xmrig | 8c306b7560431841e812f08dfc71e1db10424d447f33c4f624b0c95d73b044d5

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
Size

2.3MB
MD5

18f6266a349e40f99412530994b59320
SHA1

e3258bd65359e40a16587320817913213b4b607e
SHA256

8c306b7560431841e812f08dfc71e1db10424d447f33c4f624b0c95d73b044d5
SHA512

af8a1287b9db2cbef633c6302b0da8eee529ff4fd4b3aac179df4fed81e8c4ba6a7659e4e58330223379bbb947955119a824f16160b123fc2ee6847b3373713c
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQFD2P6QV8NqMyLEQIUGq:oemTLkNdfE0pZrQK

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5100-0-0x00007FF711610000-0x00007FF711964000-memory.dmp	xmrig
behavioral2/files/0x000800000002359b-3.dat	xmrig
behavioral2/files/0x00070000000235a0-7.dat	xmrig
behavioral2/files/0x00070000000235a2-29.dat	xmrig
behavioral2/files/0x00070000000235a3-32.dat	xmrig
behavioral2/files/0x00070000000235a4-38.dat	xmrig
behavioral2/memory/2104-42-0x00007FF6192B0000-0x00007FF619604000-memory.dmp	xmrig
behavioral2/memory/2200-39-0x00007FF72EC20000-0x00007FF72EF74000-memory.dmp	xmrig
behavioral2/memory/4536-35-0x00007FF798790000-0x00007FF798AE4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235a1-30.dat	xmrig
behavioral2/memory/2452-26-0x00007FF70AB90000-0x00007FF70AEE4000-memory.dmp	xmrig
behavioral2/files/0x000700000002359f-22.dat	xmrig
behavioral2/memory/5092-18-0x00007FF669FA0000-0x00007FF66A2F4000-memory.dmp	xmrig
behavioral2/memory/1220-14-0x00007FF761E60000-0x00007FF7621B4000-memory.dmp	xmrig
behavioral2/memory/4796-10-0x00007FF7DEEE0000-0x00007FF7DF234000-memory.dmp	xmrig
behavioral2/files/0x00070000000235a5-47.dat	xmrig
behavioral2/files/0x000800000002359c-53.dat	xmrig
behavioral2/memory/3060-55-0x00007FF619820000-0x00007FF619B74000-memory.dmp	xmrig
behavioral2/files/0x00070000000235a7-65.dat	xmrig
behavioral2/files/0x00070000000235a6-71.dat	xmrig
behavioral2/files/0x00070000000235ab-82.dat	xmrig
behavioral2/files/0x00070000000235aa-89.dat	xmrig
behavioral2/files/0x00070000000235ac-93.dat	xmrig
behavioral2/files/0x00070000000235a8-86.dat	xmrig
behavioral2/memory/1604-84-0x00007FF7E7650000-0x00007FF7E79A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235a9-79.dat	xmrig
behavioral2/memory/3076-77-0x00007FF6981A0000-0x00007FF6984F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235af-105.dat	xmrig
behavioral2/files/0x00070000000235b0-116.dat	xmrig
behavioral2/files/0x00070000000235b5-135.dat	xmrig
behavioral2/files/0x00070000000235b7-145.dat	xmrig
behavioral2/files/0x00070000000235bd-175.dat	xmrig
behavioral2/files/0x00070000000235bb-171.dat	xmrig
behavioral2/files/0x00070000000235bc-170.dat	xmrig
behavioral2/files/0x00070000000235ba-166.dat	xmrig
behavioral2/files/0x00070000000235b9-161.dat	xmrig
behavioral2/files/0x00070000000235b8-156.dat	xmrig
behavioral2/files/0x00070000000235b6-146.dat	xmrig
behavioral2/files/0x00070000000235b4-136.dat	xmrig
behavioral2/files/0x00070000000235b3-131.dat	xmrig
behavioral2/files/0x00070000000235b2-126.dat	xmrig
behavioral2/files/0x00070000000235b1-120.dat	xmrig
behavioral2/files/0x00070000000235ae-106.dat	xmrig
behavioral2/files/0x00070000000235ad-100.dat	xmrig
behavioral2/memory/2388-73-0x00007FF614710000-0x00007FF614A64000-memory.dmp	xmrig
behavioral2/memory/1316-64-0x00007FF7CFEC0000-0x00007FF7D0214000-memory.dmp	xmrig
behavioral2/memory/5052-604-0x00007FF67B450000-0x00007FF67B7A4000-memory.dmp	xmrig
behavioral2/memory/1696-609-0x00007FF751310000-0x00007FF751664000-memory.dmp	xmrig
behavioral2/memory/3564-619-0x00007FF6DE3D0000-0x00007FF6DE724000-memory.dmp	xmrig
behavioral2/memory/1472-627-0x00007FF6764D0000-0x00007FF676824000-memory.dmp	xmrig
behavioral2/memory/4068-654-0x00007FF740870000-0x00007FF740BC4000-memory.dmp	xmrig
behavioral2/memory/60-662-0x00007FF731BE0000-0x00007FF731F34000-memory.dmp	xmrig
behavioral2/memory/3968-675-0x00007FF748B80000-0x00007FF748ED4000-memory.dmp	xmrig
behavioral2/memory/4876-695-0x00007FF6215B0000-0x00007FF621904000-memory.dmp	xmrig
behavioral2/memory/732-688-0x00007FF6A1480000-0x00007FF6A17D4000-memory.dmp	xmrig
behavioral2/memory/1188-683-0x00007FF7E4380000-0x00007FF7E46D4000-memory.dmp	xmrig
behavioral2/memory/880-672-0x00007FF6811B0000-0x00007FF681504000-memory.dmp	xmrig
behavioral2/memory/1600-646-0x00007FF737190000-0x00007FF7374E4000-memory.dmp	xmrig
behavioral2/memory/4896-640-0x00007FF796C60000-0x00007FF796FB4000-memory.dmp	xmrig
behavioral2/memory/2160-635-0x00007FF6D8C50000-0x00007FF6D8FA4000-memory.dmp	xmrig
behavioral2/memory/4292-630-0x00007FF7F7ED0000-0x00007FF7F8224000-memory.dmp	xmrig
behavioral2/memory/3676-623-0x00007FF790770000-0x00007FF790AC4000-memory.dmp	xmrig
behavioral2/memory/1948-614-0x00007FF623B20000-0x00007FF623E74000-memory.dmp	xmrig
behavioral2/memory/5100-1117-0x00007FF711610000-0x00007FF711964000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4796	vQBsPiF.exe
5092	WlfClib.exe
1220	ZydIMSR.exe
2452	fAhTAAS.exe
4536	QmETcjL.exe
2200	qfJirHQ.exe
2104	jwnpiJJ.exe
3060	geheuIU.exe
1316	lgSNtfr.exe
1604	CmyWFPG.exe
2388	fkmZUha.exe
5052	ZGYpyme.exe
3076	EBDasNJ.exe
732	veyLpvj.exe
1696	NGPzMop.exe
4876	QEBKBeH.exe
1948	pWpDpkD.exe
3564	aXGJRia.exe
3676	MbICJGW.exe
1472	BPjWNpe.exe
4292	oCcMZTu.exe
2160	NKPdrgS.exe
4896	FQMXuke.exe
1600	QSDATuN.exe
4068	WCVLYCw.exe
60	YdfmGJM.exe
880	ZPHwurK.exe
3968	apmfCRD.exe
1188	SAfTwYy.exe
1820	gJxOOAu.exe
784	zmmEbSZ.exe
3360	QzkQzec.exe
2384	kziCcHS.exe
5008	AGNzabA.exe
412	qtDzGbI.exe
2612	gXUfyzK.exe
264	fmJyCXO.exe
2176	AmsPChv.exe
4864	xVrhAXv.exe
1044	RukGdIV.exe
868	GhJjLHZ.exe
3700	FCtgyWx.exe
3788	CogDwOW.exe
2820	vdFxpla.exe
2456	iFdqvgl.exe
3420	BbVAyjU.exe
4492	wLLEhOC.exe
116	tCNiSrt.exe
2140	wLFJzhj.exe
3356	BrSQIfP.exe
4504	hejyuZw.exe
4680	isdDjMi.exe
3456	OplOTvh.exe
5152	QfgKyxL.exe
5180	QoArPJC.exe
5204	fZonsjV.exe
5232	djAfjvV.exe
5260	QJNCBqy.exe
5288	sNVvgju.exe
5316	TczxiGD.exe
5344	VnQCirZ.exe
5372	XUVHWbU.exe
5400	NNRVwDl.exe
5428	bcAeQfP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5100-0-0x00007FF711610000-0x00007FF711964000-memory.dmp	upx
behavioral2/files/0x000800000002359b-3.dat	upx
behavioral2/files/0x00070000000235a0-7.dat	upx
behavioral2/files/0x00070000000235a2-29.dat	upx
behavioral2/files/0x00070000000235a3-32.dat	upx
behavioral2/files/0x00070000000235a4-38.dat	upx
behavioral2/memory/2104-42-0x00007FF6192B0000-0x00007FF619604000-memory.dmp	upx
behavioral2/memory/2200-39-0x00007FF72EC20000-0x00007FF72EF74000-memory.dmp	upx
behavioral2/memory/4536-35-0x00007FF798790000-0x00007FF798AE4000-memory.dmp	upx
behavioral2/files/0x00070000000235a1-30.dat	upx
behavioral2/memory/2452-26-0x00007FF70AB90000-0x00007FF70AEE4000-memory.dmp	upx
behavioral2/files/0x000700000002359f-22.dat	upx
behavioral2/memory/5092-18-0x00007FF669FA0000-0x00007FF66A2F4000-memory.dmp	upx
behavioral2/memory/1220-14-0x00007FF761E60000-0x00007FF7621B4000-memory.dmp	upx
behavioral2/memory/4796-10-0x00007FF7DEEE0000-0x00007FF7DF234000-memory.dmp	upx
behavioral2/files/0x00070000000235a5-47.dat	upx
behavioral2/files/0x000800000002359c-53.dat	upx
behavioral2/memory/3060-55-0x00007FF619820000-0x00007FF619B74000-memory.dmp	upx
behavioral2/files/0x00070000000235a7-65.dat	upx
behavioral2/files/0x00070000000235a6-71.dat	upx
behavioral2/files/0x00070000000235ab-82.dat	upx
behavioral2/files/0x00070000000235aa-89.dat	upx
behavioral2/files/0x00070000000235ac-93.dat	upx
behavioral2/files/0x00070000000235a8-86.dat	upx
behavioral2/memory/1604-84-0x00007FF7E7650000-0x00007FF7E79A4000-memory.dmp	upx
behavioral2/files/0x00070000000235a9-79.dat	upx
behavioral2/memory/3076-77-0x00007FF6981A0000-0x00007FF6984F4000-memory.dmp	upx
behavioral2/files/0x00070000000235af-105.dat	upx
behavioral2/files/0x00070000000235b0-116.dat	upx
behavioral2/files/0x00070000000235b5-135.dat	upx
behavioral2/files/0x00070000000235b7-145.dat	upx
behavioral2/files/0x00070000000235bd-175.dat	upx
behavioral2/files/0x00070000000235bb-171.dat	upx
behavioral2/files/0x00070000000235bc-170.dat	upx
behavioral2/files/0x00070000000235ba-166.dat	upx
behavioral2/files/0x00070000000235b9-161.dat	upx
behavioral2/files/0x00070000000235b8-156.dat	upx
behavioral2/files/0x00070000000235b6-146.dat	upx
behavioral2/files/0x00070000000235b4-136.dat	upx
behavioral2/files/0x00070000000235b3-131.dat	upx
behavioral2/files/0x00070000000235b2-126.dat	upx
behavioral2/files/0x00070000000235b1-120.dat	upx
behavioral2/files/0x00070000000235ae-106.dat	upx
behavioral2/files/0x00070000000235ad-100.dat	upx
behavioral2/memory/2388-73-0x00007FF614710000-0x00007FF614A64000-memory.dmp	upx
behavioral2/memory/1316-64-0x00007FF7CFEC0000-0x00007FF7D0214000-memory.dmp	upx
behavioral2/memory/5052-604-0x00007FF67B450000-0x00007FF67B7A4000-memory.dmp	upx
behavioral2/memory/1696-609-0x00007FF751310000-0x00007FF751664000-memory.dmp	upx
behavioral2/memory/3564-619-0x00007FF6DE3D0000-0x00007FF6DE724000-memory.dmp	upx
behavioral2/memory/1472-627-0x00007FF6764D0000-0x00007FF676824000-memory.dmp	upx
behavioral2/memory/4068-654-0x00007FF740870000-0x00007FF740BC4000-memory.dmp	upx
behavioral2/memory/60-662-0x00007FF731BE0000-0x00007FF731F34000-memory.dmp	upx
behavioral2/memory/3968-675-0x00007FF748B80000-0x00007FF748ED4000-memory.dmp	upx
behavioral2/memory/4876-695-0x00007FF6215B0000-0x00007FF621904000-memory.dmp	upx
behavioral2/memory/732-688-0x00007FF6A1480000-0x00007FF6A17D4000-memory.dmp	upx
behavioral2/memory/1188-683-0x00007FF7E4380000-0x00007FF7E46D4000-memory.dmp	upx
behavioral2/memory/880-672-0x00007FF6811B0000-0x00007FF681504000-memory.dmp	upx
behavioral2/memory/1600-646-0x00007FF737190000-0x00007FF7374E4000-memory.dmp	upx
behavioral2/memory/4896-640-0x00007FF796C60000-0x00007FF796FB4000-memory.dmp	upx
behavioral2/memory/2160-635-0x00007FF6D8C50000-0x00007FF6D8FA4000-memory.dmp	upx
behavioral2/memory/4292-630-0x00007FF7F7ED0000-0x00007FF7F8224000-memory.dmp	upx
behavioral2/memory/3676-623-0x00007FF790770000-0x00007FF790AC4000-memory.dmp	upx
behavioral2/memory/1948-614-0x00007FF623B20000-0x00007FF623E74000-memory.dmp	upx
behavioral2/memory/5100-1117-0x00007FF711610000-0x00007FF711964000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LOTieMt.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\JNugPEV.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\HutMHWN.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\ggjzoGe.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\JaqFaDG.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\ZSGqSMA.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\sqpnTmW.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\VvXpEej.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\SAfTwYy.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\QfgKyxL.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\nbyTMHL.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\XsmkRVl.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\uVjJGav.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\yQunjrR.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\aNTmiyy.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\KPbYAyp.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\ABQSBnB.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\eYkihvM.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\gPqwPmR.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\vWyvXtu.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\bguhzPf.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\oxECAiE.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\qYevivn.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\gwfHTbt.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\LOUSOub.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\WxQyPqK.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\zFTmbLV.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\DwtzoKj.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\RUsAjsz.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\WEUHeti.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\TnVcMhL.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\OplOTvh.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\lOCtfpe.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\ecrSqZa.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\LyIfmBT.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\ZRiUBAt.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\aFLaAUy.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\NKPdrgS.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\uSAVxAg.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\UmTIRBi.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\jnCdiZh.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\LvxVVZT.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\HBydoZB.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\cdBsgWt.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\ZiuUrgN.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\TeibAlJ.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\ZDGcOos.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\EDcdXBL.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\ocvGfNT.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\FbzaSJe.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\JlnMWKK.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\wvVYBbx.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\oXHpuop.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\KIAygaM.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\WoekjRB.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\tgzpwIL.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\GmFnHiv.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\UReodon.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\FXUIaVJ.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\BXafHEk.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\dbLptxE.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\fZonsjV.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\gAOqrCv.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
File created	C:\Windows\System\ZQwUWTz.exe	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4796	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	92
PID 5100 wrote to memory of 4796	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	92
PID 5100 wrote to memory of 5092	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	93
PID 5100 wrote to memory of 5092	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	93
PID 5100 wrote to memory of 1220	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	94
PID 5100 wrote to memory of 1220	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	94
PID 5100 wrote to memory of 2452	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	95
PID 5100 wrote to memory of 2452	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	95
PID 5100 wrote to memory of 4536	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	96
PID 5100 wrote to memory of 4536	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	96
PID 5100 wrote to memory of 2200	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	97
PID 5100 wrote to memory of 2200	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	97
PID 5100 wrote to memory of 2104	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	98
PID 5100 wrote to memory of 2104	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	98
PID 5100 wrote to memory of 3060	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	99
PID 5100 wrote to memory of 3060	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	99
PID 5100 wrote to memory of 1316	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	100
PID 5100 wrote to memory of 1316	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	100
PID 5100 wrote to memory of 1604	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	101
PID 5100 wrote to memory of 1604	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	101
PID 5100 wrote to memory of 2388	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	102
PID 5100 wrote to memory of 2388	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	102
PID 5100 wrote to memory of 5052	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	103
PID 5100 wrote to memory of 5052	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	103
PID 5100 wrote to memory of 3076	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	104
PID 5100 wrote to memory of 3076	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	104
PID 5100 wrote to memory of 732	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	105
PID 5100 wrote to memory of 732	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	105
PID 5100 wrote to memory of 1696	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	106
PID 5100 wrote to memory of 1696	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	106
PID 5100 wrote to memory of 4876	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	107
PID 5100 wrote to memory of 4876	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	107
PID 5100 wrote to memory of 1948	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	108
PID 5100 wrote to memory of 1948	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	108
PID 5100 wrote to memory of 3564	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	109
PID 5100 wrote to memory of 3564	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	109
PID 5100 wrote to memory of 3676	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	110
PID 5100 wrote to memory of 3676	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	110
PID 5100 wrote to memory of 1472	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	111
PID 5100 wrote to memory of 1472	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	111
PID 5100 wrote to memory of 4292	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	112
PID 5100 wrote to memory of 4292	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	112
PID 5100 wrote to memory of 2160	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	113
PID 5100 wrote to memory of 2160	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	113
PID 5100 wrote to memory of 4896	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	114
PID 5100 wrote to memory of 4896	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	114
PID 5100 wrote to memory of 1600	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	115
PID 5100 wrote to memory of 1600	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	115
PID 5100 wrote to memory of 4068	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	116
PID 5100 wrote to memory of 4068	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	116
PID 5100 wrote to memory of 60	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	117
PID 5100 wrote to memory of 60	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	117
PID 5100 wrote to memory of 880	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	118
PID 5100 wrote to memory of 880	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	118
PID 5100 wrote to memory of 3968	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	119
PID 5100 wrote to memory of 3968	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	119
PID 5100 wrote to memory of 1188	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	120
PID 5100 wrote to memory of 1188	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	120
PID 5100 wrote to memory of 1820	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	121
PID 5100 wrote to memory of 1820	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	121
PID 5100 wrote to memory of 784	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	122
PID 5100 wrote to memory of 784	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	122
PID 5100 wrote to memory of 3360	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	123
PID 5100 wrote to memory of 3360	5100	18f6266a349e40f99412530994b59320_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\18f6266a349e40f99412530994b59320_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18f6266a349e40f99412530994b59320_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\System\vQBsPiF.exe
  C:\Windows\System\vQBsPiF.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\WlfClib.exe
  C:\Windows\System\WlfClib.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\ZydIMSR.exe
  C:\Windows\System\ZydIMSR.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\fAhTAAS.exe
  C:\Windows\System\fAhTAAS.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\QmETcjL.exe
  C:\Windows\System\QmETcjL.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\qfJirHQ.exe
  C:\Windows\System\qfJirHQ.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\jwnpiJJ.exe
  C:\Windows\System\jwnpiJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\geheuIU.exe
  C:\Windows\System\geheuIU.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\lgSNtfr.exe
  C:\Windows\System\lgSNtfr.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\CmyWFPG.exe
  C:\Windows\System\CmyWFPG.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\fkmZUha.exe
  C:\Windows\System\fkmZUha.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\ZGYpyme.exe
  C:\Windows\System\ZGYpyme.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\EBDasNJ.exe
  C:\Windows\System\EBDasNJ.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\veyLpvj.exe
  C:\Windows\System\veyLpvj.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\NGPzMop.exe
  C:\Windows\System\NGPzMop.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\QEBKBeH.exe
  C:\Windows\System\QEBKBeH.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\pWpDpkD.exe
  C:\Windows\System\pWpDpkD.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\aXGJRia.exe
  C:\Windows\System\aXGJRia.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\MbICJGW.exe
  C:\Windows\System\MbICJGW.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\BPjWNpe.exe
  C:\Windows\System\BPjWNpe.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\oCcMZTu.exe
  C:\Windows\System\oCcMZTu.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\NKPdrgS.exe
  C:\Windows\System\NKPdrgS.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\FQMXuke.exe
  C:\Windows\System\FQMXuke.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\QSDATuN.exe
  C:\Windows\System\QSDATuN.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\WCVLYCw.exe
  C:\Windows\System\WCVLYCw.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\YdfmGJM.exe
  C:\Windows\System\YdfmGJM.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\ZPHwurK.exe
  C:\Windows\System\ZPHwurK.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\apmfCRD.exe
  C:\Windows\System\apmfCRD.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\SAfTwYy.exe
  C:\Windows\System\SAfTwYy.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\gJxOOAu.exe
  C:\Windows\System\gJxOOAu.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\zmmEbSZ.exe
  C:\Windows\System\zmmEbSZ.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\QzkQzec.exe
  C:\Windows\System\QzkQzec.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\kziCcHS.exe
  C:\Windows\System\kziCcHS.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\AGNzabA.exe
  C:\Windows\System\AGNzabA.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\qtDzGbI.exe
  C:\Windows\System\qtDzGbI.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\gXUfyzK.exe
  C:\Windows\System\gXUfyzK.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\fmJyCXO.exe
  C:\Windows\System\fmJyCXO.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\AmsPChv.exe
  C:\Windows\System\AmsPChv.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\xVrhAXv.exe
  C:\Windows\System\xVrhAXv.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\RukGdIV.exe
  C:\Windows\System\RukGdIV.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\GhJjLHZ.exe
  C:\Windows\System\GhJjLHZ.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\FCtgyWx.exe
  C:\Windows\System\FCtgyWx.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\CogDwOW.exe
  C:\Windows\System\CogDwOW.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\vdFxpla.exe
  C:\Windows\System\vdFxpla.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\iFdqvgl.exe
  C:\Windows\System\iFdqvgl.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\BbVAyjU.exe
  C:\Windows\System\BbVAyjU.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\wLLEhOC.exe
  C:\Windows\System\wLLEhOC.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\tCNiSrt.exe
  C:\Windows\System\tCNiSrt.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\wLFJzhj.exe
  C:\Windows\System\wLFJzhj.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\BrSQIfP.exe
  C:\Windows\System\BrSQIfP.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\hejyuZw.exe
  C:\Windows\System\hejyuZw.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\isdDjMi.exe
  C:\Windows\System\isdDjMi.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\OplOTvh.exe
  C:\Windows\System\OplOTvh.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\QfgKyxL.exe
  C:\Windows\System\QfgKyxL.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\QoArPJC.exe
  C:\Windows\System\QoArPJC.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\fZonsjV.exe
  C:\Windows\System\fZonsjV.exe
  2⤵
  - Executes dropped EXE
  PID:5204
- C:\Windows\System\djAfjvV.exe
  C:\Windows\System\djAfjvV.exe
  2⤵
  - Executes dropped EXE
  PID:5232
- C:\Windows\System\QJNCBqy.exe
  C:\Windows\System\QJNCBqy.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\sNVvgju.exe
  C:\Windows\System\sNVvgju.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\TczxiGD.exe
  C:\Windows\System\TczxiGD.exe
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Windows\System\VnQCirZ.exe
  C:\Windows\System\VnQCirZ.exe
  2⤵
  - Executes dropped EXE
  PID:5344
- C:\Windows\System\XUVHWbU.exe
  C:\Windows\System\XUVHWbU.exe
  2⤵
  - Executes dropped EXE
  PID:5372
- C:\Windows\System\NNRVwDl.exe
  C:\Windows\System\NNRVwDl.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\bcAeQfP.exe
  C:\Windows\System\bcAeQfP.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\nqNIbQZ.exe
  C:\Windows\System\nqNIbQZ.exe
  2⤵
  PID:5456
- C:\Windows\System\ceBrRSa.exe
  C:\Windows\System\ceBrRSa.exe
  2⤵
  PID:5484
- C:\Windows\System\cDYeneK.exe
  C:\Windows\System\cDYeneK.exe
  2⤵
  PID:5512
- C:\Windows\System\GqxIkkY.exe
  C:\Windows\System\GqxIkkY.exe
  2⤵
  PID:5540
- C:\Windows\System\XArnNZz.exe
  C:\Windows\System\XArnNZz.exe
  2⤵
  PID:5568
- C:\Windows\System\fyJhDuE.exe
  C:\Windows\System\fyJhDuE.exe
  2⤵
  PID:5596
- C:\Windows\System\Aagobqo.exe
  C:\Windows\System\Aagobqo.exe
  2⤵
  PID:5624
- C:\Windows\System\jjPIoJH.exe
  C:\Windows\System\jjPIoJH.exe
  2⤵
  PID:5652
- C:\Windows\System\prMfcfa.exe
  C:\Windows\System\prMfcfa.exe
  2⤵
  PID:5676
- C:\Windows\System\ipjzymo.exe
  C:\Windows\System\ipjzymo.exe
  2⤵
  PID:5708
- C:\Windows\System\FqZzJkA.exe
  C:\Windows\System\FqZzJkA.exe
  2⤵
  PID:5732
- C:\Windows\System\eYkihvM.exe
  C:\Windows\System\eYkihvM.exe
  2⤵
  PID:5764
- C:\Windows\System\eAFJpBt.exe
  C:\Windows\System\eAFJpBt.exe
  2⤵
  PID:5792
- C:\Windows\System\NtzuWnh.exe
  C:\Windows\System\NtzuWnh.exe
  2⤵
  PID:5820
- C:\Windows\System\HXYclht.exe
  C:\Windows\System\HXYclht.exe
  2⤵
  PID:5848
- C:\Windows\System\BEJOzDs.exe
  C:\Windows\System\BEJOzDs.exe
  2⤵
  PID:5876
- C:\Windows\System\bCtFEib.exe
  C:\Windows\System\bCtFEib.exe
  2⤵
  PID:5900
- C:\Windows\System\HIEhoIy.exe
  C:\Windows\System\HIEhoIy.exe
  2⤵
  PID:5932
- C:\Windows\System\baeLQfB.exe
  C:\Windows\System\baeLQfB.exe
  2⤵
  PID:5960
- C:\Windows\System\ZwAGeHS.exe
  C:\Windows\System\ZwAGeHS.exe
  2⤵
  PID:5988
- C:\Windows\System\lDeYAuN.exe
  C:\Windows\System\lDeYAuN.exe
  2⤵
  PID:6016
- C:\Windows\System\buyqRjO.exe
  C:\Windows\System\buyqRjO.exe
  2⤵
  PID:6044
- C:\Windows\System\NxFZbDK.exe
  C:\Windows\System\NxFZbDK.exe
  2⤵
  PID:6072
- C:\Windows\System\OwMiMqA.exe
  C:\Windows\System\OwMiMqA.exe
  2⤵
  PID:6100
- C:\Windows\System\MMIvrHn.exe
  C:\Windows\System\MMIvrHn.exe
  2⤵
  PID:6128
- C:\Windows\System\gAdIGPH.exe
  C:\Windows\System\gAdIGPH.exe
  2⤵
  PID:4972
- C:\Windows\System\uzTLCiV.exe
  C:\Windows\System\uzTLCiV.exe
  2⤵
  PID:728
- C:\Windows\System\yZualja.exe
  C:\Windows\System\yZualja.exe
  2⤵
  PID:4204
- C:\Windows\System\rjlbxuN.exe
  C:\Windows\System\rjlbxuN.exe
  2⤵
  PID:2248
- C:\Windows\System\yCfQHRo.exe
  C:\Windows\System\yCfQHRo.exe
  2⤵
  PID:5140
- C:\Windows\System\gwfHTbt.exe
  C:\Windows\System\gwfHTbt.exe
  2⤵
  PID:5216
- C:\Windows\System\rufrrFs.exe
  C:\Windows\System\rufrrFs.exe
  2⤵
  PID:5276
- C:\Windows\System\WGzMUsU.exe
  C:\Windows\System\WGzMUsU.exe
  2⤵
  PID:5336
- C:\Windows\System\hZNiKCS.exe
  C:\Windows\System\hZNiKCS.exe
  2⤵
  PID:5412
- C:\Windows\System\wckNNrD.exe
  C:\Windows\System\wckNNrD.exe
  2⤵
  PID:5472
- C:\Windows\System\yCsVtJR.exe
  C:\Windows\System\yCsVtJR.exe
  2⤵
  PID:5532
- C:\Windows\System\YZLDVLH.exe
  C:\Windows\System\YZLDVLH.exe
  2⤵
  PID:5608
- C:\Windows\System\qylsFmU.exe
  C:\Windows\System\qylsFmU.exe
  2⤵
  PID:5668
- C:\Windows\System\aaKouYG.exe
  C:\Windows\System\aaKouYG.exe
  2⤵
  PID:5728
- C:\Windows\System\UVDrvQG.exe
  C:\Windows\System\UVDrvQG.exe
  2⤵
  PID:5804
- C:\Windows\System\uCiszTj.exe
  C:\Windows\System\uCiszTj.exe
  2⤵
  PID:5864
- C:\Windows\System\PMSlppj.exe
  C:\Windows\System\PMSlppj.exe
  2⤵
  PID:5920
- C:\Windows\System\pSYeDXs.exe
  C:\Windows\System\pSYeDXs.exe
  2⤵
  PID:5980
- C:\Windows\System\YGEaybn.exe
  C:\Windows\System\YGEaybn.exe
  2⤵
  PID:6056
- C:\Windows\System\LisjtPv.exe
  C:\Windows\System\LisjtPv.exe
  2⤵
  PID:6116
- C:\Windows\System\IFZmBjF.exe
  C:\Windows\System\IFZmBjF.exe
  2⤵
  PID:924
- C:\Windows\System\ZhVblho.exe
  C:\Windows\System\ZhVblho.exe
  2⤵
  PID:3184
- C:\Windows\System\UvNmvOT.exe
  C:\Windows\System\UvNmvOT.exe
  2⤵
  PID:5244
- C:\Windows\System\UgVtCdh.exe
  C:\Windows\System\UgVtCdh.exe
  2⤵
  PID:5384
- C:\Windows\System\ZiuUrgN.exe
  C:\Windows\System\ZiuUrgN.exe
  2⤵
  PID:5524
- C:\Windows\System\YDiODJa.exe
  C:\Windows\System\YDiODJa.exe
  2⤵
  PID:5640
- C:\Windows\System\zbDAfcf.exe
  C:\Windows\System\zbDAfcf.exe
  2⤵
  PID:5780
- C:\Windows\System\AyDHFAt.exe
  C:\Windows\System\AyDHFAt.exe
  2⤵
  PID:5948
- C:\Windows\System\hwBNIGl.exe
  C:\Windows\System\hwBNIGl.exe
  2⤵
  PID:6032
- C:\Windows\System\IfgdZMq.exe
  C:\Windows\System\IfgdZMq.exe
  2⤵
  PID:6148
- C:\Windows\System\ExXpOmX.exe
  C:\Windows\System\ExXpOmX.exe
  2⤵
  PID:6176
- C:\Windows\System\oQGOfUM.exe
  C:\Windows\System\oQGOfUM.exe
  2⤵
  PID:6200
- C:\Windows\System\xVvwsle.exe
  C:\Windows\System\xVvwsle.exe
  2⤵
  PID:6232
- C:\Windows\System\jElTnfl.exe
  C:\Windows\System\jElTnfl.exe
  2⤵
  PID:6260
- C:\Windows\System\Tgyoqtt.exe
  C:\Windows\System\Tgyoqtt.exe
  2⤵
  PID:6292
- C:\Windows\System\BkPQfsD.exe
  C:\Windows\System\BkPQfsD.exe
  2⤵
  PID:6320
- C:\Windows\System\RcGAEwW.exe
  C:\Windows\System\RcGAEwW.exe
  2⤵
  PID:6348
- C:\Windows\System\gAOqrCv.exe
  C:\Windows\System\gAOqrCv.exe
  2⤵
  PID:6376
- C:\Windows\System\zDfqrDI.exe
  C:\Windows\System\zDfqrDI.exe
  2⤵
  PID:6404
- C:\Windows\System\XnfcfGJ.exe
  C:\Windows\System\XnfcfGJ.exe
  2⤵
  PID:6432
- C:\Windows\System\VnHAGcK.exe
  C:\Windows\System\VnHAGcK.exe
  2⤵
  PID:6460
- C:\Windows\System\ZAHCCFw.exe
  C:\Windows\System\ZAHCCFw.exe
  2⤵
  PID:6488
- C:\Windows\System\COeHrQF.exe
  C:\Windows\System\COeHrQF.exe
  2⤵
  PID:6516
- C:\Windows\System\pPBBfFB.exe
  C:\Windows\System\pPBBfFB.exe
  2⤵
  PID:6544
- C:\Windows\System\XvLkCZj.exe
  C:\Windows\System\XvLkCZj.exe
  2⤵
  PID:6572
- C:\Windows\System\lyyPjzC.exe
  C:\Windows\System\lyyPjzC.exe
  2⤵
  PID:6600
- C:\Windows\System\RUsAjsz.exe
  C:\Windows\System\RUsAjsz.exe
  2⤵
  PID:6628
- C:\Windows\System\FgEfNLo.exe
  C:\Windows\System\FgEfNLo.exe
  2⤵
  PID:6656
- C:\Windows\System\ZAwQTfb.exe
  C:\Windows\System\ZAwQTfb.exe
  2⤵
  PID:6684
- C:\Windows\System\WEUHeti.exe
  C:\Windows\System\WEUHeti.exe
  2⤵
  PID:6712
- C:\Windows\System\HgBavEp.exe
  C:\Windows\System\HgBavEp.exe
  2⤵
  PID:6740
- C:\Windows\System\fjfBUrW.exe
  C:\Windows\System\fjfBUrW.exe
  2⤵
  PID:6768
- C:\Windows\System\pyGEeTu.exe
  C:\Windows\System\pyGEeTu.exe
  2⤵
  PID:6796
- C:\Windows\System\rmitBGY.exe
  C:\Windows\System\rmitBGY.exe
  2⤵
  PID:6824
- C:\Windows\System\tdgPizP.exe
  C:\Windows\System\tdgPizP.exe
  2⤵
  PID:6852
- C:\Windows\System\JgOPCIT.exe
  C:\Windows\System\JgOPCIT.exe
  2⤵
  PID:6880
- C:\Windows\System\PFCPDYK.exe
  C:\Windows\System\PFCPDYK.exe
  2⤵
  PID:6908
- C:\Windows\System\hZOhNSi.exe
  C:\Windows\System\hZOhNSi.exe
  2⤵
  PID:6936
- C:\Windows\System\JULWppp.exe
  C:\Windows\System\JULWppp.exe
  2⤵
  PID:6964
- C:\Windows\System\ZNPVgka.exe
  C:\Windows\System\ZNPVgka.exe
  2⤵
  PID:6992
- C:\Windows\System\uJjifSd.exe
  C:\Windows\System\uJjifSd.exe
  2⤵
  PID:7020
- C:\Windows\System\FbzaSJe.exe
  C:\Windows\System\FbzaSJe.exe
  2⤵
  PID:7048
- C:\Windows\System\DJNqCnJ.exe
  C:\Windows\System\DJNqCnJ.exe
  2⤵
  PID:7076
- C:\Windows\System\rDkWgwb.exe
  C:\Windows\System\rDkWgwb.exe
  2⤵
  PID:7108
- C:\Windows\System\OwHSLXU.exe
  C:\Windows\System\OwHSLXU.exe
  2⤵
  PID:7132
- C:\Windows\System\XqjAgeN.exe
  C:\Windows\System\XqjAgeN.exe
  2⤵
  PID:7160
- C:\Windows\System\OEUJnyU.exe
  C:\Windows\System\OEUJnyU.exe
  2⤵
  PID:5304
- C:\Windows\System\SyeXCyv.exe
  C:\Windows\System\SyeXCyv.exe
  2⤵
  PID:5584
- C:\Windows\System\JlnMWKK.exe
  C:\Windows\System\JlnMWKK.exe
  2⤵
  PID:5892
- C:\Windows\System\dIRqZkQ.exe
  C:\Windows\System\dIRqZkQ.exe
  2⤵
  PID:5012
- C:\Windows\System\kWJXkCr.exe
  C:\Windows\System\kWJXkCr.exe
  2⤵
  PID:6196
- C:\Windows\System\xwpZDcF.exe
  C:\Windows\System\xwpZDcF.exe
  2⤵
  PID:1076
- C:\Windows\System\JEpyXPx.exe
  C:\Windows\System\JEpyXPx.exe
  2⤵
  PID:6284
- C:\Windows\System\QrNjltk.exe
  C:\Windows\System\QrNjltk.exe
  2⤵
  PID:6340
- C:\Windows\System\wrGiCfo.exe
  C:\Windows\System\wrGiCfo.exe
  2⤵
  PID:6396
- C:\Windows\System\HDVJZYd.exe
  C:\Windows\System\HDVJZYd.exe
  2⤵
  PID:6500
- C:\Windows\System\dorkjIt.exe
  C:\Windows\System\dorkjIt.exe
  2⤵
  PID:6560
- C:\Windows\System\oZbNodF.exe
  C:\Windows\System\oZbNodF.exe
  2⤵
  PID:6620
- C:\Windows\System\WZStXKp.exe
  C:\Windows\System\WZStXKp.exe
  2⤵
  PID:6696
- C:\Windows\System\KCdIyjS.exe
  C:\Windows\System\KCdIyjS.exe
  2⤵
  PID:6756
- C:\Windows\System\nbyTMHL.exe
  C:\Windows\System\nbyTMHL.exe
  2⤵
  PID:6816
- C:\Windows\System\jdziGhL.exe
  C:\Windows\System\jdziGhL.exe
  2⤵
  PID:6892
- C:\Windows\System\uSAVxAg.exe
  C:\Windows\System\uSAVxAg.exe
  2⤵
  PID:6952
- C:\Windows\System\bzQOYMb.exe
  C:\Windows\System\bzQOYMb.exe
  2⤵
  PID:7012
- C:\Windows\System\AZnkCfu.exe
  C:\Windows\System\AZnkCfu.exe
  2⤵
  PID:7088
- C:\Windows\System\TZQuMYp.exe
  C:\Windows\System\TZQuMYp.exe
  2⤵
  PID:7144
- C:\Windows\System\FLYUkmH.exe
  C:\Windows\System\FLYUkmH.exe
  2⤵
  PID:5444
- C:\Windows\System\puzYbRi.exe
  C:\Windows\System\puzYbRi.exe
  2⤵
  PID:2244
- C:\Windows\System\cBCEYIF.exe
  C:\Windows\System\cBCEYIF.exe
  2⤵
  PID:6312
- C:\Windows\System\lIgWjrO.exe
  C:\Windows\System\lIgWjrO.exe
  2⤵
  PID:6444
- C:\Windows\System\FPzpGIg.exe
  C:\Windows\System\FPzpGIg.exe
  2⤵
  PID:6668
- C:\Windows\System\ZQwUWTz.exe
  C:\Windows\System\ZQwUWTz.exe
  2⤵
  PID:6784
- C:\Windows\System\CUfTFQu.exe
  C:\Windows\System\CUfTFQu.exe
  2⤵
  PID:2284
- C:\Windows\System\ZRpOqKW.exe
  C:\Windows\System\ZRpOqKW.exe
  2⤵
  PID:6928
- C:\Windows\System\MoqroOH.exe
  C:\Windows\System\MoqroOH.exe
  2⤵
  PID:3648
- C:\Windows\System\TKFJVFz.exe
  C:\Windows\System\TKFJVFz.exe
  2⤵
  PID:1792
- C:\Windows\System\lJtzric.exe
  C:\Windows\System\lJtzric.exe
  2⤵
  PID:3784
- C:\Windows\System\Jslsvda.exe
  C:\Windows\System\Jslsvda.exe
  2⤵
  PID:232
- C:\Windows\System\rlCjlPn.exe
  C:\Windows\System\rlCjlPn.exe
  2⤵
  PID:1508
- C:\Windows\System\LNfbpQo.exe
  C:\Windows\System\LNfbpQo.exe
  2⤵
  PID:6424
- C:\Windows\System\UWgodho.exe
  C:\Windows\System\UWgodho.exe
  2⤵
  PID:6648
- C:\Windows\System\sxVLNqY.exe
  C:\Windows\System\sxVLNqY.exe
  2⤵
  PID:2704
- C:\Windows\System\iLpXSJn.exe
  C:\Windows\System\iLpXSJn.exe
  2⤵
  PID:6308
- C:\Windows\System\LRyfNNs.exe
  C:\Windows\System\LRyfNNs.exe
  2⤵
  PID:7224
- C:\Windows\System\gAFPjbk.exe
  C:\Windows\System\gAFPjbk.exe
  2⤵
  PID:7244
- C:\Windows\System\ddSbCaE.exe
  C:\Windows\System\ddSbCaE.exe
  2⤵
  PID:7264
- C:\Windows\System\foZGcRu.exe
  C:\Windows\System\foZGcRu.exe
  2⤵
  PID:7300
- C:\Windows\System\KqfcJkA.exe
  C:\Windows\System\KqfcJkA.exe
  2⤵
  PID:7332
- C:\Windows\System\lOCtfpe.exe
  C:\Windows\System\lOCtfpe.exe
  2⤵
  PID:7352
- C:\Windows\System\XsmkRVl.exe
  C:\Windows\System\XsmkRVl.exe
  2⤵
  PID:7368
- C:\Windows\System\eWJoStR.exe
  C:\Windows\System\eWJoStR.exe
  2⤵
  PID:7400
- C:\Windows\System\lmmmZvr.exe
  C:\Windows\System\lmmmZvr.exe
  2⤵
  PID:7432
- C:\Windows\System\DPkjwmM.exe
  C:\Windows\System\DPkjwmM.exe
  2⤵
  PID:7456
- C:\Windows\System\BnLTLVH.exe
  C:\Windows\System\BnLTLVH.exe
  2⤵
  PID:7492
- C:\Windows\System\wTgsQea.exe
  C:\Windows\System\wTgsQea.exe
  2⤵
  PID:7524
- C:\Windows\System\uOAKWnM.exe
  C:\Windows\System\uOAKWnM.exe
  2⤵
  PID:7556
- C:\Windows\System\FBXxpfz.exe
  C:\Windows\System\FBXxpfz.exe
  2⤵
  PID:7596
- C:\Windows\System\SqrpXnL.exe
  C:\Windows\System\SqrpXnL.exe
  2⤵
  PID:7644
- C:\Windows\System\bqkhZdT.exe
  C:\Windows\System\bqkhZdT.exe
  2⤵
  PID:7752
- C:\Windows\System\MUYbvLe.exe
  C:\Windows\System\MUYbvLe.exe
  2⤵
  PID:7768
- C:\Windows\System\hOnSYbJ.exe
  C:\Windows\System\hOnSYbJ.exe
  2⤵
  PID:7784
- C:\Windows\System\ZVvkekU.exe
  C:\Windows\System\ZVvkekU.exe
  2⤵
  PID:7812
- C:\Windows\System\JdjAyAr.exe
  C:\Windows\System\JdjAyAr.exe
  2⤵
  PID:7840
- C:\Windows\System\vfsvgEx.exe
  C:\Windows\System\vfsvgEx.exe
  2⤵
  PID:7868
- C:\Windows\System\mmGmjCY.exe
  C:\Windows\System\mmGmjCY.exe
  2⤵
  PID:7896
- C:\Windows\System\PUveIDh.exe
  C:\Windows\System\PUveIDh.exe
  2⤵
  PID:7924
- C:\Windows\System\SXuXFXj.exe
  C:\Windows\System\SXuXFXj.exe
  2⤵
  PID:7972
- C:\Windows\System\PAjYsNS.exe
  C:\Windows\System\PAjYsNS.exe
  2⤵
  PID:8060
- C:\Windows\System\kRkmFuu.exe
  C:\Windows\System\kRkmFuu.exe
  2⤵
  PID:8076
- C:\Windows\System\yWvBNxr.exe
  C:\Windows\System\yWvBNxr.exe
  2⤵
  PID:8092
- C:\Windows\System\zJPavcu.exe
  C:\Windows\System\zJPavcu.exe
  2⤵
  PID:8108
- C:\Windows\System\UlXJARq.exe
  C:\Windows\System\UlXJARq.exe
  2⤵
  PID:8124
- C:\Windows\System\kXAExvE.exe
  C:\Windows\System\kXAExvE.exe
  2⤵
  PID:2364
- C:\Windows\System\bWYQriX.exe
  C:\Windows\System\bWYQriX.exe
  2⤵
  PID:7204
- C:\Windows\System\EGzItpq.exe
  C:\Windows\System\EGzItpq.exe
  2⤵
  PID:7420
- C:\Windows\System\UztxIsL.exe
  C:\Windows\System\UztxIsL.exe
  2⤵
  PID:7508
- C:\Windows\System\soYTlmO.exe
  C:\Windows\System\soYTlmO.exe
  2⤵
  PID:7584
- C:\Windows\System\HmxaNNP.exe
  C:\Windows\System\HmxaNNP.exe
  2⤵
  PID:7632
- C:\Windows\System\vWyvXtu.exe
  C:\Windows\System\vWyvXtu.exe
  2⤵
  PID:7744
- C:\Windows\System\laDlhEV.exe
  C:\Windows\System\laDlhEV.exe
  2⤵
  PID:7804
- C:\Windows\System\xdvXUBy.exe
  C:\Windows\System\xdvXUBy.exe
  2⤵
  PID:7908
- C:\Windows\System\irmajjv.exe
  C:\Windows\System\irmajjv.exe
  2⤵
  PID:7968
- C:\Windows\System\ColROPe.exe
  C:\Windows\System\ColROPe.exe
  2⤵
  PID:8032
- C:\Windows\System\TICnnDr.exe
  C:\Windows\System\TICnnDr.exe
  2⤵
  PID:8088
- C:\Windows\System\ibeKszt.exe
  C:\Windows\System\ibeKszt.exe
  2⤵
  PID:5108
- C:\Windows\System\snJOWJZ.exe
  C:\Windows\System\snJOWJZ.exe
  2⤵
  PID:7712
- C:\Windows\System\gPqwPmR.exe
  C:\Windows\System\gPqwPmR.exe
  2⤵
  PID:7708
- C:\Windows\System\GIjWvfl.exe
  C:\Windows\System\GIjWvfl.exe
  2⤵
  PID:7380
- C:\Windows\System\hXPAizL.exe
  C:\Windows\System\hXPAizL.exe
  2⤵
  PID:7732
- C:\Windows\System\BHhMiPW.exe
  C:\Windows\System\BHhMiPW.exe
  2⤵
  PID:7472
- C:\Windows\System\UUHGhJM.exe
  C:\Windows\System\UUHGhJM.exe
  2⤵
  PID:7776
- C:\Windows\System\mTiqvej.exe
  C:\Windows\System\mTiqvej.exe
  2⤵
  PID:7884
- C:\Windows\System\hlRewde.exe
  C:\Windows\System\hlRewde.exe
  2⤵
  PID:8072
- C:\Windows\System\lmTAdor.exe
  C:\Windows\System\lmTAdor.exe
  2⤵
  PID:8144
- C:\Windows\System\UqECToo.exe
  C:\Windows\System\UqECToo.exe
  2⤵
  PID:7720
- C:\Windows\System\cWcbRgm.exe
  C:\Windows\System\cWcbRgm.exe
  2⤵
  PID:7628
- C:\Windows\System\IayLAxj.exe
  C:\Windows\System\IayLAxj.exe
  2⤵
  PID:7116
- C:\Windows\System\CJsJlZd.exe
  C:\Windows\System\CJsJlZd.exe
  2⤵
  PID:216
- C:\Windows\System\TIpPTFo.exe
  C:\Windows\System\TIpPTFo.exe
  2⤵
  PID:8084
- C:\Windows\System\jOSHXWq.exe
  C:\Windows\System\jOSHXWq.exe
  2⤵
  PID:8204
- C:\Windows\System\riaQfin.exe
  C:\Windows\System\riaQfin.exe
  2⤵
  PID:8224
- C:\Windows\System\tPgijwF.exe
  C:\Windows\System\tPgijwF.exe
  2⤵
  PID:8276
- C:\Windows\System\wpwsHSV.exe
  C:\Windows\System\wpwsHSV.exe
  2⤵
  PID:8304
- C:\Windows\System\UqdTjll.exe
  C:\Windows\System\UqdTjll.exe
  2⤵
  PID:8332
- C:\Windows\System\wvVYBbx.exe
  C:\Windows\System\wvVYBbx.exe
  2⤵
  PID:8348
- C:\Windows\System\IoamutR.exe
  C:\Windows\System\IoamutR.exe
  2⤵
  PID:8376
- C:\Windows\System\LnTFhSw.exe
  C:\Windows\System\LnTFhSw.exe
  2⤵
  PID:8416
- C:\Windows\System\VWjVhfH.exe
  C:\Windows\System\VWjVhfH.exe
  2⤵
  PID:8432
- C:\Windows\System\aGaDRVc.exe
  C:\Windows\System\aGaDRVc.exe
  2⤵
  PID:8460
- C:\Windows\System\rLIBqBO.exe
  C:\Windows\System\rLIBqBO.exe
  2⤵
  PID:8484
- C:\Windows\System\oxGksFO.exe
  C:\Windows\System\oxGksFO.exe
  2⤵
  PID:8520
- C:\Windows\System\lRwArEF.exe
  C:\Windows\System\lRwArEF.exe
  2⤵
  PID:8544
- C:\Windows\System\XsXtrJN.exe
  C:\Windows\System\XsXtrJN.exe
  2⤵
  PID:8580
- C:\Windows\System\uVjJGav.exe
  C:\Windows\System\uVjJGav.exe
  2⤵
  PID:8612
- C:\Windows\System\xfCGGYM.exe
  C:\Windows\System\xfCGGYM.exe
  2⤵
  PID:8640
- C:\Windows\System\KYVhsbs.exe
  C:\Windows\System\KYVhsbs.exe
  2⤵
  PID:8668
- C:\Windows\System\LOUSOub.exe
  C:\Windows\System\LOUSOub.exe
  2⤵
  PID:8696
- C:\Windows\System\DSRUKqh.exe
  C:\Windows\System\DSRUKqh.exe
  2⤵
  PID:8716
- C:\Windows\System\bLtPLIm.exe
  C:\Windows\System\bLtPLIm.exe
  2⤵
  PID:8740
- C:\Windows\System\nlUgulk.exe
  C:\Windows\System\nlUgulk.exe
  2⤵
  PID:8780
- C:\Windows\System\WuSNKIn.exe
  C:\Windows\System\WuSNKIn.exe
  2⤵
  PID:8812
- C:\Windows\System\HpcYMsO.exe
  C:\Windows\System\HpcYMsO.exe
  2⤵
  PID:8828
- C:\Windows\System\MfqQBUh.exe
  C:\Windows\System\MfqQBUh.exe
  2⤵
  PID:8856
- C:\Windows\System\HSRXSdl.exe
  C:\Windows\System\HSRXSdl.exe
  2⤵
  PID:8872
- C:\Windows\System\NcoLlbJ.exe
  C:\Windows\System\NcoLlbJ.exe
  2⤵
  PID:8900
- C:\Windows\System\IsTdgTM.exe
  C:\Windows\System\IsTdgTM.exe
  2⤵
  PID:8952
- C:\Windows\System\LBReTuK.exe
  C:\Windows\System\LBReTuK.exe
  2⤵
  PID:8980
- C:\Windows\System\cxkntiJ.exe
  C:\Windows\System\cxkntiJ.exe
  2⤵
  PID:9000
- C:\Windows\System\KVzYFyC.exe
  C:\Windows\System\KVzYFyC.exe
  2⤵
  PID:9036
- C:\Windows\System\ArJGhak.exe
  C:\Windows\System\ArJGhak.exe
  2⤵
  PID:9064
- C:\Windows\System\csLJoNT.exe
  C:\Windows\System\csLJoNT.exe
  2⤵
  PID:9080
- C:\Windows\System\zYSJyCo.exe
  C:\Windows\System\zYSJyCo.exe
  2⤵
  PID:9108
- C:\Windows\System\LxlTHqC.exe
  C:\Windows\System\LxlTHqC.exe
  2⤵
  PID:9148
- C:\Windows\System\zBiYkiP.exe
  C:\Windows\System\zBiYkiP.exe
  2⤵
  PID:9172
- C:\Windows\System\gjoXWfL.exe
  C:\Windows\System\gjoXWfL.exe
  2⤵
  PID:9204
- C:\Windows\System\MYsvfJy.exe
  C:\Windows\System\MYsvfJy.exe
  2⤵
  PID:8212
- C:\Windows\System\girzlJl.exe
  C:\Windows\System\girzlJl.exe
  2⤵
  PID:8272
- C:\Windows\System\ePVlazR.exe
  C:\Windows\System\ePVlazR.exe
  2⤵
  PID:8344
- C:\Windows\System\ridnfnA.exe
  C:\Windows\System\ridnfnA.exe
  2⤵
  PID:8408
- C:\Windows\System\nVTBQZT.exe
  C:\Windows\System\nVTBQZT.exe
  2⤵
  PID:8500
- C:\Windows\System\CzTmPPd.exe
  C:\Windows\System\CzTmPPd.exe
  2⤵
  PID:8504
- C:\Windows\System\NORDyjk.exe
  C:\Windows\System\NORDyjk.exe
  2⤵
  PID:7540
- C:\Windows\System\KIkieAY.exe
  C:\Windows\System\KIkieAY.exe
  2⤵
  PID:8684
- C:\Windows\System\OZYNaBz.exe
  C:\Windows\System\OZYNaBz.exe
  2⤵
  PID:8704
- C:\Windows\System\FvhlXbH.exe
  C:\Windows\System\FvhlXbH.exe
  2⤵
  PID:8804
- C:\Windows\System\ZSGqSMA.exe
  C:\Windows\System\ZSGqSMA.exe
  2⤵
  PID:8840
- C:\Windows\System\UIvRXBc.exe
  C:\Windows\System\UIvRXBc.exe
  2⤵
  PID:8908
- C:\Windows\System\sMMFXfN.exe
  C:\Windows\System\sMMFXfN.exe
  2⤵
  PID:8964
- C:\Windows\System\TeibAlJ.exe
  C:\Windows\System\TeibAlJ.exe
  2⤵
  PID:9016
- C:\Windows\System\XqrkTkI.exe
  C:\Windows\System\XqrkTkI.exe
  2⤵
  PID:9128
- C:\Windows\System\WyZlkQi.exe
  C:\Windows\System\WyZlkQi.exe
  2⤵
  PID:7440
- C:\Windows\System\DOJWHwE.exe
  C:\Windows\System\DOJWHwE.exe
  2⤵
  PID:8320
- C:\Windows\System\CfQocEb.exe
  C:\Windows\System\CfQocEb.exe
  2⤵
  PID:8456
- C:\Windows\System\UjEwqaG.exe
  C:\Windows\System\UjEwqaG.exe
  2⤵
  PID:8496
- C:\Windows\System\upWmcaT.exe
  C:\Windows\System\upWmcaT.exe
  2⤵
  PID:8724
- C:\Windows\System\InzPOSA.exe
  C:\Windows\System\InzPOSA.exe
  2⤵
  PID:8820
- C:\Windows\System\pEYtSVx.exe
  C:\Windows\System\pEYtSVx.exe
  2⤵
  PID:9076
- C:\Windows\System\HnMbjKG.exe
  C:\Windows\System\HnMbjKG.exe
  2⤵
  PID:9200
- C:\Windows\System\MHHBGlA.exe
  C:\Windows\System\MHHBGlA.exe
  2⤵
  PID:8528
- C:\Windows\System\OMYXULf.exe
  C:\Windows\System\OMYXULf.exe
  2⤵
  PID:8756
- C:\Windows\System\jaDbuvr.exe
  C:\Windows\System\jaDbuvr.exe
  2⤵
  PID:9120
- C:\Windows\System\lDhIHjD.exe
  C:\Windows\System\lDhIHjD.exe
  2⤵
  PID:8868
- C:\Windows\System\YcfXHay.exe
  C:\Windows\System\YcfXHay.exe
  2⤵
  PID:9224
- C:\Windows\System\gVoIGkx.exe
  C:\Windows\System\gVoIGkx.exe
  2⤵
  PID:9248
- C:\Windows\System\cmKRgXM.exe
  C:\Windows\System\cmKRgXM.exe
  2⤵
  PID:9288
- C:\Windows\System\QzXpInp.exe
  C:\Windows\System\QzXpInp.exe
  2⤵
  PID:9312
- C:\Windows\System\mLkwncm.exe
  C:\Windows\System\mLkwncm.exe
  2⤵
  PID:9344
- C:\Windows\System\gEEYWNB.exe
  C:\Windows\System\gEEYWNB.exe
  2⤵
  PID:9372
- C:\Windows\System\wBKaLMi.exe
  C:\Windows\System\wBKaLMi.exe
  2⤵
  PID:9400
- C:\Windows\System\teAstgN.exe
  C:\Windows\System\teAstgN.exe
  2⤵
  PID:9428
- C:\Windows\System\vjwACoy.exe
  C:\Windows\System\vjwACoy.exe
  2⤵
  PID:9456
- C:\Windows\System\XgdWZKK.exe
  C:\Windows\System\XgdWZKK.exe
  2⤵
  PID:9484
- C:\Windows\System\DnTgbxZ.exe
  C:\Windows\System\DnTgbxZ.exe
  2⤵
  PID:9512
- C:\Windows\System\EYCYzKB.exe
  C:\Windows\System\EYCYzKB.exe
  2⤵
  PID:9528
- C:\Windows\System\tHQRapS.exe
  C:\Windows\System\tHQRapS.exe
  2⤵
  PID:9556
- C:\Windows\System\bguhzPf.exe
  C:\Windows\System\bguhzPf.exe
  2⤵
  PID:9576
- C:\Windows\System\RMSBewH.exe
  C:\Windows\System\RMSBewH.exe
  2⤵
  PID:9608
- C:\Windows\System\ZDGcOos.exe
  C:\Windows\System\ZDGcOos.exe
  2⤵
  PID:9636
- C:\Windows\System\vpCdTKB.exe
  C:\Windows\System\vpCdTKB.exe
  2⤵
  PID:9676
- C:\Windows\System\MjeXlMa.exe
  C:\Windows\System\MjeXlMa.exe
  2⤵
  PID:9700
- C:\Windows\System\iRATdeT.exe
  C:\Windows\System\iRATdeT.exe
  2⤵
  PID:9720
- C:\Windows\System\ccnPxyZ.exe
  C:\Windows\System\ccnPxyZ.exe
  2⤵
  PID:9752
- C:\Windows\System\uhjAphT.exe
  C:\Windows\System\uhjAphT.exe
  2⤵
  PID:9792
- C:\Windows\System\EpJICJi.exe
  C:\Windows\System\EpJICJi.exe
  2⤵
  PID:9820
- C:\Windows\System\UReodon.exe
  C:\Windows\System\UReodon.exe
  2⤵
  PID:9848
- C:\Windows\System\wGQrMeo.exe
  C:\Windows\System\wGQrMeo.exe
  2⤵
  PID:9876
- C:\Windows\System\gwNVhOp.exe
  C:\Windows\System\gwNVhOp.exe
  2⤵
  PID:9896
- C:\Windows\System\zWnqcEA.exe
  C:\Windows\System\zWnqcEA.exe
  2⤵
  PID:9932
- C:\Windows\System\VhdAeSr.exe
  C:\Windows\System\VhdAeSr.exe
  2⤵
  PID:9952
- C:\Windows\System\ecrSqZa.exe
  C:\Windows\System\ecrSqZa.exe
  2⤵
  PID:9976
- C:\Windows\System\wbRbqFU.exe
  C:\Windows\System\wbRbqFU.exe
  2⤵
  PID:10020
- C:\Windows\System\PzYPefP.exe
  C:\Windows\System\PzYPefP.exe
  2⤵
  PID:10048
- C:\Windows\System\aixNSVx.exe
  C:\Windows\System\aixNSVx.exe
  2⤵
  PID:10064
- C:\Windows\System\XowwMMq.exe
  C:\Windows\System\XowwMMq.exe
  2⤵
  PID:10084
- C:\Windows\System\FufsAdx.exe
  C:\Windows\System\FufsAdx.exe
  2⤵
  PID:10148
- C:\Windows\System\MekOnsv.exe
  C:\Windows\System\MekOnsv.exe
  2⤵
  PID:10164
- C:\Windows\System\iVdGuVQ.exe
  C:\Windows\System\iVdGuVQ.exe
  2⤵
  PID:10180
- C:\Windows\System\DtZkvRU.exe
  C:\Windows\System\DtZkvRU.exe
  2⤵
  PID:10204
- C:\Windows\System\CErnrSt.exe
  C:\Windows\System\CErnrSt.exe
  2⤵
  PID:10224
- C:\Windows\System\XQgzSAx.exe
  C:\Windows\System\XQgzSAx.exe
  2⤵
  PID:9232
- C:\Windows\System\FEzdVSu.exe
  C:\Windows\System\FEzdVSu.exe
  2⤵
  PID:9368
- C:\Windows\System\FhsBBUn.exe
  C:\Windows\System\FhsBBUn.exe
  2⤵
  PID:9452
- C:\Windows\System\UyKDGGj.exe
  C:\Windows\System\UyKDGGj.exe
  2⤵
  PID:9524
- C:\Windows\System\jYqUDmU.exe
  C:\Windows\System\jYqUDmU.exe
  2⤵
  PID:9596
- C:\Windows\System\xDGNaax.exe
  C:\Windows\System\xDGNaax.exe
  2⤵
  PID:9668
- C:\Windows\System\ptRJfTG.exe
  C:\Windows\System\ptRJfTG.exe
  2⤵
  PID:9712
- C:\Windows\System\qfaZIOq.exe
  C:\Windows\System\qfaZIOq.exe
  2⤵
  PID:9788
- C:\Windows\System\htlDEJu.exe
  C:\Windows\System\htlDEJu.exe
  2⤵
  PID:9844
- C:\Windows\System\eAtCJtj.exe
  C:\Windows\System\eAtCJtj.exe
  2⤵
  PID:9940
- C:\Windows\System\BQfSiGu.exe
  C:\Windows\System\BQfSiGu.exe
  2⤵
  PID:10008
- C:\Windows\System\BQtjQuQ.exe
  C:\Windows\System\BQtjQuQ.exe
  2⤵
  PID:10060
- C:\Windows\System\mDMaGIu.exe
  C:\Windows\System\mDMaGIu.exe
  2⤵
  PID:10156
- C:\Windows\System\XFlsVRq.exe
  C:\Windows\System\XFlsVRq.exe
  2⤵
  PID:10188
- C:\Windows\System\ZlproUI.exe
  C:\Windows\System\ZlproUI.exe
  2⤵
  PID:10196
- C:\Windows\System\OImCPxW.exe
  C:\Windows\System\OImCPxW.exe
  2⤵
  PID:9396
- C:\Windows\System\ivTcHEs.exe
  C:\Windows\System\ivTcHEs.exe
  2⤵
  PID:9424
- C:\Windows\System\ARnvRZf.exe
  C:\Windows\System\ARnvRZf.exe
  2⤵
  PID:9692
- C:\Windows\System\XFssBmv.exe
  C:\Windows\System\XFssBmv.exe
  2⤵
  PID:9872
- C:\Windows\System\LyIfmBT.exe
  C:\Windows\System\LyIfmBT.exe
  2⤵
  PID:9968
- C:\Windows\System\yQunjrR.exe
  C:\Windows\System\yQunjrR.exe
  2⤵
  PID:10172
- C:\Windows\System\YsjAIaa.exe
  C:\Windows\System\YsjAIaa.exe
  2⤵
  PID:9364
- C:\Windows\System\ABKPhLf.exe
  C:\Windows\System\ABKPhLf.exe
  2⤵
  PID:9740
- C:\Windows\System\wOrLtaA.exe
  C:\Windows\System\wOrLtaA.exe
  2⤵
  PID:10104
- C:\Windows\System\HKsYgYy.exe
  C:\Windows\System\HKsYgYy.exe
  2⤵
  PID:10212
- C:\Windows\System\CsKujFP.exe
  C:\Windows\System\CsKujFP.exe
  2⤵
  PID:10176
- C:\Windows\System\LjXuEya.exe
  C:\Windows\System\LjXuEya.exe
  2⤵
  PID:10268
- C:\Windows\System\wvpdjhP.exe
  C:\Windows\System\wvpdjhP.exe
  2⤵
  PID:10292
- C:\Windows\System\NCMwdxz.exe
  C:\Windows\System\NCMwdxz.exe
  2⤵
  PID:10324
- C:\Windows\System\oSmEBHn.exe
  C:\Windows\System\oSmEBHn.exe
  2⤵
  PID:10352
- C:\Windows\System\KXGKhzz.exe
  C:\Windows\System\KXGKhzz.exe
  2⤵
  PID:10368
- C:\Windows\System\BvpsObD.exe
  C:\Windows\System\BvpsObD.exe
  2⤵
  PID:10392
- C:\Windows\System\uFOTmPe.exe
  C:\Windows\System\uFOTmPe.exe
  2⤵
  PID:10428
- C:\Windows\System\lORcrmH.exe
  C:\Windows\System\lORcrmH.exe
  2⤵
  PID:10460
- C:\Windows\System\LOTieMt.exe
  C:\Windows\System\LOTieMt.exe
  2⤵
  PID:10488
- C:\Windows\System\RfuAvdS.exe
  C:\Windows\System\RfuAvdS.exe
  2⤵
  PID:10516
- C:\Windows\System\xhlWDwU.exe
  C:\Windows\System\xhlWDwU.exe
  2⤵
  PID:10540
- C:\Windows\System\eZXGWkE.exe
  C:\Windows\System\eZXGWkE.exe
  2⤵
  PID:10560
- C:\Windows\System\UmTIRBi.exe
  C:\Windows\System\UmTIRBi.exe
  2⤵
  PID:10580
- C:\Windows\System\McYRPSS.exe
  C:\Windows\System\McYRPSS.exe
  2⤵
  PID:10596
- C:\Windows\System\XPWraAP.exe
  C:\Windows\System\XPWraAP.exe
  2⤵
  PID:10628
- C:\Windows\System\JNugPEV.exe
  C:\Windows\System\JNugPEV.exe
  2⤵
  PID:10676
- C:\Windows\System\hkqnwWN.exe
  C:\Windows\System\hkqnwWN.exe
  2⤵
  PID:10704
- C:\Windows\System\vbWdINc.exe
  C:\Windows\System\vbWdINc.exe
  2⤵
  PID:10720
- C:\Windows\System\GYNPhcn.exe
  C:\Windows\System\GYNPhcn.exe
  2⤵
  PID:10756
- C:\Windows\System\fRXxVzx.exe
  C:\Windows\System\fRXxVzx.exe
  2⤵
  PID:10776
- C:\Windows\System\PzBaEQm.exe
  C:\Windows\System\PzBaEQm.exe
  2⤵
  PID:10816
- C:\Windows\System\RmSUaHS.exe
  C:\Windows\System\RmSUaHS.exe
  2⤵
  PID:10852
- C:\Windows\System\ncJkDEO.exe
  C:\Windows\System\ncJkDEO.exe
  2⤵
  PID:10872
- C:\Windows\System\uqDLEpD.exe
  C:\Windows\System\uqDLEpD.exe
  2⤵
  PID:10900
- C:\Windows\System\iqFgSzK.exe
  C:\Windows\System\iqFgSzK.exe
  2⤵
  PID:10940
- C:\Windows\System\aNTmiyy.exe
  C:\Windows\System\aNTmiyy.exe
  2⤵
  PID:10956
- C:\Windows\System\AgSEFDW.exe
  C:\Windows\System\AgSEFDW.exe
  2⤵
  PID:10988
- C:\Windows\System\HTpelyq.exe
  C:\Windows\System\HTpelyq.exe
  2⤵
  PID:11024
- C:\Windows\System\irKZJlB.exe
  C:\Windows\System\irKZJlB.exe
  2⤵
  PID:11052
- C:\Windows\System\TPSvHft.exe
  C:\Windows\System\TPSvHft.exe
  2⤵
  PID:11080
- C:\Windows\System\tWkIURi.exe
  C:\Windows\System\tWkIURi.exe
  2⤵
  PID:11096
- C:\Windows\System\UpciGFu.exe
  C:\Windows\System\UpciGFu.exe
  2⤵
  PID:11132
- C:\Windows\System\yHBSSrJ.exe
  C:\Windows\System\yHBSSrJ.exe
  2⤵
  PID:11148
- C:\Windows\System\IUCxEXs.exe
  C:\Windows\System\IUCxEXs.exe
  2⤵
  PID:11180
- C:\Windows\System\CevOXFI.exe
  C:\Windows\System\CevOXFI.exe
  2⤵
  PID:11196
- C:\Windows\System\DWNpWpo.exe
  C:\Windows\System\DWNpWpo.exe
  2⤵
  PID:11228
- C:\Windows\System\eNrYHjz.exe
  C:\Windows\System\eNrYHjz.exe
  2⤵
  PID:10280
- C:\Windows\System\dALCIhx.exe
  C:\Windows\System\dALCIhx.exe
  2⤵
  PID:10320
- C:\Windows\System\FXUIaVJ.exe
  C:\Windows\System\FXUIaVJ.exe
  2⤵
  PID:10380
- C:\Windows\System\uwZmuwm.exe
  C:\Windows\System\uwZmuwm.exe
  2⤵
  PID:10472
- C:\Windows\System\BitMCyB.exe
  C:\Windows\System\BitMCyB.exe
  2⤵
  PID:10532
- C:\Windows\System\UeLTdAf.exe
  C:\Windows\System\UeLTdAf.exe
  2⤵
  PID:10592
- C:\Windows\System\MOrdgiM.exe
  C:\Windows\System\MOrdgiM.exe
  2⤵
  PID:10608
- C:\Windows\System\MKgmJnL.exe
  C:\Windows\System\MKgmJnL.exe
  2⤵
  PID:10732
- C:\Windows\System\IJgnpxF.exe
  C:\Windows\System\IJgnpxF.exe
  2⤵
  PID:10804
- C:\Windows\System\zhjXYVQ.exe
  C:\Windows\System\zhjXYVQ.exe
  2⤵
  PID:10192
- C:\Windows\System\SQuOuDv.exe
  C:\Windows\System\SQuOuDv.exe
  2⤵
  PID:10920
- C:\Windows\System\Ubqqibf.exe
  C:\Windows\System\Ubqqibf.exe
  2⤵
  PID:10972
- C:\Windows\System\FHTIKcP.exe
  C:\Windows\System\FHTIKcP.exe
  2⤵
  PID:11020
- C:\Windows\System\dozJJke.exe
  C:\Windows\System\dozJJke.exe
  2⤵
  PID:11112
- C:\Windows\System\dfhHvYX.exe
  C:\Windows\System\dfhHvYX.exe
  2⤵
  PID:11188
- C:\Windows\System\OxEHrPt.exe
  C:\Windows\System\OxEHrPt.exe
  2⤵
  PID:11260
- C:\Windows\System\hwjAKjm.exe
  C:\Windows\System\hwjAKjm.exe
  2⤵
  PID:10360
- C:\Windows\System\aUgqtzB.exe
  C:\Windows\System\aUgqtzB.exe
  2⤵
  PID:10524
- C:\Windows\System\pBNEYVP.exe
  C:\Windows\System\pBNEYVP.exe
  2⤵
  PID:10588
- C:\Windows\System\ClTxFBO.exe
  C:\Windows\System\ClTxFBO.exe
  2⤵
  PID:10772
- C:\Windows\System\AFKPrqC.exe
  C:\Windows\System\AFKPrqC.exe
  2⤵
  PID:10892
- C:\Windows\System\vkGtqid.exe
  C:\Windows\System\vkGtqid.exe
  2⤵
  PID:11108
- C:\Windows\System\BXafHEk.exe
  C:\Windows\System\BXafHEk.exe
  2⤵
  PID:10264
- C:\Windows\System\JApJyCg.exe
  C:\Windows\System\JApJyCg.exe
  2⤵
  PID:10572
- C:\Windows\System\APHYQiB.exe
  C:\Windows\System\APHYQiB.exe
  2⤵
  PID:10936
- C:\Windows\System\hPVxOGX.exe
  C:\Windows\System\hPVxOGX.exe
  2⤵
  PID:11244
- C:\Windows\System\rNsSMUa.exe
  C:\Windows\System\rNsSMUa.exe
  2⤵
  PID:10712
- C:\Windows\System\ZVzwaHj.exe
  C:\Windows\System\ZVzwaHj.exe
  2⤵
  PID:11288
- C:\Windows\System\zdHrHBL.exe
  C:\Windows\System\zdHrHBL.exe
  2⤵
  PID:11316
- C:\Windows\System\KPbYAyp.exe
  C:\Windows\System\KPbYAyp.exe
  2⤵
  PID:11344
- C:\Windows\System\HtWrGDE.exe
  C:\Windows\System\HtWrGDE.exe
  2⤵
  PID:11372
- C:\Windows\System\OLyoPFz.exe
  C:\Windows\System\OLyoPFz.exe
  2⤵
  PID:11400
- C:\Windows\System\WrYPndz.exe
  C:\Windows\System\WrYPndz.exe
  2⤵
  PID:11416
- C:\Windows\System\oxECAiE.exe
  C:\Windows\System\oxECAiE.exe
  2⤵
  PID:11432
- C:\Windows\System\DzgaKTx.exe
  C:\Windows\System\DzgaKTx.exe
  2⤵
  PID:11448
- C:\Windows\System\rhGxaAf.exe
  C:\Windows\System\rhGxaAf.exe
  2⤵
  PID:11472
- C:\Windows\System\JTgLvjg.exe
  C:\Windows\System\JTgLvjg.exe
  2⤵
  PID:11516
- C:\Windows\System\aLuRgvz.exe
  C:\Windows\System\aLuRgvz.exe
  2⤵
  PID:11568
- C:\Windows\System\JovdXbi.exe
  C:\Windows\System\JovdXbi.exe
  2⤵
  PID:11592
- C:\Windows\System\oXHpuop.exe
  C:\Windows\System\oXHpuop.exe
  2⤵
  PID:11624
- C:\Windows\System\KIAygaM.exe
  C:\Windows\System\KIAygaM.exe
  2⤵
  PID:11640
- C:\Windows\System\vaBtunV.exe
  C:\Windows\System\vaBtunV.exe
  2⤵
  PID:11668
- C:\Windows\System\uzDbfnV.exe
  C:\Windows\System\uzDbfnV.exe
  2⤵
  PID:11696
- C:\Windows\System\YJkOrsT.exe
  C:\Windows\System\YJkOrsT.exe
  2⤵
  PID:11724
- C:\Windows\System\iTxlJUS.exe
  C:\Windows\System\iTxlJUS.exe
  2⤵
  PID:11752
- C:\Windows\System\TRtCanl.exe
  C:\Windows\System\TRtCanl.exe
  2⤵
  PID:11768
- C:\Windows\System\aHxDYhH.exe
  C:\Windows\System\aHxDYhH.exe
  2⤵
  PID:11796
- C:\Windows\System\PNWlhip.exe
  C:\Windows\System\PNWlhip.exe
  2⤵
  PID:11824
- C:\Windows\System\JzGDNPN.exe
  C:\Windows\System\JzGDNPN.exe
  2⤵
  PID:11852
- C:\Windows\System\SZgMxJa.exe
  C:\Windows\System\SZgMxJa.exe
  2⤵
  PID:11900
- C:\Windows\System\MQMikcP.exe
  C:\Windows\System\MQMikcP.exe
  2⤵
  PID:11924
- C:\Windows\System\MKnoYeC.exe
  C:\Windows\System\MKnoYeC.exe
  2⤵
  PID:11956
- C:\Windows\System\EDcdXBL.exe
  C:\Windows\System\EDcdXBL.exe
  2⤵
  PID:11996
- C:\Windows\System\Gekxwxp.exe
  C:\Windows\System\Gekxwxp.exe
  2⤵
  PID:12016
- C:\Windows\System\RdzdgKA.exe
  C:\Windows\System\RdzdgKA.exe
  2⤵
  PID:12052
- C:\Windows\System\LphKklD.exe
  C:\Windows\System\LphKklD.exe
  2⤵
  PID:12080
- C:\Windows\System\lDBMAeG.exe
  C:\Windows\System\lDBMAeG.exe
  2⤵
  PID:12096
- C:\Windows\System\OyBOAuy.exe
  C:\Windows\System\OyBOAuy.exe
  2⤵
  PID:12136
- C:\Windows\System\GoXfHlz.exe
  C:\Windows\System\GoXfHlz.exe
  2⤵
  PID:12152
- C:\Windows\System\uTKZNVc.exe
  C:\Windows\System\uTKZNVc.exe
  2⤵
  PID:12172
- C:\Windows\System\WxQyPqK.exe
  C:\Windows\System\WxQyPqK.exe
  2⤵
  PID:12200
- C:\Windows\System\yaeydPt.exe
  C:\Windows\System\yaeydPt.exe
  2⤵
  PID:12236
- C:\Windows\System\IIHcVbG.exe
  C:\Windows\System\IIHcVbG.exe
  2⤵
  PID:12256
- C:\Windows\System\CSlRyoc.exe
  C:\Windows\System\CSlRyoc.exe
  2⤵
  PID:12284
- C:\Windows\System\oBpOvSr.exe
  C:\Windows\System\oBpOvSr.exe
  2⤵
  PID:11300
- C:\Windows\System\FdlwycC.exe
  C:\Windows\System\FdlwycC.exe
  2⤵
  PID:11384
- C:\Windows\System\JHoOakW.exe
  C:\Windows\System\JHoOakW.exe
  2⤵
  PID:11440
- C:\Windows\System\sqpnTmW.exe
  C:\Windows\System\sqpnTmW.exe
  2⤵
  PID:11500
- C:\Windows\System\eBjyJQf.exe
  C:\Windows\System\eBjyJQf.exe
  2⤵
  PID:1088
- C:\Windows\System\SOcVhQC.exe
  C:\Windows\System\SOcVhQC.exe
  2⤵
  PID:11616
- C:\Windows\System\qimyQno.exe
  C:\Windows\System\qimyQno.exe
  2⤵
  PID:11660
- C:\Windows\System\NauIhKS.exe
  C:\Windows\System\NauIhKS.exe
  2⤵
  PID:11744
- C:\Windows\System\SVjXAVP.exe
  C:\Windows\System\SVjXAVP.exe
  2⤵
  PID:11780
- C:\Windows\System\YkRnzkt.exe
  C:\Windows\System\YkRnzkt.exe
  2⤵
  PID:11884
- C:\Windows\System\TDqydLl.exe
  C:\Windows\System\TDqydLl.exe
  2⤵
  PID:11952
- C:\Windows\System\eMkCBZK.exe
  C:\Windows\System\eMkCBZK.exe
  2⤵
  PID:12012
- C:\Windows\System\alkJUyL.exe
  C:\Windows\System\alkJUyL.exe
  2⤵
  PID:12076
- C:\Windows\System\QwEhUxB.exe
  C:\Windows\System\QwEhUxB.exe
  2⤵
  PID:12184
- C:\Windows\System\ARoijVH.exe
  C:\Windows\System\ARoijVH.exe
  2⤵
  PID:12164
- C:\Windows\System\DMHbhMR.exe
  C:\Windows\System\DMHbhMR.exe
  2⤵
  PID:12264
- C:\Windows\System\xLsVsca.exe
  C:\Windows\System\xLsVsca.exe
  2⤵
  PID:12280
- C:\Windows\System\ONINSRM.exe
  C:\Windows\System\ONINSRM.exe
  2⤵
  PID:11396
- C:\Windows\System\iuGwCYT.exe
  C:\Windows\System\iuGwCYT.exe
  2⤵
  PID:11488
- C:\Windows\System\pcyCPGB.exe
  C:\Windows\System\pcyCPGB.exe
  2⤵
  PID:11620
- C:\Windows\System\kfRlLVG.exe
  C:\Windows\System\kfRlLVG.exe
  2⤵
  PID:11740
- C:\Windows\System\lRLoumt.exe
  C:\Windows\System\lRLoumt.exe
  2⤵
  PID:11916
- C:\Windows\System\JRMKZpY.exe
  C:\Windows\System\JRMKZpY.exe
  2⤵
  PID:12116
- C:\Windows\System\NzPcVgA.exe
  C:\Windows\System\NzPcVgA.exe
  2⤵
  PID:11424
- C:\Windows\System\ipUGsTM.exe
  C:\Windows\System\ipUGsTM.exe
  2⤵
  PID:2096
- C:\Windows\System\GmpRdjq.exe
  C:\Windows\System\GmpRdjq.exe
  2⤵
  PID:12108
- C:\Windows\System\dbLptxE.exe
  C:\Windows\System\dbLptxE.exe
  2⤵
  PID:12296
- C:\Windows\System\aTdtsde.exe
  C:\Windows\System\aTdtsde.exe
  2⤵
  PID:12324
- C:\Windows\System\XSMvRoR.exe
  C:\Windows\System\XSMvRoR.exe
  2⤵
  PID:12348
- C:\Windows\System\PkMwJKo.exe
  C:\Windows\System\PkMwJKo.exe
  2⤵
  PID:12396
- C:\Windows\System\FKGNRxi.exe
  C:\Windows\System\FKGNRxi.exe
  2⤵
  PID:12424
- C:\Windows\System\rAKBOQV.exe
  C:\Windows\System\rAKBOQV.exe
  2⤵
  PID:12456
- C:\Windows\System\cXWOqFs.exe
  C:\Windows\System\cXWOqFs.exe
  2⤵
  PID:12484
- C:\Windows\System\ciZIMVA.exe
  C:\Windows\System\ciZIMVA.exe
  2⤵
  PID:12512
- C:\Windows\System\vwBzztF.exe
  C:\Windows\System\vwBzztF.exe
  2⤵
  PID:12528
- C:\Windows\System\NSloguP.exe
  C:\Windows\System\NSloguP.exe
  2⤵
  PID:12556
- C:\Windows\System\kPvbtDA.exe
  C:\Windows\System\kPvbtDA.exe
  2⤵
  PID:12584
- C:\Windows\System\iAzzLgO.exe
  C:\Windows\System\iAzzLgO.exe
  2⤵
  PID:12652
- C:\Windows\System\glqIeeY.exe
  C:\Windows\System\glqIeeY.exe
  2⤵
  PID:12668
- C:\Windows\System\oNvWCCr.exe
  C:\Windows\System\oNvWCCr.exe
  2⤵
  PID:12696
- C:\Windows\System\HutMHWN.exe
  C:\Windows\System\HutMHWN.exe
  2⤵
  PID:12724
- C:\Windows\System\OnsLtww.exe
  C:\Windows\System\OnsLtww.exe
  2⤵
  PID:12740
- C:\Windows\System\QyTDYEY.exe
  C:\Windows\System\QyTDYEY.exe
  2⤵
  PID:12768
- C:\Windows\System\tXDbZAk.exe
  C:\Windows\System\tXDbZAk.exe
  2⤵
  PID:12796
- C:\Windows\System\fzoasGb.exe
  C:\Windows\System\fzoasGb.exe
  2⤵
  PID:12836
- C:\Windows\System\IXUZVnP.exe
  C:\Windows\System\IXUZVnP.exe
  2⤵
  PID:12852
- C:\Windows\System\NhzDZeX.exe
  C:\Windows\System\NhzDZeX.exe
  2⤵
  PID:12868
- C:\Windows\System\OckhdoK.exe
  C:\Windows\System\OckhdoK.exe
  2⤵
  PID:12900
- C:\Windows\System\tmrtdRq.exe
  C:\Windows\System\tmrtdRq.exe
  2⤵
  PID:12924
- C:\Windows\System\zFTmbLV.exe
  C:\Windows\System\zFTmbLV.exe
  2⤵
  PID:12948
- C:\Windows\System\lkIZuDi.exe
  C:\Windows\System\lkIZuDi.exe
  2⤵
  PID:12988
- C:\Windows\System\UbEFYKp.exe
  C:\Windows\System\UbEFYKp.exe
  2⤵
  PID:13012
- C:\Windows\System\zaYIzbl.exe
  C:\Windows\System\zaYIzbl.exe
  2⤵
  PID:13036
- C:\Windows\System\WoekjRB.exe
  C:\Windows\System\WoekjRB.exe
  2⤵
  PID:13052
- C:\Windows\System\jnCdiZh.exe
  C:\Windows\System\jnCdiZh.exe
  2⤵
  PID:13084
- C:\Windows\System\mnJWrqq.exe
  C:\Windows\System\mnJWrqq.exe
  2⤵
  PID:13112
- C:\Windows\System\ibMxsWA.exe
  C:\Windows\System\ibMxsWA.exe
  2⤵
  PID:13140
- C:\Windows\System\WeFUGhL.exe
  C:\Windows\System\WeFUGhL.exe
  2⤵
  PID:13160
- C:\Windows\System\qXCDaoe.exe
  C:\Windows\System\qXCDaoe.exe
  2⤵
  PID:13188
- C:\Windows\System\dOEwWiR.exe
  C:\Windows\System\dOEwWiR.exe
  2⤵
  PID:13256
- C:\Windows\System\ekQeyZE.exe
  C:\Windows\System\ekQeyZE.exe
  2⤵
  PID:13300
- C:\Windows\System\OohVbuD.exe
  C:\Windows\System\OohVbuD.exe
  2⤵
  PID:12320
- C:\Windows\System\jMhqiFP.exe
  C:\Windows\System\jMhqiFP.exe
  2⤵
  PID:12344
- C:\Windows\System\dLELfFn.exe
  C:\Windows\System\dLELfFn.exe
  2⤵
  PID:12416
- C:\Windows\System\kyjSYcR.exe
  C:\Windows\System\kyjSYcR.exe
  2⤵
  PID:12448
- C:\Windows\System\dEACofe.exe
  C:\Windows\System\dEACofe.exe
  2⤵
  PID:12508
- C:\Windows\System\kXrxMRh.exe
  C:\Windows\System\kXrxMRh.exe
  2⤵
  PID:12624
- C:\Windows\System\muuWeHG.exe
  C:\Windows\System\muuWeHG.exe
  2⤵
  PID:12684
- C:\Windows\System\LiKAbNE.exe
  C:\Windows\System\LiKAbNE.exe
  2⤵
  PID:12752
- C:\Windows\System\LHMYdxZ.exe
  C:\Windows\System\LHMYdxZ.exe
  2⤵
  PID:12848
- C:\Windows\System\wUKqGwn.exe
  C:\Windows\System\wUKqGwn.exe
  2⤵
  PID:12908
- C:\Windows\System\ZqrnmQz.exe
  C:\Windows\System\ZqrnmQz.exe
  2⤵
  PID:13004
- C:\Windows\System\WNmEbsS.exe
  C:\Windows\System\WNmEbsS.exe
  2⤵
  PID:13068
- C:\Windows\System\qKJjoLF.exe
  C:\Windows\System\qKJjoLF.exe
  2⤵
  PID:13128
- C:\Windows\System\ibSHkRm.exe
  C:\Windows\System\ibSHkRm.exe
  2⤵
  PID:13184
- C:\Windows\System\JPFIDHJ.exe
  C:\Windows\System\JPFIDHJ.exe
  2⤵
  PID:13268
- C:\Windows\System\wVnGhUI.exe
  C:\Windows\System\wVnGhUI.exe
  2⤵
  PID:12392
- C:\Windows\System\pAJWyQy.exe
  C:\Windows\System\pAJWyQy.exe
  2⤵
  PID:12664
- C:\Windows\System\EylxuGX.exe
  C:\Windows\System\EylxuGX.exe
  2⤵
  PID:12788
- C:\Windows\System\DwtzoKj.exe
  C:\Windows\System\DwtzoKj.exe
  2⤵
  PID:13136
- C:\Windows\System\eyoHAHk.exe
  C:\Windows\System\eyoHAHk.exe
  2⤵
  PID:12376
- C:\Windows\System\XRSHFID.exe
  C:\Windows\System\XRSHFID.exe
  2⤵
  PID:12504
- C:\Windows\System\dAfxsSw.exe
  C:\Windows\System\dAfxsSw.exe
  2⤵
  PID:13180
- C:\Windows\System\ZIxSALs.exe
  C:\Windows\System\ZIxSALs.exe
  2⤵
  PID:12976
- C:\Windows\System\CwLSOtN.exe
  C:\Windows\System\CwLSOtN.exe
  2⤵
  PID:13328
- C:\Windows\System\FasJHTS.exe
  C:\Windows\System\FasJHTS.exe
  2⤵
  PID:13380
- C:\Windows\System\lkIXCuP.exe
  C:\Windows\System\lkIXCuP.exe
  2⤵
  PID:13400
- C:\Windows\System\DnIPhgB.exe
  C:\Windows\System\DnIPhgB.exe
  2⤵
  PID:13436
- C:\Windows\System\bLIRxqS.exe
  C:\Windows\System\bLIRxqS.exe
  2⤵
  PID:13460
- C:\Windows\System\gUaNLQl.exe
  C:\Windows\System\gUaNLQl.exe
  2⤵
  PID:13504
- C:\Windows\System\xSSljJA.exe
  C:\Windows\System\xSSljJA.exe
  2⤵
  PID:13544
- C:\Windows\System\PcEqMnJ.exe
  C:\Windows\System\PcEqMnJ.exe
  2⤵
  PID:13584
- C:\Windows\System\zQXLxLK.exe
  C:\Windows\System\zQXLxLK.exe
  2⤵
  PID:13600
- C:\Windows\System\DoNFPXO.exe
  C:\Windows\System\DoNFPXO.exe
  2⤵
  PID:13636
- C:\Windows\System\QNfnTOf.exe
  C:\Windows\System\QNfnTOf.exe
  2⤵
  PID:13676
- C:\Windows\System\Dshrpqc.exe
  C:\Windows\System\Dshrpqc.exe
  2⤵
  PID:13704
- C:\Windows\System\SMMCxIX.exe
  C:\Windows\System\SMMCxIX.exe
  2⤵
  PID:13744
- C:\Windows\System\oUnRLtH.exe
  C:\Windows\System\oUnRLtH.exe
  2⤵
  PID:13768
- C:\Windows\System\tumEoBD.exe
  C:\Windows\System\tumEoBD.exe
  2⤵
  PID:13792
- C:\Windows\System\MJNThPH.exe
  C:\Windows\System\MJNThPH.exe
  2⤵
  PID:13808
- C:\Windows\System\XxUWLHP.exe
  C:\Windows\System\XxUWLHP.exe
  2⤵
  PID:13832
- C:\Windows\System\cQfXhXv.exe
  C:\Windows\System\cQfXhXv.exe
  2⤵
  PID:13868
- C:\Windows\System\JYrZAZB.exe
  C:\Windows\System\JYrZAZB.exe
  2⤵
  PID:13904
- C:\Windows\System\IrGzfXL.exe
  C:\Windows\System\IrGzfXL.exe
  2⤵
  PID:13924
- C:\Windows\System\isxQKrO.exe
  C:\Windows\System\isxQKrO.exe
  2⤵
  PID:13944
- C:\Windows\System\CahFRNO.exe
  C:\Windows\System\CahFRNO.exe
  2⤵
  PID:14004
- C:\Windows\System\UeupKTR.exe
  C:\Windows\System\UeupKTR.exe
  2⤵
  PID:14036
- C:\Windows\System\eDAfild.exe
  C:\Windows\System\eDAfild.exe
  2⤵
  PID:14060
- C:\Windows\System\hGSOuAj.exe
  C:\Windows\System\hGSOuAj.exe
  2⤵
  PID:14084
- C:\Windows\System\ZGHggJy.exe
  C:\Windows\System\ZGHggJy.exe
  2⤵
  PID:14120
- C:\Windows\System\pNqhZKr.exe
  C:\Windows\System\pNqhZKr.exe
  2⤵
  PID:14144
- C:\Windows\System\HAqGvPF.exe
  C:\Windows\System\HAqGvPF.exe
  2⤵
  PID:14176
- C:\Windows\System\ohAsLaU.exe
  C:\Windows\System\ohAsLaU.exe
  2⤵
  PID:14204
- C:\Windows\System\gYvcfqw.exe
  C:\Windows\System\gYvcfqw.exe
  2⤵
  PID:14232
- C:\Windows\System\vAqlJve.exe
  C:\Windows\System\vAqlJve.exe
  2⤵
  PID:14256
- C:\Windows\System\IHiRiHL.exe
  C:\Windows\System\IHiRiHL.exe
  2⤵
  PID:14292
- C:\Windows\System\TQmnptZ.exe
  C:\Windows\System\TQmnptZ.exe
  2⤵
  PID:14316
- C:\Windows\System\UpXZagL.exe
  C:\Windows\System\UpXZagL.exe
  2⤵
  PID:14332
- C:\Windows\System\qkqNWQy.exe
  C:\Windows\System\qkqNWQy.exe
  2⤵
  PID:13356
- C:\Windows\System\INUAXJi.exe
  C:\Windows\System\INUAXJi.exe
  2⤵
  PID:13488
- C:\Windows\System\azSrttJ.exe
  C:\Windows\System\azSrttJ.exe
  2⤵
  PID:13536
- C:\Windows\System\KQrRwAL.exe
  C:\Windows\System\KQrRwAL.exe
  2⤵
  PID:13720
- C:\Windows\System\LRhYyRm.exe
  C:\Windows\System\LRhYyRm.exe
  2⤵
  PID:13696
- C:\Windows\System\AsJmKql.exe
  C:\Windows\System\AsJmKql.exe
  2⤵
  PID:13848
- C:\Windows\System\PCulkAx.exe
  C:\Windows\System\PCulkAx.exe
  2⤵
  PID:13932
- C:\Windows\System\FKPJVyr.exe
  C:\Windows\System\FKPJVyr.exe
  2⤵
  PID:13964
- C:\Windows\System\yaZzZKs.exe
  C:\Windows\System\yaZzZKs.exe
  2⤵
  PID:14044
- C:\Windows\System\tgzpwIL.exe
  C:\Windows\System\tgzpwIL.exe
  2⤵
  PID:14104
- C:\Windows\System\XGVmCjF.exe
  C:\Windows\System\XGVmCjF.exe
  2⤵
  PID:14188
- C:\Windows\System\ZeZKwet.exe
  C:\Windows\System\ZeZKwet.exe
  2⤵
  PID:14220
- C:\Windows\System\VrGBJYS.exe
  C:\Windows\System\VrGBJYS.exe
  2⤵
  PID:14224
- C:\Windows\System\FMxhUyh.exe
  C:\Windows\System\FMxhUyh.exe
  2⤵
  PID:2936
- C:\Windows\System\BtkkkDQ.exe
  C:\Windows\System\BtkkkDQ.exe
  2⤵
  PID:13028
- C:\Windows\System\fnPYjVb.exe
  C:\Windows\System\fnPYjVb.exe
  2⤵
  PID:13624
- C:\Windows\System\vJIBsui.exe
  C:\Windows\System\vJIBsui.exe
  2⤵
  PID:13820
- C:\Windows\System\cOIPrrq.exe
  C:\Windows\System\cOIPrrq.exe
  2⤵
  PID:13992
- C:\Windows\System\EVEvrRe.exe
  C:\Windows\System\EVEvrRe.exe
  2⤵
  PID:14072
- C:\Windows\System\ImHroOW.exe
  C:\Windows\System\ImHroOW.exe
  2⤵
  PID:14216
- C:\Windows\System\LvxVVZT.exe
  C:\Windows\System\LvxVVZT.exe
  2⤵
  PID:5016
- C:\Windows\System\ocvGfNT.exe
  C:\Windows\System\ocvGfNT.exe
  2⤵
  PID:13880
- C:\Windows\System\arbyEKn.exe
  C:\Windows\System\arbyEKn.exe
  2⤵
  PID:14264
- C:\Windows\System\EUCImhs.exe
  C:\Windows\System\EUCImhs.exe
  2⤵
  PID:13788
- C:\Windows\System\dxTzfHD.exe
  C:\Windows\System\dxTzfHD.exe
  2⤵
  PID:928
- C:\Windows\System\BgLRAff.exe
  C:\Windows\System\BgLRAff.exe
  2⤵
  PID:14364
- C:\Windows\System\XmdbrMX.exe
  C:\Windows\System\XmdbrMX.exe
  2⤵
  PID:14384
- C:\Windows\System\hvGUqKK.exe
  C:\Windows\System\hvGUqKK.exe
  2⤵
  PID:14420
- C:\Windows\System\byoMvWv.exe
  C:\Windows\System\byoMvWv.exe
  2⤵
  PID:14436
- C:\Windows\System\lzrZDYW.exe
  C:\Windows\System\lzrZDYW.exe
  2⤵
  PID:14484
- C:\Windows\System\celPIhz.exe
  C:\Windows\System\celPIhz.exe
  2⤵
  PID:14504
- C:\Windows\System\FAVOgvN.exe
  C:\Windows\System\FAVOgvN.exe
  2⤵
  PID:14540
- C:\Windows\System\Wmlouve.exe
  C:\Windows\System\Wmlouve.exe
  2⤵
  PID:14568
- C:\Windows\System\YMVvqyE.exe
  C:\Windows\System\YMVvqyE.exe
  2⤵
  PID:14584
- C:\Windows\System\qVQyWvd.exe
  C:\Windows\System\qVQyWvd.exe
  2⤵
  PID:14604
- C:\Windows\System\TnVcMhL.exe
  C:\Windows\System\TnVcMhL.exe
  2⤵
  PID:14656
- C:\Windows\System\ABQSBnB.exe
  C:\Windows\System\ABQSBnB.exe
  2⤵
  PID:14672
- C:\Windows\System\cfuBXRv.exe
  C:\Windows\System\cfuBXRv.exe
  2⤵
  PID:14700
- C:\Windows\System\pBQNkSn.exe
  C:\Windows\System\pBQNkSn.exe
  2⤵
  PID:14740
- C:\Windows\System\pEFXKXA.exe
  C:\Windows\System\pEFXKXA.exe
  2⤵
  PID:14764
- C:\Windows\System\UKNTksD.exe
  C:\Windows\System\UKNTksD.exe
  2⤵
  PID:14788
- C:\Windows\System\NlgmBTd.exe
  C:\Windows\System\NlgmBTd.exe
  2⤵
  PID:14828
- C:\Windows\System\CMhbZVr.exe
  C:\Windows\System\CMhbZVr.exe
  2⤵
  PID:14856
- C:\Windows\System\FBnBAAL.exe
  C:\Windows\System\FBnBAAL.exe
  2⤵
  PID:14872
- C:\Windows\System\qYevivn.exe
  C:\Windows\System\qYevivn.exe
  2⤵
  PID:14912
- C:\Windows\System\nGXuomK.exe
  C:\Windows\System\nGXuomK.exe
  2⤵
  PID:14940
- C:\Windows\System\LBmUbnZ.exe
  C:\Windows\System\LBmUbnZ.exe
  2⤵
  PID:14956
- C:\Windows\System\ZRiUBAt.exe
  C:\Windows\System\ZRiUBAt.exe
  2⤵
  PID:15000
- C:\Windows\System\ActZohI.exe
  C:\Windows\System\ActZohI.exe
  2⤵
  PID:15064
- C:\Windows\System\zXncqwt.exe
  C:\Windows\System\zXncqwt.exe
  2⤵
  PID:15216
- C:\Windows\System\JFNJByL.exe
  C:\Windows\System\JFNJByL.exe
  2⤵
  PID:15232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3812,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
1⤵
PID:6192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BPjWNpe.exe

Filesize
2.3MB

MD5
99dec938788b174d2109f1023e332837

SHA1
a52c21708b91ca910da14b8e917c3e4515bc8dca

SHA256
93f72c2800c2134a2dd131b98be4c85c68ed52a4ff6e903abb804251c24c1acf

SHA512
4460b4cc132f400a43637e1fc5ef842e1dc6c69a0ef5305220d269143774c39da91c468f902eef93ceceb420e0c6d71e999777317948c2d07ddc101198cf1003

Download Submit
C:\Windows\System\CmyWFPG.exe

Filesize
2.3MB

MD5
eb446a5c659f238ed3d15bd78b09e756

SHA1
619722faee259a7cb69d4c7409f7c7b21e034806

SHA256
a4ee4e57fbc7259d9aa40e8230cfa290a5571d99c7399ccaafed0230d4924a2a

SHA512
75af4e814a9a3ca3df02b58ca7fbad3417767148e515794d9a251af9d984ddbcd21400be1b002098581b0c9b9e9c9a878de6801a270f13bbfe09498e41543adc

Download Submit
C:\Windows\System\EBDasNJ.exe

Filesize
2.3MB

MD5
e596567d8c53906ab0c67e71d233e198

SHA1
1f457a8cd93c85c2269717b7e475f1a5700784e7

SHA256
70941b9a5fd41be0ed46b019cf980b6300de3eeb1783640d3026e5e9b4200982

SHA512
8274e3bb86805817bd563e2617804384d0bcace00469ad1207b5069b3848fff721851997308dbcaab294df6d80958254438b8fbc2cce71c4b5deb236aa80783b

Download Submit
C:\Windows\System\FQMXuke.exe

Filesize
2.3MB

MD5
aa15a052e61e0df606281abdb8a3fef1

SHA1
8303bf3b7848d5c2f636a05aa25964b5eba9bd7a

SHA256
9946e136eb8c205e76826e59b608a2d06e39b60be5269f71404822fb09ac3de8

SHA512
9ab437091bcc5ecc49cfdf9a5da2389825e6d3daec6f054bb556f6811f8abc01f50ead676f621130d2900c0d13b3aa9fe707f9c2d45162e1a6cdfae3e9e4d80d

Download Submit
C:\Windows\System\MbICJGW.exe

Filesize
2.3MB

MD5
576f2702548ca7607cc843a3469fdcf1

SHA1
fe0834a3f3f75e6301c49525b8f494a68bad821b

SHA256
84a0206de08e01dbc918fc8c1f1497eb3eea762c2cadfb129fb1399738c86f5e

SHA512
f357dc63db44290e12619b9415ebf00aa9d01869c4ec9a2f2f428c5f65618921590b24926f9392b043efa94a8174e602045eb843f8b85acd78d390f11a1587e5

Download Submit
C:\Windows\System\NGPzMop.exe

Filesize
2.3MB

MD5
8fdd9723c86d17dbc53ef23c623b25b3

SHA1
3e2c297480e66286f71d21a4a0d248f72d783949

SHA256
223580844dbbbb9c22eb7b597258668124f65ad9a4d3f58af4bbc29ef692ad0a

SHA512
0656e5dcd90dd08b9dd670672106db2af780f785a9821ba974eb7a1fee7d482c217856a4f846f044d7d1725b07fc960d8d80611b764f581faf2d553d64d2e7ce

Download Submit
C:\Windows\System\NKPdrgS.exe

Filesize
2.3MB

MD5
f912df695c6ff6a641560ad4a3882be4

SHA1
cc20355f12ad69da3d96b073b373ac54c0a56c6d

SHA256
5c299f9ca7f58443fff8530016245104d3f826c1cb2129f28610eb62ed0ff55b

SHA512
232eb98ee1afe48be0d63002016c43c844e917af8cc69d785e4fc9ca3cc849b156616ee7c7982d9334a5e3da1f3e8cc9b7dd95a3f453a9684c8c9d89f6512012

Download Submit
C:\Windows\System\QEBKBeH.exe

Filesize
2.3MB

MD5
34addc931d5960d299d5fdecf216b670

SHA1
642928e8ec49bbfd72978059084ad9413bb5b765

SHA256
29c14bde30abf3f53b4f224ebea6b9bc77f5259af64156d4815702ad7555fac8

SHA512
8710c2af9068a575abe731934c1a616d03021f04683bd4456a76ebfdff01d640f2972a1d27e386c487ea9bda7f1fb660ea3a5732ccd96c4133b27b72319dcc0b

Download Submit
C:\Windows\System\QSDATuN.exe

Filesize
2.3MB

MD5
df6470401e19e8f544b18c562918fe02

SHA1
78dfe5fb90691a4dffc3126bbde56adf92681902

SHA256
e19abff7a9e792c2682409d711937b09e78b71797603c29cf03f2698ceda6270

SHA512
f4a35ced80628101b61dbf46eccc44fc1808378500cbc1b9ce99764773398c67cd02450dd98a486fadd98413de087c83d6ec8e8ec4bac5966342be96a2433ddf

Download Submit
C:\Windows\System\QmETcjL.exe

Filesize
2.3MB

MD5
82dae7f4a83541920e18b8ad10dd6c21

SHA1
53dca0d4fb4aca92d32cf1247c860768d81f3fa8

SHA256
10dd7498ca176f738adadfa0a6692955a664b46ef382a30b3a8430224845b92c

SHA512
23b01d51a85307d4ae885037edccc12c47f4fa09832d73dd7b2fa995d7a7a0a4d8d3e105600dd4bda617c40723cf693280232c57140567f73cfeb1f2fb1f890a

Download Submit
C:\Windows\System\QzkQzec.exe

Filesize
2.3MB

MD5
eedcf9c18dbd2197c54ef3793f6ae9c6

SHA1
8f91b0e1e273366f8c27299577b63b1f2666ca98

SHA256
28ed173f8798d23391b8798be2bcde0a7e1ce3e9384768b6fa34b5d0a5a97f83

SHA512
4235324feb78d370fa1272b0307e79b8b5e081eff1902ad0b7cc48f4bc83af0a9518b8fa4859779fa15b3dc8831d7b26409525d99e9e68b52f515b3134cbb8cb

Download Submit
C:\Windows\System\SAfTwYy.exe

Filesize
2.3MB

MD5
6efe2d28bdc5a6752af62f5d7d4767cb

SHA1
1a6efc77e5b4c3e483d73c6b246d333494851928

SHA256
e3b6ec0c767372a7d0836a0cd8ac4f29c3db17976356a71744030c5011b7f25d

SHA512
10864e0532f73caad9692550749ac122f3ddfb5bc2ac4d894a0555ae057a17647a1b49daa7c5ed56f5395d8d987fcc173ceea94f32c8fb2e932902c822bcbc4e

Download Submit
C:\Windows\System\WCVLYCw.exe

Filesize
2.3MB

MD5
8d4ad6ac132f36483b3af803eaaf674b

SHA1
beef8278e9812e620c5b43f9843ec97b21c0c6f1

SHA256
b91a1daa8ffb4ee268886b56ff044a2348b5a812aa2326189f9394c3b0e15135

SHA512
3bacbac604eb267911feab66b8bb0221922e8fe695d8a0b34aa0be4f67ec12305bb42642a58d1db2ed7b572c008814ed76a98ae23ed4dd66e4cc34aa1a007772

Download Submit
C:\Windows\System\WlfClib.exe

Filesize
2.3MB

MD5
5422818703e3e1e7a5e96351f9396792

SHA1
b72570a895f53ad95522f86c5852a207f7fe776b

SHA256
ed01dd467ef2b1edecbd6317d1a8cc1546d852e01948cc86e20110c189e45873

SHA512
86cebbbf64e0adc7ca1a05662a4db038ce74072afd2a4c4b13e1ce4dafb791828548ec73a78717fbd220e637020711f8b11f9e90498ee773658fd80ea114e943

Download Submit
C:\Windows\System\YdfmGJM.exe

Filesize
2.3MB

MD5
702d59eaf11b79b8c66740660ea2211f

SHA1
e5f385a5f12f356d3d745719b659d26978e9007a

SHA256
9e9c7dfcd889ca21e6fbbeba948f97ee74019f3235c33437ae747cc8369e5af2

SHA512
ee95366396dee6f77fa31441ef8e06d7d7d322d6c811725b4b4f37a7b83a7f7c936ad4fe6b7ff58287a9d2fb1ed653d5a8dbe5c14ca3467dbcf9503b72dd4ffd

Download Submit
C:\Windows\System\ZGYpyme.exe

Filesize
2.3MB

MD5
b9b44a10d6e1ea25ebfdfb79d7a8b3aa

SHA1
92058b9d4b89871b1e8755d68a51d3e96625d5c1

SHA256
34c84080442d215aaa1f442a1f27b188dde1d300c5175d8a623f80aa6314e83c

SHA512
c341a61e6fb590f7c80accf0769c53fe4d7e1b2cf266bdaffe3fe61a6dcd2262bf1c541c50782daba8f6dcad1c7ac78377639f5c78e8f3db032e75df366b2498

Download Submit
C:\Windows\System\ZPHwurK.exe

Filesize
2.3MB

MD5
891ee1ad29987e74ab62904ebea21304

SHA1
e7364c1ab78fe4211a3c422b0d7d03ffb9170529

SHA256
6850bca4e7f9756a5b37ade0bcb0df4204cf7e0e673d5b1ab7189d0c21a03128

SHA512
5030c80c535f49ce0eeda4859822761596d02f672119a235b1054d470631464ced35387c019208a2c2c4ad407865c1f8e982717882b498b63cdb64f939976408

Download Submit
C:\Windows\System\ZydIMSR.exe

Filesize
2.3MB

MD5
9201d3bc921ac5595f88a0e3985c7f56

SHA1
8823fceb2e666e7da228b9d079afb95cda34304b

SHA256
e0110ba363e02f38100388ec089a0dd63d0bc3b835c45daf54341d7eaaf66674

SHA512
7dbd7b959387d707f80c8d244987c057321950e5d33a6e7d3ea844e50c93c705bb777ba5ff6aba8c93e67a7182a854e63d794ae3cd40c2f529de4c03ee9c7323

Download Submit
C:\Windows\System\aXGJRia.exe

Filesize
2.3MB

MD5
fc7c776e25184d360ec60c0889bebd1b

SHA1
ea5f65fa02ed6529efd072a1d1e042cc66094b64

SHA256
521d4cc1e466eec1f0db121965e527356dc0f86963415b1b5761a1ae35d6875a

SHA512
75e5083730191b82d4baacf4f439059993d63aac7978ffbfced57a27e22606ffb12513eac598e5b1686738d5ca5e57fb085bf6ce4a6c132e3442a3e5ecbc835e

Download Submit
C:\Windows\System\apmfCRD.exe

Filesize
2.3MB

MD5
33f383bbad89de3ef0dd63b745f5968b

SHA1
4ba60d4cfe2709eaf386227fb487ba9575978e05

SHA256
f1b111fd23aed379f05273fff1a5810a69a88d65f9e710f750f038389338731b

SHA512
a04200597f8be50045c8ad2ce95220c34c47f1c406b0b455e64ae466d069ed13dc1ae9e9925b18c6f5a4ff6ce91a5fcdab4f0c2925d154492093ea44acc78360

Download Submit
C:\Windows\System\fAhTAAS.exe

Filesize
2.3MB

MD5
8a8b81dc1665986329f0f14fa9987c18

SHA1
993cf2389652a063c778305d2525a17695d61dc7

SHA256
dfcb38c81694106808437e14a0c97629f1c586c3aa6bd0be7a6041b816ec0cbc

SHA512
2478087c557000e92b9ff366dc09eeac2e740d43984b5e94205b7ae89becd2efe367f7d9c0bcf97823529399dabb7c856c6fbac9f313423bbc6a0b6dfa9c2910

Download Submit
C:\Windows\System\fkmZUha.exe

Filesize
2.3MB

MD5
54e9e5eeba4f43579ff7f4c07e9ed8dc

SHA1
a79bafaa809e18e9ff93f75a0bbe2c91bb11bb90

SHA256
f712cc5bc2d2980e5864cdeffa59077f7cf65f02ad4736cde189523e4673f6ad

SHA512
e5a3f39a1fdd054e83d3eae00d498010b19f1e119497542cb308cde9bf73421a02267e24123c711c6cc633a1fca4132db5249fa08da2379fab9157b63a00d69e

Download Submit
C:\Windows\System\gJxOOAu.exe

Filesize
2.3MB

MD5
857ed68343502dbd207fe5f930cca99f

SHA1
87efc44d9cbf085f952fac995b9185000829a294

SHA256
c675140bfeb9eaeeaa90ef4ddde05034b375409e044f575001f2dfb96f49c1ef

SHA512
1757b40e16d40c6e91a546dc1a15d2833b1a9f93748f5bdf32c5ec564348f8320a1abf0d9eb6298939e0e4a4cf870652784254063d839452429410ec48fe1483

Download Submit
C:\Windows\System\geheuIU.exe

Filesize
2.3MB

MD5
fe2a3e85cc4aec67a4f8f0e7665318b4

SHA1
e62b81ecf9cbef1792fbe798bd58f2e02dc822c4

SHA256
8099f66e9d4331d8ca51c62d142a32cadc918846cc54b1dfed2a15f40d94c076

SHA512
cd1afa5d9e31fab4b417ed34921429a024b87523a9edf0ec8e0b44d05a122d5a6bf8449a2a1151b8ac88a32fff5c528437e2b4aed31c668f3d9978db9b24d788

Download Submit
C:\Windows\System\jwnpiJJ.exe

Filesize
2.3MB

MD5
5259ba538a095c15457c544daad7edde

SHA1
20edb876498fda678b51de7694afd099d72bff7e

SHA256
ac08b7721d1c826d61015d431c74f193ad62e87a60ac803f0f733c376bc8acfa

SHA512
5a14781d9250c946a36732a6ae7edfe38f2670d6334f66fbe9aed68325a4b7d6a8455599852ee715747134f60abf6cc4d8053db23b786ddd6bf28f9f07b4026a

Download Submit
C:\Windows\System\kziCcHS.exe

Filesize
2.3MB

MD5
b4efa65a5d8cd59824f7209ed92a3bbb

SHA1
a8c1edc44271a817909058e91961d3043bdfc861

SHA256
e8e650f1a595c45987f855290aeacd3d8fd0485976798a0d028e9ec43bcfc2fd

SHA512
3cbc3e7230d03216783b52b6b6414d4d07aa5988bf9a46561d1425154b2ff011e04a2175ba93d4e3ef9cc58de3fa3eb06577e2faf7b131870b159fd3f46985b1

Download Submit
C:\Windows\System\lgSNtfr.exe

Filesize
2.3MB

MD5
ab0ed02f229ef3c40d03031fe0432105

SHA1
2884761731c576696d9790927c7c64718c17ca05

SHA256
ab6de532d1d232954000be9396c144ea9ce15932e1136dd3e6cae859ff90201b

SHA512
c450b7c9908925fcb2b44a69cc7e828d9718865a9f60a0de3e32ff211c1e7d5bf5c6bd3b96f298d6e504f6ee502341b35fa38f58bbb8134ebb2835a31d5c214d

Download Submit
C:\Windows\System\oCcMZTu.exe

Filesize
2.3MB

MD5
314cb64338bc395024cc23ae79519651

SHA1
2e399695bf07609f26d520493d4a856280393fea

SHA256
c90bcd09d41167393cfedc9f05c7e7310e901701c68f23b71dcb215e91a612f1

SHA512
f47984099a033e97e629add35998df8ce73c026ee7102a3e0b331c7c5d29dcda224ab5686749117ee0daa60cb5d8656962ff11ba745ce4c35ee1a78a7f79755a

Download Submit
C:\Windows\System\pWpDpkD.exe

Filesize
2.3MB

MD5
9210fb17b5a6177059ebf7fe9a7d11ca

SHA1
ae20f5bb5a4be75b3397f4e83687edb3415ba531

SHA256
b9782233b17e6eb5eeef3af05fe8afe2d8991e6456b21e32fb9101661b6a7d8a

SHA512
7f2eb30019ce363db9198e0ca231451835df45c63608a28509061662a3dbb7ffb36a40667e11b35913bb95021334c741f1f63bb73d1162c62be43dff82bdfd56

Download Submit
C:\Windows\System\qfJirHQ.exe

Filesize
2.3MB

MD5
448bb983c502cb426e8add8bbcded44d

SHA1
b0ab172ee064b7a06da6e9ae019e3cf3b1d388a8

SHA256
2031377c8e1a2e98115e06fe0fadb914e05ff0fc82b278e4d4b6a9096a8adc21

SHA512
246c87f63cfcdbb39dd4f43e0296d1def72c0764f77c3289827e4e54f3eada88eebb7bc0f0677707c40a6225cf34166348c2367f3ac0f265afffb29b28333184

Download Submit
C:\Windows\System\vQBsPiF.exe

Filesize
2.3MB

MD5
820410cc360feaa0946d909643edc953

SHA1
d306f1b33fc27f78d48d707ee53baa9dd971173b

SHA256
df10551baae35bd6d66c31315491ef123578628fa9e2fdfec06b232ff3b26e9b

SHA512
e8c1ef62d63542c0ac6d51f379c0c3d50a1bf676b7cfb65200552699111f00e77ac1db76e759838dc781c6cd71b3a3181a5e895720e58a22dc445e0db541848a

Download Submit
C:\Windows\System\veyLpvj.exe

Filesize
2.3MB

MD5
d4134a8786af077a2a7639a1ab6d11ee

SHA1
fc98307e0d64dd6582e674d2c2d004964e8c969a

SHA256
4bad62efebf19a0f041d03b5f28cfce82b19bfd89b7ffcc6101167e723b9b955

SHA512
9219e81a88c7297c37165cc114fea83500914aab844c52ab1d7d4b9e65c21dedd0d38a8f8e00054dcd49fe54da0d1c17e45f77376b97bd6d07a207dae87c1654

Download Submit
C:\Windows\System\zmmEbSZ.exe

Filesize
2.3MB

MD5
ddeabc4a30aca188415a006d9d5499fa

SHA1
9052179539fb97b538e8d375dee6b521d3a49e93

SHA256
f80af59b58f55a68d33cf53db47f56bbb64879e7a675619472e165486525ff4d

SHA512
cb19500ff15682ac9e189ec33a0559c038a0bb126ee6680f3ecc4a7193d05c392ab041092e110f8d4ed927625d69ee80b6206cf373dd3aba7e35fa3c2d5a8d68

Download Submit
memory/60-662-0x00007FF731BE0000-0x00007FF731F34000-memory.dmp

Filesize
3.3MB

Download
memory/60-2165-0x00007FF731BE0000-0x00007FF731F34000-memory.dmp

Filesize
3.3MB

Download
memory/732-2152-0x00007FF6A1480000-0x00007FF6A17D4000-memory.dmp

Filesize
3.3MB

Download
memory/732-688-0x00007FF6A1480000-0x00007FF6A17D4000-memory.dmp

Filesize
3.3MB

Download
memory/880-2164-0x00007FF6811B0000-0x00007FF681504000-memory.dmp

Filesize
3.3MB

Download
memory/880-672-0x00007FF6811B0000-0x00007FF681504000-memory.dmp

Filesize
3.3MB

Download
memory/1188-2162-0x00007FF7E4380000-0x00007FF7E46D4000-memory.dmp

Filesize
3.3MB

Download
memory/1188-683-0x00007FF7E4380000-0x00007FF7E46D4000-memory.dmp

Filesize
3.3MB

Download
memory/1220-1558-0x00007FF761E60000-0x00007FF7621B4000-memory.dmp

Filesize
3.3MB

Download
memory/1220-14-0x00007FF761E60000-0x00007FF7621B4000-memory.dmp

Filesize
3.3MB

Download
memory/1220-2142-0x00007FF761E60000-0x00007FF7621B4000-memory.dmp

Filesize
3.3MB

Download
memory/1316-2148-0x00007FF7CFEC0000-0x00007FF7D0214000-memory.dmp

Filesize
3.3MB

Download
memory/1316-64-0x00007FF7CFEC0000-0x00007FF7D0214000-memory.dmp

Filesize
3.3MB

Download
memory/1472-2159-0x00007FF6764D0000-0x00007FF676824000-memory.dmp

Filesize
3.3MB

Download
memory/1472-627-0x00007FF6764D0000-0x00007FF676824000-memory.dmp

Filesize
3.3MB

Download
memory/1600-2167-0x00007FF737190000-0x00007FF7374E4000-memory.dmp

Filesize
3.3MB

Download
memory/1600-646-0x00007FF737190000-0x00007FF7374E4000-memory.dmp

Filesize
3.3MB

Download
memory/1604-2150-0x00007FF7E7650000-0x00007FF7E79A4000-memory.dmp

Filesize
3.3MB

Download
memory/1604-84-0x00007FF7E7650000-0x00007FF7E79A4000-memory.dmp

Filesize
3.3MB

Download
memory/1696-2154-0x00007FF751310000-0x00007FF751664000-memory.dmp

Filesize
3.3MB

Download
memory/1696-609-0x00007FF751310000-0x00007FF751664000-memory.dmp

Filesize
3.3MB

Download
memory/1948-614-0x00007FF623B20000-0x00007FF623E74000-memory.dmp

Filesize
3.3MB

Download
memory/1948-2156-0x00007FF623B20000-0x00007FF623E74000-memory.dmp

Filesize
3.3MB

Download
memory/2104-42-0x00007FF6192B0000-0x00007FF619604000-memory.dmp

Filesize
3.3MB

Download
memory/2104-2146-0x00007FF6192B0000-0x00007FF619604000-memory.dmp

Filesize
3.3MB

Download
memory/2104-2137-0x00007FF6192B0000-0x00007FF619604000-memory.dmp

Filesize
3.3MB

Download
memory/2160-635-0x00007FF6D8C50000-0x00007FF6D8FA4000-memory.dmp

Filesize
3.3MB

Download
memory/2160-2161-0x00007FF6D8C50000-0x00007FF6D8FA4000-memory.dmp

Filesize
3.3MB

Download
memory/2200-2145-0x00007FF72EC20000-0x00007FF72EF74000-memory.dmp

Filesize
3.3MB

Download
memory/2200-1952-0x00007FF72EC20000-0x00007FF72EF74000-memory.dmp

Filesize
3.3MB

Download
memory/2200-39-0x00007FF72EC20000-0x00007FF72EF74000-memory.dmp

Filesize
3.3MB

Download
memory/2388-73-0x00007FF614710000-0x00007FF614A64000-memory.dmp

Filesize
3.3MB

Download
memory/2388-2149-0x00007FF614710000-0x00007FF614A64000-memory.dmp

Filesize
3.3MB

Download
memory/2452-26-0x00007FF70AB90000-0x00007FF70AEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2452-2143-0x00007FF70AB90000-0x00007FF70AEE4000-memory.dmp

Filesize
3.3MB

Download
memory/3060-2147-0x00007FF619820000-0x00007FF619B74000-memory.dmp

Filesize
3.3MB

Download
memory/3060-2138-0x00007FF619820000-0x00007FF619B74000-memory.dmp

Filesize
3.3MB

Download
memory/3060-55-0x00007FF619820000-0x00007FF619B74000-memory.dmp

Filesize
3.3MB

Download
memory/3076-77-0x00007FF6981A0000-0x00007FF6984F4000-memory.dmp

Filesize
3.3MB

Download
memory/3076-2139-0x00007FF6981A0000-0x00007FF6984F4000-memory.dmp

Filesize
3.3MB

Download
memory/3076-2153-0x00007FF6981A0000-0x00007FF6984F4000-memory.dmp

Filesize
3.3MB

Download
memory/3564-619-0x00007FF6DE3D0000-0x00007FF6DE724000-memory.dmp

Filesize
3.3MB

Download
memory/3564-2157-0x00007FF6DE3D0000-0x00007FF6DE724000-memory.dmp

Filesize
3.3MB

Download
memory/3676-623-0x00007FF790770000-0x00007FF790AC4000-memory.dmp

Filesize
3.3MB

Download
memory/3676-2158-0x00007FF790770000-0x00007FF790AC4000-memory.dmp

Filesize
3.3MB

Download
memory/3968-2163-0x00007FF748B80000-0x00007FF748ED4000-memory.dmp

Filesize
3.3MB

Download
memory/3968-675-0x00007FF748B80000-0x00007FF748ED4000-memory.dmp

Filesize
3.3MB

Download
memory/4068-2166-0x00007FF740870000-0x00007FF740BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4068-654-0x00007FF740870000-0x00007FF740BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4292-2160-0x00007FF7F7ED0000-0x00007FF7F8224000-memory.dmp

Filesize
3.3MB

Download
memory/4292-630-0x00007FF7F7ED0000-0x00007FF7F8224000-memory.dmp

Filesize
3.3MB

Download
memory/4536-2144-0x00007FF798790000-0x00007FF798AE4000-memory.dmp

Filesize
3.3MB

Download
memory/4536-35-0x00007FF798790000-0x00007FF798AE4000-memory.dmp

Filesize
3.3MB

Download
memory/4796-1120-0x00007FF7DEEE0000-0x00007FF7DF234000-memory.dmp

Filesize
3.3MB

Download
memory/4796-2140-0x00007FF7DEEE0000-0x00007FF7DF234000-memory.dmp

Filesize
3.3MB

Download
memory/4796-10-0x00007FF7DEEE0000-0x00007FF7DF234000-memory.dmp

Filesize
3.3MB

Download
memory/4876-2151-0x00007FF6215B0000-0x00007FF621904000-memory.dmp

Filesize
3.3MB

Download
memory/4876-695-0x00007FF6215B0000-0x00007FF621904000-memory.dmp

Filesize
3.3MB

Download
memory/4896-640-0x00007FF796C60000-0x00007FF796FB4000-memory.dmp

Filesize
3.3MB

Download
memory/4896-2168-0x00007FF796C60000-0x00007FF796FB4000-memory.dmp

Filesize
3.3MB

Download
memory/5052-2155-0x00007FF67B450000-0x00007FF67B7A4000-memory.dmp

Filesize
3.3MB

Download
memory/5052-604-0x00007FF67B450000-0x00007FF67B7A4000-memory.dmp

Filesize
3.3MB

Download
memory/5092-18-0x00007FF669FA0000-0x00007FF66A2F4000-memory.dmp

Filesize
3.3MB

Download
memory/5092-1559-0x00007FF669FA0000-0x00007FF66A2F4000-memory.dmp

Filesize
3.3MB

Download
memory/5092-2141-0x00007FF669FA0000-0x00007FF66A2F4000-memory.dmp

Filesize
3.3MB

Download
memory/5100-0-0x00007FF711610000-0x00007FF711964000-memory.dmp

Filesize
3.3MB

Download
memory/5100-1117-0x00007FF711610000-0x00007FF711964000-memory.dmp

Filesize
3.3MB

Download
memory/5100-1-0x0000024862880000-0x0000024862890000-memory.dmp

Filesize
64KB

Download