xmrig | 446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
Size 1.8MB
Sample240627-dv79lasfjl
SHA256 446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e
MD5 3fe2cd21623d195cfcbf6762bd2a1910
SHA1 36a778feff50280ac27a8f68e78e19c2eb2ad86c
SHA512 298679f3a5dbb2bf637431b6204e5bdc9c51dc52289728909da5e332efb53c661ee2149a3197e7519fbfe90eb09debd02c85d492c9ba6382ace5186c16a0682f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER80:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 17188 created 808	17188	WerFaultSecure.exe	86

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000900000002354f-4.dat	xmrig
behavioral2/files/0x0008000000023552-7.dat	xmrig
behavioral2/files/0x0007000000023556-15.dat	xmrig
behavioral2/files/0x0007000000023557-21.dat	xmrig
behavioral2/files/0x0007000000023558-24.dat	xmrig
behavioral2/files/0x0007000000023559-28.dat	xmrig
behavioral2/files/0x000700000002355a-38.dat	xmrig
behavioral2/files/0x000700000002355c-44.dat	xmrig
behavioral2/files/0x0007000000023562-72.dat	xmrig
behavioral2/files/0x0007000000023567-97.dat	xmrig
behavioral2/files/0x0007000000023568-110.dat	xmrig
behavioral2/files/0x000700000002356d-127.dat	xmrig
behavioral2/files/0x0007000000023570-142.dat	xmrig
behavioral2/files/0x0007000000023574-162.dat	xmrig
behavioral2/files/0x0007000000023572-160.dat	xmrig
behavioral2/files/0x0007000000023573-157.dat	xmrig
behavioral2/files/0x0007000000023571-155.dat	xmrig
behavioral2/files/0x000700000002356f-145.dat	xmrig
behavioral2/files/0x000700000002356e-140.dat	xmrig
behavioral2/files/0x000700000002356c-130.dat	xmrig
behavioral2/files/0x000700000002356b-125.dat	xmrig
behavioral2/files/0x000700000002356a-120.dat	xmrig
behavioral2/files/0x0007000000023569-115.dat	xmrig
behavioral2/files/0x0007000000023566-100.dat	xmrig
behavioral2/files/0x0007000000023565-95.dat	xmrig
behavioral2/files/0x0007000000023564-90.dat	xmrig
behavioral2/files/0x0007000000023563-85.dat	xmrig
behavioral2/files/0x0007000000023561-75.dat	xmrig
behavioral2/files/0x0007000000023560-70.dat	xmrig
behavioral2/files/0x000700000002355f-62.dat	xmrig
behavioral2/files/0x000700000002355e-58.dat	xmrig
behavioral2/files/0x000700000002355d-52.dat	xmrig
behavioral2/files/0x000700000002355b-42.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3188	faTorsZ.exe
4980	WZyqnOc.exe
3040	yQiVvNo.exe
3008	IJPEqJC.exe
220	lhGgzBD.exe
2768	LtjJuEY.exe
2848	PJJGdAd.exe
4820	jvwSxWw.exe
4364	vtczYua.exe
2132	xIYScAr.exe
4900	MrwFGLW.exe
1792	yCgJkJp.exe
2504	ZzlQmUT.exe
3200	eDQtLco.exe
2588	AMfKMWV.exe
3684	kHEqvyI.exe
4608	dqAPYJP.exe
400	tIrHuRW.exe
4780	rbCPUVd.exe
5088	CEBoYbk.exe
3032	EQCQnpO.exe
2660	HrPdpmZ.exe
5016	ZnFCmNS.exe
4432	BgAuqOW.exe
2248	iLobnHg.exe
2968	ZQMghaD.exe
2236	IricjvV.exe
4756	RzGShkW.exe
1592	SIrZPTf.exe
3060	XKRUkaL.exe
4864	dLNgseq.exe
3536	RiLXTFB.exe
1132	ZxIsrSg.exe
4540	dhKsONx.exe
1480	zFDFQKp.exe
3380	phKLuMf.exe
4428	WepODBB.exe
2604	ACkyIgc.exe
1276	vBirRcZ.exe
4012	nDXVAgN.exe
3644	hluvRtF.exe
520	oejqzzL.exe
4440	kEYhNPe.exe
2520	UBMOWQC.exe
3320	ySggcpY.exe
4328	UMYzoaQ.exe
548	iPnfvdf.exe
4488	IMDChAJ.exe
4880	KllthAS.exe
2120	YeehkOT.exe
4520	ZuTyGeS.exe
5116	ielqJsO.exe
4100	gOHMLbZ.exe
4680	adQdwYs.exe
2728	bIHDRup.exe
2468	mFfsDfP.exe
1112	vyigtCf.exe
1948	GerMgyz.exe
1196	BMuHCkF.exe
208	mpKsIwa.exe
2672	MlxPonL.exe
4868	KEnpUex.exe
4532	ymDrkTL.exe
1296	PgvootX.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YyYfYNI.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\pdMuYig.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\IMjSijz.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\ufgckJl.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\JTqUzFo.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\oXYxKcu.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\SXQYXdM.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\Rfutiqn.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\EQCQnpO.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\iLobnHg.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\kMMopLX.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\nQCamqm.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\VEeHGtc.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\PXysYgT.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\kAtSWHU.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\sUMOqKV.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\HYnPYkH.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\aMzCeDN.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\uCBlHEX.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\YATQOiq.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\tMMspBj.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\PpxpZxv.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\uXqGuvq.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\MdpgaOx.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\aFpsKnR.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\qjUMYWd.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\zOcWNlJ.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\faTorsZ.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\LApfiba.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\qtEhPaG.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\PCuPtAs.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\zMYRsly.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\UTMIbzS.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\CPzejNH.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\haFOSUB.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\sTPzSnF.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\CbhZnBE.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\tjbrCxg.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\iZeAqGR.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\nJBtONn.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\CtTnJop.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\iJNMFLE.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\frgWjdA.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\WZRoYju.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\PyoWPsG.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\ptvQaSI.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\JNbfLPi.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\CCMCvZV.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\kYXXHRp.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\Rawyhtj.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\RvsXHrr.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\jwxwbHE.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\ZofGAaA.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\liMbawE.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\PEpnrCl.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\NvIRVfQ.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\UpBxCdL.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\bdQbITD.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\iFVUNtr.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\bKLYzkT.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\jPkMXWn.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\Bcyyypl.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\JNXBfZX.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
File created	C:\Windows\System\mpKsIwa.exe	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4300	WerFaultSecure.exe
4300	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3188	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	89
PID 1584 wrote to memory of 3188	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	89
PID 1584 wrote to memory of 4980	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	90
PID 1584 wrote to memory of 4980	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	90
PID 1584 wrote to memory of 3040	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	91
PID 1584 wrote to memory of 3040	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	91
PID 1584 wrote to memory of 3008	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	92
PID 1584 wrote to memory of 3008	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	92
PID 1584 wrote to memory of 220	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	93
PID 1584 wrote to memory of 220	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	93
PID 1584 wrote to memory of 2768	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	94
PID 1584 wrote to memory of 2768	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	94
PID 1584 wrote to memory of 2848	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	95
PID 1584 wrote to memory of 2848	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	95
PID 1584 wrote to memory of 4820	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	96
PID 1584 wrote to memory of 4820	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	96
PID 1584 wrote to memory of 4364	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	97
PID 1584 wrote to memory of 4364	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	97
PID 1584 wrote to memory of 2132	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	98
PID 1584 wrote to memory of 2132	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	98
PID 1584 wrote to memory of 4900	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	99
PID 1584 wrote to memory of 4900	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	99
PID 1584 wrote to memory of 1792	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	100
PID 1584 wrote to memory of 1792	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	100
PID 1584 wrote to memory of 2504	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	101
PID 1584 wrote to memory of 2504	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	101
PID 1584 wrote to memory of 3200	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	102
PID 1584 wrote to memory of 3200	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	102
PID 1584 wrote to memory of 2588	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	103
PID 1584 wrote to memory of 2588	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	103
PID 1584 wrote to memory of 3684	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	104
PID 1584 wrote to memory of 3684	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	104
PID 1584 wrote to memory of 4608	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	105
PID 1584 wrote to memory of 4608	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	105
PID 1584 wrote to memory of 400	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	106
PID 1584 wrote to memory of 400	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	106
PID 1584 wrote to memory of 4780	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	107
PID 1584 wrote to memory of 4780	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	107
PID 1584 wrote to memory of 5088	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	108
PID 1584 wrote to memory of 5088	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	108
PID 1584 wrote to memory of 3032	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	109
PID 1584 wrote to memory of 3032	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	109
PID 1584 wrote to memory of 2660	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	110
PID 1584 wrote to memory of 2660	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	110
PID 1584 wrote to memory of 5016	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	111
PID 1584 wrote to memory of 5016	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	111
PID 1584 wrote to memory of 4432	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	112
PID 1584 wrote to memory of 4432	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	112
PID 1584 wrote to memory of 2248	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	113
PID 1584 wrote to memory of 2248	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	113
PID 1584 wrote to memory of 2968	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	114
PID 1584 wrote to memory of 2968	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	114
PID 1584 wrote to memory of 2236	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	115
PID 1584 wrote to memory of 2236	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	115
PID 1584 wrote to memory of 4756	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	116
PID 1584 wrote to memory of 4756	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	116
PID 1584 wrote to memory of 1592	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	117
PID 1584 wrote to memory of 1592	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	117
PID 1584 wrote to memory of 3060	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	118
PID 1584 wrote to memory of 3060	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	118
PID 1584 wrote to memory of 4864	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	119
PID 1584 wrote to memory of 4864	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	119
PID 1584 wrote to memory of 3536	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	120
PID 1584 wrote to memory of 3536	1584	446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe	120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:808
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 808 -s 620
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4300

C:\Users\Admin\AppData\Local\Temp\446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\446a2e92e47cbd296723b89a2700802b871173063ff188770643bb73df50da0e_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\System\faTorsZ.exe
  C:\Windows\System\faTorsZ.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\WZyqnOc.exe
  C:\Windows\System\WZyqnOc.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\yQiVvNo.exe
  C:\Windows\System\yQiVvNo.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\IJPEqJC.exe
  C:\Windows\System\IJPEqJC.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\lhGgzBD.exe
  C:\Windows\System\lhGgzBD.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\LtjJuEY.exe
  C:\Windows\System\LtjJuEY.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\PJJGdAd.exe
  C:\Windows\System\PJJGdAd.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\jvwSxWw.exe
  C:\Windows\System\jvwSxWw.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\vtczYua.exe
  C:\Windows\System\vtczYua.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\xIYScAr.exe
  C:\Windows\System\xIYScAr.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\MrwFGLW.exe
  C:\Windows\System\MrwFGLW.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\yCgJkJp.exe
  C:\Windows\System\yCgJkJp.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ZzlQmUT.exe
  C:\Windows\System\ZzlQmUT.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\eDQtLco.exe
  C:\Windows\System\eDQtLco.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\AMfKMWV.exe
  C:\Windows\System\AMfKMWV.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\kHEqvyI.exe
  C:\Windows\System\kHEqvyI.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\dqAPYJP.exe
  C:\Windows\System\dqAPYJP.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\tIrHuRW.exe
  C:\Windows\System\tIrHuRW.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\rbCPUVd.exe
  C:\Windows\System\rbCPUVd.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\CEBoYbk.exe
  C:\Windows\System\CEBoYbk.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\EQCQnpO.exe
  C:\Windows\System\EQCQnpO.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\HrPdpmZ.exe
  C:\Windows\System\HrPdpmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ZnFCmNS.exe
  C:\Windows\System\ZnFCmNS.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\BgAuqOW.exe
  C:\Windows\System\BgAuqOW.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\iLobnHg.exe
  C:\Windows\System\iLobnHg.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\ZQMghaD.exe
  C:\Windows\System\ZQMghaD.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\IricjvV.exe
  C:\Windows\System\IricjvV.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\RzGShkW.exe
  C:\Windows\System\RzGShkW.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\SIrZPTf.exe
  C:\Windows\System\SIrZPTf.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\XKRUkaL.exe
  C:\Windows\System\XKRUkaL.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\dLNgseq.exe
  C:\Windows\System\dLNgseq.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\RiLXTFB.exe
  C:\Windows\System\RiLXTFB.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\ZxIsrSg.exe
  C:\Windows\System\ZxIsrSg.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\dhKsONx.exe
  C:\Windows\System\dhKsONx.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\zFDFQKp.exe
  C:\Windows\System\zFDFQKp.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\phKLuMf.exe
  C:\Windows\System\phKLuMf.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\WepODBB.exe
  C:\Windows\System\WepODBB.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\ACkyIgc.exe
  C:\Windows\System\ACkyIgc.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\vBirRcZ.exe
  C:\Windows\System\vBirRcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\nDXVAgN.exe
  C:\Windows\System\nDXVAgN.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\hluvRtF.exe
  C:\Windows\System\hluvRtF.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\oejqzzL.exe
  C:\Windows\System\oejqzzL.exe
  2⤵
  - Executes dropped EXE
  PID:520
- C:\Windows\System\kEYhNPe.exe
  C:\Windows\System\kEYhNPe.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\UBMOWQC.exe
  C:\Windows\System\UBMOWQC.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ySggcpY.exe
  C:\Windows\System\ySggcpY.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\UMYzoaQ.exe
  C:\Windows\System\UMYzoaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\iPnfvdf.exe
  C:\Windows\System\iPnfvdf.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\IMDChAJ.exe
  C:\Windows\System\IMDChAJ.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\KllthAS.exe
  C:\Windows\System\KllthAS.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\YeehkOT.exe
  C:\Windows\System\YeehkOT.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\ZuTyGeS.exe
  C:\Windows\System\ZuTyGeS.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\ielqJsO.exe
  C:\Windows\System\ielqJsO.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\gOHMLbZ.exe
  C:\Windows\System\gOHMLbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\adQdwYs.exe
  C:\Windows\System\adQdwYs.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\bIHDRup.exe
  C:\Windows\System\bIHDRup.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\mFfsDfP.exe
  C:\Windows\System\mFfsDfP.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\vyigtCf.exe
  C:\Windows\System\vyigtCf.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\GerMgyz.exe
  C:\Windows\System\GerMgyz.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\BMuHCkF.exe
  C:\Windows\System\BMuHCkF.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\mpKsIwa.exe
  C:\Windows\System\mpKsIwa.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\MlxPonL.exe
  C:\Windows\System\MlxPonL.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\KEnpUex.exe
  C:\Windows\System\KEnpUex.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\ymDrkTL.exe
  C:\Windows\System\ymDrkTL.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\PgvootX.exe
  C:\Windows\System\PgvootX.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\WxBlxAs.exe
  C:\Windows\System\WxBlxAs.exe
  2⤵
  PID:4752
- C:\Windows\System\qBqFheG.exe
  C:\Windows\System\qBqFheG.exe
  2⤵
  PID:5140
- C:\Windows\System\XiUKMNe.exe
  C:\Windows\System\XiUKMNe.exe
  2⤵
  PID:5168
- C:\Windows\System\oKcIcjw.exe
  C:\Windows\System\oKcIcjw.exe
  2⤵
  PID:5204
- C:\Windows\System\meXQVOe.exe
  C:\Windows\System\meXQVOe.exe
  2⤵
  PID:5224
- C:\Windows\System\PpxpZxv.exe
  C:\Windows\System\PpxpZxv.exe
  2⤵
  PID:5252
- C:\Windows\System\IRgSDKE.exe
  C:\Windows\System\IRgSDKE.exe
  2⤵
  PID:5280
- C:\Windows\System\dFTDozk.exe
  C:\Windows\System\dFTDozk.exe
  2⤵
  PID:5308
- C:\Windows\System\jvFbVGY.exe
  C:\Windows\System\jvFbVGY.exe
  2⤵
  PID:5340
- C:\Windows\System\LtLvadF.exe
  C:\Windows\System\LtLvadF.exe
  2⤵
  PID:5368
- C:\Windows\System\VEeHGtc.exe
  C:\Windows\System\VEeHGtc.exe
  2⤵
  PID:5392
- C:\Windows\System\niWIabt.exe
  C:\Windows\System\niWIabt.exe
  2⤵
  PID:5420
- C:\Windows\System\hKCVUxm.exe
  C:\Windows\System\hKCVUxm.exe
  2⤵
  PID:5448
- C:\Windows\System\pcxUQgC.exe
  C:\Windows\System\pcxUQgC.exe
  2⤵
  PID:5476
- C:\Windows\System\YBjLmDq.exe
  C:\Windows\System\YBjLmDq.exe
  2⤵
  PID:5504
- C:\Windows\System\UvTPOqf.exe
  C:\Windows\System\UvTPOqf.exe
  2⤵
  PID:5532
- C:\Windows\System\nUvvvxT.exe
  C:\Windows\System\nUvvvxT.exe
  2⤵
  PID:5560
- C:\Windows\System\oCwnrQK.exe
  C:\Windows\System\oCwnrQK.exe
  2⤵
  PID:5588
- C:\Windows\System\ZMenMjd.exe
  C:\Windows\System\ZMenMjd.exe
  2⤵
  PID:5616
- C:\Windows\System\jahgnMJ.exe
  C:\Windows\System\jahgnMJ.exe
  2⤵
  PID:5644
- C:\Windows\System\YQIxnJJ.exe
  C:\Windows\System\YQIxnJJ.exe
  2⤵
  PID:5672
- C:\Windows\System\SxalkEC.exe
  C:\Windows\System\SxalkEC.exe
  2⤵
  PID:5700
- C:\Windows\System\znROVBU.exe
  C:\Windows\System\znROVBU.exe
  2⤵
  PID:5728
- C:\Windows\System\yfZhcSY.exe
  C:\Windows\System\yfZhcSY.exe
  2⤵
  PID:5752
- C:\Windows\System\utiXVRw.exe
  C:\Windows\System\utiXVRw.exe
  2⤵
  PID:5788
- C:\Windows\System\MzhLtoL.exe
  C:\Windows\System\MzhLtoL.exe
  2⤵
  PID:5812
- C:\Windows\System\SvOIklu.exe
  C:\Windows\System\SvOIklu.exe
  2⤵
  PID:5840
- C:\Windows\System\uCBlHEX.exe
  C:\Windows\System\uCBlHEX.exe
  2⤵
  PID:5868
- C:\Windows\System\SItkCYz.exe
  C:\Windows\System\SItkCYz.exe
  2⤵
  PID:5896
- C:\Windows\System\evrPiUL.exe
  C:\Windows\System\evrPiUL.exe
  2⤵
  PID:5924
- C:\Windows\System\IKJMCnI.exe
  C:\Windows\System\IKJMCnI.exe
  2⤵
  PID:5952
- C:\Windows\System\gKOEwLZ.exe
  C:\Windows\System\gKOEwLZ.exe
  2⤵
  PID:5980
- C:\Windows\System\xCGMHOH.exe
  C:\Windows\System\xCGMHOH.exe
  2⤵
  PID:6008
- C:\Windows\System\OxCPKZU.exe
  C:\Windows\System\OxCPKZU.exe
  2⤵
  PID:6036
- C:\Windows\System\dfQWDbz.exe
  C:\Windows\System\dfQWDbz.exe
  2⤵
  PID:6064
- C:\Windows\System\BVWXdCe.exe
  C:\Windows\System\BVWXdCe.exe
  2⤵
  PID:6092
- C:\Windows\System\zMYRsly.exe
  C:\Windows\System\zMYRsly.exe
  2⤵
  PID:6120
- C:\Windows\System\UdhKxlv.exe
  C:\Windows\System\UdhKxlv.exe
  2⤵
  PID:1128
- C:\Windows\System\HWpxWQD.exe
  C:\Windows\System\HWpxWQD.exe
  2⤵
  PID:3648
- C:\Windows\System\nlCXhiS.exe
  C:\Windows\System\nlCXhiS.exe
  2⤵
  PID:3612
- C:\Windows\System\rsMxRkd.exe
  C:\Windows\System\rsMxRkd.exe
  2⤵
  PID:380
- C:\Windows\System\eZEtObs.exe
  C:\Windows\System\eZEtObs.exe
  2⤵
  PID:3668
- C:\Windows\System\oDodREz.exe
  C:\Windows\System\oDodREz.exe
  2⤵
  PID:5152
- C:\Windows\System\DSmSbML.exe
  C:\Windows\System\DSmSbML.exe
  2⤵
  PID:5216
- C:\Windows\System\ThBGcDE.exe
  C:\Windows\System\ThBGcDE.exe
  2⤵
  PID:5268
- C:\Windows\System\pbxoEcw.exe
  C:\Windows\System\pbxoEcw.exe
  2⤵
  PID:5328
- C:\Windows\System\qXtAXSP.exe
  C:\Windows\System\qXtAXSP.exe
  2⤵
  PID:5388
- C:\Windows\System\PmTNQrX.exe
  C:\Windows\System\PmTNQrX.exe
  2⤵
  PID:5464
- C:\Windows\System\ZyvRJxu.exe
  C:\Windows\System\ZyvRJxu.exe
  2⤵
  PID:5520
- C:\Windows\System\ZofGAaA.exe
  C:\Windows\System\ZofGAaA.exe
  2⤵
  PID:5576
- C:\Windows\System\VTDyvdz.exe
  C:\Windows\System\VTDyvdz.exe
  2⤵
  PID:5636
- C:\Windows\System\jTzKSeX.exe
  C:\Windows\System\jTzKSeX.exe
  2⤵
  PID:5716
- C:\Windows\System\MkKrAST.exe
  C:\Windows\System\MkKrAST.exe
  2⤵
  PID:5780
- C:\Windows\System\uqlgNWZ.exe
  C:\Windows\System\uqlgNWZ.exe
  2⤵
  PID:5852
- C:\Windows\System\DAAoDdc.exe
  C:\Windows\System\DAAoDdc.exe
  2⤵
  PID:5908
- C:\Windows\System\JpPuMkB.exe
  C:\Windows\System\JpPuMkB.exe
  2⤵
  PID:5968
- C:\Windows\System\hQFOqnk.exe
  C:\Windows\System\hQFOqnk.exe
  2⤵
  PID:6028
- C:\Windows\System\gXaWMzO.exe
  C:\Windows\System\gXaWMzO.exe
  2⤵
  PID:6104
- C:\Windows\System\KWMenxY.exe
  C:\Windows\System\KWMenxY.exe
  2⤵
  PID:2080
- C:\Windows\System\xOhMWGh.exe
  C:\Windows\System\xOhMWGh.exe
  2⤵
  PID:4560
- C:\Windows\System\pxHqJhR.exe
  C:\Windows\System\pxHqJhR.exe
  2⤵
  PID:5184
- C:\Windows\System\fnZVNWX.exe
  C:\Windows\System\fnZVNWX.exe
  2⤵
  PID:5320
- C:\Windows\System\dAKfTAx.exe
  C:\Windows\System\dAKfTAx.exe
  2⤵
  PID:5440
- C:\Windows\System\ZuPwrKK.exe
  C:\Windows\System\ZuPwrKK.exe
  2⤵
  PID:2896
- C:\Windows\System\mGlOLEm.exe
  C:\Windows\System\mGlOLEm.exe
  2⤵
  PID:5692
- C:\Windows\System\wWOBbEL.exe
  C:\Windows\System\wWOBbEL.exe
  2⤵
  PID:5880
- C:\Windows\System\TglDmQY.exe
  C:\Windows\System\TglDmQY.exe
  2⤵
  PID:6000
- C:\Windows\System\EGjXAFD.exe
  C:\Windows\System\EGjXAFD.exe
  2⤵
  PID:6136
- C:\Windows\System\yCQWmBq.exe
  C:\Windows\System\yCQWmBq.exe
  2⤵
  PID:4332
- C:\Windows\System\vPVRUhv.exe
  C:\Windows\System\vPVRUhv.exe
  2⤵
  PID:5296
- C:\Windows\System\CbhZnBE.exe
  C:\Windows\System\CbhZnBE.exe
  2⤵
  PID:4256
- C:\Windows\System\hTGZDta.exe
  C:\Windows\System\hTGZDta.exe
  2⤵
  PID:5824
- C:\Windows\System\HPAiJOy.exe
  C:\Windows\System\HPAiJOy.exe
  2⤵
  PID:1608
- C:\Windows\System\ciSZRMN.exe
  C:\Windows\System\ciSZRMN.exe
  2⤵
  PID:6208
- C:\Windows\System\liMbawE.exe
  C:\Windows\System\liMbawE.exe
  2⤵
  PID:6236
- C:\Windows\System\lsZyaxk.exe
  C:\Windows\System\lsZyaxk.exe
  2⤵
  PID:6252
- C:\Windows\System\ARXnPUC.exe
  C:\Windows\System\ARXnPUC.exe
  2⤵
  PID:6268
- C:\Windows\System\lsbOkwX.exe
  C:\Windows\System\lsbOkwX.exe
  2⤵
  PID:6292
- C:\Windows\System\woxoQvT.exe
  C:\Windows\System\woxoQvT.exe
  2⤵
  PID:6320
- C:\Windows\System\ijslpLY.exe
  C:\Windows\System\ijslpLY.exe
  2⤵
  PID:6348
- C:\Windows\System\urgKUny.exe
  C:\Windows\System\urgKUny.exe
  2⤵
  PID:6368
- C:\Windows\System\ufNQBtk.exe
  C:\Windows\System\ufNQBtk.exe
  2⤵
  PID:6440
- C:\Windows\System\ypuQYXD.exe
  C:\Windows\System\ypuQYXD.exe
  2⤵
  PID:6488
- C:\Windows\System\wyGARpb.exe
  C:\Windows\System\wyGARpb.exe
  2⤵
  PID:6516
- C:\Windows\System\fRFHAaO.exe
  C:\Windows\System\fRFHAaO.exe
  2⤵
  PID:6544
- C:\Windows\System\OmCXyGu.exe
  C:\Windows\System\OmCXyGu.exe
  2⤵
  PID:6564
- C:\Windows\System\BEblqJJ.exe
  C:\Windows\System\BEblqJJ.exe
  2⤵
  PID:6588
- C:\Windows\System\emhgPAL.exe
  C:\Windows\System\emhgPAL.exe
  2⤵
  PID:6628
- C:\Windows\System\GQvKJjw.exe
  C:\Windows\System\GQvKJjw.exe
  2⤵
  PID:6656
- C:\Windows\System\dKyAdAN.exe
  C:\Windows\System\dKyAdAN.exe
  2⤵
  PID:6684
- C:\Windows\System\WCmKaVI.exe
  C:\Windows\System\WCmKaVI.exe
  2⤵
  PID:6712
- C:\Windows\System\EoyqNAg.exe
  C:\Windows\System\EoyqNAg.exe
  2⤵
  PID:6732
- C:\Windows\System\FkKbxHJ.exe
  C:\Windows\System\FkKbxHJ.exe
  2⤵
  PID:6768
- C:\Windows\System\umuQKWC.exe
  C:\Windows\System\umuQKWC.exe
  2⤵
  PID:6796
- C:\Windows\System\McTUjdp.exe
  C:\Windows\System\McTUjdp.exe
  2⤵
  PID:6824
- C:\Windows\System\JNbfLPi.exe
  C:\Windows\System\JNbfLPi.exe
  2⤵
  PID:6876
- C:\Windows\System\xWEsWGN.exe
  C:\Windows\System\xWEsWGN.exe
  2⤵
  PID:6892
- C:\Windows\System\BOmTCgh.exe
  C:\Windows\System\BOmTCgh.exe
  2⤵
  PID:6920
- C:\Windows\System\WZRoYju.exe
  C:\Windows\System\WZRoYju.exe
  2⤵
  PID:6936
- C:\Windows\System\NEntLBY.exe
  C:\Windows\System\NEntLBY.exe
  2⤵
  PID:6952
- C:\Windows\System\KbTiKTS.exe
  C:\Windows\System\KbTiKTS.exe
  2⤵
  PID:7004
- C:\Windows\System\VqwxlyW.exe
  C:\Windows\System\VqwxlyW.exe
  2⤵
  PID:7036
- C:\Windows\System\HZuSqAU.exe
  C:\Windows\System\HZuSqAU.exe
  2⤵
  PID:7064
- C:\Windows\System\ortyiCl.exe
  C:\Windows\System\ortyiCl.exe
  2⤵
  PID:7080
- C:\Windows\System\mkMqVqo.exe
  C:\Windows\System\mkMqVqo.exe
  2⤵
  PID:7120
- C:\Windows\System\usZuFJf.exe
  C:\Windows\System\usZuFJf.exe
  2⤵
  PID:7148
- C:\Windows\System\jjLXGSR.exe
  C:\Windows\System\jjLXGSR.exe
  2⤵
  PID:7164
- C:\Windows\System\kBiuXoo.exe
  C:\Windows\System\kBiuXoo.exe
  2⤵
  PID:2684
- C:\Windows\System\UplRuAp.exe
  C:\Windows\System\UplRuAp.exe
  2⤵
  PID:4164
- C:\Windows\System\ggADcar.exe
  C:\Windows\System\ggADcar.exe
  2⤵
  PID:6244
- C:\Windows\System\nRVQhLw.exe
  C:\Windows\System\nRVQhLw.exe
  2⤵
  PID:3832
- C:\Windows\System\NYPKXTX.exe
  C:\Windows\System\NYPKXTX.exe
  2⤵
  PID:6288
- C:\Windows\System\EAqwXuR.exe
  C:\Windows\System\EAqwXuR.exe
  2⤵
  PID:6360
- C:\Windows\System\YpMIARW.exe
  C:\Windows\System\YpMIARW.exe
  2⤵
  PID:6424
- C:\Windows\System\cAfMWey.exe
  C:\Windows\System\cAfMWey.exe
  2⤵
  PID:6420
- C:\Windows\System\RiTadPI.exe
  C:\Windows\System\RiTadPI.exe
  2⤵
  PID:6496
- C:\Windows\System\KnYUxvi.exe
  C:\Windows\System\KnYUxvi.exe
  2⤵
  PID:6528
- C:\Windows\System\WFwKwAF.exe
  C:\Windows\System\WFwKwAF.exe
  2⤵
  PID:4512
- C:\Windows\System\fHqFwDv.exe
  C:\Windows\System\fHqFwDv.exe
  2⤵
  PID:6600
- C:\Windows\System\GIzyCfh.exe
  C:\Windows\System\GIzyCfh.exe
  2⤵
  PID:6624
- C:\Windows\System\UtrniPC.exe
  C:\Windows\System\UtrniPC.exe
  2⤵
  PID:6648
- C:\Windows\System\FMhJUaD.exe
  C:\Windows\System\FMhJUaD.exe
  2⤵
  PID:3064
- C:\Windows\System\WsJLNUl.exe
  C:\Windows\System\WsJLNUl.exe
  2⤵
  PID:6756
- C:\Windows\System\mQXvfsU.exe
  C:\Windows\System\mQXvfsU.exe
  2⤵
  PID:6808
- C:\Windows\System\RFUnyFn.exe
  C:\Windows\System\RFUnyFn.exe
  2⤵
  PID:3656
- C:\Windows\System\erJYJyQ.exe
  C:\Windows\System\erJYJyQ.exe
  2⤵
  PID:6888
- C:\Windows\System\pBHeySy.exe
  C:\Windows\System\pBHeySy.exe
  2⤵
  PID:6988
- C:\Windows\System\KYiNlpa.exe
  C:\Windows\System\KYiNlpa.exe
  2⤵
  PID:7028
- C:\Windows\System\qFjtjQo.exe
  C:\Windows\System\qFjtjQo.exe
  2⤵
  PID:6844
- C:\Windows\System\hSumRDA.exe
  C:\Windows\System\hSumRDA.exe
  2⤵
  PID:7160
- C:\Windows\System\xetScAJ.exe
  C:\Windows\System\xetScAJ.exe
  2⤵
  PID:6260
- C:\Windows\System\sfXJbIp.exe
  C:\Windows\System\sfXJbIp.exe
  2⤵
  PID:6404
- C:\Windows\System\JjBpxDY.exe
  C:\Windows\System\JjBpxDY.exe
  2⤵
  PID:6416
- C:\Windows\System\hXvUsiu.exe
  C:\Windows\System\hXvUsiu.exe
  2⤵
  PID:428
- C:\Windows\System\BQnbfvn.exe
  C:\Windows\System\BQnbfvn.exe
  2⤵
  PID:5080
- C:\Windows\System\MdpgaOx.exe
  C:\Windows\System\MdpgaOx.exe
  2⤵
  PID:6680
- C:\Windows\System\sBhxQXP.exe
  C:\Windows\System\sBhxQXP.exe
  2⤵
  PID:6836
- C:\Windows\System\sHhAwOy.exe
  C:\Windows\System\sHhAwOy.exe
  2⤵
  PID:6944
- C:\Windows\System\PEpnrCl.exe
  C:\Windows\System\PEpnrCl.exe
  2⤵
  PID:7092
- C:\Windows\System\HgaypbH.exe
  C:\Windows\System\HgaypbH.exe
  2⤵
  PID:1204
- C:\Windows\System\eUjHjiY.exe
  C:\Windows\System\eUjHjiY.exe
  2⤵
  PID:1912
- C:\Windows\System\laOHfoU.exe
  C:\Windows\System\laOHfoU.exe
  2⤵
  PID:3872
- C:\Windows\System\ddQTIUn.exe
  C:\Windows\System\ddQTIUn.exe
  2⤵
  PID:4028
- C:\Windows\System\fPuAFfX.exe
  C:\Windows\System\fPuAFfX.exe
  2⤵
  PID:7056
- C:\Windows\System\qgiVwkN.exe
  C:\Windows\System\qgiVwkN.exe
  2⤵
  PID:556
- C:\Windows\System\TNleMJn.exe
  C:\Windows\System\TNleMJn.exe
  2⤵
  PID:1836
- C:\Windows\System\CGGitFn.exe
  C:\Windows\System\CGGitFn.exe
  2⤵
  PID:6860
- C:\Windows\System\KRhHKzY.exe
  C:\Windows\System\KRhHKzY.exe
  2⤵
  PID:7188
- C:\Windows\System\wGRmayo.exe
  C:\Windows\System\wGRmayo.exe
  2⤵
  PID:7204
- C:\Windows\System\ewgxDwm.exe
  C:\Windows\System\ewgxDwm.exe
  2⤵
  PID:7220
- C:\Windows\System\AQaHeey.exe
  C:\Windows\System\AQaHeey.exe
  2⤵
  PID:7256
- C:\Windows\System\FVENTwk.exe
  C:\Windows\System\FVENTwk.exe
  2⤵
  PID:7284
- C:\Windows\System\zathxWH.exe
  C:\Windows\System\zathxWH.exe
  2⤵
  PID:7320
- C:\Windows\System\ShfVZdV.exe
  C:\Windows\System\ShfVZdV.exe
  2⤵
  PID:7344
- C:\Windows\System\lexVgfo.exe
  C:\Windows\System\lexVgfo.exe
  2⤵
  PID:7364
- C:\Windows\System\GDsrgdt.exe
  C:\Windows\System\GDsrgdt.exe
  2⤵
  PID:7400
- C:\Windows\System\ahQIJss.exe
  C:\Windows\System\ahQIJss.exe
  2⤵
  PID:7428
- C:\Windows\System\bwjBBkF.exe
  C:\Windows\System\bwjBBkF.exe
  2⤵
  PID:7452
- C:\Windows\System\wLOWDXq.exe
  C:\Windows\System\wLOWDXq.exe
  2⤵
  PID:7480
- C:\Windows\System\ZmJmCxF.exe
  C:\Windows\System\ZmJmCxF.exe
  2⤵
  PID:7504
- C:\Windows\System\ykRnjWT.exe
  C:\Windows\System\ykRnjWT.exe
  2⤵
  PID:7536
- C:\Windows\System\fDxJDxQ.exe
  C:\Windows\System\fDxJDxQ.exe
  2⤵
  PID:7556
- C:\Windows\System\uriwxlP.exe
  C:\Windows\System\uriwxlP.exe
  2⤵
  PID:7580
- C:\Windows\System\mlTTbzO.exe
  C:\Windows\System\mlTTbzO.exe
  2⤵
  PID:7604
- C:\Windows\System\AGtjNoH.exe
  C:\Windows\System\AGtjNoH.exe
  2⤵
  PID:7624
- C:\Windows\System\itRoDPl.exe
  C:\Windows\System\itRoDPl.exe
  2⤵
  PID:7668
- C:\Windows\System\gaBKZhE.exe
  C:\Windows\System\gaBKZhE.exe
  2⤵
  PID:7700
- C:\Windows\System\xVTRgrB.exe
  C:\Windows\System\xVTRgrB.exe
  2⤵
  PID:7724
- C:\Windows\System\xwSCTUL.exe
  C:\Windows\System\xwSCTUL.exe
  2⤵
  PID:7752
- C:\Windows\System\pvCoQWf.exe
  C:\Windows\System\pvCoQWf.exe
  2⤵
  PID:7792
- C:\Windows\System\NfGqjzx.exe
  C:\Windows\System\NfGqjzx.exe
  2⤵
  PID:7828
- C:\Windows\System\YrIkNVF.exe
  C:\Windows\System\YrIkNVF.exe
  2⤵
  PID:7856
- C:\Windows\System\fMFlwmg.exe
  C:\Windows\System\fMFlwmg.exe
  2⤵
  PID:7872
- C:\Windows\System\qjQGtUu.exe
  C:\Windows\System\qjQGtUu.exe
  2⤵
  PID:7888
- C:\Windows\System\IVvfmgI.exe
  C:\Windows\System\IVvfmgI.exe
  2⤵
  PID:7904
- C:\Windows\System\pKacXuQ.exe
  C:\Windows\System\pKacXuQ.exe
  2⤵
  PID:7940
- C:\Windows\System\IVbicHo.exe
  C:\Windows\System\IVbicHo.exe
  2⤵
  PID:7980
- C:\Windows\System\avsnJtS.exe
  C:\Windows\System\avsnJtS.exe
  2⤵
  PID:8000
- C:\Windows\System\xZeKdZj.exe
  C:\Windows\System\xZeKdZj.exe
  2⤵
  PID:8032
- C:\Windows\System\PzlALtZ.exe
  C:\Windows\System\PzlALtZ.exe
  2⤵
  PID:8064
- C:\Windows\System\yyLJbKo.exe
  C:\Windows\System\yyLJbKo.exe
  2⤵
  PID:8084
- C:\Windows\System\antruKs.exe
  C:\Windows\System\antruKs.exe
  2⤵
  PID:8112
- C:\Windows\System\ZkPZTaK.exe
  C:\Windows\System\ZkPZTaK.exe
  2⤵
  PID:8144
- C:\Windows\System\PXysYgT.exe
  C:\Windows\System\PXysYgT.exe
  2⤵
  PID:8176
- C:\Windows\System\rjxvtXr.exe
  C:\Windows\System\rjxvtXr.exe
  2⤵
  PID:7180
- C:\Windows\System\EZcZxzu.exe
  C:\Windows\System\EZcZxzu.exe
  2⤵
  PID:7248
- C:\Windows\System\IyKoHSs.exe
  C:\Windows\System\IyKoHSs.exe
  2⤵
  PID:7340
- C:\Windows\System\DReBSuj.exe
  C:\Windows\System\DReBSuj.exe
  2⤵
  PID:7444
- C:\Windows\System\UuhgkDH.exe
  C:\Windows\System\UuhgkDH.exe
  2⤵
  PID:7500
- C:\Windows\System\tSPjDmd.exe
  C:\Windows\System\tSPjDmd.exe
  2⤵
  PID:7600
- C:\Windows\System\pMVIiYT.exe
  C:\Windows\System\pMVIiYT.exe
  2⤵
  PID:7660
- C:\Windows\System\tymrxfD.exe
  C:\Windows\System\tymrxfD.exe
  2⤵
  PID:7716
- C:\Windows\System\Xmakeki.exe
  C:\Windows\System\Xmakeki.exe
  2⤵
  PID:7768
- C:\Windows\System\FjZMgJc.exe
  C:\Windows\System\FjZMgJc.exe
  2⤵
  PID:7776
- C:\Windows\System\mkSGAvz.exe
  C:\Windows\System\mkSGAvz.exe
  2⤵
  PID:7884
- C:\Windows\System\aHJPlHT.exe
  C:\Windows\System\aHJPlHT.exe
  2⤵
  PID:7932
- C:\Windows\System\GUVogGc.exe
  C:\Windows\System\GUVogGc.exe
  2⤵
  PID:8040
- C:\Windows\System\uJOuYHQ.exe
  C:\Windows\System\uJOuYHQ.exe
  2⤵
  PID:8124
- C:\Windows\System\ZeKZpGh.exe
  C:\Windows\System\ZeKZpGh.exe
  2⤵
  PID:8168
- C:\Windows\System\eUQVbhP.exe
  C:\Windows\System\eUQVbhP.exe
  2⤵
  PID:7200
- C:\Windows\System\RZnnxng.exe
  C:\Windows\System\RZnnxng.exe
  2⤵
  PID:7332
- C:\Windows\System\SILxwhl.exe
  C:\Windows\System\SILxwhl.exe
  2⤵
  PID:7488
- C:\Windows\System\IZyRpWE.exe
  C:\Windows\System\IZyRpWE.exe
  2⤵
  PID:7680
- C:\Windows\System\CCMCvZV.exe
  C:\Windows\System\CCMCvZV.exe
  2⤵
  PID:7812
- C:\Windows\System\eAPcnxM.exe
  C:\Windows\System\eAPcnxM.exe
  2⤵
  PID:7900
- C:\Windows\System\WGLbQlx.exe
  C:\Windows\System\WGLbQlx.exe
  2⤵
  PID:8096
- C:\Windows\System\fsMSqNS.exe
  C:\Windows\System\fsMSqNS.exe
  2⤵
  PID:7396
- C:\Windows\System\PfTIqtP.exe
  C:\Windows\System\PfTIqtP.exe
  2⤵
  PID:7784
- C:\Windows\System\qcFeqVM.exe
  C:\Windows\System\qcFeqVM.exe
  2⤵
  PID:7996
- C:\Windows\System\CPRRvSw.exe
  C:\Windows\System\CPRRvSw.exe
  2⤵
  PID:8052
- C:\Windows\System\tzJtKSN.exe
  C:\Windows\System\tzJtKSN.exe
  2⤵
  PID:7620
- C:\Windows\System\AZuFNFk.exe
  C:\Windows\System\AZuFNFk.exe
  2⤵
  PID:8220
- C:\Windows\System\IytqYlV.exe
  C:\Windows\System\IytqYlV.exe
  2⤵
  PID:8248
- C:\Windows\System\DVneuWd.exe
  C:\Windows\System\DVneuWd.exe
  2⤵
  PID:8276
- C:\Windows\System\cCPJVjG.exe
  C:\Windows\System\cCPJVjG.exe
  2⤵
  PID:8304
- C:\Windows\System\bdQbITD.exe
  C:\Windows\System\bdQbITD.exe
  2⤵
  PID:8336
- C:\Windows\System\NxIefsG.exe
  C:\Windows\System\NxIefsG.exe
  2⤵
  PID:8372
- C:\Windows\System\YATQOiq.exe
  C:\Windows\System\YATQOiq.exe
  2⤵
  PID:8400
- C:\Windows\System\jOMxmct.exe
  C:\Windows\System\jOMxmct.exe
  2⤵
  PID:8416
- C:\Windows\System\OxomPdF.exe
  C:\Windows\System\OxomPdF.exe
  2⤵
  PID:8444
- C:\Windows\System\eZcaxHl.exe
  C:\Windows\System\eZcaxHl.exe
  2⤵
  PID:8472
- C:\Windows\System\cwJdHfI.exe
  C:\Windows\System\cwJdHfI.exe
  2⤵
  PID:8512
- C:\Windows\System\FNjrdxz.exe
  C:\Windows\System\FNjrdxz.exe
  2⤵
  PID:8544
- C:\Windows\System\jOODayF.exe
  C:\Windows\System\jOODayF.exe
  2⤵
  PID:8560
- C:\Windows\System\DwrKTip.exe
  C:\Windows\System\DwrKTip.exe
  2⤵
  PID:8592
- C:\Windows\System\EbIrRUg.exe
  C:\Windows\System\EbIrRUg.exe
  2⤵
  PID:8616
- C:\Windows\System\cdCciAC.exe
  C:\Windows\System\cdCciAC.exe
  2⤵
  PID:8660
- C:\Windows\System\bXbMuuj.exe
  C:\Windows\System\bXbMuuj.exe
  2⤵
  PID:8684
- C:\Windows\System\VlMVobR.exe
  C:\Windows\System\VlMVobR.exe
  2⤵
  PID:8704
- C:\Windows\System\YCfpIQD.exe
  C:\Windows\System\YCfpIQD.exe
  2⤵
  PID:8728
- C:\Windows\System\OumhaGJ.exe
  C:\Windows\System\OumhaGJ.exe
  2⤵
  PID:8760
- C:\Windows\System\wsGmWfX.exe
  C:\Windows\System\wsGmWfX.exe
  2⤵
  PID:8788
- C:\Windows\System\FBFCTHG.exe
  C:\Windows\System\FBFCTHG.exe
  2⤵
  PID:8804
- C:\Windows\System\KuObhIg.exe
  C:\Windows\System\KuObhIg.exe
  2⤵
  PID:8824
- C:\Windows\System\hPVjROD.exe
  C:\Windows\System\hPVjROD.exe
  2⤵
  PID:8864
- C:\Windows\System\yOnBitN.exe
  C:\Windows\System\yOnBitN.exe
  2⤵
  PID:8888
- C:\Windows\System\kAtSWHU.exe
  C:\Windows\System\kAtSWHU.exe
  2⤵
  PID:8908
- C:\Windows\System\KMWPaWV.exe
  C:\Windows\System\KMWPaWV.exe
  2⤵
  PID:8944
- C:\Windows\System\izLFuFT.exe
  C:\Windows\System\izLFuFT.exe
  2⤵
  PID:8996
- C:\Windows\System\kclfUfz.exe
  C:\Windows\System\kclfUfz.exe
  2⤵
  PID:9012
- C:\Windows\System\JfxqIxi.exe
  C:\Windows\System\JfxqIxi.exe
  2⤵
  PID:9040
- C:\Windows\System\aJorHgU.exe
  C:\Windows\System\aJorHgU.exe
  2⤵
  PID:9080
- C:\Windows\System\ByFWFzF.exe
  C:\Windows\System\ByFWFzF.exe
  2⤵
  PID:9096
- C:\Windows\System\NaceIeB.exe
  C:\Windows\System\NaceIeB.exe
  2⤵
  PID:9132
- C:\Windows\System\xsFolLL.exe
  C:\Windows\System\xsFolLL.exe
  2⤵
  PID:9152
- C:\Windows\System\AnzsaMY.exe
  C:\Windows\System\AnzsaMY.exe
  2⤵
  PID:9184
- C:\Windows\System\PTNzJps.exe
  C:\Windows\System\PTNzJps.exe
  2⤵
  PID:9208
- C:\Windows\System\lvRKnEG.exe
  C:\Windows\System\lvRKnEG.exe
  2⤵
  PID:8228
- C:\Windows\System\rMuWKEX.exe
  C:\Windows\System\rMuWKEX.exe
  2⤵
  PID:8316
- C:\Windows\System\iamuWqS.exe
  C:\Windows\System\iamuWqS.exe
  2⤵
  PID:8360
- C:\Windows\System\tjbrCxg.exe
  C:\Windows\System\tjbrCxg.exe
  2⤵
  PID:8460
- C:\Windows\System\kYXXHRp.exe
  C:\Windows\System\kYXXHRp.exe
  2⤵
  PID:8508
- C:\Windows\System\lyqfXft.exe
  C:\Windows\System\lyqfXft.exe
  2⤵
  PID:8532
- C:\Windows\System\AqaIYKB.exe
  C:\Windows\System\AqaIYKB.exe
  2⤵
  PID:8632
- C:\Windows\System\TklVKan.exe
  C:\Windows\System\TklVKan.exe
  2⤵
  PID:8700
- C:\Windows\System\LIQiZuL.exe
  C:\Windows\System\LIQiZuL.exe
  2⤵
  PID:8748
- C:\Windows\System\lZvlfBv.exe
  C:\Windows\System\lZvlfBv.exe
  2⤵
  PID:8800
- C:\Windows\System\PkQPAid.exe
  C:\Windows\System\PkQPAid.exe
  2⤵
  PID:8856
- C:\Windows\System\xGBqMUO.exe
  C:\Windows\System\xGBqMUO.exe
  2⤵
  PID:8988
- C:\Windows\System\LVlzJNo.exe
  C:\Windows\System\LVlzJNo.exe
  2⤵
  PID:9008
- C:\Windows\System\iZVdXsa.exe
  C:\Windows\System\iZVdXsa.exe
  2⤵
  PID:9072
- C:\Windows\System\FZvvSIS.exe
  C:\Windows\System\FZvvSIS.exe
  2⤵
  PID:9164
- C:\Windows\System\Rawyhtj.exe
  C:\Windows\System\Rawyhtj.exe
  2⤵
  PID:8212
- C:\Windows\System\eaSibOt.exe
  C:\Windows\System\eaSibOt.exe
  2⤵
  PID:8292
- C:\Windows\System\fLrIVsR.exe
  C:\Windows\System\fLrIVsR.exe
  2⤵
  PID:8440
- C:\Windows\System\TFVHxbl.exe
  C:\Windows\System\TFVHxbl.exe
  2⤵
  PID:8576
- C:\Windows\System\ILLsvgd.exe
  C:\Windows\System\ILLsvgd.exe
  2⤵
  PID:8724
- C:\Windows\System\KzkNTgH.exe
  C:\Windows\System\KzkNTgH.exe
  2⤵
  PID:8916
- C:\Windows\System\ZsPGsLd.exe
  C:\Windows\System\ZsPGsLd.exe
  2⤵
  PID:9092
- C:\Windows\System\EBeqfxC.exe
  C:\Windows\System\EBeqfxC.exe
  2⤵
  PID:8320
- C:\Windows\System\JSSAvGe.exe
  C:\Windows\System\JSSAvGe.exe
  2⤵
  PID:8668
- C:\Windows\System\dzEyPVg.exe
  C:\Windows\System\dzEyPVg.exe
  2⤵
  PID:8812
- C:\Windows\System\rWPrzWq.exe
  C:\Windows\System\rWPrzWq.exe
  2⤵
  PID:9204
- C:\Windows\System\oBlGbKC.exe
  C:\Windows\System\oBlGbKC.exe
  2⤵
  PID:8488
- C:\Windows\System\mwwNwYw.exe
  C:\Windows\System\mwwNwYw.exe
  2⤵
  PID:9256
- C:\Windows\System\bzwyPCI.exe
  C:\Windows\System\bzwyPCI.exe
  2⤵
  PID:9280
- C:\Windows\System\qbhLbtG.exe
  C:\Windows\System\qbhLbtG.exe
  2⤵
  PID:9312
- C:\Windows\System\EkRWggM.exe
  C:\Windows\System\EkRWggM.exe
  2⤵
  PID:9344
- C:\Windows\System\sWGlCEu.exe
  C:\Windows\System\sWGlCEu.exe
  2⤵
  PID:9384
- C:\Windows\System\jMChtTf.exe
  C:\Windows\System\jMChtTf.exe
  2⤵
  PID:9420
- C:\Windows\System\rfGvnvg.exe
  C:\Windows\System\rfGvnvg.exe
  2⤵
  PID:9448
- C:\Windows\System\avTokUd.exe
  C:\Windows\System\avTokUd.exe
  2⤵
  PID:9472
- C:\Windows\System\vCvKOus.exe
  C:\Windows\System\vCvKOus.exe
  2⤵
  PID:9504
- C:\Windows\System\SBWVkiB.exe
  C:\Windows\System\SBWVkiB.exe
  2⤵
  PID:9528
- C:\Windows\System\tqBFuIM.exe
  C:\Windows\System\tqBFuIM.exe
  2⤵
  PID:9560
- C:\Windows\System\GJOwvVO.exe
  C:\Windows\System\GJOwvVO.exe
  2⤵
  PID:9576
- C:\Windows\System\mtCMqXD.exe
  C:\Windows\System\mtCMqXD.exe
  2⤵
  PID:9608
- C:\Windows\System\IWuACwz.exe
  C:\Windows\System\IWuACwz.exe
  2⤵
  PID:9632
- C:\Windows\System\hXXLeLq.exe
  C:\Windows\System\hXXLeLq.exe
  2⤵
  PID:9660
- C:\Windows\System\UcnDvSu.exe
  C:\Windows\System\UcnDvSu.exe
  2⤵
  PID:9704
- C:\Windows\System\VLJJgOD.exe
  C:\Windows\System\VLJJgOD.exe
  2⤵
  PID:9720
- C:\Windows\System\aEaQfVo.exe
  C:\Windows\System\aEaQfVo.exe
  2⤵
  PID:9748
- C:\Windows\System\wbNJcvl.exe
  C:\Windows\System\wbNJcvl.exe
  2⤵
  PID:9784
- C:\Windows\System\PRCafJp.exe
  C:\Windows\System\PRCafJp.exe
  2⤵
  PID:9804
- C:\Windows\System\IjoneTp.exe
  C:\Windows\System\IjoneTp.exe
  2⤵
  PID:9840
- C:\Windows\System\daXleNm.exe
  C:\Windows\System\daXleNm.exe
  2⤵
  PID:9860
- C:\Windows\System\VYNcDSA.exe
  C:\Windows\System\VYNcDSA.exe
  2⤵
  PID:9876
- C:\Windows\System\fFKjWFc.exe
  C:\Windows\System\fFKjWFc.exe
  2⤵
  PID:9904
- C:\Windows\System\UTMIbzS.exe
  C:\Windows\System\UTMIbzS.exe
  2⤵
  PID:9940
- C:\Windows\System\sUMOqKV.exe
  C:\Windows\System\sUMOqKV.exe
  2⤵
  PID:9972
- C:\Windows\System\NLkFOCu.exe
  C:\Windows\System\NLkFOCu.exe
  2⤵
  PID:9996
- C:\Windows\System\ODegtdv.exe
  C:\Windows\System\ODegtdv.exe
  2⤵
  PID:10032
- C:\Windows\System\pYUSBOa.exe
  C:\Windows\System\pYUSBOa.exe
  2⤵
  PID:10068
- C:\Windows\System\aHDPWOL.exe
  C:\Windows\System\aHDPWOL.exe
  2⤵
  PID:10084
- C:\Windows\System\CsyOOGs.exe
  C:\Windows\System\CsyOOGs.exe
  2⤵
  PID:10108
- C:\Windows\System\OPMAJZD.exe
  C:\Windows\System\OPMAJZD.exe
  2⤵
  PID:10132
- C:\Windows\System\zEgPJaB.exe
  C:\Windows\System\zEgPJaB.exe
  2⤵
  PID:10156
- C:\Windows\System\lQJLbsZ.exe
  C:\Windows\System\lQJLbsZ.exe
  2⤵
  PID:10196
- C:\Windows\System\DrqQwyX.exe
  C:\Windows\System\DrqQwyX.exe
  2⤵
  PID:10224
- C:\Windows\System\xADjFCn.exe
  C:\Windows\System\xADjFCn.exe
  2⤵
  PID:8540
- C:\Windows\System\tgMBiYe.exe
  C:\Windows\System\tgMBiYe.exe
  2⤵
  PID:9244
- C:\Windows\System\fOsJapD.exe
  C:\Windows\System\fOsJapD.exe
  2⤵
  PID:9300
- C:\Windows\System\sfUAuRE.exe
  C:\Windows\System\sfUAuRE.exe
  2⤵
  PID:9376
- C:\Windows\System\DnrRUTI.exe
  C:\Windows\System\DnrRUTI.exe
  2⤵
  PID:9460
- C:\Windows\System\kGXmOHm.exe
  C:\Windows\System\kGXmOHm.exe
  2⤵
  PID:9524
- C:\Windows\System\ephzgPf.exe
  C:\Windows\System\ephzgPf.exe
  2⤵
  PID:9572
- C:\Windows\System\ZfmubSR.exe
  C:\Windows\System\ZfmubSR.exe
  2⤵
  PID:9600
- C:\Windows\System\ZljVQTm.exe
  C:\Windows\System\ZljVQTm.exe
  2⤵
  PID:9680
- C:\Windows\System\IjWJIYv.exe
  C:\Windows\System\IjWJIYv.exe
  2⤵
  PID:9772
- C:\Windows\System\XbDyNQj.exe
  C:\Windows\System\XbDyNQj.exe
  2⤵
  PID:9848
- C:\Windows\System\ICeODFI.exe
  C:\Windows\System\ICeODFI.exe
  2⤵
  PID:9896
- C:\Windows\System\gJCUckn.exe
  C:\Windows\System\gJCUckn.exe
  2⤵
  PID:9920
- C:\Windows\System\jhxgMPD.exe
  C:\Windows\System\jhxgMPD.exe
  2⤵
  PID:10016
- C:\Windows\System\CdyKYct.exe
  C:\Windows\System\CdyKYct.exe
  2⤵
  PID:10100
- C:\Windows\System\sGovjcp.exe
  C:\Windows\System\sGovjcp.exe
  2⤵
  PID:10140
- C:\Windows\System\ELJHvSY.exe
  C:\Windows\System\ELJHvSY.exe
  2⤵
  PID:9056
- C:\Windows\System\pxOBlYF.exe
  C:\Windows\System\pxOBlYF.exe
  2⤵
  PID:9336
- C:\Windows\System\NJPJlBW.exe
  C:\Windows\System\NJPJlBW.exe
  2⤵
  PID:9552
- C:\Windows\System\GHcbQlJ.exe
  C:\Windows\System\GHcbQlJ.exe
  2⤵
  PID:9628
- C:\Windows\System\yWLpebP.exe
  C:\Windows\System\yWLpebP.exe
  2⤵
  PID:9740
- C:\Windows\System\yZDceYn.exe
  C:\Windows\System\yZDceYn.exe
  2⤵
  PID:9872
- C:\Windows\System\iZeAqGR.exe
  C:\Windows\System\iZeAqGR.exe
  2⤵
  PID:10236
- C:\Windows\System\fDaVqDA.exe
  C:\Windows\System\fDaVqDA.exe
  2⤵
  PID:9440
- C:\Windows\System\jteRiqO.exe
  C:\Windows\System\jteRiqO.exe
  2⤵
  PID:9828
- C:\Windows\System\ENqNrLZ.exe
  C:\Windows\System\ENqNrLZ.exe
  2⤵
  PID:10128
- C:\Windows\System\zHkEhrs.exe
  C:\Windows\System\zHkEhrs.exe
  2⤵
  PID:10252
- C:\Windows\System\hSmSbMg.exe
  C:\Windows\System\hSmSbMg.exe
  2⤵
  PID:10280
- C:\Windows\System\cLUYUYK.exe
  C:\Windows\System\cLUYUYK.exe
  2⤵
  PID:10320
- C:\Windows\System\phGyrpU.exe
  C:\Windows\System\phGyrpU.exe
  2⤵
  PID:10336
- C:\Windows\System\TQLbskg.exe
  C:\Windows\System\TQLbskg.exe
  2⤵
  PID:10352
- C:\Windows\System\EEkWiHG.exe
  C:\Windows\System\EEkWiHG.exe
  2⤵
  PID:10368
- C:\Windows\System\ztcRsuP.exe
  C:\Windows\System\ztcRsuP.exe
  2⤵
  PID:10392
- C:\Windows\System\FAipuQC.exe
  C:\Windows\System\FAipuQC.exe
  2⤵
  PID:10456
- C:\Windows\System\ZMJRaCU.exe
  C:\Windows\System\ZMJRaCU.exe
  2⤵
  PID:10476
- C:\Windows\System\ejFyHea.exe
  C:\Windows\System\ejFyHea.exe
  2⤵
  PID:10504
- C:\Windows\System\SzfVucZ.exe
  C:\Windows\System\SzfVucZ.exe
  2⤵
  PID:10536
- C:\Windows\System\GOFEebt.exe
  C:\Windows\System\GOFEebt.exe
  2⤵
  PID:10560
- C:\Windows\System\abZbfaB.exe
  C:\Windows\System\abZbfaB.exe
  2⤵
  PID:10580
- C:\Windows\System\OzlCIgQ.exe
  C:\Windows\System\OzlCIgQ.exe
  2⤵
  PID:10612
- C:\Windows\System\IhvuSkM.exe
  C:\Windows\System\IhvuSkM.exe
  2⤵
  PID:10632
- C:\Windows\System\FbaMtxj.exe
  C:\Windows\System\FbaMtxj.exe
  2⤵
  PID:10656
- C:\Windows\System\AmeHjJb.exe
  C:\Windows\System\AmeHjJb.exe
  2⤵
  PID:10676
- C:\Windows\System\EzEnbLb.exe
  C:\Windows\System\EzEnbLb.exe
  2⤵
  PID:10692
- C:\Windows\System\GZJENRR.exe
  C:\Windows\System\GZJENRR.exe
  2⤵
  PID:10736
- C:\Windows\System\YadYrrl.exe
  C:\Windows\System\YadYrrl.exe
  2⤵
  PID:10764
- C:\Windows\System\YQuXIAt.exe
  C:\Windows\System\YQuXIAt.exe
  2⤵
  PID:10804
- C:\Windows\System\arORNeD.exe
  C:\Windows\System\arORNeD.exe
  2⤵
  PID:10832
- C:\Windows\System\jrXipqv.exe
  C:\Windows\System\jrXipqv.exe
  2⤵
  PID:10884
- C:\Windows\System\XLMIRME.exe
  C:\Windows\System\XLMIRME.exe
  2⤵
  PID:10912
- C:\Windows\System\iFVUNtr.exe
  C:\Windows\System\iFVUNtr.exe
  2⤵
  PID:10940
- C:\Windows\System\eRQyRNu.exe
  C:\Windows\System\eRQyRNu.exe
  2⤵
  PID:10968
- C:\Windows\System\dlBJLow.exe
  C:\Windows\System\dlBJLow.exe
  2⤵
  PID:10992
- C:\Windows\System\RniamKv.exe
  C:\Windows\System\RniamKv.exe
  2⤵
  PID:11024
- C:\Windows\System\erDasGM.exe
  C:\Windows\System\erDasGM.exe
  2⤵
  PID:11044
- C:\Windows\System\AfTsFPe.exe
  C:\Windows\System\AfTsFPe.exe
  2⤵
  PID:11076
- C:\Windows\System\zhHEKnN.exe
  C:\Windows\System\zhHEKnN.exe
  2⤵
  PID:11100
- C:\Windows\System\knGjGnF.exe
  C:\Windows\System\knGjGnF.exe
  2⤵
  PID:11124
- C:\Windows\System\fdaEUzd.exe
  C:\Windows\System\fdaEUzd.exe
  2⤵
  PID:11156
- C:\Windows\System\AXvKToe.exe
  C:\Windows\System\AXvKToe.exe
  2⤵
  PID:11180
- C:\Windows\System\bFDOoUs.exe
  C:\Windows\System\bFDOoUs.exe
  2⤵
  PID:11216
- C:\Windows\System\glKUeke.exe
  C:\Windows\System\glKUeke.exe
  2⤵
  PID:11240
- C:\Windows\System\VcDfxGF.exe
  C:\Windows\System\VcDfxGF.exe
  2⤵
  PID:9644
- C:\Windows\System\YGjtoYq.exe
  C:\Windows\System\YGjtoYq.exe
  2⤵
  PID:9028
- C:\Windows\System\EQFWLoN.exe
  C:\Windows\System\EQFWLoN.exe
  2⤵
  PID:10328
- C:\Windows\System\kvZHdLj.exe
  C:\Windows\System\kvZHdLj.exe
  2⤵
  PID:10384
- C:\Windows\System\mSaamxu.exe
  C:\Windows\System\mSaamxu.exe
  2⤵
  PID:10468
- C:\Windows\System\RXoKZCc.exe
  C:\Windows\System\RXoKZCc.exe
  2⤵
  PID:10520
- C:\Windows\System\SJxwLjP.exe
  C:\Windows\System\SJxwLjP.exe
  2⤵
  PID:10596
- C:\Windows\System\qELzOGh.exe
  C:\Windows\System\qELzOGh.exe
  2⤵
  PID:10644
- C:\Windows\System\xYRSbms.exe
  C:\Windows\System\xYRSbms.exe
  2⤵
  PID:10712
- C:\Windows\System\MYWjfCi.exe
  C:\Windows\System\MYWjfCi.exe
  2⤵
  PID:10792
- C:\Windows\System\ZSqBGvJ.exe
  C:\Windows\System\ZSqBGvJ.exe
  2⤵
  PID:10852
- C:\Windows\System\rRigVWf.exe
  C:\Windows\System\rRigVWf.exe
  2⤵
  PID:10864
- C:\Windows\System\KZVPDzW.exe
  C:\Windows\System\KZVPDzW.exe
  2⤵
  PID:11012
- C:\Windows\System\XuymGed.exe
  C:\Windows\System\XuymGed.exe
  2⤵
  PID:11052
- C:\Windows\System\DCgBuIg.exe
  C:\Windows\System\DCgBuIg.exe
  2⤵
  PID:11120
- C:\Windows\System\AHIwtMW.exe
  C:\Windows\System\AHIwtMW.exe
  2⤵
  PID:11200
- C:\Windows\System\FrVlODl.exe
  C:\Windows\System\FrVlODl.exe
  2⤵
  PID:11252
- C:\Windows\System\JnLjwap.exe
  C:\Windows\System\JnLjwap.exe
  2⤵
  PID:10264
- C:\Windows\System\LApfiba.exe
  C:\Windows\System\LApfiba.exe
  2⤵
  PID:10408
- C:\Windows\System\LpvgqPy.exe
  C:\Windows\System\LpvgqPy.exe
  2⤵
  PID:10500
- C:\Windows\System\XggRPCL.exe
  C:\Windows\System\XggRPCL.exe
  2⤵
  PID:10624
- C:\Windows\System\hGjbtqB.exe
  C:\Windows\System\hGjbtqB.exe
  2⤵
  PID:10860
- C:\Windows\System\QQoVAlj.exe
  C:\Windows\System\QQoVAlj.exe
  2⤵
  PID:11116
- C:\Windows\System\GMHRBGn.exe
  C:\Windows\System\GMHRBGn.exe
  2⤵
  PID:11232
- C:\Windows\System\zGyZkJK.exe
  C:\Windows\System\zGyZkJK.exe
  2⤵
  PID:10628
- C:\Windows\System\HLttcNt.exe
  C:\Windows\System\HLttcNt.exe
  2⤵
  PID:10684
- C:\Windows\System\WPgSvyV.exe
  C:\Windows\System\WPgSvyV.exe
  2⤵
  PID:11172
- C:\Windows\System\QTMRBhH.exe
  C:\Windows\System\QTMRBhH.exe
  2⤵
  PID:10300
- C:\Windows\System\WYwAHLY.exe
  C:\Windows\System\WYwAHLY.exe
  2⤵
  PID:11280
- C:\Windows\System\vsihxSi.exe
  C:\Windows\System\vsihxSi.exe
  2⤵
  PID:11300
- C:\Windows\System\fxrqhsE.exe
  C:\Windows\System\fxrqhsE.exe
  2⤵
  PID:11328
- C:\Windows\System\oXYxKcu.exe
  C:\Windows\System\oXYxKcu.exe
  2⤵
  PID:11368
- C:\Windows\System\PHJifaw.exe
  C:\Windows\System\PHJifaw.exe
  2⤵
  PID:11384
- C:\Windows\System\LiXFWUP.exe
  C:\Windows\System\LiXFWUP.exe
  2⤵
  PID:11412
- C:\Windows\System\OEoHfJN.exe
  C:\Windows\System\OEoHfJN.exe
  2⤵
  PID:11452
- C:\Windows\System\KkQnESp.exe
  C:\Windows\System\KkQnESp.exe
  2⤵
  PID:11472
- C:\Windows\System\WYDawXs.exe
  C:\Windows\System\WYDawXs.exe
  2⤵
  PID:11496
- C:\Windows\System\CpBJExY.exe
  C:\Windows\System\CpBJExY.exe
  2⤵
  PID:11520
- C:\Windows\System\FWSDRDc.exe
  C:\Windows\System\FWSDRDc.exe
  2⤵
  PID:11556
- C:\Windows\System\nGGvutz.exe
  C:\Windows\System\nGGvutz.exe
  2⤵
  PID:11592
- C:\Windows\System\TMegNPs.exe
  C:\Windows\System\TMegNPs.exe
  2⤵
  PID:11620
- C:\Windows\System\yUhTOBC.exe
  C:\Windows\System\yUhTOBC.exe
  2⤵
  PID:11636
- C:\Windows\System\EbjUcqR.exe
  C:\Windows\System\EbjUcqR.exe
  2⤵
  PID:11668
- C:\Windows\System\PMkSffW.exe
  C:\Windows\System\PMkSffW.exe
  2⤵
  PID:11692
- C:\Windows\System\KfKfRsw.exe
  C:\Windows\System\KfKfRsw.exe
  2⤵
  PID:11732
- C:\Windows\System\jeDfnwz.exe
  C:\Windows\System\jeDfnwz.exe
  2⤵
  PID:11752
- C:\Windows\System\DHbKRKy.exe
  C:\Windows\System\DHbKRKy.exe
  2⤵
  PID:11792
- C:\Windows\System\usMMGxY.exe
  C:\Windows\System\usMMGxY.exe
  2⤵
  PID:11820
- C:\Windows\System\MlsZWLp.exe
  C:\Windows\System\MlsZWLp.exe
  2⤵
  PID:11836
- C:\Windows\System\eynLGjn.exe
  C:\Windows\System\eynLGjn.exe
  2⤵
  PID:11864
- C:\Windows\System\LOiRSQU.exe
  C:\Windows\System\LOiRSQU.exe
  2⤵
  PID:11892
- C:\Windows\System\nJBtONn.exe
  C:\Windows\System\nJBtONn.exe
  2⤵
  PID:11912
- C:\Windows\System\ZcWUCUG.exe
  C:\Windows\System\ZcWUCUG.exe
  2⤵
  PID:11940
- C:\Windows\System\YhwCVsw.exe
  C:\Windows\System\YhwCVsw.exe
  2⤵
  PID:11972
- C:\Windows\System\fYgHFZT.exe
  C:\Windows\System\fYgHFZT.exe
  2⤵
  PID:12000
- C:\Windows\System\BzLKyIO.exe
  C:\Windows\System\BzLKyIO.exe
  2⤵
  PID:12032
- C:\Windows\System\iZnFtTr.exe
  C:\Windows\System\iZnFtTr.exe
  2⤵
  PID:12052
- C:\Windows\System\pzSZmWI.exe
  C:\Windows\System\pzSZmWI.exe
  2⤵
  PID:12076
- C:\Windows\System\UZKfzeG.exe
  C:\Windows\System\UZKfzeG.exe
  2⤵
  PID:12116
- C:\Windows\System\wPTKyEo.exe
  C:\Windows\System\wPTKyEo.exe
  2⤵
  PID:12136
- C:\Windows\System\NsvuTat.exe
  C:\Windows\System\NsvuTat.exe
  2⤵
  PID:12168
- C:\Windows\System\mYfwDlX.exe
  C:\Windows\System\mYfwDlX.exe
  2⤵
  PID:12192
- C:\Windows\System\gDRtnRq.exe
  C:\Windows\System\gDRtnRq.exe
  2⤵
  PID:12228
- C:\Windows\System\IPAPfoF.exe
  C:\Windows\System\IPAPfoF.exe
  2⤵
  PID:12272
- C:\Windows\System\NpYeSQg.exe
  C:\Windows\System\NpYeSQg.exe
  2⤵
  PID:10816
- C:\Windows\System\rqgXULJ.exe
  C:\Windows\System\rqgXULJ.exe
  2⤵
  PID:11340
- C:\Windows\System\HacArrb.exe
  C:\Windows\System\HacArrb.exe
  2⤵
  PID:11376
- C:\Windows\System\YocXfas.exe
  C:\Windows\System\YocXfas.exe
  2⤵
  PID:11460
- C:\Windows\System\NCsHyLS.exe
  C:\Windows\System\NCsHyLS.exe
  2⤵
  PID:11488
- C:\Windows\System\bnVKqDv.exe
  C:\Windows\System\bnVKqDv.exe
  2⤵
  PID:11568
- C:\Windows\System\YyKNOsI.exe
  C:\Windows\System\YyKNOsI.exe
  2⤵
  PID:11648
- C:\Windows\System\LWjdvQu.exe
  C:\Windows\System\LWjdvQu.exe
  2⤵
  PID:11676
- C:\Windows\System\gOLxchB.exe
  C:\Windows\System\gOLxchB.exe
  2⤵
  PID:11784
- C:\Windows\System\tZBBLRt.exe
  C:\Windows\System\tZBBLRt.exe
  2⤵
  PID:11828
- C:\Windows\System\TFObvYx.exe
  C:\Windows\System\TFObvYx.exe
  2⤵
  PID:11904
- C:\Windows\System\uIuKMBy.exe
  C:\Windows\System\uIuKMBy.exe
  2⤵
  PID:11980
- C:\Windows\System\AUfWlVq.exe
  C:\Windows\System\AUfWlVq.exe
  2⤵
  PID:12024
- C:\Windows\System\CLUNjGR.exe
  C:\Windows\System\CLUNjGR.exe
  2⤵
  PID:12096
- C:\Windows\System\JHeofTy.exe
  C:\Windows\System\JHeofTy.exe
  2⤵
  PID:12156
- C:\Windows\System\bKLYzkT.exe
  C:\Windows\System\bKLYzkT.exe
  2⤵
  PID:12204
- C:\Windows\System\RMezeih.exe
  C:\Windows\System\RMezeih.exe
  2⤵
  PID:12264
- C:\Windows\System\xUWfCuo.exe
  C:\Windows\System\xUWfCuo.exe
  2⤵
  PID:11448
- C:\Windows\System\MGjdAUP.exe
  C:\Windows\System\MGjdAUP.exe
  2⤵
  PID:11540
- C:\Windows\System\pcluDmn.exe
  C:\Windows\System\pcluDmn.exe
  2⤵
  PID:11612
- C:\Windows\System\DCheutn.exe
  C:\Windows\System\DCheutn.exe
  2⤵
  PID:11740
- C:\Windows\System\VWsJhrc.exe
  C:\Windows\System\VWsJhrc.exe
  2⤵
  PID:11888
- C:\Windows\System\tppqbRU.exe
  C:\Windows\System\tppqbRU.exe
  2⤵
  PID:12084
- C:\Windows\System\SySbRLs.exe
  C:\Windows\System\SySbRLs.exe
  2⤵
  PID:12164
- C:\Windows\System\tRHZwAr.exe
  C:\Windows\System\tRHZwAr.exe
  2⤵
  PID:11480
- C:\Windows\System\CPzejNH.exe
  C:\Windows\System\CPzejNH.exe
  2⤵
  PID:12020
- C:\Windows\System\BwgjCrF.exe
  C:\Windows\System\BwgjCrF.exe
  2⤵
  PID:11396
- C:\Windows\System\QTXomyS.exe
  C:\Windows\System\QTXomyS.exe
  2⤵
  PID:12224
- C:\Windows\System\MRvNqBj.exe
  C:\Windows\System\MRvNqBj.exe
  2⤵
  PID:12292
- C:\Windows\System\SMVfODH.exe
  C:\Windows\System\SMVfODH.exe
  2⤵
  PID:12308
- C:\Windows\System\hDeCfuX.exe
  C:\Windows\System\hDeCfuX.exe
  2⤵
  PID:12340
- C:\Windows\System\hZOEChO.exe
  C:\Windows\System\hZOEChO.exe
  2⤵
  PID:12364
- C:\Windows\System\kgQltQX.exe
  C:\Windows\System\kgQltQX.exe
  2⤵
  PID:12392
- C:\Windows\System\STuWfGd.exe
  C:\Windows\System\STuWfGd.exe
  2⤵
  PID:12428
- C:\Windows\System\plGoJfj.exe
  C:\Windows\System\plGoJfj.exe
  2⤵
  PID:12472
- C:\Windows\System\QaQNBng.exe
  C:\Windows\System\QaQNBng.exe
  2⤵
  PID:12492
- C:\Windows\System\SUtlTBR.exe
  C:\Windows\System\SUtlTBR.exe
  2⤵
  PID:12516
- C:\Windows\System\aBvDFUN.exe
  C:\Windows\System\aBvDFUN.exe
  2⤵
  PID:12532
- C:\Windows\System\aagyRfL.exe
  C:\Windows\System\aagyRfL.exe
  2⤵
  PID:12560
- C:\Windows\System\jPkMXWn.exe
  C:\Windows\System\jPkMXWn.exe
  2⤵
  PID:12592
- C:\Windows\System\lKAVKkb.exe
  C:\Windows\System\lKAVKkb.exe
  2⤵
  PID:12628
- C:\Windows\System\YFUmBxy.exe
  C:\Windows\System\YFUmBxy.exe
  2⤵
  PID:12668
- C:\Windows\System\ncwoQFb.exe
  C:\Windows\System\ncwoQFb.exe
  2⤵
  PID:12696
- C:\Windows\System\zKQQMiq.exe
  C:\Windows\System\zKQQMiq.exe
  2⤵
  PID:12724
- C:\Windows\System\XUCgvMv.exe
  C:\Windows\System\XUCgvMv.exe
  2⤵
  PID:12740
- C:\Windows\System\nqUJOBD.exe
  C:\Windows\System\nqUJOBD.exe
  2⤵
  PID:12768
- C:\Windows\System\KowFlel.exe
  C:\Windows\System\KowFlel.exe
  2⤵
  PID:12808
- C:\Windows\System\LfiISlu.exe
  C:\Windows\System\LfiISlu.exe
  2⤵
  PID:12824
- C:\Windows\System\UIvycKh.exe
  C:\Windows\System\UIvycKh.exe
  2⤵
  PID:12852
- C:\Windows\System\dlouEKY.exe
  C:\Windows\System\dlouEKY.exe
  2⤵
  PID:12880
- C:\Windows\System\HUHDZRV.exe
  C:\Windows\System\HUHDZRV.exe
  2⤵
  PID:12908
- C:\Windows\System\XooUtCi.exe
  C:\Windows\System\XooUtCi.exe
  2⤵
  PID:12940
- C:\Windows\System\eDHuDUW.exe
  C:\Windows\System\eDHuDUW.exe
  2⤵
  PID:12968
- C:\Windows\System\ieJmADB.exe
  C:\Windows\System\ieJmADB.exe
  2⤵
  PID:13008
- C:\Windows\System\HYnPYkH.exe
  C:\Windows\System\HYnPYkH.exe
  2⤵
  PID:13036
- C:\Windows\System\kgsLTzC.exe
  C:\Windows\System\kgsLTzC.exe
  2⤵
  PID:13064
- C:\Windows\System\FVVrxUa.exe
  C:\Windows\System\FVVrxUa.exe
  2⤵
  PID:13092
- C:\Windows\System\RvsXHrr.exe
  C:\Windows\System\RvsXHrr.exe
  2⤵
  PID:13120
- C:\Windows\System\GSipyhw.exe
  C:\Windows\System\GSipyhw.exe
  2⤵
  PID:13148
- C:\Windows\System\ZaRlEae.exe
  C:\Windows\System\ZaRlEae.exe
  2⤵
  PID:13176
- C:\Windows\System\redNqIG.exe
  C:\Windows\System\redNqIG.exe
  2⤵
  PID:13192
- C:\Windows\System\NvIRVfQ.exe
  C:\Windows\System\NvIRVfQ.exe
  2⤵
  PID:13220
- C:\Windows\System\PyoWPsG.exe
  C:\Windows\System\PyoWPsG.exe
  2⤵
  PID:13248
- C:\Windows\System\CYpcOOW.exe
  C:\Windows\System\CYpcOOW.exe
  2⤵
  PID:13288
- C:\Windows\System\ixFkFev.exe
  C:\Windows\System\ixFkFev.exe
  2⤵
  PID:11312
- C:\Windows\System\EpdqRpz.exe
  C:\Windows\System\EpdqRpz.exe
  2⤵
  PID:12328
- C:\Windows\System\jrVUKNh.exe
  C:\Windows\System\jrVUKNh.exe
  2⤵
  PID:12400
- C:\Windows\System\QrYebhx.exe
  C:\Windows\System\QrYebhx.exe
  2⤵
  PID:12448
- C:\Windows\System\eqaSsfE.exe
  C:\Windows\System\eqaSsfE.exe
  2⤵
  PID:12480
- C:\Windows\System\xQUOKwi.exe
  C:\Windows\System\xQUOKwi.exe
  2⤵
  PID:12576
- C:\Windows\System\JIiLSUC.exe
  C:\Windows\System\JIiLSUC.exe
  2⤵
  PID:12624
- C:\Windows\System\uZCkgcp.exe
  C:\Windows\System\uZCkgcp.exe
  2⤵
  PID:12692
- C:\Windows\System\oluPEgx.exe
  C:\Windows\System\oluPEgx.exe
  2⤵
  PID:12752
- C:\Windows\System\luZYViB.exe
  C:\Windows\System\luZYViB.exe
  2⤵
  PID:12820
- C:\Windows\System\BmgJTRk.exe
  C:\Windows\System\BmgJTRk.exe
  2⤵
  PID:12896
- C:\Windows\System\aFpsKnR.exe
  C:\Windows\System\aFpsKnR.exe
  2⤵
  PID:13000
- C:\Windows\System\cTAuXdc.exe
  C:\Windows\System\cTAuXdc.exe
  2⤵
  PID:13048
- C:\Windows\System\XLDDzvN.exe
  C:\Windows\System\XLDDzvN.exe
  2⤵
  PID:13104
- C:\Windows\System\CtTnJop.exe
  C:\Windows\System\CtTnJop.exe
  2⤵
  PID:13188
- C:\Windows\System\RQtNNlZ.exe
  C:\Windows\System\RQtNNlZ.exe
  2⤵
  PID:13280
- C:\Windows\System\ZqAglyh.exe
  C:\Windows\System\ZqAglyh.exe
  2⤵
  PID:12304
- C:\Windows\System\TlVMUkr.exe
  C:\Windows\System\TlVMUkr.exe
  2⤵
  PID:12456
- C:\Windows\System\BPuzROz.exe
  C:\Windows\System\BPuzROz.exe
  2⤵
  PID:12556
- C:\Windows\System\rtZbOFU.exe
  C:\Windows\System\rtZbOFU.exe
  2⤵
  PID:12720
- C:\Windows\System\OdeIpbw.exe
  C:\Windows\System\OdeIpbw.exe
  2⤵
  PID:12788
- C:\Windows\System\qhfyXwj.exe
  C:\Windows\System\qhfyXwj.exe
  2⤵
  PID:12952
- C:\Windows\System\wPFcODj.exe
  C:\Windows\System\wPFcODj.exe
  2⤵
  PID:13168
- C:\Windows\System\kttyepz.exe
  C:\Windows\System\kttyepz.exe
  2⤵
  PID:3568
- C:\Windows\System\XihNnXD.exe
  C:\Windows\System\XihNnXD.exe
  2⤵
  PID:12796
- C:\Windows\System\HrVUujv.exe
  C:\Windows\System\HrVUujv.exe
  2⤵
  PID:13056
- C:\Windows\System\VHhbdcf.exe
  C:\Windows\System\VHhbdcf.exe
  2⤵
  PID:12484
- C:\Windows\System\ppgeqgz.exe
  C:\Windows\System\ppgeqgz.exe
  2⤵
  PID:12804
- C:\Windows\System\FhXzmCf.exe
  C:\Windows\System\FhXzmCf.exe
  2⤵
  PID:13328
- C:\Windows\System\NCokpJc.exe
  C:\Windows\System\NCokpJc.exe
  2⤵
  PID:13352
- C:\Windows\System\BOgjFuk.exe
  C:\Windows\System\BOgjFuk.exe
  2⤵
  PID:13376
- C:\Windows\System\EyvxiEw.exe
  C:\Windows\System\EyvxiEw.exe
  2⤵
  PID:13412
- C:\Windows\System\xywWxfZ.exe
  C:\Windows\System\xywWxfZ.exe
  2⤵
  PID:13440
- C:\Windows\System\LEQwQDa.exe
  C:\Windows\System\LEQwQDa.exe
  2⤵
  PID:13468
- C:\Windows\System\pAqcNmp.exe
  C:\Windows\System\pAqcNmp.exe
  2⤵
  PID:13496
- C:\Windows\System\DXludMX.exe
  C:\Windows\System\DXludMX.exe
  2⤵
  PID:13524
- C:\Windows\System\RoKczez.exe
  C:\Windows\System\RoKczez.exe
  2⤵
  PID:13552
- C:\Windows\System\mjfcQru.exe
  C:\Windows\System\mjfcQru.exe
  2⤵
  PID:13580
- C:\Windows\System\SJXvluJ.exe
  C:\Windows\System\SJXvluJ.exe
  2⤵
  PID:13600
- C:\Windows\System\mrxNtdE.exe
  C:\Windows\System\mrxNtdE.exe
  2⤵
  PID:13624
- C:\Windows\System\veQwOdd.exe
  C:\Windows\System\veQwOdd.exe
  2⤵
  PID:13664
- C:\Windows\System\uKvJlvn.exe
  C:\Windows\System\uKvJlvn.exe
  2⤵
  PID:13696
- C:\Windows\System\giTwPcv.exe
  C:\Windows\System\giTwPcv.exe
  2⤵
  PID:13724
- C:\Windows\System\HChNXco.exe
  C:\Windows\System\HChNXco.exe
  2⤵
  PID:13744
- C:\Windows\System\jstCWLQ.exe
  C:\Windows\System\jstCWLQ.exe
  2⤵
  PID:13780
- C:\Windows\System\EdyXbeP.exe
  C:\Windows\System\EdyXbeP.exe
  2⤵
  PID:13796
- C:\Windows\System\QaRSdEO.exe
  C:\Windows\System\QaRSdEO.exe
  2⤵
  PID:13824
- C:\Windows\System\GGounME.exe
  C:\Windows\System\GGounME.exe
  2⤵
  PID:13840
- C:\Windows\System\JiAPQBt.exe
  C:\Windows\System\JiAPQBt.exe
  2⤵
  PID:13872
- C:\Windows\System\rJkSqIC.exe
  C:\Windows\System\rJkSqIC.exe
  2⤵
  PID:13896
- C:\Windows\System\wctIbXS.exe
  C:\Windows\System\wctIbXS.exe
  2⤵
  PID:13944
- C:\Windows\System\YSEvcfZ.exe
  C:\Windows\System\YSEvcfZ.exe
  2⤵
  PID:13964
- C:\Windows\System\CefgAqg.exe
  C:\Windows\System\CefgAqg.exe
  2⤵
  PID:13992
- C:\Windows\System\hmcROmq.exe
  C:\Windows\System\hmcROmq.exe
  2⤵
  PID:14012
- C:\Windows\System\BvFbLRZ.exe
  C:\Windows\System\BvFbLRZ.exe
  2⤵
  PID:14048
- C:\Windows\System\tExFwdo.exe
  C:\Windows\System\tExFwdo.exe
  2⤵
  PID:14068
- C:\Windows\System\SXQYXdM.exe
  C:\Windows\System\SXQYXdM.exe
  2⤵
  PID:14096
- C:\Windows\System\UwWOtmn.exe
  C:\Windows\System\UwWOtmn.exe
  2⤵
  PID:14112
- C:\Windows\System\MCYTHUA.exe
  C:\Windows\System\MCYTHUA.exe
  2⤵
  PID:14172
- C:\Windows\System\OXwfNzH.exe
  C:\Windows\System\OXwfNzH.exe
  2⤵
  PID:14192
- C:\Windows\System\LZOOWjF.exe
  C:\Windows\System\LZOOWjF.exe
  2⤵
  PID:14220
- C:\Windows\System\Bcyyypl.exe
  C:\Windows\System\Bcyyypl.exe
  2⤵
  PID:14244
- C:\Windows\System\UsyDMds.exe
  C:\Windows\System\UsyDMds.exe
  2⤵
  PID:14268
- C:\Windows\System\DOelkuA.exe
  C:\Windows\System\DOelkuA.exe
  2⤵
  PID:14308
- C:\Windows\System\YfRRCtK.exe
  C:\Windows\System\YfRRCtK.exe
  2⤵
  PID:13320
- C:\Windows\System\tBliTle.exe
  C:\Windows\System\tBliTle.exe
  2⤵
  PID:13364
- C:\Windows\System\PtsQsMG.exe
  C:\Windows\System\PtsQsMG.exe
  2⤵
  PID:13432
- C:\Windows\System\ZtSBuAR.exe
  C:\Windows\System\ZtSBuAR.exe
  2⤵
  PID:13480
- C:\Windows\System\eyDqZRf.exe
  C:\Windows\System\eyDqZRf.exe
  2⤵
  PID:13544
- C:\Windows\System\BftgMZx.exe
  C:\Windows\System\BftgMZx.exe
  2⤵
  PID:13612
- C:\Windows\System\EOCGjhn.exe
  C:\Windows\System\EOCGjhn.exe
  2⤵
  PID:13688
- C:\Windows\System\UHlQyGN.exe
  C:\Windows\System\UHlQyGN.exe
  2⤵
  PID:13740
- C:\Windows\System\lejgnTe.exe
  C:\Windows\System\lejgnTe.exe
  2⤵
  PID:13792
- C:\Windows\System\ffjwWIv.exe
  C:\Windows\System\ffjwWIv.exe
  2⤵
  PID:13888
- C:\Windows\System\YeDHZua.exe
  C:\Windows\System\YeDHZua.exe
  2⤵
  PID:13960
- C:\Windows\System\ChdpXSI.exe
  C:\Windows\System\ChdpXSI.exe
  2⤵
  PID:14004
- C:\Windows\System\PVhOKPn.exe
  C:\Windows\System\PVhOKPn.exe
  2⤵
  PID:14060
- C:\Windows\System\jxEtlQw.exe
  C:\Windows\System\jxEtlQw.exe
  2⤵
  PID:14132
- C:\Windows\System\BicsEOa.exe
  C:\Windows\System\BicsEOa.exe
  2⤵
  PID:14208
- C:\Windows\System\lzjsEtp.exe
  C:\Windows\System\lzjsEtp.exe
  2⤵
  PID:14284
- C:\Windows\System\GPAMmpp.exe
  C:\Windows\System\GPAMmpp.exe
  2⤵
  PID:14332
- C:\Windows\System\EDmDnFJ.exe
  C:\Windows\System\EDmDnFJ.exe
  2⤵
  PID:13464
- C:\Windows\System\OWbvcgs.exe
  C:\Windows\System\OWbvcgs.exe
  2⤵
  PID:13640
- C:\Windows\System\qASAENQ.exe
  C:\Windows\System\qASAENQ.exe
  2⤵
  PID:13832
- C:\Windows\System\nFKbdSH.exe
  C:\Windows\System\nFKbdSH.exe
  2⤵
  PID:13952
- C:\Windows\System\ruPrYZW.exe
  C:\Windows\System\ruPrYZW.exe
  2⤵
  PID:14064
- C:\Windows\System\iJNMFLE.exe
  C:\Windows\System\iJNMFLE.exe
  2⤵
  PID:14204
- C:\Windows\System\cLwejOA.exe
  C:\Windows\System\cLwejOA.exe
  2⤵
  PID:13396
- C:\Windows\System\aVeLIOP.exe
  C:\Windows\System\aVeLIOP.exe
  2⤵
  PID:13764
- C:\Windows\System\PErcmcU.exe
  C:\Windows\System\PErcmcU.exe
  2⤵
  PID:14032
- C:\Windows\System\GQQWxVO.exe
  C:\Windows\System\GQQWxVO.exe
  2⤵
  PID:13596
- C:\Windows\System\DNeMYpt.exe
  C:\Windows\System\DNeMYpt.exe
  2⤵
  PID:14236
- C:\Windows\System\haFOSUB.exe
  C:\Windows\System\haFOSUB.exe
  2⤵
  PID:14356
- C:\Windows\System\FmuUHzQ.exe
  C:\Windows\System\FmuUHzQ.exe
  2⤵
  PID:14372
- C:\Windows\System\sAKRsQf.exe
  C:\Windows\System\sAKRsQf.exe
  2⤵
  PID:14388
- C:\Windows\System\jAkLElT.exe
  C:\Windows\System\jAkLElT.exe
  2⤵
  PID:14440
- C:\Windows\System\DEvHoVc.exe
  C:\Windows\System\DEvHoVc.exe
  2⤵
  PID:14456
- C:\Windows\System\yqKnyeo.exe
  C:\Windows\System\yqKnyeo.exe
  2⤵
  PID:14480
- C:\Windows\System\GNfIIga.exe
  C:\Windows\System\GNfIIga.exe
  2⤵
  PID:14508
- C:\Windows\System\GFgWvud.exe
  C:\Windows\System\GFgWvud.exe
  2⤵
  PID:14540
- C:\Windows\System\ygrMnlI.exe
  C:\Windows\System\ygrMnlI.exe
  2⤵
  PID:14568
- C:\Windows\System\kjBliiL.exe
  C:\Windows\System\kjBliiL.exe
  2⤵
  PID:14596
- C:\Windows\System\MpZkaLo.exe
  C:\Windows\System\MpZkaLo.exe
  2⤵
  PID:14624
- C:\Windows\System\XMFIUjj.exe
  C:\Windows\System\XMFIUjj.exe
  2⤵
  PID:14652
- C:\Windows\System\aZOeEyn.exe
  C:\Windows\System\aZOeEyn.exe
  2⤵
  PID:14692
- C:\Windows\System\hfeKlzm.exe
  C:\Windows\System\hfeKlzm.exe
  2⤵
  PID:14720
- C:\Windows\System\FSDyBTk.exe
  C:\Windows\System\FSDyBTk.exe
  2⤵
  PID:14748
- C:\Windows\System\LxMSlHj.exe
  C:\Windows\System\LxMSlHj.exe
  2⤵
  PID:14776
- C:\Windows\System\JVgqFoW.exe
  C:\Windows\System\JVgqFoW.exe
  2⤵
  PID:14804
- C:\Windows\System\tGecPPm.exe
  C:\Windows\System\tGecPPm.exe
  2⤵
  PID:14832
- C:\Windows\System\VrWLTnU.exe
  C:\Windows\System\VrWLTnU.exe
  2⤵
  PID:14860
- C:\Windows\System\QRWtIIJ.exe
  C:\Windows\System\QRWtIIJ.exe
  2⤵
  PID:14888
- C:\Windows\System\OdHrXBQ.exe
  C:\Windows\System\OdHrXBQ.exe
  2⤵
  PID:14904
- C:\Windows\System\ToETtbP.exe
  C:\Windows\System\ToETtbP.exe
  2⤵
  PID:14932
- C:\Windows\System\SadYUdu.exe
  C:\Windows\System\SadYUdu.exe
  2⤵
  PID:14948
- C:\Windows\System\CufRNpX.exe
  C:\Windows\System\CufRNpX.exe
  2⤵
  PID:14976
- C:\Windows\System\RBLAPrY.exe
  C:\Windows\System\RBLAPrY.exe
  2⤵
  PID:15004
- C:\Windows\System\ZItfiZO.exe
  C:\Windows\System\ZItfiZO.exe
  2⤵
  PID:15036
- C:\Windows\System\mzHJPhk.exe
  C:\Windows\System\mzHJPhk.exe
  2⤵
  PID:15084
- C:\Windows\System\ZlyQRYg.exe
  C:\Windows\System\ZlyQRYg.exe
  2⤵
  PID:15112
- C:\Windows\System\DTRgUSO.exe
  C:\Windows\System\DTRgUSO.exe
  2⤵
  PID:15132
- C:\Windows\System\FcwOzkO.exe
  C:\Windows\System\FcwOzkO.exe
  2⤵
  PID:15160
- C:\Windows\System\wEcrXTZ.exe
  C:\Windows\System\wEcrXTZ.exe
  2⤵
  PID:15176
- C:\Windows\System\ImxUktE.exe
  C:\Windows\System\ImxUktE.exe
  2⤵
  PID:15224
- C:\Windows\System\asKPnNW.exe
  C:\Windows\System\asKPnNW.exe
  2⤵
  PID:15244
- C:\Windows\System\aMzCeDN.exe
  C:\Windows\System\aMzCeDN.exe
  2⤵
  PID:15280
- C:\Windows\System\dPfCeEs.exe
  C:\Windows\System\dPfCeEs.exe
  2⤵
  PID:15300
- C:\Windows\System\rQrzoww.exe
  C:\Windows\System\rQrzoww.exe
  2⤵
  PID:15320
- C:\Windows\System\rPitvjU.exe
  C:\Windows\System\rPitvjU.exe
  2⤵
  PID:15348
- C:\Windows\System\kMMopLX.exe
  C:\Windows\System\kMMopLX.exe
  2⤵
  PID:14368
- C:\Windows\System\ExcbAPo.exe
  C:\Windows\System\ExcbAPo.exe
  2⤵
  PID:14448
- C:\Windows\System\PNGOAUd.exe
  C:\Windows\System\PNGOAUd.exe
  2⤵
  PID:14500
- C:\Windows\System\YyYfYNI.exe
  C:\Windows\System\YyYfYNI.exe
  2⤵
  PID:14564
- C:\Windows\System\QsbKtqr.exe
  C:\Windows\System\QsbKtqr.exe
  2⤵
  PID:14648
- C:\Windows\System\iEWqIlE.exe
  C:\Windows\System\iEWqIlE.exe
  2⤵
  PID:14704
- C:\Windows\System\VafNpqn.exe
  C:\Windows\System\VafNpqn.exe
  2⤵
  PID:14760
- C:\Windows\System\SOFIcSh.exe
  C:\Windows\System\SOFIcSh.exe
  2⤵
  PID:14796
- C:\Windows\System\QdSqdJD.exe
  C:\Windows\System\QdSqdJD.exe
  2⤵
  PID:14856
- C:\Windows\System\XHBjSLg.exe
  C:\Windows\System\XHBjSLg.exe
  2⤵
  PID:14924
- C:\Windows\System\bWycKNW.exe
  C:\Windows\System\bWycKNW.exe
  2⤵
  PID:14960
- C:\Windows\System\MkhkiXE.exe
  C:\Windows\System\MkhkiXE.exe
  2⤵
  PID:15000
- C:\Windows\System\JNXBfZX.exe
  C:\Windows\System\JNXBfZX.exe
  2⤵
  PID:15068
- C:\Windows\System\bIEmgPF.exe
  C:\Windows\System\bIEmgPF.exe
  2⤵
  PID:15204
- C:\Windows\System\RipHAzW.exe
  C:\Windows\System\RipHAzW.exe
  2⤵
  PID:15272
- C:\Windows\System\wVVreQk.exe
  C:\Windows\System\wVVreQk.exe
  2⤵
  PID:15340
- C:\Windows\System\MgUHyfM.exe
  C:\Windows\System\MgUHyfM.exe
  2⤵
  PID:14464
- C:\Windows\System\QzZnuis.exe
  C:\Windows\System\QzZnuis.exe
  2⤵
  PID:14532
- C:\Windows\System\CdxTIMA.exe
  C:\Windows\System\CdxTIMA.exe
  2⤵
  PID:14880
- C:\Windows\System\nUiXqwE.exe
  C:\Windows\System\nUiXqwE.exe
  2⤵
  PID:15028
- C:\Windows\System\pdMuYig.exe
  C:\Windows\System\pdMuYig.exe
  2⤵
  PID:15168
- C:\Windows\System\CfxkuyC.exe
  C:\Windows\System\CfxkuyC.exe
  2⤵
  PID:15292
- C:\Windows\System\AiCkNQq.exe
  C:\Windows\System\AiCkNQq.exe
  2⤵
  PID:14588
- C:\Windows\System\pijJARn.exe
  C:\Windows\System\pijJARn.exe
  2⤵
  PID:14844
- C:\Windows\System\OUMkbGr.exe
  C:\Windows\System\OUMkbGr.exe
  2⤵
  PID:14992
- C:\Windows\System\ondMNaM.exe
  C:\Windows\System\ondMNaM.exe
  2⤵
  PID:14676
- C:\Windows\System\hvCIVHO.exe
  C:\Windows\System\hvCIVHO.exe
  2⤵
  PID:14340
- C:\Windows\System\frgWjdA.exe
  C:\Windows\System\frgWjdA.exe
  2⤵
  PID:15388
- C:\Windows\System\yFZzUFU.exe
  C:\Windows\System\yFZzUFU.exe
  2⤵
  PID:15428
- C:\Windows\System\anPJkxD.exe
  C:\Windows\System\anPJkxD.exe
  2⤵
  PID:15444
- C:\Windows\System\nOcSFIc.exe
  C:\Windows\System\nOcSFIc.exe
  2⤵
  PID:15472
- C:\Windows\System\azWzmEq.exe
  C:\Windows\System\azWzmEq.exe
  2⤵
  PID:15508
- C:\Windows\System\tvYjgnr.exe
  C:\Windows\System\tvYjgnr.exe
  2⤵
  PID:15540
- C:\Windows\System\LJWrFXD.exe
  C:\Windows\System\LJWrFXD.exe
  2⤵
  PID:15556
- C:\Windows\System\yGgdoXX.exe
  C:\Windows\System\yGgdoXX.exe
  2⤵
  PID:15576
- C:\Windows\System\GcAOwvl.exe
  C:\Windows\System\GcAOwvl.exe
  2⤵
  PID:15604
- C:\Windows\System\muggSCz.exe
  C:\Windows\System\muggSCz.exe
  2⤵
  PID:15668
- C:\Windows\System\apuncuQ.exe
  C:\Windows\System\apuncuQ.exe
  2⤵
  PID:15688
- C:\Windows\System\TBKoXes.exe
  C:\Windows\System\TBKoXes.exe
  2⤵
  PID:15716
- C:\Windows\System\iuRYFDV.exe
  C:\Windows\System\iuRYFDV.exe
  2⤵
  PID:15744
- C:\Windows\System\QxoUGNr.exe
  C:\Windows\System\QxoUGNr.exe
  2⤵
  PID:15768
- C:\Windows\System\ONNUFKQ.exe
  C:\Windows\System\ONNUFKQ.exe
  2⤵
  PID:15800
- C:\Windows\System\FOMhuyZ.exe
  C:\Windows\System\FOMhuyZ.exe
  2⤵
  PID:15824
- C:\Windows\System\iaimdou.exe
  C:\Windows\System\iaimdou.exe
  2⤵
  PID:15856
- C:\Windows\System\blvohgV.exe
  C:\Windows\System\blvohgV.exe
  2⤵
  PID:15884
- C:\Windows\System\gRymMBX.exe
  C:\Windows\System\gRymMBX.exe
  2⤵
  PID:15920
- C:\Windows\System\IMjSijz.exe
  C:\Windows\System\IMjSijz.exe
  2⤵
  PID:15956
- C:\Windows\System\cDzpcwL.exe
  C:\Windows\System\cDzpcwL.exe
  2⤵
  PID:15988
- C:\Windows\System\KYDyttp.exe
  C:\Windows\System\KYDyttp.exe
  2⤵
  PID:16016
- C:\Windows\System\lWCwDbm.exe
  C:\Windows\System\lWCwDbm.exe
  2⤵
  PID:16040
- C:\Windows\System\IhPeNKE.exe
  C:\Windows\System\IhPeNKE.exe
  2⤵
  PID:16060
- C:\Windows\System\yBGhSut.exe
  C:\Windows\System\yBGhSut.exe
  2⤵
  PID:16120
- C:\Windows\System\tMMspBj.exe
  C:\Windows\System\tMMspBj.exe
  2⤵
  PID:16152
- C:\Windows\System\qjUMYWd.exe
  C:\Windows\System\qjUMYWd.exe
  2⤵
  PID:16168
- C:\Windows\System\gWOAXqx.exe
  C:\Windows\System\gWOAXqx.exe
  2⤵
  PID:16204
- C:\Windows\System\VtcLDkv.exe
  C:\Windows\System\VtcLDkv.exe
  2⤵
  PID:16224
- C:\Windows\System\JkZrqfF.exe
  C:\Windows\System\JkZrqfF.exe
  2⤵
  PID:16240
- C:\Windows\System\LcRTWad.exe
  C:\Windows\System\LcRTWad.exe
  2⤵
  PID:16284
- C:\Windows\System\CnIgfvt.exe
  C:\Windows\System\CnIgfvt.exe
  2⤵
  PID:16308
- C:\Windows\System\ULqyERg.exe
  C:\Windows\System\ULqyERg.exe
  2⤵
  PID:16340
- C:\Windows\System\LNRwUax.exe
  C:\Windows\System\LNRwUax.exe
  2⤵
  PID:16376
- C:\Windows\System\YytWcit.exe
  C:\Windows\System\YytWcit.exe
  2⤵
  PID:15368
- C:\Windows\System\hKEXIAa.exe
  C:\Windows\System\hKEXIAa.exe
  2⤵
  PID:15412
- C:\Windows\System\SKBVeqh.exe
  C:\Windows\System\SKBVeqh.exe
  2⤵
  PID:15516
- C:\Windows\System\hEAaIjd.exe
  C:\Windows\System\hEAaIjd.exe
  2⤵
  PID:15564
- C:\Windows\System\SISivao.exe
  C:\Windows\System\SISivao.exe
  2⤵
  PID:15620
- C:\Windows\System\ZKjvELt.exe
  C:\Windows\System\ZKjvELt.exe
  2⤵
  PID:15712
- C:\Windows\System\ByENjXn.exe
  C:\Windows\System\ByENjXn.exe
  2⤵
  PID:15776
- C:\Windows\System\RsXvpYx.exe
  C:\Windows\System\RsXvpYx.exe
  2⤵
  PID:15816
- C:\Windows\System\TSSTWfs.exe
  C:\Windows\System\TSSTWfs.exe
  2⤵
  PID:15928
- C:\Windows\System\Yxxvxlu.exe
  C:\Windows\System\Yxxvxlu.exe
  2⤵
  PID:15916
- C:\Windows\System\wEVrlyB.exe
  C:\Windows\System\wEVrlyB.exe
  2⤵
  PID:16008
- C:\Windows\System\YSAkMsQ.exe
  C:\Windows\System\YSAkMsQ.exe
  2⤵
  PID:16052
- C:\Windows\System\bbbWpoO.exe
  C:\Windows\System\bbbWpoO.exe
  2⤵
  PID:16140
- C:\Windows\System\tmZPQYA.exe
  C:\Windows\System\tmZPQYA.exe
  2⤵
  PID:16200
- C:\Windows\System\pohXbmX.exe
  C:\Windows\System\pohXbmX.exe
  2⤵
  PID:16304
- C:\Windows\System\XLrpCbC.exe
  C:\Windows\System\XLrpCbC.exe
  2⤵
  PID:16364
- C:\Windows\System\IGMdgSa.exe
  C:\Windows\System\IGMdgSa.exe
  2⤵
  PID:15384
- C:\Windows\System\WFmQECx.exe
  C:\Windows\System\WFmQECx.exe
  2⤵
  PID:15524
- C:\Windows\System\CmglpMK.exe
  C:\Windows\System\CmglpMK.exe
  2⤵
  PID:15752
- C:\Windows\System\SOdwmwF.exe
  C:\Windows\System\SOdwmwF.exe
  2⤵
  PID:15844
- C:\Windows\System\jqOSqYD.exe
  C:\Windows\System\jqOSqYD.exe
  2⤵
  PID:16104
- C:\Windows\System\yNmWHso.exe
  C:\Windows\System\yNmWHso.exe
  2⤵
  PID:16116
- C:\Windows\System\mDhxrYm.exe
  C:\Windows\System\mDhxrYm.exe
  2⤵
  PID:16352
- C:\Windows\System\ISXhScC.exe
  C:\Windows\System\ISXhScC.exe
  2⤵
  PID:15676
- C:\Windows\System\qtEhPaG.exe
  C:\Windows\System\qtEhPaG.exe
  2⤵
  PID:16048
- C:\Windows\System\qNIPwxy.exe
  C:\Windows\System\qNIPwxy.exe
  2⤵
  PID:16092
- C:\Windows\System\dlTevNP.exe
  C:\Windows\System\dlTevNP.exe
  2⤵
  PID:15908
- C:\Windows\System\TJFScPc.exe
  C:\Windows\System\TJFScPc.exe
  2⤵
  PID:16408
- C:\Windows\System\eIrNrXa.exe
  C:\Windows\System\eIrNrXa.exe
  2⤵
  PID:16428
- C:\Windows\System\czsodZr.exe
  C:\Windows\System\czsodZr.exe
  2⤵
  PID:16444
- C:\Windows\System\cUaDpsF.exe
  C:\Windows\System\cUaDpsF.exe
  2⤵
  PID:16464
- C:\Windows\System\DVWiocs.exe
  C:\Windows\System\DVWiocs.exe
  2⤵
  PID:16512
- C:\Windows\System\emclIPl.exe
  C:\Windows\System\emclIPl.exe
  2⤵
  PID:16540
- C:\Windows\System\vohiQty.exe
  C:\Windows\System\vohiQty.exe
  2⤵
  PID:16564
- C:\Windows\System\CUYGSqv.exe
  C:\Windows\System\CUYGSqv.exe
  2⤵
  PID:16592
- C:\Windows\System\yNhAfyA.exe
  C:\Windows\System\yNhAfyA.exe
  2⤵
  PID:16620
- C:\Windows\System\FrvkGCT.exe
  C:\Windows\System\FrvkGCT.exe
  2⤵
  PID:16648
- C:\Windows\System\HRqsohU.exe
  C:\Windows\System\HRqsohU.exe
  2⤵
  PID:16668
- C:\Windows\System\IVcdxOx.exe
  C:\Windows\System\IVcdxOx.exe
  2⤵
  PID:16724
- C:\Windows\System\cvoDFRj.exe
  C:\Windows\System\cvoDFRj.exe
  2⤵
  PID:16744
- C:\Windows\System\dNgHazv.exe
  C:\Windows\System\dNgHazv.exe
  2⤵
  PID:16784
- C:\Windows\System\JuNJiXG.exe
  C:\Windows\System\JuNJiXG.exe
  2⤵
  PID:16808
- C:\Windows\System\qNCZUZC.exe
  C:\Windows\System\qNCZUZC.exe
  2⤵
  PID:16828
- C:\Windows\System\FGqvLxh.exe
  C:\Windows\System\FGqvLxh.exe
  2⤵
  PID:16860
- C:\Windows\System\RtAFotY.exe
  C:\Windows\System\RtAFotY.exe
  2⤵
  PID:16892
- C:\Windows\System\vomLVhC.exe
  C:\Windows\System\vomLVhC.exe
  2⤵
  PID:16920
- C:\Windows\System\RMAYOlD.exe
  C:\Windows\System\RMAYOlD.exe
  2⤵
  PID:16948
- C:\Windows\System\JySPOxH.exe
  C:\Windows\System\JySPOxH.exe
  2⤵
  PID:16964
- C:\Windows\System\qXaNDCE.exe
  C:\Windows\System\qXaNDCE.exe
  2⤵
  PID:16988
- C:\Windows\System\vzxTZwf.exe
  C:\Windows\System\vzxTZwf.exe
  2⤵
  PID:17020
- C:\Windows\System\ODZPMYZ.exe
  C:\Windows\System\ODZPMYZ.exe
  2⤵
  PID:17048
- C:\Windows\System\ckyVFAg.exe
  C:\Windows\System\ckyVFAg.exe
  2⤵
  PID:17064
- C:\Windows\System\gcBeRRx.exe
  C:\Windows\System\gcBeRRx.exe
  2⤵
  PID:17080
- C:\Windows\System\StgmLIq.exe
  C:\Windows\System\StgmLIq.exe
  2⤵
  PID:17120
- C:\Windows\System\KIJDJPo.exe
  C:\Windows\System\KIJDJPo.exe
  2⤵
  PID:17144
- C:\Windows\System\SWUVDoe.exe
  C:\Windows\System\SWUVDoe.exe
  2⤵
  PID:17172
- C:\Windows\System\VXBYRmM.exe
  C:\Windows\System\VXBYRmM.exe
  2⤵
  PID:17196
- C:\Windows\System\Rfutiqn.exe
  C:\Windows\System\Rfutiqn.exe
  2⤵
  PID:17228
- C:\Windows\System\zOcWNlJ.exe
  C:\Windows\System\zOcWNlJ.exe
  2⤵
  PID:17284
- C:\Windows\System\UpBxCdL.exe
  C:\Windows\System\UpBxCdL.exe
  2⤵
  PID:17332
- C:\Windows\System\kuYVjFQ.exe
  C:\Windows\System\kuYVjFQ.exe
  2⤵
  PID:17360
- C:\Windows\System\ZDADXty.exe
  C:\Windows\System\ZDADXty.exe
  2⤵
  PID:17384
- C:\Windows\System\UXKaWvU.exe
  C:\Windows\System\UXKaWvU.exe
  2⤵
  PID:15460
- C:\Windows\System\URsuIMY.exe
  C:\Windows\System\URsuIMY.exe
  2⤵
  PID:16424
- C:\Windows\System\NQNDyRX.exe
  C:\Windows\System\NQNDyRX.exe
  2⤵
  PID:16504
- C:\Windows\System\sTPzSnF.exe
  C:\Windows\System\sTPzSnF.exe
  2⤵
  PID:16940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
1⤵
PID:7108

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 808 -i 808 -h 368 -j 408 -s 448 -d 0
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:17188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AMfKMWV.exe

Path C:\Windows\System\AMfKMWV.exe
Size 1.8MB
SHA256 d3e81ed10ca359dae09d202397632d54ff7bc3a4e20a38a60432485b2f6a9ff8
MD5 ceb63af72c131e18f9423978baebd283
SHA1 684138ee53cdc26e1d9332d923c23f93e9a122c7
SHA512 6188f356fb5a3b9fb4429491a41b2e92ff9cb2850539bc9df5999a8f8bb0ae5d064e7c17fbb1bd01f270d421935ab89be1602498f2f83dfba45b0067b72981fd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8T:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

BgAuqOW.exe

Path C:\Windows\System\BgAuqOW.exe
Size 1.8MB
SHA256 119b12e281270c5a66d0fd1642dbfaa656fed601ecc1d8d349414e0181dd230c
MD5 aa51979192428a25d8cce324ef777865
SHA1 83af5a3e6cd560ed72d68d0504a0ce967283b895
SHA512 c93076a67ceb0be423b0d486abfb6cb7d4b22b6ea1e73d394c06fa0c46118a0bb1892ca8e3364e8a841c4d8b94e13b0e63fef0c10cb024f6118d12b72d532e48
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER81:GemTLkNdfE0pZaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

CEBoYbk.exe

Path C:\Windows\System\CEBoYbk.exe
Size 1.8MB
SHA256 687f81f12644417c128bc34942b8e00b768bf61e31165435c57dde2e793cb4e4
MD5 77e26e73f421a94a5ec46410b0c8be43
SHA1 e8514f0edac4e518f981177d19a3c7f907e9aa33
SHA512 e81c12abf3f7eee02c0790dde7bf2aebf0da07005f212cbcd2dcfea55c2d97b47bb4ae3af7915b10d16ac6ebd709b8459490c0246c1201ed9a08c1ca5ee80b6e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8Q:GemTLkNdfE0pZau
MD5 SHA1 SHA512 SSDEEP

Submit Download

EQCQnpO.exe

Path C:\Windows\System\EQCQnpO.exe
Size 1.8MB
SHA256 2356742388534c97713d6e05a285204ea7b88a5b609f4ab9329e36976304f62b
MD5 c2d79e3e599fadd662736f345c57c03b
SHA1 06619970aa6fa07d3a02d8ef1908b78f682ea54a
SHA512 6d983d56855d5624ef7f6d772d7dec5c3179624040ae8a8e943ea4589c5764a6510e482ef5a1df287faea8bdefe9f177d0cf607898262e6aa370dd7dcd0c84b4
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8c:GemTLkNdfE0pZa+
MD5 SHA1 SHA512 SSDEEP

Submit Download

HrPdpmZ.exe

Path C:\Windows\System\HrPdpmZ.exe
Size 1.8MB
SHA256 916887b5f032afdca169cbb9347ca3c0943769df1b61be6aede2f3c95d152212
MD5 dc053d47385be179b392f29d07a94e7b
SHA1 b991ee03b99f1c7e6918fd6ede8c4373892529f8
SHA512 5c6eeacfef3a5d40a8e3823c761703858de84112f636d69ef46fb490390bfc3c5dfd45c8b6d2c19de605a25515a87db6eaf06eb55323a72101d8cb28be203d16
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8f:GemTLkNdfE0pZa1
MD5 SHA1 SHA512 SSDEEP

Submit Download

IJPEqJC.exe

Path C:\Windows\System\IJPEqJC.exe
Size 1.8MB
SHA256 387488286a876230255f671c1b25b2eea77e05aedaa5cde464b42628f52abf51
MD5 5eef87e5b5c82e4773a64b4fdbd736c8
SHA1 72bee8dd3805698356a6618f9da05055ecb6b316
SHA512 3d7a85ac1d016a935c4f4ff63cd1e311e180219cd825ac2791c3eda4dc1eb2a06f943e7fb2890329f1ddd0f2faab63a9fa0bb46843c560afe0e373a6216c21bc
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8h:GemTLkNdfE0pZaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

IricjvV.exe

Path C:\Windows\System\IricjvV.exe
Size 1.8MB
SHA256 f3a05b170b295da288e4817c02bad6d56969a9ad0cf98e130b891f604f8ffa6e
MD5 b158b74f2ccb07a2f98774564b5a883e
SHA1 a47b20c001cb0a5088dcfe2b74fba7baa99b6b84
SHA512 7c396836a71e560dfbadf40abba72428b3875d69f80d2b76ecc2f2590db807161c00ba97bb7f4cd755663ea2410e22080f5feb16f264d42d02a575025a93ceac
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8W:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

LtjJuEY.exe

Path C:\Windows\System\LtjJuEY.exe
Size 1.8MB
SHA256 c9f01b89a0ac16717a4e0525c256792dd1a8c264ac5aae1c144a58f7abb01a72
MD5 7a39bf6929f8666227bd99f9b408ffc8
SHA1 0cfd38bc99671ab3b3b3ce99b8fac448b6233be9
SHA512 ea4ae16a7028dbb7307f6c97ede09a7980823a52a9f31d9bebacc9b4a75f176910a992f182e2aec47322b1624f1c5b642bcd08a3e9f4effd44dfc8ea669439fb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8d:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MrwFGLW.exe

Path C:\Windows\System\MrwFGLW.exe
Size 1.8MB
SHA256 3c5d16d0f6f65a232c290adfa5db5c41a212bac826e3fb389bc42e6288d6fac7
MD5 931b39453a3da01a91ef04c36f50e918
SHA1 5905d43827a81a04d4f6fb659ffd9ab5c1937cbc
SHA512 a18c52dec613460ebfba4273c1871f5dd407a4a5c5dbc5c6a6a7fda6e33bf3ed1e0865edce66c0c3fa22e0b66d45f9b34d7e02976435cad88bae1416b28b35a8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8G:GemTLkNdfE0pZaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

PJJGdAd.exe

Path C:\Windows\System\PJJGdAd.exe
Size 1.8MB
SHA256 c38eb6772407eff39fc7f35507b4a6533bcda378bb1fb2a0b88893689dda27bc
MD5 bb4533a2e98ec7ae7300c87cb8cf8ce6
SHA1 f3b5b73de33907e75ef49a3e16811bfb79b518d1
SHA512 c62f8d4a0bf3c73425c3e2910e0e58a8f69d4dbf855df60accdaeb18cd435b0cdfd10f4010994b25a4de5e06ab464d320a49e80cc99c8ac22b04f770cb175aa6
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8H:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

RiLXTFB.exe

Path C:\Windows\System\RiLXTFB.exe
Size 1.8MB
SHA256 f90f0b8b06b642494c75866d2aac062e6594bcf2b6f596a04eecd00184f99f66
MD5 40d70df3ce668279b2beca6441201daf
SHA1 7e0ad1ff3ea6392c04ea4d996e5fa74947088498
SHA512 ce7b0ee86dc2f41f5133f71a73a8064382b9b0617a22c9e318f19167d681c6b6e3e842df233efd6aaacae2473ab7d9560d23c84001bfb3eef30f37e446fe911d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8B:GemTLkNdfE0pZa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

RzGShkW.exe

Path C:\Windows\System\RzGShkW.exe
Size 1.8MB
SHA256 776bfc97b2e85d33a66e77366edea0e9a377e0e36b72209c33ae054c54376759
MD5 1a664d95c4cb7338c674eba65e70a497
SHA1 5662d05300ec990ab29cf5fd9600be98f68a1e09
SHA512 d3cc887082d6196730276ba528073134436efa7684f8ee6e91df3b324842c47f57a2b7ab1cf553313cd76f8ad4d4fba7aa8e54bb326964890daafbc9574b5242
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER83:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

SIrZPTf.exe

Path C:\Windows\System\SIrZPTf.exe
Size 1.8MB
SHA256 19a49ff2d53aa0700ddc48459ddbe42c94d21328f844050a9fe97b55372bd316
MD5 88e5e1fbf91894e2a06b8e2105c0abe1
SHA1 14cc028cc46d6926195ced7c32ad74bb479370b1
SHA512 c2c5864beb0b1ce887fdd3836ac3d73448a9bda6003bf8f96f58f8a7be7f39a35086d743a4a254b203e3acc588a164bfd4950e8c78ff401dd11775cbd3f94238
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8m:GemTLkNdfE0pZa8
MD5 SHA1 SHA512 SSDEEP

Submit Download

WZyqnOc.exe

Path C:\Windows\System\WZyqnOc.exe
Size 1.8MB
SHA256 1c6141d11c513ae1591a231e8cd99ce1e21be11d9b396c09f41eadf54ba88306
MD5 b08fa9aac8e67dcc77ba6295384305c7
SHA1 dcb336c5a931a72c6145f0357359b56a7b054483
SHA512 bf3f78715a1e998400ec335f4c22407b815e4b4066b552b76f37a967fd1720ae9151193f84d959a59bc3bcd2bbc285a1f74f32d5bb50d82f7c87a0c4be0089bd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8r:GemTLkNdfE0pZad
MD5 SHA1 SHA512 SSDEEP

Submit Download

XKRUkaL.exe

Path C:\Windows\System\XKRUkaL.exe
Size 1.8MB
SHA256 a5c18a70e481f22a53402055d387f286acf77447a83f85fbdc61f572a283cbfa
MD5 d1528e0fc4c7fdb579f12e35150c0102
SHA1 118c7a1e126d2257b0f5e1f841e3b5d25ed7e315
SHA512 2b31871b98ed726715a79c7620df80ecba20df846ea5f4ea5b9ad35207547289af0b5ed99dde7801a6d7d8404f41d2223224717216a2c5e3e027d62a3a819915
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER80J:GemTLkNdfE0pZas
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZQMghaD.exe

Path C:\Windows\System\ZQMghaD.exe
Size 1.8MB
SHA256 0091bc726bf47a57f8dc975c779082f77ed1bf1f9b9835f80d5892948cd6d1a8
MD5 8fa96fec1bb253216671a69ef8f6f3a1
SHA1 d0f62f4aae583736894db78a0715d771898dfab6
SHA512 e8c58b0492bae3c989460b02fa3df67ec694f88e6983f5dc47336e785560e94f226c74b09c40963ffb1c788b5b5c1370c55d73d6498b6d23995c059d6e995b3e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8s:GemTLkNdfE0pZaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZnFCmNS.exe

Path C:\Windows\System\ZnFCmNS.exe
Size 1.8MB
SHA256 cb80a0695f2366350660dc83ee8c8f43a6c902e7fcb779f70e89e2d4b4526f3b
MD5 ae6303ac38c27f87730ffcb3eebc863e
SHA1 ad3fd2ac3329d9bd9815464dadc796dfec4836be
SHA512 f5f537f253c2a020077ff9e181284d3b82d433ee5d1d5fa0e8226cb64c23b1c5f9bc156362802573da48541806c7f41a029ed88bf264b03d2b9e81146785a8cf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8H:GemTLkNdfE0pZaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZxIsrSg.exe

Path C:\Windows\System\ZxIsrSg.exe
Size 1.8MB
SHA256 9c4ac7db407c9ede7f5398d594ea4f1681b00905e8124a7d88c653a2e6f2d790
MD5 27101a0300f2f1ef230fecbcacffdef1
SHA1 448929bd99f293bd0805f427fd6e9a1b254aa590
SHA512 601a291fca369eb861b0564dd3f03b7dd3268b0032a659648e616050de63e7e8aa47a11dc30a4d46580061466d175ae4dbe8751ac782d5a92644ae33fd2f80ac
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8s:GemTLkNdfE0pZam
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZzlQmUT.exe

Path C:\Windows\System\ZzlQmUT.exe
Size 1.8MB
SHA256 649c04d479a34c668cee4bda4f8bc77521cf60619994f5804132e154387f49b6
MD5 b5558e7cd6c1870d8918199fd6430793
SHA1 d73d04093e8be083d4fe2e337f5e63151e72e8ae
SHA512 df0704d4d5b5819b7caad92eb874c2724c6a89b1b4513d00fcc4c676748164f106e1ce5f3a7534826e864f4c1bdfc6c21bd4e7eb300bb90514a4c56fa0987bc3
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8p:GemTLkNdfE0pZaf
MD5 SHA1 SHA512 SSDEEP

Submit Download

dLNgseq.exe

Path C:\Windows\System\dLNgseq.exe
Size 1.8MB
SHA256 f13f1e18abc0543c8f33c5e5cfe51dc6bd8cf29c5e15ac3b034454216b84ec66
MD5 07bc3abc2122c7abcd0b1f8d3dfc241c
SHA1 e4d820bdf1b20c597a272cfb0858e4f34347ecad
SHA512 0c02458a503e0943c72b0218bbdde4e0812476e34e36d4ef3a1003b99913a5832a21593680ff343549cd06a1b618cf1dea4379eb87c96636c9968ec0f042d746
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8R:GemTLkNdfE0pZaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

dqAPYJP.exe

Path C:\Windows\System\dqAPYJP.exe
Size 1.8MB
SHA256 757797ca6d8192c6dea8ee6501e76b3237275051cfc50a33e5fcef5df5c29357
MD5 b392f5557b127f785b935501c2c303e4
SHA1 f5b4693e43f1ab2b33a279bc0bd0fec3fda40fa8
SHA512 43b54b42d93dc0a3f4675651289f967f632c1db058031e9ae536c2281cdbeed743a71ad56fc4eafe26c15549e3cb7409751126492c9d2add1bf89b03079a7f00
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8u:GemTLkNdfE0pZaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

eDQtLco.exe

Path C:\Windows\System\eDQtLco.exe
Size 1.8MB
SHA256 74c17ba6f27767219360bd874bce433277107359e3eb9cc7ac6a184424a0813d
MD5 f4a4711690eda2359d92f2940fdaa23d
SHA1 c86ceaa4f3f7e0142ef30e78c72d89f003a905eb
SHA512 12c92529e0c859163a0bc032f85d2f2f532287f047159a2e4ae3583d36ca882e0342d805bf430a7633fd67231b62a57280884ece128494546d1fbde8037f27eb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER80:GemTLkNdfE0pZam
MD5 SHA1 SHA512 SSDEEP

Submit Download

faTorsZ.exe

Path C:\Windows\System\faTorsZ.exe
Size 1.8MB
SHA256 f3c42dd4dda0abb54e6b78ffa1dc58e187dde37f0bdfc507699e5982e0918d8f
MD5 0dea0a71f82c7f791391fea913e057a5
SHA1 015aa0b9710a45a5b193bc8703d55848158d46c1
SHA512 e7e20315a3705edb5c0d91899e6b2dba6955703db9aee4a986f06e69d2735699e0124f5992013be0c0d4c402c2561d051b4d85bbbcf1983f5d0f0e2d852e4d56
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8r:GemTLkNdfE0pZaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

iLobnHg.exe

Path C:\Windows\System\iLobnHg.exe
Size 1.8MB
SHA256 886b97e1e7ecfc72d82ddb953a299384a741071632d8df09f3df8e830f113b03
MD5 5177dc0b01e4c6bbc726e8f60fed530a
SHA1 e4b8ce1c69c06bbed4398d49431088d01f7dff41
SHA512 8f179b2e2a933694efb54f7dbfe899edc4867f371fa8f7c2aca2db08e39e1b91bd42e6b04731c54f008033516e5218883e325cf9e5244e46647c53b25f5c4367
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER86:GemTLkNdfE0pZaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvwSxWw.exe

Path C:\Windows\System\jvwSxWw.exe
Size 1.8MB
SHA256 f265af83f6a7f9f0639202a319cb43c73a7b8d0ec4d8ef53b1fd01978b8c226e
MD5 23d8316ad3ac9a7e93aa1caad11ef995
SHA1 93c5f34ae3ff40ddee67689b272fffed2efa2f2b
SHA512 a3805d36da9eb867ab8c42db85a6a6f4d1a74bab6c59e324f307a79e81c92c5c94ca93cfcc82da9f8106f5575f57dab7033dfa8bbdce0ee5d685dc7c01d9de36
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER83:GemTLkNdfE0pZaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

kHEqvyI.exe

Path C:\Windows\System\kHEqvyI.exe
Size 1.8MB
SHA256 e06bfb3e8255bd1c37224b95d259eff3c20fb73d5fae08637dd87b0dbd5e6a73
MD5 f1b47e68778487edc5be29784be3fdd1
SHA1 cfd6b001dd69c8527676c1a29a020acd4259c36e
SHA512 ad3f78e7db5a96bc8d651464720f0dccdbf7147aa53e3febbe9e0ce37c80291db87c0f09de87b7840939796a81d0593c7505d2a336488d4bbaa527a8a6af322e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8g:GemTLkNdfE0pZaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

lhGgzBD.exe

Path C:\Windows\System\lhGgzBD.exe
Size 1.8MB
SHA256 3e8e85c4d3f91a678d61491973e3d8b1b94aaa62c6ffadd26dc7288042b96cd1
MD5 426d11e4dcc248e35c700d831fd2092a
SHA1 1b55fce1874bbf62e0c94ea8a638c3072cbd5a1e
SHA512 ed820cf9c2234d63871669b535e481fafad2b36227015c327e5efbe489c8b70b9e6e45c504d520f4a19f105b36299d11e7fc9e541171c769109c903ea2184755
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8W:GemTLkNdfE0pZaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

rbCPUVd.exe

Path C:\Windows\System\rbCPUVd.exe
Size 1.8MB
SHA256 002696d183d4738c0afde756aeaf218d2fe0e60396ef55286dc12eadf3c081ed
MD5 7b46f31555494656c3cd734c24d90e8a
SHA1 e4caa5f1891d3e10fad7875de125c8d2d3caae26
SHA512 28f7e3685ca298e1545ce24cedb3cff245ca548ea458eb0b1b4d07620c57c2e9e4789db748aec81e3088138d576546d9ed2f9829f295f38771201472e16bc066
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8n:GemTLkNdfE0pZaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

tIrHuRW.exe

Path C:\Windows\System\tIrHuRW.exe
Size 1.8MB
SHA256 859e53105642431db594f64e45680331f55d574b1dffe4f7bd291c7cdce9fb0b
MD5 c912132bb0ab552471f6ebc679fbc236
SHA1 4bfe27d743c5976a97f15bbf7d5f96b09e14c33e
SHA512 3ee28f2c79b55819dd6648e32f39851579d19729643e0dc91bc82538bebc178c7719a37a789fe9721e55487bc2b22e393dc43d893992318569ff774284b1da9c
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8S:GemTLkNdfE0pZao
MD5 SHA1 SHA512 SSDEEP

Submit Download

vtczYua.exe

Path C:\Windows\System\vtczYua.exe
Size 1.8MB
SHA256 726bed52e65eb3eb4e771c9ecdf201a4398c50e8539f9489d8b59e497062f68b
MD5 67c7a15f6716b57019ea7e1827f32be4
SHA1 59165f9399d6527cb10001ed26353a1c6191e844
SHA512 2d1f5c4d78df967c7bf8f8ec1b8d974f13d3d2dcff909c4c5a2949a8a98457dc0db93f3a1948553173f237523e73fd3417220fa582608b78bdbcdc3546f27754
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8a:GemTLkNdfE0pZag
MD5 SHA1 SHA512 SSDEEP

Submit Download

xIYScAr.exe

Path C:\Windows\System\xIYScAr.exe
Size 1.8MB
SHA256 decaed0d3c11f7c54ec73202ab92000fe670c221fe8ef746f0b2376d36431c12
MD5 573022e52c563cebb5aa723284458ff2
SHA1 dc6e3d887fec9e1bca0d5a7a08ffaad489bcdc39
SHA512 e913d71e1666f6e8a8ebb192ab315e319be100a637b577bdfe0f9d5113662c694d8f0b0bdc7a869fb51ba7a52892faaf87bd5a7fb51a774a1b82ef9c45919cd5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER82:GemTLkNdfE0pZaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

yCgJkJp.exe

Path C:\Windows\System\yCgJkJp.exe
Size 1.8MB
SHA256 6d70b29c9942775e457fb7bd39ea2f5de7871d6f3cc6a0c482b5f574eca81767
MD5 464a39e1199616f505f5a5351aafee0f
SHA1 2d80565e2f6cbe93586ac3383aa5ed2f14aba43b
SHA512 c076a1a07177547476d22421aa1b222f7ff0ef8787386524025f7a6f137e54cd262ea6cdd90229c6bebf7044df0bbf09cd50bc58de8fff73a19962062091e1ea
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8P:GemTLkNdfE0pZax
MD5 SHA1 SHA512 SSDEEP

Submit Download

yQiVvNo.exe

Path C:\Windows\System\yQiVvNo.exe
Size 1.8MB
SHA256 ffc840ff34a4b8873cbe2ea6f7fdd64fc3eba696e424e465f4759531b82891a8
MD5 a3af0d88e8114e3a942e4b77fc7ae60c
SHA1 1abe781658a6419864cb27f0fb2b8077e44010bd
SHA512 f9c628753d17d0d059ec3a3f904d094662b1d2850a70b29cda1c546c1acc0a382b3b6a9a47364dfb5713590e4345d267769e3d26250381e76020eff162e2feda
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9oztFwIRxj4c5yOBQP4Z5ER8+:GemTLkNdfE0pZaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1584-0-0x00000238C5620000-0x00000238C5630000-memory.dmp

Download