xmrig | 4869ca5fc365ba0966438016003aa813151410a42ac7af8efbd950e921d0e718

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
Size

2.0MB
MD5

344782c66d5e3cf967c0e66d3e23aff0
SHA1

899b156f433970311f204b75ab3b0ac0863e05e0
SHA256

4869ca5fc365ba0966438016003aa813151410a42ac7af8efbd950e921d0e718
SHA512

9df63829c0718336099037ed8f26a4c7b77447fedbd8bca2ef1f9ae595f36ffdb3c5678f86d3d5365c5566cb99f8619ad2bb91712b1567b67c339efcf0f6004b
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbSL3dh5HELHhQ8zm:BemTLkNdfE0pZrr

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3076-0-0x00007FF739F80000-0x00007FF73A2D4000-memory.dmp	xmrig
behavioral2/files/0x0008000000022f51-5.dat	xmrig
behavioral2/files/0x000800000002340f-9.dat	xmrig
behavioral2/memory/4752-13-0x00007FF6A4BA0000-0x00007FF6A4EF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023410-24.dat	xmrig
behavioral2/files/0x0007000000023411-31.dat	xmrig
behavioral2/files/0x0007000000023415-45.dat	xmrig
behavioral2/files/0x000700000002341d-91.dat	xmrig
behavioral2/files/0x0007000000023420-106.dat	xmrig
behavioral2/files/0x0007000000023427-141.dat	xmrig
behavioral2/files/0x000700000002342a-156.dat	xmrig
behavioral2/memory/528-599-0x00007FF74CD80000-0x00007FF74D0D4000-memory.dmp	xmrig
behavioral2/memory/2344-604-0x00007FF6476E0000-0x00007FF647A34000-memory.dmp	xmrig
behavioral2/memory/1220-607-0x00007FF75BB00000-0x00007FF75BE54000-memory.dmp	xmrig
behavioral2/memory/3008-611-0x00007FF6C39C0000-0x00007FF6C3D14000-memory.dmp	xmrig
behavioral2/memory/1064-630-0x00007FF762860000-0x00007FF762BB4000-memory.dmp	xmrig
behavioral2/memory/4896-635-0x00007FF67C200000-0x00007FF67C554000-memory.dmp	xmrig
behavioral2/memory/1528-647-0x00007FF7007A0000-0x00007FF700AF4000-memory.dmp	xmrig
behavioral2/memory/2020-665-0x00007FF633350000-0x00007FF6336A4000-memory.dmp	xmrig
behavioral2/memory/2884-663-0x00007FF769170000-0x00007FF7694C4000-memory.dmp	xmrig
behavioral2/memory/3240-654-0x00007FF74D7C0000-0x00007FF74DB14000-memory.dmp	xmrig
behavioral2/memory/4608-640-0x00007FF6B68B0000-0x00007FF6B6C04000-memory.dmp	xmrig
behavioral2/memory/2056-625-0x00007FF769B00000-0x00007FF769E54000-memory.dmp	xmrig
behavioral2/memory/2772-621-0x00007FF7D26A0000-0x00007FF7D29F4000-memory.dmp	xmrig
behavioral2/memory/5004-618-0x00007FF69A8F0000-0x00007FF69AC44000-memory.dmp	xmrig
behavioral2/memory/4872-680-0x00007FF635A20000-0x00007FF635D74000-memory.dmp	xmrig
behavioral2/memory/4956-683-0x00007FF6699D0000-0x00007FF669D24000-memory.dmp	xmrig
behavioral2/memory/5076-691-0x00007FF7E9A10000-0x00007FF7E9D64000-memory.dmp	xmrig
behavioral2/memory/2004-688-0x00007FF797970000-0x00007FF797CC4000-memory.dmp	xmrig
behavioral2/memory/3352-685-0x00007FF7386B0000-0x00007FF738A04000-memory.dmp	xmrig
behavioral2/memory/1732-696-0x00007FF688990000-0x00007FF688CE4000-memory.dmp	xmrig
behavioral2/memory/1188-701-0x00007FF78F2A0000-0x00007FF78F5F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-165.dat	xmrig
behavioral2/files/0x000700000002342b-161.dat	xmrig
behavioral2/files/0x000700000002342c-160.dat	xmrig
behavioral2/files/0x0007000000023429-148.dat	xmrig
behavioral2/files/0x0007000000023428-145.dat	xmrig
behavioral2/files/0x0007000000023426-135.dat	xmrig
behavioral2/files/0x0007000000023425-131.dat	xmrig
behavioral2/files/0x0007000000023424-126.dat	xmrig
behavioral2/files/0x0007000000023423-121.dat	xmrig
behavioral2/files/0x0007000000023422-116.dat	xmrig
behavioral2/files/0x0007000000023421-111.dat	xmrig
behavioral2/files/0x000700000002341f-100.dat	xmrig
behavioral2/files/0x000700000002341e-96.dat	xmrig
behavioral2/files/0x000700000002341c-86.dat	xmrig
behavioral2/files/0x000700000002341b-81.dat	xmrig
behavioral2/files/0x000700000002341a-76.dat	xmrig
behavioral2/files/0x0007000000023419-71.dat	xmrig
behavioral2/files/0x0007000000023418-66.dat	xmrig
behavioral2/files/0x0007000000023417-60.dat	xmrig
behavioral2/files/0x0007000000023416-56.dat	xmrig
behavioral2/files/0x0007000000023414-46.dat	xmrig
behavioral2/files/0x0007000000023413-41.dat	xmrig
behavioral2/files/0x0007000000023412-36.dat	xmrig
behavioral2/memory/4620-708-0x00007FF74DFA0000-0x00007FF74E2F4000-memory.dmp	xmrig
behavioral2/memory/4976-711-0x00007FF666E80000-0x00007FF6671D4000-memory.dmp	xmrig
behavioral2/memory/4900-717-0x00007FF6674A0000-0x00007FF6677F4000-memory.dmp	xmrig
behavioral2/memory/1152-725-0x00007FF72E720000-0x00007FF72EA74000-memory.dmp	xmrig
behavioral2/memory/4600-724-0x00007FF78F570000-0x00007FF78F8C4000-memory.dmp	xmrig
behavioral2/memory/4460-705-0x00007FF7A2BA0000-0x00007FF7A2EF4000-memory.dmp	xmrig
behavioral2/memory/1844-14-0x00007FF65BC20000-0x00007FF65BF74000-memory.dmp	xmrig
behavioral2/files/0x000800000002340c-11.dat	xmrig
behavioral2/memory/3076-2142-0x00007FF739F80000-0x00007FF73A2D4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4752	sdYddlN.exe
1844	FfEmVgu.exe
528	vuBLOJw.exe
2344	eEThgEk.exe
1220	sYEuOEj.exe
3008	NwfOYAj.exe
5004	niXhyGb.exe
2772	LjkhfYs.exe
2056	JMAMZpr.exe
1064	wqRZVZD.exe
4896	fBoeJyZ.exe
4608	LuTvinv.exe
1528	sapNHPH.exe
3240	wKFJjHy.exe
2884	tuFChLv.exe
2020	iZzCJUn.exe
4872	RdcXoue.exe
4956	vsTntUx.exe
3352	aKvEwYd.exe
2004	OLkHSUy.exe
5076	hPGqfRW.exe
1732	kUoOQTP.exe
1188	DlJJzqA.exe
4460	JzGPRDg.exe
4620	iQZSFfw.exe
4976	HYlhsJv.exe
4900	mmHTfLN.exe
4600	QLocHoU.exe
1152	VMgKwIY.exe
3420	IWGvlHm.exe
4908	BmfmITj.exe
1032	UCofayl.exe
3316	STiUWCy.exe
4952	xDVGqfn.exe
872	XwxWads.exe
1192	BPQcyqW.exe
388	qSvaZOt.exe
4664	VkWXGUG.exe
1996	WWdGXqS.exe
2696	kCsSNYj.exe
2080	WoqPXGa.exe
908	wrBVPlD.exe
4540	BkhhXVr.exe
920	iUnJWzC.exe
4084	CPYCTAl.exe
2380	oBkgGlf.exe
1176	RKFRRuC.exe
3188	uuMMddV.exe
3300	KewvLzO.exe
2236	pEgwgxT.exe
3544	ZdAJDYr.exe
3236	ykBUsCg.exe
3792	VnYYEuo.exe
640	IONDpwS.exe
3176	qSKtoKW.exe
4172	VehRwmQ.exe
4372	pKEqMde.exe
4376	IaPeTQe.exe
3580	FuHfSNK.exe
1300	uHFcRQK.exe
796	yRTvZUY.exe
1240	oljcbAw.exe
4456	RcalLuC.exe
3572	SdtPTzA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3076-0-0x00007FF739F80000-0x00007FF73A2D4000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/files/0x000800000002340f-9.dat	upx
behavioral2/memory/4752-13-0x00007FF6A4BA0000-0x00007FF6A4EF4000-memory.dmp	upx
behavioral2/files/0x0007000000023410-24.dat	upx
behavioral2/files/0x0007000000023411-31.dat	upx
behavioral2/files/0x0007000000023415-45.dat	upx
behavioral2/files/0x000700000002341d-91.dat	upx
behavioral2/files/0x0007000000023420-106.dat	upx
behavioral2/files/0x0007000000023427-141.dat	upx
behavioral2/files/0x000700000002342a-156.dat	upx
behavioral2/memory/528-599-0x00007FF74CD80000-0x00007FF74D0D4000-memory.dmp	upx
behavioral2/memory/2344-604-0x00007FF6476E0000-0x00007FF647A34000-memory.dmp	upx
behavioral2/memory/1220-607-0x00007FF75BB00000-0x00007FF75BE54000-memory.dmp	upx
behavioral2/memory/3008-611-0x00007FF6C39C0000-0x00007FF6C3D14000-memory.dmp	upx
behavioral2/memory/1064-630-0x00007FF762860000-0x00007FF762BB4000-memory.dmp	upx
behavioral2/memory/4896-635-0x00007FF67C200000-0x00007FF67C554000-memory.dmp	upx
behavioral2/memory/1528-647-0x00007FF7007A0000-0x00007FF700AF4000-memory.dmp	upx
behavioral2/memory/2020-665-0x00007FF633350000-0x00007FF6336A4000-memory.dmp	upx
behavioral2/memory/2884-663-0x00007FF769170000-0x00007FF7694C4000-memory.dmp	upx
behavioral2/memory/3240-654-0x00007FF74D7C0000-0x00007FF74DB14000-memory.dmp	upx
behavioral2/memory/4608-640-0x00007FF6B68B0000-0x00007FF6B6C04000-memory.dmp	upx
behavioral2/memory/2056-625-0x00007FF769B00000-0x00007FF769E54000-memory.dmp	upx
behavioral2/memory/2772-621-0x00007FF7D26A0000-0x00007FF7D29F4000-memory.dmp	upx
behavioral2/memory/5004-618-0x00007FF69A8F0000-0x00007FF69AC44000-memory.dmp	upx
behavioral2/memory/4872-680-0x00007FF635A20000-0x00007FF635D74000-memory.dmp	upx
behavioral2/memory/4956-683-0x00007FF6699D0000-0x00007FF669D24000-memory.dmp	upx
behavioral2/memory/5076-691-0x00007FF7E9A10000-0x00007FF7E9D64000-memory.dmp	upx
behavioral2/memory/2004-688-0x00007FF797970000-0x00007FF797CC4000-memory.dmp	upx
behavioral2/memory/3352-685-0x00007FF7386B0000-0x00007FF738A04000-memory.dmp	upx
behavioral2/memory/1732-696-0x00007FF688990000-0x00007FF688CE4000-memory.dmp	upx
behavioral2/memory/1188-701-0x00007FF78F2A0000-0x00007FF78F5F4000-memory.dmp	upx
behavioral2/files/0x000700000002342d-165.dat	upx
behavioral2/files/0x000700000002342b-161.dat	upx
behavioral2/files/0x000700000002342c-160.dat	upx
behavioral2/files/0x0007000000023429-148.dat	upx
behavioral2/files/0x0007000000023428-145.dat	upx
behavioral2/files/0x0007000000023426-135.dat	upx
behavioral2/files/0x0007000000023425-131.dat	upx
behavioral2/files/0x0007000000023424-126.dat	upx
behavioral2/files/0x0007000000023423-121.dat	upx
behavioral2/files/0x0007000000023422-116.dat	upx
behavioral2/files/0x0007000000023421-111.dat	upx
behavioral2/files/0x000700000002341f-100.dat	upx
behavioral2/files/0x000700000002341e-96.dat	upx
behavioral2/files/0x000700000002341c-86.dat	upx
behavioral2/files/0x000700000002341b-81.dat	upx
behavioral2/files/0x000700000002341a-76.dat	upx
behavioral2/files/0x0007000000023419-71.dat	upx
behavioral2/files/0x0007000000023418-66.dat	upx
behavioral2/files/0x0007000000023417-60.dat	upx
behavioral2/files/0x0007000000023416-56.dat	upx
behavioral2/files/0x0007000000023414-46.dat	upx
behavioral2/files/0x0007000000023413-41.dat	upx
behavioral2/files/0x0007000000023412-36.dat	upx
behavioral2/memory/4620-708-0x00007FF74DFA0000-0x00007FF74E2F4000-memory.dmp	upx
behavioral2/memory/4976-711-0x00007FF666E80000-0x00007FF6671D4000-memory.dmp	upx
behavioral2/memory/4900-717-0x00007FF6674A0000-0x00007FF6677F4000-memory.dmp	upx
behavioral2/memory/1152-725-0x00007FF72E720000-0x00007FF72EA74000-memory.dmp	upx
behavioral2/memory/4600-724-0x00007FF78F570000-0x00007FF78F8C4000-memory.dmp	upx
behavioral2/memory/4460-705-0x00007FF7A2BA0000-0x00007FF7A2EF4000-memory.dmp	upx
behavioral2/memory/1844-14-0x00007FF65BC20000-0x00007FF65BF74000-memory.dmp	upx
behavioral2/files/0x000800000002340c-11.dat	upx
behavioral2/memory/3076-2142-0x00007FF739F80000-0x00007FF73A2D4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xaZyJOr.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\SZygqsf.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\oGSOcpP.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\yRTvZUY.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\pGvLJXa.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\iFdlVMH.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\GNVQyda.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\IcyrdBt.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\nKSVpDY.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\OptooNv.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\MlTbXaj.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\RcalLuC.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\FFUkypU.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\LDvYygQ.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\ViiHxwf.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\uBZtCYI.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\vvPCikE.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\fgFSyXX.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\NaNKabV.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\IWclzKl.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\QDfduAU.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\LuTvinv.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\pEgwgxT.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\FcdqiOl.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\gPCorvg.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\ZFYzhXR.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\lCvlGgh.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\QbReYEX.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\UAAhGSd.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\GxZfDgu.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\MnaFwLs.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\nDFqNOQ.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\bmFedLJ.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\fBoeJyZ.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\QLocHoU.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\BkhhXVr.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\OsTCMnw.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\vcCeNcI.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\UflZOzI.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\tgCJSNu.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\ltWrRaQ.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\jemsVcu.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\AzGYfnj.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\PyxDTUc.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\BbncLhA.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\JSNqTRi.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\DhcQyTn.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\FaIXymR.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\VDcngdM.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\FfEmVgu.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\iQZSFfw.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\uoVoExA.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\mhaBlvQ.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\JQlIdMM.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\pKxQHvy.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\EiRtZrK.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\VTOAWom.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\JQmVDYw.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\CHHNGRN.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\VdgYCOK.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\BmfmITj.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\QRkhItZ.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\YWNcFQJ.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
File created	C:\Windows\System\DLUVaVG.exe	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4752	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	80
PID 3076 wrote to memory of 4752	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	80
PID 3076 wrote to memory of 1844	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	81
PID 3076 wrote to memory of 1844	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	81
PID 3076 wrote to memory of 528	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	82
PID 3076 wrote to memory of 528	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	82
PID 3076 wrote to memory of 2344	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	83
PID 3076 wrote to memory of 2344	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	83
PID 3076 wrote to memory of 1220	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	84
PID 3076 wrote to memory of 1220	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	84
PID 3076 wrote to memory of 3008	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	85
PID 3076 wrote to memory of 3008	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	85
PID 3076 wrote to memory of 5004	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	86
PID 3076 wrote to memory of 5004	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	86
PID 3076 wrote to memory of 2772	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	87
PID 3076 wrote to memory of 2772	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	87
PID 3076 wrote to memory of 2056	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	88
PID 3076 wrote to memory of 2056	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	88
PID 3076 wrote to memory of 1064	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	89
PID 3076 wrote to memory of 1064	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	89
PID 3076 wrote to memory of 4896	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	90
PID 3076 wrote to memory of 4896	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	90
PID 3076 wrote to memory of 4608	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	91
PID 3076 wrote to memory of 4608	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	91
PID 3076 wrote to memory of 1528	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	92
PID 3076 wrote to memory of 1528	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	92
PID 3076 wrote to memory of 3240	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	93
PID 3076 wrote to memory of 3240	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	93
PID 3076 wrote to memory of 2884	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	94
PID 3076 wrote to memory of 2884	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	94
PID 3076 wrote to memory of 2020	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	95
PID 3076 wrote to memory of 2020	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	95
PID 3076 wrote to memory of 4872	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	96
PID 3076 wrote to memory of 4872	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	96
PID 3076 wrote to memory of 4956	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	97
PID 3076 wrote to memory of 4956	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	97
PID 3076 wrote to memory of 3352	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	98
PID 3076 wrote to memory of 3352	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	98
PID 3076 wrote to memory of 2004	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	99
PID 3076 wrote to memory of 2004	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	99
PID 3076 wrote to memory of 5076	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	100
PID 3076 wrote to memory of 5076	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	100
PID 3076 wrote to memory of 1732	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	101
PID 3076 wrote to memory of 1732	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	101
PID 3076 wrote to memory of 1188	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	102
PID 3076 wrote to memory of 1188	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	102
PID 3076 wrote to memory of 4460	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	103
PID 3076 wrote to memory of 4460	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	103
PID 3076 wrote to memory of 4620	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	104
PID 3076 wrote to memory of 4620	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	104
PID 3076 wrote to memory of 4976	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	105
PID 3076 wrote to memory of 4976	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	105
PID 3076 wrote to memory of 4900	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	106
PID 3076 wrote to memory of 4900	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	106
PID 3076 wrote to memory of 4600	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	107
PID 3076 wrote to memory of 4600	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	107
PID 3076 wrote to memory of 1152	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	108
PID 3076 wrote to memory of 1152	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	108
PID 3076 wrote to memory of 3420	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	109
PID 3076 wrote to memory of 3420	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	109
PID 3076 wrote to memory of 4908	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	110
PID 3076 wrote to memory of 4908	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	110
PID 3076 wrote to memory of 1032	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	111
PID 3076 wrote to memory of 1032	3076	344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe	111

C:\Users\Admin\AppData\Local\Temp\344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\344782c66d5e3cf967c0e66d3e23aff0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\System\sdYddlN.exe
  C:\Windows\System\sdYddlN.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\FfEmVgu.exe
  C:\Windows\System\FfEmVgu.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\vuBLOJw.exe
  C:\Windows\System\vuBLOJw.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\eEThgEk.exe
  C:\Windows\System\eEThgEk.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\sYEuOEj.exe
  C:\Windows\System\sYEuOEj.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\NwfOYAj.exe
  C:\Windows\System\NwfOYAj.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\niXhyGb.exe
  C:\Windows\System\niXhyGb.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\LjkhfYs.exe
  C:\Windows\System\LjkhfYs.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\JMAMZpr.exe
  C:\Windows\System\JMAMZpr.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\wqRZVZD.exe
  C:\Windows\System\wqRZVZD.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\fBoeJyZ.exe
  C:\Windows\System\fBoeJyZ.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\LuTvinv.exe
  C:\Windows\System\LuTvinv.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\sapNHPH.exe
  C:\Windows\System\sapNHPH.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\wKFJjHy.exe
  C:\Windows\System\wKFJjHy.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\tuFChLv.exe
  C:\Windows\System\tuFChLv.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\iZzCJUn.exe
  C:\Windows\System\iZzCJUn.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\RdcXoue.exe
  C:\Windows\System\RdcXoue.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\vsTntUx.exe
  C:\Windows\System\vsTntUx.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\aKvEwYd.exe
  C:\Windows\System\aKvEwYd.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\OLkHSUy.exe
  C:\Windows\System\OLkHSUy.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\hPGqfRW.exe
  C:\Windows\System\hPGqfRW.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\kUoOQTP.exe
  C:\Windows\System\kUoOQTP.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\DlJJzqA.exe
  C:\Windows\System\DlJJzqA.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\JzGPRDg.exe
  C:\Windows\System\JzGPRDg.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\iQZSFfw.exe
  C:\Windows\System\iQZSFfw.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\HYlhsJv.exe
  C:\Windows\System\HYlhsJv.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\mmHTfLN.exe
  C:\Windows\System\mmHTfLN.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\QLocHoU.exe
  C:\Windows\System\QLocHoU.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\VMgKwIY.exe
  C:\Windows\System\VMgKwIY.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\IWGvlHm.exe
  C:\Windows\System\IWGvlHm.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\BmfmITj.exe
  C:\Windows\System\BmfmITj.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\UCofayl.exe
  C:\Windows\System\UCofayl.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\STiUWCy.exe
  C:\Windows\System\STiUWCy.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\xDVGqfn.exe
  C:\Windows\System\xDVGqfn.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\XwxWads.exe
  C:\Windows\System\XwxWads.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\BPQcyqW.exe
  C:\Windows\System\BPQcyqW.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\qSvaZOt.exe
  C:\Windows\System\qSvaZOt.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\VkWXGUG.exe
  C:\Windows\System\VkWXGUG.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\WWdGXqS.exe
  C:\Windows\System\WWdGXqS.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\kCsSNYj.exe
  C:\Windows\System\kCsSNYj.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\WoqPXGa.exe
  C:\Windows\System\WoqPXGa.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\wrBVPlD.exe
  C:\Windows\System\wrBVPlD.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\BkhhXVr.exe
  C:\Windows\System\BkhhXVr.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\iUnJWzC.exe
  C:\Windows\System\iUnJWzC.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\CPYCTAl.exe
  C:\Windows\System\CPYCTAl.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\oBkgGlf.exe
  C:\Windows\System\oBkgGlf.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\RKFRRuC.exe
  C:\Windows\System\RKFRRuC.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\uuMMddV.exe
  C:\Windows\System\uuMMddV.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\KewvLzO.exe
  C:\Windows\System\KewvLzO.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\pEgwgxT.exe
  C:\Windows\System\pEgwgxT.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ZdAJDYr.exe
  C:\Windows\System\ZdAJDYr.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\ykBUsCg.exe
  C:\Windows\System\ykBUsCg.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\VnYYEuo.exe
  C:\Windows\System\VnYYEuo.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\IONDpwS.exe
  C:\Windows\System\IONDpwS.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\qSKtoKW.exe
  C:\Windows\System\qSKtoKW.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\VehRwmQ.exe
  C:\Windows\System\VehRwmQ.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\pKEqMde.exe
  C:\Windows\System\pKEqMde.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\IaPeTQe.exe
  C:\Windows\System\IaPeTQe.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\FuHfSNK.exe
  C:\Windows\System\FuHfSNK.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\uHFcRQK.exe
  C:\Windows\System\uHFcRQK.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\yRTvZUY.exe
  C:\Windows\System\yRTvZUY.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\oljcbAw.exe
  C:\Windows\System\oljcbAw.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\RcalLuC.exe
  C:\Windows\System\RcalLuC.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\SdtPTzA.exe
  C:\Windows\System\SdtPTzA.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\XXaSpIC.exe
  C:\Windows\System\XXaSpIC.exe
  2⤵
  PID:1172
- C:\Windows\System\udDkcry.exe
  C:\Windows\System\udDkcry.exe
  2⤵
  PID:5028
- C:\Windows\System\pKxQHvy.exe
  C:\Windows\System\pKxQHvy.exe
  2⤵
  PID:4472
- C:\Windows\System\ESHZHUX.exe
  C:\Windows\System\ESHZHUX.exe
  2⤵
  PID:4868
- C:\Windows\System\hBxMAki.exe
  C:\Windows\System\hBxMAki.exe
  2⤵
  PID:1444
- C:\Windows\System\eZOujuN.exe
  C:\Windows\System\eZOujuN.exe
  2⤵
  PID:2212
- C:\Windows\System\IbMNGXI.exe
  C:\Windows\System\IbMNGXI.exe
  2⤵
  PID:852
- C:\Windows\System\ZDeXRxc.exe
  C:\Windows\System\ZDeXRxc.exe
  2⤵
  PID:452
- C:\Windows\System\QqHFVWH.exe
  C:\Windows\System\QqHFVWH.exe
  2⤵
  PID:5056
- C:\Windows\System\EjXJffe.exe
  C:\Windows\System\EjXJffe.exe
  2⤵
  PID:3232
- C:\Windows\System\sUCRBRW.exe
  C:\Windows\System\sUCRBRW.exe
  2⤵
  PID:564
- C:\Windows\System\NCwJcDo.exe
  C:\Windows\System\NCwJcDo.exe
  2⤵
  PID:2612
- C:\Windows\System\GZsYnTn.exe
  C:\Windows\System\GZsYnTn.exe
  2⤵
  PID:3276
- C:\Windows\System\EeBFEVa.exe
  C:\Windows\System\EeBFEVa.exe
  2⤵
  PID:1724
- C:\Windows\System\TpNhmVk.exe
  C:\Windows\System\TpNhmVk.exe
  2⤵
  PID:940
- C:\Windows\System\FFUkypU.exe
  C:\Windows\System\FFUkypU.exe
  2⤵
  PID:4464
- C:\Windows\System\FVsHHrI.exe
  C:\Windows\System\FVsHHrI.exe
  2⤵
  PID:2740
- C:\Windows\System\UAAhGSd.exe
  C:\Windows\System\UAAhGSd.exe
  2⤵
  PID:4380
- C:\Windows\System\pGvLJXa.exe
  C:\Windows\System\pGvLJXa.exe
  2⤵
  PID:4644
- C:\Windows\System\sxyBOwk.exe
  C:\Windows\System\sxyBOwk.exe
  2⤵
  PID:612
- C:\Windows\System\MZQKiar.exe
  C:\Windows\System\MZQKiar.exe
  2⤵
  PID:3760
- C:\Windows\System\urSNGnL.exe
  C:\Windows\System\urSNGnL.exe
  2⤵
  PID:8
- C:\Windows\System\RFeNUbf.exe
  C:\Windows\System\RFeNUbf.exe
  2⤵
  PID:3788
- C:\Windows\System\epAZkTb.exe
  C:\Windows\System\epAZkTb.exe
  2⤵
  PID:3252
- C:\Windows\System\TIovBHW.exe
  C:\Windows\System\TIovBHW.exe
  2⤵
  PID:1780
- C:\Windows\System\nkZERrk.exe
  C:\Windows\System\nkZERrk.exe
  2⤵
  PID:5144
- C:\Windows\System\HMIqmaH.exe
  C:\Windows\System\HMIqmaH.exe
  2⤵
  PID:5172
- C:\Windows\System\kBheOHM.exe
  C:\Windows\System\kBheOHM.exe
  2⤵
  PID:5200
- C:\Windows\System\PKVppLZ.exe
  C:\Windows\System\PKVppLZ.exe
  2⤵
  PID:5228
- C:\Windows\System\XsCSCxh.exe
  C:\Windows\System\XsCSCxh.exe
  2⤵
  PID:5256
- C:\Windows\System\xTODFih.exe
  C:\Windows\System\xTODFih.exe
  2⤵
  PID:5284
- C:\Windows\System\hEuYkAV.exe
  C:\Windows\System\hEuYkAV.exe
  2⤵
  PID:5312
- C:\Windows\System\gnYKSLE.exe
  C:\Windows\System\gnYKSLE.exe
  2⤵
  PID:5340
- C:\Windows\System\ScOlXgY.exe
  C:\Windows\System\ScOlXgY.exe
  2⤵
  PID:5368
- C:\Windows\System\ZqCEZGI.exe
  C:\Windows\System\ZqCEZGI.exe
  2⤵
  PID:5396
- C:\Windows\System\XClUmIG.exe
  C:\Windows\System\XClUmIG.exe
  2⤵
  PID:5424
- C:\Windows\System\pYDfjqA.exe
  C:\Windows\System\pYDfjqA.exe
  2⤵
  PID:5452
- C:\Windows\System\uPtbFgK.exe
  C:\Windows\System\uPtbFgK.exe
  2⤵
  PID:5480
- C:\Windows\System\ArMsSkN.exe
  C:\Windows\System\ArMsSkN.exe
  2⤵
  PID:5508
- C:\Windows\System\eXOdIpR.exe
  C:\Windows\System\eXOdIpR.exe
  2⤵
  PID:5536
- C:\Windows\System\utnjpjJ.exe
  C:\Windows\System\utnjpjJ.exe
  2⤵
  PID:5564
- C:\Windows\System\fsbXJxi.exe
  C:\Windows\System\fsbXJxi.exe
  2⤵
  PID:5592
- C:\Windows\System\hArvLqI.exe
  C:\Windows\System\hArvLqI.exe
  2⤵
  PID:5620
- C:\Windows\System\yLSBbWO.exe
  C:\Windows\System\yLSBbWO.exe
  2⤵
  PID:5648
- C:\Windows\System\dYcVcUQ.exe
  C:\Windows\System\dYcVcUQ.exe
  2⤵
  PID:5676
- C:\Windows\System\iFdlVMH.exe
  C:\Windows\System\iFdlVMH.exe
  2⤵
  PID:5704
- C:\Windows\System\XOJEECI.exe
  C:\Windows\System\XOJEECI.exe
  2⤵
  PID:5732
- C:\Windows\System\nXdRGAK.exe
  C:\Windows\System\nXdRGAK.exe
  2⤵
  PID:5760
- C:\Windows\System\tHZfzKF.exe
  C:\Windows\System\tHZfzKF.exe
  2⤵
  PID:5788
- C:\Windows\System\CUGjLWt.exe
  C:\Windows\System\CUGjLWt.exe
  2⤵
  PID:5816
- C:\Windows\System\ZrZhOyF.exe
  C:\Windows\System\ZrZhOyF.exe
  2⤵
  PID:5844
- C:\Windows\System\TcDBVZn.exe
  C:\Windows\System\TcDBVZn.exe
  2⤵
  PID:5872
- C:\Windows\System\GNVQyda.exe
  C:\Windows\System\GNVQyda.exe
  2⤵
  PID:5900
- C:\Windows\System\qCXarOr.exe
  C:\Windows\System\qCXarOr.exe
  2⤵
  PID:5928
- C:\Windows\System\qxBfPeE.exe
  C:\Windows\System\qxBfPeE.exe
  2⤵
  PID:5956
- C:\Windows\System\WykThKq.exe
  C:\Windows\System\WykThKq.exe
  2⤵
  PID:5984
- C:\Windows\System\TmFuHtP.exe
  C:\Windows\System\TmFuHtP.exe
  2⤵
  PID:6012
- C:\Windows\System\AebwXvz.exe
  C:\Windows\System\AebwXvz.exe
  2⤵
  PID:6040
- C:\Windows\System\RZnVHyN.exe
  C:\Windows\System\RZnVHyN.exe
  2⤵
  PID:6068
- C:\Windows\System\HBEPino.exe
  C:\Windows\System\HBEPino.exe
  2⤵
  PID:6096
- C:\Windows\System\sJQvUKH.exe
  C:\Windows\System\sJQvUKH.exe
  2⤵
  PID:6124
- C:\Windows\System\ojBhPWm.exe
  C:\Windows\System\ojBhPWm.exe
  2⤵
  PID:2724
- C:\Windows\System\IeZWpPZ.exe
  C:\Windows\System\IeZWpPZ.exe
  2⤵
  PID:3424
- C:\Windows\System\ZXiCBXQ.exe
  C:\Windows\System\ZXiCBXQ.exe
  2⤵
  PID:1524
- C:\Windows\System\VsYfODt.exe
  C:\Windows\System\VsYfODt.exe
  2⤵
  PID:5116
- C:\Windows\System\IlBVjcG.exe
  C:\Windows\System\IlBVjcG.exe
  2⤵
  PID:4912
- C:\Windows\System\EDAqYEN.exe
  C:\Windows\System\EDAqYEN.exe
  2⤵
  PID:4808
- C:\Windows\System\urQlzZh.exe
  C:\Windows\System\urQlzZh.exe
  2⤵
  PID:3984
- C:\Windows\System\eztwqmI.exe
  C:\Windows\System\eztwqmI.exe
  2⤵
  PID:5184
- C:\Windows\System\CpquOMq.exe
  C:\Windows\System\CpquOMq.exe
  2⤵
  PID:5244
- C:\Windows\System\XPtgMVu.exe
  C:\Windows\System\XPtgMVu.exe
  2⤵
  PID:5304
- C:\Windows\System\ILNPZhX.exe
  C:\Windows\System\ILNPZhX.exe
  2⤵
  PID:5380
- C:\Windows\System\yWWfBDw.exe
  C:\Windows\System\yWWfBDw.exe
  2⤵
  PID:5440
- C:\Windows\System\uofttdi.exe
  C:\Windows\System\uofttdi.exe
  2⤵
  PID:5500
- C:\Windows\System\OsTCMnw.exe
  C:\Windows\System\OsTCMnw.exe
  2⤵
  PID:5576
- C:\Windows\System\eUOGvzv.exe
  C:\Windows\System\eUOGvzv.exe
  2⤵
  PID:5640
- C:\Windows\System\iVAttec.exe
  C:\Windows\System\iVAttec.exe
  2⤵
  PID:5696
- C:\Windows\System\kdEUeEh.exe
  C:\Windows\System\kdEUeEh.exe
  2⤵
  PID:5772
- C:\Windows\System\xaZyJOr.exe
  C:\Windows\System\xaZyJOr.exe
  2⤵
  PID:5832
- C:\Windows\System\BbncLhA.exe
  C:\Windows\System\BbncLhA.exe
  2⤵
  PID:5888
- C:\Windows\System\ckdTDEp.exe
  C:\Windows\System\ckdTDEp.exe
  2⤵
  PID:5948
- C:\Windows\System\NWfhXNt.exe
  C:\Windows\System\NWfhXNt.exe
  2⤵
  PID:6004
- C:\Windows\System\ybVnuIC.exe
  C:\Windows\System\ybVnuIC.exe
  2⤵
  PID:6084
- C:\Windows\System\QRkhItZ.exe
  C:\Windows\System\QRkhItZ.exe
  2⤵
  PID:1012
- C:\Windows\System\QMowQmR.exe
  C:\Windows\System\QMowQmR.exe
  2⤵
  PID:4284
- C:\Windows\System\XEMgVfS.exe
  C:\Windows\System\XEMgVfS.exe
  2⤵
  PID:2052
- C:\Windows\System\LDvYygQ.exe
  C:\Windows\System\LDvYygQ.exe
  2⤵
  PID:5156
- C:\Windows\System\NfhMSer.exe
  C:\Windows\System\NfhMSer.exe
  2⤵
  PID:5296
- C:\Windows\System\jLPtOvq.exe
  C:\Windows\System\jLPtOvq.exe
  2⤵
  PID:5468
- C:\Windows\System\xUYxBcM.exe
  C:\Windows\System\xUYxBcM.exe
  2⤵
  PID:5608
- C:\Windows\System\VTPXfUa.exe
  C:\Windows\System\VTPXfUa.exe
  2⤵
  PID:3508
- C:\Windows\System\TSGrJqG.exe
  C:\Windows\System\TSGrJqG.exe
  2⤵
  PID:5860
- C:\Windows\System\msrhKoa.exe
  C:\Windows\System\msrhKoa.exe
  2⤵
  PID:6000
- C:\Windows\System\EiRtZrK.exe
  C:\Windows\System\EiRtZrK.exe
  2⤵
  PID:4124
- C:\Windows\System\jGWcTei.exe
  C:\Windows\System\jGWcTei.exe
  2⤵
  PID:4024
- C:\Windows\System\LqiSyll.exe
  C:\Windows\System\LqiSyll.exe
  2⤵
  PID:5408
- C:\Windows\System\mZeLAwg.exe
  C:\Windows\System\mZeLAwg.exe
  2⤵
  PID:6168
- C:\Windows\System\JSNqTRi.exe
  C:\Windows\System\JSNqTRi.exe
  2⤵
  PID:6196
- C:\Windows\System\ppmrfSB.exe
  C:\Windows\System\ppmrfSB.exe
  2⤵
  PID:6224
- C:\Windows\System\AwJYLTQ.exe
  C:\Windows\System\AwJYLTQ.exe
  2⤵
  PID:6252
- C:\Windows\System\ZqySUqS.exe
  C:\Windows\System\ZqySUqS.exe
  2⤵
  PID:6280
- C:\Windows\System\SEUDCdM.exe
  C:\Windows\System\SEUDCdM.exe
  2⤵
  PID:6304
- C:\Windows\System\laDKqub.exe
  C:\Windows\System\laDKqub.exe
  2⤵
  PID:6336
- C:\Windows\System\SCipOcT.exe
  C:\Windows\System\SCipOcT.exe
  2⤵
  PID:6364
- C:\Windows\System\aFIGEIl.exe
  C:\Windows\System\aFIGEIl.exe
  2⤵
  PID:6392
- C:\Windows\System\PVuvKHq.exe
  C:\Windows\System\PVuvKHq.exe
  2⤵
  PID:6420
- C:\Windows\System\pITetiO.exe
  C:\Windows\System\pITetiO.exe
  2⤵
  PID:6448
- C:\Windows\System\lMOswPw.exe
  C:\Windows\System\lMOswPw.exe
  2⤵
  PID:6476
- C:\Windows\System\BfOPwlD.exe
  C:\Windows\System\BfOPwlD.exe
  2⤵
  PID:6504
- C:\Windows\System\bnuCqPA.exe
  C:\Windows\System\bnuCqPA.exe
  2⤵
  PID:6532
- C:\Windows\System\VhJhLmE.exe
  C:\Windows\System\VhJhLmE.exe
  2⤵
  PID:6560
- C:\Windows\System\eFzTycz.exe
  C:\Windows\System\eFzTycz.exe
  2⤵
  PID:6588
- C:\Windows\System\YDWzgdL.exe
  C:\Windows\System\YDWzgdL.exe
  2⤵
  PID:6616
- C:\Windows\System\Qbyflha.exe
  C:\Windows\System\Qbyflha.exe
  2⤵
  PID:6644
- C:\Windows\System\amYxorI.exe
  C:\Windows\System\amYxorI.exe
  2⤵
  PID:6768
- C:\Windows\System\zmcRLAN.exe
  C:\Windows\System\zmcRLAN.exe
  2⤵
  PID:6788
- C:\Windows\System\QwsFImA.exe
  C:\Windows\System\QwsFImA.exe
  2⤵
  PID:6804
- C:\Windows\System\bZBlzYv.exe
  C:\Windows\System\bZBlzYv.exe
  2⤵
  PID:6836
- C:\Windows\System\NbYQEcA.exe
  C:\Windows\System\NbYQEcA.exe
  2⤵
  PID:6852
- C:\Windows\System\ViiHxwf.exe
  C:\Windows\System\ViiHxwf.exe
  2⤵
  PID:6888
- C:\Windows\System\tgCJSNu.exe
  C:\Windows\System\tgCJSNu.exe
  2⤵
  PID:6924
- C:\Windows\System\AmVUnNo.exe
  C:\Windows\System\AmVUnNo.exe
  2⤵
  PID:6952
- C:\Windows\System\uEVJtdI.exe
  C:\Windows\System\uEVJtdI.exe
  2⤵
  PID:6976
- C:\Windows\System\zlwaMnJ.exe
  C:\Windows\System\zlwaMnJ.exe
  2⤵
  PID:7004
- C:\Windows\System\DKQoSae.exe
  C:\Windows\System\DKQoSae.exe
  2⤵
  PID:7024
- C:\Windows\System\HAOGYMm.exe
  C:\Windows\System\HAOGYMm.exe
  2⤵
  PID:7044
- C:\Windows\System\GXEbriH.exe
  C:\Windows\System\GXEbriH.exe
  2⤵
  PID:7072
- C:\Windows\System\eOJLiBc.exe
  C:\Windows\System\eOJLiBc.exe
  2⤵
  PID:7096
- C:\Windows\System\KjiYsqX.exe
  C:\Windows\System\KjiYsqX.exe
  2⤵
  PID:7140
- C:\Windows\System\wcJHVEm.exe
  C:\Windows\System\wcJHVEm.exe
  2⤵
  PID:7160
- C:\Windows\System\pQADfnP.exe
  C:\Windows\System\pQADfnP.exe
  2⤵
  PID:5808
- C:\Windows\System\DThYdmQ.exe
  C:\Windows\System\DThYdmQ.exe
  2⤵
  PID:6112
- C:\Windows\System\VVSdGqH.exe
  C:\Windows\System\VVSdGqH.exe
  2⤵
  PID:1320
- C:\Windows\System\KQFizzl.exe
  C:\Windows\System\KQFizzl.exe
  2⤵
  PID:6180
- C:\Windows\System\SZygqsf.exe
  C:\Windows\System\SZygqsf.exe
  2⤵
  PID:6212
- C:\Windows\System\wwqopED.exe
  C:\Windows\System\wwqopED.exe
  2⤵
  PID:6264
- C:\Windows\System\PROYXQg.exe
  C:\Windows\System\PROYXQg.exe
  2⤵
  PID:6524
- C:\Windows\System\QdKwZli.exe
  C:\Windows\System\QdKwZli.exe
  2⤵
  PID:6576
- C:\Windows\System\iUiEyse.exe
  C:\Windows\System\iUiEyse.exe
  2⤵
  PID:1248
- C:\Windows\System\qhHXPfB.exe
  C:\Windows\System\qhHXPfB.exe
  2⤵
  PID:3724
- C:\Windows\System\TBvvHvF.exe
  C:\Windows\System\TBvvHvF.exe
  2⤵
  PID:1184
- C:\Windows\System\rGkzVkJ.exe
  C:\Windows\System\rGkzVkJ.exe
  2⤵
  PID:3472
- C:\Windows\System\CGtUNdQ.exe
  C:\Windows\System\CGtUNdQ.exe
  2⤵
  PID:3744
- C:\Windows\System\OZRZbHN.exe
  C:\Windows\System\OZRZbHN.exe
  2⤵
  PID:824
- C:\Windows\System\ltWrRaQ.exe
  C:\Windows\System\ltWrRaQ.exe
  2⤵
  PID:4604
- C:\Windows\System\IIMWnEZ.exe
  C:\Windows\System\IIMWnEZ.exe
  2⤵
  PID:1968
- C:\Windows\System\rBCYpkD.exe
  C:\Windows\System\rBCYpkD.exe
  2⤵
  PID:6868
- C:\Windows\System\vVRpvXQ.exe
  C:\Windows\System\vVRpvXQ.exe
  2⤵
  PID:7040
- C:\Windows\System\VTOAWom.exe
  C:\Windows\System\VTOAWom.exe
  2⤵
  PID:7000
- C:\Windows\System\cJyOVMa.exe
  C:\Windows\System\cJyOVMa.exe
  2⤵
  PID:7128
- C:\Windows\System\bgIDViL.exe
  C:\Windows\System\bgIDViL.exe
  2⤵
  PID:6160
- C:\Windows\System\waAVYfX.exe
  C:\Windows\System\waAVYfX.exe
  2⤵
  PID:2384
- C:\Windows\System\SROiMAJ.exe
  C:\Windows\System\SROiMAJ.exe
  2⤵
  PID:6876
- C:\Windows\System\otJgBcZ.exe
  C:\Windows\System\otJgBcZ.exe
  2⤵
  PID:1196
- C:\Windows\System\VfhCkdR.exe
  C:\Windows\System\VfhCkdR.exe
  2⤵
  PID:1116
- C:\Windows\System\lZAEGSm.exe
  C:\Windows\System\lZAEGSm.exe
  2⤵
  PID:6796
- C:\Windows\System\BPPPZEv.exe
  C:\Windows\System\BPPPZEv.exe
  2⤵
  PID:6848
- C:\Windows\System\hyxcMmB.exe
  C:\Windows\System\hyxcMmB.exe
  2⤵
  PID:7092
- C:\Windows\System\dgJQiDs.exe
  C:\Windows\System\dgJQiDs.exe
  2⤵
  PID:6816
- C:\Windows\System\bFUKqZp.exe
  C:\Windows\System\bFUKqZp.exe
  2⤵
  PID:6236
- C:\Windows\System\mmoLTCG.exe
  C:\Windows\System\mmoLTCG.exe
  2⤵
  PID:4144
- C:\Windows\System\JQmVDYw.exe
  C:\Windows\System\JQmVDYw.exe
  2⤵
  PID:7052
- C:\Windows\System\ydAUMdZ.exe
  C:\Windows\System\ydAUMdZ.exe
  2⤵
  PID:6964
- C:\Windows\System\BRyjZfZ.exe
  C:\Windows\System\BRyjZfZ.exe
  2⤵
  PID:6552
- C:\Windows\System\CErKYEh.exe
  C:\Windows\System\CErKYEh.exe
  2⤵
  PID:6828
- C:\Windows\System\KIcePSA.exe
  C:\Windows\System\KIcePSA.exe
  2⤵
  PID:6628
- C:\Windows\System\OsqPQBu.exe
  C:\Windows\System\OsqPQBu.exe
  2⤵
  PID:6468
- C:\Windows\System\DlJEfWE.exe
  C:\Windows\System\DlJEfWE.exe
  2⤵
  PID:4316
- C:\Windows\System\VjaNhmQ.exe
  C:\Windows\System\VjaNhmQ.exe
  2⤵
  PID:5668
- C:\Windows\System\sDnMGtC.exe
  C:\Windows\System\sDnMGtC.exe
  2⤵
  PID:6820
- C:\Windows\System\zdxjeUo.exe
  C:\Windows\System\zdxjeUo.exe
  2⤵
  PID:7176
- C:\Windows\System\zApvPIZ.exe
  C:\Windows\System\zApvPIZ.exe
  2⤵
  PID:7208
- C:\Windows\System\uxJSnSe.exe
  C:\Windows\System\uxJSnSe.exe
  2⤵
  PID:7228
- C:\Windows\System\frwWAnA.exe
  C:\Windows\System\frwWAnA.exe
  2⤵
  PID:7260
- C:\Windows\System\Bihjwbq.exe
  C:\Windows\System\Bihjwbq.exe
  2⤵
  PID:7292
- C:\Windows\System\CTYvxso.exe
  C:\Windows\System\CTYvxso.exe
  2⤵
  PID:7316
- C:\Windows\System\NtHjmer.exe
  C:\Windows\System\NtHjmer.exe
  2⤵
  PID:7356
- C:\Windows\System\PYFhDfB.exe
  C:\Windows\System\PYFhDfB.exe
  2⤵
  PID:7388
- C:\Windows\System\JuCAZaD.exe
  C:\Windows\System\JuCAZaD.exe
  2⤵
  PID:7416
- C:\Windows\System\GKWBKsh.exe
  C:\Windows\System\GKWBKsh.exe
  2⤵
  PID:7444
- C:\Windows\System\IcyrdBt.exe
  C:\Windows\System\IcyrdBt.exe
  2⤵
  PID:7488
- C:\Windows\System\iLgvgvM.exe
  C:\Windows\System\iLgvgvM.exe
  2⤵
  PID:7504
- C:\Windows\System\XzTZlKv.exe
  C:\Windows\System\XzTZlKv.exe
  2⤵
  PID:7532
- C:\Windows\System\iXmdwgR.exe
  C:\Windows\System\iXmdwgR.exe
  2⤵
  PID:7548
- C:\Windows\System\BOkbvev.exe
  C:\Windows\System\BOkbvev.exe
  2⤵
  PID:7576
- C:\Windows\System\FcdqiOl.exe
  C:\Windows\System\FcdqiOl.exe
  2⤵
  PID:7604
- C:\Windows\System\YExWdDD.exe
  C:\Windows\System\YExWdDD.exe
  2⤵
  PID:7644
- C:\Windows\System\LHnFTTU.exe
  C:\Windows\System\LHnFTTU.exe
  2⤵
  PID:7672
- C:\Windows\System\YzxyTZJ.exe
  C:\Windows\System\YzxyTZJ.exe
  2⤵
  PID:7696
- C:\Windows\System\RDwzSAg.exe
  C:\Windows\System\RDwzSAg.exe
  2⤵
  PID:7736
- C:\Windows\System\DSgXbNH.exe
  C:\Windows\System\DSgXbNH.exe
  2⤵
  PID:7760
- C:\Windows\System\YhCluiY.exe
  C:\Windows\System\YhCluiY.exe
  2⤵
  PID:7788
- C:\Windows\System\ixAskPS.exe
  C:\Windows\System\ixAskPS.exe
  2⤵
  PID:7816
- C:\Windows\System\shDOeWa.exe
  C:\Windows\System\shDOeWa.exe
  2⤵
  PID:7844
- C:\Windows\System\GyXxiRW.exe
  C:\Windows\System\GyXxiRW.exe
  2⤵
  PID:7860
- C:\Windows\System\GxZfDgu.exe
  C:\Windows\System\GxZfDgu.exe
  2⤵
  PID:7888
- C:\Windows\System\VgCoaaC.exe
  C:\Windows\System\VgCoaaC.exe
  2⤵
  PID:7916
- C:\Windows\System\hFIdpqn.exe
  C:\Windows\System\hFIdpqn.exe
  2⤵
  PID:7956
- C:\Windows\System\UCjXerp.exe
  C:\Windows\System\UCjXerp.exe
  2⤵
  PID:7984
- C:\Windows\System\WpCPcdL.exe
  C:\Windows\System\WpCPcdL.exe
  2⤵
  PID:8004
- C:\Windows\System\ffRIeei.exe
  C:\Windows\System\ffRIeei.exe
  2⤵
  PID:8036
- C:\Windows\System\YwuoBfy.exe
  C:\Windows\System\YwuoBfy.exe
  2⤵
  PID:8060
- C:\Windows\System\iazYHwA.exe
  C:\Windows\System\iazYHwA.exe
  2⤵
  PID:8088
- C:\Windows\System\uoVoExA.exe
  C:\Windows\System\uoVoExA.exe
  2⤵
  PID:8128
- C:\Windows\System\cDsLEHa.exe
  C:\Windows\System\cDsLEHa.exe
  2⤵
  PID:8156
- C:\Windows\System\IaLxack.exe
  C:\Windows\System\IaLxack.exe
  2⤵
  PID:8180
- C:\Windows\System\OZmROIj.exe
  C:\Windows\System\OZmROIj.exe
  2⤵
  PID:7188
- C:\Windows\System\IfkUioC.exe
  C:\Windows\System\IfkUioC.exe
  2⤵
  PID:7256
- C:\Windows\System\edrmMkw.exe
  C:\Windows\System\edrmMkw.exe
  2⤵
  PID:7312
- C:\Windows\System\jPkhJtJ.exe
  C:\Windows\System\jPkhJtJ.exe
  2⤵
  PID:7400
- C:\Windows\System\incYUXA.exe
  C:\Windows\System\incYUXA.exe
  2⤵
  PID:7460
- C:\Windows\System\CHHNGRN.exe
  C:\Windows\System\CHHNGRN.exe
  2⤵
  PID:7528
- C:\Windows\System\rHXtexY.exe
  C:\Windows\System\rHXtexY.exe
  2⤵
  PID:7596
- C:\Windows\System\PIxQzWx.exe
  C:\Windows\System\PIxQzWx.exe
  2⤵
  PID:7640
- C:\Windows\System\vcCeNcI.exe
  C:\Windows\System\vcCeNcI.exe
  2⤵
  PID:7716
- C:\Windows\System\ZWFXUvr.exe
  C:\Windows\System\ZWFXUvr.exe
  2⤵
  PID:7804
- C:\Windows\System\ASmqbhp.exe
  C:\Windows\System\ASmqbhp.exe
  2⤵
  PID:7836
- C:\Windows\System\syQAXWq.exe
  C:\Windows\System\syQAXWq.exe
  2⤵
  PID:7872
- C:\Windows\System\aDMuAAo.exe
  C:\Windows\System\aDMuAAo.exe
  2⤵
  PID:7972
- C:\Windows\System\iDWhnWU.exe
  C:\Windows\System\iDWhnWU.exe
  2⤵
  PID:8020
- C:\Windows\System\OSRmIaw.exe
  C:\Windows\System\OSRmIaw.exe
  2⤵
  PID:8104
- C:\Windows\System\kQJWdpO.exe
  C:\Windows\System\kQJWdpO.exe
  2⤵
  PID:8148
- C:\Windows\System\ikpEjUN.exe
  C:\Windows\System\ikpEjUN.exe
  2⤵
  PID:7236
- C:\Windows\System\rJcDWUB.exe
  C:\Windows\System\rJcDWUB.exe
  2⤵
  PID:7432
- C:\Windows\System\ulODXNO.exe
  C:\Windows\System\ulODXNO.exe
  2⤵
  PID:7544
- C:\Windows\System\ZjVFuWD.exe
  C:\Windows\System\ZjVFuWD.exe
  2⤵
  PID:7720
- C:\Windows\System\ANQLBKy.exe
  C:\Windows\System\ANQLBKy.exe
  2⤵
  PID:7828
- C:\Windows\System\gJnSwrj.exe
  C:\Windows\System\gJnSwrj.exe
  2⤵
  PID:7932
- C:\Windows\System\lTecsIc.exe
  C:\Windows\System\lTecsIc.exe
  2⤵
  PID:8120
- C:\Windows\System\YDLZaDG.exe
  C:\Windows\System\YDLZaDG.exe
  2⤵
  PID:7496
- C:\Windows\System\hkBneRM.exe
  C:\Windows\System\hkBneRM.exe
  2⤵
  PID:7856
- C:\Windows\System\tYhrDra.exe
  C:\Windows\System\tYhrDra.exe
  2⤵
  PID:8080
- C:\Windows\System\vAHLytl.exe
  C:\Windows\System\vAHLytl.exe
  2⤵
  PID:7628
- C:\Windows\System\LeLjFYS.exe
  C:\Windows\System\LeLjFYS.exe
  2⤵
  PID:7380
- C:\Windows\System\eOJibRm.exe
  C:\Windows\System\eOJibRm.exe
  2⤵
  PID:8220
- C:\Windows\System\EzJyvqz.exe
  C:\Windows\System\EzJyvqz.exe
  2⤵
  PID:8248
- C:\Windows\System\lpbXuFh.exe
  C:\Windows\System\lpbXuFh.exe
  2⤵
  PID:8276
- C:\Windows\System\DievnUy.exe
  C:\Windows\System\DievnUy.exe
  2⤵
  PID:8308
- C:\Windows\System\saynxkO.exe
  C:\Windows\System\saynxkO.exe
  2⤵
  PID:8336
- C:\Windows\System\aampkSx.exe
  C:\Windows\System\aampkSx.exe
  2⤵
  PID:8352
- C:\Windows\System\xeYKxaV.exe
  C:\Windows\System\xeYKxaV.exe
  2⤵
  PID:8384
- C:\Windows\System\DNBxvPb.exe
  C:\Windows\System\DNBxvPb.exe
  2⤵
  PID:8408
- C:\Windows\System\YWNcFQJ.exe
  C:\Windows\System\YWNcFQJ.exe
  2⤵
  PID:8436
- C:\Windows\System\EhMtHtD.exe
  C:\Windows\System\EhMtHtD.exe
  2⤵
  PID:8464
- C:\Windows\System\FpJPZQn.exe
  C:\Windows\System\FpJPZQn.exe
  2⤵
  PID:8496
- C:\Windows\System\hfmduvY.exe
  C:\Windows\System\hfmduvY.exe
  2⤵
  PID:8516
- C:\Windows\System\AyjWQhb.exe
  C:\Windows\System\AyjWQhb.exe
  2⤵
  PID:8548
- C:\Windows\System\DhcQyTn.exe
  C:\Windows\System\DhcQyTn.exe
  2⤵
  PID:8564
- C:\Windows\System\ZxdaYgz.exe
  C:\Windows\System\ZxdaYgz.exe
  2⤵
  PID:8592
- C:\Windows\System\glvdUea.exe
  C:\Windows\System\glvdUea.exe
  2⤵
  PID:8632
- C:\Windows\System\rlApAPe.exe
  C:\Windows\System\rlApAPe.exe
  2⤵
  PID:8672
- C:\Windows\System\SpHoTUR.exe
  C:\Windows\System\SpHoTUR.exe
  2⤵
  PID:8700
- C:\Windows\System\ZccmMzk.exe
  C:\Windows\System\ZccmMzk.exe
  2⤵
  PID:8716
- C:\Windows\System\ipWDNPI.exe
  C:\Windows\System\ipWDNPI.exe
  2⤵
  PID:8760
- C:\Windows\System\sHLDcos.exe
  C:\Windows\System\sHLDcos.exe
  2⤵
  PID:8788
- C:\Windows\System\nVNyBqs.exe
  C:\Windows\System\nVNyBqs.exe
  2⤵
  PID:8804
- C:\Windows\System\piukogP.exe
  C:\Windows\System\piukogP.exe
  2⤵
  PID:8832
- C:\Windows\System\lKjHene.exe
  C:\Windows\System\lKjHene.exe
  2⤵
  PID:8860
- C:\Windows\System\BloQoJx.exe
  C:\Windows\System\BloQoJx.exe
  2⤵
  PID:8896
- C:\Windows\System\BSSevPV.exe
  C:\Windows\System\BSSevPV.exe
  2⤵
  PID:8920
- C:\Windows\System\OHIFFzZ.exe
  C:\Windows\System\OHIFFzZ.exe
  2⤵
  PID:8948
- C:\Windows\System\jRksJKK.exe
  C:\Windows\System\jRksJKK.exe
  2⤵
  PID:8980
- C:\Windows\System\lKsRTvy.exe
  C:\Windows\System\lKsRTvy.exe
  2⤵
  PID:9000
- C:\Windows\System\ATrMNVv.exe
  C:\Windows\System\ATrMNVv.exe
  2⤵
  PID:9040
- C:\Windows\System\DLUVaVG.exe
  C:\Windows\System\DLUVaVG.exe
  2⤵
  PID:9056
- C:\Windows\System\NztNLYu.exe
  C:\Windows\System\NztNLYu.exe
  2⤵
  PID:9084
- C:\Windows\System\sPKlTee.exe
  C:\Windows\System\sPKlTee.exe
  2⤵
  PID:9112
- C:\Windows\System\weacTzW.exe
  C:\Windows\System\weacTzW.exe
  2⤵
  PID:9140
- C:\Windows\System\zkPJQtL.exe
  C:\Windows\System\zkPJQtL.exe
  2⤵
  PID:9180
- C:\Windows\System\tMrvjVp.exe
  C:\Windows\System\tMrvjVp.exe
  2⤵
  PID:9212
- C:\Windows\System\lCuetwk.exe
  C:\Windows\System\lCuetwk.exe
  2⤵
  PID:8244
- C:\Windows\System\MnaFwLs.exe
  C:\Windows\System\MnaFwLs.exe
  2⤵
  PID:8300
- C:\Windows\System\SHMdTYD.exe
  C:\Windows\System\SHMdTYD.exe
  2⤵
  PID:8348
- C:\Windows\System\ceaanlR.exe
  C:\Windows\System\ceaanlR.exe
  2⤵
  PID:8424
- C:\Windows\System\uBZtCYI.exe
  C:\Windows\System\uBZtCYI.exe
  2⤵
  PID:8492
- C:\Windows\System\gXxdfUQ.exe
  C:\Windows\System\gXxdfUQ.exe
  2⤵
  PID:8560
- C:\Windows\System\asVgKpK.exe
  C:\Windows\System\asVgKpK.exe
  2⤵
  PID:8620
- C:\Windows\System\itPCFsy.exe
  C:\Windows\System\itPCFsy.exe
  2⤵
  PID:8684
- C:\Windows\System\GaXVqTr.exe
  C:\Windows\System\GaXVqTr.exe
  2⤵
  PID:8736
- C:\Windows\System\bSgjsaX.exe
  C:\Windows\System\bSgjsaX.exe
  2⤵
  PID:8772
- C:\Windows\System\FdlWvTQ.exe
  C:\Windows\System\FdlWvTQ.exe
  2⤵
  PID:8800
- C:\Windows\System\ZlBKJHn.exe
  C:\Windows\System\ZlBKJHn.exe
  2⤵
  PID:8880
- C:\Windows\System\IoGgCWf.exe
  C:\Windows\System\IoGgCWf.exe
  2⤵
  PID:8988
- C:\Windows\System\GIHBCbo.exe
  C:\Windows\System\GIHBCbo.exe
  2⤵
  PID:9052
- C:\Windows\System\xmKzWDp.exe
  C:\Windows\System\xmKzWDp.exe
  2⤵
  PID:9128
- C:\Windows\System\fdkAHhq.exe
  C:\Windows\System\fdkAHhq.exe
  2⤵
  PID:8200
- C:\Windows\System\BTAIIag.exe
  C:\Windows\System\BTAIIag.exe
  2⤵
  PID:8320
- C:\Windows\System\NqGaRNN.exe
  C:\Windows\System\NqGaRNN.exe
  2⤵
  PID:8524
- C:\Windows\System\xcMPMAJ.exe
  C:\Windows\System\xcMPMAJ.exe
  2⤵
  PID:8668
- C:\Windows\System\jiOfDiV.exe
  C:\Windows\System\jiOfDiV.exe
  2⤵
  PID:8780
- C:\Windows\System\YOmroGz.exe
  C:\Windows\System\YOmroGz.exe
  2⤵
  PID:8932
- C:\Windows\System\yXYIYsE.exe
  C:\Windows\System\yXYIYsE.exe
  2⤵
  PID:9076
- C:\Windows\System\IrHXKrP.exe
  C:\Windows\System\IrHXKrP.exe
  2⤵
  PID:8272
- C:\Windows\System\JMncGue.exe
  C:\Windows\System\JMncGue.exe
  2⤵
  PID:8556
- C:\Windows\System\HzEotFE.exe
  C:\Windows\System\HzEotFE.exe
  2⤵
  PID:8844
- C:\Windows\System\cdolTaQ.exe
  C:\Windows\System\cdolTaQ.exe
  2⤵
  PID:9156
- C:\Windows\System\rMNNEIg.exe
  C:\Windows\System\rMNNEIg.exe
  2⤵
  PID:8928
- C:\Windows\System\itRbsLm.exe
  C:\Windows\System\itRbsLm.exe
  2⤵
  PID:9236
- C:\Windows\System\iVzKvoc.exe
  C:\Windows\System\iVzKvoc.exe
  2⤵
  PID:9268
- C:\Windows\System\YoNcEgo.exe
  C:\Windows\System\YoNcEgo.exe
  2⤵
  PID:9296
- C:\Windows\System\wJjJTDt.exe
  C:\Windows\System\wJjJTDt.exe
  2⤵
  PID:9320
- C:\Windows\System\tYAqjVW.exe
  C:\Windows\System\tYAqjVW.exe
  2⤵
  PID:9348
- C:\Windows\System\bdnwEaF.exe
  C:\Windows\System\bdnwEaF.exe
  2⤵
  PID:9376
- C:\Windows\System\cyPIdPC.exe
  C:\Windows\System\cyPIdPC.exe
  2⤵
  PID:9404
- C:\Windows\System\lihxWQB.exe
  C:\Windows\System\lihxWQB.exe
  2⤵
  PID:9444
- C:\Windows\System\FaIXymR.exe
  C:\Windows\System\FaIXymR.exe
  2⤵
  PID:9464
- C:\Windows\System\ZjbOBMU.exe
  C:\Windows\System\ZjbOBMU.exe
  2⤵
  PID:9492
- C:\Windows\System\tnehgSE.exe
  C:\Windows\System\tnehgSE.exe
  2⤵
  PID:9520
- C:\Windows\System\rtHlkYx.exe
  C:\Windows\System\rtHlkYx.exe
  2⤵
  PID:9548
- C:\Windows\System\QyZPpsC.exe
  C:\Windows\System\QyZPpsC.exe
  2⤵
  PID:9576
- C:\Windows\System\scOWvsJ.exe
  C:\Windows\System\scOWvsJ.exe
  2⤵
  PID:9616
- C:\Windows\System\pTtMbpt.exe
  C:\Windows\System\pTtMbpt.exe
  2⤵
  PID:9644
- C:\Windows\System\jIzknyQ.exe
  C:\Windows\System\jIzknyQ.exe
  2⤵
  PID:9664
- C:\Windows\System\MMzJFEr.exe
  C:\Windows\System\MMzJFEr.exe
  2⤵
  PID:9700
- C:\Windows\System\fuZKbiZ.exe
  C:\Windows\System\fuZKbiZ.exe
  2⤵
  PID:9728
- C:\Windows\System\sRLmcRl.exe
  C:\Windows\System\sRLmcRl.exe
  2⤵
  PID:9752
- C:\Windows\System\AzGYfnj.exe
  C:\Windows\System\AzGYfnj.exe
  2⤵
  PID:9788
- C:\Windows\System\mdsCOwb.exe
  C:\Windows\System\mdsCOwb.exe
  2⤵
  PID:9804
- C:\Windows\System\vvPCikE.exe
  C:\Windows\System\vvPCikE.exe
  2⤵
  PID:9844
- C:\Windows\System\IyqvUYs.exe
  C:\Windows\System\IyqvUYs.exe
  2⤵
  PID:9860
- C:\Windows\System\gGUIyNX.exe
  C:\Windows\System\gGUIyNX.exe
  2⤵
  PID:9876
- C:\Windows\System\koJqJff.exe
  C:\Windows\System\koJqJff.exe
  2⤵
  PID:9896
- C:\Windows\System\ZULFhEo.exe
  C:\Windows\System\ZULFhEo.exe
  2⤵
  PID:9916
- C:\Windows\System\HRIIriH.exe
  C:\Windows\System\HRIIriH.exe
  2⤵
  PID:9940
- C:\Windows\System\ITYvHoo.exe
  C:\Windows\System\ITYvHoo.exe
  2⤵
  PID:9992
- C:\Windows\System\UMoWJrf.exe
  C:\Windows\System\UMoWJrf.exe
  2⤵
  PID:10040
- C:\Windows\System\NUOjxkV.exe
  C:\Windows\System\NUOjxkV.exe
  2⤵
  PID:10068
- C:\Windows\System\AureGrH.exe
  C:\Windows\System\AureGrH.exe
  2⤵
  PID:10084
- C:\Windows\System\RKAMbpI.exe
  C:\Windows\System\RKAMbpI.exe
  2⤵
  PID:10124
- C:\Windows\System\jemsVcu.exe
  C:\Windows\System\jemsVcu.exe
  2⤵
  PID:10152
- C:\Windows\System\iizcqbd.exe
  C:\Windows\System\iizcqbd.exe
  2⤵
  PID:10168
- C:\Windows\System\eaAIjRu.exe
  C:\Windows\System\eaAIjRu.exe
  2⤵
  PID:10196
- C:\Windows\System\bnMATyl.exe
  C:\Windows\System\bnMATyl.exe
  2⤵
  PID:10236
- C:\Windows\System\OWbhyfg.exe
  C:\Windows\System\OWbhyfg.exe
  2⤵
  PID:9220
- C:\Windows\System\vinOEYU.exe
  C:\Windows\System\vinOEYU.exe
  2⤵
  PID:9288
- C:\Windows\System\ojaDNdx.exe
  C:\Windows\System\ojaDNdx.exe
  2⤵
  PID:9336
- C:\Windows\System\pASIEjR.exe
  C:\Windows\System\pASIEjR.exe
  2⤵
  PID:9400
- C:\Windows\System\qqpgMTS.exe
  C:\Windows\System\qqpgMTS.exe
  2⤵
  PID:9472
- C:\Windows\System\jsLfysZ.exe
  C:\Windows\System\jsLfysZ.exe
  2⤵
  PID:9568
- C:\Windows\System\kGzwxTF.exe
  C:\Windows\System\kGzwxTF.exe
  2⤵
  PID:9600
- C:\Windows\System\mhaBlvQ.exe
  C:\Windows\System\mhaBlvQ.exe
  2⤵
  PID:9656
- C:\Windows\System\bquDNfl.exe
  C:\Windows\System\bquDNfl.exe
  2⤵
  PID:9736
- C:\Windows\System\LPcXknJ.exe
  C:\Windows\System\LPcXknJ.exe
  2⤵
  PID:9824
- C:\Windows\System\eiGYLXf.exe
  C:\Windows\System\eiGYLXf.exe
  2⤵
  PID:9868
- C:\Windows\System\NuFGQas.exe
  C:\Windows\System\NuFGQas.exe
  2⤵
  PID:9968
- C:\Windows\System\nDFqNOQ.exe
  C:\Windows\System\nDFqNOQ.exe
  2⤵
  PID:10024
- C:\Windows\System\buNDZiL.exe
  C:\Windows\System\buNDZiL.exe
  2⤵
  PID:10096
- C:\Windows\System\KHlJSFm.exe
  C:\Windows\System\KHlJSFm.exe
  2⤵
  PID:10140
- C:\Windows\System\gjxpPXH.exe
  C:\Windows\System\gjxpPXH.exe
  2⤵
  PID:10228
- C:\Windows\System\dhwCOGT.exe
  C:\Windows\System\dhwCOGT.exe
  2⤵
  PID:9248
- C:\Windows\System\MRsvfMt.exe
  C:\Windows\System\MRsvfMt.exe
  2⤵
  PID:9456
- C:\Windows\System\ojGiahe.exe
  C:\Windows\System\ojGiahe.exe
  2⤵
  PID:9480
- C:\Windows\System\jkubWEi.exe
  C:\Windows\System\jkubWEi.exe
  2⤵
  PID:9744
- C:\Windows\System\rapjwNr.exe
  C:\Windows\System\rapjwNr.exe
  2⤵
  PID:9960
- C:\Windows\System\wXaFnhk.exe
  C:\Windows\System\wXaFnhk.exe
  2⤵
  PID:10080
- C:\Windows\System\EIxCZmX.exe
  C:\Windows\System\EIxCZmX.exe
  2⤵
  PID:10212
- C:\Windows\System\BYyoIdW.exe
  C:\Windows\System\BYyoIdW.exe
  2⤵
  PID:9532
- C:\Windows\System\aUrySdZ.exe
  C:\Windows\System\aUrySdZ.exe
  2⤵
  PID:9872
- C:\Windows\System\VdgYCOK.exe
  C:\Windows\System\VdgYCOK.exe
  2⤵
  PID:10164
- C:\Windows\System\ouNwNga.exe
  C:\Windows\System\ouNwNga.exe
  2⤵
  PID:9784
- C:\Windows\System\USuXcsR.exe
  C:\Windows\System\USuXcsR.exe
  2⤵
  PID:10260
- C:\Windows\System\DlolNAG.exe
  C:\Windows\System\DlolNAG.exe
  2⤵
  PID:10276
- C:\Windows\System\crPoRmf.exe
  C:\Windows\System\crPoRmf.exe
  2⤵
  PID:10304
- C:\Windows\System\fgFSyXX.exe
  C:\Windows\System\fgFSyXX.exe
  2⤵
  PID:10332
- C:\Windows\System\hWmBErc.exe
  C:\Windows\System\hWmBErc.exe
  2⤵
  PID:10360
- C:\Windows\System\jdWKAXI.exe
  C:\Windows\System\jdWKAXI.exe
  2⤵
  PID:10400
- C:\Windows\System\Zijospp.exe
  C:\Windows\System\Zijospp.exe
  2⤵
  PID:10416
- C:\Windows\System\veehCeg.exe
  C:\Windows\System\veehCeg.exe
  2⤵
  PID:10452
- C:\Windows\System\MlTbXaj.exe
  C:\Windows\System\MlTbXaj.exe
  2⤵
  PID:10476
- C:\Windows\System\vsxitYU.exe
  C:\Windows\System\vsxitYU.exe
  2⤵
  PID:10520
- C:\Windows\System\yhiRrHk.exe
  C:\Windows\System\yhiRrHk.exe
  2⤵
  PID:10548
- C:\Windows\System\RksHHDi.exe
  C:\Windows\System\RksHHDi.exe
  2⤵
  PID:10576
- C:\Windows\System\yXrALQv.exe
  C:\Windows\System\yXrALQv.exe
  2⤵
  PID:10596
- C:\Windows\System\xUgcxta.exe
  C:\Windows\System\xUgcxta.exe
  2⤵
  PID:10636
- C:\Windows\System\LkCaUge.exe
  C:\Windows\System\LkCaUge.exe
  2⤵
  PID:10652
- C:\Windows\System\FPPTzuH.exe
  C:\Windows\System\FPPTzuH.exe
  2⤵
  PID:10676
- C:\Windows\System\xxIdXBM.exe
  C:\Windows\System\xxIdXBM.exe
  2⤵
  PID:10708
- C:\Windows\System\JzagxNA.exe
  C:\Windows\System\JzagxNA.exe
  2⤵
  PID:10748
- C:\Windows\System\JcfEYII.exe
  C:\Windows\System\JcfEYII.exe
  2⤵
  PID:10764
- C:\Windows\System\pHLvvDO.exe
  C:\Windows\System\pHLvvDO.exe
  2⤵
  PID:10804
- C:\Windows\System\QCyzxPf.exe
  C:\Windows\System\QCyzxPf.exe
  2⤵
  PID:10832
- C:\Windows\System\GtGanZj.exe
  C:\Windows\System\GtGanZj.exe
  2⤵
  PID:10860
- C:\Windows\System\CSfNpFy.exe
  C:\Windows\System\CSfNpFy.exe
  2⤵
  PID:10876
- C:\Windows\System\pnufxlF.exe
  C:\Windows\System\pnufxlF.exe
  2⤵
  PID:10916
- C:\Windows\System\pUvXoQJ.exe
  C:\Windows\System\pUvXoQJ.exe
  2⤵
  PID:10944
- C:\Windows\System\oGSOcpP.exe
  C:\Windows\System\oGSOcpP.exe
  2⤵
  PID:10972
- C:\Windows\System\CLRAKGz.exe
  C:\Windows\System\CLRAKGz.exe
  2⤵
  PID:11000
- C:\Windows\System\EPRmFyb.exe
  C:\Windows\System\EPRmFyb.exe
  2⤵
  PID:11028
- C:\Windows\System\XYfLgzL.exe
  C:\Windows\System\XYfLgzL.exe
  2⤵
  PID:11044
- C:\Windows\System\IZsMmAD.exe
  C:\Windows\System\IZsMmAD.exe
  2⤵
  PID:11084
- C:\Windows\System\YtLVwBa.exe
  C:\Windows\System\YtLVwBa.exe
  2⤵
  PID:11116
- C:\Windows\System\ZppiDgX.exe
  C:\Windows\System\ZppiDgX.exe
  2⤵
  PID:11144
- C:\Windows\System\fIwQNBk.exe
  C:\Windows\System\fIwQNBk.exe
  2⤵
  PID:11172
- C:\Windows\System\GOFNOnm.exe
  C:\Windows\System\GOFNOnm.exe
  2⤵
  PID:11200
- C:\Windows\System\OdGtUKD.exe
  C:\Windows\System\OdGtUKD.exe
  2⤵
  PID:11216
- C:\Windows\System\zGSsnof.exe
  C:\Windows\System\zGSsnof.exe
  2⤵
  PID:11256
- C:\Windows\System\oCrsOiW.exe
  C:\Windows\System\oCrsOiW.exe
  2⤵
  PID:10244
- C:\Windows\System\FdLeidd.exe
  C:\Windows\System\FdLeidd.exe
  2⤵
  PID:10320
- C:\Windows\System\khwWoJN.exe
  C:\Windows\System\khwWoJN.exe
  2⤵
  PID:10392
- C:\Windows\System\mPznZmz.exe
  C:\Windows\System\mPznZmz.exe
  2⤵
  PID:10444
- C:\Windows\System\cQHCSwM.exe
  C:\Windows\System\cQHCSwM.exe
  2⤵
  PID:10532
- C:\Windows\System\xWnwUYS.exe
  C:\Windows\System\xWnwUYS.exe
  2⤵
  PID:10584
- C:\Windows\System\FUwbaab.exe
  C:\Windows\System\FUwbaab.exe
  2⤵
  PID:10664
- C:\Windows\System\UsqzYnJ.exe
  C:\Windows\System\UsqzYnJ.exe
  2⤵
  PID:10724
- C:\Windows\System\InBDbgv.exe
  C:\Windows\System\InBDbgv.exe
  2⤵
  PID:10780
- C:\Windows\System\YxNsBmW.exe
  C:\Windows\System\YxNsBmW.exe
  2⤵
  PID:10852
- C:\Windows\System\gPCorvg.exe
  C:\Windows\System\gPCorvg.exe
  2⤵
  PID:10928
- C:\Windows\System\GQVwtaP.exe
  C:\Windows\System\GQVwtaP.exe
  2⤵
  PID:10992
- C:\Windows\System\gGhdvJn.exe
  C:\Windows\System\gGhdvJn.exe
  2⤵
  PID:11036
- C:\Windows\System\fXOfRYy.exe
  C:\Windows\System\fXOfRYy.exe
  2⤵
  PID:11132
- C:\Windows\System\zEHsmxq.exe
  C:\Windows\System\zEHsmxq.exe
  2⤵
  PID:11192
- C:\Windows\System\YBnVXDb.exe
  C:\Windows\System\YBnVXDb.exe
  2⤵
  PID:11248
- C:\Windows\System\YIZNrmI.exe
  C:\Windows\System\YIZNrmI.exe
  2⤵
  PID:10300
- C:\Windows\System\ycJzGbX.exe
  C:\Windows\System\ycJzGbX.exe
  2⤵
  PID:10516
- C:\Windows\System\PdsKDLc.exe
  C:\Windows\System\PdsKDLc.exe
  2⤵
  PID:10668
- C:\Windows\System\QQVkEfa.exe
  C:\Windows\System\QQVkEfa.exe
  2⤵
  PID:10756
- C:\Windows\System\scxmddQ.exe
  C:\Windows\System\scxmddQ.exe
  2⤵
  PID:10964
- C:\Windows\System\DXLUIra.exe
  C:\Windows\System\DXLUIra.exe
  2⤵
  PID:11156
- C:\Windows\System\tJIVtON.exe
  C:\Windows\System\tJIVtON.exe
  2⤵
  PID:9516
- C:\Windows\System\pvSQYkw.exe
  C:\Windows\System\pvSQYkw.exe
  2⤵
  PID:10648
- C:\Windows\System\PRHzMuB.exe
  C:\Windows\System\PRHzMuB.exe
  2⤵
  PID:10464
- C:\Windows\System\BjSkYEl.exe
  C:\Windows\System\BjSkYEl.exe
  2⤵
  PID:9276
- C:\Windows\System\qJgrEzm.exe
  C:\Windows\System\qJgrEzm.exe
  2⤵
  PID:10956
- C:\Windows\System\RXYsHUp.exe
  C:\Windows\System\RXYsHUp.exe
  2⤵
  PID:11288
- C:\Windows\System\DXEgdYd.exe
  C:\Windows\System\DXEgdYd.exe
  2⤵
  PID:11316
- C:\Windows\System\YueFaMW.exe
  C:\Windows\System\YueFaMW.exe
  2⤵
  PID:11344
- C:\Windows\System\uTxorLJ.exe
  C:\Windows\System\uTxorLJ.exe
  2⤵
  PID:11376
- C:\Windows\System\ZfNjOGA.exe
  C:\Windows\System\ZfNjOGA.exe
  2⤵
  PID:11404
- C:\Windows\System\GTeKoOz.exe
  C:\Windows\System\GTeKoOz.exe
  2⤵
  PID:11432
- C:\Windows\System\cAoNWlY.exe
  C:\Windows\System\cAoNWlY.exe
  2⤵
  PID:11468
- C:\Windows\System\qmIIhow.exe
  C:\Windows\System\qmIIhow.exe
  2⤵
  PID:11488
- C:\Windows\System\QXDsSct.exe
  C:\Windows\System\QXDsSct.exe
  2⤵
  PID:11516
- C:\Windows\System\CqMxKpP.exe
  C:\Windows\System\CqMxKpP.exe
  2⤵
  PID:11544
- C:\Windows\System\vDcSnQm.exe
  C:\Windows\System\vDcSnQm.exe
  2⤵
  PID:11584
- C:\Windows\System\xHsGdtj.exe
  C:\Windows\System\xHsGdtj.exe
  2⤵
  PID:11612
- C:\Windows\System\ZLLSqqC.exe
  C:\Windows\System\ZLLSqqC.exe
  2⤵
  PID:11668
- C:\Windows\System\eZUZYii.exe
  C:\Windows\System\eZUZYii.exe
  2⤵
  PID:11684
- C:\Windows\System\RsyoWnw.exe
  C:\Windows\System\RsyoWnw.exe
  2⤵
  PID:11712
- C:\Windows\System\yLRqCZh.exe
  C:\Windows\System\yLRqCZh.exe
  2⤵
  PID:11740
- C:\Windows\System\ZOPXrlm.exe
  C:\Windows\System\ZOPXrlm.exe
  2⤵
  PID:11768
- C:\Windows\System\mUeKwRy.exe
  C:\Windows\System\mUeKwRy.exe
  2⤵
  PID:11796
- C:\Windows\System\ePeMtkh.exe
  C:\Windows\System\ePeMtkh.exe
  2⤵
  PID:11824
- C:\Windows\System\oWEUhtQ.exe
  C:\Windows\System\oWEUhtQ.exe
  2⤵
  PID:11852
- C:\Windows\System\pMztXWV.exe
  C:\Windows\System\pMztXWV.exe
  2⤵
  PID:11868
- C:\Windows\System\hloQrMa.exe
  C:\Windows\System\hloQrMa.exe
  2⤵
  PID:11908
- C:\Windows\System\JucxGeW.exe
  C:\Windows\System\JucxGeW.exe
  2⤵
  PID:11936
- C:\Windows\System\HwPMKPD.exe
  C:\Windows\System\HwPMKPD.exe
  2⤵
  PID:11952
- C:\Windows\System\UNHYuJl.exe
  C:\Windows\System\UNHYuJl.exe
  2⤵
  PID:11980
- C:\Windows\System\uclSwrR.exe
  C:\Windows\System\uclSwrR.exe
  2⤵
  PID:12000
- C:\Windows\System\cRUIBuE.exe
  C:\Windows\System\cRUIBuE.exe
  2⤵
  PID:12052
- C:\Windows\System\YgoYBDe.exe
  C:\Windows\System\YgoYBDe.exe
  2⤵
  PID:12080
- C:\Windows\System\hoqbYnp.exe
  C:\Windows\System\hoqbYnp.exe
  2⤵
  PID:12104
- C:\Windows\System\zNzYYly.exe
  C:\Windows\System\zNzYYly.exe
  2⤵
  PID:12124
- C:\Windows\System\rtPCdql.exe
  C:\Windows\System\rtPCdql.exe
  2⤵
  PID:12164
- C:\Windows\System\uhVfkuB.exe
  C:\Windows\System\uhVfkuB.exe
  2⤵
  PID:12180
- C:\Windows\System\fpBLKwj.exe
  C:\Windows\System\fpBLKwj.exe
  2⤵
  PID:12208
- C:\Windows\System\UsLXQln.exe
  C:\Windows\System\UsLXQln.exe
  2⤵
  PID:12228
- C:\Windows\System\SnSgnIb.exe
  C:\Windows\System\SnSgnIb.exe
  2⤵
  PID:12264
- C:\Windows\System\vtwjKIN.exe
  C:\Windows\System\vtwjKIN.exe
  2⤵
  PID:11080
- C:\Windows\System\PnYvlcn.exe
  C:\Windows\System\PnYvlcn.exe
  2⤵
  PID:11300
- C:\Windows\System\PyxDTUc.exe
  C:\Windows\System\PyxDTUc.exe
  2⤵
  PID:11392
- C:\Windows\System\fAcTaQs.exe
  C:\Windows\System\fAcTaQs.exe
  2⤵
  PID:11424
- C:\Windows\System\NaNKabV.exe
  C:\Windows\System\NaNKabV.exe
  2⤵
  PID:11500
- C:\Windows\System\VYXkNNE.exe
  C:\Windows\System\VYXkNNE.exe
  2⤵
  PID:11596
- C:\Windows\System\BClcRRF.exe
  C:\Windows\System\BClcRRF.exe
  2⤵
  PID:11676
- C:\Windows\System\pnzlgYr.exe
  C:\Windows\System\pnzlgYr.exe
  2⤵
  PID:11708
- C:\Windows\System\FZLdSMo.exe
  C:\Windows\System\FZLdSMo.exe
  2⤵
  PID:11760
- C:\Windows\System\HAQVRoy.exe
  C:\Windows\System\HAQVRoy.exe
  2⤵
  PID:11840
- C:\Windows\System\vqqfYnJ.exe
  C:\Windows\System\vqqfYnJ.exe
  2⤵
  PID:11900
- C:\Windows\System\IWclzKl.exe
  C:\Windows\System\IWclzKl.exe
  2⤵
  PID:11976
- C:\Windows\System\YZAaQse.exe
  C:\Windows\System\YZAaQse.exe
  2⤵
  PID:12044
- C:\Windows\System\TWfAedr.exe
  C:\Windows\System\TWfAedr.exe
  2⤵
  PID:12120
- C:\Windows\System\bxsAOZA.exe
  C:\Windows\System\bxsAOZA.exe
  2⤵
  PID:12176
- C:\Windows\System\zbGCEBf.exe
  C:\Windows\System\zbGCEBf.exe
  2⤵
  PID:12252
- C:\Windows\System\ILbbKrO.exe
  C:\Windows\System\ILbbKrO.exe
  2⤵
  PID:11336
- C:\Windows\System\WhpUdqx.exe
  C:\Windows\System\WhpUdqx.exe
  2⤵
  PID:11528
- C:\Windows\System\OCofuaS.exe
  C:\Windows\System\OCofuaS.exe
  2⤵
  PID:11696
- C:\Windows\System\aBVQvdl.exe
  C:\Windows\System\aBVQvdl.exe
  2⤵
  PID:11820
- C:\Windows\System\QIoUvHB.exe
  C:\Windows\System\QIoUvHB.exe
  2⤵
  PID:12012
- C:\Windows\System\ljxMAYH.exe
  C:\Windows\System\ljxMAYH.exe
  2⤵
  PID:1760
- C:\Windows\System\wKfoSyl.exe
  C:\Windows\System\wKfoSyl.exe
  2⤵
  PID:10628
- C:\Windows\System\UEOLPjd.exe
  C:\Windows\System\UEOLPjd.exe
  2⤵
  PID:11484
- C:\Windows\System\kcleytv.exe
  C:\Windows\System\kcleytv.exe
  2⤵
  PID:11816
- C:\Windows\System\oZUxPfr.exe
  C:\Windows\System\oZUxPfr.exe
  2⤵
  PID:10472
- C:\Windows\System\GmiTgdR.exe
  C:\Windows\System\GmiTgdR.exe
  2⤵
  PID:12148
- C:\Windows\System\kQqKPFA.exe
  C:\Windows\System\kQqKPFA.exe
  2⤵
  PID:12300
- C:\Windows\System\eEXfGuM.exe
  C:\Windows\System\eEXfGuM.exe
  2⤵
  PID:12328
- C:\Windows\System\YFxaQvb.exe
  C:\Windows\System\YFxaQvb.exe
  2⤵
  PID:12344
- C:\Windows\System\VPWhzBO.exe
  C:\Windows\System\VPWhzBO.exe
  2⤵
  PID:12372
- C:\Windows\System\LrSWdSv.exe
  C:\Windows\System\LrSWdSv.exe
  2⤵
  PID:12400
- C:\Windows\System\xniRguo.exe
  C:\Windows\System\xniRguo.exe
  2⤵
  PID:12416
- C:\Windows\System\XkhsOGD.exe
  C:\Windows\System\XkhsOGD.exe
  2⤵
  PID:12456
- C:\Windows\System\JpAOzgb.exe
  C:\Windows\System\JpAOzgb.exe
  2⤵
  PID:12472
- C:\Windows\System\raSUiUm.exe
  C:\Windows\System\raSUiUm.exe
  2⤵
  PID:12504
- C:\Windows\System\CYxDfAp.exe
  C:\Windows\System\CYxDfAp.exe
  2⤵
  PID:12532
- C:\Windows\System\JQCQhtv.exe
  C:\Windows\System\JQCQhtv.exe
  2⤵
  PID:12556
- C:\Windows\System\ihqOhAe.exe
  C:\Windows\System\ihqOhAe.exe
  2⤵
  PID:12604
- C:\Windows\System\jHtEIbF.exe
  C:\Windows\System\jHtEIbF.exe
  2⤵
  PID:12636
- C:\Windows\System\pusFtWy.exe
  C:\Windows\System\pusFtWy.exe
  2⤵
  PID:12664
- C:\Windows\System\rEBIHxx.exe
  C:\Windows\System\rEBIHxx.exe
  2⤵
  PID:12692
- C:\Windows\System\HMksJDQ.exe
  C:\Windows\System\HMksJDQ.exe
  2⤵
  PID:12720
- C:\Windows\System\VXiBohY.exe
  C:\Windows\System\VXiBohY.exe
  2⤵
  PID:12748
- C:\Windows\System\MxptJCp.exe
  C:\Windows\System\MxptJCp.exe
  2⤵
  PID:12776
- C:\Windows\System\nKSVpDY.exe
  C:\Windows\System\nKSVpDY.exe
  2⤵
  PID:12804
- C:\Windows\System\CSAreBS.exe
  C:\Windows\System\CSAreBS.exe
  2⤵
  PID:12832
- C:\Windows\System\qvlqfmj.exe
  C:\Windows\System\qvlqfmj.exe
  2⤵
  PID:12848
- C:\Windows\System\rSvGJXD.exe
  C:\Windows\System\rSvGJXD.exe
  2⤵
  PID:12876
- C:\Windows\System\QEfWrRn.exe
  C:\Windows\System\QEfWrRn.exe
  2⤵
  PID:12896
- C:\Windows\System\PVcTcsu.exe
  C:\Windows\System\PVcTcsu.exe
  2⤵
  PID:12920
- C:\Windows\System\ujaXiML.exe
  C:\Windows\System\ujaXiML.exe
  2⤵
  PID:12964
- C:\Windows\System\EQnTbJN.exe
  C:\Windows\System\EQnTbJN.exe
  2⤵
  PID:12988
- C:\Windows\System\vcXOdru.exe
  C:\Windows\System\vcXOdru.exe
  2⤵
  PID:13028
- C:\Windows\System\OIMRxqP.exe
  C:\Windows\System\OIMRxqP.exe
  2⤵
  PID:13056
- C:\Windows\System\iZVYWWY.exe
  C:\Windows\System\iZVYWWY.exe
  2⤵
  PID:13076
- C:\Windows\System\DFuuraG.exe
  C:\Windows\System\DFuuraG.exe
  2⤵
  PID:13112
- C:\Windows\System\cvQtUAF.exe
  C:\Windows\System\cvQtUAF.exe
  2⤵
  PID:13128
- C:\Windows\System\lHFXUlC.exe
  C:\Windows\System\lHFXUlC.exe
  2⤵
  PID:13152
- C:\Windows\System\VDcngdM.exe
  C:\Windows\System\VDcngdM.exe
  2⤵
  PID:13184
- C:\Windows\System\MnvsitX.exe
  C:\Windows\System\MnvsitX.exe
  2⤵
  PID:13212
- C:\Windows\System\GVjKQOE.exe
  C:\Windows\System\GVjKQOE.exe
  2⤵
  PID:13228
- C:\Windows\System\LbTmAPv.exe
  C:\Windows\System\LbTmAPv.exe
  2⤵
  PID:13268
- C:\Windows\System\bdBIOjv.exe
  C:\Windows\System\bdBIOjv.exe
  2⤵
  PID:13308
- C:\Windows\System\hxvXLVo.exe
  C:\Windows\System\hxvXLVo.exe
  2⤵
  PID:12340
- C:\Windows\System\aYjuQZu.exe
  C:\Windows\System\aYjuQZu.exe
  2⤵
  PID:12360
- C:\Windows\System\aOELcJJ.exe
  C:\Windows\System\aOELcJJ.exe
  2⤵
  PID:12436
- C:\Windows\System\ZFYzhXR.exe
  C:\Windows\System\ZFYzhXR.exe
  2⤵
  PID:12488
- C:\Windows\System\IOOdddr.exe
  C:\Windows\System\IOOdddr.exe
  2⤵
  PID:3796
- C:\Windows\System\dOmzDjG.exe
  C:\Windows\System\dOmzDjG.exe
  2⤵
  PID:12648
- C:\Windows\System\uzLpuuR.exe
  C:\Windows\System\uzLpuuR.exe
  2⤵
  PID:12716
- C:\Windows\System\WddgWyU.exe
  C:\Windows\System\WddgWyU.exe
  2⤵
  PID:5088
- C:\Windows\System\hqcNcXV.exe
  C:\Windows\System\hqcNcXV.exe
  2⤵
  PID:12816
- C:\Windows\System\lLunqNC.exe
  C:\Windows\System\lLunqNC.exe
  2⤵
  PID:12864
- C:\Windows\System\OptooNv.exe
  C:\Windows\System\OptooNv.exe
  2⤵
  PID:12916
- C:\Windows\System\DqDhSDm.exe
  C:\Windows\System\DqDhSDm.exe
  2⤵
  PID:13012
- C:\Windows\System\wemLyiW.exe
  C:\Windows\System\wemLyiW.exe
  2⤵
  PID:3336
- C:\Windows\System\RcKvCyE.exe
  C:\Windows\System\RcKvCyE.exe
  2⤵
  PID:1132
- C:\Windows\System\xLEDnZn.exe
  C:\Windows\System\xLEDnZn.exe
  2⤵
  PID:13096
- C:\Windows\System\prznuMI.exe
  C:\Windows\System\prznuMI.exe
  2⤵
  PID:13140
- C:\Windows\System\KqhMhTB.exe
  C:\Windows\System\KqhMhTB.exe
  2⤵
  PID:13248
- C:\Windows\System\rwAKJKG.exe
  C:\Windows\System\rwAKJKG.exe
  2⤵
  PID:13304
- C:\Windows\System\VcdjMSP.exe
  C:\Windows\System\VcdjMSP.exe
  2⤵
  PID:12392
- C:\Windows\System\JQlIdMM.exe
  C:\Windows\System\JQlIdMM.exe
  2⤵
  PID:12540
- C:\Windows\System\MFwDRQp.exe
  C:\Windows\System\MFwDRQp.exe
  2⤵
  PID:12568
- C:\Windows\System\PWIivfc.exe
  C:\Windows\System\PWIivfc.exe
  2⤵
  PID:12820
- C:\Windows\System\LWOPzAQ.exe
  C:\Windows\System\LWOPzAQ.exe
  2⤵
  PID:13008
- C:\Windows\System\XaALZWD.exe
  C:\Windows\System\XaALZWD.exe
  2⤵
  PID:13160
- C:\Windows\System\QDfduAU.exe
  C:\Windows\System\QDfduAU.exe
  2⤵
  PID:13288
- C:\Windows\System\XOJmoeA.exe
  C:\Windows\System\XOJmoeA.exe
  2⤵
  PID:12368
- C:\Windows\System\CtQtbKw.exe
  C:\Windows\System\CtQtbKw.exe
  2⤵
  PID:12800
- C:\Windows\System\eYLTsyt.exe
  C:\Windows\System\eYLTsyt.exe
  2⤵
  PID:13088
- C:\Windows\System\lCvlGgh.exe
  C:\Windows\System\lCvlGgh.exe
  2⤵
  PID:12528
- C:\Windows\System\nYouYBG.exe
  C:\Windows\System\nYouYBG.exe
  2⤵
  PID:12356
- C:\Windows\System\PVwFejC.exe
  C:\Windows\System\PVwFejC.exe
  2⤵
  PID:13336
- C:\Windows\System\XBlVMXb.exe
  C:\Windows\System\XBlVMXb.exe
  2⤵
  PID:13364
- C:\Windows\System\CfsUhoO.exe
  C:\Windows\System\CfsUhoO.exe
  2⤵
  PID:13380
- C:\Windows\System\PvhNUTI.exe
  C:\Windows\System\PvhNUTI.exe
  2⤵
  PID:13408
- C:\Windows\System\hIpuBYH.exe
  C:\Windows\System\hIpuBYH.exe
  2⤵
  PID:13436
- C:\Windows\System\PGdqWUK.exe
  C:\Windows\System\PGdqWUK.exe
  2⤵
  PID:13464
- C:\Windows\System\lqCbLVc.exe
  C:\Windows\System\lqCbLVc.exe
  2⤵
  PID:13504
- C:\Windows\System\vublzQp.exe
  C:\Windows\System\vublzQp.exe
  2⤵
  PID:13532
- C:\Windows\System\bnjgaoG.exe
  C:\Windows\System\bnjgaoG.exe
  2⤵
  PID:13560
- C:\Windows\System\xjIAsZQ.exe
  C:\Windows\System\xjIAsZQ.exe
  2⤵
  PID:13588
- C:\Windows\System\OtetVtO.exe
  C:\Windows\System\OtetVtO.exe
  2⤵
  PID:13608
- C:\Windows\System\xlAWFIO.exe
  C:\Windows\System\xlAWFIO.exe
  2⤵
  PID:13632
- C:\Windows\System\Vgmspyn.exe
  C:\Windows\System\Vgmspyn.exe
  2⤵
  PID:13656
- C:\Windows\System\csVVcQz.exe
  C:\Windows\System\csVVcQz.exe
  2⤵
  PID:13680
- C:\Windows\System\IRdblkg.exe
  C:\Windows\System\IRdblkg.exe
  2⤵
  PID:13700
- C:\Windows\System\WzfYDvT.exe
  C:\Windows\System\WzfYDvT.exe
  2⤵
  PID:13728
- C:\Windows\System\mjOXZWY.exe
  C:\Windows\System\mjOXZWY.exe
  2⤵
  PID:13760
- C:\Windows\System\eAhVtbY.exe
  C:\Windows\System\eAhVtbY.exe
  2⤵
  PID:13796
- C:\Windows\System\MlcBwln.exe
  C:\Windows\System\MlcBwln.exe
  2⤵
  PID:13840
- C:\Windows\System\qOfCxVT.exe
  C:\Windows\System\qOfCxVT.exe
  2⤵
  PID:13860
- C:\Windows\System\auqnIfS.exe
  C:\Windows\System\auqnIfS.exe
  2⤵
  PID:13884
- C:\Windows\System\feFWiLm.exe
  C:\Windows\System\feFWiLm.exe
  2⤵
  PID:13924
- C:\Windows\System\UjDAqnt.exe
  C:\Windows\System\UjDAqnt.exe
  2⤵
  PID:13940
- C:\Windows\System\QbReYEX.exe
  C:\Windows\System\QbReYEX.exe
  2⤵
  PID:13960
- C:\Windows\System\YBXnvyf.exe
  C:\Windows\System\YBXnvyf.exe
  2⤵
  PID:13984
- C:\Windows\System\qBTZKoZ.exe
  C:\Windows\System\qBTZKoZ.exe
  2⤵
  PID:14028
- C:\Windows\System\bmFedLJ.exe
  C:\Windows\System\bmFedLJ.exe
  2⤵
  PID:14052
- C:\Windows\System\PRddaJb.exe
  C:\Windows\System\PRddaJb.exe
  2⤵
  PID:14080
- C:\Windows\System\gWWMGIV.exe
  C:\Windows\System\gWWMGIV.exe
  2⤵
  PID:14120
- C:\Windows\System\bdAkNAu.exe
  C:\Windows\System\bdAkNAu.exe
  2⤵
  PID:14148
- C:\Windows\System\YEJwowG.exe
  C:\Windows\System\YEJwowG.exe
  2⤵
  PID:14164
- C:\Windows\System\CyMzGXA.exe
  C:\Windows\System\CyMzGXA.exe
  2⤵
  PID:14204
- C:\Windows\System\ikXwKxu.exe
  C:\Windows\System\ikXwKxu.exe
  2⤵
  PID:14224
- C:\Windows\System\SvGtcqw.exe
  C:\Windows\System\SvGtcqw.exe
  2⤵
  PID:14248
- C:\Windows\System\YSJligj.exe
  C:\Windows\System\YSJligj.exe
  2⤵
  PID:14276
- C:\Windows\System\gjtAAOa.exe
  C:\Windows\System\gjtAAOa.exe
  2⤵
  PID:14316
- C:\Windows\System\rzWMjVb.exe
  C:\Windows\System\rzWMjVb.exe
  2⤵
  PID:12928
- C:\Windows\System\NRMnkLt.exe
  C:\Windows\System\NRMnkLt.exe
  2⤵
  PID:13348
- C:\Windows\System\TIfMloT.exe
  C:\Windows\System\TIfMloT.exe
  2⤵
  PID:13448
- C:\Windows\System\CQGodYM.exe
  C:\Windows\System\CQGodYM.exe
  2⤵
  PID:13500
- C:\Windows\System\NTUSrNe.exe
  C:\Windows\System\NTUSrNe.exe
  2⤵
  PID:13572
- C:\Windows\System\ocmpYHF.exe
  C:\Windows\System\ocmpYHF.exe
  2⤵
  PID:13648
- C:\Windows\System\PEPCdyv.exe
  C:\Windows\System\PEPCdyv.exe
  2⤵
  PID:13708
- C:\Windows\System\XZJhxnU.exe
  C:\Windows\System\XZJhxnU.exe
  2⤵
  PID:13780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BmfmITj.exe

Filesize
2.1MB

MD5
977df922df0e7f0eb8d08dd3a0f263a4

SHA1
4976060b88486d281375eaa42e84e484b737a128

SHA256
13d15c975ad8a3e9f62144279f60c5a597035a77d6e4ad06d89bb1cc4e055ae8

SHA512
b06ead92d4726d72676d5ca166a481941329da2bb772d08f34012056b72d506445bc1d389dbdb874429df5be78c75815ab368306e5f6840abea773816ced05ff

Download Submit
C:\Windows\System\DlJJzqA.exe

Filesize
2.1MB

MD5
ba2c9459bc9a1b477c40627afc5cd7a5

SHA1
3aa5d19ef38b41bdf4e7281fd3f6301d018e5948

SHA256
9a1fecd04f1a29edf32a1b1a53dce3737a2a51bbba4d6a5b010221c7c3a2505c

SHA512
8665738fd1d24037e0245e227290c7f36e1b494cab589fd57be9c444313f8df2e8528a510cbed8524b5e28f0a52babce4bf3c830096c7d5afa0c77cb06248f08

Download Submit
C:\Windows\System\FfEmVgu.exe

Filesize
2.0MB

MD5
af0aa8a9d143a0d869d1afdf7f1803b9

SHA1
a00f9fbad3b548cbcb570cc95e887d45143918c6

SHA256
d4817c995d35d7da7b6e026030d04bd5dd12925dd650a58ba444e162315991c3

SHA512
54a4d3d1efd6326e49ba43348a45fa03892b93078e02d75abe15a67e0a0331d3c808ff0cf00b812a14efd65525b83dea7a8d4554af8a478a0b54ad7f8cdb3bad

Download Submit
C:\Windows\System\HYlhsJv.exe

Filesize
2.1MB

MD5
c3fee878390ff872e112e024c4f368d9

SHA1
bcfff19ec1f558b917453e6469aa20868bdcb85b

SHA256
30daf1f5ea33bdd4b47506085cb2b0e2ac6aa6839f078d18d74a4825c36b3e92

SHA512
0880cdeafbe4cece591a52549a8547cc9111e164bf299018f6ff3d2e5cd9d2acd29c488a1da34a1aad3fe181e29c21f84788db694e98af13d4b759f789f80832

Download Submit
C:\Windows\System\IWGvlHm.exe

Filesize
2.1MB

MD5
7d5690d825377e6d94bfad33952faffa

SHA1
d61262df32e50e3e8af30d31fc41827900503ca9

SHA256
d1ea280cf0b79a2a2aebfc369b05264b1a94160fe7e9a349fb9e62d2a59c7687

SHA512
c0704cce4d2282aed3d5211d59ba0545cce04251ccfcf7b1c4948e39c7cbeea2b2481749df8ad9e3447f4f2120b737029be53b9a1828a65f4de1749d66a44bc8

Download Submit
C:\Windows\System\JMAMZpr.exe

Filesize
2.0MB

MD5
9aaabea83d369dd8188de7133e0a2b0e

SHA1
ce1de90b7b40aaebbd6d2885d83b4b96bfa71853

SHA256
88403f7e11b250a06408e1e83e97a2015f2164502061186bd7e7e4aec4f20cb7

SHA512
24b46473f6c6db2e2da5684f3adf54ad3ee669f5dd9926f050452cdf1480d044ca51fca7010fcfd554452443363c5a0fde9b65c0cf3d60967d4e661882d6d7a9

Download Submit
C:\Windows\System\JzGPRDg.exe

Filesize
2.1MB

MD5
f0a0deba83a7c9d580773e27089e0a40

SHA1
af6a724572e2f46c9cdd5fb48bdffad5425723f4

SHA256
7db6aa8d2cd16a1a6d86dadad27d450eaf8722f9b749a5b370d0679bfc3eb8e4

SHA512
8ebc2245804f0ffda109bb46e7eb17eb60629c84bf2b34ec3ca03859ca4bcbabae56213d0a1316ddd5cb7a1392ad9529cb8447c9d30b3d975e9a24da5e28ec89

Download Submit
C:\Windows\System\LjkhfYs.exe

Filesize
2.0MB

MD5
abdd68e0cc3f6299a1964c690631182e

SHA1
241c5d3c9233010dd73c06a80f54cb4150d412dc

SHA256
1334770b71ee79c50acb63b4e2400c813f692ba773f0f11b4518841619d43323

SHA512
4e2f37d6349a906d293d38b39990d2e9afac89401512f30547d22293d376eee498358949facd29b293ff61b1b20680b84c0ded2368629da9aee5aceb91c60fdb

Download Submit
C:\Windows\System\LuTvinv.exe

Filesize
2.0MB

MD5
fd9bad8edaf26d8ac48598612d0396a4

SHA1
5455f2b2515efed74e33e1bc6a5552cc0a8974b0

SHA256
2fe77a0a4ee34e11be61c3310bd27d8d03797af9f5ae0ef377a509a27c4854ae

SHA512
5c4600c1fa7340900e8d707f65c6c0fb68b39b4b23238ae9d08a72d042b150c0b63263cdf2d8a4f0412015851cc1c7a55673182ff2955b47459b2d2ca27a1158

Download Submit
C:\Windows\System\NwfOYAj.exe

Filesize
2.0MB

MD5
65b69618cd8ee59d59287f10e6fa9860

SHA1
895661cd61e287c7f612ad6470dfad3c7f6c8f52

SHA256
eafa8f5ded429c21464b0fc56764e1e7435c2cbc6a598524df8acff23361e100

SHA512
1d3d7a4e742030e54c186f07f50517d177130f8aa75100f1ee27b9bbaa099d3032a01acddb51550c1ec48fb28a6ac2d9db5b8144e448684ce74b1862317ce69f

Download Submit
C:\Windows\System\OLkHSUy.exe

Filesize
2.1MB

MD5
b2038e787358501aae4099d620e65f7b

SHA1
edb7b430ac136d5d7d18d2a259cdab4f865a6b94

SHA256
9ae0edc2213e0f3f73d1ecb8b298dbddcf93b29e404f6903928d49e2c12dec73

SHA512
3bb3cf7e940e5b754624401376a0e8de9bad688db98b9c17d01d128d96d5372dc4b8d850a703e25204c1ad546701a57efe234889bf2b07fd4fb9b3fbb6de3f3f

Download Submit
C:\Windows\System\QLocHoU.exe

Filesize
2.1MB

MD5
fd3a4773437b320c4541613dcf8dcb21

SHA1
31f7efd8e97a90fb2d3ed0b7da58ac4e29a29c1f

SHA256
a7a2cf24dd835eaa1dac092c783b013170b01d0e7ed6182d3ff8c77def2141b8

SHA512
e7b3e22126b297f95d0c5e5a112ca2f265e4bbfa5ce1ff4a9604360fd39584e01591eb6e774b6f8116e7e5545b2c3b6f645598df5e55de280b690a7acdbb1ec0

Download Submit
C:\Windows\System\RdcXoue.exe

Filesize
2.1MB

MD5
a8b12a378669fe3cf8fc6dc12eefac4d

SHA1
46a49ab9e5b68294fbf016069a6aee1a2a497be1

SHA256
ebf11a73a51067015585dc303ea98731b1932eb4b454ab7ee9494b76c037b9fe

SHA512
815d9eb4418e6aef327f2ee0a55cc9274a44de39d0073ca8803f0cba673441ed38c0ea236bbac8f7bfd35e8ad76f113409db853a9894c5bae2cb06318581c2ac

Download Submit
C:\Windows\System\STiUWCy.exe

Filesize
2.1MB

MD5
2e4de9a69ac871da341a743aaeb8484b

SHA1
2e375353abb5c477350059d7316cd1653019dd0d

SHA256
e42784c3eaddc252f6902594bf1d8e8b1b4bf2deb654ed3a78f89afae55acb3d

SHA512
0a4d010b8506abb69ea3c8c00fbf571c38ddd1142f4b0b4c112e35ae728b2455bcbbd693f6c0abc4a8665daffff50d8c57037ccff2a290dced7adf9c0cb68ee9

Download Submit
C:\Windows\System\UCofayl.exe

Filesize
2.1MB

MD5
6ebedae45011e96bb622f57775333e99

SHA1
5b86e95892509376cf07171c702d5f3f17a483c5

SHA256
4f11a8b8a29cd03edece116ba97aa1b0aff94fb1c51bb0f702ff88a252f891aa

SHA512
d514c49f5716efedeec6947cf617ce00add5ebfae4d8949ece98b600a6980bd851b6ef0c8d8722001c729a1199eed1d9c0754221739ac8d2fdb688862634d360

Download Submit
C:\Windows\System\VMgKwIY.exe

Filesize
2.1MB

MD5
e8ac7bf573c08c75ac85ff666766c64b

SHA1
59c823faac983dad4b00b923a836ec40c098fada

SHA256
4a350435f75d11b2841d29b85bde313fd91709edd946e8d55296feec4fa8405f

SHA512
c7784dca70a30695ab0e42d09ab7c1dbe1afbdffb5931aa28ca0e6c24273b6c935fa2f6e7d13c7abe9bb3023c490f04d268d60bd864f81666e9055f6bbb8b86c

Download Submit
C:\Windows\System\aKvEwYd.exe

Filesize
2.1MB

MD5
db511a3928ccc6cf7a6f544bc201e2e0

SHA1
3fae116986a6fe5da23ddec203f0b1f00f008681

SHA256
7281289350f509b2ddb5f7b37611f3e2b18b19595f5775768eb0b34f15114c3e

SHA512
823c0141fc49a2fdb66ccaecbd1e1cedbc6aeb17874f3d01792cc80fe2e78bb3a1ae2829289496a5d47a8c592935830ab144d3cf497ae5c921ab785b4068697f

Download Submit
C:\Windows\System\eEThgEk.exe

Filesize
2.0MB

MD5
c0b3a9068b89b87ecb33a969523b411a

SHA1
c66c438e24a095ed567c3bd999cefc6e18a9e937

SHA256
0ce99fe130fe2854fe039c8fa8c530577b30966688e318b2e1a1464d4449fb92

SHA512
294f7536155d2dfe439059970b4fe715daeb86f36b844eb9054569f994ab7a097e2ad37e2e5b5ff9fca8569af08d6d192a12357eaae3e14e16cb5d4c86791e85

Download Submit
C:\Windows\System\fBoeJyZ.exe

Filesize
2.0MB

MD5
83534a0d5ac224dd8de4331ccb74daba

SHA1
d94863bb94828ae79cdf4c8e7d21ecf74add2416

SHA256
68080e76506912681d629f676a6f42ea9dc8548451472ce695180f1acc35ab3a

SHA512
f05d60423e88a4f0c3e6fd0d12a9102ded3620fa8494988f310a4b7040a40f4a87fc87ea398199dc12489acacf96edf7c65378b76fd26fef336cc989e35b23b7

Download Submit
C:\Windows\System\hPGqfRW.exe

Filesize
2.1MB

MD5
320b5829ab7a5b8a31636a6afea81380

SHA1
de56cab228834ace3c42afe9d173e0e50ace2aad

SHA256
b16e5191d26afc88431546c8ee5bca1c1109b9a3d205dd030b9a675ff884465b

SHA512
f5cda6a3806d930b56e4ce5b5bdb65c14e8c573bf6531278833a573e4a655edcb5195490b725688e017b9cb2b6dd5c795166aef5cf8d0173e8ba3bff9052dcb3

Download Submit
C:\Windows\System\iQZSFfw.exe

Filesize
2.1MB

MD5
ed946b428a6e5d5f0e5e6f3b3f2c8e9b

SHA1
36b2a66f323bbd19d68d0924d422874c4a6948f2

SHA256
8e5d7e6f4f359c8c6a4b690f996e29cc58233a4f9ee1e8ccebd906be66d960a5

SHA512
f168399e78a9a17e41421016672d0d2703bc1a843032cc4be785f66bf705f88bc5e225c7a799dd49bae5707a2e31908e5b7fa68a9b6bbe7381a99654edbe4f7c

Download Submit
C:\Windows\System\iZzCJUn.exe

Filesize
2.1MB

MD5
affd5813ef7a27f2e6dd822d06a3eb91

SHA1
80ad23c4598a8367024070cef2f4bcf965bc36e9

SHA256
02de7c1e12cc9ba2ff228bf1f679d2e624160c1bb738389abeae2742dc25a43c

SHA512
2697df35f280e3c06f02253778bcf9aedf5e22be926df39e81706502dbd6d2b9af46abb09195be350e15e0f020ee66a7b79f86969774b17df159e1e5c23b1a40

Download Submit
C:\Windows\System\kUoOQTP.exe

Filesize
2.1MB

MD5
3cb44ff63c432f29bff8baa373e4ec0d

SHA1
6bf5b3bc9cfe898c8e58cd1b9fdeccf0a08e7049

SHA256
6177b6c9b014f18f62bf6943a828294db1a2bc6b75d25a45e7976b9c4de3d6d7

SHA512
d8c4228d32549c94b424e628a4ed5df3e21d35a71970d61287994933889d106601276396b77ab673d8ae75e585586c63b9c89f3862529900ac0aad05efb586f8

Download Submit
C:\Windows\System\mmHTfLN.exe

Filesize
2.1MB

MD5
45d634f3663d6abc48ddcad5cc42da6e

SHA1
af566c584a1b083e22cfb356870a5a084cd4b8fe

SHA256
c890dc6be0a7f85965b73b301280eb336313abe59445f53ee1994fabd46d13f6

SHA512
7432787cbb3e05117e21d8ba6d514038f3203376893c8b36e8bb53f9758086f89e62c3b6b00b2cd40295316537cddd31fbefc0d55f05c76862f9bc1dd947ccac

Download Submit
C:\Windows\System\niXhyGb.exe

Filesize
2.0MB

MD5
5f619e4741e1bcbedfcefb0a0575154c

SHA1
c31fe116dcfe0e516dfad665e62f08f44bb42666

SHA256
63ad7b46cb1dd0794e5d4065ae247cba15151b4d19cb95afd39ed305d79a8909

SHA512
914e7273cb0424271119ca2a50e267db1d7752a5924f16baa13d68a80f1c5f12383512e6833498da3dd580cb65066ddb8f270b1d06679d36ea465188fdddef60

Download Submit
C:\Windows\System\sYEuOEj.exe

Filesize
2.0MB

MD5
3f1abe6b705024a5b1b15484eb38760b

SHA1
0c80d8f6c5cf606c835ce8709f32abc0832ecabc

SHA256
197d3f0935a45d3208e4b34ecdbe5f32cef72d9749de9e60846d8088228c177a

SHA512
d8c02e5be5663c399a07d5b460612ca674645f21d779a3e071f090971421077b4e09e8fcab4b7ef8358f30aa9074816c9426c43b88cb0f22c82e3636308e0404

Download Submit
C:\Windows\System\sapNHPH.exe

Filesize
2.0MB

MD5
39b9f0d2691a4fbd7a30fd7caeb660f3

SHA1
2c00efa98a4cab70c2c18eb2dc018df2c96ca805

SHA256
4ae278dcbb594be17862c58514caff650c50e8867edf17553a190d1213503209

SHA512
ae9df129894f200518cee3b6a60426d06320279877a98b1249d5f7bf3b69d443c236cabec81782888d34ac5e2fe737e174f6c5b5371ed2783cad7d3a8e7c5851

Download Submit
C:\Windows\System\sdYddlN.exe

Filesize
2.0MB

MD5
7a055a489dc248be8829aaa51c2c8ced

SHA1
381ce0a7003e78e83f5add0046907fa4f14e08f1

SHA256
293da8552a7ca9d2294f53ac471a2a93a98952a31e43845a4b9ab97b8a549737

SHA512
b6824a3fdf8f3c5063ace1cc6cb5f85b181a17159d4b8bfe7e29fbdead9a45c963137822cd85ce9bb82085377c402ab8223c4a3c2be9a795ca10fb80fc2a9a13

Download Submit
C:\Windows\System\tuFChLv.exe

Filesize
2.1MB

MD5
61774b81320b983ee13a16d647f70fd3

SHA1
799d56a44692259e878fc4563dd78ef0cd46bbfe

SHA256
4952c8541caea7f6ba44740a1fc402d05be3f58ec097c259b271be307ab3b5c0

SHA512
baa1cbbc061e2cadcf53ca3fc22bb6dbfbb71232d0a4b7c02e880f21d25b5cc1cb56063e8f02fc2bb3b2014264e503d62a99d3944811473db79dacfeb426ec64

Download Submit
C:\Windows\System\vsTntUx.exe

Filesize
2.1MB

MD5
67ab60dd9f1f7d4704c535fd3609838b

SHA1
8648fe75bc6e380c498fd13c70adf9daadece24a

SHA256
a497ab4cebdd4ff3438f406b432f563ef3cca516a35dd488b765239f6ca190f5

SHA512
da2c6e2d9012107b389cf5af0f48eed7f96ac21a4065fa54a7d46c750223e7006914bff56aa58bf39fbe35f2924b2017863c1d50ccd7b07b9df78ba6250fe183

Download Submit
C:\Windows\System\vuBLOJw.exe

Filesize
2.0MB

MD5
8fb95a21533b1f3a10b2c7923ddf8bd9

SHA1
6c6e8522e1cb1f40c21eb7accd278603629099be

SHA256
1b4ee221c5da210cae45298feeab168b0f4fea7b65c0aae83521d70b1bd2a68e

SHA512
19c1f8e6075559a0bb9733465229a29e003579cf644acffffed8b3fbc667cd086b5822e438e4ce646ee2052c25d202777f4e5c09be5cf7a4fb93d41760a33209

Download Submit
C:\Windows\System\wKFJjHy.exe

Filesize
2.1MB

MD5
b6acf62bcd1cb2a0297d91f33a907e06

SHA1
16d78ebaefadfeebbfcceda74acd8d53bddf2b52

SHA256
f71a7284088183b2a50d9d0fc1395959dcb4afdcc06e2e5ac5add395383694a3

SHA512
c7ae727becaf153d7971e82509eebe9b8fcf74eb58396356e96e2e8b298d9b3874ee1f5039b14a9a5145db961c309845d5a0879af1a0ae07d196882ffa93b537

Download Submit
C:\Windows\System\wqRZVZD.exe

Filesize
2.0MB

MD5
94276aab0e2dbcfbf1b9fce060c62baf

SHA1
0048962c9e17941ee359554e346c1bf15375d2b1

SHA256
3bd822836e6bb676755eef7a471045bb68bc55cbbf7fd98c518c6bf7f4a84985

SHA512
7360fd906672c4c98bbf977c26c10cfbf3cd350f37ff05bbf298d57b96fa69cc09b3c66f653f349642eff5ced5e383cb7dbaddab64ea68833ef74aab6e977e3e

Download Submit
memory/528-2145-0x00007FF74CD80000-0x00007FF74D0D4000-memory.dmp

Filesize
3.3MB

Download
memory/528-599-0x00007FF74CD80000-0x00007FF74D0D4000-memory.dmp

Filesize
3.3MB

Download
memory/1064-630-0x00007FF762860000-0x00007FF762BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1064-2159-0x00007FF762860000-0x00007FF762BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1152-725-0x00007FF72E720000-0x00007FF72EA74000-memory.dmp

Filesize
3.3MB

Download
memory/1152-2171-0x00007FF72E720000-0x00007FF72EA74000-memory.dmp

Filesize
3.3MB

Download
memory/1188-2170-0x00007FF78F2A0000-0x00007FF78F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/1188-701-0x00007FF78F2A0000-0x00007FF78F5F4000-memory.dmp

Filesize
3.3MB

Download
memory/1220-2146-0x00007FF75BB00000-0x00007FF75BE54000-memory.dmp

Filesize
3.3MB

Download
memory/1220-607-0x00007FF75BB00000-0x00007FF75BE54000-memory.dmp

Filesize
3.3MB

Download
memory/1528-2157-0x00007FF7007A0000-0x00007FF700AF4000-memory.dmp

Filesize
3.3MB

Download
memory/1528-647-0x00007FF7007A0000-0x00007FF700AF4000-memory.dmp

Filesize
3.3MB

Download
memory/1732-2164-0x00007FF688990000-0x00007FF688CE4000-memory.dmp

Filesize
3.3MB

Download
memory/1732-696-0x00007FF688990000-0x00007FF688CE4000-memory.dmp

Filesize
3.3MB

Download
memory/1844-2144-0x00007FF65BC20000-0x00007FF65BF74000-memory.dmp

Filesize
3.3MB

Download
memory/1844-14-0x00007FF65BC20000-0x00007FF65BF74000-memory.dmp

Filesize
3.3MB

Download
memory/2004-2162-0x00007FF797970000-0x00007FF797CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2004-688-0x00007FF797970000-0x00007FF797CC4000-memory.dmp

Filesize
3.3MB

Download
memory/2020-665-0x00007FF633350000-0x00007FF6336A4000-memory.dmp

Filesize
3.3MB

Download
memory/2020-2151-0x00007FF633350000-0x00007FF6336A4000-memory.dmp

Filesize
3.3MB

Download
memory/2056-2160-0x00007FF769B00000-0x00007FF769E54000-memory.dmp

Filesize
3.3MB

Download
memory/2056-625-0x00007FF769B00000-0x00007FF769E54000-memory.dmp

Filesize
3.3MB

Download
memory/2344-2147-0x00007FF6476E0000-0x00007FF647A34000-memory.dmp

Filesize
3.3MB

Download
memory/2344-604-0x00007FF6476E0000-0x00007FF647A34000-memory.dmp

Filesize
3.3MB

Download
memory/2772-2154-0x00007FF7D26A0000-0x00007FF7D29F4000-memory.dmp

Filesize
3.3MB

Download
memory/2772-621-0x00007FF7D26A0000-0x00007FF7D29F4000-memory.dmp

Filesize
3.3MB

Download
memory/2884-663-0x00007FF769170000-0x00007FF7694C4000-memory.dmp

Filesize
3.3MB

Download
memory/2884-2152-0x00007FF769170000-0x00007FF7694C4000-memory.dmp

Filesize
3.3MB

Download
memory/3008-2148-0x00007FF6C39C0000-0x00007FF6C3D14000-memory.dmp

Filesize
3.3MB

Download
memory/3008-611-0x00007FF6C39C0000-0x00007FF6C3D14000-memory.dmp

Filesize
3.3MB

Download
memory/3076-0-0x00007FF739F80000-0x00007FF73A2D4000-memory.dmp

Filesize
3.3MB

Download
memory/3076-2142-0x00007FF739F80000-0x00007FF73A2D4000-memory.dmp

Filesize
3.3MB

Download
memory/3076-1-0x00000127CE280000-0x00000127CE290000-memory.dmp

Filesize
64KB

Download
memory/3240-2156-0x00007FF74D7C0000-0x00007FF74DB14000-memory.dmp

Filesize
3.3MB

Download
memory/3240-654-0x00007FF74D7C0000-0x00007FF74DB14000-memory.dmp

Filesize
3.3MB

Download
memory/3352-2161-0x00007FF7386B0000-0x00007FF738A04000-memory.dmp

Filesize
3.3MB

Download
memory/3352-685-0x00007FF7386B0000-0x00007FF738A04000-memory.dmp

Filesize
3.3MB

Download
memory/4460-2169-0x00007FF7A2BA0000-0x00007FF7A2EF4000-memory.dmp

Filesize
3.3MB

Download
memory/4460-705-0x00007FF7A2BA0000-0x00007FF7A2EF4000-memory.dmp

Filesize
3.3MB

Download
memory/4600-724-0x00007FF78F570000-0x00007FF78F8C4000-memory.dmp

Filesize
3.3MB

Download
memory/4600-2165-0x00007FF78F570000-0x00007FF78F8C4000-memory.dmp

Filesize
3.3MB

Download
memory/4608-640-0x00007FF6B68B0000-0x00007FF6B6C04000-memory.dmp

Filesize
3.3MB

Download
memory/4608-2158-0x00007FF6B68B0000-0x00007FF6B6C04000-memory.dmp

Filesize
3.3MB

Download
memory/4620-708-0x00007FF74DFA0000-0x00007FF74E2F4000-memory.dmp

Filesize
3.3MB

Download
memory/4620-2166-0x00007FF74DFA0000-0x00007FF74E2F4000-memory.dmp

Filesize
3.3MB

Download
memory/4752-13-0x00007FF6A4BA0000-0x00007FF6A4EF4000-memory.dmp

Filesize
3.3MB

Download
memory/4752-2143-0x00007FF6A4BA0000-0x00007FF6A4EF4000-memory.dmp

Filesize
3.3MB

Download
memory/4872-2150-0x00007FF635A20000-0x00007FF635D74000-memory.dmp

Filesize
3.3MB

Download
memory/4872-680-0x00007FF635A20000-0x00007FF635D74000-memory.dmp

Filesize
3.3MB

Download
memory/4896-2153-0x00007FF67C200000-0x00007FF67C554000-memory.dmp

Filesize
3.3MB

Download
memory/4896-635-0x00007FF67C200000-0x00007FF67C554000-memory.dmp

Filesize
3.3MB

Download
memory/4900-717-0x00007FF6674A0000-0x00007FF6677F4000-memory.dmp

Filesize
3.3MB

Download
memory/4900-2167-0x00007FF6674A0000-0x00007FF6677F4000-memory.dmp

Filesize
3.3MB

Download
memory/4956-2149-0x00007FF6699D0000-0x00007FF669D24000-memory.dmp

Filesize
3.3MB

Download
memory/4956-683-0x00007FF6699D0000-0x00007FF669D24000-memory.dmp

Filesize
3.3MB

Download
memory/4976-711-0x00007FF666E80000-0x00007FF6671D4000-memory.dmp

Filesize
3.3MB

Download
memory/4976-2168-0x00007FF666E80000-0x00007FF6671D4000-memory.dmp

Filesize
3.3MB

Download
memory/5004-2155-0x00007FF69A8F0000-0x00007FF69AC44000-memory.dmp

Filesize
3.3MB

Download
memory/5004-618-0x00007FF69A8F0000-0x00007FF69AC44000-memory.dmp

Filesize
3.3MB

Download
memory/5076-2163-0x00007FF7E9A10000-0x00007FF7E9D64000-memory.dmp

Filesize
3.3MB

Download
memory/5076-691-0x00007FF7E9A10000-0x00007FF7E9D64000-memory.dmp

Filesize
3.3MB

Download