xmrig | 88109150b5432a36aea0ccc2bed28755a8e9c70858bd4b614eab59c1ea7ca2ff

Analysis

max time kernel
125s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
Size

1.9MB
MD5

7980b94dd8ec73cb2b62a2f660798490
SHA1

80fae8db53e20b4033b31ce60c226a1e9f7b40ba
SHA256

88109150b5432a36aea0ccc2bed28755a8e9c70858bd4b614eab59c1ea7ca2ff
SHA512

35d5e5d1cba72bc1d1b59841b22f083bfc8e445612d907ca87c1cfc9fa1a7f5e75f3e9696d8d6aa4c075a2b26de0469a10ade150841c2e94d07a5790db8be697
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbSL3dh5HELBmAI:BemTLkNdfE0pZrb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2396-0-0x00007FF687040000-0x00007FF687394000-memory.dmp	xmrig
behavioral2/files/0x0009000000023540-5.dat	xmrig
behavioral2/files/0x0008000000023546-15.dat	xmrig
behavioral2/files/0x000700000002354b-41.dat	xmrig
behavioral2/files/0x000700000002354d-53.dat	xmrig
behavioral2/files/0x000700000002354f-61.dat	xmrig
behavioral2/files/0x0007000000023552-82.dat	xmrig
behavioral2/files/0x0007000000023554-92.dat	xmrig
behavioral2/files/0x0007000000023557-107.dat	xmrig
behavioral2/files/0x000700000002355a-122.dat	xmrig
behavioral2/files/0x000700000002355d-137.dat	xmrig
behavioral2/memory/3340-649-0x00007FF6AA700000-0x00007FF6AAA54000-memory.dmp	xmrig
behavioral2/memory/452-652-0x00007FF6529F0000-0x00007FF652D44000-memory.dmp	xmrig
behavioral2/memory/3540-655-0x00007FF64D580000-0x00007FF64D8D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023564-166.dat	xmrig
behavioral2/files/0x0007000000023562-162.dat	xmrig
behavioral2/files/0x0007000000023563-161.dat	xmrig
behavioral2/files/0x0007000000023561-157.dat	xmrig
behavioral2/files/0x0007000000023560-152.dat	xmrig
behavioral2/files/0x000700000002355f-147.dat	xmrig
behavioral2/files/0x000700000002355e-141.dat	xmrig
behavioral2/files/0x000700000002355c-132.dat	xmrig
behavioral2/files/0x000700000002355b-127.dat	xmrig
behavioral2/memory/4008-659-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	xmrig
behavioral2/files/0x0007000000023559-117.dat	xmrig
behavioral2/files/0x0007000000023558-112.dat	xmrig
behavioral2/files/0x0007000000023556-102.dat	xmrig
behavioral2/files/0x0007000000023555-97.dat	xmrig
behavioral2/files/0x0007000000023553-87.dat	xmrig
behavioral2/files/0x0007000000023551-76.dat	xmrig
behavioral2/files/0x0007000000023550-72.dat	xmrig
behavioral2/files/0x000700000002354e-62.dat	xmrig
behavioral2/files/0x000700000002354c-51.dat	xmrig
behavioral2/files/0x000700000002354a-40.dat	xmrig
behavioral2/files/0x0007000000023549-39.dat	xmrig
behavioral2/memory/2136-35-0x00007FF6FEB20000-0x00007FF6FEE74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023547-30.dat	xmrig
behavioral2/memory/672-27-0x00007FF625AA0000-0x00007FF625DF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023548-25.dat	xmrig
behavioral2/memory/4196-18-0x00007FF6C6FF0000-0x00007FF6C7344000-memory.dmp	xmrig
behavioral2/files/0x0008000000023543-9.dat	xmrig
behavioral2/memory/5064-666-0x00007FF7250A0000-0x00007FF7253F4000-memory.dmp	xmrig
behavioral2/memory/3100-663-0x00007FF62CC40000-0x00007FF62CF94000-memory.dmp	xmrig
behavioral2/memory/2156-671-0x00007FF77FFD0000-0x00007FF780324000-memory.dmp	xmrig
behavioral2/memory/1536-677-0x00007FF744DE0000-0x00007FF745134000-memory.dmp	xmrig
behavioral2/memory/2572-682-0x00007FF788C30000-0x00007FF788F84000-memory.dmp	xmrig
behavioral2/memory/2660-681-0x00007FF6D71A0000-0x00007FF6D74F4000-memory.dmp	xmrig
behavioral2/memory/4240-691-0x00007FF758200000-0x00007FF758554000-memory.dmp	xmrig
behavioral2/memory/3616-695-0x00007FF6BBDE0000-0x00007FF6BC134000-memory.dmp	xmrig
behavioral2/memory/4864-702-0x00007FF65DCF0000-0x00007FF65E044000-memory.dmp	xmrig
behavioral2/memory/1376-703-0x00007FF6FCB40000-0x00007FF6FCE94000-memory.dmp	xmrig
behavioral2/memory/464-711-0x00007FF626210000-0x00007FF626564000-memory.dmp	xmrig
behavioral2/memory/1700-708-0x00007FF604910000-0x00007FF604C64000-memory.dmp	xmrig
behavioral2/memory/4040-717-0x00007FF7B42A0000-0x00007FF7B45F4000-memory.dmp	xmrig
behavioral2/memory/4372-723-0x00007FF6F57A0000-0x00007FF6F5AF4000-memory.dmp	xmrig
behavioral2/memory/2184-733-0x00007FF7D6020000-0x00007FF7D6374000-memory.dmp	xmrig
behavioral2/memory/4392-748-0x00007FF7F3890000-0x00007FF7F3BE4000-memory.dmp	xmrig
behavioral2/memory/4464-743-0x00007FF63ED30000-0x00007FF63F084000-memory.dmp	xmrig
behavioral2/memory/4900-763-0x00007FF658B10000-0x00007FF658E64000-memory.dmp	xmrig
behavioral2/memory/4524-768-0x00007FF7ECCB0000-0x00007FF7ED004000-memory.dmp	xmrig
behavioral2/memory/1556-769-0x00007FF6ECD30000-0x00007FF6ED084000-memory.dmp	xmrig
behavioral2/memory/2452-773-0x00007FF69A230000-0x00007FF69A584000-memory.dmp	xmrig
behavioral2/memory/4656-728-0x00007FF7A9CF0000-0x00007FF7AA044000-memory.dmp	xmrig
behavioral2/memory/3340-2051-0x00007FF6AA700000-0x00007FF6AAA54000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4196	ZvmaPxs.exe
672	jdxvwvR.exe
4900	EnqMDmx.exe
4524	lmJhqvx.exe
2136	edTpoqo.exe
1556	JQyGqdK.exe
3340	HPCACdu.exe
2452	BcSYDGh.exe
452	rRUgybU.exe
3540	BeeYOQt.exe
4008	BOrYXCY.exe
3100	tLHIYVI.exe
5064	Sthqdyq.exe
2156	tcCoiqn.exe
1536	UoOcJWI.exe
2660	aeIRAJU.exe
2572	UEumlSZ.exe
4240	CmpMtcU.exe
3616	kBSXiij.exe
4864	PrqPLJj.exe
1376	TUafmbW.exe
1700	mEIgIlG.exe
464	OQPyFXN.exe
4040	vTPcDKd.exe
4372	aGgViTx.exe
4656	qFZHbfM.exe
2184	EcNyGXx.exe
4464	uXxWzOw.exe
4392	gEdUlcq.exe
4532	IzybdKT.exe
4216	yHmqZcs.exe
3488	yOynrJr.exe
3984	SAcSFjV.exe
2436	ljePiCe.exe
1544	NWEHtLD.exe
876	TJZXjzu.exe
4556	sYhyEKk.exe
2248	FuoqfJE.exe
996	ugwZQmP.exe
3928	JBGnnLL.exe
1252	oWCjoeH.exe
3384	zVspuCv.exe
4024	NUMhqbF.exe
2040	OsJfFyE.exe
4672	IAHUbcJ.exe
3256	ewPKRnc.exe
3180	VgOjADQ.exe
2688	CPDPaOu.exe
1784	WrEyUJF.exe
4020	ZKImkBC.exe
1828	fDjwCiq.exe
4544	mNzxiUQ.exe
3200	XEBdkMY.exe
2372	qVDYnnf.exe
3704	QBgwmjH.exe
2392	fPZArYg.exe
3300	Dlsapmz.exe
1396	xoqbdFz.exe
5060	RmFiufz.exe
4336	oRgPRYT.exe
1084	uZiHYzd.exe
1436	nFlFHZN.exe
3548	vpuwtij.exe
5124	YbqbYHv.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2396-0-0x00007FF687040000-0x00007FF687394000-memory.dmp	upx
behavioral2/files/0x0009000000023540-5.dat	upx
behavioral2/files/0x0008000000023546-15.dat	upx
behavioral2/files/0x000700000002354b-41.dat	upx
behavioral2/files/0x000700000002354d-53.dat	upx
behavioral2/files/0x000700000002354f-61.dat	upx
behavioral2/files/0x0007000000023552-82.dat	upx
behavioral2/files/0x0007000000023554-92.dat	upx
behavioral2/files/0x0007000000023557-107.dat	upx
behavioral2/files/0x000700000002355a-122.dat	upx
behavioral2/files/0x000700000002355d-137.dat	upx
behavioral2/memory/3340-649-0x00007FF6AA700000-0x00007FF6AAA54000-memory.dmp	upx
behavioral2/memory/452-652-0x00007FF6529F0000-0x00007FF652D44000-memory.dmp	upx
behavioral2/memory/3540-655-0x00007FF64D580000-0x00007FF64D8D4000-memory.dmp	upx
behavioral2/files/0x0007000000023564-166.dat	upx
behavioral2/files/0x0007000000023562-162.dat	upx
behavioral2/files/0x0007000000023563-161.dat	upx
behavioral2/files/0x0007000000023561-157.dat	upx
behavioral2/files/0x0007000000023560-152.dat	upx
behavioral2/files/0x000700000002355f-147.dat	upx
behavioral2/files/0x000700000002355e-141.dat	upx
behavioral2/files/0x000700000002355c-132.dat	upx
behavioral2/files/0x000700000002355b-127.dat	upx
behavioral2/memory/4008-659-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	upx
behavioral2/files/0x0007000000023559-117.dat	upx
behavioral2/files/0x0007000000023558-112.dat	upx
behavioral2/files/0x0007000000023556-102.dat	upx
behavioral2/files/0x0007000000023555-97.dat	upx
behavioral2/files/0x0007000000023553-87.dat	upx
behavioral2/files/0x0007000000023551-76.dat	upx
behavioral2/files/0x0007000000023550-72.dat	upx
behavioral2/files/0x000700000002354e-62.dat	upx
behavioral2/files/0x000700000002354c-51.dat	upx
behavioral2/files/0x000700000002354a-40.dat	upx
behavioral2/files/0x0007000000023549-39.dat	upx
behavioral2/memory/2136-35-0x00007FF6FEB20000-0x00007FF6FEE74000-memory.dmp	upx
behavioral2/files/0x0007000000023547-30.dat	upx
behavioral2/memory/672-27-0x00007FF625AA0000-0x00007FF625DF4000-memory.dmp	upx
behavioral2/files/0x0007000000023548-25.dat	upx
behavioral2/memory/4196-18-0x00007FF6C6FF0000-0x00007FF6C7344000-memory.dmp	upx
behavioral2/files/0x0008000000023543-9.dat	upx
behavioral2/memory/5064-666-0x00007FF7250A0000-0x00007FF7253F4000-memory.dmp	upx
behavioral2/memory/3100-663-0x00007FF62CC40000-0x00007FF62CF94000-memory.dmp	upx
behavioral2/memory/2156-671-0x00007FF77FFD0000-0x00007FF780324000-memory.dmp	upx
behavioral2/memory/1536-677-0x00007FF744DE0000-0x00007FF745134000-memory.dmp	upx
behavioral2/memory/2572-682-0x00007FF788C30000-0x00007FF788F84000-memory.dmp	upx
behavioral2/memory/2660-681-0x00007FF6D71A0000-0x00007FF6D74F4000-memory.dmp	upx
behavioral2/memory/4240-691-0x00007FF758200000-0x00007FF758554000-memory.dmp	upx
behavioral2/memory/3616-695-0x00007FF6BBDE0000-0x00007FF6BC134000-memory.dmp	upx
behavioral2/memory/4864-702-0x00007FF65DCF0000-0x00007FF65E044000-memory.dmp	upx
behavioral2/memory/1376-703-0x00007FF6FCB40000-0x00007FF6FCE94000-memory.dmp	upx
behavioral2/memory/464-711-0x00007FF626210000-0x00007FF626564000-memory.dmp	upx
behavioral2/memory/1700-708-0x00007FF604910000-0x00007FF604C64000-memory.dmp	upx
behavioral2/memory/4040-717-0x00007FF7B42A0000-0x00007FF7B45F4000-memory.dmp	upx
behavioral2/memory/4372-723-0x00007FF6F57A0000-0x00007FF6F5AF4000-memory.dmp	upx
behavioral2/memory/2184-733-0x00007FF7D6020000-0x00007FF7D6374000-memory.dmp	upx
behavioral2/memory/4392-748-0x00007FF7F3890000-0x00007FF7F3BE4000-memory.dmp	upx
behavioral2/memory/4464-743-0x00007FF63ED30000-0x00007FF63F084000-memory.dmp	upx
behavioral2/memory/4900-763-0x00007FF658B10000-0x00007FF658E64000-memory.dmp	upx
behavioral2/memory/4524-768-0x00007FF7ECCB0000-0x00007FF7ED004000-memory.dmp	upx
behavioral2/memory/1556-769-0x00007FF6ECD30000-0x00007FF6ED084000-memory.dmp	upx
behavioral2/memory/2452-773-0x00007FF69A230000-0x00007FF69A584000-memory.dmp	upx
behavioral2/memory/4656-728-0x00007FF7A9CF0000-0x00007FF7AA044000-memory.dmp	upx
behavioral2/memory/3340-2051-0x00007FF6AA700000-0x00007FF6AAA54000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gCnysQL.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\whaacSC.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\mNUChOs.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\bkhuFIR.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\mtlNdFQ.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\naeHiyz.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\usbJjSQ.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\XfdjKEu.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\VraPAnd.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\CsAlxDR.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\HsNnlGT.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\mJXqpRd.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\IiffJlS.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\WBOZrqP.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\UoOcJWI.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\ktrlvds.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\LVZsOcN.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\vbJgfrE.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\dzoDQJU.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\CSVPLdd.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\iLomUGj.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\FQOvBrQ.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\OeNeyEJ.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\vaWwUcu.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\BOLAufS.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\AqGWhMk.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\hHDcPTj.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\dbToyXW.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\QcoBbfz.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\qKIpHOO.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\wJaRYdy.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\AeRFzcE.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\zlIOiJq.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\hzUNeyY.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\YKsGZpn.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\ZpZYoIw.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\zFHQZCX.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\RWBvDir.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\JademIR.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\fMLbUzX.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\bdNGbOW.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\jQVlNtj.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\FWKiAwP.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\LpyjqQR.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\NyKkWrl.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\kFvPzTB.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\kBSXiij.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\UeRhxbs.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\YzzGgPo.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\VjIAiCd.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\ZsjsCZX.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\DFWqKfx.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\zakYdYn.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\zIWPkOB.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\vVkKfUC.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\tHiNzip.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\pnrTvJh.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\OpmzleI.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\YWpYVig.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\RdRyjjD.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\CbGJHfT.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\qFZHbfM.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\TjBskkf.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
File created	C:\Windows\System\gBIflPu.exe	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 4196	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	89
PID 2396 wrote to memory of 4196	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	89
PID 2396 wrote to memory of 672	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	90
PID 2396 wrote to memory of 672	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	90
PID 2396 wrote to memory of 4900	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	91
PID 2396 wrote to memory of 4900	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	91
PID 2396 wrote to memory of 4524	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	92
PID 2396 wrote to memory of 4524	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	92
PID 2396 wrote to memory of 2136	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	93
PID 2396 wrote to memory of 2136	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	93
PID 2396 wrote to memory of 1556	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	94
PID 2396 wrote to memory of 1556	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	94
PID 2396 wrote to memory of 3340	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	95
PID 2396 wrote to memory of 3340	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	95
PID 2396 wrote to memory of 2452	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	96
PID 2396 wrote to memory of 2452	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	96
PID 2396 wrote to memory of 452	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	97
PID 2396 wrote to memory of 452	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	97
PID 2396 wrote to memory of 3540	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	98
PID 2396 wrote to memory of 3540	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	98
PID 2396 wrote to memory of 4008	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	99
PID 2396 wrote to memory of 4008	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	99
PID 2396 wrote to memory of 3100	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	100
PID 2396 wrote to memory of 3100	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	100
PID 2396 wrote to memory of 5064	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	101
PID 2396 wrote to memory of 5064	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	101
PID 2396 wrote to memory of 2156	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	102
PID 2396 wrote to memory of 2156	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	102
PID 2396 wrote to memory of 1536	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	103
PID 2396 wrote to memory of 1536	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	103
PID 2396 wrote to memory of 2660	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	104
PID 2396 wrote to memory of 2660	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	104
PID 2396 wrote to memory of 2572	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	105
PID 2396 wrote to memory of 2572	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	105
PID 2396 wrote to memory of 4240	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	106
PID 2396 wrote to memory of 4240	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	106
PID 2396 wrote to memory of 3616	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	107
PID 2396 wrote to memory of 3616	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	107
PID 2396 wrote to memory of 4864	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	108
PID 2396 wrote to memory of 4864	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	108
PID 2396 wrote to memory of 1376	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	109
PID 2396 wrote to memory of 1376	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	109
PID 2396 wrote to memory of 1700	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	110
PID 2396 wrote to memory of 1700	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	110
PID 2396 wrote to memory of 464	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	111
PID 2396 wrote to memory of 464	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	111
PID 2396 wrote to memory of 4040	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	112
PID 2396 wrote to memory of 4040	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	112
PID 2396 wrote to memory of 4372	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	113
PID 2396 wrote to memory of 4372	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	113
PID 2396 wrote to memory of 4656	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	114
PID 2396 wrote to memory of 4656	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	114
PID 2396 wrote to memory of 2184	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	115
PID 2396 wrote to memory of 2184	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	115
PID 2396 wrote to memory of 4464	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	116
PID 2396 wrote to memory of 4464	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	116
PID 2396 wrote to memory of 4392	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	117
PID 2396 wrote to memory of 4392	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	117
PID 2396 wrote to memory of 4532	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	118
PID 2396 wrote to memory of 4532	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	118
PID 2396 wrote to memory of 4216	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	119
PID 2396 wrote to memory of 4216	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	119
PID 2396 wrote to memory of 3488	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	120
PID 2396 wrote to memory of 3488	2396	7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe	120

C:\Users\Admin\AppData\Local\Temp\7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\7980b94dd8ec73cb2b62a2f660798490_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\System\ZvmaPxs.exe
  C:\Windows\System\ZvmaPxs.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\jdxvwvR.exe
  C:\Windows\System\jdxvwvR.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\EnqMDmx.exe
  C:\Windows\System\EnqMDmx.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\lmJhqvx.exe
  C:\Windows\System\lmJhqvx.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\edTpoqo.exe
  C:\Windows\System\edTpoqo.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\JQyGqdK.exe
  C:\Windows\System\JQyGqdK.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\HPCACdu.exe
  C:\Windows\System\HPCACdu.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\BcSYDGh.exe
  C:\Windows\System\BcSYDGh.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\rRUgybU.exe
  C:\Windows\System\rRUgybU.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\BeeYOQt.exe
  C:\Windows\System\BeeYOQt.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\BOrYXCY.exe
  C:\Windows\System\BOrYXCY.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\tLHIYVI.exe
  C:\Windows\System\tLHIYVI.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\Sthqdyq.exe
  C:\Windows\System\Sthqdyq.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\tcCoiqn.exe
  C:\Windows\System\tcCoiqn.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\UoOcJWI.exe
  C:\Windows\System\UoOcJWI.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\aeIRAJU.exe
  C:\Windows\System\aeIRAJU.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\UEumlSZ.exe
  C:\Windows\System\UEumlSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\CmpMtcU.exe
  C:\Windows\System\CmpMtcU.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\kBSXiij.exe
  C:\Windows\System\kBSXiij.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\PrqPLJj.exe
  C:\Windows\System\PrqPLJj.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\TUafmbW.exe
  C:\Windows\System\TUafmbW.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\mEIgIlG.exe
  C:\Windows\System\mEIgIlG.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\OQPyFXN.exe
  C:\Windows\System\OQPyFXN.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\vTPcDKd.exe
  C:\Windows\System\vTPcDKd.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\aGgViTx.exe
  C:\Windows\System\aGgViTx.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\qFZHbfM.exe
  C:\Windows\System\qFZHbfM.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\EcNyGXx.exe
  C:\Windows\System\EcNyGXx.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\uXxWzOw.exe
  C:\Windows\System\uXxWzOw.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\gEdUlcq.exe
  C:\Windows\System\gEdUlcq.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\IzybdKT.exe
  C:\Windows\System\IzybdKT.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\yHmqZcs.exe
  C:\Windows\System\yHmqZcs.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\yOynrJr.exe
  C:\Windows\System\yOynrJr.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\SAcSFjV.exe
  C:\Windows\System\SAcSFjV.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\ljePiCe.exe
  C:\Windows\System\ljePiCe.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\NWEHtLD.exe
  C:\Windows\System\NWEHtLD.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\TJZXjzu.exe
  C:\Windows\System\TJZXjzu.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\sYhyEKk.exe
  C:\Windows\System\sYhyEKk.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\FuoqfJE.exe
  C:\Windows\System\FuoqfJE.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\ugwZQmP.exe
  C:\Windows\System\ugwZQmP.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\JBGnnLL.exe
  C:\Windows\System\JBGnnLL.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\oWCjoeH.exe
  C:\Windows\System\oWCjoeH.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\zVspuCv.exe
  C:\Windows\System\zVspuCv.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\NUMhqbF.exe
  C:\Windows\System\NUMhqbF.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\OsJfFyE.exe
  C:\Windows\System\OsJfFyE.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\IAHUbcJ.exe
  C:\Windows\System\IAHUbcJ.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\ewPKRnc.exe
  C:\Windows\System\ewPKRnc.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\VgOjADQ.exe
  C:\Windows\System\VgOjADQ.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\CPDPaOu.exe
  C:\Windows\System\CPDPaOu.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\WrEyUJF.exe
  C:\Windows\System\WrEyUJF.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\ZKImkBC.exe
  C:\Windows\System\ZKImkBC.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\fDjwCiq.exe
  C:\Windows\System\fDjwCiq.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\mNzxiUQ.exe
  C:\Windows\System\mNzxiUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\XEBdkMY.exe
  C:\Windows\System\XEBdkMY.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\qVDYnnf.exe
  C:\Windows\System\qVDYnnf.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\QBgwmjH.exe
  C:\Windows\System\QBgwmjH.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\fPZArYg.exe
  C:\Windows\System\fPZArYg.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\Dlsapmz.exe
  C:\Windows\System\Dlsapmz.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\xoqbdFz.exe
  C:\Windows\System\xoqbdFz.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\RmFiufz.exe
  C:\Windows\System\RmFiufz.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\oRgPRYT.exe
  C:\Windows\System\oRgPRYT.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\uZiHYzd.exe
  C:\Windows\System\uZiHYzd.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\nFlFHZN.exe
  C:\Windows\System\nFlFHZN.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\vpuwtij.exe
  C:\Windows\System\vpuwtij.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\YbqbYHv.exe
  C:\Windows\System\YbqbYHv.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\GyQitiY.exe
  C:\Windows\System\GyQitiY.exe
  2⤵
  PID:5152
- C:\Windows\System\CSVPLdd.exe
  C:\Windows\System\CSVPLdd.exe
  2⤵
  PID:5180
- C:\Windows\System\EbHmCnr.exe
  C:\Windows\System\EbHmCnr.exe
  2⤵
  PID:5232
- C:\Windows\System\fmCVnfd.exe
  C:\Windows\System\fmCVnfd.exe
  2⤵
  PID:5256
- C:\Windows\System\DHNeiUN.exe
  C:\Windows\System\DHNeiUN.exe
  2⤵
  PID:5272
- C:\Windows\System\iLomUGj.exe
  C:\Windows\System\iLomUGj.exe
  2⤵
  PID:5300
- C:\Windows\System\KjyHHkU.exe
  C:\Windows\System\KjyHHkU.exe
  2⤵
  PID:5328
- C:\Windows\System\MOlkHhe.exe
  C:\Windows\System\MOlkHhe.exe
  2⤵
  PID:5356
- C:\Windows\System\jXLDpjw.exe
  C:\Windows\System\jXLDpjw.exe
  2⤵
  PID:5384
- C:\Windows\System\lVphqog.exe
  C:\Windows\System\lVphqog.exe
  2⤵
  PID:5412
- C:\Windows\System\DBqlbZK.exe
  C:\Windows\System\DBqlbZK.exe
  2⤵
  PID:5440
- C:\Windows\System\ASPGnTu.exe
  C:\Windows\System\ASPGnTu.exe
  2⤵
  PID:5456
- C:\Windows\System\wooaRJu.exe
  C:\Windows\System\wooaRJu.exe
  2⤵
  PID:5484
- C:\Windows\System\haFisNs.exe
  C:\Windows\System\haFisNs.exe
  2⤵
  PID:5512
- C:\Windows\System\ddqUASU.exe
  C:\Windows\System\ddqUASU.exe
  2⤵
  PID:5540
- C:\Windows\System\ZROGgAC.exe
  C:\Windows\System\ZROGgAC.exe
  2⤵
  PID:5568
- C:\Windows\System\UWlofQI.exe
  C:\Windows\System\UWlofQI.exe
  2⤵
  PID:5596
- C:\Windows\System\pobVwCE.exe
  C:\Windows\System\pobVwCE.exe
  2⤵
  PID:5624
- C:\Windows\System\CFQrGaG.exe
  C:\Windows\System\CFQrGaG.exe
  2⤵
  PID:5652
- C:\Windows\System\hYjnpto.exe
  C:\Windows\System\hYjnpto.exe
  2⤵
  PID:5680
- C:\Windows\System\mWqHTMd.exe
  C:\Windows\System\mWqHTMd.exe
  2⤵
  PID:5708
- C:\Windows\System\GjZuusr.exe
  C:\Windows\System\GjZuusr.exe
  2⤵
  PID:5736
- C:\Windows\System\ZsjsCZX.exe
  C:\Windows\System\ZsjsCZX.exe
  2⤵
  PID:5768
- C:\Windows\System\ZYcwLtY.exe
  C:\Windows\System\ZYcwLtY.exe
  2⤵
  PID:5792
- C:\Windows\System\mJXqpRd.exe
  C:\Windows\System\mJXqpRd.exe
  2⤵
  PID:5820
- C:\Windows\System\yzwgYAT.exe
  C:\Windows\System\yzwgYAT.exe
  2⤵
  PID:5848
- C:\Windows\System\GxYjTvQ.exe
  C:\Windows\System\GxYjTvQ.exe
  2⤵
  PID:5876
- C:\Windows\System\FKdffPm.exe
  C:\Windows\System\FKdffPm.exe
  2⤵
  PID:5904
- C:\Windows\System\FQOvBrQ.exe
  C:\Windows\System\FQOvBrQ.exe
  2⤵
  PID:5932
- C:\Windows\System\kRIDLYY.exe
  C:\Windows\System\kRIDLYY.exe
  2⤵
  PID:5960
- C:\Windows\System\mfsXHqn.exe
  C:\Windows\System\mfsXHqn.exe
  2⤵
  PID:5988
- C:\Windows\System\gtCUCXg.exe
  C:\Windows\System\gtCUCXg.exe
  2⤵
  PID:6016
- C:\Windows\System\PboPcdw.exe
  C:\Windows\System\PboPcdw.exe
  2⤵
  PID:6044
- C:\Windows\System\KWROnGz.exe
  C:\Windows\System\KWROnGz.exe
  2⤵
  PID:6072
- C:\Windows\System\JsYvdPh.exe
  C:\Windows\System\JsYvdPh.exe
  2⤵
  PID:6100
- C:\Windows\System\YeccNFW.exe
  C:\Windows\System\YeccNFW.exe
  2⤵
  PID:6128
- C:\Windows\System\MthomYT.exe
  C:\Windows\System\MthomYT.exe
  2⤵
  PID:4860
- C:\Windows\System\OeNeyEJ.exe
  C:\Windows\System\OeNeyEJ.exe
  2⤵
  PID:2616
- C:\Windows\System\PaNEDxe.exe
  C:\Windows\System\PaNEDxe.exe
  2⤵
  PID:5048
- C:\Windows\System\gFPeRlE.exe
  C:\Windows\System\gFPeRlE.exe
  2⤵
  PID:1724
- C:\Windows\System\mHCIBdg.exe
  C:\Windows\System\mHCIBdg.exe
  2⤵
  PID:4836
- C:\Windows\System\inpRSGg.exe
  C:\Windows\System\inpRSGg.exe
  2⤵
  PID:3748
- C:\Windows\System\uaYCjCN.exe
  C:\Windows\System\uaYCjCN.exe
  2⤵
  PID:5172
- C:\Windows\System\DhSMvkg.exe
  C:\Windows\System\DhSMvkg.exe
  2⤵
  PID:5248
- C:\Windows\System\HAySRBF.exe
  C:\Windows\System\HAySRBF.exe
  2⤵
  PID:5316
- C:\Windows\System\YEGvqpG.exe
  C:\Windows\System\YEGvqpG.exe
  2⤵
  PID:5380
- C:\Windows\System\ORVksUn.exe
  C:\Windows\System\ORVksUn.exe
  2⤵
  PID:5432
- C:\Windows\System\MZidati.exe
  C:\Windows\System\MZidati.exe
  2⤵
  PID:5504
- C:\Windows\System\RyCQfOb.exe
  C:\Windows\System\RyCQfOb.exe
  2⤵
  PID:5580
- C:\Windows\System\JaKRFBG.exe
  C:\Windows\System\JaKRFBG.exe
  2⤵
  PID:5640
- C:\Windows\System\JJgSQEe.exe
  C:\Windows\System\JJgSQEe.exe
  2⤵
  PID:5700
- C:\Windows\System\wnXuxBR.exe
  C:\Windows\System\wnXuxBR.exe
  2⤵
  PID:5776
- C:\Windows\System\BiWuFtx.exe
  C:\Windows\System\BiWuFtx.exe
  2⤵
  PID:5836
- C:\Windows\System\ityGpMa.exe
  C:\Windows\System\ityGpMa.exe
  2⤵
  PID:5896
- C:\Windows\System\ozwdCMJ.exe
  C:\Windows\System\ozwdCMJ.exe
  2⤵
  PID:5972
- C:\Windows\System\eNNzZuP.exe
  C:\Windows\System\eNNzZuP.exe
  2⤵
  PID:6032
- C:\Windows\System\uaWWncY.exe
  C:\Windows\System\uaWWncY.exe
  2⤵
  PID:6092
- C:\Windows\System\MmXcViA.exe
  C:\Windows\System\MmXcViA.exe
  2⤵
  PID:1624
- C:\Windows\System\TjBskkf.exe
  C:\Windows\System\TjBskkf.exe
  2⤵
  PID:3744
- C:\Windows\System\IXkDoZT.exe
  C:\Windows\System\IXkDoZT.exe
  2⤵
  PID:868
- C:\Windows\System\xnyFCgE.exe
  C:\Windows\System\xnyFCgE.exe
  2⤵
  PID:5240
- C:\Windows\System\CiUkgbj.exe
  C:\Windows\System\CiUkgbj.exe
  2⤵
  PID:5404
- C:\Windows\System\HuXfghh.exe
  C:\Windows\System\HuXfghh.exe
  2⤵
  PID:5532
- C:\Windows\System\QqffTNN.exe
  C:\Windows\System\QqffTNN.exe
  2⤵
  PID:5672
- C:\Windows\System\Cmesqee.exe
  C:\Windows\System\Cmesqee.exe
  2⤵
  PID:5812
- C:\Windows\System\sGvsOPy.exe
  C:\Windows\System\sGvsOPy.exe
  2⤵
  PID:6148
- C:\Windows\System\RvPbYyi.exe
  C:\Windows\System\RvPbYyi.exe
  2⤵
  PID:6176
- C:\Windows\System\jIwYmfF.exe
  C:\Windows\System\jIwYmfF.exe
  2⤵
  PID:6204
- C:\Windows\System\OPakIHT.exe
  C:\Windows\System\OPakIHT.exe
  2⤵
  PID:6228
- C:\Windows\System\LQXYvew.exe
  C:\Windows\System\LQXYvew.exe
  2⤵
  PID:6260
- C:\Windows\System\NXPoROQ.exe
  C:\Windows\System\NXPoROQ.exe
  2⤵
  PID:6288
- C:\Windows\System\NkCZjBC.exe
  C:\Windows\System\NkCZjBC.exe
  2⤵
  PID:6312
- C:\Windows\System\IiffJlS.exe
  C:\Windows\System\IiffJlS.exe
  2⤵
  PID:6344
- C:\Windows\System\vwACtZY.exe
  C:\Windows\System\vwACtZY.exe
  2⤵
  PID:6372
- C:\Windows\System\OzvNMJl.exe
  C:\Windows\System\OzvNMJl.exe
  2⤵
  PID:6400
- C:\Windows\System\KGkusJX.exe
  C:\Windows\System\KGkusJX.exe
  2⤵
  PID:6424
- C:\Windows\System\cKldkse.exe
  C:\Windows\System\cKldkse.exe
  2⤵
  PID:6452
- C:\Windows\System\FNddTzv.exe
  C:\Windows\System\FNddTzv.exe
  2⤵
  PID:6480
- C:\Windows\System\iiLakcG.exe
  C:\Windows\System\iiLakcG.exe
  2⤵
  PID:6508
- C:\Windows\System\Gzyggnx.exe
  C:\Windows\System\Gzyggnx.exe
  2⤵
  PID:6536
- C:\Windows\System\rKSoXyh.exe
  C:\Windows\System\rKSoXyh.exe
  2⤵
  PID:6568
- C:\Windows\System\lqkevVs.exe
  C:\Windows\System\lqkevVs.exe
  2⤵
  PID:6596
- C:\Windows\System\tkYGyrS.exe
  C:\Windows\System\tkYGyrS.exe
  2⤵
  PID:6624
- C:\Windows\System\LvFQVol.exe
  C:\Windows\System\LvFQVol.exe
  2⤵
  PID:6652
- C:\Windows\System\vbJgfrE.exe
  C:\Windows\System\vbJgfrE.exe
  2⤵
  PID:6680
- C:\Windows\System\iveNJut.exe
  C:\Windows\System\iveNJut.exe
  2⤵
  PID:6708
- C:\Windows\System\zFHQZCX.exe
  C:\Windows\System\zFHQZCX.exe
  2⤵
  PID:6736
- C:\Windows\System\hzUNeyY.exe
  C:\Windows\System\hzUNeyY.exe
  2⤵
  PID:6764
- C:\Windows\System\WBOZrqP.exe
  C:\Windows\System\WBOZrqP.exe
  2⤵
  PID:6792
- C:\Windows\System\whaacSC.exe
  C:\Windows\System\whaacSC.exe
  2⤵
  PID:6820
- C:\Windows\System\ieEdYZO.exe
  C:\Windows\System\ieEdYZO.exe
  2⤵
  PID:6848
- C:\Windows\System\jHZVgIG.exe
  C:\Windows\System\jHZVgIG.exe
  2⤵
  PID:6876
- C:\Windows\System\oQynTXQ.exe
  C:\Windows\System\oQynTXQ.exe
  2⤵
  PID:6904
- C:\Windows\System\cNUheNP.exe
  C:\Windows\System\cNUheNP.exe
  2⤵
  PID:6936
- C:\Windows\System\SQrzXqY.exe
  C:\Windows\System\SQrzXqY.exe
  2⤵
  PID:6964
- C:\Windows\System\zLAdVig.exe
  C:\Windows\System\zLAdVig.exe
  2⤵
  PID:6992
- C:\Windows\System\PcEqxLG.exe
  C:\Windows\System\PcEqxLG.exe
  2⤵
  PID:7020
- C:\Windows\System\AfzFUwY.exe
  C:\Windows\System\AfzFUwY.exe
  2⤵
  PID:7048
- C:\Windows\System\UmDeFgl.exe
  C:\Windows\System\UmDeFgl.exe
  2⤵
  PID:7076
- C:\Windows\System\pQtItCl.exe
  C:\Windows\System\pQtItCl.exe
  2⤵
  PID:7104
- C:\Windows\System\qRrlQsX.exe
  C:\Windows\System\qRrlQsX.exe
  2⤵
  PID:7132
- C:\Windows\System\usbJjSQ.exe
  C:\Windows\System\usbJjSQ.exe
  2⤵
  PID:7160
- C:\Windows\System\LVqcIWj.exe
  C:\Windows\System\LVqcIWj.exe
  2⤵
  PID:6084
- C:\Windows\System\KZMNqIB.exe
  C:\Windows\System\KZMNqIB.exe
  2⤵
  PID:2668
- C:\Windows\System\wRyIBvo.exe
  C:\Windows\System\wRyIBvo.exe
  2⤵
  PID:5220
- C:\Windows\System\LllOxjW.exe
  C:\Windows\System\LllOxjW.exe
  2⤵
  PID:5608
- C:\Windows\System\gvvHjqu.exe
  C:\Windows\System\gvvHjqu.exe
  2⤵
  PID:5888
- C:\Windows\System\DMjsiJW.exe
  C:\Windows\System\DMjsiJW.exe
  2⤵
  PID:6188
- C:\Windows\System\nUOkqjy.exe
  C:\Windows\System\nUOkqjy.exe
  2⤵
  PID:6252
- C:\Windows\System\WeTNLjW.exe
  C:\Windows\System\WeTNLjW.exe
  2⤵
  PID:6328
- C:\Windows\System\mYcnxUh.exe
  C:\Windows\System\mYcnxUh.exe
  2⤵
  PID:764
- C:\Windows\System\rmcrayz.exe
  C:\Windows\System\rmcrayz.exe
  2⤵
  PID:6448
- C:\Windows\System\kqZtPJb.exe
  C:\Windows\System\kqZtPJb.exe
  2⤵
  PID:3580
- C:\Windows\System\qpeUFDK.exe
  C:\Windows\System\qpeUFDK.exe
  2⤵
  PID:6552
- C:\Windows\System\lqssVDG.exe
  C:\Windows\System\lqssVDG.exe
  2⤵
  PID:6612
- C:\Windows\System\GiHNemI.exe
  C:\Windows\System\GiHNemI.exe
  2⤵
  PID:6672
- C:\Windows\System\BHSiOIv.exe
  C:\Windows\System\BHSiOIv.exe
  2⤵
  PID:6728
- C:\Windows\System\CNBfBkA.exe
  C:\Windows\System\CNBfBkA.exe
  2⤵
  PID:6804
- C:\Windows\System\VeowHRr.exe
  C:\Windows\System\VeowHRr.exe
  2⤵
  PID:6864
- C:\Windows\System\HGsqrVo.exe
  C:\Windows\System\HGsqrVo.exe
  2⤵
  PID:6924
- C:\Windows\System\IEmgblH.exe
  C:\Windows\System\IEmgblH.exe
  2⤵
  PID:6984
- C:\Windows\System\BHeeOle.exe
  C:\Windows\System\BHeeOle.exe
  2⤵
  PID:7060
- C:\Windows\System\pzzmwyd.exe
  C:\Windows\System\pzzmwyd.exe
  2⤵
  PID:7116
- C:\Windows\System\QKYFkYV.exe
  C:\Windows\System\QKYFkYV.exe
  2⤵
  PID:7148
- C:\Windows\System\YQOzWus.exe
  C:\Windows\System\YQOzWus.exe
  2⤵
  PID:4120
- C:\Windows\System\vEbJiXT.exe
  C:\Windows\System\vEbJiXT.exe
  2⤵
  PID:4808
- C:\Windows\System\nUAXJbN.exe
  C:\Windows\System\nUAXJbN.exe
  2⤵
  PID:4536
- C:\Windows\System\ygOcltg.exe
  C:\Windows\System\ygOcltg.exe
  2⤵
  PID:4496
- C:\Windows\System\ykEpzVH.exe
  C:\Windows\System\ykEpzVH.exe
  2⤵
  PID:3352
- C:\Windows\System\rZwFpfc.exe
  C:\Windows\System\rZwFpfc.exe
  2⤵
  PID:3700
- C:\Windows\System\RNpZxth.exe
  C:\Windows\System\RNpZxth.exe
  2⤵
  PID:3680
- C:\Windows\System\ICSAWdj.exe
  C:\Windows\System\ICSAWdj.exe
  2⤵
  PID:7032
- C:\Windows\System\qruBGHh.exe
  C:\Windows\System\qruBGHh.exe
  2⤵
  PID:812
- C:\Windows\System\UOncxay.exe
  C:\Windows\System\UOncxay.exe
  2⤵
  PID:1856
- C:\Windows\System\zJtExzX.exe
  C:\Windows\System\zJtExzX.exe
  2⤵
  PID:6392
- C:\Windows\System\rQVFmzU.exe
  C:\Windows\System\rQVFmzU.exe
  2⤵
  PID:4660
- C:\Windows\System\YDoaknk.exe
  C:\Windows\System\YDoaknk.exe
  2⤵
  PID:3028
- C:\Windows\System\mNUChOs.exe
  C:\Windows\System\mNUChOs.exe
  2⤵
  PID:3496
- C:\Windows\System\TsnePKo.exe
  C:\Windows\System\TsnePKo.exe
  2⤵
  PID:4448
- C:\Windows\System\lbuJKla.exe
  C:\Windows\System\lbuJKla.exe
  2⤵
  PID:404
- C:\Windows\System\puRxuBT.exe
  C:\Windows\System\puRxuBT.exe
  2⤵
  PID:1688
- C:\Windows\System\BOqTUIF.exe
  C:\Windows\System\BOqTUIF.exe
  2⤵
  PID:216
- C:\Windows\System\nFgCXaf.exe
  C:\Windows\System\nFgCXaf.exe
  2⤵
  PID:5160
- C:\Windows\System\YPZmTAo.exe
  C:\Windows\System\YPZmTAo.exe
  2⤵
  PID:4432
- C:\Windows\System\xyfBMrJ.exe
  C:\Windows\System\xyfBMrJ.exe
  2⤵
  PID:7172
- C:\Windows\System\MvbLVGh.exe
  C:\Windows\System\MvbLVGh.exe
  2⤵
  PID:7224
- C:\Windows\System\hnvSKpz.exe
  C:\Windows\System\hnvSKpz.exe
  2⤵
  PID:7248
- C:\Windows\System\UCgAnzj.exe
  C:\Windows\System\UCgAnzj.exe
  2⤵
  PID:7284
- C:\Windows\System\CsilUyx.exe
  C:\Windows\System\CsilUyx.exe
  2⤵
  PID:7352
- C:\Windows\System\NkgnaAr.exe
  C:\Windows\System\NkgnaAr.exe
  2⤵
  PID:7368
- C:\Windows\System\JfcOpSF.exe
  C:\Windows\System\JfcOpSF.exe
  2⤵
  PID:7392
- C:\Windows\System\DFWqKfx.exe
  C:\Windows\System\DFWqKfx.exe
  2⤵
  PID:7408
- C:\Windows\System\KuKqBfA.exe
  C:\Windows\System\KuKqBfA.exe
  2⤵
  PID:7436
- C:\Windows\System\UNPABxq.exe
  C:\Windows\System\UNPABxq.exe
  2⤵
  PID:7452
- C:\Windows\System\gBIflPu.exe
  C:\Windows\System\gBIflPu.exe
  2⤵
  PID:7472
- C:\Windows\System\VYyOfPC.exe
  C:\Windows\System\VYyOfPC.exe
  2⤵
  PID:7496
- C:\Windows\System\ROJPqco.exe
  C:\Windows\System\ROJPqco.exe
  2⤵
  PID:7520
- C:\Windows\System\opbBcpw.exe
  C:\Windows\System\opbBcpw.exe
  2⤵
  PID:7540
- C:\Windows\System\pqvAhaA.exe
  C:\Windows\System\pqvAhaA.exe
  2⤵
  PID:7556
- C:\Windows\System\bdNGbOW.exe
  C:\Windows\System\bdNGbOW.exe
  2⤵
  PID:7620
- C:\Windows\System\qKCIwcG.exe
  C:\Windows\System\qKCIwcG.exe
  2⤵
  PID:7664
- C:\Windows\System\IbvEsaa.exe
  C:\Windows\System\IbvEsaa.exe
  2⤵
  PID:7712
- C:\Windows\System\MGRGUag.exe
  C:\Windows\System\MGRGUag.exe
  2⤵
  PID:7776
- C:\Windows\System\xvNleuy.exe
  C:\Windows\System\xvNleuy.exe
  2⤵
  PID:7800
- C:\Windows\System\tAcTdcn.exe
  C:\Windows\System\tAcTdcn.exe
  2⤵
  PID:7832
- C:\Windows\System\LaBjhXm.exe
  C:\Windows\System\LaBjhXm.exe
  2⤵
  PID:7888
- C:\Windows\System\PZwjXLw.exe
  C:\Windows\System\PZwjXLw.exe
  2⤵
  PID:7904
- C:\Windows\System\lPDfofL.exe
  C:\Windows\System\lPDfofL.exe
  2⤵
  PID:7944
- C:\Windows\System\yAriCJC.exe
  C:\Windows\System\yAriCJC.exe
  2⤵
  PID:7964
- C:\Windows\System\NTPzMyk.exe
  C:\Windows\System\NTPzMyk.exe
  2⤵
  PID:8060
- C:\Windows\System\sMYUyMH.exe
  C:\Windows\System\sMYUyMH.exe
  2⤵
  PID:8088
- C:\Windows\System\jMplHRv.exe
  C:\Windows\System\jMplHRv.exe
  2⤵
  PID:8108
- C:\Windows\System\VCeCamv.exe
  C:\Windows\System\VCeCamv.exe
  2⤵
  PID:8124
- C:\Windows\System\vVkKfUC.exe
  C:\Windows\System\vVkKfUC.exe
  2⤵
  PID:8164
- C:\Windows\System\XHwcwfF.exe
  C:\Windows\System\XHwcwfF.exe
  2⤵
  PID:516
- C:\Windows\System\UeRhxbs.exe
  C:\Windows\System\UeRhxbs.exe
  2⤵
  PID:7208
- C:\Windows\System\rHkIRUW.exe
  C:\Windows\System\rHkIRUW.exe
  2⤵
  PID:7308
- C:\Windows\System\pHJniCD.exe
  C:\Windows\System\pHJniCD.exe
  2⤵
  PID:7404
- C:\Windows\System\umSZHUn.exe
  C:\Windows\System\umSZHUn.exe
  2⤵
  PID:7444
- C:\Windows\System\XeYWFay.exe
  C:\Windows\System\XeYWFay.exe
  2⤵
  PID:7512
- C:\Windows\System\XfdjKEu.exe
  C:\Windows\System\XfdjKEu.exe
  2⤵
  PID:7640
- C:\Windows\System\tHiNzip.exe
  C:\Windows\System\tHiNzip.exe
  2⤵
  PID:7656
- C:\Windows\System\hXBtOgG.exe
  C:\Windows\System\hXBtOgG.exe
  2⤵
  PID:7796
- C:\Windows\System\RiyoAlE.exe
  C:\Windows\System\RiyoAlE.exe
  2⤵
  PID:6224
- C:\Windows\System\eIuoRtR.exe
  C:\Windows\System\eIuoRtR.exe
  2⤵
  PID:7900
- C:\Windows\System\YzYctUA.exe
  C:\Windows\System\YzYctUA.exe
  2⤵
  PID:7960
- C:\Windows\System\KuAQRNu.exe
  C:\Windows\System\KuAQRNu.exe
  2⤵
  PID:8076
- C:\Windows\System\AuVVFnt.exe
  C:\Windows\System\AuVVFnt.exe
  2⤵
  PID:8100
- C:\Windows\System\eIAJHKE.exe
  C:\Windows\System\eIAJHKE.exe
  2⤵
  PID:7216
- C:\Windows\System\dbToyXW.exe
  C:\Windows\System\dbToyXW.exe
  2⤵
  PID:7360
- C:\Windows\System\mHKikpQ.exe
  C:\Windows\System\mHKikpQ.exe
  2⤵
  PID:7748
- C:\Windows\System\atMxcts.exe
  C:\Windows\System\atMxcts.exe
  2⤵
  PID:3784
- C:\Windows\System\VqcLnrb.exe
  C:\Windows\System\VqcLnrb.exe
  2⤵
  PID:660
- C:\Windows\System\LfPmjgW.exe
  C:\Windows\System\LfPmjgW.exe
  2⤵
  PID:8096
- C:\Windows\System\yjmnaOB.exe
  C:\Windows\System\yjmnaOB.exe
  2⤵
  PID:7340
- C:\Windows\System\UphnYbo.exe
  C:\Windows\System\UphnYbo.exe
  2⤵
  PID:7192
- C:\Windows\System\gxEDjEj.exe
  C:\Windows\System\gxEDjEj.exe
  2⤵
  PID:8152
- C:\Windows\System\UVUmzFM.exe
  C:\Windows\System\UVUmzFM.exe
  2⤵
  PID:1128
- C:\Windows\System\pMnOqrR.exe
  C:\Windows\System\pMnOqrR.exe
  2⤵
  PID:8200
- C:\Windows\System\bgoeJVq.exe
  C:\Windows\System\bgoeJVq.exe
  2⤵
  PID:8220
- C:\Windows\System\nlhDUAT.exe
  C:\Windows\System\nlhDUAT.exe
  2⤵
  PID:8256
- C:\Windows\System\zOkTrdE.exe
  C:\Windows\System\zOkTrdE.exe
  2⤵
  PID:8284
- C:\Windows\System\aspfPww.exe
  C:\Windows\System\aspfPww.exe
  2⤵
  PID:8312
- C:\Windows\System\maUtKpx.exe
  C:\Windows\System\maUtKpx.exe
  2⤵
  PID:8340
- C:\Windows\System\QeUOpOx.exe
  C:\Windows\System\QeUOpOx.exe
  2⤵
  PID:8368
- C:\Windows\System\hLrnmFR.exe
  C:\Windows\System\hLrnmFR.exe
  2⤵
  PID:8384
- C:\Windows\System\PSacujX.exe
  C:\Windows\System\PSacujX.exe
  2⤵
  PID:8432
- C:\Windows\System\ELzwvuQ.exe
  C:\Windows\System\ELzwvuQ.exe
  2⤵
  PID:8464
- C:\Windows\System\QcoBbfz.exe
  C:\Windows\System\QcoBbfz.exe
  2⤵
  PID:8492
- C:\Windows\System\LapUrjC.exe
  C:\Windows\System\LapUrjC.exe
  2⤵
  PID:8520
- C:\Windows\System\ocJihUg.exe
  C:\Windows\System\ocJihUg.exe
  2⤵
  PID:8552
- C:\Windows\System\RjfuuUU.exe
  C:\Windows\System\RjfuuUU.exe
  2⤵
  PID:8588
- C:\Windows\System\OrGGoHC.exe
  C:\Windows\System\OrGGoHC.exe
  2⤵
  PID:8616
- C:\Windows\System\sujXYgH.exe
  C:\Windows\System\sujXYgH.exe
  2⤵
  PID:8644
- C:\Windows\System\XuRCbNa.exe
  C:\Windows\System\XuRCbNa.exe
  2⤵
  PID:8672
- C:\Windows\System\SLfaRCa.exe
  C:\Windows\System\SLfaRCa.exe
  2⤵
  PID:8700
- C:\Windows\System\mceqVHb.exe
  C:\Windows\System\mceqVHb.exe
  2⤵
  PID:8732
- C:\Windows\System\psKSISn.exe
  C:\Windows\System\psKSISn.exe
  2⤵
  PID:8760
- C:\Windows\System\PYiNdXy.exe
  C:\Windows\System\PYiNdXy.exe
  2⤵
  PID:8788
- C:\Windows\System\mnrFzeH.exe
  C:\Windows\System\mnrFzeH.exe
  2⤵
  PID:8816
- C:\Windows\System\XkzngBp.exe
  C:\Windows\System\XkzngBp.exe
  2⤵
  PID:8844
- C:\Windows\System\PTYbOMk.exe
  C:\Windows\System\PTYbOMk.exe
  2⤵
  PID:8872
- C:\Windows\System\EGDwIke.exe
  C:\Windows\System\EGDwIke.exe
  2⤵
  PID:8900
- C:\Windows\System\iaUnSDo.exe
  C:\Windows\System\iaUnSDo.exe
  2⤵
  PID:8928
- C:\Windows\System\tZXPAjd.exe
  C:\Windows\System\tZXPAjd.exe
  2⤵
  PID:8956
- C:\Windows\System\dvCPEyp.exe
  C:\Windows\System\dvCPEyp.exe
  2⤵
  PID:8984
- C:\Windows\System\KpdunRh.exe
  C:\Windows\System\KpdunRh.exe
  2⤵
  PID:9012
- C:\Windows\System\NXLZlNu.exe
  C:\Windows\System\NXLZlNu.exe
  2⤵
  PID:9048
- C:\Windows\System\pTINmut.exe
  C:\Windows\System\pTINmut.exe
  2⤵
  PID:9072
- C:\Windows\System\XusaBjn.exe
  C:\Windows\System\XusaBjn.exe
  2⤵
  PID:9100
- C:\Windows\System\zrOQDPT.exe
  C:\Windows\System\zrOQDPT.exe
  2⤵
  PID:9128
- C:\Windows\System\aIAyAld.exe
  C:\Windows\System\aIAyAld.exe
  2⤵
  PID:9156
- C:\Windows\System\HBxepxD.exe
  C:\Windows\System\HBxepxD.exe
  2⤵
  PID:9184
- C:\Windows\System\tjoYbBj.exe
  C:\Windows\System\tjoYbBj.exe
  2⤵
  PID:4944
- C:\Windows\System\iPQlhDu.exe
  C:\Windows\System\iPQlhDu.exe
  2⤵
  PID:8252
- C:\Windows\System\SxgNqhb.exe
  C:\Windows\System\SxgNqhb.exe
  2⤵
  PID:7260
- C:\Windows\System\NXcIWSJ.exe
  C:\Windows\System\NXcIWSJ.exe
  2⤵
  PID:8356
- C:\Windows\System\RBBtgsD.exe
  C:\Windows\System\RBBtgsD.exe
  2⤵
  PID:8424
- C:\Windows\System\jAIztmw.exe
  C:\Windows\System\jAIztmw.exe
  2⤵
  PID:8484
- C:\Windows\System\nqQjwRz.exe
  C:\Windows\System\nqQjwRz.exe
  2⤵
  PID:8548
- C:\Windows\System\lNQJpRA.exe
  C:\Windows\System\lNQJpRA.exe
  2⤵
  PID:8564
- C:\Windows\System\qNOOdWR.exe
  C:\Windows\System\qNOOdWR.exe
  2⤵
  PID:8660
- C:\Windows\System\ZhXjgiV.exe
  C:\Windows\System\ZhXjgiV.exe
  2⤵
  PID:8724
- C:\Windows\System\jQVlNtj.exe
  C:\Windows\System\jQVlNtj.exe
  2⤵
  PID:8780
- C:\Windows\System\KKeUSVN.exe
  C:\Windows\System\KKeUSVN.exe
  2⤵
  PID:8832
- C:\Windows\System\wSPuutw.exe
  C:\Windows\System\wSPuutw.exe
  2⤵
  PID:8892
- C:\Windows\System\wYDAHrl.exe
  C:\Windows\System\wYDAHrl.exe
  2⤵
  PID:8952
- C:\Windows\System\tVqbYWm.exe
  C:\Windows\System\tVqbYWm.exe
  2⤵
  PID:9004
- C:\Windows\System\ztTbooK.exe
  C:\Windows\System\ztTbooK.exe
  2⤵
  PID:9068
- C:\Windows\System\YKsGZpn.exe
  C:\Windows\System\YKsGZpn.exe
  2⤵
  PID:9140
- C:\Windows\System\AYfKJRl.exe
  C:\Windows\System\AYfKJRl.exe
  2⤵
  PID:9208
- C:\Windows\System\wrnDEZQ.exe
  C:\Windows\System\wrnDEZQ.exe
  2⤵
  PID:8308
- C:\Windows\System\BndvnGl.exe
  C:\Windows\System\BndvnGl.exe
  2⤵
  PID:3868
- C:\Windows\System\SQUmgJD.exe
  C:\Windows\System\SQUmgJD.exe
  2⤵
  PID:8600
- C:\Windows\System\FPlXkJJ.exe
  C:\Windows\System\FPlXkJJ.exe
  2⤵
  PID:8712
- C:\Windows\System\PexPxTY.exe
  C:\Windows\System\PexPxTY.exe
  2⤵
  PID:8856
- C:\Windows\System\sFMcYNV.exe
  C:\Windows\System\sFMcYNV.exe
  2⤵
  PID:8980
- C:\Windows\System\RkJEJfx.exe
  C:\Windows\System\RkJEJfx.exe
  2⤵
  PID:9120
- C:\Windows\System\EQRgPgC.exe
  C:\Windows\System\EQRgPgC.exe
  2⤵
  PID:8380
- C:\Windows\System\PiFHsIH.exe
  C:\Windows\System\PiFHsIH.exe
  2⤵
  PID:8688
- C:\Windows\System\gzBdHWj.exe
  C:\Windows\System\gzBdHWj.exe
  2⤵
  PID:8968
- C:\Windows\System\QBFaYDY.exe
  C:\Windows\System\QBFaYDY.exe
  2⤵
  PID:7460
- C:\Windows\System\Cvixpfl.exe
  C:\Windows\System\Cvixpfl.exe
  2⤵
  PID:8276
- C:\Windows\System\dzoDQJU.exe
  C:\Windows\System\dzoDQJU.exe
  2⤵
  PID:9220
- C:\Windows\System\mMvqVcS.exe
  C:\Windows\System\mMvqVcS.exe
  2⤵
  PID:9252
- C:\Windows\System\KeyASxJ.exe
  C:\Windows\System\KeyASxJ.exe
  2⤵
  PID:9280
- C:\Windows\System\ffScqch.exe
  C:\Windows\System\ffScqch.exe
  2⤵
  PID:9316
- C:\Windows\System\IdbUTsC.exe
  C:\Windows\System\IdbUTsC.exe
  2⤵
  PID:9344
- C:\Windows\System\IliGiRb.exe
  C:\Windows\System\IliGiRb.exe
  2⤵
  PID:9372
- C:\Windows\System\UiBIGUY.exe
  C:\Windows\System\UiBIGUY.exe
  2⤵
  PID:9400
- C:\Windows\System\eHBZgzl.exe
  C:\Windows\System\eHBZgzl.exe
  2⤵
  PID:9428
- C:\Windows\System\xuXyZpI.exe
  C:\Windows\System\xuXyZpI.exe
  2⤵
  PID:9456
- C:\Windows\System\SKqnLiE.exe
  C:\Windows\System\SKqnLiE.exe
  2⤵
  PID:9484
- C:\Windows\System\xJmJRhc.exe
  C:\Windows\System\xJmJRhc.exe
  2⤵
  PID:9512
- C:\Windows\System\DhZSYkC.exe
  C:\Windows\System\DhZSYkC.exe
  2⤵
  PID:9540
- C:\Windows\System\uVLqHZk.exe
  C:\Windows\System\uVLqHZk.exe
  2⤵
  PID:9572
- C:\Windows\System\suNCXcL.exe
  C:\Windows\System\suNCXcL.exe
  2⤵
  PID:9612
- C:\Windows\System\vaWwUcu.exe
  C:\Windows\System\vaWwUcu.exe
  2⤵
  PID:9636
- C:\Windows\System\BOLAufS.exe
  C:\Windows\System\BOLAufS.exe
  2⤵
  PID:9664
- C:\Windows\System\rAXjnyY.exe
  C:\Windows\System\rAXjnyY.exe
  2⤵
  PID:9692
- C:\Windows\System\pnrTvJh.exe
  C:\Windows\System\pnrTvJh.exe
  2⤵
  PID:9708
- C:\Windows\System\cXAwwPM.exe
  C:\Windows\System\cXAwwPM.exe
  2⤵
  PID:9732
- C:\Windows\System\QOHzJrr.exe
  C:\Windows\System\QOHzJrr.exe
  2⤵
  PID:9752
- C:\Windows\System\wTdrpPQ.exe
  C:\Windows\System\wTdrpPQ.exe
  2⤵
  PID:9804
- C:\Windows\System\XpbLmhq.exe
  C:\Windows\System\XpbLmhq.exe
  2⤵
  PID:9832
- C:\Windows\System\uiFkvmj.exe
  C:\Windows\System\uiFkvmj.exe
  2⤵
  PID:9860
- C:\Windows\System\LaMGpWD.exe
  C:\Windows\System\LaMGpWD.exe
  2⤵
  PID:9888
- C:\Windows\System\lNnsLJq.exe
  C:\Windows\System\lNnsLJq.exe
  2⤵
  PID:9916
- C:\Windows\System\IVqJmOT.exe
  C:\Windows\System\IVqJmOT.exe
  2⤵
  PID:9944
- C:\Windows\System\oiPzMrg.exe
  C:\Windows\System\oiPzMrg.exe
  2⤵
  PID:9972
- C:\Windows\System\xYoWOSi.exe
  C:\Windows\System\xYoWOSi.exe
  2⤵
  PID:10000
- C:\Windows\System\MIIOxnZ.exe
  C:\Windows\System\MIIOxnZ.exe
  2⤵
  PID:10028
- C:\Windows\System\kcWvbxa.exe
  C:\Windows\System\kcWvbxa.exe
  2⤵
  PID:10056
- C:\Windows\System\ifHjOPW.exe
  C:\Windows\System\ifHjOPW.exe
  2⤵
  PID:10084
- C:\Windows\System\OpmzleI.exe
  C:\Windows\System\OpmzleI.exe
  2⤵
  PID:10112
- C:\Windows\System\YMsJBbc.exe
  C:\Windows\System\YMsJBbc.exe
  2⤵
  PID:10140
- C:\Windows\System\cCDQBhL.exe
  C:\Windows\System\cCDQBhL.exe
  2⤵
  PID:10168
- C:\Windows\System\KKTBJSP.exe
  C:\Windows\System\KKTBJSP.exe
  2⤵
  PID:10196
- C:\Windows\System\dSmacHN.exe
  C:\Windows\System\dSmacHN.exe
  2⤵
  PID:10224
- C:\Windows\System\qbbXqjd.exe
  C:\Windows\System\qbbXqjd.exe
  2⤵
  PID:9248
- C:\Windows\System\eUNiCfr.exe
  C:\Windows\System\eUNiCfr.exe
  2⤵
  PID:9312
- C:\Windows\System\pSnSzjE.exe
  C:\Windows\System\pSnSzjE.exe
  2⤵
  PID:9384
- C:\Windows\System\uqJtLvi.exe
  C:\Windows\System\uqJtLvi.exe
  2⤵
  PID:9448
- C:\Windows\System\DwuazFd.exe
  C:\Windows\System\DwuazFd.exe
  2⤵
  PID:9508
- C:\Windows\System\eoMQWSA.exe
  C:\Windows\System\eoMQWSA.exe
  2⤵
  PID:4956
- C:\Windows\System\EZeVpLX.exe
  C:\Windows\System\EZeVpLX.exe
  2⤵
  PID:7688
- C:\Windows\System\KwPFQsT.exe
  C:\Windows\System\KwPFQsT.exe
  2⤵
  PID:9568
- C:\Windows\System\gWHavbS.exe
  C:\Windows\System\gWHavbS.exe
  2⤵
  PID:9632
- C:\Windows\System\CkqVRHp.exe
  C:\Windows\System\CkqVRHp.exe
  2⤵
  PID:9704
- C:\Windows\System\qKIpHOO.exe
  C:\Windows\System\qKIpHOO.exe
  2⤵
  PID:9728
- C:\Windows\System\YLdqhNq.exe
  C:\Windows\System\YLdqhNq.exe
  2⤵
  PID:9800
- C:\Windows\System\XrlSJpc.exe
  C:\Windows\System\XrlSJpc.exe
  2⤵
  PID:9900
- C:\Windows\System\keMDUmh.exe
  C:\Windows\System\keMDUmh.exe
  2⤵
  PID:9964
- C:\Windows\System\uMcIArb.exe
  C:\Windows\System\uMcIArb.exe
  2⤵
  PID:10024
- C:\Windows\System\YWpYVig.exe
  C:\Windows\System\YWpYVig.exe
  2⤵
  PID:10100
- C:\Windows\System\famflbu.exe
  C:\Windows\System\famflbu.exe
  2⤵
  PID:10160
- C:\Windows\System\SNIxugv.exe
  C:\Windows\System\SNIxugv.exe
  2⤵
  PID:10220
- C:\Windows\System\XpqBrXv.exe
  C:\Windows\System\XpqBrXv.exe
  2⤵
  PID:9360
- C:\Windows\System\jYsutwS.exe
  C:\Windows\System\jYsutwS.exe
  2⤵
  PID:9496
- C:\Windows\System\BRFQfyd.exe
  C:\Windows\System\BRFQfyd.exe
  2⤵
  PID:8452
- C:\Windows\System\fOgCDtG.exe
  C:\Windows\System\fOgCDtG.exe
  2⤵
  PID:9676
- C:\Windows\System\FUGduGx.exe
  C:\Windows\System\FUGduGx.exe
  2⤵
  PID:9796
- C:\Windows\System\gksKAfX.exe
  C:\Windows\System\gksKAfX.exe
  2⤵
  PID:9956
- C:\Windows\System\bkhuFIR.exe
  C:\Windows\System\bkhuFIR.exe
  2⤵
  PID:10132
- C:\Windows\System\pIgbYmH.exe
  C:\Windows\System\pIgbYmH.exe
  2⤵
  PID:9308
- C:\Windows\System\TuOFmrK.exe
  C:\Windows\System\TuOFmrK.exe
  2⤵
  PID:7856
- C:\Windows\System\skRXeBk.exe
  C:\Windows\System\skRXeBk.exe
  2⤵
  PID:9880
- C:\Windows\System\wdAEOuA.exe
  C:\Windows\System\wdAEOuA.exe
  2⤵
  PID:10216
- C:\Windows\System\hcdfoHH.exe
  C:\Windows\System\hcdfoHH.exe
  2⤵
  PID:9788
- C:\Windows\System\GYXVwHP.exe
  C:\Windows\System\GYXVwHP.exe
  2⤵
  PID:8420
- C:\Windows\System\xxOaNkG.exe
  C:\Windows\System\xxOaNkG.exe
  2⤵
  PID:10268
- C:\Windows\System\oynhDSV.exe
  C:\Windows\System\oynhDSV.exe
  2⤵
  PID:10296
- C:\Windows\System\KbqGkhe.exe
  C:\Windows\System\KbqGkhe.exe
  2⤵
  PID:10324
- C:\Windows\System\CVEoMPG.exe
  C:\Windows\System\CVEoMPG.exe
  2⤵
  PID:10352
- C:\Windows\System\GdYPXqm.exe
  C:\Windows\System\GdYPXqm.exe
  2⤵
  PID:10380
- C:\Windows\System\UMHJolt.exe
  C:\Windows\System\UMHJolt.exe
  2⤵
  PID:10408
- C:\Windows\System\vOhbZEo.exe
  C:\Windows\System\vOhbZEo.exe
  2⤵
  PID:10436
- C:\Windows\System\kHGGORf.exe
  C:\Windows\System\kHGGORf.exe
  2⤵
  PID:10464
- C:\Windows\System\xFgimKU.exe
  C:\Windows\System\xFgimKU.exe
  2⤵
  PID:10492
- C:\Windows\System\GsvVasv.exe
  C:\Windows\System\GsvVasv.exe
  2⤵
  PID:10520
- C:\Windows\System\kgyMPbt.exe
  C:\Windows\System\kgyMPbt.exe
  2⤵
  PID:10548
- C:\Windows\System\ByaweOb.exe
  C:\Windows\System\ByaweOb.exe
  2⤵
  PID:10576
- C:\Windows\System\OTSNHAN.exe
  C:\Windows\System\OTSNHAN.exe
  2⤵
  PID:10604
- C:\Windows\System\mjRhNXK.exe
  C:\Windows\System\mjRhNXK.exe
  2⤵
  PID:10632
- C:\Windows\System\IPNLPvO.exe
  C:\Windows\System\IPNLPvO.exe
  2⤵
  PID:10660
- C:\Windows\System\FFQCHNL.exe
  C:\Windows\System\FFQCHNL.exe
  2⤵
  PID:10688
- C:\Windows\System\aLWKBRs.exe
  C:\Windows\System\aLWKBRs.exe
  2⤵
  PID:10716
- C:\Windows\System\JEgmMQj.exe
  C:\Windows\System\JEgmMQj.exe
  2⤵
  PID:10744
- C:\Windows\System\xtZYDVs.exe
  C:\Windows\System\xtZYDVs.exe
  2⤵
  PID:10772
- C:\Windows\System\AqGWhMk.exe
  C:\Windows\System\AqGWhMk.exe
  2⤵
  PID:10804
- C:\Windows\System\twVCIra.exe
  C:\Windows\System\twVCIra.exe
  2⤵
  PID:10832
- C:\Windows\System\DAjGBVF.exe
  C:\Windows\System\DAjGBVF.exe
  2⤵
  PID:10860
- C:\Windows\System\zakYdYn.exe
  C:\Windows\System\zakYdYn.exe
  2⤵
  PID:10888
- C:\Windows\System\MLPGLps.exe
  C:\Windows\System\MLPGLps.exe
  2⤵
  PID:10916
- C:\Windows\System\SipugsX.exe
  C:\Windows\System\SipugsX.exe
  2⤵
  PID:10944
- C:\Windows\System\HGTKbJK.exe
  C:\Windows\System\HGTKbJK.exe
  2⤵
  PID:10972
- C:\Windows\System\ktrlvds.exe
  C:\Windows\System\ktrlvds.exe
  2⤵
  PID:11000
- C:\Windows\System\ykjXdZQ.exe
  C:\Windows\System\ykjXdZQ.exe
  2⤵
  PID:11028
- C:\Windows\System\ZpZYoIw.exe
  C:\Windows\System\ZpZYoIw.exe
  2⤵
  PID:11068
- C:\Windows\System\kAfwVKr.exe
  C:\Windows\System\kAfwVKr.exe
  2⤵
  PID:11084
- C:\Windows\System\NpdgTrl.exe
  C:\Windows\System\NpdgTrl.exe
  2⤵
  PID:11112
- C:\Windows\System\RJROLQn.exe
  C:\Windows\System\RJROLQn.exe
  2⤵
  PID:11140
- C:\Windows\System\uIffvAo.exe
  C:\Windows\System\uIffvAo.exe
  2⤵
  PID:11168
- C:\Windows\System\cGDCExq.exe
  C:\Windows\System\cGDCExq.exe
  2⤵
  PID:11196
- C:\Windows\System\tkQBhaC.exe
  C:\Windows\System\tkQBhaC.exe
  2⤵
  PID:11224
- C:\Windows\System\eYKtUFD.exe
  C:\Windows\System\eYKtUFD.exe
  2⤵
  PID:11252
- C:\Windows\System\NxPkfQu.exe
  C:\Windows\System\NxPkfQu.exe
  2⤵
  PID:10260
- C:\Windows\System\pOyYpOx.exe
  C:\Windows\System\pOyYpOx.exe
  2⤵
  PID:10320
- C:\Windows\System\wdldFmH.exe
  C:\Windows\System\wdldFmH.exe
  2⤵
  PID:10392
- C:\Windows\System\AppFkZm.exe
  C:\Windows\System\AppFkZm.exe
  2⤵
  PID:10456
- C:\Windows\System\QRlvwwG.exe
  C:\Windows\System\QRlvwwG.exe
  2⤵
  PID:10516
- C:\Windows\System\oWOGuAc.exe
  C:\Windows\System\oWOGuAc.exe
  2⤵
  PID:10588
- C:\Windows\System\dFkmMvZ.exe
  C:\Windows\System\dFkmMvZ.exe
  2⤵
  PID:10652
- C:\Windows\System\APOixaH.exe
  C:\Windows\System\APOixaH.exe
  2⤵
  PID:10712
- C:\Windows\System\TDYhJaO.exe
  C:\Windows\System\TDYhJaO.exe
  2⤵
  PID:10784
- C:\Windows\System\KQyeREn.exe
  C:\Windows\System\KQyeREn.exe
  2⤵
  PID:10848
- C:\Windows\System\QJemnEX.exe
  C:\Windows\System\QJemnEX.exe
  2⤵
  PID:10912
- C:\Windows\System\RxxiTKX.exe
  C:\Windows\System\RxxiTKX.exe
  2⤵
  PID:10988
- C:\Windows\System\leqLYEj.exe
  C:\Windows\System\leqLYEj.exe
  2⤵
  PID:11048
- C:\Windows\System\RdRyjjD.exe
  C:\Windows\System\RdRyjjD.exe
  2⤵
  PID:11108
- C:\Windows\System\crybyzR.exe
  C:\Windows\System\crybyzR.exe
  2⤵
  PID:11188
- C:\Windows\System\DvobcIa.exe
  C:\Windows\System\DvobcIa.exe
  2⤵
  PID:11244
- C:\Windows\System\JeAzpfJ.exe
  C:\Windows\System\JeAzpfJ.exe
  2⤵
  PID:10316
- C:\Windows\System\CbvRMCP.exe
  C:\Windows\System\CbvRMCP.exe
  2⤵
  PID:10484
- C:\Windows\System\tAiHjpG.exe
  C:\Windows\System\tAiHjpG.exe
  2⤵
  PID:10628
- C:\Windows\System\aAFyLSx.exe
  C:\Windows\System\aAFyLSx.exe
  2⤵
  PID:10764
- C:\Windows\System\GEsVEPJ.exe
  C:\Windows\System\GEsVEPJ.exe
  2⤵
  PID:10940
- C:\Windows\System\VraPAnd.exe
  C:\Windows\System\VraPAnd.exe
  2⤵
  PID:11096
- C:\Windows\System\ARWdsfH.exe
  C:\Windows\System\ARWdsfH.exe
  2⤵
  PID:11236
- C:\Windows\System\SVVluoY.exe
  C:\Windows\System\SVVluoY.exe
  2⤵
  PID:10564
- C:\Windows\System\MSCIsLt.exe
  C:\Windows\System\MSCIsLt.exe
  2⤵
  PID:10908
- C:\Windows\System\FWKiAwP.exe
  C:\Windows\System\FWKiAwP.exe
  2⤵
  PID:11216
- C:\Windows\System\oxwSNlP.exe
  C:\Windows\System\oxwSNlP.exe
  2⤵
  PID:11044
- C:\Windows\System\IiSTyxW.exe
  C:\Windows\System\IiSTyxW.exe
  2⤵
  PID:11268
- C:\Windows\System\RWBvDir.exe
  C:\Windows\System\RWBvDir.exe
  2⤵
  PID:11296
- C:\Windows\System\lgzcLfH.exe
  C:\Windows\System\lgzcLfH.exe
  2⤵
  PID:11324
- C:\Windows\System\GhEexeF.exe
  C:\Windows\System\GhEexeF.exe
  2⤵
  PID:11352
- C:\Windows\System\EyDOXJq.exe
  C:\Windows\System\EyDOXJq.exe
  2⤵
  PID:11380
- C:\Windows\System\tJcUode.exe
  C:\Windows\System\tJcUode.exe
  2⤵
  PID:11408
- C:\Windows\System\RGQzieb.exe
  C:\Windows\System\RGQzieb.exe
  2⤵
  PID:11436
- C:\Windows\System\MnwCJGa.exe
  C:\Windows\System\MnwCJGa.exe
  2⤵
  PID:11464
- C:\Windows\System\ldUUTmS.exe
  C:\Windows\System\ldUUTmS.exe
  2⤵
  PID:11496
- C:\Windows\System\oMZqgsQ.exe
  C:\Windows\System\oMZqgsQ.exe
  2⤵
  PID:11524
- C:\Windows\System\qIYRCzo.exe
  C:\Windows\System\qIYRCzo.exe
  2⤵
  PID:11552
- C:\Windows\System\ZFNdeHo.exe
  C:\Windows\System\ZFNdeHo.exe
  2⤵
  PID:11580
- C:\Windows\System\bEmGBcr.exe
  C:\Windows\System\bEmGBcr.exe
  2⤵
  PID:11608
- C:\Windows\System\yyFvKNu.exe
  C:\Windows\System\yyFvKNu.exe
  2⤵
  PID:11636
- C:\Windows\System\OymabJp.exe
  C:\Windows\System\OymabJp.exe
  2⤵
  PID:11664
- C:\Windows\System\SZPNUgh.exe
  C:\Windows\System\SZPNUgh.exe
  2⤵
  PID:11692
- C:\Windows\System\TNnAdFV.exe
  C:\Windows\System\TNnAdFV.exe
  2⤵
  PID:11720
- C:\Windows\System\bXwEggC.exe
  C:\Windows\System\bXwEggC.exe
  2⤵
  PID:11748
- C:\Windows\System\pOvvWYB.exe
  C:\Windows\System\pOvvWYB.exe
  2⤵
  PID:11776
- C:\Windows\System\scrkJey.exe
  C:\Windows\System\scrkJey.exe
  2⤵
  PID:11804
- C:\Windows\System\OHBDVoU.exe
  C:\Windows\System\OHBDVoU.exe
  2⤵
  PID:11836
- C:\Windows\System\nPLUczY.exe
  C:\Windows\System\nPLUczY.exe
  2⤵
  PID:11852
- C:\Windows\System\iqPfeVl.exe
  C:\Windows\System\iqPfeVl.exe
  2⤵
  PID:11868
- C:\Windows\System\pgUGTOm.exe
  C:\Windows\System\pgUGTOm.exe
  2⤵
  PID:11912
- C:\Windows\System\bYqeeYA.exe
  C:\Windows\System\bYqeeYA.exe
  2⤵
  PID:11936
- C:\Windows\System\oGpemaG.exe
  C:\Windows\System\oGpemaG.exe
  2⤵
  PID:11976
- C:\Windows\System\GyuELhy.exe
  C:\Windows\System\GyuELhy.exe
  2⤵
  PID:12004
- C:\Windows\System\xsmfSaf.exe
  C:\Windows\System\xsmfSaf.exe
  2⤵
  PID:12032
- C:\Windows\System\EnIMCHZ.exe
  C:\Windows\System\EnIMCHZ.exe
  2⤵
  PID:12060
- C:\Windows\System\gFenNNT.exe
  C:\Windows\System\gFenNNT.exe
  2⤵
  PID:12088
- C:\Windows\System\ergoFSA.exe
  C:\Windows\System\ergoFSA.exe
  2⤵
  PID:12116
- C:\Windows\System\NolmSRm.exe
  C:\Windows\System\NolmSRm.exe
  2⤵
  PID:12144
- C:\Windows\System\GeezkHc.exe
  C:\Windows\System\GeezkHc.exe
  2⤵
  PID:12172
- C:\Windows\System\BlLBFWI.exe
  C:\Windows\System\BlLBFWI.exe
  2⤵
  PID:12200
- C:\Windows\System\LnTEMVh.exe
  C:\Windows\System\LnTEMVh.exe
  2⤵
  PID:12228
- C:\Windows\System\izeTgpS.exe
  C:\Windows\System\izeTgpS.exe
  2⤵
  PID:12256
- C:\Windows\System\aDmOKGp.exe
  C:\Windows\System\aDmOKGp.exe
  2⤵
  PID:12284
- C:\Windows\System\ENFuRIR.exe
  C:\Windows\System\ENFuRIR.exe
  2⤵
  PID:10792
- C:\Windows\System\tDlrrDp.exe
  C:\Windows\System\tDlrrDp.exe
  2⤵
  PID:11372
- C:\Windows\System\lCflKZF.exe
  C:\Windows\System\lCflKZF.exe
  2⤵
  PID:11432
- C:\Windows\System\SPeMnAK.exe
  C:\Windows\System\SPeMnAK.exe
  2⤵
  PID:11508
- C:\Windows\System\Euedwpp.exe
  C:\Windows\System\Euedwpp.exe
  2⤵
  PID:11572
- C:\Windows\System\bftPrlE.exe
  C:\Windows\System\bftPrlE.exe
  2⤵
  PID:11632
- C:\Windows\System\VuNjnDm.exe
  C:\Windows\System\VuNjnDm.exe
  2⤵
  PID:11704
- C:\Windows\System\qdlNNRC.exe
  C:\Windows\System\qdlNNRC.exe
  2⤵
  PID:11768
- C:\Windows\System\ZYQvaqI.exe
  C:\Windows\System\ZYQvaqI.exe
  2⤵
  PID:11844
- C:\Windows\System\wJaRYdy.exe
  C:\Windows\System\wJaRYdy.exe
  2⤵
  PID:11884
- C:\Windows\System\wtEnHwY.exe
  C:\Windows\System\wtEnHwY.exe
  2⤵
  PID:11968
- C:\Windows\System\qNecCWU.exe
  C:\Windows\System\qNecCWU.exe
  2⤵
  PID:12028
- C:\Windows\System\AeRFzcE.exe
  C:\Windows\System\AeRFzcE.exe
  2⤵
  PID:12100
- C:\Windows\System\QKcSjze.exe
  C:\Windows\System\QKcSjze.exe
  2⤵
  PID:12164
- C:\Windows\System\YzzGgPo.exe
  C:\Windows\System\YzzGgPo.exe
  2⤵
  PID:12224
- C:\Windows\System\vTKGqcj.exe
  C:\Windows\System\vTKGqcj.exe
  2⤵
  PID:11280
- C:\Windows\System\zlIOiJq.exe
  C:\Windows\System\zlIOiJq.exe
  2⤵
  PID:11428
- C:\Windows\System\gFHTNXB.exe
  C:\Windows\System\gFHTNXB.exe
  2⤵
  PID:11564
- C:\Windows\System\nzkqRLI.exe
  C:\Windows\System\nzkqRLI.exe
  2⤵
  PID:11736
- C:\Windows\System\RubkIky.exe
  C:\Windows\System\RubkIky.exe
  2⤵
  PID:11888
- C:\Windows\System\BuYDQBA.exe
  C:\Windows\System\BuYDQBA.exe
  2⤵
  PID:12024
- C:\Windows\System\MzEesRI.exe
  C:\Windows\System\MzEesRI.exe
  2⤵
  PID:12192
- C:\Windows\System\cczcrwd.exe
  C:\Windows\System\cczcrwd.exe
  2⤵
  PID:11364
- C:\Windows\System\JEUkzvg.exe
  C:\Windows\System\JEUkzvg.exe
  2⤵
  PID:11688
- C:\Windows\System\JGSqsAJ.exe
  C:\Windows\System\JGSqsAJ.exe
  2⤵
  PID:12084
- C:\Windows\System\bebHmfM.exe
  C:\Windows\System\bebHmfM.exe
  2⤵
  PID:11628
- C:\Windows\System\OvgMXvp.exe
  C:\Windows\System\OvgMXvp.exe
  2⤵
  PID:11548
- C:\Windows\System\nEQEDkF.exe
  C:\Windows\System\nEQEDkF.exe
  2⤵
  PID:12304
- C:\Windows\System\ebGhJsW.exe
  C:\Windows\System\ebGhJsW.exe
  2⤵
  PID:12332
- C:\Windows\System\xXQdGng.exe
  C:\Windows\System\xXQdGng.exe
  2⤵
  PID:12360
- C:\Windows\System\LpyjqQR.exe
  C:\Windows\System\LpyjqQR.exe
  2⤵
  PID:12388
- C:\Windows\System\GETXQtt.exe
  C:\Windows\System\GETXQtt.exe
  2⤵
  PID:12416
- C:\Windows\System\rpdaqSw.exe
  C:\Windows\System\rpdaqSw.exe
  2⤵
  PID:12444
- C:\Windows\System\rGJWcVl.exe
  C:\Windows\System\rGJWcVl.exe
  2⤵
  PID:12472
- C:\Windows\System\FydeuqT.exe
  C:\Windows\System\FydeuqT.exe
  2⤵
  PID:12500
- C:\Windows\System\zdQOzwy.exe
  C:\Windows\System\zdQOzwy.exe
  2⤵
  PID:12528
- C:\Windows\System\puCauwf.exe
  C:\Windows\System\puCauwf.exe
  2⤵
  PID:12556
- C:\Windows\System\hxGEURM.exe
  C:\Windows\System\hxGEURM.exe
  2⤵
  PID:12584
- C:\Windows\System\MZAOEMn.exe
  C:\Windows\System\MZAOEMn.exe
  2⤵
  PID:12612
- C:\Windows\System\tDPjuBp.exe
  C:\Windows\System\tDPjuBp.exe
  2⤵
  PID:12640
- C:\Windows\System\LVZsOcN.exe
  C:\Windows\System\LVZsOcN.exe
  2⤵
  PID:12668
- C:\Windows\System\YYpPUgN.exe
  C:\Windows\System\YYpPUgN.exe
  2⤵
  PID:12696
- C:\Windows\System\wnetXYP.exe
  C:\Windows\System\wnetXYP.exe
  2⤵
  PID:12724
- C:\Windows\System\jphfomg.exe
  C:\Windows\System\jphfomg.exe
  2⤵
  PID:12752
- C:\Windows\System\kbJrXQo.exe
  C:\Windows\System\kbJrXQo.exe
  2⤵
  PID:12780
- C:\Windows\System\RlrbAPN.exe
  C:\Windows\System\RlrbAPN.exe
  2⤵
  PID:12808
- C:\Windows\System\tyPNlgG.exe
  C:\Windows\System\tyPNlgG.exe
  2⤵
  PID:12836
- C:\Windows\System\IdIVGgf.exe
  C:\Windows\System\IdIVGgf.exe
  2⤵
  PID:12864
- C:\Windows\System\NyKkWrl.exe
  C:\Windows\System\NyKkWrl.exe
  2⤵
  PID:12892
- C:\Windows\System\Pckdijq.exe
  C:\Windows\System\Pckdijq.exe
  2⤵
  PID:12920
- C:\Windows\System\qIUShiA.exe
  C:\Windows\System\qIUShiA.exe
  2⤵
  PID:12948
- C:\Windows\System\uYPpEAp.exe
  C:\Windows\System\uYPpEAp.exe
  2⤵
  PID:12976
- C:\Windows\System\xmQXIWx.exe
  C:\Windows\System\xmQXIWx.exe
  2⤵
  PID:13004
- C:\Windows\System\IeuccZk.exe
  C:\Windows\System\IeuccZk.exe
  2⤵
  PID:13032
- C:\Windows\System\pzUyihb.exe
  C:\Windows\System\pzUyihb.exe
  2⤵
  PID:13060
- C:\Windows\System\rPZUkUQ.exe
  C:\Windows\System\rPZUkUQ.exe
  2⤵
  PID:13092
- C:\Windows\System\SvncEmU.exe
  C:\Windows\System\SvncEmU.exe
  2⤵
  PID:13120
- C:\Windows\System\FJtbgIg.exe
  C:\Windows\System\FJtbgIg.exe
  2⤵
  PID:13148
- C:\Windows\System\FNhzUeO.exe
  C:\Windows\System\FNhzUeO.exe
  2⤵
  PID:13176
- C:\Windows\System\QXBtSHl.exe
  C:\Windows\System\QXBtSHl.exe
  2⤵
  PID:13204
- C:\Windows\System\FNNCvdp.exe
  C:\Windows\System\FNNCvdp.exe
  2⤵
  PID:13232
- C:\Windows\System\xMwINdf.exe
  C:\Windows\System\xMwINdf.exe
  2⤵
  PID:13260
- C:\Windows\System\AxXCTCy.exe
  C:\Windows\System\AxXCTCy.exe
  2⤵
  PID:13288
- C:\Windows\System\asaNhWV.exe
  C:\Windows\System\asaNhWV.exe
  2⤵
  PID:12296
- C:\Windows\System\DeotkTO.exe
  C:\Windows\System\DeotkTO.exe
  2⤵
  PID:12352
- C:\Windows\System\iXjpUGR.exe
  C:\Windows\System\iXjpUGR.exe
  2⤵
  PID:12428
- C:\Windows\System\RFteIXB.exe
  C:\Windows\System\RFteIXB.exe
  2⤵
  PID:12496
- C:\Windows\System\ZNakRgG.exe
  C:\Windows\System\ZNakRgG.exe
  2⤵
  PID:12552
- C:\Windows\System\qFlAkzd.exe
  C:\Windows\System\qFlAkzd.exe
  2⤵
  PID:12608
- C:\Windows\System\bMJLKsP.exe
  C:\Windows\System\bMJLKsP.exe
  2⤵
  PID:12684
- C:\Windows\System\mtlNdFQ.exe
  C:\Windows\System\mtlNdFQ.exe
  2⤵
  PID:12744
- C:\Windows\System\TVZLPAY.exe
  C:\Windows\System\TVZLPAY.exe
  2⤵
  PID:12804
- C:\Windows\System\jmkfdVR.exe
  C:\Windows\System\jmkfdVR.exe
  2⤵
  PID:12880
- C:\Windows\System\SZFgfDC.exe
  C:\Windows\System\SZFgfDC.exe
  2⤵
  PID:12944
- C:\Windows\System\gCnysQL.exe
  C:\Windows\System\gCnysQL.exe
  2⤵
  PID:13000
- C:\Windows\System\RFtXwQu.exe
  C:\Windows\System\RFtXwQu.exe
  2⤵
  PID:13056
- C:\Windows\System\AlfYGoc.exe
  C:\Windows\System\AlfYGoc.exe
  2⤵
  PID:13132
- C:\Windows\System\uLtVJhj.exe
  C:\Windows\System\uLtVJhj.exe
  2⤵
  PID:13196
- C:\Windows\System\CDyhDUj.exe
  C:\Windows\System\CDyhDUj.exe
  2⤵
  PID:13256
- C:\Windows\System\LYFQXzj.exe
  C:\Windows\System\LYFQXzj.exe
  2⤵
  PID:12320
- C:\Windows\System\omNjkxS.exe
  C:\Windows\System\omNjkxS.exe
  2⤵
  PID:12468
- C:\Windows\System\ryalJNA.exe
  C:\Windows\System\ryalJNA.exe
  2⤵
  PID:12604
- C:\Windows\System\EfOPgxh.exe
  C:\Windows\System\EfOPgxh.exe
  2⤵
  PID:12772
- C:\Windows\System\eAwWwDL.exe
  C:\Windows\System\eAwWwDL.exe
  2⤵
  PID:12916
- C:\Windows\System\CbGJHfT.exe
  C:\Windows\System\CbGJHfT.exe
  2⤵
  PID:13052
- C:\Windows\System\WgavSOW.exe
  C:\Windows\System\WgavSOW.exe
  2⤵
  PID:13228
- C:\Windows\System\KaumWDS.exe
  C:\Windows\System\KaumWDS.exe
  2⤵
  PID:12464
- C:\Windows\System\PxjdrZi.exe
  C:\Windows\System\PxjdrZi.exe
  2⤵
  PID:12736
- C:\Windows\System\dSUmOEo.exe
  C:\Windows\System\dSUmOEo.exe
  2⤵
  PID:13116
- C:\Windows\System\XyaMHPx.exe
  C:\Windows\System\XyaMHPx.exe
  2⤵
  PID:12664
- C:\Windows\System\MvsbDPO.exe
  C:\Windows\System\MvsbDPO.exe
  2⤵
  PID:11832
- C:\Windows\System\sQdOQlJ.exe
  C:\Windows\System\sQdOQlJ.exe
  2⤵
  PID:13328
- C:\Windows\System\JademIR.exe
  C:\Windows\System\JademIR.exe
  2⤵
  PID:13356
- C:\Windows\System\ZLdoSzj.exe
  C:\Windows\System\ZLdoSzj.exe
  2⤵
  PID:13384
- C:\Windows\System\GRekiDC.exe
  C:\Windows\System\GRekiDC.exe
  2⤵
  PID:13412
- C:\Windows\System\YzvNClz.exe
  C:\Windows\System\YzvNClz.exe
  2⤵
  PID:13440
- C:\Windows\System\CneHijk.exe
  C:\Windows\System\CneHijk.exe
  2⤵
  PID:13468
- C:\Windows\System\HyvxNgA.exe
  C:\Windows\System\HyvxNgA.exe
  2⤵
  PID:13496
- C:\Windows\System\RdpNVqn.exe
  C:\Windows\System\RdpNVqn.exe
  2⤵
  PID:13524
- C:\Windows\System\fMLbUzX.exe
  C:\Windows\System\fMLbUzX.exe
  2⤵
  PID:13552
- C:\Windows\System\TAsuTAg.exe
  C:\Windows\System\TAsuTAg.exe
  2⤵
  PID:13580
- C:\Windows\System\AMUAUmy.exe
  C:\Windows\System\AMUAUmy.exe
  2⤵
  PID:13608
- C:\Windows\System\EkNYmmj.exe
  C:\Windows\System\EkNYmmj.exe
  2⤵
  PID:13636
- C:\Windows\System\uXdJsRL.exe
  C:\Windows\System\uXdJsRL.exe
  2⤵
  PID:13664
- C:\Windows\System\fWdzAfE.exe
  C:\Windows\System\fWdzAfE.exe
  2⤵
  PID:13692
- C:\Windows\System\PlvJlRV.exe
  C:\Windows\System\PlvJlRV.exe
  2⤵
  PID:13716
- C:\Windows\System\KfRjLQU.exe
  C:\Windows\System\KfRjLQU.exe
  2⤵
  PID:13748
- C:\Windows\System\gENBZgY.exe
  C:\Windows\System\gENBZgY.exe
  2⤵
  PID:13776
- C:\Windows\System\cREdllY.exe
  C:\Windows\System\cREdllY.exe
  2⤵
  PID:13804
- C:\Windows\System\tBMJtZo.exe
  C:\Windows\System\tBMJtZo.exe
  2⤵
  PID:13832
- C:\Windows\System\TvVCKEF.exe
  C:\Windows\System\TvVCKEF.exe
  2⤵
  PID:13860
- C:\Windows\System\qYHeVfo.exe
  C:\Windows\System\qYHeVfo.exe
  2⤵
  PID:13888
- C:\Windows\System\uzqPptp.exe
  C:\Windows\System\uzqPptp.exe
  2⤵
  PID:13916
- C:\Windows\System\BwhDvuD.exe
  C:\Windows\System\BwhDvuD.exe
  2⤵
  PID:13944
- C:\Windows\System\IYNwChQ.exe
  C:\Windows\System\IYNwChQ.exe
  2⤵
  PID:13972
- C:\Windows\System\QsLlPpn.exe
  C:\Windows\System\QsLlPpn.exe
  2⤵
  PID:14000
- C:\Windows\System\uJBjRLk.exe
  C:\Windows\System\uJBjRLk.exe
  2⤵
  PID:14028
- C:\Windows\System\CgCODAO.exe
  C:\Windows\System\CgCODAO.exe
  2⤵
  PID:14056
- C:\Windows\System\NJpktUD.exe
  C:\Windows\System\NJpktUD.exe
  2⤵
  PID:14084
- C:\Windows\System\xhLyMje.exe
  C:\Windows\System\xhLyMje.exe
  2⤵
  PID:14112
- C:\Windows\System\kydowtE.exe
  C:\Windows\System\kydowtE.exe
  2⤵
  PID:14140
- C:\Windows\System\eeXXjDO.exe
  C:\Windows\System\eeXXjDO.exe
  2⤵
  PID:14168
- C:\Windows\System\tXSluKE.exe
  C:\Windows\System\tXSluKE.exe
  2⤵
  PID:14184
- C:\Windows\System\gjPeCQn.exe
  C:\Windows\System\gjPeCQn.exe
  2⤵
  PID:14212
- C:\Windows\System\SkOosyK.exe
  C:\Windows\System\SkOosyK.exe
  2⤵
  PID:14252
- C:\Windows\System\yParUMc.exe
  C:\Windows\System\yParUMc.exe
  2⤵
  PID:14280
- C:\Windows\System\EuSBlsD.exe
  C:\Windows\System\EuSBlsD.exe
  2⤵
  PID:14308
- C:\Windows\System\FWWuzic.exe
  C:\Windows\System\FWWuzic.exe
  2⤵
  PID:13320
- C:\Windows\System\Rcnjlpi.exe
  C:\Windows\System\Rcnjlpi.exe
  2⤵
  PID:13380
- C:\Windows\System\saDQebL.exe
  C:\Windows\System\saDQebL.exe
  2⤵
  PID:3620
- C:\Windows\System\WdAyPgc.exe
  C:\Windows\System\WdAyPgc.exe
  2⤵
  PID:13436
- C:\Windows\System\CuhIneb.exe
  C:\Windows\System\CuhIneb.exe
  2⤵
  PID:13508
- C:\Windows\System\dgbeLLW.exe
  C:\Windows\System\dgbeLLW.exe
  2⤵
  PID:13572
- C:\Windows\System\lTCYaTp.exe
  C:\Windows\System\lTCYaTp.exe
  2⤵
  PID:13632
- C:\Windows\System\KMrWHUS.exe
  C:\Windows\System\KMrWHUS.exe
  2⤵
  PID:13704
- C:\Windows\System\khJKauh.exe
  C:\Windows\System\khJKauh.exe
  2⤵
  PID:13760
- C:\Windows\System\hpBdOzV.exe
  C:\Windows\System\hpBdOzV.exe
  2⤵
  PID:13824
- C:\Windows\System\uLuQKiL.exe
  C:\Windows\System\uLuQKiL.exe
  2⤵
  PID:13884
- C:\Windows\System\kFvPzTB.exe
  C:\Windows\System\kFvPzTB.exe
  2⤵
  PID:13960
- C:\Windows\System\dIGuByY.exe
  C:\Windows\System\dIGuByY.exe
  2⤵
  PID:14020
- C:\Windows\System\jbsXQaW.exe
  C:\Windows\System\jbsXQaW.exe
  2⤵
  PID:14080
- C:\Windows\System\zSRSgTw.exe
  C:\Windows\System\zSRSgTw.exe
  2⤵
  PID:14152
- C:\Windows\System\BOkbdCo.exe
  C:\Windows\System\BOkbdCo.exe
  2⤵
  PID:14200
- C:\Windows\System\CSxosya.exe
  C:\Windows\System\CSxosya.exe
  2⤵
  PID:14276
- C:\Windows\System\pXfjIdh.exe
  C:\Windows\System\pXfjIdh.exe
  2⤵
  PID:13352
- C:\Windows\System\xecSRQj.exe
  C:\Windows\System\xecSRQj.exe
  2⤵
  PID:13424
- C:\Windows\System\lMVGRmN.exe
  C:\Windows\System\lMVGRmN.exe
  2⤵
  PID:13564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4488,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
1⤵
PID:6720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BOrYXCY.exe

Filesize
1.9MB

MD5
ebd9ccbed447fce4c053f1cd7340c8ef

SHA1
bcec65c9814501c69c46ad20ea0bbb00804f191c

SHA256
eb0e0de487af8c4e058dedcc41ffc4e8274cd843f38ce86b9931074e23565a76

SHA512
59dcfebbea1149ec700dc58599eb989a438c469c0b1811f907c732a8258cee2333a2f576ac58181a2369b7345011e946333d092bc70869c3c772941f6b9ec21e

Download Submit
C:\Windows\System\BcSYDGh.exe

Filesize
1.9MB

MD5
2dc0c81a3a91a08452ae886f8648c216

SHA1
87d3f40d63d4afa8c96f323dae0c356be7dc665d

SHA256
5c756c6c684743dd5d693e8139251db056f6ff2d677af858d58bc37e1cf78e61

SHA512
351887992a3c7e5a341ad38d534fc2aa983e8de5d4614e6b65eda9b0fea70ee9c2c09ba38872f24c5a854b69ef2d5b630cad6097b879119e296d149831205b43

Download Submit
C:\Windows\System\BeeYOQt.exe

Filesize
1.9MB

MD5
60dfe978b983433552c253786073b3b9

SHA1
f2a2b32dc006fb12fdede88bd49447e2a5479f11

SHA256
bcc1e091412f11e4beb3cd7a1538b188455cdf634d399ee95514fd68641baa34

SHA512
0bb0d3e2dd4bf29cafcecf8394de1f92cd865f8dcd5c80aca26ada62fe6fae91ced4d4411d21ed2000d8e9aa6cdbe901dc25a4db12be257a28df3ebd12455f46

Download Submit
C:\Windows\System\CmpMtcU.exe

Filesize
1.9MB

MD5
88050f7b9b2d1fd535878533395e5591

SHA1
d56e5aabefe5e9c2f3486ed86d889217a43cff5b

SHA256
eac887567ae8404c88c8be8c7243cec96f0e6779ee3345a3ecdbd42efd055f0d

SHA512
209bc7d5279b186312714bb6b0f5592161bf50c8b6504fee7c9d90ecc84a52bee2ba2d70b5ebce8101447ce35cd1e3aeb2fe4205ac60aee81c28af1deddae2a3

Download Submit
C:\Windows\System\EcNyGXx.exe

Filesize
1.9MB

MD5
558c621395b2456725e21b9f7ec6d4d1

SHA1
f49ceacbce046684bdfee852b0c4dfe70fc8026c

SHA256
73790a3bdb9632783a3e720661face077b89358ed2f87ebd68d50f5c936e477a

SHA512
2ed8158607eb24668d46bd9edd8d67aa7447e348c383a2804931c5677272d971ab658ad658f9eee434c7bbf6742bcf9c2ae3a747797394f39f3a7a328a1c20ef

Download Submit
C:\Windows\System\EnqMDmx.exe

Filesize
1.9MB

MD5
39e4551cd2f13897a2d0a93df79d619b

SHA1
acfc12fe442253063158031a0599ddd4a40e97e6

SHA256
fb391aac588466f68447652669e3571f6a85ac1d61304629450869c9210447d6

SHA512
9f7c646b055c35831cf7d6d080adcb0fb93628c75cfa8915272c1071768c3c664d40ea41113ddc3870cbb800a5ef1e05f2b5922faab01715a8fc704ef7340b30

Download Submit
C:\Windows\System\HPCACdu.exe

Filesize
1.9MB

MD5
1c9a93c8cba113f097fab0fe06a7865e

SHA1
9e6f1a4b8877f473b2fc48f80f7f744417ad5b00

SHA256
46c7f1787ee1c242de5b51d83a44691f0396c21dbf9937caa01c97e516755e2d

SHA512
bf9ab94113ef5ce509346bf4d93fca199c5b67d37e77de7070d9aa8a8e13395f8e15693a55fbf89275d352551f604e1f52a3733b3d3a3098384aa63f04ef2e00

Download Submit
C:\Windows\System\IzybdKT.exe

Filesize
1.9MB

MD5
e585e3e0c8d6d583567f78d56047ceb4

SHA1
d0ca483a97c301aa6c8e135465be5024c1e8f89c

SHA256
6a23ad89a844f808163e9486f158eb8cac1f40d174965e5fec1b9076bd30b478

SHA512
ce12b6fe85226368ea7640d9712ab138722a752dcbc184c1b4bfd6203a94cdf6ea0a6bccd5d414a2599f5f67da4cc9c1bb257444237c8c84d6d6967f87b9cb0f

Download Submit
C:\Windows\System\JQyGqdK.exe

Filesize
1.9MB

MD5
2f7e7120d8d16b378d4830d1dc84e2e0

SHA1
c166b502be25fecb04e3e63c45dcedfa1151f590

SHA256
71abf9eb0c46c4496380d6e94505eb340d60d513aaafefd6002215f6ccc24576

SHA512
3f042f2025fd1931c6c06b88884d61f7f7a7b763a3d5d32a66dd1377350410e707582a1dfe8d2812225edfbf11e98d038d2e3e71e7a856d101547e3284aa745b

Download Submit
C:\Windows\System\OQPyFXN.exe

Filesize
1.9MB

MD5
6ec1c5beedf56e7cb5b97724b6ae1b03

SHA1
17ce2b9ba35891e830136ad1811126fd37d09aca

SHA256
f5c3d1177912b1f3187bfaca1f5877054289cb293dc4808d49f4f9f9f2569a7d

SHA512
442e6e4f8075c3c35653a2602ff47168913fe63982a1f6338ff93e10b1a25143a93ca0e0534bfc94453ff7913aa2ac7462e4129a42bfce570276b9cdfecf42e2

Download Submit
C:\Windows\System\PrqPLJj.exe

Filesize
1.9MB

MD5
43ce8c162d9863c127f5ea16678486ae

SHA1
f5bb306afa00c819b8d014763f4f3575f8383b60

SHA256
22e68e4ee83262aa2d482f4a0ccc462ec722d44212b287223486079586e4010c

SHA512
9fad5f2365f29629930615b3feb234bf8b9dcee38dd44686304373f282c6bcc39afa4ca80359d755919d29647561f568546ebf9849d291d0271d932be53e90f8

Download Submit
C:\Windows\System\SAcSFjV.exe

Filesize
1.9MB

MD5
8c98c20287f44827e19de3dc4882524b

SHA1
17d414ae9837de341fcc17c7d631af973a3200ed

SHA256
fd4b1b8a143b8fcbb359b555b4791dcf0e5ece616a1d43477b2436c984f1f1fa

SHA512
5d0dd8706f2c8b3674be632ddf9cdbdd28fa00dd274f9c255320a3c93e8d887bdb187fcd4d10fe1a86a2670597d402a43435d1f8e9fe6fc188faafc326651641

Download Submit
C:\Windows\System\Sthqdyq.exe

Filesize
1.9MB

MD5
cd0d69e21f8e8d45731d320dfc773de6

SHA1
9f0b6d82eb9c1e9efb9c7cc3bfbd0ebcfb891e90

SHA256
c04f29e50245207f7df32ebfee52b1de4b526bdc9b262e7a0077bca5205c7e9d

SHA512
050276aa2b9609d14be0ca0184721df241219f3fc3f4ab4bbbdafa53ca8a8944e529d349a8f46a08c2063c50f74039162ec4a17ef50ad8acfe2797a63c150924

Download Submit
C:\Windows\System\TUafmbW.exe

Filesize
1.9MB

MD5
bda2101b5a48249e5583ba053afd3945

SHA1
52e2241453be804b07d8812a07737d5f83ec2b4a

SHA256
7cf7d61b45c9db46e21e9a6b17d5202dfebfef053212c03e2bea33a4ae3f3c3a

SHA512
103711b2aca3badf1a341bf0e39fb99413bcda1961216074d8ba0abd2296b357638f0c0def76f0f4046d0f7219a8c4577134fbf64904d2c6aae9121159c7af3a

Download Submit
C:\Windows\System\UEumlSZ.exe

Filesize
1.9MB

MD5
f3f755b403291f30ad7550830cb372f4

SHA1
04d18526a0a64456759775e3a959b57da008685c

SHA256
c7ddd6af4d919dffc7217cab40761d0283a79fb7227eb5b686b04391fad7444d

SHA512
31be0f778e9e16130f32407ddf10fd8d247bd7052687a1e0decbdfb44ea58514c5104297a4fd5bd55fd4bfc752fb8a5e8673890513e35562a57c76df91b2cc75

Download Submit
C:\Windows\System\UoOcJWI.exe

Filesize
1.9MB

MD5
c814770446d3c7efeac8ab70f02e66b9

SHA1
e98f5a0ca66536ff7be64390178f9504afcbbbd3

SHA256
347c1b7d939cac9c055a4946d21507c70111e5c2fcf95a8b25e834bdc4358b66

SHA512
9d5049508261409a8d5d1736add8e2f1f8190b4ca4ccdc92a9ebdcad300430b98122670d1e78f766dfff109a64d91a0266cce713293330ec350a9070daaf0ccf

Download Submit
C:\Windows\System\ZvmaPxs.exe

Filesize
1.9MB

MD5
b9597cb51b09ba3ed101295bd041b76c

SHA1
c6d16341be2c9eb087b158dc928a7b86218e32ea

SHA256
a4269c1bda570b166e4369e676420a442b2df0cf22ac942bc6e2702e6568513e

SHA512
9d8e366138e8a2c52caa2a873b72429033e0e972f852d6851379a9e68ba974d548fad73b8c579d8bdf165c625d29becf6d050eaea16d5f8bbda8647ec2095a03

Download Submit
C:\Windows\System\aGgViTx.exe

Filesize
1.9MB

MD5
687c9948af8ea62edef0f50f36cac39d

SHA1
24872ede83c2c0c7bc6ab83b2fed54f831d0761d

SHA256
93373176b7107459f39fe74cf069fa19bc2ce37002905f90e138e676b759e955

SHA512
e92fe40bdf28898f0bd3ae98d14fabaf01012d5006cab735e0eec651465d7e3f1f5dc719dadbc6a2c0cff71050153a87628e853d3b2d354107ae5d578471b8b2

Download Submit
C:\Windows\System\aeIRAJU.exe

Filesize
1.9MB

MD5
830afb2933c5c68008beffa0a2a658d7

SHA1
f1fb655d32cbecb6e0850408f47e7c09ecd3d1d5

SHA256
33fcdda441c33a2026f8cbeaf39655e1a697029483cb3ceb46821c87f3c4ad50

SHA512
e8290fb61c8d6cc246a5a754fc545188176daaa6aa680bd45e52fcfc2ef23d61f09a59138e5fef42ab67b3d4b1f3ef6d6f1566f330a63e9c3939cdbddab29a76

Download Submit
C:\Windows\System\edTpoqo.exe

Filesize
1.9MB

MD5
a3ecc54c3838de09e8b6d4eab2494601

SHA1
875a742d7d739c3d0c60c5c526dbd9b85cb606b4

SHA256
a4cff9ca82e2689b5a2f1cc500a1bffedb039ce8da872010ee43db747293b2c1

SHA512
988ec6046726ff065d808cba5026129042529679341157784f38de3c63a54c484e77bc70e2658819e9004193fe08fbd5ba7c37105a7b0a3c4da1b6ab0c04de61

Download Submit
C:\Windows\System\gEdUlcq.exe

Filesize
1.9MB

MD5
b763b6b40787fd3cc5d79333865337f4

SHA1
c6cf714777f130353d47bc022f525c4eb5460008

SHA256
20638ecb85f83dacd1a3f235f97940dadb2062fe9a77d5002aec6477f012d818

SHA512
2e24b1b23dcf80dba3b61c6c68f4491842d68ba7377419e5e01f2414f96a242695ef692e29576d7a0ae185e3a46a8c879568fe17e74f468891ac3f603bb59bf6

Download Submit
C:\Windows\System\jdxvwvR.exe

Filesize
1.9MB

MD5
06e9370e4bbc4b9fa59ccff4016d1355

SHA1
b1d8050efaed14070734455b6211323e22f03aa3

SHA256
587e90d3cc9643fcd0a20ea2e47603dfb58b351030810e5c07628cb28d1b8e01

SHA512
101468bbd42c7c8db433bc3cd4cac99d77584e0ee58a005542cf7b885dcfd303f89a4328ae9eedc9b52c768490c6b9f3fd6d3588f86b6cf956fbb5639ce0edbd

Download Submit
C:\Windows\System\kBSXiij.exe

Filesize
1.9MB

MD5
48dce78a39905203f814cef5fdd4a425

SHA1
b556654eef05ac2b0516134754874cc33b993bef

SHA256
8810ff3c08021a57a92b3833444a00571d8f2a225f7af0c778e0953e14ae60e3

SHA512
86e99b2870c2524c955098e3aad0c624aefbee13b9124a9f2b766d66a7c10db570eae3450815008d520669af036fba45eff1219abc84413487e79c5760c67654

Download Submit
C:\Windows\System\lmJhqvx.exe

Filesize
1.9MB

MD5
9e3c1f8c343c829934c0eb3a11166677

SHA1
6504c011cf946f86ab062cc94198286da4ca69c5

SHA256
dc78fe6d3418d9e900acd351b92df0e01de758630e1423fe712e1980f7516d90

SHA512
6fe6070464c31dc8939d535907c4ce64ad5c46bff2600509778508120660c76f1e3e8303f7ed9f79c828d0c0970004ad0ec189cb5f46ee158957336fac245f27

Download Submit
C:\Windows\System\mEIgIlG.exe

Filesize
1.9MB

MD5
307ae9251d0218924c74b93afa02da51

SHA1
f428a3993dfa559a9c287fd9da7e9c28993ee974

SHA256
5276b8a507ee083c8da3ee0c2dbaa1c9501b16445930b338c880e2df3de35cc3

SHA512
f90afda6d0e04ea55730d5c3b0e295d3ff031382f2da9501c90d7b09b009210783992e5d9f50815f00bc3a96b8f5c71ba78b315b08c133b5d0b9332d70a784e9

Download Submit
C:\Windows\System\qFZHbfM.exe

Filesize
1.9MB

MD5
bf09debbf2c78563cd85a2275eda15f7

SHA1
3fcc81b1e78c08ad9e18c8e6fd02f36a8a82c40a

SHA256
26db87441d65e6298670344edb7988f4f6cbaf319ed24e07c61fa930438fc980

SHA512
a8c85b66ee90133ab2b9b1a169f16b38ca520c590db908e631ac29b6ea09b154098346547d31d0cb4fe79426d2b6ed76fdd028b326203fb788198f2ca0e5718d

Download Submit
C:\Windows\System\rRUgybU.exe

Filesize
1.9MB

MD5
df3e10f5d308fff91f85d929c2a9c852

SHA1
a7ef3634735fb53dcfc57ae9b8518aab6bb25580

SHA256
5d31ead8c443e6fc3a1e98334468afc0882f9f37694055d9331c6dd1ebb898af

SHA512
3d1935a58d0939d5eb3a73c5b68cc61964c1f20054e5dfae810fd0c76cf6fd9122017369eb6c3332a261c33df2f5e59ea7255bae5d891cbd526cd9e84b2fd376

Download Submit
C:\Windows\System\tLHIYVI.exe

Filesize
1.9MB

MD5
647d39021f4f6fd59767561b18e28f55

SHA1
30922db1febb7fc6ceecd27e4dbb315ae94e6c86

SHA256
7a0682c683a0796dee610e8b95e60a95b954cdf843d25651002088e7cda5dba3

SHA512
4a0e727becab4e2d1007f5bde3b65e5ff628bf998fad52a1da82623e01b043812e4e30a8080c2dd254fd0d0026df31acdc4b5818a38e39fa1d42e9318003376b

Download Submit
C:\Windows\System\tcCoiqn.exe

Filesize
1.9MB

MD5
eb77805d4b25f479ff733b078490bab8

SHA1
23333dc371adebb941ffcbedf60069dfb8f8ae4d

SHA256
8c4714a660e306d2bb77f6f182a8efa6125396f70baaa5a43a99a1e441e46657

SHA512
3a955679362c169ac35bb6218c9d9641c07abf4c1516be76c5871cbfb3ee18d4a6ad1140c813929e511667600034f91f07be9f814536bd75fe584f2f77460df6

Download Submit
C:\Windows\System\uXxWzOw.exe

Filesize
1.9MB

MD5
a9adc0ae97d6523e9a94794735c09a94

SHA1
ddda08ffe9c6c7f3f96cf715dd06eec10bd15e8d

SHA256
ef0806a1cbb8aa9c1e8255d88d64a620aae5699506062273fda04ae9e4371330

SHA512
0e0c52f5b8f452ee541556deeb57a28a19d02a4865b821af3250c543fb0de9635fafdf55cb8012182fcfbb057ec07e1de40345a6ebd7ab0b7dca16e7e3d3f513

Download Submit
C:\Windows\System\vTPcDKd.exe

Filesize
1.9MB

MD5
77ef6024aaae991ccff47a3f473c61df

SHA1
811f966afb5ea24da013db70c24bf80fcfe07477

SHA256
41af4ec2d2473727a9872aa11a5669ab4d883e0fdfc55e67129f169968c923d4

SHA512
bcdee6b80c52a1499e8669692d75376ca7bbaced3862c0a1a3e4296da5973aab050c72e6ff830c55e11ae81c0760d78d65ddbd762c91ef13b6c490008ed8e00c

Download Submit
C:\Windows\System\yHmqZcs.exe

Filesize
1.9MB

MD5
ab29ca5fbc87d5b771fb34e5d1de1e08

SHA1
146b8bfc82be725448e4009c811b7fab4b2cd151

SHA256
c4887ba6c5ad116d6680d57e7a66848c2c6c522e2995217d38d52a2fca4790b4

SHA512
6e2284cc5a78b401e34a27b996fc024d4bf0ccf0611d48b17da59ef0a7118e10335d5770cb3c117c82977269611410203e9ebc7e37923926acb06fec57013b6a

Download Submit
C:\Windows\System\yOynrJr.exe

Filesize
1.9MB

MD5
6a6252e55af977ebe9cfdf9ba2fd866d

SHA1
a089ea017762118e270c49b59407b783f7ef1517

SHA256
d5bba2bdf980056bb42d79df1e8837a8bb04a21a0e6eb222f8bb6442920dd67f

SHA512
43f009a5d778cb72acb5c4470645cf42ee088c9b393ceafcfdfce3be6f89d378705aea84ba8f726f42610b238fef9bf7bc55ad793f674b6119554e3d4b7e952c

Download Submit
memory/452-652-0x00007FF6529F0000-0x00007FF652D44000-memory.dmp

Filesize
3.3MB

Download
memory/452-2059-0x00007FF6529F0000-0x00007FF652D44000-memory.dmp

Filesize
3.3MB

Download
memory/464-711-0x00007FF626210000-0x00007FF626564000-memory.dmp

Filesize
3.3MB

Download
memory/464-2077-0x00007FF626210000-0x00007FF626564000-memory.dmp

Filesize
3.3MB

Download
memory/672-2053-0x00007FF625AA0000-0x00007FF625DF4000-memory.dmp

Filesize
3.3MB

Download
memory/672-27-0x00007FF625AA0000-0x00007FF625DF4000-memory.dmp

Filesize
3.3MB

Download
memory/1376-703-0x00007FF6FCB40000-0x00007FF6FCE94000-memory.dmp

Filesize
3.3MB

Download
memory/1376-2078-0x00007FF6FCB40000-0x00007FF6FCE94000-memory.dmp

Filesize
3.3MB

Download
memory/1536-677-0x00007FF744DE0000-0x00007FF745134000-memory.dmp

Filesize
3.3MB

Download
memory/1536-2070-0x00007FF744DE0000-0x00007FF745134000-memory.dmp

Filesize
3.3MB

Download
memory/1556-769-0x00007FF6ECD30000-0x00007FF6ED084000-memory.dmp

Filesize
3.3MB

Download
memory/1556-2058-0x00007FF6ECD30000-0x00007FF6ED084000-memory.dmp

Filesize
3.3MB

Download
memory/1700-2065-0x00007FF604910000-0x00007FF604C64000-memory.dmp

Filesize
3.3MB

Download
memory/1700-708-0x00007FF604910000-0x00007FF604C64000-memory.dmp

Filesize
3.3MB

Download
memory/2136-2055-0x00007FF6FEB20000-0x00007FF6FEE74000-memory.dmp

Filesize
3.3MB

Download
memory/2136-35-0x00007FF6FEB20000-0x00007FF6FEE74000-memory.dmp

Filesize
3.3MB

Download
memory/2156-671-0x00007FF77FFD0000-0x00007FF780324000-memory.dmp

Filesize
3.3MB

Download
memory/2156-2080-0x00007FF77FFD0000-0x00007FF780324000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2073-0x00007FF7D6020000-0x00007FF7D6374000-memory.dmp

Filesize
3.3MB

Download
memory/2184-733-0x00007FF7D6020000-0x00007FF7D6374000-memory.dmp

Filesize
3.3MB

Download
memory/2396-0-0x00007FF687040000-0x00007FF687394000-memory.dmp

Filesize
3.3MB

Download
memory/2396-1-0x000001F946690000-0x000001F9466A0000-memory.dmp

Filesize
64KB

Download
memory/2452-2060-0x00007FF69A230000-0x00007FF69A584000-memory.dmp

Filesize
3.3MB

Download
memory/2452-773-0x00007FF69A230000-0x00007FF69A584000-memory.dmp

Filesize
3.3MB

Download
memory/2572-682-0x00007FF788C30000-0x00007FF788F84000-memory.dmp

Filesize
3.3MB

Download
memory/2572-2069-0x00007FF788C30000-0x00007FF788F84000-memory.dmp

Filesize
3.3MB

Download
memory/2660-2079-0x00007FF6D71A0000-0x00007FF6D74F4000-memory.dmp

Filesize
3.3MB

Download
memory/2660-681-0x00007FF6D71A0000-0x00007FF6D74F4000-memory.dmp

Filesize
3.3MB

Download
memory/3100-663-0x00007FF62CC40000-0x00007FF62CF94000-memory.dmp

Filesize
3.3MB

Download
memory/3100-2072-0x00007FF62CC40000-0x00007FF62CF94000-memory.dmp

Filesize
3.3MB

Download
memory/3340-2057-0x00007FF6AA700000-0x00007FF6AAA54000-memory.dmp

Filesize
3.3MB

Download
memory/3340-649-0x00007FF6AA700000-0x00007FF6AAA54000-memory.dmp

Filesize
3.3MB

Download
memory/3340-2051-0x00007FF6AA700000-0x00007FF6AAA54000-memory.dmp

Filesize
3.3MB

Download
memory/3540-655-0x00007FF64D580000-0x00007FF64D8D4000-memory.dmp

Filesize
3.3MB

Download
memory/3540-2075-0x00007FF64D580000-0x00007FF64D8D4000-memory.dmp

Filesize
3.3MB

Download
memory/3616-2066-0x00007FF6BBDE0000-0x00007FF6BC134000-memory.dmp

Filesize
3.3MB

Download
memory/3616-695-0x00007FF6BBDE0000-0x00007FF6BC134000-memory.dmp

Filesize
3.3MB

Download
memory/4008-659-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp

Filesize
3.3MB

Download
memory/4008-2074-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp

Filesize
3.3MB

Download
memory/4040-2064-0x00007FF7B42A0000-0x00007FF7B45F4000-memory.dmp

Filesize
3.3MB

Download
memory/4040-717-0x00007FF7B42A0000-0x00007FF7B45F4000-memory.dmp

Filesize
3.3MB

Download
memory/4196-18-0x00007FF6C6FF0000-0x00007FF6C7344000-memory.dmp

Filesize
3.3MB

Download
memory/4196-2052-0x00007FF6C6FF0000-0x00007FF6C7344000-memory.dmp

Filesize
3.3MB

Download
memory/4240-691-0x00007FF758200000-0x00007FF758554000-memory.dmp

Filesize
3.3MB

Download
memory/4240-2068-0x00007FF758200000-0x00007FF758554000-memory.dmp

Filesize
3.3MB

Download
memory/4372-2076-0x00007FF6F57A0000-0x00007FF6F5AF4000-memory.dmp

Filesize
3.3MB

Download
memory/4372-723-0x00007FF6F57A0000-0x00007FF6F5AF4000-memory.dmp

Filesize
3.3MB

Download
memory/4392-2061-0x00007FF7F3890000-0x00007FF7F3BE4000-memory.dmp

Filesize
3.3MB

Download
memory/4392-748-0x00007FF7F3890000-0x00007FF7F3BE4000-memory.dmp

Filesize
3.3MB

Download
memory/4464-2063-0x00007FF63ED30000-0x00007FF63F084000-memory.dmp

Filesize
3.3MB

Download
memory/4464-743-0x00007FF63ED30000-0x00007FF63F084000-memory.dmp

Filesize
3.3MB

Download
memory/4524-2056-0x00007FF7ECCB0000-0x00007FF7ED004000-memory.dmp

Filesize
3.3MB

Download
memory/4524-768-0x00007FF7ECCB0000-0x00007FF7ED004000-memory.dmp

Filesize
3.3MB

Download
memory/4656-2062-0x00007FF7A9CF0000-0x00007FF7AA044000-memory.dmp

Filesize
3.3MB

Download
memory/4656-728-0x00007FF7A9CF0000-0x00007FF7AA044000-memory.dmp

Filesize
3.3MB

Download
memory/4864-2067-0x00007FF65DCF0000-0x00007FF65E044000-memory.dmp

Filesize
3.3MB

Download
memory/4864-702-0x00007FF65DCF0000-0x00007FF65E044000-memory.dmp

Filesize
3.3MB

Download
memory/4900-763-0x00007FF658B10000-0x00007FF658E64000-memory.dmp

Filesize
3.3MB

Download
memory/4900-2054-0x00007FF658B10000-0x00007FF658E64000-memory.dmp

Filesize
3.3MB

Download
memory/5064-2071-0x00007FF7250A0000-0x00007FF7253F4000-memory.dmp

Filesize
3.3MB

Download
memory/5064-666-0x00007FF7250A0000-0x00007FF7253F4000-memory.dmp

Filesize
3.3MB

Download