xmrig | ad3377dd6fcf52bc6771fc866950095d9fd86db5fa8085f2434d812aa2d73b72

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
Size 2.5MB
Sample240526-zf2ddscc99
SHA256 ad3377dd6fcf52bc6771fc866950095d9fd86db5fa8085f2434d812aa2d73b72
MD5 001c507df32d87dee15a3597163c5c50
SHA1 0994a7d50ac3a11291d0f27a4bf5db3dc7b9bc4d
SHA512 e804b45e3651373f2fe56ef0d882e93a45392f0891a67359166bd3190ed1d3066fa295d882d72071e5c6a95ca2b22517fbd44d9b3a81c3f02a9b0cded909e3c5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkb:BemTLkNdfE0pZrV56utgpPFoU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 15236 created 13664	15236	WerFaultSecure.exe	723

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3604-0-0x00007FF701750000-0x00007FF701AA4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023467-5.dat	xmrig
behavioral2/files/0x0007000000023476-8.dat	xmrig
behavioral2/files/0x0007000000023475-16.dat	xmrig
behavioral2/memory/4500-21-0x00007FF78EA40000-0x00007FF78ED94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023477-24.dat	xmrig
behavioral2/memory/1760-15-0x00007FF7DF950000-0x00007FF7DFCA4000-memory.dmp	xmrig
behavioral2/memory/4408-11-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	xmrig
behavioral2/memory/552-28-0x00007FF610250000-0x00007FF6105A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023478-29.dat	xmrig
behavioral2/files/0x0007000000023479-34.dat	xmrig
behavioral2/files/0x000900000002346e-47.dat	xmrig
behavioral2/files/0x000700000002347a-55.dat	xmrig
behavioral2/files/0x000700000002347d-60.dat	xmrig
behavioral2/memory/2232-68-0x00007FF7C1800000-0x00007FF7C1B54000-memory.dmp	xmrig
behavioral2/files/0x000700000002347f-79.dat	xmrig
behavioral2/memory/2764-77-0x00007FF75EF90000-0x00007FF75F2E4000-memory.dmp	xmrig
behavioral2/memory/1484-76-0x00007FF7A2BF0000-0x00007FF7A2F44000-memory.dmp	xmrig
behavioral2/files/0x000700000002347c-73.dat	xmrig
behavioral2/files/0x000700000002347e-71.dat	xmrig
behavioral2/memory/3248-69-0x00007FF6819C0000-0x00007FF681D14000-memory.dmp	xmrig
behavioral2/files/0x000700000002347b-64.dat	xmrig
behavioral2/memory/2512-62-0x00007FF6156B0000-0x00007FF615A04000-memory.dmp	xmrig
behavioral2/memory/620-57-0x00007FF608200000-0x00007FF608554000-memory.dmp	xmrig
behavioral2/memory/4660-49-0x00007FF71E2D0000-0x00007FF71E624000-memory.dmp	xmrig
behavioral2/memory/1372-43-0x00007FF62A8E0000-0x00007FF62AC34000-memory.dmp	xmrig
behavioral2/memory/2828-39-0x00007FF64EC60000-0x00007FF64EFB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023480-83.dat	xmrig
behavioral2/files/0x0007000000023482-90.dat	xmrig
behavioral2/files/0x0007000000023484-101.dat	xmrig
behavioral2/memory/1260-103-0x00007FF7B5880000-0x00007FF7B5BD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023486-110.dat	xmrig
behavioral2/files/0x0007000000023488-121.dat	xmrig
behavioral2/memory/4924-124-0x00007FF7826C0000-0x00007FF782A14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023489-136.dat	xmrig
behavioral2/files/0x0007000000023487-134.dat	xmrig
behavioral2/memory/4864-131-0x00007FF6C3500000-0x00007FF6C3854000-memory.dmp	xmrig
behavioral2/memory/4500-125-0x00007FF78EA40000-0x00007FF78ED94000-memory.dmp	xmrig
behavioral2/memory/4020-122-0x00007FF618320000-0x00007FF618674000-memory.dmp	xmrig
behavioral2/memory/4568-116-0x00007FF6F0560000-0x00007FF6F08B4000-memory.dmp	xmrig
behavioral2/memory/1760-113-0x00007FF7DF950000-0x00007FF7DFCA4000-memory.dmp	xmrig
behavioral2/memory/3468-112-0x00007FF674570000-0x00007FF6748C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023483-109.dat	xmrig
behavioral2/memory/1624-107-0x00007FF7E2CF0000-0x00007FF7E3044000-memory.dmp	xmrig
behavioral2/files/0x0007000000023485-104.dat	xmrig
behavioral2/memory/3604-98-0x00007FF701750000-0x00007FF701AA4000-memory.dmp	xmrig
behavioral2/memory/2920-89-0x00007FF653400000-0x00007FF653754000-memory.dmp	xmrig
behavioral2/memory/4408-88-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	xmrig
behavioral2/files/0x000700000002348a-142.dat	xmrig
behavioral2/files/0x000700000002348b-143.dat	xmrig
behavioral2/files/0x000700000002348e-159.dat	xmrig
behavioral2/files/0x000700000002348d-165.dat	xmrig
behavioral2/memory/3248-186-0x00007FF6819C0000-0x00007FF681D14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023494-203.dat	xmrig
behavioral2/files/0x0007000000023492-199.dat	xmrig
behavioral2/files/0x0007000000023493-198.dat	xmrig
behavioral2/files/0x0007000000023491-191.dat	xmrig
behavioral2/files/0x0007000000023490-189.dat	xmrig
behavioral2/memory/2764-188-0x00007FF75EF90000-0x00007FF75F2E4000-memory.dmp	xmrig
behavioral2/memory/804-187-0x00007FF6413D0000-0x00007FF641724000-memory.dmp	xmrig
behavioral2/memory/1484-185-0x00007FF7A2BF0000-0x00007FF7A2F44000-memory.dmp	xmrig
behavioral2/memory/3552-184-0x00007FF7587D0000-0x00007FF758B24000-memory.dmp	xmrig
behavioral2/files/0x000700000002348f-181.dat	xmrig
behavioral2/memory/1744-175-0x00007FF69AED0000-0x00007FF69B224000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4408	pekWgIb.exe
1760	fzwtaQT.exe
4500	QjGotck.exe
552	cBPyfYJ.exe
2828	keiDgMM.exe
1372	HIAcOPF.exe
4660	pjpoghG.exe
620	QJDzZmU.exe
3248	aLAzmdt.exe
2512	mHsummt.exe
1484	CiphQPK.exe
2232	fgBzCXV.exe
2764	LJywADG.exe
2920	ffBbvkK.exe
1260	sPVnpdu.exe
1624	tCzJGPt.exe
4568	hhKZJKy.exe
3468	amapOCL.exe
4020	rkhLAXR.exe
4924	aCqFunx.exe
4864	afcKxWm.exe
696	PPwwhoz.exe
2516	gKMRCCH.exe
2836	SfzfmKg.exe
1832	QpNVzRr.exe
4032	eMsJdhJ.exe
1744	bqlTyQD.exe
3552	qBQghkH.exe
804	AAwXZZw.exe
1564	MxHEcij.exe
1548	HiWXMCZ.exe
1056	koUbhoB.exe
3548	PbrdSSr.exe
3080	GIGGRPa.exe
3536	DxNjfUb.exe
3372	tSjXbBh.exe
4332	iGMxhDF.exe
1672	FBezslH.exe
2744	mUgpBWs.exe
1512	SLmoBVt.exe
4280	RtSlQFc.exe
3448	CZwVHpK.exe
3944	CXeWdOy.exe
4672	aHWIzWw.exe
1204	GFJAvsm.exe
436	WNBPdxf.exe
216	xuuWcqS.exe
404	atKlWVs.exe
4384	tXAkYeH.exe
4976	XpAzFGE.exe
932	tpGUQZk.exe
4436	zkAdEiJ.exe
4916	KmhiEkF.exe
2740	gESnpoP.exe
4964	pAIBlXX.exe
4860	SAPKuOT.exe
5024	AbIsWEt.exe
3928	rFAhSWH.exe
4596	LehFuwA.exe
5068	LhOCHLF.exe
2036	UukUVgb.exe
3004	iGTHYoV.exe
3240	vBmqdUC.exe
3100	uLyCVxe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3604-0-0x00007FF701750000-0x00007FF701AA4000-memory.dmp	upx
behavioral2/files/0x0009000000023467-5.dat	upx
behavioral2/files/0x0007000000023476-8.dat	upx
behavioral2/files/0x0007000000023475-16.dat	upx
behavioral2/memory/4500-21-0x00007FF78EA40000-0x00007FF78ED94000-memory.dmp	upx
behavioral2/files/0x0007000000023477-24.dat	upx
behavioral2/memory/1760-15-0x00007FF7DF950000-0x00007FF7DFCA4000-memory.dmp	upx
behavioral2/memory/4408-11-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	upx
behavioral2/memory/552-28-0x00007FF610250000-0x00007FF6105A4000-memory.dmp	upx
behavioral2/files/0x0007000000023478-29.dat	upx
behavioral2/files/0x0007000000023479-34.dat	upx
behavioral2/files/0x000900000002346e-47.dat	upx
behavioral2/files/0x000700000002347a-55.dat	upx
behavioral2/files/0x000700000002347d-60.dat	upx
behavioral2/memory/2232-68-0x00007FF7C1800000-0x00007FF7C1B54000-memory.dmp	upx
behavioral2/files/0x000700000002347f-79.dat	upx
behavioral2/memory/2764-77-0x00007FF75EF90000-0x00007FF75F2E4000-memory.dmp	upx
behavioral2/memory/1484-76-0x00007FF7A2BF0000-0x00007FF7A2F44000-memory.dmp	upx
behavioral2/files/0x000700000002347c-73.dat	upx
behavioral2/files/0x000700000002347e-71.dat	upx
behavioral2/memory/3248-69-0x00007FF6819C0000-0x00007FF681D14000-memory.dmp	upx
behavioral2/files/0x000700000002347b-64.dat	upx
behavioral2/memory/2512-62-0x00007FF6156B0000-0x00007FF615A04000-memory.dmp	upx
behavioral2/memory/620-57-0x00007FF608200000-0x00007FF608554000-memory.dmp	upx
behavioral2/memory/4660-49-0x00007FF71E2D0000-0x00007FF71E624000-memory.dmp	upx
behavioral2/memory/1372-43-0x00007FF62A8E0000-0x00007FF62AC34000-memory.dmp	upx
behavioral2/memory/2828-39-0x00007FF64EC60000-0x00007FF64EFB4000-memory.dmp	upx
behavioral2/files/0x0007000000023480-83.dat	upx
behavioral2/files/0x0007000000023482-90.dat	upx
behavioral2/files/0x0007000000023484-101.dat	upx
behavioral2/memory/1260-103-0x00007FF7B5880000-0x00007FF7B5BD4000-memory.dmp	upx
behavioral2/files/0x0007000000023486-110.dat	upx
behavioral2/files/0x0007000000023488-121.dat	upx
behavioral2/memory/4924-124-0x00007FF7826C0000-0x00007FF782A14000-memory.dmp	upx
behavioral2/files/0x0007000000023489-136.dat	upx
behavioral2/files/0x0007000000023487-134.dat	upx
behavioral2/memory/4864-131-0x00007FF6C3500000-0x00007FF6C3854000-memory.dmp	upx
behavioral2/memory/4500-125-0x00007FF78EA40000-0x00007FF78ED94000-memory.dmp	upx
behavioral2/memory/4020-122-0x00007FF618320000-0x00007FF618674000-memory.dmp	upx
behavioral2/memory/4568-116-0x00007FF6F0560000-0x00007FF6F08B4000-memory.dmp	upx
behavioral2/memory/1760-113-0x00007FF7DF950000-0x00007FF7DFCA4000-memory.dmp	upx
behavioral2/memory/3468-112-0x00007FF674570000-0x00007FF6748C4000-memory.dmp	upx
behavioral2/files/0x0007000000023483-109.dat	upx
behavioral2/memory/1624-107-0x00007FF7E2CF0000-0x00007FF7E3044000-memory.dmp	upx
behavioral2/files/0x0007000000023485-104.dat	upx
behavioral2/memory/3604-98-0x00007FF701750000-0x00007FF701AA4000-memory.dmp	upx
behavioral2/memory/2920-89-0x00007FF653400000-0x00007FF653754000-memory.dmp	upx
behavioral2/memory/4408-88-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp	upx
behavioral2/files/0x000700000002348a-142.dat	upx
behavioral2/files/0x000700000002348b-143.dat	upx
behavioral2/files/0x000700000002348e-159.dat	upx
behavioral2/files/0x000700000002348d-165.dat	upx
behavioral2/memory/3248-186-0x00007FF6819C0000-0x00007FF681D14000-memory.dmp	upx
behavioral2/files/0x0007000000023494-203.dat	upx
behavioral2/files/0x0007000000023492-199.dat	upx
behavioral2/files/0x0007000000023493-198.dat	upx
behavioral2/files/0x0007000000023491-191.dat	upx
behavioral2/files/0x0007000000023490-189.dat	upx
behavioral2/memory/2764-188-0x00007FF75EF90000-0x00007FF75F2E4000-memory.dmp	upx
behavioral2/memory/804-187-0x00007FF6413D0000-0x00007FF641724000-memory.dmp	upx
behavioral2/memory/1484-185-0x00007FF7A2BF0000-0x00007FF7A2F44000-memory.dmp	upx
behavioral2/memory/3552-184-0x00007FF7587D0000-0x00007FF758B24000-memory.dmp	upx
behavioral2/files/0x000700000002348f-181.dat	upx
behavioral2/memory/1744-175-0x00007FF69AED0000-0x00007FF69B224000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CEGTMBj.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\znIrYiD.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\PwDnxzr.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\wBZNGBb.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\xtUWnKH.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\jdoqTXW.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\vpUwMUT.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\ZhmsNTa.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\bwsISVj.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\KnozEYa.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\scCaDJZ.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\YmXPELn.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\rHVtkYF.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\ODxMXpq.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\VMcgkjp.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\LIacQRh.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\inetXoP.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\HiGZESC.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\KtrUBcX.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\nimNsLS.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\xKULTVi.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\lajJppe.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\QDkqoVe.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\xBHsUOF.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\MuBgtcR.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\XlbQiTS.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\GBYhmnl.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\eIYgiKk.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\TXylHiE.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\qdgKZIw.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\gQaXCbX.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\tPYCWGX.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\TWPDWFJ.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\IuIbtUO.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\PeyyBPB.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\cyrvtCT.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\xNhnfzY.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\FDQEVjN.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\VeuXAXl.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\QBtANPx.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\AAXEMbF.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\rcKGPmj.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\ZuFMwOb.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\xRiMLFt.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\nYhVhDa.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\NxPqvHw.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\agwWYZc.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\NZZAEol.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\VcAQKha.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\pBoePAC.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\kNHfHHM.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\BrGqirN.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\hhKZJKy.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\QlqXevu.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\gxwDwoQ.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\nfcaYpU.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\vixdiQn.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\aYpPDSV.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\ucySWOD.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\iCmJwDF.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\sYYXurJ.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\QwRjilc.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\uhzrgrV.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
File created	C:\Windows\System\LJywADG.exe	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
15220	WerFaultSecure.exe
15220	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 4408	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	83
PID 3604 wrote to memory of 4408	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	83
PID 3604 wrote to memory of 1760	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	84
PID 3604 wrote to memory of 1760	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	84
PID 3604 wrote to memory of 4500	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	85
PID 3604 wrote to memory of 4500	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	85
PID 3604 wrote to memory of 552	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	86
PID 3604 wrote to memory of 552	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	86
PID 3604 wrote to memory of 2828	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	87
PID 3604 wrote to memory of 2828	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	87
PID 3604 wrote to memory of 1372	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	88
PID 3604 wrote to memory of 1372	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	88
PID 3604 wrote to memory of 4660	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	89
PID 3604 wrote to memory of 4660	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	89
PID 3604 wrote to memory of 620	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	90
PID 3604 wrote to memory of 620	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	90
PID 3604 wrote to memory of 3248	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	91
PID 3604 wrote to memory of 3248	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	91
PID 3604 wrote to memory of 2512	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	92
PID 3604 wrote to memory of 2512	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	92
PID 3604 wrote to memory of 1484	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	93
PID 3604 wrote to memory of 1484	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	93
PID 3604 wrote to memory of 2232	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	94
PID 3604 wrote to memory of 2232	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	94
PID 3604 wrote to memory of 2764	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	95
PID 3604 wrote to memory of 2764	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	95
PID 3604 wrote to memory of 2920	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	96
PID 3604 wrote to memory of 2920	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	96
PID 3604 wrote to memory of 1260	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	97
PID 3604 wrote to memory of 1260	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	97
PID 3604 wrote to memory of 1624	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	98
PID 3604 wrote to memory of 1624	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	98
PID 3604 wrote to memory of 4568	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	99
PID 3604 wrote to memory of 4568	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	99
PID 3604 wrote to memory of 3468	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	100
PID 3604 wrote to memory of 3468	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	100
PID 3604 wrote to memory of 4020	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	101
PID 3604 wrote to memory of 4020	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	101
PID 3604 wrote to memory of 4864	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	102
PID 3604 wrote to memory of 4864	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	102
PID 3604 wrote to memory of 4924	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	103
PID 3604 wrote to memory of 4924	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	103
PID 3604 wrote to memory of 696	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	104
PID 3604 wrote to memory of 696	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	104
PID 3604 wrote to memory of 2516	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	105
PID 3604 wrote to memory of 2516	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	105
PID 3604 wrote to memory of 2836	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	106
PID 3604 wrote to memory of 2836	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	106
PID 3604 wrote to memory of 1832	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	107
PID 3604 wrote to memory of 1832	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	107
PID 3604 wrote to memory of 4032	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	108
PID 3604 wrote to memory of 4032	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	108
PID 3604 wrote to memory of 1744	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	109
PID 3604 wrote to memory of 1744	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	109
PID 3604 wrote to memory of 3552	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	110
PID 3604 wrote to memory of 3552	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	110
PID 3604 wrote to memory of 804	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	111
PID 3604 wrote to memory of 804	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	111
PID 3604 wrote to memory of 1564	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	112
PID 3604 wrote to memory of 1564	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	112
PID 3604 wrote to memory of 1548	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	113
PID 3604 wrote to memory of 1548	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	113
PID 3604 wrote to memory of 1056	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	115
PID 3604 wrote to memory of 1056	3604	001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\001c507df32d87dee15a3597163c5c50_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\System\pekWgIb.exe
  C:\Windows\System\pekWgIb.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\fzwtaQT.exe
  C:\Windows\System\fzwtaQT.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\QjGotck.exe
  C:\Windows\System\QjGotck.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\cBPyfYJ.exe
  C:\Windows\System\cBPyfYJ.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\keiDgMM.exe
  C:\Windows\System\keiDgMM.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\HIAcOPF.exe
  C:\Windows\System\HIAcOPF.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\pjpoghG.exe
  C:\Windows\System\pjpoghG.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\QJDzZmU.exe
  C:\Windows\System\QJDzZmU.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\aLAzmdt.exe
  C:\Windows\System\aLAzmdt.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\mHsummt.exe
  C:\Windows\System\mHsummt.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\CiphQPK.exe
  C:\Windows\System\CiphQPK.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\fgBzCXV.exe
  C:\Windows\System\fgBzCXV.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\LJywADG.exe
  C:\Windows\System\LJywADG.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ffBbvkK.exe
  C:\Windows\System\ffBbvkK.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\sPVnpdu.exe
  C:\Windows\System\sPVnpdu.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\tCzJGPt.exe
  C:\Windows\System\tCzJGPt.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\hhKZJKy.exe
  C:\Windows\System\hhKZJKy.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\amapOCL.exe
  C:\Windows\System\amapOCL.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\rkhLAXR.exe
  C:\Windows\System\rkhLAXR.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\afcKxWm.exe
  C:\Windows\System\afcKxWm.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\aCqFunx.exe
  C:\Windows\System\aCqFunx.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\PPwwhoz.exe
  C:\Windows\System\PPwwhoz.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\gKMRCCH.exe
  C:\Windows\System\gKMRCCH.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\SfzfmKg.exe
  C:\Windows\System\SfzfmKg.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\QpNVzRr.exe
  C:\Windows\System\QpNVzRr.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\eMsJdhJ.exe
  C:\Windows\System\eMsJdhJ.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\bqlTyQD.exe
  C:\Windows\System\bqlTyQD.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\qBQghkH.exe
  C:\Windows\System\qBQghkH.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\AAwXZZw.exe
  C:\Windows\System\AAwXZZw.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\MxHEcij.exe
  C:\Windows\System\MxHEcij.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\HiWXMCZ.exe
  C:\Windows\System\HiWXMCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\koUbhoB.exe
  C:\Windows\System\koUbhoB.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\PbrdSSr.exe
  C:\Windows\System\PbrdSSr.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\GIGGRPa.exe
  C:\Windows\System\GIGGRPa.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\DxNjfUb.exe
  C:\Windows\System\DxNjfUb.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\tSjXbBh.exe
  C:\Windows\System\tSjXbBh.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\iGMxhDF.exe
  C:\Windows\System\iGMxhDF.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\FBezslH.exe
  C:\Windows\System\FBezslH.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\mUgpBWs.exe
  C:\Windows\System\mUgpBWs.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\SLmoBVt.exe
  C:\Windows\System\SLmoBVt.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\RtSlQFc.exe
  C:\Windows\System\RtSlQFc.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\CZwVHpK.exe
  C:\Windows\System\CZwVHpK.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\CXeWdOy.exe
  C:\Windows\System\CXeWdOy.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\aHWIzWw.exe
  C:\Windows\System\aHWIzWw.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\GFJAvsm.exe
  C:\Windows\System\GFJAvsm.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\WNBPdxf.exe
  C:\Windows\System\WNBPdxf.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\xuuWcqS.exe
  C:\Windows\System\xuuWcqS.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\atKlWVs.exe
  C:\Windows\System\atKlWVs.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\tXAkYeH.exe
  C:\Windows\System\tXAkYeH.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\XpAzFGE.exe
  C:\Windows\System\XpAzFGE.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\tpGUQZk.exe
  C:\Windows\System\tpGUQZk.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\zkAdEiJ.exe
  C:\Windows\System\zkAdEiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\KmhiEkF.exe
  C:\Windows\System\KmhiEkF.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\gESnpoP.exe
  C:\Windows\System\gESnpoP.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\pAIBlXX.exe
  C:\Windows\System\pAIBlXX.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\SAPKuOT.exe
  C:\Windows\System\SAPKuOT.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\AbIsWEt.exe
  C:\Windows\System\AbIsWEt.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\rFAhSWH.exe
  C:\Windows\System\rFAhSWH.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\LehFuwA.exe
  C:\Windows\System\LehFuwA.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\LhOCHLF.exe
  C:\Windows\System\LhOCHLF.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\UukUVgb.exe
  C:\Windows\System\UukUVgb.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\iGTHYoV.exe
  C:\Windows\System\iGTHYoV.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\vBmqdUC.exe
  C:\Windows\System\vBmqdUC.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\uLyCVxe.exe
  C:\Windows\System\uLyCVxe.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\HiGZESC.exe
  C:\Windows\System\HiGZESC.exe
  2⤵
  PID:4544
- C:\Windows\System\WeKajkO.exe
  C:\Windows\System\WeKajkO.exe
  2⤵
  PID:2704
- C:\Windows\System\yFfdEvF.exe
  C:\Windows\System\yFfdEvF.exe
  2⤵
  PID:876
- C:\Windows\System\JYGWIvB.exe
  C:\Windows\System\JYGWIvB.exe
  2⤵
  PID:4452
- C:\Windows\System\MqstlTX.exe
  C:\Windows\System\MqstlTX.exe
  2⤵
  PID:5136
- C:\Windows\System\iqlYCIs.exe
  C:\Windows\System\iqlYCIs.exe
  2⤵
  PID:5160
- C:\Windows\System\FMjbhXx.exe
  C:\Windows\System\FMjbhXx.exe
  2⤵
  PID:5184
- C:\Windows\System\DdGjpYF.exe
  C:\Windows\System\DdGjpYF.exe
  2⤵
  PID:5212
- C:\Windows\System\zsAKBIn.exe
  C:\Windows\System\zsAKBIn.exe
  2⤵
  PID:5244
- C:\Windows\System\MuBgtcR.exe
  C:\Windows\System\MuBgtcR.exe
  2⤵
  PID:5272
- C:\Windows\System\alVQhmj.exe
  C:\Windows\System\alVQhmj.exe
  2⤵
  PID:5296
- C:\Windows\System\bzSCZjA.exe
  C:\Windows\System\bzSCZjA.exe
  2⤵
  PID:5328
- C:\Windows\System\FbDgeYU.exe
  C:\Windows\System\FbDgeYU.exe
  2⤵
  PID:5356
- C:\Windows\System\AOvSkcs.exe
  C:\Windows\System\AOvSkcs.exe
  2⤵
  PID:5380
- C:\Windows\System\GUMEKpe.exe
  C:\Windows\System\GUMEKpe.exe
  2⤵
  PID:5412
- C:\Windows\System\seQluPd.exe
  C:\Windows\System\seQluPd.exe
  2⤵
  PID:5440
- C:\Windows\System\CvxjbyY.exe
  C:\Windows\System\CvxjbyY.exe
  2⤵
  PID:5468
- C:\Windows\System\XsLKmWx.exe
  C:\Windows\System\XsLKmWx.exe
  2⤵
  PID:5496
- C:\Windows\System\lmLChDu.exe
  C:\Windows\System\lmLChDu.exe
  2⤵
  PID:5524
- C:\Windows\System\UqOQCpU.exe
  C:\Windows\System\UqOQCpU.exe
  2⤵
  PID:5548
- C:\Windows\System\fMonORy.exe
  C:\Windows\System\fMonORy.exe
  2⤵
  PID:5580
- C:\Windows\System\NAOHXPL.exe
  C:\Windows\System\NAOHXPL.exe
  2⤵
  PID:5608
- C:\Windows\System\tZRoNsX.exe
  C:\Windows\System\tZRoNsX.exe
  2⤵
  PID:5672
- C:\Windows\System\fqyHqPU.exe
  C:\Windows\System\fqyHqPU.exe
  2⤵
  PID:5688
- C:\Windows\System\qmjhFPC.exe
  C:\Windows\System\qmjhFPC.exe
  2⤵
  PID:5704
- C:\Windows\System\bfrbtMp.exe
  C:\Windows\System\bfrbtMp.exe
  2⤵
  PID:5720
- C:\Windows\System\htWePOI.exe
  C:\Windows\System\htWePOI.exe
  2⤵
  PID:5744
- C:\Windows\System\SSHsLsT.exe
  C:\Windows\System\SSHsLsT.exe
  2⤵
  PID:5776
- C:\Windows\System\noFfXad.exe
  C:\Windows\System\noFfXad.exe
  2⤵
  PID:5804
- C:\Windows\System\RQnEACK.exe
  C:\Windows\System\RQnEACK.exe
  2⤵
  PID:5832
- C:\Windows\System\wlqkjMe.exe
  C:\Windows\System\wlqkjMe.exe
  2⤵
  PID:5856
- C:\Windows\System\QqriESX.exe
  C:\Windows\System\QqriESX.exe
  2⤵
  PID:5884
- C:\Windows\System\qZpgQzP.exe
  C:\Windows\System\qZpgQzP.exe
  2⤵
  PID:5916
- C:\Windows\System\zqFtAYk.exe
  C:\Windows\System\zqFtAYk.exe
  2⤵
  PID:5940
- C:\Windows\System\OqbNozs.exe
  C:\Windows\System\OqbNozs.exe
  2⤵
  PID:5968
- C:\Windows\System\HzXZRrT.exe
  C:\Windows\System\HzXZRrT.exe
  2⤵
  PID:6000
- C:\Windows\System\OvvXfFx.exe
  C:\Windows\System\OvvXfFx.exe
  2⤵
  PID:6028
- C:\Windows\System\UhUweFl.exe
  C:\Windows\System\UhUweFl.exe
  2⤵
  PID:6052
- C:\Windows\System\CEGTMBj.exe
  C:\Windows\System\CEGTMBj.exe
  2⤵
  PID:6080
- C:\Windows\System\KGAODvK.exe
  C:\Windows\System\KGAODvK.exe
  2⤵
  PID:6112
- C:\Windows\System\xKULTVi.exe
  C:\Windows\System\xKULTVi.exe
  2⤵
  PID:6136
- C:\Windows\System\ImmmCer.exe
  C:\Windows\System\ImmmCer.exe
  2⤵
  PID:6172
- C:\Windows\System\JTSgCzd.exe
  C:\Windows\System\JTSgCzd.exe
  2⤵
  PID:6200
- C:\Windows\System\JeuJiUP.exe
  C:\Windows\System\JeuJiUP.exe
  2⤵
  PID:6228
- C:\Windows\System\peAmofM.exe
  C:\Windows\System\peAmofM.exe
  2⤵
  PID:6256
- C:\Windows\System\ewmFCCq.exe
  C:\Windows\System\ewmFCCq.exe
  2⤵
  PID:6284
- C:\Windows\System\zJmMiZc.exe
  C:\Windows\System\zJmMiZc.exe
  2⤵
  PID:6308
- C:\Windows\System\IiSpqbV.exe
  C:\Windows\System\IiSpqbV.exe
  2⤵
  PID:6336
- C:\Windows\System\znIrYiD.exe
  C:\Windows\System\znIrYiD.exe
  2⤵
  PID:6364
- C:\Windows\System\GrgylZV.exe
  C:\Windows\System\GrgylZV.exe
  2⤵
  PID:6392
- C:\Windows\System\IaqAEFs.exe
  C:\Windows\System\IaqAEFs.exe
  2⤵
  PID:6424
- C:\Windows\System\taTEmkN.exe
  C:\Windows\System\taTEmkN.exe
  2⤵
  PID:6452
- C:\Windows\System\ztjHZkC.exe
  C:\Windows\System\ztjHZkC.exe
  2⤵
  PID:6480
- C:\Windows\System\CLJzsjw.exe
  C:\Windows\System\CLJzsjw.exe
  2⤵
  PID:6508
- C:\Windows\System\MdEXXGL.exe
  C:\Windows\System\MdEXXGL.exe
  2⤵
  PID:6532
- C:\Windows\System\MGkPZbr.exe
  C:\Windows\System\MGkPZbr.exe
  2⤵
  PID:6564
- C:\Windows\System\NVZXnfQ.exe
  C:\Windows\System\NVZXnfQ.exe
  2⤵
  PID:6592
- C:\Windows\System\DRPnGzT.exe
  C:\Windows\System\DRPnGzT.exe
  2⤵
  PID:6620
- C:\Windows\System\tSOwoEu.exe
  C:\Windows\System\tSOwoEu.exe
  2⤵
  PID:6648
- C:\Windows\System\depclcu.exe
  C:\Windows\System\depclcu.exe
  2⤵
  PID:6676
- C:\Windows\System\BBjKelz.exe
  C:\Windows\System\BBjKelz.exe
  2⤵
  PID:6704
- C:\Windows\System\ZhHKYlF.exe
  C:\Windows\System\ZhHKYlF.exe
  2⤵
  PID:6728
- C:\Windows\System\EmAIGaY.exe
  C:\Windows\System\EmAIGaY.exe
  2⤵
  PID:6756
- C:\Windows\System\KJWNxtd.exe
  C:\Windows\System\KJWNxtd.exe
  2⤵
  PID:6788
- C:\Windows\System\TWluAyk.exe
  C:\Windows\System\TWluAyk.exe
  2⤵
  PID:6816
- C:\Windows\System\JgTLsRT.exe
  C:\Windows\System\JgTLsRT.exe
  2⤵
  PID:6844
- C:\Windows\System\HdrFceE.exe
  C:\Windows\System\HdrFceE.exe
  2⤵
  PID:6872
- C:\Windows\System\DvjxwQd.exe
  C:\Windows\System\DvjxwQd.exe
  2⤵
  PID:6900
- C:\Windows\System\kNHfHHM.exe
  C:\Windows\System\kNHfHHM.exe
  2⤵
  PID:6928
- C:\Windows\System\BtwWaUw.exe
  C:\Windows\System\BtwWaUw.exe
  2⤵
  PID:6956
- C:\Windows\System\vpUwMUT.exe
  C:\Windows\System\vpUwMUT.exe
  2⤵
  PID:6980
- C:\Windows\System\BrGqirN.exe
  C:\Windows\System\BrGqirN.exe
  2⤵
  PID:7012
- C:\Windows\System\ejCLjAZ.exe
  C:\Windows\System\ejCLjAZ.exe
  2⤵
  PID:7040
- C:\Windows\System\ZAqVAHH.exe
  C:\Windows\System\ZAqVAHH.exe
  2⤵
  PID:7068
- C:\Windows\System\JeNXuhn.exe
  C:\Windows\System\JeNXuhn.exe
  2⤵
  PID:7092
- C:\Windows\System\YBhyvdo.exe
  C:\Windows\System\YBhyvdo.exe
  2⤵
  PID:7120
- C:\Windows\System\uagjILl.exe
  C:\Windows\System\uagjILl.exe
  2⤵
  PID:7152
- C:\Windows\System\qtrrprP.exe
  C:\Windows\System\qtrrprP.exe
  2⤵
  PID:6216
- C:\Windows\System\VxSniMr.exe
  C:\Windows\System\VxSniMr.exe
  2⤵
  PID:6156
- C:\Windows\System\TgMBufo.exe
  C:\Windows\System\TgMBufo.exe
  2⤵
  PID:6096
- C:\Windows\System\pamDMaL.exe
  C:\Windows\System\pamDMaL.exe
  2⤵
  PID:6016
- C:\Windows\System\MRZqoGg.exe
  C:\Windows\System\MRZqoGg.exe
  2⤵
  PID:5960
- C:\Windows\System\OKWknrS.exe
  C:\Windows\System\OKWknrS.exe
  2⤵
  PID:5900
- C:\Windows\System\XlbQiTS.exe
  C:\Windows\System\XlbQiTS.exe
  2⤵
  PID:5844
- C:\Windows\System\oNGwMnx.exe
  C:\Windows\System\oNGwMnx.exe
  2⤵
  PID:5764
- C:\Windows\System\wpWwIeX.exe
  C:\Windows\System\wpWwIeX.exe
  2⤵
  PID:5700
- C:\Windows\System\TmgBPcr.exe
  C:\Windows\System\TmgBPcr.exe
  2⤵
  PID:5652
- C:\Windows\System\zXVWHpL.exe
  C:\Windows\System\zXVWHpL.exe
  2⤵
  PID:5572
- C:\Windows\System\lrDaVoF.exe
  C:\Windows\System\lrDaVoF.exe
  2⤵
  PID:5512
- C:\Windows\System\nYhVhDa.exe
  C:\Windows\System\nYhVhDa.exe
  2⤵
  PID:5452
- C:\Windows\System\LSPGqtP.exe
  C:\Windows\System\LSPGqtP.exe
  2⤵
  PID:5376
- C:\Windows\System\UgJIsWY.exe
  C:\Windows\System\UgJIsWY.exe
  2⤵
  PID:5312
- C:\Windows\System\ayaaqwR.exe
  C:\Windows\System\ayaaqwR.exe
  2⤵
  PID:5236
- C:\Windows\System\vaGBUVm.exe
  C:\Windows\System\vaGBUVm.exe
  2⤵
  PID:5176
- C:\Windows\System\zgFOhKC.exe
  C:\Windows\System\zgFOhKC.exe
  2⤵
  PID:3224
- C:\Windows\System\AtLVMhz.exe
  C:\Windows\System\AtLVMhz.exe
  2⤵
  PID:3036
- C:\Windows\System\SwuBYDw.exe
  C:\Windows\System\SwuBYDw.exe
  2⤵
  PID:3332
- C:\Windows\System\nHpzkhA.exe
  C:\Windows\System\nHpzkhA.exe
  2⤵
  PID:3584
- C:\Windows\System\QlqXevu.exe
  C:\Windows\System\QlqXevu.exe
  2⤵
  PID:412
- C:\Windows\System\RJRkbDx.exe
  C:\Windows\System\RJRkbDx.exe
  2⤵
  PID:388
- C:\Windows\System\hQuNKvA.exe
  C:\Windows\System\hQuNKvA.exe
  2⤵
  PID:2196
- C:\Windows\System\IHEqalH.exe
  C:\Windows\System\IHEqalH.exe
  2⤵
  PID:4540
- C:\Windows\System\myGyLvK.exe
  C:\Windows\System\myGyLvK.exe
  2⤵
  PID:116
- C:\Windows\System\aYpPDSV.exe
  C:\Windows\System\aYpPDSV.exe
  2⤵
  PID:4440
- C:\Windows\System\eJdDMXA.exe
  C:\Windows\System\eJdDMXA.exe
  2⤵
  PID:1884
- C:\Windows\System\ZBrnWke.exe
  C:\Windows\System\ZBrnWke.exe
  2⤵
  PID:3304
- C:\Windows\System\MymXcYu.exe
  C:\Windows\System\MymXcYu.exe
  2⤵
  PID:2080
- C:\Windows\System\QNEkcoe.exe
  C:\Windows\System\QNEkcoe.exe
  2⤵
  PID:2848
- C:\Windows\System\oprfdZY.exe
  C:\Windows\System\oprfdZY.exe
  2⤵
  PID:4592
- C:\Windows\System\KxiceCM.exe
  C:\Windows\System\KxiceCM.exe
  2⤵
  PID:6268
- C:\Windows\System\fcELkDP.exe
  C:\Windows\System\fcELkDP.exe
  2⤵
  PID:6328
- C:\Windows\System\iNvdfed.exe
  C:\Windows\System\iNvdfed.exe
  2⤵
  PID:6408
- C:\Windows\System\PoycSpL.exe
  C:\Windows\System\PoycSpL.exe
  2⤵
  PID:6464
- C:\Windows\System\IbXMNiU.exe
  C:\Windows\System\IbXMNiU.exe
  2⤵
  PID:6548
- C:\Windows\System\uKDksJn.exe
  C:\Windows\System\uKDksJn.exe
  2⤵
  PID:6580
- C:\Windows\System\lItdEGx.exe
  C:\Windows\System\lItdEGx.exe
  2⤵
  PID:6636
- C:\Windows\System\vrJkfIa.exe
  C:\Windows\System\vrJkfIa.exe
  2⤵
  PID:6716
- C:\Windows\System\KKWpvFi.exe
  C:\Windows\System\KKWpvFi.exe
  2⤵
  PID:6776
- C:\Windows\System\BpyWhgf.exe
  C:\Windows\System\BpyWhgf.exe
  2⤵
  PID:6864
- C:\Windows\System\aiiFhZY.exe
  C:\Windows\System\aiiFhZY.exe
  2⤵
  PID:6976
- C:\Windows\System\GaZPjVM.exe
  C:\Windows\System\GaZPjVM.exe
  2⤵
  PID:7056
- C:\Windows\System\zANxXAS.exe
  C:\Windows\System\zANxXAS.exe
  2⤵
  PID:7116
- C:\Windows\System\nhnHjKb.exe
  C:\Windows\System\nhnHjKb.exe
  2⤵
  PID:6240
- C:\Windows\System\ZhmsNTa.exe
  C:\Windows\System\ZhmsNTa.exe
  2⤵
  PID:6048
- C:\Windows\System\dHKLrLi.exe
  C:\Windows\System\dHKLrLi.exe
  2⤵
  PID:4448
- C:\Windows\System\SAlGftJ.exe
  C:\Windows\System\SAlGftJ.exe
  2⤵
  PID:5796
- C:\Windows\System\PwDnxzr.exe
  C:\Windows\System\PwDnxzr.exe
  2⤵
  PID:5680
- C:\Windows\System\FGWPBei.exe
  C:\Windows\System\FGWPBei.exe
  2⤵
  PID:5064
- C:\Windows\System\jTHQqSS.exe
  C:\Windows\System\jTHQqSS.exe
  2⤵
  PID:5404
- C:\Windows\System\bJpnffr.exe
  C:\Windows\System\bJpnffr.exe
  2⤵
  PID:5340
- C:\Windows\System\PToFVld.exe
  C:\Windows\System\PToFVld.exe
  2⤵
  PID:5260
- C:\Windows\System\aAiZjEN.exe
  C:\Windows\System\aAiZjEN.exe
  2⤵
  PID:5200
- C:\Windows\System\PfKlfzE.exe
  C:\Windows\System\PfKlfzE.exe
  2⤵
  PID:2464
- C:\Windows\System\utMBgHw.exe
  C:\Windows\System\utMBgHw.exe
  2⤵
  PID:3464
- C:\Windows\System\iPzuCHC.exe
  C:\Windows\System\iPzuCHC.exe
  2⤵
  PID:4552
- C:\Windows\System\GBNlkKY.exe
  C:\Windows\System\GBNlkKY.exe
  2⤵
  PID:5088
- C:\Windows\System\ORWaYUb.exe
  C:\Windows\System\ORWaYUb.exe
  2⤵
  PID:4420
- C:\Windows\System\OxkqFLH.exe
  C:\Windows\System\OxkqFLH.exe
  2⤵
  PID:4792
- C:\Windows\System\rHVtkYF.exe
  C:\Windows\System\rHVtkYF.exe
  2⤵
  PID:3936
- C:\Windows\System\uVyYInj.exe
  C:\Windows\System\uVyYInj.exe
  2⤵
  PID:1100
- C:\Windows\System\WZRmkqg.exe
  C:\Windows\System\WZRmkqg.exe
  2⤵
  PID:2760
- C:\Windows\System\BWmlxpO.exe
  C:\Windows\System\BWmlxpO.exe
  2⤵
  PID:4784
- C:\Windows\System\pCpkdZE.exe
  C:\Windows\System\pCpkdZE.exe
  2⤵
  PID:2224
- C:\Windows\System\gZhUQAh.exe
  C:\Windows\System\gZhUQAh.exe
  2⤵
  PID:6384
- C:\Windows\System\NZZAEol.exe
  C:\Windows\System\NZZAEol.exe
  2⤵
  PID:2144
- C:\Windows\System\jITCfqu.exe
  C:\Windows\System\jITCfqu.exe
  2⤵
  PID:6688
- C:\Windows\System\heRevgg.exe
  C:\Windows\System\heRevgg.exe
  2⤵
  PID:6832
- C:\Windows\System\UyRGhYZ.exe
  C:\Windows\System\UyRGhYZ.exe
  2⤵
  PID:7052
- C:\Windows\System\ooYQbhy.exe
  C:\Windows\System\ooYQbhy.exe
  2⤵
  PID:6164
- C:\Windows\System\YntiIDP.exe
  C:\Windows\System\YntiIDP.exe
  2⤵
  PID:5872
- C:\Windows\System\WbyrZvL.exe
  C:\Windows\System\WbyrZvL.exe
  2⤵
  PID:5464
- C:\Windows\System\KjlFyzs.exe
  C:\Windows\System\KjlFyzs.exe
  2⤵
  PID:1272
- C:\Windows\System\JFudZTs.exe
  C:\Windows\System\JFudZTs.exe
  2⤵
  PID:3820
- C:\Windows\System\WlAPzXy.exe
  C:\Windows\System\WlAPzXy.exe
  2⤵
  PID:2032
- C:\Windows\System\MaEttZp.exe
  C:\Windows\System\MaEttZp.exe
  2⤵
  PID:2456
- C:\Windows\System\KXAnEvE.exe
  C:\Windows\System\KXAnEvE.exe
  2⤵
  PID:4940
- C:\Windows\System\cLPFqLm.exe
  C:\Windows\System\cLPFqLm.exe
  2⤵
  PID:1320
- C:\Windows\System\imDwWCi.exe
  C:\Windows\System\imDwWCi.exe
  2⤵
  PID:3344
- C:\Windows\System\ucySWOD.exe
  C:\Windows\System\ucySWOD.exe
  2⤵
  PID:6556
- C:\Windows\System\SYzXAMW.exe
  C:\Windows\System\SYzXAMW.exe
  2⤵
  PID:6972
- C:\Windows\System\zPUskak.exe
  C:\Windows\System\zPUskak.exe
  2⤵
  PID:5908
- C:\Windows\System\jXtllDD.exe
  C:\Windows\System\jXtllDD.exe
  2⤵
  PID:1964
- C:\Windows\System\SnFVOfK.exe
  C:\Windows\System\SnFVOfK.exe
  2⤵
  PID:4680
- C:\Windows\System\xHtxwmQ.exe
  C:\Windows\System\xHtxwmQ.exe
  2⤵
  PID:4060
- C:\Windows\System\cTpLedI.exe
  C:\Windows\System\cTpLedI.exe
  2⤵
  PID:5048
- C:\Windows\System\akiiCrp.exe
  C:\Windows\System\akiiCrp.exe
  2⤵
  PID:4372
- C:\Windows\System\bkYrtHV.exe
  C:\Windows\System\bkYrtHV.exe
  2⤵
  PID:6828
- C:\Windows\System\RtKgXRa.exe
  C:\Windows\System\RtKgXRa.exe
  2⤵
  PID:3852
- C:\Windows\System\BsoYFgW.exe
  C:\Windows\System\BsoYFgW.exe
  2⤵
  PID:4124
- C:\Windows\System\VztgveL.exe
  C:\Windows\System\VztgveL.exe
  2⤵
  PID:6440
- C:\Windows\System\uwexDGV.exe
  C:\Windows\System\uwexDGV.exe
  2⤵
  PID:4648
- C:\Windows\System\RlcBpKS.exe
  C:\Windows\System\RlcBpKS.exe
  2⤵
  PID:1400
- C:\Windows\System\RzKEnpm.exe
  C:\Windows\System\RzKEnpm.exe
  2⤵
  PID:7180
- C:\Windows\System\sJnWeNb.exe
  C:\Windows\System\sJnWeNb.exe
  2⤵
  PID:7204
- C:\Windows\System\IgcMFfq.exe
  C:\Windows\System\IgcMFfq.exe
  2⤵
  PID:7248
- C:\Windows\System\gTQcVFP.exe
  C:\Windows\System\gTQcVFP.exe
  2⤵
  PID:7276
- C:\Windows\System\PlmesSo.exe
  C:\Windows\System\PlmesSo.exe
  2⤵
  PID:7296
- C:\Windows\System\NxPqvHw.exe
  C:\Windows\System\NxPqvHw.exe
  2⤵
  PID:7332
- C:\Windows\System\XFkIinQ.exe
  C:\Windows\System\XFkIinQ.exe
  2⤵
  PID:7360
- C:\Windows\System\aGEPAlF.exe
  C:\Windows\System\aGEPAlF.exe
  2⤵
  PID:7380
- C:\Windows\System\OArMiBs.exe
  C:\Windows\System\OArMiBs.exe
  2⤵
  PID:7400
- C:\Windows\System\iSmgwpc.exe
  C:\Windows\System\iSmgwpc.exe
  2⤵
  PID:7436
- C:\Windows\System\HHHwekb.exe
  C:\Windows\System\HHHwekb.exe
  2⤵
  PID:7460
- C:\Windows\System\qOrZyIA.exe
  C:\Windows\System\qOrZyIA.exe
  2⤵
  PID:7500
- C:\Windows\System\tFeVfVj.exe
  C:\Windows\System\tFeVfVj.exe
  2⤵
  PID:7528
- C:\Windows\System\RGofOuv.exe
  C:\Windows\System\RGofOuv.exe
  2⤵
  PID:7556
- C:\Windows\System\HSgKEct.exe
  C:\Windows\System\HSgKEct.exe
  2⤵
  PID:7584
- C:\Windows\System\KIsdlKv.exe
  C:\Windows\System\KIsdlKv.exe
  2⤵
  PID:7616
- C:\Windows\System\FfFbqGy.exe
  C:\Windows\System\FfFbqGy.exe
  2⤵
  PID:7640
- C:\Windows\System\QkBbqwU.exe
  C:\Windows\System\QkBbqwU.exe
  2⤵
  PID:7676
- C:\Windows\System\PWJTfSu.exe
  C:\Windows\System\PWJTfSu.exe
  2⤵
  PID:7692
- C:\Windows\System\fCahaHR.exe
  C:\Windows\System\fCahaHR.exe
  2⤵
  PID:7720
- C:\Windows\System\RNKrIox.exe
  C:\Windows\System\RNKrIox.exe
  2⤵
  PID:7740
- C:\Windows\System\TQLzjlM.exe
  C:\Windows\System\TQLzjlM.exe
  2⤵
  PID:7764
- C:\Windows\System\OsZYrih.exe
  C:\Windows\System\OsZYrih.exe
  2⤵
  PID:7796
- C:\Windows\System\qwsLZWh.exe
  C:\Windows\System\qwsLZWh.exe
  2⤵
  PID:7820
- C:\Windows\System\hYlWzgB.exe
  C:\Windows\System\hYlWzgB.exe
  2⤵
  PID:7860
- C:\Windows\System\QtTBtkk.exe
  C:\Windows\System\QtTBtkk.exe
  2⤵
  PID:7884
- C:\Windows\System\GmgRQhx.exe
  C:\Windows\System\GmgRQhx.exe
  2⤵
  PID:7928
- C:\Windows\System\fFZIvlY.exe
  C:\Windows\System\fFZIvlY.exe
  2⤵
  PID:7964
- C:\Windows\System\vJcuMaO.exe
  C:\Windows\System\vJcuMaO.exe
  2⤵
  PID:7988
- C:\Windows\System\ZIGSOba.exe
  C:\Windows\System\ZIGSOba.exe
  2⤵
  PID:8028
- C:\Windows\System\odBSMwV.exe
  C:\Windows\System\odBSMwV.exe
  2⤵
  PID:8048
- C:\Windows\System\NtlIxzP.exe
  C:\Windows\System\NtlIxzP.exe
  2⤵
  PID:8080
- C:\Windows\System\JuCMdKp.exe
  C:\Windows\System\JuCMdKp.exe
  2⤵
  PID:8100
- C:\Windows\System\xHuxkNE.exe
  C:\Windows\System\xHuxkNE.exe
  2⤵
  PID:8136
- C:\Windows\System\rluqXxJ.exe
  C:\Windows\System\rluqXxJ.exe
  2⤵
  PID:8168
- C:\Windows\System\xUKnyhP.exe
  C:\Windows\System\xUKnyhP.exe
  2⤵
  PID:7176
- C:\Windows\System\ONusTdY.exe
  C:\Windows\System\ONusTdY.exe
  2⤵
  PID:7236
- C:\Windows\System\aiJSHDq.exe
  C:\Windows\System\aiJSHDq.exe
  2⤵
  PID:7292
- C:\Windows\System\wHAHjFY.exe
  C:\Windows\System\wHAHjFY.exe
  2⤵
  PID:7356
- C:\Windows\System\JqeVzbX.exe
  C:\Windows\System\JqeVzbX.exe
  2⤵
  PID:7388
- C:\Windows\System\OvWFiMd.exe
  C:\Windows\System\OvWFiMd.exe
  2⤵
  PID:6304
- C:\Windows\System\httCzPP.exe
  C:\Windows\System\httCzPP.exe
  2⤵
  PID:7544
- C:\Windows\System\jtNjVED.exe
  C:\Windows\System\jtNjVED.exe
  2⤵
  PID:7628
- C:\Windows\System\ECdsVmC.exe
  C:\Windows\System\ECdsVmC.exe
  2⤵
  PID:7684
- C:\Windows\System\KkCeAQo.exe
  C:\Windows\System\KkCeAQo.exe
  2⤵
  PID:7756
- C:\Windows\System\oYKNibc.exe
  C:\Windows\System\oYKNibc.exe
  2⤵
  PID:7780
- C:\Windows\System\QwRjilc.exe
  C:\Windows\System\QwRjilc.exe
  2⤵
  PID:7804
- C:\Windows\System\VeuXAXl.exe
  C:\Windows\System\VeuXAXl.exe
  2⤵
  PID:7880
- C:\Windows\System\FLonXZi.exe
  C:\Windows\System\FLonXZi.exe
  2⤵
  PID:7944
- C:\Windows\System\vCqcoCd.exe
  C:\Windows\System\vCqcoCd.exe
  2⤵
  PID:8016
- C:\Windows\System\XVBXiYY.exe
  C:\Windows\System\XVBXiYY.exe
  2⤵
  PID:8056
- C:\Windows\System\vNupmrK.exe
  C:\Windows\System\vNupmrK.exe
  2⤵
  PID:8128
- C:\Windows\System\xjNRTHB.exe
  C:\Windows\System\xjNRTHB.exe
  2⤵
  PID:8184
- C:\Windows\System\ZWJLwpP.exe
  C:\Windows\System\ZWJLwpP.exe
  2⤵
  PID:7244
- C:\Windows\System\uXUKXLB.exe
  C:\Windows\System\uXUKXLB.exe
  2⤵
  PID:7420
- C:\Windows\System\yyDvUwe.exe
  C:\Windows\System\yyDvUwe.exe
  2⤵
  PID:7908
- C:\Windows\System\ylEgHNT.exe
  C:\Windows\System\ylEgHNT.exe
  2⤵
  PID:7924
- C:\Windows\System\gjqbtbP.exe
  C:\Windows\System\gjqbtbP.exe
  2⤵
  PID:8112
- C:\Windows\System\GfMdmuI.exe
  C:\Windows\System\GfMdmuI.exe
  2⤵
  PID:7232
- C:\Windows\System\jwItZJt.exe
  C:\Windows\System\jwItZJt.exe
  2⤵
  PID:7752
- C:\Windows\System\Qgmvwft.exe
  C:\Windows\System\Qgmvwft.exe
  2⤵
  PID:8076
- C:\Windows\System\goWlaMP.exe
  C:\Windows\System\goWlaMP.exe
  2⤵
  PID:7980
- C:\Windows\System\mYfWfsK.exe
  C:\Windows\System\mYfWfsK.exe
  2⤵
  PID:8196
- C:\Windows\System\mFGUpwZ.exe
  C:\Windows\System\mFGUpwZ.exe
  2⤵
  PID:8224
- C:\Windows\System\ODxMXpq.exe
  C:\Windows\System\ODxMXpq.exe
  2⤵
  PID:8252
- C:\Windows\System\WvrZMDi.exe
  C:\Windows\System\WvrZMDi.exe
  2⤵
  PID:8272
- C:\Windows\System\uhzrgrV.exe
  C:\Windows\System\uhzrgrV.exe
  2⤵
  PID:8308
- C:\Windows\System\kEYvUlv.exe
  C:\Windows\System\kEYvUlv.exe
  2⤵
  PID:8340
- C:\Windows\System\UPkyZmw.exe
  C:\Windows\System\UPkyZmw.exe
  2⤵
  PID:8360
- C:\Windows\System\ZKLQJYP.exe
  C:\Windows\System\ZKLQJYP.exe
  2⤵
  PID:8388
- C:\Windows\System\oeBPJQX.exe
  C:\Windows\System\oeBPJQX.exe
  2⤵
  PID:8412
- C:\Windows\System\waOrYwK.exe
  C:\Windows\System\waOrYwK.exe
  2⤵
  PID:8448
- C:\Windows\System\tABJbWJ.exe
  C:\Windows\System\tABJbWJ.exe
  2⤵
  PID:8480
- C:\Windows\System\ETDxBoK.exe
  C:\Windows\System\ETDxBoK.exe
  2⤵
  PID:8508
- C:\Windows\System\ONluaXj.exe
  C:\Windows\System\ONluaXj.exe
  2⤵
  PID:8536
- C:\Windows\System\qMxCsDO.exe
  C:\Windows\System\qMxCsDO.exe
  2⤵
  PID:8560
- C:\Windows\System\NjSYRsi.exe
  C:\Windows\System\NjSYRsi.exe
  2⤵
  PID:8592
- C:\Windows\System\PafgBtq.exe
  C:\Windows\System\PafgBtq.exe
  2⤵
  PID:8620
- C:\Windows\System\vVyINyi.exe
  C:\Windows\System\vVyINyi.exe
  2⤵
  PID:8636
- C:\Windows\System\EXRIYfL.exe
  C:\Windows\System\EXRIYfL.exe
  2⤵
  PID:8672
- C:\Windows\System\Puskudl.exe
  C:\Windows\System\Puskudl.exe
  2⤵
  PID:8704
- C:\Windows\System\DFfnzZE.exe
  C:\Windows\System\DFfnzZE.exe
  2⤵
  PID:8732
- C:\Windows\System\JdZqpUF.exe
  C:\Windows\System\JdZqpUF.exe
  2⤵
  PID:8760
- C:\Windows\System\gRRbdJD.exe
  C:\Windows\System\gRRbdJD.exe
  2⤵
  PID:8796
- C:\Windows\System\wPMxQsA.exe
  C:\Windows\System\wPMxQsA.exe
  2⤵
  PID:8824
- C:\Windows\System\TytSkfU.exe
  C:\Windows\System\TytSkfU.exe
  2⤵
  PID:8864
- C:\Windows\System\gQaXCbX.exe
  C:\Windows\System\gQaXCbX.exe
  2⤵
  PID:8908
- C:\Windows\System\QyDurLK.exe
  C:\Windows\System\QyDurLK.exe
  2⤵
  PID:8944
- C:\Windows\System\GzMztOl.exe
  C:\Windows\System\GzMztOl.exe
  2⤵
  PID:8976
- C:\Windows\System\jOUgCwg.exe
  C:\Windows\System\jOUgCwg.exe
  2⤵
  PID:9004
- C:\Windows\System\TlHTVFh.exe
  C:\Windows\System\TlHTVFh.exe
  2⤵
  PID:9044
- C:\Windows\System\nrsLEWC.exe
  C:\Windows\System\nrsLEWC.exe
  2⤵
  PID:9060
- C:\Windows\System\Zhcnzjs.exe
  C:\Windows\System\Zhcnzjs.exe
  2⤵
  PID:9096
- C:\Windows\System\AyXzVoq.exe
  C:\Windows\System\AyXzVoq.exe
  2⤵
  PID:9120
- C:\Windows\System\VHyQcJr.exe
  C:\Windows\System\VHyQcJr.exe
  2⤵
  PID:9152
- C:\Windows\System\lajJppe.exe
  C:\Windows\System\lajJppe.exe
  2⤵
  PID:9188
- C:\Windows\System\zyQWjKh.exe
  C:\Windows\System\zyQWjKh.exe
  2⤵
  PID:7664
- C:\Windows\System\DQRXmIX.exe
  C:\Windows\System\DQRXmIX.exe
  2⤵
  PID:8244
- C:\Windows\System\JUalIoK.exe
  C:\Windows\System\JUalIoK.exe
  2⤵
  PID:8348
- C:\Windows\System\VPXaeYg.exe
  C:\Windows\System\VPXaeYg.exe
  2⤵
  PID:8424
- C:\Windows\System\ERlceYy.exe
  C:\Windows\System\ERlceYy.exe
  2⤵
  PID:8492
- C:\Windows\System\zinqclo.exe
  C:\Windows\System\zinqclo.exe
  2⤵
  PID:8548
- C:\Windows\System\mwzgMsG.exe
  C:\Windows\System\mwzgMsG.exe
  2⤵
  PID:8616
- C:\Windows\System\MkJCUgx.exe
  C:\Windows\System\MkJCUgx.exe
  2⤵
  PID:8688
- C:\Windows\System\wLgsjob.exe
  C:\Windows\System\wLgsjob.exe
  2⤵
  PID:8756
- C:\Windows\System\bwsISVj.exe
  C:\Windows\System\bwsISVj.exe
  2⤵
  PID:8820
- C:\Windows\System\YvXlQkL.exe
  C:\Windows\System\YvXlQkL.exe
  2⤵
  PID:8900
- C:\Windows\System\tPYCWGX.exe
  C:\Windows\System\tPYCWGX.exe
  2⤵
  PID:8988
- C:\Windows\System\RbVcaBT.exe
  C:\Windows\System\RbVcaBT.exe
  2⤵
  PID:9056
- C:\Windows\System\eNBOiYE.exe
  C:\Windows\System\eNBOiYE.exe
  2⤵
  PID:9108
- C:\Windows\System\DVmRsyq.exe
  C:\Windows\System\DVmRsyq.exe
  2⤵
  PID:9212
- C:\Windows\System\KOOBiFe.exe
  C:\Windows\System\KOOBiFe.exe
  2⤵
  PID:8304
- C:\Windows\System\pZyJRhI.exe
  C:\Windows\System\pZyJRhI.exe
  2⤵
  PID:8664
- C:\Windows\System\kzrvpUR.exe
  C:\Windows\System\kzrvpUR.exe
  2⤵
  PID:8960
- C:\Windows\System\RSWWNlJ.exe
  C:\Windows\System\RSWWNlJ.exe
  2⤵
  PID:9148
- C:\Windows\System\sZmfRco.exe
  C:\Windows\System\sZmfRco.exe
  2⤵
  PID:1180
- C:\Windows\System\sYYXurJ.exe
  C:\Windows\System\sYYXurJ.exe
  2⤵
  PID:8288
- C:\Windows\System\KLJcvoq.exe
  C:\Windows\System\KLJcvoq.exe
  2⤵
  PID:9220
- C:\Windows\System\KnozEYa.exe
  C:\Windows\System\KnozEYa.exe
  2⤵
  PID:9252
- C:\Windows\System\kSATXUc.exe
  C:\Windows\System\kSATXUc.exe
  2⤵
  PID:9292
- C:\Windows\System\iBLNlFo.exe
  C:\Windows\System\iBLNlFo.exe
  2⤵
  PID:9320
- C:\Windows\System\DyQGzGZ.exe
  C:\Windows\System\DyQGzGZ.exe
  2⤵
  PID:9348
- C:\Windows\System\yveNLEb.exe
  C:\Windows\System\yveNLEb.exe
  2⤵
  PID:9368
- C:\Windows\System\JKuVQGT.exe
  C:\Windows\System\JKuVQGT.exe
  2⤵
  PID:9404
- C:\Windows\System\pYBjvlj.exe
  C:\Windows\System\pYBjvlj.exe
  2⤵
  PID:9448
- C:\Windows\System\OrwZdsQ.exe
  C:\Windows\System\OrwZdsQ.exe
  2⤵
  PID:9488
- C:\Windows\System\OiTjoXh.exe
  C:\Windows\System\OiTjoXh.exe
  2⤵
  PID:9504
- C:\Windows\System\peDkwQd.exe
  C:\Windows\System\peDkwQd.exe
  2⤵
  PID:9548
- C:\Windows\System\mKZIfiJ.exe
  C:\Windows\System\mKZIfiJ.exe
  2⤵
  PID:9584
- C:\Windows\System\GBYhmnl.exe
  C:\Windows\System\GBYhmnl.exe
  2⤵
  PID:9616
- C:\Windows\System\xmEALQE.exe
  C:\Windows\System\xmEALQE.exe
  2⤵
  PID:9644
- C:\Windows\System\bAtFAVM.exe
  C:\Windows\System\bAtFAVM.exe
  2⤵
  PID:9676
- C:\Windows\System\zSIbJFN.exe
  C:\Windows\System\zSIbJFN.exe
  2⤵
  PID:9700
- C:\Windows\System\ACXdtSA.exe
  C:\Windows\System\ACXdtSA.exe
  2⤵
  PID:9744
- C:\Windows\System\PeyyBPB.exe
  C:\Windows\System\PeyyBPB.exe
  2⤵
  PID:9772
- C:\Windows\System\URulnBC.exe
  C:\Windows\System\URulnBC.exe
  2⤵
  PID:9788
- C:\Windows\System\yOPIoMT.exe
  C:\Windows\System\yOPIoMT.exe
  2⤵
  PID:9808
- C:\Windows\System\zEbDFiR.exe
  C:\Windows\System\zEbDFiR.exe
  2⤵
  PID:9848
- C:\Windows\System\mTqjZAf.exe
  C:\Windows\System\mTqjZAf.exe
  2⤵
  PID:9888
- C:\Windows\System\BELmDrq.exe
  C:\Windows\System\BELmDrq.exe
  2⤵
  PID:9920
- C:\Windows\System\uHUFHWG.exe
  C:\Windows\System\uHUFHWG.exe
  2⤵
  PID:9960
- C:\Windows\System\wBZNGBb.exe
  C:\Windows\System\wBZNGBb.exe
  2⤵
  PID:10000
- C:\Windows\System\yYLiXSh.exe
  C:\Windows\System\yYLiXSh.exe
  2⤵
  PID:10052
- C:\Windows\System\bjoJWaE.exe
  C:\Windows\System\bjoJWaE.exe
  2⤵
  PID:10084
- C:\Windows\System\pAQjThK.exe
  C:\Windows\System\pAQjThK.exe
  2⤵
  PID:10108
- C:\Windows\System\PizgkFw.exe
  C:\Windows\System\PizgkFw.exe
  2⤵
  PID:10140
- C:\Windows\System\fsAapQI.exe
  C:\Windows\System\fsAapQI.exe
  2⤵
  PID:10160
- C:\Windows\System\cuSokcW.exe
  C:\Windows\System\cuSokcW.exe
  2⤵
  PID:10204
- C:\Windows\System\kCgggsG.exe
  C:\Windows\System\kCgggsG.exe
  2⤵
  PID:10228
- C:\Windows\System\uuzNKLR.exe
  C:\Windows\System\uuzNKLR.exe
  2⤵
  PID:9276
- C:\Windows\System\hXkyiIy.exe
  C:\Windows\System\hXkyiIy.exe
  2⤵
  PID:9304
- C:\Windows\System\ywZPPvG.exe
  C:\Windows\System\ywZPPvG.exe
  2⤵
  PID:9416
- C:\Windows\System\elAUrMP.exe
  C:\Windows\System\elAUrMP.exe
  2⤵
  PID:9496
- C:\Windows\System\zjEESGJ.exe
  C:\Windows\System\zjEESGJ.exe
  2⤵
  PID:9608
- C:\Windows\System\hwgdAQk.exe
  C:\Windows\System\hwgdAQk.exe
  2⤵
  PID:9668
- C:\Windows\System\pdQVlLb.exe
  C:\Windows\System\pdQVlLb.exe
  2⤵
  PID:9764
- C:\Windows\System\cyrvtCT.exe
  C:\Windows\System\cyrvtCT.exe
  2⤵
  PID:9828
- C:\Windows\System\lipTFet.exe
  C:\Windows\System\lipTFet.exe
  2⤵
  PID:9856
- C:\Windows\System\wDyJeLA.exe
  C:\Windows\System\wDyJeLA.exe
  2⤵
  PID:9936
- C:\Windows\System\frSwDeq.exe
  C:\Windows\System\frSwDeq.exe
  2⤵
  PID:9992
- C:\Windows\System\JgpsWji.exe
  C:\Windows\System\JgpsWji.exe
  2⤵
  PID:10132
- C:\Windows\System\dvpbEJG.exe
  C:\Windows\System\dvpbEJG.exe
  2⤵
  PID:10192
- C:\Windows\System\tvcLtRf.exe
  C:\Windows\System\tvcLtRf.exe
  2⤵
  PID:9288
- C:\Windows\System\jPoAjaf.exe
  C:\Windows\System\jPoAjaf.exe
  2⤵
  PID:9384
- C:\Windows\System\DKiTzmd.exe
  C:\Windows\System\DKiTzmd.exe
  2⤵
  PID:9568
- C:\Windows\System\Qtttbso.exe
  C:\Windows\System\Qtttbso.exe
  2⤵
  PID:9796
- C:\Windows\System\DDPJPKe.exe
  C:\Windows\System\DDPJPKe.exe
  2⤵
  PID:9996
- C:\Windows\System\UqqYEJc.exe
  C:\Windows\System\UqqYEJc.exe
  2⤵
  PID:10172
- C:\Windows\System\pfLcFMC.exe
  C:\Windows\System\pfLcFMC.exe
  2⤵
  PID:9312
- C:\Windows\System\agAbjiD.exe
  C:\Windows\System\agAbjiD.exe
  2⤵
  PID:9524
- C:\Windows\System\SKTEXPX.exe
  C:\Windows\System\SKTEXPX.exe
  2⤵
  PID:9716
- C:\Windows\System\Onkskma.exe
  C:\Windows\System\Onkskma.exe
  2⤵
  PID:9688
- C:\Windows\System\MbCzLYj.exe
  C:\Windows\System\MbCzLYj.exe
  2⤵
  PID:10300
- C:\Windows\System\GpcXEOO.exe
  C:\Windows\System\GpcXEOO.exe
  2⤵
  PID:10320
- C:\Windows\System\atYbbkW.exe
  C:\Windows\System\atYbbkW.exe
  2⤵
  PID:10376
- C:\Windows\System\kLUwsGH.exe
  C:\Windows\System\kLUwsGH.exe
  2⤵
  PID:10404
- C:\Windows\System\UizbZFo.exe
  C:\Windows\System\UizbZFo.exe
  2⤵
  PID:10440
- C:\Windows\System\rYWORBR.exe
  C:\Windows\System\rYWORBR.exe
  2⤵
  PID:10456
- C:\Windows\System\EPdjfBi.exe
  C:\Windows\System\EPdjfBi.exe
  2⤵
  PID:10488
- C:\Windows\System\TojoSFh.exe
  C:\Windows\System\TojoSFh.exe
  2⤵
  PID:10524
- C:\Windows\System\hRxnPmy.exe
  C:\Windows\System\hRxnPmy.exe
  2⤵
  PID:10540
- C:\Windows\System\LTRVYwy.exe
  C:\Windows\System\LTRVYwy.exe
  2⤵
  PID:10580
- C:\Windows\System\Nkzcfix.exe
  C:\Windows\System\Nkzcfix.exe
  2⤵
  PID:10608
- C:\Windows\System\zOiRpjv.exe
  C:\Windows\System\zOiRpjv.exe
  2⤵
  PID:10636
- C:\Windows\System\CkitcBz.exe
  C:\Windows\System\CkitcBz.exe
  2⤵
  PID:10664
- C:\Windows\System\seYTlEv.exe
  C:\Windows\System\seYTlEv.exe
  2⤵
  PID:10688
- C:\Windows\System\aXSLWlz.exe
  C:\Windows\System\aXSLWlz.exe
  2⤵
  PID:10708
- C:\Windows\System\hnApILK.exe
  C:\Windows\System\hnApILK.exe
  2⤵
  PID:10748
- C:\Windows\System\bNKClOa.exe
  C:\Windows\System\bNKClOa.exe
  2⤵
  PID:10788
- C:\Windows\System\jRCsVUY.exe
  C:\Windows\System\jRCsVUY.exe
  2⤵
  PID:10804
- C:\Windows\System\CwckSrX.exe
  C:\Windows\System\CwckSrX.exe
  2⤵
  PID:10824
- C:\Windows\System\VwRGuKB.exe
  C:\Windows\System\VwRGuKB.exe
  2⤵
  PID:10856
- C:\Windows\System\ZgZrRPp.exe
  C:\Windows\System\ZgZrRPp.exe
  2⤵
  PID:10888
- C:\Windows\System\DfULTWY.exe
  C:\Windows\System\DfULTWY.exe
  2⤵
  PID:10920
- C:\Windows\System\hAmGdxD.exe
  C:\Windows\System\hAmGdxD.exe
  2⤵
  PID:10948
- C:\Windows\System\aqjnqXJ.exe
  C:\Windows\System\aqjnqXJ.exe
  2⤵
  PID:10976
- C:\Windows\System\PRvuYCa.exe
  C:\Windows\System\PRvuYCa.exe
  2⤵
  PID:10992
- C:\Windows\System\rNASOtU.exe
  C:\Windows\System\rNASOtU.exe
  2⤵
  PID:11032
- C:\Windows\System\eIYgiKk.exe
  C:\Windows\System\eIYgiKk.exe
  2⤵
  PID:11060
- C:\Windows\System\cSIEhgz.exe
  C:\Windows\System\cSIEhgz.exe
  2⤵
  PID:11088
- C:\Windows\System\DKCcXTb.exe
  C:\Windows\System\DKCcXTb.exe
  2⤵
  PID:11116
- C:\Windows\System\uCdQcHH.exe
  C:\Windows\System\uCdQcHH.exe
  2⤵
  PID:11148
- C:\Windows\System\fCBVDgE.exe
  C:\Windows\System\fCBVDgE.exe
  2⤵
  PID:11176
- C:\Windows\System\nnBecvk.exe
  C:\Windows\System\nnBecvk.exe
  2⤵
  PID:11204
- C:\Windows\System\UngfUWd.exe
  C:\Windows\System\UngfUWd.exe
  2⤵
  PID:11224
- C:\Windows\System\QDkqoVe.exe
  C:\Windows\System\QDkqoVe.exe
  2⤵
  PID:11260
- C:\Windows\System\vxNYXRV.exe
  C:\Windows\System\vxNYXRV.exe
  2⤵
  PID:10268
- C:\Windows\System\PwljTgR.exe
  C:\Windows\System\PwljTgR.exe
  2⤵
  PID:10356
- C:\Windows\System\OYYjZGV.exe
  C:\Windows\System\OYYjZGV.exe
  2⤵
  PID:10432
- C:\Windows\System\QHhWnDB.exe
  C:\Windows\System\QHhWnDB.exe
  2⤵
  PID:10496
- C:\Windows\System\XYovNXP.exe
  C:\Windows\System\XYovNXP.exe
  2⤵
  PID:10564
- C:\Windows\System\PCCxFXg.exe
  C:\Windows\System\PCCxFXg.exe
  2⤵
  PID:10604
- C:\Windows\System\xRiMLFt.exe
  C:\Windows\System\xRiMLFt.exe
  2⤵
  PID:10672
- C:\Windows\System\QBtANPx.exe
  C:\Windows\System\QBtANPx.exe
  2⤵
  PID:10736
- C:\Windows\System\acJoAek.exe
  C:\Windows\System\acJoAek.exe
  2⤵
  PID:10800
- C:\Windows\System\qGoybFn.exe
  C:\Windows\System\qGoybFn.exe
  2⤵
  PID:10852
- C:\Windows\System\OlTwHbT.exe
  C:\Windows\System\OlTwHbT.exe
  2⤵
  PID:10936
- C:\Windows\System\MRVdQjh.exe
  C:\Windows\System\MRVdQjh.exe
  2⤵
  PID:10988
- C:\Windows\System\xtUWnKH.exe
  C:\Windows\System\xtUWnKH.exe
  2⤵
  PID:11044
- C:\Windows\System\vMYWQsR.exe
  C:\Windows\System\vMYWQsR.exe
  2⤵
  PID:11108
- C:\Windows\System\pLDQPUp.exe
  C:\Windows\System\pLDQPUp.exe
  2⤵
  PID:11172
- C:\Windows\System\mGPyGAC.exe
  C:\Windows\System\mGPyGAC.exe
  2⤵
  PID:11252
- C:\Windows\System\bVrRZNq.exe
  C:\Windows\System\bVrRZNq.exe
  2⤵
  PID:10388
- C:\Windows\System\BdEhRai.exe
  C:\Windows\System\BdEhRai.exe
  2⤵
  PID:9364
- C:\Windows\System\pBvaPdq.exe
  C:\Windows\System\pBvaPdq.exe
  2⤵
  PID:10656
- C:\Windows\System\teMwQpe.exe
  C:\Windows\System\teMwQpe.exe
  2⤵
  PID:10816
- C:\Windows\System\agwWYZc.exe
  C:\Windows\System\agwWYZc.exe
  2⤵
  PID:10968
- C:\Windows\System\BzdWFiw.exe
  C:\Windows\System\BzdWFiw.exe
  2⤵
  PID:11128
- C:\Windows\System\PICmoKQ.exe
  C:\Windows\System\PICmoKQ.exe
  2⤵
  PID:10292
- C:\Windows\System\AzfPirr.exe
  C:\Windows\System\AzfPirr.exe
  2⤵
  PID:10596
- C:\Windows\System\QdSBfet.exe
  C:\Windows\System\QdSBfet.exe
  2⤵
  PID:10880
- C:\Windows\System\lBFAwkX.exe
  C:\Windows\System\lBFAwkX.exe
  2⤵
  PID:11212
- C:\Windows\System\SFZTopn.exe
  C:\Windows\System\SFZTopn.exe
  2⤵
  PID:11272
- C:\Windows\System\XUbMYKI.exe
  C:\Windows\System\XUbMYKI.exe
  2⤵
  PID:11304
- C:\Windows\System\CtMxpgU.exe
  C:\Windows\System\CtMxpgU.exe
  2⤵
  PID:11328
- C:\Windows\System\SxQmHXb.exe
  C:\Windows\System\SxQmHXb.exe
  2⤵
  PID:11368
- C:\Windows\System\hERJcpC.exe
  C:\Windows\System\hERJcpC.exe
  2⤵
  PID:11396
- C:\Windows\System\qoHHixf.exe
  C:\Windows\System\qoHHixf.exe
  2⤵
  PID:11432
- C:\Windows\System\TXylHiE.exe
  C:\Windows\System\TXylHiE.exe
  2⤵
  PID:11464
- C:\Windows\System\mMMBYtY.exe
  C:\Windows\System\mMMBYtY.exe
  2⤵
  PID:11492
- C:\Windows\System\umVMJae.exe
  C:\Windows\System\umVMJae.exe
  2⤵
  PID:11508
- C:\Windows\System\rucUVpK.exe
  C:\Windows\System\rucUVpK.exe
  2⤵
  PID:11540
- C:\Windows\System\kiTmcQn.exe
  C:\Windows\System\kiTmcQn.exe
  2⤵
  PID:11568
- C:\Windows\System\axHMjKw.exe
  C:\Windows\System\axHMjKw.exe
  2⤵
  PID:11604
- C:\Windows\System\mXEYznb.exe
  C:\Windows\System\mXEYznb.exe
  2⤵
  PID:11632
- C:\Windows\System\PtBmysp.exe
  C:\Windows\System\PtBmysp.exe
  2⤵
  PID:11648
- C:\Windows\System\DFecnRx.exe
  C:\Windows\System\DFecnRx.exe
  2⤵
  PID:11680
- C:\Windows\System\rLrRihW.exe
  C:\Windows\System\rLrRihW.exe
  2⤵
  PID:11716
- C:\Windows\System\lKeBRqI.exe
  C:\Windows\System\lKeBRqI.exe
  2⤵
  PID:11744
- C:\Windows\System\eGqRpUC.exe
  C:\Windows\System\eGqRpUC.exe
  2⤵
  PID:11772
- C:\Windows\System\sXxKsLS.exe
  C:\Windows\System\sXxKsLS.exe
  2⤵
  PID:11788
- C:\Windows\System\UCGQlho.exe
  C:\Windows\System\UCGQlho.exe
  2⤵
  PID:11828
- C:\Windows\System\qnudKRt.exe
  C:\Windows\System\qnudKRt.exe
  2⤵
  PID:11844
- C:\Windows\System\vFgsbkS.exe
  C:\Windows\System\vFgsbkS.exe
  2⤵
  PID:11884
- C:\Windows\System\EsIMBXu.exe
  C:\Windows\System\EsIMBXu.exe
  2⤵
  PID:11912
- C:\Windows\System\iCmJwDF.exe
  C:\Windows\System\iCmJwDF.exe
  2⤵
  PID:11940
- C:\Windows\System\LcAHIZI.exe
  C:\Windows\System\LcAHIZI.exe
  2⤵
  PID:11968
- C:\Windows\System\tGyjnDn.exe
  C:\Windows\System\tGyjnDn.exe
  2⤵
  PID:11996
- C:\Windows\System\mWrWSAy.exe
  C:\Windows\System\mWrWSAy.exe
  2⤵
  PID:12024
- C:\Windows\System\fvYNEsD.exe
  C:\Windows\System\fvYNEsD.exe
  2⤵
  PID:12052
- C:\Windows\System\clDbOKb.exe
  C:\Windows\System\clDbOKb.exe
  2⤵
  PID:12080
- C:\Windows\System\sWsmEMl.exe
  C:\Windows\System\sWsmEMl.exe
  2⤵
  PID:12104
- C:\Windows\System\kxRrYGp.exe
  C:\Windows\System\kxRrYGp.exe
  2⤵
  PID:12132
- C:\Windows\System\hbpFWTc.exe
  C:\Windows\System\hbpFWTc.exe
  2⤵
  PID:12164
- C:\Windows\System\GuIeqOO.exe
  C:\Windows\System\GuIeqOO.exe
  2⤵
  PID:12192
- C:\Windows\System\jFZRShG.exe
  C:\Windows\System\jFZRShG.exe
  2⤵
  PID:12220
- C:\Windows\System\hKSNUPM.exe
  C:\Windows\System\hKSNUPM.exe
  2⤵
  PID:12248
- C:\Windows\System\NVPZVkg.exe
  C:\Windows\System\NVPZVkg.exe
  2⤵
  PID:12276
- C:\Windows\System\LIacQRh.exe
  C:\Windows\System\LIacQRh.exe
  2⤵
  PID:11288
- C:\Windows\System\fzoiOaM.exe
  C:\Windows\System\fzoiOaM.exe
  2⤵
  PID:11348
- C:\Windows\System\gYHdTic.exe
  C:\Windows\System\gYHdTic.exe
  2⤵
  PID:11456
- C:\Windows\System\ZFxGDZW.exe
  C:\Windows\System\ZFxGDZW.exe
  2⤵
  PID:11500
- C:\Windows\System\BnzWwjq.exe
  C:\Windows\System\BnzWwjq.exe
  2⤵
  PID:11588
- C:\Windows\System\DumDiYR.exe
  C:\Windows\System\DumDiYR.exe
  2⤵
  PID:11628
- C:\Windows\System\rhOiEJi.exe
  C:\Windows\System\rhOiEJi.exe
  2⤵
  PID:11704
- C:\Windows\System\NIaSzTo.exe
  C:\Windows\System\NIaSzTo.exe
  2⤵
  PID:11808
- C:\Windows\System\XaWONqk.exe
  C:\Windows\System\XaWONqk.exe
  2⤵
  PID:11864
- C:\Windows\System\yrUzafL.exe
  C:\Windows\System\yrUzafL.exe
  2⤵
  PID:11904
- C:\Windows\System\lPfaGJc.exe
  C:\Windows\System\lPfaGJc.exe
  2⤵
  PID:11960
- C:\Windows\System\bJGOieI.exe
  C:\Windows\System\bJGOieI.exe
  2⤵
  PID:12048
- C:\Windows\System\AAXEMbF.exe
  C:\Windows\System\AAXEMbF.exe
  2⤵
  PID:12096
- C:\Windows\System\KcYMynW.exe
  C:\Windows\System\KcYMynW.exe
  2⤵
  PID:12160
- C:\Windows\System\dCdUxKr.exe
  C:\Windows\System\dCdUxKr.exe
  2⤵
  PID:12236
- C:\Windows\System\AzwnULi.exe
  C:\Windows\System\AzwnULi.exe
  2⤵
  PID:11048
- C:\Windows\System\WNKaUgo.exe
  C:\Windows\System\WNKaUgo.exe
  2⤵
  PID:11416
- C:\Windows\System\mPxRsrA.exe
  C:\Windows\System\mPxRsrA.exe
  2⤵
  PID:11616
- C:\Windows\System\sHoxZPb.exe
  C:\Windows\System\sHoxZPb.exe
  2⤵
  PID:11760
- C:\Windows\System\lHMPaBu.exe
  C:\Windows\System\lHMPaBu.exe
  2⤵
  PID:11880
- C:\Windows\System\BsdTIrX.exe
  C:\Windows\System\BsdTIrX.exe
  2⤵
  PID:12044
- C:\Windows\System\ZFJyMUZ.exe
  C:\Windows\System\ZFJyMUZ.exe
  2⤵
  PID:12188
- C:\Windows\System\zIKqnHF.exe
  C:\Windows\System\zIKqnHF.exe
  2⤵
  PID:12272
- C:\Windows\System\jVDLYeQ.exe
  C:\Windows\System\jVDLYeQ.exe
  2⤵
  PID:11700
- C:\Windows\System\sGTsgVT.exe
  C:\Windows\System\sGTsgVT.exe
  2⤵
  PID:11928
- C:\Windows\System\rcKGPmj.exe
  C:\Windows\System\rcKGPmj.exe
  2⤵
  PID:12092
- C:\Windows\System\DxitQCN.exe
  C:\Windows\System\DxitQCN.exe
  2⤵
  PID:11820
- C:\Windows\System\fQnSzRK.exe
  C:\Windows\System\fQnSzRK.exe
  2⤵
  PID:12304
- C:\Windows\System\phgKxTX.exe
  C:\Windows\System\phgKxTX.exe
  2⤵
  PID:12320
- C:\Windows\System\gxwDwoQ.exe
  C:\Windows\System\gxwDwoQ.exe
  2⤵
  PID:12352
- C:\Windows\System\HBkQaEA.exe
  C:\Windows\System\HBkQaEA.exe
  2⤵
  PID:12392
- C:\Windows\System\grkfHYr.exe
  C:\Windows\System\grkfHYr.exe
  2⤵
  PID:12436
- C:\Windows\System\vBCEbyi.exe
  C:\Windows\System\vBCEbyi.exe
  2⤵
  PID:12464
- C:\Windows\System\MeSPlAx.exe
  C:\Windows\System\MeSPlAx.exe
  2⤵
  PID:12492
- C:\Windows\System\YgIOURc.exe
  C:\Windows\System\YgIOURc.exe
  2⤵
  PID:12520
- C:\Windows\System\ahvLIsd.exe
  C:\Windows\System\ahvLIsd.exe
  2⤵
  PID:12544
- C:\Windows\System\UETFzTi.exe
  C:\Windows\System\UETFzTi.exe
  2⤵
  PID:12564
- C:\Windows\System\klDLXIu.exe
  C:\Windows\System\klDLXIu.exe
  2⤵
  PID:12592
- C:\Windows\System\xRyyNpN.exe
  C:\Windows\System\xRyyNpN.exe
  2⤵
  PID:12620
- C:\Windows\System\IEHltVg.exe
  C:\Windows\System\IEHltVg.exe
  2⤵
  PID:12648
- C:\Windows\System\xNhnfzY.exe
  C:\Windows\System\xNhnfzY.exe
  2⤵
  PID:12676
- C:\Windows\System\dqauxZO.exe
  C:\Windows\System\dqauxZO.exe
  2⤵
  PID:12704
- C:\Windows\System\kkOwcIh.exe
  C:\Windows\System\kkOwcIh.exe
  2⤵
  PID:12732
- C:\Windows\System\xxKOfNR.exe
  C:\Windows\System\xxKOfNR.exe
  2⤵
  PID:12752
- C:\Windows\System\vixdiQn.exe
  C:\Windows\System\vixdiQn.exe
  2⤵
  PID:12788
- C:\Windows\System\tXfNQjQ.exe
  C:\Windows\System\tXfNQjQ.exe
  2⤵
  PID:12828
- C:\Windows\System\bhhjWhm.exe
  C:\Windows\System\bhhjWhm.exe
  2⤵
  PID:12844
- C:\Windows\System\zwkHwEQ.exe
  C:\Windows\System\zwkHwEQ.exe
  2⤵
  PID:12872
- C:\Windows\System\ylQnnro.exe
  C:\Windows\System\ylQnnro.exe
  2⤵
  PID:12912
- C:\Windows\System\vAOSGZm.exe
  C:\Windows\System\vAOSGZm.exe
  2⤵
  PID:12936
- C:\Windows\System\tihsuoI.exe
  C:\Windows\System\tihsuoI.exe
  2⤵
  PID:12956
- C:\Windows\System\RZpywLN.exe
  C:\Windows\System\RZpywLN.exe
  2⤵
  PID:12988
- C:\Windows\System\cHYaAMw.exe
  C:\Windows\System\cHYaAMw.exe
  2⤵
  PID:13008
- C:\Windows\System\RqShqXP.exe
  C:\Windows\System\RqShqXP.exe
  2⤵
  PID:13056
- C:\Windows\System\JiKPnCi.exe
  C:\Windows\System\JiKPnCi.exe
  2⤵
  PID:13084
- C:\Windows\System\MuNGUjv.exe
  C:\Windows\System\MuNGUjv.exe
  2⤵
  PID:13100
- C:\Windows\System\auONkgg.exe
  C:\Windows\System\auONkgg.exe
  2⤵
  PID:13140
- C:\Windows\System\tBoSvkg.exe
  C:\Windows\System\tBoSvkg.exe
  2⤵
  PID:13168
- C:\Windows\System\xBHsUOF.exe
  C:\Windows\System\xBHsUOF.exe
  2⤵
  PID:13196
- C:\Windows\System\wJzjOnd.exe
  C:\Windows\System\wJzjOnd.exe
  2⤵
  PID:13224
- C:\Windows\System\ZYDNPiL.exe
  C:\Windows\System\ZYDNPiL.exe
  2⤵
  PID:13240
- C:\Windows\System\xAbZkXU.exe
  C:\Windows\System\xAbZkXU.exe
  2⤵
  PID:13268
- C:\Windows\System\cDRmxgh.exe
  C:\Windows\System\cDRmxgh.exe
  2⤵
  PID:13296
- C:\Windows\System\ZuFMwOb.exe
  C:\Windows\System\ZuFMwOb.exe
  2⤵
  PID:12300
- C:\Windows\System\sFqGzfB.exe
  C:\Windows\System\sFqGzfB.exe
  2⤵
  PID:12348
- C:\Windows\System\RZjqbLn.exe
  C:\Windows\System\RZjqbLn.exe
  2⤵
  PID:12432
- C:\Windows\System\QKguhbO.exe
  C:\Windows\System\QKguhbO.exe
  2⤵
  PID:12560
- C:\Windows\System\zoqcHdv.exe
  C:\Windows\System\zoqcHdv.exe
  2⤵
  PID:12612
- C:\Windows\System\QBnBwkN.exe
  C:\Windows\System\QBnBwkN.exe
  2⤵
  PID:12668
- C:\Windows\System\WZgQsYB.exe
  C:\Windows\System\WZgQsYB.exe
  2⤵
  PID:12776
- C:\Windows\System\lSjvSSO.exe
  C:\Windows\System\lSjvSSO.exe
  2⤵
  PID:12816
- C:\Windows\System\nZquSgm.exe
  C:\Windows\System\nZquSgm.exe
  2⤵
  PID:12904
- C:\Windows\System\aOwueFb.exe
  C:\Windows\System\aOwueFb.exe
  2⤵
  PID:13020
- C:\Windows\System\inetXoP.exe
  C:\Windows\System\inetXoP.exe
  2⤵
  PID:13092
- C:\Windows\System\wOsEGpm.exe
  C:\Windows\System\wOsEGpm.exe
  2⤵
  PID:13136
- C:\Windows\System\pBesImB.exe
  C:\Windows\System\pBesImB.exe
  2⤵
  PID:13232
- C:\Windows\System\eWOnCjh.exe
  C:\Windows\System\eWOnCjh.exe
  2⤵
  PID:11392
- C:\Windows\System\pTKpfVG.exe
  C:\Windows\System\pTKpfVG.exe
  2⤵
  PID:12616
- C:\Windows\System\rgFwjFL.exe
  C:\Windows\System\rgFwjFL.exe
  2⤵
  PID:12692
- C:\Windows\System\oEJcxZx.exe
  C:\Windows\System\oEJcxZx.exe
  2⤵
  PID:12968
- C:\Windows\System\tMvHLIH.exe
  C:\Windows\System\tMvHLIH.exe
  2⤵
  PID:12516
- C:\Windows\System\VMcgkjp.exe
  C:\Windows\System\VMcgkjp.exe
  2⤵
  PID:12540
- C:\Windows\System\JyZxaXp.exe
  C:\Windows\System\JyZxaXp.exe
  2⤵
  PID:13260
- C:\Windows\System\aLifqmK.exe
  C:\Windows\System\aLifqmK.exe
  2⤵
  PID:12664
- C:\Windows\System\EvHDbaT.exe
  C:\Windows\System\EvHDbaT.exe
  2⤵
  PID:13332
- C:\Windows\System\vBsrLNE.exe
  C:\Windows\System\vBsrLNE.exe
  2⤵
  PID:13356
- C:\Windows\System\WWmlNAD.exe
  C:\Windows\System\WWmlNAD.exe
  2⤵
  PID:13376
- C:\Windows\System\bmQsovx.exe
  C:\Windows\System\bmQsovx.exe
  2⤵
  PID:13416
- C:\Windows\System\rRjDqHi.exe
  C:\Windows\System\rRjDqHi.exe
  2⤵
  PID:13440
- C:\Windows\System\FDQEVjN.exe
  C:\Windows\System\FDQEVjN.exe
  2⤵
  PID:13488
- C:\Windows\System\iwVgOis.exe
  C:\Windows\System\iwVgOis.exe
  2⤵
  PID:13504
- C:\Windows\System\OgmNYdd.exe
  C:\Windows\System\OgmNYdd.exe
  2⤵
  PID:13528
- C:\Windows\System\rFesGNl.exe
  C:\Windows\System\rFesGNl.exe
  2⤵
  PID:13552
- C:\Windows\System\TWPDWFJ.exe
  C:\Windows\System\TWPDWFJ.exe
  2⤵
  PID:13568
- C:\Windows\System\FiCsJjN.exe
  C:\Windows\System\FiCsJjN.exe
  2⤵
  PID:13604
- C:\Windows\System\eqZUQOM.exe
  C:\Windows\System\eqZUQOM.exe
  2⤵
  PID:13636
- C:\Windows\System\GimdOkG.exe
  C:\Windows\System\GimdOkG.exe
  2⤵
  PID:13668
- C:\Windows\System\COhXiPO.exe
  C:\Windows\System\COhXiPO.exe
  2⤵
  PID:13700
- C:\Windows\System\fkFbjIW.exe
  C:\Windows\System\fkFbjIW.exe
  2⤵
  PID:13716
- C:\Windows\System\jULATsC.exe
  C:\Windows\System\jULATsC.exe
  2⤵
  PID:13752
- C:\Windows\System\UZxaKqE.exe
  C:\Windows\System\UZxaKqE.exe
  2⤵
  PID:13812
- C:\Windows\System\eQJXVpz.exe
  C:\Windows\System\eQJXVpz.exe
  2⤵
  PID:13840
- C:\Windows\System\PkEPAMC.exe
  C:\Windows\System\PkEPAMC.exe
  2⤵
  PID:13856
- C:\Windows\System\BHstVIn.exe
  C:\Windows\System\BHstVIn.exe
  2⤵
  PID:13872
- C:\Windows\System\VcAQKha.exe
  C:\Windows\System\VcAQKha.exe
  2⤵
  PID:13900
- C:\Windows\System\numidyt.exe
  C:\Windows\System\numidyt.exe
  2⤵
  PID:13932
- C:\Windows\System\RNSvbka.exe
  C:\Windows\System\RNSvbka.exe
  2⤵
  PID:13972
- C:\Windows\System\zTbgSIE.exe
  C:\Windows\System\zTbgSIE.exe
  2⤵
  PID:14004
- C:\Windows\System\wJpYFug.exe
  C:\Windows\System\wJpYFug.exe
  2⤵
  PID:14028
- C:\Windows\System\xBGnrZr.exe
  C:\Windows\System\xBGnrZr.exe
  2⤵
  PID:14060
- C:\Windows\System\EfYiDxe.exe
  C:\Windows\System\EfYiDxe.exe
  2⤵
  PID:14088
- C:\Windows\System\dgSKXPu.exe
  C:\Windows\System\dgSKXPu.exe
  2⤵
  PID:14112
- C:\Windows\System\PUXqCnX.exe
  C:\Windows\System\PUXqCnX.exe
  2⤵
  PID:14136
- C:\Windows\System\ZuZFGPk.exe
  C:\Windows\System\ZuZFGPk.exe
  2⤵
  PID:14164
- C:\Windows\System\xrqAcWP.exe
  C:\Windows\System\xrqAcWP.exe
  2⤵
  PID:14196
- C:\Windows\System\QEGpAdN.exe
  C:\Windows\System\QEGpAdN.exe
  2⤵
  PID:14220
- C:\Windows\System\AEokNnX.exe
  C:\Windows\System\AEokNnX.exe
  2⤵
  PID:14244
- C:\Windows\System\pTswFWi.exe
  C:\Windows\System\pTswFWi.exe
  2⤵
  PID:14264
- C:\Windows\System\QZvqauh.exe
  C:\Windows\System\QZvqauh.exe
  2⤵
  PID:14288
- C:\Windows\System\UgvTdWq.exe
  C:\Windows\System\UgvTdWq.exe
  2⤵
  PID:14316
- C:\Windows\System\FvLtQBK.exe
  C:\Windows\System\FvLtQBK.exe
  2⤵
  PID:13324
- C:\Windows\System\VcdWbJS.exe
  C:\Windows\System\VcdWbJS.exe
  2⤵
  PID:13388
- C:\Windows\System\ZjZqsXb.exe
  C:\Windows\System\ZjZqsXb.exe
  2⤵
  PID:13436
- C:\Windows\System\gvXnRLO.exe
  C:\Windows\System\gvXnRLO.exe
  2⤵
  PID:13516
- C:\Windows\System\joSvRvG.exe
  C:\Windows\System\joSvRvG.exe
  2⤵
  PID:13544
- C:\Windows\System\JgPOArD.exe
  C:\Windows\System\JgPOArD.exe
  2⤵
  PID:13600
- C:\Windows\System\JUetQYK.exe
  C:\Windows\System\JUetQYK.exe
  2⤵
  PID:13708
- C:\Windows\System\sNLLnwX.exe
  C:\Windows\System\sNLLnwX.exe
  2⤵
  PID:13740
- C:\Windows\System\NPVRJvt.exe
  C:\Windows\System\NPVRJvt.exe
  2⤵
  PID:13824
- C:\Windows\System\PbmJUBJ.exe
  C:\Windows\System\PbmJUBJ.exe
  2⤵
  PID:13908
- C:\Windows\System\gXOHQhl.exe
  C:\Windows\System\gXOHQhl.exe
  2⤵
  PID:13920
- C:\Windows\System\XuZjtPx.exe
  C:\Windows\System\XuZjtPx.exe
  2⤵
  PID:14044
- C:\Windows\System\XxHrtHf.exe
  C:\Windows\System\XxHrtHf.exe
  2⤵
  PID:14096
- C:\Windows\System\joFoVGC.exe
  C:\Windows\System\joFoVGC.exe
  2⤵
  PID:14128
- C:\Windows\System\scCaDJZ.exe
  C:\Windows\System\scCaDJZ.exe
  2⤵
  PID:14216
- C:\Windows\System\zBLaGVi.exe
  C:\Windows\System\zBLaGVi.exe
  2⤵
  PID:14284
- C:\Windows\System\eowPuXb.exe
  C:\Windows\System\eowPuXb.exe
  2⤵
  PID:13372
- C:\Windows\System\hyNCSyF.exe
  C:\Windows\System\hyNCSyF.exe
  2⤵
  PID:13520
- C:\Windows\System\WGaRzpz.exe
  C:\Windows\System\WGaRzpz.exe
  2⤵
  PID:13564
- C:\Windows\System\IuIbtUO.exe
  C:\Windows\System\IuIbtUO.exe
  2⤵
  PID:13948
- C:\Windows\System\iCqKeHA.exe
  C:\Windows\System\iCqKeHA.exe
  2⤵
  PID:13684
- C:\Windows\System\WreMkiD.exe
  C:\Windows\System\WreMkiD.exe
  2⤵
  PID:13964
- C:\Windows\System\yimRPKv.exe
  C:\Windows\System\yimRPKv.exe
  2⤵
  PID:4580
- C:\Windows\System\IkZJLZm.exe
  C:\Windows\System\IkZJLZm.exe
  2⤵
  PID:14148
- C:\Windows\System\RXygSxa.exe
  C:\Windows\System\RXygSxa.exe
  2⤵
  PID:14304
- C:\Windows\System\LPiKwHt.exe
  C:\Windows\System\LPiKwHt.exe
  2⤵
  PID:13496
- C:\Windows\System\hVGRASy.exe
  C:\Windows\System\hVGRASy.exe
  2⤵
  PID:13476
- C:\Windows\System\viegKCL.exe
  C:\Windows\System\viegKCL.exe
  2⤵
  PID:13836
- C:\Windows\System\iflAGaZ.exe
  C:\Windows\System\iflAGaZ.exe
  2⤵
  PID:13796
- C:\Windows\System\OqJoghc.exe
  C:\Windows\System\OqJoghc.exe
  2⤵
  PID:14368
- C:\Windows\System\joIEiAc.exe
  C:\Windows\System\joIEiAc.exe
  2⤵
  PID:14392
- C:\Windows\System\qhOtawd.exe
  C:\Windows\System\qhOtawd.exe
  2⤵
  PID:14428
- C:\Windows\System\jgJAxzu.exe
  C:\Windows\System\jgJAxzu.exe
  2⤵
  PID:14452
- C:\Windows\System\LgPtfUq.exe
  C:\Windows\System\LgPtfUq.exe
  2⤵
  PID:14476
- C:\Windows\System\XCBsdbt.exe
  C:\Windows\System\XCBsdbt.exe
  2⤵
  PID:14504
- C:\Windows\System\qdgKZIw.exe
  C:\Windows\System\qdgKZIw.exe
  2⤵
  PID:14536
- C:\Windows\System\VrFqVYt.exe
  C:\Windows\System\VrFqVYt.exe
  2⤵
  PID:14560
- C:\Windows\System\nENBkFm.exe
  C:\Windows\System\nENBkFm.exe
  2⤵
  PID:14584
- C:\Windows\System\AcbOxgu.exe
  C:\Windows\System\AcbOxgu.exe
  2⤵
  PID:14612
- C:\Windows\System\nhdouRE.exe
  C:\Windows\System\nhdouRE.exe
  2⤵
  PID:14640
- C:\Windows\System\aZTTTeW.exe
  C:\Windows\System\aZTTTeW.exe
  2⤵
  PID:14660
- C:\Windows\System\fMZmEMM.exe
  C:\Windows\System\fMZmEMM.exe
  2⤵
  PID:14692
- C:\Windows\System\KqcjWgq.exe
  C:\Windows\System\KqcjWgq.exe
  2⤵
  PID:14716
- C:\Windows\System\pTiZlID.exe
  C:\Windows\System\pTiZlID.exe
  2⤵
  PID:14736
- C:\Windows\System\kUHqCwZ.exe
  C:\Windows\System\kUHqCwZ.exe
  2⤵
  PID:14752
- C:\Windows\System\xsUqJIL.exe
  C:\Windows\System\xsUqJIL.exe
  2⤵
  PID:14776
- C:\Windows\System\Pxoynvs.exe
  C:\Windows\System\Pxoynvs.exe
  2⤵
  PID:14800
- C:\Windows\System\twMAZnI.exe
  C:\Windows\System\twMAZnI.exe
  2⤵
  PID:14832
- C:\Windows\System\WkZKcmL.exe
  C:\Windows\System\WkZKcmL.exe
  2⤵
  PID:14860
- C:\Windows\System\gQvNqoq.exe
  C:\Windows\System\gQvNqoq.exe
  2⤵
  PID:14892
- C:\Windows\System\ExNqeQN.exe
  C:\Windows\System\ExNqeQN.exe
  2⤵
  PID:14912
- C:\Windows\System\TSuwJVv.exe
  C:\Windows\System\TSuwJVv.exe
  2⤵
  PID:14940
- C:\Windows\System\BjxTFJg.exe
  C:\Windows\System\BjxTFJg.exe
  2⤵
  PID:14976
- C:\Windows\System\KLueJFq.exe
  C:\Windows\System\KLueJFq.exe
  2⤵
  PID:15004
- C:\Windows\System\pBoePAC.exe
  C:\Windows\System\pBoePAC.exe
  2⤵
  PID:15028
- C:\Windows\System\RfNUonO.exe
  C:\Windows\System\RfNUonO.exe
  2⤵
  PID:15044
- C:\Windows\System\pgVrIqC.exe
  C:\Windows\System\pgVrIqC.exe
  2⤵
  PID:15060
- C:\Windows\System\TWfjTiE.exe
  C:\Windows\System\TWfjTiE.exe
  2⤵
  PID:15084
- C:\Windows\System\dzHLqcd.exe
  C:\Windows\System\dzHLqcd.exe
  2⤵
  PID:15104
- C:\Windows\System\YmXPELn.exe
  C:\Windows\System\YmXPELn.exe
  2⤵
  PID:14472
- C:\Windows\System\bnSZwQI.exe
  C:\Windows\System\bnSZwQI.exe
  2⤵
  PID:14572
- C:\Windows\System\ZpvXpqb.exe
  C:\Windows\System\ZpvXpqb.exe
  2⤵
  PID:14516
- C:\Windows\System\EcoygJU.exe
  C:\Windows\System\EcoygJU.exe
  2⤵
  PID:14636
- C:\Windows\System\AqPOtJZ.exe
  C:\Windows\System\AqPOtJZ.exe
  2⤵
  PID:14672

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv m5hb3DVEmU2OyqpUvtGNVQ.0.2
1⤵
PID:13664
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 13664 -s 764
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:15220

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 13664 -i 13664 -h 404 -j 444 -s 448 -d 0
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:15236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AAwXZZw.exe

Path C:\Windows\System\AAwXZZw.exe
Size 2.5MB
SHA256 ae33638685761e58ee2502499932b2669572125bd9fef93112061d888ff2cc78
MD5 c6488e338250c75f0a1f9c47b784b53b
SHA1 994ca65db6f415b292e8f2b187b70a7628f099c3
SHA512 b9ec3f087b7fd5b98046d496c4de3a86fef473cff9c483b5b2432a9ef3c63cad3b06213afe4112461e2d9cb07594c9e830d77dcae15d414f589f69d54c06f227
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTke:BemTLkNdfE0pZrV56utgpPFoV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CiphQPK.exe

Path C:\Windows\System\CiphQPK.exe
Size 2.5MB
SHA256 c54a7154dd4b84197959330b35a0c325697aef4521b5a6d79a853412770e768b
MD5 ef9c65628778dbb943f25ead67a43eaa
SHA1 bd730fdebf5b8c90b1e36ec2832dadde88e78f71
SHA512 5f0306093c2b46368f033c15517423e7b1715fba06e6d5acd6952ab8df9dbe3e9d976dcd9e519f9034d762b78ea7cbe958f17a3fd23bfac6a9e53684b876e855
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkF:BemTLkNdfE0pZrV56utgpPFoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

HIAcOPF.exe

Path C:\Windows\System\HIAcOPF.exe
Size 2.5MB
SHA256 45d38d29780783d91ed5592076a590b99ad963838d723c0173237ae1773ff163
MD5 df906da9852d609bfc93a19f5bc6c060
SHA1 ae4e2c34a33846e66147e18bf34dceb768a4d59a
SHA512 d8b55ef1dac6287dace4a546011b3753f7ae8442e10323c5bfc7d4e26d7a95fc9bc2011886fd44e817fae255fae00bcfa1caa587db27e091d90bc51f11077671
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkx:BemTLkNdfE0pZrV56utgpPFo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

HiWXMCZ.exe

Path C:\Windows\System\HiWXMCZ.exe
Size 2.5MB
SHA256 3c0939c63a9d9dae9dddc2a544de49971d9365dbdad4f27200b184eab1bf0c33
MD5 f0f0074e71b719285d3461b70ede3391
SHA1 05aad154d9cf6d31d2ed6403896f58efc53b8cad
SHA512 3ede0ae789947362e30677c329fdb2fc1d0446d72f111404b3ba42451055f5e7a3f7c099cba639c2c5b36ec8815658f4c4899e1f4f9dcaf4529406d31f207faa
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTke:BemTLkNdfE0pZrV56utgpPFod
MD5 SHA1 SHA512 SSDEEP

Submit Download

LJywADG.exe

Path C:\Windows\System\LJywADG.exe
Size 2.5MB
SHA256 05cb78d3af593a142465a14b27c5ebc9cc6b14e1ff86a7e50765e9b7025d0491
MD5 7f5ce16b2def19324d401eb30d6774fd
SHA1 248070617da93576e4a913d9138d006d16457bb5
SHA512 dc6d921563ebfd4af8103ac346a6138d10c705fe599da691e52925dbd66f52bbf4d9b08bb6a7789c7e852942d7a4322163f79fd03424070dd3bf2e100929de2f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkO:BemTLkNdfE0pZrV56utgpPFol
MD5 SHA1 SHA512 SSDEEP

Submit Download

MxHEcij.exe

Path C:\Windows\System\MxHEcij.exe
Size 2.5MB
SHA256 1e9b12db939fedc531ade7239c24f0298c8d43fae1952ec5316745a0b9c77965
MD5 a4fac33e9ffa5628f7530cc9bda8e48c
SHA1 b71c8a0223c18ce701ff299afe61ecd7af053153
SHA512 40c1c2b0925f8cb35e3188867d7915ee56a7df8ec9a038f4ece426942acfbc6a5844263be9787751e110eb2cb3b9985680a4c5b68f171c96b2d36f380724d053
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTka:BemTLkNdfE0pZrV56utgpPFon
MD5 SHA1 SHA512 SSDEEP

Submit Download

PPwwhoz.exe

Path C:\Windows\System\PPwwhoz.exe
Size 2.5MB
SHA256 54ad7330c7edaebc385541f52b9c705c8a09c4d25f343bd61cf67c331e57065f
MD5 f4cd15d2753fd5d504916ee5c0bbf037
SHA1 e7124cd0c9edcdb6a989e8ebebf5facdb930baa7
SHA512 e88bd23f95f3ed489d903f37653c9d4eed6da68d8676342806b4aca14411ea10ae98bcd1059e796803ce0ac1cde4544e3955035b3a62c29430a91423448d0476
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTky:BemTLkNdfE0pZrV56utgpPFo7
MD5 SHA1 SHA512 SSDEEP

Submit Download

PbrdSSr.exe

Path C:\Windows\System\PbrdSSr.exe
Size 2.5MB
SHA256 c108c25b49bee9e8d6b4784fc59332b70c0181132e5db55a391dc6a5f15ff5e8
MD5 50dbd73f0bc5cc32ee85f53d782b02bd
SHA1 478fd993102a4a5ff0153059a30d846343728f24
SHA512 41433a1ea13f333ce84f09db8b376270add3114ae958cd59201602efbe5db45fae6b5392bb0b30f02b9700c2200ed044035a4993ac0fb6b07080191f28d6d217
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkS:BemTLkNdfE0pZrV56utgpPFoJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QJDzZmU.exe

Path C:\Windows\System\QJDzZmU.exe
Size 2.5MB
SHA256 1bdf63d5a50575d42dcbebc6a90907092241957e59ae36ae18e5272fbcae2b80
MD5 c513a440f4061272448be08a83f3311b
SHA1 409aecccfe3b11ea1558100b9034ff7a99fa7d7d
SHA512 4124c2d51cab4857d0ce1f8dcfb3b0025efba4201bbb19d7c9eb33390cdbdbfebfbe7704d3e8ffac69e0d34ebca830cde8136c74faa72451cac8f1ec9bf3f19b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkB:BemTLkNdfE0pZrV56utgpPFoY
MD5 SHA1 SHA512 SSDEEP

Submit Download

QjGotck.exe

Path C:\Windows\System\QjGotck.exe
Size 2.5MB
SHA256 a8f5408f5abdcf9fba2fce801ec7aa8b4770d4b81e02fee42a4e9bd8fe79f57c
MD5 186d4ce50042b988854916b164c3ecd0
SHA1 7381f48c6c5e8e77400d0ab10c77b8be189f307e
SHA512 c1e54f14f8357d1d10aa99c145d8fb229f22ebc022b41a547217f03c09fe3a28bd99e7206d89aee997cf1dbb5e8e919eb6880976252ff5575b4c2798a92d8080
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkX:BemTLkNdfE0pZrV56utgpPFos
MD5 SHA1 SHA512 SSDEEP

Submit Download

QpNVzRr.exe

Path C:\Windows\System\QpNVzRr.exe
Size 2.5MB
SHA256 d8ad347679945215e2311a2d2deea15e96351b7d6a28b2a022de9ce260be3103
MD5 ccbc9f627a5529c4d7e38d6cc8721d3a
SHA1 dd85cda8dac2e96b74735b3229a6a94286233e32
SHA512 8f096b365242d266cdd7257ee82e344549e3ad5c0a09b1857bedd7480873fdc9db0dad3d28dc215e1ebbdf6747d643affbc524ac563bc5ccc6590717591b05fe
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkf:BemTLkNdfE0pZrV56utgpPFo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SfzfmKg.exe

Path C:\Windows\System\SfzfmKg.exe
Size 2.5MB
SHA256 62806fabe98984e1c46d69126e0b2ddc57cccfee56b1b4fda3ce86aecb0f7e9a
MD5 9bdab5ccde25dc4d711f3000e9a9e791
SHA1 bc610d745ee0047740055af6da210352e5bfabf6
SHA512 a91747c66bf49ac03f4f12d178fcd9758dab7ea0d2e80bdd574ea33dd46bc618ef2262d73cd4d101ddeb22cedb179fd216506ab8a851957272169c23b77e9de2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTki:BemTLkNdfE0pZrV56utgpPFof
MD5 SHA1 SHA512 SSDEEP

Submit Download

aCqFunx.exe

Path C:\Windows\System\aCqFunx.exe
Size 2.5MB
SHA256 dc58100e48212d7c9d518763832eee8c93b2986750ea46958a6cd58c02aa0fd1
MD5 ee3103a8a41302d38d0f20713bbec7a6
SHA1 9aa27e6604513b92982871690dd40f0e5633b2a6
SHA512 220b4d9b2c753475ca0c0c686fc12d276b801d5362678e7f444050265d4c26f9e975dd8823d6f476c95e9e9000ee6174c5eed8c4697d24824c614c957bc6e07d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkd:BemTLkNdfE0pZrV56utgpPFoW
MD5 SHA1 SHA512 SSDEEP

Submit Download

aLAzmdt.exe

Path C:\Windows\System\aLAzmdt.exe
Size 2.5MB
SHA256 9e6692f21ec4c106f6edc79e9db7078ac7b743791cc3ab3ffde72224df038594
MD5 ab24272e0857b5d72e507f7e66be5b1d
SHA1 b7300e0cc1ece3a69bed2773ebf5242ec37e09ff
SHA512 b49eab98a5a810162ffe740b49a7d378f1bde74d075ed5e831b3869654477b04b44501a732091f3a504a4867640ff5d5a5704f5e114c56978ef8866f567aee1f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTk8:BemTLkNdfE0pZrV56utgpPFoD
MD5 SHA1 SHA512 SSDEEP

Submit Download

afcKxWm.exe

Path C:\Windows\System\afcKxWm.exe
Size 2.5MB
SHA256 f744b3c6b043b93f8cd52d98456d8aaf2dbf7071b39fe23cf4d43247ccce9c93
MD5 c199b407ce3a4c959d62b71440e9d836
SHA1 fae270cea0d304efbcf6c0d1f71ca594055994d9
SHA512 d8e30feddca31229c8fb5b6492f45de801d667a8307d3fabff6a697bb23866f99728bf9320c482d63ffcfc7f1c1e4042f68c9cbea3bbbb06e98c912597a99f8d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTk7:BemTLkNdfE0pZrV56utgpPFoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

amapOCL.exe

Path C:\Windows\System\amapOCL.exe
Size 2.5MB
SHA256 389f073ea419aca8e9df2ae5262104e9cc626d6e6e51fad729df41cb2f0a8ee4
MD5 4448b9373cf4790a157f8d8c4d44ebe9
SHA1 c630ee1124b6e454657d18b28aa6a076d625b370
SHA512 8ea5e5f98dffd178a789cb73bd626e89e658da2fec4150d970d4114e4640f3d15d61bdc6f41be77946ab82bb6252ca2c858feffd5e519e67be45690b82379afe
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkf:BemTLkNdfE0pZrV56utgpPFoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

bqlTyQD.exe

Path C:\Windows\System\bqlTyQD.exe
Size 2.5MB
SHA256 fd37b504fd4ebe413aac096e8354825b1db5eadea140ca4435fe29f1fd593c55
MD5 922dba7d0c8dd30864f2bec664bb6718
SHA1 df741b5de50a67523156f88bc94e16ec84ce3965
SHA512 d9d6bdc506c26862ff68be9acffc188fc1d5dbe611ff931c300d8e5512e7c70448b493385bc8397b0ae46dc4cf27a0e48eaaa002f89ed06a92cdaa2d43979694
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTki:BemTLkNdfE0pZrV56utgpPFoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cBPyfYJ.exe

Path C:\Windows\System\cBPyfYJ.exe
Size 2.5MB
SHA256 d484651a58c82ecadf91e939b54d44d534ef26bd48f9f8bdda09bb2be8485458
MD5 f055e07a78f2b76b8bb65b38d9c47062
SHA1 073b77ce5031c674263575913f899f6a7fc24c87
SHA512 7f1def7925f6d479b6d46c0228d006b0bc7414b3ca71c5423992298d3b2958e0b9f5300336ad42dd44e0ca483cd779572c4f7dee67da1d90c46c2f7e29260e12
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkQ:BemTLkNdfE0pZrV56utgpPFo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

eMsJdhJ.exe

Path C:\Windows\System\eMsJdhJ.exe
Size 2.5MB
SHA256 a503fb785e885cb9626e8ce32c8b3ba3a0bc60209ea2722197e3739386044250
MD5 05553904580737d03c5bf946bed05a24
SHA1 67885f04bb824ca65bfdde5d9c250ef36c4735f0
SHA512 c6b55fdf31b7061d576294e79576bcd1ef6decaaca9166a1d97c514394570cce9729c8b29e4fd90388da3eb983608fe9d95ac3cdba9cdf8a46fde68e4d6d565e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkm:BemTLkNdfE0pZrV56utgpPFoH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffBbvkK.exe

Path C:\Windows\System\ffBbvkK.exe
Size 2.5MB
SHA256 d16a83b74d41f791dbe4db81fe27da7823bd3e2c27a7897c07a24e196b235c5c
MD5 2b84f2f33bbf18bdbcb4c91303b6ae9e
SHA1 f27503af17e31fc79427c06785f8f8dc55174c21
SHA512 17d6889995f47f931042111f3fddafd25f9a9ab72d36592ec507d9ffaeaee6508825311cbbe68510eb57aec72e3891156ca186602bca9ee4b5fcaaf982a9164d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkc:BemTLkNdfE0pZrV56utgpPFoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fgBzCXV.exe

Path C:\Windows\System\fgBzCXV.exe
Size 2.5MB
SHA256 dcfb2fbb45d8a5ced8b411e905b105cc28e4189a3c55df64b08f4343ba99e2da
MD5 beaa87925fbca43ae6ba76901e7ff1c7
SHA1 7b0e1453f874cafa2d63719220f148f5a770f63e
SHA512 043ca7d53fff3eca4a6141e602c23661f2b5b5cfceb75d22cd3e556a7b989f5b2e5e0ac2436f1e637303523bae53530faf9e1063f36b0a9302d8162a024207c4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTk8:BemTLkNdfE0pZrV56utgpPFoh
MD5 SHA1 SHA512 SSDEEP

Submit Download

fzwtaQT.exe

Path C:\Windows\System\fzwtaQT.exe
Size 2.5MB
SHA256 232f5648b134cba977d815b024120f0e42ad10566b9d3fb01ef0e3e848a5b665
MD5 62e93edb620a0ac34f5c32d7ea88e622
SHA1 977f84a9a003d8645a60539ea861b0acce635c3e
SHA512 38cc3a6737985a552ba18b3530786785820889a4205c1f1119b3650a881fb3b1452f8b6d457f82f7a40ce6ae3d489a61c6b1b30bf999149a642470ff895aed43
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkI:BemTLkNdfE0pZrV56utgpPFoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gKMRCCH.exe

Path C:\Windows\System\gKMRCCH.exe
Size 2.5MB
SHA256 32dbc8c40c6457480020eba6bf4dd81ca7269f28b8c7a69e27a224555b70a2f5
MD5 c97d018d3635ebe9aac9deffb8672050
SHA1 ae2360d0aacb7b57ef38b534eef2423ef302c81d
SHA512 1308e56cc75c8be554f3bde8c158e8d41cf8041a0cac6a1c9deb81fc1c50ffa49de423693cc933cd8aeef974a3aedb027ef372ed82ef6c171e5ff30acf54594d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkV:BemTLkNdfE0pZrV56utgpPFo6
MD5 SHA1 SHA512 SSDEEP

Submit Download

hhKZJKy.exe

Path C:\Windows\System\hhKZJKy.exe
Size 2.5MB
SHA256 1444800d8a8792b050b20e201ff83849063e1fd34b09d0035acec57087ac0f0a
MD5 cf4c945e9ce814ed76c6004707a2bccd
SHA1 b2ecf3998020f43eb8dfeeb78c06721634752f52
SHA512 ac85027443505adbc2cb96008b7fadf2b46fdec8d597dd3eca5daed1db4e8265d73cba478c7b826c6b5d24f875fc488ea37f65792bf243d9fb2bd15d6a17d3e0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkb:BemTLkNdfE0pZrV56utgpPFoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

keiDgMM.exe

Path C:\Windows\System\keiDgMM.exe
Size 2.5MB
SHA256 3404b83778fa0791b2ba99c146a0510ad574febf070a7d55d860c1bf0d328289
MD5 81664330e6f9c67011578388b49a8e8d
SHA1 cb9c06f08f367ae538f78cd5f4143a4448fde359
SHA512 1c540b8ca0ac4120c9c2242743cbd15a3b33b4d7a501e5c4f065040dc25b98ce27147996b8ac6f042b0b879e0e307a56d1c5a103b83d98a120fd630a7a27a422
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkJ:BemTLkNdfE0pZrV56utgpPFoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

koUbhoB.exe

Path C:\Windows\System\koUbhoB.exe
Size 2.5MB
SHA256 da5b82086f6749187c271d5e0c1bd42518045f59962659a04494eec65162f606
MD5 a8342cc0f65f4f00f4877fea19ee56a3
SHA1 77ad2138a647eadedf51bb2c20c6a317377c2f87
SHA512 09f0e657fc02c65f656e7f384f5bb51d8c8e944af70663a0a880d790383c695e6008223c7b8e4ca67d5bfd7f2b8c81c816e65b0d1715cfaa7738cac11d63b6ea
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkwn:BemTLkNdfE0pZrV56utgpPFo7
MD5 SHA1 SHA512 SSDEEP

Submit Download

mHsummt.exe

Path C:\Windows\System\mHsummt.exe
Size 2.5MB
SHA256 5558dde4c6b6ae9de72de9a82d45f69935c1de1b849f4cf7c73995e2df5b591a
MD5 87352ee16d8b058789808d4ad5222ed1
SHA1 5d1cf590e002f5a08f82d9df7553ca7ffcf59b8d
SHA512 3c0defe1880fcda603134cbd3392f0f15e42d5c71a636d91925277a76d5ab0fd47d598119875cb68f4565673d2c74af61f0218d4432311db649cd8a579ef32e2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkh:BemTLkNdfE0pZrV56utgpPFoc
MD5 SHA1 SHA512 SSDEEP

Submit Download

pekWgIb.exe

Path C:\Windows\System\pekWgIb.exe
Size 2.5MB
SHA256 990b068f38807809953bb7f6bafcd9330df94aec58614baca547993b9969ab7b
MD5 3e9f173ea29a11e636b64eabde465b54
SHA1 d630679e56810da78e24c16dfcf3daf504f1677e
SHA512 2738cea95f199a3de6be0b7cf8d0e5fe2f05a8947b2493d6dfa0cc4259ce0770a7590abb145a1c48b631374c6fcd81d58f27ca2c9e757a16057c92d99dd9b5a6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkX:BemTLkNdfE0pZrV56utgpPFoQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pjpoghG.exe

Path C:\Windows\System\pjpoghG.exe
Size 2.5MB
SHA256 4e3c84e0587bb96cecf53ebe5449ced6a72b7ff4c2de9f265be6cddffffb2bc9
MD5 abf670488bb6a7bce7853a4ef2d9a23b
SHA1 2dcf580e74ba0a512752dbeaf55121997104b0ff
SHA512 ca70a1a6fe8504dedd8283ec59bbffdafc4174711e62dff38652f554364b4a36fed4b422a5acb6e18e2667c1721c53a49e6cd29a736b5b034720392f3b41a027
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkX:BemTLkNdfE0pZrV56utgpPFo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

qBQghkH.exe

Path C:\Windows\System\qBQghkH.exe
Size 2.5MB
SHA256 7f615a6d1bcb1c9c2b077fa399b8c32021d623a7aeb0dab371bb87031066e40d
MD5 64750de3f90a4a314f44db07c91efd1c
SHA1 0271cee72896f50f40e4ee6cfe02b47a1270824e
SHA512 da515b539f74d73ffaa4c1287a0469aa37f44ba07c4cdcda3f8a5fc3f951798cfc6141d7c0aff62b69fe6665fbd70efb2199b1e48fded087ac8e0245d2208cd9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTk8:BemTLkNdfE0pZrV56utgpPFoF
MD5 SHA1 SHA512 SSDEEP

Submit Download

rkhLAXR.exe

Path C:\Windows\System\rkhLAXR.exe
Size 2.5MB
SHA256 8f3f00e9a7481c746b0f58785567dd18e5feb4fe134941e7b5006fff4a9f0acc
MD5 2e8932c04cb609d436ad7f0327daa5f5
SHA1 1f5f89dae16b97e7b1830d53ff254d3fe1cb6524
SHA512 ef3bdc2033c04befbf33af5615817323f206964ca8727d48c871d0e1c7e13402d2f095b9ab9c79f6a777363cb9fc52f03ad39d0ffa7167ea7844cbc695849e3e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkk:BemTLkNdfE0pZrV56utgpPFoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

sPVnpdu.exe

Path C:\Windows\System\sPVnpdu.exe
Size 2.5MB
SHA256 e13c7db833257a37d5fb2612f7ceed28a310a9745947e5c9a7c762a0ba760f09
MD5 51118242b3b03ceeca8f36b6feb9c65d
SHA1 775af77c6af7638df39e321d4932d7af6f1f7c65
SHA512 628e2e14f2a60b0a0a4d990632ef84507b3c923fa045d388a8e371d8d5db34b91cf21e3f533e57b2864f2405ce0901d4abf4ce23f2c43b6e181b52d56d77a7e3
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkZk:BemTLkNdfE0pZrV56utgpPFo9
MD5 SHA1 SHA512 SSDEEP

Submit Download

tCzJGPt.exe

Path C:\Windows\System\tCzJGPt.exe
Size 2.5MB
SHA256 417f419e5f444f3b7efdd85390a94f7d346f02f961a8a9a077df98bcabd920e0
MD5 15d127abfd4d290e9523ee0a901061cd
SHA1 8908010acdd3672e538ac71731a780b84b25c688
SHA512 40dced360ccf884922f573005104e4f6185f56c29120c3c9655a52e8c6aaf6fc724f29fe2701c74143f34447c97fe26f79570b9d63e1963e41e85fdaca605528
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoPTkw:BemTLkNdfE0pZrV56utgpPFo9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-2280-0x00007FF610250000-0x00007FF6105A4000-memory.dmp

Download

memory/552-28-0x00007FF610250000-0x00007FF6105A4000-memory.dmp

Download

memory/620-168-0x00007FF608200000-0x00007FF608554000-memory.dmp

Download

memory/620-57-0x00007FF608200000-0x00007FF608554000-memory.dmp

Download

memory/620-2284-0x00007FF608200000-0x00007FF608554000-memory.dmp

Download

memory/696-2294-0x00007FF604AE0000-0x00007FF604E34000-memory.dmp

Download

memory/696-146-0x00007FF604AE0000-0x00007FF604E34000-memory.dmp

Download

memory/804-187-0x00007FF6413D0000-0x00007FF641724000-memory.dmp

Download

memory/804-2299-0x00007FF6413D0000-0x00007FF641724000-memory.dmp

Download

memory/804-2303-0x00007FF6413D0000-0x00007FF641724000-memory.dmp

Download

memory/1260-103-0x00007FF7B5880000-0x00007FF7B5BD4000-memory.dmp

Download

memory/1260-2291-0x00007FF7B5880000-0x00007FF7B5BD4000-memory.dmp

Download

memory/1372-43-0x00007FF62A8E0000-0x00007FF62AC34000-memory.dmp

Download

memory/1372-2281-0x00007FF62A8E0000-0x00007FF62AC34000-memory.dmp

Download

memory/1484-76-0x00007FF7A2BF0000-0x00007FF7A2F44000-memory.dmp

Download

memory/1484-2289-0x00007FF7A2BF0000-0x00007FF7A2F44000-memory.dmp

Download

memory/1484-185-0x00007FF7A2BF0000-0x00007FF7A2F44000-memory.dmp

Download

memory/1624-1314-0x00007FF7E2CF0000-0x00007FF7E3044000-memory.dmp

Download

memory/1624-107-0x00007FF7E2CF0000-0x00007FF7E3044000-memory.dmp

Download

memory/1624-2293-0x00007FF7E2CF0000-0x00007FF7E3044000-memory.dmp

Download

memory/1744-2305-0x00007FF69AED0000-0x00007FF69B224000-memory.dmp

Download

memory/1744-175-0x00007FF69AED0000-0x00007FF69B224000-memory.dmp

Download

memory/1744-2276-0x00007FF69AED0000-0x00007FF69B224000-memory.dmp

Download

memory/1760-2277-0x00007FF7DF950000-0x00007FF7DFCA4000-memory.dmp

Download

memory/1760-113-0x00007FF7DF950000-0x00007FF7DFCA4000-memory.dmp

Download

memory/1760-15-0x00007FF7DF950000-0x00007FF7DFCA4000-memory.dmp

Download

memory/1832-2301-0x00007FF653F30000-0x00007FF654284000-memory.dmp

Download

memory/1832-2275-0x00007FF653F30000-0x00007FF654284000-memory.dmp

Download

memory/1832-162-0x00007FF653F30000-0x00007FF654284000-memory.dmp

Download

memory/2232-170-0x00007FF7C1800000-0x00007FF7C1B54000-memory.dmp

Download

memory/2232-68-0x00007FF7C1800000-0x00007FF7C1B54000-memory.dmp

Download

memory/2232-2287-0x00007FF7C1800000-0x00007FF7C1B54000-memory.dmp

Download

memory/2512-169-0x00007FF6156B0000-0x00007FF615A04000-memory.dmp

Download

memory/2512-2286-0x00007FF6156B0000-0x00007FF615A04000-memory.dmp

Download

memory/2512-62-0x00007FF6156B0000-0x00007FF615A04000-memory.dmp

Download

memory/2516-2306-0x00007FF737D90000-0x00007FF7380E4000-memory.dmp

Download

memory/2516-2263-0x00007FF737D90000-0x00007FF7380E4000-memory.dmp

Download

memory/2516-154-0x00007FF737D90000-0x00007FF7380E4000-memory.dmp

Download

memory/2764-188-0x00007FF75EF90000-0x00007FF75F2E4000-memory.dmp

Download

memory/2764-77-0x00007FF75EF90000-0x00007FF75F2E4000-memory.dmp

Download

memory/2764-2285-0x00007FF75EF90000-0x00007FF75F2E4000-memory.dmp

Download

memory/2828-147-0x00007FF64EC60000-0x00007FF64EFB4000-memory.dmp

Download

memory/2828-39-0x00007FF64EC60000-0x00007FF64EFB4000-memory.dmp

Download

memory/2828-2282-0x00007FF64EC60000-0x00007FF64EFB4000-memory.dmp

Download

memory/2836-2300-0x00007FF7A7650000-0x00007FF7A79A4000-memory.dmp

Download

memory/2836-155-0x00007FF7A7650000-0x00007FF7A79A4000-memory.dmp

Download

memory/2920-2290-0x00007FF653400000-0x00007FF653754000-memory.dmp

Download

memory/2920-89-0x00007FF653400000-0x00007FF653754000-memory.dmp

Download

memory/3248-186-0x00007FF6819C0000-0x00007FF681D14000-memory.dmp

Download

memory/3248-2288-0x00007FF6819C0000-0x00007FF681D14000-memory.dmp

Download

memory/3248-69-0x00007FF6819C0000-0x00007FF681D14000-memory.dmp

Download

memory/3468-2292-0x00007FF674570000-0x00007FF6748C4000-memory.dmp

Download

memory/3468-112-0x00007FF674570000-0x00007FF6748C4000-memory.dmp

Download

memory/3552-2278-0x00007FF7587D0000-0x00007FF758B24000-memory.dmp

Download

memory/3552-2304-0x00007FF7587D0000-0x00007FF758B24000-memory.dmp

Download

memory/3552-184-0x00007FF7587D0000-0x00007FF758B24000-memory.dmp

Download

memory/3604-1-0x0000018DA1500000-0x0000018DA1510000-memory.dmp

Download

memory/3604-98-0x00007FF701750000-0x00007FF701AA4000-memory.dmp

Download

memory/3604-0-0x00007FF701750000-0x00007FF701AA4000-memory.dmp

Download

memory/4020-1315-0x00007FF618320000-0x00007FF618674000-memory.dmp

Download

memory/4020-2297-0x00007FF618320000-0x00007FF618674000-memory.dmp

Download

memory/4020-122-0x00007FF618320000-0x00007FF618674000-memory.dmp

Download

memory/4032-2264-0x00007FF7C0B30000-0x00007FF7C0E84000-memory.dmp

Download

memory/4032-160-0x00007FF7C0B30000-0x00007FF7C0E84000-memory.dmp

Download

memory/4032-2302-0x00007FF7C0B30000-0x00007FF7C0E84000-memory.dmp

Download

memory/4408-88-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp

Download

memory/4408-2274-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp

Download

memory/4408-11-0x00007FF6EE200000-0x00007FF6EE554000-memory.dmp

Download

memory/4500-21-0x00007FF78EA40000-0x00007FF78ED94000-memory.dmp

Download

memory/4500-2279-0x00007FF78EA40000-0x00007FF78ED94000-memory.dmp

Download

memory/4500-125-0x00007FF78EA40000-0x00007FF78ED94000-memory.dmp

Download

memory/4568-1617-0x00007FF6F0560000-0x00007FF6F08B4000-memory.dmp

Download

memory/4568-2295-0x00007FF6F0560000-0x00007FF6F08B4000-memory.dmp

Download

memory/4568-116-0x00007FF6F0560000-0x00007FF6F08B4000-memory.dmp

Download

memory/4660-49-0x00007FF71E2D0000-0x00007FF71E624000-memory.dmp

Download

memory/4660-2283-0x00007FF71E2D0000-0x00007FF71E624000-memory.dmp

Download

memory/4864-2296-0x00007FF6C3500000-0x00007FF6C3854000-memory.dmp

Download

memory/4864-131-0x00007FF6C3500000-0x00007FF6C3854000-memory.dmp

Download

memory/4864-2262-0x00007FF6C3500000-0x00007FF6C3854000-memory.dmp

Download

memory/4924-2298-0x00007FF7826C0000-0x00007FF782A14000-memory.dmp

Download

memory/4924-1619-0x00007FF7826C0000-0x00007FF782A14000-memory.dmp

Download

memory/4924-124-0x00007FF7826C0000-0x00007FF782A14000-memory.dmp

Download