xmrig | ccffbb9fbff0378cb3682ec0dc3fd63ea6d0ac57e92c2c59697574679bcbe485

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
Size

2.0MB
MD5

4a4f0198b538499403078686d3c3d0b0
SHA1

b1eb9a8512d6e86efaa91dedd5d5ef640cec1e65
SHA256

ccffbb9fbff0378cb3682ec0dc3fd63ea6d0ac57e92c2c59697574679bcbe485
SHA512

f66907c31cc777ea035320cad4d14099073e7e387c1222ec9fed4c9047e272f2820c9af96e4103c821d90122468f700329fed426b1e1112b5070c0dffbfde3ac
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbbnlD5xXY56iT:BemTLkNdfE0pZrf

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5112-0-0x00007FF718C60000-0x00007FF718FB4000-memory.dmp	xmrig
behavioral2/files/0x000d00000002342e-5.dat	xmrig
behavioral2/memory/3816-6-0x00007FF706FB0000-0x00007FF707304000-memory.dmp	xmrig
behavioral2/files/0x000800000002343a-10.dat	xmrig
behavioral2/files/0x0008000000023437-12.dat	xmrig
behavioral2/memory/1732-14-0x00007FF72B320000-0x00007FF72B674000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-24.dat	xmrig
behavioral2/memory/3108-26-0x00007FF735800000-0x00007FF735B54000-memory.dmp	xmrig
behavioral2/memory/1776-20-0x00007FF6FC6B0000-0x00007FF6FCA04000-memory.dmp	xmrig
behavioral2/files/0x0008000000023438-30.dat	xmrig
behavioral2/files/0x000700000002343c-37.dat	xmrig
behavioral2/files/0x000700000002343e-43.dat	xmrig
behavioral2/files/0x000700000002343d-46.dat	xmrig
behavioral2/files/0x000700000002343f-50.dat	xmrig
behavioral2/files/0x0007000000023442-64.dat	xmrig
behavioral2/files/0x0007000000023444-79.dat	xmrig
behavioral2/files/0x0007000000023445-85.dat	xmrig
behavioral2/files/0x000700000002344c-120.dat	xmrig
behavioral2/files/0x0007000000023453-149.dat	xmrig
behavioral2/files/0x0007000000023455-165.dat	xmrig
behavioral2/memory/3604-642-0x00007FF720A50000-0x00007FF720DA4000-memory.dmp	xmrig
behavioral2/memory/2416-646-0x00007FF707880000-0x00007FF707BD4000-memory.dmp	xmrig
behavioral2/memory/4696-647-0x00007FF653750000-0x00007FF653AA4000-memory.dmp	xmrig
behavioral2/memory/1660-650-0x00007FF744EA0000-0x00007FF7451F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023457-169.dat	xmrig
behavioral2/files/0x0007000000023456-164.dat	xmrig
behavioral2/files/0x0007000000023454-160.dat	xmrig
behavioral2/files/0x0007000000023452-150.dat	xmrig
behavioral2/files/0x0007000000023451-145.dat	xmrig
behavioral2/files/0x0007000000023450-139.dat	xmrig
behavioral2/files/0x000700000002344f-135.dat	xmrig
behavioral2/files/0x000700000002344e-130.dat	xmrig
behavioral2/files/0x000700000002344d-125.dat	xmrig
behavioral2/files/0x000700000002344b-115.dat	xmrig
behavioral2/files/0x000700000002344a-110.dat	xmrig
behavioral2/files/0x0007000000023449-105.dat	xmrig
behavioral2/files/0x0007000000023448-100.dat	xmrig
behavioral2/files/0x0007000000023447-95.dat	xmrig
behavioral2/files/0x0007000000023446-89.dat	xmrig
behavioral2/files/0x0007000000023443-75.dat	xmrig
behavioral2/files/0x0007000000023441-65.dat	xmrig
behavioral2/files/0x0007000000023440-57.dat	xmrig
behavioral2/memory/3220-48-0x00007FF769100000-0x00007FF769454000-memory.dmp	xmrig
behavioral2/memory/2396-39-0x00007FF794B70000-0x00007FF794EC4000-memory.dmp	xmrig
behavioral2/memory/3672-655-0x00007FF77DFE0000-0x00007FF77E334000-memory.dmp	xmrig
behavioral2/memory/4036-658-0x00007FF64AB80000-0x00007FF64AED4000-memory.dmp	xmrig
behavioral2/memory/3032-689-0x00007FF7044C0000-0x00007FF704814000-memory.dmp	xmrig
behavioral2/memory/4220-683-0x00007FF714DF0000-0x00007FF715144000-memory.dmp	xmrig
behavioral2/memory/1812-677-0x00007FF6B98C0000-0x00007FF6B9C14000-memory.dmp	xmrig
behavioral2/memory/3168-665-0x00007FF60A6C0000-0x00007FF60AA14000-memory.dmp	xmrig
behavioral2/memory/4756-662-0x00007FF667AD0000-0x00007FF667E24000-memory.dmp	xmrig
behavioral2/memory/4432-693-0x00007FF75EED0000-0x00007FF75F224000-memory.dmp	xmrig
behavioral2/memory/4768-697-0x00007FF7D7C70000-0x00007FF7D7FC4000-memory.dmp	xmrig
behavioral2/memory/1980-698-0x00007FF75D730000-0x00007FF75DA84000-memory.dmp	xmrig
behavioral2/memory/2176-704-0x00007FF696BE0000-0x00007FF696F34000-memory.dmp	xmrig
behavioral2/memory/2260-712-0x00007FF6F7EB0000-0x00007FF6F8204000-memory.dmp	xmrig
behavioral2/memory/3748-801-0x00007FF65FE60000-0x00007FF6601B4000-memory.dmp	xmrig
behavioral2/memory/4528-807-0x00007FF7FB3F0000-0x00007FF7FB744000-memory.dmp	xmrig
behavioral2/memory/3612-811-0x00007FF772710000-0x00007FF772A64000-memory.dmp	xmrig
behavioral2/memory/1612-810-0x00007FF6983A0000-0x00007FF6986F4000-memory.dmp	xmrig
behavioral2/memory/2136-711-0x00007FF7589C0000-0x00007FF758D14000-memory.dmp	xmrig
behavioral2/memory/2852-707-0x00007FF6DDE20000-0x00007FF6DE174000-memory.dmp	xmrig
behavioral2/memory/4920-701-0x00007FF7CF020000-0x00007FF7CF374000-memory.dmp	xmrig
behavioral2/memory/3816-2102-0x00007FF706FB0000-0x00007FF707304000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3816	jYWtYFK.exe
1732	cpINJTG.exe
1776	XRNcImQ.exe
3108	RwzyiuH.exe
2396	WuQKZhA.exe
3220	YkfgSik.exe
1612	EFBQCYQ.exe
3604	IsJIoFK.exe
3612	iEQwvNg.exe
2416	NcjiDRd.exe
4696	JGSBYFJ.exe
1660	wypAWtW.exe
3672	CtwMSaM.exe
4036	MrUrkeF.exe
4756	WHTtJmE.exe
3168	mFNyAVq.exe
1812	qgzqhDK.exe
4220	iUYHaDu.exe
3032	xxcKpDe.exe
4432	cgXcXXB.exe
4768	mGemnVf.exe
1980	dEskviC.exe
4920	rXWazsY.exe
2176	xidOfjn.exe
2852	RUuPFAH.exe
2136	zQVKOBL.exe
2260	GnLkVip.exe
3748	pMkGgfL.exe
4528	wGfWujo.exe
1728	OCypwKp.exe
536	cHelbNA.exe
4468	TYDuISm.exe
2184	OlUgHun.exe
3276	MjIfFCj.exe
4140	GuncQRq.exe
2872	EMWBtNU.exe
3164	yjjnLVD.exe
1820	dRUorbw.exe
1316	qiXzBVC.exe
3972	frJLZgn.exe
1376	MWmJkpk.exe
4344	jJHZULa.exe
1308	NjYQqTn.exe
680	rlCQbbr.exe
4688	vFfrecZ.exe
3792	BleNhCF.exe
1624	dAOQAUL.exe
3868	rJWCgca.exe
4572	FDcwtav.exe
372	CscZWgK.exe
4568	ZqfrjIm.exe
228	NRyDkFH.exe
1072	rxuDijG.exe
448	xYrOhCa.exe
1756	QgkQFwe.exe
1028	dsllCrb.exe
5012	kkWFYhj.exe
552	SiljNji.exe
3716	jttycUC.exe
2592	oJDgxaQ.exe
3780	aUWdunL.exe
4092	ezlBYdw.exe
1940	QDTeepI.exe
512	OyBcSnd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5112-0-0x00007FF718C60000-0x00007FF718FB4000-memory.dmp	upx
behavioral2/files/0x000d00000002342e-5.dat	upx
behavioral2/memory/3816-6-0x00007FF706FB0000-0x00007FF707304000-memory.dmp	upx
behavioral2/files/0x000800000002343a-10.dat	upx
behavioral2/files/0x0008000000023437-12.dat	upx
behavioral2/memory/1732-14-0x00007FF72B320000-0x00007FF72B674000-memory.dmp	upx
behavioral2/files/0x000700000002343b-24.dat	upx
behavioral2/memory/3108-26-0x00007FF735800000-0x00007FF735B54000-memory.dmp	upx
behavioral2/memory/1776-20-0x00007FF6FC6B0000-0x00007FF6FCA04000-memory.dmp	upx
behavioral2/files/0x0008000000023438-30.dat	upx
behavioral2/files/0x000700000002343c-37.dat	upx
behavioral2/files/0x000700000002343e-43.dat	upx
behavioral2/files/0x000700000002343d-46.dat	upx
behavioral2/files/0x000700000002343f-50.dat	upx
behavioral2/files/0x0007000000023442-64.dat	upx
behavioral2/files/0x0007000000023444-79.dat	upx
behavioral2/files/0x0007000000023445-85.dat	upx
behavioral2/files/0x000700000002344c-120.dat	upx
behavioral2/files/0x0007000000023453-149.dat	upx
behavioral2/files/0x0007000000023455-165.dat	upx
behavioral2/memory/3604-642-0x00007FF720A50000-0x00007FF720DA4000-memory.dmp	upx
behavioral2/memory/2416-646-0x00007FF707880000-0x00007FF707BD4000-memory.dmp	upx
behavioral2/memory/4696-647-0x00007FF653750000-0x00007FF653AA4000-memory.dmp	upx
behavioral2/memory/1660-650-0x00007FF744EA0000-0x00007FF7451F4000-memory.dmp	upx
behavioral2/files/0x0007000000023457-169.dat	upx
behavioral2/files/0x0007000000023456-164.dat	upx
behavioral2/files/0x0007000000023454-160.dat	upx
behavioral2/files/0x0007000000023452-150.dat	upx
behavioral2/files/0x0007000000023451-145.dat	upx
behavioral2/files/0x0007000000023450-139.dat	upx
behavioral2/files/0x000700000002344f-135.dat	upx
behavioral2/files/0x000700000002344e-130.dat	upx
behavioral2/files/0x000700000002344d-125.dat	upx
behavioral2/files/0x000700000002344b-115.dat	upx
behavioral2/files/0x000700000002344a-110.dat	upx
behavioral2/files/0x0007000000023449-105.dat	upx
behavioral2/files/0x0007000000023448-100.dat	upx
behavioral2/files/0x0007000000023447-95.dat	upx
behavioral2/files/0x0007000000023446-89.dat	upx
behavioral2/files/0x0007000000023443-75.dat	upx
behavioral2/files/0x0007000000023441-65.dat	upx
behavioral2/files/0x0007000000023440-57.dat	upx
behavioral2/memory/3220-48-0x00007FF769100000-0x00007FF769454000-memory.dmp	upx
behavioral2/memory/2396-39-0x00007FF794B70000-0x00007FF794EC4000-memory.dmp	upx
behavioral2/memory/3672-655-0x00007FF77DFE0000-0x00007FF77E334000-memory.dmp	upx
behavioral2/memory/4036-658-0x00007FF64AB80000-0x00007FF64AED4000-memory.dmp	upx
behavioral2/memory/3032-689-0x00007FF7044C0000-0x00007FF704814000-memory.dmp	upx
behavioral2/memory/4220-683-0x00007FF714DF0000-0x00007FF715144000-memory.dmp	upx
behavioral2/memory/1812-677-0x00007FF6B98C0000-0x00007FF6B9C14000-memory.dmp	upx
behavioral2/memory/3168-665-0x00007FF60A6C0000-0x00007FF60AA14000-memory.dmp	upx
behavioral2/memory/4756-662-0x00007FF667AD0000-0x00007FF667E24000-memory.dmp	upx
behavioral2/memory/4432-693-0x00007FF75EED0000-0x00007FF75F224000-memory.dmp	upx
behavioral2/memory/4768-697-0x00007FF7D7C70000-0x00007FF7D7FC4000-memory.dmp	upx
behavioral2/memory/1980-698-0x00007FF75D730000-0x00007FF75DA84000-memory.dmp	upx
behavioral2/memory/2176-704-0x00007FF696BE0000-0x00007FF696F34000-memory.dmp	upx
behavioral2/memory/2260-712-0x00007FF6F7EB0000-0x00007FF6F8204000-memory.dmp	upx
behavioral2/memory/3748-801-0x00007FF65FE60000-0x00007FF6601B4000-memory.dmp	upx
behavioral2/memory/4528-807-0x00007FF7FB3F0000-0x00007FF7FB744000-memory.dmp	upx
behavioral2/memory/3612-811-0x00007FF772710000-0x00007FF772A64000-memory.dmp	upx
behavioral2/memory/1612-810-0x00007FF6983A0000-0x00007FF6986F4000-memory.dmp	upx
behavioral2/memory/2136-711-0x00007FF7589C0000-0x00007FF758D14000-memory.dmp	upx
behavioral2/memory/2852-707-0x00007FF6DDE20000-0x00007FF6DE174000-memory.dmp	upx
behavioral2/memory/4920-701-0x00007FF7CF020000-0x00007FF7CF374000-memory.dmp	upx
behavioral2/memory/3816-2102-0x00007FF706FB0000-0x00007FF707304000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SiljNji.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\OkexbCi.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\hgGckwJ.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\atsGzpg.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\oaHJEHa.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\lLcynjo.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\buWhUYD.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\pzmLfnI.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\aUWdunL.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\iMWcFge.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\caWDoPH.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\tpScoVQ.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\HzUvjHg.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\hjlSxoO.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\ZMgiqMJ.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\EBrYxiP.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\LUKbdxX.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\ByWFrRt.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\hiPJkXY.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\WlzgxBn.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\sshmApn.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\mHhprAd.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\CZFjLom.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\iGSCvVc.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\pFDJwcy.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\UFRDeLM.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\fbDVrxb.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\KdGNVwr.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\BqCRduo.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\YfrxEyg.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\wxEfbJV.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\cpINJTG.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\KnOdPrN.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\cQXPwyc.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\AbTHtJH.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\PoBmcQu.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\YgeurRs.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\MYqzxPt.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\pvOXWnx.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\mFNyAVq.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\iUYHaDu.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\XckGVvk.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\qVsogbi.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\LMZLjJA.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\abIWMVJ.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\uIenrjJ.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\ZNdoCqm.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\LbjZTDL.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\pybAnST.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\CqcKYYu.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\GygJtPv.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\FkvRbBa.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\utVvZpO.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\cMteuew.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\PmdFdVH.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\wIMhIBy.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\JIFHnqt.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\YZyXcId.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\jrhwAjp.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\owpcjxK.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\ADDDCLK.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\KMmmRjZ.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\jIgZHHl.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
File created	C:\Windows\System\oefxDPv.exe	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3816	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	81
PID 5112 wrote to memory of 3816	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	81
PID 5112 wrote to memory of 1732	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	83
PID 5112 wrote to memory of 1732	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	83
PID 5112 wrote to memory of 1776	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	84
PID 5112 wrote to memory of 1776	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	84
PID 5112 wrote to memory of 3108	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	86
PID 5112 wrote to memory of 3108	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	86
PID 5112 wrote to memory of 2396	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	87
PID 5112 wrote to memory of 2396	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	87
PID 5112 wrote to memory of 3220	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	89
PID 5112 wrote to memory of 3220	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	89
PID 5112 wrote to memory of 1612	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	90
PID 5112 wrote to memory of 1612	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	90
PID 5112 wrote to memory of 3604	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	91
PID 5112 wrote to memory of 3604	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	91
PID 5112 wrote to memory of 3612	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	92
PID 5112 wrote to memory of 3612	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	92
PID 5112 wrote to memory of 2416	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	93
PID 5112 wrote to memory of 2416	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	93
PID 5112 wrote to memory of 4696	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	94
PID 5112 wrote to memory of 4696	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	94
PID 5112 wrote to memory of 1660	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	95
PID 5112 wrote to memory of 1660	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	95
PID 5112 wrote to memory of 3672	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	96
PID 5112 wrote to memory of 3672	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	96
PID 5112 wrote to memory of 4036	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	97
PID 5112 wrote to memory of 4036	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	97
PID 5112 wrote to memory of 4756	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	98
PID 5112 wrote to memory of 4756	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	98
PID 5112 wrote to memory of 3168	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	99
PID 5112 wrote to memory of 3168	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	99
PID 5112 wrote to memory of 1812	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	100
PID 5112 wrote to memory of 1812	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	100
PID 5112 wrote to memory of 4220	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	101
PID 5112 wrote to memory of 4220	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	101
PID 5112 wrote to memory of 3032	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	102
PID 5112 wrote to memory of 3032	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	102
PID 5112 wrote to memory of 4432	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	103
PID 5112 wrote to memory of 4432	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	103
PID 5112 wrote to memory of 4768	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	104
PID 5112 wrote to memory of 4768	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	104
PID 5112 wrote to memory of 1980	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	105
PID 5112 wrote to memory of 1980	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	105
PID 5112 wrote to memory of 4920	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	106
PID 5112 wrote to memory of 4920	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	106
PID 5112 wrote to memory of 2176	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	107
PID 5112 wrote to memory of 2176	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	107
PID 5112 wrote to memory of 2852	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	108
PID 5112 wrote to memory of 2852	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	108
PID 5112 wrote to memory of 2136	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	109
PID 5112 wrote to memory of 2136	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	109
PID 5112 wrote to memory of 2260	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	110
PID 5112 wrote to memory of 2260	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	110
PID 5112 wrote to memory of 3748	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	111
PID 5112 wrote to memory of 3748	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	111
PID 5112 wrote to memory of 4528	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	112
PID 5112 wrote to memory of 4528	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	112
PID 5112 wrote to memory of 1728	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	113
PID 5112 wrote to memory of 1728	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	113
PID 5112 wrote to memory of 536	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	114
PID 5112 wrote to memory of 536	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	114
PID 5112 wrote to memory of 4468	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	115
PID 5112 wrote to memory of 4468	5112	4a4f0198b538499403078686d3c3d0b0_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\4a4f0198b538499403078686d3c3d0b0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\4a4f0198b538499403078686d3c3d0b0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\System\jYWtYFK.exe
  C:\Windows\System\jYWtYFK.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\cpINJTG.exe
  C:\Windows\System\cpINJTG.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\XRNcImQ.exe
  C:\Windows\System\XRNcImQ.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\RwzyiuH.exe
  C:\Windows\System\RwzyiuH.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\WuQKZhA.exe
  C:\Windows\System\WuQKZhA.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\YkfgSik.exe
  C:\Windows\System\YkfgSik.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\EFBQCYQ.exe
  C:\Windows\System\EFBQCYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\IsJIoFK.exe
  C:\Windows\System\IsJIoFK.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\iEQwvNg.exe
  C:\Windows\System\iEQwvNg.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\NcjiDRd.exe
  C:\Windows\System\NcjiDRd.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\JGSBYFJ.exe
  C:\Windows\System\JGSBYFJ.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\wypAWtW.exe
  C:\Windows\System\wypAWtW.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\CtwMSaM.exe
  C:\Windows\System\CtwMSaM.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\MrUrkeF.exe
  C:\Windows\System\MrUrkeF.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\WHTtJmE.exe
  C:\Windows\System\WHTtJmE.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\mFNyAVq.exe
  C:\Windows\System\mFNyAVq.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\qgzqhDK.exe
  C:\Windows\System\qgzqhDK.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\iUYHaDu.exe
  C:\Windows\System\iUYHaDu.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\xxcKpDe.exe
  C:\Windows\System\xxcKpDe.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\cgXcXXB.exe
  C:\Windows\System\cgXcXXB.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\mGemnVf.exe
  C:\Windows\System\mGemnVf.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\dEskviC.exe
  C:\Windows\System\dEskviC.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\rXWazsY.exe
  C:\Windows\System\rXWazsY.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\xidOfjn.exe
  C:\Windows\System\xidOfjn.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\RUuPFAH.exe
  C:\Windows\System\RUuPFAH.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\zQVKOBL.exe
  C:\Windows\System\zQVKOBL.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\GnLkVip.exe
  C:\Windows\System\GnLkVip.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\pMkGgfL.exe
  C:\Windows\System\pMkGgfL.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\wGfWujo.exe
  C:\Windows\System\wGfWujo.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\OCypwKp.exe
  C:\Windows\System\OCypwKp.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\cHelbNA.exe
  C:\Windows\System\cHelbNA.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\TYDuISm.exe
  C:\Windows\System\TYDuISm.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\OlUgHun.exe
  C:\Windows\System\OlUgHun.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\MjIfFCj.exe
  C:\Windows\System\MjIfFCj.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\GuncQRq.exe
  C:\Windows\System\GuncQRq.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\EMWBtNU.exe
  C:\Windows\System\EMWBtNU.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\yjjnLVD.exe
  C:\Windows\System\yjjnLVD.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\dRUorbw.exe
  C:\Windows\System\dRUorbw.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\qiXzBVC.exe
  C:\Windows\System\qiXzBVC.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\frJLZgn.exe
  C:\Windows\System\frJLZgn.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\MWmJkpk.exe
  C:\Windows\System\MWmJkpk.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\jJHZULa.exe
  C:\Windows\System\jJHZULa.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\NjYQqTn.exe
  C:\Windows\System\NjYQqTn.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\rlCQbbr.exe
  C:\Windows\System\rlCQbbr.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\vFfrecZ.exe
  C:\Windows\System\vFfrecZ.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\BleNhCF.exe
  C:\Windows\System\BleNhCF.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\dAOQAUL.exe
  C:\Windows\System\dAOQAUL.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\rJWCgca.exe
  C:\Windows\System\rJWCgca.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\FDcwtav.exe
  C:\Windows\System\FDcwtav.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\CscZWgK.exe
  C:\Windows\System\CscZWgK.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\ZqfrjIm.exe
  C:\Windows\System\ZqfrjIm.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\NRyDkFH.exe
  C:\Windows\System\NRyDkFH.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\rxuDijG.exe
  C:\Windows\System\rxuDijG.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\xYrOhCa.exe
  C:\Windows\System\xYrOhCa.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\QgkQFwe.exe
  C:\Windows\System\QgkQFwe.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\dsllCrb.exe
  C:\Windows\System\dsllCrb.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\kkWFYhj.exe
  C:\Windows\System\kkWFYhj.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\SiljNji.exe
  C:\Windows\System\SiljNji.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\jttycUC.exe
  C:\Windows\System\jttycUC.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\oJDgxaQ.exe
  C:\Windows\System\oJDgxaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\aUWdunL.exe
  C:\Windows\System\aUWdunL.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\ezlBYdw.exe
  C:\Windows\System\ezlBYdw.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\QDTeepI.exe
  C:\Windows\System\QDTeepI.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\OyBcSnd.exe
  C:\Windows\System\OyBcSnd.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\uxrBRJO.exe
  C:\Windows\System\uxrBRJO.exe
  2⤵
  PID:1976
- C:\Windows\System\OkexbCi.exe
  C:\Windows\System\OkexbCi.exe
  2⤵
  PID:4340
- C:\Windows\System\rGGpmkZ.exe
  C:\Windows\System\rGGpmkZ.exe
  2⤵
  PID:1456
- C:\Windows\System\JdmfSpm.exe
  C:\Windows\System\JdmfSpm.exe
  2⤵
  PID:2244
- C:\Windows\System\CCGkaNn.exe
  C:\Windows\System\CCGkaNn.exe
  2⤵
  PID:3608
- C:\Windows\System\jFWVDiZ.exe
  C:\Windows\System\jFWVDiZ.exe
  2⤵
  PID:3872
- C:\Windows\System\cmRXhjx.exe
  C:\Windows\System\cmRXhjx.exe
  2⤵
  PID:2556
- C:\Windows\System\WeMBAdI.exe
  C:\Windows\System\WeMBAdI.exe
  2⤵
  PID:4412
- C:\Windows\System\tYZhdgK.exe
  C:\Windows\System\tYZhdgK.exe
  2⤵
  PID:2012
- C:\Windows\System\TdgRRvq.exe
  C:\Windows\System\TdgRRvq.exe
  2⤵
  PID:1096
- C:\Windows\System\CJFDMNO.exe
  C:\Windows\System\CJFDMNO.exe
  2⤵
  PID:5048
- C:\Windows\System\SvSiwbo.exe
  C:\Windows\System\SvSiwbo.exe
  2⤵
  PID:4464
- C:\Windows\System\HzUvjHg.exe
  C:\Windows\System\HzUvjHg.exe
  2⤵
  PID:5108
- C:\Windows\System\VHuRtZb.exe
  C:\Windows\System\VHuRtZb.exe
  2⤵
  PID:1588
- C:\Windows\System\kSwLGah.exe
  C:\Windows\System\kSwLGah.exe
  2⤵
  PID:2404
- C:\Windows\System\nsFfUkQ.exe
  C:\Windows\System\nsFfUkQ.exe
  2⤵
  PID:3648
- C:\Windows\System\LRqdqKw.exe
  C:\Windows\System\LRqdqKw.exe
  2⤵
  PID:4924
- C:\Windows\System\LxwRmEd.exe
  C:\Windows\System\LxwRmEd.exe
  2⤵
  PID:3012
- C:\Windows\System\aXRGFkO.exe
  C:\Windows\System\aXRGFkO.exe
  2⤵
  PID:2784
- C:\Windows\System\OXCCkcl.exe
  C:\Windows\System\OXCCkcl.exe
  2⤵
  PID:3724
- C:\Windows\System\UAhxdyX.exe
  C:\Windows\System\UAhxdyX.exe
  2⤵
  PID:1424
- C:\Windows\System\hCVMzGt.exe
  C:\Windows\System\hCVMzGt.exe
  2⤵
  PID:5128
- C:\Windows\System\HeolKsl.exe
  C:\Windows\System\HeolKsl.exe
  2⤵
  PID:5156
- C:\Windows\System\actgbUs.exe
  C:\Windows\System\actgbUs.exe
  2⤵
  PID:5184
- C:\Windows\System\LvytTsf.exe
  C:\Windows\System\LvytTsf.exe
  2⤵
  PID:5212
- C:\Windows\System\tuRTYNj.exe
  C:\Windows\System\tuRTYNj.exe
  2⤵
  PID:5240
- C:\Windows\System\cXGFNxW.exe
  C:\Windows\System\cXGFNxW.exe
  2⤵
  PID:5268
- C:\Windows\System\nSPgNZQ.exe
  C:\Windows\System\nSPgNZQ.exe
  2⤵
  PID:5296
- C:\Windows\System\njJfyqy.exe
  C:\Windows\System\njJfyqy.exe
  2⤵
  PID:5324
- C:\Windows\System\nnjDkRb.exe
  C:\Windows\System\nnjDkRb.exe
  2⤵
  PID:5352
- C:\Windows\System\EblVPkI.exe
  C:\Windows\System\EblVPkI.exe
  2⤵
  PID:5380
- C:\Windows\System\udwLKbJ.exe
  C:\Windows\System\udwLKbJ.exe
  2⤵
  PID:5408
- C:\Windows\System\XwzcVWB.exe
  C:\Windows\System\XwzcVWB.exe
  2⤵
  PID:5436
- C:\Windows\System\SeBIzvf.exe
  C:\Windows\System\SeBIzvf.exe
  2⤵
  PID:5464
- C:\Windows\System\mHhprAd.exe
  C:\Windows\System\mHhprAd.exe
  2⤵
  PID:5492
- C:\Windows\System\opfHVFt.exe
  C:\Windows\System\opfHVFt.exe
  2⤵
  PID:5520
- C:\Windows\System\ISBgKtr.exe
  C:\Windows\System\ISBgKtr.exe
  2⤵
  PID:5548
- C:\Windows\System\GxZVALU.exe
  C:\Windows\System\GxZVALU.exe
  2⤵
  PID:5576
- C:\Windows\System\fBubSTE.exe
  C:\Windows\System\fBubSTE.exe
  2⤵
  PID:5604
- C:\Windows\System\hKutKxl.exe
  C:\Windows\System\hKutKxl.exe
  2⤵
  PID:5632
- C:\Windows\System\EAKRwqG.exe
  C:\Windows\System\EAKRwqG.exe
  2⤵
  PID:5660
- C:\Windows\System\mtTOpws.exe
  C:\Windows\System\mtTOpws.exe
  2⤵
  PID:5688
- C:\Windows\System\dJzKUfG.exe
  C:\Windows\System\dJzKUfG.exe
  2⤵
  PID:5716
- C:\Windows\System\yXxtWMO.exe
  C:\Windows\System\yXxtWMO.exe
  2⤵
  PID:5744
- C:\Windows\System\wPOwrDg.exe
  C:\Windows\System\wPOwrDg.exe
  2⤵
  PID:5772
- C:\Windows\System\jiYEPPv.exe
  C:\Windows\System\jiYEPPv.exe
  2⤵
  PID:5800
- C:\Windows\System\izhyllv.exe
  C:\Windows\System\izhyllv.exe
  2⤵
  PID:5828
- C:\Windows\System\KnOdPrN.exe
  C:\Windows\System\KnOdPrN.exe
  2⤵
  PID:5856
- C:\Windows\System\RYkjudU.exe
  C:\Windows\System\RYkjudU.exe
  2⤵
  PID:5884
- C:\Windows\System\DDDkHTA.exe
  C:\Windows\System\DDDkHTA.exe
  2⤵
  PID:5912
- C:\Windows\System\CZFjLom.exe
  C:\Windows\System\CZFjLom.exe
  2⤵
  PID:5940
- C:\Windows\System\KMmmRjZ.exe
  C:\Windows\System\KMmmRjZ.exe
  2⤵
  PID:5968
- C:\Windows\System\PmuUYzD.exe
  C:\Windows\System\PmuUYzD.exe
  2⤵
  PID:5996
- C:\Windows\System\NdlaRCQ.exe
  C:\Windows\System\NdlaRCQ.exe
  2⤵
  PID:6024
- C:\Windows\System\kBuEeqz.exe
  C:\Windows\System\kBuEeqz.exe
  2⤵
  PID:6048
- C:\Windows\System\BivwSar.exe
  C:\Windows\System\BivwSar.exe
  2⤵
  PID:6080
- C:\Windows\System\mIdhXzc.exe
  C:\Windows\System\mIdhXzc.exe
  2⤵
  PID:6108
- C:\Windows\System\RntnKvk.exe
  C:\Windows\System\RntnKvk.exe
  2⤵
  PID:6136
- C:\Windows\System\jIgZHHl.exe
  C:\Windows\System\jIgZHHl.exe
  2⤵
  PID:784
- C:\Windows\System\LppQAQC.exe
  C:\Windows\System\LppQAQC.exe
  2⤵
  PID:4304
- C:\Windows\System\NiDbHAs.exe
  C:\Windows\System\NiDbHAs.exe
  2⤵
  PID:4732
- C:\Windows\System\ESFhuaa.exe
  C:\Windows\System\ESFhuaa.exe
  2⤵
  PID:4752
- C:\Windows\System\TvnXCOB.exe
  C:\Windows\System\TvnXCOB.exe
  2⤵
  PID:1468
- C:\Windows\System\zuKNzDy.exe
  C:\Windows\System\zuKNzDy.exe
  2⤵
  PID:2044
- C:\Windows\System\acviOJi.exe
  C:\Windows\System\acviOJi.exe
  2⤵
  PID:5176
- C:\Windows\System\cHFAecd.exe
  C:\Windows\System\cHFAecd.exe
  2⤵
  PID:5252
- C:\Windows\System\vPSXiBr.exe
  C:\Windows\System\vPSXiBr.exe
  2⤵
  PID:5312
- C:\Windows\System\YtExOGC.exe
  C:\Windows\System\YtExOGC.exe
  2⤵
  PID:5372
- C:\Windows\System\SzhgbUU.exe
  C:\Windows\System\SzhgbUU.exe
  2⤵
  PID:5448
- C:\Windows\System\DpEzknb.exe
  C:\Windows\System\DpEzknb.exe
  2⤵
  PID:5508
- C:\Windows\System\CeLZgfb.exe
  C:\Windows\System\CeLZgfb.exe
  2⤵
  PID:5568
- C:\Windows\System\HOnPxwN.exe
  C:\Windows\System\HOnPxwN.exe
  2⤵
  PID:5644
- C:\Windows\System\lgNTCko.exe
  C:\Windows\System\lgNTCko.exe
  2⤵
  PID:5704
- C:\Windows\System\ZMxlVjt.exe
  C:\Windows\System\ZMxlVjt.exe
  2⤵
  PID:5764
- C:\Windows\System\ACpbikn.exe
  C:\Windows\System\ACpbikn.exe
  2⤵
  PID:5840
- C:\Windows\System\GygJtPv.exe
  C:\Windows\System\GygJtPv.exe
  2⤵
  PID:5900
- C:\Windows\System\XiBQabd.exe
  C:\Windows\System\XiBQabd.exe
  2⤵
  PID:5960
- C:\Windows\System\EqvnJIC.exe
  C:\Windows\System\EqvnJIC.exe
  2⤵
  PID:6036
- C:\Windows\System\nNMhboD.exe
  C:\Windows\System\nNMhboD.exe
  2⤵
  PID:3736
- C:\Windows\System\YsVGWLM.exe
  C:\Windows\System\YsVGWLM.exe
  2⤵
  PID:828
- C:\Windows\System\WdMFKOi.exe
  C:\Windows\System\WdMFKOi.exe
  2⤵
  PID:4484
- C:\Windows\System\vEeJBcv.exe
  C:\Windows\System\vEeJBcv.exe
  2⤵
  PID:1060
- C:\Windows\System\WfdbGZi.exe
  C:\Windows\System\WfdbGZi.exe
  2⤵
  PID:5148
- C:\Windows\System\hKsthGc.exe
  C:\Windows\System\hKsthGc.exe
  2⤵
  PID:5284
- C:\Windows\System\ZExpBiu.exe
  C:\Windows\System\ZExpBiu.exe
  2⤵
  PID:5424
- C:\Windows\System\MmMBGiS.exe
  C:\Windows\System\MmMBGiS.exe
  2⤵
  PID:5596
- C:\Windows\System\vgFzZou.exe
  C:\Windows\System\vgFzZou.exe
  2⤵
  PID:3628
- C:\Windows\System\mDfUflH.exe
  C:\Windows\System\mDfUflH.exe
  2⤵
  PID:5868
- C:\Windows\System\zkkWMYN.exe
  C:\Windows\System\zkkWMYN.exe
  2⤵
  PID:6008
- C:\Windows\System\fJhqctW.exe
  C:\Windows\System\fJhqctW.exe
  2⤵
  PID:6124
- C:\Windows\System\xIJvAHu.exe
  C:\Windows\System\xIJvAHu.exe
  2⤵
  PID:6164
- C:\Windows\System\SoBPmJG.exe
  C:\Windows\System\SoBPmJG.exe
  2⤵
  PID:6192
- C:\Windows\System\PyQqAkO.exe
  C:\Windows\System\PyQqAkO.exe
  2⤵
  PID:6220
- C:\Windows\System\hgGckwJ.exe
  C:\Windows\System\hgGckwJ.exe
  2⤵
  PID:6248
- C:\Windows\System\iGSCvVc.exe
  C:\Windows\System\iGSCvVc.exe
  2⤵
  PID:6276
- C:\Windows\System\dspqOXD.exe
  C:\Windows\System\dspqOXD.exe
  2⤵
  PID:6308
- C:\Windows\System\iUwpSHc.exe
  C:\Windows\System\iUwpSHc.exe
  2⤵
  PID:6332
- C:\Windows\System\feHzLyt.exe
  C:\Windows\System\feHzLyt.exe
  2⤵
  PID:6360
- C:\Windows\System\hmgJkHL.exe
  C:\Windows\System\hmgJkHL.exe
  2⤵
  PID:6388
- C:\Windows\System\hMmlAyf.exe
  C:\Windows\System\hMmlAyf.exe
  2⤵
  PID:6416
- C:\Windows\System\tKcfOHp.exe
  C:\Windows\System\tKcfOHp.exe
  2⤵
  PID:6444
- C:\Windows\System\JsonxFo.exe
  C:\Windows\System\JsonxFo.exe
  2⤵
  PID:6472
- C:\Windows\System\JzTgqZr.exe
  C:\Windows\System\JzTgqZr.exe
  2⤵
  PID:6500
- C:\Windows\System\yOzcIGF.exe
  C:\Windows\System\yOzcIGF.exe
  2⤵
  PID:6528
- C:\Windows\System\BBBUXlY.exe
  C:\Windows\System\BBBUXlY.exe
  2⤵
  PID:6556
- C:\Windows\System\abIWMVJ.exe
  C:\Windows\System\abIWMVJ.exe
  2⤵
  PID:6584
- C:\Windows\System\wEAtVWU.exe
  C:\Windows\System\wEAtVWU.exe
  2⤵
  PID:6612
- C:\Windows\System\bIvKFPd.exe
  C:\Windows\System\bIvKFPd.exe
  2⤵
  PID:6640
- C:\Windows\System\cPlyrlp.exe
  C:\Windows\System\cPlyrlp.exe
  2⤵
  PID:6668
- C:\Windows\System\XLoQldn.exe
  C:\Windows\System\XLoQldn.exe
  2⤵
  PID:6696
- C:\Windows\System\UlOkSnj.exe
  C:\Windows\System\UlOkSnj.exe
  2⤵
  PID:6724
- C:\Windows\System\dCOznaL.exe
  C:\Windows\System\dCOznaL.exe
  2⤵
  PID:6752
- C:\Windows\System\SUDPyac.exe
  C:\Windows\System\SUDPyac.exe
  2⤵
  PID:6780
- C:\Windows\System\DiDkbYy.exe
  C:\Windows\System\DiDkbYy.exe
  2⤵
  PID:6808
- C:\Windows\System\WRdeFeh.exe
  C:\Windows\System\WRdeFeh.exe
  2⤵
  PID:6836
- C:\Windows\System\PmdFdVH.exe
  C:\Windows\System\PmdFdVH.exe
  2⤵
  PID:6864
- C:\Windows\System\TUaAHjz.exe
  C:\Windows\System\TUaAHjz.exe
  2⤵
  PID:6892
- C:\Windows\System\KxinUff.exe
  C:\Windows\System\KxinUff.exe
  2⤵
  PID:6920
- C:\Windows\System\dYSpTBA.exe
  C:\Windows\System\dYSpTBA.exe
  2⤵
  PID:6948
- C:\Windows\System\pFDJwcy.exe
  C:\Windows\System\pFDJwcy.exe
  2⤵
  PID:6976
- C:\Windows\System\rPvpemy.exe
  C:\Windows\System\rPvpemy.exe
  2⤵
  PID:7004
- C:\Windows\System\NFBJUWM.exe
  C:\Windows\System\NFBJUWM.exe
  2⤵
  PID:7032
- C:\Windows\System\KPwzkJy.exe
  C:\Windows\System\KPwzkJy.exe
  2⤵
  PID:7060
- C:\Windows\System\vvepXuB.exe
  C:\Windows\System\vvepXuB.exe
  2⤵
  PID:7088
- C:\Windows\System\UFRDeLM.exe
  C:\Windows\System\UFRDeLM.exe
  2⤵
  PID:7116
- C:\Windows\System\XtrtYoM.exe
  C:\Windows\System\XtrtYoM.exe
  2⤵
  PID:7144
- C:\Windows\System\zteEyfs.exe
  C:\Windows\System\zteEyfs.exe
  2⤵
  PID:4004
- C:\Windows\System\YnsfOSR.exe
  C:\Windows\System\YnsfOSR.exe
  2⤵
  PID:5792
- C:\Windows\System\cjOqzzP.exe
  C:\Windows\System\cjOqzzP.exe
  2⤵
  PID:6148
- C:\Windows\System\gchALJr.exe
  C:\Windows\System\gchALJr.exe
  2⤵
  PID:6184
- C:\Windows\System\GSYzsmN.exe
  C:\Windows\System\GSYzsmN.exe
  2⤵
  PID:6268
- C:\Windows\System\QsBDtcC.exe
  C:\Windows\System\QsBDtcC.exe
  2⤵
  PID:6324
- C:\Windows\System\aqQuvSf.exe
  C:\Windows\System\aqQuvSf.exe
  2⤵
  PID:6400
- C:\Windows\System\wIMhIBy.exe
  C:\Windows\System\wIMhIBy.exe
  2⤵
  PID:6432
- C:\Windows\System\lajkGFK.exe
  C:\Windows\System\lajkGFK.exe
  2⤵
  PID:6492
- C:\Windows\System\UvWkIKR.exe
  C:\Windows\System\UvWkIKR.exe
  2⤵
  PID:6540
- C:\Windows\System\fbDVrxb.exe
  C:\Windows\System\fbDVrxb.exe
  2⤵
  PID:3932
- C:\Windows\System\qwawqDr.exe
  C:\Windows\System\qwawqDr.exe
  2⤵
  PID:6660
- C:\Windows\System\pwiqlXq.exe
  C:\Windows\System\pwiqlXq.exe
  2⤵
  PID:1548
- C:\Windows\System\otqEyzb.exe
  C:\Windows\System\otqEyzb.exe
  2⤵
  PID:6744
- C:\Windows\System\fazgarK.exe
  C:\Windows\System\fazgarK.exe
  2⤵
  PID:3204
- C:\Windows\System\QYGhMpd.exe
  C:\Windows\System\QYGhMpd.exe
  2⤵
  PID:6880
- C:\Windows\System\weSbgyi.exe
  C:\Windows\System\weSbgyi.exe
  2⤵
  PID:6960
- C:\Windows\System\tOmeZmP.exe
  C:\Windows\System\tOmeZmP.exe
  2⤵
  PID:4872
- C:\Windows\System\mxEklXx.exe
  C:\Windows\System\mxEklXx.exe
  2⤵
  PID:7100
- C:\Windows\System\XckGVvk.exe
  C:\Windows\System\XckGVvk.exe
  2⤵
  PID:7104
- C:\Windows\System\ybTbpic.exe
  C:\Windows\System\ybTbpic.exe
  2⤵
  PID:7128
- C:\Windows\System\lAAoZld.exe
  C:\Windows\System\lAAoZld.exe
  2⤵
  PID:7108
- C:\Windows\System\TwmYblb.exe
  C:\Windows\System\TwmYblb.exe
  2⤵
  PID:1428
- C:\Windows\System\oevxyMz.exe
  C:\Windows\System\oevxyMz.exe
  2⤵
  PID:3172
- C:\Windows\System\atsGzpg.exe
  C:\Windows\System\atsGzpg.exe
  2⤵
  PID:6068
- C:\Windows\System\unMTCda.exe
  C:\Windows\System\unMTCda.exe
  2⤵
  PID:6260
- C:\Windows\System\ANJwlSj.exe
  C:\Windows\System\ANJwlSj.exe
  2⤵
  PID:6460
- C:\Windows\System\wxKgegn.exe
  C:\Windows\System\wxKgegn.exe
  2⤵
  PID:6632
- C:\Windows\System\maBEPIp.exe
  C:\Windows\System\maBEPIp.exe
  2⤵
  PID:2408
- C:\Windows\System\rspyPqZ.exe
  C:\Windows\System\rspyPqZ.exe
  2⤵
  PID:6848
- C:\Windows\System\qhsHwFZ.exe
  C:\Windows\System\qhsHwFZ.exe
  2⤵
  PID:7176
- C:\Windows\System\ZAImchT.exe
  C:\Windows\System\ZAImchT.exe
  2⤵
  PID:7204
- C:\Windows\System\uIenrjJ.exe
  C:\Windows\System\uIenrjJ.exe
  2⤵
  PID:7220
- C:\Windows\System\cQPXvFw.exe
  C:\Windows\System\cQPXvFw.exe
  2⤵
  PID:7248
- C:\Windows\System\niwSHCb.exe
  C:\Windows\System\niwSHCb.exe
  2⤵
  PID:7276
- C:\Windows\System\gHNtJpq.exe
  C:\Windows\System\gHNtJpq.exe
  2⤵
  PID:7304
- C:\Windows\System\oBIOSdk.exe
  C:\Windows\System\oBIOSdk.exe
  2⤵
  PID:7332
- C:\Windows\System\EbEYLUm.exe
  C:\Windows\System\EbEYLUm.exe
  2⤵
  PID:7360
- C:\Windows\System\bnYJphq.exe
  C:\Windows\System\bnYJphq.exe
  2⤵
  PID:7388
- C:\Windows\System\FTesdcx.exe
  C:\Windows\System\FTesdcx.exe
  2⤵
  PID:7416
- C:\Windows\System\FkvRbBa.exe
  C:\Windows\System\FkvRbBa.exe
  2⤵
  PID:7444
- C:\Windows\System\XfdmkdU.exe
  C:\Windows\System\XfdmkdU.exe
  2⤵
  PID:7472
- C:\Windows\System\MBzEOtH.exe
  C:\Windows\System\MBzEOtH.exe
  2⤵
  PID:7500
- C:\Windows\System\VJGEcwU.exe
  C:\Windows\System\VJGEcwU.exe
  2⤵
  PID:7528
- C:\Windows\System\qJByPwY.exe
  C:\Windows\System\qJByPwY.exe
  2⤵
  PID:7556
- C:\Windows\System\pMwvMep.exe
  C:\Windows\System\pMwvMep.exe
  2⤵
  PID:7584
- C:\Windows\System\MUhKYGk.exe
  C:\Windows\System\MUhKYGk.exe
  2⤵
  PID:7616
- C:\Windows\System\MXmcPki.exe
  C:\Windows\System\MXmcPki.exe
  2⤵
  PID:7652
- C:\Windows\System\ICtqOyc.exe
  C:\Windows\System\ICtqOyc.exe
  2⤵
  PID:7720
- C:\Windows\System\saXbtbn.exe
  C:\Windows\System\saXbtbn.exe
  2⤵
  PID:7808
- C:\Windows\System\hjlSxoO.exe
  C:\Windows\System\hjlSxoO.exe
  2⤵
  PID:7844
- C:\Windows\System\KWzzIpt.exe
  C:\Windows\System\KWzzIpt.exe
  2⤵
  PID:7860
- C:\Windows\System\aFAnhAK.exe
  C:\Windows\System\aFAnhAK.exe
  2⤵
  PID:7996
- C:\Windows\System\znyUdtq.exe
  C:\Windows\System\znyUdtq.exe
  2⤵
  PID:8056
- C:\Windows\System\uHvCLRu.exe
  C:\Windows\System\uHvCLRu.exe
  2⤵
  PID:8080
- C:\Windows\System\dwSkPpW.exe
  C:\Windows\System\dwSkPpW.exe
  2⤵
  PID:8108
- C:\Windows\System\dfoKjhO.exe
  C:\Windows\System\dfoKjhO.exe
  2⤵
  PID:8148
- C:\Windows\System\pybAnST.exe
  C:\Windows\System\pybAnST.exe
  2⤵
  PID:8180
- C:\Windows\System\pFrlNOo.exe
  C:\Windows\System\pFrlNOo.exe
  2⤵
  PID:7436
- C:\Windows\System\UPyVdJn.exe
  C:\Windows\System\UPyVdJn.exe
  2⤵
  PID:6236
- C:\Windows\System\QQoLaJO.exe
  C:\Windows\System\QQoLaJO.exe
  2⤵
  PID:7320
- C:\Windows\System\tNSqaug.exe
  C:\Windows\System\tNSqaug.exe
  2⤵
  PID:7232
- C:\Windows\System\DxvlLyS.exe
  C:\Windows\System\DxvlLyS.exe
  2⤵
  PID:6936
- C:\Windows\System\vKAlBUD.exe
  C:\Windows\System\vKAlBUD.exe
  2⤵
  PID:2076
- C:\Windows\System\dzbdFFj.exe
  C:\Windows\System\dzbdFFj.exe
  2⤵
  PID:5928
- C:\Windows\System\EKSjmJD.exe
  C:\Windows\System\EKSjmJD.exe
  2⤵
  PID:4812
- C:\Windows\System\cQXPwyc.exe
  C:\Windows\System\cQXPwyc.exe
  2⤵
  PID:1232
- C:\Windows\System\hNVCJSz.exe
  C:\Windows\System\hNVCJSz.exe
  2⤵
  PID:7044
- C:\Windows\System\BPmKrRl.exe
  C:\Windows\System\BPmKrRl.exe
  2⤵
  PID:7540
- C:\Windows\System\GSYiILT.exe
  C:\Windows\System\GSYiILT.exe
  2⤵
  PID:7604
- C:\Windows\System\Vhszooq.exe
  C:\Windows\System\Vhszooq.exe
  2⤵
  PID:7688
- C:\Windows\System\PCACwZJ.exe
  C:\Windows\System\PCACwZJ.exe
  2⤵
  PID:2040
- C:\Windows\System\NozrsHa.exe
  C:\Windows\System\NozrsHa.exe
  2⤵
  PID:7852
- C:\Windows\System\BcmfJXf.exe
  C:\Windows\System\BcmfJXf.exe
  2⤵
  PID:7888
- C:\Windows\System\HBAPozS.exe
  C:\Windows\System\HBAPozS.exe
  2⤵
  PID:6792
- C:\Windows\System\vVlBlWn.exe
  C:\Windows\System\vVlBlWn.exe
  2⤵
  PID:7992
- C:\Windows\System\VHHmCRD.exe
  C:\Windows\System\VHHmCRD.exe
  2⤵
  PID:7792
- C:\Windows\System\Tbibfpv.exe
  C:\Windows\System\Tbibfpv.exe
  2⤵
  PID:8088
- C:\Windows\System\TwZZQNw.exe
  C:\Windows\System\TwZZQNw.exe
  2⤵
  PID:8136
- C:\Windows\System\CSAHUXq.exe
  C:\Windows\System\CSAHUXq.exe
  2⤵
  PID:7324
- C:\Windows\System\TPvFQup.exe
  C:\Windows\System\TPvFQup.exe
  2⤵
  PID:7192
- C:\Windows\System\NJzVBDN.exe
  C:\Windows\System\NJzVBDN.exe
  2⤵
  PID:1872
- C:\Windows\System\ALrQJtp.exe
  C:\Windows\System\ALrQJtp.exe
  2⤵
  PID:7520
- C:\Windows\System\mlCqDtT.exe
  C:\Windows\System\mlCqDtT.exe
  2⤵
  PID:7636
- C:\Windows\System\WwRRpxp.exe
  C:\Windows\System\WwRRpxp.exe
  2⤵
  PID:7796
- C:\Windows\System\gNPgRdm.exe
  C:\Windows\System\gNPgRdm.exe
  2⤵
  PID:6988
- C:\Windows\System\oefxDPv.exe
  C:\Windows\System\oefxDPv.exe
  2⤵
  PID:8032
- C:\Windows\System\NVkipuE.exe
  C:\Windows\System\NVkipuE.exe
  2⤵
  PID:8168
- C:\Windows\System\KdGNVwr.exe
  C:\Windows\System\KdGNVwr.exe
  2⤵
  PID:6652
- C:\Windows\System\CwTjmfa.exe
  C:\Windows\System\CwTjmfa.exe
  2⤵
  PID:632
- C:\Windows\System\vkwumMh.exe
  C:\Windows\System\vkwumMh.exe
  2⤵
  PID:8040
- C:\Windows\System\AbTHtJH.exe
  C:\Windows\System\AbTHtJH.exe
  2⤵
  PID:7236
- C:\Windows\System\utVvZpO.exe
  C:\Windows\System\utVvZpO.exe
  2⤵
  PID:7268
- C:\Windows\System\OQspkMs.exe
  C:\Windows\System\OQspkMs.exe
  2⤵
  PID:8200
- C:\Windows\System\YipaOuT.exe
  C:\Windows\System\YipaOuT.exe
  2⤵
  PID:8220
- C:\Windows\System\iXNZrMj.exe
  C:\Windows\System\iXNZrMj.exe
  2⤵
  PID:8248
- C:\Windows\System\DmcUayS.exe
  C:\Windows\System\DmcUayS.exe
  2⤵
  PID:8288
- C:\Windows\System\ydGLbgX.exe
  C:\Windows\System\ydGLbgX.exe
  2⤵
  PID:8312
- C:\Windows\System\iDnGHZL.exe
  C:\Windows\System\iDnGHZL.exe
  2⤵
  PID:8332
- C:\Windows\System\gqXsAfK.exe
  C:\Windows\System\gqXsAfK.exe
  2⤵
  PID:8360
- C:\Windows\System\HacKOSn.exe
  C:\Windows\System\HacKOSn.exe
  2⤵
  PID:8400
- C:\Windows\System\ZMgiqMJ.exe
  C:\Windows\System\ZMgiqMJ.exe
  2⤵
  PID:8424
- C:\Windows\System\DhMgsiq.exe
  C:\Windows\System\DhMgsiq.exe
  2⤵
  PID:8456
- C:\Windows\System\rkyKhcb.exe
  C:\Windows\System\rkyKhcb.exe
  2⤵
  PID:8492
- C:\Windows\System\iYqGCKx.exe
  C:\Windows\System\iYqGCKx.exe
  2⤵
  PID:8512
- C:\Windows\System\XaDmusV.exe
  C:\Windows\System\XaDmusV.exe
  2⤵
  PID:8552
- C:\Windows\System\EBrYxiP.exe
  C:\Windows\System\EBrYxiP.exe
  2⤵
  PID:8568
- C:\Windows\System\bRlsRLV.exe
  C:\Windows\System\bRlsRLV.exe
  2⤵
  PID:8596
- C:\Windows\System\ZnuOPNX.exe
  C:\Windows\System\ZnuOPNX.exe
  2⤵
  PID:8628
- C:\Windows\System\aYEAuCR.exe
  C:\Windows\System\aYEAuCR.exe
  2⤵
  PID:8644
- C:\Windows\System\EaGFHGm.exe
  C:\Windows\System\EaGFHGm.exe
  2⤵
  PID:8684
- C:\Windows\System\zlDNUNz.exe
  C:\Windows\System\zlDNUNz.exe
  2⤵
  PID:8712
- C:\Windows\System\BeTAWfV.exe
  C:\Windows\System\BeTAWfV.exe
  2⤵
  PID:8732
- C:\Windows\System\ezhlFYa.exe
  C:\Windows\System\ezhlFYa.exe
  2⤵
  PID:8764
- C:\Windows\System\WlRWMLU.exe
  C:\Windows\System\WlRWMLU.exe
  2⤵
  PID:8792
- C:\Windows\System\mQAYmsH.exe
  C:\Windows\System\mQAYmsH.exe
  2⤵
  PID:8820
- C:\Windows\System\tPFeCJC.exe
  C:\Windows\System\tPFeCJC.exe
  2⤵
  PID:8840
- C:\Windows\System\MwyfBGx.exe
  C:\Windows\System\MwyfBGx.exe
  2⤵
  PID:8868
- C:\Windows\System\cYJSCjH.exe
  C:\Windows\System\cYJSCjH.exe
  2⤵
  PID:8884
- C:\Windows\System\lnstSkh.exe
  C:\Windows\System\lnstSkh.exe
  2⤵
  PID:8912
- C:\Windows\System\ypFbzuh.exe
  C:\Windows\System\ypFbzuh.exe
  2⤵
  PID:8956
- C:\Windows\System\koEqUCX.exe
  C:\Windows\System\koEqUCX.exe
  2⤵
  PID:8984
- C:\Windows\System\tCmhbAq.exe
  C:\Windows\System\tCmhbAq.exe
  2⤵
  PID:9024
- C:\Windows\System\OvAoPeU.exe
  C:\Windows\System\OvAoPeU.exe
  2⤵
  PID:9052
- C:\Windows\System\WmlNSVp.exe
  C:\Windows\System\WmlNSVp.exe
  2⤵
  PID:9072
- C:\Windows\System\hCgbYKL.exe
  C:\Windows\System\hCgbYKL.exe
  2⤵
  PID:9096
- C:\Windows\System\mjiZpUH.exe
  C:\Windows\System\mjiZpUH.exe
  2⤵
  PID:9112
- C:\Windows\System\uLoBiIz.exe
  C:\Windows\System\uLoBiIz.exe
  2⤵
  PID:9140
- C:\Windows\System\ZsvawVT.exe
  C:\Windows\System\ZsvawVT.exe
  2⤵
  PID:9172
- C:\Windows\System\cxtyUiE.exe
  C:\Windows\System\cxtyUiE.exe
  2⤵
  PID:6404
- C:\Windows\System\NljAcqG.exe
  C:\Windows\System\NljAcqG.exe
  2⤵
  PID:7832
- C:\Windows\System\NYCjZpW.exe
  C:\Windows\System\NYCjZpW.exe
  2⤵
  PID:8372
- C:\Windows\System\nIYOngn.exe
  C:\Windows\System\nIYOngn.exe
  2⤵
  PID:8420
- C:\Windows\System\hnZwqbw.exe
  C:\Windows\System\hnZwqbw.exe
  2⤵
  PID:8448
- C:\Windows\System\rOZRvYn.exe
  C:\Windows\System\rOZRvYn.exe
  2⤵
  PID:8540
- C:\Windows\System\QPmQwhR.exe
  C:\Windows\System\QPmQwhR.exe
  2⤵
  PID:8584
- C:\Windows\System\kCEuqim.exe
  C:\Windows\System\kCEuqim.exe
  2⤵
  PID:8636
- C:\Windows\System\tTHMzbU.exe
  C:\Windows\System\tTHMzbU.exe
  2⤵
  PID:8740
- C:\Windows\System\oaHJEHa.exe
  C:\Windows\System\oaHJEHa.exe
  2⤵
  PID:8808
- C:\Windows\System\TzLshpO.exe
  C:\Windows\System\TzLshpO.exe
  2⤵
  PID:8836
- C:\Windows\System\ZbBJRVg.exe
  C:\Windows\System\ZbBJRVg.exe
  2⤵
  PID:8924
- C:\Windows\System\MsFWjUs.exe
  C:\Windows\System\MsFWjUs.exe
  2⤵
  PID:8944
- C:\Windows\System\ySIxMjG.exe
  C:\Windows\System\ySIxMjG.exe
  2⤵
  PID:9040
- C:\Windows\System\SyodvCK.exe
  C:\Windows\System\SyodvCK.exe
  2⤵
  PID:9124
- C:\Windows\System\LTyTsvx.exe
  C:\Windows\System\LTyTsvx.exe
  2⤵
  PID:9128
- C:\Windows\System\FUZqMjd.exe
  C:\Windows\System\FUZqMjd.exe
  2⤵
  PID:8276
- C:\Windows\System\QlxMkUJ.exe
  C:\Windows\System\QlxMkUJ.exe
  2⤵
  PID:9248
- C:\Windows\System\RPpIuiM.exe
  C:\Windows\System\RPpIuiM.exe
  2⤵
  PID:9272
- C:\Windows\System\lLcynjo.exe
  C:\Windows\System\lLcynjo.exe
  2⤵
  PID:9300
- C:\Windows\System\HpEjQmr.exe
  C:\Windows\System\HpEjQmr.exe
  2⤵
  PID:9328
- C:\Windows\System\gZlMwJq.exe
  C:\Windows\System\gZlMwJq.exe
  2⤵
  PID:9356
- C:\Windows\System\cTHznSK.exe
  C:\Windows\System\cTHznSK.exe
  2⤵
  PID:9372
- C:\Windows\System\QhKYfEa.exe
  C:\Windows\System\QhKYfEa.exe
  2⤵
  PID:9448
- C:\Windows\System\taOyoaq.exe
  C:\Windows\System\taOyoaq.exe
  2⤵
  PID:9464
- C:\Windows\System\bLroCAE.exe
  C:\Windows\System\bLroCAE.exe
  2⤵
  PID:9492
- C:\Windows\System\ZNdoCqm.exe
  C:\Windows\System\ZNdoCqm.exe
  2⤵
  PID:9520
- C:\Windows\System\KqyVMkq.exe
  C:\Windows\System\KqyVMkq.exe
  2⤵
  PID:9548
- C:\Windows\System\iiVIEHA.exe
  C:\Windows\System\iiVIEHA.exe
  2⤵
  PID:9564
- C:\Windows\System\LUKbdxX.exe
  C:\Windows\System\LUKbdxX.exe
  2⤵
  PID:9604
- C:\Windows\System\dVMHeDD.exe
  C:\Windows\System\dVMHeDD.exe
  2⤵
  PID:9628
- C:\Windows\System\BqCRduo.exe
  C:\Windows\System\BqCRduo.exe
  2⤵
  PID:9652
- C:\Windows\System\wPJUbhx.exe
  C:\Windows\System\wPJUbhx.exe
  2⤵
  PID:9688
- C:\Windows\System\GTsrXun.exe
  C:\Windows\System\GTsrXun.exe
  2⤵
  PID:9704
- C:\Windows\System\MhbqFAQ.exe
  C:\Windows\System\MhbqFAQ.exe
  2⤵
  PID:9732
- C:\Windows\System\JIFHnqt.exe
  C:\Windows\System\JIFHnqt.exe
  2⤵
  PID:9776
- C:\Windows\System\PBjcwIB.exe
  C:\Windows\System\PBjcwIB.exe
  2⤵
  PID:9792
- C:\Windows\System\cMteuew.exe
  C:\Windows\System\cMteuew.exe
  2⤵
  PID:9832
- C:\Windows\System\PxxQhxB.exe
  C:\Windows\System\PxxQhxB.exe
  2⤵
  PID:9860
- C:\Windows\System\FLfjasa.exe
  C:\Windows\System\FLfjasa.exe
  2⤵
  PID:9888
- C:\Windows\System\fZaApyF.exe
  C:\Windows\System\fZaApyF.exe
  2⤵
  PID:9916
- C:\Windows\System\aLOETYv.exe
  C:\Windows\System\aLOETYv.exe
  2⤵
  PID:9944
- C:\Windows\System\CqcKYYu.exe
  C:\Windows\System\CqcKYYu.exe
  2⤵
  PID:9972
- C:\Windows\System\LtJQUNx.exe
  C:\Windows\System\LtJQUNx.exe
  2⤵
  PID:10000
- C:\Windows\System\buWhUYD.exe
  C:\Windows\System\buWhUYD.exe
  2⤵
  PID:10016
- C:\Windows\System\XZXmrtT.exe
  C:\Windows\System\XZXmrtT.exe
  2⤵
  PID:10044
- C:\Windows\System\YfrxEyg.exe
  C:\Windows\System\YfrxEyg.exe
  2⤵
  PID:10072
- C:\Windows\System\MxQKmIs.exe
  C:\Windows\System\MxQKmIs.exe
  2⤵
  PID:10100
- C:\Windows\System\gZgZusX.exe
  C:\Windows\System\gZgZusX.exe
  2⤵
  PID:10132
- C:\Windows\System\pugyXja.exe
  C:\Windows\System\pugyXja.exe
  2⤵
  PID:10168
- C:\Windows\System\pzmLfnI.exe
  C:\Windows\System\pzmLfnI.exe
  2⤵
  PID:10196
- C:\Windows\System\hneLRFx.exe
  C:\Windows\System\hneLRFx.exe
  2⤵
  PID:10212
- C:\Windows\System\KAljkLZ.exe
  C:\Windows\System\KAljkLZ.exe
  2⤵
  PID:10228
- C:\Windows\System\zNDgtIL.exe
  C:\Windows\System\zNDgtIL.exe
  2⤵
  PID:8376
- C:\Windows\System\PoBmcQu.exe
  C:\Windows\System\PoBmcQu.exe
  2⤵
  PID:8616
- C:\Windows\System\oFBIKxF.exe
  C:\Windows\System\oFBIKxF.exe
  2⤵
  PID:9060
- C:\Windows\System\LWBiXee.exe
  C:\Windows\System\LWBiXee.exe
  2⤵
  PID:9208
- C:\Windows\System\ijvNeOW.exe
  C:\Windows\System\ijvNeOW.exe
  2⤵
  PID:9232
- C:\Windows\System\MQeJjrY.exe
  C:\Windows\System\MQeJjrY.exe
  2⤵
  PID:1856
- C:\Windows\System\sZOhMhy.exe
  C:\Windows\System\sZOhMhy.exe
  2⤵
  PID:9224
- C:\Windows\System\qHwUKos.exe
  C:\Windows\System\qHwUKos.exe
  2⤵
  PID:9268
- C:\Windows\System\gBBLFlL.exe
  C:\Windows\System\gBBLFlL.exe
  2⤵
  PID:9344
- C:\Windows\System\mSTWnef.exe
  C:\Windows\System\mSTWnef.exe
  2⤵
  PID:9460
- C:\Windows\System\TMNnXeP.exe
  C:\Windows\System\TMNnXeP.exe
  2⤵
  PID:9480
- C:\Windows\System\caVCUDr.exe
  C:\Windows\System\caVCUDr.exe
  2⤵
  PID:9556
- C:\Windows\System\ANGVMot.exe
  C:\Windows\System\ANGVMot.exe
  2⤵
  PID:9600
- C:\Windows\System\FsYlXsc.exe
  C:\Windows\System\FsYlXsc.exe
  2⤵
  PID:9640
- C:\Windows\System\VeApBep.exe
  C:\Windows\System\VeApBep.exe
  2⤵
  PID:9768
- C:\Windows\System\unSWYIG.exe
  C:\Windows\System\unSWYIG.exe
  2⤵
  PID:9824
- C:\Windows\System\RjyOTUO.exe
  C:\Windows\System\RjyOTUO.exe
  2⤵
  PID:9872
- C:\Windows\System\ijKunHC.exe
  C:\Windows\System\ijKunHC.exe
  2⤵
  PID:4976
- C:\Windows\System\cSpVbPG.exe
  C:\Windows\System\cSpVbPG.exe
  2⤵
  PID:9984
- C:\Windows\System\drJrLvb.exe
  C:\Windows\System\drJrLvb.exe
  2⤵
  PID:10084
- C:\Windows\System\vaCXUcD.exe
  C:\Windows\System\vaCXUcD.exe
  2⤵
  PID:10124
- C:\Windows\System\fDPxPGI.exe
  C:\Windows\System\fDPxPGI.exe
  2⤵
  PID:10224
- C:\Windows\System\lJguJBu.exe
  C:\Windows\System\lJguJBu.exe
  2⤵
  PID:8004
- C:\Windows\System\vwaxDQF.exe
  C:\Windows\System\vwaxDQF.exe
  2⤵
  PID:8656
- C:\Windows\System\pKYbhAi.exe
  C:\Windows\System\pKYbhAi.exe
  2⤵
  PID:9064
- C:\Windows\System\cRDrFGY.exe
  C:\Windows\System\cRDrFGY.exe
  2⤵
  PID:9284
- C:\Windows\System\hhkRjdB.exe
  C:\Windows\System\hhkRjdB.exe
  2⤵
  PID:9408
- C:\Windows\System\plwuAzo.exe
  C:\Windows\System\plwuAzo.exe
  2⤵
  PID:2028
- C:\Windows\System\VdpEbtC.exe
  C:\Windows\System\VdpEbtC.exe
  2⤵
  PID:9680
- C:\Windows\System\keFdnvw.exe
  C:\Windows\System\keFdnvw.exe
  2⤵
  PID:9828
- C:\Windows\System\cTPcTNS.exe
  C:\Windows\System\cTPcTNS.exe
  2⤵
  PID:9884
- C:\Windows\System\BIojHRi.exe
  C:\Windows\System\BIojHRi.exe
  2⤵
  PID:10060
- C:\Windows\System\oZPuDhz.exe
  C:\Windows\System\oZPuDhz.exe
  2⤵
  PID:10188
- C:\Windows\System\REVgtPZ.exe
  C:\Windows\System\REVgtPZ.exe
  2⤵
  PID:1044
- C:\Windows\System\HvSrEJW.exe
  C:\Windows\System\HvSrEJW.exe
  2⤵
  PID:9536
- C:\Windows\System\TpxCrXw.exe
  C:\Windows\System\TpxCrXw.exe
  2⤵
  PID:9820
- C:\Windows\System\WRHzaxs.exe
  C:\Windows\System\WRHzaxs.exe
  2⤵
  PID:10116
- C:\Windows\System\RNQAxOz.exe
  C:\Windows\System\RNQAxOz.exe
  2⤵
  PID:8304
- C:\Windows\System\iYQIkPM.exe
  C:\Windows\System\iYQIkPM.exe
  2⤵
  PID:9956
- C:\Windows\System\kQpTkEt.exe
  C:\Windows\System\kQpTkEt.exe
  2⤵
  PID:9848
- C:\Windows\System\EfUyxsG.exe
  C:\Windows\System\EfUyxsG.exe
  2⤵
  PID:10256
- C:\Windows\System\OKdRwjD.exe
  C:\Windows\System\OKdRwjD.exe
  2⤵
  PID:10272
- C:\Windows\System\yOBDzsf.exe
  C:\Windows\System\yOBDzsf.exe
  2⤵
  PID:10312
- C:\Windows\System\ZyFoypm.exe
  C:\Windows\System\ZyFoypm.exe
  2⤵
  PID:10332
- C:\Windows\System\rnYwCYI.exe
  C:\Windows\System\rnYwCYI.exe
  2⤵
  PID:10360
- C:\Windows\System\UGLdHAR.exe
  C:\Windows\System\UGLdHAR.exe
  2⤵
  PID:10388
- C:\Windows\System\fLrrOqi.exe
  C:\Windows\System\fLrrOqi.exe
  2⤵
  PID:10428
- C:\Windows\System\LRlXGep.exe
  C:\Windows\System\LRlXGep.exe
  2⤵
  PID:10456
- C:\Windows\System\kkXKxNB.exe
  C:\Windows\System\kkXKxNB.exe
  2⤵
  PID:10472
- C:\Windows\System\MpneITw.exe
  C:\Windows\System\MpneITw.exe
  2⤵
  PID:10500
- C:\Windows\System\WRXEJHH.exe
  C:\Windows\System\WRXEJHH.exe
  2⤵
  PID:10532
- C:\Windows\System\TeGcGXU.exe
  C:\Windows\System\TeGcGXU.exe
  2⤵
  PID:10556
- C:\Windows\System\iBHctLo.exe
  C:\Windows\System\iBHctLo.exe
  2⤵
  PID:10596
- C:\Windows\System\bzoiNBd.exe
  C:\Windows\System\bzoiNBd.exe
  2⤵
  PID:10616
- C:\Windows\System\wxEfbJV.exe
  C:\Windows\System\wxEfbJV.exe
  2⤵
  PID:10640
- C:\Windows\System\SYbamGE.exe
  C:\Windows\System\SYbamGE.exe
  2⤵
  PID:10668
- C:\Windows\System\KxhUtDv.exe
  C:\Windows\System\KxhUtDv.exe
  2⤵
  PID:10688
- C:\Windows\System\OMVVpJm.exe
  C:\Windows\System\OMVVpJm.exe
  2⤵
  PID:10712
- C:\Windows\System\dLPBhLW.exe
  C:\Windows\System\dLPBhLW.exe
  2⤵
  PID:10736
- C:\Windows\System\VVrnRvs.exe
  C:\Windows\System\VVrnRvs.exe
  2⤵
  PID:10764
- C:\Windows\System\tXtKmkd.exe
  C:\Windows\System\tXtKmkd.exe
  2⤵
  PID:10808
- C:\Windows\System\ziAwohI.exe
  C:\Windows\System\ziAwohI.exe
  2⤵
  PID:10824
- C:\Windows\System\bbEzVkS.exe
  C:\Windows\System\bbEzVkS.exe
  2⤵
  PID:10876
- C:\Windows\System\zOGmLOK.exe
  C:\Windows\System\zOGmLOK.exe
  2⤵
  PID:10904
- C:\Windows\System\Zktlzse.exe
  C:\Windows\System\Zktlzse.exe
  2⤵
  PID:10932
- C:\Windows\System\DlYPmiz.exe
  C:\Windows\System\DlYPmiz.exe
  2⤵
  PID:10952
- C:\Windows\System\IdAdpoJ.exe
  C:\Windows\System\IdAdpoJ.exe
  2⤵
  PID:10984
- C:\Windows\System\aKLnbov.exe
  C:\Windows\System\aKLnbov.exe
  2⤵
  PID:11004
- C:\Windows\System\ZGjRDla.exe
  C:\Windows\System\ZGjRDla.exe
  2⤵
  PID:11032
- C:\Windows\System\KztrIGH.exe
  C:\Windows\System\KztrIGH.exe
  2⤵
  PID:11060
- C:\Windows\System\qVsogbi.exe
  C:\Windows\System\qVsogbi.exe
  2⤵
  PID:11088
- C:\Windows\System\AWgOoDh.exe
  C:\Windows\System\AWgOoDh.exe
  2⤵
  PID:11128
- C:\Windows\System\pIRIiFN.exe
  C:\Windows\System\pIRIiFN.exe
  2⤵
  PID:11152
- C:\Windows\System\TNYaLVo.exe
  C:\Windows\System\TNYaLVo.exe
  2⤵
  PID:11172
- C:\Windows\System\WbmdFAk.exe
  C:\Windows\System\WbmdFAk.exe
  2⤵
  PID:11200
- C:\Windows\System\jXBVZbJ.exe
  C:\Windows\System\jXBVZbJ.exe
  2⤵
  PID:11228
- C:\Windows\System\QIDWDCM.exe
  C:\Windows\System\QIDWDCM.exe
  2⤵
  PID:11260
- C:\Windows\System\JhGKeCU.exe
  C:\Windows\System\JhGKeCU.exe
  2⤵
  PID:10268
- C:\Windows\System\zmHmpmh.exe
  C:\Windows\System\zmHmpmh.exe
  2⤵
  PID:10352
- C:\Windows\System\dnBpWah.exe
  C:\Windows\System\dnBpWah.exe
  2⤵
  PID:10452
- C:\Windows\System\fSIpdfx.exe
  C:\Windows\System\fSIpdfx.exe
  2⤵
  PID:10488
- C:\Windows\System\CzRpmef.exe
  C:\Windows\System\CzRpmef.exe
  2⤵
  PID:10552
- C:\Windows\System\ROwIkdT.exe
  C:\Windows\System\ROwIkdT.exe
  2⤵
  PID:10624
- C:\Windows\System\sovQZdd.exe
  C:\Windows\System\sovQZdd.exe
  2⤵
  PID:2628
- C:\Windows\System\PNyhkJI.exe
  C:\Windows\System\PNyhkJI.exe
  2⤵
  PID:10708
- C:\Windows\System\LjzEvas.exe
  C:\Windows\System\LjzEvas.exe
  2⤵
  PID:10780
- C:\Windows\System\kjbZrAU.exe
  C:\Windows\System\kjbZrAU.exe
  2⤵
  PID:10820
- C:\Windows\System\fTetWNL.exe
  C:\Windows\System\fTetWNL.exe
  2⤵
  PID:10916
- C:\Windows\System\IfYngEh.exe
  C:\Windows\System\IfYngEh.exe
  2⤵
  PID:10976
- C:\Windows\System\ToZurbe.exe
  C:\Windows\System\ToZurbe.exe
  2⤵
  PID:11072
- C:\Windows\System\YPBEnsD.exe
  C:\Windows\System\YPBEnsD.exe
  2⤵
  PID:11144
- C:\Windows\System\crMblNy.exe
  C:\Windows\System\crMblNy.exe
  2⤵
  PID:11188
- C:\Windows\System\IVQcVzQ.exe
  C:\Windows\System\IVQcVzQ.exe
  2⤵
  PID:11244
- C:\Windows\System\CnFjOeP.exe
  C:\Windows\System\CnFjOeP.exe
  2⤵
  PID:10328
- C:\Windows\System\jjLcoVu.exe
  C:\Windows\System\jjLcoVu.exe
  2⤵
  PID:10548
- C:\Windows\System\IeTmuMd.exe
  C:\Windows\System\IeTmuMd.exe
  2⤵
  PID:10608
- C:\Windows\System\weWdLBz.exe
  C:\Windows\System\weWdLBz.exe
  2⤵
  PID:10704
- C:\Windows\System\YgeurRs.exe
  C:\Windows\System\YgeurRs.exe
  2⤵
  PID:10836
- C:\Windows\System\cVLalnW.exe
  C:\Windows\System\cVLalnW.exe
  2⤵
  PID:10888
- C:\Windows\System\uWxFhnE.exe
  C:\Windows\System\uWxFhnE.exe
  2⤵
  PID:11052
- C:\Windows\System\JSTpZDo.exe
  C:\Windows\System\JSTpZDo.exe
  2⤵
  PID:11196
- C:\Windows\System\sajyZOn.exe
  C:\Windows\System\sajyZOn.exe
  2⤵
  PID:10408
- C:\Windows\System\ByWFrRt.exe
  C:\Windows\System\ByWFrRt.exe
  2⤵
  PID:10800
- C:\Windows\System\zZILXtG.exe
  C:\Windows\System\zZILXtG.exe
  2⤵
  PID:11304
- C:\Windows\System\qjSIMBs.exe
  C:\Windows\System\qjSIMBs.exe
  2⤵
  PID:11320
- C:\Windows\System\snawCwk.exe
  C:\Windows\System\snawCwk.exe
  2⤵
  PID:11348
- C:\Windows\System\cVIUFaK.exe
  C:\Windows\System\cVIUFaK.exe
  2⤵
  PID:11364
- C:\Windows\System\KGuiCoB.exe
  C:\Windows\System\KGuiCoB.exe
  2⤵
  PID:11416
- C:\Windows\System\LSGxqPC.exe
  C:\Windows\System\LSGxqPC.exe
  2⤵
  PID:11444
- C:\Windows\System\DLrfTck.exe
  C:\Windows\System\DLrfTck.exe
  2⤵
  PID:11476
- C:\Windows\System\sXdlTkV.exe
  C:\Windows\System\sXdlTkV.exe
  2⤵
  PID:11504
- C:\Windows\System\gYhVAtS.exe
  C:\Windows\System\gYhVAtS.exe
  2⤵
  PID:11532
- C:\Windows\System\YOdYmwJ.exe
  C:\Windows\System\YOdYmwJ.exe
  2⤵
  PID:11560
- C:\Windows\System\PcwhSuX.exe
  C:\Windows\System\PcwhSuX.exe
  2⤵
  PID:11588
- C:\Windows\System\tKdxscI.exe
  C:\Windows\System\tKdxscI.exe
  2⤵
  PID:11616
- C:\Windows\System\aPiLtzx.exe
  C:\Windows\System\aPiLtzx.exe
  2⤵
  PID:11644
- C:\Windows\System\LyXNGzq.exe
  C:\Windows\System\LyXNGzq.exe
  2⤵
  PID:11672
- C:\Windows\System\JSkQMlm.exe
  C:\Windows\System\JSkQMlm.exe
  2⤵
  PID:11700
- C:\Windows\System\hiPJkXY.exe
  C:\Windows\System\hiPJkXY.exe
  2⤵
  PID:11728
- C:\Windows\System\joKgHyD.exe
  C:\Windows\System\joKgHyD.exe
  2⤵
  PID:11756
- C:\Windows\System\QnoldVd.exe
  C:\Windows\System\QnoldVd.exe
  2⤵
  PID:11772
- C:\Windows\System\CMeGVMo.exe
  C:\Windows\System\CMeGVMo.exe
  2⤵
  PID:11812
- C:\Windows\System\vNdHECW.exe
  C:\Windows\System\vNdHECW.exe
  2⤵
  PID:11832
- C:\Windows\System\WlzgxBn.exe
  C:\Windows\System\WlzgxBn.exe
  2⤵
  PID:11856
- C:\Windows\System\KelWgOZ.exe
  C:\Windows\System\KelWgOZ.exe
  2⤵
  PID:11880
- C:\Windows\System\RHyYgCK.exe
  C:\Windows\System\RHyYgCK.exe
  2⤵
  PID:11904
- C:\Windows\System\KMugPmW.exe
  C:\Windows\System\KMugPmW.exe
  2⤵
  PID:11936
- C:\Windows\System\IwGWxCv.exe
  C:\Windows\System\IwGWxCv.exe
  2⤵
  PID:11980
- C:\Windows\System\WMtPWLP.exe
  C:\Windows\System\WMtPWLP.exe
  2⤵
  PID:12004
- C:\Windows\System\otmEoIV.exe
  C:\Windows\System\otmEoIV.exe
  2⤵
  PID:12024
- C:\Windows\System\GRVWUJC.exe
  C:\Windows\System\GRVWUJC.exe
  2⤵
  PID:12056
- C:\Windows\System\IbNDtWP.exe
  C:\Windows\System\IbNDtWP.exe
  2⤵
  PID:12080
- C:\Windows\System\WFqmwmH.exe
  C:\Windows\System\WFqmwmH.exe
  2⤵
  PID:12120
- C:\Windows\System\XuJYjFM.exe
  C:\Windows\System\XuJYjFM.exe
  2⤵
  PID:12148
- C:\Windows\System\fazEJos.exe
  C:\Windows\System\fazEJos.exe
  2⤵
  PID:12176
- C:\Windows\System\ZRGfpTa.exe
  C:\Windows\System\ZRGfpTa.exe
  2⤵
  PID:12192
- C:\Windows\System\HtyyBIi.exe
  C:\Windows\System\HtyyBIi.exe
  2⤵
  PID:12220
- C:\Windows\System\uzzjHBh.exe
  C:\Windows\System\uzzjHBh.exe
  2⤵
  PID:12248
- C:\Windows\System\XOeivbh.exe
  C:\Windows\System\XOeivbh.exe
  2⤵
  PID:12280
- C:\Windows\System\eySaYGu.exe
  C:\Windows\System\eySaYGu.exe
  2⤵
  PID:2940
- C:\Windows\System\GbPvKdI.exe
  C:\Windows\System\GbPvKdI.exe
  2⤵
  PID:11296
- C:\Windows\System\oXhdTfL.exe
  C:\Windows\System\oXhdTfL.exe
  2⤵
  PID:11340
- C:\Windows\System\UjwNPCL.exe
  C:\Windows\System\UjwNPCL.exe
  2⤵
  PID:11408
- C:\Windows\System\dxicLpY.exe
  C:\Windows\System\dxicLpY.exe
  2⤵
  PID:11488
- C:\Windows\System\xyGCgta.exe
  C:\Windows\System\xyGCgta.exe
  2⤵
  PID:11548
- C:\Windows\System\INvDJBR.exe
  C:\Windows\System\INvDJBR.exe
  2⤵
  PID:11608
- C:\Windows\System\YZyXcId.exe
  C:\Windows\System\YZyXcId.exe
  2⤵
  PID:11668
- C:\Windows\System\jrhwAjp.exe
  C:\Windows\System\jrhwAjp.exe
  2⤵
  PID:11768
- C:\Windows\System\NHyITEq.exe
  C:\Windows\System\NHyITEq.exe
  2⤵
  PID:11792
- C:\Windows\System\WBkmIez.exe
  C:\Windows\System\WBkmIez.exe
  2⤵
  PID:11920
- C:\Windows\System\bvvamms.exe
  C:\Windows\System\bvvamms.exe
  2⤵
  PID:11964
- C:\Windows\System\gpRsdoC.exe
  C:\Windows\System\gpRsdoC.exe
  2⤵
  PID:12012
- C:\Windows\System\ChVBJbu.exe
  C:\Windows\System\ChVBJbu.exe
  2⤵
  PID:12068
- C:\Windows\System\PmZdFlE.exe
  C:\Windows\System\PmZdFlE.exe
  2⤵
  PID:12140
- C:\Windows\System\NMoDRNE.exe
  C:\Windows\System\NMoDRNE.exe
  2⤵
  PID:12204
- C:\Windows\System\LTkSxve.exe
  C:\Windows\System\LTkSxve.exe
  2⤵
  PID:11116
- C:\Windows\System\owpcjxK.exe
  C:\Windows\System\owpcjxK.exe
  2⤵
  PID:11316
- C:\Windows\System\kAqzyph.exe
  C:\Windows\System\kAqzyph.exe
  2⤵
  PID:11456
- C:\Windows\System\xxonThS.exe
  C:\Windows\System\xxonThS.exe
  2⤵
  PID:11628
- C:\Windows\System\dYsOsVM.exe
  C:\Windows\System\dYsOsVM.exe
  2⤵
  PID:11784
- C:\Windows\System\MYqzxPt.exe
  C:\Windows\System\MYqzxPt.exe
  2⤵
  PID:11912
- C:\Windows\System\YEpDpwQ.exe
  C:\Windows\System\YEpDpwQ.exe
  2⤵
  PID:12100
- C:\Windows\System\LVwldaH.exe
  C:\Windows\System\LVwldaH.exe
  2⤵
  PID:12160
- C:\Windows\System\ITeyXqo.exe
  C:\Windows\System\ITeyXqo.exe
  2⤵
  PID:11392
- C:\Windows\System\zaVHgSJ.exe
  C:\Windows\System\zaVHgSJ.exe
  2⤵
  PID:11748
- C:\Windows\System\fkfeuYC.exe
  C:\Windows\System\fkfeuYC.exe
  2⤵
  PID:12096
- C:\Windows\System\kephehV.exe
  C:\Windows\System\kephehV.exe
  2⤵
  PID:12172
- C:\Windows\System\QFNyqgY.exe
  C:\Windows\System\QFNyqgY.exe
  2⤵
  PID:11896
- C:\Windows\System\DgBbzmY.exe
  C:\Windows\System\DgBbzmY.exe
  2⤵
  PID:11712
- C:\Windows\System\MOJOgPe.exe
  C:\Windows\System\MOJOgPe.exe
  2⤵
  PID:12300
- C:\Windows\System\nWpunme.exe
  C:\Windows\System\nWpunme.exe
  2⤵
  PID:12368
- C:\Windows\System\voXSjnf.exe
  C:\Windows\System\voXSjnf.exe
  2⤵
  PID:12396
- C:\Windows\System\rHkSgfg.exe
  C:\Windows\System\rHkSgfg.exe
  2⤵
  PID:12424
- C:\Windows\System\auAbRiz.exe
  C:\Windows\System\auAbRiz.exe
  2⤵
  PID:12440
- C:\Windows\System\KkYFpyX.exe
  C:\Windows\System\KkYFpyX.exe
  2⤵
  PID:12460
- C:\Windows\System\AmIIBVA.exe
  C:\Windows\System\AmIIBVA.exe
  2⤵
  PID:12484
- C:\Windows\System\DwccUNr.exe
  C:\Windows\System\DwccUNr.exe
  2⤵
  PID:12512
- C:\Windows\System\vSLHtXn.exe
  C:\Windows\System\vSLHtXn.exe
  2⤵
  PID:12544
- C:\Windows\System\pzGGixr.exe
  C:\Windows\System\pzGGixr.exe
  2⤵
  PID:12580
- C:\Windows\System\dKPHRiR.exe
  C:\Windows\System\dKPHRiR.exe
  2⤵
  PID:12608
- C:\Windows\System\qqqZDdc.exe
  C:\Windows\System\qqqZDdc.exe
  2⤵
  PID:12628
- C:\Windows\System\evJZkoD.exe
  C:\Windows\System\evJZkoD.exe
  2⤵
  PID:12660
- C:\Windows\System\yAfhSFV.exe
  C:\Windows\System\yAfhSFV.exe
  2⤵
  PID:12692
- C:\Windows\System\mQwRwzu.exe
  C:\Windows\System\mQwRwzu.exe
  2⤵
  PID:12720
- C:\Windows\System\WJPAGVy.exe
  C:\Windows\System\WJPAGVy.exe
  2⤵
  PID:12748
- C:\Windows\System\vUmucVX.exe
  C:\Windows\System\vUmucVX.exe
  2⤵
  PID:12780
- C:\Windows\System\DmmiTXW.exe
  C:\Windows\System\DmmiTXW.exe
  2⤵
  PID:12808
- C:\Windows\System\mTHaPPs.exe
  C:\Windows\System\mTHaPPs.exe
  2⤵
  PID:12844
- C:\Windows\System\CNwmuZG.exe
  C:\Windows\System\CNwmuZG.exe
  2⤵
  PID:12860
- C:\Windows\System\PdaNJDT.exe
  C:\Windows\System\PdaNJDT.exe
  2⤵
  PID:12888
- C:\Windows\System\EnRMXDZ.exe
  C:\Windows\System\EnRMXDZ.exe
  2⤵
  PID:12916
- C:\Windows\System\gNFWPQJ.exe
  C:\Windows\System\gNFWPQJ.exe
  2⤵
  PID:12956
- C:\Windows\System\EAxgvJP.exe
  C:\Windows\System\EAxgvJP.exe
  2⤵
  PID:12984
- C:\Windows\System\ncHmZob.exe
  C:\Windows\System\ncHmZob.exe
  2⤵
  PID:13016
- C:\Windows\System\SzUIGCn.exe
  C:\Windows\System\SzUIGCn.exe
  2⤵
  PID:13044
- C:\Windows\System\yRwRkDy.exe
  C:\Windows\System\yRwRkDy.exe
  2⤵
  PID:13072
- C:\Windows\System\cObmhEk.exe
  C:\Windows\System\cObmhEk.exe
  2⤵
  PID:13092
- C:\Windows\System\geRLTvg.exe
  C:\Windows\System\geRLTvg.exe
  2⤵
  PID:13116
- C:\Windows\System\IVeDTBd.exe
  C:\Windows\System\IVeDTBd.exe
  2⤵
  PID:13132
- C:\Windows\System\XmShyIM.exe
  C:\Windows\System\XmShyIM.exe
  2⤵
  PID:13172
- C:\Windows\System\njrvKvB.exe
  C:\Windows\System\njrvKvB.exe
  2⤵
  PID:13204
- C:\Windows\System\DEaPGqv.exe
  C:\Windows\System\DEaPGqv.exe
  2⤵
  PID:13232
- C:\Windows\System\tXgwkPU.exe
  C:\Windows\System\tXgwkPU.exe
  2⤵
  PID:13264
- C:\Windows\System\ZSMZAcd.exe
  C:\Windows\System\ZSMZAcd.exe
  2⤵
  PID:13288
- C:\Windows\System\uUdgZWt.exe
  C:\Windows\System\uUdgZWt.exe
  2⤵
  PID:11600
- C:\Windows\System\GzRCBbw.exe
  C:\Windows\System\GzRCBbw.exe
  2⤵
  PID:12320
- C:\Windows\System\ZYBWKyo.exe
  C:\Windows\System\ZYBWKyo.exe
  2⤵
  PID:12416
- C:\Windows\System\DffzoWM.exe
  C:\Windows\System\DffzoWM.exe
  2⤵
  PID:12476
- C:\Windows\System\azxBlOF.exe
  C:\Windows\System\azxBlOF.exe
  2⤵
  PID:12572
- C:\Windows\System\LbjZTDL.exe
  C:\Windows\System\LbjZTDL.exe
  2⤵
  PID:12644
- C:\Windows\System\RHWbhEc.exe
  C:\Windows\System\RHWbhEc.exe
  2⤵
  PID:12680
- C:\Windows\System\mKFVRYd.exe
  C:\Windows\System\mKFVRYd.exe
  2⤵
  PID:12740
- C:\Windows\System\ZNESKww.exe
  C:\Windows\System\ZNESKww.exe
  2⤵
  PID:12828
- C:\Windows\System\FwJFjIl.exe
  C:\Windows\System\FwJFjIl.exe
  2⤵
  PID:12904
- C:\Windows\System\iLvRzkH.exe
  C:\Windows\System\iLvRzkH.exe
  2⤵
  PID:12972
- C:\Windows\System\AqKkgnV.exe
  C:\Windows\System\AqKkgnV.exe
  2⤵
  PID:13032
- C:\Windows\System\MAWlPlz.exe
  C:\Windows\System\MAWlPlz.exe
  2⤵
  PID:13100
- C:\Windows\System\ZfcTeJA.exe
  C:\Windows\System\ZfcTeJA.exe
  2⤵
  PID:13148
- C:\Windows\System\AdmFESj.exe
  C:\Windows\System\AdmFESj.exe
  2⤵
  PID:13216
- C:\Windows\System\FjQQaoZ.exe
  C:\Windows\System\FjQQaoZ.exe
  2⤵
  PID:13296
- C:\Windows\System\DHFIshd.exe
  C:\Windows\System\DHFIshd.exe
  2⤵
  PID:12436
- C:\Windows\System\mzwiQXh.exe
  C:\Windows\System\mzwiQXh.exe
  2⤵
  PID:12568
- C:\Windows\System\bExjHQD.exe
  C:\Windows\System\bExjHQD.exe
  2⤵
  PID:12668
- C:\Windows\System\DkIGuHc.exe
  C:\Windows\System\DkIGuHc.exe
  2⤵
  PID:12876
- C:\Windows\System\PsWSMhP.exe
  C:\Windows\System\PsWSMhP.exe
  2⤵
  PID:13008
- C:\Windows\System\lWbUyIp.exe
  C:\Windows\System\lWbUyIp.exe
  2⤵
  PID:13160
- C:\Windows\System\HlrlBex.exe
  C:\Windows\System\HlrlBex.exe
  2⤵
  PID:13244
- C:\Windows\System\FGQhEhq.exe
  C:\Windows\System\FGQhEhq.exe
  2⤵
  PID:12528
- C:\Windows\System\KhpCDbj.exe
  C:\Windows\System\KhpCDbj.exe
  2⤵
  PID:13060
- C:\Windows\System\CDHEqZT.exe
  C:\Windows\System\CDHEqZT.exe
  2⤵
  PID:12968
- C:\Windows\System\OndXEpk.exe
  C:\Windows\System\OndXEpk.exe
  2⤵
  PID:3624
- C:\Windows\System\vMJGBjL.exe
  C:\Windows\System\vMJGBjL.exe
  2⤵
  PID:544
- C:\Windows\System\QqRVhWS.exe
  C:\Windows\System\QqRVhWS.exe
  2⤵
  PID:13272
- C:\Windows\System\KZqRZjt.exe
  C:\Windows\System\KZqRZjt.exe
  2⤵
  PID:13368
- C:\Windows\System\AHkIEqi.exe
  C:\Windows\System\AHkIEqi.exe
  2⤵
  PID:13384
- C:\Windows\System\vGlsfFf.exe
  C:\Windows\System\vGlsfFf.exe
  2⤵
  PID:13412
- C:\Windows\System\uAXErAz.exe
  C:\Windows\System\uAXErAz.exe
  2⤵
  PID:13444
- C:\Windows\System\NuudoEX.exe
  C:\Windows\System\NuudoEX.exe
  2⤵
  PID:13472
- C:\Windows\System\urvnhWn.exe
  C:\Windows\System\urvnhWn.exe
  2⤵
  PID:13496
- C:\Windows\System\YQinuGS.exe
  C:\Windows\System\YQinuGS.exe
  2⤵
  PID:13516
- C:\Windows\System\KQXGMCA.exe
  C:\Windows\System\KQXGMCA.exe
  2⤵
  PID:13556
- C:\Windows\System\lIIiTAo.exe
  C:\Windows\System\lIIiTAo.exe
  2⤵
  PID:13576
- C:\Windows\System\WyusEoV.exe
  C:\Windows\System\WyusEoV.exe
  2⤵
  PID:13600
- C:\Windows\System\TSFuWIA.exe
  C:\Windows\System\TSFuWIA.exe
  2⤵
  PID:13640
- C:\Windows\System\KxHiQrr.exe
  C:\Windows\System\KxHiQrr.exe
  2⤵
  PID:13664
- C:\Windows\System\HIDHeqh.exe
  C:\Windows\System\HIDHeqh.exe
  2⤵
  PID:13692
- C:\Windows\System\uoUgKCd.exe
  C:\Windows\System\uoUgKCd.exe
  2⤵
  PID:13724
- C:\Windows\System\yjJjFhp.exe
  C:\Windows\System\yjJjFhp.exe
  2⤵
  PID:13752
- C:\Windows\System\QhLeppd.exe
  C:\Windows\System\QhLeppd.exe
  2⤵
  PID:13772
- C:\Windows\System\SuIjHjT.exe
  C:\Windows\System\SuIjHjT.exe
  2⤵
  PID:13788
- C:\Windows\System\ZxdRpBb.exe
  C:\Windows\System\ZxdRpBb.exe
  2⤵
  PID:13824
- C:\Windows\System\faoLzvA.exe
  C:\Windows\System\faoLzvA.exe
  2⤵
  PID:13864
- C:\Windows\System\bSJrrCH.exe
  C:\Windows\System\bSJrrCH.exe
  2⤵
  PID:13892
- C:\Windows\System\dJWxAGW.exe
  C:\Windows\System\dJWxAGW.exe
  2⤵
  PID:13908
- C:\Windows\System\xOlJUEa.exe
  C:\Windows\System\xOlJUEa.exe
  2⤵
  PID:13928
- C:\Windows\System\lVKKliX.exe
  C:\Windows\System\lVKKliX.exe
  2⤵
  PID:13960
- C:\Windows\System\ESdCNfl.exe
  C:\Windows\System\ESdCNfl.exe
  2⤵
  PID:14004
- C:\Windows\System\PqCTWta.exe
  C:\Windows\System\PqCTWta.exe
  2⤵
  PID:14024
- C:\Windows\System\jgTJYpB.exe
  C:\Windows\System\jgTJYpB.exe
  2⤵
  PID:14048
- C:\Windows\System\XFoZBPT.exe
  C:\Windows\System\XFoZBPT.exe
  2⤵
  PID:14076
- C:\Windows\System\ADDDCLK.exe
  C:\Windows\System\ADDDCLK.exe
  2⤵
  PID:14104
- C:\Windows\System\lcSEKoP.exe
  C:\Windows\System\lcSEKoP.exe
  2⤵
  PID:14136
- C:\Windows\System\QcegQEJ.exe
  C:\Windows\System\QcegQEJ.exe
  2⤵
  PID:14160
- C:\Windows\System\KfWiiWL.exe
  C:\Windows\System\KfWiiWL.exe
  2⤵
  PID:14180
- C:\Windows\System\AaNBoET.exe
  C:\Windows\System\AaNBoET.exe
  2⤵
  PID:14228
- C:\Windows\System\iMWcFge.exe
  C:\Windows\System\iMWcFge.exe
  2⤵
  PID:14256
- C:\Windows\System\ZUpuZoa.exe
  C:\Windows\System\ZUpuZoa.exe
  2⤵
  PID:14284
- C:\Windows\System\nXCSilL.exe
  C:\Windows\System\nXCSilL.exe
  2⤵
  PID:14308
- C:\Windows\System\PdmOrUe.exe
  C:\Windows\System\PdmOrUe.exe
  2⤵
  PID:3600
- C:\Windows\System\lfRtViQ.exe
  C:\Windows\System\lfRtViQ.exe
  2⤵
  PID:13364
- C:\Windows\System\lHHtPsc.exe
  C:\Windows\System\lHHtPsc.exe
  2⤵
  PID:13428
- C:\Windows\System\vgBKNQl.exe
  C:\Windows\System\vgBKNQl.exe
  2⤵
  PID:13492
- C:\Windows\System\biZWQyH.exe
  C:\Windows\System\biZWQyH.exe
  2⤵
  PID:13564
- C:\Windows\System\wYqwJZW.exe
  C:\Windows\System\wYqwJZW.exe
  2⤵
  PID:13632
- C:\Windows\System\sshmApn.exe
  C:\Windows\System\sshmApn.exe
  2⤵
  PID:13688
- C:\Windows\System\sSRNYcD.exe
  C:\Windows\System\sSRNYcD.exe
  2⤵
  PID:13760
- C:\Windows\System\uRUJIVH.exe
  C:\Windows\System\uRUJIVH.exe
  2⤵
  PID:13820
- C:\Windows\System\QXTfQSZ.exe
  C:\Windows\System\QXTfQSZ.exe
  2⤵
  PID:13884
- C:\Windows\System\IVVyWsk.exe
  C:\Windows\System\IVVyWsk.exe
  2⤵
  PID:13952
- C:\Windows\System\pvOXWnx.exe
  C:\Windows\System\pvOXWnx.exe
  2⤵
  PID:14016
- C:\Windows\System\xowvmOh.exe
  C:\Windows\System\xowvmOh.exe
  2⤵
  PID:14044
- C:\Windows\System\VfqyHxM.exe
  C:\Windows\System\VfqyHxM.exe
  2⤵
  PID:14152
- C:\Windows\System\xgXgGcW.exe
  C:\Windows\System\xgXgGcW.exe
  2⤵
  PID:14220
- C:\Windows\System\rwCrswu.exe
  C:\Windows\System\rwCrswu.exe
  2⤵
  PID:14272
- C:\Windows\System\yAsJdyk.exe
  C:\Windows\System\yAsJdyk.exe
  2⤵
  PID:13376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CtwMSaM.exe

Filesize
2.0MB

MD5
a40bef7a8acf01bdc3bbb2bf4c726ac9

SHA1
44118eaeb3c0940fdbe7235a5d8a4d8c8102751e

SHA256
70b3800db412f5d809bbe6e73c3bf6397fa94e7dfa73b9cbaa26eddc2a693a0b

SHA512
19d435b8a1a797941785a69014d462a0e834988001709286419547faf13a40a6cb41d8949e7bdadff4455502ca21c797b2ee447108eb8c8ecd06322d3490ae90

Download Submit
C:\Windows\System\EFBQCYQ.exe

Filesize
2.0MB

MD5
12c970fc58d165d401095071d2b1333b

SHA1
808a51a67a7437c3c5f04cb52dd9db1b6244c1f9

SHA256
db99c7d875d91be9159e8267067f6e68e79380ce7ac8b21f59aa85f8402d82ee

SHA512
8885a737c61d5a15e1564966440a3b49aea57bb3d8e8f4be784c5fc4da074f77343f2ceb8bfbb89e55bf2779901612eb76b40a62ff0a39b5f1c4b50c2082cbd1

Download Submit
C:\Windows\System\GnLkVip.exe

Filesize
2.0MB

MD5
ed68292d8944d19deda8a96ae283567d

SHA1
1d08ce872084bf11379b5a9b27469cd9f983a247

SHA256
cd183ad777c124176268ec9b7315c9127723a1c03db38f6df8ff169d927666f5

SHA512
b263aa37c2427885845d61ce3adac245fb0b6f0da1e382aad5b172c136a5e5f4842ec4aea0636436b0de589fcafece68569538c96d0e3ba9d6af5823a68c93f9

Download Submit
C:\Windows\System\IsJIoFK.exe

Filesize
2.0MB

MD5
139f7a08d4f8ed6fe620cf94241811f1

SHA1
1c5ea6b046911e152c2447c4e49f24bba76042a0

SHA256
134e99788fe082bf37fafc10623a77357868a9b35f4d4d1743c19cad86a35fa0

SHA512
ef0e6e98abbd61b169442c04ab829f307a92dd6118ad689310701d79d6b0743afe554c5b0a84335d0ec3f94fbb068a5e6c0a193e439cc597fced533f003c1c28

Download Submit
C:\Windows\System\JGSBYFJ.exe

Filesize
2.0MB

MD5
7d5cce748565f2e6a696a3e58da3c758

SHA1
8960c2060c6e4a5df208e3282ac2385bfa661fdd

SHA256
b688d1cb6cd4bf082f4aba6cad7214f4e223d8bf5e53c157c7c0d1c1317cf9c0

SHA512
cb94075208926891e303b4470985f2195599d55c9c8d60f3fff5e97b612e8493509feb9fcdef5347fd8a927abcf6de547b0c3b56bb38e70da422d2da66a6d320

Download Submit
C:\Windows\System\MrUrkeF.exe

Filesize
2.0MB

MD5
6581e2cc6100d81aae46f467f739c2fe

SHA1
288cd6ac2fede0e18767fa6c2150a6d2860cf6cc

SHA256
51c417382a71d79f7dbb0f5aa9fec96e4a9ae9aed28b91300b0868726e7a4644

SHA512
6c6126cc8e4bb59f0014aa205238c512cb86063741938380766b6955b81c1c50c3d7d037201f8e4e5ff3b95c35dec07a78eb69f7e9bc01a62901428f360a5ef6

Download Submit
C:\Windows\System\NcjiDRd.exe

Filesize
2.0MB

MD5
17ef625b420a584fc8c634bec0008d6a

SHA1
0e2a947676cc3309eed758f5398af30ad1404476

SHA256
0f1e4c142a53efbfa74f59780be8a2cc690f513a4d971f13b4ef6aeec0f0c2cc

SHA512
0c731521313f1bc1bc4fd15c4b8f84a34abef91a77456fd91b7ee584addf55d1a9989c31b058a1f636cf92ea3515045e7211b9c7d1079e9c40131fb1632acf8c

Download Submit
C:\Windows\System\OCypwKp.exe

Filesize
2.0MB

MD5
6fb79778e6d64a5762a8ae092ece4f22

SHA1
e5eaf8e1e17eaa26dd17a37c66a6af70b19f0e6b

SHA256
9d1478ceee039fe82e7c81f85c08f07b8cbf02e6609047ebadb993236395869d

SHA512
05c4cebde168801da01a88ba1e20b73474df65374436e9fc23d9a4a52ead0b52f13ae3bbc901eca145c4bca91254a85aa116d20e59548b2495adaca324e7a2d8

Download Submit
C:\Windows\System\OlUgHun.exe

Filesize
2.0MB

MD5
42e81392402d5e330d6ead884f7ba170

SHA1
3cf0f609197d8a871b40f6f0bd402a2b3eb99651

SHA256
290d44adbf354fc96055fa91177bd32ece1835fc7936152a6ee871e106eee5a1

SHA512
be42615bf5bbda125b3bc52abebe6e58780e4e1658c2754511e51f9e2c8435621f4cbc6f460678029ac929a42aca86a99a63cc51fe2975d581fab20992b77779

Download Submit
C:\Windows\System\RUuPFAH.exe

Filesize
2.0MB

MD5
b9cb847d7c9cfd1fd658ef8640af6032

SHA1
713a46efc5cea2bf83440023e72d770834f4cc29

SHA256
cbd62fdf95e27596649828547ddff4d8e1f46de6afb01c93822d8e00b81386bf

SHA512
324ac721ba4487a97366af9d3fb742830f761d4025af24860639c2ebde605537361cbef0ca40c899b2e29d6806d1294b33e3ffb252177ebb42fb88b14f1b6a7f

Download Submit
C:\Windows\System\RwzyiuH.exe

Filesize
2.0MB

MD5
6e29ef68f393ba2b603ce2822d0dcca4

SHA1
2f7500e86e786f7307e2164aa82214b938518cb2

SHA256
56e532c58149c1c9bf5808b7e271b25457e45fcb54f13e6780240259a22caea3

SHA512
d118b95859f80194fca1cb03ec44f381876ac4000c391b3c0ad9b4813536260286281be4191a68b611e58d209674b150ecfd7a8b51f4da8d10c7e1234a35c1f0

Download Submit
C:\Windows\System\TYDuISm.exe

Filesize
2.0MB

MD5
f66ee610949aa20dc0dc603cfaeee58f

SHA1
49ead86ad705889572dc23dfa26123f86cc211bb

SHA256
b72faf58f56f961deeb7d26c60f1b5adf203db6aa1c16e282a466e2e7ee97ae2

SHA512
306ed36c0399b1e3b3048186351ef6ea44844328142ce307db8920f8e3de29b46929327a6450e78000b1df5cfe66a449b634f9d90ec163d07b776f445ec5cc59

Download Submit
C:\Windows\System\WHTtJmE.exe

Filesize
2.0MB

MD5
50b7bb13971e0c6c715b24a902a6f19c

SHA1
5d1aa4cd550d79c64ebf2ee2dd98badeac4eb7c9

SHA256
eb76675cd57b0cc161ad99a989d2500f94d1f8c85f7bc0b9964363c4075513ba

SHA512
e58c922f869db83af65c423550d6abf699c8a433d2199df7cae1171886663599176a31782078d76b9be908ac23e901ed4409b1d16d874421f238debe65191f63

Download Submit
C:\Windows\System\WuQKZhA.exe

Filesize
2.0MB

MD5
edc8c2ff8451bf0baa5294b7ae4fc7a5

SHA1
452d0ed82d0d847f0b9b007c695d31dbec18d82f

SHA256
ad423ee71854476042ba13a96e33855825f10bf3647aef4134f40b5f773aa609

SHA512
c015b21ff0b33ed8f9b4872c8414535ba666b75862e1bdf1d2d1faa3f94ee098df9d2ec2d7cbcd602ea99621fe0b3800d02cdb88afd7f063cb75847cdd4b6b6c

Download Submit
C:\Windows\System\XRNcImQ.exe

Filesize
2.0MB

MD5
75aad424015145a51f03d85609079bce

SHA1
cc1c9a3d3fd32e11b084ddf26ccfee8e6e905120

SHA256
73d0e2a07c0d65bb145d24c1cff83d26d62347501694d2b0b35cf9be6c6b6790

SHA512
72496807da8e9e2e71d6b4ea1f63698f6750aa9834b492201e2b4ce23edeca6fc12381ab2052e33a4f48dc7bcca50afba617792006d6da2796cd25915b1e8757

Download Submit
C:\Windows\System\YkfgSik.exe

Filesize
2.0MB

MD5
f2bbf4e65e12de6245b772de74a59092

SHA1
b3f42efff525256013d72f84328b0000d5e82fe9

SHA256
2cdc7f80560868f234ed0843b816bad57395d2541fa3039012ed5fa8051463b4

SHA512
cd66c098a918c394a028ddd7e8ceb5e02ba04d008be5af6a5ec34fec1b3ed566c59b79eff96e5557fb198231f63a5235308d99ab8183f92f54eb4473bc8bb2f5

Download Submit
C:\Windows\System\cHelbNA.exe

Filesize
2.0MB

MD5
c41d3fe7d6c8c32754270694e168c723

SHA1
155e88319d29d59ef5cf75cdcd0e5df5829e0a5e

SHA256
4bbf62ae74b7866038ffa7c5aef3becc3bb842dbe900b471f5ca7521e9c408b5

SHA512
d4df3c61919f6358762f87ce167757c0fbc6d3fa489d0beb11d7bba5e822eff7eeb3f02bee35bba70b2991f23baf963e3c4b069659ac1dac56219080a97ef17a

Download Submit
C:\Windows\System\cgXcXXB.exe

Filesize
2.0MB

MD5
5effdb18ef6a1328e1f59983da21fb5c

SHA1
6a631b3f35481e733f9efb6a055a8f69bed900b8

SHA256
1889dc8e5c3d2e4395497b3adf8bd220ce776bb307b062a8ce9a20a464ad6ce1

SHA512
aecd4c6ba498389ee8cfe55c0ea8ce9b6743cab01c0aec5a1ca46ed91d0d1b1b60aed351f5f77ed41dcd0887317ab933d8e8b2399b74a1235cafb10d8bf94671

Download Submit
C:\Windows\System\cpINJTG.exe

Filesize
2.0MB

MD5
8b94cd3017bce135bba22a268b828f5c

SHA1
ce5fdf0db460a6af11063d6b40f751339e399602

SHA256
3d7c5985b373a786365277c3f363f12df799b5a97c7866ef14993125a90707bc

SHA512
ba98d353e14d7114a5da64e821cee3d9888bd83c0cee71e0705002910dd0fdaca4e14d0db6a9639e0c9c8dbf4b20725ec1c73ab43f820aa45d5ebb84ecbb36e1

Download Submit
C:\Windows\System\dEskviC.exe

Filesize
2.0MB

MD5
08910241040993a78572f1f28264f43a

SHA1
62f1de366ac2170f4f17b3a27442d1af416f3008

SHA256
7bebfddc02a0f089ed044521db5d7a249f32d0534b3a691691b01267be5533ef

SHA512
8b0d4817c716622e976d6221f5e5f2b9bf59cbd7a1c1fdd2850bdb4b929f2d27251396f2acf6d51770a73e644d9be781e1213013804a01fad59a7fd3ff2c6cd9

Download Submit
C:\Windows\System\iEQwvNg.exe

Filesize
2.0MB

MD5
444f6fecdbb59262f0246b4574346fcd

SHA1
0069ae83ade87da2a994d4de93b7e79616cad688

SHA256
bc0d2284375d94284fb8136d85acd26717a45b90ecdc42200c61a1e26a0e735e

SHA512
c21925d1efc3d14e1dba6833754eb5112a8e4bb74b0147cdb87c3f42ad06a71c915e9dc493147b91a17f0384c5af529610401aad4d6632b189626fb21322d6da

Download Submit
C:\Windows\System\iUYHaDu.exe

Filesize
2.0MB

MD5
25cdeebdb5c2b056bbaacabb5b0f0842

SHA1
8ebcf3dd3e23424dfc40a52569c241d667bdc8ef

SHA256
d38bc5374e791ec8531b3943b39851e9290470e8880344687ba8876f3abab517

SHA512
616850f624a05ca659f375717c1e0f26076d7c14f9e96f782e7ad41d9e6c47ae0860489a33bd598d72208adb557c914720bbd2722526232cb0d512553916adf2

Download Submit
C:\Windows\System\jYWtYFK.exe

Filesize
2.0MB

MD5
22237e6498749fb8850b4674ffde5166

SHA1
63f8be893368947d1fb5600eeef46d507da7a395

SHA256
42c1ed0b0c6d29bdfd8201229a0fce6681377b919373cd0ceac881d56c74ad9c

SHA512
4a32a5c11505b9b2d5b065318524a92160a05be9ef3af62439e8e874cd8274fc46e384282fa5de1c58f82a137f31793aee5536b5babe7c79e5dc07005893db5f

Download Submit
C:\Windows\System\mFNyAVq.exe

Filesize
2.0MB

MD5
3a560bf3a374a0ea1cb211213e469695

SHA1
f7dd95941fc7b997df1eb6947c9634ed8ef4c6e3

SHA256
fb07532c966063bc75c7309ef7efba00779bcf3bd129df543f3b3df8bd8eb7df

SHA512
a8bda61ba280e7aa4ac205d4608e2e392da0521c16f2acd19b039f0b702f5f8ac5a24bb77c3d2d929acab1f68dc247ebf1bc92fc9148f1196243b2e5c3009631

Download Submit
C:\Windows\System\mGemnVf.exe

Filesize
2.0MB

MD5
2c892d6b71ccf2bcb1701b506be62e8d

SHA1
7da8fd89e57f09e565c97176b6e76dcc0a4bad55

SHA256
692a65e691a882fbf3b05d4b94644275664ab162a210cac702105d90f128f540

SHA512
c2118c774cbcc13174f85e93df94c16e22175a0e46e43ecc910c5bf1f831c7b4255092bb3b816d7ac73d14d679b67fd78f4f106d178001080b789466d0027255

Download Submit
C:\Windows\System\pMkGgfL.exe

Filesize
2.0MB

MD5
d1583b369d5d8b24779962a6c6792f3a

SHA1
d148dcefa6d83b984777fc349bcc6f60ff25d676

SHA256
3de2e8a254409e898a58a788b6dbc53d25b4ca6e4caefcfdc1d8feaa4fe8e575

SHA512
9228fb2b8b0e7ee1e907b5de01a9c57a183d09bab04c41efd65326f0ae6743ec5612dda7b1277ab3ee32daef1d5a85d7eff6b7fbcf446cd9607958c7b2d2c7a6

Download Submit
C:\Windows\System\qgzqhDK.exe

Filesize
2.0MB

MD5
a5e214c96d948547257a52c6ee596112

SHA1
a92fa56b07327e52bdb4ec884a9aeed6391d019d

SHA256
8f1933f64cd2994c841555d404b22d9061eb99223707af10e94f6742ff1ff3c1

SHA512
6e2f9eb5dea0b460769ff30672a8f4a40acb8e2b0e68377e97f0b082407f77afa6078ef14f2e53f0789b966f66172dc02a50f1a1b3ed9b88a5851eba83b5bb2e

Download Submit
C:\Windows\System\rXWazsY.exe

Filesize
2.0MB

MD5
391a8b3a27b7bed58e83860f8e6125e7

SHA1
a68052353a7ccba4fd427b2c4c15031e4aa0fe38

SHA256
edcef55ceca2be503f95656fbfb9d3722cc5bdb0e3d640a279f4c59acd23584d

SHA512
c28f666d9414c51d8d33904ec6de3a40499105f729b3151dfacf5195b878003d3de65128e851caa53e9824d18dcda73dbeefbff374ab7ed30667a448ef87fbd4

Download Submit
C:\Windows\System\wGfWujo.exe

Filesize
2.0MB

MD5
7cbb89118055d0213b4bf1b91508d580

SHA1
e283229ab8320b61b3a4b36fc5dc7da951a22a59

SHA256
dbac1c67644580062588344685f8883723767feddf2dbd86a0b33053b44ae4bf

SHA512
be0e05f09704bf46e96eba63631c887c81d699a6b2de0ad76b02c0293857664322b89c69f4814de7d0a1086fcb281f94328210647a417b15d04bdd00d661b558

Download Submit
C:\Windows\System\wypAWtW.exe

Filesize
2.0MB

MD5
efb4128fd1595322f7d8ed6ffc530ab8

SHA1
8e5d7cddf3eeeb692bc1ad958540998cfea7a30f

SHA256
9108d51019234e6e0186151679083c56c0b2829f53dec208dcb5ea3d4c10bd0a

SHA512
9dcd155907838a7e2ac7ef12a144ba2e1025b3555fb5dfd7692d084ddb0e6b52f384bb32f631eee315d3777827f289c1e5f7d07ccf461a80a5cac6e6bfcafeed

Download Submit
C:\Windows\System\xidOfjn.exe

Filesize
2.0MB

MD5
c5240e578388661a2543f02c664df9e3

SHA1
359858fc927f6eeca5582447083d45fe60395db4

SHA256
4fc873343eb9b2bd196a2f72ab207afc01fd2dd020e9020ed6c982d1a20e9410

SHA512
4126a75a87d39ea466ee70942ac3a0c57c9543c65fd43dad4b8321bcc21445eb63d727a498855b3242da5f8de227c6d73ec3c3a82e20713167a736981efff6a5

Download Submit
C:\Windows\System\xxcKpDe.exe

Filesize
2.0MB

MD5
afb2a4e4063ed7b6038db49fa1388d5a

SHA1
1b3ba627228421b8a7d720e67f5b8f9c7251660f

SHA256
dda76f94fa08fe6dd55b1107bf871321996a23d2dde0408169e45bf96e6ab477

SHA512
6f51f7bf91fe8fe6bc431ccb0064487e4b5106f9ba86f657614711d082100504c7d7d09ed35b857df2aaeb6ff581122624e674f6b08c57608dc432d377499d3f

Download Submit
C:\Windows\System\zQVKOBL.exe

Filesize
2.0MB

MD5
3a5f1192ac2c3ec8bd557c25e01bbe66

SHA1
0f6ea1efccbaf3cc6e3bc08c366afac637a0c6b9

SHA256
2f9e80512da420a3710e05df60f5f9f99016d5c7b533035a8ba76cc508003a23

SHA512
4b388d219b0b372185535507a78c4f0ab807a3f1e5267ae5d3086e41c3890472de789ef3e34b1e379b423845a74cf282d74795ccf3910acf6817bab73dc23ab4

Download Submit
memory/1612-810-0x00007FF6983A0000-0x00007FF6986F4000-memory.dmp

Filesize
3.3MB

Download
memory/1612-2111-0x00007FF6983A0000-0x00007FF6986F4000-memory.dmp

Filesize
3.3MB

Download
memory/1660-2119-0x00007FF744EA0000-0x00007FF7451F4000-memory.dmp

Filesize
3.3MB

Download
memory/1660-650-0x00007FF744EA0000-0x00007FF7451F4000-memory.dmp

Filesize
3.3MB

Download
memory/1732-14-0x00007FF72B320000-0x00007FF72B674000-memory.dmp

Filesize
3.3MB

Download
memory/1732-2105-0x00007FF72B320000-0x00007FF72B674000-memory.dmp

Filesize
3.3MB

Download
memory/1776-20-0x00007FF6FC6B0000-0x00007FF6FCA04000-memory.dmp

Filesize
3.3MB

Download
memory/1776-2106-0x00007FF6FC6B0000-0x00007FF6FCA04000-memory.dmp

Filesize
3.3MB

Download
memory/1812-2120-0x00007FF6B98C0000-0x00007FF6B9C14000-memory.dmp

Filesize
3.3MB

Download
memory/1812-677-0x00007FF6B98C0000-0x00007FF6B9C14000-memory.dmp

Filesize
3.3MB

Download
memory/1980-2131-0x00007FF75D730000-0x00007FF75DA84000-memory.dmp

Filesize
3.3MB

Download
memory/1980-698-0x00007FF75D730000-0x00007FF75DA84000-memory.dmp

Filesize
3.3MB

Download
memory/2136-2127-0x00007FF7589C0000-0x00007FF758D14000-memory.dmp

Filesize
3.3MB

Download
memory/2136-711-0x00007FF7589C0000-0x00007FF758D14000-memory.dmp

Filesize
3.3MB

Download
memory/2176-2129-0x00007FF696BE0000-0x00007FF696F34000-memory.dmp

Filesize
3.3MB

Download
memory/2176-704-0x00007FF696BE0000-0x00007FF696F34000-memory.dmp

Filesize
3.3MB

Download
memory/2260-2125-0x00007FF6F7EB0000-0x00007FF6F8204000-memory.dmp

Filesize
3.3MB

Download
memory/2260-712-0x00007FF6F7EB0000-0x00007FF6F8204000-memory.dmp

Filesize
3.3MB

Download
memory/2396-2108-0x00007FF794B70000-0x00007FF794EC4000-memory.dmp

Filesize
3.3MB

Download
memory/2396-39-0x00007FF794B70000-0x00007FF794EC4000-memory.dmp

Filesize
3.3MB

Download
memory/2416-646-0x00007FF707880000-0x00007FF707BD4000-memory.dmp

Filesize
3.3MB

Download
memory/2416-2113-0x00007FF707880000-0x00007FF707BD4000-memory.dmp

Filesize
3.3MB

Download
memory/2852-707-0x00007FF6DDE20000-0x00007FF6DE174000-memory.dmp

Filesize
3.3MB

Download
memory/2852-2128-0x00007FF6DDE20000-0x00007FF6DE174000-memory.dmp

Filesize
3.3MB

Download
memory/3032-2122-0x00007FF7044C0000-0x00007FF704814000-memory.dmp

Filesize
3.3MB

Download
memory/3032-689-0x00007FF7044C0000-0x00007FF704814000-memory.dmp

Filesize
3.3MB

Download
memory/3108-2107-0x00007FF735800000-0x00007FF735B54000-memory.dmp

Filesize
3.3MB

Download
memory/3108-26-0x00007FF735800000-0x00007FF735B54000-memory.dmp

Filesize
3.3MB

Download
memory/3108-2103-0x00007FF735800000-0x00007FF735B54000-memory.dmp

Filesize
3.3MB

Download
memory/3168-2115-0x00007FF60A6C0000-0x00007FF60AA14000-memory.dmp

Filesize
3.3MB

Download
memory/3168-665-0x00007FF60A6C0000-0x00007FF60AA14000-memory.dmp

Filesize
3.3MB

Download
memory/3220-48-0x00007FF769100000-0x00007FF769454000-memory.dmp

Filesize
3.3MB

Download
memory/3220-2110-0x00007FF769100000-0x00007FF769454000-memory.dmp

Filesize
3.3MB

Download
memory/3604-642-0x00007FF720A50000-0x00007FF720DA4000-memory.dmp

Filesize
3.3MB

Download
memory/3604-2109-0x00007FF720A50000-0x00007FF720DA4000-memory.dmp

Filesize
3.3MB

Download
memory/3612-811-0x00007FF772710000-0x00007FF772A64000-memory.dmp

Filesize
3.3MB

Download
memory/3612-2112-0x00007FF772710000-0x00007FF772A64000-memory.dmp

Filesize
3.3MB

Download
memory/3672-2118-0x00007FF77DFE0000-0x00007FF77E334000-memory.dmp

Filesize
3.3MB

Download
memory/3672-655-0x00007FF77DFE0000-0x00007FF77E334000-memory.dmp

Filesize
3.3MB

Download
memory/3748-801-0x00007FF65FE60000-0x00007FF6601B4000-memory.dmp

Filesize
3.3MB

Download
memory/3748-2126-0x00007FF65FE60000-0x00007FF6601B4000-memory.dmp

Filesize
3.3MB

Download
memory/3816-2102-0x00007FF706FB0000-0x00007FF707304000-memory.dmp

Filesize
3.3MB

Download
memory/3816-2104-0x00007FF706FB0000-0x00007FF707304000-memory.dmp

Filesize
3.3MB

Download
memory/3816-6-0x00007FF706FB0000-0x00007FF707304000-memory.dmp

Filesize
3.3MB

Download
memory/4036-2117-0x00007FF64AB80000-0x00007FF64AED4000-memory.dmp

Filesize
3.3MB

Download
memory/4036-658-0x00007FF64AB80000-0x00007FF64AED4000-memory.dmp

Filesize
3.3MB

Download
memory/4220-2121-0x00007FF714DF0000-0x00007FF715144000-memory.dmp

Filesize
3.3MB

Download
memory/4220-683-0x00007FF714DF0000-0x00007FF715144000-memory.dmp

Filesize
3.3MB

Download
memory/4432-693-0x00007FF75EED0000-0x00007FF75F224000-memory.dmp

Filesize
3.3MB

Download
memory/4432-2123-0x00007FF75EED0000-0x00007FF75F224000-memory.dmp

Filesize
3.3MB

Download
memory/4528-807-0x00007FF7FB3F0000-0x00007FF7FB744000-memory.dmp

Filesize
3.3MB

Download
memory/4528-2132-0x00007FF7FB3F0000-0x00007FF7FB744000-memory.dmp

Filesize
3.3MB

Download
memory/4696-2114-0x00007FF653750000-0x00007FF653AA4000-memory.dmp

Filesize
3.3MB

Download
memory/4696-647-0x00007FF653750000-0x00007FF653AA4000-memory.dmp

Filesize
3.3MB

Download
memory/4756-2116-0x00007FF667AD0000-0x00007FF667E24000-memory.dmp

Filesize
3.3MB

Download
memory/4756-662-0x00007FF667AD0000-0x00007FF667E24000-memory.dmp

Filesize
3.3MB

Download
memory/4768-697-0x00007FF7D7C70000-0x00007FF7D7FC4000-memory.dmp

Filesize
3.3MB

Download
memory/4768-2124-0x00007FF7D7C70000-0x00007FF7D7FC4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-701-0x00007FF7CF020000-0x00007FF7CF374000-memory.dmp

Filesize
3.3MB

Download
memory/4920-2130-0x00007FF7CF020000-0x00007FF7CF374000-memory.dmp

Filesize
3.3MB

Download
memory/5112-0-0x00007FF718C60000-0x00007FF718FB4000-memory.dmp

Filesize
3.3MB

Download
memory/5112-1-0x00000203B8350000-0x00000203B8360000-memory.dmp

Filesize
64KB

Download