xmrig | fff2afbc4de0c7904e12e35c8fd80220f33fdbde91de31c955c329be5fd7c269

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
Size

1.9MB
MD5

f7e575a65b43ac07f7d351fe01225db0
SHA1

e8b2b2401b187cea75045e9a4544c6f79c380ff8
SHA256

fff2afbc4de0c7904e12e35c8fd80220f33fdbde91de31c955c329be5fd7c269
SHA512

3a7105a280ee25d17e1e971188215aa49c06d89b4d3532ca863d57e6fb1318f5fdf163869485fddcadf527759ef71589fbf9cd631b23fd419faf5969176ce5ad
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+AjEPm:BemTLkNdfE0pZrE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2948-0-0x00007FF720B10000-0x00007FF720E64000-memory.dmp	xmrig
behavioral2/files/0x000700000002328e-5.dat	xmrig
behavioral2/files/0x0008000000023404-10.dat	xmrig
behavioral2/files/0x0007000000023405-20.dat	xmrig
behavioral2/files/0x0007000000023406-26.dat	xmrig
behavioral2/files/0x0007000000023407-44.dat	xmrig
behavioral2/files/0x0007000000023409-49.dat	xmrig
behavioral2/files/0x000700000002340b-58.dat	xmrig
behavioral2/files/0x000700000002340f-75.dat	xmrig
behavioral2/files/0x0007000000023411-85.dat	xmrig
behavioral2/files/0x0007000000023414-104.dat	xmrig
behavioral2/files/0x000700000002341a-130.dat	xmrig
behavioral2/files/0x000700000002341d-145.dat	xmrig
behavioral2/files/0x0007000000023421-165.dat	xmrig
behavioral2/memory/3316-541-0x00007FF6F4500000-0x00007FF6F4854000-memory.dmp	xmrig
behavioral2/memory/1456-542-0x00007FF69E8D0000-0x00007FF69EC24000-memory.dmp	xmrig
behavioral2/memory/2104-544-0x00007FF7E9FC0000-0x00007FF7EA314000-memory.dmp	xmrig
behavioral2/memory/4416-546-0x00007FF747410000-0x00007FF747764000-memory.dmp	xmrig
behavioral2/memory/3180-553-0x00007FF74C7B0000-0x00007FF74CB04000-memory.dmp	xmrig
behavioral2/memory/5040-577-0x00007FF741AF0000-0x00007FF741E44000-memory.dmp	xmrig
behavioral2/memory/2564-585-0x00007FF7FA6A0000-0x00007FF7FA9F4000-memory.dmp	xmrig
behavioral2/memory/3272-589-0x00007FF6BD0D0000-0x00007FF6BD424000-memory.dmp	xmrig
behavioral2/memory/1692-609-0x00007FF6DCF30000-0x00007FF6DD284000-memory.dmp	xmrig
behavioral2/memory/3860-619-0x00007FF68E9F0000-0x00007FF68ED44000-memory.dmp	xmrig
behavioral2/memory/3692-628-0x00007FF7BDDC0000-0x00007FF7BE114000-memory.dmp	xmrig
behavioral2/memory/4376-636-0x00007FF7769A0000-0x00007FF776CF4000-memory.dmp	xmrig
behavioral2/memory/980-643-0x00007FF6FD680000-0x00007FF6FD9D4000-memory.dmp	xmrig
behavioral2/memory/4596-626-0x00007FF7F6F90000-0x00007FF7F72E4000-memory.dmp	xmrig
behavioral2/memory/2304-616-0x00007FF7E4990000-0x00007FF7E4CE4000-memory.dmp	xmrig
behavioral2/memory/2188-595-0x00007FF6ACE20000-0x00007FF6AD174000-memory.dmp	xmrig
behavioral2/memory/4920-567-0x00007FF7A6E70000-0x00007FF7A71C4000-memory.dmp	xmrig
behavioral2/memory/1852-563-0x00007FF750450000-0x00007FF7507A4000-memory.dmp	xmrig
behavioral2/memory/4044-671-0x00007FF736240000-0x00007FF736594000-memory.dmp	xmrig
behavioral2/memory/3216-667-0x00007FF6D3CE0000-0x00007FF6D4034000-memory.dmp	xmrig
behavioral2/memory/3580-664-0x00007FF79AE10000-0x00007FF79B164000-memory.dmp	xmrig
behavioral2/memory/3492-658-0x00007FF6AAA50000-0x00007FF6AADA4000-memory.dmp	xmrig
behavioral2/memory/5064-556-0x00007FF771BD0000-0x00007FF771F24000-memory.dmp	xmrig
behavioral2/memory/1080-688-0x00007FF70E5D0000-0x00007FF70E924000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-168.dat	xmrig
behavioral2/files/0x0007000000023420-163.dat	xmrig
behavioral2/files/0x000700000002341f-159.dat	xmrig
behavioral2/files/0x000700000002341e-154.dat	xmrig
behavioral2/files/0x000700000002341c-143.dat	xmrig
behavioral2/files/0x000700000002341b-139.dat	xmrig
behavioral2/files/0x0007000000023419-128.dat	xmrig
behavioral2/files/0x0007000000023418-124.dat	xmrig
behavioral2/files/0x0007000000023417-118.dat	xmrig
behavioral2/files/0x0007000000023416-114.dat	xmrig
behavioral2/files/0x0007000000023415-108.dat	xmrig
behavioral2/files/0x0007000000023413-98.dat	xmrig
behavioral2/files/0x0007000000023412-91.dat	xmrig
behavioral2/files/0x0007000000023410-81.dat	xmrig
behavioral2/files/0x000700000002340e-71.dat	xmrig
behavioral2/files/0x000700000002340d-66.dat	xmrig
behavioral2/files/0x000700000002340c-64.dat	xmrig
behavioral2/files/0x000700000002340a-54.dat	xmrig
behavioral2/files/0x0007000000023408-41.dat	xmrig
behavioral2/memory/3420-32-0x00007FF7B7450000-0x00007FF7B77A4000-memory.dmp	xmrig
behavioral2/memory/1076-27-0x00007FF6BDA70000-0x00007FF6BDDC4000-memory.dmp	xmrig
behavioral2/memory/2264-23-0x00007FF75D3B0000-0x00007FF75D704000-memory.dmp	xmrig
behavioral2/memory/2992-16-0x00007FF66B120000-0x00007FF66B474000-memory.dmp	xmrig
behavioral2/files/0x00090000000233fe-12.dat	xmrig
behavioral2/memory/3424-8-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp	xmrig
behavioral2/memory/3424-2144-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3424	CWeVtpn.exe
2992	ECtnTOI.exe
2264	DFkwTUC.exe
1076	nDziNoq.exe
3420	ihAMzjW.exe
3316	wmFsaYR.exe
1456	XgAPopl.exe
2104	BfmCUJT.exe
4416	IdITDhD.exe
3180	xRfoztO.exe
5064	ZcSZvyy.exe
1852	mcMMdLJ.exe
4920	PqOBDro.exe
5040	sJIDQLf.exe
2564	paNQuCv.exe
3272	VWKXJDc.exe
2188	bNVzwiw.exe
1692	sDlmVOi.exe
2304	EuGrJzM.exe
3860	NzgcqsP.exe
4596	UMXrxhQ.exe
3692	VMRloHe.exe
4376	iwIjMMM.exe
980	BkwLNLo.exe
3492	HKYluGG.exe
3580	lTpgwlj.exe
3216	OMwhjxT.exe
4044	YyDufnu.exe
1080	dnSrLDZ.exe
4956	ZMiyRmy.exe
1640	WsdBcpf.exe
4984	BloRXOk.exe
1084	dthdana.exe
3136	vwuQiAI.exe
2308	aqXTNSJ.exe
4824	vrGopAL.exe
1380	pNxcHxK.exe
1184	QBhBxdH.exe
492	VEfUMpZ.exe
1420	VzgvGWz.exe
4964	OmfqEqj.exe
1600	XLCMLxG.exe
2300	POpYiQo.exe
784	uUykRZO.exe
4612	vorezOp.exe
1388	jiOoLjy.exe
1204	UIKHhtT.exe
3832	VolNlCc.exe
4880	BkLBwTY.exe
3700	RwDkBMM.exe
3568	aGDklzC.exe
1684	pgIQaQG.exe
4896	XABFGpe.exe
3684	RxRrnFS.exe
2888	uEXitay.exe
3204	bOzWpWz.exe
1536	jYONrni.exe
4556	TLYbIXv.exe
2604	FYyhVsh.exe
3292	SLbrvze.exe
4516	HfvYkjZ.exe
3376	ozfWjba.exe
3472	LCOSSyA.exe
4544	HvXSkbW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2948-0-0x00007FF720B10000-0x00007FF720E64000-memory.dmp	upx
behavioral2/files/0x000700000002328e-5.dat	upx
behavioral2/files/0x0008000000023404-10.dat	upx
behavioral2/files/0x0007000000023405-20.dat	upx
behavioral2/files/0x0007000000023406-26.dat	upx
behavioral2/files/0x0007000000023407-44.dat	upx
behavioral2/files/0x0007000000023409-49.dat	upx
behavioral2/files/0x000700000002340b-58.dat	upx
behavioral2/files/0x000700000002340f-75.dat	upx
behavioral2/files/0x0007000000023411-85.dat	upx
behavioral2/files/0x0007000000023414-104.dat	upx
behavioral2/files/0x000700000002341a-130.dat	upx
behavioral2/files/0x000700000002341d-145.dat	upx
behavioral2/files/0x0007000000023421-165.dat	upx
behavioral2/memory/3316-541-0x00007FF6F4500000-0x00007FF6F4854000-memory.dmp	upx
behavioral2/memory/1456-542-0x00007FF69E8D0000-0x00007FF69EC24000-memory.dmp	upx
behavioral2/memory/2104-544-0x00007FF7E9FC0000-0x00007FF7EA314000-memory.dmp	upx
behavioral2/memory/4416-546-0x00007FF747410000-0x00007FF747764000-memory.dmp	upx
behavioral2/memory/3180-553-0x00007FF74C7B0000-0x00007FF74CB04000-memory.dmp	upx
behavioral2/memory/5040-577-0x00007FF741AF0000-0x00007FF741E44000-memory.dmp	upx
behavioral2/memory/2564-585-0x00007FF7FA6A0000-0x00007FF7FA9F4000-memory.dmp	upx
behavioral2/memory/3272-589-0x00007FF6BD0D0000-0x00007FF6BD424000-memory.dmp	upx
behavioral2/memory/1692-609-0x00007FF6DCF30000-0x00007FF6DD284000-memory.dmp	upx
behavioral2/memory/3860-619-0x00007FF68E9F0000-0x00007FF68ED44000-memory.dmp	upx
behavioral2/memory/3692-628-0x00007FF7BDDC0000-0x00007FF7BE114000-memory.dmp	upx
behavioral2/memory/4376-636-0x00007FF7769A0000-0x00007FF776CF4000-memory.dmp	upx
behavioral2/memory/980-643-0x00007FF6FD680000-0x00007FF6FD9D4000-memory.dmp	upx
behavioral2/memory/4596-626-0x00007FF7F6F90000-0x00007FF7F72E4000-memory.dmp	upx
behavioral2/memory/2304-616-0x00007FF7E4990000-0x00007FF7E4CE4000-memory.dmp	upx
behavioral2/memory/2188-595-0x00007FF6ACE20000-0x00007FF6AD174000-memory.dmp	upx
behavioral2/memory/4920-567-0x00007FF7A6E70000-0x00007FF7A71C4000-memory.dmp	upx
behavioral2/memory/1852-563-0x00007FF750450000-0x00007FF7507A4000-memory.dmp	upx
behavioral2/memory/4044-671-0x00007FF736240000-0x00007FF736594000-memory.dmp	upx
behavioral2/memory/3216-667-0x00007FF6D3CE0000-0x00007FF6D4034000-memory.dmp	upx
behavioral2/memory/3580-664-0x00007FF79AE10000-0x00007FF79B164000-memory.dmp	upx
behavioral2/memory/3492-658-0x00007FF6AAA50000-0x00007FF6AADA4000-memory.dmp	upx
behavioral2/memory/5064-556-0x00007FF771BD0000-0x00007FF771F24000-memory.dmp	upx
behavioral2/memory/1080-688-0x00007FF70E5D0000-0x00007FF70E924000-memory.dmp	upx
behavioral2/files/0x0007000000023422-168.dat	upx
behavioral2/files/0x0007000000023420-163.dat	upx
behavioral2/files/0x000700000002341f-159.dat	upx
behavioral2/files/0x000700000002341e-154.dat	upx
behavioral2/files/0x000700000002341c-143.dat	upx
behavioral2/files/0x000700000002341b-139.dat	upx
behavioral2/files/0x0007000000023419-128.dat	upx
behavioral2/files/0x0007000000023418-124.dat	upx
behavioral2/files/0x0007000000023417-118.dat	upx
behavioral2/files/0x0007000000023416-114.dat	upx
behavioral2/files/0x0007000000023415-108.dat	upx
behavioral2/files/0x0007000000023413-98.dat	upx
behavioral2/files/0x0007000000023412-91.dat	upx
behavioral2/files/0x0007000000023410-81.dat	upx
behavioral2/files/0x000700000002340e-71.dat	upx
behavioral2/files/0x000700000002340d-66.dat	upx
behavioral2/files/0x000700000002340c-64.dat	upx
behavioral2/files/0x000700000002340a-54.dat	upx
behavioral2/files/0x0007000000023408-41.dat	upx
behavioral2/memory/3420-32-0x00007FF7B7450000-0x00007FF7B77A4000-memory.dmp	upx
behavioral2/memory/1076-27-0x00007FF6BDA70000-0x00007FF6BDDC4000-memory.dmp	upx
behavioral2/memory/2264-23-0x00007FF75D3B0000-0x00007FF75D704000-memory.dmp	upx
behavioral2/memory/2992-16-0x00007FF66B120000-0x00007FF66B474000-memory.dmp	upx
behavioral2/files/0x00090000000233fe-12.dat	upx
behavioral2/memory/3424-8-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp	upx
behavioral2/memory/3424-2144-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kihpHxm.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\kwogApF.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\aGDklzC.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\GxpcdOR.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\tTEvXIi.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\TjcHoRR.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\fUCXEun.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\zbOzSWk.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\AMSxGYW.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\iBSQikV.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\WbHeawK.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\RfCjZXS.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\KXoJgYm.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\OhYYTnS.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\eJoWSXm.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\aDomJgK.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\OphBuJe.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\lwPIZGt.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\yopcfzu.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\qHsrpNB.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\dhTrMds.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\ODOQMLN.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\Vatsqhw.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\gCHSpFm.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\wvETgzF.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\mtCkJzR.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\RiTWyOX.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\wqVlcUx.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\MWxuLiL.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\XJMQJFy.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\QeZdknA.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\GKddsXp.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\IPuuyZk.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\PrDnDAL.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\vorezOp.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\oRTCEjn.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\PVsXgHy.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\mFzlGlY.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\fUpQOTi.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\lTpgwlj.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\yEtFOKz.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\IdJsWPM.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\MSWgGhY.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\lzllOsB.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\sBkMYYP.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\IeMikTZ.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\MVtWnaf.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\LCOSSyA.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\CVlcFGH.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\pwLbqGL.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\OOVooCa.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\ubiMBCp.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\vUJWgNu.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\QGnJVpz.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\Juarkqu.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\OHCsLWs.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\WOMsWby.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\jznEAhV.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\uRzmFBG.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\xBArOKi.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\ytQaeEy.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\jVEYoAy.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\iYVfElv.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
File created	C:\Windows\System\SZwOExV.exe	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3424	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	81
PID 2948 wrote to memory of 3424	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	81
PID 2948 wrote to memory of 2992	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	82
PID 2948 wrote to memory of 2992	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	82
PID 2948 wrote to memory of 2264	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	84
PID 2948 wrote to memory of 2264	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	84
PID 2948 wrote to memory of 1076	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	85
PID 2948 wrote to memory of 1076	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	85
PID 2948 wrote to memory of 3420	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	86
PID 2948 wrote to memory of 3420	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	86
PID 2948 wrote to memory of 1456	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	87
PID 2948 wrote to memory of 1456	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	87
PID 2948 wrote to memory of 3316	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	88
PID 2948 wrote to memory of 3316	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	88
PID 2948 wrote to memory of 2104	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	89
PID 2948 wrote to memory of 2104	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	89
PID 2948 wrote to memory of 4416	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	90
PID 2948 wrote to memory of 4416	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	90
PID 2948 wrote to memory of 3180	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	91
PID 2948 wrote to memory of 3180	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	91
PID 2948 wrote to memory of 5064	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	92
PID 2948 wrote to memory of 5064	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	92
PID 2948 wrote to memory of 1852	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	93
PID 2948 wrote to memory of 1852	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	93
PID 2948 wrote to memory of 4920	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	94
PID 2948 wrote to memory of 4920	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	94
PID 2948 wrote to memory of 5040	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	95
PID 2948 wrote to memory of 5040	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	95
PID 2948 wrote to memory of 2564	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	96
PID 2948 wrote to memory of 2564	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	96
PID 2948 wrote to memory of 3272	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	97
PID 2948 wrote to memory of 3272	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	97
PID 2948 wrote to memory of 2188	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	98
PID 2948 wrote to memory of 2188	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	98
PID 2948 wrote to memory of 1692	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	99
PID 2948 wrote to memory of 1692	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	99
PID 2948 wrote to memory of 2304	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	100
PID 2948 wrote to memory of 2304	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	100
PID 2948 wrote to memory of 3860	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	101
PID 2948 wrote to memory of 3860	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	101
PID 2948 wrote to memory of 4596	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	102
PID 2948 wrote to memory of 4596	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	102
PID 2948 wrote to memory of 3692	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	103
PID 2948 wrote to memory of 3692	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	103
PID 2948 wrote to memory of 4376	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	104
PID 2948 wrote to memory of 4376	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	104
PID 2948 wrote to memory of 980	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	105
PID 2948 wrote to memory of 980	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	105
PID 2948 wrote to memory of 3492	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	106
PID 2948 wrote to memory of 3492	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	106
PID 2948 wrote to memory of 3580	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	107
PID 2948 wrote to memory of 3580	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	107
PID 2948 wrote to memory of 3216	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	108
PID 2948 wrote to memory of 3216	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	108
PID 2948 wrote to memory of 4044	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	109
PID 2948 wrote to memory of 4044	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	109
PID 2948 wrote to memory of 1080	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	110
PID 2948 wrote to memory of 1080	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	110
PID 2948 wrote to memory of 4956	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	111
PID 2948 wrote to memory of 4956	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	111
PID 2948 wrote to memory of 1640	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	112
PID 2948 wrote to memory of 1640	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	112
PID 2948 wrote to memory of 4984	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	113
PID 2948 wrote to memory of 4984	2948	f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe	113

C:\Users\Admin\AppData\Local\Temp\f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\f7e575a65b43ac07f7d351fe01225db0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\System\CWeVtpn.exe
  C:\Windows\System\CWeVtpn.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\ECtnTOI.exe
  C:\Windows\System\ECtnTOI.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\DFkwTUC.exe
  C:\Windows\System\DFkwTUC.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\nDziNoq.exe
  C:\Windows\System\nDziNoq.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\ihAMzjW.exe
  C:\Windows\System\ihAMzjW.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\XgAPopl.exe
  C:\Windows\System\XgAPopl.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\wmFsaYR.exe
  C:\Windows\System\wmFsaYR.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\BfmCUJT.exe
  C:\Windows\System\BfmCUJT.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\IdITDhD.exe
  C:\Windows\System\IdITDhD.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\xRfoztO.exe
  C:\Windows\System\xRfoztO.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\ZcSZvyy.exe
  C:\Windows\System\ZcSZvyy.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\mcMMdLJ.exe
  C:\Windows\System\mcMMdLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\PqOBDro.exe
  C:\Windows\System\PqOBDro.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\sJIDQLf.exe
  C:\Windows\System\sJIDQLf.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\paNQuCv.exe
  C:\Windows\System\paNQuCv.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\VWKXJDc.exe
  C:\Windows\System\VWKXJDc.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\bNVzwiw.exe
  C:\Windows\System\bNVzwiw.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\sDlmVOi.exe
  C:\Windows\System\sDlmVOi.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\EuGrJzM.exe
  C:\Windows\System\EuGrJzM.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\NzgcqsP.exe
  C:\Windows\System\NzgcqsP.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\UMXrxhQ.exe
  C:\Windows\System\UMXrxhQ.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\VMRloHe.exe
  C:\Windows\System\VMRloHe.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\iwIjMMM.exe
  C:\Windows\System\iwIjMMM.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\BkwLNLo.exe
  C:\Windows\System\BkwLNLo.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\HKYluGG.exe
  C:\Windows\System\HKYluGG.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\lTpgwlj.exe
  C:\Windows\System\lTpgwlj.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\OMwhjxT.exe
  C:\Windows\System\OMwhjxT.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\YyDufnu.exe
  C:\Windows\System\YyDufnu.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\dnSrLDZ.exe
  C:\Windows\System\dnSrLDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\ZMiyRmy.exe
  C:\Windows\System\ZMiyRmy.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\WsdBcpf.exe
  C:\Windows\System\WsdBcpf.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\BloRXOk.exe
  C:\Windows\System\BloRXOk.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\dthdana.exe
  C:\Windows\System\dthdana.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\vwuQiAI.exe
  C:\Windows\System\vwuQiAI.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\aqXTNSJ.exe
  C:\Windows\System\aqXTNSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\vrGopAL.exe
  C:\Windows\System\vrGopAL.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\pNxcHxK.exe
  C:\Windows\System\pNxcHxK.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\QBhBxdH.exe
  C:\Windows\System\QBhBxdH.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\VEfUMpZ.exe
  C:\Windows\System\VEfUMpZ.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\VzgvGWz.exe
  C:\Windows\System\VzgvGWz.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\OmfqEqj.exe
  C:\Windows\System\OmfqEqj.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\XLCMLxG.exe
  C:\Windows\System\XLCMLxG.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\POpYiQo.exe
  C:\Windows\System\POpYiQo.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\uUykRZO.exe
  C:\Windows\System\uUykRZO.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\vorezOp.exe
  C:\Windows\System\vorezOp.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\jiOoLjy.exe
  C:\Windows\System\jiOoLjy.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\UIKHhtT.exe
  C:\Windows\System\UIKHhtT.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\VolNlCc.exe
  C:\Windows\System\VolNlCc.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\BkLBwTY.exe
  C:\Windows\System\BkLBwTY.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\RwDkBMM.exe
  C:\Windows\System\RwDkBMM.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\aGDklzC.exe
  C:\Windows\System\aGDklzC.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\pgIQaQG.exe
  C:\Windows\System\pgIQaQG.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\XABFGpe.exe
  C:\Windows\System\XABFGpe.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\RxRrnFS.exe
  C:\Windows\System\RxRrnFS.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\uEXitay.exe
  C:\Windows\System\uEXitay.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\bOzWpWz.exe
  C:\Windows\System\bOzWpWz.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\jYONrni.exe
  C:\Windows\System\jYONrni.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\TLYbIXv.exe
  C:\Windows\System\TLYbIXv.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\FYyhVsh.exe
  C:\Windows\System\FYyhVsh.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\SLbrvze.exe
  C:\Windows\System\SLbrvze.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\HfvYkjZ.exe
  C:\Windows\System\HfvYkjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\ozfWjba.exe
  C:\Windows\System\ozfWjba.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\LCOSSyA.exe
  C:\Windows\System\LCOSSyA.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\HvXSkbW.exe
  C:\Windows\System\HvXSkbW.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\alYBVrc.exe
  C:\Windows\System\alYBVrc.exe
  2⤵
  PID:4216
- C:\Windows\System\jEiYQXd.exe
  C:\Windows\System\jEiYQXd.exe
  2⤵
  PID:1864
- C:\Windows\System\GIBZVWt.exe
  C:\Windows\System\GIBZVWt.exe
  2⤵
  PID:2352
- C:\Windows\System\yEtFOKz.exe
  C:\Windows\System\yEtFOKz.exe
  2⤵
  PID:556
- C:\Windows\System\veNKyle.exe
  C:\Windows\System\veNKyle.exe
  2⤵
  PID:2256
- C:\Windows\System\bHfxnpV.exe
  C:\Windows\System\bHfxnpV.exe
  2⤵
  PID:640
- C:\Windows\System\zixhvfD.exe
  C:\Windows\System\zixhvfD.exe
  2⤵
  PID:3140
- C:\Windows\System\cLamCgM.exe
  C:\Windows\System\cLamCgM.exe
  2⤵
  PID:1576
- C:\Windows\System\IdJsWPM.exe
  C:\Windows\System\IdJsWPM.exe
  2⤵
  PID:456
- C:\Windows\System\WnsRTMo.exe
  C:\Windows\System\WnsRTMo.exe
  2⤵
  PID:4408
- C:\Windows\System\OQClqfu.exe
  C:\Windows\System\OQClqfu.exe
  2⤵
  PID:752
- C:\Windows\System\DMEicTV.exe
  C:\Windows\System\DMEicTV.exe
  2⤵
  PID:4112
- C:\Windows\System\wwCBWzT.exe
  C:\Windows\System\wwCBWzT.exe
  2⤵
  PID:2772
- C:\Windows\System\GxpcdOR.exe
  C:\Windows\System\GxpcdOR.exe
  2⤵
  PID:3576
- C:\Windows\System\WeWrYrL.exe
  C:\Windows\System\WeWrYrL.exe
  2⤵
  PID:4528
- C:\Windows\System\ohoryML.exe
  C:\Windows\System\ohoryML.exe
  2⤵
  PID:3344
- C:\Windows\System\iiwHSfB.exe
  C:\Windows\System\iiwHSfB.exe
  2⤵
  PID:4860
- C:\Windows\System\IsXXfqZ.exe
  C:\Windows\System\IsXXfqZ.exe
  2⤵
  PID:4124
- C:\Windows\System\mJduBWf.exe
  C:\Windows\System\mJduBWf.exe
  2⤵
  PID:4304
- C:\Windows\System\pYqxTju.exe
  C:\Windows\System\pYqxTju.exe
  2⤵
  PID:1952
- C:\Windows\System\tTEvXIi.exe
  C:\Windows\System\tTEvXIi.exe
  2⤵
  PID:4524
- C:\Windows\System\EZhShKi.exe
  C:\Windows\System\EZhShKi.exe
  2⤵
  PID:2996
- C:\Windows\System\efTIYzo.exe
  C:\Windows\System\efTIYzo.exe
  2⤵
  PID:2692
- C:\Windows\System\GKUMQaD.exe
  C:\Windows\System\GKUMQaD.exe
  2⤵
  PID:4076
- C:\Windows\System\zVzGwBs.exe
  C:\Windows\System\zVzGwBs.exe
  2⤵
  PID:2380
- C:\Windows\System\dZwzZRM.exe
  C:\Windows\System\dZwzZRM.exe
  2⤵
  PID:1188
- C:\Windows\System\hsohTHS.exe
  C:\Windows\System\hsohTHS.exe
  2⤵
  PID:4088
- C:\Windows\System\CVlcFGH.exe
  C:\Windows\System\CVlcFGH.exe
  2⤵
  PID:3724
- C:\Windows\System\IbSWbbY.exe
  C:\Windows\System\IbSWbbY.exe
  2⤵
  PID:5124
- C:\Windows\System\TjcHoRR.exe
  C:\Windows\System\TjcHoRR.exe
  2⤵
  PID:5152
- C:\Windows\System\OGDsgxz.exe
  C:\Windows\System\OGDsgxz.exe
  2⤵
  PID:5180
- C:\Windows\System\FuNZodd.exe
  C:\Windows\System\FuNZodd.exe
  2⤵
  PID:5208
- C:\Windows\System\SZwOExV.exe
  C:\Windows\System\SZwOExV.exe
  2⤵
  PID:5236
- C:\Windows\System\vGyGKhA.exe
  C:\Windows\System\vGyGKhA.exe
  2⤵
  PID:5264
- C:\Windows\System\CYuuBMb.exe
  C:\Windows\System\CYuuBMb.exe
  2⤵
  PID:5292
- C:\Windows\System\fWdBgVC.exe
  C:\Windows\System\fWdBgVC.exe
  2⤵
  PID:5320
- C:\Windows\System\hnfiuBX.exe
  C:\Windows\System\hnfiuBX.exe
  2⤵
  PID:5344
- C:\Windows\System\kihbGYF.exe
  C:\Windows\System\kihbGYF.exe
  2⤵
  PID:5376
- C:\Windows\System\HAHTZSQ.exe
  C:\Windows\System\HAHTZSQ.exe
  2⤵
  PID:5404
- C:\Windows\System\SWmCXiz.exe
  C:\Windows\System\SWmCXiz.exe
  2⤵
  PID:5428
- C:\Windows\System\VbfuSGg.exe
  C:\Windows\System\VbfuSGg.exe
  2⤵
  PID:5460
- C:\Windows\System\XGjynTJ.exe
  C:\Windows\System\XGjynTJ.exe
  2⤵
  PID:5488
- C:\Windows\System\UXNPloU.exe
  C:\Windows\System\UXNPloU.exe
  2⤵
  PID:5516
- C:\Windows\System\WAhQwqz.exe
  C:\Windows\System\WAhQwqz.exe
  2⤵
  PID:5544
- C:\Windows\System\uZMKtGA.exe
  C:\Windows\System\uZMKtGA.exe
  2⤵
  PID:5572
- C:\Windows\System\XelYEPt.exe
  C:\Windows\System\XelYEPt.exe
  2⤵
  PID:5596
- C:\Windows\System\hqYkViZ.exe
  C:\Windows\System\hqYkViZ.exe
  2⤵
  PID:5628
- C:\Windows\System\QZjSfal.exe
  C:\Windows\System\QZjSfal.exe
  2⤵
  PID:5656
- C:\Windows\System\peMFTbz.exe
  C:\Windows\System\peMFTbz.exe
  2⤵
  PID:5684
- C:\Windows\System\HELiCpe.exe
  C:\Windows\System\HELiCpe.exe
  2⤵
  PID:5708
- C:\Windows\System\uEHonqg.exe
  C:\Windows\System\uEHonqg.exe
  2⤵
  PID:5740
- C:\Windows\System\ajeaUGz.exe
  C:\Windows\System\ajeaUGz.exe
  2⤵
  PID:5764
- C:\Windows\System\EomqNTx.exe
  C:\Windows\System\EomqNTx.exe
  2⤵
  PID:5796
- C:\Windows\System\oZjZxbg.exe
  C:\Windows\System\oZjZxbg.exe
  2⤵
  PID:5824
- C:\Windows\System\QAtuwjF.exe
  C:\Windows\System\QAtuwjF.exe
  2⤵
  PID:5852
- C:\Windows\System\KIBQyht.exe
  C:\Windows\System\KIBQyht.exe
  2⤵
  PID:5880
- C:\Windows\System\JnQlEzw.exe
  C:\Windows\System\JnQlEzw.exe
  2⤵
  PID:5908
- C:\Windows\System\eKyRZkK.exe
  C:\Windows\System\eKyRZkK.exe
  2⤵
  PID:5936
- C:\Windows\System\YinBdAR.exe
  C:\Windows\System\YinBdAR.exe
  2⤵
  PID:5960
- C:\Windows\System\GSRooIY.exe
  C:\Windows\System\GSRooIY.exe
  2⤵
  PID:5992
- C:\Windows\System\UbRxmbW.exe
  C:\Windows\System\UbRxmbW.exe
  2⤵
  PID:6016
- C:\Windows\System\UDZaune.exe
  C:\Windows\System\UDZaune.exe
  2⤵
  PID:6048
- C:\Windows\System\kihpHxm.exe
  C:\Windows\System\kihpHxm.exe
  2⤵
  PID:6076
- C:\Windows\System\PtUtedI.exe
  C:\Windows\System\PtUtedI.exe
  2⤵
  PID:6104
- C:\Windows\System\PHgnwUt.exe
  C:\Windows\System\PHgnwUt.exe
  2⤵
  PID:6132
- C:\Windows\System\EVkkfpd.exe
  C:\Windows\System\EVkkfpd.exe
  2⤵
  PID:4288
- C:\Windows\System\UtpKwZX.exe
  C:\Windows\System\UtpKwZX.exe
  2⤵
  PID:5104
- C:\Windows\System\GRZOPPI.exe
  C:\Windows\System\GRZOPPI.exe
  2⤵
  PID:4592
- C:\Windows\System\uBjTujN.exe
  C:\Windows\System\uBjTujN.exe
  2⤵
  PID:4812
- C:\Windows\System\PSIkZUJ.exe
  C:\Windows\System\PSIkZUJ.exe
  2⤵
  PID:3968
- C:\Windows\System\USQsnti.exe
  C:\Windows\System\USQsnti.exe
  2⤵
  PID:5144
- C:\Windows\System\LFvyVYj.exe
  C:\Windows\System\LFvyVYj.exe
  2⤵
  PID:5220
- C:\Windows\System\BqDOkAh.exe
  C:\Windows\System\BqDOkAh.exe
  2⤵
  PID:5276
- C:\Windows\System\eQOWXIk.exe
  C:\Windows\System\eQOWXIk.exe
  2⤵
  PID:5336
- C:\Windows\System\OTKrWKf.exe
  C:\Windows\System\OTKrWKf.exe
  2⤵
  PID:5416
- C:\Windows\System\GlWlbam.exe
  C:\Windows\System\GlWlbam.exe
  2⤵
  PID:5452
- C:\Windows\System\xsWfyIN.exe
  C:\Windows\System\xsWfyIN.exe
  2⤵
  PID:5532
- C:\Windows\System\JJnPZIk.exe
  C:\Windows\System\JJnPZIk.exe
  2⤵
  PID:5588
- C:\Windows\System\QeZdknA.exe
  C:\Windows\System\QeZdknA.exe
  2⤵
  PID:5648
- C:\Windows\System\ubiMBCp.exe
  C:\Windows\System\ubiMBCp.exe
  2⤵
  PID:5724
- C:\Windows\System\jGmwDje.exe
  C:\Windows\System\jGmwDje.exe
  2⤵
  PID:5788
- C:\Windows\System\AfJbuLb.exe
  C:\Windows\System\AfJbuLb.exe
  2⤵
  PID:5840
- C:\Windows\System\kDPYiWJ.exe
  C:\Windows\System\kDPYiWJ.exe
  2⤵
  PID:5900
- C:\Windows\System\rVZTzxN.exe
  C:\Windows\System\rVZTzxN.exe
  2⤵
  PID:5952
- C:\Windows\System\xswIrFi.exe
  C:\Windows\System\xswIrFi.exe
  2⤵
  PID:6012
- C:\Windows\System\sjbYBzG.exe
  C:\Windows\System\sjbYBzG.exe
  2⤵
  PID:1208
- C:\Windows\System\qzoHfhv.exe
  C:\Windows\System\qzoHfhv.exe
  2⤵
  PID:6124
- C:\Windows\System\qjBIXZR.exe
  C:\Windows\System\qjBIXZR.exe
  2⤵
  PID:1984
- C:\Windows\System\ItlFMlC.exe
  C:\Windows\System\ItlFMlC.exe
  2⤵
  PID:5052
- C:\Windows\System\EdCoThM.exe
  C:\Windows\System\EdCoThM.exe
  2⤵
  PID:5248
- C:\Windows\System\YqxpstD.exe
  C:\Windows\System\YqxpstD.exe
  2⤵
  PID:5368
- C:\Windows\System\iBSQikV.exe
  C:\Windows\System\iBSQikV.exe
  2⤵
  PID:5504
- C:\Windows\System\raONHvY.exe
  C:\Windows\System\raONHvY.exe
  2⤵
  PID:5640
- C:\Windows\System\XGRyPON.exe
  C:\Windows\System\XGRyPON.exe
  2⤵
  PID:1580
- C:\Windows\System\EYwlzrM.exe
  C:\Windows\System\EYwlzrM.exe
  2⤵
  PID:4796
- C:\Windows\System\MSWgGhY.exe
  C:\Windows\System\MSWgGhY.exe
  2⤵
  PID:712
- C:\Windows\System\vGtJBlA.exe
  C:\Windows\System\vGtJBlA.exe
  2⤵
  PID:5444
- C:\Windows\System\uCZJbXi.exe
  C:\Windows\System\uCZJbXi.exe
  2⤵
  PID:5044
- C:\Windows\System\qkkAaLn.exe
  C:\Windows\System\qkkAaLn.exe
  2⤵
  PID:572
- C:\Windows\System\glyuGlt.exe
  C:\Windows\System\glyuGlt.exe
  2⤵
  PID:5620
- C:\Windows\System\YYlzHRb.exe
  C:\Windows\System\YYlzHRb.exe
  2⤵
  PID:868
- C:\Windows\System\pwLbqGL.exe
  C:\Windows\System\pwLbqGL.exe
  2⤵
  PID:2928
- C:\Windows\System\uloBFJa.exe
  C:\Windows\System\uloBFJa.exe
  2⤵
  PID:6064
- C:\Windows\System\OUloxzG.exe
  C:\Windows\System\OUloxzG.exe
  2⤵
  PID:2764
- C:\Windows\System\gjljrZR.exe
  C:\Windows\System\gjljrZR.exe
  2⤵
  PID:3972
- C:\Windows\System\vUJWgNu.exe
  C:\Windows\System\vUJWgNu.exe
  2⤵
  PID:4868
- C:\Windows\System\DcVyyFj.exe
  C:\Windows\System\DcVyyFj.exe
  2⤵
  PID:1948
- C:\Windows\System\sVnymaL.exe
  C:\Windows\System\sVnymaL.exe
  2⤵
  PID:2156
- C:\Windows\System\ttvTEAE.exe
  C:\Windows\System\ttvTEAE.exe
  2⤵
  PID:1616
- C:\Windows\System\hHCtvKL.exe
  C:\Windows\System\hHCtvKL.exe
  2⤵
  PID:2684
- C:\Windows\System\gloyXxs.exe
  C:\Windows\System\gloyXxs.exe
  2⤵
  PID:1596
- C:\Windows\System\KsRKSCf.exe
  C:\Windows\System\KsRKSCf.exe
  2⤵
  PID:6152
- C:\Windows\System\WaPPqSe.exe
  C:\Windows\System\WaPPqSe.exe
  2⤵
  PID:6172
- C:\Windows\System\YebYjmX.exe
  C:\Windows\System\YebYjmX.exe
  2⤵
  PID:6200
- C:\Windows\System\BqkVrWF.exe
  C:\Windows\System\BqkVrWF.exe
  2⤵
  PID:6280
- C:\Windows\System\YHrVSfY.exe
  C:\Windows\System\YHrVSfY.exe
  2⤵
  PID:6312
- C:\Windows\System\gCHSpFm.exe
  C:\Windows\System\gCHSpFm.exe
  2⤵
  PID:6340
- C:\Windows\System\tlmwrve.exe
  C:\Windows\System\tlmwrve.exe
  2⤵
  PID:6372
- C:\Windows\System\EEBMXpR.exe
  C:\Windows\System\EEBMXpR.exe
  2⤵
  PID:6396
- C:\Windows\System\QUcWYkS.exe
  C:\Windows\System\QUcWYkS.exe
  2⤵
  PID:6412
- C:\Windows\System\cfFWQJG.exe
  C:\Windows\System\cfFWQJG.exe
  2⤵
  PID:6440
- C:\Windows\System\BQhCbWr.exe
  C:\Windows\System\BQhCbWr.exe
  2⤵
  PID:6504
- C:\Windows\System\mlcMnhf.exe
  C:\Windows\System\mlcMnhf.exe
  2⤵
  PID:6540
- C:\Windows\System\kOsGJLB.exe
  C:\Windows\System\kOsGJLB.exe
  2⤵
  PID:6568
- C:\Windows\System\sZLOCXd.exe
  C:\Windows\System\sZLOCXd.exe
  2⤵
  PID:6596
- C:\Windows\System\OOVooCa.exe
  C:\Windows\System\OOVooCa.exe
  2⤵
  PID:6624
- C:\Windows\System\arvvfzh.exe
  C:\Windows\System\arvvfzh.exe
  2⤵
  PID:6732
- C:\Windows\System\SWNAEPc.exe
  C:\Windows\System\SWNAEPc.exe
  2⤵
  PID:6752
- C:\Windows\System\WbHeawK.exe
  C:\Windows\System\WbHeawK.exe
  2⤵
  PID:6780
- C:\Windows\System\RUCALzu.exe
  C:\Windows\System\RUCALzu.exe
  2⤵
  PID:6800
- C:\Windows\System\AVKewcS.exe
  C:\Windows\System\AVKewcS.exe
  2⤵
  PID:6820
- C:\Windows\System\nHLBeGZ.exe
  C:\Windows\System\nHLBeGZ.exe
  2⤵
  PID:6848
- C:\Windows\System\hHdAvZp.exe
  C:\Windows\System\hHdAvZp.exe
  2⤵
  PID:6876
- C:\Windows\System\lmXhPtF.exe
  C:\Windows\System\lmXhPtF.exe
  2⤵
  PID:6980
- C:\Windows\System\FQpoKGF.exe
  C:\Windows\System\FQpoKGF.exe
  2⤵
  PID:7044
- C:\Windows\System\QyTuFJY.exe
  C:\Windows\System\QyTuFJY.exe
  2⤵
  PID:7060
- C:\Windows\System\aDomJgK.exe
  C:\Windows\System\aDomJgK.exe
  2⤵
  PID:7076
- C:\Windows\System\yDPPhwj.exe
  C:\Windows\System\yDPPhwj.exe
  2⤵
  PID:7092
- C:\Windows\System\hpWOgND.exe
  C:\Windows\System\hpWOgND.exe
  2⤵
  PID:7132
- C:\Windows\System\DiDZcfG.exe
  C:\Windows\System\DiDZcfG.exe
  2⤵
  PID:1124
- C:\Windows\System\pHmtoaN.exe
  C:\Windows\System\pHmtoaN.exe
  2⤵
  PID:6160
- C:\Windows\System\ZqnrgkD.exe
  C:\Windows\System\ZqnrgkD.exe
  2⤵
  PID:6264
- C:\Windows\System\DHKvEqd.exe
  C:\Windows\System\DHKvEqd.exe
  2⤵
  PID:6308
- C:\Windows\System\kwogApF.exe
  C:\Windows\System\kwogApF.exe
  2⤵
  PID:6408
- C:\Windows\System\lcCDHZM.exe
  C:\Windows\System\lcCDHZM.exe
  2⤵
  PID:6392
- C:\Windows\System\GhmiGYP.exe
  C:\Windows\System\GhmiGYP.exe
  2⤵
  PID:6472
- C:\Windows\System\QkSisCN.exe
  C:\Windows\System\QkSisCN.exe
  2⤵
  PID:6576
- C:\Windows\System\tbHzLZY.exe
  C:\Windows\System\tbHzLZY.exe
  2⤵
  PID:6644
- C:\Windows\System\BcxszJs.exe
  C:\Windows\System\BcxszJs.exe
  2⤵
  PID:6748
- C:\Windows\System\ZBUVovu.exe
  C:\Windows\System\ZBUVovu.exe
  2⤵
  PID:6796
- C:\Windows\System\MDwghxP.exe
  C:\Windows\System\MDwghxP.exe
  2⤵
  PID:6864
- C:\Windows\System\mbJzXBt.exe
  C:\Windows\System\mbJzXBt.exe
  2⤵
  PID:6672
- C:\Windows\System\euEhAZk.exe
  C:\Windows\System\euEhAZk.exe
  2⤵
  PID:5072
- C:\Windows\System\eMhqGVu.exe
  C:\Windows\System\eMhqGVu.exe
  2⤵
  PID:6684
- C:\Windows\System\iPecngi.exe
  C:\Windows\System\iPecngi.exe
  2⤵
  PID:5892
- C:\Windows\System\OphBuJe.exe
  C:\Windows\System\OphBuJe.exe
  2⤵
  PID:1372
- C:\Windows\System\RfCjZXS.exe
  C:\Windows\System\RfCjZXS.exe
  2⤵
  PID:5308
- C:\Windows\System\PDIjxiV.exe
  C:\Windows\System\PDIjxiV.exe
  2⤵
  PID:1980
- C:\Windows\System\qgnXQxR.exe
  C:\Windows\System\qgnXQxR.exe
  2⤵
  PID:6488
- C:\Windows\System\HoebxSV.exe
  C:\Windows\System\HoebxSV.exe
  2⤵
  PID:6636
- C:\Windows\System\GkxNRYD.exe
  C:\Windows\System\GkxNRYD.exe
  2⤵
  PID:5868
- C:\Windows\System\dQZyOxD.exe
  C:\Windows\System\dQZyOxD.exe
  2⤵
  PID:6296
- C:\Windows\System\oHHvgyq.exe
  C:\Windows\System\oHHvgyq.exe
  2⤵
  PID:6668
- C:\Windows\System\pJFyrwR.exe
  C:\Windows\System\pJFyrwR.exe
  2⤵
  PID:1568
- C:\Windows\System\awbcheY.exe
  C:\Windows\System\awbcheY.exe
  2⤵
  PID:5872
- C:\Windows\System\rijBlGt.exe
  C:\Windows\System\rijBlGt.exe
  2⤵
  PID:6436
- C:\Windows\System\mWookvx.exe
  C:\Windows\System\mWookvx.exe
  2⤵
  PID:6516
- C:\Windows\System\pQPxXke.exe
  C:\Windows\System\pQPxXke.exe
  2⤵
  PID:6008
- C:\Windows\System\IpZJAeO.exe
  C:\Windows\System\IpZJAeO.exe
  2⤵
  PID:7144
- C:\Windows\System\qpWnCba.exe
  C:\Windows\System\qpWnCba.exe
  2⤵
  PID:6608
- C:\Windows\System\WORwMKY.exe
  C:\Windows\System\WORwMKY.exe
  2⤵
  PID:6536
- C:\Windows\System\LiuKjsc.exe
  C:\Windows\System\LiuKjsc.exe
  2⤵
  PID:6356
- C:\Windows\System\WfNPceX.exe
  C:\Windows\System\WfNPceX.exe
  2⤵
  PID:7196
- C:\Windows\System\gMWMGgq.exe
  C:\Windows\System\gMWMGgq.exe
  2⤵
  PID:7224
- C:\Windows\System\nsySQTS.exe
  C:\Windows\System\nsySQTS.exe
  2⤵
  PID:7252
- C:\Windows\System\EGjCmPo.exe
  C:\Windows\System\EGjCmPo.exe
  2⤵
  PID:7276
- C:\Windows\System\MGQrTkC.exe
  C:\Windows\System\MGQrTkC.exe
  2⤵
  PID:7312
- C:\Windows\System\YILOuLK.exe
  C:\Windows\System\YILOuLK.exe
  2⤵
  PID:7340
- C:\Windows\System\jZNFfmg.exe
  C:\Windows\System\jZNFfmg.exe
  2⤵
  PID:7368
- C:\Windows\System\vrCuqSG.exe
  C:\Windows\System\vrCuqSG.exe
  2⤵
  PID:7400
- C:\Windows\System\zcEWGVh.exe
  C:\Windows\System\zcEWGVh.exe
  2⤵
  PID:7424
- C:\Windows\System\KlYVIaw.exe
  C:\Windows\System\KlYVIaw.exe
  2⤵
  PID:7452
- C:\Windows\System\UpwkNnZ.exe
  C:\Windows\System\UpwkNnZ.exe
  2⤵
  PID:7480
- C:\Windows\System\oPWjHAF.exe
  C:\Windows\System\oPWjHAF.exe
  2⤵
  PID:7508
- C:\Windows\System\hkrRcmM.exe
  C:\Windows\System\hkrRcmM.exe
  2⤵
  PID:7536
- C:\Windows\System\nILAjRO.exe
  C:\Windows\System\nILAjRO.exe
  2⤵
  PID:7572
- C:\Windows\System\XAhXWPc.exe
  C:\Windows\System\XAhXWPc.exe
  2⤵
  PID:7600
- C:\Windows\System\HDWKlJn.exe
  C:\Windows\System\HDWKlJn.exe
  2⤵
  PID:7628
- C:\Windows\System\EKRyacz.exe
  C:\Windows\System\EKRyacz.exe
  2⤵
  PID:7656
- C:\Windows\System\FfnzNby.exe
  C:\Windows\System\FfnzNby.exe
  2⤵
  PID:7688
- C:\Windows\System\xpLGyIH.exe
  C:\Windows\System\xpLGyIH.exe
  2⤵
  PID:7716
- C:\Windows\System\AWWDXKf.exe
  C:\Windows\System\AWWDXKf.exe
  2⤵
  PID:7748
- C:\Windows\System\NDPTUKo.exe
  C:\Windows\System\NDPTUKo.exe
  2⤵
  PID:7788
- C:\Windows\System\puoTkBZ.exe
  C:\Windows\System\puoTkBZ.exe
  2⤵
  PID:7808
- C:\Windows\System\EXzqoHb.exe
  C:\Windows\System\EXzqoHb.exe
  2⤵
  PID:7836
- C:\Windows\System\CpMdQYD.exe
  C:\Windows\System\CpMdQYD.exe
  2⤵
  PID:7876
- C:\Windows\System\vsDhdhQ.exe
  C:\Windows\System\vsDhdhQ.exe
  2⤵
  PID:7904
- C:\Windows\System\YjwrTZh.exe
  C:\Windows\System\YjwrTZh.exe
  2⤵
  PID:7932
- C:\Windows\System\ItLCtBE.exe
  C:\Windows\System\ItLCtBE.exe
  2⤵
  PID:7960
- C:\Windows\System\ZCsRjfX.exe
  C:\Windows\System\ZCsRjfX.exe
  2⤵
  PID:7988
- C:\Windows\System\phzkpzf.exe
  C:\Windows\System\phzkpzf.exe
  2⤵
  PID:8004
- C:\Windows\System\oxRjsxH.exe
  C:\Windows\System\oxRjsxH.exe
  2⤵
  PID:8040
- C:\Windows\System\LZGIuYZ.exe
  C:\Windows\System\LZGIuYZ.exe
  2⤵
  PID:8072
- C:\Windows\System\cLBIJGL.exe
  C:\Windows\System\cLBIJGL.exe
  2⤵
  PID:8100
- C:\Windows\System\UMOvXwj.exe
  C:\Windows\System\UMOvXwj.exe
  2⤵
  PID:8128
- C:\Windows\System\ykWdyDu.exe
  C:\Windows\System\ykWdyDu.exe
  2⤵
  PID:8160
- C:\Windows\System\gZFUrLp.exe
  C:\Windows\System\gZFUrLp.exe
  2⤵
  PID:7188
- C:\Windows\System\lfiPBci.exe
  C:\Windows\System\lfiPBci.exe
  2⤵
  PID:7248
- C:\Windows\System\veYgaGl.exe
  C:\Windows\System\veYgaGl.exe
  2⤵
  PID:7304
- C:\Windows\System\EmgOTCJ.exe
  C:\Windows\System\EmgOTCJ.exe
  2⤵
  PID:7360
- C:\Windows\System\cnhgDrH.exe
  C:\Windows\System\cnhgDrH.exe
  2⤵
  PID:7408
- C:\Windows\System\BOPZNHM.exe
  C:\Windows\System\BOPZNHM.exe
  2⤵
  PID:7520
- C:\Windows\System\EOaPNfU.exe
  C:\Windows\System\EOaPNfU.exe
  2⤵
  PID:7584
- C:\Windows\System\LQayuhO.exe
  C:\Windows\System\LQayuhO.exe
  2⤵
  PID:7616
- C:\Windows\System\IMVnuAf.exe
  C:\Windows\System\IMVnuAf.exe
  2⤵
  PID:7648
- C:\Windows\System\kpyrtir.exe
  C:\Windows\System\kpyrtir.exe
  2⤵
  PID:7768
- C:\Windows\System\NTyzTHv.exe
  C:\Windows\System\NTyzTHv.exe
  2⤵
  PID:7832
- C:\Windows\System\vpofGeC.exe
  C:\Windows\System\vpofGeC.exe
  2⤵
  PID:7896
- C:\Windows\System\zvoHmsg.exe
  C:\Windows\System\zvoHmsg.exe
  2⤵
  PID:7956
- C:\Windows\System\wuqveUA.exe
  C:\Windows\System\wuqveUA.exe
  2⤵
  PID:8036
- C:\Windows\System\ZXOdQxP.exe
  C:\Windows\System\ZXOdQxP.exe
  2⤵
  PID:8084
- C:\Windows\System\lzllOsB.exe
  C:\Windows\System\lzllOsB.exe
  2⤵
  PID:8152
- C:\Windows\System\qHsrpNB.exe
  C:\Windows\System\qHsrpNB.exe
  2⤵
  PID:7268
- C:\Windows\System\sdvBxMl.exe
  C:\Windows\System\sdvBxMl.exe
  2⤵
  PID:7272
- C:\Windows\System\KCqnISf.exe
  C:\Windows\System\KCqnISf.exe
  2⤵
  PID:7564
- C:\Windows\System\yllYdsV.exe
  C:\Windows\System\yllYdsV.exe
  2⤵
  PID:7640
- C:\Windows\System\etCsMKm.exe
  C:\Windows\System\etCsMKm.exe
  2⤵
  PID:7804
- C:\Windows\System\kmzHHCo.exe
  C:\Windows\System\kmzHHCo.exe
  2⤵
  PID:7916
- C:\Windows\System\MCVUEck.exe
  C:\Windows\System\MCVUEck.exe
  2⤵
  PID:8124
- C:\Windows\System\jZRAPBP.exe
  C:\Windows\System\jZRAPBP.exe
  2⤵
  PID:8172
- C:\Windows\System\wdexCLs.exe
  C:\Windows\System\wdexCLs.exe
  2⤵
  PID:7712
- C:\Windows\System\XvqCDRw.exe
  C:\Windows\System\XvqCDRw.exe
  2⤵
  PID:7980
- C:\Windows\System\ebLSXmk.exe
  C:\Windows\System\ebLSXmk.exe
  2⤵
  PID:7996
- C:\Windows\System\QMAnijr.exe
  C:\Windows\System\QMAnijr.exe
  2⤵
  PID:8216
- C:\Windows\System\ngVKfML.exe
  C:\Windows\System\ngVKfML.exe
  2⤵
  PID:8236
- C:\Windows\System\WInvPZF.exe
  C:\Windows\System\WInvPZF.exe
  2⤵
  PID:8268
- C:\Windows\System\PvXLpws.exe
  C:\Windows\System\PvXLpws.exe
  2⤵
  PID:8292
- C:\Windows\System\cKkxIMN.exe
  C:\Windows\System\cKkxIMN.exe
  2⤵
  PID:8324
- C:\Windows\System\IQnLRPB.exe
  C:\Windows\System\IQnLRPB.exe
  2⤵
  PID:8348
- C:\Windows\System\IuJFckD.exe
  C:\Windows\System\IuJFckD.exe
  2⤵
  PID:8376
- C:\Windows\System\DWzgEkl.exe
  C:\Windows\System\DWzgEkl.exe
  2⤵
  PID:8428
- C:\Windows\System\bHjfSVb.exe
  C:\Windows\System\bHjfSVb.exe
  2⤵
  PID:8444
- C:\Windows\System\gYiItIp.exe
  C:\Windows\System\gYiItIp.exe
  2⤵
  PID:8468
- C:\Windows\System\LUrRGwv.exe
  C:\Windows\System\LUrRGwv.exe
  2⤵
  PID:8500
- C:\Windows\System\OfldkAi.exe
  C:\Windows\System\OfldkAi.exe
  2⤵
  PID:8536
- C:\Windows\System\ZLXsQoe.exe
  C:\Windows\System\ZLXsQoe.exe
  2⤵
  PID:8556
- C:\Windows\System\iyEFFPV.exe
  C:\Windows\System\iyEFFPV.exe
  2⤵
  PID:8584
- C:\Windows\System\ElxlLhK.exe
  C:\Windows\System\ElxlLhK.exe
  2⤵
  PID:8612
- C:\Windows\System\TBcGupX.exe
  C:\Windows\System\TBcGupX.exe
  2⤵
  PID:8640
- C:\Windows\System\ULiFkFP.exe
  C:\Windows\System\ULiFkFP.exe
  2⤵
  PID:8668
- C:\Windows\System\AFOWyZq.exe
  C:\Windows\System\AFOWyZq.exe
  2⤵
  PID:8684
- C:\Windows\System\DcmAACJ.exe
  C:\Windows\System\DcmAACJ.exe
  2⤵
  PID:8712
- C:\Windows\System\SlIJAGm.exe
  C:\Windows\System\SlIJAGm.exe
  2⤵
  PID:8728
- C:\Windows\System\lsrMSPW.exe
  C:\Windows\System\lsrMSPW.exe
  2⤵
  PID:8744
- C:\Windows\System\hblfZPy.exe
  C:\Windows\System\hblfZPy.exe
  2⤵
  PID:8776
- C:\Windows\System\dYzhcWP.exe
  C:\Windows\System\dYzhcWP.exe
  2⤵
  PID:8800
- C:\Windows\System\SnKCQft.exe
  C:\Windows\System\SnKCQft.exe
  2⤵
  PID:8832
- C:\Windows\System\cOmDyJn.exe
  C:\Windows\System\cOmDyJn.exe
  2⤵
  PID:8852
- C:\Windows\System\jdwpPIL.exe
  C:\Windows\System\jdwpPIL.exe
  2⤵
  PID:8884
- C:\Windows\System\RcmTGds.exe
  C:\Windows\System\RcmTGds.exe
  2⤵
  PID:8960
- C:\Windows\System\cMJOlRA.exe
  C:\Windows\System\cMJOlRA.exe
  2⤵
  PID:8988
- C:\Windows\System\kJHLjLR.exe
  C:\Windows\System\kJHLjLR.exe
  2⤵
  PID:9020
- C:\Windows\System\IMcyqzT.exe
  C:\Windows\System\IMcyqzT.exe
  2⤵
  PID:9036
- C:\Windows\System\toRExFx.exe
  C:\Windows\System\toRExFx.exe
  2⤵
  PID:9072
- C:\Windows\System\ZvgzIko.exe
  C:\Windows\System\ZvgzIko.exe
  2⤵
  PID:9092
- C:\Windows\System\SCDjwLK.exe
  C:\Windows\System\SCDjwLK.exe
  2⤵
  PID:9108
- C:\Windows\System\wwyeJUl.exe
  C:\Windows\System\wwyeJUl.exe
  2⤵
  PID:9160
- C:\Windows\System\WSSTJss.exe
  C:\Windows\System\WSSTJss.exe
  2⤵
  PID:9196
- C:\Windows\System\uQTdnSb.exe
  C:\Windows\System\uQTdnSb.exe
  2⤵
  PID:7860
- C:\Windows\System\cODkToh.exe
  C:\Windows\System\cODkToh.exe
  2⤵
  PID:8248
- C:\Windows\System\BvnGCTi.exe
  C:\Windows\System\BvnGCTi.exe
  2⤵
  PID:8364
- C:\Windows\System\dtUKncm.exe
  C:\Windows\System\dtUKncm.exe
  2⤵
  PID:8372
- C:\Windows\System\HdwmFyv.exe
  C:\Windows\System\HdwmFyv.exe
  2⤵
  PID:8456
- C:\Windows\System\VRXdmpJ.exe
  C:\Windows\System\VRXdmpJ.exe
  2⤵
  PID:8488
- C:\Windows\System\bpExAUn.exe
  C:\Windows\System\bpExAUn.exe
  2⤵
  PID:8568
- C:\Windows\System\SFFhalI.exe
  C:\Windows\System\SFFhalI.exe
  2⤵
  PID:8608
- C:\Windows\System\JHbDMla.exe
  C:\Windows\System\JHbDMla.exe
  2⤵
  PID:8696
- C:\Windows\System\fgTCkzr.exe
  C:\Windows\System\fgTCkzr.exe
  2⤵
  PID:8724
- C:\Windows\System\ASNDiFD.exe
  C:\Windows\System\ASNDiFD.exe
  2⤵
  PID:8824
- C:\Windows\System\KyHtQjT.exe
  C:\Windows\System\KyHtQjT.exe
  2⤵
  PID:8868
- C:\Windows\System\pUhuRkp.exe
  C:\Windows\System\pUhuRkp.exe
  2⤵
  PID:8968
- C:\Windows\System\YWLobok.exe
  C:\Windows\System\YWLobok.exe
  2⤵
  PID:9056
- C:\Windows\System\PhdtLAb.exe
  C:\Windows\System\PhdtLAb.exe
  2⤵
  PID:9088
- C:\Windows\System\GUdQIqO.exe
  C:\Windows\System\GUdQIqO.exe
  2⤵
  PID:3888
- C:\Windows\System\NWmClLO.exe
  C:\Windows\System\NWmClLO.exe
  2⤵
  PID:9208
- C:\Windows\System\DFNBqRN.exe
  C:\Windows\System\DFNBqRN.exe
  2⤵
  PID:8312
- C:\Windows\System\GYvdtvy.exe
  C:\Windows\System\GYvdtvy.exe
  2⤵
  PID:8548
- C:\Windows\System\FQVretK.exe
  C:\Windows\System\FQVretK.exe
  2⤵
  PID:7596
- C:\Windows\System\klqXKqu.exe
  C:\Windows\System\klqXKqu.exe
  2⤵
  PID:8788
- C:\Windows\System\nNityrG.exe
  C:\Windows\System\nNityrG.exe
  2⤵
  PID:8948
- C:\Windows\System\GKddsXp.exe
  C:\Windows\System\GKddsXp.exe
  2⤵
  PID:9080
- C:\Windows\System\IPuuyZk.exe
  C:\Windows\System\IPuuyZk.exe
  2⤵
  PID:8276
- C:\Windows\System\kPzhwax.exe
  C:\Windows\System\kPzhwax.exe
  2⤵
  PID:8600
- C:\Windows\System\XxVIkfy.exe
  C:\Windows\System\XxVIkfy.exe
  2⤵
  PID:8924
- C:\Windows\System\OHCsLWs.exe
  C:\Windows\System\OHCsLWs.exe
  2⤵
  PID:8772
- C:\Windows\System\VVtrIAx.exe
  C:\Windows\System\VVtrIAx.exe
  2⤵
  PID:8552
- C:\Windows\System\ESzvqUl.exe
  C:\Windows\System\ESzvqUl.exe
  2⤵
  PID:9236
- C:\Windows\System\CiWDqfT.exe
  C:\Windows\System\CiWDqfT.exe
  2⤵
  PID:9264
- C:\Windows\System\oQhDbqI.exe
  C:\Windows\System\oQhDbqI.exe
  2⤵
  PID:9292
- C:\Windows\System\PvHeKQx.exe
  C:\Windows\System\PvHeKQx.exe
  2⤵
  PID:9312
- C:\Windows\System\ufZGYLM.exe
  C:\Windows\System\ufZGYLM.exe
  2⤵
  PID:9336
- C:\Windows\System\VwXDJrM.exe
  C:\Windows\System\VwXDJrM.exe
  2⤵
  PID:9360
- C:\Windows\System\SRJaFnw.exe
  C:\Windows\System\SRJaFnw.exe
  2⤵
  PID:9404
- C:\Windows\System\PSbkSas.exe
  C:\Windows\System\PSbkSas.exe
  2⤵
  PID:9432
- C:\Windows\System\wvETgzF.exe
  C:\Windows\System\wvETgzF.exe
  2⤵
  PID:9448
- C:\Windows\System\lyDYfQe.exe
  C:\Windows\System\lyDYfQe.exe
  2⤵
  PID:9476
- C:\Windows\System\dhTrMds.exe
  C:\Windows\System\dhTrMds.exe
  2⤵
  PID:9516
- C:\Windows\System\ZVSRNtx.exe
  C:\Windows\System\ZVSRNtx.exe
  2⤵
  PID:9544
- C:\Windows\System\TCCMoFB.exe
  C:\Windows\System\TCCMoFB.exe
  2⤵
  PID:9584
- C:\Windows\System\FNFsrFl.exe
  C:\Windows\System\FNFsrFl.exe
  2⤵
  PID:9600
- C:\Windows\System\lwPIZGt.exe
  C:\Windows\System\lwPIZGt.exe
  2⤵
  PID:9628
- C:\Windows\System\zlsJcvV.exe
  C:\Windows\System\zlsJcvV.exe
  2⤵
  PID:9668
- C:\Windows\System\ODOQMLN.exe
  C:\Windows\System\ODOQMLN.exe
  2⤵
  PID:9684
- C:\Windows\System\oZZRlVe.exe
  C:\Windows\System\oZZRlVe.exe
  2⤵
  PID:9712
- C:\Windows\System\ABAlIfX.exe
  C:\Windows\System\ABAlIfX.exe
  2⤵
  PID:9740
- C:\Windows\System\VWwnadX.exe
  C:\Windows\System\VWwnadX.exe
  2⤵
  PID:9772
- C:\Windows\System\nTWcfso.exe
  C:\Windows\System\nTWcfso.exe
  2⤵
  PID:9800
- C:\Windows\System\nyKHuRS.exe
  C:\Windows\System\nyKHuRS.exe
  2⤵
  PID:9828
- C:\Windows\System\iyhRihZ.exe
  C:\Windows\System\iyhRihZ.exe
  2⤵
  PID:9856
- C:\Windows\System\xBArOKi.exe
  C:\Windows\System\xBArOKi.exe
  2⤵
  PID:9900
- C:\Windows\System\oRTCEjn.exe
  C:\Windows\System\oRTCEjn.exe
  2⤵
  PID:9928
- C:\Windows\System\mxolJpL.exe
  C:\Windows\System\mxolJpL.exe
  2⤵
  PID:9956
- C:\Windows\System\qcVdepw.exe
  C:\Windows\System\qcVdepw.exe
  2⤵
  PID:9980
- C:\Windows\System\agfXjUa.exe
  C:\Windows\System\agfXjUa.exe
  2⤵
  PID:10000
- C:\Windows\System\QGnJVpz.exe
  C:\Windows\System\QGnJVpz.exe
  2⤵
  PID:10028
- C:\Windows\System\dHYcKIl.exe
  C:\Windows\System\dHYcKIl.exe
  2⤵
  PID:10056
- C:\Windows\System\BXrjXjO.exe
  C:\Windows\System\BXrjXjO.exe
  2⤵
  PID:10072
- C:\Windows\System\vBeDRPE.exe
  C:\Windows\System\vBeDRPE.exe
  2⤵
  PID:10096
- C:\Windows\System\WOMsWby.exe
  C:\Windows\System\WOMsWby.exe
  2⤵
  PID:10124
- C:\Windows\System\LhJeVFS.exe
  C:\Windows\System\LhJeVFS.exe
  2⤵
  PID:10180
- C:\Windows\System\UJrTiFn.exe
  C:\Windows\System\UJrTiFn.exe
  2⤵
  PID:10200
- C:\Windows\System\exMFfBR.exe
  C:\Windows\System\exMFfBR.exe
  2⤵
  PID:10232
- C:\Windows\System\DXjisii.exe
  C:\Windows\System\DXjisii.exe
  2⤵
  PID:9248
- C:\Windows\System\oxSZwAU.exe
  C:\Windows\System\oxSZwAU.exe
  2⤵
  PID:9352
- C:\Windows\System\IimGrKH.exe
  C:\Windows\System\IimGrKH.exe
  2⤵
  PID:9420
- C:\Windows\System\gVmNigB.exe
  C:\Windows\System\gVmNigB.exe
  2⤵
  PID:9468
- C:\Windows\System\MEeVqcs.exe
  C:\Windows\System\MEeVqcs.exe
  2⤵
  PID:9504
- C:\Windows\System\Nedgtcf.exe
  C:\Windows\System\Nedgtcf.exe
  2⤵
  PID:9536
- C:\Windows\System\ZRLKVyR.exe
  C:\Windows\System\ZRLKVyR.exe
  2⤵
  PID:9644
- C:\Windows\System\MpFCnhf.exe
  C:\Windows\System\MpFCnhf.exe
  2⤵
  PID:9664
- C:\Windows\System\KXoJgYm.exe
  C:\Windows\System\KXoJgYm.exe
  2⤵
  PID:9732
- C:\Windows\System\fUCXEun.exe
  C:\Windows\System\fUCXEun.exe
  2⤵
  PID:9796
- C:\Windows\System\JIqUKhP.exe
  C:\Windows\System\JIqUKhP.exe
  2⤵
  PID:9884
- C:\Windows\System\eVocANZ.exe
  C:\Windows\System\eVocANZ.exe
  2⤵
  PID:9944
- C:\Windows\System\DiTMuXr.exe
  C:\Windows\System\DiTMuXr.exe
  2⤵
  PID:10048
- C:\Windows\System\rUqcSPg.exe
  C:\Windows\System\rUqcSPg.exe
  2⤵
  PID:10092
- C:\Windows\System\qyiIZdh.exe
  C:\Windows\System\qyiIZdh.exe
  2⤵
  PID:10148
- C:\Windows\System\mCiCOLE.exe
  C:\Windows\System\mCiCOLE.exe
  2⤵
  PID:10224
- C:\Windows\System\ILnvyxG.exe
  C:\Windows\System\ILnvyxG.exe
  2⤵
  PID:9260
- C:\Windows\System\nnKKJpN.exe
  C:\Windows\System\nnKKJpN.exe
  2⤵
  PID:9532
- C:\Windows\System\sBkMYYP.exe
  C:\Windows\System\sBkMYYP.exe
  2⤵
  PID:9580
- C:\Windows\System\ZuuFEIm.exe
  C:\Windows\System\ZuuFEIm.exe
  2⤵
  PID:9792
- C:\Windows\System\qBIYHpq.exe
  C:\Windows\System\qBIYHpq.exe
  2⤵
  PID:10020
- C:\Windows\System\uTipcAR.exe
  C:\Windows\System\uTipcAR.exe
  2⤵
  PID:10172
- C:\Windows\System\ytQaeEy.exe
  C:\Windows\System\ytQaeEy.exe
  2⤵
  PID:9224
- C:\Windows\System\edMecUQ.exe
  C:\Windows\System\edMecUQ.exe
  2⤵
  PID:9412
- C:\Windows\System\MSRglRZ.exe
  C:\Windows\System\MSRglRZ.exe
  2⤵
  PID:9940
- C:\Windows\System\hakbAvk.exe
  C:\Windows\System\hakbAvk.exe
  2⤵
  PID:10084
- C:\Windows\System\yXcgvEn.exe
  C:\Windows\System\yXcgvEn.exe
  2⤵
  PID:9728
- C:\Windows\System\tdgcbHk.exe
  C:\Windows\System\tdgcbHk.exe
  2⤵
  PID:9308
- C:\Windows\System\otxXUxH.exe
  C:\Windows\System\otxXUxH.exe
  2⤵
  PID:10284
- C:\Windows\System\mSAaEfN.exe
  C:\Windows\System\mSAaEfN.exe
  2⤵
  PID:10300
- C:\Windows\System\srKoIFL.exe
  C:\Windows\System\srKoIFL.exe
  2⤵
  PID:10340
- C:\Windows\System\NuNuhvO.exe
  C:\Windows\System\NuNuhvO.exe
  2⤵
  PID:10368
- C:\Windows\System\ZZUJvPZ.exe
  C:\Windows\System\ZZUJvPZ.exe
  2⤵
  PID:10396
- C:\Windows\System\PYJrxEA.exe
  C:\Windows\System\PYJrxEA.exe
  2⤵
  PID:10412
- C:\Windows\System\BqWWkwH.exe
  C:\Windows\System\BqWWkwH.exe
  2⤵
  PID:10428
- C:\Windows\System\mblryhM.exe
  C:\Windows\System\mblryhM.exe
  2⤵
  PID:10448
- C:\Windows\System\ZRzwrRV.exe
  C:\Windows\System\ZRzwrRV.exe
  2⤵
  PID:10472
- C:\Windows\System\LzcMNfs.exe
  C:\Windows\System\LzcMNfs.exe
  2⤵
  PID:10500
- C:\Windows\System\cJkGEoB.exe
  C:\Windows\System\cJkGEoB.exe
  2⤵
  PID:10532
- C:\Windows\System\PrDnDAL.exe
  C:\Windows\System\PrDnDAL.exe
  2⤵
  PID:10576
- C:\Windows\System\LrfDYKO.exe
  C:\Windows\System\LrfDYKO.exe
  2⤵
  PID:10604
- C:\Windows\System\iLxKdQH.exe
  C:\Windows\System\iLxKdQH.exe
  2⤵
  PID:10628
- C:\Windows\System\BvTcgzK.exe
  C:\Windows\System\BvTcgzK.exe
  2⤵
  PID:10656
- C:\Windows\System\SYvqvZy.exe
  C:\Windows\System\SYvqvZy.exe
  2⤵
  PID:10688
- C:\Windows\System\WOXcUos.exe
  C:\Windows\System\WOXcUos.exe
  2⤵
  PID:10712
- C:\Windows\System\PxEZQhb.exe
  C:\Windows\System\PxEZQhb.exe
  2⤵
  PID:10756
- C:\Windows\System\WnRDOml.exe
  C:\Windows\System\WnRDOml.exe
  2⤵
  PID:10792
- C:\Windows\System\XANgbbx.exe
  C:\Windows\System\XANgbbx.exe
  2⤵
  PID:10812
- C:\Windows\System\YQhbarc.exe
  C:\Windows\System\YQhbarc.exe
  2⤵
  PID:10836
- C:\Windows\System\xYSzRWy.exe
  C:\Windows\System\xYSzRWy.exe
  2⤵
  PID:10864
- C:\Windows\System\MhnZjlI.exe
  C:\Windows\System\MhnZjlI.exe
  2⤵
  PID:10892
- C:\Windows\System\hwVJRPT.exe
  C:\Windows\System\hwVJRPT.exe
  2⤵
  PID:10920
- C:\Windows\System\DKuMfdF.exe
  C:\Windows\System\DKuMfdF.exe
  2⤵
  PID:10964
- C:\Windows\System\nzTQldJ.exe
  C:\Windows\System\nzTQldJ.exe
  2⤵
  PID:10980
- C:\Windows\System\zbOzSWk.exe
  C:\Windows\System\zbOzSWk.exe
  2⤵
  PID:11000
- C:\Windows\System\okuQHyk.exe
  C:\Windows\System\okuQHyk.exe
  2⤵
  PID:11040
- C:\Windows\System\XnhBbSs.exe
  C:\Windows\System\XnhBbSs.exe
  2⤵
  PID:11060
- C:\Windows\System\jVEYoAy.exe
  C:\Windows\System\jVEYoAy.exe
  2⤵
  PID:11088
- C:\Windows\System\QrhSPCR.exe
  C:\Windows\System\QrhSPCR.exe
  2⤵
  PID:11128
- C:\Windows\System\ZJnZiSW.exe
  C:\Windows\System\ZJnZiSW.exe
  2⤵
  PID:11160
- C:\Windows\System\xWVuvmv.exe
  C:\Windows\System\xWVuvmv.exe
  2⤵
  PID:11188
- C:\Windows\System\vbHRLIR.exe
  C:\Windows\System\vbHRLIR.exe
  2⤵
  PID:11216
- C:\Windows\System\QdPYAqv.exe
  C:\Windows\System\QdPYAqv.exe
  2⤵
  PID:11244
- C:\Windows\System\KEVoNBK.exe
  C:\Windows\System\KEVoNBK.exe
  2⤵
  PID:10244
- C:\Windows\System\oUMbiae.exe
  C:\Windows\System\oUMbiae.exe
  2⤵
  PID:10256
- C:\Windows\System\hJKkLjT.exe
  C:\Windows\System\hJKkLjT.exe
  2⤵
  PID:10336
- C:\Windows\System\rewbLDo.exe
  C:\Windows\System\rewbLDo.exe
  2⤵
  PID:10384
- C:\Windows\System\aQYAOpl.exe
  C:\Windows\System\aQYAOpl.exe
  2⤵
  PID:9876
- C:\Windows\System\uEjfGRO.exe
  C:\Windows\System\uEjfGRO.exe
  2⤵
  PID:10508
- C:\Windows\System\wjLqSzU.exe
  C:\Windows\System\wjLqSzU.exe
  2⤵
  PID:10548
- C:\Windows\System\SouHoJV.exe
  C:\Windows\System\SouHoJV.exe
  2⤵
  PID:10600
- C:\Windows\System\PlIECXL.exe
  C:\Windows\System\PlIECXL.exe
  2⤵
  PID:10668
- C:\Windows\System\mtCkJzR.exe
  C:\Windows\System\mtCkJzR.exe
  2⤵
  PID:10776
- C:\Windows\System\VVflIcU.exe
  C:\Windows\System\VVflIcU.exe
  2⤵
  PID:2452
- C:\Windows\System\wbKYcQQ.exe
  C:\Windows\System\wbKYcQQ.exe
  2⤵
  PID:10876
- C:\Windows\System\SjRiFvt.exe
  C:\Windows\System\SjRiFvt.exe
  2⤵
  PID:10956
- C:\Windows\System\RBfieRu.exe
  C:\Windows\System\RBfieRu.exe
  2⤵
  PID:11052
- C:\Windows\System\uuVUheX.exe
  C:\Windows\System\uuVUheX.exe
  2⤵
  PID:11104
- C:\Windows\System\IeMikTZ.exe
  C:\Windows\System\IeMikTZ.exe
  2⤵
  PID:11172
- C:\Windows\System\HUpRDqS.exe
  C:\Windows\System\HUpRDqS.exe
  2⤵
  PID:11232
- C:\Windows\System\jznEAhV.exe
  C:\Windows\System\jznEAhV.exe
  2⤵
  PID:10268
- C:\Windows\System\wqVlcUx.exe
  C:\Windows\System\wqVlcUx.exe
  2⤵
  PID:10364
- C:\Windows\System\bDrwqME.exe
  C:\Windows\System\bDrwqME.exe
  2⤵
  PID:4432
- C:\Windows\System\szTfnvs.exe
  C:\Windows\System\szTfnvs.exe
  2⤵
  PID:10744
- C:\Windows\System\pdQKrTi.exe
  C:\Windows\System\pdQKrTi.exe
  2⤵
  PID:10848
- C:\Windows\System\ZUORGlC.exe
  C:\Windows\System\ZUORGlC.exe
  2⤵
  PID:10972
- C:\Windows\System\ZvEfVSM.exe
  C:\Windows\System\ZvEfVSM.exe
  2⤵
  PID:11124
- C:\Windows\System\QUgQixn.exe
  C:\Windows\System\QUgQixn.exe
  2⤵
  PID:11240
- C:\Windows\System\nQDUoFn.exe
  C:\Windows\System\nQDUoFn.exe
  2⤵
  PID:10388
- C:\Windows\System\YbQPQev.exe
  C:\Windows\System\YbQPQev.exe
  2⤵
  PID:10484
- C:\Windows\System\PLtVqRy.exe
  C:\Windows\System\PLtVqRy.exe
  2⤵
  PID:11020
- C:\Windows\System\lELkSGw.exe
  C:\Windows\System\lELkSGw.exe
  2⤵
  PID:10352
- C:\Windows\System\lJmgRRE.exe
  C:\Windows\System\lJmgRRE.exe
  2⤵
  PID:10764
- C:\Windows\System\FNSVvAt.exe
  C:\Windows\System\FNSVvAt.exe
  2⤵
  PID:11280
- C:\Windows\System\PwapmVE.exe
  C:\Windows\System\PwapmVE.exe
  2⤵
  PID:11300
- C:\Windows\System\xeVoCfc.exe
  C:\Windows\System\xeVoCfc.exe
  2⤵
  PID:11352
- C:\Windows\System\LNqAgLM.exe
  C:\Windows\System\LNqAgLM.exe
  2⤵
  PID:11380
- C:\Windows\System\ycdIsQz.exe
  C:\Windows\System\ycdIsQz.exe
  2⤵
  PID:11396
- C:\Windows\System\ZIRoKta.exe
  C:\Windows\System\ZIRoKta.exe
  2⤵
  PID:11424
- C:\Windows\System\AUgdTdd.exe
  C:\Windows\System\AUgdTdd.exe
  2⤵
  PID:11464
- C:\Windows\System\IDJmFNh.exe
  C:\Windows\System\IDJmFNh.exe
  2⤵
  PID:11492
- C:\Windows\System\cykoYHT.exe
  C:\Windows\System\cykoYHT.exe
  2⤵
  PID:11524
- C:\Windows\System\TjCNpTR.exe
  C:\Windows\System\TjCNpTR.exe
  2⤵
  PID:11552
- C:\Windows\System\Daaykyh.exe
  C:\Windows\System\Daaykyh.exe
  2⤵
  PID:11568
- C:\Windows\System\PTUFuUa.exe
  C:\Windows\System\PTUFuUa.exe
  2⤵
  PID:11608
- C:\Windows\System\IezZyZG.exe
  C:\Windows\System\IezZyZG.exe
  2⤵
  PID:11636
- C:\Windows\System\uCCiCHC.exe
  C:\Windows\System\uCCiCHC.exe
  2⤵
  PID:11652
- C:\Windows\System\vpueiYa.exe
  C:\Windows\System\vpueiYa.exe
  2⤵
  PID:11680
- C:\Windows\System\fByyMTO.exe
  C:\Windows\System\fByyMTO.exe
  2⤵
  PID:11708
- C:\Windows\System\dwoVUvP.exe
  C:\Windows\System\dwoVUvP.exe
  2⤵
  PID:11736
- C:\Windows\System\kYnsCGO.exe
  C:\Windows\System\kYnsCGO.exe
  2⤵
  PID:11776
- C:\Windows\System\qvbuMHb.exe
  C:\Windows\System\qvbuMHb.exe
  2⤵
  PID:11796
- C:\Windows\System\MnnabaG.exe
  C:\Windows\System\MnnabaG.exe
  2⤵
  PID:11832
- C:\Windows\System\cjgVOWL.exe
  C:\Windows\System\cjgVOWL.exe
  2⤵
  PID:11860
- C:\Windows\System\UhvmHYr.exe
  C:\Windows\System\UhvmHYr.exe
  2⤵
  PID:11888
- C:\Windows\System\LGjKZtO.exe
  C:\Windows\System\LGjKZtO.exe
  2⤵
  PID:11916
- C:\Windows\System\HZGbAer.exe
  C:\Windows\System\HZGbAer.exe
  2⤵
  PID:11944
- C:\Windows\System\sXVijON.exe
  C:\Windows\System\sXVijON.exe
  2⤵
  PID:11972
- C:\Windows\System\IIcqbIG.exe
  C:\Windows\System\IIcqbIG.exe
  2⤵
  PID:11988
- C:\Windows\System\bxPXSmK.exe
  C:\Windows\System\bxPXSmK.exe
  2⤵
  PID:12016
- C:\Windows\System\mKcAyAb.exe
  C:\Windows\System\mKcAyAb.exe
  2⤵
  PID:12056
- C:\Windows\System\XhxUBST.exe
  C:\Windows\System\XhxUBST.exe
  2⤵
  PID:12084
- C:\Windows\System\bHYyigh.exe
  C:\Windows\System\bHYyigh.exe
  2⤵
  PID:12100
- C:\Windows\System\njkTray.exe
  C:\Windows\System\njkTray.exe
  2⤵
  PID:12120
- C:\Windows\System\krMywjt.exe
  C:\Windows\System\krMywjt.exe
  2⤵
  PID:12148
- C:\Windows\System\eHdwjQG.exe
  C:\Windows\System\eHdwjQG.exe
  2⤵
  PID:12172
- C:\Windows\System\CcIUHoO.exe
  C:\Windows\System\CcIUHoO.exe
  2⤵
  PID:12188
- C:\Windows\System\AwgNvrf.exe
  C:\Windows\System\AwgNvrf.exe
  2⤵
  PID:12212
- C:\Windows\System\fIsLljA.exe
  C:\Windows\System\fIsLljA.exe
  2⤵
  PID:12236
- C:\Windows\System\WJGciof.exe
  C:\Windows\System\WJGciof.exe
  2⤵
  PID:12272
- C:\Windows\System\cWAmrXJ.exe
  C:\Windows\System\cWAmrXJ.exe
  2⤵
  PID:11296
- C:\Windows\System\zujevjf.exe
  C:\Windows\System\zujevjf.exe
  2⤵
  PID:3284
- C:\Windows\System\aFduaZY.exe
  C:\Windows\System\aFduaZY.exe
  2⤵
  PID:11420
- C:\Windows\System\amegnIO.exe
  C:\Windows\System\amegnIO.exe
  2⤵
  PID:11516
- C:\Windows\System\eaOzEpI.exe
  C:\Windows\System\eaOzEpI.exe
  2⤵
  PID:11544
- C:\Windows\System\XeQIJcD.exe
  C:\Windows\System\XeQIJcD.exe
  2⤵
  PID:11600
- C:\Windows\System\piveHzp.exe
  C:\Windows\System\piveHzp.exe
  2⤵
  PID:11668
- C:\Windows\System\nrCVPZV.exe
  C:\Windows\System\nrCVPZV.exe
  2⤵
  PID:11772
- C:\Windows\System\vvMRmJY.exe
  C:\Windows\System\vvMRmJY.exe
  2⤵
  PID:11816
- C:\Windows\System\dwWsjGc.exe
  C:\Windows\System\dwWsjGc.exe
  2⤵
  PID:11872
- C:\Windows\System\RxFrxOd.exe
  C:\Windows\System\RxFrxOd.exe
  2⤵
  PID:11968
- C:\Windows\System\IeIUKxb.exe
  C:\Windows\System\IeIUKxb.exe
  2⤵
  PID:12052
- C:\Windows\System\iYVfElv.exe
  C:\Windows\System\iYVfElv.exe
  2⤵
  PID:12096
- C:\Windows\System\tQHGjrQ.exe
  C:\Windows\System\tQHGjrQ.exe
  2⤵
  PID:12128
- C:\Windows\System\AuwwAUy.exe
  C:\Windows\System\AuwwAUy.exe
  2⤵
  PID:12184
- C:\Windows\System\uRzmFBG.exe
  C:\Windows\System\uRzmFBG.exe
  2⤵
  PID:12232
- C:\Windows\System\PVsXgHy.exe
  C:\Windows\System\PVsXgHy.exe
  2⤵
  PID:11408
- C:\Windows\System\KSVEcXU.exe
  C:\Windows\System\KSVEcXU.exe
  2⤵
  PID:11488
- C:\Windows\System\WWCfbLi.exe
  C:\Windows\System\WWCfbLi.exe
  2⤵
  PID:11564
- C:\Windows\System\PAjhmuJ.exe
  C:\Windows\System\PAjhmuJ.exe
  2⤵
  PID:11700
- C:\Windows\System\HvLPJRd.exe
  C:\Windows\System\HvLPJRd.exe
  2⤵
  PID:11844
- C:\Windows\System\nvykKtr.exe
  C:\Windows\System\nvykKtr.exe
  2⤵
  PID:11956
- C:\Windows\System\pZiLHxj.exe
  C:\Windows\System\pZiLHxj.exe
  2⤵
  PID:12248
- C:\Windows\System\ksrIXUu.exe
  C:\Windows\System\ksrIXUu.exe
  2⤵
  PID:11624
- C:\Windows\System\ZkrxVMG.exe
  C:\Windows\System\ZkrxVMG.exe
  2⤵
  PID:11768
- C:\Windows\System\zRqHGSP.exe
  C:\Windows\System\zRqHGSP.exe
  2⤵
  PID:11288
- C:\Windows\System\jaYfhjS.exe
  C:\Windows\System\jaYfhjS.exe
  2⤵
  PID:12076
- C:\Windows\System\UTFzHGX.exe
  C:\Windows\System\UTFzHGX.exe
  2⤵
  PID:12296
- C:\Windows\System\xgrClVo.exe
  C:\Windows\System\xgrClVo.exe
  2⤵
  PID:12324
- C:\Windows\System\ZLzrLnl.exe
  C:\Windows\System\ZLzrLnl.exe
  2⤵
  PID:12340
- C:\Windows\System\QVhaagy.exe
  C:\Windows\System\QVhaagy.exe
  2⤵
  PID:12364
- C:\Windows\System\GkjrOLD.exe
  C:\Windows\System\GkjrOLD.exe
  2⤵
  PID:12388
- C:\Windows\System\TbqQfQe.exe
  C:\Windows\System\TbqQfQe.exe
  2⤵
  PID:12436
- C:\Windows\System\dDmjYpo.exe
  C:\Windows\System\dDmjYpo.exe
  2⤵
  PID:12456
- C:\Windows\System\oisGyIt.exe
  C:\Windows\System\oisGyIt.exe
  2⤵
  PID:12484
- C:\Windows\System\nRpkgYV.exe
  C:\Windows\System\nRpkgYV.exe
  2⤵
  PID:12520
- C:\Windows\System\dIXnjOm.exe
  C:\Windows\System\dIXnjOm.exe
  2⤵
  PID:12536
- C:\Windows\System\vxIvtan.exe
  C:\Windows\System\vxIvtan.exe
  2⤵
  PID:12564
- C:\Windows\System\alqXtiD.exe
  C:\Windows\System\alqXtiD.exe
  2⤵
  PID:12596
- C:\Windows\System\rubKrZo.exe
  C:\Windows\System\rubKrZo.exe
  2⤵
  PID:12632
- C:\Windows\System\UWLuguT.exe
  C:\Windows\System\UWLuguT.exe
  2⤵
  PID:12660
- C:\Windows\System\UFxxnPn.exe
  C:\Windows\System\UFxxnPn.exe
  2⤵
  PID:12688
- C:\Windows\System\dtTFHVd.exe
  C:\Windows\System\dtTFHVd.exe
  2⤵
  PID:12712
- C:\Windows\System\mFzlGlY.exe
  C:\Windows\System\mFzlGlY.exe
  2⤵
  PID:12744
- C:\Windows\System\VrkWajR.exe
  C:\Windows\System\VrkWajR.exe
  2⤵
  PID:12760
- C:\Windows\System\rLkivWF.exe
  C:\Windows\System\rLkivWF.exe
  2⤵
  PID:12780
- C:\Windows\System\DJGsuma.exe
  C:\Windows\System\DJGsuma.exe
  2⤵
  PID:12824
- C:\Windows\System\pHtcAoT.exe
  C:\Windows\System\pHtcAoT.exe
  2⤵
  PID:12852
- C:\Windows\System\FCqyaWL.exe
  C:\Windows\System\FCqyaWL.exe
  2⤵
  PID:12880
- C:\Windows\System\BLcTGXf.exe
  C:\Windows\System\BLcTGXf.exe
  2⤵
  PID:12908
- C:\Windows\System\owmlxap.exe
  C:\Windows\System\owmlxap.exe
  2⤵
  PID:12936
- C:\Windows\System\PWsDZAD.exe
  C:\Windows\System\PWsDZAD.exe
  2⤵
  PID:12956
- C:\Windows\System\fUpQOTi.exe
  C:\Windows\System\fUpQOTi.exe
  2⤵
  PID:12980
- C:\Windows\System\zqWzAaM.exe
  C:\Windows\System\zqWzAaM.exe
  2⤵
  PID:13000
- C:\Windows\System\TgqbObg.exe
  C:\Windows\System\TgqbObg.exe
  2⤵
  PID:13032
- C:\Windows\System\DpJrlvA.exe
  C:\Windows\System\DpJrlvA.exe
  2⤵
  PID:13060
- C:\Windows\System\kwFMsAZ.exe
  C:\Windows\System\kwFMsAZ.exe
  2⤵
  PID:13100
- C:\Windows\System\LjdlejM.exe
  C:\Windows\System\LjdlejM.exe
  2⤵
  PID:13132
- C:\Windows\System\kvKQYaz.exe
  C:\Windows\System\kvKQYaz.exe
  2⤵
  PID:13172
- C:\Windows\System\UikGPEZ.exe
  C:\Windows\System\UikGPEZ.exe
  2⤵
  PID:13192
- C:\Windows\System\wVRpSnm.exe
  C:\Windows\System\wVRpSnm.exe
  2⤵
  PID:13216
- C:\Windows\System\LZdfznx.exe
  C:\Windows\System\LZdfznx.exe
  2⤵
  PID:13232
- C:\Windows\System\OfxbiAR.exe
  C:\Windows\System\OfxbiAR.exe
  2⤵
  PID:13260
- C:\Windows\System\hxvaMEe.exe
  C:\Windows\System\hxvaMEe.exe
  2⤵
  PID:13280
- C:\Windows\System\uLWvOdb.exe
  C:\Windows\System\uLWvOdb.exe
  2⤵
  PID:12336
- C:\Windows\System\UGZsqlE.exe
  C:\Windows\System\UGZsqlE.exe
  2⤵
  PID:12404
- C:\Windows\System\WqSGVvy.exe
  C:\Windows\System\WqSGVvy.exe
  2⤵
  PID:12444
- C:\Windows\System\nfYFeFz.exe
  C:\Windows\System\nfYFeFz.exe
  2⤵
  PID:12504
- C:\Windows\System\eWxLMVc.exe
  C:\Windows\System\eWxLMVc.exe
  2⤵
  PID:12584
- C:\Windows\System\IceOvEP.exe
  C:\Windows\System\IceOvEP.exe
  2⤵
  PID:12644
- C:\Windows\System\cOtgGUw.exe
  C:\Windows\System\cOtgGUw.exe
  2⤵
  PID:12704
- C:\Windows\System\nVDvhBt.exe
  C:\Windows\System\nVDvhBt.exe
  2⤵
  PID:12740
- C:\Windows\System\gzobfxV.exe
  C:\Windows\System\gzobfxV.exe
  2⤵
  PID:12800
- C:\Windows\System\LAcdmKk.exe
  C:\Windows\System\LAcdmKk.exe
  2⤵
  PID:12836
- C:\Windows\System\utBtsxw.exe
  C:\Windows\System\utBtsxw.exe
  2⤵
  PID:12896
- C:\Windows\System\NRsTsee.exe
  C:\Windows\System\NRsTsee.exe
  2⤵
  PID:12964
- C:\Windows\System\SZzUNYD.exe
  C:\Windows\System\SZzUNYD.exe
  2⤵
  PID:13024
- C:\Windows\System\AMSxGYW.exe
  C:\Windows\System\AMSxGYW.exe
  2⤵
  PID:13124
- C:\Windows\System\gzNAlFt.exe
  C:\Windows\System\gzNAlFt.exe
  2⤵
  PID:13208
- C:\Windows\System\VBbsOAX.exe
  C:\Windows\System\VBbsOAX.exe
  2⤵
  PID:13268
- C:\Windows\System\YQAbkQv.exe
  C:\Windows\System\YQAbkQv.exe
  2⤵
  PID:11484
- C:\Windows\System\DsaEWUm.exe
  C:\Windows\System\DsaEWUm.exe
  2⤵
  PID:12452
- C:\Windows\System\grapdKq.exe
  C:\Windows\System\grapdKq.exe
  2⤵
  PID:12732
- C:\Windows\System\YKspQoi.exe
  C:\Windows\System\YKspQoi.exe
  2⤵
  PID:12816
- C:\Windows\System\EuXTiEc.exe
  C:\Windows\System\EuXTiEc.exe
  2⤵
  PID:12864
- C:\Windows\System\kneNiIc.exe
  C:\Windows\System\kneNiIc.exe
  2⤵
  PID:13072
- C:\Windows\System\eAclICl.exe
  C:\Windows\System\eAclICl.exe
  2⤵
  PID:13120
- C:\Windows\System\ZuIcMYw.exe
  C:\Windows\System\ZuIcMYw.exe
  2⤵
  PID:12372
- C:\Windows\System\gtrCXpR.exe
  C:\Windows\System\gtrCXpR.exe
  2⤵
  PID:1660
- C:\Windows\System\VNGDwPc.exe
  C:\Windows\System\VNGDwPc.exe
  2⤵
  PID:12768
- C:\Windows\System\WrhrYsQ.exe
  C:\Windows\System\WrhrYsQ.exe
  2⤵
  PID:13228
- C:\Windows\System\SIXtIxj.exe
  C:\Windows\System\SIXtIxj.exe
  2⤵
  PID:2316
- C:\Windows\System\LSMiWOd.exe
  C:\Windows\System\LSMiWOd.exe
  2⤵
  PID:13152
- C:\Windows\System\SArpfpW.exe
  C:\Windows\System\SArpfpW.exe
  2⤵
  PID:12728
- C:\Windows\System\gTMwlSO.exe
  C:\Windows\System\gTMwlSO.exe
  2⤵
  PID:13332
- C:\Windows\System\YdAgLoe.exe
  C:\Windows\System\YdAgLoe.exe
  2⤵
  PID:13356
- C:\Windows\System\VGZivyV.exe
  C:\Windows\System\VGZivyV.exe
  2⤵
  PID:13400
- C:\Windows\System\NwpkbVq.exe
  C:\Windows\System\NwpkbVq.exe
  2⤵
  PID:13424
- C:\Windows\System\NySnqJx.exe
  C:\Windows\System\NySnqJx.exe
  2⤵
  PID:13452
- C:\Windows\System\SaBIqpZ.exe
  C:\Windows\System\SaBIqpZ.exe
  2⤵
  PID:13472
- C:\Windows\System\yopcfzu.exe
  C:\Windows\System\yopcfzu.exe
  2⤵
  PID:13512
- C:\Windows\System\xhUmElJ.exe
  C:\Windows\System\xhUmElJ.exe
  2⤵
  PID:13536
- C:\Windows\System\suMEItn.exe
  C:\Windows\System\suMEItn.exe
  2⤵
  PID:13556
- C:\Windows\System\nWZZCEz.exe
  C:\Windows\System\nWZZCEz.exe
  2⤵
  PID:13596
- C:\Windows\System\ECCggfn.exe
  C:\Windows\System\ECCggfn.exe
  2⤵
  PID:13624
- C:\Windows\System\LstAVjL.exe
  C:\Windows\System\LstAVjL.exe
  2⤵
  PID:13648
- C:\Windows\System\MZjuZVg.exe
  C:\Windows\System\MZjuZVg.exe
  2⤵
  PID:13668
- C:\Windows\System\DBigQrc.exe
  C:\Windows\System\DBigQrc.exe
  2⤵
  PID:13696
- C:\Windows\System\deyysIO.exe
  C:\Windows\System\deyysIO.exe
  2⤵
  PID:13724
- C:\Windows\System\pXmseEs.exe
  C:\Windows\System\pXmseEs.exe
  2⤵
  PID:13744
- C:\Windows\System\VdlWBnY.exe
  C:\Windows\System\VdlWBnY.exe
  2⤵
  PID:13780
- C:\Windows\System\zzYlAtA.exe
  C:\Windows\System\zzYlAtA.exe
  2⤵
  PID:13804
- C:\Windows\System\GfCqIne.exe
  C:\Windows\System\GfCqIne.exe
  2⤵
  PID:13848
- C:\Windows\System\Juarkqu.exe
  C:\Windows\System\Juarkqu.exe
  2⤵
  PID:13876
- C:\Windows\System\CUvfmUX.exe
  C:\Windows\System\CUvfmUX.exe
  2⤵
  PID:13904
- C:\Windows\System\ikKFdyr.exe
  C:\Windows\System\ikKFdyr.exe
  2⤵
  PID:13920
- C:\Windows\System\CGjJWrk.exe
  C:\Windows\System\CGjJWrk.exe
  2⤵
  PID:13944
- C:\Windows\System\Exripny.exe
  C:\Windows\System\Exripny.exe
  2⤵
  PID:13976
- C:\Windows\System\MVtWnaf.exe
  C:\Windows\System\MVtWnaf.exe
  2⤵
  PID:14004
- C:\Windows\System\dtTvwGY.exe
  C:\Windows\System\dtTvwGY.exe
  2⤵
  PID:14044
- C:\Windows\System\VGdsxnk.exe
  C:\Windows\System\VGdsxnk.exe
  2⤵
  PID:14072
- C:\Windows\System\CfLqjAg.exe
  C:\Windows\System\CfLqjAg.exe
  2⤵
  PID:14092
- C:\Windows\System\ihKrKUR.exe
  C:\Windows\System\ihKrKUR.exe
  2⤵
  PID:14120
- C:\Windows\System\dUmYJNT.exe
  C:\Windows\System\dUmYJNT.exe
  2⤵
  PID:14156
- C:\Windows\System\xJhAcat.exe
  C:\Windows\System\xJhAcat.exe
  2⤵
  PID:14172
- C:\Windows\System\DDsPGPC.exe
  C:\Windows\System\DDsPGPC.exe
  2⤵
  PID:14200
- C:\Windows\System\oAKHHaE.exe
  C:\Windows\System\oAKHHaE.exe
  2⤵
  PID:14240
- C:\Windows\System\RfSRpPW.exe
  C:\Windows\System\RfSRpPW.exe
  2⤵
  PID:14260
- C:\Windows\System\NUaVLmY.exe
  C:\Windows\System\NUaVLmY.exe
  2⤵
  PID:14284
- C:\Windows\System\fFktFon.exe
  C:\Windows\System\fFktFon.exe
  2⤵
  PID:14304
- C:\Windows\System\McdcHAE.exe
  C:\Windows\System\McdcHAE.exe
  2⤵
  PID:14332
- C:\Windows\System\kIrfKaK.exe
  C:\Windows\System\kIrfKaK.exe
  2⤵
  PID:13380
- C:\Windows\System\cptnuRj.exe
  C:\Windows\System\cptnuRj.exe
  2⤵
  PID:13416
- C:\Windows\System\LuXmkDz.exe
  C:\Windows\System\LuXmkDz.exe
  2⤵
  PID:13508
- C:\Windows\System\RcSdDZp.exe
  C:\Windows\System\RcSdDZp.exe
  2⤵
  PID:13612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BfmCUJT.exe

Filesize
1.9MB

MD5
970701dbd6bcb36d39b9b0eaccd943eb

SHA1
4d2531789812d6b6f8fc287ac9afb6828b1e7de3

SHA256
19b71f3cb5e43fa79d88bb5ec4144627786fe6882b1345706123634d8ccda8d4

SHA512
73114aa3973e4ead581c5fba8f31303442152baf00834b093f46324e56830b79a4482964ea9a1932e8dabc2add7299eda981692332a23699a769225892f07816

Download Submit
C:\Windows\System\BkwLNLo.exe

Filesize
1.9MB

MD5
ad1fcf4c63852b2d79f94aacf64b3cbf

SHA1
cbbca6cb754da4634b03ea89b7a960eca98bc551

SHA256
597e16201d78c570377fa8aa3b8d1a6daaa4492d996becdd67a41611579e90bf

SHA512
a526d9d30647ccab4f6037c41332532d9a2b9f64c8e7dcd91452da4f3850ae702ac3c3e2a4619be16681193a7e81bb569d8bd0bd79e9bce37dab6af3a8c465c3

Download Submit
C:\Windows\System\BloRXOk.exe

Filesize
1.9MB

MD5
4b2aae2d13628074630f6587dd6c870a

SHA1
d45acbdf2471799cea70684b22cbf8144b56c573

SHA256
9d65520bd342a4a4df06fb574a32925fc2a7ab048bf6dff6027d6dde04f6322d

SHA512
ecf5677b1882cf3eec676c36a09684539e05e718160d510d084efccd0a552e1ad5a2e83b7b60e4d7881ba0900ef164414211da7a96ddf982c5eba8db804bc856

Download Submit
C:\Windows\System\CWeVtpn.exe

Filesize
1.9MB

MD5
e5f4e78676f267d46ff5ef2778f72d44

SHA1
59bef41dbfdc80e3810a29c10451e7b0da9a3445

SHA256
24e4ae27b7190f8a28fc95cb3d3ce1dd3f69288a54dc12258df5bb1acd230aab

SHA512
33c7c5e59f0988667b350422ceba1009c95694bdceeafe6b167877d29db1d38293e2dd7ae94eee55671592f830181f71505191c67bdfbb630f14265e8ac5f643

Download Submit
C:\Windows\System\DFkwTUC.exe

Filesize
1.9MB

MD5
a19da0ee9d938c8aa627fb51491d21fd

SHA1
cb23b317c684ab5db19834173b13308b4551cf58

SHA256
7d061cd470638f2916dee8bf3296469da61ad64bc5b0f646b8876876d48d70aa

SHA512
b630be3c040ff32d9d90d5cfc5eba4b5f66bd95cceb5bbbba517a4e1812f0974833056860161183d75351561f4950027931181fd697688b553fb0e39b2829e23

Download Submit
C:\Windows\System\ECtnTOI.exe

Filesize
1.9MB

MD5
9bc770f8cda886d25916ab8aaae6d0cb

SHA1
97e2743817e93230769f0b32920a8c757144dd6b

SHA256
b1b81cc686b28cb640d6e75ff494fd2568ddf5aa96674e3ce9ba2302f2981560

SHA512
98d75b3eff8dfb18b6d053e591672073984b7bba2c0a9a88c28247ae85107d653bf22e9ada752e460aae2c342f9b3d31fada288fa341714903a5dc69c9e72a8b

Download Submit
C:\Windows\System\EuGrJzM.exe

Filesize
1.9MB

MD5
c72c7fd1b064f3000a8ded4e8589e481

SHA1
61da9ea81ecfb4771ce046a42951c8278b39095c

SHA256
87fb925fd91547ab1061ca1208439ff95835de85cdf1b99be7e39b027dd5235a

SHA512
e9c26aab4304f831d0b871f96bbf6ce46f68dce7e53c477574d3d07e934cbcddabfacf5fa69c9bbcd88946c905292dcae744eb5a1cea1388d1307474347432a4

Download Submit
C:\Windows\System\HKYluGG.exe

Filesize
1.9MB

MD5
e2a0d46ab5d1292a0261050d3f5903ae

SHA1
382976bc29192f1c18e1ac044637f58186892a34

SHA256
7a9514b0e0eb886781e09fdca9089c320a51394ae719c5fa78691fc716e5e964

SHA512
2b2d7a0f8da2449890cea74319f0dffc51c16375dcd1741d12671d7e4c586641d441233742418cc82b6a862d607ffb4e82dcef2d5e0a4bd922110dbcf7f65057

Download Submit
C:\Windows\System\IdITDhD.exe

Filesize
1.9MB

MD5
3a41d8e6c86783576a13ebf6e569f5b0

SHA1
bebf55212d9251a18095d15eafcb1ff3c278fd5e

SHA256
1eff702a0333400bd57bc8e10ccd639d121cd7167c7f718fa647f1d4f3f79c68

SHA512
c8c8e9a1326b8409ff9c72739b564d2cfbca57357ad9c4a5dc991f6a3f96a56de2b8be2cb75cd197757d48b58de111ef029755a45a9d0409d509c464d5834eb2

Download Submit
C:\Windows\System\NzgcqsP.exe

Filesize
1.9MB

MD5
1aa67627446ba82a64a44fc26e19ad5b

SHA1
46255277c4d76a21b2c269479732b38735e5ea31

SHA256
231d89b894e752fb8cfd76a5c7039623e18b5b337aaa1b8082407b7ab8bd5abc

SHA512
ee47e309e69e796abd9b4ee1747c4dcd9a4ba8219bcdfdfe45fa7e86e4c6d1a9470bdb97304c9274e77ecb30de9c19dff9efe90d30ed14f6cb398a6d838b7079

Download Submit
C:\Windows\System\OMwhjxT.exe

Filesize
1.9MB

MD5
2e17ccb7e83e1226b941c456e6dd35b1

SHA1
a350d365cf4649d4822f5863453cbe9f5329dad6

SHA256
1c64caca751beae91497bbf2e1032a4d7a2c2ae227ab978484d405db7d478882

SHA512
5a8ee152546c19085be3ea9d1d04c0fcd1c964d2c66ccf7d6eae7a888472ffcdb6032960f2fa51407db71ca297d5fc2c2ae8e626b698349c710d3e6ea2bc39c8

Download Submit
C:\Windows\System\PqOBDro.exe

Filesize
1.9MB

MD5
1422c7346b640033d67a7842f02ba601

SHA1
7785eb4b1e55f9d8f2edbe4f653b707f231e3b0b

SHA256
378e268eb0dab4879dd000614cf4b5b88605f0ce9d00a1df4cab226e2ffb07dc

SHA512
c3a6a233e67a149f2402807b36406748b008ec64b83cd8b6b0771fe2d5845aa24ed0813688c4c9ff2a77933b9eb545caeca2f10f876cd2fa99289f9867b97165

Download Submit
C:\Windows\System\UMXrxhQ.exe

Filesize
1.9MB

MD5
cfe6e694e1f7910ab56ce810ec4f7d94

SHA1
e1fe227447fd350834692c7e04e08470a9f24a62

SHA256
070f63d6781f967868370769653672501b5acfb5ecbf477db153827d5e9140f9

SHA512
efa1b47837b43b93d8e3bf3c93e854c0b2a96eb8ddba22839e97e99dbce5b0fac1745593710e49d181cd24b27e74df4e5103259526874c46a34d4535f9343e32

Download Submit
C:\Windows\System\VMRloHe.exe

Filesize
1.9MB

MD5
325d9f8605abcb846be461939aa88cdd

SHA1
2c81e1b7ed60725438a5a773cb141c5c6a9ff0d7

SHA256
2b507f63cd34215647e6e5160adffe1b4972d14a6ca34e9fbadde9f690c86d2f

SHA512
d7777831edd1cf2d0882571426ddaa23fc67622dd4e553e3e68c7022c98b728a2866ce181a9c89131ac2ab5d7103cdf261d23a7e8f77667c83e1d7b22b349432

Download Submit
C:\Windows\System\VWKXJDc.exe

Filesize
1.9MB

MD5
3d30f184dd7f3a2982b06ef29a2bca06

SHA1
4cbdda288f118424fd5c116e55169fb401f58ca4

SHA256
4f1677c05e36d8fcf0bbfb623a68075af1ee87f0a7b8a3992febf0f6e34da241

SHA512
121fa713fda6a8cedd4f71b741005639ceb4d2de124179037bdfd3aea4a53d22164b61f1251f560d2ea8553446412668dae88e875ecc522b07236f8f534b14db

Download Submit
C:\Windows\System\WsdBcpf.exe

Filesize
1.9MB

MD5
2824e79391ebea3433871af4f8ba3a0d

SHA1
61327de6d5cef8b3f0c70181df3a7aaa6d5e6ccb

SHA256
35129da326cb83ef4fe79c7de704c8a5e7406eb9f327890207349a1ca5e6845a

SHA512
efbef40948c55607565399233658382cb140dcd6290e7095d321ed797a25653907330d4fe98700fc4d87c77c1acf77f26fe58833cbbae5654944f4f1aeeeefae

Download Submit
C:\Windows\System\XgAPopl.exe

Filesize
1.9MB

MD5
49b1351099a594b62bd4113246088d25

SHA1
f5372b87dcf94e14525082106fd29bf814b338ce

SHA256
be344d93a4c326e8a870bd5c2aabbe0cf20c3e9af8f8d0a87a8941a5bfeac86a

SHA512
0306a643154bbbc61f28ae9b833ed143841e462170f16d8ec7ce3dcb4d9c655c30d64a0c29bd5f618770589bbe9bf948795570588c853d1a44a744360f23744d

Download Submit
C:\Windows\System\YyDufnu.exe

Filesize
1.9MB

MD5
a5acf290950ca8edc6a44c2af058cd51

SHA1
1114e5ac89809d4f2e15d1ea52a3a34180587a4f

SHA256
c8f05bda536e015a16d9504ca2e40323021a5028b9f86d66cf4cc9f5f31e1751

SHA512
6fff4611378aede6acda0f7e8f770fb43d63935c8fb532ec78318e57c59ac86120adbabc181109cd1f82621d2901e1053b7c4918c9e4f187a321e29c0080bfbd

Download Submit
C:\Windows\System\ZMiyRmy.exe

Filesize
1.9MB

MD5
b2206a9cabf82045acf1bdf13bd50fae

SHA1
34e5003eb938adc644e8f1bb3aa5e14702c8641e

SHA256
659e17abfb94ea62b5c294f0bb151b979133cf25d25519e69cdcc34561a43d67

SHA512
7363cfe25e5505dd1083c38347d9976f9233d4d1c6377a40beea62f79f7e4c17859b22cca209931696e1fdfe8289c07c82644e6f5d4f336c0485fcea45de17da

Download Submit
C:\Windows\System\ZcSZvyy.exe

Filesize
1.9MB

MD5
21678c3bf3fd287f0ec77b7987834a9d

SHA1
5a24f725c2ed51ecb11a7c202c71d6c6e483e932

SHA256
db13995c8c2289a57e5fc561124a2ffbdf565828d69941486ed1ecba53d061b1

SHA512
9ae98dcd1046676ccd5e1abdcc3dafe23897cca9f081e0ac05618f01f257873a8160c761fa8e835b7c6df24f28d13aca586b60202ec973fb0f98f2143d525972

Download Submit
C:\Windows\System\bNVzwiw.exe

Filesize
1.9MB

MD5
0c3c9ca5b9ab69a81f1eafa15b345bed

SHA1
0e9402fb3be26836d4c09fe54a76672f603fd9d7

SHA256
86251c669683976ac9076a9969bbd9a98f477e2c6514b0a9eb95a0eee5b2c0ce

SHA512
3be3fa32270f2a19fe9f379be7ce52813977ae1093145ad23a1446e3d64b7a256f2acedeeba5e5b10753f93a0f4ff009c238fc85d7d0aa812ea4193b4604d94a

Download Submit
C:\Windows\System\dnSrLDZ.exe

Filesize
1.9MB

MD5
e56e4dd4865a24778dc209dc57e5d7ad

SHA1
b21d2594caefde6321b73957ce083af102928228

SHA256
0347cfa8db6672894400daf7c7b3887baa60f49c6311e453d15c6fd1e49c4094

SHA512
57dd39b63d35d98563c663adac54b271422dc8cd6f36631828a752c7307589a3285f33d76844d1282cf42b71a0dfce306dc042c2f277591c4f5bd1bfcfb7b93a

Download Submit
C:\Windows\System\dthdana.exe

Filesize
1.9MB

MD5
26aaadfdaa8da571b56f19e775463b84

SHA1
89b1fc37ddb1fb6a2dd5f4c6a84fed0f285ca86b

SHA256
b7d13296fd1e4f05b7b935ec588738f62700abf1ac4e2dfe762f3da3e99dbff5

SHA512
ef4cf9bef00bdb00481aaf73e7d140a1839bbaa39bac8976790eb2c02efb398b8a8e7caee85bd84919e849efb96a5eb8469383b0df168d23d71936c25c893d30

Download Submit
C:\Windows\System\ihAMzjW.exe

Filesize
1.9MB

MD5
d06621bc3a33bbbaaa42aa17f4b60ca4

SHA1
2c6335e18df623840826968a3cdfe912d1274c19

SHA256
1e1aa8682173f7d6e5e0525bd84a84cce3879c9cdac996d289f10b822a19edfe

SHA512
05393b56ca91c5a3fe367d5aebdeb693de8b5d9166cf125ac779ae673bc921d11d16a4a2eaa277fd231c8933ba9b6b1cffd2971025e81c99b8f6a15691be4395

Download Submit
C:\Windows\System\iwIjMMM.exe

Filesize
1.9MB

MD5
fc104210453a217a0b8193b15e2a49e9

SHA1
cb4ad8515e9c01ab579c602efb1ac0efb592cbeb

SHA256
5bf4a60d883b5b5416358a30ab1c709e61e715485fcc70391ba0b93cc8f07cfb

SHA512
81e95509ee9487a77cf7b4a42429fc7e3ad5c7cac1f906ece2072fb18d12f773be5707b08923e5838fac6e6373aff366ff3f27a8d936a818113815ce78059afa

Download Submit
C:\Windows\System\lTpgwlj.exe

Filesize
1.9MB

MD5
779bce0b181e26dfa98d73fdca0c5367

SHA1
dc7142193afd37c4d78e786aef476ba463222a26

SHA256
a44c484a6a4097bb4d59295f0e6df98ece97497918c5e2ec6206259b401197d6

SHA512
014967cfc1ee9801e80d1f93e6794a1772f62b0065d75f9f1bce023491abc48db57dd23db59b1cbff26a0bad419df631cbd073b94734e571952d060f2950dada

Download Submit
C:\Windows\System\mcMMdLJ.exe

Filesize
1.9MB

MD5
4f749861356dff866bcd932e4be656c6

SHA1
ea66fb01522407ef452a59f9daef596e9d712950

SHA256
4304f1e6b97cb806c878ebbd1abecb05bce11172a0b5ccb61f8261c37206daf0

SHA512
f90f14a3a10b4a5b5530a2ca0f547579205d1dffd9bdaca8259846d4aef561c0067745cb063d7b88472265e37888632297ea1e8d72ed4b41a44f98a77a9b005d

Download Submit
C:\Windows\System\nDziNoq.exe

Filesize
1.9MB

MD5
0935212033820f0f7332839cef2a8ac5

SHA1
ccec0eec4752a55c9e11d9fa3fbcc0dc08776c75

SHA256
b40be7b8c03ad5b0e2933843c7a8c34129b2ad064f683b9600d1c5bca265922b

SHA512
7a3c5a37bdd665cdf8e70e6f0bf525d3136b9aa661f0737357efd45797935eb3cc9701e5614d6cd62ba6982e3ed85e94c53a9c4560351639b8c4cc5ea0547e50

Download Submit
C:\Windows\System\paNQuCv.exe

Filesize
1.9MB

MD5
0cd26a024912f01bb6a0f473ba982109

SHA1
228f9cb679c66b8beb58c1fc6b804c253253df77

SHA256
a082163e1299b235137181e8d00231e8f113ba734e5ac091ca98b141f790a774

SHA512
12c437d58ef5d21de5fd142a974eeada77c6afeebe66fdbb75aaf849103d13bf79a875aff9a5880e5894734bbd9579cab016c8cc51dcd6fbba8d18b81056dca6

Download Submit
C:\Windows\System\sDlmVOi.exe

Filesize
1.9MB

MD5
d4345346b66784582abaecbe22a900d0

SHA1
338ee6dd0a6c14128792ad905ae4ef8fbef63c57

SHA256
b7e80aec6a70e3299b6e8a5ac88f634d4fba05f4d53d9a38b9a407ccfb0b0ac4

SHA512
8c3e8c881356c33ed6e08db8a764a6fa6985698ff377d6390cbe34c62cd0fd3e77e0f100b4618c9378cf2a8245824d9e4b348d26e375e49e678ee50447cdfa16

Download Submit
C:\Windows\System\sJIDQLf.exe

Filesize
1.9MB

MD5
fb79541b46837ec4beeb7504d68aaa32

SHA1
54ba15919558c0169cc3177b8c25703685fc69e6

SHA256
297af21a6bd0238bb161af3d409e8de33c91fd286ce0537a3a9de6e8ca923c67

SHA512
632b41f418c3a676ecc6a8e295d1550c5b5623e10dd68127578096602c345aa3b3a0fd2e6959939952c2ad26c94ff7ed5342d927df96a1f283ddc241d6e34521

Download Submit
C:\Windows\System\wmFsaYR.exe

Filesize
1.9MB

MD5
40eb4ced243ce28ed81a2866a7d2f93a

SHA1
c835851665f8a7a082804cf29d34c86b794e086d

SHA256
48460e001d53e49c6fa1319464e9de3377582249caea0122e9add5dbc94523d0

SHA512
b90160b421911068d93adbe27792abba5bbca045639ff91008a6cbde5eac709ed292195e987a23dd059dfeeba6bd15dbdd1576b8d5959e9486c257ae8f840954

Download Submit
C:\Windows\System\xRfoztO.exe

Filesize
1.9MB

MD5
d0bcc1a99d7ce2d94c6f18243c97d663

SHA1
66fcf7c000e1f7364d10ef5794bcf7ac9948ad4f

SHA256
223c9a18489be80e5e1842db0fc50f0ebf62f1dd0888395509506be4643c24ac

SHA512
183b575f0cb81917012045711ed6f32a6de3c48b1b72a5027940cb6feddc0a7c42e3048599d49609fd677a0cf8933350968cb23b3f7895207e349141afaebcb9

Download Submit
memory/980-643-0x00007FF6FD680000-0x00007FF6FD9D4000-memory.dmp

Filesize
3.3MB

Download
memory/980-2175-0x00007FF6FD680000-0x00007FF6FD9D4000-memory.dmp

Filesize
3.3MB

Download
memory/1076-2146-0x00007FF6BDA70000-0x00007FF6BDDC4000-memory.dmp

Filesize
3.3MB

Download
memory/1076-27-0x00007FF6BDA70000-0x00007FF6BDDC4000-memory.dmp

Filesize
3.3MB

Download
memory/1076-2151-0x00007FF6BDA70000-0x00007FF6BDDC4000-memory.dmp

Filesize
3.3MB

Download
memory/1080-2171-0x00007FF70E5D0000-0x00007FF70E924000-memory.dmp

Filesize
3.3MB

Download
memory/1080-688-0x00007FF70E5D0000-0x00007FF70E924000-memory.dmp

Filesize
3.3MB

Download
memory/1456-542-0x00007FF69E8D0000-0x00007FF69EC24000-memory.dmp

Filesize
3.3MB

Download
memory/1456-2155-0x00007FF69E8D0000-0x00007FF69EC24000-memory.dmp

Filesize
3.3MB

Download
memory/1692-2161-0x00007FF6DCF30000-0x00007FF6DD284000-memory.dmp

Filesize
3.3MB

Download
memory/1692-609-0x00007FF6DCF30000-0x00007FF6DD284000-memory.dmp

Filesize
3.3MB

Download
memory/1852-2158-0x00007FF750450000-0x00007FF7507A4000-memory.dmp

Filesize
3.3MB

Download
memory/1852-563-0x00007FF750450000-0x00007FF7507A4000-memory.dmp

Filesize
3.3MB

Download
memory/2104-2154-0x00007FF7E9FC0000-0x00007FF7EA314000-memory.dmp

Filesize
3.3MB

Download
memory/2104-544-0x00007FF7E9FC0000-0x00007FF7EA314000-memory.dmp

Filesize
3.3MB

Download
memory/2188-2156-0x00007FF6ACE20000-0x00007FF6AD174000-memory.dmp

Filesize
3.3MB

Download
memory/2188-595-0x00007FF6ACE20000-0x00007FF6AD174000-memory.dmp

Filesize
3.3MB

Download
memory/2264-2145-0x00007FF75D3B0000-0x00007FF75D704000-memory.dmp

Filesize
3.3MB

Download
memory/2264-2150-0x00007FF75D3B0000-0x00007FF75D704000-memory.dmp

Filesize
3.3MB

Download
memory/2264-23-0x00007FF75D3B0000-0x00007FF75D704000-memory.dmp

Filesize
3.3MB

Download
memory/2304-2164-0x00007FF7E4990000-0x00007FF7E4CE4000-memory.dmp

Filesize
3.3MB

Download
memory/2304-616-0x00007FF7E4990000-0x00007FF7E4CE4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-2162-0x00007FF7FA6A0000-0x00007FF7FA9F4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-585-0x00007FF7FA6A0000-0x00007FF7FA9F4000-memory.dmp

Filesize
3.3MB

Download
memory/2948-1-0x000002427DB80000-0x000002427DB90000-memory.dmp

Filesize
64KB

Download
memory/2948-0-0x00007FF720B10000-0x00007FF720E64000-memory.dmp

Filesize
3.3MB

Download
memory/2992-2149-0x00007FF66B120000-0x00007FF66B474000-memory.dmp

Filesize
3.3MB

Download
memory/2992-16-0x00007FF66B120000-0x00007FF66B474000-memory.dmp

Filesize
3.3MB

Download
memory/3180-553-0x00007FF74C7B0000-0x00007FF74CB04000-memory.dmp

Filesize
3.3MB

Download
memory/3180-2165-0x00007FF74C7B0000-0x00007FF74CB04000-memory.dmp

Filesize
3.3MB

Download
memory/3216-2172-0x00007FF6D3CE0000-0x00007FF6D4034000-memory.dmp

Filesize
3.3MB

Download
memory/3216-667-0x00007FF6D3CE0000-0x00007FF6D4034000-memory.dmp

Filesize
3.3MB

Download
memory/3272-2157-0x00007FF6BD0D0000-0x00007FF6BD424000-memory.dmp

Filesize
3.3MB

Download
memory/3272-589-0x00007FF6BD0D0000-0x00007FF6BD424000-memory.dmp

Filesize
3.3MB

Download
memory/3316-2153-0x00007FF6F4500000-0x00007FF6F4854000-memory.dmp

Filesize
3.3MB

Download
memory/3316-541-0x00007FF6F4500000-0x00007FF6F4854000-memory.dmp

Filesize
3.3MB

Download
memory/3420-2152-0x00007FF7B7450000-0x00007FF7B77A4000-memory.dmp

Filesize
3.3MB

Download
memory/3420-2147-0x00007FF7B7450000-0x00007FF7B77A4000-memory.dmp

Filesize
3.3MB

Download
memory/3420-32-0x00007FF7B7450000-0x00007FF7B77A4000-memory.dmp

Filesize
3.3MB

Download
memory/3424-8-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp

Filesize
3.3MB

Download
memory/3424-2144-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp

Filesize
3.3MB

Download
memory/3424-2148-0x00007FF7188A0000-0x00007FF718BF4000-memory.dmp

Filesize
3.3MB

Download
memory/3492-658-0x00007FF6AAA50000-0x00007FF6AADA4000-memory.dmp

Filesize
3.3MB

Download
memory/3492-2174-0x00007FF6AAA50000-0x00007FF6AADA4000-memory.dmp

Filesize
3.3MB

Download
memory/3580-664-0x00007FF79AE10000-0x00007FF79B164000-memory.dmp

Filesize
3.3MB

Download
memory/3580-2173-0x00007FF79AE10000-0x00007FF79B164000-memory.dmp

Filesize
3.3MB

Download
memory/3692-2169-0x00007FF7BDDC0000-0x00007FF7BE114000-memory.dmp

Filesize
3.3MB

Download
memory/3692-628-0x00007FF7BDDC0000-0x00007FF7BE114000-memory.dmp

Filesize
3.3MB

Download
memory/3860-619-0x00007FF68E9F0000-0x00007FF68ED44000-memory.dmp

Filesize
3.3MB

Download
memory/3860-2167-0x00007FF68E9F0000-0x00007FF68ED44000-memory.dmp

Filesize
3.3MB

Download
memory/4044-2170-0x00007FF736240000-0x00007FF736594000-memory.dmp

Filesize
3.3MB

Download
memory/4044-671-0x00007FF736240000-0x00007FF736594000-memory.dmp

Filesize
3.3MB

Download
memory/4376-2176-0x00007FF7769A0000-0x00007FF776CF4000-memory.dmp

Filesize
3.3MB

Download
memory/4376-636-0x00007FF7769A0000-0x00007FF776CF4000-memory.dmp

Filesize
3.3MB

Download
memory/4416-546-0x00007FF747410000-0x00007FF747764000-memory.dmp

Filesize
3.3MB

Download
memory/4416-2166-0x00007FF747410000-0x00007FF747764000-memory.dmp

Filesize
3.3MB

Download
memory/4596-626-0x00007FF7F6F90000-0x00007FF7F72E4000-memory.dmp

Filesize
3.3MB

Download
memory/4596-2168-0x00007FF7F6F90000-0x00007FF7F72E4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-2159-0x00007FF7A6E70000-0x00007FF7A71C4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-567-0x00007FF7A6E70000-0x00007FF7A71C4000-memory.dmp

Filesize
3.3MB

Download
memory/5040-577-0x00007FF741AF0000-0x00007FF741E44000-memory.dmp

Filesize
3.3MB

Download
memory/5040-2163-0x00007FF741AF0000-0x00007FF741E44000-memory.dmp

Filesize
3.3MB

Download
memory/5064-2160-0x00007FF771BD0000-0x00007FF771F24000-memory.dmp

Filesize
3.3MB

Download
memory/5064-556-0x00007FF771BD0000-0x00007FF771F24000-memory.dmp

Filesize
3.3MB

Download