xmrig | fcb7afa87ffddc54350c7545eab797b42420cfe17dc61d8d682806123c2b1db2

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
Size

1.1MB
MD5

9e1cb674e1da8be180e5a24f49bc0120
SHA1

ba4669b17b5980cc10ccd2b78604635cc32f18c6
SHA256

fcb7afa87ffddc54350c7545eab797b42420cfe17dc61d8d682806123c2b1db2
SHA512

f9ab6b65dcc9323c716edb2f5fc30b0941ca923aceaecb89b3262b9f868adb559480dbfb3c5fc72f17cb1248750651d09b38640bf3ab64a3243f2994aaac7bc6
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5Ja5ugsz7HY9Wlkd:GezaTF8FcNkNdfE0pZ9oztFwIHT5JaoU

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000700000002327d-4.dat	xmrig
behavioral2/files/0x0007000000023439-6.dat	xmrig
behavioral2/files/0x0009000000023435-8.dat	xmrig
behavioral2/files/0x000700000002343b-23.dat	xmrig
behavioral2/files/0x000700000002343a-21.dat	xmrig
behavioral2/files/0x000700000002343c-28.dat	xmrig
behavioral2/files/0x000700000002343d-33.dat	xmrig
behavioral2/files/0x000700000002343e-40.dat	xmrig
behavioral2/files/0x000700000002343f-43.dat	xmrig
behavioral2/files/0x0007000000023443-60.dat	xmrig
behavioral2/files/0x0007000000023441-57.dat	xmrig
behavioral2/files/0x0007000000023440-50.dat	xmrig
behavioral2/files/0x0007000000023444-64.dat	xmrig
behavioral2/files/0x0007000000023445-71.dat	xmrig
behavioral2/files/0x0008000000023436-74.dat	xmrig
behavioral2/files/0x0007000000023446-79.dat	xmrig
behavioral2/files/0x0007000000023448-90.dat	xmrig
behavioral2/files/0x0007000000023447-85.dat	xmrig
behavioral2/files/0x0007000000023449-94.dat	xmrig
behavioral2/files/0x000700000002344c-102.dat	xmrig
behavioral2/files/0x000700000002344b-103.dat	xmrig
behavioral2/files/0x000700000002344d-109.dat	xmrig
behavioral2/files/0x000700000002344e-114.dat	xmrig
behavioral2/files/0x000700000002344f-119.dat	xmrig
behavioral2/files/0x0007000000023451-132.dat	xmrig
behavioral2/files/0x0007000000023450-133.dat	xmrig
behavioral2/files/0x0002000000022fcb-126.dat	xmrig
behavioral2/files/0x0007000000023452-139.dat	xmrig
behavioral2/files/0x0007000000023453-145.dat	xmrig
behavioral2/files/0x0007000000023455-159.dat	xmrig
behavioral2/files/0x0007000000023456-162.dat	xmrig
behavioral2/files/0x0007000000023454-157.dat	xmrig
behavioral2/files/0x0002000000022fc9-153.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2936	KOhInXj.exe
3068	JNeAwFi.exe
1244	uxTILXC.exe
4028	ZmfUCLY.exe
3144	xKlRhyl.exe
4156	ONEcnIN.exe
3272	fJHiQeh.exe
4732	PEGtaYr.exe
1780	mCEpnnz.exe
5036	vNIMOGk.exe
4576	FbSDrXR.exe
2380	SNxolJm.exe
5024	gyhKXik.exe
1552	UTKQJDa.exe
3132	aTLmhlV.exe
2796	tTYEpKr.exe
3652	nXhMKFH.exe
3060	eGkBVWc.exe
3672	cVmJerF.exe
636	NNBgIbt.exe
4032	CJTBRyB.exe
4204	UYBaHkD.exe
2352	ZBkEXHZ.exe
2320	VhMjvaX.exe
4956	kuXgAaB.exe
2508	ukUnDfQ.exe
4996	SCcpybO.exe
452	lPWpunT.exe
1908	KAxfGLI.exe
2900	DsEOmMG.exe
4912	BcUrtHa.exe
4940	vymiXEx.exe
4072	NBMiulR.exe
4008	hbtPLFv.exe
3040	PTtbmaP.exe
1368	btxRtBj.exe
212	jFhRvPq.exe
2532	BUNhcmT.exe
2740	dylHdWB.exe
1804	RHnEeca.exe
1536	uMspaMr.exe
4476	oudpbjR.exe
2408	yRjTjQl.exe
2068	MEtxlDN.exe
4616	CPEdUXc.exe
4636	PWuMEpr.exe
4100	cOXscWl.exe
960	kKGQcNP.exe
4344	sJYnWdA.exe
3664	suOWSzP.exe
3476	MvELIJQ.exe
2444	dAhHFhs.exe
4132	bmTbfth.exe
1272	przgiBI.exe
4460	fSmWLLe.exe
3388	tjMQRQE.exe
2412	pDQWMhM.exe
912	tSNNwQw.exe
1296	mmJxNlD.exe
1480	YoMyzPa.exe
3796	KwwcyuR.exe
3696	wPjdhAR.exe
4580	XaTkaMI.exe
1380	JAYjlAX.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rlkoBCZ.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\GkpTrsx.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\NMPYExK.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\VdwwzBs.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\QEWOaHC.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\csKVWdj.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\UECyXZP.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\RUAnIxF.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\NlRTTBv.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\UrZRnUk.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\ecmSnzp.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\KaFIbjA.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\DYeBpEP.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\gKKfKqP.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\JiALBwA.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\bwmvYRn.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\QeVeTrd.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\lroVPKl.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\rOqMKjD.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\PqrcFHe.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\dArrglz.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\sNjwXqs.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\UcLtUjm.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\DfTEozp.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\xJTDsZC.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\GBJGDIB.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\djXUNEN.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\pCwYwtx.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\tWLFHYl.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\pInKdhy.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\tfzfghY.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\OZBSqbx.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\snBFPha.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\KILPqwX.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\yNUXfCl.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\zzVfuob.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\TFfxNGc.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\TBYFHJr.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\OGGcDeX.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\ZfepZPg.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\gyhKXik.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\OyMGmRf.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\NSmwEkb.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\UtxAtXx.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\ImJpvgz.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\JiUxdWD.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\tzbEDME.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\kYrYPzb.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\UTKQJDa.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\QMEjRNL.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\yLBmBoV.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\zpAbzpU.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\zFWFvzZ.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\iYdQkTi.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\XUxAyUH.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\yXFBDBH.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\jScvAxW.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\eNSERzp.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\kJRFQyy.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\UkiYseQ.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\NXVjBkb.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\yWyghIo.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\besDIpv.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
File created	C:\Windows\System\zzuzdGX.exe	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16920	dwm.exe
Token: SeChangeNotifyPrivilege	16920	dwm.exe
Token: 33	16920	dwm.exe
Token: SeIncBasePriorityPrivilege	16920	dwm.exe
Token: SeShutdownPrivilege	16920	dwm.exe
Token: SeCreatePagefilePrivilege	16920	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3176	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2936	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	84
PID 4368 wrote to memory of 2936	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	84
PID 4368 wrote to memory of 3068	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	85
PID 4368 wrote to memory of 3068	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	85
PID 4368 wrote to memory of 1244	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	86
PID 4368 wrote to memory of 1244	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	86
PID 4368 wrote to memory of 4028	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	87
PID 4368 wrote to memory of 4028	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	87
PID 4368 wrote to memory of 3144	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	88
PID 4368 wrote to memory of 3144	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	88
PID 4368 wrote to memory of 4156	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	89
PID 4368 wrote to memory of 4156	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	89
PID 4368 wrote to memory of 3272	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	90
PID 4368 wrote to memory of 3272	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	90
PID 4368 wrote to memory of 4732	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	91
PID 4368 wrote to memory of 4732	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	91
PID 4368 wrote to memory of 1780	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	92
PID 4368 wrote to memory of 1780	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	92
PID 4368 wrote to memory of 5036	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	93
PID 4368 wrote to memory of 5036	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	93
PID 4368 wrote to memory of 4576	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	94
PID 4368 wrote to memory of 4576	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	94
PID 4368 wrote to memory of 2380	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	95
PID 4368 wrote to memory of 2380	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	95
PID 4368 wrote to memory of 5024	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	96
PID 4368 wrote to memory of 5024	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	96
PID 4368 wrote to memory of 3132	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	97
PID 4368 wrote to memory of 3132	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	97
PID 4368 wrote to memory of 1552	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	98
PID 4368 wrote to memory of 1552	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	98
PID 4368 wrote to memory of 2796	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	100
PID 4368 wrote to memory of 2796	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	100
PID 4368 wrote to memory of 3652	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	102
PID 4368 wrote to memory of 3652	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	102
PID 4368 wrote to memory of 3060	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	103
PID 4368 wrote to memory of 3060	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	103
PID 4368 wrote to memory of 3672	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	104
PID 4368 wrote to memory of 3672	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	104
PID 4368 wrote to memory of 636	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	106
PID 4368 wrote to memory of 636	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	106
PID 4368 wrote to memory of 4032	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	107
PID 4368 wrote to memory of 4032	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	107
PID 4368 wrote to memory of 4204	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	108
PID 4368 wrote to memory of 4204	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	108
PID 4368 wrote to memory of 2352	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	109
PID 4368 wrote to memory of 2352	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	109
PID 4368 wrote to memory of 2320	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	110
PID 4368 wrote to memory of 2320	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	110
PID 4368 wrote to memory of 4956	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	111
PID 4368 wrote to memory of 4956	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	111
PID 4368 wrote to memory of 2508	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	112
PID 4368 wrote to memory of 2508	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	112
PID 4368 wrote to memory of 4996	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	113
PID 4368 wrote to memory of 4996	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	113
PID 4368 wrote to memory of 452	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	114
PID 4368 wrote to memory of 452	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	114
PID 4368 wrote to memory of 1908	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	115
PID 4368 wrote to memory of 1908	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	115
PID 4368 wrote to memory of 2900	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	116
PID 4368 wrote to memory of 2900	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	116
PID 4368 wrote to memory of 4912	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	117
PID 4368 wrote to memory of 4912	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	117
PID 4368 wrote to memory of 4940	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	118
PID 4368 wrote to memory of 4940	4368	9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe	118

C:\Users\Admin\AppData\Local\Temp\9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9e1cb674e1da8be180e5a24f49bc0120_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\System\KOhInXj.exe
  C:\Windows\System\KOhInXj.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\JNeAwFi.exe
  C:\Windows\System\JNeAwFi.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\uxTILXC.exe
  C:\Windows\System\uxTILXC.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\ZmfUCLY.exe
  C:\Windows\System\ZmfUCLY.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\xKlRhyl.exe
  C:\Windows\System\xKlRhyl.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\ONEcnIN.exe
  C:\Windows\System\ONEcnIN.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\fJHiQeh.exe
  C:\Windows\System\fJHiQeh.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\PEGtaYr.exe
  C:\Windows\System\PEGtaYr.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\mCEpnnz.exe
  C:\Windows\System\mCEpnnz.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\vNIMOGk.exe
  C:\Windows\System\vNIMOGk.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\FbSDrXR.exe
  C:\Windows\System\FbSDrXR.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\SNxolJm.exe
  C:\Windows\System\SNxolJm.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\gyhKXik.exe
  C:\Windows\System\gyhKXik.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\aTLmhlV.exe
  C:\Windows\System\aTLmhlV.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\UTKQJDa.exe
  C:\Windows\System\UTKQJDa.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\tTYEpKr.exe
  C:\Windows\System\tTYEpKr.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\nXhMKFH.exe
  C:\Windows\System\nXhMKFH.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\eGkBVWc.exe
  C:\Windows\System\eGkBVWc.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\cVmJerF.exe
  C:\Windows\System\cVmJerF.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\NNBgIbt.exe
  C:\Windows\System\NNBgIbt.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\CJTBRyB.exe
  C:\Windows\System\CJTBRyB.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\UYBaHkD.exe
  C:\Windows\System\UYBaHkD.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\ZBkEXHZ.exe
  C:\Windows\System\ZBkEXHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\VhMjvaX.exe
  C:\Windows\System\VhMjvaX.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\kuXgAaB.exe
  C:\Windows\System\kuXgAaB.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\ukUnDfQ.exe
  C:\Windows\System\ukUnDfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\SCcpybO.exe
  C:\Windows\System\SCcpybO.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\lPWpunT.exe
  C:\Windows\System\lPWpunT.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\KAxfGLI.exe
  C:\Windows\System\KAxfGLI.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\DsEOmMG.exe
  C:\Windows\System\DsEOmMG.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\BcUrtHa.exe
  C:\Windows\System\BcUrtHa.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\vymiXEx.exe
  C:\Windows\System\vymiXEx.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\NBMiulR.exe
  C:\Windows\System\NBMiulR.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\hbtPLFv.exe
  C:\Windows\System\hbtPLFv.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\PTtbmaP.exe
  C:\Windows\System\PTtbmaP.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\btxRtBj.exe
  C:\Windows\System\btxRtBj.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\jFhRvPq.exe
  C:\Windows\System\jFhRvPq.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\BUNhcmT.exe
  C:\Windows\System\BUNhcmT.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\dylHdWB.exe
  C:\Windows\System\dylHdWB.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\RHnEeca.exe
  C:\Windows\System\RHnEeca.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\uMspaMr.exe
  C:\Windows\System\uMspaMr.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\oudpbjR.exe
  C:\Windows\System\oudpbjR.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\yRjTjQl.exe
  C:\Windows\System\yRjTjQl.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\MEtxlDN.exe
  C:\Windows\System\MEtxlDN.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\CPEdUXc.exe
  C:\Windows\System\CPEdUXc.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\PWuMEpr.exe
  C:\Windows\System\PWuMEpr.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\cOXscWl.exe
  C:\Windows\System\cOXscWl.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\kKGQcNP.exe
  C:\Windows\System\kKGQcNP.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\sJYnWdA.exe
  C:\Windows\System\sJYnWdA.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\suOWSzP.exe
  C:\Windows\System\suOWSzP.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\MvELIJQ.exe
  C:\Windows\System\MvELIJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\dAhHFhs.exe
  C:\Windows\System\dAhHFhs.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\bmTbfth.exe
  C:\Windows\System\bmTbfth.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\przgiBI.exe
  C:\Windows\System\przgiBI.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\fSmWLLe.exe
  C:\Windows\System\fSmWLLe.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\tjMQRQE.exe
  C:\Windows\System\tjMQRQE.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\pDQWMhM.exe
  C:\Windows\System\pDQWMhM.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\tSNNwQw.exe
  C:\Windows\System\tSNNwQw.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\mmJxNlD.exe
  C:\Windows\System\mmJxNlD.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\YoMyzPa.exe
  C:\Windows\System\YoMyzPa.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\KwwcyuR.exe
  C:\Windows\System\KwwcyuR.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\wPjdhAR.exe
  C:\Windows\System\wPjdhAR.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\XaTkaMI.exe
  C:\Windows\System\XaTkaMI.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\JAYjlAX.exe
  C:\Windows\System\JAYjlAX.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\IAxXEyr.exe
  C:\Windows\System\IAxXEyr.exe
  2⤵
  PID:2572
- C:\Windows\System\tfzfghY.exe
  C:\Windows\System\tfzfghY.exe
  2⤵
  PID:2616
- C:\Windows\System\dVXDlSH.exe
  C:\Windows\System\dVXDlSH.exe
  2⤵
  PID:4136
- C:\Windows\System\VYyxxOp.exe
  C:\Windows\System\VYyxxOp.exe
  2⤵
  PID:2576
- C:\Windows\System\VBnhSgG.exe
  C:\Windows\System\VBnhSgG.exe
  2⤵
  PID:1412
- C:\Windows\System\oIZpyiw.exe
  C:\Windows\System\oIZpyiw.exe
  2⤵
  PID:3104
- C:\Windows\System\uWmlFhe.exe
  C:\Windows\System\uWmlFhe.exe
  2⤵
  PID:1900
- C:\Windows\System\VqqRJwM.exe
  C:\Windows\System\VqqRJwM.exe
  2⤵
  PID:1968
- C:\Windows\System\yEXURVD.exe
  C:\Windows\System\yEXURVD.exe
  2⤵
  PID:992
- C:\Windows\System\BiPcLpx.exe
  C:\Windows\System\BiPcLpx.exe
  2⤵
  PID:5004
- C:\Windows\System\besDIpv.exe
  C:\Windows\System\besDIpv.exe
  2⤵
  PID:3604
- C:\Windows\System\UuTkjXm.exe
  C:\Windows\System\UuTkjXm.exe
  2⤵
  PID:4312
- C:\Windows\System\RLoFGiY.exe
  C:\Windows\System\RLoFGiY.exe
  2⤵
  PID:2848
- C:\Windows\System\VKiWNCl.exe
  C:\Windows\System\VKiWNCl.exe
  2⤵
  PID:3400
- C:\Windows\System\OzClFoO.exe
  C:\Windows\System\OzClFoO.exe
  2⤵
  PID:1016
- C:\Windows\System\IGUilLr.exe
  C:\Windows\System\IGUilLr.exe
  2⤵
  PID:4720
- C:\Windows\System\GiFzQvL.exe
  C:\Windows\System\GiFzQvL.exe
  2⤵
  PID:4060
- C:\Windows\System\UDCCGwX.exe
  C:\Windows\System\UDCCGwX.exe
  2⤵
  PID:3760
- C:\Windows\System\DfTEozp.exe
  C:\Windows\System\DfTEozp.exe
  2⤵
  PID:4404
- C:\Windows\System\POpjyQB.exe
  C:\Windows\System\POpjyQB.exe
  2⤵
  PID:4932
- C:\Windows\System\hLIevyS.exe
  C:\Windows\System\hLIevyS.exe
  2⤵
  PID:5028
- C:\Windows\System\ccKfcaL.exe
  C:\Windows\System\ccKfcaL.exe
  2⤵
  PID:4792
- C:\Windows\System\uUUURzI.exe
  C:\Windows\System\uUUURzI.exe
  2⤵
  PID:3056
- C:\Windows\System\trotUsR.exe
  C:\Windows\System\trotUsR.exe
  2⤵
  PID:3808
- C:\Windows\System\RPjrMJP.exe
  C:\Windows\System\RPjrMJP.exe
  2⤵
  PID:1632
- C:\Windows\System\jeZmAKL.exe
  C:\Windows\System\jeZmAKL.exe
  2⤵
  PID:1684
- C:\Windows\System\DRTbuce.exe
  C:\Windows\System\DRTbuce.exe
  2⤵
  PID:1152
- C:\Windows\System\hCGGCCd.exe
  C:\Windows\System\hCGGCCd.exe
  2⤵
  PID:1828
- C:\Windows\System\MtlTrkx.exe
  C:\Windows\System\MtlTrkx.exe
  2⤵
  PID:2364
- C:\Windows\System\YxABQdX.exe
  C:\Windows\System\YxABQdX.exe
  2⤵
  PID:3516
- C:\Windows\System\cBcIKcK.exe
  C:\Windows\System\cBcIKcK.exe
  2⤵
  PID:5132
- C:\Windows\System\yYmRnRZ.exe
  C:\Windows\System\yYmRnRZ.exe
  2⤵
  PID:5172
- C:\Windows\System\rTKnjZc.exe
  C:\Windows\System\rTKnjZc.exe
  2⤵
  PID:5188
- C:\Windows\System\eNSERzp.exe
  C:\Windows\System\eNSERzp.exe
  2⤵
  PID:5208
- C:\Windows\System\bVocdbk.exe
  C:\Windows\System\bVocdbk.exe
  2⤵
  PID:5248
- C:\Windows\System\zzuzdGX.exe
  C:\Windows\System\zzuzdGX.exe
  2⤵
  PID:5272
- C:\Windows\System\lXcgUBV.exe
  C:\Windows\System\lXcgUBV.exe
  2⤵
  PID:5304
- C:\Windows\System\QwEjUyR.exe
  C:\Windows\System\QwEjUyR.exe
  2⤵
  PID:5328
- C:\Windows\System\pOxBsxP.exe
  C:\Windows\System\pOxBsxP.exe
  2⤵
  PID:5360
- C:\Windows\System\sySJKfk.exe
  C:\Windows\System\sySJKfk.exe
  2⤵
  PID:5392
- C:\Windows\System\rZDXDix.exe
  C:\Windows\System\rZDXDix.exe
  2⤵
  PID:5424
- C:\Windows\System\dyxRlip.exe
  C:\Windows\System\dyxRlip.exe
  2⤵
  PID:5440
- C:\Windows\System\jgWGweF.exe
  C:\Windows\System\jgWGweF.exe
  2⤵
  PID:5472
- C:\Windows\System\QrEABIa.exe
  C:\Windows\System\QrEABIa.exe
  2⤵
  PID:5500
- C:\Windows\System\syjuZRh.exe
  C:\Windows\System\syjuZRh.exe
  2⤵
  PID:5528
- C:\Windows\System\YzKTLOj.exe
  C:\Windows\System\YzKTLOj.exe
  2⤵
  PID:5552
- C:\Windows\System\xyuuVwd.exe
  C:\Windows\System\xyuuVwd.exe
  2⤵
  PID:5588
- C:\Windows\System\KVAuEOV.exe
  C:\Windows\System\KVAuEOV.exe
  2⤵
  PID:5608
- C:\Windows\System\fNLjRdY.exe
  C:\Windows\System\fNLjRdY.exe
  2⤵
  PID:5652
- C:\Windows\System\nVIFuki.exe
  C:\Windows\System\nVIFuki.exe
  2⤵
  PID:5676
- C:\Windows\System\AalMzbI.exe
  C:\Windows\System\AalMzbI.exe
  2⤵
  PID:5700
- C:\Windows\System\gJnjpjH.exe
  C:\Windows\System\gJnjpjH.exe
  2⤵
  PID:5728
- C:\Windows\System\ZginBZM.exe
  C:\Windows\System\ZginBZM.exe
  2⤵
  PID:5760
- C:\Windows\System\pwGqXkP.exe
  C:\Windows\System\pwGqXkP.exe
  2⤵
  PID:5808
- C:\Windows\System\hYnFhmS.exe
  C:\Windows\System\hYnFhmS.exe
  2⤵
  PID:5824
- C:\Windows\System\BiMvvRT.exe
  C:\Windows\System\BiMvvRT.exe
  2⤵
  PID:5844
- C:\Windows\System\wSVljDA.exe
  C:\Windows\System\wSVljDA.exe
  2⤵
  PID:5864
- C:\Windows\System\kAzIQDV.exe
  C:\Windows\System\kAzIQDV.exe
  2⤵
  PID:5896
- C:\Windows\System\llGDpKV.exe
  C:\Windows\System\llGDpKV.exe
  2⤵
  PID:5928
- C:\Windows\System\yhYNyZw.exe
  C:\Windows\System\yhYNyZw.exe
  2⤵
  PID:5952
- C:\Windows\System\VzLGgur.exe
  C:\Windows\System\VzLGgur.exe
  2⤵
  PID:5980
- C:\Windows\System\XazEqdb.exe
  C:\Windows\System\XazEqdb.exe
  2⤵
  PID:6008
- C:\Windows\System\ZrpOoOk.exe
  C:\Windows\System\ZrpOoOk.exe
  2⤵
  PID:6036
- C:\Windows\System\POCWeLa.exe
  C:\Windows\System\POCWeLa.exe
  2⤵
  PID:6064
- C:\Windows\System\SreFrfN.exe
  C:\Windows\System\SreFrfN.exe
  2⤵
  PID:6092
- C:\Windows\System\MDkaXCS.exe
  C:\Windows\System\MDkaXCS.exe
  2⤵
  PID:6120
- C:\Windows\System\yogeeaZ.exe
  C:\Windows\System\yogeeaZ.exe
  2⤵
  PID:5128
- C:\Windows\System\caBcCUR.exe
  C:\Windows\System\caBcCUR.exe
  2⤵
  PID:5184
- C:\Windows\System\mjXkifb.exe
  C:\Windows\System\mjXkifb.exe
  2⤵
  PID:5268
- C:\Windows\System\LkiwvQq.exe
  C:\Windows\System\LkiwvQq.exe
  2⤵
  PID:5312
- C:\Windows\System\QENLTPK.exe
  C:\Windows\System\QENLTPK.exe
  2⤵
  PID:5400
- C:\Windows\System\MrJZvle.exe
  C:\Windows\System\MrJZvle.exe
  2⤵
  PID:5452
- C:\Windows\System\RQbhpmq.exe
  C:\Windows\System\RQbhpmq.exe
  2⤵
  PID:5512
- C:\Windows\System\dGokkde.exe
  C:\Windows\System\dGokkde.exe
  2⤵
  PID:5596
- C:\Windows\System\SssuAIV.exe
  C:\Windows\System\SssuAIV.exe
  2⤵
  PID:5664
- C:\Windows\System\ioKizId.exe
  C:\Windows\System\ioKizId.exe
  2⤵
  PID:5756
- C:\Windows\System\gLevJKa.exe
  C:\Windows\System\gLevJKa.exe
  2⤵
  PID:5816
- C:\Windows\System\ERFLaBz.exe
  C:\Windows\System\ERFLaBz.exe
  2⤵
  PID:5832
- C:\Windows\System\XbCsbgl.exe
  C:\Windows\System\XbCsbgl.exe
  2⤵
  PID:5912
- C:\Windows\System\RQwwUwY.exe
  C:\Windows\System\RQwwUwY.exe
  2⤵
  PID:5968
- C:\Windows\System\dCWcsUS.exe
  C:\Windows\System\dCWcsUS.exe
  2⤵
  PID:6076
- C:\Windows\System\AcTzcrb.exe
  C:\Windows\System\AcTzcrb.exe
  2⤵
  PID:6140
- C:\Windows\System\bDojNPG.exe
  C:\Windows\System\bDojNPG.exe
  2⤵
  PID:5196
- C:\Windows\System\NHWHqjL.exe
  C:\Windows\System\NHWHqjL.exe
  2⤵
  PID:5388
- C:\Windows\System\jIouEGI.exe
  C:\Windows\System\jIouEGI.exe
  2⤵
  PID:5544
- C:\Windows\System\HucNGPm.exe
  C:\Windows\System\HucNGPm.exe
  2⤵
  PID:5712
- C:\Windows\System\FNlKGmR.exe
  C:\Windows\System\FNlKGmR.exe
  2⤵
  PID:5772
- C:\Windows\System\WYbDUbw.exe
  C:\Windows\System\WYbDUbw.exe
  2⤵
  PID:5972
- C:\Windows\System\iBkYCHv.exe
  C:\Windows\System\iBkYCHv.exe
  2⤵
  PID:6136
- C:\Windows\System\RbfioBf.exe
  C:\Windows\System\RbfioBf.exe
  2⤵
  PID:5352
- C:\Windows\System\xAtFhSO.exe
  C:\Windows\System\xAtFhSO.exe
  2⤵
  PID:5884
- C:\Windows\System\YuWMIsp.exe
  C:\Windows\System\YuWMIsp.exe
  2⤵
  PID:5632
- C:\Windows\System\JpPIUTc.exe
  C:\Windows\System\JpPIUTc.exe
  2⤵
  PID:5944
- C:\Windows\System\heYzjKy.exe
  C:\Windows\System\heYzjKy.exe
  2⤵
  PID:6152
- C:\Windows\System\ObhSBIW.exe
  C:\Windows\System\ObhSBIW.exe
  2⤵
  PID:6188
- C:\Windows\System\fFFMAMK.exe
  C:\Windows\System\fFFMAMK.exe
  2⤵
  PID:6212
- C:\Windows\System\wLityEZ.exe
  C:\Windows\System\wLityEZ.exe
  2⤵
  PID:6244
- C:\Windows\System\lYNxCXD.exe
  C:\Windows\System\lYNxCXD.exe
  2⤵
  PID:6276
- C:\Windows\System\kJRFQyy.exe
  C:\Windows\System\kJRFQyy.exe
  2⤵
  PID:6296
- C:\Windows\System\hljPjNr.exe
  C:\Windows\System\hljPjNr.exe
  2⤵
  PID:6324
- C:\Windows\System\dlxksdV.exe
  C:\Windows\System\dlxksdV.exe
  2⤵
  PID:6352
- C:\Windows\System\KoYfuYf.exe
  C:\Windows\System\KoYfuYf.exe
  2⤵
  PID:6376
- C:\Windows\System\RKZqlfT.exe
  C:\Windows\System\RKZqlfT.exe
  2⤵
  PID:6404
- C:\Windows\System\QhMTqCq.exe
  C:\Windows\System\QhMTqCq.exe
  2⤵
  PID:6440
- C:\Windows\System\gDjXhfh.exe
  C:\Windows\System\gDjXhfh.exe
  2⤵
  PID:6472
- C:\Windows\System\HWjhOGN.exe
  C:\Windows\System\HWjhOGN.exe
  2⤵
  PID:6488
- C:\Windows\System\JtQyxxd.exe
  C:\Windows\System\JtQyxxd.exe
  2⤵
  PID:6528
- C:\Windows\System\vYnhYJy.exe
  C:\Windows\System\vYnhYJy.exe
  2⤵
  PID:6544
- C:\Windows\System\cTIiGUu.exe
  C:\Windows\System\cTIiGUu.exe
  2⤵
  PID:6572
- C:\Windows\System\NlRTTBv.exe
  C:\Windows\System\NlRTTBv.exe
  2⤵
  PID:6588
- C:\Windows\System\ajsurJW.exe
  C:\Windows\System\ajsurJW.exe
  2⤵
  PID:6612
- C:\Windows\System\NuEEbwY.exe
  C:\Windows\System\NuEEbwY.exe
  2⤵
  PID:6632
- C:\Windows\System\RyzlBYx.exe
  C:\Windows\System\RyzlBYx.exe
  2⤵
  PID:6648
- C:\Windows\System\DTAZNiO.exe
  C:\Windows\System\DTAZNiO.exe
  2⤵
  PID:6684
- C:\Windows\System\IRppGOR.exe
  C:\Windows\System\IRppGOR.exe
  2⤵
  PID:6712
- C:\Windows\System\djXUNEN.exe
  C:\Windows\System\djXUNEN.exe
  2⤵
  PID:6760
- C:\Windows\System\toHbSaM.exe
  C:\Windows\System\toHbSaM.exe
  2⤵
  PID:6784
- C:\Windows\System\IOOBaLt.exe
  C:\Windows\System\IOOBaLt.exe
  2⤵
  PID:6832
- C:\Windows\System\jbYeQxx.exe
  C:\Windows\System\jbYeQxx.exe
  2⤵
  PID:6856
- C:\Windows\System\nUXfdPm.exe
  C:\Windows\System\nUXfdPm.exe
  2⤵
  PID:6880
- C:\Windows\System\nbSRkNG.exe
  C:\Windows\System\nbSRkNG.exe
  2⤵
  PID:6908
- C:\Windows\System\RsnPczL.exe
  C:\Windows\System\RsnPczL.exe
  2⤵
  PID:6948
- C:\Windows\System\ijhikxM.exe
  C:\Windows\System\ijhikxM.exe
  2⤵
  PID:6964
- C:\Windows\System\koErjyS.exe
  C:\Windows\System\koErjyS.exe
  2⤵
  PID:6980
- C:\Windows\System\CIFFnbG.exe
  C:\Windows\System\CIFFnbG.exe
  2⤵
  PID:7004
- C:\Windows\System\xiwNYVI.exe
  C:\Windows\System\xiwNYVI.exe
  2⤵
  PID:7036
- C:\Windows\System\zmQBPIj.exe
  C:\Windows\System\zmQBPIj.exe
  2⤵
  PID:7068
- C:\Windows\System\eyWVGmN.exe
  C:\Windows\System\eyWVGmN.exe
  2⤵
  PID:7092
- C:\Windows\System\rXMcywZ.exe
  C:\Windows\System\rXMcywZ.exe
  2⤵
  PID:7116
- C:\Windows\System\MPOCqwp.exe
  C:\Windows\System\MPOCqwp.exe
  2⤵
  PID:7148
- C:\Windows\System\ImJpvgz.exe
  C:\Windows\System\ImJpvgz.exe
  2⤵
  PID:6164
- C:\Windows\System\bdIJgBg.exe
  C:\Windows\System\bdIJgBg.exe
  2⤵
  PID:6284
- C:\Windows\System\YAWvCLZ.exe
  C:\Windows\System\YAWvCLZ.exe
  2⤵
  PID:6312
- C:\Windows\System\thMpJcj.exe
  C:\Windows\System\thMpJcj.exe
  2⤵
  PID:6400
- C:\Windows\System\GEyeHhY.exe
  C:\Windows\System\GEyeHhY.exe
  2⤵
  PID:6480
- C:\Windows\System\CLaNcjw.exe
  C:\Windows\System\CLaNcjw.exe
  2⤵
  PID:6536
- C:\Windows\System\DAYwzvE.exe
  C:\Windows\System\DAYwzvE.exe
  2⤵
  PID:6560
- C:\Windows\System\rlkoBCZ.exe
  C:\Windows\System\rlkoBCZ.exe
  2⤵
  PID:6604
- C:\Windows\System\jNfRVHs.exe
  C:\Windows\System\jNfRVHs.exe
  2⤵
  PID:6708
- C:\Windows\System\TjWigQK.exe
  C:\Windows\System\TjWigQK.exe
  2⤵
  PID:6768
- C:\Windows\System\gCryzQX.exe
  C:\Windows\System\gCryzQX.exe
  2⤵
  PID:6864
- C:\Windows\System\etJbNsX.exe
  C:\Windows\System\etJbNsX.exe
  2⤵
  PID:6896
- C:\Windows\System\gRcNabi.exe
  C:\Windows\System\gRcNabi.exe
  2⤵
  PID:6976
- C:\Windows\System\jlxKvTl.exe
  C:\Windows\System\jlxKvTl.exe
  2⤵
  PID:7028
- C:\Windows\System\QMEjRNL.exe
  C:\Windows\System\QMEjRNL.exe
  2⤵
  PID:7108
- C:\Windows\System\RPCNZQr.exe
  C:\Windows\System\RPCNZQr.exe
  2⤵
  PID:6200
- C:\Windows\System\AvruOVb.exe
  C:\Windows\System\AvruOVb.exe
  2⤵
  PID:6264
- C:\Windows\System\jyAezCd.exe
  C:\Windows\System\jyAezCd.exe
  2⤵
  PID:6336
- C:\Windows\System\BMrHNLi.exe
  C:\Windows\System\BMrHNLi.exe
  2⤵
  PID:6584
- C:\Windows\System\uweaefH.exe
  C:\Windows\System\uweaefH.exe
  2⤵
  PID:6696
- C:\Windows\System\lammQAV.exe
  C:\Windows\System\lammQAV.exe
  2⤵
  PID:6840
- C:\Windows\System\UrZRnUk.exe
  C:\Windows\System\UrZRnUk.exe
  2⤵
  PID:7140
- C:\Windows\System\nUagCEH.exe
  C:\Windows\System\nUagCEH.exe
  2⤵
  PID:6432
- C:\Windows\System\tTxFEBT.exe
  C:\Windows\System\tTxFEBT.exe
  2⤵
  PID:6524
- C:\Windows\System\wmisEBz.exe
  C:\Windows\System\wmisEBz.exe
  2⤵
  PID:6992
- C:\Windows\System\kYblAdM.exe
  C:\Windows\System\kYblAdM.exe
  2⤵
  PID:6580
- C:\Windows\System\awRlYbr.exe
  C:\Windows\System\awRlYbr.exe
  2⤵
  PID:7136
- C:\Windows\System\pJiPNyt.exe
  C:\Windows\System\pJiPNyt.exe
  2⤵
  PID:7188
- C:\Windows\System\gKKfKqP.exe
  C:\Windows\System\gKKfKqP.exe
  2⤵
  PID:7204
- C:\Windows\System\hBafbcX.exe
  C:\Windows\System\hBafbcX.exe
  2⤵
  PID:7232
- C:\Windows\System\ecmSnzp.exe
  C:\Windows\System\ecmSnzp.exe
  2⤵
  PID:7248
- C:\Windows\System\WVzXLbL.exe
  C:\Windows\System\WVzXLbL.exe
  2⤵
  PID:7284
- C:\Windows\System\rNNijGk.exe
  C:\Windows\System\rNNijGk.exe
  2⤵
  PID:7316
- C:\Windows\System\UhkimTt.exe
  C:\Windows\System\UhkimTt.exe
  2⤵
  PID:7344
- C:\Windows\System\WGCbIhx.exe
  C:\Windows\System\WGCbIhx.exe
  2⤵
  PID:7372
- C:\Windows\System\saspdib.exe
  C:\Windows\System\saspdib.exe
  2⤵
  PID:7400
- C:\Windows\System\NwtAIwj.exe
  C:\Windows\System\NwtAIwj.exe
  2⤵
  PID:7424
- C:\Windows\System\uiRdGro.exe
  C:\Windows\System\uiRdGro.exe
  2⤵
  PID:7480
- C:\Windows\System\QWMZBao.exe
  C:\Windows\System\QWMZBao.exe
  2⤵
  PID:7500
- C:\Windows\System\XxcFuci.exe
  C:\Windows\System\XxcFuci.exe
  2⤵
  PID:7524
- C:\Windows\System\JiUxdWD.exe
  C:\Windows\System\JiUxdWD.exe
  2⤵
  PID:7568
- C:\Windows\System\iaPAwNN.exe
  C:\Windows\System\iaPAwNN.exe
  2⤵
  PID:7584
- C:\Windows\System\ZwwLiIM.exe
  C:\Windows\System\ZwwLiIM.exe
  2⤵
  PID:7612
- C:\Windows\System\ZohyMTh.exe
  C:\Windows\System\ZohyMTh.exe
  2⤵
  PID:7636
- C:\Windows\System\DJoMbKT.exe
  C:\Windows\System\DJoMbKT.exe
  2⤵
  PID:7680
- C:\Windows\System\aXHOuco.exe
  C:\Windows\System\aXHOuco.exe
  2⤵
  PID:7708
- C:\Windows\System\oYTZfWO.exe
  C:\Windows\System\oYTZfWO.exe
  2⤵
  PID:7724
- C:\Windows\System\NMPYExK.exe
  C:\Windows\System\NMPYExK.exe
  2⤵
  PID:7740
- C:\Windows\System\TOPDNbH.exe
  C:\Windows\System\TOPDNbH.exe
  2⤵
  PID:7768
- C:\Windows\System\vfXEUBK.exe
  C:\Windows\System\vfXEUBK.exe
  2⤵
  PID:7784
- C:\Windows\System\nczwjQY.exe
  C:\Windows\System\nczwjQY.exe
  2⤵
  PID:7800
- C:\Windows\System\XFrXPYu.exe
  C:\Windows\System\XFrXPYu.exe
  2⤵
  PID:7824
- C:\Windows\System\AzFKpvG.exe
  C:\Windows\System\AzFKpvG.exe
  2⤵
  PID:7900
- C:\Windows\System\OagfPWK.exe
  C:\Windows\System\OagfPWK.exe
  2⤵
  PID:7916
- C:\Windows\System\lIsczeq.exe
  C:\Windows\System\lIsczeq.exe
  2⤵
  PID:7936
- C:\Windows\System\MsJfrsm.exe
  C:\Windows\System\MsJfrsm.exe
  2⤵
  PID:7960
- C:\Windows\System\gNLADkU.exe
  C:\Windows\System\gNLADkU.exe
  2⤵
  PID:7988
- C:\Windows\System\hcazZzu.exe
  C:\Windows\System\hcazZzu.exe
  2⤵
  PID:8016
- C:\Windows\System\dZawZSh.exe
  C:\Windows\System\dZawZSh.exe
  2⤵
  PID:8036
- C:\Windows\System\XTpAsco.exe
  C:\Windows\System\XTpAsco.exe
  2⤵
  PID:8060
- C:\Windows\System\JiALBwA.exe
  C:\Windows\System\JiALBwA.exe
  2⤵
  PID:8092
- C:\Windows\System\cqlxdzB.exe
  C:\Windows\System\cqlxdzB.exe
  2⤵
  PID:8120
- C:\Windows\System\MJuaMYM.exe
  C:\Windows\System\MJuaMYM.exe
  2⤵
  PID:8172
- C:\Windows\System\ZxMhlAd.exe
  C:\Windows\System\ZxMhlAd.exe
  2⤵
  PID:7180
- C:\Windows\System\TLsYIeV.exe
  C:\Windows\System\TLsYIeV.exe
  2⤵
  PID:7272
- C:\Windows\System\pCwYwtx.exe
  C:\Windows\System\pCwYwtx.exe
  2⤵
  PID:7368
- C:\Windows\System\IxMDeUQ.exe
  C:\Windows\System\IxMDeUQ.exe
  2⤵
  PID:7380
- C:\Windows\System\njnYxXu.exe
  C:\Windows\System\njnYxXu.exe
  2⤵
  PID:7420
- C:\Windows\System\PwjschB.exe
  C:\Windows\System\PwjschB.exe
  2⤵
  PID:7512
- C:\Windows\System\sGqViPv.exe
  C:\Windows\System\sGqViPv.exe
  2⤵
  PID:7496
- C:\Windows\System\GmtdOes.exe
  C:\Windows\System\GmtdOes.exe
  2⤵
  PID:7556
- C:\Windows\System\uwqReUI.exe
  C:\Windows\System\uwqReUI.exe
  2⤵
  PID:7600
- C:\Windows\System\aFBJBEo.exe
  C:\Windows\System\aFBJBEo.exe
  2⤵
  PID:7664
- C:\Windows\System\ALTYznO.exe
  C:\Windows\System\ALTYznO.exe
  2⤵
  PID:7720
- C:\Windows\System\OlaNxSi.exe
  C:\Windows\System\OlaNxSi.exe
  2⤵
  PID:7760
- C:\Windows\System\kjaEBOb.exe
  C:\Windows\System\kjaEBOb.exe
  2⤵
  PID:7868
- C:\Windows\System\YgNIHee.exe
  C:\Windows\System\YgNIHee.exe
  2⤵
  PID:7892
- C:\Windows\System\GROwuXT.exe
  C:\Windows\System\GROwuXT.exe
  2⤵
  PID:7956
- C:\Windows\System\hbjEUkT.exe
  C:\Windows\System\hbjEUkT.exe
  2⤵
  PID:8052
- C:\Windows\System\cioilRQ.exe
  C:\Windows\System\cioilRQ.exe
  2⤵
  PID:7024
- C:\Windows\System\DOZOrIJ.exe
  C:\Windows\System\DOZOrIJ.exe
  2⤵
  PID:7356
- C:\Windows\System\gamrLAE.exe
  C:\Windows\System\gamrLAE.exe
  2⤵
  PID:7608
- C:\Windows\System\yPQPmGA.exe
  C:\Windows\System\yPQPmGA.exe
  2⤵
  PID:7704
- C:\Windows\System\ZwdszOf.exe
  C:\Windows\System\ZwdszOf.exe
  2⤵
  PID:7848
- C:\Windows\System\MdJwgJD.exe
  C:\Windows\System\MdJwgJD.exe
  2⤵
  PID:7932
- C:\Windows\System\wOiDHCo.exe
  C:\Windows\System\wOiDHCo.exe
  2⤵
  PID:8184
- C:\Windows\System\XwsyTNI.exe
  C:\Windows\System\XwsyTNI.exe
  2⤵
  PID:7656
- C:\Windows\System\KaFIbjA.exe
  C:\Windows\System\KaFIbjA.exe
  2⤵
  PID:7952
- C:\Windows\System\VnRLbuh.exe
  C:\Windows\System\VnRLbuh.exe
  2⤵
  PID:7360
- C:\Windows\System\HKsIlNd.exe
  C:\Windows\System\HKsIlNd.exe
  2⤵
  PID:8204
- C:\Windows\System\imZSMcq.exe
  C:\Windows\System\imZSMcq.exe
  2⤵
  PID:8232
- C:\Windows\System\NVHqDYK.exe
  C:\Windows\System\NVHqDYK.exe
  2⤵
  PID:8260
- C:\Windows\System\hqMGssw.exe
  C:\Windows\System\hqMGssw.exe
  2⤵
  PID:8284
- C:\Windows\System\NYuyrFK.exe
  C:\Windows\System\NYuyrFK.exe
  2⤵
  PID:8320
- C:\Windows\System\GKewFQL.exe
  C:\Windows\System\GKewFQL.exe
  2⤵
  PID:8340
- C:\Windows\System\tREMQdr.exe
  C:\Windows\System\tREMQdr.exe
  2⤵
  PID:8356
- C:\Windows\System\IDjTWrr.exe
  C:\Windows\System\IDjTWrr.exe
  2⤵
  PID:8376
- C:\Windows\System\qOzSydp.exe
  C:\Windows\System\qOzSydp.exe
  2⤵
  PID:8396
- C:\Windows\System\RxBHgjW.exe
  C:\Windows\System\RxBHgjW.exe
  2⤵
  PID:8464
- C:\Windows\System\OZBSqbx.exe
  C:\Windows\System\OZBSqbx.exe
  2⤵
  PID:8480
- C:\Windows\System\kwuFQwJ.exe
  C:\Windows\System\kwuFQwJ.exe
  2⤵
  PID:8508
- C:\Windows\System\JbMbpNw.exe
  C:\Windows\System\JbMbpNw.exe
  2⤵
  PID:8548
- C:\Windows\System\UjVJLxJ.exe
  C:\Windows\System\UjVJLxJ.exe
  2⤵
  PID:8572
- C:\Windows\System\BngebfP.exe
  C:\Windows\System\BngebfP.exe
  2⤵
  PID:8592
- C:\Windows\System\jKftUPI.exe
  C:\Windows\System\jKftUPI.exe
  2⤵
  PID:8620
- C:\Windows\System\thMZVnq.exe
  C:\Windows\System\thMZVnq.exe
  2⤵
  PID:8644
- C:\Windows\System\sMXUyeH.exe
  C:\Windows\System\sMXUyeH.exe
  2⤵
  PID:8664
- C:\Windows\System\tMyikVN.exe
  C:\Windows\System\tMyikVN.exe
  2⤵
  PID:8684
- C:\Windows\System\zlEtZWO.exe
  C:\Windows\System\zlEtZWO.exe
  2⤵
  PID:8708
- C:\Windows\System\kHRkIoQ.exe
  C:\Windows\System\kHRkIoQ.exe
  2⤵
  PID:8740
- C:\Windows\System\VTQDjvJ.exe
  C:\Windows\System\VTQDjvJ.exe
  2⤵
  PID:8760
- C:\Windows\System\BAQkOBM.exe
  C:\Windows\System\BAQkOBM.exe
  2⤵
  PID:8804
- C:\Windows\System\rLEIjst.exe
  C:\Windows\System\rLEIjst.exe
  2⤵
  PID:8844
- C:\Windows\System\YjfWkYV.exe
  C:\Windows\System\YjfWkYV.exe
  2⤵
  PID:8876
- C:\Windows\System\iWCBLLu.exe
  C:\Windows\System\iWCBLLu.exe
  2⤵
  PID:8900
- C:\Windows\System\ZZMqFVp.exe
  C:\Windows\System\ZZMqFVp.exe
  2⤵
  PID:8940
- C:\Windows\System\VRkPYIx.exe
  C:\Windows\System\VRkPYIx.exe
  2⤵
  PID:8968
- C:\Windows\System\rKvzsDe.exe
  C:\Windows\System\rKvzsDe.exe
  2⤵
  PID:8996
- C:\Windows\System\jLnFHVF.exe
  C:\Windows\System\jLnFHVF.exe
  2⤵
  PID:9012
- C:\Windows\System\oaHWDGq.exe
  C:\Windows\System\oaHWDGq.exe
  2⤵
  PID:9028
- C:\Windows\System\EFInlpM.exe
  C:\Windows\System\EFInlpM.exe
  2⤵
  PID:9052
- C:\Windows\System\aaLpZel.exe
  C:\Windows\System\aaLpZel.exe
  2⤵
  PID:9072
- C:\Windows\System\tRBTOVx.exe
  C:\Windows\System\tRBTOVx.exe
  2⤵
  PID:9088
- C:\Windows\System\ZOjhCnq.exe
  C:\Windows\System\ZOjhCnq.exe
  2⤵
  PID:9120
- C:\Windows\System\GScTcAE.exe
  C:\Windows\System\GScTcAE.exe
  2⤵
  PID:9152
- C:\Windows\System\fEqIAMJ.exe
  C:\Windows\System\fEqIAMJ.exe
  2⤵
  PID:9180
- C:\Windows\System\lbZFbXi.exe
  C:\Windows\System\lbZFbXi.exe
  2⤵
  PID:9212
- C:\Windows\System\kXzVvYx.exe
  C:\Windows\System\kXzVvYx.exe
  2⤵
  PID:8220
- C:\Windows\System\djefkud.exe
  C:\Windows\System\djefkud.exe
  2⤵
  PID:8392
- C:\Windows\System\vPZedwh.exe
  C:\Windows\System\vPZedwh.exe
  2⤵
  PID:8424
- C:\Windows\System\GkoTZHP.exe
  C:\Windows\System\GkoTZHP.exe
  2⤵
  PID:8472
- C:\Windows\System\IazdjyE.exe
  C:\Windows\System\IazdjyE.exe
  2⤵
  PID:8532
- C:\Windows\System\wCQUfZc.exe
  C:\Windows\System\wCQUfZc.exe
  2⤵
  PID:8636
- C:\Windows\System\dhAVbnT.exe
  C:\Windows\System\dhAVbnT.exe
  2⤵
  PID:8680
- C:\Windows\System\XJihWFz.exe
  C:\Windows\System\XJihWFz.exe
  2⤵
  PID:8812
- C:\Windows\System\CNfZSQH.exe
  C:\Windows\System\CNfZSQH.exe
  2⤵
  PID:8788
- C:\Windows\System\XFBpkLs.exe
  C:\Windows\System\XFBpkLs.exe
  2⤵
  PID:8884
- C:\Windows\System\VdwwzBs.exe
  C:\Windows\System\VdwwzBs.exe
  2⤵
  PID:8936
- C:\Windows\System\aGsoTCV.exe
  C:\Windows\System\aGsoTCV.exe
  2⤵
  PID:8980
- C:\Windows\System\uWTwjcN.exe
  C:\Windows\System\uWTwjcN.exe
  2⤵
  PID:9040
- C:\Windows\System\cgMuBXk.exe
  C:\Windows\System\cgMuBXk.exe
  2⤵
  PID:9136
- C:\Windows\System\gplHsAK.exe
  C:\Windows\System\gplHsAK.exe
  2⤵
  PID:7624
- C:\Windows\System\nSWTZHN.exe
  C:\Windows\System\nSWTZHN.exe
  2⤵
  PID:8372
- C:\Windows\System\VzhUqkt.exe
  C:\Windows\System\VzhUqkt.exe
  2⤵
  PID:8476
- C:\Windows\System\gsZRrwL.exe
  C:\Windows\System\gsZRrwL.exe
  2⤵
  PID:8696
- C:\Windows\System\lbRyjZT.exe
  C:\Windows\System\lbRyjZT.exe
  2⤵
  PID:8756
- C:\Windows\System\YVYMqeM.exe
  C:\Windows\System\YVYMqeM.exe
  2⤵
  PID:8864
- C:\Windows\System\fUtVuhR.exe
  C:\Windows\System\fUtVuhR.exe
  2⤵
  PID:9020
- C:\Windows\System\TFfxNGc.exe
  C:\Windows\System\TFfxNGc.exe
  2⤵
  PID:9172
- C:\Windows\System\yxhJWRF.exe
  C:\Windows\System\yxhJWRF.exe
  2⤵
  PID:8652
- C:\Windows\System\PJzdnQR.exe
  C:\Windows\System\PJzdnQR.exe
  2⤵
  PID:9024
- C:\Windows\System\KMnkaxG.exe
  C:\Windows\System\KMnkaxG.exe
  2⤵
  PID:8388
- C:\Windows\System\IbLFanT.exe
  C:\Windows\System\IbLFanT.exe
  2⤵
  PID:8868
- C:\Windows\System\tWLFHYl.exe
  C:\Windows\System\tWLFHYl.exe
  2⤵
  PID:9228
- C:\Windows\System\LoHrYme.exe
  C:\Windows\System\LoHrYme.exe
  2⤵
  PID:9252
- C:\Windows\System\EOiOMKh.exe
  C:\Windows\System\EOiOMKh.exe
  2⤵
  PID:9284
- C:\Windows\System\eHzbUmn.exe
  C:\Windows\System\eHzbUmn.exe
  2⤵
  PID:9308
- C:\Windows\System\bONWKUk.exe
  C:\Windows\System\bONWKUk.exe
  2⤵
  PID:9340
- C:\Windows\System\TBHhhUQ.exe
  C:\Windows\System\TBHhhUQ.exe
  2⤵
  PID:9364
- C:\Windows\System\xgfickT.exe
  C:\Windows\System\xgfickT.exe
  2⤵
  PID:9392
- C:\Windows\System\ipIJMCz.exe
  C:\Windows\System\ipIJMCz.exe
  2⤵
  PID:9440
- C:\Windows\System\UkiYseQ.exe
  C:\Windows\System\UkiYseQ.exe
  2⤵
  PID:9468
- C:\Windows\System\eIiTTOY.exe
  C:\Windows\System\eIiTTOY.exe
  2⤵
  PID:9492
- C:\Windows\System\fBHMsjq.exe
  C:\Windows\System\fBHMsjq.exe
  2⤵
  PID:9516
- C:\Windows\System\HMYEBoO.exe
  C:\Windows\System\HMYEBoO.exe
  2⤵
  PID:9536
- C:\Windows\System\zfidggo.exe
  C:\Windows\System\zfidggo.exe
  2⤵
  PID:9552
- C:\Windows\System\kEcMXEh.exe
  C:\Windows\System\kEcMXEh.exe
  2⤵
  PID:9580
- C:\Windows\System\ZQSCibp.exe
  C:\Windows\System\ZQSCibp.exe
  2⤵
  PID:9608
- C:\Windows\System\CptMISL.exe
  C:\Windows\System\CptMISL.exe
  2⤵
  PID:9636
- C:\Windows\System\wxVNQdl.exe
  C:\Windows\System\wxVNQdl.exe
  2⤵
  PID:9664
- C:\Windows\System\YTARRkP.exe
  C:\Windows\System\YTARRkP.exe
  2⤵
  PID:9684
- C:\Windows\System\wJYVESh.exe
  C:\Windows\System\wJYVESh.exe
  2⤵
  PID:9736
- C:\Windows\System\rpJnUZA.exe
  C:\Windows\System\rpJnUZA.exe
  2⤵
  PID:9784
- C:\Windows\System\EyZfyiB.exe
  C:\Windows\System\EyZfyiB.exe
  2⤵
  PID:9812
- C:\Windows\System\fsJQELT.exe
  C:\Windows\System\fsJQELT.exe
  2⤵
  PID:9836
- C:\Windows\System\LvccIeN.exe
  C:\Windows\System\LvccIeN.exe
  2⤵
  PID:9860
- C:\Windows\System\kikRxPc.exe
  C:\Windows\System\kikRxPc.exe
  2⤵
  PID:9876
- C:\Windows\System\JkYexzj.exe
  C:\Windows\System\JkYexzj.exe
  2⤵
  PID:9900
- C:\Windows\System\PwTVTXD.exe
  C:\Windows\System\PwTVTXD.exe
  2⤵
  PID:9920
- C:\Windows\System\jGWMFlf.exe
  C:\Windows\System\jGWMFlf.exe
  2⤵
  PID:9972
- C:\Windows\System\CfPqscE.exe
  C:\Windows\System\CfPqscE.exe
  2⤵
  PID:10000
- C:\Windows\System\uaSsIos.exe
  C:\Windows\System\uaSsIos.exe
  2⤵
  PID:10016
- C:\Windows\System\tzKwhAr.exe
  C:\Windows\System\tzKwhAr.exe
  2⤵
  PID:10048
- C:\Windows\System\yMvSFti.exe
  C:\Windows\System\yMvSFti.exe
  2⤵
  PID:10076
- C:\Windows\System\hhDGofQ.exe
  C:\Windows\System\hhDGofQ.exe
  2⤵
  PID:10108
- C:\Windows\System\KsOMrJe.exe
  C:\Windows\System\KsOMrJe.exe
  2⤵
  PID:10128
- C:\Windows\System\TkbmwOO.exe
  C:\Windows\System\TkbmwOO.exe
  2⤵
  PID:10156
- C:\Windows\System\uCmsNgj.exe
  C:\Windows\System\uCmsNgj.exe
  2⤵
  PID:10184
- C:\Windows\System\vwNZwSa.exe
  C:\Windows\System\vwNZwSa.exe
  2⤵
  PID:10208
- C:\Windows\System\TSOUHHq.exe
  C:\Windows\System\TSOUHHq.exe
  2⤵
  PID:8672
- C:\Windows\System\pbhnAxK.exe
  C:\Windows\System\pbhnAxK.exe
  2⤵
  PID:9248
- C:\Windows\System\JEetdqO.exe
  C:\Windows\System\JEetdqO.exe
  2⤵
  PID:9352
- C:\Windows\System\wqqDMTB.exe
  C:\Windows\System\wqqDMTB.exe
  2⤵
  PID:9384
- C:\Windows\System\ZWOpkmf.exe
  C:\Windows\System\ZWOpkmf.exe
  2⤵
  PID:9452
- C:\Windows\System\pKrPgaj.exe
  C:\Windows\System\pKrPgaj.exe
  2⤵
  PID:9512
- C:\Windows\System\hXrxSgQ.exe
  C:\Windows\System\hXrxSgQ.exe
  2⤵
  PID:9576
- C:\Windows\System\ctmyHQq.exe
  C:\Windows\System\ctmyHQq.exe
  2⤵
  PID:9704
- C:\Windows\System\HWdtnVb.exe
  C:\Windows\System\HWdtnVb.exe
  2⤵
  PID:9696
- C:\Windows\System\hBNyZyl.exe
  C:\Windows\System\hBNyZyl.exe
  2⤵
  PID:9780
- C:\Windows\System\xyzOlUz.exe
  C:\Windows\System\xyzOlUz.exe
  2⤵
  PID:9888
- C:\Windows\System\JXUkreZ.exe
  C:\Windows\System\JXUkreZ.exe
  2⤵
  PID:9940
- C:\Windows\System\pABjpzt.exe
  C:\Windows\System\pABjpzt.exe
  2⤵
  PID:9992
- C:\Windows\System\jHYTcXx.exe
  C:\Windows\System\jHYTcXx.exe
  2⤵
  PID:10096
- C:\Windows\System\vmdufsB.exe
  C:\Windows\System\vmdufsB.exe
  2⤵
  PID:10144
- C:\Windows\System\MJLxFsZ.exe
  C:\Windows\System\MJLxFsZ.exe
  2⤵
  PID:10196
- C:\Windows\System\jfiFiql.exe
  C:\Windows\System\jfiFiql.exe
  2⤵
  PID:9324
- C:\Windows\System\snBFPha.exe
  C:\Windows\System\snBFPha.exe
  2⤵
  PID:9420
- C:\Windows\System\fMsmakP.exe
  C:\Windows\System\fMsmakP.exe
  2⤵
  PID:9596
- C:\Windows\System\TBYFHJr.exe
  C:\Windows\System\TBYFHJr.exe
  2⤵
  PID:9756
- C:\Windows\System\appreFc.exe
  C:\Windows\System\appreFc.exe
  2⤵
  PID:9844
- C:\Windows\System\MOLZOHk.exe
  C:\Windows\System\MOLZOHk.exe
  2⤵
  PID:10008
- C:\Windows\System\RuNQTWS.exe
  C:\Windows\System\RuNQTWS.exe
  2⤵
  PID:10168
- C:\Windows\System\uePPwpU.exe
  C:\Windows\System\uePPwpU.exe
  2⤵
  PID:9416
- C:\Windows\System\eyvfcVW.exe
  C:\Windows\System\eyvfcVW.exe
  2⤵
  PID:9856
- C:\Windows\System\CAHzDKg.exe
  C:\Windows\System\CAHzDKg.exe
  2⤵
  PID:10036
- C:\Windows\System\WuVTJxs.exe
  C:\Windows\System\WuVTJxs.exe
  2⤵
  PID:9776
- C:\Windows\System\MDYgQCq.exe
  C:\Windows\System\MDYgQCq.exe
  2⤵
  PID:10244
- C:\Windows\System\kXpkEyQ.exe
  C:\Windows\System\kXpkEyQ.exe
  2⤵
  PID:10268
- C:\Windows\System\SogYDBL.exe
  C:\Windows\System\SogYDBL.exe
  2⤵
  PID:10292
- C:\Windows\System\XUxAyUH.exe
  C:\Windows\System\XUxAyUH.exe
  2⤵
  PID:10312
- C:\Windows\System\veOGxil.exe
  C:\Windows\System\veOGxil.exe
  2⤵
  PID:10332
- C:\Windows\System\LMWBVns.exe
  C:\Windows\System\LMWBVns.exe
  2⤵
  PID:10364
- C:\Windows\System\HdZETMo.exe
  C:\Windows\System\HdZETMo.exe
  2⤵
  PID:10384
- C:\Windows\System\qHxQUIs.exe
  C:\Windows\System\qHxQUIs.exe
  2⤵
  PID:10412
- C:\Windows\System\OyMGmRf.exe
  C:\Windows\System\OyMGmRf.exe
  2⤵
  PID:10452
- C:\Windows\System\ZIaRwCW.exe
  C:\Windows\System\ZIaRwCW.exe
  2⤵
  PID:10492
- C:\Windows\System\wCGviiK.exe
  C:\Windows\System\wCGviiK.exe
  2⤵
  PID:10516
- C:\Windows\System\kOpQgnq.exe
  C:\Windows\System\kOpQgnq.exe
  2⤵
  PID:10540
- C:\Windows\System\tpDZJKp.exe
  C:\Windows\System\tpDZJKp.exe
  2⤵
  PID:10564
- C:\Windows\System\ZSqQSxN.exe
  C:\Windows\System\ZSqQSxN.exe
  2⤵
  PID:10584
- C:\Windows\System\HXuoodE.exe
  C:\Windows\System\HXuoodE.exe
  2⤵
  PID:10608
- C:\Windows\System\KILPqwX.exe
  C:\Windows\System\KILPqwX.exe
  2⤵
  PID:10632
- C:\Windows\System\XPpwOKq.exe
  C:\Windows\System\XPpwOKq.exe
  2⤵
  PID:10660
- C:\Windows\System\CyHaVCc.exe
  C:\Windows\System\CyHaVCc.exe
  2⤵
  PID:10684
- C:\Windows\System\OykuEzn.exe
  C:\Windows\System\OykuEzn.exe
  2⤵
  PID:10748
- C:\Windows\System\LQSSHuG.exe
  C:\Windows\System\LQSSHuG.exe
  2⤵
  PID:10772
- C:\Windows\System\zfKQxXQ.exe
  C:\Windows\System\zfKQxXQ.exe
  2⤵
  PID:10800
- C:\Windows\System\aIcuTUa.exe
  C:\Windows\System\aIcuTUa.exe
  2⤵
  PID:10816
- C:\Windows\System\YBbODTb.exe
  C:\Windows\System\YBbODTb.exe
  2⤵
  PID:10840
- C:\Windows\System\CeqsicE.exe
  C:\Windows\System\CeqsicE.exe
  2⤵
  PID:10868
- C:\Windows\System\MVyjDCP.exe
  C:\Windows\System\MVyjDCP.exe
  2⤵
  PID:10888
- C:\Windows\System\ZPSwRMD.exe
  C:\Windows\System\ZPSwRMD.exe
  2⤵
  PID:10948
- C:\Windows\System\OxPmPsC.exe
  C:\Windows\System\OxPmPsC.exe
  2⤵
  PID:10968
- C:\Windows\System\FAdUXwY.exe
  C:\Windows\System\FAdUXwY.exe
  2⤵
  PID:10996
- C:\Windows\System\KDCEBTd.exe
  C:\Windows\System\KDCEBTd.exe
  2⤵
  PID:11024
- C:\Windows\System\OZrwhvF.exe
  C:\Windows\System\OZrwhvF.exe
  2⤵
  PID:11064
- C:\Windows\System\eMyRBug.exe
  C:\Windows\System\eMyRBug.exe
  2⤵
  PID:11084
- C:\Windows\System\SpZZcZq.exe
  C:\Windows\System\SpZZcZq.exe
  2⤵
  PID:11108
- C:\Windows\System\BQFZlKC.exe
  C:\Windows\System\BQFZlKC.exe
  2⤵
  PID:11136
- C:\Windows\System\mzNrKjW.exe
  C:\Windows\System\mzNrKjW.exe
  2⤵
  PID:11172
- C:\Windows\System\eSLRhMD.exe
  C:\Windows\System\eSLRhMD.exe
  2⤵
  PID:11192
- C:\Windows\System\nCKeWdb.exe
  C:\Windows\System\nCKeWdb.exe
  2⤵
  PID:11212
- C:\Windows\System\zDaljsz.exe
  C:\Windows\System\zDaljsz.exe
  2⤵
  PID:11244
- C:\Windows\System\dfpPGrU.exe
  C:\Windows\System\dfpPGrU.exe
  2⤵
  PID:9672
- C:\Windows\System\FUlXaCp.exe
  C:\Windows\System\FUlXaCp.exe
  2⤵
  PID:10308
- C:\Windows\System\QIHlHIr.exe
  C:\Windows\System\QIHlHIr.exe
  2⤵
  PID:10348
- C:\Windows\System\ptZHANF.exe
  C:\Windows\System\ptZHANF.exe
  2⤵
  PID:10392
- C:\Windows\System\OiEjtIN.exe
  C:\Windows\System\OiEjtIN.exe
  2⤵
  PID:10432
- C:\Windows\System\qkpfzLM.exe
  C:\Windows\System\qkpfzLM.exe
  2⤵
  PID:10500
- C:\Windows\System\axvGPUD.exe
  C:\Windows\System\axvGPUD.exe
  2⤵
  PID:10512
- C:\Windows\System\FddmuSC.exe
  C:\Windows\System\FddmuSC.exe
  2⤵
  PID:10628
- C:\Windows\System\uHhGQQI.exe
  C:\Windows\System\uHhGQQI.exe
  2⤵
  PID:10692
- C:\Windows\System\WaQaoDp.exe
  C:\Windows\System\WaQaoDp.exe
  2⤵
  PID:10808
- C:\Windows\System\ciFmVyo.exe
  C:\Windows\System\ciFmVyo.exe
  2⤵
  PID:10832
- C:\Windows\System\IZtwGKu.exe
  C:\Windows\System\IZtwGKu.exe
  2⤵
  PID:10880
- C:\Windows\System\pzUMpjJ.exe
  C:\Windows\System\pzUMpjJ.exe
  2⤵
  PID:10956
- C:\Windows\System\aDjuFNR.exe
  C:\Windows\System\aDjuFNR.exe
  2⤵
  PID:11016
- C:\Windows\System\ELfWQLQ.exe
  C:\Windows\System\ELfWQLQ.exe
  2⤵
  PID:11072
- C:\Windows\System\EPmvrDt.exe
  C:\Windows\System\EPmvrDt.exe
  2⤵
  PID:11168
- C:\Windows\System\HNnsPVZ.exe
  C:\Windows\System\HNnsPVZ.exe
  2⤵
  PID:10252
- C:\Windows\System\dtCcfGu.exe
  C:\Windows\System\dtCcfGu.exe
  2⤵
  PID:10320
- C:\Windows\System\fAagBZK.exe
  C:\Windows\System\fAagBZK.exe
  2⤵
  PID:10444
- C:\Windows\System\nFCIKDq.exe
  C:\Windows\System\nFCIKDq.exe
  2⤵
  PID:10600
- C:\Windows\System\KwdCugo.exe
  C:\Windows\System\KwdCugo.exe
  2⤵
  PID:10756
- C:\Windows\System\BTkuaUk.exe
  C:\Windows\System\BTkuaUk.exe
  2⤵
  PID:10936
- C:\Windows\System\LtGNRfe.exe
  C:\Windows\System\LtGNRfe.exe
  2⤵
  PID:11012
- C:\Windows\System\YQrEUkK.exe
  C:\Windows\System\YQrEUkK.exe
  2⤵
  PID:11228
- C:\Windows\System\XCPOCqo.exe
  C:\Windows\System\XCPOCqo.exe
  2⤵
  PID:10468
- C:\Windows\System\BfPraQi.exe
  C:\Windows\System\BfPraQi.exe
  2⤵
  PID:11092
- C:\Windows\System\ZidbnOj.exe
  C:\Windows\System\ZidbnOj.exe
  2⤵
  PID:10964
- C:\Windows\System\ylTXtBO.exe
  C:\Windows\System\ylTXtBO.exe
  2⤵
  PID:11284
- C:\Windows\System\VdZZyrl.exe
  C:\Windows\System\VdZZyrl.exe
  2⤵
  PID:11312
- C:\Windows\System\yswNVWt.exe
  C:\Windows\System\yswNVWt.exe
  2⤵
  PID:11328
- C:\Windows\System\ykEBuUM.exe
  C:\Windows\System\ykEBuUM.exe
  2⤵
  PID:11356
- C:\Windows\System\rxCXotZ.exe
  C:\Windows\System\rxCXotZ.exe
  2⤵
  PID:11384
- C:\Windows\System\ssalrkb.exe
  C:\Windows\System\ssalrkb.exe
  2⤵
  PID:11412
- C:\Windows\System\PTAhaze.exe
  C:\Windows\System\PTAhaze.exe
  2⤵
  PID:11440
- C:\Windows\System\GtBGnWW.exe
  C:\Windows\System\GtBGnWW.exe
  2⤵
  PID:11480
- C:\Windows\System\USegzeA.exe
  C:\Windows\System\USegzeA.exe
  2⤵
  PID:11508
- C:\Windows\System\acWseVf.exe
  C:\Windows\System\acWseVf.exe
  2⤵
  PID:11528
- C:\Windows\System\YEhXcAt.exe
  C:\Windows\System\YEhXcAt.exe
  2⤵
  PID:11556
- C:\Windows\System\MAkbKps.exe
  C:\Windows\System\MAkbKps.exe
  2⤵
  PID:11580
- C:\Windows\System\vgmEGPb.exe
  C:\Windows\System\vgmEGPb.exe
  2⤵
  PID:11608
- C:\Windows\System\WsJuwqq.exe
  C:\Windows\System\WsJuwqq.exe
  2⤵
  PID:11632
- C:\Windows\System\avVbKpW.exe
  C:\Windows\System\avVbKpW.exe
  2⤵
  PID:11676
- C:\Windows\System\RrbwZqe.exe
  C:\Windows\System\RrbwZqe.exe
  2⤵
  PID:11704
- C:\Windows\System\pgIEBzO.exe
  C:\Windows\System\pgIEBzO.exe
  2⤵
  PID:11732
- C:\Windows\System\UgKGImN.exe
  C:\Windows\System\UgKGImN.exe
  2⤵
  PID:11760
- C:\Windows\System\CfWfXcH.exe
  C:\Windows\System\CfWfXcH.exe
  2⤵
  PID:11784
- C:\Windows\System\yXFBDBH.exe
  C:\Windows\System\yXFBDBH.exe
  2⤵
  PID:11816
- C:\Windows\System\qGMWjAn.exe
  C:\Windows\System\qGMWjAn.exe
  2⤵
  PID:12032
- C:\Windows\System\yWyghIo.exe
  C:\Windows\System\yWyghIo.exe
  2⤵
  PID:12056
- C:\Windows\System\UoijcJy.exe
  C:\Windows\System\UoijcJy.exe
  2⤵
  PID:12084
- C:\Windows\System\izHYfcH.exe
  C:\Windows\System\izHYfcH.exe
  2⤵
  PID:12112
- C:\Windows\System\EfHtMDr.exe
  C:\Windows\System\EfHtMDr.exe
  2⤵
  PID:12140
- C:\Windows\System\VfBoKpy.exe
  C:\Windows\System\VfBoKpy.exe
  2⤵
  PID:12172
- C:\Windows\System\uppnOTB.exe
  C:\Windows\System\uppnOTB.exe
  2⤵
  PID:12196
- C:\Windows\System\OYUiyan.exe
  C:\Windows\System\OYUiyan.exe
  2⤵
  PID:12224
- C:\Windows\System\CbXgVFc.exe
  C:\Windows\System\CbXgVFc.exe
  2⤵
  PID:12264
- C:\Windows\System\ErjJFuE.exe
  C:\Windows\System\ErjJFuE.exe
  2⤵
  PID:12280
- C:\Windows\System\rOqMKjD.exe
  C:\Windows\System\rOqMKjD.exe
  2⤵
  PID:11272
- C:\Windows\System\XRfZyrM.exe
  C:\Windows\System\XRfZyrM.exe
  2⤵
  PID:11300
- C:\Windows\System\OGGcDeX.exe
  C:\Windows\System\OGGcDeX.exe
  2⤵
  PID:11368
- C:\Windows\System\GkpTrsx.exe
  C:\Windows\System\GkpTrsx.exe
  2⤵
  PID:11404
- C:\Windows\System\sPmIhzB.exe
  C:\Windows\System\sPmIhzB.exe
  2⤵
  PID:11492
- C:\Windows\System\ggdGJNN.exe
  C:\Windows\System\ggdGJNN.exe
  2⤵
  PID:11552
- C:\Windows\System\PXozKVb.exe
  C:\Windows\System\PXozKVb.exe
  2⤵
  PID:11620
- C:\Windows\System\VDqDMEe.exe
  C:\Windows\System\VDqDMEe.exe
  2⤵
  PID:11716
- C:\Windows\System\EqWOrir.exe
  C:\Windows\System\EqWOrir.exe
  2⤵
  PID:11824
- C:\Windows\System\UwbFIgR.exe
  C:\Windows\System\UwbFIgR.exe
  2⤵
  PID:11840
- C:\Windows\System\LWmerAX.exe
  C:\Windows\System\LWmerAX.exe
  2⤵
  PID:11868
- C:\Windows\System\jnHrjUw.exe
  C:\Windows\System\jnHrjUw.exe
  2⤵
  PID:11916
- C:\Windows\System\lhBnJtF.exe
  C:\Windows\System\lhBnJtF.exe
  2⤵
  PID:12020
- C:\Windows\System\yLBmBoV.exe
  C:\Windows\System\yLBmBoV.exe
  2⤵
  PID:12052
- C:\Windows\System\wCJwRbe.exe
  C:\Windows\System\wCJwRbe.exe
  2⤵
  PID:12096
- C:\Windows\System\oXHObYW.exe
  C:\Windows\System\oXHObYW.exe
  2⤵
  PID:12152
- C:\Windows\System\HIzvOff.exe
  C:\Windows\System\HIzvOff.exe
  2⤵
  PID:12180
- C:\Windows\System\iJWjIcu.exe
  C:\Windows\System\iJWjIcu.exe
  2⤵
  PID:12188
- C:\Windows\System\pCxEQwQ.exe
  C:\Windows\System\pCxEQwQ.exe
  2⤵
  PID:12260
- C:\Windows\System\VUjmmrv.exe
  C:\Windows\System\VUjmmrv.exe
  2⤵
  PID:11304
- C:\Windows\System\PuluNwW.exe
  C:\Windows\System\PuluNwW.exe
  2⤵
  PID:11428
- C:\Windows\System\kNPAvyK.exe
  C:\Windows\System\kNPAvyK.exe
  2⤵
  PID:11340
- C:\Windows\System\rfXuiuH.exe
  C:\Windows\System\rfXuiuH.exe
  2⤵
  PID:11600
- C:\Windows\System\RGyvUNp.exe
  C:\Windows\System\RGyvUNp.exe
  2⤵
  PID:11776
- C:\Windows\System\BVDqsaw.exe
  C:\Windows\System\BVDqsaw.exe
  2⤵
  PID:11856
- C:\Windows\System\ojSOkzJ.exe
  C:\Windows\System\ojSOkzJ.exe
  2⤵
  PID:11944
- C:\Windows\System\IFaQlrL.exe
  C:\Windows\System\IFaQlrL.exe
  2⤵
  PID:11948
- C:\Windows\System\OEeXkTi.exe
  C:\Windows\System\OEeXkTi.exe
  2⤵
  PID:12000
- C:\Windows\System\gSIrtgW.exe
  C:\Windows\System\gSIrtgW.exe
  2⤵
  PID:10644
- C:\Windows\System\IpfQdat.exe
  C:\Windows\System\IpfQdat.exe
  2⤵
  PID:11976
- C:\Windows\System\mMXXvej.exe
  C:\Windows\System\mMXXvej.exe
  2⤵
  PID:11688
- C:\Windows\System\NSmwEkb.exe
  C:\Windows\System\NSmwEkb.exe
  2⤵
  PID:12040
- C:\Windows\System\oEYaldi.exe
  C:\Windows\System\oEYaldi.exe
  2⤵
  PID:12124
- C:\Windows\System\hSTnFon.exe
  C:\Windows\System\hSTnFon.exe
  2⤵
  PID:12324
- C:\Windows\System\ezpeSuu.exe
  C:\Windows\System\ezpeSuu.exe
  2⤵
  PID:12352
- C:\Windows\System\XYxQikZ.exe
  C:\Windows\System\XYxQikZ.exe
  2⤵
  PID:12380
- C:\Windows\System\YXOaErn.exe
  C:\Windows\System\YXOaErn.exe
  2⤵
  PID:12396
- C:\Windows\System\oMlEvvc.exe
  C:\Windows\System\oMlEvvc.exe
  2⤵
  PID:12420
- C:\Windows\System\bOqGVEs.exe
  C:\Windows\System\bOqGVEs.exe
  2⤵
  PID:12452
- C:\Windows\System\GoxFJNU.exe
  C:\Windows\System\GoxFJNU.exe
  2⤵
  PID:12468
- C:\Windows\System\exjozZT.exe
  C:\Windows\System\exjozZT.exe
  2⤵
  PID:12492
- C:\Windows\System\adgYqYN.exe
  C:\Windows\System\adgYqYN.exe
  2⤵
  PID:12524
- C:\Windows\System\vFfygzp.exe
  C:\Windows\System\vFfygzp.exe
  2⤵
  PID:12548
- C:\Windows\System\PqrcFHe.exe
  C:\Windows\System\PqrcFHe.exe
  2⤵
  PID:12592
- C:\Windows\System\VMPLmSU.exe
  C:\Windows\System\VMPLmSU.exe
  2⤵
  PID:12608
- C:\Windows\System\wfYQRSC.exe
  C:\Windows\System\wfYQRSC.exe
  2⤵
  PID:12636
- C:\Windows\System\dTKtkQP.exe
  C:\Windows\System\dTKtkQP.exe
  2⤵
  PID:12660
- C:\Windows\System\oyvZuRI.exe
  C:\Windows\System\oyvZuRI.exe
  2⤵
  PID:12716
- C:\Windows\System\hohHPRa.exe
  C:\Windows\System\hohHPRa.exe
  2⤵
  PID:12736
- C:\Windows\System\xqdRcNC.exe
  C:\Windows\System\xqdRcNC.exe
  2⤵
  PID:12764
- C:\Windows\System\hVOYrhW.exe
  C:\Windows\System\hVOYrhW.exe
  2⤵
  PID:12804
- C:\Windows\System\Zrhswmk.exe
  C:\Windows\System\Zrhswmk.exe
  2⤵
  PID:12832
- C:\Windows\System\HfLBhaR.exe
  C:\Windows\System\HfLBhaR.exe
  2⤵
  PID:12860
- C:\Windows\System\koQLpLu.exe
  C:\Windows\System\koQLpLu.exe
  2⤵
  PID:12888
- C:\Windows\System\NGyHzcp.exe
  C:\Windows\System\NGyHzcp.exe
  2⤵
  PID:12908
- C:\Windows\System\niOPetv.exe
  C:\Windows\System\niOPetv.exe
  2⤵
  PID:12948
- C:\Windows\System\twlOSbA.exe
  C:\Windows\System\twlOSbA.exe
  2⤵
  PID:12964
- C:\Windows\System\tcjAgVu.exe
  C:\Windows\System\tcjAgVu.exe
  2⤵
  PID:12992
- C:\Windows\System\TomDZRA.exe
  C:\Windows\System\TomDZRA.exe
  2⤵
  PID:13012
- C:\Windows\System\ATUCQBc.exe
  C:\Windows\System\ATUCQBc.exe
  2⤵
  PID:13036
- C:\Windows\System\UMzpNzg.exe
  C:\Windows\System\UMzpNzg.exe
  2⤵
  PID:13060
- C:\Windows\System\PMozTDw.exe
  C:\Windows\System\PMozTDw.exe
  2⤵
  PID:13088
- C:\Windows\System\OJYZeHq.exe
  C:\Windows\System\OJYZeHq.exe
  2⤵
  PID:13116
- C:\Windows\System\TglBcfz.exe
  C:\Windows\System\TglBcfz.exe
  2⤵
  PID:13160
- C:\Windows\System\zxPZZgk.exe
  C:\Windows\System\zxPZZgk.exe
  2⤵
  PID:13184
- C:\Windows\System\awCFvlG.exe
  C:\Windows\System\awCFvlG.exe
  2⤵
  PID:13216
- C:\Windows\System\gfNfgYy.exe
  C:\Windows\System\gfNfgYy.exe
  2⤵
  PID:13232
- C:\Windows\System\FKxZuYi.exe
  C:\Windows\System\FKxZuYi.exe
  2⤵
  PID:13260
- C:\Windows\System\OzwcNjb.exe
  C:\Windows\System\OzwcNjb.exe
  2⤵
  PID:13288
- C:\Windows\System\cvqXFjK.exe
  C:\Windows\System\cvqXFjK.exe
  2⤵
  PID:11924
- C:\Windows\System\XdHvApZ.exe
  C:\Windows\System\XdHvApZ.exe
  2⤵
  PID:11396
- C:\Windows\System\DeaLOOh.exe
  C:\Windows\System\DeaLOOh.exe
  2⤵
  PID:12344
- C:\Windows\System\AtnCcmj.exe
  C:\Windows\System\AtnCcmj.exe
  2⤵
  PID:12376
- C:\Windows\System\SytZFxE.exe
  C:\Windows\System\SytZFxE.exe
  2⤵
  PID:12432
- C:\Windows\System\TLvaKgs.exe
  C:\Windows\System\TLvaKgs.exe
  2⤵
  PID:12540
- C:\Windows\System\nZGRnsr.exe
  C:\Windows\System\nZGRnsr.exe
  2⤵
  PID:12628
- C:\Windows\System\BxzLjsi.exe
  C:\Windows\System\BxzLjsi.exe
  2⤵
  PID:12652
- C:\Windows\System\uLXweLC.exe
  C:\Windows\System\uLXweLC.exe
  2⤵
  PID:12732
- C:\Windows\System\scJgDjY.exe
  C:\Windows\System\scJgDjY.exe
  2⤵
  PID:12800
- C:\Windows\System\zpAbzpU.exe
  C:\Windows\System\zpAbzpU.exe
  2⤵
  PID:12904
- C:\Windows\System\PEozNOJ.exe
  C:\Windows\System\PEozNOJ.exe
  2⤵
  PID:12940
- C:\Windows\System\pvFgiMM.exe
  C:\Windows\System\pvFgiMM.exe
  2⤵
  PID:13008
- C:\Windows\System\cJEoOiz.exe
  C:\Windows\System\cJEoOiz.exe
  2⤵
  PID:13056
- C:\Windows\System\ACKnNSU.exe
  C:\Windows\System\ACKnNSU.exe
  2⤵
  PID:13156
- C:\Windows\System\ZghtdBD.exe
  C:\Windows\System\ZghtdBD.exe
  2⤵
  PID:13228
- C:\Windows\System\wEyIYcP.exe
  C:\Windows\System\wEyIYcP.exe
  2⤵
  PID:13248
- C:\Windows\System\tzbEDME.exe
  C:\Windows\System\tzbEDME.exe
  2⤵
  PID:12460
- C:\Windows\System\lSrOlni.exe
  C:\Windows\System\lSrOlni.exe
  2⤵
  PID:12484
- C:\Windows\System\SZUKvdZ.exe
  C:\Windows\System\SZUKvdZ.exe
  2⤵
  PID:12444
- C:\Windows\System\fZacfid.exe
  C:\Windows\System\fZacfid.exe
  2⤵
  PID:12708
- C:\Windows\System\wDBgAbU.exe
  C:\Windows\System\wDBgAbU.exe
  2⤵
  PID:12848
- C:\Windows\System\ldvKfYf.exe
  C:\Windows\System\ldvKfYf.exe
  2⤵
  PID:13100
- C:\Windows\System\FVqkMwM.exe
  C:\Windows\System\FVqkMwM.exe
  2⤵
  PID:13208
- C:\Windows\System\VWNyrBq.exe
  C:\Windows\System\VWNyrBq.exe
  2⤵
  PID:12340
- C:\Windows\System\nsIETjG.exe
  C:\Windows\System\nsIETjG.exe
  2⤵
  PID:12688
- C:\Windows\System\SwrvpHX.exe
  C:\Windows\System\SwrvpHX.exe
  2⤵
  PID:12984
- C:\Windows\System\CxVWrkB.exe
  C:\Windows\System\CxVWrkB.exe
  2⤵
  PID:12156
- C:\Windows\System\eFEPWHv.exe
  C:\Windows\System\eFEPWHv.exe
  2⤵
  PID:12692
- C:\Windows\System\DzlRbAj.exe
  C:\Windows\System\DzlRbAj.exe
  2⤵
  PID:13316
- C:\Windows\System\UQaGDYg.exe
  C:\Windows\System\UQaGDYg.exe
  2⤵
  PID:13372
- C:\Windows\System\TYfESyG.exe
  C:\Windows\System\TYfESyG.exe
  2⤵
  PID:13400
- C:\Windows\System\ulmgSWW.exe
  C:\Windows\System\ulmgSWW.exe
  2⤵
  PID:13432
- C:\Windows\System\vAbfDdh.exe
  C:\Windows\System\vAbfDdh.exe
  2⤵
  PID:13460
- C:\Windows\System\abONGgp.exe
  C:\Windows\System\abONGgp.exe
  2⤵
  PID:13488
- C:\Windows\System\JNjCiVf.exe
  C:\Windows\System\JNjCiVf.exe
  2⤵
  PID:13516
- C:\Windows\System\ZliDRrA.exe
  C:\Windows\System\ZliDRrA.exe
  2⤵
  PID:13532
- C:\Windows\System\LEKIUSs.exe
  C:\Windows\System\LEKIUSs.exe
  2⤵
  PID:13552
- C:\Windows\System\Hccbicf.exe
  C:\Windows\System\Hccbicf.exe
  2⤵
  PID:13572
- C:\Windows\System\ozTfMlE.exe
  C:\Windows\System\ozTfMlE.exe
  2⤵
  PID:13600
- C:\Windows\System\IYQTyPF.exe
  C:\Windows\System\IYQTyPF.exe
  2⤵
  PID:13644
- C:\Windows\System\KkilRUm.exe
  C:\Windows\System\KkilRUm.exe
  2⤵
  PID:13660
- C:\Windows\System\smLMTES.exe
  C:\Windows\System\smLMTES.exe
  2⤵
  PID:13680
- C:\Windows\System\vJyChbQ.exe
  C:\Windows\System\vJyChbQ.exe
  2⤵
  PID:13728
- C:\Windows\System\TDiCSJz.exe
  C:\Windows\System\TDiCSJz.exe
  2⤵
  PID:13748
- C:\Windows\System\DYeBpEP.exe
  C:\Windows\System\DYeBpEP.exe
  2⤵
  PID:13800
- C:\Windows\System\WklMhUz.exe
  C:\Windows\System\WklMhUz.exe
  2⤵
  PID:13824
- C:\Windows\System\WnviLpS.exe
  C:\Windows\System\WnviLpS.exe
  2⤵
  PID:13840
- C:\Windows\System\KSISsEg.exe
  C:\Windows\System\KSISsEg.exe
  2⤵
  PID:13864
- C:\Windows\System\LriOFsp.exe
  C:\Windows\System\LriOFsp.exe
  2⤵
  PID:13908
- C:\Windows\System\pOdquDi.exe
  C:\Windows\System\pOdquDi.exe
  2⤵
  PID:13924
- C:\Windows\System\AQxOKMc.exe
  C:\Windows\System\AQxOKMc.exe
  2⤵
  PID:13940
- C:\Windows\System\ZrqEVKi.exe
  C:\Windows\System\ZrqEVKi.exe
  2⤵
  PID:13980
- C:\Windows\System\XAlVVMa.exe
  C:\Windows\System\XAlVVMa.exe
  2⤵
  PID:14020
- C:\Windows\System\whjfQAw.exe
  C:\Windows\System\whjfQAw.exe
  2⤵
  PID:14048
- C:\Windows\System\HGOGAHs.exe
  C:\Windows\System\HGOGAHs.exe
  2⤵
  PID:14076
- C:\Windows\System\oWQJhUp.exe
  C:\Windows\System\oWQJhUp.exe
  2⤵
  PID:14100
- C:\Windows\System\BQVBpbT.exe
  C:\Windows\System\BQVBpbT.exe
  2⤵
  PID:14132
- C:\Windows\System\UECyXZP.exe
  C:\Windows\System\UECyXZP.exe
  2⤵
  PID:14160
- C:\Windows\System\UtxAtXx.exe
  C:\Windows\System\UtxAtXx.exe
  2⤵
  PID:14180
- C:\Windows\System\urVdlNM.exe
  C:\Windows\System\urVdlNM.exe
  2⤵
  PID:14208
- C:\Windows\System\cLDGVuR.exe
  C:\Windows\System\cLDGVuR.exe
  2⤵
  PID:14236
- C:\Windows\System\QEWOaHC.exe
  C:\Windows\System\QEWOaHC.exe
  2⤵
  PID:14280
- C:\Windows\System\zGYzhcC.exe
  C:\Windows\System\zGYzhcC.exe
  2⤵
  PID:14300
- C:\Windows\System\ojXjzBx.exe
  C:\Windows\System\ojXjzBx.exe
  2⤵
  PID:14328
- C:\Windows\System\vreaDMu.exe
  C:\Windows\System\vreaDMu.exe
  2⤵
  PID:13328
- C:\Windows\System\yNUXfCl.exe
  C:\Windows\System\yNUXfCl.exe
  2⤵
  PID:13396
- C:\Windows\System\uFJUcca.exe
  C:\Windows\System\uFJUcca.exe
  2⤵
  PID:13444
- C:\Windows\System\ZfepZPg.exe
  C:\Windows\System\ZfepZPg.exe
  2⤵
  PID:13512
- C:\Windows\System\IfFOgRj.exe
  C:\Windows\System\IfFOgRj.exe
  2⤵
  PID:13596
- C:\Windows\System\HouRRnM.exe
  C:\Windows\System\HouRRnM.exe
  2⤵
  PID:13628
- C:\Windows\System\nodPAgB.exe
  C:\Windows\System\nodPAgB.exe
  2⤵
  PID:13704
- C:\Windows\System\ZEpwXxt.exe
  C:\Windows\System\ZEpwXxt.exe
  2⤵
  PID:13808
- C:\Windows\System\ffZrWiA.exe
  C:\Windows\System\ffZrWiA.exe
  2⤵
  PID:13896
- C:\Windows\System\vfEsGzH.exe
  C:\Windows\System\vfEsGzH.exe
  2⤵
  PID:13952
- C:\Windows\System\zQUxGAZ.exe
  C:\Windows\System\zQUxGAZ.exe
  2⤵
  PID:14012
- C:\Windows\System\WQPdcZf.exe
  C:\Windows\System\WQPdcZf.exe
  2⤵
  PID:14068
- C:\Windows\System\RlWFYmi.exe
  C:\Windows\System\RlWFYmi.exe
  2⤵
  PID:14120
- C:\Windows\System\TpmGlYM.exe
  C:\Windows\System\TpmGlYM.exe
  2⤵
  PID:14204
- C:\Windows\System\BhYNlGu.exe
  C:\Windows\System\BhYNlGu.exe
  2⤵
  PID:14232
- C:\Windows\System\otHHKAK.exe
  C:\Windows\System\otHHKAK.exe
  2⤵
  PID:13344
- C:\Windows\System\AdJktZb.exe
  C:\Windows\System\AdJktZb.exe
  2⤵
  PID:13392
- C:\Windows\System\TtHRZJg.exe
  C:\Windows\System\TtHRZJg.exe
  2⤵
  PID:13588
- C:\Windows\System\dSOYsvU.exe
  C:\Windows\System\dSOYsvU.exe
  2⤵
  PID:13656
- C:\Windows\System\QmTzBii.exe
  C:\Windows\System\QmTzBii.exe
  2⤵
  PID:13860
- C:\Windows\System\xpCwWJJ.exe
  C:\Windows\System\xpCwWJJ.exe
  2⤵
  PID:14056
- C:\Windows\System\wkxAoVr.exe
  C:\Windows\System\wkxAoVr.exe
  2⤵
  PID:14220
- C:\Windows\System\PDjmKdm.exe
  C:\Windows\System\PDjmKdm.exe
  2⤵
  PID:12788
- C:\Windows\System\lQoBuPx.exe
  C:\Windows\System\lQoBuPx.exe
  2⤵
  PID:13620
- C:\Windows\System\IeuLkbo.exe
  C:\Windows\System\IeuLkbo.exe
  2⤵
  PID:14008
- C:\Windows\System\XGYqGAj.exe
  C:\Windows\System\XGYqGAj.exe
  2⤵
  PID:14296
- C:\Windows\System\YAvkOTX.exe
  C:\Windows\System\YAvkOTX.exe
  2⤵
  PID:14116
- C:\Windows\System\BPkTPjI.exe
  C:\Windows\System\BPkTPjI.exe
  2⤵
  PID:14360
- C:\Windows\System\KHshUjY.exe
  C:\Windows\System\KHshUjY.exe
  2⤵
  PID:14388
- C:\Windows\System\NqDtiWV.exe
  C:\Windows\System\NqDtiWV.exe
  2⤵
  PID:14424
- C:\Windows\System\sFnqjFF.exe
  C:\Windows\System\sFnqjFF.exe
  2⤵
  PID:14444
- C:\Windows\System\gAXrzTL.exe
  C:\Windows\System\gAXrzTL.exe
  2⤵
  PID:14472
- C:\Windows\System\GDNXzqC.exe
  C:\Windows\System\GDNXzqC.exe
  2⤵
  PID:14500
- C:\Windows\System\YFlRIcX.exe
  C:\Windows\System\YFlRIcX.exe
  2⤵
  PID:14524
- C:\Windows\System\opXVKSp.exe
  C:\Windows\System\opXVKSp.exe
  2⤵
  PID:14556
- C:\Windows\System\dQmlHQc.exe
  C:\Windows\System\dQmlHQc.exe
  2⤵
  PID:14584
- C:\Windows\System\itwyZSG.exe
  C:\Windows\System\itwyZSG.exe
  2⤵
  PID:14604
- C:\Windows\System\jkeIQhM.exe
  C:\Windows\System\jkeIQhM.exe
  2⤵
  PID:14640
- C:\Windows\System\dmOzZCR.exe
  C:\Windows\System\dmOzZCR.exe
  2⤵
  PID:14676
- C:\Windows\System\PdtoVvI.exe
  C:\Windows\System\PdtoVvI.exe
  2⤵
  PID:14704
- C:\Windows\System\zSTKCLM.exe
  C:\Windows\System\zSTKCLM.exe
  2⤵
  PID:14744
- C:\Windows\System\dumrUBt.exe
  C:\Windows\System\dumrUBt.exe
  2⤵
  PID:14772
- C:\Windows\System\xJTDsZC.exe
  C:\Windows\System\xJTDsZC.exe
  2⤵
  PID:14792
- C:\Windows\System\KsZLwXU.exe
  C:\Windows\System\KsZLwXU.exe
  2⤵
  PID:14820
- C:\Windows\System\eLUpmQJ.exe
  C:\Windows\System\eLUpmQJ.exe
  2⤵
  PID:14840
- C:\Windows\System\rieKpak.exe
  C:\Windows\System\rieKpak.exe
  2⤵
  PID:14860
- C:\Windows\System\veFoQxB.exe
  C:\Windows\System\veFoQxB.exe
  2⤵
  PID:14884
- C:\Windows\System\bFVPlIE.exe
  C:\Windows\System\bFVPlIE.exe
  2⤵
  PID:14904
- C:\Windows\System\qhZfECw.exe
  C:\Windows\System\qhZfECw.exe
  2⤵
  PID:14932
- C:\Windows\System\KAehaiC.exe
  C:\Windows\System\KAehaiC.exe
  2⤵
  PID:14960
- C:\Windows\System\caFZckH.exe
  C:\Windows\System\caFZckH.exe
  2⤵
  PID:14988
- C:\Windows\System\ySTwNtn.exe
  C:\Windows\System\ySTwNtn.exe
  2⤵
  PID:15032
- C:\Windows\System\NXVjBkb.exe
  C:\Windows\System\NXVjBkb.exe
  2⤵
  PID:15068
- C:\Windows\System\OUoReyf.exe
  C:\Windows\System\OUoReyf.exe
  2⤵
  PID:15084
- C:\Windows\System\sMtnSVV.exe
  C:\Windows\System\sMtnSVV.exe
  2⤵
  PID:15100
- C:\Windows\System\wdVytzg.exe
  C:\Windows\System\wdVytzg.exe
  2⤵
  PID:15128
- C:\Windows\System\ssjvhHz.exe
  C:\Windows\System\ssjvhHz.exe
  2⤵
  PID:15148
- C:\Windows\System\zzVfuob.exe
  C:\Windows\System\zzVfuob.exe
  2⤵
  PID:15180
- C:\Windows\System\PeLSHio.exe
  C:\Windows\System\PeLSHio.exe
  2⤵
  PID:15204
- C:\Windows\System\csKVWdj.exe
  C:\Windows\System\csKVWdj.exe
  2⤵
  PID:15232
- C:\Windows\System\WPbJhSR.exe
  C:\Windows\System\WPbJhSR.exe
  2⤵
  PID:15252
- C:\Windows\System\OQEQXRV.exe
  C:\Windows\System\OQEQXRV.exe
  2⤵
  PID:15288
- C:\Windows\System\BJrjMWe.exe
  C:\Windows\System\BJrjMWe.exe
  2⤵
  PID:15320
- C:\Windows\System\LYFNGTL.exe
  C:\Windows\System\LYFNGTL.exe
  2⤵
  PID:15352
- C:\Windows\System\qbCykfh.exe
  C:\Windows\System\qbCykfh.exe
  2⤵
  PID:14348
- C:\Windows\System\ueVPYuF.exe
  C:\Windows\System\ueVPYuF.exe
  2⤵
  PID:14484
- C:\Windows\System\NOYJdCg.exe
  C:\Windows\System\NOYJdCg.exe
  2⤵
  PID:14516
- C:\Windows\System\OEKWKCo.exe
  C:\Windows\System\OEKWKCo.exe
  2⤵
  PID:14596
- C:\Windows\System\PKbDuou.exe
  C:\Windows\System\PKbDuou.exe
  2⤵
  PID:14648
- C:\Windows\System\bwmvYRn.exe
  C:\Windows\System\bwmvYRn.exe
  2⤵
  PID:14764
- C:\Windows\System\KuFAmVQ.exe
  C:\Windows\System\KuFAmVQ.exe
  2⤵
  PID:14780
- C:\Windows\System\JioiTTm.exe
  C:\Windows\System\JioiTTm.exe
  2⤵
  PID:14876
- C:\Windows\System\yMfTbxr.exe
  C:\Windows\System\yMfTbxr.exe
  2⤵
  PID:14948
- C:\Windows\System\dAuFFiq.exe
  C:\Windows\System\dAuFFiq.exe
  2⤵
  PID:15000
- C:\Windows\System\biGVwSP.exe
  C:\Windows\System\biGVwSP.exe
  2⤵
  PID:15076
- C:\Windows\System\gUkTKzu.exe
  C:\Windows\System\gUkTKzu.exe
  2⤵
  PID:15112
- C:\Windows\System\PXGdNrG.exe
  C:\Windows\System\PXGdNrG.exe
  2⤵
  PID:15188
- C:\Windows\System\ZRDDLFq.exe
  C:\Windows\System\ZRDDLFq.exe
  2⤵
  PID:15340
- C:\Windows\System\OFuMIBY.exe
  C:\Windows\System\OFuMIBY.exe
  2⤵
  PID:15304
- C:\Windows\System\MekvCgD.exe
  C:\Windows\System\MekvCgD.exe
  2⤵
  PID:15336
- C:\Windows\System\pInKdhy.exe
  C:\Windows\System\pInKdhy.exe
  2⤵
  PID:14420
- C:\Windows\System\irCgdZG.exe
  C:\Windows\System\irCgdZG.exe
  2⤵
  PID:14544
- C:\Windows\System\ttFYGJH.exe
  C:\Windows\System\ttFYGJH.exe
  2⤵
  PID:14628
- C:\Windows\System\nXgRfEf.exe
  C:\Windows\System\nXgRfEf.exe
  2⤵
  PID:15016
- C:\Windows\System\TGWxAHk.exe
  C:\Windows\System\TGWxAHk.exe
  2⤵
  PID:15176
- C:\Windows\System\TXsrHAJ.exe
  C:\Windows\System\TXsrHAJ.exe
  2⤵
  PID:15140
- C:\Windows\System\vQfrEUF.exe
  C:\Windows\System\vQfrEUF.exe
  2⤵
  PID:15332
- C:\Windows\System\BATXLwo.exe
  C:\Windows\System\BATXLwo.exe
  2⤵
  PID:14800
- C:\Windows\System\skhITOp.exe
  C:\Windows\System\skhITOp.exe
  2⤵
  PID:15056
- C:\Windows\System\bjjxjKf.exe
  C:\Windows\System\bjjxjKf.exe
  2⤵
  PID:15244
- C:\Windows\System\VISZvaD.exe
  C:\Windows\System\VISZvaD.exe
  2⤵
  PID:15364
- C:\Windows\System\SsHjQcK.exe
  C:\Windows\System\SsHjQcK.exe
  2⤵
  PID:15380
- C:\Windows\System\bKmUUTP.exe
  C:\Windows\System\bKmUUTP.exe
  2⤵
  PID:15412
- C:\Windows\System\lglLWEp.exe
  C:\Windows\System\lglLWEp.exe
  2⤵
  PID:15436
- C:\Windows\System\DFFblGN.exe
  C:\Windows\System\DFFblGN.exe
  2⤵
  PID:15452
- C:\Windows\System\hkZhxky.exe
  C:\Windows\System\hkZhxky.exe
  2⤵
  PID:15472
- C:\Windows\System\hbfVFek.exe
  C:\Windows\System\hbfVFek.exe
  2⤵
  PID:15488
- C:\Windows\System\wCopJBa.exe
  C:\Windows\System\wCopJBa.exe
  2⤵
  PID:15512
- C:\Windows\System\WLMzUha.exe
  C:\Windows\System\WLMzUha.exe
  2⤵
  PID:15576
- C:\Windows\System\vPRMtmU.exe
  C:\Windows\System\vPRMtmU.exe
  2⤵
  PID:15608
- C:\Windows\System\WGVQojq.exe
  C:\Windows\System\WGVQojq.exe
  2⤵
  PID:15624
- C:\Windows\System\rVlvscP.exe
  C:\Windows\System\rVlvscP.exe
  2⤵
  PID:15652
- C:\Windows\System\bEvQOkS.exe
  C:\Windows\System\bEvQOkS.exe
  2⤵
  PID:15676
- C:\Windows\System\eEvPFiI.exe
  C:\Windows\System\eEvPFiI.exe
  2⤵
  PID:15704
- C:\Windows\System\PNNiylF.exe
  C:\Windows\System\PNNiylF.exe
  2⤵
  PID:15760
- C:\Windows\System\kAfOkXl.exe
  C:\Windows\System\kAfOkXl.exe
  2⤵
  PID:15776
- C:\Windows\System\eVZqael.exe
  C:\Windows\System\eVZqael.exe
  2⤵
  PID:15800
- C:\Windows\System\QwMICeh.exe
  C:\Windows\System\QwMICeh.exe
  2⤵
  PID:15844
- C:\Windows\System\TEWpnmP.exe
  C:\Windows\System\TEWpnmP.exe
  2⤵
  PID:15864
- C:\Windows\System\TZDqCyL.exe
  C:\Windows\System\TZDqCyL.exe
  2⤵
  PID:15892
- C:\Windows\System\BkOmdCI.exe
  C:\Windows\System\BkOmdCI.exe
  2⤵
  PID:15916
- C:\Windows\System\pNmrgkb.exe
  C:\Windows\System\pNmrgkb.exe
  2⤵
  PID:15932
- C:\Windows\System\fFWeBUN.exe
  C:\Windows\System\fFWeBUN.exe
  2⤵
  PID:15976
- C:\Windows\System\XGCxuDX.exe
  C:\Windows\System\XGCxuDX.exe
  2⤵
  PID:15992
- C:\Windows\System\LCKyrfI.exe
  C:\Windows\System\LCKyrfI.exe
  2⤵
  PID:16016
- C:\Windows\System\tQeFlFJ.exe
  C:\Windows\System\tQeFlFJ.exe
  2⤵
  PID:16040
- C:\Windows\System\sphFpuq.exe
  C:\Windows\System\sphFpuq.exe
  2⤵
  PID:16084
- C:\Windows\System\JppqBsx.exe
  C:\Windows\System\JppqBsx.exe
  2⤵
  PID:16104
- C:\Windows\System\jEyBAMn.exe
  C:\Windows\System\jEyBAMn.exe
  2⤵
  PID:16132
- C:\Windows\System\EhbEvWB.exe
  C:\Windows\System\EhbEvWB.exe
  2⤵
  PID:16152
- C:\Windows\System\OKmcfOt.exe
  C:\Windows\System\OKmcfOt.exe
  2⤵
  PID:16172
- C:\Windows\System\fWbExEM.exe
  C:\Windows\System\fWbExEM.exe
  2⤵
  PID:16200
- C:\Windows\System\zFWFvzZ.exe
  C:\Windows\System\zFWFvzZ.exe
  2⤵
  PID:16224
- C:\Windows\System\kliiKrv.exe
  C:\Windows\System\kliiKrv.exe
  2⤵
  PID:16260
- C:\Windows\System\VJKtZat.exe
  C:\Windows\System\VJKtZat.exe
  2⤵
  PID:16292
- C:\Windows\System\EKKlbTq.exe
  C:\Windows\System\EKKlbTq.exe
  2⤵
  PID:16340
- C:\Windows\System\wTRzPOS.exe
  C:\Windows\System\wTRzPOS.exe
  2⤵
  PID:16372
- C:\Windows\System\aTAJrno.exe
  C:\Windows\System\aTAJrno.exe
  2⤵
  PID:15372
- C:\Windows\System\YzTFusX.exe
  C:\Windows\System\YzTFusX.exe
  2⤵
  PID:15432
- C:\Windows\System\xDdztAl.exe
  C:\Windows\System\xDdztAl.exe
  2⤵
  PID:15448
- C:\Windows\System\XZrrbbw.exe
  C:\Windows\System\XZrrbbw.exe
  2⤵
  PID:15480
- C:\Windows\System\cYcuNzw.exe
  C:\Windows\System\cYcuNzw.exe
  2⤵
  PID:15616
- C:\Windows\System\cIHrwLC.exe
  C:\Windows\System\cIHrwLC.exe
  2⤵
  PID:15648
- C:\Windows\System\yeXvhSh.exe
  C:\Windows\System\yeXvhSh.exe
  2⤵
  PID:15692
- C:\Windows\System\zPUQiLD.exe
  C:\Windows\System\zPUQiLD.exe
  2⤵
  PID:15792
- C:\Windows\System\HVIWUHG.exe
  C:\Windows\System\HVIWUHG.exe
  2⤵
  PID:15852
- C:\Windows\System\ctVCdPx.exe
  C:\Windows\System\ctVCdPx.exe
  2⤵
  PID:15928
- C:\Windows\System\VFDyrLq.exe
  C:\Windows\System\VFDyrLq.exe
  2⤵
  PID:16012
- C:\Windows\System\eJgPsCU.exe
  C:\Windows\System\eJgPsCU.exe
  2⤵
  PID:16060
- C:\Windows\System\AjQowim.exe
  C:\Windows\System\AjQowim.exe
  2⤵
  PID:16184
- C:\Windows\System\LoYSyBH.exe
  C:\Windows\System\LoYSyBH.exe
  2⤵
  PID:16212
- C:\Windows\System\vTlPDBj.exe
  C:\Windows\System\vTlPDBj.exe
  2⤵
  PID:16220
- C:\Windows\System\pFqwbIU.exe
  C:\Windows\System\pFqwbIU.exe
  2⤵
  PID:16316
- C:\Windows\System\yBxaYTs.exe
  C:\Windows\System\yBxaYTs.exe
  2⤵
  PID:16368
- C:\Windows\System\TgGnjkC.exe
  C:\Windows\System\TgGnjkC.exe
  2⤵
  PID:15376
- C:\Windows\System\PtDTxqR.exe
  C:\Windows\System\PtDTxqR.exe
  2⤵
  PID:15688
- C:\Windows\System\fVdGeZn.exe
  C:\Windows\System\fVdGeZn.exe
  2⤵
  PID:15768
- C:\Windows\System\zibMJiN.exe
  C:\Windows\System\zibMJiN.exe
  2⤵
  PID:16100
- C:\Windows\System\zetxFjf.exe
  C:\Windows\System\zetxFjf.exe
  2⤵
  PID:2948
- C:\Windows\System\JknxfPy.exe
  C:\Windows\System\JknxfPy.exe
  2⤵
  PID:3572
- C:\Windows\System\MERVGHt.exe
  C:\Windows\System\MERVGHt.exe
  2⤵
  PID:16256
- C:\Windows\System\pgfyFcY.exe
  C:\Windows\System\pgfyFcY.exe
  2⤵
  PID:15428
- C:\Windows\System\RUAnIxF.exe
  C:\Windows\System\RUAnIxF.exe
  2⤵
  PID:15828
- C:\Windows\System\EfMYPUQ.exe
  C:\Windows\System\EfMYPUQ.exe
  2⤵
  PID:16244
- C:\Windows\System\PJNcpbS.exe
  C:\Windows\System\PJNcpbS.exe
  2⤵
  PID:16356
- C:\Windows\System\NEEkAXc.exe
  C:\Windows\System\NEEkAXc.exe
  2⤵
  PID:16288
- C:\Windows\System\FQCIEYZ.exe
  C:\Windows\System\FQCIEYZ.exe
  2⤵
  PID:16388
- C:\Windows\System\dArrglz.exe
  C:\Windows\System\dArrglz.exe
  2⤵
  PID:16428
- C:\Windows\System\wJmhxAq.exe
  C:\Windows\System\wJmhxAq.exe
  2⤵
  PID:16444
- C:\Windows\System\iNAgdgs.exe
  C:\Windows\System\iNAgdgs.exe
  2⤵
  PID:16484
- C:\Windows\System\PEiMQNq.exe
  C:\Windows\System\PEiMQNq.exe
  2⤵
  PID:16516
- C:\Windows\System\FCdOxjF.exe
  C:\Windows\System\FCdOxjF.exe
  2⤵
  PID:16536
- C:\Windows\System\QeVeTrd.exe
  C:\Windows\System\QeVeTrd.exe
  2⤵
  PID:16560
- C:\Windows\System\eMnSnxF.exe
  C:\Windows\System\eMnSnxF.exe
  2⤵
  PID:16600
- C:\Windows\System\jScvAxW.exe
  C:\Windows\System\jScvAxW.exe
  2⤵
  PID:16620
- C:\Windows\System\OHdBOHM.exe
  C:\Windows\System\OHdBOHM.exe
  2⤵
  PID:16644
- C:\Windows\System\XxvZjPI.exe
  C:\Windows\System\XxvZjPI.exe
  2⤵
  PID:16672
- C:\Windows\System\NglYjoU.exe
  C:\Windows\System\NglYjoU.exe
  2⤵
  PID:16712
- C:\Windows\System\sNjwXqs.exe
  C:\Windows\System\sNjwXqs.exe
  2⤵
  PID:16732
- C:\Windows\System\EiLFVGq.exe
  C:\Windows\System\EiLFVGq.exe
  2⤵
  PID:16756
- C:\Windows\System\buDPgWQ.exe
  C:\Windows\System\buDPgWQ.exe
  2⤵
  PID:16784
- C:\Windows\System\XXUibRY.exe
  C:\Windows\System\XXUibRY.exe
  2⤵
  PID:16808
- C:\Windows\System\GNGCUMi.exe
  C:\Windows\System\GNGCUMi.exe
  2⤵
  PID:16828
- C:\Windows\System\HgEcQmV.exe
  C:\Windows\System\HgEcQmV.exe
  2⤵
  PID:16856
- C:\Windows\System\lpqQeQQ.exe
  C:\Windows\System\lpqQeQQ.exe
  2⤵
  PID:16896
- C:\Windows\System\NyYVArF.exe
  C:\Windows\System\NyYVArF.exe
  2⤵
  PID:16912
- C:\Windows\System\Fprwkxx.exe
  C:\Windows\System\Fprwkxx.exe
  2⤵
  PID:16936
- C:\Windows\System\fvJQNco.exe
  C:\Windows\System\fvJQNco.exe
  2⤵
  PID:16960
- C:\Windows\System\CGomgtw.exe
  C:\Windows\System\CGomgtw.exe
  2⤵
  PID:16988
- C:\Windows\System\ihJewOv.exe
  C:\Windows\System\ihJewOv.exe
  2⤵
  PID:17024
- C:\Windows\System\tHHMNQN.exe
  C:\Windows\System\tHHMNQN.exe
  2⤵
  PID:17048
- C:\Windows\System\TaCpPkB.exe
  C:\Windows\System\TaCpPkB.exe
  2⤵
  PID:17104
- C:\Windows\System\LARnFsJ.exe
  C:\Windows\System\LARnFsJ.exe
  2⤵
  PID:17124
- C:\Windows\System\PiBlyAl.exe
  C:\Windows\System\PiBlyAl.exe
  2⤵
  PID:17148
- C:\Windows\System\sshKWMp.exe
  C:\Windows\System\sshKWMp.exe
  2⤵
  PID:17172
- C:\Windows\System\lroVPKl.exe
  C:\Windows\System\lroVPKl.exe
  2⤵
  PID:17196
- C:\Windows\System\SFaTIot.exe
  C:\Windows\System\SFaTIot.exe
  2⤵
  PID:17228
- C:\Windows\System\pRAmGqc.exe
  C:\Windows\System\pRAmGqc.exe
  2⤵
  PID:17256
- C:\Windows\System\WrQBAQW.exe
  C:\Windows\System\WrQBAQW.exe
  2⤵
  PID:17300
- C:\Windows\System\iYdQkTi.exe
  C:\Windows\System\iYdQkTi.exe
  2⤵
  PID:17328
- C:\Windows\System\mjJfSmP.exe
  C:\Windows\System\mjJfSmP.exe
  2⤵
  PID:17344
- C:\Windows\System\diXkGer.exe
  C:\Windows\System\diXkGer.exe
  2⤵
  PID:17376
- C:\Windows\System\CxImSZM.exe
  C:\Windows\System\CxImSZM.exe
  2⤵
  PID:17400
- C:\Windows\System\ZbToNWT.exe
  C:\Windows\System\ZbToNWT.exe
  2⤵
  PID:15956
- C:\Windows\System\kYrYPzb.exe
  C:\Windows\System\kYrYPzb.exe
  2⤵
  PID:16440
- C:\Windows\System\FvdLBUi.exe
  C:\Windows\System\FvdLBUi.exe
  2⤵
  PID:16504
- C:\Windows\System\PmaLREG.exe
  C:\Windows\System\PmaLREG.exe
  2⤵
  PID:16588
- C:\Windows\System\NsFxbmW.exe
  C:\Windows\System\NsFxbmW.exe
  2⤵
  PID:16664
- C:\Windows\System\aYNNHPc.exe
  C:\Windows\System\aYNNHPc.exe
  2⤵
  PID:16740
- C:\Windows\System\SOQoCnV.exe
  C:\Windows\System\SOQoCnV.exe
  2⤵
  PID:16804
- C:\Windows\System\asfPZfx.exe
  C:\Windows\System\asfPZfx.exe
  2⤵
  PID:16864
- C:\Windows\System\CkmzdED.exe
  C:\Windows\System\CkmzdED.exe
  2⤵
  PID:16904

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16920

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BcUrtHa.exe

Filesize
1.1MB

MD5
a97877133542ce5d5b91ccfb6b28bcc9

SHA1
a5e75b2e9d750e1d981b5330fcb9b37ab864fe91

SHA256
fcf225dba6ab3addcc3a1e3427c8561d64e270213908989fb064fedb3a0fa5e2

SHA512
e7fe7925de00e3bd4cb0951556ce2bd5c33f982bf704ee5df3524ad62fe6222f1c3fcdf3818f905fbb3282b0c04e9fbe454883051c1c7ddfccecc6e7f33276c4

Download Submit
C:\Windows\System\CJTBRyB.exe

Filesize
1.1MB

MD5
3fda25e541ba9c1bd292038606467e09

SHA1
4a01c35ee28dbdb17f933d41538940e14a043508

SHA256
bb97c39011e358a0718909d59164fdf3116f9c918c969a90b3232ef2f8e0c823

SHA512
33af4d2d17695cf05b6ea240858d94bc5d7898ccea086a533cfcd4027673792c71865a323dfc34d3df74f4a750d991214f30f3b0675437dda8789afcefabcd04

Download Submit
C:\Windows\System\DsEOmMG.exe

Filesize
1.1MB

MD5
5dbdc3c5dcdbbc8a88733f53b8a7e26c

SHA1
781cfce38cfde11408b960aa6f7afbd5e9e810b2

SHA256
2aabf9ea7d7f4bccef51ccb54e5f6c2d2c70ef70085e5c2699b3adb7c5b6e01d

SHA512
fd02422ed1c3f0204d4bc1c8cedb753bd646da76fe0db5562bd50fea2832593c3c510714dbcca34f62c6936ac0672f50eacf49d9bb278a5744366e0d11a664d1

Download Submit
C:\Windows\System\FbSDrXR.exe

Filesize
1.1MB

MD5
069e53a00341a71ba12641602b00a39e

SHA1
d8dc1f7f2ace50e52b0d53d57d5363a939f3f9c6

SHA256
e76e72ad1a57a333855696036546defb660b726480b02b7a3f7fea6f02577c6d

SHA512
00625b1472be914efd8a1400f20033a42c6d3edc8b18223b7341f9bf08bb5ed0d1687500dcef8a4ec99373c19f4862c17d0a91691535bc75dd92fce2160aaa61

Download Submit
C:\Windows\System\JNeAwFi.exe

Filesize
1.1MB

MD5
e176916bbd29fda1e06a57ebf4ab3791

SHA1
f3e94976c1289d40d35d4b470bdfb6a060b0f3b8

SHA256
8b28a7b96c82aeec65da5444a83f96c1b4ec15df5c568364dc47db92eb9788a6

SHA512
5f02003a4a79846b7f943b4298a87944bafecd6a618a3e3478df0defbc716feb268a0661e5145f0e48fce1b7a997c806aeb1c9e1a7ae322ed7f7ed3cf3b65447

Download Submit
C:\Windows\System\KAxfGLI.exe

Filesize
1.1MB

MD5
905c2d6ce279bb7785f83b8285a3a784

SHA1
584cc78bf3d6cbd30c97a1ac2c11d60ed819ad50

SHA256
e8bf180e8c9c4fa0e1779dfd59ac50247e52720afc3111e0fe5993dedc670d3b

SHA512
4bef60754f1f2f8031ce7a380bfc2f543332e19b6a3e10a8ce528d2f8e32d61bf7ae9abce41f4345e511187f1473b40f09025edd43787ce1ef329a4e2363a7d6

Download Submit
C:\Windows\System\KOhInXj.exe

Filesize
1.1MB

MD5
dfdbd259a0c1840694976f8bbf31433e

SHA1
8cb2c2af1a1399f8a1638cefd626f75851d4621a

SHA256
53fbb621b42bb8aa7bd82fde70236d48979e34765c6519dd19f4e4e2ea8ea887

SHA512
a00a7cbec63ebc0ee2c3d0688adb8f07492987f401ade553afe1073eb023f1e0ca96aaf721effdd4a3f60a4d7959305c7b19dc9447e61bd2461264122ccbdea4

Download Submit
C:\Windows\System\NBMiulR.exe

Filesize
1.1MB

MD5
0c029ae07ba1ebb42a1af7e8a1364b6a

SHA1
7037fe72fe5c5887d774e4c5640abbadaf8f8d42

SHA256
907f19c0fdc0202f5ab647e6fbc58c72f455d55c402df47a6eee7427ceecc353

SHA512
5b43fb4e71b592bce0ee144f00244292381ebda98621df5855e790a167f6c51587e74355df53fbb64fda2edade1226d49aad06d312861cceb104e09b15638862

Download Submit
C:\Windows\System\NNBgIbt.exe

Filesize
1.1MB

MD5
7384949850103c034eb4b8a8e4ad07e0

SHA1
a64cd8ed012832cfb5737eed3ae214c780dbbff9

SHA256
d17573a8cb29122cebcd75de66671a1425bcb0f42813f881d08136ffe96d4eca

SHA512
850683b350422586e62b073ad2bdfeff3ea88536fe1cb8243a82cab4599e58d20b19949ca164a167a1e7dd5e16ead5d176f9abc3aafa965a19d7cf701626c9b8

Download Submit
C:\Windows\System\ONEcnIN.exe

Filesize
1.1MB

MD5
d849d0e3dd33cd65b1f3fb27b1cfab00

SHA1
2f48a47d41c478720a7344e1a63b849cc61d6e65

SHA256
24ef936d05a233498784a412fc787b7c1c9fe792b800ab79ec5f601833d68d37

SHA512
ac7f62636ab39d940b26cd9d3fe7fc4562d57ce48fb43cf9ae07b88bbe49c1b20c9979c697ad4236cffe45c6bbe63cc4d1a1062e0ae816bcd764ffd07c0c4744

Download Submit
C:\Windows\System\PEGtaYr.exe

Filesize
1.1MB

MD5
8f83799c52448b80d72933c2d3368039

SHA1
1d782312307ef2cee16692309892ed456bb5e919

SHA256
c3a48e8838ef5a49d36e0408c2b42f5652215d24aa2639742a864fb11ad59e18

SHA512
7f736e5edd9c14f29f61b16bbd74ea1c4946f6c926f55b0c7ff71910397c81cc8dd36b97601c5bb727216f36fb6e409ee633c0adffe8acb38eebb4de74a41019

Download Submit
C:\Windows\System\SCcpybO.exe

Filesize
1.1MB

MD5
71adbc069a4f05e925ac3c7e0e702c3c

SHA1
c58713deb9c031b032af5ac813e7d400543fb82b

SHA256
110946bb94577cb65175ceb4cb53b9d9153be75ef3c01bd4380cabe5d83ed999

SHA512
e7edbae02461291d05d71844a85c96ffdf54a23a13a6b364009589f881106b285e370fb1d9abac0a64861b4f57da83fc11c1daa7bcbb2cd67d28c19d2126fc9b

Download Submit
C:\Windows\System\SNxolJm.exe

Filesize
1.1MB

MD5
91ed52ed6f7d04d4f65590d488083bf5

SHA1
70e44deb90508d8eb2f38a89da97a5b361f8853f

SHA256
eea0b68a679c54b1ad350beac719c32b1a47dc89de917be06df0b200d519ce82

SHA512
871210fc3daae106cc24fc1f01aa5464143c39b19ea613b0ed306d330e7714d19b436f9dd58e5b0cabe183cf38b499c484f1f0a5db494df0dc21b96eb3ad260a

Download Submit
C:\Windows\System\UTKQJDa.exe

Filesize
1.1MB

MD5
a6ea7629c59d35199f8bef2895cbd616

SHA1
cb6dcb0a6ac4d224b35c16d775f513435589d5fa

SHA256
62b63970abf8f234aa13bf679430910911ec0906fc48d240bff1e55868012c7f

SHA512
13537c906b7287cd6c1622427d4d1be2f28d10d60bd7f1514a6f8aba8cc82efb6148b7646a57a0dda4721aa2aa90b785f40d7bd6b886f3650703bdd0d479befa

Download Submit
C:\Windows\System\UYBaHkD.exe

Filesize
1.1MB

MD5
4ff9d0aee62175c72c950e81e2511da2

SHA1
99711795a82b00f2901fd61e87792d50c82ed9d3

SHA256
7ebd4f28adfcfe9da5c5d32faef0caadcca89574d1c993b506eb252624abf334

SHA512
b5780bdf436ba098a7f972360ce59436e534428be2345ca04d05830fd0d2309625b0c2f6d67cc01eec2e57bb57f60b5e2792972227098c3ca13071b0bf4467d2

Download Submit
C:\Windows\System\VhMjvaX.exe

Filesize
1.1MB

MD5
5c2e7057957b84230a8a132991046c8a

SHA1
44184caeb7f89b70ba63efa6d480d899394e62cd

SHA256
4e0454a08c4eee79c8a8402c75ef0c5bf7aa34c200f1a8bfca6e822ece6cf633

SHA512
3fc10ed501ef084caa2e2b8d011f6de62e4180cc3c9427666e40c44b8dba77a91c2490d550c47d5c74aea67ac4c6d2846f0d4922ec6cc0cef86cd338f8ae97a1

Download Submit
C:\Windows\System\ZBkEXHZ.exe

Filesize
1.1MB

MD5
5e407ab900dc737733195b05ad05b078

SHA1
37f0cdefdd7c8758634a697652d0ba4d1de74718

SHA256
e13722b349afe38a48030eeb54c5858d8e9279080c6ef9729ff8ed750b481d4a

SHA512
6881f19f6ad915be08a575c5c5605a237209cc5f67d58d0252756e9379fa4c1292c0e0664463e3df24d09e6a751beff79549d4bfe19d0bc08a26c9133e1dbfc3

Download Submit
C:\Windows\System\ZmfUCLY.exe

Filesize
1.1MB

MD5
01f239ecb0c168fe64d9617acb84c059

SHA1
86b27a305ed79871cd974f546f6883be729c476d

SHA256
87e4a5341bf582631bbddc58b8622f93644c2d6e92f76bd25fe827dae63607ef

SHA512
06662aaeb50e2c13b7f361de0be7ead9463dc7ff54f80bf4d1ca2e96588c15716cecc7e794a4f6331f5ea5204b4413207d3b8989457e0c1c183317e6f1d8cb59

Download Submit
C:\Windows\System\aTLmhlV.exe

Filesize
1.1MB

MD5
758f087599e52cdc6b34f4a7d2f29c78

SHA1
1c7cdf51c80abd8c4b5a6a818ad4b26ec6d36dd6

SHA256
a7eb0f0763cfaa6488fe0ef30bfb3b2797c947a47bad49a974ec55b3d3675af0

SHA512
24c5fcdf77229542762e8d79f15542919107bd4f2f2cd4d8501aeabb72610bd073f7df2ef8a215371cb9f4b5020b75f707541d2c1f78ea32b745b2e7eb663141

Download Submit
C:\Windows\System\cVmJerF.exe

Filesize
1.1MB

MD5
34f79ce4ee584e9365a648466582104d

SHA1
34b32ad3099f9a4588e5b5fd12de4e552dd3c231

SHA256
87fa547474b7bf0778ad91980d957ec67511ec6a1a4fa9aab9547aeb00d13f69

SHA512
14cfd78ef546e428511f36c46778f4ada094150c492e53a84d6e7d8d15b1f2d30df032151dad6903a73bdfc9de7e95cf0137f132cd54e0afa027cf55a6bdbd12

Download Submit
C:\Windows\System\eGkBVWc.exe

Filesize
1.1MB

MD5
5417df397750049c3184a70f068fbf74

SHA1
f2ac76351c7dfbe7726d54e8b505ecd7f9da3d16

SHA256
45a3e04f1266cb1e34ac08587d886714e1743e701bb4654a824cb15a39300112

SHA512
bb78ae661af52943f754cc21b042fe300bb2b89f82c8386db3b267011b940c155b5f823ae8c003e728a85f457240f24793919b92de6eba73b29847fe227a7456

Download Submit
C:\Windows\System\fJHiQeh.exe

Filesize
1.1MB

MD5
b543b9ab2861558b4b4075af79b1ff7e

SHA1
9d3333dc6bbe4b6df8b6fde01a3af69078e1b875

SHA256
01bef7063e1f8779fab34596965911e1bbb7d27f164e9478cad4e88778d6f7de

SHA512
2463b6d2353f7cac500012dce0c526836bbc7a799c3e3a046ea4ba49e887b84ebfe9f01439469693dc422a3c5e309490cccc7cdb7dab6786a183aaeac145cc73

Download Submit
C:\Windows\System\gyhKXik.exe

Filesize
1.1MB

MD5
14d295f197a6375f3dcfddd93c82db1b

SHA1
34997096d9945d7df95f499be0daf5b114441887

SHA256
188302e0d28c9c09e430adc5ceef68e509aa1985596d97d991ae03f52946dad0

SHA512
b03fac839a6d89f2f5bedb6ef23fc257bd40d7bfbde1fb7edbe8000fc05f49e495835bdc8bb0026b54abfdb3f4a310dc50d4dc53de277d38993968a0c111af8e

Download Submit
C:\Windows\System\kuXgAaB.exe

Filesize
1.1MB

MD5
e85662505c42815d8b49746c2c3e757f

SHA1
eb28487f92a95c5d3c5a87f1ffbefd9d7540c0d3

SHA256
9e8516dd9616bc9a976a78a612f5062cc9dce2e5bccfd98ab49e8b97a177bec3

SHA512
8767a162d2fbf79516f397ba8bc55bdf1acd1d44d9cac3357263efc7f38a3b31b42eaff7bc669a7f9101330405d19768c84adb5ccc9485bfa28044ab08c29098

Download Submit
C:\Windows\System\lPWpunT.exe

Filesize
1.1MB

MD5
16bff6b0c375805e1d3184d7cd2a6c0b

SHA1
ffdd671f90b11094749d313431a5f541490781d2

SHA256
0fab624408a8515fcf9f8eacabd28da55b3355233ad1da3c7ca5aecf890445a2

SHA512
d67f497aee99ecc05be444261e34c23bea666b1a9e703b225a170e30723860a08429a1e2ba3fa785e26ef0086e493e9cb256a3c0a65828ee32bb0ca3e0e6b135

Download Submit
C:\Windows\System\mCEpnnz.exe

Filesize
1.1MB

MD5
1465458a1ebf36b0adcf0d139e17be5f

SHA1
700051e9d50c790e92d1d07ecc88f54b3032cf48

SHA256
d9069c1528982476f1894d2f2842b2500c0fac10e2d5c13ab44439bfe47dd4e1

SHA512
60e4ab91f2d592402c97954d521e32901fd0210d93f79cc73154ce052f00ff21d3c1adc74fa3d68a7bcca09394eb4e3a0394334c5272347aa505e1c39a168c20

Download Submit
C:\Windows\System\nXhMKFH.exe

Filesize
1.1MB

MD5
2dc0850f9d0422d11218e915537c7b6c

SHA1
487dc4f288166fc61cb8cda6c8d28b7024e80e0f

SHA256
62c979d7064c8866385953208d0b365e43d21c282aa7e8995e280c4b270dee05

SHA512
a7528c5c0da469f7847da6e8de6fe4d5948c0450a0a9580e4e72a9bbea8cc541786c82bc8d22a5890216cb16ccd7435b361de642d5fcca7e355d8c8817d2d04b

Download Submit
C:\Windows\System\tTYEpKr.exe

Filesize
1.1MB

MD5
52096c2066822a91d4bfe573215daf51

SHA1
c75b53e0c086e93ed09b2f2e7e37c133ed931b01

SHA256
6525d523bb799d767bf342ae8927db78b87e7f1f7c3cb627771ca203a5a5fba7

SHA512
ce6f93b831b3b3e6dc651fbf73c9ebe03d5fd2cdf5faa69d4ae8bfc8e5c75e35a3934dfb03576b556b7128cd3dc4a43e03c1c00c554013dc1e6066581b62826c

Download Submit
C:\Windows\System\ukUnDfQ.exe

Filesize
1.1MB

MD5
16fd1fc3f2c091f562a319338062ab5c

SHA1
2ecac026c47990b602ef12b07e12661990b249ba

SHA256
9567ad2644eeb03f7b11a127d205cda90f177d16222442d279b749b149f103ba

SHA512
650860cd395f2353fc01fca492c4e91e6673759cdc02308c53c8023f7cc3e83181fbea93354434c0dd22b95bcb506d27fd2446ca947bdd7a65ed2e00583824eb

Download Submit
C:\Windows\System\uxTILXC.exe

Filesize
1.1MB

MD5
468374c3af1e006ea3d551e5c6a78d7c

SHA1
e6ebd00120201de49639ad01bfc1d73a326647a3

SHA256
6986e3d62fb57521e64647e0935ff1936e94ea8a465049e683792bf2df00f3d8

SHA512
904be1796b8efcb5d27d665395dff5399667c44c127f8040b47007051cc37c905ad3a0c2e3e968d2b6dc69943c030cd8cdf0347f38b6c5c5c1e2f5107077b844

Download Submit
C:\Windows\System\vNIMOGk.exe

Filesize
1.1MB

MD5
22707f65d4ae6074effa954557355e78

SHA1
fc97582ec85b9a3d1d1fd625c9510e8499b9dd49

SHA256
3daf5dbb34f61aaf781e383beb0ed90a55c5ddfa5d77883067f9fbe17aa47d30

SHA512
cf0e6fa733431a8b5f798df684845b0d9acd4fec4fef59aa401a8706214b4b8a4175f50a739e4fad9d1125866224189e8a21e2d8662f18397f63d75a8f820f3e

Download Submit
C:\Windows\System\vymiXEx.exe

Filesize
1.1MB

MD5
ea1a92315a1172124796af40dead3d17

SHA1
7382d3920ba15de7ca4147d4c7fde58f07b3462b

SHA256
e8b8b3aafdd27daf3ddefce34bb3a56c3d36ca4ff475f22d71177beff7f4f02c

SHA512
d79ff4ecced7dbce6e3fd3fefa610d8a941e27587f53710d4d9212919ba32adee04398641c76cc473a59e9e7491697b186d6e419e78eba8b6ba4bb99c930091a

Download Submit
C:\Windows\System\xKlRhyl.exe

Filesize
1.1MB

MD5
5662cb330881376458872ef27f995413

SHA1
807486e671943632bc1414c9e28f83f4df9fdf6c

SHA256
2bc19614c6a291d6af7fcfc5f91b24386c235ffea6c6cc91b01fbd0e17793eac

SHA512
ed583472645f7cdc154df82d7e4141d8d4fcc8c8928557af8e2257b97bdda2ce9a69ab78f6c80b3317446354b124715b2fde49e32f846468c4850b8e02ca5e8a

Download Submit
memory/4368-0-0x0000023D359D0000-0x0000023D359E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads