xmrig | ab7fd1c4783f79c1b334f8597b8ead53b51a169a45cdd3bcf3178bfa753d382e

Analysis

max time kernel
95s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb30916d61d1399e74bbee658c118230_NEIKI.exe
Size

1.8MB
MD5

fb30916d61d1399e74bbee658c118230
SHA1

5d43823b6a87cd17ab37b1de575eb7519a9ff736
SHA256

ab7fd1c4783f79c1b334f8597b8ead53b51a169a45cdd3bcf3178bfa753d382e
SHA512

f75f33eaa979d48960e16e4af3100515dae37488ce598675b055ef6be24eaa1ce0caf77524db65ec1539114f56f68f73e23ad72a1fae86ee5865a2a56edcdc00
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbdhDLL4Kw:BemTLkNdfE0pZrN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2188-0-0x00007FF74A4B0000-0x00007FF74A804000-memory.dmp	xmrig
behavioral2/files/0x000700000002328e-5.dat	xmrig
behavioral2/files/0x000800000002341f-10.dat	xmrig
behavioral2/files/0x0008000000023422-20.dat	xmrig
behavioral2/files/0x0007000000023424-28.dat	xmrig
behavioral2/files/0x0007000000023425-32.dat	xmrig
behavioral2/files/0x0007000000023428-51.dat	xmrig
behavioral2/files/0x000700000002342d-76.dat	xmrig
behavioral2/files/0x0007000000023439-136.dat	xmrig
behavioral2/files/0x000700000002343e-160.dat	xmrig
behavioral2/memory/2992-666-0x00007FF754850000-0x00007FF754BA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023440-165.dat	xmrig
behavioral2/files/0x000700000002343f-162.dat	xmrig
behavioral2/files/0x000700000002343d-156.dat	xmrig
behavioral2/files/0x000700000002343c-150.dat	xmrig
behavioral2/files/0x000700000002343b-146.dat	xmrig
behavioral2/files/0x000700000002343a-140.dat	xmrig
behavioral2/files/0x0007000000023438-131.dat	xmrig
behavioral2/files/0x0007000000023437-125.dat	xmrig
behavioral2/files/0x0007000000023436-121.dat	xmrig
behavioral2/files/0x0007000000023435-115.dat	xmrig
behavioral2/files/0x0007000000023434-111.dat	xmrig
behavioral2/files/0x0007000000023433-105.dat	xmrig
behavioral2/files/0x0007000000023432-101.dat	xmrig
behavioral2/files/0x0007000000023431-95.dat	xmrig
behavioral2/files/0x0007000000023430-91.dat	xmrig
behavioral2/files/0x000700000002342f-86.dat	xmrig
behavioral2/files/0x000700000002342e-80.dat	xmrig
behavioral2/files/0x000700000002342c-70.dat	xmrig
behavioral2/files/0x000700000002342b-66.dat	xmrig
behavioral2/files/0x000700000002342a-60.dat	xmrig
behavioral2/files/0x0007000000023429-56.dat	xmrig
behavioral2/files/0x0007000000023427-45.dat	xmrig
behavioral2/files/0x0007000000023426-41.dat	xmrig
behavioral2/memory/2004-29-0x00007FF6346D0000-0x00007FF634A24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-23.dat	xmrig
behavioral2/memory/2872-9-0x00007FF7AA8B0000-0x00007FF7AAC04000-memory.dmp	xmrig
behavioral2/memory/4648-668-0x00007FF61F440000-0x00007FF61F794000-memory.dmp	xmrig
behavioral2/memory/1888-670-0x00007FF7C7750000-0x00007FF7C7AA4000-memory.dmp	xmrig
behavioral2/memory/3156-671-0x00007FF795140000-0x00007FF795494000-memory.dmp	xmrig
behavioral2/memory/2332-672-0x00007FF6D28C0000-0x00007FF6D2C14000-memory.dmp	xmrig
behavioral2/memory/4428-675-0x00007FF630290000-0x00007FF6305E4000-memory.dmp	xmrig
behavioral2/memory/4244-676-0x00007FF6C1BE0000-0x00007FF6C1F34000-memory.dmp	xmrig
behavioral2/memory/4280-677-0x00007FF682900000-0x00007FF682C54000-memory.dmp	xmrig
behavioral2/memory/2020-679-0x00007FF767330000-0x00007FF767684000-memory.dmp	xmrig
behavioral2/memory/4036-698-0x00007FF6F6670000-0x00007FF6F69C4000-memory.dmp	xmrig
behavioral2/memory/620-705-0x00007FF6F1E40000-0x00007FF6F2194000-memory.dmp	xmrig
behavioral2/memory/4932-717-0x00007FF6B7120000-0x00007FF6B7474000-memory.dmp	xmrig
behavioral2/memory/2052-716-0x00007FF7F9760000-0x00007FF7F9AB4000-memory.dmp	xmrig
behavioral2/memory/2056-697-0x00007FF7B1A20000-0x00007FF7B1D74000-memory.dmp	xmrig
behavioral2/memory/5076-694-0x00007FF6C6870000-0x00007FF6C6BC4000-memory.dmp	xmrig
behavioral2/memory/4640-724-0x00007FF6D8980000-0x00007FF6D8CD4000-memory.dmp	xmrig
behavioral2/memory/5036-729-0x00007FF7EFAA0000-0x00007FF7EFDF4000-memory.dmp	xmrig
behavioral2/memory/372-752-0x00007FF737EC0000-0x00007FF738214000-memory.dmp	xmrig
behavioral2/memory/4500-756-0x00007FF733CF0000-0x00007FF734044000-memory.dmp	xmrig
behavioral2/memory/3628-759-0x00007FF61E460000-0x00007FF61E7B4000-memory.dmp	xmrig
behavioral2/memory/4192-755-0x00007FF697120000-0x00007FF697474000-memory.dmp	xmrig
behavioral2/memory/920-749-0x00007FF6A49B0000-0x00007FF6A4D04000-memory.dmp	xmrig
behavioral2/memory/2924-744-0x00007FF72DC10000-0x00007FF72DF64000-memory.dmp	xmrig
behavioral2/memory/4008-741-0x00007FF6B1590000-0x00007FF6B18E4000-memory.dmp	xmrig
behavioral2/memory/3836-737-0x00007FF67C490000-0x00007FF67C7E4000-memory.dmp	xmrig
behavioral2/memory/4400-735-0x00007FF7DD540000-0x00007FF7DD894000-memory.dmp	xmrig
behavioral2/memory/4128-723-0x00007FF6C1020000-0x00007FF6C1374000-memory.dmp	xmrig
behavioral2/memory/2872-2124-0x00007FF7AA8B0000-0x00007FF7AAC04000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2872	SJNvICp.exe
2004	cOgaCJN.exe
4500	ZSstStR.exe
2992	vBcrEbF.exe
4648	ysSTPWf.exe
3628	ClnoYRa.exe
1888	seGFtJL.exe
3156	vBFCOEo.exe
2332	tPLPjxp.exe
4428	WILeueN.exe
4244	UaqyotA.exe
4280	SRahqzS.exe
2020	CsOyNBw.exe
5076	EYUajzz.exe
2056	cerKHzl.exe
4036	jFShRIz.exe
620	LykoWmy.exe
2052	cxHEubL.exe
4932	swZTzBM.exe
4128	gIKhnvc.exe
4640	FjVseDu.exe
5036	PEEDQNt.exe
4400	futEUvW.exe
3836	vmWauOk.exe
4008	WWbTPhM.exe
2924	OattYJU.exe
920	MmAtPfg.exe
372	DzzQaZG.exe
4192	zrmGGHt.exe
2752	JDAcyth.exe
2612	rEoZIQb.exe
2376	QBgSgpg.exe
3300	jcIuVlE.exe
1740	bCcUNZO.exe
4780	VOzlBIq.exe
4912	nRWaqrB.exe
4568	izjlqpe.exe
5060	KPGNdyN.exe
3484	zWRJrCz.exe
4664	wxCXjFE.exe
1772	wTEWLXJ.exe
448	ZyUDjpK.exe
4624	OousgOx.exe
2632	rsUGOlO.exe
4976	SRmCrDD.exe
1736	HsdUTQF.exe
2028	INrfSwf.exe
3864	XxNsZlJ.exe
3900	TLcvnAy.exe
4944	UbYYnuk.exe
1564	OLOCcYa.exe
2552	cTHEaCS.exe
4612	ZJtODuF.exe
4892	LAFTyAZ.exe
668	eXiOgpv.exe
4368	lSElSOQ.exe
3272	TgkvqNf.exe
1848	niFwRQr.exe
1796	tTPFCsb.exe
3516	KtYVdGW.exe
2008	LLTgCYc.exe
1176	AcvxrHR.exe
2784	SKqnYwK.exe
3612	IlXZpmp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2188-0-0x00007FF74A4B0000-0x00007FF74A804000-memory.dmp	upx
behavioral2/files/0x000700000002328e-5.dat	upx
behavioral2/files/0x000800000002341f-10.dat	upx
behavioral2/files/0x0008000000023422-20.dat	upx
behavioral2/files/0x0007000000023424-28.dat	upx
behavioral2/files/0x0007000000023425-32.dat	upx
behavioral2/files/0x0007000000023428-51.dat	upx
behavioral2/files/0x000700000002342d-76.dat	upx
behavioral2/files/0x0007000000023439-136.dat	upx
behavioral2/files/0x000700000002343e-160.dat	upx
behavioral2/memory/2992-666-0x00007FF754850000-0x00007FF754BA4000-memory.dmp	upx
behavioral2/files/0x0007000000023440-165.dat	upx
behavioral2/files/0x000700000002343f-162.dat	upx
behavioral2/files/0x000700000002343d-156.dat	upx
behavioral2/files/0x000700000002343c-150.dat	upx
behavioral2/files/0x000700000002343b-146.dat	upx
behavioral2/files/0x000700000002343a-140.dat	upx
behavioral2/files/0x0007000000023438-131.dat	upx
behavioral2/files/0x0007000000023437-125.dat	upx
behavioral2/files/0x0007000000023436-121.dat	upx
behavioral2/files/0x0007000000023435-115.dat	upx
behavioral2/files/0x0007000000023434-111.dat	upx
behavioral2/files/0x0007000000023433-105.dat	upx
behavioral2/files/0x0007000000023432-101.dat	upx
behavioral2/files/0x0007000000023431-95.dat	upx
behavioral2/files/0x0007000000023430-91.dat	upx
behavioral2/files/0x000700000002342f-86.dat	upx
behavioral2/files/0x000700000002342e-80.dat	upx
behavioral2/files/0x000700000002342c-70.dat	upx
behavioral2/files/0x000700000002342b-66.dat	upx
behavioral2/files/0x000700000002342a-60.dat	upx
behavioral2/files/0x0007000000023429-56.dat	upx
behavioral2/files/0x0007000000023427-45.dat	upx
behavioral2/files/0x0007000000023426-41.dat	upx
behavioral2/memory/2004-29-0x00007FF6346D0000-0x00007FF634A24000-memory.dmp	upx
behavioral2/files/0x0007000000023423-23.dat	upx
behavioral2/memory/2872-9-0x00007FF7AA8B0000-0x00007FF7AAC04000-memory.dmp	upx
behavioral2/memory/4648-668-0x00007FF61F440000-0x00007FF61F794000-memory.dmp	upx
behavioral2/memory/1888-670-0x00007FF7C7750000-0x00007FF7C7AA4000-memory.dmp	upx
behavioral2/memory/3156-671-0x00007FF795140000-0x00007FF795494000-memory.dmp	upx
behavioral2/memory/2332-672-0x00007FF6D28C0000-0x00007FF6D2C14000-memory.dmp	upx
behavioral2/memory/4428-675-0x00007FF630290000-0x00007FF6305E4000-memory.dmp	upx
behavioral2/memory/4244-676-0x00007FF6C1BE0000-0x00007FF6C1F34000-memory.dmp	upx
behavioral2/memory/4280-677-0x00007FF682900000-0x00007FF682C54000-memory.dmp	upx
behavioral2/memory/2020-679-0x00007FF767330000-0x00007FF767684000-memory.dmp	upx
behavioral2/memory/4036-698-0x00007FF6F6670000-0x00007FF6F69C4000-memory.dmp	upx
behavioral2/memory/620-705-0x00007FF6F1E40000-0x00007FF6F2194000-memory.dmp	upx
behavioral2/memory/4932-717-0x00007FF6B7120000-0x00007FF6B7474000-memory.dmp	upx
behavioral2/memory/2052-716-0x00007FF7F9760000-0x00007FF7F9AB4000-memory.dmp	upx
behavioral2/memory/2056-697-0x00007FF7B1A20000-0x00007FF7B1D74000-memory.dmp	upx
behavioral2/memory/5076-694-0x00007FF6C6870000-0x00007FF6C6BC4000-memory.dmp	upx
behavioral2/memory/4640-724-0x00007FF6D8980000-0x00007FF6D8CD4000-memory.dmp	upx
behavioral2/memory/5036-729-0x00007FF7EFAA0000-0x00007FF7EFDF4000-memory.dmp	upx
behavioral2/memory/372-752-0x00007FF737EC0000-0x00007FF738214000-memory.dmp	upx
behavioral2/memory/4500-756-0x00007FF733CF0000-0x00007FF734044000-memory.dmp	upx
behavioral2/memory/3628-759-0x00007FF61E460000-0x00007FF61E7B4000-memory.dmp	upx
behavioral2/memory/4192-755-0x00007FF697120000-0x00007FF697474000-memory.dmp	upx
behavioral2/memory/920-749-0x00007FF6A49B0000-0x00007FF6A4D04000-memory.dmp	upx
behavioral2/memory/2924-744-0x00007FF72DC10000-0x00007FF72DF64000-memory.dmp	upx
behavioral2/memory/4008-741-0x00007FF6B1590000-0x00007FF6B18E4000-memory.dmp	upx
behavioral2/memory/3836-737-0x00007FF67C490000-0x00007FF67C7E4000-memory.dmp	upx
behavioral2/memory/4400-735-0x00007FF7DD540000-0x00007FF7DD894000-memory.dmp	upx
behavioral2/memory/4128-723-0x00007FF6C1020000-0x00007FF6C1374000-memory.dmp	upx
behavioral2/memory/2872-2124-0x00007FF7AA8B0000-0x00007FF7AAC04000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yrlUCuT.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\PEEDQNt.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\kXpSpdq.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\KkyvMAa.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\puTohwR.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\jdFFeyG.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\BYgmdGk.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ABhuYCW.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ieqInBZ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\wgOUyQp.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\RuwHoqX.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\nRIoHbP.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\gPIynPk.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\DfufYAn.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\xEAilZk.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\QDoySmR.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\MyVTthf.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\tFPIONg.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\QDyUaLj.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\jWNywwm.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\wMDBbxO.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\FVyTkkv.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\LhwKjqM.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\RqXwCDo.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\KMfkuGF.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\KMzTSkz.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\xfpsJuX.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\lfcxmVd.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\XhaJyqu.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\SXjAvgS.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\AcvxrHR.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\mMXbNuH.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\LeTKzYQ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\pzxjtVZ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\zQusphD.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\aqKyVKJ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\gSaYLsM.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\EYUajzz.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\TrFCEQm.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\xxjdFxC.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\EsUbkRa.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\oniVZab.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\xowRcQf.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\CmYlkKN.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\WWbTPhM.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\FhkTjzt.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\zxIwTFq.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\lMGrXQY.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\IlrTjlK.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\TTmfOfW.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\TtaJNMw.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\KWLAuzB.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\bpHgtNx.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\UXRXcpe.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\SOaykLQ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ZeDnlgr.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\zWRJrCz.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ZUmQWPC.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\aKglmeZ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ylEjKKk.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\dyyfYqb.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\cOgaCJN.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\LVUqSAT.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\MZxsXOs.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2872	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	82
PID 2188 wrote to memory of 2872	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	82
PID 2188 wrote to memory of 2004	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	83
PID 2188 wrote to memory of 2004	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	83
PID 2188 wrote to memory of 4500	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	84
PID 2188 wrote to memory of 4500	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	84
PID 2188 wrote to memory of 2992	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	85
PID 2188 wrote to memory of 2992	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	85
PID 2188 wrote to memory of 4648	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	86
PID 2188 wrote to memory of 4648	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	86
PID 2188 wrote to memory of 3628	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	87
PID 2188 wrote to memory of 3628	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	87
PID 2188 wrote to memory of 1888	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	88
PID 2188 wrote to memory of 1888	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	88
PID 2188 wrote to memory of 3156	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	89
PID 2188 wrote to memory of 3156	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	89
PID 2188 wrote to memory of 2332	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	90
PID 2188 wrote to memory of 2332	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	90
PID 2188 wrote to memory of 4428	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	91
PID 2188 wrote to memory of 4428	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	91
PID 2188 wrote to memory of 4244	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	92
PID 2188 wrote to memory of 4244	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	92
PID 2188 wrote to memory of 4280	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	93
PID 2188 wrote to memory of 4280	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	93
PID 2188 wrote to memory of 2020	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	94
PID 2188 wrote to memory of 2020	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	94
PID 2188 wrote to memory of 5076	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	95
PID 2188 wrote to memory of 5076	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	95
PID 2188 wrote to memory of 2056	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	96
PID 2188 wrote to memory of 2056	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	96
PID 2188 wrote to memory of 4036	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	97
PID 2188 wrote to memory of 4036	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	97
PID 2188 wrote to memory of 620	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	98
PID 2188 wrote to memory of 620	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	98
PID 2188 wrote to memory of 2052	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	99
PID 2188 wrote to memory of 2052	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	99
PID 2188 wrote to memory of 4932	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	100
PID 2188 wrote to memory of 4932	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	100
PID 2188 wrote to memory of 4128	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	101
PID 2188 wrote to memory of 4128	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	101
PID 2188 wrote to memory of 4640	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	102
PID 2188 wrote to memory of 4640	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	102
PID 2188 wrote to memory of 5036	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	103
PID 2188 wrote to memory of 5036	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	103
PID 2188 wrote to memory of 4400	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	104
PID 2188 wrote to memory of 4400	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	104
PID 2188 wrote to memory of 3836	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	105
PID 2188 wrote to memory of 3836	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	105
PID 2188 wrote to memory of 4008	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	106
PID 2188 wrote to memory of 4008	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	106
PID 2188 wrote to memory of 2924	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	107
PID 2188 wrote to memory of 2924	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	107
PID 2188 wrote to memory of 920	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	108
PID 2188 wrote to memory of 920	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	108
PID 2188 wrote to memory of 372	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	109
PID 2188 wrote to memory of 372	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	109
PID 2188 wrote to memory of 4192	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	110
PID 2188 wrote to memory of 4192	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	110
PID 2188 wrote to memory of 2752	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	111
PID 2188 wrote to memory of 2752	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	111
PID 2188 wrote to memory of 2612	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	112
PID 2188 wrote to memory of 2612	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	112
PID 2188 wrote to memory of 2376	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	113
PID 2188 wrote to memory of 2376	2188	fb30916d61d1399e74bbee658c118230_NEIKI.exe	113

C:\Users\Admin\AppData\Local\Temp\fb30916d61d1399e74bbee658c118230_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\fb30916d61d1399e74bbee658c118230_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System\SJNvICp.exe
  C:\Windows\System\SJNvICp.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\cOgaCJN.exe
  C:\Windows\System\cOgaCJN.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ZSstStR.exe
  C:\Windows\System\ZSstStR.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\vBcrEbF.exe
  C:\Windows\System\vBcrEbF.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ysSTPWf.exe
  C:\Windows\System\ysSTPWf.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\ClnoYRa.exe
  C:\Windows\System\ClnoYRa.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\seGFtJL.exe
  C:\Windows\System\seGFtJL.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\vBFCOEo.exe
  C:\Windows\System\vBFCOEo.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\tPLPjxp.exe
  C:\Windows\System\tPLPjxp.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\WILeueN.exe
  C:\Windows\System\WILeueN.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\UaqyotA.exe
  C:\Windows\System\UaqyotA.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\SRahqzS.exe
  C:\Windows\System\SRahqzS.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\CsOyNBw.exe
  C:\Windows\System\CsOyNBw.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\EYUajzz.exe
  C:\Windows\System\EYUajzz.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\cerKHzl.exe
  C:\Windows\System\cerKHzl.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\jFShRIz.exe
  C:\Windows\System\jFShRIz.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\LykoWmy.exe
  C:\Windows\System\LykoWmy.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\cxHEubL.exe
  C:\Windows\System\cxHEubL.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\swZTzBM.exe
  C:\Windows\System\swZTzBM.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\gIKhnvc.exe
  C:\Windows\System\gIKhnvc.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\FjVseDu.exe
  C:\Windows\System\FjVseDu.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\PEEDQNt.exe
  C:\Windows\System\PEEDQNt.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\futEUvW.exe
  C:\Windows\System\futEUvW.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\vmWauOk.exe
  C:\Windows\System\vmWauOk.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\WWbTPhM.exe
  C:\Windows\System\WWbTPhM.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\OattYJU.exe
  C:\Windows\System\OattYJU.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\MmAtPfg.exe
  C:\Windows\System\MmAtPfg.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\DzzQaZG.exe
  C:\Windows\System\DzzQaZG.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\zrmGGHt.exe
  C:\Windows\System\zrmGGHt.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\JDAcyth.exe
  C:\Windows\System\JDAcyth.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\rEoZIQb.exe
  C:\Windows\System\rEoZIQb.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\QBgSgpg.exe
  C:\Windows\System\QBgSgpg.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\jcIuVlE.exe
  C:\Windows\System\jcIuVlE.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\bCcUNZO.exe
  C:\Windows\System\bCcUNZO.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\VOzlBIq.exe
  C:\Windows\System\VOzlBIq.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\nRWaqrB.exe
  C:\Windows\System\nRWaqrB.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\izjlqpe.exe
  C:\Windows\System\izjlqpe.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\KPGNdyN.exe
  C:\Windows\System\KPGNdyN.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\zWRJrCz.exe
  C:\Windows\System\zWRJrCz.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\wxCXjFE.exe
  C:\Windows\System\wxCXjFE.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\wTEWLXJ.exe
  C:\Windows\System\wTEWLXJ.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\ZyUDjpK.exe
  C:\Windows\System\ZyUDjpK.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\OousgOx.exe
  C:\Windows\System\OousgOx.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\rsUGOlO.exe
  C:\Windows\System\rsUGOlO.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\SRmCrDD.exe
  C:\Windows\System\SRmCrDD.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\HsdUTQF.exe
  C:\Windows\System\HsdUTQF.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\INrfSwf.exe
  C:\Windows\System\INrfSwf.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\XxNsZlJ.exe
  C:\Windows\System\XxNsZlJ.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\TLcvnAy.exe
  C:\Windows\System\TLcvnAy.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\UbYYnuk.exe
  C:\Windows\System\UbYYnuk.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\OLOCcYa.exe
  C:\Windows\System\OLOCcYa.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\cTHEaCS.exe
  C:\Windows\System\cTHEaCS.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ZJtODuF.exe
  C:\Windows\System\ZJtODuF.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\LAFTyAZ.exe
  C:\Windows\System\LAFTyAZ.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\eXiOgpv.exe
  C:\Windows\System\eXiOgpv.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\lSElSOQ.exe
  C:\Windows\System\lSElSOQ.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\TgkvqNf.exe
  C:\Windows\System\TgkvqNf.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\niFwRQr.exe
  C:\Windows\System\niFwRQr.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\tTPFCsb.exe
  C:\Windows\System\tTPFCsb.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\KtYVdGW.exe
  C:\Windows\System\KtYVdGW.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\LLTgCYc.exe
  C:\Windows\System\LLTgCYc.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\AcvxrHR.exe
  C:\Windows\System\AcvxrHR.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\SKqnYwK.exe
  C:\Windows\System\SKqnYwK.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\IlXZpmp.exe
  C:\Windows\System\IlXZpmp.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\fhbKAha.exe
  C:\Windows\System\fhbKAha.exe
  2⤵
  PID:2716
- C:\Windows\System\IzLXRkP.exe
  C:\Windows\System\IzLXRkP.exe
  2⤵
  PID:4876
- C:\Windows\System\zAInQGn.exe
  C:\Windows\System\zAInQGn.exe
  2⤵
  PID:2036
- C:\Windows\System\nhIhLVr.exe
  C:\Windows\System\nhIhLVr.exe
  2⤵
  PID:4896
- C:\Windows\System\qnsHtZW.exe
  C:\Windows\System\qnsHtZW.exe
  2⤵
  PID:4456
- C:\Windows\System\TrFCEQm.exe
  C:\Windows\System\TrFCEQm.exe
  2⤵
  PID:2328
- C:\Windows\System\VoXsjXU.exe
  C:\Windows\System\VoXsjXU.exe
  2⤵
  PID:400
- C:\Windows\System\QCYDUCL.exe
  C:\Windows\System\QCYDUCL.exe
  2⤵
  PID:1608
- C:\Windows\System\MJyfuzs.exe
  C:\Windows\System\MJyfuzs.exe
  2⤵
  PID:1152
- C:\Windows\System\uOwPxHc.exe
  C:\Windows\System\uOwPxHc.exe
  2⤵
  PID:316
- C:\Windows\System\UHveCZC.exe
  C:\Windows\System\UHveCZC.exe
  2⤵
  PID:2452
- C:\Windows\System\rEAScAg.exe
  C:\Windows\System\rEAScAg.exe
  2⤵
  PID:5052
- C:\Windows\System\IhsrGvO.exe
  C:\Windows\System\IhsrGvO.exe
  2⤵
  PID:3188
- C:\Windows\System\mrztSAc.exe
  C:\Windows\System\mrztSAc.exe
  2⤵
  PID:944
- C:\Windows\System\OElEdSx.exe
  C:\Windows\System\OElEdSx.exe
  2⤵
  PID:2420
- C:\Windows\System\xEAilZk.exe
  C:\Windows\System\xEAilZk.exe
  2⤵
  PID:1652
- C:\Windows\System\ggaZANS.exe
  C:\Windows\System\ggaZANS.exe
  2⤵
  PID:1524
- C:\Windows\System\ksFHyFU.exe
  C:\Windows\System\ksFHyFU.exe
  2⤵
  PID:3632
- C:\Windows\System\zCHFcby.exe
  C:\Windows\System\zCHFcby.exe
  2⤵
  PID:1836
- C:\Windows\System\qxNCGVL.exe
  C:\Windows\System\qxNCGVL.exe
  2⤵
  PID:3324
- C:\Windows\System\kXpSpdq.exe
  C:\Windows\System\kXpSpdq.exe
  2⤵
  PID:2264
- C:\Windows\System\dInjkvl.exe
  C:\Windows\System\dInjkvl.exe
  2⤵
  PID:2932
- C:\Windows\System\ebAlClP.exe
  C:\Windows\System\ebAlClP.exe
  2⤵
  PID:4564
- C:\Windows\System\wvgCqhg.exe
  C:\Windows\System\wvgCqhg.exe
  2⤵
  PID:5144
- C:\Windows\System\bvQuWqP.exe
  C:\Windows\System\bvQuWqP.exe
  2⤵
  PID:5176
- C:\Windows\System\ZUmQWPC.exe
  C:\Windows\System\ZUmQWPC.exe
  2⤵
  PID:5204
- C:\Windows\System\EjGcnUp.exe
  C:\Windows\System\EjGcnUp.exe
  2⤵
  PID:5232
- C:\Windows\System\BiufHCl.exe
  C:\Windows\System\BiufHCl.exe
  2⤵
  PID:5260
- C:\Windows\System\rTfhBpV.exe
  C:\Windows\System\rTfhBpV.exe
  2⤵
  PID:5288
- C:\Windows\System\hNNJJpf.exe
  C:\Windows\System\hNNJJpf.exe
  2⤵
  PID:5316
- C:\Windows\System\xxjdFxC.exe
  C:\Windows\System\xxjdFxC.exe
  2⤵
  PID:5344
- C:\Windows\System\gaIkRFN.exe
  C:\Windows\System\gaIkRFN.exe
  2⤵
  PID:5372
- C:\Windows\System\bjpCZMC.exe
  C:\Windows\System\bjpCZMC.exe
  2⤵
  PID:5400
- C:\Windows\System\TFAPYJC.exe
  C:\Windows\System\TFAPYJC.exe
  2⤵
  PID:5428
- C:\Windows\System\XHIuAKy.exe
  C:\Windows\System\XHIuAKy.exe
  2⤵
  PID:5456
- C:\Windows\System\GjCBtFH.exe
  C:\Windows\System\GjCBtFH.exe
  2⤵
  PID:5484
- C:\Windows\System\sbjeIHB.exe
  C:\Windows\System\sbjeIHB.exe
  2⤵
  PID:5512
- C:\Windows\System\joMMKRG.exe
  C:\Windows\System\joMMKRG.exe
  2⤵
  PID:5540
- C:\Windows\System\iWkSDea.exe
  C:\Windows\System\iWkSDea.exe
  2⤵
  PID:5568
- C:\Windows\System\NDSfLUl.exe
  C:\Windows\System\NDSfLUl.exe
  2⤵
  PID:5596
- C:\Windows\System\ABhuYCW.exe
  C:\Windows\System\ABhuYCW.exe
  2⤵
  PID:5624
- C:\Windows\System\Sqnggdo.exe
  C:\Windows\System\Sqnggdo.exe
  2⤵
  PID:5652
- C:\Windows\System\cfiwZSz.exe
  C:\Windows\System\cfiwZSz.exe
  2⤵
  PID:5676
- C:\Windows\System\dILWuFY.exe
  C:\Windows\System\dILWuFY.exe
  2⤵
  PID:5704
- C:\Windows\System\gyQxiiq.exe
  C:\Windows\System\gyQxiiq.exe
  2⤵
  PID:5732
- C:\Windows\System\ecqTkLF.exe
  C:\Windows\System\ecqTkLF.exe
  2⤵
  PID:5760
- C:\Windows\System\VLUPZPL.exe
  C:\Windows\System\VLUPZPL.exe
  2⤵
  PID:5792
- C:\Windows\System\jWNywwm.exe
  C:\Windows\System\jWNywwm.exe
  2⤵
  PID:5820
- C:\Windows\System\vkRxWCH.exe
  C:\Windows\System\vkRxWCH.exe
  2⤵
  PID:5848
- C:\Windows\System\gtfNoVu.exe
  C:\Windows\System\gtfNoVu.exe
  2⤵
  PID:5876
- C:\Windows\System\FhkTjzt.exe
  C:\Windows\System\FhkTjzt.exe
  2⤵
  PID:5904
- C:\Windows\System\xqxHSpt.exe
  C:\Windows\System\xqxHSpt.exe
  2⤵
  PID:5932
- C:\Windows\System\ZbMUdnJ.exe
  C:\Windows\System\ZbMUdnJ.exe
  2⤵
  PID:5960
- C:\Windows\System\UrjFFWV.exe
  C:\Windows\System\UrjFFWV.exe
  2⤵
  PID:5988
- C:\Windows\System\eyTCzhu.exe
  C:\Windows\System\eyTCzhu.exe
  2⤵
  PID:6016
- C:\Windows\System\peebHdC.exe
  C:\Windows\System\peebHdC.exe
  2⤵
  PID:6044
- C:\Windows\System\pGnVrxp.exe
  C:\Windows\System\pGnVrxp.exe
  2⤵
  PID:6072
- C:\Windows\System\xHgAugh.exe
  C:\Windows\System\xHgAugh.exe
  2⤵
  PID:6100
- C:\Windows\System\riLAaok.exe
  C:\Windows\System\riLAaok.exe
  2⤵
  PID:6128
- C:\Windows\System\FpljMNj.exe
  C:\Windows\System\FpljMNj.exe
  2⤵
  PID:2464
- C:\Windows\System\QDoySmR.exe
  C:\Windows\System\QDoySmR.exe
  2⤵
  PID:4860
- C:\Windows\System\ZziRMBl.exe
  C:\Windows\System\ZziRMBl.exe
  2⤵
  PID:3692
- C:\Windows\System\bpHgtNx.exe
  C:\Windows\System\bpHgtNx.exe
  2⤵
  PID:4452
- C:\Windows\System\KkyvMAa.exe
  C:\Windows\System\KkyvMAa.exe
  2⤵
  PID:2532
- C:\Windows\System\WiLsIdt.exe
  C:\Windows\System\WiLsIdt.exe
  2⤵
  PID:2832
- C:\Windows\System\puTohwR.exe
  C:\Windows\System\puTohwR.exe
  2⤵
  PID:3760
- C:\Windows\System\hZaGkYR.exe
  C:\Windows\System\hZaGkYR.exe
  2⤵
  PID:5164
- C:\Windows\System\sfTBZnF.exe
  C:\Windows\System\sfTBZnF.exe
  2⤵
  PID:5224
- C:\Windows\System\OMztmuM.exe
  C:\Windows\System\OMztmuM.exe
  2⤵
  PID:5280
- C:\Windows\System\yuzDJgk.exe
  C:\Windows\System\yuzDJgk.exe
  2⤵
  PID:5336
- C:\Windows\System\xkIRcKN.exe
  C:\Windows\System\xkIRcKN.exe
  2⤵
  PID:5412
- C:\Windows\System\GwwmIHp.exe
  C:\Windows\System\GwwmIHp.exe
  2⤵
  PID:5472
- C:\Windows\System\FgZuRMU.exe
  C:\Windows\System\FgZuRMU.exe
  2⤵
  PID:5532
- C:\Windows\System\GQpbaGz.exe
  C:\Windows\System\GQpbaGz.exe
  2⤵
  PID:5612
- C:\Windows\System\dopaOwk.exe
  C:\Windows\System\dopaOwk.exe
  2⤵
  PID:5672
- C:\Windows\System\KhBBRSw.exe
  C:\Windows\System\KhBBRSw.exe
  2⤵
  PID:5748
- C:\Windows\System\WhjUunD.exe
  C:\Windows\System\WhjUunD.exe
  2⤵
  PID:5808
- C:\Windows\System\PbSmJIK.exe
  C:\Windows\System\PbSmJIK.exe
  2⤵
  PID:5868
- C:\Windows\System\xEZQUsC.exe
  C:\Windows\System\xEZQUsC.exe
  2⤵
  PID:5944
- C:\Windows\System\XDuMAvJ.exe
  C:\Windows\System\XDuMAvJ.exe
  2⤵
  PID:6004
- C:\Windows\System\sUvQTPE.exe
  C:\Windows\System\sUvQTPE.exe
  2⤵
  PID:6064
- C:\Windows\System\DrpmYZv.exe
  C:\Windows\System\DrpmYZv.exe
  2⤵
  PID:6140
- C:\Windows\System\uMVcoPv.exe
  C:\Windows\System\uMVcoPv.exe
  2⤵
  PID:4040
- C:\Windows\System\qPXuuUv.exe
  C:\Windows\System\qPXuuUv.exe
  2⤵
  PID:4084
- C:\Windows\System\evXsOwh.exe
  C:\Windows\System\evXsOwh.exe
  2⤵
  PID:5132
- C:\Windows\System\dhpJvle.exe
  C:\Windows\System\dhpJvle.exe
  2⤵
  PID:5248
- C:\Windows\System\TTONPwE.exe
  C:\Windows\System\TTONPwE.exe
  2⤵
  PID:5388
- C:\Windows\System\AvreMZc.exe
  C:\Windows\System\AvreMZc.exe
  2⤵
  PID:5524
- C:\Windows\System\JSckhwA.exe
  C:\Windows\System\JSckhwA.exe
  2⤵
  PID:5644
- C:\Windows\System\hSMoJnf.exe
  C:\Windows\System\hSMoJnf.exe
  2⤵
  PID:5784
- C:\Windows\System\VwIrOTB.exe
  C:\Windows\System\VwIrOTB.exe
  2⤵
  PID:5976
- C:\Windows\System\meBtYbx.exe
  C:\Windows\System\meBtYbx.exe
  2⤵
  PID:6152
- C:\Windows\System\MOiJmgM.exe
  C:\Windows\System\MOiJmgM.exe
  2⤵
  PID:6184
- C:\Windows\System\TNFhIuh.exe
  C:\Windows\System\TNFhIuh.exe
  2⤵
  PID:6200
- C:\Windows\System\FboLLvK.exe
  C:\Windows\System\FboLLvK.exe
  2⤵
  PID:6228
- C:\Windows\System\UXRXcpe.exe
  C:\Windows\System\UXRXcpe.exe
  2⤵
  PID:6252
- C:\Windows\System\xrVBVba.exe
  C:\Windows\System\xrVBVba.exe
  2⤵
  PID:6284
- C:\Windows\System\gdRiuSZ.exe
  C:\Windows\System\gdRiuSZ.exe
  2⤵
  PID:6312
- C:\Windows\System\QgyPlZt.exe
  C:\Windows\System\QgyPlZt.exe
  2⤵
  PID:6340
- C:\Windows\System\yrAmgOi.exe
  C:\Windows\System\yrAmgOi.exe
  2⤵
  PID:6364
- C:\Windows\System\iDdIvGW.exe
  C:\Windows\System\iDdIvGW.exe
  2⤵
  PID:6392
- C:\Windows\System\ZmtrHMh.exe
  C:\Windows\System\ZmtrHMh.exe
  2⤵
  PID:6420
- C:\Windows\System\ePCrGuW.exe
  C:\Windows\System\ePCrGuW.exe
  2⤵
  PID:6448
- C:\Windows\System\KsugAeo.exe
  C:\Windows\System\KsugAeo.exe
  2⤵
  PID:6476
- C:\Windows\System\KyBoBOl.exe
  C:\Windows\System\KyBoBOl.exe
  2⤵
  PID:6508
- C:\Windows\System\UmzlIve.exe
  C:\Windows\System\UmzlIve.exe
  2⤵
  PID:6532
- C:\Windows\System\biecUTk.exe
  C:\Windows\System\biecUTk.exe
  2⤵
  PID:6560
- C:\Windows\System\pmBABYa.exe
  C:\Windows\System\pmBABYa.exe
  2⤵
  PID:6592
- C:\Windows\System\aKglmeZ.exe
  C:\Windows\System\aKglmeZ.exe
  2⤵
  PID:6620
- C:\Windows\System\IROztRS.exe
  C:\Windows\System\IROztRS.exe
  2⤵
  PID:6648
- C:\Windows\System\bVMlDBF.exe
  C:\Windows\System\bVMlDBF.exe
  2⤵
  PID:6676
- C:\Windows\System\jbzshCJ.exe
  C:\Windows\System\jbzshCJ.exe
  2⤵
  PID:6704
- C:\Windows\System\OnSqhYS.exe
  C:\Windows\System\OnSqhYS.exe
  2⤵
  PID:6728
- C:\Windows\System\rIHanKb.exe
  C:\Windows\System\rIHanKb.exe
  2⤵
  PID:6756
- C:\Windows\System\LvroILM.exe
  C:\Windows\System\LvroILM.exe
  2⤵
  PID:6788
- C:\Windows\System\UzPcuTi.exe
  C:\Windows\System\UzPcuTi.exe
  2⤵
  PID:6816
- C:\Windows\System\OFsblxT.exe
  C:\Windows\System\OFsblxT.exe
  2⤵
  PID:6844
- C:\Windows\System\bXJoxUb.exe
  C:\Windows\System\bXJoxUb.exe
  2⤵
  PID:6872
- C:\Windows\System\EiehGpW.exe
  C:\Windows\System\EiehGpW.exe
  2⤵
  PID:6900
- C:\Windows\System\NaSSuev.exe
  C:\Windows\System\NaSSuev.exe
  2⤵
  PID:6928
- C:\Windows\System\AatmkIY.exe
  C:\Windows\System\AatmkIY.exe
  2⤵
  PID:6956
- C:\Windows\System\TicVgmB.exe
  C:\Windows\System\TicVgmB.exe
  2⤵
  PID:6984
- C:\Windows\System\WsUcbJw.exe
  C:\Windows\System\WsUcbJw.exe
  2⤵
  PID:7012
- C:\Windows\System\faJBYMu.exe
  C:\Windows\System\faJBYMu.exe
  2⤵
  PID:7040
- C:\Windows\System\hyDMUmd.exe
  C:\Windows\System\hyDMUmd.exe
  2⤵
  PID:7068
- C:\Windows\System\QzMlZXi.exe
  C:\Windows\System\QzMlZXi.exe
  2⤵
  PID:7096
- C:\Windows\System\iOgrjXq.exe
  C:\Windows\System\iOgrjXq.exe
  2⤵
  PID:7124
- C:\Windows\System\cbJmqwX.exe
  C:\Windows\System\cbJmqwX.exe
  2⤵
  PID:7152
- C:\Windows\System\jNqQosh.exe
  C:\Windows\System\jNqQosh.exe
  2⤵
  PID:3788
- C:\Windows\System\BukdLvW.exe
  C:\Windows\System\BukdLvW.exe
  2⤵
  PID:3380
- C:\Windows\System\KesVTIF.exe
  C:\Windows\System\KesVTIF.exe
  2⤵
  PID:5332
- C:\Windows\System\suVoEwJ.exe
  C:\Windows\System\suVoEwJ.exe
  2⤵
  PID:5640
- C:\Windows\System\zerXRcB.exe
  C:\Windows\System\zerXRcB.exe
  2⤵
  PID:6036
- C:\Windows\System\wjgfuuP.exe
  C:\Windows\System\wjgfuuP.exe
  2⤵
  PID:6176
- C:\Windows\System\LeUMtYs.exe
  C:\Windows\System\LeUMtYs.exe
  2⤵
  PID:6240
- C:\Windows\System\jUwZfpG.exe
  C:\Windows\System\jUwZfpG.exe
  2⤵
  PID:6300
- C:\Windows\System\EBaQECh.exe
  C:\Windows\System\EBaQECh.exe
  2⤵
  PID:6548
- C:\Windows\System\CWIldnI.exe
  C:\Windows\System\CWIldnI.exe
  2⤵
  PID:6632
- C:\Windows\System\mgprFYR.exe
  C:\Windows\System\mgprFYR.exe
  2⤵
  PID:6664
- C:\Windows\System\XARPbHZ.exe
  C:\Windows\System\XARPbHZ.exe
  2⤵
  PID:6716
- C:\Windows\System\wxDfbAP.exe
  C:\Windows\System\wxDfbAP.exe
  2⤵
  PID:6748
- C:\Windows\System\lNMewJF.exe
  C:\Windows\System\lNMewJF.exe
  2⤵
  PID:6800
- C:\Windows\System\zOFsPOE.exe
  C:\Windows\System\zOFsPOE.exe
  2⤵
  PID:4844
- C:\Windows\System\SOaykLQ.exe
  C:\Windows\System\SOaykLQ.exe
  2⤵
  PID:6916
- C:\Windows\System\ytXympv.exe
  C:\Windows\System\ytXympv.exe
  2⤵
  PID:6996
- C:\Windows\System\HdFKYfm.exe
  C:\Windows\System\HdFKYfm.exe
  2⤵
  PID:3936
- C:\Windows\System\xKlYaEc.exe
  C:\Windows\System\xKlYaEc.exe
  2⤵
  PID:6112
- C:\Windows\System\UKIgSyV.exe
  C:\Windows\System\UKIgSyV.exe
  2⤵
  PID:3032
- C:\Windows\System\MyVTthf.exe
  C:\Windows\System\MyVTthf.exe
  2⤵
  PID:5012
- C:\Windows\System\XZXuvXE.exe
  C:\Windows\System\XZXuvXE.exe
  2⤵
  PID:4908
- C:\Windows\System\mMXbNuH.exe
  C:\Windows\System\mMXbNuH.exe
  2⤵
  PID:4016
- C:\Windows\System\hnDLgar.exe
  C:\Windows\System\hnDLgar.exe
  2⤵
  PID:6328
- C:\Windows\System\KiQsJhd.exe
  C:\Windows\System\KiQsJhd.exe
  2⤵
  PID:60
- C:\Windows\System\dPnhegP.exe
  C:\Windows\System\dPnhegP.exe
  2⤵
  PID:224
- C:\Windows\System\accrfTh.exe
  C:\Windows\System\accrfTh.exe
  2⤵
  PID:6744
- C:\Windows\System\EgPSGYC.exe
  C:\Windows\System\EgPSGYC.exe
  2⤵
  PID:6884
- C:\Windows\System\KJdqtBy.exe
  C:\Windows\System\KJdqtBy.exe
  2⤵
  PID:7004
- C:\Windows\System\bapcvip.exe
  C:\Windows\System\bapcvip.exe
  2⤵
  PID:7116
- C:\Windows\System\DrZoNAI.exe
  C:\Windows\System\DrZoNAI.exe
  2⤵
  PID:2212
- C:\Windows\System\xwfOZUL.exe
  C:\Windows\System\xwfOZUL.exe
  2⤵
  PID:6524
- C:\Windows\System\hdUbhOm.exe
  C:\Windows\System\hdUbhOm.exe
  2⤵
  PID:1000
- C:\Windows\System\NIOOBxE.exe
  C:\Windows\System\NIOOBxE.exe
  2⤵
  PID:6520
- C:\Windows\System\WxBdAhX.exe
  C:\Windows\System\WxBdAhX.exe
  2⤵
  PID:1344
- C:\Windows\System\hpaSqDH.exe
  C:\Windows\System\hpaSqDH.exe
  2⤵
  PID:1712
- C:\Windows\System\ZmrOVkT.exe
  C:\Windows\System\ZmrOVkT.exe
  2⤵
  PID:4264
- C:\Windows\System\eSKEPbs.exe
  C:\Windows\System\eSKEPbs.exe
  2⤵
  PID:2556
- C:\Windows\System\BFcSGOz.exe
  C:\Windows\System\BFcSGOz.exe
  2⤵
  PID:6940
- C:\Windows\System\sxLpIhv.exe
  C:\Windows\System\sxLpIhv.exe
  2⤵
  PID:3944
- C:\Windows\System\OjceqpA.exe
  C:\Windows\System\OjceqpA.exe
  2⤵
  PID:6660
- C:\Windows\System\ylEjKKk.exe
  C:\Windows\System\ylEjKKk.exe
  2⤵
  PID:5584
- C:\Windows\System\mcUtJqV.exe
  C:\Windows\System\mcUtJqV.exe
  2⤵
  PID:7192
- C:\Windows\System\Puzadqd.exe
  C:\Windows\System\Puzadqd.exe
  2⤵
  PID:7228
- C:\Windows\System\EeQhdlT.exe
  C:\Windows\System\EeQhdlT.exe
  2⤵
  PID:7244
- C:\Windows\System\fLmXyHM.exe
  C:\Windows\System\fLmXyHM.exe
  2⤵
  PID:7272
- C:\Windows\System\YScxunP.exe
  C:\Windows\System\YScxunP.exe
  2⤵
  PID:7312
- C:\Windows\System\TAZmBNs.exe
  C:\Windows\System\TAZmBNs.exe
  2⤵
  PID:7340
- C:\Windows\System\TLuFYyB.exe
  C:\Windows\System\TLuFYyB.exe
  2⤵
  PID:7368
- C:\Windows\System\TKEswkc.exe
  C:\Windows\System\TKEswkc.exe
  2⤵
  PID:7392
- C:\Windows\System\GsraWxm.exe
  C:\Windows\System\GsraWxm.exe
  2⤵
  PID:7412
- C:\Windows\System\tFPIONg.exe
  C:\Windows\System\tFPIONg.exe
  2⤵
  PID:7440
- C:\Windows\System\uShGTUI.exe
  C:\Windows\System\uShGTUI.exe
  2⤵
  PID:7456
- C:\Windows\System\gemLtGu.exe
  C:\Windows\System\gemLtGu.exe
  2⤵
  PID:7476
- C:\Windows\System\hMNXidY.exe
  C:\Windows\System\hMNXidY.exe
  2⤵
  PID:7504
- C:\Windows\System\eePGXwI.exe
  C:\Windows\System\eePGXwI.exe
  2⤵
  PID:7524
- C:\Windows\System\ePpqSrE.exe
  C:\Windows\System\ePpqSrE.exe
  2⤵
  PID:7588
- C:\Windows\System\BeGmhCJ.exe
  C:\Windows\System\BeGmhCJ.exe
  2⤵
  PID:7612
- C:\Windows\System\puCkPUP.exe
  C:\Windows\System\puCkPUP.exe
  2⤵
  PID:7636
- C:\Windows\System\ChZpjHa.exe
  C:\Windows\System\ChZpjHa.exe
  2⤵
  PID:7656
- C:\Windows\System\KtPnBEp.exe
  C:\Windows\System\KtPnBEp.exe
  2⤵
  PID:7688
- C:\Windows\System\xtlvWtt.exe
  C:\Windows\System\xtlvWtt.exe
  2⤵
  PID:7708
- C:\Windows\System\MNkCNHU.exe
  C:\Windows\System\MNkCNHU.exe
  2⤵
  PID:7736
- C:\Windows\System\eRuWeNO.exe
  C:\Windows\System\eRuWeNO.exe
  2⤵
  PID:7768
- C:\Windows\System\XKhjwOh.exe
  C:\Windows\System\XKhjwOh.exe
  2⤵
  PID:7792
- C:\Windows\System\qtnQEKm.exe
  C:\Windows\System\qtnQEKm.exe
  2⤵
  PID:7824
- C:\Windows\System\JqAdPlt.exe
  C:\Windows\System\JqAdPlt.exe
  2⤵
  PID:7848
- C:\Windows\System\NKTaTxq.exe
  C:\Windows\System\NKTaTxq.exe
  2⤵
  PID:7884
- C:\Windows\System\DzxphMN.exe
  C:\Windows\System\DzxphMN.exe
  2⤵
  PID:7932
- C:\Windows\System\jybJnlv.exe
  C:\Windows\System\jybJnlv.exe
  2⤵
  PID:7960
- C:\Windows\System\aZmfXhX.exe
  C:\Windows\System\aZmfXhX.exe
  2⤵
  PID:7976
- C:\Windows\System\pNCQLxH.exe
  C:\Windows\System\pNCQLxH.exe
  2⤵
  PID:8004
- C:\Windows\System\FkTZPuj.exe
  C:\Windows\System\FkTZPuj.exe
  2⤵
  PID:8032
- C:\Windows\System\SXcLiJh.exe
  C:\Windows\System\SXcLiJh.exe
  2⤵
  PID:8060
- C:\Windows\System\vtlQltB.exe
  C:\Windows\System\vtlQltB.exe
  2⤵
  PID:8096
- C:\Windows\System\SMEEovb.exe
  C:\Windows\System\SMEEovb.exe
  2⤵
  PID:8116
- C:\Windows\System\exUdfnv.exe
  C:\Windows\System\exUdfnv.exe
  2⤵
  PID:8144
- C:\Windows\System\WsdZwwu.exe
  C:\Windows\System\WsdZwwu.exe
  2⤵
  PID:8176
- C:\Windows\System\PJUBqgz.exe
  C:\Windows\System\PJUBqgz.exe
  2⤵
  PID:7180
- C:\Windows\System\wMDBbxO.exe
  C:\Windows\System\wMDBbxO.exe
  2⤵
  PID:7220
- C:\Windows\System\NQKexSD.exe
  C:\Windows\System\NQKexSD.exe
  2⤵
  PID:7292
- C:\Windows\System\PbjiaGg.exe
  C:\Windows\System\PbjiaGg.exe
  2⤵
  PID:7356
- C:\Windows\System\QDyUaLj.exe
  C:\Windows\System\QDyUaLj.exe
  2⤵
  PID:7432
- C:\Windows\System\UXQSOwz.exe
  C:\Windows\System\UXQSOwz.exe
  2⤵
  PID:7472
- C:\Windows\System\bRpXHHU.exe
  C:\Windows\System\bRpXHHU.exe
  2⤵
  PID:7540
- C:\Windows\System\LeTKzYQ.exe
  C:\Windows\System\LeTKzYQ.exe
  2⤵
  PID:7620
- C:\Windows\System\sbgICbD.exe
  C:\Windows\System\sbgICbD.exe
  2⤵
  PID:7680
- C:\Windows\System\VCYNutB.exe
  C:\Windows\System\VCYNutB.exe
  2⤵
  PID:7732
- C:\Windows\System\dQifouT.exe
  C:\Windows\System\dQifouT.exe
  2⤵
  PID:7816
- C:\Windows\System\NhTGSef.exe
  C:\Windows\System\NhTGSef.exe
  2⤵
  PID:7808
- C:\Windows\System\jIYfxRg.exe
  C:\Windows\System\jIYfxRg.exe
  2⤵
  PID:7912
- C:\Windows\System\pUPVooM.exe
  C:\Windows\System\pUPVooM.exe
  2⤵
  PID:7988
- C:\Windows\System\PQFHDXf.exe
  C:\Windows\System\PQFHDXf.exe
  2⤵
  PID:8076
- C:\Windows\System\RBsWGBi.exe
  C:\Windows\System\RBsWGBi.exe
  2⤵
  PID:8132
- C:\Windows\System\zxIwTFq.exe
  C:\Windows\System\zxIwTFq.exe
  2⤵
  PID:7236
- C:\Windows\System\VgmGEwC.exe
  C:\Windows\System\VgmGEwC.exe
  2⤵
  PID:7452
- C:\Windows\System\owyjBsD.exe
  C:\Windows\System\owyjBsD.exe
  2⤵
  PID:7448
- C:\Windows\System\WjZfnOh.exe
  C:\Windows\System\WjZfnOh.exe
  2⤵
  PID:7672
- C:\Windows\System\xxJPSgI.exe
  C:\Windows\System\xxJPSgI.exe
  2⤵
  PID:7764
- C:\Windows\System\tFjtBUI.exe
  C:\Windows\System\tFjtBUI.exe
  2⤵
  PID:7924
- C:\Windows\System\TBrZFKb.exe
  C:\Windows\System\TBrZFKb.exe
  2⤵
  PID:8112
- C:\Windows\System\pzxjtVZ.exe
  C:\Windows\System\pzxjtVZ.exe
  2⤵
  PID:8160
- C:\Windows\System\KFEnpul.exe
  C:\Windows\System\KFEnpul.exe
  2⤵
  PID:7464
- C:\Windows\System\GVGHxdh.exe
  C:\Windows\System\GVGHxdh.exe
  2⤵
  PID:7804
- C:\Windows\System\FXbJEHR.exe
  C:\Windows\System\FXbJEHR.exe
  2⤵
  PID:7868
- C:\Windows\System\gsHpqMk.exe
  C:\Windows\System\gsHpqMk.exe
  2⤵
  PID:8208
- C:\Windows\System\hynnICY.exe
  C:\Windows\System\hynnICY.exe
  2⤵
  PID:8236
- C:\Windows\System\PejyNNy.exe
  C:\Windows\System\PejyNNy.exe
  2⤵
  PID:8264
- C:\Windows\System\yiKfuIs.exe
  C:\Windows\System\yiKfuIs.exe
  2⤵
  PID:8292
- C:\Windows\System\xowRcQf.exe
  C:\Windows\System\xowRcQf.exe
  2⤵
  PID:8320
- C:\Windows\System\zQusphD.exe
  C:\Windows\System\zQusphD.exe
  2⤵
  PID:8348
- C:\Windows\System\AQQmnxW.exe
  C:\Windows\System\AQQmnxW.exe
  2⤵
  PID:8364
- C:\Windows\System\uJMTTnO.exe
  C:\Windows\System\uJMTTnO.exe
  2⤵
  PID:8392
- C:\Windows\System\TEiHzAD.exe
  C:\Windows\System\TEiHzAD.exe
  2⤵
  PID:8428
- C:\Windows\System\CNUhnVL.exe
  C:\Windows\System\CNUhnVL.exe
  2⤵
  PID:8448
- C:\Windows\System\oprGCWu.exe
  C:\Windows\System\oprGCWu.exe
  2⤵
  PID:8480
- C:\Windows\System\nDfSEep.exe
  C:\Windows\System\nDfSEep.exe
  2⤵
  PID:8512
- C:\Windows\System\DtOEFTe.exe
  C:\Windows\System\DtOEFTe.exe
  2⤵
  PID:8536
- C:\Windows\System\zMfXeoG.exe
  C:\Windows\System\zMfXeoG.exe
  2⤵
  PID:8560
- C:\Windows\System\LVUqSAT.exe
  C:\Windows\System\LVUqSAT.exe
  2⤵
  PID:8596
- C:\Windows\System\ieqInBZ.exe
  C:\Windows\System\ieqInBZ.exe
  2⤵
  PID:8616
- C:\Windows\System\LxFzPkY.exe
  C:\Windows\System\LxFzPkY.exe
  2⤵
  PID:8660
- C:\Windows\System\AgFJpZO.exe
  C:\Windows\System\AgFJpZO.exe
  2⤵
  PID:8680
- C:\Windows\System\IlrTjlK.exe
  C:\Windows\System\IlrTjlK.exe
  2⤵
  PID:8696
- C:\Windows\System\gPIynPk.exe
  C:\Windows\System\gPIynPk.exe
  2⤵
  PID:8728
- C:\Windows\System\MZxsXOs.exe
  C:\Windows\System\MZxsXOs.exe
  2⤵
  PID:8760
- C:\Windows\System\LSALTMf.exe
  C:\Windows\System\LSALTMf.exe
  2⤵
  PID:8796
- C:\Windows\System\VLHjZMZ.exe
  C:\Windows\System\VLHjZMZ.exe
  2⤵
  PID:8824
- C:\Windows\System\ccHIocb.exe
  C:\Windows\System\ccHIocb.exe
  2⤵
  PID:8864
- C:\Windows\System\jTmnLEp.exe
  C:\Windows\System\jTmnLEp.exe
  2⤵
  PID:8880
- C:\Windows\System\vicuxxg.exe
  C:\Windows\System\vicuxxg.exe
  2⤵
  PID:8904
- C:\Windows\System\FpzmaZN.exe
  C:\Windows\System\FpzmaZN.exe
  2⤵
  PID:8948
- C:\Windows\System\cQLgIiY.exe
  C:\Windows\System\cQLgIiY.exe
  2⤵
  PID:8964
- C:\Windows\System\FqWykXN.exe
  C:\Windows\System\FqWykXN.exe
  2⤵
  PID:8992
- C:\Windows\System\caAwtjI.exe
  C:\Windows\System\caAwtjI.exe
  2⤵
  PID:9020
- C:\Windows\System\jdFFeyG.exe
  C:\Windows\System\jdFFeyG.exe
  2⤵
  PID:9040
- C:\Windows\System\RgTYDvm.exe
  C:\Windows\System\RgTYDvm.exe
  2⤵
  PID:9084
- C:\Windows\System\mUlOVRp.exe
  C:\Windows\System\mUlOVRp.exe
  2⤵
  PID:9104
- C:\Windows\System\UMTCLQE.exe
  C:\Windows\System\UMTCLQE.exe
  2⤵
  PID:9136
- C:\Windows\System\nGWXOvy.exe
  C:\Windows\System\nGWXOvy.exe
  2⤵
  PID:9176
- C:\Windows\System\lpqdZUd.exe
  C:\Windows\System\lpqdZUd.exe
  2⤵
  PID:9192
- C:\Windows\System\RtdujcH.exe
  C:\Windows\System\RtdujcH.exe
  2⤵
  PID:7948
- C:\Windows\System\BKuSNKP.exe
  C:\Windows\System\BKuSNKP.exe
  2⤵
  PID:8228
- C:\Windows\System\DylFkgs.exe
  C:\Windows\System\DylFkgs.exe
  2⤵
  PID:8280
- C:\Windows\System\jplagjl.exe
  C:\Windows\System\jplagjl.exe
  2⤵
  PID:8312
- C:\Windows\System\DFiHGjd.exe
  C:\Windows\System\DFiHGjd.exe
  2⤵
  PID:1232
- C:\Windows\System\rMnNzYC.exe
  C:\Windows\System\rMnNzYC.exe
  2⤵
  PID:8440
- C:\Windows\System\OabVqJO.exe
  C:\Windows\System\OabVqJO.exe
  2⤵
  PID:8532
- C:\Windows\System\lkRkCko.exe
  C:\Windows\System\lkRkCko.exe
  2⤵
  PID:8604
- C:\Windows\System\pMXFjVY.exe
  C:\Windows\System\pMXFjVY.exe
  2⤵
  PID:8652
- C:\Windows\System\DDQccEg.exe
  C:\Windows\System\DDQccEg.exe
  2⤵
  PID:8740
- C:\Windows\System\qdnrauK.exe
  C:\Windows\System\qdnrauK.exe
  2⤵
  PID:8808
- C:\Windows\System\uAMRLGL.exe
  C:\Windows\System\uAMRLGL.exe
  2⤵
  PID:8876
- C:\Windows\System\SNMgUXa.exe
  C:\Windows\System\SNMgUXa.exe
  2⤵
  PID:8932
- C:\Windows\System\IzOEeZu.exe
  C:\Windows\System\IzOEeZu.exe
  2⤵
  PID:8976
- C:\Windows\System\IhHvBpQ.exe
  C:\Windows\System\IhHvBpQ.exe
  2⤵
  PID:8984
- C:\Windows\System\cCbsCLP.exe
  C:\Windows\System\cCbsCLP.exe
  2⤵
  PID:9072
- C:\Windows\System\VFFelwP.exe
  C:\Windows\System\VFFelwP.exe
  2⤵
  PID:9152
- C:\Windows\System\WczahlF.exe
  C:\Windows\System\WczahlF.exe
  2⤵
  PID:8224
- C:\Windows\System\yjePNqM.exe
  C:\Windows\System\yjePNqM.exe
  2⤵
  PID:8256
- C:\Windows\System\cxbylua.exe
  C:\Windows\System\cxbylua.exe
  2⤵
  PID:8496
- C:\Windows\System\nWhcbMe.exe
  C:\Windows\System\nWhcbMe.exe
  2⤵
  PID:8528
- C:\Windows\System\HtSGJkl.exe
  C:\Windows\System\HtSGJkl.exe
  2⤵
  PID:8788
- C:\Windows\System\cKLvskr.exe
  C:\Windows\System\cKLvskr.exe
  2⤵
  PID:8896
- C:\Windows\System\eHYEjTG.exe
  C:\Windows\System\eHYEjTG.exe
  2⤵
  PID:9056
- C:\Windows\System\pivtKXT.exe
  C:\Windows\System\pivtKXT.exe
  2⤵
  PID:9128
- C:\Windows\System\dDnrBVw.exe
  C:\Windows\System\dDnrBVw.exe
  2⤵
  PID:9204
- C:\Windows\System\oxVeBrm.exe
  C:\Windows\System\oxVeBrm.exe
  2⤵
  PID:8852
- C:\Windows\System\pAUcVhz.exe
  C:\Windows\System\pAUcVhz.exe
  2⤵
  PID:8928
- C:\Windows\System\bzuNlKH.exe
  C:\Windows\System\bzuNlKH.exe
  2⤵
  PID:8360
- C:\Windows\System\cDPtacH.exe
  C:\Windows\System\cDPtacH.exe
  2⤵
  PID:9228
- C:\Windows\System\ONHwMbb.exe
  C:\Windows\System\ONHwMbb.exe
  2⤵
  PID:9256
- C:\Windows\System\xlpgBmE.exe
  C:\Windows\System\xlpgBmE.exe
  2⤵
  PID:9272
- C:\Windows\System\BSuCNSX.exe
  C:\Windows\System\BSuCNSX.exe
  2⤵
  PID:9296
- C:\Windows\System\gvUiIiD.exe
  C:\Windows\System\gvUiIiD.exe
  2⤵
  PID:9328
- C:\Windows\System\YjNqKPD.exe
  C:\Windows\System\YjNqKPD.exe
  2⤵
  PID:9348
- C:\Windows\System\zcXzWIU.exe
  C:\Windows\System\zcXzWIU.exe
  2⤵
  PID:9372
- C:\Windows\System\fZibgWq.exe
  C:\Windows\System\fZibgWq.exe
  2⤵
  PID:9400
- C:\Windows\System\RqXwCDo.exe
  C:\Windows\System\RqXwCDo.exe
  2⤵
  PID:9436
- C:\Windows\System\qTuDasy.exe
  C:\Windows\System\qTuDasy.exe
  2⤵
  PID:9480
- C:\Windows\System\fzjviBc.exe
  C:\Windows\System\fzjviBc.exe
  2⤵
  PID:9496
- C:\Windows\System\hvmAywr.exe
  C:\Windows\System\hvmAywr.exe
  2⤵
  PID:9516
- C:\Windows\System\HtZeGfO.exe
  C:\Windows\System\HtZeGfO.exe
  2⤵
  PID:9536
- C:\Windows\System\gEXGzSi.exe
  C:\Windows\System\gEXGzSi.exe
  2⤵
  PID:9556
- C:\Windows\System\YiRZMXj.exe
  C:\Windows\System\YiRZMXj.exe
  2⤵
  PID:9572
- C:\Windows\System\dnIZAvL.exe
  C:\Windows\System\dnIZAvL.exe
  2⤵
  PID:9588
- C:\Windows\System\riWyhor.exe
  C:\Windows\System\riWyhor.exe
  2⤵
  PID:9604
- C:\Windows\System\QrcwvrQ.exe
  C:\Windows\System\QrcwvrQ.exe
  2⤵
  PID:9668
- C:\Windows\System\dhmOAER.exe
  C:\Windows\System\dhmOAER.exe
  2⤵
  PID:9692
- C:\Windows\System\lyELJTE.exe
  C:\Windows\System\lyELJTE.exe
  2⤵
  PID:9724
- C:\Windows\System\kceiBMj.exe
  C:\Windows\System\kceiBMj.exe
  2⤵
  PID:9752
- C:\Windows\System\oNecVFf.exe
  C:\Windows\System\oNecVFf.exe
  2⤵
  PID:9788
- C:\Windows\System\YAHQECG.exe
  C:\Windows\System\YAHQECG.exe
  2⤵
  PID:9824
- C:\Windows\System\YuHaLzc.exe
  C:\Windows\System\YuHaLzc.exe
  2⤵
  PID:9848
- C:\Windows\System\xhSrGRu.exe
  C:\Windows\System\xhSrGRu.exe
  2⤵
  PID:9876
- C:\Windows\System\npDINhM.exe
  C:\Windows\System\npDINhM.exe
  2⤵
  PID:9920
- C:\Windows\System\NcDIthH.exe
  C:\Windows\System\NcDIthH.exe
  2⤵
  PID:9952
- C:\Windows\System\FUoZlRX.exe
  C:\Windows\System\FUoZlRX.exe
  2⤵
  PID:9976
- C:\Windows\System\MclLjfK.exe
  C:\Windows\System\MclLjfK.exe
  2⤵
  PID:10016
- C:\Windows\System\hRSOLdt.exe
  C:\Windows\System\hRSOLdt.exe
  2⤵
  PID:10044
- C:\Windows\System\aCqZKTf.exe
  C:\Windows\System\aCqZKTf.exe
  2⤵
  PID:10064
- C:\Windows\System\apHxevw.exe
  C:\Windows\System\apHxevw.exe
  2⤵
  PID:10088
- C:\Windows\System\hvRxgVK.exe
  C:\Windows\System\hvRxgVK.exe
  2⤵
  PID:10128
- C:\Windows\System\eZrFUPu.exe
  C:\Windows\System\eZrFUPu.exe
  2⤵
  PID:10156
- C:\Windows\System\LwehlmD.exe
  C:\Windows\System\LwehlmD.exe
  2⤵
  PID:10172
- C:\Windows\System\WkwWfuW.exe
  C:\Windows\System\WkwWfuW.exe
  2⤵
  PID:10200
- C:\Windows\System\tcvJozA.exe
  C:\Windows\System\tcvJozA.exe
  2⤵
  PID:9012
- C:\Windows\System\lfcxmVd.exe
  C:\Windows\System\lfcxmVd.exe
  2⤵
  PID:9244
- C:\Windows\System\DfufYAn.exe
  C:\Windows\System\DfufYAn.exe
  2⤵
  PID:9312
- C:\Windows\System\XWOhhxh.exe
  C:\Windows\System\XWOhhxh.exe
  2⤵
  PID:9356
- C:\Windows\System\XkaiMaE.exe
  C:\Windows\System\XkaiMaE.exe
  2⤵
  PID:9432
- C:\Windows\System\XKukOWf.exe
  C:\Windows\System\XKukOWf.exe
  2⤵
  PID:9472
- C:\Windows\System\kaHMshP.exe
  C:\Windows\System\kaHMshP.exe
  2⤵
  PID:9580
- C:\Windows\System\pVyaUKG.exe
  C:\Windows\System\pVyaUKG.exe
  2⤵
  PID:9656
- C:\Windows\System\YFayiZK.exe
  C:\Windows\System\YFayiZK.exe
  2⤵
  PID:9584
- C:\Windows\System\rcuuxID.exe
  C:\Windows\System\rcuuxID.exe
  2⤵
  PID:9628
- C:\Windows\System\BxgBzmA.exe
  C:\Windows\System\BxgBzmA.exe
  2⤵
  PID:9780
- C:\Windows\System\eWCvIkb.exe
  C:\Windows\System\eWCvIkb.exe
  2⤵
  PID:9864
- C:\Windows\System\BvpuSmL.exe
  C:\Windows\System\BvpuSmL.exe
  2⤵
  PID:9932
- C:\Windows\System\lMGrXQY.exe
  C:\Windows\System\lMGrXQY.exe
  2⤵
  PID:10012
- C:\Windows\System\GUyLsNf.exe
  C:\Windows\System\GUyLsNf.exe
  2⤵
  PID:10052
- C:\Windows\System\oQmMRfy.exe
  C:\Windows\System\oQmMRfy.exe
  2⤵
  PID:10108
- C:\Windows\System\WlNfPde.exe
  C:\Windows\System\WlNfPde.exe
  2⤵
  PID:10220
- C:\Windows\System\HXEYode.exe
  C:\Windows\System\HXEYode.exe
  2⤵
  PID:9220
- C:\Windows\System\PYjXVUR.exe
  C:\Windows\System\PYjXVUR.exe
  2⤵
  PID:4684
- C:\Windows\System\QQHWNMi.exe
  C:\Windows\System\QQHWNMi.exe
  2⤵
  PID:9388
- C:\Windows\System\hMYCfhA.exe
  C:\Windows\System\hMYCfhA.exe
  2⤵
  PID:9512
- C:\Windows\System\FVyTkkv.exe
  C:\Windows\System\FVyTkkv.exe
  2⤵
  PID:9736
- C:\Windows\System\lBuEXBA.exe
  C:\Windows\System\lBuEXBA.exe
  2⤵
  PID:9992
- C:\Windows\System\MnxCbsh.exe
  C:\Windows\System\MnxCbsh.exe
  2⤵
  PID:9972
- C:\Windows\System\aCGqRHp.exe
  C:\Windows\System\aCGqRHp.exe
  2⤵
  PID:10232
- C:\Windows\System\mFWtrbO.exe
  C:\Windows\System\mFWtrbO.exe
  2⤵
  PID:9568
- C:\Windows\System\oLRZLni.exe
  C:\Windows\System\oLRZLni.exe
  2⤵
  PID:9492
- C:\Windows\System\FVTIdXe.exe
  C:\Windows\System\FVTIdXe.exe
  2⤵
  PID:10060
- C:\Windows\System\TcAEeUl.exe
  C:\Windows\System\TcAEeUl.exe
  2⤵
  PID:4740
- C:\Windows\System\yRiFkoG.exe
  C:\Windows\System\yRiFkoG.exe
  2⤵
  PID:10244
- C:\Windows\System\PElbWJP.exe
  C:\Windows\System\PElbWJP.exe
  2⤵
  PID:10276
- C:\Windows\System\XZzJfeM.exe
  C:\Windows\System\XZzJfeM.exe
  2⤵
  PID:10300
- C:\Windows\System\DBUvYzh.exe
  C:\Windows\System\DBUvYzh.exe
  2⤵
  PID:10328
- C:\Windows\System\diqiQXs.exe
  C:\Windows\System\diqiQXs.exe
  2⤵
  PID:10364
- C:\Windows\System\KBgGpIG.exe
  C:\Windows\System\KBgGpIG.exe
  2⤵
  PID:10384
- C:\Windows\System\PKuzQBr.exe
  C:\Windows\System\PKuzQBr.exe
  2⤵
  PID:10412
- C:\Windows\System\syeYryj.exe
  C:\Windows\System\syeYryj.exe
  2⤵
  PID:10436
- C:\Windows\System\BCrvmUI.exe
  C:\Windows\System\BCrvmUI.exe
  2⤵
  PID:10468
- C:\Windows\System\MrTMTNT.exe
  C:\Windows\System\MrTMTNT.exe
  2⤵
  PID:10496
- C:\Windows\System\oaoKOkp.exe
  C:\Windows\System\oaoKOkp.exe
  2⤵
  PID:10548
- C:\Windows\System\yrlUCuT.exe
  C:\Windows\System\yrlUCuT.exe
  2⤵
  PID:10576
- C:\Windows\System\pGPsvxQ.exe
  C:\Windows\System\pGPsvxQ.exe
  2⤵
  PID:10604
- C:\Windows\System\IcHFiZi.exe
  C:\Windows\System\IcHFiZi.exe
  2⤵
  PID:10620
- C:\Windows\System\QFlMvUs.exe
  C:\Windows\System\QFlMvUs.exe
  2⤵
  PID:10644
- C:\Windows\System\qbbgLsE.exe
  C:\Windows\System\qbbgLsE.exe
  2⤵
  PID:10680
- C:\Windows\System\CnNorIT.exe
  C:\Windows\System\CnNorIT.exe
  2⤵
  PID:10708
- C:\Windows\System\TTmfOfW.exe
  C:\Windows\System\TTmfOfW.exe
  2⤵
  PID:10732
- C:\Windows\System\BJPxeQC.exe
  C:\Windows\System\BJPxeQC.exe
  2⤵
  PID:10768
- C:\Windows\System\QHIMvUQ.exe
  C:\Windows\System\QHIMvUQ.exe
  2⤵
  PID:10792
- C:\Windows\System\WGORzHw.exe
  C:\Windows\System\WGORzHw.exe
  2⤵
  PID:10820
- C:\Windows\System\txjfkcX.exe
  C:\Windows\System\txjfkcX.exe
  2⤵
  PID:10848
- C:\Windows\System\ZoxmuQd.exe
  C:\Windows\System\ZoxmuQd.exe
  2⤵
  PID:10884
- C:\Windows\System\HxpltMH.exe
  C:\Windows\System\HxpltMH.exe
  2⤵
  PID:10904
- C:\Windows\System\TKRigBM.exe
  C:\Windows\System\TKRigBM.exe
  2⤵
  PID:10936
- C:\Windows\System\JYDZZSY.exe
  C:\Windows\System\JYDZZSY.exe
  2⤵
  PID:10972
- C:\Windows\System\PXBnbmi.exe
  C:\Windows\System\PXBnbmi.exe
  2⤵
  PID:10992
- C:\Windows\System\CUNVFMp.exe
  C:\Windows\System\CUNVFMp.exe
  2⤵
  PID:11020
- C:\Windows\System\nMnPamK.exe
  C:\Windows\System\nMnPamK.exe
  2⤵
  PID:11044
- C:\Windows\System\iWseSGI.exe
  C:\Windows\System\iWseSGI.exe
  2⤵
  PID:11072
- C:\Windows\System\XhaJyqu.exe
  C:\Windows\System\XhaJyqu.exe
  2⤵
  PID:11092
- C:\Windows\System\KSZQnrX.exe
  C:\Windows\System\KSZQnrX.exe
  2⤵
  PID:11116
- C:\Windows\System\EezBGuw.exe
  C:\Windows\System\EezBGuw.exe
  2⤵
  PID:11140
- C:\Windows\System\WiKyjGg.exe
  C:\Windows\System\WiKyjGg.exe
  2⤵
  PID:11168
- C:\Windows\System\VlqNipG.exe
  C:\Windows\System\VlqNipG.exe
  2⤵
  PID:11200
- C:\Windows\System\fYMjfzH.exe
  C:\Windows\System\fYMjfzH.exe
  2⤵
  PID:11252
- C:\Windows\System\oEcmnoI.exe
  C:\Windows\System\oEcmnoI.exe
  2⤵
  PID:9844
- C:\Windows\System\SXjAvgS.exe
  C:\Windows\System\SXjAvgS.exe
  2⤵
  PID:10288
- C:\Windows\System\XXPzZVg.exe
  C:\Windows\System\XXPzZVg.exe
  2⤵
  PID:10312
- C:\Windows\System\KMfkuGF.exe
  C:\Windows\System\KMfkuGF.exe
  2⤵
  PID:10396
- C:\Windows\System\RYrRavp.exe
  C:\Windows\System\RYrRavp.exe
  2⤵
  PID:10484
- C:\Windows\System\PMSqDBd.exe
  C:\Windows\System\PMSqDBd.exe
  2⤵
  PID:10564
- C:\Windows\System\ETsVMOc.exe
  C:\Windows\System\ETsVMOc.exe
  2⤵
  PID:10636
- C:\Windows\System\EsUbkRa.exe
  C:\Windows\System\EsUbkRa.exe
  2⤵
  PID:10696
- C:\Windows\System\wiPCRMu.exe
  C:\Windows\System\wiPCRMu.exe
  2⤵
  PID:10780
- C:\Windows\System\OQgQqNi.exe
  C:\Windows\System\OQgQqNi.exe
  2⤵
  PID:10808
- C:\Windows\System\LeuKCkQ.exe
  C:\Windows\System\LeuKCkQ.exe
  2⤵
  PID:10900
- C:\Windows\System\GxFZbBX.exe
  C:\Windows\System\GxFZbBX.exe
  2⤵
  PID:10960
- C:\Windows\System\gEAHJPS.exe
  C:\Windows\System\gEAHJPS.exe
  2⤵
  PID:10980
- C:\Windows\System\rqiqvxh.exe
  C:\Windows\System\rqiqvxh.exe
  2⤵
  PID:11064
- C:\Windows\System\oniVZab.exe
  C:\Windows\System\oniVZab.exe
  2⤵
  PID:11100
- C:\Windows\System\BbWSZlM.exe
  C:\Windows\System\BbWSZlM.exe
  2⤵
  PID:11152
- C:\Windows\System\vimCOaC.exe
  C:\Windows\System\vimCOaC.exe
  2⤵
  PID:10344
- C:\Windows\System\nMrLydO.exe
  C:\Windows\System\nMrLydO.exe
  2⤵
  PID:10480
- C:\Windows\System\hBNUtSd.exe
  C:\Windows\System\hBNUtSd.exe
  2⤵
  PID:10528
- C:\Windows\System\szEizZj.exe
  C:\Windows\System\szEizZj.exe
  2⤵
  PID:10724
- C:\Windows\System\EFQSzfs.exe
  C:\Windows\System\EFQSzfs.exe
  2⤵
  PID:10832
- C:\Windows\System\jrCJNph.exe
  C:\Windows\System\jrCJNph.exe
  2⤵
  PID:11016
- C:\Windows\System\VhWptmx.exe
  C:\Windows\System\VhWptmx.exe
  2⤵
  PID:11128
- C:\Windows\System\VjrYZiC.exe
  C:\Windows\System\VjrYZiC.exe
  2⤵
  PID:10292
- C:\Windows\System\QQctbdt.exe
  C:\Windows\System\QQctbdt.exe
  2⤵
  PID:10752
- C:\Windows\System\ZPIsgdC.exe
  C:\Windows\System\ZPIsgdC.exe
  2⤵
  PID:10968
- C:\Windows\System\QHgNsBX.exe
  C:\Windows\System\QHgNsBX.exe
  2⤵
  PID:10348
- C:\Windows\System\aNPwPtC.exe
  C:\Windows\System\aNPwPtC.exe
  2⤵
  PID:11160
- C:\Windows\System\czwZhNe.exe
  C:\Windows\System\czwZhNe.exe
  2⤵
  PID:11284
- C:\Windows\System\aqKyVKJ.exe
  C:\Windows\System\aqKyVKJ.exe
  2⤵
  PID:11312
- C:\Windows\System\bWqzlDv.exe
  C:\Windows\System\bWqzlDv.exe
  2⤵
  PID:11352
- C:\Windows\System\gEoKrPo.exe
  C:\Windows\System\gEoKrPo.exe
  2⤵
  PID:11372
- C:\Windows\System\CxBLgAv.exe
  C:\Windows\System\CxBLgAv.exe
  2⤵
  PID:11408
- C:\Windows\System\jIYEVka.exe
  C:\Windows\System\jIYEVka.exe
  2⤵
  PID:11424
- C:\Windows\System\rfwDpaQ.exe
  C:\Windows\System\rfwDpaQ.exe
  2⤵
  PID:11452
- C:\Windows\System\oOTsPOy.exe
  C:\Windows\System\oOTsPOy.exe
  2⤵
  PID:11492
- C:\Windows\System\zndBupO.exe
  C:\Windows\System\zndBupO.exe
  2⤵
  PID:11520
- C:\Windows\System\lPhylYN.exe
  C:\Windows\System\lPhylYN.exe
  2⤵
  PID:11548
- C:\Windows\System\mnWHGIg.exe
  C:\Windows\System\mnWHGIg.exe
  2⤵
  PID:11564
- C:\Windows\System\LwEgaIY.exe
  C:\Windows\System\LwEgaIY.exe
  2⤵
  PID:11592
- C:\Windows\System\uEVOIGF.exe
  C:\Windows\System\uEVOIGF.exe
  2⤵
  PID:11632
- C:\Windows\System\iQkPIDy.exe
  C:\Windows\System\iQkPIDy.exe
  2⤵
  PID:11664
- C:\Windows\System\abbwYSg.exe
  C:\Windows\System\abbwYSg.exe
  2⤵
  PID:11680
- C:\Windows\System\FbSjYtf.exe
  C:\Windows\System\FbSjYtf.exe
  2⤵
  PID:11716
- C:\Windows\System\OAUrPRU.exe
  C:\Windows\System\OAUrPRU.exe
  2⤵
  PID:11736
- C:\Windows\System\koWMTzu.exe
  C:\Windows\System\koWMTzu.exe
  2⤵
  PID:11768
- C:\Windows\System\PyhOUgZ.exe
  C:\Windows\System\PyhOUgZ.exe
  2⤵
  PID:11792
- C:\Windows\System\KJcFqLi.exe
  C:\Windows\System\KJcFqLi.exe
  2⤵
  PID:11816
- C:\Windows\System\RzTwkLs.exe
  C:\Windows\System\RzTwkLs.exe
  2⤵
  PID:11852
- C:\Windows\System\NJeINtI.exe
  C:\Windows\System\NJeINtI.exe
  2⤵
  PID:11888
- C:\Windows\System\LRUnvmO.exe
  C:\Windows\System\LRUnvmO.exe
  2⤵
  PID:11916
- C:\Windows\System\qnRcBAA.exe
  C:\Windows\System\qnRcBAA.exe
  2⤵
  PID:11932
- C:\Windows\System\lGXiMQC.exe
  C:\Windows\System\lGXiMQC.exe
  2⤵
  PID:11952
- C:\Windows\System\CrROydp.exe
  C:\Windows\System\CrROydp.exe
  2⤵
  PID:11976
- C:\Windows\System\jQOsIfH.exe
  C:\Windows\System\jQOsIfH.exe
  2⤵
  PID:12000
- C:\Windows\System\riwaPIN.exe
  C:\Windows\System\riwaPIN.exe
  2⤵
  PID:12020
- C:\Windows\System\ZDxlTov.exe
  C:\Windows\System\ZDxlTov.exe
  2⤵
  PID:12072
- C:\Windows\System\UDRcSyD.exe
  C:\Windows\System\UDRcSyD.exe
  2⤵
  PID:12092
- C:\Windows\System\PsuuTXL.exe
  C:\Windows\System\PsuuTXL.exe
  2⤵
  PID:12140
- C:\Windows\System\HVmoTDQ.exe
  C:\Windows\System\HVmoTDQ.exe
  2⤵
  PID:12156
- C:\Windows\System\sRDVUpq.exe
  C:\Windows\System\sRDVUpq.exe
  2⤵
  PID:12196
- C:\Windows\System\ZMoLQkz.exe
  C:\Windows\System\ZMoLQkz.exe
  2⤵
  PID:12224
- C:\Windows\System\KzUqCzb.exe
  C:\Windows\System\KzUqCzb.exe
  2⤵
  PID:12252
- C:\Windows\System\rmXDjwW.exe
  C:\Windows\System\rmXDjwW.exe
  2⤵
  PID:12272
- C:\Windows\System\nRKXjgv.exe
  C:\Windows\System\nRKXjgv.exe
  2⤵
  PID:10836
- C:\Windows\System\KMzTSkz.exe
  C:\Windows\System\KMzTSkz.exe
  2⤵
  PID:11368
- C:\Windows\System\IXlCgPr.exe
  C:\Windows\System\IXlCgPr.exe
  2⤵
  PID:11392
- C:\Windows\System\KAQjWbZ.exe
  C:\Windows\System\KAQjWbZ.exe
  2⤵
  PID:11472
- C:\Windows\System\uwshrTH.exe
  C:\Windows\System\uwshrTH.exe
  2⤵
  PID:11504
- C:\Windows\System\upCIxqz.exe
  C:\Windows\System\upCIxqz.exe
  2⤵
  PID:11556
- C:\Windows\System\lWBYVWE.exe
  C:\Windows\System\lWBYVWE.exe
  2⤵
  PID:11628
- C:\Windows\System\mVlaaNS.exe
  C:\Windows\System\mVlaaNS.exe
  2⤵
  PID:11724
- C:\Windows\System\qohWASN.exe
  C:\Windows\System\qohWASN.exe
  2⤵
  PID:11780
- C:\Windows\System\BNjamlp.exe
  C:\Windows\System\BNjamlp.exe
  2⤵
  PID:11832
- C:\Windows\System\vpuyehA.exe
  C:\Windows\System\vpuyehA.exe
  2⤵
  PID:11904
- C:\Windows\System\PAigmxi.exe
  C:\Windows\System\PAigmxi.exe
  2⤵
  PID:11996
- C:\Windows\System\NqxUQSV.exe
  C:\Windows\System\NqxUQSV.exe
  2⤵
  PID:12056
- C:\Windows\System\VfnhNhb.exe
  C:\Windows\System\VfnhNhb.exe
  2⤵
  PID:12052
- C:\Windows\System\TtaJNMw.exe
  C:\Windows\System\TtaJNMw.exe
  2⤵
  PID:12172
- C:\Windows\System\KDmUgkD.exe
  C:\Windows\System\KDmUgkD.exe
  2⤵
  PID:12216
- C:\Windows\System\skKRKpG.exe
  C:\Windows\System\skKRKpG.exe
  2⤵
  PID:12280
- C:\Windows\System\yCWGeSI.exe
  C:\Windows\System\yCWGeSI.exe
  2⤵
  PID:11440
- C:\Windows\System\OTIfnxH.exe
  C:\Windows\System\OTIfnxH.exe
  2⤵
  PID:11776
- C:\Windows\System\qasjJyd.exe
  C:\Windows\System\qasjJyd.exe
  2⤵
  PID:11988
- C:\Windows\System\FDqbivO.exe
  C:\Windows\System\FDqbivO.exe
  2⤵
  PID:12104
- C:\Windows\System\yUWqqWB.exe
  C:\Windows\System\yUWqqWB.exe
  2⤵
  PID:12208
- C:\Windows\System\tdyrCyb.exe
  C:\Windows\System\tdyrCyb.exe
  2⤵
  PID:11344
- C:\Windows\System\meMsZXx.exe
  C:\Windows\System\meMsZXx.exe
  2⤵
  PID:11704
- C:\Windows\System\OvDhFgY.exe
  C:\Windows\System\OvDhFgY.exe
  2⤵
  PID:12016
- C:\Windows\System\kBvyeyr.exe
  C:\Windows\System\kBvyeyr.exe
  2⤵
  PID:12296
- C:\Windows\System\CJnaAEg.exe
  C:\Windows\System\CJnaAEg.exe
  2⤵
  PID:12320
- C:\Windows\System\ZWSwbgC.exe
  C:\Windows\System\ZWSwbgC.exe
  2⤵
  PID:12360
- C:\Windows\System\xfpsJuX.exe
  C:\Windows\System\xfpsJuX.exe
  2⤵
  PID:12384
- C:\Windows\System\tAcSrIr.exe
  C:\Windows\System\tAcSrIr.exe
  2⤵
  PID:12408
- C:\Windows\System\pFlfGXS.exe
  C:\Windows\System\pFlfGXS.exe
  2⤵
  PID:12456
- C:\Windows\System\YojTqYk.exe
  C:\Windows\System\YojTqYk.exe
  2⤵
  PID:12484
- C:\Windows\System\bIVxuLu.exe
  C:\Windows\System\bIVxuLu.exe
  2⤵
  PID:12508
- C:\Windows\System\icrYEkI.exe
  C:\Windows\System\icrYEkI.exe
  2⤵
  PID:12524
- C:\Windows\System\EHbZJhE.exe
  C:\Windows\System\EHbZJhE.exe
  2⤵
  PID:12560
- C:\Windows\System\jCJVsxb.exe
  C:\Windows\System\jCJVsxb.exe
  2⤵
  PID:12588
- C:\Windows\System\WhVGfdZ.exe
  C:\Windows\System\WhVGfdZ.exe
  2⤵
  PID:12636
- C:\Windows\System\SibRivG.exe
  C:\Windows\System\SibRivG.exe
  2⤵
  PID:12664
- C:\Windows\System\dtqvzox.exe
  C:\Windows\System\dtqvzox.exe
  2⤵
  PID:12692
- C:\Windows\System\KSTquOj.exe
  C:\Windows\System\KSTquOj.exe
  2⤵
  PID:12708
- C:\Windows\System\vWPEAYt.exe
  C:\Windows\System\vWPEAYt.exe
  2⤵
  PID:12732
- C:\Windows\System\jeZIOHI.exe
  C:\Windows\System\jeZIOHI.exe
  2⤵
  PID:12752
- C:\Windows\System\JpmUHSQ.exe
  C:\Windows\System\JpmUHSQ.exe
  2⤵
  PID:12780
- C:\Windows\System\lDuiaIe.exe
  C:\Windows\System\lDuiaIe.exe
  2⤵
  PID:12812
- C:\Windows\System\czPADSd.exe
  C:\Windows\System\czPADSd.exe
  2⤵
  PID:12840
- C:\Windows\System\OhkuqRy.exe
  C:\Windows\System\OhkuqRy.exe
  2⤵
  PID:12868
- C:\Windows\System\ucRhKkw.exe
  C:\Windows\System\ucRhKkw.exe
  2⤵
  PID:12904
- C:\Windows\System\egwgIyt.exe
  C:\Windows\System\egwgIyt.exe
  2⤵
  PID:12932
- C:\Windows\System\wrhbPMM.exe
  C:\Windows\System\wrhbPMM.exe
  2⤵
  PID:12956
- C:\Windows\System\rhtwNlG.exe
  C:\Windows\System\rhtwNlG.exe
  2⤵
  PID:12976
- C:\Windows\System\kawdjit.exe
  C:\Windows\System\kawdjit.exe
  2⤵
  PID:13008
- C:\Windows\System\dyyfYqb.exe
  C:\Windows\System\dyyfYqb.exe
  2⤵
  PID:13032
- C:\Windows\System\pycFnnx.exe
  C:\Windows\System\pycFnnx.exe
  2⤵
  PID:13056
- C:\Windows\System\MvQDBJt.exe
  C:\Windows\System\MvQDBJt.exe
  2⤵
  PID:13100
- C:\Windows\System\JztXykx.exe
  C:\Windows\System\JztXykx.exe
  2⤵
  PID:13128
- C:\Windows\System\pxDxNAm.exe
  C:\Windows\System\pxDxNAm.exe
  2⤵
  PID:13164
- C:\Windows\System\zGpYCoj.exe
  C:\Windows\System\zGpYCoj.exe
  2⤵
  PID:13184
- C:\Windows\System\ERyChpv.exe
  C:\Windows\System\ERyChpv.exe
  2⤵
  PID:13216
- C:\Windows\System\gYgrbVT.exe
  C:\Windows\System\gYgrbVT.exe
  2⤵
  PID:13244
- C:\Windows\System\ZTkgGhX.exe
  C:\Windows\System\ZTkgGhX.exe
  2⤵
  PID:13280
- C:\Windows\System\FddGKYK.exe
  C:\Windows\System\FddGKYK.exe
  2⤵
  PID:13296
- C:\Windows\System\rSzJqjG.exe
  C:\Windows\System\rSzJqjG.exe
  2⤵
  PID:12192
- C:\Windows\System\Fmkyixp.exe
  C:\Windows\System\Fmkyixp.exe
  2⤵
  PID:12376
- C:\Windows\System\xdNKyPz.exe
  C:\Windows\System\xdNKyPz.exe
  2⤵
  PID:12444
- C:\Windows\System\CmYlkKN.exe
  C:\Windows\System\CmYlkKN.exe
  2⤵
  PID:12472
- C:\Windows\System\wgOUyQp.exe
  C:\Windows\System\wgOUyQp.exe
  2⤵
  PID:12612
- C:\Windows\System\QLMCMvY.exe
  C:\Windows\System\QLMCMvY.exe
  2⤵
  PID:12652
- C:\Windows\System\VnaKRaI.exe
  C:\Windows\System\VnaKRaI.exe
  2⤵
  PID:12768
- C:\Windows\System\MVTrfrb.exe
  C:\Windows\System\MVTrfrb.exe
  2⤵
  PID:12800
- C:\Windows\System\ZeDnlgr.exe
  C:\Windows\System\ZeDnlgr.exe
  2⤵
  PID:12856
- C:\Windows\System\YnBJpyh.exe
  C:\Windows\System\YnBJpyh.exe
  2⤵
  PID:12916
- C:\Windows\System\SsNsZBc.exe
  C:\Windows\System\SsNsZBc.exe
  2⤵
  PID:12992
- C:\Windows\System\faHHpZf.exe
  C:\Windows\System\faHHpZf.exe
  2⤵
  PID:13044
- C:\Windows\System\nzpySDt.exe
  C:\Windows\System\nzpySDt.exe
  2⤵
  PID:13112
- C:\Windows\System\UNMOgAz.exe
  C:\Windows\System\UNMOgAz.exe
  2⤵
  PID:13192
- C:\Windows\System\JqQXwXo.exe
  C:\Windows\System\JqQXwXo.exe
  2⤵
  PID:13228
- C:\Windows\System\YWGBOBV.exe
  C:\Windows\System\YWGBOBV.exe
  2⤵
  PID:13288
- C:\Windows\System\bItFBkL.exe
  C:\Windows\System\bItFBkL.exe
  2⤵
  PID:12240
- C:\Windows\System\cIwMUVq.exe
  C:\Windows\System\cIwMUVq.exe
  2⤵
  PID:12492
- C:\Windows\System\lFddmfj.exe
  C:\Windows\System\lFddmfj.exe
  2⤵
  PID:12632
- C:\Windows\System\RzaIHRZ.exe
  C:\Windows\System\RzaIHRZ.exe
  2⤵
  PID:12996
- C:\Windows\System\jWLrXnb.exe
  C:\Windows\System\jWLrXnb.exe
  2⤵
  PID:12948
- C:\Windows\System\csNTDRl.exe
  C:\Windows\System\csNTDRl.exe
  2⤵
  PID:13140
- C:\Windows\System\tUGMJgu.exe
  C:\Windows\System\tUGMJgu.exe
  2⤵
  PID:13240
- C:\Windows\System\MXinuNZ.exe
  C:\Windows\System\MXinuNZ.exe
  2⤵
  PID:12356
- C:\Windows\System\SBsQYJI.exe
  C:\Windows\System\SBsQYJI.exe
  2⤵
  PID:12808
- C:\Windows\System\imtIIbl.exe
  C:\Windows\System\imtIIbl.exe
  2⤵
  PID:13308
- C:\Windows\System\CCwHCFB.exe
  C:\Windows\System\CCwHCFB.exe
  2⤵
  PID:12724
- C:\Windows\System\wFDOtsB.exe
  C:\Windows\System\wFDOtsB.exe
  2⤵
  PID:13336
- C:\Windows\System\lcNXMOe.exe
  C:\Windows\System\lcNXMOe.exe
  2⤵
  PID:13364
- C:\Windows\System\JCnPPVY.exe
  C:\Windows\System\JCnPPVY.exe
  2⤵
  PID:13392
- C:\Windows\System\ZuLJVgZ.exe
  C:\Windows\System\ZuLJVgZ.exe
  2⤵
  PID:13424
- C:\Windows\System\soFxdrF.exe
  C:\Windows\System\soFxdrF.exe
  2⤵
  PID:13440
- C:\Windows\System\UasWiMv.exe
  C:\Windows\System\UasWiMv.exe
  2⤵
  PID:13456
- C:\Windows\System\RuwHoqX.exe
  C:\Windows\System\RuwHoqX.exe
  2⤵
  PID:13492
- C:\Windows\System\xydYCza.exe
  C:\Windows\System\xydYCza.exe
  2⤵
  PID:13512
- C:\Windows\System\YeyTvQf.exe
  C:\Windows\System\YeyTvQf.exe
  2⤵
  PID:13540
- C:\Windows\System\saeTQAm.exe
  C:\Windows\System\saeTQAm.exe
  2⤵
  PID:13576
- C:\Windows\System\QLqvrxT.exe
  C:\Windows\System\QLqvrxT.exe
  2⤵
  PID:13604
- C:\Windows\System\bJQnAgA.exe
  C:\Windows\System\bJQnAgA.exe
  2⤵
  PID:13636
- C:\Windows\System\gNYSjYi.exe
  C:\Windows\System\gNYSjYi.exe
  2⤵
  PID:13664
- C:\Windows\System\nNjcdNS.exe
  C:\Windows\System\nNjcdNS.exe
  2⤵
  PID:13692
- C:\Windows\System\XFeZkzi.exe
  C:\Windows\System\XFeZkzi.exe
  2⤵
  PID:13716
- C:\Windows\System\nJZYGXk.exe
  C:\Windows\System\nJZYGXk.exe
  2⤵
  PID:13756
- C:\Windows\System\dXGEKEd.exe
  C:\Windows\System\dXGEKEd.exe
  2⤵
  PID:13776
- C:\Windows\System\FAZwAQn.exe
  C:\Windows\System\FAZwAQn.exe
  2⤵
  PID:13816
- C:\Windows\System\YWfRYzD.exe
  C:\Windows\System\YWfRYzD.exe
  2⤵
  PID:13844
- C:\Windows\System\MHqiTdE.exe
  C:\Windows\System\MHqiTdE.exe
  2⤵
  PID:13872
- C:\Windows\System\IQNrcvf.exe
  C:\Windows\System\IQNrcvf.exe
  2⤵
  PID:13896
- C:\Windows\System\gSaYLsM.exe
  C:\Windows\System\gSaYLsM.exe
  2⤵
  PID:13916
- C:\Windows\System\oopPQUp.exe
  C:\Windows\System\oopPQUp.exe
  2⤵
  PID:13944
- C:\Windows\System\MIviTdu.exe
  C:\Windows\System\MIviTdu.exe
  2⤵
  PID:13976
- C:\Windows\System\bfxmozO.exe
  C:\Windows\System\bfxmozO.exe
  2⤵
  PID:14000
- C:\Windows\System\nEmHKuC.exe
  C:\Windows\System\nEmHKuC.exe
  2⤵
  PID:14024
- C:\Windows\System\CflPQns.exe
  C:\Windows\System\CflPQns.exe
  2⤵
  PID:14060
- C:\Windows\System\fYMfRdq.exe
  C:\Windows\System\fYMfRdq.exe
  2⤵
  PID:14084
- C:\Windows\System\LhwKjqM.exe
  C:\Windows\System\LhwKjqM.exe
  2⤵
  PID:14124
- C:\Windows\System\VRwqLfs.exe
  C:\Windows\System\VRwqLfs.exe
  2⤵
  PID:14148
- C:\Windows\System\uncZgEn.exe
  C:\Windows\System\uncZgEn.exe
  2⤵
  PID:14168
- C:\Windows\System\NeUfDLB.exe
  C:\Windows\System\NeUfDLB.exe
  2⤵
  PID:14196
- C:\Windows\System\twmzfhi.exe
  C:\Windows\System\twmzfhi.exe
  2⤵
  PID:14220
- C:\Windows\System\SmlyhHA.exe
  C:\Windows\System\SmlyhHA.exe
  2⤵
  PID:14252
- C:\Windows\System\FDSRdpb.exe
  C:\Windows\System\FDSRdpb.exe
  2⤵
  PID:14280
- C:\Windows\System\SpTSTkO.exe
  C:\Windows\System\SpTSTkO.exe
  2⤵
  PID:14296
- C:\Windows\System\BzLPJmS.exe
  C:\Windows\System\BzLPJmS.exe
  2⤵
  PID:14324
- C:\Windows\System\SUPgzQQ.exe
  C:\Windows\System\SUPgzQQ.exe
  2⤵
  PID:13348
- C:\Windows\System\iwkJyGs.exe
  C:\Windows\System\iwkJyGs.exe
  2⤵
  PID:13420
- C:\Windows\System\KWLAuzB.exe
  C:\Windows\System\KWLAuzB.exe
  2⤵
  PID:13476
- C:\Windows\System\JOsQPBX.exe
  C:\Windows\System\JOsQPBX.exe
  2⤵
  PID:13536
- C:\Windows\System\xUQdyLf.exe
  C:\Windows\System\xUQdyLf.exe
  2⤵
  PID:13588
- C:\Windows\System\ZPZqDzR.exe
  C:\Windows\System\ZPZqDzR.exe
  2⤵
  PID:13712
- C:\Windows\System\BmOmRzP.exe
  C:\Windows\System\BmOmRzP.exe
  2⤵
  PID:13768
- C:\Windows\System\RIesAqh.exe
  C:\Windows\System\RIesAqh.exe
  2⤵
  PID:13836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ClnoYRa.exe

Filesize
1.8MB

MD5
d5005fee4ed247353dc66fbece75a71c

SHA1
42b369f49b8a7138de9eff104442df18506e77fc

SHA256
c51d64d5631309cb8bfc569f609b126c97b439fed6c7300efd6e032d185a8c8c

SHA512
ac6ba7fc69dd2dc9d51b1cd5b6381383dd727e591a0dc599e9ef11aa4cc4535961c6683ab4853906a450d043000b780a8664224330d09115ff68d3db889f5210

Download Submit
C:\Windows\System\CsOyNBw.exe

Filesize
1.8MB

MD5
6d8a6b139ab6a9dd129beaee4e7d0f5d

SHA1
39ff9c0a018fc79d25f0098042e222f44beeb264

SHA256
1f121c3e544b9a3cac1a9c8c183cbfabb7ad47766229a2cdfb4e910f7080767d

SHA512
b781d580c091a42a77371b2cb7dd3473a579efab4bf80fe004a154dbb42c2c6e0b30fca865445eb18fef00c9354f77471e6aff3f41274bb6d25e331930afa8fb

Download Submit
C:\Windows\System\DzzQaZG.exe

Filesize
1.8MB

MD5
bfbf22f8be1178403c696c9598e817f4

SHA1
d685ef5dfb85651229fdf9597361732b8c7c51db

SHA256
1b0e543c1fdfd2635993557b088ce22af5e58544863831c02fd9c5ec9a034fca

SHA512
e0195e1551deecf552db54ddccbcae897c103c7450fd0ffc5b1e57807d4138801d87ed26f5fe899dba88787a578b92f8106349e814f4022deef7c85d444b5d34

Download Submit
C:\Windows\System\EYUajzz.exe

Filesize
1.8MB

MD5
63db4f6dcad08fd809da227d5f754b9e

SHA1
20fcb9812b6494257c03dae7c9a6921a9c91bf78

SHA256
fbbf33983e984b9850bc42d9e37c4e27f088a4fef41f8708386e0a7dcd1e9854

SHA512
53ea4d83b21f834e4251bd44d9edd43ca7433deffc702614a706eef75a5c8ad5a279172d6358aa959fb9bb3d5b3664056356f5ca10343fd0913abccd344e34c1

Download Submit
C:\Windows\System\FjVseDu.exe

Filesize
1.8MB

MD5
37efefaf3edcc39c055ce4d10a1154d0

SHA1
74ae4e26e617daf8c88d4a7c709aad6ce7f5ef2b

SHA256
2437dee101cb4b2509dc01c4c8f72c6635e866953499d0f1bb8e9c0a0428a3b5

SHA512
809bbe59f691980b27023aedc3c63fea7f8adbba4cbb43ec84d91487d6310304322b8bec1775a3725f7c7324b520e2a326406e96d833f7eb1bdc44ded78d7710

Download Submit
C:\Windows\System\JDAcyth.exe

Filesize
1.8MB

MD5
fc4a6d5974dd2093c8b5be151f35887a

SHA1
a247bcb03c4ea25cb44e94254de250e43254c48a

SHA256
d5fb753a75d37df819f76da55d1b3c7a671c403ae6a132aae9e1abc48ef90621

SHA512
64160d23c7dc4e7a33d58d9314dd91b6df2c741bc8214fe46062fba250c06e4aee547d48cf56151f6527a1fd4074a031ea87513f88868cf1b91cde85cb3385a9

Download Submit
C:\Windows\System\LykoWmy.exe

Filesize
1.8MB

MD5
502e9aa0dcc1922d98468423f1036442

SHA1
1189eb552e6f20bf36174c1af9c99ed61268ea27

SHA256
755af178c00ad2f007eac82fa259f1d46c6dcfebe1c7df05bedd6b2dee8b5aa4

SHA512
aebd66ab4109f6fe20101550d9d462d7b60a24e8a8b4edce5c5b842169f5e00a59d704cd3224be60827f41cffa5bec5c3d70f367c10c2a03c477d1f68506f69b

Download Submit
C:\Windows\System\MmAtPfg.exe

Filesize
1.8MB

MD5
9901255e5df25698f7e74178a67559a8

SHA1
b731e14d470f25cd8ed201a8ca94c11450bf6857

SHA256
e2fbb93562b98bf5b25fb403115c4954e3a3507cf4689f650ed6c29aa2f7858d

SHA512
1b68a50efe628954b2bfe3ab19d00e83c6d01caf291cdb3094dcffb284958d206ee56c906f6519c567210fe5ddd45fddb9cb9ecfc738ea7323a6fb16e57e3c54

Download Submit
C:\Windows\System\OattYJU.exe

Filesize
1.8MB

MD5
75e9d28616a7da00533e8935a74ee1bf

SHA1
eb7109f175cacf40847e98e75ccc2e4ca78002fa

SHA256
c9cb3a8e922856869dca0b5f644d2958c92c21b7d860c5ada060c509646099aa

SHA512
0952c1bd80579257e18d69eb4165f79d9626514a50354400a87452bbb9f6444b8b437b1355f551e1187ce356d7e3aa485fd7d8bd500141eaf85a4cb8132d8443

Download Submit
C:\Windows\System\PEEDQNt.exe

Filesize
1.8MB

MD5
7395c25faf88436dd571b721032724b1

SHA1
8c7be1afa1584fb6b40d726da46bf559ab3896e3

SHA256
433618f0554ab422fbec0e7ed7a78c4f41fcd44a95e898f9830cdaa3d6c3e1bb

SHA512
0c520311daf94270eaf5bc8d86430245673bddf75d36f5bb4c9bb4a52e496697229d0bf13c17b49210c443ca0ed0337f5feb7b163c8098f50d212bb038ac16da

Download Submit
C:\Windows\System\QBgSgpg.exe

Filesize
1.8MB

MD5
1f6fa15aba2aeead1a2a534e38e562bc

SHA1
721c9fcd5ef7a23acbd2e9c5a7ca5d09ebc34575

SHA256
43957389c18e4fce0d669def02952015cd5c5df46095b7832b673d6dd43f5a0e

SHA512
a537183a3770582e5a4d69deb5153100320f88ab32c572f11fd38a2b56705856fd5fb29574348c5943325265e8edce154cbf13894bfc1902d0681f8262803225

Download Submit
C:\Windows\System\SJNvICp.exe

Filesize
1.8MB

MD5
54e44db25606a4d4128438cc5ba2942b

SHA1
4c57d3af5aa2d34d3c24b0dbb64ee95ddd662ab9

SHA256
1444577b5d12a2e8222995cf5a55e0435e7c3bc23d7d724b8139df499b0585a0

SHA512
c7fa5b760ba3cd5a14036b41338fb1e1f98081e1eb9b852d48b813a5d6b68b999d15c8b5e9476653a35108b6552d2a2796926c2f125361189ee1d0564a8a6c85

Download Submit
C:\Windows\System\SRahqzS.exe

Filesize
1.8MB

MD5
122a1f62309f0b30a5cb0c4a6541e022

SHA1
d29a143c984b516755de3fdca036a8baf45ed3a5

SHA256
24e4528d6c20e5cc1adec613969f1086e27d88b64efdbc9bd93d5df27dc46f2b

SHA512
15cf4a6aa4be1c4547f21af5cb49beab7b5b61fc3a44f26c6943dc73812ae3fe24e75d3c90d4df086e7469adda799c8ba85c383965eaff4c2c00ec4a65ae40be

Download Submit
C:\Windows\System\UaqyotA.exe

Filesize
1.8MB

MD5
f4b368c9b26cd5e5c9765ceecf019d17

SHA1
daca0a1948d3052e61f9e61828703e131f5c9f9d

SHA256
dccba1b362fe480b96cd9746b8d5d03fc2cf6ccf60127db089a9aea88177b8f4

SHA512
ff157bbc069983f0dfb72c7df2b7799e5e17f374760390ff15d9f79f19e9f57026735f6855fd06d0fb3f2c3f29470c94facb6e63601ed46c3cd7a4d72190060f

Download Submit
C:\Windows\System\WILeueN.exe

Filesize
1.8MB

MD5
fc066f2078bccbc0297fde1084c8d167

SHA1
a81897a1e7b9ce9aa32cfa52dc68856682bf22f6

SHA256
8845f1af4ee3e9ee3d6cfa115a3122aa6da2b1cdff9030988294f8bfa403f79a

SHA512
30a15c79851aa5a4668dd91db76458b7ae9d99af94749367fa6c95e3c8091cd9951860a191759f0a5951775e2abad74937dc381f1e76dd891687a9e27e788e6f

Download Submit
C:\Windows\System\WWbTPhM.exe

Filesize
1.8MB

MD5
030aca240576a7e67f342840caa712e1

SHA1
cad8371ba434d03c76d00fd4dfd27c40ba14f04a

SHA256
bfcf1b375957666281407715a43f5c40da607ddd1301cee2e79ce89c3e3f02a6

SHA512
9d95062353f5723c67e7fb37d92ca2b470e17c0c6127c53b6e954c8847de0a993218552d0849b3ddd9a0e41662104dd88b58d19fe7eaac6a49848749ec334dde

Download Submit
C:\Windows\System\ZSstStR.exe

Filesize
1.8MB

MD5
da90562fe210cb8eb8e6a61de2d0a577

SHA1
ef7d8105d7126bf9adfdda2e522b3809fb246675

SHA256
96ad9097c114a1e16fe95ba3761fdf3e1b9c7443930065faf112abf1a78c5ffc

SHA512
56dd7fa58969479d840b53adc3f02cfc0ad83e89ed4c80d0b24eb3bc4d46f7aef722caeacbaa9d2b65378151221146200cabaab78308892d1fa095414ad4fb54

Download Submit
C:\Windows\System\cOgaCJN.exe

Filesize
1.8MB

MD5
85d25807b9a0a14869b472164fac4e98

SHA1
f9c4498e253b6f9052f66f1ec8192d1cd007bd3d

SHA256
1a3db3e5206ffd3580d1c496b0e05fa393d795a951c19217a4ca05fe8d25bdb8

SHA512
61964556829b3a03f51f8740786d1b4e3c269568f4e555136554eb46037ce325fcf9582e59f1b2c09a85edb0d14e7c1bbb17895b6a9f6b435c66829e5bad2517

Download Submit
C:\Windows\System\cerKHzl.exe

Filesize
1.8MB

MD5
7e8b80a41e4a47108beabf6259a06dbe

SHA1
12d498fd197a48b278871b0df1364d4ce41fba08

SHA256
af08de27c34ae175e1ef5a9656ec1b37eb15950d1090a8295589471f1d213f92

SHA512
ec1f2ecbf57e7ee94274eae3280292fa7e9f5be3a0bde6a6cb154ece922d9d58f24e203ea413a0edc32f5207e82db3b1a3cae813fae98f5e590c623846bf5514

Download Submit
C:\Windows\System\cxHEubL.exe

Filesize
1.8MB

MD5
5cd15654554e544df3b3063d18f485b8

SHA1
d0d3ef9cf2632b2926a7b9e3e9384beac2d4fd1f

SHA256
cf44e8a2d82f0802a681e9d5e369a2164d03756c6a150498cd7bf5031ca89d0f

SHA512
8f82b498e20ff9886b4596f5952acd81aec49157a94717fddb7078e0dbddfac05d03026335662993432a306e73d9b41dbbd24616dcf12762db867314bc51c9f7

Download Submit
C:\Windows\System\futEUvW.exe

Filesize
1.8MB

MD5
8a41f25e4b04aa744a673897f327a53a

SHA1
aae7df08f8033565063a488421f270f2e638a42d

SHA256
4f17a5d026e1e19d7dbbcf280133a26769db4b67672c1ba47d2009b3ef7c1ffb

SHA512
fe3bbaa52ed3c60844f31ca1fd2dd100d0a7982e7c61d808da36de2e0617755158ef20357e60331bdba5edff3db9219ca864ffb459d60ad87b98e4df9227b299

Download Submit
C:\Windows\System\gIKhnvc.exe

Filesize
1.8MB

MD5
1e2f895a39dd75c26d6fb23ba2640c48

SHA1
2e271e8953c20e60767b5a53d9281c44a2df39eb

SHA256
f9c5f4cf09caf0ece4c6112ce732090ff269b4cabc576c9aa09c22dba466c693

SHA512
b0af89ca7ab2f10f62f061fb19dde90898270999bd7ce4a6b6fc091eba436bf3632b37428e0f9413f69c461a309318a8e89e085c8dafe94ff2243795943a8c23

Download Submit
C:\Windows\System\jFShRIz.exe

Filesize
1.8MB

MD5
4d791e902da844da6f15b2cf7beaac91

SHA1
f920f5952c4f693279cb4fc6a8cc05d2770155c8

SHA256
5d251d0559eafe2c8d6f36770d242c077ca4ff9855626a5cbccb16e23507ef44

SHA512
5a54e9ead2e1116e452535b4ca0cd163ae3bbba4d643ac9454f5bd1c19be8f34eda827dc33252364266cfd6086b18a667d6e3d94b6308a6477bc45c35c8339c8

Download Submit
C:\Windows\System\jcIuVlE.exe

Filesize
1.8MB

MD5
aeb8a3bb6dfa494a8a27d4c68fd5b6ad

SHA1
f0ba8142d44b8158167951eac170bb3aa1f4d15b

SHA256
ec21d3e7f067b3bf21ea5a15cc1c78d93215b507d4f4c789a4a46ed98cf56198

SHA512
1a95ae143ed79efac32879b33a1f3ceea04c108e2b082a61a937cd61c3cfe10613935d3c586979b55ec6fad4fcf5412a065d261a8a06ed9eddd32f8e70f881c9

Download Submit
C:\Windows\System\rEoZIQb.exe

Filesize
1.8MB

MD5
813f42e998ab21f21b544cf4f290de1f

SHA1
e7e1c6c33dfd52b1c97d07e3ec945819272c03ba

SHA256
c3305c4555df7de1d82a41233a3291a1ab2a7bc83a6d0305d20d274d05de4f11

SHA512
44fc410b1e486fe33b7e664cf2a8508d8305268d77938cfc5c46704e7e6286fda2d49f9568a26759e07521c7c6da1e1591a6787f37a8c99aab177fa637dc0fcc

Download Submit
C:\Windows\System\seGFtJL.exe

Filesize
1.8MB

MD5
1f458da56d26d92dc90b6d1c4bb2173e

SHA1
359d08278760684819575e8ef09c82acf55c1ee3

SHA256
5088d719e449b15352c0394e0b60e0b7a9e855bfc845ed113a5ac58d49b25f3d

SHA512
e33356fa3ee1dde7acde34cbf0a95834322beb68151c2e6a0c10994a9f42bdb40979994e44812358c99417075658d90d6d3c734ba08f7575b4147f53d5433c39

Download Submit
C:\Windows\System\swZTzBM.exe

Filesize
1.8MB

MD5
a51ffcd4807fd10df7fb9b67064d7809

SHA1
5275c91a76ae703c1356ef2fa9322cb261833624

SHA256
82d8a90f2459adabe0e6461d6f238c1174b64c3b52d5a48b909d0ebec60605f2

SHA512
26cb991178ccf26c063969f46bdf4581f569e03dfd33193a4d23839a7c7bc92786e5d36548971912e8f0858ab84a58c4c11af5882ec470f57722bcce1405dc81

Download Submit
C:\Windows\System\tPLPjxp.exe

Filesize
1.8MB

MD5
3452d49869416e7d1477431c93737255

SHA1
7d3c0dd9833107620f9383dc937a22044b458692

SHA256
71276e4d022de1c1879c5268e644b865b60063ae1cfc0f1250f6019bf938e762

SHA512
6fa065c4a4a92a618af3a5f9e99a786e39f0d1e21b3658f055665d65e2ffc5c58ffc3faa54ceeb31efdc89db3b1a34c6815c9b9a61758cc7ef76e71cbd670b13

Download Submit
C:\Windows\System\vBFCOEo.exe

Filesize
1.8MB

MD5
43b76ce047ae44dcf788d9b549f3c6dd

SHA1
d1d6db7e7fcebc09d7c0610f84c581e58b86b13a

SHA256
17c31deb9a5f0182b08978c866fd0e6ac5e3c06aa73398b19a91e50ae2c93347

SHA512
05ebb53287987a46907cfdb19a81bfb27eaaf000179e579962e6b7324d90acd0b51a957712616e730bbb3f3aca0139ebead59b22110e159bb25bbaa50c0cf22b

Download Submit
C:\Windows\System\vBcrEbF.exe

Filesize
1.8MB

MD5
3c63277bab4d26d3ed7359f30cce7243

SHA1
333890679951569228ff0f84fc4b83f6e7c09fb1

SHA256
4512c1ab9ae8ef3461580450586413601c477687f71716f62d2e3cd83d917fbc

SHA512
d00df3a5996a575550679d79609541460388bff590a8fbd102fef5918ab190e374e52672d8e907d5960b3bdc8df9e8c7e949234a0cb81481ec7e18dfd3821e77

Download Submit
C:\Windows\System\vmWauOk.exe

Filesize
1.8MB

MD5
396b735c89fde6ffeb51cd450868786b

SHA1
13accb1b213533e51d65225f8c6fd5a515ca526b

SHA256
d72f4dee4e92f0f0d80b2599373e1649cb05a000b424244cca7c4623bc57ec43

SHA512
f9159873bdc587df7adaa0a24421b02edc5f94fff698e118a38821a41e6f64d41256ba14258591ba13d49fb7bde8f1ef1ef9da095d4a549a55fc8c992ba0107f

Download Submit
C:\Windows\System\ysSTPWf.exe

Filesize
1.8MB

MD5
aae24066a54e9a42cbe480e261cfb5ab

SHA1
e723d8465a349fcb2c9288565be83efd6a2d67e2

SHA256
58ae5625d7b60954483a8c3375741e14145d682b664a09e0129390a6a198f3b6

SHA512
d5050ae4de187d95c068b4e7741d269bab730f4a9300db8b9917e42f78ab97276abdd4e12d1e0b2dc3b43ed637db41dd9e58e35eac5d0be9232609123ab9887a

Download Submit
C:\Windows\System\zrmGGHt.exe

Filesize
1.8MB

MD5
978e3c8a3c9e3cf7d793e0fe2971ea36

SHA1
84ad28f25d034812669453f8ae3213fa78db81ce

SHA256
f4e153968fd5344f4dd86cc917abb6eee2fba882fdc5e36b5b1793a37e5a9820

SHA512
122f8c635843089a25eba47105a8884ca9153e60204da2b51e946e8f0449336f6681509dff4acc791143daa284ebe235c9c2b14883694e229119aaa842e318d8

Download Submit
memory/372-752-0x00007FF737EC0000-0x00007FF738214000-memory.dmp

Filesize
3.3MB

Download
memory/372-2152-0x00007FF737EC0000-0x00007FF738214000-memory.dmp

Filesize
3.3MB

Download
memory/620-2136-0x00007FF6F1E40000-0x00007FF6F2194000-memory.dmp

Filesize
3.3MB

Download
memory/620-705-0x00007FF6F1E40000-0x00007FF6F2194000-memory.dmp

Filesize
3.3MB

Download
memory/920-749-0x00007FF6A49B0000-0x00007FF6A4D04000-memory.dmp

Filesize
3.3MB

Download
memory/920-2154-0x00007FF6A49B0000-0x00007FF6A4D04000-memory.dmp

Filesize
3.3MB

Download
memory/1888-2132-0x00007FF7C7750000-0x00007FF7C7AA4000-memory.dmp

Filesize
3.3MB

Download
memory/1888-670-0x00007FF7C7750000-0x00007FF7C7AA4000-memory.dmp

Filesize
3.3MB

Download
memory/2004-2127-0x00007FF6346D0000-0x00007FF634A24000-memory.dmp

Filesize
3.3MB

Download
memory/2004-2125-0x00007FF6346D0000-0x00007FF634A24000-memory.dmp

Filesize
3.3MB

Download
memory/2004-29-0x00007FF6346D0000-0x00007FF634A24000-memory.dmp

Filesize
3.3MB

Download
memory/2020-679-0x00007FF767330000-0x00007FF767684000-memory.dmp

Filesize
3.3MB

Download
memory/2020-2145-0x00007FF767330000-0x00007FF767684000-memory.dmp

Filesize
3.3MB

Download
memory/2052-2137-0x00007FF7F9760000-0x00007FF7F9AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2052-716-0x00007FF7F9760000-0x00007FF7F9AB4000-memory.dmp

Filesize
3.3MB

Download
memory/2056-697-0x00007FF7B1A20000-0x00007FF7B1D74000-memory.dmp

Filesize
3.3MB

Download
memory/2056-2146-0x00007FF7B1A20000-0x00007FF7B1D74000-memory.dmp

Filesize
3.3MB

Download
memory/2188-0-0x00007FF74A4B0000-0x00007FF74A804000-memory.dmp

Filesize
3.3MB

Download
memory/2188-1-0x0000021356C40000-0x0000021356C50000-memory.dmp

Filesize
64KB

Download
memory/2332-2134-0x00007FF6D28C0000-0x00007FF6D2C14000-memory.dmp

Filesize
3.3MB

Download
memory/2332-672-0x00007FF6D28C0000-0x00007FF6D2C14000-memory.dmp

Filesize
3.3MB

Download
memory/2872-9-0x00007FF7AA8B0000-0x00007FF7AAC04000-memory.dmp

Filesize
3.3MB

Download
memory/2872-2126-0x00007FF7AA8B0000-0x00007FF7AAC04000-memory.dmp

Filesize
3.3MB

Download
memory/2872-2124-0x00007FF7AA8B0000-0x00007FF7AAC04000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2153-0x00007FF72DC10000-0x00007FF72DF64000-memory.dmp

Filesize
3.3MB

Download
memory/2924-744-0x00007FF72DC10000-0x00007FF72DF64000-memory.dmp

Filesize
3.3MB

Download
memory/2992-2129-0x00007FF754850000-0x00007FF754BA4000-memory.dmp

Filesize
3.3MB

Download
memory/2992-666-0x00007FF754850000-0x00007FF754BA4000-memory.dmp

Filesize
3.3MB

Download
memory/3156-2133-0x00007FF795140000-0x00007FF795494000-memory.dmp

Filesize
3.3MB

Download
memory/3156-671-0x00007FF795140000-0x00007FF795494000-memory.dmp

Filesize
3.3MB

Download
memory/3628-759-0x00007FF61E460000-0x00007FF61E7B4000-memory.dmp

Filesize
3.3MB

Download
memory/3628-2131-0x00007FF61E460000-0x00007FF61E7B4000-memory.dmp

Filesize
3.3MB

Download
memory/3836-737-0x00007FF67C490000-0x00007FF67C7E4000-memory.dmp

Filesize
3.3MB

Download
memory/3836-2150-0x00007FF67C490000-0x00007FF67C7E4000-memory.dmp

Filesize
3.3MB

Download
memory/4008-2151-0x00007FF6B1590000-0x00007FF6B18E4000-memory.dmp

Filesize
3.3MB

Download
memory/4008-741-0x00007FF6B1590000-0x00007FF6B18E4000-memory.dmp

Filesize
3.3MB

Download
memory/4036-2147-0x00007FF6F6670000-0x00007FF6F69C4000-memory.dmp

Filesize
3.3MB

Download
memory/4036-698-0x00007FF6F6670000-0x00007FF6F69C4000-memory.dmp

Filesize
3.3MB

Download
memory/4128-723-0x00007FF6C1020000-0x00007FF6C1374000-memory.dmp

Filesize
3.3MB

Download
memory/4128-2135-0x00007FF6C1020000-0x00007FF6C1374000-memory.dmp

Filesize
3.3MB

Download
memory/4192-2140-0x00007FF697120000-0x00007FF697474000-memory.dmp

Filesize
3.3MB

Download
memory/4192-755-0x00007FF697120000-0x00007FF697474000-memory.dmp

Filesize
3.3MB

Download
memory/4244-676-0x00007FF6C1BE0000-0x00007FF6C1F34000-memory.dmp

Filesize
3.3MB

Download
memory/4244-2139-0x00007FF6C1BE0000-0x00007FF6C1F34000-memory.dmp

Filesize
3.3MB

Download
memory/4280-2143-0x00007FF682900000-0x00007FF682C54000-memory.dmp

Filesize
3.3MB

Download
memory/4280-677-0x00007FF682900000-0x00007FF682C54000-memory.dmp

Filesize
3.3MB

Download
memory/4400-2148-0x00007FF7DD540000-0x00007FF7DD894000-memory.dmp

Filesize
3.3MB

Download
memory/4400-735-0x00007FF7DD540000-0x00007FF7DD894000-memory.dmp

Filesize
3.3MB

Download
memory/4428-675-0x00007FF630290000-0x00007FF6305E4000-memory.dmp

Filesize
3.3MB

Download
memory/4428-2141-0x00007FF630290000-0x00007FF6305E4000-memory.dmp

Filesize
3.3MB

Download
memory/4500-2128-0x00007FF733CF0000-0x00007FF734044000-memory.dmp

Filesize
3.3MB

Download
memory/4500-756-0x00007FF733CF0000-0x00007FF734044000-memory.dmp

Filesize
3.3MB

Download
memory/4640-724-0x00007FF6D8980000-0x00007FF6D8CD4000-memory.dmp

Filesize
3.3MB

Download
memory/4640-2142-0x00007FF6D8980000-0x00007FF6D8CD4000-memory.dmp

Filesize
3.3MB

Download
memory/4648-668-0x00007FF61F440000-0x00007FF61F794000-memory.dmp

Filesize
3.3MB

Download
memory/4648-2130-0x00007FF61F440000-0x00007FF61F794000-memory.dmp

Filesize
3.3MB

Download
memory/4932-717-0x00007FF6B7120000-0x00007FF6B7474000-memory.dmp

Filesize
3.3MB

Download
memory/4932-2138-0x00007FF6B7120000-0x00007FF6B7474000-memory.dmp

Filesize
3.3MB

Download
memory/5036-729-0x00007FF7EFAA0000-0x00007FF7EFDF4000-memory.dmp

Filesize
3.3MB

Download
memory/5036-2149-0x00007FF7EFAA0000-0x00007FF7EFDF4000-memory.dmp

Filesize
3.3MB

Download
memory/5076-2144-0x00007FF6C6870000-0x00007FF6C6BC4000-memory.dmp

Filesize
3.3MB

Download
memory/5076-694-0x00007FF6C6870000-0x00007FF6C6BC4000-memory.dmp

Filesize
3.3MB

Download