xmrig | 5626ee07bece986f9e0f243e151904d11e69a9361e825d29197d627c2802254e

Analysis

max time kernel
95s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

950aee28908073a51c1e0395320940d0_NEIKI.exe
Size

5.0MB
MD5

950aee28908073a51c1e0395320940d0
SHA1

c0b8ca809f72c5a5db7f1f5136305edd0cfa4292
SHA256

5626ee07bece986f9e0f243e151904d11e69a9361e825d29197d627c2802254e
SHA512

e5eb96ca620e2b5db6ee84d00c4bdc6244adee4e8d6a5ad9292c8efc8a0dbbd14b5d30e5a999df29e01ea8c9372e0a1aa4a5adad6f0dc73036b64e56992551f7
SSDEEP

98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32V:Q+856utgpPF8u/8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5076-0-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp	xmrig
behavioral2/files/0x0005000000023284-5.dat	xmrig
behavioral2/memory/4372-7-0x00007FF795080000-0x00007FF7953D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fa-9.dat	xmrig
behavioral2/memory/3860-14-0x00007FF651BC0000-0x00007FF651F14000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fb-8.dat	xmrig
behavioral2/memory/4924-20-0x00007FF623B90000-0x00007FF623EE4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fc-23.dat	xmrig
behavioral2/files/0x00070000000233fe-37.dat	xmrig
behavioral2/files/0x00070000000233ff-38.dat	xmrig
behavioral2/files/0x0007000000023400-45.dat	xmrig
behavioral2/memory/2112-46-0x00007FF681300000-0x00007FF681654000-memory.dmp	xmrig
behavioral2/files/0x0007000000023401-52.dat	xmrig
behavioral2/files/0x0007000000023402-63.dat	xmrig
behavioral2/files/0x0007000000023403-68.dat	xmrig
behavioral2/files/0x0007000000023404-75.dat	xmrig
behavioral2/files/0x0007000000023405-81.dat	xmrig
behavioral2/files/0x0007000000023407-88.dat	xmrig
behavioral2/files/0x0007000000023408-95.dat	xmrig
behavioral2/files/0x0007000000023411-141.dat	xmrig
behavioral2/files/0x0007000000023416-166.dat	xmrig
behavioral2/files/0x0007000000023417-170.dat	xmrig
behavioral2/files/0x0007000000023415-161.dat	xmrig
behavioral2/files/0x0007000000023414-155.dat	xmrig
behavioral2/files/0x0007000000023413-151.dat	xmrig
behavioral2/files/0x0007000000023412-145.dat	xmrig
behavioral2/files/0x0007000000023410-135.dat	xmrig
behavioral2/files/0x000700000002340f-131.dat	xmrig
behavioral2/files/0x000700000002340e-125.dat	xmrig
behavioral2/files/0x000700000002340d-121.dat	xmrig
behavioral2/files/0x000700000002340c-115.dat	xmrig
behavioral2/files/0x000700000002340b-111.dat	xmrig
behavioral2/memory/2508-298-0x00007FF65AEE0000-0x00007FF65B234000-memory.dmp	xmrig
behavioral2/memory/2248-299-0x00007FF64CBA0000-0x00007FF64CEF4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-105.dat	xmrig
behavioral2/files/0x0007000000023409-101.dat	xmrig
behavioral2/files/0x0007000000023406-83.dat	xmrig
behavioral2/files/0x00080000000233f7-58.dat	xmrig
behavioral2/memory/4516-300-0x00007FF7A4DA0000-0x00007FF7A50F4000-memory.dmp	xmrig
behavioral2/memory/3348-301-0x00007FF6FD4A0000-0x00007FF6FD7F4000-memory.dmp	xmrig
behavioral2/memory/2804-308-0x00007FF740080000-0x00007FF7403D4000-memory.dmp	xmrig
behavioral2/memory/3488-311-0x00007FF7558C0000-0x00007FF755C14000-memory.dmp	xmrig
behavioral2/memory/4184-316-0x00007FF6D1530000-0x00007FF6D1884000-memory.dmp	xmrig
behavioral2/memory/4672-335-0x00007FF67BC50000-0x00007FF67BFA4000-memory.dmp	xmrig
behavioral2/memory/1776-339-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp	xmrig
behavioral2/memory/1692-346-0x00007FF704450000-0x00007FF7047A4000-memory.dmp	xmrig
behavioral2/memory/3356-350-0x00007FF714110000-0x00007FF714464000-memory.dmp	xmrig
behavioral2/memory/668-354-0x00007FF70CC60000-0x00007FF70CFB4000-memory.dmp	xmrig
behavioral2/memory/4308-348-0x00007FF635370000-0x00007FF6356C4000-memory.dmp	xmrig
behavioral2/memory/3236-344-0x00007FF7BB2D0000-0x00007FF7BB624000-memory.dmp	xmrig
behavioral2/memory/2884-342-0x00007FF72CC40000-0x00007FF72CF94000-memory.dmp	xmrig
behavioral2/memory/1596-333-0x00007FF660EA0000-0x00007FF6611F4000-memory.dmp	xmrig
behavioral2/memory/1472-326-0x00007FF740B50000-0x00007FF740EA4000-memory.dmp	xmrig
behavioral2/memory/4896-323-0x00007FF6A33B0000-0x00007FF6A3704000-memory.dmp	xmrig
behavioral2/memory/2280-322-0x00007FF7059C0000-0x00007FF705D14000-memory.dmp	xmrig
behavioral2/memory/5076-734-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp	xmrig
behavioral2/memory/1664-1582-0x00007FF7C3040000-0x00007FF7C3394000-memory.dmp	xmrig
behavioral2/memory/1988-1776-0x00007FF7CDB80000-0x00007FF7CDED4000-memory.dmp	xmrig
behavioral2/memory/2112-1989-0x00007FF681300000-0x00007FF681654000-memory.dmp	xmrig
behavioral2/memory/2560-1775-0x00007FF7E22B0000-0x00007FF7E2604000-memory.dmp	xmrig
behavioral2/memory/4372-735-0x00007FF795080000-0x00007FF7953D4000-memory.dmp	xmrig
behavioral2/memory/1248-318-0x00007FF6331A0000-0x00007FF6334F4000-memory.dmp	xmrig
behavioral2/memory/3740-312-0x00007FF7138B0000-0x00007FF713C04000-memory.dmp	xmrig
behavioral2/memory/5100-305-0x00007FF6ACA00000-0x00007FF6ACD54000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4372	srVfyfq.exe
3860	JZdlSQB.exe
4924	dZkDPZK.exe
1664	FEKzjtB.exe
2560	PstKdhY.exe
1988	knccCqA.exe
2112	gJVxazm.exe
668	yNDMmyc.exe
2508	IrjLfmF.exe
2248	PwXPQuM.exe
4516	SbipUeI.exe
3348	bEWEHgQ.exe
5100	avGCHEl.exe
2804	cCnEkGw.exe
3488	JsVNcKG.exe
3740	FZIEFco.exe
4184	AkbJDfY.exe
1248	WTgudqM.exe
2280	NzvHgOl.exe
4896	FvzILqo.exe
1472	OaRfXTn.exe
1596	hyDqPmY.exe
4672	QarwNru.exe
1776	yZUsWsn.exe
2884	lXTcFSd.exe
3236	STtbpOz.exe
1692	XxpkRkJ.exe
4308	GseTUEU.exe
3356	ReETAKZ.exe
4180	nTrTqVR.exe
2552	YCiwmpy.exe
5060	HRZYhCK.exe
4124	mTCznvh.exe
1916	GJysbpi.exe
3232	frYfOAy.exe
1484	FkFgxQm.exe
4972	aSQuxZt.exe
2556	QvGAmvf.exe
3352	CKBTcMN.exe
3168	NdMvJAq.exe
232	jmFBZPm.exe
2820	BaWErKB.exe
4984	mCkXSzz.exe
4968	LKjonMz.exe
4424	stXjcsi.exe
4420	DkxxWIi.exe
744	viNcRjO.exe
2448	sXADUIe.exe
3700	IxQlZZw.exe
2960	odyltuP.exe
3720	ZFcPOXv.exe
3244	hBFPfUs.exe
3480	LSjucCv.exe
4068	kPqbnUQ.exe
5116	jESsDTS.exe
3448	yEzPkxO.exe
1976	YqvWEME.exe
4712	xalvLQu.exe
5020	BZMZGvH.exe
4316	JVYzaJA.exe
3492	rizggaA.exe
2388	rjUOTWf.exe
3288	MeCUspG.exe
464	Yxwnlho.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5076-0-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp	upx
behavioral2/files/0x0005000000023284-5.dat	upx
behavioral2/memory/4372-7-0x00007FF795080000-0x00007FF7953D4000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-9.dat	upx
behavioral2/memory/3860-14-0x00007FF651BC0000-0x00007FF651F14000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-8.dat	upx
behavioral2/memory/4924-20-0x00007FF623B90000-0x00007FF623EE4000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-23.dat	upx
behavioral2/files/0x00070000000233fe-37.dat	upx
behavioral2/files/0x00070000000233ff-38.dat	upx
behavioral2/files/0x0007000000023400-45.dat	upx
behavioral2/memory/2112-46-0x00007FF681300000-0x00007FF681654000-memory.dmp	upx
behavioral2/files/0x0007000000023401-52.dat	upx
behavioral2/files/0x0007000000023402-63.dat	upx
behavioral2/files/0x0007000000023403-68.dat	upx
behavioral2/files/0x0007000000023404-75.dat	upx
behavioral2/files/0x0007000000023405-81.dat	upx
behavioral2/files/0x0007000000023407-88.dat	upx
behavioral2/files/0x0007000000023408-95.dat	upx
behavioral2/files/0x0007000000023411-141.dat	upx
behavioral2/files/0x0007000000023416-166.dat	upx
behavioral2/files/0x0007000000023417-170.dat	upx
behavioral2/files/0x0007000000023415-161.dat	upx
behavioral2/files/0x0007000000023414-155.dat	upx
behavioral2/files/0x0007000000023413-151.dat	upx
behavioral2/files/0x0007000000023412-145.dat	upx
behavioral2/files/0x0007000000023410-135.dat	upx
behavioral2/files/0x000700000002340f-131.dat	upx
behavioral2/files/0x000700000002340e-125.dat	upx
behavioral2/files/0x000700000002340d-121.dat	upx
behavioral2/files/0x000700000002340c-115.dat	upx
behavioral2/files/0x000700000002340b-111.dat	upx
behavioral2/memory/2508-298-0x00007FF65AEE0000-0x00007FF65B234000-memory.dmp	upx
behavioral2/memory/2248-299-0x00007FF64CBA0000-0x00007FF64CEF4000-memory.dmp	upx
behavioral2/files/0x000700000002340a-105.dat	upx
behavioral2/files/0x0007000000023409-101.dat	upx
behavioral2/files/0x0007000000023406-83.dat	upx
behavioral2/files/0x00080000000233f7-58.dat	upx
behavioral2/memory/4516-300-0x00007FF7A4DA0000-0x00007FF7A50F4000-memory.dmp	upx
behavioral2/memory/3348-301-0x00007FF6FD4A0000-0x00007FF6FD7F4000-memory.dmp	upx
behavioral2/memory/2804-308-0x00007FF740080000-0x00007FF7403D4000-memory.dmp	upx
behavioral2/memory/3488-311-0x00007FF7558C0000-0x00007FF755C14000-memory.dmp	upx
behavioral2/memory/4184-316-0x00007FF6D1530000-0x00007FF6D1884000-memory.dmp	upx
behavioral2/memory/4672-335-0x00007FF67BC50000-0x00007FF67BFA4000-memory.dmp	upx
behavioral2/memory/1776-339-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp	upx
behavioral2/memory/1692-346-0x00007FF704450000-0x00007FF7047A4000-memory.dmp	upx
behavioral2/memory/3356-350-0x00007FF714110000-0x00007FF714464000-memory.dmp	upx
behavioral2/memory/668-354-0x00007FF70CC60000-0x00007FF70CFB4000-memory.dmp	upx
behavioral2/memory/4308-348-0x00007FF635370000-0x00007FF6356C4000-memory.dmp	upx
behavioral2/memory/3236-344-0x00007FF7BB2D0000-0x00007FF7BB624000-memory.dmp	upx
behavioral2/memory/2884-342-0x00007FF72CC40000-0x00007FF72CF94000-memory.dmp	upx
behavioral2/memory/1596-333-0x00007FF660EA0000-0x00007FF6611F4000-memory.dmp	upx
behavioral2/memory/1472-326-0x00007FF740B50000-0x00007FF740EA4000-memory.dmp	upx
behavioral2/memory/4896-323-0x00007FF6A33B0000-0x00007FF6A3704000-memory.dmp	upx
behavioral2/memory/2280-322-0x00007FF7059C0000-0x00007FF705D14000-memory.dmp	upx
behavioral2/memory/5076-734-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp	upx
behavioral2/memory/1664-1582-0x00007FF7C3040000-0x00007FF7C3394000-memory.dmp	upx
behavioral2/memory/1988-1776-0x00007FF7CDB80000-0x00007FF7CDED4000-memory.dmp	upx
behavioral2/memory/2112-1989-0x00007FF681300000-0x00007FF681654000-memory.dmp	upx
behavioral2/memory/2560-1775-0x00007FF7E22B0000-0x00007FF7E2604000-memory.dmp	upx
behavioral2/memory/4372-735-0x00007FF795080000-0x00007FF7953D4000-memory.dmp	upx
behavioral2/memory/1248-318-0x00007FF6331A0000-0x00007FF6334F4000-memory.dmp	upx
behavioral2/memory/3740-312-0x00007FF7138B0000-0x00007FF713C04000-memory.dmp	upx
behavioral2/memory/5100-305-0x00007FF6ACA00000-0x00007FF6ACD54000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WMQhlSX.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\bdvqViN.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\wCVkYSy.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\TeKpKcn.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\RuDmvyW.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\fMUUxEQ.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\FewIwDi.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\lhzHEfm.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\SNnLwVF.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\cchhIJR.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\kAwWAuV.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\pYwfnDh.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\AkbJDfY.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\GtuCItp.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\WSUHtJL.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\HHfXBAW.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\WqJyGlb.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\YTrJhfS.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\RgfBIle.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\FwlxBuW.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\ZxwoCzr.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\rMuxIPS.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\raVPjhZ.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\QSOKHJE.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\zHXjjUd.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\JXBvvon.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\UOhgBMd.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\jYXDNCV.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\CHxqTkA.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\MurXKvY.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\WBuZuju.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\YDxYktj.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\aSQuxZt.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\sCWEXXA.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\ONUHglE.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\DAtPZiQ.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\YxLSlXN.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\mftTvns.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\hZiEoQK.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\GDJsfvo.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\uynzgLH.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\FssYiDm.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\DBeBphC.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\xIXILeY.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\ASOgtTy.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\nDdhWAO.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\jdbInJC.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\astDeLf.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\iODMkDJ.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\sXADUIe.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\iKuiAjD.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\COPaQbG.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\vqngaFb.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\moPaNbP.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\ouJJpGL.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\EsYzACL.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\aZhYePz.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\Zdsrken.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\vNGZYEk.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\mdbcuKC.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\uQINpAM.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\WzRFteq.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\JSdJWPZ.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe
File created	C:\Windows\System\FZIEFco.exe	950aee28908073a51c1e0395320940d0_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4372	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	84
PID 5076 wrote to memory of 4372	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	84
PID 5076 wrote to memory of 3860	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	85
PID 5076 wrote to memory of 3860	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	85
PID 5076 wrote to memory of 4924	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	86
PID 5076 wrote to memory of 4924	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	86
PID 5076 wrote to memory of 1664	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	87
PID 5076 wrote to memory of 1664	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	87
PID 5076 wrote to memory of 2560	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	88
PID 5076 wrote to memory of 2560	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	88
PID 5076 wrote to memory of 1988	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	89
PID 5076 wrote to memory of 1988	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	89
PID 5076 wrote to memory of 2112	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	90
PID 5076 wrote to memory of 2112	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	90
PID 5076 wrote to memory of 668	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	91
PID 5076 wrote to memory of 668	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	91
PID 5076 wrote to memory of 2508	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	92
PID 5076 wrote to memory of 2508	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	92
PID 5076 wrote to memory of 2248	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	93
PID 5076 wrote to memory of 2248	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	93
PID 5076 wrote to memory of 4516	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	94
PID 5076 wrote to memory of 4516	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	94
PID 5076 wrote to memory of 3348	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	95
PID 5076 wrote to memory of 3348	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	95
PID 5076 wrote to memory of 5100	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	96
PID 5076 wrote to memory of 5100	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	96
PID 5076 wrote to memory of 2804	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	97
PID 5076 wrote to memory of 2804	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	97
PID 5076 wrote to memory of 3488	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	98
PID 5076 wrote to memory of 3488	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	98
PID 5076 wrote to memory of 3740	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	99
PID 5076 wrote to memory of 3740	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	99
PID 5076 wrote to memory of 4184	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	100
PID 5076 wrote to memory of 4184	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	100
PID 5076 wrote to memory of 1248	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	101
PID 5076 wrote to memory of 1248	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	101
PID 5076 wrote to memory of 2280	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	102
PID 5076 wrote to memory of 2280	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	102
PID 5076 wrote to memory of 4896	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	103
PID 5076 wrote to memory of 4896	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	103
PID 5076 wrote to memory of 1472	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	104
PID 5076 wrote to memory of 1472	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	104
PID 5076 wrote to memory of 1596	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	105
PID 5076 wrote to memory of 1596	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	105
PID 5076 wrote to memory of 4672	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	106
PID 5076 wrote to memory of 4672	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	106
PID 5076 wrote to memory of 1776	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	107
PID 5076 wrote to memory of 1776	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	107
PID 5076 wrote to memory of 2884	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	108
PID 5076 wrote to memory of 2884	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	108
PID 5076 wrote to memory of 3236	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	109
PID 5076 wrote to memory of 3236	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	109
PID 5076 wrote to memory of 1692	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	110
PID 5076 wrote to memory of 1692	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	110
PID 5076 wrote to memory of 4308	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	111
PID 5076 wrote to memory of 4308	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	111
PID 5076 wrote to memory of 3356	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	112
PID 5076 wrote to memory of 3356	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	112
PID 5076 wrote to memory of 4180	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	113
PID 5076 wrote to memory of 4180	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	113
PID 5076 wrote to memory of 2552	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	114
PID 5076 wrote to memory of 2552	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	114
PID 5076 wrote to memory of 5060	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	115
PID 5076 wrote to memory of 5060	5076	950aee28908073a51c1e0395320940d0_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\950aee28908073a51c1e0395320940d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\950aee28908073a51c1e0395320940d0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System\srVfyfq.exe
  C:\Windows\System\srVfyfq.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\JZdlSQB.exe
  C:\Windows\System\JZdlSQB.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\dZkDPZK.exe
  C:\Windows\System\dZkDPZK.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\FEKzjtB.exe
  C:\Windows\System\FEKzjtB.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\PstKdhY.exe
  C:\Windows\System\PstKdhY.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\knccCqA.exe
  C:\Windows\System\knccCqA.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\gJVxazm.exe
  C:\Windows\System\gJVxazm.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\yNDMmyc.exe
  C:\Windows\System\yNDMmyc.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\IrjLfmF.exe
  C:\Windows\System\IrjLfmF.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\PwXPQuM.exe
  C:\Windows\System\PwXPQuM.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\SbipUeI.exe
  C:\Windows\System\SbipUeI.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\bEWEHgQ.exe
  C:\Windows\System\bEWEHgQ.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\avGCHEl.exe
  C:\Windows\System\avGCHEl.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\cCnEkGw.exe
  C:\Windows\System\cCnEkGw.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\JsVNcKG.exe
  C:\Windows\System\JsVNcKG.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\FZIEFco.exe
  C:\Windows\System\FZIEFco.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\AkbJDfY.exe
  C:\Windows\System\AkbJDfY.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\WTgudqM.exe
  C:\Windows\System\WTgudqM.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\NzvHgOl.exe
  C:\Windows\System\NzvHgOl.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\FvzILqo.exe
  C:\Windows\System\FvzILqo.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\OaRfXTn.exe
  C:\Windows\System\OaRfXTn.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\hyDqPmY.exe
  C:\Windows\System\hyDqPmY.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\QarwNru.exe
  C:\Windows\System\QarwNru.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\yZUsWsn.exe
  C:\Windows\System\yZUsWsn.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\lXTcFSd.exe
  C:\Windows\System\lXTcFSd.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\STtbpOz.exe
  C:\Windows\System\STtbpOz.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\XxpkRkJ.exe
  C:\Windows\System\XxpkRkJ.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\GseTUEU.exe
  C:\Windows\System\GseTUEU.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\ReETAKZ.exe
  C:\Windows\System\ReETAKZ.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\nTrTqVR.exe
  C:\Windows\System\nTrTqVR.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\YCiwmpy.exe
  C:\Windows\System\YCiwmpy.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\HRZYhCK.exe
  C:\Windows\System\HRZYhCK.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\mTCznvh.exe
  C:\Windows\System\mTCznvh.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\GJysbpi.exe
  C:\Windows\System\GJysbpi.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\frYfOAy.exe
  C:\Windows\System\frYfOAy.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\FkFgxQm.exe
  C:\Windows\System\FkFgxQm.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\aSQuxZt.exe
  C:\Windows\System\aSQuxZt.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\QvGAmvf.exe
  C:\Windows\System\QvGAmvf.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\CKBTcMN.exe
  C:\Windows\System\CKBTcMN.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\NdMvJAq.exe
  C:\Windows\System\NdMvJAq.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\jmFBZPm.exe
  C:\Windows\System\jmFBZPm.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\BaWErKB.exe
  C:\Windows\System\BaWErKB.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\mCkXSzz.exe
  C:\Windows\System\mCkXSzz.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\LKjonMz.exe
  C:\Windows\System\LKjonMz.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\stXjcsi.exe
  C:\Windows\System\stXjcsi.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\DkxxWIi.exe
  C:\Windows\System\DkxxWIi.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\viNcRjO.exe
  C:\Windows\System\viNcRjO.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\sXADUIe.exe
  C:\Windows\System\sXADUIe.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\IxQlZZw.exe
  C:\Windows\System\IxQlZZw.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\odyltuP.exe
  C:\Windows\System\odyltuP.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\ZFcPOXv.exe
  C:\Windows\System\ZFcPOXv.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\hBFPfUs.exe
  C:\Windows\System\hBFPfUs.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\LSjucCv.exe
  C:\Windows\System\LSjucCv.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\kPqbnUQ.exe
  C:\Windows\System\kPqbnUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\jESsDTS.exe
  C:\Windows\System\jESsDTS.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\yEzPkxO.exe
  C:\Windows\System\yEzPkxO.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\YqvWEME.exe
  C:\Windows\System\YqvWEME.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\xalvLQu.exe
  C:\Windows\System\xalvLQu.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\BZMZGvH.exe
  C:\Windows\System\BZMZGvH.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\JVYzaJA.exe
  C:\Windows\System\JVYzaJA.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\rizggaA.exe
  C:\Windows\System\rizggaA.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\rjUOTWf.exe
  C:\Windows\System\rjUOTWf.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\MeCUspG.exe
  C:\Windows\System\MeCUspG.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\Yxwnlho.exe
  C:\Windows\System\Yxwnlho.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\hWlhTbU.exe
  C:\Windows\System\hWlhTbU.exe
  2⤵
  PID:212
- C:\Windows\System\ymWRyiY.exe
  C:\Windows\System\ymWRyiY.exe
  2⤵
  PID:4444
- C:\Windows\System\PbnsXQa.exe
  C:\Windows\System\PbnsXQa.exe
  2⤵
  PID:2368
- C:\Windows\System\wawQKFL.exe
  C:\Windows\System\wawQKFL.exe
  2⤵
  PID:2576
- C:\Windows\System\ppKGgEC.exe
  C:\Windows\System\ppKGgEC.exe
  2⤵
  PID:4076
- C:\Windows\System\tlTPINZ.exe
  C:\Windows\System\tlTPINZ.exe
  2⤵
  PID:2628
- C:\Windows\System\dBTjECj.exe
  C:\Windows\System\dBTjECj.exe
  2⤵
  PID:2348
- C:\Windows\System\oxHuMgx.exe
  C:\Windows\System\oxHuMgx.exe
  2⤵
  PID:4656
- C:\Windows\System\FmXXObz.exe
  C:\Windows\System\FmXXObz.exe
  2⤵
  PID:4352
- C:\Windows\System\KDVMpCT.exe
  C:\Windows\System\KDVMpCT.exe
  2⤵
  PID:392
- C:\Windows\System\QaPSyfi.exe
  C:\Windows\System\QaPSyfi.exe
  2⤵
  PID:2940
- C:\Windows\System\DeSCNYJ.exe
  C:\Windows\System\DeSCNYJ.exe
  2⤵
  PID:1136
- C:\Windows\System\DEINbbY.exe
  C:\Windows\System\DEINbbY.exe
  2⤵
  PID:2000
- C:\Windows\System\BfCTDUB.exe
  C:\Windows\System\BfCTDUB.exe
  2⤵
  PID:3256
- C:\Windows\System\oWOQWgX.exe
  C:\Windows\System\oWOQWgX.exe
  2⤵
  PID:2664
- C:\Windows\System\qEUhDVO.exe
  C:\Windows\System\qEUhDVO.exe
  2⤵
  PID:5052
- C:\Windows\System\onqLfOG.exe
  C:\Windows\System\onqLfOG.exe
  2⤵
  PID:1640
- C:\Windows\System\eXxlxVz.exe
  C:\Windows\System\eXxlxVz.exe
  2⤵
  PID:1928
- C:\Windows\System\Amckyxj.exe
  C:\Windows\System\Amckyxj.exe
  2⤵
  PID:4948
- C:\Windows\System\YQPjXyd.exe
  C:\Windows\System\YQPjXyd.exe
  2⤵
  PID:1076
- C:\Windows\System\zpNwVCp.exe
  C:\Windows\System\zpNwVCp.exe
  2⤵
  PID:2252
- C:\Windows\System\KJhxofC.exe
  C:\Windows\System\KJhxofC.exe
  2⤵
  PID:2424
- C:\Windows\System\VrpQTCN.exe
  C:\Windows\System\VrpQTCN.exe
  2⤵
  PID:5136
- C:\Windows\System\QoxVUKV.exe
  C:\Windows\System\QoxVUKV.exe
  2⤵
  PID:5168
- C:\Windows\System\LbgVYbm.exe
  C:\Windows\System\LbgVYbm.exe
  2⤵
  PID:5216
- C:\Windows\System\JJooDBw.exe
  C:\Windows\System\JJooDBw.exe
  2⤵
  PID:5252
- C:\Windows\System\RkXpsrd.exe
  C:\Windows\System\RkXpsrd.exe
  2⤵
  PID:5276
- C:\Windows\System\zHXjjUd.exe
  C:\Windows\System\zHXjjUd.exe
  2⤵
  PID:5308
- C:\Windows\System\hVWFYjN.exe
  C:\Windows\System\hVWFYjN.exe
  2⤵
  PID:5340
- C:\Windows\System\gdvjqfw.exe
  C:\Windows\System\gdvjqfw.exe
  2⤵
  PID:5376
- C:\Windows\System\uAmrMiG.exe
  C:\Windows\System\uAmrMiG.exe
  2⤵
  PID:5436
- C:\Windows\System\ZmZjOjQ.exe
  C:\Windows\System\ZmZjOjQ.exe
  2⤵
  PID:5512
- C:\Windows\System\nVDrIWy.exe
  C:\Windows\System\nVDrIWy.exe
  2⤵
  PID:5556
- C:\Windows\System\XNmsUjJ.exe
  C:\Windows\System\XNmsUjJ.exe
  2⤵
  PID:5584
- C:\Windows\System\xZJfjgZ.exe
  C:\Windows\System\xZJfjgZ.exe
  2⤵
  PID:5620
- C:\Windows\System\UExXEzb.exe
  C:\Windows\System\UExXEzb.exe
  2⤵
  PID:5668
- C:\Windows\System\KAZLYel.exe
  C:\Windows\System\KAZLYel.exe
  2⤵
  PID:5708
- C:\Windows\System\tjGpwpv.exe
  C:\Windows\System\tjGpwpv.exe
  2⤵
  PID:5728
- C:\Windows\System\VzqekUo.exe
  C:\Windows\System\VzqekUo.exe
  2⤵
  PID:5764
- C:\Windows\System\XBjRIqr.exe
  C:\Windows\System\XBjRIqr.exe
  2⤵
  PID:5796
- C:\Windows\System\WSNBFFd.exe
  C:\Windows\System\WSNBFFd.exe
  2⤵
  PID:5840
- C:\Windows\System\OixPvgX.exe
  C:\Windows\System\OixPvgX.exe
  2⤵
  PID:5868
- C:\Windows\System\iKuiAjD.exe
  C:\Windows\System\iKuiAjD.exe
  2⤵
  PID:5900
- C:\Windows\System\tQXzEFc.exe
  C:\Windows\System\tQXzEFc.exe
  2⤵
  PID:5928
- C:\Windows\System\NMgmSnt.exe
  C:\Windows\System\NMgmSnt.exe
  2⤵
  PID:5964
- C:\Windows\System\JdTtLkQ.exe
  C:\Windows\System\JdTtLkQ.exe
  2⤵
  PID:6008
- C:\Windows\System\RvXxwsl.exe
  C:\Windows\System\RvXxwsl.exe
  2⤵
  PID:6040
- C:\Windows\System\CfBmFLW.exe
  C:\Windows\System\CfBmFLW.exe
  2⤵
  PID:6068
- C:\Windows\System\AHRyRTx.exe
  C:\Windows\System\AHRyRTx.exe
  2⤵
  PID:6100
- C:\Windows\System\AAisaeu.exe
  C:\Windows\System\AAisaeu.exe
  2⤵
  PID:6128
- C:\Windows\System\ILMxdGZ.exe
  C:\Windows\System\ILMxdGZ.exe
  2⤵
  PID:3596
- C:\Windows\System\QjTJrfn.exe
  C:\Windows\System\QjTJrfn.exe
  2⤵
  PID:3512
- C:\Windows\System\uOPJlTv.exe
  C:\Windows\System\uOPJlTv.exe
  2⤵
  PID:2588
- C:\Windows\System\rLaNMdt.exe
  C:\Windows\System\rLaNMdt.exe
  2⤵
  PID:5176
- C:\Windows\System\talAXHR.exe
  C:\Windows\System\talAXHR.exe
  2⤵
  PID:4976
- C:\Windows\System\sCWEXXA.exe
  C:\Windows\System\sCWEXXA.exe
  2⤵
  PID:5260
- C:\Windows\System\uGIwBeV.exe
  C:\Windows\System\uGIwBeV.exe
  2⤵
  PID:5356
- C:\Windows\System\GtuCItp.exe
  C:\Windows\System\GtuCItp.exe
  2⤵
  PID:5492
- C:\Windows\System\hVLUhNM.exe
  C:\Windows\System\hVLUhNM.exe
  2⤵
  PID:5416
- C:\Windows\System\PkpHTOP.exe
  C:\Windows\System\PkpHTOP.exe
  2⤵
  PID:5580
- C:\Windows\System\kgkGdbM.exe
  C:\Windows\System\kgkGdbM.exe
  2⤵
  PID:5652
- C:\Windows\System\dxjvdBr.exe
  C:\Windows\System\dxjvdBr.exe
  2⤵
  PID:5720
- C:\Windows\System\eudSysq.exe
  C:\Windows\System\eudSysq.exe
  2⤵
  PID:5908
- C:\Windows\System\QPdbJAX.exe
  C:\Windows\System\QPdbJAX.exe
  2⤵
  PID:5960
- C:\Windows\System\eewtTij.exe
  C:\Windows\System\eewtTij.exe
  2⤵
  PID:6028
- C:\Windows\System\HmFlJFC.exe
  C:\Windows\System\HmFlJFC.exe
  2⤵
  PID:6136
- C:\Windows\System\SULAaYE.exe
  C:\Windows\System\SULAaYE.exe
  2⤵
  PID:3216
- C:\Windows\System\VBOSBHe.exe
  C:\Windows\System\VBOSBHe.exe
  2⤵
  PID:5156
- C:\Windows\System\tUrdeDj.exe
  C:\Windows\System\tUrdeDj.exe
  2⤵
  PID:5268
- C:\Windows\System\CQZuCys.exe
  C:\Windows\System\CQZuCys.exe
  2⤵
  PID:5544
- C:\Windows\System\FegIqDu.exe
  C:\Windows\System\FegIqDu.exe
  2⤵
  PID:5696
- C:\Windows\System\zENgNFe.exe
  C:\Windows\System\zENgNFe.exe
  2⤵
  PID:6016
- C:\Windows\System\OKbIZaA.exe
  C:\Windows\System\OKbIZaA.exe
  2⤵
  PID:1600
- C:\Windows\System\GUxJtDT.exe
  C:\Windows\System\GUxJtDT.exe
  2⤵
  PID:5244
- C:\Windows\System\qnKbThj.exe
  C:\Windows\System\qnKbThj.exe
  2⤵
  PID:6052
- C:\Windows\System\fImegnL.exe
  C:\Windows\System\fImegnL.exe
  2⤵
  PID:5524
- C:\Windows\System\ReDcqTz.exe
  C:\Windows\System\ReDcqTz.exe
  2⤵
  PID:6112
- C:\Windows\System\sgIQbNc.exe
  C:\Windows\System\sgIQbNc.exe
  2⤵
  PID:6172
- C:\Windows\System\eUmYVcx.exe
  C:\Windows\System\eUmYVcx.exe
  2⤵
  PID:6196
- C:\Windows\System\OFvVQqz.exe
  C:\Windows\System\OFvVQqz.exe
  2⤵
  PID:6224
- C:\Windows\System\HvxLrPe.exe
  C:\Windows\System\HvxLrPe.exe
  2⤵
  PID:6252
- C:\Windows\System\jZMbMse.exe
  C:\Windows\System\jZMbMse.exe
  2⤵
  PID:6288
- C:\Windows\System\YouhGYF.exe
  C:\Windows\System\YouhGYF.exe
  2⤵
  PID:6316
- C:\Windows\System\HMPrTAO.exe
  C:\Windows\System\HMPrTAO.exe
  2⤵
  PID:6344
- C:\Windows\System\wlKVRVG.exe
  C:\Windows\System\wlKVRVG.exe
  2⤵
  PID:6384
- C:\Windows\System\VXIRVqO.exe
  C:\Windows\System\VXIRVqO.exe
  2⤵
  PID:6400
- C:\Windows\System\FAUJGei.exe
  C:\Windows\System\FAUJGei.exe
  2⤵
  PID:6436
- C:\Windows\System\KpDdMNb.exe
  C:\Windows\System\KpDdMNb.exe
  2⤵
  PID:6464
- C:\Windows\System\PwBErCr.exe
  C:\Windows\System\PwBErCr.exe
  2⤵
  PID:6500
- C:\Windows\System\wWNFbUJ.exe
  C:\Windows\System\wWNFbUJ.exe
  2⤵
  PID:6524
- C:\Windows\System\YxLSlXN.exe
  C:\Windows\System\YxLSlXN.exe
  2⤵
  PID:6552
- C:\Windows\System\yuobiGd.exe
  C:\Windows\System\yuobiGd.exe
  2⤵
  PID:6584
- C:\Windows\System\mWGmOMh.exe
  C:\Windows\System\mWGmOMh.exe
  2⤵
  PID:6620
- C:\Windows\System\jDihNvI.exe
  C:\Windows\System\jDihNvI.exe
  2⤵
  PID:6644
- C:\Windows\System\numEmdh.exe
  C:\Windows\System\numEmdh.exe
  2⤵
  PID:6676
- C:\Windows\System\cUnBJke.exe
  C:\Windows\System\cUnBJke.exe
  2⤵
  PID:6716
- C:\Windows\System\SvQdtnU.exe
  C:\Windows\System\SvQdtnU.exe
  2⤵
  PID:6748
- C:\Windows\System\BMbnRmy.exe
  C:\Windows\System\BMbnRmy.exe
  2⤵
  PID:6772
- C:\Windows\System\khoLbcE.exe
  C:\Windows\System\khoLbcE.exe
  2⤵
  PID:6804
- C:\Windows\System\VhhwccB.exe
  C:\Windows\System\VhhwccB.exe
  2⤵
  PID:6848
- C:\Windows\System\cYUYRoM.exe
  C:\Windows\System\cYUYRoM.exe
  2⤵
  PID:6900
- C:\Windows\System\Qjbract.exe
  C:\Windows\System\Qjbract.exe
  2⤵
  PID:6952
- C:\Windows\System\GXIfBuE.exe
  C:\Windows\System\GXIfBuE.exe
  2⤵
  PID:7012
- C:\Windows\System\HeIKWXH.exe
  C:\Windows\System\HeIKWXH.exe
  2⤵
  PID:7088
- C:\Windows\System\oFlnbie.exe
  C:\Windows\System\oFlnbie.exe
  2⤵
  PID:7128
- C:\Windows\System\IcJxOHg.exe
  C:\Windows\System\IcJxOHg.exe
  2⤵
  PID:7152
- C:\Windows\System\TVpooqK.exe
  C:\Windows\System\TVpooqK.exe
  2⤵
  PID:6188
- C:\Windows\System\JRLLBhz.exe
  C:\Windows\System\JRLLBhz.exe
  2⤵
  PID:6272
- C:\Windows\System\stmUCTM.exe
  C:\Windows\System\stmUCTM.exe
  2⤵
  PID:6416
- C:\Windows\System\mONzVRI.exe
  C:\Windows\System\mONzVRI.exe
  2⤵
  PID:6452
- C:\Windows\System\ffxrbry.exe
  C:\Windows\System\ffxrbry.exe
  2⤵
  PID:6536
- C:\Windows\System\uJFranx.exe
  C:\Windows\System\uJFranx.exe
  2⤵
  PID:6568
- C:\Windows\System\qZeMtHE.exe
  C:\Windows\System\qZeMtHE.exe
  2⤵
  PID:6652
- C:\Windows\System\dKwKOJF.exe
  C:\Windows\System\dKwKOJF.exe
  2⤵
  PID:6704
- C:\Windows\System\MMOlHsv.exe
  C:\Windows\System\MMOlHsv.exe
  2⤵
  PID:6780
- C:\Windows\System\hyIcQVP.exe
  C:\Windows\System\hyIcQVP.exe
  2⤵
  PID:6892
- C:\Windows\System\JXtwZRS.exe
  C:\Windows\System\JXtwZRS.exe
  2⤵
  PID:6988
- C:\Windows\System\aMKTSfw.exe
  C:\Windows\System\aMKTSfw.exe
  2⤵
  PID:7116
- C:\Windows\System\aTLeIoj.exe
  C:\Windows\System\aTLeIoj.exe
  2⤵
  PID:6160
- C:\Windows\System\aqzUBqS.exe
  C:\Windows\System\aqzUBqS.exe
  2⤵
  PID:6428
- C:\Windows\System\gHQfSKE.exe
  C:\Windows\System\gHQfSKE.exe
  2⤵
  PID:6560
- C:\Windows\System\sSosEOk.exe
  C:\Windows\System\sSosEOk.exe
  2⤵
  PID:3264
- C:\Windows\System\eDYKWSG.exe
  C:\Windows\System\eDYKWSG.exe
  2⤵
  PID:396
- C:\Windows\System\jjmYAlb.exe
  C:\Windows\System\jjmYAlb.exe
  2⤵
  PID:6240
- C:\Windows\System\VoaXJTk.exe
  C:\Windows\System\VoaXJTk.exe
  2⤵
  PID:6616
- C:\Windows\System\prGmjeM.exe
  C:\Windows\System\prGmjeM.exe
  2⤵
  PID:6916
- C:\Windows\System\uejpkSf.exe
  C:\Windows\System\uejpkSf.exe
  2⤵
  PID:6688
- C:\Windows\System\uynzgLH.exe
  C:\Windows\System\uynzgLH.exe
  2⤵
  PID:7180
- C:\Windows\System\hWTxFuc.exe
  C:\Windows\System\hWTxFuc.exe
  2⤵
  PID:7208
- C:\Windows\System\FvVLnzf.exe
  C:\Windows\System\FvVLnzf.exe
  2⤵
  PID:7248
- C:\Windows\System\JXBvvon.exe
  C:\Windows\System\JXBvvon.exe
  2⤵
  PID:7308
- C:\Windows\System\aELxRrz.exe
  C:\Windows\System\aELxRrz.exe
  2⤵
  PID:7352
- C:\Windows\System\odbTKHE.exe
  C:\Windows\System\odbTKHE.exe
  2⤵
  PID:7376
- C:\Windows\System\BWvPpxZ.exe
  C:\Windows\System\BWvPpxZ.exe
  2⤵
  PID:7420
- C:\Windows\System\ouJJpGL.exe
  C:\Windows\System\ouJJpGL.exe
  2⤵
  PID:7436
- C:\Windows\System\jMoVwTa.exe
  C:\Windows\System\jMoVwTa.exe
  2⤵
  PID:7496
- C:\Windows\System\VhqSEsW.exe
  C:\Windows\System\VhqSEsW.exe
  2⤵
  PID:7536
- C:\Windows\System\muaVLcu.exe
  C:\Windows\System\muaVLcu.exe
  2⤵
  PID:7564
- C:\Windows\System\tTaDHjE.exe
  C:\Windows\System\tTaDHjE.exe
  2⤵
  PID:7600
- C:\Windows\System\cVKuYDC.exe
  C:\Windows\System\cVKuYDC.exe
  2⤵
  PID:7640
- C:\Windows\System\cXgVcTK.exe
  C:\Windows\System\cXgVcTK.exe
  2⤵
  PID:7668
- C:\Windows\System\yBSWPAt.exe
  C:\Windows\System\yBSWPAt.exe
  2⤵
  PID:7692
- C:\Windows\System\TSWlxWB.exe
  C:\Windows\System\TSWlxWB.exe
  2⤵
  PID:7720
- C:\Windows\System\QkDdTIc.exe
  C:\Windows\System\QkDdTIc.exe
  2⤵
  PID:7756
- C:\Windows\System\VrALbaH.exe
  C:\Windows\System\VrALbaH.exe
  2⤵
  PID:7780
- C:\Windows\System\UOhgBMd.exe
  C:\Windows\System\UOhgBMd.exe
  2⤵
  PID:7812
- C:\Windows\System\YTrJhfS.exe
  C:\Windows\System\YTrJhfS.exe
  2⤵
  PID:7844
- C:\Windows\System\MFqNYVK.exe
  C:\Windows\System\MFqNYVK.exe
  2⤵
  PID:7864
- C:\Windows\System\mkRRNlf.exe
  C:\Windows\System\mkRRNlf.exe
  2⤵
  PID:7892
- C:\Windows\System\uNKSvQr.exe
  C:\Windows\System\uNKSvQr.exe
  2⤵
  PID:7924
- C:\Windows\System\PqyQBFk.exe
  C:\Windows\System\PqyQBFk.exe
  2⤵
  PID:7960
- C:\Windows\System\wIXBLQc.exe
  C:\Windows\System\wIXBLQc.exe
  2⤵
  PID:7996
- C:\Windows\System\tAhXXTD.exe
  C:\Windows\System\tAhXXTD.exe
  2⤵
  PID:8024
- C:\Windows\System\FssYiDm.exe
  C:\Windows\System\FssYiDm.exe
  2⤵
  PID:8044
- C:\Windows\System\fXVhazs.exe
  C:\Windows\System\fXVhazs.exe
  2⤵
  PID:8076
- C:\Windows\System\bwoVSaG.exe
  C:\Windows\System\bwoVSaG.exe
  2⤵
  PID:8100
- C:\Windows\System\UJTLwRN.exe
  C:\Windows\System\UJTLwRN.exe
  2⤵
  PID:8128
- C:\Windows\System\NGVAKKu.exe
  C:\Windows\System\NGVAKKu.exe
  2⤵
  PID:8176
- C:\Windows\System\GtuNIJV.exe
  C:\Windows\System\GtuNIJV.exe
  2⤵
  PID:7204
- C:\Windows\System\oVGafSf.exe
  C:\Windows\System\oVGafSf.exe
  2⤵
  PID:7320
- C:\Windows\System\ERsAqvw.exe
  C:\Windows\System\ERsAqvw.exe
  2⤵
  PID:7372
- C:\Windows\System\vNGZYEk.exe
  C:\Windows\System\vNGZYEk.exe
  2⤵
  PID:7428
- C:\Windows\System\QbBBasq.exe
  C:\Windows\System\QbBBasq.exe
  2⤵
  PID:7332
- C:\Windows\System\oVougTF.exe
  C:\Windows\System\oVougTF.exe
  2⤵
  PID:7532
- C:\Windows\System\WSUHtJL.exe
  C:\Windows\System\WSUHtJL.exe
  2⤵
  PID:7588
- C:\Windows\System\jYXDNCV.exe
  C:\Windows\System\jYXDNCV.exe
  2⤵
  PID:7676
- C:\Windows\System\eDNRuPd.exe
  C:\Windows\System\eDNRuPd.exe
  2⤵
  PID:7740
- C:\Windows\System\LyyrCBj.exe
  C:\Windows\System\LyyrCBj.exe
  2⤵
  PID:7800
- C:\Windows\System\EdEGpEd.exe
  C:\Windows\System\EdEGpEd.exe
  2⤵
  PID:7856
- C:\Windows\System\HULrniw.exe
  C:\Windows\System\HULrniw.exe
  2⤵
  PID:7936
- C:\Windows\System\EFeCDmp.exe
  C:\Windows\System\EFeCDmp.exe
  2⤵
  PID:8012
- C:\Windows\System\wQPEDmc.exe
  C:\Windows\System\wQPEDmc.exe
  2⤵
  PID:7528
- C:\Windows\System\zFppNfj.exe
  C:\Windows\System\zFppNfj.exe
  2⤵
  PID:7708
- C:\Windows\System\RgfBIle.exe
  C:\Windows\System\RgfBIle.exe
  2⤵
  PID:8056
- C:\Windows\System\fzjLGpl.exe
  C:\Windows\System\fzjLGpl.exe
  2⤵
  PID:8116
- C:\Windows\System\VSdwoms.exe
  C:\Windows\System\VSdwoms.exe
  2⤵
  PID:7176
- C:\Windows\System\zPnolRQ.exe
  C:\Windows\System\zPnolRQ.exe
  2⤵
  PID:8184
- C:\Windows\System\GBHnlhn.exe
  C:\Windows\System\GBHnlhn.exe
  2⤵
  PID:7396
- C:\Windows\System\FCRkokI.exe
  C:\Windows\System\FCRkokI.exe
  2⤵
  PID:7276
- C:\Windows\System\tdxsxhm.exe
  C:\Windows\System\tdxsxhm.exe
  2⤵
  PID:7576
- C:\Windows\System\SPlRsCI.exe
  C:\Windows\System\SPlRsCI.exe
  2⤵
  PID:7736
- C:\Windows\System\fUSXAof.exe
  C:\Windows\System\fUSXAof.exe
  2⤵
  PID:7984
- C:\Windows\System\aJtlRsS.exe
  C:\Windows\System\aJtlRsS.exe
  2⤵
  PID:8092
- C:\Windows\System\xMGDVZD.exe
  C:\Windows\System\xMGDVZD.exe
  2⤵
  PID:1456
- C:\Windows\System\sosPVYs.exe
  C:\Windows\System\sosPVYs.exe
  2⤵
  PID:4964
- C:\Windows\System\TyLNyLj.exe
  C:\Windows\System\TyLNyLj.exe
  2⤵
  PID:1932
- C:\Windows\System\HHfXBAW.exe
  C:\Windows\System\HHfXBAW.exe
  2⤵
  PID:2768
- C:\Windows\System\iGKTGCx.exe
  C:\Windows\System\iGKTGCx.exe
  2⤵
  PID:7368
- C:\Windows\System\PuezLdH.exe
  C:\Windows\System\PuezLdH.exe
  2⤵
  PID:8148
- C:\Windows\System\MGxdCmj.exe
  C:\Windows\System\MGxdCmj.exe
  2⤵
  PID:8032
- C:\Windows\System\deQZTia.exe
  C:\Windows\System\deQZTia.exe
  2⤵
  PID:1860
- C:\Windows\System\UgkGpXx.exe
  C:\Windows\System\UgkGpXx.exe
  2⤵
  PID:6264
- C:\Windows\System\OWNXDZb.exe
  C:\Windows\System\OWNXDZb.exe
  2⤵
  PID:7716
- C:\Windows\System\wPrtXuF.exe
  C:\Windows\System\wPrtXuF.exe
  2⤵
  PID:3632
- C:\Windows\System\xoAlYMt.exe
  C:\Windows\System\xoAlYMt.exe
  2⤵
  PID:7920
- C:\Windows\System\taAGdNO.exe
  C:\Windows\System\taAGdNO.exe
  2⤵
  PID:7272
- C:\Windows\System\VEoAZSE.exe
  C:\Windows\System\VEoAZSE.exe
  2⤵
  PID:8220
- C:\Windows\System\epNlkuE.exe
  C:\Windows\System\epNlkuE.exe
  2⤵
  PID:8248
- C:\Windows\System\JbKntMC.exe
  C:\Windows\System\JbKntMC.exe
  2⤵
  PID:8284
- C:\Windows\System\PTWsyhq.exe
  C:\Windows\System\PTWsyhq.exe
  2⤵
  PID:8312
- C:\Windows\System\SZRClIx.exe
  C:\Windows\System\SZRClIx.exe
  2⤵
  PID:8336
- C:\Windows\System\PfZQclc.exe
  C:\Windows\System\PfZQclc.exe
  2⤵
  PID:8368
- C:\Windows\System\hQUNRJp.exe
  C:\Windows\System\hQUNRJp.exe
  2⤵
  PID:8392
- C:\Windows\System\BYJsYar.exe
  C:\Windows\System\BYJsYar.exe
  2⤵
  PID:8428
- C:\Windows\System\fJKKgXI.exe
  C:\Windows\System\fJKKgXI.exe
  2⤵
  PID:8448
- C:\Windows\System\bGQskBb.exe
  C:\Windows\System\bGQskBb.exe
  2⤵
  PID:8476
- C:\Windows\System\KJpTVrO.exe
  C:\Windows\System\KJpTVrO.exe
  2⤵
  PID:8512
- C:\Windows\System\mmcHRKl.exe
  C:\Windows\System\mmcHRKl.exe
  2⤵
  PID:8536
- C:\Windows\System\BHOZora.exe
  C:\Windows\System\BHOZora.exe
  2⤵
  PID:8560
- C:\Windows\System\VsftNkj.exe
  C:\Windows\System\VsftNkj.exe
  2⤵
  PID:8588
- C:\Windows\System\BhkTLmf.exe
  C:\Windows\System\BhkTLmf.exe
  2⤵
  PID:8620
- C:\Windows\System\TuxMiwb.exe
  C:\Windows\System\TuxMiwb.exe
  2⤵
  PID:8660
- C:\Windows\System\gEqQyQL.exe
  C:\Windows\System\gEqQyQL.exe
  2⤵
  PID:8676
- C:\Windows\System\LQstWXG.exe
  C:\Windows\System\LQstWXG.exe
  2⤵
  PID:8708
- C:\Windows\System\AzYvJWw.exe
  C:\Windows\System\AzYvJWw.exe
  2⤵
  PID:8732
- C:\Windows\System\UphUxyV.exe
  C:\Windows\System\UphUxyV.exe
  2⤵
  PID:8760
- C:\Windows\System\udxYjKw.exe
  C:\Windows\System\udxYjKw.exe
  2⤵
  PID:8788
- C:\Windows\System\ysczPWK.exe
  C:\Windows\System\ysczPWK.exe
  2⤵
  PID:8816
- C:\Windows\System\HJMIIrW.exe
  C:\Windows\System\HJMIIrW.exe
  2⤵
  PID:8852
- C:\Windows\System\zowwSVw.exe
  C:\Windows\System\zowwSVw.exe
  2⤵
  PID:8872
- C:\Windows\System\vaGqLWc.exe
  C:\Windows\System\vaGqLWc.exe
  2⤵
  PID:8900
- C:\Windows\System\VYXtbqG.exe
  C:\Windows\System\VYXtbqG.exe
  2⤵
  PID:8932
- C:\Windows\System\AnFrvgT.exe
  C:\Windows\System\AnFrvgT.exe
  2⤵
  PID:8956
- C:\Windows\System\sEDasjP.exe
  C:\Windows\System\sEDasjP.exe
  2⤵
  PID:8984
- C:\Windows\System\ZntcBxR.exe
  C:\Windows\System\ZntcBxR.exe
  2⤵
  PID:9012
- C:\Windows\System\SMrvJzl.exe
  C:\Windows\System\SMrvJzl.exe
  2⤵
  PID:9048
- C:\Windows\System\wjrbIxk.exe
  C:\Windows\System\wjrbIxk.exe
  2⤵
  PID:9068
- C:\Windows\System\qejJxxz.exe
  C:\Windows\System\qejJxxz.exe
  2⤵
  PID:9096
- C:\Windows\System\RWiqLOl.exe
  C:\Windows\System\RWiqLOl.exe
  2⤵
  PID:9124
- C:\Windows\System\YZSPtSi.exe
  C:\Windows\System\YZSPtSi.exe
  2⤵
  PID:9152
- C:\Windows\System\pUlzhRp.exe
  C:\Windows\System\pUlzhRp.exe
  2⤵
  PID:9180
- C:\Windows\System\jsKWiPr.exe
  C:\Windows\System\jsKWiPr.exe
  2⤵
  PID:8156
- C:\Windows\System\vhvCnxG.exe
  C:\Windows\System\vhvCnxG.exe
  2⤵
  PID:8240
- C:\Windows\System\SNnLwVF.exe
  C:\Windows\System\SNnLwVF.exe
  2⤵
  PID:8328
- C:\Windows\System\mcRqpmY.exe
  C:\Windows\System\mcRqpmY.exe
  2⤵
  PID:8380
- C:\Windows\System\CiimiyG.exe
  C:\Windows\System\CiimiyG.exe
  2⤵
  PID:8468
- C:\Windows\System\GrPdKbt.exe
  C:\Windows\System\GrPdKbt.exe
  2⤵
  PID:8552
- C:\Windows\System\LVIwnQp.exe
  C:\Windows\System\LVIwnQp.exe
  2⤵
  PID:8608
- C:\Windows\System\abokbox.exe
  C:\Windows\System\abokbox.exe
  2⤵
  PID:8640
- C:\Windows\System\WMQhlSX.exe
  C:\Windows\System\WMQhlSX.exe
  2⤵
  PID:8724
- C:\Windows\System\ChvIXFm.exe
  C:\Windows\System\ChvIXFm.exe
  2⤵
  PID:8812
- C:\Windows\System\MmgDilN.exe
  C:\Windows\System\MmgDilN.exe
  2⤵
  PID:8868
- C:\Windows\System\mftTvns.exe
  C:\Windows\System\mftTvns.exe
  2⤵
  PID:8924
- C:\Windows\System\AMeVrnq.exe
  C:\Windows\System\AMeVrnq.exe
  2⤵
  PID:9000
- C:\Windows\System\jAOttzf.exe
  C:\Windows\System\jAOttzf.exe
  2⤵
  PID:9060
- C:\Windows\System\qReoDad.exe
  C:\Windows\System\qReoDad.exe
  2⤵
  PID:9116
- C:\Windows\System\wKilMib.exe
  C:\Windows\System\wKilMib.exe
  2⤵
  PID:9176
- C:\Windows\System\tsKKkoM.exe
  C:\Windows\System\tsKKkoM.exe
  2⤵
  PID:8272
- C:\Windows\System\qRwcfFC.exe
  C:\Windows\System\qRwcfFC.exe
  2⤵
  PID:8436
- C:\Windows\System\uzkxHUJ.exe
  C:\Windows\System\uzkxHUJ.exe
  2⤵
  PID:8580
- C:\Windows\System\JhfnPWz.exe
  C:\Windows\System\JhfnPWz.exe
  2⤵
  PID:8752
- C:\Windows\System\zRKKNCQ.exe
  C:\Windows\System\zRKKNCQ.exe
  2⤵
  PID:8916
- C:\Windows\System\aWUaQaS.exe
  C:\Windows\System\aWUaQaS.exe
  2⤵
  PID:9108
- C:\Windows\System\aEjutXk.exe
  C:\Windows\System\aEjutXk.exe
  2⤵
  PID:8348
- C:\Windows\System\SLlSmcD.exe
  C:\Windows\System\SLlSmcD.exe
  2⤵
  PID:8572
- C:\Windows\System\ykxclTw.exe
  C:\Windows\System\ykxclTw.exe
  2⤵
  PID:8892
- C:\Windows\System\GWrdFCL.exe
  C:\Windows\System\GWrdFCL.exe
  2⤵
  PID:9172
- C:\Windows\System\jNequFS.exe
  C:\Windows\System\jNequFS.exe
  2⤵
  PID:9092
- C:\Windows\System\hTxOehv.exe
  C:\Windows\System\hTxOehv.exe
  2⤵
  PID:8860
- C:\Windows\System\KZdTaqC.exe
  C:\Windows\System\KZdTaqC.exe
  2⤵
  PID:9244
- C:\Windows\System\ydvtPFR.exe
  C:\Windows\System\ydvtPFR.exe
  2⤵
  PID:9272
- C:\Windows\System\HfTtsds.exe
  C:\Windows\System\HfTtsds.exe
  2⤵
  PID:9300
- C:\Windows\System\BzKCpvm.exe
  C:\Windows\System\BzKCpvm.exe
  2⤵
  PID:9328
- C:\Windows\System\kMQreLK.exe
  C:\Windows\System\kMQreLK.exe
  2⤵
  PID:9356
- C:\Windows\System\qBYeFNa.exe
  C:\Windows\System\qBYeFNa.exe
  2⤵
  PID:9384
- C:\Windows\System\AyaqDyu.exe
  C:\Windows\System\AyaqDyu.exe
  2⤵
  PID:9412
- C:\Windows\System\FocjCnx.exe
  C:\Windows\System\FocjCnx.exe
  2⤵
  PID:9440
- C:\Windows\System\EWojRby.exe
  C:\Windows\System\EWojRby.exe
  2⤵
  PID:9468
- C:\Windows\System\bKLGjce.exe
  C:\Windows\System\bKLGjce.exe
  2⤵
  PID:9496
- C:\Windows\System\GQFghUP.exe
  C:\Windows\System\GQFghUP.exe
  2⤵
  PID:9524
- C:\Windows\System\UngmVpZ.exe
  C:\Windows\System\UngmVpZ.exe
  2⤵
  PID:9556
- C:\Windows\System\xZclaru.exe
  C:\Windows\System\xZclaru.exe
  2⤵
  PID:9584
- C:\Windows\System\vDYgyzf.exe
  C:\Windows\System\vDYgyzf.exe
  2⤵
  PID:9624
- C:\Windows\System\QYrRcEJ.exe
  C:\Windows\System\QYrRcEJ.exe
  2⤵
  PID:9672
- C:\Windows\System\LEUNTew.exe
  C:\Windows\System\LEUNTew.exe
  2⤵
  PID:9724
- C:\Windows\System\ZzgvYdW.exe
  C:\Windows\System\ZzgvYdW.exe
  2⤵
  PID:9752
- C:\Windows\System\sjUuHPf.exe
  C:\Windows\System\sjUuHPf.exe
  2⤵
  PID:9784
- C:\Windows\System\SjVQRFa.exe
  C:\Windows\System\SjVQRFa.exe
  2⤵
  PID:9808
- C:\Windows\System\zxhMhNa.exe
  C:\Windows\System\zxhMhNa.exe
  2⤵
  PID:9836
- C:\Windows\System\YJwBNVS.exe
  C:\Windows\System\YJwBNVS.exe
  2⤵
  PID:9864
- C:\Windows\System\CyhmUkC.exe
  C:\Windows\System\CyhmUkC.exe
  2⤵
  PID:9892
- C:\Windows\System\czedfpP.exe
  C:\Windows\System\czedfpP.exe
  2⤵
  PID:9920
- C:\Windows\System\rQJFGnB.exe
  C:\Windows\System\rQJFGnB.exe
  2⤵
  PID:9948
- C:\Windows\System\OfMEDtd.exe
  C:\Windows\System\OfMEDtd.exe
  2⤵
  PID:9980
- C:\Windows\System\ihbJern.exe
  C:\Windows\System\ihbJern.exe
  2⤵
  PID:10016
- C:\Windows\System\QqFWwtL.exe
  C:\Windows\System\QqFWwtL.exe
  2⤵
  PID:10032
- C:\Windows\System\pSgTnRP.exe
  C:\Windows\System\pSgTnRP.exe
  2⤵
  PID:10060
- C:\Windows\System\tBCSXRU.exe
  C:\Windows\System\tBCSXRU.exe
  2⤵
  PID:10096
- C:\Windows\System\NRsVQcE.exe
  C:\Windows\System\NRsVQcE.exe
  2⤵
  PID:10124
- C:\Windows\System\GxNjJSK.exe
  C:\Windows\System\GxNjJSK.exe
  2⤵
  PID:10152
- C:\Windows\System\VxbwkhZ.exe
  C:\Windows\System\VxbwkhZ.exe
  2⤵
  PID:10184
- C:\Windows\System\nDdhWAO.exe
  C:\Windows\System\nDdhWAO.exe
  2⤵
  PID:10208
- C:\Windows\System\MRakYMX.exe
  C:\Windows\System\MRakYMX.exe
  2⤵
  PID:10236
- C:\Windows\System\LlyNiNx.exe
  C:\Windows\System\LlyNiNx.exe
  2⤵
  PID:9268
- C:\Windows\System\iZhzXCG.exe
  C:\Windows\System\iZhzXCG.exe
  2⤵
  PID:9340
- C:\Windows\System\woEBftf.exe
  C:\Windows\System\woEBftf.exe
  2⤵
  PID:9404
- C:\Windows\System\cBVHHMg.exe
  C:\Windows\System\cBVHHMg.exe
  2⤵
  PID:9464
- C:\Windows\System\yKsbGUR.exe
  C:\Windows\System\yKsbGUR.exe
  2⤵
  PID:9540
- C:\Windows\System\FwlxBuW.exe
  C:\Windows\System\FwlxBuW.exe
  2⤵
  PID:9600
- C:\Windows\System\LMMiJMl.exe
  C:\Windows\System\LMMiJMl.exe
  2⤵
  PID:9716
- C:\Windows\System\yTGNWoS.exe
  C:\Windows\System\yTGNWoS.exe
  2⤵
  PID:9776
- C:\Windows\System\sDpdngB.exe
  C:\Windows\System\sDpdngB.exe
  2⤵
  PID:9848
- C:\Windows\System\nMBucmL.exe
  C:\Windows\System\nMBucmL.exe
  2⤵
  PID:9912
- C:\Windows\System\ncosRGB.exe
  C:\Windows\System\ncosRGB.exe
  2⤵
  PID:9972
- C:\Windows\System\IDKSVUV.exe
  C:\Windows\System\IDKSVUV.exe
  2⤵
  PID:10048
- C:\Windows\System\XCHCaxX.exe
  C:\Windows\System\XCHCaxX.exe
  2⤵
  PID:10116
- C:\Windows\System\UVIkBOd.exe
  C:\Windows\System\UVIkBOd.exe
  2⤵
  PID:10192
- C:\Windows\System\ubPDZzD.exe
  C:\Windows\System\ubPDZzD.exe
  2⤵
  PID:9236
- C:\Windows\System\cchhIJR.exe
  C:\Windows\System\cchhIJR.exe
  2⤵
  PID:9380
- C:\Windows\System\wehizjw.exe
  C:\Windows\System\wehizjw.exe
  2⤵
  PID:9520
- C:\Windows\System\FkPDqil.exe
  C:\Windows\System\FkPDqil.exe
  2⤵
  PID:9748
- C:\Windows\System\tTRXZzE.exe
  C:\Windows\System\tTRXZzE.exe
  2⤵
  PID:9940
- C:\Windows\System\TWLSLzB.exe
  C:\Windows\System\TWLSLzB.exe
  2⤵
  PID:10028
- C:\Windows\System\STDZWVP.exe
  C:\Windows\System\STDZWVP.exe
  2⤵
  PID:10224
- C:\Windows\System\cBxOYsP.exe
  C:\Windows\System\cBxOYsP.exe
  2⤵
  PID:9492
- C:\Windows\System\npeLsfZ.exe
  C:\Windows\System\npeLsfZ.exe
  2⤵
  PID:9876
- C:\Windows\System\qkrEgLt.exe
  C:\Windows\System\qkrEgLt.exe
  2⤵
  PID:9324
- C:\Windows\System\yXFAhXG.exe
  C:\Windows\System\yXFAhXG.exe
  2⤵
  PID:10172
- C:\Windows\System\iHqgGIF.exe
  C:\Windows\System\iHqgGIF.exe
  2⤵
  PID:10248
- C:\Windows\System\xqJhfqq.exe
  C:\Windows\System\xqJhfqq.exe
  2⤵
  PID:10284
- C:\Windows\System\NDFlcpp.exe
  C:\Windows\System\NDFlcpp.exe
  2⤵
  PID:10308
- C:\Windows\System\XdPyjwy.exe
  C:\Windows\System\XdPyjwy.exe
  2⤵
  PID:10332
- C:\Windows\System\ONUHglE.exe
  C:\Windows\System\ONUHglE.exe
  2⤵
  PID:10360
- C:\Windows\System\yUteEMw.exe
  C:\Windows\System\yUteEMw.exe
  2⤵
  PID:10388
- C:\Windows\System\ogTUbZU.exe
  C:\Windows\System\ogTUbZU.exe
  2⤵
  PID:10416
- C:\Windows\System\OqMlpOt.exe
  C:\Windows\System\OqMlpOt.exe
  2⤵
  PID:10444
- C:\Windows\System\oMSzeFs.exe
  C:\Windows\System\oMSzeFs.exe
  2⤵
  PID:10472
- C:\Windows\System\xzxaFJh.exe
  C:\Windows\System\xzxaFJh.exe
  2⤵
  PID:10500
- C:\Windows\System\VBGAbhV.exe
  C:\Windows\System\VBGAbhV.exe
  2⤵
  PID:10532
- C:\Windows\System\jDovZPE.exe
  C:\Windows\System\jDovZPE.exe
  2⤵
  PID:10556
- C:\Windows\System\yRFcRZB.exe
  C:\Windows\System\yRFcRZB.exe
  2⤵
  PID:10592
- C:\Windows\System\eUTfaCL.exe
  C:\Windows\System\eUTfaCL.exe
  2⤵
  PID:10612
- C:\Windows\System\stgJMUP.exe
  C:\Windows\System\stgJMUP.exe
  2⤵
  PID:10640
- C:\Windows\System\gZqizOk.exe
  C:\Windows\System\gZqizOk.exe
  2⤵
  PID:10668
- C:\Windows\System\RuDmvyW.exe
  C:\Windows\System\RuDmvyW.exe
  2⤵
  PID:10700
- C:\Windows\System\kiJZdBu.exe
  C:\Windows\System\kiJZdBu.exe
  2⤵
  PID:10736
- C:\Windows\System\BwqUwUt.exe
  C:\Windows\System\BwqUwUt.exe
  2⤵
  PID:10756
- C:\Windows\System\PPxXRQi.exe
  C:\Windows\System\PPxXRQi.exe
  2⤵
  PID:10784
- C:\Windows\System\tOpbKpQ.exe
  C:\Windows\System\tOpbKpQ.exe
  2⤵
  PID:10812
- C:\Windows\System\yUSYPMW.exe
  C:\Windows\System\yUSYPMW.exe
  2⤵
  PID:10848
- C:\Windows\System\ccYzSvj.exe
  C:\Windows\System\ccYzSvj.exe
  2⤵
  PID:10868
- C:\Windows\System\jySBhxE.exe
  C:\Windows\System\jySBhxE.exe
  2⤵
  PID:10904
- C:\Windows\System\qnOGKCF.exe
  C:\Windows\System\qnOGKCF.exe
  2⤵
  PID:10924
- C:\Windows\System\FmFyUgC.exe
  C:\Windows\System\FmFyUgC.exe
  2⤵
  PID:10952
- C:\Windows\System\JboBCTu.exe
  C:\Windows\System\JboBCTu.exe
  2⤵
  PID:10980
- C:\Windows\System\yLquWom.exe
  C:\Windows\System\yLquWom.exe
  2⤵
  PID:11008
- C:\Windows\System\YdAWmvi.exe
  C:\Windows\System\YdAWmvi.exe
  2⤵
  PID:11036
- C:\Windows\System\fmoaVYX.exe
  C:\Windows\System\fmoaVYX.exe
  2⤵
  PID:11076
- C:\Windows\System\dzNXPld.exe
  C:\Windows\System\dzNXPld.exe
  2⤵
  PID:11096
- C:\Windows\System\mdbcuKC.exe
  C:\Windows\System\mdbcuKC.exe
  2⤵
  PID:11128
- C:\Windows\System\AEDEwsg.exe
  C:\Windows\System\AEDEwsg.exe
  2⤵
  PID:11152
- C:\Windows\System\fcygZTb.exe
  C:\Windows\System\fcygZTb.exe
  2⤵
  PID:11184
- C:\Windows\System\zHgsHit.exe
  C:\Windows\System\zHgsHit.exe
  2⤵
  PID:11208
- C:\Windows\System\GEFfABC.exe
  C:\Windows\System\GEFfABC.exe
  2⤵
  PID:11236
- C:\Windows\System\upAYapm.exe
  C:\Windows\System\upAYapm.exe
  2⤵
  PID:10108
- C:\Windows\System\HMTiQur.exe
  C:\Windows\System\HMTiQur.exe
  2⤵
  PID:10300
- C:\Windows\System\MJjZctV.exe
  C:\Windows\System\MJjZctV.exe
  2⤵
  PID:10384
- C:\Windows\System\KeVwzVV.exe
  C:\Windows\System\KeVwzVV.exe
  2⤵
  PID:10460
- C:\Windows\System\KyZYqUo.exe
  C:\Windows\System\KyZYqUo.exe
  2⤵
  PID:10540
- C:\Windows\System\COPaQbG.exe
  C:\Windows\System\COPaQbG.exe
  2⤵
  PID:10580
- C:\Windows\System\ZBvBalP.exe
  C:\Windows\System\ZBvBalP.exe
  2⤵
  PID:10652
- C:\Windows\System\qADhoYI.exe
  C:\Windows\System\qADhoYI.exe
  2⤵
  PID:10716
- C:\Windows\System\EHjgsWs.exe
  C:\Windows\System\EHjgsWs.exe
  2⤵
  PID:10776
- C:\Windows\System\OazyBou.exe
  C:\Windows\System\OazyBou.exe
  2⤵
  PID:10836
- C:\Windows\System\DtKfFwQ.exe
  C:\Windows\System\DtKfFwQ.exe
  2⤵
  PID:10936
- C:\Windows\System\zsafXmE.exe
  C:\Windows\System\zsafXmE.exe
  2⤵
  PID:10972
- C:\Windows\System\DBeBphC.exe
  C:\Windows\System\DBeBphC.exe
  2⤵
  PID:11060
- C:\Windows\System\EPOKACb.exe
  C:\Windows\System\EPOKACb.exe
  2⤵
  PID:11148
- C:\Windows\System\hZiEoQK.exe
  C:\Windows\System\hZiEoQK.exe
  2⤵
  PID:10376
- C:\Windows\System\yEsdwBo.exe
  C:\Windows\System\yEsdwBo.exe
  2⤵
  PID:10512
- C:\Windows\System\WighNKl.exe
  C:\Windows\System\WighNKl.exe
  2⤵
  PID:10628
- C:\Windows\System\GCzPFhL.exe
  C:\Windows\System\GCzPFhL.exe
  2⤵
  PID:10948
- C:\Windows\System\Kqugvei.exe
  C:\Windows\System\Kqugvei.exe
  2⤵
  PID:11028
- C:\Windows\System\hbstnqt.exe
  C:\Windows\System\hbstnqt.exe
  2⤵
  PID:10296
- C:\Windows\System\xWQxmEp.exe
  C:\Windows\System\xWQxmEp.exe
  2⤵
  PID:10692
- C:\Windows\System\GzQfxGo.exe
  C:\Windows\System\GzQfxGo.exe
  2⤵
  PID:11120
- C:\Windows\System\TnKynAu.exe
  C:\Windows\System\TnKynAu.exe
  2⤵
  PID:10568
- C:\Windows\System\rRPXceI.exe
  C:\Windows\System\rRPXceI.exe
  2⤵
  PID:11048
- C:\Windows\System\nLIlMPb.exe
  C:\Windows\System\nLIlMPb.exe
  2⤵
  PID:11288
- C:\Windows\System\SINhUTA.exe
  C:\Windows\System\SINhUTA.exe
  2⤵
  PID:11308
- C:\Windows\System\GBQJKsL.exe
  C:\Windows\System\GBQJKsL.exe
  2⤵
  PID:11336
- C:\Windows\System\xFXzFRR.exe
  C:\Windows\System\xFXzFRR.exe
  2⤵
  PID:11364
- C:\Windows\System\oYLzzuB.exe
  C:\Windows\System\oYLzzuB.exe
  2⤵
  PID:11392
- C:\Windows\System\NyetNaU.exe
  C:\Windows\System\NyetNaU.exe
  2⤵
  PID:11424
- C:\Windows\System\Srmysug.exe
  C:\Windows\System\Srmysug.exe
  2⤵
  PID:11452
- C:\Windows\System\rMuxIPS.exe
  C:\Windows\System\rMuxIPS.exe
  2⤵
  PID:11480
- C:\Windows\System\kAwWAuV.exe
  C:\Windows\System\kAwWAuV.exe
  2⤵
  PID:11508
- C:\Windows\System\ZUZyGxQ.exe
  C:\Windows\System\ZUZyGxQ.exe
  2⤵
  PID:11536
- C:\Windows\System\qONyaNU.exe
  C:\Windows\System\qONyaNU.exe
  2⤵
  PID:11564
- C:\Windows\System\DNsmmmc.exe
  C:\Windows\System\DNsmmmc.exe
  2⤵
  PID:11592
- C:\Windows\System\hFCoUwH.exe
  C:\Windows\System\hFCoUwH.exe
  2⤵
  PID:11620
- C:\Windows\System\bMDjTzg.exe
  C:\Windows\System\bMDjTzg.exe
  2⤵
  PID:11648
- C:\Windows\System\fpQjJbi.exe
  C:\Windows\System\fpQjJbi.exe
  2⤵
  PID:11676
- C:\Windows\System\RHXPuth.exe
  C:\Windows\System\RHXPuth.exe
  2⤵
  PID:11704
- C:\Windows\System\DpYszvl.exe
  C:\Windows\System\DpYszvl.exe
  2⤵
  PID:11732
- C:\Windows\System\STFcpDB.exe
  C:\Windows\System\STFcpDB.exe
  2⤵
  PID:11760
- C:\Windows\System\pWwPkQo.exe
  C:\Windows\System\pWwPkQo.exe
  2⤵
  PID:11788
- C:\Windows\System\ZPaAiZU.exe
  C:\Windows\System\ZPaAiZU.exe
  2⤵
  PID:11816
- C:\Windows\System\sUVwsAc.exe
  C:\Windows\System\sUVwsAc.exe
  2⤵
  PID:11844
- C:\Windows\System\AGblnTd.exe
  C:\Windows\System\AGblnTd.exe
  2⤵
  PID:11872
- C:\Windows\System\REXVzQR.exe
  C:\Windows\System\REXVzQR.exe
  2⤵
  PID:11900
- C:\Windows\System\uQINpAM.exe
  C:\Windows\System\uQINpAM.exe
  2⤵
  PID:11928
- C:\Windows\System\EKQvEAk.exe
  C:\Windows\System\EKQvEAk.exe
  2⤵
  PID:11956
- C:\Windows\System\hBAumZg.exe
  C:\Windows\System\hBAumZg.exe
  2⤵
  PID:11984
- C:\Windows\System\UfNjPna.exe
  C:\Windows\System\UfNjPna.exe
  2⤵
  PID:12012
- C:\Windows\System\LBzSVDE.exe
  C:\Windows\System\LBzSVDE.exe
  2⤵
  PID:12040
- C:\Windows\System\vJyBwxW.exe
  C:\Windows\System\vJyBwxW.exe
  2⤵
  PID:12068
- C:\Windows\System\qqnWFoS.exe
  C:\Windows\System\qqnWFoS.exe
  2⤵
  PID:12096
- C:\Windows\System\eJzhExA.exe
  C:\Windows\System\eJzhExA.exe
  2⤵
  PID:12128
- C:\Windows\System\xCPqYsq.exe
  C:\Windows\System\xCPqYsq.exe
  2⤵
  PID:12164
- C:\Windows\System\iwsOdzM.exe
  C:\Windows\System\iwsOdzM.exe
  2⤵
  PID:12184
- C:\Windows\System\jWHAbEu.exe
  C:\Windows\System\jWHAbEu.exe
  2⤵
  PID:12212
- C:\Windows\System\qepwjCr.exe
  C:\Windows\System\qepwjCr.exe
  2⤵
  PID:12240
- C:\Windows\System\aYUcFZr.exe
  C:\Windows\System\aYUcFZr.exe
  2⤵
  PID:12268
- C:\Windows\System\WzRFteq.exe
  C:\Windows\System\WzRFteq.exe
  2⤵
  PID:11304
- C:\Windows\System\thcamFn.exe
  C:\Windows\System\thcamFn.exe
  2⤵
  PID:11348
- C:\Windows\System\PCfDXqD.exe
  C:\Windows\System\PCfDXqD.exe
  2⤵
  PID:11416
- C:\Windows\System\GRHxCIO.exe
  C:\Windows\System\GRHxCIO.exe
  2⤵
  PID:11476
- C:\Windows\System\EsYzACL.exe
  C:\Windows\System\EsYzACL.exe
  2⤵
  PID:11556
- C:\Windows\System\ZCNgXRB.exe
  C:\Windows\System\ZCNgXRB.exe
  2⤵
  PID:11616
- C:\Windows\System\pgOxGTu.exe
  C:\Windows\System\pgOxGTu.exe
  2⤵
  PID:11672
- C:\Windows\System\ujTMIcD.exe
  C:\Windows\System\ujTMIcD.exe
  2⤵
  PID:11728
- C:\Windows\System\BbBfSJs.exe
  C:\Windows\System\BbBfSJs.exe
  2⤵
  PID:4568
- C:\Windows\System\BmAvLlJ.exe
  C:\Windows\System\BmAvLlJ.exe
  2⤵
  PID:11840
- C:\Windows\System\XJVtTch.exe
  C:\Windows\System\XJVtTch.exe
  2⤵
  PID:11924
- C:\Windows\System\nYAnwDb.exe
  C:\Windows\System\nYAnwDb.exe
  2⤵
  PID:11976
- C:\Windows\System\QInelvp.exe
  C:\Windows\System\QInelvp.exe
  2⤵
  PID:12036
- C:\Windows\System\TdlkJCl.exe
  C:\Windows\System\TdlkJCl.exe
  2⤵
  PID:12108
- C:\Windows\System\dZFtChJ.exe
  C:\Windows\System\dZFtChJ.exe
  2⤵
  PID:12140
- C:\Windows\System\xOWJEzs.exe
  C:\Windows\System\xOWJEzs.exe
  2⤵
  PID:3988
- C:\Windows\System\tpWZcTH.exe
  C:\Windows\System\tpWZcTH.exe
  2⤵
  PID:12148
- C:\Windows\System\DAtPZiQ.exe
  C:\Windows\System\DAtPZiQ.exe
  2⤵
  PID:12208
- C:\Windows\System\UgZsrjh.exe
  C:\Windows\System\UgZsrjh.exe
  2⤵
  PID:12280
- C:\Windows\System\CAaetFN.exe
  C:\Windows\System\CAaetFN.exe
  2⤵
  PID:676
- C:\Windows\System\OZJNwRV.exe
  C:\Windows\System\OZJNwRV.exe
  2⤵
  PID:11408
- C:\Windows\System\ptSfgps.exe
  C:\Windows\System\ptSfgps.exe
  2⤵
  PID:11584
- C:\Windows\System\xeAeXEf.exe
  C:\Windows\System\xeAeXEf.exe
  2⤵
  PID:11724
- C:\Windows\System\VoapUTM.exe
  C:\Windows\System\VoapUTM.exe
  2⤵
  PID:11836
- C:\Windows\System\XcUoGtX.exe
  C:\Windows\System\XcUoGtX.exe
  2⤵
  PID:12032
- C:\Windows\System\QySLQBI.exe
  C:\Windows\System\QySLQBI.exe
  2⤵
  PID:12120
- C:\Windows\System\dERunWp.exe
  C:\Windows\System\dERunWp.exe
  2⤵
  PID:4732
- C:\Windows\System\EUFJBIW.exe
  C:\Windows\System\EUFJBIW.exe
  2⤵
  PID:2900
- C:\Windows\System\rYdqiBK.exe
  C:\Windows\System\rYdqiBK.exe
  2⤵
  PID:11472
- C:\Windows\System\fMUUxEQ.exe
  C:\Windows\System\fMUUxEQ.exe
  2⤵
  PID:11808
- C:\Windows\System\GbLmrel.exe
  C:\Windows\System\GbLmrel.exe
  2⤵
  PID:924
- C:\Windows\System\rUgTWVf.exe
  C:\Windows\System\rUgTWVf.exe
  2⤵
  PID:11328
- C:\Windows\System\qpbnRbb.exe
  C:\Windows\System\qpbnRbb.exe
  2⤵
  PID:12088
- C:\Windows\System\ZYtoEGJ.exe
  C:\Windows\System\ZYtoEGJ.exe
  2⤵
  PID:11500
- C:\Windows\System\OwrUFdZ.exe
  C:\Windows\System\OwrUFdZ.exe
  2⤵
  PID:7940
- C:\Windows\System\YwTfeWy.exe
  C:\Windows\System\YwTfeWy.exe
  2⤵
  PID:12320
- C:\Windows\System\mViZWiF.exe
  C:\Windows\System\mViZWiF.exe
  2⤵
  PID:12340
- C:\Windows\System\ybICJTN.exe
  C:\Windows\System\ybICJTN.exe
  2⤵
  PID:12368
- C:\Windows\System\RGhQEZH.exe
  C:\Windows\System\RGhQEZH.exe
  2⤵
  PID:12400
- C:\Windows\System\HYxlMrZ.exe
  C:\Windows\System\HYxlMrZ.exe
  2⤵
  PID:12428
- C:\Windows\System\hOhjuWs.exe
  C:\Windows\System\hOhjuWs.exe
  2⤵
  PID:12456
- C:\Windows\System\WQLLgxv.exe
  C:\Windows\System\WQLLgxv.exe
  2⤵
  PID:12484
- C:\Windows\System\fqejMbQ.exe
  C:\Windows\System\fqejMbQ.exe
  2⤵
  PID:12512
- C:\Windows\System\psRCZWW.exe
  C:\Windows\System\psRCZWW.exe
  2⤵
  PID:12540
- C:\Windows\System\qjoooug.exe
  C:\Windows\System\qjoooug.exe
  2⤵
  PID:12568
- C:\Windows\System\BxamDKg.exe
  C:\Windows\System\BxamDKg.exe
  2⤵
  PID:12596
- C:\Windows\System\TxtZTxh.exe
  C:\Windows\System\TxtZTxh.exe
  2⤵
  PID:12624
- C:\Windows\System\ENqvBzM.exe
  C:\Windows\System\ENqvBzM.exe
  2⤵
  PID:12652
- C:\Windows\System\ujjrTRI.exe
  C:\Windows\System\ujjrTRI.exe
  2⤵
  PID:12680
- C:\Windows\System\VUbIbRc.exe
  C:\Windows\System\VUbIbRc.exe
  2⤵
  PID:12708
- C:\Windows\System\jdbInJC.exe
  C:\Windows\System\jdbInJC.exe
  2⤵
  PID:12740
- C:\Windows\System\CHxqTkA.exe
  C:\Windows\System\CHxqTkA.exe
  2⤵
  PID:12764
- C:\Windows\System\DgsmMAf.exe
  C:\Windows\System\DgsmMAf.exe
  2⤵
  PID:12792
- C:\Windows\System\MWttqoQ.exe
  C:\Windows\System\MWttqoQ.exe
  2⤵
  PID:12820
- C:\Windows\System\pYwfnDh.exe
  C:\Windows\System\pYwfnDh.exe
  2⤵
  PID:12848
- C:\Windows\System\uEnVinF.exe
  C:\Windows\System\uEnVinF.exe
  2⤵
  PID:12876
- C:\Windows\System\ynCdzjs.exe
  C:\Windows\System\ynCdzjs.exe
  2⤵
  PID:12904
- C:\Windows\System\AsfVdjl.exe
  C:\Windows\System\AsfVdjl.exe
  2⤵
  PID:12932
- C:\Windows\System\uKFCfwQ.exe
  C:\Windows\System\uKFCfwQ.exe
  2⤵
  PID:12960
- C:\Windows\System\YDmxMbw.exe
  C:\Windows\System\YDmxMbw.exe
  2⤵
  PID:12988
- C:\Windows\System\ImSZigR.exe
  C:\Windows\System\ImSZigR.exe
  2⤵
  PID:13016
- C:\Windows\System\aZhYePz.exe
  C:\Windows\System\aZhYePz.exe
  2⤵
  PID:13044
- C:\Windows\System\TcLQxkt.exe
  C:\Windows\System\TcLQxkt.exe
  2⤵
  PID:13072
- C:\Windows\System\Fbdttap.exe
  C:\Windows\System\Fbdttap.exe
  2⤵
  PID:13100
- C:\Windows\System\vqngaFb.exe
  C:\Windows\System\vqngaFb.exe
  2⤵
  PID:13128
- C:\Windows\System\DoQXlzq.exe
  C:\Windows\System\DoQXlzq.exe
  2⤵
  PID:13156
- C:\Windows\System\HwZkIhH.exe
  C:\Windows\System\HwZkIhH.exe
  2⤵
  PID:13184
- C:\Windows\System\wsmHKwq.exe
  C:\Windows\System\wsmHKwq.exe
  2⤵
  PID:13212
- C:\Windows\System\bJYZwHQ.exe
  C:\Windows\System\bJYZwHQ.exe
  2⤵
  PID:13240
- C:\Windows\System\GrnwyLh.exe
  C:\Windows\System\GrnwyLh.exe
  2⤵
  PID:13268
- C:\Windows\System\CYqYDFb.exe
  C:\Windows\System\CYqYDFb.exe
  2⤵
  PID:13296
- C:\Windows\System\GQlxHwv.exe
  C:\Windows\System\GQlxHwv.exe
  2⤵
  PID:12328
- C:\Windows\System\qUcGLkO.exe
  C:\Windows\System\qUcGLkO.exe
  2⤵
  PID:12380
- C:\Windows\System\UEjrJgT.exe
  C:\Windows\System\UEjrJgT.exe
  2⤵
  PID:12444
- C:\Windows\System\tqyNwJP.exe
  C:\Windows\System\tqyNwJP.exe
  2⤵
  PID:12500
- C:\Windows\System\hKKkizq.exe
  C:\Windows\System\hKKkizq.exe
  2⤵
  PID:12588
- C:\Windows\System\MXcOlXG.exe
  C:\Windows\System\MXcOlXG.exe
  2⤵
  PID:12636
- C:\Windows\System\ArqrqPS.exe
  C:\Windows\System\ArqrqPS.exe
  2⤵
  PID:12692
- C:\Windows\System\vTxKiBt.exe
  C:\Windows\System\vTxKiBt.exe
  2⤵
  PID:12760
- C:\Windows\System\aUONqJN.exe
  C:\Windows\System\aUONqJN.exe
  2⤵
  PID:12864
- C:\Windows\System\XWtGbbm.exe
  C:\Windows\System\XWtGbbm.exe
  2⤵
  PID:12896
- C:\Windows\System\iTygFKx.exe
  C:\Windows\System\iTygFKx.exe
  2⤵
  PID:12980
- C:\Windows\System\inzxbHp.exe
  C:\Windows\System\inzxbHp.exe
  2⤵
  PID:13040
- C:\Windows\System\nmpntZR.exe
  C:\Windows\System\nmpntZR.exe
  2⤵
  PID:13152
- C:\Windows\System\xaIMtNE.exe
  C:\Windows\System\xaIMtNE.exe
  2⤵
  PID:13208
- C:\Windows\System\yRxttXq.exe
  C:\Windows\System\yRxttXq.exe
  2⤵
  PID:13252
- C:\Windows\System\gQALXSU.exe
  C:\Windows\System\gQALXSU.exe
  2⤵
  PID:12304
- C:\Windows\System\fJgidSA.exe
  C:\Windows\System\fJgidSA.exe
  2⤵
  PID:12412
- C:\Windows\System\kmwVHzm.exe
  C:\Windows\System\kmwVHzm.exe
  2⤵
  PID:12616
- C:\Windows\System\SjIeRdz.exe
  C:\Windows\System\SjIeRdz.exe
  2⤵
  PID:12748
- C:\Windows\System\eyHUlzV.exe
  C:\Windows\System\eyHUlzV.exe
  2⤵
  PID:12952
- C:\Windows\System\mWZtcZC.exe
  C:\Windows\System\mWZtcZC.exe
  2⤵
  PID:12388
- C:\Windows\System\APUvqcR.exe
  C:\Windows\System\APUvqcR.exe
  2⤵
  PID:13232
- C:\Windows\System\jTiUmou.exe
  C:\Windows\System\jTiUmou.exe
  2⤵
  PID:12364
- C:\Windows\System\TEbubwj.exe
  C:\Windows\System\TEbubwj.exe
  2⤵
  PID:12872
- C:\Windows\System\XPNcETO.exe
  C:\Windows\System\XPNcETO.exe
  2⤵
  PID:12608
- C:\Windows\System\uiSVfZi.exe
  C:\Windows\System\uiSVfZi.exe
  2⤵
  PID:12816
- C:\Windows\System\yRtCTvu.exe
  C:\Windows\System\yRtCTvu.exe
  2⤵
  PID:13036
- C:\Windows\System\Rkjniak.exe
  C:\Windows\System\Rkjniak.exe
  2⤵
  PID:2376
- C:\Windows\System\GGpRAlC.exe
  C:\Windows\System\GGpRAlC.exe
  2⤵
  PID:3752
- C:\Windows\System\hlCbMLu.exe
  C:\Windows\System\hlCbMLu.exe
  2⤵
  PID:13320
- C:\Windows\System\iqcMtYU.exe
  C:\Windows\System\iqcMtYU.exe
  2⤵
  PID:13348
- C:\Windows\System\xzahIhJ.exe
  C:\Windows\System\xzahIhJ.exe
  2⤵
  PID:13376
- C:\Windows\System\GDJsfvo.exe
  C:\Windows\System\GDJsfvo.exe
  2⤵
  PID:13416
- C:\Windows\System\zkszVKv.exe
  C:\Windows\System\zkszVKv.exe
  2⤵
  PID:13436
- C:\Windows\System\CBojPMl.exe
  C:\Windows\System\CBojPMl.exe
  2⤵
  PID:13464
- C:\Windows\System\hCzkrer.exe
  C:\Windows\System\hCzkrer.exe
  2⤵
  PID:13492
- C:\Windows\System\pLkRDwb.exe
  C:\Windows\System\pLkRDwb.exe
  2⤵
  PID:13536
- C:\Windows\System\kciKQUz.exe
  C:\Windows\System\kciKQUz.exe
  2⤵
  PID:13564
- C:\Windows\System\LAkyvQO.exe
  C:\Windows\System\LAkyvQO.exe
  2⤵
  PID:13584
- C:\Windows\System\VaUJUex.exe
  C:\Windows\System\VaUJUex.exe
  2⤵
  PID:13612
- C:\Windows\System\mfqctKD.exe
  C:\Windows\System\mfqctKD.exe
  2⤵
  PID:13640
- C:\Windows\System\PKBeOMm.exe
  C:\Windows\System\PKBeOMm.exe
  2⤵
  PID:13668
- C:\Windows\System\astDeLf.exe
  C:\Windows\System\astDeLf.exe
  2⤵
  PID:13696
- C:\Windows\System\VGIvrFa.exe
  C:\Windows\System\VGIvrFa.exe
  2⤵
  PID:13724
- C:\Windows\System\rsDDEox.exe
  C:\Windows\System\rsDDEox.exe
  2⤵
  PID:13752
- C:\Windows\System\wQatPAq.exe
  C:\Windows\System\wQatPAq.exe
  2⤵
  PID:13780
- C:\Windows\System\gUGOniJ.exe
  C:\Windows\System\gUGOniJ.exe
  2⤵
  PID:13808
- C:\Windows\System\vfhhaHU.exe
  C:\Windows\System\vfhhaHU.exe
  2⤵
  PID:13836
- C:\Windows\System\TvbBAtM.exe
  C:\Windows\System\TvbBAtM.exe
  2⤵
  PID:13864
- C:\Windows\System\styaeyg.exe
  C:\Windows\System\styaeyg.exe
  2⤵
  PID:13892
- C:\Windows\System\OsJssCx.exe
  C:\Windows\System\OsJssCx.exe
  2⤵
  PID:13920
- C:\Windows\System\AbbMrmN.exe
  C:\Windows\System\AbbMrmN.exe
  2⤵
  PID:13948
- C:\Windows\System\oaePGLT.exe
  C:\Windows\System\oaePGLT.exe
  2⤵
  PID:13976
- C:\Windows\System\zmRryka.exe
  C:\Windows\System\zmRryka.exe
  2⤵
  PID:14004
- C:\Windows\System\LBUstMq.exe
  C:\Windows\System\LBUstMq.exe
  2⤵
  PID:14032
- C:\Windows\System\sweDmaO.exe
  C:\Windows\System\sweDmaO.exe
  2⤵
  PID:14060
- C:\Windows\System\SGuWVlJ.exe
  C:\Windows\System\SGuWVlJ.exe
  2⤵
  PID:14088
- C:\Windows\System\mRoEBPl.exe
  C:\Windows\System\mRoEBPl.exe
  2⤵
  PID:14116
- C:\Windows\System\raVPjhZ.exe
  C:\Windows\System\raVPjhZ.exe
  2⤵
  PID:14144
- C:\Windows\System\JTUiFRo.exe
  C:\Windows\System\JTUiFRo.exe
  2⤵
  PID:14172
- C:\Windows\System\iODMkDJ.exe
  C:\Windows\System\iODMkDJ.exe
  2⤵
  PID:14200
- C:\Windows\System\mPfuKXQ.exe
  C:\Windows\System\mPfuKXQ.exe
  2⤵
  PID:14228
- C:\Windows\System\ZxwoCzr.exe
  C:\Windows\System\ZxwoCzr.exe
  2⤵
  PID:14256
- C:\Windows\System\MDISiDT.exe
  C:\Windows\System\MDISiDT.exe
  2⤵
  PID:14284
- C:\Windows\System\MurXKvY.exe
  C:\Windows\System\MurXKvY.exe
  2⤵
  PID:14312
- C:\Windows\System\CBSOspp.exe
  C:\Windows\System\CBSOspp.exe
  2⤵
  PID:13316
- C:\Windows\System\bdvqViN.exe
  C:\Windows\System\bdvqViN.exe
  2⤵
  PID:13392
- C:\Windows\System\NybTeRs.exe
  C:\Windows\System\NybTeRs.exe
  2⤵
  PID:13456
- C:\Windows\System\zXycMeZ.exe
  C:\Windows\System\zXycMeZ.exe
  2⤵
  PID:13516
- C:\Windows\System\KEXmIcn.exe
  C:\Windows\System\KEXmIcn.exe
  2⤵
  PID:13604
- C:\Windows\System\SWDvUhQ.exe
  C:\Windows\System\SWDvUhQ.exe
  2⤵
  PID:13664
- C:\Windows\System\KTuydep.exe
  C:\Windows\System\KTuydep.exe
  2⤵
  PID:13736
- C:\Windows\System\ZGdeUOp.exe
  C:\Windows\System\ZGdeUOp.exe
  2⤵
  PID:13800
- C:\Windows\System\DPpMqVu.exe
  C:\Windows\System\DPpMqVu.exe
  2⤵
  PID:13860
- C:\Windows\System\lgNYTKe.exe
  C:\Windows\System\lgNYTKe.exe
  2⤵
  PID:13932
- C:\Windows\System\jVJrnKr.exe
  C:\Windows\System\jVJrnKr.exe
  2⤵
  PID:13996
- C:\Windows\System\AaKajGO.exe
  C:\Windows\System\AaKajGO.exe
  2⤵
  PID:14056
- C:\Windows\System\WqJyGlb.exe
  C:\Windows\System\WqJyGlb.exe
  2⤵
  PID:14128
- C:\Windows\System\SYcwucq.exe
  C:\Windows\System\SYcwucq.exe
  2⤵
  PID:14184
- C:\Windows\System\ZpSXBEo.exe
  C:\Windows\System\ZpSXBEo.exe
  2⤵
  PID:14248
- C:\Windows\System\UyShHPt.exe
  C:\Windows\System\UyShHPt.exe
  2⤵
  PID:14308
- C:\Windows\System\vpIzYIL.exe
  C:\Windows\System\vpIzYIL.exe
  2⤵
  PID:13428
- C:\Windows\System\dCNDBcC.exe
  C:\Windows\System\dCNDBcC.exe
  2⤵
  PID:13596
- C:\Windows\System\iTVjCir.exe
  C:\Windows\System\iTVjCir.exe
  2⤵
  PID:13764
- C:\Windows\System\cuShaXb.exe
  C:\Windows\System\cuShaXb.exe
  2⤵
  PID:13912
- C:\Windows\System\ZjorqCA.exe
  C:\Windows\System\ZjorqCA.exe
  2⤵
  PID:14052
- C:\Windows\System\KvZVgaq.exe
  C:\Windows\System\KvZVgaq.exe
  2⤵
  PID:14212
- C:\Windows\System\hrtUpuA.exe
  C:\Windows\System\hrtUpuA.exe
  2⤵
  PID:13368
- C:\Windows\System\CexzLAX.exe
  C:\Windows\System\CexzLAX.exe
  2⤵
  PID:13832
- C:\Windows\System\wfCbZSb.exe
  C:\Windows\System\wfCbZSb.exe
  2⤵
  PID:13408
- C:\Windows\System\oTvMALj.exe
  C:\Windows\System\oTvMALj.exe
  2⤵
  PID:13720
- C:\Windows\System\yBrzDhw.exe
  C:\Windows\System\yBrzDhw.exe
  2⤵
  PID:228
- C:\Windows\System\wnslcRl.exe
  C:\Windows\System\wnslcRl.exe
  2⤵
  PID:14376
- C:\Windows\System\NnzHLsZ.exe
  C:\Windows\System\NnzHLsZ.exe
  2⤵
  PID:14412
- C:\Windows\System\VuqPZbN.exe
  C:\Windows\System\VuqPZbN.exe
  2⤵
  PID:14440
- C:\Windows\System\hDdpLZI.exe
  C:\Windows\System\hDdpLZI.exe
  2⤵
  PID:14468
- C:\Windows\System\HboVapA.exe
  C:\Windows\System\HboVapA.exe
  2⤵
  PID:14516
- C:\Windows\System\cRmcIAD.exe
  C:\Windows\System\cRmcIAD.exe
  2⤵
  PID:14548
- C:\Windows\System\qknlcOX.exe
  C:\Windows\System\qknlcOX.exe
  2⤵
  PID:14576
- C:\Windows\System\nrsanqF.exe
  C:\Windows\System\nrsanqF.exe
  2⤵
  PID:14612
- C:\Windows\System\Zdsrken.exe
  C:\Windows\System\Zdsrken.exe
  2⤵
  PID:14632
- C:\Windows\System\ASOgtTy.exe
  C:\Windows\System\ASOgtTy.exe
  2⤵
  PID:14664
- C:\Windows\System\PrNqzrF.exe
  C:\Windows\System\PrNqzrF.exe
  2⤵
  PID:14692
- C:\Windows\System\smINkSF.exe
  C:\Windows\System\smINkSF.exe
  2⤵
  PID:14720
- C:\Windows\System\ihhleIX.exe
  C:\Windows\System\ihhleIX.exe
  2⤵
  PID:14748
- C:\Windows\System\wXpQOUS.exe
  C:\Windows\System\wXpQOUS.exe
  2⤵
  PID:14916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AkbJDfY.exe

Filesize
5.0MB

MD5
bb732fecbbd06679de76d183986a786e

SHA1
ae59d73b87f65d65930b84a6d88de9c34fdfb4c3

SHA256
f7481852c9ccb0fc68cd94a598cd785a805463641a6af10bf05c7d45423cf139

SHA512
da0ccf7c3efab8d6e7cbda1796c3959a703777a733369e4450e8b5d1c2390c471215fb890ff075b6d9091673ca8d8dc8650dfa12a9b19401b75e2f00524b9609

Download Submit
C:\Windows\System\FEKzjtB.exe

Filesize
5.0MB

MD5
60729d5de2c019d17a28397f24756525

SHA1
b1763aeee59e054346ce49ace2816fb56c87676f

SHA256
b1a5a07aa54cf180bbe42f086db82d39431ccc4592dd8630d58a69b15d302bfb

SHA512
fc2a99fdc186b4dc46224600a18c117c9cabac852895cdae5c09b0a60c86adba939a9f7dbdf29ebac868ecab2dc79f7bc253a0bf1f1107233ebe0bafdc55dcce

Download Submit
C:\Windows\System\FZIEFco.exe

Filesize
5.0MB

MD5
d97cc4bc8cbdfa6e272f8afdac9a5997

SHA1
05c3d0fb0f7c8ae74ef90b37f5b4c0cded149f37

SHA256
b2af58b6791050009624b5fb3b7fa7424675a461dd324a2d92c651db00acea41

SHA512
f86a16608e385c1cdca1b6175d44c6dab17400e26e50adda0b3c2c4bec89294b0c09427ef9439ae24754660358aa8f66b1905780d80214539155f9afebbb93fa

Download Submit
C:\Windows\System\FvzILqo.exe

Filesize
5.0MB

MD5
f86bcae92617bf7757daadf6f978616e

SHA1
88e0cd03d4696ccf74ca6183a6287f039b89d664

SHA256
3baf404efd5fc81cb196a39cdb17ad60ef75e2b2a919e3343f0fdd878c04404f

SHA512
1c82025744a6df3776a842917da114bedd8c234ed0c89f5b1fc6f0221144671126b437de073ede4c4fddebe463c713b3ab81688e90037df5bfca7e5893998f1a

Download Submit
C:\Windows\System\GseTUEU.exe

Filesize
5.0MB

MD5
d85a5582a9e89744c152c42609a39e8b

SHA1
98dc4a8bd9f0a001d1a104eae887101f9becf58e

SHA256
2a8e2ee8c2048725b9c625e519cf2e5006f86cab2b0b1490ed70c93cf7ca7a45

SHA512
084cc659e30d61fc2c9124a207b9668a07f34627ab3173b342efe0c59fd8da3809b0cc37a24ea2326281c6a60aff99032cff85a517a22d5b678371e173063bf0

Download Submit
C:\Windows\System\HRZYhCK.exe

Filesize
5.0MB

MD5
e40180a6bb42a496c7bc29637f2bd889

SHA1
6c2807ac717f9c3e30ba9e1a853f0437cd24abdf

SHA256
7ca22f7d3c367ba354cb1db89bef465c2a7e9eae66641ba5714b5189c53b0f59

SHA512
a10aad584499609e62e2c27a260c27cd5cde0aa0133a80d5d0cc94af6e27f0e0b27d474392107f276f6b8412699cf8e349abb48f42aeb682bcfe9b8b656dfcfd

Download Submit
C:\Windows\System\IrjLfmF.exe

Filesize
5.0MB

MD5
b270b3749e1ada26eefb5be1b021d5fb

SHA1
ec11816633e5ecfdc91b38f4e2a807bccd73076b

SHA256
8a49c8155aa5074b3d024366df68dda7dd9a6275034f5b6d743e5715c9a4e481

SHA512
84dd219836fabcec490dd660a0fc3fdaaf5c8b8841e96923c6783a7da2943df9aeeedf06dfc5e35aded323032ea2ac3800f51030d8d558c454f2968f1e0d4b47

Download Submit
C:\Windows\System\JZdlSQB.exe

Filesize
5.0MB

MD5
db2ca0efe8458f9add4cfe26f59726b0

SHA1
add861dd49aa913e8dddd02ed19d5a7ee6539069

SHA256
bbb91566e9dbffb57cdc306a572676948fc29e2eae242d11b209c710875129c6

SHA512
d9acba40b6db87cea8cca5fc06e292a4bca24420a935953abbd9c08230242893df11f3edceb2dfcafc402767dba58a2b643e49bbf158a1b6379e410a1d3b79c2

Download Submit
C:\Windows\System\JsVNcKG.exe

Filesize
5.0MB

MD5
51fd0b1b885f28e27618d164b7f33fda

SHA1
a115645330b87f71c7d78903d586b1b00ead9dff

SHA256
a1cca3460470d2fe3fc888d0075545cd32939f719a000a1a27da0dcd8d4c8206

SHA512
8523300281d47739833bc2b695e09063780db6463349ca085f7bf531f4eb98d1893fb444ea72b9c0ec2410c85e83fff9f1c76f9541bf0c3c11e03671a4dfa66c

Download Submit
C:\Windows\System\NzvHgOl.exe

Filesize
5.0MB

MD5
9099fcdfc0deaf66832eeababe2b1e48

SHA1
89219cef0b332eeafe0bab98afaec029ba0057e4

SHA256
eb368e91eed3053555c15b5c8057ee9e02021a490a2d150465c46e1d48adc38a

SHA512
7f5ce07b09663a57e48f124f967d51f032724a34d688f4242f734ce8bf39060785a7a7a76c50b7185354adb0f4ed3bcfd56f794c9e62942fb9e90449cd0e3796

Download Submit
C:\Windows\System\OaRfXTn.exe

Filesize
5.0MB

MD5
1b340b752aca7ad874d6a22774037bc9

SHA1
68f8cc16c638d71130cd0d924254b64debba4535

SHA256
4574a340cf2f24e6e57af9d869c8390cf7f6467adb95ccc97c3becc55b71ad02

SHA512
8479e2b85c35e08f9175a440dda0cb0b9de4ba2444cdfaf2f5e37aafc9384f716a8eb1f722d1b4fa92c815874fbf60dcd99f11d8c5a8a9d1b4a41859c7d9c907

Download Submit
C:\Windows\System\PstKdhY.exe

Filesize
5.0MB

MD5
b0079312d34d1db5717a21a7af21677a

SHA1
047918aa969bd4e7e63aedc4b08357b0168fc0da

SHA256
79e7b48d590e5e5552190deb04d28be0d3832ff216b270f9800db0747eb5e9d8

SHA512
51edd4b47a97de4267280fdb46ac968ee79fa9734aa2120c7fcee82253316bd5e0ce67974b7bcfc148a9ef86fb520ca90ad7d3e5b27e6d99042fc09c308618b2

Download Submit
C:\Windows\System\PwXPQuM.exe

Filesize
5.0MB

MD5
0de589c8b561f2647be1586aee0a383a

SHA1
d7211768fdd390c99ef1d299f11ce760e23c7d55

SHA256
016d4baf81915a15a0e9fdc9a34877e2917ecf57fb6b6d4691bf505d36d9947b

SHA512
0ba9d50d188bb85907bca48a98cf03ba95d5f7a8068a7a1edd7fd73f3e71ca167abc9074046352c99495eea1d1bf4551c5208d6f4e4797244c73c16843482283

Download Submit
C:\Windows\System\QarwNru.exe

Filesize
5.0MB

MD5
3e0c231f88f23733547d185bfe5fb04e

SHA1
d5cd8cf2f4f2a3a88b5de8657a4253f4131a67bf

SHA256
7e89befeca0d1e51c2cad95cae348149e95236c8c337be56e1f74d2a3d07fff6

SHA512
d65bd1ee1ad7213524286344d007a4710bfe20d8750a74675b4ed3f203da4635271fff2ee33981ad1ba338ac09a744caee09af924a9575349d326e84fafdbec0

Download Submit
C:\Windows\System\ReETAKZ.exe

Filesize
5.0MB

MD5
9009557211b193b50c7c0df8abf41113

SHA1
4d0683bc78f42c5520e4823cfc1771e1544e1991

SHA256
47110fe2762e6b68f54449e121ccc7c029c95052a8f90fcd68e99576d58f4dd0

SHA512
ee797150b6e6084e6fcb08ac6500ddd5873b494063c25ce90d8671ce6dce258dfa0c428a6c3f7d86fae59a80c7cc68a8e4798a33dad6b82ce4e9017a5ef77644

Download Submit
C:\Windows\System\STtbpOz.exe

Filesize
5.0MB

MD5
0f94a881deaa01353a114d9365eed7cb

SHA1
811bd87b51aa41269033e025c7ad404eda7057e8

SHA256
564985a3f97d2a434e5e0d42df7b485b52f8be964a9f370d4ea7f1675c3a6b6c

SHA512
6732d8f7aca456c8b26a5428282e1081b072cba5f757853a68c6dada56a1ffc00a6bfe4c475d510a93c19c78f55884073ebab0fecf68170ddb3eccccfa35e18e

Download Submit
C:\Windows\System\SbipUeI.exe

Filesize
5.0MB

MD5
2d1dc31dc986d43925e8364d1433c399

SHA1
fbd70109eb5bb105e4e21e9f5d2f34b61176f767

SHA256
6cc937aff6b808b0101ff58a946ff36940dca412f295e1f2ef9ba897c49bf40b

SHA512
39240715c0d31908f0c80fb1245405e7627fd8c5eeaada5e00bc191fd39627ed3021ff7297eebdcd7aab770fab317f6758e5f0a1fa0f254f1365b94cdf61d2d5

Download Submit
C:\Windows\System\WTgudqM.exe

Filesize
5.0MB

MD5
a883fa08d81d1d6de91f5e700536442c

SHA1
715a23b76fdc14964785116e3d29d82c9f9358eb

SHA256
91ccd7d1e02110c94131cf65ba2b3983d2d3eaa530c7ee471405338addcde096

SHA512
70eef5bd8eab2b7100244c18c5d860b3023c7c90ef7b9c3804d3e16721c4cdc59664e389b296e3e573302cbe9a99fac2fb1af910cf34d0b4bddd388c7ac143ed

Download Submit
C:\Windows\System\XxpkRkJ.exe

Filesize
5.0MB

MD5
84c1095cce837e576c091540ec6582f2

SHA1
797b7a73270f8127de962fbf646431363666b46c

SHA256
719106af3249046dca139ac8a974a98f6947b687560cef787015bbba1d8cd647

SHA512
f5041ceea8bb604e365e0598bbbef916272530ea29fa3c250a820d0754074cf786264f64e459d2cc833e155962645d1b1a8ad254a21817cb3a59806586a78673

Download Submit
C:\Windows\System\YCiwmpy.exe

Filesize
5.0MB

MD5
ceaf99d67d98c6ea3520ff4de6417fdf

SHA1
c3d21afd3807963fdfbb74c6f8aa9c100476d1bc

SHA256
833307fa8eaeeb5c7067acac3583c5aa395c8a2941ce6733185bad767adeb972

SHA512
b31ed563a60af56fe02712cd738cffea3b7ffff77080958580862c12213056578e5af45ba396b7890bd09206fbbb44af1d08c36359a54b2253e9afb27a098d34

Download Submit
C:\Windows\System\avGCHEl.exe

Filesize
5.0MB

MD5
4c37ea913df234a8a34c98b8eb706e70

SHA1
e3037c901167efd2e260f321291f7f32f992e317

SHA256
9922f686a15153d926c5eba852263fb97c0692473f4210f8c6684fb4166d2a8c

SHA512
c03185a72a2cfdb370df5b22270cbffadf36e10f48e2d82bcd0727c475a64a6d3dd77ed2839f4fe590a7657516cbf31f8b759d137e1c92b7229e1666c76fb7a8

Download Submit
C:\Windows\System\bEWEHgQ.exe

Filesize
5.0MB

MD5
bd8f163c2db2de43df5e3df42c3d5f7c

SHA1
35cff48e2203406860b9837e77eef252928c42bf

SHA256
6f66f695f855c5da5e5a9a3d98efc098243ac6e6fc0ca8e3f3b4a4a54030300f

SHA512
2566e5281dd2098cfd3365df920e542caddb768187186cb9d0217e5989f53fa00dc180fe6dfe6365fc47c91b9da6c46a84e8d55c60f0dd3f0c575c2fc953e7f7

Download Submit
C:\Windows\System\cCnEkGw.exe

Filesize
5.0MB

MD5
98b9a71f0cfe304f8deca19c1c7d9655

SHA1
2ff8417bd393db92a279f8bc8ebf731ad0cf2d20

SHA256
634e2ff490e6604be2cdfb0a7051b84d585590ab4614182e371ac1fe949c004a

SHA512
7bf091f06d71b6f37e4f38c321280c7a2a5b4758e6b1597a44cf72e57bd9b5b81cde3da6478b9383da484e01dff7e9bae743ef15b57ee0f3728aae03ca4df2a7

Download Submit
C:\Windows\System\dZkDPZK.exe

Filesize
5.0MB

MD5
eaef241e66c47932cee09db111de1ac1

SHA1
a60e2dcd0734fd8ed29d40b66c2dce7e74b93b77

SHA256
1c38fd9057c1ee429953079cbd7d43ceee9f05f0d90d38dba2bf9d095abd28b1

SHA512
4545fb9e62c3344f2222540f9ae5ec0b55acd2df42b2c8a5704b17e61951da434cd30055dc84d25cfe3764e0de3f2735e1068b31b655b0bdfc2a5c3f4d884b75

Download Submit
C:\Windows\System\gJVxazm.exe

Filesize
5.0MB

MD5
48646714eaac034320a640e26e8509a0

SHA1
bb092b8dd9507de386aca85e6e2d785e208f6be0

SHA256
a29e389936fed256d806e2a347f6e044720426ee35637c30e52140ef32928fd1

SHA512
540a2342af599d2865a2e67f3316dfa7131addaa2d4b418515e59bb6ae88f5f8668abf4148cf995b194e5af3646ac12eb1391a8ed312419f8dd89935647de152

Download Submit
C:\Windows\System\hyDqPmY.exe

Filesize
5.0MB

MD5
bbf7a9ff0da63e6ea1f57e7d1cfa5bb8

SHA1
8534695320ee983b946763fa176a235a5bae9f4d

SHA256
e4ea67c4af3a80f55a9c316984a03286744dfd5fee0837107309baafa58fa948

SHA512
b3c2dc0e42c4f894a1d344f472cb46aaebef4cf05d625e43b8a0a85a8226e69ffbb4e982a3f87e79033271ceb8c1c5c8b44dd619ec3d28dd1771d7ba37b7dd64

Download Submit
C:\Windows\System\knccCqA.exe

Filesize
5.0MB

MD5
676e303d64eff072c5f425dfc9e8da51

SHA1
56c7a3566c98aafdc71ecf51d2a39008796e9786

SHA256
fa1b782944374c0ee553e7b614fcd8f21104c97c1f2f3147a0baab2146590153

SHA512
819c5a6d91979a804dc06a0f8eb1dc902bc6a4b058a0e45d2eabb5bc0e85933ae9e86d9b7b52b7cac6d7bef0950f2d9946084837482f49e9b3f80556bb6a6777

Download Submit
C:\Windows\System\lXTcFSd.exe

Filesize
5.0MB

MD5
9e7e56d0413798c49ff38b97263c42cb

SHA1
65718d8cd50e966c66630ea999dfa20e803a0329

SHA256
2d8e8aea759a3ac865fdbddb5dc217e74bded98782fb525fb9b4cff9294d4e51

SHA512
83ca950f762f2de45bf1953fe3c4674a16b0dce73e5336d097cbb04ec779092849cb802b444a419d6ba29a8ff00373a4bbee35987e833836eb9b0d253102ac4a

Download Submit
C:\Windows\System\nTrTqVR.exe

Filesize
5.0MB

MD5
249aa489608f463184f6aec96744323f

SHA1
f5d33e32bd0233f7b2031f01379ae3ca0e1694fb

SHA256
0a22085b09663b866b00a2068aa50d9e1da49de2a76487d5b3a6311e14b3e5a4

SHA512
6c81070c89abded354653299ee23ca65d0abfa40e4a84e1e554fc0609b82cc52194786367e0418d55015e107347a793c708ea10286f96efdaf96dec47cfc0677

Download Submit
C:\Windows\System\srVfyfq.exe

Filesize
5.0MB

MD5
527ce82a69504d42136f95e5ae92c154

SHA1
b35fa7a8cc66894131e84b1e66fbb68f025f7df3

SHA256
d90f3d084cc483214a9a49a8eec49ca98cca20d40d38e3bcff4b73cd1e59be47

SHA512
74cd09dc332c3f7fbd3b00e50194dd9055d0c8ae03b449858a35973c97c7a65c7d988f46bd05107bc0ab6c9cff21e84a005fb66e9a3ea426467cf4252a659d7e

Download Submit
C:\Windows\System\yNDMmyc.exe

Filesize
5.0MB

MD5
faff96e083d8e34e794d7a8923a83e23

SHA1
64ca762117e56f29c9f1f2d800c571217cefa7c2

SHA256
a9d550a3cfcb15aa06fdc1fc2c049f812141e3c77b498469207d5815cfb43a88

SHA512
10b6edc78c05694c2503e1c343fd52744d1cb0906a750799f9c735dd2282c36f1b300d67a425b7697080335bdfe0ddf844defb70a084b84b8f08de39014536b5

Download Submit
C:\Windows\System\yZUsWsn.exe

Filesize
5.0MB

MD5
817b850445c05802ebf04472c5ac0928

SHA1
6c4311e1361cc641a05df42dd513820d73165da1

SHA256
5f88f729933b3b449833faa73ddb4ad1357804887f4f2d6ea627576ef511ad16

SHA512
a3631aa7868878d38b4dea8565d51caa6a575f0db3147e4ae83a2d4aa62dd385a9cfeb69c8847e961beb2e545f6eb9453be81062f4b89111065f1795c83955e3

Download Submit
memory/668-2149-0x00007FF70CC60000-0x00007FF70CFB4000-memory.dmp

Filesize
3.3MB

Download
memory/668-354-0x00007FF70CC60000-0x00007FF70CFB4000-memory.dmp

Filesize
3.3MB

Download
memory/1248-318-0x00007FF6331A0000-0x00007FF6334F4000-memory.dmp

Filesize
3.3MB

Download
memory/1248-2159-0x00007FF6331A0000-0x00007FF6334F4000-memory.dmp

Filesize
3.3MB

Download
memory/1472-326-0x00007FF740B50000-0x00007FF740EA4000-memory.dmp

Filesize
3.3MB

Download
memory/1472-2162-0x00007FF740B50000-0x00007FF740EA4000-memory.dmp

Filesize
3.3MB

Download
memory/1596-333-0x00007FF660EA0000-0x00007FF6611F4000-memory.dmp

Filesize
3.3MB

Download
memory/1596-2163-0x00007FF660EA0000-0x00007FF6611F4000-memory.dmp

Filesize
3.3MB

Download
memory/1664-2145-0x00007FF7C3040000-0x00007FF7C3394000-memory.dmp

Filesize
3.3MB

Download
memory/1664-27-0x00007FF7C3040000-0x00007FF7C3394000-memory.dmp

Filesize
3.3MB

Download
memory/1664-1582-0x00007FF7C3040000-0x00007FF7C3394000-memory.dmp

Filesize
3.3MB

Download
memory/1692-346-0x00007FF704450000-0x00007FF7047A4000-memory.dmp

Filesize
3.3MB

Download
memory/1692-2167-0x00007FF704450000-0x00007FF7047A4000-memory.dmp

Filesize
3.3MB

Download
memory/1776-339-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp

Filesize
3.3MB

Download
memory/1776-2165-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp

Filesize
3.3MB

Download
memory/1988-1776-0x00007FF7CDB80000-0x00007FF7CDED4000-memory.dmp

Filesize
3.3MB

Download
memory/1988-41-0x00007FF7CDB80000-0x00007FF7CDED4000-memory.dmp

Filesize
3.3MB

Download
memory/1988-2147-0x00007FF7CDB80000-0x00007FF7CDED4000-memory.dmp

Filesize
3.3MB

Download
memory/2112-46-0x00007FF681300000-0x00007FF681654000-memory.dmp

Filesize
3.3MB

Download
memory/2112-1989-0x00007FF681300000-0x00007FF681654000-memory.dmp

Filesize
3.3MB

Download
memory/2112-2148-0x00007FF681300000-0x00007FF681654000-memory.dmp

Filesize
3.3MB

Download
memory/2248-299-0x00007FF64CBA0000-0x00007FF64CEF4000-memory.dmp

Filesize
3.3MB

Download
memory/2248-2151-0x00007FF64CBA0000-0x00007FF64CEF4000-memory.dmp

Filesize
3.3MB

Download
memory/2280-2160-0x00007FF7059C0000-0x00007FF705D14000-memory.dmp

Filesize
3.3MB

Download
memory/2280-322-0x00007FF7059C0000-0x00007FF705D14000-memory.dmp

Filesize
3.3MB

Download
memory/2508-298-0x00007FF65AEE0000-0x00007FF65B234000-memory.dmp

Filesize
3.3MB

Download
memory/2508-2150-0x00007FF65AEE0000-0x00007FF65B234000-memory.dmp

Filesize
3.3MB

Download
memory/2560-2146-0x00007FF7E22B0000-0x00007FF7E2604000-memory.dmp

Filesize
3.3MB

Download
memory/2560-32-0x00007FF7E22B0000-0x00007FF7E2604000-memory.dmp

Filesize
3.3MB

Download
memory/2560-1775-0x00007FF7E22B0000-0x00007FF7E2604000-memory.dmp

Filesize
3.3MB

Download
memory/2804-308-0x00007FF740080000-0x00007FF7403D4000-memory.dmp

Filesize
3.3MB

Download
memory/2804-2155-0x00007FF740080000-0x00007FF7403D4000-memory.dmp

Filesize
3.3MB

Download
memory/2884-2166-0x00007FF72CC40000-0x00007FF72CF94000-memory.dmp

Filesize
3.3MB

Download
memory/2884-342-0x00007FF72CC40000-0x00007FF72CF94000-memory.dmp

Filesize
3.3MB

Download
memory/3236-344-0x00007FF7BB2D0000-0x00007FF7BB624000-memory.dmp

Filesize
3.3MB

Download
memory/3236-2168-0x00007FF7BB2D0000-0x00007FF7BB624000-memory.dmp

Filesize
3.3MB

Download
memory/3348-301-0x00007FF6FD4A0000-0x00007FF6FD7F4000-memory.dmp

Filesize
3.3MB

Download
memory/3348-2153-0x00007FF6FD4A0000-0x00007FF6FD7F4000-memory.dmp

Filesize
3.3MB

Download
memory/3356-350-0x00007FF714110000-0x00007FF714464000-memory.dmp

Filesize
3.3MB

Download
memory/3356-2170-0x00007FF714110000-0x00007FF714464000-memory.dmp

Filesize
3.3MB

Download
memory/3488-311-0x00007FF7558C0000-0x00007FF755C14000-memory.dmp

Filesize
3.3MB

Download
memory/3488-2156-0x00007FF7558C0000-0x00007FF755C14000-memory.dmp

Filesize
3.3MB

Download
memory/3740-312-0x00007FF7138B0000-0x00007FF713C04000-memory.dmp

Filesize
3.3MB

Download
memory/3740-2157-0x00007FF7138B0000-0x00007FF713C04000-memory.dmp

Filesize
3.3MB

Download
memory/3860-2142-0x00007FF651BC0000-0x00007FF651F14000-memory.dmp

Filesize
3.3MB

Download
memory/3860-14-0x00007FF651BC0000-0x00007FF651F14000-memory.dmp

Filesize
3.3MB

Download
memory/4184-316-0x00007FF6D1530000-0x00007FF6D1884000-memory.dmp

Filesize
3.3MB

Download
memory/4184-2158-0x00007FF6D1530000-0x00007FF6D1884000-memory.dmp

Filesize
3.3MB

Download
memory/4308-348-0x00007FF635370000-0x00007FF6356C4000-memory.dmp

Filesize
3.3MB

Download
memory/4308-2169-0x00007FF635370000-0x00007FF6356C4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-7-0x00007FF795080000-0x00007FF7953D4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-735-0x00007FF795080000-0x00007FF7953D4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-2143-0x00007FF795080000-0x00007FF7953D4000-memory.dmp

Filesize
3.3MB

Download
memory/4516-300-0x00007FF7A4DA0000-0x00007FF7A50F4000-memory.dmp

Filesize
3.3MB

Download
memory/4516-2152-0x00007FF7A4DA0000-0x00007FF7A50F4000-memory.dmp

Filesize
3.3MB

Download
memory/4672-335-0x00007FF67BC50000-0x00007FF67BFA4000-memory.dmp

Filesize
3.3MB

Download
memory/4672-2164-0x00007FF67BC50000-0x00007FF67BFA4000-memory.dmp

Filesize
3.3MB

Download
memory/4896-2161-0x00007FF6A33B0000-0x00007FF6A3704000-memory.dmp

Filesize
3.3MB

Download
memory/4896-323-0x00007FF6A33B0000-0x00007FF6A3704000-memory.dmp

Filesize
3.3MB

Download
memory/4924-20-0x00007FF623B90000-0x00007FF623EE4000-memory.dmp

Filesize
3.3MB

Download
memory/4924-2144-0x00007FF623B90000-0x00007FF623EE4000-memory.dmp

Filesize
3.3MB

Download
memory/5076-0-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp

Filesize
3.3MB

Download
memory/5076-1-0x000002198EAC0000-0x000002198EAD0000-memory.dmp

Filesize
64KB

Download
memory/5076-734-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp

Filesize
3.3MB

Download
memory/5100-2154-0x00007FF6ACA00000-0x00007FF6ACD54000-memory.dmp

Filesize
3.3MB

Download
memory/5100-305-0x00007FF6ACA00000-0x00007FF6ACD54000-memory.dmp

Filesize
3.3MB

Download