xmrig | cdef56ecb6e229ec22576b215de049032ff1472a12179052cc68c00bf0029b09

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65db4567af98c936b55e930ca8d8be10_NEIKI.exe
Size

2.0MB
MD5

65db4567af98c936b55e930ca8d8be10
SHA1

928edf9a2d2bd80953594347b742d4754f8c456f
SHA256

cdef56ecb6e229ec22576b215de049032ff1472a12179052cc68c00bf0029b09
SHA512

3060b6cd68f9a64d2559c8ccb26f481b4e33c48cf358489bd91db56bb40a590ff9f9c8e0dc9db9470650212b75d81b32ed6e0058098b0b0569aa3b2bc95226b7
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+AjEG7uA8R+:BemTLkNdfE0pZro

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1228-0-0x00007FF79E8C0000-0x00007FF79EC14000-memory.dmp	xmrig
behavioral2/files/0x0008000000022f51-11.dat	xmrig
behavioral2/files/0x00080000000233fe-15.dat	xmrig
behavioral2/files/0x00080000000233fb-13.dat	xmrig
behavioral2/memory/4120-10-0x00007FF790B60000-0x00007FF790EB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023402-39.dat	xmrig
behavioral2/files/0x0007000000023406-44.dat	xmrig
behavioral2/files/0x0007000000023408-57.dat	xmrig
behavioral2/files/0x0007000000023407-76.dat	xmrig
behavioral2/memory/2724-91-0x00007FF767F40000-0x00007FF768294000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-99.dat	xmrig
behavioral2/memory/4576-105-0x00007FF6AADC0000-0x00007FF6AB114000-memory.dmp	xmrig
behavioral2/memory/4356-108-0x00007FF79DF80000-0x00007FF79E2D4000-memory.dmp	xmrig
behavioral2/memory/4088-110-0x00007FF65B310000-0x00007FF65B664000-memory.dmp	xmrig
behavioral2/memory/1276-109-0x00007FF779860000-0x00007FF779BB4000-memory.dmp	xmrig
behavioral2/memory/4072-107-0x00007FF73FD10000-0x00007FF740064000-memory.dmp	xmrig
behavioral2/memory/212-106-0x00007FF64D550000-0x00007FF64D8A4000-memory.dmp	xmrig
behavioral2/memory/908-104-0x00007FF753360000-0x00007FF7536B4000-memory.dmp	xmrig
behavioral2/memory/2872-103-0x00007FF64DAE0000-0x00007FF64DE34000-memory.dmp	xmrig
behavioral2/memory/3068-102-0x00007FF67A520000-0x00007FF67A874000-memory.dmp	xmrig
behavioral2/memory/1324-101-0x00007FF7F9B20000-0x00007FF7F9E74000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-97.dat	xmrig
behavioral2/files/0x000700000002340b-95.dat	xmrig
behavioral2/memory/2536-94-0x00007FF7E7B70000-0x00007FF7E7EC4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-92.dat	xmrig
behavioral2/memory/1656-81-0x00007FF7A6D70000-0x00007FF7A70C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023404-70.dat	xmrig
behavioral2/memory/2360-69-0x00007FF75D400000-0x00007FF75D754000-memory.dmp	xmrig
behavioral2/files/0x0007000000023400-64.dat	xmrig
behavioral2/files/0x0007000000023409-62.dat	xmrig
behavioral2/files/0x0007000000023405-61.dat	xmrig
behavioral2/memory/2132-59-0x00007FF6A7B50000-0x00007FF6A7EA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-55.dat	xmrig
behavioral2/files/0x0007000000023401-53.dat	xmrig
behavioral2/memory/2948-49-0x00007FF6236E0000-0x00007FF623A34000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ff-42.dat	xmrig
behavioral2/memory/5040-25-0x00007FF609B30000-0x00007FF609E84000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-112.dat	xmrig
behavioral2/files/0x0007000000023413-143.dat	xmrig
behavioral2/files/0x0007000000023414-156.dat	xmrig
behavioral2/files/0x0007000000023418-177.dat	xmrig
behavioral2/memory/3628-192-0x00007FF64C280000-0x00007FF64C5D4000-memory.dmp	xmrig
behavioral2/memory/4108-193-0x00007FF794A30000-0x00007FF794D84000-memory.dmp	xmrig
behavioral2/memory/872-198-0x00007FF6CCCA0000-0x00007FF6CCFF4000-memory.dmp	xmrig
behavioral2/memory/4516-200-0x00007FF738E40000-0x00007FF739194000-memory.dmp	xmrig
behavioral2/memory/968-199-0x00007FF61C9D0000-0x00007FF61CD24000-memory.dmp	xmrig
behavioral2/memory/1404-194-0x00007FF67DF00000-0x00007FF67E254000-memory.dmp	xmrig
behavioral2/files/0x000700000002341d-188.dat	xmrig
behavioral2/files/0x000700000002341c-187.dat	xmrig
behavioral2/memory/5068-183-0x00007FF65F430000-0x00007FF65F784000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-182.dat	xmrig
behavioral2/files/0x000700000002341b-176.dat	xmrig
behavioral2/files/0x000700000002341a-173.dat	xmrig
behavioral2/memory/4044-172-0x00007FF7806D0000-0x00007FF780A24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-169.dat	xmrig
behavioral2/files/0x0007000000023419-168.dat	xmrig
behavioral2/files/0x0007000000023412-163.dat	xmrig
behavioral2/files/0x0007000000023417-160.dat	xmrig
behavioral2/files/0x00080000000233fc-157.dat	xmrig
behavioral2/memory/888-153-0x00007FF78F650000-0x00007FF78F9A4000-memory.dmp	xmrig
behavioral2/memory/3844-146-0x00007FF66C570000-0x00007FF66C8C4000-memory.dmp	xmrig
behavioral2/files/0x000800000002340f-148.dat	xmrig
behavioral2/files/0x0008000000023411-140.dat	xmrig
behavioral2/memory/664-133-0x00007FF634AD0000-0x00007FF634E24000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4120	PbWjacQ.exe
2948	lVprdgA.exe
5040	geVtzRY.exe
212	VxNLiEK.exe
2132	gReypmR.exe
2360	cNsewLj.exe
1656	qTShxqC.exe
2724	lJnqPfO.exe
2536	mXMOLOw.exe
1324	CEeRyRq.exe
4072	WAwQDHS.exe
3068	ztmnXWm.exe
2872	MGwNjHY.exe
4356	jUGupCI.exe
1276	QEfxQNG.exe
4088	IPSSRaN.exe
908	yYAmbeK.exe
4576	DiHOFSs.exe
664	kFXoWrO.exe
4108	gtWhyWM.exe
1404	QZdhfNx.exe
872	xFXjHpH.exe
3844	uBUuHhm.exe
968	yucNmSu.exe
888	pNcdIlN.exe
4044	cbWLach.exe
4516	RsTfgjx.exe
5068	lnXwKHo.exe
3628	nIiKGWb.exe
3268	jbrXqwA.exe
844	GJjAmzC.exe
3020	bMcUgmG.exe
1856	vnYBoCW.exe
3364	yfMiHZo.exe
4564	AoiokBz.exe
3404	NTSrPUY.exe
4008	KLrOjCt.exe
4528	HmgyOmc.exe
2540	yaznEwI.exe
3436	IjmRtnf.exe
1560	DWRBedR.exe
4168	hdYIkew.exe
1804	FuvtyxZ.exe
3344	gVVGJTR.exe
4768	kwqduxi.exe
2152	uIsagOe.exe
1164	QtMYAIX.exe
2660	wYgQYUg.exe
668	WiEFqFJ.exe
1724	VNECZwd.exe
3284	eFKuKZq.exe
4680	PBECCmw.exe
4324	iNAaihc.exe
3340	sCpoqdy.exe
4948	rhiRZWG.exe
1236	uqNqLYk.exe
3516	wltZnET.exe
2088	vHnyyaA.exe
4812	KyMMyRT.exe
4652	eILRbHP.exe
3796	idnseGT.exe
3036	zCxCAKt.exe
3704	fFJHfSx.exe
5084	qkWdrjN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1228-0-0x00007FF79E8C0000-0x00007FF79EC14000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-11.dat	upx
behavioral2/files/0x00080000000233fe-15.dat	upx
behavioral2/files/0x00080000000233fb-13.dat	upx
behavioral2/memory/4120-10-0x00007FF790B60000-0x00007FF790EB4000-memory.dmp	upx
behavioral2/files/0x0007000000023402-39.dat	upx
behavioral2/files/0x0007000000023406-44.dat	upx
behavioral2/files/0x0007000000023408-57.dat	upx
behavioral2/files/0x0007000000023407-76.dat	upx
behavioral2/memory/2724-91-0x00007FF767F40000-0x00007FF768294000-memory.dmp	upx
behavioral2/files/0x000700000002340d-99.dat	upx
behavioral2/memory/4576-105-0x00007FF6AADC0000-0x00007FF6AB114000-memory.dmp	upx
behavioral2/memory/4356-108-0x00007FF79DF80000-0x00007FF79E2D4000-memory.dmp	upx
behavioral2/memory/4088-110-0x00007FF65B310000-0x00007FF65B664000-memory.dmp	upx
behavioral2/memory/1276-109-0x00007FF779860000-0x00007FF779BB4000-memory.dmp	upx
behavioral2/memory/4072-107-0x00007FF73FD10000-0x00007FF740064000-memory.dmp	upx
behavioral2/memory/212-106-0x00007FF64D550000-0x00007FF64D8A4000-memory.dmp	upx
behavioral2/memory/908-104-0x00007FF753360000-0x00007FF7536B4000-memory.dmp	upx
behavioral2/memory/2872-103-0x00007FF64DAE0000-0x00007FF64DE34000-memory.dmp	upx
behavioral2/memory/3068-102-0x00007FF67A520000-0x00007FF67A874000-memory.dmp	upx
behavioral2/memory/1324-101-0x00007FF7F9B20000-0x00007FF7F9E74000-memory.dmp	upx
behavioral2/files/0x000700000002340c-97.dat	upx
behavioral2/files/0x000700000002340b-95.dat	upx
behavioral2/memory/2536-94-0x00007FF7E7B70000-0x00007FF7E7EC4000-memory.dmp	upx
behavioral2/files/0x000700000002340a-92.dat	upx
behavioral2/memory/1656-81-0x00007FF7A6D70000-0x00007FF7A70C4000-memory.dmp	upx
behavioral2/files/0x0007000000023404-70.dat	upx
behavioral2/memory/2360-69-0x00007FF75D400000-0x00007FF75D754000-memory.dmp	upx
behavioral2/files/0x0007000000023400-64.dat	upx
behavioral2/files/0x0007000000023409-62.dat	upx
behavioral2/files/0x0007000000023405-61.dat	upx
behavioral2/memory/2132-59-0x00007FF6A7B50000-0x00007FF6A7EA4000-memory.dmp	upx
behavioral2/files/0x0007000000023403-55.dat	upx
behavioral2/files/0x0007000000023401-53.dat	upx
behavioral2/memory/2948-49-0x00007FF6236E0000-0x00007FF623A34000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-42.dat	upx
behavioral2/memory/5040-25-0x00007FF609B30000-0x00007FF609E84000-memory.dmp	upx
behavioral2/files/0x000700000002340e-112.dat	upx
behavioral2/files/0x0007000000023413-143.dat	upx
behavioral2/files/0x0007000000023414-156.dat	upx
behavioral2/files/0x0007000000023418-177.dat	upx
behavioral2/memory/3628-192-0x00007FF64C280000-0x00007FF64C5D4000-memory.dmp	upx
behavioral2/memory/4108-193-0x00007FF794A30000-0x00007FF794D84000-memory.dmp	upx
behavioral2/memory/872-198-0x00007FF6CCCA0000-0x00007FF6CCFF4000-memory.dmp	upx
behavioral2/memory/4516-200-0x00007FF738E40000-0x00007FF739194000-memory.dmp	upx
behavioral2/memory/968-199-0x00007FF61C9D0000-0x00007FF61CD24000-memory.dmp	upx
behavioral2/memory/1404-194-0x00007FF67DF00000-0x00007FF67E254000-memory.dmp	upx
behavioral2/files/0x000700000002341d-188.dat	upx
behavioral2/files/0x000700000002341c-187.dat	upx
behavioral2/memory/5068-183-0x00007FF65F430000-0x00007FF65F784000-memory.dmp	upx
behavioral2/files/0x0007000000023415-182.dat	upx
behavioral2/files/0x000700000002341b-176.dat	upx
behavioral2/files/0x000700000002341a-173.dat	upx
behavioral2/memory/4044-172-0x00007FF7806D0000-0x00007FF780A24000-memory.dmp	upx
behavioral2/files/0x0007000000023416-169.dat	upx
behavioral2/files/0x0007000000023419-168.dat	upx
behavioral2/files/0x0007000000023412-163.dat	upx
behavioral2/files/0x0007000000023417-160.dat	upx
behavioral2/files/0x00080000000233fc-157.dat	upx
behavioral2/memory/888-153-0x00007FF78F650000-0x00007FF78F9A4000-memory.dmp	upx
behavioral2/memory/3844-146-0x00007FF66C570000-0x00007FF66C8C4000-memory.dmp	upx
behavioral2/files/0x000800000002340f-148.dat	upx
behavioral2/files/0x0008000000023411-140.dat	upx
behavioral2/memory/664-133-0x00007FF634AD0000-0x00007FF634E24000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IJNmbfh.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\awjyunw.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\SpWWivm.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\KgruURb.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\iobxfYN.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\nuSGyIk.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\wITeJUw.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\rKXTSGB.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\tfJeCIz.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\zIxeIbj.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\bLdJipw.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\CdcyBOX.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\lREdduA.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\KMrDCAV.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\AyslqtV.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\RcRVGVB.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\yngcvkx.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\GrtWdEQ.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\ceOvMAU.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\EGbPysR.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\egfvdbH.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\mdNZeaa.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\htOwyFO.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\JqZXixs.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\sCpoqdy.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\nIvMiCS.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\HonFSQr.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\roBVHej.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\gvLPTjA.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\SORGONX.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\rRkFpym.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\JYFPhmG.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\gcVoSEJ.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\bwlaDbf.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\OkELSxQ.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\KrJdKMN.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\PfjJuSp.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\cWgsaHf.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\FJEwjqD.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\TAbZViw.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\Slwaomk.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\WAYMBqd.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\SAchrcZ.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\VTpNbrf.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\UKHaJVs.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\WuYVaft.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\qBboFcH.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\uYslVlZ.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\TToFXhL.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\HzgtIXz.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\dinZLYh.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\cbWLach.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\ACyizqT.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\OXNigXZ.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\SuFpBlF.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\wGyIVCz.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\YkniEOm.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\mYwjrBS.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\kvLYTJA.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\KtHThXQ.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\yUlrTsI.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\IiXmfdQ.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\eGjOPBe.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe
File created	C:\Windows\System\lmwbCoi.exe	65db4567af98c936b55e930ca8d8be10_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 4120	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	82
PID 1228 wrote to memory of 4120	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	82
PID 1228 wrote to memory of 2948	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	83
PID 1228 wrote to memory of 2948	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	83
PID 1228 wrote to memory of 5040	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	84
PID 1228 wrote to memory of 5040	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	84
PID 1228 wrote to memory of 2132	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	85
PID 1228 wrote to memory of 2132	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	85
PID 1228 wrote to memory of 212	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	86
PID 1228 wrote to memory of 212	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	86
PID 1228 wrote to memory of 2360	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	87
PID 1228 wrote to memory of 2360	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	87
PID 1228 wrote to memory of 2724	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	88
PID 1228 wrote to memory of 2724	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	88
PID 1228 wrote to memory of 1656	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	89
PID 1228 wrote to memory of 1656	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	89
PID 1228 wrote to memory of 4072	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	90
PID 1228 wrote to memory of 4072	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	90
PID 1228 wrote to memory of 2536	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	91
PID 1228 wrote to memory of 2536	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	91
PID 1228 wrote to memory of 1324	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	92
PID 1228 wrote to memory of 1324	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	92
PID 1228 wrote to memory of 3068	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	93
PID 1228 wrote to memory of 3068	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	93
PID 1228 wrote to memory of 2872	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	94
PID 1228 wrote to memory of 2872	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	94
PID 1228 wrote to memory of 4356	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	95
PID 1228 wrote to memory of 4356	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	95
PID 1228 wrote to memory of 1276	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	96
PID 1228 wrote to memory of 1276	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	96
PID 1228 wrote to memory of 4088	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	97
PID 1228 wrote to memory of 4088	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	97
PID 1228 wrote to memory of 908	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	98
PID 1228 wrote to memory of 908	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	98
PID 1228 wrote to memory of 4576	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	99
PID 1228 wrote to memory of 4576	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	99
PID 1228 wrote to memory of 664	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	102
PID 1228 wrote to memory of 664	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	102
PID 1228 wrote to memory of 4108	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	103
PID 1228 wrote to memory of 4108	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	103
PID 1228 wrote to memory of 1404	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	104
PID 1228 wrote to memory of 1404	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	104
PID 1228 wrote to memory of 872	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	105
PID 1228 wrote to memory of 872	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	105
PID 1228 wrote to memory of 3844	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	106
PID 1228 wrote to memory of 3844	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	106
PID 1228 wrote to memory of 968	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	107
PID 1228 wrote to memory of 968	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	107
PID 1228 wrote to memory of 888	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	108
PID 1228 wrote to memory of 888	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	108
PID 1228 wrote to memory of 4516	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	109
PID 1228 wrote to memory of 4516	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	109
PID 1228 wrote to memory of 4044	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	110
PID 1228 wrote to memory of 4044	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	110
PID 1228 wrote to memory of 3268	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	111
PID 1228 wrote to memory of 3268	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	111
PID 1228 wrote to memory of 5068	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	112
PID 1228 wrote to memory of 5068	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	112
PID 1228 wrote to memory of 1856	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	113
PID 1228 wrote to memory of 1856	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	113
PID 1228 wrote to memory of 3628	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	114
PID 1228 wrote to memory of 3628	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	114
PID 1228 wrote to memory of 844	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	115
PID 1228 wrote to memory of 844	1228	65db4567af98c936b55e930ca8d8be10_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\65db4567af98c936b55e930ca8d8be10_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\65db4567af98c936b55e930ca8d8be10_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\System\PbWjacQ.exe
  C:\Windows\System\PbWjacQ.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\lVprdgA.exe
  C:\Windows\System\lVprdgA.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\geVtzRY.exe
  C:\Windows\System\geVtzRY.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\gReypmR.exe
  C:\Windows\System\gReypmR.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\VxNLiEK.exe
  C:\Windows\System\VxNLiEK.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\cNsewLj.exe
  C:\Windows\System\cNsewLj.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\lJnqPfO.exe
  C:\Windows\System\lJnqPfO.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\qTShxqC.exe
  C:\Windows\System\qTShxqC.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\WAwQDHS.exe
  C:\Windows\System\WAwQDHS.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\mXMOLOw.exe
  C:\Windows\System\mXMOLOw.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\CEeRyRq.exe
  C:\Windows\System\CEeRyRq.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\ztmnXWm.exe
  C:\Windows\System\ztmnXWm.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\MGwNjHY.exe
  C:\Windows\System\MGwNjHY.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\jUGupCI.exe
  C:\Windows\System\jUGupCI.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\QEfxQNG.exe
  C:\Windows\System\QEfxQNG.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\IPSSRaN.exe
  C:\Windows\System\IPSSRaN.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\yYAmbeK.exe
  C:\Windows\System\yYAmbeK.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\DiHOFSs.exe
  C:\Windows\System\DiHOFSs.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\kFXoWrO.exe
  C:\Windows\System\kFXoWrO.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\gtWhyWM.exe
  C:\Windows\System\gtWhyWM.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\QZdhfNx.exe
  C:\Windows\System\QZdhfNx.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\xFXjHpH.exe
  C:\Windows\System\xFXjHpH.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\uBUuHhm.exe
  C:\Windows\System\uBUuHhm.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\yucNmSu.exe
  C:\Windows\System\yucNmSu.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\pNcdIlN.exe
  C:\Windows\System\pNcdIlN.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\RsTfgjx.exe
  C:\Windows\System\RsTfgjx.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\cbWLach.exe
  C:\Windows\System\cbWLach.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\jbrXqwA.exe
  C:\Windows\System\jbrXqwA.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\lnXwKHo.exe
  C:\Windows\System\lnXwKHo.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\vnYBoCW.exe
  C:\Windows\System\vnYBoCW.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\nIiKGWb.exe
  C:\Windows\System\nIiKGWb.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\GJjAmzC.exe
  C:\Windows\System\GJjAmzC.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\bMcUgmG.exe
  C:\Windows\System\bMcUgmG.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\yfMiHZo.exe
  C:\Windows\System\yfMiHZo.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\AoiokBz.exe
  C:\Windows\System\AoiokBz.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\NTSrPUY.exe
  C:\Windows\System\NTSrPUY.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\KLrOjCt.exe
  C:\Windows\System\KLrOjCt.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\HmgyOmc.exe
  C:\Windows\System\HmgyOmc.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\yaznEwI.exe
  C:\Windows\System\yaznEwI.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\IjmRtnf.exe
  C:\Windows\System\IjmRtnf.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\DWRBedR.exe
  C:\Windows\System\DWRBedR.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\hdYIkew.exe
  C:\Windows\System\hdYIkew.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\FuvtyxZ.exe
  C:\Windows\System\FuvtyxZ.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\gVVGJTR.exe
  C:\Windows\System\gVVGJTR.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\kwqduxi.exe
  C:\Windows\System\kwqduxi.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\uIsagOe.exe
  C:\Windows\System\uIsagOe.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\QtMYAIX.exe
  C:\Windows\System\QtMYAIX.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\wYgQYUg.exe
  C:\Windows\System\wYgQYUg.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\WiEFqFJ.exe
  C:\Windows\System\WiEFqFJ.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\VNECZwd.exe
  C:\Windows\System\VNECZwd.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\eFKuKZq.exe
  C:\Windows\System\eFKuKZq.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\PBECCmw.exe
  C:\Windows\System\PBECCmw.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\iNAaihc.exe
  C:\Windows\System\iNAaihc.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\sCpoqdy.exe
  C:\Windows\System\sCpoqdy.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\rhiRZWG.exe
  C:\Windows\System\rhiRZWG.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\uqNqLYk.exe
  C:\Windows\System\uqNqLYk.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\wltZnET.exe
  C:\Windows\System\wltZnET.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\vHnyyaA.exe
  C:\Windows\System\vHnyyaA.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\KyMMyRT.exe
  C:\Windows\System\KyMMyRT.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\eILRbHP.exe
  C:\Windows\System\eILRbHP.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\idnseGT.exe
  C:\Windows\System\idnseGT.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\zCxCAKt.exe
  C:\Windows\System\zCxCAKt.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\fFJHfSx.exe
  C:\Windows\System\fFJHfSx.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\qkWdrjN.exe
  C:\Windows\System\qkWdrjN.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\QbvXOTr.exe
  C:\Windows\System\QbvXOTr.exe
  2⤵
  PID:4352
- C:\Windows\System\urrMVFO.exe
  C:\Windows\System\urrMVFO.exe
  2⤵
  PID:1232
- C:\Windows\System\mEmiDZT.exe
  C:\Windows\System\mEmiDZT.exe
  2⤵
  PID:2284
- C:\Windows\System\DoruIBh.exe
  C:\Windows\System\DoruIBh.exe
  2⤵
  PID:1896
- C:\Windows\System\dLYKFKR.exe
  C:\Windows\System\dLYKFKR.exe
  2⤵
  PID:1180
- C:\Windows\System\KpZLjPp.exe
  C:\Windows\System\KpZLjPp.exe
  2⤵
  PID:2140
- C:\Windows\System\iobxfYN.exe
  C:\Windows\System\iobxfYN.exe
  2⤵
  PID:1188
- C:\Windows\System\MYfakJB.exe
  C:\Windows\System\MYfakJB.exe
  2⤵
  PID:4916
- C:\Windows\System\pYHIqfb.exe
  C:\Windows\System\pYHIqfb.exe
  2⤵
  PID:932
- C:\Windows\System\XeZJsLv.exe
  C:\Windows\System\XeZJsLv.exe
  2⤵
  PID:2608
- C:\Windows\System\GlbWSft.exe
  C:\Windows\System\GlbWSft.exe
  2⤵
  PID:1712
- C:\Windows\System\tyURtun.exe
  C:\Windows\System\tyURtun.exe
  2⤵
  PID:2176
- C:\Windows\System\PcwjGCW.exe
  C:\Windows\System\PcwjGCW.exe
  2⤵
  PID:3968
- C:\Windows\System\voYJvGr.exe
  C:\Windows\System\voYJvGr.exe
  2⤵
  PID:3940
- C:\Windows\System\uynGhod.exe
  C:\Windows\System\uynGhod.exe
  2⤵
  PID:5104
- C:\Windows\System\HsCaJBn.exe
  C:\Windows\System\HsCaJBn.exe
  2⤵
  PID:4408
- C:\Windows\System\lAmRPtt.exe
  C:\Windows\System\lAmRPtt.exe
  2⤵
  PID:1992
- C:\Windows\System\gpWesnp.exe
  C:\Windows\System\gpWesnp.exe
  2⤵
  PID:1848
- C:\Windows\System\sWOjCtW.exe
  C:\Windows\System\sWOjCtW.exe
  2⤵
  PID:936
- C:\Windows\System\riSOLLS.exe
  C:\Windows\System\riSOLLS.exe
  2⤵
  PID:3456
- C:\Windows\System\wlMarOO.exe
  C:\Windows\System\wlMarOO.exe
  2⤵
  PID:4928
- C:\Windows\System\lsRZGCS.exe
  C:\Windows\System\lsRZGCS.exe
  2⤵
  PID:1388
- C:\Windows\System\RweBnaH.exe
  C:\Windows\System\RweBnaH.exe
  2⤵
  PID:1932
- C:\Windows\System\QamqXds.exe
  C:\Windows\System\QamqXds.exe
  2⤵
  PID:2624
- C:\Windows\System\rWutstf.exe
  C:\Windows\System\rWutstf.exe
  2⤵
  PID:1452
- C:\Windows\System\DZxSdGc.exe
  C:\Windows\System\DZxSdGc.exe
  2⤵
  PID:5004
- C:\Windows\System\VRVVKPQ.exe
  C:\Windows\System\VRVVKPQ.exe
  2⤵
  PID:768
- C:\Windows\System\rRkFpym.exe
  C:\Windows\System\rRkFpym.exe
  2⤵
  PID:5132
- C:\Windows\System\otUVvbC.exe
  C:\Windows\System\otUVvbC.exe
  2⤵
  PID:5156
- C:\Windows\System\xeFsPHP.exe
  C:\Windows\System\xeFsPHP.exe
  2⤵
  PID:5184
- C:\Windows\System\mhYRUFO.exe
  C:\Windows\System\mhYRUFO.exe
  2⤵
  PID:5220
- C:\Windows\System\YkniEOm.exe
  C:\Windows\System\YkniEOm.exe
  2⤵
  PID:5248
- C:\Windows\System\VNmsenI.exe
  C:\Windows\System\VNmsenI.exe
  2⤵
  PID:5268
- C:\Windows\System\lbWEqwu.exe
  C:\Windows\System\lbWEqwu.exe
  2⤵
  PID:5300
- C:\Windows\System\bsNKzbp.exe
  C:\Windows\System\bsNKzbp.exe
  2⤵
  PID:5324
- C:\Windows\System\mYwjrBS.exe
  C:\Windows\System\mYwjrBS.exe
  2⤵
  PID:5352
- C:\Windows\System\PlQDLVK.exe
  C:\Windows\System\PlQDLVK.exe
  2⤵
  PID:5380
- C:\Windows\System\SqapLgG.exe
  C:\Windows\System\SqapLgG.exe
  2⤵
  PID:5408
- C:\Windows\System\qwOcLpo.exe
  C:\Windows\System\qwOcLpo.exe
  2⤵
  PID:5428
- C:\Windows\System\YdaPaMO.exe
  C:\Windows\System\YdaPaMO.exe
  2⤵
  PID:5464
- C:\Windows\System\ZewGuNa.exe
  C:\Windows\System\ZewGuNa.exe
  2⤵
  PID:5496
- C:\Windows\System\RcRVGVB.exe
  C:\Windows\System\RcRVGVB.exe
  2⤵
  PID:5524
- C:\Windows\System\OCGNrDG.exe
  C:\Windows\System\OCGNrDG.exe
  2⤵
  PID:5548
- C:\Windows\System\NJvRLQz.exe
  C:\Windows\System\NJvRLQz.exe
  2⤵
  PID:5568
- C:\Windows\System\pkpTjLc.exe
  C:\Windows\System\pkpTjLc.exe
  2⤵
  PID:5596
- C:\Windows\System\tyOiieK.exe
  C:\Windows\System\tyOiieK.exe
  2⤵
  PID:5628
- C:\Windows\System\SvygIRo.exe
  C:\Windows\System\SvygIRo.exe
  2⤵
  PID:5660
- C:\Windows\System\vkBumEA.exe
  C:\Windows\System\vkBumEA.exe
  2⤵
  PID:5684
- C:\Windows\System\iyAgwKn.exe
  C:\Windows\System\iyAgwKn.exe
  2⤵
  PID:5712
- C:\Windows\System\MNKuHPt.exe
  C:\Windows\System\MNKuHPt.exe
  2⤵
  PID:5736
- C:\Windows\System\zIPxKid.exe
  C:\Windows\System\zIPxKid.exe
  2⤵
  PID:5768
- C:\Windows\System\ibWeNQd.exe
  C:\Windows\System\ibWeNQd.exe
  2⤵
  PID:5796
- C:\Windows\System\RtApnHO.exe
  C:\Windows\System\RtApnHO.exe
  2⤵
  PID:5832
- C:\Windows\System\oCZCLvj.exe
  C:\Windows\System\oCZCLvj.exe
  2⤵
  PID:5864
- C:\Windows\System\afUNNLD.exe
  C:\Windows\System\afUNNLD.exe
  2⤵
  PID:5892
- C:\Windows\System\NxdDDWe.exe
  C:\Windows\System\NxdDDWe.exe
  2⤵
  PID:5920
- C:\Windows\System\tJeiMVO.exe
  C:\Windows\System\tJeiMVO.exe
  2⤵
  PID:5948
- C:\Windows\System\UEOwQtZ.exe
  C:\Windows\System\UEOwQtZ.exe
  2⤵
  PID:5976
- C:\Windows\System\kvLYTJA.exe
  C:\Windows\System\kvLYTJA.exe
  2⤵
  PID:6004
- C:\Windows\System\ldIIqxm.exe
  C:\Windows\System\ldIIqxm.exe
  2⤵
  PID:6036
- C:\Windows\System\nuSGyIk.exe
  C:\Windows\System\nuSGyIk.exe
  2⤵
  PID:6056
- C:\Windows\System\AYxivTf.exe
  C:\Windows\System\AYxivTf.exe
  2⤵
  PID:6080
- C:\Windows\System\brtSLbn.exe
  C:\Windows\System\brtSLbn.exe
  2⤵
  PID:6104
- C:\Windows\System\EfWpqXn.exe
  C:\Windows\System\EfWpqXn.exe
  2⤵
  PID:6140
- C:\Windows\System\fhrGGaz.exe
  C:\Windows\System\fhrGGaz.exe
  2⤵
  PID:5176
- C:\Windows\System\zCbJIjz.exe
  C:\Windows\System\zCbJIjz.exe
  2⤵
  PID:5228
- C:\Windows\System\jzbsBGV.exe
  C:\Windows\System\jzbsBGV.exe
  2⤵
  PID:5280
- C:\Windows\System\FqCJKLu.exe
  C:\Windows\System\FqCJKLu.exe
  2⤵
  PID:5340
- C:\Windows\System\WEduCWr.exe
  C:\Windows\System\WEduCWr.exe
  2⤵
  PID:5420
- C:\Windows\System\WuYVaft.exe
  C:\Windows\System\WuYVaft.exe
  2⤵
  PID:5508
- C:\Windows\System\OpqPGIt.exe
  C:\Windows\System\OpqPGIt.exe
  2⤵
  PID:5544
- C:\Windows\System\JoGRcBc.exe
  C:\Windows\System\JoGRcBc.exe
  2⤵
  PID:5644
- C:\Windows\System\PaOPWfi.exe
  C:\Windows\System\PaOPWfi.exe
  2⤵
  PID:5720
- C:\Windows\System\oyudXee.exe
  C:\Windows\System\oyudXee.exe
  2⤵
  PID:5792
- C:\Windows\System\vyONlKU.exe
  C:\Windows\System\vyONlKU.exe
  2⤵
  PID:5816
- C:\Windows\System\cSGimbq.exe
  C:\Windows\System\cSGimbq.exe
  2⤵
  PID:5904
- C:\Windows\System\JbZCSTI.exe
  C:\Windows\System\JbZCSTI.exe
  2⤵
  PID:5960
- C:\Windows\System\gwuXJqI.exe
  C:\Windows\System\gwuXJqI.exe
  2⤵
  PID:6048
- C:\Windows\System\iMvKPzt.exe
  C:\Windows\System\iMvKPzt.exe
  2⤵
  PID:6116
- C:\Windows\System\Slwaomk.exe
  C:\Windows\System\Slwaomk.exe
  2⤵
  PID:5152
- C:\Windows\System\xJQmnfy.exe
  C:\Windows\System\xJQmnfy.exe
  2⤵
  PID:5244
- C:\Windows\System\xjLPZpx.exe
  C:\Windows\System\xjLPZpx.exe
  2⤵
  PID:5400
- C:\Windows\System\PShDpQM.exe
  C:\Windows\System\PShDpQM.exe
  2⤵
  PID:5636
- C:\Windows\System\IJNmbfh.exe
  C:\Windows\System\IJNmbfh.exe
  2⤵
  PID:5784
- C:\Windows\System\XtIoutG.exe
  C:\Windows\System\XtIoutG.exe
  2⤵
  PID:5940
- C:\Windows\System\iorXFtO.exe
  C:\Windows\System\iorXFtO.exe
  2⤵
  PID:6044
- C:\Windows\System\rVgfEHQ.exe
  C:\Windows\System\rVgfEHQ.exe
  2⤵
  PID:5348
- C:\Windows\System\eCUTKOV.exe
  C:\Windows\System\eCUTKOV.exe
  2⤵
  PID:5752
- C:\Windows\System\TFDUtmP.exe
  C:\Windows\System\TFDUtmP.exe
  2⤵
  PID:6092
- C:\Windows\System\wdcDUna.exe
  C:\Windows\System\wdcDUna.exe
  2⤵
  PID:5888
- C:\Windows\System\faCHjQu.exe
  C:\Windows\System\faCHjQu.exe
  2⤵
  PID:6148
- C:\Windows\System\ddRdvze.exe
  C:\Windows\System\ddRdvze.exe
  2⤵
  PID:6172
- C:\Windows\System\HMZrSoC.exe
  C:\Windows\System\HMZrSoC.exe
  2⤵
  PID:6196
- C:\Windows\System\KrJdKMN.exe
  C:\Windows\System\KrJdKMN.exe
  2⤵
  PID:6228
- C:\Windows\System\wPeYJsv.exe
  C:\Windows\System\wPeYJsv.exe
  2⤵
  PID:6260
- C:\Windows\System\WAYMBqd.exe
  C:\Windows\System\WAYMBqd.exe
  2⤵
  PID:6292
- C:\Windows\System\NnwuUAL.exe
  C:\Windows\System\NnwuUAL.exe
  2⤵
  PID:6324
- C:\Windows\System\wUAZMJz.exe
  C:\Windows\System\wUAZMJz.exe
  2⤵
  PID:6340
- C:\Windows\System\agVZsbr.exe
  C:\Windows\System\agVZsbr.exe
  2⤵
  PID:6376
- C:\Windows\System\kmBhYBW.exe
  C:\Windows\System\kmBhYBW.exe
  2⤵
  PID:6396
- C:\Windows\System\zWhJtxB.exe
  C:\Windows\System\zWhJtxB.exe
  2⤵
  PID:6424
- C:\Windows\System\DJHroag.exe
  C:\Windows\System\DJHroag.exe
  2⤵
  PID:6464
- C:\Windows\System\IjdvjRB.exe
  C:\Windows\System\IjdvjRB.exe
  2⤵
  PID:6492
- C:\Windows\System\wITeJUw.exe
  C:\Windows\System\wITeJUw.exe
  2⤵
  PID:6516
- C:\Windows\System\miSjCUt.exe
  C:\Windows\System\miSjCUt.exe
  2⤵
  PID:6544
- C:\Windows\System\yngcvkx.exe
  C:\Windows\System\yngcvkx.exe
  2⤵
  PID:6572
- C:\Windows\System\CHNhnva.exe
  C:\Windows\System\CHNhnva.exe
  2⤵
  PID:6596
- C:\Windows\System\bjwTAIO.exe
  C:\Windows\System\bjwTAIO.exe
  2⤵
  PID:6612
- C:\Windows\System\xUdmbjh.exe
  C:\Windows\System\xUdmbjh.exe
  2⤵
  PID:6648
- C:\Windows\System\RaTCIZf.exe
  C:\Windows\System\RaTCIZf.exe
  2⤵
  PID:6680
- C:\Windows\System\zfbfDaX.exe
  C:\Windows\System\zfbfDaX.exe
  2⤵
  PID:6700
- C:\Windows\System\KVnZGBf.exe
  C:\Windows\System\KVnZGBf.exe
  2⤵
  PID:6736
- C:\Windows\System\nIvMiCS.exe
  C:\Windows\System\nIvMiCS.exe
  2⤵
  PID:6772
- C:\Windows\System\fyFQzcZ.exe
  C:\Windows\System\fyFQzcZ.exe
  2⤵
  PID:6796
- C:\Windows\System\kStELUL.exe
  C:\Windows\System\kStELUL.exe
  2⤵
  PID:6824
- C:\Windows\System\AHXNDWT.exe
  C:\Windows\System\AHXNDWT.exe
  2⤵
  PID:6856
- C:\Windows\System\dlEmLHQ.exe
  C:\Windows\System\dlEmLHQ.exe
  2⤵
  PID:6884
- C:\Windows\System\jzMrNhC.exe
  C:\Windows\System\jzMrNhC.exe
  2⤵
  PID:6916
- C:\Windows\System\zHmLuQx.exe
  C:\Windows\System\zHmLuQx.exe
  2⤵
  PID:6932
- C:\Windows\System\FHrtNVL.exe
  C:\Windows\System\FHrtNVL.exe
  2⤵
  PID:6964
- C:\Windows\System\oWPqVpW.exe
  C:\Windows\System\oWPqVpW.exe
  2⤵
  PID:6996
- C:\Windows\System\ichuxKM.exe
  C:\Windows\System\ichuxKM.exe
  2⤵
  PID:7028
- C:\Windows\System\mhoJizo.exe
  C:\Windows\System\mhoJizo.exe
  2⤵
  PID:7052
- C:\Windows\System\mvsJhOK.exe
  C:\Windows\System\mvsJhOK.exe
  2⤵
  PID:7072
- C:\Windows\System\AaaEAVY.exe
  C:\Windows\System\AaaEAVY.exe
  2⤵
  PID:7116
- C:\Windows\System\zQZJWrd.exe
  C:\Windows\System\zQZJWrd.exe
  2⤵
  PID:7140
- C:\Windows\System\lmwbCoi.exe
  C:\Windows\System\lmwbCoi.exe
  2⤵
  PID:7156
- C:\Windows\System\CnUNcMH.exe
  C:\Windows\System\CnUNcMH.exe
  2⤵
  PID:6168
- C:\Windows\System\YouMWYl.exe
  C:\Windows\System\YouMWYl.exe
  2⤵
  PID:6224
- C:\Windows\System\AYoQRWY.exe
  C:\Windows\System\AYoQRWY.exe
  2⤵
  PID:6312
- C:\Windows\System\BtKLVoq.exe
  C:\Windows\System\BtKLVoq.exe
  2⤵
  PID:6408
- C:\Windows\System\QJpbthk.exe
  C:\Windows\System\QJpbthk.exe
  2⤵
  PID:6448
- C:\Windows\System\KJvGprw.exe
  C:\Windows\System\KJvGprw.exe
  2⤵
  PID:6508
- C:\Windows\System\plDXVrS.exe
  C:\Windows\System\plDXVrS.exe
  2⤵
  PID:6608
- C:\Windows\System\nDsPGgz.exe
  C:\Windows\System\nDsPGgz.exe
  2⤵
  PID:6664
- C:\Windows\System\vwVgvTt.exe
  C:\Windows\System\vwVgvTt.exe
  2⤵
  PID:6696
- C:\Windows\System\eGIRuWV.exe
  C:\Windows\System\eGIRuWV.exe
  2⤵
  PID:6804
- C:\Windows\System\dJpiNrY.exe
  C:\Windows\System\dJpiNrY.exe
  2⤵
  PID:6840
- C:\Windows\System\UGmLlHW.exe
  C:\Windows\System\UGmLlHW.exe
  2⤵
  PID:6908
- C:\Windows\System\GavxIjB.exe
  C:\Windows\System\GavxIjB.exe
  2⤵
  PID:6988
- C:\Windows\System\AlUFhGl.exe
  C:\Windows\System\AlUFhGl.exe
  2⤵
  PID:7040
- C:\Windows\System\YbiXLtC.exe
  C:\Windows\System\YbiXLtC.exe
  2⤵
  PID:184
- C:\Windows\System\PZeMYya.exe
  C:\Windows\System\PZeMYya.exe
  2⤵
  PID:7148
- C:\Windows\System\NFfvlZs.exe
  C:\Windows\System\NFfvlZs.exe
  2⤵
  PID:6308
- C:\Windows\System\ADlqjOg.exe
  C:\Windows\System\ADlqjOg.exe
  2⤵
  PID:6416
- C:\Windows\System\GNUYAtI.exe
  C:\Windows\System\GNUYAtI.exe
  2⤵
  PID:6580
- C:\Windows\System\fCuTtxu.exe
  C:\Windows\System\fCuTtxu.exe
  2⤵
  PID:6672
- C:\Windows\System\HhnYEuC.exe
  C:\Windows\System\HhnYEuC.exe
  2⤵
  PID:6792
- C:\Windows\System\DRZHilt.exe
  C:\Windows\System\DRZHilt.exe
  2⤵
  PID:7012
- C:\Windows\System\WHbbhpj.exe
  C:\Windows\System\WHbbhpj.exe
  2⤵
  PID:6276
- C:\Windows\System\bTNOoEa.exe
  C:\Windows\System\bTNOoEa.exe
  2⤵
  PID:6476
- C:\Windows\System\wCMtLAu.exe
  C:\Windows\System\wCMtLAu.exe
  2⤵
  PID:6748
- C:\Windows\System\NBPVWuf.exe
  C:\Windows\System\NBPVWuf.exe
  2⤵
  PID:7092
- C:\Windows\System\SEhTVZc.exe
  C:\Windows\System\SEhTVZc.exe
  2⤵
  PID:7108
- C:\Windows\System\hnzWgqw.exe
  C:\Windows\System\hnzWgqw.exe
  2⤵
  PID:7188
- C:\Windows\System\hikQScv.exe
  C:\Windows\System\hikQScv.exe
  2⤵
  PID:7204
- C:\Windows\System\iGcZfLm.exe
  C:\Windows\System\iGcZfLm.exe
  2⤵
  PID:7232
- C:\Windows\System\siAtVgP.exe
  C:\Windows\System\siAtVgP.exe
  2⤵
  PID:7252
- C:\Windows\System\HXCVGbI.exe
  C:\Windows\System\HXCVGbI.exe
  2⤵
  PID:7268
- C:\Windows\System\UbKrXEH.exe
  C:\Windows\System\UbKrXEH.exe
  2⤵
  PID:7300
- C:\Windows\System\vzIrmEb.exe
  C:\Windows\System\vzIrmEb.exe
  2⤵
  PID:7328
- C:\Windows\System\rwAUvrb.exe
  C:\Windows\System\rwAUvrb.exe
  2⤵
  PID:7356
- C:\Windows\System\OciUzof.exe
  C:\Windows\System\OciUzof.exe
  2⤵
  PID:7380
- C:\Windows\System\BqxKcgG.exe
  C:\Windows\System\BqxKcgG.exe
  2⤵
  PID:7412
- C:\Windows\System\YmsUFnA.exe
  C:\Windows\System\YmsUFnA.exe
  2⤵
  PID:7444
- C:\Windows\System\qAHgWTz.exe
  C:\Windows\System\qAHgWTz.exe
  2⤵
  PID:7484
- C:\Windows\System\JYSUTwP.exe
  C:\Windows\System\JYSUTwP.exe
  2⤵
  PID:7504
- C:\Windows\System\MJVNLMS.exe
  C:\Windows\System\MJVNLMS.exe
  2⤵
  PID:7540
- C:\Windows\System\MZXmmbd.exe
  C:\Windows\System\MZXmmbd.exe
  2⤵
  PID:7564
- C:\Windows\System\rKXTSGB.exe
  C:\Windows\System\rKXTSGB.exe
  2⤵
  PID:7596
- C:\Windows\System\fzyuoFi.exe
  C:\Windows\System\fzyuoFi.exe
  2⤵
  PID:7612
- C:\Windows\System\QjxYmse.exe
  C:\Windows\System\QjxYmse.exe
  2⤵
  PID:7636
- C:\Windows\System\GIiycsS.exe
  C:\Windows\System\GIiycsS.exe
  2⤵
  PID:7672
- C:\Windows\System\kvDPOBN.exe
  C:\Windows\System\kvDPOBN.exe
  2⤵
  PID:7700
- C:\Windows\System\ewHxOWS.exe
  C:\Windows\System\ewHxOWS.exe
  2⤵
  PID:7740
- C:\Windows\System\BlLwEwE.exe
  C:\Windows\System\BlLwEwE.exe
  2⤵
  PID:7764
- C:\Windows\System\XTtYVWe.exe
  C:\Windows\System\XTtYVWe.exe
  2⤵
  PID:7800
- C:\Windows\System\imZRhnw.exe
  C:\Windows\System\imZRhnw.exe
  2⤵
  PID:7828
- C:\Windows\System\SAchrcZ.exe
  C:\Windows\System\SAchrcZ.exe
  2⤵
  PID:7860
- C:\Windows\System\dYLDiAW.exe
  C:\Windows\System\dYLDiAW.exe
  2⤵
  PID:7888
- C:\Windows\System\kVCfpAU.exe
  C:\Windows\System\kVCfpAU.exe
  2⤵
  PID:7924
- C:\Windows\System\kLumaCN.exe
  C:\Windows\System\kLumaCN.exe
  2⤵
  PID:7960
- C:\Windows\System\aIuAHIU.exe
  C:\Windows\System\aIuAHIU.exe
  2⤵
  PID:7996
- C:\Windows\System\lFFANbv.exe
  C:\Windows\System\lFFANbv.exe
  2⤵
  PID:8012
- C:\Windows\System\RBDNlcL.exe
  C:\Windows\System\RBDNlcL.exe
  2⤵
  PID:8044
- C:\Windows\System\UvSqTtz.exe
  C:\Windows\System\UvSqTtz.exe
  2⤵
  PID:8068
- C:\Windows\System\ACyizqT.exe
  C:\Windows\System\ACyizqT.exe
  2⤵
  PID:8096
- C:\Windows\System\JgrCMCr.exe
  C:\Windows\System\JgrCMCr.exe
  2⤵
  PID:8124
- C:\Windows\System\VCTflav.exe
  C:\Windows\System\VCTflav.exe
  2⤵
  PID:8152
- C:\Windows\System\MmAqljQ.exe
  C:\Windows\System\MmAqljQ.exe
  2⤵
  PID:8188
- C:\Windows\System\evakZYm.exe
  C:\Windows\System\evakZYm.exe
  2⤵
  PID:6624
- C:\Windows\System\cZHjvSD.exe
  C:\Windows\System\cZHjvSD.exe
  2⤵
  PID:7316
- C:\Windows\System\rlUgiKE.exe
  C:\Windows\System\rlUgiKE.exe
  2⤵
  PID:7296
- C:\Windows\System\xKLbncs.exe
  C:\Windows\System\xKLbncs.exe
  2⤵
  PID:7396
- C:\Windows\System\GilbLoa.exe
  C:\Windows\System\GilbLoa.exe
  2⤵
  PID:7428
- C:\Windows\System\qRPnXOE.exe
  C:\Windows\System\qRPnXOE.exe
  2⤵
  PID:7424
- C:\Windows\System\HpqziaY.exe
  C:\Windows\System\HpqziaY.exe
  2⤵
  PID:7500
- C:\Windows\System\xGlXFqA.exe
  C:\Windows\System\xGlXFqA.exe
  2⤵
  PID:7556
- C:\Windows\System\DrJutHJ.exe
  C:\Windows\System\DrJutHJ.exe
  2⤵
  PID:7620
- C:\Windows\System\VQyHzbG.exe
  C:\Windows\System\VQyHzbG.exe
  2⤵
  PID:7712
- C:\Windows\System\orYZygu.exe
  C:\Windows\System\orYZygu.exe
  2⤵
  PID:7780
- C:\Windows\System\GnCDpdo.exe
  C:\Windows\System\GnCDpdo.exe
  2⤵
  PID:7884
- C:\Windows\System\tWTqshn.exe
  C:\Windows\System\tWTqshn.exe
  2⤵
  PID:7940
- C:\Windows\System\BBTfqqW.exe
  C:\Windows\System\BBTfqqW.exe
  2⤵
  PID:8008
- C:\Windows\System\PfjJuSp.exe
  C:\Windows\System\PfjJuSp.exe
  2⤵
  PID:8060
- C:\Windows\System\GrtWdEQ.exe
  C:\Windows\System\GrtWdEQ.exe
  2⤵
  PID:8160
- C:\Windows\System\gvDFRwE.exe
  C:\Windows\System\gvDFRwE.exe
  2⤵
  PID:7228
- C:\Windows\System\BFLsodn.exe
  C:\Windows\System\BFLsodn.exe
  2⤵
  PID:7368
- C:\Windows\System\VTpNbrf.exe
  C:\Windows\System\VTpNbrf.exe
  2⤵
  PID:7464
- C:\Windows\System\UjPSKHr.exe
  C:\Windows\System\UjPSKHr.exe
  2⤵
  PID:7516
- C:\Windows\System\WOwXkHf.exe
  C:\Windows\System\WOwXkHf.exe
  2⤵
  PID:7656
- C:\Windows\System\UbBlRqX.exe
  C:\Windows\System\UbBlRqX.exe
  2⤵
  PID:7752
- C:\Windows\System\mhzipcj.exe
  C:\Windows\System\mhzipcj.exe
  2⤵
  PID:7988
- C:\Windows\System\MrTqEwF.exe
  C:\Windows\System\MrTqEwF.exe
  2⤵
  PID:8092
- C:\Windows\System\FEtVhsO.exe
  C:\Windows\System\FEtVhsO.exe
  2⤵
  PID:7292
- C:\Windows\System\SKlgCct.exe
  C:\Windows\System\SKlgCct.exe
  2⤵
  PID:3396
- C:\Windows\System\pirdjRt.exe
  C:\Windows\System\pirdjRt.exe
  2⤵
  PID:7900
- C:\Windows\System\AUaJdkM.exe
  C:\Windows\System\AUaJdkM.exe
  2⤵
  PID:1640
- C:\Windows\System\TMthiSt.exe
  C:\Windows\System\TMthiSt.exe
  2⤵
  PID:372
- C:\Windows\System\DxLmBdh.exe
  C:\Windows\System\DxLmBdh.exe
  2⤵
  PID:8212
- C:\Windows\System\tXoEufQ.exe
  C:\Windows\System\tXoEufQ.exe
  2⤵
  PID:8240
- C:\Windows\System\knDcwsU.exe
  C:\Windows\System\knDcwsU.exe
  2⤵
  PID:8268
- C:\Windows\System\hVioUhP.exe
  C:\Windows\System\hVioUhP.exe
  2⤵
  PID:8296
- C:\Windows\System\XetfojQ.exe
  C:\Windows\System\XetfojQ.exe
  2⤵
  PID:8316
- C:\Windows\System\sFcuVUA.exe
  C:\Windows\System\sFcuVUA.exe
  2⤵
  PID:8336
- C:\Windows\System\qjJbBXC.exe
  C:\Windows\System\qjJbBXC.exe
  2⤵
  PID:8368
- C:\Windows\System\efUclHX.exe
  C:\Windows\System\efUclHX.exe
  2⤵
  PID:8404
- C:\Windows\System\XLBeBPo.exe
  C:\Windows\System\XLBeBPo.exe
  2⤵
  PID:8440
- C:\Windows\System\kLjbwTi.exe
  C:\Windows\System\kLjbwTi.exe
  2⤵
  PID:8460
- C:\Windows\System\kWvDXgr.exe
  C:\Windows\System\kWvDXgr.exe
  2⤵
  PID:8496
- C:\Windows\System\cTTpeHW.exe
  C:\Windows\System\cTTpeHW.exe
  2⤵
  PID:8532
- C:\Windows\System\EDYxvTK.exe
  C:\Windows\System\EDYxvTK.exe
  2⤵
  PID:8560
- C:\Windows\System\NJfTyKu.exe
  C:\Windows\System\NJfTyKu.exe
  2⤵
  PID:8584
- C:\Windows\System\wgwmTBv.exe
  C:\Windows\System\wgwmTBv.exe
  2⤵
  PID:8616
- C:\Windows\System\MuTcYIE.exe
  C:\Windows\System\MuTcYIE.exe
  2⤵
  PID:8644
- C:\Windows\System\KAwHgrr.exe
  C:\Windows\System\KAwHgrr.exe
  2⤵
  PID:8672
- C:\Windows\System\rIsCwfh.exe
  C:\Windows\System\rIsCwfh.exe
  2⤵
  PID:8700
- C:\Windows\System\NyyUUzo.exe
  C:\Windows\System\NyyUUzo.exe
  2⤵
  PID:8728
- C:\Windows\System\XbmxuKH.exe
  C:\Windows\System\XbmxuKH.exe
  2⤵
  PID:8764
- C:\Windows\System\YcjHUVl.exe
  C:\Windows\System\YcjHUVl.exe
  2⤵
  PID:8796
- C:\Windows\System\pYranOo.exe
  C:\Windows\System\pYranOo.exe
  2⤵
  PID:8812
- C:\Windows\System\uBGEmIG.exe
  C:\Windows\System\uBGEmIG.exe
  2⤵
  PID:8840
- C:\Windows\System\cZZmdJF.exe
  C:\Windows\System\cZZmdJF.exe
  2⤵
  PID:8868
- C:\Windows\System\HrOPVhK.exe
  C:\Windows\System\HrOPVhK.exe
  2⤵
  PID:8884
- C:\Windows\System\kkxMwDc.exe
  C:\Windows\System\kkxMwDc.exe
  2⤵
  PID:8928
- C:\Windows\System\DTnAkHm.exe
  C:\Windows\System\DTnAkHm.exe
  2⤵
  PID:8952
- C:\Windows\System\TvGgvUI.exe
  C:\Windows\System\TvGgvUI.exe
  2⤵
  PID:8980
- C:\Windows\System\pqczUNK.exe
  C:\Windows\System\pqczUNK.exe
  2⤵
  PID:9012
- C:\Windows\System\xtGmnEu.exe
  C:\Windows\System\xtGmnEu.exe
  2⤵
  PID:9040
- C:\Windows\System\OuwNfuV.exe
  C:\Windows\System\OuwNfuV.exe
  2⤵
  PID:9064
- C:\Windows\System\aGVkryR.exe
  C:\Windows\System\aGVkryR.exe
  2⤵
  PID:9092
- C:\Windows\System\KdxwDLa.exe
  C:\Windows\System\KdxwDLa.exe
  2⤵
  PID:9128
- C:\Windows\System\SluKDSB.exe
  C:\Windows\System\SluKDSB.exe
  2⤵
  PID:9152
- C:\Windows\System\ANxWZTd.exe
  C:\Windows\System\ANxWZTd.exe
  2⤵
  PID:9188
- C:\Windows\System\JBvDRgb.exe
  C:\Windows\System\JBvDRgb.exe
  2⤵
  PID:9204
- C:\Windows\System\DUmxJCO.exe
  C:\Windows\System\DUmxJCO.exe
  2⤵
  PID:8180
- C:\Windows\System\tfJeCIz.exe
  C:\Windows\System\tfJeCIz.exe
  2⤵
  PID:8252
- C:\Windows\System\eTiGEvC.exe
  C:\Windows\System\eTiGEvC.exe
  2⤵
  PID:8328
- C:\Windows\System\IkWTfaG.exe
  C:\Windows\System\IkWTfaG.exe
  2⤵
  PID:8352
- C:\Windows\System\mkoamTg.exe
  C:\Windows\System\mkoamTg.exe
  2⤵
  PID:8456
- C:\Windows\System\ACbViWk.exe
  C:\Windows\System\ACbViWk.exe
  2⤵
  PID:8516
- C:\Windows\System\bMOhIFn.exe
  C:\Windows\System\bMOhIFn.exe
  2⤵
  PID:8592
- C:\Windows\System\QghMdCU.exe
  C:\Windows\System\QghMdCU.exe
  2⤵
  PID:8632
- C:\Windows\System\DfsMCwe.exe
  C:\Windows\System\DfsMCwe.exe
  2⤵
  PID:8656
- C:\Windows\System\cWgsaHf.exe
  C:\Windows\System\cWgsaHf.exe
  2⤵
  PID:8740
- C:\Windows\System\vtTVLxk.exe
  C:\Windows\System\vtTVLxk.exe
  2⤵
  PID:8828
- C:\Windows\System\qlJqlej.exe
  C:\Windows\System\qlJqlej.exe
  2⤵
  PID:8856
- C:\Windows\System\LRKIQOr.exe
  C:\Windows\System\LRKIQOr.exe
  2⤵
  PID:8880
- C:\Windows\System\yocFBAI.exe
  C:\Windows\System\yocFBAI.exe
  2⤵
  PID:8992
- C:\Windows\System\yIosQbU.exe
  C:\Windows\System\yIosQbU.exe
  2⤵
  PID:9116
- C:\Windows\System\mncdfhb.exe
  C:\Windows\System\mncdfhb.exe
  2⤵
  PID:9148
- C:\Windows\System\gcMKOOm.exe
  C:\Windows\System\gcMKOOm.exe
  2⤵
  PID:8200
- C:\Windows\System\IhciDdT.exe
  C:\Windows\System\IhciDdT.exe
  2⤵
  PID:8232
- C:\Windows\System\VUWBpqU.exe
  C:\Windows\System\VUWBpqU.exe
  2⤵
  PID:1924
- C:\Windows\System\qBboFcH.exe
  C:\Windows\System\qBboFcH.exe
  2⤵
  PID:8452
- C:\Windows\System\QzKtFNi.exe
  C:\Windows\System\QzKtFNi.exe
  2⤵
  PID:8692
- C:\Windows\System\awjyunw.exe
  C:\Windows\System\awjyunw.exe
  2⤵
  PID:8784
- C:\Windows\System\YoCzMXU.exe
  C:\Windows\System\YoCzMXU.exe
  2⤵
  PID:8996
- C:\Windows\System\qFASqkf.exe
  C:\Windows\System\qFASqkf.exe
  2⤵
  PID:9140
- C:\Windows\System\spTHXSk.exe
  C:\Windows\System\spTHXSk.exe
  2⤵
  PID:7452
- C:\Windows\System\ceOvMAU.exe
  C:\Windows\System\ceOvMAU.exe
  2⤵
  PID:3732
- C:\Windows\System\CHUzmaw.exe
  C:\Windows\System\CHUzmaw.exe
  2⤵
  PID:8512
- C:\Windows\System\xQBRSjk.exe
  C:\Windows\System\xQBRSjk.exe
  2⤵
  PID:9080
- C:\Windows\System\vpVuohM.exe
  C:\Windows\System\vpVuohM.exe
  2⤵
  PID:9176
- C:\Windows\System\ogpcHSO.exe
  C:\Windows\System\ogpcHSO.exe
  2⤵
  PID:4496
- C:\Windows\System\vxwpPfF.exe
  C:\Windows\System\vxwpPfF.exe
  2⤵
  PID:9240
- C:\Windows\System\JYFPhmG.exe
  C:\Windows\System\JYFPhmG.exe
  2⤵
  PID:9264
- C:\Windows\System\hEmLnAc.exe
  C:\Windows\System\hEmLnAc.exe
  2⤵
  PID:9284
- C:\Windows\System\WorgTPW.exe
  C:\Windows\System\WorgTPW.exe
  2⤵
  PID:9308
- C:\Windows\System\mOPTRJg.exe
  C:\Windows\System\mOPTRJg.exe
  2⤵
  PID:9328
- C:\Windows\System\ZyvcQUS.exe
  C:\Windows\System\ZyvcQUS.exe
  2⤵
  PID:9356
- C:\Windows\System\UibYyCb.exe
  C:\Windows\System\UibYyCb.exe
  2⤵
  PID:9388
- C:\Windows\System\tOcrYQX.exe
  C:\Windows\System\tOcrYQX.exe
  2⤵
  PID:9408
- C:\Windows\System\HtpVNxt.exe
  C:\Windows\System\HtpVNxt.exe
  2⤵
  PID:9436
- C:\Windows\System\svvgmSO.exe
  C:\Windows\System\svvgmSO.exe
  2⤵
  PID:9456
- C:\Windows\System\coAiNfN.exe
  C:\Windows\System\coAiNfN.exe
  2⤵
  PID:9564
- C:\Windows\System\EGbPysR.exe
  C:\Windows\System\EGbPysR.exe
  2⤵
  PID:9588
- C:\Windows\System\RuOKJuU.exe
  C:\Windows\System\RuOKJuU.exe
  2⤵
  PID:9604
- C:\Windows\System\BmCiaVe.exe
  C:\Windows\System\BmCiaVe.exe
  2⤵
  PID:9632
- C:\Windows\System\vDvVqia.exe
  C:\Windows\System\vDvVqia.exe
  2⤵
  PID:9660
- C:\Windows\System\AXjjaME.exe
  C:\Windows\System\AXjjaME.exe
  2⤵
  PID:9680
- C:\Windows\System\QSoHHGx.exe
  C:\Windows\System\QSoHHGx.exe
  2⤵
  PID:9704
- C:\Windows\System\fMJkRCB.exe
  C:\Windows\System\fMJkRCB.exe
  2⤵
  PID:9732
- C:\Windows\System\gcVoSEJ.exe
  C:\Windows\System\gcVoSEJ.exe
  2⤵
  PID:9772
- C:\Windows\System\BTjLFFL.exe
  C:\Windows\System\BTjLFFL.exe
  2⤵
  PID:9804
- C:\Windows\System\JwQfYqb.exe
  C:\Windows\System\JwQfYqb.exe
  2⤵
  PID:9828
- C:\Windows\System\yOnTcQl.exe
  C:\Windows\System\yOnTcQl.exe
  2⤵
  PID:9856
- C:\Windows\System\jvUeHuX.exe
  C:\Windows\System\jvUeHuX.exe
  2⤵
  PID:9884
- C:\Windows\System\YrNmOoD.exe
  C:\Windows\System\YrNmOoD.exe
  2⤵
  PID:9916
- C:\Windows\System\caPFRLY.exe
  C:\Windows\System\caPFRLY.exe
  2⤵
  PID:9952
- C:\Windows\System\OjMbwAa.exe
  C:\Windows\System\OjMbwAa.exe
  2⤵
  PID:9968
- C:\Windows\System\RfpaQiM.exe
  C:\Windows\System\RfpaQiM.exe
  2⤵
  PID:10004
- C:\Windows\System\OXNigXZ.exe
  C:\Windows\System\OXNigXZ.exe
  2⤵
  PID:10040
- C:\Windows\System\xtnmyQX.exe
  C:\Windows\System\xtnmyQX.exe
  2⤵
  PID:10064
- C:\Windows\System\capeUlG.exe
  C:\Windows\System\capeUlG.exe
  2⤵
  PID:10092
- C:\Windows\System\SpWWivm.exe
  C:\Windows\System\SpWWivm.exe
  2⤵
  PID:10116
- C:\Windows\System\bwlaDbf.exe
  C:\Windows\System\bwlaDbf.exe
  2⤵
  PID:10148
- C:\Windows\System\JeWVMqP.exe
  C:\Windows\System\JeWVMqP.exe
  2⤵
  PID:10172
- C:\Windows\System\hlnYtHB.exe
  C:\Windows\System\hlnYtHB.exe
  2⤵
  PID:10196
- C:\Windows\System\VeDbxcD.exe
  C:\Windows\System\VeDbxcD.exe
  2⤵
  PID:10228
- C:\Windows\System\QryonJM.exe
  C:\Windows\System\QryonJM.exe
  2⤵
  PID:8788
- C:\Windows\System\AEKenLI.exe
  C:\Windows\System\AEKenLI.exe
  2⤵
  PID:9296
- C:\Windows\System\OkELSxQ.exe
  C:\Windows\System\OkELSxQ.exe
  2⤵
  PID:9316
- C:\Windows\System\IXYMdUS.exe
  C:\Windows\System\IXYMdUS.exe
  2⤵
  PID:9344
- C:\Windows\System\tNALvYO.exe
  C:\Windows\System\tNALvYO.exe
  2⤵
  PID:9368
- C:\Windows\System\UgiDoLX.exe
  C:\Windows\System\UgiDoLX.exe
  2⤵
  PID:9444
- C:\Windows\System\EbtUNpl.exe
  C:\Windows\System\EbtUNpl.exe
  2⤵
  PID:9488
- C:\Windows\System\GaKcrbR.exe
  C:\Windows\System\GaKcrbR.exe
  2⤵
  PID:3384
- C:\Windows\System\SKPdqFa.exe
  C:\Windows\System\SKPdqFa.exe
  2⤵
  PID:1152
- C:\Windows\System\sflXznv.exe
  C:\Windows\System\sflXznv.exe
  2⤵
  PID:2984
- C:\Windows\System\XMNTUre.exe
  C:\Windows\System\XMNTUre.exe
  2⤵
  PID:9584
- C:\Windows\System\rXcvKEq.exe
  C:\Windows\System\rXcvKEq.exe
  2⤵
  PID:9648
- C:\Windows\System\FJmjGfS.exe
  C:\Windows\System\FJmjGfS.exe
  2⤵
  PID:9692
- C:\Windows\System\gkuoCRt.exe
  C:\Windows\System\gkuoCRt.exe
  2⤵
  PID:9812
- C:\Windows\System\aNwXRLc.exe
  C:\Windows\System\aNwXRLc.exe
  2⤵
  PID:9844
- C:\Windows\System\LfSRZuI.exe
  C:\Windows\System\LfSRZuI.exe
  2⤵
  PID:9944
- C:\Windows\System\ZZqiAmo.exe
  C:\Windows\System\ZZqiAmo.exe
  2⤵
  PID:10036
- C:\Windows\System\aNDMTnJ.exe
  C:\Windows\System\aNDMTnJ.exe
  2⤵
  PID:10104
- C:\Windows\System\KgruURb.exe
  C:\Windows\System\KgruURb.exe
  2⤵
  PID:10160
- C:\Windows\System\BMdnuzG.exe
  C:\Windows\System\BMdnuzG.exe
  2⤵
  PID:10212
- C:\Windows\System\SiQeVtY.exe
  C:\Windows\System\SiQeVtY.exe
  2⤵
  PID:9384
- C:\Windows\System\egDrwJV.exe
  C:\Windows\System\egDrwJV.exe
  2⤵
  PID:4700
- C:\Windows\System\ENaGHsx.exe
  C:\Windows\System\ENaGHsx.exe
  2⤵
  PID:9552
- C:\Windows\System\GIabahi.exe
  C:\Windows\System\GIabahi.exe
  2⤵
  PID:9272
- C:\Windows\System\oyrAFrI.exe
  C:\Windows\System\oyrAFrI.exe
  2⤵
  PID:9596
- C:\Windows\System\NpUZiwz.exe
  C:\Windows\System\NpUZiwz.exe
  2⤵
  PID:9896
- C:\Windows\System\zIxeIbj.exe
  C:\Windows\System\zIxeIbj.exe
  2⤵
  PID:10144
- C:\Windows\System\mIyZcZo.exe
  C:\Windows\System\mIyZcZo.exe
  2⤵
  PID:10136
- C:\Windows\System\XBbYHqH.exe
  C:\Windows\System\XBbYHqH.exe
  2⤵
  PID:9260
- C:\Windows\System\roBVHej.exe
  C:\Windows\System\roBVHej.exe
  2⤵
  PID:4760
- C:\Windows\System\XZSEjvb.exe
  C:\Windows\System\XZSEjvb.exe
  2⤵
  PID:9676
- C:\Windows\System\vODwQPT.exe
  C:\Windows\System\vODwQPT.exe
  2⤵
  PID:9252
- C:\Windows\System\HNxlhyW.exe
  C:\Windows\System\HNxlhyW.exe
  2⤵
  PID:9728
- C:\Windows\System\lFCUfVW.exe
  C:\Windows\System\lFCUfVW.exe
  2⤵
  PID:10244
- C:\Windows\System\lREdduA.exe
  C:\Windows\System\lREdduA.exe
  2⤵
  PID:10272
- C:\Windows\System\fXRlbFT.exe
  C:\Windows\System\fXRlbFT.exe
  2⤵
  PID:10304
- C:\Windows\System\aOuMfLn.exe
  C:\Windows\System\aOuMfLn.exe
  2⤵
  PID:10332
- C:\Windows\System\lVjGutY.exe
  C:\Windows\System\lVjGutY.exe
  2⤵
  PID:10372
- C:\Windows\System\nJOJuZX.exe
  C:\Windows\System\nJOJuZX.exe
  2⤵
  PID:10396
- C:\Windows\System\IRmnNwo.exe
  C:\Windows\System\IRmnNwo.exe
  2⤵
  PID:10428
- C:\Windows\System\ZOOauZk.exe
  C:\Windows\System\ZOOauZk.exe
  2⤵
  PID:10444
- C:\Windows\System\zYRHToN.exe
  C:\Windows\System\zYRHToN.exe
  2⤵
  PID:10476
- C:\Windows\System\DYupSMX.exe
  C:\Windows\System\DYupSMX.exe
  2⤵
  PID:10500
- C:\Windows\System\uYslVlZ.exe
  C:\Windows\System\uYslVlZ.exe
  2⤵
  PID:10528
- C:\Windows\System\eyfIyaR.exe
  C:\Windows\System\eyfIyaR.exe
  2⤵
  PID:10556
- C:\Windows\System\pcRIxoW.exe
  C:\Windows\System\pcRIxoW.exe
  2⤵
  PID:10584
- C:\Windows\System\UKHaJVs.exe
  C:\Windows\System\UKHaJVs.exe
  2⤵
  PID:10612
- C:\Windows\System\TDUpPAF.exe
  C:\Windows\System\TDUpPAF.exe
  2⤵
  PID:10640
- C:\Windows\System\DbvGgYC.exe
  C:\Windows\System\DbvGgYC.exe
  2⤵
  PID:10668
- C:\Windows\System\xnDaVij.exe
  C:\Windows\System\xnDaVij.exe
  2⤵
  PID:10696
- C:\Windows\System\sGFNyks.exe
  C:\Windows\System\sGFNyks.exe
  2⤵
  PID:10716
- C:\Windows\System\ehxzyGy.exe
  C:\Windows\System\ehxzyGy.exe
  2⤵
  PID:10748
- C:\Windows\System\wZKdOuo.exe
  C:\Windows\System\wZKdOuo.exe
  2⤵
  PID:10772
- C:\Windows\System\PGfgLAv.exe
  C:\Windows\System\PGfgLAv.exe
  2⤵
  PID:10796
- C:\Windows\System\PWWcVPo.exe
  C:\Windows\System\PWWcVPo.exe
  2⤵
  PID:10816
- C:\Windows\System\KMrDCAV.exe
  C:\Windows\System\KMrDCAV.exe
  2⤵
  PID:10848
- C:\Windows\System\GPKUtxG.exe
  C:\Windows\System\GPKUtxG.exe
  2⤵
  PID:10868
- C:\Windows\System\HMHrCHD.exe
  C:\Windows\System\HMHrCHD.exe
  2⤵
  PID:10896
- C:\Windows\System\KmiRnBn.exe
  C:\Windows\System\KmiRnBn.exe
  2⤵
  PID:10940
- C:\Windows\System\nyzaJSS.exe
  C:\Windows\System\nyzaJSS.exe
  2⤵
  PID:10964
- C:\Windows\System\YTibWiX.exe
  C:\Windows\System\YTibWiX.exe
  2⤵
  PID:10996
- C:\Windows\System\pUqGAZy.exe
  C:\Windows\System\pUqGAZy.exe
  2⤵
  PID:11020
- C:\Windows\System\sTHlpeM.exe
  C:\Windows\System\sTHlpeM.exe
  2⤵
  PID:11052
- C:\Windows\System\YUuGHUU.exe
  C:\Windows\System\YUuGHUU.exe
  2⤵
  PID:11080
- C:\Windows\System\CBVEbSW.exe
  C:\Windows\System\CBVEbSW.exe
  2⤵
  PID:11112
- C:\Windows\System\etYLIFt.exe
  C:\Windows\System\etYLIFt.exe
  2⤵
  PID:11144
- C:\Windows\System\MdXVKCu.exe
  C:\Windows\System\MdXVKCu.exe
  2⤵
  PID:11172
- C:\Windows\System\wpHIcYM.exe
  C:\Windows\System\wpHIcYM.exe
  2⤵
  PID:11200
- C:\Windows\System\aBviPMs.exe
  C:\Windows\System\aBviPMs.exe
  2⤵
  PID:11216
- C:\Windows\System\TFpHgVw.exe
  C:\Windows\System\TFpHgVw.exe
  2⤵
  PID:11248
- C:\Windows\System\egfvdbH.exe
  C:\Windows\System\egfvdbH.exe
  2⤵
  PID:10260
- C:\Windows\System\oYGSezD.exe
  C:\Windows\System\oYGSezD.exe
  2⤵
  PID:10320
- C:\Windows\System\mdNZeaa.exe
  C:\Windows\System\mdNZeaa.exe
  2⤵
  PID:10360
- C:\Windows\System\aMhStaZ.exe
  C:\Windows\System\aMhStaZ.exe
  2⤵
  PID:10464
- C:\Windows\System\AbRgVHc.exe
  C:\Windows\System\AbRgVHc.exe
  2⤵
  PID:10512
- C:\Windows\System\huNYxbK.exe
  C:\Windows\System\huNYxbK.exe
  2⤵
  PID:10604
- C:\Windows\System\ZJVYpsj.exe
  C:\Windows\System\ZJVYpsj.exe
  2⤵
  PID:10632
- C:\Windows\System\ENDTZOD.exe
  C:\Windows\System\ENDTZOD.exe
  2⤵
  PID:10736
- C:\Windows\System\tAQEzUq.exe
  C:\Windows\System\tAQEzUq.exe
  2⤵
  PID:10780
- C:\Windows\System\juKkvPA.exe
  C:\Windows\System\juKkvPA.exe
  2⤵
  PID:10844
- C:\Windows\System\MKHRFbO.exe
  C:\Windows\System\MKHRFbO.exe
  2⤵
  PID:10924
- C:\Windows\System\IuZoWCN.exe
  C:\Windows\System\IuZoWCN.exe
  2⤵
  PID:10988
- C:\Windows\System\SuFpBlF.exe
  C:\Windows\System\SuFpBlF.exe
  2⤵
  PID:11068
- C:\Windows\System\hvksEdP.exe
  C:\Windows\System\hvksEdP.exe
  2⤵
  PID:11136
- C:\Windows\System\qYNDiEc.exe
  C:\Windows\System\qYNDiEc.exe
  2⤵
  PID:11160
- C:\Windows\System\GEodjzu.exe
  C:\Windows\System\GEodjzu.exe
  2⤵
  PID:11236
- C:\Windows\System\YykhUbw.exe
  C:\Windows\System\YykhUbw.exe
  2⤵
  PID:10368
- C:\Windows\System\IaTEQqn.exe
  C:\Windows\System\IaTEQqn.exe
  2⤵
  PID:10412
- C:\Windows\System\vBIUvqJ.exe
  C:\Windows\System\vBIUvqJ.exe
  2⤵
  PID:10624
- C:\Windows\System\LgZFzZY.exe
  C:\Windows\System\LgZFzZY.exe
  2⤵
  PID:10712
- C:\Windows\System\lkfnVHl.exe
  C:\Windows\System\lkfnVHl.exe
  2⤵
  PID:10892
- C:\Windows\System\GHqqjIl.exe
  C:\Windows\System\GHqqjIl.exe
  2⤵
  PID:11104
- C:\Windows\System\WiGVZzn.exe
  C:\Windows\System\WiGVZzn.exe
  2⤵
  PID:11212
- C:\Windows\System\WisQmBG.exe
  C:\Windows\System\WisQmBG.exe
  2⤵
  PID:10264
- C:\Windows\System\zfXTpcx.exe
  C:\Windows\System\zfXTpcx.exe
  2⤵
  PID:10656
- C:\Windows\System\ukGuLjG.exe
  C:\Windows\System\ukGuLjG.exe
  2⤵
  PID:10960
- C:\Windows\System\tzKYEVm.exe
  C:\Windows\System\tzKYEVm.exe
  2⤵
  PID:11268
- C:\Windows\System\dQydLNG.exe
  C:\Windows\System\dQydLNG.exe
  2⤵
  PID:11284
- C:\Windows\System\FjODlOJ.exe
  C:\Windows\System\FjODlOJ.exe
  2⤵
  PID:11320
- C:\Windows\System\AtNYETY.exe
  C:\Windows\System\AtNYETY.exe
  2⤵
  PID:11352
- C:\Windows\System\XNFdPjW.exe
  C:\Windows\System\XNFdPjW.exe
  2⤵
  PID:11380
- C:\Windows\System\pUsVUZw.exe
  C:\Windows\System\pUsVUZw.exe
  2⤵
  PID:11408
- C:\Windows\System\gMklKnt.exe
  C:\Windows\System\gMklKnt.exe
  2⤵
  PID:11436
- C:\Windows\System\tRwtXAK.exe
  C:\Windows\System\tRwtXAK.exe
  2⤵
  PID:11452
- C:\Windows\System\gvLPTjA.exe
  C:\Windows\System\gvLPTjA.exe
  2⤵
  PID:11484
- C:\Windows\System\cBppukB.exe
  C:\Windows\System\cBppukB.exe
  2⤵
  PID:11524
- C:\Windows\System\sjTAgoC.exe
  C:\Windows\System\sjTAgoC.exe
  2⤵
  PID:11548
- C:\Windows\System\LSRcvPW.exe
  C:\Windows\System\LSRcvPW.exe
  2⤵
  PID:11580
- C:\Windows\System\XcByJSi.exe
  C:\Windows\System\XcByJSi.exe
  2⤵
  PID:11604
- C:\Windows\System\hUilERp.exe
  C:\Windows\System\hUilERp.exe
  2⤵
  PID:11620
- C:\Windows\System\gWDGhDY.exe
  C:\Windows\System\gWDGhDY.exe
  2⤵
  PID:11648
- C:\Windows\System\bxcWReP.exe
  C:\Windows\System\bxcWReP.exe
  2⤵
  PID:11668
- C:\Windows\System\HpOkaqX.exe
  C:\Windows\System\HpOkaqX.exe
  2⤵
  PID:11700
- C:\Windows\System\sFYfbXi.exe
  C:\Windows\System\sFYfbXi.exe
  2⤵
  PID:11732
- C:\Windows\System\SDlUvmu.exe
  C:\Windows\System\SDlUvmu.exe
  2⤵
  PID:11760
- C:\Windows\System\eZmwmql.exe
  C:\Windows\System\eZmwmql.exe
  2⤵
  PID:11784
- C:\Windows\System\kbhBFit.exe
  C:\Windows\System\kbhBFit.exe
  2⤵
  PID:11816
- C:\Windows\System\kvBCJHT.exe
  C:\Windows\System\kvBCJHT.exe
  2⤵
  PID:11836
- C:\Windows\System\LWHAGOA.exe
  C:\Windows\System\LWHAGOA.exe
  2⤵
  PID:11872
- C:\Windows\System\uoGwXgm.exe
  C:\Windows\System\uoGwXgm.exe
  2⤵
  PID:11912
- C:\Windows\System\HonFSQr.exe
  C:\Windows\System\HonFSQr.exe
  2⤵
  PID:11928
- C:\Windows\System\hCFsxBP.exe
  C:\Windows\System\hCFsxBP.exe
  2⤵
  PID:11952
- C:\Windows\System\cVYNpav.exe
  C:\Windows\System\cVYNpav.exe
  2⤵
  PID:11976
- C:\Windows\System\TAbZViw.exe
  C:\Windows\System\TAbZViw.exe
  2⤵
  PID:12008
- C:\Windows\System\FJEwjqD.exe
  C:\Windows\System\FJEwjqD.exe
  2⤵
  PID:12036
- C:\Windows\System\jEqaDbi.exe
  C:\Windows\System\jEqaDbi.exe
  2⤵
  PID:12072
- C:\Windows\System\leVXktp.exe
  C:\Windows\System\leVXktp.exe
  2⤵
  PID:12096
- C:\Windows\System\udtqTto.exe
  C:\Windows\System\udtqTto.exe
  2⤵
  PID:12124
- C:\Windows\System\iQMCMyJ.exe
  C:\Windows\System\iQMCMyJ.exe
  2⤵
  PID:12164
- C:\Windows\System\HZPRkNl.exe
  C:\Windows\System\HZPRkNl.exe
  2⤵
  PID:12180
- C:\Windows\System\OBLDthf.exe
  C:\Windows\System\OBLDthf.exe
  2⤵
  PID:12208
- C:\Windows\System\yUlrTsI.exe
  C:\Windows\System\yUlrTsI.exe
  2⤵
  PID:12236
- C:\Windows\System\bgKqRJN.exe
  C:\Windows\System\bgKqRJN.exe
  2⤵
  PID:12268
- C:\Windows\System\vETtYDS.exe
  C:\Windows\System\vETtYDS.exe
  2⤵
  PID:9824
- C:\Windows\System\yyhcaxa.exe
  C:\Windows\System\yyhcaxa.exe
  2⤵
  PID:11276
- C:\Windows\System\GOQgflk.exe
  C:\Windows\System\GOQgflk.exe
  2⤵
  PID:11340
- C:\Windows\System\IcLczHj.exe
  C:\Windows\System\IcLczHj.exe
  2⤵
  PID:11428
- C:\Windows\System\LVhexiv.exe
  C:\Windows\System\LVhexiv.exe
  2⤵
  PID:11496
- C:\Windows\System\SRPeQwV.exe
  C:\Windows\System\SRPeQwV.exe
  2⤵
  PID:11536
- C:\Windows\System\ZXtpnVT.exe
  C:\Windows\System\ZXtpnVT.exe
  2⤵
  PID:11560
- C:\Windows\System\AZJTaLr.exe
  C:\Windows\System\AZJTaLr.exe
  2⤵
  PID:11612
- C:\Windows\System\frnVrkv.exe
  C:\Windows\System\frnVrkv.exe
  2⤵
  PID:11708
- C:\Windows\System\FESzNYg.exe
  C:\Windows\System\FESzNYg.exe
  2⤵
  PID:11748
- C:\Windows\System\TIqYaRM.exe
  C:\Windows\System\TIqYaRM.exe
  2⤵
  PID:11832
- C:\Windows\System\RIwSBPl.exe
  C:\Windows\System\RIwSBPl.exe
  2⤵
  PID:11964
- C:\Windows\System\GSUVISU.exe
  C:\Windows\System\GSUVISU.exe
  2⤵
  PID:12084
- C:\Windows\System\iILIMuj.exe
  C:\Windows\System\iILIMuj.exe
  2⤵
  PID:12116
- C:\Windows\System\GHmPpbZ.exe
  C:\Windows\System\GHmPpbZ.exe
  2⤵
  PID:12192
- C:\Windows\System\mmAtqgi.exe
  C:\Windows\System\mmAtqgi.exe
  2⤵
  PID:12252
- C:\Windows\System\RjhyHlh.exe
  C:\Windows\System\RjhyHlh.exe
  2⤵
  PID:12284
- C:\Windows\System\TlYCtag.exe
  C:\Windows\System\TlYCtag.exe
  2⤵
  PID:11396
- C:\Windows\System\LwwhIlH.exe
  C:\Windows\System\LwwhIlH.exe
  2⤵
  PID:11572
- C:\Windows\System\glsLIIQ.exe
  C:\Windows\System\glsLIIQ.exe
  2⤵
  PID:11680
- C:\Windows\System\aeTlLbl.exe
  C:\Windows\System\aeTlLbl.exe
  2⤵
  PID:11804
- C:\Windows\System\LvOhAqr.exe
  C:\Windows\System\LvOhAqr.exe
  2⤵
  PID:11828
- C:\Windows\System\ZZZSqHT.exe
  C:\Windows\System\ZZZSqHT.exe
  2⤵
  PID:12028
- C:\Windows\System\yyaXoSa.exe
  C:\Windows\System\yyaXoSa.exe
  2⤵
  PID:11364
- C:\Windows\System\jFXpifH.exe
  C:\Windows\System\jFXpifH.exe
  2⤵
  PID:11444
- C:\Windows\System\dUIZjdI.exe
  C:\Windows\System\dUIZjdI.exe
  2⤵
  PID:11592
- C:\Windows\System\ZRuMoJI.exe
  C:\Windows\System\ZRuMoJI.exe
  2⤵
  PID:12136
- C:\Windows\System\qkCSjbc.exe
  C:\Windows\System\qkCSjbc.exe
  2⤵
  PID:12000
- C:\Windows\System\ByTLlUG.exe
  C:\Windows\System\ByTLlUG.exe
  2⤵
  PID:12304
- C:\Windows\System\yNEJXfm.exe
  C:\Windows\System\yNEJXfm.exe
  2⤵
  PID:12328
- C:\Windows\System\EJRiRdT.exe
  C:\Windows\System\EJRiRdT.exe
  2⤵
  PID:12356
- C:\Windows\System\VQSLyRk.exe
  C:\Windows\System\VQSLyRk.exe
  2⤵
  PID:12384
- C:\Windows\System\jTwXWIk.exe
  C:\Windows\System\jTwXWIk.exe
  2⤵
  PID:12412
- C:\Windows\System\jtNMTEZ.exe
  C:\Windows\System\jtNMTEZ.exe
  2⤵
  PID:12444
- C:\Windows\System\BdAHzlm.exe
  C:\Windows\System\BdAHzlm.exe
  2⤵
  PID:12472
- C:\Windows\System\OdYXLky.exe
  C:\Windows\System\OdYXLky.exe
  2⤵
  PID:12500
- C:\Windows\System\mmejDtv.exe
  C:\Windows\System\mmejDtv.exe
  2⤵
  PID:12528
- C:\Windows\System\dRBEEyZ.exe
  C:\Windows\System\dRBEEyZ.exe
  2⤵
  PID:12560
- C:\Windows\System\SORGONX.exe
  C:\Windows\System\SORGONX.exe
  2⤵
  PID:12600
- C:\Windows\System\ECnZZHW.exe
  C:\Windows\System\ECnZZHW.exe
  2⤵
  PID:12624
- C:\Windows\System\qdJcfSR.exe
  C:\Windows\System\qdJcfSR.exe
  2⤵
  PID:12652
- C:\Windows\System\NPnVRaK.exe
  C:\Windows\System\NPnVRaK.exe
  2⤵
  PID:12680
- C:\Windows\System\bLdJipw.exe
  C:\Windows\System\bLdJipw.exe
  2⤵
  PID:12700
- C:\Windows\System\VUMchZF.exe
  C:\Windows\System\VUMchZF.exe
  2⤵
  PID:12736
- C:\Windows\System\wHhgsGx.exe
  C:\Windows\System\wHhgsGx.exe
  2⤵
  PID:12772
- C:\Windows\System\wGyIVCz.exe
  C:\Windows\System\wGyIVCz.exe
  2⤵
  PID:12792
- C:\Windows\System\FOJCBqK.exe
  C:\Windows\System\FOJCBqK.exe
  2⤵
  PID:12812
- C:\Windows\System\NdYttne.exe
  C:\Windows\System\NdYttne.exe
  2⤵
  PID:12840
- C:\Windows\System\kHHzvbU.exe
  C:\Windows\System\kHHzvbU.exe
  2⤵
  PID:12872
- C:\Windows\System\dPXGMpZ.exe
  C:\Windows\System\dPXGMpZ.exe
  2⤵
  PID:12908
- C:\Windows\System\zoaRKBx.exe
  C:\Windows\System\zoaRKBx.exe
  2⤵
  PID:12928
- C:\Windows\System\jLaFImG.exe
  C:\Windows\System\jLaFImG.exe
  2⤵
  PID:12956
- C:\Windows\System\IrrqKwl.exe
  C:\Windows\System\IrrqKwl.exe
  2⤵
  PID:12972
- C:\Windows\System\zgMRZKB.exe
  C:\Windows\System\zgMRZKB.exe
  2⤵
  PID:12992
- C:\Windows\System\BNNGYoj.exe
  C:\Windows\System\BNNGYoj.exe
  2⤵
  PID:13028
- C:\Windows\System\rzOKacG.exe
  C:\Windows\System\rzOKacG.exe
  2⤵
  PID:13048
- C:\Windows\System\PukNTVf.exe
  C:\Windows\System\PukNTVf.exe
  2⤵
  PID:13068
- C:\Windows\System\lHXRVLf.exe
  C:\Windows\System\lHXRVLf.exe
  2⤵
  PID:13100
- C:\Windows\System\dahDNYI.exe
  C:\Windows\System\dahDNYI.exe
  2⤵
  PID:13136
- C:\Windows\System\bVpcpLi.exe
  C:\Windows\System\bVpcpLi.exe
  2⤵
  PID:13164
- C:\Windows\System\lZDnBrh.exe
  C:\Windows\System\lZDnBrh.exe
  2⤵
  PID:13180
- C:\Windows\System\oZFJmZO.exe
  C:\Windows\System\oZFJmZO.exe
  2⤵
  PID:13208
- C:\Windows\System\iRqELYp.exe
  C:\Windows\System\iRqELYp.exe
  2⤵
  PID:13236
- C:\Windows\System\cSbiksp.exe
  C:\Windows\System\cSbiksp.exe
  2⤵
  PID:13260
- C:\Windows\System\SxxugNS.exe
  C:\Windows\System\SxxugNS.exe
  2⤵
  PID:13284
- C:\Windows\System\wSqseKG.exe
  C:\Windows\System\wSqseKG.exe
  2⤵
  PID:11392
- C:\Windows\System\VAijyBp.exe
  C:\Windows\System\VAijyBp.exe
  2⤵
  PID:10984
- C:\Windows\System\dinZLYh.exe
  C:\Windows\System\dinZLYh.exe
  2⤵
  PID:11280
- C:\Windows\System\JGDGnpH.exe
  C:\Windows\System\JGDGnpH.exe
  2⤵
  PID:12464
- C:\Windows\System\fLZUdnS.exe
  C:\Windows\System\fLZUdnS.exe
  2⤵
  PID:12512
- C:\Windows\System\rGFwqXm.exe
  C:\Windows\System\rGFwqXm.exe
  2⤵
  PID:12576
- C:\Windows\System\QVeWtHj.exe
  C:\Windows\System\QVeWtHj.exe
  2⤵
  PID:12584
- C:\Windows\System\DPutulv.exe
  C:\Windows\System\DPutulv.exe
  2⤵
  PID:12716
- C:\Windows\System\MHnSTMQ.exe
  C:\Windows\System\MHnSTMQ.exe
  2⤵
  PID:12720
- C:\Windows\System\HiklIBr.exe
  C:\Windows\System\HiklIBr.exe
  2⤵
  PID:12800
- C:\Windows\System\YJjOyrq.exe
  C:\Windows\System\YJjOyrq.exe
  2⤵
  PID:12944
- C:\Windows\System\gOIeIIC.exe
  C:\Windows\System\gOIeIIC.exe
  2⤵
  PID:13016
- C:\Windows\System\aqLUFcb.exe
  C:\Windows\System\aqLUFcb.exe
  2⤵
  PID:13128
- C:\Windows\System\OSLROJI.exe
  C:\Windows\System\OSLROJI.exe
  2⤵
  PID:12988
- C:\Windows\System\TsMrHTo.exe
  C:\Windows\System\TsMrHTo.exe
  2⤵
  PID:13176
- C:\Windows\System\prUGXuB.exe
  C:\Windows\System\prUGXuB.exe
  2⤵
  PID:13220
- C:\Windows\System\UpopWsl.exe
  C:\Windows\System\UpopWsl.exe
  2⤵
  PID:13228
- C:\Windows\System\xOOXxZa.exe
  C:\Windows\System\xOOXxZa.exe
  2⤵
  PID:12380
- C:\Windows\System\GPULSpL.exe
  C:\Windows\System\GPULSpL.exe
  2⤵
  PID:11684
- C:\Windows\System\gnylhDO.exe
  C:\Windows\System\gnylhDO.exe
  2⤵
  PID:12752
- C:\Windows\System\aeqYJqT.exe
  C:\Windows\System\aeqYJqT.exe
  2⤵
  PID:12524
- C:\Windows\System\OMnBKWT.exe
  C:\Windows\System\OMnBKWT.exe
  2⤵
  PID:12808
- C:\Windows\System\xlkZaTF.exe
  C:\Windows\System\xlkZaTF.exe
  2⤵
  PID:12968
- C:\Windows\System\eJxxiFR.exe
  C:\Windows\System\eJxxiFR.exe
  2⤵
  PID:13172
- C:\Windows\System\JhTKFJM.exe
  C:\Windows\System\JhTKFJM.exe
  2⤵
  PID:12484
- C:\Windows\System\IiXmfdQ.exe
  C:\Windows\System\IiXmfdQ.exe
  2⤵
  PID:12660
- C:\Windows\System\BlFXiNX.exe
  C:\Windows\System\BlFXiNX.exe
  2⤵
  PID:12952
- C:\Windows\System\ZLVJOEl.exe
  C:\Windows\System\ZLVJOEl.exe
  2⤵
  PID:13336
- C:\Windows\System\uLUoWCR.exe
  C:\Windows\System\uLUoWCR.exe
  2⤵
  PID:13360
- C:\Windows\System\tPELTSu.exe
  C:\Windows\System\tPELTSu.exe
  2⤵
  PID:13392
- C:\Windows\System\eGjOPBe.exe
  C:\Windows\System\eGjOPBe.exe
  2⤵
  PID:13420
- C:\Windows\System\TlrPwsf.exe
  C:\Windows\System\TlrPwsf.exe
  2⤵
  PID:13444
- C:\Windows\System\FAihfWx.exe
  C:\Windows\System\FAihfWx.exe
  2⤵
  PID:13472
- C:\Windows\System\OMNOxXO.exe
  C:\Windows\System\OMNOxXO.exe
  2⤵
  PID:13496
- C:\Windows\System\xZwCEAN.exe
  C:\Windows\System\xZwCEAN.exe
  2⤵
  PID:13524
- C:\Windows\System\AyslqtV.exe
  C:\Windows\System\AyslqtV.exe
  2⤵
  PID:13548
- C:\Windows\System\TToFXhL.exe
  C:\Windows\System\TToFXhL.exe
  2⤵
  PID:13592
- C:\Windows\System\MswyIrC.exe
  C:\Windows\System\MswyIrC.exe
  2⤵
  PID:13624
- C:\Windows\System\GoLZPnV.exe
  C:\Windows\System\GoLZPnV.exe
  2⤵
  PID:13652
- C:\Windows\System\twIdqna.exe
  C:\Windows\System\twIdqna.exe
  2⤵
  PID:13680
- C:\Windows\System\lrOOpQw.exe
  C:\Windows\System\lrOOpQw.exe
  2⤵
  PID:13708
- C:\Windows\System\GRLQFqV.exe
  C:\Windows\System\GRLQFqV.exe
  2⤵
  PID:13740
- C:\Windows\System\OhxwEaA.exe
  C:\Windows\System\OhxwEaA.exe
  2⤵
  PID:13788
- C:\Windows\System\YZolHrK.exe
  C:\Windows\System\YZolHrK.exe
  2⤵
  PID:13808
- C:\Windows\System\SCwEtIP.exe
  C:\Windows\System\SCwEtIP.exe
  2⤵
  PID:13836
- C:\Windows\System\OxMcUZj.exe
  C:\Windows\System\OxMcUZj.exe
  2⤵
  PID:13860
- C:\Windows\System\BCdJnDB.exe
  C:\Windows\System\BCdJnDB.exe
  2⤵
  PID:13884
- C:\Windows\System\VQMOBaC.exe
  C:\Windows\System\VQMOBaC.exe
  2⤵
  PID:13916
- C:\Windows\System\sCWTpjq.exe
  C:\Windows\System\sCWTpjq.exe
  2⤵
  PID:13948
- C:\Windows\System\rDzDrIw.exe
  C:\Windows\System\rDzDrIw.exe
  2⤵
  PID:13972
- C:\Windows\System\VghzGTu.exe
  C:\Windows\System\VghzGTu.exe
  2⤵
  PID:13996
- C:\Windows\System\jpHthAr.exe
  C:\Windows\System\jpHthAr.exe
  2⤵
  PID:14012
- C:\Windows\System\hjYGPbf.exe
  C:\Windows\System\hjYGPbf.exe
  2⤵
  PID:14104
- C:\Windows\System\ZTHSIPz.exe
  C:\Windows\System\ZTHSIPz.exe
  2⤵
  PID:14132
- C:\Windows\System\lciwzro.exe
  C:\Windows\System\lciwzro.exe
  2⤵
  PID:14168
- C:\Windows\System\NtpajPB.exe
  C:\Windows\System\NtpajPB.exe
  2⤵
  PID:14188
- C:\Windows\System\iqcdFVJ.exe
  C:\Windows\System\iqcdFVJ.exe
  2⤵
  PID:14204
- C:\Windows\System\kfPAGom.exe
  C:\Windows\System\kfPAGom.exe
  2⤵
  PID:14232
- C:\Windows\System\HMKTeyH.exe
  C:\Windows\System\HMKTeyH.exe
  2⤵
  PID:14256
- C:\Windows\System\nZbZgSf.exe
  C:\Windows\System\nZbZgSf.exe
  2⤵
  PID:14292
- C:\Windows\System\nkbxNHt.exe
  C:\Windows\System\nkbxNHt.exe
  2⤵
  PID:14316
- C:\Windows\System\gLLEeXr.exe
  C:\Windows\System\gLLEeXr.exe
  2⤵
  PID:13012
- C:\Windows\System\eIFfGgs.exe
  C:\Windows\System\eIFfGgs.exe
  2⤵
  PID:2116
- C:\Windows\System\TDhWwBH.exe
  C:\Windows\System\TDhWwBH.exe
  2⤵
  PID:13280
- C:\Windows\System\lbqPWrn.exe
  C:\Windows\System\lbqPWrn.exe
  2⤵
  PID:13296
- C:\Windows\System\EKdOsSw.exe
  C:\Windows\System\EKdOsSw.exe
  2⤵
  PID:13440
- C:\Windows\System\TNzdYYJ.exe
  C:\Windows\System\TNzdYYJ.exe
  2⤵
  PID:13368
- C:\Windows\System\yGCHQJH.exe
  C:\Windows\System\yGCHQJH.exe
  2⤵
  PID:13604
- C:\Windows\System\VhlfZvy.exe
  C:\Windows\System\VhlfZvy.exe
  2⤵
  PID:13644
- C:\Windows\System\MWPdJcR.exe
  C:\Windows\System\MWPdJcR.exe
  2⤵
  PID:13572
- C:\Windows\System\jVMFLle.exe
  C:\Windows\System\jVMFLle.exe
  2⤵
  PID:13692
- C:\Windows\System\aJMMRah.exe
  C:\Windows\System\aJMMRah.exe
  2⤵
  PID:13724
- C:\Windows\System\JnAKpsF.exe
  C:\Windows\System\JnAKpsF.exe
  2⤵
  PID:13848
- C:\Windows\System\aMnKArd.exe
  C:\Windows\System\aMnKArd.exe
  2⤵
  PID:13932
- C:\Windows\System\GjidXzc.exe
  C:\Windows\System\GjidXzc.exe
  2⤵
  PID:13908
- C:\Windows\System\SlNYuHP.exe
  C:\Windows\System\SlNYuHP.exe
  2⤵
  PID:13968
- C:\Windows\System\vjfIZpL.exe
  C:\Windows\System\vjfIZpL.exe
  2⤵
  PID:14128
- C:\Windows\System\ENsKciA.exe
  C:\Windows\System\ENsKciA.exe
  2⤵
  PID:14112
- C:\Windows\System\MKCisbX.exe
  C:\Windows\System\MKCisbX.exe
  2⤵
  PID:13512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AoiokBz.exe

Filesize
2.0MB

MD5
d499b673023c2f40989b0e51bbd196dd

SHA1
f20d6a2f8160671010adb86464871ddfd22a6d18

SHA256
b4325846cb78dae4f4011d04838d474bbd11260d58fe15c41e306d6ba929ed24

SHA512
bdf7a1dea268f070865121d85df7af263709bc93606cc73519ad674561e7d628bd5fc2206932261db65c9a62efe9a9c49bf2c833d7a6b492aecf91c9d8818759

Download Submit
C:\Windows\System\CEeRyRq.exe

Filesize
2.0MB

MD5
1be93601bc7b7f1a9a0132bc732083c4

SHA1
50d33fede7764d073ad65d8468bb9ba9888f60ac

SHA256
2df9a943273b56b30ce0176a229b60d67a10989fff1efaffeb3cd841a88b747e

SHA512
fda639b186c0b62abb9dc9f2ae84e539000135de06df66d6b75271081f62a8191d3e0fa8ea6a5a4ba20b91d832e231cfbe80e8bcbc6fd288701b17ec78ff2e9d

Download Submit
C:\Windows\System\DiHOFSs.exe

Filesize
2.0MB

MD5
08342df97cac15f77f4628016881fccf

SHA1
e212f2c7150b508658f46db05ebe73d286c91822

SHA256
7c697d7e3b4fb1dd826f7c949628c053edc980bbb73e4e39bc29c544d0955e41

SHA512
0fa74b8e8be0e6584f2ac7b4af064496ed5c33edac51f2683a0e1bc81aef4ebdc8cdb4bd1f783d586e3ce9027b45656a0204991eb985e1ac91a0daeb7a512eb0

Download Submit
C:\Windows\System\GJjAmzC.exe

Filesize
2.0MB

MD5
e57a3ed8e069a826c498f924c6e89a86

SHA1
cf0d3ae6c1873e0ba06d5bf0f05f678493be5fe2

SHA256
51f8563527f71656abdcd0144e6951dd166791e7e9ff9eaa20e4a2eb85408e2a

SHA512
25fedb7e00c9dedad3b5d619333c92f5732770efc13dd8f12ffa4fe3e5612c2b250c93dc36a2fae1babc23d61a30c685052e3816c26bfb35e183ab7350534c4e

Download Submit
C:\Windows\System\IPSSRaN.exe

Filesize
2.0MB

MD5
ad648cf540e25def8fe365a5493483fb

SHA1
b366286eb44fd02f02b58a7034baa0be7a0e01bf

SHA256
b815673735eca081b242329e92760e6aad96a9283c543368bf0ad6529d3edc8d

SHA512
b056170300689447e36edfa8a3d89ccc82d569b095a21e36ab47c1971f51664cd00b706ce7c3c030905eeb555d941e1522b86260530ba303c2de083b1a4de19c

Download Submit
C:\Windows\System\MGwNjHY.exe

Filesize
2.0MB

MD5
2670f6de44e8a5b74dca6569cc1603cb

SHA1
8120bc97252e6eb50c20270578ff3b0cd9bef3bb

SHA256
2b74c5e1842c3d013145a8fcca7c4ca69fca8e817e03115af3645d6a96e543e8

SHA512
a2faff33b9ef87ec9a6ca18b1ec6a44b33d752b79825c06682860db96a904a1866a7459de5e5f7480acda510fbf3e7a41063e849566166f90be7a7461510bda6

Download Submit
C:\Windows\System\PbWjacQ.exe

Filesize
2.0MB

MD5
56dde87268af736496a010b132aafd3b

SHA1
504ebcbe5ff13def736212b4846fbc553f2efe01

SHA256
862dcac798a634d135e29cfe3896a771dc1fdf4ea7e71739948a4b6dea5b83d2

SHA512
feaf2e195956263953aa03144d0f9cd36d8602af6830b6761475d37da64871e6dd1075f2aa19236ad9c6547cdec03d719d946740aa26fbeb38dc539e99c0cd0e

Download Submit
C:\Windows\System\QEfxQNG.exe

Filesize
2.0MB

MD5
8e8e07bcb4faecdcc066c2970bf4b4c8

SHA1
db293635670405a71ad3ddda6fb5d77ea47f7984

SHA256
ea423a79689ea9b2bb9fadcffdeb984f4b6f63c97b7bb4ddbf5cfe48c6a1c6d8

SHA512
0452d8c9b2f9a87dea28ecbfbc491c3c7675530105f8a3d994d6372de0a0d916e35837d09be2646a407a732fc71251b33a6f75ffc60d9e8c42e13736412c9a43

Download Submit
C:\Windows\System\QZdhfNx.exe

Filesize
2.0MB

MD5
71edfad6162c4904cd40aca5f7fb3e52

SHA1
25ecca45429178a850967e2e8e26edc0971df985

SHA256
a224c8554a7f9f09dee951ae79462cbf9be31aa77e5ac8b9188f37117b173008

SHA512
bbb18c52479c3a1b1a3b92208f5955a573385e2f65895b8139f34199d96cce71ddbe54f554530aaf6e31906695010491d64c9af3e2b9ad76ac95dd9a184df0dd

Download Submit
C:\Windows\System\RsTfgjx.exe

Filesize
2.0MB

MD5
f17176f692256f41a1c7b05efefda827

SHA1
7c232b7a5139f821ff6b0b1ef26d8067ca426679

SHA256
e7cc03579a4242fa72e6256b583a307e97bc2d8c4693dcfe4a9081eb1e516dd1

SHA512
4adfd4ef09a1a99f8fdb2688c83811877b93952b1299649c91eac8e31ceaa30308725c009691b26971261cc9144d616d95ab1417e624f75b76f9512cf88801e8

Download Submit
C:\Windows\System\VxNLiEK.exe

Filesize
2.0MB

MD5
7c6fbcbd71e6b56d72bd444303968560

SHA1
243575da5ae66ce3b6a761c04c9fa6280f662dce

SHA256
c800908961e4d2fd846a565f425e7cb83e2c8d1af20ea1f0eae2d0ade8eddccf

SHA512
fab36c82661ae388fb832f3cf9c72f0b0e9cf0ac8ce50b313f8882a7898cb44b90db2b3c291b9514d076eb2cd52b415e6520e148cd2b9e36542329eb14ab5803

Download Submit
C:\Windows\System\WAwQDHS.exe

Filesize
2.0MB

MD5
ca82ddfc5e065cb02410889b31d5f0f6

SHA1
512d834482b66cf9edb84cfd4f8a698ca1f8bf32

SHA256
b4e609eb410252d799bcedf4da3f74d1376b7b313be338b55cea7655f2f75345

SHA512
1d904216c972e254f65ee4dd4ddfb5b22d1143c2c1ab4882d53ae6c3696551f8233fb906b228346847df1dfdce08d35d7c8c1c1d8faaf5fd64a383b47cc72aea

Download Submit
C:\Windows\System\bMcUgmG.exe

Filesize
2.0MB

MD5
24d946928002d93fdcd99a32ea0dd90e

SHA1
bed4b7b53caf559c75feb6af872131d41c4b7802

SHA256
e963d43d73bfd3f7f17cee0553c07c6b4562c3e33db5d8574332b538a07e1393

SHA512
1f75fe254002967cbd861347a4f84a51a61c3ce50e054d2113d54c7cc02949939e73c9f02ff8a0ad96520d5e5bddfac99c02ea0c2548b68dd30e5e16d8a5ac1b

Download Submit
C:\Windows\System\cNsewLj.exe

Filesize
2.0MB

MD5
6c33b8972e2409d86b2688f7b0999a58

SHA1
118b270f9c092ffcf40e0b6caaf67e42732160ff

SHA256
dcb9ff1e2c4a75ea3361955520c73337da435f1254adb7e4fe528d6ab3ecfb99

SHA512
8a6bef3d1447e7a03df7f6f9550484f5e611d05b1601f59b0ae43cfb1c4912185316d264fabbfdf47dad6ecea89689d98ee1efd367a902b7406af3d74f8b4006

Download Submit
C:\Windows\System\cbWLach.exe

Filesize
2.0MB

MD5
4b0a022977797efdd4cebf9bd7519595

SHA1
816f9a7480edfba983d358c3545105b0e35f8fda

SHA256
6c04fc6a24da9e6edfbb95600c00bf7d538ed1b9d2f3920251720f170a5e5862

SHA512
31b12ba2fcb85dee16e7ac5105a6807a7eb9f5992cd4823a02c534d3ea593b61f73f1305b7b51602d7f61278240041703e71e377f5e0279be9b98dd38c755fd4

Download Submit
C:\Windows\System\gReypmR.exe

Filesize
2.0MB

MD5
1e69afb3ca6536c9b862c96130c3a670

SHA1
d70b0b07af5001a7725987a15181b0c24c8a3f48

SHA256
25f3fc61db0561b95ada58407a8bae44afc39a001aa1bf25d0eabf01cd113d37

SHA512
5f06168dc54e760957946341e7030401b48f4080c5b641ce87c6496f8529db41b0df09f4ea602e45c7132e0a2bd95d1943af6ee7dae1aefa8c1514d5a95e31d9

Download Submit
C:\Windows\System\geVtzRY.exe

Filesize
2.0MB

MD5
ecc3a7e7b2cc3b0eb26fdc37e7aa799f

SHA1
9a310708eecffab14321fcaf0f2468fa50ee6986

SHA256
879e44a8bdd5408aedfe6940a58fcaa6856c6fee820d206759948f55fe1eef2f

SHA512
b2dff64e50990136c88615efa3922b975a3fab536b63298dbcd0188717d9d9a4088663eb546071176e7df1a61ad6af50c6f54f14aec3cba555ef9af0f3bc57a4

Download Submit
C:\Windows\System\gtWhyWM.exe

Filesize
2.0MB

MD5
0edc134b49e619c3f1758442e05253ba

SHA1
aef4395810127664d0e8d6efa4512983d9b88f15

SHA256
dd79d117f54d44c3a169ee69f0fc58eb59939571595315c697a29cf3f11c18b2

SHA512
1aded4e05968fa7f65a3161fdff128fdd0d7ddd3c65012afd8dcf68f54d936a3a6a37e7a6ea3cf7873bbcd7b4a092afabea8e37e42097e58f5fa00f150528d97

Download Submit
C:\Windows\System\jUGupCI.exe

Filesize
2.0MB

MD5
72c6c50d2888e804c4802f96cc5982e6

SHA1
cbc2c5299aca768dafee96103cf8d5f9e9823fd7

SHA256
68aeac18f918d2a43755d2dd273d9327f09d1c15e516679aadaebdc96eee9807

SHA512
ae13ee8092a2f67159eb03f862642772046fedb29568a7e806fbc3d3e22f108f0a502c6dcc57d23c69b6b3d7e14d0bafa06f5f421d25ba16bf6e3c9ebf808343

Download Submit
C:\Windows\System\jbrXqwA.exe

Filesize
2.0MB

MD5
6d962425bc3919b02ee5ab3ea76098ba

SHA1
5312cc2f1bcc38072f623d1cb08c0b59a6f09c02

SHA256
5377617ef9c9e43b5b51f9f3d197846e5d6508d72cfd92114d7425cd62efaad6

SHA512
17a467c1f9df1fa1850d4cab28b33900834876e59317ec22af0e42d2e997343080ca671aa157d6b3e52e65e5f72784988bb584c70739f9b164e2be1023dabdf3

Download Submit
C:\Windows\System\kFXoWrO.exe

Filesize
2.0MB

MD5
7ca873da048e7bd702eef2201ff41d1d

SHA1
9e49c7ec9508a13c3cabed9d97ac2ed2e2828307

SHA256
35caf65e914d933f6194bc7ad096d3500da8c3c14e8188a6e42ffeb079872b71

SHA512
0b2e6aef3cac24b080018d92963726937ace986c432bde7e0f388ed2d85e0788b941f02d1581433ce4cc6b026c2dbb7680c46ec126a10e93b0ea5cf3f3023e64

Download Submit
C:\Windows\System\lJnqPfO.exe

Filesize
2.0MB

MD5
ec31c0c623913a419cbd185a01112350

SHA1
6218f27837deda465ce2b0cd09a6e692cb16bf82

SHA256
76533ed3b94f475f18517a88f38a75c496cb6506b7a50428a98a509015a1041d

SHA512
04f0955d3b961fd8c99341d03d0b32dc09fcb5a8f234c8b5bb3e303fb0aeb16020740531c3ec6353a4cae1c2d848c3231183a134636ea8a0b0f2783e206001a0

Download Submit
C:\Windows\System\lVprdgA.exe

Filesize
2.0MB

MD5
93ac6ffc8af756dbccc157537438b4c7

SHA1
427636c35387bb85cfd180d12060b2f30b14894b

SHA256
f15f08f0414ca3769f797ef3b412be0a9f879a512ad1198acaaa801320d00c3f

SHA512
e6c960515a7e75f00d81e010286630f97246b1c27d692952d35c7638897677c629bd127015259375344fa2b24bce7196a797001313af7122fa9fbf4424b91849

Download Submit
C:\Windows\System\lnXwKHo.exe

Filesize
2.0MB

MD5
ceef818f1b5a6f7592ddf5d9cf0a1a19

SHA1
69e12e624a48fcf67263ab7d79a9658aaf9f30ab

SHA256
de2406f2c2e5d2cf0012954f137c41498cbafee88a40fe9483c06dcaf2be2d50

SHA512
53f288ab8710c4206e572f096faa9656d1029f36807562f621850ab1908b7396ec708bcab55894ca631f1e2e0d21499dd7f62f189051fe6fa52236ced332cc18

Download Submit
C:\Windows\System\mXMOLOw.exe

Filesize
2.0MB

MD5
2882823b7ce793e52719a180bde27e99

SHA1
576ce67e0721b6879c159e662c6fbe39c5f7f76d

SHA256
11c4951892150df5b6bf9f110ae3c7eaa54240a2053bdedcf3857f78cb2f3a37

SHA512
58a75e6b29954b59621f49f9a030d5c6c7063c244d9701fdc74f7b0872355fc81c2d786b75e1e1a0f01482dbb76a85f6c6f36a67c5d016b0979c16147bdc340d

Download Submit
C:\Windows\System\nIiKGWb.exe

Filesize
2.0MB

MD5
4e6f53a3da01cbac52f1216930e6aaa7

SHA1
f1ae56fd397462efa2b01362039c53ed7c0b5072

SHA256
dcd7f3426361659b18793a919b15eafd81945d6c47de61cda89c692700c47149

SHA512
ce6d8b0f785774a6546e46c88ec113c8586592c049f9c7d387041715f79ef124db4722f2e8cfa163bd0b02411c4688374f2472424d31a9e2175302bcc5d5c288

Download Submit
C:\Windows\System\pNcdIlN.exe

Filesize
2.0MB

MD5
72b4e2fb7ed9c940642685bf63be0dd2

SHA1
4923d07280bc0977fd3ac9f1326cfe5e5ea8e4a7

SHA256
b95baf43ee381f1d649cb4727c85a52e281569c8b19a75830ad5cdff66eb0b3d

SHA512
3579735bcdb8f1a9c8364d53a818883d4ac9b6258d2c4be0bccbe5cb394c2330221eaf147c19fdd48c59d3c96949335fb9caa34a081f24618555b0d7325b2864

Download Submit
C:\Windows\System\qTShxqC.exe

Filesize
2.0MB

MD5
ed3c0b48489f1772f5fde9e78819b20c

SHA1
196a24721952834e01838723d7409d412b667021

SHA256
723399e67c3c5a8c540f7aa87fa62198a695a125151c054cfe4dfebdebac2b26

SHA512
8bffab6b1c1e20aa6eee56b8fa9b6c7f9448f5294e0364651e7ace2ef01b4068f26271802525ccd45f9f0dbc79950a346b02220eeb14a2dbbff6db3836e5bcb3

Download Submit
C:\Windows\System\uBUuHhm.exe

Filesize
2.0MB

MD5
fb7312d98496391db335093f18aec78b

SHA1
6bbc8d28d1908f474a2516bfe2c2b33252a4a016

SHA256
5e3d4e47ed6adcd96558e07d346037441f4d20b8a38efd6eabddfa6042e0affd

SHA512
638d2446ce2c564b0944db04e7cf41816eb039a31baeee1e0b0ae738265447aae65f555939e664127753844b01a7c8eda4c1d25c05fdf176c89c7da9639b1f40

Download Submit
C:\Windows\System\vnYBoCW.exe

Filesize
2.0MB

MD5
a36de2c3ddd3c569e0f9a11f8e93fb0b

SHA1
5dbdf6bf942129fc4e63615da9b3573f727a86c4

SHA256
0ba19f207e73af8ea8979704b304769b02abd0371eca5b56807b53b6980d7626

SHA512
1703dc87214ca92fc23c5d2532ce988eb1ca998b3a356de2867d15fcaf707b1747ed10075b709ea63b911ad26d6b58d0720b871ff81c2334c6ed3c5c31060485

Download Submit
C:\Windows\System\xFXjHpH.exe

Filesize
2.0MB

MD5
92f966d6f00c884662b4f99e5a5db26e

SHA1
2cfd96f9b1038ca8494c3cc87a41a80cab9c6ae0

SHA256
e82286eb09027b35e94b887357fdf940dee71714acbe2cfc4e04251fdb4a2504

SHA512
40ee3db7412eae97728f2ff3614a6116c848909402fda07c99c86d8d75b7cb35087fdaac8b6073a511f976ef5b16e75a9a70ef8bde9d31b938270977bd8c3677

Download Submit
C:\Windows\System\yYAmbeK.exe

Filesize
2.0MB

MD5
511e1af0d0611903e9ca1390190c807d

SHA1
86228c8f3540ee2b13fbfe2433359d89dad32f90

SHA256
c18046eede0a1f8df7e8a6d9a7daaa1051c3010312c57807ea85f2623fd79563

SHA512
e0bca8bd3668f109680eb728ae2d7d01e8ad3f3d3a19f754d2604d9f80d05c166de61d84adcb95a12f421c377eb9af9b72a5b98adb398549316810937fc8e3de

Download Submit
C:\Windows\System\yfMiHZo.exe

Filesize
2.0MB

MD5
888adfc933748943d38f07fe7f8c7c3e

SHA1
00c41cce787b217087193dabe337303fe3dffe50

SHA256
26bfe6ab44188c1a8a6db50d6911e155b5cb9bae01a18a6d54eeb0306602c164

SHA512
bede9a95f3c5d90be6c2271ab4d7fbc160bf134c383ea9f911b42397b527de9d45c5de68c0c14b4f188d471bca82ee215e937818bade0464b41eca695854be69

Download Submit
C:\Windows\System\yucNmSu.exe

Filesize
2.0MB

MD5
ee32feebb1a92d1fc73808e3c54ae642

SHA1
3dffcecdd2b1944feae34dd355763ae6f0422c2c

SHA256
e8999a6d793f278b11825e5371fc4c509940aa9887cde8f50af09b8b7a7a9a1c

SHA512
2084f4e81ffe938d9766efbe233f17ca64c80f9df863eb1ca502b8077acc1d526fa77847a8f2ebc36ea1120a7a4e6529be062f97a1664b826d5b7a6d28772374

Download Submit
C:\Windows\System\ztmnXWm.exe

Filesize
2.0MB

MD5
8fce57a557a61fd5c4da833a05fb98de

SHA1
0cb38fb7400ef6cc921cbb00faf0d5706e373cb9

SHA256
9cab54ca16cc4d99800e14dc019006a8c21e269942965bf8e107a4dca4f1f681

SHA512
b252e6dd393a17d32cb82e21e9d692b711aabc2fb8301d20975af98781f0d4d6e7545131dc6db172bf863c65987df7648c4a4f765fecc19f4164f2745ddace2b

Download Submit
memory/212-2178-0x00007FF64D550000-0x00007FF64D8A4000-memory.dmp

Filesize
3.3MB

Download
memory/212-106-0x00007FF64D550000-0x00007FF64D8A4000-memory.dmp

Filesize
3.3MB

Download
memory/664-2189-0x00007FF634AD0000-0x00007FF634E24000-memory.dmp

Filesize
3.3MB

Download
memory/664-2167-0x00007FF634AD0000-0x00007FF634E24000-memory.dmp

Filesize
3.3MB

Download
memory/664-133-0x00007FF634AD0000-0x00007FF634E24000-memory.dmp

Filesize
3.3MB

Download
memory/872-2195-0x00007FF6CCCA0000-0x00007FF6CCFF4000-memory.dmp

Filesize
3.3MB

Download
memory/872-198-0x00007FF6CCCA0000-0x00007FF6CCFF4000-memory.dmp

Filesize
3.3MB

Download
memory/888-153-0x00007FF78F650000-0x00007FF78F9A4000-memory.dmp

Filesize
3.3MB

Download
memory/888-2191-0x00007FF78F650000-0x00007FF78F9A4000-memory.dmp

Filesize
3.3MB

Download
memory/888-2168-0x00007FF78F650000-0x00007FF78F9A4000-memory.dmp

Filesize
3.3MB

Download
memory/908-2185-0x00007FF753360000-0x00007FF7536B4000-memory.dmp

Filesize
3.3MB

Download
memory/908-104-0x00007FF753360000-0x00007FF7536B4000-memory.dmp

Filesize
3.3MB

Download
memory/968-199-0x00007FF61C9D0000-0x00007FF61CD24000-memory.dmp

Filesize
3.3MB

Download
memory/968-2193-0x00007FF61C9D0000-0x00007FF61CD24000-memory.dmp

Filesize
3.3MB

Download
memory/1228-1-0x00000215E6F70000-0x00000215E6F80000-memory.dmp

Filesize
64KB

Download
memory/1228-0-0x00007FF79E8C0000-0x00007FF79EC14000-memory.dmp

Filesize
3.3MB

Download
memory/1276-2182-0x00007FF779860000-0x00007FF779BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1276-109-0x00007FF779860000-0x00007FF779BB4000-memory.dmp

Filesize
3.3MB

Download
memory/1324-101-0x00007FF7F9B20000-0x00007FF7F9E74000-memory.dmp

Filesize
3.3MB

Download
memory/1324-2183-0x00007FF7F9B20000-0x00007FF7F9E74000-memory.dmp

Filesize
3.3MB

Download
memory/1404-2194-0x00007FF67DF00000-0x00007FF67E254000-memory.dmp

Filesize
3.3MB

Download
memory/1404-194-0x00007FF67DF00000-0x00007FF67E254000-memory.dmp

Filesize
3.3MB

Download
memory/1656-81-0x00007FF7A6D70000-0x00007FF7A70C4000-memory.dmp

Filesize
3.3MB

Download
memory/1656-2180-0x00007FF7A6D70000-0x00007FF7A70C4000-memory.dmp

Filesize
3.3MB

Download
memory/2132-59-0x00007FF6A7B50000-0x00007FF6A7EA4000-memory.dmp

Filesize
3.3MB

Download
memory/2132-2173-0x00007FF6A7B50000-0x00007FF6A7EA4000-memory.dmp

Filesize
3.3MB

Download
memory/2360-2181-0x00007FF75D400000-0x00007FF75D754000-memory.dmp

Filesize
3.3MB

Download
memory/2360-69-0x00007FF75D400000-0x00007FF75D754000-memory.dmp

Filesize
3.3MB

Download
memory/2536-2175-0x00007FF7E7B70000-0x00007FF7E7EC4000-memory.dmp

Filesize
3.3MB

Download
memory/2536-94-0x00007FF7E7B70000-0x00007FF7E7EC4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-2177-0x00007FF767F40000-0x00007FF768294000-memory.dmp

Filesize
3.3MB

Download
memory/2724-91-0x00007FF767F40000-0x00007FF768294000-memory.dmp

Filesize
3.3MB

Download
memory/2872-103-0x00007FF64DAE0000-0x00007FF64DE34000-memory.dmp

Filesize
3.3MB

Download
memory/2872-2184-0x00007FF64DAE0000-0x00007FF64DE34000-memory.dmp

Filesize
3.3MB

Download
memory/2948-49-0x00007FF6236E0000-0x00007FF623A34000-memory.dmp

Filesize
3.3MB

Download
memory/2948-2171-0x00007FF6236E0000-0x00007FF623A34000-memory.dmp

Filesize
3.3MB

Download
memory/3068-102-0x00007FF67A520000-0x00007FF67A874000-memory.dmp

Filesize
3.3MB

Download
memory/3068-2174-0x00007FF67A520000-0x00007FF67A874000-memory.dmp

Filesize
3.3MB

Download
memory/3628-192-0x00007FF64C280000-0x00007FF64C5D4000-memory.dmp

Filesize
3.3MB

Download
memory/3628-2192-0x00007FF64C280000-0x00007FF64C5D4000-memory.dmp

Filesize
3.3MB

Download
memory/3844-2165-0x00007FF66C570000-0x00007FF66C8C4000-memory.dmp

Filesize
3.3MB

Download
memory/3844-2190-0x00007FF66C570000-0x00007FF66C8C4000-memory.dmp

Filesize
3.3MB

Download
memory/3844-146-0x00007FF66C570000-0x00007FF66C8C4000-memory.dmp

Filesize
3.3MB

Download
memory/4044-2166-0x00007FF7806D0000-0x00007FF780A24000-memory.dmp

Filesize
3.3MB

Download
memory/4044-172-0x00007FF7806D0000-0x00007FF780A24000-memory.dmp

Filesize
3.3MB

Download
memory/4044-2196-0x00007FF7806D0000-0x00007FF780A24000-memory.dmp

Filesize
3.3MB

Download
memory/4072-107-0x00007FF73FD10000-0x00007FF740064000-memory.dmp

Filesize
3.3MB

Download
memory/4072-2176-0x00007FF73FD10000-0x00007FF740064000-memory.dmp

Filesize
3.3MB

Download
memory/4088-110-0x00007FF65B310000-0x00007FF65B664000-memory.dmp

Filesize
3.3MB

Download
memory/4088-2186-0x00007FF65B310000-0x00007FF65B664000-memory.dmp

Filesize
3.3MB

Download
memory/4108-193-0x00007FF794A30000-0x00007FF794D84000-memory.dmp

Filesize
3.3MB

Download
memory/4108-2188-0x00007FF794A30000-0x00007FF794D84000-memory.dmp

Filesize
3.3MB

Download
memory/4120-2170-0x00007FF790B60000-0x00007FF790EB4000-memory.dmp

Filesize
3.3MB

Download
memory/4120-10-0x00007FF790B60000-0x00007FF790EB4000-memory.dmp

Filesize
3.3MB

Download
memory/4120-2163-0x00007FF790B60000-0x00007FF790EB4000-memory.dmp

Filesize
3.3MB

Download
memory/4356-108-0x00007FF79DF80000-0x00007FF79E2D4000-memory.dmp

Filesize
3.3MB

Download
memory/4356-2179-0x00007FF79DF80000-0x00007FF79E2D4000-memory.dmp

Filesize
3.3MB

Download
memory/4516-200-0x00007FF738E40000-0x00007FF739194000-memory.dmp

Filesize
3.3MB

Download
memory/4516-2198-0x00007FF738E40000-0x00007FF739194000-memory.dmp

Filesize
3.3MB

Download
memory/4576-2187-0x00007FF6AADC0000-0x00007FF6AB114000-memory.dmp

Filesize
3.3MB

Download
memory/4576-105-0x00007FF6AADC0000-0x00007FF6AB114000-memory.dmp

Filesize
3.3MB

Download
memory/5040-25-0x00007FF609B30000-0x00007FF609E84000-memory.dmp

Filesize
3.3MB

Download
memory/5040-2164-0x00007FF609B30000-0x00007FF609E84000-memory.dmp

Filesize
3.3MB

Download
memory/5040-2172-0x00007FF609B30000-0x00007FF609E84000-memory.dmp

Filesize
3.3MB

Download
memory/5068-2197-0x00007FF65F430000-0x00007FF65F784000-memory.dmp

Filesize
3.3MB

Download
memory/5068-2169-0x00007FF65F430000-0x00007FF65F784000-memory.dmp

Filesize
3.3MB

Download
memory/5068-183-0x00007FF65F430000-0x00007FF65F784000-memory.dmp

Filesize
3.3MB

Download