xmrig | 53278cdbde6aaf5dceb885cf138c10d519da28f44bab5155981331108414baa5

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
Size

1.4MB
MD5

98ec2a3e1b4ab61146bd99a1ca6dfe10
SHA1

565bd5fd55c5d8735cc4d292c136c5bd18ab87d2
SHA256

53278cdbde6aaf5dceb885cf138c10d519da28f44bab5155981331108414baa5
SHA512

7b12eb6e7952d3a1b78ff01cda304979282be5f806c3af0172c1ae6504720b35500ec302983905c2e0c520ca94ead937b96c6e6e1873fbf1feca6324563f23f8
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUz7DMKTbcUV:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVF

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023bb2-4.dat	xmrig
behavioral2/files/0x000a000000023bb6-10.dat	xmrig
behavioral2/files/0x000a000000023bb7-8.dat	xmrig
behavioral2/files/0x000a000000023bb8-17.dat	xmrig
behavioral2/files/0x000a000000023bba-29.dat	xmrig
behavioral2/files/0x000a000000023bbb-37.dat	xmrig
behavioral2/files/0x0031000000023bbd-45.dat	xmrig
behavioral2/files/0x000a000000023bbc-43.dat	xmrig
behavioral2/files/0x0031000000023bbe-48.dat	xmrig
behavioral2/files/0x000a000000023bb9-26.dat	xmrig
behavioral2/files/0x000a000000023bc0-54.dat	xmrig
behavioral2/files/0x000b000000023bb3-61.dat	xmrig
behavioral2/files/0x000a000000023bc3-67.dat	xmrig
behavioral2/files/0x000a000000023bc2-74.dat	xmrig
behavioral2/files/0x000a000000023bc6-84.dat	xmrig
behavioral2/files/0x000a000000023bca-106.dat	xmrig
behavioral2/files/0x000a000000023bd1-130.dat	xmrig
behavioral2/files/0x000a000000023bcd-144.dat	xmrig
behavioral2/files/0x000a000000023bd4-162.dat	xmrig
behavioral2/files/0x000a000000023bd3-158.dat	xmrig
behavioral2/files/0x000a000000023bcc-156.dat	xmrig
behavioral2/files/0x000a000000023bd2-154.dat	xmrig
behavioral2/files/0x000a000000023bd0-150.dat	xmrig
behavioral2/files/0x000a000000023bcf-148.dat	xmrig
behavioral2/files/0x000a000000023bce-146.dat	xmrig
behavioral2/files/0x000a000000023bcb-142.dat	xmrig
behavioral2/files/0x000a000000023bc9-138.dat	xmrig
behavioral2/files/0x000a000000023bc8-136.dat	xmrig
behavioral2/files/0x000a000000023bc7-134.dat	xmrig
behavioral2/files/0x000a000000023bc5-103.dat	xmrig
behavioral2/files/0x000a000000023bc4-95.dat	xmrig
behavioral2/files/0x000a000000023bc1-73.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3588	nQLvwhq.exe
2808	nLQjigX.exe
2764	oiQYqJU.exe
4604	gAjNPUu.exe
1740	bNCZxIc.exe
1932	IgpiJYo.exe
4724	CIiPPlV.exe
4840	ITuNRDK.exe
2528	GucyWfF.exe
896	bRLOUDU.exe
3060	jPfKQKh.exe
4636	eJEKmpT.exe
2748	mQBSAXm.exe
2356	duOdyLr.exe
4272	PshkkWf.exe
4340	RfIfxZl.exe
5016	CcBWLVu.exe
4520	IcRIeAI.exe
4708	TKMoPAO.exe
4160	JaenAgk.exe
4232	wjQeEun.exe
5020	cFhGpOR.exe
3032	TDqmiWX.exe
1680	HYKrRRd.exe
4484	xBYhogA.exe
4072	gkQYxTG.exe
2092	DWFxWFq.exe
1420	yGzNokn.exe
4612	LSMTvZi.exe
3404	PjaSNlC.exe
3536	XvBcmoc.exe
2904	SXmBOXS.exe
4772	VJJEAFN.exe
5112	HEWcQiS.exe
3848	OIpyKBg.exe
4112	cTXsVfv.exe
3252	tnxeQFD.exe
3724	SVLFCvw.exe
3524	EckzLzb.exe
2172	QuIWPAk.exe
3856	kikyWmb.exe
2620	wypAXcj.exe
1020	ksTaCrE.exe
4764	naNOjHy.exe
1848	DvbkOTl.exe
3036	bUmOJht.exe
1920	xIYzdTz.exe
4368	MePDxMV.exe
3960	uLZMEFM.exe
676	zUNdsZs.exe
4204	dsfXFnZ.exe
4328	BMoFdSE.exe
2644	SvUkBQa.exe
8	TlnquHo.exe
220	lWFnyiI.exe
1516	PZdbjtz.exe
3472	TqEMcqP.exe
4924	GENuhYC.exe
3532	RSybehX.exe
1068	rbJzgAz.exe
3040	CYjfFBK.exe
2076	lduEpzj.exe
1720	OSiWvSh.exe
2308	ZQTvUTD.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZQTvUTD.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\vbZYdjD.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\JAyKdUI.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\nJadyAJ.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\CcBWLVu.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\fojtLmC.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\UfHScQb.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\nQLvwhq.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\AvwRAnc.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\KjHjIVt.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\HIjITkA.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\GucyWfF.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\dsfXFnZ.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\VSJkqow.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\YZkLnEA.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\OSiWvSh.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\euvAOVy.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\VYlbNIe.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\bndaEvQ.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\bHjkAhc.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\RpvVonl.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\GzJaqTe.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\pCYwISH.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\kDdrmCT.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\ZRKlqto.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\CfbQjtK.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\INuWCCj.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\ruGlcTX.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\IOnvlUd.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\KFZSxWq.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\RyMyJBy.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\FJAocbF.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\tVjpkGQ.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\pAWRuyN.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\JxGNNfm.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\mmttvso.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\FrTclAP.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\ajshxHI.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\npXKnVj.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\LFfGWsj.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\otNJeZO.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\dYVqBJE.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\PamGUvb.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\FlnANQG.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\bXCFroE.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\zjkIGPu.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\uBkvVYl.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\YhpzOmK.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\LrPjqiG.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\TLkBXYj.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\RmcdOHq.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\LyTNDpV.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\LHTPeBL.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\ajvGSuF.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\KtNUlcR.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\NJfqcpz.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\szaAKBj.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\GuuPLSJ.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\SbZgqJM.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\KkuvuNx.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\gWuTQmD.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\MVwZSxd.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\VRaKjQZ.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
File created	C:\Windows\System\qIUCVNe.exe	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17364	dwm.exe
Token: SeChangeNotifyPrivilege	17364	dwm.exe
Token: 33	17364	dwm.exe
Token: SeIncBasePriorityPrivilege	17364	dwm.exe
Token: SeShutdownPrivilege	17364	dwm.exe
Token: SeCreatePagefilePrivilege	17364	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 3588	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	84
PID 4756 wrote to memory of 3588	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	84
PID 4756 wrote to memory of 2808	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	85
PID 4756 wrote to memory of 2808	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	85
PID 4756 wrote to memory of 2764	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	86
PID 4756 wrote to memory of 2764	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	86
PID 4756 wrote to memory of 4604	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	87
PID 4756 wrote to memory of 4604	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	87
PID 4756 wrote to memory of 1740	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	88
PID 4756 wrote to memory of 1740	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	88
PID 4756 wrote to memory of 1932	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	89
PID 4756 wrote to memory of 1932	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	89
PID 4756 wrote to memory of 4724	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	90
PID 4756 wrote to memory of 4724	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	90
PID 4756 wrote to memory of 4840	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	91
PID 4756 wrote to memory of 4840	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	91
PID 4756 wrote to memory of 2528	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	92
PID 4756 wrote to memory of 2528	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	92
PID 4756 wrote to memory of 896	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	93
PID 4756 wrote to memory of 896	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	93
PID 4756 wrote to memory of 3060	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	94
PID 4756 wrote to memory of 3060	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	94
PID 4756 wrote to memory of 4636	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	95
PID 4756 wrote to memory of 4636	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	95
PID 4756 wrote to memory of 2748	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	96
PID 4756 wrote to memory of 2748	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	96
PID 4756 wrote to memory of 4272	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	97
PID 4756 wrote to memory of 4272	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	97
PID 4756 wrote to memory of 2356	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	98
PID 4756 wrote to memory of 2356	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	98
PID 4756 wrote to memory of 4340	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	99
PID 4756 wrote to memory of 4340	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	99
PID 4756 wrote to memory of 5016	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	100
PID 4756 wrote to memory of 5016	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	100
PID 4756 wrote to memory of 4520	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	101
PID 4756 wrote to memory of 4520	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	101
PID 4756 wrote to memory of 4708	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	102
PID 4756 wrote to memory of 4708	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	102
PID 4756 wrote to memory of 4160	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	103
PID 4756 wrote to memory of 4160	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	103
PID 4756 wrote to memory of 4232	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	104
PID 4756 wrote to memory of 4232	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	104
PID 4756 wrote to memory of 5020	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	105
PID 4756 wrote to memory of 5020	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	105
PID 4756 wrote to memory of 3032	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	106
PID 4756 wrote to memory of 3032	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	106
PID 4756 wrote to memory of 1680	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	107
PID 4756 wrote to memory of 1680	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	107
PID 4756 wrote to memory of 4484	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	108
PID 4756 wrote to memory of 4484	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	108
PID 4756 wrote to memory of 4072	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	109
PID 4756 wrote to memory of 4072	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	109
PID 4756 wrote to memory of 2092	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	110
PID 4756 wrote to memory of 2092	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	110
PID 4756 wrote to memory of 1420	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	111
PID 4756 wrote to memory of 1420	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	111
PID 4756 wrote to memory of 4612	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	112
PID 4756 wrote to memory of 4612	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	112
PID 4756 wrote to memory of 3404	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	113
PID 4756 wrote to memory of 3404	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	113
PID 4756 wrote to memory of 3536	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	114
PID 4756 wrote to memory of 3536	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	114
PID 4756 wrote to memory of 2904	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	115
PID 4756 wrote to memory of 2904	4756	98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe	115

C:\Users\Admin\AppData\Local\Temp\98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\98ec2a3e1b4ab61146bd99a1ca6dfe10_NEAS.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\System\nQLvwhq.exe
  C:\Windows\System\nQLvwhq.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\nLQjigX.exe
  C:\Windows\System\nLQjigX.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\oiQYqJU.exe
  C:\Windows\System\oiQYqJU.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\gAjNPUu.exe
  C:\Windows\System\gAjNPUu.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\bNCZxIc.exe
  C:\Windows\System\bNCZxIc.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\IgpiJYo.exe
  C:\Windows\System\IgpiJYo.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\CIiPPlV.exe
  C:\Windows\System\CIiPPlV.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\ITuNRDK.exe
  C:\Windows\System\ITuNRDK.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\GucyWfF.exe
  C:\Windows\System\GucyWfF.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\bRLOUDU.exe
  C:\Windows\System\bRLOUDU.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\jPfKQKh.exe
  C:\Windows\System\jPfKQKh.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\eJEKmpT.exe
  C:\Windows\System\eJEKmpT.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\mQBSAXm.exe
  C:\Windows\System\mQBSAXm.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\PshkkWf.exe
  C:\Windows\System\PshkkWf.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\duOdyLr.exe
  C:\Windows\System\duOdyLr.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\RfIfxZl.exe
  C:\Windows\System\RfIfxZl.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\CcBWLVu.exe
  C:\Windows\System\CcBWLVu.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\IcRIeAI.exe
  C:\Windows\System\IcRIeAI.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\TKMoPAO.exe
  C:\Windows\System\TKMoPAO.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\JaenAgk.exe
  C:\Windows\System\JaenAgk.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\wjQeEun.exe
  C:\Windows\System\wjQeEun.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\cFhGpOR.exe
  C:\Windows\System\cFhGpOR.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\TDqmiWX.exe
  C:\Windows\System\TDqmiWX.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\HYKrRRd.exe
  C:\Windows\System\HYKrRRd.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\xBYhogA.exe
  C:\Windows\System\xBYhogA.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\gkQYxTG.exe
  C:\Windows\System\gkQYxTG.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\DWFxWFq.exe
  C:\Windows\System\DWFxWFq.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\yGzNokn.exe
  C:\Windows\System\yGzNokn.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\LSMTvZi.exe
  C:\Windows\System\LSMTvZi.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\PjaSNlC.exe
  C:\Windows\System\PjaSNlC.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\XvBcmoc.exe
  C:\Windows\System\XvBcmoc.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\SXmBOXS.exe
  C:\Windows\System\SXmBOXS.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\VJJEAFN.exe
  C:\Windows\System\VJJEAFN.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\HEWcQiS.exe
  C:\Windows\System\HEWcQiS.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\OIpyKBg.exe
  C:\Windows\System\OIpyKBg.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\cTXsVfv.exe
  C:\Windows\System\cTXsVfv.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\tnxeQFD.exe
  C:\Windows\System\tnxeQFD.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\SVLFCvw.exe
  C:\Windows\System\SVLFCvw.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\EckzLzb.exe
  C:\Windows\System\EckzLzb.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\QuIWPAk.exe
  C:\Windows\System\QuIWPAk.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\kikyWmb.exe
  C:\Windows\System\kikyWmb.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\wypAXcj.exe
  C:\Windows\System\wypAXcj.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\ksTaCrE.exe
  C:\Windows\System\ksTaCrE.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\naNOjHy.exe
  C:\Windows\System\naNOjHy.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\DvbkOTl.exe
  C:\Windows\System\DvbkOTl.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\bUmOJht.exe
  C:\Windows\System\bUmOJht.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\xIYzdTz.exe
  C:\Windows\System\xIYzdTz.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\RSybehX.exe
  C:\Windows\System\RSybehX.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\MePDxMV.exe
  C:\Windows\System\MePDxMV.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\uLZMEFM.exe
  C:\Windows\System\uLZMEFM.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\zUNdsZs.exe
  C:\Windows\System\zUNdsZs.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\dsfXFnZ.exe
  C:\Windows\System\dsfXFnZ.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\BMoFdSE.exe
  C:\Windows\System\BMoFdSE.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\SvUkBQa.exe
  C:\Windows\System\SvUkBQa.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\TlnquHo.exe
  C:\Windows\System\TlnquHo.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\lWFnyiI.exe
  C:\Windows\System\lWFnyiI.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\PZdbjtz.exe
  C:\Windows\System\PZdbjtz.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\TqEMcqP.exe
  C:\Windows\System\TqEMcqP.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\GENuhYC.exe
  C:\Windows\System\GENuhYC.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\rbJzgAz.exe
  C:\Windows\System\rbJzgAz.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\CYjfFBK.exe
  C:\Windows\System\CYjfFBK.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\lduEpzj.exe
  C:\Windows\System\lduEpzj.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\OSiWvSh.exe
  C:\Windows\System\OSiWvSh.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ZQTvUTD.exe
  C:\Windows\System\ZQTvUTD.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\jJFpsux.exe
  C:\Windows\System\jJFpsux.exe
  2⤵
  PID:4776
- C:\Windows\System\bHjkAhc.exe
  C:\Windows\System\bHjkAhc.exe
  2⤵
  PID:2676
- C:\Windows\System\NJfqcpz.exe
  C:\Windows\System\NJfqcpz.exe
  2⤵
  PID:4164
- C:\Windows\System\HzkcIxh.exe
  C:\Windows\System\HzkcIxh.exe
  2⤵
  PID:1336
- C:\Windows\System\OrwtkNj.exe
  C:\Windows\System\OrwtkNj.exe
  2⤵
  PID:1388
- C:\Windows\System\kybndUn.exe
  C:\Windows\System\kybndUn.exe
  2⤵
  PID:2432
- C:\Windows\System\wHqXqqO.exe
  C:\Windows\System\wHqXqqO.exe
  2⤵
  PID:3656
- C:\Windows\System\WxbXPQz.exe
  C:\Windows\System\WxbXPQz.exe
  2⤵
  PID:3376
- C:\Windows\System\HbCAVJs.exe
  C:\Windows\System\HbCAVJs.exe
  2⤵
  PID:5008
- C:\Windows\System\TKmLTyF.exe
  C:\Windows\System\TKmLTyF.exe
  2⤵
  PID:2992
- C:\Windows\System\IOnvlUd.exe
  C:\Windows\System\IOnvlUd.exe
  2⤵
  PID:1724
- C:\Windows\System\jrfwESv.exe
  C:\Windows\System\jrfwESv.exe
  2⤵
  PID:5092
- C:\Windows\System\EFPApFy.exe
  C:\Windows\System\EFPApFy.exe
  2⤵
  PID:4648
- C:\Windows\System\gAZxDul.exe
  C:\Windows\System\gAZxDul.exe
  2⤵
  PID:4264
- C:\Windows\System\uDwnjXC.exe
  C:\Windows\System\uDwnjXC.exe
  2⤵
  PID:2720
- C:\Windows\System\GHYWlml.exe
  C:\Windows\System\GHYWlml.exe
  2⤵
  PID:4500
- C:\Windows\System\vytdRes.exe
  C:\Windows\System\vytdRes.exe
  2⤵
  PID:4496
- C:\Windows\System\mPAFlhZ.exe
  C:\Windows\System\mPAFlhZ.exe
  2⤵
  PID:2512
- C:\Windows\System\jGjzNAG.exe
  C:\Windows\System\jGjzNAG.exe
  2⤵
  PID:2564
- C:\Windows\System\vvYVVez.exe
  C:\Windows\System\vvYVVez.exe
  2⤵
  PID:2032
- C:\Windows\System\bPHMwLh.exe
  C:\Windows\System\bPHMwLh.exe
  2⤵
  PID:4744
- C:\Windows\System\GnRZntn.exe
  C:\Windows\System\GnRZntn.exe
  2⤵
  PID:4628
- C:\Windows\System\bUCXPqd.exe
  C:\Windows\System\bUCXPqd.exe
  2⤵
  PID:716
- C:\Windows\System\nRtBJMt.exe
  C:\Windows\System\nRtBJMt.exe
  2⤵
  PID:3696
- C:\Windows\System\QEiNiLD.exe
  C:\Windows\System\QEiNiLD.exe
  2⤵
  PID:2232
- C:\Windows\System\ucAtfIM.exe
  C:\Windows\System\ucAtfIM.exe
  2⤵
  PID:3604
- C:\Windows\System\nFBCWRL.exe
  C:\Windows\System\nFBCWRL.exe
  2⤵
  PID:1272
- C:\Windows\System\qhFNtqH.exe
  C:\Windows\System\qhFNtqH.exe
  2⤵
  PID:2948
- C:\Windows\System\jOpIuQC.exe
  C:\Windows\System\jOpIuQC.exe
  2⤵
  PID:4808
- C:\Windows\System\iRSNKlE.exe
  C:\Windows\System\iRSNKlE.exe
  2⤵
  PID:3136
- C:\Windows\System\RRZrEWr.exe
  C:\Windows\System\RRZrEWr.exe
  2⤵
  PID:4172
- C:\Windows\System\wiEXyZZ.exe
  C:\Windows\System\wiEXyZZ.exe
  2⤵
  PID:1836
- C:\Windows\System\xlWidGL.exe
  C:\Windows\System\xlWidGL.exe
  2⤵
  PID:3052
- C:\Windows\System\IwJqEfY.exe
  C:\Windows\System\IwJqEfY.exe
  2⤵
  PID:2952
- C:\Windows\System\UrPMCKf.exe
  C:\Windows\System\UrPMCKf.exe
  2⤵
  PID:540
- C:\Windows\System\HhbbEUF.exe
  C:\Windows\System\HhbbEUF.exe
  2⤵
  PID:1852
- C:\Windows\System\yHglbtV.exe
  C:\Windows\System\yHglbtV.exe
  2⤵
  PID:432
- C:\Windows\System\zygmsyf.exe
  C:\Windows\System\zygmsyf.exe
  2⤵
  PID:5136
- C:\Windows\System\MRZRllu.exe
  C:\Windows\System\MRZRllu.exe
  2⤵
  PID:5156
- C:\Windows\System\rcFNHPC.exe
  C:\Windows\System\rcFNHPC.exe
  2⤵
  PID:5192
- C:\Windows\System\UhrGFrk.exe
  C:\Windows\System\UhrGFrk.exe
  2⤵
  PID:5224
- C:\Windows\System\LJCMqNL.exe
  C:\Windows\System\LJCMqNL.exe
  2⤵
  PID:5260
- C:\Windows\System\dhYhrkM.exe
  C:\Windows\System\dhYhrkM.exe
  2⤵
  PID:5280
- C:\Windows\System\XmZuEnV.exe
  C:\Windows\System\XmZuEnV.exe
  2⤵
  PID:5308
- C:\Windows\System\KFZSxWq.exe
  C:\Windows\System\KFZSxWq.exe
  2⤵
  PID:5336
- C:\Windows\System\GRHtLmM.exe
  C:\Windows\System\GRHtLmM.exe
  2⤵
  PID:5364
- C:\Windows\System\WElUHHu.exe
  C:\Windows\System\WElUHHu.exe
  2⤵
  PID:5392
- C:\Windows\System\FYQtRVS.exe
  C:\Windows\System\FYQtRVS.exe
  2⤵
  PID:5420
- C:\Windows\System\RPDNzoX.exe
  C:\Windows\System\RPDNzoX.exe
  2⤵
  PID:5452
- C:\Windows\System\JCTeqcK.exe
  C:\Windows\System\JCTeqcK.exe
  2⤵
  PID:5476
- C:\Windows\System\xYAxQth.exe
  C:\Windows\System\xYAxQth.exe
  2⤵
  PID:5512
- C:\Windows\System\PEQFrip.exe
  C:\Windows\System\PEQFrip.exe
  2⤵
  PID:5552
- C:\Windows\System\PhmipCB.exe
  C:\Windows\System\PhmipCB.exe
  2⤵
  PID:5588
- C:\Windows\System\QQjPIWE.exe
  C:\Windows\System\QQjPIWE.exe
  2⤵
  PID:5608
- C:\Windows\System\ZXbtCpg.exe
  C:\Windows\System\ZXbtCpg.exe
  2⤵
  PID:5636
- C:\Windows\System\ajshxHI.exe
  C:\Windows\System\ajshxHI.exe
  2⤵
  PID:5672
- C:\Windows\System\IBbhpCs.exe
  C:\Windows\System\IBbhpCs.exe
  2⤵
  PID:5704
- C:\Windows\System\RstwKqA.exe
  C:\Windows\System\RstwKqA.exe
  2⤵
  PID:5740
- C:\Windows\System\OOnmywO.exe
  C:\Windows\System\OOnmywO.exe
  2⤵
  PID:5768
- C:\Windows\System\NogZgvB.exe
  C:\Windows\System\NogZgvB.exe
  2⤵
  PID:5808
- C:\Windows\System\DcgdiaP.exe
  C:\Windows\System\DcgdiaP.exe
  2⤵
  PID:5824
- C:\Windows\System\OzbUmJm.exe
  C:\Windows\System\OzbUmJm.exe
  2⤵
  PID:5864
- C:\Windows\System\szaAKBj.exe
  C:\Windows\System\szaAKBj.exe
  2⤵
  PID:5892
- C:\Windows\System\CxavtQV.exe
  C:\Windows\System\CxavtQV.exe
  2⤵
  PID:5908
- C:\Windows\System\vRhjmsA.exe
  C:\Windows\System\vRhjmsA.exe
  2⤵
  PID:5924
- C:\Windows\System\muKXxvf.exe
  C:\Windows\System\muKXxvf.exe
  2⤵
  PID:5960
- C:\Windows\System\MfFhOsT.exe
  C:\Windows\System\MfFhOsT.exe
  2⤵
  PID:5988
- C:\Windows\System\nbXWkiL.exe
  C:\Windows\System\nbXWkiL.exe
  2⤵
  PID:6020
- C:\Windows\System\zYBGPhc.exe
  C:\Windows\System\zYBGPhc.exe
  2⤵
  PID:6052
- C:\Windows\System\SFGULbR.exe
  C:\Windows\System\SFGULbR.exe
  2⤵
  PID:6096
- C:\Windows\System\exQmTyE.exe
  C:\Windows\System\exQmTyE.exe
  2⤵
  PID:6124
- C:\Windows\System\zbjnyIh.exe
  C:\Windows\System\zbjnyIh.exe
  2⤵
  PID:756
- C:\Windows\System\lruODwb.exe
  C:\Windows\System\lruODwb.exe
  2⤵
  PID:5148
- C:\Windows\System\BjZNbOk.exe
  C:\Windows\System\BjZNbOk.exe
  2⤵
  PID:5304
- C:\Windows\System\RmTgacb.exe
  C:\Windows\System\RmTgacb.exe
  2⤵
  PID:5348
- C:\Windows\System\aXoCoEX.exe
  C:\Windows\System\aXoCoEX.exe
  2⤵
  PID:5412
- C:\Windows\System\RPRvCFk.exe
  C:\Windows\System\RPRvCFk.exe
  2⤵
  PID:5472
- C:\Windows\System\OzIRoKj.exe
  C:\Windows\System\OzIRoKj.exe
  2⤵
  PID:5604
- C:\Windows\System\cTkEGii.exe
  C:\Windows\System\cTkEGii.exe
  2⤵
  PID:5656
- C:\Windows\System\KsnPwWb.exe
  C:\Windows\System\KsnPwWb.exe
  2⤵
  PID:5688
- C:\Windows\System\xGXPxKp.exe
  C:\Windows\System\xGXPxKp.exe
  2⤵
  PID:5752
- C:\Windows\System\OpyHZBv.exe
  C:\Windows\System\OpyHZBv.exe
  2⤵
  PID:5840
- C:\Windows\System\qSajrJX.exe
  C:\Windows\System\qSajrJX.exe
  2⤵
  PID:5904
- C:\Windows\System\ieXyQJm.exe
  C:\Windows\System\ieXyQJm.exe
  2⤵
  PID:6008
- C:\Windows\System\NPOjELU.exe
  C:\Windows\System\NPOjELU.exe
  2⤵
  PID:6036
- C:\Windows\System\UHTKbwU.exe
  C:\Windows\System\UHTKbwU.exe
  2⤵
  PID:6112
- C:\Windows\System\cbjcbDS.exe
  C:\Windows\System\cbjcbDS.exe
  2⤵
  PID:5216
- C:\Windows\System\lWccaCG.exe
  C:\Windows\System\lWccaCG.exe
  2⤵
  PID:5404
- C:\Windows\System\gBRYHRe.exe
  C:\Windows\System\gBRYHRe.exe
  2⤵
  PID:5624
- C:\Windows\System\DBDfGzo.exe
  C:\Windows\System\DBDfGzo.exe
  2⤵
  PID:5792
- C:\Windows\System\OBsUvIN.exe
  C:\Windows\System\OBsUvIN.exe
  2⤵
  PID:5900
- C:\Windows\System\ibdRAAP.exe
  C:\Windows\System\ibdRAAP.exe
  2⤵
  PID:6004
- C:\Windows\System\JzqGdSf.exe
  C:\Windows\System\JzqGdSf.exe
  2⤵
  PID:5128
- C:\Windows\System\KZQbmVO.exe
  C:\Windows\System\KZQbmVO.exe
  2⤵
  PID:5540
- C:\Windows\System\QBgdBJd.exe
  C:\Windows\System\QBgdBJd.exe
  2⤵
  PID:5980
- C:\Windows\System\ogCFnKq.exe
  C:\Windows\System\ogCFnKq.exe
  2⤵
  PID:5384
- C:\Windows\System\RoRflPy.exe
  C:\Windows\System\RoRflPy.exe
  2⤵
  PID:6156
- C:\Windows\System\AvwRAnc.exe
  C:\Windows\System\AvwRAnc.exe
  2⤵
  PID:6180
- C:\Windows\System\gmcnaJI.exe
  C:\Windows\System\gmcnaJI.exe
  2⤵
  PID:6208
- C:\Windows\System\zFBkcpn.exe
  C:\Windows\System\zFBkcpn.exe
  2⤵
  PID:6236
- C:\Windows\System\fvjZaLd.exe
  C:\Windows\System\fvjZaLd.exe
  2⤵
  PID:6268
- C:\Windows\System\dkaHgmR.exe
  C:\Windows\System\dkaHgmR.exe
  2⤵
  PID:6292
- C:\Windows\System\sAwyeMp.exe
  C:\Windows\System\sAwyeMp.exe
  2⤵
  PID:6316
- C:\Windows\System\xuUlQcR.exe
  C:\Windows\System\xuUlQcR.exe
  2⤵
  PID:6352
- C:\Windows\System\QdPBWPh.exe
  C:\Windows\System\QdPBWPh.exe
  2⤵
  PID:6376
- C:\Windows\System\VcfIeRx.exe
  C:\Windows\System\VcfIeRx.exe
  2⤵
  PID:6404
- C:\Windows\System\EXyVlfx.exe
  C:\Windows\System\EXyVlfx.exe
  2⤵
  PID:6432
- C:\Windows\System\kzCVozC.exe
  C:\Windows\System\kzCVozC.exe
  2⤵
  PID:6460
- C:\Windows\System\xbfCBQx.exe
  C:\Windows\System\xbfCBQx.exe
  2⤵
  PID:6488
- C:\Windows\System\CcXDrwU.exe
  C:\Windows\System\CcXDrwU.exe
  2⤵
  PID:6520
- C:\Windows\System\IfnxHiZ.exe
  C:\Windows\System\IfnxHiZ.exe
  2⤵
  PID:6552
- C:\Windows\System\czpQykD.exe
  C:\Windows\System\czpQykD.exe
  2⤵
  PID:6588
- C:\Windows\System\LrEbVss.exe
  C:\Windows\System\LrEbVss.exe
  2⤵
  PID:6616
- C:\Windows\System\LpocUJF.exe
  C:\Windows\System\LpocUJF.exe
  2⤵
  PID:6644
- C:\Windows\System\ZYbBhkX.exe
  C:\Windows\System\ZYbBhkX.exe
  2⤵
  PID:6668
- C:\Windows\System\zumBjMc.exe
  C:\Windows\System\zumBjMc.exe
  2⤵
  PID:6696
- C:\Windows\System\YvOMSVT.exe
  C:\Windows\System\YvOMSVT.exe
  2⤵
  PID:6728
- C:\Windows\System\fHXAtBR.exe
  C:\Windows\System\fHXAtBR.exe
  2⤵
  PID:6764
- C:\Windows\System\oItEinv.exe
  C:\Windows\System\oItEinv.exe
  2⤵
  PID:6796
- C:\Windows\System\tTnRolT.exe
  C:\Windows\System\tTnRolT.exe
  2⤵
  PID:6824
- C:\Windows\System\frLCFix.exe
  C:\Windows\System\frLCFix.exe
  2⤵
  PID:6852
- C:\Windows\System\FjaolMC.exe
  C:\Windows\System\FjaolMC.exe
  2⤵
  PID:6884
- C:\Windows\System\orwKCiH.exe
  C:\Windows\System\orwKCiH.exe
  2⤵
  PID:6916
- C:\Windows\System\gTZGSLP.exe
  C:\Windows\System\gTZGSLP.exe
  2⤵
  PID:6948
- C:\Windows\System\fRUUgwF.exe
  C:\Windows\System\fRUUgwF.exe
  2⤵
  PID:6972
- C:\Windows\System\oEtYJjK.exe
  C:\Windows\System\oEtYJjK.exe
  2⤵
  PID:6992
- C:\Windows\System\DiDekkZ.exe
  C:\Windows\System\DiDekkZ.exe
  2⤵
  PID:7028
- C:\Windows\System\CBmteDM.exe
  C:\Windows\System\CBmteDM.exe
  2⤵
  PID:7044
- C:\Windows\System\UnerjZq.exe
  C:\Windows\System\UnerjZq.exe
  2⤵
  PID:7084
- C:\Windows\System\rqpuUbL.exe
  C:\Windows\System\rqpuUbL.exe
  2⤵
  PID:7108
- C:\Windows\System\qWqpIss.exe
  C:\Windows\System\qWqpIss.exe
  2⤵
  PID:7140
- C:\Windows\System\fmYXezh.exe
  C:\Windows\System\fmYXezh.exe
  2⤵
  PID:5328
- C:\Windows\System\OGOEiKP.exe
  C:\Windows\System\OGOEiKP.exe
  2⤵
  PID:6172
- C:\Windows\System\QeUVZHL.exe
  C:\Windows\System\QeUVZHL.exe
  2⤵
  PID:6220
- C:\Windows\System\RBksrzQ.exe
  C:\Windows\System\RBksrzQ.exe
  2⤵
  PID:6260
- C:\Windows\System\uVOkVSp.exe
  C:\Windows\System\uVOkVSp.exe
  2⤵
  PID:6304
- C:\Windows\System\fwTCouR.exe
  C:\Windows\System\fwTCouR.exe
  2⤵
  PID:6444
- C:\Windows\System\isIEHdB.exe
  C:\Windows\System\isIEHdB.exe
  2⤵
  PID:6500
- C:\Windows\System\UhuPkev.exe
  C:\Windows\System\UhuPkev.exe
  2⤵
  PID:6540
- C:\Windows\System\ZKaXcmL.exe
  C:\Windows\System\ZKaXcmL.exe
  2⤵
  PID:6536
- C:\Windows\System\NcvPkDU.exe
  C:\Windows\System\NcvPkDU.exe
  2⤵
  PID:6632
- C:\Windows\System\cLYxAKc.exe
  C:\Windows\System\cLYxAKc.exe
  2⤵
  PID:6688
- C:\Windows\System\GVesbyF.exe
  C:\Windows\System\GVesbyF.exe
  2⤵
  PID:6784
- C:\Windows\System\wNflloT.exe
  C:\Windows\System\wNflloT.exe
  2⤵
  PID:6840
- C:\Windows\System\fojtLmC.exe
  C:\Windows\System\fojtLmC.exe
  2⤵
  PID:6912
- C:\Windows\System\Fsjuanz.exe
  C:\Windows\System\Fsjuanz.exe
  2⤵
  PID:7008
- C:\Windows\System\negcSJn.exe
  C:\Windows\System\negcSJn.exe
  2⤵
  PID:7068
- C:\Windows\System\RwoitjB.exe
  C:\Windows\System\RwoitjB.exe
  2⤵
  PID:7124
- C:\Windows\System\dPJgdpR.exe
  C:\Windows\System\dPJgdpR.exe
  2⤵
  PID:7164
- C:\Windows\System\MJbXGzJ.exe
  C:\Windows\System\MJbXGzJ.exe
  2⤵
  PID:6328
- C:\Windows\System\BIuAuzC.exe
  C:\Windows\System\BIuAuzC.exe
  2⤵
  PID:6512
- C:\Windows\System\CfbQjtK.exe
  C:\Windows\System\CfbQjtK.exe
  2⤵
  PID:6580
- C:\Windows\System\kgSLmMt.exe
  C:\Windows\System\kgSLmMt.exe
  2⤵
  PID:6740
- C:\Windows\System\uSSvhdV.exe
  C:\Windows\System\uSSvhdV.exe
  2⤵
  PID:6832
- C:\Windows\System\shTrQhB.exe
  C:\Windows\System\shTrQhB.exe
  2⤵
  PID:7036
- C:\Windows\System\LrPjqiG.exe
  C:\Windows\System\LrPjqiG.exe
  2⤵
  PID:6192
- C:\Windows\System\PbfeKWv.exe
  C:\Windows\System\PbfeKWv.exe
  2⤵
  PID:6472
- C:\Windows\System\yfLIIlj.exe
  C:\Windows\System\yfLIIlj.exe
  2⤵
  PID:7056
- C:\Windows\System\HXDuQIn.exe
  C:\Windows\System\HXDuQIn.exe
  2⤵
  PID:6456
- C:\Windows\System\bDzVZkM.exe
  C:\Windows\System\bDzVZkM.exe
  2⤵
  PID:6756
- C:\Windows\System\adtHDxw.exe
  C:\Windows\System\adtHDxw.exe
  2⤵
  PID:7196
- C:\Windows\System\LvvShYV.exe
  C:\Windows\System\LvvShYV.exe
  2⤵
  PID:7224
- C:\Windows\System\QBuQYrH.exe
  C:\Windows\System\QBuQYrH.exe
  2⤵
  PID:7256
- C:\Windows\System\TDlBoDx.exe
  C:\Windows\System\TDlBoDx.exe
  2⤵
  PID:7272
- C:\Windows\System\BvFBicz.exe
  C:\Windows\System\BvFBicz.exe
  2⤵
  PID:7300
- C:\Windows\System\jIeCymL.exe
  C:\Windows\System\jIeCymL.exe
  2⤵
  PID:7320
- C:\Windows\System\GYUdRjk.exe
  C:\Windows\System\GYUdRjk.exe
  2⤵
  PID:7348
- C:\Windows\System\ZEQnVPd.exe
  C:\Windows\System\ZEQnVPd.exe
  2⤵
  PID:7384
- C:\Windows\System\IMlAqYh.exe
  C:\Windows\System\IMlAqYh.exe
  2⤵
  PID:7412
- C:\Windows\System\xzEKOTR.exe
  C:\Windows\System\xzEKOTR.exe
  2⤵
  PID:7440
- C:\Windows\System\TNjyMlL.exe
  C:\Windows\System\TNjyMlL.exe
  2⤵
  PID:7468
- C:\Windows\System\ZnxfXHs.exe
  C:\Windows\System\ZnxfXHs.exe
  2⤵
  PID:7500
- C:\Windows\System\hkwTpjh.exe
  C:\Windows\System\hkwTpjh.exe
  2⤵
  PID:7536
- C:\Windows\System\LmsLeDz.exe
  C:\Windows\System\LmsLeDz.exe
  2⤵
  PID:7560
- C:\Windows\System\GAbtayM.exe
  C:\Windows\System\GAbtayM.exe
  2⤵
  PID:7592
- C:\Windows\System\euvAOVy.exe
  C:\Windows\System\euvAOVy.exe
  2⤵
  PID:7620
- C:\Windows\System\RYysdlN.exe
  C:\Windows\System\RYysdlN.exe
  2⤵
  PID:7636
- C:\Windows\System\jHSrDoJ.exe
  C:\Windows\System\jHSrDoJ.exe
  2⤵
  PID:7668
- C:\Windows\System\kQtPOlr.exe
  C:\Windows\System\kQtPOlr.exe
  2⤵
  PID:7696
- C:\Windows\System\qnacCOO.exe
  C:\Windows\System\qnacCOO.exe
  2⤵
  PID:7724
- C:\Windows\System\cJnjTCf.exe
  C:\Windows\System\cJnjTCf.exe
  2⤵
  PID:7752
- C:\Windows\System\OAWEpkK.exe
  C:\Windows\System\OAWEpkK.exe
  2⤵
  PID:7780
- C:\Windows\System\PehBMuF.exe
  C:\Windows\System\PehBMuF.exe
  2⤵
  PID:7808
- C:\Windows\System\fxVNMRj.exe
  C:\Windows\System\fxVNMRj.exe
  2⤵
  PID:7836
- C:\Windows\System\hAwKfDF.exe
  C:\Windows\System\hAwKfDF.exe
  2⤵
  PID:7872
- C:\Windows\System\gqCWBtO.exe
  C:\Windows\System\gqCWBtO.exe
  2⤵
  PID:7896
- C:\Windows\System\BVhIYpC.exe
  C:\Windows\System\BVhIYpC.exe
  2⤵
  PID:7928
- C:\Windows\System\AsfOXbM.exe
  C:\Windows\System\AsfOXbM.exe
  2⤵
  PID:7952
- C:\Windows\System\FCFwXZN.exe
  C:\Windows\System\FCFwXZN.exe
  2⤵
  PID:7976
- C:\Windows\System\DLaejFB.exe
  C:\Windows\System\DLaejFB.exe
  2⤵
  PID:8000
- C:\Windows\System\vMNSpGL.exe
  C:\Windows\System\vMNSpGL.exe
  2⤵
  PID:8032
- C:\Windows\System\MmhXQph.exe
  C:\Windows\System\MmhXQph.exe
  2⤵
  PID:8056
- C:\Windows\System\JCpHTng.exe
  C:\Windows\System\JCpHTng.exe
  2⤵
  PID:8084
- C:\Windows\System\HGjfjCp.exe
  C:\Windows\System\HGjfjCp.exe
  2⤵
  PID:8120
- C:\Windows\System\muzyweU.exe
  C:\Windows\System\muzyweU.exe
  2⤵
  PID:8148
- C:\Windows\System\oHqjHYX.exe
  C:\Windows\System\oHqjHYX.exe
  2⤵
  PID:8176
- C:\Windows\System\okeMHJA.exe
  C:\Windows\System\okeMHJA.exe
  2⤵
  PID:7180
- C:\Windows\System\uquwcDR.exe
  C:\Windows\System\uquwcDR.exe
  2⤵
  PID:7244
- C:\Windows\System\peZZizd.exe
  C:\Windows\System\peZZizd.exe
  2⤵
  PID:7344
- C:\Windows\System\onVCFGy.exe
  C:\Windows\System\onVCFGy.exe
  2⤵
  PID:7372
- C:\Windows\System\mgeifxX.exe
  C:\Windows\System\mgeifxX.exe
  2⤵
  PID:7436
- C:\Windows\System\lpnUMSA.exe
  C:\Windows\System\lpnUMSA.exe
  2⤵
  PID:7528
- C:\Windows\System\ZBtXvfs.exe
  C:\Windows\System\ZBtXvfs.exe
  2⤵
  PID:7628
- C:\Windows\System\lOenhAG.exe
  C:\Windows\System\lOenhAG.exe
  2⤵
  PID:7712
- C:\Windows\System\rWkAPPx.exe
  C:\Windows\System\rWkAPPx.exe
  2⤵
  PID:7768
- C:\Windows\System\jCifaiN.exe
  C:\Windows\System\jCifaiN.exe
  2⤵
  PID:7848
- C:\Windows\System\lQNkXqH.exe
  C:\Windows\System\lQNkXqH.exe
  2⤵
  PID:7884
- C:\Windows\System\NmpHSUg.exe
  C:\Windows\System\NmpHSUg.exe
  2⤵
  PID:7948
- C:\Windows\System\SFtJFLT.exe
  C:\Windows\System\SFtJFLT.exe
  2⤵
  PID:8020
- C:\Windows\System\bbUqzTQ.exe
  C:\Windows\System\bbUqzTQ.exe
  2⤵
  PID:8080
- C:\Windows\System\bGWzOnL.exe
  C:\Windows\System\bGWzOnL.exe
  2⤵
  PID:8136
- C:\Windows\System\RXPtGRP.exe
  C:\Windows\System\RXPtGRP.exe
  2⤵
  PID:7288
- C:\Windows\System\AbTKXUo.exe
  C:\Windows\System\AbTKXUo.exe
  2⤵
  PID:7316
- C:\Windows\System\vhUbgOC.exe
  C:\Windows\System\vhUbgOC.exe
  2⤵
  PID:7580
- C:\Windows\System\iISHXQL.exe
  C:\Windows\System\iISHXQL.exe
  2⤵
  PID:7804
- C:\Windows\System\yklBZXa.exe
  C:\Windows\System\yklBZXa.exe
  2⤵
  PID:7964
- C:\Windows\System\leoUYvn.exe
  C:\Windows\System\leoUYvn.exe
  2⤵
  PID:8140
- C:\Windows\System\QjAbJUo.exe
  C:\Windows\System\QjAbJUo.exe
  2⤵
  PID:6076
- C:\Windows\System\clOfqAj.exe
  C:\Windows\System\clOfqAj.exe
  2⤵
  PID:7680
- C:\Windows\System\RlWVegh.exe
  C:\Windows\System\RlWVegh.exe
  2⤵
  PID:7824
- C:\Windows\System\nsDefgv.exe
  C:\Windows\System\nsDefgv.exe
  2⤵
  PID:7892
- C:\Windows\System\zzwYlxM.exe
  C:\Windows\System\zzwYlxM.exe
  2⤵
  PID:8216
- C:\Windows\System\Dktuafd.exe
  C:\Windows\System\Dktuafd.exe
  2⤵
  PID:8248
- C:\Windows\System\YCwiThs.exe
  C:\Windows\System\YCwiThs.exe
  2⤵
  PID:8280
- C:\Windows\System\UELCcWy.exe
  C:\Windows\System\UELCcWy.exe
  2⤵
  PID:8308
- C:\Windows\System\AvhjKgs.exe
  C:\Windows\System\AvhjKgs.exe
  2⤵
  PID:8340
- C:\Windows\System\FkrCtuj.exe
  C:\Windows\System\FkrCtuj.exe
  2⤵
  PID:8368
- C:\Windows\System\knaZGAy.exe
  C:\Windows\System\knaZGAy.exe
  2⤵
  PID:8396
- C:\Windows\System\fHEXDmu.exe
  C:\Windows\System\fHEXDmu.exe
  2⤵
  PID:8424
- C:\Windows\System\SzMJfuh.exe
  C:\Windows\System\SzMJfuh.exe
  2⤵
  PID:8452
- C:\Windows\System\bnOQzBu.exe
  C:\Windows\System\bnOQzBu.exe
  2⤵
  PID:8468
- C:\Windows\System\tevRosL.exe
  C:\Windows\System\tevRosL.exe
  2⤵
  PID:8500
- C:\Windows\System\FtFRptB.exe
  C:\Windows\System\FtFRptB.exe
  2⤵
  PID:8524
- C:\Windows\System\kKQVbPW.exe
  C:\Windows\System\kKQVbPW.exe
  2⤵
  PID:8548
- C:\Windows\System\TLkBXYj.exe
  C:\Windows\System\TLkBXYj.exe
  2⤵
  PID:8580
- C:\Windows\System\rsOxkXl.exe
  C:\Windows\System\rsOxkXl.exe
  2⤵
  PID:8608
- C:\Windows\System\VSJkqow.exe
  C:\Windows\System\VSJkqow.exe
  2⤵
  PID:8636
- C:\Windows\System\IaubgVK.exe
  C:\Windows\System\IaubgVK.exe
  2⤵
  PID:8668
- C:\Windows\System\qHpQzOv.exe
  C:\Windows\System\qHpQzOv.exe
  2⤵
  PID:8704
- C:\Windows\System\yxbuEQu.exe
  C:\Windows\System\yxbuEQu.exe
  2⤵
  PID:8732
- C:\Windows\System\oneEnZR.exe
  C:\Windows\System\oneEnZR.exe
  2⤵
  PID:8764
- C:\Windows\System\aWncWtX.exe
  C:\Windows\System\aWncWtX.exe
  2⤵
  PID:8788
- C:\Windows\System\JMLuUAc.exe
  C:\Windows\System\JMLuUAc.exe
  2⤵
  PID:8816
- C:\Windows\System\CCYzQQM.exe
  C:\Windows\System\CCYzQQM.exe
  2⤵
  PID:8844
- C:\Windows\System\uPXnBVJ.exe
  C:\Windows\System\uPXnBVJ.exe
  2⤵
  PID:8876
- C:\Windows\System\KLqwQrO.exe
  C:\Windows\System\KLqwQrO.exe
  2⤵
  PID:8900
- C:\Windows\System\vuiuwVr.exe
  C:\Windows\System\vuiuwVr.exe
  2⤵
  PID:8936
- C:\Windows\System\kKnjwEo.exe
  C:\Windows\System\kKnjwEo.exe
  2⤵
  PID:8964
- C:\Windows\System\VakBYEB.exe
  C:\Windows\System\VakBYEB.exe
  2⤵
  PID:8980
- C:\Windows\System\RdSZJvo.exe
  C:\Windows\System\RdSZJvo.exe
  2⤵
  PID:9004
- C:\Windows\System\pvyTOzn.exe
  C:\Windows\System\pvyTOzn.exe
  2⤵
  PID:9044
- C:\Windows\System\QTvljEt.exe
  C:\Windows\System\QTvljEt.exe
  2⤵
  PID:9072
- C:\Windows\System\HfgpGoi.exe
  C:\Windows\System\HfgpGoi.exe
  2⤵
  PID:9104
- C:\Windows\System\XtkwrXD.exe
  C:\Windows\System\XtkwrXD.exe
  2⤵
  PID:9136
- C:\Windows\System\XfmaYBA.exe
  C:\Windows\System\XfmaYBA.exe
  2⤵
  PID:9172
- C:\Windows\System\hjXPnEI.exe
  C:\Windows\System\hjXPnEI.exe
  2⤵
  PID:9200
- C:\Windows\System\cwamFYB.exe
  C:\Windows\System\cwamFYB.exe
  2⤵
  PID:8068
- C:\Windows\System\GeZZCWZ.exe
  C:\Windows\System\GeZZCWZ.exe
  2⤵
  PID:8236
- C:\Windows\System\FJAocbF.exe
  C:\Windows\System\FJAocbF.exe
  2⤵
  PID:8320
- C:\Windows\System\JKjayWk.exe
  C:\Windows\System\JKjayWk.exe
  2⤵
  PID:8392
- C:\Windows\System\BHiEUTm.exe
  C:\Windows\System\BHiEUTm.exe
  2⤵
  PID:8460
- C:\Windows\System\SErmfzC.exe
  C:\Windows\System\SErmfzC.exe
  2⤵
  PID:8560
- C:\Windows\System\pmnibkB.exe
  C:\Windows\System\pmnibkB.exe
  2⤵
  PID:8588
- C:\Windows\System\gBgBlEV.exe
  C:\Windows\System\gBgBlEV.exe
  2⤵
  PID:8688
- C:\Windows\System\auyxVkl.exe
  C:\Windows\System\auyxVkl.exe
  2⤵
  PID:8756
- C:\Windows\System\DSZZpxI.exe
  C:\Windows\System\DSZZpxI.exe
  2⤵
  PID:8784
- C:\Windows\System\VhXgyVn.exe
  C:\Windows\System\VhXgyVn.exe
  2⤵
  PID:8868
- C:\Windows\System\VlbWWaZ.exe
  C:\Windows\System\VlbWWaZ.exe
  2⤵
  PID:8924
- C:\Windows\System\wQFPKOQ.exe
  C:\Windows\System\wQFPKOQ.exe
  2⤵
  PID:8976
- C:\Windows\System\zyFQPLd.exe
  C:\Windows\System\zyFQPLd.exe
  2⤵
  PID:9016
- C:\Windows\System\giVyqKG.exe
  C:\Windows\System\giVyqKG.exe
  2⤵
  PID:9064
- C:\Windows\System\QbkPsCP.exe
  C:\Windows\System\QbkPsCP.exe
  2⤵
  PID:9132
- C:\Windows\System\VbkIxoU.exe
  C:\Windows\System\VbkIxoU.exe
  2⤵
  PID:9184
- C:\Windows\System\zuxftxX.exe
  C:\Windows\System\zuxftxX.exe
  2⤵
  PID:8272
- C:\Windows\System\qGkeuXC.exe
  C:\Windows\System\qGkeuXC.exe
  2⤵
  PID:8420
- C:\Windows\System\SFsjxIN.exe
  C:\Windows\System\SFsjxIN.exe
  2⤵
  PID:8572
- C:\Windows\System\pnVYRKZ.exe
  C:\Windows\System\pnVYRKZ.exe
  2⤵
  PID:8628
- C:\Windows\System\ILHCkxW.exe
  C:\Windows\System\ILHCkxW.exe
  2⤵
  PID:8948
- C:\Windows\System\xpEtnFD.exe
  C:\Windows\System\xpEtnFD.exe
  2⤵
  PID:9120
- C:\Windows\System\cVLXomd.exe
  C:\Windows\System\cVLXomd.exe
  2⤵
  PID:9100
- C:\Windows\System\zJwJgeI.exe
  C:\Windows\System\zJwJgeI.exe
  2⤵
  PID:9236
- C:\Windows\System\pAWRuyN.exe
  C:\Windows\System\pAWRuyN.exe
  2⤵
  PID:9280
- C:\Windows\System\XRtZVxq.exe
  C:\Windows\System\XRtZVxq.exe
  2⤵
  PID:9308
- C:\Windows\System\ghjelic.exe
  C:\Windows\System\ghjelic.exe
  2⤵
  PID:9328
- C:\Windows\System\RBmgYIi.exe
  C:\Windows\System\RBmgYIi.exe
  2⤵
  PID:9348
- C:\Windows\System\RlXvVyc.exe
  C:\Windows\System\RlXvVyc.exe
  2⤵
  PID:9372
- C:\Windows\System\kiUiuGa.exe
  C:\Windows\System\kiUiuGa.exe
  2⤵
  PID:9396
- C:\Windows\System\JFApuzJ.exe
  C:\Windows\System\JFApuzJ.exe
  2⤵
  PID:9428
- C:\Windows\System\HVydLEf.exe
  C:\Windows\System\HVydLEf.exe
  2⤵
  PID:9468
- C:\Windows\System\wDSKwJc.exe
  C:\Windows\System\wDSKwJc.exe
  2⤵
  PID:9496
- C:\Windows\System\CTTIQIJ.exe
  C:\Windows\System\CTTIQIJ.exe
  2⤵
  PID:9532
- C:\Windows\System\uBFMXeL.exe
  C:\Windows\System\uBFMXeL.exe
  2⤵
  PID:9560
- C:\Windows\System\jHZeJfj.exe
  C:\Windows\System\jHZeJfj.exe
  2⤵
  PID:9584
- C:\Windows\System\BYzLzSi.exe
  C:\Windows\System\BYzLzSi.exe
  2⤵
  PID:9600
- C:\Windows\System\ycxaPcc.exe
  C:\Windows\System\ycxaPcc.exe
  2⤵
  PID:9624
- C:\Windows\System\qMBdenv.exe
  C:\Windows\System\qMBdenv.exe
  2⤵
  PID:9644
- C:\Windows\System\vgatSSI.exe
  C:\Windows\System\vgatSSI.exe
  2⤵
  PID:9668
- C:\Windows\System\FloNlZd.exe
  C:\Windows\System\FloNlZd.exe
  2⤵
  PID:9688
- C:\Windows\System\vVUIOal.exe
  C:\Windows\System\vVUIOal.exe
  2⤵
  PID:9708
- C:\Windows\System\CgYlAnJ.exe
  C:\Windows\System\CgYlAnJ.exe
  2⤵
  PID:9732
- C:\Windows\System\LcCbskL.exe
  C:\Windows\System\LcCbskL.exe
  2⤵
  PID:9764
- C:\Windows\System\qHqGgHc.exe
  C:\Windows\System\qHqGgHc.exe
  2⤵
  PID:9788
- C:\Windows\System\tEtWUuZ.exe
  C:\Windows\System\tEtWUuZ.exe
  2⤵
  PID:9808
- C:\Windows\System\dAUwGCs.exe
  C:\Windows\System\dAUwGCs.exe
  2⤵
  PID:9840
- C:\Windows\System\glYbJya.exe
  C:\Windows\System\glYbJya.exe
  2⤵
  PID:9872
- C:\Windows\System\LFfGWsj.exe
  C:\Windows\System\LFfGWsj.exe
  2⤵
  PID:9892
- C:\Windows\System\BEQmPFQ.exe
  C:\Windows\System\BEQmPFQ.exe
  2⤵
  PID:9920
- C:\Windows\System\zuHBIzm.exe
  C:\Windows\System\zuHBIzm.exe
  2⤵
  PID:9944
- C:\Windows\System\XyHBLiI.exe
  C:\Windows\System\XyHBLiI.exe
  2⤵
  PID:9976
- C:\Windows\System\PIPjuyS.exe
  C:\Windows\System\PIPjuyS.exe
  2⤵
  PID:10004
- C:\Windows\System\kRhuzEx.exe
  C:\Windows\System\kRhuzEx.exe
  2⤵
  PID:10028
- C:\Windows\System\srAmddM.exe
  C:\Windows\System\srAmddM.exe
  2⤵
  PID:10052
- C:\Windows\System\tXcrIBI.exe
  C:\Windows\System\tXcrIBI.exe
  2⤵
  PID:10080
- C:\Windows\System\txSiyQb.exe
  C:\Windows\System\txSiyQb.exe
  2⤵
  PID:10112
- C:\Windows\System\zluGdAJ.exe
  C:\Windows\System\zluGdAJ.exe
  2⤵
  PID:10140
- C:\Windows\System\VYlbNIe.exe
  C:\Windows\System\VYlbNIe.exe
  2⤵
  PID:10168
- C:\Windows\System\moUrmpC.exe
  C:\Windows\System\moUrmpC.exe
  2⤵
  PID:10188
- C:\Windows\System\PIjdaGK.exe
  C:\Windows\System\PIjdaGK.exe
  2⤵
  PID:10216
- C:\Windows\System\MVwZSxd.exe
  C:\Windows\System\MVwZSxd.exe
  2⤵
  PID:8296
- C:\Windows\System\QsWEOiQ.exe
  C:\Windows\System\QsWEOiQ.exe
  2⤵
  PID:8752
- C:\Windows\System\ecgYCGS.exe
  C:\Windows\System\ecgYCGS.exe
  2⤵
  PID:9248
- C:\Windows\System\vCOcvJK.exe
  C:\Windows\System\vCOcvJK.exe
  2⤵
  PID:9296
- C:\Windows\System\bQZLUlX.exe
  C:\Windows\System\bQZLUlX.exe
  2⤵
  PID:9344
- C:\Windows\System\ToktsDc.exe
  C:\Windows\System\ToktsDc.exe
  2⤵
  PID:9408
- C:\Windows\System\NBSyZqJ.exe
  C:\Windows\System\NBSyZqJ.exe
  2⤵
  PID:9508
- C:\Windows\System\pUxokHX.exe
  C:\Windows\System\pUxokHX.exe
  2⤵
  PID:9460
- C:\Windows\System\qooFXBo.exe
  C:\Windows\System\qooFXBo.exe
  2⤵
  PID:9540
- C:\Windows\System\jvvFKBO.exe
  C:\Windows\System\jvvFKBO.exe
  2⤵
  PID:9828
- C:\Windows\System\eKtDZzC.exe
  C:\Windows\System\eKtDZzC.exe
  2⤵
  PID:9756
- C:\Windows\System\ATScjjN.exe
  C:\Windows\System\ATScjjN.exe
  2⤵
  PID:9952
- C:\Windows\System\YNlOKuY.exe
  C:\Windows\System\YNlOKuY.exe
  2⤵
  PID:9776
- C:\Windows\System\WWmohhr.exe
  C:\Windows\System\WWmohhr.exe
  2⤵
  PID:10044
- C:\Windows\System\HeNquqJ.exe
  C:\Windows\System\HeNquqJ.exe
  2⤵
  PID:9900
- C:\Windows\System\TFCdHTF.exe
  C:\Windows\System\TFCdHTF.exe
  2⤵
  PID:10020
- C:\Windows\System\pCYwISH.exe
  C:\Windows\System\pCYwISH.exe
  2⤵
  PID:10180
- C:\Windows\System\ykmAGKA.exe
  C:\Windows\System\ykmAGKA.exe
  2⤵
  PID:10108
- C:\Windows\System\RwEvzxE.exe
  C:\Windows\System\RwEvzxE.exe
  2⤵
  PID:10092
- C:\Windows\System\ahdZfhc.exe
  C:\Windows\System\ahdZfhc.exe
  2⤵
  PID:8740
- C:\Windows\System\fqZTLhG.exe
  C:\Windows\System\fqZTLhG.exe
  2⤵
  PID:9544
- C:\Windows\System\TlasGKH.exe
  C:\Windows\System\TlasGKH.exe
  2⤵
  PID:9968
- C:\Windows\System\VXPYErr.exe
  C:\Windows\System\VXPYErr.exe
  2⤵
  PID:9464
- C:\Windows\System\pHLFGIy.exe
  C:\Windows\System\pHLFGIy.exe
  2⤵
  PID:10244
- C:\Windows\System\wdYHeSq.exe
  C:\Windows\System\wdYHeSq.exe
  2⤵
  PID:10264
- C:\Windows\System\gHczDQV.exe
  C:\Windows\System\gHczDQV.exe
  2⤵
  PID:10296
- C:\Windows\System\lHpRIpV.exe
  C:\Windows\System\lHpRIpV.exe
  2⤵
  PID:10312
- C:\Windows\System\pGDkPeH.exe
  C:\Windows\System\pGDkPeH.exe
  2⤵
  PID:10332
- C:\Windows\System\AJbXMYX.exe
  C:\Windows\System\AJbXMYX.exe
  2⤵
  PID:10356
- C:\Windows\System\jYGyfZm.exe
  C:\Windows\System\jYGyfZm.exe
  2⤵
  PID:10380
- C:\Windows\System\eiBXmWu.exe
  C:\Windows\System\eiBXmWu.exe
  2⤵
  PID:10400
- C:\Windows\System\TlPlHqU.exe
  C:\Windows\System\TlPlHqU.exe
  2⤵
  PID:10432
- C:\Windows\System\NbJsttn.exe
  C:\Windows\System\NbJsttn.exe
  2⤵
  PID:10452
- C:\Windows\System\jIIESgU.exe
  C:\Windows\System\jIIESgU.exe
  2⤵
  PID:10468
- C:\Windows\System\WUnOyyg.exe
  C:\Windows\System\WUnOyyg.exe
  2⤵
  PID:10500
- C:\Windows\System\nXgpSpG.exe
  C:\Windows\System\nXgpSpG.exe
  2⤵
  PID:10536
- C:\Windows\System\ZHgYOzE.exe
  C:\Windows\System\ZHgYOzE.exe
  2⤵
  PID:10560
- C:\Windows\System\oyJGeHw.exe
  C:\Windows\System\oyJGeHw.exe
  2⤵
  PID:10580
- C:\Windows\System\CoHLilJ.exe
  C:\Windows\System\CoHLilJ.exe
  2⤵
  PID:10608
- C:\Windows\System\GzEQyrS.exe
  C:\Windows\System\GzEQyrS.exe
  2⤵
  PID:10632
- C:\Windows\System\ZvSnyry.exe
  C:\Windows\System\ZvSnyry.exe
  2⤵
  PID:10664
- C:\Windows\System\DLkxill.exe
  C:\Windows\System\DLkxill.exe
  2⤵
  PID:10684
- C:\Windows\System\SdthiPj.exe
  C:\Windows\System\SdthiPj.exe
  2⤵
  PID:10708
- C:\Windows\System\lAAOISp.exe
  C:\Windows\System\lAAOISp.exe
  2⤵
  PID:10744
- C:\Windows\System\FncJrJE.exe
  C:\Windows\System\FncJrJE.exe
  2⤵
  PID:10768
- C:\Windows\System\RmcdOHq.exe
  C:\Windows\System\RmcdOHq.exe
  2⤵
  PID:10796
- C:\Windows\System\oqqDaiB.exe
  C:\Windows\System\oqqDaiB.exe
  2⤵
  PID:10828
- C:\Windows\System\NTsRXym.exe
  C:\Windows\System\NTsRXym.exe
  2⤵
  PID:10848
- C:\Windows\System\yParyrO.exe
  C:\Windows\System\yParyrO.exe
  2⤵
  PID:10876
- C:\Windows\System\ebAgNBX.exe
  C:\Windows\System\ebAgNBX.exe
  2⤵
  PID:10900
- C:\Windows\System\kVUdczJ.exe
  C:\Windows\System\kVUdczJ.exe
  2⤵
  PID:10932
- C:\Windows\System\nwPNrBl.exe
  C:\Windows\System\nwPNrBl.exe
  2⤵
  PID:10980
- C:\Windows\System\slKnqkU.exe
  C:\Windows\System\slKnqkU.exe
  2⤵
  PID:11020
- C:\Windows\System\hVIynio.exe
  C:\Windows\System\hVIynio.exe
  2⤵
  PID:11052
- C:\Windows\System\KkuvuNx.exe
  C:\Windows\System\KkuvuNx.exe
  2⤵
  PID:11088
- C:\Windows\System\FEzQWOm.exe
  C:\Windows\System\FEzQWOm.exe
  2⤵
  PID:11104
- C:\Windows\System\JxGNNfm.exe
  C:\Windows\System\JxGNNfm.exe
  2⤵
  PID:11128
- C:\Windows\System\qFBKCUZ.exe
  C:\Windows\System\qFBKCUZ.exe
  2⤵
  PID:11156
- C:\Windows\System\laHFXGz.exe
  C:\Windows\System\laHFXGz.exe
  2⤵
  PID:11188
- C:\Windows\System\cIerQLA.exe
  C:\Windows\System\cIerQLA.exe
  2⤵
  PID:11224
- C:\Windows\System\ckCHECp.exe
  C:\Windows\System\ckCHECp.exe
  2⤵
  PID:11244
- C:\Windows\System\GssZvAi.exe
  C:\Windows\System\GssZvAi.exe
  2⤵
  PID:9636
- C:\Windows\System\dRbLKlK.exe
  C:\Windows\System\dRbLKlK.exe
  2⤵
  PID:9504
- C:\Windows\System\fhYdsAn.exe
  C:\Windows\System\fhYdsAn.exe
  2⤵
  PID:9368
- C:\Windows\System\SYPDOoe.exe
  C:\Windows\System\SYPDOoe.exe
  2⤵
  PID:10076
- C:\Windows\System\uNcFaiO.exe
  C:\Windows\System\uNcFaiO.exe
  2⤵
  PID:10308
- C:\Windows\System\aPIAOMr.exe
  C:\Windows\System\aPIAOMr.exe
  2⤵
  PID:10132
- C:\Windows\System\LaLpPeF.exe
  C:\Windows\System\LaLpPeF.exe
  2⤵
  PID:10428
- C:\Windows\System\nQNrKmQ.exe
  C:\Windows\System\nQNrKmQ.exe
  2⤵
  PID:9596
- C:\Windows\System\KjHjIVt.exe
  C:\Windows\System\KjHjIVt.exe
  2⤵
  PID:10556
- C:\Windows\System\vzpxwsb.exe
  C:\Windows\System\vzpxwsb.exe
  2⤵
  PID:10760
- C:\Windows\System\CpEUckQ.exe
  C:\Windows\System\CpEUckQ.exe
  2⤵
  PID:10596
- C:\Windows\System\LNWgyGE.exe
  C:\Windows\System\LNWgyGE.exe
  2⤵
  PID:10644
- C:\Windows\System\ledSIbs.exe
  C:\Windows\System\ledSIbs.exe
  2⤵
  PID:10484
- C:\Windows\System\XFYkAOL.exe
  C:\Windows\System\XFYkAOL.exe
  2⤵
  PID:10492
- C:\Windows\System\MJIDmel.exe
  C:\Windows\System\MJIDmel.exe
  2⤵
  PID:11036
- C:\Windows\System\ierdHZC.exe
  C:\Windows\System\ierdHZC.exe
  2⤵
  PID:10888
- C:\Windows\System\fUjVjrF.exe
  C:\Windows\System\fUjVjrF.exe
  2⤵
  PID:11124
- C:\Windows\System\xYZDjNb.exe
  C:\Windows\System\xYZDjNb.exe
  2⤵
  PID:10720
- C:\Windows\System\sedxdch.exe
  C:\Windows\System\sedxdch.exe
  2⤵
  PID:11212
- C:\Windows\System\RpvVonl.exe
  C:\Windows\System\RpvVonl.exe
  2⤵
  PID:11084
- C:\Windows\System\zZsrxJK.exe
  C:\Windows\System\zZsrxJK.exe
  2⤵
  PID:10016
- C:\Windows\System\hviBMtb.exe
  C:\Windows\System\hviBMtb.exe
  2⤵
  PID:10196
- C:\Windows\System\vwFxqoq.exe
  C:\Windows\System\vwFxqoq.exe
  2⤵
  PID:10544
- C:\Windows\System\HXOUUZQ.exe
  C:\Windows\System\HXOUUZQ.exe
  2⤵
  PID:10232
- C:\Windows\System\BfdhLJU.exe
  C:\Windows\System\BfdhLJU.exe
  2⤵
  PID:10412
- C:\Windows\System\cMQNnFT.exe
  C:\Windows\System\cMQNnFT.exe
  2⤵
  PID:11292
- C:\Windows\System\KCxSYzF.exe
  C:\Windows\System\KCxSYzF.exe
  2⤵
  PID:11320
- C:\Windows\System\vrCnPnV.exe
  C:\Windows\System\vrCnPnV.exe
  2⤵
  PID:11360
- C:\Windows\System\EEdDPkX.exe
  C:\Windows\System\EEdDPkX.exe
  2⤵
  PID:11380
- C:\Windows\System\sPhzxYi.exe
  C:\Windows\System\sPhzxYi.exe
  2⤵
  PID:11408
- C:\Windows\System\fnlbNYa.exe
  C:\Windows\System\fnlbNYa.exe
  2⤵
  PID:11424
- C:\Windows\System\QxUnHRC.exe
  C:\Windows\System\QxUnHRC.exe
  2⤵
  PID:11444
- C:\Windows\System\ugSRnbc.exe
  C:\Windows\System\ugSRnbc.exe
  2⤵
  PID:11472
- C:\Windows\System\WbEvtKb.exe
  C:\Windows\System\WbEvtKb.exe
  2⤵
  PID:11508
- C:\Windows\System\CIJHEzM.exe
  C:\Windows\System\CIJHEzM.exe
  2⤵
  PID:11532
- C:\Windows\System\npXKnVj.exe
  C:\Windows\System\npXKnVj.exe
  2⤵
  PID:11556
- C:\Windows\System\JQIAqbh.exe
  C:\Windows\System\JQIAqbh.exe
  2⤵
  PID:11576
- C:\Windows\System\upGrfoA.exe
  C:\Windows\System\upGrfoA.exe
  2⤵
  PID:11604
- C:\Windows\System\UHliOLy.exe
  C:\Windows\System\UHliOLy.exe
  2⤵
  PID:11628
- C:\Windows\System\GSjVapJ.exe
  C:\Windows\System\GSjVapJ.exe
  2⤵
  PID:11644
- C:\Windows\System\TMLHIZU.exe
  C:\Windows\System\TMLHIZU.exe
  2⤵
  PID:11660
- C:\Windows\System\jUsspCV.exe
  C:\Windows\System\jUsspCV.exe
  2⤵
  PID:11680
- C:\Windows\System\DweETbb.exe
  C:\Windows\System\DweETbb.exe
  2⤵
  PID:11712
- C:\Windows\System\NJVHwCH.exe
  C:\Windows\System\NJVHwCH.exe
  2⤵
  PID:11744
- C:\Windows\System\GJaPOEQ.exe
  C:\Windows\System\GJaPOEQ.exe
  2⤵
  PID:11768
- C:\Windows\System\psKYYcC.exe
  C:\Windows\System\psKYYcC.exe
  2⤵
  PID:11788
- C:\Windows\System\ccHknIk.exe
  C:\Windows\System\ccHknIk.exe
  2⤵
  PID:11820
- C:\Windows\System\OxTXzDt.exe
  C:\Windows\System\OxTXzDt.exe
  2⤵
  PID:11852
- C:\Windows\System\pCegLQK.exe
  C:\Windows\System\pCegLQK.exe
  2⤵
  PID:11880
- C:\Windows\System\zNGZRlc.exe
  C:\Windows\System\zNGZRlc.exe
  2⤵
  PID:11904
- C:\Windows\System\ENnaRYP.exe
  C:\Windows\System\ENnaRYP.exe
  2⤵
  PID:11928
- C:\Windows\System\PwtoUXg.exe
  C:\Windows\System\PwtoUXg.exe
  2⤵
  PID:11944
- C:\Windows\System\yCjpUeo.exe
  C:\Windows\System\yCjpUeo.exe
  2⤵
  PID:11984
- C:\Windows\System\lyRuHYd.exe
  C:\Windows\System\lyRuHYd.exe
  2⤵
  PID:12012
- C:\Windows\System\uzzJwtA.exe
  C:\Windows\System\uzzJwtA.exe
  2⤵
  PID:12036
- C:\Windows\System\xlOyNNL.exe
  C:\Windows\System\xlOyNNL.exe
  2⤵
  PID:12064
- C:\Windows\System\nmSatQV.exe
  C:\Windows\System\nmSatQV.exe
  2⤵
  PID:12092
- C:\Windows\System\kDdrmCT.exe
  C:\Windows\System\kDdrmCT.exe
  2⤵
  PID:12124
- C:\Windows\System\TpvhEtt.exe
  C:\Windows\System\TpvhEtt.exe
  2⤵
  PID:12148
- C:\Windows\System\HoYjiaL.exe
  C:\Windows\System\HoYjiaL.exe
  2⤵
  PID:12184
- C:\Windows\System\eaivIBH.exe
  C:\Windows\System\eaivIBH.exe
  2⤵
  PID:12208
- C:\Windows\System\mePxkbm.exe
  C:\Windows\System\mePxkbm.exe
  2⤵
  PID:12228
- C:\Windows\System\xzZhagC.exe
  C:\Windows\System\xzZhagC.exe
  2⤵
  PID:12264
- C:\Windows\System\nqNiwya.exe
  C:\Windows\System\nqNiwya.exe
  2⤵
  PID:10784
- C:\Windows\System\otNJeZO.exe
  C:\Windows\System\otNJeZO.exe
  2⤵
  PID:11048
- C:\Windows\System\GuuPLSJ.exe
  C:\Windows\System\GuuPLSJ.exe
  2⤵
  PID:11028
- C:\Windows\System\hNXgEPJ.exe
  C:\Windows\System\hNXgEPJ.exe
  2⤵
  PID:10448
- C:\Windows\System\ACIIBTe.exe
  C:\Windows\System\ACIIBTe.exe
  2⤵
  PID:10908
- C:\Windows\System\bDFoeoh.exe
  C:\Windows\System\bDFoeoh.exe
  2⤵
  PID:10808
- C:\Windows\System\uXhxkWU.exe
  C:\Windows\System\uXhxkWU.exe
  2⤵
  PID:11420
- C:\Windows\System\RyMyJBy.exe
  C:\Windows\System\RyMyJBy.exe
  2⤵
  PID:11468
- C:\Windows\System\GnYdQNG.exe
  C:\Windows\System\GnYdQNG.exe
  2⤵
  PID:11312
- C:\Windows\System\FZAbgjd.exe
  C:\Windows\System\FZAbgjd.exe
  2⤵
  PID:11012
- C:\Windows\System\rSoIbMl.exe
  C:\Windows\System\rSoIbMl.exe
  2⤵
  PID:10064
- C:\Windows\System\nOeYKQc.exe
  C:\Windows\System\nOeYKQc.exe
  2⤵
  PID:11696
- C:\Windows\System\ZTpmvrr.exe
  C:\Windows\System\ZTpmvrr.exe
  2⤵
  PID:11276
- C:\Windows\System\tkupewg.exe
  C:\Windows\System\tkupewg.exe
  2⤵
  PID:11552
- C:\Windows\System\UJmkCyo.exe
  C:\Windows\System\UJmkCyo.exe
  2⤵
  PID:11900
- C:\Windows\System\WqdsRgi.exe
  C:\Windows\System\WqdsRgi.exe
  2⤵
  PID:11656
- C:\Windows\System\OqUCopC.exe
  C:\Windows\System\OqUCopC.exe
  2⤵
  PID:11736
- C:\Windows\System\VORBDSn.exe
  C:\Windows\System\VORBDSn.exe
  2⤵
  PID:12088
- C:\Windows\System\uvstgOb.exe
  C:\Windows\System\uvstgOb.exe
  2⤵
  PID:12196
- C:\Windows\System\BFdsKQJ.exe
  C:\Windows\System\BFdsKQJ.exe
  2⤵
  PID:11872
- C:\Windows\System\vdtlKba.exe
  C:\Windows\System\vdtlKba.exe
  2⤵
  PID:11996
- C:\Windows\System\riNetdG.exe
  C:\Windows\System\riNetdG.exe
  2⤵
  PID:12024
- C:\Windows\System\zcGqIrj.exe
  C:\Windows\System\zcGqIrj.exe
  2⤵
  PID:12080
- C:\Windows\System\MLJhGoW.exe
  C:\Windows\System\MLJhGoW.exe
  2⤵
  PID:11808
- C:\Windows\System\GUrnGYb.exe
  C:\Windows\System\GUrnGYb.exe
  2⤵
  PID:11616
- C:\Windows\System\LHngust.exe
  C:\Windows\System\LHngust.exe
  2⤵
  PID:11964
- C:\Windows\System\NkNjXJw.exe
  C:\Windows\System\NkNjXJw.exe
  2⤵
  PID:12308
- C:\Windows\System\VDJSYvs.exe
  C:\Windows\System\VDJSYvs.exe
  2⤵
  PID:12344
- C:\Windows\System\saRPCcw.exe
  C:\Windows\System\saRPCcw.exe
  2⤵
  PID:12364
- C:\Windows\System\iqNxfOa.exe
  C:\Windows\System\iqNxfOa.exe
  2⤵
  PID:12392
- C:\Windows\System\EJJSWQr.exe
  C:\Windows\System\EJJSWQr.exe
  2⤵
  PID:12416
- C:\Windows\System\bZRAPkc.exe
  C:\Windows\System\bZRAPkc.exe
  2⤵
  PID:12448
- C:\Windows\System\jOmIkBG.exe
  C:\Windows\System\jOmIkBG.exe
  2⤵
  PID:12468
- C:\Windows\System\bbvPqSi.exe
  C:\Windows\System\bbvPqSi.exe
  2⤵
  PID:12496
- C:\Windows\System\oNLwcUH.exe
  C:\Windows\System\oNLwcUH.exe
  2⤵
  PID:12520
- C:\Windows\System\elRAcYb.exe
  C:\Windows\System\elRAcYb.exe
  2⤵
  PID:12548
- C:\Windows\System\eWfOXYr.exe
  C:\Windows\System\eWfOXYr.exe
  2⤵
  PID:12580
- C:\Windows\System\hPbmDcj.exe
  C:\Windows\System\hPbmDcj.exe
  2⤵
  PID:12600
- C:\Windows\System\GQeqemR.exe
  C:\Windows\System\GQeqemR.exe
  2⤵
  PID:12632
- C:\Windows\System\vbZYdjD.exe
  C:\Windows\System\vbZYdjD.exe
  2⤵
  PID:12656
- C:\Windows\System\beDTCto.exe
  C:\Windows\System\beDTCto.exe
  2⤵
  PID:12680
- C:\Windows\System\PRLrErQ.exe
  C:\Windows\System\PRLrErQ.exe
  2⤵
  PID:12700
- C:\Windows\System\PdJystH.exe
  C:\Windows\System\PdJystH.exe
  2⤵
  PID:12724
- C:\Windows\System\EHmfmnn.exe
  C:\Windows\System\EHmfmnn.exe
  2⤵
  PID:12756
- C:\Windows\System\dsCTdOn.exe
  C:\Windows\System\dsCTdOn.exe
  2⤵
  PID:12784
- C:\Windows\System\nALyyWV.exe
  C:\Windows\System\nALyyWV.exe
  2⤵
  PID:12816
- C:\Windows\System\EOAutuh.exe
  C:\Windows\System\EOAutuh.exe
  2⤵
  PID:12836
- C:\Windows\System\NDNzyNX.exe
  C:\Windows\System\NDNzyNX.exe
  2⤵
  PID:12864
- C:\Windows\System\FsSSNzc.exe
  C:\Windows\System\FsSSNzc.exe
  2⤵
  PID:12880
- C:\Windows\System\FwZmStR.exe
  C:\Windows\System\FwZmStR.exe
  2⤵
  PID:12904
- C:\Windows\System\BnBbUbR.exe
  C:\Windows\System\BnBbUbR.exe
  2⤵
  PID:12924
- C:\Windows\System\UygmNzR.exe
  C:\Windows\System\UygmNzR.exe
  2⤵
  PID:12944
- C:\Windows\System\JvFPgUR.exe
  C:\Windows\System\JvFPgUR.exe
  2⤵
  PID:12972
- C:\Windows\System\VmmeQCv.exe
  C:\Windows\System\VmmeQCv.exe
  2⤵
  PID:12996
- C:\Windows\System\WKrDIhs.exe
  C:\Windows\System\WKrDIhs.exe
  2⤵
  PID:13196
- C:\Windows\System\kPvSKGU.exe
  C:\Windows\System\kPvSKGU.exe
  2⤵
  PID:13228
- C:\Windows\System\puHdCFD.exe
  C:\Windows\System\puHdCFD.exe
  2⤵
  PID:13264
- C:\Windows\System\WhWJdbW.exe
  C:\Windows\System\WhWJdbW.exe
  2⤵
  PID:13308
- C:\Windows\System\tVsvWKY.exe
  C:\Windows\System\tVsvWKY.exe
  2⤵
  PID:11764
- C:\Windows\System\ZRKlqto.exe
  C:\Windows\System\ZRKlqto.exe
  2⤵
  PID:10648
- C:\Windows\System\xZEQtVE.exe
  C:\Windows\System\xZEQtVE.exe
  2⤵
  PID:11836
- C:\Windows\System\KIbpnoz.exe
  C:\Windows\System\KIbpnoz.exe
  2⤵
  PID:11972
- C:\Windows\System\cxMdfZQ.exe
  C:\Windows\System\cxMdfZQ.exe
  2⤵
  PID:12436
- C:\Windows\System\pHXpZzH.exe
  C:\Windows\System\pHXpZzH.exe
  2⤵
  PID:12512
- C:\Windows\System\dktxVpR.exe
  C:\Windows\System\dktxVpR.exe
  2⤵
  PID:11724
- C:\Windows\System\PFcFoax.exe
  C:\Windows\System\PFcFoax.exe
  2⤵
  PID:12624
- C:\Windows\System\qwUVZdd.exe
  C:\Windows\System\qwUVZdd.exe
  2⤵
  PID:12708
- C:\Windows\System\DzreTiy.exe
  C:\Windows\System\DzreTiy.exe
  2⤵
  PID:12856
- C:\Windows\System\zmjZrXy.exe
  C:\Windows\System\zmjZrXy.exe
  2⤵
  PID:10756
- C:\Windows\System\moeVEsS.exe
  C:\Windows\System\moeVEsS.exe
  2⤵
  PID:12324
- C:\Windows\System\iFsoJoA.exe
  C:\Windows\System\iFsoJoA.exe
  2⤵
  PID:12956
- C:\Windows\System\iaYcXmg.exe
  C:\Windows\System\iaYcXmg.exe
  2⤵
  PID:12488
- C:\Windows\System\EfTkyeN.exe
  C:\Windows\System\EfTkyeN.exe
  2⤵
  PID:12292
- C:\Windows\System\dIXTKdM.exe
  C:\Windows\System\dIXTKdM.exe
  2⤵
  PID:12940
- C:\Windows\System\GkSVSOu.exe
  C:\Windows\System\GkSVSOu.exe
  2⤵
  PID:13180
- C:\Windows\System\tgMrDVw.exe
  C:\Windows\System\tgMrDVw.exe
  2⤵
  PID:12768
- C:\Windows\System\kPiraNh.exe
  C:\Windows\System\kPiraNh.exe
  2⤵
  PID:12800
- C:\Windows\System\UzQYViy.exe
  C:\Windows\System\UzQYViy.exe
  2⤵
  PID:13300
- C:\Windows\System\SbZgqJM.exe
  C:\Windows\System\SbZgqJM.exe
  2⤵
  PID:12896
- C:\Windows\System\OERuBfg.exe
  C:\Windows\System\OERuBfg.exe
  2⤵
  PID:13172
- C:\Windows\System\QXNPiEL.exe
  C:\Windows\System\QXNPiEL.exe
  2⤵
  PID:10488
- C:\Windows\System\wVFxqJY.exe
  C:\Windows\System\wVFxqJY.exe
  2⤵
  PID:12020
- C:\Windows\System\tpYbalp.exe
  C:\Windows\System\tpYbalp.exe
  2⤵
  PID:11344
- C:\Windows\System\nmriONQ.exe
  C:\Windows\System\nmriONQ.exe
  2⤵
  PID:13104
- C:\Windows\System\JPkYgwj.exe
  C:\Windows\System\JPkYgwj.exe
  2⤵
  PID:12172
- C:\Windows\System\JAyKdUI.exe
  C:\Windows\System\JAyKdUI.exe
  2⤵
  PID:10568
- C:\Windows\System\YXkCLgZ.exe
  C:\Windows\System\YXkCLgZ.exe
  2⤵
  PID:12300
- C:\Windows\System\OHQzivH.exe
  C:\Windows\System\OHQzivH.exe
  2⤵
  PID:12832
- C:\Windows\System\voXHNYQ.exe
  C:\Windows\System\voXHNYQ.exe
  2⤵
  PID:12672
- C:\Windows\System\DxGPPny.exe
  C:\Windows\System\DxGPPny.exe
  2⤵
  PID:12968
- C:\Windows\System\ZBJDswz.exe
  C:\Windows\System\ZBJDswz.exe
  2⤵
  PID:13344
- C:\Windows\System\INuWCCj.exe
  C:\Windows\System\INuWCCj.exe
  2⤵
  PID:13364
- C:\Windows\System\sgVRNuz.exe
  C:\Windows\System\sgVRNuz.exe
  2⤵
  PID:13396
- C:\Windows\System\aUeocen.exe
  C:\Windows\System\aUeocen.exe
  2⤵
  PID:13420
- C:\Windows\System\UZAbdXj.exe
  C:\Windows\System\UZAbdXj.exe
  2⤵
  PID:13436
- C:\Windows\System\nyCbqGH.exe
  C:\Windows\System\nyCbqGH.exe
  2⤵
  PID:13460
- C:\Windows\System\cmSFdCA.exe
  C:\Windows\System\cmSFdCA.exe
  2⤵
  PID:13484
- C:\Windows\System\kfDQENP.exe
  C:\Windows\System\kfDQENP.exe
  2⤵
  PID:13508
- C:\Windows\System\JyZKkpU.exe
  C:\Windows\System\JyZKkpU.exe
  2⤵
  PID:13532
- C:\Windows\System\ezyPSZO.exe
  C:\Windows\System\ezyPSZO.exe
  2⤵
  PID:13560
- C:\Windows\System\NtseqMn.exe
  C:\Windows\System\NtseqMn.exe
  2⤵
  PID:13580
- C:\Windows\System\ruGlcTX.exe
  C:\Windows\System\ruGlcTX.exe
  2⤵
  PID:13608
- C:\Windows\System\TOQdsUY.exe
  C:\Windows\System\TOQdsUY.exe
  2⤵
  PID:13632
- C:\Windows\System\qoxXKty.exe
  C:\Windows\System\qoxXKty.exe
  2⤵
  PID:13660
- C:\Windows\System\uymGPTY.exe
  C:\Windows\System\uymGPTY.exe
  2⤵
  PID:13676
- C:\Windows\System\PvADfhn.exe
  C:\Windows\System\PvADfhn.exe
  2⤵
  PID:13704
- C:\Windows\System\qZdGsaO.exe
  C:\Windows\System\qZdGsaO.exe
  2⤵
  PID:13732
- C:\Windows\System\SgIqxUy.exe
  C:\Windows\System\SgIqxUy.exe
  2⤵
  PID:13756
- C:\Windows\System\WJsNQds.exe
  C:\Windows\System\WJsNQds.exe
  2⤵
  PID:13796
- C:\Windows\System\HTwOUpX.exe
  C:\Windows\System\HTwOUpX.exe
  2⤵
  PID:13816
- C:\Windows\System\NZwONzT.exe
  C:\Windows\System\NZwONzT.exe
  2⤵
  PID:13836
- C:\Windows\System\dHkIOTR.exe
  C:\Windows\System\dHkIOTR.exe
  2⤵
  PID:13872
- C:\Windows\System\vedKTNs.exe
  C:\Windows\System\vedKTNs.exe
  2⤵
  PID:13892
- C:\Windows\System\OMyDtRo.exe
  C:\Windows\System\OMyDtRo.exe
  2⤵
  PID:13916
- C:\Windows\System\uFwKArL.exe
  C:\Windows\System\uFwKArL.exe
  2⤵
  PID:13944
- C:\Windows\System\QYLusCR.exe
  C:\Windows\System\QYLusCR.exe
  2⤵
  PID:13972
- C:\Windows\System\rBTeOoN.exe
  C:\Windows\System\rBTeOoN.exe
  2⤵
  PID:14000
- C:\Windows\System\mFFlBUj.exe
  C:\Windows\System\mFFlBUj.exe
  2⤵
  PID:14016
- C:\Windows\System\Roseoyj.exe
  C:\Windows\System\Roseoyj.exe
  2⤵
  PID:14040
- C:\Windows\System\YaKgpCv.exe
  C:\Windows\System\YaKgpCv.exe
  2⤵
  PID:14064
- C:\Windows\System\sXTZzel.exe
  C:\Windows\System\sXTZzel.exe
  2⤵
  PID:14092
- C:\Windows\System\JjIjoGa.exe
  C:\Windows\System\JjIjoGa.exe
  2⤵
  PID:14120
- C:\Windows\System\ssKVPLp.exe
  C:\Windows\System\ssKVPLp.exe
  2⤵
  PID:14144
- C:\Windows\System\gnexOIe.exe
  C:\Windows\System\gnexOIe.exe
  2⤵
  PID:14172
- C:\Windows\System\xsJYrZI.exe
  C:\Windows\System\xsJYrZI.exe
  2⤵
  PID:14200
- C:\Windows\System\LyTNDpV.exe
  C:\Windows\System\LyTNDpV.exe
  2⤵
  PID:14224
- C:\Windows\System\TKovKaC.exe
  C:\Windows\System\TKovKaC.exe
  2⤵
  PID:14248
- C:\Windows\System\UfqiMMY.exe
  C:\Windows\System\UfqiMMY.exe
  2⤵
  PID:14280
- C:\Windows\System\yHTBOhu.exe
  C:\Windows\System\yHTBOhu.exe
  2⤵
  PID:14300
- C:\Windows\System\WOcsFnY.exe
  C:\Windows\System\WOcsFnY.exe
  2⤵
  PID:14320
- C:\Windows\System\wlqfXDP.exe
  C:\Windows\System\wlqfXDP.exe
  2⤵
  PID:13256
- C:\Windows\System\FjufxkD.exe
  C:\Windows\System\FjufxkD.exe
  2⤵
  PID:12140
- C:\Windows\System\TUzsPDN.exe
  C:\Windows\System\TUzsPDN.exe
  2⤵
  PID:12988
- C:\Windows\System\AODuVOZ.exe
  C:\Windows\System\AODuVOZ.exe
  2⤵
  PID:13340
- C:\Windows\System\MyxucWb.exe
  C:\Windows\System\MyxucWb.exe
  2⤵
  PID:13240
- C:\Windows\System\CDUMmdb.exe
  C:\Windows\System\CDUMmdb.exe
  2⤵
  PID:12824
- C:\Windows\System\oDGfNJC.exe
  C:\Windows\System\oDGfNJC.exe
  2⤵
  PID:13576
- C:\Windows\System\iaTaKrg.exe
  C:\Windows\System\iaTaKrg.exe
  2⤵
  PID:13408
- C:\Windows\System\kLosKWw.exe
  C:\Windows\System\kLosKWw.exe
  2⤵
  PID:13692
- C:\Windows\System\fMxNfFv.exe
  C:\Windows\System\fMxNfFv.exe
  2⤵
  PID:13032
- C:\Windows\System\HuZLhiX.exe
  C:\Windows\System\HuZLhiX.exe
  2⤵
  PID:12540
- C:\Windows\System\KqBxVnx.exe
  C:\Windows\System\KqBxVnx.exe
  2⤵
  PID:13864
- C:\Windows\System\dYVqBJE.exe
  C:\Windows\System\dYVqBJE.exe
  2⤵
  PID:13928
- C:\Windows\System\ZilBKVY.exe
  C:\Windows\System\ZilBKVY.exe
  2⤵
  PID:14008
- C:\Windows\System\anCaQuz.exe
  C:\Windows\System\anCaQuz.exe
  2⤵
  PID:13828
- C:\Windows\System\wWfsDLZ.exe
  C:\Windows\System\wWfsDLZ.exe
  2⤵
  PID:13716
- C:\Windows\System\bEqQYWU.exe
  C:\Windows\System\bEqQYWU.exe
  2⤵
  PID:14312
- C:\Windows\System\SGyTEuK.exe
  C:\Windows\System\SGyTEuK.exe
  2⤵
  PID:14108
- C:\Windows\System\vIJWElD.exe
  C:\Windows\System\vIJWElD.exe
  2⤵
  PID:13884
- C:\Windows\System\FGjcahH.exe
  C:\Windows\System\FGjcahH.exe
  2⤵
  PID:14236
- C:\Windows\System\TcztYJE.exe
  C:\Windows\System\TcztYJE.exe
  2⤵
  PID:14332
- C:\Windows\System\YCzWnMz.exe
  C:\Windows\System\YCzWnMz.exe
  2⤵
  PID:14104
- C:\Windows\System\XFnUQPG.exe
  C:\Windows\System\XFnUQPG.exe
  2⤵
  PID:14352
- C:\Windows\System\KpWNDSO.exe
  C:\Windows\System\KpWNDSO.exe
  2⤵
  PID:14392
- C:\Windows\System\wKhLhIH.exe
  C:\Windows\System\wKhLhIH.exe
  2⤵
  PID:14484
- C:\Windows\System\PWxRsaV.exe
  C:\Windows\System\PWxRsaV.exe
  2⤵
  PID:14516
- C:\Windows\System\WIbLunJ.exe
  C:\Windows\System\WIbLunJ.exe
  2⤵
  PID:14564
- C:\Windows\System\heWoCVh.exe
  C:\Windows\System\heWoCVh.exe
  2⤵
  PID:14600
- C:\Windows\System\NPwLaXL.exe
  C:\Windows\System\NPwLaXL.exe
  2⤵
  PID:14620
- C:\Windows\System\EMKyKmH.exe
  C:\Windows\System\EMKyKmH.exe
  2⤵
  PID:14640
- C:\Windows\System\UPDkOyv.exe
  C:\Windows\System\UPDkOyv.exe
  2⤵
  PID:14672
- C:\Windows\System\diUlYPo.exe
  C:\Windows\System\diUlYPo.exe
  2⤵
  PID:14708
- C:\Windows\System\tAjBxAO.exe
  C:\Windows\System\tAjBxAO.exe
  2⤵
  PID:14744
- C:\Windows\System\HYZiraw.exe
  C:\Windows\System\HYZiraw.exe
  2⤵
  PID:14772
- C:\Windows\System\larJwMa.exe
  C:\Windows\System\larJwMa.exe
  2⤵
  PID:14796
- C:\Windows\System\VuxYSNg.exe
  C:\Windows\System\VuxYSNg.exe
  2⤵
  PID:14820
- C:\Windows\System\RCYbJLo.exe
  C:\Windows\System\RCYbJLo.exe
  2⤵
  PID:14848
- C:\Windows\System\rsZvfqb.exe
  C:\Windows\System\rsZvfqb.exe
  2⤵
  PID:14872
- C:\Windows\System\POBPILG.exe
  C:\Windows\System\POBPILG.exe
  2⤵
  PID:14892
- C:\Windows\System\gQDBNza.exe
  C:\Windows\System\gQDBNza.exe
  2⤵
  PID:14912
- C:\Windows\System\bGRfIVv.exe
  C:\Windows\System\bGRfIVv.exe
  2⤵
  PID:14956
- C:\Windows\System\hYnjBRa.exe
  C:\Windows\System\hYnjBRa.exe
  2⤵
  PID:14976
- C:\Windows\System\Qhfrdpo.exe
  C:\Windows\System\Qhfrdpo.exe
  2⤵
  PID:15008
- C:\Windows\System\qaRXNXn.exe
  C:\Windows\System\qaRXNXn.exe
  2⤵
  PID:15032
- C:\Windows\System\mzVTXhc.exe
  C:\Windows\System\mzVTXhc.exe
  2⤵
  PID:15048
- C:\Windows\System\bXCFroE.exe
  C:\Windows\System\bXCFroE.exe
  2⤵
  PID:15076
- C:\Windows\System\MxAzihy.exe
  C:\Windows\System\MxAzihy.exe
  2⤵
  PID:15104
- C:\Windows\System\YukXaKH.exe
  C:\Windows\System\YukXaKH.exe
  2⤵
  PID:15136
- C:\Windows\System\hMbPBWT.exe
  C:\Windows\System\hMbPBWT.exe
  2⤵
  PID:15160
- C:\Windows\System\hkHwqlO.exe
  C:\Windows\System\hkHwqlO.exe
  2⤵
  PID:15184
- C:\Windows\System\GVigotF.exe
  C:\Windows\System\GVigotF.exe
  2⤵
  PID:15204
- C:\Windows\System\WtIJuox.exe
  C:\Windows\System\WtIJuox.exe
  2⤵
  PID:15224
- C:\Windows\System\nJadyAJ.exe
  C:\Windows\System\nJadyAJ.exe
  2⤵
  PID:15244
- C:\Windows\System\GOYcIQv.exe
  C:\Windows\System\GOYcIQv.exe
  2⤵
  PID:15268
- C:\Windows\System\xECvoiQ.exe
  C:\Windows\System\xECvoiQ.exe
  2⤵
  PID:15284
- C:\Windows\System\dmkcZuS.exe
  C:\Windows\System\dmkcZuS.exe
  2⤵
  PID:15316
- C:\Windows\System\KnEAhHR.exe
  C:\Windows\System\KnEAhHR.exe
  2⤵
  PID:15332
- C:\Windows\System\ILAzMYY.exe
  C:\Windows\System\ILAzMYY.exe
  2⤵
  PID:15356
- C:\Windows\System\YZkLnEA.exe
  C:\Windows\System\YZkLnEA.exe
  2⤵
  PID:13416
- C:\Windows\System\QIOlbUM.exe
  C:\Windows\System\QIOlbUM.exe
  2⤵
  PID:14072
- C:\Windows\System\mmttvso.exe
  C:\Windows\System\mmttvso.exe
  2⤵
  PID:12528
- C:\Windows\System\ljfbMgU.exe
  C:\Windows\System\ljfbMgU.exe
  2⤵
  PID:13688
- C:\Windows\System\Vayrsgs.exe
  C:\Windows\System\Vayrsgs.exe
  2⤵
  PID:14136
- C:\Windows\System\uGSmhzj.exe
  C:\Windows\System\uGSmhzj.exe
  2⤵
  PID:13856
- C:\Windows\System\hXbneTu.exe
  C:\Windows\System\hXbneTu.exe
  2⤵
  PID:13448
- C:\Windows\System\AEpoZwr.exe
  C:\Windows\System\AEpoZwr.exe
  2⤵
  PID:14584
- C:\Windows\System\fkpWiCl.exe
  C:\Windows\System\fkpWiCl.exe
  2⤵
  PID:14456
- C:\Windows\System\hDnMMnt.exe
  C:\Windows\System\hDnMMnt.exe
  2⤵
  PID:14408
- C:\Windows\System\OFncGhe.exe
  C:\Windows\System\OFncGhe.exe
  2⤵
  PID:14728
- C:\Windows\System\AAkNprF.exe
  C:\Windows\System\AAkNprF.exe
  2⤵
  PID:14808
- C:\Windows\System\TrhcNGt.exe
  C:\Windows\System\TrhcNGt.exe
  2⤵
  PID:14688
- C:\Windows\System\nidUlJn.exe
  C:\Windows\System\nidUlJn.exe
  2⤵
  PID:14940
- C:\Windows\System\NmCnnkU.exe
  C:\Windows\System\NmCnnkU.exe
  2⤵
  PID:14680
- C:\Windows\System\mDTSZOq.exe
  C:\Windows\System\mDTSZOq.exe
  2⤵
  PID:14756
- C:\Windows\System\XbuCmwl.exe
  C:\Windows\System\XbuCmwl.exe
  2⤵
  PID:14920
- C:\Windows\System\etBGdad.exe
  C:\Windows\System\etBGdad.exe
  2⤵
  PID:14840
- C:\Windows\System\kvYkbwP.exe
  C:\Windows\System\kvYkbwP.exe
  2⤵
  PID:14884
- C:\Windows\System\HTRtDZG.exe
  C:\Windows\System\HTRtDZG.exe
  2⤵
  PID:15312
- C:\Windows\System\ZkGSztv.exe
  C:\Windows\System\ZkGSztv.exe
  2⤵
  PID:13776
- C:\Windows\System\UVylvaG.exe
  C:\Windows\System\UVylvaG.exe
  2⤵
  PID:15220
- C:\Windows\System\caxRDhs.exe
  C:\Windows\System\caxRDhs.exe
  2⤵
  PID:15116
- C:\Windows\System\JfvPdrk.exe
  C:\Windows\System\JfvPdrk.exe
  2⤵
  PID:14524
- C:\Windows\System\LHTPeBL.exe
  C:\Windows\System\LHTPeBL.exe
  2⤵
  PID:14572
- C:\Windows\System\UfHScQb.exe
  C:\Windows\System\UfHScQb.exe
  2⤵
  PID:14656
- C:\Windows\System\mzkfXLi.exe
  C:\Windows\System\mzkfXLi.exe
  2⤵
  PID:15308
- C:\Windows\System\PamGUvb.exe
  C:\Windows\System\PamGUvb.exe
  2⤵
  PID:14836
- C:\Windows\System\yGeykwS.exe
  C:\Windows\System\yGeykwS.exe
  2⤵
  PID:15380
- C:\Windows\System\jAMqGBy.exe
  C:\Windows\System\jAMqGBy.exe
  2⤵
  PID:15396
- C:\Windows\System\xjhRPXa.exe
  C:\Windows\System\xjhRPXa.exe
  2⤵
  PID:15412
- C:\Windows\System\ftCzoSD.exe
  C:\Windows\System\ftCzoSD.exe
  2⤵
  PID:15436
- C:\Windows\System\cvXIBNG.exe
  C:\Windows\System\cvXIBNG.exe
  2⤵
  PID:15468
- C:\Windows\System\rgJZUxG.exe
  C:\Windows\System\rgJZUxG.exe
  2⤵
  PID:15504
- C:\Windows\System\WXWenea.exe
  C:\Windows\System\WXWenea.exe
  2⤵
  PID:15528
- C:\Windows\System\VmWiiBC.exe
  C:\Windows\System\VmWiiBC.exe
  2⤵
  PID:15552
- C:\Windows\System\LYjAFYB.exe
  C:\Windows\System\LYjAFYB.exe
  2⤵
  PID:15568
- C:\Windows\System\vHngTix.exe
  C:\Windows\System\vHngTix.exe
  2⤵
  PID:15600
- C:\Windows\System\nqgyGge.exe
  C:\Windows\System\nqgyGge.exe
  2⤵
  PID:15620
- C:\Windows\System\VjqASrL.exe
  C:\Windows\System\VjqASrL.exe
  2⤵
  PID:15644
- C:\Windows\System\hmofIbR.exe
  C:\Windows\System\hmofIbR.exe
  2⤵
  PID:15660
- C:\Windows\System\RenRdsv.exe
  C:\Windows\System\RenRdsv.exe
  2⤵
  PID:15680
- C:\Windows\System\rDNsUln.exe
  C:\Windows\System\rDNsUln.exe
  2⤵
  PID:15700
- C:\Windows\System\OVEkdgh.exe
  C:\Windows\System\OVEkdgh.exe
  2⤵
  PID:15720
- C:\Windows\System\ryfUnSK.exe
  C:\Windows\System\ryfUnSK.exe
  2⤵
  PID:15736
- C:\Windows\System\qvsHCBN.exe
  C:\Windows\System\qvsHCBN.exe
  2⤵
  PID:15760
- C:\Windows\System\zjkIGPu.exe
  C:\Windows\System\zjkIGPu.exe
  2⤵
  PID:15780
- C:\Windows\System\wpQUtao.exe
  C:\Windows\System\wpQUtao.exe
  2⤵
  PID:15808
- C:\Windows\System\WLgASgD.exe
  C:\Windows\System\WLgASgD.exe
  2⤵
  PID:15836
- C:\Windows\System\cxVqsXc.exe
  C:\Windows\System\cxVqsXc.exe
  2⤵
  PID:15860
- C:\Windows\System\XftKgvm.exe
  C:\Windows\System\XftKgvm.exe
  2⤵
  PID:15884
- C:\Windows\System\tzXoxrw.exe
  C:\Windows\System\tzXoxrw.exe
  2⤵
  PID:15916
- C:\Windows\System\nsmqVMi.exe
  C:\Windows\System\nsmqVMi.exe
  2⤵
  PID:15948
- C:\Windows\System\mnQWBjl.exe
  C:\Windows\System\mnQWBjl.exe
  2⤵
  PID:15980
- C:\Windows\System\XnxRjeM.exe
  C:\Windows\System\XnxRjeM.exe
  2⤵
  PID:16008
- C:\Windows\System\bPlamIC.exe
  C:\Windows\System\bPlamIC.exe
  2⤵
  PID:16036
- C:\Windows\System\yOktjWd.exe
  C:\Windows\System\yOktjWd.exe
  2⤵
  PID:16060
- C:\Windows\System\pVWLUuJ.exe
  C:\Windows\System\pVWLUuJ.exe
  2⤵
  PID:16084
- C:\Windows\System\zDZLbdv.exe
  C:\Windows\System\zDZLbdv.exe
  2⤵
  PID:16112
- C:\Windows\System\rCvcsgU.exe
  C:\Windows\System\rCvcsgU.exe
  2⤵
  PID:16132
- C:\Windows\System\VRaKjQZ.exe
  C:\Windows\System\VRaKjQZ.exe
  2⤵
  PID:16156
- C:\Windows\System\uDdtlhV.exe
  C:\Windows\System\uDdtlhV.exe
  2⤵
  PID:16176
- C:\Windows\System\OulwzZO.exe
  C:\Windows\System\OulwzZO.exe
  2⤵
  PID:16200
- C:\Windows\System\FlnANQG.exe
  C:\Windows\System\FlnANQG.exe
  2⤵
  PID:16216
- C:\Windows\System\VhlaGQA.exe
  C:\Windows\System\VhlaGQA.exe
  2⤵
  PID:16240
- C:\Windows\System\zSyfXWZ.exe
  C:\Windows\System\zSyfXWZ.exe
  2⤵
  PID:16276
- C:\Windows\System\ajvGSuF.exe
  C:\Windows\System\ajvGSuF.exe
  2⤵
  PID:16296
- C:\Windows\System\RrBmZpx.exe
  C:\Windows\System\RrBmZpx.exe
  2⤵
  PID:16324
- C:\Windows\System\DJsxXhA.exe
  C:\Windows\System\DJsxXhA.exe
  2⤵
  PID:16344
- C:\Windows\System\aEtnDZN.exe
  C:\Windows\System\aEtnDZN.exe
  2⤵
  PID:16364
- C:\Windows\System\QUMoNBn.exe
  C:\Windows\System\QUMoNBn.exe
  2⤵
  PID:14404
- C:\Windows\System\clbzwHD.exe
  C:\Windows\System\clbzwHD.exe
  2⤵
  PID:13324
- C:\Windows\System\gyFAnWD.exe
  C:\Windows\System\gyFAnWD.exe
  2⤵
  PID:14048
- C:\Windows\System\IVbMfZT.exe
  C:\Windows\System\IVbMfZT.exe
  2⤵
  PID:15408
- C:\Windows\System\wuvgjvp.exe
  C:\Windows\System\wuvgjvp.exe
  2⤵
  PID:11600
- C:\Windows\System\pQrCFqw.exe
  C:\Windows\System\pQrCFqw.exe
  2⤵
  PID:15352
- C:\Windows\System\ADDqtqV.exe
  C:\Windows\System\ADDqtqV.exe
  2⤵
  PID:13784
- C:\Windows\System\lwkSjvd.exe
  C:\Windows\System\lwkSjvd.exe
  2⤵
  PID:14880
- C:\Windows\System\INArcFN.exe
  C:\Windows\System\INArcFN.exe
  2⤵
  PID:13852
- C:\Windows\System\KvLieXF.exe
  C:\Windows\System\KvLieXF.exe
  2⤵
  PID:15676
- C:\Windows\System\gRYMhOn.exe
  C:\Windows\System\gRYMhOn.exe
  2⤵
  PID:15448
- C:\Windows\System\xMBdOnA.exe
  C:\Windows\System\xMBdOnA.exe
  2⤵
  PID:15512
- C:\Windows\System\wswYnMH.exe
  C:\Windows\System\wswYnMH.exe
  2⤵
  PID:14628
- C:\Windows\System\YVVCdPe.exe
  C:\Windows\System\YVVCdPe.exe
  2⤵
  PID:15544
- C:\Windows\System\IZGfLaG.exe
  C:\Windows\System\IZGfLaG.exe
  2⤵
  PID:15592
- C:\Windows\System\ArfyGZS.exe
  C:\Windows\System\ArfyGZS.exe
  2⤵
  PID:15996
- C:\Windows\System\zVHjLDv.exe
  C:\Windows\System\zVHjLDv.exe
  2⤵
  PID:16032
- C:\Windows\System\tviCAEq.exe
  C:\Windows\System\tviCAEq.exe
  2⤵
  PID:16428
- C:\Windows\System\jAvYvOb.exe
  C:\Windows\System\jAvYvOb.exe
  2⤵
  PID:16444
- C:\Windows\System\epzuSFi.exe
  C:\Windows\System\epzuSFi.exe
  2⤵
  PID:16460
- C:\Windows\System\ecaFuYE.exe
  C:\Windows\System\ecaFuYE.exe
  2⤵
  PID:16476
- C:\Windows\System\KJkPfoK.exe
  C:\Windows\System\KJkPfoK.exe
  2⤵
  PID:16496
- C:\Windows\System\bndaEvQ.exe
  C:\Windows\System\bndaEvQ.exe
  2⤵
  PID:16520
- C:\Windows\System\oYEWTxN.exe
  C:\Windows\System\oYEWTxN.exe
  2⤵
  PID:16536
- C:\Windows\System\JAIvNQl.exe
  C:\Windows\System\JAIvNQl.exe
  2⤵
  PID:16560
- C:\Windows\System\IycYiOR.exe
  C:\Windows\System\IycYiOR.exe
  2⤵
  PID:16588
- C:\Windows\System\bPNcMqQ.exe
  C:\Windows\System\bPNcMqQ.exe
  2⤵
  PID:16608
- C:\Windows\System\cqcrPIT.exe
  C:\Windows\System\cqcrPIT.exe
  2⤵
  PID:16632
- C:\Windows\System\sNZBZqR.exe
  C:\Windows\System\sNZBZqR.exe
  2⤵
  PID:16652
- C:\Windows\System\UcVQHtZ.exe
  C:\Windows\System\UcVQHtZ.exe
  2⤵
  PID:16672
- C:\Windows\System\QwbSLIT.exe
  C:\Windows\System\QwbSLIT.exe
  2⤵
  PID:16700
- C:\Windows\System\iabTZWB.exe
  C:\Windows\System\iabTZWB.exe
  2⤵
  PID:16716
- C:\Windows\System\UDBHQrw.exe
  C:\Windows\System\UDBHQrw.exe
  2⤵
  PID:16756
- C:\Windows\System\PssdMUM.exe
  C:\Windows\System\PssdMUM.exe
  2⤵
  PID:16776
- C:\Windows\System\ajzlPXP.exe
  C:\Windows\System\ajzlPXP.exe
  2⤵
  PID:16792
- C:\Windows\System\bORjQOY.exe
  C:\Windows\System\bORjQOY.exe
  2⤵
  PID:16820
- C:\Windows\System\KHPUSUS.exe
  C:\Windows\System\KHPUSUS.exe
  2⤵
  PID:16848
- C:\Windows\System\ZicLTVJ.exe
  C:\Windows\System\ZicLTVJ.exe
  2⤵
  PID:16868
- C:\Windows\System\eWhbxeL.exe
  C:\Windows\System\eWhbxeL.exe
  2⤵
  PID:16896
- C:\Windows\System\skugVcD.exe
  C:\Windows\System\skugVcD.exe
  2⤵
  PID:16912
- C:\Windows\System\NEoHHeS.exe
  C:\Windows\System\NEoHHeS.exe
  2⤵
  PID:16940
- C:\Windows\System\ApHwvfr.exe
  C:\Windows\System\ApHwvfr.exe
  2⤵
  PID:16964
- C:\Windows\System\FrTclAP.exe
  C:\Windows\System\FrTclAP.exe
  2⤵
  PID:17000
- C:\Windows\System\goZFbdE.exe
  C:\Windows\System\goZFbdE.exe
  2⤵
  PID:17028
- C:\Windows\System\ZRRAUVO.exe
  C:\Windows\System\ZRRAUVO.exe
  2⤵
  PID:17044
- C:\Windows\System\YDNAXcT.exe
  C:\Windows\System\YDNAXcT.exe
  2⤵
  PID:17060
- C:\Windows\System\BzXVxMn.exe
  C:\Windows\System\BzXVxMn.exe
  2⤵
  PID:17084
- C:\Windows\System\BOydbxD.exe
  C:\Windows\System\BOydbxD.exe
  2⤵
  PID:17116
- C:\Windows\System\YyrnVgE.exe
  C:\Windows\System\YyrnVgE.exe
  2⤵
  PID:17144
- C:\Windows\System\VDdbIMm.exe
  C:\Windows\System\VDdbIMm.exe
  2⤵
  PID:17168
- C:\Windows\System\CeGNGvJ.exe
  C:\Windows\System\CeGNGvJ.exe
  2⤵
  PID:17192
- C:\Windows\System\axDhqeO.exe
  C:\Windows\System\axDhqeO.exe
  2⤵
  PID:17216
- C:\Windows\System\HfuYLDh.exe
  C:\Windows\System\HfuYLDh.exe
  2⤵
  PID:17240
- C:\Windows\System\DBpiIeo.exe
  C:\Windows\System\DBpiIeo.exe
  2⤵
  PID:17260
- C:\Windows\System\vyYWtcM.exe
  C:\Windows\System\vyYWtcM.exe
  2⤵
  PID:17288
- C:\Windows\System\nPjswAB.exe
  C:\Windows\System\nPjswAB.exe
  2⤵
  PID:17332
- C:\Windows\System\FBaWGZQ.exe
  C:\Windows\System\FBaWGZQ.exe
  2⤵
  PID:17356
- C:\Windows\System\aRophYL.exe
  C:\Windows\System\aRophYL.exe
  2⤵
  PID:17376
- C:\Windows\System\yqrzHIb.exe
  C:\Windows\System\yqrzHIb.exe
  2⤵
  PID:17396
- C:\Windows\System\ZINCFmY.exe
  C:\Windows\System\ZINCFmY.exe
  2⤵
  PID:15656
- C:\Windows\System\OGrawEq.exe
  C:\Windows\System\OGrawEq.exe
  2⤵
  PID:15368
- C:\Windows\System\vHySGhI.exe
  C:\Windows\System\vHySGhI.exe
  2⤵
  PID:4480
- C:\Windows\System\nPBdKUm.exe
  C:\Windows\System\nPBdKUm.exe
  2⤵
  PID:16468
- C:\Windows\System\fVrvEyP.exe
  C:\Windows\System\fVrvEyP.exe
  2⤵
  PID:16548
- C:\Windows\System\uZIofqu.exe
  C:\Windows\System\uZIofqu.exe
  2⤵
  PID:17228
- C:\Windows\System\uBkvVYl.exe
  C:\Windows\System\uBkvVYl.exe
  2⤵
  PID:17136
- C:\Windows\System\fMbazgH.exe
  C:\Windows\System\fMbazgH.exe
  2⤵
  PID:17052
- C:\Windows\System\LWyLzOs.exe
  C:\Windows\System\LWyLzOs.exe
  2⤵
  PID:17252
- C:\Windows\System\VajbAsF.exe
  C:\Windows\System\VajbAsF.exe
  2⤵
  PID:17392
- C:\Windows\System\cNsriwS.exe
  C:\Windows\System\cNsriwS.exe
  2⤵
  PID:16624
- C:\Windows\System\KtNUlcR.exe
  C:\Windows\System\KtNUlcR.exe
  2⤵
  PID:548

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CIiPPlV.exe

Filesize
1.4MB

MD5
289e408c14a5c0342236c0747a803d14

SHA1
f8400878379c05f44e460bb779b2d8a1ddc1f9f9

SHA256
22c0b2dd6024fd4369c8ae3e339546cbd2dc7d74b9d7062c234ad55df94ff6d5

SHA512
b2cdf006828089d0de3466c21b42da75672da7ceccf466571cc4e4345d1b5fc14c066186013661a7e0f67ccb90971e4378b78d7dabfb30ae75349727a2a3e225

Download Submit
C:\Windows\System\CcBWLVu.exe

Filesize
1.4MB

MD5
0604777c036bb105cb05ab03a30290ae

SHA1
02cb43fab4165fdd83cae13d7a06f7624de73228

SHA256
b9692eee67f236712b0daff7730284a47243c1ec63134aff4fb8c1dfbd9f020e

SHA512
cb66ecdf414b0a89bff5448648d2e7ef6163f34423837ff3e647497fac1cbe4fdda66b3a7988d347cdc4bafb379e07d223f728e7d9bb6f96a1ebca5d98fa5a46

Download Submit
C:\Windows\System\DWFxWFq.exe

Filesize
1.4MB

MD5
dd86a24b0fceba41e4b3e61bc0095c91

SHA1
95293a557b36118fdc6bb521cdba54d0e4df20a3

SHA256
68ce1b74bb137b63f442c6ec67af1625fc48296dc8b3e643e9795e090ab36e2b

SHA512
f7ca8981f6bd21ce40b57d838a6fffeff6640b4a5d45b43ccf92c14b0745e5b5dfd22c6fbe30bc67accd7ff007b7633365918454469da2f1309f0b9ce5c0d3c8

Download Submit
C:\Windows\System\GucyWfF.exe

Filesize
1.4MB

MD5
502c78b7627379d42ebdd7129c43a5e6

SHA1
14c65cbc453847cc04460d3e55b869db70b647dc

SHA256
e04a0bf01b3667e80f3fbb14fd0c3494eb58c331500a02cde0e3eff5cc9d12f2

SHA512
6647bde71618d05c8b2a2170e0df22bc606bdda27836e8d796f916a08d3cf4967e10139489feabbfdf9c8e1bb7702686bb7e7d2c075222f4b93cd04e7e09cfd7

Download Submit
C:\Windows\System\HYKrRRd.exe

Filesize
1.4MB

MD5
a0b3e313b495d409bdbe55d06860b41a

SHA1
242f2144a09167cff388feb36d64c1ed1c07eba0

SHA256
1ffb43af46072d4a6269cc99cbcd325ad0d887397543b48fef343452363df8e7

SHA512
81bf16f582f552d5f72301e71ead364698a9ced3d62add0e744ebab54cfb2a963ba004d535fd2151966146be8587a0a44a08f0da181b5f42affd03c5431ce346

Download Submit
C:\Windows\System\ITuNRDK.exe

Filesize
1.4MB

MD5
82a3e42fc7eed3dfcd22067ceab6b233

SHA1
24e2061c7e96e66b3cfe5deae993fa916e6a609e

SHA256
2dfd786a930a2dd03428650e2ee4ba72bb2f3ef8516f575e71698d3cba967f35

SHA512
ee76dae5a7afb430cd7bfd30ce471ae8115f33eb1e44255a74fa1b65220789731591b2039d61c951192fc97bbfe5e1df64863788ce676aa090b2cf6541f790e0

Download Submit
C:\Windows\System\IcRIeAI.exe

Filesize
1.4MB

MD5
8358f1137696d88739213cab60846db6

SHA1
7b98f5457271bc4e7a5603fce65f43ab6691aeb8

SHA256
114f6d75cbefbbb64fe6f3eb3d81eb6bc98fcd135f4f4451f826cafd1c475b11

SHA512
8bda4d5f7e4b2b9f64a40db06fb4c27d3c5d3c013f159ba2c2a084f684eb8b74bcca87a73c68dd68300e30930f8a969e8c501ced309f37853cf8baff650d55e4

Download Submit
C:\Windows\System\IgpiJYo.exe

Filesize
1.4MB

MD5
826cfc626910571a042922c153d26210

SHA1
e2e83793f098d9fad88785d8c82594637829e354

SHA256
6edcdd12076765fc994574fb31a9c4efcf4227c2e6db6319c56dd4ad68dd3011

SHA512
74c54c87f9f7117a6eae4c95a74eb6c84828a4ccb7076484a45db87dcaa42176e12290777549c07e60c02a3df5a4a55f7d6eb2307f9e00c348c758b4cd780f4f

Download Submit
C:\Windows\System\JaenAgk.exe

Filesize
1.4MB

MD5
a859b17f27d0dad42231f53e0628bf35

SHA1
5e00c8864c29e52ca197e4cd4f95ef21d65cd802

SHA256
379b2965917e76eee02ff52355b7babe7a30c0f46b50be52769fc4a7fc4288d7

SHA512
83cc5d1f034f7882f34a6f2f0bbf72b165c354aff20129b22d165687ebeb5881b5209eb2cb2a015fe9098d48a1c41c8403bbdc11bcd8272640888f6b997575bc

Download Submit
C:\Windows\System\LSMTvZi.exe

Filesize
1.4MB

MD5
a5cd7a3c8640f8672c2fb365bea5c428

SHA1
b098cd52317024dc8d9934112c5cf57f777f7508

SHA256
3ccd48d0f2680872c7cfa53b76a474458367b1b46a3a9167e81d9397ecdbf59e

SHA512
ef7efab1a3f254562366ab979af54dba4c1c3e96b932efc9f887520de7ccccfbdd8bdc6320b97ba5442d29bb3616f73ac927ddfd42db56d5051d8de3d4b8f4e6

Download Submit
C:\Windows\System\PjaSNlC.exe

Filesize
1.4MB

MD5
ff0c5b04ba4a06ab3272761aa43d5b16

SHA1
6f6ff2509a109ebe2d2256f61a42ba8b7dc4ddff

SHA256
62b13bf3def4dab4cd9a587fa6e262e1a7f612f0ea9f73a148043e0bafc7a890

SHA512
ee2b1e78024f5c8fedd3ecb619d60c48f8ecd1c77e62fcc6c4b1cd737af26c20d630a0a8b88cbed2f4883e693412f14ba5fce334e6d2d6835cfc977a53f18c9e

Download Submit
C:\Windows\System\PshkkWf.exe

Filesize
1.4MB

MD5
a51e25a0dd2fa170329abdf1d7af6c99

SHA1
8c466d35969fbcfdff399411ed4e29f719e4ede1

SHA256
38845273224aaa0b9e152b16af36a3f2b6f3d0347ec647fb412795422ed5c3ea

SHA512
ee35a028ef40356ac1d1b1c038357f7e17741f009359cbad2f6dec8779fbba740655348ef0f418e596f71081bf944f378f2bd7132eb13c0d2842006b3c8e1cc6

Download Submit
C:\Windows\System\RfIfxZl.exe

Filesize
1.4MB

MD5
5b2e2c4a1ecf99d004c99fbdc441bb68

SHA1
49724b88e0abec2932257be4a3cae84724aa9b1b

SHA256
cb35d6af1835815561fa07d20c8d6c78f2519bd062c35bc87abf4894a6553075

SHA512
6250b5022569c58ff7ddadeb1adeeacd1237bbe0fab303662b0e1d9eb532bab426348db886666f7e966ccb1d683fa1ece75a3d10bde70527a5fe907ce6f5f848

Download Submit
C:\Windows\System\SXmBOXS.exe

Filesize
1.4MB

MD5
0f034cbd4047bb2a5250d7ac55e2b736

SHA1
fc65f348733b0e6be18d32c32d6f6e41594221b6

SHA256
22508ad1b1782177ca5ead1034533b315d378382255051e2e49e32aa24e79a88

SHA512
51eee35ccb3faf073aef4f66a7f3483d3bf9232b9dd8a5c2b659dbca7fada0bab7ed936a4d5b8fda38fee80c8603f46bc34518edeeb919e73991ec52685992f6

Download Submit
C:\Windows\System\TDqmiWX.exe

Filesize
1.4MB

MD5
8bf39aa96f70c73a71afa7185c813032

SHA1
d8b845ba062f6848972016e6fba32d765470d87d

SHA256
a0ca408d88b9181fa9fb83dd1a86132f55856fcab976cfbdafa155ee4c28c819

SHA512
2f5b8e0370889a1a5ad852d75ab61754930cf7377bb4c5998aac0e16f0f2ac2e3bfeae752950b8e4616a3358ef697d9a7b035aff01c4c8688d58aad54f399771

Download Submit
C:\Windows\System\TKMoPAO.exe

Filesize
1.4MB

MD5
35a95d85945a9bb276a1f2403c5b24d6

SHA1
f7a773ce2d10bc057e8605b1e56712563bcec145

SHA256
c9c33ab7c8bfdc7f2bedca0f03ecdf84d7a49e0d0aa7b85c9ed76a2231a20fa9

SHA512
6357b0336e988c65ec4d17444d4154eb39912836296ecc517bc482f0f38fb9cbd6829e5e0166a4aca4d8a90a52546749992ff02fb26c7464cf1c6ec330898fcc

Download Submit
C:\Windows\System\XvBcmoc.exe

Filesize
1.4MB

MD5
7f580cf615b7917f490d3fda65071d0e

SHA1
730462c43727f11a34919523653a944ae93c6149

SHA256
cb7123998a7f0aea871041d6b24204e00b03fb368dd1c9b18684833ff196ccf8

SHA512
138bae4e5b245ad3c11911ec4efb63ff4a1c7dbf7b5a2d75d64f60fda03eb09bcdab4dc0b7d366a6389c8729e36fad29deab82c56d070dc6f6c68a635600dc1f

Download Submit
C:\Windows\System\bNCZxIc.exe

Filesize
1.4MB

MD5
40c83f9876da257dadd979b1a9746e66

SHA1
89fa5c5758398af44d8cad6858f0fca20d6d1178

SHA256
e200f735e637cfe21c1817af052b2593c76d390d8f8658a08122aaf40e15e040

SHA512
ff72afa5a6a8fd14c6c9453e217f427b353a9acea8e1375a69689f7752bebc418f0d2511edf7b415a41bea673846b2168b4944439d0333587308f21c5fce7a2b

Download Submit
C:\Windows\System\bRLOUDU.exe

Filesize
1.4MB

MD5
561af289ed8c6f3df5e3e06985c54e78

SHA1
63435e13bd1f688a743833450ed69601bcc4ef4e

SHA256
ac05deca5155b051af7f77992ac2353266d668b1e8cee05bfb5dae14b5467a06

SHA512
537bf12a37b37c6bcb6a9227dbd10ba2545c694c67b482cf653d87e3a2ec00736fce6b57909a037162b4e13a8fff04655b0b3e981a9b8de903214a0ae91b941f

Download Submit
C:\Windows\System\cFhGpOR.exe

Filesize
1.4MB

MD5
b0b058f410138ac47156fdfc2f9dac9d

SHA1
3591f0ca7b7e091a30ba9003cb719edf7f309a5c

SHA256
c247c93b5678a19356ddb014400aafc34c35134f55d5f77dbf375ac0065d4464

SHA512
e7468dc20e9189da9dc093299037ad11f505329ccf1dc0457e56e349ef3c169626d961ef7cca712bc5d13a53b602cd930208d3555651553736d65b5003f4c7a9

Download Submit
C:\Windows\System\duOdyLr.exe

Filesize
1.4MB

MD5
512490b0037b46402c6a5c04e7ace5f6

SHA1
22714294ac3289c7ffa60302fdcf6d4921e58ae5

SHA256
a3a897504313fd33917b74953db8a727169052a857c5672fe48a10ab3e25fd36

SHA512
1638f7a31f98d2ca8d86cefb37577318418848af02c3d07eb279e2021c64231300df73a3daa829391b85104758c7f98d72d00fcbb882ad1795ed1c74e26b5616

Download Submit
C:\Windows\System\eJEKmpT.exe

Filesize
1.4MB

MD5
014d4cab775be50997c9ea8a55fdefcf

SHA1
e5aa9260c736693721a468622a93dfc5b08e0b77

SHA256
bbfa80b608bee0b1c6a5091338653037c8eb974a8d4301ce3154fec09b7c95ab

SHA512
55a80552bda700be5163fcffe3c1084f069a2f8e80bf00cded66f894ee71f355d21e9b858390ed9b448ff0e7b529b55afc9a102ad43c2cbaa803549345bff86d

Download Submit
C:\Windows\System\gAjNPUu.exe

Filesize
1.4MB

MD5
1edef1591173c3c292e7c6017ecf1aff

SHA1
01dc475ca70b6157b740c1fc284a1598e7b3a9a3

SHA256
5c0a73233e19f61cdb3085f8676e7791e3b29aedb66b8ba17e2430f8ebc45a82

SHA512
2a38151cc2c3b46f11c25bbf30d0c9ed3941b057f9178cc3d2e9ef356a3375afe5f9dfb9dfb674b86a8286a80e6d52084db2d766326793a16ac52da047fac9e3

Download Submit
C:\Windows\System\gkQYxTG.exe

Filesize
1.4MB

MD5
fb0e0acf7ca85f37c7a5c4ca25c7b63b

SHA1
694eec6eb3102fc0f59b94eccc9655ec1a3bd9b5

SHA256
acdc601b41e43c7b41f0ff7c2342ccd8dfa4432668a07df7fe2eb0e24286c923

SHA512
ff555a345fad8297d8fd95259ca8289022fb616971ac896a0603d5e24595545e91936a4396111549536af0f4e7c5c9b807416a496288fa00b64e6f0fb93df605

Download Submit
C:\Windows\System\jPfKQKh.exe

Filesize
1.4MB

MD5
0808315553e6b2a1eb41f31c39605db2

SHA1
72343a3695368b07a88ae12805108d18cc9d45b4

SHA256
d675c83cba78d19ae483c607788ba7c9626ae23600aa9ac8f15f07ceb33e5628

SHA512
af5d61b147340b4f2532264315292c8165c50ac89e5569106bebcd2d3b500f480d237741c2413303ed65aee1a74fb1219db0c71124cb219a9523dac3c69a2d1f

Download Submit
C:\Windows\System\mQBSAXm.exe

Filesize
1.4MB

MD5
bdb937e04a9a5c3ab90fed1cb21f88a3

SHA1
5f7b82aa368465be992611068e1fb1dd8e3c32c0

SHA256
56ed5369a58e46c2a34ef69267e5f8c524f5130e14b925f064ac4029cc5a51d7

SHA512
4648f182ae8029cbe9b82d8b9fc98a6a055e0507f01b12e25efdc1d6ad2be8e522a578ea88c3181b9e7278a99d0bb06929a557dacaf9dbee70480fbb0e39e169

Download Submit
C:\Windows\System\nLQjigX.exe

Filesize
1.4MB

MD5
972f752a2bbab2ded57db2b69d673897

SHA1
bcc9bc212f0a167b984976f3a303500093addf7c

SHA256
052e2ddd43d5f6829d7b51ba8d1347c2a62198c1f215c950fa030609ab080f4c

SHA512
783eb170ea678195f033eb7e2051e220e4a1130b8d5928d50f8d64652490134c4c956939ac39d2d12d13c7dbaf916c54f1d18fe5d8f9e936b453b3d3fae4e939

Download Submit
C:\Windows\System\nQLvwhq.exe

Filesize
1.4MB

MD5
cf1e448cce147c92a8cfdf0525989cec

SHA1
5f9939af3aaf7b47ec8a138e61d8d89a59fbbef5

SHA256
08040dfeecc1a489ee6e0f6a026eb88528871b186d4acc8b929ccf8fd991668e

SHA512
d6d6f75517f2e7a8d0f9ed1e815486226258bed15bc4967acc050890ae2657279f63f4929e41dbc1ba5f77617cde69518b6328d516c546a0c2a5661d62a87c61

Download Submit
C:\Windows\System\oiQYqJU.exe

Filesize
1.4MB

MD5
1959a715699e218a9be78c210d380ed1

SHA1
4cec4a83c7bf9a7c58ea9040dbea60086aa0da8c

SHA256
86da6650cf9bf362e5e921dd262cb6bb9327be6480b392b6e59a1555bb12eaa8

SHA512
4ab4c4681b7acc4b18cab91ce3f2b944be2114abe55514affb71823d1d776e10be9b198be0f3ec7da48810cfbd57bbcc808d8b049af613088d4436e53e65ee30

Download Submit
C:\Windows\System\wjQeEun.exe

Filesize
1.4MB

MD5
447c126f654a9833728716ea93a12094

SHA1
b6aeae0c6a05192f503861034858a8079501038c

SHA256
74edfa27cb9634e0197f995ebec780ef03d9acb7811b24a2a038a387075d6792

SHA512
9e5394454726d7ab088233e06c5d74500078a91a30ceabbce3dd6034e8ae36f9d2c9b035b11f4fbbb190ba9ef2efb2a218b4d28afef65796ffadd8b9caaf6780

Download Submit
C:\Windows\System\xBYhogA.exe

Filesize
1.4MB

MD5
1e3501d510797f1f55853b5daaef290d

SHA1
73baf405a111b36e79343a1f1abf1c0bf193e009

SHA256
f3c9df7fde9e242f73527b02d5597e70c5e11259acc1d20318c2360a460328fb

SHA512
f5d77542b94c8b6bd23ec2e3e343446ccd9414747efd2402ccb3614daf778d388b4e56b8a54e4699d706be81c3bc0ba9afe4ebeaa77f8c56b0f3c2d7269c24cb

Download Submit
C:\Windows\System\yGzNokn.exe

Filesize
1.4MB

MD5
3566745a474613e565f158a156edb118

SHA1
2fd693a8184a88804e8817bc05e85ee30c62c3c9

SHA256
ac82a744abaa67ffd09007ad4c9b4c392cfd16e65483980445630e5caae526d1

SHA512
ae836410a1b2230764a194967a77328f8e3c9152c45636c8890fe27ec032f69e865c401389d2d4965bdaf7b2a60a8cd7bcc94e66421e4a816b551b9b8b85a4ef

Download Submit
memory/4756-0-0x00000243B6BD0000-0x00000243B6BE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads