xmrig | 771fff59de16c5114c862c9c53ab9d129f9218aef97ab3cc880141b9ba139370

Analysis

max time kernel
124s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
Size

2.0MB
MD5

bd5bff9b276095792a6b98de5f4ae9d0
SHA1

ba79174b87b9147fc1c1090e3e04103e4a5412db
SHA256

771fff59de16c5114c862c9c53ab9d129f9218aef97ab3cc880141b9ba139370
SHA512

966415c2b2d1b69d224f428fb14270115935fcb44af541e2c57cdde47d7fb21c182864e89923646b805f90cf37bbc6f540294a2e1b042e1cd74dec7bf866c970
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxpWftb3H6xaKF9:BemTLkNdfE0pZrQr

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1060-0-0x00007FF72F8D0000-0x00007FF72FC24000-memory.dmp	xmrig
behavioral2/files/0x000e000000023b99-14.dat	xmrig
behavioral2/files/0x000a000000023ba8-19.dat	xmrig
behavioral2/files/0x000a000000023ba9-23.dat	xmrig
behavioral2/memory/1164-18-0x00007FF670FB0000-0x00007FF671304000-memory.dmp	xmrig
behavioral2/memory/4712-13-0x00007FF70DEE0000-0x00007FF70E234000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba7-9.dat	xmrig
behavioral2/memory/1336-27-0x00007FF603F30000-0x00007FF604284000-memory.dmp	xmrig
behavioral2/memory/5016-34-0x00007FF7E2690000-0x00007FF7E29E4000-memory.dmp	xmrig
behavioral2/files/0x000b000000023ba4-41.dat	xmrig
behavioral2/files/0x000a000000023bad-57.dat	xmrig
behavioral2/files/0x000a000000023bb2-76.dat	xmrig
behavioral2/files/0x000a000000023bbc-124.dat	xmrig
behavioral2/files/0x000a000000023bbf-139.dat	xmrig
behavioral2/memory/1396-669-0x00007FF703CB0000-0x00007FF704004000-memory.dmp	xmrig
behavioral2/memory/4400-670-0x00007FF672BD0000-0x00007FF672F24000-memory.dmp	xmrig
behavioral2/memory/2948-673-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp	xmrig
behavioral2/memory/4808-674-0x00007FF731070000-0x00007FF7313C4000-memory.dmp	xmrig
behavioral2/memory/3736-678-0x00007FF78BFC0000-0x00007FF78C314000-memory.dmp	xmrig
behavioral2/memory/2264-683-0x00007FF642A90000-0x00007FF642DE4000-memory.dmp	xmrig
behavioral2/memory/1464-693-0x00007FF6EACD0000-0x00007FF6EB024000-memory.dmp	xmrig
behavioral2/memory/4984-701-0x00007FF646E50000-0x00007FF6471A4000-memory.dmp	xmrig
behavioral2/memory/4908-723-0x00007FF776F20000-0x00007FF777274000-memory.dmp	xmrig
behavioral2/memory/3504-724-0x00007FF7F6DA0000-0x00007FF7F70F4000-memory.dmp	xmrig
behavioral2/memory/2128-731-0x00007FF781210000-0x00007FF781564000-memory.dmp	xmrig
behavioral2/memory/4372-736-0x00007FF601150000-0x00007FF6014A4000-memory.dmp	xmrig
behavioral2/memory/2016-737-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp	xmrig
behavioral2/memory/540-739-0x00007FF691400000-0x00007FF691754000-memory.dmp	xmrig
behavioral2/memory/4580-741-0x00007FF75C620000-0x00007FF75C974000-memory.dmp	xmrig
behavioral2/memory/2208-742-0x00007FF7DCE80000-0x00007FF7DD1D4000-memory.dmp	xmrig
behavioral2/memory/2076-740-0x00007FF6A3310000-0x00007FF6A3664000-memory.dmp	xmrig
behavioral2/memory/3388-738-0x00007FF7215B0000-0x00007FF721904000-memory.dmp	xmrig
behavioral2/memory/4104-734-0x00007FF7E46E0000-0x00007FF7E4A34000-memory.dmp	xmrig
behavioral2/memory/436-719-0x00007FF61E000000-0x00007FF61E354000-memory.dmp	xmrig
behavioral2/memory/532-714-0x00007FF6FC680000-0x00007FF6FC9D4000-memory.dmp	xmrig
behavioral2/memory/4944-710-0x00007FF60E100000-0x00007FF60E454000-memory.dmp	xmrig
behavioral2/memory/2972-703-0x00007FF79EE90000-0x00007FF79F1E4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bc5-169.dat	xmrig
behavioral2/files/0x000a000000023bc3-167.dat	xmrig
behavioral2/files/0x000a000000023bc4-164.dat	xmrig
behavioral2/files/0x000a000000023bc2-162.dat	xmrig
behavioral2/files/0x000a000000023bc1-157.dat	xmrig
behavioral2/files/0x000a000000023bc0-152.dat	xmrig
behavioral2/files/0x000a000000023bbe-142.dat	xmrig
behavioral2/files/0x000a000000023bbd-137.dat	xmrig
behavioral2/files/0x000a000000023bbb-127.dat	xmrig
behavioral2/files/0x000a000000023bba-122.dat	xmrig
behavioral2/files/0x000a000000023bb9-117.dat	xmrig
behavioral2/files/0x000a000000023bb8-112.dat	xmrig
behavioral2/files/0x0031000000023bb7-107.dat	xmrig
behavioral2/files/0x0031000000023bb6-102.dat	xmrig
behavioral2/files/0x0031000000023bb5-97.dat	xmrig
behavioral2/files/0x000a000000023bb4-92.dat	xmrig
behavioral2/files/0x000a000000023bb3-87.dat	xmrig
behavioral2/files/0x000a000000023bb1-74.dat	xmrig
behavioral2/files/0x000a000000023bb0-69.dat	xmrig
behavioral2/files/0x000a000000023baf-67.dat	xmrig
behavioral2/files/0x000a000000023bac-65.dat	xmrig
behavioral2/memory/4212-60-0x00007FF75D300000-0x00007FF75D654000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bae-59.dat	xmrig
behavioral2/memory/1084-46-0x00007FF7FBF80000-0x00007FF7FC2D4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bab-39.dat	xmrig
behavioral2/files/0x000a000000023baa-32.dat	xmrig
behavioral2/memory/1060-2092-0x00007FF72F8D0000-0x00007FF72FC24000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4712	kWdkPpZ.exe
1164	ztTBhsT.exe
1336	KIBBmbr.exe
5016	ngqQthV.exe
540	cbcaEEk.exe
1084	BlrLoWU.exe
2076	phbbOCk.exe
4212	rjPTujj.exe
1396	vwGFbAw.exe
4400	xhGSPYO.exe
2948	brOlMXe.exe
4580	CchsEqG.exe
2208	VbIgwvX.exe
4808	FjncNwI.exe
3736	JXvTmtL.exe
2264	pkdugxr.exe
1464	OgSullD.exe
4984	lFINJuc.exe
2972	RbxNDZf.exe
4944	fCWWTkE.exe
532	clXRWLa.exe
436	mPvmwnr.exe
4908	WltlQkO.exe
3504	fKWulvP.exe
2128	tKWDydT.exe
4104	bKnXLxL.exe
4372	iFtdobR.exe
2016	ZCzrGEL.exe
3388	LXyJhPy.exe
4416	jaVtKGI.exe
4048	jFXhkuV.exe
2968	aaienAL.exe
1140	urbdmdi.exe
976	hBWvqFr.exe
748	NBZKVPl.exe
4328	LsklPuP.exe
4972	kNLlzCd.exe
4740	aqtVaEA.exe
1992	MDJAQwf.exe
4824	olQfARf.exe
3320	wszTFZs.exe
4924	uGkaARk.exe
3716	NalEUpQ.exe
4364	ykoRJde.exe
3792	jUQWSaE.exe
4288	AwnVhEL.exe
216	KyquDxk.exe
3440	CcwKBhU.exe
4620	GKsBWJI.exe
1596	UlShGlS.exe
1504	GNDqrZc.exe
3632	CgMmzKn.exe
928	ddWHdlw.exe
2148	hpAGLOY.exe
3156	xDjODBG.exe
4860	uUbBsfx.exe
1276	LBRYYqC.exe
3548	zvAujYZ.exe
2776	EUGkfsw.exe
1680	WFoPDDu.exe
4596	SszWNMU.exe
4440	EzpbHJA.exe
4312	OyBSTSt.exe
4568	AEtejEu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1060-0-0x00007FF72F8D0000-0x00007FF72FC24000-memory.dmp	upx
behavioral2/files/0x000e000000023b99-14.dat	upx
behavioral2/files/0x000a000000023ba8-19.dat	upx
behavioral2/files/0x000a000000023ba9-23.dat	upx
behavioral2/memory/1164-18-0x00007FF670FB0000-0x00007FF671304000-memory.dmp	upx
behavioral2/memory/4712-13-0x00007FF70DEE0000-0x00007FF70E234000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-9.dat	upx
behavioral2/memory/1336-27-0x00007FF603F30000-0x00007FF604284000-memory.dmp	upx
behavioral2/memory/5016-34-0x00007FF7E2690000-0x00007FF7E29E4000-memory.dmp	upx
behavioral2/files/0x000b000000023ba4-41.dat	upx
behavioral2/files/0x000a000000023bad-57.dat	upx
behavioral2/files/0x000a000000023bb2-76.dat	upx
behavioral2/files/0x000a000000023bbc-124.dat	upx
behavioral2/files/0x000a000000023bbf-139.dat	upx
behavioral2/memory/1396-669-0x00007FF703CB0000-0x00007FF704004000-memory.dmp	upx
behavioral2/memory/4400-670-0x00007FF672BD0000-0x00007FF672F24000-memory.dmp	upx
behavioral2/memory/2948-673-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp	upx
behavioral2/memory/4808-674-0x00007FF731070000-0x00007FF7313C4000-memory.dmp	upx
behavioral2/memory/3736-678-0x00007FF78BFC0000-0x00007FF78C314000-memory.dmp	upx
behavioral2/memory/2264-683-0x00007FF642A90000-0x00007FF642DE4000-memory.dmp	upx
behavioral2/memory/1464-693-0x00007FF6EACD0000-0x00007FF6EB024000-memory.dmp	upx
behavioral2/memory/4984-701-0x00007FF646E50000-0x00007FF6471A4000-memory.dmp	upx
behavioral2/memory/4908-723-0x00007FF776F20000-0x00007FF777274000-memory.dmp	upx
behavioral2/memory/3504-724-0x00007FF7F6DA0000-0x00007FF7F70F4000-memory.dmp	upx
behavioral2/memory/2128-731-0x00007FF781210000-0x00007FF781564000-memory.dmp	upx
behavioral2/memory/4372-736-0x00007FF601150000-0x00007FF6014A4000-memory.dmp	upx
behavioral2/memory/2016-737-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp	upx
behavioral2/memory/540-739-0x00007FF691400000-0x00007FF691754000-memory.dmp	upx
behavioral2/memory/4580-741-0x00007FF75C620000-0x00007FF75C974000-memory.dmp	upx
behavioral2/memory/2208-742-0x00007FF7DCE80000-0x00007FF7DD1D4000-memory.dmp	upx
behavioral2/memory/2076-740-0x00007FF6A3310000-0x00007FF6A3664000-memory.dmp	upx
behavioral2/memory/3388-738-0x00007FF7215B0000-0x00007FF721904000-memory.dmp	upx
behavioral2/memory/4104-734-0x00007FF7E46E0000-0x00007FF7E4A34000-memory.dmp	upx
behavioral2/memory/436-719-0x00007FF61E000000-0x00007FF61E354000-memory.dmp	upx
behavioral2/memory/532-714-0x00007FF6FC680000-0x00007FF6FC9D4000-memory.dmp	upx
behavioral2/memory/4944-710-0x00007FF60E100000-0x00007FF60E454000-memory.dmp	upx
behavioral2/memory/2972-703-0x00007FF79EE90000-0x00007FF79F1E4000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-169.dat	upx
behavioral2/files/0x000a000000023bc3-167.dat	upx
behavioral2/files/0x000a000000023bc4-164.dat	upx
behavioral2/files/0x000a000000023bc2-162.dat	upx
behavioral2/files/0x000a000000023bc1-157.dat	upx
behavioral2/files/0x000a000000023bc0-152.dat	upx
behavioral2/files/0x000a000000023bbe-142.dat	upx
behavioral2/files/0x000a000000023bbd-137.dat	upx
behavioral2/files/0x000a000000023bbb-127.dat	upx
behavioral2/files/0x000a000000023bba-122.dat	upx
behavioral2/files/0x000a000000023bb9-117.dat	upx
behavioral2/files/0x000a000000023bb8-112.dat	upx
behavioral2/files/0x0031000000023bb7-107.dat	upx
behavioral2/files/0x0031000000023bb6-102.dat	upx
behavioral2/files/0x0031000000023bb5-97.dat	upx
behavioral2/files/0x000a000000023bb4-92.dat	upx
behavioral2/files/0x000a000000023bb3-87.dat	upx
behavioral2/files/0x000a000000023bb1-74.dat	upx
behavioral2/files/0x000a000000023bb0-69.dat	upx
behavioral2/files/0x000a000000023baf-67.dat	upx
behavioral2/files/0x000a000000023bac-65.dat	upx
behavioral2/memory/4212-60-0x00007FF75D300000-0x00007FF75D654000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-59.dat	upx
behavioral2/memory/1084-46-0x00007FF7FBF80000-0x00007FF7FC2D4000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-39.dat	upx
behavioral2/files/0x000a000000023baa-32.dat	upx
behavioral2/memory/1060-2092-0x00007FF72F8D0000-0x00007FF72FC24000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TzUuzHN.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\YtAMjSB.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\YvugtnA.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\QaDxOOZ.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\xAAeYTb.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\MWtdUbx.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\uCPwLnj.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\wuyGxFD.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\CCaGCqr.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\ieZUnDW.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\qJAGUxT.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\jgljHHY.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\QspxYoA.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\uLBOnZq.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\lutemFG.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\BWmUgmq.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\zHPSbxX.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\JxPKbTk.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\ciDanIH.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\lnVZCUE.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\JWrVxSd.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\oQvfksW.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\EbDQtmr.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\aqtVaEA.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\YBQCAgr.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\aWDejiN.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\pkPncsb.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\ACbBecg.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\qgLxXvi.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\kWdkPpZ.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\PkMukTg.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\uZVZrhd.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\lJdSHJL.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\ofqpAEs.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\HoRnuoK.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\wIzURmB.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\hrDDpSb.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\AoIohus.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\RguEvJw.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\BTKdXJp.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\LukDfOC.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\FVwqFgn.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\aaienAL.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\jUQWSaE.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\ZsIISTJ.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\xFxKpaW.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\EgHNayx.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\UXzIyPl.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\wVlvIcj.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\jwYwgOm.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\CZrhRqa.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\LXyJhPy.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\AwnVhEL.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\nJzMSYs.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\LxqDPzq.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\PsWZABQ.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\ACUlNsQ.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\VAZcPkT.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\BziZZHO.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\trzScua.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\lEwcwlN.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\kqvKpZa.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\PfmuTLx.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
File created	C:\Windows\System\efXlmfb.exe	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4712	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	88
PID 1060 wrote to memory of 4712	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	88
PID 1060 wrote to memory of 1164	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	89
PID 1060 wrote to memory of 1164	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	89
PID 1060 wrote to memory of 1336	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	90
PID 1060 wrote to memory of 1336	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	90
PID 1060 wrote to memory of 5016	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	91
PID 1060 wrote to memory of 5016	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	91
PID 1060 wrote to memory of 540	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	92
PID 1060 wrote to memory of 540	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	92
PID 1060 wrote to memory of 1084	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	93
PID 1060 wrote to memory of 1084	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	93
PID 1060 wrote to memory of 2076	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	94
PID 1060 wrote to memory of 2076	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	94
PID 1060 wrote to memory of 4212	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	95
PID 1060 wrote to memory of 4212	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	95
PID 1060 wrote to memory of 1396	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	96
PID 1060 wrote to memory of 1396	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	96
PID 1060 wrote to memory of 4400	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	97
PID 1060 wrote to memory of 4400	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	97
PID 1060 wrote to memory of 2948	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	98
PID 1060 wrote to memory of 2948	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	98
PID 1060 wrote to memory of 4580	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	99
PID 1060 wrote to memory of 4580	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	99
PID 1060 wrote to memory of 2208	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	100
PID 1060 wrote to memory of 2208	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	100
PID 1060 wrote to memory of 4808	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	101
PID 1060 wrote to memory of 4808	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	101
PID 1060 wrote to memory of 3736	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	102
PID 1060 wrote to memory of 3736	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	102
PID 1060 wrote to memory of 2264	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	103
PID 1060 wrote to memory of 2264	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	103
PID 1060 wrote to memory of 1464	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	104
PID 1060 wrote to memory of 1464	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	104
PID 1060 wrote to memory of 4984	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	105
PID 1060 wrote to memory of 4984	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	105
PID 1060 wrote to memory of 2972	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	106
PID 1060 wrote to memory of 2972	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	106
PID 1060 wrote to memory of 4944	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	107
PID 1060 wrote to memory of 4944	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	107
PID 1060 wrote to memory of 532	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	108
PID 1060 wrote to memory of 532	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	108
PID 1060 wrote to memory of 436	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	109
PID 1060 wrote to memory of 436	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	109
PID 1060 wrote to memory of 4908	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	110
PID 1060 wrote to memory of 4908	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	110
PID 1060 wrote to memory of 3504	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	111
PID 1060 wrote to memory of 3504	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	111
PID 1060 wrote to memory of 2128	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	112
PID 1060 wrote to memory of 2128	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	112
PID 1060 wrote to memory of 4104	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	113
PID 1060 wrote to memory of 4104	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	113
PID 1060 wrote to memory of 4372	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	114
PID 1060 wrote to memory of 4372	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	114
PID 1060 wrote to memory of 2016	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	115
PID 1060 wrote to memory of 2016	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	115
PID 1060 wrote to memory of 3388	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	116
PID 1060 wrote to memory of 3388	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	116
PID 1060 wrote to memory of 4416	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	117
PID 1060 wrote to memory of 4416	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	117
PID 1060 wrote to memory of 4048	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	118
PID 1060 wrote to memory of 4048	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	118
PID 1060 wrote to memory of 2968	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	119
PID 1060 wrote to memory of 2968	1060	bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe	119

C:\Users\Admin\AppData\Local\Temp\bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\bd5bff9b276095792a6b98de5f4ae9d0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\System\kWdkPpZ.exe
  C:\Windows\System\kWdkPpZ.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\ztTBhsT.exe
  C:\Windows\System\ztTBhsT.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\KIBBmbr.exe
  C:\Windows\System\KIBBmbr.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\ngqQthV.exe
  C:\Windows\System\ngqQthV.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\cbcaEEk.exe
  C:\Windows\System\cbcaEEk.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\BlrLoWU.exe
  C:\Windows\System\BlrLoWU.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\phbbOCk.exe
  C:\Windows\System\phbbOCk.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\rjPTujj.exe
  C:\Windows\System\rjPTujj.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\vwGFbAw.exe
  C:\Windows\System\vwGFbAw.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\xhGSPYO.exe
  C:\Windows\System\xhGSPYO.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\brOlMXe.exe
  C:\Windows\System\brOlMXe.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\CchsEqG.exe
  C:\Windows\System\CchsEqG.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\VbIgwvX.exe
  C:\Windows\System\VbIgwvX.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\FjncNwI.exe
  C:\Windows\System\FjncNwI.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\JXvTmtL.exe
  C:\Windows\System\JXvTmtL.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\pkdugxr.exe
  C:\Windows\System\pkdugxr.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\OgSullD.exe
  C:\Windows\System\OgSullD.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\lFINJuc.exe
  C:\Windows\System\lFINJuc.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\RbxNDZf.exe
  C:\Windows\System\RbxNDZf.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\fCWWTkE.exe
  C:\Windows\System\fCWWTkE.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\clXRWLa.exe
  C:\Windows\System\clXRWLa.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\mPvmwnr.exe
  C:\Windows\System\mPvmwnr.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\WltlQkO.exe
  C:\Windows\System\WltlQkO.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\fKWulvP.exe
  C:\Windows\System\fKWulvP.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\tKWDydT.exe
  C:\Windows\System\tKWDydT.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\bKnXLxL.exe
  C:\Windows\System\bKnXLxL.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\iFtdobR.exe
  C:\Windows\System\iFtdobR.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\ZCzrGEL.exe
  C:\Windows\System\ZCzrGEL.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\LXyJhPy.exe
  C:\Windows\System\LXyJhPy.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\jaVtKGI.exe
  C:\Windows\System\jaVtKGI.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\jFXhkuV.exe
  C:\Windows\System\jFXhkuV.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\aaienAL.exe
  C:\Windows\System\aaienAL.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\urbdmdi.exe
  C:\Windows\System\urbdmdi.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\hBWvqFr.exe
  C:\Windows\System\hBWvqFr.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\NBZKVPl.exe
  C:\Windows\System\NBZKVPl.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\LsklPuP.exe
  C:\Windows\System\LsklPuP.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\kNLlzCd.exe
  C:\Windows\System\kNLlzCd.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\aqtVaEA.exe
  C:\Windows\System\aqtVaEA.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\MDJAQwf.exe
  C:\Windows\System\MDJAQwf.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\olQfARf.exe
  C:\Windows\System\olQfARf.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\wszTFZs.exe
  C:\Windows\System\wszTFZs.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\uGkaARk.exe
  C:\Windows\System\uGkaARk.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\NalEUpQ.exe
  C:\Windows\System\NalEUpQ.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\ykoRJde.exe
  C:\Windows\System\ykoRJde.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\jUQWSaE.exe
  C:\Windows\System\jUQWSaE.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\AwnVhEL.exe
  C:\Windows\System\AwnVhEL.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\KyquDxk.exe
  C:\Windows\System\KyquDxk.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\CcwKBhU.exe
  C:\Windows\System\CcwKBhU.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\GKsBWJI.exe
  C:\Windows\System\GKsBWJI.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\UlShGlS.exe
  C:\Windows\System\UlShGlS.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\GNDqrZc.exe
  C:\Windows\System\GNDqrZc.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\CgMmzKn.exe
  C:\Windows\System\CgMmzKn.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\ddWHdlw.exe
  C:\Windows\System\ddWHdlw.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\hpAGLOY.exe
  C:\Windows\System\hpAGLOY.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\xDjODBG.exe
  C:\Windows\System\xDjODBG.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\uUbBsfx.exe
  C:\Windows\System\uUbBsfx.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\LBRYYqC.exe
  C:\Windows\System\LBRYYqC.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\zvAujYZ.exe
  C:\Windows\System\zvAujYZ.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\EUGkfsw.exe
  C:\Windows\System\EUGkfsw.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\WFoPDDu.exe
  C:\Windows\System\WFoPDDu.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\SszWNMU.exe
  C:\Windows\System\SszWNMU.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\EzpbHJA.exe
  C:\Windows\System\EzpbHJA.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\OyBSTSt.exe
  C:\Windows\System\OyBSTSt.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\AEtejEu.exe
  C:\Windows\System\AEtejEu.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\RcBYGSJ.exe
  C:\Windows\System\RcBYGSJ.exe
  2⤵
  PID:1760
- C:\Windows\System\ziqPdcw.exe
  C:\Windows\System\ziqPdcw.exe
  2⤵
  PID:5108
- C:\Windows\System\PLkVaBr.exe
  C:\Windows\System\PLkVaBr.exe
  2⤵
  PID:980
- C:\Windows\System\NgJLswk.exe
  C:\Windows\System\NgJLswk.exe
  2⤵
  PID:4592
- C:\Windows\System\TXDtvYW.exe
  C:\Windows\System\TXDtvYW.exe
  2⤵
  PID:1028
- C:\Windows\System\ciDanIH.exe
  C:\Windows\System\ciDanIH.exe
  2⤵
  PID:4952
- C:\Windows\System\MEKJwtL.exe
  C:\Windows\System\MEKJwtL.exe
  2⤵
  PID:2724
- C:\Windows\System\WNonWyS.exe
  C:\Windows\System\WNonWyS.exe
  2⤵
  PID:2244
- C:\Windows\System\nKBEkbj.exe
  C:\Windows\System\nKBEkbj.exe
  2⤵
  PID:3744
- C:\Windows\System\YBQCAgr.exe
  C:\Windows\System\YBQCAgr.exe
  2⤵
  PID:5148
- C:\Windows\System\GBhhhfF.exe
  C:\Windows\System\GBhhhfF.exe
  2⤵
  PID:5176
- C:\Windows\System\TwOKAsX.exe
  C:\Windows\System\TwOKAsX.exe
  2⤵
  PID:5204
- C:\Windows\System\lyqWjyh.exe
  C:\Windows\System\lyqWjyh.exe
  2⤵
  PID:5232
- C:\Windows\System\KXAUlux.exe
  C:\Windows\System\KXAUlux.exe
  2⤵
  PID:5260
- C:\Windows\System\SYTYXsI.exe
  C:\Windows\System\SYTYXsI.exe
  2⤵
  PID:5288
- C:\Windows\System\IbXFEzP.exe
  C:\Windows\System\IbXFEzP.exe
  2⤵
  PID:5316
- C:\Windows\System\aTvktYx.exe
  C:\Windows\System\aTvktYx.exe
  2⤵
  PID:5344
- C:\Windows\System\yoJlzXq.exe
  C:\Windows\System\yoJlzXq.exe
  2⤵
  PID:5368
- C:\Windows\System\BWBuwwn.exe
  C:\Windows\System\BWBuwwn.exe
  2⤵
  PID:5400
- C:\Windows\System\phkKkuf.exe
  C:\Windows\System\phkKkuf.exe
  2⤵
  PID:5428
- C:\Windows\System\vqhJwgs.exe
  C:\Windows\System\vqhJwgs.exe
  2⤵
  PID:5452
- C:\Windows\System\reTHMvJ.exe
  C:\Windows\System\reTHMvJ.exe
  2⤵
  PID:5484
- C:\Windows\System\tiOiHKp.exe
  C:\Windows\System\tiOiHKp.exe
  2⤵
  PID:5508
- C:\Windows\System\wuyGxFD.exe
  C:\Windows\System\wuyGxFD.exe
  2⤵
  PID:5536
- C:\Windows\System\pGjZkDZ.exe
  C:\Windows\System\pGjZkDZ.exe
  2⤵
  PID:5564
- C:\Windows\System\TYxTIjS.exe
  C:\Windows\System\TYxTIjS.exe
  2⤵
  PID:5596
- C:\Windows\System\LJPZlXg.exe
  C:\Windows\System\LJPZlXg.exe
  2⤵
  PID:5620
- C:\Windows\System\pBxRYph.exe
  C:\Windows\System\pBxRYph.exe
  2⤵
  PID:5648
- C:\Windows\System\LXbuQFI.exe
  C:\Windows\System\LXbuQFI.exe
  2⤵
  PID:5676
- C:\Windows\System\jIPlwjx.exe
  C:\Windows\System\jIPlwjx.exe
  2⤵
  PID:5704
- C:\Windows\System\GzjAeao.exe
  C:\Windows\System\GzjAeao.exe
  2⤵
  PID:5732
- C:\Windows\System\JVWjJTM.exe
  C:\Windows\System\JVWjJTM.exe
  2⤵
  PID:5764
- C:\Windows\System\tyftFsl.exe
  C:\Windows\System\tyftFsl.exe
  2⤵
  PID:5792
- C:\Windows\System\ZsIISTJ.exe
  C:\Windows\System\ZsIISTJ.exe
  2⤵
  PID:5820
- C:\Windows\System\xaBedBi.exe
  C:\Windows\System\xaBedBi.exe
  2⤵
  PID:5848
- C:\Windows\System\LEaTYCu.exe
  C:\Windows\System\LEaTYCu.exe
  2⤵
  PID:5872
- C:\Windows\System\xFxKpaW.exe
  C:\Windows\System\xFxKpaW.exe
  2⤵
  PID:5900
- C:\Windows\System\vvInITj.exe
  C:\Windows\System\vvInITj.exe
  2⤵
  PID:5928
- C:\Windows\System\RdlieyU.exe
  C:\Windows\System\RdlieyU.exe
  2⤵
  PID:5956
- C:\Windows\System\LApsBeT.exe
  C:\Windows\System\LApsBeT.exe
  2⤵
  PID:5984
- C:\Windows\System\cNzPEgF.exe
  C:\Windows\System\cNzPEgF.exe
  2⤵
  PID:6012
- C:\Windows\System\qNgMjdI.exe
  C:\Windows\System\qNgMjdI.exe
  2⤵
  PID:6040
- C:\Windows\System\uLBOnZq.exe
  C:\Windows\System\uLBOnZq.exe
  2⤵
  PID:6068
- C:\Windows\System\rYyAOTi.exe
  C:\Windows\System\rYyAOTi.exe
  2⤵
  PID:6100
- C:\Windows\System\HoRnuoK.exe
  C:\Windows\System\HoRnuoK.exe
  2⤵
  PID:6128
- C:\Windows\System\lutemFG.exe
  C:\Windows\System\lutemFG.exe
  2⤵
  PID:396
- C:\Windows\System\ZPIWwRk.exe
  C:\Windows\System\ZPIWwRk.exe
  2⤵
  PID:2216
- C:\Windows\System\XPNbrIE.exe
  C:\Windows\System\XPNbrIE.exe
  2⤵
  PID:696
- C:\Windows\System\oigXuqi.exe
  C:\Windows\System\oigXuqi.exe
  2⤵
  PID:3956
- C:\Windows\System\ptgplJZ.exe
  C:\Windows\System\ptgplJZ.exe
  2⤵
  PID:4628
- C:\Windows\System\VVDvtmw.exe
  C:\Windows\System\VVDvtmw.exe
  2⤵
  PID:8
- C:\Windows\System\TUtBIhT.exe
  C:\Windows\System\TUtBIhT.exe
  2⤵
  PID:5156
- C:\Windows\System\qZWGWCi.exe
  C:\Windows\System\qZWGWCi.exe
  2⤵
  PID:5220
- C:\Windows\System\oAjLySK.exe
  C:\Windows\System\oAjLySK.exe
  2⤵
  PID:5280
- C:\Windows\System\ErVITKD.exe
  C:\Windows\System\ErVITKD.exe
  2⤵
  PID:5352
- C:\Windows\System\GtXxMHa.exe
  C:\Windows\System\GtXxMHa.exe
  2⤵
  PID:5416
- C:\Windows\System\XbPfUUa.exe
  C:\Windows\System\XbPfUUa.exe
  2⤵
  PID:5472
- C:\Windows\System\ZRocijT.exe
  C:\Windows\System\ZRocijT.exe
  2⤵
  PID:5548
- C:\Windows\System\KELZngN.exe
  C:\Windows\System\KELZngN.exe
  2⤵
  PID:5612
- C:\Windows\System\iyHpaXm.exe
  C:\Windows\System\iyHpaXm.exe
  2⤵
  PID:5668
- C:\Windows\System\GFvOwFg.exe
  C:\Windows\System\GFvOwFg.exe
  2⤵
  PID:5744
- C:\Windows\System\ZbAnmJD.exe
  C:\Windows\System\ZbAnmJD.exe
  2⤵
  PID:5808
- C:\Windows\System\wMAUcjd.exe
  C:\Windows\System\wMAUcjd.exe
  2⤵
  PID:5864
- C:\Windows\System\VPIkgfG.exe
  C:\Windows\System\VPIkgfG.exe
  2⤵
  PID:5940
- C:\Windows\System\PkMukTg.exe
  C:\Windows\System\PkMukTg.exe
  2⤵
  PID:5996
- C:\Windows\System\KudMVMS.exe
  C:\Windows\System\KudMVMS.exe
  2⤵
  PID:6056
- C:\Windows\System\XRIpbZF.exe
  C:\Windows\System\XRIpbZF.exe
  2⤵
  PID:6120
- C:\Windows\System\khzUlBf.exe
  C:\Windows\System\khzUlBf.exe
  2⤵
  PID:1728
- C:\Windows\System\GqPvsMe.exe
  C:\Windows\System\GqPvsMe.exe
  2⤵
  PID:2812
- C:\Windows\System\ooQOBYW.exe
  C:\Windows\System\ooQOBYW.exe
  2⤵
  PID:5136
- C:\Windows\System\ZwPjgbW.exe
  C:\Windows\System\ZwPjgbW.exe
  2⤵
  PID:5308
- C:\Windows\System\BWmUgmq.exe
  C:\Windows\System\BWmUgmq.exe
  2⤵
  PID:5448
- C:\Windows\System\AZaApJm.exe
  C:\Windows\System\AZaApJm.exe
  2⤵
  PID:5584
- C:\Windows\System\VOKhqIa.exe
  C:\Windows\System\VOKhqIa.exe
  2⤵
  PID:5772
- C:\Windows\System\QpLgPkv.exe
  C:\Windows\System\QpLgPkv.exe
  2⤵
  PID:5892
- C:\Windows\System\gGVazFp.exe
  C:\Windows\System\gGVazFp.exe
  2⤵
  PID:6164
- C:\Windows\System\oPfHIDE.exe
  C:\Windows\System\oPfHIDE.exe
  2⤵
  PID:6192
- C:\Windows\System\jTquInK.exe
  C:\Windows\System\jTquInK.exe
  2⤵
  PID:6220
- C:\Windows\System\khInfVI.exe
  C:\Windows\System\khInfVI.exe
  2⤵
  PID:6248
- C:\Windows\System\vANLBCe.exe
  C:\Windows\System\vANLBCe.exe
  2⤵
  PID:6276
- C:\Windows\System\WUnVMic.exe
  C:\Windows\System\WUnVMic.exe
  2⤵
  PID:6304
- C:\Windows\System\iCvpvWa.exe
  C:\Windows\System\iCvpvWa.exe
  2⤵
  PID:6332
- C:\Windows\System\IHCjCPw.exe
  C:\Windows\System\IHCjCPw.exe
  2⤵
  PID:6360
- C:\Windows\System\odorQTH.exe
  C:\Windows\System\odorQTH.exe
  2⤵
  PID:6388
- C:\Windows\System\uhPOjpt.exe
  C:\Windows\System\uhPOjpt.exe
  2⤵
  PID:6416
- C:\Windows\System\xpdGuwj.exe
  C:\Windows\System\xpdGuwj.exe
  2⤵
  PID:6444
- C:\Windows\System\pItgdbo.exe
  C:\Windows\System\pItgdbo.exe
  2⤵
  PID:6472
- C:\Windows\System\EgHNayx.exe
  C:\Windows\System\EgHNayx.exe
  2⤵
  PID:6500
- C:\Windows\System\lnVZCUE.exe
  C:\Windows\System\lnVZCUE.exe
  2⤵
  PID:6528
- C:\Windows\System\aFnCqTM.exe
  C:\Windows\System\aFnCqTM.exe
  2⤵
  PID:6556
- C:\Windows\System\Spxcvbo.exe
  C:\Windows\System\Spxcvbo.exe
  2⤵
  PID:6584
- C:\Windows\System\pEOkNQS.exe
  C:\Windows\System\pEOkNQS.exe
  2⤵
  PID:6612
- C:\Windows\System\fqsqITp.exe
  C:\Windows\System\fqsqITp.exe
  2⤵
  PID:6644
- C:\Windows\System\EOrGMfu.exe
  C:\Windows\System\EOrGMfu.exe
  2⤵
  PID:6668
- C:\Windows\System\yxFizxv.exe
  C:\Windows\System\yxFizxv.exe
  2⤵
  PID:6696
- C:\Windows\System\zIHjMQf.exe
  C:\Windows\System\zIHjMQf.exe
  2⤵
  PID:6724
- C:\Windows\System\qhtCLid.exe
  C:\Windows\System\qhtCLid.exe
  2⤵
  PID:6752
- C:\Windows\System\byTlzaA.exe
  C:\Windows\System\byTlzaA.exe
  2⤵
  PID:6780
- C:\Windows\System\VhdOPzt.exe
  C:\Windows\System\VhdOPzt.exe
  2⤵
  PID:6808
- C:\Windows\System\RJzmBJJ.exe
  C:\Windows\System\RJzmBJJ.exe
  2⤵
  PID:6836
- C:\Windows\System\trzScua.exe
  C:\Windows\System\trzScua.exe
  2⤵
  PID:6864
- C:\Windows\System\yaAmdNK.exe
  C:\Windows\System\yaAmdNK.exe
  2⤵
  PID:6892
- C:\Windows\System\OzklogZ.exe
  C:\Windows\System\OzklogZ.exe
  2⤵
  PID:6920
- C:\Windows\System\uiLkwME.exe
  C:\Windows\System\uiLkwME.exe
  2⤵
  PID:6948
- C:\Windows\System\OeZHKxS.exe
  C:\Windows\System\OeZHKxS.exe
  2⤵
  PID:6976
- C:\Windows\System\lmcxYpW.exe
  C:\Windows\System\lmcxYpW.exe
  2⤵
  PID:7004
- C:\Windows\System\NXaXQmD.exe
  C:\Windows\System\NXaXQmD.exe
  2⤵
  PID:7032
- C:\Windows\System\tvyZXKV.exe
  C:\Windows\System\tvyZXKV.exe
  2⤵
  PID:7060
- C:\Windows\System\yOnIEbW.exe
  C:\Windows\System\yOnIEbW.exe
  2⤵
  PID:7088
- C:\Windows\System\IBVoepp.exe
  C:\Windows\System\IBVoepp.exe
  2⤵
  PID:7112
- C:\Windows\System\lEZHIUk.exe
  C:\Windows\System\lEZHIUk.exe
  2⤵
  PID:7140
- C:\Windows\System\zQdvWHS.exe
  C:\Windows\System\zQdvWHS.exe
  2⤵
  PID:5976
- C:\Windows\System\oPPSYJh.exe
  C:\Windows\System\oPPSYJh.exe
  2⤵
  PID:6108
- C:\Windows\System\YlOldmK.exe
  C:\Windows\System\YlOldmK.exe
  2⤵
  PID:64
- C:\Windows\System\IAEPwIC.exe
  C:\Windows\System\IAEPwIC.exe
  2⤵
  PID:5384
- C:\Windows\System\pUEUbsL.exe
  C:\Windows\System\pUEUbsL.exe
  2⤵
  PID:5716
- C:\Windows\System\GUyQjfC.exe
  C:\Windows\System\GUyQjfC.exe
  2⤵
  PID:6176
- C:\Windows\System\lEwcwlN.exe
  C:\Windows\System\lEwcwlN.exe
  2⤵
  PID:6236
- C:\Windows\System\tvdnDZs.exe
  C:\Windows\System\tvdnDZs.exe
  2⤵
  PID:6296
- C:\Windows\System\tUAYOnh.exe
  C:\Windows\System\tUAYOnh.exe
  2⤵
  PID:6372
- C:\Windows\System\IeejAnr.exe
  C:\Windows\System\IeejAnr.exe
  2⤵
  PID:2224
- C:\Windows\System\KMoVfvA.exe
  C:\Windows\System\KMoVfvA.exe
  2⤵
  PID:6464
- C:\Windows\System\PfDfrol.exe
  C:\Windows\System\PfDfrol.exe
  2⤵
  PID:6520
- C:\Windows\System\foxmoyW.exe
  C:\Windows\System\foxmoyW.exe
  2⤵
  PID:992
- C:\Windows\System\CBgipZp.exe
  C:\Windows\System\CBgipZp.exe
  2⤵
  PID:6652
- C:\Windows\System\aIxppAq.exe
  C:\Windows\System\aIxppAq.exe
  2⤵
  PID:6688
- C:\Windows\System\WShEdsg.exe
  C:\Windows\System\WShEdsg.exe
  2⤵
  PID:6764
- C:\Windows\System\NAuaxMk.exe
  C:\Windows\System\NAuaxMk.exe
  2⤵
  PID:6824
- C:\Windows\System\bnNCdSE.exe
  C:\Windows\System\bnNCdSE.exe
  2⤵
  PID:6880
- C:\Windows\System\MZggPFz.exe
  C:\Windows\System\MZggPFz.exe
  2⤵
  PID:4700
- C:\Windows\System\jNvJNlV.exe
  C:\Windows\System\jNvJNlV.exe
  2⤵
  PID:6992
- C:\Windows\System\kqvKpZa.exe
  C:\Windows\System\kqvKpZa.exe
  2⤵
  PID:7048
- C:\Windows\System\Dooyuld.exe
  C:\Windows\System\Dooyuld.exe
  2⤵
  PID:7104
- C:\Windows\System\trwcunZ.exe
  C:\Windows\System\trwcunZ.exe
  2⤵
  PID:7164
- C:\Windows\System\vZqEXYN.exe
  C:\Windows\System\vZqEXYN.exe
  2⤵
  PID:5196
- C:\Windows\System\YtAMjSB.exe
  C:\Windows\System\YtAMjSB.exe
  2⤵
  PID:2512
- C:\Windows\System\HIxKASV.exe
  C:\Windows\System\HIxKASV.exe
  2⤵
  PID:3272
- C:\Windows\System\VLMAhdv.exe
  C:\Windows\System\VLMAhdv.exe
  2⤵
  PID:6436
- C:\Windows\System\tppzWdb.exe
  C:\Windows\System\tppzWdb.exe
  2⤵
  PID:6512
- C:\Windows\System\eUqklwb.exe
  C:\Windows\System\eUqklwb.exe
  2⤵
  PID:6604
- C:\Windows\System\HalwCAl.exe
  C:\Windows\System\HalwCAl.exe
  2⤵
  PID:6680
- C:\Windows\System\GQPpymX.exe
  C:\Windows\System\GQPpymX.exe
  2⤵
  PID:6792
- C:\Windows\System\qSvjLlR.exe
  C:\Windows\System\qSvjLlR.exe
  2⤵
  PID:3132
- C:\Windows\System\NRMdraX.exe
  C:\Windows\System\NRMdraX.exe
  2⤵
  PID:6912
- C:\Windows\System\cVADGLy.exe
  C:\Windows\System\cVADGLy.exe
  2⤵
  PID:7024
- C:\Windows\System\hiZNoRE.exe
  C:\Windows\System\hiZNoRE.exe
  2⤵
  PID:2024
- C:\Windows\System\ubmDBwb.exe
  C:\Windows\System\ubmDBwb.exe
  2⤵
  PID:4272
- C:\Windows\System\xdaqUjX.exe
  C:\Windows\System\xdaqUjX.exe
  2⤵
  PID:4420
- C:\Windows\System\LwpOLrg.exe
  C:\Windows\System\LwpOLrg.exe
  2⤵
  PID:5660
- C:\Windows\System\cklSMFK.exe
  C:\Windows\System\cklSMFK.exe
  2⤵
  PID:6348
- C:\Windows\System\HDSUOOL.exe
  C:\Windows\System\HDSUOOL.exe
  2⤵
  PID:4320
- C:\Windows\System\uRYkBly.exe
  C:\Windows\System\uRYkBly.exe
  2⤵
  PID:6740
- C:\Windows\System\DNhCzjX.exe
  C:\Windows\System\DNhCzjX.exe
  2⤵
  PID:776
- C:\Windows\System\MIiRRfQ.exe
  C:\Windows\System\MIiRRfQ.exe
  2⤵
  PID:6288
- C:\Windows\System\drwErnz.exe
  C:\Windows\System\drwErnz.exe
  2⤵
  PID:3668
- C:\Windows\System\LhZCZqE.exe
  C:\Windows\System\LhZCZqE.exe
  2⤵
  PID:1416
- C:\Windows\System\WPRqhPc.exe
  C:\Windows\System\WPRqhPc.exe
  2⤵
  PID:2524
- C:\Windows\System\CRyIgVD.exe
  C:\Windows\System\CRyIgVD.exe
  2⤵
  PID:6628
- C:\Windows\System\YUlILXT.exe
  C:\Windows\System\YUlILXT.exe
  2⤵
  PID:6380
- C:\Windows\System\RNHCIMQ.exe
  C:\Windows\System\RNHCIMQ.exe
  2⤵
  PID:6572
- C:\Windows\System\RqFcTet.exe
  C:\Windows\System\RqFcTet.exe
  2⤵
  PID:7184
- C:\Windows\System\pCyGBtq.exe
  C:\Windows\System\pCyGBtq.exe
  2⤵
  PID:7208
- C:\Windows\System\sWUdhJy.exe
  C:\Windows\System\sWUdhJy.exe
  2⤵
  PID:7228
- C:\Windows\System\YvugtnA.exe
  C:\Windows\System\YvugtnA.exe
  2⤵
  PID:7256
- C:\Windows\System\gARGlzz.exe
  C:\Windows\System\gARGlzz.exe
  2⤵
  PID:7304
- C:\Windows\System\htHfqtd.exe
  C:\Windows\System\htHfqtd.exe
  2⤵
  PID:7328
- C:\Windows\System\lVUSVrD.exe
  C:\Windows\System\lVUSVrD.exe
  2⤵
  PID:7364
- C:\Windows\System\bHlAXjg.exe
  C:\Windows\System\bHlAXjg.exe
  2⤵
  PID:7392
- C:\Windows\System\BzZmrtX.exe
  C:\Windows\System\BzZmrtX.exe
  2⤵
  PID:7428
- C:\Windows\System\qBYuNOC.exe
  C:\Windows\System\qBYuNOC.exe
  2⤵
  PID:7452
- C:\Windows\System\oamIhgy.exe
  C:\Windows\System\oamIhgy.exe
  2⤵
  PID:7484
- C:\Windows\System\EgIICRx.exe
  C:\Windows\System\EgIICRx.exe
  2⤵
  PID:7508
- C:\Windows\System\IrVpyGR.exe
  C:\Windows\System\IrVpyGR.exe
  2⤵
  PID:7536
- C:\Windows\System\LASweEx.exe
  C:\Windows\System\LASweEx.exe
  2⤵
  PID:7604
- C:\Windows\System\zqXnjFF.exe
  C:\Windows\System\zqXnjFF.exe
  2⤵
  PID:7620
- C:\Windows\System\PfmuTLx.exe
  C:\Windows\System\PfmuTLx.exe
  2⤵
  PID:7640
- C:\Windows\System\kcjjerk.exe
  C:\Windows\System\kcjjerk.exe
  2⤵
  PID:7672
- C:\Windows\System\PuUhenh.exe
  C:\Windows\System\PuUhenh.exe
  2⤵
  PID:7700
- C:\Windows\System\SxxvMnH.exe
  C:\Windows\System\SxxvMnH.exe
  2⤵
  PID:7716
- C:\Windows\System\EdpKCdr.exe
  C:\Windows\System\EdpKCdr.exe
  2⤵
  PID:7744
- C:\Windows\System\hpDGSxs.exe
  C:\Windows\System\hpDGSxs.exe
  2⤵
  PID:7764
- C:\Windows\System\vQcwibT.exe
  C:\Windows\System\vQcwibT.exe
  2⤵
  PID:7796
- C:\Windows\System\XIXTyMR.exe
  C:\Windows\System\XIXTyMR.exe
  2⤵
  PID:7828
- C:\Windows\System\YCVrNgi.exe
  C:\Windows\System\YCVrNgi.exe
  2⤵
  PID:7884
- C:\Windows\System\iOsRGGA.exe
  C:\Windows\System\iOsRGGA.exe
  2⤵
  PID:7912
- C:\Windows\System\BXElhbD.exe
  C:\Windows\System\BXElhbD.exe
  2⤵
  PID:7948
- C:\Windows\System\gIwHJFK.exe
  C:\Windows\System\gIwHJFK.exe
  2⤵
  PID:7964
- C:\Windows\System\ZPZIKLK.exe
  C:\Windows\System\ZPZIKLK.exe
  2⤵
  PID:7984
- C:\Windows\System\prpeqXl.exe
  C:\Windows\System\prpeqXl.exe
  2⤵
  PID:8020
- C:\Windows\System\BZQkWlS.exe
  C:\Windows\System\BZQkWlS.exe
  2⤵
  PID:8040
- C:\Windows\System\iWgypjc.exe
  C:\Windows\System\iWgypjc.exe
  2⤵
  PID:8088
- C:\Windows\System\QpNswRo.exe
  C:\Windows\System\QpNswRo.exe
  2⤵
  PID:8108
- C:\Windows\System\wIoExPr.exe
  C:\Windows\System\wIoExPr.exe
  2⤵
  PID:8148
- C:\Windows\System\qDrJFqm.exe
  C:\Windows\System\qDrJFqm.exe
  2⤵
  PID:8176
- C:\Windows\System\lwrAIez.exe
  C:\Windows\System\lwrAIez.exe
  2⤵
  PID:7200
- C:\Windows\System\doUWxQd.exe
  C:\Windows\System\doUWxQd.exe
  2⤵
  PID:7192
- C:\Windows\System\wQUPpGl.exe
  C:\Windows\System\wQUPpGl.exe
  2⤵
  PID:7276
- C:\Windows\System\jKyQqoo.exe
  C:\Windows\System\jKyQqoo.exe
  2⤵
  PID:7388
- C:\Windows\System\yWAqGDN.exe
  C:\Windows\System\yWAqGDN.exe
  2⤵
  PID:7436
- C:\Windows\System\hHmsETe.exe
  C:\Windows\System\hHmsETe.exe
  2⤵
  PID:7476
- C:\Windows\System\GIKBKVo.exe
  C:\Windows\System\GIKBKVo.exe
  2⤵
  PID:7528
- C:\Windows\System\BOneFGG.exe
  C:\Windows\System\BOneFGG.exe
  2⤵
  PID:7568
- C:\Windows\System\hHQyybF.exe
  C:\Windows\System\hHQyybF.exe
  2⤵
  PID:7708
- C:\Windows\System\qjpEmKN.exe
  C:\Windows\System\qjpEmKN.exe
  2⤵
  PID:7772
- C:\Windows\System\wIzURmB.exe
  C:\Windows\System\wIzURmB.exe
  2⤵
  PID:7848
- C:\Windows\System\KdCuHQN.exe
  C:\Windows\System\KdCuHQN.exe
  2⤵
  PID:7908
- C:\Windows\System\PZZttwh.exe
  C:\Windows\System\PZZttwh.exe
  2⤵
  PID:7992
- C:\Windows\System\CAfWqmS.exe
  C:\Windows\System\CAfWqmS.exe
  2⤵
  PID:8064
- C:\Windows\System\HKoPzCt.exe
  C:\Windows\System\HKoPzCt.exe
  2⤵
  PID:8144
- C:\Windows\System\zFvQWFd.exe
  C:\Windows\System\zFvQWFd.exe
  2⤵
  PID:968
- C:\Windows\System\XNvfuxx.exe
  C:\Windows\System\XNvfuxx.exe
  2⤵
  PID:7292
- C:\Windows\System\CCaGCqr.exe
  C:\Windows\System\CCaGCqr.exe
  2⤵
  PID:7404
- C:\Windows\System\gUTyAKd.exe
  C:\Windows\System\gUTyAKd.exe
  2⤵
  PID:7504
- C:\Windows\System\dBgltkM.exe
  C:\Windows\System\dBgltkM.exe
  2⤵
  PID:7780
- C:\Windows\System\NKxlOHD.exe
  C:\Windows\System\NKxlOHD.exe
  2⤵
  PID:7940
- C:\Windows\System\kBZrskg.exe
  C:\Windows\System\kBZrskg.exe
  2⤵
  PID:8096
- C:\Windows\System\KuYUkpO.exe
  C:\Windows\System\KuYUkpO.exe
  2⤵
  PID:7784
- C:\Windows\System\FVsjCjp.exe
  C:\Windows\System\FVsjCjp.exe
  2⤵
  PID:8128
- C:\Windows\System\bLvWPBv.exe
  C:\Windows\System\bLvWPBv.exe
  2⤵
  PID:7972
- C:\Windows\System\iaRIIee.exe
  C:\Windows\System\iaRIIee.exe
  2⤵
  PID:8216
- C:\Windows\System\VLKBfKF.exe
  C:\Windows\System\VLKBfKF.exe
  2⤵
  PID:8252
- C:\Windows\System\pViMblF.exe
  C:\Windows\System\pViMblF.exe
  2⤵
  PID:8272
- C:\Windows\System\efXlmfb.exe
  C:\Windows\System\efXlmfb.exe
  2⤵
  PID:8304
- C:\Windows\System\agcWGSc.exe
  C:\Windows\System\agcWGSc.exe
  2⤵
  PID:8332
- C:\Windows\System\YGjMDlU.exe
  C:\Windows\System\YGjMDlU.exe
  2⤵
  PID:8360
- C:\Windows\System\iZCSAZq.exe
  C:\Windows\System\iZCSAZq.exe
  2⤵
  PID:8388
- C:\Windows\System\CWgcdIR.exe
  C:\Windows\System\CWgcdIR.exe
  2⤵
  PID:8416
- C:\Windows\System\fdDWEzr.exe
  C:\Windows\System\fdDWEzr.exe
  2⤵
  PID:8444
- C:\Windows\System\zHPSbxX.exe
  C:\Windows\System\zHPSbxX.exe
  2⤵
  PID:8476
- C:\Windows\System\WEwqlQt.exe
  C:\Windows\System\WEwqlQt.exe
  2⤵
  PID:8500
- C:\Windows\System\ItzlJeo.exe
  C:\Windows\System\ItzlJeo.exe
  2⤵
  PID:8516
- C:\Windows\System\EWzogaa.exe
  C:\Windows\System\EWzogaa.exe
  2⤵
  PID:8548
- C:\Windows\System\JxPKbTk.exe
  C:\Windows\System\JxPKbTk.exe
  2⤵
  PID:8596
- C:\Windows\System\ggRmUEQ.exe
  C:\Windows\System\ggRmUEQ.exe
  2⤵
  PID:8624
- C:\Windows\System\ljzBcLg.exe
  C:\Windows\System\ljzBcLg.exe
  2⤵
  PID:8652
- C:\Windows\System\gVJMRCV.exe
  C:\Windows\System\gVJMRCV.exe
  2⤵
  PID:8668
- C:\Windows\System\JWrVxSd.exe
  C:\Windows\System\JWrVxSd.exe
  2⤵
  PID:8696
- C:\Windows\System\kMaaJRQ.exe
  C:\Windows\System\kMaaJRQ.exe
  2⤵
  PID:8720
- C:\Windows\System\pREPZdy.exe
  C:\Windows\System\pREPZdy.exe
  2⤵
  PID:8752
- C:\Windows\System\tWCScDb.exe
  C:\Windows\System\tWCScDb.exe
  2⤵
  PID:8768
- C:\Windows\System\mqOeWTK.exe
  C:\Windows\System\mqOeWTK.exe
  2⤵
  PID:8808
- C:\Windows\System\kzSUNRf.exe
  C:\Windows\System\kzSUNRf.exe
  2⤵
  PID:8844
- C:\Windows\System\mlafVqK.exe
  C:\Windows\System\mlafVqK.exe
  2⤵
  PID:8876
- C:\Windows\System\YOZNoBk.exe
  C:\Windows\System\YOZNoBk.exe
  2⤵
  PID:8904
- C:\Windows\System\nJzMSYs.exe
  C:\Windows\System\nJzMSYs.exe
  2⤵
  PID:8932
- C:\Windows\System\eEFxivd.exe
  C:\Windows\System\eEFxivd.exe
  2⤵
  PID:8960
- C:\Windows\System\GRDhkZH.exe
  C:\Windows\System\GRDhkZH.exe
  2⤵
  PID:8976
- C:\Windows\System\pDKtxhi.exe
  C:\Windows\System\pDKtxhi.exe
  2⤵
  PID:9004
- C:\Windows\System\GOPcwfh.exe
  C:\Windows\System\GOPcwfh.exe
  2⤵
  PID:9036
- C:\Windows\System\QspxYoA.exe
  C:\Windows\System\QspxYoA.exe
  2⤵
  PID:9064
- C:\Windows\System\fUggYzy.exe
  C:\Windows\System\fUggYzy.exe
  2⤵
  PID:9088
- C:\Windows\System\VOjzObC.exe
  C:\Windows\System\VOjzObC.exe
  2⤵
  PID:9116
- C:\Windows\System\awSZxts.exe
  C:\Windows\System\awSZxts.exe
  2⤵
  PID:9136
- C:\Windows\System\BTKdXJp.exe
  C:\Windows\System\BTKdXJp.exe
  2⤵
  PID:9160
- C:\Windows\System\fxdlMEI.exe
  C:\Windows\System\fxdlMEI.exe
  2⤵
  PID:9196
- C:\Windows\System\eEMNIbL.exe
  C:\Windows\System\eEMNIbL.exe
  2⤵
  PID:8240
- C:\Windows\System\NlBbNUj.exe
  C:\Windows\System\NlBbNUj.exe
  2⤵
  PID:8268
- C:\Windows\System\GDihBxb.exe
  C:\Windows\System\GDihBxb.exe
  2⤵
  PID:8372
- C:\Windows\System\TyDqYIv.exe
  C:\Windows\System\TyDqYIv.exe
  2⤵
  PID:8436
- C:\Windows\System\vOkEIaA.exe
  C:\Windows\System\vOkEIaA.exe
  2⤵
  PID:8492
- C:\Windows\System\ACUlNsQ.exe
  C:\Windows\System\ACUlNsQ.exe
  2⤵
  PID:8532
- C:\Windows\System\qKSGVoz.exe
  C:\Windows\System\qKSGVoz.exe
  2⤵
  PID:8592
- C:\Windows\System\HTglXYw.exe
  C:\Windows\System\HTglXYw.exe
  2⤵
  PID:8660
- C:\Windows\System\VkwjtwF.exe
  C:\Windows\System\VkwjtwF.exe
  2⤵
  PID:8716
- C:\Windows\System\PYhWQbj.exe
  C:\Windows\System\PYhWQbj.exe
  2⤵
  PID:8796
- C:\Windows\System\nnZoSAU.exe
  C:\Windows\System\nnZoSAU.exe
  2⤵
  PID:8872
- C:\Windows\System\kPzNvOx.exe
  C:\Windows\System\kPzNvOx.exe
  2⤵
  PID:8952
- C:\Windows\System\DmrBHKL.exe
  C:\Windows\System\DmrBHKL.exe
  2⤵
  PID:9020
- C:\Windows\System\NtxQVAn.exe
  C:\Windows\System\NtxQVAn.exe
  2⤵
  PID:9076
- C:\Windows\System\DknorVL.exe
  C:\Windows\System\DknorVL.exe
  2⤵
  PID:9172
- C:\Windows\System\oEEZbtq.exe
  C:\Windows\System\oEEZbtq.exe
  2⤵
  PID:8208
- C:\Windows\System\iVFEKLf.exe
  C:\Windows\System\iVFEKLf.exe
  2⤵
  PID:8324
- C:\Windows\System\TJREzcE.exe
  C:\Windows\System\TJREzcE.exe
  2⤵
  PID:8508
- C:\Windows\System\Qzhfhpr.exe
  C:\Windows\System\Qzhfhpr.exe
  2⤵
  PID:8644
- C:\Windows\System\oDoPIKR.exe
  C:\Windows\System\oDoPIKR.exe
  2⤵
  PID:8740
- C:\Windows\System\BEhQsTo.exe
  C:\Windows\System\BEhQsTo.exe
  2⤵
  PID:8896
- C:\Windows\System\kcyNfdY.exe
  C:\Windows\System\kcyNfdY.exe
  2⤵
  PID:9044
- C:\Windows\System\uSctlqO.exe
  C:\Windows\System\uSctlqO.exe
  2⤵
  PID:9144
- C:\Windows\System\lyGEaYS.exe
  C:\Windows\System\lyGEaYS.exe
  2⤵
  PID:8408
- C:\Windows\System\SbmZhjg.exe
  C:\Windows\System\SbmZhjg.exe
  2⤵
  PID:8744
- C:\Windows\System\uZVZrhd.exe
  C:\Windows\System\uZVZrhd.exe
  2⤵
  PID:9100
- C:\Windows\System\Cynxzgx.exe
  C:\Windows\System\Cynxzgx.exe
  2⤵
  PID:8580
- C:\Windows\System\IfdxBHK.exe
  C:\Windows\System\IfdxBHK.exe
  2⤵
  PID:9220
- C:\Windows\System\ijMZqdM.exe
  C:\Windows\System\ijMZqdM.exe
  2⤵
  PID:9256
- C:\Windows\System\WFbELDt.exe
  C:\Windows\System\WFbELDt.exe
  2⤵
  PID:9276
- C:\Windows\System\VhxWlwH.exe
  C:\Windows\System\VhxWlwH.exe
  2⤵
  PID:9308
- C:\Windows\System\hrDDpSb.exe
  C:\Windows\System\hrDDpSb.exe
  2⤵
  PID:9332
- C:\Windows\System\leNlksx.exe
  C:\Windows\System\leNlksx.exe
  2⤵
  PID:9372
- C:\Windows\System\sYfSOvU.exe
  C:\Windows\System\sYfSOvU.exe
  2⤵
  PID:9404
- C:\Windows\System\KqdZclM.exe
  C:\Windows\System\KqdZclM.exe
  2⤵
  PID:9432
- C:\Windows\System\PJoDSIq.exe
  C:\Windows\System\PJoDSIq.exe
  2⤵
  PID:9448
- C:\Windows\System\UUOvXNb.exe
  C:\Windows\System\UUOvXNb.exe
  2⤵
  PID:9464
- C:\Windows\System\otmBxfg.exe
  C:\Windows\System\otmBxfg.exe
  2⤵
  PID:9516
- C:\Windows\System\wkjOQNk.exe
  C:\Windows\System\wkjOQNk.exe
  2⤵
  PID:9536
- C:\Windows\System\RNjyUTW.exe
  C:\Windows\System\RNjyUTW.exe
  2⤵
  PID:9564
- C:\Windows\System\AEJfuCW.exe
  C:\Windows\System\AEJfuCW.exe
  2⤵
  PID:9592
- C:\Windows\System\jMXUSgx.exe
  C:\Windows\System\jMXUSgx.exe
  2⤵
  PID:9620
- C:\Windows\System\wpJOMmt.exe
  C:\Windows\System\wpJOMmt.exe
  2⤵
  PID:9644
- C:\Windows\System\OzoVcOb.exe
  C:\Windows\System\OzoVcOb.exe
  2⤵
  PID:9676
- C:\Windows\System\aWDejiN.exe
  C:\Windows\System\aWDejiN.exe
  2⤵
  PID:9704
- C:\Windows\System\dhtVqjc.exe
  C:\Windows\System\dhtVqjc.exe
  2⤵
  PID:9744
- C:\Windows\System\FEoFbRU.exe
  C:\Windows\System\FEoFbRU.exe
  2⤵
  PID:9772
- C:\Windows\System\BoyaPnX.exe
  C:\Windows\System\BoyaPnX.exe
  2⤵
  PID:9800
- C:\Windows\System\DbTMbpD.exe
  C:\Windows\System\DbTMbpD.exe
  2⤵
  PID:9820
- C:\Windows\System\AhfmWHJ.exe
  C:\Windows\System\AhfmWHJ.exe
  2⤵
  PID:9844
- C:\Windows\System\BSBuxUq.exe
  C:\Windows\System\BSBuxUq.exe
  2⤵
  PID:9872
- C:\Windows\System\ODLzXCS.exe
  C:\Windows\System\ODLzXCS.exe
  2⤵
  PID:9900
- C:\Windows\System\VEmSRvI.exe
  C:\Windows\System\VEmSRvI.exe
  2⤵
  PID:9928
- C:\Windows\System\RkfhrQi.exe
  C:\Windows\System\RkfhrQi.exe
  2⤵
  PID:9956
- C:\Windows\System\qOZUNmE.exe
  C:\Windows\System\qOZUNmE.exe
  2⤵
  PID:9972
- C:\Windows\System\yzZJkEA.exe
  C:\Windows\System\yzZJkEA.exe
  2⤵
  PID:10008
- C:\Windows\System\ufnXKXf.exe
  C:\Windows\System\ufnXKXf.exe
  2⤵
  PID:10032
- C:\Windows\System\iXFmFHe.exe
  C:\Windows\System\iXFmFHe.exe
  2⤵
  PID:10080
- C:\Windows\System\CTllAlP.exe
  C:\Windows\System\CTllAlP.exe
  2⤵
  PID:10096
- C:\Windows\System\ynJAwlk.exe
  C:\Windows\System\ynJAwlk.exe
  2⤵
  PID:10112
- C:\Windows\System\NGjVmNK.exe
  C:\Windows\System\NGjVmNK.exe
  2⤵
  PID:10136
- C:\Windows\System\XIUIBUo.exe
  C:\Windows\System\XIUIBUo.exe
  2⤵
  PID:10152
- C:\Windows\System\yWmQuQt.exe
  C:\Windows\System\yWmQuQt.exe
  2⤵
  PID:10216
- C:\Windows\System\lmwOmYT.exe
  C:\Windows\System\lmwOmYT.exe
  2⤵
  PID:9248
- C:\Windows\System\bBrCtpz.exe
  C:\Windows\System\bBrCtpz.exe
  2⤵
  PID:9272
- C:\Windows\System\APVPLif.exe
  C:\Windows\System\APVPLif.exe
  2⤵
  PID:9348
- C:\Windows\System\iyBUWrK.exe
  C:\Windows\System\iyBUWrK.exe
  2⤵
  PID:9400
- C:\Windows\System\QaDxOOZ.exe
  C:\Windows\System\QaDxOOZ.exe
  2⤵
  PID:9528
- C:\Windows\System\vlHTGGj.exe
  C:\Windows\System\vlHTGGj.exe
  2⤵
  PID:9552
- C:\Windows\System\TYlOnuN.exe
  C:\Windows\System\TYlOnuN.exe
  2⤵
  PID:9632
- C:\Windows\System\DaEZTDb.exe
  C:\Windows\System\DaEZTDb.exe
  2⤵
  PID:9696
- C:\Windows\System\IVZroxE.exe
  C:\Windows\System\IVZroxE.exe
  2⤵
  PID:9728
- C:\Windows\System\djOSLCu.exe
  C:\Windows\System\djOSLCu.exe
  2⤵
  PID:9792
- C:\Windows\System\hpyktHS.exe
  C:\Windows\System\hpyktHS.exe
  2⤵
  PID:9888
- C:\Windows\System\xAAeYTb.exe
  C:\Windows\System\xAAeYTb.exe
  2⤵
  PID:9916
- C:\Windows\System\rHaDaZs.exe
  C:\Windows\System\rHaDaZs.exe
  2⤵
  PID:9996
- C:\Windows\System\FGmXyVl.exe
  C:\Windows\System\FGmXyVl.exe
  2⤵
  PID:10088
- C:\Windows\System\EpIMOTC.exe
  C:\Windows\System\EpIMOTC.exe
  2⤵
  PID:10128
- C:\Windows\System\iqiwrAI.exe
  C:\Windows\System\iqiwrAI.exe
  2⤵
  PID:10236
- C:\Windows\System\OrCGEdn.exe
  C:\Windows\System\OrCGEdn.exe
  2⤵
  PID:9244
- C:\Windows\System\hdAkzoq.exe
  C:\Windows\System\hdAkzoq.exe
  2⤵
  PID:9484
- C:\Windows\System\VAZcPkT.exe
  C:\Windows\System\VAZcPkT.exe
  2⤵
  PID:9580
- C:\Windows\System\YXoRtaI.exe
  C:\Windows\System\YXoRtaI.exe
  2⤵
  PID:9656
- C:\Windows\System\zOtaOlP.exe
  C:\Windows\System\zOtaOlP.exe
  2⤵
  PID:9920
- C:\Windows\System\hquAgqM.exe
  C:\Windows\System\hquAgqM.exe
  2⤵
  PID:10060
- C:\Windows\System\iuQMHIy.exe
  C:\Windows\System\iuQMHIy.exe
  2⤵
  PID:7660
- C:\Windows\System\FTnSIOZ.exe
  C:\Windows\System\FTnSIOZ.exe
  2⤵
  PID:9556
- C:\Windows\System\RathUfq.exe
  C:\Windows\System\RathUfq.exe
  2⤵
  PID:9884
- C:\Windows\System\yfPrWAL.exe
  C:\Windows\System\yfPrWAL.exe
  2⤵
  PID:10104
- C:\Windows\System\LwMXGAU.exe
  C:\Windows\System\LwMXGAU.exe
  2⤵
  PID:9832
- C:\Windows\System\pVRfqew.exe
  C:\Windows\System\pVRfqew.exe
  2⤵
  PID:10248
- C:\Windows\System\EccafFn.exe
  C:\Windows\System\EccafFn.exe
  2⤵
  PID:10268
- C:\Windows\System\LxqDPzq.exe
  C:\Windows\System\LxqDPzq.exe
  2⤵
  PID:10296
- C:\Windows\System\KCUnrAK.exe
  C:\Windows\System\KCUnrAK.exe
  2⤵
  PID:10316
- C:\Windows\System\nydaeCc.exe
  C:\Windows\System\nydaeCc.exe
  2⤵
  PID:10356
- C:\Windows\System\OENCPAS.exe
  C:\Windows\System\OENCPAS.exe
  2⤵
  PID:10392
- C:\Windows\System\IzSXwad.exe
  C:\Windows\System\IzSXwad.exe
  2⤵
  PID:10432
- C:\Windows\System\yONiIjQ.exe
  C:\Windows\System\yONiIjQ.exe
  2⤵
  PID:10448
- C:\Windows\System\dWUdqzw.exe
  C:\Windows\System\dWUdqzw.exe
  2⤵
  PID:10476
- C:\Windows\System\sDMtUkF.exe
  C:\Windows\System\sDMtUkF.exe
  2⤵
  PID:10504
- C:\Windows\System\qDTFkfK.exe
  C:\Windows\System\qDTFkfK.exe
  2⤵
  PID:10544
- C:\Windows\System\hKoINug.exe
  C:\Windows\System\hKoINug.exe
  2⤵
  PID:10572
- C:\Windows\System\LpMQCRw.exe
  C:\Windows\System\LpMQCRw.exe
  2⤵
  PID:10600
- C:\Windows\System\TNOgKif.exe
  C:\Windows\System\TNOgKif.exe
  2⤵
  PID:10616
- C:\Windows\System\TcrGpqY.exe
  C:\Windows\System\TcrGpqY.exe
  2⤵
  PID:10632
- C:\Windows\System\dDWvcEC.exe
  C:\Windows\System\dDWvcEC.exe
  2⤵
  PID:10680
- C:\Windows\System\PsWZABQ.exe
  C:\Windows\System\PsWZABQ.exe
  2⤵
  PID:10712
- C:\Windows\System\imwhlVs.exe
  C:\Windows\System\imwhlVs.exe
  2⤵
  PID:10732
- C:\Windows\System\MZAJIwR.exe
  C:\Windows\System\MZAJIwR.exe
  2⤵
  PID:10756
- C:\Windows\System\gBwBEQh.exe
  C:\Windows\System\gBwBEQh.exe
  2⤵
  PID:10796
- C:\Windows\System\IhlukYs.exe
  C:\Windows\System\IhlukYs.exe
  2⤵
  PID:10812
- C:\Windows\System\yMXOrJT.exe
  C:\Windows\System\yMXOrJT.exe
  2⤵
  PID:10840
- C:\Windows\System\LukDfOC.exe
  C:\Windows\System\LukDfOC.exe
  2⤵
  PID:10880
- C:\Windows\System\csFEJQs.exe
  C:\Windows\System\csFEJQs.exe
  2⤵
  PID:10908
- C:\Windows\System\xULUtrs.exe
  C:\Windows\System\xULUtrs.exe
  2⤵
  PID:10936
- C:\Windows\System\SIAeuWN.exe
  C:\Windows\System\SIAeuWN.exe
  2⤵
  PID:10952
- C:\Windows\System\rGeVhEE.exe
  C:\Windows\System\rGeVhEE.exe
  2⤵
  PID:10980
- C:\Windows\System\FVwqFgn.exe
  C:\Windows\System\FVwqFgn.exe
  2⤵
  PID:11020
- C:\Windows\System\HvfkEYy.exe
  C:\Windows\System\HvfkEYy.exe
  2⤵
  PID:11048
- C:\Windows\System\vmaPFjS.exe
  C:\Windows\System\vmaPFjS.exe
  2⤵
  PID:11064
- C:\Windows\System\aBQJpuP.exe
  C:\Windows\System\aBQJpuP.exe
  2⤵
  PID:11092
- C:\Windows\System\sFZxBxI.exe
  C:\Windows\System\sFZxBxI.exe
  2⤵
  PID:11132
- C:\Windows\System\zimBVXA.exe
  C:\Windows\System\zimBVXA.exe
  2⤵
  PID:11164
- C:\Windows\System\oASYuMb.exe
  C:\Windows\System\oASYuMb.exe
  2⤵
  PID:11192
- C:\Windows\System\jiNoFTK.exe
  C:\Windows\System\jiNoFTK.exe
  2⤵
  PID:11208
- C:\Windows\System\vbFayri.exe
  C:\Windows\System\vbFayri.exe
  2⤵
  PID:11248
- C:\Windows\System\otnARZp.exe
  C:\Windows\System\otnARZp.exe
  2⤵
  PID:9524
- C:\Windows\System\wzOIDfr.exe
  C:\Windows\System\wzOIDfr.exe
  2⤵
  PID:10276
- C:\Windows\System\stmqTka.exe
  C:\Windows\System\stmqTka.exe
  2⤵
  PID:10340
- C:\Windows\System\whSuNwb.exe
  C:\Windows\System\whSuNwb.exe
  2⤵
  PID:10424
- C:\Windows\System\VvJnUDf.exe
  C:\Windows\System\VvJnUDf.exe
  2⤵
  PID:10488
- C:\Windows\System\oQvfksW.exe
  C:\Windows\System\oQvfksW.exe
  2⤵
  PID:10556
- C:\Windows\System\bhnUiET.exe
  C:\Windows\System\bhnUiET.exe
  2⤵
  PID:10608
- C:\Windows\System\RMFjxGY.exe
  C:\Windows\System\RMFjxGY.exe
  2⤵
  PID:10704
- C:\Windows\System\wAsFxkz.exe
  C:\Windows\System\wAsFxkz.exe
  2⤵
  PID:10752
- C:\Windows\System\XsJpkQc.exe
  C:\Windows\System\XsJpkQc.exe
  2⤵
  PID:10804
- C:\Windows\System\PgQxDxV.exe
  C:\Windows\System\PgQxDxV.exe
  2⤵
  PID:10900
- C:\Windows\System\AnydouJ.exe
  C:\Windows\System\AnydouJ.exe
  2⤵
  PID:10968
- C:\Windows\System\eHbTMCd.exe
  C:\Windows\System\eHbTMCd.exe
  2⤵
  PID:11040
- C:\Windows\System\AoIohus.exe
  C:\Windows\System\AoIohus.exe
  2⤵
  PID:11104
- C:\Windows\System\srIAZvj.exe
  C:\Windows\System\srIAZvj.exe
  2⤵
  PID:11160
- C:\Windows\System\DfGssKc.exe
  C:\Windows\System\DfGssKc.exe
  2⤵
  PID:11228
- C:\Windows\System\dKMaJCi.exe
  C:\Windows\System\dKMaJCi.exe
  2⤵
  PID:9964
- C:\Windows\System\FbihUTE.exe
  C:\Windows\System\FbihUTE.exe
  2⤵
  PID:10312
- C:\Windows\System\vQntGir.exe
  C:\Windows\System\vQntGir.exe
  2⤵
  PID:10624
- C:\Windows\System\LrvclTy.exe
  C:\Windows\System\LrvclTy.exe
  2⤵
  PID:10720
- C:\Windows\System\kGaTqIu.exe
  C:\Windows\System\kGaTqIu.exe
  2⤵
  PID:10856
- C:\Windows\System\iJSpWzP.exe
  C:\Windows\System\iJSpWzP.exe
  2⤵
  PID:10996
- C:\Windows\System\JVoREdl.exe
  C:\Windows\System\JVoREdl.exe
  2⤵
  PID:11200
- C:\Windows\System\IabfrZR.exe
  C:\Windows\System\IabfrZR.exe
  2⤵
  PID:10256
- C:\Windows\System\BWQlmBM.exe
  C:\Windows\System\BWQlmBM.exe
  2⤵
  PID:10784
- C:\Windows\System\nfHrasG.exe
  C:\Windows\System\nfHrasG.exe
  2⤵
  PID:11088
- C:\Windows\System\pXMpVJg.exe
  C:\Windows\System\pXMpVJg.exe
  2⤵
  PID:10468
- C:\Windows\System\FEJbvOo.exe
  C:\Windows\System\FEJbvOo.exe
  2⤵
  PID:10948
- C:\Windows\System\ESokhdc.exe
  C:\Windows\System\ESokhdc.exe
  2⤵
  PID:11240
- C:\Windows\System\QVPALIi.exe
  C:\Windows\System\QVPALIi.exe
  2⤵
  PID:11288
- C:\Windows\System\tEFnrMV.exe
  C:\Windows\System\tEFnrMV.exe
  2⤵
  PID:11328
- C:\Windows\System\KSmVheR.exe
  C:\Windows\System\KSmVheR.exe
  2⤵
  PID:11352
- C:\Windows\System\iUALjPq.exe
  C:\Windows\System\iUALjPq.exe
  2⤵
  PID:11376
- C:\Windows\System\cOezLIH.exe
  C:\Windows\System\cOezLIH.exe
  2⤵
  PID:11404
- C:\Windows\System\mnPSMiv.exe
  C:\Windows\System\mnPSMiv.exe
  2⤵
  PID:11432
- C:\Windows\System\UBSPdaN.exe
  C:\Windows\System\UBSPdaN.exe
  2⤵
  PID:11460
- C:\Windows\System\QdAQYgv.exe
  C:\Windows\System\QdAQYgv.exe
  2⤵
  PID:11488
- C:\Windows\System\vfRrvBj.exe
  C:\Windows\System\vfRrvBj.exe
  2⤵
  PID:11516
- C:\Windows\System\BziZZHO.exe
  C:\Windows\System\BziZZHO.exe
  2⤵
  PID:11556
- C:\Windows\System\FZzqyFa.exe
  C:\Windows\System\FZzqyFa.exe
  2⤵
  PID:11584
- C:\Windows\System\rmkcrMn.exe
  C:\Windows\System\rmkcrMn.exe
  2⤵
  PID:11612
- C:\Windows\System\eivbkAB.exe
  C:\Windows\System\eivbkAB.exe
  2⤵
  PID:11640
- C:\Windows\System\BPikhfJ.exe
  C:\Windows\System\BPikhfJ.exe
  2⤵
  PID:11668
- C:\Windows\System\ZzOUJic.exe
  C:\Windows\System\ZzOUJic.exe
  2⤵
  PID:11688
- C:\Windows\System\BrmcCtI.exe
  C:\Windows\System\BrmcCtI.exe
  2⤵
  PID:11716
- C:\Windows\System\pfhpbOg.exe
  C:\Windows\System\pfhpbOg.exe
  2⤵
  PID:11740
- C:\Windows\System\rYvqkFG.exe
  C:\Windows\System\rYvqkFG.exe
  2⤵
  PID:11768
- C:\Windows\System\mFaMDSE.exe
  C:\Windows\System\mFaMDSE.exe
  2⤵
  PID:11808
- C:\Windows\System\AHrYoJw.exe
  C:\Windows\System\AHrYoJw.exe
  2⤵
  PID:11836
- C:\Windows\System\UJCjngl.exe
  C:\Windows\System\UJCjngl.exe
  2⤵
  PID:11864
- C:\Windows\System\rEVtQNW.exe
  C:\Windows\System\rEVtQNW.exe
  2⤵
  PID:11880
- C:\Windows\System\RguEvJw.exe
  C:\Windows\System\RguEvJw.exe
  2⤵
  PID:11900
- C:\Windows\System\UQeqbXE.exe
  C:\Windows\System\UQeqbXE.exe
  2⤵
  PID:11932
- C:\Windows\System\gQxkTUy.exe
  C:\Windows\System\gQxkTUy.exe
  2⤵
  PID:11956
- C:\Windows\System\LmwpAsd.exe
  C:\Windows\System\LmwpAsd.exe
  2⤵
  PID:11996
- C:\Windows\System\EVZaBQN.exe
  C:\Windows\System\EVZaBQN.exe
  2⤵
  PID:12020
- C:\Windows\System\BuLCuIN.exe
  C:\Windows\System\BuLCuIN.exe
  2⤵
  PID:12060
- C:\Windows\System\apgycwU.exe
  C:\Windows\System\apgycwU.exe
  2⤵
  PID:12084
- C:\Windows\System\YWqiMRl.exe
  C:\Windows\System\YWqiMRl.exe
  2⤵
  PID:12108
- C:\Windows\System\rrHtUWB.exe
  C:\Windows\System\rrHtUWB.exe
  2⤵
  PID:12128
- C:\Windows\System\vHPobmb.exe
  C:\Windows\System\vHPobmb.exe
  2⤵
  PID:12168
- C:\Windows\System\hYnjIHq.exe
  C:\Windows\System\hYnjIHq.exe
  2⤵
  PID:12192
- C:\Windows\System\WvNsvyG.exe
  C:\Windows\System\WvNsvyG.exe
  2⤵
  PID:12212
- C:\Windows\System\jwGEAfj.exe
  C:\Windows\System\jwGEAfj.exe
  2⤵
  PID:12248
- C:\Windows\System\jJTOXZt.exe
  C:\Windows\System\jJTOXZt.exe
  2⤵
  PID:12276
- C:\Windows\System\QIZArlc.exe
  C:\Windows\System\QIZArlc.exe
  2⤵
  PID:11316
- C:\Windows\System\zchinzn.exe
  C:\Windows\System\zchinzn.exe
  2⤵
  PID:11364
- C:\Windows\System\JUlxyks.exe
  C:\Windows\System\JUlxyks.exe
  2⤵
  PID:11424
- C:\Windows\System\mLYGvru.exe
  C:\Windows\System\mLYGvru.exe
  2⤵
  PID:11484
- C:\Windows\System\LWkMYQg.exe
  C:\Windows\System\LWkMYQg.exe
  2⤵
  PID:11540
- C:\Windows\System\FCVyDiD.exe
  C:\Windows\System\FCVyDiD.exe
  2⤵
  PID:11580
- C:\Windows\System\reSftdl.exe
  C:\Windows\System\reSftdl.exe
  2⤵
  PID:11656
- C:\Windows\System\zlXENkK.exe
  C:\Windows\System\zlXENkK.exe
  2⤵
  PID:11724
- C:\Windows\System\aoPSPZA.exe
  C:\Windows\System\aoPSPZA.exe
  2⤵
  PID:11800
- C:\Windows\System\NRvjEFj.exe
  C:\Windows\System\NRvjEFj.exe
  2⤵
  PID:11852
- C:\Windows\System\ExXnHAx.exe
  C:\Windows\System\ExXnHAx.exe
  2⤵
  PID:11908
- C:\Windows\System\KIZsgCx.exe
  C:\Windows\System\KIZsgCx.exe
  2⤵
  PID:12036
- C:\Windows\System\hFIKSyT.exe
  C:\Windows\System\hFIKSyT.exe
  2⤵
  PID:12068
- C:\Windows\System\osQKWvO.exe
  C:\Windows\System\osQKWvO.exe
  2⤵
  PID:12116
- C:\Windows\System\JvMzsOw.exe
  C:\Windows\System\JvMzsOw.exe
  2⤵
  PID:12200
- C:\Windows\System\JyfpPKY.exe
  C:\Windows\System\JyfpPKY.exe
  2⤵
  PID:12260
- C:\Windows\System\SkAJPYJ.exe
  C:\Windows\System\SkAJPYJ.exe
  2⤵
  PID:11308
- C:\Windows\System\AuHlOpy.exe
  C:\Windows\System\AuHlOpy.exe
  2⤵
  PID:11452
- C:\Windows\System\izLHzZZ.exe
  C:\Windows\System\izLHzZZ.exe
  2⤵
  PID:11608
- C:\Windows\System\ekdplKD.exe
  C:\Windows\System\ekdplKD.exe
  2⤵
  PID:11652
- C:\Windows\System\sycUHvl.exe
  C:\Windows\System\sycUHvl.exe
  2⤵
  PID:11976
- C:\Windows\System\XhZsnyd.exe
  C:\Windows\System\XhZsnyd.exe
  2⤵
  PID:12180
- C:\Windows\System\xBKJtiv.exe
  C:\Windows\System\xBKJtiv.exe
  2⤵
  PID:11304
- C:\Windows\System\xlLCnuW.exe
  C:\Windows\System\xlLCnuW.exe
  2⤵
  PID:11528
- C:\Windows\System\WxqrTJu.exe
  C:\Windows\System\WxqrTJu.exe
  2⤵
  PID:11792
- C:\Windows\System\AtqGhGL.exe
  C:\Windows\System\AtqGhGL.exe
  2⤵
  PID:12268
- C:\Windows\System\IhAgwGn.exe
  C:\Windows\System\IhAgwGn.exe
  2⤵
  PID:11708
- C:\Windows\System\yGbdmMe.exe
  C:\Windows\System\yGbdmMe.exe
  2⤵
  PID:12324
- C:\Windows\System\mouhMAf.exe
  C:\Windows\System\mouhMAf.exe
  2⤵
  PID:12360
- C:\Windows\System\ZPWErPP.exe
  C:\Windows\System\ZPWErPP.exe
  2⤵
  PID:12416
- C:\Windows\System\pkPncsb.exe
  C:\Windows\System\pkPncsb.exe
  2⤵
  PID:12444
- C:\Windows\System\daFJGaM.exe
  C:\Windows\System\daFJGaM.exe
  2⤵
  PID:12468
- C:\Windows\System\yEgCXqf.exe
  C:\Windows\System\yEgCXqf.exe
  2⤵
  PID:12496
- C:\Windows\System\PZkcKZS.exe
  C:\Windows\System\PZkcKZS.exe
  2⤵
  PID:12540
- C:\Windows\System\QwFRazR.exe
  C:\Windows\System\QwFRazR.exe
  2⤵
  PID:12568
- C:\Windows\System\ZGzWYvf.exe
  C:\Windows\System\ZGzWYvf.exe
  2⤵
  PID:12596
- C:\Windows\System\ieZUnDW.exe
  C:\Windows\System\ieZUnDW.exe
  2⤵
  PID:12612
- C:\Windows\System\CocuEZB.exe
  C:\Windows\System\CocuEZB.exe
  2⤵
  PID:12648
- C:\Windows\System\fjKwIGm.exe
  C:\Windows\System\fjKwIGm.exe
  2⤵
  PID:12684
- C:\Windows\System\YAhxfVz.exe
  C:\Windows\System\YAhxfVz.exe
  2⤵
  PID:12716
- C:\Windows\System\vsyNEtn.exe
  C:\Windows\System\vsyNEtn.exe
  2⤵
  PID:12732
- C:\Windows\System\ulAuiBX.exe
  C:\Windows\System\ulAuiBX.exe
  2⤵
  PID:12768
- C:\Windows\System\RIJTKnV.exe
  C:\Windows\System\RIJTKnV.exe
  2⤵
  PID:12796
- C:\Windows\System\PcXHtJH.exe
  C:\Windows\System\PcXHtJH.exe
  2⤵
  PID:12828
- C:\Windows\System\UXzIyPl.exe
  C:\Windows\System\UXzIyPl.exe
  2⤵
  PID:12844
- C:\Windows\System\cnoxvly.exe
  C:\Windows\System\cnoxvly.exe
  2⤵
  PID:12876
- C:\Windows\System\ELlLzwx.exe
  C:\Windows\System\ELlLzwx.exe
  2⤵
  PID:12896
- C:\Windows\System\FSYsXNw.exe
  C:\Windows\System\FSYsXNw.exe
  2⤵
  PID:12932
- C:\Windows\System\vSHzFnm.exe
  C:\Windows\System\vSHzFnm.exe
  2⤵
  PID:12960
- C:\Windows\System\atTnqEU.exe
  C:\Windows\System\atTnqEU.exe
  2⤵
  PID:13000
- C:\Windows\System\DlyVEUX.exe
  C:\Windows\System\DlyVEUX.exe
  2⤵
  PID:13028
- C:\Windows\System\aDIcWsy.exe
  C:\Windows\System\aDIcWsy.exe
  2⤵
  PID:13056
- C:\Windows\System\VqnvIll.exe
  C:\Windows\System\VqnvIll.exe
  2⤵
  PID:13072
- C:\Windows\System\jqAmvGe.exe
  C:\Windows\System\jqAmvGe.exe
  2⤵
  PID:13088
- C:\Windows\System\nkxyBJi.exe
  C:\Windows\System\nkxyBJi.exe
  2⤵
  PID:13112
- C:\Windows\System\hpBtDzQ.exe
  C:\Windows\System\hpBtDzQ.exe
  2⤵
  PID:13148
- C:\Windows\System\tZdTefe.exe
  C:\Windows\System\tZdTefe.exe
  2⤵
  PID:13184
- C:\Windows\System\zVPPJFB.exe
  C:\Windows\System\zVPPJFB.exe
  2⤵
  PID:13224
- C:\Windows\System\ruHbeWL.exe
  C:\Windows\System\ruHbeWL.exe
  2⤵
  PID:13240
- C:\Windows\System\jGQbfZl.exe
  C:\Windows\System\jGQbfZl.exe
  2⤵
  PID:13272
- C:\Windows\System\dOgizfG.exe
  C:\Windows\System\dOgizfG.exe
  2⤵
  PID:13296
- C:\Windows\System\qJAGUxT.exe
  C:\Windows\System\qJAGUxT.exe
  2⤵
  PID:2400
- C:\Windows\System\drMmvQy.exe
  C:\Windows\System\drMmvQy.exe
  2⤵
  PID:12300
- C:\Windows\System\MWtdUbx.exe
  C:\Windows\System\MWtdUbx.exe
  2⤵
  PID:12432
- C:\Windows\System\mTvKXxc.exe
  C:\Windows\System\mTvKXxc.exe
  2⤵
  PID:12460
- C:\Windows\System\CBEijsq.exe
  C:\Windows\System\CBEijsq.exe
  2⤵
  PID:12556
- C:\Windows\System\EwTfyrI.exe
  C:\Windows\System\EwTfyrI.exe
  2⤵
  PID:12632
- C:\Windows\System\zeEYjEA.exe
  C:\Windows\System\zeEYjEA.exe
  2⤵
  PID:12676
- C:\Windows\System\pyMaRcB.exe
  C:\Windows\System\pyMaRcB.exe
  2⤵
  PID:12724
- C:\Windows\System\ITurqqS.exe
  C:\Windows\System\ITurqqS.exe
  2⤵
  PID:12824
- C:\Windows\System\bsvbtmo.exe
  C:\Windows\System\bsvbtmo.exe
  2⤵
  PID:12884
- C:\Windows\System\Kkzopym.exe
  C:\Windows\System\Kkzopym.exe
  2⤵
  PID:12920
- C:\Windows\System\bIHsxRw.exe
  C:\Windows\System\bIHsxRw.exe
  2⤵
  PID:13016
- C:\Windows\System\iwFduhy.exe
  C:\Windows\System\iwFduhy.exe
  2⤵
  PID:13064
- C:\Windows\System\VovulkR.exe
  C:\Windows\System\VovulkR.exe
  2⤵
  PID:13144
- C:\Windows\System\NowNKDf.exe
  C:\Windows\System\NowNKDf.exe
  2⤵
  PID:13156
- C:\Windows\System\ZobrXHb.exe
  C:\Windows\System\ZobrXHb.exe
  2⤵
  PID:13212
- C:\Windows\System\RiqxXOM.exe
  C:\Windows\System\RiqxXOM.exe
  2⤵
  PID:13264
- C:\Windows\System\mLXVAPj.exe
  C:\Windows\System\mLXVAPj.exe
  2⤵
  PID:13292
- C:\Windows\System\LmtqsFu.exe
  C:\Windows\System\LmtqsFu.exe
  2⤵
  PID:12384
- C:\Windows\System\wisfNoW.exe
  C:\Windows\System\wisfNoW.exe
  2⤵
  PID:12564
- C:\Windows\System\lemsCsw.exe
  C:\Windows\System\lemsCsw.exe
  2⤵
  PID:12704
- C:\Windows\System\XUFiDhB.exe
  C:\Windows\System\XUFiDhB.exe
  2⤵
  PID:12868
- C:\Windows\System\IYEWsVq.exe
  C:\Windows\System\IYEWsVq.exe
  2⤵
  PID:13040
- C:\Windows\System\luJyBrF.exe
  C:\Windows\System\luJyBrF.exe
  2⤵
  PID:13232
- C:\Windows\System\nFwQttG.exe
  C:\Windows\System\nFwQttG.exe
  2⤵
  PID:12552
- C:\Windows\System\aHofAfq.exe
  C:\Windows\System\aHofAfq.exe
  2⤵
  PID:12672
- C:\Windows\System\bMIkkbV.exe
  C:\Windows\System\bMIkkbV.exe
  2⤵
  PID:13172
- C:\Windows\System\eXwZybO.exe
  C:\Windows\System\eXwZybO.exe
  2⤵
  PID:4092
- C:\Windows\System\hqfDGIw.exe
  C:\Windows\System\hqfDGIw.exe
  2⤵
  PID:13332
- C:\Windows\System\BmpLMln.exe
  C:\Windows\System\BmpLMln.exe
  2⤵
  PID:13372
- C:\Windows\System\uRiVsPz.exe
  C:\Windows\System\uRiVsPz.exe
  2⤵
  PID:13396
- C:\Windows\System\IStqmtW.exe
  C:\Windows\System\IStqmtW.exe
  2⤵
  PID:13452
- C:\Windows\System\NPmPhgW.exe
  C:\Windows\System\NPmPhgW.exe
  2⤵
  PID:13480
- C:\Windows\System\XJlhUHj.exe
  C:\Windows\System\XJlhUHj.exe
  2⤵
  PID:13500
- C:\Windows\System\eJwKFgb.exe
  C:\Windows\System\eJwKFgb.exe
  2⤵
  PID:13528
- C:\Windows\System\GGNfeof.exe
  C:\Windows\System\GGNfeof.exe
  2⤵
  PID:13588
- C:\Windows\System\guRpNyg.exe
  C:\Windows\System\guRpNyg.exe
  2⤵
  PID:13604
- C:\Windows\System\BMtuJDh.exe
  C:\Windows\System\BMtuJDh.exe
  2⤵
  PID:13652
- C:\Windows\System\NKfcNmx.exe
  C:\Windows\System\NKfcNmx.exe
  2⤵
  PID:13696
- C:\Windows\System\oThFFtY.exe
  C:\Windows\System\oThFFtY.exe
  2⤵
  PID:13716
- C:\Windows\System\TlXlHmN.exe
  C:\Windows\System\TlXlHmN.exe
  2⤵
  PID:13760
- C:\Windows\System\dohCUyF.exe
  C:\Windows\System\dohCUyF.exe
  2⤵
  PID:13784
- C:\Windows\System\eHFsKFf.exe
  C:\Windows\System\eHFsKFf.exe
  2⤵
  PID:13816
- C:\Windows\System\UPTQwBV.exe
  C:\Windows\System\UPTQwBV.exe
  2⤵
  PID:13840
- C:\Windows\System\blPkBPc.exe
  C:\Windows\System\blPkBPc.exe
  2⤵
  PID:13860
- C:\Windows\System\XlJvKDX.exe
  C:\Windows\System\XlJvKDX.exe
  2⤵
  PID:13880
- C:\Windows\System\YrIWCeE.exe
  C:\Windows\System\YrIWCeE.exe
  2⤵
  PID:13912
- C:\Windows\System\FxcSGgN.exe
  C:\Windows\System\FxcSGgN.exe
  2⤵
  PID:13964
- C:\Windows\System\uLLNmnD.exe
  C:\Windows\System\uLLNmnD.exe
  2⤵
  PID:13996
- C:\Windows\System\kPflADI.exe
  C:\Windows\System\kPflADI.exe
  2⤵
  PID:14016
- C:\Windows\System\bZmutHk.exe
  C:\Windows\System\bZmutHk.exe
  2⤵
  PID:14032
- C:\Windows\System\Lonofwf.exe
  C:\Windows\System\Lonofwf.exe
  2⤵
  PID:14048
- C:\Windows\System\cMocKbh.exe
  C:\Windows\System\cMocKbh.exe
  2⤵
  PID:14072
- C:\Windows\System\eCbIYOq.exe
  C:\Windows\System\eCbIYOq.exe
  2⤵
  PID:14124
- C:\Windows\System\IUvdyhi.exe
  C:\Windows\System\IUvdyhi.exe
  2⤵
  PID:14148
- C:\Windows\System\ubUBjsT.exe
  C:\Windows\System\ubUBjsT.exe
  2⤵
  PID:14208
- C:\Windows\System\tWeCojv.exe
  C:\Windows\System\tWeCojv.exe
  2⤵
  PID:14224
- C:\Windows\System\hpCmSLh.exe
  C:\Windows\System\hpCmSLh.exe
  2⤵
  PID:14248
- C:\Windows\System\lJdSHJL.exe
  C:\Windows\System\lJdSHJL.exe
  2⤵
  PID:14292
- C:\Windows\System\CunRkho.exe
  C:\Windows\System\CunRkho.exe
  2⤵
  PID:14308
- C:\Windows\System\sTVgaZD.exe
  C:\Windows\System\sTVgaZD.exe
  2⤵
  PID:13352
- C:\Windows\System\shBjkUw.exe
  C:\Windows\System\shBjkUw.exe
  2⤵
  PID:13416
- C:\Windows\System\RMtlnJU.exe
  C:\Windows\System\RMtlnJU.exe
  2⤵
  PID:13476
- C:\Windows\System\ofqpAEs.exe
  C:\Windows\System\ofqpAEs.exe
  2⤵
  PID:13624
- C:\Windows\System\XjAGgCb.exe
  C:\Windows\System\XjAGgCb.exe
  2⤵
  PID:13704
- C:\Windows\System\ayunopS.exe
  C:\Windows\System\ayunopS.exe
  2⤵
  PID:13776
- C:\Windows\System\dnVbwwF.exe
  C:\Windows\System\dnVbwwF.exe
  2⤵
  PID:13832
- C:\Windows\System\ACbBecg.exe
  C:\Windows\System\ACbBecg.exe
  2⤵
  PID:13856
- C:\Windows\System\IBfxNwD.exe
  C:\Windows\System\IBfxNwD.exe
  2⤵
  PID:13944
- C:\Windows\System\vojOJYA.exe
  C:\Windows\System\vojOJYA.exe
  2⤵
  PID:14044
- C:\Windows\System\fPQuxtj.exe
  C:\Windows\System\fPQuxtj.exe
  2⤵
  PID:14184
- C:\Windows\System\uFVSvQs.exe
  C:\Windows\System\uFVSvQs.exe
  2⤵
  PID:14116
- C:\Windows\System\cUAsQcS.exe
  C:\Windows\System\cUAsQcS.exe
  2⤵
  PID:14216
- C:\Windows\System\TzUuzHN.exe
  C:\Windows\System\TzUuzHN.exe
  2⤵
  PID:14280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BlrLoWU.exe

Filesize
2.0MB

MD5
c440a3ff57eacc298b853102e7c3e4fe

SHA1
7530d566ea6a71693e2fceff2f2f3d4e1658b6f1

SHA256
199988db735c6ed871d6566b31dd10d0f23bbf4545cdbac9b6e93b865620ecca

SHA512
e16072b4fac5a7f043853c65423071d315d8540a3da464f25313e0228fa583cd463ce396cf9ea9fc391096e33e726dd2e5c26a16a505e9e80aea58b458fd0698

Download Submit
C:\Windows\System\CchsEqG.exe

Filesize
2.0MB

MD5
9fa49e0de13c4d8b2f6ec0ef18e0acbe

SHA1
dc8da633d41652170293a022b8765a7056cad9e6

SHA256
4be90015c7bcf1bc467bae5033a9757194c46906a924bf0b8d225577b8984de8

SHA512
d0ab5cb4a2e70788a7012eccec47b3b689afd3ffe5b93911bc9536a97d8338441f5447cdf40ceddf2409cc5c2589f1700f0d09f6c0b6ef1106c4780c4d4f0958

Download Submit
C:\Windows\System\FjncNwI.exe

Filesize
2.0MB

MD5
b1a097f17cd6b42474a2c29815f90d02

SHA1
d011e299413c91bc22012d46491f6a0e424f0fe3

SHA256
f10737442c3fe05847b7462904127332012806569822771b62159f65fd85be8d

SHA512
8179e055518c88256dfe0effa8c1f5d8eb22a2860906348b20f7c0ac8c22cde1b5266f72e56fb7a1790f710a973bfc421e880b7059787bfd25dd90c9a6695919

Download Submit
C:\Windows\System\JXvTmtL.exe

Filesize
2.0MB

MD5
b825af2e65f8ca2b38d989c340106f5a

SHA1
023a37288fcd9184cbf1ffc1436153611d1015ca

SHA256
031d8fe7024cc99af4f923ebcd795989fb90d332ab7311af7544973e1d4ff30f

SHA512
9ba76f55074d0cc3d88fd79902aa96ac4e4721a87f1015e389d7d305c3d36aa0d3ee33f6ef1734f4156ac4881fab061a985d9113e8b713e33fb5409298f8e2f9

Download Submit
C:\Windows\System\KIBBmbr.exe

Filesize
2.0MB

MD5
e32373386a467519c754107526099d9b

SHA1
fb6a3dadba4a2cc9d440d1d701480aa7ab75be5c

SHA256
16a02005daa78848b1d28f27d84cc7371482102b1f56f08ff90332be86497f85

SHA512
5bda20044bc0cd6d9c96c62882e5baf726f2059158c01d8b980f57b60787fc7c06ef84adc5dc3936b1683c2bd775b8c67d69084a5ffb3a34068d42171c892f97

Download Submit
C:\Windows\System\LXyJhPy.exe

Filesize
2.0MB

MD5
ce7c8c6a68536b1e45cbca2183aff8e5

SHA1
730b1dcebffc487db611adfc163af08bc3d94c4c

SHA256
f0e8b0533b6701742d0ea691f89f46a21c235255f17df24d03cd28cea557c64b

SHA512
1bfbb6e9ee3706dd539443c1b3d16d9398c82b1cf969de49a1a8d360084cb5f350238d413ff89f7ff14173ab614fa216062cf4406fa36f07de9c7985a1cbbd45

Download Submit
C:\Windows\System\OgSullD.exe

Filesize
2.0MB

MD5
7ba52443aa1e7fc12c77d07080c83878

SHA1
203c1cd03bac7c67fe305847be2497b65b3cc657

SHA256
d831556dccc9181210e0efd169d434e5a246a1fecc85c219b25d24a243f0ff31

SHA512
dbbb9a7a27053f924141ee3cb8b4a0160274d394208e74d02db8eaf40d862c8130e1027b8cae3cede44cbbe81ce93fbb8989540080ce9e21f9a72c7ddab655d8

Download Submit
C:\Windows\System\RbxNDZf.exe

Filesize
2.0MB

MD5
7a49a4593c7ee8977511246f45dc76e6

SHA1
2f42138c717e5cea06d677b214515e7213e533ac

SHA256
f894fc49672e7859dcc23c09bb952b542e209b319a6698f81d5798ed46770a95

SHA512
4314ada3f6a3a399147a211760174ed8accd392b038fcc4d52a3cc44014fc1d9ca25c2ec0f281b350caa99f0c9d84b9789bdaf061ad717463254fa598840bd33

Download Submit
C:\Windows\System\VbIgwvX.exe

Filesize
2.0MB

MD5
28cbffec34e347de844fd7af86654794

SHA1
c19429ea2a31d74aa5432790e36923bf5d15d0fb

SHA256
d642b9283749070999a03643228e45c5f98695a470392d439c573d9db1672adf

SHA512
fd8f147fc41a1b12c1126e2de52a85b846752088359e847dc673f3010f2fe9d223ac7c8ec2994132d875889b7da05bdb99eb9bd12538b0376cf9659b71535d6e

Download Submit
C:\Windows\System\WltlQkO.exe

Filesize
2.0MB

MD5
2fd09c0e45b04a4285a8a73546b9e1b2

SHA1
cce22ddccb45dbfe934438c0b590b62a704ea6e5

SHA256
efee72f645e332e7f87dcfe78f0316d8fe98ceeaf11f8bfbc8f3f0061432a9a3

SHA512
41eb432289d1e2f107253c95c7df46e053c4e8e04b15c4bee80faed34a32fa659eb28707d80a7067c02da26087deedb5293ea65aed84c38318c7d2dfeca43e92

Download Submit
C:\Windows\System\ZCzrGEL.exe

Filesize
2.0MB

MD5
75e3a9b1fd633f2828d77f1491fb8d73

SHA1
6ba58e6e08891763ac5f583ed3f94f36cfe6dec3

SHA256
07dfddf5cfc8504e206dd317132665bd55726768e9cc42f0e2b0840527c73f7d

SHA512
959f0af2586fb671ea1e6f97cbfb5575b003b5b86b088571356a2a7a3508330f98c039dbd7db8cff0fcee138ac750edb3161cfad5f9e33a4de2d28b1acd4706d

Download Submit
C:\Windows\System\aaienAL.exe

Filesize
2.0MB

MD5
7641ff51f46cebf79e9a6b11742aee25

SHA1
a7607dcb79e5f18e406fb3d17334a4e0897b3589

SHA256
2a94f2d6853a9d9d1498408d4b1a6f032f3ca61e00bea76ebcae38af77662eb0

SHA512
24c0e40383d4a5861954ed1eb747a19586a91c1a3484ec2f6e9ce75a4cb93c6f362e9e11b496e5df1245b4470d030532a2ae5a807996ee48d0001633054a85bc

Download Submit
C:\Windows\System\bKnXLxL.exe

Filesize
2.0MB

MD5
16cdeae441fd2bf1ee6afe8757d416c1

SHA1
90462b1d751e7f1c7f7b5bd1c25c2e2e47c0a734

SHA256
1b7e0bbf2c25467cd65a46e82103d593f4ff6a23b509926ee42ddb9048f34792

SHA512
4c00111565a8df0f8f861088cf46397461037882be2a7ad191c4a8c0f4f9ac74946286aea8cc999952593b3f0df7c6483536619f8342c60e775b2258ce0f4297

Download Submit
C:\Windows\System\brOlMXe.exe

Filesize
2.0MB

MD5
91ac7318dd12cb64732a5048ed62059b

SHA1
55dbd46e4733b5443f28e662ca7124d4850af224

SHA256
52045b8dda072a1232c3f4fbbe3a9339e821cdc3d65a98fcd18b97e28a263f18

SHA512
f607b5a172d01b03993aa9d8c48b30481895e99547832f0944319ca8f4100e87fe694134a002191e3de6d25fa9daa955fe68e7c956b5557d58538345e15a24cc

Download Submit
C:\Windows\System\cbcaEEk.exe

Filesize
2.0MB

MD5
2c0c044eb6bc15a0ac26a3581f1900bd

SHA1
19a8318c6d9b3d61cd83d6ea93be4da42c6f9131

SHA256
efcfc756092fef0bac96d2a4fe73dde516844aac3d0debf395be2db2d5cdea7c

SHA512
4fddbbc20a56dfbe2990a2c3f79eb86c92d148c9b5f16088c81ba6cb97e10b246fb1e91cf5a26c1068b7c74f4d8830a99817ed19344a78b58f5ffe320b6fd69d

Download Submit
C:\Windows\System\clXRWLa.exe

Filesize
2.0MB

MD5
8559706101f370e20264ecfa2111cabe

SHA1
8333e0362f4025957c263983da2fe9a38ddfdb13

SHA256
cf30affe8be56e8589902957610d9158240b18a01adb7f6a2a92a8edb43fa088

SHA512
59a5ec29a7b4985fe740252788be5c0dd5a431d13bb0ea126d42e3f4ab9c7398accf40de6f8e777cfcb0ca9668bdc068699a57905df4fb794d86361c6dc3e1e4

Download Submit
C:\Windows\System\fCWWTkE.exe

Filesize
2.0MB

MD5
6f909a5e5fb4205044e98edd99182187

SHA1
a1783ccff228cb4df78df87cae3cda88df932fb7

SHA256
6907e3141d0c701fc9bf9e9b5fe070eb0d1d0803248a4ac8a215207a3fe5bb23

SHA512
791e905bb9b4f33d5c8df544cde1e1402abefd37db5f1524b765023ae083d48deb5cc2d055ddd46a0339abbe8927e339cb9609d9d00aef7b5de5344c3815cb03

Download Submit
C:\Windows\System\fKWulvP.exe

Filesize
2.0MB

MD5
7005a233183bbc8a45811104f99ffcb3

SHA1
1f2f50ce200c6a1cf87e3430e5ae3d2831f519c7

SHA256
f0d28534d81708d583c5235d5ab914c624470941b126febc9a8d5f3b0cf6aef2

SHA512
ffd9fea48889b5bf0a628c0aa75d4470d8c2dc5bef97c9b0a22e07f4482f1b81e918735afd5a6f6d128c1b56c5ba422d2b2dbeeed1b9f87e6a5090a3d2b52a05

Download Submit
C:\Windows\System\iFtdobR.exe

Filesize
2.0MB

MD5
202363da7db1ab51ba04ff5bbb428148

SHA1
a7713f5b84f293af25aea9476954495239120dc1

SHA256
5bad6ed7d72441ec1f9297adfc6ea14dec7c8a8de62a74c2e7faacdf30386ccc

SHA512
ed7a756162d12d99aff01f428049c0ec3b7e091d757c285080e5d48e359a5c9ab2f3c7c0d0b87d8c8cb5db5e5207408f94244788a5d3808aa7d9405565828f33

Download Submit
C:\Windows\System\jFXhkuV.exe

Filesize
2.0MB

MD5
b714faa4e08d12ab7f1feac8b6839afa

SHA1
8845acb7bbdc949bb05dd291bfda9f9c46993948

SHA256
79227471749e84866d2357b670548d74e59290da9554bec4d289c886bd917e4a

SHA512
7531ee1f4d8cc76300326a504691769375d9b9fba34f7ab038ae9fc7a5a609aec50bb646ee6150a2d221363526932078286b183fba5fd49edca6b6e146a4b2a3

Download Submit
C:\Windows\System\jaVtKGI.exe

Filesize
2.0MB

MD5
4aee46a81dda1cb4851a1ab381c987f3

SHA1
b18d539dd587f233ac2aefbb6b25686c5b7329c1

SHA256
4f070303acfebc57870a94ef5228925ed7d31baf5599ceb0ad9abb8baeffecb2

SHA512
2591bbacd071b78b3bb916f9cf1c6f83b1a5a4c331fbb7d5ef7487043c8c76b5318bea863802190ca9e7cfad5b20947d3a6058f325e5b4ccbcc3f39aadf86be0

Download Submit
C:\Windows\System\kWdkPpZ.exe

Filesize
2.0MB

MD5
bc118ede1cbdcb7f702c172f12bb8b0e

SHA1
9ccbf95920c203fd6ebe3e4ec967e84d79229aa9

SHA256
0f325c533fd1626cdb4fb7edcbcef432e9ded60dd98a86006409fce48f2208ed

SHA512
4ab2d6540cade52850a0c5f0b1b78154887fe3e3e54322f255fefe1a907777897d72b6c8b236629963b508eb66dd176e2d42bce736942280f371d3d7d2f8447f

Download Submit
C:\Windows\System\lFINJuc.exe

Filesize
2.0MB

MD5
1afa5c693c16fc3e338e72bca790f7ff

SHA1
901d76695fe6b4b97282eedd787755d26d07cddc

SHA256
ba8b6a57bd28c53895f0c4fcd9b7f34b7d70c3c0339e3b86c8cb178b5404e361

SHA512
a5b480eb76290aa8058c9f2aca49d5c6a5fb2615c3bfe30c7e93a7fb5bd4aa203f1812a64d7341a3c956be2d5f4928975b20ba47b3954ce1d7f7a470b5fa1f58

Download Submit
C:\Windows\System\mPvmwnr.exe

Filesize
2.0MB

MD5
aa7a128e447a6259f3618d8f2afb7d06

SHA1
b70cf9d055a247f1556dd50b8dbe023526aa397b

SHA256
2f3287b671042f27ebcddd9643cd1fcbd8264174f1bb075dc4ab30dc829ed0de

SHA512
085f366411a594db7438498b84286f3142642b241b7c5a7e6ce379db0fc69cb716d1fdcf2d5465080ba8534a751a3d30dc12a0a2381b56b2e1c1ce5b11cd1d78

Download Submit
C:\Windows\System\ngqQthV.exe

Filesize
2.0MB

MD5
ab294b9e67986b5c3cae5c64afe29c79

SHA1
ec44803c26d8da12400ca38bab5ed3c096737f26

SHA256
8a5eeb23280f3f62685dd822e89ac59181db70fcd63f31d99ed725d2e0aa9d76

SHA512
8e93f08b02c261097cbf4408d928a3dc5f78403208e4b39ccb829e67f6698a3231357a88e32f3fd8208497f9958e8c30de76bb1741e54c2515edcbe18caa0b9b

Download Submit
C:\Windows\System\phbbOCk.exe

Filesize
2.0MB

MD5
542e949a66aa71aa563d01c8ece9d199

SHA1
03cbef18ab9c2879b801239e9c061deb68d938cf

SHA256
bb30e23ed0913f08cb73be0c8054394bd501123f50cfaa4dbf8e585679e91bcc

SHA512
033bc60881d196c0e506b90215ed8c83bc2059a48648d14be9756b575418f7a727097603523dc5b5f44f218492edd295bf930303e99fcea6970969372b8613cd

Download Submit
C:\Windows\System\pkdugxr.exe

Filesize
2.0MB

MD5
cd25e29550b722d84793bd73d48e73e7

SHA1
5ea6fe663dd65e38be494c50060560288fba9777

SHA256
7c6faa058e091d2cfd29c3c0b24a552ec96bc58ee75c700c6d040367153f460e

SHA512
2a0a2f2cb2d6b36fe7630f162ffba25cb860379fc974132d0172648f0c90b77db28749c0f6eaca44636cb6925be56ba1aa6b0da1fc700fc9ee981079af704c61

Download Submit
C:\Windows\System\rjPTujj.exe

Filesize
2.0MB

MD5
b18743bcd53b2f1b3a23a32dc133beb8

SHA1
326b80eba5794c7de10de6e20460ff80dc69ad1e

SHA256
2b0ed6380f4061f4b8101b7535d3e7dd5794f6f090b43ce6f30d56dce8da7cb2

SHA512
3bb05bfbac71cd75c8275d4ede65404d539eac09d23c667faf84e55838f17113657b9d3a10869c3a4f515fcd3be3681aebda1f22649ce43e7e29c8434bfc39e1

Download Submit
C:\Windows\System\tKWDydT.exe

Filesize
2.0MB

MD5
0aa53ca4bf6c9de3f3e3202b28d001d2

SHA1
f4401a698097765abf95ad9c05f1e0ef8db0c6db

SHA256
bc1035ebb7e3a0ab44f6715c286be274f24c68d7edc4ad297f1d15a765c6bd59

SHA512
e8aa3381aff58c8f3ea1bd97eb7a464401ff05baa1a5170322fc5978b4a7626abffd5845c3cdba1f7e9f9ff7cedd8bd0a6c8c1b67c77e2194eba264583beda18

Download Submit
C:\Windows\System\urbdmdi.exe

Filesize
2.0MB

MD5
4c87f7906b493a2cd8f4c0bafb8fd955

SHA1
40e1ef27819e452d63e90fcb692447ee03cc53a9

SHA256
b24ff47dcd8b751a2a6988f76587f622d317775988541eecf8ef92cbf7a24dd3

SHA512
498d8e174a8aed11524bed3df4063d97fbaf3dce7a7d9078c5275ee14971be917b2381cda0ce6567a8d9ae90664c09f40e3159786fadeef06d57cc023da199f4

Download Submit
C:\Windows\System\vwGFbAw.exe

Filesize
2.0MB

MD5
34c3bd4d73d56b8aecc0ee3d67aa7a53

SHA1
c145df984e174a3025acbda029cb0d952f534c5b

SHA256
9897d6bddfcf19b19b0d95dcc8aa9eeca3df4e646394a6567eacc0c92bfb73da

SHA512
ceb47c583e012dc9a4739a2957dd60b45bd4a78ffb22edc2ad29c12042377470bb728e2900d14ce1d2be2a38fb692b6568dfdb91c8d45c3914668114eae53ad0

Download Submit
C:\Windows\System\xhGSPYO.exe

Filesize
2.0MB

MD5
604a83c865b2fbf4f01a8de72c3092da

SHA1
000aa379164752702765957db14c3f5fd46fd2e0

SHA256
4fe1950de16c585cec3879ec79fc616e995f785bb881847add1269aba22c15af

SHA512
311acee04e0535a64fd8223c8d78e0fbfe186e582ee4e823b03ffd2f4f41e28090ea46532198f011625f1bb33184bb3b08d976a3415b708d9eb6f89c5b1a92c8

Download Submit
C:\Windows\System\ztTBhsT.exe

Filesize
2.0MB

MD5
685715305001df05bbb5f6800742ba56

SHA1
8cec60620a69129cc1973f7c5aaf5c192bdc10d7

SHA256
d503554b9b9e12523e9ea09d550ac4eea86e5a02e3ec0c78949bbcd8cae8dd27

SHA512
54a0558939ac02a635921657f6cf82ef039427d997a3abb3771f0c7209b8daf1477389c46c4c3a03497c845cc7eca5752da3fc2b34a52d42c1f780660f0236ca

Download Submit
memory/436-719-0x00007FF61E000000-0x00007FF61E354000-memory.dmp

Filesize
3.3MB

Download
memory/436-2117-0x00007FF61E000000-0x00007FF61E354000-memory.dmp

Filesize
3.3MB

Download
memory/532-714-0x00007FF6FC680000-0x00007FF6FC9D4000-memory.dmp

Filesize
3.3MB

Download
memory/532-2115-0x00007FF6FC680000-0x00007FF6FC9D4000-memory.dmp

Filesize
3.3MB

Download
memory/540-739-0x00007FF691400000-0x00007FF691754000-memory.dmp

Filesize
3.3MB

Download
memory/540-2100-0x00007FF691400000-0x00007FF691754000-memory.dmp

Filesize
3.3MB

Download
memory/1060-2092-0x00007FF72F8D0000-0x00007FF72FC24000-memory.dmp

Filesize
3.3MB

Download
memory/1060-0-0x00007FF72F8D0000-0x00007FF72FC24000-memory.dmp

Filesize
3.3MB

Download
memory/1060-1-0x000002189D6C0000-0x000002189D6D0000-memory.dmp

Filesize
64KB

Download
memory/1084-2101-0x00007FF7FBF80000-0x00007FF7FC2D4000-memory.dmp

Filesize
3.3MB

Download
memory/1084-2094-0x00007FF7FBF80000-0x00007FF7FC2D4000-memory.dmp

Filesize
3.3MB

Download
memory/1084-46-0x00007FF7FBF80000-0x00007FF7FC2D4000-memory.dmp

Filesize
3.3MB

Download
memory/1164-18-0x00007FF670FB0000-0x00007FF671304000-memory.dmp

Filesize
3.3MB

Download
memory/1164-2096-0x00007FF670FB0000-0x00007FF671304000-memory.dmp

Filesize
3.3MB

Download
memory/1336-2099-0x00007FF603F30000-0x00007FF604284000-memory.dmp

Filesize
3.3MB

Download
memory/1336-27-0x00007FF603F30000-0x00007FF604284000-memory.dmp

Filesize
3.3MB

Download
memory/1396-669-0x00007FF703CB0000-0x00007FF704004000-memory.dmp

Filesize
3.3MB

Download
memory/1396-2103-0x00007FF703CB0000-0x00007FF704004000-memory.dmp

Filesize
3.3MB

Download
memory/1464-2111-0x00007FF6EACD0000-0x00007FF6EB024000-memory.dmp

Filesize
3.3MB

Download
memory/1464-693-0x00007FF6EACD0000-0x00007FF6EB024000-memory.dmp

Filesize
3.3MB

Download
memory/2016-2122-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp

Filesize
3.3MB

Download
memory/2016-737-0x00007FF66F350000-0x00007FF66F6A4000-memory.dmp

Filesize
3.3MB

Download
memory/2076-2102-0x00007FF6A3310000-0x00007FF6A3664000-memory.dmp

Filesize
3.3MB

Download
memory/2076-740-0x00007FF6A3310000-0x00007FF6A3664000-memory.dmp

Filesize
3.3MB

Download
memory/2128-731-0x00007FF781210000-0x00007FF781564000-memory.dmp

Filesize
3.3MB

Download
memory/2128-2106-0x00007FF781210000-0x00007FF781564000-memory.dmp

Filesize
3.3MB

Download
memory/2208-742-0x00007FF7DCE80000-0x00007FF7DD1D4000-memory.dmp

Filesize
3.3MB

Download
memory/2208-2109-0x00007FF7DCE80000-0x00007FF7DD1D4000-memory.dmp

Filesize
3.3MB

Download
memory/2264-683-0x00007FF642A90000-0x00007FF642DE4000-memory.dmp

Filesize
3.3MB

Download
memory/2264-2112-0x00007FF642A90000-0x00007FF642DE4000-memory.dmp

Filesize
3.3MB

Download
memory/2948-2119-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp

Filesize
3.3MB

Download
memory/2948-673-0x00007FF7F21F0000-0x00007FF7F2544000-memory.dmp

Filesize
3.3MB

Download
memory/2972-703-0x00007FF79EE90000-0x00007FF79F1E4000-memory.dmp

Filesize
3.3MB

Download
memory/2972-2114-0x00007FF79EE90000-0x00007FF79F1E4000-memory.dmp

Filesize
3.3MB

Download
memory/3388-2124-0x00007FF7215B0000-0x00007FF721904000-memory.dmp

Filesize
3.3MB

Download
memory/3388-738-0x00007FF7215B0000-0x00007FF721904000-memory.dmp

Filesize
3.3MB

Download
memory/3504-724-0x00007FF7F6DA0000-0x00007FF7F70F4000-memory.dmp

Filesize
3.3MB

Download
memory/3504-2116-0x00007FF7F6DA0000-0x00007FF7F70F4000-memory.dmp

Filesize
3.3MB

Download
memory/3736-678-0x00007FF78BFC0000-0x00007FF78C314000-memory.dmp

Filesize
3.3MB

Download
memory/3736-2121-0x00007FF78BFC0000-0x00007FF78C314000-memory.dmp

Filesize
3.3MB

Download
memory/4104-734-0x00007FF7E46E0000-0x00007FF7E4A34000-memory.dmp

Filesize
3.3MB

Download
memory/4104-2107-0x00007FF7E46E0000-0x00007FF7E4A34000-memory.dmp

Filesize
3.3MB

Download
memory/4212-60-0x00007FF75D300000-0x00007FF75D654000-memory.dmp

Filesize
3.3MB

Download
memory/4212-2095-0x00007FF75D300000-0x00007FF75D654000-memory.dmp

Filesize
3.3MB

Download
memory/4212-2105-0x00007FF75D300000-0x00007FF75D654000-memory.dmp

Filesize
3.3MB

Download
memory/4372-2123-0x00007FF601150000-0x00007FF6014A4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-736-0x00007FF601150000-0x00007FF6014A4000-memory.dmp

Filesize
3.3MB

Download
memory/4400-670-0x00007FF672BD0000-0x00007FF672F24000-memory.dmp

Filesize
3.3MB

Download
memory/4400-2104-0x00007FF672BD0000-0x00007FF672F24000-memory.dmp

Filesize
3.3MB

Download
memory/4580-741-0x00007FF75C620000-0x00007FF75C974000-memory.dmp

Filesize
3.3MB

Download
memory/4580-2118-0x00007FF75C620000-0x00007FF75C974000-memory.dmp

Filesize
3.3MB

Download
memory/4712-13-0x00007FF70DEE0000-0x00007FF70E234000-memory.dmp

Filesize
3.3MB

Download
memory/4712-2097-0x00007FF70DEE0000-0x00007FF70E234000-memory.dmp

Filesize
3.3MB

Download
memory/4712-2093-0x00007FF70DEE0000-0x00007FF70E234000-memory.dmp

Filesize
3.3MB

Download
memory/4808-2120-0x00007FF731070000-0x00007FF7313C4000-memory.dmp

Filesize
3.3MB

Download
memory/4808-674-0x00007FF731070000-0x00007FF7313C4000-memory.dmp

Filesize
3.3MB

Download
memory/4908-2108-0x00007FF776F20000-0x00007FF777274000-memory.dmp

Filesize
3.3MB

Download
memory/4908-723-0x00007FF776F20000-0x00007FF777274000-memory.dmp

Filesize
3.3MB

Download
memory/4944-2113-0x00007FF60E100000-0x00007FF60E454000-memory.dmp

Filesize
3.3MB

Download
memory/4944-710-0x00007FF60E100000-0x00007FF60E454000-memory.dmp

Filesize
3.3MB

Download
memory/4984-701-0x00007FF646E50000-0x00007FF6471A4000-memory.dmp

Filesize
3.3MB

Download
memory/4984-2110-0x00007FF646E50000-0x00007FF6471A4000-memory.dmp

Filesize
3.3MB

Download
memory/5016-34-0x00007FF7E2690000-0x00007FF7E29E4000-memory.dmp

Filesize
3.3MB

Download
memory/5016-2098-0x00007FF7E2690000-0x00007FF7E29E4000-memory.dmp

Filesize
3.3MB

Download