xmrig | 1a6e10c2bbe0b438e1595e5be7a379eb7fa0991fd1fad8139713506911059f65

Analysis

max time kernel
96s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
Size 2.1MB
Sample240523-1vzzjsad44
SHA256 1a6e10c2bbe0b438e1595e5be7a379eb7fa0991fd1fad8139713506911059f65
MD5 93975d5ff83ef31b703bda8ebc76b8d0
SHA1 d78c13d9c6ad591f23b1ab7c50cc6b9ccbc5b5e1
SHA512 00f891c04ca2369560ad3729abf8c78d833e004e468e13d4a6f7c61f5dd2a38809ee7189189ca62273306c09a420ff44d85ac7287d753883e61150e0486a1a2a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wA:BemTLkNdfE0pZrO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 14888 created 3816	14888	WerFaultSecure.exe	79

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4748-0-0x00007FF721C30000-0x00007FF721F84000-memory.dmp	xmrig
behavioral2/files/0x00090000000233ea-5.dat	xmrig
behavioral2/files/0x00070000000233f4-16.dat	xmrig
behavioral2/files/0x00070000000233f3-15.dat	xmrig
behavioral2/files/0x00070000000233f5-27.dat	xmrig
behavioral2/files/0x00070000000233f7-33.dat	xmrig
behavioral2/files/0x00070000000233fa-51.dat	xmrig
behavioral2/files/0x00070000000233fc-59.dat	xmrig
behavioral2/files/0x0007000000023400-82.dat	xmrig
behavioral2/files/0x0007000000023405-107.dat	xmrig
behavioral2/files/0x0007000000023409-123.dat	xmrig
behavioral2/files/0x000700000002340c-141.dat	xmrig
behavioral2/files/0x0007000000023410-162.dat	xmrig
behavioral2/memory/4948-732-0x00007FF681AE0000-0x00007FF681E34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-166.dat	xmrig
behavioral2/files/0x000700000002340f-157.dat	xmrig
behavioral2/files/0x000700000002340e-152.dat	xmrig
behavioral2/files/0x000700000002340d-147.dat	xmrig
behavioral2/files/0x000700000002340b-137.dat	xmrig
behavioral2/files/0x000700000002340a-131.dat	xmrig
behavioral2/files/0x0007000000023408-121.dat	xmrig
behavioral2/files/0x0007000000023407-117.dat	xmrig
behavioral2/files/0x0007000000023406-111.dat	xmrig
behavioral2/files/0x0007000000023404-102.dat	xmrig
behavioral2/files/0x0007000000023403-96.dat	xmrig
behavioral2/files/0x0007000000023402-92.dat	xmrig
behavioral2/files/0x0007000000023401-86.dat	xmrig
behavioral2/files/0x00070000000233ff-76.dat	xmrig
behavioral2/files/0x00070000000233fe-72.dat	xmrig
behavioral2/files/0x00070000000233fd-66.dat	xmrig
behavioral2/files/0x00070000000233fb-54.dat	xmrig
behavioral2/files/0x00070000000233f9-47.dat	xmrig
behavioral2/files/0x00070000000233f8-41.dat	xmrig
behavioral2/files/0x00070000000233f6-31.dat	xmrig
behavioral2/memory/4440-21-0x00007FF7F3FA0000-0x00007FF7F42F4000-memory.dmp	xmrig
behavioral2/memory/2484-14-0x00007FF736870000-0x00007FF736BC4000-memory.dmp	xmrig
behavioral2/memory/3692-10-0x00007FF657130000-0x00007FF657484000-memory.dmp	xmrig
behavioral2/memory/908-734-0x00007FF755A10000-0x00007FF755D64000-memory.dmp	xmrig
behavioral2/memory/532-733-0x00007FF6B9AA0000-0x00007FF6B9DF4000-memory.dmp	xmrig
behavioral2/memory/4940-735-0x00007FF6BE570000-0x00007FF6BE8C4000-memory.dmp	xmrig
behavioral2/memory/3372-736-0x00007FF6EC6D0000-0x00007FF6ECA24000-memory.dmp	xmrig
behavioral2/memory/3576-737-0x00007FF72D960000-0x00007FF72DCB4000-memory.dmp	xmrig
behavioral2/memory/368-738-0x00007FF731B80000-0x00007FF731ED4000-memory.dmp	xmrig
behavioral2/memory/2316-739-0x00007FF677640000-0x00007FF677994000-memory.dmp	xmrig
behavioral2/memory/3228-740-0x00007FF6637F0000-0x00007FF663B44000-memory.dmp	xmrig
behavioral2/memory/4188-743-0x00007FF6C0540000-0x00007FF6C0894000-memory.dmp	xmrig
behavioral2/memory/2084-742-0x00007FF61F710000-0x00007FF61FA64000-memory.dmp	xmrig
behavioral2/memory/3644-741-0x00007FF68B150000-0x00007FF68B4A4000-memory.dmp	xmrig
behavioral2/memory/5088-744-0x00007FF6D7500000-0x00007FF6D7854000-memory.dmp	xmrig
behavioral2/memory/4500-745-0x00007FF752FA0000-0x00007FF7532F4000-memory.dmp	xmrig
behavioral2/memory/4340-805-0x00007FF71A570000-0x00007FF71A8C4000-memory.dmp	xmrig
behavioral2/memory/652-826-0x00007FF711E90000-0x00007FF7121E4000-memory.dmp	xmrig
behavioral2/memory/1424-849-0x00007FF6B0EB0000-0x00007FF6B1204000-memory.dmp	xmrig
behavioral2/memory/1816-866-0x00007FF622BD0000-0x00007FF622F24000-memory.dmp	xmrig
behavioral2/memory/2596-863-0x00007FF715B70000-0x00007FF715EC4000-memory.dmp	xmrig
behavioral2/memory/4744-845-0x00007FF7B5EE0000-0x00007FF7B6234000-memory.dmp	xmrig
behavioral2/memory/512-834-0x00007FF61AC60000-0x00007FF61AFB4000-memory.dmp	xmrig
behavioral2/memory/3856-809-0x00007FF787E70000-0x00007FF7881C4000-memory.dmp	xmrig
behavioral2/memory/2828-789-0x00007FF669D10000-0x00007FF66A064000-memory.dmp	xmrig
behavioral2/memory/4136-779-0x00007FF624DE0000-0x00007FF625134000-memory.dmp	xmrig
behavioral2/memory/548-768-0x00007FF7A8350000-0x00007FF7A86A4000-memory.dmp	xmrig
behavioral2/memory/4780-764-0x00007FF7CE570000-0x00007FF7CE8C4000-memory.dmp	xmrig
behavioral2/memory/4748-2126-0x00007FF721C30000-0x00007FF721F84000-memory.dmp	xmrig
behavioral2/memory/2484-2127-0x00007FF736870000-0x00007FF736BC4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3692	yudApSx.exe
2484	leyJtrY.exe
4440	KRablEX.exe
4948	vhcdJVF.exe
1816	GBUmVZK.exe
532	RxlRMmj.exe
908	UqoasPR.exe
4940	IEZzbFZ.exe
3372	oDbVUOX.exe
3576	iEosLvG.exe
368	ceGcPjo.exe
2316	CCvLazv.exe
3228	ZqDrkeS.exe
3644	uRkiSuS.exe
2084	qvaDBxU.exe
4188	SZtuABw.exe
5088	lzAfhyc.exe
4500	yeMcxuY.exe
4780	AFeIROW.exe
548	SjxvJto.exe
4136	IHCiBob.exe
2828	CaMaGou.exe
4340	OMpVkxj.exe
3856	RxaLEmV.exe
652	VNkZGcZ.exe
512	CFdqqYX.exe
4744	tkoiNeY.exe
1424	KIHBhKH.exe
2596	dzkhAKX.exe
2156	vqyTITB.exe
3224	aAoigdb.exe
2300	yYjuffU.exe
4884	kREGrZd.exe
4336	OUatUKr.exe
1788	APLOWsm.exe
2916	HoiLOzD.exe
3736	ocKTmZt.exe
1820	lYYSxYt.exe
4868	PfEJtNn.exe
1892	fywWtzi.exe
4728	mYcKSHT.exe
444	XlQLMud.exe
216	FDtxeBM.exe
4196	vpzTXlG.exe
3520	jnLpwVT.exe
232	YTjRpey.exe
4288	YiEnOzN.exe
1752	rMrMxlG.exe
1140	NMcRRSQ.exe
3772	muwMeRp.exe
544	ZWVxJEY.exe
2140	tlOVBmu.exe
4968	ublwSgK.exe
4792	EDcGCbk.exe
4056	VdxoHIU.exe
1848	ndEmoIM.exe
676	mgfgDMu.exe
1492	qyqbqmM.exe
3940	ZCseXLr.exe
856	ZgYqsYj.exe
2052	ltYLPGC.exe
3516	VSRektP.exe
4416	CZrBywc.exe
3584	CsqAMrW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4748-0-0x00007FF721C30000-0x00007FF721F84000-memory.dmp	upx
behavioral2/files/0x00090000000233ea-5.dat	upx
behavioral2/files/0x00070000000233f4-16.dat	upx
behavioral2/files/0x00070000000233f3-15.dat	upx
behavioral2/files/0x00070000000233f5-27.dat	upx
behavioral2/files/0x00070000000233f7-33.dat	upx
behavioral2/files/0x00070000000233fa-51.dat	upx
behavioral2/files/0x00070000000233fc-59.dat	upx
behavioral2/files/0x0007000000023400-82.dat	upx
behavioral2/files/0x0007000000023405-107.dat	upx
behavioral2/files/0x0007000000023409-123.dat	upx
behavioral2/files/0x000700000002340c-141.dat	upx
behavioral2/files/0x0007000000023410-162.dat	upx
behavioral2/memory/4948-732-0x00007FF681AE0000-0x00007FF681E34000-memory.dmp	upx
behavioral2/files/0x0007000000023411-166.dat	upx
behavioral2/files/0x000700000002340f-157.dat	upx
behavioral2/files/0x000700000002340e-152.dat	upx
behavioral2/files/0x000700000002340d-147.dat	upx
behavioral2/files/0x000700000002340b-137.dat	upx
behavioral2/files/0x000700000002340a-131.dat	upx
behavioral2/files/0x0007000000023408-121.dat	upx
behavioral2/files/0x0007000000023407-117.dat	upx
behavioral2/files/0x0007000000023406-111.dat	upx
behavioral2/files/0x0007000000023404-102.dat	upx
behavioral2/files/0x0007000000023403-96.dat	upx
behavioral2/files/0x0007000000023402-92.dat	upx
behavioral2/files/0x0007000000023401-86.dat	upx
behavioral2/files/0x00070000000233ff-76.dat	upx
behavioral2/files/0x00070000000233fe-72.dat	upx
behavioral2/files/0x00070000000233fd-66.dat	upx
behavioral2/files/0x00070000000233fb-54.dat	upx
behavioral2/files/0x00070000000233f9-47.dat	upx
behavioral2/files/0x00070000000233f8-41.dat	upx
behavioral2/files/0x00070000000233f6-31.dat	upx
behavioral2/memory/4440-21-0x00007FF7F3FA0000-0x00007FF7F42F4000-memory.dmp	upx
behavioral2/memory/2484-14-0x00007FF736870000-0x00007FF736BC4000-memory.dmp	upx
behavioral2/memory/3692-10-0x00007FF657130000-0x00007FF657484000-memory.dmp	upx
behavioral2/memory/908-734-0x00007FF755A10000-0x00007FF755D64000-memory.dmp	upx
behavioral2/memory/532-733-0x00007FF6B9AA0000-0x00007FF6B9DF4000-memory.dmp	upx
behavioral2/memory/4940-735-0x00007FF6BE570000-0x00007FF6BE8C4000-memory.dmp	upx
behavioral2/memory/3372-736-0x00007FF6EC6D0000-0x00007FF6ECA24000-memory.dmp	upx
behavioral2/memory/3576-737-0x00007FF72D960000-0x00007FF72DCB4000-memory.dmp	upx
behavioral2/memory/368-738-0x00007FF731B80000-0x00007FF731ED4000-memory.dmp	upx
behavioral2/memory/2316-739-0x00007FF677640000-0x00007FF677994000-memory.dmp	upx
behavioral2/memory/3228-740-0x00007FF6637F0000-0x00007FF663B44000-memory.dmp	upx
behavioral2/memory/4188-743-0x00007FF6C0540000-0x00007FF6C0894000-memory.dmp	upx
behavioral2/memory/2084-742-0x00007FF61F710000-0x00007FF61FA64000-memory.dmp	upx
behavioral2/memory/3644-741-0x00007FF68B150000-0x00007FF68B4A4000-memory.dmp	upx
behavioral2/memory/5088-744-0x00007FF6D7500000-0x00007FF6D7854000-memory.dmp	upx
behavioral2/memory/4500-745-0x00007FF752FA0000-0x00007FF7532F4000-memory.dmp	upx
behavioral2/memory/4340-805-0x00007FF71A570000-0x00007FF71A8C4000-memory.dmp	upx
behavioral2/memory/652-826-0x00007FF711E90000-0x00007FF7121E4000-memory.dmp	upx
behavioral2/memory/1424-849-0x00007FF6B0EB0000-0x00007FF6B1204000-memory.dmp	upx
behavioral2/memory/1816-866-0x00007FF622BD0000-0x00007FF622F24000-memory.dmp	upx
behavioral2/memory/2596-863-0x00007FF715B70000-0x00007FF715EC4000-memory.dmp	upx
behavioral2/memory/4744-845-0x00007FF7B5EE0000-0x00007FF7B6234000-memory.dmp	upx
behavioral2/memory/512-834-0x00007FF61AC60000-0x00007FF61AFB4000-memory.dmp	upx
behavioral2/memory/3856-809-0x00007FF787E70000-0x00007FF7881C4000-memory.dmp	upx
behavioral2/memory/2828-789-0x00007FF669D10000-0x00007FF66A064000-memory.dmp	upx
behavioral2/memory/4136-779-0x00007FF624DE0000-0x00007FF625134000-memory.dmp	upx
behavioral2/memory/548-768-0x00007FF7A8350000-0x00007FF7A86A4000-memory.dmp	upx
behavioral2/memory/4780-764-0x00007FF7CE570000-0x00007FF7CE8C4000-memory.dmp	upx
behavioral2/memory/4748-2126-0x00007FF721C30000-0x00007FF721F84000-memory.dmp	upx
behavioral2/memory/2484-2127-0x00007FF736870000-0x00007FF736BC4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dTxXrPn.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\EYChWpE.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\KIHBhKH.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\RikFAuh.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\UBxItWz.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\wQdauBd.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\TbAxLsf.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\pWBONZu.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\NeJioPx.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\UqDPShA.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\KRablEX.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\VNkZGcZ.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\CsqAMrW.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\nmnDvIA.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\abpYftL.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\NZqnudR.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\fMPOkfo.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\fnIYfHc.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\Bsgywox.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\TJYmQKE.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\BVfhZmW.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\uhiYOgg.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\mPGxrxG.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\kdVrMQh.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\QDoIXEo.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\zzeTRTu.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\AmSbxzj.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\iGmyAYh.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\ubeBJca.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\zzVZcln.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\DZJrWsq.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\eyYkQAz.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\WEQZlvy.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\TMNBZLO.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\ocKTmZt.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\YoBsoPN.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\uTKkBHB.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\HygIvYd.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\lHJIIsO.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\geOkgNG.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\kZcJFJB.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\egIPrsz.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\jdiieaH.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\dVOfCoq.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\agLkGsO.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\iWOGqDb.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\CFdqqYX.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\mYcKSHT.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\Aofhgid.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\begqhhN.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\ftdgXpp.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\bPFcQZX.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\JbCzdWE.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\GwSiUGd.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\leyJtrY.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\zFrYYGh.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\WGafwgg.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\FHEgjIO.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\UBivBvr.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\YZZYpiv.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\IEZzbFZ.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\muwMeRp.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\wPvEYMD.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
File created	C:\Windows\System\pFqnHbm.exe	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
15024	WerFaultSecure.exe
15024	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 3692	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	84
PID 4748 wrote to memory of 3692	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	84
PID 4748 wrote to memory of 2484	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	85
PID 4748 wrote to memory of 2484	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	85
PID 4748 wrote to memory of 4440	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	86
PID 4748 wrote to memory of 4440	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	86
PID 4748 wrote to memory of 4948	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	87
PID 4748 wrote to memory of 4948	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	87
PID 4748 wrote to memory of 1816	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	88
PID 4748 wrote to memory of 1816	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	88
PID 4748 wrote to memory of 532	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	89
PID 4748 wrote to memory of 532	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	89
PID 4748 wrote to memory of 908	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	90
PID 4748 wrote to memory of 908	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	90
PID 4748 wrote to memory of 4940	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	91
PID 4748 wrote to memory of 4940	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	91
PID 4748 wrote to memory of 3372	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	92
PID 4748 wrote to memory of 3372	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	92
PID 4748 wrote to memory of 3576	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	93
PID 4748 wrote to memory of 3576	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	93
PID 4748 wrote to memory of 368	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	94
PID 4748 wrote to memory of 368	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	94
PID 4748 wrote to memory of 2316	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	95
PID 4748 wrote to memory of 2316	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	95
PID 4748 wrote to memory of 3228	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	96
PID 4748 wrote to memory of 3228	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	96
PID 4748 wrote to memory of 3644	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	97
PID 4748 wrote to memory of 3644	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	97
PID 4748 wrote to memory of 2084	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	98
PID 4748 wrote to memory of 2084	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	98
PID 4748 wrote to memory of 4188	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	99
PID 4748 wrote to memory of 4188	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	99
PID 4748 wrote to memory of 5088	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	100
PID 4748 wrote to memory of 5088	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	100
PID 4748 wrote to memory of 4500	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	101
PID 4748 wrote to memory of 4500	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	101
PID 4748 wrote to memory of 4780	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	102
PID 4748 wrote to memory of 4780	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	102
PID 4748 wrote to memory of 548	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	103
PID 4748 wrote to memory of 548	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	103
PID 4748 wrote to memory of 4136	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	104
PID 4748 wrote to memory of 4136	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	104
PID 4748 wrote to memory of 2828	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	105
PID 4748 wrote to memory of 2828	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	105
PID 4748 wrote to memory of 4340	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	106
PID 4748 wrote to memory of 4340	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	106
PID 4748 wrote to memory of 3856	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	107
PID 4748 wrote to memory of 3856	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	107
PID 4748 wrote to memory of 652	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	108
PID 4748 wrote to memory of 652	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	108
PID 4748 wrote to memory of 512	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	109
PID 4748 wrote to memory of 512	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	109
PID 4748 wrote to memory of 4744	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	110
PID 4748 wrote to memory of 4744	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	110
PID 4748 wrote to memory of 1424	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	111
PID 4748 wrote to memory of 1424	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	111
PID 4748 wrote to memory of 2596	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	112
PID 4748 wrote to memory of 2596	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	112
PID 4748 wrote to memory of 2156	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	113
PID 4748 wrote to memory of 2156	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	113
PID 4748 wrote to memory of 3224	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	114
PID 4748 wrote to memory of 3224	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	114
PID 4748 wrote to memory of 2300	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	115
PID 4748 wrote to memory of 2300	4748	93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe	115

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:3816
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 3816 -s 2148
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:15024

C:\Users\Admin\AppData\Local\Temp\93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\93975d5ff83ef31b703bda8ebc76b8d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\System\yudApSx.exe
  C:\Windows\System\yudApSx.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\leyJtrY.exe
  C:\Windows\System\leyJtrY.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\KRablEX.exe
  C:\Windows\System\KRablEX.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\vhcdJVF.exe
  C:\Windows\System\vhcdJVF.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\GBUmVZK.exe
  C:\Windows\System\GBUmVZK.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\RxlRMmj.exe
  C:\Windows\System\RxlRMmj.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\UqoasPR.exe
  C:\Windows\System\UqoasPR.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\IEZzbFZ.exe
  C:\Windows\System\IEZzbFZ.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\oDbVUOX.exe
  C:\Windows\System\oDbVUOX.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\iEosLvG.exe
  C:\Windows\System\iEosLvG.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\ceGcPjo.exe
  C:\Windows\System\ceGcPjo.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\CCvLazv.exe
  C:\Windows\System\CCvLazv.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\ZqDrkeS.exe
  C:\Windows\System\ZqDrkeS.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\uRkiSuS.exe
  C:\Windows\System\uRkiSuS.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\qvaDBxU.exe
  C:\Windows\System\qvaDBxU.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\SZtuABw.exe
  C:\Windows\System\SZtuABw.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\lzAfhyc.exe
  C:\Windows\System\lzAfhyc.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\yeMcxuY.exe
  C:\Windows\System\yeMcxuY.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\AFeIROW.exe
  C:\Windows\System\AFeIROW.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\SjxvJto.exe
  C:\Windows\System\SjxvJto.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\IHCiBob.exe
  C:\Windows\System\IHCiBob.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\CaMaGou.exe
  C:\Windows\System\CaMaGou.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\OMpVkxj.exe
  C:\Windows\System\OMpVkxj.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\RxaLEmV.exe
  C:\Windows\System\RxaLEmV.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\VNkZGcZ.exe
  C:\Windows\System\VNkZGcZ.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\CFdqqYX.exe
  C:\Windows\System\CFdqqYX.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\tkoiNeY.exe
  C:\Windows\System\tkoiNeY.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\KIHBhKH.exe
  C:\Windows\System\KIHBhKH.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\dzkhAKX.exe
  C:\Windows\System\dzkhAKX.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\vqyTITB.exe
  C:\Windows\System\vqyTITB.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\aAoigdb.exe
  C:\Windows\System\aAoigdb.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\yYjuffU.exe
  C:\Windows\System\yYjuffU.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\kREGrZd.exe
  C:\Windows\System\kREGrZd.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\OUatUKr.exe
  C:\Windows\System\OUatUKr.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\APLOWsm.exe
  C:\Windows\System\APLOWsm.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\HoiLOzD.exe
  C:\Windows\System\HoiLOzD.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\ocKTmZt.exe
  C:\Windows\System\ocKTmZt.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\lYYSxYt.exe
  C:\Windows\System\lYYSxYt.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\PfEJtNn.exe
  C:\Windows\System\PfEJtNn.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\fywWtzi.exe
  C:\Windows\System\fywWtzi.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\mYcKSHT.exe
  C:\Windows\System\mYcKSHT.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\XlQLMud.exe
  C:\Windows\System\XlQLMud.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\FDtxeBM.exe
  C:\Windows\System\FDtxeBM.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\vpzTXlG.exe
  C:\Windows\System\vpzTXlG.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\jnLpwVT.exe
  C:\Windows\System\jnLpwVT.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\YTjRpey.exe
  C:\Windows\System\YTjRpey.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\YiEnOzN.exe
  C:\Windows\System\YiEnOzN.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\rMrMxlG.exe
  C:\Windows\System\rMrMxlG.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\NMcRRSQ.exe
  C:\Windows\System\NMcRRSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\muwMeRp.exe
  C:\Windows\System\muwMeRp.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\ZWVxJEY.exe
  C:\Windows\System\ZWVxJEY.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\tlOVBmu.exe
  C:\Windows\System\tlOVBmu.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\ublwSgK.exe
  C:\Windows\System\ublwSgK.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\EDcGCbk.exe
  C:\Windows\System\EDcGCbk.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\VdxoHIU.exe
  C:\Windows\System\VdxoHIU.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\ndEmoIM.exe
  C:\Windows\System\ndEmoIM.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\mgfgDMu.exe
  C:\Windows\System\mgfgDMu.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\qyqbqmM.exe
  C:\Windows\System\qyqbqmM.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\ZCseXLr.exe
  C:\Windows\System\ZCseXLr.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\ZgYqsYj.exe
  C:\Windows\System\ZgYqsYj.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\ltYLPGC.exe
  C:\Windows\System\ltYLPGC.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\VSRektP.exe
  C:\Windows\System\VSRektP.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\CZrBywc.exe
  C:\Windows\System\CZrBywc.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\CsqAMrW.exe
  C:\Windows\System\CsqAMrW.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\yNHseDN.exe
  C:\Windows\System\yNHseDN.exe
  2⤵
  PID:2348
- C:\Windows\System\EqzCMTz.exe
  C:\Windows\System\EqzCMTz.exe
  2⤵
  PID:224
- C:\Windows\System\euJEwHa.exe
  C:\Windows\System\euJEwHa.exe
  2⤵
  PID:4272
- C:\Windows\System\YlRVvpZ.exe
  C:\Windows\System\YlRVvpZ.exe
  2⤵
  PID:596
- C:\Windows\System\mSDGAPw.exe
  C:\Windows\System\mSDGAPw.exe
  2⤵
  PID:2332
- C:\Windows\System\eomSAFo.exe
  C:\Windows\System\eomSAFo.exe
  2⤵
  PID:640
- C:\Windows\System\dJDTIcF.exe
  C:\Windows\System\dJDTIcF.exe
  2⤵
  PID:4508
- C:\Windows\System\SyFdjEC.exe
  C:\Windows\System\SyFdjEC.exe
  2⤵
  PID:5140
- C:\Windows\System\yNHDbZd.exe
  C:\Windows\System\yNHDbZd.exe
  2⤵
  PID:5168
- C:\Windows\System\naTgcYl.exe
  C:\Windows\System\naTgcYl.exe
  2⤵
  PID:5196
- C:\Windows\System\nskoyEl.exe
  C:\Windows\System\nskoyEl.exe
  2⤵
  PID:5228
- C:\Windows\System\zshQgdK.exe
  C:\Windows\System\zshQgdK.exe
  2⤵
  PID:5260
- C:\Windows\System\TgwtOfA.exe
  C:\Windows\System\TgwtOfA.exe
  2⤵
  PID:5288
- C:\Windows\System\nqvZrKM.exe
  C:\Windows\System\nqvZrKM.exe
  2⤵
  PID:5316
- C:\Windows\System\QQEQVCI.exe
  C:\Windows\System\QQEQVCI.exe
  2⤵
  PID:5344
- C:\Windows\System\tHKtePT.exe
  C:\Windows\System\tHKtePT.exe
  2⤵
  PID:5372
- C:\Windows\System\rcmIsEO.exe
  C:\Windows\System\rcmIsEO.exe
  2⤵
  PID:5400
- C:\Windows\System\ovyMHEy.exe
  C:\Windows\System\ovyMHEy.exe
  2⤵
  PID:5428
- C:\Windows\System\VReOdKu.exe
  C:\Windows\System\VReOdKu.exe
  2⤵
  PID:5448
- C:\Windows\System\DvNxEww.exe
  C:\Windows\System\DvNxEww.exe
  2⤵
  PID:5476
- C:\Windows\System\JIaMesT.exe
  C:\Windows\System\JIaMesT.exe
  2⤵
  PID:5504
- C:\Windows\System\QgOolwF.exe
  C:\Windows\System\QgOolwF.exe
  2⤵
  PID:5532
- C:\Windows\System\qnvbooK.exe
  C:\Windows\System\qnvbooK.exe
  2⤵
  PID:5560
- C:\Windows\System\JcjgrZs.exe
  C:\Windows\System\JcjgrZs.exe
  2⤵
  PID:5588
- C:\Windows\System\ubeBJca.exe
  C:\Windows\System\ubeBJca.exe
  2⤵
  PID:5616
- C:\Windows\System\rSCynFJ.exe
  C:\Windows\System\rSCynFJ.exe
  2⤵
  PID:5644
- C:\Windows\System\MBVCMHk.exe
  C:\Windows\System\MBVCMHk.exe
  2⤵
  PID:5668
- C:\Windows\System\tmDceSJ.exe
  C:\Windows\System\tmDceSJ.exe
  2⤵
  PID:5696
- C:\Windows\System\RlPReHD.exe
  C:\Windows\System\RlPReHD.exe
  2⤵
  PID:5728
- C:\Windows\System\vOvcdxh.exe
  C:\Windows\System\vOvcdxh.exe
  2⤵
  PID:5756
- C:\Windows\System\ObenOXI.exe
  C:\Windows\System\ObenOXI.exe
  2⤵
  PID:5784
- C:\Windows\System\zmMTigx.exe
  C:\Windows\System\zmMTigx.exe
  2⤵
  PID:5812
- C:\Windows\System\KmCmbdm.exe
  C:\Windows\System\KmCmbdm.exe
  2⤵
  PID:5840
- C:\Windows\System\EkoqGCU.exe
  C:\Windows\System\EkoqGCU.exe
  2⤵
  PID:5868
- C:\Windows\System\uwkIQVg.exe
  C:\Windows\System\uwkIQVg.exe
  2⤵
  PID:5896
- C:\Windows\System\mHMKXjo.exe
  C:\Windows\System\mHMKXjo.exe
  2⤵
  PID:5924
- C:\Windows\System\ULUdwRX.exe
  C:\Windows\System\ULUdwRX.exe
  2⤵
  PID:5952
- C:\Windows\System\fZcTsOL.exe
  C:\Windows\System\fZcTsOL.exe
  2⤵
  PID:5980
- C:\Windows\System\IgOLeTe.exe
  C:\Windows\System\IgOLeTe.exe
  2⤵
  PID:6008
- C:\Windows\System\wcUgtCB.exe
  C:\Windows\System\wcUgtCB.exe
  2⤵
  PID:6036
- C:\Windows\System\YrPlmvY.exe
  C:\Windows\System\YrPlmvY.exe
  2⤵
  PID:6060
- C:\Windows\System\qRSxKCM.exe
  C:\Windows\System\qRSxKCM.exe
  2⤵
  PID:6092
- C:\Windows\System\ZQTfmYx.exe
  C:\Windows\System\ZQTfmYx.exe
  2⤵
  PID:6120
- C:\Windows\System\XkflFVd.exe
  C:\Windows\System\XkflFVd.exe
  2⤵
  PID:4248
- C:\Windows\System\EEKWqTn.exe
  C:\Windows\System\EEKWqTn.exe
  2⤵
  PID:2256
- C:\Windows\System\UkwhvXf.exe
  C:\Windows\System\UkwhvXf.exe
  2⤵
  PID:4480
- C:\Windows\System\zBFfQrZ.exe
  C:\Windows\System\zBFfQrZ.exe
  2⤵
  PID:3144
- C:\Windows\System\bjmsxNu.exe
  C:\Windows\System\bjmsxNu.exe
  2⤵
  PID:4284
- C:\Windows\System\RwvRHnf.exe
  C:\Windows\System\RwvRHnf.exe
  2⤵
  PID:1356
- C:\Windows\System\DWnIgAJ.exe
  C:\Windows\System\DWnIgAJ.exe
  2⤵
  PID:5124
- C:\Windows\System\IOKDpNq.exe
  C:\Windows\System\IOKDpNq.exe
  2⤵
  PID:5208
- C:\Windows\System\ksfWKtw.exe
  C:\Windows\System\ksfWKtw.exe
  2⤵
  PID:5252
- C:\Windows\System\YyYfNmu.exe
  C:\Windows\System\YyYfNmu.exe
  2⤵
  PID:5312
- C:\Windows\System\fHeEXak.exe
  C:\Windows\System\fHeEXak.exe
  2⤵
  PID:5388
- C:\Windows\System\uEhfjIC.exe
  C:\Windows\System\uEhfjIC.exe
  2⤵
  PID:5444
- C:\Windows\System\STXjvzQ.exe
  C:\Windows\System\STXjvzQ.exe
  2⤵
  PID:5516
- C:\Windows\System\rqlhyXG.exe
  C:\Windows\System\rqlhyXG.exe
  2⤵
  PID:5576
- C:\Windows\System\QkmaZOv.exe
  C:\Windows\System\QkmaZOv.exe
  2⤵
  PID:5636
- C:\Windows\System\Bgcgbij.exe
  C:\Windows\System\Bgcgbij.exe
  2⤵
  PID:5712
- C:\Windows\System\oWLOSVs.exe
  C:\Windows\System\oWLOSVs.exe
  2⤵
  PID:5772
- C:\Windows\System\BHkzgnZ.exe
  C:\Windows\System\BHkzgnZ.exe
  2⤵
  PID:5832
- C:\Windows\System\sHEAGwO.exe
  C:\Windows\System\sHEAGwO.exe
  2⤵
  PID:5908
- C:\Windows\System\bWBlPpi.exe
  C:\Windows\System\bWBlPpi.exe
  2⤵
  PID:5968
- C:\Windows\System\UrKjmaj.exe
  C:\Windows\System\UrKjmaj.exe
  2⤵
  PID:6028
- C:\Windows\System\iZdLJjM.exe
  C:\Windows\System\iZdLJjM.exe
  2⤵
  PID:6104
- C:\Windows\System\muqLOki.exe
  C:\Windows\System\muqLOki.exe
  2⤵
  PID:4100
- C:\Windows\System\syQdPYb.exe
  C:\Windows\System\syQdPYb.exe
  2⤵
  PID:4880
- C:\Windows\System\dyzevNE.exe
  C:\Windows\System\dyzevNE.exe
  2⤵
  PID:4560
- C:\Windows\System\zzVZcln.exe
  C:\Windows\System\zzVZcln.exe
  2⤵
  PID:5240
- C:\Windows\System\pQTymjH.exe
  C:\Windows\System\pQTymjH.exe
  2⤵
  PID:5364
- C:\Windows\System\jGImxUD.exe
  C:\Windows\System\jGImxUD.exe
  2⤵
  PID:5544
- C:\Windows\System\JHWfftH.exe
  C:\Windows\System\JHWfftH.exe
  2⤵
  PID:5684
- C:\Windows\System\YoBsoPN.exe
  C:\Windows\System\YoBsoPN.exe
  2⤵
  PID:6172
- C:\Windows\System\nMYtMio.exe
  C:\Windows\System\nMYtMio.exe
  2⤵
  PID:6200
- C:\Windows\System\geOkgNG.exe
  C:\Windows\System\geOkgNG.exe
  2⤵
  PID:6228
- C:\Windows\System\XUssnvw.exe
  C:\Windows\System\XUssnvw.exe
  2⤵
  PID:6256
- C:\Windows\System\TJYmQKE.exe
  C:\Windows\System\TJYmQKE.exe
  2⤵
  PID:6284
- C:\Windows\System\fkzSuNU.exe
  C:\Windows\System\fkzSuNU.exe
  2⤵
  PID:6312
- C:\Windows\System\VRFvzOK.exe
  C:\Windows\System\VRFvzOK.exe
  2⤵
  PID:6340
- C:\Windows\System\GYMrjKL.exe
  C:\Windows\System\GYMrjKL.exe
  2⤵
  PID:6364
- C:\Windows\System\VTqnKkL.exe
  C:\Windows\System\VTqnKkL.exe
  2⤵
  PID:6396
- C:\Windows\System\wPvEYMD.exe
  C:\Windows\System\wPvEYMD.exe
  2⤵
  PID:6424
- C:\Windows\System\zAURkVu.exe
  C:\Windows\System\zAURkVu.exe
  2⤵
  PID:6452
- C:\Windows\System\ERaNYPS.exe
  C:\Windows\System\ERaNYPS.exe
  2⤵
  PID:6480
- C:\Windows\System\IcEyHoz.exe
  C:\Windows\System\IcEyHoz.exe
  2⤵
  PID:6508
- C:\Windows\System\qysFRXK.exe
  C:\Windows\System\qysFRXK.exe
  2⤵
  PID:6536
- C:\Windows\System\bPFcQZX.exe
  C:\Windows\System\bPFcQZX.exe
  2⤵
  PID:6564
- C:\Windows\System\DKTdlYv.exe
  C:\Windows\System\DKTdlYv.exe
  2⤵
  PID:6592
- C:\Windows\System\zJSnJQB.exe
  C:\Windows\System\zJSnJQB.exe
  2⤵
  PID:6620
- C:\Windows\System\dteajII.exe
  C:\Windows\System\dteajII.exe
  2⤵
  PID:6648
- C:\Windows\System\wQdauBd.exe
  C:\Windows\System\wQdauBd.exe
  2⤵
  PID:6676
- C:\Windows\System\kZcJFJB.exe
  C:\Windows\System\kZcJFJB.exe
  2⤵
  PID:6704
- C:\Windows\System\EnIeDAl.exe
  C:\Windows\System\EnIeDAl.exe
  2⤵
  PID:6736
- C:\Windows\System\CTYmneP.exe
  C:\Windows\System\CTYmneP.exe
  2⤵
  PID:6760
- C:\Windows\System\drRjKIA.exe
  C:\Windows\System\drRjKIA.exe
  2⤵
  PID:6788
- C:\Windows\System\BDUoOJG.exe
  C:\Windows\System\BDUoOJG.exe
  2⤵
  PID:6812
- C:\Windows\System\opcvcIH.exe
  C:\Windows\System\opcvcIH.exe
  2⤵
  PID:6840
- C:\Windows\System\Frtjgny.exe
  C:\Windows\System\Frtjgny.exe
  2⤵
  PID:6872
- C:\Windows\System\fjgFLCH.exe
  C:\Windows\System\fjgFLCH.exe
  2⤵
  PID:6900
- C:\Windows\System\JbCzdWE.exe
  C:\Windows\System\JbCzdWE.exe
  2⤵
  PID:6928
- C:\Windows\System\jtBjBGG.exe
  C:\Windows\System\jtBjBGG.exe
  2⤵
  PID:6956
- C:\Windows\System\RYCpZEY.exe
  C:\Windows\System\RYCpZEY.exe
  2⤵
  PID:6984
- C:\Windows\System\FpRzIho.exe
  C:\Windows\System\FpRzIho.exe
  2⤵
  PID:7012
- C:\Windows\System\qRTeFrU.exe
  C:\Windows\System\qRTeFrU.exe
  2⤵
  PID:7040
- C:\Windows\System\yjbXkHA.exe
  C:\Windows\System\yjbXkHA.exe
  2⤵
  PID:7068
- C:\Windows\System\eUjnpeP.exe
  C:\Windows\System\eUjnpeP.exe
  2⤵
  PID:7096
- C:\Windows\System\TbAxLsf.exe
  C:\Windows\System\TbAxLsf.exe
  2⤵
  PID:7124
- C:\Windows\System\bwARlTS.exe
  C:\Windows\System\bwARlTS.exe
  2⤵
  PID:7152
- C:\Windows\System\zFrYYGh.exe
  C:\Windows\System\zFrYYGh.exe
  2⤵
  PID:5748
- C:\Windows\System\FbaPnAm.exe
  C:\Windows\System\FbaPnAm.exe
  2⤵
  PID:5936
- C:\Windows\System\OZIpEjZ.exe
  C:\Windows\System\OZIpEjZ.exe
  2⤵
  PID:1832
- C:\Windows\System\AFUxIzD.exe
  C:\Windows\System\AFUxIzD.exe
  2⤵
  PID:2092
- C:\Windows\System\pFqnHbm.exe
  C:\Windows\System\pFqnHbm.exe
  2⤵
  PID:5156
- C:\Windows\System\VaaMNtR.exe
  C:\Windows\System\VaaMNtR.exe
  2⤵
  PID:5488
- C:\Windows\System\JExeAsJ.exe
  C:\Windows\System\JExeAsJ.exe
  2⤵
  PID:6188
- C:\Windows\System\qsQepXL.exe
  C:\Windows\System\qsQepXL.exe
  2⤵
  PID:6248
- C:\Windows\System\PAJjEaO.exe
  C:\Windows\System\PAJjEaO.exe
  2⤵
  PID:4528
- C:\Windows\System\HklbSRe.exe
  C:\Windows\System\HklbSRe.exe
  2⤵
  PID:6360
- C:\Windows\System\mYmNpbW.exe
  C:\Windows\System\mYmNpbW.exe
  2⤵
  PID:6440
- C:\Windows\System\SZccOLO.exe
  C:\Windows\System\SZccOLO.exe
  2⤵
  PID:6496
- C:\Windows\System\TJqIcwY.exe
  C:\Windows\System\TJqIcwY.exe
  2⤵
  PID:6556
- C:\Windows\System\LFJEDDR.exe
  C:\Windows\System\LFJEDDR.exe
  2⤵
  PID:6632
- C:\Windows\System\aNwGPjE.exe
  C:\Windows\System\aNwGPjE.exe
  2⤵
  PID:3572
- C:\Windows\System\vGuYKOs.exe
  C:\Windows\System\vGuYKOs.exe
  2⤵
  PID:6744
- C:\Windows\System\WFHwpyg.exe
  C:\Windows\System\WFHwpyg.exe
  2⤵
  PID:6804
- C:\Windows\System\IUUPtvM.exe
  C:\Windows\System\IUUPtvM.exe
  2⤵
  PID:6864
- C:\Windows\System\PJZUiSb.exe
  C:\Windows\System\PJZUiSb.exe
  2⤵
  PID:6920
- C:\Windows\System\ftVJvux.exe
  C:\Windows\System\ftVJvux.exe
  2⤵
  PID:7000
- C:\Windows\System\uGjvNii.exe
  C:\Windows\System\uGjvNii.exe
  2⤵
  PID:7056
- C:\Windows\System\JkQZsNP.exe
  C:\Windows\System\JkQZsNP.exe
  2⤵
  PID:7136
- C:\Windows\System\DBlXdmM.exe
  C:\Windows\System\DBlXdmM.exe
  2⤵
  PID:5860
- C:\Windows\System\KNdehAR.exe
  C:\Windows\System\KNdehAR.exe
  2⤵
  PID:6136
- C:\Windows\System\iWpRnVC.exe
  C:\Windows\System\iWpRnVC.exe
  2⤵
  PID:5468
- C:\Windows\System\tRtoZUd.exe
  C:\Windows\System\tRtoZUd.exe
  2⤵
  PID:6276
- C:\Windows\System\UMlbgHZ.exe
  C:\Windows\System\UMlbgHZ.exe
  2⤵
  PID:6408
- C:\Windows\System\nsvZvmc.exe
  C:\Windows\System\nsvZvmc.exe
  2⤵
  PID:6492
- C:\Windows\System\qIymKIt.exe
  C:\Windows\System\qIymKIt.exe
  2⤵
  PID:6608
- C:\Windows\System\Aofhgid.exe
  C:\Windows\System\Aofhgid.exe
  2⤵
  PID:6720
- C:\Windows\System\CHKsicN.exe
  C:\Windows\System\CHKsicN.exe
  2⤵
  PID:6892
- C:\Windows\System\WZwxYnc.exe
  C:\Windows\System\WZwxYnc.exe
  2⤵
  PID:7028
- C:\Windows\System\shuMmRX.exe
  C:\Windows\System\shuMmRX.exe
  2⤵
  PID:5688
- C:\Windows\System\YXzVacG.exe
  C:\Windows\System\YXzVacG.exe
  2⤵
  PID:6020
- C:\Windows\System\ZAYcOOX.exe
  C:\Windows\System\ZAYcOOX.exe
  2⤵
  PID:4664
- C:\Windows\System\FYyGcLE.exe
  C:\Windows\System\FYyGcLE.exe
  2⤵
  PID:6436
- C:\Windows\System\DylwZcv.exe
  C:\Windows\System\DylwZcv.exe
  2⤵
  PID:7196
- C:\Windows\System\eSnsJBy.exe
  C:\Windows\System\eSnsJBy.exe
  2⤵
  PID:7224
- C:\Windows\System\aCxbPEr.exe
  C:\Windows\System\aCxbPEr.exe
  2⤵
  PID:7252
- C:\Windows\System\UDUouAr.exe
  C:\Windows\System\UDUouAr.exe
  2⤵
  PID:7280
- C:\Windows\System\RIVAwKT.exe
  C:\Windows\System\RIVAwKT.exe
  2⤵
  PID:7308
- C:\Windows\System\zxbvDka.exe
  C:\Windows\System\zxbvDka.exe
  2⤵
  PID:7336
- C:\Windows\System\GAtTbuz.exe
  C:\Windows\System\GAtTbuz.exe
  2⤵
  PID:7364
- C:\Windows\System\DrNigNa.exe
  C:\Windows\System\DrNigNa.exe
  2⤵
  PID:7392
- C:\Windows\System\TcCfDvH.exe
  C:\Windows\System\TcCfDvH.exe
  2⤵
  PID:7420
- C:\Windows\System\mDQzTPv.exe
  C:\Windows\System\mDQzTPv.exe
  2⤵
  PID:7448
- C:\Windows\System\azEiooG.exe
  C:\Windows\System\azEiooG.exe
  2⤵
  PID:7476
- C:\Windows\System\zRCcJvg.exe
  C:\Windows\System\zRCcJvg.exe
  2⤵
  PID:7504
- C:\Windows\System\PEYiTTn.exe
  C:\Windows\System\PEYiTTn.exe
  2⤵
  PID:7532
- C:\Windows\System\NSvzvCp.exe
  C:\Windows\System\NSvzvCp.exe
  2⤵
  PID:7560
- C:\Windows\System\DERYfwT.exe
  C:\Windows\System\DERYfwT.exe
  2⤵
  PID:7688
- C:\Windows\System\lueURYg.exe
  C:\Windows\System\lueURYg.exe
  2⤵
  PID:7712
- C:\Windows\System\BZDLQbW.exe
  C:\Windows\System\BZDLQbW.exe
  2⤵
  PID:7728
- C:\Windows\System\KBsQaOY.exe
  C:\Windows\System\KBsQaOY.exe
  2⤵
  PID:7752
- C:\Windows\System\MSCGBwS.exe
  C:\Windows\System\MSCGBwS.exe
  2⤵
  PID:7772
- C:\Windows\System\LgZOqNr.exe
  C:\Windows\System\LgZOqNr.exe
  2⤵
  PID:7796
- C:\Windows\System\aOtFRFu.exe
  C:\Windows\System\aOtFRFu.exe
  2⤵
  PID:7812
- C:\Windows\System\egIPrsz.exe
  C:\Windows\System\egIPrsz.exe
  2⤵
  PID:7836
- C:\Windows\System\mrkJcZN.exe
  C:\Windows\System\mrkJcZN.exe
  2⤵
  PID:7856
- C:\Windows\System\OAFMgJE.exe
  C:\Windows\System\OAFMgJE.exe
  2⤵
  PID:7876
- C:\Windows\System\PHzXDNH.exe
  C:\Windows\System\PHzXDNH.exe
  2⤵
  PID:7892
- C:\Windows\System\ouqmPMw.exe
  C:\Windows\System\ouqmPMw.exe
  2⤵
  PID:7908
- C:\Windows\System\ylQIWBS.exe
  C:\Windows\System\ylQIWBS.exe
  2⤵
  PID:7924
- C:\Windows\System\qlqsDpe.exe
  C:\Windows\System\qlqsDpe.exe
  2⤵
  PID:7948
- C:\Windows\System\jdiieaH.exe
  C:\Windows\System\jdiieaH.exe
  2⤵
  PID:7968
- C:\Windows\System\JKhDsYM.exe
  C:\Windows\System\JKhDsYM.exe
  2⤵
  PID:7996
- C:\Windows\System\cKuNKGH.exe
  C:\Windows\System\cKuNKGH.exe
  2⤵
  PID:8028
- C:\Windows\System\IvlmLqQ.exe
  C:\Windows\System\IvlmLqQ.exe
  2⤵
  PID:8052
- C:\Windows\System\YPyTBiW.exe
  C:\Windows\System\YPyTBiW.exe
  2⤵
  PID:8068
- C:\Windows\System\BVfhZmW.exe
  C:\Windows\System\BVfhZmW.exe
  2⤵
  PID:8108
- C:\Windows\System\DhjwrsF.exe
  C:\Windows\System\DhjwrsF.exe
  2⤵
  PID:8144
- C:\Windows\System\dVOfCoq.exe
  C:\Windows\System\dVOfCoq.exe
  2⤵
  PID:8168
- C:\Windows\System\UkabHqz.exe
  C:\Windows\System\UkabHqz.exe
  2⤵
  PID:6464
- C:\Windows\System\iWAZPGP.exe
  C:\Windows\System\iWAZPGP.exe
  2⤵
  PID:3264
- C:\Windows\System\RikFAuh.exe
  C:\Windows\System\RikFAuh.exe
  2⤵
  PID:7088
- C:\Windows\System\wFrxsoc.exe
  C:\Windows\System\wFrxsoc.exe
  2⤵
  PID:2184
- C:\Windows\System\LNNVegm.exe
  C:\Windows\System\LNNVegm.exe
  2⤵
  PID:7180
- C:\Windows\System\ZRHPJZB.exe
  C:\Windows\System\ZRHPJZB.exe
  2⤵
  PID:7208
- C:\Windows\System\FpaNbgm.exe
  C:\Windows\System\FpaNbgm.exe
  2⤵
  PID:4548
- C:\Windows\System\Biugrpu.exe
  C:\Windows\System\Biugrpu.exe
  2⤵
  PID:7292
- C:\Windows\System\NJMRthM.exe
  C:\Windows\System\NJMRthM.exe
  2⤵
  PID:7384
- C:\Windows\System\GvNFVIJ.exe
  C:\Windows\System\GvNFVIJ.exe
  2⤵
  PID:2280
- C:\Windows\System\EgBZyBv.exe
  C:\Windows\System\EgBZyBv.exe
  2⤵
  PID:3684
- C:\Windows\System\IqngEPT.exe
  C:\Windows\System\IqngEPT.exe
  2⤵
  PID:7552
- C:\Windows\System\RZzCDYO.exe
  C:\Windows\System\RZzCDYO.exe
  2⤵
  PID:7604
- C:\Windows\System\daBuWgX.exe
  C:\Windows\System\daBuWgX.exe
  2⤵
  PID:7648
- C:\Windows\System\UTwQPBF.exe
  C:\Windows\System\UTwQPBF.exe
  2⤵
  PID:5016
- C:\Windows\System\CoghYFJ.exe
  C:\Windows\System\CoghYFJ.exe
  2⤵
  PID:1840
- C:\Windows\System\HZcpBaG.exe
  C:\Windows\System\HZcpBaG.exe
  2⤵
  PID:7720
- C:\Windows\System\ILHMDoO.exe
  C:\Windows\System\ILHMDoO.exe
  2⤵
  PID:7808
- C:\Windows\System\UfLKNGo.exe
  C:\Windows\System\UfLKNGo.exe
  2⤵
  PID:8092
- C:\Windows\System\dnizKUG.exe
  C:\Windows\System\dnizKUG.exe
  2⤵
  PID:7936
- C:\Windows\System\DZJrWsq.exe
  C:\Windows\System\DZJrWsq.exe
  2⤵
  PID:8044
- C:\Windows\System\GwSiUGd.exe
  C:\Windows\System\GwSiUGd.exe
  2⤵
  PID:8180
- C:\Windows\System\fPtUwYz.exe
  C:\Windows\System\fPtUwYz.exe
  2⤵
  PID:7264
- C:\Windows\System\BWTVHOj.exe
  C:\Windows\System\BWTVHOj.exe
  2⤵
  PID:6300
- C:\Windows\System\MUTWbmA.exe
  C:\Windows\System\MUTWbmA.exe
  2⤵
  PID:7244
- C:\Windows\System\rAQmcxz.exe
  C:\Windows\System\rAQmcxz.exe
  2⤵
  PID:7300
- C:\Windows\System\agLkGsO.exe
  C:\Windows\System\agLkGsO.exe
  2⤵
  PID:3804
- C:\Windows\System\xbOldcG.exe
  C:\Windows\System\xbOldcG.exe
  2⤵
  PID:5024
- C:\Windows\System\Enakdrh.exe
  C:\Windows\System\Enakdrh.exe
  2⤵
  PID:7656
- C:\Windows\System\BVJhBgF.exe
  C:\Windows\System\BVJhBgF.exe
  2⤵
  PID:7884
- C:\Windows\System\nDsCigp.exe
  C:\Windows\System\nDsCigp.exe
  2⤵
  PID:7904
- C:\Windows\System\crCAWJP.exe
  C:\Windows\System\crCAWJP.exe
  2⤵
  PID:2552
- C:\Windows\System\begqhhN.exe
  C:\Windows\System\begqhhN.exe
  2⤵
  PID:3400
- C:\Windows\System\kWLwaGM.exe
  C:\Windows\System\kWLwaGM.exe
  2⤵
  PID:7356
- C:\Windows\System\ymUHfCl.exe
  C:\Windows\System\ymUHfCl.exe
  2⤵
  PID:8040
- C:\Windows\System\cjebWmX.exe
  C:\Windows\System\cjebWmX.exe
  2⤵
  PID:2340
- C:\Windows\System\XpLWGNw.exe
  C:\Windows\System\XpLWGNw.exe
  2⤵
  PID:7212
- C:\Windows\System\MdxrrQj.exe
  C:\Windows\System\MdxrrQj.exe
  2⤵
  PID:7412
- C:\Windows\System\WhxiBYI.exe
  C:\Windows\System\WhxiBYI.exe
  2⤵
  PID:3472
- C:\Windows\System\VaARYQi.exe
  C:\Windows\System\VaARYQi.exe
  2⤵
  PID:7784
- C:\Windows\System\lgHnfzZ.exe
  C:\Windows\System\lgHnfzZ.exe
  2⤵
  PID:7240
- C:\Windows\System\IRiZYJZ.exe
  C:\Windows\System\IRiZYJZ.exe
  2⤵
  PID:7188
- C:\Windows\System\RapISPY.exe
  C:\Windows\System\RapISPY.exe
  2⤵
  PID:4596
- C:\Windows\System\rpjNrjb.exe
  C:\Windows\System\rpjNrjb.exe
  2⤵
  PID:7544
- C:\Windows\System\yiuxlAv.exe
  C:\Windows\System\yiuxlAv.exe
  2⤵
  PID:8208
- C:\Windows\System\GmCKjJU.exe
  C:\Windows\System\GmCKjJU.exe
  2⤵
  PID:8248
- C:\Windows\System\UgXEuEe.exe
  C:\Windows\System\UgXEuEe.exe
  2⤵
  PID:8272
- C:\Windows\System\JyUzUOA.exe
  C:\Windows\System\JyUzUOA.exe
  2⤵
  PID:8308
- C:\Windows\System\Aebvakj.exe
  C:\Windows\System\Aebvakj.exe
  2⤵
  PID:8336
- C:\Windows\System\DRnGfkZ.exe
  C:\Windows\System\DRnGfkZ.exe
  2⤵
  PID:8352
- C:\Windows\System\iDQuyls.exe
  C:\Windows\System\iDQuyls.exe
  2⤵
  PID:8380
- C:\Windows\System\wgyiTso.exe
  C:\Windows\System\wgyiTso.exe
  2⤵
  PID:8420
- C:\Windows\System\MVUEong.exe
  C:\Windows\System\MVUEong.exe
  2⤵
  PID:8452
- C:\Windows\System\PbHkITl.exe
  C:\Windows\System\PbHkITl.exe
  2⤵
  PID:8480
- C:\Windows\System\XnSSOct.exe
  C:\Windows\System\XnSSOct.exe
  2⤵
  PID:8500
- C:\Windows\System\NIwYrGs.exe
  C:\Windows\System\NIwYrGs.exe
  2⤵
  PID:8540
- C:\Windows\System\FHEgjIO.exe
  C:\Windows\System\FHEgjIO.exe
  2⤵
  PID:8568
- C:\Windows\System\UDAFLXB.exe
  C:\Windows\System\UDAFLXB.exe
  2⤵
  PID:8584
- C:\Windows\System\uhiYOgg.exe
  C:\Windows\System\uhiYOgg.exe
  2⤵
  PID:8616
- C:\Windows\System\lzJHeWW.exe
  C:\Windows\System\lzJHeWW.exe
  2⤵
  PID:8652
- C:\Windows\System\zmjmQZy.exe
  C:\Windows\System\zmjmQZy.exe
  2⤵
  PID:8672
- C:\Windows\System\vGjhWtn.exe
  C:\Windows\System\vGjhWtn.exe
  2⤵
  PID:8708
- C:\Windows\System\fOwTtEZ.exe
  C:\Windows\System\fOwTtEZ.exe
  2⤵
  PID:8728
- C:\Windows\System\ScgHlkj.exe
  C:\Windows\System\ScgHlkj.exe
  2⤵
  PID:8748
- C:\Windows\System\XEgTBkQ.exe
  C:\Windows\System\XEgTBkQ.exe
  2⤵
  PID:8768
- C:\Windows\System\RtoJFrT.exe
  C:\Windows\System\RtoJFrT.exe
  2⤵
  PID:8808
- C:\Windows\System\UBivBvr.exe
  C:\Windows\System\UBivBvr.exe
  2⤵
  PID:8840
- C:\Windows\System\kFJLdbe.exe
  C:\Windows\System\kFJLdbe.exe
  2⤵
  PID:8876
- C:\Windows\System\HygIvYd.exe
  C:\Windows\System\HygIvYd.exe
  2⤵
  PID:8892
- C:\Windows\System\XonVuAx.exe
  C:\Windows\System\XonVuAx.exe
  2⤵
  PID:8928
- C:\Windows\System\NxHnuPo.exe
  C:\Windows\System\NxHnuPo.exe
  2⤵
  PID:8952
- C:\Windows\System\LUSuqEc.exe
  C:\Windows\System\LUSuqEc.exe
  2⤵
  PID:8968
- C:\Windows\System\VxsZFih.exe
  C:\Windows\System\VxsZFih.exe
  2⤵
  PID:9020
- C:\Windows\System\RoOMoVQ.exe
  C:\Windows\System\RoOMoVQ.exe
  2⤵
  PID:9036
- C:\Windows\System\kdVrMQh.exe
  C:\Windows\System\kdVrMQh.exe
  2⤵
  PID:9064
- C:\Windows\System\WXvDYVi.exe
  C:\Windows\System\WXvDYVi.exe
  2⤵
  PID:9092
- C:\Windows\System\YMuPLNZ.exe
  C:\Windows\System\YMuPLNZ.exe
  2⤵
  PID:9148
- C:\Windows\System\YOgHzIx.exe
  C:\Windows\System\YOgHzIx.exe
  2⤵
  PID:9168
- C:\Windows\System\Wdrewpv.exe
  C:\Windows\System\Wdrewpv.exe
  2⤵
  PID:9196
- C:\Windows\System\lNIRhaA.exe
  C:\Windows\System\lNIRhaA.exe
  2⤵
  PID:1408
- C:\Windows\System\hSxBTgH.exe
  C:\Windows\System\hSxBTgH.exe
  2⤵
  PID:8268
- C:\Windows\System\LLWTBsB.exe
  C:\Windows\System\LLWTBsB.exe
  2⤵
  PID:8328
- C:\Windows\System\wnZIDTL.exe
  C:\Windows\System\wnZIDTL.exe
  2⤵
  PID:8364
- C:\Windows\System\BiUCAkl.exe
  C:\Windows\System\BiUCAkl.exe
  2⤵
  PID:8476
- C:\Windows\System\TIcWITT.exe
  C:\Windows\System\TIcWITT.exe
  2⤵
  PID:8524
- C:\Windows\System\LzuWrju.exe
  C:\Windows\System\LzuWrju.exe
  2⤵
  PID:8580
- C:\Windows\System\AiSRhFX.exe
  C:\Windows\System\AiSRhFX.exe
  2⤵
  PID:8668
- C:\Windows\System\ANcLDht.exe
  C:\Windows\System\ANcLDht.exe
  2⤵
  PID:8716
- C:\Windows\System\oOmnMUN.exe
  C:\Windows\System\oOmnMUN.exe
  2⤵
  PID:8744
- C:\Windows\System\PdVVMuj.exe
  C:\Windows\System\PdVVMuj.exe
  2⤵
  PID:8784
- C:\Windows\System\pxbxhtQ.exe
  C:\Windows\System\pxbxhtQ.exe
  2⤵
  PID:8960
- C:\Windows\System\XhBwBTA.exe
  C:\Windows\System\XhBwBTA.exe
  2⤵
  PID:8944
- C:\Windows\System\JxfxTpd.exe
  C:\Windows\System\JxfxTpd.exe
  2⤵
  PID:9052
- C:\Windows\System\pqWNGHQ.exe
  C:\Windows\System\pqWNGHQ.exe
  2⤵
  PID:9108
- C:\Windows\System\CfCAAJj.exe
  C:\Windows\System\CfCAAJj.exe
  2⤵
  PID:9164
- C:\Windows\System\AgxnTdx.exe
  C:\Windows\System\AgxnTdx.exe
  2⤵
  PID:9212
- C:\Windows\System\mbqMpWC.exe
  C:\Windows\System\mbqMpWC.exe
  2⤵
  PID:8388
- C:\Windows\System\FUfTYqd.exe
  C:\Windows\System\FUfTYqd.exe
  2⤵
  PID:8496
- C:\Windows\System\pWBONZu.exe
  C:\Windows\System\pWBONZu.exe
  2⤵
  PID:8692
- C:\Windows\System\abpYftL.exe
  C:\Windows\System\abpYftL.exe
  2⤵
  PID:8888
- C:\Windows\System\zDMyLGv.exe
  C:\Windows\System\zDMyLGv.exe
  2⤵
  PID:9028
- C:\Windows\System\vRZEaZj.exe
  C:\Windows\System\vRZEaZj.exe
  2⤵
  PID:9116
- C:\Windows\System\vVlnuVn.exe
  C:\Windows\System\vVlnuVn.exe
  2⤵
  PID:8408
- C:\Windows\System\nwqAjJr.exe
  C:\Windows\System\nwqAjJr.exe
  2⤵
  PID:8740
- C:\Windows\System\QDoIXEo.exe
  C:\Windows\System\QDoIXEo.exe
  2⤵
  PID:9032
- C:\Windows\System\KahCPsb.exe
  C:\Windows\System\KahCPsb.exe
  2⤵
  PID:8924
- C:\Windows\System\LJKObFn.exe
  C:\Windows\System\LJKObFn.exe
  2⤵
  PID:8868
- C:\Windows\System\mvLSicO.exe
  C:\Windows\System\mvLSicO.exe
  2⤵
  PID:9240
- C:\Windows\System\HAHRvtM.exe
  C:\Windows\System\HAHRvtM.exe
  2⤵
  PID:9268
- C:\Windows\System\naDvQKX.exe
  C:\Windows\System\naDvQKX.exe
  2⤵
  PID:9296
- C:\Windows\System\ZVXOwVO.exe
  C:\Windows\System\ZVXOwVO.exe
  2⤵
  PID:9324
- C:\Windows\System\ehoGECE.exe
  C:\Windows\System\ehoGECE.exe
  2⤵
  PID:9364
- C:\Windows\System\PNMJOtc.exe
  C:\Windows\System\PNMJOtc.exe
  2⤵
  PID:9392
- C:\Windows\System\zzeTRTu.exe
  C:\Windows\System\zzeTRTu.exe
  2⤵
  PID:9420
- C:\Windows\System\CTtMZMK.exe
  C:\Windows\System\CTtMZMK.exe
  2⤵
  PID:9448
- C:\Windows\System\jaFZtMt.exe
  C:\Windows\System\jaFZtMt.exe
  2⤵
  PID:9476
- C:\Windows\System\poesnos.exe
  C:\Windows\System\poesnos.exe
  2⤵
  PID:9500
- C:\Windows\System\kELrdXq.exe
  C:\Windows\System\kELrdXq.exe
  2⤵
  PID:9524
- C:\Windows\System\uTKkBHB.exe
  C:\Windows\System\uTKkBHB.exe
  2⤵
  PID:9564
- C:\Windows\System\IHPrUat.exe
  C:\Windows\System\IHPrUat.exe
  2⤵
  PID:9584
- C:\Windows\System\RRFNvmN.exe
  C:\Windows\System\RRFNvmN.exe
  2⤵
  PID:9612
- C:\Windows\System\TVjqvpQ.exe
  C:\Windows\System\TVjqvpQ.exe
  2⤵
  PID:9636
- C:\Windows\System\ckqcPNj.exe
  C:\Windows\System\ckqcPNj.exe
  2⤵
  PID:9676
- C:\Windows\System\PXPMoXc.exe
  C:\Windows\System\PXPMoXc.exe
  2⤵
  PID:9692
- C:\Windows\System\yaUGZWr.exe
  C:\Windows\System\yaUGZWr.exe
  2⤵
  PID:9716
- C:\Windows\System\HoJudtJ.exe
  C:\Windows\System\HoJudtJ.exe
  2⤵
  PID:9748
- C:\Windows\System\JCDOsiV.exe
  C:\Windows\System\JCDOsiV.exe
  2⤵
  PID:9780
- C:\Windows\System\QLIRhve.exe
  C:\Windows\System\QLIRhve.exe
  2⤵
  PID:9816
- C:\Windows\System\oTiHrDb.exe
  C:\Windows\System\oTiHrDb.exe
  2⤵
  PID:9844
- C:\Windows\System\ziEaZiV.exe
  C:\Windows\System\ziEaZiV.exe
  2⤵
  PID:9860
- C:\Windows\System\XVxqTAn.exe
  C:\Windows\System\XVxqTAn.exe
  2⤵
  PID:9900
- C:\Windows\System\mkigTaq.exe
  C:\Windows\System\mkigTaq.exe
  2⤵
  PID:9928
- C:\Windows\System\XUrSECk.exe
  C:\Windows\System\XUrSECk.exe
  2⤵
  PID:9956
- C:\Windows\System\YCWwDge.exe
  C:\Windows\System\YCWwDge.exe
  2⤵
  PID:9984
- C:\Windows\System\HHitBjn.exe
  C:\Windows\System\HHitBjn.exe
  2⤵
  PID:10016
- C:\Windows\System\MzoTTWv.exe
  C:\Windows\System\MzoTTWv.exe
  2⤵
  PID:10044
- C:\Windows\System\PLTWJDT.exe
  C:\Windows\System\PLTWJDT.exe
  2⤵
  PID:10060
- C:\Windows\System\HJIWwpC.exe
  C:\Windows\System\HJIWwpC.exe
  2⤵
  PID:10100
- C:\Windows\System\TrKkweS.exe
  C:\Windows\System\TrKkweS.exe
  2⤵
  PID:10116
- C:\Windows\System\aWqXIcu.exe
  C:\Windows\System\aWqXIcu.exe
  2⤵
  PID:10148
- C:\Windows\System\npzetJH.exe
  C:\Windows\System\npzetJH.exe
  2⤵
  PID:10184
- C:\Windows\System\sWSpkRT.exe
  C:\Windows\System\sWSpkRT.exe
  2⤵
  PID:10200
- C:\Windows\System\CBwgtKy.exe
  C:\Windows\System\CBwgtKy.exe
  2⤵
  PID:8440
- C:\Windows\System\tmJnYyZ.exe
  C:\Windows\System\tmJnYyZ.exe
  2⤵
  PID:9260
- C:\Windows\System\RLNBhHY.exe
  C:\Windows\System\RLNBhHY.exe
  2⤵
  PID:9320
- C:\Windows\System\lXKvKmn.exe
  C:\Windows\System\lXKvKmn.exe
  2⤵
  PID:9360
- C:\Windows\System\kkUfjQo.exe
  C:\Windows\System\kkUfjQo.exe
  2⤵
  PID:9400
- C:\Windows\System\fTIkmlo.exe
  C:\Windows\System\fTIkmlo.exe
  2⤵
  PID:9516
- C:\Windows\System\gvsHvKu.exe
  C:\Windows\System\gvsHvKu.exe
  2⤵
  PID:9560
- C:\Windows\System\URqfCyo.exe
  C:\Windows\System\URqfCyo.exe
  2⤵
  PID:9660
- C:\Windows\System\kYmlavL.exe
  C:\Windows\System\kYmlavL.exe
  2⤵
  PID:9684
- C:\Windows\System\bpdydPR.exe
  C:\Windows\System\bpdydPR.exe
  2⤵
  PID:9736
- C:\Windows\System\TMNBZLO.exe
  C:\Windows\System\TMNBZLO.exe
  2⤵
  PID:9852
- C:\Windows\System\abTfFte.exe
  C:\Windows\System\abTfFte.exe
  2⤵
  PID:9920
- C:\Windows\System\JnzdJSo.exe
  C:\Windows\System\JnzdJSo.exe
  2⤵
  PID:9976
- C:\Windows\System\iefXxua.exe
  C:\Windows\System\iefXxua.exe
  2⤵
  PID:10012
- C:\Windows\System\FYYlLSo.exe
  C:\Windows\System\FYYlLSo.exe
  2⤵
  PID:10076
- C:\Windows\System\UbCOtzo.exe
  C:\Windows\System\UbCOtzo.exe
  2⤵
  PID:10140
- C:\Windows\System\OKavaQO.exe
  C:\Windows\System\OKavaQO.exe
  2⤵
  PID:10224
- C:\Windows\System\DGBEewq.exe
  C:\Windows\System\DGBEewq.exe
  2⤵
  PID:9228
- C:\Windows\System\gYfGAvF.exe
  C:\Windows\System\gYfGAvF.exe
  2⤵
  PID:9444
- C:\Windows\System\lXAcSxU.exe
  C:\Windows\System\lXAcSxU.exe
  2⤵
  PID:9556
- C:\Windows\System\wyijsEq.exe
  C:\Windows\System\wyijsEq.exe
  2⤵
  PID:9708
- C:\Windows\System\HdDqcNF.exe
  C:\Windows\System\HdDqcNF.exe
  2⤵
  PID:9832
- C:\Windows\System\qKexOGN.exe
  C:\Windows\System\qKexOGN.exe
  2⤵
  PID:9968
- C:\Windows\System\Bxfxpcs.exe
  C:\Windows\System\Bxfxpcs.exe
  2⤵
  PID:10108
- C:\Windows\System\ytEHbQa.exe
  C:\Windows\System\ytEHbQa.exe
  2⤵
  PID:9312
- C:\Windows\System\oTCGVwO.exe
  C:\Windows\System\oTCGVwO.exe
  2⤵
  PID:9672
- C:\Windows\System\dRktnrk.exe
  C:\Windows\System\dRktnrk.exe
  2⤵
  PID:10036
- C:\Windows\System\AgthUJQ.exe
  C:\Windows\System\AgthUJQ.exe
  2⤵
  PID:9572
- C:\Windows\System\wyPmazC.exe
  C:\Windows\System\wyPmazC.exe
  2⤵
  PID:10248
- C:\Windows\System\zQpcLyO.exe
  C:\Windows\System\zQpcLyO.exe
  2⤵
  PID:10264
- C:\Windows\System\YvzbvJz.exe
  C:\Windows\System\YvzbvJz.exe
  2⤵
  PID:10280
- C:\Windows\System\aCKVRbs.exe
  C:\Windows\System\aCKVRbs.exe
  2⤵
  PID:10308
- C:\Windows\System\YZZYpiv.exe
  C:\Windows\System\YZZYpiv.exe
  2⤵
  PID:10328
- C:\Windows\System\UBxItWz.exe
  C:\Windows\System\UBxItWz.exe
  2⤵
  PID:10352
- C:\Windows\System\MITrBmJ.exe
  C:\Windows\System\MITrBmJ.exe
  2⤵
  PID:10392
- C:\Windows\System\vuiPkVt.exe
  C:\Windows\System\vuiPkVt.exe
  2⤵
  PID:10440
- C:\Windows\System\itOxmey.exe
  C:\Windows\System\itOxmey.exe
  2⤵
  PID:10476
- C:\Windows\System\vrKfrOz.exe
  C:\Windows\System\vrKfrOz.exe
  2⤵
  PID:10504
- C:\Windows\System\BwkPjYK.exe
  C:\Windows\System\BwkPjYK.exe
  2⤵
  PID:10532
- C:\Windows\System\nryWyYw.exe
  C:\Windows\System\nryWyYw.exe
  2⤵
  PID:10560
- C:\Windows\System\yDOXvsh.exe
  C:\Windows\System\yDOXvsh.exe
  2⤵
  PID:10588
- C:\Windows\System\SQvcTGJ.exe
  C:\Windows\System\SQvcTGJ.exe
  2⤵
  PID:10616
- C:\Windows\System\uaBwwmd.exe
  C:\Windows\System\uaBwwmd.exe
  2⤵
  PID:10632
- C:\Windows\System\WsMEhSm.exe
  C:\Windows\System\WsMEhSm.exe
  2⤵
  PID:10672
- C:\Windows\System\NZqnudR.exe
  C:\Windows\System\NZqnudR.exe
  2⤵
  PID:10700
- C:\Windows\System\HuQpuVL.exe
  C:\Windows\System\HuQpuVL.exe
  2⤵
  PID:10716
- C:\Windows\System\osCFcDM.exe
  C:\Windows\System\osCFcDM.exe
  2⤵
  PID:10752
- C:\Windows\System\MoWetCr.exe
  C:\Windows\System\MoWetCr.exe
  2⤵
  PID:10772
- C:\Windows\System\EJpRJlT.exe
  C:\Windows\System\EJpRJlT.exe
  2⤵
  PID:10800
- C:\Windows\System\ZkwNaWR.exe
  C:\Windows\System\ZkwNaWR.exe
  2⤵
  PID:10844
- C:\Windows\System\OVKYFXh.exe
  C:\Windows\System\OVKYFXh.exe
  2⤵
  PID:10860
- C:\Windows\System\RbqqzJq.exe
  C:\Windows\System\RbqqzJq.exe
  2⤵
  PID:10888
- C:\Windows\System\WGMdIYO.exe
  C:\Windows\System\WGMdIYO.exe
  2⤵
  PID:10920
- C:\Windows\System\NeJioPx.exe
  C:\Windows\System\NeJioPx.exe
  2⤵
  PID:10948
- C:\Windows\System\qfIyAQF.exe
  C:\Windows\System\qfIyAQF.exe
  2⤵
  PID:10984
- C:\Windows\System\CPHDoef.exe
  C:\Windows\System\CPHDoef.exe
  2⤵
  PID:11004
- C:\Windows\System\LkQIgQj.exe
  C:\Windows\System\LkQIgQj.exe
  2⤵
  PID:11044
- C:\Windows\System\GPddpfS.exe
  C:\Windows\System\GPddpfS.exe
  2⤵
  PID:11072
- C:\Windows\System\OdcIMWJ.exe
  C:\Windows\System\OdcIMWJ.exe
  2⤵
  PID:11100
- C:\Windows\System\FXuydYO.exe
  C:\Windows\System\FXuydYO.exe
  2⤵
  PID:11128
- C:\Windows\System\iqsrJLW.exe
  C:\Windows\System\iqsrJLW.exe
  2⤵
  PID:11156
- C:\Windows\System\cVnacpS.exe
  C:\Windows\System\cVnacpS.exe
  2⤵
  PID:11184
- C:\Windows\System\NrQHEND.exe
  C:\Windows\System\NrQHEND.exe
  2⤵
  PID:11212
- C:\Windows\System\pBfPMsu.exe
  C:\Windows\System\pBfPMsu.exe
  2⤵
  PID:11240
- C:\Windows\System\jVPWeJe.exe
  C:\Windows\System\jVPWeJe.exe
  2⤵
  PID:9256
- C:\Windows\System\jZeEwyZ.exe
  C:\Windows\System\jZeEwyZ.exe
  2⤵
  PID:10316
- C:\Windows\System\THESfje.exe
  C:\Windows\System\THESfje.exe
  2⤵
  PID:10380
- C:\Windows\System\XxSqsMo.exe
  C:\Windows\System\XxSqsMo.exe
  2⤵
  PID:10428
- C:\Windows\System\neYlBPU.exe
  C:\Windows\System\neYlBPU.exe
  2⤵
  PID:10496
- C:\Windows\System\fMPOkfo.exe
  C:\Windows\System\fMPOkfo.exe
  2⤵
  PID:10544
- C:\Windows\System\ckhyIHw.exe
  C:\Windows\System\ckhyIHw.exe
  2⤵
  PID:10648
- C:\Windows\System\wKAgRZH.exe
  C:\Windows\System\wKAgRZH.exe
  2⤵
  PID:10696
- C:\Windows\System\xxNaOew.exe
  C:\Windows\System\xxNaOew.exe
  2⤵
  PID:10744
- C:\Windows\System\xfbEtLU.exe
  C:\Windows\System\xfbEtLU.exe
  2⤵
  PID:10812
- C:\Windows\System\LUZUlTF.exe
  C:\Windows\System\LUZUlTF.exe
  2⤵
  PID:10852
- C:\Windows\System\kDaykEL.exe
  C:\Windows\System\kDaykEL.exe
  2⤵
  PID:10936
- C:\Windows\System\kmYeyCA.exe
  C:\Windows\System\kmYeyCA.exe
  2⤵
  PID:11028
- C:\Windows\System\zDnzFjy.exe
  C:\Windows\System\zDnzFjy.exe
  2⤵
  PID:11060
- C:\Windows\System\ScTmhWC.exe
  C:\Windows\System\ScTmhWC.exe
  2⤵
  PID:11124
- C:\Windows\System\IjEPNxJ.exe
  C:\Windows\System\IjEPNxJ.exe
  2⤵
  PID:11196
- C:\Windows\System\JJuGETa.exe
  C:\Windows\System\JJuGETa.exe
  2⤵
  PID:11232
- C:\Windows\System\xthXytC.exe
  C:\Windows\System\xthXytC.exe
  2⤵
  PID:10408
- C:\Windows\System\LYWYYOE.exe
  C:\Windows\System\LYWYYOE.exe
  2⤵
  PID:10584
- C:\Windows\System\dTxXrPn.exe
  C:\Windows\System\dTxXrPn.exe
  2⤵
  PID:10760
- C:\Windows\System\SgQaZNk.exe
  C:\Windows\System\SgQaZNk.exe
  2⤵
  PID:10912
- C:\Windows\System\tzYjFqr.exe
  C:\Windows\System\tzYjFqr.exe
  2⤵
  PID:11040
- C:\Windows\System\RKdputN.exe
  C:\Windows\System\RKdputN.exe
  2⤵
  PID:11120
- C:\Windows\System\wAAaAUW.exe
  C:\Windows\System\wAAaAUW.exe
  2⤵
  PID:11168
- C:\Windows\System\ywNcrbC.exe
  C:\Windows\System\ywNcrbC.exe
  2⤵
  PID:10784
- C:\Windows\System\tgaxATf.exe
  C:\Windows\System\tgaxATf.exe
  2⤵
  PID:11084
- C:\Windows\System\LryuieJ.exe
  C:\Windows\System\LryuieJ.exe
  2⤵
  PID:10276
- C:\Windows\System\lfWaWyA.exe
  C:\Windows\System\lfWaWyA.exe
  2⤵
  PID:11152
- C:\Windows\System\trxASLO.exe
  C:\Windows\System\trxASLO.exe
  2⤵
  PID:11300
- C:\Windows\System\VtdZRRC.exe
  C:\Windows\System\VtdZRRC.exe
  2⤵
  PID:11328
- C:\Windows\System\oLJXRkc.exe
  C:\Windows\System\oLJXRkc.exe
  2⤵
  PID:11356
- C:\Windows\System\qgYLVqJ.exe
  C:\Windows\System\qgYLVqJ.exe
  2⤵
  PID:11376
- C:\Windows\System\YkumNtp.exe
  C:\Windows\System\YkumNtp.exe
  2⤵
  PID:11416
- C:\Windows\System\sCynQFw.exe
  C:\Windows\System\sCynQFw.exe
  2⤵
  PID:11444
- C:\Windows\System\WtNihxz.exe
  C:\Windows\System\WtNihxz.exe
  2⤵
  PID:11472
- C:\Windows\System\faPkxiv.exe
  C:\Windows\System\faPkxiv.exe
  2⤵
  PID:11500
- C:\Windows\System\JoETgfZ.exe
  C:\Windows\System\JoETgfZ.exe
  2⤵
  PID:11516
- C:\Windows\System\KTjidsh.exe
  C:\Windows\System\KTjidsh.exe
  2⤵
  PID:11544
- C:\Windows\System\AmSbxzj.exe
  C:\Windows\System\AmSbxzj.exe
  2⤵
  PID:11572
- C:\Windows\System\jaYVDyT.exe
  C:\Windows\System\jaYVDyT.exe
  2⤵
  PID:11600
- C:\Windows\System\oSHqGKP.exe
  C:\Windows\System\oSHqGKP.exe
  2⤵
  PID:11628
- C:\Windows\System\oenDnwL.exe
  C:\Windows\System\oenDnwL.exe
  2⤵
  PID:11668
- C:\Windows\System\pyfCYSK.exe
  C:\Windows\System\pyfCYSK.exe
  2⤵
  PID:11688
- C:\Windows\System\tgVNZHi.exe
  C:\Windows\System\tgVNZHi.exe
  2⤵
  PID:11716
- C:\Windows\System\yqgbuEJ.exe
  C:\Windows\System\yqgbuEJ.exe
  2⤵
  PID:11740
- C:\Windows\System\xUTfDgb.exe
  C:\Windows\System\xUTfDgb.exe
  2⤵
  PID:11780
- C:\Windows\System\abtysjP.exe
  C:\Windows\System\abtysjP.exe
  2⤵
  PID:11808
- C:\Windows\System\HPdPcYG.exe
  C:\Windows\System\HPdPcYG.exe
  2⤵
  PID:11836
- C:\Windows\System\trJAXGM.exe
  C:\Windows\System\trJAXGM.exe
  2⤵
  PID:11864
- C:\Windows\System\lxIPGXN.exe
  C:\Windows\System\lxIPGXN.exe
  2⤵
  PID:11904
- C:\Windows\System\urpUagl.exe
  C:\Windows\System\urpUagl.exe
  2⤵
  PID:11924
- C:\Windows\System\LOrQiDu.exe
  C:\Windows\System\LOrQiDu.exe
  2⤵
  PID:11948
- C:\Windows\System\kYltmnA.exe
  C:\Windows\System\kYltmnA.exe
  2⤵
  PID:11964
- C:\Windows\System\OTXzYYS.exe
  C:\Windows\System\OTXzYYS.exe
  2⤵
  PID:12016
- C:\Windows\System\YENDddd.exe
  C:\Windows\System\YENDddd.exe
  2⤵
  PID:12036
- C:\Windows\System\KEPKcgB.exe
  C:\Windows\System\KEPKcgB.exe
  2⤵
  PID:12072
- C:\Windows\System\sRoPqqn.exe
  C:\Windows\System\sRoPqqn.exe
  2⤵
  PID:12092
- C:\Windows\System\asAWNDf.exe
  C:\Windows\System\asAWNDf.exe
  2⤵
  PID:12136
- C:\Windows\System\kiUZvKM.exe
  C:\Windows\System\kiUZvKM.exe
  2⤵
  PID:12164
- C:\Windows\System\eXJIkiN.exe
  C:\Windows\System\eXJIkiN.exe
  2⤵
  PID:12208
- C:\Windows\System\pOfxALY.exe
  C:\Windows\System\pOfxALY.exe
  2⤵
  PID:12232
- C:\Windows\System\bfvBvGD.exe
  C:\Windows\System\bfvBvGD.exe
  2⤵
  PID:12260
- C:\Windows\System\DmCmoHu.exe
  C:\Windows\System\DmCmoHu.exe
  2⤵
  PID:10708
- C:\Windows\System\QLOwYLh.exe
  C:\Windows\System\QLOwYLh.exe
  2⤵
  PID:11348
- C:\Windows\System\vEZQyYu.exe
  C:\Windows\System\vEZQyYu.exe
  2⤵
  PID:11412
- C:\Windows\System\WNPKpMg.exe
  C:\Windows\System\WNPKpMg.exe
  2⤵
  PID:11484
- C:\Windows\System\iGmyAYh.exe
  C:\Windows\System\iGmyAYh.exe
  2⤵
  PID:11528
- C:\Windows\System\ogDeXFz.exe
  C:\Windows\System\ogDeXFz.exe
  2⤵
  PID:11588
- C:\Windows\System\KKcgsiK.exe
  C:\Windows\System\KKcgsiK.exe
  2⤵
  PID:11648
- C:\Windows\System\wopdKqV.exe
  C:\Windows\System\wopdKqV.exe
  2⤵
  PID:11724
- C:\Windows\System\nGmcvUo.exe
  C:\Windows\System\nGmcvUo.exe
  2⤵
  PID:11756
- C:\Windows\System\ReVVfam.exe
  C:\Windows\System\ReVVfam.exe
  2⤵
  PID:11832
- C:\Windows\System\AdaDaTB.exe
  C:\Windows\System\AdaDaTB.exe
  2⤵
  PID:11936
- C:\Windows\System\vZSJWzK.exe
  C:\Windows\System\vZSJWzK.exe
  2⤵
  PID:11980
- C:\Windows\System\EMBWIYU.exe
  C:\Windows\System\EMBWIYU.exe
  2⤵
  PID:12048
- C:\Windows\System\PQlIwqb.exe
  C:\Windows\System\PQlIwqb.exe
  2⤵
  PID:12104
- C:\Windows\System\zmWSplC.exe
  C:\Windows\System\zmWSplC.exe
  2⤵
  PID:12152
- C:\Windows\System\GqhScpu.exe
  C:\Windows\System\GqhScpu.exe
  2⤵
  PID:12276
- C:\Windows\System\VpimsFT.exe
  C:\Windows\System\VpimsFT.exe
  2⤵
  PID:11312
- C:\Windows\System\xFxvLsD.exe
  C:\Windows\System\xFxvLsD.exe
  2⤵
  PID:11536
- C:\Windows\System\YaPlVsy.exe
  C:\Windows\System\YaPlVsy.exe
  2⤵
  PID:11676
- C:\Windows\System\oVBEQDw.exe
  C:\Windows\System\oVBEQDw.exe
  2⤵
  PID:11860
- C:\Windows\System\XqUrbVg.exe
  C:\Windows\System\XqUrbVg.exe
  2⤵
  PID:12032
- C:\Windows\System\AcoItFD.exe
  C:\Windows\System\AcoItFD.exe
  2⤵
  PID:12192
- C:\Windows\System\UKegUal.exe
  C:\Windows\System\UKegUal.exe
  2⤵
  PID:11316
- C:\Windows\System\oInxplG.exe
  C:\Windows\System\oInxplG.exe
  2⤵
  PID:11760
- C:\Windows\System\XfEwwsc.exe
  C:\Windows\System\XfEwwsc.exe
  2⤵
  PID:12024
- C:\Windows\System\UqDPShA.exe
  C:\Windows\System\UqDPShA.exe
  2⤵
  PID:11584
- C:\Windows\System\gfppjMq.exe
  C:\Windows\System\gfppjMq.exe
  2⤵
  PID:12124
- C:\Windows\System\WGafwgg.exe
  C:\Windows\System\WGafwgg.exe
  2⤵
  PID:12296
- C:\Windows\System\bzTnwKm.exe
  C:\Windows\System\bzTnwKm.exe
  2⤵
  PID:12312
- C:\Windows\System\rzslOxS.exe
  C:\Windows\System\rzslOxS.exe
  2⤵
  PID:12336
- C:\Windows\System\OyEhzLW.exe
  C:\Windows\System\OyEhzLW.exe
  2⤵
  PID:12368
- C:\Windows\System\pgxuKNn.exe
  C:\Windows\System\pgxuKNn.exe
  2⤵
  PID:12404
- C:\Windows\System\vtjFxSg.exe
  C:\Windows\System\vtjFxSg.exe
  2⤵
  PID:12440
- C:\Windows\System\MOJsZCW.exe
  C:\Windows\System\MOJsZCW.exe
  2⤵
  PID:12460
- C:\Windows\System\WPpYlxf.exe
  C:\Windows\System\WPpYlxf.exe
  2⤵
  PID:12496
- C:\Windows\System\lhwFIPg.exe
  C:\Windows\System\lhwFIPg.exe
  2⤵
  PID:12540
- C:\Windows\System\iimMEhu.exe
  C:\Windows\System\iimMEhu.exe
  2⤵
  PID:12568
- C:\Windows\System\fnIYfHc.exe
  C:\Windows\System\fnIYfHc.exe
  2⤵
  PID:12596
- C:\Windows\System\Ewvkgfq.exe
  C:\Windows\System\Ewvkgfq.exe
  2⤵
  PID:12620
- C:\Windows\System\iHqFjXc.exe
  C:\Windows\System\iHqFjXc.exe
  2⤵
  PID:12652
- C:\Windows\System\gsahQBf.exe
  C:\Windows\System\gsahQBf.exe
  2⤵
  PID:12680
- C:\Windows\System\FsokHeb.exe
  C:\Windows\System\FsokHeb.exe
  2⤵
  PID:12708
- C:\Windows\System\sQoRrxQ.exe
  C:\Windows\System\sQoRrxQ.exe
  2⤵
  PID:12736
- C:\Windows\System\BNssxaQ.exe
  C:\Windows\System\BNssxaQ.exe
  2⤵
  PID:12756
- C:\Windows\System\RqoonEL.exe
  C:\Windows\System\RqoonEL.exe
  2⤵
  PID:12780
- C:\Windows\System\rWerimF.exe
  C:\Windows\System\rWerimF.exe
  2⤵
  PID:12820
- C:\Windows\System\OlKCIHh.exe
  C:\Windows\System\OlKCIHh.exe
  2⤵
  PID:12856
- C:\Windows\System\lFZEgRn.exe
  C:\Windows\System\lFZEgRn.exe
  2⤵
  PID:12872
- C:\Windows\System\gWUYKqx.exe
  C:\Windows\System\gWUYKqx.exe
  2⤵
  PID:12900
- C:\Windows\System\TdgsLDu.exe
  C:\Windows\System\TdgsLDu.exe
  2⤵
  PID:12928
- C:\Windows\System\TcQnwDb.exe
  C:\Windows\System\TcQnwDb.exe
  2⤵
  PID:12976
- C:\Windows\System\twBLXcF.exe
  C:\Windows\System\twBLXcF.exe
  2⤵
  PID:13016
- C:\Windows\System\HPaVLyd.exe
  C:\Windows\System\HPaVLyd.exe
  2⤵
  PID:13032
- C:\Windows\System\AVmNDos.exe
  C:\Windows\System\AVmNDos.exe
  2⤵
  PID:13060
- C:\Windows\System\KbdLBZQ.exe
  C:\Windows\System\KbdLBZQ.exe
  2⤵
  PID:13096
- C:\Windows\System\ogAppfj.exe
  C:\Windows\System\ogAppfj.exe
  2⤵
  PID:13116
- C:\Windows\System\neObcFr.exe
  C:\Windows\System\neObcFr.exe
  2⤵
  PID:13136
- C:\Windows\System\HHOBQEc.exe
  C:\Windows\System\HHOBQEc.exe
  2⤵
  PID:13164
- C:\Windows\System\bpsmIhc.exe
  C:\Windows\System\bpsmIhc.exe
  2⤵
  PID:13192
- C:\Windows\System\DKWZyqm.exe
  C:\Windows\System\DKWZyqm.exe
  2⤵
  PID:13220
- C:\Windows\System\iWOGqDb.exe
  C:\Windows\System\iWOGqDb.exe
  2⤵
  PID:13252
- C:\Windows\System\TvJdlPn.exe
  C:\Windows\System\TvJdlPn.exe
  2⤵
  PID:13276
- C:\Windows\System\ATmcUmV.exe
  C:\Windows\System\ATmcUmV.exe
  2⤵
  PID:13304
- C:\Windows\System\EYChWpE.exe
  C:\Windows\System\EYChWpE.exe
  2⤵
  PID:12352
- C:\Windows\System\ZmIQrtT.exe
  C:\Windows\System\ZmIQrtT.exe
  2⤵
  PID:12380
- C:\Windows\System\Bsgywox.exe
  C:\Windows\System\Bsgywox.exe
  2⤵
  PID:12480
- C:\Windows\System\IyOmCxm.exe
  C:\Windows\System\IyOmCxm.exe
  2⤵
  PID:12584
- C:\Windows\System\UGdrBFZ.exe
  C:\Windows\System\UGdrBFZ.exe
  2⤵
  PID:12648
- C:\Windows\System\zEVPMjI.exe
  C:\Windows\System\zEVPMjI.exe
  2⤵
  PID:12700
- C:\Windows\System\iUVhIlN.exe
  C:\Windows\System\iUVhIlN.exe
  2⤵
  PID:12752
- C:\Windows\System\FWlOZsj.exe
  C:\Windows\System\FWlOZsj.exe
  2⤵
  PID:12832
- C:\Windows\System\rHtsrSW.exe
  C:\Windows\System\rHtsrSW.exe
  2⤵
  PID:12956
- C:\Windows\System\yFHTjgn.exe
  C:\Windows\System\yFHTjgn.exe
  2⤵
  PID:13028
- C:\Windows\System\kaEalAK.exe
  C:\Windows\System\kaEalAK.exe
  2⤵
  PID:13108
- C:\Windows\System\stWMysz.exe
  C:\Windows\System\stWMysz.exe
  2⤵
  PID:12292
- C:\Windows\System\kstfdfa.exe
  C:\Windows\System\kstfdfa.exe
  2⤵
  PID:12388
- C:\Windows\System\bPbIESL.exe
  C:\Windows\System\bPbIESL.exe
  2⤵
  PID:12644
- C:\Windows\System\BCBgDzB.exe
  C:\Windows\System\BCBgDzB.exe
  2⤵
  PID:4276
- C:\Windows\System\hoEkmvm.exe
  C:\Windows\System\hoEkmvm.exe
  2⤵
  PID:12852
- C:\Windows\System\SNbyroa.exe
  C:\Windows\System\SNbyroa.exe
  2⤵
  PID:12992
- C:\Windows\System\lHJIIsO.exe
  C:\Windows\System\lHJIIsO.exe
  2⤵
  PID:13244
- C:\Windows\System\sfVEebV.exe
  C:\Windows\System\sfVEebV.exe
  2⤵
  PID:12416
- C:\Windows\System\lfoUWOz.exe
  C:\Windows\System\lfoUWOz.exe
  2⤵
  PID:3904
- C:\Windows\System\iGbzQnd.exe
  C:\Windows\System\iGbzQnd.exe
  2⤵
  PID:12308
- C:\Windows\System\RoVtVSI.exe
  C:\Windows\System\RoVtVSI.exe
  2⤵
  PID:13320
- C:\Windows\System\fSSXEeL.exe
  C:\Windows\System\fSSXEeL.exe
  2⤵
  PID:13384
- C:\Windows\System\tmZvYlh.exe
  C:\Windows\System\tmZvYlh.exe
  2⤵
  PID:13404
- C:\Windows\System\OvxXWsZ.exe
  C:\Windows\System\OvxXWsZ.exe
  2⤵
  PID:13448
- C:\Windows\System\KFUZgRS.exe
  C:\Windows\System\KFUZgRS.exe
  2⤵
  PID:13476
- C:\Windows\System\qDBYzjL.exe
  C:\Windows\System\qDBYzjL.exe
  2⤵
  PID:13500
- C:\Windows\System\scgijeI.exe
  C:\Windows\System\scgijeI.exe
  2⤵
  PID:13524
- C:\Windows\System\uYkvCty.exe
  C:\Windows\System\uYkvCty.exe
  2⤵
  PID:13560
- C:\Windows\System\JDLRbgD.exe
  C:\Windows\System\JDLRbgD.exe
  2⤵
  PID:13584
- C:\Windows\System\zgmHIsT.exe
  C:\Windows\System\zgmHIsT.exe
  2⤵
  PID:13644
- C:\Windows\System\KdTjSKA.exe
  C:\Windows\System\KdTjSKA.exe
  2⤵
  PID:13684
- C:\Windows\System\fHjQLGd.exe
  C:\Windows\System\fHjQLGd.exe
  2⤵
  PID:13708
- C:\Windows\System\rEyyOfD.exe
  C:\Windows\System\rEyyOfD.exe
  2⤵
  PID:13724
- C:\Windows\System\vTIqEXh.exe
  C:\Windows\System\vTIqEXh.exe
  2⤵
  PID:13748
- C:\Windows\System\CsLqxyi.exe
  C:\Windows\System\CsLqxyi.exe
  2⤵
  PID:13812
- C:\Windows\System\BlTVvcu.exe
  C:\Windows\System\BlTVvcu.exe
  2⤵
  PID:13832
- C:\Windows\System\IqlDiyC.exe
  C:\Windows\System\IqlDiyC.exe
  2⤵
  PID:13856
- C:\Windows\System\amWSfmv.exe
  C:\Windows\System\amWSfmv.exe
  2⤵
  PID:13888
- C:\Windows\System\CpGvKLf.exe
  C:\Windows\System\CpGvKLf.exe
  2⤵
  PID:13904
- C:\Windows\System\nmnDvIA.exe
  C:\Windows\System\nmnDvIA.exe
  2⤵
  PID:13920
- C:\Windows\System\briaxnl.exe
  C:\Windows\System\briaxnl.exe
  2⤵
  PID:13952
- C:\Windows\System\xgjQeWT.exe
  C:\Windows\System\xgjQeWT.exe
  2⤵
  PID:13988
- C:\Windows\System\ZdnIxVz.exe
  C:\Windows\System\ZdnIxVz.exe
  2⤵
  PID:14008
- C:\Windows\System\yxVwlqU.exe
  C:\Windows\System\yxVwlqU.exe
  2⤵
  PID:14028
- C:\Windows\System\zATOizd.exe
  C:\Windows\System\zATOizd.exe
  2⤵
  PID:14044
- C:\Windows\System\YoEwNVH.exe
  C:\Windows\System\YoEwNVH.exe
  2⤵
  PID:14084
- C:\Windows\System\jRYjkIG.exe
  C:\Windows\System\jRYjkIG.exe
  2⤵
  PID:14108
- C:\Windows\System\mquutag.exe
  C:\Windows\System\mquutag.exe
  2⤵
  PID:14180
- C:\Windows\System\xDgpmAF.exe
  C:\Windows\System\xDgpmAF.exe
  2⤵
  PID:14208
- C:\Windows\System\VLUNFIj.exe
  C:\Windows\System\VLUNFIj.exe
  2⤵
  PID:14224
- C:\Windows\System\rUWSlBi.exe
  C:\Windows\System\rUWSlBi.exe
  2⤵
  PID:14260
- C:\Windows\System\lQbdJwz.exe
  C:\Windows\System\lQbdJwz.exe
  2⤵
  PID:14280
- C:\Windows\System\mPGxrxG.exe
  C:\Windows\System\mPGxrxG.exe
  2⤵
  PID:14296
- C:\Windows\System\FqNfFxd.exe
  C:\Windows\System\FqNfFxd.exe
  2⤵
  PID:14316
- C:\Windows\System\rkHIyCj.exe
  C:\Windows\System\rkHIyCj.exe
  2⤵
  PID:13332
- C:\Windows\System\UnXvArB.exe
  C:\Windows\System\UnXvArB.exe
  2⤵
  PID:13428
- C:\Windows\System\YkcxpUI.exe
  C:\Windows\System\YkcxpUI.exe
  2⤵
  PID:13468
- C:\Windows\System\eyYkQAz.exe
  C:\Windows\System\eyYkQAz.exe
  2⤵
  PID:13512
- C:\Windows\System\XMBxhBN.exe
  C:\Windows\System\XMBxhBN.exe
  2⤵
  PID:13632
- C:\Windows\System\DtuJNZQ.exe
  C:\Windows\System\DtuJNZQ.exe
  2⤵
  PID:13720
- C:\Windows\System\zdzoQRr.exe
  C:\Windows\System\zdzoQRr.exe
  2⤵
  PID:13844
- C:\Windows\System\sppnHEj.exe
  C:\Windows\System\sppnHEj.exe
  2⤵
  PID:13896
- C:\Windows\System\CJZWKVc.exe
  C:\Windows\System\CJZWKVc.exe
  2⤵
  PID:13944
- C:\Windows\System\OEnYtJC.exe
  C:\Windows\System\OEnYtJC.exe
  2⤵
  PID:14016
- C:\Windows\System\KvXPuin.exe
  C:\Windows\System\KvXPuin.exe
  2⤵
  PID:14068
- C:\Windows\System\ftdgXpp.exe
  C:\Windows\System\ftdgXpp.exe
  2⤵
  PID:14168
- C:\Windows\System\ibBEmGI.exe
  C:\Windows\System\ibBEmGI.exe
  2⤵
  PID:14196
- C:\Windows\System\OsUmOuZ.exe
  C:\Windows\System\OsUmOuZ.exe
  2⤵
  PID:14292
- C:\Windows\System\teMstaw.exe
  C:\Windows\System\teMstaw.exe
  2⤵
  PID:12884
- C:\Windows\System\yhnmzEZ.exe
  C:\Windows\System\yhnmzEZ.exe
  2⤵
  PID:13400
- C:\Windows\System\TkiOUZa.exe
  C:\Windows\System\TkiOUZa.exe
  2⤵
  PID:13736
- C:\Windows\System\zeAXAbQ.exe
  C:\Windows\System\zeAXAbQ.exe
  2⤵
  PID:13848
- C:\Windows\System\VpaxFjx.exe
  C:\Windows\System\VpaxFjx.exe
  2⤵
  PID:14000
- C:\Windows\System\UsjoOPW.exe
  C:\Windows\System\UsjoOPW.exe
  2⤵
  PID:14064
- C:\Windows\System\WEQZlvy.exe
  C:\Windows\System\WEQZlvy.exe
  2⤵
  PID:14312
- C:\Windows\System\tFoTplV.exe
  C:\Windows\System\tFoTplV.exe
  2⤵
  PID:13676
- C:\Windows\System\cJQnfSv.exe
  C:\Windows\System\cJQnfSv.exe
  2⤵
  PID:14200
- C:\Windows\System\GRJKqjK.exe
  C:\Windows\System\GRJKqjK.exe
  2⤵
  PID:14348
- C:\Windows\System\HeLcdQB.exe
  C:\Windows\System\HeLcdQB.exe
  2⤵
  PID:14372
- C:\Windows\System\ArfJpEI.exe
  C:\Windows\System\ArfJpEI.exe
  2⤵
  PID:14388
- C:\Windows\System\cDFUXNM.exe
  C:\Windows\System\cDFUXNM.exe
  2⤵
  PID:14420
- C:\Windows\System\toTSQYQ.exe
  C:\Windows\System\toTSQYQ.exe
  2⤵
  PID:14444

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 3816 -i 3816 -h 464 -j 468 -s 476 -d 14848
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:14888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AFeIROW.exe

Path C:\Windows\System\AFeIROW.exe
Size 2.1MB
SHA256 3b811150fe807a9fd8d037915621fa24bb0165b8e01da218c7d65157bd592694
MD5 b48c1e3fa0fa2e79a488fab05f2c5587
SHA1 a38ba015a2a8ed5544ed309e54232bd25bc1074b
SHA512 ac26daad6e0e91dfc4452cd840cd17a70b6b6be4462f0c3634a94308dd552fb5757f93d79fa3b3ecb3eac6bc8789931c2a4a194ce3998cb8f966e9e3f6c0a8aa
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wzq:BemTLkNdfE0pZrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCvLazv.exe

Path C:\Windows\System\CCvLazv.exe
Size 2.1MB
SHA256 9e14bce3a39c4e8f4c7c35df037200841ba333e2e580f582e0b1ddfda453ac55
MD5 0fe05a93a9511c735c262fa45789adad
SHA1 ff502cea9b1c46c6c5582d3651710e45cd048952
SHA512 be390ab6c40a3ad5d6fb941e127347686a5b9ef4c1ffca90c5b9d42d674d49a352ffd4d3fbe4eeabb4d6ca041225a19ed1f848fabf5f51b359afb3f98a88b69d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wa:BemTLkNdfE0pZr8
MD5 SHA1 SHA512 SSDEEP

Submit Download

CFdqqYX.exe

Path C:\Windows\System\CFdqqYX.exe
Size 2.1MB
SHA256 27204ee15bc868c66cb41f673df78ba528dad20fe80e90bcdec9e4a57d8db644
MD5 bff3182d9b3bf295437f598b58687670
SHA1 eeec870897dcb9c4836d8835c7377d1a95089110
SHA512 8ea40492c9d8adf46f33b271e8399ce3341f720f0aa55f5297a1d90bd24d9dba1fe45c79adacb20a82497231a3f4ecfc3de88fbaed82c170896fd276263a550a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wn:BemTLkNdfE0pZr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

CaMaGou.exe

Path C:\Windows\System\CaMaGou.exe
Size 2.1MB
SHA256 f31c9e6c315e61ba548490bf76b19ed4034fb34e6e9ea82f792d2557b3910fce
MD5 5b55831629ba90df2e3dc0c5053c9476
SHA1 51a9bf898268f2d397bb27d08521e03dbfa51259
SHA512 604e85e5b1fc7cea85df3632ebb7a2287b2582e3fba4c173e5d1a1865bf6470828bf36c135f3d9b4fdd0e644855edc5ca9b0e5e8132d03dcf97f31a1b2205e62
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+w10:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

GBUmVZK.exe

Path C:\Windows\System\GBUmVZK.exe
Size 2.1MB
SHA256 246f6d308f0474b7037fd609f894127738f635a95424ce3664b236b225261030
MD5 75a7d51e9ee72a6cef617d2d8a180e02
SHA1 05f640e0b61f90e4654debaf56198ac4a077a1e2
SHA512 062f6057aa7722d7bad982e23e98db4d1f3f241b0fc2a0449f0474bcb57be4b71748c419f049880458ad13703fde118bd1159fb71da869e0643e8542e74cb53a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wi:BemTLkNdfE0pZrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

IEZzbFZ.exe

Path C:\Windows\System\IEZzbFZ.exe
Size 2.1MB
SHA256 518b9393bf5996d229bd7a6974e610a91b1a5660d92f744c2e3dcb94819dce36
MD5 bd9c7d26a261143da8f908793ee5914b
SHA1 ab260a93e3db504d2ee2cd7d1e1e3b8ba9d4a953
SHA512 946c4064e3df989aa65a30033f55ca9d24426890adb93e24ff668d78bab3b2780a6c48a64d7fda5ff19bd7c60a7f7256d369b7c350ba13c199609e50d4eadb84
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wL:BemTLkNdfE0pZrF
MD5 SHA1 SHA512 SSDEEP

Submit Download

IHCiBob.exe

Path C:\Windows\System\IHCiBob.exe
Size 2.1MB
SHA256 41380d58f93323c1bb61c9cc4f544fff337632207b2e7237970aacc7efdbae58
MD5 fd2e096292dcd2b4339d6910e7cbe154
SHA1 df7fefdff78010a2d113ddd4c37dc3fce7f71f74
SHA512 7eed06c68c7427b6efc07bfe48b7617d97d424ed1f467f6ed1dbde31ccfe9f157099971e2fbb27dfa3c2acb6af453e41f72a9a8c47543d361f465c82d66eff2d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wT:BemTLkNdfE0pZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

KIHBhKH.exe

Path C:\Windows\System\KIHBhKH.exe
Size 2.1MB
SHA256 a63bb49348c456e24c96178119a11683fc08599713db5d1482009894e2057f64
MD5 c728f1e857ffe601d026c9547ed97b31
SHA1 8efd4a3abf628ef60f340c5c203938056027a7e7
SHA512 342f159af28af835b1b739182283906ee250b299dbb9d81aa69dd8317518d54869962aad5fe5403bd9a972bca3ce94b79eb7d4e5920f5d029b5176b0870519a1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wQ:BemTLkNdfE0pZrS
MD5 SHA1 SHA512 SSDEEP

Submit Download

KRablEX.exe

Path C:\Windows\System\KRablEX.exe
Size 2.1MB
SHA256 dcb6a4af2c81538b910325226454d16693d356035b563e2c2d9992f917f9f780
MD5 79d6dac32991a07dab9e5f0b434a674e
SHA1 9eed1c4cd45a8c7eda8fdbb6974ac250a9860c90
SHA512 7f1268a8fce675aee50f71f319bbaeb2af3ff509ddf7d0de81dc8d3c9c37ddf77ef8a891c5498ba28a7fae4eb1ff4f2a0f3866e73e57d945c7952115914ab433
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+w/:BemTLkNdfE0pZr5
MD5 SHA1 SHA512 SSDEEP

Submit Download

OMpVkxj.exe

Path C:\Windows\System\OMpVkxj.exe
Size 2.1MB
SHA256 87bb69198d703177b1c21f5db51cefd8215b5ed6cfc43157a914e98c1674a93c
MD5 58daba544b2f6367c9765e2fa52b550b
SHA1 a942d437b82025d3b9a583fa441b338eb17f166b
SHA512 468756cea6577f9c911d9910902610f7f6183ba19d2eaca0d0597134601d5bfad093d87f35b128996c8a94598d29e41ed5a09dd980f0d9a94490df293d170f29
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wl:BemTLkNdfE0pZrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

RxaLEmV.exe

Path C:\Windows\System\RxaLEmV.exe
Size 2.1MB
SHA256 fa0e9190e3215f44f1748ecbca402832dcaec4781ce2113962dad87721d76cac
MD5 3382d8bfa81cf2c58c15dd347f2ea233
SHA1 0f182d599c7ac2ce5838187f9d5af807b15841e9
SHA512 08d06834016784f31ffd2fc785b287b6e1fc5bb36052df18277ad09d4a9f51bb259325e8035d58f07175a8b82cbc8d0708fb3afc020745d999d9000819e84663
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wi:BemTLkNdfE0pZrU
MD5 SHA1 SHA512 SSDEEP

Submit Download

RxlRMmj.exe

Path C:\Windows\System\RxlRMmj.exe
Size 2.1MB
SHA256 3819e4d1bb4d10e67269b4fb804b94ae1790f3a36b48373bf9f8db0521d0f622
MD5 b53279008ca9573ab9f0325140df4415
SHA1 af1988a2195e1c0d4043cd9fc5d2063b1a2b761b
SHA512 01e22b78d24aa3df8ab59dc96be15bd0d4b7df4c3cc2596c139f0019cf34e39cbd5ec369415703b188790edb8c0eecb6eade7ad4bad9c855efba0a73e0765945
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wn:BemTLkNdfE0pZrB
MD5 SHA1 SHA512 SSDEEP

Submit Download

SZtuABw.exe

Path C:\Windows\System\SZtuABw.exe
Size 2.1MB
SHA256 9b0ffe8067b255bee3a2b142c6e72ecfb888275f9d65ce0a2388d0f4958e9fa7
MD5 d17600dba7a90e7f0b97f7e409be92d5
SHA1 2cb9b6fa05b27f081a52796d54d1acbfa9fe3b38
SHA512 663cc8cf4876b0ea1060eacf32dda1b04076771488627a60dd774ce3cc120275612b0671127d4705414090f238f3249116ebca1a8c9529a43cb04c2182460f6f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+w4:BemTLkNdfE0pZrm
MD5 SHA1 SHA512 SSDEEP

Submit Download

SjxvJto.exe

Path C:\Windows\System\SjxvJto.exe
Size 2.1MB
SHA256 e5c11831972d54a01d9285ef392fa4afd4145e4ae6d0f779988d16b33163786b
MD5 109718f6c5f398fac27a4cc242e9ba49
SHA1 5f44350d59e836dc1a46900441dbf6c3cb8cc717
SHA512 98abf6029c53615a4e8867138df46506612b33f254360ff229b07a535b32fec72a4b8661659101b44f4c8fc8b1da9d27e73aaf071b1470de7fe8fe645dfacf7c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wJ:BemTLkNdfE0pZrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

UqoasPR.exe

Path C:\Windows\System\UqoasPR.exe
Size 2.1MB
SHA256 c5c8a3bfd48a073be2b43ebbe6b3e4ecdf58e4149304098d447fbff6626ca87d
MD5 616ec928f06b5eae6ffb8dba2ec74a53
SHA1 274fff111421f5f8c7bc0bdc460bac5d54410aff
SHA512 80e39aaacd04b8460a53bd3a635cd8e6675baa238b620a06ecc66dee6a9b55f7d670e2adb6cf3d43cb46e36293311319a17b859883966ed09f460ca2efd1c1ed
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wG:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

VNkZGcZ.exe

Path C:\Windows\System\VNkZGcZ.exe
Size 2.1MB
SHA256 81ff18b61318a00f072f841b2253d910a36aaf2efddc72b489bfc5dc02f00d55
MD5 de89bfa08f0ae007aa079446388ac321
SHA1 7561a9a3eb8ef2de6fe082f681d9707968011a9d
SHA512 c372ae7ddd281d3d406708367c8a4e82cb8942e84260c67697d431a6dbc5df50c175802365dab408b3f844f00d5fb6733150c72500ba1c8e256d5ed63428a3ab
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wY:BemTLkNdfE0pZr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZqDrkeS.exe

Path C:\Windows\System\ZqDrkeS.exe
Size 2.1MB
SHA256 a611c820db19e08efe3c0bda4de7cdd9a30474cf41c47bedb4da4cfa2c57e5db
MD5 2394116098d203c91dd8b9baad7f05b9
SHA1 0abb3f1b4d1be5f821d1e6965416cfa9ce8a281b
SHA512 c9519260d0a17e410b72a32fd617e120859a5e4bab9890c2a228daa8e484f0c5379bc565f248698538ffa43b57208d088e780ecc1c052d7872e9e1567ef7cd57
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wG:BemTLkNdfE0pZrE
MD5 SHA1 SHA512 SSDEEP

Submit Download

aAoigdb.exe

Path C:\Windows\System\aAoigdb.exe
Size 2.1MB
SHA256 c073c6f3f34cf4d58d5667f8e997db17e9eff1d9d736dcd1d9adc1ff7cded657
MD5 efa2e9d45cf74c23d5bd6a9585fb0d54
SHA1 7f19f6f4d8a218406f22d464c90eb5eb63417757
SHA512 106f5f6210d279e7b66fb41b1d2f1e840abd68f89cc7a48d8e4a89477608e628563a5cd5b8aea087b06b2c36b53616b0b7e0a26bc20ff1cbdc944fcb1428088b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+w2D:BemTLkNdfE0pZrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ceGcPjo.exe

Path C:\Windows\System\ceGcPjo.exe
Size 2.1MB
SHA256 ef00e30ad69a1f315565c9b153db5396fb797b664de35d49fa9d124d59baf9f3
MD5 7f1bc448d670404ef33bb6cfdf4a64a5
SHA1 cb42645c91b57bfd8dab596b3a99f84ccbbbadbc
SHA512 b446bf770ee72c36fe07c5e5334ef10f1c4320d3bbf89302c8b30dffe061475d9c50760ba816033b13c20ad0acb408fc916b0de7e24ff3aaeba29283357f1292
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+w2:BemTLkNdfE0pZrs
MD5 SHA1 SHA512 SSDEEP

Submit Download

dzkhAKX.exe

Path C:\Windows\System\dzkhAKX.exe
Size 2.1MB
SHA256 23a69988e69937ab880423dabf9bf63881f24b75889912970a791759e0647670
MD5 85bfe1476a14f1dcf48fec3a0e1d952a
SHA1 705fbcfeaeebff7b9d286bffa304ab7430373394
SHA512 366d313809114112d5a70abace0debb0f01f875c21e11a8fd0ade5b5e4b244bf2944853f68e9571849af8cf4d3986e257c0b73d00c49108db56182766e8b942c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+w2:BemTLkNdfE0pZrs
MD5 SHA1 SHA512 SSDEEP

Submit Download

iEosLvG.exe

Path C:\Windows\System\iEosLvG.exe
Size 2.1MB
SHA256 a5d684564fb4bda4e5c62a9ffb9b17584565d7bfb2840f4470bd53b88276f658
MD5 fb3ae1216ea791c9eef1a321b296cb51
SHA1 127bea9d4e88cdcb497d827763ba8f324edef987
SHA512 aeecd1d50bde32881d951c68123a13d534a729b21c7dd449c47f9991f26df52318b877bce1fabe2f476943dec320adeabbb062a34033409f13fb9166da90d7a7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wd:BemTLkNdfE0pZrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

leyJtrY.exe

Path C:\Windows\System\leyJtrY.exe
Size 2.1MB
SHA256 557db908e48161bf5faa85e2fd2f8249a0fcc179508981b7c2765706cae83be4
MD5 e4e98354923d14b4285bb5f480e8f53b
SHA1 1856b59b126439de67cb0677b096ed4e84626f31
SHA512 4f244603226ad4b6ee056f310b172210c4d6a8382f79a75459cc97c9f6da1d6ff5457d06cb8377b5b9b465257f0a4fc8b5fdfb92bda9e50278a9ef977ee638b7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wo:BemTLkNdfE0pZr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzAfhyc.exe

Path C:\Windows\System\lzAfhyc.exe
Size 2.1MB
SHA256 2daefe2fa9562d0bc4de1fe112bff9e2c2a0c9b239047df16d02b2e267f1904f
MD5 6186a1dc0f18dc008153514cd3f2754a
SHA1 afa44516519f6da5961030a09a533bee9078f7c1
SHA512 c7f8d0d102d29999edd1ce1e7c555ba310517aa3ef37d55c624dcfe0571e7cd6aa975dd75e827b5b28e4e562ac04dccac515d23006c6c1a94f158202ecabd080
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wF:BemTLkNdfE0pZr7
MD5 SHA1 SHA512 SSDEEP

Submit Download

oDbVUOX.exe

Path C:\Windows\System\oDbVUOX.exe
Size 2.1MB
SHA256 9aaa2702b286438e133d39bc70a3bddcf34ecf3edd251a664ea1251556925336
MD5 01a47c68026d4033d572152bffc82ca4
SHA1 b08b0e36032b68f023e99058f31fffe2a94ab31d
SHA512 3f41804e36ee3699e377be340ebcc9381b6142ca1a8dbe18327d2df9b0aa300bd629b29ca3876de3d829dff6df28c743f626ac68a0f805c7b77c42a19f681d56
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wO:BemTLkNdfE0pZrs
MD5 SHA1 SHA512 SSDEEP

Submit Download

qvaDBxU.exe

Path C:\Windows\System\qvaDBxU.exe
Size 2.1MB
SHA256 57aeae366c7d615e33a38e83d1c4e7963a790abe34921251b2958cee415357e9
MD5 fe3d6a85a15cc8dee2c3454878cc5c4b
SHA1 0c9715038c0aa88258887a3b585aef98518ed31d
SHA512 7c764bb79005f4d00e50b32c95c8515daf0ec2b08cc62a4b218222147aa29966274a81a191983485b2340adae5b973428449cbfbe308ad80bc7410a9961b9e18
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+w3:BemTLkNdfE0pZrZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkoiNeY.exe

Path C:\Windows\System\tkoiNeY.exe
Size 2.1MB
SHA256 d4040a0fbb08d162ca5d3e54db96a610ef0085f9e99864a4e7525d65f7781faa
MD5 254cdea110e781cb60fbba52f72f6177
SHA1 b119f32827e4b6bd6e4f302f2a8b314f74197f5d
SHA512 f836bf5bf98a3919a89d9acc852412218ce3f342abdc9e53feb4b18b9c5167c274aeaa9a612e8d73157e143c752cb02ad512f3d92eb2fc226b4a160a7ff2996b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wO:BemTLkNdfE0pZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

uRkiSuS.exe

Path C:\Windows\System\uRkiSuS.exe
Size 2.1MB
SHA256 3ebd2df6fbe2978e429966927259961ea7a0cda998e335dea9d6c4bb0ed36391
MD5 1d8d5385c5ed0770acef35cd86097bfa
SHA1 a613469788e303544f03e74ff8c2bb1a9aac9060
SHA512 2ac300ecf6e410edad926b4371140948ac744a40c09d8f4fd220f961391ceb64ad61a9fa18f725a2d0e985293efd583e8899bfbfdc18835ee5c4ebbf433ffd44
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wa:BemTLkNdfE0pZrQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vhcdJVF.exe

Path C:\Windows\System\vhcdJVF.exe
Size 2.1MB
SHA256 7e6d86521a4b0669b6d035c751193a4942f3ce6eb3ca9b32c7b528bc31c88349
MD5 654a8d3f54e167fc1ec18424a6ee9fba
SHA1 a91ecdbc4bb9c6ea406ea9317e748bc27fb36878
SHA512 506ad61062c8e7e0b4651c0e77e9716f4eebdca3f99eb10476384adc473c614c599c8fc453f7f4e85da4296266d62457c6b11815f6fca3dd65bad9dd4c570831
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wU:BemTLkNdfE0pZrO
MD5 SHA1 SHA512 SSDEEP

Submit Download

vqyTITB.exe

Path C:\Windows\System\vqyTITB.exe
Size 2.1MB
SHA256 48d5efc7b4bb6e65a4ddb5c48bd89906b6ebe8238163133b3c2f93fdc547ac97
MD5 bda4551710e6931ccf20164ce20e8aca
SHA1 47fa36333a4ad008674ac0be1424dc43d73761b2
SHA512 da9957502b05412507b6870e53c5df4b91ef153a83cc2b55df69f16ad2917db1749375f81f379407649ade8be8ac81a4f4b7b79ed367056051b86e0725b0c700
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+w3:BemTLkNdfE0pZrp
MD5 SHA1 SHA512 SSDEEP

Submit Download

yYjuffU.exe

Path C:\Windows\System\yYjuffU.exe
Size 2.1MB
SHA256 de80acf5e76c7ea67828fadd6fb57d7264208b4e95e3db84aec6cbc0e311c328
MD5 2ab1a0f9b2972df1b1b89ca42a58993f
SHA1 3f3c05e23b92b441f6d920d0054d66c97c29184d
SHA512 e591ace9867cca76aee5edb634665192e38cda8fbe00d098668a17f9d6bdd3025a8c80209f637f5d3ecd086376d596fc6bf623d3777e31a3e0d62cb93e93d037
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wv:BemTLkNdfE0pZrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

yeMcxuY.exe

Path C:\Windows\System\yeMcxuY.exe
Size 2.1MB
SHA256 fdaf87f925eb2e61ed8e99b60a00e45be6181af2c303c50dfb5be2856ee72137
MD5 c4f5321ab7fa5d9bfda8c63644d6eb38
SHA1 fa4567bac6a3f76b26743e903fc5d9bc07d8411d
SHA512 4bd733b041bc64190f3fec41c7d8cb5477a09a173973c5ce66de02cd7f1f69d4b81173d53cc1176d79ffb744834121f597d56863bd4c5c68ba5f9e48bbb45901
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+wq:BemTLkNdfE0pZr8
MD5 SHA1 SHA512 SSDEEP

Submit Download

yudApSx.exe

Path C:\Windows\System\yudApSx.exe
Size 2.1MB
SHA256 2986bf3bb4a087aa7cf42eeebef7f6db48674b64bb7d488b806b1baf9c3d07d1
MD5 3d75b3d1aa26e0ece449d0c8aa423689
SHA1 4ea4e47493e5c366e9612a3f2ac22d502f38a49d
SHA512 9f3f9c5f0e9a752f66a6b91682740685bce5a74dd6fcfa686b018e2fa6921f56aa66ded48ad7a9505131590e6e2668d68912d1ed40b53e6bad53f9c33c6a26b6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wISK9XIXs/+w/:BemTLkNdfE0pZrF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-738-0x00007FF731B80000-0x00007FF731ED4000-memory.dmp

Download

memory/368-2149-0x00007FF731B80000-0x00007FF731ED4000-memory.dmp

Download

memory/512-2159-0x00007FF61AC60000-0x00007FF61AFB4000-memory.dmp

Download

memory/512-834-0x00007FF61AC60000-0x00007FF61AFB4000-memory.dmp

Download

memory/532-2146-0x00007FF6B9AA0000-0x00007FF6B9DF4000-memory.dmp

Download

memory/532-733-0x00007FF6B9AA0000-0x00007FF6B9DF4000-memory.dmp

Download

memory/548-2151-0x00007FF7A8350000-0x00007FF7A86A4000-memory.dmp

Download

memory/548-768-0x00007FF7A8350000-0x00007FF7A86A4000-memory.dmp

Download

memory/652-826-0x00007FF711E90000-0x00007FF7121E4000-memory.dmp

Download

memory/652-2152-0x00007FF711E90000-0x00007FF7121E4000-memory.dmp

Download

memory/908-734-0x00007FF755A10000-0x00007FF755D64000-memory.dmp

Download

memory/908-2144-0x00007FF755A10000-0x00007FF755D64000-memory.dmp

Download

memory/1424-2164-0x00007FF6B0EB0000-0x00007FF6B1204000-memory.dmp

Download

memory/1424-849-0x00007FF6B0EB0000-0x00007FF6B1204000-memory.dmp

Download

memory/1816-2147-0x00007FF622BD0000-0x00007FF622F24000-memory.dmp

Download

memory/1816-866-0x00007FF622BD0000-0x00007FF622F24000-memory.dmp

Download

memory/2084-742-0x00007FF61F710000-0x00007FF61FA64000-memory.dmp

Download

memory/2084-2166-0x00007FF61F710000-0x00007FF61FA64000-memory.dmp

Download

memory/2316-2150-0x00007FF677640000-0x00007FF677994000-memory.dmp

Download

memory/2316-739-0x00007FF677640000-0x00007FF677994000-memory.dmp

Download

memory/2484-2140-0x00007FF736870000-0x00007FF736BC4000-memory.dmp

Download

memory/2484-2127-0x00007FF736870000-0x00007FF736BC4000-memory.dmp

Download

memory/2484-14-0x00007FF736870000-0x00007FF736BC4000-memory.dmp

Download

memory/2596-863-0x00007FF715B70000-0x00007FF715EC4000-memory.dmp

Download

memory/2596-2158-0x00007FF715B70000-0x00007FF715EC4000-memory.dmp

Download

memory/2828-789-0x00007FF669D10000-0x00007FF66A064000-memory.dmp

Download

memory/2828-2155-0x00007FF669D10000-0x00007FF66A064000-memory.dmp

Download

memory/3228-740-0x00007FF6637F0000-0x00007FF663B44000-memory.dmp

Download

memory/3228-2162-0x00007FF6637F0000-0x00007FF663B44000-memory.dmp

Download

memory/3372-736-0x00007FF6EC6D0000-0x00007FF6ECA24000-memory.dmp

Download

memory/3372-2143-0x00007FF6EC6D0000-0x00007FF6ECA24000-memory.dmp

Download

memory/3576-737-0x00007FF72D960000-0x00007FF72DCB4000-memory.dmp

Download

memory/3576-2145-0x00007FF72D960000-0x00007FF72DCB4000-memory.dmp

Download

memory/3644-2163-0x00007FF68B150000-0x00007FF68B4A4000-memory.dmp

Download

memory/3644-741-0x00007FF68B150000-0x00007FF68B4A4000-memory.dmp

Download

memory/3692-10-0x00007FF657130000-0x00007FF657484000-memory.dmp

Download

memory/3692-2139-0x00007FF657130000-0x00007FF657484000-memory.dmp

Download

memory/3856-2153-0x00007FF787E70000-0x00007FF7881C4000-memory.dmp

Download

memory/3856-809-0x00007FF787E70000-0x00007FF7881C4000-memory.dmp

Download

memory/4136-779-0x00007FF624DE0000-0x00007FF625134000-memory.dmp

Download

memory/4136-2154-0x00007FF624DE0000-0x00007FF625134000-memory.dmp

Download

memory/4188-2165-0x00007FF6C0540000-0x00007FF6C0894000-memory.dmp

Download

memory/4188-743-0x00007FF6C0540000-0x00007FF6C0894000-memory.dmp

Download

memory/4340-805-0x00007FF71A570000-0x00007FF71A8C4000-memory.dmp

Download

memory/4340-2156-0x00007FF71A570000-0x00007FF71A8C4000-memory.dmp

Download

memory/4440-21-0x00007FF7F3FA0000-0x00007FF7F42F4000-memory.dmp

Download

memory/4440-2141-0x00007FF7F3FA0000-0x00007FF7F42F4000-memory.dmp

Download

memory/4440-2129-0x00007FF7F3FA0000-0x00007FF7F42F4000-memory.dmp

Download

memory/4500-2161-0x00007FF752FA0000-0x00007FF7532F4000-memory.dmp

Download

memory/4500-745-0x00007FF752FA0000-0x00007FF7532F4000-memory.dmp

Download

memory/4744-845-0x00007FF7B5EE0000-0x00007FF7B6234000-memory.dmp

Download

memory/4744-2160-0x00007FF7B5EE0000-0x00007FF7B6234000-memory.dmp

Download

memory/4748-0-0x00007FF721C30000-0x00007FF721F84000-memory.dmp

Download

memory/4748-1-0x000001EFEA2F0000-0x000001EFEA300000-memory.dmp

Download

memory/4748-2126-0x00007FF721C30000-0x00007FF721F84000-memory.dmp

Download

memory/4780-764-0x00007FF7CE570000-0x00007FF7CE8C4000-memory.dmp

Download

memory/4780-2157-0x00007FF7CE570000-0x00007FF7CE8C4000-memory.dmp

Download

memory/4940-2142-0x00007FF6BE570000-0x00007FF6BE8C4000-memory.dmp

Download

memory/4940-735-0x00007FF6BE570000-0x00007FF6BE8C4000-memory.dmp

Download

memory/4948-732-0x00007FF681AE0000-0x00007FF681E34000-memory.dmp

Download

memory/4948-2148-0x00007FF681AE0000-0x00007FF681E34000-memory.dmp

Download

memory/4948-2128-0x00007FF681AE0000-0x00007FF681E34000-memory.dmp

Download

memory/5088-2167-0x00007FF6D7500000-0x00007FF6D7854000-memory.dmp

Download

memory/5088-744-0x00007FF6D7500000-0x00007FF6D7854000-memory.dmp

Download