤵
  PID:5564
- C:\Windows\System\wrpDbqV.exe
  C:\Windows\System\wrpDbqV.exe
  2⤵
  PID:5608
- C:\Windows\System\lKnJakZ.exe
  C:\Windows\System\lKnJakZ.exe
  2⤵
  PID:5640
- C:\Windows\System\dxbOyeF.exe
  C:\Windows\System\dxbOyeF.exe
  2⤵
  PID:5664
- C:\Windows\System\gdSqIbw.exe
  C:\Windows\System\gdSqIbw.exe
  2⤵
  PID:5684
- C:\Windows\System\OpvgqiW.exe
  C:\Windows\System\OpvgqiW.exe
  2⤵
  PID:5712
- C:\Windows\System\NKfAAlU.exe
  C:\Windows\System\NKfAAlU.exe
  2⤵
  PID:5740
- C:\Windows\System\HxRxGig.exe
  C:\Windows\System\HxRxGig.exe
  2⤵
  PID:5764
- C:\Windows\System\bAgjRIm.exe
  C:\Windows\System\bAgjRIm.exe
  2⤵
  PID:5796
- C:\Windows\System\jhLhRtN.exe
  C:\Windows\System\jhLhRtN.exe
  2⤵
  PID:5824
- C:\Windows\System\LWKVUax.exe
  C:\Windows\System\LWKVUax.exe
  2⤵
  PID:5852
- C:\Windows\System\skNMnxc.exe
  C:\Windows\System\skNMnxc.exe
  2⤵
  PID:5880
- C:\Windows\System\lOQORjt.exe
  C:\Windows\System\lOQORjt.exe
  2⤵
  PID:5908
- C:\Windows\System\QfifdOO.exe
  C:\Windows\System\QfifdOO.exe
  2⤵
  PID:5936
- C:\Windows\System\sjnPRdW.exe
  C:\Windows\System\sjnPRdW.exe
  2⤵
  PID:5964
- C:\Windows\System\IsGBBnR.exe
  C:\Windows\System\IsGBBnR.exe
  2⤵
  PID:5992
- C:\Windows\System\JByNHhx.exe
  C:\Windows\System\JByNHhx.exe
  2⤵
  PID:6020
- C:\Windows\System\PomjgyU.exe
  C:\Windows\System\PomjgyU.exe
  2⤵
  PID:6048
- C:\Windows\System\Tmmwipc.exe
  C:\Windows\System\Tmmwipc.exe
  2⤵
  PID:6076
- C:\Windows\System\WJwUmzl.exe
  C:\Windows\System\WJwUmzl.exe
  2⤵
  PID:6104
- C:\Windows\System\vriMXIO.exe
  C:\Windows\System\vriMXIO.exe
  2⤵
  PID:6132
- C:\Windows\System\rCYFwbj.exe
  C:\Windows\System\rCYFwbj.exe
  2⤵
  PID:1484
- C:\Windows\System\trAPFaO.exe
  C:\Windows\System\trAPFaO.exe
  2⤵
  PID:1572
- C:\Windows\System\MHrlEuc.exe
  C:\Windows\System\MHrlEuc.exe
  2⤵
  PID:3108
- C:\Windows\System\yxepOrP.exe
  C:\Windows\System\yxepOrP.exe
  2⤵
  PID:5128
- C:\Windows\System\eZDJEkY.exe
  C:\Windows\System\eZDJEkY.exe
  2⤵
  PID:2824
- C:\Windows\System\QujFYuy.exe
  C:\Windows\System\QujFYuy.exe
  2⤵
  PID:5244
- C:\Windows\System\bFEVAWg.exe
  C:\Windows\System\bFEVAWg.exe
  2⤵
  PID:5304
- C:\Windows\System\BKkJluO.exe
  C:\Windows\System\BKkJluO.exe
  2⤵
  PID:5360
- C:\Windows\System\cTUolSV.exe
  C:\Windows\System\cTUolSV.exe
  2⤵
  PID:5416
- C:\Windows\System\lBERRLR.exe
  C:\Windows\System\lBERRLR.exe
  2⤵
  PID:5472
- C:\Windows\System\VkyWlYq.exe
  C:\Windows\System\VkyWlYq.exe
  2⤵
  PID:6148
- C:\Windows\System\BqueVNc.exe
  C:\Windows\System\BqueVNc.exe
  2⤵
  PID:6176
- C:\Windows\System\FKNWije.exe
  C:\Windows\System\FKNWije.exe
  2⤵
  PID:6204
- C:\Windows\System\SrrIEfh.exe
  C:\Windows\System\SrrIEfh.exe
  2⤵
  PID:6232
- C:\Windows\System\XeeWZSj.exe
  C:\Windows\System\XeeWZSj.exe
  2⤵
  PID:6260
- C:\Windows\System\OoJlAjm.exe
  C:\Windows\System\OoJlAjm.exe
  2⤵
  PID:6288
- C:\Windows\System\SAVMGAN.exe
  C:\Windows\System\SAVMGAN.exe
  2⤵
  PID:6316
- C:\Windows\System\rujSTCz.exe
  C:\Windows\System\rujSTCz.exe
  2⤵
  PID:6344
- C:\Windows\System\bQXbyNt.exe
  C:\Windows\System\bQXbyNt.exe
  2⤵
  PID:6372
- C:\Windows\System\wolteyc.exe
  C:\Windows\System\wolteyc.exe
  2⤵
  PID:6400
- C:\Windows\System\lcMzSKk.exe
  C:\Windows\System\lcMzSKk.exe
  2⤵
  PID:6424
- C:\Windows\System\KmJWbpo.exe
  C:\Windows\System\KmJWbpo.exe
  2⤵
  PID:6464
- C:\Windows\System\tUROTee.exe
  C:\Windows\System\tUROTee.exe
  2⤵
  PID:6496
- C:\Windows\System\ERTTxgk.exe
  C:\Windows\System\ERTTxgk.exe
  2⤵
  PID:6524
- C:\Windows\System\oitQIVJ.exe
  C:\Windows\System\oitQIVJ.exe
  2⤵
  PID:6592
- C:\Windows\System\hwKPJnq.exe
  C:\Windows\System\hwKPJnq.exe
  2⤵
  PID:6632
- C:\Windows\System\eqUSfSS.exe
  C:\Windows\System\eqUSfSS.exe
  2⤵
  PID:6656
- C:\Windows\System\vQziASC.exe
  C:\Windows\System\vQziASC.exe
  2⤵
  PID:6672
- C:\Windows\System\ZJObOgW.exe
  C:\Windows\System\ZJObOgW.exe
  2⤵
  PID:6704
- C:\Windows\System\azwUEYP.exe
  C:\Windows\System\azwUEYP.exe
  2⤵
  PID:6724
- C:\Windows\System\CYAZTwl.exe
  C:\Windows\System\CYAZTwl.exe
  2⤵
  PID:6760
- C:\Windows\System\ZdlCdEp.exe
  C:\Windows\System\ZdlCdEp.exe
  2⤵
  PID:6784
- C:\Windows\System\SunFJvn.exe
  C:\Windows\System\SunFJvn.exe
  2⤵
  PID:6812
- C:\Windows\System\oGRngtn.exe
  C:\Windows\System\oGRngtn.exe
  2⤵
  PID:6840
- C:\Windows\System\QqWmLMA.exe
  C:\Windows\System\QqWmLMA.exe
  2⤵
  PID:6912
- C:\Windows\System\GsqAafg.exe
  C:\Windows\System\GsqAafg.exe
  2⤵
  PID:7012
- C:\Windows\System\qmMFbka.exe
  C:\Windows\System\qmMFbka.exe
  2⤵
  PID:7040
- C:\Windows\System\KCBPlof.exe
  C:\Windows\System\KCBPlof.exe
  2⤵
  PID:7092
- C:\Windows\System\XZjHuyd.exe
  C:\Windows\System\XZjHuyd.exe
  2⤵
  PID:7112
- C:\Windows\System\jmjPbZu.exe
  C:\Windows\System\jmjPbZu.exe
  2⤵
  PID:7136
- C:\Windows\System\SUpHONh.exe
  C:\Windows\System\SUpHONh.exe
  2⤵
  PID:7156
- C:\Windows\System\DgqptAW.exe
  C:\Windows\System\DgqptAW.exe
  2⤵
  PID:6416
- C:\Windows\System\JTaxfPY.exe
  C:\Windows\System\JTaxfPY.exe
  2⤵
  PID:2308
- C:\Windows\System\cdXDqUS.exe
  C:\Windows\System\cdXDqUS.exe
  2⤵
  PID:6308
- C:\Windows\System\aVzmLJD.exe
  C:\Windows\System\aVzmLJD.exe
  2⤵
  PID:4084
- C:\Windows\System\BkrNuzr.exe
  C:\Windows\System\BkrNuzr.exe
  2⤵
  PID:1072
- C:\Windows\System\ZgEiIoe.exe
  C:\Windows\System\ZgEiIoe.exe
  2⤵
  PID:5464
- C:\Windows\System\IhGwJss.exe
  C:\Windows\System\IhGwJss.exe
  2⤵
  PID:5352
- C:\Windows\System\TyakwBZ.exe
  C:\Windows\System\TyakwBZ.exe
  2⤵
  PID:5220
- C:\Windows\System\ivUbiKc.exe
  C:\Windows\System\ivUbiKc.exe
  2⤵
  PID:4088
- C:\Windows\System\QBwfVLE.exe
  C:\Windows\System\QBwfVLE.exe
  2⤵
  PID:3264
- C:\Windows\System\kncvtwm.exe
  C:\Windows\System\kncvtwm.exe
  2⤵
  PID:6064
- C:\Windows\System\iOlvhCz.exe
  C:\Windows\System\iOlvhCz.exe
  2⤵
  PID:3640
- C:\Windows\System\yYHsJAx.exe
  C:\Windows\System\yYHsJAx.exe
  2⤵
  PID:5952
- C:\Windows\System\EJyNEDj.exe
  C:\Windows\System\EJyNEDj.exe
  2⤵
  PID:5920
- C:\Windows\System\OAYYTcf.exe
  C:\Windows\System\OAYYTcf.exe
  2⤵
  PID:5864
- C:\Windows\System\MMcopeF.exe
  C:\Windows\System\MMcopeF.exe
  2⤵
  PID:5808
- C:\Windows\System\bbPywzH.exe
  C:\Windows\System\bbPywzH.exe
  2⤵
  PID:5728
- C:\Windows\System\NDdkENC.exe
  C:\Windows\System\NDdkENC.exe
  2⤵
  PID:5696
- C:\Windows\System\pEeSjxe.exe
  C:\Windows\System\pEeSjxe.exe
  2⤵
  PID:5628
- C:\Windows\System\kuuzlVa.exe
  C:\Windows\System\kuuzlVa.exe
  2⤵
  PID:5556
- C:\Windows\System\ArnwsgL.exe
  C:\Windows\System\ArnwsgL.exe
  2⤵
  PID:6484
- C:\Windows\System\QLRHxRh.exe
  C:\Windows\System\QLRHxRh.exe
  2⤵
  PID:3192
- C:\Windows\System\kiASHtL.exe
  C:\Windows\System\kiASHtL.exe
  2⤵
  PID:6488
- C:\Windows\System\UairQNe.exe
  C:\Windows\System\UairQNe.exe
  2⤵
  PID:4532
- C:\Windows\System\XRElqpc.exe
  C:\Windows\System\XRElqpc.exe
  2⤵
  PID:6560
- C:\Windows\System\unNdHQD.exe
  C:\Windows\System\unNdHQD.exe
  2⤵
  PID:6644
- C:\Windows\System\qMMztJu.exe
  C:\Windows\System\qMMztJu.exe
  2⤵
  PID:6668
- C:\Windows\System\PNgEVoB.exe
  C:\Windows\System\PNgEVoB.exe
  2⤵
  PID:6756
- C:\Windows\System\GfpsinH.exe
  C:\Windows\System\GfpsinH.exe
  2⤵
  PID:5584
- C:\Windows\System\XNLHfwa.exe
  C:\Windows\System\XNLHfwa.exe
  2⤵
  PID:6996
- C:\Windows\System\EvPsyDF.exe
  C:\Windows\System\EvPsyDF.exe
  2⤵
  PID:7036
- C:\Windows\System\GJeLXty.exe
  C:\Windows\System\GJeLXty.exe
  2⤵
  PID:7128
- C:\Windows\System\ASqeOWS.exe
  C:\Windows\System\ASqeOWS.exe
  2⤵
  PID:3112
- C:\Windows\System\AlgYoMq.exe
  C:\Windows\System\AlgYoMq.exe
  2⤵
  PID:6652
- C:\Windows\System\WkJfHKH.exe
  C:\Windows\System\WkJfHKH.exe
  2⤵
  PID:1264
- C:\Windows\System\WNgQWtl.exe
  C:\Windows\System\WNgQWtl.exe
  2⤵
  PID:7144
- C:\Windows\System\RthLTwi.exe
  C:\Windows\System\RthLTwi.exe
  2⤵
  PID:5384
- C:\Windows\System\JxtoGRD.exe
  C:\Windows\System\JxtoGRD.exe
  2⤵
  PID:4228
- C:\Windows\System\SYkiVxi.exe
  C:\Windows\System\SYkiVxi.exe
  2⤵
  PID:464
- C:\Windows\System\dEOEKGu.exe
  C:\Windows\System\dEOEKGu.exe
  2⤵
  PID:6068
- C:\Windows\System\AYEhhpM.exe
  C:\Windows\System\AYEhhpM.exe
  2⤵
  PID:6960
- C:\Windows\System\FOjaPJM.exe
  C:\Windows\System\FOjaPJM.exe
  2⤵
  PID:3328
- C:\Windows\System\WaDaajG.exe
  C:\Windows\System\WaDaajG.exe
  2⤵
  PID:5924
- C:\Windows\System\mYzweLK.exe
  C:\Windows\System\mYzweLK.exe
  2⤵
  PID:5836
- C:\Windows\System\lCbzZbz.exe
  C:\Windows\System\lCbzZbz.exe
  2⤵
  PID:5652
- C:\Windows\System\Jefvteu.exe
  C:\Windows\System\Jefvteu.exe
  2⤵
  PID:1360
- C:\Windows\System\SlvpIYj.exe
  C:\Windows\System\SlvpIYj.exe
  2⤵
  PID:4892
- C:\Windows\System\jYFkErY.exe
  C:\Windows\System\jYFkErY.exe
  2⤵
  PID:3548
- C:\Windows\System\GovUKtl.exe
  C:\Windows\System\GovUKtl.exe
  2⤵
  PID:6800
- C:\Windows\System\WBFgVJT.exe
  C:\Windows\System\WBFgVJT.exe
  2⤵
  PID:6992
- C:\Windows\System\DxDYwoQ.exe
  C:\Windows\System\DxDYwoQ.exe
  2⤵
  PID:5068
- C:\Windows\System\QExzsyN.exe
  C:\Windows\System\QExzsyN.exe
  2⤵
  PID:7048
- C:\Windows\System\VYAbCgq.exe
  C:\Windows\System\VYAbCgq.exe
  2⤵
  PID:5388
- C:\Windows\System\yCTiEao.exe
  C:\Windows\System\yCTiEao.exe
  2⤵
  PID:3592
- C:\Windows\System\oIzchOf.exe
  C:\Windows\System\oIzchOf.exe
  2⤵
  PID:3848
- C:\Windows\System\kYVMvUg.exe
  C:\Windows\System\kYVMvUg.exe
  2⤵
  PID:3884
- C:\Windows\System\eWhlJCy.exe
  C:\Windows\System\eWhlJCy.exe
  2⤵
  PID:5528
- C:\Windows\System\DRZqoqg.exe
  C:\Windows\System\DRZqoqg.exe
  2⤵
  PID:6664
- C:\Windows\System\gWhEDof.exe
  C:\Windows\System\gWhEDof.exe
  2⤵
  PID:6356
- C:\Windows\System\FxwhChN.exe
  C:\Windows\System\FxwhChN.exe
  2⤵
  PID:7120
- C:\Windows\System\gVdbdIh.exe
  C:\Windows\System\gVdbdIh.exe
  2⤵
  PID:4940
- C:\Windows\System\SnWtePg.exe
  C:\Windows\System\SnWtePg.exe
  2⤵
  PID:3800
- C:\Windows\System\KqsomSv.exe
  C:\Windows\System\KqsomSv.exe
  2⤵
  PID:6120
- C:\Windows\System\wibRHhe.exe
  C:\Windows\System\wibRHhe.exe
  2⤵
  PID:6604
- C:\Windows\System\MIWEQsu.exe
  C:\Windows\System\MIWEQsu.exe
  2⤵
  PID:7056
- C:\Windows\System\XEMWWct.exe
  C:\Windows\System\XEMWWct.exe
  2⤵
  PID:7184
- C:\Windows\System\RUWrxoq.exe
  C:\Windows\System\RUWrxoq.exe
  2⤵
  PID:7224
- C:\Windows\System\uyeFQFc.exe
  C:\Windows\System\uyeFQFc.exe
  2⤵
  PID:7240
- C:\Windows\System\GyEHoBw.exe
  C:\Windows\System\GyEHoBw.exe
  2⤵
  PID:7284
- C:\Windows\System\eHlwgYZ.exe
  C:\Windows\System\eHlwgYZ.exe
  2⤵
  PID:7312
- C:\Windows\System\yGobiQg.exe
  C:\Windows\System\yGobiQg.exe
  2⤵
  PID:7336
- C:\Windows\System\mVMVqHw.exe
  C:\Windows\System\mVMVqHw.exe
  2⤵
  PID:7360
- C:\Windows\System\jnVaUXz.exe
  C:\Windows\System\jnVaUXz.exe
  2⤵
  PID:7380
- C:\Windows\System\uPBeDTV.exe
  C:\Windows\System\uPBeDTV.exe
  2⤵
  PID:7420
- C:\Windows\System\MEHGDJv.exe
  C:\Windows\System\MEHGDJv.exe
  2⤵
  PID:7436
- C:\Windows\System\oCuybnQ.exe
  C:\Windows\System\oCuybnQ.exe
  2⤵
  PID:7476
- C:\Windows\System\RHGlJhB.exe
  C:\Windows\System\RHGlJhB.exe
  2⤵
  PID:7496
- C:\Windows\System\gpstHRA.exe
  C:\Windows\System\gpstHRA.exe
  2⤵
  PID:7532
- C:\Windows\System\ZCebwDQ.exe
  C:\Windows\System\ZCebwDQ.exe
  2⤵
  PID:7560
- C:\Windows\System\qlsnBmX.exe
  C:\Windows\System\qlsnBmX.exe
  2⤵
  PID:7588
- C:\Windows\System\CuvVvGN.exe
  C:\Windows\System\CuvVvGN.exe
  2⤵
  PID:7612
- C:\Windows\System\bfZtGif.exe
  C:\Windows\System\bfZtGif.exe
  2⤵
  PID:7632
- C:\Windows\System\hLWzHhm.exe
  C:\Windows\System\hLWzHhm.exe
  2⤵
  PID:7648
- C:\Windows\System\bmFDzNS.exe
  C:\Windows\System\bmFDzNS.exe
  2⤵
  PID:7676
- C:\Windows\System\xIDqyyt.exe
  C:\Windows\System\xIDqyyt.exe
  2⤵
  PID:7716
- C:\Windows\System\eoOehHq.exe
  C:\Windows\System\eoOehHq.exe
  2⤵
  PID:7744
- C:\Windows\System\GeFybws.exe
  C:\Windows\System\GeFybws.exe
  2⤵
  PID:7784
- C:\Windows\System\yqBYfuJ.exe
  C:\Windows\System\yqBYfuJ.exe
  2⤵
  PID:7804
- C:\Windows\System\UXgbMZQ.exe
  C:\Windows\System\UXgbMZQ.exe
  2⤵
  PID:7836
- C:\Windows\System\lVapdtR.exe
  C:\Windows\System\lVapdtR.exe
  2⤵
  PID:7868
- C:\Windows\System\ueFEpKU.exe
  C:\Windows\System\ueFEpKU.exe
  2⤵
  PID:7896
- C:\Windows\System\rnqmPEA.exe
  C:\Windows\System\rnqmPEA.exe
  2⤵
  PID:7924
- C:\Windows\System\MUBUMvP.exe
  C:\Windows\System\MUBUMvP.exe
  2⤵
  PID:7952
- C:\Windows\System\VFuhzGb.exe
  C:\Windows\System\VFuhzGb.exe
  2⤵
  PID:7980
- C:\Windows\System\YldRzPF.exe
  C:\Windows\System\YldRzPF.exe
  2⤵
  PID:8008
- C:\Windows\System\GIfpruo.exe
  C:\Windows\System\GIfpruo.exe
  2⤵
  PID:8036
- C:\Windows\System\aJvTYSV.exe
  C:\Windows\System\aJvTYSV.exe
  2⤵
  PID:8064
- C:\Windows\System\YuSnTzz.exe
  C:\Windows\System\YuSnTzz.exe
  2⤵
  PID:8092
- C:\Windows\System\ecsbDdw.exe
  C:\Windows\System\ecsbDdw.exe
  2⤵
  PID:8124
- C:\Windows\System\OXHjsrL.exe
  C:\Windows\System\OXHjsrL.exe
  2⤵
  PID:8152
- C:\Windows\System\JPuIhXI.exe
  C:\Windows\System\JPuIhXI.exe
  2⤵
  PID:8180
- C:\Windows\System\feUMtIp.exe
  C:\Windows\System\feUMtIp.exe
  2⤵
  PID:7216
- C:\Windows\System\OpRwJqO.exe
  C:\Windows\System\OpRwJqO.exe
  2⤵
  PID:7272
- C:\Windows\System\AsRexHT.exe
  C:\Windows\System\AsRexHT.exe
  2⤵
  PID:7332
- C:\Windows\System\shNIEBE.exe
  C:\Windows\System\shNIEBE.exe
  2⤵
  PID:7372
- C:\Windows\System\HeVCKFO.exe
  C:\Windows\System\HeVCKFO.exe
  2⤵
  PID:7428
- C:\Windows\System\kLAfusz.exe
  C:\Windows\System\kLAfusz.exe
  2⤵
  PID:7504
- C:\Windows\System\enqsWcR.exe
  C:\Windows\System\enqsWcR.exe
  2⤵
  PID:7584
- C:\Windows\System\VjXpLHx.exe
  C:\Windows\System\VjXpLHx.exe
  2⤵
  PID:7660
- C:\Windows\System\sjVsdXk.exe
  C:\Windows\System\sjVsdXk.exe
  2⤵
  PID:7696
- C:\Windows\System\NZeCGSH.exe
  C:\Windows\System\NZeCGSH.exe
  2⤵
  PID:7768
- C:\Windows\System\DNwaUXq.exe
  C:\Windows\System\DNwaUXq.exe
  2⤵
  PID:7860
- C:\Windows\System\mtJIQMD.exe
  C:\Windows\System\mtJIQMD.exe
  2⤵
  PID:7916
- C:\Windows\System\GOZbSYF.exe
  C:\Windows\System\GOZbSYF.exe
  2⤵
  PID:7992
- C:\Windows\System\yFYkhGk.exe
  C:\Windows\System\yFYkhGk.exe
  2⤵
  PID:8052
- C:\Windows\System\PClGikW.exe
  C:\Windows\System\PClGikW.exe
  2⤵
  PID:8084
- C:\Windows\System\paHYTbJ.exe
  C:\Windows\System\paHYTbJ.exe
  2⤵
  PID:8176
- C:\Windows\System\dyybbIY.exe
  C:\Windows\System\dyybbIY.exe
  2⤵
  PID:7324
- C:\Windows\System\lgCiknI.exe
  C:\Windows\System\lgCiknI.exe
  2⤵
  PID:7368
- C:\Windows\System\KeGOYoF.exe
  C:\Windows\System\KeGOYoF.exe
  2⤵
  PID:7520
- C:\Windows\System\jQtnYcj.exe
  C:\Windows\System\jQtnYcj.exe
  2⤵
  PID:7736
- C:\Windows\System\KNTTzyh.exe
  C:\Windows\System\KNTTzyh.exe
  2⤵
  PID:7832
- C:\Windows\System\hEMjWDI.exe
  C:\Windows\System\hEMjWDI.exe
  2⤵
  PID:7908
- C:\Windows\System\qPfBHSD.exe
  C:\Windows\System\qPfBHSD.exe
  2⤵
  PID:8136
- C:\Windows\System\rcSckro.exe
  C:\Windows\System\rcSckro.exe
  2⤵
  PID:7212
- C:\Windows\System\oTNaqvS.exe
  C:\Windows\System\oTNaqvS.exe
  2⤵
  PID:7608
- C:\Windows\System\rWuFUFp.exe
  C:\Windows\System\rWuFUFp.exe
  2⤵
  PID:8032
- C:\Windows\System\iJmFrPU.exe
  C:\Windows\System\iJmFrPU.exe
  2⤵
  PID:7884
- C:\Windows\System\PqSKBQI.exe
  C:\Windows\System\PqSKBQI.exe
  2⤵
  PID:8200
- C:\Windows\System\adUkxEh.exe
  C:\Windows\System\adUkxEh.exe
  2⤵
  PID:8228
- C:\Windows\System\lemCVQQ.exe
  C:\Windows\System\lemCVQQ.exe
  2⤵
  PID:8260
- C:\Windows\System\uRNLCWO.exe
  C:\Windows\System\uRNLCWO.exe
  2⤵
  PID:8284
- C:\Windows\System\UpLGmqy.exe
  C:\Windows\System\UpLGmqy.exe
  2⤵
  PID:8312
- C:\Windows\System\NcabpTz.exe
  C:\Windows\System\NcabpTz.exe
  2⤵
  PID:8344
- C:\Windows\System\hjodCfR.exe
  C:\Windows\System\hjodCfR.exe
  2⤵
  PID:8368
- C:\Windows\System\iHAzrTI.exe
  C:\Windows\System\iHAzrTI.exe
  2⤵
  PID:8396
- C:\Windows\System\vhBFcGQ.exe
  C:\Windows\System\vhBFcGQ.exe
  2⤵
  PID:8416
- C:\Windows\System\BQYPwCR.exe
  C:\Windows\System\BQYPwCR.exe
  2⤵
  PID:8452
- C:\Windows\System\bIqZuqi.exe
  C:\Windows\System\bIqZuqi.exe
  2⤵
  PID:8468
- C:\Windows\System\SwwXmZW.exe
  C:\Windows\System\SwwXmZW.exe
  2⤵
  PID:8496
- C:\Windows\System\WHCQkRy.exe
  C:\Windows\System\WHCQkRy.exe
  2⤵
  PID:8524
- C:\Windows\System\vXayzUz.exe
  C:\Windows\System\vXayzUz.exe
  2⤵
  PID:8564
- C:\Windows\System\ZwuNrFW.exe
  C:\Windows\System\ZwuNrFW.exe
  2⤵
  PID:8580
- C:\Windows\System\EwSkwEG.exe
  C:\Windows\System\EwSkwEG.exe
  2⤵
  PID:8612
- C:\Windows\System\nnejQtO.exe
  C:\Windows\System\nnejQtO.exe
  2⤵
  PID:8652
- C:\Windows\System\DMozzOY.exe
  C:\Windows\System\DMozzOY.exe
  2⤵
  PID:8680
- C:\Windows\System\AQzARBz.exe
  C:\Windows\System\AQzARBz.exe
  2⤵
  PID:8708
- C:\Windows\System\SBhKOGw.exe
  C:\Windows\System\SBhKOGw.exe
  2⤵
  PID:8732
- C:\Windows\System\QaJaumw.exe
  C:\Windows\System\QaJaumw.exe
  2⤵
  PID:8764
- C:\Windows\System\PozlOOW.exe
  C:\Windows\System\PozlOOW.exe
  2⤵
  PID:8792
- C:\Windows\System\peHUBWe.exe
  C:\Windows\System\peHUBWe.exe
  2⤵
  PID:8820
- C:\Windows\System\VzrWOVk.exe
  C:\Windows\System\VzrWOVk.exe
  2⤵
  PID:8848
- C:\Windows\System\NKEZflb.exe
  C:\Windows\System\NKEZflb.exe
  2⤵
  PID:8876
- C:\Windows\System\GLRIGME.exe
  C:\Windows\System\GLRIGME.exe
  2⤵
  PID:8900
- C:\Windows\System\hXnZSNI.exe
  C:\Windows\System\hXnZSNI.exe
  2⤵
  PID:8920
- C:\Windows\System\OwjoGVx.exe
  C:\Windows\System\OwjoGVx.exe
  2⤵
  PID:8936
- C:\Windows\System\kdXmhpf.exe
  C:\Windows\System\kdXmhpf.exe
  2⤵
  PID:8976
- C:\Windows\System\vuVmUWi.exe
  C:\Windows\System\vuVmUWi.exe
  2⤵
  PID:9016
- C:\Windows\System\gIoEmes.exe
  C:\Windows\System\gIoEmes.exe
  2⤵
  PID:9032
- C:\Windows\System\bvBELpq.exe
  C:\Windows\System\bvBELpq.exe
  2⤵
  PID:9060
- C:\Windows\System\fXVPfLv.exe
  C:\Windows\System\fXVPfLv.exe
  2⤵
  PID:9092
- C:\Windows\System\yLlYggf.exe
  C:\Windows\System\yLlYggf.exe
  2⤵
  PID:9128
- C:\Windows\System\iKrSIXj.exe
  C:\Windows\System\iKrSIXj.exe
  2⤵
  PID:9144
- C:\Windows\System\CXhhyKm.exe
  C:\Windows\System\CXhhyKm.exe
  2⤵
  PID:9164
- C:\Windows\System\uysmqRy.exe
  C:\Windows\System\uysmqRy.exe
  2⤵
  PID:9180
- C:\Windows\System\XDwFcZZ.exe
  C:\Windows\System\XDwFcZZ.exe
  2⤵
  PID:8216
- C:\Windows\System\vTsgwSL.exe
  C:\Windows\System\vTsgwSL.exe
  2⤵
  PID:8280
- C:\Windows\System\YGKBzDl.exe
  C:\Windows\System\YGKBzDl.exe
  2⤵
  PID:8336
- C:\Windows\System\vsayphe.exe
  C:\Windows\System\vsayphe.exe
  2⤵
  PID:8404
- C:\Windows\System\SWlUJXl.exe
  C:\Windows\System\SWlUJXl.exe
  2⤵
  PID:8460
- C:\Windows\System\ZyCgDNy.exe
  C:\Windows\System\ZyCgDNy.exe
  2⤵
  PID:8552
- C:\Windows\System\kZGoDjT.exe
  C:\Windows\System\kZGoDjT.exe
  2⤵
  PID:8608
- C:\Windows\System\jhlIEKo.exe
  C:\Windows\System\jhlIEKo.exe
  2⤵
  PID:8692
- C:\Windows\System\PGIspUQ.exe
  C:\Windows\System\PGIspUQ.exe
  2⤵
  PID:8748
- C:\Windows\System\FWYQwfT.exe
  C:\Windows\System\FWYQwfT.exe
  2⤵
  PID:8812
- C:\Windows\System\hkttmnl.exe
  C:\Windows\System\hkttmnl.exe
  2⤵
  PID:8868
- C:\Windows\System\BCHJDwD.exe
  C:\Windows\System\BCHJDwD.exe
  2⤵
  PID:8992
- C:\Windows\System\sSzRfxC.exe
  C:\Windows\System\sSzRfxC.exe
  2⤵
  PID:9024
- C:\Windows\System\djMpXZv.exe
  C:\Windows\System\djMpXZv.exe
  2⤵
  PID:9088
- C:\Windows\System\VmVRybJ.exe
  C:\Windows\System\VmVRybJ.exe
  2⤵
  PID:9156
- C:\Windows\System\ywIvrAX.exe
  C:\Windows\System\ywIvrAX.exe
  2⤵
  PID:9204
- C:\Windows\System\kxCDGgf.exe
  C:\Windows\System\kxCDGgf.exe
  2⤵
  PID:8248
- C:\Windows\System\GMYvCSu.exe
  C:\Windows\System\GMYvCSu.exe
  2⤵
  PID:8356
- C:\Windows\System\SyYksbv.exe
  C:\Windows\System\SyYksbv.exe
  2⤵
  PID:8664
- C:\Windows\System\HtVkIPz.exe
  C:\Windows\System\HtVkIPz.exe
  2⤵
  PID:8760
- C:\Windows\System\jZDrOEa.exe
  C:\Windows\System\jZDrOEa.exe
  2⤵
  PID:9008
- C:\Windows\System\KsEGxNb.exe
  C:\Windows\System\KsEGxNb.exe
  2⤵
  PID:9072
- C:\Windows\System\vPfBRPo.exe
  C:\Windows\System\vPfBRPo.exe
  2⤵
  PID:8296
- C:\Windows\System\sgKDjhW.exe
  C:\Windows\System\sgKDjhW.exe
  2⤵
  PID:8308
- C:\Windows\System\dakrQte.exe
  C:\Windows\System\dakrQte.exe
  2⤵
  PID:9044
- C:\Windows\System\IjHllLn.exe
  C:\Windows\System\IjHllLn.exe
  2⤵
  PID:8576
- C:\Windows\System\iJkviQm.exe
  C:\Windows\System\iJkviQm.exe
  2⤵
  PID:9028
- C:\Windows\System\iXVMCFt.exe
  C:\Windows\System\iXVMCFt.exe
  2⤵
  PID:9236
- C:\Windows\System\OEfkOXp.exe
  C:\Windows\System\OEfkOXp.exe
  2⤵
  PID:9264
- C:\Windows\System\YqdWnWI.exe
  C:\Windows\System\YqdWnWI.exe
  2⤵
  PID:9284
- C:\Windows\System\RrIZRrb.exe
  C:\Windows\System\RrIZRrb.exe
  2⤵
  PID:9320
- C:\Windows\System\oMBfzZg.exe
  C:\Windows\System\oMBfzZg.exe
  2⤵
  PID:9348
- C:\Windows\System\fQMpvkO.exe
  C:\Windows\System\fQMpvkO.exe
  2⤵
  PID:9368
- C:\Windows\System\dciEtQl.exe
  C:\Windows\System\dciEtQl.exe
  2⤵
  PID:9408
- C:\Windows\System\vDGHyKf.exe
  C:\Windows\System\vDGHyKf.exe
  2⤵
  PID:9432
- C:\Windows\System\OmbPpsf.exe
  C:\Windows\System\OmbPpsf.exe
  2⤵
  PID:9452
- C:\Windows\System\FbNadXa.exe
  C:\Windows\System\FbNadXa.exe
  2⤵
  PID:9480
- C:\Windows\System\JHGoOYI.exe
  C:\Windows\System\JHGoOYI.exe
  2⤵
  PID:9508
- C:\Windows\System\ipVlScP.exe
  C:\Windows\System\ipVlScP.exe
  2⤵
  PID:9536
- C:\Windows\System\wPFpSjq.exe
  C:\Windows\System\wPFpSjq.exe
  2⤵
  PID:9568
- C:\Windows\System\AwBaYEw.exe
  C:\Windows\System\AwBaYEw.exe
  2⤵
  PID:9604
- C:\Windows\System\dPsLWmA.exe
  C:\Windows\System\dPsLWmA.exe
  2⤵
  PID:9624
- C:\Windows\System\AWCeiYM.exe
  C:\Windows\System\AWCeiYM.exe
  2⤵
  PID:9648
- C:\Windows\System\ATqhRBZ.exe
  C:\Windows\System\ATqhRBZ.exe
  2⤵
  PID:9672
- C:\Windows\System\fJBbLIe.exe
  C:\Windows\System\fJBbLIe.exe
  2⤵
  PID:9700
- C:\Windows\System\egXsEfX.exe
  C:\Windows\System\egXsEfX.exe
  2⤵
  PID:9728
- C:\Windows\System\vGZRqgU.exe
  C:\Windows\System\vGZRqgU.exe
  2⤵
  PID:9748
- C:\Windows\System\rMlnWFH.exe
  C:\Windows\System\rMlnWFH.exe
  2⤵
  PID:9792
- C:\Windows\System\XatTkes.exe
  C:\Windows\System\XatTkes.exe
  2⤵
  PID:9816
- C:\Windows\System\prgTXvQ.exe
  C:\Windows\System\prgTXvQ.exe
  2⤵
  PID:9832
- C:\Windows\System\tViRbCY.exe
  C:\Windows\System\tViRbCY.exe
  2⤵
  PID:9848
- C:\Windows\System\ZNgyLKb.exe
  C:\Windows\System\ZNgyLKb.exe
  2⤵
  PID:9872
- C:\Windows\System\rFFIOSK.exe
  C:\Windows\System\rFFIOSK.exe
  2⤵
  PID:9904
- C:\Windows\System\vqkNcgO.exe
  C:\Windows\System\vqkNcgO.exe
  2⤵
  PID:9928
- C:\Windows\System\FkFFubk.exe
  C:\Windows\System\FkFFubk.exe
  2⤵
  PID:9968
- C:\Windows\System\ZgUqSiI.exe
  C:\Windows\System\ZgUqSiI.exe
  2⤵
  PID:10012
- C:\Windows\System\XTtXKee.exe
  C:\Windows\System\XTtXKee.exe
  2⤵
  PID:10040
- C:\Windows\System\rHGktbU.exe
  C:\Windows\System\rHGktbU.exe
  2⤵
  PID:10068
- C:\Windows\System\arukunf.exe
  C:\Windows\System\arukunf.exe
  2⤵
  PID:10100
- C:\Windows\System\PIjvHEC.exe
  C:\Windows\System\PIjvHEC.exe
  2⤵
  PID:10136
- C:\Windows\System\ZCyvlsM.exe
  C:\Windows\System\ZCyvlsM.exe
  2⤵
  PID:10164
- C:\Windows\System\BwzBiTY.exe
  C:\Windows\System\BwzBiTY.exe
  2⤵
  PID:10192
- C:\Windows\System\YXgOGeo.exe
  C:\Windows\System\YXgOGeo.exe
  2⤵
  PID:10208
- C:\Windows\System\PSxNXmA.exe
  C:\Windows\System\PSxNXmA.exe
  2⤵
  PID:9228
- C:\Windows\System\XeLBxxo.exe
  C:\Windows\System\XeLBxxo.exe
  2⤵
  PID:9304
- C:\Windows\System\eFlqLcn.exe
  C:\Windows\System\eFlqLcn.exe
  2⤵
  PID:9360
- C:\Windows\System\eLluchG.exe
  C:\Windows\System\eLluchG.exe
  2⤵
  PID:9416
- C:\Windows\System\yOrYWXu.exe
  C:\Windows\System\yOrYWXu.exe
  2⤵
  PID:9472
- C:\Windows\System\PLQszjA.exe
  C:\Windows\System\PLQszjA.exe
  2⤵
  PID:9548
- C:\Windows\System\FsnEBbC.exe
  C:\Windows\System\FsnEBbC.exe
  2⤵
  PID:9600
- C:\Windows\System\rNWfmVa.exe
  C:\Windows\System\rNWfmVa.exe
  2⤵
  PID:9632
- C:\Windows\System\tElRQAG.exe
  C:\Windows\System\tElRQAG.exe
  2⤵
  PID:9688
- C:\Windows\System\UMiHKDn.exe
  C:\Windows\System\UMiHKDn.exe
  2⤵
  PID:9780
- C:\Windows\System\ajTPwnS.exe
  C:\Windows\System\ajTPwnS.exe
  2⤵
  PID:9828
- C:\Windows\System\zbcaYFs.exe
  C:\Windows\System\zbcaYFs.exe
  2⤵
  PID:9916
- C:\Windows\System\nNFELpN.exe
  C:\Windows\System\nNFELpN.exe
  2⤵
  PID:9960
- C:\Windows\System\Xgbwits.exe
  C:\Windows\System\Xgbwits.exe
  2⤵
  PID:10088
- C:\Windows\System\GogluVM.exe
  C:\Windows\System\GogluVM.exe
  2⤵
  PID:10148
- C:\Windows\System\LNdErHm.exe
  C:\Windows\System\LNdErHm.exe
  2⤵
  PID:10200
- C:\Windows\System\gDHDKFi.exe
  C:\Windows\System\gDHDKFi.exe
  2⤵
  PID:9276
- C:\Windows\System\RnpXbwY.exe
  C:\Windows\System\RnpXbwY.exe
  2⤵
  PID:9400
- C:\Windows\System\ZqwtvYT.exe
  C:\Windows\System\ZqwtvYT.exe
  2⤵
  PID:9592
- C:\Windows\System\PKppvYM.exe
  C:\Windows\System\PKppvYM.exe
  2⤵
  PID:9744
- C:\Windows\System\yNRJAeN.exe
  C:\Windows\System\yNRJAeN.exe
  2⤵
  PID:9812
- C:\Windows\System\lixEQte.exe
  C:\Windows\System\lixEQte.exe
  2⤵
  PID:10052
- C:\Windows\System\WqMIGtU.exe
  C:\Windows\System\WqMIGtU.exe
  2⤵
  PID:10116
- C:\Windows\System\DybQzda.exe
  C:\Windows\System\DybQzda.exe
  2⤵
  PID:9524
- C:\Windows\System\ZlvkldR.exe
  C:\Windows\System\ZlvkldR.exe
  2⤵
  PID:9692
- C:\Windows\System\ZcPUvjA.exe
  C:\Windows\System\ZcPUvjA.exe
  2⤵
  PID:10204
- C:\Windows\System\vAGOWoV.exe
  C:\Windows\System\vAGOWoV.exe
  2⤵
  PID:10036
- C:\Windows\System\zRjDVvz.exe
  C:\Windows\System\zRjDVvz.exe
  2⤵
  PID:9668
- C:\Windows\System\wbBWxbz.exe
  C:\Windows\System\wbBWxbz.exe
  2⤵
  PID:10268
- C:\Windows\System\bGrZWQy.exe
  C:\Windows\System\bGrZWQy.exe
  2⤵
  PID:10296
- C:\Windows\System\vQNFtXa.exe
  C:\Windows\System\vQNFtXa.exe
  2⤵
  PID:10312
- C:\Windows\System\nzfqRdi.exe
  C:\Windows\System\nzfqRdi.exe
  2⤵
  PID:10344
- C:\Windows\System\AsYpXbm.exe
  C:\Windows\System\AsYpXbm.exe
  2⤵
  PID:10368
- C:\Windows\System\gyhnGxL.exe
  C:\Windows\System\gyhnGxL.exe
  2⤵
  PID:10408
- C:\Windows\System\yzqkTbi.exe
  C:\Windows\System\yzqkTbi.exe
  2⤵
  PID:10428
- C:\Windows\System\dvHxVIX.exe
  C:\Windows\System\dvHxVIX.exe
  2⤵
  PID:10452
- C:\Windows\System\MdEtPoA.exe
  C:\Windows\System\MdEtPoA.exe
  2⤵
  PID:10492
- C:\Windows\System\aWFaQPb.exe
  C:\Windows\System\aWFaQPb.exe
  2⤵
  PID:10520
- C:\Windows\System\LAKGifM.exe
  C:\Windows\System\LAKGifM.exe
  2⤵
  PID:10548
- C:\Windows\System\yZHOvvC.exe
  C:\Windows\System\yZHOvvC.exe
  2⤵
  PID:10576
- C:\Windows\System\nMTTQED.exe
  C:\Windows\System\nMTTQED.exe
  2⤵
  PID:10596
- C:\Windows\System\Gnjpqos.exe
  C:\Windows\System\Gnjpqos.exe
  2⤵
  PID:10632
- C:\Windows\System\rbYwhpq.exe
  C:\Windows\System\rbYwhpq.exe
  2⤵
  PID:10648
- C:\Windows\System\xqQWTkb.exe
  C:\Windows\System\xqQWTkb.exe
  2⤵
  PID:10688
- C:\Windows\System\zhOzAWD.exe
  C:\Windows\System\zhOzAWD.exe
  2⤵
  PID:10716
- C:\Windows\System\Vrgdaln.exe
  C:\Windows\System\Vrgdaln.exe
  2⤵
  PID:10744
- C:\Windows\System\XeUUYQZ.exe
  C:\Windows\System\XeUUYQZ.exe
  2⤵
  PID:10772
- C:\Windows\System\UOZPoSS.exe
  C:\Windows\System\UOZPoSS.exe
  2⤵
  PID:10800
- C:\Windows\System\onvyILu.exe
  C:\Windows\System\onvyILu.exe
  2⤵
  PID:10820
- C:\Windows\System\qjGQwaY.exe
  C:\Windows\System\qjGQwaY.exe
  2⤵
  PID:10844
- C:\Windows\System\ytjEjyJ.exe
  C:\Windows\System\ytjEjyJ.exe
  2⤵
  PID:10884
- C:\Windows\System\HvMTQzP.exe
  C:\Windows\System\HvMTQzP.exe
  2⤵
  PID:10912
- C:\Windows\System\fmcbkzO.exe
  C:\Windows\System\fmcbkzO.exe
  2⤵
  PID:10940
- C:\Windows\System\xQgyibd.exe
  C:\Windows\System\xQgyibd.exe
  2⤵
  PID:10968
- C:\Windows\System\NUWhvID.exe
  C:\Windows\System\NUWhvID.exe
  2⤵
  PID:10996
- C:\Windows\System\yavmoBd.exe
  C:\Windows\System\yavmoBd.exe
  2⤵
  PID:11024
- C:\Windows\System\InLURmx.exe
  C:\Windows\System\InLURmx.exe
  2⤵
  PID:11052
- C:\Windows\System\DucTJmB.exe
  C:\Windows\System\DucTJmB.exe
  2⤵
  PID:11080
- C:\Windows\System\eLaizjo.exe
  C:\Windows\System\eLaizjo.exe
  2⤵
  PID:11108
- C:\Windows\System\hExqMAF.exe
  C:\Windows\System\hExqMAF.exe
  2⤵
  PID:11136
- C:\Windows\System\LrNWAWE.exe
  C:\Windows\System\LrNWAWE.exe
  2⤵
  PID:11164
- C:\Windows\System\lxdHpbk.exe
  C:\Windows\System\lxdHpbk.exe
  2⤵
  PID:11192
- C:\Windows\System\fMOUBXr.exe
  C:\Windows\System\fMOUBXr.exe
  2⤵
  PID:11220
- C:\Windows\System\WEjoXWw.exe
  C:\Windows\System\WEjoXWw.exe
  2⤵
  PID:11248
- C:\Windows\System\PuIPeVy.exe
  C:\Windows\System\PuIPeVy.exe
  2⤵
  PID:10260
- C:\Windows\System\KfDYfrw.exe
  C:\Windows\System\KfDYfrw.exe
  2⤵
  PID:10328
- C:\Windows\System\tHpFsRY.exe
  C:\Windows\System\tHpFsRY.exe
  2⤵
  PID:10400
- C:\Windows\System\lKGJlmM.exe
  C:\Windows\System\lKGJlmM.exe
  2⤵
  PID:10464
- C:\Windows\System\jHcSpwo.exe
  C:\Windows\System\jHcSpwo.exe
  2⤵
  PID:10536
- C:\Windows\System\ZgwdoXj.exe
  C:\Windows\System\ZgwdoXj.exe
  2⤵
  PID:10588
- C:\Windows\System\cotAlGl.exe
  C:\Windows\System\cotAlGl.exe
  2⤵
  PID:10660
- C:\Windows\System\skmCBFw.exe
  C:\Windows\System\skmCBFw.exe
  2⤵
  PID:10728
- C:\Windows\System\EPvcPkZ.exe
  C:\Windows\System\EPvcPkZ.exe
  2⤵
  PID:10764
- C:\Windows\System\NVQXBNP.exe
  C:\Windows\System\NVQXBNP.exe
  2⤵
  PID:10872
- C:\Windows\System\dBANQGC.exe
  C:\Windows\System\dBANQGC.exe
  2⤵
  PID:10924
- C:\Windows\System\XvqdIpX.exe
  C:\Windows\System\XvqdIpX.exe
  2⤵
  PID:10980
- C:\Windows\System\gnvMBqV.exe
  C:\Windows\System\gnvMBqV.exe
  2⤵
  PID:4792
- C:\Windows\System\fyxYpfJ.exe
  C:\Windows\System\fyxYpfJ.exe
  2⤵
  PID:11072
- C:\Windows\System\bQRlLpP.exe
  C:\Windows\System\bQRlLpP.exe
  2⤵
  PID:11156
- C:\Windows\System\fGheVnF.exe
  C:\Windows\System\fGheVnF.exe
  2⤵
  PID:11204
- C:\Windows\System\XixFEvl.exe
  C:\Windows\System\XixFEvl.exe
  2⤵
  PID:10308
- C:\Windows\System\CjRXtsj.exe
  C:\Windows\System\CjRXtsj.exe
  2⤵
  PID:10444
- C:\Windows\System\dIedbFZ.exe
  C:\Windows\System\dIedbFZ.exe
  2⤵
  PID:10584
- C:\Windows\System\xaonOve.exe
  C:\Windows\System\xaonOve.exe
  2⤵
  PID:10700
- C:\Windows\System\gQmGGGE.exe
  C:\Windows\System\gQmGGGE.exe
  2⤵
  PID:10864
- C:\Windows\System\wgdOIBD.exe
  C:\Windows\System\wgdOIBD.exe
  2⤵
  PID:11040
- C:\Windows\System\wvwOwdn.exe
  C:\Windows\System\wvwOwdn.exe
  2⤵
  PID:11132
- C:\Windows\System\GsubfQW.exe
  C:\Windows\System\GsubfQW.exe
  2⤵
  PID:11260
- C:\Windows\System\QmzCuUY.exe
  C:\Windows\System\QmzCuUY.exe
  2⤵
  PID:10708
- C:\Windows\System\VUncryA.exe
  C:\Windows\System\VUncryA.exe
  2⤵
  PID:11012
- C:\Windows\System\XLXBZff.exe
  C:\Windows\System\XLXBZff.exe
  2⤵
  PID:11212
- C:\Windows\System\pOBsOmZ.exe
  C:\Windows\System\pOBsOmZ.exe
  2⤵
  PID:10952
- C:\Windows\System\JSlfglk.exe
  C:\Windows\System\JSlfglk.exe
  2⤵
  PID:10436
- C:\Windows\System\ROdoekz.exe
  C:\Windows\System\ROdoekz.exe
  2⤵
  PID:11284
- C:\Windows\System\USofxKH.exe
  C:\Windows\System\USofxKH.exe
  2⤵
  PID:11312
- C:\Windows\System\EqiXXQj.exe
  C:\Windows\System\EqiXXQj.exe
  2⤵
  PID:11340
- C:\Windows\System\mIumaHk.exe
  C:\Windows\System\mIumaHk.exe
  2⤵
  PID:11368
- C:\Windows\System\dvLsavL.exe
  C:\Windows\System\dvLsavL.exe
  2⤵
  PID:11396
- C:\Windows\System\keNaklL.exe
  C:\Windows\System\keNaklL.exe
  2⤵
  PID:11424
- C:\Windows\System\scpZnMm.exe
  C:\Windows\System\scpZnMm.exe
  2⤵
  PID:11452
- C:\Windows\System\dTpWOQP.exe
  C:\Windows\System\dTpWOQP.exe
  2⤵
  PID:11480
- C:\Windows\System\oCisfmc.exe
  C:\Windows\System\oCisfmc.exe
  2⤵
  PID:11508
- C:\Windows\System\zYSAxyy.exe
  C:\Windows\System\zYSAxyy.exe
  2⤵
  PID:11536
- C:\Windows\System\JLhPFfL.exe
  C:\Windows\System\JLhPFfL.exe
  2⤵
  PID:11564
- C:\Windows\System\PVaalEY.exe
  C:\Windows\System\PVaalEY.exe
  2⤵
  PID:11592
- C:\Windows\System\yRxgdFt.exe
  C:\Windows\System\yRxgdFt.exe
  2⤵
  PID:11620
- C:\Windows\System\SfrSaDU.exe
  C:\Windows\System\SfrSaDU.exe
  2⤵
  PID:11648
- C:\Windows\System\wapnzVe.exe
  C:\Windows\System\wapnzVe.exe
  2⤵
  PID:11676
- C:\Windows\System\eOyIUYy.exe
  C:\Windows\System\eOyIUYy.exe
  2⤵
  PID:11704
- C:\Windows\System\nKtRMZN.exe
  C:\Windows\System\nKtRMZN.exe
  2⤵
  PID:11732
- C:\Windows\System\vPgvMTF.exe
  C:\Windows\System\vPgvMTF.exe
  2⤵
  PID:11760
- C:\Windows\System\gtxdXgn.exe
  C:\Windows\System\gtxdXgn.exe
  2⤵
  PID:11784
- C:\Windows\System\WvMbWbZ.exe
  C:\Windows\System\WvMbWbZ.exe
  2⤵
  PID:11812
- C:\Windows\System\FLcagTy.exe
  C:\Windows\System\FLcagTy.exe
  2⤵
  PID:11832
- C:\Windows\System\BrUjfAD.exe
  C:\Windows\System\BrUjfAD.exe
  2⤵
  PID:11872
- C:\Windows\System\NeMSgFX.exe
  C:\Windows\System\NeMSgFX.exe
  2⤵
  PID:11900
- C:\Windows\System\pmdHSOr.exe
  C:\Windows\System\pmdHSOr.exe
  2⤵
  PID:11928
- C:\Windows\System\VUxdMyg.exe
  C:\Windows\System\VUxdMyg.exe
  2⤵
  PID:11956
- C:\Windows\System\NRMNosZ.exe
  C:\Windows\System\NRMNosZ.exe
  2⤵
  PID:11996
- C:\Windows\System\zzVnqUJ.exe
  C:\Windows\System\zzVnqUJ.exe
  2⤵
  PID:12012
- C:\Windows\System\Luofnkm.exe
  C:\Windows\System\Luofnkm.exe
  2⤵
  PID:12040
- C:\Windows\System\OwnHmXS.exe
  C:\Windows\System\OwnHmXS.exe
  2⤵
  PID:12068
- C:\Windows\System\erkOQhw.exe
  C:\Windows\System\erkOQhw.exe
  2⤵
  PID:12096
- C:\Windows\System\ttNeZMX.exe
  C:\Windows\System\ttNeZMX.exe
  2⤵
  PID:12124
- C:\Windows\System\BcjJaho.exe
  C:\Windows\System\BcjJaho.exe
  2⤵
  PID:12152
- C:\Windows\System\RlPFcEV.exe
  C:\Windows\System\RlPFcEV.exe
  2⤵
  PID:12176
- C:\Windows\System\cCSDVcp.exe
  C:\Windows\System\cCSDVcp.exe
  2⤵
  PID:12196
- C:\Windows\System\eFfBBDG.exe
  C:\Windows\System\eFfBBDG.exe
  2⤵
  PID:12236
- C:\Windows\System\TbUCtvI.exe
  C:\Windows\System\TbUCtvI.exe
  2⤵
  PID:12264
- C:\Windows\System\wAmfxlf.exe
  C:\Windows\System\wAmfxlf.exe
  2⤵
  PID:11272
- C:\Windows\System\uXGGlEV.exe
  C:\Windows\System\uXGGlEV.exe
  2⤵
  PID:11336
- C:\Windows\System\VVCBhyS.exe
  C:\Windows\System\VVCBhyS.exe
  2⤵
  PID:11408
- C:\Windows\System\UKavcTl.exe
  C:\Windows\System\UKavcTl.exe
  2⤵
  PID:11468
- C:\Windows\System\siPYAEu.exe
  C:\Windows\System\siPYAEu.exe
  2⤵
  PID:11528
- C:\Windows\System\ebfwmau.exe
  C:\Windows\System\ebfwmau.exe
  2⤵
  PID:11580
- C:\Windows\System\ceiBydY.exe
  C:\Windows\System\ceiBydY.exe
  2⤵
  PID:11616
- C:\Windows\System\NaLxpTk.exe
  C:\Windows\System\NaLxpTk.exe
  2⤵
  PID:11632
- C:\Windows\System\gkbOddy.exe
  C:\Windows\System\gkbOddy.exe
  2⤵
  PID:11700
- C:\Windows\System\oIYcDvD.exe
  C:\Windows\System\oIYcDvD.exe
  2⤵
  PID:11752
- C:\Windows\System\MXRVowO.exe
  C:\Windows\System\MXRVowO.exe
  2⤵
  PID:11824
- C:\Windows\System\xPNDvoo.exe
  C:\Windows\System\xPNDvoo.exe
  2⤵
  PID:11992
- C:\Windows\System\BBRijQv.exe
  C:\Windows\System\BBRijQv.exe
  2⤵
  PID:12024
- C:\Windows\System\reSYUmI.exe
  C:\Windows\System\reSYUmI.exe
  2⤵
  PID:12112
- C:\Windows\System\CPFAEoH.exe
  C:\Windows\System\CPFAEoH.exe
  2⤵
  PID:12144
- C:\Windows\System\QqQIidR.exe
  C:\Windows\System\QqQIidR.exe
  2⤵
  PID:12192
- C:\Windows\System\ielOgxU.exe
  C:\Windows\System\ielOgxU.exe
  2⤵
  PID:12276
- C:\Windows\System\WumGXIf.exe
  C:\Windows\System\WumGXIf.exe
  2⤵
  PID:11380
- C:\Windows\System\cbYjjNw.exe
  C:\Windows\System\cbYjjNw.exe
  2⤵
  PID:11608
- C:\Windows\System\Gpiexze.exe
  C:\Windows\System\Gpiexze.exe
  2⤵
  PID:11728
- C:\Windows\System\UezyUAs.exe
  C:\Windows\System\UezyUAs.exe
  2⤵
  PID:11796
- C:\Windows\System\KnsDnaF.exe
  C:\Windows\System\KnsDnaF.exe
  2⤵
  PID:3708
- C:\Windows\System\kQymAzh.exe
  C:\Windows\System\kQymAzh.exe
  2⤵
  PID:12060
- C:\Windows\System\kUxaWuT.exe
  C:\Windows\System\kUxaWuT.exe
  2⤵
  PID:12160
- C:\Windows\System\vLGYECG.exe
  C:\Windows\System\vLGYECG.exe
  2⤵
  PID:11332
- C:\Windows\System\oVeBMht.exe
  C:\Windows\System\oVeBMht.exe
  2⤵
  PID:11524
- C:\Windows\System\wkZWzOT.exe
  C:\Windows\System\wkZWzOT.exe
  2⤵
  PID:952
- C:\Windows\System\dXmEZwz.exe
  C:\Windows\System\dXmEZwz.exe
  2⤵
  PID:4308
- C:\Windows\System\BqaFMTH.exe
  C:\Windows\System\BqaFMTH.exe
  2⤵
  PID:11744
- C:\Windows\System\JyoqitN.exe
  C:\Windows\System\JyoqitN.exe
  2⤵
  PID:11440
- C:\Windows\System\AkNAlHu.exe
  C:\Windows\System\AkNAlHu.exe
  2⤵
  PID:12320
- C:\Windows\System\tqqToXS.exe
  C:\Windows\System\tqqToXS.exe
  2⤵
  PID:12336
- C:\Windows\System\xeVdEtQ.exe
  C:\Windows\System\xeVdEtQ.exe
  2⤵
  PID:12376
- C:\Windows\System\vuFiAGQ.exe
  C:\Windows\System\vuFiAGQ.exe
  2⤵
  PID:12392
- C:\Windows\System\pddyxrW.exe
  C:\Windows\System\pddyxrW.exe
  2⤵
  PID:12424
- C:\Windows\System\NQPknhZ.exe
  C:\Windows\System\NQPknhZ.exe
  2⤵
  PID:12460
- C:\Windows\System\zaSQZvJ.exe
  C:\Windows\System\zaSQZvJ.exe
  2⤵
  PID:12488
- C:\Windows\System\HTaxYmG.exe
  C:\Windows\System\HTaxYmG.exe
  2⤵
  PID:12516
- C:\Windows\System\WkHjVYe.exe
  C:\Windows\System\WkHjVYe.exe
  2⤵
  PID:12544
- C:\Windows\System\QDzTUqJ.exe
  C:\Windows\System\QDzTUqJ.exe
  2⤵
  PID:12560
- C:\Windows\System\VGADRLl.exe
  C:\Windows\System\VGADRLl.exe
  2⤵
  PID:12600
- C:\Windows\System\rETyOvG.exe
  C:\Windows\System\rETyOvG.exe
  2⤵
  PID:12628
- C:\Windows\System\LunOnOt.exe
  C:\Windows\System\LunOnOt.exe
  2⤵
  PID:12656
- C:\Windows\System\cyfECmL.exe
  C:\Windows\System\cyfECmL.exe
  2⤵
  PID:12684
- C:\Windows\System\XNQipnX.exe
  C:\Windows\System\XNQipnX.exe
  2⤵
  PID:12712
- C:\Windows\System\yCRqXmP.exe
  C:\Windows\System\yCRqXmP.exe
  2⤵
  PID:12740
- C:\Windows\System\TjyGmYp.exe
  C:\Windows\System\TjyGmYp.exe
  2⤵
  PID:12764
- C:\Windows\System\VHmBrxA.exe
  C:\Windows\System\VHmBrxA.exe
  2⤵
  PID:12796
- C:\Windows\System\eNKHisW.exe
  C:\Windows\System\eNKHisW.exe
  2⤵
  PID:12824
- C:\Windows\System\MybHCgl.exe
  C:\Windows\System\MybHCgl.exe
  2⤵
  PID:12852
- C:\Windows\System\hyqePHb.exe
  C:\Windows\System\hyqePHb.exe
  2⤵
  PID:12880
- C:\Windows\System\yAhXitq.exe
  C:\Windows\System\yAhXitq.exe
  2⤵
  PID:12896
- C:\Windows\System\qRdSSUv.exe
  C:\Windows\System\qRdSSUv.exe
  2⤵
  PID:12936
- C:\Windows\System\MIKQddC.exe
  C:\Windows\System\MIKQddC.exe
  2⤵
  PID:12964
- C:\Windows\System\uWTHawW.exe
  C:\Windows\System\uWTHawW.exe
  2⤵
  PID:12992
- C:\Windows\System\LCzThlD.exe
  C:\Windows\System\LCzThlD.exe
  2⤵
  PID:13020
- C:\Windows\System\oQrHYhq.exe
  C:\Windows\System\oQrHYhq.exe
  2⤵
  PID:13048
- C:\Windows\System\IVUTUit.exe
  C:\Windows\System\IVUTUit.exe
  2⤵
  PID:13076
- C:\Windows\System\XLdIJKR.exe
  C:\Windows\System\XLdIJKR.exe
  2⤵
  PID:13104
- C:\Windows\System\bJtIeoC.exe
  C:\Windows\System\bJtIeoC.exe
  2⤵
  PID:13132
- C:\Windows\System\ElPgqAK.exe
  C:\Windows\System\ElPgqAK.exe
  2⤵
  PID:13160
- C:\Windows\System\sfqlLhY.exe
  C:\Windows\System\sfqlLhY.exe
  2⤵
  PID:13188
- C:\Windows\System\eACtYYC.exe
  C:\Windows\System\eACtYYC.exe
  2⤵
  PID:13216
- C:\Windows\System\MojibPG.exe
  C:\Windows\System\MojibPG.exe
  2⤵
  PID:13248
- C:\Windows\System\xrmSdXv.exe
  C:\Windows\System\xrmSdXv.exe
  2⤵
  PID:13276
- C:\Windows\System\szCRVfm.exe
  C:\Windows\System\szCRVfm.exe
  2⤵
  PID:13304
- C:\Windows\System\pkXXPsc.exe
  C:\Windows\System\pkXXPsc.exe
  2⤵
  PID:12316
- C:\Windows\System\YQbYBab.exe
  C:\Windows\System\YQbYBab.exe
  2⤵
  PID:12384
- C:\Windows\System\wFcQcRt.exe
  C:\Windows\System\wFcQcRt.exe
  2⤵
  PID:12452
- C:\Windows\System\jtFbvyh.exe
  C:\Windows\System\jtFbvyh.exe
  2⤵
  PID:12504
- C:\Windows\System\guGnwaC.exe
  C:\Windows\System\guGnwaC.exe
  2⤵
  PID:12588
- C:\Windows\System\XrGLDwv.exe
  C:\Windows\System\XrGLDwv.exe
  2⤵
  PID:12644
- C:\Windows\System\nGRUmUO.exe
  C:\Windows\System\nGRUmUO.exe
  2⤵
  PID:12708
- C:\Windows\System\ljmMFzT.exe
  C:\Windows\System\ljmMFzT.exe
  2⤵
  PID:12780
- C:\Windows\System\lIvnjiJ.exe
  C:\Windows\System\lIvnjiJ.exe
  2⤵
  PID:12840
- C:\Windows\System\wvrhHGw.exe
  C:\Windows\System\wvrhHGw.exe
  2⤵
  PID:12916
- C:\Windows\System\TgLGUzV.exe
  C:\Windows\System\TgLGUzV.exe
  2⤵
  PID:12948
- C:\Windows\System\hLHnHHD.exe
  C:\Windows\System\hLHnHHD.exe
  2⤵
  PID:13036
- C:\Windows\System\FpKNxWW.exe
  C:\Windows\System\FpKNxWW.exe
  2⤵
  PID:13096
- C:\Windows\System\dDqRaxE.exe
  C:\Windows\System\dDqRaxE.exe
  2⤵
  PID:13152
- C:\Windows\System\NMkQRnD.exe
  C:\Windows\System\NMkQRnD.exe
  2⤵
  PID:13200
- C:\Windows\System\YlYlxKJ.exe
  C:\Windows\System\YlYlxKJ.exe
  2⤵
  PID:13264
- C:\Windows\System\oZEYcya.exe
  C:\Windows\System\oZEYcya.exe
  2⤵
  PID:12312
- C:\Windows\System\vInGtYS.exe
  C:\Windows\System\vInGtYS.exe
  2⤵
  PID:12556
- C:\Windows\System\dBnModx.exe
  C:\Windows\System\dBnModx.exe
  2⤵
  PID:12696
- C:\Windows\System\LGIMbDI.exe
  C:\Windows\System\LGIMbDI.exe
  2⤵
  PID:12836
- C:\Windows\System\FnvUPDJ.exe
  C:\Windows\System\FnvUPDJ.exe
  2⤵
  PID:13004
- C:\Windows\System\JSFPxWC.exe
  C:\Windows\System\JSFPxWC.exe
  2⤵
  PID:13176
- C:\Windows\System\dlqfOWe.exe
  C:\Windows\System\dlqfOWe.exe
  2⤵
  PID:12304
- C:\Windows\System\SFDjVtz.exe
  C:\Windows\System\SFDjVtz.exe
  2⤵
  PID:12640
- C:\Windows\System\ICHyKeu.exe
  C:\Windows\System\ICHyKeu.exe
  2⤵
  PID:12928
- C:\Windows\System\QvOIzwU.exe
  C:\Windows\System\QvOIzwU.exe
  2⤵
  PID:2632
- C:\Windows\System\KCFDWoA.exe
  C:\Windows\System\KCFDWoA.exe
  2⤵
  PID:13228
- C:\Windows\System\UUQfMMG.exe
  C:\Windows\System\UUQfMMG.exe
  2⤵
  PID:12820
- C:\Windows\System\UIFcZHf.exe
  C:\Windows\System\UIFcZHf.exe
  2⤵
  PID:3864
- C:\Windows\System\dvUrBMY.exe
  C:\Windows\System\dvUrBMY.exe
  2⤵
  PID:1556
- C:\Windows\System\bBbGeUw.exe
  C:\Windows\System\bBbGeUw.exe
  2⤵
  PID:13332
- C:\Windows\System\UKYvDWp.exe
  C:\Windows\System\UKYvDWp.exe
  2⤵
  PID:13364
- C:\Windows\System\aLQJRZi.exe
  C:\Windows\System\aLQJRZi.exe
  2⤵
  PID:13396
- C:\Windows\System\wLYAYqs.exe
  C:\Windows\System\wLYAYqs.exe
  2⤵
  PID:13424
- C:\Windows\System\UnAZCmy.exe
  C:\Windows\System\UnAZCmy.exe
  2⤵
  PID:13452
- C:\Windows\System\ycmmcCE.exe
  C:\Windows\System\ycmmcCE.exe
  2⤵
  PID:13480
- C:\Windows\System\XPpfFRv.exe
  C:\Windows\System\XPpfFRv.exe
  2⤵
  PID:13496
- C:\Windows\System\emjKbfq.exe
  C:\Windows\System\emjKbfq.exe
  2⤵
  PID:13536
- C:\Windows\System\LFPhqRL.exe
  C:\Windows\System\LFPhqRL.exe
  2⤵
  PID:13564
- C:\Windows\System\MiWnyGZ.exe
  C:\Windows\System\MiWnyGZ.exe
  2⤵
  PID:13592
- C:\Windows\System\Psgbthx.exe
  C:\Windows\System\Psgbthx.exe
  2⤵
  PID:13608
- C:\Windows\System\tRztcUb.exe
  C:\Windows\System\tRztcUb.exe
  2⤵
  PID:13648
- C:\Windows\System\owxcGsF.exe
  C:\Windows\System\owxcGsF.exe
  2⤵
  PID:13676
- C:\Windows\System\dhGVWGr.exe
  C:\Windows\System\dhGVWGr.exe
  2⤵
  PID:13704
- C:\Windows\System\FveIXQa.exe
  C:\Windows\System\FveIXQa.exe
  2⤵
  PID:13732
- C:\Windows\System\ZEXRLvg.exe
  C:\Windows\System\ZEXRLvg.exe
  2⤵
  PID:13760
- C:\Windows\System\HqsnxuE.exe
  C:\Windows\System\HqsnxuE.exe
  2⤵
  PID:13776
- C:\Windows\System\VNwRAff.exe
  C:\Windows\System\VNwRAff.exe
  2⤵
  PID:13804
- C:\Windows\System\yyWoxrT.exe
  C:\Windows\System\yyWoxrT.exe
  2⤵
  PID:13844
- C:\Windows\System\PliLPAj.exe
  C:\Windows\System\PliLPAj.exe
  2⤵
  PID:13864
- C:\Windows\System\fGaxygf.exe
  C:\Windows\System\fGaxygf.exe
  2⤵
  PID:13900
- C:\Windows\System\XWUzcrE.exe
  C:\Windows\System\XWUzcrE.exe
  2⤵
  PID:13928
- C:\Windows\System\VZtLroC.exe
  C:\Windows\System\VZtLroC.exe
  2⤵
  PID:13952
- C:\Windows\System\NLcqyUk.exe
  C:\Windows\System\NLcqyUk.exe
  2⤵
  PID:13972
- C:\Windows\System\hPDmWPv.exe
  C:\Windows\System\hPDmWPv.exe
  2⤵
  PID:14000
- C:\Windows\System\uKONLup.exe
  C:\Windows\System\uKONLup.exe
  2⤵
  PID:14040
- C:\Windows\System\CBSjons.exe
  C:\Windows\System\CBSjons.exe
  2⤵
  PID:14072
- C:\Windows\System\EkEOKYy.exe
  C:\Windows\System\EkEOKYy.exe
  2⤵
  PID:14100
- C:\Windows\System\HqZVYiz.exe
  C:\Windows\System\HqZVYiz.exe
  2⤵
  PID:14128
- C:\Windows\System\PrCatfq.exe
  C:\Windows\System\PrCatfq.exe
  2⤵
  PID:14156
- C:\Windows\System\tKlpgGU.exe
  C:\Windows\System\tKlpgGU.exe
  2⤵
  PID:14184
- C:\Windows\System\PTgBzmJ.exe
  C:\Windows\System\PTgBzmJ.exe
  2⤵
  PID:14212
- C:\Windows\System\SkSNWOm.exe
  C:\Windows\System\SkSNWOm.exe
  2⤵
  PID:14232
- C:\Windows\System\nTkRkLX.exe
  C:\Windows\System\nTkRkLX.exe
  2⤵
  PID:14252
- C:\Windows\System\MtvOBtu.exe
  C:\Windows\System\MtvOBtu.exe
  2⤵
  PID:14268
- C:\Windows\System\DBZwnJk.exe
  C:\Windows\System\DBZwnJk.exe
  2⤵
  PID:14308
- C:\Windows\System\hkSOiAo.exe
  C:\Windows\System\hkSOiAo.exe
  2⤵
  PID:13356
- C:\Windows\System\rOsuiTi.exe
  C:\Windows\System\rOsuiTi.exe
  2⤵
  PID:13416
- C:\Windows\System\OMCtrvX.exe
  C:\Windows\System\OMCtrvX.exe
  2⤵
  PID:13448
- C:\Windows\System\WESebUS.exe
  C:\Windows\System\WESebUS.exe
  2⤵
  PID:13548
- C:\Windows\System\ZbIGsFN.exe
  C:\Windows\System\ZbIGsFN.exe
  2⤵
  PID:13640
- C:\Windows\System\rrZOSND.exe
  C:\Windows\System\rrZOSND.exe
  2⤵
  PID:13700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CMDqvuU.exe

Filesize
2.1MB

MD5
927b90fc131c20af9acb40b9f812fc52

SHA1
740789215285304921a5529bece3e6817dc5d2f2

SHA256
2edc761d53a31960e7ec38d0e8a2a5a4c32eaaa503ac6eba4b56888e9a7bf86b

SHA512
b92c37868a0c3f564bbcd962cad8e05eea0394755ac9eedf6fe519c1a151e47ac2e1007c753638e6891bd5772abf86f44da7bf1edb672ebd647bd79048756f11

Download Submit
C:\Windows\System\CcrheEZ.exe

Filesize
2.1MB

MD5
1e1aa91f30aa8ada1cc0fee6b7a08e61

SHA1
90eff217543634264be64f61e164d2f2c60aa11a

SHA256
80f0d8d763878699b93afeec95e2d2055c1bfc957692cd96e9d87a711c4f5bb2

SHA512
d0d322ee8959e01983bd85e73f91447f48ce57ff8f6fd2999aee05ff302aa5ed83d6a9eff08394c61e93090344774205af3466744d8d1b865b14058c40817e4f

Download Submit
C:\Windows\System\EnRQIGA.exe

Filesize
2.1MB

MD5
69217ceba1eda829f3e8df84a19f3e28

SHA1
ab202ef89c370aef7bb2d869d0e948ccc6e10a84

SHA256
04c37c4152ea8e6089895f8b278dfdf9c5a334b199c49a08586c7f039318cfab

SHA512
9f9311d1ba87b94069e9b0d2cce4fbea4c25e9e5a7c5de72daaf2a0d9a9125cfc21ac820909af28f23efe9ff80980dcbf6e5de292b0c1764c16b424a1219758b

Download Submit
C:\Windows\System\FyxslZZ.exe

Filesize
2.1MB

MD5
5fdceb81d8c715da7abaf12d83cd0c84

SHA1
0025a025755aba1eb1d4f111c8c006d471fe3c84

SHA256
36c0d694b1f95e8adf83872f903ce091b1f40d565dfe544a0363bd1e90a024ea

SHA512
579b7df2cb74303d434616c18261c695d32a779aad52d9605201e094de218f9f6fe902dc27e22e988ecaf0c889612a92314104126282f63fdfc98ffaa8be1db2

Download Submit
C:\Windows\System\JKCkTPv.exe

Filesize
2.1MB

MD5
78ffad5e5d8d5190e373ceb807bb4ee1

SHA1
322144f92ade74845da67d1d5b9b4c9c9c153ac7

SHA256
6de6d4895b9f17853cb68e17b10d5adabcd0e1945ea911234fb695c3c9a8590c

SHA512
34a0e7d776cf41e948ae5478a95b5ff7819680bbe941034d2060b9ef5d14543253e0eb73d5949bc6c13adc9c4db073aa853b9afa728573687ba465ddc0837d39

Download Submit
C:\Windows\System\PAqmzWD.exe

Filesize
2.1MB

MD5
82457d155b497c3b063a6511286c6c12

SHA1
f207a138dd333ff22c244112af901a2f9a2dcffa

SHA256
2a2376f346b2a7c85f763f1b1b061d10d3b09a83483d5e2dd27e914d97584b3e

SHA512
7c5793ab30fb199d3502f71dba80488bb99c9192927233e92f492ed6154412ab52a001c578f9fbcc1fd9a51ebeb8e584b168d22ba3b33b87e94321ff6df2b586

Download Submit
C:\Windows\System\PjAhHod.exe

Filesize
2.1MB

MD5
7a6dcb5393488a502cefa1ebd1353eb2

SHA1
139ba54d763bbfcbabc68b2f313456c77190f9c6

SHA256
d1127b54e877a214ffef1ee916a1854d079c76f0ac887393e66ddaeeb8c46b71

SHA512
55f25385c178d0d70ae1a4fc154cb3f6e8a4eb35d9b3a0bc042aa55d6ef7e8e24cd1b12cc1e53d1f8d69525adfdafc5f8cc5fe711e84a8cabcceeb3814e0e886

Download Submit
C:\Windows\System\SyyqJcX.exe

Filesize
2.1MB

MD5
fa85ca7edb48f5d196445ad2231555d1

SHA1
75e3bced350f961ee84b831747ee6e8720abf167

SHA256
ab598eb90cb2f204686119dab0950cf25b8644497b173e76569b1074c637af0e

SHA512
466390dcb7ffd7fa0862a891aa1c23024e4c14bc8c21ea2799120d9ca60871304347a6f9b76a1741c2e79f09b5acb2c0c0da658277b23130a9835be1d0e961b5

Download Submit
C:\Windows\System\TRrbrbH.exe

Filesize
2.1MB

MD5
bf9dccbef25d90705fbd06e9748cf708

SHA1
9b19314b970b1e914f49f17463dfe5fe7be8adff

SHA256
7740e5da8732dfdc9f73bdb3e572562f56976ef91765b65975bdafa1e1f992ed

SHA512
a3de41a2cf04224398278f383b8a308bf2b5ccfb49059bb42a02adcdfd482926ee3ce052bed4217b6187b4232e26ff17bcf2d6036ae325ab1c70015a4c75c2d7

Download Submit
C:\Windows\System\TnZnHNl.exe

Filesize
2.1MB

MD5
6575f22a02265c1a4fcbd215426a07cb

SHA1
18606b73d8e33895d0b0c0aabc39189ba70c30e1

SHA256
dca0e067faea2882c77c68296c326cd63c515715b8cecc86f77d79d1dba39195

SHA512
f864769027de67ab536bdbc64c687335526621f66f76ef8b4861e33f6278b571fed2faf4e2f4f751603c162501290cd769fbe4d5bcff5b3f1b6166d806f737d4

Download Submit
C:\Windows\System\VfNNrVE.exe

Filesize
2.1MB

MD5
68e104366e1c9e56c55053422cd7fd79

SHA1
99ad7ace8cb32ffc8cb6cd8b1965d887548ffa42

SHA256
a6e6eed6e9b4d6205a79cba15ce79d47b369323a98564876930a1ce87bfce933

SHA512
fba52bdf630f5d96bfab056e0d3e5d4ea7e246f5673edd0e8c00e5be293d43572b59e4b8bfd94a45b10c8551f852572586e55a922aea1a84cf81a8b9c8312780

Download Submit
C:\Windows\System\ZByVUlH.exe

Filesize
2.1MB

MD5
fd3cb2e3923992d81dcaab28ac9808fe

SHA1
34f8b15ea752d0e691e2096eb1638d7bca747eaf

SHA256
7e9aa880cb41535b17990daaa5fd5b7bb750fb6e010c6a339b7eaee7055f91fc

SHA512
3bf82ed5c42aaaf8dc2e543c920933c896bad52c78b0aadaef62b5172c5b2c9998ef6cd88aa7b92114c8bd5d7f5076262e5cbb204f8b789ced38cdb93bc17e45

Download Submit
C:\Windows\System\ZdiAHQm.exe

Filesize
2.1MB

MD5
40242e8e5094f4b07b22aabc5bc336cb

SHA1
0fc9a0c6928576775b9661fe1c99255901889c54

SHA256
1ce75746821e934bf0466d7b1d16e42ab566cc706a6d4499da6a3e18e04917d5

SHA512
b6cc88521600edd821141886382dd4da2e43abf8dead3c5251dd5d3fdafd3a3e77c279c7d5925fa94f8b5fc99bd9d387995e6a673f9f61d2df9cd273a7603f3b

Download Submit
C:\Windows\System\gGjHHtr.exe

Filesize
2.1MB

MD5
4e1e6dcc89b0e2ffcc0eb0bb4ab6981d

SHA1
86b8f575c6dfb99fd7e6f13778e3ce7352c4c75b

SHA256
7cc8f537600607a1b556f94fa9c825481d3bafd1be3d6bcc365881622419e71f

SHA512
eacefd979df7c30ac48e90a9863b5c35d5dbcf15a20aefea7efd3aa80bca2550d2990400d4dfe561058ca01befc7ea84bb7e8e7a90c8456e84ff3fc6cc753d2d

Download Submit
C:\Windows\System\ivycesQ.exe

Filesize
2.1MB

MD5
df8ab7db6dabe8fa49ec72d274771d61

SHA1
13bcd16f092d4acfe5d1587a716d821babe0c8fd

SHA256
2f5058221aa962a62c00b38b594b2065d64cb07b0df0309a3b6c02afe9799d0e

SHA512
782000a038f804cc08ac4ac6508b6157a3681312f6d9bb35c0456208cd66b48f6a5045d80ad2d3a2dbfe57a973e94faa5eb3af43bf789140457ef6803f4bf7bb

Download Submit
C:\Windows\System\jGFqYlP.exe

Filesize
2.1MB

MD5
9a8af31ac8c6604cdfb554edfe08911d

SHA1
afb322afd9d4aa006cc893132ae0eb9c48180586

SHA256
19351b410b4defe735f209a5d0f39d9788610efa9440e46c338cbe5c0fa26c2d

SHA512
6766f644bfbd51e8082baf6fde3978196395192e6aa263564b37f31b0e9baca790c1621b576263ff0276fa2e4213f8899c667dcd2741d1e0000f14e15aafe430

Download Submit
C:\Windows\System\jTULeiy.exe

Filesize
2.1MB

MD5
35528cf0115c14727b0cbe4a4237e29d

SHA1
8cafac1cfeece246a4b93eeed0c00166ef7f8ac3

SHA256
f4135fd97b4a3da250ad55750136ac64db024e8cf4a043f2f56837319ef12649

SHA512
e6678814520ed59def289cb04e9a124e4c484f61ca2708c0656ec404959b54aa5095158a7ca095d2ae87b15cd3ee3ca83c4e489c068720a91b9e16f6acb25837

Download Submit
C:\Windows\System\kvQXRFm.exe

Filesize
2.1MB

MD5
73adbaa02ed6479c522396b494d8628e

SHA1
005d1f5d19326d3ff586533c3de54ead4e4e5518

SHA256
6e319166893f925c28ec1fd8adeb8dcffbded81e5d58f716715ec6dd47fc331d

SHA512
7cc8881fc030bede895f80175fe82b8e4f0d76614845578c1012eb0bdb615b731680ff1c8778613a1f25e5f7537a7c3de46d03e27822bdc5d62c3ca380f90392

Download Submit
C:\Windows\System\kycrDpw.exe

Filesize
2.1MB

MD5
5581da4da02ab82f2ef521544e699c61

SHA1
23ee3f96116275fd33c3fe2306b2fcdf37acbfc0

SHA256
d80e8801d3477316059fe0c6977edb03bb46a5b7142ca9ecf7e9b7d0064fdd96

SHA512
c9ee2f07b29b25a73999be41fca1d95c6cbeea6fd1476259a242eb0adcca765a71d0f5c7fd6539b40b55b0597694e18b3defe3f1221e4a1d9f4762ab95a37c87

Download Submit
C:\Windows\System\lBXYiXU.exe

Filesize
2.1MB

MD5
eaa7fae520688a79b3f231b9323ca4fa

SHA1
a1e62ee8745f6829b01a731e2f33597004d3b3c9

SHA256
f9d1841132a731d282703b981bcae2b77d392fb76453bacb4c1b4cbddf0b9662

SHA512
a21e7055b54f3536ef6150da7c21452a46b8f19442c3c963262ac480cfedfae32722da165d7a7f59210539e46f0f399b92f2038ddbdda52437153d7fe8bd158f

Download Submit
C:\Windows\System\mWYRMfd.exe

Filesize
2.1MB

MD5
8fdd0d9c1449b842f97e3d7124406d4b

SHA1
811226ca6475c944b11590f6750ee43268628886

SHA256
a67107683e6a059e1f1b709d26f16dacfa3796052ffe12c407247a208faf8fdf

SHA512
20776b0d74373c875a157d5fcb0fb2876005c6c17956e91cbf92bb765c059e4321fb156444d25ab0d9916a86beea638a563b7a40056deccc2acefa603d8e53bc

Download Submit
C:\Windows\System\mudDCOh.exe

Filesize
2.1MB

MD5
ca524c2a8ac1226da4052b50ae9b11ef

SHA1
dcc252416bf2d43ab515cf3b237a5322c095c3a5

SHA256
3be58530b048b72bd3fbc37750f8dd235bd28f362fae531906d50b01b97e17af

SHA512
2e3373f10dcf562fa34e16443d677d6a2d20c284fcd1a5a33e8e54457901cd0a2199adfe62b473996ca019978e61a6cb67efa27ef74100c7fa5464153f7930d5

Download Submit
C:\Windows\System\nIfucvh.exe

Filesize
2.1MB

MD5
a2e8b6fdd175f5613855f0478852b086

SHA1
0ab617d088a868cb1cebadebcb3587e4cf806493

SHA256
89668533789300d2a51e11c2d0d4e7b88784126368491de7cd3a6fc8412b26ed

SHA512
32a2d4329890af56cf5784fcf83ff43329601073c2a4c34e74d264faf267b397a2f5df89873aa28a19ca36387d9c23ff2b1bf4c3001f844636078da69d8eae13

Download Submit
C:\Windows\System\ooGnunp.exe

Filesize
2.1MB

MD5
5bad0dd751c0eef8e05222f10297f94d

SHA1
7c5ad858389493273d8e75ebf2166d9536b2484a

SHA256
8a031cff8be23dea094f820bfc2d24bfd28dcc3ec4c8e5e312ffd180b17c5e69

SHA512
dbac850361217ba74bb3651ce458ea07262a93a6fc2fcac55c1e1c88691ed02bc9ea7f237f6ea56c7c0b448e83e6e0cb2d4aab693ac7f5ac08782f2767c5a4f6

Download Submit
C:\Windows\System\pUBBXkX.exe

Filesize
2.1MB

MD5
bc15c590dc17ec47570666d55a164930

SHA1
baddbbf59e747307531e8807bc7ccce5dbcafb53

SHA256
d4d4b1bf4e5d6421716d0b1b0f3fee835cfbfe322e2510a72f0c87f1cca12d2b

SHA512
c5b53d2941d52b2286d11bce6d8619559a65425ee55c21d5fa4c666ed14fefa84fc5993c23b16f12298e387d703fd61c943df5758cf6cf65949f9521d5ce8367

Download Submit
C:\Windows\System\pVNXAGu.exe

Filesize
2.1MB

MD5
316615f5fce3867267360d68b7c29995

SHA1
35fedc5ca01a01f0e5fcec37b53a08996de98fe6

SHA256
15f84ab1575dcf33d4a4c9574b171c88e87739ed2cef1c0fd31a43e16bc47f25

SHA512
fbeaafc60e0e787d5cc86276dc05ec8af83a2e9c593282e6367347186bab77e4a353832b68a70373558f5cbd54a1d65a15ee124fbe5d2e89401308261150c7f7

Download Submit
C:\Windows\System\rDNDmbj.exe

Filesize
2.1MB

MD5
bdf6cc58e81700f97edb02d02ea8f128

SHA1
cf58ea7eecd04fa934907ad6aa372a0821a74b9d

SHA256
9cd7dc6df8db6678227cd7f154eef6aeff9bed2fbe26b6cb52e5810d207e3357

SHA512
cda277462e82f8a6d7eedf8d4f4e6cb14a8dd73bdd734883f3e69b3a8bce8a2a357a1d833e4f3358f01aa5e8cf8c732c35b56c0e7389b63873ee2e098cc26966

Download Submit
C:\Windows\System\sHMkrUa.exe

Filesize
2.1MB

MD5
89cd889c17c245d584070318e7a6f628

SHA1
45db2a02320e78d79361c80c139fff3adae97d81

SHA256
a492e672b7b20a76928b969dabc7eddde0f58915c2184761c63e0a4f566edae0

SHA512
0364906b5ed2ba271c762c9d1196e28e52f3510b65ff34cebddb4ea1533d90c4350ae59bdd53eb858e2b96c5775795abbb03636cc33bb77f99562199dab18cd4

Download Submit
C:\Windows\System\swBePuN.exe

Filesize
2.1MB

MD5
41891f76631010dded8f669966f2111b

SHA1
ff1876b7aec8ed5e276a41eda1d95a548b63788f

SHA256
cafb5ae67c4ede8c98262954d3c091a8e9610728f1cbea5e96e28dcfbf148347

SHA512
a51ef4b4b03d21e423f8ab2a3b32a4dfaf9f4d56057858c8feba96b88a3b871b785349a436c53fd783edfb79435962a56dcfbcb75a2f5cd36fff33a3fc162d04

Download Submit
C:\Windows\System\uDnjiSy.exe

Filesize
2.1MB

MD5
ca66b528f9dfbdfe4aab263bf4b4afc3

SHA1
88cee9ec1640d8280b05fcc00d116849201e4a33

SHA256
fac81b025b75035cb339fd97968f5b76917f36fd1040523f12e0ca4df5fecd2b

SHA512
20703c8bcf34b1df83cae76164879c2191335d668f2feeb21bdeeeac1b2197b85d314f9f716018c67f80f802afe955727e558f7a247716c0419e7959d3fa802f

Download Submit
C:\Windows\System\wkfNQHe.exe

Filesize
2.1MB

MD5
861dc07c8fc4bf8aba249f5bd28c631b

SHA1
bc3af4dadea5966d7a3750286b7fff6833eeec19

SHA256
d4388fed513fad9dd010db01f740db0645eed0078b926664c46bf717f1f5d0e5

SHA512
8a32a11423e2e3d73e7b4cfdece6bd17c3629bdbe7c119f59f005c5385dea30b59c613f8ef2d6697c5642b36ab95a840267e51d621d7ba6803df4608d0a31945

Download Submit
C:\Windows\System\wpqATau.exe

Filesize
2.1MB

MD5
6c394c78e78ee018017c9ea86cc28baf

SHA1
64a80d8991093e2512f2ca31e7e08ddeabee5fd1

SHA256
d2ae9c3b05121d32fea6e4e19a3035f2733f109ec668cfa1431afd3671ba104f

SHA512
3c86634d05da888b42c861c617515b037f32313a625fe10062096862c650f7a76fb98ae9d27089af98a8a4914906f81b2c8de062d2d3c2e83f05f2c2cbd4378b

Download Submit
C:\Windows\System\yNuOyFq.exe

Filesize
2.1MB

MD5
04bf845a1735f1db9f1e8245ec8027ee

SHA1
a390e57f54afa99d7a66ac7478d796c73b19e0cc

SHA256
5fe6ccb64d3fd2ccbfe889e137cbf3d2dcb327b94d465c324ff87f3b0bc67b0e

SHA512
d0ba746075cd629543c2c7f072a6143bdfe0ef37a8e4f7069fc88e9593bbab811722567cd08a249a6cfe7f99e8fbc1357a4fe32ee23203ec45d3c526a6809992

Download Submit
memory/392-2148-0x00007FF76AB40000-0x00007FF76AE94000-memory.dmp

Filesize
3.3MB

Download
memory/392-606-0x00007FF76AB40000-0x00007FF76AE94000-memory.dmp

Filesize
3.3MB

Download
memory/912-2156-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp

Filesize
3.3MB

Download
memory/912-612-0x00007FF73B1A0000-0x00007FF73B4F4000-memory.dmp

Filesize
3.3MB

Download
memory/1092-564-0x00007FF7A3F70000-0x00007FF7A42C4000-memory.dmp

Filesize
3.3MB

Download
memory/1092-2146-0x00007FF7A3F70000-0x00007FF7A42C4000-memory.dmp

Filesize
3.3MB

Download
memory/1344-520-0x00007FF76EA70000-0x00007FF76EDC4000-memory.dmp

Filesize
3.3MB

Download
memory/1344-2136-0x00007FF76EA70000-0x00007FF76EDC4000-memory.dmp

Filesize
3.3MB

Download
memory/1416-600-0x00007FF6FCAA0000-0x00007FF6FCDF4000-memory.dmp

Filesize
3.3MB

Download
memory/1416-2147-0x00007FF6FCAA0000-0x00007FF6FCDF4000-memory.dmp

Filesize
3.3MB

Download
memory/1680-577-0x00007FF677E40000-0x00007FF678194000-memory.dmp

Filesize
3.3MB

Download
memory/1680-2152-0x00007FF677E40000-0x00007FF678194000-memory.dmp

Filesize
3.3MB

Download
memory/1904-532-0x00007FF7D3B70000-0x00007FF7D3EC4000-memory.dmp

Filesize
3.3MB

Download
memory/1904-2143-0x00007FF7D3B70000-0x00007FF7D3EC4000-memory.dmp

Filesize
3.3MB

Download
memory/1916-524-0x00007FF784000000-0x00007FF784354000-memory.dmp

Filesize
3.3MB

Download
memory/1916-2141-0x00007FF784000000-0x00007FF784354000-memory.dmp

Filesize
3.3MB

Download
memory/1920-2128-0x00007FF735060000-0x00007FF7353B4000-memory.dmp

Filesize
3.3MB

Download
memory/1920-2138-0x00007FF735060000-0x00007FF7353B4000-memory.dmp

Filesize
3.3MB

Download
memory/1920-47-0x00007FF735060000-0x00007FF7353B4000-memory.dmp

Filesize
3.3MB

Download
memory/1924-2132-0x00007FF7A6EC0000-0x00007FF7A7214000-memory.dmp

Filesize
3.3MB

Download
memory/1924-2126-0x00007FF7A6EC0000-0x00007FF7A7214000-memory.dmp

Filesize
3.3MB

Download
memory/1924-25-0x00007FF7A6EC0000-0x00007FF7A7214000-memory.dmp

Filesize
3.3MB

Download
memory/1992-539-0x00007FF704400000-0x00007FF704754000-memory.dmp

Filesize
3.3MB

Download
memory/1992-2144-0x00007FF704400000-0x00007FF704754000-memory.dmp

Filesize
3.3MB

Download
memory/2112-40-0x00007FF633450000-0x00007FF6337A4000-memory.dmp

Filesize
3.3MB

Download
memory/2112-2133-0x00007FF633450000-0x00007FF6337A4000-memory.dmp

Filesize
3.3MB

Download
memory/2196-2051-0x00007FF6012C0000-0x00007FF601614000-memory.dmp

Filesize
3.3MB

Download
memory/2196-12-0x00007FF6012C0000-0x00007FF601614000-memory.dmp

Filesize
3.3MB

Download
memory/2196-2130-0x00007FF6012C0000-0x00007FF601614000-memory.dmp

Filesize
3.3MB

Download
memory/2464-576-0x00007FF62DA60000-0x00007FF62DDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2464-2153-0x00007FF62DA60000-0x00007FF62DDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2552-2137-0x00007FF6D4130000-0x00007FF6D4484000-memory.dmp

Filesize
3.3MB

Download
memory/2552-614-0x00007FF6D4130000-0x00007FF6D4484000-memory.dmp

Filesize
3.3MB

Download
memory/2668-2155-0x00007FF74AA70000-0x00007FF74ADC4000-memory.dmp

Filesize
3.3MB

Download
memory/2668-573-0x00007FF74AA70000-0x00007FF74ADC4000-memory.dmp

Filesize
3.3MB

Download
memory/3212-2140-0x00007FF7937A0000-0x00007FF793AF4000-memory.dmp

Filesize
3.3MB

Download
memory/3212-535-0x00007FF7937A0000-0x00007FF793AF4000-memory.dmp

Filesize
3.3MB

Download
memory/3252-548-0x00007FF6A7D20000-0x00007FF6A8074000-memory.dmp

Filesize
3.3MB

Download
memory/3252-2157-0x00007FF6A7D20000-0x00007FF6A8074000-memory.dmp

Filesize
3.3MB

Download
memory/3304-603-0x00007FF68F1F0000-0x00007FF68F544000-memory.dmp

Filesize
3.3MB

Download
memory/3304-2149-0x00007FF68F1F0000-0x00007FF68F544000-memory.dmp

Filesize
3.3MB

Download
memory/3364-2158-0x00007FF6DF280000-0x00007FF6DF5D4000-memory.dmp

Filesize
3.3MB

Download
memory/3364-580-0x00007FF6DF280000-0x00007FF6DF5D4000-memory.dmp

Filesize
3.3MB

Download
memory/3552-555-0x00007FF6AD6A0000-0x00007FF6AD9F4000-memory.dmp

Filesize
3.3MB

Download
memory/3552-2145-0x00007FF6AD6A0000-0x00007FF6AD9F4000-memory.dmp

Filesize
3.3MB

Download
memory/3612-2139-0x00007FF77DE10000-0x00007FF77E164000-memory.dmp

Filesize
3.3MB

Download
memory/3612-2129-0x00007FF77DE10000-0x00007FF77E164000-memory.dmp

Filesize
3.3MB

Download
memory/3612-386-0x00007FF77DE10000-0x00007FF77E164000-memory.dmp

Filesize
3.3MB

Download
memory/3912-2134-0x00007FF6583A0000-0x00007FF6586F4000-memory.dmp

Filesize
3.3MB

Download
memory/3912-41-0x00007FF6583A0000-0x00007FF6586F4000-memory.dmp

Filesize
3.3MB

Download
memory/3940-589-0x00007FF724310000-0x00007FF724664000-memory.dmp

Filesize
3.3MB

Download
memory/3940-2150-0x00007FF724310000-0x00007FF724664000-memory.dmp

Filesize
3.3MB

Download
memory/4192-2142-0x00007FF7CEFD0000-0x00007FF7CF324000-memory.dmp

Filesize
3.3MB

Download
memory/4192-529-0x00007FF7CEFD0000-0x00007FF7CF324000-memory.dmp

Filesize
3.3MB

Download
memory/4236-2048-0x00007FF6002F0000-0x00007FF600644000-memory.dmp

Filesize
3.3MB

Download
memory/4236-2131-0x00007FF6002F0000-0x00007FF600644000-memory.dmp

Filesize
3.3MB

Download
memory/4236-6-0x00007FF6002F0000-0x00007FF600644000-memory.dmp

Filesize
3.3MB

Download
memory/4280-568-0x00007FF6F2270000-0x00007FF6F25C4000-memory.dmp

Filesize
3.3MB

Download
memory/4280-2154-0x00007FF6F2270000-0x00007FF6F25C4000-memory.dmp

Filesize
3.3MB

Download
memory/4488-2127-0x00007FF7DBDF0000-0x00007FF7DC144000-memory.dmp

Filesize
3.3MB

Download
memory/4488-2135-0x00007FF7DBDF0000-0x00007FF7DC144000-memory.dmp

Filesize
3.3MB

Download
memory/4488-32-0x00007FF7DBDF0000-0x00007FF7DC144000-memory.dmp

Filesize
3.3MB

Download
memory/5016-0-0x00007FF7B8160000-0x00007FF7B84B4000-memory.dmp

Filesize
3.3MB

Download
memory/5016-1-0x00000217D3A60000-0x00000217D3A70000-memory.dmp

Filesize
64KB

Download
memory/5016-1680-0x00007FF7B8160000-0x00007FF7B84B4000-memory.dmp

Filesize
3.3MB

Download
memory/5104-2151-0x00007FF6EFC40000-0x00007FF6EFF94000-memory.dmp

Filesize
3.3MB

Download
memory/5104-584-0x00007FF6EFC40000-0x00007FF6EFF94000-memory.dmp

Filesize
3.3MB

Download