xmrig | 6c2d5d89b98e4da898bea782a6383d3ed0c66cf653940b6524bef1e16e7f9869

Analysis

max time kernel
125s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
Size

1.9MB
MD5

1dd8c7a31250d65a43199d350ae83ba0
SHA1

c18e3d7bfd0024d1bd8f8d5bcba18eb540e88277
SHA256

6c2d5d89b98e4da898bea782a6383d3ed0c66cf653940b6524bef1e16e7f9869
SHA512

8d4810f65961ea4a241e9a2d907eff9bc972977ae2fbe119fd0bf1b60b0671bcf4fefc435d6c10d47ca2ee5c94ce47ba0d119ed7a0ca7cbc8771acbdf8e2a78e
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIKFGkvE1bXcsdPipAj:GemTLkNdfE0pZab

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023467-4.dat	xmrig
behavioral2/files/0x000800000002346a-9.dat	xmrig
behavioral2/files/0x000700000002346e-8.dat	xmrig
behavioral2/files/0x000700000002346f-19.dat	xmrig
behavioral2/files/0x0007000000023471-34.dat	xmrig
behavioral2/files/0x0007000000023472-38.dat	xmrig
behavioral2/files/0x0007000000023477-51.dat	xmrig
behavioral2/files/0x0007000000023476-66.dat	xmrig
behavioral2/files/0x0007000000023479-70.dat	xmrig
behavioral2/files/0x0007000000023478-68.dat	xmrig
behavioral2/files/0x0007000000023474-59.dat	xmrig
behavioral2/files/0x0007000000023475-54.dat	xmrig
behavioral2/files/0x0007000000023473-44.dat	xmrig
behavioral2/files/0x0007000000023470-27.dat	xmrig
behavioral2/files/0x000700000002347a-75.dat	xmrig
behavioral2/files/0x000800000002346b-78.dat	xmrig
behavioral2/files/0x000700000002347c-84.dat	xmrig
behavioral2/files/0x000700000002347d-89.dat	xmrig
behavioral2/files/0x000700000002347e-96.dat	xmrig
behavioral2/files/0x0007000000023481-102.dat	xmrig
behavioral2/files/0x0007000000023480-108.dat	xmrig
behavioral2/files/0x0007000000023483-121.dat	xmrig
behavioral2/files/0x0007000000023489-142.dat	xmrig
behavioral2/files/0x0007000000023488-151.dat	xmrig
behavioral2/files/0x000700000002348c-162.dat	xmrig
behavioral2/files/0x000700000002348e-161.dat	xmrig
behavioral2/files/0x000700000002348d-160.dat	xmrig
behavioral2/files/0x000700000002348a-153.dat	xmrig
behavioral2/files/0x000700000002348b-146.dat	xmrig
behavioral2/files/0x0007000000023486-141.dat	xmrig
behavioral2/files/0x0007000000023487-137.dat	xmrig
behavioral2/files/0x0007000000023485-131.dat	xmrig
behavioral2/files/0x0007000000023484-128.dat	xmrig
behavioral2/files/0x0007000000023482-116.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4580	fQEJaGW.exe
4628	CnkeUOP.exe
1936	MhCWELV.exe
948	teeEsKO.exe
2212	IKsNheX.exe
1656	HBGnzHS.exe
4060	OzObDNN.exe
4752	pgYrhyr.exe
3632	wnvfOgc.exe
4240	OOMYZYA.exe
4708	QfoQpRG.exe
2320	GwtIdMg.exe
4816	hFhQwED.exe
3640	SUwndzC.exe
2692	lymWAKZ.exe
232	uHCyGAo.exe
2112	AxxJivs.exe
1208	baTExEH.exe
5044	HvoEvvH.exe
1892	HPHjgiJ.exe
4460	pVkwEZI.exe
4692	uJswCls.exe
4320	WuDqINP.exe
4208	iVYWOFm.exe
2088	zxWehxK.exe
8	OKOvHZs.exe
3944	mXhLkGo.exe
4552	dXDzrRx.exe
2928	rmlJCxX.exe
1608	JtDufBa.exe
3284	PiLrCHC.exe
2832	MpRlmLe.exe
4668	oKmAjfq.exe
3176	CgKUKij.exe
2292	nzMbSac.exe
4440	gLVolcy.exe
4556	dITauhN.exe
4900	lsRKNgx.exe
2364	Drrhmgu.exe
3064	OkWzgIy.exe
3148	BhWHUHZ.exe
4272	ZilJIaW.exe
3376	xJRILLs.exe
464	MMfRFmv.exe
3052	HhNQgQu.exe
4484	vOXkccp.exe
840	ggrbBoi.exe
636	SpuZcjE.exe
4760	ZRhTDkn.exe
1296	aTIteHy.exe
1028	DOexhlY.exe
1324	LjlQSNF.exe
4232	qZeiUFa.exe
1360	yOlxnna.exe
4644	OFzsmqg.exe
4324	CvapYak.exe
848	wOvtTJc.exe
3700	SqmQGeJ.exe
4520	UCJymqN.exe
2328	vJvYpVd.exe
5000	ThGdaMB.exe
4916	EYlbuBm.exe
3512	Gneavma.exe
4032	fRXlmfG.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hnmPVsf.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\dNNDfyB.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ANNJSro.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\lURzlPU.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\iawbNTe.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\uaXgaAD.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\aENlFTO.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\BjpOkTk.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\HozLCEH.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\TEGfbXk.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\WuDqINP.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\psVUwbX.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ddyqMgc.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\DtLjopW.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\EDFUErd.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\kKYAYLd.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\DIllJPx.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\PIPyhFF.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\eNtgvaP.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\OFzsmqg.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\rMNjIZX.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\KyrVsGE.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\WvZblXP.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\csgCCtf.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\tnGXdDl.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\DUlolrY.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\TyyxeyP.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\zzyqFKy.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\lDqPJFO.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\nCJoiAR.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\jWPbjqY.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ciyeVAM.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\sMkKvck.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\kMUGPct.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\KgbpGZk.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\qWdvDuF.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\dHQvqAQ.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\zQDmTrp.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\mFWHAIf.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\HUytiCa.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ristTrZ.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\TEUChhV.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\MmePLBt.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\zcEkgdU.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\dKYPHQv.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\MrVAzzj.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\STWCudi.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\MArdVXA.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\xaXdare.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\NAUpbYm.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\yFFmbAT.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\RrzIdhm.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\hAttHyW.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\cXMCUkG.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\PWTNrAl.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ikhBvcb.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\fpHWcOy.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\wjdNPDj.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\pUArptI.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\LjlQSNF.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\YXxmGEY.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ZnVrsLM.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ZVaRlpL.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
File created	C:\Windows\System\VJnaQqQ.exe	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17044	dwm.exe
Token: SeChangeNotifyPrivilege	17044	dwm.exe
Token: 33	17044	dwm.exe
Token: SeIncBasePriorityPrivilege	17044	dwm.exe
Token: SeShutdownPrivilege	17044	dwm.exe
Token: SeCreatePagefilePrivilege	17044	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4580	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	86
PID 3652 wrote to memory of 4580	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	86
PID 3652 wrote to memory of 4628	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	87
PID 3652 wrote to memory of 4628	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	87
PID 3652 wrote to memory of 1936	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	88
PID 3652 wrote to memory of 1936	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	88
PID 3652 wrote to memory of 948	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	89
PID 3652 wrote to memory of 948	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	89
PID 3652 wrote to memory of 2212	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	90
PID 3652 wrote to memory of 2212	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	90
PID 3652 wrote to memory of 1656	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	91
PID 3652 wrote to memory of 1656	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	91
PID 3652 wrote to memory of 4752	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	92
PID 3652 wrote to memory of 4752	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	92
PID 3652 wrote to memory of 4060	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	93
PID 3652 wrote to memory of 4060	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	93
PID 3652 wrote to memory of 4240	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	94
PID 3652 wrote to memory of 4240	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	94
PID 3652 wrote to memory of 3632	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	95
PID 3652 wrote to memory of 3632	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	95
PID 3652 wrote to memory of 4708	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	96
PID 3652 wrote to memory of 4708	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	96
PID 3652 wrote to memory of 2320	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	97
PID 3652 wrote to memory of 2320	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	97
PID 3652 wrote to memory of 4816	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	98
PID 3652 wrote to memory of 4816	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	98
PID 3652 wrote to memory of 3640	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	99
PID 3652 wrote to memory of 3640	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	99
PID 3652 wrote to memory of 2692	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	100
PID 3652 wrote to memory of 2692	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	100
PID 3652 wrote to memory of 232	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	101
PID 3652 wrote to memory of 232	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	101
PID 3652 wrote to memory of 2112	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	102
PID 3652 wrote to memory of 2112	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	102
PID 3652 wrote to memory of 1208	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	103
PID 3652 wrote to memory of 1208	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	103
PID 3652 wrote to memory of 5044	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	104
PID 3652 wrote to memory of 5044	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	104
PID 3652 wrote to memory of 1892	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	105
PID 3652 wrote to memory of 1892	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	105
PID 3652 wrote to memory of 4460	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	106
PID 3652 wrote to memory of 4460	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	106
PID 3652 wrote to memory of 4692	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	107
PID 3652 wrote to memory of 4692	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	107
PID 3652 wrote to memory of 2088	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	108
PID 3652 wrote to memory of 2088	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	108
PID 3652 wrote to memory of 4320	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	109
PID 3652 wrote to memory of 4320	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	109
PID 3652 wrote to memory of 4208	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	110
PID 3652 wrote to memory of 4208	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	110
PID 3652 wrote to memory of 8	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	111
PID 3652 wrote to memory of 8	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	111
PID 3652 wrote to memory of 4552	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	112
PID 3652 wrote to memory of 4552	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	112
PID 3652 wrote to memory of 3944	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	113
PID 3652 wrote to memory of 3944	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	113
PID 3652 wrote to memory of 1608	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	114
PID 3652 wrote to memory of 1608	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	114
PID 3652 wrote to memory of 2928	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	115
PID 3652 wrote to memory of 2928	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	115
PID 3652 wrote to memory of 3284	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	116
PID 3652 wrote to memory of 3284	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	116
PID 3652 wrote to memory of 2832	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	117
PID 3652 wrote to memory of 2832	3652	1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1dd8c7a31250d65a43199d350ae83ba0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\System\fQEJaGW.exe
  C:\Windows\System\fQEJaGW.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\CnkeUOP.exe
  C:\Windows\System\CnkeUOP.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\MhCWELV.exe
  C:\Windows\System\MhCWELV.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\teeEsKO.exe
  C:\Windows\System\teeEsKO.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\IKsNheX.exe
  C:\Windows\System\IKsNheX.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\HBGnzHS.exe
  C:\Windows\System\HBGnzHS.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\pgYrhyr.exe
  C:\Windows\System\pgYrhyr.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\OzObDNN.exe
  C:\Windows\System\OzObDNN.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\OOMYZYA.exe
  C:\Windows\System\OOMYZYA.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\wnvfOgc.exe
  C:\Windows\System\wnvfOgc.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\QfoQpRG.exe
  C:\Windows\System\QfoQpRG.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\GwtIdMg.exe
  C:\Windows\System\GwtIdMg.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\hFhQwED.exe
  C:\Windows\System\hFhQwED.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\SUwndzC.exe
  C:\Windows\System\SUwndzC.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\lymWAKZ.exe
  C:\Windows\System\lymWAKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\uHCyGAo.exe
  C:\Windows\System\uHCyGAo.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\AxxJivs.exe
  C:\Windows\System\AxxJivs.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\baTExEH.exe
  C:\Windows\System\baTExEH.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\HvoEvvH.exe
  C:\Windows\System\HvoEvvH.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\HPHjgiJ.exe
  C:\Windows\System\HPHjgiJ.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\pVkwEZI.exe
  C:\Windows\System\pVkwEZI.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\uJswCls.exe
  C:\Windows\System\uJswCls.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\zxWehxK.exe
  C:\Windows\System\zxWehxK.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\WuDqINP.exe
  C:\Windows\System\WuDqINP.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\iVYWOFm.exe
  C:\Windows\System\iVYWOFm.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\OKOvHZs.exe
  C:\Windows\System\OKOvHZs.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\dXDzrRx.exe
  C:\Windows\System\dXDzrRx.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\mXhLkGo.exe
  C:\Windows\System\mXhLkGo.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\JtDufBa.exe
  C:\Windows\System\JtDufBa.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\rmlJCxX.exe
  C:\Windows\System\rmlJCxX.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\PiLrCHC.exe
  C:\Windows\System\PiLrCHC.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\MpRlmLe.exe
  C:\Windows\System\MpRlmLe.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\oKmAjfq.exe
  C:\Windows\System\oKmAjfq.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\CgKUKij.exe
  C:\Windows\System\CgKUKij.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\nzMbSac.exe
  C:\Windows\System\nzMbSac.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\gLVolcy.exe
  C:\Windows\System\gLVolcy.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\dITauhN.exe
  C:\Windows\System\dITauhN.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\lsRKNgx.exe
  C:\Windows\System\lsRKNgx.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\Drrhmgu.exe
  C:\Windows\System\Drrhmgu.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\OkWzgIy.exe
  C:\Windows\System\OkWzgIy.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\BhWHUHZ.exe
  C:\Windows\System\BhWHUHZ.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ZilJIaW.exe
  C:\Windows\System\ZilJIaW.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\xJRILLs.exe
  C:\Windows\System\xJRILLs.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\MMfRFmv.exe
  C:\Windows\System\MMfRFmv.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\HhNQgQu.exe
  C:\Windows\System\HhNQgQu.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\vOXkccp.exe
  C:\Windows\System\vOXkccp.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\ggrbBoi.exe
  C:\Windows\System\ggrbBoi.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\SpuZcjE.exe
  C:\Windows\System\SpuZcjE.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\ZRhTDkn.exe
  C:\Windows\System\ZRhTDkn.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\aTIteHy.exe
  C:\Windows\System\aTIteHy.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\DOexhlY.exe
  C:\Windows\System\DOexhlY.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\LjlQSNF.exe
  C:\Windows\System\LjlQSNF.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\qZeiUFa.exe
  C:\Windows\System\qZeiUFa.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\yOlxnna.exe
  C:\Windows\System\yOlxnna.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\OFzsmqg.exe
  C:\Windows\System\OFzsmqg.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\CvapYak.exe
  C:\Windows\System\CvapYak.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\wOvtTJc.exe
  C:\Windows\System\wOvtTJc.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\SqmQGeJ.exe
  C:\Windows\System\SqmQGeJ.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\UCJymqN.exe
  C:\Windows\System\UCJymqN.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\vJvYpVd.exe
  C:\Windows\System\vJvYpVd.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ThGdaMB.exe
  C:\Windows\System\ThGdaMB.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\EYlbuBm.exe
  C:\Windows\System\EYlbuBm.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\Gneavma.exe
  C:\Windows\System\Gneavma.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\fRXlmfG.exe
  C:\Windows\System\fRXlmfG.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\jIxFJVF.exe
  C:\Windows\System\jIxFJVF.exe
  2⤵
  PID:4464
- C:\Windows\System\amfGgob.exe
  C:\Windows\System\amfGgob.exe
  2⤵
  PID:3924
- C:\Windows\System\KTJIfbB.exe
  C:\Windows\System\KTJIfbB.exe
  2⤵
  PID:4928
- C:\Windows\System\BRhAGgF.exe
  C:\Windows\System\BRhAGgF.exe
  2⤵
  PID:3484
- C:\Windows\System\LzbJxDk.exe
  C:\Windows\System\LzbJxDk.exe
  2⤵
  PID:1620
- C:\Windows\System\WMVbzgT.exe
  C:\Windows\System\WMVbzgT.exe
  2⤵
  PID:3688
- C:\Windows\System\XWtEjHq.exe
  C:\Windows\System\XWtEjHq.exe
  2⤵
  PID:712
- C:\Windows\System\cASvCXP.exe
  C:\Windows\System\cASvCXP.exe
  2⤵
  PID:3084
- C:\Windows\System\zWiGsNt.exe
  C:\Windows\System\zWiGsNt.exe
  2⤵
  PID:556
- C:\Windows\System\sgUGGzK.exe
  C:\Windows\System\sgUGGzK.exe
  2⤵
  PID:1464
- C:\Windows\System\WAISwfZ.exe
  C:\Windows\System\WAISwfZ.exe
  2⤵
  PID:4656
- C:\Windows\System\zcEkgdU.exe
  C:\Windows\System\zcEkgdU.exe
  2⤵
  PID:3968
- C:\Windows\System\DGYPDGG.exe
  C:\Windows\System\DGYPDGG.exe
  2⤵
  PID:2188
- C:\Windows\System\yWjhVks.exe
  C:\Windows\System\yWjhVks.exe
  2⤵
  PID:964
- C:\Windows\System\merDRug.exe
  C:\Windows\System\merDRug.exe
  2⤵
  PID:5108
- C:\Windows\System\TyyxeyP.exe
  C:\Windows\System\TyyxeyP.exe
  2⤵
  PID:624
- C:\Windows\System\avTgWdv.exe
  C:\Windows\System\avTgWdv.exe
  2⤵
  PID:4704
- C:\Windows\System\xjaIQip.exe
  C:\Windows\System\xjaIQip.exe
  2⤵
  PID:2660
- C:\Windows\System\daNEZcM.exe
  C:\Windows\System\daNEZcM.exe
  2⤵
  PID:1996
- C:\Windows\System\giyRWAC.exe
  C:\Windows\System\giyRWAC.exe
  2⤵
  PID:1000
- C:\Windows\System\tcXDgUX.exe
  C:\Windows\System\tcXDgUX.exe
  2⤵
  PID:3040
- C:\Windows\System\tSULMsC.exe
  C:\Windows\System\tSULMsC.exe
  2⤵
  PID:4020
- C:\Windows\System\QWSTlBe.exe
  C:\Windows\System\QWSTlBe.exe
  2⤵
  PID:4936
- C:\Windows\System\HWEKPqs.exe
  C:\Windows\System\HWEKPqs.exe
  2⤵
  PID:732
- C:\Windows\System\XUEVEiA.exe
  C:\Windows\System\XUEVEiA.exe
  2⤵
  PID:916
- C:\Windows\System\BSQyUde.exe
  C:\Windows\System\BSQyUde.exe
  2⤵
  PID:4492
- C:\Windows\System\VMUxHHo.exe
  C:\Windows\System\VMUxHHo.exe
  2⤵
  PID:2872
- C:\Windows\System\LqvMpbd.exe
  C:\Windows\System\LqvMpbd.exe
  2⤵
  PID:1788
- C:\Windows\System\tcjJObT.exe
  C:\Windows\System\tcjJObT.exe
  2⤵
  PID:3056
- C:\Windows\System\zzyqFKy.exe
  C:\Windows\System\zzyqFKy.exe
  2⤵
  PID:4648
- C:\Windows\System\HwJDZqZ.exe
  C:\Windows\System\HwJDZqZ.exe
  2⤵
  PID:4180
- C:\Windows\System\mxbPVLf.exe
  C:\Windows\System\mxbPVLf.exe
  2⤵
  PID:5124
- C:\Windows\System\gEcArFH.exe
  C:\Windows\System\gEcArFH.exe
  2⤵
  PID:5152
- C:\Windows\System\LeviZVh.exe
  C:\Windows\System\LeviZVh.exe
  2⤵
  PID:5192
- C:\Windows\System\mIdXcaw.exe
  C:\Windows\System\mIdXcaw.exe
  2⤵
  PID:5212
- C:\Windows\System\sIRuZJj.exe
  C:\Windows\System\sIRuZJj.exe
  2⤵
  PID:5240
- C:\Windows\System\sXOJnhb.exe
  C:\Windows\System\sXOJnhb.exe
  2⤵
  PID:5272
- C:\Windows\System\xNNmrcc.exe
  C:\Windows\System\xNNmrcc.exe
  2⤵
  PID:5308
- C:\Windows\System\zFkUICZ.exe
  C:\Windows\System\zFkUICZ.exe
  2⤵
  PID:5324
- C:\Windows\System\qIYFxKT.exe
  C:\Windows\System\qIYFxKT.exe
  2⤵
  PID:5356
- C:\Windows\System\ARfMzqJ.exe
  C:\Windows\System\ARfMzqJ.exe
  2⤵
  PID:5380
- C:\Windows\System\xgKXYjy.exe
  C:\Windows\System\xgKXYjy.exe
  2⤵
  PID:5408
- C:\Windows\System\uApKHvM.exe
  C:\Windows\System\uApKHvM.exe
  2⤵
  PID:5424
- C:\Windows\System\PMtQroA.exe
  C:\Windows\System\PMtQroA.exe
  2⤵
  PID:5456
- C:\Windows\System\rUDRNus.exe
  C:\Windows\System\rUDRNus.exe
  2⤵
  PID:5492
- C:\Windows\System\psVUwbX.exe
  C:\Windows\System\psVUwbX.exe
  2⤵
  PID:5520
- C:\Windows\System\lCZdkoP.exe
  C:\Windows\System\lCZdkoP.exe
  2⤵
  PID:5548
- C:\Windows\System\qJVMBPc.exe
  C:\Windows\System\qJVMBPc.exe
  2⤵
  PID:5584
- C:\Windows\System\sdIukJg.exe
  C:\Windows\System\sdIukJg.exe
  2⤵
  PID:5804
- C:\Windows\System\NApXMRM.exe
  C:\Windows\System\NApXMRM.exe
  2⤵
  PID:5824
- C:\Windows\System\lURzlPU.exe
  C:\Windows\System\lURzlPU.exe
  2⤵
  PID:5844
- C:\Windows\System\xJNjSrQ.exe
  C:\Windows\System\xJNjSrQ.exe
  2⤵
  PID:5864
- C:\Windows\System\uasoAma.exe
  C:\Windows\System\uasoAma.exe
  2⤵
  PID:5900
- C:\Windows\System\VVrpjtO.exe
  C:\Windows\System\VVrpjtO.exe
  2⤵
  PID:5920
- C:\Windows\System\KeHlbrE.exe
  C:\Windows\System\KeHlbrE.exe
  2⤵
  PID:5956
- C:\Windows\System\AaZzpcw.exe
  C:\Windows\System\AaZzpcw.exe
  2⤵
  PID:5996
- C:\Windows\System\jBOShHa.exe
  C:\Windows\System\jBOShHa.exe
  2⤵
  PID:6016
- C:\Windows\System\RwwPwQM.exe
  C:\Windows\System\RwwPwQM.exe
  2⤵
  PID:6052
- C:\Windows\System\EhvdrqZ.exe
  C:\Windows\System\EhvdrqZ.exe
  2⤵
  PID:6092
- C:\Windows\System\WZojnXu.exe
  C:\Windows\System\WZojnXu.exe
  2⤵
  PID:6112
- C:\Windows\System\pTICrZZ.exe
  C:\Windows\System\pTICrZZ.exe
  2⤵
  PID:6136
- C:\Windows\System\HNibgwl.exe
  C:\Windows\System\HNibgwl.exe
  2⤵
  PID:5136
- C:\Windows\System\iPNzTgT.exe
  C:\Windows\System\iPNzTgT.exe
  2⤵
  PID:5236
- C:\Windows\System\dmmyShj.exe
  C:\Windows\System\dmmyShj.exe
  2⤵
  PID:5344
- C:\Windows\System\XlEuWXU.exe
  C:\Windows\System\XlEuWXU.exe
  2⤵
  PID:5372
- C:\Windows\System\xnaVtIJ.exe
  C:\Windows\System\xnaVtIJ.exe
  2⤵
  PID:3952
- C:\Windows\System\DDopALw.exe
  C:\Windows\System\DDopALw.exe
  2⤵
  PID:5480
- C:\Windows\System\ddyqMgc.exe
  C:\Windows\System\ddyqMgc.exe
  2⤵
  PID:5576
- C:\Windows\System\BkXcXAX.exe
  C:\Windows\System\BkXcXAX.exe
  2⤵
  PID:5616
- C:\Windows\System\PzKErDN.exe
  C:\Windows\System\PzKErDN.exe
  2⤵
  PID:5640
- C:\Windows\System\ZtdiAGC.exe
  C:\Windows\System\ZtdiAGC.exe
  2⤵
  PID:5668
- C:\Windows\System\iQbvBBz.exe
  C:\Windows\System\iQbvBBz.exe
  2⤵
  PID:5704
- C:\Windows\System\pyJFnFW.exe
  C:\Windows\System\pyJFnFW.exe
  2⤵
  PID:5728
- C:\Windows\System\YrlkjaH.exe
  C:\Windows\System\YrlkjaH.exe
  2⤵
  PID:5756
- C:\Windows\System\ewEjkJi.exe
  C:\Windows\System\ewEjkJi.exe
  2⤵
  PID:5784
- C:\Windows\System\ktpKeIV.exe
  C:\Windows\System\ktpKeIV.exe
  2⤵
  PID:5832
- C:\Windows\System\wMUWrNz.exe
  C:\Windows\System\wMUWrNz.exe
  2⤵
  PID:5860
- C:\Windows\System\rUcPElW.exe
  C:\Windows\System\rUcPElW.exe
  2⤵
  PID:5928
- C:\Windows\System\wGVulij.exe
  C:\Windows\System\wGVulij.exe
  2⤵
  PID:5980
- C:\Windows\System\jHtHbob.exe
  C:\Windows\System\jHtHbob.exe
  2⤵
  PID:6076
- C:\Windows\System\CeYlxdO.exe
  C:\Windows\System\CeYlxdO.exe
  2⤵
  PID:6124
- C:\Windows\System\JHurWca.exe
  C:\Windows\System\JHurWca.exe
  2⤵
  PID:5300
- C:\Windows\System\lTSzvGX.exe
  C:\Windows\System\lTSzvGX.exe
  2⤵
  PID:5440
- C:\Windows\System\CCDIcxn.exe
  C:\Windows\System\CCDIcxn.exe
  2⤵
  PID:5436
- C:\Windows\System\wyRKdYQ.exe
  C:\Windows\System\wyRKdYQ.exe
  2⤵
  PID:5652
- C:\Windows\System\BQvYZaP.exe
  C:\Windows\System\BQvYZaP.exe
  2⤵
  PID:5680
- C:\Windows\System\DApixAm.exe
  C:\Windows\System\DApixAm.exe
  2⤵
  PID:5776
- C:\Windows\System\OQACLTC.exe
  C:\Windows\System\OQACLTC.exe
  2⤵
  PID:5936
- C:\Windows\System\RrzIdhm.exe
  C:\Windows\System\RrzIdhm.exe
  2⤵
  PID:6072
- C:\Windows\System\EuOpiIX.exe
  C:\Windows\System\EuOpiIX.exe
  2⤵
  PID:3980
- C:\Windows\System\FIBUwZQ.exe
  C:\Windows\System\FIBUwZQ.exe
  2⤵
  PID:5624
- C:\Windows\System\JKbiOyf.exe
  C:\Windows\System\JKbiOyf.exe
  2⤵
  PID:5740
- C:\Windows\System\MByAakL.exe
  C:\Windows\System\MByAakL.exe
  2⤵
  PID:5984
- C:\Windows\System\hAttHyW.exe
  C:\Windows\System\hAttHyW.exe
  2⤵
  PID:5684
- C:\Windows\System\YXxmGEY.exe
  C:\Windows\System\YXxmGEY.exe
  2⤵
  PID:4012
- C:\Windows\System\zoeQBAd.exe
  C:\Windows\System\zoeQBAd.exe
  2⤵
  PID:6148
- C:\Windows\System\VHIaCvU.exe
  C:\Windows\System\VHIaCvU.exe
  2⤵
  PID:6176
- C:\Windows\System\fakoYYe.exe
  C:\Windows\System\fakoYYe.exe
  2⤵
  PID:6208
- C:\Windows\System\UYOCfLd.exe
  C:\Windows\System\UYOCfLd.exe
  2⤵
  PID:6224
- C:\Windows\System\pefUskB.exe
  C:\Windows\System\pefUskB.exe
  2⤵
  PID:6256
- C:\Windows\System\ZVaRlpL.exe
  C:\Windows\System\ZVaRlpL.exe
  2⤵
  PID:6280
- C:\Windows\System\zTwgAbc.exe
  C:\Windows\System\zTwgAbc.exe
  2⤵
  PID:6316
- C:\Windows\System\VJnaQqQ.exe
  C:\Windows\System\VJnaQqQ.exe
  2⤵
  PID:6348
- C:\Windows\System\WzXTHJX.exe
  C:\Windows\System\WzXTHJX.exe
  2⤵
  PID:6364
- C:\Windows\System\BqaSkDa.exe
  C:\Windows\System\BqaSkDa.exe
  2⤵
  PID:6396
- C:\Windows\System\slPplhn.exe
  C:\Windows\System\slPplhn.exe
  2⤵
  PID:6432
- C:\Windows\System\GNFjHYK.exe
  C:\Windows\System\GNFjHYK.exe
  2⤵
  PID:6464
- C:\Windows\System\DVJlVpk.exe
  C:\Windows\System\DVJlVpk.exe
  2⤵
  PID:6492
- C:\Windows\System\CGNZgtT.exe
  C:\Windows\System\CGNZgtT.exe
  2⤵
  PID:6520
- C:\Windows\System\lKVOuNF.exe
  C:\Windows\System\lKVOuNF.exe
  2⤵
  PID:6536
- C:\Windows\System\fpsQRzQ.exe
  C:\Windows\System\fpsQRzQ.exe
  2⤵
  PID:6568
- C:\Windows\System\asdyKsq.exe
  C:\Windows\System\asdyKsq.exe
  2⤵
  PID:6600
- C:\Windows\System\ZmeLRBV.exe
  C:\Windows\System\ZmeLRBV.exe
  2⤵
  PID:6620
- C:\Windows\System\vLzokzT.exe
  C:\Windows\System\vLzokzT.exe
  2⤵
  PID:6652
- C:\Windows\System\bRIUzFq.exe
  C:\Windows\System\bRIUzFq.exe
  2⤵
  PID:6680
- C:\Windows\System\PjTLVPE.exe
  C:\Windows\System\PjTLVPE.exe
  2⤵
  PID:6712
- C:\Windows\System\oRLnGVg.exe
  C:\Windows\System\oRLnGVg.exe
  2⤵
  PID:6736
- C:\Windows\System\yRqTabt.exe
  C:\Windows\System\yRqTabt.exe
  2⤵
  PID:6768
- C:\Windows\System\DhoeCTp.exe
  C:\Windows\System\DhoeCTp.exe
  2⤵
  PID:6788
- C:\Windows\System\RsbIUtC.exe
  C:\Windows\System\RsbIUtC.exe
  2⤵
  PID:6820
- C:\Windows\System\MVzwVwg.exe
  C:\Windows\System\MVzwVwg.exe
  2⤵
  PID:6840
- C:\Windows\System\OUOOWue.exe
  C:\Windows\System\OUOOWue.exe
  2⤵
  PID:6868
- C:\Windows\System\faMzhLC.exe
  C:\Windows\System\faMzhLC.exe
  2⤵
  PID:6888
- C:\Windows\System\CtrsDsw.exe
  C:\Windows\System\CtrsDsw.exe
  2⤵
  PID:6920
- C:\Windows\System\xoGDeXw.exe
  C:\Windows\System\xoGDeXw.exe
  2⤵
  PID:6960
- C:\Windows\System\DzUdVtg.exe
  C:\Windows\System\DzUdVtg.exe
  2⤵
  PID:6980
- C:\Windows\System\kYiSKBQ.exe
  C:\Windows\System\kYiSKBQ.exe
  2⤵
  PID:7004
- C:\Windows\System\dKYPHQv.exe
  C:\Windows\System\dKYPHQv.exe
  2⤵
  PID:7032
- C:\Windows\System\hGJoboD.exe
  C:\Windows\System\hGJoboD.exe
  2⤵
  PID:7068
- C:\Windows\System\SfhxWXZ.exe
  C:\Windows\System\SfhxWXZ.exe
  2⤵
  PID:7096
- C:\Windows\System\SazSipU.exe
  C:\Windows\System\SazSipU.exe
  2⤵
  PID:7112
- C:\Windows\System\LJhNZmg.exe
  C:\Windows\System\LJhNZmg.exe
  2⤵
  PID:7144
- C:\Windows\System\afXvSrQ.exe
  C:\Windows\System\afXvSrQ.exe
  2⤵
  PID:5800
- C:\Windows\System\lDqPJFO.exe
  C:\Windows\System\lDqPJFO.exe
  2⤵
  PID:6192
- C:\Windows\System\VUgmcjF.exe
  C:\Windows\System\VUgmcjF.exe
  2⤵
  PID:6276
- C:\Windows\System\TeQvWQe.exe
  C:\Windows\System\TeQvWQe.exe
  2⤵
  PID:6332
- C:\Windows\System\QXvmUMT.exe
  C:\Windows\System\QXvmUMT.exe
  2⤵
  PID:6428
- C:\Windows\System\WVqGwWq.exe
  C:\Windows\System\WVqGwWq.exe
  2⤵
  PID:6504
- C:\Windows\System\yLJZFsO.exe
  C:\Windows\System\yLJZFsO.exe
  2⤵
  PID:6480
- C:\Windows\System\ristTrZ.exe
  C:\Windows\System\ristTrZ.exe
  2⤵
  PID:6592
- C:\Windows\System\oCwosgS.exe
  C:\Windows\System\oCwosgS.exe
  2⤵
  PID:6648
- C:\Windows\System\SDrgasF.exe
  C:\Windows\System\SDrgasF.exe
  2⤵
  PID:6728
- C:\Windows\System\rMWDUHe.exe
  C:\Windows\System\rMWDUHe.exe
  2⤵
  PID:6804
- C:\Windows\System\SLxEdzi.exe
  C:\Windows\System\SLxEdzi.exe
  2⤵
  PID:6884
- C:\Windows\System\DtLjopW.exe
  C:\Windows\System\DtLjopW.exe
  2⤵
  PID:6956
- C:\Windows\System\tChScHY.exe
  C:\Windows\System\tChScHY.exe
  2⤵
  PID:6936
- C:\Windows\System\BGTazYo.exe
  C:\Windows\System\BGTazYo.exe
  2⤵
  PID:7028
- C:\Windows\System\pmuxsgF.exe
  C:\Windows\System\pmuxsgF.exe
  2⤵
  PID:7128
- C:\Windows\System\OWkwDgj.exe
  C:\Windows\System\OWkwDgj.exe
  2⤵
  PID:6268
- C:\Windows\System\SmIOBnp.exe
  C:\Windows\System\SmIOBnp.exe
  2⤵
  PID:3200
- C:\Windows\System\rjCGwlf.exe
  C:\Windows\System\rjCGwlf.exe
  2⤵
  PID:6404
- C:\Windows\System\NxVaIqz.exe
  C:\Windows\System\NxVaIqz.exe
  2⤵
  PID:6616
- C:\Windows\System\FPTyRUw.exe
  C:\Windows\System\FPTyRUw.exe
  2⤵
  PID:6832
- C:\Windows\System\tXEcpRx.exe
  C:\Windows\System\tXEcpRx.exe
  2⤵
  PID:6864
- C:\Windows\System\TWHiSEX.exe
  C:\Windows\System\TWHiSEX.exe
  2⤵
  PID:6992
- C:\Windows\System\YKRGeEZ.exe
  C:\Windows\System\YKRGeEZ.exe
  2⤵
  PID:6048
- C:\Windows\System\emPKbrc.exe
  C:\Windows\System\emPKbrc.exe
  2⤵
  PID:6528
- C:\Windows\System\PerWoBl.exe
  C:\Windows\System\PerWoBl.exe
  2⤵
  PID:6848
- C:\Windows\System\CnvKfMf.exe
  C:\Windows\System\CnvKfMf.exe
  2⤵
  PID:4584
- C:\Windows\System\fFVtHVN.exe
  C:\Windows\System\fFVtHVN.exe
  2⤵
  PID:7192
- C:\Windows\System\Qibtouh.exe
  C:\Windows\System\Qibtouh.exe
  2⤵
  PID:7216
- C:\Windows\System\vmCpExl.exe
  C:\Windows\System\vmCpExl.exe
  2⤵
  PID:7248
- C:\Windows\System\VWQxzEF.exe
  C:\Windows\System\VWQxzEF.exe
  2⤵
  PID:7272
- C:\Windows\System\IVsZLCG.exe
  C:\Windows\System\IVsZLCG.exe
  2⤵
  PID:7300
- C:\Windows\System\OlicEii.exe
  C:\Windows\System\OlicEii.exe
  2⤵
  PID:7336
- C:\Windows\System\tBIYUgs.exe
  C:\Windows\System\tBIYUgs.exe
  2⤵
  PID:7368
- C:\Windows\System\rosVYVc.exe
  C:\Windows\System\rosVYVc.exe
  2⤵
  PID:7396
- C:\Windows\System\YZlwyMA.exe
  C:\Windows\System\YZlwyMA.exe
  2⤵
  PID:7420
- C:\Windows\System\DzbOhHM.exe
  C:\Windows\System\DzbOhHM.exe
  2⤵
  PID:7452
- C:\Windows\System\iwdTADT.exe
  C:\Windows\System\iwdTADT.exe
  2⤵
  PID:7480
- C:\Windows\System\ehuAxVO.exe
  C:\Windows\System\ehuAxVO.exe
  2⤵
  PID:7496
- C:\Windows\System\gnjzuBd.exe
  C:\Windows\System\gnjzuBd.exe
  2⤵
  PID:7524
- C:\Windows\System\obbSbph.exe
  C:\Windows\System\obbSbph.exe
  2⤵
  PID:7564
- C:\Windows\System\merJkFE.exe
  C:\Windows\System\merJkFE.exe
  2⤵
  PID:7596
- C:\Windows\System\rlmeNkx.exe
  C:\Windows\System\rlmeNkx.exe
  2⤵
  PID:7616
- C:\Windows\System\gdlHRxR.exe
  C:\Windows\System\gdlHRxR.exe
  2⤵
  PID:7640
- C:\Windows\System\qvyyxQD.exe
  C:\Windows\System\qvyyxQD.exe
  2⤵
  PID:7668
- C:\Windows\System\hxEVljN.exe
  C:\Windows\System\hxEVljN.exe
  2⤵
  PID:7708
- C:\Windows\System\FgHAhPm.exe
  C:\Windows\System\FgHAhPm.exe
  2⤵
  PID:7736
- C:\Windows\System\TFDcbSf.exe
  C:\Windows\System\TFDcbSf.exe
  2⤵
  PID:7764
- C:\Windows\System\JHKVIfo.exe
  C:\Windows\System\JHKVIfo.exe
  2⤵
  PID:7792
- C:\Windows\System\vGteDKV.exe
  C:\Windows\System\vGteDKV.exe
  2⤵
  PID:7812
- C:\Windows\System\mckBVyh.exe
  C:\Windows\System\mckBVyh.exe
  2⤵
  PID:7848
- C:\Windows\System\SEayjYK.exe
  C:\Windows\System\SEayjYK.exe
  2⤵
  PID:7876
- C:\Windows\System\GBGhBgm.exe
  C:\Windows\System\GBGhBgm.exe
  2⤵
  PID:7892
- C:\Windows\System\PvshCVh.exe
  C:\Windows\System\PvshCVh.exe
  2⤵
  PID:7920
- C:\Windows\System\xlytsBC.exe
  C:\Windows\System\xlytsBC.exe
  2⤵
  PID:7948
- C:\Windows\System\UCULiDy.exe
  C:\Windows\System\UCULiDy.exe
  2⤵
  PID:7976
- C:\Windows\System\ZHsPuio.exe
  C:\Windows\System\ZHsPuio.exe
  2⤵
  PID:8004
- C:\Windows\System\otFlCRM.exe
  C:\Windows\System\otFlCRM.exe
  2⤵
  PID:8028
- C:\Windows\System\zCtnoBd.exe
  C:\Windows\System\zCtnoBd.exe
  2⤵
  PID:8060
- C:\Windows\System\xNsshvA.exe
  C:\Windows\System\xNsshvA.exe
  2⤵
  PID:8092
- C:\Windows\System\MrVAzzj.exe
  C:\Windows\System\MrVAzzj.exe
  2⤵
  PID:8120
- C:\Windows\System\nKNDRgb.exe
  C:\Windows\System\nKNDRgb.exe
  2⤵
  PID:8148
- C:\Windows\System\RQHmFiD.exe
  C:\Windows\System\RQHmFiD.exe
  2⤵
  PID:8184
- C:\Windows\System\SVjKBkv.exe
  C:\Windows\System\SVjKBkv.exe
  2⤵
  PID:6236
- C:\Windows\System\GwnGVyo.exe
  C:\Windows\System\GwnGVyo.exe
  2⤵
  PID:7200
- C:\Windows\System\osnETFI.exe
  C:\Windows\System\osnETFI.exe
  2⤵
  PID:7288
- C:\Windows\System\OMwossY.exe
  C:\Windows\System\OMwossY.exe
  2⤵
  PID:7312
- C:\Windows\System\cXMCUkG.exe
  C:\Windows\System\cXMCUkG.exe
  2⤵
  PID:7408
- C:\Windows\System\Qtzlclc.exe
  C:\Windows\System\Qtzlclc.exe
  2⤵
  PID:7464
- C:\Windows\System\QyLEjjP.exe
  C:\Windows\System\QyLEjjP.exe
  2⤵
  PID:7548
- C:\Windows\System\pURRLoj.exe
  C:\Windows\System\pURRLoj.exe
  2⤵
  PID:7624
- C:\Windows\System\vkaHEgG.exe
  C:\Windows\System\vkaHEgG.exe
  2⤵
  PID:7652
- C:\Windows\System\wWwCqwX.exe
  C:\Windows\System\wWwCqwX.exe
  2⤵
  PID:7700
- C:\Windows\System\pmsOglz.exe
  C:\Windows\System\pmsOglz.exe
  2⤵
  PID:7756
- C:\Windows\System\jxpdKIR.exe
  C:\Windows\System\jxpdKIR.exe
  2⤵
  PID:7836
- C:\Windows\System\BiJOVGX.exe
  C:\Windows\System\BiJOVGX.exe
  2⤵
  PID:7904
- C:\Windows\System\CdwaNSl.exe
  C:\Windows\System\CdwaNSl.exe
  2⤵
  PID:7996
- C:\Windows\System\PDNBTzd.exe
  C:\Windows\System\PDNBTzd.exe
  2⤵
  PID:8100
- C:\Windows\System\nFZUtfU.exe
  C:\Windows\System\nFZUtfU.exe
  2⤵
  PID:8144
- C:\Windows\System\pjrAgGW.exe
  C:\Windows\System\pjrAgGW.exe
  2⤵
  PID:7176
- C:\Windows\System\XqPtaSX.exe
  C:\Windows\System\XqPtaSX.exe
  2⤵
  PID:7260
- C:\Windows\System\RNrihuv.exe
  C:\Windows\System\RNrihuv.exe
  2⤵
  PID:7440
- C:\Windows\System\kaYgfdv.exe
  C:\Windows\System\kaYgfdv.exe
  2⤵
  PID:7588
- C:\Windows\System\bxOReAW.exe
  C:\Windows\System\bxOReAW.exe
  2⤵
  PID:7800
- C:\Windows\System\REpNsoO.exe
  C:\Windows\System\REpNsoO.exe
  2⤵
  PID:7868
- C:\Windows\System\lwazRCG.exe
  C:\Windows\System\lwazRCG.exe
  2⤵
  PID:8056
- C:\Windows\System\dHQvqAQ.exe
  C:\Windows\System\dHQvqAQ.exe
  2⤵
  PID:7236
- C:\Windows\System\YExPJQC.exe
  C:\Windows\System\YExPJQC.exe
  2⤵
  PID:7544
- C:\Windows\System\rMXwmqf.exe
  C:\Windows\System\rMXwmqf.exe
  2⤵
  PID:7908
- C:\Windows\System\HNndQSR.exe
  C:\Windows\System\HNndQSR.exe
  2⤵
  PID:6532
- C:\Windows\System\GzPTrjW.exe
  C:\Windows\System\GzPTrjW.exe
  2⤵
  PID:7776
- C:\Windows\System\OmEtlSg.exe
  C:\Windows\System\OmEtlSg.exe
  2⤵
  PID:344
- C:\Windows\System\reHmCRD.exe
  C:\Windows\System\reHmCRD.exe
  2⤵
  PID:8204
- C:\Windows\System\pojVilG.exe
  C:\Windows\System\pojVilG.exe
  2⤵
  PID:8236
- C:\Windows\System\WvZblXP.exe
  C:\Windows\System\WvZblXP.exe
  2⤵
  PID:8268
- C:\Windows\System\XQezYrc.exe
  C:\Windows\System\XQezYrc.exe
  2⤵
  PID:8300
- C:\Windows\System\mgKvZfe.exe
  C:\Windows\System\mgKvZfe.exe
  2⤵
  PID:8332
- C:\Windows\System\NILNjsn.exe
  C:\Windows\System\NILNjsn.exe
  2⤵
  PID:8360
- C:\Windows\System\eZLNHDX.exe
  C:\Windows\System\eZLNHDX.exe
  2⤵
  PID:8396
- C:\Windows\System\GRkZzgU.exe
  C:\Windows\System\GRkZzgU.exe
  2⤵
  PID:8412
- C:\Windows\System\RxOPdVl.exe
  C:\Windows\System\RxOPdVl.exe
  2⤵
  PID:8432
- C:\Windows\System\TXaUDOG.exe
  C:\Windows\System\TXaUDOG.exe
  2⤵
  PID:8460
- C:\Windows\System\NsjpQAw.exe
  C:\Windows\System\NsjpQAw.exe
  2⤵
  PID:8496
- C:\Windows\System\HNEbJbG.exe
  C:\Windows\System\HNEbJbG.exe
  2⤵
  PID:8524
- C:\Windows\System\pfNOMJx.exe
  C:\Windows\System\pfNOMJx.exe
  2⤵
  PID:8552
- C:\Windows\System\wlfiVMC.exe
  C:\Windows\System\wlfiVMC.exe
  2⤵
  PID:8584
- C:\Windows\System\MVWdlIy.exe
  C:\Windows\System\MVWdlIy.exe
  2⤵
  PID:8624
- C:\Windows\System\uFhgNXf.exe
  C:\Windows\System\uFhgNXf.exe
  2⤵
  PID:8656
- C:\Windows\System\BZIzAdM.exe
  C:\Windows\System\BZIzAdM.exe
  2⤵
  PID:8708
- C:\Windows\System\NqyGffA.exe
  C:\Windows\System\NqyGffA.exe
  2⤵
  PID:8728
- C:\Windows\System\lpzNhnp.exe
  C:\Windows\System\lpzNhnp.exe
  2⤵
  PID:8756
- C:\Windows\System\EUpcsrn.exe
  C:\Windows\System\EUpcsrn.exe
  2⤵
  PID:8776
- C:\Windows\System\SfBuIXu.exe
  C:\Windows\System\SfBuIXu.exe
  2⤵
  PID:8808
- C:\Windows\System\mDpzIll.exe
  C:\Windows\System\mDpzIll.exe
  2⤵
  PID:8824
- C:\Windows\System\SrCmaLF.exe
  C:\Windows\System\SrCmaLF.exe
  2⤵
  PID:8844
- C:\Windows\System\ZnVrsLM.exe
  C:\Windows\System\ZnVrsLM.exe
  2⤵
  PID:8872
- C:\Windows\System\JGQjEyY.exe
  C:\Windows\System\JGQjEyY.exe
  2⤵
  PID:8912
- C:\Windows\System\Xtnrqgj.exe
  C:\Windows\System\Xtnrqgj.exe
  2⤵
  PID:8940
- C:\Windows\System\ncrukbs.exe
  C:\Windows\System\ncrukbs.exe
  2⤵
  PID:8972
- C:\Windows\System\DfTTlBD.exe
  C:\Windows\System\DfTTlBD.exe
  2⤵
  PID:9024
- C:\Windows\System\odaTzdL.exe
  C:\Windows\System\odaTzdL.exe
  2⤵
  PID:9040
- C:\Windows\System\iMYCNcT.exe
  C:\Windows\System\iMYCNcT.exe
  2⤵
  PID:9068
- C:\Windows\System\DAqBePu.exe
  C:\Windows\System\DAqBePu.exe
  2⤵
  PID:9096
- C:\Windows\System\nTjEozg.exe
  C:\Windows\System\nTjEozg.exe
  2⤵
  PID:9112
- C:\Windows\System\wyymuEq.exe
  C:\Windows\System\wyymuEq.exe
  2⤵
  PID:9140
- C:\Windows\System\LHZOaNj.exe
  C:\Windows\System\LHZOaNj.exe
  2⤵
  PID:9168
- C:\Windows\System\fwyrpRs.exe
  C:\Windows\System\fwyrpRs.exe
  2⤵
  PID:9196
- C:\Windows\System\izyJcYX.exe
  C:\Windows\System\izyJcYX.exe
  2⤵
  PID:1692
- C:\Windows\System\qofJuFN.exe
  C:\Windows\System\qofJuFN.exe
  2⤵
  PID:4392
- C:\Windows\System\khzisdq.exe
  C:\Windows\System\khzisdq.exe
  2⤵
  PID:8244
- C:\Windows\System\IFCgeTc.exe
  C:\Windows\System\IFCgeTc.exe
  2⤵
  PID:8320
- C:\Windows\System\nbNhrUV.exe
  C:\Windows\System\nbNhrUV.exe
  2⤵
  PID:8388
- C:\Windows\System\OjZFIUt.exe
  C:\Windows\System\OjZFIUt.exe
  2⤵
  PID:8488
- C:\Windows\System\dKpBTRi.exe
  C:\Windows\System\dKpBTRi.exe
  2⤵
  PID:8576
- C:\Windows\System\AIGWjEG.exe
  C:\Windows\System\AIGWjEG.exe
  2⤵
  PID:8636
- C:\Windows\System\wjdNPDj.exe
  C:\Windows\System\wjdNPDj.exe
  2⤵
  PID:8716
- C:\Windows\System\WdZEtoa.exe
  C:\Windows\System\WdZEtoa.exe
  2⤵
  PID:8764
- C:\Windows\System\ZuHiEua.exe
  C:\Windows\System\ZuHiEua.exe
  2⤵
  PID:8840
- C:\Windows\System\pIaVPLY.exe
  C:\Windows\System\pIaVPLY.exe
  2⤵
  PID:8896
- C:\Windows\System\unNzRiu.exe
  C:\Windows\System\unNzRiu.exe
  2⤵
  PID:8952
- C:\Windows\System\pZPwKvR.exe
  C:\Windows\System\pZPwKvR.exe
  2⤵
  PID:9004
- C:\Windows\System\lnwobHL.exe
  C:\Windows\System\lnwobHL.exe
  2⤵
  PID:9080
- C:\Windows\System\xumKfbl.exe
  C:\Windows\System\xumKfbl.exe
  2⤵
  PID:9180
- C:\Windows\System\qVmAfjU.exe
  C:\Windows\System\qVmAfjU.exe
  2⤵
  PID:3424
- C:\Windows\System\fPyfmPn.exe
  C:\Windows\System\fPyfmPn.exe
  2⤵
  PID:8284
- C:\Windows\System\kURoXAl.exe
  C:\Windows\System\kURoXAl.exe
  2⤵
  PID:8420
- C:\Windows\System\CCtkQUc.exe
  C:\Windows\System\CCtkQUc.exe
  2⤵
  PID:8564
- C:\Windows\System\YfXPtYf.exe
  C:\Windows\System\YfXPtYf.exe
  2⤵
  PID:8868
- C:\Windows\System\jRKuPMg.exe
  C:\Windows\System\jRKuPMg.exe
  2⤵
  PID:9032
- C:\Windows\System\tjxxuHV.exe
  C:\Windows\System\tjxxuHV.exe
  2⤵
  PID:9132
- C:\Windows\System\STixjZb.exe
  C:\Windows\System\STixjZb.exe
  2⤵
  PID:6164
- C:\Windows\System\lBDXTEE.exe
  C:\Windows\System\lBDXTEE.exe
  2⤵
  PID:8612
- C:\Windows\System\HmHimNh.exe
  C:\Windows\System\HmHimNh.exe
  2⤵
  PID:8992
- C:\Windows\System\noMZPmo.exe
  C:\Windows\System\noMZPmo.exe
  2⤵
  PID:2524
- C:\Windows\System\STWCudi.exe
  C:\Windows\System\STWCudi.exe
  2⤵
  PID:9224
- C:\Windows\System\gMLJJRU.exe
  C:\Windows\System\gMLJJRU.exe
  2⤵
  PID:9252
- C:\Windows\System\kHyxyKU.exe
  C:\Windows\System\kHyxyKU.exe
  2⤵
  PID:9280
- C:\Windows\System\DIllJPx.exe
  C:\Windows\System\DIllJPx.exe
  2⤵
  PID:9316
- C:\Windows\System\mrSFzdT.exe
  C:\Windows\System\mrSFzdT.exe
  2⤵
  PID:9348
- C:\Windows\System\ozHilex.exe
  C:\Windows\System\ozHilex.exe
  2⤵
  PID:9380
- C:\Windows\System\RdGpuFB.exe
  C:\Windows\System\RdGpuFB.exe
  2⤵
  PID:9404
- C:\Windows\System\pgsRdzz.exe
  C:\Windows\System\pgsRdzz.exe
  2⤵
  PID:9420
- C:\Windows\System\zmpvJLP.exe
  C:\Windows\System\zmpvJLP.exe
  2⤵
  PID:9460
- C:\Windows\System\PIPyhFF.exe
  C:\Windows\System\PIPyhFF.exe
  2⤵
  PID:9488
- C:\Windows\System\lTHPEme.exe
  C:\Windows\System\lTHPEme.exe
  2⤵
  PID:9508
- C:\Windows\System\ULAtwqO.exe
  C:\Windows\System\ULAtwqO.exe
  2⤵
  PID:9536
- C:\Windows\System\qNrxcWp.exe
  C:\Windows\System\qNrxcWp.exe
  2⤵
  PID:9572
- C:\Windows\System\akjloQP.exe
  C:\Windows\System\akjloQP.exe
  2⤵
  PID:9600
- C:\Windows\System\xxjVOan.exe
  C:\Windows\System\xxjVOan.exe
  2⤵
  PID:9628
- C:\Windows\System\zmtFlWx.exe
  C:\Windows\System\zmtFlWx.exe
  2⤵
  PID:9648
- C:\Windows\System\qGgBwKc.exe
  C:\Windows\System\qGgBwKc.exe
  2⤵
  PID:9684
- C:\Windows\System\DrGhulg.exe
  C:\Windows\System\DrGhulg.exe
  2⤵
  PID:9704
- C:\Windows\System\NAUpbYm.exe
  C:\Windows\System\NAUpbYm.exe
  2⤵
  PID:9728
- C:\Windows\System\sdgGuHy.exe
  C:\Windows\System\sdgGuHy.exe
  2⤵
  PID:9756
- C:\Windows\System\wyiFqzl.exe
  C:\Windows\System\wyiFqzl.exe
  2⤵
  PID:9784
- C:\Windows\System\aENlFTO.exe
  C:\Windows\System\aENlFTO.exe
  2⤵
  PID:9824
- C:\Windows\System\iawbNTe.exe
  C:\Windows\System\iawbNTe.exe
  2⤵
  PID:9852
- C:\Windows\System\iwLRVeh.exe
  C:\Windows\System\iwLRVeh.exe
  2⤵
  PID:9880
- C:\Windows\System\ibKNDje.exe
  C:\Windows\System\ibKNDje.exe
  2⤵
  PID:9908
- C:\Windows\System\wZorSzs.exe
  C:\Windows\System\wZorSzs.exe
  2⤵
  PID:9928
- C:\Windows\System\icYaeab.exe
  C:\Windows\System\icYaeab.exe
  2⤵
  PID:9956
- C:\Windows\System\mxhxUYb.exe
  C:\Windows\System\mxhxUYb.exe
  2⤵
  PID:9980
- C:\Windows\System\PlpTFus.exe
  C:\Windows\System\PlpTFus.exe
  2⤵
  PID:10008
- C:\Windows\System\itwBTFV.exe
  C:\Windows\System\itwBTFV.exe
  2⤵
  PID:10040
- C:\Windows\System\eypmdBL.exe
  C:\Windows\System\eypmdBL.exe
  2⤵
  PID:10068
- C:\Windows\System\OANRYpf.exe
  C:\Windows\System\OANRYpf.exe
  2⤵
  PID:10092
- C:\Windows\System\grSJmZs.exe
  C:\Windows\System\grSJmZs.exe
  2⤵
  PID:10124
- C:\Windows\System\JzioVwR.exe
  C:\Windows\System\JzioVwR.exe
  2⤵
  PID:10148
- C:\Windows\System\NtCaIRe.exe
  C:\Windows\System\NtCaIRe.exe
  2⤵
  PID:10188
- C:\Windows\System\DLZgLPV.exe
  C:\Windows\System\DLZgLPV.exe
  2⤵
  PID:10212
- C:\Windows\System\BTWKWoP.exe
  C:\Windows\System\BTWKWoP.exe
  2⤵
  PID:10232
- C:\Windows\System\LJMiLiT.exe
  C:\Windows\System\LJMiLiT.exe
  2⤵
  PID:9220
- C:\Windows\System\cPTzMiF.exe
  C:\Windows\System\cPTzMiF.exe
  2⤵
  PID:9300
- C:\Windows\System\BjpOkTk.exe
  C:\Windows\System\BjpOkTk.exe
  2⤵
  PID:9396
- C:\Windows\System\DKbMoET.exe
  C:\Windows\System\DKbMoET.exe
  2⤵
  PID:9448
- C:\Windows\System\NJePftJ.exe
  C:\Windows\System\NJePftJ.exe
  2⤵
  PID:9504
- C:\Windows\System\oSOTjPL.exe
  C:\Windows\System\oSOTjPL.exe
  2⤵
  PID:9556
- C:\Windows\System\QLiSkHo.exe
  C:\Windows\System\QLiSkHo.exe
  2⤵
  PID:9616
- C:\Windows\System\tnTCXxQ.exe
  C:\Windows\System\tnTCXxQ.exe
  2⤵
  PID:9668
- C:\Windows\System\qGjqxJQ.exe
  C:\Windows\System\qGjqxJQ.exe
  2⤵
  PID:9720
- C:\Windows\System\wyxtWpX.exe
  C:\Windows\System\wyxtWpX.exe
  2⤵
  PID:9812
- C:\Windows\System\DbhHfxN.exe
  C:\Windows\System\DbhHfxN.exe
  2⤵
  PID:9872
- C:\Windows\System\XnxWHhY.exe
  C:\Windows\System\XnxWHhY.exe
  2⤵
  PID:9936
- C:\Windows\System\HmuQvfH.exe
  C:\Windows\System\HmuQvfH.exe
  2⤵
  PID:10000
- C:\Windows\System\haYqqZQ.exe
  C:\Windows\System\haYqqZQ.exe
  2⤵
  PID:10084
- C:\Windows\System\uqEeRso.exe
  C:\Windows\System\uqEeRso.exe
  2⤵
  PID:10160
- C:\Windows\System\ihMUOfB.exe
  C:\Windows\System\ihMUOfB.exe
  2⤵
  PID:10224
- C:\Windows\System\pPjKtiu.exe
  C:\Windows\System\pPjKtiu.exe
  2⤵
  PID:9344
- C:\Windows\System\ycBgAes.exe
  C:\Windows\System\ycBgAes.exe
  2⤵
  PID:9484
- C:\Windows\System\koUnJoT.exe
  C:\Windows\System\koUnJoT.exe
  2⤵
  PID:9644
- C:\Windows\System\mvUloNs.exe
  C:\Windows\System\mvUloNs.exe
  2⤵
  PID:9692
- C:\Windows\System\FQIimsy.exe
  C:\Windows\System\FQIimsy.exe
  2⤵
  PID:9892
- C:\Windows\System\eHxMgOL.exe
  C:\Windows\System\eHxMgOL.exe
  2⤵
  PID:9964
- C:\Windows\System\TEUChhV.exe
  C:\Windows\System\TEUChhV.exe
  2⤵
  PID:10052
- C:\Windows\System\itcuoes.exe
  C:\Windows\System\itcuoes.exe
  2⤵
  PID:9288
- C:\Windows\System\vMPPQlq.exe
  C:\Windows\System\vMPPQlq.exe
  2⤵
  PID:9108
- C:\Windows\System\PWbHCWd.exe
  C:\Windows\System\PWbHCWd.exe
  2⤵
  PID:9992
- C:\Windows\System\pUArptI.exe
  C:\Windows\System\pUArptI.exe
  2⤵
  PID:9796
- C:\Windows\System\YNyPgGl.exe
  C:\Windows\System\YNyPgGl.exe
  2⤵
  PID:10252
- C:\Windows\System\uaXgaAD.exe
  C:\Windows\System\uaXgaAD.exe
  2⤵
  PID:10280
- C:\Windows\System\dUTteRa.exe
  C:\Windows\System\dUTteRa.exe
  2⤵
  PID:10308
- C:\Windows\System\rgjxUdL.exe
  C:\Windows\System\rgjxUdL.exe
  2⤵
  PID:10324
- C:\Windows\System\klcfPZt.exe
  C:\Windows\System\klcfPZt.exe
  2⤵
  PID:10344
- C:\Windows\System\hnmPVsf.exe
  C:\Windows\System\hnmPVsf.exe
  2⤵
  PID:10372
- C:\Windows\System\XtevxIV.exe
  C:\Windows\System\XtevxIV.exe
  2⤵
  PID:10396
- C:\Windows\System\LILRDUn.exe
  C:\Windows\System\LILRDUn.exe
  2⤵
  PID:10424
- C:\Windows\System\EvMTCyi.exe
  C:\Windows\System\EvMTCyi.exe
  2⤵
  PID:10452
- C:\Windows\System\zduqzit.exe
  C:\Windows\System\zduqzit.exe
  2⤵
  PID:10476
- C:\Windows\System\fyWfzWn.exe
  C:\Windows\System\fyWfzWn.exe
  2⤵
  PID:10512
- C:\Windows\System\XGZeNiw.exe
  C:\Windows\System\XGZeNiw.exe
  2⤵
  PID:10536
- C:\Windows\System\DFUpZZg.exe
  C:\Windows\System\DFUpZZg.exe
  2⤵
  PID:10564
- C:\Windows\System\nAbsmLw.exe
  C:\Windows\System\nAbsmLw.exe
  2⤵
  PID:10596
- C:\Windows\System\ctCUdvg.exe
  C:\Windows\System\ctCUdvg.exe
  2⤵
  PID:10620
- C:\Windows\System\fnKtoqM.exe
  C:\Windows\System\fnKtoqM.exe
  2⤵
  PID:10636
- C:\Windows\System\RPcwdfB.exe
  C:\Windows\System\RPcwdfB.exe
  2⤵
  PID:10660
- C:\Windows\System\sImiEUS.exe
  C:\Windows\System\sImiEUS.exe
  2⤵
  PID:10688
- C:\Windows\System\agCsQKw.exe
  C:\Windows\System\agCsQKw.exe
  2⤵
  PID:10716
- C:\Windows\System\DbqCaEm.exe
  C:\Windows\System\DbqCaEm.exe
  2⤵
  PID:10756
- C:\Windows\System\jhaIkzY.exe
  C:\Windows\System\jhaIkzY.exe
  2⤵
  PID:10780
- C:\Windows\System\FAvrFdK.exe
  C:\Windows\System\FAvrFdK.exe
  2⤵
  PID:10812
- C:\Windows\System\lQrMPMg.exe
  C:\Windows\System\lQrMPMg.exe
  2⤵
  PID:10844
- C:\Windows\System\vnwdAyF.exe
  C:\Windows\System\vnwdAyF.exe
  2⤵
  PID:10860
- C:\Windows\System\gcMpnaH.exe
  C:\Windows\System\gcMpnaH.exe
  2⤵
  PID:10892
- C:\Windows\System\ydzrlfm.exe
  C:\Windows\System\ydzrlfm.exe
  2⤵
  PID:10932
- C:\Windows\System\DGlPbOR.exe
  C:\Windows\System\DGlPbOR.exe
  2⤵
  PID:10960
- C:\Windows\System\kMUGPct.exe
  C:\Windows\System\kMUGPct.exe
  2⤵
  PID:10992
- C:\Windows\System\nAjkwFa.exe
  C:\Windows\System\nAjkwFa.exe
  2⤵
  PID:11024
- C:\Windows\System\TEHlnAE.exe
  C:\Windows\System\TEHlnAE.exe
  2⤵
  PID:11056
- C:\Windows\System\rRLRteG.exe
  C:\Windows\System\rRLRteG.exe
  2⤵
  PID:11080
- C:\Windows\System\uAMiCJj.exe
  C:\Windows\System\uAMiCJj.exe
  2⤵
  PID:11112
- C:\Windows\System\qLrvSMF.exe
  C:\Windows\System\qLrvSMF.exe
  2⤵
  PID:11136
- C:\Windows\System\qRJraJx.exe
  C:\Windows\System\qRJraJx.exe
  2⤵
  PID:11172
- C:\Windows\System\gwkbtoV.exe
  C:\Windows\System\gwkbtoV.exe
  2⤵
  PID:11188
- C:\Windows\System\FmsORJm.exe
  C:\Windows\System\FmsORJm.exe
  2⤵
  PID:11208
- C:\Windows\System\pFBmkIw.exe
  C:\Windows\System\pFBmkIw.exe
  2⤵
  PID:11244
- C:\Windows\System\WHMwcLT.exe
  C:\Windows\System\WHMwcLT.exe
  2⤵
  PID:9924
- C:\Windows\System\qQjRMTH.exe
  C:\Windows\System\qQjRMTH.exe
  2⤵
  PID:10320
- C:\Windows\System\nGBTPrq.exe
  C:\Windows\System\nGBTPrq.exe
  2⤵
  PID:10364
- C:\Windows\System\rMNjIZX.exe
  C:\Windows\System\rMNjIZX.exe
  2⤵
  PID:10416
- C:\Windows\System\baPNZrE.exe
  C:\Windows\System\baPNZrE.exe
  2⤵
  PID:10500
- C:\Windows\System\sFoTkkI.exe
  C:\Windows\System\sFoTkkI.exe
  2⤵
  PID:10548
- C:\Windows\System\zwQandX.exe
  C:\Windows\System\zwQandX.exe
  2⤵
  PID:10592
- C:\Windows\System\pcEBxLc.exe
  C:\Windows\System\pcEBxLc.exe
  2⤵
  PID:10672
- C:\Windows\System\NKbQTOV.exe
  C:\Windows\System\NKbQTOV.exe
  2⤵
  PID:10704
- C:\Windows\System\teWSPbi.exe
  C:\Windows\System\teWSPbi.exe
  2⤵
  PID:10800
- C:\Windows\System\mwQGayL.exe
  C:\Windows\System\mwQGayL.exe
  2⤵
  PID:10852
- C:\Windows\System\PfmRrpv.exe
  C:\Windows\System\PfmRrpv.exe
  2⤵
  PID:10944
- C:\Windows\System\qduIFJL.exe
  C:\Windows\System\qduIFJL.exe
  2⤵
  PID:11008
- C:\Windows\System\XojrBTc.exe
  C:\Windows\System\XojrBTc.exe
  2⤵
  PID:11092
- C:\Windows\System\OfMDgJX.exe
  C:\Windows\System\OfMDgJX.exe
  2⤵
  PID:11180
- C:\Windows\System\ikhBvcb.exe
  C:\Windows\System\ikhBvcb.exe
  2⤵
  PID:11256
- C:\Windows\System\RhatnEU.exe
  C:\Windows\System\RhatnEU.exe
  2⤵
  PID:10360
- C:\Windows\System\VbRxyZj.exe
  C:\Windows\System\VbRxyZj.exe
  2⤵
  PID:10460
- C:\Windows\System\uhuYWPV.exe
  C:\Windows\System\uhuYWPV.exe
  2⤵
  PID:10744
- C:\Windows\System\uYlwAlh.exe
  C:\Windows\System\uYlwAlh.exe
  2⤵
  PID:10628
- C:\Windows\System\grxMbVI.exe
  C:\Windows\System\grxMbVI.exe
  2⤵
  PID:10796
- C:\Windows\System\CWawtul.exe
  C:\Windows\System\CWawtul.exe
  2⤵
  PID:11132
- C:\Windows\System\VdykooU.exe
  C:\Windows\System\VdykooU.exe
  2⤵
  PID:10268
- C:\Windows\System\yeiaPEj.exe
  C:\Windows\System\yeiaPEj.exe
  2⤵
  PID:10408
- C:\Windows\System\zjdmIGt.exe
  C:\Windows\System\zjdmIGt.exe
  2⤵
  PID:10976
- C:\Windows\System\FEkoAjf.exe
  C:\Windows\System\FEkoAjf.exe
  2⤵
  PID:11108
- C:\Windows\System\gcqSjKE.exe
  C:\Windows\System\gcqSjKE.exe
  2⤵
  PID:9712
- C:\Windows\System\LTBeBZh.exe
  C:\Windows\System\LTBeBZh.exe
  2⤵
  PID:11284
- C:\Windows\System\aWikgnM.exe
  C:\Windows\System\aWikgnM.exe
  2⤵
  PID:11320
- C:\Windows\System\caxPtTA.exe
  C:\Windows\System\caxPtTA.exe
  2⤵
  PID:11352
- C:\Windows\System\TZFtFsa.exe
  C:\Windows\System\TZFtFsa.exe
  2⤵
  PID:11372
- C:\Windows\System\eiaQoZh.exe
  C:\Windows\System\eiaQoZh.exe
  2⤵
  PID:11396
- C:\Windows\System\IUKOYhR.exe
  C:\Windows\System\IUKOYhR.exe
  2⤵
  PID:11428
- C:\Windows\System\MoWcRHY.exe
  C:\Windows\System\MoWcRHY.exe
  2⤵
  PID:11448
- C:\Windows\System\iBMIfsk.exe
  C:\Windows\System\iBMIfsk.exe
  2⤵
  PID:11484
- C:\Windows\System\zCOQLAe.exe
  C:\Windows\System\zCOQLAe.exe
  2⤵
  PID:11508
- C:\Windows\System\yFFmbAT.exe
  C:\Windows\System\yFFmbAT.exe
  2⤵
  PID:11544
- C:\Windows\System\tCbWcEl.exe
  C:\Windows\System\tCbWcEl.exe
  2⤵
  PID:11564
- C:\Windows\System\eAvKcLJ.exe
  C:\Windows\System\eAvKcLJ.exe
  2⤵
  PID:11580
- C:\Windows\System\PnhMDNE.exe
  C:\Windows\System\PnhMDNE.exe
  2⤵
  PID:11608
- C:\Windows\System\IMqxLlh.exe
  C:\Windows\System\IMqxLlh.exe
  2⤵
  PID:11636
- C:\Windows\System\PFcrRZq.exe
  C:\Windows\System\PFcrRZq.exe
  2⤵
  PID:11672
- C:\Windows\System\csgCCtf.exe
  C:\Windows\System\csgCCtf.exe
  2⤵
  PID:11704
- C:\Windows\System\lKabqLL.exe
  C:\Windows\System\lKabqLL.exe
  2⤵
  PID:11732
- C:\Windows\System\jUGqXYy.exe
  C:\Windows\System\jUGqXYy.exe
  2⤵
  PID:11764
- C:\Windows\System\YwLSNTN.exe
  C:\Windows\System\YwLSNTN.exe
  2⤵
  PID:11796
- C:\Windows\System\dHQxvqk.exe
  C:\Windows\System\dHQxvqk.exe
  2⤵
  PID:11820
- C:\Windows\System\MmePLBt.exe
  C:\Windows\System\MmePLBt.exe
  2⤵
  PID:11848
- C:\Windows\System\ZZAwbai.exe
  C:\Windows\System\ZZAwbai.exe
  2⤵
  PID:11876
- C:\Windows\System\vdqNGFZ.exe
  C:\Windows\System\vdqNGFZ.exe
  2⤵
  PID:11900
- C:\Windows\System\RWWniEN.exe
  C:\Windows\System\RWWniEN.exe
  2⤵
  PID:11932
- C:\Windows\System\XKQvuDU.exe
  C:\Windows\System\XKQvuDU.exe
  2⤵
  PID:11952
- C:\Windows\System\PTeTVcf.exe
  C:\Windows\System\PTeTVcf.exe
  2⤵
  PID:11988
- C:\Windows\System\aZlOvMI.exe
  C:\Windows\System\aZlOvMI.exe
  2⤵
  PID:12008
- C:\Windows\System\eOXHnZB.exe
  C:\Windows\System\eOXHnZB.exe
  2⤵
  PID:12032
- C:\Windows\System\mSRITBP.exe
  C:\Windows\System\mSRITBP.exe
  2⤵
  PID:12056
- C:\Windows\System\RgdCDme.exe
  C:\Windows\System\RgdCDme.exe
  2⤵
  PID:12076
- C:\Windows\System\zTSAdrf.exe
  C:\Windows\System\zTSAdrf.exe
  2⤵
  PID:12092
- C:\Windows\System\ktxYPkX.exe
  C:\Windows\System\ktxYPkX.exe
  2⤵
  PID:12120
- C:\Windows\System\OPLeRuP.exe
  C:\Windows\System\OPLeRuP.exe
  2⤵
  PID:12144
- C:\Windows\System\SLFGwXX.exe
  C:\Windows\System\SLFGwXX.exe
  2⤵
  PID:12176
- C:\Windows\System\TQoyhNN.exe
  C:\Windows\System\TQoyhNN.exe
  2⤵
  PID:12204
- C:\Windows\System\uztHNMU.exe
  C:\Windows\System\uztHNMU.exe
  2⤵
  PID:12244
- C:\Windows\System\kFxVvQM.exe
  C:\Windows\System\kFxVvQM.exe
  2⤵
  PID:12268
- C:\Windows\System\JyaTNLn.exe
  C:\Windows\System\JyaTNLn.exe
  2⤵
  PID:10316
- C:\Windows\System\fpnWIwb.exe
  C:\Windows\System\fpnWIwb.exe
  2⤵
  PID:11336
- C:\Windows\System\LtfKBmE.exe
  C:\Windows\System\LtfKBmE.exe
  2⤵
  PID:11408
- C:\Windows\System\EjyfMnf.exe
  C:\Windows\System\EjyfMnf.exe
  2⤵
  PID:11504
- C:\Windows\System\gpJnzZl.exe
  C:\Windows\System\gpJnzZl.exe
  2⤵
  PID:11552
- C:\Windows\System\xZsIdbW.exe
  C:\Windows\System\xZsIdbW.exe
  2⤵
  PID:11624
- C:\Windows\System\JjqWGVJ.exe
  C:\Windows\System\JjqWGVJ.exe
  2⤵
  PID:11688
- C:\Windows\System\tgtlvtW.exe
  C:\Windows\System\tgtlvtW.exe
  2⤵
  PID:11760
- C:\Windows\System\BSlvQpr.exe
  C:\Windows\System\BSlvQpr.exe
  2⤵
  PID:11812
- C:\Windows\System\dtqPuBg.exe
  C:\Windows\System\dtqPuBg.exe
  2⤵
  PID:11868
- C:\Windows\System\KyCiUOG.exe
  C:\Windows\System\KyCiUOG.exe
  2⤵
  PID:11944
- C:\Windows\System\jHBqdkv.exe
  C:\Windows\System\jHBqdkv.exe
  2⤵
  PID:12048
- C:\Windows\System\pSTcRPw.exe
  C:\Windows\System\pSTcRPw.exe
  2⤵
  PID:12052
- C:\Windows\System\uuFZXLw.exe
  C:\Windows\System\uuFZXLw.exe
  2⤵
  PID:12232
- C:\Windows\System\OTkEXDQ.exe
  C:\Windows\System\OTkEXDQ.exe
  2⤵
  PID:10828
- C:\Windows\System\xlrWIdC.exe
  C:\Windows\System\xlrWIdC.exe
  2⤵
  PID:11064
- C:\Windows\System\BhACHNi.exe
  C:\Windows\System\BhACHNi.exe
  2⤵
  PID:11464
- C:\Windows\System\rZsRWJV.exe
  C:\Windows\System\rZsRWJV.exe
  2⤵
  PID:11664
- C:\Windows\System\NGRWqxv.exe
  C:\Windows\System\NGRWqxv.exe
  2⤵
  PID:11804
- C:\Windows\System\AShlWcu.exe
  C:\Windows\System\AShlWcu.exe
  2⤵
  PID:11960
- C:\Windows\System\uZSJief.exe
  C:\Windows\System\uZSJief.exe
  2⤵
  PID:12068
- C:\Windows\System\bBVGJmM.exe
  C:\Windows\System\bBVGJmM.exe
  2⤵
  PID:12260
- C:\Windows\System\iABZVUt.exe
  C:\Windows\System\iABZVUt.exe
  2⤵
  PID:11392
- C:\Windows\System\MxISrud.exe
  C:\Windows\System\MxISrud.exe
  2⤵
  PID:11816
- C:\Windows\System\HyaGYdP.exe
  C:\Windows\System\HyaGYdP.exe
  2⤵
  PID:12136
- C:\Windows\System\DKZwrIL.exe
  C:\Windows\System\DKZwrIL.exe
  2⤵
  PID:12024
- C:\Windows\System\wRXrTOE.exe
  C:\Windows\System\wRXrTOE.exe
  2⤵
  PID:12300
- C:\Windows\System\vlCSNGo.exe
  C:\Windows\System\vlCSNGo.exe
  2⤵
  PID:12328
- C:\Windows\System\eguybDD.exe
  C:\Windows\System\eguybDD.exe
  2⤵
  PID:12356
- C:\Windows\System\AgqDLwW.exe
  C:\Windows\System\AgqDLwW.exe
  2⤵
  PID:12388
- C:\Windows\System\CCfszfo.exe
  C:\Windows\System\CCfszfo.exe
  2⤵
  PID:12420
- C:\Windows\System\jWYliOI.exe
  C:\Windows\System\jWYliOI.exe
  2⤵
  PID:12452
- C:\Windows\System\EyqHScn.exe
  C:\Windows\System\EyqHScn.exe
  2⤵
  PID:12480
- C:\Windows\System\xmbCKbR.exe
  C:\Windows\System\xmbCKbR.exe
  2⤵
  PID:12512
- C:\Windows\System\eqHnPeQ.exe
  C:\Windows\System\eqHnPeQ.exe
  2⤵
  PID:12528
- C:\Windows\System\bRafmUm.exe
  C:\Windows\System\bRafmUm.exe
  2⤵
  PID:12556
- C:\Windows\System\gAtNAur.exe
  C:\Windows\System\gAtNAur.exe
  2⤵
  PID:12588
- C:\Windows\System\wSHmFhL.exe
  C:\Windows\System\wSHmFhL.exe
  2⤵
  PID:12620
- C:\Windows\System\PdBSEBb.exe
  C:\Windows\System\PdBSEBb.exe
  2⤵
  PID:12640
- C:\Windows\System\CRTPeSv.exe
  C:\Windows\System\CRTPeSv.exe
  2⤵
  PID:12672
- C:\Windows\System\DVPvsuq.exe
  C:\Windows\System\DVPvsuq.exe
  2⤵
  PID:12704
- C:\Windows\System\QbzFKIv.exe
  C:\Windows\System\QbzFKIv.exe
  2⤵
  PID:12724
- C:\Windows\System\HvJuHWW.exe
  C:\Windows\System\HvJuHWW.exe
  2⤵
  PID:12752
- C:\Windows\System\KgbpGZk.exe
  C:\Windows\System\KgbpGZk.exe
  2⤵
  PID:12780
- C:\Windows\System\xSXBkIB.exe
  C:\Windows\System\xSXBkIB.exe
  2⤵
  PID:12812
- C:\Windows\System\AUxhAvr.exe
  C:\Windows\System\AUxhAvr.exe
  2⤵
  PID:12836
- C:\Windows\System\tmasphE.exe
  C:\Windows\System\tmasphE.exe
  2⤵
  PID:12868
- C:\Windows\System\RCiybXg.exe
  C:\Windows\System\RCiybXg.exe
  2⤵
  PID:12892
- C:\Windows\System\GHaZhCa.exe
  C:\Windows\System\GHaZhCa.exe
  2⤵
  PID:12912
- C:\Windows\System\kYaNOff.exe
  C:\Windows\System\kYaNOff.exe
  2⤵
  PID:12932
- C:\Windows\System\xRrSUNG.exe
  C:\Windows\System\xRrSUNG.exe
  2⤵
  PID:12952
- C:\Windows\System\zozSMTt.exe
  C:\Windows\System\zozSMTt.exe
  2⤵
  PID:12980
- C:\Windows\System\DBquiGh.exe
  C:\Windows\System\DBquiGh.exe
  2⤵
  PID:13004
- C:\Windows\System\JxfKeIW.exe
  C:\Windows\System\JxfKeIW.exe
  2⤵
  PID:13036
- C:\Windows\System\KyeIVnv.exe
  C:\Windows\System\KyeIVnv.exe
  2⤵
  PID:13072
- C:\Windows\System\ALDkcKh.exe
  C:\Windows\System\ALDkcKh.exe
  2⤵
  PID:13096
- C:\Windows\System\lIwtqmk.exe
  C:\Windows\System\lIwtqmk.exe
  2⤵
  PID:13132
- C:\Windows\System\ykkyHpS.exe
  C:\Windows\System\ykkyHpS.exe
  2⤵
  PID:13164
- C:\Windows\System\eOgMTxn.exe
  C:\Windows\System\eOgMTxn.exe
  2⤵
  PID:13200
- C:\Windows\System\ugpDSrV.exe
  C:\Windows\System\ugpDSrV.exe
  2⤵
  PID:13228
- C:\Windows\System\dvgZkxX.exe
  C:\Windows\System\dvgZkxX.exe
  2⤵
  PID:13256
- C:\Windows\System\gZuqVhF.exe
  C:\Windows\System\gZuqVhF.exe
  2⤵
  PID:13280
- C:\Windows\System\nPdwVwh.exe
  C:\Windows\System\nPdwVwh.exe
  2⤵
  PID:13308
- C:\Windows\System\fMBvUVR.exe
  C:\Windows\System\fMBvUVR.exe
  2⤵
  PID:12320
- C:\Windows\System\WeKocSX.exe
  C:\Windows\System\WeKocSX.exe
  2⤵
  PID:12380
- C:\Windows\System\THMPpCF.exe
  C:\Windows\System\THMPpCF.exe
  2⤵
  PID:12448
- C:\Windows\System\HozLCEH.exe
  C:\Windows\System\HozLCEH.exe
  2⤵
  PID:12524
- C:\Windows\System\fKZVTVf.exe
  C:\Windows\System\fKZVTVf.exe
  2⤵
  PID:12596
- C:\Windows\System\zDqonYU.exe
  C:\Windows\System\zDqonYU.exe
  2⤵
  PID:12668
- C:\Windows\System\vKzbmCY.exe
  C:\Windows\System\vKzbmCY.exe
  2⤵
  PID:12940
- C:\Windows\System\LRcWbps.exe
  C:\Windows\System\LRcWbps.exe
  2⤵
  PID:12948
- C:\Windows\System\UKiXTYu.exe
  C:\Windows\System\UKiXTYu.exe
  2⤵
  PID:13044
- C:\Windows\System\bkRgvzY.exe
  C:\Windows\System\bkRgvzY.exe
  2⤵
  PID:13120
- C:\Windows\System\gaLTmgD.exe
  C:\Windows\System\gaLTmgD.exe
  2⤵
  PID:13152
- C:\Windows\System\zhmlRxe.exe
  C:\Windows\System\zhmlRxe.exe
  2⤵
  PID:13304
- C:\Windows\System\twbEvdr.exe
  C:\Windows\System\twbEvdr.exe
  2⤵
  PID:12292
- C:\Windows\System\HpzPWpI.exe
  C:\Windows\System\HpzPWpI.exe
  2⤵
  PID:12568
- C:\Windows\System\qxgBkaA.exe
  C:\Windows\System\qxgBkaA.exe
  2⤵
  PID:12736
- C:\Windows\System\oZoxAGD.exe
  C:\Windows\System\oZoxAGD.exe
  2⤵
  PID:13020
- C:\Windows\System\oAxjjUY.exe
  C:\Windows\System\oAxjjUY.exe
  2⤵
  PID:12372
- C:\Windows\System\DRjZKEk.exe
  C:\Windows\System\DRjZKEk.exe
  2⤵
  PID:12688
- C:\Windows\System\vZQNudg.exe
  C:\Windows\System\vZQNudg.exe
  2⤵
  PID:13092
- C:\Windows\System\xQbalZZ.exe
  C:\Windows\System\xQbalZZ.exe
  2⤵
  PID:12416
- C:\Windows\System\OgezINH.exe
  C:\Windows\System\OgezINH.exe
  2⤵
  PID:13332
- C:\Windows\System\syQjKMp.exe
  C:\Windows\System\syQjKMp.exe
  2⤵
  PID:13352
- C:\Windows\System\lgaBvMP.exe
  C:\Windows\System\lgaBvMP.exe
  2⤵
  PID:13384
- C:\Windows\System\CpgZjcd.exe
  C:\Windows\System\CpgZjcd.exe
  2⤵
  PID:13408
- C:\Windows\System\NfauJhg.exe
  C:\Windows\System\NfauJhg.exe
  2⤵
  PID:13436
- C:\Windows\System\ZDBLajV.exe
  C:\Windows\System\ZDBLajV.exe
  2⤵
  PID:13456
- C:\Windows\System\sGFpTmJ.exe
  C:\Windows\System\sGFpTmJ.exe
  2⤵
  PID:13484
- C:\Windows\System\WnlWTEU.exe
  C:\Windows\System\WnlWTEU.exe
  2⤵
  PID:13516
- C:\Windows\System\woBTNKw.exe
  C:\Windows\System\woBTNKw.exe
  2⤵
  PID:13544
- C:\Windows\System\EyldjwA.exe
  C:\Windows\System\EyldjwA.exe
  2⤵
  PID:13576
- C:\Windows\System\JTVAYUM.exe
  C:\Windows\System\JTVAYUM.exe
  2⤵
  PID:13600
- C:\Windows\System\sJRDfzM.exe
  C:\Windows\System\sJRDfzM.exe
  2⤵
  PID:13624
- C:\Windows\System\bEixtjA.exe
  C:\Windows\System\bEixtjA.exe
  2⤵
  PID:13660
- C:\Windows\System\hcLBTJd.exe
  C:\Windows\System\hcLBTJd.exe
  2⤵
  PID:13692
- C:\Windows\System\MKrXMns.exe
  C:\Windows\System\MKrXMns.exe
  2⤵
  PID:13720
- C:\Windows\System\vwoVKvA.exe
  C:\Windows\System\vwoVKvA.exe
  2⤵
  PID:13748
- C:\Windows\System\coMgRze.exe
  C:\Windows\System\coMgRze.exe
  2⤵
  PID:13776
- C:\Windows\System\udwMeax.exe
  C:\Windows\System\udwMeax.exe
  2⤵
  PID:13800
- C:\Windows\System\drQnwhN.exe
  C:\Windows\System\drQnwhN.exe
  2⤵
  PID:13840
- C:\Windows\System\MArdVXA.exe
  C:\Windows\System\MArdVXA.exe
  2⤵
  PID:13872
- C:\Windows\System\VkgWDbw.exe
  C:\Windows\System\VkgWDbw.exe
  2⤵
  PID:13892
- C:\Windows\System\HSGbnpo.exe
  C:\Windows\System\HSGbnpo.exe
  2⤵
  PID:13916
- C:\Windows\System\tnGXdDl.exe
  C:\Windows\System\tnGXdDl.exe
  2⤵
  PID:13948
- C:\Windows\System\WpsHQqB.exe
  C:\Windows\System\WpsHQqB.exe
  2⤵
  PID:13972
- C:\Windows\System\YkZkOGm.exe
  C:\Windows\System\YkZkOGm.exe
  2⤵
  PID:14024
- C:\Windows\System\zXIdxdZ.exe
  C:\Windows\System\zXIdxdZ.exe
  2⤵
  PID:14052
- C:\Windows\System\oeChPBp.exe
  C:\Windows\System\oeChPBp.exe
  2⤵
  PID:14088
- C:\Windows\System\ZIwrNgK.exe
  C:\Windows\System\ZIwrNgK.exe
  2⤵
  PID:14124
- C:\Windows\System\tpWsJZJ.exe
  C:\Windows\System\tpWsJZJ.exe
  2⤵
  PID:14156
- C:\Windows\System\YljRGln.exe
  C:\Windows\System\YljRGln.exe
  2⤵
  PID:14184
- C:\Windows\System\QRhFXWI.exe
  C:\Windows\System\QRhFXWI.exe
  2⤵
  PID:14208
- C:\Windows\System\JFerYNW.exe
  C:\Windows\System\JFerYNW.exe
  2⤵
  PID:14236
- C:\Windows\System\NOPTmSy.exe
  C:\Windows\System\NOPTmSy.exe
  2⤵
  PID:14264
- C:\Windows\System\ipduZAO.exe
  C:\Windows\System\ipduZAO.exe
  2⤵
  PID:14288
- C:\Windows\System\uBkNNAF.exe
  C:\Windows\System\uBkNNAF.exe
  2⤵
  PID:14324
- C:\Windows\System\eNtgvaP.exe
  C:\Windows\System\eNtgvaP.exe
  2⤵
  PID:12440
- C:\Windows\System\VCaYOXG.exe
  C:\Windows\System\VCaYOXG.exe
  2⤵
  PID:13344
- C:\Windows\System\ZAqBAxH.exe
  C:\Windows\System\ZAqBAxH.exe
  2⤵
  PID:13396
- C:\Windows\System\pfbsVzD.exe
  C:\Windows\System\pfbsVzD.exe
  2⤵
  PID:13444
- C:\Windows\System\istdCoL.exe
  C:\Windows\System\istdCoL.exe
  2⤵
  PID:13532
- C:\Windows\System\wKpWPTz.exe
  C:\Windows\System\wKpWPTz.exe
  2⤵
  PID:13612
- C:\Windows\System\zFALBgx.exe
  C:\Windows\System\zFALBgx.exe
  2⤵
  PID:13644
- C:\Windows\System\lTmQXMt.exe
  C:\Windows\System\lTmQXMt.exe
  2⤵
  PID:13768
- C:\Windows\System\jZxdjMA.exe
  C:\Windows\System\jZxdjMA.exe
  2⤵
  PID:13788
- C:\Windows\System\BatOZrR.exe
  C:\Windows\System\BatOZrR.exe
  2⤵
  PID:13824
- C:\Windows\System\DzkXzfn.exe
  C:\Windows\System\DzkXzfn.exe
  2⤵
  PID:13924
- C:\Windows\System\SMsosRl.exe
  C:\Windows\System\SMsosRl.exe
  2⤵
  PID:14032
- C:\Windows\System\hpKlyYx.exe
  C:\Windows\System\hpKlyYx.exe
  2⤵
  PID:14072
- C:\Windows\System\eyWhWhL.exe
  C:\Windows\System\eyWhWhL.exe
  2⤵
  PID:14148
- C:\Windows\System\GMshzXN.exe
  C:\Windows\System\GMshzXN.exe
  2⤵
  PID:14224
- C:\Windows\System\mbcPJna.exe
  C:\Windows\System\mbcPJna.exe
  2⤵
  PID:14320
- C:\Windows\System\XOuVQRe.exe
  C:\Windows\System\XOuVQRe.exe
  2⤵
  PID:13376
- C:\Windows\System\BvbOkbA.exe
  C:\Windows\System\BvbOkbA.exe
  2⤵
  PID:13464
- C:\Windows\System\ZNzrSMK.exe
  C:\Windows\System\ZNzrSMK.exe
  2⤵
  PID:13740
- C:\Windows\System\eWEznQp.exe
  C:\Windows\System\eWEznQp.exe
  2⤵
  PID:13716
- C:\Windows\System\dIsQVjB.exe
  C:\Windows\System\dIsQVjB.exe
  2⤵
  PID:13832
- C:\Windows\System\sWGczGj.exe
  C:\Windows\System\sWGczGj.exe
  2⤵
  PID:14204
- C:\Windows\System\UckmAMW.exe
  C:\Windows\System\UckmAMW.exe
  2⤵
  PID:14280
- C:\Windows\System\XRGmdMU.exe
  C:\Windows\System\XRGmdMU.exe
  2⤵
  PID:14108
- C:\Windows\System\FmVSOyB.exe
  C:\Windows\System\FmVSOyB.exe
  2⤵
  PID:13984
- C:\Windows\System\ByDfvmc.exe
  C:\Windows\System\ByDfvmc.exe
  2⤵
  PID:14312
- C:\Windows\System\uhBNdZO.exe
  C:\Windows\System\uhBNdZO.exe
  2⤵
  PID:13732
- C:\Windows\System\fcLwseS.exe
  C:\Windows\System\fcLwseS.exe
  2⤵
  PID:14356
- C:\Windows\System\uKfwTQc.exe
  C:\Windows\System\uKfwTQc.exe
  2⤵
  PID:14380
- C:\Windows\System\iPGjFRQ.exe
  C:\Windows\System\iPGjFRQ.exe
  2⤵
  PID:14404
- C:\Windows\System\tBBfbnt.exe
  C:\Windows\System\tBBfbnt.exe
  2⤵
  PID:14436
- C:\Windows\System\plJmxwS.exe
  C:\Windows\System\plJmxwS.exe
  2⤵
  PID:14464
- C:\Windows\System\BlHtGpu.exe
  C:\Windows\System\BlHtGpu.exe
  2⤵
  PID:14496
- C:\Windows\System\yshiHxK.exe
  C:\Windows\System\yshiHxK.exe
  2⤵
  PID:14528
- C:\Windows\System\oYxLcTA.exe
  C:\Windows\System\oYxLcTA.exe
  2⤵
  PID:14548
- C:\Windows\System\YgiYtZN.exe
  C:\Windows\System\YgiYtZN.exe
  2⤵
  PID:14576
- C:\Windows\System\kCdmWto.exe
  C:\Windows\System\kCdmWto.exe
  2⤵
  PID:14608
- C:\Windows\System\iUKjDBU.exe
  C:\Windows\System\iUKjDBU.exe
  2⤵
  PID:14632
- C:\Windows\System\yqBHpdn.exe
  C:\Windows\System\yqBHpdn.exe
  2⤵
  PID:14656
- C:\Windows\System\AjbnIOi.exe
  C:\Windows\System\AjbnIOi.exe
  2⤵
  PID:14688
- C:\Windows\System\aPkdLHe.exe
  C:\Windows\System\aPkdLHe.exe
  2⤵
  PID:14716
- C:\Windows\System\TVwZVVP.exe
  C:\Windows\System\TVwZVVP.exe
  2⤵
  PID:14752
- C:\Windows\System\QHKMsqM.exe
  C:\Windows\System\QHKMsqM.exe
  2⤵
  PID:14776
- C:\Windows\System\LUYrPwe.exe
  C:\Windows\System\LUYrPwe.exe
  2⤵
  PID:14808
- C:\Windows\System\BLswAvV.exe
  C:\Windows\System\BLswAvV.exe
  2⤵
  PID:14840
- C:\Windows\System\aIsuSEm.exe
  C:\Windows\System\aIsuSEm.exe
  2⤵
  PID:14876
- C:\Windows\System\qpgPuZZ.exe
  C:\Windows\System\qpgPuZZ.exe
  2⤵
  PID:14912
- C:\Windows\System\qtoOLnf.exe
  C:\Windows\System\qtoOLnf.exe
  2⤵
  PID:14940
- C:\Windows\System\sulQXmD.exe
  C:\Windows\System\sulQXmD.exe
  2⤵
  PID:14968
- C:\Windows\System\qrxYUNw.exe
  C:\Windows\System\qrxYUNw.exe
  2⤵
  PID:15008
- C:\Windows\System\Vcghxzl.exe
  C:\Windows\System\Vcghxzl.exe
  2⤵
  PID:15040
- C:\Windows\System\NSlJMfi.exe
  C:\Windows\System\NSlJMfi.exe
  2⤵
  PID:15064
- C:\Windows\System\PxVtDdM.exe
  C:\Windows\System\PxVtDdM.exe
  2⤵
  PID:15084
- C:\Windows\System\cMKlgNc.exe
  C:\Windows\System\cMKlgNc.exe
  2⤵
  PID:15108
- C:\Windows\System\jPVwojg.exe
  C:\Windows\System\jPVwojg.exe
  2⤵
  PID:15132
- C:\Windows\System\JAVbRWU.exe
  C:\Windows\System\JAVbRWU.exe
  2⤵
  PID:15164
- C:\Windows\System\UkultUv.exe
  C:\Windows\System\UkultUv.exe
  2⤵
  PID:15184
- C:\Windows\System\YPmODMI.exe
  C:\Windows\System\YPmODMI.exe
  2⤵
  PID:15204
- C:\Windows\System\kwauuqv.exe
  C:\Windows\System\kwauuqv.exe
  2⤵
  PID:15244
- C:\Windows\System\YBtUuFP.exe
  C:\Windows\System\YBtUuFP.exe
  2⤵
  PID:15272
- C:\Windows\System\GGjyUDr.exe
  C:\Windows\System\GGjyUDr.exe
  2⤵
  PID:15300
- C:\Windows\System\zKmemrz.exe
  C:\Windows\System\zKmemrz.exe
  2⤵
  PID:15324
- C:\Windows\System\EDFUErd.exe
  C:\Windows\System\EDFUErd.exe
  2⤵
  PID:15348
- C:\Windows\System\UxaoOFI.exe
  C:\Windows\System\UxaoOFI.exe
  2⤵
  PID:14104
- C:\Windows\System\oKkEiJu.exe
  C:\Windows\System\oKkEiJu.exe
  2⤵
  PID:14428
- C:\Windows\System\BAsDMBM.exe
  C:\Windows\System\BAsDMBM.exe
  2⤵
  PID:14372
- C:\Windows\System\ahSrKXJ.exe
  C:\Windows\System\ahSrKXJ.exe
  2⤵
  PID:14492
- C:\Windows\System\ChCyVLO.exe
  C:\Windows\System\ChCyVLO.exe
  2⤵
  PID:14456
- C:\Windows\System\XjdolzQ.exe
  C:\Windows\System\XjdolzQ.exe
  2⤵
  PID:14172
- C:\Windows\System\DEPugNp.exe
  C:\Windows\System\DEPugNp.exe
  2⤵
  PID:14200
- C:\Windows\System\heQpnIy.exe
  C:\Windows\System\heQpnIy.exe
  2⤵
  PID:14624
- C:\Windows\System\QtooNxG.exe
  C:\Windows\System\QtooNxG.exe
  2⤵
  PID:14684
- C:\Windows\System\CuJNeRJ.exe
  C:\Windows\System\CuJNeRJ.exe
  2⤵
  PID:14764
- C:\Windows\System\dOtcIVf.exe
  C:\Windows\System\dOtcIVf.exe
  2⤵
  PID:14804
- C:\Windows\System\ekIEpPP.exe
  C:\Windows\System\ekIEpPP.exe
  2⤵
  PID:14992
- C:\Windows\System\AIxYwwf.exe
  C:\Windows\System\AIxYwwf.exe
  2⤵
  PID:14976
- C:\Windows\System\EGGZWPg.exe
  C:\Windows\System\EGGZWPg.exe
  2⤵
  PID:14996
- C:\Windows\System\XbFqDQQ.exe
  C:\Windows\System\XbFqDQQ.exe
  2⤵
  PID:15144
- C:\Windows\System\JvtqJrZ.exe
  C:\Windows\System\JvtqJrZ.exe
  2⤵
  PID:15176
- C:\Windows\System\OFatvak.exe
  C:\Windows\System\OFatvak.exe
  2⤵
  PID:15212
- C:\Windows\System\zlQwzuu.exe
  C:\Windows\System\zlQwzuu.exe
  2⤵
  PID:15336
- C:\Windows\System\ujZMzfo.exe
  C:\Windows\System\ujZMzfo.exe
  2⤵
  PID:13888
- C:\Windows\System\tgYIoLf.exe
  C:\Windows\System\tgYIoLf.exe
  2⤵
  PID:14424
- C:\Windows\System\MMReRIF.exe
  C:\Windows\System\MMReRIF.exe
  2⤵
  PID:14544
- C:\Windows\System\kswygjs.exe
  C:\Windows\System\kswygjs.exe
  2⤵
  PID:14712
- C:\Windows\System\wssWHUH.exe
  C:\Windows\System\wssWHUH.exe
  2⤵
  PID:14864
- C:\Windows\System\AAlpMcF.exe
  C:\Windows\System\AAlpMcF.exe
  2⤵
  PID:15152
- C:\Windows\System\ZtShAgg.exe
  C:\Windows\System\ZtShAgg.exe
  2⤵
  PID:15080
- C:\Windows\System\GKxORKg.exe
  C:\Windows\System\GKxORKg.exe
  2⤵
  PID:14376
- C:\Windows\System\mXyzcuv.exe
  C:\Windows\System\mXyzcuv.exe
  2⤵
  PID:15076
- C:\Windows\System\qWdvDuF.exe
  C:\Windows\System\qWdvDuF.exe
  2⤵
  PID:13904
- C:\Windows\System\yCzErvu.exe
  C:\Windows\System\yCzErvu.exe
  2⤵
  PID:14540
- C:\Windows\System\sdFUoeX.exe
  C:\Windows\System\sdFUoeX.exe
  2⤵
  PID:15364
- C:\Windows\System\zWXdpje.exe
  C:\Windows\System\zWXdpje.exe
  2⤵
  PID:15404
- C:\Windows\System\lHPMFey.exe
  C:\Windows\System\lHPMFey.exe
  2⤵
  PID:15428
- C:\Windows\System\VmGEjDp.exe
  C:\Windows\System\VmGEjDp.exe
  2⤵
  PID:15460
- C:\Windows\System\HUytiCa.exe
  C:\Windows\System\HUytiCa.exe
  2⤵
  PID:15488
- C:\Windows\System\CzfpixK.exe
  C:\Windows\System\CzfpixK.exe
  2⤵
  PID:15512
- C:\Windows\System\wlUXVKD.exe
  C:\Windows\System\wlUXVKD.exe
  2⤵
  PID:15540
- C:\Windows\System\fRTwHIn.exe
  C:\Windows\System\fRTwHIn.exe
  2⤵
  PID:15568
- C:\Windows\System\UdwwEpF.exe
  C:\Windows\System\UdwwEpF.exe
  2⤵
  PID:15592
- C:\Windows\System\ytBcNXU.exe
  C:\Windows\System\ytBcNXU.exe
  2⤵
  PID:15628
- C:\Windows\System\DoNUPoh.exe
  C:\Windows\System\DoNUPoh.exe
  2⤵
  PID:15656
- C:\Windows\System\TEGfbXk.exe
  C:\Windows\System\TEGfbXk.exe
  2⤵
  PID:15692
- C:\Windows\System\KHeTIwx.exe
  C:\Windows\System\KHeTIwx.exe
  2⤵
  PID:15720
- C:\Windows\System\hsWlisU.exe
  C:\Windows\System\hsWlisU.exe
  2⤵
  PID:15756
- C:\Windows\System\juPmvxy.exe
  C:\Windows\System\juPmvxy.exe
  2⤵
  PID:15784
- C:\Windows\System\dNNDfyB.exe
  C:\Windows\System\dNNDfyB.exe
  2⤵
  PID:15812
- C:\Windows\System\ZCFNldS.exe
  C:\Windows\System\ZCFNldS.exe
  2⤵
  PID:15844
- C:\Windows\System\JJOaXUX.exe
  C:\Windows\System\JJOaXUX.exe
  2⤵
  PID:15872
- C:\Windows\System\ugMCmqk.exe
  C:\Windows\System\ugMCmqk.exe
  2⤵
  PID:15904
- C:\Windows\System\RPWPpAp.exe
  C:\Windows\System\RPWPpAp.exe
  2⤵
  PID:15932
- C:\Windows\System\jWPbjqY.exe
  C:\Windows\System\jWPbjqY.exe
  2⤵
  PID:15956
- C:\Windows\System\zQDmTrp.exe
  C:\Windows\System\zQDmTrp.exe
  2⤵
  PID:15980
- C:\Windows\System\bvXonYj.exe
  C:\Windows\System\bvXonYj.exe
  2⤵
  PID:16004
- C:\Windows\System\DcUWhjN.exe
  C:\Windows\System\DcUWhjN.exe
  2⤵
  PID:16148
- C:\Windows\System\ExgeWrg.exe
  C:\Windows\System\ExgeWrg.exe
  2⤵
  PID:16164
- C:\Windows\System\BkgHlzO.exe
  C:\Windows\System\BkgHlzO.exe
  2⤵
  PID:16192
- C:\Windows\System\TlKGIBx.exe
  C:\Windows\System\TlKGIBx.exe
  2⤵
  PID:16212
- C:\Windows\System\YSZjiNy.exe
  C:\Windows\System\YSZjiNy.exe
  2⤵
  PID:16236
- C:\Windows\System\yvdPLEF.exe
  C:\Windows\System\yvdPLEF.exe
  2⤵
  PID:16264
- C:\Windows\System\yXuQroZ.exe
  C:\Windows\System\yXuQroZ.exe
  2⤵
  PID:16284
- C:\Windows\System\pQXtSNj.exe
  C:\Windows\System\pQXtSNj.exe
  2⤵
  PID:16312
- C:\Windows\System\aohfFNI.exe
  C:\Windows\System\aohfFNI.exe
  2⤵
  PID:16344
- C:\Windows\System\tcKmjYH.exe
  C:\Windows\System\tcKmjYH.exe
  2⤵
  PID:16364
- C:\Windows\System\rCrCyeE.exe
  C:\Windows\System\rCrCyeE.exe
  2⤵
  PID:15232
- C:\Windows\System\WNIqRTe.exe
  C:\Windows\System\WNIqRTe.exe
  2⤵
  PID:14852
- C:\Windows\System\nnalTCT.exe
  C:\Windows\System\nnalTCT.exe
  2⤵
  PID:14452
- C:\Windows\System\yGvIPgS.exe
  C:\Windows\System\yGvIPgS.exe
  2⤵
  PID:15536
- C:\Windows\System\gdLSUYt.exe
  C:\Windows\System\gdLSUYt.exe
  2⤵
  PID:1600
- C:\Windows\System\JrMvmnE.exe
  C:\Windows\System\JrMvmnE.exe
  2⤵
  PID:15468
- C:\Windows\System\fBBTiuM.exe
  C:\Windows\System\fBBTiuM.exe
  2⤵
  PID:15584
- C:\Windows\System\FSmlegU.exe
  C:\Windows\System\FSmlegU.exe
  2⤵
  PID:15612
- C:\Windows\System\HPnkviz.exe
  C:\Windows\System\HPnkviz.exe
  2⤵
  PID:15752
- C:\Windows\System\BqYWyEQ.exe
  C:\Windows\System\BqYWyEQ.exe
  2⤵
  PID:15800
- C:\Windows\System\QbdBGue.exe
  C:\Windows\System\QbdBGue.exe
  2⤵
  PID:15860
- C:\Windows\System\fCeheKg.exe
  C:\Windows\System\fCeheKg.exe
  2⤵
  PID:15900
- C:\Windows\System\dEylMMa.exe
  C:\Windows\System\dEylMMa.exe
  2⤵
  PID:15976
- C:\Windows\System\uJjWCJM.exe
  C:\Windows\System\uJjWCJM.exe
  2⤵
  PID:16020
- C:\Windows\System\VTyAdMg.exe
  C:\Windows\System\VTyAdMg.exe
  2⤵
  PID:16128
- C:\Windows\System\QbdjpRC.exe
  C:\Windows\System\QbdjpRC.exe
  2⤵
  PID:16200
- C:\Windows\System\ZsKsnZE.exe
  C:\Windows\System\ZsKsnZE.exe
  2⤵
  PID:16280
- C:\Windows\System\mpLKEUK.exe
  C:\Windows\System\mpLKEUK.exe
  2⤵
  PID:16320
- C:\Windows\System\LrHtxoO.exe
  C:\Windows\System\LrHtxoO.exe
  2⤵
  PID:16332
- C:\Windows\System\FuymjYo.exe
  C:\Windows\System\FuymjYo.exe
  2⤵
  PID:15344
- C:\Windows\System\WNLaSEC.exe
  C:\Windows\System\WNLaSEC.exe
  2⤵
  PID:15380
- C:\Windows\System\yvCWCFN.exe
  C:\Windows\System\yvCWCFN.exe
  2⤵
  PID:15552
- C:\Windows\System\gpOZMpP.exe
  C:\Windows\System\gpOZMpP.exe
  2⤵
  PID:15688
- C:\Windows\System\IYKdyJI.exe
  C:\Windows\System\IYKdyJI.exe
  2⤵
  PID:15704
- C:\Windows\System\lLcxOiX.exe
  C:\Windows\System\lLcxOiX.exe
  2⤵
  PID:15924
- C:\Windows\System\cEybMtf.exe
  C:\Windows\System\cEybMtf.exe
  2⤵
  PID:16256
- C:\Windows\System\IesGjet.exe
  C:\Windows\System\IesGjet.exe
  2⤵
  PID:16296
- C:\Windows\System\mYqyiOa.exe
  C:\Windows\System\mYqyiOa.exe
  2⤵
  PID:16356
- C:\Windows\System\VyIaSuv.exe
  C:\Windows\System\VyIaSuv.exe
  2⤵
  PID:15484
- C:\Windows\System\bMPrsNX.exe
  C:\Windows\System\bMPrsNX.exe
  2⤵
  PID:15604
- C:\Windows\System\guPajFo.exe
  C:\Windows\System\guPajFo.exe
  2⤵
  PID:15472
- C:\Windows\System\bNxpUah.exe
  C:\Windows\System\bNxpUah.exe
  2⤵
  PID:15400
- C:\Windows\System\NDDUcoX.exe
  C:\Windows\System\NDDUcoX.exe
  2⤵
  PID:16400
- C:\Windows\System\nIBEQuy.exe
  C:\Windows\System\nIBEQuy.exe
  2⤵
  PID:16420
- C:\Windows\System\PEOwfhE.exe
  C:\Windows\System\PEOwfhE.exe
  2⤵
  PID:16456
- C:\Windows\System\pdWJnUH.exe
  C:\Windows\System\pdWJnUH.exe
  2⤵
  PID:16476
- C:\Windows\System\lBObbOT.exe
  C:\Windows\System\lBObbOT.exe
  2⤵
  PID:16500
- C:\Windows\System\dHtuRrJ.exe
  C:\Windows\System\dHtuRrJ.exe
  2⤵
  PID:16524
- C:\Windows\System\xpRLiQs.exe
  C:\Windows\System\xpRLiQs.exe
  2⤵
  PID:16544
- C:\Windows\System\kMgzBnd.exe
  C:\Windows\System\kMgzBnd.exe
  2⤵
  PID:16560
- C:\Windows\System\yWaqiXA.exe
  C:\Windows\System\yWaqiXA.exe
  2⤵
  PID:16588
- C:\Windows\System\HtxiXSQ.exe
  C:\Windows\System\HtxiXSQ.exe
  2⤵
  PID:16620
- C:\Windows\System\wFIFhKf.exe
  C:\Windows\System\wFIFhKf.exe
  2⤵
  PID:16660
- C:\Windows\System\ySBdbSk.exe
  C:\Windows\System\ySBdbSk.exe
  2⤵
  PID:16676
- C:\Windows\System\CuoMlTP.exe
  C:\Windows\System\CuoMlTP.exe
  2⤵
  PID:16708
- C:\Windows\System\cOrNmfN.exe
  C:\Windows\System\cOrNmfN.exe
  2⤵
  PID:16728
- C:\Windows\System\mFWHAIf.exe
  C:\Windows\System\mFWHAIf.exe
  2⤵
  PID:16756
- C:\Windows\System\VGBnhya.exe
  C:\Windows\System\VGBnhya.exe
  2⤵
  PID:16780
- C:\Windows\System\qOqknDn.exe
  C:\Windows\System\qOqknDn.exe
  2⤵
  PID:16816
- C:\Windows\System\Ihbkfng.exe
  C:\Windows\System\Ihbkfng.exe
  2⤵
  PID:16848
- C:\Windows\System\tWaCaHX.exe
  C:\Windows\System\tWaCaHX.exe
  2⤵
  PID:16880
- C:\Windows\System\ZlCiXmz.exe
  C:\Windows\System\ZlCiXmz.exe
  2⤵
  PID:16904
- C:\Windows\System\ynMojeY.exe
  C:\Windows\System\ynMojeY.exe
  2⤵
  PID:16944
- C:\Windows\System\KjFVsjl.exe
  C:\Windows\System\KjFVsjl.exe
  2⤵
  PID:16976
- C:\Windows\System\ZxXzfZe.exe
  C:\Windows\System\ZxXzfZe.exe
  2⤵
  PID:17000
- C:\Windows\System\PSBscjo.exe
  C:\Windows\System\PSBscjo.exe
  2⤵
  PID:17020
- C:\Windows\System\axBbWop.exe
  C:\Windows\System\axBbWop.exe
  2⤵
  PID:17056
- C:\Windows\System\iOTZIck.exe
  C:\Windows\System\iOTZIck.exe
  2⤵
  PID:17076
- C:\Windows\System\ANNJSro.exe
  C:\Windows\System\ANNJSro.exe
  2⤵
  PID:17092
- C:\Windows\System\ApsFqJm.exe
  C:\Windows\System\ApsFqJm.exe
  2⤵
  PID:17108
- C:\Windows\System\PWTNrAl.exe
  C:\Windows\System\PWTNrAl.exe
  2⤵
  PID:17136
- C:\Windows\System\uAatUsI.exe
  C:\Windows\System\uAatUsI.exe
  2⤵
  PID:17160
- C:\Windows\System\AKxGmtf.exe
  C:\Windows\System\AKxGmtf.exe
  2⤵
  PID:17176
- C:\Windows\System\NenYVkY.exe
  C:\Windows\System\NenYVkY.exe
  2⤵
  PID:17196
- C:\Windows\System\zqxMtBS.exe
  C:\Windows\System\zqxMtBS.exe
  2⤵
  PID:17220
- C:\Windows\System\aZcsrzN.exe
  C:\Windows\System\aZcsrzN.exe
  2⤵
  PID:17244
- C:\Windows\System\PlFMfxn.exe
  C:\Windows\System\PlFMfxn.exe
  2⤵
  PID:17268
- C:\Windows\System\PxjDxtB.exe
  C:\Windows\System\PxjDxtB.exe
  2⤵
  PID:17292
- C:\Windows\System\DUlolrY.exe
  C:\Windows\System\DUlolrY.exe
  2⤵
  PID:17320
- C:\Windows\System\ZGQYCuH.exe
  C:\Windows\System\ZGQYCuH.exe
  2⤵
  PID:17352
- C:\Windows\System\nElIIPX.exe
  C:\Windows\System\nElIIPX.exe
  2⤵
  PID:17388
- C:\Windows\System\oiSjjXd.exe
  C:\Windows\System\oiSjjXd.exe
  2⤵
  PID:16388
- C:\Windows\System\kQYJVvV.exe
  C:\Windows\System\kQYJVvV.exe
  2⤵
  PID:16596
- C:\Windows\System\gAUtSkA.exe
  C:\Windows\System\gAUtSkA.exe
  2⤵
  PID:16648
- C:\Windows\System\LoqssHJ.exe
  C:\Windows\System\LoqssHJ.exe
  2⤵
  PID:16916

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AxxJivs.exe

Filesize
1.9MB

MD5
0e6b4c338196e6b0f77ca69ebdef0b62

SHA1
48fa08f98ef7f81caa04b9ff508e10e83add43fb

SHA256
4dc81542050decf99918dede21cd34da5d0a7a410123edc8ba2b4251d3ddd856

SHA512
32ed88cca00aa68e68ff6136a981250157ce8f7313037b68f8e5fd0d3ebeacc2c589a4493a34dcf2acb79815d3d2d6bcc9a99f06447bfb2b5dda6e77dea8fd86

Download Submit
C:\Windows\System\CgKUKij.exe

Filesize
1.9MB

MD5
6eb954d162589da7b2c80130d55b58a8

SHA1
6318b8a6a5e4c1b9777a63681f658b0e1e5c1f39

SHA256
1fa6a781c8ba002aff4b222f7c00ff259849f916adb8be9a3a8e11be97b3fd88

SHA512
9791d477e558e55642a8d01dc8301a2300afee4794f9d9050dac81f4d125645de7a293b78e33beb52a6a3529ddc8b5d2816ccc69725499941fc6dad06e9610f4

Download Submit
C:\Windows\System\CnkeUOP.exe

Filesize
1.9MB

MD5
98c40b285325998672254448b171aa51

SHA1
57dcba914aed2403cd5e3aafb4f817308665937a

SHA256
4e24c2b457e2e0957bc5fb39d5f52ba570499b10f5468befc10614911791ab21

SHA512
8cc3265f032a0e96d89c1b54d0930c811566c9d41012f100f83fda14e21beee6a4e9bb81b3dfac3a9d1b8f04132d17c0711b3624a14eae1d10a10c4315f828a7

Download Submit
C:\Windows\System\GwtIdMg.exe

Filesize
1.9MB

MD5
92b387ee8178cfb6c1098a6f8b3f41e0

SHA1
c3530d33b973214e5c6ca5bc3a5e4580427d9379

SHA256
47adb944a37a1e16f5b02760257ec4e3bab9fb9b544a17dfdd49b25ae54b2d37

SHA512
82a53ac85fb982e80bf32e8dc23c9c80ed0154217f8b378005f1570aaad53b1abfa29c4dee45fffc976ccc5fe40877646b2fc642f16a5539e8d8d5816bb7027c

Download Submit
C:\Windows\System\HBGnzHS.exe

Filesize
1.9MB

MD5
7e7dfd64b1d96039b7f2576b6755de38

SHA1
554a8f713219e9c8c786255edf55c73145945a1e

SHA256
d756baadbf9c30c969c62b8240fa2ef5889ab368472b26f0fa8e7bfc7dc31b6b

SHA512
99aeeb04f583b232791056c2525b6ac0a1e002dd5eec014b08d8751d27447ff347229d0a862f7fd800b85acd9c552728ac1f6c8a5bb9d990e7726cf2dd34bcac

Download Submit
C:\Windows\System\HPHjgiJ.exe

Filesize
1.9MB

MD5
358fa58073bb842b3b35d0078e1be4a6

SHA1
4dd141ccb943722e5f46ccb0dbbbd8f2eeb0cac9

SHA256
6ba155bc77c92f0469c39e386f2cf03bdd8c4acbef77646a5dd7f744d9ba5d39

SHA512
7c2b11724ea21b79519a9a831155d3a6554a19871797980cc07d509102b980f4b4b28ea51ef37aec79208cd0bdce736d57fafa9b356a79d11f117dcce88fdb6b

Download Submit
C:\Windows\System\HvoEvvH.exe

Filesize
1.9MB

MD5
98f30d51f1231d7ec1a841b9c8f62827

SHA1
7cbdbf1ce22f484238a685daca9b9d3104211a76

SHA256
277b5109b177524a24156d58135e28ef8c25a980d09800e4b256b0acff76356f

SHA512
9b4ee8e09e001d09e09ae21f4dc96cfac73f933be9b5a7eb285a710f42f839eaba221d89ce89a8c7a6105ad2f8d49d46e496280081aa554171dc684c2002703b

Download Submit
C:\Windows\System\IKsNheX.exe

Filesize
1.9MB

MD5
5c4a02d4440088d315966a604a970d1e

SHA1
c4e128cb846febb76d4f5366c54027e7b20be0e1

SHA256
38e5bbe09e73a4a640a29d4d59068cd7e95c718807437b5bac6a805bccf8196e

SHA512
876040140db0a6543392b15f047a651a252c03ddc4c79c2ddef7d9c260a7a72b63c44a28d4dec70a75e1f535ecdfd37d81c7f2e7358b1fd691b7cd7451738238

Download Submit
C:\Windows\System\JtDufBa.exe

Filesize
1.9MB

MD5
3f339ffa0da700313427c066baa1be3d

SHA1
b8df4d034d2642988da9eecf57fabc9ac8634c01

SHA256
b0f54f02b2cb63c0044657cbb57fecba62ebbb797573cd5fed79385026691f94

SHA512
a478ea0644646d4e4c45f287a931d12ba45f7c727deefd3e8f8f350cea10dd0a87acdff0a31dd92f321b83a028771257b579036a7b607fe24e87bf4d2a10b3e2

Download Submit
C:\Windows\System\MhCWELV.exe

Filesize
1.9MB

MD5
6a2c5556412a4dd6c6280b99d8fccf3a

SHA1
74255757af095c1b0b5dd3e0ea142592e91432f0

SHA256
d7c675257c3d5e88d5e961e62715b7eee5a12b83225374f022cf9b265211e384

SHA512
793a02992eccca2c3e01a7caa76f824656c05e1e8883d49f15668d5cf020f954a8eaaaf0ad32e9cca75d31084363ebd204f4e6d928ff3b1a55ad5a620e73e840

Download Submit
C:\Windows\System\MpRlmLe.exe

Filesize
1.9MB

MD5
c69e945582e066fe99132e1d855d1a74

SHA1
1232c88123da01f86c81bd0f969b83de771214bb

SHA256
e297eb3dd33f400e5f699248fed06fea3997315f9fe6545b285ff15216a96993

SHA512
b0026c3b2f9faccfddc2783c3917b9897e3a8fdb2a7241848f267d491cf8cd1cb4fec14dde4622956722b92b5f3b3b2fcdaf011bde8b0098c94eae94ce5093d2

Download Submit
C:\Windows\System\OKOvHZs.exe

Filesize
1.9MB

MD5
ff15adf4f5b1ee4d4f6b5f8db585593d

SHA1
9d72eca7cc318dcb53b329756d4ad31a5b482e0c

SHA256
be25d01f15941b11f1eac238977640e4fdc54c6f913abe7d631e72459c5ef751

SHA512
71309066dae61da708d93385474b865a9416bc19857deed18319eafd34d6c9e60e2774b167959f455826b33497c72cb1d4144224c538ca345676993842661be6

Download Submit
C:\Windows\System\OOMYZYA.exe

Filesize
1.9MB

MD5
74981276dca0a077f6aa1727c41e064a

SHA1
c9e09d6f5ce97d8787240d0648b61fe4278aa32e

SHA256
04581f9bc80cd93b8631a827f0bc323df2f677b912e80cb3d4bc4c94813f013a

SHA512
570673faef26df579f3bb8d3edfc0a38492acd552585aea2d2d4e7a8fade455715df243e4dd85bde69f65a1d3e0b4f8637f370a20c167ed39131898a431e7b6d

Download Submit
C:\Windows\System\OzObDNN.exe

Filesize
1.9MB

MD5
7e5046d73a622bc49356b68dc4e1f731

SHA1
2b8c0a3110c2316799b14fe34675f7750e002178

SHA256
e665c377eb7e25841b9214d1c8632f3ebd1cd672e082190e9106a5d8233c482e

SHA512
5402aca91fee786f7c3a1d8d04a76feed2ad2186d90abb9290d9f488f181c593247cdd58dd0da9996c54680de666f8d0ddd56a3a32cbb70efde3571428e11f43

Download Submit
C:\Windows\System\PiLrCHC.exe

Filesize
1.9MB

MD5
82f5a5e3c21d23524591f5074ac353d9

SHA1
09a8fd42f3dab9519d908507d68f9760b60bf68f

SHA256
3b4700db142ba4328b996fa20180de1dc3f4eeadec18d5df2177b34e9fb0411c

SHA512
d668882525103f60d5751c45fc31e6f3661cc2341be1aed0dc11ad5bba70c78d84df731cb358ffca27940a9c38792599fbf12b15f8c4780c52901e45575b6016

Download Submit
C:\Windows\System\QfoQpRG.exe

Filesize
1.9MB

MD5
93835405bdc0c54ad89f32efa637ea71

SHA1
6daef159010b2a4e6ecce06551d68b9fddb90e54

SHA256
a42d1b7c56a5835a70745d76513ad1059790326beb4c8413eec81ed12a52475b

SHA512
ee231445a187bb3a5c9162815f47c3108572c4608fe94fc4d8df4a0c494e3e4799d8e808ea219e7da99301ee419c3bd5975667df2a51573c3079ba42721a1781

Download Submit
C:\Windows\System\SUwndzC.exe

Filesize
1.9MB

MD5
5195c9fffcd2d055c9dec49b29ad5f75

SHA1
f74eea3abc4c79958d94022d746fc6d7689198a1

SHA256
891b68c7eb0fbfb66880109a403e15d55d883175951a8d7d436256a48103a67f

SHA512
f331105c1e46efd0d10316933a80645ca5172b594ed8ada7f3868d64dfdca2e8a56037d0bc04f98fcb2f6ab8a66ee3d8dcb6d53943695bf88a174aece944e196

Download Submit
C:\Windows\System\WuDqINP.exe

Filesize
1.9MB

MD5
16da7ff36367cc3fcf915b8718c56217

SHA1
337cced626e5a84f5c8d4951f4d43e85d41c37aa

SHA256
6d40165bbaa6e137d7a28454e6459f8cdf0c776503d12c340db460a782945f51

SHA512
85b51b5b17d7994065136672afaec0c8a6e252651927e0c2bdeaeb19f74163f4a0fb59d50b9dbaa54eb01725fcb57e480c87bfa37fc3fcd281808bf7321228f9

Download Submit
C:\Windows\System\baTExEH.exe

Filesize
1.9MB

MD5
9c545533217cb31b86884e130352b117

SHA1
ae20f385045feee7961cfbbaf3d68256f15a7c1c

SHA256
90d6f873e0c5ee01d9275cfeae9dd8d3ae64b1b7458a489bc5241177887bdd98

SHA512
d4125802b50163e10d17878c00a0236ec9f9cffd5738f78990e13e2197e92e431788fbc0f1aa27a23aa80ed44841ac2b425ea51bf8117775dbae1f93a2e12f5b

Download Submit
C:\Windows\System\dXDzrRx.exe

Filesize
1.9MB

MD5
5363346bf1095fcd375718ca57bcc70a

SHA1
a014a2489f9221c13b483cdc637ebf525c994b99

SHA256
02759f7ae5da01a92c66eca7cb9b7848fb020cb479deaba8212d005bf5a00925

SHA512
37a5adf5e9e67c0b3dcb73728382f45e4edc42e130a5e479f73e61d54fa312e00aa6edf7be1d72a815e8a368e86b8218a1ae28d9e6bb92af4cb68ccfa197777d

Download Submit
C:\Windows\System\fQEJaGW.exe

Filesize
1.9MB

MD5
d53328e7d6ef90068147d2600d0759f3

SHA1
acad1ebd053aee70f64a3cbf19dc8e436f159fae

SHA256
469f6a47b1b7be14ccd36c0f9f308e5d96fa47b4a28b57aefb28b6fbecea9a53

SHA512
8e595adfa0da1e80074286f40b23ef2733f9645d74fc5bdbfdcbbdd37feee94fb7f42147dbb9d2eb307c11560a7bbf7531b0e7042036f4200ee287ade3dd0f76

Download Submit
C:\Windows\System\hFhQwED.exe

Filesize
1.9MB

MD5
8a1db649615533f70d8825c09d69ff78

SHA1
afb0253e0626196debb7008e87994adc20aa60d8

SHA256
d4b00691b2d5db4439f15b1f77af8d7d2c2080c7134e1cc273ea85b1c93342ac

SHA512
69b349280103a6d869bebe3f5477396fc8fd7f2c498d5e6a3c5bc0fe22f839a9fcbcf632f9d09d624005515bebfeb792d7b61e4ab5e30b3acc0fca278150e71f

Download Submit
C:\Windows\System\iVYWOFm.exe

Filesize
1.9MB

MD5
6d965a2c1af0f41ae54954a4bdb1f4e0

SHA1
213a9f1a2fddade796199e460f9b6eeeef2a5c06

SHA256
e73ceb1a2f2aac8e7ce1202b18253b9485186def804419dd1c235a4777bc32f2

SHA512
3aa45b29077353420781fcbf50f7cea35c1f9f93d015fa915c42a58e873dd9c8358f2386ec9b2c60ad2613112889e2c6fbc0ff4b5c8d5a4fe693863700717896

Download Submit
C:\Windows\System\lymWAKZ.exe

Filesize
1.9MB

MD5
762947e87adde3d8a4992d295614a59e

SHA1
3ab5ec62ce3fbd24cbc15ed52e7a78f0fe38e911

SHA256
0d22949fa46e14bb338e6e2bb6f094063e663463a9898925360a2127b469654c

SHA512
4134fe5d64ca48082c4adea5aaff0dc2ca2d2509d8f1f0e55bae5b8defcde86ccb5f0c5c99e377b664b524301109b468852fc511640078c1523da0c113b99e5f

Download Submit
C:\Windows\System\mXhLkGo.exe

Filesize
1.9MB

MD5
0b6071d564a80efd632b511d399b47a4

SHA1
6a254e99dfc93b9f4369f3800afb77b769b69ccf

SHA256
f9e4ce68e4c24f851f817114e323e290b20922abda3d54da7363ce4e05ea9d5a

SHA512
6ab24f1b190d33f5fbfc9608d56c2b40df6a1d96673ebfcb958ec190e1b10bb42a506d94948c6ba8f22f4455cfff3d6483926856cb37d0ca4b8f01edc1e882cb

Download Submit
C:\Windows\System\oKmAjfq.exe

Filesize
1.9MB

MD5
50a00469c497101bd9dd9819220291f0

SHA1
8b220a1a20abef99078ddb8f4ffe2405f65b768c

SHA256
dec57080bc156c199675d053f0b7ab2fd40f30dc51ea7d89eb563c829eb69ecc

SHA512
9dfcb46f3ffff5730fd604f1b04dcbbcf0eb98be96852412a1b1b897d9a5ce7ddceffede6a980da09bc7616cbd86a3f728536105f7a4bdbb3234287841d01ee7

Download Submit
C:\Windows\System\pVkwEZI.exe

Filesize
1.9MB

MD5
93f60dcee039df5d2f87bb210f1cbe7c

SHA1
2e7141c48b88df856ae0cdcff1047d3fabffc7bb

SHA256
85100266e723fab042db346a7b66db61aded6b7b9b56ebb7da6b984adeba121a

SHA512
5967d684a9b6941f039d418116052cd81de1be51079131b6600a596c29905224cc9442204f47f8dc41b48e149b0fcfe22c08fa4c9b51ceb673709d360d7d9bd9

Download Submit
C:\Windows\System\pgYrhyr.exe

Filesize
1.9MB

MD5
89bcb00ae749d80c6174753f424ed593

SHA1
e6a1b25c3a1929c35ac046698ed5dbe4627abec3

SHA256
f496e552000179cf7ca3cedcfa59659c240efee935206d16e1482460d0b357c1

SHA512
f2089c4cc1810f80b4077641bab2e0a3bc1971aa4550cd2f65697fad480c43d6ef0e8b0daa856678237b46bb17adc83746c960394d45ea9a1889e4fd50dc79ff

Download Submit
C:\Windows\System\rmlJCxX.exe

Filesize
1.9MB

MD5
deb4d2076a40d07be1210e9295039b79

SHA1
ba87e76ec90976d2338b53d9b1ed95ab601551dc

SHA256
5b66b8c86a81551028e489fadb521c9fc2af5291a7b03737af983114e946958d

SHA512
b102ddd332f7cc85226ae65abcaabfbf32846ff64b4f6ea61f32fa29dbb6ed2b0e090afa6e7a7f51f20bd71b645f84b3fe49e1bca449d4f25db007c4c707f65c

Download Submit
C:\Windows\System\teeEsKO.exe

Filesize
1.9MB

MD5
e6e0ac9f15de338797ecc992f6915fe4

SHA1
cfd38589efbaee4ad06254510e4a25201416700c

SHA256
ec8e291129843dfe69b3947cfaf7ae8918d4061fee46cac4d510b37504022da1

SHA512
1fab69afc8e73b5ed222ddf67557453d2a1730c947201d2fb092ff14bd27605f7fd5a7730b557400ca2aae50628c2e2188613ad3c8c5d6aa5c7704756196b941

Download Submit
C:\Windows\System\uHCyGAo.exe

Filesize
1.9MB

MD5
d815c0ab6840c834847b7b10dea2e2d0

SHA1
ec807abe9c3783464d960a5142a0f626e6f3586d

SHA256
803a6bb16245e408b4a0367612e9e1aeba593f0799dddd0e6773872abdc3a173

SHA512
5d8213f6af57eaa7ecefda33712ee32932baa5a30c827ac95da7d0255d1f1550c03494f86acda7a73bb365dd5470009dc72b849bd33f7997e1ce5591d49e65c0

Download Submit
C:\Windows\System\uJswCls.exe

Filesize
1.9MB

MD5
a71d11dfaf829acd47281a910556a593

SHA1
78b0741103e7f05b3d2bdd51f0daef08f390b191

SHA256
61e6286256822cabe3afad7764c3b0d48aa9d9b40d589d3ba829ac48b508bc9a

SHA512
21e45f7bd0289eaf3f268125d65055b348c0b46cfc0169d73d8e04e9e2da7ef902a63c674fa58ae8e7e8d20e36e2d1c9676159925b1228af49b3e36cb2c41120

Download Submit
C:\Windows\System\wnvfOgc.exe

Filesize
1.9MB

MD5
7fa9406be05a10d828e0fd18891ca6fa

SHA1
5e3bae0aba9cb55ee230102dc2e7d7eabee205bb

SHA256
22f3426c753527e7f7203459a14c7b736de0c8c13007f600378e3ee01e683780

SHA512
72e96734c2293c5be9bba6f543f5f582e6d2e20b2324b43f4a9298c5a7727ae08ab505f413f28364963b02d7b6cf96869a760af1fa3fab7361a621ecf61400c9

Download Submit
C:\Windows\System\zxWehxK.exe

Filesize
1.9MB

MD5
6ec3e7b84eb3f711a7b718303befef61

SHA1
9bd32c0712e41ded1cf28c1c9e388df54c282283

SHA256
15f98132627db7894df7fb368f9415e325c0f6edfaafdb6228769e75eef46287

SHA512
2e2e4f4a166747b7971e83e22b2731a53efcf32915333d97d496161595aaf5dc860313e96d2496f4c3d5ab510dcf5058a003504864ded4eea5d9307f2d2abeb4

Download Submit
memory/3652-0-0x0000022CC4DB0000-0x0000022CC4DC0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads