xmrig | 35174fed70eee5b347b5281ee64b5b168258118868ef2c77ea5feefb8b53ed11

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
Size 2.1MB
Sample240524-jmcqlsac59
SHA256 35174fed70eee5b347b5281ee64b5b168258118868ef2c77ea5feefb8b53ed11
MD5 1714ca3110d02db6f1205d02b7ac3bd0
SHA1 d289e9e9138ad06b1ffa9ada3d9afd08909aef28
SHA512 0ec17e9eb4f71839d0367c6dc2443e01d3f65b1571d9147b7968956dc59df6e43275a4c8b8fbdb0ef186f012b50cf84944a435e597f13c16c87d325004da66be
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmU:GemTLkNdfE0pZaQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 7700 created 4968	7700	WerFaultSecure.exe	89

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000700000002354d-7.dat	xmrig
behavioral2/files/0x0009000000023546-12.dat	xmrig
behavioral2/files/0x000700000002354e-15.dat	xmrig
behavioral2/files/0x000700000002354f-20.dat	xmrig
behavioral2/files/0x0007000000023550-22.dat	xmrig
behavioral2/files/0x0007000000023553-43.dat	xmrig
behavioral2/files/0x0007000000023555-49.dat	xmrig
behavioral2/files/0x000700000002355b-79.dat	xmrig
behavioral2/files/0x000700000002355d-93.dat	xmrig
behavioral2/files/0x0007000000023562-118.dat	xmrig
behavioral2/files/0x0007000000023568-148.dat	xmrig
behavioral2/files/0x000700000002356c-162.dat	xmrig
behavioral2/files/0x000700000002356a-158.dat	xmrig
behavioral2/files/0x000700000002356b-157.dat	xmrig
behavioral2/files/0x0007000000023569-153.dat	xmrig
behavioral2/files/0x0007000000023567-142.dat	xmrig
behavioral2/files/0x0007000000023566-138.dat	xmrig
behavioral2/files/0x0007000000023565-133.dat	xmrig
behavioral2/files/0x0007000000023564-128.dat	xmrig
behavioral2/files/0x0007000000023563-123.dat	xmrig
behavioral2/files/0x0007000000023561-113.dat	xmrig
behavioral2/files/0x0007000000023560-107.dat	xmrig
behavioral2/files/0x000700000002355f-103.dat	xmrig
behavioral2/files/0x000700000002355e-98.dat	xmrig
behavioral2/files/0x000700000002355c-87.dat	xmrig
behavioral2/files/0x000700000002355a-77.dat	xmrig
behavioral2/files/0x0007000000023559-73.dat	xmrig
behavioral2/files/0x0007000000023558-67.dat	xmrig
behavioral2/files/0x0007000000023557-63.dat	xmrig
behavioral2/files/0x0007000000023556-58.dat	xmrig
behavioral2/files/0x0007000000023554-47.dat	xmrig
behavioral2/files/0x0007000000023552-35.dat	xmrig
behavioral2/files/0x0007000000023551-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3068	NWwlRlm.exe
3980	ViMYdIV.exe
216	sFuZUcV.exe
3712	ZZNqusY.exe
540	AetiSYN.exe
3880	ExIKmaC.exe
3016	MrXqmJl.exe
4036	VWzUnWz.exe
4676	npIyRuL.exe
2384	gctqQta.exe
2056	hpPWons.exe
3288	sGEAKxL.exe
3024	lnvuWHB.exe
3444	zdeFKyO.exe
3764	puZZGNe.exe
660	VHlTUSj.exe
1728	YdZscNJ.exe
3088	RpqMyOH.exe
1108	KfzwbCk.exe
2256	Jynwpoo.exe
1176	lgqRsfy.exe
3680	ONTatHD.exe
1724	aBBKQDg.exe
1584	nakcEPH.exe
4064	hrLOvfs.exe
3756	nwYJrCK.exe
2108	qfZpJiT.exe
1340	PcSKDTB.exe
2468	RwmQjKZ.exe
4556	JhKRitz.exe
2616	qttDhpQ.exe
4028	yUHXsxG.exe
816	IQmUAjl.exe
4404	SGBZaNR.exe
2764	cOJKHHz.exe
4616	ZCYMECk.exe
3804	HSjJYhl.exe
2364	fmZowzA.exe
4456	QRuhHPl.exe
1488	vMTPRxQ.exe
2592	TtQIKVj.exe
3400	TEjabvj.exe
4532	djouDFG.exe
1512	yBwsjtP.exe
2580	bpPgefr.exe
4172	LgkzyAP.exe
2476	IXUtoJE.exe
1956	UExqKNE.exe
3636	JcdiIKD.exe
1016	oTOdURH.exe
4796	hglNovo.exe
5128	cJNTeGs.exe
5156	mACWebN.exe
5184	jTRzhTj.exe
5212	MeeLsCz.exe
5240	nDuDXHw.exe
5264	hYTAhlJ.exe
5300	rfPZpCl.exe
5328	RxTlDiA.exe
5360	yIhnReV.exe
5388	lqAbPLH.exe
5416	TrrFEFn.exe
5444	PCVTpbm.exe
5472	WVZHCeX.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LXSTBXx.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\TkSVTDl.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\bUejbAt.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\jECnKCg.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\kqUjgrH.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\ELOiXad.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\DzdwWJW.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\FVNvztU.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\LVnrLUp.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\KcaQyBx.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\XYlOXqT.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\YvdaFwR.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\lrickoC.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\qvuiELZ.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\yqIVeeX.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\HFnddoJ.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\WqhUKQR.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\nFVmsHV.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\sFuZUcV.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\OJspdWS.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\YRhbQwA.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\uFFuUfr.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\sJFeEKL.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\HSjJYhl.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\pNdFeQQ.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\VXKpvNM.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\lDMjIpW.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\tjzmmks.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZCYMECk.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\FiMZKxu.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\bGLVjTU.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\Ghpgtku.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\GXbQJZv.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\pTcqDAr.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\cVmQBJJ.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\SGkSxtV.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\HRqtGPa.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\QgnVihg.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\NWwlRlm.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\VHlTUSj.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\LUitCzr.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\TNdmbgd.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\RoFpSxM.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\GueqszM.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\PKUwyPn.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\fSUaCOn.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\UixfFtJ.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\tukkfwp.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\LifyLzT.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\ErvSuzJ.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\eoLOAuP.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\InJSYDs.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\OQUKhZG.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\HaMmWmp.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\ATwQZyg.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\QKdAaNy.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\iszmanb.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\GSrsnvi.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\jQsfeFk.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\HeOgnIF.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\kJXgcmy.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\mEKxpmZ.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\xsMVmSb.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
File created	C:\Windows\System\RVMNJDi.exe	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	WerFaultSecure.exe
2028	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4084	dwm.exe
Token: SeChangeNotifyPrivilege	4084	dwm.exe
Token: 33	4084	dwm.exe
Token: SeIncBasePriorityPrivilege	4084	dwm.exe
Token: SeShutdownPrivilege	4084	dwm.exe
Token: SeCreatePagefilePrivilege	4084	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 3068	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	93
PID 868 wrote to memory of 3068	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	93
PID 868 wrote to memory of 3980	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	94
PID 868 wrote to memory of 3980	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	94
PID 868 wrote to memory of 216	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	95
PID 868 wrote to memory of 216	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	95
PID 868 wrote to memory of 3712	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	96
PID 868 wrote to memory of 3712	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	96
PID 868 wrote to memory of 540	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	98
PID 868 wrote to memory of 540	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	98
PID 868 wrote to memory of 3880	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	99
PID 868 wrote to memory of 3880	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	99
PID 868 wrote to memory of 3016	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	100
PID 868 wrote to memory of 3016	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	100
PID 868 wrote to memory of 4036	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	101
PID 868 wrote to memory of 4036	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	101
PID 868 wrote to memory of 4676	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	102
PID 868 wrote to memory of 4676	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	102
PID 868 wrote to memory of 2384	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	103
PID 868 wrote to memory of 2384	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	103
PID 868 wrote to memory of 2056	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	104
PID 868 wrote to memory of 2056	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	104
PID 868 wrote to memory of 3288	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	105
PID 868 wrote to memory of 3288	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	105
PID 868 wrote to memory of 3024	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	106
PID 868 wrote to memory of 3024	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	106
PID 868 wrote to memory of 3444	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	107
PID 868 wrote to memory of 3444	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	107
PID 868 wrote to memory of 3764	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	108
PID 868 wrote to memory of 3764	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	108
PID 868 wrote to memory of 660	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	109
PID 868 wrote to memory of 660	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	109
PID 868 wrote to memory of 1728	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	110
PID 868 wrote to memory of 1728	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	110
PID 868 wrote to memory of 3088	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	111
PID 868 wrote to memory of 3088	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	111
PID 868 wrote to memory of 1108	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	112
PID 868 wrote to memory of 1108	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	112
PID 868 wrote to memory of 2256	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	113
PID 868 wrote to memory of 2256	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	113
PID 868 wrote to memory of 1176	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	114
PID 868 wrote to memory of 1176	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	114
PID 868 wrote to memory of 3680	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	115
PID 868 wrote to memory of 3680	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	115
PID 868 wrote to memory of 1724	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	116
PID 868 wrote to memory of 1724	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	116
PID 868 wrote to memory of 1584	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	117
PID 868 wrote to memory of 1584	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	117
PID 868 wrote to memory of 4064	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	118
PID 868 wrote to memory of 4064	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	118
PID 868 wrote to memory of 3756	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	119
PID 868 wrote to memory of 3756	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	119
PID 868 wrote to memory of 2108	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	120
PID 868 wrote to memory of 2108	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	120
PID 868 wrote to memory of 1340	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	121
PID 868 wrote to memory of 1340	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	121
PID 868 wrote to memory of 2468	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	122
PID 868 wrote to memory of 2468	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	122
PID 868 wrote to memory of 4556	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	123
PID 868 wrote to memory of 4556	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	123
PID 868 wrote to memory of 2616	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	124
PID 868 wrote to memory of 2616	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	124
PID 868 wrote to memory of 4028	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	125
PID 868 wrote to memory of 4028	868	1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe	125

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:4968
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4968 -s 240
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

C:\Users\Admin\AppData\Local\Temp\1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1714ca3110d02db6f1205d02b7ac3bd0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\System\NWwlRlm.exe
  C:\Windows\System\NWwlRlm.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\ViMYdIV.exe
  C:\Windows\System\ViMYdIV.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\sFuZUcV.exe
  C:\Windows\System\sFuZUcV.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\ZZNqusY.exe
  C:\Windows\System\ZZNqusY.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\AetiSYN.exe
  C:\Windows\System\AetiSYN.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ExIKmaC.exe
  C:\Windows\System\ExIKmaC.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\MrXqmJl.exe
  C:\Windows\System\MrXqmJl.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\VWzUnWz.exe
  C:\Windows\System\VWzUnWz.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\npIyRuL.exe
  C:\Windows\System\npIyRuL.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\gctqQta.exe
  C:\Windows\System\gctqQta.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\hpPWons.exe
  C:\Windows\System\hpPWons.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\sGEAKxL.exe
  C:\Windows\System\sGEAKxL.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\lnvuWHB.exe
  C:\Windows\System\lnvuWHB.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\zdeFKyO.exe
  C:\Windows\System\zdeFKyO.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\puZZGNe.exe
  C:\Windows\System\puZZGNe.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\VHlTUSj.exe
  C:\Windows\System\VHlTUSj.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\YdZscNJ.exe
  C:\Windows\System\YdZscNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\RpqMyOH.exe
  C:\Windows\System\RpqMyOH.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\KfzwbCk.exe
  C:\Windows\System\KfzwbCk.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\Jynwpoo.exe
  C:\Windows\System\Jynwpoo.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\lgqRsfy.exe
  C:\Windows\System\lgqRsfy.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\ONTatHD.exe
  C:\Windows\System\ONTatHD.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\aBBKQDg.exe
  C:\Windows\System\aBBKQDg.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\nakcEPH.exe
  C:\Windows\System\nakcEPH.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\hrLOvfs.exe
  C:\Windows\System\hrLOvfs.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\nwYJrCK.exe
  C:\Windows\System\nwYJrCK.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\qfZpJiT.exe
  C:\Windows\System\qfZpJiT.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\PcSKDTB.exe
  C:\Windows\System\PcSKDTB.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\RwmQjKZ.exe
  C:\Windows\System\RwmQjKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\JhKRitz.exe
  C:\Windows\System\JhKRitz.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\qttDhpQ.exe
  C:\Windows\System\qttDhpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\yUHXsxG.exe
  C:\Windows\System\yUHXsxG.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\IQmUAjl.exe
  C:\Windows\System\IQmUAjl.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\SGBZaNR.exe
  C:\Windows\System\SGBZaNR.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\cOJKHHz.exe
  C:\Windows\System\cOJKHHz.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ZCYMECk.exe
  C:\Windows\System\ZCYMECk.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\HSjJYhl.exe
  C:\Windows\System\HSjJYhl.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\fmZowzA.exe
  C:\Windows\System\fmZowzA.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\QRuhHPl.exe
  C:\Windows\System\QRuhHPl.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\vMTPRxQ.exe
  C:\Windows\System\vMTPRxQ.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\TtQIKVj.exe
  C:\Windows\System\TtQIKVj.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\TEjabvj.exe
  C:\Windows\System\TEjabvj.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\djouDFG.exe
  C:\Windows\System\djouDFG.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\yBwsjtP.exe
  C:\Windows\System\yBwsjtP.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\bpPgefr.exe
  C:\Windows\System\bpPgefr.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\LgkzyAP.exe
  C:\Windows\System\LgkzyAP.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\IXUtoJE.exe
  C:\Windows\System\IXUtoJE.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\UExqKNE.exe
  C:\Windows\System\UExqKNE.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\JcdiIKD.exe
  C:\Windows\System\JcdiIKD.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\oTOdURH.exe
  C:\Windows\System\oTOdURH.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\hglNovo.exe
  C:\Windows\System\hglNovo.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\cJNTeGs.exe
  C:\Windows\System\cJNTeGs.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\mACWebN.exe
  C:\Windows\System\mACWebN.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\jTRzhTj.exe
  C:\Windows\System\jTRzhTj.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\MeeLsCz.exe
  C:\Windows\System\MeeLsCz.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\nDuDXHw.exe
  C:\Windows\System\nDuDXHw.exe
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Windows\System\hYTAhlJ.exe
  C:\Windows\System\hYTAhlJ.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\rfPZpCl.exe
  C:\Windows\System\rfPZpCl.exe
  2⤵
  - Executes dropped EXE
  PID:5300
- C:\Windows\System\RxTlDiA.exe
  C:\Windows\System\RxTlDiA.exe
  2⤵
  - Executes dropped EXE
  PID:5328
- C:\Windows\System\yIhnReV.exe
  C:\Windows\System\yIhnReV.exe
  2⤵
  - Executes dropped EXE
  PID:5360
- C:\Windows\System\lqAbPLH.exe
  C:\Windows\System\lqAbPLH.exe
  2⤵
  - Executes dropped EXE
  PID:5388
- C:\Windows\System\TrrFEFn.exe
  C:\Windows\System\TrrFEFn.exe
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Windows\System\PCVTpbm.exe
  C:\Windows\System\PCVTpbm.exe
  2⤵
  - Executes dropped EXE
  PID:5444
- C:\Windows\System\WVZHCeX.exe
  C:\Windows\System\WVZHCeX.exe
  2⤵
  - Executes dropped EXE
  PID:5472
- C:\Windows\System\gecnfdz.exe
  C:\Windows\System\gecnfdz.exe
  2⤵
  PID:5496
- C:\Windows\System\HwtWleZ.exe
  C:\Windows\System\HwtWleZ.exe
  2⤵
  PID:5524
- C:\Windows\System\MKdfVuj.exe
  C:\Windows\System\MKdfVuj.exe
  2⤵
  PID:5552
- C:\Windows\System\LifyLzT.exe
  C:\Windows\System\LifyLzT.exe
  2⤵
  PID:5580
- C:\Windows\System\KcuocRp.exe
  C:\Windows\System\KcuocRp.exe
  2⤵
  PID:5600
- C:\Windows\System\gNCRann.exe
  C:\Windows\System\gNCRann.exe
  2⤵
  PID:5632
- C:\Windows\System\tMQqouv.exe
  C:\Windows\System\tMQqouv.exe
  2⤵
  PID:5656
- C:\Windows\System\sjHhvpw.exe
  C:\Windows\System\sjHhvpw.exe
  2⤵
  PID:5684
- C:\Windows\System\tsYXJTi.exe
  C:\Windows\System\tsYXJTi.exe
  2⤵
  PID:5712
- C:\Windows\System\cbQTlGZ.exe
  C:\Windows\System\cbQTlGZ.exe
  2⤵
  PID:5740
- C:\Windows\System\QjLJves.exe
  C:\Windows\System\QjLJves.exe
  2⤵
  PID:5764
- C:\Windows\System\gWukhnA.exe
  C:\Windows\System\gWukhnA.exe
  2⤵
  PID:5796
- C:\Windows\System\lmpgAXq.exe
  C:\Windows\System\lmpgAXq.exe
  2⤵
  PID:5824
- C:\Windows\System\JDIinXn.exe
  C:\Windows\System\JDIinXn.exe
  2⤵
  PID:5852
- C:\Windows\System\iIAnBdz.exe
  C:\Windows\System\iIAnBdz.exe
  2⤵
  PID:5880
- C:\Windows\System\kcYKYAs.exe
  C:\Windows\System\kcYKYAs.exe
  2⤵
  PID:5908
- C:\Windows\System\GAqfTlC.exe
  C:\Windows\System\GAqfTlC.exe
  2⤵
  PID:5936
- C:\Windows\System\JTrbalt.exe
  C:\Windows\System\JTrbalt.exe
  2⤵
  PID:5964
- C:\Windows\System\yqIVeeX.exe
  C:\Windows\System\yqIVeeX.exe
  2⤵
  PID:5992
- C:\Windows\System\jQsfeFk.exe
  C:\Windows\System\jQsfeFk.exe
  2⤵
  PID:6020
- C:\Windows\System\odeMFXP.exe
  C:\Windows\System\odeMFXP.exe
  2⤵
  PID:6048
- C:\Windows\System\ddmWLFz.exe
  C:\Windows\System\ddmWLFz.exe
  2⤵
  PID:6076
- C:\Windows\System\ifcVVxi.exe
  C:\Windows\System\ifcVVxi.exe
  2⤵
  PID:6104
- C:\Windows\System\bzjCoLS.exe
  C:\Windows\System\bzjCoLS.exe
  2⤵
  PID:6132
- C:\Windows\System\zflpWlT.exe
  C:\Windows\System\zflpWlT.exe
  2⤵
  PID:4744
- C:\Windows\System\rQUVdFo.exe
  C:\Windows\System\rQUVdFo.exe
  2⤵
  PID:808
- C:\Windows\System\abpXJSG.exe
  C:\Windows\System\abpXJSG.exe
  2⤵
  PID:768
- C:\Windows\System\cVmQBJJ.exe
  C:\Windows\System\cVmQBJJ.exe
  2⤵
  PID:776
- C:\Windows\System\qgfolyE.exe
  C:\Windows\System\qgfolyE.exe
  2⤵
  PID:3448
- C:\Windows\System\LfqziHh.exe
  C:\Windows\System\LfqziHh.exe
  2⤵
  PID:5164
- C:\Windows\System\SGkSxtV.exe
  C:\Windows\System\SGkSxtV.exe
  2⤵
  PID:5228
- C:\Windows\System\ZtcLqOI.exe
  C:\Windows\System\ZtcLqOI.exe
  2⤵
  PID:5284
- C:\Windows\System\PaLqSNj.exe
  C:\Windows\System\PaLqSNj.exe
  2⤵
  PID:5352
- C:\Windows\System\FKAfDbL.exe
  C:\Windows\System\FKAfDbL.exe
  2⤵
  PID:5428
- C:\Windows\System\FVIdWRz.exe
  C:\Windows\System\FVIdWRz.exe
  2⤵
  PID:5488
- C:\Windows\System\OkqTmPs.exe
  C:\Windows\System\OkqTmPs.exe
  2⤵
  PID:5548
- C:\Windows\System\FErqKbJ.exe
  C:\Windows\System\FErqKbJ.exe
  2⤵
  PID:5616
- C:\Windows\System\PMDChux.exe
  C:\Windows\System\PMDChux.exe
  2⤵
  PID:5672
- C:\Windows\System\aNUXUwi.exe
  C:\Windows\System\aNUXUwi.exe
  2⤵
  PID:5752
- C:\Windows\System\frklnkX.exe
  C:\Windows\System\frklnkX.exe
  2⤵
  PID:5812
- C:\Windows\System\XDyHlmM.exe
  C:\Windows\System\XDyHlmM.exe
  2⤵
  PID:5872
- C:\Windows\System\jjIRYiK.exe
  C:\Windows\System\jjIRYiK.exe
  2⤵
  PID:5948
- C:\Windows\System\qOjMNFu.exe
  C:\Windows\System\qOjMNFu.exe
  2⤵
  PID:6008
- C:\Windows\System\sJACBGG.exe
  C:\Windows\System\sJACBGG.exe
  2⤵
  PID:6068
- C:\Windows\System\XbxLWeq.exe
  C:\Windows\System\XbxLWeq.exe
  2⤵
  PID:2872
- C:\Windows\System\rVkCmpv.exe
  C:\Windows\System\rVkCmpv.exe
  2⤵
  PID:4628
- C:\Windows\System\FqfbDPu.exe
  C:\Windows\System\FqfbDPu.exe
  2⤵
  PID:3536
- C:\Windows\System\VFnUusS.exe
  C:\Windows\System\VFnUusS.exe
  2⤵
  PID:5256
- C:\Windows\System\jNCRsEN.exe
  C:\Windows\System\jNCRsEN.exe
  2⤵
  PID:5400
- C:\Windows\System\sckEhXb.exe
  C:\Windows\System\sckEhXb.exe
  2⤵
  PID:5540
- C:\Windows\System\dxjkJPk.exe
  C:\Windows\System\dxjkJPk.exe
  2⤵
  PID:5652
- C:\Windows\System\iYyFXyC.exe
  C:\Windows\System\iYyFXyC.exe
  2⤵
  PID:6168
- C:\Windows\System\rGNfPoa.exe
  C:\Windows\System\rGNfPoa.exe
  2⤵
  PID:6196
- C:\Windows\System\iwpGXfo.exe
  C:\Windows\System\iwpGXfo.exe
  2⤵
  PID:6224
- C:\Windows\System\OLbMzYg.exe
  C:\Windows\System\OLbMzYg.exe
  2⤵
  PID:6248
- C:\Windows\System\QfDGZbZ.exe
  C:\Windows\System\QfDGZbZ.exe
  2⤵
  PID:6280
- C:\Windows\System\prjpLjn.exe
  C:\Windows\System\prjpLjn.exe
  2⤵
  PID:6308
- C:\Windows\System\NDuTbrX.exe
  C:\Windows\System\NDuTbrX.exe
  2⤵
  PID:6336
- C:\Windows\System\ZqrOKTT.exe
  C:\Windows\System\ZqrOKTT.exe
  2⤵
  PID:6360
- C:\Windows\System\YpTvZYF.exe
  C:\Windows\System\YpTvZYF.exe
  2⤵
  PID:6392
- C:\Windows\System\SoGXzDF.exe
  C:\Windows\System\SoGXzDF.exe
  2⤵
  PID:6420
- C:\Windows\System\vlMNanc.exe
  C:\Windows\System\vlMNanc.exe
  2⤵
  PID:6448
- C:\Windows\System\HtwSFuT.exe
  C:\Windows\System\HtwSFuT.exe
  2⤵
  PID:6476
- C:\Windows\System\DilKwFJ.exe
  C:\Windows\System\DilKwFJ.exe
  2⤵
  PID:6504
- C:\Windows\System\nBpNmRC.exe
  C:\Windows\System\nBpNmRC.exe
  2⤵
  PID:6532
- C:\Windows\System\fjBpoMa.exe
  C:\Windows\System\fjBpoMa.exe
  2⤵
  PID:6560
- C:\Windows\System\Onevqjl.exe
  C:\Windows\System\Onevqjl.exe
  2⤵
  PID:6588
- C:\Windows\System\ztmNJOY.exe
  C:\Windows\System\ztmNJOY.exe
  2⤵
  PID:6616
- C:\Windows\System\SDWgqfZ.exe
  C:\Windows\System\SDWgqfZ.exe
  2⤵
  PID:6644
- C:\Windows\System\gUJXgIy.exe
  C:\Windows\System\gUJXgIy.exe
  2⤵
  PID:6672
- C:\Windows\System\sAIPnIO.exe
  C:\Windows\System\sAIPnIO.exe
  2⤵
  PID:6700
- C:\Windows\System\EhqgvPl.exe
  C:\Windows\System\EhqgvPl.exe
  2⤵
  PID:6728
- C:\Windows\System\LZpEHQi.exe
  C:\Windows\System\LZpEHQi.exe
  2⤵
  PID:6752
- C:\Windows\System\CnddGaE.exe
  C:\Windows\System\CnddGaE.exe
  2⤵
  PID:6784
- C:\Windows\System\znUSpjw.exe
  C:\Windows\System\znUSpjw.exe
  2⤵
  PID:6812
- C:\Windows\System\kGQAggy.exe
  C:\Windows\System\kGQAggy.exe
  2⤵
  PID:6840
- C:\Windows\System\inZTWFb.exe
  C:\Windows\System\inZTWFb.exe
  2⤵
  PID:6868
- C:\Windows\System\rrxSWEW.exe
  C:\Windows\System\rrxSWEW.exe
  2⤵
  PID:6896
- C:\Windows\System\jgLpgqK.exe
  C:\Windows\System\jgLpgqK.exe
  2⤵
  PID:6924
- C:\Windows\System\AvBYPFF.exe
  C:\Windows\System\AvBYPFF.exe
  2⤵
  PID:6952
- C:\Windows\System\zXkVQBM.exe
  C:\Windows\System\zXkVQBM.exe
  2⤵
  PID:6976
- C:\Windows\System\eOenkvI.exe
  C:\Windows\System\eOenkvI.exe
  2⤵
  PID:7008
- C:\Windows\System\LxOVwyV.exe
  C:\Windows\System\LxOVwyV.exe
  2⤵
  PID:7036
- C:\Windows\System\BRZdHnb.exe
  C:\Windows\System\BRZdHnb.exe
  2⤵
  PID:7064
- C:\Windows\System\ATwQZyg.exe
  C:\Windows\System\ATwQZyg.exe
  2⤵
  PID:7092
- C:\Windows\System\XgapByF.exe
  C:\Windows\System\XgapByF.exe
  2⤵
  PID:7120
- C:\Windows\System\BMDkKUi.exe
  C:\Windows\System\BMDkKUi.exe
  2⤵
  PID:7148
- C:\Windows\System\kBpWoqF.exe
  C:\Windows\System\kBpWoqF.exe
  2⤵
  PID:5780
- C:\Windows\System\IAAUqoQ.exe
  C:\Windows\System\IAAUqoQ.exe
  2⤵
  PID:5900
- C:\Windows\System\HRqtGPa.exe
  C:\Windows\System\HRqtGPa.exe
  2⤵
  PID:6060
- C:\Windows\System\YEsGLli.exe
  C:\Windows\System\YEsGLli.exe
  2⤵
  PID:4524
- C:\Windows\System\PNSqfgg.exe
  C:\Windows\System\PNSqfgg.exe
  2⤵
  PID:5324
- C:\Windows\System\cVmFKFI.exe
  C:\Windows\System\cVmFKFI.exe
  2⤵
  PID:5596
- C:\Windows\System\kAKKHxI.exe
  C:\Windows\System\kAKKHxI.exe
  2⤵
  PID:6208
- C:\Windows\System\GjstiOg.exe
  C:\Windows\System\GjstiOg.exe
  2⤵
  PID:6268
- C:\Windows\System\JGMJsXr.exe
  C:\Windows\System\JGMJsXr.exe
  2⤵
  PID:6328
- C:\Windows\System\BCjIiIE.exe
  C:\Windows\System\BCjIiIE.exe
  2⤵
  PID:6384
- C:\Windows\System\xTcjTwd.exe
  C:\Windows\System\xTcjTwd.exe
  2⤵
  PID:6460
- C:\Windows\System\bECCEFM.exe
  C:\Windows\System\bECCEFM.exe
  2⤵
  PID:6520
- C:\Windows\System\XxZioRL.exe
  C:\Windows\System\XxZioRL.exe
  2⤵
  PID:6580
- C:\Windows\System\TkSVTDl.exe
  C:\Windows\System\TkSVTDl.exe
  2⤵
  PID:6656
- C:\Windows\System\OgOYjeh.exe
  C:\Windows\System\OgOYjeh.exe
  2⤵
  PID:6712
- C:\Windows\System\DNbqdCd.exe
  C:\Windows\System\DNbqdCd.exe
  2⤵
  PID:6776
- C:\Windows\System\zjkUQVq.exe
  C:\Windows\System\zjkUQVq.exe
  2⤵
  PID:6832
- C:\Windows\System\KnNKiLg.exe
  C:\Windows\System\KnNKiLg.exe
  2⤵
  PID:6908
- C:\Windows\System\HvBmAjN.exe
  C:\Windows\System\HvBmAjN.exe
  2⤵
  PID:1852
- C:\Windows\System\YyUHakX.exe
  C:\Windows\System\YyUHakX.exe
  2⤵
  PID:7000
- C:\Windows\System\VgcEvcz.exe
  C:\Windows\System\VgcEvcz.exe
  2⤵
  PID:7080
- C:\Windows\System\ISmABod.exe
  C:\Windows\System\ISmABod.exe
  2⤵
  PID:7140
- C:\Windows\System\uBQornR.exe
  C:\Windows\System\uBQornR.exe
  2⤵
  PID:3012
- C:\Windows\System\JAGZHti.exe
  C:\Windows\System\JAGZHti.exe
  2⤵
  PID:1564
- C:\Windows\System\kszRQaj.exe
  C:\Windows\System\kszRQaj.exe
  2⤵
  PID:6184
- C:\Windows\System\UtPziDk.exe
  C:\Windows\System\UtPziDk.exe
  2⤵
  PID:6320
- C:\Windows\System\GBURtUz.exe
  C:\Windows\System\GBURtUz.exe
  2⤵
  PID:6492
- C:\Windows\System\fPuMFGp.exe
  C:\Windows\System\fPuMFGp.exe
  2⤵
  PID:6628
- C:\Windows\System\YiHPBNG.exe
  C:\Windows\System\YiHPBNG.exe
  2⤵
  PID:6768
- C:\Windows\System\mUKOKov.exe
  C:\Windows\System\mUKOKov.exe
  2⤵
  PID:6916
- C:\Windows\System\koUxSPv.exe
  C:\Windows\System\koUxSPv.exe
  2⤵
  PID:1812
- C:\Windows\System\LDcgSfb.exe
  C:\Windows\System\LDcgSfb.exe
  2⤵
  PID:7176
- C:\Windows\System\ZnCjupS.exe
  C:\Windows\System\ZnCjupS.exe
  2⤵
  PID:7208
- C:\Windows\System\gQQdpGT.exe
  C:\Windows\System\gQQdpGT.exe
  2⤵
  PID:7232
- C:\Windows\System\sovTjCR.exe
  C:\Windows\System\sovTjCR.exe
  2⤵
  PID:7260
- C:\Windows\System\dDUUckf.exe
  C:\Windows\System\dDUUckf.exe
  2⤵
  PID:7288
- C:\Windows\System\hQxiqvX.exe
  C:\Windows\System\hQxiqvX.exe
  2⤵
  PID:7316
- C:\Windows\System\VOvJpZS.exe
  C:\Windows\System\VOvJpZS.exe
  2⤵
  PID:7344
- C:\Windows\System\muytuKj.exe
  C:\Windows\System\muytuKj.exe
  2⤵
  PID:7372
- C:\Windows\System\yDQIKJL.exe
  C:\Windows\System\yDQIKJL.exe
  2⤵
  PID:7400
- C:\Windows\System\aYQvuLY.exe
  C:\Windows\System\aYQvuLY.exe
  2⤵
  PID:7428
- C:\Windows\System\tmpujKn.exe
  C:\Windows\System\tmpujKn.exe
  2⤵
  PID:7452
- C:\Windows\System\QKDtery.exe
  C:\Windows\System\QKDtery.exe
  2⤵
  PID:7484
- C:\Windows\System\lJxldiL.exe
  C:\Windows\System\lJxldiL.exe
  2⤵
  PID:7512
- C:\Windows\System\HDEIEaM.exe
  C:\Windows\System\HDEIEaM.exe
  2⤵
  PID:7540
- C:\Windows\System\jGPxeBl.exe
  C:\Windows\System\jGPxeBl.exe
  2⤵
  PID:7568
- C:\Windows\System\fmvpOmr.exe
  C:\Windows\System\fmvpOmr.exe
  2⤵
  PID:7596
- C:\Windows\System\XHFjPqg.exe
  C:\Windows\System\XHFjPqg.exe
  2⤵
  PID:7624
- C:\Windows\System\lLKsisr.exe
  C:\Windows\System\lLKsisr.exe
  2⤵
  PID:7652
- C:\Windows\System\whNdWKt.exe
  C:\Windows\System\whNdWKt.exe
  2⤵
  PID:7676
- C:\Windows\System\GLwJhFv.exe
  C:\Windows\System\GLwJhFv.exe
  2⤵
  PID:7704
- C:\Windows\System\QPkcFjZ.exe
  C:\Windows\System\QPkcFjZ.exe
  2⤵
  PID:7732
- C:\Windows\System\qHCHtHm.exe
  C:\Windows\System\qHCHtHm.exe
  2⤵
  PID:7764
- C:\Windows\System\TUqBCGg.exe
  C:\Windows\System\TUqBCGg.exe
  2⤵
  PID:7788
- C:\Windows\System\EKLamOz.exe
  C:\Windows\System\EKLamOz.exe
  2⤵
  PID:7816
- C:\Windows\System\fzeSEfn.exe
  C:\Windows\System\fzeSEfn.exe
  2⤵
  PID:7848
- C:\Windows\System\JBlThQD.exe
  C:\Windows\System\JBlThQD.exe
  2⤵
  PID:7876
- C:\Windows\System\cgtrKjh.exe
  C:\Windows\System\cgtrKjh.exe
  2⤵
  PID:7904
- C:\Windows\System\sZHhWjW.exe
  C:\Windows\System\sZHhWjW.exe
  2⤵
  PID:7928
- C:\Windows\System\lJriOwH.exe
  C:\Windows\System\lJriOwH.exe
  2⤵
  PID:8020
- C:\Windows\System\SErCJRw.exe
  C:\Windows\System\SErCJRw.exe
  2⤵
  PID:8056
- C:\Windows\System\JiEeEzV.exe
  C:\Windows\System\JiEeEzV.exe
  2⤵
  PID:8088
- C:\Windows\System\hpNLVdC.exe
  C:\Windows\System\hpNLVdC.exe
  2⤵
  PID:8104
- C:\Windows\System\InJSYDs.exe
  C:\Windows\System\InJSYDs.exe
  2⤵
  PID:8140
- C:\Windows\System\nsZIXzI.exe
  C:\Windows\System\nsZIXzI.exe
  2⤵
  PID:8168
- C:\Windows\System\VJbqgLz.exe
  C:\Windows\System\VJbqgLz.exe
  2⤵
  PID:6240
- C:\Windows\System\kiBwOUM.exe
  C:\Windows\System\kiBwOUM.exe
  2⤵
  PID:6552
- C:\Windows\System\jBwPpLB.exe
  C:\Windows\System\jBwPpLB.exe
  2⤵
  PID:6824
- C:\Windows\System\xrKASrF.exe
  C:\Windows\System\xrKASrF.exe
  2⤵
  PID:7056
- C:\Windows\System\PKUwyPn.exe
  C:\Windows\System\PKUwyPn.exe
  2⤵
  PID:7224
- C:\Windows\System\FIyDxMK.exe
  C:\Windows\System\FIyDxMK.exe
  2⤵
  PID:7272
- C:\Windows\System\ARlfPHZ.exe
  C:\Windows\System\ARlfPHZ.exe
  2⤵
  PID:7356
- C:\Windows\System\mEKxpmZ.exe
  C:\Windows\System\mEKxpmZ.exe
  2⤵
  PID:7388
- C:\Windows\System\iJntzrG.exe
  C:\Windows\System\iJntzrG.exe
  2⤵
  PID:7468
- C:\Windows\System\KoLcHXA.exe
  C:\Windows\System\KoLcHXA.exe
  2⤵
  PID:3236
- C:\Windows\System\LtaQNQg.exe
  C:\Windows\System\LtaQNQg.exe
  2⤵
  PID:7556
- C:\Windows\System\SMbZUrn.exe
  C:\Windows\System\SMbZUrn.exe
  2⤵
  PID:7608
- C:\Windows\System\zvKtjip.exe
  C:\Windows\System\zvKtjip.exe
  2⤵
  PID:7636
- C:\Windows\System\RvVdmWn.exe
  C:\Windows\System\RvVdmWn.exe
  2⤵
  PID:7668
- C:\Windows\System\DTSEcxR.exe
  C:\Windows\System\DTSEcxR.exe
  2⤵
  PID:2192
- C:\Windows\System\tMxFVhm.exe
  C:\Windows\System\tMxFVhm.exe
  2⤵
  PID:7752
- C:\Windows\System\NvjcPmm.exe
  C:\Windows\System\NvjcPmm.exe
  2⤵
  PID:7776
- C:\Windows\System\RLfhbwY.exe
  C:\Windows\System\RLfhbwY.exe
  2⤵
  PID:7808
- C:\Windows\System\bXztrhP.exe
  C:\Windows\System\bXztrhP.exe
  2⤵
  PID:2792
- C:\Windows\System\NxodzDr.exe
  C:\Windows\System\NxodzDr.exe
  2⤵
  PID:564
- C:\Windows\System\TNdmbgd.exe
  C:\Windows\System\TNdmbgd.exe
  2⤵
  PID:7864
- C:\Windows\System\UkYxmBB.exe
  C:\Windows\System\UkYxmBB.exe
  2⤵
  PID:7892
- C:\Windows\System\UYBCQNp.exe
  C:\Windows\System\UYBCQNp.exe
  2⤵
  PID:7920
- C:\Windows\System\rvyHiTR.exe
  C:\Windows\System\rvyHiTR.exe
  2⤵
  PID:2284
- C:\Windows\System\Ujlxcvy.exe
  C:\Windows\System\Ujlxcvy.exe
  2⤵
  PID:4920
- C:\Windows\System\AjXUMEU.exe
  C:\Windows\System\AjXUMEU.exe
  2⤵
  PID:8036
- C:\Windows\System\GhsCMLF.exe
  C:\Windows\System\GhsCMLF.exe
  2⤵
  PID:8080
- C:\Windows\System\ADcgsyY.exe
  C:\Windows\System\ADcgsyY.exe
  2⤵
  PID:8128
- C:\Windows\System\yMNDVCV.exe
  C:\Windows\System\yMNDVCV.exe
  2⤵
  PID:4288
- C:\Windows\System\dfwjOMN.exe
  C:\Windows\System\dfwjOMN.exe
  2⤵
  PID:7188
- C:\Windows\System\fSYoznd.exe
  C:\Windows\System\fSYoznd.exe
  2⤵
  PID:4748
- C:\Windows\System\QgnVihg.exe
  C:\Windows\System\QgnVihg.exe
  2⤵
  PID:7440
- C:\Windows\System\XYoGNdp.exe
  C:\Windows\System\XYoGNdp.exe
  2⤵
  PID:7584
- C:\Windows\System\AatcPQT.exe
  C:\Windows\System\AatcPQT.exe
  2⤵
  PID:2780
- C:\Windows\System\rEAIJne.exe
  C:\Windows\System\rEAIJne.exe
  2⤵
  PID:4892
- C:\Windows\System\cSvmYbD.exe
  C:\Windows\System\cSvmYbD.exe
  2⤵
  PID:4880
- C:\Windows\System\IGZdbyT.exe
  C:\Windows\System\IGZdbyT.exe
  2⤵
  PID:3280
- C:\Windows\System\IJstPNc.exe
  C:\Windows\System\IJstPNc.exe
  2⤵
  PID:2400
- C:\Windows\System\YvdaFwR.exe
  C:\Windows\System\YvdaFwR.exe
  2⤵
  PID:3172
- C:\Windows\System\CSptODf.exe
  C:\Windows\System\CSptODf.exe
  2⤵
  PID:8072
- C:\Windows\System\KuiPwgD.exe
  C:\Windows\System\KuiPwgD.exe
  2⤵
  PID:8188
- C:\Windows\System\dSiXLCu.exe
  C:\Windows\System\dSiXLCu.exe
  2⤵
  PID:4888
- C:\Windows\System\lrickoC.exe
  C:\Windows\System\lrickoC.exe
  2⤵
  PID:6992
- C:\Windows\System\qvuiELZ.exe
  C:\Windows\System\qvuiELZ.exe
  2⤵
  PID:7496
- C:\Windows\System\RPDkhRl.exe
  C:\Windows\System\RPDkhRl.exe
  2⤵
  PID:7804
- C:\Windows\System\UuCKSNm.exe
  C:\Windows\System\UuCKSNm.exe
  2⤵
  PID:1372
- C:\Windows\System\dwCHYpQ.exe
  C:\Windows\System\dwCHYpQ.exe
  2⤵
  PID:6548
- C:\Windows\System\DediAEs.exe
  C:\Windows\System\DediAEs.exe
  2⤵
  PID:7412
- C:\Windows\System\YMipGhi.exe
  C:\Windows\System\YMipGhi.exe
  2⤵
  PID:7988
- C:\Windows\System\GgZXsHu.exe
  C:\Windows\System\GgZXsHu.exe
  2⤵
  PID:1204
- C:\Windows\System\yMOZphK.exe
  C:\Windows\System\yMOZphK.exe
  2⤵
  PID:1944
- C:\Windows\System\QQkOgmt.exe
  C:\Windows\System\QQkOgmt.exe
  2⤵
  PID:8208
- C:\Windows\System\ipGMKem.exe
  C:\Windows\System\ipGMKem.exe
  2⤵
  PID:8244
- C:\Windows\System\wUtqjZb.exe
  C:\Windows\System\wUtqjZb.exe
  2⤵
  PID:8284
- C:\Windows\System\iJpvKwP.exe
  C:\Windows\System\iJpvKwP.exe
  2⤵
  PID:8320
- C:\Windows\System\PRiICCU.exe
  C:\Windows\System\PRiICCU.exe
  2⤵
  PID:8344
- C:\Windows\System\oDTRBsQ.exe
  C:\Windows\System\oDTRBsQ.exe
  2⤵
  PID:8376
- C:\Windows\System\TdnBLmw.exe
  C:\Windows\System\TdnBLmw.exe
  2⤵
  PID:8416
- C:\Windows\System\QKdAaNy.exe
  C:\Windows\System\QKdAaNy.exe
  2⤵
  PID:8444
- C:\Windows\System\iGwIdoH.exe
  C:\Windows\System\iGwIdoH.exe
  2⤵
  PID:8460
- C:\Windows\System\YtOhSuq.exe
  C:\Windows\System\YtOhSuq.exe
  2⤵
  PID:8496
- C:\Windows\System\pNdFeQQ.exe
  C:\Windows\System\pNdFeQQ.exe
  2⤵
  PID:8516
- C:\Windows\System\dxgjYXV.exe
  C:\Windows\System\dxgjYXV.exe
  2⤵
  PID:8532
- C:\Windows\System\eDDnUDg.exe
  C:\Windows\System\eDDnUDg.exe
  2⤵
  PID:8564
- C:\Windows\System\BwZkmyp.exe
  C:\Windows\System\BwZkmyp.exe
  2⤵
  PID:8600
- C:\Windows\System\rIPwije.exe
  C:\Windows\System\rIPwije.exe
  2⤵
  PID:8640
- C:\Windows\System\ErvSuzJ.exe
  C:\Windows\System\ErvSuzJ.exe
  2⤵
  PID:8656
- C:\Windows\System\HMuNSrs.exe
  C:\Windows\System\HMuNSrs.exe
  2⤵
  PID:8684
- C:\Windows\System\EPXQFfr.exe
  C:\Windows\System\EPXQFfr.exe
  2⤵
  PID:8712
- C:\Windows\System\JfyhwQO.exe
  C:\Windows\System\JfyhwQO.exe
  2⤵
  PID:8740
- C:\Windows\System\GPBViNU.exe
  C:\Windows\System\GPBViNU.exe
  2⤵
  PID:8768
- C:\Windows\System\omGmdzE.exe
  C:\Windows\System\omGmdzE.exe
  2⤵
  PID:8796
- C:\Windows\System\DWASdvG.exe
  C:\Windows\System\DWASdvG.exe
  2⤵
  PID:8836
- C:\Windows\System\FXAbpgm.exe
  C:\Windows\System\FXAbpgm.exe
  2⤵
  PID:8868
- C:\Windows\System\LxQgShU.exe
  C:\Windows\System\LxQgShU.exe
  2⤵
  PID:8896
- C:\Windows\System\xZhPlCe.exe
  C:\Windows\System\xZhPlCe.exe
  2⤵
  PID:8912
- C:\Windows\System\TwpPWDO.exe
  C:\Windows\System\TwpPWDO.exe
  2⤵
  PID:8952
- C:\Windows\System\iszmanb.exe
  C:\Windows\System\iszmanb.exe
  2⤵
  PID:8980
- C:\Windows\System\vPBJgkY.exe
  C:\Windows\System\vPBJgkY.exe
  2⤵
  PID:8996
- C:\Windows\System\HZhEQwh.exe
  C:\Windows\System\HZhEQwh.exe
  2⤵
  PID:9032
- C:\Windows\System\mcuyaMW.exe
  C:\Windows\System\mcuyaMW.exe
  2⤵
  PID:9056
- C:\Windows\System\YkvmBef.exe
  C:\Windows\System\YkvmBef.exe
  2⤵
  PID:9084
- C:\Windows\System\kMsUKlI.exe
  C:\Windows\System\kMsUKlI.exe
  2⤵
  PID:9112
- C:\Windows\System\sZkSUCo.exe
  C:\Windows\System\sZkSUCo.exe
  2⤵
  PID:9152
- C:\Windows\System\mFaSMHw.exe
  C:\Windows\System\mFaSMHw.exe
  2⤵
  PID:9168
- C:\Windows\System\yRQrhMk.exe
  C:\Windows\System\yRQrhMk.exe
  2⤵
  PID:9196
- C:\Windows\System\DXorqZd.exe
  C:\Windows\System\DXorqZd.exe
  2⤵
  PID:1276
- C:\Windows\System\EOrSzuK.exe
  C:\Windows\System\EOrSzuK.exe
  2⤵
  PID:8260
- C:\Windows\System\LYefnri.exe
  C:\Windows\System\LYefnri.exe
  2⤵
  PID:8356
- C:\Windows\System\AlLgaGc.exe
  C:\Windows\System\AlLgaGc.exe
  2⤵
  PID:8428
- C:\Windows\System\BUfJCHe.exe
  C:\Windows\System\BUfJCHe.exe
  2⤵
  PID:8508
- C:\Windows\System\TmexgPc.exe
  C:\Windows\System\TmexgPc.exe
  2⤵
  PID:8556
- C:\Windows\System\zbLdPTS.exe
  C:\Windows\System\zbLdPTS.exe
  2⤵
  PID:8584
- C:\Windows\System\ZAsxwhI.exe
  C:\Windows\System\ZAsxwhI.exe
  2⤵
  PID:8708
- C:\Windows\System\eDJwZbE.exe
  C:\Windows\System\eDJwZbE.exe
  2⤵
  PID:8756
- C:\Windows\System\ERmpuRB.exe
  C:\Windows\System\ERmpuRB.exe
  2⤵
  PID:8788
- C:\Windows\System\YyBWuSm.exe
  C:\Windows\System\YyBWuSm.exe
  2⤵
  PID:8884
- C:\Windows\System\tsOXWEZ.exe
  C:\Windows\System\tsOXWEZ.exe
  2⤵
  PID:8972
- C:\Windows\System\SWJVekm.exe
  C:\Windows\System\SWJVekm.exe
  2⤵
  PID:9028
- C:\Windows\System\HeOgnIF.exe
  C:\Windows\System\HeOgnIF.exe
  2⤵
  PID:9064
- C:\Windows\System\BOVucCV.exe
  C:\Windows\System\BOVucCV.exe
  2⤵
  PID:9148
- C:\Windows\System\WSuIoNf.exe
  C:\Windows\System\WSuIoNf.exe
  2⤵
  PID:9180
- C:\Windows\System\NCBcMgh.exe
  C:\Windows\System\NCBcMgh.exe
  2⤵
  PID:8292
- C:\Windows\System\fFBZdmN.exe
  C:\Windows\System\fFBZdmN.exe
  2⤵
  PID:8452
- C:\Windows\System\pdKEXSQ.exe
  C:\Windows\System\pdKEXSQ.exe
  2⤵
  PID:8596
- C:\Windows\System\kPATzXf.exe
  C:\Windows\System\kPATzXf.exe
  2⤵
  PID:8764
- C:\Windows\System\yrJlORo.exe
  C:\Windows\System\yrJlORo.exe
  2⤵
  PID:8908
- C:\Windows\System\BWhIaMl.exe
  C:\Windows\System\BWhIaMl.exe
  2⤵
  PID:9136
- C:\Windows\System\dYdFIse.exe
  C:\Windows\System\dYdFIse.exe
  2⤵
  PID:9212
- C:\Windows\System\JxBnqVX.exe
  C:\Windows\System\JxBnqVX.exe
  2⤵
  PID:8668
- C:\Windows\System\lgbGqpe.exe
  C:\Windows\System\lgbGqpe.exe
  2⤵
  PID:8992
- C:\Windows\System\uONJdqF.exe
  C:\Windows\System\uONJdqF.exe
  2⤵
  PID:9184
- C:\Windows\System\HZHNzAZ.exe
  C:\Windows\System\HZHNzAZ.exe
  2⤵
  PID:8940
- C:\Windows\System\rRJyqLy.exe
  C:\Windows\System\rRJyqLy.exe
  2⤵
  PID:8804
- C:\Windows\System\BBXmQvD.exe
  C:\Windows\System\BBXmQvD.exe
  2⤵
  PID:9252
- C:\Windows\System\hTbpvdy.exe
  C:\Windows\System\hTbpvdy.exe
  2⤵
  PID:9280
- C:\Windows\System\vLMYxMs.exe
  C:\Windows\System\vLMYxMs.exe
  2⤵
  PID:9324
- C:\Windows\System\HFnddoJ.exe
  C:\Windows\System\HFnddoJ.exe
  2⤵
  PID:9340
- C:\Windows\System\weVoJPw.exe
  C:\Windows\System\weVoJPw.exe
  2⤵
  PID:9368
- C:\Windows\System\CMCqrvO.exe
  C:\Windows\System\CMCqrvO.exe
  2⤵
  PID:9400
- C:\Windows\System\qqoTtjx.exe
  C:\Windows\System\qqoTtjx.exe
  2⤵
  PID:9416
- C:\Windows\System\vuEGrYv.exe
  C:\Windows\System\vuEGrYv.exe
  2⤵
  PID:9456
- C:\Windows\System\lbupOUA.exe
  C:\Windows\System\lbupOUA.exe
  2⤵
  PID:9496
- C:\Windows\System\FnqlaXl.exe
  C:\Windows\System\FnqlaXl.exe
  2⤵
  PID:9524
- C:\Windows\System\XlfeTJs.exe
  C:\Windows\System\XlfeTJs.exe
  2⤵
  PID:9552
- C:\Windows\System\doRnUrR.exe
  C:\Windows\System\doRnUrR.exe
  2⤵
  PID:9572
- C:\Windows\System\mRDlcon.exe
  C:\Windows\System\mRDlcon.exe
  2⤵
  PID:9596
- C:\Windows\System\TacYBCL.exe
  C:\Windows\System\TacYBCL.exe
  2⤵
  PID:9624
- C:\Windows\System\EGwexXk.exe
  C:\Windows\System\EGwexXk.exe
  2⤵
  PID:9668
- C:\Windows\System\rKjdVoQ.exe
  C:\Windows\System\rKjdVoQ.exe
  2⤵
  PID:9692
- C:\Windows\System\VqbeeSF.exe
  C:\Windows\System\VqbeeSF.exe
  2⤵
  PID:9712
- C:\Windows\System\vkOZsEt.exe
  C:\Windows\System\vkOZsEt.exe
  2⤵
  PID:9728
- C:\Windows\System\pWkSgSG.exe
  C:\Windows\System\pWkSgSG.exe
  2⤵
  PID:9744
- C:\Windows\System\PQemcxw.exe
  C:\Windows\System\PQemcxw.exe
  2⤵
  PID:9808
- C:\Windows\System\HDpHSfZ.exe
  C:\Windows\System\HDpHSfZ.exe
  2⤵
  PID:9836
- C:\Windows\System\kpMwkIj.exe
  C:\Windows\System\kpMwkIj.exe
  2⤵
  PID:9864
- C:\Windows\System\iqtyRQJ.exe
  C:\Windows\System\iqtyRQJ.exe
  2⤵
  PID:9880
- C:\Windows\System\EaDsrJJ.exe
  C:\Windows\System\EaDsrJJ.exe
  2⤵
  PID:9908
- C:\Windows\System\lPxKNRF.exe
  C:\Windows\System\lPxKNRF.exe
  2⤵
  PID:9924
- C:\Windows\System\OaYNnOi.exe
  C:\Windows\System\OaYNnOi.exe
  2⤵
  PID:9944
- C:\Windows\System\FNiaAzW.exe
  C:\Windows\System\FNiaAzW.exe
  2⤵
  PID:9964
- C:\Windows\System\SRyLXpN.exe
  C:\Windows\System\SRyLXpN.exe
  2⤵
  PID:9984
- C:\Windows\System\NGEaUYq.exe
  C:\Windows\System\NGEaUYq.exe
  2⤵
  PID:10000
- C:\Windows\System\XjuIHlB.exe
  C:\Windows\System\XjuIHlB.exe
  2⤵
  PID:10020
- C:\Windows\System\rNFgFEo.exe
  C:\Windows\System\rNFgFEo.exe
  2⤵
  PID:10048
- C:\Windows\System\IamETQS.exe
  C:\Windows\System\IamETQS.exe
  2⤵
  PID:10100
- C:\Windows\System\ltjoljR.exe
  C:\Windows\System\ltjoljR.exe
  2⤵
  PID:10132
- C:\Windows\System\SPUjOug.exe
  C:\Windows\System\SPUjOug.exe
  2⤵
  PID:10224
- C:\Windows\System\bFZbIdI.exe
  C:\Windows\System\bFZbIdI.exe
  2⤵
  PID:8364
- C:\Windows\System\aIkAywN.exe
  C:\Windows\System\aIkAywN.exe
  2⤵
  PID:9304
- C:\Windows\System\ohTzuls.exe
  C:\Windows\System\ohTzuls.exe
  2⤵
  PID:9356
- C:\Windows\System\mTVAzsU.exe
  C:\Windows\System\mTVAzsU.exe
  2⤵
  PID:9408
- C:\Windows\System\ZIAkAUs.exe
  C:\Windows\System\ZIAkAUs.exe
  2⤵
  PID:9484
- C:\Windows\System\ZkmqQrV.exe
  C:\Windows\System\ZkmqQrV.exe
  2⤵
  PID:9540
- C:\Windows\System\aLVazWK.exe
  C:\Windows\System\aLVazWK.exe
  2⤵
  PID:9584
- C:\Windows\System\agjuBhe.exe
  C:\Windows\System\agjuBhe.exe
  2⤵
  PID:9620
- C:\Windows\System\BoOtgTs.exe
  C:\Windows\System\BoOtgTs.exe
  2⤵
  PID:9780
- C:\Windows\System\AUAjGHe.exe
  C:\Windows\System\AUAjGHe.exe
  2⤵
  PID:9844
- C:\Windows\System\IXfPJom.exe
  C:\Windows\System\IXfPJom.exe
  2⤵
  PID:9896
- C:\Windows\System\RnDfUzj.exe
  C:\Windows\System\RnDfUzj.exe
  2⤵
  PID:9952
- C:\Windows\System\AIOtMmg.exe
  C:\Windows\System\AIOtMmg.exe
  2⤵
  PID:10076
- C:\Windows\System\fPVbcjY.exe
  C:\Windows\System\fPVbcjY.exe
  2⤵
  PID:10144
- C:\Windows\System\Ghpgtku.exe
  C:\Windows\System\Ghpgtku.exe
  2⤵
  PID:10220
- C:\Windows\System\KNErrRt.exe
  C:\Windows\System\KNErrRt.exe
  2⤵
  PID:9268
- C:\Windows\System\HzAZAwn.exe
  C:\Windows\System\HzAZAwn.exe
  2⤵
  PID:9440
- C:\Windows\System\uHIjnek.exe
  C:\Windows\System\uHIjnek.exe
  2⤵
  PID:9644
- C:\Windows\System\GXhptZX.exe
  C:\Windows\System\GXhptZX.exe
  2⤵
  PID:9856
- C:\Windows\System\ZsSXcIg.exe
  C:\Windows\System\ZsSXcIg.exe
  2⤵
  PID:9996
- C:\Windows\System\haLgzZQ.exe
  C:\Windows\System\haLgzZQ.exe
  2⤵
  PID:10088
- C:\Windows\System\xsMVmSb.exe
  C:\Windows\System\xsMVmSb.exe
  2⤵
  PID:10260
- C:\Windows\System\UKnXnoD.exe
  C:\Windows\System\UKnXnoD.exe
  2⤵
  PID:10280
- C:\Windows\System\eoLOAuP.exe
  C:\Windows\System\eoLOAuP.exe
  2⤵
  PID:10336
- C:\Windows\System\JZBHmNS.exe
  C:\Windows\System\JZBHmNS.exe
  2⤵
  PID:10368
- C:\Windows\System\lDMjIpW.exe
  C:\Windows\System\lDMjIpW.exe
  2⤵
  PID:10396
- C:\Windows\System\FiMZKxu.exe
  C:\Windows\System\FiMZKxu.exe
  2⤵
  PID:10412
- C:\Windows\System\fSUaCOn.exe
  C:\Windows\System\fSUaCOn.exe
  2⤵
  PID:10448
- C:\Windows\System\xVQgFsW.exe
  C:\Windows\System\xVQgFsW.exe
  2⤵
  PID:10468
- C:\Windows\System\eDqjHdx.exe
  C:\Windows\System\eDqjHdx.exe
  2⤵
  PID:10496
- C:\Windows\System\FzVejLc.exe
  C:\Windows\System\FzVejLc.exe
  2⤵
  PID:10536
- C:\Windows\System\FVNvztU.exe
  C:\Windows\System\FVNvztU.exe
  2⤵
  PID:10556
- C:\Windows\System\UesLPpN.exe
  C:\Windows\System\UesLPpN.exe
  2⤵
  PID:10588
- C:\Windows\System\xUOQAQw.exe
  C:\Windows\System\xUOQAQw.exe
  2⤵
  PID:10620
- C:\Windows\System\dhkwVSU.exe
  C:\Windows\System\dhkwVSU.exe
  2⤵
  PID:10648
- C:\Windows\System\KFsiaCc.exe
  C:\Windows\System\KFsiaCc.exe
  2⤵
  PID:10672
- C:\Windows\System\sbSYeGY.exe
  C:\Windows\System\sbSYeGY.exe
  2⤵
  PID:10712
- C:\Windows\System\wjApecJ.exe
  C:\Windows\System\wjApecJ.exe
  2⤵
  PID:10740
- C:\Windows\System\idJLdqL.exe
  C:\Windows\System\idJLdqL.exe
  2⤵
  PID:10760
- C:\Windows\System\bGLVjTU.exe
  C:\Windows\System\bGLVjTU.exe
  2⤵
  PID:10792
- C:\Windows\System\syxZIyp.exe
  C:\Windows\System\syxZIyp.exe
  2⤵
  PID:10828
- C:\Windows\System\cRRNjIU.exe
  C:\Windows\System\cRRNjIU.exe
  2⤵
  PID:10852
- C:\Windows\System\qUjmCZs.exe
  C:\Windows\System\qUjmCZs.exe
  2⤵
  PID:10876
- C:\Windows\System\snCOpjf.exe
  C:\Windows\System\snCOpjf.exe
  2⤵
  PID:10896
- C:\Windows\System\CDvbKYi.exe
  C:\Windows\System\CDvbKYi.exe
  2⤵
  PID:10916
- C:\Windows\System\LZtFOtj.exe
  C:\Windows\System\LZtFOtj.exe
  2⤵
  PID:10948
- C:\Windows\System\TleEhHZ.exe
  C:\Windows\System\TleEhHZ.exe
  2⤵
  PID:10988
- C:\Windows\System\DSzRnyd.exe
  C:\Windows\System\DSzRnyd.exe
  2⤵
  PID:11020
- C:\Windows\System\ApEKGkG.exe
  C:\Windows\System\ApEKGkG.exe
  2⤵
  PID:11048
- C:\Windows\System\tceLOyh.exe
  C:\Windows\System\tceLOyh.exe
  2⤵
  PID:11096
- C:\Windows\System\naWYPqw.exe
  C:\Windows\System\naWYPqw.exe
  2⤵
  PID:11112
- C:\Windows\System\EBNNyiu.exe
  C:\Windows\System\EBNNyiu.exe
  2⤵
  PID:11140
- C:\Windows\System\JYNmRVF.exe
  C:\Windows\System\JYNmRVF.exe
  2⤵
  PID:11172
- C:\Windows\System\ZZAqgIH.exe
  C:\Windows\System\ZZAqgIH.exe
  2⤵
  PID:11196
- C:\Windows\System\cxXFInW.exe
  C:\Windows\System\cxXFInW.exe
  2⤵
  PID:11228
- C:\Windows\System\PFbmSix.exe
  C:\Windows\System\PFbmSix.exe
  2⤵
  PID:9520
- C:\Windows\System\YrKDdqP.exe
  C:\Windows\System\YrKDdqP.exe
  2⤵
  PID:10324
- C:\Windows\System\efZDRUx.exe
  C:\Windows\System\efZDRUx.exe
  2⤵
  PID:10352
- C:\Windows\System\PUnHzQV.exe
  C:\Windows\System\PUnHzQV.exe
  2⤵
  PID:10408
- C:\Windows\System\kemKJts.exe
  C:\Windows\System\kemKJts.exe
  2⤵
  PID:10528
- C:\Windows\System\bAYlyIQ.exe
  C:\Windows\System\bAYlyIQ.exe
  2⤵
  PID:10604
- C:\Windows\System\FMaDnAW.exe
  C:\Windows\System\FMaDnAW.exe
  2⤵
  PID:10668
- C:\Windows\System\gYRvqsW.exe
  C:\Windows\System\gYRvqsW.exe
  2⤵
  PID:10720
- C:\Windows\System\EEdXRDS.exe
  C:\Windows\System\EEdXRDS.exe
  2⤵
  PID:10780
- C:\Windows\System\dWyqYRw.exe
  C:\Windows\System\dWyqYRw.exe
  2⤵
  PID:10844
- C:\Windows\System\yjscTkH.exe
  C:\Windows\System\yjscTkH.exe
  2⤵
  PID:10928
- C:\Windows\System\hNDbCnt.exe
  C:\Windows\System\hNDbCnt.exe
  2⤵
  PID:11040
- C:\Windows\System\sguSepS.exe
  C:\Windows\System\sguSepS.exe
  2⤵
  PID:11080
- C:\Windows\System\HGidadk.exe
  C:\Windows\System\HGidadk.exe
  2⤵
  PID:11128
- C:\Windows\System\bAyuhbt.exe
  C:\Windows\System\bAyuhbt.exe
  2⤵
  PID:11216
- C:\Windows\System\pkNFgHj.exe
  C:\Windows\System\pkNFgHj.exe
  2⤵
  PID:10356
- C:\Windows\System\PVFuIPO.exe
  C:\Windows\System\PVFuIPO.exe
  2⤵
  PID:10480
- C:\Windows\System\EZMjodp.exe
  C:\Windows\System\EZMjodp.exe
  2⤵
  PID:10636
- C:\Windows\System\zvYIupi.exe
  C:\Windows\System\zvYIupi.exe
  2⤵
  PID:10748
- C:\Windows\System\OJspdWS.exe
  C:\Windows\System\OJspdWS.exe
  2⤵
  PID:10932
- C:\Windows\System\Uajmyfs.exe
  C:\Windows\System\Uajmyfs.exe
  2⤵
  PID:11156
- C:\Windows\System\kPHMPrt.exe
  C:\Windows\System\kPHMPrt.exe
  2⤵
  PID:10428
- C:\Windows\System\POKJqda.exe
  C:\Windows\System\POKJqda.exe
  2⤵
  PID:10656
- C:\Windows\System\rpjhYfS.exe
  C:\Windows\System\rpjhYfS.exe
  2⤵
  PID:11036
- C:\Windows\System\PbiRkLE.exe
  C:\Windows\System\PbiRkLE.exe
  2⤵
  PID:10568
- C:\Windows\System\mQhlIxJ.exe
  C:\Windows\System\mQhlIxJ.exe
  2⤵
  PID:11272
- C:\Windows\System\dGrJTkD.exe
  C:\Windows\System\dGrJTkD.exe
  2⤵
  PID:11300
- C:\Windows\System\xnWqujz.exe
  C:\Windows\System\xnWqujz.exe
  2⤵
  PID:11316
- C:\Windows\System\AIBeaQL.exe
  C:\Windows\System\AIBeaQL.exe
  2⤵
  PID:11352
- C:\Windows\System\XGUQgdG.exe
  C:\Windows\System\XGUQgdG.exe
  2⤵
  PID:11380
- C:\Windows\System\KtOEsUo.exe
  C:\Windows\System\KtOEsUo.exe
  2⤵
  PID:11408
- C:\Windows\System\gneYQWy.exe
  C:\Windows\System\gneYQWy.exe
  2⤵
  PID:11428
- C:\Windows\System\SkizYZS.exe
  C:\Windows\System\SkizYZS.exe
  2⤵
  PID:11456
- C:\Windows\System\yLjjvhz.exe
  C:\Windows\System\yLjjvhz.exe
  2⤵
  PID:11484
- C:\Windows\System\wPnwXyv.exe
  C:\Windows\System\wPnwXyv.exe
  2⤵
  PID:11512
- C:\Windows\System\lzZEexN.exe
  C:\Windows\System\lzZEexN.exe
  2⤵
  PID:11540
- C:\Windows\System\wHldtNF.exe
  C:\Windows\System\wHldtNF.exe
  2⤵
  PID:11576
- C:\Windows\System\nrtrwIp.exe
  C:\Windows\System\nrtrwIp.exe
  2⤵
  PID:11596
- C:\Windows\System\lCWlLjl.exe
  C:\Windows\System\lCWlLjl.exe
  2⤵
  PID:11624
- C:\Windows\System\KWOPwBN.exe
  C:\Windows\System\KWOPwBN.exe
  2⤵
  PID:11656
- C:\Windows\System\sxjxZeR.exe
  C:\Windows\System\sxjxZeR.exe
  2⤵
  PID:11692
- C:\Windows\System\imiaIpr.exe
  C:\Windows\System\imiaIpr.exe
  2⤵
  PID:11712
- C:\Windows\System\WyQuwBm.exe
  C:\Windows\System\WyQuwBm.exe
  2⤵
  PID:11736
- C:\Windows\System\tukcmNW.exe
  C:\Windows\System\tukcmNW.exe
  2⤵
  PID:11756
- C:\Windows\System\IGgQFsm.exe
  C:\Windows\System\IGgQFsm.exe
  2⤵
  PID:11784
- C:\Windows\System\VOcNEKN.exe
  C:\Windows\System\VOcNEKN.exe
  2⤵
  PID:11832
- C:\Windows\System\jRFpAvo.exe
  C:\Windows\System\jRFpAvo.exe
  2⤵
  PID:11848
- C:\Windows\System\ZrOuXay.exe
  C:\Windows\System\ZrOuXay.exe
  2⤵
  PID:11876
- C:\Windows\System\YItBKkV.exe
  C:\Windows\System\YItBKkV.exe
  2⤵
  PID:11904
- C:\Windows\System\GTyRYZD.exe
  C:\Windows\System\GTyRYZD.exe
  2⤵
  PID:11944
- C:\Windows\System\pdFmDAg.exe
  C:\Windows\System\pdFmDAg.exe
  2⤵
  PID:11960
- C:\Windows\System\BSuepbf.exe
  C:\Windows\System\BSuepbf.exe
  2⤵
  PID:12000
- C:\Windows\System\DEeahfb.exe
  C:\Windows\System\DEeahfb.exe
  2⤵
  PID:12024
- C:\Windows\System\TaPADla.exe
  C:\Windows\System\TaPADla.exe
  2⤵
  PID:12056
- C:\Windows\System\xFJJTMt.exe
  C:\Windows\System\xFJJTMt.exe
  2⤵
  PID:12084
- C:\Windows\System\LVnrLUp.exe
  C:\Windows\System\LVnrLUp.exe
  2⤵
  PID:12108
- C:\Windows\System\CDLJzUm.exe
  C:\Windows\System\CDLJzUm.exe
  2⤵
  PID:12140
- C:\Windows\System\zkCjOUO.exe
  C:\Windows\System\zkCjOUO.exe
  2⤵
  PID:12168
- C:\Windows\System\SGOfgAL.exe
  C:\Windows\System\SGOfgAL.exe
  2⤵
  PID:12184
- C:\Windows\System\ezqwKWp.exe
  C:\Windows\System\ezqwKWp.exe
  2⤵
  PID:12228
- C:\Windows\System\KdLzXEZ.exe
  C:\Windows\System\KdLzXEZ.exe
  2⤵
  PID:12248
- C:\Windows\System\XCaiDnk.exe
  C:\Windows\System\XCaiDnk.exe
  2⤵
  PID:11268
- C:\Windows\System\jFvKExy.exe
  C:\Windows\System\jFvKExy.exe
  2⤵
  PID:11328
- C:\Windows\System\gskWmZz.exe
  C:\Windows\System\gskWmZz.exe
  2⤵
  PID:11404
- C:\Windows\System\fqVTSHq.exe
  C:\Windows\System\fqVTSHq.exe
  2⤵
  PID:11468
- C:\Windows\System\spfeSXj.exe
  C:\Windows\System\spfeSXj.exe
  2⤵
  PID:11532
- C:\Windows\System\ZVVLxXs.exe
  C:\Windows\System\ZVVLxXs.exe
  2⤵
  PID:11612
- C:\Windows\System\XkLkmpu.exe
  C:\Windows\System\XkLkmpu.exe
  2⤵
  PID:11648
- C:\Windows\System\mBIauwI.exe
  C:\Windows\System\mBIauwI.exe
  2⤵
  PID:11728
- C:\Windows\System\hyDCgda.exe
  C:\Windows\System\hyDCgda.exe
  2⤵
  PID:11796
- C:\Windows\System\bDZRTOh.exe
  C:\Windows\System\bDZRTOh.exe
  2⤵
  PID:11888
- C:\Windows\System\UTMTbcT.exe
  C:\Windows\System\UTMTbcT.exe
  2⤵
  PID:11924
- C:\Windows\System\AUpTlce.exe
  C:\Windows\System\AUpTlce.exe
  2⤵
  PID:11976
- C:\Windows\System\YEdraoc.exe
  C:\Windows\System\YEdraoc.exe
  2⤵
  PID:12076
- C:\Windows\System\RoFpSxM.exe
  C:\Windows\System\RoFpSxM.exe
  2⤵
  PID:12136
- C:\Windows\System\JAfXglD.exe
  C:\Windows\System\JAfXglD.exe
  2⤵
  PID:12176
- C:\Windows\System\YRhbQwA.exe
  C:\Windows\System\YRhbQwA.exe
  2⤵
  PID:12244
- C:\Windows\System\LvYegbP.exe
  C:\Windows\System\LvYegbP.exe
  2⤵
  PID:11308
- C:\Windows\System\OclfkhC.exe
  C:\Windows\System\OclfkhC.exe
  2⤵
  PID:11472
- C:\Windows\System\EszRjrg.exe
  C:\Windows\System\EszRjrg.exe
  2⤵
  PID:11668
- C:\Windows\System\MEzKLeB.exe
  C:\Windows\System\MEzKLeB.exe
  2⤵
  PID:11844
- C:\Windows\System\MCkqDur.exe
  C:\Windows\System\MCkqDur.exe
  2⤵
  PID:11860
- C:\Windows\System\kwkBPpE.exe
  C:\Windows\System\kwkBPpE.exe
  2⤵
  PID:12120
- C:\Windows\System\GCxEukQ.exe
  C:\Windows\System\GCxEukQ.exe
  2⤵
  PID:12224
- C:\Windows\System\XRQvyHK.exe
  C:\Windows\System\XRQvyHK.exe
  2⤵
  PID:11556
- C:\Windows\System\ratbPtg.exe
  C:\Windows\System\ratbPtg.exe
  2⤵
  PID:11752
- C:\Windows\System\TGmdOdp.exe
  C:\Windows\System\TGmdOdp.exe
  2⤵
  PID:12072
- C:\Windows\System\VNffFNe.exe
  C:\Windows\System\VNffFNe.exe
  2⤵
  PID:12040
- C:\Windows\System\vjZbuVI.exe
  C:\Windows\System\vjZbuVI.exe
  2⤵
  PID:12296
- C:\Windows\System\aGrbGNz.exe
  C:\Windows\System\aGrbGNz.exe
  2⤵
  PID:12324
- C:\Windows\System\YUBHxSZ.exe
  C:\Windows\System\YUBHxSZ.exe
  2⤵
  PID:12352
- C:\Windows\System\YKuHJNa.exe
  C:\Windows\System\YKuHJNa.exe
  2⤵
  PID:12368
- C:\Windows\System\QFPTvne.exe
  C:\Windows\System\QFPTvne.exe
  2⤵
  PID:12404
- C:\Windows\System\QcJYylB.exe
  C:\Windows\System\QcJYylB.exe
  2⤵
  PID:12428
- C:\Windows\System\QobAylt.exe
  C:\Windows\System\QobAylt.exe
  2⤵
  PID:12452
- C:\Windows\System\AMUFzXB.exe
  C:\Windows\System\AMUFzXB.exe
  2⤵
  PID:12476
- C:\Windows\System\uHtsdUJ.exe
  C:\Windows\System\uHtsdUJ.exe
  2⤵
  PID:12520
- C:\Windows\System\hewRXPM.exe
  C:\Windows\System\hewRXPM.exe
  2⤵
  PID:12548
- C:\Windows\System\LaCbfTH.exe
  C:\Windows\System\LaCbfTH.exe
  2⤵
  PID:12568
- C:\Windows\System\Pnnuwzd.exe
  C:\Windows\System\Pnnuwzd.exe
  2⤵
  PID:12592
- C:\Windows\System\XQQJQfr.exe
  C:\Windows\System\XQQJQfr.exe
  2⤵
  PID:12620
- C:\Windows\System\bcXiFNT.exe
  C:\Windows\System\bcXiFNT.exe
  2⤵
  PID:12660
- C:\Windows\System\ShAJezc.exe
  C:\Windows\System\ShAJezc.exe
  2⤵
  PID:12676
- C:\Windows\System\dRUydaW.exe
  C:\Windows\System\dRUydaW.exe
  2⤵
  PID:12716
- C:\Windows\System\uIOfYcA.exe
  C:\Windows\System\uIOfYcA.exe
  2⤵
  PID:12744
- C:\Windows\System\uSDwMjd.exe
  C:\Windows\System\uSDwMjd.exe
  2⤵
  PID:12772
- C:\Windows\System\mWukmmK.exe
  C:\Windows\System\mWukmmK.exe
  2⤵
  PID:12800
- C:\Windows\System\IbDXgVK.exe
  C:\Windows\System\IbDXgVK.exe
  2⤵
  PID:12828
- C:\Windows\System\SMCbqMk.exe
  C:\Windows\System\SMCbqMk.exe
  2⤵
  PID:12856
- C:\Windows\System\JcmJnax.exe
  C:\Windows\System\JcmJnax.exe
  2⤵
  PID:12872
- C:\Windows\System\ToBzBxH.exe
  C:\Windows\System\ToBzBxH.exe
  2⤵
  PID:12912
- C:\Windows\System\dfZncxh.exe
  C:\Windows\System\dfZncxh.exe
  2⤵
  PID:12928
- C:\Windows\System\opTJOlN.exe
  C:\Windows\System\opTJOlN.exe
  2⤵
  PID:12976
- C:\Windows\System\gZNHGkp.exe
  C:\Windows\System\gZNHGkp.exe
  2⤵
  PID:13004
- C:\Windows\System\vHBrQqP.exe
  C:\Windows\System\vHBrQqP.exe
  2⤵
  PID:13032
- C:\Windows\System\XSxqtts.exe
  C:\Windows\System\XSxqtts.exe
  2⤵
  PID:13060
- C:\Windows\System\XytorqH.exe
  C:\Windows\System\XytorqH.exe
  2⤵
  PID:13080
- C:\Windows\System\LUitCzr.exe
  C:\Windows\System\LUitCzr.exe
  2⤵
  PID:13112
- C:\Windows\System\IOwYLdM.exe
  C:\Windows\System\IOwYLdM.exe
  2⤵
  PID:13132
- C:\Windows\System\kJXgcmy.exe
  C:\Windows\System\kJXgcmy.exe
  2⤵
  PID:13156
- C:\Windows\System\QngNYSK.exe
  C:\Windows\System\QngNYSK.exe
  2⤵
  PID:13180
- C:\Windows\System\YAKeeLu.exe
  C:\Windows\System\YAKeeLu.exe
  2⤵
  PID:13204
- C:\Windows\System\mzvPkmM.exe
  C:\Windows\System\mzvPkmM.exe
  2⤵
  PID:13256
- C:\Windows\System\ETPhlKl.exe
  C:\Windows\System\ETPhlKl.exe
  2⤵
  PID:13272
- C:\Windows\System\BGMvgoE.exe
  C:\Windows\System\BGMvgoE.exe
  2⤵
  PID:13300
- C:\Windows\System\HVThVqh.exe
  C:\Windows\System\HVThVqh.exe
  2⤵
  PID:12312
- C:\Windows\System\WuBHbpx.exe
  C:\Windows\System\WuBHbpx.exe
  2⤵
  PID:12392
- C:\Windows\System\VXKpvNM.exe
  C:\Windows\System\VXKpvNM.exe
  2⤵
  PID:12468
- C:\Windows\System\iOMQQoJ.exe
  C:\Windows\System\iOMQQoJ.exe
  2⤵
  PID:12532
- C:\Windows\System\VsyaRnI.exe
  C:\Windows\System\VsyaRnI.exe
  2⤵
  PID:12644
- C:\Windows\System\SBgnpyk.exe
  C:\Windows\System\SBgnpyk.exe
  2⤵
  PID:12656
- C:\Windows\System\bPGwary.exe
  C:\Windows\System\bPGwary.exe
  2⤵
  PID:12756
- C:\Windows\System\qdkzORw.exe
  C:\Windows\System\qdkzORw.exe
  2⤵
  PID:12820
- C:\Windows\System\DKvvfin.exe
  C:\Windows\System\DKvvfin.exe
  2⤵
  PID:12868
- C:\Windows\System\CHSLJox.exe
  C:\Windows\System\CHSLJox.exe
  2⤵
  PID:12920
- C:\Windows\System\hiakDDV.exe
  C:\Windows\System\hiakDDV.exe
  2⤵
  PID:11772
- C:\Windows\System\QSaOGes.exe
  C:\Windows\System\QSaOGes.exe
  2⤵
  PID:13076
- C:\Windows\System\wyDtgNc.exe
  C:\Windows\System\wyDtgNc.exe
  2⤵
  PID:13128
- C:\Windows\System\PgNIKHn.exe
  C:\Windows\System\PgNIKHn.exe
  2⤵
  PID:13176
- C:\Windows\System\oSyemvg.exe
  C:\Windows\System\oSyemvg.exe
  2⤵
  PID:13228
- C:\Windows\System\SvaVhli.exe
  C:\Windows\System\SvaVhli.exe
  2⤵
  PID:12360
- C:\Windows\System\DyOGQKX.exe
  C:\Windows\System\DyOGQKX.exe
  2⤵
  PID:12496
- C:\Windows\System\OVumzSf.exe
  C:\Windows\System\OVumzSf.exe
  2⤵
  PID:12616
- C:\Windows\System\cGLziOp.exe
  C:\Windows\System\cGLziOp.exe
  2⤵
  PID:12740
- C:\Windows\System\EyVCQGJ.exe
  C:\Windows\System\EyVCQGJ.exe
  2⤵
  PID:12992
- C:\Windows\System\KoOedGt.exe
  C:\Windows\System\KoOedGt.exe
  2⤵
  PID:13096
- C:\Windows\System\pXkmxQo.exe
  C:\Windows\System\pXkmxQo.exe
  2⤵
  PID:13200
- C:\Windows\System\qurCBDc.exe
  C:\Windows\System\qurCBDc.exe
  2⤵
  PID:13308
- C:\Windows\System\kxopKQI.exe
  C:\Windows\System\kxopKQI.exe
  2⤵
  PID:12896
- C:\Windows\System\kredEMF.exe
  C:\Windows\System\kredEMF.exe
  2⤵
  PID:13284
- C:\Windows\System\tjzmmks.exe
  C:\Windows\System\tjzmmks.exe
  2⤵
  PID:12608
- C:\Windows\System\IGRviRb.exe
  C:\Windows\System\IGRviRb.exe
  2⤵
  PID:13316
- C:\Windows\System\rikQOsL.exe
  C:\Windows\System\rikQOsL.exe
  2⤵
  PID:13340
- C:\Windows\System\cwInrvZ.exe
  C:\Windows\System\cwInrvZ.exe
  2⤵
  PID:13380
- C:\Windows\System\Scktvsw.exe
  C:\Windows\System\Scktvsw.exe
  2⤵
  PID:13408
- C:\Windows\System\aTrzlLG.exe
  C:\Windows\System\aTrzlLG.exe
  2⤵
  PID:13432
- C:\Windows\System\dqLenEd.exe
  C:\Windows\System\dqLenEd.exe
  2⤵
  PID:13460
- C:\Windows\System\VpynhyP.exe
  C:\Windows\System\VpynhyP.exe
  2⤵
  PID:13480
- C:\Windows\System\ALJWvJa.exe
  C:\Windows\System\ALJWvJa.exe
  2⤵
  PID:13500
- C:\Windows\System\qVHpVGw.exe
  C:\Windows\System\qVHpVGw.exe
  2⤵
  PID:13536
- C:\Windows\System\Bokgrcd.exe
  C:\Windows\System\Bokgrcd.exe
  2⤵
  PID:13564
- C:\Windows\System\ptaImxd.exe
  C:\Windows\System\ptaImxd.exe
  2⤵
  PID:13604
- C:\Windows\System\MXiPQxU.exe
  C:\Windows\System\MXiPQxU.exe
  2⤵
  PID:13628
- C:\Windows\System\wlMgrFg.exe
  C:\Windows\System\wlMgrFg.exe
  2⤵
  PID:13660
- C:\Windows\System\HGZvhsx.exe
  C:\Windows\System\HGZvhsx.exe
  2⤵
  PID:13688
- C:\Windows\System\rIEovnO.exe
  C:\Windows\System\rIEovnO.exe
  2⤵
  PID:13716
- C:\Windows\System\ohovcFE.exe
  C:\Windows\System\ohovcFE.exe
  2⤵
  PID:13732
- C:\Windows\System\otFukqf.exe
  C:\Windows\System\otFukqf.exe
  2⤵
  PID:13772
- C:\Windows\System\DahwTeO.exe
  C:\Windows\System\DahwTeO.exe
  2⤵
  PID:13792
- C:\Windows\System\yClHPwA.exe
  C:\Windows\System\yClHPwA.exe
  2⤵
  PID:13820
- C:\Windows\System\uRdGMMI.exe
  C:\Windows\System\uRdGMMI.exe
  2⤵
  PID:13848
- C:\Windows\System\bVHbjyc.exe
  C:\Windows\System\bVHbjyc.exe
  2⤵
  PID:13872
- C:\Windows\System\COqsbLb.exe
  C:\Windows\System\COqsbLb.exe
  2⤵
  PID:13900
- C:\Windows\System\tBoxcze.exe
  C:\Windows\System\tBoxcze.exe
  2⤵
  PID:13940
- C:\Windows\System\XDzrytS.exe
  C:\Windows\System\XDzrytS.exe
  2⤵
  PID:13964
- C:\Windows\System\GueqszM.exe
  C:\Windows\System\GueqszM.exe
  2⤵
  PID:13980
- C:\Windows\System\AsNFAjH.exe
  C:\Windows\System\AsNFAjH.exe
  2⤵
  PID:14028
- C:\Windows\System\sUWTocb.exe
  C:\Windows\System\sUWTocb.exe
  2⤵
  PID:14056
- C:\Windows\System\bUejbAt.exe
  C:\Windows\System\bUejbAt.exe
  2⤵
  PID:14084
- C:\Windows\System\ghhOCYP.exe
  C:\Windows\System\ghhOCYP.exe
  2⤵
  PID:14112
- C:\Windows\System\coWHITD.exe
  C:\Windows\System\coWHITD.exe
  2⤵
  PID:14128
- C:\Windows\System\nUlReuL.exe
  C:\Windows\System\nUlReuL.exe
  2⤵
  PID:14156
- C:\Windows\System\kDkQiKf.exe
  C:\Windows\System\kDkQiKf.exe
  2⤵
  PID:14172
- C:\Windows\System\puwHcom.exe
  C:\Windows\System\puwHcom.exe
  2⤵
  PID:14204
- C:\Windows\System\ZBxAalo.exe
  C:\Windows\System\ZBxAalo.exe
  2⤵
  PID:14244
- C:\Windows\System\exsSNAW.exe
  C:\Windows\System\exsSNAW.exe
  2⤵
  PID:14288
- C:\Windows\System\yrcyhZG.exe
  C:\Windows\System\yrcyhZG.exe
  2⤵
  PID:14312
- C:\Windows\System\RVMNJDi.exe
  C:\Windows\System\RVMNJDi.exe
  2⤵
  PID:14332
- C:\Windows\System\ZgbgbLz.exe
  C:\Windows\System\ZgbgbLz.exe
  2⤵
  PID:13368
- C:\Windows\System\rQtQllU.exe
  C:\Windows\System\rQtQllU.exe
  2⤵
  PID:13452
- C:\Windows\System\CTAOZgQ.exe
  C:\Windows\System\CTAOZgQ.exe
  2⤵
  PID:13476
- C:\Windows\System\fbfNzPF.exe
  C:\Windows\System\fbfNzPF.exe
  2⤵
  PID:13556
- C:\Windows\System\NhHMeGX.exe
  C:\Windows\System\NhHMeGX.exe
  2⤵
  PID:13620
- C:\Windows\System\vwUwIVN.exe
  C:\Windows\System\vwUwIVN.exe
  2⤵
  PID:13704
- C:\Windows\System\XUnOfXT.exe
  C:\Windows\System\XUnOfXT.exe
  2⤵
  PID:13752
- C:\Windows\System\uhCfPxH.exe
  C:\Windows\System\uhCfPxH.exe
  2⤵
  PID:13812
- C:\Windows\System\OxDexFA.exe
  C:\Windows\System\OxDexFA.exe
  2⤵
  PID:13884
- C:\Windows\System\hRmrPoZ.exe
  C:\Windows\System\hRmrPoZ.exe
  2⤵
  PID:13948
- C:\Windows\System\rnpwXXp.exe
  C:\Windows\System\rnpwXXp.exe
  2⤵
  PID:14024
- C:\Windows\System\zHCbvUa.exe
  C:\Windows\System\zHCbvUa.exe
  2⤵
  PID:14096
- C:\Windows\System\bnXZEEg.exe
  C:\Windows\System\bnXZEEg.exe
  2⤵
  PID:14140
- C:\Windows\System\VBeBtNo.exe
  C:\Windows\System\VBeBtNo.exe
  2⤵
  PID:14240
- C:\Windows\System\YOWQHBJ.exe
  C:\Windows\System\YOWQHBJ.exe
  2⤵
  PID:14296
- C:\Windows\System\CGmpaCg.exe
  C:\Windows\System\CGmpaCg.exe
  2⤵
  PID:13336
- C:\Windows\System\QOulFCx.exe
  C:\Windows\System\QOulFCx.exe
  2⤵
  PID:13468
- C:\Windows\System\OQUKhZG.exe
  C:\Windows\System\OQUKhZG.exe
  2⤵
  PID:3848
- C:\Windows\System\natPZRs.exe
  C:\Windows\System\natPZRs.exe
  2⤵
  PID:13728
- C:\Windows\System\uUmPEbG.exe
  C:\Windows\System\uUmPEbG.exe
  2⤵
  PID:13916
- C:\Windows\System\HqDlayc.exe
  C:\Windows\System\HqDlayc.exe
  2⤵
  PID:14052
- C:\Windows\System\kbWhXoL.exe
  C:\Windows\System\kbWhXoL.exe
  2⤵
  PID:14196
- C:\Windows\System\QOdGUxK.exe
  C:\Windows\System\QOdGUxK.exe
  2⤵
  PID:13352
- C:\Windows\System\RAEHUCC.exe
  C:\Windows\System\RAEHUCC.exe
  2⤵
  PID:13888
- C:\Windows\System\tOimtBu.exe
  C:\Windows\System\tOimtBu.exe
  2⤵
  PID:14144
- C:\Windows\System\RPUrnLY.exe
  C:\Windows\System\RPUrnLY.exe
  2⤵
  PID:13724
- C:\Windows\System\PMjtQye.exe
  C:\Windows\System\PMjtQye.exe
  2⤵
  PID:13684
- C:\Windows\System\gzOkqbb.exe
  C:\Windows\System\gzOkqbb.exe
  2⤵
  PID:14360
- C:\Windows\System\tUftbnc.exe
  C:\Windows\System\tUftbnc.exe
  2⤵
  PID:14396
- C:\Windows\System\SrzUscj.exe
  C:\Windows\System\SrzUscj.exe
  2⤵
  PID:14424
- C:\Windows\System\zbWyaAq.exe
  C:\Windows\System\zbWyaAq.exe
  2⤵
  PID:14452
- C:\Windows\System\TTkfyCd.exe
  C:\Windows\System\TTkfyCd.exe
  2⤵
  PID:14484
- C:\Windows\System\gAsWioN.exe
  C:\Windows\System\gAsWioN.exe
  2⤵
  PID:14512
- C:\Windows\System\gRDVxDv.exe
  C:\Windows\System\gRDVxDv.exe
  2⤵
  PID:14528
- C:\Windows\System\IXWaCvj.exe
  C:\Windows\System\IXWaCvj.exe
  2⤵
  PID:14556
- C:\Windows\System\hnROfAz.exe
  C:\Windows\System\hnROfAz.exe
  2⤵
  PID:14596
- C:\Windows\System\iJXZqon.exe
  C:\Windows\System\iJXZqon.exe
  2⤵
  PID:14624
- C:\Windows\System\qhbwwEm.exe
  C:\Windows\System\qhbwwEm.exe
  2⤵
  PID:14652
- C:\Windows\System\QjpyXzE.exe
  C:\Windows\System\QjpyXzE.exe
  2⤵
  PID:14668
- C:\Windows\System\JWmirXU.exe
  C:\Windows\System\JWmirXU.exe
  2⤵
  PID:14708
- C:\Windows\System\UtJbqfH.exe
  C:\Windows\System\UtJbqfH.exe
  2⤵
  PID:14736
- C:\Windows\System\ZCOWxBs.exe
  C:\Windows\System\ZCOWxBs.exe
  2⤵
  PID:14756
- C:\Windows\System\bNSSySc.exe
  C:\Windows\System\bNSSySc.exe
  2⤵
  PID:14780
- C:\Windows\System\tukkfwp.exe
  C:\Windows\System\tukkfwp.exe
  2⤵
  PID:14796
- C:\Windows\System\EOwdAJJ.exe
  C:\Windows\System\EOwdAJJ.exe
  2⤵
  PID:14820
- C:\Windows\System\wYuQtnG.exe
  C:\Windows\System\wYuQtnG.exe
  2⤵
  PID:14856
- C:\Windows\System\RqUjYCt.exe
  C:\Windows\System\RqUjYCt.exe
  2⤵
  PID:14892
- C:\Windows\System\RfTVjkM.exe
  C:\Windows\System\RfTVjkM.exe
  2⤵
  PID:14920
- C:\Windows\System\bGYrzRt.exe
  C:\Windows\System\bGYrzRt.exe
  2⤵
  PID:14960
- C:\Windows\System\zECZRli.exe
  C:\Windows\System\zECZRli.exe
  2⤵
  PID:14988
- C:\Windows\System\RzbkRIR.exe
  C:\Windows\System\RzbkRIR.exe
  2⤵
  PID:15004
- C:\Windows\System\Ijaqwgv.exe
  C:\Windows\System\Ijaqwgv.exe
  2⤵
  PID:15020
- C:\Windows\System\SCjIOiK.exe
  C:\Windows\System\SCjIOiK.exe
  2⤵
  PID:15052
- C:\Windows\System\uzpoxgZ.exe
  C:\Windows\System\uzpoxgZ.exe
  2⤵
  PID:15084
- C:\Windows\System\GAufTHg.exe
  C:\Windows\System\GAufTHg.exe
  2⤵
  PID:15128
- C:\Windows\System\sLFasAc.exe
  C:\Windows\System\sLFasAc.exe
  2⤵
  PID:15156
- C:\Windows\System\jHwAZnP.exe
  C:\Windows\System\jHwAZnP.exe
  2⤵
  PID:15172
- C:\Windows\System\NTxtriO.exe
  C:\Windows\System\NTxtriO.exe
  2⤵
  PID:15192
- C:\Windows\System\ScDaAgC.exe
  C:\Windows\System\ScDaAgC.exe
  2⤵
  PID:15228
- C:\Windows\System\wcbPUIy.exe
  C:\Windows\System\wcbPUIy.exe
  2⤵
  PID:15244
- C:\Windows\System\dWaPtNv.exe
  C:\Windows\System\dWaPtNv.exe
  2⤵
  PID:15288
- C:\Windows\System\dHQkfQn.exe
  C:\Windows\System\dHQkfQn.exe
  2⤵
  PID:15304
- C:\Windows\System\MFImXYT.exe
  C:\Windows\System\MFImXYT.exe
  2⤵
  PID:15340
- C:\Windows\System\CrlcDhC.exe
  C:\Windows\System\CrlcDhC.exe
  2⤵
  PID:14272
- C:\Windows\System\masbSMT.exe
  C:\Windows\System\masbSMT.exe
  2⤵
  PID:14432
- C:\Windows\System\nNebWdh.exe
  C:\Windows\System\nNebWdh.exe
  2⤵
  PID:14472
- C:\Windows\System\vxKPLSP.exe
  C:\Windows\System\vxKPLSP.exe
  2⤵
  PID:14544
- C:\Windows\System\mbKHiMO.exe
  C:\Windows\System\mbKHiMO.exe
  2⤵
  PID:14580
- C:\Windows\System\SPTomJm.exe
  C:\Windows\System\SPTomJm.exe
  2⤵
  PID:14640
- C:\Windows\System\LYfciKi.exe
  C:\Windows\System\LYfciKi.exe
  2⤵
  PID:14732
- C:\Windows\System\rpTVabM.exe
  C:\Windows\System\rpTVabM.exe
  2⤵
  PID:14808
- C:\Windows\System\EpxLmYD.exe
  C:\Windows\System\EpxLmYD.exe
  2⤵
  PID:14848
- C:\Windows\System\ESnqgDE.exe
  C:\Windows\System\ESnqgDE.exe
  2⤵
  PID:14916
- C:\Windows\System\VLWexni.exe
  C:\Windows\System\VLWexni.exe
  2⤵
  PID:14284
- C:\Windows\System\EYOqgyt.exe
  C:\Windows\System\EYOqgyt.exe
  2⤵
  PID:15036
- C:\Windows\System\GrbwJjc.exe
  C:\Windows\System\GrbwJjc.exe
  2⤵
  PID:15144
- C:\Windows\System\hKcgAnP.exe
  C:\Windows\System\hKcgAnP.exe
  2⤵
  PID:15200
- C:\Windows\System\HpQjxMg.exe
  C:\Windows\System\HpQjxMg.exe
  2⤵
  PID:15236
- C:\Windows\System\QXbLODY.exe
  C:\Windows\System\QXbLODY.exe
  2⤵
  PID:15276
- C:\Windows\System\HRaYzeF.exe
  C:\Windows\System\HRaYzeF.exe
  2⤵
  PID:15316
- C:\Windows\System\rVHOtFr.exe
  C:\Windows\System\rVHOtFr.exe
  2⤵
  PID:14460
- C:\Windows\System\IRTZcpi.exe
  C:\Windows\System\IRTZcpi.exe
  2⤵
  PID:14772
- C:\Windows\System\KgKRufy.exe
  C:\Windows\System\KgKRufy.exe
  2⤵
  PID:14940
- C:\Windows\System\AfmsBaQ.exe
  C:\Windows\System\AfmsBaQ.exe
  2⤵
  PID:15000
- C:\Windows\System\ldtwdjp.exe
  C:\Windows\System\ldtwdjp.exe
  2⤵
  PID:15164
- C:\Windows\System\YbYtnNZ.exe
  C:\Windows\System\YbYtnNZ.exe
  2⤵
  PID:3156
- C:\Windows\System\jLKiQeu.exe
  C:\Windows\System\jLKiQeu.exe
  2⤵
  PID:14504
- C:\Windows\System\ypWBRaa.exe
  C:\Windows\System\ypWBRaa.exe
  2⤵
  PID:14720
- C:\Windows\System\IDWHPgU.exe
  C:\Windows\System\IDWHPgU.exe
  2⤵
  PID:14972
- C:\Windows\System\tdFxazR.exe
  C:\Windows\System\tdFxazR.exe
  2⤵
  PID:14392
- C:\Windows\System\HaMmWmp.exe
  C:\Windows\System\HaMmWmp.exe
  2⤵
  PID:14948
- C:\Windows\System\KxEDZFI.exe
  C:\Windows\System\KxEDZFI.exe
  2⤵
  PID:15400
- C:\Windows\System\jcuWssL.exe
  C:\Windows\System\jcuWssL.exe
  2⤵
  PID:15416
- C:\Windows\System\ezVvEHt.exe
  C:\Windows\System\ezVvEHt.exe
  2⤵
  PID:15444
- C:\Windows\System\vQNXzPu.exe
  C:\Windows\System\vQNXzPu.exe
  2⤵
  PID:15472
- C:\Windows\System\bZBKcem.exe
  C:\Windows\System\bZBKcem.exe
  2⤵
  PID:15500
- C:\Windows\System\YusPsTs.exe
  C:\Windows\System\YusPsTs.exe
  2⤵
  PID:15528
- C:\Windows\System\zTdMTNi.exe
  C:\Windows\System\zTdMTNi.exe
  2⤵
  PID:15556
- C:\Windows\System\qjUQJgJ.exe
  C:\Windows\System\qjUQJgJ.exe
  2⤵
  PID:15584
- C:\Windows\System\RetMMEz.exe
  C:\Windows\System\RetMMEz.exe
  2⤵
  PID:15604
- C:\Windows\System\bXiEmNP.exe
  C:\Windows\System\bXiEmNP.exe
  2⤵
  PID:15640
- C:\Windows\System\HGtjNvv.exe
  C:\Windows\System\HGtjNvv.exe
  2⤵
  PID:15668
- C:\Windows\System\oqxteXe.exe
  C:\Windows\System\oqxteXe.exe
  2⤵
  PID:15696
- C:\Windows\System\kqUjgrH.exe
  C:\Windows\System\kqUjgrH.exe
  2⤵
  PID:15724
- C:\Windows\System\KcaQyBx.exe
  C:\Windows\System\KcaQyBx.exe
  2⤵
  PID:15740
- C:\Windows\System\nvDMFQv.exe
  C:\Windows\System\nvDMFQv.exe
  2⤵
  PID:15780
- C:\Windows\System\jOeTKuI.exe
  C:\Windows\System\jOeTKuI.exe
  2⤵
  PID:15796
- C:\Windows\System\TDpDBty.exe
  C:\Windows\System\TDpDBty.exe
  2⤵
  PID:15824
- C:\Windows\System\fBfJaMO.exe
  C:\Windows\System\fBfJaMO.exe
  2⤵
  PID:15860
- C:\Windows\System\byZCHxA.exe
  C:\Windows\System\byZCHxA.exe
  2⤵
  PID:15896
- C:\Windows\System\GXbQJZv.exe
  C:\Windows\System\GXbQJZv.exe
  2⤵
  PID:15920
- C:\Windows\System\NHzkJmC.exe
  C:\Windows\System\NHzkJmC.exe
  2⤵
  PID:15956
- C:\Windows\System\tRFnCpr.exe
  C:\Windows\System\tRFnCpr.exe
  2⤵
  PID:15984
- C:\Windows\System\gmFMEbM.exe
  C:\Windows\System\gmFMEbM.exe
  2⤵
  PID:16008
- C:\Windows\System\MPZDcBx.exe
  C:\Windows\System\MPZDcBx.exe
  2⤵
  PID:16032
- C:\Windows\System\jknoKTn.exe
  C:\Windows\System\jknoKTn.exe
  2⤵
  PID:16056
- C:\Windows\System\waBidZU.exe
  C:\Windows\System\waBidZU.exe
  2⤵
  PID:16096
- C:\Windows\System\kqqXxqL.exe
  C:\Windows\System\kqqXxqL.exe
  2⤵
  PID:16112
- C:\Windows\System\AqDejCx.exe
  C:\Windows\System\AqDejCx.exe
  2⤵
  PID:16140
- C:\Windows\System\QjstIFv.exe
  C:\Windows\System\QjstIFv.exe
  2⤵
  PID:16160
- C:\Windows\System\KSpDVNz.exe
  C:\Windows\System\KSpDVNz.exe
  2⤵
  PID:16188
- C:\Windows\System\fQkgFqK.exe
  C:\Windows\System\fQkgFqK.exe
  2⤵
  PID:16212
- C:\Windows\System\kSbNeeZ.exe
  C:\Windows\System\kSbNeeZ.exe
  2⤵
  PID:16256
- C:\Windows\System\kiBJXyL.exe
  C:\Windows\System\kiBJXyL.exe
  2⤵
  PID:16284
- C:\Windows\System\caLRteJ.exe
  C:\Windows\System\caLRteJ.exe
  2⤵
  PID:16308
- C:\Windows\System\NdeAtXz.exe
  C:\Windows\System\NdeAtXz.exe
  2⤵
  PID:16336
- C:\Windows\System\qapouJC.exe
  C:\Windows\System\qapouJC.exe
  2⤵
  PID:16356
- C:\Windows\System\lCuoejY.exe
  C:\Windows\System\lCuoejY.exe
  2⤵
  PID:15364
- C:\Windows\System\MhHXsMq.exe
  C:\Windows\System\MhHXsMq.exe
  2⤵
  PID:15412
- C:\Windows\System\VVLZkdd.exe
  C:\Windows\System\VVLZkdd.exe
  2⤵
  PID:15512
- C:\Windows\System\NUtpzmn.exe
  C:\Windows\System\NUtpzmn.exe
  2⤵
  PID:15568
- C:\Windows\System\zgDCAIY.exe
  C:\Windows\System\zgDCAIY.exe
  2⤵
  PID:15624
- C:\Windows\System\WPeUywP.exe
  C:\Windows\System\WPeUywP.exe
  2⤵
  PID:15680
- C:\Windows\System\TJNlfWg.exe
  C:\Windows\System\TJNlfWg.exe
  2⤵
  PID:15708
- C:\Windows\System\LJjgOdL.exe
  C:\Windows\System\LJjgOdL.exe
  2⤵
  PID:15792
- C:\Windows\System\NwBCevl.exe
  C:\Windows\System\NwBCevl.exe
  2⤵
  PID:15888
- C:\Windows\System\WQKkNkV.exe
  C:\Windows\System\WQKkNkV.exe
  2⤵
  PID:15948
- C:\Windows\System\ELOiXad.exe
  C:\Windows\System\ELOiXad.exe
  2⤵
  PID:16024
- C:\Windows\System\nFVmsHV.exe
  C:\Windows\System\nFVmsHV.exe
  2⤵
  PID:16072
- C:\Windows\System\yNsSOax.exe
  C:\Windows\System\yNsSOax.exe
  2⤵
  PID:16104
- C:\Windows\System\uFFuUfr.exe
  C:\Windows\System\uFFuUfr.exe
  2⤵
  PID:16204
- C:\Windows\System\fxMSwep.exe
  C:\Windows\System\fxMSwep.exe
  2⤵
  PID:16276
- C:\Windows\System\DuUCVnB.exe
  C:\Windows\System\DuUCVnB.exe
  2⤵
  PID:9804
- C:\Windows\System\IieWluo.exe
  C:\Windows\System\IieWluo.exe
  2⤵
  PID:10156
- C:\Windows\System\YJiVzji.exe
  C:\Windows\System\YJiVzji.exe
  2⤵
  PID:780
- C:\Windows\System\JoRUXOt.exe
  C:\Windows\System\JoRUXOt.exe
  2⤵
  PID:15468
- C:\Windows\System\FTBUjsr.exe
  C:\Windows\System\FTBUjsr.exe
  2⤵
  PID:15632
- C:\Windows\System\UixfFtJ.exe
  C:\Windows\System\UixfFtJ.exe
  2⤵
  PID:15844
- C:\Windows\System\GnTvNME.exe
  C:\Windows\System\GnTvNME.exe
  2⤵
  PID:15884
- C:\Windows\System\pTcqDAr.exe
  C:\Windows\System\pTcqDAr.exe
  2⤵
  PID:16156
- C:\Windows\System\lCOJtwF.exe
  C:\Windows\System\lCOJtwF.exe
  2⤵
  PID:16168
- C:\Windows\System\TlEpDrc.exe
  C:\Windows\System\TlEpDrc.exe
  2⤵
  PID:15488
- C:\Windows\System\sBUHdez.exe
  C:\Windows\System\sBUHdez.exe
  2⤵
  PID:15768
- C:\Windows\System\BGjOXPc.exe
  C:\Windows\System\BGjOXPc.exe
  2⤵
  PID:16208
- C:\Windows\System\kRgAjBV.exe
  C:\Windows\System\kRgAjBV.exe
  2⤵
  PID:14380
- C:\Windows\System\AYZAkVc.exe
  C:\Windows\System\AYZAkVc.exe
  2⤵
  PID:16040
- C:\Windows\System\wrlKrEw.exe
  C:\Windows\System\wrlKrEw.exe
  2⤵
  PID:16396
- C:\Windows\System\eMYMCNo.exe
  C:\Windows\System\eMYMCNo.exe
  2⤵
  PID:16424
- C:\Windows\System\iBcQQkQ.exe
  C:\Windows\System\iBcQQkQ.exe
  2⤵
  PID:16452
- C:\Windows\System\CiuVsXV.exe
  C:\Windows\System\CiuVsXV.exe
  2⤵
  PID:16468
- C:\Windows\System\QiGDqgg.exe
  C:\Windows\System\QiGDqgg.exe
  2⤵
  PID:16492
- C:\Windows\System\pIeutgK.exe
  C:\Windows\System\pIeutgK.exe
  2⤵
  PID:16524
- C:\Windows\System\xAtzPzm.exe
  C:\Windows\System\xAtzPzm.exe
  2⤵
  PID:16552
- C:\Windows\System\GSrsnvi.exe
  C:\Windows\System\GSrsnvi.exe
  2⤵
  PID:16580
- C:\Windows\System\bVyMrXq.exe
  C:\Windows\System\bVyMrXq.exe
  2⤵
  PID:16620
- C:\Windows\System\nnCTeUc.exe
  C:\Windows\System\nnCTeUc.exe
  2⤵
  PID:16636
- C:\Windows\System\bDwnSHS.exe
  C:\Windows\System\bDwnSHS.exe
  2⤵
  PID:16664
- C:\Windows\System\jECnKCg.exe
  C:\Windows\System\jECnKCg.exe
  2⤵
  PID:16684
- C:\Windows\System\ZUGbtpv.exe
  C:\Windows\System\ZUGbtpv.exe
  2⤵
  PID:16712
- C:\Windows\System\AfhJaYx.exe
  C:\Windows\System\AfhJaYx.exe
  2⤵
  PID:16740
- C:\Windows\System\sYIGulw.exe
  C:\Windows\System\sYIGulw.exe
  2⤵
  PID:16792
- C:\Windows\System\CFgxqZE.exe
  C:\Windows\System\CFgxqZE.exe
  2⤵
  PID:16824
- C:\Windows\System\SqaKScK.exe
  C:\Windows\System\SqaKScK.exe
  2⤵
  PID:16844
- C:\Windows\System\XYlOXqT.exe
  C:\Windows\System\XYlOXqT.exe
  2⤵
  PID:16872
- C:\Windows\System\bJaEHNP.exe
  C:\Windows\System\bJaEHNP.exe
  2⤵
  PID:16900
- C:\Windows\System\ZWDmrcT.exe
  C:\Windows\System\ZWDmrcT.exe
  2⤵
  PID:16932
- C:\Windows\System\geoFIYS.exe
  C:\Windows\System\geoFIYS.exe
  2⤵
  PID:16968
- C:\Windows\System\JnjDMOH.exe
  C:\Windows\System\JnjDMOH.exe
  2⤵
  PID:16992
- C:\Windows\System\oQKsmxI.exe
  C:\Windows\System\oQKsmxI.exe
  2⤵
  PID:17012
- C:\Windows\System\nBLIIMa.exe
  C:\Windows\System\nBLIIMa.exe
  2⤵
  PID:17040
- C:\Windows\System\NJIJyBc.exe
  C:\Windows\System\NJIJyBc.exe
  2⤵
  PID:17080
- C:\Windows\System\LXSTBXx.exe
  C:\Windows\System\LXSTBXx.exe
  2⤵
  PID:17128
- C:\Windows\System\OLsSpGh.exe
  C:\Windows\System\OLsSpGh.exe
  2⤵
  PID:17160
- C:\Windows\System\uusXwOx.exe
  C:\Windows\System\uusXwOx.exe
  2⤵
  PID:17184
- C:\Windows\System\OGNXgyI.exe
  C:\Windows\System\OGNXgyI.exe
  2⤵
  PID:17208
- C:\Windows\System\PBAjUbI.exe
  C:\Windows\System\PBAjUbI.exe
  2⤵
  PID:17228
- C:\Windows\System\YNqWumI.exe
  C:\Windows\System\YNqWumI.exe
  2⤵
  PID:17272
- C:\Windows\System\WxwdovE.exe
  C:\Windows\System\WxwdovE.exe
  2⤵
  PID:17304
- C:\Windows\System\nMwXrDt.exe
  C:\Windows\System\nMwXrDt.exe
  2⤵
  PID:17332
- C:\Windows\System\eXqVtck.exe
  C:\Windows\System\eXqVtck.exe
  2⤵
  PID:17360
- C:\Windows\System\qRCvuJT.exe
  C:\Windows\System\qRCvuJT.exe
  2⤵
  PID:17376
- C:\Windows\System\khnbqSM.exe
  C:\Windows\System\khnbqSM.exe
  2⤵
  PID:16076
- C:\Windows\System\swkWtrC.exe
  C:\Windows\System\swkWtrC.exe
  2⤵
  PID:16460
- C:\Windows\System\mTFqrGK.exe
  C:\Windows\System\mTFqrGK.exe
  2⤵
  PID:16488
- C:\Windows\System\FLHJjUa.exe
  C:\Windows\System\FLHJjUa.exe
  2⤵
  PID:16572
- C:\Windows\System\gOmzaSp.exe
  C:\Windows\System\gOmzaSp.exe
  2⤵
  PID:16644
- C:\Windows\System\ShtfUQP.exe
  C:\Windows\System\ShtfUQP.exe
  2⤵
  PID:16696
- C:\Windows\System\pPNwDZJ.exe
  C:\Windows\System\pPNwDZJ.exe
  2⤵
  PID:16776
- C:\Windows\System\tUOKbvQ.exe
  C:\Windows\System\tUOKbvQ.exe
  2⤵
  PID:16860
- C:\Windows\System\WqhUKQR.exe
  C:\Windows\System\WqhUKQR.exe
  2⤵
  PID:16912
- C:\Windows\System\qmeUWYh.exe
  C:\Windows\System\qmeUWYh.exe
  2⤵
  PID:16984
- C:\Windows\System\DqplDyx.exe
  C:\Windows\System\DqplDyx.exe
  2⤵
  PID:17036
- C:\Windows\System\bbPfMPl.exe
  C:\Windows\System\bbPfMPl.exe
  2⤵
  PID:17140
- C:\Windows\System\IzOuzqj.exe
  C:\Windows\System\IzOuzqj.exe
  2⤵
  PID:17200
- C:\Windows\System\yFCcanS.exe
  C:\Windows\System\yFCcanS.exe
  2⤵
  PID:17284
- C:\Windows\System\rqibaBS.exe
  C:\Windows\System\rqibaBS.exe
  2⤵
  PID:17352
- C:\Windows\System\OsNoeDZ.exe
  C:\Windows\System\OsNoeDZ.exe
  2⤵
  PID:17404
- C:\Windows\System\XySfczS.exe
  C:\Windows\System\XySfczS.exe
  2⤵
  PID:16564
- C:\Windows\System\ZSMuhXc.exe
  C:\Windows\System\ZSMuhXc.exe
  2⤵
  PID:16612
- C:\Windows\System\RakDPny.exe
  C:\Windows\System\RakDPny.exe
  2⤵
  PID:16820
- C:\Windows\System\uSzWGnk.exe
  C:\Windows\System\uSzWGnk.exe
  2⤵
  PID:16892
- C:\Windows\System\tCJrsKv.exe
  C:\Windows\System\tCJrsKv.exe
  2⤵
  PID:17068
- C:\Windows\System\gcgKbqf.exe
  C:\Windows\System\gcgKbqf.exe
  2⤵
  PID:17100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:8
1⤵
PID:7996

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4968 -i 4968 -h 412 -j 408 -s 420 -d 0
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:7700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AetiSYN.exe

Path C:\Windows\System\AetiSYN.exe
Size 2.1MB
SHA256 b0c5c65e005eb0664d3e16a58f4423d2fa7caa924b9ca861ff3fa948ac7d7c93
MD5 4e3196b1c993bcf9a5a7ab915f64901e
SHA1 982c550ed865a392b1d83ad43a322e3ddc76fde9
SHA512 e3cf4171c96c574a8b51db7766854540bcef5a06e3c42534ea1b4ed3a80c731c994cd09a92cbe4911853ec646a88863c0e65270276be1ed01eeccfe4b187cb1e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmL:GemTLkNdfE0pZav
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExIKmaC.exe

Path C:\Windows\System\ExIKmaC.exe
Size 2.1MB
SHA256 710c656d768b107e65b48c52910b5432d48c88b070d8440960a55941864924e6
MD5 53fe885ea7e2b0b14ffdaa4365f25ccb
SHA1 38a0f1d46cd4e7c5b8566f5faeecfb377d23019f
SHA512 866cbee03a7c4ccbad29547691a0dd2bf1e8d909d68cd9fcc49fbe6589f92a9f7efaaf2654ce98d0145c24b49b5c1ed40327d33703c7ca2bc6a36ddd0f254ae4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmi:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

IQmUAjl.exe

Path C:\Windows\System\IQmUAjl.exe
Size 2.1MB
SHA256 cd1739360b788dc8553169c07bec06f1f2e3873417dd19f07649d0da5c2a49d9
MD5 20acb85e1d1fe7320f06712bbad0a869
SHA1 0eb653f756c48310361c1e046c79f9d5cfbaf2e7
SHA512 aa0a2a460f8b67b3d7a75709c337710374f27ebf1d1677ac39d4274e58c2f80555804aa9e261f6310d9b5150ae74e31c58b83fe06ca14ab930ad368062100a31
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmL:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

JhKRitz.exe

Path C:\Windows\System\JhKRitz.exe
Size 2.1MB
SHA256 3576ecb112ff8ce166a469c24f8cd3db5b5e799a6e8453b84b910cf67bf83a2c
MD5 5608300b8e22c05d3287a18bde8170c0
SHA1 ea857861bbf9ab98a0ba6b68bb4dd370ddaf1e64
SHA512 8220175cac7b8133a41f78e35ba3817529e000cb4b012220c5a36bfac32ae3c3a7235d58719449b7c71f4129e6121498d0fb723f914fbc71ce8be8cd7fe81ce8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmF:GemTLkNdfE0pZap
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jynwpoo.exe

Path C:\Windows\System\Jynwpoo.exe
Size 2.1MB
SHA256 04c24b2c625e2101d2274c848136b3a00d2a9675c27b6d7a3a05096b342e844f
MD5 e918db4281a03f37fa30cfb37ba623f5
SHA1 383e0df9d94a3b3d5035161b5c7007047b57d2d8
SHA512 3455150d14b5a24fd5e723f3fc7f219268f16aaf19ca820313cba1db862743f61b518c33610e716a7d7c8f0e87c261c49f967801dc002ac08de008cac22b2388
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmz:GemTLkNdfE0pZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

KfzwbCk.exe

Path C:\Windows\System\KfzwbCk.exe
Size 2.1MB
SHA256 35eb97741e49caf8cf721e18ace5838e6746a0f23c873585ee86b7a32b911004
MD5 3172ba6b3198e1be320003ed0fff80df
SHA1 45559f3143986feea63960aaf5d0675bd5a5a281
SHA512 76323b9fd9342bfb3913877f38db1e1cbafd9c87cf6018eb892855786ab5bb70684fc534d51701f4d43dfa1c01a3ec15ee13c38ee05f7438a072064e6e093451
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmd:GemTLkNdfE0pZap
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrXqmJl.exe

Path C:\Windows\System\MrXqmJl.exe
Size 2.1MB
SHA256 ddc0b3efe1ae651b73f4aff51e7861ce3cdffefc3b4f8ef7ccce2d0ec597c9f0
MD5 af788e905d57c761a2b84180704a68f6
SHA1 2aa3db8de8609faffebabaf1a5d967713e268329
SHA512 794086f22191febf3cace518a43906eb63fc9b22f28680ab74b053f1e6c2dcedc3b5fee148ca45c05c5513748be21366166e4ae13210cf6a0b6801396b632f2f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmk:GemTLkNdfE0pZao
MD5 SHA1 SHA512 SSDEEP

Submit Download

NWwlRlm.exe

Path C:\Windows\System\NWwlRlm.exe
Size 2.1MB
SHA256 e69da1c3552e16cf79de57338fea8a3f7a0ef3a5394ff058e9b447fdecee6c8a
MD5 e68b9642e34137b957a9bd95c8d1a1e7
SHA1 505fb4da01d0de00073f338c522d03142a6c11e8
SHA512 ebe1a4f53b77b73d758797c5221acad7b096fd6dbb287a878bd96113d7709b34e01cad12996558e8f4911e4613910a6123ea1c28bf61e5aec3afb5ef37c82216
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmC:GemTLkNdfE0pZaO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ONTatHD.exe

Path C:\Windows\System\ONTatHD.exe
Size 2.1MB
SHA256 d2e970695f089f182b9cf616b25c6e7a7afdd2ceb4e987cc3936e3c703e91779
MD5 04e654902753e5eac507fb6a7968056c
SHA1 1de29cf1219cf313f475a85f23de0120c0cc3042
SHA512 2f0378d1bad79d73dfc69d221d328eb9f61edd81b5f44212249e89f58b79224be4bc9fb0876eb38a5a2a7f23398719616db58e848841bd741383f020257853ee
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmf:GemTLkNdfE0pZaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

PcSKDTB.exe

Path C:\Windows\System\PcSKDTB.exe
Size 2.1MB
SHA256 80c5c6156a438475725fa5e0d7e940e224e72958ff016d1ddf996360c461f7f4
MD5 e11b990b6482b6b9cf2cb2d266c5c136
SHA1 878eeb5288962114bbae1ff20a7ee7493e872125
SHA512 1adfea4d452ed9e48a56e35f5ce5a4730d762303912241f8ec50798b984440d393f1319c6e4423726c56347a1a569bc87595ee5abe2a9e42f70425fef9a2a645
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmR:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpqMyOH.exe

Path C:\Windows\System\RpqMyOH.exe
Size 2.1MB
SHA256 9098dd51d8887603e05077c01556b510aeada6ffdbb2e1e8f343205611fe06d3
MD5 572f852fd1f7e8dbd082559ff5c18d95
SHA1 9ffac60dcf1b19f5e8749c39fbe19694814ce3ed
SHA512 2b598590b0dc1af62ab5a2da3c288a37fd32fecce7f726b917d08e64446a5acf9749c4dbc9bfab56f2ce295b0031fa54048ef8e619e2ba3a08b702ff3f03b87b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBm4:GemTLkNdfE0pZaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

RwmQjKZ.exe

Path C:\Windows\System\RwmQjKZ.exe
Size 2.1MB
SHA256 3109fd57779496a88110c53ccc41e8ecc4af98f9882c92aa76e6cf4e0bd3e4e4
MD5 3fbcbbb0c978a518ffde6f28c065dab2
SHA1 a63d9abbb0d0bc7d6a6a761614619e1916c3d68a
SHA512 a2c23e23feaf3ddedb01de0edf78c9ddededdfdce0e2b8c96749439f05b0be83d4ccdb093ddebee1343c8fb912dc4c190050434c132684b6cb5e1c49585ffcd0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmT:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VHlTUSj.exe

Path C:\Windows\System\VHlTUSj.exe
Size 2.1MB
SHA256 132d51cb9cc606f697a6c012d1cb694ca43fa02a23a35d88d0d3d33c04c312bc
MD5 0be6b457c98439a1917eabc5cb41cdb0
SHA1 c973922de433f00433e8bb014c0555c32ec23b39
SHA512 4a5bd25f9404a4d776546dafb8df82a7202daf6b3f687cd82d4a0de618a4923a907e41c8ebd9e6d03e3cbf09cf8c47ab7e9d1659f6fa6532504302609b4cb6a2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBm6:GemTLkNdfE0pZaG
MD5 SHA1 SHA512 SSDEEP

Submit Download

VWzUnWz.exe

Path C:\Windows\System\VWzUnWz.exe
Size 2.1MB
SHA256 d2c5a46693cf99fd8dc264cf423a9e26941249d127dc7c8ed6aa1079dfc5e866
MD5 1ff6a0ed2dad8bebf128d51c58479dd2
SHA1 0fa1344b18458ec22e32ad30fde6d7aebef56177
SHA512 0e008fd15e0537a55acbd9cdfa2d0e771e7ebc8ca5d645b38ee55044fcd35c64b979d7355266176a16f739ef54a5f2d0901adec03bea7edf7cc9aa8a1b1a0087
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBm8:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ViMYdIV.exe

Path C:\Windows\System\ViMYdIV.exe
Size 2.1MB
SHA256 86f4906548e3744a50482d2b95d73d3fd18f5643b7d35ca01684ce33f0714c6d
MD5 9a69026fd7b0f8b52989399e5f85a461
SHA1 c2a7ec4267491dae295168a22dc90a22a8013e21
SHA512 8bb41b5bd4bf480d540ef3ac1f76c6564239ccb30649d22ae69a98e1b40f7f5c2b3a8489c320c03a7ce787b74751867e960bd8a26360d7fe2b68df66f43fdbf2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmN:GemTLkNdfE0pZa5
MD5 SHA1 SHA512 SSDEEP

Submit Download

YdZscNJ.exe

Path C:\Windows\System\YdZscNJ.exe
Size 2.1MB
SHA256 40cfd13b35204611d95a6c302a56e196db59df8f28eb303e9f6f8bc43f2437c9
MD5 071e6996711fa97655a9ef31181251a0
SHA1 afa9d3dda09f1b450aa0bc0f9cbd14af8f3e3158
SHA512 21707ad9bc2f5ec8d3c428841773b144e8ae4982820d9edcda3f9d5a97705f5f9177fc4dea92d0420998d9f0aeb1a186ec33f1e62cb73580ecb64e10345f9404
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmq:GemTLkNdfE0pZa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZZNqusY.exe

Path C:\Windows\System\ZZNqusY.exe
Size 2.1MB
SHA256 d8b95ead7dd71b0d378dd7a05103fdba4dc42151016f1a538cbd6ecd2905dca3
MD5 4a41fbb333a49d528d57a14f859d74ad
SHA1 bf31d73f94afa669de55c802a9d0b4288db35f95
SHA512 c10d89ea0b216ff490f5b24363e50b1888036ec5c394a69fa9fe3ab54abb17847ceca4796fb68f7fe35d818dd7c36ff1eb3771db0dff7a4e547e05ee29f45cdc
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmj:GemTLkNdfE0pZa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

aBBKQDg.exe

Path C:\Windows\System\aBBKQDg.exe
Size 2.1MB
SHA256 58238015194375c5c37ddbb8f3bb0e8238088f64b08a87d84e09c9210c5f09d4
MD5 5ad91df3ac34d360f84714c94ff77d8e
SHA1 3bb8500af4433337bda66678af3a0a189a6c3c95
SHA512 6bf7a6285215e643a876fe8ece99323974a92d8c4a90eba5e5c483f8228b6428f29f66fcb15b9bf877b87acef283dfe6ce5d12d6fb80cbd9df536b7b2fb40817
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmh:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

gctqQta.exe

Path C:\Windows\System\gctqQta.exe
Size 2.1MB
SHA256 f7657042f0f2abfc86634679610ebd877c19e5b51ed157bf607608e6e13639dd
MD5 882f60ecca4a9bae243c9abf160b2af2
SHA1 6b02603017557751e390f80c3181552a275835dc
SHA512 75a568943f63e0ad08baf8275085dfd4786c76b058e99c9ac1fba073a7f2eece78c5963f198145c0b0a9259c5bcc42083232a9faacab6b0e746e66fca5034343
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmn:GemTLkNdfE0pZa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

hpPWons.exe

Path C:\Windows\System\hpPWons.exe
Size 2.1MB
SHA256 8d4417ebc7bebba72c32b7879f89cf681f22eb2a60cc6ae2d97b3204529e1cda
MD5 202a65d0d46ed35c523b580b92af786e
SHA1 5ad390a913b8bf24086601d7d60fb295939da926
SHA512 e78824eb2e56ea5fe2f1dabecb40f77d8406107341d569148dae26ab14e62e77f786976a7d5e8f69080a2a658b0567485766af7a5effa9f623986e33b65e9d38
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBm7M:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

hrLOvfs.exe

Path C:\Windows\System\hrLOvfs.exe
Size 2.1MB
SHA256 599b36c4e22b0240a67c4231f34734a11b05c0f5743a1bea3f33ff31bbf20848
MD5 9916b64fd753c20c00dc77098c36331f
SHA1 0b7f7c53a575afc97fc1dcc2c1c323657057df7d
SHA512 3b681ed3109df7c7a9a36abb3f330f8efb66f210265d18f8bcadf7953d28d74543cc8dfd250a8e56b48a0147bd9698a9b8356b909bc8c8e74255139db112ea5b
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmt:GemTLkNdfE0pZaZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lgqRsfy.exe

Path C:\Windows\System\lgqRsfy.exe
Size 2.1MB
SHA256 17b669486d7afbf93f6b6e7b7db5b6828a4e9ce4c4dd1b2875ea77ba007abbfc
MD5 b283db8a38dabd9ab8fa1630224f6456
SHA1 1433bbb80fc54c2218ed3a1b40b110b2767c64da
SHA512 2b66540c782b740eb08f7c8341161fe67e5e4f1738d5493839016254682f9c7dc50fd7ea9ed19f65a30f086e63ad382360304671fadf6d050a598feafffcac14
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmb:GemTLkNdfE0pZaP
MD5 SHA1 SHA512 SSDEEP

Submit Download

lnvuWHB.exe

Path C:\Windows\System\lnvuWHB.exe
Size 2.1MB
SHA256 bf2090c7252728e23dc000277c06c98d03ce3539a5f6a778d78762a3c29e03d5
MD5 1c10cd5e3e24b2ab1bddf73b0ec890ad
SHA1 c01d8cbd5f4fc813a9194f3b1f7a17184bab6e56
SHA512 2653a4fb9a804b1a12142d0a5ca0acb72a8fc2a2882e48cbac329320f837f188c14128cf0aec652fca26df00c59a96279fabc002587fc226b0b68cb6fe21d261
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmk:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

nakcEPH.exe

Path C:\Windows\System\nakcEPH.exe
Size 2.1MB
SHA256 aba7eaac06085013933d7727da575fafe5966f2e786e36fc5dd8dd2a522812d6
MD5 8fd306c2aca947d44f15d04ec0aed7dc
SHA1 ff143344bef9fc92018863530cefca475142bca8
SHA512 f1224aae8f7f408c402887634e9ef917da65c88ddc2e7dc536489c22874ab725a0f418820abc68311b6a0af1e7c8922a15b94be9dbb90b7f4b3c38083120118c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmk:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

npIyRuL.exe

Path C:\Windows\System\npIyRuL.exe
Size 2.1MB
SHA256 693ad00c9ef9848933daac651f933904b5943d5a8acdefb71c9721aaf7205c35
MD5 ef0e1055d662ec2f9296afff61629c08
SHA1 7fbc36686b64db1b0d5055b7c8ca910b1e502660
SHA512 babb1e9850b28f3fd7d544438a54a6b6a9903543c68687d24434ed57ef35844052ad5ce6977a6332f926d45851c913d1e99c1d307df5916aeb19a3568653cf65
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBm5:GemTLkNdfE0pZal
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwYJrCK.exe

Path C:\Windows\System\nwYJrCK.exe
Size 2.1MB
SHA256 7db74bdbfd74e44b786f0e26047cce0895c70e2b44637565193b7b97bf555dde
MD5 b48a9c55545cb6d155ef51cc063ac4d9
SHA1 12c80b90cf2c3d190910561df6a86fc19d6994b6
SHA512 88fd70e63e29fe58d5017d75a6d8b57d6b7167337476c2ae7c42221dd5e22c26058aba1f04292df5d8a48cff5d470d8f08bb088388882f83a7ebe0013b4edc68
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmg:GemTLkNdfE0pZac
MD5 SHA1 SHA512 SSDEEP

Submit Download

puZZGNe.exe

Path C:\Windows\System\puZZGNe.exe
Size 2.1MB
SHA256 9d51281555c4a72379c8b3d81edca5df312c09d77d3129adbb976fb7a220c16d
MD5 865125c8c6da315e30b6ca73cf18932e
SHA1 6887aff02ffd02081ccace848f2e7266e0d75eed
SHA512 e23ee8faf3c823f0c2b7c0ecc56423f9d6c14427c3f177bce58d1500d81ad4cf162c533bfbfbdb3bafc8ddc7c468beb6699aaddede7028ad5743dfad2894fd48
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBm+:GemTLkNdfE0pZai
MD5 SHA1 SHA512 SSDEEP

Submit Download

qfZpJiT.exe

Path C:\Windows\System\qfZpJiT.exe
Size 2.1MB
SHA256 12bba0061d88db009389362fb13f099e5856453264d98a9507f813f9a8513e9c
MD5 40372a32126f1b028ec649d2db58c209
SHA1 b620dd04cea7716dee36abe4f9a262d6b934f39d
SHA512 f8aa5a98d31f7c611d8db93008767fd5ccf4c43b9f4b9dfa1f5b3124424c41a9372fee3c6fc110c3560b15c5482028ca76c1a577a1f507968b9bb8c3815537fe
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmN:GemTLkNdfE0pZaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qttDhpQ.exe

Path C:\Windows\System\qttDhpQ.exe
Size 2.1MB
SHA256 343d74581b733773d10e7b13d7e821e8d3ef4e12b028d98da47f2fa2cee2080b
MD5 f74ebce67dcb68bd14bfad6bc7a27968
SHA1 29b7a1deccde6f27a4b1a575430ccca0e113def9
SHA512 637abf44a8661fde81a93079f74deeedc7c01c57eb3e31196ea9c97b7843e2e1add499aeebb1b82293792de0e5a61c1b99058cedc1ccacbf5c4c9301bc5211e7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmE:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

sFuZUcV.exe

Path C:\Windows\System\sFuZUcV.exe
Size 2.1MB
SHA256 47a99df87598180c0d74c296fc37d0caae79f2800475df7417630022152d09c9
MD5 4e507872c173cf008e68e4b39380b7f3
SHA1 a7b7b1b009b3e16c9fe978ab7e514f7758feeec7
SHA512 09287deb2041a482823842bda5d92e29dd0f7c760bb2432430e3c8ea8f67f9e4beb1df87ae7119fdd99f7d0fcaa8a3dd90fe4025e8c1bf02bf75f0a23764cd9a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmu:GemTLkNdfE0pZaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

sGEAKxL.exe

Path C:\Windows\System\sGEAKxL.exe
Size 2.1MB
SHA256 3c9ea74fffbbfdaddcd0ad832b3257df1649bb0a261facb8361b2866757c764f
MD5 c16f85c30f6a2d621e05c9c2bf30f8fd
SHA1 d59021e6a8108d82d71b0a74d2e39f24480346e6
SHA512 bdd98efdbfccf5bef24927be60700f74a215195f8ea0b6febdc342049944a8895cde37c788bd1d13afe5bb7a439978142cca922af576a9d789fe771f90029f12
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmw:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yUHXsxG.exe

Path C:\Windows\System\yUHXsxG.exe
Size 2.1MB
SHA256 84522f74ce919d9c7b4c0b8b7f3f789eb8539f06fe329a53310a37513418920a
MD5 3fcb2e94d7a9f07e8bfe7a2e421c1def
SHA1 09a990fda761f4221f32c17e0959da5906275c6f
SHA512 ad26bec89bac778748f0a094ccb99b2678762bd69f191cabf43357453211953a826d2344081a24b5a3f25e6eaa05f789c8400b1f8b97140c0f46c3a0ef53238c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmn:GemTLkNdfE0pZaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

zdeFKyO.exe

Path C:\Windows\System\zdeFKyO.exe
Size 2.1MB
SHA256 5f88ce4a6a8d5ebe5ec85cc327752328ec4a2085f6b8d59515bf72ec1f832428
MD5 b97107c3d117917f27a45c63f4546008
SHA1 d31704cf98150be60cb9502201fda377df2e73ff
SHA512 847a576e50101148c87ec910dcce21327035ad587cb502f261be430b8fb0912c93d8f0f3eee15c36bf04fcc083840e365f150800e3f3fdd77600badbd35abc7e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwI3I4O/QdGWrtgpVgJbuBmX:GemTLkNdfE0pZar
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/868-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Download