xmrig | 58e95e51735d1ab0e14e2f51c8889c43b72e869500f8e7aae39e005ac299ef0e

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
Size 1.2MB
Sample240525-q39tlsfa94
SHA256 58e95e51735d1ab0e14e2f51c8889c43b72e869500f8e7aae39e005ac299ef0e
MD5 5cb4810c0d31a76d2f99d10da4bb33e0
SHA1 2c126a3e42cca9a87f4ea009d75b2fdbfba054bb
SHA512 c9218dd9767096e73ec8660e4bf55c95f9e8667cfd1286f1ea90ec181f653ef42f3901c1d99cd4536a7f385d45c7e19877450cc25767a2861c6f656f8cfa456c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOp:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3208 created 4144	3208	WerFaultSecure.exe	77

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000500000002328f-3.dat	xmrig
behavioral2/files/0x000800000002341d-9.dat	xmrig
behavioral2/files/0x0007000000023421-7.dat	xmrig
behavioral2/files/0x0007000000023422-22.dat	xmrig
behavioral2/files/0x0007000000023426-42.dat	xmrig
behavioral2/files/0x000700000002342d-74.dat	xmrig
behavioral2/files/0x0007000000023431-92.dat	xmrig
behavioral2/files/0x000700000002343c-153.dat	xmrig
behavioral2/files/0x000700000002343f-162.dat	xmrig
behavioral2/files/0x000700000002343e-159.dat	xmrig
behavioral2/files/0x000700000002343d-155.dat	xmrig
behavioral2/files/0x000700000002343b-148.dat	xmrig
behavioral2/files/0x000700000002343a-145.dat	xmrig
behavioral2/files/0x0007000000023439-140.dat	xmrig
behavioral2/files/0x0007000000023438-135.dat	xmrig
behavioral2/files/0x0007000000023437-130.dat	xmrig
behavioral2/files/0x0007000000023436-125.dat	xmrig
behavioral2/files/0x0007000000023435-119.dat	xmrig
behavioral2/files/0x0007000000023434-115.dat	xmrig
behavioral2/files/0x0007000000023433-108.dat	xmrig
behavioral2/files/0x0007000000023432-103.dat	xmrig
behavioral2/files/0x0007000000023430-93.dat	xmrig
behavioral2/files/0x000700000002342f-88.dat	xmrig
behavioral2/files/0x000700000002342e-82.dat	xmrig
behavioral2/files/0x000700000002342c-72.dat	xmrig
behavioral2/files/0x000700000002342b-68.dat	xmrig
behavioral2/files/0x000700000002342a-62.dat	xmrig
behavioral2/files/0x0007000000023429-58.dat	xmrig
behavioral2/files/0x0007000000023428-52.dat	xmrig
behavioral2/files/0x0007000000023427-46.dat	xmrig
behavioral2/files/0x0007000000023425-36.dat	xmrig
behavioral2/files/0x0007000000023424-32.dat	xmrig
behavioral2/files/0x0007000000023423-27.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3376	HjIMuWB.exe
4176	gArmAyG.exe
2892	BVOvMHf.exe
4008	KBKfgha.exe
4920	cKYEUOf.exe
2264	pHXGLEk.exe
884	aFjLApq.exe
2324	WEAvOGR.exe
336	gYAMMfa.exe
4064	nLxaRhB.exe
2028	HHENCGR.exe
4396	eCdmjGs.exe
4880	xqzFatk.exe
1472	MtcFKiU.exe
4200	AhJcezU.exe
3100	MsPLAJF.exe
3108	LCNHCzQ.exe
1896	ODTDyJG.exe
5028	fnExNrW.exe
2336	MajBcFU.exe
4500	ChRTAdD.exe
4936	qCXSbpS.exe
860	DsuNvrD.exe
4576	YPTEzuz.exe
4428	OMUsCoj.exe
2420	wiqzvYv.exe
3176	hIHnQbh.exe
2656	mNBOzpL.exe
1600	gfdmGTe.exe
1492	TjrhEtQ.exe
4516	WgjEvJn.exe
3584	ORKZhnJ.exe
1876	RVHRYfH.exe
1368	iYmtTwc.exe
4184	mvZyNDa.exe
964	ncnWBCm.exe
3920	svCfNsJ.exe
2344	pbNAwba.exe
432	NoFnmgX.exe
4520	JDDtBcX.exe
4868	BzshADa.exe
4948	TnmPyLJ.exe
3540	JIGgACN.exe
4424	cTPBFaT.exe
2200	OrvJpbf.exe
1840	OQqYNaY.exe
2524	DfxFAId.exe
4824	tHbbcbb.exe
2448	ssdmUIz.exe
808	wfyOnLM.exe
4228	IrNINYd.exe
4040	VWKHBnG.exe
3236	pbzLaNA.exe
2172	hqVecLY.exe
4348	RpuUVlp.exe
376	ypeWsMM.exe
516	IHvOhxN.exe
2136	fNFIASE.exe
4376	qpLhNvY.exe
1504	FuOAwlc.exe
4784	lXRNTNs.exe
3856	YIOYYGd.exe
1780	gioSdCU.exe
2908	jaxlCCm.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MoyMSdP.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\lHwVxbr.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\GtUloKV.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\NHoMTXS.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\uMpuhQn.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\qyOpyjO.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\Srrckan.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\zrkEdHX.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\QPzhkmi.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\fVSxVNo.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\EKEZNbj.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\cEUnOQY.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\LQbcqKf.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\wrUgjFy.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\URBGmLQ.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\xEoHsuH.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\EHTAyWT.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\DqwvQtY.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\xdyBqOQ.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\DRYyOsa.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\CqAjiUW.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\OsJDaEG.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\LjSXxVs.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\rOukmIl.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\OxXFcaG.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\njvYTaW.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\YwIiasB.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\eFUmsrR.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\deyLkEi.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\tPSuBLO.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\DhSozTz.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\iZBFVlW.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\INIStdT.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZbYxtWr.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\EsXpxvD.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\ooMHinM.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\VLFoYTc.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\gArmAyG.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\xGrexRH.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\zXeQulb.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\oawsfPb.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\DtQZIzU.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\PDmIhPc.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\tBhBtuF.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\CUstDkW.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\NfhQxJm.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\iIjbtwo.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\pbzLaNA.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZsQPtQm.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\ArplpvJ.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\QCDlqOQ.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\IHvOhxN.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\CYhoAIW.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\TxmoxBP.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\nDuDPZj.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\QMrgMHJ.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\gWMqeuB.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\IrNINYd.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\LtWrzJe.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\WoDuhzR.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\pHXGLEk.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\rpEXBqL.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\ozmSJci.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
File created	C:\Windows\System\aemVMTm.exe	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3636	WerFaultSecure.exe
3636	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3376	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	84
PID 1512 wrote to memory of 3376	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	84
PID 1512 wrote to memory of 4176	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	85
PID 1512 wrote to memory of 4176	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	85
PID 1512 wrote to memory of 2892	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	86
PID 1512 wrote to memory of 2892	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	86
PID 1512 wrote to memory of 4008	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	87
PID 1512 wrote to memory of 4008	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	87
PID 1512 wrote to memory of 4920	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	88
PID 1512 wrote to memory of 4920	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	88
PID 1512 wrote to memory of 2264	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	89
PID 1512 wrote to memory of 2264	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	89
PID 1512 wrote to memory of 884	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	90
PID 1512 wrote to memory of 884	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	90
PID 1512 wrote to memory of 2324	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	91
PID 1512 wrote to memory of 2324	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	91
PID 1512 wrote to memory of 336	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	92
PID 1512 wrote to memory of 336	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	92
PID 1512 wrote to memory of 4064	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	93
PID 1512 wrote to memory of 4064	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	93
PID 1512 wrote to memory of 2028	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	94
PID 1512 wrote to memory of 2028	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	94
PID 1512 wrote to memory of 4396	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	95
PID 1512 wrote to memory of 4396	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	95
PID 1512 wrote to memory of 4880	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	96
PID 1512 wrote to memory of 4880	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	96
PID 1512 wrote to memory of 1472	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	97
PID 1512 wrote to memory of 1472	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	97
PID 1512 wrote to memory of 4200	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	98
PID 1512 wrote to memory of 4200	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	98
PID 1512 wrote to memory of 3100	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	99
PID 1512 wrote to memory of 3100	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	99
PID 1512 wrote to memory of 3108	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	100
PID 1512 wrote to memory of 3108	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	100
PID 1512 wrote to memory of 1896	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	101
PID 1512 wrote to memory of 1896	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	101
PID 1512 wrote to memory of 5028	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	102
PID 1512 wrote to memory of 5028	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	102
PID 1512 wrote to memory of 2336	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	103
PID 1512 wrote to memory of 2336	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	103
PID 1512 wrote to memory of 4500	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	104
PID 1512 wrote to memory of 4500	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	104
PID 1512 wrote to memory of 4936	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	105
PID 1512 wrote to memory of 4936	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	105
PID 1512 wrote to memory of 860	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	106
PID 1512 wrote to memory of 860	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	106
PID 1512 wrote to memory of 4576	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	107
PID 1512 wrote to memory of 4576	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	107
PID 1512 wrote to memory of 4428	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	108
PID 1512 wrote to memory of 4428	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	108
PID 1512 wrote to memory of 2420	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	109
PID 1512 wrote to memory of 2420	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	109
PID 1512 wrote to memory of 3176	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	110
PID 1512 wrote to memory of 3176	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	110
PID 1512 wrote to memory of 2656	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	111
PID 1512 wrote to memory of 2656	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	111
PID 1512 wrote to memory of 1600	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	112
PID 1512 wrote to memory of 1600	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	112
PID 1512 wrote to memory of 1492	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	113
PID 1512 wrote to memory of 1492	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	113
PID 1512 wrote to memory of 4516	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	114
PID 1512 wrote to memory of 4516	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	114
PID 1512 wrote to memory of 3584	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	115
PID 1512 wrote to memory of 3584	1512	5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe	115

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv 18+xxLg9v0u5/T7tYkLPJg.0
1⤵
PID:4144
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4144 -s 392
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3636

C:\Users\Admin\AppData\Local\Temp\5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5cb4810c0d31a76d2f99d10da4bb33e0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\System\HjIMuWB.exe
  C:\Windows\System\HjIMuWB.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\gArmAyG.exe
  C:\Windows\System\gArmAyG.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\BVOvMHf.exe
  C:\Windows\System\BVOvMHf.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\KBKfgha.exe
  C:\Windows\System\KBKfgha.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\cKYEUOf.exe
  C:\Windows\System\cKYEUOf.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\pHXGLEk.exe
  C:\Windows\System\pHXGLEk.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\aFjLApq.exe
  C:\Windows\System\aFjLApq.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\WEAvOGR.exe
  C:\Windows\System\WEAvOGR.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\gYAMMfa.exe
  C:\Windows\System\gYAMMfa.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\nLxaRhB.exe
  C:\Windows\System\nLxaRhB.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\HHENCGR.exe
  C:\Windows\System\HHENCGR.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\eCdmjGs.exe
  C:\Windows\System\eCdmjGs.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\xqzFatk.exe
  C:\Windows\System\xqzFatk.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\MtcFKiU.exe
  C:\Windows\System\MtcFKiU.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\AhJcezU.exe
  C:\Windows\System\AhJcezU.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\MsPLAJF.exe
  C:\Windows\System\MsPLAJF.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\LCNHCzQ.exe
  C:\Windows\System\LCNHCzQ.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\ODTDyJG.exe
  C:\Windows\System\ODTDyJG.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\fnExNrW.exe
  C:\Windows\System\fnExNrW.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\MajBcFU.exe
  C:\Windows\System\MajBcFU.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\ChRTAdD.exe
  C:\Windows\System\ChRTAdD.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\qCXSbpS.exe
  C:\Windows\System\qCXSbpS.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\DsuNvrD.exe
  C:\Windows\System\DsuNvrD.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\YPTEzuz.exe
  C:\Windows\System\YPTEzuz.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\OMUsCoj.exe
  C:\Windows\System\OMUsCoj.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\wiqzvYv.exe
  C:\Windows\System\wiqzvYv.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\hIHnQbh.exe
  C:\Windows\System\hIHnQbh.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\mNBOzpL.exe
  C:\Windows\System\mNBOzpL.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\gfdmGTe.exe
  C:\Windows\System\gfdmGTe.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\TjrhEtQ.exe
  C:\Windows\System\TjrhEtQ.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\WgjEvJn.exe
  C:\Windows\System\WgjEvJn.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\ORKZhnJ.exe
  C:\Windows\System\ORKZhnJ.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\RVHRYfH.exe
  C:\Windows\System\RVHRYfH.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\iYmtTwc.exe
  C:\Windows\System\iYmtTwc.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\mvZyNDa.exe
  C:\Windows\System\mvZyNDa.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\ncnWBCm.exe
  C:\Windows\System\ncnWBCm.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\svCfNsJ.exe
  C:\Windows\System\svCfNsJ.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\pbNAwba.exe
  C:\Windows\System\pbNAwba.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\NoFnmgX.exe
  C:\Windows\System\NoFnmgX.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\JDDtBcX.exe
  C:\Windows\System\JDDtBcX.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\BzshADa.exe
  C:\Windows\System\BzshADa.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\TnmPyLJ.exe
  C:\Windows\System\TnmPyLJ.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\JIGgACN.exe
  C:\Windows\System\JIGgACN.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\cTPBFaT.exe
  C:\Windows\System\cTPBFaT.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\OrvJpbf.exe
  C:\Windows\System\OrvJpbf.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\OQqYNaY.exe
  C:\Windows\System\OQqYNaY.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\DfxFAId.exe
  C:\Windows\System\DfxFAId.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\tHbbcbb.exe
  C:\Windows\System\tHbbcbb.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\ssdmUIz.exe
  C:\Windows\System\ssdmUIz.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\wfyOnLM.exe
  C:\Windows\System\wfyOnLM.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\IrNINYd.exe
  C:\Windows\System\IrNINYd.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\VWKHBnG.exe
  C:\Windows\System\VWKHBnG.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\pbzLaNA.exe
  C:\Windows\System\pbzLaNA.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\hqVecLY.exe
  C:\Windows\System\hqVecLY.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\RpuUVlp.exe
  C:\Windows\System\RpuUVlp.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\ypeWsMM.exe
  C:\Windows\System\ypeWsMM.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\IHvOhxN.exe
  C:\Windows\System\IHvOhxN.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\fNFIASE.exe
  C:\Windows\System\fNFIASE.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\qpLhNvY.exe
  C:\Windows\System\qpLhNvY.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\FuOAwlc.exe
  C:\Windows\System\FuOAwlc.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\lXRNTNs.exe
  C:\Windows\System\lXRNTNs.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\YIOYYGd.exe
  C:\Windows\System\YIOYYGd.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\gioSdCU.exe
  C:\Windows\System\gioSdCU.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\jaxlCCm.exe
  C:\Windows\System\jaxlCCm.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\SDlaKpv.exe
  C:\Windows\System\SDlaKpv.exe
  2⤵
  PID:2440
- C:\Windows\System\IFKMGYO.exe
  C:\Windows\System\IFKMGYO.exe
  2⤵
  PID:1004
- C:\Windows\System\LiOwlws.exe
  C:\Windows\System\LiOwlws.exe
  2⤵
  PID:2360
- C:\Windows\System\vJCJyEr.exe
  C:\Windows\System\vJCJyEr.exe
  2⤵
  PID:4512
- C:\Windows\System\AztGRry.exe
  C:\Windows\System\AztGRry.exe
  2⤵
  PID:4760
- C:\Windows\System\IUNuCeG.exe
  C:\Windows\System\IUNuCeG.exe
  2⤵
  PID:2020
- C:\Windows\System\RGlxXLh.exe
  C:\Windows\System\RGlxXLh.exe
  2⤵
  PID:3392
- C:\Windows\System\qRiaplw.exe
  C:\Windows\System\qRiaplw.exe
  2⤵
  PID:3036
- C:\Windows\System\hbPCStA.exe
  C:\Windows\System\hbPCStA.exe
  2⤵
  PID:556
- C:\Windows\System\Gjwdjci.exe
  C:\Windows\System\Gjwdjci.exe
  2⤵
  PID:4636
- C:\Windows\System\jZlBvJp.exe
  C:\Windows\System\jZlBvJp.exe
  2⤵
  PID:3760
- C:\Windows\System\IbiQzLu.exe
  C:\Windows\System\IbiQzLu.exe
  2⤵
  PID:1180
- C:\Windows\System\LcUJJOd.exe
  C:\Windows\System\LcUJJOd.exe
  2⤵
  PID:4232
- C:\Windows\System\MkLrDDy.exe
  C:\Windows\System\MkLrDDy.exe
  2⤵
  PID:2488
- C:\Windows\System\OburKPp.exe
  C:\Windows\System\OburKPp.exe
  2⤵
  PID:5008
- C:\Windows\System\ZsQPtQm.exe
  C:\Windows\System\ZsQPtQm.exe
  2⤵
  PID:2032
- C:\Windows\System\CMqCgco.exe
  C:\Windows\System\CMqCgco.exe
  2⤵
  PID:5144
- C:\Windows\System\INIStdT.exe
  C:\Windows\System\INIStdT.exe
  2⤵
  PID:5172
- C:\Windows\System\FNxRKEW.exe
  C:\Windows\System\FNxRKEW.exe
  2⤵
  PID:5196
- C:\Windows\System\ydVWOEb.exe
  C:\Windows\System\ydVWOEb.exe
  2⤵
  PID:5220
- C:\Windows\System\LbgwpnZ.exe
  C:\Windows\System\LbgwpnZ.exe
  2⤵
  PID:5248
- C:\Windows\System\xckvkwS.exe
  C:\Windows\System\xckvkwS.exe
  2⤵
  PID:5272
- C:\Windows\System\rstItYZ.exe
  C:\Windows\System\rstItYZ.exe
  2⤵
  PID:5300
- C:\Windows\System\eNHYDkq.exe
  C:\Windows\System\eNHYDkq.exe
  2⤵
  PID:5324
- C:\Windows\System\MVILQlk.exe
  C:\Windows\System\MVILQlk.exe
  2⤵
  PID:5360
- C:\Windows\System\asEBvBp.exe
  C:\Windows\System\asEBvBp.exe
  2⤵
  PID:5388
- C:\Windows\System\QtjhXFX.exe
  C:\Windows\System\QtjhXFX.exe
  2⤵
  PID:5412
- C:\Windows\System\cEzWusY.exe
  C:\Windows\System\cEzWusY.exe
  2⤵
  PID:5444
- C:\Windows\System\YKobtWY.exe
  C:\Windows\System\YKobtWY.exe
  2⤵
  PID:5468
- C:\Windows\System\nRLZYkO.exe
  C:\Windows\System\nRLZYkO.exe
  2⤵
  PID:5500
- C:\Windows\System\cUkjoji.exe
  C:\Windows\System\cUkjoji.exe
  2⤵
  PID:5532
- C:\Windows\System\gaAoOel.exe
  C:\Windows\System\gaAoOel.exe
  2⤵
  PID:5556
- C:\Windows\System\mlGLmXT.exe
  C:\Windows\System\mlGLmXT.exe
  2⤵
  PID:5600
- C:\Windows\System\EqHTBJs.exe
  C:\Windows\System\EqHTBJs.exe
  2⤵
  PID:5620
- C:\Windows\System\dicnlne.exe
  C:\Windows\System\dicnlne.exe
  2⤵
  PID:5648
- C:\Windows\System\JRwntTW.exe
  C:\Windows\System\JRwntTW.exe
  2⤵
  PID:5676
- C:\Windows\System\ZEhHvWx.exe
  C:\Windows\System\ZEhHvWx.exe
  2⤵
  PID:5704
- C:\Windows\System\xJsUROf.exe
  C:\Windows\System\xJsUROf.exe
  2⤵
  PID:5732
- C:\Windows\System\LEqqsqW.exe
  C:\Windows\System\LEqqsqW.exe
  2⤵
  PID:5756
- C:\Windows\System\LxMcTpC.exe
  C:\Windows\System\LxMcTpC.exe
  2⤵
  PID:5776
- C:\Windows\System\ZdKwbZF.exe
  C:\Windows\System\ZdKwbZF.exe
  2⤵
  PID:5800
- C:\Windows\System\biCxFOb.exe
  C:\Windows\System\biCxFOb.exe
  2⤵
  PID:5832
- C:\Windows\System\dmISmZX.exe
  C:\Windows\System\dmISmZX.exe
  2⤵
  PID:5860
- C:\Windows\System\libZlfq.exe
  C:\Windows\System\libZlfq.exe
  2⤵
  PID:5884
- C:\Windows\System\auroInD.exe
  C:\Windows\System\auroInD.exe
  2⤵
  PID:5912
- C:\Windows\System\hegnGuG.exe
  C:\Windows\System\hegnGuG.exe
  2⤵
  PID:5944
- C:\Windows\System\uSATShR.exe
  C:\Windows\System\uSATShR.exe
  2⤵
  PID:5968
- C:\Windows\System\CTwgySx.exe
  C:\Windows\System\CTwgySx.exe
  2⤵
  PID:6000
- C:\Windows\System\cGMEEKp.exe
  C:\Windows\System\cGMEEKp.exe
  2⤵
  PID:6024
- C:\Windows\System\ArplpvJ.exe
  C:\Windows\System\ArplpvJ.exe
  2⤵
  PID:6052
- C:\Windows\System\caUkggU.exe
  C:\Windows\System\caUkggU.exe
  2⤵
  PID:6092
- C:\Windows\System\ciJKSUH.exe
  C:\Windows\System\ciJKSUH.exe
  2⤵
  PID:6120
- C:\Windows\System\XpzfDYH.exe
  C:\Windows\System\XpzfDYH.exe
  2⤵
  PID:6140
- C:\Windows\System\ZNgqbQP.exe
  C:\Windows\System\ZNgqbQP.exe
  2⤵
  PID:4560
- C:\Windows\System\MvjZLOP.exe
  C:\Windows\System\MvjZLOP.exe
  2⤵
  PID:2724
- C:\Windows\System\TBNqzJE.exe
  C:\Windows\System\TBNqzJE.exe
  2⤵
  PID:4548
- C:\Windows\System\FjafPBn.exe
  C:\Windows\System\FjafPBn.exe
  2⤵
  PID:4320
- C:\Windows\System\pEgwJJI.exe
  C:\Windows\System\pEgwJJI.exe
  2⤵
  PID:1740
- C:\Windows\System\ZbYxtWr.exe
  C:\Windows\System\ZbYxtWr.exe
  2⤵
  PID:1596
- C:\Windows\System\CUstDkW.exe
  C:\Windows\System\CUstDkW.exe
  2⤵
  PID:5168
- C:\Windows\System\DArOWnB.exe
  C:\Windows\System\DArOWnB.exe
  2⤵
  PID:5228
- C:\Windows\System\fppFwVj.exe
  C:\Windows\System\fppFwVj.exe
  2⤵
  PID:5292
- C:\Windows\System\XirRNhu.exe
  C:\Windows\System\XirRNhu.exe
  2⤵
  PID:5348
- C:\Windows\System\lCEDQzw.exe
  C:\Windows\System\lCEDQzw.exe
  2⤵
  PID:5424
- C:\Windows\System\kkZwazF.exe
  C:\Windows\System\kkZwazF.exe
  2⤵
  PID:5484
- C:\Windows\System\JJyunwS.exe
  C:\Windows\System\JJyunwS.exe
  2⤵
  PID:5548
- C:\Windows\System\xXMelPU.exe
  C:\Windows\System\xXMelPU.exe
  2⤵
  PID:5632
- C:\Windows\System\CGhNgnq.exe
  C:\Windows\System\CGhNgnq.exe
  2⤵
  PID:5692
- C:\Windows\System\RcoEsJj.exe
  C:\Windows\System\RcoEsJj.exe
  2⤵
  PID:5772
- C:\Windows\System\BqCxZfW.exe
  C:\Windows\System\BqCxZfW.exe
  2⤵
  PID:5816
- C:\Windows\System\HxCdSkI.exe
  C:\Windows\System\HxCdSkI.exe
  2⤵
  PID:5876
- C:\Windows\System\zpJJjBq.exe
  C:\Windows\System\zpJJjBq.exe
  2⤵
  PID:5932
- C:\Windows\System\IIpzxPs.exe
  C:\Windows\System\IIpzxPs.exe
  2⤵
  PID:5992
- C:\Windows\System\dTldUzt.exe
  C:\Windows\System\dTldUzt.exe
  2⤵
  PID:6072
- C:\Windows\System\HTbRfmo.exe
  C:\Windows\System\HTbRfmo.exe
  2⤵
  PID:6132
- C:\Windows\System\UlGBjvu.exe
  C:\Windows\System\UlGBjvu.exe
  2⤵
  PID:2300
- C:\Windows\System\ZoPoqhl.exe
  C:\Windows\System\ZoPoqhl.exe
  2⤵
  PID:6172
- C:\Windows\System\tZgofTF.exe
  C:\Windows\System\tZgofTF.exe
  2⤵
  PID:6196
- C:\Windows\System\nfDchWf.exe
  C:\Windows\System\nfDchWf.exe
  2⤵
  PID:6228
- C:\Windows\System\mPCnUAu.exe
  C:\Windows\System\mPCnUAu.exe
  2⤵
  PID:6252
- C:\Windows\System\rOukmIl.exe
  C:\Windows\System\rOukmIl.exe
  2⤵
  PID:6284
- C:\Windows\System\nbOiGsQ.exe
  C:\Windows\System\nbOiGsQ.exe
  2⤵
  PID:6312
- C:\Windows\System\rJDmoYQ.exe
  C:\Windows\System\rJDmoYQ.exe
  2⤵
  PID:6340
- C:\Windows\System\aemVMTm.exe
  C:\Windows\System\aemVMTm.exe
  2⤵
  PID:6364
- C:\Windows\System\FZQOTbu.exe
  C:\Windows\System\FZQOTbu.exe
  2⤵
  PID:6396
- C:\Windows\System\dsJfJwI.exe
  C:\Windows\System\dsJfJwI.exe
  2⤵
  PID:6432
- C:\Windows\System\FRSCXBb.exe
  C:\Windows\System\FRSCXBb.exe
  2⤵
  PID:6460
- C:\Windows\System\NvBouLt.exe
  C:\Windows\System\NvBouLt.exe
  2⤵
  PID:6488
- C:\Windows\System\otDpiuf.exe
  C:\Windows\System\otDpiuf.exe
  2⤵
  PID:6508
- C:\Windows\System\gbciJNH.exe
  C:\Windows\System\gbciJNH.exe
  2⤵
  PID:6536
- C:\Windows\System\DqwvQtY.exe
  C:\Windows\System\DqwvQtY.exe
  2⤵
  PID:6564
- C:\Windows\System\kNwtaLb.exe
  C:\Windows\System\kNwtaLb.exe
  2⤵
  PID:6592
- C:\Windows\System\oQtgHsZ.exe
  C:\Windows\System\oQtgHsZ.exe
  2⤵
  PID:6620
- C:\Windows\System\NoJsHrs.exe
  C:\Windows\System\NoJsHrs.exe
  2⤵
  PID:6660
- C:\Windows\System\AJcmWIX.exe
  C:\Windows\System\AJcmWIX.exe
  2⤵
  PID:6688
- C:\Windows\System\iqUlMcp.exe
  C:\Windows\System\iqUlMcp.exe
  2⤵
  PID:6712
- C:\Windows\System\xbHgMjk.exe
  C:\Windows\System\xbHgMjk.exe
  2⤵
  PID:6732
- C:\Windows\System\PoixkgD.exe
  C:\Windows\System\PoixkgD.exe
  2⤵
  PID:6760
- C:\Windows\System\ppVtAYJ.exe
  C:\Windows\System\ppVtAYJ.exe
  2⤵
  PID:6784
- C:\Windows\System\FzdLpEw.exe
  C:\Windows\System\FzdLpEw.exe
  2⤵
  PID:6812
- C:\Windows\System\tEAPbNo.exe
  C:\Windows\System\tEAPbNo.exe
  2⤵
  PID:6844
- C:\Windows\System\rQXmSJx.exe
  C:\Windows\System\rQXmSJx.exe
  2⤵
  PID:6872
- C:\Windows\System\opfcLbi.exe
  C:\Windows\System\opfcLbi.exe
  2⤵
  PID:6900
- C:\Windows\System\eLOMcln.exe
  C:\Windows\System\eLOMcln.exe
  2⤵
  PID:6924
- C:\Windows\System\PEQqeXZ.exe
  C:\Windows\System\PEQqeXZ.exe
  2⤵
  PID:6956
- C:\Windows\System\qWDzHjE.exe
  C:\Windows\System\qWDzHjE.exe
  2⤵
  PID:6980
- C:\Windows\System\hYnEWKw.exe
  C:\Windows\System\hYnEWKw.exe
  2⤵
  PID:7012
- C:\Windows\System\YkLnmKa.exe
  C:\Windows\System\YkLnmKa.exe
  2⤵
  PID:7040
- C:\Windows\System\yooEUAz.exe
  C:\Windows\System\yooEUAz.exe
  2⤵
  PID:7068
- C:\Windows\System\GpdeKia.exe
  C:\Windows\System\GpdeKia.exe
  2⤵
  PID:7096
- C:\Windows\System\MjGIAjx.exe
  C:\Windows\System\MjGIAjx.exe
  2⤵
  PID:7128
- C:\Windows\System\TqOrmDD.exe
  C:\Windows\System\TqOrmDD.exe
  2⤵
  PID:7156
- C:\Windows\System\CRhGwkk.exe
  C:\Windows\System\CRhGwkk.exe
  2⤵
  PID:4116
- C:\Windows\System\pGOQFIp.exe
  C:\Windows\System\pGOQFIp.exe
  2⤵
  PID:1972
- C:\Windows\System\ggdJOeG.exe
  C:\Windows\System\ggdJOeG.exe
  2⤵
  PID:5208
- C:\Windows\System\BwLdCAE.exe
  C:\Windows\System\BwLdCAE.exe
  2⤵
  PID:5404
- C:\Windows\System\RqvHroa.exe
  C:\Windows\System\RqvHroa.exe
  2⤵
  PID:5544
- C:\Windows\System\SpCtWSI.exe
  C:\Windows\System\SpCtWSI.exe
  2⤵
  PID:5664
- C:\Windows\System\VPAQFGu.exe
  C:\Windows\System\VPAQFGu.exe
  2⤵
  PID:5792
- C:\Windows\System\bBWzESG.exe
  C:\Windows\System\bBWzESG.exe
  2⤵
  PID:5904
- C:\Windows\System\IVxjdmq.exe
  C:\Windows\System\IVxjdmq.exe
  2⤵
  PID:6044
- C:\Windows\System\XOpsoRA.exe
  C:\Windows\System\XOpsoRA.exe
  2⤵
  PID:2312
- C:\Windows\System\cwaKfbm.exe
  C:\Windows\System\cwaKfbm.exe
  2⤵
  PID:6192
- C:\Windows\System\yLoxnfK.exe
  C:\Windows\System\yLoxnfK.exe
  2⤵
  PID:6268
- C:\Windows\System\FYWjuzi.exe
  C:\Windows\System\FYWjuzi.exe
  2⤵
  PID:6324
- C:\Windows\System\RarlDkS.exe
  C:\Windows\System\RarlDkS.exe
  2⤵
  PID:6384
- C:\Windows\System\spRagcN.exe
  C:\Windows\System\spRagcN.exe
  2⤵
  PID:6448
- C:\Windows\System\beXNQxJ.exe
  C:\Windows\System\beXNQxJ.exe
  2⤵
  PID:6520
- C:\Windows\System\sfpcfJA.exe
  C:\Windows\System\sfpcfJA.exe
  2⤵
  PID:6576
- C:\Windows\System\uYDtxSx.exe
  C:\Windows\System\uYDtxSx.exe
  2⤵
  PID:6632
- C:\Windows\System\LYLEbbf.exe
  C:\Windows\System\LYLEbbf.exe
  2⤵
  PID:6676
- C:\Windows\System\yJTcnRn.exe
  C:\Windows\System\yJTcnRn.exe
  2⤵
  PID:6744
- C:\Windows\System\OMAqxJo.exe
  C:\Windows\System\OMAqxJo.exe
  2⤵
  PID:3664
- C:\Windows\System\UaWjvUS.exe
  C:\Windows\System\UaWjvUS.exe
  2⤵
  PID:6944
- C:\Windows\System\ipRYBmQ.exe
  C:\Windows\System\ipRYBmQ.exe
  2⤵
  PID:7028
- C:\Windows\System\HwelbfD.exe
  C:\Windows\System\HwelbfD.exe
  2⤵
  PID:7112
- C:\Windows\System\KKOWIdg.exe
  C:\Windows\System\KKOWIdg.exe
  2⤵
  PID:4536
- C:\Windows\System\pWrBydY.exe
  C:\Windows\System\pWrBydY.exe
  2⤵
  PID:2860
- C:\Windows\System\LdSaokP.exe
  C:\Windows\System\LdSaokP.exe
  2⤵
  PID:5340
- C:\Windows\System\RxKJMCu.exe
  C:\Windows\System\RxKJMCu.exe
  2⤵
  PID:5584
- C:\Windows\System\fVSxVNo.exe
  C:\Windows\System\fVSxVNo.exe
  2⤵
  PID:5988
- C:\Windows\System\VzFggjW.exe
  C:\Windows\System\VzFggjW.exe
  2⤵
  PID:4216
- C:\Windows\System\WRWxJej.exe
  C:\Windows\System\WRWxJej.exe
  2⤵
  PID:6184
- C:\Windows\System\mKxMplk.exe
  C:\Windows\System\mKxMplk.exe
  2⤵
  PID:6244
- C:\Windows\System\GPpRlfm.exe
  C:\Windows\System\GPpRlfm.exe
  2⤵
  PID:1680
- C:\Windows\System\uMpuhQn.exe
  C:\Windows\System\uMpuhQn.exe
  2⤵
  PID:4104
- C:\Windows\System\ViODJNy.exe
  C:\Windows\System\ViODJNy.exe
  2⤵
  PID:6484
- C:\Windows\System\YQGubpq.exe
  C:\Windows\System\YQGubpq.exe
  2⤵
  PID:2876
- C:\Windows\System\byZVbgP.exe
  C:\Windows\System\byZVbgP.exe
  2⤵
  PID:2620
- C:\Windows\System\MNVlSGP.exe
  C:\Windows\System\MNVlSGP.exe
  2⤵
  PID:6644
- C:\Windows\System\VLnDVJf.exe
  C:\Windows\System\VLnDVJf.exe
  2⤵
  PID:6704
- C:\Windows\System\zQsBSHX.exe
  C:\Windows\System\zQsBSHX.exe
  2⤵
  PID:1956
- C:\Windows\System\CBNKomC.exe
  C:\Windows\System\CBNKomC.exe
  2⤵
  PID:6776
- C:\Windows\System\rJBVCmT.exe
  C:\Windows\System\rJBVCmT.exe
  2⤵
  PID:7148
- C:\Windows\System\XzDqzLl.exe
  C:\Windows\System\XzDqzLl.exe
  2⤵
  PID:4956
- C:\Windows\System\XroWZlD.exe
  C:\Windows\System\XroWZlD.exe
  2⤵
  PID:5716
- C:\Windows\System\sXOVfCp.exe
  C:\Windows\System\sXOVfCp.exe
  2⤵
  PID:3124
- C:\Windows\System\CYWZbWo.exe
  C:\Windows\System\CYWZbWo.exe
  2⤵
  PID:1656
- C:\Windows\System\HEMvoNU.exe
  C:\Windows\System\HEMvoNU.exe
  2⤵
  PID:4388
- C:\Windows\System\EKEZNbj.exe
  C:\Windows\System\EKEZNbj.exe
  2⤵
  PID:1584
- C:\Windows\System\WLhjuDK.exe
  C:\Windows\System\WLhjuDK.exe
  2⤵
  PID:6948
- C:\Windows\System\edNNKRS.exe
  C:\Windows\System\edNNKRS.exe
  2⤵
  PID:6108
- C:\Windows\System\ZQmTdMU.exe
  C:\Windows\System\ZQmTdMU.exe
  2⤵
  PID:4856
- C:\Windows\System\fbhldgj.exe
  C:\Windows\System\fbhldgj.exe
  2⤵
  PID:5284
- C:\Windows\System\WMZkFSu.exe
  C:\Windows\System\WMZkFSu.exe
  2⤵
  PID:1664
- C:\Windows\System\cEUnOQY.exe
  C:\Windows\System\cEUnOQY.exe
  2⤵
  PID:3656
- C:\Windows\System\WgOkGIr.exe
  C:\Windows\System\WgOkGIr.exe
  2⤵
  PID:7192
- C:\Windows\System\QptMTZA.exe
  C:\Windows\System\QptMTZA.exe
  2⤵
  PID:7208
- C:\Windows\System\EmoyBYS.exe
  C:\Windows\System\EmoyBYS.exe
  2⤵
  PID:7236
- C:\Windows\System\lltJiVV.exe
  C:\Windows\System\lltJiVV.exe
  2⤵
  PID:7268
- C:\Windows\System\dSuwBVg.exe
  C:\Windows\System\dSuwBVg.exe
  2⤵
  PID:7292
- C:\Windows\System\ZSeYGuP.exe
  C:\Windows\System\ZSeYGuP.exe
  2⤵
  PID:7312
- C:\Windows\System\qyOpyjO.exe
  C:\Windows\System\qyOpyjO.exe
  2⤵
  PID:7332
- C:\Windows\System\UfVHzhP.exe
  C:\Windows\System\UfVHzhP.exe
  2⤵
  PID:7356
- C:\Windows\System\EyXrGTP.exe
  C:\Windows\System\EyXrGTP.exe
  2⤵
  PID:7388
- C:\Windows\System\kcKixNT.exe
  C:\Windows\System\kcKixNT.exe
  2⤵
  PID:7412
- C:\Windows\System\ffKGcJg.exe
  C:\Windows\System\ffKGcJg.exe
  2⤵
  PID:7436
- C:\Windows\System\qqLlLbo.exe
  C:\Windows\System\qqLlLbo.exe
  2⤵
  PID:7464
- C:\Windows\System\wDaLJCH.exe
  C:\Windows\System\wDaLJCH.exe
  2⤵
  PID:7488
- C:\Windows\System\cTdSuMn.exe
  C:\Windows\System\cTdSuMn.exe
  2⤵
  PID:7528
- C:\Windows\System\TXtQMiQ.exe
  C:\Windows\System\TXtQMiQ.exe
  2⤵
  PID:7564
- C:\Windows\System\irQuVqt.exe
  C:\Windows\System\irQuVqt.exe
  2⤵
  PID:7588
- C:\Windows\System\AJdfbuS.exe
  C:\Windows\System\AJdfbuS.exe
  2⤵
  PID:7616
- C:\Windows\System\sJvgjuQ.exe
  C:\Windows\System\sJvgjuQ.exe
  2⤵
  PID:7648
- C:\Windows\System\ZlSBLmv.exe
  C:\Windows\System\ZlSBLmv.exe
  2⤵
  PID:7672
- C:\Windows\System\GoGJpfa.exe
  C:\Windows\System\GoGJpfa.exe
  2⤵
  PID:7720
- C:\Windows\System\TcZMPRw.exe
  C:\Windows\System\TcZMPRw.exe
  2⤵
  PID:7740
- C:\Windows\System\LxsUaxu.exe
  C:\Windows\System\LxsUaxu.exe
  2⤵
  PID:7760
- C:\Windows\System\HIGltha.exe
  C:\Windows\System\HIGltha.exe
  2⤵
  PID:7780
- C:\Windows\System\EaMgbfq.exe
  C:\Windows\System\EaMgbfq.exe
  2⤵
  PID:7800
- C:\Windows\System\AZhCcDF.exe
  C:\Windows\System\AZhCcDF.exe
  2⤵
  PID:7860
- C:\Windows\System\lFoJeRZ.exe
  C:\Windows\System\lFoJeRZ.exe
  2⤵
  PID:7892
- C:\Windows\System\yIvvrCl.exe
  C:\Windows\System\yIvvrCl.exe
  2⤵
  PID:7924
- C:\Windows\System\ijFhaJC.exe
  C:\Windows\System\ijFhaJC.exe
  2⤵
  PID:7960
- C:\Windows\System\ZYTjLqN.exe
  C:\Windows\System\ZYTjLqN.exe
  2⤵
  PID:7988
- C:\Windows\System\duhaNEw.exe
  C:\Windows\System\duhaNEw.exe
  2⤵
  PID:8008
- C:\Windows\System\nwZlQPj.exe
  C:\Windows\System\nwZlQPj.exe
  2⤵
  PID:8028
- C:\Windows\System\ublbelQ.exe
  C:\Windows\System\ublbelQ.exe
  2⤵
  PID:8048
- C:\Windows\System\EToagfe.exe
  C:\Windows\System\EToagfe.exe
  2⤵
  PID:8096
- C:\Windows\System\EsXpxvD.exe
  C:\Windows\System\EsXpxvD.exe
  2⤵
  PID:8128
- C:\Windows\System\hmiEEua.exe
  C:\Windows\System\hmiEEua.exe
  2⤵
  PID:8144
- C:\Windows\System\ExKaPsW.exe
  C:\Windows\System\ExKaPsW.exe
  2⤵
  PID:8172
- C:\Windows\System\EffUwPA.exe
  C:\Windows\System\EffUwPA.exe
  2⤵
  PID:7180
- C:\Windows\System\RvorZds.exe
  C:\Windows\System\RvorZds.exe
  2⤵
  PID:7264
- C:\Windows\System\VtqKbLP.exe
  C:\Windows\System\VtqKbLP.exe
  2⤵
  PID:7324
- C:\Windows\System\zrFicKz.exe
  C:\Windows\System\zrFicKz.exe
  2⤵
  PID:7348
- C:\Windows\System\Tldklsz.exe
  C:\Windows\System\Tldklsz.exe
  2⤵
  PID:7420
- C:\Windows\System\PtFRJcq.exe
  C:\Windows\System\PtFRJcq.exe
  2⤵
  PID:7504
- C:\Windows\System\cBcgfiR.exe
  C:\Windows\System\cBcgfiR.exe
  2⤵
  PID:7556
- C:\Windows\System\RKRqfdO.exe
  C:\Windows\System\RKRqfdO.exe
  2⤵
  PID:7600
- C:\Windows\System\zOqpjLX.exe
  C:\Windows\System\zOqpjLX.exe
  2⤵
  PID:7708
- C:\Windows\System\FZdPZXc.exe
  C:\Windows\System\FZdPZXc.exe
  2⤵
  PID:7748
- C:\Windows\System\JWUUeze.exe
  C:\Windows\System\JWUUeze.exe
  2⤵
  PID:7772
- C:\Windows\System\ZwDKHxn.exe
  C:\Windows\System\ZwDKHxn.exe
  2⤵
  PID:7852
- C:\Windows\System\zXeXLBA.exe
  C:\Windows\System\zXeXLBA.exe
  2⤵
  PID:7916
- C:\Windows\System\SSkzoxw.exe
  C:\Windows\System\SSkzoxw.exe
  2⤵
  PID:8004
- C:\Windows\System\aoKqiaf.exe
  C:\Windows\System\aoKqiaf.exe
  2⤵
  PID:8080
- C:\Windows\System\FHgcccb.exe
  C:\Windows\System\FHgcccb.exe
  2⤵
  PID:4432
- C:\Windows\System\GzuGcGk.exe
  C:\Windows\System\GzuGcGk.exe
  2⤵
  PID:8160
- C:\Windows\System\XPzexEM.exe
  C:\Windows\System\XPzexEM.exe
  2⤵
  PID:7248
- C:\Windows\System\IZxjxrY.exe
  C:\Windows\System\IZxjxrY.exe
  2⤵
  PID:4256
- C:\Windows\System\IPHNDgR.exe
  C:\Windows\System\IPHNDgR.exe
  2⤵
  PID:7456
- C:\Windows\System\fRSieOH.exe
  C:\Windows\System\fRSieOH.exe
  2⤵
  PID:7624
- C:\Windows\System\WJFzsbR.exe
  C:\Windows\System\WJFzsbR.exe
  2⤵
  PID:7788
- C:\Windows\System\tBhBtuF.exe
  C:\Windows\System\tBhBtuF.exe
  2⤵
  PID:7956
- C:\Windows\System\caKNufT.exe
  C:\Windows\System\caKNufT.exe
  2⤵
  PID:4632
- C:\Windows\System\ZOYbJNp.exe
  C:\Windows\System\ZOYbJNp.exe
  2⤵
  PID:7244
- C:\Windows\System\DRYyOsa.exe
  C:\Windows\System\DRYyOsa.exe
  2⤵
  PID:7276
- C:\Windows\System\HgmaZYQ.exe
  C:\Windows\System\HgmaZYQ.exe
  2⤵
  PID:7608
- C:\Windows\System\ibVTzPB.exe
  C:\Windows\System\ibVTzPB.exe
  2⤵
  PID:8036
- C:\Windows\System\PZIjyFN.exe
  C:\Windows\System\PZIjyFN.exe
  2⤵
  PID:8140
- C:\Windows\System\butxUMw.exe
  C:\Windows\System\butxUMw.exe
  2⤵
  PID:7844
- C:\Windows\System\CYUNAZw.exe
  C:\Windows\System\CYUNAZw.exe
  2⤵
  PID:4440
- C:\Windows\System\VAEcYdN.exe
  C:\Windows\System\VAEcYdN.exe
  2⤵
  PID:8216
- C:\Windows\System\aXTYCqr.exe
  C:\Windows\System\aXTYCqr.exe
  2⤵
  PID:8232
- C:\Windows\System\UzUUHFB.exe
  C:\Windows\System\UzUUHFB.exe
  2⤵
  PID:8260
- C:\Windows\System\ugRyjEE.exe
  C:\Windows\System\ugRyjEE.exe
  2⤵
  PID:8288
- C:\Windows\System\lNQeoAp.exe
  C:\Windows\System\lNQeoAp.exe
  2⤵
  PID:8316
- C:\Windows\System\COXVoQS.exe
  C:\Windows\System\COXVoQS.exe
  2⤵
  PID:8384
- C:\Windows\System\NzSKRSC.exe
  C:\Windows\System\NzSKRSC.exe
  2⤵
  PID:8404
- C:\Windows\System\tCGsZuC.exe
  C:\Windows\System\tCGsZuC.exe
  2⤵
  PID:8432
- C:\Windows\System\WguaIPK.exe
  C:\Windows\System\WguaIPK.exe
  2⤵
  PID:8456
- C:\Windows\System\AMhVHQc.exe
  C:\Windows\System\AMhVHQc.exe
  2⤵
  PID:8476
- C:\Windows\System\CcVJTgn.exe
  C:\Windows\System\CcVJTgn.exe
  2⤵
  PID:8508
- C:\Windows\System\JUsyYaR.exe
  C:\Windows\System\JUsyYaR.exe
  2⤵
  PID:8536
- C:\Windows\System\QPAvAzg.exe
  C:\Windows\System\QPAvAzg.exe
  2⤵
  PID:8560
- C:\Windows\System\BIsvhuw.exe
  C:\Windows\System\BIsvhuw.exe
  2⤵
  PID:8580
- C:\Windows\System\BYlSRHY.exe
  C:\Windows\System\BYlSRHY.exe
  2⤵
  PID:8616
- C:\Windows\System\QCDlqOQ.exe
  C:\Windows\System\QCDlqOQ.exe
  2⤵
  PID:8636
- C:\Windows\System\oOVWNqX.exe
  C:\Windows\System\oOVWNqX.exe
  2⤵
  PID:8672
- C:\Windows\System\zkpuVBd.exe
  C:\Windows\System\zkpuVBd.exe
  2⤵
  PID:8688
- C:\Windows\System\HwapizI.exe
  C:\Windows\System\HwapizI.exe
  2⤵
  PID:8712
- C:\Windows\System\ZgDsqsM.exe
  C:\Windows\System\ZgDsqsM.exe
  2⤵
  PID:8736
- C:\Windows\System\BPAJDJQ.exe
  C:\Windows\System\BPAJDJQ.exe
  2⤵
  PID:8772
- C:\Windows\System\qmZlEqS.exe
  C:\Windows\System\qmZlEqS.exe
  2⤵
  PID:8788
- C:\Windows\System\nNKUSGQ.exe
  C:\Windows\System\nNKUSGQ.exe
  2⤵
  PID:8836
- C:\Windows\System\yqlscbP.exe
  C:\Windows\System\yqlscbP.exe
  2⤵
  PID:8868
- C:\Windows\System\LWMRxGE.exe
  C:\Windows\System\LWMRxGE.exe
  2⤵
  PID:8904
- C:\Windows\System\rkcOddi.exe
  C:\Windows\System\rkcOddi.exe
  2⤵
  PID:8928
- C:\Windows\System\KQRukdS.exe
  C:\Windows\System\KQRukdS.exe
  2⤵
  PID:8956
- C:\Windows\System\UfEdhWG.exe
  C:\Windows\System\UfEdhWG.exe
  2⤵
  PID:8996
- C:\Windows\System\xGrexRH.exe
  C:\Windows\System\xGrexRH.exe
  2⤵
  PID:9012
- C:\Windows\System\DfSnLfZ.exe
  C:\Windows\System\DfSnLfZ.exe
  2⤵
  PID:9032
- C:\Windows\System\tLibdMe.exe
  C:\Windows\System\tLibdMe.exe
  2⤵
  PID:9056
- C:\Windows\System\jEewTmM.exe
  C:\Windows\System\jEewTmM.exe
  2⤵
  PID:9080
- C:\Windows\System\MoyMSdP.exe
  C:\Windows\System\MoyMSdP.exe
  2⤵
  PID:9104
- C:\Windows\System\YwIiasB.exe
  C:\Windows\System\YwIiasB.exe
  2⤵
  PID:9128
- C:\Windows\System\HayoCoL.exe
  C:\Windows\System\HayoCoL.exe
  2⤵
  PID:9152
- C:\Windows\System\ooMHinM.exe
  C:\Windows\System\ooMHinM.exe
  2⤵
  PID:9176
- C:\Windows\System\nJMnNdS.exe
  C:\Windows\System\nJMnNdS.exe
  2⤵
  PID:9196
- C:\Windows\System\KtGNFqB.exe
  C:\Windows\System\KtGNFqB.exe
  2⤵
  PID:8108
- C:\Windows\System\dvinGBD.exe
  C:\Windows\System\dvinGBD.exe
  2⤵
  PID:8276
- C:\Windows\System\PRVWmBN.exe
  C:\Windows\System\PRVWmBN.exe
  2⤵
  PID:8356
- C:\Windows\System\jeXwiZY.exe
  C:\Windows\System\jeXwiZY.exe
  2⤵
  PID:8396
- C:\Windows\System\pyPMwTT.exe
  C:\Windows\System\pyPMwTT.exe
  2⤵
  PID:8504
- C:\Windows\System\jmLmogS.exe
  C:\Windows\System\jmLmogS.exe
  2⤵
  PID:8552
- C:\Windows\System\fXnkaAh.exe
  C:\Windows\System\fXnkaAh.exe
  2⤵
  PID:8664
- C:\Windows\System\wlBtsfA.exe
  C:\Windows\System\wlBtsfA.exe
  2⤵
  PID:8708
- C:\Windows\System\PhdZFpm.exe
  C:\Windows\System\PhdZFpm.exe
  2⤵
  PID:8744
- C:\Windows\System\VyNVpxg.exe
  C:\Windows\System\VyNVpxg.exe
  2⤵
  PID:3496
- C:\Windows\System\sguYNFR.exe
  C:\Windows\System\sguYNFR.exe
  2⤵
  PID:8832
- C:\Windows\System\ogDUoIy.exe
  C:\Windows\System\ogDUoIy.exe
  2⤵
  PID:8884
- C:\Windows\System\GbjnryL.exe
  C:\Windows\System\GbjnryL.exe
  2⤵
  PID:7628
- C:\Windows\System\iZBFVlW.exe
  C:\Windows\System\iZBFVlW.exe
  2⤵
  PID:9028
- C:\Windows\System\tqtWlta.exe
  C:\Windows\System\tqtWlta.exe
  2⤵
  PID:9112
- C:\Windows\System\UveoDGr.exe
  C:\Windows\System\UveoDGr.exe
  2⤵
  PID:9188
- C:\Windows\System\Srrckan.exe
  C:\Windows\System\Srrckan.exe
  2⤵
  PID:8372
- C:\Windows\System\EYctFOu.exe
  C:\Windows\System\EYctFOu.exe
  2⤵
  PID:8444
- C:\Windows\System\KwEuvtS.exe
  C:\Windows\System\KwEuvtS.exe
  2⤵
  PID:8644
- C:\Windows\System\HjDNYCc.exe
  C:\Windows\System\HjDNYCc.exe
  2⤵
  PID:8816
- C:\Windows\System\ibEuarO.exe
  C:\Windows\System\ibEuarO.exe
  2⤵
  PID:8892
- C:\Windows\System\xACybXn.exe
  C:\Windows\System\xACybXn.exe
  2⤵
  PID:9072
- C:\Windows\System\cXZMLcM.exe
  C:\Windows\System\cXZMLcM.exe
  2⤵
  PID:8208
- C:\Windows\System\TnpFdte.exe
  C:\Windows\System\TnpFdte.exe
  2⤵
  PID:8228
- C:\Windows\System\ZfexpeN.exe
  C:\Windows\System\ZfexpeN.exe
  2⤵
  PID:8848
- C:\Windows\System\qKaGzgH.exe
  C:\Windows\System\qKaGzgH.exe
  2⤵
  PID:9124
- C:\Windows\System\rNvzwhf.exe
  C:\Windows\System\rNvzwhf.exe
  2⤵
  PID:9172
- C:\Windows\System\xqdcEHf.exe
  C:\Windows\System\xqdcEHf.exe
  2⤵
  PID:9228
- C:\Windows\System\CYhoAIW.exe
  C:\Windows\System\CYhoAIW.exe
  2⤵
  PID:9276
- C:\Windows\System\dVtCgIU.exe
  C:\Windows\System\dVtCgIU.exe
  2⤵
  PID:9304
- C:\Windows\System\myZMGTt.exe
  C:\Windows\System\myZMGTt.exe
  2⤵
  PID:9324
- C:\Windows\System\cGjUpXh.exe
  C:\Windows\System\cGjUpXh.exe
  2⤵
  PID:9352
- C:\Windows\System\fcSOCgL.exe
  C:\Windows\System\fcSOCgL.exe
  2⤵
  PID:9368
- C:\Windows\System\eFUmsrR.exe
  C:\Windows\System\eFUmsrR.exe
  2⤵
  PID:9392
- C:\Windows\System\qSBeZfM.exe
  C:\Windows\System\qSBeZfM.exe
  2⤵
  PID:9412
- C:\Windows\System\zXeQulb.exe
  C:\Windows\System\zXeQulb.exe
  2⤵
  PID:9432
- C:\Windows\System\JKZwnfP.exe
  C:\Windows\System\JKZwnfP.exe
  2⤵
  PID:9464
- C:\Windows\System\JbdQEct.exe
  C:\Windows\System\JbdQEct.exe
  2⤵
  PID:9488
- C:\Windows\System\TUgYxAa.exe
  C:\Windows\System\TUgYxAa.exe
  2⤵
  PID:9516
- C:\Windows\System\oEctzLr.exe
  C:\Windows\System\oEctzLr.exe
  2⤵
  PID:9536
- C:\Windows\System\UsCHcFy.exe
  C:\Windows\System\UsCHcFy.exe
  2⤵
  PID:9560
- C:\Windows\System\GuVZVxE.exe
  C:\Windows\System\GuVZVxE.exe
  2⤵
  PID:9584
- C:\Windows\System\Zdvxopa.exe
  C:\Windows\System\Zdvxopa.exe
  2⤵
  PID:9608
- C:\Windows\System\LTFkenk.exe
  C:\Windows\System\LTFkenk.exe
  2⤵
  PID:9628
- C:\Windows\System\qQDsBeR.exe
  C:\Windows\System\qQDsBeR.exe
  2⤵
  PID:9656
- C:\Windows\System\gYEpWJW.exe
  C:\Windows\System\gYEpWJW.exe
  2⤵
  PID:9672
- C:\Windows\System\PLqnKFS.exe
  C:\Windows\System\PLqnKFS.exe
  2⤵
  PID:9696
- C:\Windows\System\dCvNDKa.exe
  C:\Windows\System\dCvNDKa.exe
  2⤵
  PID:9716
- C:\Windows\System\RdIblwx.exe
  C:\Windows\System\RdIblwx.exe
  2⤵
  PID:9748
- C:\Windows\System\FwFVIRu.exe
  C:\Windows\System\FwFVIRu.exe
  2⤵
  PID:9776
- C:\Windows\System\AmSkwDa.exe
  C:\Windows\System\AmSkwDa.exe
  2⤵
  PID:9792
- C:\Windows\System\sNcyWYE.exe
  C:\Windows\System\sNcyWYE.exe
  2⤵
  PID:9812
- C:\Windows\System\RXiaOLS.exe
  C:\Windows\System\RXiaOLS.exe
  2⤵
  PID:9868
- C:\Windows\System\VgVpyzK.exe
  C:\Windows\System\VgVpyzK.exe
  2⤵
  PID:9884
- C:\Windows\System\heLZwjc.exe
  C:\Windows\System\heLZwjc.exe
  2⤵
  PID:9908
- C:\Windows\System\PLJrdtG.exe
  C:\Windows\System\PLJrdtG.exe
  2⤵
  PID:9936
- C:\Windows\System\lkHCfwd.exe
  C:\Windows\System\lkHCfwd.exe
  2⤵
  PID:9976
- C:\Windows\System\GtaYbbt.exe
  C:\Windows\System\GtaYbbt.exe
  2⤵
  PID:10004
- C:\Windows\System\fLYXqHA.exe
  C:\Windows\System\fLYXqHA.exe
  2⤵
  PID:10028
- C:\Windows\System\IqrOfzA.exe
  C:\Windows\System\IqrOfzA.exe
  2⤵
  PID:10056
- C:\Windows\System\BovROnh.exe
  C:\Windows\System\BovROnh.exe
  2⤵
  PID:10076
- C:\Windows\System\wLajzjn.exe
  C:\Windows\System\wLajzjn.exe
  2⤵
  PID:10100
- C:\Windows\System\KcTOcUB.exe
  C:\Windows\System\KcTOcUB.exe
  2⤵
  PID:10132
- C:\Windows\System\xYumabK.exe
  C:\Windows\System\xYumabK.exe
  2⤵
  PID:10152
- C:\Windows\System\EsPZtYc.exe
  C:\Windows\System\EsPZtYc.exe
  2⤵
  PID:10184
- C:\Windows\System\yMkWekL.exe
  C:\Windows\System\yMkWekL.exe
  2⤵
  PID:10216
- C:\Windows\System\deyLkEi.exe
  C:\Windows\System\deyLkEi.exe
  2⤵
  PID:9220
- C:\Windows\System\LvRyYZZ.exe
  C:\Windows\System\LvRyYZZ.exe
  2⤵
  PID:9272
- C:\Windows\System\LtWrzJe.exe
  C:\Windows\System\LtWrzJe.exe
  2⤵
  PID:9292
- C:\Windows\System\QWwDnau.exe
  C:\Windows\System\QWwDnau.exe
  2⤵
  PID:9336
- C:\Windows\System\RLshZiD.exe
  C:\Windows\System\RLshZiD.exe
  2⤵
  PID:9380
- C:\Windows\System\dXnjJJq.exe
  C:\Windows\System\dXnjJJq.exe
  2⤵
  PID:9424
- C:\Windows\System\JFXFYsl.exe
  C:\Windows\System\JFXFYsl.exe
  2⤵
  PID:9480
- C:\Windows\System\UrPAkLX.exe
  C:\Windows\System\UrPAkLX.exe
  2⤵
  PID:9544
- C:\Windows\System\cuJAjto.exe
  C:\Windows\System\cuJAjto.exe
  2⤵
  PID:2736
- C:\Windows\System\PRLEXaQ.exe
  C:\Windows\System\PRLEXaQ.exe
  2⤵
  PID:9644
- C:\Windows\System\JTVQkRk.exe
  C:\Windows\System\JTVQkRk.exe
  2⤵
  PID:9760
- C:\Windows\System\WoDuhzR.exe
  C:\Windows\System\WoDuhzR.exe
  2⤵
  PID:9708
- C:\Windows\System\FPqJYdI.exe
  C:\Windows\System\FPqJYdI.exe
  2⤵
  PID:9788
- C:\Windows\System\DQddnfS.exe
  C:\Windows\System\DQddnfS.exe
  2⤵
  PID:9820
- C:\Windows\System\jjodSOo.exe
  C:\Windows\System\jjodSOo.exe
  2⤵
  PID:9840
- C:\Windows\System\WDnEVRy.exe
  C:\Windows\System\WDnEVRy.exe
  2⤵
  PID:10064
- C:\Windows\System\ZwmZWDb.exe
  C:\Windows\System\ZwmZWDb.exe
  2⤵
  PID:9996
- C:\Windows\System\eDmOEsz.exe
  C:\Windows\System\eDmOEsz.exe
  2⤵
  PID:10000
- C:\Windows\System\etFXxYK.exe
  C:\Windows\System\etFXxYK.exe
  2⤵
  PID:10124
- C:\Windows\System\hlLADnN.exe
  C:\Windows\System\hlLADnN.exe
  2⤵
  PID:10172
- C:\Windows\System\BOFaryU.exe
  C:\Windows\System\BOFaryU.exe
  2⤵
  PID:10236
- C:\Windows\System\tYkeWiQ.exe
  C:\Windows\System\tYkeWiQ.exe
  2⤵
  PID:9376
- C:\Windows\System\mDfdxal.exe
  C:\Windows\System\mDfdxal.exe
  2⤵
  PID:9532
- C:\Windows\System\xnpEUqh.exe
  C:\Windows\System\xnpEUqh.exe
  2⤵
  PID:9620
- C:\Windows\System\KjZovRX.exe
  C:\Windows\System\KjZovRX.exe
  2⤵
  PID:9640
- C:\Windows\System\dIjJKuJ.exe
  C:\Windows\System\dIjJKuJ.exe
  2⤵
  PID:10148
- C:\Windows\System\fZUJNPP.exe
  C:\Windows\System\fZUJNPP.exe
  2⤵
  PID:9316
- C:\Windows\System\IdZHZWF.exe
  C:\Windows\System\IdZHZWF.exe
  2⤵
  PID:10040
- C:\Windows\System\vLePeXZ.exe
  C:\Windows\System\vLePeXZ.exe
  2⤵
  PID:10096
- C:\Windows\System\tgslqat.exe
  C:\Windows\System\tgslqat.exe
  2⤵
  PID:10256
- C:\Windows\System\NrNGokY.exe
  C:\Windows\System\NrNGokY.exe
  2⤵
  PID:10276
- C:\Windows\System\wujPFmT.exe
  C:\Windows\System\wujPFmT.exe
  2⤵
  PID:10296
- C:\Windows\System\xgzqqrk.exe
  C:\Windows\System\xgzqqrk.exe
  2⤵
  PID:10324
- C:\Windows\System\xJHmLpY.exe
  C:\Windows\System\xJHmLpY.exe
  2⤵
  PID:10356
- C:\Windows\System\lDaUVDG.exe
  C:\Windows\System\lDaUVDG.exe
  2⤵
  PID:10376
- C:\Windows\System\fnEpAPL.exe
  C:\Windows\System\fnEpAPL.exe
  2⤵
  PID:10404
- C:\Windows\System\NwJPVzx.exe
  C:\Windows\System\NwJPVzx.exe
  2⤵
  PID:10432
- C:\Windows\System\mHWLyOg.exe
  C:\Windows\System\mHWLyOg.exe
  2⤵
  PID:10448
- C:\Windows\System\mfodyka.exe
  C:\Windows\System\mfodyka.exe
  2⤵
  PID:10476
- C:\Windows\System\LUGkWRz.exe
  C:\Windows\System\LUGkWRz.exe
  2⤵
  PID:10504
- C:\Windows\System\EiBjaYi.exe
  C:\Windows\System\EiBjaYi.exe
  2⤵
  PID:10528
- C:\Windows\System\uQuDeyn.exe
  C:\Windows\System\uQuDeyn.exe
  2⤵
  PID:10552
- C:\Windows\System\aLlsEtA.exe
  C:\Windows\System\aLlsEtA.exe
  2⤵
  PID:10580
- C:\Windows\System\AmtEqKi.exe
  C:\Windows\System\AmtEqKi.exe
  2⤵
  PID:10608
- C:\Windows\System\eqiyXYD.exe
  C:\Windows\System\eqiyXYD.exe
  2⤵
  PID:10636
- C:\Windows\System\POJEvQW.exe
  C:\Windows\System\POJEvQW.exe
  2⤵
  PID:10656
- C:\Windows\System\PqiDldt.exe
  C:\Windows\System\PqiDldt.exe
  2⤵
  PID:10672
- C:\Windows\System\DSZewek.exe
  C:\Windows\System\DSZewek.exe
  2⤵
  PID:10696
- C:\Windows\System\tPSuBLO.exe
  C:\Windows\System\tPSuBLO.exe
  2⤵
  PID:10716
- C:\Windows\System\unxTpgn.exe
  C:\Windows\System\unxTpgn.exe
  2⤵
  PID:10736
- C:\Windows\System\cyJPQKV.exe
  C:\Windows\System\cyJPQKV.exe
  2⤵
  PID:10756
- C:\Windows\System\PivfhbG.exe
  C:\Windows\System\PivfhbG.exe
  2⤵
  PID:10792
- C:\Windows\System\qxfDNdR.exe
  C:\Windows\System\qxfDNdR.exe
  2⤵
  PID:10812
- C:\Windows\System\yNVTopf.exe
  C:\Windows\System\yNVTopf.exe
  2⤵
  PID:10836
- C:\Windows\System\BeEreby.exe
  C:\Windows\System\BeEreby.exe
  2⤵
  PID:10856
- C:\Windows\System\XrTjXAL.exe
  C:\Windows\System\XrTjXAL.exe
  2⤵
  PID:10880
- C:\Windows\System\MMiVqWh.exe
  C:\Windows\System\MMiVqWh.exe
  2⤵
  PID:10908
- C:\Windows\System\cYllObT.exe
  C:\Windows\System\cYllObT.exe
  2⤵
  PID:10924
- C:\Windows\System\xZShoAc.exe
  C:\Windows\System\xZShoAc.exe
  2⤵
  PID:10952
- C:\Windows\System\GmKdwZw.exe
  C:\Windows\System\GmKdwZw.exe
  2⤵
  PID:10976
- C:\Windows\System\VaXwUzx.exe
  C:\Windows\System\VaXwUzx.exe
  2⤵
  PID:11012
- C:\Windows\System\BlfJDur.exe
  C:\Windows\System\BlfJDur.exe
  2⤵
  PID:11036
- C:\Windows\System\LQbcqKf.exe
  C:\Windows\System\LQbcqKf.exe
  2⤵
  PID:11140
- C:\Windows\System\rWwpAAb.exe
  C:\Windows\System\rWwpAAb.exe
  2⤵
  PID:11176
- C:\Windows\System\dlKejGt.exe
  C:\Windows\System\dlKejGt.exe
  2⤵
  PID:11204
- C:\Windows\System\mDhMvYB.exe
  C:\Windows\System\mDhMvYB.exe
  2⤵
  PID:11232
- C:\Windows\System\ioVncRY.exe
  C:\Windows\System\ioVncRY.exe
  2⤵
  PID:5032
- C:\Windows\System\zrkEdHX.exe
  C:\Windows\System\zrkEdHX.exe
  2⤵
  PID:10196
- C:\Windows\System\fCpOiqk.exe
  C:\Windows\System\fCpOiqk.exe
  2⤵
  PID:9076
- C:\Windows\System\wGzICmN.exe
  C:\Windows\System\wGzICmN.exe
  2⤵
  PID:10364
- C:\Windows\System\eecRPrJ.exe
  C:\Windows\System\eecRPrJ.exe
  2⤵
  PID:9576
- C:\Windows\System\bbaIgGm.exe
  C:\Windows\System\bbaIgGm.exe
  2⤵
  PID:10252
- C:\Windows\System\iBLweXs.exe
  C:\Windows\System\iBLweXs.exe
  2⤵
  PID:10348
- C:\Windows\System\uaZhkmV.exe
  C:\Windows\System\uaZhkmV.exe
  2⤵
  PID:10568
- C:\Windows\System\peUNoMV.exe
  C:\Windows\System\peUNoMV.exe
  2⤵
  PID:10616
- C:\Windows\System\VhTqJUZ.exe
  C:\Windows\System\VhTqJUZ.exe
  2⤵
  PID:10664
- C:\Windows\System\mwgCUCw.exe
  C:\Windows\System\mwgCUCw.exe
  2⤵
  PID:10728
- C:\Windows\System\UwXxLgO.exe
  C:\Windows\System\UwXxLgO.exe
  2⤵
  PID:10864
- C:\Windows\System\WZAEBdm.exe
  C:\Windows\System\WZAEBdm.exe
  2⤵
  PID:10688
- C:\Windows\System\ldUniTV.exe
  C:\Windows\System\ldUniTV.exe
  2⤵
  PID:10724
- C:\Windows\System\DzkzJxm.exe
  C:\Windows\System\DzkzJxm.exe
  2⤵
  PID:10632
- C:\Windows\System\mnuAuem.exe
  C:\Windows\System\mnuAuem.exe
  2⤵
  PID:10892
- C:\Windows\System\vxvwrFB.exe
  C:\Windows\System\vxvwrFB.exe
  2⤵
  PID:10920
- C:\Windows\System\Hbrdwtt.exe
  C:\Windows\System\Hbrdwtt.exe
  2⤵
  PID:10752
- C:\Windows\System\rEeiudi.exe
  C:\Windows\System\rEeiudi.exe
  2⤵
  PID:10828
- C:\Windows\System\GbaBXAA.exe
  C:\Windows\System\GbaBXAA.exe
  2⤵
  PID:10916
- C:\Windows\System\FxWswpu.exe
  C:\Windows\System\FxWswpu.exe
  2⤵
  PID:10972
- C:\Windows\System\MzJTsNS.exe
  C:\Windows\System\MzJTsNS.exe
  2⤵
  PID:11132
- C:\Windows\System\XfmSvxl.exe
  C:\Windows\System\XfmSvxl.exe
  2⤵
  PID:11188
- C:\Windows\System\xNKWrju.exe
  C:\Windows\System\xNKWrju.exe
  2⤵
  PID:11268
- C:\Windows\System\UtAXElv.exe
  C:\Windows\System\UtAXElv.exe
  2⤵
  PID:11288
- C:\Windows\System\dCBiWsL.exe
  C:\Windows\System\dCBiWsL.exe
  2⤵
  PID:11308
- C:\Windows\System\DDVaNdU.exe
  C:\Windows\System\DDVaNdU.exe
  2⤵
  PID:11332
- C:\Windows\System\FXdtzsv.exe
  C:\Windows\System\FXdtzsv.exe
  2⤵
  PID:11360
- C:\Windows\System\WoysaLi.exe
  C:\Windows\System\WoysaLi.exe
  2⤵
  PID:11380
- C:\Windows\System\ZzTwkTw.exe
  C:\Windows\System\ZzTwkTw.exe
  2⤵
  PID:11400
- C:\Windows\System\uQZUnzV.exe
  C:\Windows\System\uQZUnzV.exe
  2⤵
  PID:11500
- C:\Windows\System\mLxFKOU.exe
  C:\Windows\System\mLxFKOU.exe
  2⤵
  PID:11520
- C:\Windows\System\uMkYxqv.exe
  C:\Windows\System\uMkYxqv.exe
  2⤵
  PID:11544
- C:\Windows\System\TxmoxBP.exe
  C:\Windows\System\TxmoxBP.exe
  2⤵
  PID:11572
- C:\Windows\System\HLAernn.exe
  C:\Windows\System\HLAernn.exe
  2⤵
  PID:11596
- C:\Windows\System\PwkvhFS.exe
  C:\Windows\System\PwkvhFS.exe
  2⤵
  PID:11624
- C:\Windows\System\lHwVxbr.exe
  C:\Windows\System\lHwVxbr.exe
  2⤵
  PID:11664
- C:\Windows\System\UmgoKDZ.exe
  C:\Windows\System\UmgoKDZ.exe
  2⤵
  PID:11716
- C:\Windows\System\iwzjRTf.exe
  C:\Windows\System\iwzjRTf.exe
  2⤵
  PID:11740
- C:\Windows\System\RkceQmO.exe
  C:\Windows\System\RkceQmO.exe
  2⤵
  PID:11776
- C:\Windows\System\yasMUev.exe
  C:\Windows\System\yasMUev.exe
  2⤵
  PID:11884
- C:\Windows\System\CytJuXr.exe
  C:\Windows\System\CytJuXr.exe
  2⤵
  PID:11908
- C:\Windows\System\QtijeAj.exe
  C:\Windows\System\QtijeAj.exe
  2⤵
  PID:11940
- C:\Windows\System\jUvJDxr.exe
  C:\Windows\System\jUvJDxr.exe
  2⤵
  PID:11964
- C:\Windows\System\TIMlBuh.exe
  C:\Windows\System\TIMlBuh.exe
  2⤵
  PID:11988
- C:\Windows\System\aMfIuwo.exe
  C:\Windows\System\aMfIuwo.exe
  2⤵
  PID:12008
- C:\Windows\System\LPVsCTD.exe
  C:\Windows\System\LPVsCTD.exe
  2⤵
  PID:12036
- C:\Windows\System\TIQdyeF.exe
  C:\Windows\System\TIQdyeF.exe
  2⤵
  PID:12060
- C:\Windows\System\XVxEtfs.exe
  C:\Windows\System\XVxEtfs.exe
  2⤵
  PID:12084
- C:\Windows\System\KRRXsAs.exe
  C:\Windows\System\KRRXsAs.exe
  2⤵
  PID:12116
- C:\Windows\System\TvVABFq.exe
  C:\Windows\System\TvVABFq.exe
  2⤵
  PID:12144
- C:\Windows\System\YRdCDUa.exe
  C:\Windows\System\YRdCDUa.exe
  2⤵
  PID:12168
- C:\Windows\System\HLbsmHs.exe
  C:\Windows\System\HLbsmHs.exe
  2⤵
  PID:12192
- C:\Windows\System\IldKKSj.exe
  C:\Windows\System\IldKKSj.exe
  2⤵
  PID:12212
- C:\Windows\System\EfftxGX.exe
  C:\Windows\System\EfftxGX.exe
  2⤵
  PID:12236
- C:\Windows\System\EhEYYBW.exe
  C:\Windows\System\EhEYYBW.exe
  2⤵
  PID:12260
- C:\Windows\System\OxXFcaG.exe
  C:\Windows\System\OxXFcaG.exe
  2⤵
  PID:12280
- C:\Windows\System\WOZmpbC.exe
  C:\Windows\System\WOZmpbC.exe
  2⤵
  PID:11004
- C:\Windows\System\XdwEWAY.exe
  C:\Windows\System\XdwEWAY.exe
  2⤵
  PID:10940
- C:\Windows\System\Ivbthnt.exe
  C:\Windows\System\Ivbthnt.exe
  2⤵
  PID:10964
- C:\Windows\System\lGChCjE.exe
  C:\Windows\System\lGChCjE.exe
  2⤵
  PID:10288
- C:\Windows\System\BHMtIVd.exe
  C:\Windows\System\BHMtIVd.exe
  2⤵
  PID:11372
- C:\Windows\System\zlZoyYA.exe
  C:\Windows\System\zlZoyYA.exe
  2⤵
  PID:9692
- C:\Windows\System\FSJoFUk.exe
  C:\Windows\System\FSJoFUk.exe
  2⤵
  PID:10372
- C:\Windows\System\NbKrPOh.exe
  C:\Windows\System\NbKrPOh.exe
  2⤵
  PID:10420
- C:\Windows\System\YRwagzR.exe
  C:\Windows\System\YRwagzR.exe
  2⤵
  PID:10464
- C:\Windows\System\ypkUdDc.exe
  C:\Windows\System\ypkUdDc.exe
  2⤵
  PID:11344
- C:\Windows\System\iAyDwvm.exe
  C:\Windows\System\iAyDwvm.exe
  2⤵
  PID:11484
- C:\Windows\System\UVMnVhT.exe
  C:\Windows\System\UVMnVhT.exe
  2⤵
  PID:11212
- C:\Windows\System\ePLYnaD.exe
  C:\Windows\System\ePLYnaD.exe
  2⤵
  PID:11352
- C:\Windows\System\jGVyoqa.exe
  C:\Windows\System\jGVyoqa.exe
  2⤵
  PID:11784
- C:\Windows\System\piXuqny.exe
  C:\Windows\System\piXuqny.exe
  2⤵
  PID:11672
- C:\Windows\System\hZUEiWl.exe
  C:\Windows\System\hZUEiWl.exe
  2⤵
  PID:11748
- C:\Windows\System\iMrUStH.exe
  C:\Windows\System\iMrUStH.exe
  2⤵
  PID:11876
- C:\Windows\System\mIgGmhY.exe
  C:\Windows\System\mIgGmhY.exe
  2⤵
  PID:11560
- C:\Windows\System\PUoPPlH.exe
  C:\Windows\System\PUoPPlH.exe
  2⤵
  PID:11620
- C:\Windows\System\jISyzUq.exe
  C:\Windows\System\jISyzUq.exe
  2⤵
  PID:11728
- C:\Windows\System\rnyvFer.exe
  C:\Windows\System\rnyvFer.exe
  2⤵
  PID:12076
- C:\Windows\System\OjNUcKF.exe
  C:\Windows\System\OjNUcKF.exe
  2⤵
  PID:11820
- C:\Windows\System\dPHOqrA.exe
  C:\Windows\System\dPHOqrA.exe
  2⤵
  PID:12176
- C:\Windows\System\rGpZPdD.exe
  C:\Windows\System\rGpZPdD.exe
  2⤵
  PID:11864
- C:\Windows\System\sjekJUF.exe
  C:\Windows\System\sjekJUF.exe
  2⤵
  PID:12128
- C:\Windows\System\QaUKmSg.exe
  C:\Windows\System\QaUKmSg.exe
  2⤵
  PID:12020
- C:\Windows\System\FQzntRl.exe
  C:\Windows\System\FQzntRl.exe
  2⤵
  PID:12056
- C:\Windows\System\ukxWAcB.exe
  C:\Windows\System\ukxWAcB.exe
  2⤵
  PID:10492
- C:\Windows\System\YihCdma.exe
  C:\Windows\System\YihCdma.exe
  2⤵
  PID:11300
- C:\Windows\System\aMjYugP.exe
  C:\Windows\System\aMjYugP.exe
  2⤵
  PID:12152
- C:\Windows\System\xHxIdxm.exe
  C:\Windows\System\xHxIdxm.exe
  2⤵
  PID:12204
- C:\Windows\System\NEyuegH.exe
  C:\Windows\System\NEyuegH.exe
  2⤵
  PID:9548
- C:\Windows\System\pdvEEmN.exe
  C:\Windows\System\pdvEEmN.exe
  2⤵
  PID:11768
- C:\Windows\System\IkESewz.exe
  C:\Windows\System\IkESewz.exe
  2⤵
  PID:12316
- C:\Windows\System\ioxbAlV.exe
  C:\Windows\System\ioxbAlV.exe
  2⤵
  PID:12336
- C:\Windows\System\UzjIRmi.exe
  C:\Windows\System\UzjIRmi.exe
  2⤵
  PID:12364
- C:\Windows\System\LYkyFaz.exe
  C:\Windows\System\LYkyFaz.exe
  2⤵
  PID:12476
- C:\Windows\System\BNVpMzb.exe
  C:\Windows\System\BNVpMzb.exe
  2⤵
  PID:12500
- C:\Windows\System\vARUSRm.exe
  C:\Windows\System\vARUSRm.exe
  2⤵
  PID:12528
- C:\Windows\System\eAPQLZQ.exe
  C:\Windows\System\eAPQLZQ.exe
  2⤵
  PID:12544
- C:\Windows\System\NIrGOAD.exe
  C:\Windows\System\NIrGOAD.exe
  2⤵
  PID:12744
- C:\Windows\System\KinuvGx.exe
  C:\Windows\System\KinuvGx.exe
  2⤵
  PID:12764
- C:\Windows\System\BChtxYV.exe
  C:\Windows\System\BChtxYV.exe
  2⤵
  PID:12856
- C:\Windows\System\vQgtsVl.exe
  C:\Windows\System\vQgtsVl.exe
  2⤵
  PID:12880
- C:\Windows\System\WYDIEnq.exe
  C:\Windows\System\WYDIEnq.exe
  2⤵
  PID:12996
- C:\Windows\System\FUonIdR.exe
  C:\Windows\System\FUonIdR.exe
  2⤵
  PID:13020
- C:\Windows\System\EgbmgYU.exe
  C:\Windows\System\EgbmgYU.exe
  2⤵
  PID:13040
- C:\Windows\System\mllUzck.exe
  C:\Windows\System\mllUzck.exe
  2⤵
  PID:13068
- C:\Windows\System\WvNMLUV.exe
  C:\Windows\System\WvNMLUV.exe
  2⤵
  PID:13092
- C:\Windows\System\TrAIENW.exe
  C:\Windows\System\TrAIENW.exe
  2⤵
  PID:13132
- C:\Windows\System\xEvYLVY.exe
  C:\Windows\System\xEvYLVY.exe
  2⤵
  PID:13152
- C:\Windows\System\JYoPmXD.exe
  C:\Windows\System\JYoPmXD.exe
  2⤵
  PID:13204
- C:\Windows\System\kmFWjYQ.exe
  C:\Windows\System\kmFWjYQ.exe
  2⤵
  PID:13244
- C:\Windows\System\ArLfbzZ.exe
  C:\Windows\System\ArLfbzZ.exe
  2⤵
  PID:13280
- C:\Windows\System\ciHEmdn.exe
  C:\Windows\System\ciHEmdn.exe
  2⤵
  PID:12256
- C:\Windows\System\hcLaUdp.exe
  C:\Windows\System\hcLaUdp.exe
  2⤵
  PID:10900
- C:\Windows\System\wWWKHcT.exe
  C:\Windows\System\wWWKHcT.exe
  2⤵
  PID:11368
- C:\Windows\System\RlAimXl.exe
  C:\Windows\System\RlAimXl.exe
  2⤵
  PID:10012
- C:\Windows\System\gfEXXGJ.exe
  C:\Windows\System\gfEXXGJ.exe
  2⤵
  PID:12356
- C:\Windows\System\rJiaimH.exe
  C:\Windows\System\rJiaimH.exe
  2⤵
  PID:11340
- C:\Windows\System\ufJpmWX.exe
  C:\Windows\System\ufJpmWX.exe
  2⤵
  PID:11508
- C:\Windows\System\afPkhRG.exe
  C:\Windows\System\afPkhRG.exe
  2⤵
  PID:11540
- C:\Windows\System\EeZQrkv.exe
  C:\Windows\System\EeZQrkv.exe
  2⤵
  PID:12380
- C:\Windows\System\jIRGeGj.exe
  C:\Windows\System\jIRGeGj.exe
  2⤵
  PID:10536
- C:\Windows\System\ZQzhmod.exe
  C:\Windows\System\ZQzhmod.exe
  2⤵
  PID:12328
- C:\Windows\System\mzCAmKu.exe
  C:\Windows\System\mzCAmKu.exe
  2⤵
  PID:12508
- C:\Windows\System\kDqpWpE.exe
  C:\Windows\System\kDqpWpE.exe
  2⤵
  PID:12488
- C:\Windows\System\UhoFzIr.exe
  C:\Windows\System\UhoFzIr.exe
  2⤵
  PID:12536
- C:\Windows\System\iTutClf.exe
  C:\Windows\System\iTutClf.exe
  2⤵
  PID:12976
- C:\Windows\System\DHjQVJx.exe
  C:\Windows\System\DHjQVJx.exe
  2⤵
  PID:12792
- C:\Windows\System\oVTHlqy.exe
  C:\Windows\System\oVTHlqy.exe
  2⤵
  PID:12852
- C:\Windows\System\ntoMcNV.exe
  C:\Windows\System\ntoMcNV.exe
  2⤵
  PID:12972
- C:\Windows\System\fmXEoLU.exe
  C:\Windows\System\fmXEoLU.exe
  2⤵
  PID:13036
- C:\Windows\System\IccOCSP.exe
  C:\Windows\System\IccOCSP.exe
  2⤵
  PID:13076
- C:\Windows\System\BvNZRYL.exe
  C:\Windows\System\BvNZRYL.exe
  2⤵
  PID:13148
- C:\Windows\System\RVovEDV.exe
  C:\Windows\System\RVovEDV.exe
  2⤵
  PID:13288
- C:\Windows\System\iaoxMEI.exe
  C:\Windows\System\iaoxMEI.exe
  2⤵
  PID:13236
- C:\Windows\System\ZNmKfUY.exe
  C:\Windows\System\ZNmKfUY.exe
  2⤵
  PID:13268
- C:\Windows\System\AePdXxl.exe
  C:\Windows\System\AePdXxl.exe
  2⤵
  PID:11280
- C:\Windows\System\FPRCVJg.exe
  C:\Windows\System\FPRCVJg.exe
  2⤵
  PID:12352
- C:\Windows\System\hgeFSdZ.exe
  C:\Windows\System\hgeFSdZ.exe
  2⤵
  PID:12376
- C:\Windows\System\rwYzfVf.exe
  C:\Windows\System\rwYzfVf.exe
  2⤵
  PID:11644
- C:\Windows\System\wrUgjFy.exe
  C:\Windows\System\wrUgjFy.exe
  2⤵
  PID:10944
- C:\Windows\System\CBQHifm.exe
  C:\Windows\System\CBQHifm.exe
  2⤵
  PID:12436
- C:\Windows\System\mkpYTTo.exe
  C:\Windows\System\mkpYTTo.exe
  2⤵
  PID:12868
- C:\Windows\System\AksHbEO.exe
  C:\Windows\System\AksHbEO.exe
  2⤵
  PID:12908
- C:\Windows\System\kOhZFJV.exe
  C:\Windows\System\kOhZFJV.exe
  2⤵
  PID:13008
- C:\Windows\System\wuivUKU.exe
  C:\Windows\System\wuivUKU.exe
  2⤵
  PID:13056
- C:\Windows\System\ettHSKi.exe
  C:\Windows\System\ettHSKi.exe
  2⤵
  PID:13144
- C:\Windows\System\WQcKRot.exe
  C:\Windows\System\WQcKRot.exe
  2⤵
  PID:13216
- C:\Windows\System\SazAOhz.exe
  C:\Windows\System\SazAOhz.exe
  2⤵
  PID:10332
- C:\Windows\System\yNAegDd.exe
  C:\Windows\System\yNAegDd.exe
  2⤵
  PID:10204
- C:\Windows\System\XubWRRm.exe
  C:\Windows\System\XubWRRm.exe
  2⤵
  PID:11996
- C:\Windows\System\vTWoaDr.exe
  C:\Windows\System\vTWoaDr.exe
  2⤵
  PID:13324
- C:\Windows\System\BbaCROd.exe
  C:\Windows\System\BbaCROd.exe
  2⤵
  PID:13340
- C:\Windows\System\ikwhpQK.exe
  C:\Windows\System\ikwhpQK.exe
  2⤵
  PID:13372
- C:\Windows\System\nShZpfJ.exe
  C:\Windows\System\nShZpfJ.exe
  2⤵
  PID:13396
- C:\Windows\System\lUFGVtc.exe
  C:\Windows\System\lUFGVtc.exe
  2⤵
  PID:13420
- C:\Windows\System\uXgzijd.exe
  C:\Windows\System\uXgzijd.exe
  2⤵
  PID:13448
- C:\Windows\System\tDisMRP.exe
  C:\Windows\System\tDisMRP.exe
  2⤵
  PID:13464
- C:\Windows\System\sdqdYKL.exe
  C:\Windows\System\sdqdYKL.exe
  2⤵
  PID:13496
- C:\Windows\System\icpZNau.exe
  C:\Windows\System\icpZNau.exe
  2⤵
  PID:13516
- C:\Windows\System\tFdxFWc.exe
  C:\Windows\System\tFdxFWc.exe
  2⤵
  PID:13544
- C:\Windows\System\bYEyrDs.exe
  C:\Windows\System\bYEyrDs.exe
  2⤵
  PID:13568
- C:\Windows\System\BBHPgil.exe
  C:\Windows\System\BBHPgil.exe
  2⤵
  PID:13596
- C:\Windows\System\kForRxy.exe
  C:\Windows\System\kForRxy.exe
  2⤵
  PID:13612
- C:\Windows\System\iGtPRHF.exe
  C:\Windows\System\iGtPRHF.exe
  2⤵
  PID:13628
- C:\Windows\System\ffjOfvw.exe
  C:\Windows\System\ffjOfvw.exe
  2⤵
  PID:13648
- C:\Windows\System\LNDWkoO.exe
  C:\Windows\System\LNDWkoO.exe
  2⤵
  PID:13676
- C:\Windows\System\jlhVznk.exe
  C:\Windows\System\jlhVznk.exe
  2⤵
  PID:13696
- C:\Windows\System\IMrWKPZ.exe
  C:\Windows\System\IMrWKPZ.exe
  2⤵
  PID:13712
- C:\Windows\System\aXXWskZ.exe
  C:\Windows\System\aXXWskZ.exe
  2⤵
  PID:13732
- C:\Windows\System\EWjXjAc.exe
  C:\Windows\System\EWjXjAc.exe
  2⤵
  PID:13764
- C:\Windows\System\GxPhodJ.exe
  C:\Windows\System\GxPhodJ.exe
  2⤵
  PID:13784
- C:\Windows\System\JVbbwJX.exe
  C:\Windows\System\JVbbwJX.exe
  2⤵
  PID:13800
- C:\Windows\System\CqAjiUW.exe
  C:\Windows\System\CqAjiUW.exe
  2⤵
  PID:13820
- C:\Windows\System\THoxKKv.exe
  C:\Windows\System\THoxKKv.exe
  2⤵
  PID:13836
- C:\Windows\System\WaACMms.exe
  C:\Windows\System\WaACMms.exe
  2⤵
  PID:13852
- C:\Windows\System\yPMXfOA.exe
  C:\Windows\System\yPMXfOA.exe
  2⤵
  PID:13872
- C:\Windows\System\YRWlFJC.exe
  C:\Windows\System\YRWlFJC.exe
  2⤵
  PID:13888
- C:\Windows\System\bganjkn.exe
  C:\Windows\System\bganjkn.exe
  2⤵
  PID:13912
- C:\Windows\System\jrclKaU.exe
  C:\Windows\System\jrclKaU.exe
  2⤵
  PID:13940
- C:\Windows\System\aitPPtJ.exe
  C:\Windows\System\aitPPtJ.exe
  2⤵
  PID:13956
- C:\Windows\System\uEXwalD.exe
  C:\Windows\System\uEXwalD.exe
  2⤵
  PID:13972
- C:\Windows\System\nsJaFkO.exe
  C:\Windows\System\nsJaFkO.exe
  2⤵
  PID:14000
- C:\Windows\System\bJultYa.exe
  C:\Windows\System\bJultYa.exe
  2⤵
  PID:14016
- C:\Windows\System\sfGtUVI.exe
  C:\Windows\System\sfGtUVI.exe
  2⤵
  PID:14040
- C:\Windows\System\onkvafM.exe
  C:\Windows\System\onkvafM.exe
  2⤵
  PID:14068
- C:\Windows\System\arkTchJ.exe
  C:\Windows\System\arkTchJ.exe
  2⤵
  PID:14092
- C:\Windows\System\ZVxdMij.exe
  C:\Windows\System\ZVxdMij.exe
  2⤵
  PID:14116
- C:\Windows\System\PtVnDOA.exe
  C:\Windows\System\PtVnDOA.exe
  2⤵
  PID:14144
- C:\Windows\System\qfdArsy.exe
  C:\Windows\System\qfdArsy.exe
  2⤵
  PID:14172
- C:\Windows\System\gopGGWf.exe
  C:\Windows\System\gopGGWf.exe
  2⤵
  PID:14204
- C:\Windows\System\JnsoICa.exe
  C:\Windows\System\JnsoICa.exe
  2⤵
  PID:14240
- C:\Windows\System\MMiwflM.exe
  C:\Windows\System\MMiwflM.exe
  2⤵
  PID:14268
- C:\Windows\System\iTLiodt.exe
  C:\Windows\System\iTLiodt.exe
  2⤵
  PID:14292
- C:\Windows\System\sIZInLh.exe
  C:\Windows\System\sIZInLh.exe
  2⤵
  PID:14320
- C:\Windows\System\XLOJhDx.exe
  C:\Windows\System\XLOJhDx.exe
  2⤵
  PID:12912
- C:\Windows\System\fviCrAC.exe
  C:\Windows\System\fviCrAC.exe
  2⤵
  PID:13088
- C:\Windows\System\oDGeXlJ.exe
  C:\Windows\System\oDGeXlJ.exe
  2⤵
  PID:12424
- C:\Windows\System\BZTyggw.exe
  C:\Windows\System\BZTyggw.exe
  2⤵
  PID:13392
- C:\Windows\System\GVVRWtj.exe
  C:\Windows\System\GVVRWtj.exe
  2⤵
  PID:11872
- C:\Windows\System\jqcPqOs.exe
  C:\Windows\System\jqcPqOs.exe
  2⤵
  PID:13112
- C:\Windows\System\JJvSvCy.exe
  C:\Windows\System\JJvSvCy.exe
  2⤵
  PID:13364
- C:\Windows\System\XuYVSBh.exe
  C:\Windows\System\XuYVSBh.exe
  2⤵
  PID:13552
- C:\Windows\System\cYZBuYZ.exe
  C:\Windows\System\cYZBuYZ.exe
  2⤵
  PID:13484
- C:\Windows\System\zfoIQBR.exe
  C:\Windows\System\zfoIQBR.exe
  2⤵
  PID:13528
- C:\Windows\System\EkaGYuP.exe
  C:\Windows\System\EkaGYuP.exe
  2⤵
  PID:13604
- C:\Windows\System\JWFlDlV.exe
  C:\Windows\System\JWFlDlV.exe
  2⤵
  PID:13664
- C:\Windows\System\XXzZiRk.exe
  C:\Windows\System\XXzZiRk.exe
  2⤵
  PID:13720
- C:\Windows\System\oMoZNlq.exe
  C:\Windows\System\oMoZNlq.exe
  2⤵
  PID:13760
- C:\Windows\System\JerKUZw.exe
  C:\Windows\System\JerKUZw.exe
  2⤵
  PID:13928
- C:\Windows\System\zwKTEHF.exe
  C:\Windows\System\zwKTEHF.exe
  2⤵
  PID:14112
- C:\Windows\System\TVYsmox.exe
  C:\Windows\System\TVYsmox.exe
  2⤵
  PID:14008
- C:\Windows\System\xKbfkFZ.exe
  C:\Windows\System\xKbfkFZ.exe
  2⤵
  PID:14264
- C:\Windows\System\bvBhYOa.exe
  C:\Windows\System\bvBhYOa.exe
  2⤵
  PID:14052
- C:\Windows\System\rIaLCdV.exe
  C:\Windows\System\rIaLCdV.exe
  2⤵
  PID:13252
- C:\Windows\System\eABHWSM.exe
  C:\Windows\System\eABHWSM.exe
  2⤵
  PID:14012
- C:\Windows\System\FIphEvY.exe
  C:\Windows\System\FIphEvY.exe
  2⤵
  PID:14356
- C:\Windows\System\vjgsWCk.exe
  C:\Windows\System\vjgsWCk.exe
  2⤵
  PID:14388
- C:\Windows\System\GAaovUS.exe
  C:\Windows\System\GAaovUS.exe
  2⤵
  PID:14408
- C:\Windows\System\aDznfcJ.exe
  C:\Windows\System\aDznfcJ.exe
  2⤵
  PID:14432
- C:\Windows\System\HAibDnq.exe
  C:\Windows\System\HAibDnq.exe
  2⤵
  PID:14456
- C:\Windows\System\URBGmLQ.exe
  C:\Windows\System\URBGmLQ.exe
  2⤵
  PID:14472
- C:\Windows\System\apaxxsF.exe
  C:\Windows\System\apaxxsF.exe
  2⤵
  PID:14492
- C:\Windows\System\lpLkuxS.exe
  C:\Windows\System\lpLkuxS.exe
  2⤵
  PID:14520
- C:\Windows\System\eanVvEB.exe
  C:\Windows\System\eanVvEB.exe
  2⤵
  PID:14548
- C:\Windows\System\sgRwOCn.exe
  C:\Windows\System\sgRwOCn.exe
  2⤵
  PID:14576
- C:\Windows\System\AMHaJHw.exe
  C:\Windows\System\AMHaJHw.exe
  2⤵
  PID:14596
- C:\Windows\System\LzWlqzp.exe
  C:\Windows\System\LzWlqzp.exe
  2⤵
  PID:14616
- C:\Windows\System\cPgXhdu.exe
  C:\Windows\System\cPgXhdu.exe
  2⤵
  PID:14632
- C:\Windows\System\FkFTCcQ.exe
  C:\Windows\System\FkFTCcQ.exe
  2⤵
  PID:14648
- C:\Windows\System\NGYfHqq.exe
  C:\Windows\System\NGYfHqq.exe
  2⤵
  PID:14668
- C:\Windows\System\rsMJugE.exe
  C:\Windows\System\rsMJugE.exe
  2⤵
  PID:14700
- C:\Windows\System\jPVQaIh.exe
  C:\Windows\System\jPVQaIh.exe
  2⤵
  PID:14720
- C:\Windows\System\mNejvKc.exe
  C:\Windows\System\mNejvKc.exe
  2⤵
  PID:14752
- C:\Windows\System\MDtAkcE.exe
  C:\Windows\System\MDtAkcE.exe
  2⤵
  PID:14776
- C:\Windows\System\NWTwaCq.exe
  C:\Windows\System\NWTwaCq.exe
  2⤵
  PID:14796
- C:\Windows\System\bgCgYNg.exe
  C:\Windows\System\bgCgYNg.exe
  2⤵
  PID:14812
- C:\Windows\System\YtmRLEG.exe
  C:\Windows\System\YtmRLEG.exe
  2⤵
  PID:14832
- C:\Windows\System\CMREKxl.exe
  C:\Windows\System\CMREKxl.exe
  2⤵
  PID:14872
- C:\Windows\System\rKJHtAZ.exe
  C:\Windows\System\rKJHtAZ.exe
  2⤵
  PID:15012
- C:\Windows\System\nDuDPZj.exe
  C:\Windows\System\nDuDPZj.exe
  2⤵
  PID:15036
- C:\Windows\System\PPdAUOK.exe
  C:\Windows\System\PPdAUOK.exe
  2⤵
  PID:15056
- C:\Windows\System\ZBJDSMc.exe
  C:\Windows\System\ZBJDSMc.exe
  2⤵
  PID:15076
- C:\Windows\System\UExNgDd.exe
  C:\Windows\System\UExNgDd.exe
  2⤵
  PID:15104
- C:\Windows\System\vjumvnj.exe
  C:\Windows\System\vjumvnj.exe
  2⤵
  PID:15124
- C:\Windows\System\qWkUqnB.exe
  C:\Windows\System\qWkUqnB.exe
  2⤵
  PID:15164
- C:\Windows\System\pASrGvB.exe
  C:\Windows\System\pASrGvB.exe
  2⤵
  PID:15200
- C:\Windows\System\ZUMGtWI.exe
  C:\Windows\System\ZUMGtWI.exe
  2⤵
  PID:15236
- C:\Windows\System\ZvhmgoA.exe
  C:\Windows\System\ZvhmgoA.exe
  2⤵
  PID:15280
- C:\Windows\System\KmYVFar.exe
  C:\Windows\System\KmYVFar.exe
  2⤵
  PID:15308
- C:\Windows\System\owNYBmL.exe
  C:\Windows\System\owNYBmL.exe
  2⤵
  PID:15340
- C:\Windows\System\YudatvT.exe
  C:\Windows\System\YudatvT.exe
  2⤵
  PID:13540
- C:\Windows\System\EASbdvK.exe
  C:\Windows\System\EASbdvK.exe
  2⤵
  PID:14300
- C:\Windows\System\CBWJoAO.exe
  C:\Windows\System\CBWJoAO.exe
  2⤵
  PID:13052
- C:\Windows\System\WLBwcwj.exe
  C:\Windows\System\WLBwcwj.exe
  2⤵
  PID:14248
- C:\Windows\System\GtUloKV.exe
  C:\Windows\System\GtUloKV.exe
  2⤵
  PID:14312
- C:\Windows\System\sPSVDCk.exe
  C:\Windows\System\sPSVDCk.exe
  2⤵
  PID:13384
- C:\Windows\System\JIfoBHv.exe
  C:\Windows\System\JIfoBHv.exe
  2⤵
  PID:14628
- C:\Windows\System\vPVveWC.exe
  C:\Windows\System\vPVveWC.exe
  2⤵
  PID:13580
- C:\Windows\System\eJcBvlf.exe
  C:\Windows\System\eJcBvlf.exe
  2⤵
  PID:13560
- C:\Windows\System\GWTpdIi.exe
  C:\Windows\System\GWTpdIi.exe
  2⤵
  PID:13812
- C:\Windows\System\RvQAiCe.exe
  C:\Windows\System\RvQAiCe.exe
  2⤵
  PID:13952
- C:\Windows\System\hLLQtCX.exe
  C:\Windows\System\hLLQtCX.exe
  2⤵
  PID:14840
- C:\Windows\System\ZzADtbg.exe
  C:\Windows\System\ZzADtbg.exe
  2⤵
  PID:14348
- C:\Windows\System\HZqbYEt.exe
  C:\Windows\System\HZqbYEt.exe
  2⤵
  PID:14384
- C:\Windows\System\JnjyjYz.exe
  C:\Windows\System\JnjyjYz.exe
  2⤵
  PID:14428
- C:\Windows\System\uutbPgS.exe
  C:\Windows\System\uutbPgS.exe
  2⤵
  PID:14784
- C:\Windows\System\NHoMTXS.exe
  C:\Windows\System\NHoMTXS.exe
  2⤵
  PID:14508
- C:\Windows\System\UpamgVu.exe
  C:\Windows\System\UpamgVu.exe
  2⤵
  PID:14880
- C:\Windows\System\PQGsvfm.exe
  C:\Windows\System\PQGsvfm.exe
  2⤵
  PID:14760
- C:\Windows\System\vWmbxpE.exe
  C:\Windows\System\vWmbxpE.exe
  2⤵
  PID:14804
- C:\Windows\System\BUpZihT.exe
  C:\Windows\System\BUpZihT.exe
  2⤵
  PID:15048
- C:\Windows\System\IjZZIul.exe
  C:\Windows\System\IjZZIul.exe
  2⤵
  PID:13844
- C:\Windows\System\uFxiipz.exe
  C:\Windows\System\uFxiipz.exe
  2⤵
  PID:15328
- C:\Windows\System\uprntFZ.exe
  C:\Windows\System\uprntFZ.exe
  2⤵
  PID:14032
- C:\Windows\System\hSexBes.exe
  C:\Windows\System\hSexBes.exe
  2⤵
  PID:14140
- C:\Windows\System\uothSdm.exe
  C:\Windows\System\uothSdm.exe
  2⤵
  PID:15220
- C:\Windows\System\uHxeoIg.exe
  C:\Windows\System\uHxeoIg.exe
  2⤵
  PID:15192
- C:\Windows\System\ObeYKfi.exe
  C:\Windows\System\ObeYKfi.exe
  2⤵
  PID:14188
- C:\Windows\System\DaOZGEq.exe
  C:\Windows\System\DaOZGEq.exe
  2⤵
  PID:15364
- C:\Windows\System\yooYhzl.exe
  C:\Windows\System\yooYhzl.exe
  2⤵
  PID:15400
- C:\Windows\System\ENRlSqZ.exe
  C:\Windows\System\ENRlSqZ.exe
  2⤵
  PID:15420
- C:\Windows\System\sURqocc.exe
  C:\Windows\System\sURqocc.exe
  2⤵
  PID:15452
- C:\Windows\System\nqCRGUt.exe
  C:\Windows\System\nqCRGUt.exe
  2⤵
  PID:15480
- C:\Windows\System\LGzNFwE.exe
  C:\Windows\System\LGzNFwE.exe
  2⤵
  PID:15500
- C:\Windows\System\FErWFZj.exe
  C:\Windows\System\FErWFZj.exe
  2⤵
  PID:15520
- C:\Windows\System\gYWlsXG.exe
  C:\Windows\System\gYWlsXG.exe
  2⤵
  PID:15548
- C:\Windows\System\bztpsTf.exe
  C:\Windows\System\bztpsTf.exe
  2⤵
  PID:15568
- C:\Windows\System\MWprKop.exe
  C:\Windows\System\MWprKop.exe
  2⤵
  PID:15584
- C:\Windows\System\tLIvCvR.exe
  C:\Windows\System\tLIvCvR.exe
  2⤵
  PID:15608
- C:\Windows\System\wQhkGAk.exe
  C:\Windows\System\wQhkGAk.exe
  2⤵
  PID:15632
- C:\Windows\System\mpkvUCY.exe
  C:\Windows\System\mpkvUCY.exe
  2⤵
  PID:15660
- C:\Windows\System\JmXRECV.exe
  C:\Windows\System\JmXRECV.exe
  2⤵
  PID:15676
- C:\Windows\System\hnKuBtV.exe
  C:\Windows\System\hnKuBtV.exe
  2⤵
  PID:15692
- C:\Windows\System\GiXSjvU.exe
  C:\Windows\System\GiXSjvU.exe
  2⤵
  PID:15724
- C:\Windows\System\phqUNpR.exe
  C:\Windows\System\phqUNpR.exe
  2⤵
  PID:15752
- C:\Windows\System\WirhQLA.exe
  C:\Windows\System\WirhQLA.exe
  2⤵
  PID:15768
- C:\Windows\System\ePKyMZv.exe
  C:\Windows\System\ePKyMZv.exe
  2⤵
  PID:15796
- C:\Windows\System\bdhrknC.exe
  C:\Windows\System\bdhrknC.exe
  2⤵
  PID:15816
- C:\Windows\System\IHIqGgv.exe
  C:\Windows\System\IHIqGgv.exe
  2⤵
  PID:15832
- C:\Windows\System\rhcXJgh.exe
  C:\Windows\System\rhcXJgh.exe
  2⤵
  PID:15848
- C:\Windows\System\NmQLYEj.exe
  C:\Windows\System\NmQLYEj.exe
  2⤵
  PID:15880
- C:\Windows\System\lFLJBSC.exe
  C:\Windows\System\lFLJBSC.exe
  2⤵
  PID:15896
- C:\Windows\System\eDwrnPa.exe
  C:\Windows\System\eDwrnPa.exe
  2⤵
  PID:15916
- C:\Windows\System\NfhQxJm.exe
  C:\Windows\System\NfhQxJm.exe
  2⤵
  PID:15944
- C:\Windows\System\iMuUxRF.exe
  C:\Windows\System\iMuUxRF.exe
  2⤵
  PID:15968
- C:\Windows\System\tSPSBXz.exe
  C:\Windows\System\tSPSBXz.exe
  2⤵
  PID:15996
- C:\Windows\System\KdLNoqq.exe
  C:\Windows\System\KdLNoqq.exe
  2⤵
  PID:16028
- C:\Windows\System\hpyXfgy.exe
  C:\Windows\System\hpyXfgy.exe
  2⤵
  PID:16060
- C:\Windows\System\sZQzaFr.exe
  C:\Windows\System\sZQzaFr.exe
  2⤵
  PID:16076
- C:\Windows\System\rMdcBzO.exe
  C:\Windows\System\rMdcBzO.exe
  2⤵
  PID:16104
- C:\Windows\System\FyBgZMe.exe
  C:\Windows\System\FyBgZMe.exe
  2⤵
  PID:16136
- C:\Windows\System\RblMGoT.exe
  C:\Windows\System\RblMGoT.exe
  2⤵
  PID:16164
- C:\Windows\System\HMFkVHO.exe
  C:\Windows\System\HMFkVHO.exe
  2⤵
  PID:16184
- C:\Windows\System\dLQfzCS.exe
  C:\Windows\System\dLQfzCS.exe
  2⤵
  PID:16204
- C:\Windows\System\njvYTaW.exe
  C:\Windows\System\njvYTaW.exe
  2⤵
  PID:16224
- C:\Windows\System\etvjPzo.exe
  C:\Windows\System\etvjPzo.exe
  2⤵
  PID:16252
- C:\Windows\System\MSpNZUA.exe
  C:\Windows\System\MSpNZUA.exe
  2⤵
  PID:16280
- C:\Windows\System\ozmSJci.exe
  C:\Windows\System\ozmSJci.exe
  2⤵
  PID:16316
- C:\Windows\System\EITiTLZ.exe
  C:\Windows\System\EITiTLZ.exe
  2⤵
  PID:16336
- C:\Windows\System\HNczCps.exe
  C:\Windows\System\HNczCps.exe
  2⤵
  PID:16356
- C:\Windows\System\IpEPtyt.exe
  C:\Windows\System\IpEPtyt.exe
  2⤵
  PID:16380
- C:\Windows\System\xwaomJR.exe
  C:\Windows\System\xwaomJR.exe
  2⤵
  PID:15352
- C:\Windows\System\JPrFCRL.exe
  C:\Windows\System\JPrFCRL.exe
  2⤵
  PID:12864
- C:\Windows\System\EiPfjwH.exe
  C:\Windows\System\EiPfjwH.exe
  2⤵
  PID:14988
- C:\Windows\System\IEMZpTb.exe
  C:\Windows\System\IEMZpTb.exe
  2⤵
  PID:14568
- C:\Windows\System\haIHMNZ.exe
  C:\Windows\System\haIHMNZ.exe
  2⤵
  PID:14612
- C:\Windows\System\GKeAkgm.exe
  C:\Windows\System\GKeAkgm.exe
  2⤵
  PID:14912
- C:\Windows\System\WIdnLjm.exe
  C:\Windows\System\WIdnLjm.exe
  2⤵
  PID:15408
- C:\Windows\System\CsDnJUA.exe
  C:\Windows\System\CsDnJUA.exe
  2⤵
  PID:15508
- C:\Windows\System\vPRkATk.exe
  C:\Windows\System\vPRkATk.exe
  2⤵
  PID:15176
- C:\Windows\System\aOYfiFi.exe
  C:\Windows\System\aOYfiFi.exe
  2⤵
  PID:13492
- C:\Windows\System\YQjzJYs.exe
  C:\Windows\System\YQjzJYs.exe
  2⤵
  PID:15648
- C:\Windows\System\BtldSZu.exe
  C:\Windows\System\BtldSZu.exe
  2⤵
  PID:15392
- C:\Windows\System\XbwGYTz.exe
  C:\Windows\System\XbwGYTz.exe
  2⤵
  PID:1392
- C:\Windows\System\hbWAdNX.exe
  C:\Windows\System\hbWAdNX.exe
  2⤵
  PID:15812
- C:\Windows\System\MhCeNpf.exe
  C:\Windows\System\MhCeNpf.exe
  2⤵
  PID:15860
- C:\Windows\System\bgtOKzq.exe
  C:\Windows\System\bgtOKzq.exe
  2⤵
  PID:15956
- C:\Windows\System\vYrlDqC.exe
  C:\Windows\System\vYrlDqC.exe
  2⤵
  PID:15624
- C:\Windows\System\zHIQquq.exe
  C:\Windows\System\zHIQquq.exe
  2⤵
  PID:15672
- C:\Windows\System\uPrhIBH.exe
  C:\Windows\System\uPrhIBH.exe
  2⤵
  PID:15744
- C:\Windows\System\MNleAaz.exe
  C:\Windows\System\MNleAaz.exe
  2⤵
  PID:16216
- C:\Windows\System\qFPqkff.exe
  C:\Windows\System\qFPqkff.exe
  2⤵
  PID:15840
- C:\Windows\System\banNHGJ.exe
  C:\Windows\System\banNHGJ.exe
  2⤵
  PID:16288
- C:\Windows\System\WoAxAgC.exe
  C:\Windows\System\WoAxAgC.exe
  2⤵
  PID:16332
- C:\Windows\System\WXSuIcx.exe
  C:\Windows\System\WXSuIcx.exe
  2⤵
  PID:15644
- C:\Windows\System\QCYPOgT.exe
  C:\Windows\System\QCYPOgT.exe
  2⤵
  PID:16396
- C:\Windows\System\ERyrUqc.exe
  C:\Windows\System\ERyrUqc.exe
  2⤵
  PID:16428
- C:\Windows\System\NSfFrMn.exe
  C:\Windows\System\NSfFrMn.exe
  2⤵
  PID:16448
- C:\Windows\System\QRgBguP.exe
  C:\Windows\System\QRgBguP.exe
  2⤵
  PID:16464
- C:\Windows\System\qEctCQb.exe
  C:\Windows\System\qEctCQb.exe
  2⤵
  PID:16484
- C:\Windows\System\iLuYdpC.exe
  C:\Windows\System\iLuYdpC.exe
  2⤵
  PID:16508
- C:\Windows\System\mmltntJ.exe
  C:\Windows\System\mmltntJ.exe
  2⤵
  PID:16536
- C:\Windows\System\SGoOVJn.exe
  C:\Windows\System\SGoOVJn.exe
  2⤵
  PID:16556
- C:\Windows\System\ieHlcld.exe
  C:\Windows\System\ieHlcld.exe
  2⤵
  PID:16584
- C:\Windows\System\xWkZZHr.exe
  C:\Windows\System\xWkZZHr.exe
  2⤵
  PID:16604
- C:\Windows\System\kfsGRwA.exe
  C:\Windows\System\kfsGRwA.exe
  2⤵
  PID:16624
- C:\Windows\System\zHmsQyM.exe
  C:\Windows\System\zHmsQyM.exe
  2⤵
  PID:16640
- C:\Windows\System\IqiRNRq.exe
  C:\Windows\System\IqiRNRq.exe
  2⤵
  PID:16672
- C:\Windows\System\tDYKAmj.exe
  C:\Windows\System\tDYKAmj.exe
  2⤵
  PID:16688
- C:\Windows\System\qNzoUEH.exe
  C:\Windows\System\qNzoUEH.exe
  2⤵
  PID:16712
- C:\Windows\System\XwnBTOZ.exe
  C:\Windows\System\XwnBTOZ.exe
  2⤵
  PID:16740
- C:\Windows\System\zNNaFqM.exe
  C:\Windows\System\zNNaFqM.exe
  2⤵
  PID:16764
- C:\Windows\System\MMnCANT.exe
  C:\Windows\System\MMnCANT.exe
  2⤵
  PID:16780
- C:\Windows\System\CjFuGHH.exe
  C:\Windows\System\CjFuGHH.exe
  2⤵
  PID:16796
- C:\Windows\System\rhZGdvi.exe
  C:\Windows\System\rhZGdvi.exe
  2⤵
  PID:16820
- C:\Windows\System\gdqKyIn.exe
  C:\Windows\System\gdqKyIn.exe
  2⤵
  PID:16848
- C:\Windows\System\rzLdUtx.exe
  C:\Windows\System\rzLdUtx.exe
  2⤵
  PID:16868
- C:\Windows\System\TnNNtbY.exe
  C:\Windows\System\TnNNtbY.exe
  2⤵
  PID:16884
- C:\Windows\System\FRAsoSz.exe
  C:\Windows\System\FRAsoSz.exe
  2⤵
  PID:16900
- C:\Windows\System\jiJXpBO.exe
  C:\Windows\System\jiJXpBO.exe
  2⤵
  PID:16924
- C:\Windows\System\gBqCOOu.exe
  C:\Windows\System\gBqCOOu.exe
  2⤵
  PID:16940
- C:\Windows\System\FKyPvKx.exe
  C:\Windows\System\FKyPvKx.exe
  2⤵
  PID:16956
- C:\Windows\System\xVjcmHr.exe
  C:\Windows\System\xVjcmHr.exe
  2⤵
  PID:16972
- C:\Windows\System\AINiqqe.exe
  C:\Windows\System\AINiqqe.exe
  2⤵
  PID:17004
- C:\Windows\System\YkxSaeK.exe
  C:\Windows\System\YkxSaeK.exe
  2⤵
  PID:17040
- C:\Windows\System\GKmjWet.exe
  C:\Windows\System\GKmjWet.exe
  2⤵
  PID:17064
- C:\Windows\System\JGAbIBb.exe
  C:\Windows\System\JGAbIBb.exe
  2⤵
  PID:17084
- C:\Windows\System\czLxhGV.exe
  C:\Windows\System\czLxhGV.exe
  2⤵
  PID:17112
- C:\Windows\System\ygeHEDV.exe
  C:\Windows\System\ygeHEDV.exe
  2⤵
  PID:17128
- C:\Windows\System\nsLYlTE.exe
  C:\Windows\System\nsLYlTE.exe
  2⤵
  PID:17144
- C:\Windows\System\wXQvuvS.exe
  C:\Windows\System\wXQvuvS.exe
  2⤵
  PID:17172
- C:\Windows\System\CmQRrWY.exe
  C:\Windows\System\CmQRrWY.exe
  2⤵
  PID:17188
- C:\Windows\System\lcuRviy.exe
  C:\Windows\System\lcuRviy.exe
  2⤵
  PID:17204
- C:\Windows\System\rWOhWdD.exe
  C:\Windows\System\rWOhWdD.exe
  2⤵
  PID:17224
- C:\Windows\System\PkurWal.exe
  C:\Windows\System\PkurWal.exe
  2⤵
  PID:16620
- C:\Windows\System\WRfgFPM.exe
  C:\Windows\System\WRfgFPM.exe
  2⤵
  PID:15428
- C:\Windows\System\fZQMbDA.exe
  C:\Windows\System\fZQMbDA.exe
  2⤵
  PID:17052
- C:\Windows\System\AgAWMNg.exe
  C:\Windows\System\AgAWMNg.exe
  2⤵
  PID:16528
- C:\Windows\System\tODwMlg.exe
  C:\Windows\System\tODwMlg.exe
  2⤵
  PID:16012
- C:\Windows\System\pTXPawm.exe
  C:\Windows\System\pTXPawm.exe
  2⤵
  PID:16856
- C:\Windows\System\jvxMjjY.exe
  C:\Windows\System\jvxMjjY.exe
  2⤵
  PID:17244
- C:\Windows\System\OxFVUTK.exe
  C:\Windows\System\OxFVUTK.exe
  2⤵
  PID:17392
- C:\Windows\System\nRSTybS.exe
  C:\Windows\System\nRSTybS.exe
  2⤵
  PID:17404
- C:\Windows\System\RRSCWgP.exe
  C:\Windows\System\RRSCWgP.exe
  2⤵
  PID:16368
- C:\Windows\System\LHcnBKo.exe
  C:\Windows\System\LHcnBKo.exe
  2⤵
  PID:868
- C:\Windows\System\VehbWQd.exe
  C:\Windows\System\VehbWQd.exe
  2⤵
  PID:16592
- C:\Windows\System\RaURiwg.exe
  C:\Windows\System\RaURiwg.exe
  2⤵
  PID:16916
- C:\Windows\System\qrFzNlJ.exe
  C:\Windows\System\qrFzNlJ.exe
  2⤵
  PID:17000
- C:\Windows\System\QoGXDmG.exe
  C:\Windows\System\QoGXDmG.exe
  2⤵
  PID:388
- C:\Windows\System\lMrogCJ.exe
  C:\Windows\System\lMrogCJ.exe
  2⤵
  PID:2160
- C:\Windows\System\PUVzKms.exe
  C:\Windows\System\PUVzKms.exe
  2⤵
  PID:12756

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4144 -i 4144 -h 552 -j 556 -s 564 -d 16128
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3208

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:16900

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:16972

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AhJcezU.exe

Path C:\Windows\System\AhJcezU.exe
Size 1.2MB
SHA256 b9cb2112ae4a79e5e9b2e03afeb64ad9926d7ef523aa1ac27db6e528f30292c5
MD5 d65f10d6375316dafd7eb2b0c7e30ce2
SHA1 40ad81442802649034ccc26ff94185275a54ce08
SHA512 2fa82311b0a40477ff46597ad57ee4a8c7b476554dacd19bbc951be55f038b1ab8da9197b9e8fe26a774be1c0af5b35b18da6c8f1db59dc795e4979b06cacdf7
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlO1:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaos
MD5 SHA1 SHA512 SSDEEP

Submit Download

BVOvMHf.exe

Path C:\Windows\System\BVOvMHf.exe
Size 1.2MB
SHA256 11490a24dca2b9fe146532a11c2b1a0d6a413a6a16758870249c203260d8f8f1
MD5 5b0377540cb7f918034a692597e48329
SHA1 2764dc466a3a3aa04d26ad6ccbe13dd9f23f572f
SHA512 4ead2d759295e381af84edc8640946acbdde028d9f84bea44598b3bfa7812140f17164d318462566f70847cbbd43a811fa4f50334d4d798d58444d83d2583b16
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlO3:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ChRTAdD.exe

Path C:\Windows\System\ChRTAdD.exe
Size 1.2MB
SHA256 28495ace72ae096b844fbde41ed9fd6a16404a74c75c8a03985c16f819c1ebcf
MD5 0551d2e4da9718002eaef7ef115b3522
SHA1 a17cc52fc2d192e0c9c14521ec9cda6acd618b76
SHA512 5cdcc6b7b90dd4b0650cef9cf1af28f92301ec01b397162ddaf5e4b2631cbc30df99182c9826a19e028378e83fbdfa7ff6c7f2910a07399ec2d2fa2f71bc0d36
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOH:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

DsuNvrD.exe

Path C:\Windows\System\DsuNvrD.exe
Size 1.2MB
SHA256 ec0e8efc1f2448e997a33e6005d3d9d04cddfbd5c9906cf91f5b109522a5e12b
MD5 45f1c3687d2880b47f2d06d234fc1ff0
SHA1 5c4048c3acc32af17a83828809efd7aca120318f
SHA512 c99a31d107233089ed2b663ee28ccfb51b7b4f240e74c2acf157173d1c80bf0909e6e1fc974ff7e58bbc614b5e7e326aa9f0bf62b962258f65bdb5c139ee6bcc
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOr:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jao6
MD5 SHA1 SHA512 SSDEEP

Submit Download

HHENCGR.exe

Path C:\Windows\System\HHENCGR.exe
Size 1.2MB
SHA256 8b5d33604b256aaf5c438a86e4a365bc64d4a0c1832e27b7a45e9f118cdc1255
MD5 16ad3999f892ae5bc4dbc6ba42530d3f
SHA1 7d17ed3d1c764638df67c17dc37b623e53acae45
SHA512 0d9678f32c2b4d071a2deaaa307d36924cc524de22cd4a64db36ec5c7a41eba01ff449e9d2136c2fea3ff864d948962c8d83ed7a76f4bdae29bfbffc3db21ce1
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlO7:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

HjIMuWB.exe

Path C:\Windows\System\HjIMuWB.exe
Size 1.2MB
SHA256 b5aa0261402edf789898d9aa713e90ea9ce5e50b981af913a252c45737817998
MD5 d4de527908e74fa201a7b1aafcd92dcd
SHA1 e12b4290e58b86b7fba1ee6e508e60a44583f0db
SHA512 973e42f2b8663e27fa01d6a539cb746260c3bb4de4252fd107f71871edae9848421e4baf39f78fdf18d122314f256ec9de0501e9e95d548c1d473a92f690f512
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlO2:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoH
MD5 SHA1 SHA512 SSDEEP

Submit Download

KBKfgha.exe

Path C:\Windows\System\KBKfgha.exe
Size 1.2MB
SHA256 34930eb037b6ec0bc2427f68157498e347363f0371dfcc7fd2c19c6501e4582d
MD5 fd92418af9279e63c396977d32aae23b
SHA1 6c12ba366c0ba37f1b7aa5eceb145e81b5bfe091
SHA512 31f7164890138b3b4c7528e59a0e51acfb1b09e7725c58d4e93a888ad7ca6c1b9fdaa82362c98e26bc63ac4cc6e8732de431a079f7ff41d208abeb1543e8d7c8
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlO0:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LCNHCzQ.exe

Path C:\Windows\System\LCNHCzQ.exe
Size 1.2MB
SHA256 a6cf4f5ec27e390f527d6d6f0fa2e0d38dee63e8ac0904022db49696941e5116
MD5 7911abd264fac6bfcdc34e5527b7c2de
SHA1 bd9552851d29e8451362d5ebc5e57ae433dd8cad
SHA512 22e20a853ea4769c9992090f4625ccd1f745dfb43fa22317b2e1258ef7aa5c74d2add15bbeb6da7151e2aad91318b810c3d521cd7f4fa0784f9bcd7f5c43c4a4
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOe:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

MajBcFU.exe

Path C:\Windows\System\MajBcFU.exe
Size 1.2MB
SHA256 7d2727b5ca3053af3287907cd5085a1b8ed2d69e7953f639f7a311e29e74ef40
MD5 7db582960b3c698547ce2e07370223f1
SHA1 bf2f2b8c5a6176b862d72441c4dda34554f9239a
SHA512 ad92707722569ad61de5c2e17781db88d6e71af211e5f44df878c0b10257904caf8303bb5121df7a9a11b3cbd60838b04b0fa32076a2357bbdebf045fd1de7b7
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOf:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jao0
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsPLAJF.exe

Path C:\Windows\System\MsPLAJF.exe
Size 1.2MB
SHA256 b75630b90d3a17d580f71802732bc915ee5ec0603ad77675c2bbce5e3fd0a6b4
MD5 70c18280229d27eeac2e1d15452922f1
SHA1 d6e81e6790dbf3c5e52fdb6cb17dbf5eab44c1a7
SHA512 a9a54c5ce2f375a6dcfa8a905628fd17c7555111f163da08ba02c9ae6c059caf592dcb23bd7e4fe8e1992f20b02c530acdad8513c8123a25428f4b4772884f0d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOG:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MtcFKiU.exe

Path C:\Windows\System\MtcFKiU.exe
Size 1.2MB
SHA256 330aba34db82d8db8a9dd5fe00d21beb55853e8df697dd938574428de35a2952
MD5 ddd8f362efbe5e878f6605ac78b05c86
SHA1 088609a8fae04f492d97f8e44836f742aaee076f
SHA512 71d1dd667c8c23600d55bcee7674625ec47cb38dea1719c97930ed9934dd43d469e97082b3e093c0a8df1ce2b01b783c840c053ca608dee3d3ec82dd7755df35
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOG:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaop
MD5 SHA1 SHA512 SSDEEP

Submit Download

ODTDyJG.exe

Path C:\Windows\System\ODTDyJG.exe
Size 1.2MB
SHA256 8b2080b5a1f2262936a878172a11160c462fae0f21d7fbb64d4d03752b25d89d
MD5 cbbec2cc194e92d32626c8784d0a58ad
SHA1 868ea8d8dd6cf37594f0304984632a41f5ae985d
SHA512 ade6b8b4f54f8ad5629e9a176b79acbccc8f0bc60dea1cb229b37ff73c3bde06e5659d464446646355ff36bd8360f564655e879b42ec82221a41e774459678ae
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOf:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoU
MD5 SHA1 SHA512 SSDEEP

Submit Download

OMUsCoj.exe

Path C:\Windows\System\OMUsCoj.exe
Size 1.2MB
SHA256 356c4e29d0927b47e2fbd017a8255e1759a1f279799fdd261189fe75e399941b
MD5 578cd56ec9afc1f44c0ede21ca2454e5
SHA1 0c3880d80bf837dcd7c0a1902a50d10e36aacb66
SHA512 9e84986468c7a783adfd092f9556b391bcb82e9d2dc07a72569d00afd253f64530683f6b2142db9754a7202c7757aeecbf940187f4da074480618e8369be0ef6
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlO6u:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

ORKZhnJ.exe

Path C:\Windows\System\ORKZhnJ.exe
Size 1.2MB
SHA256 9fcc6253dc845c1f7793065e1feae13a66d2d0ed0ea3eaad4f70e315bda2e7da
MD5 2d02a00135e82a601ad90a2fc6850590
SHA1 399b273cf5db7c34cb326fad0ee5cb4ca2e89e67
SHA512 223f783c045e7e2045342062828f31e3548e0f1507105cb7f00b4428d7000f9274aeac9e5c4013c17cd9b54634a002be9c0fda27a17802c5e86d56f1713c5c6e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOD:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jao4
MD5 SHA1 SHA512 SSDEEP

Submit Download

RVHRYfH.exe

Path C:\Windows\System\RVHRYfH.exe
Size 1.2MB
SHA256 cd5ba9a59e6fe90a7546a7d419db9be0312471003239db81d42ca167905301a1
MD5 163be47ca08b080bf1e783c404623562
SHA1 867e24fc9b63eae220072ac6e583800d524016ad
SHA512 46377ac95da41d97554342b51b48a98d4a8df6c9adb2f0e09e852293941fa6e58536383b99c5f43861876bfd9f10694cbba5c6997444b900697426dbee8b01d1
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOWc:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TjrhEtQ.exe

Path C:\Windows\System\TjrhEtQ.exe
Size 1.2MB
SHA256 c9a3718c29a8118bea58485ad7dff70db3bc5582a44167901237383440cb1579
MD5 0bcf8f819ddb3fb197bda0869dc86592
SHA1 1a5032fa3796671befbb6b5549c35ac44e1cb13d
SHA512 33cb74e5df86561e2ed1ad1f3296185c47f626dd0d4ea60e8c8a592a7f77f685c62cc568f98492229e19ed7f341cfef046420efb7da2ce84a3e7eac64ac36d7c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOt:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoC
MD5 SHA1 SHA512 SSDEEP

Submit Download

WEAvOGR.exe

Path C:\Windows\System\WEAvOGR.exe
Size 1.2MB
SHA256 2097f84b7b71af8e09966065c9cb35698866f3286db496f347ed72ae68c8fed8
MD5 ed08130c81a5e1a1f9d7e41dcff216a3
SHA1 8ba45081f9ac0bb86d0239053f8699127a4ee11e
SHA512 c9f841700ad7c10e4aaa453dc3b3caf4a8cb18b504c90d965e19c39f0f6f0c44adb929a617c0c8e4cd02767f079208c5524a4c8fd520f5046dd6c86f0e6b0661
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOd:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

WgjEvJn.exe

Path C:\Windows\System\WgjEvJn.exe
Size 1.2MB
SHA256 0291ffc353e7dfe3b6a18bb0e5172c898bea753bbc3456bf76fac895d1b36584
MD5 1b84dd73661330b8bdc36c0dbf824186
SHA1 99b3c76e238a2d330b41618d2a4247ad9210feef
SHA512 212f2b2df99b9f4ac3192ad6ec070ce62d75b57b7f8c38b82d54457f03aca37e978dcfbce2c743eb4d3f590e3d7b68349316404aab418e4b672c5f38759cf0c9
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlO4:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jao1
MD5 SHA1 SHA512 SSDEEP

Submit Download

YPTEzuz.exe

Path C:\Windows\System\YPTEzuz.exe
Size 1.2MB
SHA256 ca011f9fd06bdde3f88e9fc2b6cdfbad502938577ed103e3bb45ccb6ec12acf6
MD5 dca7898683b8191f212105235facdec9
SHA1 4d66d3a30fa46d95e9553d09fb0fb02b7dbe74b6
SHA512 b944679a9e67d0599e39828ad5ef97b9fd98869124b27ffcb12c740ad309b7d11576dff40b835ebe9dc01aa1d7bbc91e44d759f948caa7ff7e154520d489e867
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOu:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaox
MD5 SHA1 SHA512 SSDEEP

Submit Download

aFjLApq.exe

Path C:\Windows\System\aFjLApq.exe
Size 1.2MB
SHA256 7f1a0e167bb93bcfcb2c010fb5d615d10e8c050716a7eeb0baba020781bcb264
MD5 d3aee926e72786bff46d890fe884f636
SHA1 bba576b288889130a6a0272b85a50adb7020fccb
SHA512 b6bead08686346d72ccf0a26413c5d84c84c010544e75eb582346e02d04fb876a49cb068f872653157fbfea9c1f6e387022f18d4aa4b11cf83de4d218abe5eb6
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlON:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

cKYEUOf.exe

Path C:\Windows\System\cKYEUOf.exe
Size 1.2MB
SHA256 0606e078193d222f175c075fd04e69b69f0518638876b699ead9b2a25d61c68d
MD5 b1e0ec53581db157b61c07ebc7e558b4
SHA1 d4a197c7cf63e750d0b84dfe0e98e174c785d602
SHA512 b0832cdc3b2fb1aead86f14cc6493b9e455540505cf3bd5d22c8cbe7593e8dcf28da3748f0fa8c5c55fa6d77fef6fa3e5604fc211767efe7322adeebbb63cd99
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOZ:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoA
MD5 SHA1 SHA512 SSDEEP

Submit Download

eCdmjGs.exe

Path C:\Windows\System\eCdmjGs.exe
Size 1.2MB
SHA256 24a0e0255e6b018a30a5857db5450a69a3990b387587aa18b1a0d891b48b13ee
MD5 81b1e06f3836c983072571b1d38fd606
SHA1 b5ede33285a95e2d40f903f7f8e1b5b8b0a43605
SHA512 13438309a912f85953d2dc36734b105a97dcf495b804115bdbf6e6897baebbf536b1f25df168f3a9e846ea5a5acf5761670eb3f9dfc2b123a2d8d4413c10b202
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlO/:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jao0
MD5 SHA1 SHA512 SSDEEP

Submit Download

fnExNrW.exe

Path C:\Windows\System\fnExNrW.exe
Size 1.2MB
SHA256 21b2823b39d95806f294e70587b08a38dcb091ab17b1d21142667c0370b4f6c5
MD5 b9936904f93104b619456a91528b4727
SHA1 9ca7919d32fd95744a25713e3b02327d11f3ec74
SHA512 a156c2e1754a44b9f751136277a3fa9e58921608a7fa6a535b3020790cd3bb446673257819374b3e82e835506a5e07577a5c4ca83b30801e2560cf55624ae966
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOLP:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jao2
MD5 SHA1 SHA512 SSDEEP

Submit Download

gArmAyG.exe

Path C:\Windows\System\gArmAyG.exe
Size 1.2MB
SHA256 1f420a25c989433759a23be18be32f84cbf1e1492e7d9113bae5bc41ced6453d
MD5 44a07e8185563836ca82c4827e9e4028
SHA1 2b5fba96385a91c0fc115adc9fb9291b6bcac8de
SHA512 70bc1ce7c71a39c4c3af0e64019935d8aed24cf9034c803eaa1cee885e825095d2c265b0a1bcc68bacca58c83c4bf6c8d5201b876e1f94b396282b5fce41cd65
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOC:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gYAMMfa.exe

Path C:\Windows\System\gYAMMfa.exe
Size 1.2MB
SHA256 ce87612827a95aa6e7c871038cbd00c18fb80cee6dec67db8dd5d8d9ef3c27da
MD5 405c80b5377de62c650ae7542904f7f3
SHA1 84795616f8a7f8941547fe9bfc14f26f8ba5a914
SHA512 45a3d473890fbd5ce1d7669a1a43f87579947fef9b0d6d277df6b08979f9bf4df09d55d3d118f11012de6d2839bf43e36d5190894859a42e478d8cbf827d8a75
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlORX:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaow
MD5 SHA1 SHA512 SSDEEP

Submit Download

gfdmGTe.exe

Path C:\Windows\System\gfdmGTe.exe
Size 1.2MB
SHA256 fd57838865427458f284fb34c6bf27e02bc93ff334a65fd28437045b9950fbd0
MD5 72cbc3b042077280fccc1e150cce6abc
SHA1 5170decddcde7563daf69382439789ca5b112182
SHA512 48b892a08766497853d7dc6fcb76f55c65b3c8afa8ec1dd82c2bdd8055d5e623eee1668bcd2dd8253de8fc1106dfbb214fe52c2f0dba8241e022f3d99a8a1f58
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOG:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaov
MD5 SHA1 SHA512 SSDEEP

Submit Download

hIHnQbh.exe

Path C:\Windows\System\hIHnQbh.exe
Size 1.2MB
SHA256 97f867b94b57ecd08d08d5a023888296ff4add7b7e2ea833a12868c8137b18fc
MD5 ed92382c4c6ee6de7237b88719d715c6
SHA1 12a7c0f83f4c0cd742c1cb6e0749c289cfab37da
SHA512 70a4c925d8438fa62b4c8d4fe79f47bf746d9439276f65747e815e7b4b99e53293a23e05faff3d275e904ea85f48555225d477e46e590b56c7c9b50141b92926
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOr8:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mNBOzpL.exe

Path C:\Windows\System\mNBOzpL.exe
Size 1.2MB
SHA256 0c52742db2e34759241f234006ba3fe3cf798ddfe19fc66e36ea1a6a88527aae
MD5 44bbc6275873894590d739fb45d80216
SHA1 91e6edf84f66f1099591e6a44d2b23eaa2c57d12
SHA512 7f3d65f4afdbad30ceefff73af599757d2a8941772d43a5cf8c320bfae685c37748bb26239ca012d17437d2835070d274ac0452cbd6d28d1ce3d31b95c9f8777
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOH:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

nLxaRhB.exe

Path C:\Windows\System\nLxaRhB.exe
Size 1.2MB
SHA256 e5194b2340b8d6d7d19d1be731bd038669331e67a7a5fe7f819291c897eb2cae
MD5 a248df6cdefc8f97d5761f7c511f9115
SHA1 5042c2e1c35f5767126f8a160ae8f810a91e8d37
SHA512 887e1d54068e1e866fe4598c75787ad392f5891d95ad9c52c27b4577e4445f0b802325a8cf3806199273960828102cebaa53cd0c5096f480defb9c3bef94ff2b
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOJ:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaoa
MD5 SHA1 SHA512 SSDEEP

Submit Download

pHXGLEk.exe

Path C:\Windows\System\pHXGLEk.exe
Size 1.2MB
SHA256 5a5ce35d7c47e38fa2bb8f56aae96bae1eb28269f84025b38e6ccafef5657600
MD5 b84de44713edfb88243fa9f34de4c1c8
SHA1 182abb8a64f77431a27fa09ae46aac3feec2fefa
SHA512 82a3b6e6b614472a0d710856ee18d39f097bfd8aa587d2e32bba054ebedf13cdc2de73498c2490944bb072daf60bf72061c0a1d694e8ef2a7675007990d813ec
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOh:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

qCXSbpS.exe

Path C:\Windows\System\qCXSbpS.exe
Size 1.2MB
SHA256 5ded7923bb8799df412510f27e35ec1fa9f99dc1741851d98b782f98afb6da31
MD5 c8155be3b7b2b508fef5d4ff31d493d2
SHA1 71e918bc9922e5376c4ce93b8662c579bbc13756
SHA512 25cfaaebf20622fd369dd208c671aed414f3ba9b40972eb1d521b8dc8bd6c898b847075b115a889212d4d8be51ad178da1c3b98bb89271b4e415afdbb58733b5
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOi:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaod
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiqzvYv.exe

Path C:\Windows\System\wiqzvYv.exe
Size 1.2MB
SHA256 bfcb96df0b4be1aa31a872339cce28f762e88c275d379217c53d3a7e1443e03c
MD5 343d580699fb13542659f1207066824f
SHA1 063ac64c396e46582544f31dbeb48aaaa4ca5bc9
SHA512 3d9a3acb9409c8e463f22c84bee00b1ea19786084b0c07ab179a33fb0154c1ad95a5d519533c54de1fb12fe656064ab949027040a3c35581095785369ac8175f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlO32:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaol
MD5 SHA1 SHA512 SSDEEP

Submit Download

xqzFatk.exe

Path C:\Windows\System\xqzFatk.exe
Size 1.2MB
SHA256 2260ab69b73c570a448a9ff967cf12d22fa7394849c957357cda5c7527fb5972
MD5 d984b2f138fb817763c7fd2e28768ce4
SHA1 988f78eaaeb3397ecbe67030dea5f97996b02cd5
SHA512 7bc31d04428fa66bc415ac07db6c06fb1d9580163ebc2fa46c695ae9f0a51fa1a80924df1a9ea8d9cc1b496d80a5812877beda9880e07489ce521de40d13222f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9WlOv:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jaou
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1512-0-0x000001FA4AFB0000-0x000001FA4AFC0000-memory.dmp

Download