xmrig | b0a3f55d6041159af8bd6d218e3cd759fa3fcbdc0ec2ffa5770d11dd30cc24ab

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
Size 1.1MB
Sample240614-paembszend
SHA256 b0a3f55d6041159af8bd6d218e3cd759fa3fcbdc0ec2ffa5770d11dd30cc24ab
MD5 be15ac74a3dc37f31d6a6f279aa73d70
SHA1 da304fb931f5d6da027a0152d6215442d85d427f
SHA512 b116e79678e6c791571f5cc9da738c2e1c5bfb0657b43016f453642180715cee9d888693055dec91b4e94c3b71ec67ce5e5e29e462c14188121e22b187aa8d5a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XT1:GezaTF8FcNkNdfE0pZ9oztFwIRy11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 16460 created 17148	16460	WerFaultSecure.exe	912

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x00090000000235d8-4.dat	xmrig
behavioral2/files/0x00080000000235db-8.dat	xmrig
behavioral2/files/0x00070000000235df-11.dat	xmrig
behavioral2/files/0x00070000000235e0-19.dat	xmrig
behavioral2/files/0x00070000000235e1-23.dat	xmrig
behavioral2/files/0x00070000000235e4-88.dat	xmrig
behavioral2/files/0x00070000000235f2-107.dat	xmrig
behavioral2/files/0x00070000000235ff-134.dat	xmrig
behavioral2/files/0x00070000000235fe-147.dat	xmrig
behavioral2/files/0x00070000000235ec-158.dat	xmrig
behavioral2/files/0x00070000000235eb-157.dat	xmrig
behavioral2/files/0x00070000000235e9-156.dat	xmrig
behavioral2/files/0x00070000000235e2-149.dat	xmrig
behavioral2/files/0x00070000000235e6-152.dat	xmrig
behavioral2/files/0x00070000000235fc-146.dat	xmrig
behavioral2/files/0x00070000000235f7-145.dat	xmrig
behavioral2/files/0x00070000000235f5-144.dat	xmrig
behavioral2/files/0x00070000000235ef-139.dat	xmrig
behavioral2/files/0x00070000000235ed-138.dat	xmrig
behavioral2/files/0x00070000000235ea-137.dat	xmrig
behavioral2/files/0x00070000000235e3-133.dat	xmrig
behavioral2/files/0x00070000000235f8-131.dat	xmrig
behavioral2/files/0x00070000000235f4-130.dat	xmrig
behavioral2/files/0x00070000000235ee-127.dat	xmrig
behavioral2/files/0x00070000000235fd-120.dat	xmrig
behavioral2/files/0x00070000000235fb-117.dat	xmrig
behavioral2/files/0x00070000000235fa-116.dat	xmrig
behavioral2/files/0x00070000000235f9-114.dat	xmrig
behavioral2/files/0x00070000000235f6-112.dat	xmrig
behavioral2/files/0x00070000000235f1-126.dat	xmrig
behavioral2/files/0x00070000000235f3-105.dat	xmrig
behavioral2/files/0x00070000000235e5-93.dat	xmrig
behavioral2/files/0x00070000000235e8-92.dat	xmrig
behavioral2/files/0x00070000000235f0-102.dat	xmrig
behavioral2/files/0x00070000000235e7-91.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4164	TAjUOZK.exe
1436	dUPnyDq.exe
116	qQkQbsX.exe
4684	VPystwx.exe
2632	MIzEqlm.exe
2268	wgzsIxQ.exe
3164	XVQMbDV.exe
3572	WzPkAcR.exe
4652	GJQPQiM.exe
4192	bEmyViu.exe
3296	maocXjT.exe
1136	ONCgJnW.exe
4320	IahhPAQ.exe
2620	CevlBXr.exe
4416	AttXxdU.exe
2416	FpiZzHl.exe
2488	hqKToxs.exe
4408	ntcNwDW.exe
840	XRPhNBo.exe
5092	JUSoout.exe
3500	xUHTtIY.exe
1768	YyXKITR.exe
4912	EygKXyf.exe
1472	vkGpBVk.exe
4580	WxXikNU.exe
3052	NmXRYXh.exe
2180	OgNzkte.exe
2968	cfQgdeK.exe
2532	tZKStCD.exe
992	mUYoyOI.exe
644	LSdcrxO.exe
2804	QYmauOM.exe
2196	SnoIQvA.exe
2276	PZlthcu.exe
1844	SqGyTtp.exe
3456	zteRnZQ.exe
3420	jXLbKLf.exe
5048	IcByZDb.exe
2888	IQnUBdB.exe
2700	yAEPvIY.exe
4308	CDMfVWF.exe
1964	jvDVRvl.exe
4612	HCRNbbV.exe
4872	ShdHhJr.exe
2592	uamGOnN.exe
1268	UPtHgGY.exe
3300	FecPUqq.exe
3148	ZoCuuCp.exe
968	sZrIVhw.exe
4280	JpvnsJQ.exe
1708	gfsMzCt.exe
4224	nrkahYL.exe
1924	VBJZSnH.exe
1348	xQzRABw.exe
4288	OSJNytg.exe
3748	PlnfiJV.exe
2916	ijOyBoy.exe
4364	jtqqDbE.exe
4236	bXaGnVF.exe
4448	IXXxlLV.exe
1620	pYumJII.exe
2288	HdoOttm.exe
728	vbGYJWg.exe
4440	yLxXjZs.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\WER7490.tmp.WERDataCollectionStatus.txt	WerFaultSecure.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GttBycA.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\EmhapBJ.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\bPVxBOW.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\jvDVRvl.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\IOOzdXA.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\dQEHWYF.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\qpUjzFi.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\wEqeCTz.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\PREOwvs.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\RwcYIEh.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\drEAwxp.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\OSJNytg.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\faGFhGT.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\kwLKoNx.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\LrMKMDc.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\ooNILuE.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\ipDOFVP.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\PWuuOAX.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\gnxNQtz.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\TOHGoGl.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\qgNjyDX.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\zdMHCow.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\fvHZNDk.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\HXkHTVu.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\IotOMyN.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\oLDARzw.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\VHHerMx.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\tHqUmqW.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\NryDLcZ.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\xhWWQSo.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\SVnuyVC.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\amfCQrJ.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\gOMgWEd.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\dUPnyDq.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\VgyGbzh.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\pjdWPWn.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\nKuKvRU.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\mUvaVtE.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\HLbKGiv.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\WFoiffN.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\kvRHGuq.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\FUWwcOi.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\zHfMXuY.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\qeIhnXe.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\iSasogL.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\KuJffwU.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\oOYCeVW.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\HTkOjRR.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\LtTSmrl.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\SvJzgwH.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\gfsMzCt.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\VrpMLfE.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\gGYqqZm.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\RmBiIYK.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\zNQbPRJ.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\mWYpwfe.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\Qppyoha.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\KoWtAlu.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\cHqddcN.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\thRrQxh.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\VObAbay.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\OGZAHHH.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\EqzRfBr.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
File created	C:\Windows\System\QHxfuRJ.exe	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
16648	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4164	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	90
PID 4372 wrote to memory of 4164	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	90
PID 4372 wrote to memory of 1436	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	91
PID 4372 wrote to memory of 1436	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	91
PID 4372 wrote to memory of 116	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	92
PID 4372 wrote to memory of 116	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	92
PID 4372 wrote to memory of 4684	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	93
PID 4372 wrote to memory of 4684	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	93
PID 4372 wrote to memory of 2632	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	94
PID 4372 wrote to memory of 2632	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	94
PID 4372 wrote to memory of 3164	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	95
PID 4372 wrote to memory of 3164	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	95
PID 4372 wrote to memory of 3572	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	96
PID 4372 wrote to memory of 3572	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	96
PID 4372 wrote to memory of 4652	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	97
PID 4372 wrote to memory of 4652	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	97
PID 4372 wrote to memory of 4192	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	98
PID 4372 wrote to memory of 4192	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	98
PID 4372 wrote to memory of 3296	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	99
PID 4372 wrote to memory of 3296	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	99
PID 4372 wrote to memory of 1136	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	100
PID 4372 wrote to memory of 1136	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	100
PID 4372 wrote to memory of 4320	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	101
PID 4372 wrote to memory of 4320	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	101
PID 4372 wrote to memory of 2620	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	102
PID 4372 wrote to memory of 2620	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	102
PID 4372 wrote to memory of 4416	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	103
PID 4372 wrote to memory of 4416	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	103
PID 4372 wrote to memory of 2416	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	104
PID 4372 wrote to memory of 2416	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	104
PID 4372 wrote to memory of 4408	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	105
PID 4372 wrote to memory of 4408	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	105
PID 4372 wrote to memory of 2488	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	106
PID 4372 wrote to memory of 2488	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	106
PID 4372 wrote to memory of 840	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	107
PID 4372 wrote to memory of 840	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	107
PID 4372 wrote to memory of 5092	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	108
PID 4372 wrote to memory of 5092	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	108
PID 4372 wrote to memory of 3500	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	109
PID 4372 wrote to memory of 3500	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	109
PID 4372 wrote to memory of 1768	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	110
PID 4372 wrote to memory of 1768	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	110
PID 4372 wrote to memory of 4912	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	111
PID 4372 wrote to memory of 4912	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	111
PID 4372 wrote to memory of 1472	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	112
PID 4372 wrote to memory of 1472	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	112
PID 4372 wrote to memory of 4580	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	113
PID 4372 wrote to memory of 4580	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	113
PID 4372 wrote to memory of 3052	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	114
PID 4372 wrote to memory of 3052	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	114
PID 4372 wrote to memory of 2180	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	115
PID 4372 wrote to memory of 2180	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	115
PID 4372 wrote to memory of 2968	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	116
PID 4372 wrote to memory of 2968	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	116
PID 4372 wrote to memory of 2532	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	117
PID 4372 wrote to memory of 2532	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	117
PID 4372 wrote to memory of 992	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	118
PID 4372 wrote to memory of 992	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	118
PID 4372 wrote to memory of 644	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	119
PID 4372 wrote to memory of 644	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	119
PID 4372 wrote to memory of 2804	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	120
PID 4372 wrote to memory of 2804	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	120
PID 4372 wrote to memory of 2196	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	121
PID 4372 wrote to memory of 2196	4372	be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\be15ac74a3dc37f31d6a6f279aa73d70_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System\TAjUOZK.exe
  C:\Windows\System\TAjUOZK.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\dUPnyDq.exe
  C:\Windows\System\dUPnyDq.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\qQkQbsX.exe
  C:\Windows\System\qQkQbsX.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\VPystwx.exe
  C:\Windows\System\VPystwx.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\MIzEqlm.exe
  C:\Windows\System\MIzEqlm.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\XVQMbDV.exe
  C:\Windows\System\XVQMbDV.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\WzPkAcR.exe
  C:\Windows\System\WzPkAcR.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\GJQPQiM.exe
  C:\Windows\System\GJQPQiM.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\bEmyViu.exe
  C:\Windows\System\bEmyViu.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\maocXjT.exe
  C:\Windows\System\maocXjT.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\ONCgJnW.exe
  C:\Windows\System\ONCgJnW.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\IahhPAQ.exe
  C:\Windows\System\IahhPAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\CevlBXr.exe
  C:\Windows\System\CevlBXr.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\AttXxdU.exe
  C:\Windows\System\AttXxdU.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\FpiZzHl.exe
  C:\Windows\System\FpiZzHl.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\ntcNwDW.exe
  C:\Windows\System\ntcNwDW.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\hqKToxs.exe
  C:\Windows\System\hqKToxs.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\XRPhNBo.exe
  C:\Windows\System\XRPhNBo.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\JUSoout.exe
  C:\Windows\System\JUSoout.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\xUHTtIY.exe
  C:\Windows\System\xUHTtIY.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\YyXKITR.exe
  C:\Windows\System\YyXKITR.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\EygKXyf.exe
  C:\Windows\System\EygKXyf.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\vkGpBVk.exe
  C:\Windows\System\vkGpBVk.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\WxXikNU.exe
  C:\Windows\System\WxXikNU.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\NmXRYXh.exe
  C:\Windows\System\NmXRYXh.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\OgNzkte.exe
  C:\Windows\System\OgNzkte.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\cfQgdeK.exe
  C:\Windows\System\cfQgdeK.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\tZKStCD.exe
  C:\Windows\System\tZKStCD.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\mUYoyOI.exe
  C:\Windows\System\mUYoyOI.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\LSdcrxO.exe
  C:\Windows\System\LSdcrxO.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\QYmauOM.exe
  C:\Windows\System\QYmauOM.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\SnoIQvA.exe
  C:\Windows\System\SnoIQvA.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\PZlthcu.exe
  C:\Windows\System\PZlthcu.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\wgzsIxQ.exe
  C:\Windows\System\wgzsIxQ.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\SqGyTtp.exe
  C:\Windows\System\SqGyTtp.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\jXLbKLf.exe
  C:\Windows\System\jXLbKLf.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\zteRnZQ.exe
  C:\Windows\System\zteRnZQ.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\IcByZDb.exe
  C:\Windows\System\IcByZDb.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\IQnUBdB.exe
  C:\Windows\System\IQnUBdB.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\yAEPvIY.exe
  C:\Windows\System\yAEPvIY.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\CDMfVWF.exe
  C:\Windows\System\CDMfVWF.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\jvDVRvl.exe
  C:\Windows\System\jvDVRvl.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\HCRNbbV.exe
  C:\Windows\System\HCRNbbV.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\ShdHhJr.exe
  C:\Windows\System\ShdHhJr.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\uamGOnN.exe
  C:\Windows\System\uamGOnN.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\UPtHgGY.exe
  C:\Windows\System\UPtHgGY.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\FecPUqq.exe
  C:\Windows\System\FecPUqq.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\ZoCuuCp.exe
  C:\Windows\System\ZoCuuCp.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\sZrIVhw.exe
  C:\Windows\System\sZrIVhw.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\JpvnsJQ.exe
  C:\Windows\System\JpvnsJQ.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\gfsMzCt.exe
  C:\Windows\System\gfsMzCt.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\nrkahYL.exe
  C:\Windows\System\nrkahYL.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\VBJZSnH.exe
  C:\Windows\System\VBJZSnH.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\xQzRABw.exe
  C:\Windows\System\xQzRABw.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\OSJNytg.exe
  C:\Windows\System\OSJNytg.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\PlnfiJV.exe
  C:\Windows\System\PlnfiJV.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\ijOyBoy.exe
  C:\Windows\System\ijOyBoy.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\jtqqDbE.exe
  C:\Windows\System\jtqqDbE.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\bXaGnVF.exe
  C:\Windows\System\bXaGnVF.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\IXXxlLV.exe
  C:\Windows\System\IXXxlLV.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\pYumJII.exe
  C:\Windows\System\pYumJII.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\HdoOttm.exe
  C:\Windows\System\HdoOttm.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\vbGYJWg.exe
  C:\Windows\System\vbGYJWg.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\yLxXjZs.exe
  C:\Windows\System\yLxXjZs.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\SfkjaVz.exe
  C:\Windows\System\SfkjaVz.exe
  2⤵
  PID:2512
- C:\Windows\System\SxDcicO.exe
  C:\Windows\System\SxDcicO.exe
  2⤵
  PID:1416
- C:\Windows\System\IJEKIjF.exe
  C:\Windows\System\IJEKIjF.exe
  2⤵
  PID:1548
- C:\Windows\System\gMDjJKx.exe
  C:\Windows\System\gMDjJKx.exe
  2⤵
  PID:1724
- C:\Windows\System\MTMLoqA.exe
  C:\Windows\System\MTMLoqA.exe
  2⤵
  PID:1892
- C:\Windows\System\lRMfijp.exe
  C:\Windows\System\lRMfijp.exe
  2⤵
  PID:4664
- C:\Windows\System\amfCQrJ.exe
  C:\Windows\System\amfCQrJ.exe
  2⤵
  PID:3184
- C:\Windows\System\hvmXOeY.exe
  C:\Windows\System\hvmXOeY.exe
  2⤵
  PID:1664
- C:\Windows\System\aYpSEoN.exe
  C:\Windows\System\aYpSEoN.exe
  2⤵
  PID:4996
- C:\Windows\System\fdLRRlH.exe
  C:\Windows\System\fdLRRlH.exe
  2⤵
  PID:2776
- C:\Windows\System\mScoAYX.exe
  C:\Windows\System\mScoAYX.exe
  2⤵
  PID:3920
- C:\Windows\System\PoTmZmh.exe
  C:\Windows\System\PoTmZmh.exe
  2⤵
  PID:1700
- C:\Windows\System\gnxNQtz.exe
  C:\Windows\System\gnxNQtz.exe
  2⤵
  PID:5108
- C:\Windows\System\xXlFSyZ.exe
  C:\Windows\System\xXlFSyZ.exe
  2⤵
  PID:1276
- C:\Windows\System\PqmBdFF.exe
  C:\Windows\System\PqmBdFF.exe
  2⤵
  PID:4512
- C:\Windows\System\mteqePj.exe
  C:\Windows\System\mteqePj.exe
  2⤵
  PID:4348
- C:\Windows\System\wnDlbnG.exe
  C:\Windows\System\wnDlbnG.exe
  2⤵
  PID:5128
- C:\Windows\System\kchVTBg.exe
  C:\Windows\System\kchVTBg.exe
  2⤵
  PID:5144
- C:\Windows\System\sGFgUSp.exe
  C:\Windows\System\sGFgUSp.exe
  2⤵
  PID:5176
- C:\Windows\System\iNRSdrk.exe
  C:\Windows\System\iNRSdrk.exe
  2⤵
  PID:5208
- C:\Windows\System\iSVEuqe.exe
  C:\Windows\System\iSVEuqe.exe
  2⤵
  PID:5240
- C:\Windows\System\jwGcKwo.exe
  C:\Windows\System\jwGcKwo.exe
  2⤵
  PID:5276
- C:\Windows\System\ViHbVbO.exe
  C:\Windows\System\ViHbVbO.exe
  2⤵
  PID:5320
- C:\Windows\System\XOeGkfo.exe
  C:\Windows\System\XOeGkfo.exe
  2⤵
  PID:5344
- C:\Windows\System\SEtIHoq.exe
  C:\Windows\System\SEtIHoq.exe
  2⤵
  PID:5372
- C:\Windows\System\faGFhGT.exe
  C:\Windows\System\faGFhGT.exe
  2⤵
  PID:5400
- C:\Windows\System\VXVgjTZ.exe
  C:\Windows\System\VXVgjTZ.exe
  2⤵
  PID:5420
- C:\Windows\System\FOkPUXU.exe
  C:\Windows\System\FOkPUXU.exe
  2⤵
  PID:5444
- C:\Windows\System\zHfMXuY.exe
  C:\Windows\System\zHfMXuY.exe
  2⤵
  PID:5480
- C:\Windows\System\aPRFlFR.exe
  C:\Windows\System\aPRFlFR.exe
  2⤵
  PID:5512
- C:\Windows\System\qeIhnXe.exe
  C:\Windows\System\qeIhnXe.exe
  2⤵
  PID:5528
- C:\Windows\System\swKzHoB.exe
  C:\Windows\System\swKzHoB.exe
  2⤵
  PID:5544
- C:\Windows\System\IOOzdXA.exe
  C:\Windows\System\IOOzdXA.exe
  2⤵
  PID:5572
- C:\Windows\System\qEgOSVf.exe
  C:\Windows\System\qEgOSVf.exe
  2⤵
  PID:5596
- C:\Windows\System\YGHterR.exe
  C:\Windows\System\YGHterR.exe
  2⤵
  PID:5624
- C:\Windows\System\hBIhiLz.exe
  C:\Windows\System\hBIhiLz.exe
  2⤵
  PID:5656
- C:\Windows\System\aoaDoPW.exe
  C:\Windows\System\aoaDoPW.exe
  2⤵
  PID:5676
- C:\Windows\System\RmtJNxD.exe
  C:\Windows\System\RmtJNxD.exe
  2⤵
  PID:5704
- C:\Windows\System\mqdQQBI.exe
  C:\Windows\System\mqdQQBI.exe
  2⤵
  PID:5728
- C:\Windows\System\xxmgvjq.exe
  C:\Windows\System\xxmgvjq.exe
  2⤵
  PID:5780
- C:\Windows\System\OCgYSoP.exe
  C:\Windows\System\OCgYSoP.exe
  2⤵
  PID:5796
- C:\Windows\System\mWZVnxR.exe
  C:\Windows\System\mWZVnxR.exe
  2⤵
  PID:5824
- C:\Windows\System\OnaRFlC.exe
  C:\Windows\System\OnaRFlC.exe
  2⤵
  PID:5860
- C:\Windows\System\ymtJunX.exe
  C:\Windows\System\ymtJunX.exe
  2⤵
  PID:5884
- C:\Windows\System\ZlNPmwP.exe
  C:\Windows\System\ZlNPmwP.exe
  2⤵
  PID:5900
- C:\Windows\System\rRvHELI.exe
  C:\Windows\System\rRvHELI.exe
  2⤵
  PID:5916
- C:\Windows\System\vYwbirH.exe
  C:\Windows\System\vYwbirH.exe
  2⤵
  PID:5932
- C:\Windows\System\vHntIKG.exe
  C:\Windows\System\vHntIKG.exe
  2⤵
  PID:5964
- C:\Windows\System\nEbeBJv.exe
  C:\Windows\System\nEbeBJv.exe
  2⤵
  PID:5988
- C:\Windows\System\jmWogoi.exe
  C:\Windows\System\jmWogoi.exe
  2⤵
  PID:6028
- C:\Windows\System\QPFhtFn.exe
  C:\Windows\System\QPFhtFn.exe
  2⤵
  PID:6052
- C:\Windows\System\slmaOhH.exe
  C:\Windows\System\slmaOhH.exe
  2⤵
  PID:6088
- C:\Windows\System\eBqGgng.exe
  C:\Windows\System\eBqGgng.exe
  2⤵
  PID:6124
- C:\Windows\System\PHiqvCO.exe
  C:\Windows\System\PHiqvCO.exe
  2⤵
  PID:4304
- C:\Windows\System\NfAgYzm.exe
  C:\Windows\System\NfAgYzm.exe
  2⤵
  PID:5164
- C:\Windows\System\mfTUXHz.exe
  C:\Windows\System\mfTUXHz.exe
  2⤵
  PID:5224
- C:\Windows\System\sAyTjdO.exe
  C:\Windows\System\sAyTjdO.exe
  2⤵
  PID:5316
- C:\Windows\System\LHCLgBl.exe
  C:\Windows\System\LHCLgBl.exe
  2⤵
  PID:5436
- C:\Windows\System\CkFaMcY.exe
  C:\Windows\System\CkFaMcY.exe
  2⤵
  PID:5536
- C:\Windows\System\SvPfPJE.exe
  C:\Windows\System\SvPfPJE.exe
  2⤵
  PID:5588
- C:\Windows\System\COvbcHG.exe
  C:\Windows\System\COvbcHG.exe
  2⤵
  PID:5612
- C:\Windows\System\HVWqWNc.exe
  C:\Windows\System\HVWqWNc.exe
  2⤵
  PID:5724
- C:\Windows\System\FWRLThr.exe
  C:\Windows\System\FWRLThr.exe
  2⤵
  PID:5792
- C:\Windows\System\GcOtOkI.exe
  C:\Windows\System\GcOtOkI.exe
  2⤵
  PID:5840
- C:\Windows\System\vWimetN.exe
  C:\Windows\System\vWimetN.exe
  2⤵
  PID:5876
- C:\Windows\System\lDOSqAm.exe
  C:\Windows\System\lDOSqAm.exe
  2⤵
  PID:5928
- C:\Windows\System\jjuykxv.exe
  C:\Windows\System\jjuykxv.exe
  2⤵
  PID:5976
- C:\Windows\System\STcZeKq.exe
  C:\Windows\System\STcZeKq.exe
  2⤵
  PID:6132
- C:\Windows\System\xuDAJZi.exe
  C:\Windows\System\xuDAJZi.exe
  2⤵
  PID:5264
- C:\Windows\System\ODvlKwa.exe
  C:\Windows\System\ODvlKwa.exe
  2⤵
  PID:5364
- C:\Windows\System\pTUXViS.exe
  C:\Windows\System\pTUXViS.exe
  2⤵
  PID:5440
- C:\Windows\System\xFtdvho.exe
  C:\Windows\System\xFtdvho.exe
  2⤵
  PID:5616
- C:\Windows\System\XSTooGq.exe
  C:\Windows\System\XSTooGq.exe
  2⤵
  PID:5844
- C:\Windows\System\NNcoPAf.exe
  C:\Windows\System\NNcoPAf.exe
  2⤵
  PID:5908
- C:\Windows\System\UHQKWTA.exe
  C:\Windows\System\UHQKWTA.exe
  2⤵
  PID:5248
- C:\Windows\System\twRqltZ.exe
  C:\Windows\System\twRqltZ.exe
  2⤵
  PID:3720
- C:\Windows\System\PBZcipX.exe
  C:\Windows\System\PBZcipX.exe
  2⤵
  PID:6016
- C:\Windows\System\hxpfRHs.exe
  C:\Windows\System\hxpfRHs.exe
  2⤵
  PID:5340
- C:\Windows\System\MVRoPRw.exe
  C:\Windows\System\MVRoPRw.exe
  2⤵
  PID:5684
- C:\Windows\System\fxSMfhR.exe
  C:\Windows\System\fxSMfhR.exe
  2⤵
  PID:6044
- C:\Windows\System\enfKTWi.exe
  C:\Windows\System\enfKTWi.exe
  2⤵
  PID:5912
- C:\Windows\System\mkBTgnt.exe
  C:\Windows\System\mkBTgnt.exe
  2⤵
  PID:6172
- C:\Windows\System\kwLKoNx.exe
  C:\Windows\System\kwLKoNx.exe
  2⤵
  PID:6200
- C:\Windows\System\DIkpcax.exe
  C:\Windows\System\DIkpcax.exe
  2⤵
  PID:6224
- C:\Windows\System\ZiYDEvT.exe
  C:\Windows\System\ZiYDEvT.exe
  2⤵
  PID:6272
- C:\Windows\System\dMZFtzH.exe
  C:\Windows\System\dMZFtzH.exe
  2⤵
  PID:6296
- C:\Windows\System\ueDoTSn.exe
  C:\Windows\System\ueDoTSn.exe
  2⤵
  PID:6332
- C:\Windows\System\aiwgXAo.exe
  C:\Windows\System\aiwgXAo.exe
  2⤵
  PID:6360
- C:\Windows\System\xdMPnSS.exe
  C:\Windows\System\xdMPnSS.exe
  2⤵
  PID:6388
- C:\Windows\System\xlaBORs.exe
  C:\Windows\System\xlaBORs.exe
  2⤵
  PID:6420
- C:\Windows\System\TLbTIHf.exe
  C:\Windows\System\TLbTIHf.exe
  2⤵
  PID:6444
- C:\Windows\System\Qppyoha.exe
  C:\Windows\System\Qppyoha.exe
  2⤵
  PID:6468
- C:\Windows\System\ObVGfkN.exe
  C:\Windows\System\ObVGfkN.exe
  2⤵
  PID:6496
- C:\Windows\System\oTBzgKD.exe
  C:\Windows\System\oTBzgKD.exe
  2⤵
  PID:6520
- C:\Windows\System\UrLDBZW.exe
  C:\Windows\System\UrLDBZW.exe
  2⤵
  PID:6560
- C:\Windows\System\WpeDRcl.exe
  C:\Windows\System\WpeDRcl.exe
  2⤵
  PID:6584
- C:\Windows\System\RSDmKJD.exe
  C:\Windows\System\RSDmKJD.exe
  2⤵
  PID:6600
- C:\Windows\System\yIwdSgZ.exe
  C:\Windows\System\yIwdSgZ.exe
  2⤵
  PID:6620
- C:\Windows\System\saGWglt.exe
  C:\Windows\System\saGWglt.exe
  2⤵
  PID:6644
- C:\Windows\System\DyNjTVW.exe
  C:\Windows\System\DyNjTVW.exe
  2⤵
  PID:6668
- C:\Windows\System\iwgbZgk.exe
  C:\Windows\System\iwgbZgk.exe
  2⤵
  PID:6688
- C:\Windows\System\uOoXegm.exe
  C:\Windows\System\uOoXegm.exe
  2⤵
  PID:6712
- C:\Windows\System\abMvnoh.exe
  C:\Windows\System\abMvnoh.exe
  2⤵
  PID:6780
- C:\Windows\System\VpTzNRQ.exe
  C:\Windows\System\VpTzNRQ.exe
  2⤵
  PID:6804
- C:\Windows\System\RTZwhaP.exe
  C:\Windows\System\RTZwhaP.exe
  2⤵
  PID:6844
- C:\Windows\System\TOkjxat.exe
  C:\Windows\System\TOkjxat.exe
  2⤵
  PID:6872
- C:\Windows\System\fIKBnOc.exe
  C:\Windows\System\fIKBnOc.exe
  2⤵
  PID:6892
- C:\Windows\System\WiJXUmi.exe
  C:\Windows\System\WiJXUmi.exe
  2⤵
  PID:6920
- C:\Windows\System\oxuWuTe.exe
  C:\Windows\System\oxuWuTe.exe
  2⤵
  PID:6936
- C:\Windows\System\oSluVRy.exe
  C:\Windows\System\oSluVRy.exe
  2⤵
  PID:6960
- C:\Windows\System\fAfOxBf.exe
  C:\Windows\System\fAfOxBf.exe
  2⤵
  PID:7016
- C:\Windows\System\OAOeUGv.exe
  C:\Windows\System\OAOeUGv.exe
  2⤵
  PID:7036
- C:\Windows\System\IlHbxiI.exe
  C:\Windows\System\IlHbxiI.exe
  2⤵
  PID:7060
- C:\Windows\System\hJPjWyo.exe
  C:\Windows\System\hJPjWyo.exe
  2⤵
  PID:7100
- C:\Windows\System\dQEHWYF.exe
  C:\Windows\System\dQEHWYF.exe
  2⤵
  PID:7124
- C:\Windows\System\IWdxlPZ.exe
  C:\Windows\System\IWdxlPZ.exe
  2⤵
  PID:7144
- C:\Windows\System\YqVMyxN.exe
  C:\Windows\System\YqVMyxN.exe
  2⤵
  PID:5284
- C:\Windows\System\cEIAPfW.exe
  C:\Windows\System\cEIAPfW.exe
  2⤵
  PID:5972
- C:\Windows\System\gqaXUKF.exe
  C:\Windows\System\gqaXUKF.exe
  2⤵
  PID:6192
- C:\Windows\System\xidWbXR.exe
  C:\Windows\System\xidWbXR.exe
  2⤵
  PID:6312
- C:\Windows\System\xMTHaTt.exe
  C:\Windows\System\xMTHaTt.exe
  2⤵
  PID:6356
- C:\Windows\System\gnJBYGW.exe
  C:\Windows\System\gnJBYGW.exe
  2⤵
  PID:6428
- C:\Windows\System\LZHfJAy.exe
  C:\Windows\System\LZHfJAy.exe
  2⤵
  PID:6464
- C:\Windows\System\fpDZNLV.exe
  C:\Windows\System\fpDZNLV.exe
  2⤵
  PID:6528
- C:\Windows\System\BEKFBVd.exe
  C:\Windows\System\BEKFBVd.exe
  2⤵
  PID:6568
- C:\Windows\System\jBgtLGp.exe
  C:\Windows\System\jBgtLGp.exe
  2⤵
  PID:6676
- C:\Windows\System\vEolJpw.exe
  C:\Windows\System\vEolJpw.exe
  2⤵
  PID:6736
- C:\Windows\System\oduIDBU.exe
  C:\Windows\System\oduIDBU.exe
  2⤵
  PID:6792
- C:\Windows\System\czjcsXm.exe
  C:\Windows\System\czjcsXm.exe
  2⤵
  PID:6856
- C:\Windows\System\hxGrAen.exe
  C:\Windows\System\hxGrAen.exe
  2⤵
  PID:6908
- C:\Windows\System\jqPwsSt.exe
  C:\Windows\System\jqPwsSt.exe
  2⤵
  PID:6932
- C:\Windows\System\rVBzoei.exe
  C:\Windows\System\rVBzoei.exe
  2⤵
  PID:7056
- C:\Windows\System\LhUnZvg.exe
  C:\Windows\System\LhUnZvg.exe
  2⤵
  PID:5636
- C:\Windows\System\yxHzclO.exe
  C:\Windows\System\yxHzclO.exe
  2⤵
  PID:6292
- C:\Windows\System\THMYjvv.exe
  C:\Windows\System\THMYjvv.exe
  2⤵
  PID:6576
- C:\Windows\System\tdzVnKI.exe
  C:\Windows\System\tdzVnKI.exe
  2⤵
  PID:6544
- C:\Windows\System\sieLVhF.exe
  C:\Windows\System\sieLVhF.exe
  2⤵
  PID:6628
- C:\Windows\System\kBzJIzX.exe
  C:\Windows\System\kBzJIzX.exe
  2⤵
  PID:6652
- C:\Windows\System\TOHGoGl.exe
  C:\Windows\System\TOHGoGl.exe
  2⤵
  PID:6948
- C:\Windows\System\ZjnFhwb.exe
  C:\Windows\System\ZjnFhwb.exe
  2⤵
  PID:6344
- C:\Windows\System\HzXjjDA.exe
  C:\Windows\System\HzXjjDA.exe
  2⤵
  PID:6592
- C:\Windows\System\YQpIZpZ.exe
  C:\Windows\System\YQpIZpZ.exe
  2⤵
  PID:6752
- C:\Windows\System\lKNjnpI.exe
  C:\Windows\System\lKNjnpI.exe
  2⤵
  PID:7116
- C:\Windows\System\lJEYPJy.exe
  C:\Windows\System\lJEYPJy.exe
  2⤵
  PID:6880
- C:\Windows\System\kyXzoFJ.exe
  C:\Windows\System\kyXzoFJ.exe
  2⤵
  PID:7208
- C:\Windows\System\RATDEIF.exe
  C:\Windows\System\RATDEIF.exe
  2⤵
  PID:7228
- C:\Windows\System\lXfpTyS.exe
  C:\Windows\System\lXfpTyS.exe
  2⤵
  PID:7256
- C:\Windows\System\bOKwrfM.exe
  C:\Windows\System\bOKwrfM.exe
  2⤵
  PID:7280
- C:\Windows\System\inWQVWM.exe
  C:\Windows\System\inWQVWM.exe
  2⤵
  PID:7308
- C:\Windows\System\mvEymec.exe
  C:\Windows\System\mvEymec.exe
  2⤵
  PID:7336
- C:\Windows\System\iQMNNlC.exe
  C:\Windows\System\iQMNNlC.exe
  2⤵
  PID:7376
- C:\Windows\System\acXHVUA.exe
  C:\Windows\System\acXHVUA.exe
  2⤵
  PID:7400
- C:\Windows\System\zkfRlEA.exe
  C:\Windows\System\zkfRlEA.exe
  2⤵
  PID:7432
- C:\Windows\System\kcnyKny.exe
  C:\Windows\System\kcnyKny.exe
  2⤵
  PID:7452
- C:\Windows\System\GcYvotV.exe
  C:\Windows\System\GcYvotV.exe
  2⤵
  PID:7476
- C:\Windows\System\fTXSdzG.exe
  C:\Windows\System\fTXSdzG.exe
  2⤵
  PID:7516
- C:\Windows\System\lHVhiOJ.exe
  C:\Windows\System\lHVhiOJ.exe
  2⤵
  PID:7536
- C:\Windows\System\RulEYPa.exe
  C:\Windows\System\RulEYPa.exe
  2⤵
  PID:7564
- C:\Windows\System\ZGeFDHE.exe
  C:\Windows\System\ZGeFDHE.exe
  2⤵
  PID:7600
- C:\Windows\System\aCNSOWy.exe
  C:\Windows\System\aCNSOWy.exe
  2⤵
  PID:7620
- C:\Windows\System\lAtkURZ.exe
  C:\Windows\System\lAtkURZ.exe
  2⤵
  PID:7644
- C:\Windows\System\GcNnaqY.exe
  C:\Windows\System\GcNnaqY.exe
  2⤵
  PID:7672
- C:\Windows\System\wHMQkxB.exe
  C:\Windows\System\wHMQkxB.exe
  2⤵
  PID:7708
- C:\Windows\System\LJPFCfL.exe
  C:\Windows\System\LJPFCfL.exe
  2⤵
  PID:7732
- C:\Windows\System\WskZBHq.exe
  C:\Windows\System\WskZBHq.exe
  2⤵
  PID:7752
- C:\Windows\System\CEItYMu.exe
  C:\Windows\System\CEItYMu.exe
  2⤵
  PID:7776
- C:\Windows\System\KaKRsRc.exe
  C:\Windows\System\KaKRsRc.exe
  2⤵
  PID:7804
- C:\Windows\System\OLGUryy.exe
  C:\Windows\System\OLGUryy.exe
  2⤵
  PID:7832
- C:\Windows\System\LPehFqF.exe
  C:\Windows\System\LPehFqF.exe
  2⤵
  PID:7856
- C:\Windows\System\pKKjqGC.exe
  C:\Windows\System\pKKjqGC.exe
  2⤵
  PID:7904
- C:\Windows\System\cjTUEqJ.exe
  C:\Windows\System\cjTUEqJ.exe
  2⤵
  PID:7928
- C:\Windows\System\INpsYWD.exe
  C:\Windows\System\INpsYWD.exe
  2⤵
  PID:7956
- C:\Windows\System\daRLxVs.exe
  C:\Windows\System\daRLxVs.exe
  2⤵
  PID:7984
- C:\Windows\System\hBTNEQi.exe
  C:\Windows\System\hBTNEQi.exe
  2⤵
  PID:8000
- C:\Windows\System\fvHZNDk.exe
  C:\Windows\System\fvHZNDk.exe
  2⤵
  PID:8032
- C:\Windows\System\eBbdgcB.exe
  C:\Windows\System\eBbdgcB.exe
  2⤵
  PID:8052
- C:\Windows\System\lpwgrUw.exe
  C:\Windows\System\lpwgrUw.exe
  2⤵
  PID:8084
- C:\Windows\System\pHVAEmT.exe
  C:\Windows\System\pHVAEmT.exe
  2⤵
  PID:8108
- C:\Windows\System\yFdPHUr.exe
  C:\Windows\System\yFdPHUr.exe
  2⤵
  PID:8132
- C:\Windows\System\sJLblFa.exe
  C:\Windows\System\sJLblFa.exe
  2⤵
  PID:8156
- C:\Windows\System\DrVQWiq.exe
  C:\Windows\System\DrVQWiq.exe
  2⤵
  PID:8180
- C:\Windows\System\pwzwtxo.exe
  C:\Windows\System\pwzwtxo.exe
  2⤵
  PID:7236
- C:\Windows\System\JcdZZaH.exe
  C:\Windows\System\JcdZZaH.exe
  2⤵
  PID:7296
- C:\Windows\System\GGOijGf.exe
  C:\Windows\System\GGOijGf.exe
  2⤵
  PID:7348
- C:\Windows\System\tDEIBJy.exe
  C:\Windows\System\tDEIBJy.exe
  2⤵
  PID:7440
- C:\Windows\System\iepFYtX.exe
  C:\Windows\System\iepFYtX.exe
  2⤵
  PID:7548
- C:\Windows\System\UKDyFAx.exe
  C:\Windows\System\UKDyFAx.exe
  2⤵
  PID:7580
- C:\Windows\System\zevKxFN.exe
  C:\Windows\System\zevKxFN.exe
  2⤵
  PID:7636
- C:\Windows\System\VKvxaGb.exe
  C:\Windows\System\VKvxaGb.exe
  2⤵
  PID:7760
- C:\Windows\System\BayYGkH.exe
  C:\Windows\System\BayYGkH.exe
  2⤵
  PID:7724
- C:\Windows\System\AtLXIan.exe
  C:\Windows\System\AtLXIan.exe
  2⤵
  PID:7852
- C:\Windows\System\uDvxAVJ.exe
  C:\Windows\System\uDvxAVJ.exe
  2⤵
  PID:7916
- C:\Windows\System\LylaXpJ.exe
  C:\Windows\System\LylaXpJ.exe
  2⤵
  PID:7972
- C:\Windows\System\hIRJWPH.exe
  C:\Windows\System\hIRJWPH.exe
  2⤵
  PID:8024
- C:\Windows\System\MedHKqs.exe
  C:\Windows\System\MedHKqs.exe
  2⤵
  PID:8048
- C:\Windows\System\XqCJzqA.exe
  C:\Windows\System\XqCJzqA.exe
  2⤵
  PID:8120
- C:\Windows\System\TGYTEMb.exe
  C:\Windows\System\TGYTEMb.exe
  2⤵
  PID:8152
- C:\Windows\System\xQDpGnj.exe
  C:\Windows\System\xQDpGnj.exe
  2⤵
  PID:7324
- C:\Windows\System\UFZQiXB.exe
  C:\Windows\System\UFZQiXB.exe
  2⤵
  PID:7364
- C:\Windows\System\vkjKGdp.exe
  C:\Windows\System\vkjKGdp.exe
  2⤵
  PID:7524
- C:\Windows\System\kqFFEdX.exe
  C:\Windows\System\kqFFEdX.exe
  2⤵
  PID:7688
- C:\Windows\System\QuUQoQE.exe
  C:\Windows\System\QuUQoQE.exe
  2⤵
  PID:7792
- C:\Windows\System\rkbjorv.exe
  C:\Windows\System\rkbjorv.exe
  2⤵
  PID:7968
- C:\Windows\System\xRBkjQr.exe
  C:\Windows\System\xRBkjQr.exe
  2⤵
  PID:8072
- C:\Windows\System\ZhspDZU.exe
  C:\Windows\System\ZhspDZU.exe
  2⤵
  PID:7472
- C:\Windows\System\HjhdSwp.exe
  C:\Windows\System\HjhdSwp.exe
  2⤵
  PID:8128
- C:\Windows\System\ASFCjNL.exe
  C:\Windows\System\ASFCjNL.exe
  2⤵
  PID:8200
- C:\Windows\System\ruURvNc.exe
  C:\Windows\System\ruURvNc.exe
  2⤵
  PID:8228
- C:\Windows\System\gfQASGl.exe
  C:\Windows\System\gfQASGl.exe
  2⤵
  PID:8272
- C:\Windows\System\xGfFnYy.exe
  C:\Windows\System\xGfFnYy.exe
  2⤵
  PID:8304
- C:\Windows\System\IytaheG.exe
  C:\Windows\System\IytaheG.exe
  2⤵
  PID:8320
- C:\Windows\System\OmEuLXq.exe
  C:\Windows\System\OmEuLXq.exe
  2⤵
  PID:8352
- C:\Windows\System\ItezpVB.exe
  C:\Windows\System\ItezpVB.exe
  2⤵
  PID:8368
- C:\Windows\System\aAHvgLL.exe
  C:\Windows\System\aAHvgLL.exe
  2⤵
  PID:8392
- C:\Windows\System\tqJJoFG.exe
  C:\Windows\System\tqJJoFG.exe
  2⤵
  PID:8444
- C:\Windows\System\YaJkaiN.exe
  C:\Windows\System\YaJkaiN.exe
  2⤵
  PID:8472
- C:\Windows\System\FiFznLE.exe
  C:\Windows\System\FiFznLE.exe
  2⤵
  PID:8504
- C:\Windows\System\ZAvlBQv.exe
  C:\Windows\System\ZAvlBQv.exe
  2⤵
  PID:8532
- C:\Windows\System\SefNbNM.exe
  C:\Windows\System\SefNbNM.exe
  2⤵
  PID:8548
- C:\Windows\System\Jnidzal.exe
  C:\Windows\System\Jnidzal.exe
  2⤵
  PID:8584
- C:\Windows\System\eIzyEaS.exe
  C:\Windows\System\eIzyEaS.exe
  2⤵
  PID:8616
- C:\Windows\System\RDdRZVk.exe
  C:\Windows\System\RDdRZVk.exe
  2⤵
  PID:8636
- C:\Windows\System\KkpevuM.exe
  C:\Windows\System\KkpevuM.exe
  2⤵
  PID:8660
- C:\Windows\System\LFRtWLO.exe
  C:\Windows\System\LFRtWLO.exe
  2⤵
  PID:8680
- C:\Windows\System\VZmuYlF.exe
  C:\Windows\System\VZmuYlF.exe
  2⤵
  PID:8700
- C:\Windows\System\nSJdhmW.exe
  C:\Windows\System\nSJdhmW.exe
  2⤵
  PID:8724
- C:\Windows\System\ulvBQsJ.exe
  C:\Windows\System\ulvBQsJ.exe
  2⤵
  PID:8764
- C:\Windows\System\XDUSlym.exe
  C:\Windows\System\XDUSlym.exe
  2⤵
  PID:8784
- C:\Windows\System\ogHAzdR.exe
  C:\Windows\System\ogHAzdR.exe
  2⤵
  PID:8816
- C:\Windows\System\AlwyDAt.exe
  C:\Windows\System\AlwyDAt.exe
  2⤵
  PID:8852
- C:\Windows\System\pwRMaCt.exe
  C:\Windows\System\pwRMaCt.exe
  2⤵
  PID:8880
- C:\Windows\System\dZrGcxw.exe
  C:\Windows\System\dZrGcxw.exe
  2⤵
  PID:8908
- C:\Windows\System\NSzsuGa.exe
  C:\Windows\System\NSzsuGa.exe
  2⤵
  PID:8932
- C:\Windows\System\LgmYhIa.exe
  C:\Windows\System\LgmYhIa.exe
  2⤵
  PID:8972
- C:\Windows\System\iSasogL.exe
  C:\Windows\System\iSasogL.exe
  2⤵
  PID:9000
- C:\Windows\System\xqhRcuu.exe
  C:\Windows\System\xqhRcuu.exe
  2⤵
  PID:9040
- C:\Windows\System\TnrZvmn.exe
  C:\Windows\System\TnrZvmn.exe
  2⤵
  PID:9068
- C:\Windows\System\VrpMLfE.exe
  C:\Windows\System\VrpMLfE.exe
  2⤵
  PID:9096
- C:\Windows\System\mIDXKGk.exe
  C:\Windows\System\mIDXKGk.exe
  2⤵
  PID:9112
- C:\Windows\System\EOOhPYq.exe
  C:\Windows\System\EOOhPYq.exe
  2⤵
  PID:9140
- C:\Windows\System\xQsVFih.exe
  C:\Windows\System\xQsVFih.exe
  2⤵
  PID:9180
- C:\Windows\System\JfLWVFe.exe
  C:\Windows\System\JfLWVFe.exe
  2⤵
  PID:9196
- C:\Windows\System\NznBjMa.exe
  C:\Windows\System\NznBjMa.exe
  2⤵
  PID:9212
- C:\Windows\System\CSNKKwo.exe
  C:\Windows\System\CSNKKwo.exe
  2⤵
  PID:7532
- C:\Windows\System\zxYiKmY.exe
  C:\Windows\System\zxYiKmY.exe
  2⤵
  PID:8224
- C:\Windows\System\sviNPjE.exe
  C:\Windows\System\sviNPjE.exe
  2⤵
  PID:8288
- C:\Windows\System\exMvTGf.exe
  C:\Windows\System\exMvTGf.exe
  2⤵
  PID:8360
- C:\Windows\System\gOMgWEd.exe
  C:\Windows\System\gOMgWEd.exe
  2⤵
  PID:8500
- C:\Windows\System\EoYvXQZ.exe
  C:\Windows\System\EoYvXQZ.exe
  2⤵
  PID:8560
- C:\Windows\System\xuAbSDB.exe
  C:\Windows\System\xuAbSDB.exe
  2⤵
  PID:8628
- C:\Windows\System\roBDnKj.exe
  C:\Windows\System\roBDnKj.exe
  2⤵
  PID:7448
- C:\Windows\System\fCbfhxa.exe
  C:\Windows\System\fCbfhxa.exe
  2⤵
  PID:8708
- C:\Windows\System\GphPCFO.exe
  C:\Windows\System\GphPCFO.exe
  2⤵
  PID:8720
- C:\Windows\System\bLhXCeU.exe
  C:\Windows\System\bLhXCeU.exe
  2⤵
  PID:8876
- C:\Windows\System\DoiEpPt.exe
  C:\Windows\System\DoiEpPt.exe
  2⤵
  PID:8920
- C:\Windows\System\OCbnwXO.exe
  C:\Windows\System\OCbnwXO.exe
  2⤵
  PID:8988
- C:\Windows\System\yVOLDLG.exe
  C:\Windows\System\yVOLDLG.exe
  2⤵
  PID:9064
- C:\Windows\System\TMlsOHw.exe
  C:\Windows\System\TMlsOHw.exe
  2⤵
  PID:9108
- C:\Windows\System\OiSQTkW.exe
  C:\Windows\System\OiSQTkW.exe
  2⤵
  PID:9168
- C:\Windows\System\XtoiPvo.exe
  C:\Windows\System\XtoiPvo.exe
  2⤵
  PID:8216
- C:\Windows\System\LHBNOTp.exe
  C:\Windows\System\LHBNOTp.exe
  2⤵
  PID:8336
- C:\Windows\System\HLbKGiv.exe
  C:\Windows\System\HLbKGiv.exe
  2⤵
  PID:8528
- C:\Windows\System\tTqcaJZ.exe
  C:\Windows\System\tTqcaJZ.exe
  2⤵
  PID:8644
- C:\Windows\System\eVCRUEh.exe
  C:\Windows\System\eVCRUEh.exe
  2⤵
  PID:8712
- C:\Windows\System\HXkHTVu.exe
  C:\Windows\System\HXkHTVu.exe
  2⤵
  PID:8896
- C:\Windows\System\ernkwEg.exe
  C:\Windows\System\ernkwEg.exe
  2⤵
  PID:9084
- C:\Windows\System\IotOMyN.exe
  C:\Windows\System\IotOMyN.exe
  2⤵
  PID:9164
- C:\Windows\System\UKvnKYp.exe
  C:\Windows\System\UKvnKYp.exe
  2⤵
  PID:8572
- C:\Windows\System\vFOoPpN.exe
  C:\Windows\System\vFOoPpN.exe
  2⤵
  PID:8924
- C:\Windows\System\gspmQfa.exe
  C:\Windows\System\gspmQfa.exe
  2⤵
  PID:9132
- C:\Windows\System\TRlQlXs.exe
  C:\Windows\System\TRlQlXs.exe
  2⤵
  PID:9052
- C:\Windows\System\LwCsVjR.exe
  C:\Windows\System\LwCsVjR.exe
  2⤵
  PID:9232
- C:\Windows\System\IXpllKk.exe
  C:\Windows\System\IXpllKk.exe
  2⤵
  PID:9256
- C:\Windows\System\WLNsSez.exe
  C:\Windows\System\WLNsSez.exe
  2⤵
  PID:9280
- C:\Windows\System\XiVoPRu.exe
  C:\Windows\System\XiVoPRu.exe
  2⤵
  PID:9308
- C:\Windows\System\UJjlIMS.exe
  C:\Windows\System\UJjlIMS.exe
  2⤵
  PID:9348
- C:\Windows\System\SXUIQiH.exe
  C:\Windows\System\SXUIQiH.exe
  2⤵
  PID:9368
- C:\Windows\System\ZNGbTzg.exe
  C:\Windows\System\ZNGbTzg.exe
  2⤵
  PID:9400
- C:\Windows\System\fehpNBt.exe
  C:\Windows\System\fehpNBt.exe
  2⤵
  PID:9420
- C:\Windows\System\qcwKuLp.exe
  C:\Windows\System\qcwKuLp.exe
  2⤵
  PID:9448
- C:\Windows\System\uesJjeS.exe
  C:\Windows\System\uesJjeS.exe
  2⤵
  PID:9484
- C:\Windows\System\WFoiffN.exe
  C:\Windows\System\WFoiffN.exe
  2⤵
  PID:9516
- C:\Windows\System\LJgYqRH.exe
  C:\Windows\System\LJgYqRH.exe
  2⤵
  PID:9536
- C:\Windows\System\yuYIXSa.exe
  C:\Windows\System\yuYIXSa.exe
  2⤵
  PID:9560
- C:\Windows\System\POLEOkr.exe
  C:\Windows\System\POLEOkr.exe
  2⤵
  PID:9612
- C:\Windows\System\UCdZjHI.exe
  C:\Windows\System\UCdZjHI.exe
  2⤵
  PID:9628
- C:\Windows\System\NIYcAhG.exe
  C:\Windows\System\NIYcAhG.exe
  2⤵
  PID:9652
- C:\Windows\System\iUILBLT.exe
  C:\Windows\System\iUILBLT.exe
  2⤵
  PID:9684
- C:\Windows\System\XlArEyz.exe
  C:\Windows\System\XlArEyz.exe
  2⤵
  PID:9700
- C:\Windows\System\GEquchx.exe
  C:\Windows\System\GEquchx.exe
  2⤵
  PID:9716
- C:\Windows\System\MnNmfNK.exe
  C:\Windows\System\MnNmfNK.exe
  2⤵
  PID:9732
- C:\Windows\System\mQSziVr.exe
  C:\Windows\System\mQSziVr.exe
  2⤵
  PID:9808
- C:\Windows\System\jebZVqf.exe
  C:\Windows\System\jebZVqf.exe
  2⤵
  PID:9828
- C:\Windows\System\qpUjzFi.exe
  C:\Windows\System\qpUjzFi.exe
  2⤵
  PID:9852
- C:\Windows\System\XdAtFEt.exe
  C:\Windows\System\XdAtFEt.exe
  2⤵
  PID:9872
- C:\Windows\System\QkKGUCv.exe
  C:\Windows\System\QkKGUCv.exe
  2⤵
  PID:9904
- C:\Windows\System\VTAsUvA.exe
  C:\Windows\System\VTAsUvA.exe
  2⤵
  PID:9932
- C:\Windows\System\HNtTstf.exe
  C:\Windows\System\HNtTstf.exe
  2⤵
  PID:9952
- C:\Windows\System\CVUGLtk.exe
  C:\Windows\System\CVUGLtk.exe
  2⤵
  PID:9968
- C:\Windows\System\GxCmqbz.exe
  C:\Windows\System\GxCmqbz.exe
  2⤵
  PID:9996
- C:\Windows\System\KoWtAlu.exe
  C:\Windows\System\KoWtAlu.exe
  2⤵
  PID:10016
- C:\Windows\System\ErsSoup.exe
  C:\Windows\System\ErsSoup.exe
  2⤵
  PID:10044
- C:\Windows\System\YBbZkWu.exe
  C:\Windows\System\YBbZkWu.exe
  2⤵
  PID:10076
- C:\Windows\System\OEHrFXI.exe
  C:\Windows\System\OEHrFXI.exe
  2⤵
  PID:10100
- C:\Windows\System\AdtNNdV.exe
  C:\Windows\System\AdtNNdV.exe
  2⤵
  PID:10128
- C:\Windows\System\zHauFus.exe
  C:\Windows\System\zHauFus.exe
  2⤵
  PID:10172
- C:\Windows\System\pNxklqo.exe
  C:\Windows\System\pNxklqo.exe
  2⤵
  PID:10196
- C:\Windows\System\EjIjfod.exe
  C:\Windows\System\EjIjfod.exe
  2⤵
  PID:8268
- C:\Windows\System\xLBhAUF.exe
  C:\Windows\System\xLBhAUF.exe
  2⤵
  PID:9248
- C:\Windows\System\XRddvCj.exe
  C:\Windows\System\XRddvCj.exe
  2⤵
  PID:9344
- C:\Windows\System\tEOtmnx.exe
  C:\Windows\System\tEOtmnx.exe
  2⤵
  PID:9388
- C:\Windows\System\erNHTwc.exe
  C:\Windows\System\erNHTwc.exe
  2⤵
  PID:9432
- C:\Windows\System\KsJDVAa.exe
  C:\Windows\System\KsJDVAa.exe
  2⤵
  PID:9512
- C:\Windows\System\BXAOwYG.exe
  C:\Windows\System\BXAOwYG.exe
  2⤵
  PID:9584
- C:\Windows\System\bPVxBOW.exe
  C:\Windows\System\bPVxBOW.exe
  2⤵
  PID:9620
- C:\Windows\System\RUvvrFC.exe
  C:\Windows\System\RUvvrFC.exe
  2⤵
  PID:9692
- C:\Windows\System\lxXiAPB.exe
  C:\Windows\System\lxXiAPB.exe
  2⤵
  PID:9728
- C:\Windows\System\EqzRfBr.exe
  C:\Windows\System\EqzRfBr.exe
  2⤵
  PID:9760
- C:\Windows\System\uWRZSYA.exe
  C:\Windows\System\uWRZSYA.exe
  2⤵
  PID:9844
- C:\Windows\System\PdtYfAq.exe
  C:\Windows\System\PdtYfAq.exe
  2⤵
  PID:10036
- C:\Windows\System\oeQkkKl.exe
  C:\Windows\System\oeQkkKl.exe
  2⤵
  PID:10108
- C:\Windows\System\WMgaKpl.exe
  C:\Windows\System\WMgaKpl.exe
  2⤵
  PID:10084
- C:\Windows\System\pekToEV.exe
  C:\Windows\System\pekToEV.exe
  2⤵
  PID:10152
- C:\Windows\System\ljdDoxL.exe
  C:\Windows\System\ljdDoxL.exe
  2⤵
  PID:9276
- C:\Windows\System\hQBxQxo.exe
  C:\Windows\System\hQBxQxo.exe
  2⤵
  PID:9332
- C:\Windows\System\RcPPnph.exe
  C:\Windows\System\RcPPnph.exe
  2⤵
  PID:9476
- C:\Windows\System\MbrMsbQ.exe
  C:\Windows\System\MbrMsbQ.exe
  2⤵
  PID:9508
- C:\Windows\System\umiyuxm.exe
  C:\Windows\System\umiyuxm.exe
  2⤵
  PID:9468
- C:\Windows\System\JoLcLSo.exe
  C:\Windows\System\JoLcLSo.exe
  2⤵
  PID:9532
- C:\Windows\System\gdkxuad.exe
  C:\Windows\System\gdkxuad.exe
  2⤵
  PID:9820
- C:\Windows\System\qYKfHdq.exe
  C:\Windows\System\qYKfHdq.exe
  2⤵
  PID:9948
- C:\Windows\System\eJhyHlB.exe
  C:\Windows\System\eJhyHlB.exe
  2⤵
  PID:10232
- C:\Windows\System\XxnYurC.exe
  C:\Windows\System\XxnYurC.exe
  2⤵
  PID:10236
- C:\Windows\System\VgyGbzh.exe
  C:\Windows\System\VgyGbzh.exe
  2⤵
  PID:9580
- C:\Windows\System\QraywEL.exe
  C:\Windows\System\QraywEL.exe
  2⤵
  PID:9496
- C:\Windows\System\QaaRnjH.exe
  C:\Windows\System\QaaRnjH.exe
  2⤵
  PID:10256
- C:\Windows\System\CKGNCXs.exe
  C:\Windows\System\CKGNCXs.exe
  2⤵
  PID:10296
- C:\Windows\System\cqJgLHb.exe
  C:\Windows\System\cqJgLHb.exe
  2⤵
  PID:10324
- C:\Windows\System\gjvMDGX.exe
  C:\Windows\System\gjvMDGX.exe
  2⤵
  PID:10352
- C:\Windows\System\pjdWPWn.exe
  C:\Windows\System\pjdWPWn.exe
  2⤵
  PID:10384
- C:\Windows\System\yaIumpw.exe
  C:\Windows\System\yaIumpw.exe
  2⤵
  PID:10416
- C:\Windows\System\vTtPfdg.exe
  C:\Windows\System\vTtPfdg.exe
  2⤵
  PID:10484
- C:\Windows\System\hcyYPru.exe
  C:\Windows\System\hcyYPru.exe
  2⤵
  PID:10508
- C:\Windows\System\NLGeZfy.exe
  C:\Windows\System\NLGeZfy.exe
  2⤵
  PID:10532
- C:\Windows\System\hNkaMCy.exe
  C:\Windows\System\hNkaMCy.exe
  2⤵
  PID:10568
- C:\Windows\System\paIEkdO.exe
  C:\Windows\System\paIEkdO.exe
  2⤵
  PID:10600
- C:\Windows\System\CgjxLet.exe
  C:\Windows\System\CgjxLet.exe
  2⤵
  PID:10628
- C:\Windows\System\lIGKzyg.exe
  C:\Windows\System\lIGKzyg.exe
  2⤵
  PID:10672
- C:\Windows\System\aURoKej.exe
  C:\Windows\System\aURoKej.exe
  2⤵
  PID:10688
- C:\Windows\System\WpqJnbG.exe
  C:\Windows\System\WpqJnbG.exe
  2⤵
  PID:10716
- C:\Windows\System\knnoyxL.exe
  C:\Windows\System\knnoyxL.exe
  2⤵
  PID:10744
- C:\Windows\System\FDlaUpY.exe
  C:\Windows\System\FDlaUpY.exe
  2⤵
  PID:10776
- C:\Windows\System\YbmIykz.exe
  C:\Windows\System\YbmIykz.exe
  2⤵
  PID:10800
- C:\Windows\System\Vyqspyc.exe
  C:\Windows\System\Vyqspyc.exe
  2⤵
  PID:10824
- C:\Windows\System\gGYqqZm.exe
  C:\Windows\System\gGYqqZm.exe
  2⤵
  PID:10868
- C:\Windows\System\wLjMomX.exe
  C:\Windows\System\wLjMomX.exe
  2⤵
  PID:10896
- C:\Windows\System\wkafmBK.exe
  C:\Windows\System\wkafmBK.exe
  2⤵
  PID:10916
- C:\Windows\System\XrVEZGZ.exe
  C:\Windows\System\XrVEZGZ.exe
  2⤵
  PID:10940
- C:\Windows\System\MMrHBaO.exe
  C:\Windows\System\MMrHBaO.exe
  2⤵
  PID:10968
- C:\Windows\System\xnwPjPC.exe
  C:\Windows\System\xnwPjPC.exe
  2⤵
  PID:10988
- C:\Windows\System\drlTXcF.exe
  C:\Windows\System\drlTXcF.exe
  2⤵
  PID:11012
- C:\Windows\System\wwFPiJv.exe
  C:\Windows\System\wwFPiJv.exe
  2⤵
  PID:11048
- C:\Windows\System\jqEhCli.exe
  C:\Windows\System\jqEhCli.exe
  2⤵
  PID:11072
- C:\Windows\System\GomGVAP.exe
  C:\Windows\System\GomGVAP.exe
  2⤵
  PID:11100
- C:\Windows\System\muUyojl.exe
  C:\Windows\System\muUyojl.exe
  2⤵
  PID:11132
- C:\Windows\System\WaKYFjb.exe
  C:\Windows\System\WaKYFjb.exe
  2⤵
  PID:11152
- C:\Windows\System\OfsvIyG.exe
  C:\Windows\System\OfsvIyG.exe
  2⤵
  PID:11172
- C:\Windows\System\GffuKVG.exe
  C:\Windows\System\GffuKVG.exe
  2⤵
  PID:11204
- C:\Windows\System\mZqxWZK.exe
  C:\Windows\System\mZqxWZK.exe
  2⤵
  PID:11232
- C:\Windows\System\ScHDYrz.exe
  C:\Windows\System\ScHDYrz.exe
  2⤵
  PID:9824
- C:\Windows\System\SwwpnWr.exe
  C:\Windows\System\SwwpnWr.exe
  2⤵
  PID:9316
- C:\Windows\System\ZWXdXUA.exe
  C:\Windows\System\ZWXdXUA.exe
  2⤵
  PID:10004
- C:\Windows\System\bWxSuNn.exe
  C:\Windows\System\bWxSuNn.exe
  2⤵
  PID:10280
- C:\Windows\System\tVJIHuL.exe
  C:\Windows\System\tVJIHuL.exe
  2⤵
  PID:10340
- C:\Windows\System\QGdjPQl.exe
  C:\Windows\System\QGdjPQl.exe
  2⤵
  PID:10496
- C:\Windows\System\iJEcwjr.exe
  C:\Windows\System\iJEcwjr.exe
  2⤵
  PID:10552
- C:\Windows\System\bKXmQJR.exe
  C:\Windows\System\bKXmQJR.exe
  2⤵
  PID:10620
- C:\Windows\System\GBrrkjw.exe
  C:\Windows\System\GBrrkjw.exe
  2⤵
  PID:10648
- C:\Windows\System\YrHxepV.exe
  C:\Windows\System\YrHxepV.exe
  2⤵
  PID:10772
- C:\Windows\System\HZYwSNY.exe
  C:\Windows\System\HZYwSNY.exe
  2⤵
  PID:10816
- C:\Windows\System\YWWnKAT.exe
  C:\Windows\System\YWWnKAT.exe
  2⤵
  PID:10924
- C:\Windows\System\onyjRAA.exe
  C:\Windows\System\onyjRAA.exe
  2⤵
  PID:10952
- C:\Windows\System\EqIaxXK.exe
  C:\Windows\System\EqIaxXK.exe
  2⤵
  PID:10976
- C:\Windows\System\UVxBlHf.exe
  C:\Windows\System\UVxBlHf.exe
  2⤵
  PID:11060
- C:\Windows\System\BlKZCiS.exe
  C:\Windows\System\BlKZCiS.exe
  2⤵
  PID:11200
- C:\Windows\System\TNhdROW.exe
  C:\Windows\System\TNhdROW.exe
  2⤵
  PID:11228
- C:\Windows\System\SvJzgwH.exe
  C:\Windows\System\SvJzgwH.exe
  2⤵
  PID:11252
- C:\Windows\System\LYXvaHn.exe
  C:\Windows\System\LYXvaHn.exe
  2⤵
  PID:10348
- C:\Windows\System\IfLWByu.exe
  C:\Windows\System\IfLWByu.exe
  2⤵
  PID:10612
- C:\Windows\System\tYszphx.exe
  C:\Windows\System\tYszphx.exe
  2⤵
  PID:10652
- C:\Windows\System\npAXPJI.exe
  C:\Windows\System\npAXPJI.exe
  2⤵
  PID:10796
- C:\Windows\System\UAIUjEX.exe
  C:\Windows\System\UAIUjEX.exe
  2⤵
  PID:10912
- C:\Windows\System\iTyhFUA.exe
  C:\Windows\System\iTyhFUA.exe
  2⤵
  PID:11124
- C:\Windows\System\sEzpUrq.exe
  C:\Windows\System\sEzpUrq.exe
  2⤵
  PID:11180
- C:\Windows\System\pYptduo.exe
  C:\Windows\System\pYptduo.exe
  2⤵
  PID:10308
- C:\Windows\System\casEkHo.exe
  C:\Windows\System\casEkHo.exe
  2⤵
  PID:10704
- C:\Windows\System\jRNWrcD.exe
  C:\Windows\System\jRNWrcD.exe
  2⤵
  PID:10892
- C:\Windows\System\NaaZXkn.exe
  C:\Windows\System\NaaZXkn.exe
  2⤵
  PID:10288
- C:\Windows\System\dPmAkXs.exe
  C:\Windows\System\dPmAkXs.exe
  2⤵
  PID:10760
- C:\Windows\System\CxFTomF.exe
  C:\Windows\System\CxFTomF.exe
  2⤵
  PID:11284
- C:\Windows\System\EjWcPdn.exe
  C:\Windows\System\EjWcPdn.exe
  2⤵
  PID:11304
- C:\Windows\System\ERAqcCg.exe
  C:\Windows\System\ERAqcCg.exe
  2⤵
  PID:11332
- C:\Windows\System\JBTCfCP.exe
  C:\Windows\System\JBTCfCP.exe
  2⤵
  PID:11392
- C:\Windows\System\efojLxP.exe
  C:\Windows\System\efojLxP.exe
  2⤵
  PID:11420
- C:\Windows\System\LNDtIIi.exe
  C:\Windows\System\LNDtIIi.exe
  2⤵
  PID:11448
- C:\Windows\System\QFYiEXd.exe
  C:\Windows\System\QFYiEXd.exe
  2⤵
  PID:11480
- C:\Windows\System\ppAAasp.exe
  C:\Windows\System\ppAAasp.exe
  2⤵
  PID:11500
- C:\Windows\System\yPeUIND.exe
  C:\Windows\System\yPeUIND.exe
  2⤵
  PID:11516
- C:\Windows\System\kvDjmDM.exe
  C:\Windows\System\kvDjmDM.exe
  2⤵
  PID:11564
- C:\Windows\System\REGDESQ.exe
  C:\Windows\System\REGDESQ.exe
  2⤵
  PID:11588
- C:\Windows\System\BgNgUXI.exe
  C:\Windows\System\BgNgUXI.exe
  2⤵
  PID:11612
- C:\Windows\System\NkdslXZ.exe
  C:\Windows\System\NkdslXZ.exe
  2⤵
  PID:11640
- C:\Windows\System\SqNyqJk.exe
  C:\Windows\System\SqNyqJk.exe
  2⤵
  PID:11684
- C:\Windows\System\AyeBfiu.exe
  C:\Windows\System\AyeBfiu.exe
  2⤵
  PID:11700
- C:\Windows\System\JpvlCuJ.exe
  C:\Windows\System\JpvlCuJ.exe
  2⤵
  PID:11720
- C:\Windows\System\BTAuduF.exe
  C:\Windows\System\BTAuduF.exe
  2⤵
  PID:11748
- C:\Windows\System\NoEsxqe.exe
  C:\Windows\System\NoEsxqe.exe
  2⤵
  PID:11768
- C:\Windows\System\qpwQFbb.exe
  C:\Windows\System\qpwQFbb.exe
  2⤵
  PID:11812
- C:\Windows\System\JKyPbMf.exe
  C:\Windows\System\JKyPbMf.exe
  2⤵
  PID:11832
- C:\Windows\System\JxBEzOc.exe
  C:\Windows\System\JxBEzOc.exe
  2⤵
  PID:11868
- C:\Windows\System\tmzjTnJ.exe
  C:\Windows\System\tmzjTnJ.exe
  2⤵
  PID:11900
- C:\Windows\System\bBlFvMy.exe
  C:\Windows\System\bBlFvMy.exe
  2⤵
  PID:11924
- C:\Windows\System\wmiQWRW.exe
  C:\Windows\System\wmiQWRW.exe
  2⤵
  PID:11944
- C:\Windows\System\LrbKFCk.exe
  C:\Windows\System\LrbKFCk.exe
  2⤵
  PID:11968
- C:\Windows\System\bZGmXeY.exe
  C:\Windows\System\bZGmXeY.exe
  2⤵
  PID:11992
- C:\Windows\System\HLfFLXc.exe
  C:\Windows\System\HLfFLXc.exe
  2⤵
  PID:12024
- C:\Windows\System\lPOqLHw.exe
  C:\Windows\System\lPOqLHw.exe
  2⤵
  PID:12040
- C:\Windows\System\xhWWQSo.exe
  C:\Windows\System\xhWWQSo.exe
  2⤵
  PID:12068
- C:\Windows\System\rhotHfU.exe
  C:\Windows\System\rhotHfU.exe
  2⤵
  PID:12112
- C:\Windows\System\MfhygAY.exe
  C:\Windows\System\MfhygAY.exe
  2⤵
  PID:12144
- C:\Windows\System\SdwkMrg.exe
  C:\Windows\System\SdwkMrg.exe
  2⤵
  PID:12160
- C:\Windows\System\GmwXzaM.exe
  C:\Windows\System\GmwXzaM.exe
  2⤵
  PID:12180
- C:\Windows\System\cHPAgFy.exe
  C:\Windows\System\cHPAgFy.exe
  2⤵
  PID:12200
- C:\Windows\System\SVnuyVC.exe
  C:\Windows\System\SVnuyVC.exe
  2⤵
  PID:12232
- C:\Windows\System\hkJjoiF.exe
  C:\Windows\System\hkJjoiF.exe
  2⤵
  PID:12260
- C:\Windows\System\VDFSzlB.exe
  C:\Windows\System\VDFSzlB.exe
  2⤵
  PID:11168
- C:\Windows\System\jeaoXRd.exe
  C:\Windows\System\jeaoXRd.exe
  2⤵
  PID:11280
- C:\Windows\System\mHIcNea.exe
  C:\Windows\System\mHIcNea.exe
  2⤵
  PID:11376
- C:\Windows\System\myhAAbr.exe
  C:\Windows\System\myhAAbr.exe
  2⤵
  PID:11440
- C:\Windows\System\AXtGEdW.exe
  C:\Windows\System\AXtGEdW.exe
  2⤵
  PID:11580
- C:\Windows\System\MLMZlaL.exe
  C:\Windows\System\MLMZlaL.exe
  2⤵
  PID:11576
- C:\Windows\System\dDYBwBC.exe
  C:\Windows\System\dDYBwBC.exe
  2⤵
  PID:11656
- C:\Windows\System\ezvOLPI.exe
  C:\Windows\System\ezvOLPI.exe
  2⤵
  PID:11680
- C:\Windows\System\XJsXKmY.exe
  C:\Windows\System\XJsXKmY.exe
  2⤵
  PID:11736
- C:\Windows\System\pDXlAvO.exe
  C:\Windows\System\pDXlAvO.exe
  2⤵
  PID:11840
- C:\Windows\System\PIUIggP.exe
  C:\Windows\System\PIUIggP.exe
  2⤵
  PID:11856
- C:\Windows\System\mdPihSN.exe
  C:\Windows\System\mdPihSN.exe
  2⤵
  PID:11932
- C:\Windows\System\zeXFehg.exe
  C:\Windows\System\zeXFehg.exe
  2⤵
  PID:12008
- C:\Windows\System\dfMSiqB.exe
  C:\Windows\System\dfMSiqB.exe
  2⤵
  PID:12188
- C:\Windows\System\EbAhLpP.exe
  C:\Windows\System\EbAhLpP.exe
  2⤵
  PID:12244
- C:\Windows\System\jJYhDqC.exe
  C:\Windows\System\jJYhDqC.exe
  2⤵
  PID:12216
- C:\Windows\System\kvRHGuq.exe
  C:\Windows\System\kvRHGuq.exe
  2⤵
  PID:11368
- C:\Windows\System\favBQZJ.exe
  C:\Windows\System\favBQZJ.exe
  2⤵
  PID:11508
- C:\Windows\System\hesEENz.exe
  C:\Windows\System\hesEENz.exe
  2⤵
  PID:11760
- C:\Windows\System\RCJGCZr.exe
  C:\Windows\System\RCJGCZr.exe
  2⤵
  PID:11792
- C:\Windows\System\mCtEmTf.exe
  C:\Windows\System\mCtEmTf.exe
  2⤵
  PID:11896
- C:\Windows\System\OBROQeN.exe
  C:\Windows\System\OBROQeN.exe
  2⤵
  PID:12108
- C:\Windows\System\JgBKQqX.exe
  C:\Windows\System\JgBKQqX.exe
  2⤵
  PID:12240
- C:\Windows\System\qhmpWhO.exe
  C:\Windows\System\qhmpWhO.exe
  2⤵
  PID:11468
- C:\Windows\System\cfelihQ.exe
  C:\Windows\System\cfelihQ.exe
  2⤵
  PID:11960
- C:\Windows\System\BbqOcko.exe
  C:\Windows\System\BbqOcko.exe
  2⤵
  PID:12176
- C:\Windows\System\UHnJlVv.exe
  C:\Windows\System\UHnJlVv.exe
  2⤵
  PID:12136
- C:\Windows\System\dFmVJOj.exe
  C:\Windows\System\dFmVJOj.exe
  2⤵
  PID:11756
- C:\Windows\System\eNVDMAT.exe
  C:\Windows\System\eNVDMAT.exe
  2⤵
  PID:12328
- C:\Windows\System\lTIkqUk.exe
  C:\Windows\System\lTIkqUk.exe
  2⤵
  PID:12356
- C:\Windows\System\scAOQgm.exe
  C:\Windows\System\scAOQgm.exe
  2⤵
  PID:12372
- C:\Windows\System\YjOpVlA.exe
  C:\Windows\System\YjOpVlA.exe
  2⤵
  PID:12400
- C:\Windows\System\JiDQnsl.exe
  C:\Windows\System\JiDQnsl.exe
  2⤵
  PID:12416
- C:\Windows\System\pJDzcVU.exe
  C:\Windows\System\pJDzcVU.exe
  2⤵
  PID:12440
- C:\Windows\System\NtcxuxF.exe
  C:\Windows\System\NtcxuxF.exe
  2⤵
  PID:12464
- C:\Windows\System\hpZWezG.exe
  C:\Windows\System\hpZWezG.exe
  2⤵
  PID:12512
- C:\Windows\System\QEkzZSD.exe
  C:\Windows\System\QEkzZSD.exe
  2⤵
  PID:12532
- C:\Windows\System\SoqvhdB.exe
  C:\Windows\System\SoqvhdB.exe
  2⤵
  PID:12568
- C:\Windows\System\SKmpglG.exe
  C:\Windows\System\SKmpglG.exe
  2⤵
  PID:12584
- C:\Windows\System\yAEkTej.exe
  C:\Windows\System\yAEkTej.exe
  2⤵
  PID:12600
- C:\Windows\System\HTzybQo.exe
  C:\Windows\System\HTzybQo.exe
  2⤵
  PID:12624
- C:\Windows\System\fWEJwsa.exe
  C:\Windows\System\fWEJwsa.exe
  2⤵
  PID:12656
- C:\Windows\System\gRDItXA.exe
  C:\Windows\System\gRDItXA.exe
  2⤵
  PID:12684
- C:\Windows\System\CJyBere.exe
  C:\Windows\System\CJyBere.exe
  2⤵
  PID:12708
- C:\Windows\System\fEdBGxK.exe
  C:\Windows\System\fEdBGxK.exe
  2⤵
  PID:12728
- C:\Windows\System\NDahNIW.exe
  C:\Windows\System\NDahNIW.exe
  2⤵
  PID:12756
- C:\Windows\System\IpUFdlC.exe
  C:\Windows\System\IpUFdlC.exe
  2⤵
  PID:12776
- C:\Windows\System\nKuKvRU.exe
  C:\Windows\System\nKuKvRU.exe
  2⤵
  PID:12824
- C:\Windows\System\umvcvEo.exe
  C:\Windows\System\umvcvEo.exe
  2⤵
  PID:12848
- C:\Windows\System\PZOReEY.exe
  C:\Windows\System\PZOReEY.exe
  2⤵
  PID:12876
- C:\Windows\System\HkqQzvF.exe
  C:\Windows\System\HkqQzvF.exe
  2⤵
  PID:12908
- C:\Windows\System\MWBxoQr.exe
  C:\Windows\System\MWBxoQr.exe
  2⤵
  PID:12924
- C:\Windows\System\qgNjyDX.exe
  C:\Windows\System\qgNjyDX.exe
  2⤵
  PID:12964
- C:\Windows\System\tGrQosN.exe
  C:\Windows\System\tGrQosN.exe
  2⤵
  PID:12996
- C:\Windows\System\umclTIl.exe
  C:\Windows\System\umclTIl.exe
  2⤵
  PID:13028
- C:\Windows\System\EQqpIAG.exe
  C:\Windows\System\EQqpIAG.exe
  2⤵
  PID:13048
- C:\Windows\System\mUvaVtE.exe
  C:\Windows\System\mUvaVtE.exe
  2⤵
  PID:13068
- C:\Windows\System\VFKyanT.exe
  C:\Windows\System\VFKyanT.exe
  2⤵
  PID:13116
- C:\Windows\System\IQYDIJP.exe
  C:\Windows\System\IQYDIJP.exe
  2⤵
  PID:13156
- C:\Windows\System\GttBycA.exe
  C:\Windows\System\GttBycA.exe
  2⤵
  PID:13184
- C:\Windows\System\oOYCeVW.exe
  C:\Windows\System\oOYCeVW.exe
  2⤵
  PID:13200
- C:\Windows\System\wosHAOc.exe
  C:\Windows\System\wosHAOc.exe
  2⤵
  PID:13244
- C:\Windows\System\PnMfATm.exe
  C:\Windows\System\PnMfATm.exe
  2⤵
  PID:13268
- C:\Windows\System\YcJcZIc.exe
  C:\Windows\System\YcJcZIc.exe
  2⤵
  PID:13288
- C:\Windows\System\MrcTcGw.exe
  C:\Windows\System\MrcTcGw.exe
  2⤵
  PID:13308
- C:\Windows\System\zudETjj.exe
  C:\Windows\System\zudETjj.exe
  2⤵
  PID:12344
- C:\Windows\System\GhEygjH.exe
  C:\Windows\System\GhEygjH.exe
  2⤵
  PID:12384
- C:\Windows\System\IJwsbpn.exe
  C:\Windows\System\IJwsbpn.exe
  2⤵
  PID:12452
- C:\Windows\System\KiEPLJQ.exe
  C:\Windows\System\KiEPLJQ.exe
  2⤵
  PID:12528
- C:\Windows\System\XPpLGHG.exe
  C:\Windows\System\XPpLGHG.exe
  2⤵
  PID:12632
- C:\Windows\System\ISTSDGc.exe
  C:\Windows\System\ISTSDGc.exe
  2⤵
  PID:12704
- C:\Windows\System\JbuhKsr.exe
  C:\Windows\System\JbuhKsr.exe
  2⤵
  PID:12736
- C:\Windows\System\vnBDMAK.exe
  C:\Windows\System\vnBDMAK.exe
  2⤵
  PID:12872
- C:\Windows\System\yUTJcFa.exe
  C:\Windows\System\yUTJcFa.exe
  2⤵
  PID:12844
- C:\Windows\System\ZPPtolt.exe
  C:\Windows\System\ZPPtolt.exe
  2⤵
  PID:12940
- C:\Windows\System\KvHSGNr.exe
  C:\Windows\System\KvHSGNr.exe
  2⤵
  PID:12952
- C:\Windows\System\MnLWWSC.exe
  C:\Windows\System\MnLWWSC.exe
  2⤵
  PID:13108
- C:\Windows\System\wEqeCTz.exe
  C:\Windows\System\wEqeCTz.exe
  2⤵
  PID:13140
- C:\Windows\System\uhxPoDA.exe
  C:\Windows\System\uhxPoDA.exe
  2⤵
  PID:13224
- C:\Windows\System\OYBlFiN.exe
  C:\Windows\System\OYBlFiN.exe
  2⤵
  PID:13284
- C:\Windows\System\vBTTSSS.exe
  C:\Windows\System\vBTTSSS.exe
  2⤵
  PID:13296
- C:\Windows\System\ENdaLPg.exe
  C:\Windows\System\ENdaLPg.exe
  2⤵
  PID:12496
- C:\Windows\System\gXVPgyY.exe
  C:\Windows\System\gXVPgyY.exe
  2⤵
  PID:12520
- C:\Windows\System\yaOArpY.exe
  C:\Windows\System\yaOArpY.exe
  2⤵
  PID:12716
- C:\Windows\System\KVDOlfg.exe
  C:\Windows\System\KVDOlfg.exe
  2⤵
  PID:12768
- C:\Windows\System\dphqQtZ.exe
  C:\Windows\System\dphqQtZ.exe
  2⤵
  PID:13040
- C:\Windows\System\mrBcAUA.exe
  C:\Windows\System\mrBcAUA.exe
  2⤵
  PID:12620
- C:\Windows\System\XjpqujE.exe
  C:\Windows\System\XjpqujE.exe
  2⤵
  PID:12492
- C:\Windows\System\gmBXyMv.exe
  C:\Windows\System\gmBXyMv.exe
  2⤵
  PID:12984
- C:\Windows\System\MMFYsPJ.exe
  C:\Windows\System\MMFYsPJ.exe
  2⤵
  PID:13260
- C:\Windows\System\KmcQbvw.exe
  C:\Windows\System\KmcQbvw.exe
  2⤵
  PID:13352
- C:\Windows\System\oXnSbas.exe
  C:\Windows\System\oXnSbas.exe
  2⤵
  PID:13368
- C:\Windows\System\yhYEbcF.exe
  C:\Windows\System\yhYEbcF.exe
  2⤵
  PID:13392
- C:\Windows\System\dtFTODf.exe
  C:\Windows\System\dtFTODf.exe
  2⤵
  PID:13436
- C:\Windows\System\qhPEnZf.exe
  C:\Windows\System\qhPEnZf.exe
  2⤵
  PID:13476
- C:\Windows\System\wBSKnml.exe
  C:\Windows\System\wBSKnml.exe
  2⤵
  PID:13504
- C:\Windows\System\cHqddcN.exe
  C:\Windows\System\cHqddcN.exe
  2⤵
  PID:13520
- C:\Windows\System\RmBiIYK.exe
  C:\Windows\System\RmBiIYK.exe
  2⤵
  PID:13548
- C:\Windows\System\IDDIuoT.exe
  C:\Windows\System\IDDIuoT.exe
  2⤵
  PID:13584
- C:\Windows\System\nfudvWy.exe
  C:\Windows\System\nfudvWy.exe
  2⤵
  PID:13604
- C:\Windows\System\WxcACyk.exe
  C:\Windows\System\WxcACyk.exe
  2⤵
  PID:13620
- C:\Windows\System\frWrVnf.exe
  C:\Windows\System\frWrVnf.exe
  2⤵
  PID:13648
- C:\Windows\System\MesASjw.exe
  C:\Windows\System\MesASjw.exe
  2⤵
  PID:13672
- C:\Windows\System\IJWqWwv.exe
  C:\Windows\System\IJWqWwv.exe
  2⤵
  PID:13704
- C:\Windows\System\ApmfvyW.exe
  C:\Windows\System\ApmfvyW.exe
  2⤵
  PID:13724
- C:\Windows\System\hGUySdr.exe
  C:\Windows\System\hGUySdr.exe
  2⤵
  PID:13748
- C:\Windows\System\ogIDosd.exe
  C:\Windows\System\ogIDosd.exe
  2⤵
  PID:13764
- C:\Windows\System\uwGEYNt.exe
  C:\Windows\System\uwGEYNt.exe
  2⤵
  PID:13828
- C:\Windows\System\GZEFOTH.exe
  C:\Windows\System\GZEFOTH.exe
  2⤵
  PID:13848
- C:\Windows\System\vBAUeYA.exe
  C:\Windows\System\vBAUeYA.exe
  2⤵
  PID:13868
- C:\Windows\System\TWCowDC.exe
  C:\Windows\System\TWCowDC.exe
  2⤵
  PID:13912
- C:\Windows\System\HTkOjRR.exe
  C:\Windows\System\HTkOjRR.exe
  2⤵
  PID:13928
- C:\Windows\System\thRrQxh.exe
  C:\Windows\System\thRrQxh.exe
  2⤵
  PID:13972
- C:\Windows\System\fhrIwHP.exe
  C:\Windows\System\fhrIwHP.exe
  2⤵
  PID:13996
- C:\Windows\System\ZmiUriP.exe
  C:\Windows\System\ZmiUriP.exe
  2⤵
  PID:14024
- C:\Windows\System\yplBkBP.exe
  C:\Windows\System\yplBkBP.exe
  2⤵
  PID:14048
- C:\Windows\System\mtZBjrq.exe
  C:\Windows\System\mtZBjrq.exe
  2⤵
  PID:14092
- C:\Windows\System\OOlKjjk.exe
  C:\Windows\System\OOlKjjk.exe
  2⤵
  PID:14120
- C:\Windows\System\SrzjDTW.exe
  C:\Windows\System\SrzjDTW.exe
  2⤵
  PID:14136
- C:\Windows\System\MqAZXrB.exe
  C:\Windows\System\MqAZXrB.exe
  2⤵
  PID:14152
- C:\Windows\System\kLktTge.exe
  C:\Windows\System\kLktTge.exe
  2⤵
  PID:14180
- C:\Windows\System\ZteMQkS.exe
  C:\Windows\System\ZteMQkS.exe
  2⤵
  PID:14208
- C:\Windows\System\oLDARzw.exe
  C:\Windows\System\oLDARzw.exe
  2⤵
  PID:14236
- C:\Windows\System\MPRmpCH.exe
  C:\Windows\System\MPRmpCH.exe
  2⤵
  PID:14252
- C:\Windows\System\XDRKFDx.exe
  C:\Windows\System\XDRKFDx.exe
  2⤵
  PID:14284
- C:\Windows\System\YcxGMnU.exe
  C:\Windows\System\YcxGMnU.exe
  2⤵
  PID:14308
- C:\Windows\System\SKcZYvt.exe
  C:\Windows\System\SKcZYvt.exe
  2⤵
  PID:13316
- C:\Windows\System\JJyVQob.exe
  C:\Windows\System\JJyVQob.exe
  2⤵
  PID:13324
- C:\Windows\System\qqfnPYB.exe
  C:\Windows\System\qqfnPYB.exe
  2⤵
  PID:13364
- C:\Windows\System\VHHerMx.exe
  C:\Windows\System\VHHerMx.exe
  2⤵
  PID:13492
- C:\Windows\System\dNTRoNi.exe
  C:\Windows\System\dNTRoNi.exe
  2⤵
  PID:13516
- C:\Windows\System\AjnEWdS.exe
  C:\Windows\System\AjnEWdS.exe
  2⤵
  PID:13664
- C:\Windows\System\pRBwJsk.exe
  C:\Windows\System\pRBwJsk.exe
  2⤵
  PID:13696
- C:\Windows\System\SezFZWA.exe
  C:\Windows\System\SezFZWA.exe
  2⤵
  PID:13808
- C:\Windows\System\JJZrNxi.exe
  C:\Windows\System\JJZrNxi.exe
  2⤵
  PID:13840
- C:\Windows\System\WxLqFzu.exe
  C:\Windows\System\WxLqFzu.exe
  2⤵
  PID:13944
- C:\Windows\System\qIyaGzu.exe
  C:\Windows\System\qIyaGzu.exe
  2⤵
  PID:13960
- C:\Windows\System\xLALDRR.exe
  C:\Windows\System\xLALDRR.exe
  2⤵
  PID:14008
- C:\Windows\System\qEOKFDU.exe
  C:\Windows\System\qEOKFDU.exe
  2⤵
  PID:14068
- C:\Windows\System\hXfpktT.exe
  C:\Windows\System\hXfpktT.exe
  2⤵
  PID:14144
- C:\Windows\System\RUhVtar.exe
  C:\Windows\System\RUhVtar.exe
  2⤵
  PID:14220
- C:\Windows\System\KzEdQhn.exe
  C:\Windows\System\KzEdQhn.exe
  2⤵
  PID:14264
- C:\Windows\System\iTQXIQe.exe
  C:\Windows\System\iTQXIQe.exe
  2⤵
  PID:14316
- C:\Windows\System\iHAaqpE.exe
  C:\Windows\System\iHAaqpE.exe
  2⤵
  PID:13408
- C:\Windows\System\KNBWsqZ.exe
  C:\Windows\System\KNBWsqZ.exe
  2⤵
  PID:13596
- C:\Windows\System\PRhEJTL.exe
  C:\Windows\System\PRhEJTL.exe
  2⤵
  PID:13720
- C:\Windows\System\OjyPlkW.exe
  C:\Windows\System\OjyPlkW.exe
  2⤵
  PID:13888
- C:\Windows\System\isovZxf.exe
  C:\Windows\System\isovZxf.exe
  2⤵
  PID:14128
- C:\Windows\System\OVMRXXt.exe
  C:\Windows\System\OVMRXXt.exe
  2⤵
  PID:14164
- C:\Windows\System\wcwmNgM.exe
  C:\Windows\System\wcwmNgM.exe
  2⤵
  PID:14204
- C:\Windows\System\xIOsXJZ.exe
  C:\Windows\System\xIOsXJZ.exe
  2⤵
  PID:13512
- C:\Windows\System\uyiZJcH.exe
  C:\Windows\System\uyiZJcH.exe
  2⤵
  PID:13900
- C:\Windows\System\eDEYKgM.exe
  C:\Windows\System\eDEYKgM.exe
  2⤵
  PID:13380
- C:\Windows\System\MjyDrcO.exe
  C:\Windows\System\MjyDrcO.exe
  2⤵
  PID:14192
- C:\Windows\System\rpVKXes.exe
  C:\Windows\System\rpVKXes.exe
  2⤵
  PID:14356
- C:\Windows\System\GTUSTWE.exe
  C:\Windows\System\GTUSTWE.exe
  2⤵
  PID:14388
- C:\Windows\System\ouVINIQ.exe
  C:\Windows\System\ouVINIQ.exe
  2⤵
  PID:14416
- C:\Windows\System\oGCFaTw.exe
  C:\Windows\System\oGCFaTw.exe
  2⤵
  PID:14440
- C:\Windows\System\tmMvJoQ.exe
  C:\Windows\System\tmMvJoQ.exe
  2⤵
  PID:14460
- C:\Windows\System\xxllwuu.exe
  C:\Windows\System\xxllwuu.exe
  2⤵
  PID:14492
- C:\Windows\System\qUhBQIM.exe
  C:\Windows\System\qUhBQIM.exe
  2⤵
  PID:14516
- C:\Windows\System\Rzqijik.exe
  C:\Windows\System\Rzqijik.exe
  2⤵
  PID:14540
- C:\Windows\System\jlPWegn.exe
  C:\Windows\System\jlPWegn.exe
  2⤵
  PID:14568
- C:\Windows\System\pcErhCn.exe
  C:\Windows\System\pcErhCn.exe
  2⤵
  PID:14596
- C:\Windows\System\OHTfOAO.exe
  C:\Windows\System\OHTfOAO.exe
  2⤵
  PID:14652
- C:\Windows\System\QMNXuBM.exe
  C:\Windows\System\QMNXuBM.exe
  2⤵
  PID:14680
- C:\Windows\System\nFZkEby.exe
  C:\Windows\System\nFZkEby.exe
  2⤵
  PID:14696
- C:\Windows\System\zjxtkkO.exe
  C:\Windows\System\zjxtkkO.exe
  2⤵
  PID:14712
- C:\Windows\System\AJBMwlN.exe
  C:\Windows\System\AJBMwlN.exe
  2⤵
  PID:14736
- C:\Windows\System\NSrhvVA.exe
  C:\Windows\System\NSrhvVA.exe
  2⤵
  PID:14756
- C:\Windows\System\nMpuAFH.exe
  C:\Windows\System\nMpuAFH.exe
  2⤵
  PID:14780
- C:\Windows\System\FymIybu.exe
  C:\Windows\System\FymIybu.exe
  2⤵
  PID:14852
- C:\Windows\System\NsOaVMd.exe
  C:\Windows\System\NsOaVMd.exe
  2⤵
  PID:14868
- C:\Windows\System\dmDIAkd.exe
  C:\Windows\System\dmDIAkd.exe
  2⤵
  PID:14908
- C:\Windows\System\nfXAurt.exe
  C:\Windows\System\nfXAurt.exe
  2⤵
  PID:14936
- C:\Windows\System\XwIMOfy.exe
  C:\Windows\System\XwIMOfy.exe
  2⤵
  PID:14952
- C:\Windows\System\ULrGikp.exe
  C:\Windows\System\ULrGikp.exe
  2⤵
  PID:14968
- C:\Windows\System\oeitGxO.exe
  C:\Windows\System\oeitGxO.exe
  2⤵
  PID:14984
- C:\Windows\System\HLTvxyW.exe
  C:\Windows\System\HLTvxyW.exe
  2⤵
  PID:15032
- C:\Windows\System\QLkFcKF.exe
  C:\Windows\System\QLkFcKF.exe
  2⤵
  PID:15064
- C:\Windows\System\bnGBSmC.exe
  C:\Windows\System\bnGBSmC.exe
  2⤵
  PID:15080
- C:\Windows\System\qwKcKjh.exe
  C:\Windows\System\qwKcKjh.exe
  2⤵
  PID:15116
- C:\Windows\System\YwsWlej.exe
  C:\Windows\System\YwsWlej.exe
  2⤵
  PID:15136
- C:\Windows\System\BFgLeZr.exe
  C:\Windows\System\BFgLeZr.exe
  2⤵
  PID:15188
- C:\Windows\System\QbFYvct.exe
  C:\Windows\System\QbFYvct.exe
  2⤵
  PID:15204
- C:\Windows\System\paUkEhh.exe
  C:\Windows\System\paUkEhh.exe
  2⤵
  PID:15220
- C:\Windows\System\KIaAfmj.exe
  C:\Windows\System\KIaAfmj.exe
  2⤵
  PID:15248
- C:\Windows\System\uFuSZtT.exe
  C:\Windows\System\uFuSZtT.exe
  2⤵
  PID:15280
- C:\Windows\System\PYVECvb.exe
  C:\Windows\System\PYVECvb.exe
  2⤵
  PID:15300
- C:\Windows\System\SXzgRRC.exe
  C:\Windows\System\SXzgRRC.exe
  2⤵
  PID:15328
- C:\Windows\System\ltSFkOp.exe
  C:\Windows\System\ltSFkOp.exe
  2⤵
  PID:15348
- C:\Windows\System\KHiJmfW.exe
  C:\Windows\System\KHiJmfW.exe
  2⤵
  PID:13800
- C:\Windows\System\TsLnufR.exe
  C:\Windows\System\TsLnufR.exe
  2⤵
  PID:14380
- C:\Windows\System\wRnSRzL.exe
  C:\Windows\System\wRnSRzL.exe
  2⤵
  PID:14428
- C:\Windows\System\fDDfBjP.exe
  C:\Windows\System\fDDfBjP.exe
  2⤵
  PID:14512
- C:\Windows\System\DjbwPNa.exe
  C:\Windows\System\DjbwPNa.exe
  2⤵
  PID:14576
- C:\Windows\System\OhlEvhv.exe
  C:\Windows\System\OhlEvhv.exe
  2⤵
  PID:14664
- C:\Windows\System\gacqBxT.exe
  C:\Windows\System\gacqBxT.exe
  2⤵
  PID:14728
- C:\Windows\System\LlAHnjE.exe
  C:\Windows\System\LlAHnjE.exe
  2⤵
  PID:14752
- C:\Windows\System\LjxgqYG.exe
  C:\Windows\System\LjxgqYG.exe
  2⤵
  PID:14812
- C:\Windows\System\gQzxVuB.exe
  C:\Windows\System\gQzxVuB.exe
  2⤵
  PID:14924
- C:\Windows\System\lhgumIM.exe
  C:\Windows\System\lhgumIM.exe
  2⤵
  PID:15072
- C:\Windows\System\vcpCUJO.exe
  C:\Windows\System\vcpCUJO.exe
  2⤵
  PID:15100
- C:\Windows\System\EWzUTGd.exe
  C:\Windows\System\EWzUTGd.exe
  2⤵
  PID:15160
- C:\Windows\System\rrVdcAk.exe
  C:\Windows\System\rrVdcAk.exe
  2⤵
  PID:15200
- C:\Windows\System\wqHMrfU.exe
  C:\Windows\System\wqHMrfU.exe
  2⤵
  PID:15288
- C:\Windows\System\fTOYonP.exe
  C:\Windows\System\fTOYonP.exe
  2⤵
  PID:15340
- C:\Windows\System\mzpMirP.exe
  C:\Windows\System\mzpMirP.exe
  2⤵
  PID:14472
- C:\Windows\System\JUzVvvK.exe
  C:\Windows\System\JUzVvvK.exe
  2⤵
  PID:14608
- C:\Windows\System\GCHAmPi.exe
  C:\Windows\System\GCHAmPi.exe
  2⤵
  PID:14764
- C:\Windows\System\jhaKAGT.exe
  C:\Windows\System\jhaKAGT.exe
  2⤵
  PID:14820
- C:\Windows\System\dBRMYKQ.exe
  C:\Windows\System\dBRMYKQ.exe
  2⤵
  PID:15044
- C:\Windows\System\wBLyURf.exe
  C:\Windows\System\wBLyURf.exe
  2⤵
  PID:15216
- C:\Windows\System\tOMJHsw.exe
  C:\Windows\System\tOMJHsw.exe
  2⤵
  PID:15324
- C:\Windows\System\thyKlhS.exe
  C:\Windows\System\thyKlhS.exe
  2⤵
  PID:14748
- C:\Windows\System\iBBWDDp.exe
  C:\Windows\System\iBBWDDp.exe
  2⤵
  PID:15196
- C:\Windows\System\ATXMAUb.exe
  C:\Windows\System\ATXMAUb.exe
  2⤵
  PID:14668
- C:\Windows\System\RKiYKDw.exe
  C:\Windows\System\RKiYKDw.exe
  2⤵
  PID:15356
- C:\Windows\System\PBytIlW.exe
  C:\Windows\System\PBytIlW.exe
  2⤵
  PID:15388
- C:\Windows\System\stoOfzV.exe
  C:\Windows\System\stoOfzV.exe
  2⤵
  PID:15436
- C:\Windows\System\mAwkaxi.exe
  C:\Windows\System\mAwkaxi.exe
  2⤵
  PID:15452
- C:\Windows\System\iirjUDX.exe
  C:\Windows\System\iirjUDX.exe
  2⤵
  PID:15480
- C:\Windows\System\tHqUmqW.exe
  C:\Windows\System\tHqUmqW.exe
  2⤵
  PID:15500
- C:\Windows\System\HxKlEQP.exe
  C:\Windows\System\HxKlEQP.exe
  2⤵
  PID:15520
- C:\Windows\System\nWoBAtk.exe
  C:\Windows\System\nWoBAtk.exe
  2⤵
  PID:15548
- C:\Windows\System\Ptpotzy.exe
  C:\Windows\System\Ptpotzy.exe
  2⤵
  PID:15572
- C:\Windows\System\dJHYgBB.exe
  C:\Windows\System\dJHYgBB.exe
  2⤵
  PID:15600
- C:\Windows\System\acNBNWT.exe
  C:\Windows\System\acNBNWT.exe
  2⤵
  PID:15648
- C:\Windows\System\rhLzdYz.exe
  C:\Windows\System\rhLzdYz.exe
  2⤵
  PID:15680
- C:\Windows\System\PoRzVUT.exe
  C:\Windows\System\PoRzVUT.exe
  2⤵
  PID:15704
- C:\Windows\System\cSDbhWd.exe
  C:\Windows\System\cSDbhWd.exe
  2⤵
  PID:15728
- C:\Windows\System\LtTSmrl.exe
  C:\Windows\System\LtTSmrl.exe
  2⤵
  PID:15748
- C:\Windows\System\YYAcmAm.exe
  C:\Windows\System\YYAcmAm.exe
  2⤵
  PID:15772
- C:\Windows\System\pAshfza.exe
  C:\Windows\System\pAshfza.exe
  2⤵
  PID:15792
- C:\Windows\System\ZYqQVUg.exe
  C:\Windows\System\ZYqQVUg.exe
  2⤵
  PID:15812
- C:\Windows\System\niBPWqJ.exe
  C:\Windows\System\niBPWqJ.exe
  2⤵
  PID:15848
- C:\Windows\System\SCJFHIS.exe
  C:\Windows\System\SCJFHIS.exe
  2⤵
  PID:15880
- C:\Windows\System\KuJffwU.exe
  C:\Windows\System\KuJffwU.exe
  2⤵
  PID:15904
- C:\Windows\System\ZoRDrBF.exe
  C:\Windows\System\ZoRDrBF.exe
  2⤵
  PID:15932
- C:\Windows\System\ciLrHkH.exe
  C:\Windows\System\ciLrHkH.exe
  2⤵
  PID:15976
- C:\Windows\System\xXFdOLP.exe
  C:\Windows\System\xXFdOLP.exe
  2⤵
  PID:16000
- C:\Windows\System\BvDAbVR.exe
  C:\Windows\System\BvDAbVR.exe
  2⤵
  PID:16036
- C:\Windows\System\LrMKMDc.exe
  C:\Windows\System\LrMKMDc.exe
  2⤵
  PID:16056
- C:\Windows\System\tjcdeTG.exe
  C:\Windows\System\tjcdeTG.exe
  2⤵
  PID:16076
- C:\Windows\System\JOePxjJ.exe
  C:\Windows\System\JOePxjJ.exe
  2⤵
  PID:16104
- C:\Windows\System\JFsBfwI.exe
  C:\Windows\System\JFsBfwI.exe
  2⤵
  PID:16128
- C:\Windows\System\ytrSTKx.exe
  C:\Windows\System\ytrSTKx.exe
  2⤵
  PID:16152
- C:\Windows\System\rYmXoSF.exe
  C:\Windows\System\rYmXoSF.exe
  2⤵
  PID:16220
- C:\Windows\System\XPaGTYL.exe
  C:\Windows\System\XPaGTYL.exe
  2⤵
  PID:16248
- C:\Windows\System\vTEOsox.exe
  C:\Windows\System\vTEOsox.exe
  2⤵
  PID:16280
- C:\Windows\System\ooNILuE.exe
  C:\Windows\System\ooNILuE.exe
  2⤵
  PID:16300
- C:\Windows\System\jkXeOQa.exe
  C:\Windows\System\jkXeOQa.exe
  2⤵
  PID:16316
- C:\Windows\System\VObAbay.exe
  C:\Windows\System\VObAbay.exe
  2⤵
  PID:16332
- C:\Windows\System\cMEacEH.exe
  C:\Windows\System\cMEacEH.exe
  2⤵
  PID:16360
- C:\Windows\System\uhqPKjE.exe
  C:\Windows\System\uhqPKjE.exe
  2⤵
  PID:14528
- C:\Windows\System\FpUmIRV.exe
  C:\Windows\System\FpUmIRV.exe
  2⤵
  PID:15376
- C:\Windows\System\QwKHTOG.exe
  C:\Windows\System\QwKHTOG.exe
  2⤵
  PID:15444
- C:\Windows\System\QHxfuRJ.exe
  C:\Windows\System\QHxfuRJ.exe
  2⤵
  PID:15592
- C:\Windows\System\dQjpjmS.exe
  C:\Windows\System\dQjpjmS.exe
  2⤵
  PID:15584
- C:\Windows\System\eizMhxB.exe
  C:\Windows\System\eizMhxB.exe
  2⤵
  PID:15720
- C:\Windows\System\rCOdvZq.exe
  C:\Windows\System\rCOdvZq.exe
  2⤵
  PID:15820
- C:\Windows\System\FuKgaEJ.exe
  C:\Windows\System\FuKgaEJ.exe
  2⤵
  PID:15836
- C:\Windows\System\OGZAHHH.exe
  C:\Windows\System\OGZAHHH.exe
  2⤵
  PID:15928
- C:\Windows\System\SBKkrVd.exe
  C:\Windows\System\SBKkrVd.exe
  2⤵
  PID:15956
- C:\Windows\System\ZuoniVZ.exe
  C:\Windows\System\ZuoniVZ.exe
  2⤵
  PID:15968
- C:\Windows\System\KNuDXyc.exe
  C:\Windows\System\KNuDXyc.exe
  2⤵
  PID:16124
- C:\Windows\System\qPUazbp.exe
  C:\Windows\System\qPUazbp.exe
  2⤵
  PID:16148
- C:\Windows\System\NryDLcZ.exe
  C:\Windows\System\NryDLcZ.exe
  2⤵
  PID:16204
- C:\Windows\System\zmovtsq.exe
  C:\Windows\System\zmovtsq.exe
  2⤵
  PID:16244
- C:\Windows\System\tyhDjSQ.exe
  C:\Windows\System\tyhDjSQ.exe
  2⤵
  PID:16324
- C:\Windows\System\JDVjqZF.exe
  C:\Windows\System\JDVjqZF.exe
  2⤵
  PID:15448
- C:\Windows\System\BvZphDq.exe
  C:\Windows\System\BvZphDq.exe
  2⤵
  PID:15568
- C:\Windows\System\yidnrlx.exe
  C:\Windows\System\yidnrlx.exe
  2⤵
  PID:15764
- C:\Windows\System\qPLVTga.exe
  C:\Windows\System\qPLVTga.exe
  2⤵
  PID:15992
- C:\Windows\System\DaPgbJO.exe
  C:\Windows\System\DaPgbJO.exe
  2⤵
  PID:14848
- C:\Windows\System\nVTiNUv.exe
  C:\Windows\System\nVTiNUv.exe
  2⤵
  PID:16208
- C:\Windows\System\bqsgNqs.exe
  C:\Windows\System\bqsgNqs.exe
  2⤵
  PID:16288
- C:\Windows\System\aOgUqdy.exe
  C:\Windows\System\aOgUqdy.exe
  2⤵
  PID:15608
- C:\Windows\System\rbAOOTv.exe
  C:\Windows\System\rbAOOTv.exe
  2⤵
  PID:16020
- C:\Windows\System\jwTlBRw.exe
  C:\Windows\System\jwTlBRw.exe
  2⤵
  PID:16168
- C:\Windows\System\tmCgjJY.exe
  C:\Windows\System\tmCgjJY.exe
  2⤵
  PID:15868
- C:\Windows\System\nmjaTSp.exe
  C:\Windows\System\nmjaTSp.exe
  2⤵
  PID:16396
- C:\Windows\System\ipDOFVP.exe
  C:\Windows\System\ipDOFVP.exe
  2⤵
  PID:16412
- C:\Windows\System\EmhapBJ.exe
  C:\Windows\System\EmhapBJ.exe
  2⤵
  PID:16440
- C:\Windows\System\OSBvmJB.exe
  C:\Windows\System\OSBvmJB.exe
  2⤵
  PID:16480
- C:\Windows\System\UIFNIsB.exe
  C:\Windows\System\UIFNIsB.exe
  2⤵
  PID:16496
- C:\Windows\System\KVwSiff.exe
  C:\Windows\System\KVwSiff.exe
  2⤵
  PID:16524
- C:\Windows\System\zNQbPRJ.exe
  C:\Windows\System\zNQbPRJ.exe
  2⤵
  PID:16540
- C:\Windows\System\TccgaXj.exe
  C:\Windows\System\TccgaXj.exe
  2⤵
  PID:16572
- C:\Windows\System\VcqkWSQ.exe
  C:\Windows\System\VcqkWSQ.exe
  2⤵
  PID:16596
- C:\Windows\System\SPXWXiJ.exe
  C:\Windows\System\SPXWXiJ.exe
  2⤵
  PID:16612
- C:\Windows\System\WOvOZHt.exe
  C:\Windows\System\WOvOZHt.exe
  2⤵
  PID:16628
- C:\Windows\System\uQCFvEk.exe
  C:\Windows\System\uQCFvEk.exe
  2⤵
  PID:16656
- C:\Windows\System\WDtJgIn.exe
  C:\Windows\System\WDtJgIn.exe
  2⤵
  PID:16728
- C:\Windows\System\xLcqdwr.exe
  C:\Windows\System\xLcqdwr.exe
  2⤵
  PID:16752
- C:\Windows\System\QAXtuVx.exe
  C:\Windows\System\QAXtuVx.exe
  2⤵
  PID:16768
- C:\Windows\System\bZXopgO.exe
  C:\Windows\System\bZXopgO.exe
  2⤵
  PID:16792
- C:\Windows\System\PWuuOAX.exe
  C:\Windows\System\PWuuOAX.exe
  2⤵
  PID:16844
- C:\Windows\System\KWnZfXC.exe
  C:\Windows\System\KWnZfXC.exe
  2⤵
  PID:16868
- C:\Windows\System\ApRdLSa.exe
  C:\Windows\System\ApRdLSa.exe
  2⤵
  PID:16892
- C:\Windows\System\gebKkhI.exe
  C:\Windows\System\gebKkhI.exe
  2⤵
  PID:16908
- C:\Windows\System\zHkygpN.exe
  C:\Windows\System\zHkygpN.exe
  2⤵
  PID:16944
- C:\Windows\System\fXSWTjU.exe
  C:\Windows\System\fXSWTjU.exe
  2⤵
  PID:16960
- C:\Windows\System\bRbZskI.exe
  C:\Windows\System\bRbZskI.exe
  2⤵
  PID:16980
- C:\Windows\System\qqUTWXf.exe
  C:\Windows\System\qqUTWXf.exe
  2⤵
  PID:17060
- C:\Windows\System\cgDUaAo.exe
  C:\Windows\System\cgDUaAo.exe
  2⤵
  PID:17076
- C:\Windows\System\TZdVMMI.exe
  C:\Windows\System\TZdVMMI.exe
  2⤵
  PID:17096
- C:\Windows\System\kWIwpdE.exe
  C:\Windows\System\kWIwpdE.exe
  2⤵
  PID:17120
- C:\Windows\System\hJQaPAY.exe
  C:\Windows\System\hJQaPAY.exe
  2⤵
  PID:17136
- C:\Windows\System\IVGuZpy.exe
  C:\Windows\System\IVGuZpy.exe
  2⤵
  PID:17160
- C:\Windows\System\CzoxDuy.exe
  C:\Windows\System\CzoxDuy.exe
  2⤵
  PID:17188
- C:\Windows\System\zEfAFhs.exe
  C:\Windows\System\zEfAFhs.exe
  2⤵
  PID:17228
- C:\Windows\System\ilDkANv.exe
  C:\Windows\System\ilDkANv.exe
  2⤵
  PID:17244
- C:\Windows\System\GxzljBp.exe
  C:\Windows\System\GxzljBp.exe
  2⤵
  PID:17276
- C:\Windows\System\lHsEbGL.exe
  C:\Windows\System\lHsEbGL.exe
  2⤵
  PID:17312
- C:\Windows\System\TbAxsoj.exe
  C:\Windows\System\TbAxsoj.exe
  2⤵
  PID:17356
- C:\Windows\System\vgjlDUs.exe
  C:\Windows\System\vgjlDUs.exe
  2⤵
  PID:17372
- C:\Windows\System\NrKUccl.exe
  C:\Windows\System\NrKUccl.exe
  2⤵
  PID:17388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3768,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
1⤵
PID:5944

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv n1UYUIdgz0GhipsregDF5Q.0.2
1⤵
PID:17148
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 17148 -s 980
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:16648

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 17148 -i 17148 -h 448 -j 456 -s 468 -d 17380
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:16460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AttXxdU.exe

Path C:\Windows\System\AttXxdU.exe
Size 1.1MB
SHA256 479828a6cec099749ff512d59049b1e6f8bc0252e6cfa2498b87ee3aeba4a7c8
MD5 7e86979084c553f21e8c5b18f43dd7ce
SHA1 6a8ff9bb5c8e66f879b6084dd9399721d5faf103
SHA512 1ea5ffb753326544af6cbed47fd08f57ee47d3038954e2f5495ff5611403cf05209748c582259c0c7e59df26e03e7da640e2caeb949878ee8c10b27e75397641
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTE:GezaTF8FcNkNdfE0pZ9oztFwIRy1E
MD5 SHA1 SHA512 SSDEEP

Submit Download

CevlBXr.exe

Path C:\Windows\System\CevlBXr.exe
Size 1.1MB
SHA256 6b7be512409816c206c4c2561b3f87f8369cefacfc1c888642b390655b14aa16
MD5 5d95f4312b62e0da824102d8c6456d6e
SHA1 d9ab531d49d52619030e0a87c46229c9e4cd072c
SHA512 1eba687bc18d161418328bc04242bb1bb3e3410eb45a5d6c13cd2b3d8d9c5ec6175c7241189645db1f941382baaddc1f6445eb969b27eeec7115648939ed35ee
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTK:GezaTF8FcNkNdfE0pZ9oztFwIRy1K
MD5 SHA1 SHA512 SSDEEP

Submit Download

EygKXyf.exe

Path C:\Windows\System\EygKXyf.exe
Size 1.1MB
SHA256 78b25a91404607628b37cc374349f1b69cabffb3160f4913011d72420c2de28e
MD5 2393fa99f81ce54683ad4a4ae5307f35
SHA1 f16a968982abfabf0253d4022d037510546e1323
SHA512 0919ff7a45394811e28d8d545f9e42d43f94e2e94a4efde8f0772007fb29dded8cc9d46b9a35b7b3cdf21646d5a8febaa1d36f45f9208edd4fac63b5ccef6d6f
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XT9:GezaTF8FcNkNdfE0pZ9oztFwIRy19
MD5 SHA1 SHA512 SSDEEP

Submit Download

FpiZzHl.exe

Path C:\Windows\System\FpiZzHl.exe
Size 1.1MB
SHA256 827205dc99b3aa838805b109f2a635c7acf4b95e2189e2c96149eb11a4a1fada
MD5 ece13604a142bd4d3307aeb30a9ea20a
SHA1 b84a97ccd6aa7d028cd66261cc94442b931adc22
SHA512 361af87252bbf5f7473a416eaafe859b0af440d99f4ac7c67127e0ae50fbe1a3c86393f360d48bd6864efe657cc1eaff4e5fb5fdfb50e72992dc5b111b3b9619
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTh:GezaTF8FcNkNdfE0pZ9oztFwIRy1h
MD5 SHA1 SHA512 SSDEEP

Submit Download

GJQPQiM.exe

Path C:\Windows\System\GJQPQiM.exe
Size 1.1MB
SHA256 8ee490865a243425999238ae4e8c4e3249a2e29c05538a9e25a57dd2289cf01e
MD5 e97cb04b9720beeea5725c2d015c2dbb
SHA1 1196103da1d2b61c05edec564680519222ee1d34
SHA512 d8175235e113f96bc75ca6eecd7c5e6e9721112835e9929570dd794cb6d1d2d610d298d25b9a934188fcfaa88ffea2fd9c426b38ad673df2d27e36abac269b1e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XT5:GezaTF8FcNkNdfE0pZ9oztFwIRy15
MD5 SHA1 SHA512 SSDEEP

Submit Download

IahhPAQ.exe

Path C:\Windows\System\IahhPAQ.exe
Size 1.1MB
SHA256 ffdddf304d354a1032b152ffb3c4f1dcd9a9979ec33f4561630e6466971d0d64
MD5 c107d4812c6f1492f4544a7d947e6187
SHA1 a7d8c25d35b8b7fda06337cd92bbc968f3da0fbd
SHA512 5829edab3f008aa34a99efce652d0426fcbc98e8014c5b6d09b784bc8d2e6625e07a998fa634935d5d9b26d5af1821b53a1a4fa9f96c47f565bd21d228c2ca87
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTI:GezaTF8FcNkNdfE0pZ9oztFwIRy1I
MD5 SHA1 SHA512 SSDEEP

Submit Download

JUSoout.exe

Path C:\Windows\System\JUSoout.exe
Size 1.1MB
SHA256 27ba75bebae87c6cb5b3c17c9dcf67d81e1f48eaf808f2a997cb7aa5b260fcfc
MD5 9ac2a845137757e0dfc36f16a63a5399
SHA1 604825d60d1e1f3fd0eafc12057b9808465fbf47
SHA512 98f49b5d586103139345b5856ff3b4b9a84b299fd67a7606d7811420242bc594d830d1f09e69aae19379509f8a5a17384c11d827234627bf4ed99a17365b0083
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTN:GezaTF8FcNkNdfE0pZ9oztFwIRy1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSdcrxO.exe

Path C:\Windows\System\LSdcrxO.exe
Size 1.1MB
SHA256 c3bfff9b0443f589961773c8ca7ef54eb24533ea0d45672ea44ab3d344721f06
MD5 2a0659476501d299c01a231526d384f0
SHA1 6ae897108caf113347a422cefd541511ff351aeb
SHA512 6ca2dbb6b296a46b37442943bfd306d36db2305cb5a64a6d578f7267989686a18a15e9b9b8fb4c0609dc4f6b5b7563690fba7e8c7e0b319ef1e8008015ba02a8
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTd:GezaTF8FcNkNdfE0pZ9oztFwIRy1d
MD5 SHA1 SHA512 SSDEEP

Submit Download

MIzEqlm.exe

Path C:\Windows\System\MIzEqlm.exe
Size 1.1MB
SHA256 87180af0436af8abd31ee309da47591493ce7f885cd7b19e063ed4857ec825e3
MD5 b2a95419b2d14d9f6444074b7f771788
SHA1 7468ef12629b1375c2971f325a75357ef8a1945f
SHA512 bf0a06db83120d1c2828163f6ae12f00bd297afc7544972aa5637162fd340a3a7da73589761d39aa78307fb81af1e848730722904f4a060d23f162946e06869c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTd:GezaTF8FcNkNdfE0pZ9oztFwIRy1d
MD5 SHA1 SHA512 SSDEEP

Submit Download

NmXRYXh.exe

Path C:\Windows\System\NmXRYXh.exe
Size 1.1MB
SHA256 e2e7c016bb738bed7754e66f48a964b7e3815d8b8b0afcbfb8a5ac65de26e18f
MD5 afe11fbdd875fb05139c26b076671694
SHA1 f4c94cd1b2f3e5d71ea3be0dda35915078d2de85
SHA512 9ada0b43857777f2da6fa155ec41185c50cc26f7a9eeedb77aa1bc9690dfe972396b6ffb763211c0704d88c6d1154b4bac14376c8da43337ecfe26fbb41874fb
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTb:GezaTF8FcNkNdfE0pZ9oztFwIRy1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

ONCgJnW.exe

Path C:\Windows\System\ONCgJnW.exe
Size 1.1MB
SHA256 2d8773d4d6e75cb12650f7b2f3fff16de642f5989d1d1afc828f50afcc4933be
MD5 983ee9c9455ead27eaa0f1ca8c74f00a
SHA1 5756f601b7da7de8743cbacaed8ae7cd5aaf8faf
SHA512 c69e003d1539cb1c21735f277fa31bea6f59dcc70ca9363b5a02c39d773a51c936f7fa213005c99c8a79f2a41ad78cbe13001bc0e80f76449b460d29ec4196d6
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTB:GezaTF8FcNkNdfE0pZ9oztFwIRy1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

OgNzkte.exe

Path C:\Windows\System\OgNzkte.exe
Size 1.1MB
SHA256 2fb6d77883e68dccccd03d295d1c589d99147b6df5a0bf297f2218162e4a7733
MD5 980de87c203ad5235e7dfdb1d9fb4159
SHA1 b4f25f5b5aafa9d290ec14d94f7da9d298b274ea
SHA512 5b34b8a2524781f80ff8da96e5cc2d6e0d8e9c14fbed4259688af97dec929de53cdcfbad2ec80f29641754a4c811e5e850ebb09f41a54cc180fc9db5a732bd2e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTIp:GezaTF8FcNkNdfE0pZ9oztFwIRy1S
MD5 SHA1 SHA512 SSDEEP

Submit Download

PZlthcu.exe

Path C:\Windows\System\PZlthcu.exe
Size 1.1MB
SHA256 6e51045b17a43c9cbc553e93745a6c7b679c94c78c11cdfcbfbe1026933cd8b9
MD5 b516c0017a480ea6df8420534ab09688
SHA1 cd1de19de13071dd1fde7896047754ce0907299d
SHA512 3f596221e9e2bf4393a3cbca9805307c05957f5b8a639f37f75351d5d2b5c182ca9006d6f0d7499fa68b0b2c3f17639f13df7d5e81fe8e949c9c384a5643be90
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XT5:GezaTF8FcNkNdfE0pZ9oztFwIRy15
MD5 SHA1 SHA512 SSDEEP

Submit Download

QYmauOM.exe

Path C:\Windows\System\QYmauOM.exe
Size 1.1MB
SHA256 0d67acdd78d8402c5a1687eccf9e0908dc51ad9f0d668198742e6225e080756d
MD5 c5ae06675d6f2a11620da99422328c95
SHA1 a630e646d140363daacca33643277498e87f2b8f
SHA512 67b4445f28206cd3cfa783fd9908cfcbdea83f36696ed3d585a33e4ef7a8e791f7c6679ceafbb3a315a45acef56e727a36f57f7dbee0e98454da621f8b50d717
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTP:GezaTF8FcNkNdfE0pZ9oztFwIRy1P
MD5 SHA1 SHA512 SSDEEP

Submit Download

SnoIQvA.exe

Path C:\Windows\System\SnoIQvA.exe
Size 1.1MB
SHA256 4397f009a73a3f7c729e795815b2f6bc160024f0fb189755029a8b87cc48f3ec
MD5 d5befb82980316d055a329382853e4cf
SHA1 fb25cd51a3b2f731d85aa3d8df9a822fc7948bd2
SHA512 c4bfe574fc127e16aab88e9da434403b786cbdc4c21dd73cf5428549f24d8d6dde2a72b477f54c29814055a464518385f819b9a492f596c3ab4589f9085ec21a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTNl:GezaTF8FcNkNdfE0pZ9oztFwIRy1z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SqGyTtp.exe

Path C:\Windows\System\SqGyTtp.exe
Size 1.1MB
SHA256 1c3c5893de2182f43bd08ed3873255cda1c6a31179479b598d5e34127db23271
MD5 1b47e49d546974e59eae9208d96c75ac
SHA1 3104aff0c32f3b3482154c465ef842c02f6fea08
SHA512 ff6baa2fa6fa73fbeca957414ee30ba1ffcbfe77bcf046cd1531f4414ef4f76b6a6855ecb172f2ecd92399d4ee9bb96e260703c7c83cfd96194c3d2a96f3d754
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTY:GezaTF8FcNkNdfE0pZ9oztFwIRy1Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

TAjUOZK.exe

Path C:\Windows\System\TAjUOZK.exe
Size 1.1MB
SHA256 7d83cf7a21d71635fd89f622880d720ffaf03003ea56fe6118adfde5579f346d
MD5 690a31ef2f0bd9952b2679a7b0b864a4
SHA1 6b4328e85ee6bc44ed36854c44b0126519daa171
SHA512 3914bfd76b09ab6659e8165746418fc3639b019a417f126c51ee0da9fbbc4b986ec2afb7c1062aa354d4f6ea27548a845c4937180f69d6803c95f184530ab768
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XT6:GezaTF8FcNkNdfE0pZ9oztFwIRy16
MD5 SHA1 SHA512 SSDEEP

Submit Download

VPystwx.exe

Path C:\Windows\System\VPystwx.exe
Size 1.1MB
SHA256 118041171d1fbca4c880faac21383ce329c6f3629e3e4f218fbba75772096f2d
MD5 8450d7992ba21374d6efe945a462435c
SHA1 90e59436965c6dcc8d31bfeea7ec9c66d424b768
SHA512 787d0acc67fb450c5dc3d6fc707afa86637fed71e1d34a6057c01307696be8f6e09923c3a47deac7d73789e37dde2ab09a25e3157c52205d22368106f7f56e71
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XT7:GezaTF8FcNkNdfE0pZ9oztFwIRy17
MD5 SHA1 SHA512 SSDEEP

Submit Download

WxXikNU.exe

Path C:\Windows\System\WxXikNU.exe
Size 1.1MB
SHA256 95f28a3661e44e6632703bd8e11bc0b741b5b00b738844fe44d8f2c9f520bbb0
MD5 7a7865465ffcd887b32b79e6e7977bea
SHA1 f8e3ee08c9e90e75d8d14f3e90468f9b3c2b085f
SHA512 bee64390333bdd91de4b91e9f7fbca1b6667d7f1a5be2a5359588c01a1dac71d72717341cac4d6a54b8c803a9442eecf7ee322999100e564ff1c049305784390
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTf:GezaTF8FcNkNdfE0pZ9oztFwIRy1f
MD5 SHA1 SHA512 SSDEEP

Submit Download

WzPkAcR.exe

Path C:\Windows\System\WzPkAcR.exe
Size 1.1MB
SHA256 1cdf9ec1f0dafe4acd96e29043f95911266f8a028ae5555ed218e4bada9a2799
MD5 f03e6aa150a1d9a1242de771fca9c28c
SHA1 22efa89213d5c5503e08d947e13ca73b4d9c5733
SHA512 e32fbf4e4bd922259c105e9a8457e8e70571598ae67c4e2fc51a8cee451f2bd97300b80b6e218876513d868b801176941a53e3ffeb5ba91f2e2db46106b4fd2a
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTz:GezaTF8FcNkNdfE0pZ9oztFwIRy1z
MD5 SHA1 SHA512 SSDEEP

Submit Download

XRPhNBo.exe

Path C:\Windows\System\XRPhNBo.exe
Size 1.1MB
SHA256 5b451748c51f3a7339bced6849e0c25f13e1923fde285536f83c1e47ce05e2c8
MD5 01ebc988fc17273949d5ef3ae45d46ca
SHA1 7d239f7dc0842ed5e7e1d66b6e856998710697e4
SHA512 6e5b328e9335d0fe1ec793c03a351368bd51c5cb4c6300f2c5df1b9e8c02ce24135f2076abbe3188570859ee80d730c4db550bf8ae9a6f02fcc910a87d812f71
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTEz:GezaTF8FcNkNdfE0pZ9oztFwIRy1g
MD5 SHA1 SHA512 SSDEEP

Submit Download

XVQMbDV.exe

Path C:\Windows\System\XVQMbDV.exe
Size 1.1MB
SHA256 081e7d8ee8269013fbc5bca56e18f56a33aa8938cdf3639bbd7d14fdf9c99730
MD5 29f47594ddd28c4df746f1e6d8c924eb
SHA1 6d9bce08e0ae3a942d6af060d8a51fdf28c71ad5
SHA512 874f12e492df60f90872255bd3db47d0f88552fe3ba432602e301200fb7baff888e0f231882910d557e078c9d8f45c969aba806a1d19da01c7f18de7487012ea
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTb:GezaTF8FcNkNdfE0pZ9oztFwIRy1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

YyXKITR.exe

Path C:\Windows\System\YyXKITR.exe
Size 1.1MB
SHA256 aa74b4ad059418a0803843b7087528692178a29a64a0d129abca88291291a178
MD5 7a0ee1b46d1846ba016fd29e787bfc91
SHA1 ed9b6be7d84602e9592de9d843a3a15183ebd5b7
SHA512 0b831ab6bd2e14fab231da767057b439658b3f80e631aa4c44908f6076081857796835997285603e428f3159a7366c42e84311f7b79c86f875814f5fa41efc1e
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTa:GezaTF8FcNkNdfE0pZ9oztFwIRy1a
MD5 SHA1 SHA512 SSDEEP

Submit Download

bEmyViu.exe

Path C:\Windows\System\bEmyViu.exe
Size 1.1MB
SHA256 20e1149e94842181f18949bac4452c392c0cb3a8f4d8663b8d7110a0fd7e0b09
MD5 234f5f274e638326ba71d9ca650fc162
SHA1 69d91ba89029d6013a2591b5b1fccf1cb9165c96
SHA512 df188122549bbd300bf2563870576d9c543e666d249c94e74ca147e5fd6bc2964c4a81290cc81f960b918f4aa3716aa28d63464789011c2b510189691bb1ba68
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XT7:GezaTF8FcNkNdfE0pZ9oztFwIRy17
MD5 SHA1 SHA512 SSDEEP

Submit Download

cfQgdeK.exe

Path C:\Windows\System\cfQgdeK.exe
Size 1.1MB
SHA256 3fb9c44d1abf57c87203b29ee0f269a31fd6a80ac70eb9973971aaaa3a999cfb
MD5 4a25b056d753fc541caa0863da36aeb8
SHA1 609c0128fce943964f009f7eb28ab824b09e9c72
SHA512 aa200a7e709d9672fb8051822f1768a1622a86d20330b51cb6bbff35a24b86838e06579bcf75c7aa6bf86ea1287c4d17e4dbb314da701a9f436406baaf284249
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTC:GezaTF8FcNkNdfE0pZ9oztFwIRy1C
MD5 SHA1 SHA512 SSDEEP

Submit Download

dUPnyDq.exe

Path C:\Windows\System\dUPnyDq.exe
Size 1.1MB
SHA256 a9895ea5570060ea026d554eb9f6de85c67572ce7a07ac7183fd0e00c86c8e06
MD5 c09e2908b4fa6cebc4e3a02593f35fbf
SHA1 a988ba25fda8a6eac76eabca7742af050f7a902f
SHA512 5c1b0c1c2c4efdad26e22a31903c7a0dc5e59d84a26041a96ad3f26632491de467aa1bbd899b610dd08361336178baeb6b0f94044b3ad396f893e4c1116b1bf0
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTk:GezaTF8FcNkNdfE0pZ9oztFwIRy1k
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqKToxs.exe

Path C:\Windows\System\hqKToxs.exe
Size 1.1MB
SHA256 ff8cb1bc7c388777a6b6577f9ec6a573aa1e68a1a13b915a6575ed37dfa50331
MD5 b575f3b361b18e59fe19e459d0a93eb9
SHA1 a74b61d99272087060243a07cb906324d68c4cd2
SHA512 4e70874f42fb60c39a6cc62433b04aa0e6182c9321d14abc316d8c95f6c867f42d5acd08653074c64d0377130031aadd2105db0f18b9420ec90a11527e36cd7c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTy:GezaTF8FcNkNdfE0pZ9oztFwIRy1y
MD5 SHA1 SHA512 SSDEEP

Submit Download

mUYoyOI.exe

Path C:\Windows\System\mUYoyOI.exe
Size 1.1MB
SHA256 a747e2d5c79edb05ae2010e2a4805fb41ddd6c2159f0ca3038526532cee73f05
MD5 2c1cb57dd873702005371920e2fab8ba
SHA1 099c863cc715ff1b06ea4b29c27e090de8a4d32d
SHA512 caa77749389c72c7b89731a7e2326e54c7b83047305dc6c492a4874722e10cdb6a3f76892203f6b4a064815864232e87d8e243e95853f55baeba672420132767
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTZ:GezaTF8FcNkNdfE0pZ9oztFwIRy1Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

maocXjT.exe

Path C:\Windows\System\maocXjT.exe
Size 1.1MB
SHA256 2bc54b4f90257c57f4aec431d7a58ee3948d8386721c4cfd916b2504fb0cd468
MD5 87da0f33981a3f41a672e0124f975b57
SHA1 dc6a3b88c94572536d93fa6a0031788a4496616c
SHA512 57e0fc421b2e2316bb3cb2a3942e33b3310cf8b2cfd189ea7f75ee97ea671c08d4e92108a3614920529459d5031db98d9118e4743e44ace168f3bbfd1b7e7575
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTi:GezaTF8FcNkNdfE0pZ9oztFwIRy1i
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntcNwDW.exe

Path C:\Windows\System\ntcNwDW.exe
Size 1.1MB
SHA256 18cccdadb9991abf435145cd859102c4e4cccc20ad88c870bc54e3faf545425e
MD5 01009c59eeba763c4756493afc1080f0
SHA1 0179382622cc678ec2114318e0b76711932dbee3
SHA512 8cd440aacd9df145653d47c84c7484e577937ce5bd77df88d1c5eb440a3900594c7753fb0819a2e519592cf46855e3588f59d05c2536a4e82561c4530907af78
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTk:GezaTF8FcNkNdfE0pZ9oztFwIRy1k
MD5 SHA1 SHA512 SSDEEP

Submit Download

qQkQbsX.exe

Path C:\Windows\System\qQkQbsX.exe
Size 1.1MB
SHA256 92a99aa90e4f8ca6f50c4ea0bc657184d25cb62722727ec6272f26f3f38ee748
MD5 29f305cfa8eea16695bb4e8fab4cf0ec
SHA1 cdb7aab181fe98540bc06cf4086802e5a74c5204
SHA512 f8d83225e7e8b86bb2224c98b79e4f5f0acdecaae493c593844c5459f77c2e1e9e9a8b7725395de9935904cd2e5710ee9358ef72da3f65ecea27d1a750ebf8ed
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTr:GezaTF8FcNkNdfE0pZ9oztFwIRy1r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tZKStCD.exe

Path C:\Windows\System\tZKStCD.exe
Size 1.1MB
SHA256 271a5a228d19a6661d4cf4682d153b84a586badbaeb6c754182df63ce4553dee
MD5 3b9d5d98882191eaa9ff916cf99986f7
SHA1 6374c825e0b167cc92879f38a26d8afc43149115
SHA512 8ce5d0970f47a5c5cee1a46a4ce265df500eaecefd26fa5e49df2dde4879255932e2f95503bc839dd7b7c3fb5b1f17ac86a5478dff64f6338778c9dd93fc0274
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTDz:GezaTF8FcNkNdfE0pZ9oztFwIRy1n
MD5 SHA1 SHA512 SSDEEP

Submit Download

vkGpBVk.exe

Path C:\Windows\System\vkGpBVk.exe
Size 1.1MB
SHA256 572ad32df6268e0c678e2abcdedf98cc4de8d32499b0a2693bb85025858dea9c
MD5 78dbdfe9c5031d9c6dd487432bf36ee4
SHA1 eef95952b9827e37c247c60f8a180bb8e4d65dcb
SHA512 65870e42a1e742398515cc7b44b4147c1eb7dfffd2d284160190d45722258bff1719eda4b2e0892f28da94f7b38cf34dd39340e5d7f416340da64124388de3ba
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XT/:GezaTF8FcNkNdfE0pZ9oztFwIRy1/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wgzsIxQ.exe

Path C:\Windows\System\wgzsIxQ.exe
Size 1.1MB
SHA256 bc5b003456d090cd6e5977c02a08a487326b77cfa9150cee94c90659730d0303
MD5 fd80fc20674127f4a41854f134625adc
SHA1 cdb51da6863ac3fe357c0f30e99e458d9c711167
SHA512 68c0205beec3de690dc206e12731e9f30c2efa0d3987d9032c2b88299b0157de12b60ab7ef9885863ffea977fa5a51fc016842c3a69f8ea300d010770c7fdc6c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTl:GezaTF8FcNkNdfE0pZ9oztFwIRy1l
MD5 SHA1 SHA512 SSDEEP

Submit Download

xUHTtIY.exe

Path C:\Windows\System\xUHTtIY.exe
Size 1.1MB
SHA256 55a609a6d2b041c1d2d7234efeca4ff5ef580f6adf58fcb90f7797e221359c81
MD5 0d50f82cf620017e0990ce70c1351b88
SHA1 07a45e27d9c4ec911b981d8b32da55c4ecb9734d
SHA512 abd78e105e24320bef8cdd7821ee9d73e11b2b46f9558f231e1bc61e37068760cb53700519450f03ba22601ec2860a553aacc8ed4381e05950c6b403ec6798af
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66X21XTj:GezaTF8FcNkNdfE0pZ9oztFwIRy1j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4372-0-0x0000024C5CB40000-0x0000024C5CB50000-memory.dmp

Download