xmrig | fa0db4f1abbcf806f1f9986039684b0b9547d6b28cc19d73e64f4248e92749af

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
Size 3.0MB
Sample240526-vnegdaed42
SHA256 fa0db4f1abbcf806f1f9986039684b0b9547d6b28cc19d73e64f4248e92749af
MD5 16c0c7aede5f2eff2f3dea3d4acfdd00
SHA1 9a2d494e3b189a4f7c5dd422045e5a4a8c245031
SHA512 3036f21ca362eede1bf7f73cbfadaa154e79c0138f6aecf29e72170481eab1fcd84d58f25bb7d3fbcdd7d82270b50ba99edc1395e312a1d2f876d6e96d70444f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRD:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3412-0-0x00007FF64AE90000-0x00007FF64B286000-memory.dmp	xmrig
behavioral2/files/0x0008000000023482-5.dat	xmrig
behavioral2/files/0x0007000000023487-7.dat	xmrig
behavioral2/files/0x0007000000023486-9.dat	xmrig
behavioral2/memory/4432-22-0x00007FF6BFC70000-0x00007FF6C0066000-memory.dmp	xmrig
behavioral2/files/0x000700000002348a-52.dat	xmrig
behavioral2/files/0x0007000000023496-78.dat	xmrig
behavioral2/files/0x0007000000023491-93.dat	xmrig
behavioral2/files/0x0007000000023498-111.dat	xmrig
behavioral2/memory/4804-125-0x00007FF658DB0000-0x00007FF6591A6000-memory.dmp	xmrig
behavioral2/memory/4264-131-0x00007FF69B510000-0x00007FF69B906000-memory.dmp	xmrig
behavioral2/memory/2768-137-0x00007FF68E650000-0x00007FF68EA46000-memory.dmp	xmrig
behavioral2/files/0x000700000002349b-141.dat	xmrig
behavioral2/files/0x000700000002349c-168.dat	xmrig
behavioral2/files/0x00070000000234a3-201.dat	xmrig
behavioral2/memory/3064-214-0x00007FF6EFE30000-0x00007FF6F0226000-memory.dmp	xmrig
behavioral2/memory/1096-212-0x00007FF7F5F60000-0x00007FF7F6356000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a8-211.dat	xmrig
behavioral2/files/0x00070000000234a7-210.dat	xmrig
behavioral2/files/0x00070000000234a6-209.dat	xmrig
behavioral2/files/0x00070000000234a5-208.dat	xmrig
behavioral2/files/0x00080000000234a2-207.dat	xmrig
behavioral2/files/0x00070000000234a4-206.dat	xmrig
behavioral2/files/0x00070000000234a0-200.dat	xmrig
behavioral2/files/0x000700000002349f-194.dat	xmrig
behavioral2/files/0x000700000002349e-188.dat	xmrig
behavioral2/files/0x000700000002349d-180.dat	xmrig
behavioral2/files/0x0008000000023483-176.dat	xmrig
behavioral2/memory/1608-136-0x00007FF7ED0E0000-0x00007FF7ED4D6000-memory.dmp	xmrig
behavioral2/memory/3564-135-0x00007FF6A3C30000-0x00007FF6A4026000-memory.dmp	xmrig
behavioral2/memory/5012-134-0x00007FF6F23C0000-0x00007FF6F27B6000-memory.dmp	xmrig
behavioral2/memory/1092-133-0x00007FF761CA0000-0x00007FF762096000-memory.dmp	xmrig
behavioral2/memory/1276-132-0x00007FF72A690000-0x00007FF72AA86000-memory.dmp	xmrig
behavioral2/memory/3456-130-0x00007FF78D9E0000-0x00007FF78DDD6000-memory.dmp	xmrig
behavioral2/memory/4560-129-0x00007FF6E6AE0000-0x00007FF6E6ED6000-memory.dmp	xmrig
behavioral2/memory/4280-128-0x00007FF73C160000-0x00007FF73C556000-memory.dmp	xmrig
behavioral2/memory/60-127-0x00007FF7CD420000-0x00007FF7CD816000-memory.dmp	xmrig
behavioral2/memory/3644-126-0x00007FF73CA50000-0x00007FF73CE46000-memory.dmp	xmrig
behavioral2/memory/4004-124-0x00007FF699750000-0x00007FF699B46000-memory.dmp	xmrig
behavioral2/memory/4820-123-0x00007FF7641B0000-0x00007FF7645A6000-memory.dmp	xmrig
behavioral2/memory/4276-122-0x00007FF7DE360000-0x00007FF7DE756000-memory.dmp	xmrig
behavioral2/files/0x000700000002349a-120.dat	xmrig
behavioral2/files/0x0007000000023499-118.dat	xmrig
behavioral2/memory/2556-116-0x00007FF6CB7F0000-0x00007FF6CBBE6000-memory.dmp	xmrig
behavioral2/memory/2016-113-0x00007FF7EA4D0000-0x00007FF7EA8C6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023492-109.dat	xmrig
behavioral2/files/0x0007000000023497-105.dat	xmrig
behavioral2/files/0x0007000000023495-100.dat	xmrig
behavioral2/files/0x0007000000023494-97.dat	xmrig
behavioral2/memory/3048-96-0x00007FF67B480000-0x00007FF67B876000-memory.dmp	xmrig
behavioral2/memory/920-95-0x00007FF602C80000-0x00007FF603076000-memory.dmp	xmrig
behavioral2/files/0x0007000000023490-91.dat	xmrig
behavioral2/files/0x0007000000023493-84.dat	xmrig
behavioral2/files/0x000700000002348d-80.dat	xmrig
behavioral2/files/0x000700000002348c-76.dat	xmrig
behavioral2/files/0x000700000002348f-89.dat	xmrig
behavioral2/files/0x000700000002348e-87.dat	xmrig
behavioral2/files/0x0007000000023489-43.dat	xmrig
behavioral2/files/0x0007000000023488-40.dat	xmrig
behavioral2/files/0x000700000002348b-47.dat	xmrig
behavioral2/memory/1656-8-0x00007FF746C70000-0x00007FF747066000-memory.dmp	xmrig
behavioral2/memory/1656-1972-0x00007FF746C70000-0x00007FF747066000-memory.dmp	xmrig
behavioral2/memory/4432-1975-0x00007FF6BFC70000-0x00007FF6C0066000-memory.dmp	xmrig
behavioral2/memory/1656-1976-0x00007FF746C70000-0x00007FF747066000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4852	powershell.exe
13	4852	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4852	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1656	AfrKfPy.exe
4432	ylhjYYg.exe
3564	YMurOqZ.exe
920	JAhniCU.exe
3048	oYxSGGP.exe
2016	WQTnZJS.exe
1608	SiWdQNv.exe
2556	zgoGVLd.exe
4276	KIcoJMc.exe
4820	WfSJVAm.exe
4004	RpmAhPX.exe
4804	KdwaaPC.exe
3644	sMHrseS.exe
60	LTsnrVT.exe
4280	RaqEoAF.exe
4560	AIZLcxI.exe
3456	NYMYvhb.exe
4264	HTgmiQF.exe
1276	UtDTELI.exe
1092	UftiLiM.exe
2768	DoRlvtM.exe
5012	XSwRgSi.exe
1096	pSIjxDD.exe
3064	GPzxXCc.exe
3928	JVSaEKN.exe
2096	fqVzOqF.exe
3304	NyDSjyM.exe
1484	KziMUFg.exe
1208	WaQaFiS.exe
2348	uyroSXy.exe
2420	IleAUXu.exe
2384	tXEqUcZ.exe
2740	gydTVbJ.exe
3492	vzvoPfs.exe
2112	VWtOjWl.exe
4156	bjHUjdK.exe
5028	PkPjemV.exe
4732	gAThTBI.exe
2568	WZDfmQl.exe
1852	EsQnCMp.exe
3408	wIHbmyy.exe
1884	PCQfXbG.exe
2860	BLwzcKG.exe
116	BSWccDg.exe
4976	HCSnzQQ.exe
3576	njAlOVI.exe
1916	IdJDTIS.exe
876	YLeTJka.exe
5084	MqnZszs.exe
2612	JbPbzas.exe
1472	IfxDEfH.exe
4972	wLJHzDH.exe
4780	ycZPIaR.exe
4700	mOpEyGt.exe
4020	MqAYgUF.exe
1404	BQnDoyu.exe
4872	gaSeNUB.exe
1540	UZodxuv.exe
2224	SXiyVdK.exe
764	SloIiBN.exe
1436	NIneFAq.exe
4328	jfhGzBJ.exe
3992	NHohSKr.exe
2156	NNQcInG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3412-0-0x00007FF64AE90000-0x00007FF64B286000-memory.dmp	upx
behavioral2/files/0x0008000000023482-5.dat	upx
behavioral2/files/0x0007000000023487-7.dat	upx
behavioral2/files/0x0007000000023486-9.dat	upx
behavioral2/memory/4432-22-0x00007FF6BFC70000-0x00007FF6C0066000-memory.dmp	upx
behavioral2/files/0x000700000002348a-52.dat	upx
behavioral2/files/0x0007000000023496-78.dat	upx
behavioral2/files/0x0007000000023491-93.dat	upx
behavioral2/files/0x0007000000023498-111.dat	upx
behavioral2/memory/4804-125-0x00007FF658DB0000-0x00007FF6591A6000-memory.dmp	upx
behavioral2/memory/4264-131-0x00007FF69B510000-0x00007FF69B906000-memory.dmp	upx
behavioral2/memory/2768-137-0x00007FF68E650000-0x00007FF68EA46000-memory.dmp	upx
behavioral2/files/0x000700000002349b-141.dat	upx
behavioral2/files/0x000700000002349c-168.dat	upx
behavioral2/files/0x00070000000234a3-201.dat	upx
behavioral2/memory/3064-214-0x00007FF6EFE30000-0x00007FF6F0226000-memory.dmp	upx
behavioral2/memory/1096-212-0x00007FF7F5F60000-0x00007FF7F6356000-memory.dmp	upx
behavioral2/files/0x00070000000234a8-211.dat	upx
behavioral2/files/0x00070000000234a7-210.dat	upx
behavioral2/files/0x00070000000234a6-209.dat	upx
behavioral2/files/0x00070000000234a5-208.dat	upx
behavioral2/files/0x00080000000234a2-207.dat	upx
behavioral2/files/0x00070000000234a4-206.dat	upx
behavioral2/files/0x00070000000234a0-200.dat	upx
behavioral2/files/0x000700000002349f-194.dat	upx
behavioral2/files/0x000700000002349e-188.dat	upx
behavioral2/files/0x000700000002349d-180.dat	upx
behavioral2/files/0x0008000000023483-176.dat	upx
behavioral2/memory/1608-136-0x00007FF7ED0E0000-0x00007FF7ED4D6000-memory.dmp	upx
behavioral2/memory/3564-135-0x00007FF6A3C30000-0x00007FF6A4026000-memory.dmp	upx
behavioral2/memory/5012-134-0x00007FF6F23C0000-0x00007FF6F27B6000-memory.dmp	upx
behavioral2/memory/1092-133-0x00007FF761CA0000-0x00007FF762096000-memory.dmp	upx
behavioral2/memory/1276-132-0x00007FF72A690000-0x00007FF72AA86000-memory.dmp	upx
behavioral2/memory/3456-130-0x00007FF78D9E0000-0x00007FF78DDD6000-memory.dmp	upx
behavioral2/memory/4560-129-0x00007FF6E6AE0000-0x00007FF6E6ED6000-memory.dmp	upx
behavioral2/memory/4280-128-0x00007FF73C160000-0x00007FF73C556000-memory.dmp	upx
behavioral2/memory/60-127-0x00007FF7CD420000-0x00007FF7CD816000-memory.dmp	upx
behavioral2/memory/3644-126-0x00007FF73CA50000-0x00007FF73CE46000-memory.dmp	upx
behavioral2/memory/4004-124-0x00007FF699750000-0x00007FF699B46000-memory.dmp	upx
behavioral2/memory/4820-123-0x00007FF7641B0000-0x00007FF7645A6000-memory.dmp	upx
behavioral2/memory/4276-122-0x00007FF7DE360000-0x00007FF7DE756000-memory.dmp	upx
behavioral2/files/0x000700000002349a-120.dat	upx
behavioral2/files/0x0007000000023499-118.dat	upx
behavioral2/memory/2556-116-0x00007FF6CB7F0000-0x00007FF6CBBE6000-memory.dmp	upx
behavioral2/memory/2016-113-0x00007FF7EA4D0000-0x00007FF7EA8C6000-memory.dmp	upx
behavioral2/files/0x0007000000023492-109.dat	upx
behavioral2/files/0x0007000000023497-105.dat	upx
behavioral2/files/0x0007000000023495-100.dat	upx
behavioral2/files/0x0007000000023494-97.dat	upx
behavioral2/memory/3048-96-0x00007FF67B480000-0x00007FF67B876000-memory.dmp	upx
behavioral2/memory/920-95-0x00007FF602C80000-0x00007FF603076000-memory.dmp	upx
behavioral2/files/0x0007000000023490-91.dat	upx
behavioral2/files/0x0007000000023493-84.dat	upx
behavioral2/files/0x000700000002348d-80.dat	upx
behavioral2/files/0x000700000002348c-76.dat	upx
behavioral2/files/0x000700000002348f-89.dat	upx
behavioral2/files/0x000700000002348e-87.dat	upx
behavioral2/files/0x0007000000023489-43.dat	upx
behavioral2/files/0x0007000000023488-40.dat	upx
behavioral2/files/0x000700000002348b-47.dat	upx
behavioral2/memory/1656-8-0x00007FF746C70000-0x00007FF747066000-memory.dmp	upx
behavioral2/memory/1656-1972-0x00007FF746C70000-0x00007FF747066000-memory.dmp	upx
behavioral2/memory/4432-1975-0x00007FF6BFC70000-0x00007FF6C0066000-memory.dmp	upx
behavioral2/memory/1656-1976-0x00007FF746C70000-0x00007FF747066000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EHMJdvM.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\SGqRcKE.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\ooAJQGT.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\JqSjqwR.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\YsKeypX.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\eMKlOdi.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\bXEacgP.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\PGcnzKr.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\wblABXA.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\XfxEGvE.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\SGeuNYD.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\kgExeoG.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\pvDwVXd.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\LRUYsOS.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\VVKWVLl.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\uFvWjwA.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\KcdLXxN.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\jHyPvaV.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\wDdeoOr.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\GbAPWkm.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\yzLfRcN.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\hekeSGG.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\GuVGTMO.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\daXmEQJ.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\bWNQTCD.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\HYYPgax.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\KuLqEfq.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\gjnHvaL.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\PJpafpX.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\KLRSYNV.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\dUnMBIb.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\KmRrfhV.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\hrOExdU.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\Qdqdtzl.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\jWCGcza.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\soLldLg.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\WyfcZHl.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\SuQbpPX.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\XmgvLxc.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\sPtUtdO.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\WZZiiMy.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\jraBtqZ.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\SrVtfDv.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\NtZEfIc.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\jGABicD.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\KrSVGWH.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\pyXXiMK.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\FtKxvsS.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\GyIaRVn.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\nGBLQbC.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\DXHnTfY.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\ZBgekYY.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\LqaWzBe.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\zyPemfI.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\uUPNIkB.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\TgAckPH.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\xOcRfaI.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\kvXDrUa.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\awPxzRk.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\hEQZsAd.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\yrrsUPI.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\HdAolrQ.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\GgBpZGM.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
File created	C:\Windows\System\TiBPXBV.exe	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
780	WerFaultSecure.exe
780	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeLockMemoryPrivilege	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4852	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	83
PID 3412 wrote to memory of 4852	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	83
PID 3412 wrote to memory of 1656	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	84
PID 3412 wrote to memory of 1656	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	84
PID 3412 wrote to memory of 4432	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	85
PID 3412 wrote to memory of 4432	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	85
PID 3412 wrote to memory of 3564	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	86
PID 3412 wrote to memory of 3564	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	86
PID 3412 wrote to memory of 920	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	87
PID 3412 wrote to memory of 920	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	87
PID 3412 wrote to memory of 3048	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	88
PID 3412 wrote to memory of 3048	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	88
PID 3412 wrote to memory of 2016	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	89
PID 3412 wrote to memory of 2016	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	89
PID 3412 wrote to memory of 1608	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	90
PID 3412 wrote to memory of 1608	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	90
PID 3412 wrote to memory of 2556	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	91
PID 3412 wrote to memory of 2556	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	91
PID 3412 wrote to memory of 4276	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	92
PID 3412 wrote to memory of 4276	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	92
PID 3412 wrote to memory of 4820	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	93
PID 3412 wrote to memory of 4820	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	93
PID 3412 wrote to memory of 4004	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	94
PID 3412 wrote to memory of 4004	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	94
PID 3412 wrote to memory of 4804	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	95
PID 3412 wrote to memory of 4804	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	95
PID 3412 wrote to memory of 3644	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	96
PID 3412 wrote to memory of 3644	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	96
PID 3412 wrote to memory of 1276	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	97
PID 3412 wrote to memory of 1276	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	97
PID 3412 wrote to memory of 60	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	98
PID 3412 wrote to memory of 60	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	98
PID 3412 wrote to memory of 4280	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	99
PID 3412 wrote to memory of 4280	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	99
PID 3412 wrote to memory of 4560	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	100
PID 3412 wrote to memory of 4560	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	100
PID 3412 wrote to memory of 3456	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	101
PID 3412 wrote to memory of 3456	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	101
PID 3412 wrote to memory of 4264	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	102
PID 3412 wrote to memory of 4264	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	102
PID 3412 wrote to memory of 1092	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	103
PID 3412 wrote to memory of 1092	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	103
PID 3412 wrote to memory of 2768	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	104
PID 3412 wrote to memory of 2768	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	104
PID 3412 wrote to memory of 5012	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	105
PID 3412 wrote to memory of 5012	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	105
PID 3412 wrote to memory of 1096	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	106
PID 3412 wrote to memory of 1096	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	106
PID 3412 wrote to memory of 3064	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	107
PID 3412 wrote to memory of 3064	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	107
PID 3412 wrote to memory of 3928	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	108
PID 3412 wrote to memory of 3928	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	108
PID 3412 wrote to memory of 2096	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	109
PID 3412 wrote to memory of 2096	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	109
PID 3412 wrote to memory of 3304	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	110
PID 3412 wrote to memory of 3304	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	110
PID 3412 wrote to memory of 1484	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	111
PID 3412 wrote to memory of 1484	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	111
PID 3412 wrote to memory of 1208	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	112
PID 3412 wrote to memory of 1208	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	112
PID 3412 wrote to memory of 2348	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	113
PID 3412 wrote to memory of 2348	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	113
PID 3412 wrote to memory of 2420	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	114
PID 3412 wrote to memory of 2420	3412	16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\16c0c7aede5f2eff2f3dea3d4acfdd00_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4852" "2956" "2880" "2960" "0" "0" "2964" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12896
- C:\Windows\System\AfrKfPy.exe
  C:\Windows\System\AfrKfPy.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\ylhjYYg.exe
  C:\Windows\System\ylhjYYg.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\YMurOqZ.exe
  C:\Windows\System\YMurOqZ.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\JAhniCU.exe
  C:\Windows\System\JAhniCU.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\oYxSGGP.exe
  C:\Windows\System\oYxSGGP.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\WQTnZJS.exe
  C:\Windows\System\WQTnZJS.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\SiWdQNv.exe
  C:\Windows\System\SiWdQNv.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\zgoGVLd.exe
  C:\Windows\System\zgoGVLd.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\KIcoJMc.exe
  C:\Windows\System\KIcoJMc.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\WfSJVAm.exe
  C:\Windows\System\WfSJVAm.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\RpmAhPX.exe
  C:\Windows\System\RpmAhPX.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\KdwaaPC.exe
  C:\Windows\System\KdwaaPC.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\sMHrseS.exe
  C:\Windows\System\sMHrseS.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\UtDTELI.exe
  C:\Windows\System\UtDTELI.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\LTsnrVT.exe
  C:\Windows\System\LTsnrVT.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\RaqEoAF.exe
  C:\Windows\System\RaqEoAF.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\AIZLcxI.exe
  C:\Windows\System\AIZLcxI.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\NYMYvhb.exe
  C:\Windows\System\NYMYvhb.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\HTgmiQF.exe
  C:\Windows\System\HTgmiQF.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\UftiLiM.exe
  C:\Windows\System\UftiLiM.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\DoRlvtM.exe
  C:\Windows\System\DoRlvtM.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\XSwRgSi.exe
  C:\Windows\System\XSwRgSi.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\pSIjxDD.exe
  C:\Windows\System\pSIjxDD.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\GPzxXCc.exe
  C:\Windows\System\GPzxXCc.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\JVSaEKN.exe
  C:\Windows\System\JVSaEKN.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\fqVzOqF.exe
  C:\Windows\System\fqVzOqF.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\NyDSjyM.exe
  C:\Windows\System\NyDSjyM.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\KziMUFg.exe
  C:\Windows\System\KziMUFg.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\WaQaFiS.exe
  C:\Windows\System\WaQaFiS.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\uyroSXy.exe
  C:\Windows\System\uyroSXy.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\IleAUXu.exe
  C:\Windows\System\IleAUXu.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\tXEqUcZ.exe
  C:\Windows\System\tXEqUcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\gydTVbJ.exe
  C:\Windows\System\gydTVbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\vzvoPfs.exe
  C:\Windows\System\vzvoPfs.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\VWtOjWl.exe
  C:\Windows\System\VWtOjWl.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\bjHUjdK.exe
  C:\Windows\System\bjHUjdK.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\PkPjemV.exe
  C:\Windows\System\PkPjemV.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\gAThTBI.exe
  C:\Windows\System\gAThTBI.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\WZDfmQl.exe
  C:\Windows\System\WZDfmQl.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\EsQnCMp.exe
  C:\Windows\System\EsQnCMp.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\wIHbmyy.exe
  C:\Windows\System\wIHbmyy.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\PCQfXbG.exe
  C:\Windows\System\PCQfXbG.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\njAlOVI.exe
  C:\Windows\System\njAlOVI.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\BLwzcKG.exe
  C:\Windows\System\BLwzcKG.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\BSWccDg.exe
  C:\Windows\System\BSWccDg.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\HCSnzQQ.exe
  C:\Windows\System\HCSnzQQ.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\IdJDTIS.exe
  C:\Windows\System\IdJDTIS.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\YLeTJka.exe
  C:\Windows\System\YLeTJka.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\MqnZszs.exe
  C:\Windows\System\MqnZszs.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\JbPbzas.exe
  C:\Windows\System\JbPbzas.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\IfxDEfH.exe
  C:\Windows\System\IfxDEfH.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\wLJHzDH.exe
  C:\Windows\System\wLJHzDH.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\ycZPIaR.exe
  C:\Windows\System\ycZPIaR.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\mOpEyGt.exe
  C:\Windows\System\mOpEyGt.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\MqAYgUF.exe
  C:\Windows\System\MqAYgUF.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\BQnDoyu.exe
  C:\Windows\System\BQnDoyu.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\gaSeNUB.exe
  C:\Windows\System\gaSeNUB.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\UZodxuv.exe
  C:\Windows\System\UZodxuv.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\SXiyVdK.exe
  C:\Windows\System\SXiyVdK.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\NIneFAq.exe
  C:\Windows\System\NIneFAq.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\SloIiBN.exe
  C:\Windows\System\SloIiBN.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\jfhGzBJ.exe
  C:\Windows\System\jfhGzBJ.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\NHohSKr.exe
  C:\Windows\System\NHohSKr.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\wkqOkqt.exe
  C:\Windows\System\wkqOkqt.exe
  2⤵
  PID:4744
- C:\Windows\System\NNQcInG.exe
  C:\Windows\System\NNQcInG.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\bkjVkbX.exe
  C:\Windows\System\bkjVkbX.exe
  2⤵
  PID:1184
- C:\Windows\System\kjCBhbV.exe
  C:\Windows\System\kjCBhbV.exe
  2⤵
  PID:3356
- C:\Windows\System\XGTGVzK.exe
  C:\Windows\System\XGTGVzK.exe
  2⤵
  PID:4956
- C:\Windows\System\MFMjTiK.exe
  C:\Windows\System\MFMjTiK.exe
  2⤵
  PID:3796
- C:\Windows\System\cFynInu.exe
  C:\Windows\System\cFynInu.exe
  2⤵
  PID:3800
- C:\Windows\System\vECedxh.exe
  C:\Windows\System\vECedxh.exe
  2⤵
  PID:3696
- C:\Windows\System\INEOeou.exe
  C:\Windows\System\INEOeou.exe
  2⤵
  PID:3360
- C:\Windows\System\dxRsahU.exe
  C:\Windows\System\dxRsahU.exe
  2⤵
  PID:4108
- C:\Windows\System\rydJncG.exe
  C:\Windows\System\rydJncG.exe
  2⤵
  PID:224
- C:\Windows\System\yDETPwO.exe
  C:\Windows\System\yDETPwO.exe
  2⤵
  PID:4324
- C:\Windows\System\PpJkfwl.exe
  C:\Windows\System\PpJkfwl.exe
  2⤵
  PID:3876
- C:\Windows\System\gjPYLyW.exe
  C:\Windows\System\gjPYLyW.exe
  2⤵
  PID:512
- C:\Windows\System\fwFUqQj.exe
  C:\Windows\System\fwFUqQj.exe
  2⤵
  PID:4016
- C:\Windows\System\UJyRBDT.exe
  C:\Windows\System\UJyRBDT.exe
  2⤵
  PID:2716
- C:\Windows\System\SUeTOYf.exe
  C:\Windows\System\SUeTOYf.exe
  2⤵
  PID:628
- C:\Windows\System\rHZfQeg.exe
  C:\Windows\System\rHZfQeg.exe
  2⤵
  PID:2196
- C:\Windows\System\YsGGbDD.exe
  C:\Windows\System\YsGGbDD.exe
  2⤵
  PID:1060
- C:\Windows\System\zAyWyJv.exe
  C:\Windows\System\zAyWyJv.exe
  2⤵
  PID:2596
- C:\Windows\System\yNhqPZf.exe
  C:\Windows\System\yNhqPZf.exe
  2⤵
  PID:1728
- C:\Windows\System\UdyFpSu.exe
  C:\Windows\System\UdyFpSu.exe
  2⤵
  PID:3344
- C:\Windows\System\EgGeqUN.exe
  C:\Windows\System\EgGeqUN.exe
  2⤵
  PID:4840
- C:\Windows\System\ZXkjphO.exe
  C:\Windows\System\ZXkjphO.exe
  2⤵
  PID:4828
- C:\Windows\System\tQWZTaH.exe
  C:\Windows\System\tQWZTaH.exe
  2⤵
  PID:1376
- C:\Windows\System\XIYWhUP.exe
  C:\Windows\System\XIYWhUP.exe
  2⤵
  PID:4764
- C:\Windows\System\oCVwRyT.exe
  C:\Windows\System\oCVwRyT.exe
  2⤵
  PID:3108
- C:\Windows\System\hVWuieB.exe
  C:\Windows\System\hVWuieB.exe
  2⤵
  PID:2772
- C:\Windows\System\eSntsat.exe
  C:\Windows\System\eSntsat.exe
  2⤵
  PID:4508
- C:\Windows\System\FuMrvUn.exe
  C:\Windows\System\FuMrvUn.exe
  2⤵
  PID:4104
- C:\Windows\System\kndUsEO.exe
  C:\Windows\System\kndUsEO.exe
  2⤵
  PID:4052
- C:\Windows\System\rBEfNha.exe
  C:\Windows\System\rBEfNha.exe
  2⤵
  PID:1076
- C:\Windows\System\DEWZcBz.exe
  C:\Windows\System\DEWZcBz.exe
  2⤵
  PID:2748
- C:\Windows\System\fZSuNyL.exe
  C:\Windows\System\fZSuNyL.exe
  2⤵
  PID:3268
- C:\Windows\System\kJWwQJu.exe
  C:\Windows\System\kJWwQJu.exe
  2⤵
  PID:5164
- C:\Windows\System\gGiOhyQ.exe
  C:\Windows\System\gGiOhyQ.exe
  2⤵
  PID:5184
- C:\Windows\System\vmKZtMx.exe
  C:\Windows\System\vmKZtMx.exe
  2⤵
  PID:5220
- C:\Windows\System\wJKtoLJ.exe
  C:\Windows\System\wJKtoLJ.exe
  2⤵
  PID:5240
- C:\Windows\System\xGDeqZO.exe
  C:\Windows\System\xGDeqZO.exe
  2⤵
  PID:5268
- C:\Windows\System\rnWkUkf.exe
  C:\Windows\System\rnWkUkf.exe
  2⤵
  PID:5296
- C:\Windows\System\cXlSjkx.exe
  C:\Windows\System\cXlSjkx.exe
  2⤵
  PID:5332
- C:\Windows\System\DTzHVLr.exe
  C:\Windows\System\DTzHVLr.exe
  2⤵
  PID:5352
- C:\Windows\System\CuyTrEb.exe
  C:\Windows\System\CuyTrEb.exe
  2⤵
  PID:5380
- C:\Windows\System\utuAOHL.exe
  C:\Windows\System\utuAOHL.exe
  2⤵
  PID:5412
- C:\Windows\System\WGYkDXW.exe
  C:\Windows\System\WGYkDXW.exe
  2⤵
  PID:5444
- C:\Windows\System\tTrjIGT.exe
  C:\Windows\System\tTrjIGT.exe
  2⤵
  PID:5464
- C:\Windows\System\aLDHrgb.exe
  C:\Windows\System\aLDHrgb.exe
  2⤵
  PID:5492
- C:\Windows\System\vJcGYAY.exe
  C:\Windows\System\vJcGYAY.exe
  2⤵
  PID:5520
- C:\Windows\System\alaUqpR.exe
  C:\Windows\System\alaUqpR.exe
  2⤵
  PID:5548
- C:\Windows\System\ZjsDbGh.exe
  C:\Windows\System\ZjsDbGh.exe
  2⤵
  PID:5580
- C:\Windows\System\cRWzWnH.exe
  C:\Windows\System\cRWzWnH.exe
  2⤵
  PID:5604
- C:\Windows\System\TpUCsvB.exe
  C:\Windows\System\TpUCsvB.exe
  2⤵
  PID:5632
- C:\Windows\System\EWpjiIl.exe
  C:\Windows\System\EWpjiIl.exe
  2⤵
  PID:5660
- C:\Windows\System\VdzIJMg.exe
  C:\Windows\System\VdzIJMg.exe
  2⤵
  PID:5688
- C:\Windows\System\tBIDjiu.exe
  C:\Windows\System\tBIDjiu.exe
  2⤵
  PID:5716
- C:\Windows\System\EprPhtr.exe
  C:\Windows\System\EprPhtr.exe
  2⤵
  PID:5744
- C:\Windows\System\UvZGMIT.exe
  C:\Windows\System\UvZGMIT.exe
  2⤵
  PID:5772
- C:\Windows\System\XUjdXST.exe
  C:\Windows\System\XUjdXST.exe
  2⤵
  PID:5808
- C:\Windows\System\eaLGOLa.exe
  C:\Windows\System\eaLGOLa.exe
  2⤵
  PID:5836
- C:\Windows\System\oypjGPL.exe
  C:\Windows\System\oypjGPL.exe
  2⤵
  PID:5856
- C:\Windows\System\NCbdrRX.exe
  C:\Windows\System\NCbdrRX.exe
  2⤵
  PID:5896
- C:\Windows\System\cLBEheB.exe
  C:\Windows\System\cLBEheB.exe
  2⤵
  PID:5920
- C:\Windows\System\BPnxuKd.exe
  C:\Windows\System\BPnxuKd.exe
  2⤵
  PID:5944
- C:\Windows\System\OICiGWt.exe
  C:\Windows\System\OICiGWt.exe
  2⤵
  PID:5972
- C:\Windows\System\PJpafpX.exe
  C:\Windows\System\PJpafpX.exe
  2⤵
  PID:6004
- C:\Windows\System\SxfBgoK.exe
  C:\Windows\System\SxfBgoK.exe
  2⤵
  PID:6036
- C:\Windows\System\nwVYxhw.exe
  C:\Windows\System\nwVYxhw.exe
  2⤵
  PID:6064
- C:\Windows\System\GdZjIWT.exe
  C:\Windows\System\GdZjIWT.exe
  2⤵
  PID:6088
- C:\Windows\System\pXsYTpT.exe
  C:\Windows\System\pXsYTpT.exe
  2⤵
  PID:6112
- C:\Windows\System\WLiJbYL.exe
  C:\Windows\System\WLiJbYL.exe
  2⤵
  PID:3288
- C:\Windows\System\roONNuN.exe
  C:\Windows\System\roONNuN.exe
  2⤵
  PID:5128
- C:\Windows\System\wFbWXpW.exe
  C:\Windows\System\wFbWXpW.exe
  2⤵
  PID:5232
- C:\Windows\System\EiHXTkS.exe
  C:\Windows\System\EiHXTkS.exe
  2⤵
  PID:5288
- C:\Windows\System\UzEUitN.exe
  C:\Windows\System\UzEUitN.exe
  2⤵
  PID:5364
- C:\Windows\System\zyPemfI.exe
  C:\Windows\System\zyPemfI.exe
  2⤵
  PID:5428
- C:\Windows\System\yxNjmzW.exe
  C:\Windows\System\yxNjmzW.exe
  2⤵
  PID:5488
- C:\Windows\System\lnrUvoh.exe
  C:\Windows\System\lnrUvoh.exe
  2⤵
  PID:5560
- C:\Windows\System\HHfizzY.exe
  C:\Windows\System\HHfizzY.exe
  2⤵
  PID:5628
- C:\Windows\System\HgZAvVi.exe
  C:\Windows\System\HgZAvVi.exe
  2⤵
  PID:5684
- C:\Windows\System\ZuexClf.exe
  C:\Windows\System\ZuexClf.exe
  2⤵
  PID:5768
- C:\Windows\System\FiyExJT.exe
  C:\Windows\System\FiyExJT.exe
  2⤵
  PID:5844
- C:\Windows\System\yRbtqzU.exe
  C:\Windows\System\yRbtqzU.exe
  2⤵
  PID:5884
- C:\Windows\System\HUgKuXk.exe
  C:\Windows\System\HUgKuXk.exe
  2⤵
  PID:5956
- C:\Windows\System\mgnnWdo.exe
  C:\Windows\System\mgnnWdo.exe
  2⤵
  PID:6020
- C:\Windows\System\hlLApxX.exe
  C:\Windows\System\hlLApxX.exe
  2⤵
  PID:6080
- C:\Windows\System\IxjyEJK.exe
  C:\Windows\System\IxjyEJK.exe
  2⤵
  PID:6140
- C:\Windows\System\FpebDaI.exe
  C:\Windows\System\FpebDaI.exe
  2⤵
  PID:5228
- C:\Windows\System\OuaJfKc.exe
  C:\Windows\System\OuaJfKc.exe
  2⤵
  PID:5376
- C:\Windows\System\wdWLwIW.exe
  C:\Windows\System\wdWLwIW.exe
  2⤵
  PID:5544
- C:\Windows\System\ypjolqU.exe
  C:\Windows\System\ypjolqU.exe
  2⤵
  PID:5740
- C:\Windows\System\gTMLcgi.exe
  C:\Windows\System\gTMLcgi.exe
  2⤵
  PID:5868
- C:\Windows\System\FzYQZdO.exe
  C:\Windows\System\FzYQZdO.exe
  2⤵
  PID:6012
- C:\Windows\System\fPaoUMF.exe
  C:\Windows\System\fPaoUMF.exe
  2⤵
  PID:5172
- C:\Windows\System\vpvWKMR.exe
  C:\Windows\System\vpvWKMR.exe
  2⤵
  PID:5540
- C:\Windows\System\jqSDdKy.exe
  C:\Windows\System\jqSDdKy.exe
  2⤵
  PID:5672
- C:\Windows\System\OIniMrG.exe
  C:\Windows\System\OIniMrG.exe
  2⤵
  PID:5936
- C:\Windows\System\ANxxudu.exe
  C:\Windows\System\ANxxudu.exe
  2⤵
  PID:5616
- C:\Windows\System\neqMMdU.exe
  C:\Windows\System\neqMMdU.exe
  2⤵
  PID:6176
- C:\Windows\System\LXiSpaO.exe
  C:\Windows\System\LXiSpaO.exe
  2⤵
  PID:6204
- C:\Windows\System\JffTxMp.exe
  C:\Windows\System\JffTxMp.exe
  2⤵
  PID:6248
- C:\Windows\System\UEQNnQs.exe
  C:\Windows\System\UEQNnQs.exe
  2⤵
  PID:6276
- C:\Windows\System\QKUbcey.exe
  C:\Windows\System\QKUbcey.exe
  2⤵
  PID:6308
- C:\Windows\System\qSAGPBG.exe
  C:\Windows\System\qSAGPBG.exe
  2⤵
  PID:6336
- C:\Windows\System\VeWboZU.exe
  C:\Windows\System\VeWboZU.exe
  2⤵
  PID:6360
- C:\Windows\System\TmTyIfU.exe
  C:\Windows\System\TmTyIfU.exe
  2⤵
  PID:6388
- C:\Windows\System\ztBOKYP.exe
  C:\Windows\System\ztBOKYP.exe
  2⤵
  PID:6416
- C:\Windows\System\viApFkS.exe
  C:\Windows\System\viApFkS.exe
  2⤵
  PID:6444
- C:\Windows\System\aeDMUkI.exe
  C:\Windows\System\aeDMUkI.exe
  2⤵
  PID:6472
- C:\Windows\System\soJkjMl.exe
  C:\Windows\System\soJkjMl.exe
  2⤵
  PID:6500
- C:\Windows\System\XxpQgSk.exe
  C:\Windows\System\XxpQgSk.exe
  2⤵
  PID:6528
- C:\Windows\System\aTuvFdZ.exe
  C:\Windows\System\aTuvFdZ.exe
  2⤵
  PID:6560
- C:\Windows\System\eCRUQAG.exe
  C:\Windows\System\eCRUQAG.exe
  2⤵
  PID:6584
- C:\Windows\System\rbSFYkJ.exe
  C:\Windows\System\rbSFYkJ.exe
  2⤵
  PID:6612
- C:\Windows\System\PxejxFn.exe
  C:\Windows\System\PxejxFn.exe
  2⤵
  PID:6644
- C:\Windows\System\SDyBzen.exe
  C:\Windows\System\SDyBzen.exe
  2⤵
  PID:6676
- C:\Windows\System\BsjVVig.exe
  C:\Windows\System\BsjVVig.exe
  2⤵
  PID:6708
- C:\Windows\System\hXQrcOZ.exe
  C:\Windows\System\hXQrcOZ.exe
  2⤵
  PID:6736
- C:\Windows\System\KNIRitI.exe
  C:\Windows\System\KNIRitI.exe
  2⤵
  PID:6772
- C:\Windows\System\ofkRqKH.exe
  C:\Windows\System\ofkRqKH.exe
  2⤵
  PID:6800
- C:\Windows\System\tnwNwDB.exe
  C:\Windows\System\tnwNwDB.exe
  2⤵
  PID:6820
- C:\Windows\System\xeCrttV.exe
  C:\Windows\System\xeCrttV.exe
  2⤵
  PID:6848
- C:\Windows\System\VQNHowA.exe
  C:\Windows\System\VQNHowA.exe
  2⤵
  PID:6876
- C:\Windows\System\LLetreu.exe
  C:\Windows\System\LLetreu.exe
  2⤵
  PID:6904
- C:\Windows\System\YlrIPXG.exe
  C:\Windows\System\YlrIPXG.exe
  2⤵
  PID:6932
- C:\Windows\System\uypkHDf.exe
  C:\Windows\System\uypkHDf.exe
  2⤵
  PID:6952
- C:\Windows\System\JVfZsBW.exe
  C:\Windows\System\JVfZsBW.exe
  2⤵
  PID:6976
- C:\Windows\System\IRuoIwg.exe
  C:\Windows\System\IRuoIwg.exe
  2⤵
  PID:7004
- C:\Windows\System\MMbKVTe.exe
  C:\Windows\System\MMbKVTe.exe
  2⤵
  PID:7044
- C:\Windows\System\dGLqqFv.exe
  C:\Windows\System\dGLqqFv.exe
  2⤵
  PID:7060
- C:\Windows\System\RrDxKlm.exe
  C:\Windows\System\RrDxKlm.exe
  2⤵
  PID:7088
- C:\Windows\System\xdyEyQH.exe
  C:\Windows\System\xdyEyQH.exe
  2⤵
  PID:7116
- C:\Windows\System\jzcnQvu.exe
  C:\Windows\System\jzcnQvu.exe
  2⤵
  PID:7156
- C:\Windows\System\YliSEqc.exe
  C:\Windows\System\YliSEqc.exe
  2⤵
  PID:5852
- C:\Windows\System\XQMUJsV.exe
  C:\Windows\System\XQMUJsV.exe
  2⤵
  PID:6172
- C:\Windows\System\ahAbKkP.exe
  C:\Windows\System\ahAbKkP.exe
  2⤵
  PID:6260
- C:\Windows\System\iLnhJuL.exe
  C:\Windows\System\iLnhJuL.exe
  2⤵
  PID:6296
- C:\Windows\System\iTCSJJn.exe
  C:\Windows\System\iTCSJJn.exe
  2⤵
  PID:6380
- C:\Windows\System\oIxKxqF.exe
  C:\Windows\System\oIxKxqF.exe
  2⤵
  PID:6456
- C:\Windows\System\uOBsebs.exe
  C:\Windows\System\uOBsebs.exe
  2⤵
  PID:6512
- C:\Windows\System\QWWAWZw.exe
  C:\Windows\System\QWWAWZw.exe
  2⤵
  PID:6576
- C:\Windows\System\TsvoZNY.exe
  C:\Windows\System\TsvoZNY.exe
  2⤵
  PID:2804
- C:\Windows\System\lHCuDTY.exe
  C:\Windows\System\lHCuDTY.exe
  2⤵
  PID:6700
- C:\Windows\System\HfqkGOY.exe
  C:\Windows\System\HfqkGOY.exe
  2⤵
  PID:6748
- C:\Windows\System\DBwRqQe.exe
  C:\Windows\System\DBwRqQe.exe
  2⤵
  PID:6832
- C:\Windows\System\LYBytFE.exe
  C:\Windows\System\LYBytFE.exe
  2⤵
  PID:6868
- C:\Windows\System\vACnfkv.exe
  C:\Windows\System\vACnfkv.exe
  2⤵
  PID:6924
- C:\Windows\System\wAZWfxr.exe
  C:\Windows\System\wAZWfxr.exe
  2⤵
  PID:6968
- C:\Windows\System\zRsUTSF.exe
  C:\Windows\System\zRsUTSF.exe
  2⤵
  PID:7024
- C:\Windows\System\IjiljAl.exe
  C:\Windows\System\IjiljAl.exe
  2⤵
  PID:7108
- C:\Windows\System\vWsZofj.exe
  C:\Windows\System\vWsZofj.exe
  2⤵
  PID:7164
- C:\Windows\System\GPTmasz.exe
  C:\Windows\System\GPTmasz.exe
  2⤵
  PID:6232
- C:\Windows\System\TjRrwsN.exe
  C:\Windows\System\TjRrwsN.exe
  2⤵
  PID:6324
- C:\Windows\System\lShqBUg.exe
  C:\Windows\System\lShqBUg.exe
  2⤵
  PID:6540
- C:\Windows\System\VkghnsB.exe
  C:\Windows\System\VkghnsB.exe
  2⤵
  PID:6668
- C:\Windows\System\qIfOYEv.exe
  C:\Windows\System\qIfOYEv.exe
  2⤵
  PID:6816
- C:\Windows\System\POeWtqq.exe
  C:\Windows\System\POeWtqq.exe
  2⤵
  PID:4592
- C:\Windows\System\IuqzmyJ.exe
  C:\Windows\System\IuqzmyJ.exe
  2⤵
  PID:7056
- C:\Windows\System\zVyVWGl.exe
  C:\Windows\System\zVyVWGl.exe
  2⤵
  PID:5344
- C:\Windows\System\KbzxQdt.exe
  C:\Windows\System\KbzxQdt.exe
  2⤵
  PID:6464
- C:\Windows\System\WEEvmhN.exe
  C:\Windows\System\WEEvmhN.exe
  2⤵
  PID:6596
- C:\Windows\System\vKvuIab.exe
  C:\Windows\System\vKvuIab.exe
  2⤵
  PID:3016
- C:\Windows\System\LFjyOIC.exe
  C:\Windows\System\LFjyOIC.exe
  2⤵
  PID:6988
- C:\Windows\System\ldRtaNf.exe
  C:\Windows\System\ldRtaNf.exe
  2⤵
  PID:6412
- C:\Windows\System\xPolZED.exe
  C:\Windows\System\xPolZED.exe
  2⤵
  PID:6992
- C:\Windows\System\JLKsTgH.exe
  C:\Windows\System\JLKsTgH.exe
  2⤵
  PID:3672
- C:\Windows\System\KoVDPHJ.exe
  C:\Windows\System\KoVDPHJ.exe
  2⤵
  PID:7208
- C:\Windows\System\sMWRTGf.exe
  C:\Windows\System\sMWRTGf.exe
  2⤵
  PID:7236
- C:\Windows\System\rYwKuVY.exe
  C:\Windows\System\rYwKuVY.exe
  2⤵
  PID:7264
- C:\Windows\System\VMXTfvH.exe
  C:\Windows\System\VMXTfvH.exe
  2⤵
  PID:7292
- C:\Windows\System\HhQYeED.exe
  C:\Windows\System\HhQYeED.exe
  2⤵
  PID:7320
- C:\Windows\System\vSezLiS.exe
  C:\Windows\System\vSezLiS.exe
  2⤵
  PID:7348
- C:\Windows\System\iIwaWGP.exe
  C:\Windows\System\iIwaWGP.exe
  2⤵
  PID:7368
- C:\Windows\System\PPjAjtE.exe
  C:\Windows\System\PPjAjtE.exe
  2⤵
  PID:7404
- C:\Windows\System\kzdGkFO.exe
  C:\Windows\System\kzdGkFO.exe
  2⤵
  PID:7432
- C:\Windows\System\mVWaqrb.exe
  C:\Windows\System\mVWaqrb.exe
  2⤵
  PID:7448
- C:\Windows\System\yWzZPlT.exe
  C:\Windows\System\yWzZPlT.exe
  2⤵
  PID:7476
- C:\Windows\System\elFvytL.exe
  C:\Windows\System\elFvytL.exe
  2⤵
  PID:7496
- C:\Windows\System\OifOBgU.exe
  C:\Windows\System\OifOBgU.exe
  2⤵
  PID:7532
- C:\Windows\System\CtUQrHp.exe
  C:\Windows\System\CtUQrHp.exe
  2⤵
  PID:7548
- C:\Windows\System\yCOhuCV.exe
  C:\Windows\System\yCOhuCV.exe
  2⤵
  PID:7588
- C:\Windows\System\iKgyZkW.exe
  C:\Windows\System\iKgyZkW.exe
  2⤵
  PID:7628
- C:\Windows\System\OmIgMQr.exe
  C:\Windows\System\OmIgMQr.exe
  2⤵
  PID:7644
- C:\Windows\System\QrOWtTn.exe
  C:\Windows\System\QrOWtTn.exe
  2⤵
  PID:7672
- C:\Windows\System\XvCnWsW.exe
  C:\Windows\System\XvCnWsW.exe
  2⤵
  PID:7700
- C:\Windows\System\NRyMPkx.exe
  C:\Windows\System\NRyMPkx.exe
  2⤵
  PID:7728
- C:\Windows\System\RHZUrVM.exe
  C:\Windows\System\RHZUrVM.exe
  2⤵
  PID:7760
- C:\Windows\System\qIxFVTg.exe
  C:\Windows\System\qIxFVTg.exe
  2⤵
  PID:7792
- C:\Windows\System\IkBjeRG.exe
  C:\Windows\System\IkBjeRG.exe
  2⤵
  PID:7812
- C:\Windows\System\YYwzjVj.exe
  C:\Windows\System\YYwzjVj.exe
  2⤵
  PID:7836
- C:\Windows\System\IznbQSJ.exe
  C:\Windows\System\IznbQSJ.exe
  2⤵
  PID:7868
- C:\Windows\System\EluCsLH.exe
  C:\Windows\System\EluCsLH.exe
  2⤵
  PID:7896
- C:\Windows\System\GdUNiLr.exe
  C:\Windows\System\GdUNiLr.exe
  2⤵
  PID:7924
- C:\Windows\System\KjZMLkB.exe
  C:\Windows\System\KjZMLkB.exe
  2⤵
  PID:7968
- C:\Windows\System\PrRQDvw.exe
  C:\Windows\System\PrRQDvw.exe
  2⤵
  PID:7984
- C:\Windows\System\CdmdceD.exe
  C:\Windows\System\CdmdceD.exe
  2⤵
  PID:8012
- C:\Windows\System\yqXjIyH.exe
  C:\Windows\System\yqXjIyH.exe
  2⤵
  PID:8040
- C:\Windows\System\suFHrEc.exe
  C:\Windows\System\suFHrEc.exe
  2⤵
  PID:8068
- C:\Windows\System\XStYrrA.exe
  C:\Windows\System\XStYrrA.exe
  2⤵
  PID:8112
- C:\Windows\System\uofcFel.exe
  C:\Windows\System\uofcFel.exe
  2⤵
  PID:8132
- C:\Windows\System\dMDfwrP.exe
  C:\Windows\System\dMDfwrP.exe
  2⤵
  PID:8156
- C:\Windows\System\vTlGohN.exe
  C:\Windows\System\vTlGohN.exe
  2⤵
  PID:8184
- C:\Windows\System\kLXseLZ.exe
  C:\Windows\System\kLXseLZ.exe
  2⤵
  PID:7180
- C:\Windows\System\TKPbmCF.exe
  C:\Windows\System\TKPbmCF.exe
  2⤵
  PID:7280
- C:\Windows\System\RkzqytA.exe
  C:\Windows\System\RkzqytA.exe
  2⤵
  PID:7332
- C:\Windows\System\SbpPemS.exe
  C:\Windows\System\SbpPemS.exe
  2⤵
  PID:7400
- C:\Windows\System\BvoKwtR.exe
  C:\Windows\System\BvoKwtR.exe
  2⤵
  PID:7516
- C:\Windows\System\EcNSkPm.exe
  C:\Windows\System\EcNSkPm.exe
  2⤵
  PID:7560
- C:\Windows\System\dajQYyF.exe
  C:\Windows\System\dajQYyF.exe
  2⤵
  PID:7624
- C:\Windows\System\jGABicD.exe
  C:\Windows\System\jGABicD.exe
  2⤵
  PID:7664
- C:\Windows\System\UeEkrVC.exe
  C:\Windows\System\UeEkrVC.exe
  2⤵
  PID:7756
- C:\Windows\System\MMlzcRo.exe
  C:\Windows\System\MMlzcRo.exe
  2⤵
  PID:7804
- C:\Windows\System\rFZvpyh.exe
  C:\Windows\System\rFZvpyh.exe
  2⤵
  PID:7856
- C:\Windows\System\gXfWzIQ.exe
  C:\Windows\System\gXfWzIQ.exe
  2⤵
  PID:7892
- C:\Windows\System\EqQkgDL.exe
  C:\Windows\System\EqQkgDL.exe
  2⤵
  PID:7912
- C:\Windows\System\MsWJnbl.exe
  C:\Windows\System\MsWJnbl.exe
  2⤵
  PID:8020
- C:\Windows\System\paHswpz.exe
  C:\Windows\System\paHswpz.exe
  2⤵
  PID:8032
- C:\Windows\System\MjfurWr.exe
  C:\Windows\System\MjfurWr.exe
  2⤵
  PID:8168
- C:\Windows\System\RZnOMJC.exe
  C:\Windows\System\RZnOMJC.exe
  2⤵
  PID:7184
- C:\Windows\System\XFFWwXy.exe
  C:\Windows\System\XFFWwXy.exe
  2⤵
  PID:7440
- C:\Windows\System\XNUlZmf.exe
  C:\Windows\System\XNUlZmf.exe
  2⤵
  PID:7616
- C:\Windows\System\azksywA.exe
  C:\Windows\System\azksywA.exe
  2⤵
  PID:7776
- C:\Windows\System\mNRiOGa.exe
  C:\Windows\System\mNRiOGa.exe
  2⤵
  PID:3924
- C:\Windows\System\ujbamPA.exe
  C:\Windows\System\ujbamPA.exe
  2⤵
  PID:8000
- C:\Windows\System\bvDgrMg.exe
  C:\Windows\System\bvDgrMg.exe
  2⤵
  PID:6940
- C:\Windows\System\hPhoyyZ.exe
  C:\Windows\System\hPhoyyZ.exe
  2⤵
  PID:7444
- C:\Windows\System\YidjHki.exe
  C:\Windows\System\YidjHki.exe
  2⤵
  PID:3516
- C:\Windows\System\JUrcxlO.exe
  C:\Windows\System\JUrcxlO.exe
  2⤵
  PID:7640
- C:\Windows\System\oAdFCiz.exe
  C:\Windows\System\oAdFCiz.exe
  2⤵
  PID:8196
- C:\Windows\System\PNXmZXF.exe
  C:\Windows\System\PNXmZXF.exe
  2⤵
  PID:8232
- C:\Windows\System\fKzjEDu.exe
  C:\Windows\System\fKzjEDu.exe
  2⤵
  PID:8260
- C:\Windows\System\mBPQxCL.exe
  C:\Windows\System\mBPQxCL.exe
  2⤵
  PID:8292
- C:\Windows\System\ufAsLic.exe
  C:\Windows\System\ufAsLic.exe
  2⤵
  PID:8316
- C:\Windows\System\NjEduyZ.exe
  C:\Windows\System\NjEduyZ.exe
  2⤵
  PID:8348
- C:\Windows\System\YKBOEGi.exe
  C:\Windows\System\YKBOEGi.exe
  2⤵
  PID:8380
- C:\Windows\System\JeXLBtp.exe
  C:\Windows\System\JeXLBtp.exe
  2⤵
  PID:8420
- C:\Windows\System\AeVowjP.exe
  C:\Windows\System\AeVowjP.exe
  2⤵
  PID:8448
- C:\Windows\System\CBIulmG.exe
  C:\Windows\System\CBIulmG.exe
  2⤵
  PID:8476
- C:\Windows\System\DBStNSz.exe
  C:\Windows\System\DBStNSz.exe
  2⤵
  PID:8504
- C:\Windows\System\IxkIlEB.exe
  C:\Windows\System\IxkIlEB.exe
  2⤵
  PID:8540
- C:\Windows\System\DxjqsRQ.exe
  C:\Windows\System\DxjqsRQ.exe
  2⤵
  PID:8568
- C:\Windows\System\IbbzdFf.exe
  C:\Windows\System\IbbzdFf.exe
  2⤵
  PID:8596
- C:\Windows\System\ZVNFsHt.exe
  C:\Windows\System\ZVNFsHt.exe
  2⤵
  PID:8656
- C:\Windows\System\VUDgxbg.exe
  C:\Windows\System\VUDgxbg.exe
  2⤵
  PID:8676
- C:\Windows\System\BZUngpH.exe
  C:\Windows\System\BZUngpH.exe
  2⤵
  PID:8696
- C:\Windows\System\MjuYgZG.exe
  C:\Windows\System\MjuYgZG.exe
  2⤵
  PID:8732
- C:\Windows\System\xvEUnBf.exe
  C:\Windows\System\xvEUnBf.exe
  2⤵
  PID:8780
- C:\Windows\System\cEuqCzv.exe
  C:\Windows\System\cEuqCzv.exe
  2⤵
  PID:8816
- C:\Windows\System\FeGjzCL.exe
  C:\Windows\System\FeGjzCL.exe
  2⤵
  PID:8832
- C:\Windows\System\gAXiRaj.exe
  C:\Windows\System\gAXiRaj.exe
  2⤵
  PID:8868
- C:\Windows\System\FDeUVkh.exe
  C:\Windows\System\FDeUVkh.exe
  2⤵
  PID:8900
- C:\Windows\System\gZPigfr.exe
  C:\Windows\System\gZPigfr.exe
  2⤵
  PID:8940
- C:\Windows\System\tvvbUdU.exe
  C:\Windows\System\tvvbUdU.exe
  2⤵
  PID:8968
- C:\Windows\System\OskgYHO.exe
  C:\Windows\System\OskgYHO.exe
  2⤵
  PID:9004
- C:\Windows\System\jhoqMWN.exe
  C:\Windows\System\jhoqMWN.exe
  2⤵
  PID:9040
- C:\Windows\System\dkhSAJC.exe
  C:\Windows\System\dkhSAJC.exe
  2⤵
  PID:9056
- C:\Windows\System\BNwHyEs.exe
  C:\Windows\System\BNwHyEs.exe
  2⤵
  PID:9104
- C:\Windows\System\JJHzTpU.exe
  C:\Windows\System\JJHzTpU.exe
  2⤵
  PID:9136
- C:\Windows\System\vOcyLsH.exe
  C:\Windows\System\vOcyLsH.exe
  2⤵
  PID:9176
- C:\Windows\System\SlfnPmp.exe
  C:\Windows\System\SlfnPmp.exe
  2⤵
  PID:9192
- C:\Windows\System\otBRJni.exe
  C:\Windows\System\otBRJni.exe
  2⤵
  PID:8212
- C:\Windows\System\wNuvpao.exe
  C:\Windows\System\wNuvpao.exe
  2⤵
  PID:8276
- C:\Windows\System\NUKhyrm.exe
  C:\Windows\System\NUKhyrm.exe
  2⤵
  PID:8360
- C:\Windows\System\LypwvJL.exe
  C:\Windows\System\LypwvJL.exe
  2⤵
  PID:8440
- C:\Windows\System\IemYvYH.exe
  C:\Windows\System\IemYvYH.exe
  2⤵
  PID:8552
- C:\Windows\System\apzGfPi.exe
  C:\Windows\System\apzGfPi.exe
  2⤵
  PID:4712
- C:\Windows\System\CATByEY.exe
  C:\Windows\System\CATByEY.exe
  2⤵
  PID:8688
- C:\Windows\System\PSUrHzE.exe
  C:\Windows\System\PSUrHzE.exe
  2⤵
  PID:8776
- C:\Windows\System\UawFreR.exe
  C:\Windows\System\UawFreR.exe
  2⤵
  PID:8828
- C:\Windows\System\SjwxJHx.exe
  C:\Windows\System\SjwxJHx.exe
  2⤵
  PID:8924
- C:\Windows\System\AbfwxVA.exe
  C:\Windows\System\AbfwxVA.exe
  2⤵
  PID:8984
- C:\Windows\System\hrOExdU.exe
  C:\Windows\System\hrOExdU.exe
  2⤵
  PID:2484
- C:\Windows\System\EigaYVU.exe
  C:\Windows\System\EigaYVU.exe
  2⤵
  PID:9152
- C:\Windows\System\egelrMo.exe
  C:\Windows\System\egelrMo.exe
  2⤵
  PID:8244
- C:\Windows\System\xSqMpSs.exe
  C:\Windows\System\xSqMpSs.exe
  2⤵
  PID:8564
- C:\Windows\System\WwOuqMW.exe
  C:\Windows\System\WwOuqMW.exe
  2⤵
  PID:8608
- C:\Windows\System\uqBnzUq.exe
  C:\Windows\System\uqBnzUq.exe
  2⤵
  PID:8724
- C:\Windows\System\kdCxxUO.exe
  C:\Windows\System\kdCxxUO.exe
  2⤵
  PID:9116
- C:\Windows\System\kXoJNBD.exe
  C:\Windows\System\kXoJNBD.exe
  2⤵
  PID:9212
- C:\Windows\System\LLrTsNb.exe
  C:\Windows\System\LLrTsNb.exe
  2⤵
  PID:8472
- C:\Windows\System\XfxEGvE.exe
  C:\Windows\System\XfxEGvE.exe
  2⤵
  PID:8800
- C:\Windows\System\uUpzJTr.exe
  C:\Windows\System\uUpzJTr.exe
  2⤵
  PID:9224
- C:\Windows\System\BsneMwq.exe
  C:\Windows\System\BsneMwq.exe
  2⤵
  PID:9260
- C:\Windows\System\CSXwhXG.exe
  C:\Windows\System\CSXwhXG.exe
  2⤵
  PID:9296
- C:\Windows\System\qwxaWHF.exe
  C:\Windows\System\qwxaWHF.exe
  2⤵
  PID:9324
- C:\Windows\System\ZikFJqE.exe
  C:\Windows\System\ZikFJqE.exe
  2⤵
  PID:9352
- C:\Windows\System\vBDQaJG.exe
  C:\Windows\System\vBDQaJG.exe
  2⤵
  PID:9376
- C:\Windows\System\zMYaKZu.exe
  C:\Windows\System\zMYaKZu.exe
  2⤵
  PID:9404
- C:\Windows\System\YMHHeGf.exe
  C:\Windows\System\YMHHeGf.exe
  2⤵
  PID:9432
- C:\Windows\System\KQuQekB.exe
  C:\Windows\System\KQuQekB.exe
  2⤵
  PID:9448
- C:\Windows\System\eaCXijb.exe
  C:\Windows\System\eaCXijb.exe
  2⤵
  PID:9480
- C:\Windows\System\kWxtjcf.exe
  C:\Windows\System\kWxtjcf.exe
  2⤵
  PID:9520
- C:\Windows\System\BpdFnGI.exe
  C:\Windows\System\BpdFnGI.exe
  2⤵
  PID:9544
- C:\Windows\System\udlEyDv.exe
  C:\Windows\System\udlEyDv.exe
  2⤵
  PID:9576
- C:\Windows\System\fYLZNQM.exe
  C:\Windows\System\fYLZNQM.exe
  2⤵
  PID:9604
- C:\Windows\System\xrZNOTq.exe
  C:\Windows\System\xrZNOTq.exe
  2⤵
  PID:9632
- C:\Windows\System\eFRRPnc.exe
  C:\Windows\System\eFRRPnc.exe
  2⤵
  PID:9656
- C:\Windows\System\EHMJdvM.exe
  C:\Windows\System\EHMJdvM.exe
  2⤵
  PID:9684
- C:\Windows\System\ReUaGDV.exe
  C:\Windows\System\ReUaGDV.exe
  2⤵
  PID:9724
- C:\Windows\System\GiIcwXE.exe
  C:\Windows\System\GiIcwXE.exe
  2⤵
  PID:9760
- C:\Windows\System\VEtgHah.exe
  C:\Windows\System\VEtgHah.exe
  2⤵
  PID:9788
- C:\Windows\System\CpqUijF.exe
  C:\Windows\System\CpqUijF.exe
  2⤵
  PID:9812
- C:\Windows\System\yrCyrxw.exe
  C:\Windows\System\yrCyrxw.exe
  2⤵
  PID:9840
- C:\Windows\System\lzHFbxq.exe
  C:\Windows\System\lzHFbxq.exe
  2⤵
  PID:9868
- C:\Windows\System\RVdtEKl.exe
  C:\Windows\System\RVdtEKl.exe
  2⤵
  PID:9900
- C:\Windows\System\ouNckiF.exe
  C:\Windows\System\ouNckiF.exe
  2⤵
  PID:9948
- C:\Windows\System\RCoeyDZ.exe
  C:\Windows\System\RCoeyDZ.exe
  2⤵
  PID:9976
- C:\Windows\System\nSBVTot.exe
  C:\Windows\System\nSBVTot.exe
  2⤵
  PID:10004
- C:\Windows\System\nMaFXuj.exe
  C:\Windows\System\nMaFXuj.exe
  2⤵
  PID:10020
- C:\Windows\System\TaxFmrW.exe
  C:\Windows\System\TaxFmrW.exe
  2⤵
  PID:10060
- C:\Windows\System\mAIhOow.exe
  C:\Windows\System\mAIhOow.exe
  2⤵
  PID:10076
- C:\Windows\System\JAUyxYf.exe
  C:\Windows\System\JAUyxYf.exe
  2⤵
  PID:10100
- C:\Windows\System\cewLbQk.exe
  C:\Windows\System\cewLbQk.exe
  2⤵
  PID:10140
- C:\Windows\System\affmTVf.exe
  C:\Windows\System\affmTVf.exe
  2⤵
  PID:10168
- C:\Windows\System\FxtDemF.exe
  C:\Windows\System\FxtDemF.exe
  2⤵
  PID:10188
- C:\Windows\System\BKlgDcQ.exe
  C:\Windows\System\BKlgDcQ.exe
  2⤵
  PID:10220
- C:\Windows\System\uiUsEvP.exe
  C:\Windows\System\uiUsEvP.exe
  2⤵
  PID:9020
- C:\Windows\System\eSPYVRV.exe
  C:\Windows\System\eSPYVRV.exe
  2⤵
  PID:9164
- C:\Windows\System\vDsLlTz.exe
  C:\Windows\System\vDsLlTz.exe
  2⤵
  PID:9336
- C:\Windows\System\VYgqhng.exe
  C:\Windows\System\VYgqhng.exe
  2⤵
  PID:9364
- C:\Windows\System\pfRYBEQ.exe
  C:\Windows\System\pfRYBEQ.exe
  2⤵
  PID:9444
- C:\Windows\System\DOQfFIl.exe
  C:\Windows\System\DOQfFIl.exe
  2⤵
  PID:9468
- C:\Windows\System\TuxgWNB.exe
  C:\Windows\System\TuxgWNB.exe
  2⤵
  PID:9596
- C:\Windows\System\Qyfnacs.exe
  C:\Windows\System\Qyfnacs.exe
  2⤵
  PID:9652
- C:\Windows\System\kYbwjvO.exe
  C:\Windows\System\kYbwjvO.exe
  2⤵
  PID:9712
- C:\Windows\System\Juxudwk.exe
  C:\Windows\System\Juxudwk.exe
  2⤵
  PID:9824
- C:\Windows\System\iSngdmd.exe
  C:\Windows\System\iSngdmd.exe
  2⤵
  PID:9860
- C:\Windows\System\IJLzfwR.exe
  C:\Windows\System\IJLzfwR.exe
  2⤵
  PID:9932
- C:\Windows\System\QbGdsID.exe
  C:\Windows\System\QbGdsID.exe
  2⤵
  PID:9964
- C:\Windows\System\MylUTnr.exe
  C:\Windows\System\MylUTnr.exe
  2⤵
  PID:10044
- C:\Windows\System\LzlFwdL.exe
  C:\Windows\System\LzlFwdL.exe
  2⤵
  PID:10096
- C:\Windows\System\ZiUNNyN.exe
  C:\Windows\System\ZiUNNyN.exe
  2⤵
  PID:10204
- C:\Windows\System\KoIxZmA.exe
  C:\Windows\System\KoIxZmA.exe
  2⤵
  PID:9236
- C:\Windows\System\aKZWXsG.exe
  C:\Windows\System\aKZWXsG.exe
  2⤵
  PID:9396
- C:\Windows\System\xDMzUDQ.exe
  C:\Windows\System\xDMzUDQ.exe
  2⤵
  PID:9540
- C:\Windows\System\QEscMql.exe
  C:\Windows\System\QEscMql.exe
  2⤵
  PID:9736
- C:\Windows\System\wzOjjkC.exe
  C:\Windows\System\wzOjjkC.exe
  2⤵
  PID:9916
- C:\Windows\System\kzEvwSG.exe
  C:\Windows\System\kzEvwSG.exe
  2⤵
  PID:9996
- C:\Windows\System\zMTTOEy.exe
  C:\Windows\System\zMTTOEy.exe
  2⤵
  PID:10200
- C:\Windows\System\DphuQQG.exe
  C:\Windows\System\DphuQQG.exe
  2⤵
  PID:9428
- C:\Windows\System\XvdFiwt.exe
  C:\Windows\System\XvdFiwt.exe
  2⤵
  PID:9896
- C:\Windows\System\NCKoesL.exe
  C:\Windows\System\NCKoesL.exe
  2⤵
  PID:10184
- C:\Windows\System\OsAqaFu.exe
  C:\Windows\System\OsAqaFu.exe
  2⤵
  PID:9568
- C:\Windows\System\zIJATwU.exe
  C:\Windows\System\zIJATwU.exe
  2⤵
  PID:10248
- C:\Windows\System\SOGLTBo.exe
  C:\Windows\System\SOGLTBo.exe
  2⤵
  PID:10288
- C:\Windows\System\XZbVAFt.exe
  C:\Windows\System\XZbVAFt.exe
  2⤵
  PID:10316
- C:\Windows\System\yqdYOuq.exe
  C:\Windows\System\yqdYOuq.exe
  2⤵
  PID:10344
- C:\Windows\System\lkhqHqM.exe
  C:\Windows\System\lkhqHqM.exe
  2⤵
  PID:10372
- C:\Windows\System\YDWXMKt.exe
  C:\Windows\System\YDWXMKt.exe
  2⤵
  PID:10408
- C:\Windows\System\EYdFbcK.exe
  C:\Windows\System\EYdFbcK.exe
  2⤵
  PID:10424
- C:\Windows\System\jGtfoBD.exe
  C:\Windows\System\jGtfoBD.exe
  2⤵
  PID:10440
- C:\Windows\System\gojSJMM.exe
  C:\Windows\System\gojSJMM.exe
  2⤵
  PID:10464
- C:\Windows\System\KLRSYNV.exe
  C:\Windows\System\KLRSYNV.exe
  2⤵
  PID:10492
- C:\Windows\System\RSLgSgj.exe
  C:\Windows\System\RSLgSgj.exe
  2⤵
  PID:10512
- C:\Windows\System\YvPtLfD.exe
  C:\Windows\System\YvPtLfD.exe
  2⤵
  PID:10568
- C:\Windows\System\iJDjLZx.exe
  C:\Windows\System\iJDjLZx.exe
  2⤵
  PID:10604
- C:\Windows\System\VKIfVdQ.exe
  C:\Windows\System\VKIfVdQ.exe
  2⤵
  PID:10632
- C:\Windows\System\NfQkqDo.exe
  C:\Windows\System\NfQkqDo.exe
  2⤵
  PID:10660
- C:\Windows\System\NGgMewc.exe
  C:\Windows\System\NGgMewc.exe
  2⤵
  PID:10688
- C:\Windows\System\JkYSpba.exe
  C:\Windows\System\JkYSpba.exe
  2⤵
  PID:10708
- C:\Windows\System\KFsVWoz.exe
  C:\Windows\System\KFsVWoz.exe
  2⤵
  PID:10740
- C:\Windows\System\VOwdRms.exe
  C:\Windows\System\VOwdRms.exe
  2⤵
  PID:10764
- C:\Windows\System\IsYGpYQ.exe
  C:\Windows\System\IsYGpYQ.exe
  2⤵
  PID:10796
- C:\Windows\System\WGhyQLS.exe
  C:\Windows\System\WGhyQLS.exe
  2⤵
  PID:10820
- C:\Windows\System\UuhxPfV.exe
  C:\Windows\System\UuhxPfV.exe
  2⤵
  PID:10860
- C:\Windows\System\anVQxwa.exe
  C:\Windows\System\anVQxwa.exe
  2⤵
  PID:10888
- C:\Windows\System\eamzCeD.exe
  C:\Windows\System\eamzCeD.exe
  2⤵
  PID:10924
- C:\Windows\System\cngRsnf.exe
  C:\Windows\System\cngRsnf.exe
  2⤵
  PID:10956
- C:\Windows\System\fDocHrh.exe
  C:\Windows\System\fDocHrh.exe
  2⤵
  PID:10984
- C:\Windows\System\nszmMlw.exe
  C:\Windows\System\nszmMlw.exe
  2⤵
  PID:11020
- C:\Windows\System\pBarKiB.exe
  C:\Windows\System\pBarKiB.exe
  2⤵
  PID:11048
- C:\Windows\System\LJfbtQM.exe
  C:\Windows\System\LJfbtQM.exe
  2⤵
  PID:11088
- C:\Windows\System\bHURChw.exe
  C:\Windows\System\bHURChw.exe
  2⤵
  PID:11120
- C:\Windows\System\KknGmhN.exe
  C:\Windows\System\KknGmhN.exe
  2⤵
  PID:11148
- C:\Windows\System\CZwoOdg.exe
  C:\Windows\System\CZwoOdg.exe
  2⤵
  PID:11164
- C:\Windows\System\jDXwMVq.exe
  C:\Windows\System\jDXwMVq.exe
  2⤵
  PID:11196
- C:\Windows\System\vsDSNKI.exe
  C:\Windows\System\vsDSNKI.exe
  2⤵
  PID:11220
- C:\Windows\System\yqaXLXk.exe
  C:\Windows\System\yqaXLXk.exe
  2⤵
  PID:11240
- C:\Windows\System\DeCBKEw.exe
  C:\Windows\System\DeCBKEw.exe
  2⤵
  PID:10260
- C:\Windows\System\xTufDAL.exe
  C:\Windows\System\xTufDAL.exe
  2⤵
  PID:10328
- C:\Windows\System\NlBuwwc.exe
  C:\Windows\System\NlBuwwc.exe
  2⤵
  PID:10396
- C:\Windows\System\VPTgQPo.exe
  C:\Windows\System\VPTgQPo.exe
  2⤵
  PID:10452
- C:\Windows\System\zZzhXvH.exe
  C:\Windows\System\zZzhXvH.exe
  2⤵
  PID:10540
- C:\Windows\System\XnehaWq.exe
  C:\Windows\System\XnehaWq.exe
  2⤵
  PID:10616
- C:\Windows\System\RHUZuhJ.exe
  C:\Windows\System\RHUZuhJ.exe
  2⤵
  PID:10684
- C:\Windows\System\YIQInlU.exe
  C:\Windows\System\YIQInlU.exe
  2⤵
  PID:10696
- C:\Windows\System\vVQMvTr.exe
  C:\Windows\System\vVQMvTr.exe
  2⤵
  PID:10780
- C:\Windows\System\pyXXiMK.exe
  C:\Windows\System\pyXXiMK.exe
  2⤵
  PID:10880
- C:\Windows\System\DbgwFgE.exe
  C:\Windows\System\DbgwFgE.exe
  2⤵
  PID:10948
- C:\Windows\System\KZesdqX.exe
  C:\Windows\System\KZesdqX.exe
  2⤵
  PID:11040
- C:\Windows\System\NADfJKx.exe
  C:\Windows\System\NADfJKx.exe
  2⤵
  PID:11104
- C:\Windows\System\qHgxyCO.exe
  C:\Windows\System\qHgxyCO.exe
  2⤵
  PID:11140
- C:\Windows\System\EWHgoOu.exe
  C:\Windows\System\EWHgoOu.exe
  2⤵
  PID:11204
- C:\Windows\System\VPTzIVL.exe
  C:\Windows\System\VPTzIVL.exe
  2⤵
  PID:10300
- C:\Windows\System\SsQQhbd.exe
  C:\Windows\System\SsQQhbd.exe
  2⤵
  PID:10480
- C:\Windows\System\STRnLfX.exe
  C:\Windows\System\STRnLfX.exe
  2⤵
  PID:10592
- C:\Windows\System\fvbHvkk.exe
  C:\Windows\System\fvbHvkk.exe
  2⤵
  PID:10812
- C:\Windows\System\zPrukKA.exe
  C:\Windows\System\zPrukKA.exe
  2⤵
  PID:10868
- C:\Windows\System\dPODifi.exe
  C:\Windows\System\dPODifi.exe
  2⤵
  PID:11028
- C:\Windows\System\OPAoOoS.exe
  C:\Windows\System\OPAoOoS.exe
  2⤵
  PID:11176
- C:\Windows\System\seHnVOA.exe
  C:\Windows\System\seHnVOA.exe
  2⤵
  PID:8344
- C:\Windows\System\IuGBXTa.exe
  C:\Windows\System\IuGBXTa.exe
  2⤵
  PID:10936
- C:\Windows\System\iMlZSZc.exe
  C:\Windows\System\iMlZSZc.exe
  2⤵
  PID:10392
- C:\Windows\System\LmRfjHY.exe
  C:\Windows\System\LmRfjHY.exe
  2⤵
  PID:4304
- C:\Windows\System\zQQHiCx.exe
  C:\Windows\System\zQQHiCx.exe
  2⤵
  PID:11284
- C:\Windows\System\fMseCMs.exe
  C:\Windows\System\fMseCMs.exe
  2⤵
  PID:11300
- C:\Windows\System\gtfJYfm.exe
  C:\Windows\System\gtfJYfm.exe
  2⤵
  PID:11340
- C:\Windows\System\bMFTsDB.exe
  C:\Windows\System\bMFTsDB.exe
  2⤵
  PID:11368
- C:\Windows\System\OcceCvI.exe
  C:\Windows\System\OcceCvI.exe
  2⤵
  PID:11396
- C:\Windows\System\uiAMgeJ.exe
  C:\Windows\System\uiAMgeJ.exe
  2⤵
  PID:11428
- C:\Windows\System\MegeCkB.exe
  C:\Windows\System\MegeCkB.exe
  2⤵
  PID:11456
- C:\Windows\System\RtSGhKY.exe
  C:\Windows\System\RtSGhKY.exe
  2⤵
  PID:11484
- C:\Windows\System\gnDSqUj.exe
  C:\Windows\System\gnDSqUj.exe
  2⤵
  PID:11504
- C:\Windows\System\wzoErrR.exe
  C:\Windows\System\wzoErrR.exe
  2⤵
  PID:11528
- C:\Windows\System\uuebegB.exe
  C:\Windows\System\uuebegB.exe
  2⤵
  PID:11564
- C:\Windows\System\uCbVviW.exe
  C:\Windows\System\uCbVviW.exe
  2⤵
  PID:11584
- C:\Windows\System\JERctof.exe
  C:\Windows\System\JERctof.exe
  2⤵
  PID:11612
- C:\Windows\System\bHAymaO.exe
  C:\Windows\System\bHAymaO.exe
  2⤵
  PID:11628
- C:\Windows\System\zPjgQyq.exe
  C:\Windows\System\zPjgQyq.exe
  2⤵
  PID:11672
- C:\Windows\System\OvRSbxJ.exe
  C:\Windows\System\OvRSbxJ.exe
  2⤵
  PID:11700
- C:\Windows\System\HLcxABc.exe
  C:\Windows\System\HLcxABc.exe
  2⤵
  PID:11728
- C:\Windows\System\ZfegBLZ.exe
  C:\Windows\System\ZfegBLZ.exe
  2⤵
  PID:11752
- C:\Windows\System\WAMIpdF.exe
  C:\Windows\System\WAMIpdF.exe
  2⤵
  PID:11768
- C:\Windows\System\VbCtwQp.exe
  C:\Windows\System\VbCtwQp.exe
  2⤵
  PID:11804
- C:\Windows\System\XXYsrtj.exe
  C:\Windows\System\XXYsrtj.exe
  2⤵
  PID:11824
- C:\Windows\System\Ztnbqzb.exe
  C:\Windows\System\Ztnbqzb.exe
  2⤵
  PID:11860
- C:\Windows\System\CBeQYdu.exe
  C:\Windows\System\CBeQYdu.exe
  2⤵
  PID:11880
- C:\Windows\System\pTNBtCs.exe
  C:\Windows\System\pTNBtCs.exe
  2⤵
  PID:11916
- C:\Windows\System\iNwDouu.exe
  C:\Windows\System\iNwDouu.exe
  2⤵
  PID:11960
- C:\Windows\System\HfzULKk.exe
  C:\Windows\System\HfzULKk.exe
  2⤵
  PID:11988
- C:\Windows\System\OgNJJFI.exe
  C:\Windows\System\OgNJJFI.exe
  2⤵
  PID:12016
- C:\Windows\System\HBPtLsY.exe
  C:\Windows\System\HBPtLsY.exe
  2⤵
  PID:12032
- C:\Windows\System\JsBNwfc.exe
  C:\Windows\System\JsBNwfc.exe
  2⤵
  PID:12064
- C:\Windows\System\pDFRVnY.exe
  C:\Windows\System\pDFRVnY.exe
  2⤵
  PID:12092
- C:\Windows\System\CeVHBuc.exe
  C:\Windows\System\CeVHBuc.exe
  2⤵
  PID:12128
- C:\Windows\System\yckvFGl.exe
  C:\Windows\System\yckvFGl.exe
  2⤵
  PID:12156
- C:\Windows\System\mCReeyX.exe
  C:\Windows\System\mCReeyX.exe
  2⤵
  PID:12208
- C:\Windows\System\CjdNCoM.exe
  C:\Windows\System\CjdNCoM.exe
  2⤵
  PID:12224
- C:\Windows\System\AOTnmAA.exe
  C:\Windows\System\AOTnmAA.exe
  2⤵
  PID:12252
- C:\Windows\System\uPfyIGN.exe
  C:\Windows\System\uPfyIGN.exe
  2⤵
  PID:12280
- C:\Windows\System\PtAcqIY.exe
  C:\Windows\System\PtAcqIY.exe
  2⤵
  PID:11328
- C:\Windows\System\xaxNrOu.exe
  C:\Windows\System\xaxNrOu.exe
  2⤵
  PID:11312
- C:\Windows\System\NZILwek.exe
  C:\Windows\System\NZILwek.exe
  2⤵
  PID:11380
- C:\Windows\System\XFnPEtP.exe
  C:\Windows\System\XFnPEtP.exe
  2⤵
  PID:11448
- C:\Windows\System\DYNGwOL.exe
  C:\Windows\System\DYNGwOL.exe
  2⤵
  PID:11496
- C:\Windows\System\hekeSGG.exe
  C:\Windows\System\hekeSGG.exe
  2⤵
  PID:11600
- C:\Windows\System\BITHxVw.exe
  C:\Windows\System\BITHxVw.exe
  2⤵
  PID:11648
- C:\Windows\System\lUtkYJg.exe
  C:\Windows\System\lUtkYJg.exe
  2⤵
  PID:11744
- C:\Windows\System\KNIUGyw.exe
  C:\Windows\System\KNIUGyw.exe
  2⤵
  PID:11780
- C:\Windows\System\LRFCuwk.exe
  C:\Windows\System\LRFCuwk.exe
  2⤵
  PID:11872
- C:\Windows\System\dOwEelt.exe
  C:\Windows\System\dOwEelt.exe
  2⤵
  PID:11952
- C:\Windows\System\NHCVeCA.exe
  C:\Windows\System\NHCVeCA.exe
  2⤵
  PID:12000
- C:\Windows\System\RqyRgIw.exe
  C:\Windows\System\RqyRgIw.exe
  2⤵
  PID:12060
- C:\Windows\System\FqYtyAO.exe
  C:\Windows\System\FqYtyAO.exe
  2⤵
  PID:12116
- C:\Windows\System\nqXIWFs.exe
  C:\Windows\System\nqXIWFs.exe
  2⤵
  PID:12164
- C:\Windows\System\lPiLzpW.exe
  C:\Windows\System\lPiLzpW.exe
  2⤵
  PID:12264
- C:\Windows\System\SPvnyDx.exe
  C:\Windows\System\SPvnyDx.exe
  2⤵
  PID:11384
- C:\Windows\System\ctUfFdQ.exe
  C:\Windows\System\ctUfFdQ.exe
  2⤵
  PID:11468
- C:\Windows\System\ZnEudEX.exe
  C:\Windows\System\ZnEudEX.exe
  2⤵
  PID:11680
- C:\Windows\System\OPNXiOH.exe
  C:\Windows\System\OPNXiOH.exe
  2⤵
  PID:11764
- C:\Windows\System\itjZGgu.exe
  C:\Windows\System\itjZGgu.exe
  2⤵
  PID:11876
- C:\Windows\System\kafuzjl.exe
  C:\Windows\System\kafuzjl.exe
  2⤵
  PID:11972
- C:\Windows\System\wAbEiRi.exe
  C:\Windows\System\wAbEiRi.exe
  2⤵
  PID:12028
- C:\Windows\System\CslDXZe.exe
  C:\Windows\System\CslDXZe.exe
  2⤵
  PID:12268
- C:\Windows\System\BwUfaBm.exe
  C:\Windows\System\BwUfaBm.exe
  2⤵
  PID:11736
- C:\Windows\System\TIPQSGX.exe
  C:\Windows\System\TIPQSGX.exe
  2⤵
  PID:12112
- C:\Windows\System\NONPUzp.exe
  C:\Windows\System\NONPUzp.exe
  2⤵
  PID:11416
- C:\Windows\System\pSsdqkH.exe
  C:\Windows\System\pSsdqkH.exe
  2⤵
  PID:12296
- C:\Windows\System\xFnriqP.exe
  C:\Windows\System\xFnriqP.exe
  2⤵
  PID:12316
- C:\Windows\System\RtzDxcV.exe
  C:\Windows\System\RtzDxcV.exe
  2⤵
  PID:12348
- C:\Windows\System\bKqlDjr.exe
  C:\Windows\System\bKqlDjr.exe
  2⤵
  PID:12384
- C:\Windows\System\EpCroOO.exe
  C:\Windows\System\EpCroOO.exe
  2⤵
  PID:12420
- C:\Windows\System\ePcDkKQ.exe
  C:\Windows\System\ePcDkKQ.exe
  2⤵
  PID:12448
- C:\Windows\System\oQJgsUn.exe
  C:\Windows\System\oQJgsUn.exe
  2⤵
  PID:12476
- C:\Windows\System\CXhjmvA.exe
  C:\Windows\System\CXhjmvA.exe
  2⤵
  PID:12504
- C:\Windows\System\BzXTcNB.exe
  C:\Windows\System\BzXTcNB.exe
  2⤵
  PID:12540
- C:\Windows\System\vKTidfP.exe
  C:\Windows\System\vKTidfP.exe
  2⤵
  PID:12568
- C:\Windows\System\hhkOexD.exe
  C:\Windows\System\hhkOexD.exe
  2⤵
  PID:12600
- C:\Windows\System\zWrJQVh.exe
  C:\Windows\System\zWrJQVh.exe
  2⤵
  PID:12632
- C:\Windows\System\pRNijRj.exe
  C:\Windows\System\pRNijRj.exe
  2⤵
  PID:12648
- C:\Windows\System\QfOZwbo.exe
  C:\Windows\System\QfOZwbo.exe
  2⤵
  PID:12684
- C:\Windows\System\gRMRPyH.exe
  C:\Windows\System\gRMRPyH.exe
  2⤵
  PID:12708
- C:\Windows\System\zZIFayS.exe
  C:\Windows\System\zZIFayS.exe
  2⤵
  PID:12736
- C:\Windows\System\RmiTwWb.exe
  C:\Windows\System\RmiTwWb.exe
  2⤵
  PID:12764
- C:\Windows\System\hAvhrMP.exe
  C:\Windows\System\hAvhrMP.exe
  2⤵
  PID:12800
- C:\Windows\System\ptljaku.exe
  C:\Windows\System\ptljaku.exe
  2⤵
  PID:12836
- C:\Windows\System\piINkxI.exe
  C:\Windows\System\piINkxI.exe
  2⤵
  PID:12876
- C:\Windows\System\uEZIYpn.exe
  C:\Windows\System\uEZIYpn.exe
  2⤵
  PID:12916
- C:\Windows\System\QDOKbuh.exe
  C:\Windows\System\QDOKbuh.exe
  2⤵
  PID:12952
- C:\Windows\System\QRixAaf.exe
  C:\Windows\System\QRixAaf.exe
  2⤵
  PID:13000
- C:\Windows\System\arOalDw.exe
  C:\Windows\System\arOalDw.exe
  2⤵
  PID:13056
- C:\Windows\System\WDJhaCN.exe
  C:\Windows\System\WDJhaCN.exe
  2⤵
  PID:13080
- C:\Windows\System\PXviJzB.exe
  C:\Windows\System\PXviJzB.exe
  2⤵
  PID:13108
- C:\Windows\System\ZJtXcDg.exe
  C:\Windows\System\ZJtXcDg.exe
  2⤵
  PID:13140
- C:\Windows\System\kOYlZun.exe
  C:\Windows\System\kOYlZun.exe
  2⤵
  PID:13172
- C:\Windows\System\XprPFKw.exe
  C:\Windows\System\XprPFKw.exe
  2⤵
  PID:13196
- C:\Windows\System\RnIqQsE.exe
  C:\Windows\System\RnIqQsE.exe
  2⤵
  PID:13232
- C:\Windows\System\PiEDCZa.exe
  C:\Windows\System\PiEDCZa.exe
  2⤵
  PID:12488
- C:\Windows\System\zDkwQGa.exe
  C:\Windows\System\zDkwQGa.exe
  2⤵
  PID:12584
- C:\Windows\System\RfnQuNT.exe
  C:\Windows\System\RfnQuNT.exe
  2⤵
  PID:12616
- C:\Windows\System\GcHcMfN.exe
  C:\Windows\System\GcHcMfN.exe
  2⤵
  PID:12668
- C:\Windows\System\ZpqqBMe.exe
  C:\Windows\System\ZpqqBMe.exe
  2⤵
  PID:12704
- C:\Windows\System\ZZoJGAi.exe
  C:\Windows\System\ZZoJGAi.exe
  2⤵
  PID:12776
- C:\Windows\System\YsKeypX.exe
  C:\Windows\System\YsKeypX.exe
  2⤵
  PID:3128
- C:\Windows\System\ERgCZBi.exe
  C:\Windows\System\ERgCZBi.exe
  2⤵
  PID:12820
- C:\Windows\System\VaksNAB.exe
  C:\Windows\System\VaksNAB.exe
  2⤵
  PID:12900
- C:\Windows\System\lbcdcaT.exe
  C:\Windows\System\lbcdcaT.exe
  2⤵
  PID:13008
- C:\Windows\System\DDctwbe.exe
  C:\Windows\System\DDctwbe.exe
  2⤵
  PID:13076
- C:\Windows\System\MLcaNBN.exe
  C:\Windows\System\MLcaNBN.exe
  2⤵
  PID:13152
- C:\Windows\System\hDrbZmc.exe
  C:\Windows\System\hDrbZmc.exe
  2⤵
  PID:2624
- C:\Windows\System\vVEUmUv.exe
  C:\Windows\System\vVEUmUv.exe
  2⤵
  PID:13188
- C:\Windows\System\jZFMCmv.exe
  C:\Windows\System\jZFMCmv.exe
  2⤵
  PID:3068
- C:\Windows\System\GwuNTbI.exe
  C:\Windows\System\GwuNTbI.exe
  2⤵
  PID:3328
- C:\Windows\System\OeerBHv.exe
  C:\Windows\System\OeerBHv.exe
  2⤵
  PID:4632
- C:\Windows\System\hoRMNvE.exe
  C:\Windows\System\hoRMNvE.exe
  2⤵
  PID:3040
- C:\Windows\System\cNBqBxJ.exe
  C:\Windows\System\cNBqBxJ.exe
  2⤵
  PID:4808
- C:\Windows\System\ePqSphS.exe
  C:\Windows\System\ePqSphS.exe
  2⤵
  PID:1200
- C:\Windows\System\Jxtajyj.exe
  C:\Windows\System\Jxtajyj.exe
  2⤵
  PID:4888
- C:\Windows\System\rAPOriA.exe
  C:\Windows\System\rAPOriA.exe
  2⤵
  PID:4348
- C:\Windows\System\tjYGhqG.exe
  C:\Windows\System\tjYGhqG.exe
  2⤵
  PID:3936
- C:\Windows\System\TJfqXdD.exe
  C:\Windows\System\TJfqXdD.exe
  2⤵
  PID:4816
- C:\Windows\System\fUObtqm.exe
  C:\Windows\System\fUObtqm.exe
  2⤵
  PID:4720
- C:\Windows\System\AAkCBLy.exe
  C:\Windows\System\AAkCBLy.exe
  2⤵
  PID:4876
- C:\Windows\System\yjhscHT.exe
  C:\Windows\System\yjhscHT.exe
  2⤵
  PID:2240
- C:\Windows\System\UcBMeBC.exe
  C:\Windows\System\UcBMeBC.exe
  2⤵
  PID:1788
- C:\Windows\System\jIyBOFq.exe
  C:\Windows\System\jIyBOFq.exe
  2⤵
  PID:1492
- C:\Windows\System\NFNVBOW.exe
  C:\Windows\System\NFNVBOW.exe
  2⤵
  PID:3100
- C:\Windows\System\ZeqmxgJ.exe
  C:\Windows\System\ZeqmxgJ.exe
  2⤵
  PID:2300
- C:\Windows\System\oalFqur.exe
  C:\Windows\System\oalFqur.exe
  2⤵
  PID:1272
- C:\Windows\System\HEegElB.exe
  C:\Windows\System\HEegElB.exe
  2⤵
  PID:4684
- C:\Windows\System\myKjpCY.exe
  C:\Windows\System\myKjpCY.exe
  2⤵
  PID:2336
- C:\Windows\System\iIAUsXN.exe
  C:\Windows\System\iIAUsXN.exe
  2⤵
  PID:4544
- C:\Windows\System\soxBKjV.exe
  C:\Windows\System\soxBKjV.exe
  2⤵
  PID:3400
- C:\Windows\System\HDKwYFP.exe
  C:\Windows\System\HDKwYFP.exe
  2⤵
  PID:2656
- C:\Windows\System\RTOMIeD.exe
  C:\Windows\System\RTOMIeD.exe
  2⤵
  PID:1956
- C:\Windows\System\GXVjjrW.exe
  C:\Windows\System\GXVjjrW.exe
  2⤵
  PID:3940
- C:\Windows\System\mUlEReC.exe
  C:\Windows\System\mUlEReC.exe
  2⤵
  PID:4436
- C:\Windows\System\fejGBTA.exe
  C:\Windows\System\fejGBTA.exe
  2⤵
  PID:952
- C:\Windows\System\FpmHRgp.exe
  C:\Windows\System\FpmHRgp.exe
  2⤵
  PID:1600
- C:\Windows\System\YdhZqBn.exe
  C:\Windows\System\YdhZqBn.exe
  2⤵
  PID:2924
- C:\Windows\System\iHNYevl.exe
  C:\Windows\System\iHNYevl.exe
  2⤵
  PID:3140
- C:\Windows\System\qQmuhBY.exe
  C:\Windows\System\qQmuhBY.exe
  2⤵
  PID:4380
- C:\Windows\System\jrTQUxS.exe
  C:\Windows\System\jrTQUxS.exe
  2⤵
  PID:2948
- C:\Windows\System\wqlIWLr.exe
  C:\Windows\System\wqlIWLr.exe
  2⤵
  PID:2500
- C:\Windows\System\WXDaMze.exe
  C:\Windows\System\WXDaMze.exe
  2⤵
  PID:3852
- C:\Windows\System\LXyHgXU.exe
  C:\Windows\System\LXyHgXU.exe
  2⤵
  PID:5160
- C:\Windows\System\zseGtWD.exe
  C:\Windows\System\zseGtWD.exe
  2⤵
  PID:5212
- C:\Windows\System\YGAohRH.exe
  C:\Windows\System\YGAohRH.exe
  2⤵
  PID:2020
- C:\Windows\System\ngVpRYR.exe
  C:\Windows\System\ngVpRYR.exe
  2⤵
  PID:5276
- C:\Windows\System\KVQkBTg.exe
  C:\Windows\System\KVQkBTg.exe
  2⤵
  PID:924
- C:\Windows\System\sEjgNQM.exe
  C:\Windows\System\sEjgNQM.exe
  2⤵
  PID:5304
- C:\Windows\System\KNfjdhi.exe
  C:\Windows\System\KNfjdhi.exe
  2⤵
  PID:2032
- C:\Windows\System\ruGFhyu.exe
  C:\Windows\System\ruGFhyu.exe
  2⤵
  PID:3280
- C:\Windows\System\lzZPkhC.exe
  C:\Windows\System\lzZPkhC.exe
  2⤵
  PID:4420
- C:\Windows\System\WjsHvsr.exe
  C:\Windows\System\WjsHvsr.exe
  2⤵
  PID:1356
- C:\Windows\System\nFipafB.exe
  C:\Windows\System\nFipafB.exe
  2⤵
  PID:12972
- C:\Windows\System\LsxkjGW.exe
  C:\Windows\System\LsxkjGW.exe
  2⤵
  PID:12984
- C:\Windows\System\DlFftLO.exe
  C:\Windows\System\DlFftLO.exe
  2⤵
  PID:12404
- C:\Windows\System\mIqCTNE.exe
  C:\Windows\System\mIqCTNE.exe
  2⤵
  PID:1880
- C:\Windows\System\FcCWHLG.exe
  C:\Windows\System\FcCWHLG.exe
  2⤵
  PID:4220
- C:\Windows\System\adaMDsv.exe
  C:\Windows\System\adaMDsv.exe
  2⤵
  PID:5440
- C:\Windows\System\KEyzETS.exe
  C:\Windows\System\KEyzETS.exe
  2⤵
  PID:5508
- C:\Windows\System\lnTpdFY.exe
  C:\Windows\System\lnTpdFY.exe
  2⤵
  PID:5080
- C:\Windows\System\VPogAfh.exe
  C:\Windows\System\VPogAfh.exe
  2⤵
  PID:3952
- C:\Windows\System\IRHIYaE.exe
  C:\Windows\System\IRHIYaE.exe
  2⤵
  PID:556
- C:\Windows\System\hKEXqsp.exe
  C:\Windows\System\hKEXqsp.exe
  2⤵
  PID:12472
- C:\Windows\System\sOQWEOf.exe
  C:\Windows\System\sOQWEOf.exe
  2⤵
  PID:13092
- C:\Windows\System\dHcnkmC.exe
  C:\Windows\System\dHcnkmC.exe
  2⤵
  PID:3324
- C:\Windows\System\bmTkHSK.exe
  C:\Windows\System\bmTkHSK.exe
  2⤵
  PID:2728
- C:\Windows\System\ZcPaHMz.exe
  C:\Windows\System\ZcPaHMz.exe
  2⤵
  PID:12556
- C:\Windows\System\zVlJhRh.exe
  C:\Windows\System\zVlJhRh.exe
  2⤵
  PID:12640
- C:\Windows\System\UQIDqZR.exe
  C:\Windows\System\UQIDqZR.exe
  2⤵
  PID:12312
- C:\Windows\System\UbasKVQ.exe
  C:\Windows\System\UbasKVQ.exe
  2⤵
  PID:13104
- C:\Windows\System\sPNEZrB.exe
  C:\Windows\System\sPNEZrB.exe
  2⤵
  PID:12148
- C:\Windows\System\KtwvsAR.exe
  C:\Windows\System\KtwvsAR.exe
  2⤵
  PID:5592
- C:\Windows\System\ebPAxwE.exe
  C:\Windows\System\ebPAxwE.exe
  2⤵
  PID:5640
- C:\Windows\System\RZzfAGX.exe
  C:\Windows\System\RZzfAGX.exe
  2⤵
  PID:5696
- C:\Windows\System\IWhKRPn.exe
  C:\Windows\System\IWhKRPn.exe
  2⤵
  PID:5752
- C:\Windows\System\wbUtaVh.exe
  C:\Windows\System\wbUtaVh.exe
  2⤵
  PID:5800
- C:\Windows\System\PSoAlYs.exe
  C:\Windows\System\PSoAlYs.exe
  2⤵
  PID:5864
- C:\Windows\System\lRuscAc.exe
  C:\Windows\System\lRuscAc.exe
  2⤵
  PID:5916
- C:\Windows\System\VIuCTwo.exe
  C:\Windows\System\VIuCTwo.exe
  2⤵
  PID:5980
- C:\Windows\System\tolDPHh.exe
  C:\Windows\System\tolDPHh.exe
  2⤵
  PID:6032
- C:\Windows\System\iowbGqW.exe
  C:\Windows\System\iowbGqW.exe
  2⤵
  PID:6084
- C:\Windows\System\TAvvRJy.exe
  C:\Windows\System\TAvvRJy.exe
  2⤵
  PID:4424
- C:\Windows\System\opfJKdd.exe
  C:\Windows\System\opfJKdd.exe
  2⤵
  PID:5252
- C:\Windows\System\JCaejDb.exe
  C:\Windows\System\JCaejDb.exe
  2⤵
  PID:5348
- C:\Windows\System\aBjXkNy.exe
  C:\Windows\System\aBjXkNy.exe
  2⤵
  PID:5512
- C:\Windows\System\tbqfehW.exe
  C:\Windows\System\tbqfehW.exe
  2⤵
  PID:5624
- C:\Windows\System\TGYZetZ.exe
  C:\Windows\System\TGYZetZ.exe
  2⤵
  PID:5764
- C:\Windows\System\Jobldhh.exe
  C:\Windows\System\Jobldhh.exe
  2⤵
  PID:5908
- C:\Windows\System\veOsCtW.exe
  C:\Windows\System\veOsCtW.exe
  2⤵
  PID:4908
- C:\Windows\System\EcRGOPI.exe
  C:\Windows\System\EcRGOPI.exe
  2⤵
  PID:4408
- C:\Windows\System\aFuQgKH.exe
  C:\Windows\System\aFuQgKH.exe
  2⤵
  PID:5404
- C:\Windows\System\NqXmomm.exe
  C:\Windows\System\NqXmomm.exe
  2⤵
  PID:5712
- C:\Windows\System\UbPWklr.exe
  C:\Windows\System\UbPWklr.exe
  2⤵
  PID:6052
- C:\Windows\System\qsKqLBL.exe
  C:\Windows\System\qsKqLBL.exe
  2⤵
  PID:5996
- C:\Windows\System\ChgJVMr.exe
  C:\Windows\System\ChgJVMr.exe
  2⤵
  PID:6156
- C:\Windows\System\kyLjlXq.exe
  C:\Windows\System\kyLjlXq.exe
  2⤵
  PID:6212
- C:\Windows\System\GCCvcVJ.exe
  C:\Windows\System\GCCvcVJ.exe
  2⤵
  PID:6256
- C:\Windows\System\OEvERnC.exe
  C:\Windows\System\OEvERnC.exe
  2⤵
  PID:6304
- C:\Windows\System\GAVXXXW.exe
  C:\Windows\System\GAVXXXW.exe
  2⤵
  PID:6368
- C:\Windows\System\vkTaGGf.exe
  C:\Windows\System\vkTaGGf.exe
  2⤵
  PID:6424
- C:\Windows\System\BcBuhZX.exe
  C:\Windows\System\BcBuhZX.exe
  2⤵
  PID:6480
- C:\Windows\System\BrPVfIQ.exe
  C:\Windows\System\BrPVfIQ.exe
  2⤵
  PID:6536
- C:\Windows\System\mLOQnXU.exe
  C:\Windows\System\mLOQnXU.exe
  2⤵
  PID:6592
- C:\Windows\System\hUiyqtU.exe
  C:\Windows\System\hUiyqtU.exe
  2⤵
  PID:6656
- C:\Windows\System\gyUMfRa.exe
  C:\Windows\System\gyUMfRa.exe
  2⤵
  PID:6716
- C:\Windows\System\JxQMBQO.exe
  C:\Windows\System\JxQMBQO.exe
  2⤵
  PID:6764
- C:\Windows\System\aRvOlCj.exe
  C:\Windows\System\aRvOlCj.exe
  2⤵
  PID:12796
- C:\Windows\System\IajsxtT.exe
  C:\Windows\System\IajsxtT.exe
  2⤵
  PID:10432
- C:\Windows\System\xNZsLkt.exe
  C:\Windows\System\xNZsLkt.exe
  2⤵
  PID:10404
- C:\Windows\System\CoarSzs.exe
  C:\Windows\System\CoarSzs.exe
  2⤵
  PID:5020
- C:\Windows\System\StZUmsq.exe
  C:\Windows\System\StZUmsq.exe
  2⤵
  PID:6836
- C:\Windows\System\TStWLBf.exe
  C:\Windows\System\TStWLBf.exe
  2⤵
  PID:12976
- C:\Windows\System\WCvHVuC.exe
  C:\Windows\System\WCvHVuC.exe
  2⤵
  PID:3300
- C:\Windows\System\ZRsVNHw.exe
  C:\Windows\System\ZRsVNHw.exe
  2⤵
  PID:6864
- C:\Windows\System\wYVldRd.exe
  C:\Windows\System\wYVldRd.exe
  2⤵
  PID:6912
- C:\Windows\System\DeFoCaZ.exe
  C:\Windows\System\DeFoCaZ.exe
  2⤵
  PID:6948
- C:\Windows\System\LrbEqjN.exe
  C:\Windows\System\LrbEqjN.exe
  2⤵
  PID:3572
- C:\Windows\System\ecZVTrG.exe
  C:\Windows\System\ecZVTrG.exe
  2⤵
  PID:7028
- C:\Windows\System\VyJRfgk.exe
  C:\Windows\System\VyJRfgk.exe
  2⤵
  PID:4112
- C:\Windows\System\gcjFQBf.exe
  C:\Windows\System\gcjFQBf.exe
  2⤵
  PID:940
- C:\Windows\System\QyHtRgl.exe
  C:\Windows\System\QyHtRgl.exe
  2⤵
  PID:7132
- C:\Windows\System\hgeRPnp.exe
  C:\Windows\System\hgeRPnp.exe
  2⤵
  PID:3820
- C:\Windows\System\OSywwrj.exe
  C:\Windows\System\OSywwrj.exe
  2⤵
  PID:4116
- C:\Windows\System\uimSnhF.exe
  C:\Windows\System\uimSnhF.exe
  2⤵
  PID:6160
- C:\Windows\System\zJhfzqu.exe
  C:\Windows\System\zJhfzqu.exe
  2⤵
  PID:3104
- C:\Windows\System\qraRbDQ.exe
  C:\Windows\System\qraRbDQ.exe
  2⤵
  PID:6316
- C:\Windows\System\LxmkfNK.exe
  C:\Windows\System\LxmkfNK.exe
  2⤵
  PID:4344
- C:\Windows\System\XMOeWLR.exe
  C:\Windows\System\XMOeWLR.exe
  2⤵
  PID:6408
- C:\Windows\System\oBAhpdG.exe
  C:\Windows\System\oBAhpdG.exe
  2⤵
  PID:6548
- C:\Windows\System\wCTldQp.exe
  C:\Windows\System\wCTldQp.exe
  2⤵
  PID:6628
- C:\Windows\System\CvgasKm.exe
  C:\Windows\System\CvgasKm.exe
  2⤵
  PID:6728
- C:\Windows\System\NWFAPVQ.exe
  C:\Windows\System\NWFAPVQ.exe
  2⤵
  PID:888
- C:\Windows\System\NwAwqHy.exe
  C:\Windows\System\NwAwqHy.exe
  2⤵
  PID:6888
- C:\Windows\System\aQfQfMn.exe
  C:\Windows\System\aQfQfMn.exe
  2⤵
  PID:4716
- C:\Windows\System\JdXQhRU.exe
  C:\Windows\System\JdXQhRU.exe
  2⤵
  PID:4968
- C:\Windows\System\nxJQtSr.exe
  C:\Windows\System\nxJQtSr.exe
  2⤵
  PID:3184
- C:\Windows\System\qdgtXRx.exe
  C:\Windows\System\qdgtXRx.exe
  2⤵
  PID:7032
- C:\Windows\System\XAYxudU.exe
  C:\Windows\System\XAYxudU.exe
  2⤵
  PID:7140
- C:\Windows\System\nbTzPSX.exe
  C:\Windows\System\nbTzPSX.exe
  2⤵
  PID:12944
- C:\Windows\System\zxrRggw.exe
  C:\Windows\System\zxrRggw.exe
  2⤵
  PID:4400
- C:\Windows\System\GJHxWIl.exe
  C:\Windows\System\GJHxWIl.exe
  2⤵
  PID:3724
- C:\Windows\System\cCEnTOm.exe
  C:\Windows\System\cCEnTOm.exe
  2⤵
  PID:3348
- C:\Windows\System\MNXOxrz.exe
  C:\Windows\System\MNXOxrz.exe
  2⤵
  PID:6492
- C:\Windows\System\BEIuWya.exe
  C:\Windows\System\BEIuWya.exe
  2⤵
  PID:6660
- C:\Windows\System\tGrCqta.exe
  C:\Windows\System\tGrCqta.exe
  2⤵
  PID:1640
- C:\Windows\System\HbzNECX.exe
  C:\Windows\System\HbzNECX.exe
  2⤵
  PID:1536
- C:\Windows\System\hfvJnHE.exe
  C:\Windows\System\hfvJnHE.exe
  2⤵
  PID:7016
- C:\Windows\System\hTrbqfe.exe
  C:\Windows\System\hTrbqfe.exe
  2⤵
  PID:2268
- C:\Windows\System\ecMRZcy.exe
  C:\Windows\System\ecMRZcy.exe
  2⤵
  PID:1612
- C:\Windows\System\HbFryUK.exe
  C:\Windows\System\HbFryUK.exe
  2⤵
  PID:436
- C:\Windows\System\KrSVGWH.exe
  C:\Windows\System\KrSVGWH.exe
  2⤵
  PID:6928
- C:\Windows\System\JwTiFaw.exe
  C:\Windows\System\JwTiFaw.exe
  2⤵
  PID:6328
- C:\Windows\System\HTkVlNj.exe
  C:\Windows\System\HTkVlNj.exe
  2⤵
  PID:7176
- C:\Windows\System\XxxTDta.exe
  C:\Windows\System\XxxTDta.exe
  2⤵
  PID:7224
- C:\Windows\System\zqTuKhx.exe
  C:\Windows\System\zqTuKhx.exe
  2⤵
  PID:7244
- C:\Windows\System\PMEQNGp.exe
  C:\Windows\System\PMEQNGp.exe
  2⤵
  PID:5192
- C:\Windows\System\IRqjpQH.exe
  C:\Windows\System\IRqjpQH.exe
  2⤵
  PID:4240
- C:\Windows\System\VciUvmE.exe
  C:\Windows\System\VciUvmE.exe
  2⤵
  PID:2600
- C:\Windows\System\UKqSMjK.exe
  C:\Windows\System\UKqSMjK.exe
  2⤵
  PID:4900
- C:\Windows\System\NGuPwzW.exe
  C:\Windows\System\NGuPwzW.exe
  2⤵
  PID:12756
- C:\Windows\System\DpVkZJE.exe
  C:\Windows\System\DpVkZJE.exe
  2⤵
  PID:4308
- C:\Windows\System\WnNrPlk.exe
  C:\Windows\System\WnNrPlk.exe
  2⤵
  PID:12784
- C:\Windows\System\mXlJoPJ.exe
  C:\Windows\System\mXlJoPJ.exe
  2⤵
  PID:13228
- C:\Windows\System\kHctgQs.exe
  C:\Windows\System\kHctgQs.exe
  2⤵
  PID:7328
- C:\Windows\System\FZWMOeF.exe
  C:\Windows\System\FZWMOeF.exe
  2⤵
  PID:3892
- C:\Windows\System\VAHTHcD.exe
  C:\Windows\System\VAHTHcD.exe
  2⤵
  PID:3896
- C:\Windows\System\xICqGZS.exe
  C:\Windows\System\xICqGZS.exe
  2⤵
  PID:13256
- C:\Windows\System\cVeyPMS.exe
  C:\Windows\System\cVeyPMS.exe
  2⤵
  PID:13036
- C:\Windows\System\AjaOKRV.exe
  C:\Windows\System\AjaOKRV.exe
  2⤵
  PID:12948
- C:\Windows\System\aiheQKt.exe
  C:\Windows\System\aiheQKt.exe
  2⤵
  PID:7564
- C:\Windows\System\hgaAlwd.exe
  C:\Windows\System\hgaAlwd.exe
  2⤵
  PID:7596
- C:\Windows\System\QDcblQh.exe
  C:\Windows\System\QDcblQh.exe
  2⤵
  PID:5424
- C:\Windows\System\BImjWch.exe
  C:\Windows\System\BImjWch.exe
  2⤵
  PID:5480
- C:\Windows\System\fQNXmcc.exe
  C:\Windows\System\fQNXmcc.exe
  2⤵
  PID:5408
- C:\Windows\System\kkGobiC.exe
  C:\Windows\System\kkGobiC.exe
  2⤵
  PID:7712
- C:\Windows\System\DYWOAfq.exe
  C:\Windows\System\DYWOAfq.exe
  2⤵
  PID:7752
- C:\Windows\System\LRUYsOS.exe
  C:\Windows\System\LRUYsOS.exe
  2⤵
  PID:396
- C:\Windows\System\ifioGos.exe
  C:\Windows\System\ifioGos.exe
  2⤵
  PID:7844
- C:\Windows\System\sKAIYVo.exe
  C:\Windows\System\sKAIYVo.exe
  2⤵
  PID:7920
- C:\Windows\System\bIHDJhN.exe
  C:\Windows\System\bIHDJhN.exe
  2⤵
  PID:12624
- C:\Windows\System\qQFaQwS.exe
  C:\Windows\System\qQFaQwS.exe
  2⤵
  PID:12580
- C:\Windows\System\fJrsTHS.exe
  C:\Windows\System\fJrsTHS.exe
  2⤵
  PID:12660
- C:\Windows\System\ertPGdt.exe
  C:\Windows\System\ertPGdt.exe
  2⤵
  PID:12360
- C:\Windows\System\UIKFzUW.exe
  C:\Windows\System\UIKFzUW.exe
  2⤵
  PID:13308
- C:\Windows\System\YVmvOzo.exe
  C:\Windows\System\YVmvOzo.exe
  2⤵
  PID:5564
- C:\Windows\System\cTaexnQ.exe
  C:\Windows\System\cTaexnQ.exe
  2⤵
  PID:5612
- C:\Windows\System\jSFboSH.exe
  C:\Windows\System\jSFboSH.exe
  2⤵
  PID:5704
- C:\Windows\System\ecliONn.exe
  C:\Windows\System\ecliONn.exe
  2⤵
  PID:5140
- C:\Windows\System\dXqyuJt.exe
  C:\Windows\System\dXqyuJt.exe
  2⤵
  PID:5828
- C:\Windows\System\GJnJYDc.exe
  C:\Windows\System\GJnJYDc.exe
  2⤵
  PID:5724
- C:\Windows\System\QHYpOfC.exe
  C:\Windows\System\QHYpOfC.exe
  2⤵
  PID:7464
- C:\Windows\System\hqSXGKG.exe
  C:\Windows\System\hqSXGKG.exe
  2⤵
  PID:7484
- C:\Windows\System\Qdqdtzl.exe
  C:\Windows\System\Qdqdtzl.exe
  2⤵
  PID:5952
- C:\Windows\System\psrPBuq.exe
  C:\Windows\System\psrPBuq.exe
  2⤵
  PID:7740
- C:\Windows\System\dyfvRyw.exe
  C:\Windows\System\dyfvRyw.exe
  2⤵
  PID:7808
- C:\Windows\System\eSqfeSq.exe
  C:\Windows\System\eSqfeSq.exe
  2⤵
  PID:6000
- C:\Windows\System\FLldASd.exe
  C:\Windows\System\FLldASd.exe
  2⤵
  PID:5308
- C:\Windows\System\ZlKhndq.exe
  C:\Windows\System\ZlKhndq.exe
  2⤵
  PID:5572
- C:\Windows\System\WeRryHB.exe
  C:\Windows\System\WeRryHB.exe
  2⤵
  PID:8088
- C:\Windows\System\catLqiR.exe
  C:\Windows\System\catLqiR.exe
  2⤵
  PID:7200
- C:\Windows\System\vZaHkpy.exe
  C:\Windows\System\vZaHkpy.exe
  2⤵
  PID:7312
- C:\Windows\System\knyCdBL.exe
  C:\Windows\System\knyCdBL.exe
  2⤵
  PID:7600
- C:\Windows\System\YNspBTI.exe
  C:\Windows\System\YNspBTI.exe
  2⤵
  PID:7692
- C:\Windows\System\FxmNMYt.exe
  C:\Windows\System\FxmNMYt.exe
  2⤵
  PID:5912
- C:\Windows\System\vbKiwoh.exe
  C:\Windows\System\vbKiwoh.exe
  2⤵
  PID:5208
- C:\Windows\System\GxdTBST.exe
  C:\Windows\System\GxdTBST.exe
  2⤵
  PID:6184
- C:\Windows\System\mxwlfnw.exe
  C:\Windows\System\mxwlfnw.exe
  2⤵
  PID:8256
- C:\Windows\System\RQOutML.exe
  C:\Windows\System\RQOutML.exe
  2⤵
  PID:8268
- C:\Windows\System\NhDCRaG.exe
  C:\Windows\System\NhDCRaG.exe
  2⤵
  PID:8332
- C:\Windows\System\acfaQLz.exe
  C:\Windows\System\acfaQLz.exe
  2⤵
  PID:8340
- C:\Windows\System\IhkHCDz.exe
  C:\Windows\System\IhkHCDz.exe
  2⤵
  PID:8412
- C:\Windows\System\ZidaTrA.exe
  C:\Windows\System\ZidaTrA.exe
  2⤵
  PID:8436
- C:\Windows\System\hjyXwjJ.exe
  C:\Windows\System\hjyXwjJ.exe
  2⤵
  PID:8464
- C:\Windows\System\WMuMZhW.exe
  C:\Windows\System\WMuMZhW.exe
  2⤵
  PID:8496
- C:\Windows\System\gWVFgIC.exe
  C:\Windows\System\gWVFgIC.exe
  2⤵
  PID:6556
- C:\Windows\System\TsphFrX.exe
  C:\Windows\System\TsphFrX.exe
  2⤵
  PID:8560
- C:\Windows\System\PxMbAHQ.exe
  C:\Windows\System\PxMbAHQ.exe
  2⤵
  PID:6684
- C:\Windows\System\sRtfqbz.exe
  C:\Windows\System\sRtfqbz.exe
  2⤵
  PID:6768
- C:\Windows\System\tbXqnfI.exe
  C:\Windows\System\tbXqnfI.exe
  2⤵
  PID:6792
- C:\Windows\System\ZdGqTuD.exe
  C:\Windows\System\ZdGqTuD.exe
  2⤵
  PID:12204
- C:\Windows\System\niqkzkM.exe
  C:\Windows\System\niqkzkM.exe
  2⤵
  PID:12848
- C:\Windows\System\hQkUOpe.exe
  C:\Windows\System\hQkUOpe.exe
  2⤵
  PID:1712
- C:\Windows\System\pRcCDLX.exe
  C:\Windows\System\pRcCDLX.exe
  2⤵
  PID:3368
- C:\Windows\System\uzjlCCR.exe
  C:\Windows\System\uzjlCCR.exe
  2⤵
  PID:3812
- C:\Windows\System\NRuLpUw.exe
  C:\Windows\System\NRuLpUw.exe
  2⤵
  PID:7020
- C:\Windows\System\EFPHxHI.exe
  C:\Windows\System\EFPHxHI.exe
  2⤵
  PID:1420
- C:\Windows\System\bTHRwxH.exe
  C:\Windows\System\bTHRwxH.exe
  2⤵
  PID:1960
- C:\Windows\System\BHNYoXy.exe
  C:\Windows\System\BHNYoXy.exe
  2⤵
  PID:6344
- C:\Windows\System\xBGFIoB.exe
  C:\Windows\System\xBGFIoB.exe
  2⤵
  PID:6440
- C:\Windows\System\auIPbzf.exe
  C:\Windows\System\auIPbzf.exe
  2⤵
  PID:8712
- C:\Windows\System\rgHsWQa.exe
  C:\Windows\System\rgHsWQa.exe
  2⤵
  PID:8744
- C:\Windows\System\YCNvSaA.exe
  C:\Windows\System\YCNvSaA.exe
  2⤵
  PID:6784
- C:\Windows\System\SBZRQdo.exe
  C:\Windows\System\SBZRQdo.exe
  2⤵
  PID:5144
- C:\Windows\System\jaGbfsV.exe
  C:\Windows\System\jaGbfsV.exe
  2⤵
  PID:4892
- C:\Windows\System\CIbbYdA.exe
  C:\Windows\System\CIbbYdA.exe
  2⤵
  PID:4352
- C:\Windows\System\gaRQrAF.exe
  C:\Windows\System\gaRQrAF.exe
  2⤵
  PID:9012
- C:\Windows\System\gpUBHpI.exe
  C:\Windows\System\gpUBHpI.exe
  2⤵
  PID:9064
- C:\Windows\System\kJLoSQQ.exe
  C:\Windows\System\kJLoSQQ.exe
  2⤵
  PID:9072
- C:\Windows\System\KdjfGgo.exe
  C:\Windows\System\KdjfGgo.exe
  2⤵
  PID:9148
- C:\Windows\System\AvxfsRW.exe
  C:\Windows\System\AvxfsRW.exe
  2⤵
  PID:8204
- C:\Windows\System\ywoYblW.exe
  C:\Windows\System\ywoYblW.exe
  2⤵
  PID:1252
- C:\Windows\System\qPYLFBK.exe
  C:\Windows\System\qPYLFBK.exe
  2⤵
  PID:8500
- C:\Windows\System\FxcArig.exe
  C:\Windows\System\FxcArig.exe
  2⤵
  PID:8532
- C:\Windows\System\ChdfqQn.exe
  C:\Windows\System\ChdfqQn.exe
  2⤵
  PID:2892
- C:\Windows\System\ZomUzFi.exe
  C:\Windows\System\ZomUzFi.exe
  2⤵
  PID:4176
- C:\Windows\System\AiXMVOC.exe
  C:\Windows\System\AiXMVOC.exe
  2⤵
  PID:8980
- C:\Windows\System\SZRYSzX.exe
  C:\Windows\System\SZRYSzX.exe
  2⤵
  PID:9076
- C:\Windows\System\QpsymGO.exe
  C:\Windows\System\QpsymGO.exe
  2⤵
  PID:9188
- C:\Windows\System\dNrdSZP.exe
  C:\Windows\System\dNrdSZP.exe
  2⤵
  PID:1944
- C:\Windows\System\NEbWccG.exe
  C:\Windows\System\NEbWccG.exe
  2⤵
  PID:8488
- C:\Windows\System\FipvHTo.exe
  C:\Windows\System\FipvHTo.exe
  2⤵
  PID:6124
- C:\Windows\System\FYtGKSs.exe
  C:\Windows\System\FYtGKSs.exe
  2⤵
  PID:1468
- C:\Windows\System\GmQQbty.exe
  C:\Windows\System\GmQQbty.exe
  2⤵
  PID:7188
- C:\Windows\System\nkhyVJw.exe
  C:\Windows\System\nkhyVJw.exe
  2⤵
  PID:8620
- C:\Windows\System\hwidWlM.exe
  C:\Windows\System\hwidWlM.exe
  2⤵
  PID:12980
- C:\Windows\System\zBJtqMD.exe
  C:\Windows\System\zBJtqMD.exe
  2⤵
  PID:9272
- C:\Windows\System\kFOHFHY.exe
  C:\Windows\System\kFOHFHY.exe
  2⤵
  PID:1772
- C:\Windows\System\KaAzapZ.exe
  C:\Windows\System\KaAzapZ.exe
  2⤵
  PID:12788
- C:\Windows\System\QiEmZim.exe
  C:\Windows\System\QiEmZim.exe
  2⤵
  PID:4336
- C:\Windows\System\VEHNWrO.exe
  C:\Windows\System\VEHNWrO.exe
  2⤵
  PID:7276
- C:\Windows\System\oolGKqC.exe
  C:\Windows\System\oolGKqC.exe
  2⤵
  PID:9640
- C:\Windows\System\QkHkqiZ.exe
  C:\Windows\System\QkHkqiZ.exe
  2⤵
  PID:7384
- C:\Windows\System\GNzftOY.exe
  C:\Windows\System\GNzftOY.exe
  2⤵
  PID:9820
- C:\Windows\System\uYzbZhj.exe
  C:\Windows\System\uYzbZhj.exe
  2⤵
  PID:12960
- C:\Windows\System\VlzbswH.exe
  C:\Windows\System\VlzbswH.exe
  2⤵
  PID:9924
- C:\Windows\System\sPfIKCB.exe
  C:\Windows\System\sPfIKCB.exe
  2⤵
  PID:9956
- C:\Windows\System\hvuVyLx.exe
  C:\Windows\System\hvuVyLx.exe
  2⤵
  PID:7696
- C:\Windows\System\xQpJsAc.exe
  C:\Windows\System\xQpJsAc.exe
  2⤵
  PID:10036
- C:\Windows\System\QPiaryy.exe
  C:\Windows\System\QPiaryy.exe
  2⤵
  PID:4688
- C:\Windows\System\AEvedyB.exe
  C:\Windows\System\AEvedyB.exe
  2⤵
  PID:10132
- C:\Windows\System\EMBMOQL.exe
  C:\Windows\System\EMBMOQL.exe
  2⤵
  PID:7736
- C:\Windows\System\uJKoCxN.exe
  C:\Windows\System\uJKoCxN.exe
  2⤵
  PID:10196
- C:\Windows\System\OQGAnaH.exe
  C:\Windows\System\OQGAnaH.exe
  2⤵
  PID:10236
- C:\Windows\System\cIcrNNs.exe
  C:\Windows\System\cIcrNNs.exe
  2⤵
  PID:8716
- C:\Windows\System\kcoaguf.exe
  C:\Windows\System\kcoaguf.exe
  2⤵
  PID:3296
- C:\Windows\System\rAXKAxX.exe
  C:\Windows\System\rAXKAxX.exe
  2⤵
  PID:2452
- C:\Windows\System\LATVjTy.exe
  C:\Windows\System\LATVjTy.exe
  2⤵
  PID:7952
- C:\Windows\System\WRybndm.exe
  C:\Windows\System\WRybndm.exe
  2⤵
  PID:9400
- C:\Windows\System\CELsTik.exe
  C:\Windows\System\CELsTik.exe
  2⤵
  PID:8028
- C:\Windows\System\WVidHBe.exe
  C:\Windows\System\WVidHBe.exe
  2⤵
  PID:8048
- C:\Windows\System\kLXmasF.exe
  C:\Windows\System\kLXmasF.exe
  2⤵
  PID:9584
- C:\Windows\System\ijGbZuu.exe
  C:\Windows\System\ijGbZuu.exe
  2⤵
  PID:8164
- C:\Windows\System\btxnEgz.exe
  C:\Windows\System\btxnEgz.exe
  2⤵
  PID:5816
- C:\Windows\System\yQXUpYT.exe
  C:\Windows\System\yQXUpYT.exe
  2⤵
  PID:7340
- C:\Windows\System\eFxsiAs.exe
  C:\Windows\System\eFxsiAs.exe
  2⤵
  PID:5620
- C:\Windows\System\DhAqBrk.exe
  C:\Windows\System\DhAqBrk.exe
  2⤵
  PID:10092
- C:\Windows\System\hoGKIQZ.exe
  C:\Windows\System\hoGKIQZ.exe
  2⤵
  PID:7576
- C:\Windows\System\NwnsvMl.exe
  C:\Windows\System\NwnsvMl.exe
  2⤵
  PID:9280
- C:\Windows\System\hJJEUmz.exe
  C:\Windows\System\hJJEUmz.exe
  2⤵
  PID:7748
- C:\Windows\System\quFVsfu.exe
  C:\Windows\System\quFVsfu.exe
  2⤵
  PID:7540
- C:\Windows\System\tLrrjyt.exe
  C:\Windows\System\tLrrjyt.exe
  2⤵
  PID:9804
- C:\Windows\System\wDSqAnT.exe
  C:\Windows\System\wDSqAnT.exe
  2⤵
  PID:9864
- C:\Windows\System\zYTlqaU.exe
  C:\Windows\System\zYTlqaU.exe
  2⤵
  PID:6120
- C:\Windows\System\kZAxCte.exe
  C:\Windows\System\kZAxCte.exe
  2⤵
  PID:5792
- C:\Windows\System\VXPpnDQ.exe
  C:\Windows\System\VXPpnDQ.exe
  2⤵
  PID:10128
- C:\Windows\System\NtWWRTm.exe
  C:\Windows\System\NtWWRTm.exe
  2⤵
  PID:9676
- C:\Windows\System\oHnKiKT.exe
  C:\Windows\System\oHnKiKT.exe
  2⤵
  PID:5968
- C:\Windows\System\TgAckPH.exe
  C:\Windows\System\TgAckPH.exe
  2⤵
  PID:7720
- C:\Windows\System\wEvcjUS.exe
  C:\Windows\System\wEvcjUS.exe
  2⤵
  PID:10272
- C:\Windows\System\OUqGusH.exe
  C:\Windows\System\OUqGusH.exe
  2⤵
  PID:5708
- C:\Windows\System\eBtQdCU.exe
  C:\Windows\System\eBtQdCU.exe
  2⤵
  PID:13124
- C:\Windows\System\bWiTsLQ.exe
  C:\Windows\System\bWiTsLQ.exe
  2⤵
  PID:9168
- C:\Windows\System\DBgimqR.exe
  C:\Windows\System\DBgimqR.exe
  2⤵
  PID:10296
- C:\Windows\System\eLyavxR.exe
  C:\Windows\System\eLyavxR.exe
  2⤵
  PID:10340
- C:\Windows\System\qrGIpaX.exe
  C:\Windows\System\qrGIpaX.exe
  2⤵
  PID:8052
- C:\Windows\System\SGeuNYD.exe
  C:\Windows\System\SGeuNYD.exe
  2⤵
  PID:7468
- C:\Windows\System\csraBzL.exe
  C:\Windows\System\csraBzL.exe
  2⤵
  PID:880
- C:\Windows\System\sMzKQXT.exe
  C:\Windows\System\sMzKQXT.exe
  2⤵
  PID:3020
- C:\Windows\System\aycdnkg.exe
  C:\Windows\System\aycdnkg.exe
  2⤵
  PID:2064
- C:\Windows\System\rfWCyjn.exe
  C:\Windows\System\rfWCyjn.exe
  2⤵
  PID:4580
- C:\Windows\System\lXChQJU.exe
  C:\Windows\System\lXChQJU.exe
  2⤵
  PID:8036
- C:\Windows\System\JWLxQuJ.exe
  C:\Windows\System\JWLxQuJ.exe
  2⤵
  PID:8636
- C:\Windows\System\LiTaOBz.exe
  C:\Windows\System\LiTaOBz.exe
  2⤵
  PID:6192
- C:\Windows\System\yXraUJi.exe
  C:\Windows\System\yXraUJi.exe
  2⤵
  PID:6228
- C:\Windows\System\MCoRujE.exe
  C:\Windows\System\MCoRujE.exe
  2⤵
  PID:10500
- C:\Windows\System\PushcPb.exe
  C:\Windows\System\PushcPb.exe
  2⤵
  PID:10548
- C:\Windows\System\SpZvlJk.exe
  C:\Windows\System\SpZvlJk.exe
  2⤵
  PID:10556
- C:\Windows\System\dYWcpqw.exe
  C:\Windows\System\dYWcpqw.exe
  2⤵
  PID:10580
- C:\Windows\System\NkUBwck.exe
  C:\Windows\System\NkUBwck.exe
  2⤵
  PID:6496
- C:\Windows\System\uZllllx.exe
  C:\Windows\System\uZllllx.exe
  2⤵
  PID:10648
- C:\Windows\System\yiciTmk.exe
  C:\Windows\System\yiciTmk.exe
  2⤵
  PID:10720
- C:\Windows\System\dpoEMEK.exe
  C:\Windows\System\dpoEMEK.exe
  2⤵
  PID:10732
- C:\Windows\System\JGIHMwd.exe
  C:\Windows\System\JGIHMwd.exe
  2⤵
  PID:8520
- C:\Windows\System\YNwbjJb.exe
  C:\Windows\System\YNwbjJb.exe
  2⤵
  PID:6620
- C:\Windows\System\awGKxmO.exe
  C:\Windows\System\awGKxmO.exe
  2⤵
  PID:10872
- C:\Windows\System\pGSkxIs.exe
  C:\Windows\System\pGSkxIs.exe
  2⤵
  PID:8576
- C:\Windows\System\ADSqgeG.exe
  C:\Windows\System\ADSqgeG.exe
  2⤵
  PID:10940
- C:\Windows\System\mLncMbd.exe
  C:\Windows\System\mLncMbd.exe
  2⤵
  PID:11012
- C:\Windows\System\gpmlzVA.exe
  C:\Windows\System\gpmlzVA.exe
  2⤵
  PID:11064
- C:\Windows\System\AiNwTrs.exe
  C:\Windows\System\AiNwTrs.exe
  2⤵
  PID:11108
- C:\Windows\System\UhyaCth.exe
  C:\Windows\System\UhyaCth.exe
  2⤵
  PID:2800
- C:\Windows\System\qptMesa.exe
  C:\Windows\System\qptMesa.exe
  2⤵
  PID:11128
- C:\Windows\System\IyRizfR.exe
  C:\Windows\System\IyRizfR.exe
  2⤵
  PID:2584
- C:\Windows\System\LHsVpnQ.exe
  C:\Windows\System\LHsVpnQ.exe
  2⤵
  PID:11188
- C:\Windows\System\YljHDJB.exe
  C:\Windows\System\YljHDJB.exe
  2⤵
  PID:13164
- C:\Windows\System\tfQELsq.exe
  C:\Windows\System\tfQELsq.exe
  2⤵
  PID:9460
- C:\Windows\System\IwjQgdv.exe
  C:\Windows\System\IwjQgdv.exe
  2⤵
  PID:13244
- C:\Windows\System\FiwzLcw.exe
  C:\Windows\System\FiwzLcw.exe
  2⤵
  PID:10364
- C:\Windows\System\REareEe.exe
  C:\Windows\System\REareEe.exe
  2⤵
  PID:10384
- C:\Windows\System\VQNFWfM.exe
  C:\Windows\System\VQNFWfM.exe
  2⤵
  PID:7068
- C:\Windows\System\cXBqUrB.exe
  C:\Windows\System\cXBqUrB.exe
  2⤵
  PID:4480
- C:\Windows\System\brjokPv.exe
  C:\Windows\System\brjokPv.exe
  2⤵
  PID:1692
- C:\Windows\System\mlyfuhE.exe
  C:\Windows\System\mlyfuhE.exe
  2⤵
  PID:2632
- C:\Windows\System\KnkbALN.exe
  C:\Windows\System\KnkbALN.exe
  2⤵
  PID:10776
- C:\Windows\System\PtnnHgD.exe
  C:\Windows\System\PtnnHgD.exe
  2⤵
  PID:10832
- C:\Windows\System\qEybChz.exe
  C:\Windows\System\qEybChz.exe
  2⤵
  PID:10912
- C:\Windows\System\zoEqozh.exe
  C:\Windows\System\zoEqozh.exe
  2⤵
  PID:8844
- C:\Windows\System\OSspJtt.exe
  C:\Windows\System\OSspJtt.exe
  2⤵
  PID:8880
- C:\Windows\System\HOccXVa.exe
  C:\Windows\System\HOccXVa.exe
  2⤵
  PID:8908
- C:\Windows\System\RniBzvq.exe
  C:\Windows\System\RniBzvq.exe
  2⤵
  PID:11260
- C:\Windows\System\EAttqhO.exe
  C:\Windows\System\EAttqhO.exe
  2⤵
  PID:10280
- C:\Windows\System\lywRsDw.exe
  C:\Windows\System\lywRsDw.exe
  2⤵
  PID:10488
- C:\Windows\System\NyXmCGP.exe
  C:\Windows\System\NyXmCGP.exe
  2⤵
  PID:9092
- C:\Windows\System\LdQEhae.exe
  C:\Windows\System\LdQEhae.exe
  2⤵
  PID:10968
- C:\Windows\System\cvKyqlY.exe
  C:\Windows\System\cvKyqlY.exe
  2⤵
  PID:11180
- C:\Windows\System\KhPICjG.exe
  C:\Windows\System\KhPICjG.exe
  2⤵
  PID:10748
- C:\Windows\System\NxEVqUE.exe
  C:\Windows\System\NxEVqUE.exe
  2⤵
  PID:11004
- C:\Windows\System\MouQbRB.exe
  C:\Windows\System\MouQbRB.exe
  2⤵
  PID:6372
- C:\Windows\System\lUoCRrx.exe
  C:\Windows\System\lUoCRrx.exe
  2⤵
  PID:4528
- C:\Windows\System\nbhysqE.exe
  C:\Windows\System\nbhysqE.exe
  2⤵
  PID:8516
- C:\Windows\System\gGrQDPL.exe
  C:\Windows\System\gGrQDPL.exe
  2⤵
  PID:5016
- C:\Windows\System\SsScybk.exe
  C:\Windows\System\SsScybk.exe
  2⤵
  PID:12564
- C:\Windows\System\TJEeAyF.exe
  C:\Windows\System\TJEeAyF.exe
  2⤵
  PID:228
- C:\Windows\System\EVEbeRg.exe
  C:\Windows\System\EVEbeRg.exe
  2⤵
  PID:11452
- C:\Windows\System\gDeGzoq.exe
  C:\Windows\System\gDeGzoq.exe
  2⤵
  PID:6200
- C:\Windows\System\bwUsxQY.exe
  C:\Windows\System\bwUsxQY.exe
  2⤵
  PID:7304
- C:\Windows\System\LTFgDCH.exe
  C:\Windows\System\LTFgDCH.exe
  2⤵
  PID:11572
- C:\Windows\System\xblWKLl.exe
  C:\Windows\System\xblWKLl.exe
  2⤵
  PID:3964
- C:\Windows\System\mPuLSWH.exe
  C:\Windows\System\mPuLSWH.exe
  2⤵
  PID:8884
- C:\Windows\System\cIhsGzi.exe
  C:\Windows\System\cIhsGzi.exe
  2⤵
  PID:11668
- C:\Windows\System\PgsaXqT.exe
  C:\Windows\System\PgsaXqT.exe
  2⤵
  PID:7216
- C:\Windows\System\FtKxvsS.exe
  C:\Windows\System\FtKxvsS.exe
  2⤵
  PID:9232
- C:\Windows\System\vjiaNOI.exe
  C:\Windows\System\vjiaNOI.exe
  2⤵
  PID:11784
- C:\Windows\System\bWuqriT.exe
  C:\Windows\System\bWuqriT.exe
  2⤵
  PID:4392
- C:\Windows\System\PjeCmlD.exe
  C:\Windows\System\PjeCmlD.exe
  2⤵
  PID:11840
- C:\Windows\System\EAtyxAw.exe
  C:\Windows\System\EAtyxAw.exe
  2⤵
  PID:9532
- C:\Windows\System\aroYAAe.exe
  C:\Windows\System\aroYAAe.exe
  2⤵
  PID:2288
- C:\Windows\System\lWUVeHU.exe
  C:\Windows\System\lWUVeHU.exe
  2⤵
  PID:9696
- C:\Windows\System\xnRtTpN.exe
  C:\Windows\System\xnRtTpN.exe
  2⤵
  PID:12004
- C:\Windows\System\FgAYqSU.exe
  C:\Windows\System\FgAYqSU.exe
  2⤵
  PID:5388
- C:\Windows\System\tGPssrG.exe
  C:\Windows\System\tGPssrG.exe
  2⤵
  PID:9944
- C:\Windows\System\EceAVWM.exe
  C:\Windows\System\EceAVWM.exe
  2⤵
  PID:9972
- C:\Windows\System\jiLgKTJ.exe
  C:\Windows\System\jiLgKTJ.exe
  2⤵
  PID:7604
- C:\Windows\System\mlcTvQv.exe
  C:\Windows\System\mlcTvQv.exe
  2⤵
  PID:10028
- C:\Windows\System\lHlXFgf.exe
  C:\Windows\System\lHlXFgf.exe
  2⤵
  PID:12176
- C:\Windows\System\jkwYDot.exe
  C:\Windows\System\jkwYDot.exe
  2⤵
  PID:10084
- C:\Windows\System\PLBtJgT.exe
  C:\Windows\System\PLBtJgT.exe
  2⤵
  PID:10152
- C:\Windows\System\yAyVuoT.exe
  C:\Windows\System\yAyVuoT.exe
  2⤵
  PID:7876
- C:\Windows\System\ojPiSjD.exe
  C:\Windows\System\ojPiSjD.exe
  2⤵
  PID:12248
- C:\Windows\System\vWrWGOg.exe
  C:\Windows\System\vWrWGOg.exe
  2⤵
  PID:12644
- C:\Windows\System\acIQBql.exe
  C:\Windows\System\acIQBql.exe
  2⤵
  PID:11276
- C:\Windows\System\PSZwxjo.exe
  C:\Windows\System\PSZwxjo.exe
  2⤵
  PID:9492
- C:\Windows\System\BSTMJUC.exe
  C:\Windows\System\BSTMJUC.exe
  2⤵
  PID:11524
- C:\Windows\System\eMKlOdi.exe
  C:\Windows\System\eMKlOdi.exe
  2⤵
  PID:8144
- C:\Windows\System\ndFKljS.exe
  C:\Windows\System\ndFKljS.exe
  2⤵
  PID:11656
- C:\Windows\System\FBEjsyB.exe
  C:\Windows\System\FBEjsyB.exe
  2⤵
  PID:9716
- C:\Windows\System\LIluZtT.exe
  C:\Windows\System\LIluZtT.exe
  2⤵
  PID:9756
- C:\Windows\System\vsiLAEW.exe
  C:\Windows\System\vsiLAEW.exe
  2⤵
  PID:9988
- C:\Windows\System\okElMug.exe
  C:\Windows\System\okElMug.exe
  2⤵
  PID:12240
- C:\Windows\System\xOcRfaI.exe
  C:\Windows\System\xOcRfaI.exe
  2⤵
  PID:8580
- C:\Windows\System\IJqNpqU.exe
  C:\Windows\System\IJqNpqU.exe
  2⤵
  PID:9312
- C:\Windows\System\hLMnPrZ.exe
  C:\Windows\System\hLMnPrZ.exe
  2⤵
  PID:5180
- C:\Windows\System\zYSuPwO.exe
  C:\Windows\System\zYSuPwO.exe
  2⤵
  PID:4572
- C:\Windows\System\GjErGqA.exe
  C:\Windows\System\GjErGqA.exe
  2⤵
  PID:5928
- C:\Windows\System\whvrSZa.exe
  C:\Windows\System\whvrSZa.exe
  2⤵
  PID:11420
- C:\Windows\System\ZKrnQYL.exe
  C:\Windows\System\ZKrnQYL.exe
  2⤵
  PID:7708
- C:\Windows\System\qwweTha.exe
  C:\Windows\System\qwweTha.exe
  2⤵
  PID:2788
- C:\Windows\System\rFVfFvp.exe
  C:\Windows\System\rFVfFvp.exe
  2⤵
  PID:7948
- C:\Windows\System\zdaWzmA.exe
  C:\Windows\System\zdaWzmA.exe
  2⤵
  PID:12364
- C:\Windows\System\ZQPCkBW.exe
  C:\Windows\System\ZQPCkBW.exe
  2⤵
  PID:5532
- C:\Windows\System\YoeeXtw.exe
  C:\Windows\System\YoeeXtw.exe
  2⤵
  PID:12380
- C:\Windows\System\ALuSycJ.exe
  C:\Windows\System\ALuSycJ.exe
  2⤵
  PID:7976
- C:\Windows\System\YzosRei.exe
  C:\Windows\System\YzosRei.exe
  2⤵
  PID:12468
- C:\Windows\System\JCSGkWh.exe
  C:\Windows\System\JCSGkWh.exe
  2⤵
  PID:12492
- C:\Windows\System\TcfxpXV.exe
  C:\Windows\System\TcfxpXV.exe
  2⤵
  PID:7356
- C:\Windows\System\GJYoHCg.exe
  C:\Windows\System\GJYoHCg.exe
  2⤵
  PID:1812
- C:\Windows\System\rwiCXNm.exe
  C:\Windows\System\rwiCXNm.exe
  2⤵
  PID:12576
- C:\Windows\System\jyyhTvc.exe
  C:\Windows\System\jyyhTvc.exe
  2⤵
  PID:7660
- C:\Windows\System\ptKfvrH.exe
  C:\Windows\System\ptKfvrH.exe
  2⤵
  PID:12676
- C:\Windows\System\UCsmpQD.exe
  C:\Windows\System\UCsmpQD.exe
  2⤵
  PID:6264
- C:\Windows\System\qxwVXYT.exe
  C:\Windows\System\qxwVXYT.exe
  2⤵
  PID:6332
- C:\Windows\System\AkHhAbZ.exe
  C:\Windows\System\AkHhAbZ.exe
  2⤵
  PID:6396
- C:\Windows\System\hwAWwUb.exe
  C:\Windows\System\hwAWwUb.exe
  2⤵
  PID:10584
- C:\Windows\System\WHGspDb.exe
  C:\Windows\System\WHGspDb.exe
  2⤵
  PID:10676
- C:\Windows\System\hqtZHei.exe
  C:\Windows\System\hqtZHei.exe
  2⤵
  PID:12392
- C:\Windows\System\YHDhdXH.exe
  C:\Windows\System\YHDhdXH.exe
  2⤵
  PID:10784
- C:\Windows\System\gTAetrY.exe
  C:\Windows\System\gTAetrY.exe
  2⤵
  PID:13100
- C:\Windows\System\YEhMILa.exe
  C:\Windows\System\YEhMILa.exe
  2⤵
  PID:13128
- C:\Windows\System\QowzXPL.exe
  C:\Windows\System\QowzXPL.exe
  2⤵
  PID:13148
- C:\Windows\System\MjcSKkI.exe
  C:\Windows\System\MjcSKkI.exe
  2⤵
  PID:13260
- C:\Windows\System\eoHClyc.exe
  C:\Windows\System\eoHClyc.exe
  2⤵
  PID:13252
- C:\Windows\System\NEisXoM.exe
  C:\Windows\System\NEisXoM.exe
  2⤵
  PID:3136
- C:\Windows\System\kYgTShI.exe
  C:\Windows\System\kYgTShI.exe
  2⤵
  PID:2780
- C:\Windows\System\iIfKIKu.exe
  C:\Windows\System\iIfKIKu.exe
  2⤵
  PID:1124
- C:\Windows\System\EsTrrvv.exe
  C:\Windows\System\EsTrrvv.exe
  2⤵
  PID:12304
- C:\Windows\System\iSkjDVa.exe
  C:\Windows\System\iSkjDVa.exe
  2⤵
  PID:12664
- C:\Windows\System\eSEfPmS.exe
  C:\Windows\System\eSEfPmS.exe
  2⤵
  PID:8624
- C:\Windows\System\vxhDPJA.exe
  C:\Windows\System\vxhDPJA.exe
  2⤵
  PID:3872
- C:\Windows\System\gVzuSZU.exe
  C:\Windows\System\gVzuSZU.exe
  2⤵
  PID:11184
- C:\Windows\System\TvspRuM.exe
  C:\Windows\System\TvspRuM.exe
  2⤵
  PID:9132
- C:\Windows\System\qEwvKSV.exe
  C:\Windows\System\qEwvKSV.exe
  2⤵
  PID:2812
- C:\Windows\System\UPNsMVp.exe
  C:\Windows\System\UPNsMVp.exe
  2⤵
  PID:7000
- C:\Windows\System\eRkaPOu.exe
  C:\Windows\System\eRkaPOu.exe
  2⤵
  PID:6240
- C:\Windows\System\FEfDOcn.exe
  C:\Windows\System\FEfDOcn.exe
  2⤵
  PID:10588
- C:\Windows\System\AVUOcwp.exe
  C:\Windows\System\AVUOcwp.exe
  2⤵
  PID:10736
- C:\Windows\System\spHyjQQ.exe
  C:\Windows\System\spHyjQQ.exe
  2⤵
  PID:1912
- C:\Windows\System\dylXhMS.exe
  C:\Windows\System\dylXhMS.exe
  2⤵
  PID:6780
- C:\Windows\System\UucLMGQ.exe
  C:\Windows\System\UucLMGQ.exe
  2⤵
  PID:11132
- C:\Windows\System\OVMixAz.exe
  C:\Windows\System\OVMixAz.exe
  2⤵
  PID:6960
- C:\Windows\System\NZdQntW.exe
  C:\Windows\System\NZdQntW.exe
  2⤵
  PID:9028
- C:\Windows\System\SdhdzUO.exe
  C:\Windows\System\SdhdzUO.exe
  2⤵
  PID:9096
- C:\Windows\System\cyHHhfm.exe
  C:\Windows\System\cyHHhfm.exe
  2⤵
  PID:11248
- C:\Windows\System\sQEybtn.exe
  C:\Windows\System\sQEybtn.exe
  2⤵
  PID:11236
- C:\Windows\System\iWuuKWc.exe
  C:\Windows\System\iWuuKWc.exe
  2⤵
  PID:6288
- C:\Windows\System\nvLrLXb.exe
  C:\Windows\System\nvLrLXb.exe
  2⤵
  PID:11316

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 4580 -s 2196
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_u4d11jqd.lax.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u4d11jqd.lax.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AIZLcxI.exe

Path C:\Windows\System\AIZLcxI.exe
Size 3.0MB
SHA256 669a2a5cf7eb76d7d1440783e8fb4d7bfa4dfb41bfba2b3ea2cd28d1f6d4a97f
MD5 871bc2df18220b541f89b397691db59d
SHA1 471cd6c79018daef736694967ae619c17d7d550e
SHA512 ceb9c3e39cee243d63de1fbe0ffc7792353c8c73b0da2465f6a15eb5bae8d85dcfce34923b1e530d71b79383460eb97a36a433379acbefeba8bc586361dcbae6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

AfrKfPy.exe

Path C:\Windows\System\AfrKfPy.exe
Size 3.0MB
SHA256 b8972dc6abf0fc6cf295223bfac8b5906d9701a23e4dd002137f3bbeba1d94aa
MD5 866ae6b5a3486774952dce0f8288ad13
SHA1 710f0572276acc38ea8c4c0ed2653c86ccc6e8e7
SHA512 365be2b9476c1db57b40563b443def5ba15378bae421cd2358197deb86525c85cc472bc268dbc12a25e9d4cfdfb6f5925b05841c86df0e06ce86e8662c401aa1
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

DoRlvtM.exe

Path C:\Windows\System\DoRlvtM.exe
Size 3.0MB
SHA256 0e968954adc1214de7ce9d01ae0b634c53b93bd3d99389b3a7d22acaf107a32f
MD5 dfcaa1cf4a5919aabeb9460423e7935b
SHA1 af31e082cd9848f6bd52bdef9780a92b5cabc674
SHA512 e05816ab9139b8600d6d5ad369a0ea36fad858339d097cc3c24811cc22426b26749efc5aaee37a29d57fd15405f8ca469c2324bf611bc088c326ee374c600bcc
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR2:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

GPzxXCc.exe

Path C:\Windows\System\GPzxXCc.exe
Size 3.0MB
SHA256 9fcee941a48fe92094de3bda68971ab333a9fcd301adbf94008756a079edbd4b
MD5 d2a1f70fcea540b2ef52afbcffc2f818
SHA1 32d94a495d230e86281233ced59f7d1f44e4af13
SHA512 08604cc9eaacc03e0d17c4df88b78e385df68bebc721712b1873dc3f44a4138a6bd02427ebb34507df403bc737a242c2f0c5744584d43993783808d97b4febcc
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR1:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

HTgmiQF.exe

Path C:\Windows\System\HTgmiQF.exe
Size 3.0MB
SHA256 3200e6d1b5e35393a100e71afe87a8e6655b918c555a67464e06bf68e1c69c28
MD5 c4706c93726bcedf9ad124b4fbf69f33
SHA1 483e0a0d544a6919ffe9d81a6d2f8787e48ff1fa
SHA512 7acdd557d1a5fef027305e8ea4dbe9722bec0ead763cf944dca469d07f72429e27bcc32b0a261a76a21457506012c215eb35fa0326fcda9b30f7518dd8b3f96e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR9:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

IleAUXu.exe

Path C:\Windows\System\IleAUXu.exe
Size 3.0MB
SHA256 f1753b5099f193a61698f15dcc5cf749a75e84567d3a54012c53f56293b4050b
MD5 b026fce98ac2ba8e6ab3e3fd4242facf
SHA1 73500ef63e7691b7721c555a603781816c93b32c
SHA512 1bb55b641924721ddfa4197257f29f5f04855ad583f5532e51378e3067ae6d042935fea0fe52a0717a7eab8e35406bea15dd76649891d8de28ca94c292e560af
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR6:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

JAhniCU.exe

Path C:\Windows\System\JAhniCU.exe
Size 3.0MB
SHA256 a36fdb4fb461bd3c93457b40ad49639a4eb82f83d126efe992d12cf4f15fccfb
MD5 7fe206e384cc572db184e3313978057a
SHA1 1bfdb983c5a3434b4bcc4c4f133ed0318d2b9411
SHA512 1a308dc101b0a211fb59f2b3fb33ef10414ab7fc56d9c8c7a08b0fa097a22b02b319aef0559845b7df45ecda134a92a97af2f5bc623f73ea4854bc29cd12b23e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRw:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

JVSaEKN.exe

Path C:\Windows\System\JVSaEKN.exe
Size 3.0MB
SHA256 c865e436c8bd8e6b386fe7ba2410308ad59c469a76237b4281de30bace0c1203
MD5 937f558f9d4e2c73a6ff5df8bccd4819
SHA1 b811893445706e28d32448147423516a7dbad643
SHA512 a0f7832fe99cc1310568b81184da6c4b616b9604f5f1adf7b0be51a2be4e28bbe8af4b25a81c75e1095a074e16946f01894ff047b79ee02de0033fd6191033ac
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRh:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

KIcoJMc.exe

Path C:\Windows\System\KIcoJMc.exe
Size 3.0MB
SHA256 fbe4fe587e156914f2f5cf31fa7ed25a7ef141e3aa6bedf9e79a8328774dabf7
MD5 b22b3edbe0277b42686ee2851cfe3242
SHA1 621f4a76a41b586c0f1af13b395d6ef621501210
SHA512 4d5fa7d703cde079a5f3e2905f1060319b651d9ec8ab6d11a1ac5e0fca368fd8686d6a7e82a8323c3027bb8424470d73190e8851860277f8939b00c7efad94cb
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR9:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R3
MD5 SHA1 SHA512 SSDEEP

Submit Download

KdwaaPC.exe

Path C:\Windows\System\KdwaaPC.exe
Size 3.0MB
SHA256 33db742887665f7214f6ec57a1ed96334498ce3d85d717e3be56ee8bd8656842
MD5 17a007996d4e4d5a4e33efb57f58cab7
SHA1 164a807ec5136479bda7ebd1094a4cdb6795ccaf
SHA512 8f584798c1a15d425fad3d09e163697405e58386148768c55cb0694f70610ffb3ad621ee095fffd51e5016248c4b6d2c9c500ca92b32b260d01b0b7116c08429
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR2:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

KziMUFg.exe

Path C:\Windows\System\KziMUFg.exe
Size 3.0MB
SHA256 72df1b3da297fd58bce8146bfb1e37a08a53b84027346493707b36a33a2a63e6
MD5 649bd7b09a1f3c27b1fadaac93f6ddc0
SHA1 ed9fce2bf3909fc6049bcaf4659da40a10bc0878
SHA512 d25c45e910ae10dd3815d26f71c1a7f9e254e16efdbd1d373f1feabc69cf26c043d61ac7c7be15f87d07e9908c95598d1ee12f0e80085bd746d346b828cdcaea
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRf:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R5
MD5 SHA1 SHA512 SSDEEP

Submit Download

LTsnrVT.exe

Path C:\Windows\System\LTsnrVT.exe
Size 3.0MB
SHA256 42110a54a1e1021a27b9f48ca53f257aa48970b351d703c0ac7fd27b19684ea4
MD5 ed511aa4d7a5cbba36e5dd41a281c75b
SHA1 44359cc638848659c55abd9f8838f2de88bcbc93
SHA512 1a29ac3ff2fa5e63b2467763faaa688acd0d9a44219cf7a27ed4d3d4ad17f2e5b45ec3ed03350e42e3590da21156ef119ae00c50c6082c036727889aa2e04046
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRP:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

NYMYvhb.exe

Path C:\Windows\System\NYMYvhb.exe
Size 3.0MB
SHA256 0d80cd6582adee9e4506390e8fec1d2eec73df3a6eb018f48dd29d9ce59992eb
MD5 2689b8eb5c97a605179ac4d1c80a5031
SHA1 bf0554f58f0f2b67f30436b06b62d98c90b7b3cd
SHA512 dae4f7abeed8ebaab8b4a50ca7790fce6b20b6cd2637d1e458014679415b2511c7b21933e58ffde3ec7b10fcaa9f78409a3dc98185377701122cd1a8862eb107
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRz:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

NyDSjyM.exe

Path C:\Windows\System\NyDSjyM.exe
Size 3.0MB
SHA256 8ddae5e48f2c6ff45bfdcaa60b00cd38364eaf069e4ea3c246f607ff3b4bc9c2
MD5 5288d3db1cdd55e1234068b53c56ce27
SHA1 63a37858af7f307d9d40e6fd3211da4ff68f44d2
SHA512 783936a4c257d1699b7dddae3f91e19c4f188ffd03ff3ed849ca9bb98fcc0b6db46a55c0f5a1ac47d6b37238673d8040acc93d72a42b9826fba3bb2a3e8860c6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRB:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

QgtWOzi.exe

Path C:\Windows\System\QgtWOzi.exe
Size 8B
SHA256 4443ea8760d035c6b4f05df6df4c7e7ad9c5afa8dead954bce57dab5a5afcf1e
MD5 66bd487d69202ef8b2b1bb2e1931ebf3
SHA1 6297e827d2cc12ba96555851f82fc059665704b0
SHA512 9e09fc0a19c454ee0cecdc74d2823aed9c4a94ebbcd2ca5a3004beafcda66afd0bc9b7ffcaee69b05991566849eedce2fe3d3b28ecd596511f3194e8d04c5acc
MD5 SHA1 SHA512

Submit Download

RaqEoAF.exe

Path C:\Windows\System\RaqEoAF.exe
Size 3.0MB
SHA256 629c283dfca25dd0b9224482383a34af48aef9690b52e24da2e806fef021425a
MD5 a50c6e542f46f37ac30af6710793d878
SHA1 45a43607d2279a3eca3d6560db350085e2151e96
SHA512 a83ff68f54a1f8906e4406b55cb775441579e093998e474462f1f635ffcb056540432c777e4aab60dd100800a2a09a9794a8d3f7b758eee52f67767274bf733d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRm:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpmAhPX.exe

Path C:\Windows\System\RpmAhPX.exe
Size 3.0MB
SHA256 fc87218b3215a128538ee0946fd1e286f9c1b34cc169063653922eb395b99998
MD5 11326e028f37d95f19364c5c3412628f
SHA1 f89ea72384a46e52cfeb77107a927fe734fa9609
SHA512 653112cf294c61fb8bd9449d168dcf05ff4d7d7350554454ceaf70975447a69739038261e2f70d6941f73bc02392db12740262925251a9469bf067e68926e8be
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR5:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiWdQNv.exe

Path C:\Windows\System\SiWdQNv.exe
Size 3.0MB
SHA256 34209c7faf0e98c5e7ec3b136ce01a6c0dc08686951c8f60ef37aff66c288fd7
MD5 70ec416bc4de27f3eb0eaa1cb0433a74
SHA1 b2e5ee5992bdd457a624d351d597c5cbf0bbe13c
SHA512 9fcad99d7790e09f4ca4f78777555764217efc6dbbc9a18403d2ac5cb48dc671ce01d61102a3d6927839e6f0cb8860435fbb7dd6e333eaa33ada02c93e4c781a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRO:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RM
MD5 SHA1 SHA512 SSDEEP

Submit Download

UftiLiM.exe

Path C:\Windows\System\UftiLiM.exe
Size 3.0MB
SHA256 07c41883a11ec0cffaae1d4b89a65839b83bb4396cf10fbd577d98569ebc3cf0
MD5 6d756341c8252875959fca43a847c96a
SHA1 ab0ebcc905f1c0b2d42bd5c3bc7cff017935db70
SHA512 20a8934532d5d3cabb13fe0d31fbda71f7f9db32b0504ebad49dd6c231ac8f1cb364d7d71d11a9d89d5699c120367fef9726b18fb76cacf921168c26fc38fd5e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRa:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

UtDTELI.exe

Path C:\Windows\System\UtDTELI.exe
Size 3.0MB
SHA256 abf82b9f02d811fcf16ff7a55b0a1dc5aaf71074e6b3ef50547cfbda6447f26a
MD5 94dee72bdc6521ba9ad995bffd6f5f1f
SHA1 32b3cee7730bbc8bb7e93806ab0a445ee35428c2
SHA512 26866cfd2139d76a9da22a4812cbc3d52665fad2f3b73ee45dd2bbd0c18125b48e548f82f2712e59bcc66266905c8db03ec45a529ed8df06a3418f7904cd4d10
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRa:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc
MD5 SHA1 SHA512 SSDEEP

Submit Download

VWtOjWl.exe

Path C:\Windows\System\VWtOjWl.exe
Size 3.0MB
SHA256 6d057d63a51a828b748b65620920dc0fe39207abf23cbc8d4fc0064fb13113e8
MD5 7009110b02210cec6584b9af2a03d764
SHA1 7433ec6adef8006adb44a70680f3d6c01101941f
SHA512 3ed9922c21b1f19c02dfd421044b1ee3bb0e43a1a6fe4ed11bd8bf10238c4ead973efa5e92cab711119c4b2cf16e7ae87fd9903985226f7faf3a73ab0008e333
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

WQTnZJS.exe

Path C:\Windows\System\WQTnZJS.exe
Size 3.0MB
SHA256 d3dca92d1654a10e71a318a03b3cf040f58daf015c347d45de1edd58f7bfd95d
MD5 37204224a47399550e10ba65470ea265
SHA1 8fff30ff0c6e27be0d7da9dab770ed3542a7c289
SHA512 f0570668e6b1be3a2372088bafef7412204be822625050dc6f42a6354878914eac27040ad1956a4297ef144a579e8f9ba44ceedef5747db3c3a92312149a0f5f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRj:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaQaFiS.exe

Path C:\Windows\System\WaQaFiS.exe
Size 3.0MB
SHA256 015906bfb91bf58cb51f7fcc13e6383eba8eecc2ee89a371b83799921375d17b
MD5 17ea4ed71015a451d533b12f5515915b
SHA1 eb1d66b11bbd870c49cb3f4d1dda7bcba4074038
SHA512 0dde8a5ee205e0cdddec1d3d735642947425e9c7477274516194e5960ddcbe76688b6ed694bdc648cc0f8fba70f711045deba8ba985c3895136af547efe9f74a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRl:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

WfSJVAm.exe

Path C:\Windows\System\WfSJVAm.exe
Size 3.0MB
SHA256 e8917d7ca5a71a73dc9d536f09f29d7d940c9670596502d537c4113f51bece60
MD5 946638d2ea963af8154fdb13e2caff7f
SHA1 c42ed4e149de60236e441e5bf976e0148950d076
SHA512 ad3bb52085d1103d35ef9798c11ec590b1bf035013f50029e3912069a693788b8d12cfded4746c7b233121122cc9862ecc77d86619f08a191725d188cf9b5b51
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR3:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

XSwRgSi.exe

Path C:\Windows\System\XSwRgSi.exe
Size 3.0MB
SHA256 65333c894809d3a7943d6a98bf1efad0d55d80c97dcae4784f16f344377d84e6
MD5 6e3d733ae4797f315cddc4aba2147248
SHA1 230a32dd57469f2d1658a73fc5b2387c5cdaebe1
SHA512 c8d72e61055493145df42cf3538f65d935ce6ff04917b6840967c41ee355330a18af96d4b2e41b0a2f9c9a99de0c4e8f9ea0dad675e853a7f6649b5522a6a39a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRr:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rx
MD5 SHA1 SHA512 SSDEEP

Submit Download

YMurOqZ.exe

Path C:\Windows\System\YMurOqZ.exe
Size 3.0MB
SHA256 31fc704fedded9e7ff56cb435b05902a7d91bcc5649c78ea3ede73144b4da258
MD5 9a49c23ea93777e41b4a043ef40cea0d
SHA1 eacc3a9b9d7ea4f54a56587eae2631c3650632cc
SHA512 6e3a2df8037513dc3dfd72206ef670ec66f39879e0441fe84da6520bc6a62fb7b8b89291aee2c18f171563cb1afdd2bdab71bca77d1bfd67335370239edf1611
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRv:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

bjHUjdK.exe

Path C:\Windows\System\bjHUjdK.exe
Size 3.0MB
SHA256 fa8d19ed024165051f9d15d1a201965b3e9c1daedda995ea9538ea79976abdeb
MD5 4dcedd5b1fbc79da38f3488055564a39
SHA1 4f092e565f2c92dc1d288a7723fd030d6365db92
SHA512 a1c34bdebb35f6e1f010b1e2613e37fd6941efff87eeb78f67ae6a518c5383578983ea95fadb6f9869d5d902d5596ea67a96d72a7dbe89437f92a07ab1219e29
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRR:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rb
MD5 SHA1 SHA512 SSDEEP

Submit Download

fqVzOqF.exe

Path C:\Windows\System\fqVzOqF.exe
Size 3.0MB
SHA256 68055ca0d7b9052bbec2cefc2e13a6380a59b0ee7ad745f61871822794762342
MD5 004614462b8f3ab1b4bf8d5029eb33a0
SHA1 eb0dc478dd6f76df9bd5bd6385bdb19fdb69cfcc
SHA512 602b523dc4678b27ab987e5d62b377a459ff19021b3256d6076dc1986ee66355a679b0cf235e7067b71f869de5e5baca3b15ec6f70fb54d1fe9f94f0bdb76d1a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

gydTVbJ.exe

Path C:\Windows\System\gydTVbJ.exe
Size 3.0MB
SHA256 353c572128ddd7e0a73a33ddaa212c2fce3264e9e6f43bf4d976e198cee731c2
MD5 2044b1f56b415f5d18ecd208ce932970
SHA1 2390f3e30cf478dab344c8f0fa3e82de48913f32
SHA512 c0e3d835e567c68b0ec5c8e8d689dabc802e3dbac7ecbf535c6f72df5a8f40cfb9bb5bf537ae1704bdc39b6864e4be6a3126df0257427fa3562b1759d06642db
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRR:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

oYxSGGP.exe

Path C:\Windows\System\oYxSGGP.exe
Size 3.0MB
SHA256 6b17264ae9fb7875e5e18d9d7a3bb48ba385c8321bbb0c3a587c9c7b318ec59c
MD5 56ba9694444b468a44b1761645633695
SHA1 0c37e383f00dd40be4bf3b724b79c06098b38797
SHA512 356f6821749e9eac0ba67e855fbf5a34ea822871c752e9d274311032babc5de03bec9aa67ed5e6a379598184728f4eed1f0a257ef07e6541512a658afab04994
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRc:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

pSIjxDD.exe

Path C:\Windows\System\pSIjxDD.exe
Size 3.0MB
SHA256 a055945fa82f1084699b26add6cdd48fc0b6352808db1425870664bbfaf1ab7b
MD5 b7cafe02e2e89dc44ac3ea154501ef23
SHA1 e2889ff8ec3b476102e510c0a315850c69b53342
SHA512 f32c3335d7f8a0e617b3be1a9bf83d48075f74e280128182ac7aa774fcbb280f5ba3959fa8f29112194d15539b804ff86d77fd740ef84bf64deae9cad060c426
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR7:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

sMHrseS.exe

Path C:\Windows\System\sMHrseS.exe
Size 3.0MB
SHA256 bc45d2e0008f69d98a32dc293221557b276a801fd62ac809ac82e768672d6f2c
MD5 0f2b83447f7b57fa5acaf6f34ee3e5c8
SHA1 a63ae981942459183f5db83005651b84d630d761
SHA512 4f43cead7cbfd46b545107e9f7aeebf54f83e5ca8cb3192f754ab3878582c65ffcd99a492eca36e71d44f368eeb4810c27f2228186522e838e452cf389e906a5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRG:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tXEqUcZ.exe

Path C:\Windows\System\tXEqUcZ.exe
Size 3.0MB
SHA256 e961b2b50c48152d72542f75cd5df757495c0ce1e78e6b3e5c0325fb486e1ae7
MD5 d3dd5427cf32e6a7ce4b60536a090bec
SHA1 ca70f933fb944473fdcecb0bf8ba53871818a740
SHA512 25c9cbe53f0d5317abe08218f85195e52fe9565dc99499c658ebec45211707fd2712cec1c19446ab816db2c80977c8ca35df5b211ea730ed2acd7578a0be5202
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRt:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

uyroSXy.exe

Path C:\Windows\System\uyroSXy.exe
Size 3.0MB
SHA256 58f2e9833e0367c0684717f569a8bfdb52dad2af92824626479cb7c3de396e24
MD5 1facb0262525249fc56ead355cc794ee
SHA1 386a6303ca7ee46f8c840aa468227186228805b4
SHA512 22e156e3cb3fc560f7c1defd242d1d2668bfa49cd299a37f77c360bf7bf45555f7b841ceae1859e9f852534038f3154a58545b8825430dacffd80fd6f1c19fc9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRn:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

vzvoPfs.exe

Path C:\Windows\System\vzvoPfs.exe
Size 3.0MB
SHA256 1f30b26a43c6369c3b38dbfabf20d8b7c35009ae5f8fa14306346443ff2c1df8
MD5 19dc82041a5ef5e37420c565af19d971
SHA1 687a799d9942cbb20020a9cc96a7df58104e4dbb
SHA512 5b89d0868d3fd09c30d972c66ec45de3cb1d9e11e96c8d11434773c2fee0801adf8369a31ec365d406ab38d7b5df7a46c91da619911fd475169b9ee9fadd7773
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iR4:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylhjYYg.exe

Path C:\Windows\System\ylhjYYg.exe
Size 3.0MB
SHA256 1b99482db1dcb151b9b9a281286545995a633562ded50027babb2750eb27fd35
MD5 601331fa34acfad286a52713ff26a413
SHA1 1b12563fadf2bbf0f4385bdddafdba71e15155e1
SHA512 ccf17ead571debc7dd27a44c35d7146b57b2f0996de3419de60757961d66701a7d6d7d6a01dd9ff132f02bd68e5f8f97546a2f69e21909203918c6648adb9b30
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRC:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RE
MD5 SHA1 SHA512 SSDEEP

Submit Download

zgoGVLd.exe

Path C:\Windows\System\zgoGVLd.exe
Size 3.0MB
SHA256 b39e12a7ec4d409cb3a689280b53ce6c32aba08c5b5d8ce0f4f01f11c79a59fc
MD5 db327f2055f6b3542d702be49b7122b3
SHA1 8c93150751359494570e65badab3fe77f934fea7
SHA512 a8b8060f7502c8201a0f4475308b7c82f8d3c4bf09c703ccc301a5d9f951b2f3eca5f25cf4ee3614ea97557361c8fc69c9e2d7dbc78949e5b7b3ed9d3972d88b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRU:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-1995-0x00007FF7CD420000-0x00007FF7CD816000-memory.dmp

Download

memory/60-127-0x00007FF7CD420000-0x00007FF7CD816000-memory.dmp

Download

memory/920-1981-0x00007FF602C80000-0x00007FF603076000-memory.dmp

Download

memory/920-95-0x00007FF602C80000-0x00007FF603076000-memory.dmp

Download

memory/1092-133-0x00007FF761CA0000-0x00007FF762096000-memory.dmp

Download

memory/1092-1985-0x00007FF761CA0000-0x00007FF762096000-memory.dmp

Download

memory/1096-212-0x00007FF7F5F60000-0x00007FF7F6356000-memory.dmp

Download

memory/1096-2008-0x00007FF7F5F60000-0x00007FF7F6356000-memory.dmp

Download

memory/1276-132-0x00007FF72A690000-0x00007FF72AA86000-memory.dmp

Download

memory/1276-1986-0x00007FF72A690000-0x00007FF72AA86000-memory.dmp

Download

memory/1608-1978-0x00007FF7ED0E0000-0x00007FF7ED4D6000-memory.dmp

Download

memory/1608-136-0x00007FF7ED0E0000-0x00007FF7ED4D6000-memory.dmp

Download

memory/1656-1976-0x00007FF746C70000-0x00007FF747066000-memory.dmp

Download

memory/1656-1972-0x00007FF746C70000-0x00007FF747066000-memory.dmp

Download

memory/1656-8-0x00007FF746C70000-0x00007FF747066000-memory.dmp

Download

memory/2016-113-0x00007FF7EA4D0000-0x00007FF7EA8C6000-memory.dmp

Download

memory/2016-1980-0x00007FF7EA4D0000-0x00007FF7EA8C6000-memory.dmp

Download

memory/2556-116-0x00007FF6CB7F0000-0x00007FF6CBBE6000-memory.dmp

Download

memory/2556-1982-0x00007FF6CB7F0000-0x00007FF6CBBE6000-memory.dmp

Download

memory/2768-137-0x00007FF68E650000-0x00007FF68EA46000-memory.dmp

Download

memory/2768-1983-0x00007FF68E650000-0x00007FF68EA46000-memory.dmp

Download

memory/3048-96-0x00007FF67B480000-0x00007FF67B876000-memory.dmp

Download

memory/3048-1977-0x00007FF67B480000-0x00007FF67B876000-memory.dmp

Download

memory/3064-2002-0x00007FF6EFE30000-0x00007FF6F0226000-memory.dmp

Download

memory/3064-214-0x00007FF6EFE30000-0x00007FF6F0226000-memory.dmp

Download

memory/3412-1-0x0000018C65E00000-0x0000018C65E10000-memory.dmp

Download

memory/3412-0-0x00007FF64AE90000-0x00007FF64B286000-memory.dmp

Download

memory/3456-1988-0x00007FF78D9E0000-0x00007FF78DDD6000-memory.dmp

Download

memory/3456-130-0x00007FF78D9E0000-0x00007FF78DDD6000-memory.dmp

Download

memory/3564-1979-0x00007FF6A3C30000-0x00007FF6A4026000-memory.dmp

Download

memory/3564-135-0x00007FF6A3C30000-0x00007FF6A4026000-memory.dmp

Download

memory/3644-1991-0x00007FF73CA50000-0x00007FF73CE46000-memory.dmp

Download

memory/3644-126-0x00007FF73CA50000-0x00007FF73CE46000-memory.dmp

Download

memory/4004-1993-0x00007FF699750000-0x00007FF699B46000-memory.dmp

Download

memory/4004-124-0x00007FF699750000-0x00007FF699B46000-memory.dmp

Download

memory/4264-1987-0x00007FF69B510000-0x00007FF69B906000-memory.dmp

Download

memory/4264-131-0x00007FF69B510000-0x00007FF69B906000-memory.dmp

Download

memory/4276-122-0x00007FF7DE360000-0x00007FF7DE756000-memory.dmp

Download

memory/4276-1996-0x00007FF7DE360000-0x00007FF7DE756000-memory.dmp

Download

memory/4280-128-0x00007FF73C160000-0x00007FF73C556000-memory.dmp

Download

memory/4280-1990-0x00007FF73C160000-0x00007FF73C556000-memory.dmp

Download

memory/4432-1975-0x00007FF6BFC70000-0x00007FF6C0066000-memory.dmp

Download

memory/4432-22-0x00007FF6BFC70000-0x00007FF6C0066000-memory.dmp

Download

memory/4560-129-0x00007FF6E6AE0000-0x00007FF6E6ED6000-memory.dmp

Download

memory/4560-1989-0x00007FF6E6AE0000-0x00007FF6E6ED6000-memory.dmp

Download

memory/4804-125-0x00007FF658DB0000-0x00007FF6591A6000-memory.dmp

Download

memory/4804-1992-0x00007FF658DB0000-0x00007FF6591A6000-memory.dmp

Download

memory/4820-123-0x00007FF7641B0000-0x00007FF7645A6000-memory.dmp

Download

memory/4820-1994-0x00007FF7641B0000-0x00007FF7645A6000-memory.dmp

Download

memory/4852-117-0x00007FFBF4690000-0x00007FFBF5151000-memory.dmp

Download

memory/4852-1973-0x00007FFBF4690000-0x00007FFBF5151000-memory.dmp

Download

memory/4852-29-0x00007FFBF4693000-0x00007FFBF4695000-memory.dmp

Download

memory/4852-1974-0x00007FFBF4693000-0x00007FFBF4695000-memory.dmp

Download

memory/4852-139-0x0000028FFBFC0000-0x0000028FFBFE2000-memory.dmp

Download

memory/4852-309-0x0000028FFCF50000-0x0000028FFD6F6000-memory.dmp

Download

memory/4852-86-0x00007FFBF4690000-0x00007FFBF5151000-memory.dmp

Download

memory/4852-2103-0x00007FFBF4690000-0x00007FFBF5151000-memory.dmp

Download

memory/5012-1984-0x00007FF6F23C0000-0x00007FF6F27B6000-memory.dmp

Download

memory/5012-134-0x00007FF6F23C0000-0x00007FF6F27B6000-memory.dmp

Download