xmrig | 94889ad4fc4def968633972443bed58f0511c35e9b6c326a02647f9a26ad6ab3

Analysis

max time kernel
132s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
Size

1.1MB
MD5

ae6355ccfd9ceb71b432e0c11ae60c50
SHA1

16d9a2da6844bebe39f514c08d7c05d61fe1e931
SHA256

94889ad4fc4def968633972443bed58f0511c35e9b6c326a02647f9a26ad6ab3
SHA512

f41f56cbc6d6777cc9863076696926a8ea23f0470c2dda8d295ff2281ea412311e3d56bc4b126740b79f53e09e89e32a3989f086559500de3d400124c8b8fe8c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenszl66bwW7:GezaTF8FcNkNdfE0pZ9oztFwIRv

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000022f51-4.dat	xmrig
behavioral2/files/0x00080000000233e4-13.dat	xmrig
behavioral2/files/0x00070000000233e6-19.dat	xmrig
behavioral2/files/0x00070000000233e7-27.dat	xmrig
behavioral2/files/0x00070000000233ea-43.dat	xmrig
behavioral2/files/0x00070000000233f6-97.dat	xmrig
behavioral2/files/0x00070000000233fc-135.dat	xmrig
behavioral2/files/0x0007000000023403-162.dat	xmrig
behavioral2/files/0x0007000000023401-160.dat	xmrig
behavioral2/files/0x0007000000023402-157.dat	xmrig
behavioral2/files/0x0007000000023400-155.dat	xmrig
behavioral2/files/0x00070000000233ff-150.dat	xmrig
behavioral2/files/0x00070000000233fe-145.dat	xmrig
behavioral2/files/0x00070000000233fd-140.dat	xmrig
behavioral2/files/0x00070000000233fb-130.dat	xmrig
behavioral2/files/0x00070000000233fa-125.dat	xmrig
behavioral2/files/0x00070000000233f9-120.dat	xmrig
behavioral2/files/0x00070000000233f8-115.dat	xmrig
behavioral2/files/0x00070000000233f7-110.dat	xmrig
behavioral2/files/0x00070000000233f5-100.dat	xmrig
behavioral2/files/0x00070000000233f4-92.dat	xmrig
behavioral2/files/0x00070000000233f3-88.dat	xmrig
behavioral2/files/0x00070000000233f2-83.dat	xmrig
behavioral2/files/0x00070000000233f1-77.dat	xmrig
behavioral2/files/0x00070000000233f0-73.dat	xmrig
behavioral2/files/0x00070000000233ef-67.dat	xmrig
behavioral2/files/0x00070000000233ee-63.dat	xmrig
behavioral2/files/0x00070000000233ed-57.dat	xmrig
behavioral2/files/0x00070000000233ec-53.dat	xmrig
behavioral2/files/0x00070000000233eb-47.dat	xmrig
behavioral2/files/0x00070000000233e9-37.dat	xmrig
behavioral2/files/0x00070000000233e8-33.dat	xmrig
behavioral2/files/0x00070000000233e5-14.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2344	cpASgYP.exe
3240	OaFEkie.exe
1044	jPfzhGd.exe
1716	qaDZSuy.exe
2084	NBkMrcU.exe
2232	vyTjErU.exe
2200	EgBFcqc.exe
3388	DMosHtW.exe
4856	PqFaXmC.exe
4828	ZWsAATD.exe
8	OvUhYgp.exe
4052	BjdgmcB.exe
4592	pTlSRVd.exe
2860	teyHwZi.exe
2128	KwaWrHW.exe
4968	NLpJWKt.exe
2520	ShovDNu.exe
1412	eEjdkgF.exe
4212	QhkFxml.exe
1860	lKhdkBz.exe
4364	KUMrKPN.exe
5112	OtzQBum.exe
5104	qHkBgJE.exe
2856	OZQFbbd.exe
4356	jSJiMBo.exe
2396	MniIOTq.exe
2812	DSJqezg.exe
612	YouMBgO.exe
1104	KAMgJwT.exe
4488	GOKJxJw.exe
2300	eTUKBJI.exe
4268	FtxRlbv.exe
1744	WQTORBB.exe
4876	yYVLhmb.exe
4744	PtWepMw.exe
3992	jxOFwpk.exe
3360	mGLtmPc.exe
1140	TeRIoLD.exe
4956	JQzSbOB.exe
3948	omtMDOH.exe
3964	KDkQgny.exe
3392	VNnXBvo.exe
1132	ByPjjPm.exe
4880	MaaQExb.exe
5024	qYtkUsD.exe
4556	tQJxelh.exe
1432	mdSiERk.exe
4784	yqDlXtx.exe
564	UGtQlrT.exe
4552	rHnqNFA.exe
4624	aNhksxo.exe
892	VIvLxvS.exe
1736	pahisPJ.exe
1108	fnHqyfh.exe
3612	CJDgXjE.exe
1344	sPGjPIh.exe
3320	EjDjWyp.exe
2424	plWAsfG.exe
956	JhGdAxk.exe
4596	RDewopi.exe
2144	wWwZtjc.exe
3316	grOtCKG.exe
516	PeiILBe.exe
4704	NNeCgij.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zlLfnTI.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\WQyzlAT.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\jkYSfQZ.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\IKxSeel.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\PtWepMw.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\lKZwrgR.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\dlrJidx.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\CkROGOy.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\NufExNk.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\virqiXn.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\bvhbFoJ.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\OlkKGHL.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\DUGrJte.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\veGXUhv.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\HQIcYKc.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\VpejSWn.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\AZzEQvU.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\XzaSCFi.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\DMosHtW.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\PXAuEWw.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\KtHIrvF.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\uxiPcsr.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\NLpJWKt.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\JHrSqOd.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\eOOJiyH.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\iudeeXC.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\mKEIqEh.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\riYRidA.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\xLUofSJ.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\SsLmCQs.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\UYjsuHv.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\yqmQfBk.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\JhGdAxk.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\PwrGFJx.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\ZcZgpQJ.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\xYwpFYQ.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\NnAdQQy.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\osCwjXQ.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\LYwusaM.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\NTczDkZ.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\HBczZgv.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\JQzSbOB.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\rXSwxsC.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\jYjAgpq.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\ydZNOau.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\tetFpfw.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\vprzwOK.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\oKEiQUw.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\cqtMonY.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\GQApAMA.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\kbiyLpS.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\VzJXrVf.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\WSUBShv.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\fGfhwMG.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\ECcCdNo.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\gjbVZUC.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\yRNJvrV.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\MOnOGfN.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\jxOFwpk.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\fMHKGPE.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\ZLcggdR.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\WyNyUpZ.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\cUrSSKF.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
File created	C:\Windows\System\mGAfYCa.exe	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16800	dwm.exe
Token: SeChangeNotifyPrivilege	16800	dwm.exe
Token: 33	16800	dwm.exe
Token: SeIncBasePriorityPrivilege	16800	dwm.exe
Token: SeCreateGlobalPrivilege	17016	dwm.exe
Token: SeChangeNotifyPrivilege	17016	dwm.exe
Token: 33	17016	dwm.exe
Token: SeIncBasePriorityPrivilege	17016	dwm.exe
Token: SeShutdownPrivilege	17016	dwm.exe
Token: SeCreatePagefilePrivilege	17016	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2344	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	83
PID 3908 wrote to memory of 2344	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	83
PID 3908 wrote to memory of 3240	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	84
PID 3908 wrote to memory of 3240	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	84
PID 3908 wrote to memory of 1044	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	85
PID 3908 wrote to memory of 1044	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	85
PID 3908 wrote to memory of 1716	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	86
PID 3908 wrote to memory of 1716	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	86
PID 3908 wrote to memory of 2084	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	87
PID 3908 wrote to memory of 2084	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	87
PID 3908 wrote to memory of 2232	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	88
PID 3908 wrote to memory of 2232	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	88
PID 3908 wrote to memory of 2200	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	89
PID 3908 wrote to memory of 2200	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	89
PID 3908 wrote to memory of 3388	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	90
PID 3908 wrote to memory of 3388	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	90
PID 3908 wrote to memory of 4856	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	91
PID 3908 wrote to memory of 4856	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	91
PID 3908 wrote to memory of 4828	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	92
PID 3908 wrote to memory of 4828	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	92
PID 3908 wrote to memory of 8	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	93
PID 3908 wrote to memory of 8	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	93
PID 3908 wrote to memory of 4052	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	94
PID 3908 wrote to memory of 4052	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	94
PID 3908 wrote to memory of 4592	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	95
PID 3908 wrote to memory of 4592	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	95
PID 3908 wrote to memory of 2860	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	96
PID 3908 wrote to memory of 2860	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	96
PID 3908 wrote to memory of 2128	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	97
PID 3908 wrote to memory of 2128	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	97
PID 3908 wrote to memory of 4968	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	98
PID 3908 wrote to memory of 4968	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	98
PID 3908 wrote to memory of 2520	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	99
PID 3908 wrote to memory of 2520	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	99
PID 3908 wrote to memory of 1412	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	100
PID 3908 wrote to memory of 1412	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	100
PID 3908 wrote to memory of 4212	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	101
PID 3908 wrote to memory of 4212	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	101
PID 3908 wrote to memory of 1860	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	102
PID 3908 wrote to memory of 1860	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	102
PID 3908 wrote to memory of 4364	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	103
PID 3908 wrote to memory of 4364	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	103
PID 3908 wrote to memory of 5112	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	104
PID 3908 wrote to memory of 5112	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	104
PID 3908 wrote to memory of 5104	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	105
PID 3908 wrote to memory of 5104	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	105
PID 3908 wrote to memory of 2856	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	106
PID 3908 wrote to memory of 2856	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	106
PID 3908 wrote to memory of 4356	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	107
PID 3908 wrote to memory of 4356	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	107
PID 3908 wrote to memory of 2396	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	108
PID 3908 wrote to memory of 2396	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	108
PID 3908 wrote to memory of 2812	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	109
PID 3908 wrote to memory of 2812	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	109
PID 3908 wrote to memory of 612	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	110
PID 3908 wrote to memory of 612	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	110
PID 3908 wrote to memory of 1104	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	111
PID 3908 wrote to memory of 1104	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	111
PID 3908 wrote to memory of 4488	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	112
PID 3908 wrote to memory of 4488	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	112
PID 3908 wrote to memory of 2300	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	113
PID 3908 wrote to memory of 2300	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	113
PID 3908 wrote to memory of 4268	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	114
PID 3908 wrote to memory of 4268	3908	ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ae6355ccfd9ceb71b432e0c11ae60c50_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\System\cpASgYP.exe
  C:\Windows\System\cpASgYP.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\OaFEkie.exe
  C:\Windows\System\OaFEkie.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\jPfzhGd.exe
  C:\Windows\System\jPfzhGd.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\qaDZSuy.exe
  C:\Windows\System\qaDZSuy.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\NBkMrcU.exe
  C:\Windows\System\NBkMrcU.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\vyTjErU.exe
  C:\Windows\System\vyTjErU.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\EgBFcqc.exe
  C:\Windows\System\EgBFcqc.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\DMosHtW.exe
  C:\Windows\System\DMosHtW.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\PqFaXmC.exe
  C:\Windows\System\PqFaXmC.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\ZWsAATD.exe
  C:\Windows\System\ZWsAATD.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\OvUhYgp.exe
  C:\Windows\System\OvUhYgp.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\BjdgmcB.exe
  C:\Windows\System\BjdgmcB.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\pTlSRVd.exe
  C:\Windows\System\pTlSRVd.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\teyHwZi.exe
  C:\Windows\System\teyHwZi.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\KwaWrHW.exe
  C:\Windows\System\KwaWrHW.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\NLpJWKt.exe
  C:\Windows\System\NLpJWKt.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\ShovDNu.exe
  C:\Windows\System\ShovDNu.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\eEjdkgF.exe
  C:\Windows\System\eEjdkgF.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\QhkFxml.exe
  C:\Windows\System\QhkFxml.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\lKhdkBz.exe
  C:\Windows\System\lKhdkBz.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\KUMrKPN.exe
  C:\Windows\System\KUMrKPN.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\OtzQBum.exe
  C:\Windows\System\OtzQBum.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\qHkBgJE.exe
  C:\Windows\System\qHkBgJE.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\OZQFbbd.exe
  C:\Windows\System\OZQFbbd.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\jSJiMBo.exe
  C:\Windows\System\jSJiMBo.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\MniIOTq.exe
  C:\Windows\System\MniIOTq.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\DSJqezg.exe
  C:\Windows\System\DSJqezg.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\YouMBgO.exe
  C:\Windows\System\YouMBgO.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\KAMgJwT.exe
  C:\Windows\System\KAMgJwT.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\GOKJxJw.exe
  C:\Windows\System\GOKJxJw.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\eTUKBJI.exe
  C:\Windows\System\eTUKBJI.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\FtxRlbv.exe
  C:\Windows\System\FtxRlbv.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\WQTORBB.exe
  C:\Windows\System\WQTORBB.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\yYVLhmb.exe
  C:\Windows\System\yYVLhmb.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\PtWepMw.exe
  C:\Windows\System\PtWepMw.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\jxOFwpk.exe
  C:\Windows\System\jxOFwpk.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\mGLtmPc.exe
  C:\Windows\System\mGLtmPc.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\TeRIoLD.exe
  C:\Windows\System\TeRIoLD.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\JQzSbOB.exe
  C:\Windows\System\JQzSbOB.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\omtMDOH.exe
  C:\Windows\System\omtMDOH.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\KDkQgny.exe
  C:\Windows\System\KDkQgny.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\VNnXBvo.exe
  C:\Windows\System\VNnXBvo.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\ByPjjPm.exe
  C:\Windows\System\ByPjjPm.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\MaaQExb.exe
  C:\Windows\System\MaaQExb.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\qYtkUsD.exe
  C:\Windows\System\qYtkUsD.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\tQJxelh.exe
  C:\Windows\System\tQJxelh.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\mdSiERk.exe
  C:\Windows\System\mdSiERk.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\yqDlXtx.exe
  C:\Windows\System\yqDlXtx.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\UGtQlrT.exe
  C:\Windows\System\UGtQlrT.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\rHnqNFA.exe
  C:\Windows\System\rHnqNFA.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\aNhksxo.exe
  C:\Windows\System\aNhksxo.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\VIvLxvS.exe
  C:\Windows\System\VIvLxvS.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\pahisPJ.exe
  C:\Windows\System\pahisPJ.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\fnHqyfh.exe
  C:\Windows\System\fnHqyfh.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\CJDgXjE.exe
  C:\Windows\System\CJDgXjE.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\sPGjPIh.exe
  C:\Windows\System\sPGjPIh.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\EjDjWyp.exe
  C:\Windows\System\EjDjWyp.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\plWAsfG.exe
  C:\Windows\System\plWAsfG.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\JhGdAxk.exe
  C:\Windows\System\JhGdAxk.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\RDewopi.exe
  C:\Windows\System\RDewopi.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\wWwZtjc.exe
  C:\Windows\System\wWwZtjc.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\grOtCKG.exe
  C:\Windows\System\grOtCKG.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\PeiILBe.exe
  C:\Windows\System\PeiILBe.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\NNeCgij.exe
  C:\Windows\System\NNeCgij.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\PHotFYI.exe
  C:\Windows\System\PHotFYI.exe
  2⤵
  PID:536
- C:\Windows\System\ZBIkklf.exe
  C:\Windows\System\ZBIkklf.exe
  2⤵
  PID:4368
- C:\Windows\System\GGvcVwN.exe
  C:\Windows\System\GGvcVwN.exe
  2⤵
  PID:2348
- C:\Windows\System\XVbQGko.exe
  C:\Windows\System\XVbQGko.exe
  2⤵
  PID:1172
- C:\Windows\System\cqDXTUq.exe
  C:\Windows\System\cqDXTUq.exe
  2⤵
  PID:1544
- C:\Windows\System\irpFkWE.exe
  C:\Windows\System\irpFkWE.exe
  2⤵
  PID:1120
- C:\Windows\System\rTSqBEo.exe
  C:\Windows\System\rTSqBEo.exe
  2⤵
  PID:3364
- C:\Windows\System\RAOTUnp.exe
  C:\Windows\System\RAOTUnp.exe
  2⤵
  PID:4304
- C:\Windows\System\NaBhNUl.exe
  C:\Windows\System\NaBhNUl.exe
  2⤵
  PID:3988
- C:\Windows\System\BAGcmbk.exe
  C:\Windows\System\BAGcmbk.exe
  2⤵
  PID:4476
- C:\Windows\System\fMHKGPE.exe
  C:\Windows\System\fMHKGPE.exe
  2⤵
  PID:224
- C:\Windows\System\gEzqskn.exe
  C:\Windows\System\gEzqskn.exe
  2⤵
  PID:1452
- C:\Windows\System\SdDYKBA.exe
  C:\Windows\System\SdDYKBA.exe
  2⤵
  PID:4344
- C:\Windows\System\QIPDvaP.exe
  C:\Windows\System\QIPDvaP.exe
  2⤵
  PID:1436
- C:\Windows\System\bsiMGxS.exe
  C:\Windows\System\bsiMGxS.exe
  2⤵
  PID:1036
- C:\Windows\System\vaILjHI.exe
  C:\Windows\System\vaILjHI.exe
  2⤵
  PID:412
- C:\Windows\System\vprzwOK.exe
  C:\Windows\System\vprzwOK.exe
  2⤵
  PID:5148
- C:\Windows\System\FElLcaJ.exe
  C:\Windows\System\FElLcaJ.exe
  2⤵
  PID:5180
- C:\Windows\System\BrZOPZf.exe
  C:\Windows\System\BrZOPZf.exe
  2⤵
  PID:5204
- C:\Windows\System\Etiiuyu.exe
  C:\Windows\System\Etiiuyu.exe
  2⤵
  PID:5232
- C:\Windows\System\IEpzGJC.exe
  C:\Windows\System\IEpzGJC.exe
  2⤵
  PID:5260
- C:\Windows\System\ZMzKZGk.exe
  C:\Windows\System\ZMzKZGk.exe
  2⤵
  PID:5288
- C:\Windows\System\NMJaahA.exe
  C:\Windows\System\NMJaahA.exe
  2⤵
  PID:5316
- C:\Windows\System\MpJnLnj.exe
  C:\Windows\System\MpJnLnj.exe
  2⤵
  PID:5344
- C:\Windows\System\mVlSHpM.exe
  C:\Windows\System\mVlSHpM.exe
  2⤵
  PID:5372
- C:\Windows\System\kaYQoXk.exe
  C:\Windows\System\kaYQoXk.exe
  2⤵
  PID:5400
- C:\Windows\System\WVlvGVv.exe
  C:\Windows\System\WVlvGVv.exe
  2⤵
  PID:5428
- C:\Windows\System\UIsbgyg.exe
  C:\Windows\System\UIsbgyg.exe
  2⤵
  PID:5456
- C:\Windows\System\rKJkLzu.exe
  C:\Windows\System\rKJkLzu.exe
  2⤵
  PID:5484
- C:\Windows\System\ZjTbOul.exe
  C:\Windows\System\ZjTbOul.exe
  2⤵
  PID:5512
- C:\Windows\System\nhiVIXf.exe
  C:\Windows\System\nhiVIXf.exe
  2⤵
  PID:5540
- C:\Windows\System\GHLMBFR.exe
  C:\Windows\System\GHLMBFR.exe
  2⤵
  PID:5568
- C:\Windows\System\dnDvcou.exe
  C:\Windows\System\dnDvcou.exe
  2⤵
  PID:5596
- C:\Windows\System\OOcJoBB.exe
  C:\Windows\System\OOcJoBB.exe
  2⤵
  PID:5620
- C:\Windows\System\sHCPsKB.exe
  C:\Windows\System\sHCPsKB.exe
  2⤵
  PID:5652
- C:\Windows\System\NdheKHW.exe
  C:\Windows\System\NdheKHW.exe
  2⤵
  PID:5680
- C:\Windows\System\xAVcbRt.exe
  C:\Windows\System\xAVcbRt.exe
  2⤵
  PID:5708
- C:\Windows\System\Ydfsypr.exe
  C:\Windows\System\Ydfsypr.exe
  2⤵
  PID:5736
- C:\Windows\System\veGXUhv.exe
  C:\Windows\System\veGXUhv.exe
  2⤵
  PID:5764
- C:\Windows\System\cwjeiAs.exe
  C:\Windows\System\cwjeiAs.exe
  2⤵
  PID:5792
- C:\Windows\System\gXemaaU.exe
  C:\Windows\System\gXemaaU.exe
  2⤵
  PID:5820
- C:\Windows\System\gTDADNA.exe
  C:\Windows\System\gTDADNA.exe
  2⤵
  PID:5848
- C:\Windows\System\ewhSSob.exe
  C:\Windows\System\ewhSSob.exe
  2⤵
  PID:5876
- C:\Windows\System\qDRWShH.exe
  C:\Windows\System\qDRWShH.exe
  2⤵
  PID:5904
- C:\Windows\System\JsTtgjc.exe
  C:\Windows\System\JsTtgjc.exe
  2⤵
  PID:5928
- C:\Windows\System\TPLWReM.exe
  C:\Windows\System\TPLWReM.exe
  2⤵
  PID:5956
- C:\Windows\System\ZqJLVaM.exe
  C:\Windows\System\ZqJLVaM.exe
  2⤵
  PID:5988
- C:\Windows\System\BelLQnU.exe
  C:\Windows\System\BelLQnU.exe
  2⤵
  PID:6016
- C:\Windows\System\PXAuEWw.exe
  C:\Windows\System\PXAuEWw.exe
  2⤵
  PID:6044
- C:\Windows\System\smCrxau.exe
  C:\Windows\System\smCrxau.exe
  2⤵
  PID:6072
- C:\Windows\System\ZeSoUUT.exe
  C:\Windows\System\ZeSoUUT.exe
  2⤵
  PID:6100
- C:\Windows\System\oRoaNOV.exe
  C:\Windows\System\oRoaNOV.exe
  2⤵
  PID:6132
- C:\Windows\System\wLFGgeK.exe
  C:\Windows\System\wLFGgeK.exe
  2⤵
  PID:2988
- C:\Windows\System\DgTysus.exe
  C:\Windows\System\DgTysus.exe
  2⤵
  PID:4292
- C:\Windows\System\EmFFBTS.exe
  C:\Windows\System\EmFFBTS.exe
  2⤵
  PID:2768
- C:\Windows\System\cuKcbtl.exe
  C:\Windows\System\cuKcbtl.exe
  2⤵
  PID:5028
- C:\Windows\System\xaBTFWH.exe
  C:\Windows\System\xaBTFWH.exe
  2⤵
  PID:4884
- C:\Windows\System\JcqEbRg.exe
  C:\Windows\System\JcqEbRg.exe
  2⤵
  PID:2156
- C:\Windows\System\GcYbAZq.exe
  C:\Windows\System\GcYbAZq.exe
  2⤵
  PID:1204
- C:\Windows\System\TfgLwre.exe
  C:\Windows\System\TfgLwre.exe
  2⤵
  PID:3944
- C:\Windows\System\SPqEmBt.exe
  C:\Windows\System\SPqEmBt.exe
  2⤵
  PID:3300
- C:\Windows\System\jkYSfQZ.exe
  C:\Windows\System\jkYSfQZ.exe
  2⤵
  PID:5188
- C:\Windows\System\NhbkkiS.exe
  C:\Windows\System\NhbkkiS.exe
  2⤵
  PID:5248
- C:\Windows\System\yUhKRyw.exe
  C:\Windows\System\yUhKRyw.exe
  2⤵
  PID:5308
- C:\Windows\System\eoXwiSW.exe
  C:\Windows\System\eoXwiSW.exe
  2⤵
  PID:5384
- C:\Windows\System\bWPdqvC.exe
  C:\Windows\System\bWPdqvC.exe
  2⤵
  PID:5420
- C:\Windows\System\JzPTqWw.exe
  C:\Windows\System\JzPTqWw.exe
  2⤵
  PID:5476
- C:\Windows\System\OXKHeAe.exe
  C:\Windows\System\OXKHeAe.exe
  2⤵
  PID:5552
- C:\Windows\System\QALfpXv.exe
  C:\Windows\System\QALfpXv.exe
  2⤵
  PID:5612
- C:\Windows\System\HXSXrvM.exe
  C:\Windows\System\HXSXrvM.exe
  2⤵
  PID:5672
- C:\Windows\System\UpWGBUc.exe
  C:\Windows\System\UpWGBUc.exe
  2⤵
  PID:5752
- C:\Windows\System\YREJGgf.exe
  C:\Windows\System\YREJGgf.exe
  2⤵
  PID:5808
- C:\Windows\System\lKZwrgR.exe
  C:\Windows\System\lKZwrgR.exe
  2⤵
  PID:5868
- C:\Windows\System\ICvGYOk.exe
  C:\Windows\System\ICvGYOk.exe
  2⤵
  PID:5944
- C:\Windows\System\ECcCdNo.exe
  C:\Windows\System\ECcCdNo.exe
  2⤵
  PID:6004
- C:\Windows\System\dlrJidx.exe
  C:\Windows\System\dlrJidx.exe
  2⤵
  PID:6068
- C:\Windows\System\rXSwxsC.exe
  C:\Windows\System\rXSwxsC.exe
  2⤵
  PID:6140
- C:\Windows\System\dquUbbB.exe
  C:\Windows\System\dquUbbB.exe
  2⤵
  PID:6164
- C:\Windows\System\ifQbpsj.exe
  C:\Windows\System\ifQbpsj.exe
  2⤵
  PID:6192
- C:\Windows\System\ijIeGzi.exe
  C:\Windows\System\ijIeGzi.exe
  2⤵
  PID:6220
- C:\Windows\System\nMcaBky.exe
  C:\Windows\System\nMcaBky.exe
  2⤵
  PID:6248
- C:\Windows\System\zlLfnTI.exe
  C:\Windows\System\zlLfnTI.exe
  2⤵
  PID:6280
- C:\Windows\System\dafKTHD.exe
  C:\Windows\System\dafKTHD.exe
  2⤵
  PID:6304
- C:\Windows\System\FnZcgsB.exe
  C:\Windows\System\FnZcgsB.exe
  2⤵
  PID:6332
- C:\Windows\System\TOYUzGJ.exe
  C:\Windows\System\TOYUzGJ.exe
  2⤵
  PID:6360
- C:\Windows\System\pWPYojI.exe
  C:\Windows\System\pWPYojI.exe
  2⤵
  PID:6388
- C:\Windows\System\uZscDdE.exe
  C:\Windows\System\uZscDdE.exe
  2⤵
  PID:6416
- C:\Windows\System\GDiuKkV.exe
  C:\Windows\System\GDiuKkV.exe
  2⤵
  PID:6448
- C:\Windows\System\usUOxyQ.exe
  C:\Windows\System\usUOxyQ.exe
  2⤵
  PID:6484
- C:\Windows\System\kJhKgmp.exe
  C:\Windows\System\kJhKgmp.exe
  2⤵
  PID:6508
- C:\Windows\System\jAaKrHo.exe
  C:\Windows\System\jAaKrHo.exe
  2⤵
  PID:6528
- C:\Windows\System\GrYnngi.exe
  C:\Windows\System\GrYnngi.exe
  2⤵
  PID:6560
- C:\Windows\System\jVHvSEA.exe
  C:\Windows\System\jVHvSEA.exe
  2⤵
  PID:6584
- C:\Windows\System\CUaYqpb.exe
  C:\Windows\System\CUaYqpb.exe
  2⤵
  PID:6612
- C:\Windows\System\dKuXPrf.exe
  C:\Windows\System\dKuXPrf.exe
  2⤵
  PID:6640
- C:\Windows\System\wDFprHh.exe
  C:\Windows\System\wDFprHh.exe
  2⤵
  PID:6668
- C:\Windows\System\SCVMPgc.exe
  C:\Windows\System\SCVMPgc.exe
  2⤵
  PID:6696
- C:\Windows\System\zlYSMrB.exe
  C:\Windows\System\zlYSMrB.exe
  2⤵
  PID:6724
- C:\Windows\System\QyjdsrS.exe
  C:\Windows\System\QyjdsrS.exe
  2⤵
  PID:6752
- C:\Windows\System\FRIvUpA.exe
  C:\Windows\System\FRIvUpA.exe
  2⤵
  PID:6780
- C:\Windows\System\JHrSqOd.exe
  C:\Windows\System\JHrSqOd.exe
  2⤵
  PID:6808
- C:\Windows\System\RLjUAwE.exe
  C:\Windows\System\RLjUAwE.exe
  2⤵
  PID:6836
- C:\Windows\System\jYjAgpq.exe
  C:\Windows\System\jYjAgpq.exe
  2⤵
  PID:6864
- C:\Windows\System\EIRmLgj.exe
  C:\Windows\System\EIRmLgj.exe
  2⤵
  PID:6892
- C:\Windows\System\PziBPyG.exe
  C:\Windows\System\PziBPyG.exe
  2⤵
  PID:6920
- C:\Windows\System\jejbemv.exe
  C:\Windows\System\jejbemv.exe
  2⤵
  PID:6948
- C:\Windows\System\virqiXn.exe
  C:\Windows\System\virqiXn.exe
  2⤵
  PID:6976
- C:\Windows\System\GDqJcXY.exe
  C:\Windows\System\GDqJcXY.exe
  2⤵
  PID:7004
- C:\Windows\System\MVjgumr.exe
  C:\Windows\System\MVjgumr.exe
  2⤵
  PID:7032
- C:\Windows\System\yIIOUIg.exe
  C:\Windows\System\yIIOUIg.exe
  2⤵
  PID:7060
- C:\Windows\System\VSCHesl.exe
  C:\Windows\System\VSCHesl.exe
  2⤵
  PID:7088
- C:\Windows\System\frPEohB.exe
  C:\Windows\System\frPEohB.exe
  2⤵
  PID:7116
- C:\Windows\System\nvJbCnx.exe
  C:\Windows\System\nvJbCnx.exe
  2⤵
  PID:7144
- C:\Windows\System\UphmCTC.exe
  C:\Windows\System\UphmCTC.exe
  2⤵
  PID:2660
- C:\Windows\System\zfYPHVI.exe
  C:\Windows\System\zfYPHVI.exe
  2⤵
  PID:4996
- C:\Windows\System\ikSWgDF.exe
  C:\Windows\System\ikSWgDF.exe
  2⤵
  PID:3020
- C:\Windows\System\yxeZaNU.exe
  C:\Windows\System\yxeZaNU.exe
  2⤵
  PID:4340
- C:\Windows\System\EPqymxc.exe
  C:\Windows\System\EPqymxc.exe
  2⤵
  PID:5216
- C:\Windows\System\wzWfOQV.exe
  C:\Windows\System\wzWfOQV.exe
  2⤵
  PID:5356
- C:\Windows\System\oKEiQUw.exe
  C:\Windows\System\oKEiQUw.exe
  2⤵
  PID:5468
- C:\Windows\System\pUVDPoa.exe
  C:\Windows\System\pUVDPoa.exe
  2⤵
  PID:5640
- C:\Windows\System\ctazkxL.exe
  C:\Windows\System\ctazkxL.exe
  2⤵
  PID:5784
- C:\Windows\System\QMHTKsP.exe
  C:\Windows\System\QMHTKsP.exe
  2⤵
  PID:5924
- C:\Windows\System\buCPeGO.exe
  C:\Windows\System\buCPeGO.exe
  2⤵
  PID:6092
- C:\Windows\System\hEsVcbP.exe
  C:\Windows\System\hEsVcbP.exe
  2⤵
  PID:6180
- C:\Windows\System\OQtwvXd.exe
  C:\Windows\System\OQtwvXd.exe
  2⤵
  PID:6260
- C:\Windows\System\gjbVZUC.exe
  C:\Windows\System\gjbVZUC.exe
  2⤵
  PID:6316
- C:\Windows\System\bwGQodc.exe
  C:\Windows\System\bwGQodc.exe
  2⤵
  PID:6376
- C:\Windows\System\gpRzmdY.exe
  C:\Windows\System\gpRzmdY.exe
  2⤵
  PID:3592
- C:\Windows\System\ZILISwQ.exe
  C:\Windows\System\ZILISwQ.exe
  2⤵
  PID:4392
- C:\Windows\System\nBQwJSW.exe
  C:\Windows\System\nBQwJSW.exe
  2⤵
  PID:6544
- C:\Windows\System\PwrGFJx.exe
  C:\Windows\System\PwrGFJx.exe
  2⤵
  PID:6600
- C:\Windows\System\XLwFEKe.exe
  C:\Windows\System\XLwFEKe.exe
  2⤵
  PID:6680
- C:\Windows\System\WXBxPol.exe
  C:\Windows\System\WXBxPol.exe
  2⤵
  PID:6740
- C:\Windows\System\bvhbFoJ.exe
  C:\Windows\System\bvhbFoJ.exe
  2⤵
  PID:6800
- C:\Windows\System\Fkjcxsr.exe
  C:\Windows\System\Fkjcxsr.exe
  2⤵
  PID:6856
- C:\Windows\System\vhyPcca.exe
  C:\Windows\System\vhyPcca.exe
  2⤵
  PID:6932
- C:\Windows\System\OyODREK.exe
  C:\Windows\System\OyODREK.exe
  2⤵
  PID:6992
- C:\Windows\System\oBUECyA.exe
  C:\Windows\System\oBUECyA.exe
  2⤵
  PID:7056
- C:\Windows\System\ogyTYDc.exe
  C:\Windows\System\ogyTYDc.exe
  2⤵
  PID:7128
- C:\Windows\System\zXVRqui.exe
  C:\Windows\System\zXVRqui.exe
  2⤵
  PID:5100
- C:\Windows\System\HvRhmdb.exe
  C:\Windows\System\HvRhmdb.exe
  2⤵
  PID:1664
- C:\Windows\System\DpgdkNE.exe
  C:\Windows\System\DpgdkNE.exe
  2⤵
  PID:5280
- C:\Windows\System\YcpAaOf.exe
  C:\Windows\System\YcpAaOf.exe
  2⤵
  PID:5528
- C:\Windows\System\TaVFdLY.exe
  C:\Windows\System\TaVFdLY.exe
  2⤵
  PID:5860
- C:\Windows\System\NHiNmHV.exe
  C:\Windows\System\NHiNmHV.exe
  2⤵
  PID:6152
- C:\Windows\System\ueVAswK.exe
  C:\Windows\System\ueVAswK.exe
  2⤵
  PID:1480
- C:\Windows\System\vcrFVjF.exe
  C:\Windows\System\vcrFVjF.exe
  2⤵
  PID:3100
- C:\Windows\System\FAPYWuH.exe
  C:\Windows\System\FAPYWuH.exe
  2⤵
  PID:6596
- C:\Windows\System\THoCQkU.exe
  C:\Windows\System\THoCQkU.exe
  2⤵
  PID:6656
- C:\Windows\System\dubegPl.exe
  C:\Windows\System\dubegPl.exe
  2⤵
  PID:6792
- C:\Windows\System\MtYkaLJ.exe
  C:\Windows\System\MtYkaLJ.exe
  2⤵
  PID:6904
- C:\Windows\System\Rxeunoc.exe
  C:\Windows\System\Rxeunoc.exe
  2⤵
  PID:4992
- C:\Windows\System\riYRidA.exe
  C:\Windows\System\riYRidA.exe
  2⤵
  PID:7156
- C:\Windows\System\phHrtYw.exe
  C:\Windows\System\phHrtYw.exe
  2⤵
  PID:3400
- C:\Windows\System\ZeOyKYF.exe
  C:\Windows\System\ZeOyKYF.exe
  2⤵
  PID:4960
- C:\Windows\System\PJCjspw.exe
  C:\Windows\System\PJCjspw.exe
  2⤵
  PID:2736
- C:\Windows\System\sYEmKwp.exe
  C:\Windows\System\sYEmKwp.exe
  2⤵
  PID:1268
- C:\Windows\System\eJuCKQf.exe
  C:\Windows\System\eJuCKQf.exe
  2⤵
  PID:6032
- C:\Windows\System\sMYsTgI.exe
  C:\Windows\System\sMYsTgI.exe
  2⤵
  PID:6300
- C:\Windows\System\osOBNlG.exe
  C:\Windows\System\osOBNlG.exe
  2⤵
  PID:1460
- C:\Windows\System\eOAgeTl.exe
  C:\Windows\System\eOAgeTl.exe
  2⤵
  PID:1484
- C:\Windows\System\UyABhPo.exe
  C:\Windows\System\UyABhPo.exe
  2⤵
  PID:6652
- C:\Windows\System\nYoBSIA.exe
  C:\Windows\System\nYoBSIA.exe
  2⤵
  PID:6712
- C:\Windows\System\rGuZOGU.exe
  C:\Windows\System\rGuZOGU.exe
  2⤵
  PID:3848
- C:\Windows\System\ZcZgpQJ.exe
  C:\Windows\System\ZcZgpQJ.exe
  2⤵
  PID:5140
- C:\Windows\System\MVftIKx.exe
  C:\Windows\System\MVftIKx.exe
  2⤵
  PID:2516
- C:\Windows\System\DNQptQM.exe
  C:\Windows\System\DNQptQM.exe
  2⤵
  PID:912
- C:\Windows\System\TdpREjB.exe
  C:\Windows\System\TdpREjB.exe
  2⤵
  PID:4524
- C:\Windows\System\iyUVzeR.exe
  C:\Windows\System\iyUVzeR.exe
  2⤵
  PID:7104
- C:\Windows\System\vCbdgeS.exe
  C:\Windows\System\vCbdgeS.exe
  2⤵
  PID:4948
- C:\Windows\System\beXwaKJ.exe
  C:\Windows\System\beXwaKJ.exe
  2⤵
  PID:5084
- C:\Windows\System\CwetyHs.exe
  C:\Windows\System\CwetyHs.exe
  2⤵
  PID:7184
- C:\Windows\System\LFgXrjx.exe
  C:\Windows\System\LFgXrjx.exe
  2⤵
  PID:7212
- C:\Windows\System\KKOMnvj.exe
  C:\Windows\System\KKOMnvj.exe
  2⤵
  PID:7228
- C:\Windows\System\VRerlVF.exe
  C:\Windows\System\VRerlVF.exe
  2⤵
  PID:7252
- C:\Windows\System\IjFspYz.exe
  C:\Windows\System\IjFspYz.exe
  2⤵
  PID:7276
- C:\Windows\System\TykDEHx.exe
  C:\Windows\System\TykDEHx.exe
  2⤵
  PID:7308
- C:\Windows\System\tCSMGiB.exe
  C:\Windows\System\tCSMGiB.exe
  2⤵
  PID:7336
- C:\Windows\System\lvoRDEe.exe
  C:\Windows\System\lvoRDEe.exe
  2⤵
  PID:7364
- C:\Windows\System\gMXmWXx.exe
  C:\Windows\System\gMXmWXx.exe
  2⤵
  PID:7384
- C:\Windows\System\furCjFo.exe
  C:\Windows\System\furCjFo.exe
  2⤵
  PID:7404
- C:\Windows\System\OuuFXSp.exe
  C:\Windows\System\OuuFXSp.exe
  2⤵
  PID:7428
- C:\Windows\System\HbGXjfZ.exe
  C:\Windows\System\HbGXjfZ.exe
  2⤵
  PID:7456
- C:\Windows\System\KiffVOx.exe
  C:\Windows\System\KiffVOx.exe
  2⤵
  PID:7496
- C:\Windows\System\MCLArtm.exe
  C:\Windows\System\MCLArtm.exe
  2⤵
  PID:7520
- C:\Windows\System\VBiiBqa.exe
  C:\Windows\System\VBiiBqa.exe
  2⤵
  PID:7552
- C:\Windows\System\FUZWFCk.exe
  C:\Windows\System\FUZWFCk.exe
  2⤵
  PID:7568
- C:\Windows\System\fmjVEXV.exe
  C:\Windows\System\fmjVEXV.exe
  2⤵
  PID:7588
- C:\Windows\System\kwwqzvG.exe
  C:\Windows\System\kwwqzvG.exe
  2⤵
  PID:7640
- C:\Windows\System\VgCeSbK.exe
  C:\Windows\System\VgCeSbK.exe
  2⤵
  PID:7664
- C:\Windows\System\EyflQTa.exe
  C:\Windows\System\EyflQTa.exe
  2⤵
  PID:7716
- C:\Windows\System\LESPjpP.exe
  C:\Windows\System\LESPjpP.exe
  2⤵
  PID:7732
- C:\Windows\System\iXgODdo.exe
  C:\Windows\System\iXgODdo.exe
  2⤵
  PID:7748
- C:\Windows\System\RoyItdC.exe
  C:\Windows\System\RoyItdC.exe
  2⤵
  PID:7764
- C:\Windows\System\dJLShft.exe
  C:\Windows\System\dJLShft.exe
  2⤵
  PID:7780
- C:\Windows\System\ikpKNbw.exe
  C:\Windows\System\ikpKNbw.exe
  2⤵
  PID:7844
- C:\Windows\System\elLvqvH.exe
  C:\Windows\System\elLvqvH.exe
  2⤵
  PID:7864
- C:\Windows\System\TfyMpyT.exe
  C:\Windows\System\TfyMpyT.exe
  2⤵
  PID:7900
- C:\Windows\System\XXmpHwW.exe
  C:\Windows\System\XXmpHwW.exe
  2⤵
  PID:7928
- C:\Windows\System\HPrmliz.exe
  C:\Windows\System\HPrmliz.exe
  2⤵
  PID:7956
- C:\Windows\System\tbBFHyT.exe
  C:\Windows\System\tbBFHyT.exe
  2⤵
  PID:7972
- C:\Windows\System\ItOjlyS.exe
  C:\Windows\System\ItOjlyS.exe
  2⤵
  PID:8000
- C:\Windows\System\ULASpPP.exe
  C:\Windows\System\ULASpPP.exe
  2⤵
  PID:8032
- C:\Windows\System\DAidZnd.exe
  C:\Windows\System\DAidZnd.exe
  2⤵
  PID:8064
- C:\Windows\System\fIJeVNO.exe
  C:\Windows\System\fIJeVNO.exe
  2⤵
  PID:8092
- C:\Windows\System\KaUQOqq.exe
  C:\Windows\System\KaUQOqq.exe
  2⤵
  PID:8120
- C:\Windows\System\hLWIEgW.exe
  C:\Windows\System\hLWIEgW.exe
  2⤵
  PID:8152
- C:\Windows\System\CLQdhLK.exe
  C:\Windows\System\CLQdhLK.exe
  2⤵
  PID:3040
- C:\Windows\System\qWCVoqJ.exe
  C:\Windows\System\qWCVoqJ.exe
  2⤵
  PID:7204
- C:\Windows\System\xLsIKsU.exe
  C:\Windows\System\xLsIKsU.exe
  2⤵
  PID:7244
- C:\Windows\System\LZAKmHu.exe
  C:\Windows\System\LZAKmHu.exe
  2⤵
  PID:7272
- C:\Windows\System\qYGSSeM.exe
  C:\Windows\System\qYGSSeM.exe
  2⤵
  PID:7324
- C:\Windows\System\TUhMzTJ.exe
  C:\Windows\System\TUhMzTJ.exe
  2⤵
  PID:7436
- C:\Windows\System\WlLghev.exe
  C:\Windows\System\WlLghev.exe
  2⤵
  PID:7516
- C:\Windows\System\JpHYcRI.exe
  C:\Windows\System\JpHYcRI.exe
  2⤵
  PID:7596
- C:\Windows\System\FuqGpnG.exe
  C:\Windows\System\FuqGpnG.exe
  2⤵
  PID:7684
- C:\Windows\System\ytTQaWh.exe
  C:\Windows\System\ytTQaWh.exe
  2⤵
  PID:7656
- C:\Windows\System\qOMPBEP.exe
  C:\Windows\System\qOMPBEP.exe
  2⤵
  PID:7700
- C:\Windows\System\VrPKwQF.exe
  C:\Windows\System\VrPKwQF.exe
  2⤵
  PID:7796
- C:\Windows\System\TGhCrtq.exe
  C:\Windows\System\TGhCrtq.exe
  2⤵
  PID:7856
- C:\Windows\System\kXFMZJw.exe
  C:\Windows\System\kXFMZJw.exe
  2⤵
  PID:7940
- C:\Windows\System\HQIcYKc.exe
  C:\Windows\System\HQIcYKc.exe
  2⤵
  PID:7964
- C:\Windows\System\ZSzmgIC.exe
  C:\Windows\System\ZSzmgIC.exe
  2⤵
  PID:8136
- C:\Windows\System\UJaHnwi.exe
  C:\Windows\System\UJaHnwi.exe
  2⤵
  PID:8172
- C:\Windows\System\uLtVWXa.exe
  C:\Windows\System\uLtVWXa.exe
  2⤵
  PID:7224
- C:\Windows\System\sIegIWm.exe
  C:\Windows\System\sIegIWm.exe
  2⤵
  PID:7540
- C:\Windows\System\OKkGnRc.exe
  C:\Windows\System\OKkGnRc.exe
  2⤵
  PID:7580
- C:\Windows\System\ujiTkJx.exe
  C:\Windows\System\ujiTkJx.exe
  2⤵
  PID:7812
- C:\Windows\System\ecmhypH.exe
  C:\Windows\System\ecmhypH.exe
  2⤵
  PID:7908
- C:\Windows\System\nRVyHYt.exe
  C:\Windows\System\nRVyHYt.exe
  2⤵
  PID:8188
- C:\Windows\System\PzIxyrV.exe
  C:\Windows\System\PzIxyrV.exe
  2⤵
  PID:8112
- C:\Windows\System\ijXIBBE.exe
  C:\Windows\System\ijXIBBE.exe
  2⤵
  PID:7320
- C:\Windows\System\cQFgmdd.exe
  C:\Windows\System\cQFgmdd.exe
  2⤵
  PID:7740
- C:\Windows\System\HXGmcfv.exe
  C:\Windows\System\HXGmcfv.exe
  2⤵
  PID:8044
- C:\Windows\System\Gsiqnum.exe
  C:\Windows\System\Gsiqnum.exe
  2⤵
  PID:7412
- C:\Windows\System\HvvknQF.exe
  C:\Windows\System\HvvknQF.exe
  2⤵
  PID:8216
- C:\Windows\System\SguUWrW.exe
  C:\Windows\System\SguUWrW.exe
  2⤵
  PID:8244
- C:\Windows\System\yRNJvrV.exe
  C:\Windows\System\yRNJvrV.exe
  2⤵
  PID:8272
- C:\Windows\System\aRdATxX.exe
  C:\Windows\System\aRdATxX.exe
  2⤵
  PID:8300
- C:\Windows\System\QuDerrd.exe
  C:\Windows\System\QuDerrd.exe
  2⤵
  PID:8328
- C:\Windows\System\mMMStxe.exe
  C:\Windows\System\mMMStxe.exe
  2⤵
  PID:8352
- C:\Windows\System\HiGbcyw.exe
  C:\Windows\System\HiGbcyw.exe
  2⤵
  PID:8384
- C:\Windows\System\JxUVGLf.exe
  C:\Windows\System\JxUVGLf.exe
  2⤵
  PID:8424
- C:\Windows\System\dUZNXvt.exe
  C:\Windows\System\dUZNXvt.exe
  2⤵
  PID:8452
- C:\Windows\System\cQvXLrK.exe
  C:\Windows\System\cQvXLrK.exe
  2⤵
  PID:8468
- C:\Windows\System\NxUPLuN.exe
  C:\Windows\System\NxUPLuN.exe
  2⤵
  PID:8488
- C:\Windows\System\WyNyUpZ.exe
  C:\Windows\System\WyNyUpZ.exe
  2⤵
  PID:8516
- C:\Windows\System\RGRHnOU.exe
  C:\Windows\System\RGRHnOU.exe
  2⤵
  PID:8544
- C:\Windows\System\HlgTHcW.exe
  C:\Windows\System\HlgTHcW.exe
  2⤵
  PID:8572
- C:\Windows\System\KXeeesc.exe
  C:\Windows\System\KXeeesc.exe
  2⤵
  PID:8608
- C:\Windows\System\ptQKHLJ.exe
  C:\Windows\System\ptQKHLJ.exe
  2⤵
  PID:8636
- C:\Windows\System\MOnOGfN.exe
  C:\Windows\System\MOnOGfN.exe
  2⤵
  PID:8664
- C:\Windows\System\bSewaZI.exe
  C:\Windows\System\bSewaZI.exe
  2⤵
  PID:8684
- C:\Windows\System\MBDKmLo.exe
  C:\Windows\System\MBDKmLo.exe
  2⤵
  PID:8704
- C:\Windows\System\MRNLqlM.exe
  C:\Windows\System\MRNLqlM.exe
  2⤵
  PID:8724
- C:\Windows\System\QukGiCS.exe
  C:\Windows\System\QukGiCS.exe
  2⤵
  PID:8748
- C:\Windows\System\IDJlFEb.exe
  C:\Windows\System\IDJlFEb.exe
  2⤵
  PID:8772
- C:\Windows\System\isgVTgg.exe
  C:\Windows\System\isgVTgg.exe
  2⤵
  PID:8804
- C:\Windows\System\tgChPaR.exe
  C:\Windows\System\tgChPaR.exe
  2⤵
  PID:8824
- C:\Windows\System\EVDwMQo.exe
  C:\Windows\System\EVDwMQo.exe
  2⤵
  PID:8852
- C:\Windows\System\cjnRAHB.exe
  C:\Windows\System\cjnRAHB.exe
  2⤵
  PID:8924
- C:\Windows\System\UriRYpF.exe
  C:\Windows\System\UriRYpF.exe
  2⤵
  PID:8952
- C:\Windows\System\MvixinQ.exe
  C:\Windows\System\MvixinQ.exe
  2⤵
  PID:8996
- C:\Windows\System\UoKeZVB.exe
  C:\Windows\System\UoKeZVB.exe
  2⤵
  PID:9016
- C:\Windows\System\OlkKGHL.exe
  C:\Windows\System\OlkKGHL.exe
  2⤵
  PID:9044
- C:\Windows\System\AbcdZZX.exe
  C:\Windows\System\AbcdZZX.exe
  2⤵
  PID:9068
- C:\Windows\System\OdcpmHv.exe
  C:\Windows\System\OdcpmHv.exe
  2⤵
  PID:9108
- C:\Windows\System\nuagNXb.exe
  C:\Windows\System\nuagNXb.exe
  2⤵
  PID:9124
- C:\Windows\System\AzlLLJF.exe
  C:\Windows\System\AzlLLJF.exe
  2⤵
  PID:9140
- C:\Windows\System\KyWjUlc.exe
  C:\Windows\System\KyWjUlc.exe
  2⤵
  PID:9156
- C:\Windows\System\yLAWLVA.exe
  C:\Windows\System\yLAWLVA.exe
  2⤵
  PID:9188
- C:\Windows\System\CXqkNEA.exe
  C:\Windows\System\CXqkNEA.exe
  2⤵
  PID:7612
- C:\Windows\System\TKbLzMU.exe
  C:\Windows\System\TKbLzMU.exe
  2⤵
  PID:8236
- C:\Windows\System\dNPWzoU.exe
  C:\Windows\System\dNPWzoU.exe
  2⤵
  PID:8340
- C:\Windows\System\ogzQvFH.exe
  C:\Windows\System\ogzQvFH.exe
  2⤵
  PID:8380
- C:\Windows\System\odiPAQj.exe
  C:\Windows\System\odiPAQj.exe
  2⤵
  PID:8412
- C:\Windows\System\QfgeJfK.exe
  C:\Windows\System\QfgeJfK.exe
  2⤵
  PID:8536
- C:\Windows\System\IPXudSl.exe
  C:\Windows\System\IPXudSl.exe
  2⤵
  PID:8556
- C:\Windows\System\aWOSrGl.exe
  C:\Windows\System\aWOSrGl.exe
  2⤵
  PID:8628
- C:\Windows\System\yiVjLHI.exe
  C:\Windows\System\yiVjLHI.exe
  2⤵
  PID:8676
- C:\Windows\System\VUzUruR.exe
  C:\Windows\System\VUzUruR.exe
  2⤵
  PID:8796
- C:\Windows\System\KtHIrvF.exe
  C:\Windows\System\KtHIrvF.exe
  2⤵
  PID:8816
- C:\Windows\System\cUrSSKF.exe
  C:\Windows\System\cUrSSKF.exe
  2⤵
  PID:8900
- C:\Windows\System\TIxyHUU.exe
  C:\Windows\System\TIxyHUU.exe
  2⤵
  PID:8980
- C:\Windows\System\atkeZDE.exe
  C:\Windows\System\atkeZDE.exe
  2⤵
  PID:9052
- C:\Windows\System\TaIPOMm.exe
  C:\Windows\System\TaIPOMm.exe
  2⤵
  PID:9064
- C:\Windows\System\RdrFXXL.exe
  C:\Windows\System\RdrFXXL.exe
  2⤵
  PID:9152
- C:\Windows\System\pJsIFDd.exe
  C:\Windows\System\pJsIFDd.exe
  2⤵
  PID:9180
- C:\Windows\System\MyfDIuP.exe
  C:\Windows\System\MyfDIuP.exe
  2⤵
  PID:8204
- C:\Windows\System\DTxAFIp.exe
  C:\Windows\System\DTxAFIp.exe
  2⤵
  PID:8404
- C:\Windows\System\jvScbaw.exe
  C:\Windows\System\jvScbaw.exe
  2⤵
  PID:8484
- C:\Windows\System\UdGurrp.exe
  C:\Windows\System\UdGurrp.exe
  2⤵
  PID:8700
- C:\Windows\System\hjmtyjl.exe
  C:\Windows\System\hjmtyjl.exe
  2⤵
  PID:8892
- C:\Windows\System\jQfLuca.exe
  C:\Windows\System\jQfLuca.exe
  2⤵
  PID:392
- C:\Windows\System\JCoQTWc.exe
  C:\Windows\System\JCoQTWc.exe
  2⤵
  PID:9200
- C:\Windows\System\mwDTqNo.exe
  C:\Windows\System\mwDTqNo.exe
  2⤵
  PID:8288
- C:\Windows\System\pyPKTbQ.exe
  C:\Windows\System\pyPKTbQ.exe
  2⤵
  PID:8652
- C:\Windows\System\vBHVxEv.exe
  C:\Windows\System\vBHVxEv.exe
  2⤵
  PID:9092
- C:\Windows\System\LhbFoTh.exe
  C:\Windows\System\LhbFoTh.exe
  2⤵
  PID:8476
- C:\Windows\System\NzMJSMg.exe
  C:\Windows\System\NzMJSMg.exe
  2⤵
  PID:9228
- C:\Windows\System\ebPpoow.exe
  C:\Windows\System\ebPpoow.exe
  2⤵
  PID:9256
- C:\Windows\System\vSOiDYI.exe
  C:\Windows\System\vSOiDYI.exe
  2⤵
  PID:9312
- C:\Windows\System\LpGzoIo.exe
  C:\Windows\System\LpGzoIo.exe
  2⤵
  PID:9336
- C:\Windows\System\REkrMLI.exe
  C:\Windows\System\REkrMLI.exe
  2⤵
  PID:9376
- C:\Windows\System\xqVvvDy.exe
  C:\Windows\System\xqVvvDy.exe
  2⤵
  PID:9396
- C:\Windows\System\ADhwHtB.exe
  C:\Windows\System\ADhwHtB.exe
  2⤵
  PID:9424
- C:\Windows\System\jOWkVzE.exe
  C:\Windows\System\jOWkVzE.exe
  2⤵
  PID:9452
- C:\Windows\System\GqrmyDM.exe
  C:\Windows\System\GqrmyDM.exe
  2⤵
  PID:9492
- C:\Windows\System\qNNXIBr.exe
  C:\Windows\System\qNNXIBr.exe
  2⤵
  PID:9512
- C:\Windows\System\WfZxbTR.exe
  C:\Windows\System\WfZxbTR.exe
  2⤵
  PID:9536
- C:\Windows\System\RZxPKKg.exe
  C:\Windows\System\RZxPKKg.exe
  2⤵
  PID:9560
- C:\Windows\System\NyBUYvU.exe
  C:\Windows\System\NyBUYvU.exe
  2⤵
  PID:9576
- C:\Windows\System\NJXJZiy.exe
  C:\Windows\System\NJXJZiy.exe
  2⤵
  PID:9620
- C:\Windows\System\iHHRBhZ.exe
  C:\Windows\System\iHHRBhZ.exe
  2⤵
  PID:9640
- C:\Windows\System\ypxupdY.exe
  C:\Windows\System\ypxupdY.exe
  2⤵
  PID:9672
- C:\Windows\System\uPvqJpP.exe
  C:\Windows\System\uPvqJpP.exe
  2⤵
  PID:9692
- C:\Windows\System\bQqGJDG.exe
  C:\Windows\System\bQqGJDG.exe
  2⤵
  PID:9732
- C:\Windows\System\wMTTxVq.exe
  C:\Windows\System\wMTTxVq.exe
  2⤵
  PID:9760
- C:\Windows\System\EMXkuif.exe
  C:\Windows\System\EMXkuif.exe
  2⤵
  PID:9780
- C:\Windows\System\KkOeaIO.exe
  C:\Windows\System\KkOeaIO.exe
  2⤵
  PID:9804
- C:\Windows\System\wYznGTh.exe
  C:\Windows\System\wYznGTh.exe
  2⤵
  PID:9832
- C:\Windows\System\DVrFfyJ.exe
  C:\Windows\System\DVrFfyJ.exe
  2⤵
  PID:9848
- C:\Windows\System\DHjpyGN.exe
  C:\Windows\System\DHjpyGN.exe
  2⤵
  PID:9896
- C:\Windows\System\uYGNEnk.exe
  C:\Windows\System\uYGNEnk.exe
  2⤵
  PID:9920
- C:\Windows\System\wAuATLk.exe
  C:\Windows\System\wAuATLk.exe
  2⤵
  PID:9940
- C:\Windows\System\DpUzLVo.exe
  C:\Windows\System\DpUzLVo.exe
  2⤵
  PID:9964
- C:\Windows\System\MBLGCgI.exe
  C:\Windows\System\MBLGCgI.exe
  2⤵
  PID:9984
- C:\Windows\System\ndApGhP.exe
  C:\Windows\System\ndApGhP.exe
  2⤵
  PID:10016
- C:\Windows\System\cwlskad.exe
  C:\Windows\System\cwlskad.exe
  2⤵
  PID:10044
- C:\Windows\System\XFXeLIu.exe
  C:\Windows\System\XFXeLIu.exe
  2⤵
  PID:10060
- C:\Windows\System\KWjInNE.exe
  C:\Windows\System\KWjInNE.exe
  2⤵
  PID:10084
- C:\Windows\System\CVQIWPr.exe
  C:\Windows\System\CVQIWPr.exe
  2⤵
  PID:10132
- C:\Windows\System\fBvEBnK.exe
  C:\Windows\System\fBvEBnK.exe
  2⤵
  PID:10164
- C:\Windows\System\wJSamND.exe
  C:\Windows\System\wJSamND.exe
  2⤵
  PID:10188
- C:\Windows\System\rAqSwpc.exe
  C:\Windows\System\rAqSwpc.exe
  2⤵
  PID:10216
- C:\Windows\System\EregEDc.exe
  C:\Windows\System\EregEDc.exe
  2⤵
  PID:9212
- C:\Windows\System\kgwrQSV.exe
  C:\Windows\System\kgwrQSV.exe
  2⤵
  PID:9308
- C:\Windows\System\EhUKZeH.exe
  C:\Windows\System\EhUKZeH.exe
  2⤵
  PID:9388
- C:\Windows\System\DDBGPDx.exe
  C:\Windows\System\DDBGPDx.exe
  2⤵
  PID:9432
- C:\Windows\System\QjbpESN.exe
  C:\Windows\System\QjbpESN.exe
  2⤵
  PID:9484
- C:\Windows\System\LeGRjYM.exe
  C:\Windows\System\LeGRjYM.exe
  2⤵
  PID:9528
- C:\Windows\System\XlVsVrI.exe
  C:\Windows\System\XlVsVrI.exe
  2⤵
  PID:9608
- C:\Windows\System\fAeCczh.exe
  C:\Windows\System\fAeCczh.exe
  2⤵
  PID:9596
- C:\Windows\System\xFafksW.exe
  C:\Windows\System\xFafksW.exe
  2⤵
  PID:9688
- C:\Windows\System\jwvKFWc.exe
  C:\Windows\System\jwvKFWc.exe
  2⤵
  PID:9728
- C:\Windows\System\CJGkvFF.exe
  C:\Windows\System\CJGkvFF.exe
  2⤵
  PID:9892
- C:\Windows\System\kbiyLpS.exe
  C:\Windows\System\kbiyLpS.exe
  2⤵
  PID:9916
- C:\Windows\System\mvaBdqA.exe
  C:\Windows\System\mvaBdqA.exe
  2⤵
  PID:9972
- C:\Windows\System\eKdZXCY.exe
  C:\Windows\System\eKdZXCY.exe
  2⤵
  PID:10028
- C:\Windows\System\ILfGMMo.exe
  C:\Windows\System\ILfGMMo.exe
  2⤵
  PID:10124
- C:\Windows\System\teYzfpO.exe
  C:\Windows\System\teYzfpO.exe
  2⤵
  PID:10148
- C:\Windows\System\BMpqisy.exe
  C:\Windows\System\BMpqisy.exe
  2⤵
  PID:9172
- C:\Windows\System\HWVYfxC.exe
  C:\Windows\System\HWVYfxC.exe
  2⤵
  PID:9364
- C:\Windows\System\aCgvvxE.exe
  C:\Windows\System\aCgvvxE.exe
  2⤵
  PID:9508
- C:\Windows\System\hcqizxN.exe
  C:\Windows\System\hcqizxN.exe
  2⤵
  PID:9724
- C:\Windows\System\uBXAwdQ.exe
  C:\Windows\System\uBXAwdQ.exe
  2⤵
  PID:10000
- C:\Windows\System\RtABWvF.exe
  C:\Windows\System\RtABWvF.exe
  2⤵
  PID:10072
- C:\Windows\System\JCSQtEb.exe
  C:\Windows\System\JCSQtEb.exe
  2⤵
  PID:10212
- C:\Windows\System\ACZwLjN.exe
  C:\Windows\System\ACZwLjN.exe
  2⤵
  PID:9436
- C:\Windows\System\nXmLKNB.exe
  C:\Windows\System\nXmLKNB.exe
  2⤵
  PID:9636
- C:\Windows\System\GSVCBAe.exe
  C:\Windows\System\GSVCBAe.exe
  2⤵
  PID:9880
- C:\Windows\System\uEkjscy.exe
  C:\Windows\System\uEkjscy.exe
  2⤵
  PID:10056
- C:\Windows\System\SKPgsJo.exe
  C:\Windows\System\SKPgsJo.exe
  2⤵
  PID:10252
- C:\Windows\System\alOoeHp.exe
  C:\Windows\System\alOoeHp.exe
  2⤵
  PID:10268
- C:\Windows\System\AdqvaiS.exe
  C:\Windows\System\AdqvaiS.exe
  2⤵
  PID:10304
- C:\Windows\System\xbOHumD.exe
  C:\Windows\System\xbOHumD.exe
  2⤵
  PID:10320
- C:\Windows\System\kriQlmA.exe
  C:\Windows\System\kriQlmA.exe
  2⤵
  PID:10340
- C:\Windows\System\XFntBsv.exe
  C:\Windows\System\XFntBsv.exe
  2⤵
  PID:10368
- C:\Windows\System\wimLiEN.exe
  C:\Windows\System\wimLiEN.exe
  2⤵
  PID:10396
- C:\Windows\System\ppmHgHm.exe
  C:\Windows\System\ppmHgHm.exe
  2⤵
  PID:10440
- C:\Windows\System\TWUUTMe.exe
  C:\Windows\System\TWUUTMe.exe
  2⤵
  PID:10476
- C:\Windows\System\vgCWqjZ.exe
  C:\Windows\System\vgCWqjZ.exe
  2⤵
  PID:10516
- C:\Windows\System\BlCgMFm.exe
  C:\Windows\System\BlCgMFm.exe
  2⤵
  PID:10536
- C:\Windows\System\YUoUnEL.exe
  C:\Windows\System\YUoUnEL.exe
  2⤵
  PID:10572
- C:\Windows\System\LVlTSGd.exe
  C:\Windows\System\LVlTSGd.exe
  2⤵
  PID:10604
- C:\Windows\System\DkIIhJF.exe
  C:\Windows\System\DkIIhJF.exe
  2⤵
  PID:10632
- C:\Windows\System\cqtMonY.exe
  C:\Windows\System\cqtMonY.exe
  2⤵
  PID:10660
- C:\Windows\System\GjkRVEE.exe
  C:\Windows\System\GjkRVEE.exe
  2⤵
  PID:10680
- C:\Windows\System\FYZeidb.exe
  C:\Windows\System\FYZeidb.exe
  2⤵
  PID:10704
- C:\Windows\System\XhMoyzM.exe
  C:\Windows\System\XhMoyzM.exe
  2⤵
  PID:10720
- C:\Windows\System\RVVNUTk.exe
  C:\Windows\System\RVVNUTk.exe
  2⤵
  PID:10748
- C:\Windows\System\anxcRXF.exe
  C:\Windows\System\anxcRXF.exe
  2⤵
  PID:10776
- C:\Windows\System\HFiPHBG.exe
  C:\Windows\System\HFiPHBG.exe
  2⤵
  PID:10800
- C:\Windows\System\uNuaRjH.exe
  C:\Windows\System\uNuaRjH.exe
  2⤵
  PID:10824
- C:\Windows\System\hvmzoQl.exe
  C:\Windows\System\hvmzoQl.exe
  2⤵
  PID:10848
- C:\Windows\System\IHzacvV.exe
  C:\Windows\System\IHzacvV.exe
  2⤵
  PID:10912
- C:\Windows\System\alXhcMf.exe
  C:\Windows\System\alXhcMf.exe
  2⤵
  PID:10928
- C:\Windows\System\kkFEKOl.exe
  C:\Windows\System\kkFEKOl.exe
  2⤵
  PID:10956
- C:\Windows\System\ZkIqIxj.exe
  C:\Windows\System\ZkIqIxj.exe
  2⤵
  PID:10972
- C:\Windows\System\ETFkVeb.exe
  C:\Windows\System\ETFkVeb.exe
  2⤵
  PID:11020
- C:\Windows\System\JoUCxBT.exe
  C:\Windows\System\JoUCxBT.exe
  2⤵
  PID:11060
- C:\Windows\System\rogdJSy.exe
  C:\Windows\System\rogdJSy.exe
  2⤵
  PID:11076
- C:\Windows\System\tUlhmFO.exe
  C:\Windows\System\tUlhmFO.exe
  2⤵
  PID:11100
- C:\Windows\System\OJSQbhk.exe
  C:\Windows\System\OJSQbhk.exe
  2⤵
  PID:11136
- C:\Windows\System\nuErbUx.exe
  C:\Windows\System\nuErbUx.exe
  2⤵
  PID:11156
- C:\Windows\System\NJWSyxK.exe
  C:\Windows\System\NJWSyxK.exe
  2⤵
  PID:11172
- C:\Windows\System\QDAxuaC.exe
  C:\Windows\System\QDAxuaC.exe
  2⤵
  PID:11192
- C:\Windows\System\jItZHJv.exe
  C:\Windows\System\jItZHJv.exe
  2⤵
  PID:11212
- C:\Windows\System\YWNBjtj.exe
  C:\Windows\System\YWNBjtj.exe
  2⤵
  PID:11236
- C:\Windows\System\LNZkLKD.exe
  C:\Windows\System\LNZkLKD.exe
  2⤵
  PID:9748
- C:\Windows\System\IKxSeel.exe
  C:\Windows\System\IKxSeel.exe
  2⤵
  PID:10260
- C:\Windows\System\WqAswwN.exe
  C:\Windows\System\WqAswwN.exe
  2⤵
  PID:10364
- C:\Windows\System\osCwjXQ.exe
  C:\Windows\System\osCwjXQ.exe
  2⤵
  PID:10420
- C:\Windows\System\ReINdiN.exe
  C:\Windows\System\ReINdiN.exe
  2⤵
  PID:10496
- C:\Windows\System\gUufdTj.exe
  C:\Windows\System\gUufdTj.exe
  2⤵
  PID:10616
- C:\Windows\System\tRqbYuA.exe
  C:\Windows\System\tRqbYuA.exe
  2⤵
  PID:10676
- C:\Windows\System\PrukPrD.exe
  C:\Windows\System\PrukPrD.exe
  2⤵
  PID:10760
- C:\Windows\System\eDCYQzJ.exe
  C:\Windows\System\eDCYQzJ.exe
  2⤵
  PID:10812
- C:\Windows\System\FmgSmtG.exe
  C:\Windows\System\FmgSmtG.exe
  2⤵
  PID:10880
- C:\Windows\System\SCROoiL.exe
  C:\Windows\System\SCROoiL.exe
  2⤵
  PID:10940
- C:\Windows\System\xezydhn.exe
  C:\Windows\System\xezydhn.exe
  2⤵
  PID:10968
- C:\Windows\System\UQvKBUy.exe
  C:\Windows\System\UQvKBUy.exe
  2⤵
  PID:11068
- C:\Windows\System\jvmzCuF.exe
  C:\Windows\System\jvmzCuF.exe
  2⤵
  PID:11148
- C:\Windows\System\nzRdZub.exe
  C:\Windows\System\nzRdZub.exe
  2⤵
  PID:11188
- C:\Windows\System\cTNLteT.exe
  C:\Windows\System\cTNLteT.exe
  2⤵
  PID:10236
- C:\Windows\System\lKtELqD.exe
  C:\Windows\System\lKtELqD.exe
  2⤵
  PID:10336
- C:\Windows\System\xvUDQaf.exe
  C:\Windows\System\xvUDQaf.exe
  2⤵
  PID:10356
- C:\Windows\System\VrkgriB.exe
  C:\Windows\System\VrkgriB.exe
  2⤵
  PID:10468
- C:\Windows\System\VzJXrVf.exe
  C:\Windows\System\VzJXrVf.exe
  2⤵
  PID:10716
- C:\Windows\System\LRMYbNx.exe
  C:\Windows\System\LRMYbNx.exe
  2⤵
  PID:10784
- C:\Windows\System\LTtiaTs.exe
  C:\Windows\System\LTtiaTs.exe
  2⤵
  PID:10992
- C:\Windows\System\FMJinqV.exe
  C:\Windows\System\FMJinqV.exe
  2⤵
  PID:11164
- C:\Windows\System\WLPXIHV.exe
  C:\Windows\System\WLPXIHV.exe
  2⤵
  PID:10312
- C:\Windows\System\iesShHC.exe
  C:\Windows\System\iesShHC.exe
  2⤵
  PID:10736
- C:\Windows\System\zDxogpu.exe
  C:\Windows\System\zDxogpu.exe
  2⤵
  PID:11180
- C:\Windows\System\EkySpXD.exe
  C:\Windows\System\EkySpXD.exe
  2⤵
  PID:10740
- C:\Windows\System\uxiPcsr.exe
  C:\Windows\System\uxiPcsr.exe
  2⤵
  PID:11280
- C:\Windows\System\iMwWQtp.exe
  C:\Windows\System\iMwWQtp.exe
  2⤵
  PID:11312
- C:\Windows\System\jroQvWO.exe
  C:\Windows\System\jroQvWO.exe
  2⤵
  PID:11332
- C:\Windows\System\tnUoFeD.exe
  C:\Windows\System\tnUoFeD.exe
  2⤵
  PID:11356
- C:\Windows\System\kNsvBHW.exe
  C:\Windows\System\kNsvBHW.exe
  2⤵
  PID:11380
- C:\Windows\System\XhizCaw.exe
  C:\Windows\System\XhizCaw.exe
  2⤵
  PID:11428
- C:\Windows\System\qoMQbAG.exe
  C:\Windows\System\qoMQbAG.exe
  2⤵
  PID:11452
- C:\Windows\System\NwPlmoA.exe
  C:\Windows\System\NwPlmoA.exe
  2⤵
  PID:11480
- C:\Windows\System\hlLwNCp.exe
  C:\Windows\System\hlLwNCp.exe
  2⤵
  PID:11520
- C:\Windows\System\roKjIxZ.exe
  C:\Windows\System\roKjIxZ.exe
  2⤵
  PID:11548
- C:\Windows\System\jBCIbmF.exe
  C:\Windows\System\jBCIbmF.exe
  2⤵
  PID:11564
- C:\Windows\System\wkqWyPF.exe
  C:\Windows\System\wkqWyPF.exe
  2⤵
  PID:11592
- C:\Windows\System\dvpobZN.exe
  C:\Windows\System\dvpobZN.exe
  2⤵
  PID:11616
- C:\Windows\System\XShtSEj.exe
  C:\Windows\System\XShtSEj.exe
  2⤵
  PID:11640
- C:\Windows\System\ZkZdtHN.exe
  C:\Windows\System\ZkZdtHN.exe
  2⤵
  PID:11664
- C:\Windows\System\OZSwXrO.exe
  C:\Windows\System\OZSwXrO.exe
  2⤵
  PID:11700
- C:\Windows\System\BKHWPpz.exe
  C:\Windows\System\BKHWPpz.exe
  2⤵
  PID:11772
- C:\Windows\System\zoCghkY.exe
  C:\Windows\System\zoCghkY.exe
  2⤵
  PID:11792
- C:\Windows\System\FNTniMM.exe
  C:\Windows\System\FNTniMM.exe
  2⤵
  PID:11820
- C:\Windows\System\ydWuIvU.exe
  C:\Windows\System\ydWuIvU.exe
  2⤵
  PID:11836
- C:\Windows\System\HrJMaoP.exe
  C:\Windows\System\HrJMaoP.exe
  2⤵
  PID:11856
- C:\Windows\System\XJBpcIg.exe
  C:\Windows\System\XJBpcIg.exe
  2⤵
  PID:11896
- C:\Windows\System\xWRVbNs.exe
  C:\Windows\System\xWRVbNs.exe
  2⤵
  PID:11920
- C:\Windows\System\hzHqzjA.exe
  C:\Windows\System\hzHqzjA.exe
  2⤵
  PID:11936
- C:\Windows\System\zShZSCl.exe
  C:\Windows\System\zShZSCl.exe
  2⤵
  PID:11952
- C:\Windows\System\ltlBOYm.exe
  C:\Windows\System\ltlBOYm.exe
  2⤵
  PID:12000
- C:\Windows\System\kLYhmlA.exe
  C:\Windows\System\kLYhmlA.exe
  2⤵
  PID:12028
- C:\Windows\System\fkZdrMH.exe
  C:\Windows\System\fkZdrMH.exe
  2⤵
  PID:12052
- C:\Windows\System\MMmcEFl.exe
  C:\Windows\System\MMmcEFl.exe
  2⤵
  PID:12100
- C:\Windows\System\ZmPMlcS.exe
  C:\Windows\System\ZmPMlcS.exe
  2⤵
  PID:12120
- C:\Windows\System\GFrAjXB.exe
  C:\Windows\System\GFrAjXB.exe
  2⤵
  PID:12144
- C:\Windows\System\BiKcMaQ.exe
  C:\Windows\System\BiKcMaQ.exe
  2⤵
  PID:12164
- C:\Windows\System\iVpGXsP.exe
  C:\Windows\System\iVpGXsP.exe
  2⤵
  PID:12188
- C:\Windows\System\HCgXvfb.exe
  C:\Windows\System\HCgXvfb.exe
  2⤵
  PID:12208
- C:\Windows\System\KgrzbOc.exe
  C:\Windows\System\KgrzbOc.exe
  2⤵
  PID:12232
- C:\Windows\System\AZzEQvU.exe
  C:\Windows\System\AZzEQvU.exe
  2⤵
  PID:12260
- C:\Windows\System\khNZnod.exe
  C:\Windows\System\khNZnod.exe
  2⤵
  PID:12276
- C:\Windows\System\EvWkqXA.exe
  C:\Windows\System\EvWkqXA.exe
  2⤵
  PID:10844
- C:\Windows\System\UeYSmaL.exe
  C:\Windows\System\UeYSmaL.exe
  2⤵
  PID:11396
- C:\Windows\System\tXylSZR.exe
  C:\Windows\System\tXylSZR.exe
  2⤵
  PID:11448
- C:\Windows\System\qhtybon.exe
  C:\Windows\System\qhtybon.exe
  2⤵
  PID:11532
- C:\Windows\System\xqywomU.exe
  C:\Windows\System\xqywomU.exe
  2⤵
  PID:11556
- C:\Windows\System\CkROGOy.exe
  C:\Windows\System\CkROGOy.exe
  2⤵
  PID:11632
- C:\Windows\System\wtlVnhw.exe
  C:\Windows\System\wtlVnhw.exe
  2⤵
  PID:11708
- C:\Windows\System\DjbBjBl.exe
  C:\Windows\System\DjbBjBl.exe
  2⤵
  PID:11812
- C:\Windows\System\gwEsNGx.exe
  C:\Windows\System\gwEsNGx.exe
  2⤵
  PID:11880
- C:\Windows\System\fUGNsWa.exe
  C:\Windows\System\fUGNsWa.exe
  2⤵
  PID:11928
- C:\Windows\System\CkpCWbM.exe
  C:\Windows\System\CkpCWbM.exe
  2⤵
  PID:11984
- C:\Windows\System\MkLmJGJ.exe
  C:\Windows\System\MkLmJGJ.exe
  2⤵
  PID:12064
- C:\Windows\System\nJRtmEH.exe
  C:\Windows\System\nJRtmEH.exe
  2⤵
  PID:12072
- C:\Windows\System\FCdBcbn.exe
  C:\Windows\System\FCdBcbn.exe
  2⤵
  PID:12112
- C:\Windows\System\nblxtsn.exe
  C:\Windows\System\nblxtsn.exe
  2⤵
  PID:12216
- C:\Windows\System\XCrJZHf.exe
  C:\Windows\System\XCrJZHf.exe
  2⤵
  PID:11268
- C:\Windows\System\cYXiDRc.exe
  C:\Windows\System\cYXiDRc.exe
  2⤵
  PID:11344
- C:\Windows\System\TxEYyej.exe
  C:\Windows\System\TxEYyej.exe
  2⤵
  PID:11580
- C:\Windows\System\nFUfZJN.exe
  C:\Windows\System\nFUfZJN.exe
  2⤵
  PID:11680
- C:\Windows\System\PuXBHqh.exe
  C:\Windows\System\PuXBHqh.exe
  2⤵
  PID:11852
- C:\Windows\System\cuPCvFl.exe
  C:\Windows\System\cuPCvFl.exe
  2⤵
  PID:11932
- C:\Windows\System\jkNLRZl.exe
  C:\Windows\System\jkNLRZl.exe
  2⤵
  PID:12176
- C:\Windows\System\WQyzlAT.exe
  C:\Windows\System\WQyzlAT.exe
  2⤵
  PID:11652
- C:\Windows\System\ICxgCjk.exe
  C:\Windows\System\ICxgCjk.exe
  2⤵
  PID:12020
- C:\Windows\System\LYwusaM.exe
  C:\Windows\System\LYwusaM.exe
  2⤵
  PID:12268
- C:\Windows\System\wxswKAx.exe
  C:\Windows\System\wxswKAx.exe
  2⤵
  PID:11892
- C:\Windows\System\niwPXZb.exe
  C:\Windows\System\niwPXZb.exe
  2⤵
  PID:12300
- C:\Windows\System\HkojgxL.exe
  C:\Windows\System\HkojgxL.exe
  2⤵
  PID:12324
- C:\Windows\System\bordICY.exe
  C:\Windows\System\bordICY.exe
  2⤵
  PID:12388
- C:\Windows\System\ErdlQGN.exe
  C:\Windows\System\ErdlQGN.exe
  2⤵
  PID:12416
- C:\Windows\System\nKNNMKI.exe
  C:\Windows\System\nKNNMKI.exe
  2⤵
  PID:12436
- C:\Windows\System\IJKtGDf.exe
  C:\Windows\System\IJKtGDf.exe
  2⤵
  PID:12488
- C:\Windows\System\pouxTNM.exe
  C:\Windows\System\pouxTNM.exe
  2⤵
  PID:12504
- C:\Windows\System\UiHIabG.exe
  C:\Windows\System\UiHIabG.exe
  2⤵
  PID:12528
- C:\Windows\System\NExwuJO.exe
  C:\Windows\System\NExwuJO.exe
  2⤵
  PID:12552
- C:\Windows\System\EcCIyqB.exe
  C:\Windows\System\EcCIyqB.exe
  2⤵
  PID:12568
- C:\Windows\System\XMOfoKf.exe
  C:\Windows\System\XMOfoKf.exe
  2⤵
  PID:12616
- C:\Windows\System\SDMVaoQ.exe
  C:\Windows\System\SDMVaoQ.exe
  2⤵
  PID:12636
- C:\Windows\System\KLnBxvP.exe
  C:\Windows\System\KLnBxvP.exe
  2⤵
  PID:12672
- C:\Windows\System\jObXmPj.exe
  C:\Windows\System\jObXmPj.exe
  2⤵
  PID:12696
- C:\Windows\System\MPlSOIl.exe
  C:\Windows\System\MPlSOIl.exe
  2⤵
  PID:12724
- C:\Windows\System\vzRhcqA.exe
  C:\Windows\System\vzRhcqA.exe
  2⤵
  PID:12752
- C:\Windows\System\NfAhCNa.exe
  C:\Windows\System\NfAhCNa.exe
  2⤵
  PID:12776
- C:\Windows\System\PAhSMff.exe
  C:\Windows\System\PAhSMff.exe
  2⤵
  PID:12812
- C:\Windows\System\DwIGhUP.exe
  C:\Windows\System\DwIGhUP.exe
  2⤵
  PID:12840
- C:\Windows\System\PEzOMqL.exe
  C:\Windows\System\PEzOMqL.exe
  2⤵
  PID:12864
- C:\Windows\System\zmSnGgA.exe
  C:\Windows\System\zmSnGgA.exe
  2⤵
  PID:12908
- C:\Windows\System\BqdLiOK.exe
  C:\Windows\System\BqdLiOK.exe
  2⤵
  PID:12924
- C:\Windows\System\SoPSCxO.exe
  C:\Windows\System\SoPSCxO.exe
  2⤵
  PID:12964
- C:\Windows\System\obtNwJh.exe
  C:\Windows\System\obtNwJh.exe
  2⤵
  PID:12980
- C:\Windows\System\xLUofSJ.exe
  C:\Windows\System\xLUofSJ.exe
  2⤵
  PID:13008
- C:\Windows\System\ZebtDuQ.exe
  C:\Windows\System\ZebtDuQ.exe
  2⤵
  PID:13040
- C:\Windows\System\SbRAfud.exe
  C:\Windows\System\SbRAfud.exe
  2⤵
  PID:13076
- C:\Windows\System\AJLkLBc.exe
  C:\Windows\System\AJLkLBc.exe
  2⤵
  PID:13096
- C:\Windows\System\XEzDdnY.exe
  C:\Windows\System\XEzDdnY.exe
  2⤵
  PID:13120
- C:\Windows\System\wxkQeQJ.exe
  C:\Windows\System\wxkQeQJ.exe
  2⤵
  PID:13144
- C:\Windows\System\NQIAMES.exe
  C:\Windows\System\NQIAMES.exe
  2⤵
  PID:13164
- C:\Windows\System\ugVNpIE.exe
  C:\Windows\System\ugVNpIE.exe
  2⤵
  PID:13180
- C:\Windows\System\PIDbTKw.exe
  C:\Windows\System\PIDbTKw.exe
  2⤵
  PID:13240
- C:\Windows\System\ynnFzFl.exe
  C:\Windows\System\ynnFzFl.exe
  2⤵
  PID:13260
- C:\Windows\System\xYwpFYQ.exe
  C:\Windows\System\xYwpFYQ.exe
  2⤵
  PID:13276
- C:\Windows\System\uMJsAbm.exe
  C:\Windows\System\uMJsAbm.exe
  2⤵
  PID:12092
- C:\Windows\System\nGTngrB.exe
  C:\Windows\System\nGTngrB.exe
  2⤵
  PID:11612
- C:\Windows\System\ImVzdVN.exe
  C:\Windows\System\ImVzdVN.exe
  2⤵
  PID:12344
- C:\Windows\System\TMuAcll.exe
  C:\Windows\System\TMuAcll.exe
  2⤵
  PID:12444
- C:\Windows\System\YnjlHZV.exe
  C:\Windows\System\YnjlHZV.exe
  2⤵
  PID:12520
- C:\Windows\System\bicnhYs.exe
  C:\Windows\System\bicnhYs.exe
  2⤵
  PID:12540
- C:\Windows\System\qJLUKxD.exe
  C:\Windows\System\qJLUKxD.exe
  2⤵
  PID:12632
- C:\Windows\System\ZbBkgdW.exe
  C:\Windows\System\ZbBkgdW.exe
  2⤵
  PID:12744
- C:\Windows\System\mUmVPbK.exe
  C:\Windows\System\mUmVPbK.exe
  2⤵
  PID:12764
- C:\Windows\System\sYzsqeV.exe
  C:\Windows\System\sYzsqeV.exe
  2⤵
  PID:12792
- C:\Windows\System\SsxTFvI.exe
  C:\Windows\System\SsxTFvI.exe
  2⤵
  PID:12828
- C:\Windows\System\EVKBRTe.exe
  C:\Windows\System\EVKBRTe.exe
  2⤵
  PID:12936
- C:\Windows\System\YwkWjvd.exe
  C:\Windows\System\YwkWjvd.exe
  2⤵
  PID:13000
- C:\Windows\System\pDaIXOg.exe
  C:\Windows\System\pDaIXOg.exe
  2⤵
  PID:13136
- C:\Windows\System\NtJfmgg.exe
  C:\Windows\System\NtJfmgg.exe
  2⤵
  PID:13156
- C:\Windows\System\hYPWdsv.exe
  C:\Windows\System\hYPWdsv.exe
  2⤵
  PID:13200
- C:\Windows\System\utCIGaN.exe
  C:\Windows\System\utCIGaN.exe
  2⤵
  PID:13300
- C:\Windows\System\pZhcmHr.exe
  C:\Windows\System\pZhcmHr.exe
  2⤵
  PID:12292
- C:\Windows\System\ydZNOau.exe
  C:\Windows\System\ydZNOau.exe
  2⤵
  PID:12476
- C:\Windows\System\oMcUgpX.exe
  C:\Windows\System\oMcUgpX.exe
  2⤵
  PID:12692
- C:\Windows\System\xgEnSmq.exe
  C:\Windows\System\xgEnSmq.exe
  2⤵
  PID:12716
- C:\Windows\System\pwpogID.exe
  C:\Windows\System\pwpogID.exe
  2⤵
  PID:12824
- C:\Windows\System\GHQMSoE.exe
  C:\Windows\System\GHQMSoE.exe
  2⤵
  PID:13004
- C:\Windows\System\plNKFzj.exe
  C:\Windows\System\plNKFzj.exe
  2⤵
  PID:13112
- C:\Windows\System\MHPcEUq.exe
  C:\Windows\System\MHPcEUq.exe
  2⤵
  PID:12356
- C:\Windows\System\BwtRfQC.exe
  C:\Windows\System\BwtRfQC.exe
  2⤵
  PID:12516
- C:\Windows\System\ZdEDLie.exe
  C:\Windows\System\ZdEDLie.exe
  2⤵
  PID:13088
- C:\Windows\System\WyPCDGv.exe
  C:\Windows\System\WyPCDGv.exe
  2⤵
  PID:13268
- C:\Windows\System\wMRShDG.exe
  C:\Windows\System\wMRShDG.exe
  2⤵
  PID:13324
- C:\Windows\System\toXruTS.exe
  C:\Windows\System\toXruTS.exe
  2⤵
  PID:13364
- C:\Windows\System\yuEiLiU.exe
  C:\Windows\System\yuEiLiU.exe
  2⤵
  PID:13384
- C:\Windows\System\WZrbuTm.exe
  C:\Windows\System\WZrbuTm.exe
  2⤵
  PID:13424
- C:\Windows\System\PWQbsQC.exe
  C:\Windows\System\PWQbsQC.exe
  2⤵
  PID:13452
- C:\Windows\System\CdtTqgx.exe
  C:\Windows\System\CdtTqgx.exe
  2⤵
  PID:13468
- C:\Windows\System\nqoEdau.exe
  C:\Windows\System\nqoEdau.exe
  2⤵
  PID:13492
- C:\Windows\System\sKivPCu.exe
  C:\Windows\System\sKivPCu.exe
  2⤵
  PID:13512
- C:\Windows\System\RFGdqWE.exe
  C:\Windows\System\RFGdqWE.exe
  2⤵
  PID:13532
- C:\Windows\System\lxzOUcu.exe
  C:\Windows\System\lxzOUcu.exe
  2⤵
  PID:13560
- C:\Windows\System\klvkHel.exe
  C:\Windows\System\klvkHel.exe
  2⤵
  PID:13588
- C:\Windows\System\GyHVVbQ.exe
  C:\Windows\System\GyHVVbQ.exe
  2⤵
  PID:13604
- C:\Windows\System\LhNSprY.exe
  C:\Windows\System\LhNSprY.exe
  2⤵
  PID:13636
- C:\Windows\System\aWGPXwm.exe
  C:\Windows\System\aWGPXwm.exe
  2⤵
  PID:13668
- C:\Windows\System\QmllXRk.exe
  C:\Windows\System\QmllXRk.exe
  2⤵
  PID:13704
- C:\Windows\System\DvbbGNY.exe
  C:\Windows\System\DvbbGNY.exe
  2⤵
  PID:13732
- C:\Windows\System\ILRTIZC.exe
  C:\Windows\System\ILRTIZC.exe
  2⤵
  PID:13760
- C:\Windows\System\QbXcouW.exe
  C:\Windows\System\QbXcouW.exe
  2⤵
  PID:13788
- C:\Windows\System\LsELoOg.exe
  C:\Windows\System\LsELoOg.exe
  2⤵
  PID:13816
- C:\Windows\System\bdzWDXk.exe
  C:\Windows\System\bdzWDXk.exe
  2⤵
  PID:13840
- C:\Windows\System\CWiQJlc.exe
  C:\Windows\System\CWiQJlc.exe
  2⤵
  PID:13868
- C:\Windows\System\yaJgUuA.exe
  C:\Windows\System\yaJgUuA.exe
  2⤵
  PID:13896
- C:\Windows\System\oSegIHI.exe
  C:\Windows\System\oSegIHI.exe
  2⤵
  PID:13916
- C:\Windows\System\fSDWAQl.exe
  C:\Windows\System\fSDWAQl.exe
  2⤵
  PID:13940
- C:\Windows\System\EkNfPAV.exe
  C:\Windows\System\EkNfPAV.exe
  2⤵
  PID:13964
- C:\Windows\System\oVpoJEh.exe
  C:\Windows\System\oVpoJEh.exe
  2⤵
  PID:14044
- C:\Windows\System\dFqFwqb.exe
  C:\Windows\System\dFqFwqb.exe
  2⤵
  PID:14060
- C:\Windows\System\eOOJiyH.exe
  C:\Windows\System\eOOJiyH.exe
  2⤵
  PID:14088
- C:\Windows\System\mGAfYCa.exe
  C:\Windows\System\mGAfYCa.exe
  2⤵
  PID:14112
- C:\Windows\System\RXItKHN.exe
  C:\Windows\System\RXItKHN.exe
  2⤵
  PID:14140
- C:\Windows\System\bjnupLP.exe
  C:\Windows\System\bjnupLP.exe
  2⤵
  PID:14160
- C:\Windows\System\eRVwSIv.exe
  C:\Windows\System\eRVwSIv.exe
  2⤵
  PID:14184
- C:\Windows\System\KIMZhdw.exe
  C:\Windows\System\KIMZhdw.exe
  2⤵
  PID:14200
- C:\Windows\System\ZLcggdR.exe
  C:\Windows\System\ZLcggdR.exe
  2⤵
  PID:14220
- C:\Windows\System\IMxxyPo.exe
  C:\Windows\System\IMxxyPo.exe
  2⤵
  PID:14240
- C:\Windows\System\LIIGNjS.exe
  C:\Windows\System\LIIGNjS.exe
  2⤵
  PID:14276
- C:\Windows\System\rLuadtp.exe
  C:\Windows\System\rLuadtp.exe
  2⤵
  PID:14296
- C:\Windows\System\XOuDYDi.exe
  C:\Windows\System\XOuDYDi.exe
  2⤵
  PID:13376
- C:\Windows\System\HzOIRKs.exe
  C:\Windows\System\HzOIRKs.exe
  2⤵
  PID:13444
- C:\Windows\System\fkNoqov.exe
  C:\Windows\System\fkNoqov.exe
  2⤵
  PID:13504
- C:\Windows\System\jdyxfzA.exe
  C:\Windows\System\jdyxfzA.exe
  2⤵
  PID:13528
- C:\Windows\System\oKawhTF.exe
  C:\Windows\System\oKawhTF.exe
  2⤵
  PID:13540
- C:\Windows\System\XEjGpUb.exe
  C:\Windows\System\XEjGpUb.exe
  2⤵
  PID:13628
- C:\Windows\System\QGojLfi.exe
  C:\Windows\System\QGojLfi.exe
  2⤵
  PID:13720
- C:\Windows\System\EYLgcUr.exe
  C:\Windows\System\EYLgcUr.exe
  2⤵
  PID:13772
- C:\Windows\System\uOwXgXz.exe
  C:\Windows\System\uOwXgXz.exe
  2⤵
  PID:13824
- C:\Windows\System\dGbQEsD.exe
  C:\Windows\System\dGbQEsD.exe
  2⤵
  PID:13952
- C:\Windows\System\isJOoBD.exe
  C:\Windows\System\isJOoBD.exe
  2⤵
  PID:13980
- C:\Windows\System\RdLIEXG.exe
  C:\Windows\System\RdLIEXG.exe
  2⤵
  PID:14076
- C:\Windows\System\UHIMhhr.exe
  C:\Windows\System\UHIMhhr.exe
  2⤵
  PID:14148
- C:\Windows\System\cFSnaMT.exe
  C:\Windows\System\cFSnaMT.exe
  2⤵
  PID:14252
- C:\Windows\System\KsmWaSl.exe
  C:\Windows\System\KsmWaSl.exe
  2⤵
  PID:14284
- C:\Windows\System\QvzvvRE.exe
  C:\Windows\System\QvzvvRE.exe
  2⤵
  PID:14324
- C:\Windows\System\ZbygeUU.exe
  C:\Windows\System\ZbygeUU.exe
  2⤵
  PID:13336
- C:\Windows\System\omozxlM.exe
  C:\Windows\System\omozxlM.exe
  2⤵
  PID:13488
- C:\Windows\System\FwXavWK.exe
  C:\Windows\System\FwXavWK.exe
  2⤵
  PID:13688
- C:\Windows\System\CMQRYlc.exe
  C:\Windows\System\CMQRYlc.exe
  2⤵
  PID:13784
- C:\Windows\System\KhjbleE.exe
  C:\Windows\System\KhjbleE.exe
  2⤵
  PID:13924
- C:\Windows\System\rwTiRoc.exe
  C:\Windows\System\rwTiRoc.exe
  2⤵
  PID:14108
- C:\Windows\System\ldVNBhg.exe
  C:\Windows\System\ldVNBhg.exe
  2⤵
  PID:14228
- C:\Windows\System\rmoReEs.exe
  C:\Windows\System\rmoReEs.exe
  2⤵
  PID:13440
- C:\Windows\System\WHcDwZK.exe
  C:\Windows\System\WHcDwZK.exe
  2⤵
  PID:14196
- C:\Windows\System\KybMNnK.exe
  C:\Windows\System\KybMNnK.exe
  2⤵
  PID:14168
- C:\Windows\System\iudeeXC.exe
  C:\Windows\System\iudeeXC.exe
  2⤵
  PID:14004
- C:\Windows\System\UkauZBq.exe
  C:\Windows\System\UkauZBq.exe
  2⤵
  PID:14344
- C:\Windows\System\CoTtkbb.exe
  C:\Windows\System\CoTtkbb.exe
  2⤵
  PID:14396
- C:\Windows\System\XzaSCFi.exe
  C:\Windows\System\XzaSCFi.exe
  2⤵
  PID:14416
- C:\Windows\System\yzHfdWC.exe
  C:\Windows\System\yzHfdWC.exe
  2⤵
  PID:14432
- C:\Windows\System\fFORlrf.exe
  C:\Windows\System\fFORlrf.exe
  2⤵
  PID:14464
- C:\Windows\System\LebMErH.exe
  C:\Windows\System\LebMErH.exe
  2⤵
  PID:14484
- C:\Windows\System\KEwillY.exe
  C:\Windows\System\KEwillY.exe
  2⤵
  PID:14508
- C:\Windows\System\dsUSaPc.exe
  C:\Windows\System\dsUSaPc.exe
  2⤵
  PID:14540
- C:\Windows\System\OOedQjF.exe
  C:\Windows\System\OOedQjF.exe
  2⤵
  PID:14568
- C:\Windows\System\AoupnnF.exe
  C:\Windows\System\AoupnnF.exe
  2⤵
  PID:14588
- C:\Windows\System\TiLFAgi.exe
  C:\Windows\System\TiLFAgi.exe
  2⤵
  PID:14608
- C:\Windows\System\SRtcYuo.exe
  C:\Windows\System\SRtcYuo.exe
  2⤵
  PID:14628
- C:\Windows\System\VNwLjrx.exe
  C:\Windows\System\VNwLjrx.exe
  2⤵
  PID:14672
- C:\Windows\System\nDgWNSO.exe
  C:\Windows\System\nDgWNSO.exe
  2⤵
  PID:14716
- C:\Windows\System\BnnBVNE.exe
  C:\Windows\System\BnnBVNE.exe
  2⤵
  PID:14748
- C:\Windows\System\TeoEhvP.exe
  C:\Windows\System\TeoEhvP.exe
  2⤵
  PID:14772
- C:\Windows\System\VpejSWn.exe
  C:\Windows\System\VpejSWn.exe
  2⤵
  PID:14792
- C:\Windows\System\XwXquLP.exe
  C:\Windows\System\XwXquLP.exe
  2⤵
  PID:14836
- C:\Windows\System\Egrfwym.exe
  C:\Windows\System\Egrfwym.exe
  2⤵
  PID:14876
- C:\Windows\System\qnyBqBM.exe
  C:\Windows\System\qnyBqBM.exe
  2⤵
  PID:14896
- C:\Windows\System\THAjWBd.exe
  C:\Windows\System\THAjWBd.exe
  2⤵
  PID:14920
- C:\Windows\System\eNOqahF.exe
  C:\Windows\System\eNOqahF.exe
  2⤵
  PID:14936
- C:\Windows\System\ykkjQDB.exe
  C:\Windows\System\ykkjQDB.exe
  2⤵
  PID:14964
- C:\Windows\System\WLdmOPM.exe
  C:\Windows\System\WLdmOPM.exe
  2⤵
  PID:14996
- C:\Windows\System\XvWAbTg.exe
  C:\Windows\System\XvWAbTg.exe
  2⤵
  PID:15044
- C:\Windows\System\PoHDFNX.exe
  C:\Windows\System\PoHDFNX.exe
  2⤵
  PID:15060
- C:\Windows\System\zQdVUAz.exe
  C:\Windows\System\zQdVUAz.exe
  2⤵
  PID:15088
- C:\Windows\System\WSUBShv.exe
  C:\Windows\System\WSUBShv.exe
  2⤵
  PID:15104
- C:\Windows\System\uXFSYNY.exe
  C:\Windows\System\uXFSYNY.exe
  2⤵
  PID:15144
- C:\Windows\System\oCICTND.exe
  C:\Windows\System\oCICTND.exe
  2⤵
  PID:15184
- C:\Windows\System\qiPSmEl.exe
  C:\Windows\System\qiPSmEl.exe
  2⤵
  PID:15200
- C:\Windows\System\hpvIdic.exe
  C:\Windows\System\hpvIdic.exe
  2⤵
  PID:15240
- C:\Windows\System\SsLmCQs.exe
  C:\Windows\System\SsLmCQs.exe
  2⤵
  PID:15268
- C:\Windows\System\CvWyGPO.exe
  C:\Windows\System\CvWyGPO.exe
  2⤵
  PID:15284
- C:\Windows\System\URFUgeI.exe
  C:\Windows\System\URFUgeI.exe
  2⤵
  PID:15300
- C:\Windows\System\gVEZzKo.exe
  C:\Windows\System\gVEZzKo.exe
  2⤵
  PID:15316
- C:\Windows\System\yBVMpVI.exe
  C:\Windows\System\yBVMpVI.exe
  2⤵
  PID:13648
- C:\Windows\System\ZhomEgl.exe
  C:\Windows\System\ZhomEgl.exe
  2⤵
  PID:14380
- C:\Windows\System\mSwnmKJ.exe
  C:\Windows\System\mSwnmKJ.exe
  2⤵
  PID:14428
- C:\Windows\System\FHKUoEB.exe
  C:\Windows\System\FHKUoEB.exe
  2⤵
  PID:14504
- C:\Windows\System\ywucHkL.exe
  C:\Windows\System\ywucHkL.exe
  2⤵
  PID:14552
- C:\Windows\System\hntPzCN.exe
  C:\Windows\System\hntPzCN.exe
  2⤵
  PID:14604
- C:\Windows\System\yqmQfBk.exe
  C:\Windows\System\yqmQfBk.exe
  2⤵
  PID:14668
- C:\Windows\System\TloguUp.exe
  C:\Windows\System\TloguUp.exe
  2⤵
  PID:14788
- C:\Windows\System\zylvAPY.exe
  C:\Windows\System\zylvAPY.exe
  2⤵
  PID:14860
- C:\Windows\System\ybbNmap.exe
  C:\Windows\System\ybbNmap.exe
  2⤵
  PID:14932
- C:\Windows\System\oCKTZkw.exe
  C:\Windows\System\oCKTZkw.exe
  2⤵
  PID:14956
- C:\Windows\System\NTczDkZ.exe
  C:\Windows\System\NTczDkZ.exe
  2⤵
  PID:15096
- C:\Windows\System\KLjZzWu.exe
  C:\Windows\System\KLjZzWu.exe
  2⤵
  PID:15132
- C:\Windows\System\KRWSEzI.exe
  C:\Windows\System\KRWSEzI.exe
  2⤵
  PID:15172
- C:\Windows\System\kNKcKQT.exe
  C:\Windows\System\kNKcKQT.exe
  2⤵
  PID:15256
- C:\Windows\System\fxynscf.exe
  C:\Windows\System\fxynscf.exe
  2⤵
  PID:15308
- C:\Windows\System\LgKugan.exe
  C:\Windows\System\LgKugan.exe
  2⤵
  PID:15352
- C:\Windows\System\OMWvNiR.exe
  C:\Windows\System\OMWvNiR.exe
  2⤵
  PID:14444
- C:\Windows\System\CMYXGbI.exe
  C:\Windows\System\CMYXGbI.exe
  2⤵
  PID:14660
- C:\Windows\System\QfxlHQd.exe
  C:\Windows\System\QfxlHQd.exe
  2⤵
  PID:14784
- C:\Windows\System\mhmAnqM.exe
  C:\Windows\System\mhmAnqM.exe
  2⤵
  PID:14948
- C:\Windows\System\nuycUjI.exe
  C:\Windows\System\nuycUjI.exe
  2⤵
  PID:15080
- C:\Windows\System\KAUsHUg.exe
  C:\Windows\System\KAUsHUg.exe
  2⤵
  PID:15232
- C:\Windows\System\tOJhmqj.exe
  C:\Windows\System\tOJhmqj.exe
  2⤵
  PID:15332
- C:\Windows\System\rUjusBy.exe
  C:\Windows\System\rUjusBy.exe
  2⤵
  PID:14580
- C:\Windows\System\IYwENvy.exe
  C:\Windows\System\IYwENvy.exe
  2⤵
  PID:14820
- C:\Windows\System\SAjQUEN.exe
  C:\Windows\System\SAjQUEN.exe
  2⤵
  PID:14644
- C:\Windows\System\rFRuUFe.exe
  C:\Windows\System\rFRuUFe.exe
  2⤵
  PID:15216
- C:\Windows\System\zRwJbCx.exe
  C:\Windows\System\zRwJbCx.exe
  2⤵
  PID:15380
- C:\Windows\System\YNLQnPf.exe
  C:\Windows\System\YNLQnPf.exe
  2⤵
  PID:15404
- C:\Windows\System\SPIJJZw.exe
  C:\Windows\System\SPIJJZw.exe
  2⤵
  PID:15432
- C:\Windows\System\dWUFlZM.exe
  C:\Windows\System\dWUFlZM.exe
  2⤵
  PID:15484
- C:\Windows\System\hWWPdrY.exe
  C:\Windows\System\hWWPdrY.exe
  2⤵
  PID:15504
- C:\Windows\System\mDoWFXS.exe
  C:\Windows\System\mDoWFXS.exe
  2⤵
  PID:15532
- C:\Windows\System\hMguvyJ.exe
  C:\Windows\System\hMguvyJ.exe
  2⤵
  PID:15552
- C:\Windows\System\MEtwWir.exe
  C:\Windows\System\MEtwWir.exe
  2⤵
  PID:15580
- C:\Windows\System\fsffwAl.exe
  C:\Windows\System\fsffwAl.exe
  2⤵
  PID:15612
- C:\Windows\System\nIxfsgy.exe
  C:\Windows\System\nIxfsgy.exe
  2⤵
  PID:15632
- C:\Windows\System\ilFZojb.exe
  C:\Windows\System\ilFZojb.exe
  2⤵
  PID:15660
- C:\Windows\System\cxnOhNS.exe
  C:\Windows\System\cxnOhNS.exe
  2⤵
  PID:15676
- C:\Windows\System\FxWQakL.exe
  C:\Windows\System\FxWQakL.exe
  2⤵
  PID:15696
- C:\Windows\System\JwQZjSb.exe
  C:\Windows\System\JwQZjSb.exe
  2⤵
  PID:15764
- C:\Windows\System\JdrjllO.exe
  C:\Windows\System\JdrjllO.exe
  2⤵
  PID:15780
- C:\Windows\System\dUwhATD.exe
  C:\Windows\System\dUwhATD.exe
  2⤵
  PID:15824
- C:\Windows\System\BjsUKHG.exe
  C:\Windows\System\BjsUKHG.exe
  2⤵
  PID:15852
- C:\Windows\System\tunVHCQ.exe
  C:\Windows\System\tunVHCQ.exe
  2⤵
  PID:15876
- C:\Windows\System\PHfEDro.exe
  C:\Windows\System\PHfEDro.exe
  2⤵
  PID:15896
- C:\Windows\System\VTGtnLK.exe
  C:\Windows\System\VTGtnLK.exe
  2⤵
  PID:15928
- C:\Windows\System\FcEyvyz.exe
  C:\Windows\System\FcEyvyz.exe
  2⤵
  PID:15960
- C:\Windows\System\MzhcQxv.exe
  C:\Windows\System\MzhcQxv.exe
  2⤵
  PID:15980
- C:\Windows\System\AGGYuvt.exe
  C:\Windows\System\AGGYuvt.exe
  2⤵
  PID:15996
- C:\Windows\System\WMzWnAw.exe
  C:\Windows\System\WMzWnAw.exe
  2⤵
  PID:16024
- C:\Windows\System\FvsmxMe.exe
  C:\Windows\System\FvsmxMe.exe
  2⤵
  PID:16052
- C:\Windows\System\moKfqGc.exe
  C:\Windows\System\moKfqGc.exe
  2⤵
  PID:16068
- C:\Windows\System\CdWiYvf.exe
  C:\Windows\System\CdWiYvf.exe
  2⤵
  PID:16124
- C:\Windows\System\aLCqMMO.exe
  C:\Windows\System\aLCqMMO.exe
  2⤵
  PID:16152
- C:\Windows\System\fGfhwMG.exe
  C:\Windows\System\fGfhwMG.exe
  2⤵
  PID:16188
- C:\Windows\System\ZjKMckS.exe
  C:\Windows\System\ZjKMckS.exe
  2⤵
  PID:16208
- C:\Windows\System\IaLVkYl.exe
  C:\Windows\System\IaLVkYl.exe
  2⤵
  PID:16228
- C:\Windows\System\xMZQLpX.exe
  C:\Windows\System\xMZQLpX.exe
  2⤵
  PID:16248
- C:\Windows\System\tePCNLu.exe
  C:\Windows\System\tePCNLu.exe
  2⤵
  PID:16280
- C:\Windows\System\DsRnyAt.exe
  C:\Windows\System\DsRnyAt.exe
  2⤵
  PID:16316
- C:\Windows\System\dAvQvys.exe
  C:\Windows\System\dAvQvys.exe
  2⤵
  PID:16340
- C:\Windows\System\ZOBqvlA.exe
  C:\Windows\System\ZOBqvlA.exe
  2⤵
  PID:16360
- C:\Windows\System\PWHuEZc.exe
  C:\Windows\System\PWHuEZc.exe
  2⤵
  PID:15028
- C:\Windows\System\MLsGbXA.exe
  C:\Windows\System\MLsGbXA.exe
  2⤵
  PID:15392
- C:\Windows\System\QaycNhp.exe
  C:\Windows\System\QaycNhp.exe
  2⤵
  PID:15452
- C:\Windows\System\ItetVNU.exe
  C:\Windows\System\ItetVNU.exe
  2⤵
  PID:15648
- C:\Windows\System\IsbxOII.exe
  C:\Windows\System\IsbxOII.exe
  2⤵
  PID:15644
- C:\Windows\System\ulpTTHY.exe
  C:\Windows\System\ulpTTHY.exe
  2⤵
  PID:15656
- C:\Windows\System\zTYXKWq.exe
  C:\Windows\System\zTYXKWq.exe
  2⤵
  PID:15772
- C:\Windows\System\aGEPsxD.exe
  C:\Windows\System\aGEPsxD.exe
  2⤵
  PID:15888
- C:\Windows\System\jjTKsXO.exe
  C:\Windows\System\jjTKsXO.exe
  2⤵
  PID:15916
- C:\Windows\System\IHpMceD.exe
  C:\Windows\System\IHpMceD.exe
  2⤵
  PID:15992
- C:\Windows\System\GTNgwkk.exe
  C:\Windows\System\GTNgwkk.exe
  2⤵
  PID:16032
- C:\Windows\System\CBlBKcX.exe
  C:\Windows\System\CBlBKcX.exe
  2⤵
  PID:16104
- C:\Windows\System\amnQDZV.exe
  C:\Windows\System\amnQDZV.exe
  2⤵
  PID:16196
- C:\Windows\System\sbAvRww.exe
  C:\Windows\System\sbAvRww.exe
  2⤵
  PID:16224
- C:\Windows\System\trgclak.exe
  C:\Windows\System\trgclak.exe
  2⤵
  PID:16292
- C:\Windows\System\wPajkhC.exe
  C:\Windows\System\wPajkhC.exe
  2⤵
  PID:1988
- C:\Windows\System\YIPNUYo.exe
  C:\Windows\System\YIPNUYo.exe
  2⤵
  PID:2596
- C:\Windows\System\RspfJAH.exe
  C:\Windows\System\RspfJAH.exe
  2⤵
  PID:16312
- C:\Windows\System\DbImUgX.exe
  C:\Windows\System\DbImUgX.exe
  2⤵
  PID:14368
- C:\Windows\System\lJGvyUh.exe
  C:\Windows\System\lJGvyUh.exe
  2⤵
  PID:15540
- C:\Windows\System\fwgqgfq.exe
  C:\Windows\System\fwgqgfq.exe
  2⤵
  PID:15572
- C:\Windows\System\QEFAYDW.exe
  C:\Windows\System\QEFAYDW.exe
  2⤵
  PID:15812
- C:\Windows\System\CbZfVyN.exe
  C:\Windows\System\CbZfVyN.exe
  2⤵
  PID:15868
- C:\Windows\System\xnlcpuG.exe
  C:\Windows\System\xnlcpuG.exe
  2⤵
  PID:16096
- C:\Windows\System\BJRjOXN.exe
  C:\Windows\System\BJRjOXN.exe
  2⤵
  PID:16172
- C:\Windows\System\gZUeFOX.exe
  C:\Windows\System\gZUeFOX.exe
  2⤵
  PID:16332
- C:\Windows\System\DjsdtIa.exe
  C:\Windows\System\DjsdtIa.exe
  2⤵
  PID:16324
- C:\Windows\System\rArylNW.exe
  C:\Windows\System\rArylNW.exe
  2⤵
  PID:16380
- C:\Windows\System\ijexzqu.exe
  C:\Windows\System\ijexzqu.exe
  2⤵
  PID:15840
- C:\Windows\System\MTcmXld.exe
  C:\Windows\System\MTcmXld.exe
  2⤵
  PID:15988
- C:\Windows\System\SirdveW.exe
  C:\Windows\System\SirdveW.exe
  2⤵
  PID:16396
- C:\Windows\System\MGltLym.exe
  C:\Windows\System\MGltLym.exe
  2⤵
  PID:16416
- C:\Windows\System\lbepUMb.exe
  C:\Windows\System\lbepUMb.exe
  2⤵
  PID:16432
- C:\Windows\System\mKEIqEh.exe
  C:\Windows\System\mKEIqEh.exe
  2⤵
  PID:16448
- C:\Windows\System\kcgUHDN.exe
  C:\Windows\System\kcgUHDN.exe
  2⤵
  PID:16472
- C:\Windows\System\cUIHRVS.exe
  C:\Windows\System\cUIHRVS.exe
  2⤵
  PID:16492
- C:\Windows\System\nuEPJPr.exe
  C:\Windows\System\nuEPJPr.exe
  2⤵
  PID:16528
- C:\Windows\System\SERbvFm.exe
  C:\Windows\System\SERbvFm.exe
  2⤵
  PID:16544
- C:\Windows\System\EQWFwSl.exe
  C:\Windows\System\EQWFwSl.exe
  2⤵
  PID:16564
- C:\Windows\System\TLZuDPj.exe
  C:\Windows\System\TLZuDPj.exe
  2⤵
  PID:16580
- C:\Windows\System\OsPpTHZ.exe
  C:\Windows\System\OsPpTHZ.exe
  2⤵
  PID:16600
- C:\Windows\System\dULwQyA.exe
  C:\Windows\System\dULwQyA.exe
  2⤵
  PID:16620
- C:\Windows\System\yASzDwz.exe
  C:\Windows\System\yASzDwz.exe
  2⤵
  PID:16636
- C:\Windows\System\leDmnzw.exe
  C:\Windows\System\leDmnzw.exe
  2⤵
  PID:16652
- C:\Windows\System\JvvVzzc.exe
  C:\Windows\System\JvvVzzc.exe
  2⤵
  PID:16680
- C:\Windows\System\HBczZgv.exe
  C:\Windows\System\HBczZgv.exe
  2⤵
  PID:16704
- C:\Windows\System\fxrFyVD.exe
  C:\Windows\System\fxrFyVD.exe
  2⤵
  PID:16728
- C:\Windows\System\UYjsuHv.exe
  C:\Windows\System\UYjsuHv.exe
  2⤵
  PID:16748
- C:\Windows\System\FLvBcMd.exe
  C:\Windows\System\FLvBcMd.exe
  2⤵
  PID:16764
- C:\Windows\System\ABbtJDN.exe
  C:\Windows\System\ABbtJDN.exe
  2⤵
  PID:16788
- C:\Windows\System\dWMMZJP.exe
  C:\Windows\System\dWMMZJP.exe
  2⤵
  PID:16808
- C:\Windows\System\fLXnoSJ.exe
  C:\Windows\System\fLXnoSJ.exe
  2⤵
  PID:16824
- C:\Windows\System\DUGrJte.exe
  C:\Windows\System\DUGrJte.exe
  2⤵
  PID:16840
- C:\Windows\System\FxVmNqQ.exe
  C:\Windows\System\FxVmNqQ.exe
  2⤵
  PID:16856
- C:\Windows\System\HyBmMjZ.exe
  C:\Windows\System\HyBmMjZ.exe
  2⤵
  PID:16872
- C:\Windows\System\tytekpn.exe
  C:\Windows\System\tytekpn.exe
  2⤵
  PID:16904
- C:\Windows\System\mRhEbFG.exe
  C:\Windows\System\mRhEbFG.exe
  2⤵
  PID:16932
- C:\Windows\System\UEPHITZ.exe
  C:\Windows\System\UEPHITZ.exe
  2⤵
  PID:16948
- C:\Windows\System\GQApAMA.exe
  C:\Windows\System\GQApAMA.exe
  2⤵
  PID:16976
- C:\Windows\System\XKpFEpd.exe
  C:\Windows\System\XKpFEpd.exe
  2⤵
  PID:17000
- C:\Windows\System\wVMDGsG.exe
  C:\Windows\System\wVMDGsG.exe
  2⤵
  PID:17020

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16800

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BjdgmcB.exe

Filesize
1.1MB

MD5
38589c2528f97070c44321bb222635e2

SHA1
c0a0b68ab923acc4e5df07e5b0ceb1af363d6188

SHA256
f0cccd5ccd70e7546f290340c4ffaf42ca32271f5fc250b1f2a3c105ab46ce18

SHA512
a567dfb71e65b340cd3772a58c19ec22a7dfe71934a2c6a202f017d77db9246e624ee7a223d4b7e5ffc945350a31081e3a9c261ee661ec5475b182b981dc9b98

Download Submit
C:\Windows\System\DMosHtW.exe

Filesize
1.1MB

MD5
03fa7b5903854daaaa291800b125a65b

SHA1
f1c020e6dec0eaf591bd4746a9427af2a50e6ae9

SHA256
83bd0460623a3b720a66176b9043fd4352e2b3ef39543c8a4a23742015f64a66

SHA512
c22464cbfa3a5e3a6d24ed4b4c5dc55ea23c4fe4a8e1ac452f91d6685e829dacd0dfd964d4a8735d186a479d76a6e78f5090a98a72ac72993781b6aa6d8d4423

Download Submit
C:\Windows\System\DSJqezg.exe

Filesize
1.1MB

MD5
834f97a62ef6075a7dc8403411ba53c0

SHA1
2b5316512f99113d1da3648300df2f8bdb011cd8

SHA256
c81b46a104b1eb482ba5d58545ba9b771af92314ab9adfc006a0cd166dce9890

SHA512
a1f5f247921cfe73cff3c9918fb5ac8689c9cd715c00955338e9b0fb62c8c76c1b8e52cb774141701d65d101cc4e19dd0029c7646c9011b95f475fb64b786115

Download Submit
C:\Windows\System\EgBFcqc.exe

Filesize
1.1MB

MD5
24c7674cabf4ff47df93c51d2392e4f5

SHA1
867379e4b19be43970cf2c5a9c4918c6db1aa065

SHA256
5d3049dbc304ded38a1389640bb306f40eaa98a1998a3f877a118c94212f93c4

SHA512
1a85e94b1c2c6e31b73122ed3afa5936ebd6791be60c5218a1bdf10e4732cb0889bda2509bb52fbe2d722204f8f4a874cea24fdb6d469324bc8da29f9b34972e

Download Submit
C:\Windows\System\FtxRlbv.exe

Filesize
1.1MB

MD5
cbd21430043187b6c2c214262c50ff29

SHA1
812d8bcf4ea04ba91f29b038883fe75787bc8adc

SHA256
4f833de0cba863549c3e8029d092cd6230240d36a740ac213749ddf1a6bfe444

SHA512
3aaa4df9e389b3ea452aec1640668254e1278059695e39e819ff691593b359872e3d514000c26280a289f11338a4ae6abc4a2b9f591347b8bc84ba333575497f

Download Submit
C:\Windows\System\GOKJxJw.exe

Filesize
1.1MB

MD5
471d41bf24191955bab9ef912f69360f

SHA1
18393a47a9df1300fec8f6d3f62ed740eae3ce6e

SHA256
54ec6b76e8febe2f68f2876e5e5ad1c0fe29fbb8cb0bdd503c1358a95fc2431f

SHA512
9479e987ccdd3d62f8fb1e0a61a06ea65c0a87fc0523a257cd39439a000eb6073aed87676aba03a3a5d14df8ebf1c785b5ab07b41bb7a3c83d2f9964e2fbb176

Download Submit
C:\Windows\System\KAMgJwT.exe

Filesize
1.1MB

MD5
1d3a2b3197e1c8aa4a268d525f24a843

SHA1
cfa6d3b3a04d440d7838c2e25baa4088f3401af5

SHA256
ab9dbbd802b3eaa9e9fca4ff3eec63a2de3f9f6e2b407a45852c3b7a24ef3de0

SHA512
5dfc39b5cbc44a3c5298d2b5ea05de813bc7045fc85df031a66be775e17bd8c80a655a6c397ca67e39d97d09368d6fcd6bb9d333a0ed80664388a5585ba710a7

Download Submit
C:\Windows\System\KUMrKPN.exe

Filesize
1.1MB

MD5
555543531c2196ab17aa8f53a0dcd940

SHA1
f2b03ed8665e7a05dbc29223b3acd91ef3436474

SHA256
b53a3db151fe70b96f4fd5aadf6e9f2279d2bb8f7fd56d8a43c2c0a9b7930001

SHA512
0e4c771f371de1cea30ac96a05a86b9c2bada72e9b39ec013914bd42916ad6320340962e7cf32bfdc71aa716bbc279044208fa839d2d827a9906c2fd6587aa4c

Download Submit
C:\Windows\System\KwaWrHW.exe

Filesize
1.1MB

MD5
7111e95c8fcba96c96cf64e7c9b1172d

SHA1
96358b21f690b036cb6284fbf539008fa3f263a6

SHA256
b95f818aff54affe5d02abf5232c8783aa78010f1cb11bba050b2f3e1fa26e36

SHA512
9063252642439fd8505113c3c1b9f8e8dcfbd3306f7322337828ae1de21ffe5a6abcacf0edd8ba8f3ead2fc24c9bdc62cd78430faf0755eac9a4a3fc325ca389

Download Submit
C:\Windows\System\MniIOTq.exe

Filesize
1.1MB

MD5
b07d30dd932fbcba68415425ce679cec

SHA1
238357d1636aaccbd7da4ff09d0a95ce3eea8c96

SHA256
c3849a9a710704864731e1825177ec74254d82892e1792ba853e14bd6c1558f4

SHA512
64aa905676962a43b940f29084d241b0ac00a0ea62ce513799b0261e74dd411a8e072794f2a205995bf07f612e5d0ad34a1cbf54f70f5e70cbf70d28ae3c08af

Download Submit
C:\Windows\System\NBkMrcU.exe

Filesize
1.1MB

MD5
2208c3a162b119e92f9956b5ba8bb683

SHA1
fca1cd72d6531190df4bd7191229db70e818671f

SHA256
352e20dc73ee5f1ad2b224365f8bc2f841bee21f91d4587e96d03c11b121b3e9

SHA512
fa647649d3d8888e72eaf2a87a6a7cf76885faf7dbeee9cf797ee10ba68e2e1c56ea8f7c25978b5e7681ac766223955da57762db177e34b67764c7d44e673570

Download Submit
C:\Windows\System\NLpJWKt.exe

Filesize
1.1MB

MD5
f9104a5a4db6bda8f7a94845fdabfffd

SHA1
88e1fb4a5e8f5077ed8594ffb9e32e80ff21c0ed

SHA256
5681d5574f1b094a714224be42507e9c4d4eba008becdcf8a55d9df6e51317e2

SHA512
b03f8fa34cca935b5873bca73ea503d8014fec38a0efc89c3c65a88782fba3ce9eb6493601e87c24749b76e24806fa4a3cde88c9347bd6e2593db3fe1f932119

Download Submit
C:\Windows\System\OZQFbbd.exe

Filesize
1.1MB

MD5
0dfe6635ddb6f030399902352f050375

SHA1
45d07226d643dec16971195de7425b3f5007c79b

SHA256
7f6b6e6b5af2c75ce8300e7eb77ab551a75b0bf5f3881282351a405666f85a79

SHA512
75f12c79849a4c0e523356c183ed630f80ef7f38d671a33836323063ed567c5fe9b0acce383c5b9f823b7f893a67c8de570cc853c14190c586d3e83465e35a68

Download Submit
C:\Windows\System\OaFEkie.exe

Filesize
1.1MB

MD5
ca7407976acf5f8c8b85bd3f51c67b4a

SHA1
dcb54579cc9fbefc80f4d66a2056c3297bb53c59

SHA256
8811a31675ee53fd98b464fbe47458fd75dd0dcdf9e167f5f3c71b331ab5df83

SHA512
3a74a956532b7cc36662ba087410c96e9362fb75ef24e311250dcab388a9037c556a700bc48819d306d40df3eef2864ee21683f308bddde7aa96bc09e1ba2f30

Download Submit
C:\Windows\System\OtzQBum.exe

Filesize
1.1MB

MD5
8231fb1a82efdca2bf95e6f7525b47ea

SHA1
0c8101a216fcfa61c1e9196b6969a93e1e7a1788

SHA256
cb4c8e9762c353df966d972e50395c0ac68f3ebab27e1775115c38396eb38126

SHA512
2ab93d8fb368967f6b59aed53a351f39ae4078c66105c07d80abcb86e2fe65ffa42af140c53aaed2d1e9b63a4fdade095bf494c9f54e29f9b7ef394d2f8dc8aa

Download Submit
C:\Windows\System\OvUhYgp.exe

Filesize
1.1MB

MD5
efc0da435f3ccee72b1192fcb17e738a

SHA1
758262db659c3976f6845bc233ec2926fedbdee8

SHA256
86c11659c4e111fc3ee9faf185efb9c5fd417e6e709da9bb471f3d351e96f97f

SHA512
477334294bebb8caa1b25407e85f89bb535543ed1eb45f3e23530d41fe6faa01071bb8bdee879b6c006520e51902fdbf7f36afab0abb6c633f6796b912f668af

Download Submit
C:\Windows\System\PqFaXmC.exe

Filesize
1.1MB

MD5
ea294caa80a6caac5963b71ee09e6092

SHA1
337525d90ad6bf47e7c24582655e9d78a4b0eea6

SHA256
0b13ed7d2e65a59159bf352d657e671fc99a6848ee5fb934f00599eaddc78f48

SHA512
7bf5e4bf5f6b8a310cdde451efd19ab284de386b7900732040789d3ea1a481ff42cc90095fb3fb70fc93097dbd90c87d8be9bbd01cc180706f0631a1897b1fda

Download Submit
C:\Windows\System\QhkFxml.exe

Filesize
1.1MB

MD5
e88838d7975830ee0ef592463c8a79fa

SHA1
c4ebcd62e107666d783d042bc4b26a8f60cddf1a

SHA256
180baa833bed6a8e8fb427d8ea673de7dbe4564fd2a29130e798909b722d0f13

SHA512
ebb572bd5b91879c3ee280fb750bfe7d51e78339c6cc7a29daec142b5b0f96a808cc4ef74b6f747820bb91ca7423138acc1e9ad7fbdb73f32bc065f982719c82

Download Submit
C:\Windows\System\ShovDNu.exe

Filesize
1.1MB

MD5
fe79f190f184f4008e23023c038b684f

SHA1
db105b4a460b7b600b5ebd40915b88a72803bc00

SHA256
a868fc07cbfbb32361f2fa7f212658b5fecf5913c141ef9a5bf6c976ef91e96e

SHA512
ae6cbe90a40fb763d5a64afb6bf9f30a344ad66ec36d43f54649ea7b572e18528025b004fa2c3b6b8e4481cb2c8a44b3dd2b85cfb8c31b1b36fc2b63bace58aa

Download Submit
C:\Windows\System\WQTORBB.exe

Filesize
1.1MB

MD5
17dd496fa7721bb78d167da2bfffb999

SHA1
86107049b6840319b1f28f64bf6a49f02bbb5b7d

SHA256
c6690aa81b8ad6469eb4d7bb9af899bc4d7235646c5d172237fb9555463d12ba

SHA512
c0bb737673aad21d5870b7aa9fd7d0bcc845904b779f64fd0b94485670725d9efbea07c08d39b8c3cbc743a95a2811bec54f36ff281a4d2680860321ecb5bda4

Download Submit
C:\Windows\System\YouMBgO.exe

Filesize
1.1MB

MD5
06998b5389891becbc4aa3a35477fc15

SHA1
0d2f5244e4ad0675b3f7be895b2a2db4817e8fa6

SHA256
c51371d8189b3444deac1ad2b16239f9e4362cec354ad73cb403d9143bba489e

SHA512
c3ff749dbfdcdde90d88b6fb9f01a55e160a76155288b82485f0a7ec4db913b94beb1807f0cffd3322df788f337fc250c039dd21cb3daebc377c9753532cd9d5

Download Submit
C:\Windows\System\ZWsAATD.exe

Filesize
1.1MB

MD5
536084a2092bd6ed37e95d36abbe714c

SHA1
4846e86dc0b798580335c48a4a6b0459dbbfe1fe

SHA256
6817af9eb9c3fd9b83b3e3c62ab079da15420fa32c41a4e4efe0d838347a911a

SHA512
36cac08c472cd734d60e7222832387480711db20bd2a7967286f923a60d488832ce6a569a49c8a2e59a980d3a02bb793e7194cd4def40bce98db71deca3ba87e

Download Submit
C:\Windows\System\cpASgYP.exe

Filesize
1.1MB

MD5
7c475dd9bd8397840092c383dbc7d01a

SHA1
d68643b86893d25f051c4224cc6d73a3c1e35bb7

SHA256
39c458e306f66ad381ec2005b05d02c2865b7a9c44fe01b42a1299e7971dc60e

SHA512
b3cdc5324f0501f245ae38e608a820aa883dca3587d285bb7a25bc3b2601b99d67eae32c5039b0089d59c3ca4fc70e2dc9baf52d553cf01155761c24430e591a

Download Submit
C:\Windows\System\eEjdkgF.exe

Filesize
1.1MB

MD5
d132408e7676b5e00873134a2b1c5014

SHA1
6c9e42b8c343c028eac5621ac3388898d48ba860

SHA256
9cc907b5c38ad74523e6dae15bde62e35c24c90d4928ccba9c1eb98c498b6f2f

SHA512
c48a0853c34a341e0da1b30646180d15afe2bdc66437eff6e501bcdf9f6c13d3115cb1dd58455f3f5247c6e701d1a0801566ea3402f571325f8a9bb1fcc7c1b9

Download Submit
C:\Windows\System\eTUKBJI.exe

Filesize
1.1MB

MD5
470e20451ff2e5f242efee9d4c1e586b

SHA1
2b493376459b173eee713987c871130c25a366d8

SHA256
98e5791bd3496596269d08f605bc705348d265d81297ea2f0b9350f6d91f8ed6

SHA512
88162a32c63268c5a5bb78674d5f2fa322b3a88b4dec6d134fbc72819d2ea9d5da9465854e13861e9df6e09ef39f46ef2ead4a74d19c62b131dc054f33f71f65

Download Submit
C:\Windows\System\jPfzhGd.exe

Filesize
1.1MB

MD5
0daa850f2c78b35b645b877ce2c005fc

SHA1
83770c8778c0344930cfeb06f94ebe1f33965d2c

SHA256
63f1a3933b1ae832029a0c920c19a33851b7d0fda11888115545c1c049bfc3d4

SHA512
459cecde2d06bce43d040bb042438e1e80d3bd6143297fa764b35e55978ec3358333594a82687bc6fcdadcb4a52796c10dcaa3aa5b7399e07c71c873d894e8e4

Download Submit
C:\Windows\System\jSJiMBo.exe

Filesize
1.1MB

MD5
9897a70cd03d2e942922777065006290

SHA1
efeb4c84af98cfdfe810658caf1dbaa0b3a848f8

SHA256
e12696d348fb3da79a8f01a6bb1b0717609dc670308428b5c0b12f5ae03abd50

SHA512
39318c2aee945f953bdbf1ce948c1c291d585075765627589731a59c48e85eeda89b8ed46b7298bc6694d67ba54811fa7bea588fcf81b05c284c8c47a4318a0e

Download Submit
C:\Windows\System\lKhdkBz.exe

Filesize
1.1MB

MD5
c5a930c422191a4da8138cb5ccc0150f

SHA1
7910d50c3aa89bac711af892f266befe3337206d

SHA256
8f43e90cc1ea4b5fcd2df6063c02ba1efd65e0687205fa126bf47bee67eaa63c

SHA512
901cbbf45c429158afcf2a69c5bb5e1a12fef7fccc718ce86bdaa2e23079431b3af7832f0979bd2c6cb5a2d1cf7471956713f16227f92a1c45b1332d4864e184

Download Submit
C:\Windows\System\pTlSRVd.exe

Filesize
1.1MB

MD5
b3f12aa8dd2ad3662bc16f79694fa8bf

SHA1
12265bde5bdd4ca4bfa8e2d05b4f9e06c621c145

SHA256
dbd7c53770074eaa43895287931c72b3dbec21f878e6d11f587f11bc5e13d9e6

SHA512
c8646e53d248efde24d140646e3ce4bb47fdb0fbf232971d9519006ffbaf1405a0bdfd93bb1ae234d55c1306dae5e15d9c45ca40a9fe1eaaa53f0dfc8799fa6d

Download Submit
C:\Windows\System\qHkBgJE.exe

Filesize
1.1MB

MD5
fb6655197745c218d07017acd9cbfb85

SHA1
cf51fb6a9dda72a6798d86154f34475e5d7c8eda

SHA256
81f4c42289349b7ab47bb3a143b95f781c6b27e0743a79f47e64d1f779754a34

SHA512
db5fc7719f225534ba2fae506cb83681edef1ac7d7c4e934bc8b5f9781c084afaa2a7f1ab54a2ce7d8d71769eae9a14b1c4f1ce5380355cba446ce03f374c864

Download Submit
C:\Windows\System\qaDZSuy.exe

Filesize
1.1MB

MD5
c963849d4b3e5e48a49ee45088733f9f

SHA1
ada5c75212c36671f9733ee43b83f6bf5d45f39c

SHA256
f01a801b2196d8b6a381242f43c1a7268abb7015bca916ae7dab3e62744010e3

SHA512
b1879856800c62cbe2bf8517cd2196d2bc1f3c8e8e5db00cde36343d00f3cddbcc8a508fda459bd6c71e4135516d9046456393905f19e891ef3450e0863d2d39

Download Submit
C:\Windows\System\teyHwZi.exe

Filesize
1.1MB

MD5
60a6f46ad24844c449d1de227ba22538

SHA1
f053726e8fe751549c1165abb59479117de9b046

SHA256
cb6e70663efbdb279b23a2b66577b8bf91f8af5356358528cc22b94a3295012e

SHA512
9b15db6c2c75ccea0987f8ba9490ea68168eb94c4b2e2cc8d6dd3aced5fae18eae728493c739609dc68d5da65f691d58791591db6694951c678717c7f52f6ec8

Download Submit
C:\Windows\System\vyTjErU.exe

Filesize
1.1MB

MD5
7f4292a433175f265520aaae01da0d40

SHA1
fbf600dab8f0181bcfbf54a32c62d3056167a1e9

SHA256
497ed70d8a2ff4f4fa2e875f1da2e1150dad8a9a341ffcbc89538cb131d2d6c6

SHA512
92a42e6e08be87c99a3a790f6ab02deb41dd2516d7abad8f8483b6da45708450764f6094be0cea434bb5f017f7e54181163c3ace489d864b3ea60684c8262d58

Download Submit
memory/3908-0-0x000002E230B90000-0x000002E230BA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads