xmrig | 5f7d84cc06c414c01bc53fb2b32e2d27c34010363fc249d1a278b37a83befea1

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
Size 1.6MB
Sample240613-acrbkszelm
SHA256 5f7d84cc06c414c01bc53fb2b32e2d27c34010363fc249d1a278b37a83befea1
MD5 4eb306de09a250cd0d90cbd348037730
SHA1 27e211f40fdcc9a74344a6075ea74408e801f014
SHA512 b776c84df92befb1295cbac4db898389ce03a6a7138f7048725d84ce97f65c98bf730c55394752a06b7d707a8a628b0c038453b84f963a3a084fee30ab243cc8
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoek:RWWBib356utgn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 13660 created 4612	13660	WerFaultSecure.exe	77

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral2/memory/752-524-0x00007FF65D9C0000-0x00007FF65DD11000-memory.dmp	xmrig
behavioral2/memory/2648-525-0x00007FF7D65B0000-0x00007FF7D6901000-memory.dmp	xmrig
behavioral2/memory/1552-526-0x00007FF7CAB30000-0x00007FF7CAE81000-memory.dmp	xmrig
behavioral2/memory/3088-527-0x00007FF7B6310000-0x00007FF7B6661000-memory.dmp	xmrig
behavioral2/memory/2924-25-0x00007FF738800000-0x00007FF738B51000-memory.dmp	xmrig
behavioral2/memory/2100-528-0x00007FF6C7A40000-0x00007FF6C7D91000-memory.dmp	xmrig
behavioral2/memory/4448-529-0x00007FF693F70000-0x00007FF6942C1000-memory.dmp	xmrig
behavioral2/memory/1736-531-0x00007FF6C1750000-0x00007FF6C1AA1000-memory.dmp	xmrig
behavioral2/memory/4492-530-0x00007FF6FEB20000-0x00007FF6FEE71000-memory.dmp	xmrig
behavioral2/memory/2784-533-0x00007FF7B29E0000-0x00007FF7B2D31000-memory.dmp	xmrig
behavioral2/memory/4884-532-0x00007FF6A7090000-0x00007FF6A73E1000-memory.dmp	xmrig
behavioral2/memory/1444-534-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp	xmrig
behavioral2/memory/1220-536-0x00007FF76E640000-0x00007FF76E991000-memory.dmp	xmrig
behavioral2/memory/412-537-0x00007FF784730000-0x00007FF784A81000-memory.dmp	xmrig
behavioral2/memory/3820-535-0x00007FF68F410000-0x00007FF68F761000-memory.dmp	xmrig
behavioral2/memory/3092-548-0x00007FF6998F0000-0x00007FF699C41000-memory.dmp	xmrig
behavioral2/memory/5072-562-0x00007FF663F90000-0x00007FF6642E1000-memory.dmp	xmrig
behavioral2/memory/4848-564-0x00007FF7813E0000-0x00007FF781731000-memory.dmp	xmrig
behavioral2/memory/3992-569-0x00007FF7C4540000-0x00007FF7C4891000-memory.dmp	xmrig
behavioral2/memory/3596-554-0x00007FF748990000-0x00007FF748CE1000-memory.dmp	xmrig
behavioral2/memory/4344-578-0x00007FF793820000-0x00007FF793B71000-memory.dmp	xmrig
behavioral2/memory/4332-583-0x00007FF7AB4F0000-0x00007FF7AB841000-memory.dmp	xmrig
behavioral2/memory/5016-588-0x00007FF618240000-0x00007FF618591000-memory.dmp	xmrig
behavioral2/memory/2752-601-0x00007FF693CE0000-0x00007FF694031000-memory.dmp	xmrig
behavioral2/memory/1072-597-0x00007FF645C30000-0x00007FF645F81000-memory.dmp	xmrig
behavioral2/memory/2576-577-0x00007FF6AF180000-0x00007FF6AF4D1000-memory.dmp	xmrig
behavioral2/memory/1200-2246-0x00007FF687230000-0x00007FF687581000-memory.dmp	xmrig
behavioral2/memory/1940-2247-0x00007FF6F4FD0000-0x00007FF6F5321000-memory.dmp	xmrig
behavioral2/memory/4280-2248-0x00007FF6A4730000-0x00007FF6A4A81000-memory.dmp	xmrig
behavioral2/memory/1200-2272-0x00007FF687230000-0x00007FF687581000-memory.dmp	xmrig
behavioral2/memory/1940-2274-0x00007FF6F4FD0000-0x00007FF6F5321000-memory.dmp	xmrig
behavioral2/memory/4280-2278-0x00007FF6A4730000-0x00007FF6A4A81000-memory.dmp	xmrig
behavioral2/memory/2924-2276-0x00007FF738800000-0x00007FF738B51000-memory.dmp	xmrig
behavioral2/memory/752-2280-0x00007FF65D9C0000-0x00007FF65DD11000-memory.dmp	xmrig
behavioral2/memory/4448-2284-0x00007FF693F70000-0x00007FF6942C1000-memory.dmp	xmrig
behavioral2/memory/2784-2299-0x00007FF7B29E0000-0x00007FF7B2D31000-memory.dmp	xmrig
behavioral2/memory/1220-2304-0x00007FF76E640000-0x00007FF76E991000-memory.dmp	xmrig
behavioral2/memory/412-2306-0x00007FF784730000-0x00007FF784A81000-memory.dmp	xmrig
behavioral2/memory/5072-2312-0x00007FF663F90000-0x00007FF6642E1000-memory.dmp	xmrig
behavioral2/memory/3992-2314-0x00007FF7C4540000-0x00007FF7C4891000-memory.dmp	xmrig
behavioral2/memory/4848-2316-0x00007FF7813E0000-0x00007FF781731000-memory.dmp	xmrig
behavioral2/memory/3596-2310-0x00007FF748990000-0x00007FF748CE1000-memory.dmp	xmrig
behavioral2/memory/3092-2308-0x00007FF6998F0000-0x00007FF699C41000-memory.dmp	xmrig
behavioral2/memory/1444-2302-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp	xmrig
behavioral2/memory/3820-2301-0x00007FF68F410000-0x00007FF68F761000-memory.dmp	xmrig
behavioral2/memory/4492-2296-0x00007FF6FEB20000-0x00007FF6FEE71000-memory.dmp	xmrig
behavioral2/memory/4884-2294-0x00007FF6A7090000-0x00007FF6A73E1000-memory.dmp	xmrig
behavioral2/memory/2648-2292-0x00007FF7D65B0000-0x00007FF7D6901000-memory.dmp	xmrig
behavioral2/memory/1552-2290-0x00007FF7CAB30000-0x00007FF7CAE81000-memory.dmp	xmrig
behavioral2/memory/3088-2288-0x00007FF7B6310000-0x00007FF7B6661000-memory.dmp	xmrig
behavioral2/memory/2100-2287-0x00007FF6C7A40000-0x00007FF6C7D91000-memory.dmp	xmrig
behavioral2/memory/1736-2282-0x00007FF6C1750000-0x00007FF6C1AA1000-memory.dmp	xmrig
behavioral2/memory/1072-2335-0x00007FF645C30000-0x00007FF645F81000-memory.dmp	xmrig
behavioral2/memory/2752-2366-0x00007FF693CE0000-0x00007FF694031000-memory.dmp	xmrig
behavioral2/memory/4332-2329-0x00007FF7AB4F0000-0x00007FF7AB841000-memory.dmp	xmrig
behavioral2/memory/5016-2331-0x00007FF618240000-0x00007FF618591000-memory.dmp	xmrig
behavioral2/memory/2576-2327-0x00007FF6AF180000-0x00007FF6AF4D1000-memory.dmp	xmrig
behavioral2/memory/4344-2319-0x00007FF793820000-0x00007FF793B71000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1200	dhUsLDZ.exe
1940	NIKhFXm.exe
4280	cFnKQQo.exe
2924	brtnOrb.exe
752	fFwStZh.exe
2648	CVLbPBX.exe
1552	iQVHART.exe
3088	DgNuUBG.exe
2100	adaKKCo.exe
4448	dRhtIUj.exe
4492	pueawOj.exe
1736	NxTLGfT.exe
4884	jovlfeo.exe
2784	zGmQnlW.exe
1444	IceazCp.exe
3820	Vjaaxqv.exe
1220	RQpPihx.exe
412	ETePwlF.exe
3092	YqNyOIb.exe
3596	pgUYKSN.exe
5072	HFyNWwY.exe
4848	lhmHqXm.exe
3992	bPkWhfN.exe
2576	YvBJKDB.exe
4344	cxYozgC.exe
4332	ClPgXgz.exe
5016	riuokRQ.exe
1072	iMYdjVz.exe
2752	sklpcxE.exe
1740	lyVfPBb.exe
2336	rbbEqxX.exe
988	YdnmkEB.exe
3028	WindNeN.exe
4132	yuTLhwA.exe
4988	TYTfSPE.exe
4308	egCzNGD.exe
4440	gEpghQl.exe
3456	IOCNMUF.exe
2052	MoGeVTZ.exe
3340	VZsUlQQ.exe
4428	iqkuRRW.exe
3352	XwjlYAI.exe
3432	dDqBnGr.exe
4008	PHkBibb.exe
4148	mTEGIRk.exe
4088	NlRyLEb.exe
3420	LpojsHv.exe
4324	BLlxQDT.exe
4240	xoZCfOf.exe
3472	UjSfXDk.exe
2904	gPlfBto.exe
3244	BhbLBXu.exe
4704	OFktabi.exe
3904	iAtHKMk.exe
2868	rRloYPJ.exe
788	etShLIl.exe
2528	omgVWMf.exe
4400	UgdeHUF.exe
4484	vLFkElC.exe
1100	PqrnrRT.exe
1144	bRWGUEK.exe
1140	FZvToya.exe
4224	BuaSmsY.exe
1992	NFXEdKd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1272-0-0x00007FF61D690000-0x00007FF61D9E1000-memory.dmp	upx
behavioral2/files/0x0007000000023451-7.dat	upx
behavioral2/files/0x00050000000232b2-10.dat	upx
behavioral2/files/0x0008000000023450-9.dat	upx
behavioral2/memory/1200-8-0x00007FF687230000-0x00007FF687581000-memory.dmp	upx
behavioral2/memory/4280-22-0x00007FF6A4730000-0x00007FF6A4A81000-memory.dmp	upx
behavioral2/files/0x0007000000023457-55.dat	upx
behavioral2/files/0x000700000002345e-82.dat	upx
behavioral2/files/0x0007000000023468-132.dat	upx
behavioral2/files/0x000700000002346b-147.dat	upx
behavioral2/files/0x000700000002346f-167.dat	upx
behavioral2/memory/752-524-0x00007FF65D9C0000-0x00007FF65DD11000-memory.dmp	upx
behavioral2/memory/2648-525-0x00007FF7D65B0000-0x00007FF7D6901000-memory.dmp	upx
behavioral2/memory/1552-526-0x00007FF7CAB30000-0x00007FF7CAE81000-memory.dmp	upx
behavioral2/files/0x000700000002346d-165.dat	upx
behavioral2/files/0x000700000002346e-162.dat	upx
behavioral2/files/0x000700000002346c-160.dat	upx
behavioral2/files/0x000700000002346a-150.dat	upx
behavioral2/files/0x0007000000023469-145.dat	upx
behavioral2/files/0x0007000000023467-135.dat	upx
behavioral2/files/0x0007000000023466-130.dat	upx
behavioral2/files/0x0007000000023465-125.dat	upx
behavioral2/files/0x0007000000023464-120.dat	upx
behavioral2/memory/3088-527-0x00007FF7B6310000-0x00007FF7B6661000-memory.dmp	upx
behavioral2/files/0x0007000000023463-115.dat	upx
behavioral2/files/0x0007000000023462-110.dat	upx
behavioral2/files/0x0007000000023461-105.dat	upx
behavioral2/files/0x0007000000023460-100.dat	upx
behavioral2/files/0x000700000002345f-95.dat	upx
behavioral2/files/0x000700000002345d-85.dat	upx
behavioral2/files/0x000700000002345c-80.dat	upx
behavioral2/files/0x000700000002345b-75.dat	upx
behavioral2/files/0x000700000002345a-70.dat	upx
behavioral2/files/0x0007000000023459-65.dat	upx
behavioral2/files/0x0007000000023458-60.dat	upx
behavioral2/files/0x0007000000023456-50.dat	upx
behavioral2/files/0x0007000000023455-42.dat	upx
behavioral2/files/0x0007000000023454-38.dat	upx
behavioral2/files/0x0007000000023453-29.dat	upx
behavioral2/memory/2924-25-0x00007FF738800000-0x00007FF738B51000-memory.dmp	upx
behavioral2/files/0x0007000000023452-21.dat	upx
behavioral2/memory/1940-15-0x00007FF6F4FD0000-0x00007FF6F5321000-memory.dmp	upx
behavioral2/memory/2100-528-0x00007FF6C7A40000-0x00007FF6C7D91000-memory.dmp	upx
behavioral2/memory/4448-529-0x00007FF693F70000-0x00007FF6942C1000-memory.dmp	upx
behavioral2/memory/1736-531-0x00007FF6C1750000-0x00007FF6C1AA1000-memory.dmp	upx
behavioral2/memory/4492-530-0x00007FF6FEB20000-0x00007FF6FEE71000-memory.dmp	upx
behavioral2/memory/2784-533-0x00007FF7B29E0000-0x00007FF7B2D31000-memory.dmp	upx
behavioral2/memory/4884-532-0x00007FF6A7090000-0x00007FF6A73E1000-memory.dmp	upx
behavioral2/memory/1444-534-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp	upx
behavioral2/memory/1220-536-0x00007FF76E640000-0x00007FF76E991000-memory.dmp	upx
behavioral2/memory/412-537-0x00007FF784730000-0x00007FF784A81000-memory.dmp	upx
behavioral2/memory/3820-535-0x00007FF68F410000-0x00007FF68F761000-memory.dmp	upx
behavioral2/memory/3092-548-0x00007FF6998F0000-0x00007FF699C41000-memory.dmp	upx
behavioral2/memory/5072-562-0x00007FF663F90000-0x00007FF6642E1000-memory.dmp	upx
behavioral2/memory/4848-564-0x00007FF7813E0000-0x00007FF781731000-memory.dmp	upx
behavioral2/memory/3992-569-0x00007FF7C4540000-0x00007FF7C4891000-memory.dmp	upx
behavioral2/memory/3596-554-0x00007FF748990000-0x00007FF748CE1000-memory.dmp	upx
behavioral2/memory/4344-578-0x00007FF793820000-0x00007FF793B71000-memory.dmp	upx
behavioral2/memory/4332-583-0x00007FF7AB4F0000-0x00007FF7AB841000-memory.dmp	upx
behavioral2/memory/5016-588-0x00007FF618240000-0x00007FF618591000-memory.dmp	upx
behavioral2/memory/2752-601-0x00007FF693CE0000-0x00007FF694031000-memory.dmp	upx
behavioral2/memory/1072-597-0x00007FF645C30000-0x00007FF645F81000-memory.dmp	upx
behavioral2/memory/2576-577-0x00007FF6AF180000-0x00007FF6AF4D1000-memory.dmp	upx
behavioral2/memory/1200-2246-0x00007FF687230000-0x00007FF687581000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pueawOj.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\gEpghQl.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\HkTCvkp.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\ffAhiLN.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\sMObCQL.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\nSOdpmX.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\ErZzjFI.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\vLFkElC.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\fXBoRaa.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\XIdAnzl.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\IAODiUA.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\xJkWSjv.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\DSJuUTq.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\fbGrTYb.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\wXyvuBa.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\wmifTZd.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\cZIgmAJ.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\yuTLhwA.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\kOdYHIb.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\FkUZMug.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\JDvqWbQ.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\iMSveXL.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\juKzcdv.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\dDfwbrB.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\zbAxNMW.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\IceazCp.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\mTEGIRk.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\RbqFUiV.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\GvRmAXf.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\pIUdyiu.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\KteUMAE.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\yQrNeXn.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\Vjaaxqv.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\kYKgqtq.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\GntdrVD.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\IKSEJfN.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\bPkWhfN.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\IOCNMUF.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\dWrVqHs.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\AvSPUhK.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\ELovySA.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\zHaXbXu.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\cupRjcS.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\JXeGPFM.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\qPciuzo.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\FoAqCnV.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\SlKIuFT.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\NRVBUbA.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\rbbEqxX.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\ocTQJSt.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\goEmfXt.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\tzKmCiK.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\nazvqoG.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\zytVYJY.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\jhYccev.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\uwBqruy.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\GLBjLzk.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\pyGxqQe.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\yWMGpzo.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\FrlHclT.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\dNaqPvk.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\aVYWUle.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\PSXfQsN.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
File created	C:\Windows\System\hnTRyHu.exe	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
14188	WerFaultSecure.exe
14188	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1200	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	83
PID 1272 wrote to memory of 1200	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	83
PID 1272 wrote to memory of 1940	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	84
PID 1272 wrote to memory of 1940	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	84
PID 1272 wrote to memory of 4280	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	85
PID 1272 wrote to memory of 4280	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	85
PID 1272 wrote to memory of 2924	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	86
PID 1272 wrote to memory of 2924	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	86
PID 1272 wrote to memory of 752	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	87
PID 1272 wrote to memory of 752	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	87
PID 1272 wrote to memory of 2648	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	88
PID 1272 wrote to memory of 2648	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	88
PID 1272 wrote to memory of 1552	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	89
PID 1272 wrote to memory of 1552	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	89
PID 1272 wrote to memory of 3088	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	90
PID 1272 wrote to memory of 3088	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	90
PID 1272 wrote to memory of 2100	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	91
PID 1272 wrote to memory of 2100	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	91
PID 1272 wrote to memory of 4448	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	92
PID 1272 wrote to memory of 4448	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	92
PID 1272 wrote to memory of 4492	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	93
PID 1272 wrote to memory of 4492	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	93
PID 1272 wrote to memory of 1736	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	94
PID 1272 wrote to memory of 1736	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	94
PID 1272 wrote to memory of 4884	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	95
PID 1272 wrote to memory of 4884	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	95
PID 1272 wrote to memory of 2784	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	96
PID 1272 wrote to memory of 2784	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	96
PID 1272 wrote to memory of 1444	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	97
PID 1272 wrote to memory of 1444	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	97
PID 1272 wrote to memory of 3820	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	98
PID 1272 wrote to memory of 3820	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	98
PID 1272 wrote to memory of 1220	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	99
PID 1272 wrote to memory of 1220	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	99
PID 1272 wrote to memory of 412	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	100
PID 1272 wrote to memory of 412	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	100
PID 1272 wrote to memory of 3092	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	101
PID 1272 wrote to memory of 3092	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	101
PID 1272 wrote to memory of 3596	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	102
PID 1272 wrote to memory of 3596	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	102
PID 1272 wrote to memory of 5072	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	103
PID 1272 wrote to memory of 5072	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	103
PID 1272 wrote to memory of 4848	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	104
PID 1272 wrote to memory of 4848	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	104
PID 1272 wrote to memory of 3992	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	105
PID 1272 wrote to memory of 3992	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	105
PID 1272 wrote to memory of 2576	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	106
PID 1272 wrote to memory of 2576	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	106
PID 1272 wrote to memory of 4344	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	107
PID 1272 wrote to memory of 4344	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	107
PID 1272 wrote to memory of 4332	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	108
PID 1272 wrote to memory of 4332	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	108
PID 1272 wrote to memory of 5016	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	109
PID 1272 wrote to memory of 5016	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	109
PID 1272 wrote to memory of 1072	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	110
PID 1272 wrote to memory of 1072	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	110
PID 1272 wrote to memory of 2752	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	111
PID 1272 wrote to memory of 2752	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	111
PID 1272 wrote to memory of 1740	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	112
PID 1272 wrote to memory of 1740	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	112
PID 1272 wrote to memory of 2336	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	113
PID 1272 wrote to memory of 2336	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	113
PID 1272 wrote to memory of 988	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	114
PID 1272 wrote to memory of 988	1272	4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe	114

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv xMKhyoNq6U2SlGJNnSrOyA.0
1⤵
PID:4612
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4612 -s 464
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:14188

C:\Users\Admin\AppData\Local\Temp\4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4eb306de09a250cd0d90cbd348037730_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\System\dhUsLDZ.exe
  C:\Windows\System\dhUsLDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\NIKhFXm.exe
  C:\Windows\System\NIKhFXm.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\cFnKQQo.exe
  C:\Windows\System\cFnKQQo.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\brtnOrb.exe
  C:\Windows\System\brtnOrb.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\fFwStZh.exe
  C:\Windows\System\fFwStZh.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\CVLbPBX.exe
  C:\Windows\System\CVLbPBX.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\iQVHART.exe
  C:\Windows\System\iQVHART.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\DgNuUBG.exe
  C:\Windows\System\DgNuUBG.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\adaKKCo.exe
  C:\Windows\System\adaKKCo.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\dRhtIUj.exe
  C:\Windows\System\dRhtIUj.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\pueawOj.exe
  C:\Windows\System\pueawOj.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\NxTLGfT.exe
  C:\Windows\System\NxTLGfT.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\jovlfeo.exe
  C:\Windows\System\jovlfeo.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\zGmQnlW.exe
  C:\Windows\System\zGmQnlW.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\IceazCp.exe
  C:\Windows\System\IceazCp.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\Vjaaxqv.exe
  C:\Windows\System\Vjaaxqv.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\RQpPihx.exe
  C:\Windows\System\RQpPihx.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\ETePwlF.exe
  C:\Windows\System\ETePwlF.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\YqNyOIb.exe
  C:\Windows\System\YqNyOIb.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\pgUYKSN.exe
  C:\Windows\System\pgUYKSN.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\HFyNWwY.exe
  C:\Windows\System\HFyNWwY.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\lhmHqXm.exe
  C:\Windows\System\lhmHqXm.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\bPkWhfN.exe
  C:\Windows\System\bPkWhfN.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\YvBJKDB.exe
  C:\Windows\System\YvBJKDB.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\cxYozgC.exe
  C:\Windows\System\cxYozgC.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\ClPgXgz.exe
  C:\Windows\System\ClPgXgz.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\riuokRQ.exe
  C:\Windows\System\riuokRQ.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\iMYdjVz.exe
  C:\Windows\System\iMYdjVz.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\sklpcxE.exe
  C:\Windows\System\sklpcxE.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\lyVfPBb.exe
  C:\Windows\System\lyVfPBb.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\rbbEqxX.exe
  C:\Windows\System\rbbEqxX.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\YdnmkEB.exe
  C:\Windows\System\YdnmkEB.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\WindNeN.exe
  C:\Windows\System\WindNeN.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\yuTLhwA.exe
  C:\Windows\System\yuTLhwA.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\TYTfSPE.exe
  C:\Windows\System\TYTfSPE.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\egCzNGD.exe
  C:\Windows\System\egCzNGD.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\gEpghQl.exe
  C:\Windows\System\gEpghQl.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\IOCNMUF.exe
  C:\Windows\System\IOCNMUF.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\MoGeVTZ.exe
  C:\Windows\System\MoGeVTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\VZsUlQQ.exe
  C:\Windows\System\VZsUlQQ.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\iqkuRRW.exe
  C:\Windows\System\iqkuRRW.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\XwjlYAI.exe
  C:\Windows\System\XwjlYAI.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\dDqBnGr.exe
  C:\Windows\System\dDqBnGr.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\PHkBibb.exe
  C:\Windows\System\PHkBibb.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\mTEGIRk.exe
  C:\Windows\System\mTEGIRk.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\NlRyLEb.exe
  C:\Windows\System\NlRyLEb.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\LpojsHv.exe
  C:\Windows\System\LpojsHv.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\BLlxQDT.exe
  C:\Windows\System\BLlxQDT.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\xoZCfOf.exe
  C:\Windows\System\xoZCfOf.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\UjSfXDk.exe
  C:\Windows\System\UjSfXDk.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\gPlfBto.exe
  C:\Windows\System\gPlfBto.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\BhbLBXu.exe
  C:\Windows\System\BhbLBXu.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\OFktabi.exe
  C:\Windows\System\OFktabi.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\iAtHKMk.exe
  C:\Windows\System\iAtHKMk.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\rRloYPJ.exe
  C:\Windows\System\rRloYPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\etShLIl.exe
  C:\Windows\System\etShLIl.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\omgVWMf.exe
  C:\Windows\System\omgVWMf.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\UgdeHUF.exe
  C:\Windows\System\UgdeHUF.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\vLFkElC.exe
  C:\Windows\System\vLFkElC.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\PqrnrRT.exe
  C:\Windows\System\PqrnrRT.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\bRWGUEK.exe
  C:\Windows\System\bRWGUEK.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\FZvToya.exe
  C:\Windows\System\FZvToya.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\BuaSmsY.exe
  C:\Windows\System\BuaSmsY.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\NFXEdKd.exe
  C:\Windows\System\NFXEdKd.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\edIiPJH.exe
  C:\Windows\System\edIiPJH.exe
  2⤵
  PID:2520
- C:\Windows\System\gkeIYPB.exe
  C:\Windows\System\gkeIYPB.exe
  2⤵
  PID:944
- C:\Windows\System\fXBoRaa.exe
  C:\Windows\System\fXBoRaa.exe
  2⤵
  PID:1988
- C:\Windows\System\FrlHclT.exe
  C:\Windows\System\FrlHclT.exe
  2⤵
  PID:4472
- C:\Windows\System\tuVcfAS.exe
  C:\Windows\System\tuVcfAS.exe
  2⤵
  PID:3940
- C:\Windows\System\pJcUNHO.exe
  C:\Windows\System\pJcUNHO.exe
  2⤵
  PID:4524
- C:\Windows\System\MsCwpYZ.exe
  C:\Windows\System\MsCwpYZ.exe
  2⤵
  PID:2280
- C:\Windows\System\ZgUqFUk.exe
  C:\Windows\System\ZgUqFUk.exe
  2⤵
  PID:1328
- C:\Windows\System\Ddighdc.exe
  C:\Windows\System\Ddighdc.exe
  2⤵
  PID:2608
- C:\Windows\System\WMycaBl.exe
  C:\Windows\System\WMycaBl.exe
  2⤵
  PID:3668
- C:\Windows\System\FTDdGcG.exe
  C:\Windows\System\FTDdGcG.exe
  2⤵
  PID:2060
- C:\Windows\System\EEzipjJ.exe
  C:\Windows\System\EEzipjJ.exe
  2⤵
  PID:2056
- C:\Windows\System\ZrtGpWY.exe
  C:\Windows\System\ZrtGpWY.exe
  2⤵
  PID:4640
- C:\Windows\System\jUUlrId.exe
  C:\Windows\System\jUUlrId.exe
  2⤵
  PID:2936
- C:\Windows\System\UZvySKS.exe
  C:\Windows\System\UZvySKS.exe
  2⤵
  PID:4608
- C:\Windows\System\avRllwx.exe
  C:\Windows\System\avRllwx.exe
  2⤵
  PID:3440
- C:\Windows\System\fbGrTYb.exe
  C:\Windows\System\fbGrTYb.exe
  2⤵
  PID:2340
- C:\Windows\System\DBTQwNt.exe
  C:\Windows\System\DBTQwNt.exe
  2⤵
  PID:4824
- C:\Windows\System\iUCVfrr.exe
  C:\Windows\System\iUCVfrr.exe
  2⤵
  PID:4744
- C:\Windows\System\SKOXHLr.exe
  C:\Windows\System\SKOXHLr.exe
  2⤵
  PID:4388
- C:\Windows\System\RbqFUiV.exe
  C:\Windows\System\RbqFUiV.exe
  2⤵
  PID:3916
- C:\Windows\System\AcyxdrW.exe
  C:\Windows\System\AcyxdrW.exe
  2⤵
  PID:4928
- C:\Windows\System\DzZuYVV.exe
  C:\Windows\System\DzZuYVV.exe
  2⤵
  PID:3540
- C:\Windows\System\LIzYgHF.exe
  C:\Windows\System\LIzYgHF.exe
  2⤵
  PID:3724
- C:\Windows\System\SkUREKC.exe
  C:\Windows\System\SkUREKC.exe
  2⤵
  PID:800
- C:\Windows\System\NfNRLeS.exe
  C:\Windows\System\NfNRLeS.exe
  2⤵
  PID:4592
- C:\Windows\System\IxYwgJw.exe
  C:\Windows\System\IxYwgJw.exe
  2⤵
  PID:4152
- C:\Windows\System\GvRmAXf.exe
  C:\Windows\System\GvRmAXf.exe
  2⤵
  PID:4652
- C:\Windows\System\HkTCvkp.exe
  C:\Windows\System\HkTCvkp.exe
  2⤵
  PID:3572
- C:\Windows\System\nEoKBzg.exe
  C:\Windows\System\nEoKBzg.exe
  2⤵
  PID:1616
- C:\Windows\System\ffAhiLN.exe
  C:\Windows\System\ffAhiLN.exe
  2⤵
  PID:5136
- C:\Windows\System\llNARFz.exe
  C:\Windows\System\llNARFz.exe
  2⤵
  PID:5156
- C:\Windows\System\emBPhQx.exe
  C:\Windows\System\emBPhQx.exe
  2⤵
  PID:5180
- C:\Windows\System\RXZCQta.exe
  C:\Windows\System\RXZCQta.exe
  2⤵
  PID:5208
- C:\Windows\System\WLXysjJ.exe
  C:\Windows\System\WLXysjJ.exe
  2⤵
  PID:5236
- C:\Windows\System\ngbLbcJ.exe
  C:\Windows\System\ngbLbcJ.exe
  2⤵
  PID:5264
- C:\Windows\System\kwnxFGD.exe
  C:\Windows\System\kwnxFGD.exe
  2⤵
  PID:5292
- C:\Windows\System\lGEjeaz.exe
  C:\Windows\System\lGEjeaz.exe
  2⤵
  PID:5320
- C:\Windows\System\HmHukBs.exe
  C:\Windows\System\HmHukBs.exe
  2⤵
  PID:5348
- C:\Windows\System\MRddzRu.exe
  C:\Windows\System\MRddzRu.exe
  2⤵
  PID:5376
- C:\Windows\System\vrzLOHy.exe
  C:\Windows\System\vrzLOHy.exe
  2⤵
  PID:5404
- C:\Windows\System\vtpwpxr.exe
  C:\Windows\System\vtpwpxr.exe
  2⤵
  PID:5432
- C:\Windows\System\juKzcdv.exe
  C:\Windows\System\juKzcdv.exe
  2⤵
  PID:5460
- C:\Windows\System\DXzrqJO.exe
  C:\Windows\System\DXzrqJO.exe
  2⤵
  PID:5488
- C:\Windows\System\UHFZytI.exe
  C:\Windows\System\UHFZytI.exe
  2⤵
  PID:5516
- C:\Windows\System\yVLlteH.exe
  C:\Windows\System\yVLlteH.exe
  2⤵
  PID:5544
- C:\Windows\System\RCHbuzP.exe
  C:\Windows\System\RCHbuzP.exe
  2⤵
  PID:5572
- C:\Windows\System\QhUgApO.exe
  C:\Windows\System\QhUgApO.exe
  2⤵
  PID:5600
- C:\Windows\System\KTbZAdQ.exe
  C:\Windows\System\KTbZAdQ.exe
  2⤵
  PID:5628
- C:\Windows\System\DhtqfAr.exe
  C:\Windows\System\DhtqfAr.exe
  2⤵
  PID:5656
- C:\Windows\System\WWMvyKM.exe
  C:\Windows\System\WWMvyKM.exe
  2⤵
  PID:5684
- C:\Windows\System\gieKWRG.exe
  C:\Windows\System\gieKWRG.exe
  2⤵
  PID:5712
- C:\Windows\System\SWYcfEg.exe
  C:\Windows\System\SWYcfEg.exe
  2⤵
  PID:5740
- C:\Windows\System\gTrOtEJ.exe
  C:\Windows\System\gTrOtEJ.exe
  2⤵
  PID:5768
- C:\Windows\System\kTyBZQh.exe
  C:\Windows\System\kTyBZQh.exe
  2⤵
  PID:5796
- C:\Windows\System\BWHmepg.exe
  C:\Windows\System\BWHmepg.exe
  2⤵
  PID:5824
- C:\Windows\System\qDbbBwQ.exe
  C:\Windows\System\qDbbBwQ.exe
  2⤵
  PID:5852
- C:\Windows\System\pIUdyiu.exe
  C:\Windows\System\pIUdyiu.exe
  2⤵
  PID:5880
- C:\Windows\System\nNLLnMf.exe
  C:\Windows\System\nNLLnMf.exe
  2⤵
  PID:5908
- C:\Windows\System\wWvXqiv.exe
  C:\Windows\System\wWvXqiv.exe
  2⤵
  PID:5936
- C:\Windows\System\piyUsVW.exe
  C:\Windows\System\piyUsVW.exe
  2⤵
  PID:5964
- C:\Windows\System\QZWIwDb.exe
  C:\Windows\System\QZWIwDb.exe
  2⤵
  PID:5992
- C:\Windows\System\kqdLOqc.exe
  C:\Windows\System\kqdLOqc.exe
  2⤵
  PID:6020
- C:\Windows\System\kIBhgTD.exe
  C:\Windows\System\kIBhgTD.exe
  2⤵
  PID:6048
- C:\Windows\System\VFsdWrD.exe
  C:\Windows\System\VFsdWrD.exe
  2⤵
  PID:6076
- C:\Windows\System\aujYQir.exe
  C:\Windows\System\aujYQir.exe
  2⤵
  PID:6104
- C:\Windows\System\yHEobGL.exe
  C:\Windows\System\yHEobGL.exe
  2⤵
  PID:6132
- C:\Windows\System\NrsrqQX.exe
  C:\Windows\System\NrsrqQX.exe
  2⤵
  PID:4456
- C:\Windows\System\PteYjey.exe
  C:\Windows\System\PteYjey.exe
  2⤵
  PID:4056
- C:\Windows\System\dtrlaKG.exe
  C:\Windows\System\dtrlaKG.exe
  2⤵
  PID:416
- C:\Windows\System\tMtGayh.exe
  C:\Windows\System\tMtGayh.exe
  2⤵
  PID:1608
- C:\Windows\System\wFzMEzy.exe
  C:\Windows\System\wFzMEzy.exe
  2⤵
  PID:1612
- C:\Windows\System\MojLvOM.exe
  C:\Windows\System\MojLvOM.exe
  2⤵
  PID:5168
- C:\Windows\System\AwQuqRi.exe
  C:\Windows\System\AwQuqRi.exe
  2⤵
  PID:5228
- C:\Windows\System\cVkySeH.exe
  C:\Windows\System\cVkySeH.exe
  2⤵
  PID:5288
- C:\Windows\System\gjZGbrU.exe
  C:\Windows\System\gjZGbrU.exe
  2⤵
  PID:4920
- C:\Windows\System\jvQqgkT.exe
  C:\Windows\System\jvQqgkT.exe
  2⤵
  PID:5400
- C:\Windows\System\NZtJHJt.exe
  C:\Windows\System\NZtJHJt.exe
  2⤵
  PID:5452
- C:\Windows\System\FmkqELx.exe
  C:\Windows\System\FmkqELx.exe
  2⤵
  PID:3568
- C:\Windows\System\fEgWbKp.exe
  C:\Windows\System\fEgWbKp.exe
  2⤵
  PID:5564
- C:\Windows\System\WqBOPUf.exe
  C:\Windows\System\WqBOPUf.exe
  2⤵
  PID:5624
- C:\Windows\System\CQIgZnP.exe
  C:\Windows\System\CQIgZnP.exe
  2⤵
  PID:5700
- C:\Windows\System\QXnGJaK.exe
  C:\Windows\System\QXnGJaK.exe
  2⤵
  PID:5756
- C:\Windows\System\QSmejpa.exe
  C:\Windows\System\QSmejpa.exe
  2⤵
  PID:5812
- C:\Windows\System\nWiLwfQ.exe
  C:\Windows\System\nWiLwfQ.exe
  2⤵
  PID:5868
- C:\Windows\System\FCNsrrm.exe
  C:\Windows\System\FCNsrrm.exe
  2⤵
  PID:5924
- C:\Windows\System\RmySbsh.exe
  C:\Windows\System\RmySbsh.exe
  2⤵
  PID:764
- C:\Windows\System\zSKqhVv.exe
  C:\Windows\System\zSKqhVv.exe
  2⤵
  PID:6016
- C:\Windows\System\JTLpMxr.exe
  C:\Windows\System\JTLpMxr.exe
  2⤵
  PID:6072
- C:\Windows\System\EJsTlrI.exe
  C:\Windows\System\EJsTlrI.exe
  2⤵
  PID:5200
- C:\Windows\System\WxeRuzf.exe
  C:\Windows\System\WxeRuzf.exe
  2⤵
  PID:5260
- C:\Windows\System\jhYccev.exe
  C:\Windows\System\jhYccev.exe
  2⤵
  PID:4888
- C:\Windows\System\lRSWYyZ.exe
  C:\Windows\System\lRSWYyZ.exe
  2⤵
  PID:5396
- C:\Windows\System\HilgKaJ.exe
  C:\Windows\System\HilgKaJ.exe
  2⤵
  PID:5484
- C:\Windows\System\IjQKdhf.exe
  C:\Windows\System\IjQKdhf.exe
  2⤵
  PID:5092
- C:\Windows\System\COUEPSe.exe
  C:\Windows\System\COUEPSe.exe
  2⤵
  PID:5736
- C:\Windows\System\kxJagbL.exe
  C:\Windows\System\kxJagbL.exe
  2⤵
  PID:5792
- C:\Windows\System\OtloFBT.exe
  C:\Windows\System\OtloFBT.exe
  2⤵
  PID:3504
- C:\Windows\System\ZAofrNY.exe
  C:\Windows\System\ZAofrNY.exe
  2⤵
  PID:1568
- C:\Windows\System\ODjPAQl.exe
  C:\Windows\System\ODjPAQl.exe
  2⤵
  PID:4316
- C:\Windows\System\kOdYHIb.exe
  C:\Windows\System\kOdYHIb.exe
  2⤵
  PID:996
- C:\Windows\System\kpJsTaZ.exe
  C:\Windows\System\kpJsTaZ.exe
  2⤵
  PID:1932
- C:\Windows\System\EXuWHNz.exe
  C:\Windows\System\EXuWHNz.exe
  2⤵
  PID:1292
- C:\Windows\System\eHOoDFf.exe
  C:\Windows\System\eHOoDFf.exe
  2⤵
  PID:5392
- C:\Windows\System\uUUAmHK.exe
  C:\Windows\System\uUUAmHK.exe
  2⤵
  PID:748
- C:\Windows\System\GgnJQRR.exe
  C:\Windows\System\GgnJQRR.exe
  2⤵
  PID:5784
- C:\Windows\System\xaMPnmF.exe
  C:\Windows\System\xaMPnmF.exe
  2⤵
  PID:4860
- C:\Windows\System\cvhgSFl.exe
  C:\Windows\System\cvhgSFl.exe
  2⤵
  PID:4644
- C:\Windows\System\KjKCPuK.exe
  C:\Windows\System\KjKCPuK.exe
  2⤵
  PID:5788
- C:\Windows\System\dkrLGZv.exe
  C:\Windows\System\dkrLGZv.exe
  2⤵
  PID:5000
- C:\Windows\System\FyJYAKb.exe
  C:\Windows\System\FyJYAKb.exe
  2⤵
  PID:3444
- C:\Windows\System\vgYwUvU.exe
  C:\Windows\System\vgYwUvU.exe
  2⤵
  PID:5504
- C:\Windows\System\UdXpYha.exe
  C:\Windows\System\UdXpYha.exe
  2⤵
  PID:5680
- C:\Windows\System\WNILCMh.exe
  C:\Windows\System\WNILCMh.exe
  2⤵
  PID:1580
- C:\Windows\System\PyzGtuW.exe
  C:\Windows\System\PyzGtuW.exe
  2⤵
  PID:3696
- C:\Windows\System\dWrVqHs.exe
  C:\Windows\System\dWrVqHs.exe
  2⤵
  PID:6172
- C:\Windows\System\pDNxWBh.exe
  C:\Windows\System\pDNxWBh.exe
  2⤵
  PID:6216
- C:\Windows\System\LdMkHhk.exe
  C:\Windows\System\LdMkHhk.exe
  2⤵
  PID:6232
- C:\Windows\System\CcJHima.exe
  C:\Windows\System\CcJHima.exe
  2⤵
  PID:6256
- C:\Windows\System\MNdZHxq.exe
  C:\Windows\System\MNdZHxq.exe
  2⤵
  PID:6300
- C:\Windows\System\OLtSbaN.exe
  C:\Windows\System\OLtSbaN.exe
  2⤵
  PID:6316
- C:\Windows\System\KlLTXjS.exe
  C:\Windows\System\KlLTXjS.exe
  2⤵
  PID:6336
- C:\Windows\System\qjuLruD.exe
  C:\Windows\System\qjuLruD.exe
  2⤵
  PID:6376
- C:\Windows\System\zONrXfs.exe
  C:\Windows\System\zONrXfs.exe
  2⤵
  PID:6392
- C:\Windows\System\MbIoGtd.exe
  C:\Windows\System\MbIoGtd.exe
  2⤵
  PID:6416
- C:\Windows\System\gMKoPEE.exe
  C:\Windows\System\gMKoPEE.exe
  2⤵
  PID:6436
- C:\Windows\System\gdqdZdx.exe
  C:\Windows\System\gdqdZdx.exe
  2⤵
  PID:6468
- C:\Windows\System\vnAASzQ.exe
  C:\Windows\System\vnAASzQ.exe
  2⤵
  PID:6512
- C:\Windows\System\esqLlzm.exe
  C:\Windows\System\esqLlzm.exe
  2⤵
  PID:6528
- C:\Windows\System\XgRaSfX.exe
  C:\Windows\System\XgRaSfX.exe
  2⤵
  PID:6556
- C:\Windows\System\UcwyIWO.exe
  C:\Windows\System\UcwyIWO.exe
  2⤵
  PID:6576
- C:\Windows\System\XeNfrUJ.exe
  C:\Windows\System\XeNfrUJ.exe
  2⤵
  PID:6608
- C:\Windows\System\AhJSUwk.exe
  C:\Windows\System\AhJSUwk.exe
  2⤵
  PID:6672
- C:\Windows\System\zjJPPGj.exe
  C:\Windows\System\zjJPPGj.exe
  2⤵
  PID:6692
- C:\Windows\System\ebwMnkE.exe
  C:\Windows\System\ebwMnkE.exe
  2⤵
  PID:6728
- C:\Windows\System\ZfGBZJu.exe
  C:\Windows\System\ZfGBZJu.exe
  2⤵
  PID:6748
- C:\Windows\System\UCYSyoA.exe
  C:\Windows\System\UCYSyoA.exe
  2⤵
  PID:6776
- C:\Windows\System\phuuDBF.exe
  C:\Windows\System\phuuDBF.exe
  2⤵
  PID:6792
- C:\Windows\System\ofmJrDO.exe
  C:\Windows\System\ofmJrDO.exe
  2⤵
  PID:6840
- C:\Windows\System\GobelxI.exe
  C:\Windows\System\GobelxI.exe
  2⤵
  PID:6856
- C:\Windows\System\ocTQJSt.exe
  C:\Windows\System\ocTQJSt.exe
  2⤵
  PID:6876
- C:\Windows\System\lGsKaOd.exe
  C:\Windows\System\lGsKaOd.exe
  2⤵
  PID:6908
- C:\Windows\System\oiSHeCn.exe
  C:\Windows\System\oiSHeCn.exe
  2⤵
  PID:6928
- C:\Windows\System\URcVTHv.exe
  C:\Windows\System\URcVTHv.exe
  2⤵
  PID:6976
- C:\Windows\System\zrXyLhG.exe
  C:\Windows\System\zrXyLhG.exe
  2⤵
  PID:6996
- C:\Windows\System\UgSKdpY.exe
  C:\Windows\System\UgSKdpY.exe
  2⤵
  PID:7016
- C:\Windows\System\pLkSUQk.exe
  C:\Windows\System\pLkSUQk.exe
  2⤵
  PID:7036
- C:\Windows\System\cupRjcS.exe
  C:\Windows\System\cupRjcS.exe
  2⤵
  PID:7064
- C:\Windows\System\dmsLtjm.exe
  C:\Windows\System\dmsLtjm.exe
  2⤵
  PID:7104
- C:\Windows\System\PLDiNxP.exe
  C:\Windows\System\PLDiNxP.exe
  2⤵
  PID:7128
- C:\Windows\System\sVceCJy.exe
  C:\Windows\System\sVceCJy.exe
  2⤵
  PID:7164
- C:\Windows\System\dNaqPvk.exe
  C:\Windows\System\dNaqPvk.exe
  2⤵
  PID:4092
- C:\Windows\System\CMsmoSt.exe
  C:\Windows\System\CMsmoSt.exe
  2⤵
  PID:6208
- C:\Windows\System\LEQopsV.exe
  C:\Windows\System\LEQopsV.exe
  2⤵
  PID:6284
- C:\Windows\System\LGZRmtw.exe
  C:\Windows\System\LGZRmtw.exe
  2⤵
  PID:6364
- C:\Windows\System\PqyWEaM.exe
  C:\Windows\System\PqyWEaM.exe
  2⤵
  PID:6428
- C:\Windows\System\sMObCQL.exe
  C:\Windows\System\sMObCQL.exe
  2⤵
  PID:6484
- C:\Windows\System\QSVnjqq.exe
  C:\Windows\System\QSVnjqq.exe
  2⤵
  PID:6536
- C:\Windows\System\zGeHAly.exe
  C:\Windows\System\zGeHAly.exe
  2⤵
  PID:6616
- C:\Windows\System\esDObGh.exe
  C:\Windows\System\esDObGh.exe
  2⤵
  PID:6648
- C:\Windows\System\XIdAnzl.exe
  C:\Windows\System\XIdAnzl.exe
  2⤵
  PID:6720
- C:\Windows\System\IklIwIG.exe
  C:\Windows\System\IklIwIG.exe
  2⤵
  PID:6800
- C:\Windows\System\vhKHgaf.exe
  C:\Windows\System\vhKHgaf.exe
  2⤵
  PID:6820
- C:\Windows\System\HqFvVYY.exe
  C:\Windows\System\HqFvVYY.exe
  2⤵
  PID:6868
- C:\Windows\System\HQbdDJn.exe
  C:\Windows\System\HQbdDJn.exe
  2⤵
  PID:6896
- C:\Windows\System\oPkJUXU.exe
  C:\Windows\System\oPkJUXU.exe
  2⤵
  PID:6968
- C:\Windows\System\rXLeOKI.exe
  C:\Windows\System\rXLeOKI.exe
  2⤵
  PID:7044
- C:\Windows\System\nhMOhZf.exe
  C:\Windows\System\nhMOhZf.exe
  2⤵
  PID:7100
- C:\Windows\System\KXcYaHL.exe
  C:\Windows\System\KXcYaHL.exe
  2⤵
  PID:6168
- C:\Windows\System\sjCUoQV.exe
  C:\Windows\System\sjCUoQV.exe
  2⤵
  PID:6444
- C:\Windows\System\KcCJSmO.exe
  C:\Windows\System\KcCJSmO.exe
  2⤵
  PID:6476
- C:\Windows\System\HWOGSBV.exe
  C:\Windows\System\HWOGSBV.exe
  2⤵
  PID:6600
- C:\Windows\System\jFUcElr.exe
  C:\Windows\System\jFUcElr.exe
  2⤵
  PID:6944
- C:\Windows\System\JXeGPFM.exe
  C:\Windows\System\JXeGPFM.exe
  2⤵
  PID:6160
- C:\Windows\System\XuhYOhU.exe
  C:\Windows\System\XuhYOhU.exe
  2⤵
  PID:7116
- C:\Windows\System\VEISvHs.exe
  C:\Windows\System\VEISvHs.exe
  2⤵
  PID:6572
- C:\Windows\System\EGiAUfQ.exe
  C:\Windows\System\EGiAUfQ.exe
  2⤵
  PID:6824
- C:\Windows\System\QpIWuzx.exe
  C:\Windows\System\QpIWuzx.exe
  2⤵
  PID:7012
- C:\Windows\System\NvHXiGr.exe
  C:\Windows\System\NvHXiGr.exe
  2⤵
  PID:7176
- C:\Windows\System\chTwaDd.exe
  C:\Windows\System\chTwaDd.exe
  2⤵
  PID:7204
- C:\Windows\System\ZyzJOZY.exe
  C:\Windows\System\ZyzJOZY.exe
  2⤵
  PID:7244
- C:\Windows\System\AmrDxjT.exe
  C:\Windows\System\AmrDxjT.exe
  2⤵
  PID:7264
- C:\Windows\System\GcLBrBL.exe
  C:\Windows\System\GcLBrBL.exe
  2⤵
  PID:7288
- C:\Windows\System\TpHmaUO.exe
  C:\Windows\System\TpHmaUO.exe
  2⤵
  PID:7312
- C:\Windows\System\YyNdxJb.exe
  C:\Windows\System\YyNdxJb.exe
  2⤵
  PID:7332
- C:\Windows\System\rvbaeyY.exe
  C:\Windows\System\rvbaeyY.exe
  2⤵
  PID:7368
- C:\Windows\System\dbxWWjK.exe
  C:\Windows\System\dbxWWjK.exe
  2⤵
  PID:7396
- C:\Windows\System\rBHPFOt.exe
  C:\Windows\System\rBHPFOt.exe
  2⤵
  PID:7428
- C:\Windows\System\ZGWHdYX.exe
  C:\Windows\System\ZGWHdYX.exe
  2⤵
  PID:7452
- C:\Windows\System\amqFSLW.exe
  C:\Windows\System\amqFSLW.exe
  2⤵
  PID:7484
- C:\Windows\System\uwBqruy.exe
  C:\Windows\System\uwBqruy.exe
  2⤵
  PID:7500
- C:\Windows\System\FkUZMug.exe
  C:\Windows\System\FkUZMug.exe
  2⤵
  PID:7536
- C:\Windows\System\QemyoML.exe
  C:\Windows\System\QemyoML.exe
  2⤵
  PID:7564
- C:\Windows\System\MEvTKoJ.exe
  C:\Windows\System\MEvTKoJ.exe
  2⤵
  PID:7596
- C:\Windows\System\eeEiudf.exe
  C:\Windows\System\eeEiudf.exe
  2⤵
  PID:7632
- C:\Windows\System\ScoXDdr.exe
  C:\Windows\System\ScoXDdr.exe
  2⤵
  PID:7652
- C:\Windows\System\xLMOSRl.exe
  C:\Windows\System\xLMOSRl.exe
  2⤵
  PID:7684
- C:\Windows\System\KteUMAE.exe
  C:\Windows\System\KteUMAE.exe
  2⤵
  PID:7728
- C:\Windows\System\udMSYTx.exe
  C:\Windows\System\udMSYTx.exe
  2⤵
  PID:7748
- C:\Windows\System\rWfzvNF.exe
  C:\Windows\System\rWfzvNF.exe
  2⤵
  PID:7784
- C:\Windows\System\dDfwbrB.exe
  C:\Windows\System\dDfwbrB.exe
  2⤵
  PID:7800
- C:\Windows\System\FXGAKzz.exe
  C:\Windows\System\FXGAKzz.exe
  2⤵
  PID:7828
- C:\Windows\System\qPciuzo.exe
  C:\Windows\System\qPciuzo.exe
  2⤵
  PID:7852
- C:\Windows\System\WhOGGkM.exe
  C:\Windows\System\WhOGGkM.exe
  2⤵
  PID:7892
- C:\Windows\System\ZmgQkSV.exe
  C:\Windows\System\ZmgQkSV.exe
  2⤵
  PID:7912
- C:\Windows\System\SGzLZVa.exe
  C:\Windows\System\SGzLZVa.exe
  2⤵
  PID:7960
- C:\Windows\System\UhILYmP.exe
  C:\Windows\System\UhILYmP.exe
  2⤵
  PID:7980
- C:\Windows\System\QcFfEXR.exe
  C:\Windows\System\QcFfEXR.exe
  2⤵
  PID:8012
- C:\Windows\System\yQrNeXn.exe
  C:\Windows\System\yQrNeXn.exe
  2⤵
  PID:8032
- C:\Windows\System\mBsziGn.exe
  C:\Windows\System\mBsziGn.exe
  2⤵
  PID:8052
- C:\Windows\System\eQTINgc.exe
  C:\Windows\System\eQTINgc.exe
  2⤵
  PID:8100
- C:\Windows\System\GdOdThK.exe
  C:\Windows\System\GdOdThK.exe
  2⤵
  PID:8120
- C:\Windows\System\qcCeMfO.exe
  C:\Windows\System\qcCeMfO.exe
  2⤵
  PID:8144
- C:\Windows\System\vYThHvg.exe
  C:\Windows\System\vYThHvg.exe
  2⤵
  PID:8164
- C:\Windows\System\dHaSYCY.exe
  C:\Windows\System\dHaSYCY.exe
  2⤵
  PID:8188
- C:\Windows\System\sVrUOrb.exe
  C:\Windows\System\sVrUOrb.exe
  2⤵
  PID:6764
- C:\Windows\System\shETkzI.exe
  C:\Windows\System\shETkzI.exe
  2⤵
  PID:7216
- C:\Windows\System\FoAqCnV.exe
  C:\Windows\System\FoAqCnV.exe
  2⤵
  PID:7272
- C:\Windows\System\EtFSjyk.exe
  C:\Windows\System\EtFSjyk.exe
  2⤵
  PID:7304
- C:\Windows\System\wGbofLS.exe
  C:\Windows\System\wGbofLS.exe
  2⤵
  PID:7360
- C:\Windows\System\tnqzeQo.exe
  C:\Windows\System\tnqzeQo.exe
  2⤵
  PID:7448
- C:\Windows\System\uigGkPM.exe
  C:\Windows\System\uigGkPM.exe
  2⤵
  PID:7480
- C:\Windows\System\onnJHSB.exe
  C:\Windows\System\onnJHSB.exe
  2⤵
  PID:7592
- C:\Windows\System\iTLWdgW.exe
  C:\Windows\System\iTLWdgW.exe
  2⤵
  PID:7648
- C:\Windows\System\YBTnNQY.exe
  C:\Windows\System\YBTnNQY.exe
  2⤵
  PID:7744
- C:\Windows\System\tsBdonk.exe
  C:\Windows\System\tsBdonk.exe
  2⤵
  PID:7840
- C:\Windows\System\tkVInfM.exe
  C:\Windows\System\tkVInfM.exe
  2⤵
  PID:7940
- C:\Windows\System\BbCTySh.exe
  C:\Windows\System\BbCTySh.exe
  2⤵
  PID:7972
- C:\Windows\System\KMSQZRB.exe
  C:\Windows\System\KMSQZRB.exe
  2⤵
  PID:8024
- C:\Windows\System\nMqvkdT.exe
  C:\Windows\System\nMqvkdT.exe
  2⤵
  PID:8076
- C:\Windows\System\HnPGwok.exe
  C:\Windows\System\HnPGwok.exe
  2⤵
  PID:8140
- C:\Windows\System\llnhMbd.exe
  C:\Windows\System\llnhMbd.exe
  2⤵
  PID:8184
- C:\Windows\System\kmmZmls.exe
  C:\Windows\System\kmmZmls.exe
  2⤵
  PID:7340
- C:\Windows\System\rchNOuV.exe
  C:\Windows\System\rchNOuV.exe
  2⤵
  PID:7408
- C:\Windows\System\uGhpsuK.exe
  C:\Windows\System\uGhpsuK.exe
  2⤵
  PID:7472
- C:\Windows\System\DwFwxnu.exe
  C:\Windows\System\DwFwxnu.exe
  2⤵
  PID:7920
- C:\Windows\System\HfuZATf.exe
  C:\Windows\System\HfuZATf.exe
  2⤵
  PID:7976
- C:\Windows\System\rQPNACd.exe
  C:\Windows\System\rQPNACd.exe
  2⤵
  PID:8060
- C:\Windows\System\ekDQQle.exe
  C:\Windows\System\ekDQQle.exe
  2⤵
  PID:8132
- C:\Windows\System\bmhbHDK.exe
  C:\Windows\System\bmhbHDK.exe
  2⤵
  PID:6524
- C:\Windows\System\ZiYcjhb.exe
  C:\Windows\System\ZiYcjhb.exe
  2⤵
  PID:7512
- C:\Windows\System\arNUUtL.exe
  C:\Windows\System\arNUUtL.exe
  2⤵
  PID:7716
- C:\Windows\System\JRzxkMP.exe
  C:\Windows\System\JRzxkMP.exe
  2⤵
  PID:8004
- C:\Windows\System\IAODiUA.exe
  C:\Windows\System\IAODiUA.exe
  2⤵
  PID:7880
- C:\Windows\System\LyFqIkd.exe
  C:\Windows\System\LyFqIkd.exe
  2⤵
  PID:8224
- C:\Windows\System\mpEBWOP.exe
  C:\Windows\System\mpEBWOP.exe
  2⤵
  PID:8256
- C:\Windows\System\IIsjjNZ.exe
  C:\Windows\System\IIsjjNZ.exe
  2⤵
  PID:8280
- C:\Windows\System\VyiRXSl.exe
  C:\Windows\System\VyiRXSl.exe
  2⤵
  PID:8300
- C:\Windows\System\TRFAqhy.exe
  C:\Windows\System\TRFAqhy.exe
  2⤵
  PID:8324
- C:\Windows\System\jeQcmJx.exe
  C:\Windows\System\jeQcmJx.exe
  2⤵
  PID:8344
- C:\Windows\System\XIljGcn.exe
  C:\Windows\System\XIljGcn.exe
  2⤵
  PID:8360
- C:\Windows\System\VmaDeGz.exe
  C:\Windows\System\VmaDeGz.exe
  2⤵
  PID:8384
- C:\Windows\System\HusjCOP.exe
  C:\Windows\System\HusjCOP.exe
  2⤵
  PID:8404
- C:\Windows\System\dnMKdKl.exe
  C:\Windows\System\dnMKdKl.exe
  2⤵
  PID:8432
- C:\Windows\System\eZYHijU.exe
  C:\Windows\System\eZYHijU.exe
  2⤵
  PID:8460
- C:\Windows\System\ricMtAq.exe
  C:\Windows\System\ricMtAq.exe
  2⤵
  PID:8516
- C:\Windows\System\EDGZOJo.exe
  C:\Windows\System\EDGZOJo.exe
  2⤵
  PID:8560
- C:\Windows\System\NhyeDIL.exe
  C:\Windows\System\NhyeDIL.exe
  2⤵
  PID:8576
- C:\Windows\System\QGNMZLY.exe
  C:\Windows\System\QGNMZLY.exe
  2⤵
  PID:8596
- C:\Windows\System\LZvAcPW.exe
  C:\Windows\System\LZvAcPW.exe
  2⤵
  PID:8620
- C:\Windows\System\StvQKgI.exe
  C:\Windows\System\StvQKgI.exe
  2⤵
  PID:8644
- C:\Windows\System\DGhCUam.exe
  C:\Windows\System\DGhCUam.exe
  2⤵
  PID:8692
- C:\Windows\System\jSkwMsa.exe
  C:\Windows\System\jSkwMsa.exe
  2⤵
  PID:8716
- C:\Windows\System\kqcAHhK.exe
  C:\Windows\System\kqcAHhK.exe
  2⤵
  PID:8744
- C:\Windows\System\kjBvZvL.exe
  C:\Windows\System\kjBvZvL.exe
  2⤵
  PID:8764
- C:\Windows\System\JattDJX.exe
  C:\Windows\System\JattDJX.exe
  2⤵
  PID:8788
- C:\Windows\System\BRvaWzl.exe
  C:\Windows\System\BRvaWzl.exe
  2⤵
  PID:8808
- C:\Windows\System\jAtmvpV.exe
  C:\Windows\System\jAtmvpV.exe
  2⤵
  PID:8848
- C:\Windows\System\VdwuASQ.exe
  C:\Windows\System\VdwuASQ.exe
  2⤵
  PID:8868
- C:\Windows\System\tZfYQdA.exe
  C:\Windows\System\tZfYQdA.exe
  2⤵
  PID:8888
- C:\Windows\System\yzEvhHW.exe
  C:\Windows\System\yzEvhHW.exe
  2⤵
  PID:8912
- C:\Windows\System\kkSOHKx.exe
  C:\Windows\System\kkSOHKx.exe
  2⤵
  PID:8936
- C:\Windows\System\qwuJpmM.exe
  C:\Windows\System\qwuJpmM.exe
  2⤵
  PID:8960
- C:\Windows\System\AjnBcRN.exe
  C:\Windows\System\AjnBcRN.exe
  2⤵
  PID:8996
- C:\Windows\System\LnlMAkr.exe
  C:\Windows\System\LnlMAkr.exe
  2⤵
  PID:9016
- C:\Windows\System\hiykauf.exe
  C:\Windows\System\hiykauf.exe
  2⤵
  PID:9036
- C:\Windows\System\eGYChpN.exe
  C:\Windows\System\eGYChpN.exe
  2⤵
  PID:9064
- C:\Windows\System\wnSMwzS.exe
  C:\Windows\System\wnSMwzS.exe
  2⤵
  PID:9092
- C:\Windows\System\AryCmZq.exe
  C:\Windows\System\AryCmZq.exe
  2⤵
  PID:9120
- C:\Windows\System\mXoYfvV.exe
  C:\Windows\System\mXoYfvV.exe
  2⤵
  PID:9144
- C:\Windows\System\VlnoLSm.exe
  C:\Windows\System\VlnoLSm.exe
  2⤵
  PID:9160
- C:\Windows\System\PqBXJxr.exe
  C:\Windows\System\PqBXJxr.exe
  2⤵
  PID:8160
- C:\Windows\System\QMZyaWi.exe
  C:\Windows\System\QMZyaWi.exe
  2⤵
  PID:8320
- C:\Windows\System\PayWiOI.exe
  C:\Windows\System\PayWiOI.exe
  2⤵
  PID:8424
- C:\Windows\System\rDLMkEs.exe
  C:\Windows\System\rDLMkEs.exe
  2⤵
  PID:8480
- C:\Windows\System\LQCpppv.exe
  C:\Windows\System\LQCpppv.exe
  2⤵
  PID:8508
- C:\Windows\System\rYjWdYx.exe
  C:\Windows\System\rYjWdYx.exe
  2⤵
  PID:8552
- C:\Windows\System\mAbskKR.exe
  C:\Windows\System\mAbskKR.exe
  2⤵
  PID:8628
- C:\Windows\System\DyHmnHD.exe
  C:\Windows\System\DyHmnHD.exe
  2⤵
  PID:8708
- C:\Windows\System\eSClWRJ.exe
  C:\Windows\System\eSClWRJ.exe
  2⤵
  PID:8688
- C:\Windows\System\XEoLLmj.exe
  C:\Windows\System\XEoLLmj.exe
  2⤵
  PID:8844
- C:\Windows\System\kYKgqtq.exe
  C:\Windows\System\kYKgqtq.exe
  2⤵
  PID:8884
- C:\Windows\System\tpGpQNd.exe
  C:\Windows\System\tpGpQNd.exe
  2⤵
  PID:8952
- C:\Windows\System\qlvZEkU.exe
  C:\Windows\System\qlvZEkU.exe
  2⤵
  PID:8980
- C:\Windows\System\hRaCqDO.exe
  C:\Windows\System\hRaCqDO.exe
  2⤵
  PID:9004
- C:\Windows\System\JVSTIZd.exe
  C:\Windows\System\JVSTIZd.exe
  2⤵
  PID:9084
- C:\Windows\System\MoTzpwi.exe
  C:\Windows\System\MoTzpwi.exe
  2⤵
  PID:9152
- C:\Windows\System\wKlgNHm.exe
  C:\Windows\System\wKlgNHm.exe
  2⤵
  PID:8244
- C:\Windows\System\vaIAXtE.exe
  C:\Windows\System\vaIAXtE.exe
  2⤵
  PID:7952
- C:\Windows\System\hZjXQmX.exe
  C:\Windows\System\hZjXQmX.exe
  2⤵
  PID:8448
- C:\Windows\System\vzuBFEF.exe
  C:\Windows\System\vzuBFEF.exe
  2⤵
  PID:8536
- C:\Windows\System\bwvscNj.exe
  C:\Windows\System\bwvscNj.exe
  2⤵
  PID:8660
- C:\Windows\System\PixhBec.exe
  C:\Windows\System\PixhBec.exe
  2⤵
  PID:8908
- C:\Windows\System\pYvBMqM.exe
  C:\Windows\System\pYvBMqM.exe
  2⤵
  PID:9052
- C:\Windows\System\MyIIylS.exe
  C:\Windows\System\MyIIylS.exe
  2⤵
  PID:9172
- C:\Windows\System\kVDPLCR.exe
  C:\Windows\System\kVDPLCR.exe
  2⤵
  PID:8220
- C:\Windows\System\qIlyfdx.exe
  C:\Windows\System\qIlyfdx.exe
  2⤵
  PID:8400
- C:\Windows\System\mtbfZqP.exe
  C:\Windows\System\mtbfZqP.exe
  2⤵
  PID:8616
- C:\Windows\System\qkgCriy.exe
  C:\Windows\System\qkgCriy.exe
  2⤵
  PID:9240
- C:\Windows\System\jdYAnbX.exe
  C:\Windows\System\jdYAnbX.exe
  2⤵
  PID:9296
- C:\Windows\System\MyXieSg.exe
  C:\Windows\System\MyXieSg.exe
  2⤵
  PID:9316
- C:\Windows\System\XwNaJXu.exe
  C:\Windows\System\XwNaJXu.exe
  2⤵
  PID:9340
- C:\Windows\System\UWKvLON.exe
  C:\Windows\System\UWKvLON.exe
  2⤵
  PID:9360
- C:\Windows\System\bWVQgHE.exe
  C:\Windows\System\bWVQgHE.exe
  2⤵
  PID:9400
- C:\Windows\System\aKuGAvD.exe
  C:\Windows\System\aKuGAvD.exe
  2⤵
  PID:9440
- C:\Windows\System\BAVTHvR.exe
  C:\Windows\System\BAVTHvR.exe
  2⤵
  PID:9480
- C:\Windows\System\IrkqUzm.exe
  C:\Windows\System\IrkqUzm.exe
  2⤵
  PID:9500
- C:\Windows\System\GLBjLzk.exe
  C:\Windows\System\GLBjLzk.exe
  2⤵
  PID:9520
- C:\Windows\System\nqNpMau.exe
  C:\Windows\System\nqNpMau.exe
  2⤵
  PID:9540
- C:\Windows\System\opxFbeP.exe
  C:\Windows\System\opxFbeP.exe
  2⤵
  PID:9560
- C:\Windows\System\dfLnQIt.exe
  C:\Windows\System\dfLnQIt.exe
  2⤵
  PID:9584
- C:\Windows\System\yTCHGQL.exe
  C:\Windows\System\yTCHGQL.exe
  2⤵
  PID:9616
- C:\Windows\System\pyGxqQe.exe
  C:\Windows\System\pyGxqQe.exe
  2⤵
  PID:9648
- C:\Windows\System\ZdUoQDt.exe
  C:\Windows\System\ZdUoQDt.exe
  2⤵
  PID:9712
- C:\Windows\System\eJDUQjq.exe
  C:\Windows\System\eJDUQjq.exe
  2⤵
  PID:9736
- C:\Windows\System\tlDQMig.exe
  C:\Windows\System\tlDQMig.exe
  2⤵
  PID:9756
- C:\Windows\System\OKurjds.exe
  C:\Windows\System\OKurjds.exe
  2⤵
  PID:9776
- C:\Windows\System\ZLhecRC.exe
  C:\Windows\System\ZLhecRC.exe
  2⤵
  PID:9804
- C:\Windows\System\wXyvuBa.exe
  C:\Windows\System\wXyvuBa.exe
  2⤵
  PID:9860
- C:\Windows\System\RqObNGy.exe
  C:\Windows\System\RqObNGy.exe
  2⤵
  PID:9900
- C:\Windows\System\HXnDIhR.exe
  C:\Windows\System\HXnDIhR.exe
  2⤵
  PID:9932
- C:\Windows\System\qbySYmL.exe
  C:\Windows\System\qbySYmL.exe
  2⤵
  PID:9948
- C:\Windows\System\JCimWdy.exe
  C:\Windows\System\JCimWdy.exe
  2⤵
  PID:9972
- C:\Windows\System\FjTJKuC.exe
  C:\Windows\System\FjTJKuC.exe
  2⤵
  PID:10048
- C:\Windows\System\SlKIuFT.exe
  C:\Windows\System\SlKIuFT.exe
  2⤵
  PID:10064
- C:\Windows\System\nCoEzFb.exe
  C:\Windows\System\nCoEzFb.exe
  2⤵
  PID:10084
- C:\Windows\System\sDzhEeq.exe
  C:\Windows\System\sDzhEeq.exe
  2⤵
  PID:10100
- C:\Windows\System\SWzBgAm.exe
  C:\Windows\System\SWzBgAm.exe
  2⤵
  PID:10116
- C:\Windows\System\rnpuRjZ.exe
  C:\Windows\System\rnpuRjZ.exe
  2⤵
  PID:10132
- C:\Windows\System\qjZsFRA.exe
  C:\Windows\System\qjZsFRA.exe
  2⤵
  PID:10148
- C:\Windows\System\mmgxjHD.exe
  C:\Windows\System\mmgxjHD.exe
  2⤵
  PID:10164
- C:\Windows\System\LGbXhkl.exe
  C:\Windows\System\LGbXhkl.exe
  2⤵
  PID:10180
- C:\Windows\System\oXlKIxx.exe
  C:\Windows\System\oXlKIxx.exe
  2⤵
  PID:10208
- C:\Windows\System\rlCKmuK.exe
  C:\Windows\System\rlCKmuK.exe
  2⤵
  PID:10224
- C:\Windows\System\iYctilu.exe
  C:\Windows\System\iYctilu.exe
  2⤵
  PID:8380
- C:\Windows\System\FFzuiDc.exe
  C:\Windows\System\FFzuiDc.exe
  2⤵
  PID:9044
- C:\Windows\System\IleMCBQ.exe
  C:\Windows\System\IleMCBQ.exe
  2⤵
  PID:9228
- C:\Windows\System\PgnxBBS.exe
  C:\Windows\System\PgnxBBS.exe
  2⤵
  PID:9456
- C:\Windows\System\sVNQnDy.exe
  C:\Windows\System\sVNQnDy.exe
  2⤵
  PID:9488
- C:\Windows\System\kmOoRYn.exe
  C:\Windows\System\kmOoRYn.exe
  2⤵
  PID:9536
- C:\Windows\System\rkxEzEG.exe
  C:\Windows\System\rkxEzEG.exe
  2⤵
  PID:2976
- C:\Windows\System\tRkUpvP.exe
  C:\Windows\System\tRkUpvP.exe
  2⤵
  PID:9844
- C:\Windows\System\nSOdpmX.exe
  C:\Windows\System\nSOdpmX.exe
  2⤵
  PID:9868
- C:\Windows\System\uAIvepY.exe
  C:\Windows\System\uAIvepY.exe
  2⤵
  PID:9988
- C:\Windows\System\YpztNlh.exe
  C:\Windows\System\YpztNlh.exe
  2⤵
  PID:9832
- C:\Windows\System\RAkwOtf.exe
  C:\Windows\System\RAkwOtf.exe
  2⤵
  PID:9924
- C:\Windows\System\LHygMvR.exe
  C:\Windows\System\LHygMvR.exe
  2⤵
  PID:9996
- C:\Windows\System\woGfAAg.exe
  C:\Windows\System\woGfAAg.exe
  2⤵
  PID:10004
- C:\Windows\System\pHzCPfU.exe
  C:\Windows\System\pHzCPfU.exe
  2⤵
  PID:10012
- C:\Windows\System\uzeLuNF.exe
  C:\Windows\System\uzeLuNF.exe
  2⤵
  PID:10024
- C:\Windows\System\VMrYoPF.exe
  C:\Windows\System\VMrYoPF.exe
  2⤵
  PID:10196
- C:\Windows\System\WByqqsf.exe
  C:\Windows\System\WByqqsf.exe
  2⤵
  PID:9280
- C:\Windows\System\SXQcwPI.exe
  C:\Windows\System\SXQcwPI.exe
  2⤵
  PID:9664
- C:\Windows\System\lerpbll.exe
  C:\Windows\System\lerpbll.exe
  2⤵
  PID:9836
- C:\Windows\System\DYpeflq.exe
  C:\Windows\System\DYpeflq.exe
  2⤵
  PID:9992
- C:\Windows\System\owOTEFu.exe
  C:\Windows\System\owOTEFu.exe
  2⤵
  PID:9824
- C:\Windows\System\iHxNBxr.exe
  C:\Windows\System\iHxNBxr.exe
  2⤵
  PID:10160
- C:\Windows\System\akRSXwD.exe
  C:\Windows\System\akRSXwD.exe
  2⤵
  PID:10108
- C:\Windows\System\tAzMgeC.exe
  C:\Windows\System\tAzMgeC.exe
  2⤵
  PID:8568
- C:\Windows\System\RBZAgnF.exe
  C:\Windows\System\RBZAgnF.exe
  2⤵
  PID:4804
- C:\Windows\System\uMqRpea.exe
  C:\Windows\System\uMqRpea.exe
  2⤵
  PID:9856
- C:\Windows\System\iRHKnSn.exe
  C:\Windows\System\iRHKnSn.exe
  2⤵
  PID:9896
- C:\Windows\System\kygQMXk.exe
  C:\Windows\System\kygQMXk.exe
  2⤵
  PID:10112
- C:\Windows\System\cTHfEUQ.exe
  C:\Windows\System\cTHfEUQ.exe
  2⤵
  PID:9548
- C:\Windows\System\VTakWJT.exe
  C:\Windows\System\VTakWJT.exe
  2⤵
  PID:9008
- C:\Windows\System\EPRFMoG.exe
  C:\Windows\System\EPRFMoG.exe
  2⤵
  PID:10244
- C:\Windows\System\zPPGIIJ.exe
  C:\Windows\System\zPPGIIJ.exe
  2⤵
  PID:10264
- C:\Windows\System\SnrWXcG.exe
  C:\Windows\System\SnrWXcG.exe
  2⤵
  PID:10284
- C:\Windows\System\XpPTDql.exe
  C:\Windows\System\XpPTDql.exe
  2⤵
  PID:10312
- C:\Windows\System\KsOzExc.exe
  C:\Windows\System\KsOzExc.exe
  2⤵
  PID:10332
- C:\Windows\System\JVEfMLv.exe
  C:\Windows\System\JVEfMLv.exe
  2⤵
  PID:10352
- C:\Windows\System\RasUhNw.exe
  C:\Windows\System\RasUhNw.exe
  2⤵
  PID:10368
- C:\Windows\System\uFgKdCN.exe
  C:\Windows\System\uFgKdCN.exe
  2⤵
  PID:10392
- C:\Windows\System\NZeEiTj.exe
  C:\Windows\System\NZeEiTj.exe
  2⤵
  PID:10440
- C:\Windows\System\QaQKZgv.exe
  C:\Windows\System\QaQKZgv.exe
  2⤵
  PID:10456
- C:\Windows\System\WOCKeiJ.exe
  C:\Windows\System\WOCKeiJ.exe
  2⤵
  PID:10480
- C:\Windows\System\qoonRRE.exe
  C:\Windows\System\qoonRRE.exe
  2⤵
  PID:10524
- C:\Windows\System\BEfdsPF.exe
  C:\Windows\System\BEfdsPF.exe
  2⤵
  PID:10540
- C:\Windows\System\aVYWUle.exe
  C:\Windows\System\aVYWUle.exe
  2⤵
  PID:10564
- C:\Windows\System\JAYScnk.exe
  C:\Windows\System\JAYScnk.exe
  2⤵
  PID:10604
- C:\Windows\System\GJbNOIi.exe
  C:\Windows\System\GJbNOIi.exe
  2⤵
  PID:10624
- C:\Windows\System\tWUzrLd.exe
  C:\Windows\System\tWUzrLd.exe
  2⤵
  PID:10672
- C:\Windows\System\ilFqTfd.exe
  C:\Windows\System\ilFqTfd.exe
  2⤵
  PID:10748
- C:\Windows\System\IILcZKc.exe
  C:\Windows\System\IILcZKc.exe
  2⤵
  PID:10764
- C:\Windows\System\BWrDIaL.exe
  C:\Windows\System\BWrDIaL.exe
  2⤵
  PID:10792
- C:\Windows\System\OFCbcwZ.exe
  C:\Windows\System\OFCbcwZ.exe
  2⤵
  PID:10820
- C:\Windows\System\tvIgNfG.exe
  C:\Windows\System\tvIgNfG.exe
  2⤵
  PID:10840
- C:\Windows\System\vwZSksx.exe
  C:\Windows\System\vwZSksx.exe
  2⤵
  PID:10860
- C:\Windows\System\bdMVaws.exe
  C:\Windows\System\bdMVaws.exe
  2⤵
  PID:10884
- C:\Windows\System\ecTAtCw.exe
  C:\Windows\System\ecTAtCw.exe
  2⤵
  PID:10904
- C:\Windows\System\fxPZvXQ.exe
  C:\Windows\System\fxPZvXQ.exe
  2⤵
  PID:10932
- C:\Windows\System\rbzsCKx.exe
  C:\Windows\System\rbzsCKx.exe
  2⤵
  PID:11028
- C:\Windows\System\TDVGzdF.exe
  C:\Windows\System\TDVGzdF.exe
  2⤵
  PID:11052
- C:\Windows\System\AvSPUhK.exe
  C:\Windows\System\AvSPUhK.exe
  2⤵
  PID:11076
- C:\Windows\System\yTQWfff.exe
  C:\Windows\System\yTQWfff.exe
  2⤵
  PID:11096
- C:\Windows\System\nQEiNus.exe
  C:\Windows\System\nQEiNus.exe
  2⤵
  PID:11116
- C:\Windows\System\GKeHRKV.exe
  C:\Windows\System\GKeHRKV.exe
  2⤵
  PID:11144
- C:\Windows\System\VVsLXoh.exe
  C:\Windows\System\VVsLXoh.exe
  2⤵
  PID:11164
- C:\Windows\System\CDXnRGy.exe
  C:\Windows\System\CDXnRGy.exe
  2⤵
  PID:11184
- C:\Windows\System\mUFbUML.exe
  C:\Windows\System\mUFbUML.exe
  2⤵
  PID:11240
- C:\Windows\System\gyAJpjv.exe
  C:\Windows\System\gyAJpjv.exe
  2⤵
  PID:10036
- C:\Windows\System\FOUrrCq.exe
  C:\Windows\System\FOUrrCq.exe
  2⤵
  PID:10256
- C:\Windows\System\kwnaQQf.exe
  C:\Windows\System\kwnaQQf.exe
  2⤵
  PID:10292
- C:\Windows\System\czlwMNT.exe
  C:\Windows\System\czlwMNT.exe
  2⤵
  PID:10364
- C:\Windows\System\hUGZssU.exe
  C:\Windows\System\hUGZssU.exe
  2⤵
  PID:10468
- C:\Windows\System\gMKuvYg.exe
  C:\Windows\System\gMKuvYg.exe
  2⤵
  PID:10496
- C:\Windows\System\RdMouPb.exe
  C:\Windows\System\RdMouPb.exe
  2⤵
  PID:10548
- C:\Windows\System\aYPXbpS.exe
  C:\Windows\System\aYPXbpS.exe
  2⤵
  PID:10720
- C:\Windows\System\tbQElby.exe
  C:\Windows\System\tbQElby.exe
  2⤵
  PID:10788
- C:\Windows\System\gbdFVGV.exe
  C:\Windows\System\gbdFVGV.exe
  2⤵
  PID:10832
- C:\Windows\System\Juvmzxn.exe
  C:\Windows\System\Juvmzxn.exe
  2⤵
  PID:10876
- C:\Windows\System\rPEZENm.exe
  C:\Windows\System\rPEZENm.exe
  2⤵
  PID:10920
- C:\Windows\System\mwjnoUT.exe
  C:\Windows\System\mwjnoUT.exe
  2⤵
  PID:10960
- C:\Windows\System\iCuQKxz.exe
  C:\Windows\System\iCuQKxz.exe
  2⤵
  PID:11024
- C:\Windows\System\Ucidyxo.exe
  C:\Windows\System\Ucidyxo.exe
  2⤵
  PID:11092
- C:\Windows\System\vpTVFrO.exe
  C:\Windows\System\vpTVFrO.exe
  2⤵
  PID:11140
- C:\Windows\System\ixpLDEw.exe
  C:\Windows\System\ixpLDEw.exe
  2⤵
  PID:11224
- C:\Windows\System\KpuLtuY.exe
  C:\Windows\System\KpuLtuY.exe
  2⤵
  PID:10056
- C:\Windows\System\rSeBUJq.exe
  C:\Windows\System\rSeBUJq.exe
  2⤵
  PID:10632
- C:\Windows\System\PTIroFF.exe
  C:\Windows\System\PTIroFF.exe
  2⤵
  PID:2240
- C:\Windows\System\OHDGptn.exe
  C:\Windows\System\OHDGptn.exe
  2⤵
  PID:10856
- C:\Windows\System\HBMRsVe.exe
  C:\Windows\System\HBMRsVe.exe
  2⤵
  PID:11064
- C:\Windows\System\nOkwDIX.exe
  C:\Windows\System\nOkwDIX.exe
  2⤵
  PID:11124
- C:\Windows\System\ySzkPnL.exe
  C:\Windows\System\ySzkPnL.exe
  2⤵
  PID:10512
- C:\Windows\System\qFZzERh.exe
  C:\Windows\System\qFZzERh.exe
  2⤵
  PID:10900
- C:\Windows\System\zxWiqqX.exe
  C:\Windows\System\zxWiqqX.exe
  2⤵
  PID:10192
- C:\Windows\System\OxswvnO.exe
  C:\Windows\System\OxswvnO.exe
  2⤵
  PID:10684
- C:\Windows\System\QMlqUvl.exe
  C:\Windows\System\QMlqUvl.exe
  2⤵
  PID:11136
- C:\Windows\System\HoKGFcL.exe
  C:\Windows\System\HoKGFcL.exe
  2⤵
  PID:11288
- C:\Windows\System\JnqSaXE.exe
  C:\Windows\System\JnqSaXE.exe
  2⤵
  PID:11324
- C:\Windows\System\XnGeZTK.exe
  C:\Windows\System\XnGeZTK.exe
  2⤵
  PID:11356
- C:\Windows\System\htNSpBD.exe
  C:\Windows\System\htNSpBD.exe
  2⤵
  PID:11384
- C:\Windows\System\VJgiMQK.exe
  C:\Windows\System\VJgiMQK.exe
  2⤵
  PID:11404
- C:\Windows\System\sTKIccs.exe
  C:\Windows\System\sTKIccs.exe
  2⤵
  PID:11436
- C:\Windows\System\xJkWSjv.exe
  C:\Windows\System\xJkWSjv.exe
  2⤵
  PID:11476
- C:\Windows\System\ZJqujUQ.exe
  C:\Windows\System\ZJqujUQ.exe
  2⤵
  PID:11500
- C:\Windows\System\vkfUaXB.exe
  C:\Windows\System\vkfUaXB.exe
  2⤵
  PID:11536
- C:\Windows\System\uKQeMmh.exe
  C:\Windows\System\uKQeMmh.exe
  2⤵
  PID:11556
- C:\Windows\System\hFXizmy.exe
  C:\Windows\System\hFXizmy.exe
  2⤵
  PID:11576
- C:\Windows\System\GKTjYbr.exe
  C:\Windows\System\GKTjYbr.exe
  2⤵
  PID:11600
- C:\Windows\System\PqukVwM.exe
  C:\Windows\System\PqukVwM.exe
  2⤵
  PID:11632
- C:\Windows\System\TbqVPJh.exe
  C:\Windows\System\TbqVPJh.exe
  2⤵
  PID:11656
- C:\Windows\System\WrtDFCK.exe
  C:\Windows\System\WrtDFCK.exe
  2⤵
  PID:11700
- C:\Windows\System\rvvQfVv.exe
  C:\Windows\System\rvvQfVv.exe
  2⤵
  PID:11724
- C:\Windows\System\cUKkRst.exe
  C:\Windows\System\cUKkRst.exe
  2⤵
  PID:11740
- C:\Windows\System\lVSeIAS.exe
  C:\Windows\System\lVSeIAS.exe
  2⤵
  PID:11760
- C:\Windows\System\yvGhvjw.exe
  C:\Windows\System\yvGhvjw.exe
  2⤵
  PID:11808
- C:\Windows\System\rzImCJY.exe
  C:\Windows\System\rzImCJY.exe
  2⤵
  PID:11832
- C:\Windows\System\erohpjQ.exe
  C:\Windows\System\erohpjQ.exe
  2⤵
  PID:11856
- C:\Windows\System\xuEzgwE.exe
  C:\Windows\System\xuEzgwE.exe
  2⤵
  PID:11876
- C:\Windows\System\kmbxelx.exe
  C:\Windows\System\kmbxelx.exe
  2⤵
  PID:11896
- C:\Windows\System\rIqsVUF.exe
  C:\Windows\System\rIqsVUF.exe
  2⤵
  PID:11928
- C:\Windows\System\uoEpGke.exe
  C:\Windows\System\uoEpGke.exe
  2⤵
  PID:11988
- C:\Windows\System\tHaaZfc.exe
  C:\Windows\System\tHaaZfc.exe
  2⤵
  PID:12008
- C:\Windows\System\IqGhpWf.exe
  C:\Windows\System\IqGhpWf.exe
  2⤵
  PID:12032
- C:\Windows\System\PMcZKUj.exe
  C:\Windows\System\PMcZKUj.exe
  2⤵
  PID:12052
- C:\Windows\System\ylOAbOY.exe
  C:\Windows\System\ylOAbOY.exe
  2⤵
  PID:12076
- C:\Windows\System\sTGHWix.exe
  C:\Windows\System\sTGHWix.exe
  2⤵
  PID:12092
- C:\Windows\System\CxEpFnC.exe
  C:\Windows\System\CxEpFnC.exe
  2⤵
  PID:12132
- C:\Windows\System\yECZxBs.exe
  C:\Windows\System\yECZxBs.exe
  2⤵
  PID:12172
- C:\Windows\System\RwKjOYZ.exe
  C:\Windows\System\RwKjOYZ.exe
  2⤵
  PID:12200
- C:\Windows\System\ymzhptL.exe
  C:\Windows\System\ymzhptL.exe
  2⤵
  PID:12216
- C:\Windows\System\HIWkPkr.exe
  C:\Windows\System\HIWkPkr.exe
  2⤵
  PID:12236
- C:\Windows\System\TFkbArV.exe
  C:\Windows\System\TFkbArV.exe
  2⤵
  PID:12264
- C:\Windows\System\nFSvoxq.exe
  C:\Windows\System\nFSvoxq.exe
  2⤵
  PID:12284
- C:\Windows\System\cjvBpca.exe
  C:\Windows\System\cjvBpca.exe
  2⤵
  PID:10716
- C:\Windows\System\YMyiatC.exe
  C:\Windows\System\YMyiatC.exe
  2⤵
  PID:11320
- C:\Windows\System\dLqHgnj.exe
  C:\Windows\System\dLqHgnj.exe
  2⤵
  PID:11380
- C:\Windows\System\omqPlOx.exe
  C:\Windows\System\omqPlOx.exe
  2⤵
  PID:11448
- C:\Windows\System\jXQnzns.exe
  C:\Windows\System\jXQnzns.exe
  2⤵
  PID:11528
- C:\Windows\System\ErZzjFI.exe
  C:\Windows\System\ErZzjFI.exe
  2⤵
  PID:11608
- C:\Windows\System\BJiVyAX.exe
  C:\Windows\System\BJiVyAX.exe
  2⤵
  PID:11716
- C:\Windows\System\RCEKicC.exe
  C:\Windows\System\RCEKicC.exe
  2⤵
  PID:11780
- C:\Windows\System\RwtGkQw.exe
  C:\Windows\System\RwtGkQw.exe
  2⤵
  PID:11800
- C:\Windows\System\GntdrVD.exe
  C:\Windows\System\GntdrVD.exe
  2⤵
  PID:11864
- C:\Windows\System\zMwfXww.exe
  C:\Windows\System\zMwfXww.exe
  2⤵
  PID:11964
- C:\Windows\System\xwmfhXW.exe
  C:\Windows\System\xwmfhXW.exe
  2⤵
  PID:11920
- C:\Windows\System\ayAIQAX.exe
  C:\Windows\System\ayAIQAX.exe
  2⤵
  PID:12004
- C:\Windows\System\kwXjEfo.exe
  C:\Windows\System\kwXjEfo.exe
  2⤵
  PID:12048
- C:\Windows\System\gaZblaf.exe
  C:\Windows\System\gaZblaf.exe
  2⤵
  PID:12184
- C:\Windows\System\FkGcHgO.exe
  C:\Windows\System\FkGcHgO.exe
  2⤵
  PID:11260
- C:\Windows\System\tgYujdT.exe
  C:\Windows\System\tgYujdT.exe
  2⤵
  PID:11372
- C:\Windows\System\mdzbWHQ.exe
  C:\Windows\System\mdzbWHQ.exe
  2⤵
  PID:11484
- C:\Windows\System\goEmfXt.exe
  C:\Windows\System\goEmfXt.exe
  2⤵
  PID:1364
- C:\Windows\System\gqdrZxT.exe
  C:\Windows\System\gqdrZxT.exe
  2⤵
  PID:11892
- C:\Windows\System\YjoeHJb.exe
  C:\Windows\System\YjoeHJb.exe
  2⤵
  PID:11848
- C:\Windows\System\rvJgcns.exe
  C:\Windows\System\rvJgcns.exe
  2⤵
  PID:11924
- C:\Windows\System\ngSabJU.exe
  C:\Windows\System\ngSabJU.exe
  2⤵
  PID:12276
- C:\Windows\System\JUMiswD.exe
  C:\Windows\System\JUMiswD.exe
  2⤵
  PID:10700
- C:\Windows\System\CYPSkXg.exe
  C:\Windows\System\CYPSkXg.exe
  2⤵
  PID:11736
- C:\Windows\System\DSJuUTq.exe
  C:\Windows\System\DSJuUTq.exe
  2⤵
  PID:11304
- C:\Windows\System\NRVBUbA.exe
  C:\Windows\System\NRVBUbA.exe
  2⤵
  PID:11872
- C:\Windows\System\UIdZHpv.exe
  C:\Windows\System\UIdZHpv.exe
  2⤵
  PID:12312
- C:\Windows\System\OFHSceC.exe
  C:\Windows\System\OFHSceC.exe
  2⤵
  PID:12336
- C:\Windows\System\BaPhFsT.exe
  C:\Windows\System\BaPhFsT.exe
  2⤵
  PID:12352
- C:\Windows\System\wJcgDAy.exe
  C:\Windows\System\wJcgDAy.exe
  2⤵
  PID:12372
- C:\Windows\System\OXPTaBS.exe
  C:\Windows\System\OXPTaBS.exe
  2⤵
  PID:12396
- C:\Windows\System\hZMIXtY.exe
  C:\Windows\System\hZMIXtY.exe
  2⤵
  PID:12440
- C:\Windows\System\lNZnphi.exe
  C:\Windows\System\lNZnphi.exe
  2⤵
  PID:12468
- C:\Windows\System\PSXfQsN.exe
  C:\Windows\System\PSXfQsN.exe
  2⤵
  PID:12496
- C:\Windows\System\NuDCDJh.exe
  C:\Windows\System\NuDCDJh.exe
  2⤵
  PID:12524
- C:\Windows\System\ncXVWlm.exe
  C:\Windows\System\ncXVWlm.exe
  2⤵
  PID:12544
- C:\Windows\System\bShJjYC.exe
  C:\Windows\System\bShJjYC.exe
  2⤵
  PID:12568
- C:\Windows\System\hEwaUIi.exe
  C:\Windows\System\hEwaUIi.exe
  2⤵
  PID:12584
- C:\Windows\System\bqOTLbz.exe
  C:\Windows\System\bqOTLbz.exe
  2⤵
  PID:12608
- C:\Windows\System\yUHiubS.exe
  C:\Windows\System\yUHiubS.exe
  2⤵
  PID:12668
- C:\Windows\System\FWzlEOr.exe
  C:\Windows\System\FWzlEOr.exe
  2⤵
  PID:12700
- C:\Windows\System\TosWmsw.exe
  C:\Windows\System\TosWmsw.exe
  2⤵
  PID:12728
- C:\Windows\System\sJIGAtt.exe
  C:\Windows\System\sJIGAtt.exe
  2⤵
  PID:12756
- C:\Windows\System\ZGqnqhO.exe
  C:\Windows\System\ZGqnqhO.exe
  2⤵
  PID:12772
- C:\Windows\System\HTjZDwF.exe
  C:\Windows\System\HTjZDwF.exe
  2⤵
  PID:12796
- C:\Windows\System\qODPZvX.exe
  C:\Windows\System\qODPZvX.exe
  2⤵
  PID:12824
- C:\Windows\System\TkKNsfT.exe
  C:\Windows\System\TkKNsfT.exe
  2⤵
  PID:12960
- C:\Windows\System\saJQEZo.exe
  C:\Windows\System\saJQEZo.exe
  2⤵
  PID:12976
- C:\Windows\System\rFKPhtO.exe
  C:\Windows\System\rFKPhtO.exe
  2⤵
  PID:13060
- C:\Windows\System\NUddWch.exe
  C:\Windows\System\NUddWch.exe
  2⤵
  PID:13076
- C:\Windows\System\zvGOuJQ.exe
  C:\Windows\System\zvGOuJQ.exe
  2⤵
  PID:13108
- C:\Windows\System\nsaeSur.exe
  C:\Windows\System\nsaeSur.exe
  2⤵
  PID:13124
- C:\Windows\System\rvchyiz.exe
  C:\Windows\System\rvchyiz.exe
  2⤵
  PID:13140
- C:\Windows\System\UfyzvMb.exe
  C:\Windows\System\UfyzvMb.exe
  2⤵
  PID:13188
- C:\Windows\System\eUDgkXB.exe
  C:\Windows\System\eUDgkXB.exe
  2⤵
  PID:13216
- C:\Windows\System\SBhTUoE.exe
  C:\Windows\System\SBhTUoE.exe
  2⤵
  PID:13248
- C:\Windows\System\NQdCAWL.exe
  C:\Windows\System\NQdCAWL.exe
  2⤵
  PID:13276
- C:\Windows\System\ZAgEFuc.exe
  C:\Windows\System\ZAgEFuc.exe
  2⤵
  PID:13296
- C:\Windows\System\ayVUWXu.exe
  C:\Windows\System\ayVUWXu.exe
  2⤵
  PID:12308
- C:\Windows\System\qkzqZmo.exe
  C:\Windows\System\qkzqZmo.exe
  2⤵
  PID:12344
- C:\Windows\System\NRLqRHF.exe
  C:\Windows\System\NRLqRHF.exe
  2⤵
  PID:12412
- C:\Windows\System\oXbAOya.exe
  C:\Windows\System\oXbAOya.exe
  2⤵
  PID:12432
- C:\Windows\System\OtEDaZH.exe
  C:\Windows\System\OtEDaZH.exe
  2⤵
  PID:12532
- C:\Windows\System\eXAMrfK.exe
  C:\Windows\System\eXAMrfK.exe
  2⤵
  PID:12580
- C:\Windows\System\cJhwaSc.exe
  C:\Windows\System\cJhwaSc.exe
  2⤵
  PID:12652
- C:\Windows\System\wmifTZd.exe
  C:\Windows\System\wmifTZd.exe
  2⤵
  PID:12740
- C:\Windows\System\pHEhewc.exe
  C:\Windows\System\pHEhewc.exe
  2⤵
  PID:12784
- C:\Windows\System\RcXhdRK.exe
  C:\Windows\System\RcXhdRK.exe
  2⤵
  PID:12812
- C:\Windows\System\lwgXzAS.exe
  C:\Windows\System\lwgXzAS.exe
  2⤵
  PID:12924
- C:\Windows\System\tzKmCiK.exe
  C:\Windows\System\tzKmCiK.exe
  2⤵
  PID:12936
- C:\Windows\System\RyGyZsc.exe
  C:\Windows\System\RyGyZsc.exe
  2⤵
  PID:12868
- C:\Windows\System\DKbPPfI.exe
  C:\Windows\System\DKbPPfI.exe
  2⤵
  PID:12992
- C:\Windows\System\DIfvwFa.exe
  C:\Windows\System\DIfvwFa.exe
  2⤵
  PID:13008
- C:\Windows\System\BFHFdka.exe
  C:\Windows\System\BFHFdka.exe
  2⤵
  PID:13052
- C:\Windows\System\WPnQpie.exe
  C:\Windows\System\WPnQpie.exe
  2⤵
  PID:4800
- C:\Windows\System\JEVfvSy.exe
  C:\Windows\System\JEVfvSy.exe
  2⤵
  PID:13116
- C:\Windows\System\eWSMCSR.exe
  C:\Windows\System\eWSMCSR.exe
  2⤵
  PID:13136
- C:\Windows\System\kksTjYY.exe
  C:\Windows\System\kksTjYY.exe
  2⤵
  PID:13208
- C:\Windows\System\gQsvNHr.exe
  C:\Windows\System\gQsvNHr.exe
  2⤵
  PID:13244
- C:\Windows\System\eSgdAkj.exe
  C:\Windows\System\eSgdAkj.exe
  2⤵
  PID:12304
- C:\Windows\System\pOAnJNY.exe
  C:\Windows\System\pOAnJNY.exe
  2⤵
  PID:12392
- C:\Windows\System\GBSeWmF.exe
  C:\Windows\System\GBSeWmF.exe
  2⤵
  PID:12520
- C:\Windows\System\HwccdXj.exe
  C:\Windows\System\HwccdXj.exe
  2⤵
  PID:12940
- C:\Windows\System\sGIhPMb.exe
  C:\Windows\System\sGIhPMb.exe
  2⤵
  PID:13072
- C:\Windows\System\hnTRyHu.exe
  C:\Windows\System\hnTRyHu.exe
  2⤵
  PID:13104
- C:\Windows\System\nYmaRfI.exe
  C:\Windows\System\nYmaRfI.exe
  2⤵
  PID:12296
- C:\Windows\System\ELovySA.exe
  C:\Windows\System\ELovySA.exe
  2⤵
  PID:12696
- C:\Windows\System\byzeZGq.exe
  C:\Windows\System\byzeZGq.exe
  2⤵
  PID:12944
- C:\Windows\System\wIqCFpd.exe
  C:\Windows\System\wIqCFpd.exe
  2⤵
  PID:2424
- C:\Windows\System\zwABwPq.exe
  C:\Windows\System\zwABwPq.exe
  2⤵
  PID:13320
- C:\Windows\System\lzrsazI.exe
  C:\Windows\System\lzrsazI.exe
  2⤵
  PID:13344
- C:\Windows\System\ijlQBsy.exe
  C:\Windows\System\ijlQBsy.exe
  2⤵
  PID:13364
- C:\Windows\System\gMwxQhd.exe
  C:\Windows\System\gMwxQhd.exe
  2⤵
  PID:13380
- C:\Windows\System\idwRAfc.exe
  C:\Windows\System\idwRAfc.exe
  2⤵
  PID:13400
- C:\Windows\System\rlyDSFY.exe
  C:\Windows\System\rlyDSFY.exe
  2⤵
  PID:13420
- C:\Windows\System\vzxFnKN.exe
  C:\Windows\System\vzxFnKN.exe
  2⤵
  PID:13436
- C:\Windows\System\JDvqWbQ.exe
  C:\Windows\System\JDvqWbQ.exe
  2⤵
  PID:13456
- C:\Windows\System\nbidcGD.exe
  C:\Windows\System\nbidcGD.exe
  2⤵
  PID:13476
- C:\Windows\System\VPfgoQK.exe
  C:\Windows\System\VPfgoQK.exe
  2⤵
  PID:13496
- C:\Windows\System\DsezzTd.exe
  C:\Windows\System\DsezzTd.exe
  2⤵
  PID:13520
- C:\Windows\System\TXdQkrG.exe
  C:\Windows\System\TXdQkrG.exe
  2⤵
  PID:13576
- C:\Windows\System\IKSEJfN.exe
  C:\Windows\System\IKSEJfN.exe
  2⤵
  PID:13640
- C:\Windows\System\XjysHUY.exe
  C:\Windows\System\XjysHUY.exe
  2⤵
  PID:13704
- C:\Windows\System\rBmbMbc.exe
  C:\Windows\System\rBmbMbc.exe
  2⤵
  PID:13728
- C:\Windows\System\gOuuEOQ.exe
  C:\Windows\System\gOuuEOQ.exe
  2⤵
  PID:13756
- C:\Windows\System\YIdJMYV.exe
  C:\Windows\System\YIdJMYV.exe
  2⤵
  PID:13772
- C:\Windows\System\leUxOLd.exe
  C:\Windows\System\leUxOLd.exe
  2⤵
  PID:13800
- C:\Windows\System\EEGWehl.exe
  C:\Windows\System\EEGWehl.exe
  2⤵
  PID:13816
- C:\Windows\System\WvasOaa.exe
  C:\Windows\System\WvasOaa.exe
  2⤵
  PID:13836
- C:\Windows\System\EzBqywZ.exe
  C:\Windows\System\EzBqywZ.exe
  2⤵
  PID:13856
- C:\Windows\System\szMqdGl.exe
  C:\Windows\System\szMqdGl.exe
  2⤵
  PID:13884
- C:\Windows\System\iOlZzyI.exe
  C:\Windows\System\iOlZzyI.exe
  2⤵
  PID:13904
- C:\Windows\System\GeugGRu.exe
  C:\Windows\System\GeugGRu.exe
  2⤵
  PID:13964
- C:\Windows\System\ceXrjKi.exe
  C:\Windows\System\ceXrjKi.exe
  2⤵
  PID:13992
- C:\Windows\System\RhrfGEY.exe
  C:\Windows\System\RhrfGEY.exe
  2⤵
  PID:14012
- C:\Windows\System\tyiEphE.exe
  C:\Windows\System\tyiEphE.exe
  2⤵
  PID:14044
- C:\Windows\System\zyYyLub.exe
  C:\Windows\System\zyYyLub.exe
  2⤵
  PID:14060
- C:\Windows\System\obcINHj.exe
  C:\Windows\System\obcINHj.exe
  2⤵
  PID:14084
- C:\Windows\System\klJbfuF.exe
  C:\Windows\System\klJbfuF.exe
  2⤵
  PID:14136
- C:\Windows\System\lminZTA.exe
  C:\Windows\System\lminZTA.exe
  2⤵
  PID:14180
- C:\Windows\System\AEftpAv.exe
  C:\Windows\System\AEftpAv.exe
  2⤵
  PID:14204
- C:\Windows\System\voUrcLC.exe
  C:\Windows\System\voUrcLC.exe
  2⤵
  PID:14228
- C:\Windows\System\peadakf.exe
  C:\Windows\System\peadakf.exe
  2⤵
  PID:14260
- C:\Windows\System\GLbcKZD.exe
  C:\Windows\System\GLbcKZD.exe
  2⤵
  PID:14280
- C:\Windows\System\iMSveXL.exe
  C:\Windows\System\iMSveXL.exe
  2⤵
  PID:12744
- C:\Windows\System\oCDnJpd.exe
  C:\Windows\System\oCDnJpd.exe
  2⤵
  PID:12488
- C:\Windows\System\oqkeBhu.exe
  C:\Windows\System\oqkeBhu.exe
  2⤵
  PID:13376

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4612 -i 4612 -h 428 -j 408 -s 432 -d 13548
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:13660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CVLbPBX.exe

Path C:\Windows\System\CVLbPBX.exe
Size 1.6MB
SHA256 3b959dca042955ecb02b6dd140b7c66dfeb4fd7625f3841e652c03926c42ebec
MD5 635925993e89eb67dae5a5126b9f5497
SHA1 98745c2f73b39d09ae66b4c81688e47d08536ed0
SHA512 a6e696548190a6b37632d98599f716b79e539b7546c954c9a87a8ed9619a4e0ee6f272ab9bc01c7637d68cc4364e7011e8e01107f546003a7dfd9b29b4e5f5b7
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoes:RWWBib356utg1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClPgXgz.exe

Path C:\Windows\System\ClPgXgz.exe
Size 1.6MB
SHA256 f2931b6abbe065e09532455a8e342f33cbadfe96b458f3ea0ab551ef695c067b
MD5 38248858c99e39489387210264bc4f86
SHA1 50f1d4372f169a23dcf74033c54051cbd1c49255
SHA512 55c0bff0e74e50dd742f9eae359171ea548ebfd8b79948c816a60a54542928e408a4d82fafd0534d34672fad434e1805ea480272a1237de563ca692a469f3e46
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoe4:RWWBib356utg5
MD5 SHA1 SHA512 SSDEEP

Submit Download

DgNuUBG.exe

Path C:\Windows\System\DgNuUBG.exe
Size 1.6MB
SHA256 bfb583e41d7420128fd7d501e6c27cf7bd3fdba575081ba8f8d8dbf5964ae8a6
MD5 d2375569c236b15f0cbaf54b27961d9f
SHA1 41995dce7047e1e9f620b361ce23e3a08b01948c
SHA512 ac275b3c0077409e4cc3c9fa18633e1bc76d2c14be6bf7830ea01ec686e149dcaf6ad66aa41f0ce1e4b2eca498b980bfd6e35bd174573f5391782f13324380ab
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeu:RWWBib356utgn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ETePwlF.exe

Path C:\Windows\System\ETePwlF.exe
Size 1.6MB
SHA256 683fac8efdc8f1a98908fb6e640334760f4d0e76ef8b3b1fa2ad9aa3f622de31
MD5 5e58a9cc66398c3a0281ce2c7b69c951
SHA1 7b32e9c32c88a36db70a5607bd92d45a5a811b9c
SHA512 3acb4be99d89f8c62b0a0ea7aae89be1f90ccc9bdc379300fb5748d4be446670e8b6a80da2768c892547fcf4eb18d67bb12bd2747bbc753b9b8c3c96313d0607
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoe5:RWWBib356utgE
MD5 SHA1 SHA512 SSDEEP

Submit Download

HFyNWwY.exe

Path C:\Windows\System\HFyNWwY.exe
Size 1.6MB
SHA256 82423d48beb2d836488fcc5644389453cfac9c8f9d82d85e8673f4ae43003326
MD5 5edb6d9794570dcb6cc1a6a6b11acfea
SHA1 f1297a87421b353e113c9bdc1caac2046f03106e
SHA512 545948ffb58e0822ef73083c73e78c085776f602c91adfdc415b9c6424d4ee010de7aa05bb4670d3e7f5142033949de0dfcb2eb512e56dd6c692543e67bcbc8c
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoe2:RWWBib356utgJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IceazCp.exe

Path C:\Windows\System\IceazCp.exe
Size 1.6MB
SHA256 8ef744669d83b973e3265db23a41d6ec116716955133ce37b330b990d4c87fda
MD5 43e73e40f771803d094213e2f5790f1b
SHA1 8a0a7eee5bca203d6ad3bd928f82b08e8c64829c
SHA512 3ad6253869dafd30fd7f98fcddfafbf04c2867682de1bd5737fcd9dcd11de35969d2bec8ba404240d1cab3f791daaa6b93fa312680bf4ba7c72a4bdb2f9791f0
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeB:RWWBib356utg2
MD5 SHA1 SHA512 SSDEEP

Submit Download

NIKhFXm.exe

Path C:\Windows\System\NIKhFXm.exe
Size 1.6MB
SHA256 dc697b7ed6d66cdd5e8390dd52465b24f9bb1e087b0c6fe0ec981f69a583a207
MD5 874949cee0b3b1a3b43bd9d155d5c603
SHA1 ecf7628ace50078504105d5be39cf0eb7a3e2095
SHA512 6d0a469eb1b9aea0ad40592634c05339df5fc6edc9454952827ba6e550652f1f392e64a3d4d93888deec4093cf2c76075c67455e24786f2f17f3eec58598fe02
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoee:RWWBib356utg3
MD5 SHA1 SHA512 SSDEEP

Submit Download

NxTLGfT.exe

Path C:\Windows\System\NxTLGfT.exe
Size 1.6MB
SHA256 b2e2a689744648ff8e6a8b09ddef218e02e170c2f524a1225f025cd48cb0fef6
MD5 303a2f530115a992ca4ed2ee7d38a7a6
SHA1 6d0110a60d39d95ce779b66b0e4b89261689852a
SHA512 ef0ac668e323cb5a07dce7b1434134c7c59bd93a67f56c6f9189fbf59d296a80a07a24d6247a5cd8f5e6b112284547293aa4a6b6c188ed163882b1d37e375ca3
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeh:RWWBib356utg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

RQpPihx.exe

Path C:\Windows\System\RQpPihx.exe
Size 1.6MB
SHA256 9720f0aff9befe40281ef249f66e78c079589082cc75f4f13b5d7899d0a4f022
MD5 219530dbc3636328fd66a4063d1b31b5
SHA1 7eec1a92f7ca64db4d71d53173d71c3426a2c33a
SHA512 3f05d47b62a89d53e1e2c4ba4e720b6632c12ab85a765444d4e4ee6d881463e6610b34b9ec952a9ed007f7fbbdfb9dfbab61d74458d24e157ed8907a7e73abbb
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeo:RWWBib356utgT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vjaaxqv.exe

Path C:\Windows\System\Vjaaxqv.exe
Size 1.6MB
SHA256 16c20340969fed1e84c44a7048c2f1ffe0000e07ba8b6fd16c8eeaa6f8494c91
MD5 dce5113cc6774d029e2172e4ba659717
SHA1 727f98cf3ecc4d429651fd76e89f9fab72e961c4
SHA512 4a7ce9b46c72fb81264dffb880157a3b94916354369c523e5700f00f46a36484117e614e90787fd563f633386c8c1594d967b5b8cf7b7599e3d6c2402f64191a
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoee:RWWBib356utgr
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindNeN.exe

Path C:\Windows\System\WindNeN.exe
Size 1.6MB
SHA256 d6a77fce816e517fe3d3768b254d305189bd4e1a0d0a6db4e3ef74078a37bb52
MD5 11f50c17657d4d906c63f05eccc0387e
SHA1 aaa98d1d0ed944fb65cd79050cd114da31cb5488
SHA512 c760f7dc7b7756eb8ca15eda2aa50261a964f02e0c3e259a4eae02d4d5baa06af385750ee8defd720c9622c7996ee0323fcf60843adaa61781eefe82b1c9b4af
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoee:RWWBib356utgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

YdnmkEB.exe

Path C:\Windows\System\YdnmkEB.exe
Size 1.6MB
SHA256 dacd95867ff900f63615e6b907abb0e08e69bd3da23ab749ea68d0fc033f81e1
MD5 07c7fef5a44a9cab772ffe393b08cc71
SHA1 1c38cd02248fe47b6b07d54c3b0d82c3d26da827
SHA512 6dfff64774bd7dcb1a3d1674b4691979d21f8e1a93823d0adbd4ddd0bb7959d076b542fabfdd48042c152d48f618903993deb72d9c4f5b2352df174159637973
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoew:RWWBib356utg5
MD5 SHA1 SHA512 SSDEEP

Submit Download

YqNyOIb.exe

Path C:\Windows\System\YqNyOIb.exe
Size 1.6MB
SHA256 29fc4e7f21f32949f2a872f8b3aac27c93a892de19b36f618d118317bdf9f620
MD5 74e92197ab2c4dadbb2468fcc8d410a1
SHA1 e540b4a8f3a03e91028982a6435fa2864464be98
SHA512 8cb6c5bda8ccf715f8c41e49214d3e39a934cb25bc563ae828c469470d7f60593b70ec2ecfedf732c2d0657060d1e7165aeb0860873c1b0c86f3aa4dd5ebf820
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeJ:RWWBib356utgG
MD5 SHA1 SHA512 SSDEEP

Submit Download

YvBJKDB.exe

Path C:\Windows\System\YvBJKDB.exe
Size 1.6MB
SHA256 2ea182f64570f0b7b24f92bd5e236a11d64c26f828a609c64642085207a3a3c6
MD5 b683762fd2387e32f1b01bb97f21ccf8
SHA1 55af137916ceaaf1c12d45aa98f871f44b062819
SHA512 832345b39bd04ded8796944f241c02ddf4cca5ed8a14b4bf44d34dca58bc55017106bbf0eaf283841969379465b09487b8a2b8708e22b90561455be265391001
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeC:RWWBib356utgv
MD5 SHA1 SHA512 SSDEEP

Submit Download

adaKKCo.exe

Path C:\Windows\System\adaKKCo.exe
Size 1.6MB
SHA256 4059fc028a7a9a7bc0edf09988a60c6adbdb06354da7ec74277f11159a62461d
MD5 7c62850af08e2c4467f674297311246f
SHA1 3caffc239172a3bfd43950cf681a4527a4b3d2b7
SHA512 1401bfe05df5a9fb798451935152a00f7b93709794d85e9bda5c6a37c4f56f09b69568458ed23b9fc172ab354104a958f12caf7c070ca8d6ffd96d2b36ef42c5
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeo:RWWBib356utgf
MD5 SHA1 SHA512 SSDEEP

Submit Download

bPkWhfN.exe

Path C:\Windows\System\bPkWhfN.exe
Size 1.6MB
SHA256 40a9c0052384743e6a653de2f8d9665d36bd50f604bb09dc0531999abea79238
MD5 2c5a3bd1af5660397a38ca7f1b4f71e2
SHA1 63744357b2654d678c52736a463065640c12abd3
SHA512 40b55543ca45b55d76c80e12fac632a0fa30d2beeb78d4b269c9324227effc2cb10c687e38563f35134335a026f9bb33468c1663834645e989580a66e1aa7ee7
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoe6:RWWBib356utg9
MD5 SHA1 SHA512 SSDEEP

Submit Download

brtnOrb.exe

Path C:\Windows\System\brtnOrb.exe
Size 1.6MB
SHA256 3c96733d5d58178c17b4d85425144926386e8e03aac15747427c69563fa0d9d3
MD5 139ad9b5aef9f6c56368625355547bd0
SHA1 dfeabf1b40007e8a145b41430278c54ac2903808
SHA512 3ddd79531580115ce3d56cccc398afbcee27b51984dd5478c0ec378ba4f8568fff79200900b53f9497560a81223c2059bb428584f981d0a9b6dd7acfa9fb48fb
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeq:RWWBib356utgn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cFnKQQo.exe

Path C:\Windows\System\cFnKQQo.exe
Size 1.6MB
SHA256 95d792f1db5add4af49814dead5e06b101738d3f98be2cf5827127179a647a80
MD5 298ee043254d533e91e93ea2cfd6d5e1
SHA1 5ac34a00ca56dc82c913a4a21501b24e2ddce1c5
SHA512 f516f051d8d1140132b2a04634283051019e89e9e7f3a1a570ac047ade3caa1f3ed67e60822894e7499a11cd877f6952bcc47754a7957e8bc541a2b93e216e98
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeN:RWWBib356utgm
MD5 SHA1 SHA512 SSDEEP

Submit Download

cxYozgC.exe

Path C:\Windows\System\cxYozgC.exe
Size 1.6MB
SHA256 3ad54f0caac2658b702bbdef9fbdf9be4f317bc026b361708d7213442757432d
MD5 bdf70aeaa2ae179263af3803ed29b0da
SHA1 850ea28437509163ce10673a1a94d7982fe5ce10
SHA512 691486c9f759be869e84b1590649158aa46a643aed8dfc71266d0bf6bb2ac062accc99fad1fb8a8dcd923c7fc4d5afa485cff888fc4089c957083e18101ac81e
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeN:RWWBib356utgq
MD5 SHA1 SHA512 SSDEEP

Submit Download

dRhtIUj.exe

Path C:\Windows\System\dRhtIUj.exe
Size 1.6MB
SHA256 3d765ed2474a22bcd9f55ae61ed895ee459f95fefda0a274a84ab95b6ffcb1d5
MD5 99b403e76f1625f9e59fff44d0ef2a0a
SHA1 41b62a9db80eac04e426950483a20d89b65374c4
SHA512 742527dfe343df43a3f6791311deb7e9b76f58dbac7ab7e2d376c252cc4d323e0472e425018f192762c8273591597903f609ecd274a808252c4355c3814b9122
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoe1:RWWBib356utgI
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhUsLDZ.exe

Path C:\Windows\System\dhUsLDZ.exe
Size 1.6MB
SHA256 0b5a6d3e514b4fc329181c1551f784d8c0c072ed2791853f1a5be094c5d78bfe
MD5 b51737812421fd0ff9403d5527441a1f
SHA1 6f3039d34f77c3e8f01dcf5163590d3df1454b17
SHA512 63d753373051f84e36fed385cb6812ec0791de15ef39d1ee5d375310133a99f2eaf3c5e57958acd13fbb19f1c611690fc75477d7f9ed589b0b4bb448ddd16809
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoet:RWWBib356utg6
MD5 SHA1 SHA512 SSDEEP

Submit Download

fFwStZh.exe

Path C:\Windows\System\fFwStZh.exe
Size 1.6MB
SHA256 7fc90db85de2a0f97b0710677f0ebe74670c8731bb4dae42b0b20a5d97950f36
MD5 51aa16ca5db372f9bdb4843b6b19d4d7
SHA1 3350d16ae198162791b32fd4ea9f22fbbde8ac6d
SHA512 adf36ed157c446d68136a88fc9c6d81695edd0deb624bd0a798fee33c617f697bdfd3f2776f7c499b98bee3089f8280c4c05f55d6cee6cd14024afb0a48a7d22
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeo:RWWBib356utgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

iMYdjVz.exe

Path C:\Windows\System\iMYdjVz.exe
Size 1.6MB
SHA256 11bf8a21b601eb6dc1ca31d0104d20e7e9427b7ad1988d3d4e6c3668e58c8c2f
MD5 42ed6b8aa948f64fbd73ec6786d7e177
SHA1 bb62de390b070c13b7e2a4c795bcad702f021a32
SHA512 ff9a5b07deabe51a78371476055806b325998009805e2f97a38802d3119a3afc4402d75e7482657ca46cb1adfe58a495a7d2c486bb8f8ed8c12a8e97684ee445
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoe6:RWWBib356utg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

iQVHART.exe

Path C:\Windows\System\iQVHART.exe
Size 1.6MB
SHA256 69f8e0281763543f0c3366eb82f2538b59280c2b01454b8c37d953cb65c152b1
MD5 e0a49413620ecd9f6928e070b4f94fb6
SHA1 375c85fa4d525f9ac5befbf40e6afe5048404423
SHA512 1893767be35b0eba68f540ccd895673cf8615d3d775aa823070da08b6eb26ff2ff731aa9f956d94a4be0a2035e4291f116a636729117ebb6d57393ce20424125
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeA:RWWBib356utgn
MD5 SHA1 SHA512 SSDEEP

Submit Download

jovlfeo.exe

Path C:\Windows\System\jovlfeo.exe
Size 1.6MB
SHA256 9a194637a6cff349c9c1c8c8bd07a6c2cf0c09293b91e4850ce0c086a54a69e8
MD5 c4acd893afbedd1d74c912641a669570
SHA1 894826f245336e7c7643875128e56b5f3dba7e7a
SHA512 a5a29843be7a70126e1e540919917ca3c800656d43bb28cf95904793261b2dec88c462e5cc4057ef5bad34aafae235d7d94b16a54a86691c263b2f2668c681de
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeG:RWWBib356utgd
MD5 SHA1 SHA512 SSDEEP

Submit Download

lhmHqXm.exe

Path C:\Windows\System\lhmHqXm.exe
Size 1.6MB
SHA256 321936f77d9f8914882834c0054fa26250631d0536a0fd4f94494426a063c2e4
MD5 ab27c8cf685506eac7b50d4fb77b7f3f
SHA1 a8061840f7145b100f4dcbc7bd78c03b287b2dfa
SHA512 6d5e5f3565ade5f8bf4006d6e01ece4e2250410473e3a885f166805615666c7f29e2235366af574b91a402adbf94666b31a6b46d48ffaf9d24b11c160cf142b0
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoem:RWWBib356utgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

lyVfPBb.exe

Path C:\Windows\System\lyVfPBb.exe
Size 1.6MB
SHA256 a79681cab6b46a185454d1e44db5372cffa2657445c7d28db3db22bb1267e46a
MD5 45651993c97fde7a93b0b7c2dff91aa4
SHA1 005c799711b8fc5b2c5d56f4e0d7f7b8c4d848cc
SHA512 460d44f0a4c4f0d99fb782956b588f007064ffe83571834fc5fba290f5c1a53daf67f65b848719be42f81d6f9ee7cd6e63d1f236390ea5ebd6e3c5bd0e6edf12
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoew:RWWBib356utg1
MD5 SHA1 SHA512 SSDEEP

Submit Download

pgUYKSN.exe

Path C:\Windows\System\pgUYKSN.exe
Size 1.6MB
SHA256 e30a98aa5c7dbe1b3d96f36e3a718f752c1c4bcdf2b38deb3bbbf84d392bcd88
MD5 1c04be5719dcfe49f4741593d6ced577
SHA1 65fccea8b7d276177ce77ea9e691c2b5bf0e445f
SHA512 6c3f8057cba7d755a9fb0bb4c564f15ee2a0ed1ccb1855678854ae3848101b8db2a35e4f1781583a645365955d9dfdf7517ff5e29266d785f8654c2cbb8b9ffb
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeN:RWWBib356utgY
MD5 SHA1 SHA512 SSDEEP

Submit Download

pueawOj.exe

Path C:\Windows\System\pueawOj.exe
Size 1.6MB
SHA256 18c1095e1ad38c7d632e54c87dd16d7213961b7d6d281f72abd9306b45d18f0e
MD5 092ce28689ada88cc41fbae8830caa32
SHA1 97f943362d8f2d8bfa3bd5add7dfd39a92f9ae48
SHA512 10b1a1aa99a8f8e2b3996b3fb6e5210c73747195b98412bf7233939ffeca1f52cb7d915d58fe286bc6ae7ec1dd571855c124dec2887b3707ecb09fe6456f8dea
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeJ:RWWBib356utge
MD5 SHA1 SHA512 SSDEEP

Submit Download

rbbEqxX.exe

Path C:\Windows\System\rbbEqxX.exe
Size 1.6MB
SHA256 71bb9eadf0158d6757a38528de5ea0859cce1d61cbc4b778907cbbcb9855addd
MD5 d3ecc4532814f8204008f374aedf51aa
SHA1 82b92a3c4b2a782006209d3eeca3e77d755701aa
SHA512 145af06b9a0a093413fc900073db8a5abf2ee488582b060ea8250bd8c917400dc4d6cd3b71b4a4c1f7a661a531a9747237d7e460387ef8666411cb89fb4215f1
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoel:RWWBib356utgK
MD5 SHA1 SHA512 SSDEEP

Submit Download

riuokRQ.exe

Path C:\Windows\System\riuokRQ.exe
Size 1.6MB
SHA256 a5b43e208b8d1f5f23e8d3de140bbc9e533a26cd7d56fcf562c639d879b1b01c
MD5 edf0c5eb5069297fb75510f817935953
SHA1 9c8bc272d5874f5d49a2572ce3cd8119d6b11826
SHA512 35c32488201ade0addfdc3a4bbad0efe753adb4d35c7683c631353ddc52a62641ff2084f703a7bf76a26780c0190c3f2c20f6bcb7b320e7892f1ca9376fc0080
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoes:RWWBib356utgD
MD5 SHA1 SHA512 SSDEEP

Submit Download

sklpcxE.exe

Path C:\Windows\System\sklpcxE.exe
Size 1.6MB
SHA256 c58f5cff96d38fb83fa6c0801c2758433ed70717e64bc2e9f9e272baf05b4527
MD5 7a0637e65b9e7bad1f8fa5aca1ee10bb
SHA1 9892ea0c9db103dcdb1e8a58b989aecf108aaa4b
SHA512 4872217dcfca8bdd05de052b5907102b25414098b79aa25f98bd1583bce6d6c2fb25c3561e5779a3acdc50589576bf6e7ba258cf8b67c5f307c20b470fb0814f
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoeh:RWWBib356utge
MD5 SHA1 SHA512 SSDEEP

Submit Download

zGmQnlW.exe

Path C:\Windows\System\zGmQnlW.exe
Size 1.6MB
SHA256 68f3551043b73cb7885c236d16f6d77a0ae440f26e7650865327a51d67559c42
MD5 3fba47d9cee45b792b2582f1d59a7cdc
SHA1 e9ba3bbeb9caace7b17f6b662feb88ee0c74e9a1
SHA512 5b77f60eeee97ed23f14335ba69c7f1fec0087dc5766d31f1dde543bb60338a6e3072d666ea0ff3994469859324ab4303f1ff7c00d7c6595f8a83310da115b72
SSDEEP 49152:ROdWCCi7/raU56uL3pgrCEdM/QxtgPoert:RWWBib356utg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-537-0x00007FF784730000-0x00007FF784A81000-memory.dmp

Download

memory/412-2306-0x00007FF784730000-0x00007FF784A81000-memory.dmp

Download

memory/752-2280-0x00007FF65D9C0000-0x00007FF65DD11000-memory.dmp

Download

memory/752-524-0x00007FF65D9C0000-0x00007FF65DD11000-memory.dmp

Download

memory/1072-2335-0x00007FF645C30000-0x00007FF645F81000-memory.dmp

Download

memory/1072-597-0x00007FF645C30000-0x00007FF645F81000-memory.dmp

Download

memory/1200-2246-0x00007FF687230000-0x00007FF687581000-memory.dmp

Download

memory/1200-8-0x00007FF687230000-0x00007FF687581000-memory.dmp

Download

memory/1200-2272-0x00007FF687230000-0x00007FF687581000-memory.dmp

Download

memory/1220-2304-0x00007FF76E640000-0x00007FF76E991000-memory.dmp

Download

memory/1220-536-0x00007FF76E640000-0x00007FF76E991000-memory.dmp

Download

memory/1272-1-0x0000024D05DE0000-0x0000024D05DF0000-memory.dmp

Download

memory/1272-0-0x00007FF61D690000-0x00007FF61D9E1000-memory.dmp

Download

memory/1444-2302-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp

Download

memory/1444-534-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp

Download

memory/1552-2290-0x00007FF7CAB30000-0x00007FF7CAE81000-memory.dmp

Download

memory/1552-526-0x00007FF7CAB30000-0x00007FF7CAE81000-memory.dmp

Download

memory/1736-531-0x00007FF6C1750000-0x00007FF6C1AA1000-memory.dmp

Download

memory/1736-2282-0x00007FF6C1750000-0x00007FF6C1AA1000-memory.dmp

Download

memory/1940-2274-0x00007FF6F4FD0000-0x00007FF6F5321000-memory.dmp

Download

memory/1940-15-0x00007FF6F4FD0000-0x00007FF6F5321000-memory.dmp

Download

memory/1940-2247-0x00007FF6F4FD0000-0x00007FF6F5321000-memory.dmp

Download

memory/2100-2287-0x00007FF6C7A40000-0x00007FF6C7D91000-memory.dmp

Download

memory/2100-528-0x00007FF6C7A40000-0x00007FF6C7D91000-memory.dmp

Download

memory/2576-2327-0x00007FF6AF180000-0x00007FF6AF4D1000-memory.dmp

Download

memory/2576-577-0x00007FF6AF180000-0x00007FF6AF4D1000-memory.dmp

Download

memory/2648-2292-0x00007FF7D65B0000-0x00007FF7D6901000-memory.dmp

Download

memory/2648-525-0x00007FF7D65B0000-0x00007FF7D6901000-memory.dmp

Download

memory/2752-2366-0x00007FF693CE0000-0x00007FF694031000-memory.dmp

Download

memory/2752-601-0x00007FF693CE0000-0x00007FF694031000-memory.dmp

Download

memory/2784-533-0x00007FF7B29E0000-0x00007FF7B2D31000-memory.dmp

Download

memory/2784-2299-0x00007FF7B29E0000-0x00007FF7B2D31000-memory.dmp

Download

memory/2924-2276-0x00007FF738800000-0x00007FF738B51000-memory.dmp

Download

memory/2924-25-0x00007FF738800000-0x00007FF738B51000-memory.dmp

Download

memory/3088-2288-0x00007FF7B6310000-0x00007FF7B6661000-memory.dmp

Download

memory/3088-527-0x00007FF7B6310000-0x00007FF7B6661000-memory.dmp

Download

memory/3092-548-0x00007FF6998F0000-0x00007FF699C41000-memory.dmp

Download

memory/3092-2308-0x00007FF6998F0000-0x00007FF699C41000-memory.dmp

Download

memory/3596-554-0x00007FF748990000-0x00007FF748CE1000-memory.dmp

Download

memory/3596-2310-0x00007FF748990000-0x00007FF748CE1000-memory.dmp

Download

memory/3820-2301-0x00007FF68F410000-0x00007FF68F761000-memory.dmp

Download

memory/3820-535-0x00007FF68F410000-0x00007FF68F761000-memory.dmp

Download

memory/3992-2314-0x00007FF7C4540000-0x00007FF7C4891000-memory.dmp

Download

memory/3992-569-0x00007FF7C4540000-0x00007FF7C4891000-memory.dmp

Download

memory/4280-2278-0x00007FF6A4730000-0x00007FF6A4A81000-memory.dmp

Download

memory/4280-22-0x00007FF6A4730000-0x00007FF6A4A81000-memory.dmp

Download

memory/4280-2248-0x00007FF6A4730000-0x00007FF6A4A81000-memory.dmp

Download

memory/4332-2329-0x00007FF7AB4F0000-0x00007FF7AB841000-memory.dmp

Download

memory/4332-583-0x00007FF7AB4F0000-0x00007FF7AB841000-memory.dmp

Download

memory/4344-2319-0x00007FF793820000-0x00007FF793B71000-memory.dmp

Download

memory/4344-578-0x00007FF793820000-0x00007FF793B71000-memory.dmp

Download

memory/4448-2284-0x00007FF693F70000-0x00007FF6942C1000-memory.dmp

Download

memory/4448-529-0x00007FF693F70000-0x00007FF6942C1000-memory.dmp

Download

memory/4492-2296-0x00007FF6FEB20000-0x00007FF6FEE71000-memory.dmp

Download

memory/4492-530-0x00007FF6FEB20000-0x00007FF6FEE71000-memory.dmp

Download

memory/4848-2316-0x00007FF7813E0000-0x00007FF781731000-memory.dmp

Download

memory/4848-564-0x00007FF7813E0000-0x00007FF781731000-memory.dmp

Download

memory/4884-2294-0x00007FF6A7090000-0x00007FF6A73E1000-memory.dmp

Download

memory/4884-532-0x00007FF6A7090000-0x00007FF6A73E1000-memory.dmp

Download

memory/5016-2331-0x00007FF618240000-0x00007FF618591000-memory.dmp

Download

memory/5016-588-0x00007FF618240000-0x00007FF618591000-memory.dmp

Download

memory/5072-2312-0x00007FF663F90000-0x00007FF6642E1000-memory.dmp

Download

memory/5072-562-0x00007FF663F90000-0x00007FF6642E1000-memory.dmp

Download