xmrig | bf964312fec5174a665fab7db69e0ea6989f16344cb911fe9dddcafd82b61d84

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
Size 2.3MB
Sample240522-2kx8msbf4y
SHA256 bf964312fec5174a665fab7db69e0ea6989f16344cb911fe9dddcafd82b61d84
MD5 4e3d8efe3e5cbefd593a132be02a2450
SHA1 0ce2847eb086e295ee0898e5dce53191154cd24c
SHA512 2e1be55ccf5bb1acc27ecf96201092116238b969e3ba9a31aa6a1642504d2e74dfdfb34f50d89a284ff5d3e0a95d5f2d6dcb9fe5e2ac34345a82f4daa29dfb3c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZ4:BemTLkNdfE0pZrQk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2068-0-0x00007FF64C5D0000-0x00007FF64C924000-memory.dmp	xmrig
behavioral2/files/0x0008000000023414-5.dat	xmrig
behavioral2/memory/3704-8-0x00007FF7D4900000-0x00007FF7D4C54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-7.dat	xmrig
behavioral2/files/0x0007000000023418-12.dat	xmrig
behavioral2/files/0x000700000002341b-27.dat	xmrig
behavioral2/files/0x0007000000023421-57.dat	xmrig
behavioral2/files/0x0007000000023424-75.dat	xmrig
behavioral2/files/0x0007000000023427-89.dat	xmrig
behavioral2/files/0x000700000002342a-101.dat	xmrig
behavioral2/files/0x0007000000023432-145.dat	xmrig
behavioral2/files/0x0007000000023437-164.dat	xmrig
behavioral2/memory/3568-729-0x00007FF73CFD0000-0x00007FF73D324000-memory.dmp	xmrig
behavioral2/memory/1944-731-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp	xmrig
behavioral2/memory/984-732-0x00007FF6553B0000-0x00007FF655704000-memory.dmp	xmrig
behavioral2/memory/3356-730-0x00007FF6A7950000-0x00007FF6A7CA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023436-161.dat	xmrig
behavioral2/files/0x0007000000023435-159.dat	xmrig
behavioral2/files/0x0007000000023434-155.dat	xmrig
behavioral2/files/0x0007000000023433-149.dat	xmrig
behavioral2/files/0x0007000000023431-139.dat	xmrig
behavioral2/files/0x0007000000023430-135.dat	xmrig
behavioral2/files/0x000700000002342f-129.dat	xmrig
behavioral2/files/0x000700000002342e-125.dat	xmrig
behavioral2/files/0x000700000002342d-120.dat	xmrig
behavioral2/files/0x000700000002342c-115.dat	xmrig
behavioral2/files/0x000700000002342b-109.dat	xmrig
behavioral2/files/0x0007000000023429-99.dat	xmrig
behavioral2/files/0x0007000000023428-95.dat	xmrig
behavioral2/files/0x0007000000023426-85.dat	xmrig
behavioral2/files/0x0007000000023425-79.dat	xmrig
behavioral2/files/0x0007000000023423-69.dat	xmrig
behavioral2/files/0x0007000000023422-65.dat	xmrig
behavioral2/files/0x0007000000023420-54.dat	xmrig
behavioral2/files/0x000700000002341f-49.dat	xmrig
behavioral2/files/0x000700000002341e-42.dat	xmrig
behavioral2/files/0x000700000002341d-37.dat	xmrig
behavioral2/files/0x000700000002341c-32.dat	xmrig
behavioral2/files/0x000700000002341a-23.dat	xmrig
behavioral2/memory/4272-15-0x00007FF742920000-0x00007FF742C74000-memory.dmp	xmrig
behavioral2/memory/4892-733-0x00007FF7A98A0000-0x00007FF7A9BF4000-memory.dmp	xmrig
behavioral2/memory/1212-735-0x00007FF63D4E0000-0x00007FF63D834000-memory.dmp	xmrig
behavioral2/memory/544-734-0x00007FF7DEDF0000-0x00007FF7DF144000-memory.dmp	xmrig
behavioral2/memory/752-736-0x00007FF76C530000-0x00007FF76C884000-memory.dmp	xmrig
behavioral2/memory/4020-768-0x00007FF7AA130000-0x00007FF7AA484000-memory.dmp	xmrig
behavioral2/memory/2576-790-0x00007FF6BF720000-0x00007FF6BFA74000-memory.dmp	xmrig
behavioral2/memory/3280-781-0x00007FF793580000-0x00007FF7938D4000-memory.dmp	xmrig
behavioral2/memory/2088-780-0x00007FF7EEE90000-0x00007FF7EF1E4000-memory.dmp	xmrig
behavioral2/memory/2948-755-0x00007FF6F03F0000-0x00007FF6F0744000-memory.dmp	xmrig
behavioral2/memory/4932-749-0x00007FF768FC0000-0x00007FF769314000-memory.dmp	xmrig
behavioral2/memory/4092-798-0x00007FF6DB430000-0x00007FF6DB784000-memory.dmp	xmrig
behavioral2/memory/3184-801-0x00007FF6E4BA0000-0x00007FF6E4EF4000-memory.dmp	xmrig
behavioral2/memory/1196-808-0x00007FF7EDC20000-0x00007FF7EDF74000-memory.dmp	xmrig
behavioral2/memory/2312-815-0x00007FF7ACFF0000-0x00007FF7AD344000-memory.dmp	xmrig
behavioral2/memory/1508-857-0x00007FF6E1A90000-0x00007FF6E1DE4000-memory.dmp	xmrig
behavioral2/memory/4540-861-0x00007FF767450000-0x00007FF7677A4000-memory.dmp	xmrig
behavioral2/memory/408-883-0x00007FF6C0A30000-0x00007FF6C0D84000-memory.dmp	xmrig
behavioral2/memory/4592-884-0x00007FF7E4BC0000-0x00007FF7E4F14000-memory.dmp	xmrig
behavioral2/memory/428-879-0x00007FF6B9C00000-0x00007FF6B9F54000-memory.dmp	xmrig
behavioral2/memory/3024-875-0x00007FF6DA550000-0x00007FF6DA8A4000-memory.dmp	xmrig
behavioral2/memory/4656-872-0x00007FF660AE0000-0x00007FF660E34000-memory.dmp	xmrig
behavioral2/memory/388-869-0x00007FF6A7860000-0x00007FF6A7BB4000-memory.dmp	xmrig
behavioral2/memory/4312-803-0x00007FF75BE00000-0x00007FF75C154000-memory.dmp	xmrig
behavioral2/memory/2068-2141-0x00007FF64C5D0000-0x00007FF64C924000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3704	RrXaWaH.exe
4272	zZGoIvs.exe
3568	UfxEqTJ.exe
3356	WBHtwHt.exe
1944	bpNKTvp.exe
984	ZrWfGWd.exe
4892	nOhPVTv.exe
544	lyEGzvn.exe
1212	wLeVMwP.exe
752	SukFDQi.exe
4932	lFqWLPD.exe
2948	cfWIqyY.exe
4020	DHfiURx.exe
2088	SESlSkK.exe
3280	FmKpGHS.exe
2576	zMPGYnC.exe
4092	GDSEkgx.exe
3184	LMwQUXH.exe
4312	tBDfdDV.exe
1196	ffHCvRL.exe
2312	epakjRY.exe
1508	ytPNaVl.exe
4540	IcTnclp.exe
388	zLxxJnT.exe
4656	uTFjkuZ.exe
3024	NBeyIlu.exe
428	RopQOTb.exe
408	IwtjsmK.exe
4592	COYiuGP.exe
1704	HEDQwRf.exe
4016	bYobKVo.exe
824	uiwcGTE.exe
3228	dTBkJke.exe
4460	OsAJWJN.exe
4648	JXTteUL.exe
1588	pjjhWIC.exe
3032	kbKMDKF.exe
1576	gCrroBb.exe
3276	uxxVcUE.exe
4580	RKNEfUG.exe
3260	kzLVROV.exe
4980	kVduown.exe
3684	cqcCyqr.exe
1128	uiuNGvw.exe
384	AFVzUbQ.exe
1844	VxVeOdR.exe
3148	PYGYxyc.exe
2252	VIcvInm.exe
632	TwyXqkq.exe
1408	GgHNfnc.exe
5008	GAcRwAq.exe
3484	MMKBSBn.exe
2684	yinvWwb.exe
3020	fySvDic.exe
4724	HMFhiWA.exe
4244	udvyjiy.exe
3820	miPmjzr.exe
1220	kjWDRQy.exe
212	hbjgnJS.exe
3224	mVdhZNq.exe
2368	qCYWaWu.exe
2028	QatdLfg.exe
1812	TUrUUKX.exe
2148	zauydfd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2068-0-0x00007FF64C5D0000-0x00007FF64C924000-memory.dmp	upx
behavioral2/files/0x0008000000023414-5.dat	upx
behavioral2/memory/3704-8-0x00007FF7D4900000-0x00007FF7D4C54000-memory.dmp	upx
behavioral2/files/0x0007000000023419-7.dat	upx
behavioral2/files/0x0007000000023418-12.dat	upx
behavioral2/files/0x000700000002341b-27.dat	upx
behavioral2/files/0x0007000000023421-57.dat	upx
behavioral2/files/0x0007000000023424-75.dat	upx
behavioral2/files/0x0007000000023427-89.dat	upx
behavioral2/files/0x000700000002342a-101.dat	upx
behavioral2/files/0x0007000000023432-145.dat	upx
behavioral2/files/0x0007000000023437-164.dat	upx
behavioral2/memory/3568-729-0x00007FF73CFD0000-0x00007FF73D324000-memory.dmp	upx
behavioral2/memory/1944-731-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp	upx
behavioral2/memory/984-732-0x00007FF6553B0000-0x00007FF655704000-memory.dmp	upx
behavioral2/memory/3356-730-0x00007FF6A7950000-0x00007FF6A7CA4000-memory.dmp	upx
behavioral2/files/0x0007000000023436-161.dat	upx
behavioral2/files/0x0007000000023435-159.dat	upx
behavioral2/files/0x0007000000023434-155.dat	upx
behavioral2/files/0x0007000000023433-149.dat	upx
behavioral2/files/0x0007000000023431-139.dat	upx
behavioral2/files/0x0007000000023430-135.dat	upx
behavioral2/files/0x000700000002342f-129.dat	upx
behavioral2/files/0x000700000002342e-125.dat	upx
behavioral2/files/0x000700000002342d-120.dat	upx
behavioral2/files/0x000700000002342c-115.dat	upx
behavioral2/files/0x000700000002342b-109.dat	upx
behavioral2/files/0x0007000000023429-99.dat	upx
behavioral2/files/0x0007000000023428-95.dat	upx
behavioral2/files/0x0007000000023426-85.dat	upx
behavioral2/files/0x0007000000023425-79.dat	upx
behavioral2/files/0x0007000000023423-69.dat	upx
behavioral2/files/0x0007000000023422-65.dat	upx
behavioral2/files/0x0007000000023420-54.dat	upx
behavioral2/files/0x000700000002341f-49.dat	upx
behavioral2/files/0x000700000002341e-42.dat	upx
behavioral2/files/0x000700000002341d-37.dat	upx
behavioral2/files/0x000700000002341c-32.dat	upx
behavioral2/files/0x000700000002341a-23.dat	upx
behavioral2/memory/4272-15-0x00007FF742920000-0x00007FF742C74000-memory.dmp	upx
behavioral2/memory/4892-733-0x00007FF7A98A0000-0x00007FF7A9BF4000-memory.dmp	upx
behavioral2/memory/1212-735-0x00007FF63D4E0000-0x00007FF63D834000-memory.dmp	upx
behavioral2/memory/544-734-0x00007FF7DEDF0000-0x00007FF7DF144000-memory.dmp	upx
behavioral2/memory/752-736-0x00007FF76C530000-0x00007FF76C884000-memory.dmp	upx
behavioral2/memory/4020-768-0x00007FF7AA130000-0x00007FF7AA484000-memory.dmp	upx
behavioral2/memory/2576-790-0x00007FF6BF720000-0x00007FF6BFA74000-memory.dmp	upx
behavioral2/memory/3280-781-0x00007FF793580000-0x00007FF7938D4000-memory.dmp	upx
behavioral2/memory/2088-780-0x00007FF7EEE90000-0x00007FF7EF1E4000-memory.dmp	upx
behavioral2/memory/2948-755-0x00007FF6F03F0000-0x00007FF6F0744000-memory.dmp	upx
behavioral2/memory/4932-749-0x00007FF768FC0000-0x00007FF769314000-memory.dmp	upx
behavioral2/memory/4092-798-0x00007FF6DB430000-0x00007FF6DB784000-memory.dmp	upx
behavioral2/memory/3184-801-0x00007FF6E4BA0000-0x00007FF6E4EF4000-memory.dmp	upx
behavioral2/memory/1196-808-0x00007FF7EDC20000-0x00007FF7EDF74000-memory.dmp	upx
behavioral2/memory/2312-815-0x00007FF7ACFF0000-0x00007FF7AD344000-memory.dmp	upx
behavioral2/memory/1508-857-0x00007FF6E1A90000-0x00007FF6E1DE4000-memory.dmp	upx
behavioral2/memory/4540-861-0x00007FF767450000-0x00007FF7677A4000-memory.dmp	upx
behavioral2/memory/408-883-0x00007FF6C0A30000-0x00007FF6C0D84000-memory.dmp	upx
behavioral2/memory/4592-884-0x00007FF7E4BC0000-0x00007FF7E4F14000-memory.dmp	upx
behavioral2/memory/428-879-0x00007FF6B9C00000-0x00007FF6B9F54000-memory.dmp	upx
behavioral2/memory/3024-875-0x00007FF6DA550000-0x00007FF6DA8A4000-memory.dmp	upx
behavioral2/memory/4656-872-0x00007FF660AE0000-0x00007FF660E34000-memory.dmp	upx
behavioral2/memory/388-869-0x00007FF6A7860000-0x00007FF6A7BB4000-memory.dmp	upx
behavioral2/memory/4312-803-0x00007FF75BE00000-0x00007FF75C154000-memory.dmp	upx
behavioral2/memory/2068-2141-0x00007FF64C5D0000-0x00007FF64C924000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EwFfNyh.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\hIfBNyt.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\klyaLwm.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\zKApksZ.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\SiHOVyA.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\oAlrBdm.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\tImrkrH.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\ShxUfBI.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\rGqOGXh.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\yensvrI.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\ifGTvKH.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\SlZyXly.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\wjIAfSg.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\rEOVXZo.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\NpKWTuy.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\BOcZZVQ.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\XkTxFyp.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\rWWDIEW.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\PjOCrKs.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\JcyUlvB.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\zZGoIvs.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\GAcRwAq.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\HAXZprE.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\owQEmbD.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\CzEsCQE.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\CtrcOWe.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\QatdLfg.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\tNpXBAM.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\qAYEPrF.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\QZSfxkq.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\uTFjkuZ.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\WttZBDb.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\YdwYEZj.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\bNJRAqo.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\FmWrxAu.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\tQlqNyc.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\VHkpTaz.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\WYpjlHZ.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\GXEduLR.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\eaMBpeN.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\bSQZriG.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\DIjRGkP.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\GIgaFuB.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\bdEriaG.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\oIvOMTx.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\IiFPHEU.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\ZPmYsdv.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\wgVmXiR.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\YpajOpJ.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\YFsqsau.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\MTodHtQ.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\UXoCFIf.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\XtZayba.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\sPIcYVB.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\fySvDic.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\tyOPUGL.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\CFqHHKq.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\bXiWCRB.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\ytPNaVl.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\LEpKpyl.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\gIPgryY.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\HMFhiWA.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\qwWoRGD.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
File created	C:\Windows\System\lkoxtvE.exe	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4544	WerFaultSecure.exe
4544	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3704	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	83
PID 2068 wrote to memory of 3704	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	83
PID 2068 wrote to memory of 4272	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	84
PID 2068 wrote to memory of 4272	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	84
PID 2068 wrote to memory of 3568	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	85
PID 2068 wrote to memory of 3568	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	85
PID 2068 wrote to memory of 3356	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	86
PID 2068 wrote to memory of 3356	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	86
PID 2068 wrote to memory of 1944	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	87
PID 2068 wrote to memory of 1944	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	87
PID 2068 wrote to memory of 984	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	88
PID 2068 wrote to memory of 984	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	88
PID 2068 wrote to memory of 4892	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	89
PID 2068 wrote to memory of 4892	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	89
PID 2068 wrote to memory of 544	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	90
PID 2068 wrote to memory of 544	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	90
PID 2068 wrote to memory of 1212	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	91
PID 2068 wrote to memory of 1212	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	91
PID 2068 wrote to memory of 752	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	92
PID 2068 wrote to memory of 752	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	92
PID 2068 wrote to memory of 4932	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	93
PID 2068 wrote to memory of 4932	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	93
PID 2068 wrote to memory of 2948	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	94
PID 2068 wrote to memory of 2948	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	94
PID 2068 wrote to memory of 4020	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	95
PID 2068 wrote to memory of 4020	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	95
PID 2068 wrote to memory of 2088	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	96
PID 2068 wrote to memory of 2088	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	96
PID 2068 wrote to memory of 3280	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	97
PID 2068 wrote to memory of 3280	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	97
PID 2068 wrote to memory of 2576	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	98
PID 2068 wrote to memory of 2576	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	98
PID 2068 wrote to memory of 4092	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	99
PID 2068 wrote to memory of 4092	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	99
PID 2068 wrote to memory of 3184	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	100
PID 2068 wrote to memory of 3184	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	100
PID 2068 wrote to memory of 4312	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	101
PID 2068 wrote to memory of 4312	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	101
PID 2068 wrote to memory of 1196	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	102
PID 2068 wrote to memory of 1196	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	102
PID 2068 wrote to memory of 2312	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	103
PID 2068 wrote to memory of 2312	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	103
PID 2068 wrote to memory of 1508	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	104
PID 2068 wrote to memory of 1508	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	104
PID 2068 wrote to memory of 4540	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	105
PID 2068 wrote to memory of 4540	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	105
PID 2068 wrote to memory of 388	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	106
PID 2068 wrote to memory of 388	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	106
PID 2068 wrote to memory of 4656	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	107
PID 2068 wrote to memory of 4656	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	107
PID 2068 wrote to memory of 3024	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	108
PID 2068 wrote to memory of 3024	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	108
PID 2068 wrote to memory of 428	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	109
PID 2068 wrote to memory of 428	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	109
PID 2068 wrote to memory of 408	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	110
PID 2068 wrote to memory of 408	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	110
PID 2068 wrote to memory of 4592	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	111
PID 2068 wrote to memory of 4592	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	111
PID 2068 wrote to memory of 1704	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	112
PID 2068 wrote to memory of 1704	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	112
PID 2068 wrote to memory of 4016	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	113
PID 2068 wrote to memory of 4016	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	113
PID 2068 wrote to memory of 824	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	114
PID 2068 wrote to memory of 824	2068	4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4e3d8efe3e5cbefd593a132be02a2450_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\System\RrXaWaH.exe
  C:\Windows\System\RrXaWaH.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\zZGoIvs.exe
  C:\Windows\System\zZGoIvs.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\UfxEqTJ.exe
  C:\Windows\System\UfxEqTJ.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\WBHtwHt.exe
  C:\Windows\System\WBHtwHt.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\bpNKTvp.exe
  C:\Windows\System\bpNKTvp.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\ZrWfGWd.exe
  C:\Windows\System\ZrWfGWd.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\nOhPVTv.exe
  C:\Windows\System\nOhPVTv.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\lyEGzvn.exe
  C:\Windows\System\lyEGzvn.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\wLeVMwP.exe
  C:\Windows\System\wLeVMwP.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\SukFDQi.exe
  C:\Windows\System\SukFDQi.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\lFqWLPD.exe
  C:\Windows\System\lFqWLPD.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\cfWIqyY.exe
  C:\Windows\System\cfWIqyY.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\DHfiURx.exe
  C:\Windows\System\DHfiURx.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\SESlSkK.exe
  C:\Windows\System\SESlSkK.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\FmKpGHS.exe
  C:\Windows\System\FmKpGHS.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\zMPGYnC.exe
  C:\Windows\System\zMPGYnC.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\GDSEkgx.exe
  C:\Windows\System\GDSEkgx.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\LMwQUXH.exe
  C:\Windows\System\LMwQUXH.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\tBDfdDV.exe
  C:\Windows\System\tBDfdDV.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\ffHCvRL.exe
  C:\Windows\System\ffHCvRL.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\epakjRY.exe
  C:\Windows\System\epakjRY.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ytPNaVl.exe
  C:\Windows\System\ytPNaVl.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\IcTnclp.exe
  C:\Windows\System\IcTnclp.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\zLxxJnT.exe
  C:\Windows\System\zLxxJnT.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\uTFjkuZ.exe
  C:\Windows\System\uTFjkuZ.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\NBeyIlu.exe
  C:\Windows\System\NBeyIlu.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\RopQOTb.exe
  C:\Windows\System\RopQOTb.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\IwtjsmK.exe
  C:\Windows\System\IwtjsmK.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\COYiuGP.exe
  C:\Windows\System\COYiuGP.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\HEDQwRf.exe
  C:\Windows\System\HEDQwRf.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\bYobKVo.exe
  C:\Windows\System\bYobKVo.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\uiwcGTE.exe
  C:\Windows\System\uiwcGTE.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\dTBkJke.exe
  C:\Windows\System\dTBkJke.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\OsAJWJN.exe
  C:\Windows\System\OsAJWJN.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\JXTteUL.exe
  C:\Windows\System\JXTteUL.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\pjjhWIC.exe
  C:\Windows\System\pjjhWIC.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\kbKMDKF.exe
  C:\Windows\System\kbKMDKF.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\gCrroBb.exe
  C:\Windows\System\gCrroBb.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\uxxVcUE.exe
  C:\Windows\System\uxxVcUE.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\RKNEfUG.exe
  C:\Windows\System\RKNEfUG.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\kzLVROV.exe
  C:\Windows\System\kzLVROV.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\kVduown.exe
  C:\Windows\System\kVduown.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\cqcCyqr.exe
  C:\Windows\System\cqcCyqr.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\uiuNGvw.exe
  C:\Windows\System\uiuNGvw.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\AFVzUbQ.exe
  C:\Windows\System\AFVzUbQ.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\VxVeOdR.exe
  C:\Windows\System\VxVeOdR.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\PYGYxyc.exe
  C:\Windows\System\PYGYxyc.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\VIcvInm.exe
  C:\Windows\System\VIcvInm.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\TwyXqkq.exe
  C:\Windows\System\TwyXqkq.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\GgHNfnc.exe
  C:\Windows\System\GgHNfnc.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\GAcRwAq.exe
  C:\Windows\System\GAcRwAq.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\MMKBSBn.exe
  C:\Windows\System\MMKBSBn.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\yinvWwb.exe
  C:\Windows\System\yinvWwb.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\fySvDic.exe
  C:\Windows\System\fySvDic.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\HMFhiWA.exe
  C:\Windows\System\HMFhiWA.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\udvyjiy.exe
  C:\Windows\System\udvyjiy.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\miPmjzr.exe
  C:\Windows\System\miPmjzr.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\kjWDRQy.exe
  C:\Windows\System\kjWDRQy.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\hbjgnJS.exe
  C:\Windows\System\hbjgnJS.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\mVdhZNq.exe
  C:\Windows\System\mVdhZNq.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\qCYWaWu.exe
  C:\Windows\System\qCYWaWu.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\QatdLfg.exe
  C:\Windows\System\QatdLfg.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\TUrUUKX.exe
  C:\Windows\System\TUrUUKX.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\zauydfd.exe
  C:\Windows\System\zauydfd.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\BvhJHzW.exe
  C:\Windows\System\BvhJHzW.exe
  2⤵
  PID:264
- C:\Windows\System\ZQKKfAr.exe
  C:\Windows\System\ZQKKfAr.exe
  2⤵
  PID:5040
- C:\Windows\System\ZIWzpbY.exe
  C:\Windows\System\ZIWzpbY.exe
  2⤵
  PID:5044
- C:\Windows\System\VHkpTaz.exe
  C:\Windows\System\VHkpTaz.exe
  2⤵
  PID:3788
- C:\Windows\System\wgVmXiR.exe
  C:\Windows\System\wgVmXiR.exe
  2⤵
  PID:4748
- C:\Windows\System\VuVAFVY.exe
  C:\Windows\System\VuVAFVY.exe
  2⤵
  PID:1784
- C:\Windows\System\yhVGlQY.exe
  C:\Windows\System\yhVGlQY.exe
  2⤵
  PID:1392
- C:\Windows\System\OxEcUsU.exe
  C:\Windows\System\OxEcUsU.exe
  2⤵
  PID:3960
- C:\Windows\System\ltPHXOQ.exe
  C:\Windows\System\ltPHXOQ.exe
  2⤵
  PID:2076
- C:\Windows\System\SjiENHf.exe
  C:\Windows\System\SjiENHf.exe
  2⤵
  PID:2364
- C:\Windows\System\xKBYleQ.exe
  C:\Windows\System\xKBYleQ.exe
  2⤵
  PID:2780
- C:\Windows\System\rEOVXZo.exe
  C:\Windows\System\rEOVXZo.exe
  2⤵
  PID:4568
- C:\Windows\System\hIfBNyt.exe
  C:\Windows\System\hIfBNyt.exe
  2⤵
  PID:2620
- C:\Windows\System\xcKsHoy.exe
  C:\Windows\System\xcKsHoy.exe
  2⤵
  PID:3580
- C:\Windows\System\ANyxxMU.exe
  C:\Windows\System\ANyxxMU.exe
  2⤵
  PID:4428
- C:\Windows\System\PoWqzOm.exe
  C:\Windows\System\PoWqzOm.exe
  2⤵
  PID:3724
- C:\Windows\System\zxmcJbJ.exe
  C:\Windows\System\zxmcJbJ.exe
  2⤵
  PID:4920
- C:\Windows\System\SlsoGji.exe
  C:\Windows\System\SlsoGji.exe
  2⤵
  PID:3152
- C:\Windows\System\NmvZicP.exe
  C:\Windows\System\NmvZicP.exe
  2⤵
  PID:3544
- C:\Windows\System\NUBmpwQ.exe
  C:\Windows\System\NUBmpwQ.exe
  2⤵
  PID:5140
- C:\Windows\System\nmxlxqW.exe
  C:\Windows\System\nmxlxqW.exe
  2⤵
  PID:5168
- C:\Windows\System\oSYHWnd.exe
  C:\Windows\System\oSYHWnd.exe
  2⤵
  PID:5196
- C:\Windows\System\XCmwFCI.exe
  C:\Windows\System\XCmwFCI.exe
  2⤵
  PID:5224
- C:\Windows\System\cMWRKfP.exe
  C:\Windows\System\cMWRKfP.exe
  2⤵
  PID:5252
- C:\Windows\System\xEYTooc.exe
  C:\Windows\System\xEYTooc.exe
  2⤵
  PID:5280
- C:\Windows\System\mBiICAr.exe
  C:\Windows\System\mBiICAr.exe
  2⤵
  PID:5308
- C:\Windows\System\eYldcnE.exe
  C:\Windows\System\eYldcnE.exe
  2⤵
  PID:5336
- C:\Windows\System\asIiTYc.exe
  C:\Windows\System\asIiTYc.exe
  2⤵
  PID:5360
- C:\Windows\System\kOxebvm.exe
  C:\Windows\System\kOxebvm.exe
  2⤵
  PID:5392
- C:\Windows\System\OHfhKhE.exe
  C:\Windows\System\OHfhKhE.exe
  2⤵
  PID:5420
- C:\Windows\System\QBfkaAW.exe
  C:\Windows\System\QBfkaAW.exe
  2⤵
  PID:5448
- C:\Windows\System\ynzYCrS.exe
  C:\Windows\System\ynzYCrS.exe
  2⤵
  PID:5476
- C:\Windows\System\WYpjlHZ.exe
  C:\Windows\System\WYpjlHZ.exe
  2⤵
  PID:5504
- C:\Windows\System\YFHwdOw.exe
  C:\Windows\System\YFHwdOw.exe
  2⤵
  PID:5532
- C:\Windows\System\GLkZqkQ.exe
  C:\Windows\System\GLkZqkQ.exe
  2⤵
  PID:5560
- C:\Windows\System\Gvzxsmg.exe
  C:\Windows\System\Gvzxsmg.exe
  2⤵
  PID:5588
- C:\Windows\System\ObHIlSz.exe
  C:\Windows\System\ObHIlSz.exe
  2⤵
  PID:5616
- C:\Windows\System\GXEduLR.exe
  C:\Windows\System\GXEduLR.exe
  2⤵
  PID:5644
- C:\Windows\System\eQdOwhT.exe
  C:\Windows\System\eQdOwhT.exe
  2⤵
  PID:5672
- C:\Windows\System\VzZTFZP.exe
  C:\Windows\System\VzZTFZP.exe
  2⤵
  PID:5700
- C:\Windows\System\odwlttY.exe
  C:\Windows\System\odwlttY.exe
  2⤵
  PID:5728
- C:\Windows\System\BHJwwGu.exe
  C:\Windows\System\BHJwwGu.exe
  2⤵
  PID:5756
- C:\Windows\System\MPADqkO.exe
  C:\Windows\System\MPADqkO.exe
  2⤵
  PID:5784
- C:\Windows\System\taTIcDi.exe
  C:\Windows\System\taTIcDi.exe
  2⤵
  PID:5812
- C:\Windows\System\tNpXBAM.exe
  C:\Windows\System\tNpXBAM.exe
  2⤵
  PID:5840
- C:\Windows\System\YkGUINz.exe
  C:\Windows\System\YkGUINz.exe
  2⤵
  PID:5868
- C:\Windows\System\kcOFvqx.exe
  C:\Windows\System\kcOFvqx.exe
  2⤵
  PID:5896
- C:\Windows\System\StFiYTJ.exe
  C:\Windows\System\StFiYTJ.exe
  2⤵
  PID:5924
- C:\Windows\System\PcAnmSd.exe
  C:\Windows\System\PcAnmSd.exe
  2⤵
  PID:5952
- C:\Windows\System\HAXZprE.exe
  C:\Windows\System\HAXZprE.exe
  2⤵
  PID:5980
- C:\Windows\System\SYEhIMU.exe
  C:\Windows\System\SYEhIMU.exe
  2⤵
  PID:6008
- C:\Windows\System\lAXIzPD.exe
  C:\Windows\System\lAXIzPD.exe
  2⤵
  PID:6032
- C:\Windows\System\owQEmbD.exe
  C:\Windows\System\owQEmbD.exe
  2⤵
  PID:6064
- C:\Windows\System\nJxuWyv.exe
  C:\Windows\System\nJxuWyv.exe
  2⤵
  PID:6092
- C:\Windows\System\yONxozE.exe
  C:\Windows\System\yONxozE.exe
  2⤵
  PID:6120
- C:\Windows\System\KJUfXhO.exe
  C:\Windows\System\KJUfXhO.exe
  2⤵
  PID:4940
- C:\Windows\System\dqLQktQ.exe
  C:\Windows\System\dqLQktQ.exe
  2⤵
  PID:3232
- C:\Windows\System\bjMctZJ.exe
  C:\Windows\System\bjMctZJ.exe
  2⤵
  PID:4332
- C:\Windows\System\TQNgwfB.exe
  C:\Windows\System\TQNgwfB.exe
  2⤵
  PID:2608
- C:\Windows\System\MNtrhQa.exe
  C:\Windows\System\MNtrhQa.exe
  2⤵
  PID:2600
- C:\Windows\System\LJwwnbe.exe
  C:\Windows\System\LJwwnbe.exe
  2⤵
  PID:4052
- C:\Windows\System\vMCxvfT.exe
  C:\Windows\System\vMCxvfT.exe
  2⤵
  PID:5156
- C:\Windows\System\aHwOjYp.exe
  C:\Windows\System\aHwOjYp.exe
  2⤵
  PID:5216
- C:\Windows\System\ctnRUNl.exe
  C:\Windows\System\ctnRUNl.exe
  2⤵
  PID:5292
- C:\Windows\System\xSfQKtw.exe
  C:\Windows\System\xSfQKtw.exe
  2⤵
  PID:5348
- C:\Windows\System\CAxiGFE.exe
  C:\Windows\System\CAxiGFE.exe
  2⤵
  PID:5412
- C:\Windows\System\xDWdJPZ.exe
  C:\Windows\System\xDWdJPZ.exe
  2⤵
  PID:5488
- C:\Windows\System\TQbRtvZ.exe
  C:\Windows\System\TQbRtvZ.exe
  2⤵
  PID:5548
- C:\Windows\System\HxvZrke.exe
  C:\Windows\System\HxvZrke.exe
  2⤵
  PID:5604
- C:\Windows\System\MIlCnSG.exe
  C:\Windows\System\MIlCnSG.exe
  2⤵
  PID:5684
- C:\Windows\System\WjOaufc.exe
  C:\Windows\System\WjOaufc.exe
  2⤵
  PID:5744
- C:\Windows\System\xxbBWpy.exe
  C:\Windows\System\xxbBWpy.exe
  2⤵
  PID:5804
- C:\Windows\System\xKshbLc.exe
  C:\Windows\System\xKshbLc.exe
  2⤵
  PID:5880
- C:\Windows\System\lhkefbF.exe
  C:\Windows\System\lhkefbF.exe
  2⤵
  PID:5940
- C:\Windows\System\CgXlMWO.exe
  C:\Windows\System\CgXlMWO.exe
  2⤵
  PID:6000
- C:\Windows\System\KtMLudn.exe
  C:\Windows\System\KtMLudn.exe
  2⤵
  PID:6076
- C:\Windows\System\xbqlDIG.exe
  C:\Windows\System\xbqlDIG.exe
  2⤵
  PID:6136
- C:\Windows\System\lXEpxxB.exe
  C:\Windows\System\lXEpxxB.exe
  2⤵
  PID:1272
- C:\Windows\System\LnUCnrI.exe
  C:\Windows\System\LnUCnrI.exe
  2⤵
  PID:4084
- C:\Windows\System\KJVXtIb.exe
  C:\Windows\System\KJVXtIb.exe
  2⤵
  PID:5188
- C:\Windows\System\ZmOkVgw.exe
  C:\Windows\System\ZmOkVgw.exe
  2⤵
  PID:5328
- C:\Windows\System\zDkNIHe.exe
  C:\Windows\System\zDkNIHe.exe
  2⤵
  PID:5464
- C:\Windows\System\YpajOpJ.exe
  C:\Windows\System\YpajOpJ.exe
  2⤵
  PID:5636
- C:\Windows\System\EWIJOmI.exe
  C:\Windows\System\EWIJOmI.exe
  2⤵
  PID:5796
- C:\Windows\System\qAYEPrF.exe
  C:\Windows\System\qAYEPrF.exe
  2⤵
  PID:6156
- C:\Windows\System\tyOPUGL.exe
  C:\Windows\System\tyOPUGL.exe
  2⤵
  PID:6184
- C:\Windows\System\CoCOXAm.exe
  C:\Windows\System\CoCOXAm.exe
  2⤵
  PID:6212
- C:\Windows\System\kzBbPGs.exe
  C:\Windows\System\kzBbPGs.exe
  2⤵
  PID:6240
- C:\Windows\System\ZkRMrri.exe
  C:\Windows\System\ZkRMrri.exe
  2⤵
  PID:6268
- C:\Windows\System\GSRAkbh.exe
  C:\Windows\System\GSRAkbh.exe
  2⤵
  PID:6296
- C:\Windows\System\ZelgauK.exe
  C:\Windows\System\ZelgauK.exe
  2⤵
  PID:6324
- C:\Windows\System\kwZZkjo.exe
  C:\Windows\System\kwZZkjo.exe
  2⤵
  PID:6352
- C:\Windows\System\cINYUTq.exe
  C:\Windows\System\cINYUTq.exe
  2⤵
  PID:6380
- C:\Windows\System\MZAwWpp.exe
  C:\Windows\System\MZAwWpp.exe
  2⤵
  PID:6408
- C:\Windows\System\hhzXYJL.exe
  C:\Windows\System\hhzXYJL.exe
  2⤵
  PID:6436
- C:\Windows\System\oChaaju.exe
  C:\Windows\System\oChaaju.exe
  2⤵
  PID:6460
- C:\Windows\System\klyaLwm.exe
  C:\Windows\System\klyaLwm.exe
  2⤵
  PID:6492
- C:\Windows\System\rcGVgPR.exe
  C:\Windows\System\rcGVgPR.exe
  2⤵
  PID:6520
- C:\Windows\System\hcMMREF.exe
  C:\Windows\System\hcMMREF.exe
  2⤵
  PID:6552
- C:\Windows\System\WGtuFZB.exe
  C:\Windows\System\WGtuFZB.exe
  2⤵
  PID:6588
- C:\Windows\System\TMLOrjW.exe
  C:\Windows\System\TMLOrjW.exe
  2⤵
  PID:6616
- C:\Windows\System\IXPTTqK.exe
  C:\Windows\System\IXPTTqK.exe
  2⤵
  PID:6640
- C:\Windows\System\CqTdCpR.exe
  C:\Windows\System\CqTdCpR.exe
  2⤵
  PID:6668
- C:\Windows\System\ruTZHpx.exe
  C:\Windows\System\ruTZHpx.exe
  2⤵
  PID:6696
- C:\Windows\System\NpKWTuy.exe
  C:\Windows\System\NpKWTuy.exe
  2⤵
  PID:6724
- C:\Windows\System\FWLpdve.exe
  C:\Windows\System\FWLpdve.exe
  2⤵
  PID:6752
- C:\Windows\System\zeAvGtT.exe
  C:\Windows\System\zeAvGtT.exe
  2⤵
  PID:6772
- C:\Windows\System\EHRUEYC.exe
  C:\Windows\System\EHRUEYC.exe
  2⤵
  PID:6800
- C:\Windows\System\YbHhbBN.exe
  C:\Windows\System\YbHhbBN.exe
  2⤵
  PID:6828
- C:\Windows\System\fTIjDYj.exe
  C:\Windows\System\fTIjDYj.exe
  2⤵
  PID:6856
- C:\Windows\System\VMqyPPB.exe
  C:\Windows\System\VMqyPPB.exe
  2⤵
  PID:6884
- C:\Windows\System\OsFHFrs.exe
  C:\Windows\System\OsFHFrs.exe
  2⤵
  PID:6912
- C:\Windows\System\KbrkIFw.exe
  C:\Windows\System\KbrkIFw.exe
  2⤵
  PID:6940
- C:\Windows\System\rJjkzXI.exe
  C:\Windows\System\rJjkzXI.exe
  2⤵
  PID:6968
- C:\Windows\System\nejzBVO.exe
  C:\Windows\System\nejzBVO.exe
  2⤵
  PID:6992
- C:\Windows\System\OPFBiHv.exe
  C:\Windows\System\OPFBiHv.exe
  2⤵
  PID:7024
- C:\Windows\System\AaMiKFZ.exe
  C:\Windows\System\AaMiKFZ.exe
  2⤵
  PID:7052
- C:\Windows\System\XrqJjsN.exe
  C:\Windows\System\XrqJjsN.exe
  2⤵
  PID:7080
- C:\Windows\System\BviBomI.exe
  C:\Windows\System\BviBomI.exe
  2⤵
  PID:7108
- C:\Windows\System\pKzfAlk.exe
  C:\Windows\System\pKzfAlk.exe
  2⤵
  PID:7136
- C:\Windows\System\xOEvkSD.exe
  C:\Windows\System\xOEvkSD.exe
  2⤵
  PID:7164
- C:\Windows\System\cmkANai.exe
  C:\Windows\System\cmkANai.exe
  2⤵
  PID:6048
- C:\Windows\System\rWWDIEW.exe
  C:\Windows\System\rWWDIEW.exe
  2⤵
  PID:1372
- C:\Windows\System\ucbdrNg.exe
  C:\Windows\System\ucbdrNg.exe
  2⤵
  PID:5264
- C:\Windows\System\XlAcMnu.exe
  C:\Windows\System\XlAcMnu.exe
  2⤵
  PID:5576
- C:\Windows\System\FaXuolt.exe
  C:\Windows\System\FaXuolt.exe
  2⤵
  PID:5908
- C:\Windows\System\hZTgEAW.exe
  C:\Windows\System\hZTgEAW.exe
  2⤵
  PID:6204
- C:\Windows\System\fljrGLn.exe
  C:\Windows\System\fljrGLn.exe
  2⤵
  PID:6280
- C:\Windows\System\VFPAbxJ.exe
  C:\Windows\System\VFPAbxJ.exe
  2⤵
  PID:6336
- C:\Windows\System\EuHpNGx.exe
  C:\Windows\System\EuHpNGx.exe
  2⤵
  PID:6392
- C:\Windows\System\jfyVQSs.exe
  C:\Windows\System\jfyVQSs.exe
  2⤵
  PID:6456
- C:\Windows\System\ahbbwVh.exe
  C:\Windows\System\ahbbwVh.exe
  2⤵
  PID:6532
- C:\Windows\System\ZXVWnCU.exe
  C:\Windows\System\ZXVWnCU.exe
  2⤵
  PID:4264
- C:\Windows\System\YHSRDUq.exe
  C:\Windows\System\YHSRDUq.exe
  2⤵
  PID:6656
- C:\Windows\System\rBEKxTU.exe
  C:\Windows\System\rBEKxTU.exe
  2⤵
  PID:6716
- C:\Windows\System\ezVMcNJ.exe
  C:\Windows\System\ezVMcNJ.exe
  2⤵
  PID:6784
- C:\Windows\System\KHmsCsc.exe
  C:\Windows\System\KHmsCsc.exe
  2⤵
  PID:6844
- C:\Windows\System\hdwLdFM.exe
  C:\Windows\System\hdwLdFM.exe
  2⤵
  PID:6896
- C:\Windows\System\KUkhCNR.exe
  C:\Windows\System\KUkhCNR.exe
  2⤵
  PID:6956
- C:\Windows\System\dlidUzx.exe
  C:\Windows\System\dlidUzx.exe
  2⤵
  PID:7016
- C:\Windows\System\PMwxZsD.exe
  C:\Windows\System\PMwxZsD.exe
  2⤵
  PID:7072
- C:\Windows\System\IuTKKID.exe
  C:\Windows\System\IuTKKID.exe
  2⤵
  PID:7148
- C:\Windows\System\CVLsqjI.exe
  C:\Windows\System\CVLsqjI.exe
  2⤵
  PID:4916
- C:\Windows\System\OFWcUmp.exe
  C:\Windows\System\OFWcUmp.exe
  2⤵
  PID:3132
- C:\Windows\System\nzYRiOy.exe
  C:\Windows\System\nzYRiOy.exe
  2⤵
  PID:5772
- C:\Windows\System\KDXmSPC.exe
  C:\Windows\System\KDXmSPC.exe
  2⤵
  PID:6308
- C:\Windows\System\gWJHDNM.exe
  C:\Windows\System\gWJHDNM.exe
  2⤵
  PID:6424
- C:\Windows\System\znxSkYv.exe
  C:\Windows\System\znxSkYv.exe
  2⤵
  PID:3660
- C:\Windows\System\znpKxTB.exe
  C:\Windows\System\znpKxTB.exe
  2⤵
  PID:6632
- C:\Windows\System\vHBmwCB.exe
  C:\Windows\System\vHBmwCB.exe
  2⤵
  PID:1808
- C:\Windows\System\xVTRAMv.exe
  C:\Windows\System\xVTRAMv.exe
  2⤵
  PID:6868
- C:\Windows\System\NXoAzVy.exe
  C:\Windows\System\NXoAzVy.exe
  2⤵
  PID:6932
- C:\Windows\System\drDVzwH.exe
  C:\Windows\System\drDVzwH.exe
  2⤵
  PID:2220
- C:\Windows\System\NxDvKGM.exe
  C:\Windows\System\NxDvKGM.exe
  2⤵
  PID:7156
- C:\Windows\System\qVMuVxZ.exe
  C:\Windows\System\qVMuVxZ.exe
  2⤵
  PID:4860
- C:\Windows\System\CTzFSQE.exe
  C:\Windows\System\CTzFSQE.exe
  2⤵
  PID:6232
- C:\Windows\System\LLQykbH.exe
  C:\Windows\System\LLQykbH.exe
  2⤵
  PID:6432
- C:\Windows\System\LHWXkUt.exe
  C:\Windows\System\LHWXkUt.exe
  2⤵
  PID:2308
- C:\Windows\System\aFoOvcQ.exe
  C:\Windows\System\aFoOvcQ.exe
  2⤵
  PID:2584
- C:\Windows\System\FDPbnbu.exe
  C:\Windows\System\FDPbnbu.exe
  2⤵
  PID:1044
- C:\Windows\System\yqIWHbb.exe
  C:\Windows\System\yqIWHbb.exe
  2⤵
  PID:1356
- C:\Windows\System\BBgRbfg.exe
  C:\Windows\System\BBgRbfg.exe
  2⤵
  PID:1448
- C:\Windows\System\yILGxTQ.exe
  C:\Windows\System\yILGxTQ.exe
  2⤵
  PID:3512
- C:\Windows\System\jBLgMKJ.exe
  C:\Windows\System\jBLgMKJ.exe
  2⤵
  PID:4088
- C:\Windows\System\djWfBDf.exe
  C:\Windows\System\djWfBDf.exe
  2⤵
  PID:636
- C:\Windows\System\qbuWeXj.exe
  C:\Windows\System\qbuWeXj.exe
  2⤵
  PID:3896
- C:\Windows\System\bYVXjyK.exe
  C:\Windows\System\bYVXjyK.exe
  2⤵
  PID:6692
- C:\Windows\System\bXdudBt.exe
  C:\Windows\System\bXdudBt.exe
  2⤵
  PID:1660
- C:\Windows\System\RuxkjNe.exe
  C:\Windows\System\RuxkjNe.exe
  2⤵
  PID:7172
- C:\Windows\System\KCFxhLw.exe
  C:\Windows\System\KCFxhLw.exe
  2⤵
  PID:7196
- C:\Windows\System\PjOCrKs.exe
  C:\Windows\System\PjOCrKs.exe
  2⤵
  PID:7216
- C:\Windows\System\rHMQeiS.exe
  C:\Windows\System\rHMQeiS.exe
  2⤵
  PID:7232
- C:\Windows\System\BGJSluQ.exe
  C:\Windows\System\BGJSluQ.exe
  2⤵
  PID:7248
- C:\Windows\System\DSQWtEP.exe
  C:\Windows\System\DSQWtEP.exe
  2⤵
  PID:7316
- C:\Windows\System\qkAMyqI.exe
  C:\Windows\System\qkAMyqI.exe
  2⤵
  PID:7348
- C:\Windows\System\QARaJTY.exe
  C:\Windows\System\QARaJTY.exe
  2⤵
  PID:7372
- C:\Windows\System\eaMBpeN.exe
  C:\Windows\System\eaMBpeN.exe
  2⤵
  PID:7400
- C:\Windows\System\OYRCFSJ.exe
  C:\Windows\System\OYRCFSJ.exe
  2⤵
  PID:7464
- C:\Windows\System\zxAJCNu.exe
  C:\Windows\System\zxAJCNu.exe
  2⤵
  PID:7520
- C:\Windows\System\PqUZXBS.exe
  C:\Windows\System\PqUZXBS.exe
  2⤵
  PID:7540
- C:\Windows\System\uDHUino.exe
  C:\Windows\System\uDHUino.exe
  2⤵
  PID:7576
- C:\Windows\System\WtcVDUa.exe
  C:\Windows\System\WtcVDUa.exe
  2⤵
  PID:7660
- C:\Windows\System\QEYmGHu.exe
  C:\Windows\System\QEYmGHu.exe
  2⤵
  PID:7680
- C:\Windows\System\WttZBDb.exe
  C:\Windows\System\WttZBDb.exe
  2⤵
  PID:7696
- C:\Windows\System\QZSfxkq.exe
  C:\Windows\System\QZSfxkq.exe
  2⤵
  PID:7716
- C:\Windows\System\rpoKVfA.exe
  C:\Windows\System\rpoKVfA.exe
  2⤵
  PID:7740
- C:\Windows\System\RyXsIRc.exe
  C:\Windows\System\RyXsIRc.exe
  2⤵
  PID:7760
- C:\Windows\System\UDdXDPR.exe
  C:\Windows\System\UDdXDPR.exe
  2⤵
  PID:7788
- C:\Windows\System\kvKqhyA.exe
  C:\Windows\System\kvKqhyA.exe
  2⤵
  PID:7812
- C:\Windows\System\gMaHjIf.exe
  C:\Windows\System\gMaHjIf.exe
  2⤵
  PID:7852
- C:\Windows\System\cCzLPJu.exe
  C:\Windows\System\cCzLPJu.exe
  2⤵
  PID:7884
- C:\Windows\System\FmWrxAu.exe
  C:\Windows\System\FmWrxAu.exe
  2⤵
  PID:7912
- C:\Windows\System\pgfZGSd.exe
  C:\Windows\System\pgfZGSd.exe
  2⤵
  PID:7940
- C:\Windows\System\lZQbAuM.exe
  C:\Windows\System\lZQbAuM.exe
  2⤵
  PID:7968
- C:\Windows\System\YdwYEZj.exe
  C:\Windows\System\YdwYEZj.exe
  2⤵
  PID:8000
- C:\Windows\System\JmBxCpZ.exe
  C:\Windows\System\JmBxCpZ.exe
  2⤵
  PID:8068
- C:\Windows\System\APGGYQj.exe
  C:\Windows\System\APGGYQj.exe
  2⤵
  PID:8084
- C:\Windows\System\wkIkNUC.exe
  C:\Windows\System\wkIkNUC.exe
  2⤵
  PID:8104
- C:\Windows\System\TXzvHxa.exe
  C:\Windows\System\TXzvHxa.exe
  2⤵
  PID:8128
- C:\Windows\System\SaaeeFB.exe
  C:\Windows\System\SaaeeFB.exe
  2⤵
  PID:8156
- C:\Windows\System\TLGAHgq.exe
  C:\Windows\System\TLGAHgq.exe
  2⤵
  PID:8188
- C:\Windows\System\sibWYcg.exe
  C:\Windows\System\sibWYcg.exe
  2⤵
  PID:1596
- C:\Windows\System\jxgbFAN.exe
  C:\Windows\System\jxgbFAN.exe
  2⤵
  PID:7328
- C:\Windows\System\wFiLfuu.exe
  C:\Windows\System\wFiLfuu.exe
  2⤵
  PID:7412
- C:\Windows\System\PCyvbtC.exe
  C:\Windows\System\PCyvbtC.exe
  2⤵
  PID:7480
- C:\Windows\System\cQnbBBw.exe
  C:\Windows\System\cQnbBBw.exe
  2⤵
  PID:7532
- C:\Windows\System\hirqPNa.exe
  C:\Windows\System\hirqPNa.exe
  2⤵
  PID:7588
- C:\Windows\System\VBbmuPc.exe
  C:\Windows\System\VBbmuPc.exe
  2⤵
  PID:7804
- C:\Windows\System\dvfLCGX.exe
  C:\Windows\System\dvfLCGX.exe
  2⤵
  PID:7772
- C:\Windows\System\bNJRAqo.exe
  C:\Windows\System\bNJRAqo.exe
  2⤵
  PID:7708
- C:\Windows\System\ToOVgJx.exe
  C:\Windows\System\ToOVgJx.exe
  2⤵
  PID:7876
- C:\Windows\System\qcOPAJm.exe
  C:\Windows\System\qcOPAJm.exe
  2⤵
  PID:7932
- C:\Windows\System\CFqHHKq.exe
  C:\Windows\System\CFqHHKq.exe
  2⤵
  PID:8012
- C:\Windows\System\NehDrsm.exe
  C:\Windows\System\NehDrsm.exe
  2⤵
  PID:8096
- C:\Windows\System\lZqUPhH.exe
  C:\Windows\System\lZqUPhH.exe
  2⤵
  PID:8112
- C:\Windows\System\xxOLAkC.exe
  C:\Windows\System\xxOLAkC.exe
  2⤵
  PID:7436
- C:\Windows\System\AzCLCXb.exe
  C:\Windows\System\AzCLCXb.exe
  2⤵
  PID:4668
- C:\Windows\System\BOcZZVQ.exe
  C:\Windows\System\BOcZZVQ.exe
  2⤵
  PID:8144
- C:\Windows\System\VayrfQy.exe
  C:\Windows\System\VayrfQy.exe
  2⤵
  PID:7344
- C:\Windows\System\gyqaPLP.exe
  C:\Windows\System\gyqaPLP.exe
  2⤵
  PID:7616
- C:\Windows\System\rTGRCSN.exe
  C:\Windows\System\rTGRCSN.exe
  2⤵
  PID:7780
- C:\Windows\System\loGfJQE.exe
  C:\Windows\System\loGfJQE.exe
  2⤵
  PID:7924
- C:\Windows\System\DIjRGkP.exe
  C:\Windows\System\DIjRGkP.exe
  2⤵
  PID:8056
- C:\Windows\System\bpTPsjL.exe
  C:\Windows\System\bpTPsjL.exe
  2⤵
  PID:8116
- C:\Windows\System\ErgHlnX.exe
  C:\Windows\System\ErgHlnX.exe
  2⤵
  PID:7208
- C:\Windows\System\VfZMaLP.exe
  C:\Windows\System\VfZMaLP.exe
  2⤵
  PID:7840
- C:\Windows\System\tQlqNyc.exe
  C:\Windows\System\tQlqNyc.exe
  2⤵
  PID:8152
- C:\Windows\System\EALCURI.exe
  C:\Windows\System\EALCURI.exe
  2⤵
  PID:8036
- C:\Windows\System\aQASPas.exe
  C:\Windows\System\aQASPas.exe
  2⤵
  PID:7956
- C:\Windows\System\cPvqvKG.exe
  C:\Windows\System\cPvqvKG.exe
  2⤵
  PID:8208
- C:\Windows\System\vaxjZhi.exe
  C:\Windows\System\vaxjZhi.exe
  2⤵
  PID:8236
- C:\Windows\System\etWlbQm.exe
  C:\Windows\System\etWlbQm.exe
  2⤵
  PID:8272
- C:\Windows\System\KilyVxm.exe
  C:\Windows\System\KilyVxm.exe
  2⤵
  PID:8304
- C:\Windows\System\GsyINED.exe
  C:\Windows\System\GsyINED.exe
  2⤵
  PID:8332
- C:\Windows\System\exovAPT.exe
  C:\Windows\System\exovAPT.exe
  2⤵
  PID:8360
- C:\Windows\System\iboyLfp.exe
  C:\Windows\System\iboyLfp.exe
  2⤵
  PID:8392
- C:\Windows\System\MEidPSL.exe
  C:\Windows\System\MEidPSL.exe
  2⤵
  PID:8416
- C:\Windows\System\ngYmZlh.exe
  C:\Windows\System\ngYmZlh.exe
  2⤵
  PID:8448
- C:\Windows\System\LTKffLu.exe
  C:\Windows\System\LTKffLu.exe
  2⤵
  PID:8472
- C:\Windows\System\glPsuii.exe
  C:\Windows\System\glPsuii.exe
  2⤵
  PID:8504
- C:\Windows\System\GYBjMNG.exe
  C:\Windows\System\GYBjMNG.exe
  2⤵
  PID:8536
- C:\Windows\System\GxTfblA.exe
  C:\Windows\System\GxTfblA.exe
  2⤵
  PID:8564
- C:\Windows\System\pPRoShz.exe
  C:\Windows\System\pPRoShz.exe
  2⤵
  PID:8592
- C:\Windows\System\wgEHbYg.exe
  C:\Windows\System\wgEHbYg.exe
  2⤵
  PID:8616
- C:\Windows\System\ShxUfBI.exe
  C:\Windows\System\ShxUfBI.exe
  2⤵
  PID:8640
- C:\Windows\System\CavSkBr.exe
  C:\Windows\System\CavSkBr.exe
  2⤵
  PID:8672
- C:\Windows\System\vFrzihw.exe
  C:\Windows\System\vFrzihw.exe
  2⤵
  PID:8704
- C:\Windows\System\BmzCCej.exe
  C:\Windows\System\BmzCCej.exe
  2⤵
  PID:8768
- C:\Windows\System\UgBvBLk.exe
  C:\Windows\System\UgBvBLk.exe
  2⤵
  PID:8784
- C:\Windows\System\VLDLVnW.exe
  C:\Windows\System\VLDLVnW.exe
  2⤵
  PID:8816
- C:\Windows\System\qwWoRGD.exe
  C:\Windows\System\qwWoRGD.exe
  2⤵
  PID:8844
- C:\Windows\System\KWMOkKK.exe
  C:\Windows\System\KWMOkKK.exe
  2⤵
  PID:8872
- C:\Windows\System\kvAbuqj.exe
  C:\Windows\System\kvAbuqj.exe
  2⤵
  PID:8888
- C:\Windows\System\bBqVVJH.exe
  C:\Windows\System\bBqVVJH.exe
  2⤵
  PID:8928
- C:\Windows\System\HPwvwlt.exe
  C:\Windows\System\HPwvwlt.exe
  2⤵
  PID:8944
- C:\Windows\System\YFsqsau.exe
  C:\Windows\System\YFsqsau.exe
  2⤵
  PID:8984
- C:\Windows\System\xeRWfhB.exe
  C:\Windows\System\xeRWfhB.exe
  2⤵
  PID:9004
- C:\Windows\System\sGlHzCE.exe
  C:\Windows\System\sGlHzCE.exe
  2⤵
  PID:9032
- C:\Windows\System\qFyJoEj.exe
  C:\Windows\System\qFyJoEj.exe
  2⤵
  PID:9056
- C:\Windows\System\UWPTWvj.exe
  C:\Windows\System\UWPTWvj.exe
  2⤵
  PID:9092
- C:\Windows\System\mxahAGr.exe
  C:\Windows\System\mxahAGr.exe
  2⤵
  PID:9108
- C:\Windows\System\kKnIVtm.exe
  C:\Windows\System\kKnIVtm.exe
  2⤵
  PID:9128
- C:\Windows\System\bNPxKRo.exe
  C:\Windows\System\bNPxKRo.exe
  2⤵
  PID:9148
- C:\Windows\System\vHrycgv.exe
  C:\Windows\System\vHrycgv.exe
  2⤵
  PID:9168
- C:\Windows\System\zzHpnVo.exe
  C:\Windows\System\zzHpnVo.exe
  2⤵
  PID:9200
- C:\Windows\System\JFmjKmF.exe
  C:\Windows\System\JFmjKmF.exe
  2⤵
  PID:8228
- C:\Windows\System\XBXbDqu.exe
  C:\Windows\System\XBXbDqu.exe
  2⤵
  PID:8320
- C:\Windows\System\wdGPhHi.exe
  C:\Windows\System\wdGPhHi.exe
  2⤵
  PID:8384
- C:\Windows\System\VuzctpG.exe
  C:\Windows\System\VuzctpG.exe
  2⤵
  PID:8464
- C:\Windows\System\YacBOQo.exe
  C:\Windows\System\YacBOQo.exe
  2⤵
  PID:8528
- C:\Windows\System\MTodHtQ.exe
  C:\Windows\System\MTodHtQ.exe
  2⤵
  PID:8588
- C:\Windows\System\CcnsBMQ.exe
  C:\Windows\System\CcnsBMQ.exe
  2⤵
  PID:8652
- C:\Windows\System\vPztbrT.exe
  C:\Windows\System\vPztbrT.exe
  2⤵
  PID:8716
- C:\Windows\System\iELzWtb.exe
  C:\Windows\System\iELzWtb.exe
  2⤵
  PID:8828
- C:\Windows\System\goeKZtK.exe
  C:\Windows\System\goeKZtK.exe
  2⤵
  PID:8904
- C:\Windows\System\ZgpdnDP.exe
  C:\Windows\System\ZgpdnDP.exe
  2⤵
  PID:8996
- C:\Windows\System\LEpKpyl.exe
  C:\Windows\System\LEpKpyl.exe
  2⤵
  PID:9028
- C:\Windows\System\zmDADoy.exe
  C:\Windows\System\zmDADoy.exe
  2⤵
  PID:9156
- C:\Windows\System\EOJUhUu.exe
  C:\Windows\System\EOJUhUu.exe
  2⤵
  PID:9188
- C:\Windows\System\nUvddGS.exe
  C:\Windows\System\nUvddGS.exe
  2⤵
  PID:8252
- C:\Windows\System\opKerIz.exe
  C:\Windows\System\opKerIz.exe
  2⤵
  PID:8356
- C:\Windows\System\LEcpvDG.exe
  C:\Windows\System\LEcpvDG.exe
  2⤵
  PID:8608
- C:\Windows\System\GAzKGGH.exe
  C:\Windows\System\GAzKGGH.exe
  2⤵
  PID:8696
- C:\Windows\System\WkqAuwF.exe
  C:\Windows\System\WkqAuwF.exe
  2⤵
  PID:8804
- C:\Windows\System\KeYQPZh.exe
  C:\Windows\System\KeYQPZh.exe
  2⤵
  PID:9012
- C:\Windows\System\cxOTbqC.exe
  C:\Windows\System\cxOTbqC.exe
  2⤵
  PID:9124
- C:\Windows\System\EHyBiGG.exe
  C:\Windows\System\EHyBiGG.exe
  2⤵
  PID:8296
- C:\Windows\System\sdzNsSq.exe
  C:\Windows\System\sdzNsSq.exe
  2⤵
  PID:8964
- C:\Windows\System\SLgRVBS.exe
  C:\Windows\System\SLgRVBS.exe
  2⤵
  PID:9068
- C:\Windows\System\CjZaWTz.exe
  C:\Windows\System\CjZaWTz.exe
  2⤵
  PID:8732
- C:\Windows\System\KXWdxcF.exe
  C:\Windows\System\KXWdxcF.exe
  2⤵
  PID:9236
- C:\Windows\System\VaINDmu.exe
  C:\Windows\System\VaINDmu.exe
  2⤵
  PID:9256
- C:\Windows\System\geaIimb.exe
  C:\Windows\System\geaIimb.exe
  2⤵
  PID:9284
- C:\Windows\System\SSFCiit.exe
  C:\Windows\System\SSFCiit.exe
  2⤵
  PID:9304
- C:\Windows\System\bXiWCRB.exe
  C:\Windows\System\bXiWCRB.exe
  2⤵
  PID:9348
- C:\Windows\System\OJyTlAQ.exe
  C:\Windows\System\OJyTlAQ.exe
  2⤵
  PID:9376
- C:\Windows\System\vuOJxra.exe
  C:\Windows\System\vuOJxra.exe
  2⤵
  PID:9404
- C:\Windows\System\EgGNKLa.exe
  C:\Windows\System\EgGNKLa.exe
  2⤵
  PID:9432
- C:\Windows\System\zNRTQLX.exe
  C:\Windows\System\zNRTQLX.exe
  2⤵
  PID:9448
- C:\Windows\System\diNPRdv.exe
  C:\Windows\System\diNPRdv.exe
  2⤵
  PID:9488
- C:\Windows\System\Rayrxag.exe
  C:\Windows\System\Rayrxag.exe
  2⤵
  PID:9528
- C:\Windows\System\reuWbsb.exe
  C:\Windows\System\reuWbsb.exe
  2⤵
  PID:9556
- C:\Windows\System\oGOaFVT.exe
  C:\Windows\System\oGOaFVT.exe
  2⤵
  PID:9584
- C:\Windows\System\SJYFDBF.exe
  C:\Windows\System\SJYFDBF.exe
  2⤵
  PID:9612
- C:\Windows\System\jakashO.exe
  C:\Windows\System\jakashO.exe
  2⤵
  PID:9628
- C:\Windows\System\UXoCFIf.exe
  C:\Windows\System\UXoCFIf.exe
  2⤵
  PID:9656
- C:\Windows\System\FtxPPIe.exe
  C:\Windows\System\FtxPPIe.exe
  2⤵
  PID:9672
- C:\Windows\System\lKFJolJ.exe
  C:\Windows\System\lKFJolJ.exe
  2⤵
  PID:9708
- C:\Windows\System\QhqzbKJ.exe
  C:\Windows\System\QhqzbKJ.exe
  2⤵
  PID:9728
- C:\Windows\System\HUfXgTS.exe
  C:\Windows\System\HUfXgTS.exe
  2⤵
  PID:9776
- C:\Windows\System\XVrJgBl.exe
  C:\Windows\System\XVrJgBl.exe
  2⤵
  PID:9808
- C:\Windows\System\KwXdPMs.exe
  C:\Windows\System\KwXdPMs.exe
  2⤵
  PID:9836
- C:\Windows\System\IDGIvQV.exe
  C:\Windows\System\IDGIvQV.exe
  2⤵
  PID:9852
- C:\Windows\System\cixryLC.exe
  C:\Windows\System\cixryLC.exe
  2⤵
  PID:9888
- C:\Windows\System\AnNeGGL.exe
  C:\Windows\System\AnNeGGL.exe
  2⤵
  PID:9912
- C:\Windows\System\AAReZHu.exe
  C:\Windows\System\AAReZHu.exe
  2⤵
  PID:9936
- C:\Windows\System\ZshHLln.exe
  C:\Windows\System\ZshHLln.exe
  2⤵
  PID:9964
- C:\Windows\System\WKbQUkf.exe
  C:\Windows\System\WKbQUkf.exe
  2⤵
  PID:10000
- C:\Windows\System\qAaHfhb.exe
  C:\Windows\System\qAaHfhb.exe
  2⤵
  PID:10024
- C:\Windows\System\SyVwqyr.exe
  C:\Windows\System\SyVwqyr.exe
  2⤵
  PID:10048
- C:\Windows\System\xwMIqmD.exe
  C:\Windows\System\xwMIqmD.exe
  2⤵
  PID:10076
- C:\Windows\System\RtxFyqB.exe
  C:\Windows\System\RtxFyqB.exe
  2⤵
  PID:10104
- C:\Windows\System\WanJkeZ.exe
  C:\Windows\System\WanJkeZ.exe
  2⤵
  PID:10136
- C:\Windows\System\vHqKcWN.exe
  C:\Windows\System\vHqKcWN.exe
  2⤵
  PID:10160
- C:\Windows\System\WYxXQjo.exe
  C:\Windows\System\WYxXQjo.exe
  2⤵
  PID:10188
- C:\Windows\System\cDLUbcw.exe
  C:\Windows\System\cDLUbcw.exe
  2⤵
  PID:10224
- C:\Windows\System\ICNbIKZ.exe
  C:\Windows\System\ICNbIKZ.exe
  2⤵
  PID:9080
- C:\Windows\System\rGqOGXh.exe
  C:\Windows\System\rGqOGXh.exe
  2⤵
  PID:9224
- C:\Windows\System\UDgSkjY.exe
  C:\Windows\System\UDgSkjY.exe
  2⤵
  PID:9280
- C:\Windows\System\oNsIBYv.exe
  C:\Windows\System\oNsIBYv.exe
  2⤵
  PID:9400
- C:\Windows\System\lBqqSQo.exe
  C:\Windows\System\lBqqSQo.exe
  2⤵
  PID:9428
- C:\Windows\System\TQIPASa.exe
  C:\Windows\System\TQIPASa.exe
  2⤵
  PID:9480
- C:\Windows\System\ZIyrvJg.exe
  C:\Windows\System\ZIyrvJg.exe
  2⤵
  PID:9544
- C:\Windows\System\YoSIJIb.exe
  C:\Windows\System\YoSIJIb.exe
  2⤵
  PID:9596
- C:\Windows\System\XkTxFyp.exe
  C:\Windows\System\XkTxFyp.exe
  2⤵
  PID:9620
- C:\Windows\System\JYyQsZx.exe
  C:\Windows\System\JYyQsZx.exe
  2⤵
  PID:9720
- C:\Windows\System\NzgsLqK.exe
  C:\Windows\System\NzgsLqK.exe
  2⤵
  PID:9876
- C:\Windows\System\wGbrtrw.exe
  C:\Windows\System\wGbrtrw.exe
  2⤵
  PID:9928
- C:\Windows\System\veWuCUx.exe
  C:\Windows\System\veWuCUx.exe
  2⤵
  PID:10020
- C:\Windows\System\cMcrTuQ.exe
  C:\Windows\System\cMcrTuQ.exe
  2⤵
  PID:10088
- C:\Windows\System\OEQEAtQ.exe
  C:\Windows\System\OEQEAtQ.exe
  2⤵
  PID:10152
- C:\Windows\System\VByFKiV.exe
  C:\Windows\System\VByFKiV.exe
  2⤵
  PID:10216
- C:\Windows\System\MWKgAxp.exe
  C:\Windows\System\MWKgAxp.exe
  2⤵
  PID:9272
- C:\Windows\System\EJzyDsQ.exe
  C:\Windows\System\EJzyDsQ.exe
  2⤵
  PID:2936
- C:\Windows\System\cEXVpCB.exe
  C:\Windows\System\cEXVpCB.exe
  2⤵
  PID:9668
- C:\Windows\System\cMsgacU.exe
  C:\Windows\System\cMsgacU.exe
  2⤵
  PID:9580
- C:\Windows\System\GQngVoi.exe
  C:\Windows\System\GQngVoi.exe
  2⤵
  PID:9864
- C:\Windows\System\VqjuXKD.exe
  C:\Windows\System\VqjuXKD.exe
  2⤵
  PID:10064
- C:\Windows\System\zKApksZ.exe
  C:\Windows\System\zKApksZ.exe
  2⤵
  PID:10172
- C:\Windows\System\rKYsspP.exe
  C:\Windows\System\rKYsspP.exe
  2⤵
  PID:9360
- C:\Windows\System\ZqPCciz.exe
  C:\Windows\System\ZqPCciz.exe
  2⤵
  PID:9724
- C:\Windows\System\KrOGdoR.exe
  C:\Windows\System\KrOGdoR.exe
  2⤵
  PID:9768
- C:\Windows\System\IiFPHEU.exe
  C:\Windows\System\IiFPHEU.exe
  2⤵
  PID:8576
- C:\Windows\System\GIgaFuB.exe
  C:\Windows\System\GIgaFuB.exe
  2⤵
  PID:10124
- C:\Windows\System\yjLLdvb.exe
  C:\Windows\System\yjLLdvb.exe
  2⤵
  PID:4080
- C:\Windows\System\ucaYxQI.exe
  C:\Windows\System\ucaYxQI.exe
  2⤵
  PID:10268
- C:\Windows\System\FubBwJL.exe
  C:\Windows\System\FubBwJL.exe
  2⤵
  PID:10316
- C:\Windows\System\QtkTjIL.exe
  C:\Windows\System\QtkTjIL.exe
  2⤵
  PID:10340
- C:\Windows\System\okkXxEf.exe
  C:\Windows\System\okkXxEf.exe
  2⤵
  PID:10360
- C:\Windows\System\VqdXryz.exe
  C:\Windows\System\VqdXryz.exe
  2⤵
  PID:10388
- C:\Windows\System\IBlMvaM.exe
  C:\Windows\System\IBlMvaM.exe
  2⤵
  PID:10416
- C:\Windows\System\QtakGTT.exe
  C:\Windows\System\QtakGTT.exe
  2⤵
  PID:10432
- C:\Windows\System\iaJlRfH.exe
  C:\Windows\System\iaJlRfH.exe
  2⤵
  PID:10476
- C:\Windows\System\xREFywY.exe
  C:\Windows\System\xREFywY.exe
  2⤵
  PID:10500
- C:\Windows\System\VnewMmm.exe
  C:\Windows\System\VnewMmm.exe
  2⤵
  PID:10528
- C:\Windows\System\rgdHrpc.exe
  C:\Windows\System\rgdHrpc.exe
  2⤵
  PID:10548
- C:\Windows\System\tpjCiyo.exe
  C:\Windows\System\tpjCiyo.exe
  2⤵
  PID:10580
- C:\Windows\System\SKNxcwN.exe
  C:\Windows\System\SKNxcwN.exe
  2⤵
  PID:10612
- C:\Windows\System\XUEBzrp.exe
  C:\Windows\System\XUEBzrp.exe
  2⤵
  PID:10636
- C:\Windows\System\lvMfsSw.exe
  C:\Windows\System\lvMfsSw.exe
  2⤵
  PID:10656
- C:\Windows\System\nWAIxUt.exe
  C:\Windows\System\nWAIxUt.exe
  2⤵
  PID:10672
- C:\Windows\System\SEnDMDp.exe
  C:\Windows\System\SEnDMDp.exe
  2⤵
  PID:10712
- C:\Windows\System\VWTconf.exe
  C:\Windows\System\VWTconf.exe
  2⤵
  PID:10736
- C:\Windows\System\ncsRtMV.exe
  C:\Windows\System\ncsRtMV.exe
  2⤵
  PID:10760
- C:\Windows\System\eYUEYPZ.exe
  C:\Windows\System\eYUEYPZ.exe
  2⤵
  PID:10804
- C:\Windows\System\VovoAaq.exe
  C:\Windows\System\VovoAaq.exe
  2⤵
  PID:10848
- C:\Windows\System\kNYJrnZ.exe
  C:\Windows\System\kNYJrnZ.exe
  2⤵
  PID:10864
- C:\Windows\System\eHqhTjI.exe
  C:\Windows\System\eHqhTjI.exe
  2⤵
  PID:10904
- C:\Windows\System\gIPgryY.exe
  C:\Windows\System\gIPgryY.exe
  2⤵
  PID:10932
- C:\Windows\System\rKXDXaE.exe
  C:\Windows\System\rKXDXaE.exe
  2⤵
  PID:10960
- C:\Windows\System\JTFJdvI.exe
  C:\Windows\System\JTFJdvI.exe
  2⤵
  PID:10988
- C:\Windows\System\JSdDSYi.exe
  C:\Windows\System\JSdDSYi.exe
  2⤵
  PID:11016
- C:\Windows\System\xZpZcEY.exe
  C:\Windows\System\xZpZcEY.exe
  2⤵
  PID:11044
- C:\Windows\System\JcyUlvB.exe
  C:\Windows\System\JcyUlvB.exe
  2⤵
  PID:11060
- C:\Windows\System\ZdYyMMZ.exe
  C:\Windows\System\ZdYyMMZ.exe
  2⤵
  PID:11088
- C:\Windows\System\AdrnKxr.exe
  C:\Windows\System\AdrnKxr.exe
  2⤵
  PID:11128
- C:\Windows\System\ZpawoMT.exe
  C:\Windows\System\ZpawoMT.exe
  2⤵
  PID:11144
- C:\Windows\System\nGfGJzu.exe
  C:\Windows\System\nGfGJzu.exe
  2⤵
  PID:11172
- C:\Windows\System\ExPCJTf.exe
  C:\Windows\System\ExPCJTf.exe
  2⤵
  PID:11212
- C:\Windows\System\BYZNzpR.exe
  C:\Windows\System\BYZNzpR.exe
  2⤵
  PID:11228
- C:\Windows\System\gqnGUdN.exe
  C:\Windows\System\gqnGUdN.exe
  2⤵
  PID:11256
- C:\Windows\System\hqBrIiZ.exe
  C:\Windows\System\hqBrIiZ.exe
  2⤵
  PID:10296
- C:\Windows\System\yensvrI.exe
  C:\Windows\System\yensvrI.exe
  2⤵
  PID:10324
- C:\Windows\System\VAByfRy.exe
  C:\Windows\System\VAByfRy.exe
  2⤵
  PID:10408
- C:\Windows\System\tUbUFas.exe
  C:\Windows\System\tUbUFas.exe
  2⤵
  PID:1976
- C:\Windows\System\njDvSyQ.exe
  C:\Windows\System\njDvSyQ.exe
  2⤵
  PID:1652
- C:\Windows\System\AblZSkO.exe
  C:\Windows\System\AblZSkO.exe
  2⤵
  PID:10588
- C:\Windows\System\wdGISty.exe
  C:\Windows\System\wdGISty.exe
  2⤵
  PID:10624
- C:\Windows\System\WhutBVR.exe
  C:\Windows\System\WhutBVR.exe
  2⤵
  PID:10696
- C:\Windows\System\TeFrPtM.exe
  C:\Windows\System\TeFrPtM.exe
  2⤵
  PID:10812
- C:\Windows\System\ILbQhrh.exe
  C:\Windows\System\ILbQhrh.exe
  2⤵
  PID:10836
- C:\Windows\System\EgbKTlZ.exe
  C:\Windows\System\EgbKTlZ.exe
  2⤵
  PID:10880
- C:\Windows\System\gFBlfnR.exe
  C:\Windows\System\gFBlfnR.exe
  2⤵
  PID:10952
- C:\Windows\System\XjteGAY.exe
  C:\Windows\System\XjteGAY.exe
  2⤵
  PID:11012
- C:\Windows\System\AGilSnV.exe
  C:\Windows\System\AGilSnV.exe
  2⤵
  PID:11084
- C:\Windows\System\bLJjHlf.exe
  C:\Windows\System\bLJjHlf.exe
  2⤵
  PID:11120
- C:\Windows\System\zBYBZfb.exe
  C:\Windows\System\zBYBZfb.exe
  2⤵
  PID:11168
- C:\Windows\System\ekvmUiD.exe
  C:\Windows\System\ekvmUiD.exe
  2⤵
  PID:11224
- C:\Windows\System\gelNqhL.exe
  C:\Windows\System\gelNqhL.exe
  2⤵
  PID:10424
- C:\Windows\System\SiHOVyA.exe
  C:\Windows\System\SiHOVyA.exe
  2⤵
  PID:10544
- C:\Windows\System\IOHlwqi.exe
  C:\Windows\System\IOHlwqi.exe
  2⤵
  PID:10648
- C:\Windows\System\DMVFTJb.exe
  C:\Windows\System\DMVFTJb.exe
  2⤵
  PID:1988
- C:\Windows\System\iEUxBaz.exe
  C:\Windows\System\iEUxBaz.exe
  2⤵
  PID:10844
- C:\Windows\System\GeqtfvL.exe
  C:\Windows\System\GeqtfvL.exe
  2⤵
  PID:11004
- C:\Windows\System\qQsXkno.exe
  C:\Windows\System\qQsXkno.exe
  2⤵
  PID:11208
- C:\Windows\System\LaIqmGm.exe
  C:\Windows\System\LaIqmGm.exe
  2⤵
  PID:10488
- C:\Windows\System\HeMxwhV.exe
  C:\Windows\System\HeMxwhV.exe
  2⤵
  PID:10692
- C:\Windows\System\ZPmYsdv.exe
  C:\Windows\System\ZPmYsdv.exe
  2⤵
  PID:10984
- C:\Windows\System\HoyjVAm.exe
  C:\Windows\System\HoyjVAm.exe
  2⤵
  PID:10348
- C:\Windows\System\sZxkgbM.exe
  C:\Windows\System\sZxkgbM.exe
  2⤵
  PID:4924
- C:\Windows\System\MYeYrXE.exe
  C:\Windows\System\MYeYrXE.exe
  2⤵
  PID:11268
- C:\Windows\System\CzEsCQE.exe
  C:\Windows\System\CzEsCQE.exe
  2⤵
  PID:11304
- C:\Windows\System\lQbISjJ.exe
  C:\Windows\System\lQbISjJ.exe
  2⤵
  PID:11332
- C:\Windows\System\WVnGdZD.exe
  C:\Windows\System\WVnGdZD.exe
  2⤵
  PID:11360
- C:\Windows\System\togIMft.exe
  C:\Windows\System\togIMft.exe
  2⤵
  PID:11384
- C:\Windows\System\qwAifyp.exe
  C:\Windows\System\qwAifyp.exe
  2⤵
  PID:11416
- C:\Windows\System\bdEriaG.exe
  C:\Windows\System\bdEriaG.exe
  2⤵
  PID:11444
- C:\Windows\System\YcLQBFc.exe
  C:\Windows\System\YcLQBFc.exe
  2⤵
  PID:11460
- C:\Windows\System\itkzKJB.exe
  C:\Windows\System\itkzKJB.exe
  2⤵
  PID:11500
- C:\Windows\System\jxZdisE.exe
  C:\Windows\System\jxZdisE.exe
  2⤵
  PID:11532
- C:\Windows\System\PTlSFfH.exe
  C:\Windows\System\PTlSFfH.exe
  2⤵
  PID:11560
- C:\Windows\System\YkhLJGa.exe
  C:\Windows\System\YkhLJGa.exe
  2⤵
  PID:11584
- C:\Windows\System\XFJlAyn.exe
  C:\Windows\System\XFJlAyn.exe
  2⤵
  PID:11616
- C:\Windows\System\ctbUKoW.exe
  C:\Windows\System\ctbUKoW.exe
  2⤵
  PID:11644
- C:\Windows\System\foXkKmp.exe
  C:\Windows\System\foXkKmp.exe
  2⤵
  PID:11672
- C:\Windows\System\MhzySbM.exe
  C:\Windows\System\MhzySbM.exe
  2⤵
  PID:11692
- C:\Windows\System\TZekkHO.exe
  C:\Windows\System\TZekkHO.exe
  2⤵
  PID:11728
- C:\Windows\System\LRGAFmv.exe
  C:\Windows\System\LRGAFmv.exe
  2⤵
  PID:11756
- C:\Windows\System\mIKfDep.exe
  C:\Windows\System\mIKfDep.exe
  2⤵
  PID:11772
- C:\Windows\System\GKCUGHG.exe
  C:\Windows\System\GKCUGHG.exe
  2⤵
  PID:11812
- C:\Windows\System\AbCwZcQ.exe
  C:\Windows\System\AbCwZcQ.exe
  2⤵
  PID:11840
- C:\Windows\System\dtGGoCW.exe
  C:\Windows\System\dtGGoCW.exe
  2⤵
  PID:11864
- C:\Windows\System\bnjXMtb.exe
  C:\Windows\System\bnjXMtb.exe
  2⤵
  PID:11896
- C:\Windows\System\uISkHLK.exe
  C:\Windows\System\uISkHLK.exe
  2⤵
  PID:11912
- C:\Windows\System\zbYuqpO.exe
  C:\Windows\System\zbYuqpO.exe
  2⤵
  PID:11948
- C:\Windows\System\saIPSWs.exe
  C:\Windows\System\saIPSWs.exe
  2⤵
  PID:11980
- C:\Windows\System\BtlKAUQ.exe
  C:\Windows\System\BtlKAUQ.exe
  2⤵
  PID:12008
- C:\Windows\System\HoZPFLc.exe
  C:\Windows\System\HoZPFLc.exe
  2⤵
  PID:12024
- C:\Windows\System\iDppTkC.exe
  C:\Windows\System\iDppTkC.exe
  2⤵
  PID:12052
- C:\Windows\System\ZXpDJcq.exe
  C:\Windows\System\ZXpDJcq.exe
  2⤵
  PID:12092
- C:\Windows\System\VNBWcCD.exe
  C:\Windows\System\VNBWcCD.exe
  2⤵
  PID:12112
- C:\Windows\System\SlZyXly.exe
  C:\Windows\System\SlZyXly.exe
  2⤵
  PID:12140
- C:\Windows\System\ATglaMu.exe
  C:\Windows\System\ATglaMu.exe
  2⤵
  PID:12160
- C:\Windows\System\pccrlzG.exe
  C:\Windows\System\pccrlzG.exe
  2⤵
  PID:12208
- C:\Windows\System\VnjqaqQ.exe
  C:\Windows\System\VnjqaqQ.exe
  2⤵
  PID:12224
- C:\Windows\System\lMvouYx.exe
  C:\Windows\System\lMvouYx.exe
  2⤵
  PID:12264
- C:\Windows\System\rhDKFFf.exe
  C:\Windows\System\rhDKFFf.exe
  2⤵
  PID:11052
- C:\Windows\System\IMZIqiP.exe
  C:\Windows\System\IMZIqiP.exe
  2⤵
  PID:11320
- C:\Windows\System\DLYNorw.exe
  C:\Windows\System\DLYNorw.exe
  2⤵
  PID:11392
- C:\Windows\System\WZvZCsC.exe
  C:\Windows\System\WZvZCsC.exe
  2⤵
  PID:11456
- C:\Windows\System\oIvOMTx.exe
  C:\Windows\System\oIvOMTx.exe
  2⤵
  PID:11492
- C:\Windows\System\YKKkqFo.exe
  C:\Windows\System\YKKkqFo.exe
  2⤵
  PID:11576
- C:\Windows\System\WdHmHRE.exe
  C:\Windows\System\WdHmHRE.exe
  2⤵
  PID:11660
- C:\Windows\System\ehagqdP.exe
  C:\Windows\System\ehagqdP.exe
  2⤵
  PID:11724
- C:\Windows\System\KuikVta.exe
  C:\Windows\System\KuikVta.exe
  2⤵
  PID:2436
- C:\Windows\System\lUhEiXX.exe
  C:\Windows\System\lUhEiXX.exe
  2⤵
  PID:11808
- C:\Windows\System\LemCRtm.exe
  C:\Windows\System\LemCRtm.exe
  2⤵
  PID:452
- C:\Windows\System\njLNzmW.exe
  C:\Windows\System\njLNzmW.exe
  2⤵
  PID:11892
- C:\Windows\System\jSLkhaP.exe
  C:\Windows\System\jSLkhaP.exe
  2⤵
  PID:11976
- C:\Windows\System\GFmyuac.exe
  C:\Windows\System\GFmyuac.exe
  2⤵
  PID:12040
- C:\Windows\System\zIfPtbX.exe
  C:\Windows\System\zIfPtbX.exe
  2⤵
  PID:12100
- C:\Windows\System\SwhcpHT.exe
  C:\Windows\System\SwhcpHT.exe
  2⤵
  PID:12192
- C:\Windows\System\lkoxtvE.exe
  C:\Windows\System\lkoxtvE.exe
  2⤵
  PID:12248
- C:\Windows\System\HlgaLmh.exe
  C:\Windows\System\HlgaLmh.exe
  2⤵
  PID:11452
- C:\Windows\System\HxZYvXr.exe
  C:\Windows\System\HxZYvXr.exe
  2⤵
  PID:11640
- C:\Windows\System\SxUsoXL.exe
  C:\Windows\System\SxUsoXL.exe
  2⤵
  PID:11712
- C:\Windows\System\vTrvDQB.exe
  C:\Windows\System\vTrvDQB.exe
  2⤵
  PID:11856
- C:\Windows\System\JSqMQtz.exe
  C:\Windows\System\JSqMQtz.exe
  2⤵
  PID:12004
- C:\Windows\System\YyvFLGY.exe
  C:\Windows\System\YyvFLGY.exe
  2⤵
  PID:12236
- C:\Windows\System\CPhwsME.exe
  C:\Windows\System\CPhwsME.exe
  2⤵
  PID:11748
- C:\Windows\System\BMYFiUW.exe
  C:\Windows\System\BMYFiUW.exe
  2⤵
  PID:12168
- C:\Windows\System\lkoSoMn.exe
  C:\Windows\System\lkoSoMn.exe
  2⤵
  PID:11968
- C:\Windows\System\rEtZiCu.exe
  C:\Windows\System\rEtZiCu.exe
  2⤵
  PID:12312
- C:\Windows\System\RqhFRVo.exe
  C:\Windows\System\RqhFRVo.exe
  2⤵
  PID:12340
- C:\Windows\System\BXRGKhm.exe
  C:\Windows\System\BXRGKhm.exe
  2⤵
  PID:12372
- C:\Windows\System\dlFWcNc.exe
  C:\Windows\System\dlFWcNc.exe
  2⤵
  PID:12408
- C:\Windows\System\hdnOhVN.exe
  C:\Windows\System\hdnOhVN.exe
  2⤵
  PID:12432
- C:\Windows\System\huoEYDo.exe
  C:\Windows\System\huoEYDo.exe
  2⤵
  PID:12452
- C:\Windows\System\eTxhCqK.exe
  C:\Windows\System\eTxhCqK.exe
  2⤵
  PID:12504
- C:\Windows\System\vZarEVo.exe
  C:\Windows\System\vZarEVo.exe
  2⤵
  PID:12524
- C:\Windows\System\iKKSvpJ.exe
  C:\Windows\System\iKKSvpJ.exe
  2⤵
  PID:12568
- C:\Windows\System\wywYhED.exe
  C:\Windows\System\wywYhED.exe
  2⤵
  PID:12592
- C:\Windows\System\mMatdAt.exe
  C:\Windows\System\mMatdAt.exe
  2⤵
  PID:12620
- C:\Windows\System\jyGzeIs.exe
  C:\Windows\System\jyGzeIs.exe
  2⤵
  PID:12652
- C:\Windows\System\IVocCee.exe
  C:\Windows\System\IVocCee.exe
  2⤵
  PID:12680
- C:\Windows\System\UgAcSII.exe
  C:\Windows\System\UgAcSII.exe
  2⤵
  PID:12708
- C:\Windows\System\gCrJvEo.exe
  C:\Windows\System\gCrJvEo.exe
  2⤵
  PID:12736
- C:\Windows\System\EwFfNyh.exe
  C:\Windows\System\EwFfNyh.exe
  2⤵
  PID:12764
- C:\Windows\System\pYAungb.exe
  C:\Windows\System\pYAungb.exe
  2⤵
  PID:12780
- C:\Windows\System\lSvyGBj.exe
  C:\Windows\System\lSvyGBj.exe
  2⤵
  PID:12812
- C:\Windows\System\syFmJvT.exe
  C:\Windows\System\syFmJvT.exe
  2⤵
  PID:12836
- C:\Windows\System\cheLHJL.exe
  C:\Windows\System\cheLHJL.exe
  2⤵
  PID:12860
- C:\Windows\System\ifGTvKH.exe
  C:\Windows\System\ifGTvKH.exe
  2⤵
  PID:12904
- C:\Windows\System\iFYojMS.exe
  C:\Windows\System\iFYojMS.exe
  2⤵
  PID:12920
- C:\Windows\System\BEWWFae.exe
  C:\Windows\System\BEWWFae.exe
  2⤵
  PID:12952
- C:\Windows\System\vJduEsF.exe
  C:\Windows\System\vJduEsF.exe
  2⤵
  PID:12988
- C:\Windows\System\snfytIe.exe
  C:\Windows\System\snfytIe.exe
  2⤵
  PID:13016
- C:\Windows\System\YtZxKdX.exe
  C:\Windows\System\YtZxKdX.exe
  2⤵
  PID:13032
- C:\Windows\System\ceXWgTd.exe
  C:\Windows\System\ceXWgTd.exe
  2⤵
  PID:13056
- C:\Windows\System\TysnAtR.exe
  C:\Windows\System\TysnAtR.exe
  2⤵
  PID:13088
- C:\Windows\System\QQzkOSg.exe
  C:\Windows\System\QQzkOSg.exe
  2⤵
  PID:13136
- C:\Windows\System\bKkYYXN.exe
  C:\Windows\System\bKkYYXN.exe
  2⤵
  PID:13160
- C:\Windows\System\inLsdKZ.exe
  C:\Windows\System\inLsdKZ.exe
  2⤵
  PID:13200
- C:\Windows\System\MKOJxei.exe
  C:\Windows\System\MKOJxei.exe
  2⤵
  PID:13228
- C:\Windows\System\IIAqVDg.exe
  C:\Windows\System\IIAqVDg.exe
  2⤵
  PID:13248
- C:\Windows\System\WIgTHJm.exe
  C:\Windows\System\WIgTHJm.exe
  2⤵
  PID:13264
- C:\Windows\System\unpufcn.exe
  C:\Windows\System\unpufcn.exe
  2⤵
  PID:13304
- C:\Windows\System\RQTNKTW.exe
  C:\Windows\System\RQTNKTW.exe
  2⤵
  PID:11552
- C:\Windows\System\aysOyoC.exe
  C:\Windows\System\aysOyoC.exe
  2⤵
  PID:12440
- C:\Windows\System\OcjDtCr.exe
  C:\Windows\System\OcjDtCr.exe
  2⤵
  PID:12484
- C:\Windows\System\MXNhlht.exe
  C:\Windows\System\MXNhlht.exe
  2⤵
  PID:12584
- C:\Windows\System\OpAcNLx.exe
  C:\Windows\System\OpAcNLx.exe
  2⤵
  PID:12604
- C:\Windows\System\QZwoXsu.exe
  C:\Windows\System\QZwoXsu.exe
  2⤵
  PID:12700
- C:\Windows\System\eztWUwf.exe
  C:\Windows\System\eztWUwf.exe
  2⤵
  PID:12752
- C:\Windows\System\bSQZriG.exe
  C:\Windows\System\bSQZriG.exe
  2⤵
  PID:12884
- C:\Windows\System\wjIAfSg.exe
  C:\Windows\System\wjIAfSg.exe
  2⤵
  PID:12900
- C:\Windows\System\aIQzbfK.exe
  C:\Windows\System\aIQzbfK.exe
  2⤵
  PID:12972
- C:\Windows\System\UeqJutY.exe
  C:\Windows\System\UeqJutY.exe
  2⤵
  PID:13048
- C:\Windows\System\hIfpTZb.exe
  C:\Windows\System\hIfpTZb.exe
  2⤵
  PID:13104
- C:\Windows\System\VmvYssP.exe
  C:\Windows\System\VmvYssP.exe
  2⤵
  PID:13156
- C:\Windows\System\AFXxyIo.exe
  C:\Windows\System\AFXxyIo.exe
  2⤵
  PID:13296
- C:\Windows\System\etCpKDQ.exe
  C:\Windows\System\etCpKDQ.exe
  2⤵
  PID:12328
- C:\Windows\System\FkjmYTu.exe
  C:\Windows\System\FkjmYTu.exe
  2⤵
  PID:12552
- C:\Windows\System\EzcGPwB.exe
  C:\Windows\System\EzcGPwB.exe
  2⤵
  PID:12728
- C:\Windows\System\znjBGkf.exe
  C:\Windows\System\znjBGkf.exe
  2⤵
  PID:12916
- C:\Windows\System\pKPQDzU.exe
  C:\Windows\System\pKPQDzU.exe
  2⤵
  PID:13008
- C:\Windows\System\phxqTxj.exe
  C:\Windows\System\phxqTxj.exe
  2⤵
  PID:12128
- C:\Windows\System\KChZCzn.exe
  C:\Windows\System\KChZCzn.exe
  2⤵
  PID:12480
- C:\Windows\System\hCHKmEp.exe
  C:\Windows\System\hCHKmEp.exe
  2⤵
  PID:12888
- C:\Windows\System\hqJIgCB.exe
  C:\Windows\System\hqJIgCB.exe
  2⤵
  PID:13324
- C:\Windows\System\esoYVWh.exe
  C:\Windows\System\esoYVWh.exe
  2⤵
  PID:13368
- C:\Windows\System\pmLWTJl.exe
  C:\Windows\System\pmLWTJl.exe
  2⤵
  PID:13396
- C:\Windows\System\KgPgwvb.exe
  C:\Windows\System\KgPgwvb.exe
  2⤵
  PID:13420
- C:\Windows\System\btJQhmH.exe
  C:\Windows\System\btJQhmH.exe
  2⤵
  PID:13452
- C:\Windows\System\ArxFDFp.exe
  C:\Windows\System\ArxFDFp.exe
  2⤵
  PID:13484
- C:\Windows\System\vGASoKc.exe
  C:\Windows\System\vGASoKc.exe
  2⤵
  PID:13512
- C:\Windows\System\pBWPSrA.exe
  C:\Windows\System\pBWPSrA.exe
  2⤵
  PID:13540
- C:\Windows\System\TrPOdzD.exe
  C:\Windows\System\TrPOdzD.exe
  2⤵
  PID:13568
- C:\Windows\System\RsrOdXB.exe
  C:\Windows\System\RsrOdXB.exe
  2⤵
  PID:13608
- C:\Windows\System\TLvBIHP.exe
  C:\Windows\System\TLvBIHP.exe
  2⤵
  PID:13648
- C:\Windows\System\GAxEuDN.exe
  C:\Windows\System\GAxEuDN.exe
  2⤵
  PID:13676
- C:\Windows\System\KwIwulX.exe
  C:\Windows\System\KwIwulX.exe
  2⤵
  PID:13704
- C:\Windows\System\oFHyfCN.exe
  C:\Windows\System\oFHyfCN.exe
  2⤵
  PID:13764
- C:\Windows\System\BbSDtHU.exe
  C:\Windows\System\BbSDtHU.exe
  2⤵
  PID:13780
- C:\Windows\System\ggwJtsV.exe
  C:\Windows\System\ggwJtsV.exe
  2⤵
  PID:13828
- C:\Windows\System\YMuMQAa.exe
  C:\Windows\System\YMuMQAa.exe
  2⤵
  PID:13864
- C:\Windows\System\TWuKDqO.exe
  C:\Windows\System\TWuKDqO.exe
  2⤵
  PID:13892
- C:\Windows\System\Tekqpma.exe
  C:\Windows\System\Tekqpma.exe
  2⤵
  PID:13916
- C:\Windows\System\mWwVNbg.exe
  C:\Windows\System\mWwVNbg.exe
  2⤵
  PID:13956
- C:\Windows\System\bKuDoNH.exe
  C:\Windows\System\bKuDoNH.exe
  2⤵
  PID:13984
- C:\Windows\System\hyeahCY.exe
  C:\Windows\System\hyeahCY.exe
  2⤵
  PID:14016
- C:\Windows\System\DYqIwLF.exe
  C:\Windows\System\DYqIwLF.exe
  2⤵
  PID:14052
- C:\Windows\System\FRkvhCW.exe
  C:\Windows\System\FRkvhCW.exe
  2⤵
  PID:14068
- C:\Windows\System\nLBrkYc.exe
  C:\Windows\System\nLBrkYc.exe
  2⤵
  PID:14108
- C:\Windows\System\zwHweXU.exe
  C:\Windows\System\zwHweXU.exe
  2⤵
  PID:14128
- C:\Windows\System\oYGTTmD.exe
  C:\Windows\System\oYGTTmD.exe
  2⤵
  PID:14148
- C:\Windows\System\KpeIaBA.exe
  C:\Windows\System\KpeIaBA.exe
  2⤵
  PID:14192
- C:\Windows\System\HJduZZo.exe
  C:\Windows\System\HJduZZo.exe
  2⤵
  PID:14216
- C:\Windows\System\NuzGvVU.exe
  C:\Windows\System\NuzGvVU.exe
  2⤵
  PID:14248
- C:\Windows\System\PjcwWfa.exe
  C:\Windows\System\PjcwWfa.exe
  2⤵
  PID:14272
- C:\Windows\System\DZXnGDH.exe
  C:\Windows\System\DZXnGDH.exe
  2⤵
  PID:14304
- C:\Windows\System\LeToGFw.exe
  C:\Windows\System\LeToGFw.exe
  2⤵
  PID:14328
- C:\Windows\System\eRwwdoO.exe
  C:\Windows\System\eRwwdoO.exe
  2⤵
  PID:1420
- C:\Windows\System\etqwsWB.exe
  C:\Windows\System\etqwsWB.exe
  2⤵
  PID:13012
- C:\Windows\System\oAlrBdm.exe
  C:\Windows\System\oAlrBdm.exe
  2⤵
  PID:13412
- C:\Windows\System\BxWgbOC.exe
  C:\Windows\System\BxWgbOC.exe
  2⤵
  PID:13472
- C:\Windows\System\HIvllJZ.exe
  C:\Windows\System\HIvllJZ.exe
  2⤵
  PID:13536
- C:\Windows\System\SYWzpIP.exe
  C:\Windows\System\SYWzpIP.exe
  2⤵
  PID:13592
- C:\Windows\System\xnpMZQK.exe
  C:\Windows\System\xnpMZQK.exe
  2⤵
  PID:13732
- C:\Windows\System\NTcpqPs.exe
  C:\Windows\System\NTcpqPs.exe
  2⤵
  PID:13820
- C:\Windows\System\uNUOEnB.exe
  C:\Windows\System\uNUOEnB.exe
  2⤵
  PID:13944
- C:\Windows\System\ifIIxBI.exe
  C:\Windows\System\ifIIxBI.exe
  2⤵
  PID:14036
- C:\Windows\System\XSCWIsH.exe
  C:\Windows\System\XSCWIsH.exe
  2⤵
  PID:14080
- C:\Windows\System\XRTUgLi.exe
  C:\Windows\System\XRTUgLi.exe
  2⤵
  PID:14240
- C:\Windows\System\CtrcOWe.exe
  C:\Windows\System\CtrcOWe.exe
  2⤵
  PID:14284
- C:\Windows\System\tImrkrH.exe
  C:\Windows\System\tImrkrH.exe
  2⤵
  PID:3448
- C:\Windows\System\aQLivtZ.exe
  C:\Windows\System\aQLivtZ.exe
  2⤵
  PID:336
- C:\Windows\System\eZTlghX.exe
  C:\Windows\System\eZTlghX.exe
  2⤵
  PID:13620
- C:\Windows\System\MDIrSQg.exe
  C:\Windows\System\MDIrSQg.exe
  2⤵
  PID:13776
- C:\Windows\System\lrHpjwk.exe
  C:\Windows\System\lrHpjwk.exe
  2⤵
  PID:13976

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 952 -s 2188
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

COYiuGP.exe

Path C:\Windows\System\COYiuGP.exe
Size 2.3MB
SHA256 4e4316675c60bd5fbd040d07349c02b6d3caa609f6a191aca46dd4dd0121cd1e
MD5 91a0fadcda76a29cd9e531f03e1f0dee
SHA1 4081806a1fdfdd5a9380ad0b0541821fce32123f
SHA512 69464a732d7b361c21d4e42b2a8b1d3767abbed4a8ccb412e2edc5f31df219cebe6f4fdbc37af4a2199f8ad348ae33d48e7a3956351e708a4d8bd3ff0bd74fa8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZj:BemTLkNdfE0pZrQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

DHfiURx.exe

Path C:\Windows\System\DHfiURx.exe
Size 2.3MB
SHA256 183404b41abe647020c8313fa8e963904595a03bcef5086d5029855ce2b4933b
MD5 82be5c4e66cc52cb68b98ab0e8af1b87
SHA1 95a78b642c25d3a511f12afd38a8d25203d9445b
SHA512 fd277d302335aaa8a6e56b380323c98cb1c1a486f8cb744cb28a8b3a330ae28b2131b2044a8406aa4c9c253cde1e88f4d417591bd3fda7b953befcea943b2573
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZG:BemTLkNdfE0pZrQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

FmKpGHS.exe

Path C:\Windows\System\FmKpGHS.exe
Size 2.3MB
SHA256 25bf261fb78259275706afc66eec91241f53a933b7b559124814f78d5b138380
MD5 485e74df31bf6b475794ac78ea389a00
SHA1 ea33b0ae37e00702125813227b0e3a2e01a69157
SHA512 ef7524d879f109efdbb60d65d2b25ae0d4a4b7a7b74e0820d44c5bb7dacac37b978ffc774778ee0195e4c35c43a31270ebd84a1c77a17d7bac3c40aa018c79d4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZ5:BemTLkNdfE0pZrQt
MD5 SHA1 SHA512 SSDEEP

Submit Download

GDSEkgx.exe

Path C:\Windows\System\GDSEkgx.exe
Size 2.3MB
SHA256 6023424f986619a16c2107824f9a8bb63867b451b46cdbd721e1141da4b582bf
MD5 bf0be9535bc574b5269b70612ac9d83e
SHA1 20db4971aaea8cf6796079d82449ed8ff61bc419
SHA512 80164aecca07b2b09dd19c54b1da3395e01bcc18927f61b79feb45d468804b183c788dea942ce4c70961171d55876c761e27e13f9110127b2e3f0b412237a7be
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZ5:BemTLkNdfE0pZrQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

HEDQwRf.exe

Path C:\Windows\System\HEDQwRf.exe
Size 2.3MB
SHA256 945e8719b9de88c96bfe10bb91077d5a3f57424aaaffc6f20302d2094cb5756a
MD5 a6a1cb683d84619a2e3476a26361958b
SHA1 ba0c2095953deca32b4bdbbc9049c7d86887667b
SHA512 46bdefaab6cd30e1c6f35e6c0133f445d922bcb87de6f63b5043672c0be962de9fcd1dd456438042adf195ed9eb2ea3c8d9a1b40064a0aee982dad26194bde81
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZi:BemTLkNdfE0pZrQG
MD5 SHA1 SHA512 SSDEEP

Submit Download

IcTnclp.exe

Path C:\Windows\System\IcTnclp.exe
Size 2.3MB
SHA256 07a3bc218f271bffbd656099ba555fc96818a6997bc1890f9bed8a507be243fe
MD5 f452091ec067ad81d6b00dcde29492b7
SHA1 10ee52f2da24d077276a41aa3772a71dacf829b7
SHA512 eff285f1e858ebe33aafd3a55cd5ee51dea2a26a50760395dd752901d4ed542006c7ea122dce5425450a1f3b3cf87b900fefe3aa9b324a0030678bc9cbb913cc
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZP:BemTLkNdfE0pZrQz
MD5 SHA1 SHA512 SSDEEP

Submit Download

IwtjsmK.exe

Path C:\Windows\System\IwtjsmK.exe
Size 2.3MB
SHA256 93eab1c6c19b19fe4399199d5ce0cf53ecf188b0f6f6cab00f1d8ee92490bf3d
MD5 73e1462c0579900eb877f4268f562a09
SHA1 1897711a0b2b036041776362c675a0db927ceeba
SHA512 fe1584f38ab78473727fe02009bec3045d62f7aad2cc2ed63102456d7631938fec9af8526b3c1d2e5957c7da58435e4128d532b9614b6672ee9f45679362e773
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZh:BemTLkNdfE0pZrQt
MD5 SHA1 SHA512 SSDEEP

Submit Download

LMwQUXH.exe

Path C:\Windows\System\LMwQUXH.exe
Size 2.3MB
SHA256 a6c5505a72a2c458f1ea6a92f039b45707f1bc48f50506211e151e9d506bb101
MD5 714f67139853b0a7ad70ff993f64c91a
SHA1 578071ab1aeb04f7d423ff67ba54693e843db6b5
SHA512 e4c175b9fd8c9ff4ef2024ca8c0fc031e8143159912c3b3812ae56148c814aa8575727e0830c9ee76d65ddd50ac9bde1049322b0c226b2c274661f95a2726b5a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZE:BemTLkNdfE0pZrQI
MD5 SHA1 SHA512 SSDEEP

Submit Download

NBeyIlu.exe

Path C:\Windows\System\NBeyIlu.exe
Size 2.3MB
SHA256 c01df4b25c638500b69350a57f0af9668969ec92a565a1967342e88ada47a781
MD5 4bea9813124ea7b34b65084a21e3e6d8
SHA1 4da057722c48afac050049dc52ed6708069c169d
SHA512 c9dc60b75ef00cfd33c7afaf02fdb424ed095b5992264460bd8e4f0eaf56270d6dd0567a0ecda46b853ff3cc823c9fa7d3a2ea84cd78b29a65c52103a7509087
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZn:BemTLkNdfE0pZrQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

RopQOTb.exe

Path C:\Windows\System\RopQOTb.exe
Size 2.3MB
SHA256 61b353469adaa82a709a1928f5198f07d861138d6e4e63576e0247ab0c667001
MD5 a155046f2e072c11123ef7d4e85d6d76
SHA1 4c863ebe6a32927c19c354d4ed412347d3fccd4b
SHA512 da3cf60716661d3c25a57e11f5ab97e07b2482617a58f65045a2f6baa70cc55c8f5aa82bdfd6b9b13876cccb29b1f4d82d6a20cf7b27f33eecc6582c390aa09e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZx:BemTLkNdfE0pZrQl
MD5 SHA1 SHA512 SSDEEP

Submit Download

RrXaWaH.exe

Path C:\Windows\System\RrXaWaH.exe
Size 2.3MB
SHA256 7adf46fbf765639fcbda04133631a86214ce7b76073d4d612287d611200ce6d4
MD5 0944a8358c8dd5211fc49a504c4e629c
SHA1 9d1fa3ce0f18d22afd28ea29e21eadb3fcaba5e6
SHA512 2deef8f270cd7e4a10d69ee26703c953d515b28f8d3606d2b4695763564eac4456fe55258221a6db7bd26b28dd35e8548b431ecd54365b3777758f118d3e38a9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZJ:BemTLkNdfE0pZrQ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

SESlSkK.exe

Path C:\Windows\System\SESlSkK.exe
Size 2.3MB
SHA256 bcaa17cbd393c595f8226a285c7f7b9fefb77a351fa967996e508a771a1afbe3
MD5 d3ea14b0e9e313845178db6c75f2223c
SHA1 f7460f4881d3bda08c69c22397ebe353ea79ce1b
SHA512 ec557cccad63bafe946ac1f2245b7b43d2bbf30ff53fee1872120e2179f71b3c9d3c30673675b378b6018f95675707ce3394565b19a4863cd33095b25ac5b948
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZ9:BemTLkNdfE0pZrQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

SukFDQi.exe

Path C:\Windows\System\SukFDQi.exe
Size 2.3MB
SHA256 88aab623eaa2c69cd6f62c25ac877821197fb55d2f22f2ac7da3031d04825b55
MD5 9db1ac493705d038ed231754f2e1a997
SHA1 03a32e0fbe68b0a429fb2c471f2c9ccc8345b02c
SHA512 594cbf5d9ff6d73705644a9e1b05b1b0eb2c989eaa59d26b68d9cef35b7d8684169802374ac29b7d6ffe94a57643ced99ad33309175dee82b8947bada07ae833
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZ2:BemTLkNdfE0pZrQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

UfxEqTJ.exe

Path C:\Windows\System\UfxEqTJ.exe
Size 2.3MB
SHA256 9526c976df350e780572d83ae71a405a838489320ecfa4e7cedf24e6fb196b4d
MD5 07bb87767757f1b7cb8975ad29174e7f
SHA1 59ef998f1c301cdb30a0c788e5f1183c76b45deb
SHA512 311727954ce402132fc3ec3f6db2431b6ada2e4371692ded1747cfe7195444624c741bbb8d0ebf5a558517016317c5ddec1e9145b2998f56013d70dfcd97d34a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZ1:BemTLkNdfE0pZrQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

WBHtwHt.exe

Path C:\Windows\System\WBHtwHt.exe
Size 2.3MB
SHA256 7556445ab24d3f14a7639c17e204eebd95dfec31c267d71c455ad0ac2ccc4470
MD5 0a0c9de5b476c9a2fe5e38aa0947e724
SHA1 08945a4ce73ba2a768b56848f03dde67ea419d19
SHA512 c0ae6eda271b2031b7fc0be0fdd51045ee269a12e250cc7e51493cdaef59f53609d39f35961d47fce32ff2b0b11a3ee54532682cdf7c6089b0b23166abdd8960
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZb:BemTLkNdfE0pZrQv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZrWfGWd.exe

Path C:\Windows\System\ZrWfGWd.exe
Size 2.3MB
SHA256 54f7bc95b590febd6df0a83cde90fcc8d8ea2e20beb0ab054b70e62b8bb3a988
MD5 6caf520ca08289b824b8033194670421
SHA1 ec9cc4dbbe7a2d97ccb24f2f9b07fb98cdde242d
SHA512 b70f4af6fdfb6a1ddf94ced0d338174fa46d0b7e3dc28cc0b173d1956b787d11e2daf9f3387389338b79216122ae284f0d0cfb235f400fa98b323d246b8c3401
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZ8:BemTLkNdfE0pZrQA
MD5 SHA1 SHA512 SSDEEP

Submit Download

bYobKVo.exe

Path C:\Windows\System\bYobKVo.exe
Size 2.3MB
SHA256 5944cae1f9db14b91eeb4e401153ea9a62eba7e0ea7f120b601a109814178269
MD5 25aee7e30561aefc822580c3dfe2bde2
SHA1 9174c3f8689a92ffb6db3745aef9e0d7264e39cf
SHA512 e1d63539769f1acdeeef488edde0506829cafaf3b399369d89efccd715b43d27246d1b836ffa84953e7a4d949a5341ca0171dc56cf6700333c0833dbfab4efa7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZH:BemTLkNdfE0pZrQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

bpNKTvp.exe

Path C:\Windows\System\bpNKTvp.exe
Size 2.3MB
SHA256 c9782f3516877539dda6f6d39804d6c01bed54570a4f8c1058e38ed36556e87b
MD5 5ad35ec6467f5ca5f03082f8db58dab5
SHA1 b08658719c3b1b80742275448b1e5edd5a2b25b9
SHA512 85f306304af46178218dc81f4e309ff0f6d8570459fa239228600b59597a21a346db590d8ba64ad3e00d7eab7013f7635763bfe7d501de320503393312371fe1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZQ:BemTLkNdfE0pZrQc
MD5 SHA1 SHA512 SSDEEP

Submit Download

cfWIqyY.exe

Path C:\Windows\System\cfWIqyY.exe
Size 2.3MB
SHA256 abf5afc2af7a70d9bf8f4af5bd69dfcf2359bd98c7adf9cb91b281b7a6029fa3
MD5 b8a7dab29c067fad8aa0a8ab302c8353
SHA1 f43d2b8fb29146943626ed5a1241abbf455d1172
SHA512 f1b99ea4ab0ac7609c9b8589c179198250c2a92bef8313eaf3c608d76b0a1a529331b8ccc29663307a4da5aee98079d440a26f99c3ac4bd43466443d95208806
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZp:BemTLkNdfE0pZrQF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dTBkJke.exe

Path C:\Windows\System\dTBkJke.exe
Size 2.3MB
SHA256 965c21a71c74deca53dc107fbc445d79fd5dd02381d53e88fdc3cb360904cc14
MD5 d4e05a5776b5d9439417fd14beedd594
SHA1 9380109a49f0ccf6f2afeed90732a2f9ba6f5993
SHA512 f8839a1204f28259f28c9c8bbec8d741c37bef66f6131d39fd4097d8ce85521f609d647130a5b9e011b120da20c2ca44b9add8c583697d872054a32125f38829
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZ9:BemTLkNdfE0pZrQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

epakjRY.exe

Path C:\Windows\System\epakjRY.exe
Size 2.3MB
SHA256 073055f3e67261a39f061ab34dec7eead8a161f0a0c3ea7345bbfa16aa69398c
MD5 ef3a9e1eddbcc0664153e8a4462696cc
SHA1 55024ddeea443c14a58bfa5ccc1f72927fd2c4d6
SHA512 74e8c08e96dc0ada23abf3330dcbc192c5c85d7023bad5159989adfb741c6adba1da7a772bf9ae6c85ac6c1371e75e20949e126ae73cfe8063eaffeaf5fb6a94
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZz:BemTLkNdfE0pZrQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffHCvRL.exe

Path C:\Windows\System\ffHCvRL.exe
Size 2.3MB
SHA256 44a081d48bfe5ef26d305f09ab1659431d887d27acc21b089db02bf44b5e74f8
MD5 2ccf4db03b3437b75d7d8226b7a124de
SHA1 313c7da6ceb4d168ca2d8ffea277534308fe1fdd
SHA512 4cd9086b6c78a171f4e6ee554b993534e352aa97f8554d357e5be4bc5a790ffbd88ab9e63070c7fee8b333b7cb52acd2b16c9a95d7da0e6885bb3e39b8a66d17
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZL:BemTLkNdfE0pZrQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

lFqWLPD.exe

Path C:\Windows\System\lFqWLPD.exe
Size 2.3MB
SHA256 cd3232953e6494843c3683efa95625c040b97653eb0e59ee9e487eca6d50b6fb
MD5 58784b25ac5c312c265c5995d38833ad
SHA1 fd898f7de59ab1e0cb2349789f67b64e56c781c7
SHA512 9a3dfba8e6fd9565e6cbed13b2bde63b10639dea2f788811810ed6b8bf1a8042344c89c8b39900355fbc469c5aa868b9613538c184d7fa1c1d546375ffc6a2ad
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZL:BemTLkNdfE0pZrQv
MD5 SHA1 SHA512 SSDEEP

Submit Download

lyEGzvn.exe

Path C:\Windows\System\lyEGzvn.exe
Size 2.3MB
SHA256 8668971737eaa73f6d82713305fbac30d2d6e0af17f555dda7a9c075502f5840
MD5 75d94703aaccf2cbda8127843df9af81
SHA1 ed70ba9b4901345a4cf4ecfca058c510a209271b
SHA512 742e4b40f19d75dbb731383a4fd7d27f49706455abc313a63d16da0eb023db3484b723b22f124ea80490b520596b7e46c1366093a642bdfafeb535d4a918ec54
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZd:BemTLkNdfE0pZrQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

nOhPVTv.exe

Path C:\Windows\System\nOhPVTv.exe
Size 2.3MB
SHA256 31c68fe2f8f9bb9b5a54fe5154b4ffbffeea8e53d5575e753e9e97538f5e51b8
MD5 e3e56aaf63dbb01f07a0f080360277c5
SHA1 0ee26a47c5564b2a72770c1c6b422ec75adce4f6
SHA512 1e699c365d3bfde28403265d77ba51b6d1faa0f70a18a4831b23f22bb5a75578ac7df7a58d16605fbc9914e5ec38308ae41eb0dd394173e28a21199215af830e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZx:BemTLkNdfE0pZrQN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tBDfdDV.exe

Path C:\Windows\System\tBDfdDV.exe
Size 2.3MB
SHA256 a84099f4941df1509324886d26d1492980d16706232909b2f9bd7c147414ef38
MD5 8389e540c358fba0c13cd576bfd6f7c6
SHA1 7e7488fb6337e5ddf38d2401b841339162292e52
SHA512 b4385814826c78d1cab321819edefa2a48dcc8b13b00d4d1ddcbec9c293f8cbd618efc521bc7776299ec60a55ece0239fd0079ad136e37a6f5e4e4ba4b00c180
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZX:BemTLkNdfE0pZrQj
MD5 SHA1 SHA512 SSDEEP

Submit Download

uTFjkuZ.exe

Path C:\Windows\System\uTFjkuZ.exe
Size 2.3MB
SHA256 8470a0a09bae6b4e212f1e46c44f5111cb85a08a6a1d4918991e84bedecb8eeb
MD5 5655111f6cc764be614714763090beed
SHA1 e25aa24297ebb4ef6a2a8e4c648da304214bd05d
SHA512 b204385c6d72fde51308280c98d7297a13c6971bf640103334eef945835db37bb61da08732684b852777b4b2b242d0ca3bed6ec830ec59d2d8e9edc8f2e62a42
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZD:BemTLkNdfE0pZrQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

uiwcGTE.exe

Path C:\Windows\System\uiwcGTE.exe
Size 2.3MB
SHA256 f85d762466f8893cbb4fa4d37056d7cbc42975e8c5011fa24d42cee01626f8eb
MD5 bf62183c4922de1a522fef3efc61feae
SHA1 9882049b290854f92feee305f91e030bd8c6ddee
SHA512 5971d7e34230845374ec8c67978197be47874e91de9538acb97ded06811b1f0cb8d501d688e7ce4d1f1af7286d814e8554df132cb1a7a5e937111e5519b384c8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZt:BemTLkNdfE0pZrQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

wLeVMwP.exe

Path C:\Windows\System\wLeVMwP.exe
Size 2.3MB
SHA256 6d4b9ebf58f2f6dae44b6db38c658ac97da41fadd76878bca508a45b0c281e52
MD5 58c5e88288070d77370e0f1ef5644c2c
SHA1 824c57898c71ac268cb5bb28c08528b003502e52
SHA512 027542c96945984cfa281ccb54448e5445dcf03150d600f63cc2f8ee83662b54143a74c97d2248ad4a5e49f31c26bdebe6ce2b6b876d1ceb8bed9163fb83557a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZU:BemTLkNdfE0pZrQA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ytPNaVl.exe

Path C:\Windows\System\ytPNaVl.exe
Size 2.3MB
SHA256 c1c6673d3d3e92396747c2ed1028ec4accc3b7ed80a27fddcc64a6fca1039c9e
MD5 88a4f1d752d157be68c63b4f67ae9d20
SHA1 7b878fa5f5bdb26955013ed3e6f690c29fc3b4d8
SHA512 66368be63db81202924837b01d7c34d88c8caf561662397dab2ca6dc7eedce44fe212a16854f116f8b77324329f466e3fdfdf6f9c035e1b1d15fca41f858bb2d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZY2:BemTLkNdfE0pZrQH
MD5 SHA1 SHA512 SSDEEP

Submit Download

zLxxJnT.exe

Path C:\Windows\System\zLxxJnT.exe
Size 2.3MB
SHA256 2ee7a1629b7f2ef871ff5acd14f60e1c57464df912db248b2e16172efed62928
MD5 47c45cf6b1d0aa5eb64da4fd3faaf688
SHA1 243d41bfd3addf8e67c5f896ca1d466dcd22f38d
SHA512 b6576e3ddad2f68b6cc3a1d9a3b287186ff76fb0ba9e7a4d2848a920526b58e26fb4ff381012fc9b4a647d2ef91bfe05b2a37bac702717ad8f709f0775fbcb28
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZP:BemTLkNdfE0pZrQr
MD5 SHA1 SHA512 SSDEEP

Submit Download

zMPGYnC.exe

Path C:\Windows\System\zMPGYnC.exe
Size 2.3MB
SHA256 440426286102af9a57cb830edaa44712a4c1a0de74926fc86e156311910ba374
MD5 6ae2959a43f13fb53301f1695d36d157
SHA1 571f64fd32e4915dc05e6458206c9efa47eb8fdb
SHA512 37beb6a6bd05ff5b135609733f6f49b817d22c3af6a28d7fc04746f1604c9b58e6ea48049d9122255d0bf796695daedf078b7a9e1f0ef91efd1403c315dba24c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZs:BemTLkNdfE0pZrQg
MD5 SHA1 SHA512 SSDEEP

Submit Download

zZGoIvs.exe

Path C:\Windows\System\zZGoIvs.exe
Size 2.3MB
SHA256 b783a56181377cfe96fd6722ace4c6bb71068d99b5f66abedbff6d30d472b719
MD5 4807b58b6825d0cee9bfe446b9049874
SHA1 1dfd5d64ceecd84346da294c1d2112598968304d
SHA512 948d34c03794a5ba58011d38fc078c2a516664304220b14941d2433845bcb46ac1bae343273e8e72b4341dcd5ed5b8484291f8473262cd30d5d131a98d753eb7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQHxH4T9eSMVZM:BemTLkNdfE0pZrQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-869-0x00007FF6A7860000-0x00007FF6A7BB4000-memory.dmp

Download

memory/388-2164-0x00007FF6A7860000-0x00007FF6A7BB4000-memory.dmp

Download

memory/408-2169-0x00007FF6C0A30000-0x00007FF6C0D84000-memory.dmp

Download

memory/408-883-0x00007FF6C0A30000-0x00007FF6C0D84000-memory.dmp

Download

memory/428-879-0x00007FF6B9C00000-0x00007FF6B9F54000-memory.dmp

Download

memory/428-2168-0x00007FF6B9C00000-0x00007FF6B9F54000-memory.dmp

Download

memory/544-734-0x00007FF7DEDF0000-0x00007FF7DF144000-memory.dmp

Download

memory/544-2149-0x00007FF7DEDF0000-0x00007FF7DF144000-memory.dmp

Download

memory/752-2154-0x00007FF76C530000-0x00007FF76C884000-memory.dmp

Download

memory/752-736-0x00007FF76C530000-0x00007FF76C884000-memory.dmp

Download

memory/984-2146-0x00007FF6553B0000-0x00007FF655704000-memory.dmp

Download

memory/984-732-0x00007FF6553B0000-0x00007FF655704000-memory.dmp

Download

memory/1196-2155-0x00007FF7EDC20000-0x00007FF7EDF74000-memory.dmp

Download

memory/1196-808-0x00007FF7EDC20000-0x00007FF7EDF74000-memory.dmp

Download

memory/1212-2150-0x00007FF63D4E0000-0x00007FF63D834000-memory.dmp

Download

memory/1212-735-0x00007FF63D4E0000-0x00007FF63D834000-memory.dmp

Download

memory/1508-2166-0x00007FF6E1A90000-0x00007FF6E1DE4000-memory.dmp

Download

memory/1508-857-0x00007FF6E1A90000-0x00007FF6E1DE4000-memory.dmp

Download

memory/1944-2145-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp

Download

memory/1944-731-0x00007FF7F6E80000-0x00007FF7F71D4000-memory.dmp

Download

memory/2068-1-0x0000019116D20000-0x0000019116D30000-memory.dmp

Download

memory/2068-0-0x00007FF64C5D0000-0x00007FF64C924000-memory.dmp

Download

memory/2068-2141-0x00007FF64C5D0000-0x00007FF64C924000-memory.dmp

Download

memory/2088-780-0x00007FF7EEE90000-0x00007FF7EF1E4000-memory.dmp

Download

memory/2088-2165-0x00007FF7EEE90000-0x00007FF7EF1E4000-memory.dmp

Download

memory/2312-815-0x00007FF7ACFF0000-0x00007FF7AD344000-memory.dmp

Download

memory/2312-2156-0x00007FF7ACFF0000-0x00007FF7AD344000-memory.dmp

Download

memory/2576-790-0x00007FF6BF720000-0x00007FF6BFA74000-memory.dmp

Download

memory/2576-2161-0x00007FF6BF720000-0x00007FF6BFA74000-memory.dmp

Download

memory/2948-2158-0x00007FF6F03F0000-0x00007FF6F0744000-memory.dmp

Download

memory/2948-755-0x00007FF6F03F0000-0x00007FF6F0744000-memory.dmp

Download

memory/3024-875-0x00007FF6DA550000-0x00007FF6DA8A4000-memory.dmp

Download

memory/3024-2167-0x00007FF6DA550000-0x00007FF6DA8A4000-memory.dmp

Download

memory/3184-801-0x00007FF6E4BA0000-0x00007FF6E4EF4000-memory.dmp

Download

memory/3184-2162-0x00007FF6E4BA0000-0x00007FF6E4EF4000-memory.dmp

Download

memory/3280-781-0x00007FF793580000-0x00007FF7938D4000-memory.dmp

Download

memory/3280-2152-0x00007FF793580000-0x00007FF7938D4000-memory.dmp

Download

memory/3356-2147-0x00007FF6A7950000-0x00007FF6A7CA4000-memory.dmp

Download

memory/3356-730-0x00007FF6A7950000-0x00007FF6A7CA4000-memory.dmp

Download

memory/3568-2144-0x00007FF73CFD0000-0x00007FF73D324000-memory.dmp

Download

memory/3568-729-0x00007FF73CFD0000-0x00007FF73D324000-memory.dmp

Download

memory/3704-2143-0x00007FF7D4900000-0x00007FF7D4C54000-memory.dmp

Download

memory/3704-8-0x00007FF7D4900000-0x00007FF7D4C54000-memory.dmp

Download

memory/4020-768-0x00007FF7AA130000-0x00007FF7AA484000-memory.dmp

Download

memory/4020-2151-0x00007FF7AA130000-0x00007FF7AA484000-memory.dmp

Download

memory/4092-2157-0x00007FF6DB430000-0x00007FF6DB784000-memory.dmp

Download

memory/4092-798-0x00007FF6DB430000-0x00007FF6DB784000-memory.dmp

Download

memory/4272-15-0x00007FF742920000-0x00007FF742C74000-memory.dmp

Download

memory/4272-2142-0x00007FF742920000-0x00007FF742C74000-memory.dmp

Download

memory/4272-2180-0x00007FF742920000-0x00007FF742C74000-memory.dmp

Download

memory/4312-2160-0x00007FF75BE00000-0x00007FF75C154000-memory.dmp

Download

memory/4312-803-0x00007FF75BE00000-0x00007FF75C154000-memory.dmp

Download

memory/4540-861-0x00007FF767450000-0x00007FF7677A4000-memory.dmp

Download

memory/4540-2163-0x00007FF767450000-0x00007FF7677A4000-memory.dmp

Download

memory/4592-884-0x00007FF7E4BC0000-0x00007FF7E4F14000-memory.dmp

Download

memory/4592-2176-0x00007FF7E4BC0000-0x00007FF7E4F14000-memory.dmp

Download

memory/4656-2159-0x00007FF660AE0000-0x00007FF660E34000-memory.dmp

Download

memory/4656-872-0x00007FF660AE0000-0x00007FF660E34000-memory.dmp

Download

memory/4892-733-0x00007FF7A98A0000-0x00007FF7A9BF4000-memory.dmp

Download

memory/4892-2148-0x00007FF7A98A0000-0x00007FF7A9BF4000-memory.dmp

Download

memory/4932-2153-0x00007FF768FC0000-0x00007FF769314000-memory.dmp

Download

memory/4932-749-0x00007FF768FC0000-0x00007FF769314000-memory.dmp

Download