xmrig | f78f8fc716a7b75c3dace4b0c79ea11f0edaa959fe74ec2b8443ec3998539a87

Analysis

max time kernel
120s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

053323e37502c56a7973ca542f014e80_NEIKI.exe
Size

2.2MB
MD5

053323e37502c56a7973ca542f014e80
SHA1

5e51c8f52b8a3c5a31c3cc0089fce4479a1a89a6
SHA256

f78f8fc716a7b75c3dace4b0c79ea11f0edaa959fe74ec2b8443ec3998539a87
SHA512

0a0ccf4b9bd93526eaa45ef18577077c582cc8329337ce378c79dd98de9c8812f137bf0205912bda614741dc5feadc8024245556c89d3f3e0c656e6c115f6db5
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQW/yFtgmZ3:BemTLkNdfE0pZrQt

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3192-0-0x00007FF600950000-0x00007FF600CA4000-memory.dmp	xmrig
behavioral2/files/0x000700000002328e-5.dat	xmrig
behavioral2/files/0x00080000000233f9-7.dat	xmrig
behavioral2/files/0x00070000000233fa-18.dat	xmrig
behavioral2/files/0x00070000000233fd-57.dat	xmrig
behavioral2/files/0x0007000000023404-69.dat	xmrig
behavioral2/memory/3632-84-0x00007FF614AB0000-0x00007FF614E04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-95.dat	xmrig
behavioral2/memory/2488-105-0x00007FF754DA0000-0x00007FF7550F4000-memory.dmp	xmrig
behavioral2/memory/3220-113-0x00007FF6305C0000-0x00007FF630914000-memory.dmp	xmrig
behavioral2/memory/1824-116-0x00007FF61B3F0000-0x00007FF61B744000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-142.dat	xmrig
behavioral2/files/0x000700000002340c-157.dat	xmrig
behavioral2/files/0x000700000002341a-182.dat	xmrig
behavioral2/memory/1644-198-0x00007FF6E7880000-0x00007FF6E7BD4000-memory.dmp	xmrig
behavioral2/memory/4592-205-0x00007FF7E3060000-0x00007FF7E33B4000-memory.dmp	xmrig
behavioral2/memory/1624-204-0x00007FF775FA0000-0x00007FF7762F4000-memory.dmp	xmrig
behavioral2/memory/4516-203-0x00007FF74BCF0000-0x00007FF74C044000-memory.dmp	xmrig
behavioral2/memory/3136-202-0x00007FF753EB0000-0x00007FF754204000-memory.dmp	xmrig
behavioral2/memory/540-201-0x00007FF633190000-0x00007FF6334E4000-memory.dmp	xmrig
behavioral2/memory/3616-200-0x00007FF717680000-0x00007FF7179D4000-memory.dmp	xmrig
behavioral2/memory/620-199-0x00007FF70EB20000-0x00007FF70EE74000-memory.dmp	xmrig
behavioral2/memory/4364-192-0x00007FF670AE0000-0x00007FF670E34000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-185.dat	xmrig
behavioral2/files/0x0007000000023411-183.dat	xmrig
behavioral2/files/0x0007000000023419-181.dat	xmrig
behavioral2/files/0x0007000000023418-180.dat	xmrig
behavioral2/files/0x0007000000023417-179.dat	xmrig
behavioral2/files/0x0007000000023416-178.dat	xmrig
behavioral2/files/0x0007000000023415-177.dat	xmrig
behavioral2/files/0x0007000000023414-176.dat	xmrig
behavioral2/files/0x000700000002340e-174.dat	xmrig
behavioral2/files/0x0007000000023413-173.dat	xmrig
behavioral2/files/0x0007000000023412-171.dat	xmrig
behavioral2/files/0x0007000000023410-151.dat	xmrig
behavioral2/files/0x00080000000233f7-131.dat	xmrig
behavioral2/files/0x000700000002340b-129.dat	xmrig
behavioral2/memory/4424-122-0x00007FF654B00000-0x00007FF654E54000-memory.dmp	xmrig
behavioral2/memory/916-121-0x00007FF73CD30000-0x00007FF73D084000-memory.dmp	xmrig
behavioral2/memory/1384-120-0x00007FF7251D0000-0x00007FF725524000-memory.dmp	xmrig
behavioral2/memory/4640-119-0x00007FF767B30000-0x00007FF767E84000-memory.dmp	xmrig
behavioral2/memory/1404-118-0x00007FF7B9240000-0x00007FF7B9594000-memory.dmp	xmrig
behavioral2/memory/4344-117-0x00007FF6ADFB0000-0x00007FF6AE304000-memory.dmp	xmrig
behavioral2/memory/4224-115-0x00007FF6E2E60000-0x00007FF6E31B4000-memory.dmp	xmrig
behavioral2/memory/3176-114-0x00007FF6DB660000-0x00007FF6DB9B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-111.dat	xmrig
behavioral2/files/0x0007000000023409-109.dat	xmrig
behavioral2/memory/3276-108-0x00007FF6BBD00000-0x00007FF6BC054000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-102.dat	xmrig
behavioral2/files/0x0007000000023406-100.dat	xmrig
behavioral2/files/0x0007000000023405-98.dat	xmrig
behavioral2/memory/4312-96-0x00007FF621610000-0x00007FF621964000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-91.dat	xmrig
behavioral2/files/0x0007000000023402-79.dat	xmrig
behavioral2/files/0x0007000000023401-78.dat	xmrig
behavioral2/memory/4544-75-0x00007FF6A8A50000-0x00007FF6A8DA4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-72.dat	xmrig
behavioral2/files/0x0007000000023400-68.dat	xmrig
behavioral2/files/0x00070000000233ff-65.dat	xmrig
behavioral2/memory/2808-62-0x00007FF7D6A70000-0x00007FF7D6DC4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-54.dat	xmrig
behavioral2/memory/1440-50-0x00007FF7D92F0000-0x00007FF7D9644000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fb-46.dat	xmrig
behavioral2/memory/928-37-0x00007FF6CD6D0000-0x00007FF6CDA24000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4808	DMacctM.exe
1648	pMNUAAN.exe
1824	EgQBCQU.exe
928	pGvEtoG.exe
4344	aJDWGoN.exe
1440	UUWGubS.exe
2808	DOwbLRg.exe
4544	vElksek.exe
3632	AGpmiMJ.exe
4312	fkqKcwe.exe
1404	GbdFuGz.exe
2488	levjhHK.exe
3276	nShXFwp.exe
4640	rCGpYoi.exe
3220	QUyoHfE.exe
1384	MhVwFSQ.exe
916	Kozvogl.exe
3176	fEktkPM.exe
4424	wBwuQLC.exe
4224	IvtqDZs.exe
4364	IGvJrRX.exe
1644	mdGUuKB.exe
620	ZFvCETM.exe
3616	cFivDSg.exe
540	TDvVJJP.exe
3136	INBbwcZ.exe
4516	mMbWtXR.exe
1624	XKrXgpG.exe
4592	CdclXah.exe
2916	MfsfzKK.exe
4800	FxHEuaR.exe
1520	lftTkYs.exe
5116	HVCualM.exe
4336	sOdaUeW.exe
2948	GTcDxFe.exe
3928	mBodPkH.exe
4048	DhEiSpd.exe
1920	biWYNSE.exe
4864	usfUdqs.exe
1636	NJamjyT.exe
2336	DvLGoTV.exe
3092	tIdFGKK.exe
3488	yEZKXGo.exe
3296	VlPFGCm.exe
4292	xBZAaxU.exe
1652	KKXXDDz.exe
3184	FBdZQky.exe
3984	aSbyHqE.exe
3188	MkchwDU.exe
4368	ElwBYRI.exe
4588	xHcYgFv.exe
1040	UJrIpRx.exe
3520	vmmKefm.exe
1612	bmOPFTv.exe
4372	mcadyZA.exe
640	pdmgjhR.exe
4536	jIIedfM.exe
3876	wFDFCOX.exe
1756	lUhShXY.exe
3716	TsFxvjY.exe
1816	LDTAIGi.exe
1416	dkKNiCn.exe
2496	LZuqmem.exe
3952	usxlmFu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3192-0-0x00007FF600950000-0x00007FF600CA4000-memory.dmp	upx
behavioral2/files/0x000700000002328e-5.dat	upx
behavioral2/files/0x00080000000233f9-7.dat	upx
behavioral2/files/0x00070000000233fa-18.dat	upx
behavioral2/files/0x00070000000233fd-57.dat	upx
behavioral2/files/0x0007000000023404-69.dat	upx
behavioral2/memory/3632-84-0x00007FF614AB0000-0x00007FF614E04000-memory.dmp	upx
behavioral2/files/0x0007000000023408-95.dat	upx
behavioral2/memory/2488-105-0x00007FF754DA0000-0x00007FF7550F4000-memory.dmp	upx
behavioral2/memory/3220-113-0x00007FF6305C0000-0x00007FF630914000-memory.dmp	upx
behavioral2/memory/1824-116-0x00007FF61B3F0000-0x00007FF61B744000-memory.dmp	upx
behavioral2/files/0x000700000002340d-142.dat	upx
behavioral2/files/0x000700000002340c-157.dat	upx
behavioral2/files/0x000700000002341a-182.dat	upx
behavioral2/memory/1644-198-0x00007FF6E7880000-0x00007FF6E7BD4000-memory.dmp	upx
behavioral2/memory/4592-205-0x00007FF7E3060000-0x00007FF7E33B4000-memory.dmp	upx
behavioral2/memory/1624-204-0x00007FF775FA0000-0x00007FF7762F4000-memory.dmp	upx
behavioral2/memory/4516-203-0x00007FF74BCF0000-0x00007FF74C044000-memory.dmp	upx
behavioral2/memory/3136-202-0x00007FF753EB0000-0x00007FF754204000-memory.dmp	upx
behavioral2/memory/540-201-0x00007FF633190000-0x00007FF6334E4000-memory.dmp	upx
behavioral2/memory/3616-200-0x00007FF717680000-0x00007FF7179D4000-memory.dmp	upx
behavioral2/memory/620-199-0x00007FF70EB20000-0x00007FF70EE74000-memory.dmp	upx
behavioral2/memory/4364-192-0x00007FF670AE0000-0x00007FF670E34000-memory.dmp	upx
behavioral2/files/0x000700000002340f-185.dat	upx
behavioral2/files/0x0007000000023411-183.dat	upx
behavioral2/files/0x0007000000023419-181.dat	upx
behavioral2/files/0x0007000000023418-180.dat	upx
behavioral2/files/0x0007000000023417-179.dat	upx
behavioral2/files/0x0007000000023416-178.dat	upx
behavioral2/files/0x0007000000023415-177.dat	upx
behavioral2/files/0x0007000000023414-176.dat	upx
behavioral2/files/0x000700000002340e-174.dat	upx
behavioral2/files/0x0007000000023413-173.dat	upx
behavioral2/files/0x0007000000023412-171.dat	upx
behavioral2/files/0x0007000000023410-151.dat	upx
behavioral2/files/0x00080000000233f7-131.dat	upx
behavioral2/files/0x000700000002340b-129.dat	upx
behavioral2/memory/4424-122-0x00007FF654B00000-0x00007FF654E54000-memory.dmp	upx
behavioral2/memory/916-121-0x00007FF73CD30000-0x00007FF73D084000-memory.dmp	upx
behavioral2/memory/1384-120-0x00007FF7251D0000-0x00007FF725524000-memory.dmp	upx
behavioral2/memory/4640-119-0x00007FF767B30000-0x00007FF767E84000-memory.dmp	upx
behavioral2/memory/1404-118-0x00007FF7B9240000-0x00007FF7B9594000-memory.dmp	upx
behavioral2/memory/4344-117-0x00007FF6ADFB0000-0x00007FF6AE304000-memory.dmp	upx
behavioral2/memory/4224-115-0x00007FF6E2E60000-0x00007FF6E31B4000-memory.dmp	upx
behavioral2/memory/3176-114-0x00007FF6DB660000-0x00007FF6DB9B4000-memory.dmp	upx
behavioral2/files/0x000700000002340a-111.dat	upx
behavioral2/files/0x0007000000023409-109.dat	upx
behavioral2/memory/3276-108-0x00007FF6BBD00000-0x00007FF6BC054000-memory.dmp	upx
behavioral2/files/0x0007000000023407-102.dat	upx
behavioral2/files/0x0007000000023406-100.dat	upx
behavioral2/files/0x0007000000023405-98.dat	upx
behavioral2/memory/4312-96-0x00007FF621610000-0x00007FF621964000-memory.dmp	upx
behavioral2/files/0x0007000000023403-91.dat	upx
behavioral2/files/0x0007000000023402-79.dat	upx
behavioral2/files/0x0007000000023401-78.dat	upx
behavioral2/memory/4544-75-0x00007FF6A8A50000-0x00007FF6A8DA4000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-72.dat	upx
behavioral2/files/0x0007000000023400-68.dat	upx
behavioral2/files/0x00070000000233ff-65.dat	upx
behavioral2/memory/2808-62-0x00007FF7D6A70000-0x00007FF7D6DC4000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-54.dat	upx
behavioral2/memory/1440-50-0x00007FF7D92F0000-0x00007FF7D9644000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-46.dat	upx
behavioral2/memory/928-37-0x00007FF6CD6D0000-0x00007FF6CDA24000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lgPHGzt.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\HqFtTEM.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\FmONdha.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\orzmEUJ.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\eODtJYo.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\mdPQHix.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\CPzYOkZ.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\sTblZtz.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\uZhMXdf.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\VxUxxrL.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\qmdXMXh.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\QhOtuCZ.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\ZlvauBI.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\dDGeJpp.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\szVtiBO.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\AwSagns.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\HVCualM.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\ZhgLUzK.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\mQbdXwR.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\LCWhgZo.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\BxDpsZn.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\hyRnkzZ.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\dtqQBbt.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\wRpoYgF.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\ElwBYRI.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\jIIedfM.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\LDTAIGi.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\QzaRZCQ.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\riPVXEf.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\iDpxiUi.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\YYiidyk.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\XVIMaTy.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\MsZFslZ.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\RFRppow.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\AebpBLt.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\jzbGmCV.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\uybiyVS.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\PQYGHRl.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\bwijCJb.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\NjHUnrp.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\FVEwKZD.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\sxWwlSg.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\mMoLKJO.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\qATeEIX.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\rTBoqAq.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\YINVMff.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\raTPMjD.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\KCWdxNv.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\pMNUAAN.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\coCRmwj.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\xAtLUIZ.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\GjvUkzM.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\Lcjfkeu.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\IDoaKgo.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\WiVZGFX.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\TJFNLNi.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\HEVwvRk.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\fnJOMtu.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\EqRNogL.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\YiQHnFM.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\sjZUFvM.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\IAnwNqv.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\llSoBdx.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe
File created	C:\Windows\System\ailMxKJ.exe	053323e37502c56a7973ca542f014e80_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 4808	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	82
PID 3192 wrote to memory of 4808	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	82
PID 3192 wrote to memory of 1648	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	84
PID 3192 wrote to memory of 1648	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	84
PID 3192 wrote to memory of 1824	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	85
PID 3192 wrote to memory of 1824	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	85
PID 3192 wrote to memory of 928	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	86
PID 3192 wrote to memory of 928	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	86
PID 3192 wrote to memory of 4344	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	87
PID 3192 wrote to memory of 4344	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	87
PID 3192 wrote to memory of 1440	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	88
PID 3192 wrote to memory of 1440	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	88
PID 3192 wrote to memory of 2808	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	89
PID 3192 wrote to memory of 2808	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	89
PID 3192 wrote to memory of 4544	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	90
PID 3192 wrote to memory of 4544	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	90
PID 3192 wrote to memory of 3632	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	91
PID 3192 wrote to memory of 3632	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	91
PID 3192 wrote to memory of 4312	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	92
PID 3192 wrote to memory of 4312	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	92
PID 3192 wrote to memory of 1404	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	93
PID 3192 wrote to memory of 1404	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	93
PID 3192 wrote to memory of 2488	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	94
PID 3192 wrote to memory of 2488	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	94
PID 3192 wrote to memory of 3276	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	95
PID 3192 wrote to memory of 3276	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	95
PID 3192 wrote to memory of 4640	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	96
PID 3192 wrote to memory of 4640	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	96
PID 3192 wrote to memory of 3220	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	97
PID 3192 wrote to memory of 3220	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	97
PID 3192 wrote to memory of 1384	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	98
PID 3192 wrote to memory of 1384	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	98
PID 3192 wrote to memory of 916	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	99
PID 3192 wrote to memory of 916	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	99
PID 3192 wrote to memory of 3176	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	100
PID 3192 wrote to memory of 3176	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	100
PID 3192 wrote to memory of 4424	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	101
PID 3192 wrote to memory of 4424	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	101
PID 3192 wrote to memory of 4224	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	102
PID 3192 wrote to memory of 4224	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	102
PID 3192 wrote to memory of 4364	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	103
PID 3192 wrote to memory of 4364	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	103
PID 3192 wrote to memory of 1644	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	104
PID 3192 wrote to memory of 1644	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	104
PID 3192 wrote to memory of 620	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	105
PID 3192 wrote to memory of 620	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	105
PID 3192 wrote to memory of 3616	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	106
PID 3192 wrote to memory of 3616	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	106
PID 3192 wrote to memory of 540	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	107
PID 3192 wrote to memory of 540	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	107
PID 3192 wrote to memory of 3136	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	108
PID 3192 wrote to memory of 3136	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	108
PID 3192 wrote to memory of 4516	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	109
PID 3192 wrote to memory of 4516	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	109
PID 3192 wrote to memory of 1624	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	110
PID 3192 wrote to memory of 1624	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	110
PID 3192 wrote to memory of 4592	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	111
PID 3192 wrote to memory of 4592	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	111
PID 3192 wrote to memory of 2916	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	112
PID 3192 wrote to memory of 2916	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	112
PID 3192 wrote to memory of 4800	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	113
PID 3192 wrote to memory of 4800	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	113
PID 3192 wrote to memory of 1520	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	114
PID 3192 wrote to memory of 1520	3192	053323e37502c56a7973ca542f014e80_NEIKI.exe	114

C:\Users\Admin\AppData\Local\Temp\053323e37502c56a7973ca542f014e80_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\053323e37502c56a7973ca542f014e80_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\System\DMacctM.exe
  C:\Windows\System\DMacctM.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\pMNUAAN.exe
  C:\Windows\System\pMNUAAN.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\EgQBCQU.exe
  C:\Windows\System\EgQBCQU.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\pGvEtoG.exe
  C:\Windows\System\pGvEtoG.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\aJDWGoN.exe
  C:\Windows\System\aJDWGoN.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\UUWGubS.exe
  C:\Windows\System\UUWGubS.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\DOwbLRg.exe
  C:\Windows\System\DOwbLRg.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\vElksek.exe
  C:\Windows\System\vElksek.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\AGpmiMJ.exe
  C:\Windows\System\AGpmiMJ.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\fkqKcwe.exe
  C:\Windows\System\fkqKcwe.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\GbdFuGz.exe
  C:\Windows\System\GbdFuGz.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\levjhHK.exe
  C:\Windows\System\levjhHK.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\nShXFwp.exe
  C:\Windows\System\nShXFwp.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\rCGpYoi.exe
  C:\Windows\System\rCGpYoi.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\QUyoHfE.exe
  C:\Windows\System\QUyoHfE.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\MhVwFSQ.exe
  C:\Windows\System\MhVwFSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\Kozvogl.exe
  C:\Windows\System\Kozvogl.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\fEktkPM.exe
  C:\Windows\System\fEktkPM.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\wBwuQLC.exe
  C:\Windows\System\wBwuQLC.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\IvtqDZs.exe
  C:\Windows\System\IvtqDZs.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\IGvJrRX.exe
  C:\Windows\System\IGvJrRX.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\mdGUuKB.exe
  C:\Windows\System\mdGUuKB.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ZFvCETM.exe
  C:\Windows\System\ZFvCETM.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\cFivDSg.exe
  C:\Windows\System\cFivDSg.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\TDvVJJP.exe
  C:\Windows\System\TDvVJJP.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\INBbwcZ.exe
  C:\Windows\System\INBbwcZ.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\mMbWtXR.exe
  C:\Windows\System\mMbWtXR.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\XKrXgpG.exe
  C:\Windows\System\XKrXgpG.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\CdclXah.exe
  C:\Windows\System\CdclXah.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\MfsfzKK.exe
  C:\Windows\System\MfsfzKK.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\FxHEuaR.exe
  C:\Windows\System\FxHEuaR.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\lftTkYs.exe
  C:\Windows\System\lftTkYs.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\HVCualM.exe
  C:\Windows\System\HVCualM.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\sOdaUeW.exe
  C:\Windows\System\sOdaUeW.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\GTcDxFe.exe
  C:\Windows\System\GTcDxFe.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\mBodPkH.exe
  C:\Windows\System\mBodPkH.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\DhEiSpd.exe
  C:\Windows\System\DhEiSpd.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\biWYNSE.exe
  C:\Windows\System\biWYNSE.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\usfUdqs.exe
  C:\Windows\System\usfUdqs.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\NJamjyT.exe
  C:\Windows\System\NJamjyT.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\DvLGoTV.exe
  C:\Windows\System\DvLGoTV.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\tIdFGKK.exe
  C:\Windows\System\tIdFGKK.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\yEZKXGo.exe
  C:\Windows\System\yEZKXGo.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\VlPFGCm.exe
  C:\Windows\System\VlPFGCm.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\xBZAaxU.exe
  C:\Windows\System\xBZAaxU.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\KKXXDDz.exe
  C:\Windows\System\KKXXDDz.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\FBdZQky.exe
  C:\Windows\System\FBdZQky.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\aSbyHqE.exe
  C:\Windows\System\aSbyHqE.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\MkchwDU.exe
  C:\Windows\System\MkchwDU.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\ElwBYRI.exe
  C:\Windows\System\ElwBYRI.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\xHcYgFv.exe
  C:\Windows\System\xHcYgFv.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\UJrIpRx.exe
  C:\Windows\System\UJrIpRx.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\vmmKefm.exe
  C:\Windows\System\vmmKefm.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\bmOPFTv.exe
  C:\Windows\System\bmOPFTv.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\mcadyZA.exe
  C:\Windows\System\mcadyZA.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\pdmgjhR.exe
  C:\Windows\System\pdmgjhR.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\jIIedfM.exe
  C:\Windows\System\jIIedfM.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\wFDFCOX.exe
  C:\Windows\System\wFDFCOX.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\lUhShXY.exe
  C:\Windows\System\lUhShXY.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\TsFxvjY.exe
  C:\Windows\System\TsFxvjY.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\LDTAIGi.exe
  C:\Windows\System\LDTAIGi.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\dkKNiCn.exe
  C:\Windows\System\dkKNiCn.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\LZuqmem.exe
  C:\Windows\System\LZuqmem.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\usxlmFu.exe
  C:\Windows\System\usxlmFu.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\jFUZHMT.exe
  C:\Windows\System\jFUZHMT.exe
  2⤵
  PID:2104
- C:\Windows\System\hrxpVxK.exe
  C:\Windows\System\hrxpVxK.exe
  2⤵
  PID:2688
- C:\Windows\System\GgvzCjh.exe
  C:\Windows\System\GgvzCjh.exe
  2⤵
  PID:1704
- C:\Windows\System\cBuMonS.exe
  C:\Windows\System\cBuMonS.exe
  2⤵
  PID:3840
- C:\Windows\System\lOjMvtX.exe
  C:\Windows\System\lOjMvtX.exe
  2⤵
  PID:3752
- C:\Windows\System\YPrhbXK.exe
  C:\Windows\System\YPrhbXK.exe
  2⤵
  PID:2220
- C:\Windows\System\coCRmwj.exe
  C:\Windows\System\coCRmwj.exe
  2⤵
  PID:1996
- C:\Windows\System\AbYsLgm.exe
  C:\Windows\System\AbYsLgm.exe
  2⤵
  PID:2420
- C:\Windows\System\FtzhaCM.exe
  C:\Windows\System\FtzhaCM.exe
  2⤵
  PID:4524
- C:\Windows\System\kNKIjUO.exe
  C:\Windows\System\kNKIjUO.exe
  2⤵
  PID:412
- C:\Windows\System\FqjIJxG.exe
  C:\Windows\System\FqjIJxG.exe
  2⤵
  PID:3640
- C:\Windows\System\Fxqriad.exe
  C:\Windows\System\Fxqriad.exe
  2⤵
  PID:3652
- C:\Windows\System\CGIXbxh.exe
  C:\Windows\System\CGIXbxh.exe
  2⤵
  PID:4408
- C:\Windows\System\fdqFSqV.exe
  C:\Windows\System\fdqFSqV.exe
  2⤵
  PID:4628
- C:\Windows\System\wPmaFKu.exe
  C:\Windows\System\wPmaFKu.exe
  2⤵
  PID:1268
- C:\Windows\System\UitEsKn.exe
  C:\Windows\System\UitEsKn.exe
  2⤵
  PID:4328
- C:\Windows\System\lgPHGzt.exe
  C:\Windows\System\lgPHGzt.exe
  2⤵
  PID:1616
- C:\Windows\System\HqFtTEM.exe
  C:\Windows\System\HqFtTEM.exe
  2⤵
  PID:1504
- C:\Windows\System\EqRNogL.exe
  C:\Windows\System\EqRNogL.exe
  2⤵
  PID:5024
- C:\Windows\System\XDEicSu.exe
  C:\Windows\System\XDEicSu.exe
  2⤵
  PID:3944
- C:\Windows\System\uiaqdND.exe
  C:\Windows\System\uiaqdND.exe
  2⤵
  PID:4908
- C:\Windows\System\zDYysKV.exe
  C:\Windows\System\zDYysKV.exe
  2⤵
  PID:1944
- C:\Windows\System\NjHUnrp.exe
  C:\Windows\System\NjHUnrp.exe
  2⤵
  PID:884
- C:\Windows\System\xAtLUIZ.exe
  C:\Windows\System\xAtLUIZ.exe
  2⤵
  PID:2092
- C:\Windows\System\OrpkSDX.exe
  C:\Windows\System\OrpkSDX.exe
  2⤵
  PID:3580
- C:\Windows\System\eDOMTux.exe
  C:\Windows\System\eDOMTux.exe
  2⤵
  PID:3992
- C:\Windows\System\bgLNvQs.exe
  C:\Windows\System\bgLNvQs.exe
  2⤵
  PID:1332
- C:\Windows\System\ttFOatL.exe
  C:\Windows\System\ttFOatL.exe
  2⤵
  PID:2692
- C:\Windows\System\JunAALT.exe
  C:\Windows\System\JunAALT.exe
  2⤵
  PID:5096
- C:\Windows\System\yLjjDJC.exe
  C:\Windows\System\yLjjDJC.exe
  2⤵
  PID:3096
- C:\Windows\System\qnxdYlL.exe
  C:\Windows\System\qnxdYlL.exe
  2⤵
  PID:4400
- C:\Windows\System\oTwtBUI.exe
  C:\Windows\System\oTwtBUI.exe
  2⤵
  PID:3004
- C:\Windows\System\kDSOnyO.exe
  C:\Windows\System\kDSOnyO.exe
  2⤵
  PID:4644
- C:\Windows\System\RmcfPuj.exe
  C:\Windows\System\RmcfPuj.exe
  2⤵
  PID:2076
- C:\Windows\System\qIahoze.exe
  C:\Windows\System\qIahoze.exe
  2⤵
  PID:5004
- C:\Windows\System\rUZodUF.exe
  C:\Windows\System\rUZodUF.exe
  2⤵
  PID:5008
- C:\Windows\System\qmdXMXh.exe
  C:\Windows\System\qmdXMXh.exe
  2⤵
  PID:2288
- C:\Windows\System\gdtLBDn.exe
  C:\Windows\System\gdtLBDn.exe
  2⤵
  PID:668
- C:\Windows\System\mysPYkd.exe
  C:\Windows\System\mysPYkd.exe
  2⤵
  PID:3332
- C:\Windows\System\IVjjBbl.exe
  C:\Windows\System\IVjjBbl.exe
  2⤵
  PID:1108
- C:\Windows\System\oCRWJRx.exe
  C:\Windows\System\oCRWJRx.exe
  2⤵
  PID:2592
- C:\Windows\System\blWZWqU.exe
  C:\Windows\System\blWZWqU.exe
  2⤵
  PID:5148
- C:\Windows\System\uzMcTSl.exe
  C:\Windows\System\uzMcTSl.exe
  2⤵
  PID:5180
- C:\Windows\System\saemzRi.exe
  C:\Windows\System\saemzRi.exe
  2⤵
  PID:5212
- C:\Windows\System\ifSYLkf.exe
  C:\Windows\System\ifSYLkf.exe
  2⤵
  PID:5248
- C:\Windows\System\lQDVSUe.exe
  C:\Windows\System\lQDVSUe.exe
  2⤵
  PID:5268
- C:\Windows\System\KtLekCL.exe
  C:\Windows\System\KtLekCL.exe
  2⤵
  PID:5300
- C:\Windows\System\ibsNPvU.exe
  C:\Windows\System\ibsNPvU.exe
  2⤵
  PID:5332
- C:\Windows\System\PlxIFsj.exe
  C:\Windows\System\PlxIFsj.exe
  2⤵
  PID:5352
- C:\Windows\System\OhHJilP.exe
  C:\Windows\System\OhHJilP.exe
  2⤵
  PID:5388
- C:\Windows\System\caAPsFU.exe
  C:\Windows\System\caAPsFU.exe
  2⤵
  PID:5412
- C:\Windows\System\kyYspzh.exe
  C:\Windows\System\kyYspzh.exe
  2⤵
  PID:5444
- C:\Windows\System\laGtSIv.exe
  C:\Windows\System\laGtSIv.exe
  2⤵
  PID:5460
- C:\Windows\System\OYKwFph.exe
  C:\Windows\System\OYKwFph.exe
  2⤵
  PID:5488
- C:\Windows\System\dGyMFtd.exe
  C:\Windows\System\dGyMFtd.exe
  2⤵
  PID:5520
- C:\Windows\System\YKAoDSO.exe
  C:\Windows\System\YKAoDSO.exe
  2⤵
  PID:5548
- C:\Windows\System\RXRmGNF.exe
  C:\Windows\System\RXRmGNF.exe
  2⤵
  PID:5576
- C:\Windows\System\LfBRNUk.exe
  C:\Windows\System\LfBRNUk.exe
  2⤵
  PID:5600
- C:\Windows\System\WoxQclw.exe
  C:\Windows\System\WoxQclw.exe
  2⤵
  PID:5636
- C:\Windows\System\FSfqtzR.exe
  C:\Windows\System\FSfqtzR.exe
  2⤵
  PID:5660
- C:\Windows\System\YiQHnFM.exe
  C:\Windows\System\YiQHnFM.exe
  2⤵
  PID:5692
- C:\Windows\System\CvYiyho.exe
  C:\Windows\System\CvYiyho.exe
  2⤵
  PID:5716
- C:\Windows\System\KoBOGTv.exe
  C:\Windows\System\KoBOGTv.exe
  2⤵
  PID:5752
- C:\Windows\System\Jcemkdc.exe
  C:\Windows\System\Jcemkdc.exe
  2⤵
  PID:5784
- C:\Windows\System\KrBEhPo.exe
  C:\Windows\System\KrBEhPo.exe
  2⤵
  PID:5804
- C:\Windows\System\xxefTjV.exe
  C:\Windows\System\xxefTjV.exe
  2⤵
  PID:5824
- C:\Windows\System\FWIdInF.exe
  C:\Windows\System\FWIdInF.exe
  2⤵
  PID:5860
- C:\Windows\System\KqATYVz.exe
  C:\Windows\System\KqATYVz.exe
  2⤵
  PID:5880
- C:\Windows\System\dgkwxrg.exe
  C:\Windows\System\dgkwxrg.exe
  2⤵
  PID:5908
- C:\Windows\System\lDHPVKH.exe
  C:\Windows\System\lDHPVKH.exe
  2⤵
  PID:5936
- C:\Windows\System\jQbuUzo.exe
  C:\Windows\System\jQbuUzo.exe
  2⤵
  PID:5964
- C:\Windows\System\FNgFjDw.exe
  C:\Windows\System\FNgFjDw.exe
  2⤵
  PID:5992
- C:\Windows\System\IGVOvjR.exe
  C:\Windows\System\IGVOvjR.exe
  2⤵
  PID:6020
- C:\Windows\System\KxfyIdh.exe
  C:\Windows\System\KxfyIdh.exe
  2⤵
  PID:6048
- C:\Windows\System\lJzwtmJ.exe
  C:\Windows\System\lJzwtmJ.exe
  2⤵
  PID:6084
- C:\Windows\System\LhVJrVl.exe
  C:\Windows\System\LhVJrVl.exe
  2⤵
  PID:6104
- C:\Windows\System\pDXrkuc.exe
  C:\Windows\System\pDXrkuc.exe
  2⤵
  PID:5136
- C:\Windows\System\IDuEdbB.exe
  C:\Windows\System\IDuEdbB.exe
  2⤵
  PID:5132
- C:\Windows\System\GjCzEGp.exe
  C:\Windows\System\GjCzEGp.exe
  2⤵
  PID:5228
- C:\Windows\System\ALvdhAR.exe
  C:\Windows\System\ALvdhAR.exe
  2⤵
  PID:5284
- C:\Windows\System\FmONdha.exe
  C:\Windows\System\FmONdha.exe
  2⤵
  PID:5372
- C:\Windows\System\iseucnq.exe
  C:\Windows\System\iseucnq.exe
  2⤵
  PID:5432
- C:\Windows\System\tHEYvDY.exe
  C:\Windows\System\tHEYvDY.exe
  2⤵
  PID:5504
- C:\Windows\System\QhOtuCZ.exe
  C:\Windows\System\QhOtuCZ.exe
  2⤵
  PID:5568
- C:\Windows\System\QOizpXa.exe
  C:\Windows\System\QOizpXa.exe
  2⤵
  PID:5612
- C:\Windows\System\auuaWpD.exe
  C:\Windows\System\auuaWpD.exe
  2⤵
  PID:5680
- C:\Windows\System\nIPgjGj.exe
  C:\Windows\System\nIPgjGj.exe
  2⤵
  PID:5744
- C:\Windows\System\WfqLbkl.exe
  C:\Windows\System\WfqLbkl.exe
  2⤵
  PID:5820
- C:\Windows\System\MsZFslZ.exe
  C:\Windows\System\MsZFslZ.exe
  2⤵
  PID:5876
- C:\Windows\System\xgJTQln.exe
  C:\Windows\System\xgJTQln.exe
  2⤵
  PID:5952
- C:\Windows\System\UoYWzSL.exe
  C:\Windows\System\UoYWzSL.exe
  2⤵
  PID:6004
- C:\Windows\System\mCKoEEU.exe
  C:\Windows\System\mCKoEEU.exe
  2⤵
  PID:6068
- C:\Windows\System\kKGfCdR.exe
  C:\Windows\System\kKGfCdR.exe
  2⤵
  PID:6136
- C:\Windows\System\iAZGDDL.exe
  C:\Windows\System\iAZGDDL.exe
  2⤵
  PID:5196
- C:\Windows\System\yrOkDAS.exe
  C:\Windows\System\yrOkDAS.exe
  2⤵
  PID:5296
- C:\Windows\System\kfVQsVY.exe
  C:\Windows\System\kfVQsVY.exe
  2⤵
  PID:5480
- C:\Windows\System\oOwEHyF.exe
  C:\Windows\System\oOwEHyF.exe
  2⤵
  PID:5644
- C:\Windows\System\PCMZMkW.exe
  C:\Windows\System\PCMZMkW.exe
  2⤵
  PID:5724
- C:\Windows\System\PoIDFWp.exe
  C:\Windows\System\PoIDFWp.exe
  2⤵
  PID:5928
- C:\Windows\System\GxJSiMA.exe
  C:\Windows\System\GxJSiMA.exe
  2⤵
  PID:6100
- C:\Windows\System\JHuVLiA.exe
  C:\Windows\System\JHuVLiA.exe
  2⤵
  PID:5368
- C:\Windows\System\LyCURhq.exe
  C:\Windows\System\LyCURhq.exe
  2⤵
  PID:5736
- C:\Windows\System\VIBVXDS.exe
  C:\Windows\System\VIBVXDS.exe
  2⤵
  PID:2800
- C:\Windows\System\jWCgNpW.exe
  C:\Windows\System\jWCgNpW.exe
  2⤵
  PID:6176
- C:\Windows\System\qFCphqC.exe
  C:\Windows\System\qFCphqC.exe
  2⤵
  PID:6208
- C:\Windows\System\VqIGBZA.exe
  C:\Windows\System\VqIGBZA.exe
  2⤵
  PID:6224
- C:\Windows\System\iCsCVAV.exe
  C:\Windows\System\iCsCVAV.exe
  2⤵
  PID:6244
- C:\Windows\System\hRcRorS.exe
  C:\Windows\System\hRcRorS.exe
  2⤵
  PID:6284
- C:\Windows\System\EVscKtO.exe
  C:\Windows\System\EVscKtO.exe
  2⤵
  PID:6308
- C:\Windows\System\JBClNVX.exe
  C:\Windows\System\JBClNVX.exe
  2⤵
  PID:6336
- C:\Windows\System\BqUqILs.exe
  C:\Windows\System\BqUqILs.exe
  2⤵
  PID:6368
- C:\Windows\System\OvCIRFI.exe
  C:\Windows\System\OvCIRFI.exe
  2⤵
  PID:6400
- C:\Windows\System\VDBhSEu.exe
  C:\Windows\System\VDBhSEu.exe
  2⤵
  PID:6428
- C:\Windows\System\spXnNTh.exe
  C:\Windows\System\spXnNTh.exe
  2⤵
  PID:6452
- C:\Windows\System\HoBaKyI.exe
  C:\Windows\System\HoBaKyI.exe
  2⤵
  PID:6476
- C:\Windows\System\yMvPMVD.exe
  C:\Windows\System\yMvPMVD.exe
  2⤵
  PID:6512
- C:\Windows\System\TWDJTKk.exe
  C:\Windows\System\TWDJTKk.exe
  2⤵
  PID:6548
- C:\Windows\System\yEZotCl.exe
  C:\Windows\System\yEZotCl.exe
  2⤵
  PID:6568
- C:\Windows\System\mttiJwk.exe
  C:\Windows\System\mttiJwk.exe
  2⤵
  PID:6604
- C:\Windows\System\XyDMNpZ.exe
  C:\Windows\System\XyDMNpZ.exe
  2⤵
  PID:6640
- C:\Windows\System\mbxwvPj.exe
  C:\Windows\System\mbxwvPj.exe
  2⤵
  PID:6664
- C:\Windows\System\tsERLAU.exe
  C:\Windows\System\tsERLAU.exe
  2⤵
  PID:6692
- C:\Windows\System\fMzutQs.exe
  C:\Windows\System\fMzutQs.exe
  2⤵
  PID:6712
- C:\Windows\System\AFIdLmf.exe
  C:\Windows\System\AFIdLmf.exe
  2⤵
  PID:6732
- C:\Windows\System\OICzpex.exe
  C:\Windows\System\OICzpex.exe
  2⤵
  PID:6748
- C:\Windows\System\djuCOjZ.exe
  C:\Windows\System\djuCOjZ.exe
  2⤵
  PID:6768
- C:\Windows\System\esodGYU.exe
  C:\Windows\System\esodGYU.exe
  2⤵
  PID:6784
- C:\Windows\System\JLnXEzx.exe
  C:\Windows\System\JLnXEzx.exe
  2⤵
  PID:6808
- C:\Windows\System\HcxiAtJ.exe
  C:\Windows\System\HcxiAtJ.exe
  2⤵
  PID:6824
- C:\Windows\System\Zbgdrfg.exe
  C:\Windows\System\Zbgdrfg.exe
  2⤵
  PID:6852
- C:\Windows\System\ANdLspL.exe
  C:\Windows\System\ANdLspL.exe
  2⤵
  PID:6880
- C:\Windows\System\yEWkEvN.exe
  C:\Windows\System\yEWkEvN.exe
  2⤵
  PID:6916
- C:\Windows\System\UszTmzI.exe
  C:\Windows\System\UszTmzI.exe
  2⤵
  PID:6956
- C:\Windows\System\RMarsSh.exe
  C:\Windows\System\RMarsSh.exe
  2⤵
  PID:6980
- C:\Windows\System\tCOxHtm.exe
  C:\Windows\System\tCOxHtm.exe
  2⤵
  PID:7020
- C:\Windows\System\mTlnacM.exe
  C:\Windows\System\mTlnacM.exe
  2⤵
  PID:7048
- C:\Windows\System\VIGWDIL.exe
  C:\Windows\System\VIGWDIL.exe
  2⤵
  PID:7088
- C:\Windows\System\HutkgEe.exe
  C:\Windows\System\HutkgEe.exe
  2⤵
  PID:7116
- C:\Windows\System\doPlwYG.exe
  C:\Windows\System\doPlwYG.exe
  2⤵
  PID:7148
- C:\Windows\System\STuaQvO.exe
  C:\Windows\System\STuaQvO.exe
  2⤵
  PID:7164
- C:\Windows\System\lLsoOCu.exe
  C:\Windows\System\lLsoOCu.exe
  2⤵
  PID:5924
- C:\Windows\System\QaElUEu.exe
  C:\Windows\System\QaElUEu.exe
  2⤵
  PID:6220
- C:\Windows\System\HtcCiJg.exe
  C:\Windows\System\HtcCiJg.exe
  2⤵
  PID:6296
- C:\Windows\System\UrOKgva.exe
  C:\Windows\System\UrOKgva.exe
  2⤵
  PID:6376
- C:\Windows\System\LBQNrjQ.exe
  C:\Windows\System\LBQNrjQ.exe
  2⤵
  PID:6444
- C:\Windows\System\SWhfXAw.exe
  C:\Windows\System\SWhfXAw.exe
  2⤵
  PID:6536
- C:\Windows\System\GjvUkzM.exe
  C:\Windows\System\GjvUkzM.exe
  2⤵
  PID:6612
- C:\Windows\System\Lcjfkeu.exe
  C:\Windows\System\Lcjfkeu.exe
  2⤵
  PID:6688
- C:\Windows\System\CmUxviI.exe
  C:\Windows\System\CmUxviI.exe
  2⤵
  PID:6780
- C:\Windows\System\orzmEUJ.exe
  C:\Windows\System\orzmEUJ.exe
  2⤵
  PID:6840
- C:\Windows\System\juZTndy.exe
  C:\Windows\System\juZTndy.exe
  2⤵
  PID:6872
- C:\Windows\System\rtjQNlI.exe
  C:\Windows\System\rtjQNlI.exe
  2⤵
  PID:6904
- C:\Windows\System\sjZUFvM.exe
  C:\Windows\System\sjZUFvM.exe
  2⤵
  PID:6972
- C:\Windows\System\IikRnNV.exe
  C:\Windows\System\IikRnNV.exe
  2⤵
  PID:7064
- C:\Windows\System\JveWpCU.exe
  C:\Windows\System\JveWpCU.exe
  2⤵
  PID:7108
- C:\Windows\System\cQnNOzb.exe
  C:\Windows\System\cQnNOzb.exe
  2⤵
  PID:6156
- C:\Windows\System\EiXLzVV.exe
  C:\Windows\System\EiXLzVV.exe
  2⤵
  PID:6264
- C:\Windows\System\AwvrChK.exe
  C:\Windows\System\AwvrChK.exe
  2⤵
  PID:6504
- C:\Windows\System\DkeyprS.exe
  C:\Windows\System\DkeyprS.exe
  2⤵
  PID:6556
- C:\Windows\System\TuzcUQb.exe
  C:\Windows\System\TuzcUQb.exe
  2⤵
  PID:6804
- C:\Windows\System\GPOVwat.exe
  C:\Windows\System\GPOVwat.exe
  2⤵
  PID:7044
- C:\Windows\System\RWNEIDc.exe
  C:\Windows\System\RWNEIDc.exe
  2⤵
  PID:7132
- C:\Windows\System\YsAywvE.exe
  C:\Windows\System\YsAywvE.exe
  2⤵
  PID:6320
- C:\Windows\System\CIMnoIF.exe
  C:\Windows\System\CIMnoIF.exe
  2⤵
  PID:6656
- C:\Windows\System\gQFLpne.exe
  C:\Windows\System\gQFLpne.exe
  2⤵
  PID:7008
- C:\Windows\System\IAnwNqv.exe
  C:\Windows\System\IAnwNqv.exe
  2⤵
  PID:6560
- C:\Windows\System\VpAKGJZ.exe
  C:\Windows\System\VpAKGJZ.exe
  2⤵
  PID:7176
- C:\Windows\System\aKaWjpW.exe
  C:\Windows\System\aKaWjpW.exe
  2⤵
  PID:7212
- C:\Windows\System\CLfOGjU.exe
  C:\Windows\System\CLfOGjU.exe
  2⤵
  PID:7236
- C:\Windows\System\COPztxg.exe
  C:\Windows\System\COPztxg.exe
  2⤵
  PID:7260
- C:\Windows\System\CwlxULo.exe
  C:\Windows\System\CwlxULo.exe
  2⤵
  PID:7296
- C:\Windows\System\MidzeRk.exe
  C:\Windows\System\MidzeRk.exe
  2⤵
  PID:7332
- C:\Windows\System\BjrxvDL.exe
  C:\Windows\System\BjrxvDL.exe
  2⤵
  PID:7348
- C:\Windows\System\QiIYvCs.exe
  C:\Windows\System\QiIYvCs.exe
  2⤵
  PID:7368
- C:\Windows\System\ahsJFDC.exe
  C:\Windows\System\ahsJFDC.exe
  2⤵
  PID:7388
- C:\Windows\System\PPRPCuL.exe
  C:\Windows\System\PPRPCuL.exe
  2⤵
  PID:7420
- C:\Windows\System\gExZGQm.exe
  C:\Windows\System\gExZGQm.exe
  2⤵
  PID:7456
- C:\Windows\System\CsoMHSy.exe
  C:\Windows\System\CsoMHSy.exe
  2⤵
  PID:7492
- C:\Windows\System\hzrqZdj.exe
  C:\Windows\System\hzrqZdj.exe
  2⤵
  PID:7524
- C:\Windows\System\vpCsULm.exe
  C:\Windows\System\vpCsULm.exe
  2⤵
  PID:7548
- C:\Windows\System\xSRpWzP.exe
  C:\Windows\System\xSRpWzP.exe
  2⤵
  PID:7588
- C:\Windows\System\xyfTBji.exe
  C:\Windows\System\xyfTBji.exe
  2⤵
  PID:7616
- C:\Windows\System\JazixLc.exe
  C:\Windows\System\JazixLc.exe
  2⤵
  PID:7632
- C:\Windows\System\uKHdWpA.exe
  C:\Windows\System\uKHdWpA.exe
  2⤵
  PID:7664
- C:\Windows\System\NNghpJX.exe
  C:\Windows\System\NNghpJX.exe
  2⤵
  PID:7692
- C:\Windows\System\kNETrhv.exe
  C:\Windows\System\kNETrhv.exe
  2⤵
  PID:7728
- C:\Windows\System\cTldsYj.exe
  C:\Windows\System\cTldsYj.exe
  2⤵
  PID:7756
- C:\Windows\System\NLUjxRm.exe
  C:\Windows\System\NLUjxRm.exe
  2⤵
  PID:7784
- C:\Windows\System\veevdhB.exe
  C:\Windows\System\veevdhB.exe
  2⤵
  PID:7808
- C:\Windows\System\eODtJYo.exe
  C:\Windows\System\eODtJYo.exe
  2⤵
  PID:7832
- C:\Windows\System\ZnpWbRP.exe
  C:\Windows\System\ZnpWbRP.exe
  2⤵
  PID:7872
- C:\Windows\System\kmSByfe.exe
  C:\Windows\System\kmSByfe.exe
  2⤵
  PID:7904
- C:\Windows\System\GdUvXDY.exe
  C:\Windows\System\GdUvXDY.exe
  2⤵
  PID:7932
- C:\Windows\System\FogguBu.exe
  C:\Windows\System\FogguBu.exe
  2⤵
  PID:7952
- C:\Windows\System\Hzjnewl.exe
  C:\Windows\System\Hzjnewl.exe
  2⤵
  PID:7976
- C:\Windows\System\krOEcwE.exe
  C:\Windows\System\krOEcwE.exe
  2⤵
  PID:8016
- C:\Windows\System\fdyMBxU.exe
  C:\Windows\System\fdyMBxU.exe
  2⤵
  PID:8036
- C:\Windows\System\IDoaKgo.exe
  C:\Windows\System\IDoaKgo.exe
  2⤵
  PID:8072
- C:\Windows\System\dNljGrB.exe
  C:\Windows\System\dNljGrB.exe
  2⤵
  PID:8092
- C:\Windows\System\PRghnrw.exe
  C:\Windows\System\PRghnrw.exe
  2⤵
  PID:8120
- C:\Windows\System\tluZApR.exe
  C:\Windows\System\tluZApR.exe
  2⤵
  PID:8144
- C:\Windows\System\xegYxJQ.exe
  C:\Windows\System\xegYxJQ.exe
  2⤵
  PID:8168
- C:\Windows\System\lSJqNwj.exe
  C:\Windows\System\lSJqNwj.exe
  2⤵
  PID:7228
- C:\Windows\System\YTLBNYJ.exe
  C:\Windows\System\YTLBNYJ.exe
  2⤵
  PID:7276
- C:\Windows\System\IOCxirT.exe
  C:\Windows\System\IOCxirT.exe
  2⤵
  PID:7328
- C:\Windows\System\BOihHok.exe
  C:\Windows\System\BOihHok.exe
  2⤵
  PID:7376
- C:\Windows\System\dtqQBbt.exe
  C:\Windows\System\dtqQBbt.exe
  2⤵
  PID:7448
- C:\Windows\System\dzZUOAS.exe
  C:\Windows\System\dzZUOAS.exe
  2⤵
  PID:7520
- C:\Windows\System\jjZYupP.exe
  C:\Windows\System\jjZYupP.exe
  2⤵
  PID:7568
- C:\Windows\System\rThOEGI.exe
  C:\Windows\System\rThOEGI.exe
  2⤵
  PID:7628
- C:\Windows\System\eDktzpq.exe
  C:\Windows\System\eDktzpq.exe
  2⤵
  PID:7680
- C:\Windows\System\FVEwKZD.exe
  C:\Windows\System\FVEwKZD.exe
  2⤵
  PID:7800
- C:\Windows\System\NpLIkrp.exe
  C:\Windows\System\NpLIkrp.exe
  2⤵
  PID:7864
- C:\Windows\System\olPPTbY.exe
  C:\Windows\System\olPPTbY.exe
  2⤵
  PID:7928
- C:\Windows\System\ttzkvgu.exe
  C:\Windows\System\ttzkvgu.exe
  2⤵
  PID:8032
- C:\Windows\System\AeylYRW.exe
  C:\Windows\System\AeylYRW.exe
  2⤵
  PID:8080
- C:\Windows\System\ygMLTxU.exe
  C:\Windows\System\ygMLTxU.exe
  2⤵
  PID:8152
- C:\Windows\System\GTFtcTK.exe
  C:\Windows\System\GTFtcTK.exe
  2⤵
  PID:6564
- C:\Windows\System\qTxMaLw.exe
  C:\Windows\System\qTxMaLw.exe
  2⤵
  PID:7480
- C:\Windows\System\McuYhaG.exe
  C:\Windows\System\McuYhaG.exe
  2⤵
  PID:7572
- C:\Windows\System\HGVnCWR.exe
  C:\Windows\System\HGVnCWR.exe
  2⤵
  PID:7780
- C:\Windows\System\oJTrTOl.exe
  C:\Windows\System\oJTrTOl.exe
  2⤵
  PID:7896
- C:\Windows\System\LzynASH.exe
  C:\Windows\System\LzynASH.exe
  2⤵
  PID:7996
- C:\Windows\System\vhiQHxV.exe
  C:\Windows\System\vhiQHxV.exe
  2⤵
  PID:8100
- C:\Windows\System\eeTZFWn.exe
  C:\Windows\System\eeTZFWn.exe
  2⤵
  PID:7360
- C:\Windows\System\ndLHdji.exe
  C:\Windows\System\ndLHdji.exe
  2⤵
  PID:7752
- C:\Windows\System\tYBqaNp.exe
  C:\Windows\System\tYBqaNp.exe
  2⤵
  PID:8044
- C:\Windows\System\JdOuWPO.exe
  C:\Windows\System\JdOuWPO.exe
  2⤵
  PID:7856
- C:\Windows\System\QYFOVSD.exe
  C:\Windows\System\QYFOVSD.exe
  2⤵
  PID:4188
- C:\Windows\System\rAaiOaN.exe
  C:\Windows\System\rAaiOaN.exe
  2⤵
  PID:8208
- C:\Windows\System\QzaRZCQ.exe
  C:\Windows\System\QzaRZCQ.exe
  2⤵
  PID:8240
- C:\Windows\System\mdPQHix.exe
  C:\Windows\System\mdPQHix.exe
  2⤵
  PID:8256
- C:\Windows\System\xqWeGnj.exe
  C:\Windows\System\xqWeGnj.exe
  2⤵
  PID:8272
- C:\Windows\System\kaGEAuG.exe
  C:\Windows\System\kaGEAuG.exe
  2⤵
  PID:8304
- C:\Windows\System\Wyvgicy.exe
  C:\Windows\System\Wyvgicy.exe
  2⤵
  PID:8332
- C:\Windows\System\BBNwTqb.exe
  C:\Windows\System\BBNwTqb.exe
  2⤵
  PID:8364
- C:\Windows\System\fMbLrbw.exe
  C:\Windows\System\fMbLrbw.exe
  2⤵
  PID:8392
- C:\Windows\System\UOiGLaD.exe
  C:\Windows\System\UOiGLaD.exe
  2⤵
  PID:8428
- C:\Windows\System\GdTuOQm.exe
  C:\Windows\System\GdTuOQm.exe
  2⤵
  PID:8456
- C:\Windows\System\fvWUcXQ.exe
  C:\Windows\System\fvWUcXQ.exe
  2⤵
  PID:8496
- C:\Windows\System\yuzwPXw.exe
  C:\Windows\System\yuzwPXw.exe
  2⤵
  PID:8524
- C:\Windows\System\sXOnQrW.exe
  C:\Windows\System\sXOnQrW.exe
  2⤵
  PID:8544
- C:\Windows\System\wQKLTip.exe
  C:\Windows\System\wQKLTip.exe
  2⤵
  PID:8572
- C:\Windows\System\NXIsxkR.exe
  C:\Windows\System\NXIsxkR.exe
  2⤵
  PID:8604
- C:\Windows\System\INYaoce.exe
  C:\Windows\System\INYaoce.exe
  2⤵
  PID:8624
- C:\Windows\System\BJlgJvA.exe
  C:\Windows\System\BJlgJvA.exe
  2⤵
  PID:8656
- C:\Windows\System\DUUtlhl.exe
  C:\Windows\System\DUUtlhl.exe
  2⤵
  PID:8688
- C:\Windows\System\ZhgLUzK.exe
  C:\Windows\System\ZhgLUzK.exe
  2⤵
  PID:8708
- C:\Windows\System\KAjNLWr.exe
  C:\Windows\System\KAjNLWr.exe
  2⤵
  PID:8748
- C:\Windows\System\vOxQJoB.exe
  C:\Windows\System\vOxQJoB.exe
  2⤵
  PID:8764
- C:\Windows\System\JCNhuCM.exe
  C:\Windows\System\JCNhuCM.exe
  2⤵
  PID:8796
- C:\Windows\System\FFfDYvj.exe
  C:\Windows\System\FFfDYvj.exe
  2⤵
  PID:8820
- C:\Windows\System\FTOMbhp.exe
  C:\Windows\System\FTOMbhp.exe
  2⤵
  PID:8852
- C:\Windows\System\ZlvauBI.exe
  C:\Windows\System\ZlvauBI.exe
  2⤵
  PID:8876
- C:\Windows\System\qfGuUxj.exe
  C:\Windows\System\qfGuUxj.exe
  2⤵
  PID:8904
- C:\Windows\System\otNQGMt.exe
  C:\Windows\System\otNQGMt.exe
  2⤵
  PID:8944
- C:\Windows\System\DxXeugM.exe
  C:\Windows\System\DxXeugM.exe
  2⤵
  PID:8968
- C:\Windows\System\ZJpsLJH.exe
  C:\Windows\System\ZJpsLJH.exe
  2⤵
  PID:8984
- C:\Windows\System\FRrHXNi.exe
  C:\Windows\System\FRrHXNi.exe
  2⤵
  PID:9012
- C:\Windows\System\YYeiMVs.exe
  C:\Windows\System\YYeiMVs.exe
  2⤵
  PID:9032
- C:\Windows\System\XJKRqYi.exe
  C:\Windows\System\XJKRqYi.exe
  2⤵
  PID:9060
- C:\Windows\System\wYloszF.exe
  C:\Windows\System\wYloszF.exe
  2⤵
  PID:9092
- C:\Windows\System\fGbsBEN.exe
  C:\Windows\System\fGbsBEN.exe
  2⤵
  PID:9132
- C:\Windows\System\lGTkKfi.exe
  C:\Windows\System\lGTkKfi.exe
  2⤵
  PID:9168
- C:\Windows\System\mqROhRJ.exe
  C:\Windows\System\mqROhRJ.exe
  2⤵
  PID:9196
- C:\Windows\System\XiZIdsY.exe
  C:\Windows\System\XiZIdsY.exe
  2⤵
  PID:2000
- C:\Windows\System\VowcUye.exe
  C:\Windows\System\VowcUye.exe
  2⤵
  PID:8252
- C:\Windows\System\VoPPLGs.exe
  C:\Windows\System\VoPPLGs.exe
  2⤵
  PID:8316
- C:\Windows\System\cGQHpOT.exe
  C:\Windows\System\cGQHpOT.exe
  2⤵
  PID:3816
- C:\Windows\System\BFzMugP.exe
  C:\Windows\System\BFzMugP.exe
  2⤵
  PID:8412
- C:\Windows\System\ViOQUdP.exe
  C:\Windows\System\ViOQUdP.exe
  2⤵
  PID:8476
- C:\Windows\System\CqKftjR.exe
  C:\Windows\System\CqKftjR.exe
  2⤵
  PID:8532
- C:\Windows\System\uRBKJjr.exe
  C:\Windows\System\uRBKJjr.exe
  2⤵
  PID:8580
- C:\Windows\System\HESUXiU.exe
  C:\Windows\System\HESUXiU.exe
  2⤵
  PID:8620
- C:\Windows\System\vzyukZY.exe
  C:\Windows\System\vzyukZY.exe
  2⤵
  PID:8700
- C:\Windows\System\UgbnIcF.exe
  C:\Windows\System\UgbnIcF.exe
  2⤵
  PID:8756
- C:\Windows\System\TAGzuyq.exe
  C:\Windows\System\TAGzuyq.exe
  2⤵
  PID:8868
- C:\Windows\System\llSoBdx.exe
  C:\Windows\System\llSoBdx.exe
  2⤵
  PID:8924
- C:\Windows\System\yTAYzyI.exe
  C:\Windows\System\yTAYzyI.exe
  2⤵
  PID:8980
- C:\Windows\System\iTmfOtU.exe
  C:\Windows\System\iTmfOtU.exe
  2⤵
  PID:9000
- C:\Windows\System\ailMxKJ.exe
  C:\Windows\System\ailMxKJ.exe
  2⤵
  PID:9072
- C:\Windows\System\VPPFHzS.exe
  C:\Windows\System\VPPFHzS.exe
  2⤵
  PID:9176
- C:\Windows\System\DBhSkKY.exe
  C:\Windows\System\DBhSkKY.exe
  2⤵
  PID:8060
- C:\Windows\System\TyNZDYD.exe
  C:\Windows\System\TyNZDYD.exe
  2⤵
  PID:8356
- C:\Windows\System\nBgNXVs.exe
  C:\Windows\System\nBgNXVs.exe
  2⤵
  PID:8480
- C:\Windows\System\WrHtbvC.exe
  C:\Windows\System\WrHtbvC.exe
  2⤵
  PID:3608
- C:\Windows\System\twgSfsO.exe
  C:\Windows\System\twgSfsO.exe
  2⤵
  PID:8664
- C:\Windows\System\DTzFBzu.exe
  C:\Windows\System\DTzFBzu.exe
  2⤵
  PID:8788
- C:\Windows\System\wGbIext.exe
  C:\Windows\System\wGbIext.exe
  2⤵
  PID:9040
- C:\Windows\System\yEynJCC.exe
  C:\Windows\System\yEynJCC.exe
  2⤵
  PID:9160
- C:\Windows\System\aEXmthu.exe
  C:\Windows\System\aEXmthu.exe
  2⤵
  PID:8204
- C:\Windows\System\rLbIhap.exe
  C:\Windows\System\rLbIhap.exe
  2⤵
  PID:8552
- C:\Windows\System\bseBTqL.exe
  C:\Windows\System\bseBTqL.exe
  2⤵
  PID:8832
- C:\Windows\System\dyJbCqc.exe
  C:\Windows\System\dyJbCqc.exe
  2⤵
  PID:8296
- C:\Windows\System\lmUjoAl.exe
  C:\Windows\System\lmUjoAl.exe
  2⤵
  PID:8568
- C:\Windows\System\dQJMZtX.exe
  C:\Windows\System\dQJMZtX.exe
  2⤵
  PID:9204
- C:\Windows\System\BWhVrjH.exe
  C:\Windows\System\BWhVrjH.exe
  2⤵
  PID:9240
- C:\Windows\System\iRIOlqk.exe
  C:\Windows\System\iRIOlqk.exe
  2⤵
  PID:9280
- C:\Windows\System\KMfIqGb.exe
  C:\Windows\System\KMfIqGb.exe
  2⤵
  PID:9308
- C:\Windows\System\YhUzorD.exe
  C:\Windows\System\YhUzorD.exe
  2⤵
  PID:9324
- C:\Windows\System\RFRppow.exe
  C:\Windows\System\RFRppow.exe
  2⤵
  PID:9352
- C:\Windows\System\DvaOumH.exe
  C:\Windows\System\DvaOumH.exe
  2⤵
  PID:9380
- C:\Windows\System\bUZGjoi.exe
  C:\Windows\System\bUZGjoi.exe
  2⤵
  PID:9408
- C:\Windows\System\AebpBLt.exe
  C:\Windows\System\AebpBLt.exe
  2⤵
  PID:9436
- C:\Windows\System\RtJpYbr.exe
  C:\Windows\System\RtJpYbr.exe
  2⤵
  PID:9472
- C:\Windows\System\OyiquOe.exe
  C:\Windows\System\OyiquOe.exe
  2⤵
  PID:9500
- C:\Windows\System\riPVXEf.exe
  C:\Windows\System\riPVXEf.exe
  2⤵
  PID:9528
- C:\Windows\System\WmFWpVG.exe
  C:\Windows\System\WmFWpVG.exe
  2⤵
  PID:9552
- C:\Windows\System\uoFEsgY.exe
  C:\Windows\System\uoFEsgY.exe
  2⤵
  PID:9584
- C:\Windows\System\squnePL.exe
  C:\Windows\System\squnePL.exe
  2⤵
  PID:9616
- C:\Windows\System\mMpqJPz.exe
  C:\Windows\System\mMpqJPz.exe
  2⤵
  PID:9640
- C:\Windows\System\pUXZBrD.exe
  C:\Windows\System\pUXZBrD.exe
  2⤵
  PID:9672
- C:\Windows\System\ZVEHJfZ.exe
  C:\Windows\System\ZVEHJfZ.exe
  2⤵
  PID:9688
- C:\Windows\System\Kyzrqhn.exe
  C:\Windows\System\Kyzrqhn.exe
  2⤵
  PID:9724
- C:\Windows\System\mVRNRyO.exe
  C:\Windows\System\mVRNRyO.exe
  2⤵
  PID:9752
- C:\Windows\System\TqxymZk.exe
  C:\Windows\System\TqxymZk.exe
  2⤵
  PID:9776
- C:\Windows\System\jsIFbHH.exe
  C:\Windows\System\jsIFbHH.exe
  2⤵
  PID:9812
- C:\Windows\System\jzbGmCV.exe
  C:\Windows\System\jzbGmCV.exe
  2⤵
  PID:9836
- C:\Windows\System\VEKcNhE.exe
  C:\Windows\System\VEKcNhE.exe
  2⤵
  PID:9868
- C:\Windows\System\vDKbIDs.exe
  C:\Windows\System\vDKbIDs.exe
  2⤵
  PID:9900
- C:\Windows\System\OSQXNVB.exe
  C:\Windows\System\OSQXNVB.exe
  2⤵
  PID:9920
- C:\Windows\System\FpWcpun.exe
  C:\Windows\System\FpWcpun.exe
  2⤵
  PID:9940
- C:\Windows\System\JKrrxQj.exe
  C:\Windows\System\JKrrxQj.exe
  2⤵
  PID:9960
- C:\Windows\System\yfJvoqB.exe
  C:\Windows\System\yfJvoqB.exe
  2⤵
  PID:9980
- C:\Windows\System\OAcvdpA.exe
  C:\Windows\System\OAcvdpA.exe
  2⤵
  PID:10016
- C:\Windows\System\yqOsHBO.exe
  C:\Windows\System\yqOsHBO.exe
  2⤵
  PID:10048
- C:\Windows\System\bYszgdT.exe
  C:\Windows\System\bYszgdT.exe
  2⤵
  PID:10088
- C:\Windows\System\SjsLfNc.exe
  C:\Windows\System\SjsLfNc.exe
  2⤵
  PID:10116
- C:\Windows\System\uybiyVS.exe
  C:\Windows\System\uybiyVS.exe
  2⤵
  PID:10140
- C:\Windows\System\pRHUzQj.exe
  C:\Windows\System\pRHUzQj.exe
  2⤵
  PID:10160
- C:\Windows\System\ihsuBtJ.exe
  C:\Windows\System\ihsuBtJ.exe
  2⤵
  PID:10196
- C:\Windows\System\vPeAQfx.exe
  C:\Windows\System\vPeAQfx.exe
  2⤵
  PID:10228
- C:\Windows\System\MAoquGW.exe
  C:\Windows\System\MAoquGW.exe
  2⤵
  PID:9236
- C:\Windows\System\DIvOdIX.exe
  C:\Windows\System\DIvOdIX.exe
  2⤵
  PID:9304
- C:\Windows\System\MFOcbzH.exe
  C:\Windows\System\MFOcbzH.exe
  2⤵
  PID:9420
- C:\Windows\System\qeQiXPE.exe
  C:\Windows\System\qeQiXPE.exe
  2⤵
  PID:9480
- C:\Windows\System\HyIrZEQ.exe
  C:\Windows\System\HyIrZEQ.exe
  2⤵
  PID:9520
- C:\Windows\System\jVMoYoz.exe
  C:\Windows\System\jVMoYoz.exe
  2⤵
  PID:9568
- C:\Windows\System\IeRAnOF.exe
  C:\Windows\System\IeRAnOF.exe
  2⤵
  PID:9612
- C:\Windows\System\uMyxiLl.exe
  C:\Windows\System\uMyxiLl.exe
  2⤵
  PID:9712
- C:\Windows\System\OfDrXWR.exe
  C:\Windows\System\OfDrXWR.exe
  2⤵
  PID:9772
- C:\Windows\System\VHIbLnn.exe
  C:\Windows\System\VHIbLnn.exe
  2⤵
  PID:9828
- C:\Windows\System\EKUnTwC.exe
  C:\Windows\System\EKUnTwC.exe
  2⤵
  PID:9912
- C:\Windows\System\PgHqOTI.exe
  C:\Windows\System\PgHqOTI.exe
  2⤵
  PID:3728
- C:\Windows\System\sCWjffz.exe
  C:\Windows\System\sCWjffz.exe
  2⤵
  PID:1356
- C:\Windows\System\dDGeJpp.exe
  C:\Windows\System\dDGeJpp.exe
  2⤵
  PID:10040
- C:\Windows\System\RoqcRTy.exe
  C:\Windows\System\RoqcRTy.exe
  2⤵
  PID:10072
- C:\Windows\System\UBzuqed.exe
  C:\Windows\System\UBzuqed.exe
  2⤵
  PID:10180
- C:\Windows\System\XIZaPya.exe
  C:\Windows\System\XIZaPya.exe
  2⤵
  PID:10156
- C:\Windows\System\rcWivQb.exe
  C:\Windows\System\rcWivQb.exe
  2⤵
  PID:9260
- C:\Windows\System\dOykSZN.exe
  C:\Windows\System\dOykSZN.exe
  2⤵
  PID:9452
- C:\Windows\System\eFougmu.exe
  C:\Windows\System\eFougmu.exe
  2⤵
  PID:9648
- C:\Windows\System\cQWVDkF.exe
  C:\Windows\System\cQWVDkF.exe
  2⤵
  PID:9764
- C:\Windows\System\QyODHaO.exe
  C:\Windows\System\QyODHaO.exe
  2⤵
  PID:9932
- C:\Windows\System\jnuvfXR.exe
  C:\Windows\System\jnuvfXR.exe
  2⤵
  PID:10008
- C:\Windows\System\KegMPtN.exe
  C:\Windows\System\KegMPtN.exe
  2⤵
  PID:10216
- C:\Windows\System\PPYSsbe.exe
  C:\Windows\System\PPYSsbe.exe
  2⤵
  PID:9336
- C:\Windows\System\YBfvaKw.exe
  C:\Windows\System\YBfvaKw.exe
  2⤵
  PID:9744
- C:\Windows\System\YwFXnsz.exe
  C:\Windows\System\YwFXnsz.exe
  2⤵
  PID:9936
- C:\Windows\System\xDUHVSJ.exe
  C:\Windows\System\xDUHVSJ.exe
  2⤵
  PID:9656
- C:\Windows\System\QRbKgvJ.exe
  C:\Windows\System\QRbKgvJ.exe
  2⤵
  PID:10248
- C:\Windows\System\MsWNESB.exe
  C:\Windows\System\MsWNESB.exe
  2⤵
  PID:10264
- C:\Windows\System\btYZgmU.exe
  C:\Windows\System\btYZgmU.exe
  2⤵
  PID:10304
- C:\Windows\System\hqnRqQB.exe
  C:\Windows\System\hqnRqQB.exe
  2⤵
  PID:10320
- C:\Windows\System\PuPkEsD.exe
  C:\Windows\System\PuPkEsD.exe
  2⤵
  PID:10364
- C:\Windows\System\sxWwlSg.exe
  C:\Windows\System\sxWwlSg.exe
  2⤵
  PID:10392
- C:\Windows\System\jzuRAzM.exe
  C:\Windows\System\jzuRAzM.exe
  2⤵
  PID:10416
- C:\Windows\System\NZKGYIh.exe
  C:\Windows\System\NZKGYIh.exe
  2⤵
  PID:10444
- C:\Windows\System\faSESCH.exe
  C:\Windows\System\faSESCH.exe
  2⤵
  PID:10464
- C:\Windows\System\FsrKyiQ.exe
  C:\Windows\System\FsrKyiQ.exe
  2⤵
  PID:10500
- C:\Windows\System\rnQDyAT.exe
  C:\Windows\System\rnQDyAT.exe
  2⤵
  PID:10532
- C:\Windows\System\tHVThFZ.exe
  C:\Windows\System\tHVThFZ.exe
  2⤵
  PID:10564
- C:\Windows\System\NaeCdZp.exe
  C:\Windows\System\NaeCdZp.exe
  2⤵
  PID:10592
- C:\Windows\System\BxJWWnf.exe
  C:\Windows\System\BxJWWnf.exe
  2⤵
  PID:10620
- C:\Windows\System\AWkjVNm.exe
  C:\Windows\System\AWkjVNm.exe
  2⤵
  PID:10656
- C:\Windows\System\QzGosMb.exe
  C:\Windows\System\QzGosMb.exe
  2⤵
  PID:10680
- C:\Windows\System\PIJAzIc.exe
  C:\Windows\System\PIJAzIc.exe
  2⤵
  PID:10708
- C:\Windows\System\ViLqkTg.exe
  C:\Windows\System\ViLqkTg.exe
  2⤵
  PID:10736
- C:\Windows\System\fzzGjwa.exe
  C:\Windows\System\fzzGjwa.exe
  2⤵
  PID:10760
- C:\Windows\System\OkeMtHP.exe
  C:\Windows\System\OkeMtHP.exe
  2⤵
  PID:10800
- C:\Windows\System\RUrvmzV.exe
  C:\Windows\System\RUrvmzV.exe
  2⤵
  PID:10816
- C:\Windows\System\GilwSbz.exe
  C:\Windows\System\GilwSbz.exe
  2⤵
  PID:10852
- C:\Windows\System\iDpxiUi.exe
  C:\Windows\System\iDpxiUi.exe
  2⤵
  PID:10872
- C:\Windows\System\zdQycUO.exe
  C:\Windows\System\zdQycUO.exe
  2⤵
  PID:10892
- C:\Windows\System\jsposGz.exe
  C:\Windows\System\jsposGz.exe
  2⤵
  PID:10920
- C:\Windows\System\WiVZGFX.exe
  C:\Windows\System\WiVZGFX.exe
  2⤵
  PID:10956
- C:\Windows\System\szVtiBO.exe
  C:\Windows\System\szVtiBO.exe
  2⤵
  PID:10976
- C:\Windows\System\qMnflqc.exe
  C:\Windows\System\qMnflqc.exe
  2⤵
  PID:11012
- C:\Windows\System\mQbdXwR.exe
  C:\Windows\System\mQbdXwR.exe
  2⤵
  PID:11044
- C:\Windows\System\zmZflaZ.exe
  C:\Windows\System\zmZflaZ.exe
  2⤵
  PID:11072
- C:\Windows\System\xIRtjul.exe
  C:\Windows\System\xIRtjul.exe
  2⤵
  PID:11088
- C:\Windows\System\IwqLfMp.exe
  C:\Windows\System\IwqLfMp.exe
  2⤵
  PID:11112
- C:\Windows\System\gzYEfJs.exe
  C:\Windows\System\gzYEfJs.exe
  2⤵
  PID:11136
- C:\Windows\System\XMhFTNm.exe
  C:\Windows\System\XMhFTNm.exe
  2⤵
  PID:11164
- C:\Windows\System\WbttQaH.exe
  C:\Windows\System\WbttQaH.exe
  2⤵
  PID:11196
- C:\Windows\System\jXsnyjn.exe
  C:\Windows\System\jXsnyjn.exe
  2⤵
  PID:11216
- C:\Windows\System\IXmZBoR.exe
  C:\Windows\System\IXmZBoR.exe
  2⤵
  PID:11244
- C:\Windows\System\PmmiBTh.exe
  C:\Windows\System\PmmiBTh.exe
  2⤵
  PID:10112
- C:\Windows\System\gmlCuYD.exe
  C:\Windows\System\gmlCuYD.exe
  2⤵
  PID:10348
- C:\Windows\System\PQYGHRl.exe
  C:\Windows\System\PQYGHRl.exe
  2⤵
  PID:10344
- C:\Windows\System\qATeEIX.exe
  C:\Windows\System\qATeEIX.exe
  2⤵
  PID:10408
- C:\Windows\System\IxzgojV.exe
  C:\Windows\System\IxzgojV.exe
  2⤵
  PID:10516
- C:\Windows\System\KVFmUAt.exe
  C:\Windows\System\KVFmUAt.exe
  2⤵
  PID:10580
- C:\Windows\System\WusRltq.exe
  C:\Windows\System\WusRltq.exe
  2⤵
  PID:10636
- C:\Windows\System\EJlAiso.exe
  C:\Windows\System\EJlAiso.exe
  2⤵
  PID:10668
- C:\Windows\System\rTBoqAq.exe
  C:\Windows\System\rTBoqAq.exe
  2⤵
  PID:10724
- C:\Windows\System\xWzNrSu.exe
  C:\Windows\System\xWzNrSu.exe
  2⤵
  PID:10828
- C:\Windows\System\RJNVDrY.exe
  C:\Windows\System\RJNVDrY.exe
  2⤵
  PID:10860
- C:\Windows\System\gTDlZXD.exe
  C:\Windows\System\gTDlZXD.exe
  2⤵
  PID:10936
- C:\Windows\System\kTGrkUj.exe
  C:\Windows\System\kTGrkUj.exe
  2⤵
  PID:11004
- C:\Windows\System\eaZwglA.exe
  C:\Windows\System\eaZwglA.exe
  2⤵
  PID:11024
- C:\Windows\System\jCnhQnI.exe
  C:\Windows\System\jCnhQnI.exe
  2⤵
  PID:11060
- C:\Windows\System\LCWhgZo.exe
  C:\Windows\System\LCWhgZo.exe
  2⤵
  PID:11188
- C:\Windows\System\lKMibwK.exe
  C:\Windows\System\lKMibwK.exe
  2⤵
  PID:11228
- C:\Windows\System\biOEVHe.exe
  C:\Windows\System\biOEVHe.exe
  2⤵
  PID:10256
- C:\Windows\System\qHywNAm.exe
  C:\Windows\System\qHywNAm.exe
  2⤵
  PID:10436
- C:\Windows\System\DvMdZHV.exe
  C:\Windows\System\DvMdZHV.exe
  2⤵
  PID:10556
- C:\Windows\System\bUEtDjN.exe
  C:\Windows\System\bUEtDjN.exe
  2⤵
  PID:10512
- C:\Windows\System\siTZjis.exe
  C:\Windows\System\siTZjis.exe
  2⤵
  PID:10552
- C:\Windows\System\HUPHVjO.exe
  C:\Windows\System\HUPHVjO.exe
  2⤵
  PID:10728
- C:\Windows\System\fyImqLg.exe
  C:\Windows\System\fyImqLg.exe
  2⤵
  PID:10792
- C:\Windows\System\GmcdPON.exe
  C:\Windows\System\GmcdPON.exe
  2⤵
  PID:10944
- C:\Windows\System\NTMqWZm.exe
  C:\Windows\System\NTMqWZm.exe
  2⤵
  PID:11160
- C:\Windows\System\wRpoYgF.exe
  C:\Windows\System\wRpoYgF.exe
  2⤵
  PID:11260
- C:\Windows\System\REcOhis.exe
  C:\Windows\System\REcOhis.exe
  2⤵
  PID:10616
- C:\Windows\System\LXBdJtR.exe
  C:\Windows\System\LXBdJtR.exe
  2⤵
  PID:11144
- C:\Windows\System\jyljpcr.exe
  C:\Windows\System\jyljpcr.exe
  2⤵
  PID:10928
- C:\Windows\System\lepOwUf.exe
  C:\Windows\System\lepOwUf.exe
  2⤵
  PID:11288
- C:\Windows\System\lCjIeAt.exe
  C:\Windows\System\lCjIeAt.exe
  2⤵
  PID:11320
- C:\Windows\System\TiBCFFq.exe
  C:\Windows\System\TiBCFFq.exe
  2⤵
  PID:11348
- C:\Windows\System\JtfatKH.exe
  C:\Windows\System\JtfatKH.exe
  2⤵
  PID:11368
- C:\Windows\System\ioSdBXc.exe
  C:\Windows\System\ioSdBXc.exe
  2⤵
  PID:11400
- C:\Windows\System\LFinDEE.exe
  C:\Windows\System\LFinDEE.exe
  2⤵
  PID:11432
- C:\Windows\System\vKwqhQG.exe
  C:\Windows\System\vKwqhQG.exe
  2⤵
  PID:11464
- C:\Windows\System\afbeWGH.exe
  C:\Windows\System\afbeWGH.exe
  2⤵
  PID:11496
- C:\Windows\System\yGxvGFY.exe
  C:\Windows\System\yGxvGFY.exe
  2⤵
  PID:11520
- C:\Windows\System\IAFhNYB.exe
  C:\Windows\System\IAFhNYB.exe
  2⤵
  PID:11556
- C:\Windows\System\MRQTnTV.exe
  C:\Windows\System\MRQTnTV.exe
  2⤵
  PID:11576
- C:\Windows\System\YJnZmHi.exe
  C:\Windows\System\YJnZmHi.exe
  2⤵
  PID:11600
- C:\Windows\System\gNrkVmX.exe
  C:\Windows\System\gNrkVmX.exe
  2⤵
  PID:11628
- C:\Windows\System\SwYHtwI.exe
  C:\Windows\System\SwYHtwI.exe
  2⤵
  PID:11656
- C:\Windows\System\IybtJvb.exe
  C:\Windows\System\IybtJvb.exe
  2⤵
  PID:11688
- C:\Windows\System\pxeUDjx.exe
  C:\Windows\System\pxeUDjx.exe
  2⤵
  PID:11716
- C:\Windows\System\MUTkUgm.exe
  C:\Windows\System\MUTkUgm.exe
  2⤵
  PID:11748
- C:\Windows\System\fNXGygK.exe
  C:\Windows\System\fNXGygK.exe
  2⤵
  PID:11792
- C:\Windows\System\AjbhvzH.exe
  C:\Windows\System\AjbhvzH.exe
  2⤵
  PID:11816
- C:\Windows\System\hEAlTEd.exe
  C:\Windows\System\hEAlTEd.exe
  2⤵
  PID:11844
- C:\Windows\System\TCXjnyb.exe
  C:\Windows\System\TCXjnyb.exe
  2⤵
  PID:11872
- C:\Windows\System\PohTwKr.exe
  C:\Windows\System\PohTwKr.exe
  2⤵
  PID:11912
- C:\Windows\System\ahFyhpp.exe
  C:\Windows\System\ahFyhpp.exe
  2⤵
  PID:11928
- C:\Windows\System\rPsDlDs.exe
  C:\Windows\System\rPsDlDs.exe
  2⤵
  PID:11956
- C:\Windows\System\dKsxRiz.exe
  C:\Windows\System\dKsxRiz.exe
  2⤵
  PID:11980
- C:\Windows\System\CPzYOkZ.exe
  C:\Windows\System\CPzYOkZ.exe
  2⤵
  PID:12016
- C:\Windows\System\JAcNAwI.exe
  C:\Windows\System\JAcNAwI.exe
  2⤵
  PID:12056
- C:\Windows\System\tCcdfOJ.exe
  C:\Windows\System\tCcdfOJ.exe
  2⤵
  PID:12080
- C:\Windows\System\uUxoomR.exe
  C:\Windows\System\uUxoomR.exe
  2⤵
  PID:12108
- C:\Windows\System\EFFRwkr.exe
  C:\Windows\System\EFFRwkr.exe
  2⤵
  PID:12136
- C:\Windows\System\iGZnthz.exe
  C:\Windows\System\iGZnthz.exe
  2⤵
  PID:12168
- C:\Windows\System\TzDJCsU.exe
  C:\Windows\System\TzDJCsU.exe
  2⤵
  PID:12200
- C:\Windows\System\CVVtATe.exe
  C:\Windows\System\CVVtATe.exe
  2⤵
  PID:12228
- C:\Windows\System\URwNyQm.exe
  C:\Windows\System\URwNyQm.exe
  2⤵
  PID:12252
- C:\Windows\System\dJxswiT.exe
  C:\Windows\System\dJxswiT.exe
  2⤵
  PID:12276
- C:\Windows\System\vUzOlFw.exe
  C:\Windows\System\vUzOlFw.exe
  2⤵
  PID:3472
- C:\Windows\System\Ankehpu.exe
  C:\Windows\System\Ankehpu.exe
  2⤵
  PID:10004
- C:\Windows\System\fHkzXpG.exe
  C:\Windows\System\fHkzXpG.exe
  2⤵
  PID:10428
- C:\Windows\System\cdTklTj.exe
  C:\Windows\System\cdTklTj.exe
  2⤵
  PID:11408
- C:\Windows\System\rfqhXhQ.exe
  C:\Windows\System\rfqhXhQ.exe
  2⤵
  PID:11540
- C:\Windows\System\oOwMjXf.exe
  C:\Windows\System\oOwMjXf.exe
  2⤵
  PID:11536
- C:\Windows\System\jfIRHsG.exe
  C:\Windows\System\jfIRHsG.exe
  2⤵
  PID:11640
- C:\Windows\System\UcCwlWR.exe
  C:\Windows\System\UcCwlWR.exe
  2⤵
  PID:11676
- C:\Windows\System\YINVMff.exe
  C:\Windows\System\YINVMff.exe
  2⤵
  PID:11700
- C:\Windows\System\HBoJHJP.exe
  C:\Windows\System\HBoJHJP.exe
  2⤵
  PID:11800
- C:\Windows\System\vrWyLPX.exe
  C:\Windows\System\vrWyLPX.exe
  2⤵
  PID:11852
- C:\Windows\System\nTDleRV.exe
  C:\Windows\System\nTDleRV.exe
  2⤵
  PID:11944
- C:\Windows\System\cncDNRh.exe
  C:\Windows\System\cncDNRh.exe
  2⤵
  PID:11996
- C:\Windows\System\MFvuzIp.exe
  C:\Windows\System\MFvuzIp.exe
  2⤵
  PID:12072
- C:\Windows\System\HEVwvRk.exe
  C:\Windows\System\HEVwvRk.exe
  2⤵
  PID:12100
- C:\Windows\System\uNlEcka.exe
  C:\Windows\System\uNlEcka.exe
  2⤵
  PID:12184
- C:\Windows\System\EUmIsfj.exe
  C:\Windows\System\EUmIsfj.exe
  2⤵
  PID:12248
- C:\Windows\System\SUebVbI.exe
  C:\Windows\System\SUebVbI.exe
  2⤵
  PID:11300
- C:\Windows\System\bwijCJb.exe
  C:\Windows\System\bwijCJb.exe
  2⤵
  PID:11380
- C:\Windows\System\BmuWtiX.exe
  C:\Windows\System\BmuWtiX.exe
  2⤵
  PID:11476
- C:\Windows\System\VUEHNjC.exe
  C:\Windows\System\VUEHNjC.exe
  2⤵
  PID:11644
- C:\Windows\System\vjuRYpY.exe
  C:\Windows\System\vjuRYpY.exe
  2⤵
  PID:11952
- C:\Windows\System\PRMkPQW.exe
  C:\Windows\System\PRMkPQW.exe
  2⤵
  PID:12068
- C:\Windows\System\NEgmMRn.exe
  C:\Windows\System\NEgmMRn.exe
  2⤵
  PID:12116
- C:\Windows\System\lfnUSVm.exe
  C:\Windows\System\lfnUSVm.exe
  2⤵
  PID:11364
- C:\Windows\System\QjudAEJ.exe
  C:\Windows\System\QjudAEJ.exe
  2⤵
  PID:11892
- C:\Windows\System\wWQsqRT.exe
  C:\Windows\System\wWQsqRT.exe
  2⤵
  PID:12160
- C:\Windows\System\hBytcNg.exe
  C:\Windows\System\hBytcNg.exe
  2⤵
  PID:11896
- C:\Windows\System\YKcRzHm.exe
  C:\Windows\System\YKcRzHm.exe
  2⤵
  PID:12272
- C:\Windows\System\ezxlSgn.exe
  C:\Windows\System\ezxlSgn.exe
  2⤵
  PID:12312
- C:\Windows\System\TyEMqnK.exe
  C:\Windows\System\TyEMqnK.exe
  2⤵
  PID:12332
- C:\Windows\System\MMCyUgt.exe
  C:\Windows\System\MMCyUgt.exe
  2⤵
  PID:12364
- C:\Windows\System\sgCGmxj.exe
  C:\Windows\System\sgCGmxj.exe
  2⤵
  PID:12396
- C:\Windows\System\raTPMjD.exe
  C:\Windows\System\raTPMjD.exe
  2⤵
  PID:12416
- C:\Windows\System\tuZUsie.exe
  C:\Windows\System\tuZUsie.exe
  2⤵
  PID:12444
- C:\Windows\System\WQHvNoj.exe
  C:\Windows\System\WQHvNoj.exe
  2⤵
  PID:12472
- C:\Windows\System\NcmRsVG.exe
  C:\Windows\System\NcmRsVG.exe
  2⤵
  PID:12508
- C:\Windows\System\tCvdWNI.exe
  C:\Windows\System\tCvdWNI.exe
  2⤵
  PID:12528
- C:\Windows\System\biAYTQt.exe
  C:\Windows\System\biAYTQt.exe
  2⤵
  PID:12556
- C:\Windows\System\dXGKcCj.exe
  C:\Windows\System\dXGKcCj.exe
  2⤵
  PID:12588
- C:\Windows\System\ReVnyco.exe
  C:\Windows\System\ReVnyco.exe
  2⤵
  PID:12616
- C:\Windows\System\gbFkMLV.exe
  C:\Windows\System\gbFkMLV.exe
  2⤵
  PID:12640
- C:\Windows\System\jSHRHQZ.exe
  C:\Windows\System\jSHRHQZ.exe
  2⤵
  PID:12668
- C:\Windows\System\otdKzdi.exe
  C:\Windows\System\otdKzdi.exe
  2⤵
  PID:12700
- C:\Windows\System\fSuWdYP.exe
  C:\Windows\System\fSuWdYP.exe
  2⤵
  PID:12716
- C:\Windows\System\IlWzLhD.exe
  C:\Windows\System\IlWzLhD.exe
  2⤵
  PID:12752
- C:\Windows\System\tMQCwzK.exe
  C:\Windows\System\tMQCwzK.exe
  2⤵
  PID:12772
- C:\Windows\System\LJLRvyL.exe
  C:\Windows\System\LJLRvyL.exe
  2⤵
  PID:12796
- C:\Windows\System\LihoMad.exe
  C:\Windows\System\LihoMad.exe
  2⤵
  PID:12824
- C:\Windows\System\XUXsDCv.exe
  C:\Windows\System\XUXsDCv.exe
  2⤵
  PID:12852
- C:\Windows\System\cyYxPqL.exe
  C:\Windows\System\cyYxPqL.exe
  2⤵
  PID:12888
- C:\Windows\System\npqZnXj.exe
  C:\Windows\System\npqZnXj.exe
  2⤵
  PID:12912
- C:\Windows\System\XLQVmeK.exe
  C:\Windows\System\XLQVmeK.exe
  2⤵
  PID:12940
- C:\Windows\System\hyAqeqA.exe
  C:\Windows\System\hyAqeqA.exe
  2⤵
  PID:12964
- C:\Windows\System\qhksEeE.exe
  C:\Windows\System\qhksEeE.exe
  2⤵
  PID:12996
- C:\Windows\System\ubyRPlN.exe
  C:\Windows\System\ubyRPlN.exe
  2⤵
  PID:13032
- C:\Windows\System\AZukmut.exe
  C:\Windows\System\AZukmut.exe
  2⤵
  PID:13056
- C:\Windows\System\QwdJQwM.exe
  C:\Windows\System\QwdJQwM.exe
  2⤵
  PID:13092
- C:\Windows\System\OyMpdmQ.exe
  C:\Windows\System\OyMpdmQ.exe
  2⤵
  PID:13120
- C:\Windows\System\YYiidyk.exe
  C:\Windows\System\YYiidyk.exe
  2⤵
  PID:13156
- C:\Windows\System\LIPZpQN.exe
  C:\Windows\System\LIPZpQN.exe
  2⤵
  PID:13176
- C:\Windows\System\aJtmavO.exe
  C:\Windows\System\aJtmavO.exe
  2⤵
  PID:13212
- C:\Windows\System\sTblZtz.exe
  C:\Windows\System\sTblZtz.exe
  2⤵
  PID:13232
- C:\Windows\System\hOmqElL.exe
  C:\Windows\System\hOmqElL.exe
  2⤵
  PID:13268
- C:\Windows\System\YIoBEWD.exe
  C:\Windows\System\YIoBEWD.exe
  2⤵
  PID:13296
- C:\Windows\System\RttDhmO.exe
  C:\Windows\System\RttDhmO.exe
  2⤵
  PID:11304
- C:\Windows\System\uZhMXdf.exe
  C:\Windows\System\uZhMXdf.exe
  2⤵
  PID:12348
- C:\Windows\System\hcIyJaP.exe
  C:\Windows\System\hcIyJaP.exe
  2⤵
  PID:12408
- C:\Windows\System\VxUxxrL.exe
  C:\Windows\System\VxUxxrL.exe
  2⤵
  PID:12496
- C:\Windows\System\gfcWycK.exe
  C:\Windows\System\gfcWycK.exe
  2⤵
  PID:12520
- C:\Windows\System\mMoLKJO.exe
  C:\Windows\System\mMoLKJO.exe
  2⤵
  PID:12608
- C:\Windows\System\qKFnMmf.exe
  C:\Windows\System\qKFnMmf.exe
  2⤵
  PID:12664
- C:\Windows\System\xgOvMcV.exe
  C:\Windows\System\xgOvMcV.exe
  2⤵
  PID:12684
- C:\Windows\System\EgYhqAB.exe
  C:\Windows\System\EgYhqAB.exe
  2⤵
  PID:12820
- C:\Windows\System\AvcuhLN.exe
  C:\Windows\System\AvcuhLN.exe
  2⤵
  PID:12904
- C:\Windows\System\LeVQRvJ.exe
  C:\Windows\System\LeVQRvJ.exe
  2⤵
  PID:12924
- C:\Windows\System\GBRoEKl.exe
  C:\Windows\System\GBRoEKl.exe
  2⤵
  PID:12972
- C:\Windows\System\XFHOiZi.exe
  C:\Windows\System\XFHOiZi.exe
  2⤵
  PID:13012
- C:\Windows\System\oOsDNio.exe
  C:\Windows\System\oOsDNio.exe
  2⤵
  PID:13112
- C:\Windows\System\JKZdJvn.exe
  C:\Windows\System\JKZdJvn.exe
  2⤵
  PID:13172
- C:\Windows\System\SLNdvgS.exe
  C:\Windows\System\SLNdvgS.exe
  2⤵
  PID:13188
- C:\Windows\System\bhDiCrK.exe
  C:\Windows\System\bhDiCrK.exe
  2⤵
  PID:13288
- C:\Windows\System\OvCsMDq.exe
  C:\Windows\System\OvCsMDq.exe
  2⤵
  PID:4496
- C:\Windows\System\QXOFpfk.exe
  C:\Windows\System\QXOFpfk.exe
  2⤵
  PID:4632
- C:\Windows\System\fqzmNBT.exe
  C:\Windows\System\fqzmNBT.exe
  2⤵
  PID:12524
- C:\Windows\System\ILHVPeX.exe
  C:\Windows\System\ILHVPeX.exe
  2⤵
  PID:12632
- C:\Windows\System\DXpaxOH.exe
  C:\Windows\System\DXpaxOH.exe
  2⤵
  PID:12740
- C:\Windows\System\ngUmlzK.exe
  C:\Windows\System\ngUmlzK.exe
  2⤵
  PID:12880
- C:\Windows\System\yRJAFJT.exe
  C:\Windows\System\yRJAFJT.exe
  2⤵
  PID:13132
- C:\Windows\System\kNNyPuU.exe
  C:\Windows\System\kNNyPuU.exe
  2⤵
  PID:13256
- C:\Windows\System\BtjRAwk.exe
  C:\Windows\System\BtjRAwk.exe
  2⤵
  PID:12388
- C:\Windows\System\EzvOZrC.exe
  C:\Windows\System\EzvOZrC.exe
  2⤵
  PID:12784
- C:\Windows\System\hjwvEMA.exe
  C:\Windows\System\hjwvEMA.exe
  2⤵
  PID:13276
- C:\Windows\System\yhNvsMr.exe
  C:\Windows\System\yhNvsMr.exe
  2⤵
  PID:13048
- C:\Windows\System\BSehoPy.exe
  C:\Windows\System\BSehoPy.exe
  2⤵
  PID:13084
- C:\Windows\System\AXfIMKd.exe
  C:\Windows\System\AXfIMKd.exe
  2⤵
  PID:13340
- C:\Windows\System\ikJkHIQ.exe
  C:\Windows\System\ikJkHIQ.exe
  2⤵
  PID:13364
- C:\Windows\System\oodPppM.exe
  C:\Windows\System\oodPppM.exe
  2⤵
  PID:13392
- C:\Windows\System\tgcLugt.exe
  C:\Windows\System\tgcLugt.exe
  2⤵
  PID:13420
- C:\Windows\System\BxDpsZn.exe
  C:\Windows\System\BxDpsZn.exe
  2⤵
  PID:13452
- C:\Windows\System\hDrlVGE.exe
  C:\Windows\System\hDrlVGE.exe
  2⤵
  PID:13484
- C:\Windows\System\akBSTRS.exe
  C:\Windows\System\akBSTRS.exe
  2⤵
  PID:13512
- C:\Windows\System\yXJNLOX.exe
  C:\Windows\System\yXJNLOX.exe
  2⤵
  PID:13548
- C:\Windows\System\ZCDclcP.exe
  C:\Windows\System\ZCDclcP.exe
  2⤵
  PID:13564
- C:\Windows\System\tdlDLEa.exe
  C:\Windows\System\tdlDLEa.exe
  2⤵
  PID:13592
- C:\Windows\System\kNnRdhy.exe
  C:\Windows\System\kNnRdhy.exe
  2⤵
  PID:13624
- C:\Windows\System\nWtKBDD.exe
  C:\Windows\System\nWtKBDD.exe
  2⤵
  PID:13648
- C:\Windows\System\nAQLMok.exe
  C:\Windows\System\nAQLMok.exe
  2⤵
  PID:13672
- C:\Windows\System\pDwNFuZ.exe
  C:\Windows\System\pDwNFuZ.exe
  2⤵
  PID:13700
- C:\Windows\System\XcRBulV.exe
  C:\Windows\System\XcRBulV.exe
  2⤵
  PID:13724
- C:\Windows\System\TUGBRzJ.exe
  C:\Windows\System\TUGBRzJ.exe
  2⤵
  PID:13752
- C:\Windows\System\VxfbQmN.exe
  C:\Windows\System\VxfbQmN.exe
  2⤵
  PID:13792
- C:\Windows\System\KCWdxNv.exe
  C:\Windows\System\KCWdxNv.exe
  2⤵
  PID:13816
- C:\Windows\System\YsdFaPy.exe
  C:\Windows\System\YsdFaPy.exe
  2⤵
  PID:13836
- C:\Windows\System\QiCNvad.exe
  C:\Windows\System\QiCNvad.exe
  2⤵
  PID:13856
- C:\Windows\System\Akdzyff.exe
  C:\Windows\System\Akdzyff.exe
  2⤵
  PID:13888
- C:\Windows\System\ODRYhPr.exe
  C:\Windows\System\ODRYhPr.exe
  2⤵
  PID:13920
- C:\Windows\System\IrXunFe.exe
  C:\Windows\System\IrXunFe.exe
  2⤵
  PID:13956
- C:\Windows\System\qbaYTJy.exe
  C:\Windows\System\qbaYTJy.exe
  2⤵
  PID:13972
- C:\Windows\System\xgaoetH.exe
  C:\Windows\System\xgaoetH.exe
  2⤵
  PID:13996
- C:\Windows\System\ECEJeiH.exe
  C:\Windows\System\ECEJeiH.exe
  2⤵
  PID:14024
- C:\Windows\System\ujKnhpz.exe
  C:\Windows\System\ujKnhpz.exe
  2⤵
  PID:14056
- C:\Windows\System\uMLAuJN.exe
  C:\Windows\System\uMLAuJN.exe
  2⤵
  PID:14084
- C:\Windows\System\fmUFTkI.exe
  C:\Windows\System\fmUFTkI.exe
  2⤵
  PID:14152
- C:\Windows\System\cQLaPuk.exe
  C:\Windows\System\cQLaPuk.exe
  2⤵
  PID:14188
- C:\Windows\System\NyxVAvH.exe
  C:\Windows\System\NyxVAvH.exe
  2⤵
  PID:14216
- C:\Windows\System\JMAWuYX.exe
  C:\Windows\System\JMAWuYX.exe
  2⤵
  PID:14232
- C:\Windows\System\AwSagns.exe
  C:\Windows\System\AwSagns.exe
  2⤵
  PID:14256
- C:\Windows\System\LdwPPKD.exe
  C:\Windows\System\LdwPPKD.exe
  2⤵
  PID:14296
- C:\Windows\System\TyoNzNR.exe
  C:\Windows\System\TyoNzNR.exe
  2⤵
  PID:14320
- C:\Windows\System\TfpDiEp.exe
  C:\Windows\System\TfpDiEp.exe
  2⤵
  PID:12488
- C:\Windows\System\CXvsPKC.exe
  C:\Windows\System\CXvsPKC.exe
  2⤵
  PID:13356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AGpmiMJ.exe

Filesize
2.2MB

MD5
00a70d7a83d1837dc2cca75488736f11

SHA1
af7ef8e48f435a23ac236bfb09d5ddfad808192f

SHA256
083f53d49425e9352350c7321809996699dc5bb6c2f700565d446a5b83aec9bc

SHA512
32f3da453ea81ca4aeafae635b591915f6260e04ee5da2355af1f1d2fb80d6df9de6642636cd913fbb2cf322173cea5e6c3fc03930449e66bff33826586bc8b5

Download Submit
C:\Windows\System\CdclXah.exe

Filesize
2.2MB

MD5
06473cec9671f6f31b70d3567c8a7e0d

SHA1
fc3ef8da32bfe39b49edc25d3a5a07b8a6d190c6

SHA256
479edfab7da2762d58b86367eb5c8696f566d2564cc8e282a83c3b8af23c81aa

SHA512
ad247bab39581952e0ae2ac8150c21c2ffd8f45dd42759e5f66cece1d8d1c99490cf2f2819fcdb2b273a9f13a6f0c4ab001fb821b44203676b7815c881737d13

Download Submit
C:\Windows\System\DMacctM.exe

Filesize
2.2MB

MD5
c6ad9ca1408b1a09fc91c3ba94969d03

SHA1
8489a035c59f8ee643c49221e5da3b2555d2017f

SHA256
fe0b2a2a36390a91a83bb8ff108054c8d97f944887544d2516d08480e5d409db

SHA512
df2c720dea9a3a76473457c3683e0a8d4ff43fcc808a7bb81a64864fa97717d21dbdc84e0136c6c136a5fb7cfb1e80cf203a9f250e2176a0dd8e43f996290016

Download Submit
C:\Windows\System\DOwbLRg.exe

Filesize
2.2MB

MD5
dbe51d8e18efd029b925e74744354147

SHA1
1dfa6ca7e91dd6677df1602491715c42ee4ccb70

SHA256
c7b3d0dec643638e2582709c2f07e6e15e292b5f19b0dd6d6031cf1a628c1277

SHA512
fffa89d498fb4d96996f83d780da5db40c632f6f9a325907ea22334e2715df199a18bb1b4e25b5a7b94d5d49786b739d75fac2706c46ed5a7b0782eaccd7325d

Download Submit
C:\Windows\System\DhEiSpd.exe

Filesize
2.2MB

MD5
9d9c69b511070a6874cac20aecfb8ed2

SHA1
9de6f8113838b043bf348aea3d05a826ef9c9be1

SHA256
a3b75f53efb1e3da9ba70505c712d0591f249adde38ac21d637c65ca8f196fd1

SHA512
9ac42174b9126b9123d8c13c66b3bf57a4362ac46bd54ae9c1b8e04cedbe2a7ea8089de1727516204161c471b907271ca776e61bb903d7d781387d7b0cd7edd1

Download Submit
C:\Windows\System\EgQBCQU.exe

Filesize
2.2MB

MD5
587f5d1cf42e1dc9bbdbd8d04262543a

SHA1
957b18f0a45bc5d4691d439b955f90f0649c1e5b

SHA256
9cf04e18367763c19bd6a0c9bb0ea8d2c45ec7743ff8f7ef5efe91240ae2d30c

SHA512
d2e67f14ee05a4b70c3c709d30b20d8b361571a6f92d8d5ececb34aea7f1f122da309f9a964f570892d4478a12931a36192bda1c44bc078c6f49e58d8ad89ec8

Download Submit
C:\Windows\System\FxHEuaR.exe

Filesize
2.2MB

MD5
17982bf453a67d6c3ae9b8328b555d9f

SHA1
0765ae0b2beb11e6d6089bd45574f08a330c9965

SHA256
f0be95241a7a125ade1a2c1c46f6903b09f5b64e843d1ff5b2a002d1a74a79e1

SHA512
d120e9f6e64f06685f3f50d7ae78e5ac65c1ba3f24c8768db463c0f8bb0b82a67b652cf34e0a94d11e2f8217d80fe619fa0201f0b29885731c63bcd8f82edf20

Download Submit
C:\Windows\System\GTcDxFe.exe

Filesize
2.2MB

MD5
94059420b9ce2ec86ca8faa5a27040b6

SHA1
a9dad4435bb1217195d6e8424b6d30f2ecc82051

SHA256
d6938b85d6f2fe4a2e7c2f91e0857e9110a324b82c4de385fde0c985a489d910

SHA512
65dcf3d28714ec27d68110e87592195ac6a9fccacf11b964aedba891e77ec866d44a5ea47ab786a305d3a5e9befa3f0f6e288d082bd42dacf6328a438ec0ace4

Download Submit
C:\Windows\System\GbdFuGz.exe

Filesize
2.2MB

MD5
d13d2f3330a486066e9d2a5a6e40e413

SHA1
0d0c5c44d427146d87f4b977e45d8c30e492ba9b

SHA256
8eb5a6d41da0836ce41904996fc605be1e15e1e4dc81a591b16c47b2c1520e31

SHA512
c683b24acc320975e01b3ae2165f0aa626d7ef55cbdb646e71760a6b0a3ebcc13b8b105297b4f556d9ba0cb43eee611bc6684ed057a41d16738be7a2923ad015

Download Submit
C:\Windows\System\HVCualM.exe

Filesize
2.2MB

MD5
176858e2475d54636326bb2dee6cdbda

SHA1
5b77da97befb6030c5f0504e9557550f429f8a62

SHA256
ea00efba7833b3fa3aea17f6017f4607e8839148247d5b39f7202668e17032d0

SHA512
9f1fe427786c16cd71ba4c62eed0996bed3d9c45786434085248a1870429de30cb11fd181097f7eccfeb9a446c9c26af091d36a532bd7f1b6602f7a1da303080

Download Submit
C:\Windows\System\IGvJrRX.exe

Filesize
2.2MB

MD5
7ec15553e6b5a58f9c95fc8b866a7283

SHA1
d60643f24bf18de4c7e9a9bdfaf4d3f4712cadcd

SHA256
34f218b22fa632938fdcc82b4127bc03c647b08105963d1aff1c55e9cbd647fe

SHA512
c1bcc937f46cb43601c3ffebe12fd775ba78df7a3e9463d51cbaddc81215cdc8cb566e1fa3e361bc5a8e625967626ed707affa59c5de4ab38646f0c1c6b173fd

Download Submit
C:\Windows\System\INBbwcZ.exe

Filesize
2.2MB

MD5
ae051180c325bccc781c174a83b5ea44

SHA1
273e34486d0c31f98b23752983a60698fc285166

SHA256
02aa4f6c9b1477c2e9be632ad63a8218b38260616f0c91a4aa77f957f389f9f0

SHA512
43b546aea51d4b746710bf961c89fcdb7f6f7c16eb6b21f4ee44f4f5ed35b1b56e6a9700993579e2944bb521b219082359a7eee87ed077cd87ffb5d7c57b157a

Download Submit
C:\Windows\System\IvtqDZs.exe

Filesize
2.2MB

MD5
157d03676cfba0e4e27387e986fb794e

SHA1
6d15e6f2b2b28a77045bccdf6c59ccc09a47fd5d

SHA256
d52b6e8ed154161d496de1b5c462f3794c61252c1fe0e34f1f2e2843c16bfe44

SHA512
422e7375e1beb946115cc5e33385b58fe886ef831f24681b65c4fee69fa0588fb41b1b5c0707910a540ea332d0f3d63cc718fe2daeecd8ce0235ec255d49f322

Download Submit
C:\Windows\System\Kozvogl.exe

Filesize
2.2MB

MD5
cb4240125998045239ad85bd7e5cada5

SHA1
6fd390c388dfc7f7d21fd7f2fee8ec302e160c78

SHA256
758ca21328b34c31e1c7644999b6c99fcfe906aa54e77c5fc692dc137b6add87

SHA512
ada278397df3a916e4ecfc79cf5c64a445af52bd83f72e560c02891fc9f8ce2613f9f765838f6ad0d72c55932debc4758e1d0583920645d18e7a7db6dd9b8bb8

Download Submit
C:\Windows\System\MfsfzKK.exe

Filesize
2.2MB

MD5
c54683af1376df9d333830f1c1928a15

SHA1
d9948ee25fd563bad007bcd4000a5ed0f91cae06

SHA256
0f8bd2428154eb4680709fe3a1f1f50ced99a21d0e2e5cc32d9da2b0c7bf5e35

SHA512
32e4b5ef9553dfb85554d9f6017e2c139915b5a175ac6455eb5b55c311b961c566681ae1331907d1680c1213b28ae3ee2e8159ed8d0a8b9b458c003184db8ead

Download Submit
C:\Windows\System\MhVwFSQ.exe

Filesize
2.2MB

MD5
f02bdf0988f9ad587a9499aa98332d66

SHA1
8f6788491e2ee5c417be5f00d0f4703f076cdee8

SHA256
cbf8858d779f25079642ce18fb3c76274ffeff386a7e6f26ec95458988ff8892

SHA512
f49f4831a4cf88bdeb03e8cb0a6ab23e120513a9632e35e2fc7ee76396748f7e2dab3a92ff4982a7edf6c3cf0e7c76c67fc107379e5b2f153093dd26ce2ca3c5

Download Submit
C:\Windows\System\QUyoHfE.exe

Filesize
2.2MB

MD5
4b7b511851f44f0e44cd21e6221b1978

SHA1
1f32b6b8d86930729e43f59e3b9ddfac6e1246f7

SHA256
b44fb3aceac8bf47c4a99f9693ffc9dbb6cb168859a06149b3e3f5c20461e406

SHA512
13d9c8985f61d4b42013a3e789f85b38795b3701380ee04b74e2343d17048c26928d04d1fa603d52d84b09a21919809533a6ae11cb69c083a71f9d6d74f9259c

Download Submit
C:\Windows\System\TDvVJJP.exe

Filesize
2.2MB

MD5
e621d7c6c6edc4bb0143367911a6e170

SHA1
582de438b9229fb851def2f708fce3fffafa0377

SHA256
20170cf88efa1cb3e5948f5d1d8ca6f7deb141446783ceb791736019473710cc

SHA512
b26dbdffa2987ee33680461448a8982f0f1070555effbb9cb672e89dcbae49fab9cc00060641cea6d54d27a3bf3d427e8ec4df2945f6a43aa5833fbc27919470

Download Submit
C:\Windows\System\UUWGubS.exe

Filesize
2.2MB

MD5
5891faf0eb0ab58a36358a4367e52e3f

SHA1
2544ad99d47780f4af1a3165c14cb562ef85075e

SHA256
4e21468e579952809766b5739ab0bb8677fe5f894ea4503a82010253c034dd3d

SHA512
31fafbcd4f30bc44b422422023732941834094a8d21011c466e5862f28bf735872a30d3cc3597df8f1acb1ce19a1c7d4f7a85800197fd9861d4c126f840eb40a

Download Submit
C:\Windows\System\XKrXgpG.exe

Filesize
2.2MB

MD5
002fae2ddf284350a28c0dcf14967243

SHA1
2fb25cf6de3a37cabf380bf67814a384e2004fe9

SHA256
268552e6ea5d033e011e317aa786d397c454f2982380d250daf568bedf314a6d

SHA512
5fa2bcde0016f9b409626bd141d0a4b8fa82d5521d40c0bb2b34f6cf36d752f7207242d0664d1043ac8d612bdcf91d6a94ca99498e82623e38a9358f0d430eeb

Download Submit
C:\Windows\System\ZFvCETM.exe

Filesize
2.2MB

MD5
cdd80c0dc93f7fb43112649356b03205

SHA1
ef18c02d423715693c40e03698cd64520ed555af

SHA256
fc3e9b63f6aeb628d2493067c867c0eceddcba4d0d402012664799d2378f241d

SHA512
772b9f1dd445505b2c3d540e11c729af7f7546cf4663086c01ec9f5e6c0cfb3f0d576b960ed06ff2e53d7bbab044711756677d38dbdee775565ffc62d02db990

Download Submit
C:\Windows\System\aJDWGoN.exe

Filesize
2.2MB

MD5
694b48e2c9e5e16cde647da70ac7453f

SHA1
d64abd73946f558bb39c4578a67976bc8c86f925

SHA256
5351e49c896fbc04337a6421056454377a133669d86442c38f9bb2841de4e150

SHA512
5406320f393a460501c82459f4ec6714a4b8f2845f9c4e5aa8ea47fc89d42d56b4c71e5382f1ca5bebc6d601aa9186225fb361f5c15f8e0485c697a31b1bbe39

Download Submit
C:\Windows\System\cFivDSg.exe

Filesize
2.2MB

MD5
3fe43681456608f7044f269514a69211

SHA1
4a5fc85bf86842d055dbf8a4a9edf5f847c833c5

SHA256
b8472fe13a4718fad84f66e1342218c0e02e1a493452154fc12f02e4f58fc259

SHA512
f8a949bb63fb298b910697174586386eae7cb89a0d847bda3fd81755c7a45b4a46867372cc95cab22b86f733d7ef018586b04df42984d96423185172d71342aa

Download Submit
C:\Windows\System\fEktkPM.exe

Filesize
2.2MB

MD5
c88d44bf1bb80e9c9710ce366a5674cb

SHA1
0085f500d673fa6d1a921b01b434e64a601b11d1

SHA256
23260859531478f9f47e1a24937a3b1c06e3ff7e17a74d682d69eff2b5eeb802

SHA512
9aa1fe4b3af85de43e3afa89f9bef5f159f93c53cc77a62cccebeb392071486593df5cb2f86591c5d58e517bfc99eb7f550cd1e2a009d68db3ed1bcafb34bd4d

Download Submit
C:\Windows\System\fkqKcwe.exe

Filesize
2.2MB

MD5
d17147de2ff9409cad9d6fe819f37d64

SHA1
95414935921b424539fa5d7dfccf0a7c6ee773b4

SHA256
2b79e23b79587fe4463d5ecb1c0d16c91c3494bf1a92f37bc99abbdab8437fc4

SHA512
689f9d29273b8e8c995c408f78e1a08be7d45047464430d0b4b6a04b9b3dc07e49862013b6d7d8e01b3d040dddcebb63f153ecae8e41881a92cf386f13ecd366

Download Submit
C:\Windows\System\levjhHK.exe

Filesize
2.2MB

MD5
d6ac83d34de15e64c1113ef6a479d607

SHA1
5e3954ed1f984645d1e215f5e09d21e864466b37

SHA256
81a7d9c9446be2d18435036d4bf17e42fb1ce7b4c739313a68ebbff15c20c5b7

SHA512
6dacebcb999f04a43ab38db4cf9579f16ac30e85931a0752401bf00ee75af4b907d9cd087bdf0e756dcce7301116022629320f1d3b559a3bd0fbce43e87414d3

Download Submit
C:\Windows\System\lftTkYs.exe

Filesize
2.2MB

MD5
d6f5799ada8163bcc044291d201f1cb1

SHA1
3a2cafae00807a2737c072d80af0d16df68b5663

SHA256
860b44c131b4cc122e0f8e7e4fb25a5ccd1f894eec809d2a4a61f2b86ab857fa

SHA512
6b725171693c8c1170c20398ce440e964a6120d76f7671eab1380024fe91d744beb100397daa82c475498047f94299436ffb1c6320b30dc58200f257c14b3f10

Download Submit
C:\Windows\System\mBodPkH.exe

Filesize
2.2MB

MD5
279c54c36f69db0f1517d2aa99e31c1e

SHA1
c55602df6408b48e835b8ce556146559b8e870a5

SHA256
c2cd6995cd098c6e75d88b5da0676347c84fd38b8ef952cbbba09b0c63cb6c0f

SHA512
0df3508a6b9e4937afec780bb5fd5d115237061db9072a86a2eeef61d6c968dfec20c8d30636d8bb7a41d86af05989871678392b21272dc762ffa2cba8ecd56f

Download Submit
C:\Windows\System\mMbWtXR.exe

Filesize
2.2MB

MD5
f6eef27c5d3001312ecfe2e183623f4d

SHA1
feaa62c8f2a4004b1423a46feb11fd6763f29dcd

SHA256
dae0368d4922fadedc1cfa07257efead30076b7a96ab2b5197745f38468e8dfe

SHA512
0fa669c083fad53c451832ccf53bbb802be4e824c961ddbd69ef17765335978238efe75c417a3873724741545fe5d7fe9e1f59a9dd4a8b09ad2ae00b7e21883a

Download Submit
C:\Windows\System\mdGUuKB.exe

Filesize
2.2MB

MD5
67c5c56a2cfcde11d5b1c9d4226bb2c0

SHA1
0805304a88afeff51f10dd37314016cfb6e6bd28

SHA256
cf34fcc716947d2a50b62d12446b951cadd47db66979a44a01db3a98b941615c

SHA512
9d4338cf369ffbc4990828ee20f5e12a126d7f2fd1583136f1d6ec1545099877f9645e9964bae52a1463ed2d7f2ab9ca51c1927d0de6eae558dfe7d6e839661c

Download Submit
C:\Windows\System\nShXFwp.exe

Filesize
2.2MB

MD5
4230a6feaac803ace2c6d52a24c26532

SHA1
714256548a36a68e3cdb69f6127f30a5335d6c9d

SHA256
80921da5120163a18539622f59c65a9c6710a9898191cd134c5312b7a21b1b88

SHA512
53aa0837e551b5c1a59d336d0204662103c582cdbedfe9e4e15e3b601dbe7a173e86fc0df24f33fd868a302c18e971a437c472e6873c9737f7021aab74a37233

Download Submit
C:\Windows\System\pGvEtoG.exe

Filesize
2.2MB

MD5
22bb30bfe7803dc6f8df514f29a57ffa

SHA1
f1f6a07b19d7d0a65809790b6d776de02fb659f0

SHA256
894fd0be130459a6073481e7ddcd4b922a6775c4e904064920e03885d0162385

SHA512
24bc9a7e0d093631886235412056dc5c578995fed74b745a8d0aa416dc11227a11e924574f6b6a2028358274d44f5d2d6d9f2040aa6d7f9a8b1b4186b6c889e2

Download Submit
C:\Windows\System\pMNUAAN.exe

Filesize
2.2MB

MD5
eb8d24b0fee7a4d16215b3392efa11bb

SHA1
4cfdda85729e9e2a4513e4b8fdb4eaf970a08043

SHA256
f1591cafc48ad133b64b6fc0fce072fde3eb5dd73d52dd85ea34c66879cb97ff

SHA512
2e676506b247bcf0736154dbfe5be07d18730c66de09de0ad5ffa01c60654067232fecd30becdcd89a0df29ef9c0d0c349dde8abcff192d4617063600b22eab5

Download Submit
C:\Windows\System\rCGpYoi.exe

Filesize
2.2MB

MD5
08af46e2e324498e93d97975a73a1473

SHA1
c99c3da350477471bffd3cb54f4335e9dbe356b5

SHA256
368be7cb3463665f94170303f1b31efaf2b84132c382f6e9c8000ad3cf4ed099

SHA512
d7a9473bc342e9fd1587ad94c9e83deb5eb329bfcea9307f2adadac5b396b985db1855e20e897f695ee5aebe4735b4cd87bf080e76e800c2645d8492d07fed09

Download Submit
C:\Windows\System\sOdaUeW.exe

Filesize
2.2MB

MD5
48de46a728bc4e99bcdbf3fd24154ed3

SHA1
e3db39cc5b1095940b710de7eb29fd3e112aeaff

SHA256
5b756e756f7a186d54f35329e662375402d3250bdcfad706b9f3f06af768be52

SHA512
da5a1d78ab556fa2d0bd7ebb3a88af187088c18d5b129e801e3ba34e041d43ef20f3982be5d0fb1e46a3f16188d65ead8b7fb8ed7a209e36060611fd385e264c

Download Submit
C:\Windows\System\vElksek.exe

Filesize
2.2MB

MD5
147a702f7a64354c30bdff9a51140f23

SHA1
a7293c5bc89b591a3f868514edd3c0200127235d

SHA256
12e91f56f2948e9bf29bfbe255f53d7c3201a4c1fc471f901f882a23ed83af40

SHA512
fe59a615d9a9804733d1d5c63d467563353754c003392ffb4016456e7177eb231c0592d3344d4619922f5b7bb95bbdf582135fdf399522b31566a9a00a3099aa

Download Submit
C:\Windows\System\wBwuQLC.exe

Filesize
2.2MB

MD5
38dea765c7bebe9806bb4775cc5c014a

SHA1
641312d9e4bbc5deb6bc9582851f3b32c876b992

SHA256
6a33b9e2098c3aafd4454be2d3c93241c3b0283003a64abcfdd7658831e6f8b1

SHA512
3386c308aa17bef695bacacba3d50f76c31c1398f1b020fde14848b361a9265726bfd6c3c78fe1fe3981f78221e078f6ff70c634b9dfc7adc669a4f0563ea19b

Download Submit
memory/540-2171-0x00007FF633190000-0x00007FF6334E4000-memory.dmp

Filesize
3.3MB

Download
memory/540-201-0x00007FF633190000-0x00007FF6334E4000-memory.dmp

Filesize
3.3MB

Download
memory/620-199-0x00007FF70EB20000-0x00007FF70EE74000-memory.dmp

Filesize
3.3MB

Download
memory/620-2166-0x00007FF70EB20000-0x00007FF70EE74000-memory.dmp

Filesize
3.3MB

Download
memory/916-121-0x00007FF73CD30000-0x00007FF73D084000-memory.dmp

Filesize
3.3MB

Download
memory/916-2161-0x00007FF73CD30000-0x00007FF73D084000-memory.dmp

Filesize
3.3MB

Download
memory/928-37-0x00007FF6CD6D0000-0x00007FF6CDA24000-memory.dmp

Filesize
3.3MB

Download
memory/928-2146-0x00007FF6CD6D0000-0x00007FF6CDA24000-memory.dmp

Filesize
3.3MB

Download
memory/928-2139-0x00007FF6CD6D0000-0x00007FF6CDA24000-memory.dmp

Filesize
3.3MB

Download
memory/1384-120-0x00007FF7251D0000-0x00007FF725524000-memory.dmp

Filesize
3.3MB

Download
memory/1384-2158-0x00007FF7251D0000-0x00007FF725524000-memory.dmp

Filesize
3.3MB

Download
memory/1404-118-0x00007FF7B9240000-0x00007FF7B9594000-memory.dmp

Filesize
3.3MB

Download
memory/1404-2150-0x00007FF7B9240000-0x00007FF7B9594000-memory.dmp

Filesize
3.3MB

Download
memory/1440-2142-0x00007FF7D92F0000-0x00007FF7D9644000-memory.dmp

Filesize
3.3MB

Download
memory/1440-50-0x00007FF7D92F0000-0x00007FF7D9644000-memory.dmp

Filesize
3.3MB

Download
memory/1440-2149-0x00007FF7D92F0000-0x00007FF7D9644000-memory.dmp

Filesize
3.3MB

Download
memory/1624-2170-0x00007FF775FA0000-0x00007FF7762F4000-memory.dmp

Filesize
3.3MB

Download
memory/1624-204-0x00007FF775FA0000-0x00007FF7762F4000-memory.dmp

Filesize
3.3MB

Download
memory/1644-198-0x00007FF6E7880000-0x00007FF6E7BD4000-memory.dmp

Filesize
3.3MB

Download
memory/1644-2164-0x00007FF6E7880000-0x00007FF6E7BD4000-memory.dmp

Filesize
3.3MB

Download
memory/1648-2138-0x00007FF63F760000-0x00007FF63FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/1648-21-0x00007FF63F760000-0x00007FF63FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/1648-2144-0x00007FF63F760000-0x00007FF63FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/1824-116-0x00007FF61B3F0000-0x00007FF61B744000-memory.dmp

Filesize
3.3MB

Download
memory/1824-2145-0x00007FF61B3F0000-0x00007FF61B744000-memory.dmp

Filesize
3.3MB

Download
memory/2488-2152-0x00007FF754DA0000-0x00007FF7550F4000-memory.dmp

Filesize
3.3MB

Download
memory/2488-105-0x00007FF754DA0000-0x00007FF7550F4000-memory.dmp

Filesize
3.3MB

Download
memory/2808-62-0x00007FF7D6A70000-0x00007FF7D6DC4000-memory.dmp

Filesize
3.3MB

Download
memory/2808-2140-0x00007FF7D6A70000-0x00007FF7D6DC4000-memory.dmp

Filesize
3.3MB

Download
memory/2808-2148-0x00007FF7D6A70000-0x00007FF7D6DC4000-memory.dmp

Filesize
3.3MB

Download
memory/3136-202-0x00007FF753EB0000-0x00007FF754204000-memory.dmp

Filesize
3.3MB

Download
memory/3136-2168-0x00007FF753EB0000-0x00007FF754204000-memory.dmp

Filesize
3.3MB

Download
memory/3176-114-0x00007FF6DB660000-0x00007FF6DB9B4000-memory.dmp

Filesize
3.3MB

Download
memory/3176-2159-0x00007FF6DB660000-0x00007FF6DB9B4000-memory.dmp

Filesize
3.3MB

Download
memory/3192-0-0x00007FF600950000-0x00007FF600CA4000-memory.dmp

Filesize
3.3MB

Download
memory/3192-2137-0x00007FF600950000-0x00007FF600CA4000-memory.dmp

Filesize
3.3MB

Download
memory/3192-1-0x0000014E2A6E0000-0x0000014E2A6F0000-memory.dmp

Filesize
64KB

Download
memory/3220-2157-0x00007FF6305C0000-0x00007FF630914000-memory.dmp

Filesize
3.3MB

Download
memory/3220-113-0x00007FF6305C0000-0x00007FF630914000-memory.dmp

Filesize
3.3MB

Download
memory/3276-108-0x00007FF6BBD00000-0x00007FF6BC054000-memory.dmp

Filesize
3.3MB

Download
memory/3276-2156-0x00007FF6BBD00000-0x00007FF6BC054000-memory.dmp

Filesize
3.3MB

Download
memory/3616-2165-0x00007FF717680000-0x00007FF7179D4000-memory.dmp

Filesize
3.3MB

Download
memory/3616-200-0x00007FF717680000-0x00007FF7179D4000-memory.dmp

Filesize
3.3MB

Download
memory/3632-84-0x00007FF614AB0000-0x00007FF614E04000-memory.dmp

Filesize
3.3MB

Download
memory/3632-2154-0x00007FF614AB0000-0x00007FF614E04000-memory.dmp

Filesize
3.3MB

Download
memory/4224-2162-0x00007FF6E2E60000-0x00007FF6E31B4000-memory.dmp

Filesize
3.3MB

Download
memory/4224-115-0x00007FF6E2E60000-0x00007FF6E31B4000-memory.dmp

Filesize
3.3MB

Download
memory/4312-2153-0x00007FF621610000-0x00007FF621964000-memory.dmp

Filesize
3.3MB

Download
memory/4312-96-0x00007FF621610000-0x00007FF621964000-memory.dmp

Filesize
3.3MB

Download
memory/4344-117-0x00007FF6ADFB0000-0x00007FF6AE304000-memory.dmp

Filesize
3.3MB

Download
memory/4344-2147-0x00007FF6ADFB0000-0x00007FF6AE304000-memory.dmp

Filesize
3.3MB

Download
memory/4364-192-0x00007FF670AE0000-0x00007FF670E34000-memory.dmp

Filesize
3.3MB

Download
memory/4364-2160-0x00007FF670AE0000-0x00007FF670E34000-memory.dmp

Filesize
3.3MB

Download
memory/4424-2163-0x00007FF654B00000-0x00007FF654E54000-memory.dmp

Filesize
3.3MB

Download
memory/4424-122-0x00007FF654B00000-0x00007FF654E54000-memory.dmp

Filesize
3.3MB

Download
memory/4516-203-0x00007FF74BCF0000-0x00007FF74C044000-memory.dmp

Filesize
3.3MB

Download
memory/4516-2169-0x00007FF74BCF0000-0x00007FF74C044000-memory.dmp

Filesize
3.3MB

Download
memory/4544-2151-0x00007FF6A8A50000-0x00007FF6A8DA4000-memory.dmp

Filesize
3.3MB

Download
memory/4544-75-0x00007FF6A8A50000-0x00007FF6A8DA4000-memory.dmp

Filesize
3.3MB

Download
memory/4544-2141-0x00007FF6A8A50000-0x00007FF6A8DA4000-memory.dmp

Filesize
3.3MB

Download
memory/4592-205-0x00007FF7E3060000-0x00007FF7E33B4000-memory.dmp

Filesize
3.3MB

Download
memory/4592-2167-0x00007FF7E3060000-0x00007FF7E33B4000-memory.dmp

Filesize
3.3MB

Download
memory/4640-2155-0x00007FF767B30000-0x00007FF767E84000-memory.dmp

Filesize
3.3MB

Download
memory/4640-119-0x00007FF767B30000-0x00007FF767E84000-memory.dmp

Filesize
3.3MB

Download
memory/4808-2143-0x00007FF6DD4B0000-0x00007FF6DD804000-memory.dmp

Filesize
3.3MB

Download
memory/4808-15-0x00007FF6DD4B0000-0x00007FF6DD804000-memory.dmp

Filesize
3.3MB

Download