xmrig | 2d6ea9f18c76edd21d0c186c3f4c07304714d5c95a8c3ce2245da0039d59d7fb

Analysis

max time kernel
147s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 03:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
Size

1.6MB
MD5

991f21576055bdcd5075f4b4357ef010
SHA1

34fb221e060e1d6bc611921dc21f4468131663b7
SHA256

2d6ea9f18c76edd21d0c186c3f4c07304714d5c95a8c3ce2245da0039d59d7fb
SHA512

d596f3211e45bbc3a92619a72f1f83375236e1a54e0f8bd11601cc54f96d483bca093d7e0936468028257b781d9f529ba6037605261edfdef98dc20188218e85
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2Nqc7:GemTLkNdfE0pZaT

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 16792 created 4260	16792	WerFaultSecure.exe	78

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000800000002342d-3.dat	xmrig
behavioral2/files/0x0007000000023431-9.dat	xmrig
behavioral2/files/0x0007000000023432-8.dat	xmrig
behavioral2/files/0x0007000000023433-19.dat	xmrig
behavioral2/files/0x0007000000023434-23.dat	xmrig
behavioral2/files/0x0007000000023435-30.dat	xmrig
behavioral2/files/0x0007000000023437-38.dat	xmrig
behavioral2/files/0x0007000000023436-35.dat	xmrig
behavioral2/files/0x0007000000023438-44.dat	xmrig
behavioral2/files/0x0007000000023439-49.dat	xmrig
behavioral2/files/0x000800000002342e-54.dat	xmrig
behavioral2/files/0x000700000002343a-62.dat	xmrig
behavioral2/files/0x000700000002343c-67.dat	xmrig
behavioral2/files/0x000700000002343d-70.dat	xmrig
behavioral2/files/0x000700000002343b-71.dat	xmrig
behavioral2/files/0x000700000002343f-79.dat	xmrig
behavioral2/files/0x0007000000023440-84.dat	xmrig
behavioral2/files/0x0007000000023441-90.dat	xmrig
behavioral2/files/0x0007000000023442-96.dat	xmrig
behavioral2/files/0x0007000000023443-111.dat	xmrig
behavioral2/files/0x0007000000023446-114.dat	xmrig
behavioral2/files/0x0007000000023447-118.dat	xmrig
behavioral2/files/0x0007000000023445-113.dat	xmrig
behavioral2/files/0x0007000000023448-125.dat	xmrig
behavioral2/files/0x000700000002344b-137.dat	xmrig
behavioral2/files/0x000700000002344f-157.dat	xmrig
behavioral2/files/0x0007000000023450-162.dat	xmrig
behavioral2/files/0x000700000002344e-160.dat	xmrig
behavioral2/files/0x000700000002344d-155.dat	xmrig
behavioral2/files/0x000700000002344c-150.dat	xmrig
behavioral2/files/0x000700000002344a-140.dat	xmrig
behavioral2/files/0x0007000000023449-132.dat	xmrig
behavioral2/files/0x0007000000023444-109.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
404	vuUKmHV.exe
4640	eGUiSsJ.exe
1892	bdrXzRR.exe
1844	AKkfwSY.exe
3872	dgsWhYX.exe
432	RhKzHYt.exe
1168	bWvUTvY.exe
2212	NNdLpDj.exe
4580	IJXoNNp.exe
4864	KulEkrV.exe
4492	MIVnjZf.exe
3828	nYgEdub.exe
2588	dcbHjat.exe
824	GIUqmGe.exe
1176	VdXXhgJ.exe
4676	zlghEFE.exe
4516	FRMFyyt.exe
4016	nDhMvOd.exe
4048	rJmImcF.exe
3312	nyiSFVJ.exe
4904	LpCBJvU.exe
4880	hRbBojl.exe
4484	JUNXLsf.exe
2784	nEOhZAh.exe
3068	ndJeDBq.exe
3436	cIDaiLD.exe
2096	frOXMxo.exe
1648	YwHyEOZ.exe
2244	tlnOqYo.exe
1396	jLQlEAN.exe
2040	WoUTSJZ.exe
3960	TaLNnrr.exe
3932	FqMuFsm.exe
684	ywQxNEG.exe
768	VHSbRWW.exe
2376	vewqISa.exe
4460	XNWTOyf.exe
628	OGoiPVi.exe
4200	WTvyRmz.exe
3680	WdGdtRR.exe
1832	pfCRGcw.exe
5100	LKfZePd.exe
2704	IdeHXeI.exe
4428	ftsqKDn.exe
3464	qzeMort.exe
1896	iEsMDVx.exe
3516	SmEHGXk.exe
2004	VEtYTHM.exe
4340	IGZRrMW.exe
1148	xKKSZQt.exe
1304	ROSVpfn.exe
4532	PLpGIyM.exe
1776	KEjuesD.exe
1488	TQvCKFu.exe
1920	GZiYAyT.exe
2268	OBvuJMb.exe
2260	LNHPFdo.exe
4928	PCQqFOR.exe
5040	LYieKYv.exe
1512	cqCJNho.exe
1716	UdKTLjr.exe
4108	cTuKJHI.exe
892	cGhICBJ.exe
1796	vjAQppq.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\WERD40A.tmp.WERDataCollectionStatus.txt	WerFaultSecure.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YIEnqsi.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\OGoiPVi.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\usuNnKg.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\JnmjcCn.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\muLMmpd.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\MffRcdC.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\kIykmTk.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\kDvfMma.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\UCxodiI.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\kTAHkCf.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\PLpGIyM.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\lUVWlHQ.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\AoIvCdd.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\AqMDPYD.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\RUTeHsW.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\VHSbRWW.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\sQnqxXH.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\smOndCr.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\ePBKyNw.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\gDGdkoz.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\aMfAcBz.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\VlbdTaj.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\NUoFbXs.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\RhKzHYt.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\iEsMDVx.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\bZEVzEB.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\nDBRrKc.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\sutEkCa.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\ddxnyoj.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\gUkXvGR.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\dIROChW.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\ZlmJzUY.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\nDhMvOd.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\tktfKav.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\nCMeMRX.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\dpGVTcQ.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\xexXioy.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\yFfoFtt.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\nmffBcG.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\bSQTJYc.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\hWmwkbV.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\tljPyyD.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\znZycku.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\rOuPrwn.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\lkyuEiT.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\MeSXZFg.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\aRVQlhV.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\tawcTOE.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\IGBBonk.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\cvsVguW.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\LAWZIWY.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\HRsvAhd.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\YpvxNAD.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\seQCjaD.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\PMMkUgR.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\VZwXbpC.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\ROBmeWt.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\KKfvbsn.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\JkPDmsU.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\bOIznLQ.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\QNVvLJK.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\DBmqMZr.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\BvtsFwA.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
File created	C:\Windows\System\sywMCty.exe	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2344	dwm.exe
Token: SeChangeNotifyPrivilege	2344	dwm.exe
Token: 33	2344	dwm.exe
Token: SeIncBasePriorityPrivilege	2344	dwm.exe
Token: SeCreateGlobalPrivilege	1436	dwm.exe
Token: SeChangeNotifyPrivilege	1436	dwm.exe
Token: 33	1436	dwm.exe
Token: SeIncBasePriorityPrivilege	1436	dwm.exe
Token: SeShutdownPrivilege	1436	dwm.exe
Token: SeCreatePagefilePrivilege	1436	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 404	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	83
PID 3100 wrote to memory of 404	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	83
PID 3100 wrote to memory of 4640	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	84
PID 3100 wrote to memory of 4640	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	84
PID 3100 wrote to memory of 1892	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	85
PID 3100 wrote to memory of 1892	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	85
PID 3100 wrote to memory of 1844	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	86
PID 3100 wrote to memory of 1844	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	86
PID 3100 wrote to memory of 3872	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	87
PID 3100 wrote to memory of 3872	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	87
PID 3100 wrote to memory of 432	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	89
PID 3100 wrote to memory of 432	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	89
PID 3100 wrote to memory of 1168	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	90
PID 3100 wrote to memory of 1168	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	90
PID 3100 wrote to memory of 2212	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	91
PID 3100 wrote to memory of 2212	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	91
PID 3100 wrote to memory of 4580	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	92
PID 3100 wrote to memory of 4580	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	92
PID 3100 wrote to memory of 4864	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	94
PID 3100 wrote to memory of 4864	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	94
PID 3100 wrote to memory of 4492	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	95
PID 3100 wrote to memory of 4492	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	95
PID 3100 wrote to memory of 3828	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	96
PID 3100 wrote to memory of 3828	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	96
PID 3100 wrote to memory of 2588	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	98
PID 3100 wrote to memory of 2588	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	98
PID 3100 wrote to memory of 824	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	99
PID 3100 wrote to memory of 824	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	99
PID 3100 wrote to memory of 1176	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	100
PID 3100 wrote to memory of 1176	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	100
PID 3100 wrote to memory of 4676	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	101
PID 3100 wrote to memory of 4676	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	101
PID 3100 wrote to memory of 4516	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	102
PID 3100 wrote to memory of 4516	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	102
PID 3100 wrote to memory of 4016	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	103
PID 3100 wrote to memory of 4016	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	103
PID 3100 wrote to memory of 4048	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	104
PID 3100 wrote to memory of 4048	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	104
PID 3100 wrote to memory of 3312	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	105
PID 3100 wrote to memory of 3312	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	105
PID 3100 wrote to memory of 4904	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	106
PID 3100 wrote to memory of 4904	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	106
PID 3100 wrote to memory of 4880	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	107
PID 3100 wrote to memory of 4880	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	107
PID 3100 wrote to memory of 4484	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	108
PID 3100 wrote to memory of 4484	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	108
PID 3100 wrote to memory of 2784	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	109
PID 3100 wrote to memory of 2784	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	109
PID 3100 wrote to memory of 3068	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	110
PID 3100 wrote to memory of 3068	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	110
PID 3100 wrote to memory of 3436	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	111
PID 3100 wrote to memory of 3436	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	111
PID 3100 wrote to memory of 2096	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	112
PID 3100 wrote to memory of 2096	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	112
PID 3100 wrote to memory of 1648	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	113
PID 3100 wrote to memory of 1648	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	113
PID 3100 wrote to memory of 2244	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	114
PID 3100 wrote to memory of 2244	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	114
PID 3100 wrote to memory of 1396	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	115
PID 3100 wrote to memory of 1396	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	115
PID 3100 wrote to memory of 2040	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	116
PID 3100 wrote to memory of 2040	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	116
PID 3100 wrote to memory of 3960	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	117
PID 3100 wrote to memory of 3960	3100	991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe	117

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:4260
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4260 -s 2156
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:17036

C:\Users\Admin\AppData\Local\Temp\991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\991f21576055bdcd5075f4b4357ef010_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\System\vuUKmHV.exe
  C:\Windows\System\vuUKmHV.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\eGUiSsJ.exe
  C:\Windows\System\eGUiSsJ.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\bdrXzRR.exe
  C:\Windows\System\bdrXzRR.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\AKkfwSY.exe
  C:\Windows\System\AKkfwSY.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\dgsWhYX.exe
  C:\Windows\System\dgsWhYX.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\RhKzHYt.exe
  C:\Windows\System\RhKzHYt.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\bWvUTvY.exe
  C:\Windows\System\bWvUTvY.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\NNdLpDj.exe
  C:\Windows\System\NNdLpDj.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\IJXoNNp.exe
  C:\Windows\System\IJXoNNp.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\KulEkrV.exe
  C:\Windows\System\KulEkrV.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\MIVnjZf.exe
  C:\Windows\System\MIVnjZf.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\nYgEdub.exe
  C:\Windows\System\nYgEdub.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\dcbHjat.exe
  C:\Windows\System\dcbHjat.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\GIUqmGe.exe
  C:\Windows\System\GIUqmGe.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\VdXXhgJ.exe
  C:\Windows\System\VdXXhgJ.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\zlghEFE.exe
  C:\Windows\System\zlghEFE.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\FRMFyyt.exe
  C:\Windows\System\FRMFyyt.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\nDhMvOd.exe
  C:\Windows\System\nDhMvOd.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\rJmImcF.exe
  C:\Windows\System\rJmImcF.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\nyiSFVJ.exe
  C:\Windows\System\nyiSFVJ.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\LpCBJvU.exe
  C:\Windows\System\LpCBJvU.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\hRbBojl.exe
  C:\Windows\System\hRbBojl.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\JUNXLsf.exe
  C:\Windows\System\JUNXLsf.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\nEOhZAh.exe
  C:\Windows\System\nEOhZAh.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\ndJeDBq.exe
  C:\Windows\System\ndJeDBq.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\cIDaiLD.exe
  C:\Windows\System\cIDaiLD.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\frOXMxo.exe
  C:\Windows\System\frOXMxo.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\YwHyEOZ.exe
  C:\Windows\System\YwHyEOZ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\tlnOqYo.exe
  C:\Windows\System\tlnOqYo.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\jLQlEAN.exe
  C:\Windows\System\jLQlEAN.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\WoUTSJZ.exe
  C:\Windows\System\WoUTSJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\TaLNnrr.exe
  C:\Windows\System\TaLNnrr.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\FqMuFsm.exe
  C:\Windows\System\FqMuFsm.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\ywQxNEG.exe
  C:\Windows\System\ywQxNEG.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\VHSbRWW.exe
  C:\Windows\System\VHSbRWW.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\vewqISa.exe
  C:\Windows\System\vewqISa.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\XNWTOyf.exe
  C:\Windows\System\XNWTOyf.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\OGoiPVi.exe
  C:\Windows\System\OGoiPVi.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\WTvyRmz.exe
  C:\Windows\System\WTvyRmz.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\WdGdtRR.exe
  C:\Windows\System\WdGdtRR.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\pfCRGcw.exe
  C:\Windows\System\pfCRGcw.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\LKfZePd.exe
  C:\Windows\System\LKfZePd.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\IdeHXeI.exe
  C:\Windows\System\IdeHXeI.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ftsqKDn.exe
  C:\Windows\System\ftsqKDn.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\qzeMort.exe
  C:\Windows\System\qzeMort.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\iEsMDVx.exe
  C:\Windows\System\iEsMDVx.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\SmEHGXk.exe
  C:\Windows\System\SmEHGXk.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\VEtYTHM.exe
  C:\Windows\System\VEtYTHM.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\IGZRrMW.exe
  C:\Windows\System\IGZRrMW.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\xKKSZQt.exe
  C:\Windows\System\xKKSZQt.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\ROSVpfn.exe
  C:\Windows\System\ROSVpfn.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\PLpGIyM.exe
  C:\Windows\System\PLpGIyM.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\KEjuesD.exe
  C:\Windows\System\KEjuesD.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\TQvCKFu.exe
  C:\Windows\System\TQvCKFu.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\GZiYAyT.exe
  C:\Windows\System\GZiYAyT.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\OBvuJMb.exe
  C:\Windows\System\OBvuJMb.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\LNHPFdo.exe
  C:\Windows\System\LNHPFdo.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\PCQqFOR.exe
  C:\Windows\System\PCQqFOR.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\LYieKYv.exe
  C:\Windows\System\LYieKYv.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\cqCJNho.exe
  C:\Windows\System\cqCJNho.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\UdKTLjr.exe
  C:\Windows\System\UdKTLjr.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\cTuKJHI.exe
  C:\Windows\System\cTuKJHI.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\cGhICBJ.exe
  C:\Windows\System\cGhICBJ.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\vjAQppq.exe
  C:\Windows\System\vjAQppq.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\yFfoFtt.exe
  C:\Windows\System\yFfoFtt.exe
  2⤵
  PID:4056
- C:\Windows\System\DBmqMZr.exe
  C:\Windows\System\DBmqMZr.exe
  2⤵
  PID:2052
- C:\Windows\System\OBKHwOT.exe
  C:\Windows\System\OBKHwOT.exe
  2⤵
  PID:2852
- C:\Windows\System\oQEExIB.exe
  C:\Windows\System\oQEExIB.exe
  2⤵
  PID:2616
- C:\Windows\System\tktfKav.exe
  C:\Windows\System\tktfKav.exe
  2⤵
  PID:3956
- C:\Windows\System\eyugtEl.exe
  C:\Windows\System\eyugtEl.exe
  2⤵
  PID:4388
- C:\Windows\System\AlVNLzT.exe
  C:\Windows\System\AlVNLzT.exe
  2⤵
  PID:3496
- C:\Windows\System\uObLDIS.exe
  C:\Windows\System\uObLDIS.exe
  2⤵
  PID:1496
- C:\Windows\System\OdMUhAC.exe
  C:\Windows\System\OdMUhAC.exe
  2⤵
  PID:4400
- C:\Windows\System\HGodoZf.exe
  C:\Windows\System\HGodoZf.exe
  2⤵
  PID:1908
- C:\Windows\System\UvNduRJ.exe
  C:\Windows\System\UvNduRJ.exe
  2⤵
  PID:456
- C:\Windows\System\usuNnKg.exe
  C:\Windows\System\usuNnKg.exe
  2⤵
  PID:4140
- C:\Windows\System\IBjxZZB.exe
  C:\Windows\System\IBjxZZB.exe
  2⤵
  PID:868
- C:\Windows\System\CBsZIxG.exe
  C:\Windows\System\CBsZIxG.exe
  2⤵
  PID:2216
- C:\Windows\System\XjpIzCy.exe
  C:\Windows\System\XjpIzCy.exe
  2⤵
  PID:4608
- C:\Windows\System\reVqfDx.exe
  C:\Windows\System\reVqfDx.exe
  2⤵
  PID:4080
- C:\Windows\System\nsDCIQU.exe
  C:\Windows\System\nsDCIQU.exe
  2⤵
  PID:948
- C:\Windows\System\mXWAtoc.exe
  C:\Windows\System\mXWAtoc.exe
  2⤵
  PID:4688
- C:\Windows\System\XAqutcG.exe
  C:\Windows\System\XAqutcG.exe
  2⤵
  PID:2148
- C:\Windows\System\JShQepK.exe
  C:\Windows\System\JShQepK.exe
  2⤵
  PID:4704
- C:\Windows\System\IooorZc.exe
  C:\Windows\System\IooorZc.exe
  2⤵
  PID:1900
- C:\Windows\System\erUaYzo.exe
  C:\Windows\System\erUaYzo.exe
  2⤵
  PID:3316
- C:\Windows\System\bZEVzEB.exe
  C:\Windows\System\bZEVzEB.exe
  2⤵
  PID:3008
- C:\Windows\System\XpvNVXN.exe
  C:\Windows\System\XpvNVXN.exe
  2⤵
  PID:2068
- C:\Windows\System\WaPOfxf.exe
  C:\Windows\System\WaPOfxf.exe
  2⤵
  PID:612
- C:\Windows\System\uCqkXjD.exe
  C:\Windows\System\uCqkXjD.exe
  2⤵
  PID:3412
- C:\Windows\System\KHGltDk.exe
  C:\Windows\System\KHGltDk.exe
  2⤵
  PID:640
- C:\Windows\System\olaXZML.exe
  C:\Windows\System\olaXZML.exe
  2⤵
  PID:3372
- C:\Windows\System\HfyMiUk.exe
  C:\Windows\System\HfyMiUk.exe
  2⤵
  PID:1956
- C:\Windows\System\AxyQexN.exe
  C:\Windows\System\AxyQexN.exe
  2⤵
  PID:712
- C:\Windows\System\BWFQUQu.exe
  C:\Windows\System\BWFQUQu.exe
  2⤵
  PID:5148
- C:\Windows\System\daloetM.exe
  C:\Windows\System\daloetM.exe
  2⤵
  PID:5172
- C:\Windows\System\ZHNgfFm.exe
  C:\Windows\System\ZHNgfFm.exe
  2⤵
  PID:5204
- C:\Windows\System\uuBTjpk.exe
  C:\Windows\System\uuBTjpk.exe
  2⤵
  PID:5228
- C:\Windows\System\sbFtSGI.exe
  C:\Windows\System\sbFtSGI.exe
  2⤵
  PID:5260
- C:\Windows\System\cOrPYuX.exe
  C:\Windows\System\cOrPYuX.exe
  2⤵
  PID:5320
- C:\Windows\System\nCoMqJO.exe
  C:\Windows\System\nCoMqJO.exe
  2⤵
  PID:5360
- C:\Windows\System\qhDJsbG.exe
  C:\Windows\System\qhDJsbG.exe
  2⤵
  PID:5388
- C:\Windows\System\TmBGhSD.exe
  C:\Windows\System\TmBGhSD.exe
  2⤵
  PID:5416
- C:\Windows\System\qoIrkKR.exe
  C:\Windows\System\qoIrkKR.exe
  2⤵
  PID:5432
- C:\Windows\System\HLbrnbL.exe
  C:\Windows\System\HLbrnbL.exe
  2⤵
  PID:5464
- C:\Windows\System\WPrRQfK.exe
  C:\Windows\System\WPrRQfK.exe
  2⤵
  PID:5484
- C:\Windows\System\NUoFbXs.exe
  C:\Windows\System\NUoFbXs.exe
  2⤵
  PID:5516
- C:\Windows\System\WuuVIYK.exe
  C:\Windows\System\WuuVIYK.exe
  2⤵
  PID:5544
- C:\Windows\System\gnyoGmF.exe
  C:\Windows\System\gnyoGmF.exe
  2⤵
  PID:5580
- C:\Windows\System\PptGGOj.exe
  C:\Windows\System\PptGGOj.exe
  2⤵
  PID:5600
- C:\Windows\System\miYCsYJ.exe
  C:\Windows\System\miYCsYJ.exe
  2⤵
  PID:5636
- C:\Windows\System\vKrHgzY.exe
  C:\Windows\System\vKrHgzY.exe
  2⤵
  PID:5656
- C:\Windows\System\UrGugFh.exe
  C:\Windows\System\UrGugFh.exe
  2⤵
  PID:5692
- C:\Windows\System\fJmjwCY.exe
  C:\Windows\System\fJmjwCY.exe
  2⤵
  PID:5712
- C:\Windows\System\kPSIcTY.exe
  C:\Windows\System\kPSIcTY.exe
  2⤵
  PID:5740
- C:\Windows\System\bGqBBet.exe
  C:\Windows\System\bGqBBet.exe
  2⤵
  PID:5756
- C:\Windows\System\wBTlRza.exe
  C:\Windows\System\wBTlRza.exe
  2⤵
  PID:5776
- C:\Windows\System\rnODmEB.exe
  C:\Windows\System\rnODmEB.exe
  2⤵
  PID:5800
- C:\Windows\System\AlOcYTa.exe
  C:\Windows\System\AlOcYTa.exe
  2⤵
  PID:5832
- C:\Windows\System\esMTVyY.exe
  C:\Windows\System\esMTVyY.exe
  2⤵
  PID:5856
- C:\Windows\System\HJpeZGW.exe
  C:\Windows\System\HJpeZGW.exe
  2⤵
  PID:5920
- C:\Windows\System\BocjBLM.exe
  C:\Windows\System\BocjBLM.exe
  2⤵
  PID:5944
- C:\Windows\System\PRQkgvq.exe
  C:\Windows\System\PRQkgvq.exe
  2⤵
  PID:5960
- C:\Windows\System\YseEgEI.exe
  C:\Windows\System\YseEgEI.exe
  2⤵
  PID:5992
- C:\Windows\System\tmdquzw.exe
  C:\Windows\System\tmdquzw.exe
  2⤵
  PID:6032
- C:\Windows\System\VZwXbpC.exe
  C:\Windows\System\VZwXbpC.exe
  2⤵
  PID:6048
- C:\Windows\System\ROBmeWt.exe
  C:\Windows\System\ROBmeWt.exe
  2⤵
  PID:6076
- C:\Windows\System\OwEqmMC.exe
  C:\Windows\System\OwEqmMC.exe
  2⤵
  PID:6104
- C:\Windows\System\YQTWGYA.exe
  C:\Windows\System\YQTWGYA.exe
  2⤵
  PID:6132
- C:\Windows\System\CCLCVlZ.exe
  C:\Windows\System\CCLCVlZ.exe
  2⤵
  PID:3904
- C:\Windows\System\nLJtUHi.exe
  C:\Windows\System\nLJtUHi.exe
  2⤵
  PID:2196
- C:\Windows\System\cqNhUIK.exe
  C:\Windows\System\cqNhUIK.exe
  2⤵
  PID:5140
- C:\Windows\System\OucKMTg.exe
  C:\Windows\System\OucKMTg.exe
  2⤵
  PID:5252
- C:\Windows\System\AzzrxRY.exe
  C:\Windows\System\AzzrxRY.exe
  2⤵
  PID:2796
- C:\Windows\System\NVgQhEI.exe
  C:\Windows\System\NVgQhEI.exe
  2⤵
  PID:4900
- C:\Windows\System\aoAKqeO.exe
  C:\Windows\System\aoAKqeO.exe
  2⤵
  PID:4840
- C:\Windows\System\EEmdvgm.exe
  C:\Windows\System\EEmdvgm.exe
  2⤵
  PID:5356
- C:\Windows\System\zcRhACa.exe
  C:\Windows\System\zcRhACa.exe
  2⤵
  PID:5400
- C:\Windows\System\GkkCAYL.exe
  C:\Windows\System\GkkCAYL.exe
  2⤵
  PID:5480
- C:\Windows\System\JpUarIR.exe
  C:\Windows\System\JpUarIR.exe
  2⤵
  PID:5536
- C:\Windows\System\NEqZITJ.exe
  C:\Windows\System\NEqZITJ.exe
  2⤵
  PID:5592
- C:\Windows\System\jJGREDG.exe
  C:\Windows\System\jJGREDG.exe
  2⤵
  PID:5684
- C:\Windows\System\WVwboKH.exe
  C:\Windows\System\WVwboKH.exe
  2⤵
  PID:5732
- C:\Windows\System\xNMVVEw.exe
  C:\Windows\System\xNMVVEw.exe
  2⤵
  PID:5824
- C:\Windows\System\qPPXbnF.exe
  C:\Windows\System\qPPXbnF.exe
  2⤵
  PID:5904
- C:\Windows\System\jUZHAtT.exe
  C:\Windows\System\jUZHAtT.exe
  2⤵
  PID:5976
- C:\Windows\System\lUVWlHQ.exe
  C:\Windows\System\lUVWlHQ.exe
  2⤵
  PID:6024
- C:\Windows\System\rKNyazX.exe
  C:\Windows\System\rKNyazX.exe
  2⤵
  PID:6100
- C:\Windows\System\bpNOViq.exe
  C:\Windows\System\bpNOViq.exe
  2⤵
  PID:3452
- C:\Windows\System\grRYfFi.exe
  C:\Windows\System\grRYfFi.exe
  2⤵
  PID:904
- C:\Windows\System\RZUXMDn.exe
  C:\Windows\System\RZUXMDn.exe
  2⤵
  PID:924
- C:\Windows\System\VXeABtn.exe
  C:\Windows\System\VXeABtn.exe
  2⤵
  PID:5412
- C:\Windows\System\heyXUCv.exe
  C:\Windows\System\heyXUCv.exe
  2⤵
  PID:5560
- C:\Windows\System\dlTMliY.exe
  C:\Windows\System\dlTMliY.exe
  2⤵
  PID:5652
- C:\Windows\System\klBnxUp.exe
  C:\Windows\System\klBnxUp.exe
  2⤵
  PID:5700
- C:\Windows\System\cKSIdgP.exe
  C:\Windows\System\cKSIdgP.exe
  2⤵
  PID:5772
- C:\Windows\System\uuAgRIG.exe
  C:\Windows\System\uuAgRIG.exe
  2⤵
  PID:5876
- C:\Windows\System\BvtsFwA.exe
  C:\Windows\System\BvtsFwA.exe
  2⤵
  PID:6016
- C:\Windows\System\gwUmvEN.exe
  C:\Windows\System\gwUmvEN.exe
  2⤵
  PID:1308
- C:\Windows\System\QwnqVbP.exe
  C:\Windows\System\QwnqVbP.exe
  2⤵
  PID:5272
- C:\Windows\System\eMAfzaJ.exe
  C:\Windows\System\eMAfzaJ.exe
  2⤵
  PID:5280
- C:\Windows\System\wZanoJX.exe
  C:\Windows\System\wZanoJX.exe
  2⤵
  PID:5728
- C:\Windows\System\xnLJPvY.exe
  C:\Windows\System\xnLJPvY.exe
  2⤵
  PID:6180
- C:\Windows\System\GOHNqti.exe
  C:\Windows\System\GOHNqti.exe
  2⤵
  PID:6200
- C:\Windows\System\iYhWqQK.exe
  C:\Windows\System\iYhWqQK.exe
  2⤵
  PID:6244
- C:\Windows\System\tcuXzjx.exe
  C:\Windows\System\tcuXzjx.exe
  2⤵
  PID:6268
- C:\Windows\System\gVYiIoS.exe
  C:\Windows\System\gVYiIoS.exe
  2⤵
  PID:6296
- C:\Windows\System\dtgbTbW.exe
  C:\Windows\System\dtgbTbW.exe
  2⤵
  PID:6312
- C:\Windows\System\yOdmOEU.exe
  C:\Windows\System\yOdmOEU.exe
  2⤵
  PID:6328
- C:\Windows\System\bSbwCSH.exe
  C:\Windows\System\bSbwCSH.exe
  2⤵
  PID:6392
- C:\Windows\System\UxFNUse.exe
  C:\Windows\System\UxFNUse.exe
  2⤵
  PID:6420
- C:\Windows\System\hiZtxvh.exe
  C:\Windows\System\hiZtxvh.exe
  2⤵
  PID:6436
- C:\Windows\System\AhIiNNt.exe
  C:\Windows\System\AhIiNNt.exe
  2⤵
  PID:6464
- C:\Windows\System\fuAMTYE.exe
  C:\Windows\System\fuAMTYE.exe
  2⤵
  PID:6480
- C:\Windows\System\jtdJsKt.exe
  C:\Windows\System\jtdJsKt.exe
  2⤵
  PID:6516
- C:\Windows\System\SFgKYnt.exe
  C:\Windows\System\SFgKYnt.exe
  2⤵
  PID:6532
- C:\Windows\System\lYtUerq.exe
  C:\Windows\System\lYtUerq.exe
  2⤵
  PID:6552
- C:\Windows\System\PhVwbfJ.exe
  C:\Windows\System\PhVwbfJ.exe
  2⤵
  PID:6580
- C:\Windows\System\tCltoqL.exe
  C:\Windows\System\tCltoqL.exe
  2⤵
  PID:6612
- C:\Windows\System\XjkATTq.exe
  C:\Windows\System\XjkATTq.exe
  2⤵
  PID:6644
- C:\Windows\System\RTejVKP.exe
  C:\Windows\System\RTejVKP.exe
  2⤵
  PID:6672
- C:\Windows\System\qFJRrkD.exe
  C:\Windows\System\qFJRrkD.exe
  2⤵
  PID:6704
- C:\Windows\System\ShqFjuN.exe
  C:\Windows\System\ShqFjuN.exe
  2⤵
  PID:6724
- C:\Windows\System\nmffBcG.exe
  C:\Windows\System\nmffBcG.exe
  2⤵
  PID:6768
- C:\Windows\System\eJdJscs.exe
  C:\Windows\System\eJdJscs.exe
  2⤵
  PID:6796
- C:\Windows\System\WojzxsA.exe
  C:\Windows\System\WojzxsA.exe
  2⤵
  PID:6824
- C:\Windows\System\mQIBLGd.exe
  C:\Windows\System\mQIBLGd.exe
  2⤵
  PID:6856
- C:\Windows\System\IFOAMYK.exe
  C:\Windows\System\IFOAMYK.exe
  2⤵
  PID:6892
- C:\Windows\System\QUGHiaK.exe
  C:\Windows\System\QUGHiaK.exe
  2⤵
  PID:6912
- C:\Windows\System\nCMeMRX.exe
  C:\Windows\System\nCMeMRX.exe
  2⤵
  PID:6944
- C:\Windows\System\qZrodhk.exe
  C:\Windows\System\qZrodhk.exe
  2⤵
  PID:6972
- C:\Windows\System\TXuDikT.exe
  C:\Windows\System\TXuDikT.exe
  2⤵
  PID:7000
- C:\Windows\System\bmASpBD.exe
  C:\Windows\System\bmASpBD.exe
  2⤵
  PID:7032
- C:\Windows\System\fwrjDhF.exe
  C:\Windows\System\fwrjDhF.exe
  2⤵
  PID:7056
- C:\Windows\System\jzDTJfO.exe
  C:\Windows\System\jzDTJfO.exe
  2⤵
  PID:7084
- C:\Windows\System\AoIvCdd.exe
  C:\Windows\System\AoIvCdd.exe
  2⤵
  PID:7112
- C:\Windows\System\yhbMKAf.exe
  C:\Windows\System\yhbMKAf.exe
  2⤵
  PID:7144
- C:\Windows\System\NwhCXcX.exe
  C:\Windows\System\NwhCXcX.exe
  2⤵
  PID:952
- C:\Windows\System\yjYKRit.exe
  C:\Windows\System\yjYKRit.exe
  2⤵
  PID:6156
- C:\Windows\System\MMwcdqg.exe
  C:\Windows\System\MMwcdqg.exe
  2⤵
  PID:6232
- C:\Windows\System\HPJSPpm.exe
  C:\Windows\System\HPJSPpm.exe
  2⤵
  PID:6348
- C:\Windows\System\hATnwPy.exe
  C:\Windows\System\hATnwPy.exe
  2⤵
  PID:6384
- C:\Windows\System\mOXRPzT.exe
  C:\Windows\System\mOXRPzT.exe
  2⤵
  PID:6432
- C:\Windows\System\ANEIQoV.exe
  C:\Windows\System\ANEIQoV.exe
  2⤵
  PID:6492
- C:\Windows\System\gVMNauO.exe
  C:\Windows\System\gVMNauO.exe
  2⤵
  PID:6588
- C:\Windows\System\jOxiWuR.exe
  C:\Windows\System\jOxiWuR.exe
  2⤵
  PID:6596
- C:\Windows\System\VXXSLMr.exe
  C:\Windows\System\VXXSLMr.exe
  2⤵
  PID:6688
- C:\Windows\System\ttTSAeT.exe
  C:\Windows\System\ttTSAeT.exe
  2⤵
  PID:6764
- C:\Windows\System\tyNBBtK.exe
  C:\Windows\System\tyNBBtK.exe
  2⤵
  PID:6812
- C:\Windows\System\zrUZfKo.exe
  C:\Windows\System\zrUZfKo.exe
  2⤵
  PID:6884
- C:\Windows\System\BecVFzo.exe
  C:\Windows\System\BecVFzo.exe
  2⤵
  PID:6968
- C:\Windows\System\IGBBonk.exe
  C:\Windows\System\IGBBonk.exe
  2⤵
  PID:7012
- C:\Windows\System\hgOvDKt.exe
  C:\Windows\System\hgOvDKt.exe
  2⤵
  PID:7068
- C:\Windows\System\iUzKgZr.exe
  C:\Windows\System\iUzKgZr.exe
  2⤵
  PID:7156
- C:\Windows\System\XVlSkrb.exe
  C:\Windows\System\XVlSkrb.exe
  2⤵
  PID:6196
- C:\Windows\System\ScpJtqh.exe
  C:\Windows\System\ScpJtqh.exe
  2⤵
  PID:6376
- C:\Windows\System\BimFANa.exe
  C:\Windows\System\BimFANa.exe
  2⤵
  PID:6544
- C:\Windows\System\XaUUoVL.exe
  C:\Windows\System\XaUUoVL.exe
  2⤵
  PID:6736
- C:\Windows\System\fMjHmJL.exe
  C:\Windows\System\fMjHmJL.exe
  2⤵
  PID:6868
- C:\Windows\System\ETvCWpP.exe
  C:\Windows\System\ETvCWpP.exe
  2⤵
  PID:6964
- C:\Windows\System\ofBrVPJ.exe
  C:\Windows\System\ofBrVPJ.exe
  2⤵
  PID:7152
- C:\Windows\System\vodEfUP.exe
  C:\Windows\System\vodEfUP.exe
  2⤵
  PID:6288
- C:\Windows\System\XdoYkSY.exe
  C:\Windows\System\XdoYkSY.exe
  2⤵
  PID:6664
- C:\Windows\System\CkrSTYu.exe
  C:\Windows\System\CkrSTYu.exe
  2⤵
  PID:6928
- C:\Windows\System\LEEqReK.exe
  C:\Windows\System\LEEqReK.exe
  2⤵
  PID:7176
- C:\Windows\System\InVCyRL.exe
  C:\Windows\System\InVCyRL.exe
  2⤵
  PID:7204
- C:\Windows\System\jGUTPvI.exe
  C:\Windows\System\jGUTPvI.exe
  2⤵
  PID:7232
- C:\Windows\System\YFonjJd.exe
  C:\Windows\System\YFonjJd.exe
  2⤵
  PID:7256
- C:\Windows\System\zQakiSr.exe
  C:\Windows\System\zQakiSr.exe
  2⤵
  PID:7288
- C:\Windows\System\ZCHbQdb.exe
  C:\Windows\System\ZCHbQdb.exe
  2⤵
  PID:7316
- C:\Windows\System\OUFEhfR.exe
  C:\Windows\System\OUFEhfR.exe
  2⤵
  PID:7344
- C:\Windows\System\WcoqmfQ.exe
  C:\Windows\System\WcoqmfQ.exe
  2⤵
  PID:7372
- C:\Windows\System\YJJKDDh.exe
  C:\Windows\System\YJJKDDh.exe
  2⤵
  PID:7396
- C:\Windows\System\iaZCgti.exe
  C:\Windows\System\iaZCgti.exe
  2⤵
  PID:7420
- C:\Windows\System\FgZDkNY.exe
  C:\Windows\System\FgZDkNY.exe
  2⤵
  PID:7440
- C:\Windows\System\JVKdEcy.exe
  C:\Windows\System\JVKdEcy.exe
  2⤵
  PID:7472
- C:\Windows\System\ysWGQjT.exe
  C:\Windows\System\ysWGQjT.exe
  2⤵
  PID:7492
- C:\Windows\System\zlfTjoE.exe
  C:\Windows\System\zlfTjoE.exe
  2⤵
  PID:7520
- C:\Windows\System\shHYmXs.exe
  C:\Windows\System\shHYmXs.exe
  2⤵
  PID:7552
- C:\Windows\System\PWkLRCH.exe
  C:\Windows\System\PWkLRCH.exe
  2⤵
  PID:7584
- C:\Windows\System\JgdbLjL.exe
  C:\Windows\System\JgdbLjL.exe
  2⤵
  PID:7608
- C:\Windows\System\CDXzivW.exe
  C:\Windows\System\CDXzivW.exe
  2⤵
  PID:7644
- C:\Windows\System\dPvGMBj.exe
  C:\Windows\System\dPvGMBj.exe
  2⤵
  PID:7672
- C:\Windows\System\HRsvAhd.exe
  C:\Windows\System\HRsvAhd.exe
  2⤵
  PID:7712
- C:\Windows\System\bSQTJYc.exe
  C:\Windows\System\bSQTJYc.exe
  2⤵
  PID:7728
- C:\Windows\System\CLmsriE.exe
  C:\Windows\System\CLmsriE.exe
  2⤵
  PID:7756
- C:\Windows\System\AQEKnnb.exe
  C:\Windows\System\AQEKnnb.exe
  2⤵
  PID:7776
- C:\Windows\System\etNZlhd.exe
  C:\Windows\System\etNZlhd.exe
  2⤵
  PID:7800
- C:\Windows\System\mxKRJsx.exe
  C:\Windows\System\mxKRJsx.exe
  2⤵
  PID:7828
- C:\Windows\System\EyWORhd.exe
  C:\Windows\System\EyWORhd.exe
  2⤵
  PID:7864
- C:\Windows\System\XMsIiIm.exe
  C:\Windows\System\XMsIiIm.exe
  2⤵
  PID:7896
- C:\Windows\System\gNwMXyP.exe
  C:\Windows\System\gNwMXyP.exe
  2⤵
  PID:7932
- C:\Windows\System\cwbjSil.exe
  C:\Windows\System\cwbjSil.exe
  2⤵
  PID:7960
- C:\Windows\System\cTlorSD.exe
  C:\Windows\System\cTlorSD.exe
  2⤵
  PID:7980
- C:\Windows\System\HpNiemm.exe
  C:\Windows\System\HpNiemm.exe
  2⤵
  PID:8008
- C:\Windows\System\CXUfTLt.exe
  C:\Windows\System\CXUfTLt.exe
  2⤵
  PID:8028
- C:\Windows\System\qcOxfjw.exe
  C:\Windows\System\qcOxfjw.exe
  2⤵
  PID:8064
- C:\Windows\System\GFGwxEO.exe
  C:\Windows\System\GFGwxEO.exe
  2⤵
  PID:8080
- C:\Windows\System\hMDOSHb.exe
  C:\Windows\System\hMDOSHb.exe
  2⤵
  PID:8120
- C:\Windows\System\ghrmtIf.exe
  C:\Windows\System\ghrmtIf.exe
  2⤵
  PID:8140
- C:\Windows\System\QehhcQu.exe
  C:\Windows\System\QehhcQu.exe
  2⤵
  PID:8172
- C:\Windows\System\XAASrZN.exe
  C:\Windows\System\XAASrZN.exe
  2⤵
  PID:6572
- C:\Windows\System\vqlKbax.exe
  C:\Windows\System\vqlKbax.exe
  2⤵
  PID:7228
- C:\Windows\System\oNHkoSn.exe
  C:\Windows\System\oNHkoSn.exe
  2⤵
  PID:7272
- C:\Windows\System\dOJQSlQ.exe
  C:\Windows\System\dOJQSlQ.exe
  2⤵
  PID:7340
- C:\Windows\System\JxflswL.exe
  C:\Windows\System\JxflswL.exe
  2⤵
  PID:7404
- C:\Windows\System\QJIvFtg.exe
  C:\Windows\System\QJIvFtg.exe
  2⤵
  PID:7448
- C:\Windows\System\TYVjcqw.exe
  C:\Windows\System\TYVjcqw.exe
  2⤵
  PID:7540
- C:\Windows\System\CfSLtQl.exe
  C:\Windows\System\CfSLtQl.exe
  2⤵
  PID:7604
- C:\Windows\System\gVVjqmq.exe
  C:\Windows\System\gVVjqmq.exe
  2⤵
  PID:7692
- C:\Windows\System\YggqEHS.exe
  C:\Windows\System\YggqEHS.exe
  2⤵
  PID:7740
- C:\Windows\System\kThiDTQ.exe
  C:\Windows\System\kThiDTQ.exe
  2⤵
  PID:7820
- C:\Windows\System\XwXwRLr.exe
  C:\Windows\System\XwXwRLr.exe
  2⤵
  PID:7856
- C:\Windows\System\wQudWey.exe
  C:\Windows\System\wQudWey.exe
  2⤵
  PID:7952
- C:\Windows\System\MeSXZFg.exe
  C:\Windows\System\MeSXZFg.exe
  2⤵
  PID:7976
- C:\Windows\System\PVLZkpL.exe
  C:\Windows\System\PVLZkpL.exe
  2⤵
  PID:8072
- C:\Windows\System\ogqHVCZ.exe
  C:\Windows\System\ogqHVCZ.exe
  2⤵
  PID:7128
- C:\Windows\System\nszVSmg.exe
  C:\Windows\System\nszVSmg.exe
  2⤵
  PID:7188
- C:\Windows\System\dMEyFIP.exe
  C:\Windows\System\dMEyFIP.exe
  2⤵
  PID:5956
- C:\Windows\System\EhDRRzV.exe
  C:\Windows\System\EhDRRzV.exe
  2⤵
  PID:7488
- C:\Windows\System\UOwjuCs.exe
  C:\Windows\System\UOwjuCs.exe
  2⤵
  PID:7724
- C:\Windows\System\ihQZCYu.exe
  C:\Windows\System\ihQZCYu.exe
  2⤵
  PID:7792
- C:\Windows\System\xBQpala.exe
  C:\Windows\System\xBQpala.exe
  2⤵
  PID:8048
- C:\Windows\System\xntFKkW.exe
  C:\Windows\System\xntFKkW.exe
  2⤵
  PID:8152
- C:\Windows\System\UCxodiI.exe
  C:\Windows\System\UCxodiI.exe
  2⤵
  PID:7628
- C:\Windows\System\YoTCjWM.exe
  C:\Windows\System\YoTCjWM.exe
  2⤵
  PID:7992
- C:\Windows\System\yTqHwxG.exe
  C:\Windows\System\yTqHwxG.exe
  2⤵
  PID:8100
- C:\Windows\System\etHxSdv.exe
  C:\Windows\System\etHxSdv.exe
  2⤵
  PID:8136
- C:\Windows\System\MgwKiPr.exe
  C:\Windows\System\MgwKiPr.exe
  2⤵
  PID:8208
- C:\Windows\System\OmssMsN.exe
  C:\Windows\System\OmssMsN.exe
  2⤵
  PID:8236
- C:\Windows\System\sutEkCa.exe
  C:\Windows\System\sutEkCa.exe
  2⤵
  PID:8256
- C:\Windows\System\jISSFzb.exe
  C:\Windows\System\jISSFzb.exe
  2⤵
  PID:8292
- C:\Windows\System\eaFomYV.exe
  C:\Windows\System\eaFomYV.exe
  2⤵
  PID:8308
- C:\Windows\System\ZMdrIUc.exe
  C:\Windows\System\ZMdrIUc.exe
  2⤵
  PID:8344
- C:\Windows\System\DqLlgQW.exe
  C:\Windows\System\DqLlgQW.exe
  2⤵
  PID:8368
- C:\Windows\System\JYunhfX.exe
  C:\Windows\System\JYunhfX.exe
  2⤵
  PID:8416
- C:\Windows\System\DjCqXrp.exe
  C:\Windows\System\DjCqXrp.exe
  2⤵
  PID:8432
- C:\Windows\System\PkbPKEy.exe
  C:\Windows\System\PkbPKEy.exe
  2⤵
  PID:8448
- C:\Windows\System\UNocdJT.exe
  C:\Windows\System\UNocdJT.exe
  2⤵
  PID:8484
- C:\Windows\System\kNLRZSz.exe
  C:\Windows\System\kNLRZSz.exe
  2⤵
  PID:8528
- C:\Windows\System\npHqzJb.exe
  C:\Windows\System\npHqzJb.exe
  2⤵
  PID:8548
- C:\Windows\System\cdIuUJw.exe
  C:\Windows\System\cdIuUJw.exe
  2⤵
  PID:8572
- C:\Windows\System\FofoOFj.exe
  C:\Windows\System\FofoOFj.exe
  2⤵
  PID:8600
- C:\Windows\System\bxomqNm.exe
  C:\Windows\System\bxomqNm.exe
  2⤵
  PID:8628
- C:\Windows\System\iYKWmpe.exe
  C:\Windows\System\iYKWmpe.exe
  2⤵
  PID:8656
- C:\Windows\System\HiQYRYF.exe
  C:\Windows\System\HiQYRYF.exe
  2⤵
  PID:8684
- C:\Windows\System\meQVgUo.exe
  C:\Windows\System\meQVgUo.exe
  2⤵
  PID:8724
- C:\Windows\System\HGgnPxc.exe
  C:\Windows\System\HGgnPxc.exe
  2⤵
  PID:8740
- C:\Windows\System\jTyGtGb.exe
  C:\Windows\System\jTyGtGb.exe
  2⤵
  PID:8760
- C:\Windows\System\KhtbVSU.exe
  C:\Windows\System\KhtbVSU.exe
  2⤵
  PID:8796
- C:\Windows\System\vkfAemV.exe
  C:\Windows\System\vkfAemV.exe
  2⤵
  PID:8828
- C:\Windows\System\sdDDdGi.exe
  C:\Windows\System\sdDDdGi.exe
  2⤵
  PID:8852
- C:\Windows\System\ZloeUGA.exe
  C:\Windows\System\ZloeUGA.exe
  2⤵
  PID:8876
- C:\Windows\System\tljPyyD.exe
  C:\Windows\System\tljPyyD.exe
  2⤵
  PID:8908
- C:\Windows\System\Kmvmwfk.exe
  C:\Windows\System\Kmvmwfk.exe
  2⤵
  PID:8936
- C:\Windows\System\pljtnGU.exe
  C:\Windows\System\pljtnGU.exe
  2⤵
  PID:8956
- C:\Windows\System\rmHquUq.exe
  C:\Windows\System\rmHquUq.exe
  2⤵
  PID:8988
- C:\Windows\System\ugfUkoW.exe
  C:\Windows\System\ugfUkoW.exe
  2⤵
  PID:9036
- C:\Windows\System\kPhOIIr.exe
  C:\Windows\System\kPhOIIr.exe
  2⤵
  PID:9064
- C:\Windows\System\bSVZwuR.exe
  C:\Windows\System\bSVZwuR.exe
  2⤵
  PID:9080
- C:\Windows\System\NuaKmfc.exe
  C:\Windows\System\NuaKmfc.exe
  2⤵
  PID:9104
- C:\Windows\System\fGcHPsc.exe
  C:\Windows\System\fGcHPsc.exe
  2⤵
  PID:9136
- C:\Windows\System\VjPBXGd.exe
  C:\Windows\System\VjPBXGd.exe
  2⤵
  PID:9152
- C:\Windows\System\EGoZjZZ.exe
  C:\Windows\System\EGoZjZZ.exe
  2⤵
  PID:9184
- C:\Windows\System\AECJWcD.exe
  C:\Windows\System\AECJWcD.exe
  2⤵
  PID:8228
- C:\Windows\System\lPlmOXp.exe
  C:\Windows\System\lPlmOXp.exe
  2⤵
  PID:8284
- C:\Windows\System\lUDyrwI.exe
  C:\Windows\System\lUDyrwI.exe
  2⤵
  PID:8304
- C:\Windows\System\ixNzrqi.exe
  C:\Windows\System\ixNzrqi.exe
  2⤵
  PID:8376
- C:\Windows\System\oZazqia.exe
  C:\Windows\System\oZazqia.exe
  2⤵
  PID:8444
- C:\Windows\System\QgewFUl.exe
  C:\Windows\System\QgewFUl.exe
  2⤵
  PID:8472
- C:\Windows\System\hvJgswa.exe
  C:\Windows\System\hvJgswa.exe
  2⤵
  PID:8536
- C:\Windows\System\rnbGflL.exe
  C:\Windows\System\rnbGflL.exe
  2⤵
  PID:8616
- C:\Windows\System\pzPvgVh.exe
  C:\Windows\System\pzPvgVh.exe
  2⤵
  PID:8644
- C:\Windows\System\gFXMNwr.exe
  C:\Windows\System\gFXMNwr.exe
  2⤵
  PID:8716
- C:\Windows\System\oRyWcgQ.exe
  C:\Windows\System\oRyWcgQ.exe
  2⤵
  PID:8784
- C:\Windows\System\RbFVWvp.exe
  C:\Windows\System\RbFVWvp.exe
  2⤵
  PID:8904
- C:\Windows\System\CFLYTsa.exe
  C:\Windows\System\CFLYTsa.exe
  2⤵
  PID:8952
- C:\Windows\System\AmHUtLm.exe
  C:\Windows\System\AmHUtLm.exe
  2⤵
  PID:9024
- C:\Windows\System\wPmHJcu.exe
  C:\Windows\System\wPmHJcu.exe
  2⤵
  PID:9072
- C:\Windows\System\hwKiKQJ.exe
  C:\Windows\System\hwKiKQJ.exe
  2⤵
  PID:9148
- C:\Windows\System\yqYpXuC.exe
  C:\Windows\System\yqYpXuC.exe
  2⤵
  PID:8244
- C:\Windows\System\xvrFDsb.exe
  C:\Windows\System\xvrFDsb.exe
  2⤵
  PID:8352
- C:\Windows\System\AzDmNQV.exe
  C:\Windows\System\AzDmNQV.exe
  2⤵
  PID:8504
- C:\Windows\System\BRsTpAO.exe
  C:\Windows\System\BRsTpAO.exe
  2⤵
  PID:8648
- C:\Windows\System\otmOece.exe
  C:\Windows\System\otmOece.exe
  2⤵
  PID:8820
- C:\Windows\System\INjSomT.exe
  C:\Windows\System\INjSomT.exe
  2⤵
  PID:8980
- C:\Windows\System\tAVKPxy.exe
  C:\Windows\System\tAVKPxy.exe
  2⤵
  PID:9120
- C:\Windows\System\dPZQbgg.exe
  C:\Windows\System\dPZQbgg.exe
  2⤵
  PID:8392
- C:\Windows\System\KqhhtUp.exe
  C:\Windows\System\KqhhtUp.exe
  2⤵
  PID:8668
- C:\Windows\System\aRVQlhV.exe
  C:\Windows\System\aRVQlhV.exe
  2⤵
  PID:8964
- C:\Windows\System\ZPoOqnz.exe
  C:\Windows\System\ZPoOqnz.exe
  2⤵
  PID:8280
- C:\Windows\System\RYdDRVF.exe
  C:\Windows\System\RYdDRVF.exe
  2⤵
  PID:9076
- C:\Windows\System\JnmjcCn.exe
  C:\Windows\System\JnmjcCn.exe
  2⤵
  PID:9232
- C:\Windows\System\OONhezr.exe
  C:\Windows\System\OONhezr.exe
  2⤵
  PID:9268
- C:\Windows\System\LPEYNKp.exe
  C:\Windows\System\LPEYNKp.exe
  2⤵
  PID:9300
- C:\Windows\System\dfhKOzo.exe
  C:\Windows\System\dfhKOzo.exe
  2⤵
  PID:9352
- C:\Windows\System\jVYzGGV.exe
  C:\Windows\System\jVYzGGV.exe
  2⤵
  PID:9380
- C:\Windows\System\hKgnBWQ.exe
  C:\Windows\System\hKgnBWQ.exe
  2⤵
  PID:9396
- C:\Windows\System\BcNwSLv.exe
  C:\Windows\System\BcNwSLv.exe
  2⤵
  PID:9428
- C:\Windows\System\OGwPwXc.exe
  C:\Windows\System\OGwPwXc.exe
  2⤵
  PID:9448
- C:\Windows\System\iqsTQBB.exe
  C:\Windows\System\iqsTQBB.exe
  2⤵
  PID:9464
- C:\Windows\System\DfUylqv.exe
  C:\Windows\System\DfUylqv.exe
  2⤵
  PID:9492
- C:\Windows\System\enSkGhM.exe
  C:\Windows\System\enSkGhM.exe
  2⤵
  PID:9516
- C:\Windows\System\jQGTcOH.exe
  C:\Windows\System\jQGTcOH.exe
  2⤵
  PID:9540
- C:\Windows\System\tIMrOir.exe
  C:\Windows\System\tIMrOir.exe
  2⤵
  PID:9564
- C:\Windows\System\doGeAsW.exe
  C:\Windows\System\doGeAsW.exe
  2⤵
  PID:9592
- C:\Windows\System\DbfBBwR.exe
  C:\Windows\System\DbfBBwR.exe
  2⤵
  PID:9612
- C:\Windows\System\xtqszfS.exe
  C:\Windows\System\xtqszfS.exe
  2⤵
  PID:9640
- C:\Windows\System\TLhCPAl.exe
  C:\Windows\System\TLhCPAl.exe
  2⤵
  PID:9680
- C:\Windows\System\BXdAArd.exe
  C:\Windows\System\BXdAArd.exe
  2⤵
  PID:9712
- C:\Windows\System\RKkGoay.exe
  C:\Windows\System\RKkGoay.exe
  2⤵
  PID:9764
- C:\Windows\System\DKOIdDq.exe
  C:\Windows\System\DKOIdDq.exe
  2⤵
  PID:9780
- C:\Windows\System\yWqnWoC.exe
  C:\Windows\System\yWqnWoC.exe
  2⤵
  PID:9820
- C:\Windows\System\KCEvJAr.exe
  C:\Windows\System\KCEvJAr.exe
  2⤵
  PID:9844
- C:\Windows\System\RSnnDud.exe
  C:\Windows\System\RSnnDud.exe
  2⤵
  PID:9872
- C:\Windows\System\sQnqxXH.exe
  C:\Windows\System\sQnqxXH.exe
  2⤵
  PID:9900
- C:\Windows\System\lonDRpc.exe
  C:\Windows\System\lonDRpc.exe
  2⤵
  PID:9928
- C:\Windows\System\YyoyaqC.exe
  C:\Windows\System\YyoyaqC.exe
  2⤵
  PID:9952
- C:\Windows\System\jadLjtn.exe
  C:\Windows\System\jadLjtn.exe
  2⤵
  PID:9972
- C:\Windows\System\ZFHrizj.exe
  C:\Windows\System\ZFHrizj.exe
  2⤵
  PID:10000
- C:\Windows\System\BhegqLT.exe
  C:\Windows\System\BhegqLT.exe
  2⤵
  PID:10016
- C:\Windows\System\UMWgHFt.exe
  C:\Windows\System\UMWgHFt.exe
  2⤵
  PID:10064
- C:\Windows\System\FmOhVAA.exe
  C:\Windows\System\FmOhVAA.exe
  2⤵
  PID:10084
- C:\Windows\System\apGKFMh.exe
  C:\Windows\System\apGKFMh.exe
  2⤵
  PID:10124
- C:\Windows\System\UrqHsVU.exe
  C:\Windows\System\UrqHsVU.exe
  2⤵
  PID:10152
- C:\Windows\System\LGlBSWH.exe
  C:\Windows\System\LGlBSWH.exe
  2⤵
  PID:10188
- C:\Windows\System\DvnyYtY.exe
  C:\Windows\System\DvnyYtY.exe
  2⤵
  PID:10208
- C:\Windows\System\UXmhqDa.exe
  C:\Windows\System\UXmhqDa.exe
  2⤵
  PID:10224
- C:\Windows\System\mcOjtjJ.exe
  C:\Windows\System\mcOjtjJ.exe
  2⤵
  PID:9244
- C:\Windows\System\nvyHiXh.exe
  C:\Windows\System\nvyHiXh.exe
  2⤵
  PID:9336
- C:\Windows\System\CKuHFMu.exe
  C:\Windows\System\CKuHFMu.exe
  2⤵
  PID:9436
- C:\Windows\System\WxjgXOH.exe
  C:\Windows\System\WxjgXOH.exe
  2⤵
  PID:9480
- C:\Windows\System\vfxqNsy.exe
  C:\Windows\System\vfxqNsy.exe
  2⤵
  PID:9524
- C:\Windows\System\kQcvlEZ.exe
  C:\Windows\System\kQcvlEZ.exe
  2⤵
  PID:9608
- C:\Windows\System\jqgXzFp.exe
  C:\Windows\System\jqgXzFp.exe
  2⤵
  PID:9664
- C:\Windows\System\COndniA.exe
  C:\Windows\System\COndniA.exe
  2⤵
  PID:9688
- C:\Windows\System\TZGyvrN.exe
  C:\Windows\System\TZGyvrN.exe
  2⤵
  PID:9804
- C:\Windows\System\JIBXxYU.exe
  C:\Windows\System\JIBXxYU.exe
  2⤵
  PID:9884
- C:\Windows\System\rphTpKx.exe
  C:\Windows\System\rphTpKx.exe
  2⤵
  PID:9916
- C:\Windows\System\jsRjNss.exe
  C:\Windows\System\jsRjNss.exe
  2⤵
  PID:9960
- C:\Windows\System\tawcTOE.exe
  C:\Windows\System\tawcTOE.exe
  2⤵
  PID:10076
- C:\Windows\System\qSbBQWu.exe
  C:\Windows\System\qSbBQWu.exe
  2⤵
  PID:10108
- C:\Windows\System\mmSaVaQ.exe
  C:\Windows\System\mmSaVaQ.exe
  2⤵
  PID:10176
- C:\Windows\System\rOuPrwn.exe
  C:\Windows\System\rOuPrwn.exe
  2⤵
  PID:9124
- C:\Windows\System\BSqNRWA.exe
  C:\Windows\System\BSqNRWA.exe
  2⤵
  PID:9408
- C:\Windows\System\vPxhSQq.exe
  C:\Windows\System\vPxhSQq.exe
  2⤵
  PID:9580
- C:\Windows\System\KKfvbsn.exe
  C:\Windows\System\KKfvbsn.exe
  2⤵
  PID:9744
- C:\Windows\System\AqEgKJV.exe
  C:\Windows\System\AqEgKJV.exe
  2⤵
  PID:9812
- C:\Windows\System\sEKxMki.exe
  C:\Windows\System\sEKxMki.exe
  2⤵
  PID:9892
- C:\Windows\System\kGltbgA.exe
  C:\Windows\System\kGltbgA.exe
  2⤵
  PID:10200
- C:\Windows\System\HYgqstM.exe
  C:\Windows\System\HYgqstM.exe
  2⤵
  PID:9460
- C:\Windows\System\KHxsbWx.exe
  C:\Windows\System\KHxsbWx.exe
  2⤵
  PID:9604
- C:\Windows\System\aIHDVrT.exe
  C:\Windows\System\aIHDVrT.exe
  2⤵
  PID:10096
- C:\Windows\System\QJpmNbV.exe
  C:\Windows\System\QJpmNbV.exe
  2⤵
  PID:9632
- C:\Windows\System\FEPLWVP.exe
  C:\Windows\System\FEPLWVP.exe
  2⤵
  PID:10256
- C:\Windows\System\ZJPrIiI.exe
  C:\Windows\System\ZJPrIiI.exe
  2⤵
  PID:10276
- C:\Windows\System\mDpoJuj.exe
  C:\Windows\System\mDpoJuj.exe
  2⤵
  PID:10304
- C:\Windows\System\pJiIFWr.exe
  C:\Windows\System\pJiIFWr.exe
  2⤵
  PID:10324
- C:\Windows\System\ITvzDxI.exe
  C:\Windows\System\ITvzDxI.exe
  2⤵
  PID:10356
- C:\Windows\System\neGWNEN.exe
  C:\Windows\System\neGWNEN.exe
  2⤵
  PID:10392
- C:\Windows\System\ymRAmbl.exe
  C:\Windows\System\ymRAmbl.exe
  2⤵
  PID:10420
- C:\Windows\System\dzAptIQ.exe
  C:\Windows\System\dzAptIQ.exe
  2⤵
  PID:10448
- C:\Windows\System\qyRnlfq.exe
  C:\Windows\System\qyRnlfq.exe
  2⤵
  PID:10464
- C:\Windows\System\SOJeHbl.exe
  C:\Windows\System\SOJeHbl.exe
  2⤵
  PID:10496
- C:\Windows\System\gDGdkoz.exe
  C:\Windows\System\gDGdkoz.exe
  2⤵
  PID:10520
- C:\Windows\System\AJETDIZ.exe
  C:\Windows\System\AJETDIZ.exe
  2⤵
  PID:10540
- C:\Windows\System\drjbbJa.exe
  C:\Windows\System\drjbbJa.exe
  2⤵
  PID:10568
- C:\Windows\System\jOyFKEu.exe
  C:\Windows\System\jOyFKEu.exe
  2⤵
  PID:10600
- C:\Windows\System\eFDodDw.exe
  C:\Windows\System\eFDodDw.exe
  2⤵
  PID:10656
- C:\Windows\System\WHNbhpQ.exe
  C:\Windows\System\WHNbhpQ.exe
  2⤵
  PID:10692
- C:\Windows\System\IVZeRWF.exe
  C:\Windows\System\IVZeRWF.exe
  2⤵
  PID:10708
- C:\Windows\System\ZvEtYNH.exe
  C:\Windows\System\ZvEtYNH.exe
  2⤵
  PID:10740
- C:\Windows\System\liUOidT.exe
  C:\Windows\System\liUOidT.exe
  2⤵
  PID:10760
- C:\Windows\System\yScDXne.exe
  C:\Windows\System\yScDXne.exe
  2⤵
  PID:10796
- C:\Windows\System\zTUakvx.exe
  C:\Windows\System\zTUakvx.exe
  2⤵
  PID:10824
- C:\Windows\System\YHcBAXf.exe
  C:\Windows\System\YHcBAXf.exe
  2⤵
  PID:10840
- C:\Windows\System\LyZDKhD.exe
  C:\Windows\System\LyZDKhD.exe
  2⤵
  PID:10872
- C:\Windows\System\CswfnbZ.exe
  C:\Windows\System\CswfnbZ.exe
  2⤵
  PID:10920
- C:\Windows\System\QFkyijA.exe
  C:\Windows\System\QFkyijA.exe
  2⤵
  PID:10944
- C:\Windows\System\KcDJybO.exe
  C:\Windows\System\KcDJybO.exe
  2⤵
  PID:10968
- C:\Windows\System\JzfEguq.exe
  C:\Windows\System\JzfEguq.exe
  2⤵
  PID:11000
- C:\Windows\System\BxcFLOe.exe
  C:\Windows\System\BxcFLOe.exe
  2⤵
  PID:11036
- C:\Windows\System\mzWKaan.exe
  C:\Windows\System\mzWKaan.exe
  2⤵
  PID:11084
- C:\Windows\System\SFIxLCG.exe
  C:\Windows\System\SFIxLCG.exe
  2⤵
  PID:11116
- C:\Windows\System\sywMCty.exe
  C:\Windows\System\sywMCty.exe
  2⤵
  PID:11136
- C:\Windows\System\KwKZAvy.exe
  C:\Windows\System\KwKZAvy.exe
  2⤵
  PID:11160
- C:\Windows\System\TEgqwWb.exe
  C:\Windows\System\TEgqwWb.exe
  2⤵
  PID:11176
- C:\Windows\System\EHJNiWr.exe
  C:\Windows\System\EHJNiWr.exe
  2⤵
  PID:11204
- C:\Windows\System\bIUYssT.exe
  C:\Windows\System\bIUYssT.exe
  2⤵
  PID:11244
- C:\Windows\System\cTtpERb.exe
  C:\Windows\System\cTtpERb.exe
  2⤵
  PID:9292
- C:\Windows\System\HRNSdQB.exe
  C:\Windows\System\HRNSdQB.exe
  2⤵
  PID:10284
- C:\Windows\System\pvJaoba.exe
  C:\Windows\System\pvJaoba.exe
  2⤵
  PID:10340
- C:\Windows\System\eyZjruY.exe
  C:\Windows\System\eyZjruY.exe
  2⤵
  PID:10400
- C:\Windows\System\ZetVphQ.exe
  C:\Windows\System\ZetVphQ.exe
  2⤵
  PID:10504
- C:\Windows\System\IriUedT.exe
  C:\Windows\System\IriUedT.exe
  2⤵
  PID:10564
- C:\Windows\System\ZIzcWxJ.exe
  C:\Windows\System\ZIzcWxJ.exe
  2⤵
  PID:10556
- C:\Windows\System\eAoyGMW.exe
  C:\Windows\System\eAoyGMW.exe
  2⤵
  PID:10700
- C:\Windows\System\qWOoyAm.exe
  C:\Windows\System\qWOoyAm.exe
  2⤵
  PID:10780
- C:\Windows\System\ACnVina.exe
  C:\Windows\System\ACnVina.exe
  2⤵
  PID:10860
- C:\Windows\System\GELCpch.exe
  C:\Windows\System\GELCpch.exe
  2⤵
  PID:10940
- C:\Windows\System\vgtczvf.exe
  C:\Windows\System\vgtczvf.exe
  2⤵
  PID:10984
- C:\Windows\System\KmRycKX.exe
  C:\Windows\System\KmRycKX.exe
  2⤵
  PID:11028
- C:\Windows\System\eVidoWi.exe
  C:\Windows\System\eVidoWi.exe
  2⤵
  PID:11076
- C:\Windows\System\MDxPoUE.exe
  C:\Windows\System\MDxPoUE.exe
  2⤵
  PID:11156
- C:\Windows\System\NbOVpNG.exe
  C:\Windows\System\NbOVpNG.exe
  2⤵
  PID:11236
- C:\Windows\System\unGJoer.exe
  C:\Windows\System\unGJoer.exe
  2⤵
  PID:10348
- C:\Windows\System\naRzVjc.exe
  C:\Windows\System\naRzVjc.exe
  2⤵
  PID:10528
- C:\Windows\System\CwMYZjD.exe
  C:\Windows\System\CwMYZjD.exe
  2⤵
  PID:10628
- C:\Windows\System\zbPRoFn.exe
  C:\Windows\System\zbPRoFn.exe
  2⤵
  PID:10756
- C:\Windows\System\WBYmMGQ.exe
  C:\Windows\System\WBYmMGQ.exe
  2⤵
  PID:10668
- C:\Windows\System\VUxEPXY.exe
  C:\Windows\System\VUxEPXY.exe
  2⤵
  PID:11020
- C:\Windows\System\xVLgelk.exe
  C:\Windows\System\xVLgelk.exe
  2⤵
  PID:10316
- C:\Windows\System\YzbdxOe.exe
  C:\Windows\System\YzbdxOe.exe
  2⤵
  PID:10512
- C:\Windows\System\iWniFmP.exe
  C:\Windows\System\iWniFmP.exe
  2⤵
  PID:10936
- C:\Windows\System\jCTpNUb.exe
  C:\Windows\System\jCTpNUb.exe
  2⤵
  PID:11016
- C:\Windows\System\yyTpVuR.exe
  C:\Windows\System\yyTpVuR.exe
  2⤵
  PID:10728
- C:\Windows\System\ZQBJNAH.exe
  C:\Windows\System\ZQBJNAH.exe
  2⤵
  PID:11280
- C:\Windows\System\mUOhfaA.exe
  C:\Windows\System\mUOhfaA.exe
  2⤵
  PID:11324
- C:\Windows\System\kcAXgKW.exe
  C:\Windows\System\kcAXgKW.exe
  2⤵
  PID:11348
- C:\Windows\System\XXEpDZc.exe
  C:\Windows\System\XXEpDZc.exe
  2⤵
  PID:11376
- C:\Windows\System\zJGKsdx.exe
  C:\Windows\System\zJGKsdx.exe
  2⤵
  PID:11408
- C:\Windows\System\dpGVTcQ.exe
  C:\Windows\System\dpGVTcQ.exe
  2⤵
  PID:11432
- C:\Windows\System\bAlwgzt.exe
  C:\Windows\System\bAlwgzt.exe
  2⤵
  PID:11460
- C:\Windows\System\GrTrteI.exe
  C:\Windows\System\GrTrteI.exe
  2⤵
  PID:11488
- C:\Windows\System\jhOwjoT.exe
  C:\Windows\System\jhOwjoT.exe
  2⤵
  PID:11516
- C:\Windows\System\hLpHyEf.exe
  C:\Windows\System\hLpHyEf.exe
  2⤵
  PID:11544
- C:\Windows\System\wnaSPZB.exe
  C:\Windows\System\wnaSPZB.exe
  2⤵
  PID:11580
- C:\Windows\System\brFHrKU.exe
  C:\Windows\System\brFHrKU.exe
  2⤵
  PID:11620
- C:\Windows\System\PVXvaZN.exe
  C:\Windows\System\PVXvaZN.exe
  2⤵
  PID:11656
- C:\Windows\System\cvjriZY.exe
  C:\Windows\System\cvjriZY.exe
  2⤵
  PID:11672
- C:\Windows\System\PMMkUgR.exe
  C:\Windows\System\PMMkUgR.exe
  2⤵
  PID:11700
- C:\Windows\System\zErYRXc.exe
  C:\Windows\System\zErYRXc.exe
  2⤵
  PID:11728
- C:\Windows\System\FDGLUEb.exe
  C:\Windows\System\FDGLUEb.exe
  2⤵
  PID:11748
- C:\Windows\System\bepAlzA.exe
  C:\Windows\System\bepAlzA.exe
  2⤵
  PID:11768
- C:\Windows\System\qTkwTAZ.exe
  C:\Windows\System\qTkwTAZ.exe
  2⤵
  PID:11796
- C:\Windows\System\mnsolLa.exe
  C:\Windows\System\mnsolLa.exe
  2⤵
  PID:11820
- C:\Windows\System\eNATsns.exe
  C:\Windows\System\eNATsns.exe
  2⤵
  PID:11852
- C:\Windows\System\JKvonGA.exe
  C:\Windows\System\JKvonGA.exe
  2⤵
  PID:11900
- C:\Windows\System\vPCxJpF.exe
  C:\Windows\System\vPCxJpF.exe
  2⤵
  PID:11924
- C:\Windows\System\YPcfpwj.exe
  C:\Windows\System\YPcfpwj.exe
  2⤵
  PID:11948
- C:\Windows\System\GoQijyN.exe
  C:\Windows\System\GoQijyN.exe
  2⤵
  PID:11984
- C:\Windows\System\WEuIcHP.exe
  C:\Windows\System\WEuIcHP.exe
  2⤵
  PID:12008
- C:\Windows\System\nbuWTvv.exe
  C:\Windows\System\nbuWTvv.exe
  2⤵
  PID:12032
- C:\Windows\System\ChWySXy.exe
  C:\Windows\System\ChWySXy.exe
  2⤵
  PID:12056
- C:\Windows\System\ddxnyoj.exe
  C:\Windows\System\ddxnyoj.exe
  2⤵
  PID:12084
- C:\Windows\System\IxCWTJA.exe
  C:\Windows\System\IxCWTJA.exe
  2⤵
  PID:12112
- C:\Windows\System\TeSkxjw.exe
  C:\Windows\System\TeSkxjw.exe
  2⤵
  PID:12144
- C:\Windows\System\vUuEezQ.exe
  C:\Windows\System\vUuEezQ.exe
  2⤵
  PID:12160
- C:\Windows\System\lQKbiOi.exe
  C:\Windows\System\lQKbiOi.exe
  2⤵
  PID:12196
- C:\Windows\System\cjUCbbb.exe
  C:\Windows\System\cjUCbbb.exe
  2⤵
  PID:12244
- C:\Windows\System\ImvTdJK.exe
  C:\Windows\System\ImvTdJK.exe
  2⤵
  PID:12276
- C:\Windows\System\PqwDwox.exe
  C:\Windows\System\PqwDwox.exe
  2⤵
  PID:11260
- C:\Windows\System\CtLKuZp.exe
  C:\Windows\System\CtLKuZp.exe
  2⤵
  PID:11308
- C:\Windows\System\kqxsiDc.exe
  C:\Windows\System\kqxsiDc.exe
  2⤵
  PID:11360
- C:\Windows\System\ZNWUjeu.exe
  C:\Windows\System\ZNWUjeu.exe
  2⤵
  PID:11404
- C:\Windows\System\VbdHElh.exe
  C:\Windows\System\VbdHElh.exe
  2⤵
  PID:11456
- C:\Windows\System\FqozCZc.exe
  C:\Windows\System\FqozCZc.exe
  2⤵
  PID:11588
- C:\Windows\System\kMUzqAP.exe
  C:\Windows\System\kMUzqAP.exe
  2⤵
  PID:11652
- C:\Windows\System\KwkKAog.exe
  C:\Windows\System\KwkKAog.exe
  2⤵
  PID:11684
- C:\Windows\System\JkPDmsU.exe
  C:\Windows\System\JkPDmsU.exe
  2⤵
  PID:11776
- C:\Windows\System\xChjhyd.exe
  C:\Windows\System\xChjhyd.exe
  2⤵
  PID:11844
- C:\Windows\System\HimjTjL.exe
  C:\Windows\System\HimjTjL.exe
  2⤵
  PID:11912
- C:\Windows\System\LkZBpUX.exe
  C:\Windows\System\LkZBpUX.exe
  2⤵
  PID:12076
- C:\Windows\System\mGpTWAM.exe
  C:\Windows\System\mGpTWAM.exe
  2⤵
  PID:12048
- C:\Windows\System\UNHQScm.exe
  C:\Windows\System\UNHQScm.exe
  2⤵
  PID:12172
- C:\Windows\System\XlZVRxh.exe
  C:\Windows\System\XlZVRxh.exe
  2⤵
  PID:12188
- C:\Windows\System\KNvrqkV.exe
  C:\Windows\System\KNvrqkV.exe
  2⤵
  PID:12228
- C:\Windows\System\DfnyknJ.exe
  C:\Windows\System\DfnyknJ.exe
  2⤵
  PID:12260
- C:\Windows\System\EExeCzz.exe
  C:\Windows\System\EExeCzz.exe
  2⤵
  PID:11340
- C:\Windows\System\YCwwbtS.exe
  C:\Windows\System\YCwwbtS.exe
  2⤵
  PID:11692
- C:\Windows\System\aInnKkV.exe
  C:\Windows\System\aInnKkV.exe
  2⤵
  PID:11816
- C:\Windows\System\smOndCr.exe
  C:\Windows\System\smOndCr.exe
  2⤵
  PID:12072
- C:\Windows\System\bOIznLQ.exe
  C:\Windows\System\bOIznLQ.exe
  2⤵
  PID:12128
- C:\Windows\System\gUkXvGR.exe
  C:\Windows\System\gUkXvGR.exe
  2⤵
  PID:12184
- C:\Windows\System\cOYKtTA.exe
  C:\Windows\System\cOYKtTA.exe
  2⤵
  PID:11708
- C:\Windows\System\UNKeDtA.exe
  C:\Windows\System\UNKeDtA.exe
  2⤵
  PID:12292
- C:\Windows\System\khxqrNR.exe
  C:\Windows\System\khxqrNR.exe
  2⤵
  PID:12332
- C:\Windows\System\unfTkXT.exe
  C:\Windows\System\unfTkXT.exe
  2⤵
  PID:12360
- C:\Windows\System\tuFevDm.exe
  C:\Windows\System\tuFevDm.exe
  2⤵
  PID:12376
- C:\Windows\System\jBiCNgV.exe
  C:\Windows\System\jBiCNgV.exe
  2⤵
  PID:12416
- C:\Windows\System\NNuFaSL.exe
  C:\Windows\System\NNuFaSL.exe
  2⤵
  PID:12448
- C:\Windows\System\cvsVguW.exe
  C:\Windows\System\cvsVguW.exe
  2⤵
  PID:12464
- C:\Windows\System\YLetMYc.exe
  C:\Windows\System\YLetMYc.exe
  2⤵
  PID:12496
- C:\Windows\System\ALgnDhi.exe
  C:\Windows\System\ALgnDhi.exe
  2⤵
  PID:12516
- C:\Windows\System\gYrFNAO.exe
  C:\Windows\System\gYrFNAO.exe
  2⤵
  PID:12552
- C:\Windows\System\keFmGmB.exe
  C:\Windows\System\keFmGmB.exe
  2⤵
  PID:12580
- C:\Windows\System\JuOzhZk.exe
  C:\Windows\System\JuOzhZk.exe
  2⤵
  PID:12604
- C:\Windows\System\wRehxLz.exe
  C:\Windows\System\wRehxLz.exe
  2⤵
  PID:12632
- C:\Windows\System\ndCDclV.exe
  C:\Windows\System\ndCDclV.exe
  2⤵
  PID:12660
- C:\Windows\System\VkXpKeU.exe
  C:\Windows\System\VkXpKeU.exe
  2⤵
  PID:12696
- C:\Windows\System\qYwbmtj.exe
  C:\Windows\System\qYwbmtj.exe
  2⤵
  PID:12728
- C:\Windows\System\HKcnLgj.exe
  C:\Windows\System\HKcnLgj.exe
  2⤵
  PID:12752
- C:\Windows\System\DyAeWEZ.exe
  C:\Windows\System\DyAeWEZ.exe
  2⤵
  PID:12788
- C:\Windows\System\pQpSZWI.exe
  C:\Windows\System\pQpSZWI.exe
  2⤵
  PID:12836
- C:\Windows\System\PbEExvp.exe
  C:\Windows\System\PbEExvp.exe
  2⤵
  PID:12856
- C:\Windows\System\rChjXnN.exe
  C:\Windows\System\rChjXnN.exe
  2⤵
  PID:12880
- C:\Windows\System\SOXhQcm.exe
  C:\Windows\System\SOXhQcm.exe
  2⤵
  PID:12900
- C:\Windows\System\AIeyjHI.exe
  C:\Windows\System\AIeyjHI.exe
  2⤵
  PID:12928
- C:\Windows\System\DYInYBk.exe
  C:\Windows\System\DYInYBk.exe
  2⤵
  PID:12956
- C:\Windows\System\TIoibMN.exe
  C:\Windows\System\TIoibMN.exe
  2⤵
  PID:12980
- C:\Windows\System\LLCRXfp.exe
  C:\Windows\System\LLCRXfp.exe
  2⤵
  PID:13044
- C:\Windows\System\bgZYOZL.exe
  C:\Windows\System\bgZYOZL.exe
  2⤵
  PID:13076
- C:\Windows\System\FAgKxSn.exe
  C:\Windows\System\FAgKxSn.exe
  2⤵
  PID:13112
- C:\Windows\System\RqtmBHr.exe
  C:\Windows\System\RqtmBHr.exe
  2⤵
  PID:13128
- C:\Windows\System\ToeDneM.exe
  C:\Windows\System\ToeDneM.exe
  2⤵
  PID:13160
- C:\Windows\System\HIUmeiX.exe
  C:\Windows\System\HIUmeiX.exe
  2⤵
  PID:13188
- C:\Windows\System\VxGyOkB.exe
  C:\Windows\System\VxGyOkB.exe
  2⤵
  PID:13220
- C:\Windows\System\cIcRLuH.exe
  C:\Windows\System\cIcRLuH.exe
  2⤵
  PID:13256
- C:\Windows\System\JHnGpwP.exe
  C:\Windows\System\JHnGpwP.exe
  2⤵
  PID:13272
- C:\Windows\System\pLoVQQy.exe
  C:\Windows\System\pLoVQQy.exe
  2⤵
  PID:10812
- C:\Windows\System\SemslYe.exe
  C:\Windows\System\SemslYe.exe
  2⤵
  PID:12352
- C:\Windows\System\oXJjjlJ.exe
  C:\Windows\System\oXJjjlJ.exe
  2⤵
  PID:12396
- C:\Windows\System\dgeUXHj.exe
  C:\Windows\System\dgeUXHj.exe
  2⤵
  PID:12460
- C:\Windows\System\SKWsRwK.exe
  C:\Windows\System\SKWsRwK.exe
  2⤵
  PID:12548
- C:\Windows\System\ybjlcOE.exe
  C:\Windows\System\ybjlcOE.exe
  2⤵
  PID:12672
- C:\Windows\System\VCNERtt.exe
  C:\Windows\System\VCNERtt.exe
  2⤵
  PID:12744
- C:\Windows\System\FJPhuzy.exe
  C:\Windows\System\FJPhuzy.exe
  2⤵
  PID:12828
- C:\Windows\System\tOLOlxf.exe
  C:\Windows\System\tOLOlxf.exe
  2⤵
  PID:12864
- C:\Windows\System\WKvtcgp.exe
  C:\Windows\System\WKvtcgp.exe
  2⤵
  PID:12976
- C:\Windows\System\CaCZmQX.exe
  C:\Windows\System\CaCZmQX.exe
  2⤵
  PID:13032
- C:\Windows\System\BTFVYci.exe
  C:\Windows\System\BTFVYci.exe
  2⤵
  PID:13104
- C:\Windows\System\mSlmpUc.exe
  C:\Windows\System\mSlmpUc.exe
  2⤵
  PID:13140
- C:\Windows\System\YpvxNAD.exe
  C:\Windows\System\YpvxNAD.exe
  2⤵
  PID:13204
- C:\Windows\System\YBmkByI.exe
  C:\Windows\System\YBmkByI.exe
  2⤵
  PID:13268
- C:\Windows\System\YibAyOw.exe
  C:\Windows\System\YibAyOw.exe
  2⤵
  PID:12568
- C:\Windows\System\uDCZwiq.exe
  C:\Windows\System\uDCZwiq.exe
  2⤵
  PID:12652
- C:\Windows\System\owyIoYO.exe
  C:\Windows\System\owyIoYO.exe
  2⤵
  PID:12740
- C:\Windows\System\aMfAcBz.exe
  C:\Windows\System\aMfAcBz.exe
  2⤵
  PID:12940
- C:\Windows\System\ADxDNcK.exe
  C:\Windows\System\ADxDNcK.exe
  2⤵
  PID:13088
- C:\Windows\System\MffRcdC.exe
  C:\Windows\System\MffRcdC.exe
  2⤵
  PID:13252
- C:\Windows\System\aMaOOTM.exe
  C:\Windows\System\aMaOOTM.exe
  2⤵
  PID:12688
- C:\Windows\System\QhoXbyn.exe
  C:\Windows\System\QhoXbyn.exe
  2⤵
  PID:13016
- C:\Windows\System\TYBEEGC.exe
  C:\Windows\System\TYBEEGC.exe
  2⤵
  PID:12400
- C:\Windows\System\tTpRLzW.exe
  C:\Windows\System\tTpRLzW.exe
  2⤵
  PID:12852
- C:\Windows\System\jINaeVz.exe
  C:\Windows\System\jINaeVz.exe
  2⤵
  PID:13328
- C:\Windows\System\znZycku.exe
  C:\Windows\System\znZycku.exe
  2⤵
  PID:13352
- C:\Windows\System\ByjnxCl.exe
  C:\Windows\System\ByjnxCl.exe
  2⤵
  PID:13388
- C:\Windows\System\SeVhQzR.exe
  C:\Windows\System\SeVhQzR.exe
  2⤵
  PID:13412
- C:\Windows\System\vvYVNVY.exe
  C:\Windows\System\vvYVNVY.exe
  2⤵
  PID:13476
- C:\Windows\System\VzjrDQW.exe
  C:\Windows\System\VzjrDQW.exe
  2⤵
  PID:13496
- C:\Windows\System\kTAHkCf.exe
  C:\Windows\System\kTAHkCf.exe
  2⤵
  PID:13516
- C:\Windows\System\Uibdvoo.exe
  C:\Windows\System\Uibdvoo.exe
  2⤵
  PID:13540
- C:\Windows\System\eXyCgiT.exe
  C:\Windows\System\eXyCgiT.exe
  2⤵
  PID:13560
- C:\Windows\System\YQeIzXn.exe
  C:\Windows\System\YQeIzXn.exe
  2⤵
  PID:13592
- C:\Windows\System\kIykmTk.exe
  C:\Windows\System\kIykmTk.exe
  2⤵
  PID:13632
- C:\Windows\System\SKDRqsv.exe
  C:\Windows\System\SKDRqsv.exe
  2⤵
  PID:13684
- C:\Windows\System\oaUjCgp.exe
  C:\Windows\System\oaUjCgp.exe
  2⤵
  PID:13700
- C:\Windows\System\bUjzCoo.exe
  C:\Windows\System\bUjzCoo.exe
  2⤵
  PID:13716
- C:\Windows\System\WKZEclf.exe
  C:\Windows\System\WKZEclf.exe
  2⤵
  PID:13772
- C:\Windows\System\lNvNADs.exe
  C:\Windows\System\lNvNADs.exe
  2⤵
  PID:13796
- C:\Windows\System\kyWaXHf.exe
  C:\Windows\System\kyWaXHf.exe
  2⤵
  PID:13816
- C:\Windows\System\fmCvGJo.exe
  C:\Windows\System\fmCvGJo.exe
  2⤵
  PID:13848
- C:\Windows\System\cXBUEZV.exe
  C:\Windows\System\cXBUEZV.exe
  2⤵
  PID:13868
- C:\Windows\System\usrsgGV.exe
  C:\Windows\System\usrsgGV.exe
  2⤵
  PID:13888
- C:\Windows\System\sQHwceM.exe
  C:\Windows\System\sQHwceM.exe
  2⤵
  PID:13912
- C:\Windows\System\JKzmaqU.exe
  C:\Windows\System\JKzmaqU.exe
  2⤵
  PID:13948
- C:\Windows\System\CPCtEkx.exe
  C:\Windows\System\CPCtEkx.exe
  2⤵
  PID:13988
- C:\Windows\System\hWmwkbV.exe
  C:\Windows\System\hWmwkbV.exe
  2⤵
  PID:14020
- C:\Windows\System\dAGCXtS.exe
  C:\Windows\System\dAGCXtS.exe
  2⤵
  PID:14040
- C:\Windows\System\TsAHfaR.exe
  C:\Windows\System\TsAHfaR.exe
  2⤵
  PID:14068
- C:\Windows\System\VrcVTgz.exe
  C:\Windows\System\VrcVTgz.exe
  2⤵
  PID:14116
- C:\Windows\System\lJYkzoH.exe
  C:\Windows\System\lJYkzoH.exe
  2⤵
  PID:14132
- C:\Windows\System\VhpCbnz.exe
  C:\Windows\System\VhpCbnz.exe
  2⤵
  PID:14148
- C:\Windows\System\hXzzsVi.exe
  C:\Windows\System\hXzzsVi.exe
  2⤵
  PID:14200
- C:\Windows\System\FZlHBRI.exe
  C:\Windows\System\FZlHBRI.exe
  2⤵
  PID:14228
- C:\Windows\System\GPizCzH.exe
  C:\Windows\System\GPizCzH.exe
  2⤵
  PID:14244
- C:\Windows\System\NSVKWXl.exe
  C:\Windows\System\NSVKWXl.exe
  2⤵
  PID:14284
- C:\Windows\System\CdXVTzp.exe
  C:\Windows\System\CdXVTzp.exe
  2⤵
  PID:14320
- C:\Windows\System\aRPbEiU.exe
  C:\Windows\System\aRPbEiU.exe
  2⤵
  PID:12508
- C:\Windows\System\nAUkaqr.exe
  C:\Windows\System\nAUkaqr.exe
  2⤵
  PID:13324
- C:\Windows\System\Baenrad.exe
  C:\Windows\System\Baenrad.exe
  2⤵
  PID:13408
- C:\Windows\System\spVLsdN.exe
  C:\Windows\System\spVLsdN.exe
  2⤵
  PID:13464
- C:\Windows\System\VlbdTaj.exe
  C:\Windows\System\VlbdTaj.exe
  2⤵
  PID:13548
- C:\Windows\System\IembpTe.exe
  C:\Windows\System\IembpTe.exe
  2⤵
  PID:13588
- C:\Windows\System\YwIrQsC.exe
  C:\Windows\System\YwIrQsC.exe
  2⤵
  PID:13648
- C:\Windows\System\BNmLaBB.exe
  C:\Windows\System\BNmLaBB.exe
  2⤵
  PID:13708
- C:\Windows\System\OWpQHIp.exe
  C:\Windows\System\OWpQHIp.exe
  2⤵
  PID:13780
- C:\Windows\System\YRmrUfV.exe
  C:\Windows\System\YRmrUfV.exe
  2⤵
  PID:13836
- C:\Windows\System\UUpfaBl.exe
  C:\Windows\System\UUpfaBl.exe
  2⤵
  PID:13900
- C:\Windows\System\BpaHbyK.exe
  C:\Windows\System\BpaHbyK.exe
  2⤵
  PID:13980
- C:\Windows\System\FtQlcbK.exe
  C:\Windows\System\FtQlcbK.exe
  2⤵
  PID:14012
- C:\Windows\System\xkdyImO.exe
  C:\Windows\System\xkdyImO.exe
  2⤵
  PID:14092
- C:\Windows\System\ctKtmGR.exe
  C:\Windows\System\ctKtmGR.exe
  2⤵
  PID:14160
- C:\Windows\System\bZhbrxg.exe
  C:\Windows\System\bZhbrxg.exe
  2⤵
  PID:14220
- C:\Windows\System\gBOZbOE.exe
  C:\Windows\System\gBOZbOE.exe
  2⤵
  PID:14280
- C:\Windows\System\BcXpqbY.exe
  C:\Windows\System\BcXpqbY.exe
  2⤵
  PID:4824
- C:\Windows\System\uligAyK.exe
  C:\Windows\System\uligAyK.exe
  2⤵
  PID:13532
- C:\Windows\System\VcTMVwG.exe
  C:\Windows\System\VcTMVwG.exe
  2⤵
  PID:13660
- C:\Windows\System\kPeqBTd.exe
  C:\Windows\System\kPeqBTd.exe
  2⤵
  PID:13764
- C:\Windows\System\XSxSFBK.exe
  C:\Windows\System\XSxSFBK.exe
  2⤵
  PID:13936
- C:\Windows\System\vJfCANN.exe
  C:\Windows\System\vJfCANN.exe
  2⤵
  PID:14056
- C:\Windows\System\OxDndtB.exe
  C:\Windows\System\OxDndtB.exe
  2⤵
  PID:14332
- C:\Windows\System\Xrlxxkw.exe
  C:\Windows\System\Xrlxxkw.exe
  2⤵
  PID:13628
- C:\Windows\System\yMeCxYf.exe
  C:\Windows\System\yMeCxYf.exe
  2⤵
  PID:14268
- C:\Windows\System\WHhWUUl.exe
  C:\Windows\System\WHhWUUl.exe
  2⤵
  PID:14004
- C:\Windows\System\QNVvLJK.exe
  C:\Windows\System\QNVvLJK.exe
  2⤵
  PID:14340
- C:\Windows\System\vEuDJOd.exe
  C:\Windows\System\vEuDJOd.exe
  2⤵
  PID:14360
- C:\Windows\System\DhiRvtf.exe
  C:\Windows\System\DhiRvtf.exe
  2⤵
  PID:14396
- C:\Windows\System\meFLTGC.exe
  C:\Windows\System\meFLTGC.exe
  2⤵
  PID:14420
- C:\Windows\System\CQiNhvg.exe
  C:\Windows\System\CQiNhvg.exe
  2⤵
  PID:14452
- C:\Windows\System\JQxPowA.exe
  C:\Windows\System\JQxPowA.exe
  2⤵
  PID:14480
- C:\Windows\System\dckgYmU.exe
  C:\Windows\System\dckgYmU.exe
  2⤵
  PID:14496
- C:\Windows\System\ulFZsUm.exe
  C:\Windows\System\ulFZsUm.exe
  2⤵
  PID:14536
- C:\Windows\System\ozYLULQ.exe
  C:\Windows\System\ozYLULQ.exe
  2⤵
  PID:14552
- C:\Windows\System\FkgZSEc.exe
  C:\Windows\System\FkgZSEc.exe
  2⤵
  PID:14580
- C:\Windows\System\xexXioy.exe
  C:\Windows\System\xexXioy.exe
  2⤵
  PID:14624
- C:\Windows\System\oOSIlcp.exe
  C:\Windows\System\oOSIlcp.exe
  2⤵
  PID:14648
- C:\Windows\System\xyvODPB.exe
  C:\Windows\System\xyvODPB.exe
  2⤵
  PID:14676
- C:\Windows\System\YhlJnDX.exe
  C:\Windows\System\YhlJnDX.exe
  2⤵
  PID:14704
- C:\Windows\System\ABbajUg.exe
  C:\Windows\System\ABbajUg.exe
  2⤵
  PID:14732
- C:\Windows\System\jhYeTly.exe
  C:\Windows\System\jhYeTly.exe
  2⤵
  PID:14760
- C:\Windows\System\XbZtWSA.exe
  C:\Windows\System\XbZtWSA.exe
  2⤵
  PID:14788
- C:\Windows\System\nnxEFQX.exe
  C:\Windows\System\nnxEFQX.exe
  2⤵
  PID:14816
- C:\Windows\System\gipqDwA.exe
  C:\Windows\System\gipqDwA.exe
  2⤵
  PID:14844
- C:\Windows\System\uYdzhwz.exe
  C:\Windows\System\uYdzhwz.exe
  2⤵
  PID:14872
- C:\Windows\System\WfnxtwB.exe
  C:\Windows\System\WfnxtwB.exe
  2⤵
  PID:14904
- C:\Windows\System\saLspNG.exe
  C:\Windows\System\saLspNG.exe
  2⤵
  PID:14928
- C:\Windows\System\THHIcXh.exe
  C:\Windows\System\THHIcXh.exe
  2⤵
  PID:14948
- C:\Windows\System\GcERARg.exe
  C:\Windows\System\GcERARg.exe
  2⤵
  PID:14988
- C:\Windows\System\YIEnqsi.exe
  C:\Windows\System\YIEnqsi.exe
  2⤵
  PID:15028
- C:\Windows\System\JfalAuA.exe
  C:\Windows\System\JfalAuA.exe
  2⤵
  PID:15056
- C:\Windows\System\zmfMnvQ.exe
  C:\Windows\System\zmfMnvQ.exe
  2⤵
  PID:15080
- C:\Windows\System\FukzkHA.exe
  C:\Windows\System\FukzkHA.exe
  2⤵
  PID:15100
- C:\Windows\System\TtkPwyZ.exe
  C:\Windows\System\TtkPwyZ.exe
  2⤵
  PID:15116
- C:\Windows\System\uOAgrDN.exe
  C:\Windows\System\uOAgrDN.exe
  2⤵
  PID:15156
- C:\Windows\System\vXwjBfK.exe
  C:\Windows\System\vXwjBfK.exe
  2⤵
  PID:15196
- C:\Windows\System\bqfCQLQ.exe
  C:\Windows\System\bqfCQLQ.exe
  2⤵
  PID:15224
- C:\Windows\System\tzxuCyc.exe
  C:\Windows\System\tzxuCyc.exe
  2⤵
  PID:15252
- C:\Windows\System\WbNOJdP.exe
  C:\Windows\System\WbNOJdP.exe
  2⤵
  PID:15268
- C:\Windows\System\XcCYSBw.exe
  C:\Windows\System\XcCYSBw.exe
  2⤵
  PID:15296
- C:\Windows\System\zyNlOPd.exe
  C:\Windows\System\zyNlOPd.exe
  2⤵
  PID:15324
- C:\Windows\System\rgWxfBL.exe
  C:\Windows\System\rgWxfBL.exe
  2⤵
  PID:15352
- C:\Windows\System\ngnaFqJ.exe
  C:\Windows\System\ngnaFqJ.exe
  2⤵
  PID:14356
- C:\Windows\System\sUFDBLe.exe
  C:\Windows\System\sUFDBLe.exe
  2⤵
  PID:14384
- C:\Windows\System\EbkRDap.exe
  C:\Windows\System\EbkRDap.exe
  2⤵
  PID:14464
- C:\Windows\System\qIVEJEM.exe
  C:\Windows\System\qIVEJEM.exe
  2⤵
  PID:14524
- C:\Windows\System\WSvOyBJ.exe
  C:\Windows\System\WSvOyBJ.exe
  2⤵
  PID:14608
- C:\Windows\System\GQqwChP.exe
  C:\Windows\System\GQqwChP.exe
  2⤵
  PID:14568
- C:\Windows\System\UgiRcwa.exe
  C:\Windows\System\UgiRcwa.exe
  2⤵
  PID:14668
- C:\Windows\System\ybDEbeQ.exe
  C:\Windows\System\ybDEbeQ.exe
  2⤵
  PID:14720
- C:\Windows\System\aVgzMZM.exe
  C:\Windows\System\aVgzMZM.exe
  2⤵
  PID:14780
- C:\Windows\System\fPjaqLP.exe
  C:\Windows\System\fPjaqLP.exe
  2⤵
  PID:4956
- C:\Windows\System\iBTGVVx.exe
  C:\Windows\System\iBTGVVx.exe
  2⤵
  PID:14884
- C:\Windows\System\LAWZIWY.exe
  C:\Windows\System\LAWZIWY.exe
  2⤵
  PID:15016
- C:\Windows\System\lNqJoNZ.exe
  C:\Windows\System\lNqJoNZ.exe
  2⤵
  PID:15088
- C:\Windows\System\vfuBTvX.exe
  C:\Windows\System\vfuBTvX.exe
  2⤵
  PID:15188
- C:\Windows\System\padzwja.exe
  C:\Windows\System\padzwja.exe
  2⤵
  PID:15212
- C:\Windows\System\gYgGJvk.exe
  C:\Windows\System\gYgGJvk.exe
  2⤵
  PID:15284
- C:\Windows\System\hBGIeLg.exe
  C:\Windows\System\hBGIeLg.exe
  2⤵
  PID:14180
- C:\Windows\System\HyKltDA.exe
  C:\Windows\System\HyKltDA.exe
  2⤵
  PID:14520
- C:\Windows\System\MljQlKL.exe
  C:\Windows\System\MljQlKL.exe
  2⤵
  PID:14572
- C:\Windows\System\oRMGpaY.exe
  C:\Windows\System\oRMGpaY.exe
  2⤵
  PID:4844
- C:\Windows\System\TbywyNB.exe
  C:\Windows\System\TbywyNB.exe
  2⤵
  PID:15040
- C:\Windows\System\aOfqafH.exe
  C:\Windows\System\aOfqafH.exe
  2⤵
  PID:15128
- C:\Windows\System\AYOCftW.exe
  C:\Windows\System\AYOCftW.exe
  2⤵
  PID:15336
- C:\Windows\System\CCAxEVC.exe
  C:\Windows\System\CCAxEVC.exe
  2⤵
  PID:14544
- C:\Windows\System\TRsphXO.exe
  C:\Windows\System\TRsphXO.exe
  2⤵
  PID:14968
- C:\Windows\System\TBWEAIP.exe
  C:\Windows\System\TBWEAIP.exe
  2⤵
  PID:14432
- C:\Windows\System\euSuQzy.exe
  C:\Windows\System\euSuQzy.exe
  2⤵
  PID:15376
- C:\Windows\System\hyoKOrr.exe
  C:\Windows\System\hyoKOrr.exe
  2⤵
  PID:15392
- C:\Windows\System\TzZWAEX.exe
  C:\Windows\System\TzZWAEX.exe
  2⤵
  PID:15432
- C:\Windows\System\zByAzTh.exe
  C:\Windows\System\zByAzTh.exe
  2⤵
  PID:15448
- C:\Windows\System\HAdXQKW.exe
  C:\Windows\System\HAdXQKW.exe
  2⤵
  PID:15476
- C:\Windows\System\FNEVIwt.exe
  C:\Windows\System\FNEVIwt.exe
  2⤵
  PID:15492
- C:\Windows\System\LIjAfVo.exe
  C:\Windows\System\LIjAfVo.exe
  2⤵
  PID:15516
- C:\Windows\System\ctDLuev.exe
  C:\Windows\System\ctDLuev.exe
  2⤵
  PID:15540
- C:\Windows\System\llHVwhj.exe
  C:\Windows\System\llHVwhj.exe
  2⤵
  PID:15600
- C:\Windows\System\WYUpZBQ.exe
  C:\Windows\System\WYUpZBQ.exe
  2⤵
  PID:15616
- C:\Windows\System\VldoPtc.exe
  C:\Windows\System\VldoPtc.exe
  2⤵
  PID:15644
- C:\Windows\System\HEnHZgO.exe
  C:\Windows\System\HEnHZgO.exe
  2⤵
  PID:15668
- C:\Windows\System\VylpbCE.exe
  C:\Windows\System\VylpbCE.exe
  2⤵
  PID:15720
- C:\Windows\System\roFdexS.exe
  C:\Windows\System\roFdexS.exe
  2⤵
  PID:15740
- C:\Windows\System\fXLlrwL.exe
  C:\Windows\System\fXLlrwL.exe
  2⤵
  PID:15764
- C:\Windows\System\frkwRRj.exe
  C:\Windows\System\frkwRRj.exe
  2⤵
  PID:15780
- C:\Windows\System\bAVhtkF.exe
  C:\Windows\System\bAVhtkF.exe
  2⤵
  PID:15820
- C:\Windows\System\mgbjOBQ.exe
  C:\Windows\System\mgbjOBQ.exe
  2⤵
  PID:15844
- C:\Windows\System\xxmQwRm.exe
  C:\Windows\System\xxmQwRm.exe
  2⤵
  PID:15884
- C:\Windows\System\dIROChW.exe
  C:\Windows\System\dIROChW.exe
  2⤵
  PID:15904
- C:\Windows\System\xrXGPpp.exe
  C:\Windows\System\xrXGPpp.exe
  2⤵
  PID:15944
- C:\Windows\System\RUdheJJ.exe
  C:\Windows\System\RUdheJJ.exe
  2⤵
  PID:15972
- C:\Windows\System\ePBKyNw.exe
  C:\Windows\System\ePBKyNw.exe
  2⤵
  PID:15988
- C:\Windows\System\nDBRrKc.exe
  C:\Windows\System\nDBRrKc.exe
  2⤵
  PID:16012
- C:\Windows\System\oERPShv.exe
  C:\Windows\System\oERPShv.exe
  2⤵
  PID:16044
- C:\Windows\System\CUBnKix.exe
  C:\Windows\System\CUBnKix.exe
  2⤵
  PID:16064
- C:\Windows\System\RDWaSlm.exe
  C:\Windows\System\RDWaSlm.exe
  2⤵
  PID:16092
- C:\Windows\System\fPOzerX.exe
  C:\Windows\System\fPOzerX.exe
  2⤵
  PID:16140
- C:\Windows\System\jSRHuVY.exe
  C:\Windows\System\jSRHuVY.exe
  2⤵
  PID:16156
- C:\Windows\System\zNSJEUj.exe
  C:\Windows\System\zNSJEUj.exe
  2⤵
  PID:16184
- C:\Windows\System\dvHdfrg.exe
  C:\Windows\System\dvHdfrg.exe
  2⤵
  PID:16212
- C:\Windows\System\sMkvdsP.exe
  C:\Windows\System\sMkvdsP.exe
  2⤵
  PID:16240
- C:\Windows\System\ReeezUk.exe
  C:\Windows\System\ReeezUk.exe
  2⤵
  PID:16256
- C:\Windows\System\MRKgMmT.exe
  C:\Windows\System\MRKgMmT.exe
  2⤵
  PID:16300
- C:\Windows\System\UseqGGA.exe
  C:\Windows\System\UseqGGA.exe
  2⤵
  PID:16324
- C:\Windows\System\fnpganH.exe
  C:\Windows\System\fnpganH.exe
  2⤵
  PID:16352
- C:\Windows\System\DcUarXm.exe
  C:\Windows\System\DcUarXm.exe
  2⤵
  PID:16368
- C:\Windows\System\MefOVYT.exe
  C:\Windows\System\MefOVYT.exe
  2⤵
  PID:15384
- C:\Windows\System\aYSzGFk.exe
  C:\Windows\System\aYSzGFk.exe
  2⤵
  PID:15440
- C:\Windows\System\ZLTfSKX.exe
  C:\Windows\System\ZLTfSKX.exe
  2⤵
  PID:15528
- C:\Windows\System\vAfzIkk.exe
  C:\Windows\System\vAfzIkk.exe
  2⤵
  PID:15580
- C:\Windows\System\HcUoSvM.exe
  C:\Windows\System\HcUoSvM.exe
  2⤵
  PID:15608
- C:\Windows\System\ezFTcGr.exe
  C:\Windows\System\ezFTcGr.exe
  2⤵
  PID:15680
- C:\Windows\System\huFwXro.exe
  C:\Windows\System\huFwXro.exe
  2⤵
  PID:15748
- C:\Windows\System\ZlmJzUY.exe
  C:\Windows\System\ZlmJzUY.exe
  2⤵
  PID:15792
- C:\Windows\System\bBChXha.exe
  C:\Windows\System\bBChXha.exe
  2⤵
  PID:15856
- C:\Windows\System\AmeoRtA.exe
  C:\Windows\System\AmeoRtA.exe
  2⤵
  PID:4716
- C:\Windows\System\hhECihY.exe
  C:\Windows\System\hhECihY.exe
  2⤵
  PID:16028
- C:\Windows\System\AJDmbXE.exe
  C:\Windows\System\AJDmbXE.exe
  2⤵
  PID:16076
- C:\Windows\System\XmlumGP.exe
  C:\Windows\System\XmlumGP.exe
  2⤵
  PID:16148
- C:\Windows\System\lkZtqUA.exe
  C:\Windows\System\lkZtqUA.exe
  2⤵
  PID:16204
- C:\Windows\System\boaKuvh.exe
  C:\Windows\System\boaKuvh.exe
  2⤵
  PID:16252
- C:\Windows\System\joXsekA.exe
  C:\Windows\System\joXsekA.exe
  2⤵
  PID:16312
- C:\Windows\System\lylmCXM.exe
  C:\Windows\System\lylmCXM.exe
  2⤵
  PID:15428
- C:\Windows\System\jTNmJdc.exe
  C:\Windows\System\jTNmJdc.exe
  2⤵
  PID:15488
- C:\Windows\System\qDbSSMr.exe
  C:\Windows\System\qDbSSMr.exe
  2⤵
  PID:15632
- C:\Windows\System\bopIsLU.exe
  C:\Windows\System\bopIsLU.exe
  2⤵
  PID:15752
- C:\Windows\System\hMwEFLc.exe
  C:\Windows\System\hMwEFLc.exe
  2⤵
  PID:15880
- C:\Windows\System\XTLrViF.exe
  C:\Windows\System\XTLrViF.exe
  2⤵
  PID:16036
- C:\Windows\System\TEccblh.exe
  C:\Windows\System\TEccblh.exe
  2⤵
  PID:16196
- C:\Windows\System\nNRdnEU.exe
  C:\Windows\System\nNRdnEU.exe
  2⤵
  PID:16316
- C:\Windows\System\KjqBBcu.exe
  C:\Windows\System\KjqBBcu.exe
  2⤵
  PID:15408
- C:\Windows\System\hojcFKm.exe
  C:\Windows\System\hojcFKm.exe
  2⤵
  PID:15736
- C:\Windows\System\pKjOxtG.exe
  C:\Windows\System\pKjOxtG.exe
  2⤵
  PID:15760
- C:\Windows\System\iwgDmvS.exe
  C:\Windows\System\iwgDmvS.exe
  2⤵
  PID:15960
- C:\Windows\System\BBrLSBk.exe
  C:\Windows\System\BBrLSBk.exe
  2⤵
  PID:1932
- C:\Windows\System\TisGRMx.exe
  C:\Windows\System\TisGRMx.exe
  2⤵
  PID:15776
- C:\Windows\System\mzMpPxs.exe
  C:\Windows\System\mzMpPxs.exe
  2⤵
  PID:16408
- C:\Windows\System\yNbBhyj.exe
  C:\Windows\System\yNbBhyj.exe
  2⤵
  PID:16424
- C:\Windows\System\oxLSBit.exe
  C:\Windows\System\oxLSBit.exe
  2⤵
  PID:16480
- C:\Windows\System\UFwJyql.exe
  C:\Windows\System\UFwJyql.exe
  2⤵
  PID:16504
- C:\Windows\System\HicfSMU.exe
  C:\Windows\System\HicfSMU.exe
  2⤵
  PID:16520
- C:\Windows\System\duihjIQ.exe
  C:\Windows\System\duihjIQ.exe
  2⤵
  PID:16560
- C:\Windows\System\FPfKish.exe
  C:\Windows\System\FPfKish.exe
  2⤵
  PID:16576
- C:\Windows\System\WuEjKeP.exe
  C:\Windows\System\WuEjKeP.exe
  2⤵
  PID:16616
- C:\Windows\System\UHYyxwK.exe
  C:\Windows\System\UHYyxwK.exe
  2⤵
  PID:16632
- C:\Windows\System\wgThFTd.exe
  C:\Windows\System\wgThFTd.exe
  2⤵
  PID:16672
- C:\Windows\System\chohqNC.exe
  C:\Windows\System\chohqNC.exe
  2⤵
  PID:16692
- C:\Windows\System\YGgfosk.exe
  C:\Windows\System\YGgfosk.exe
  2⤵
  PID:16736
- C:\Windows\System\mojSCcm.exe
  C:\Windows\System\mojSCcm.exe
  2⤵
  PID:16756
- C:\Windows\System\kiANiZo.exe
  C:\Windows\System\kiANiZo.exe
  2⤵
  PID:16772
- C:\Windows\System\rqHbqja.exe
  C:\Windows\System\rqHbqja.exe
  2⤵
  PID:16796
- C:\Windows\System\bBLZOjM.exe
  C:\Windows\System\bBLZOjM.exe
  2⤵
  PID:16836
- C:\Windows\System\YYlRldw.exe
  C:\Windows\System\YYlRldw.exe
  2⤵
  PID:16860
- C:\Windows\System\PYNghCz.exe
  C:\Windows\System\PYNghCz.exe
  2⤵
  PID:16880
- C:\Windows\System\YMYdWIc.exe
  C:\Windows\System\YMYdWIc.exe
  2⤵
  PID:16904
- C:\Windows\System\KqVAnUP.exe
  C:\Windows\System\KqVAnUP.exe
  2⤵
  PID:16932
- C:\Windows\System\seQCjaD.exe
  C:\Windows\System\seQCjaD.exe
  2⤵
  PID:16980
- C:\Windows\System\jrIyiLq.exe
  C:\Windows\System\jrIyiLq.exe
  2⤵
  PID:16996
- C:\Windows\System\WFIBOnF.exe
  C:\Windows\System\WFIBOnF.exe
  2⤵
  PID:17028
- C:\Windows\System\MTYYbSD.exe
  C:\Windows\System\MTYYbSD.exe
  2⤵
  PID:17044
- C:\Windows\System\BypslXc.exe
  C:\Windows\System\BypslXc.exe
  2⤵
  PID:17076
- C:\Windows\System\UXxtXyA.exe
  C:\Windows\System\UXxtXyA.exe
  2⤵
  PID:17100
- C:\Windows\System\kKUiubZ.exe
  C:\Windows\System\kKUiubZ.exe
  2⤵
  PID:17128
- C:\Windows\System\vtVyfNo.exe
  C:\Windows\System\vtVyfNo.exe
  2⤵
  PID:17148
- C:\Windows\System\msujEnX.exe
  C:\Windows\System\msujEnX.exe
  2⤵
  PID:17172
- C:\Windows\System\XOnggzo.exe
  C:\Windows\System\XOnggzo.exe
  2⤵
  PID:17204
- C:\Windows\System\ABTpOuz.exe
  C:\Windows\System\ABTpOuz.exe
  2⤵
  PID:17252
- C:\Windows\System\CVgqCkR.exe
  C:\Windows\System\CVgqCkR.exe
  2⤵
  PID:17276
- C:\Windows\System\hEQGmUb.exe
  C:\Windows\System\hEQGmUb.exe
  2⤵
  PID:17308
- C:\Windows\System\lkyuEiT.exe
  C:\Windows\System\lkyuEiT.exe
  2⤵
  PID:17332
- C:\Windows\System\JYEXFyf.exe
  C:\Windows\System\JYEXFyf.exe
  2⤵
  PID:17364
- C:\Windows\System\AqMDPYD.exe
  C:\Windows\System\AqMDPYD.exe
  2⤵
  PID:17404
- C:\Windows\System\GOKXpTx.exe
  C:\Windows\System\GOKXpTx.exe
  2⤵
  PID:16268
- C:\Windows\System\qoeiEMX.exe
  C:\Windows\System\qoeiEMX.exe
  2⤵
  PID:15868
- C:\Windows\System\hBXizFu.exe
  C:\Windows\System\hBXizFu.exe
  2⤵
  PID:15708
- C:\Windows\System\fnggExs.exe
  C:\Windows\System\fnggExs.exe
  2⤵
  PID:16572
- C:\Windows\System\LHISJEf.exe
  C:\Windows\System\LHISJEf.exe
  2⤵
  PID:16656
- C:\Windows\System\xoCEvrL.exe
  C:\Windows\System\xoCEvrL.exe
  2⤵
  PID:16700
- C:\Windows\System\tuunkqg.exe
  C:\Windows\System\tuunkqg.exe
  2⤵
  PID:16820
- C:\Windows\System\MsPImMZ.exe
  C:\Windows\System\MsPImMZ.exe
  2⤵
  PID:744
- C:\Windows\System\gWHHotU.exe
  C:\Windows\System\gWHHotU.exe
  2⤵
  PID:440
- C:\Windows\System\eNwSmim.exe
  C:\Windows\System\eNwSmim.exe
  2⤵
  PID:16916
- C:\Windows\System\RVHREao.exe
  C:\Windows\System\RVHREao.exe
  2⤵
  PID:16968
- C:\Windows\System\EydTXtd.exe
  C:\Windows\System\EydTXtd.exe
  2⤵
  PID:17012
- C:\Windows\System\OPNzJoY.exe
  C:\Windows\System\OPNzJoY.exe
  2⤵
  PID:17160
- C:\Windows\System\oYcDsof.exe
  C:\Windows\System\oYcDsof.exe
  2⤵
  PID:17136
- C:\Windows\System\OYXGgpO.exe
  C:\Windows\System\OYXGgpO.exe
  2⤵
  PID:17288

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4260 -i 4260 -h 520 -j 524 -s 532 -d 0
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:16792

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AKkfwSY.exe

Filesize
1.6MB

MD5
e4cb94cc68718633bf74895edaa65911

SHA1
69d207cb7e53090cf35ceb8e2e90b19b9f2f157d

SHA256
4d9f1b1889cb8777a0984652155f018a44127fa33b24ccb3bfbf6dc3d6182721

SHA512
b3ffbb681d53a9f28d967eb5719b2324f3889419647da1c1511f5692bfb258a4d106dd42faf97d70407de7d58e1ea34cd9424b19720e6b0c6259c37d8d7f8665

Download Submit
C:\Windows\System\FRMFyyt.exe

Filesize
1.6MB

MD5
9ff64905b23d87838085e3287c8b1671

SHA1
91904a024bfe1de45b256056fd8aed09acd143ad

SHA256
335e25fae74ee6c5a6f4642d7954a6fe7f1b743e503f886cba4ae9fdaf5b5500

SHA512
a1f0454048239afe7313c564409581bb3c4a4796790e820606e377f9fedca3a2264394c7df3ec906071e33d9b6dcbc17af78f593f04d45fced2d56a7c5ece48c

Download Submit
C:\Windows\System\FqMuFsm.exe

Filesize
1.6MB

MD5
7a15683d37559c3e739883e6bd7daa65

SHA1
af50e617964fdf8939624ab43e3e2fa7327df93f

SHA256
da0c87bb64ff4244586de1d38f3d5f58b11e1e1e0617b2570cfed6579c2cf3da

SHA512
fc2dd0523a563ea9b996787f23bcf88c5e34121e086df0208e0d57312e488ec9552f593eb1b36f618a833f416cd7c5994f95240b6e0a78176b82e7ddd8099528

Download Submit
C:\Windows\System\GIUqmGe.exe

Filesize
1.6MB

MD5
17f8aae1f7ba39db5176a6ddecacb417

SHA1
cc45e3931291ee5c748bc954a6f7e0c9ed6eeddd

SHA256
736d0af74dc79f20a9185215397911c630c2f62c446cab431a0fd23471c9c4b7

SHA512
882b5ecf13d638f9c1fc0fe3ff216b11c825b9bc65f83faec56f8f2181d8f6283153a532b43b5953a8f30e9c327843e8026bfc9ea910746b8cff3989847a674c

Download Submit
C:\Windows\System\IJXoNNp.exe

Filesize
1.6MB

MD5
6601f1c512dca9eeb715068638ecea7a

SHA1
63f5597ea5b50300e7142eca9fd74291199547f9

SHA256
92b9dc2d202d5da8419677a3993a2e037b85cefbe2ff07a31dc48df186b976f2

SHA512
f86e778b351fc881bd6287c00c2fca237bed5ac5ad5275760fd208a63c83771c4197de44089e0acf946e38120715643d963e3e3820a42b63479dbab5ee2a4234

Download Submit
C:\Windows\System\JUNXLsf.exe

Filesize
1.6MB

MD5
f61e0573a73c74a32ebda73bd36ceec5

SHA1
52551b0ccbaa72ef4587fd267f53e30b6010a366

SHA256
6ac0f7ab830fc051fdea3346b661c19e1aa175b94a8a85cabf6e0b660cb662e9

SHA512
40e91622403d7f1f6fcdb3cf3dae6d8b75c7428e2928d8344109cf03240cee702b3a11fddac3a798b60d5e95c9c790e22462d68367256cbfc00e46fe59e8eefb

Download Submit
C:\Windows\System\KulEkrV.exe

Filesize
1.6MB

MD5
eac9678f0d934bd7f389881554052286

SHA1
73950640e9a9af98338d94bfe7cc433f3200c2e1

SHA256
4aee3afcbcc078a7057f707a986c6efb7f4fbd129cd9520e13cba4ba27617abe

SHA512
6bc74a74fa5f3a5678ce2468dd49893ce8846e29a40fb936ebc7cd6534a3935d8b5b7be3db1ee74ef81f03418a9f678c4f57c853f129d9933c7df84d03fba9aa

Download Submit
C:\Windows\System\LpCBJvU.exe

Filesize
1.6MB

MD5
567b2f10881c861f4455643280b8f2ab

SHA1
baab97d652020009ac8b4fab95f2cf0e941923f7

SHA256
5bfaef4423ab2997a8c8b020fb416edfff446a31fd5bedaf05cd746816095a69

SHA512
241a96641cbf05413e7ae9a13e8c95d399bc16a16074790478fa5b85d6126845605b5d2d5d4dd9348697e0a769f1695dfd099f4fef64acc3fb40c6aa1f948a8d

Download Submit
C:\Windows\System\MIVnjZf.exe

Filesize
1.6MB

MD5
47240baf0f962420dc6ac9ff491301d7

SHA1
ee8fd1050425fa8e7e52d30347c8a75a7aacfc39

SHA256
a0490c7df60a010d3e357de631f2a57ab67cbfe2b5705fc5d1442942aec9d87f

SHA512
826923eb3da04af88597db207e0742c3d36f6fc4f333f99782b841b67c1101f4e874553f419429da5e7c8c49767ef8dc24b70c6e5a336cd732262fe1af2defa3

Download Submit
C:\Windows\System\NNdLpDj.exe

Filesize
1.6MB

MD5
fba7c02f963a539937482535ece2e342

SHA1
70b04309a1c25b98bbbfee482c5f8383fdf03f8e

SHA256
40b4fdd33b7cabf0d96076ed757b2b097bf26c31a14019515e3b48bbadf40995

SHA512
a680fc3ce43887851c8063d579aadb5c8cd0018de32c2560f576cf3d101f53204ae2269f1b5a725d60dff30fcc9f8848cde30b25e4aff88fb26a3696dc60969e

Download Submit
C:\Windows\System\RhKzHYt.exe

Filesize
1.6MB

MD5
dca0df9c343537099399c8f862e730e9

SHA1
e5b20783b17d2d7fe5482cdd9e54d6e0b7dfa645

SHA256
626f70851ba99d274ea1c0c04c87f9d199751a1e27150a7d0760547764555438

SHA512
b4b6de4ec8f8bdfb3eea3a6c868aaef0d07760a2b395c45ff4cecb13a4c7961a4558db1ff5b9da0decf3606cb5f0ef5280a9a0723a6ac3e93570a7cac4f67a3c

Download Submit
C:\Windows\System\TaLNnrr.exe

Filesize
1.6MB

MD5
4ed543524cd9bd194d7423749e6b6d5b

SHA1
35bb56bcf7a904acc8a4966c0dd7218181d1580f

SHA256
86a54c4a4a814ea3098f7a841d7ce28632895410306249ac2cea1d51689dfd30

SHA512
efc01f3ad74320470f508d11ff9b1e0d799964132a50034626e1e5159e0955cc9f231dcf359042a9860cf17a6973272af1b1cc59f38e3b13b2b4301ea3678509

Download Submit
C:\Windows\System\VdXXhgJ.exe

Filesize
1.6MB

MD5
409f1dce875f5fe2ad3dffb007880d30

SHA1
fa286dd87c62261a261413af39445dff95e3636f

SHA256
f5f7a8b4d29d52d4ca50e363ee6416a0aeb7354415e95248c6b4a07dbbc6cb60

SHA512
55cde4f67179a437b7454c964f8dee4e379295a5814b3bc3f076f84b9f6869ed5b6f6e1ec7bcf2e2f7f204845ec77aa22d308824044cb8fa78166c2d0eb6c642

Download Submit
C:\Windows\System\WoUTSJZ.exe

Filesize
1.6MB

MD5
a1d54bd16bb996561b08e50ffd42825e

SHA1
76a9a68581218bee63811856a698ba2d547ee957

SHA256
2a9f3f0b7d6a3d40b8a872a8ba0d90eb04b186f8a5d984e6a6ff75e9cc226de6

SHA512
e459bbdd647099a93e1b52628c67e7f36c54df183e4e387cbe58401acb8b9ea76af05d0b1a850037df8959dc59367dc2c2d7d591072a98b41782c80bfeba8b2b

Download Submit
C:\Windows\System\YwHyEOZ.exe

Filesize
1.6MB

MD5
deb80171cd09c47303eaac1dc9431a4e

SHA1
63533455eb4c1997a57215d107e6c3d1afb4d250

SHA256
e942637134fead45d2c595f1fb766bf4577add24c00d558de4f62f71e3bb975b

SHA512
45d617d0ab14acff4a3177bd57c90e58c2221a9bfdc1b6d37aa312a5fd382125250c753024ed479902108f1a7dedb81946aa86e647640c440e002a3e036fc367

Download Submit
C:\Windows\System\bWvUTvY.exe

Filesize
1.6MB

MD5
b160cdff318b98353032b5cdb8d25790

SHA1
08d8174001d80dad3c3850d8667e1ca2e8dd028e

SHA256
9e7aef661941cca137faab35f0911cd584ae11a72f6e3e1f725fd0dc6fb6749d

SHA512
231f94882ac28473f82f4e8010cc271d02e8b08f7a5a72d5d7cf43fae068c40c9788db0881a94efac307fcb893535de3ee10a27aee771e4c17453b4237ac652c

Download Submit
C:\Windows\System\bdrXzRR.exe

Filesize
1.6MB

MD5
7fa372662a1d6795fe430e8ffad10d99

SHA1
3605704fd20f273571fff58a3dccf9e91116446d

SHA256
73fa48d985162cab76a25d6d9c578e6724c9f3bad0ae517bf071ce8336426506

SHA512
f0f81f32ae9d69f94ea04759196b293b7730ae8921d03a599bba05962dde452452b62326f12e5cd2ad11bdd08811a55fefeef5586bccc85be8cab1be25da19dc

Download Submit
C:\Windows\System\cIDaiLD.exe

Filesize
1.6MB

MD5
9a182143714d8a84b364e394c2923dfb

SHA1
6733781e7d2b713279debdfca7cbd2e5c1b3f154

SHA256
d318d2105165aea28a206d3a2e4e4b636b95cadd99edf389e27067576298ff3a

SHA512
f10ce4048725ac3be377ab28a40c441ae5330caa615685fbd984710c6d4d5856215845387edd969a3c768cc94204f0e6c90fd8d7faa378c705267f1f31631ec1

Download Submit
C:\Windows\System\dcbHjat.exe

Filesize
1.6MB

MD5
6c015baff750cf2df639aa6e7898d51c

SHA1
314119db6b7571c9e062cb20c0f870a9526fe817

SHA256
71ff565f577710664f0ea43874c492b5a9a3afbd9b6df249e9f7bdd8baf03b69

SHA512
280bc0a3ebcca1497a1f78c582658aa6a0a2fd90c8058a728a38f76f964f6d2f4cbec2ded32cb720f2fd6c571a3e5a2ed38e7286366c26dd2386f6bb7b304317

Download Submit
C:\Windows\System\dgsWhYX.exe

Filesize
1.6MB

MD5
1d20f8671f294ad0a71ebfc29065ae54

SHA1
71595a0c88ae759dcfce20184dc5be7776cd00f7

SHA256
bd637f641c6cef808aa24461528f10cd35dd1e458e70a297cc979270983485d5

SHA512
5a76ddc58188027e421c0f9c111da1e08662f10c56a7abde1e5b6dfc327818c6bf0b210799606ae71a635b0395ca20ab7d35da67820fbe11840eca310657cdbf

Download Submit
C:\Windows\System\eGUiSsJ.exe

Filesize
1.6MB

MD5
7a5ca1163fcf06e327850191affba169

SHA1
3be8e1868ecd32d150826a181457604598997c23

SHA256
75db3b885046ed69394c25c3db41157b24e94812486302256c00c51aff1ef776

SHA512
99bf8b9f385aed68e50c98f4361410b9360e511b3877faf2e235cc9a0fddc28bf4d1a14f123ecf26c32686a52a1c7ec55dbdc7a63e90e4b4a36455ea03971f5c

Download Submit
C:\Windows\System\frOXMxo.exe

Filesize
1.6MB

MD5
c66d2287c42a384747caa85c5226279e

SHA1
eab1cb5459f75b0e94562ea631962df956f6b46c

SHA256
18061b421a0791c92ece55cfb2751c88c99181469f9a6728ea97f8e1f55f1eb1

SHA512
527c4e7baa3bfbead02fb5701bc6ab9e5fb7db229be9b82b83b5d61218eb4c84ce2c7844e181470920e577c8432da1ed8460e3683ba25372ab2c797042ee51e5

Download Submit
C:\Windows\System\hRbBojl.exe

Filesize
1.6MB

MD5
76debd52c1e6dd5e360f6e3898cdc3a5

SHA1
b116234febcdaa5a0dd11f83b1728e4f789e1889

SHA256
2d0f172994092d4fe3e7941163ec285f5ef17b820ec62bbc9b552ddbc915c490

SHA512
8e7997518551c2ddf66824dfc6c948a09c8364d17f9213c98d0094791f793ecf6b81933fb25e9a29e91224e7a55836da4041105f74ec009295a7da643fdce0ac

Download Submit
C:\Windows\System\jLQlEAN.exe

Filesize
1.6MB

MD5
7f061c25abe300d41f9ac6f9c16c0b4e

SHA1
f2fb5c477fec8d0a39b620db4d610d341b17a1c9

SHA256
4045a892b3b6f004855a813aab94c4ca45fe1581561d6850d370cf7ce8aa9224

SHA512
70581f740558f81aa7c7aa0274cfcb2fea20c4a8209c169b15bb1328afe3337a47d85e0296d446f9270e4d0a08365a034669f091f8a106c83fa9857a5ee7381b

Download Submit
C:\Windows\System\nDhMvOd.exe

Filesize
1.6MB

MD5
e7cd1ab523b445654340878dd6e11f80

SHA1
51d529849f619a0ea59daa6e42bdc73c2d26555f

SHA256
a339bee7dfe7a495bbc4d756298304cec84a221b0ca8e472b7bbad6263889bb4

SHA512
aa323327a59762c90f448ebdb059def98abadfc977cb99d55632a05d5463dcaa6d8fe53cb618b87782fb15735f861caaa008fba67eb1719eebda1c07e85824ca

Download Submit
C:\Windows\System\nEOhZAh.exe

Filesize
1.6MB

MD5
fd5f60112bf0ae9120a9824f07be89d7

SHA1
befd6624a3940a17fc1aadab8a32aea0c16b5c9f

SHA256
22d7cbab6a2964e2070fe7ec0ebd45f2c2bbbc704ffcda014903e8c1f9253ff7

SHA512
c9ffe0b12d1ea077eaa8708b090227c69497c8845608ccfdc556adf9248fb1e64f2b841aabc2327761957981b39cf6e87112b0f75a411b746f0e452b05c92e9c

Download Submit
C:\Windows\System\nYgEdub.exe

Filesize
1.6MB

MD5
bb776ef11a37ffe04c617b3cb50fa262

SHA1
39ce4ea0f1c922dd69412cb7e8f61b10dfe96fe6

SHA256
c30428f2e2342ee208d990a9ec336ff82943a384450d86e2fa92d4f74c66e886

SHA512
8e90a7d0d6a7de58b4a29ae6b241653fb395f812fa0b2bcc904a263494a35c5e908a537958245aed3ae6585e4aa8373c80acd4297bf78f2b9756aabcb8ad080a

Download Submit
C:\Windows\System\ndJeDBq.exe

Filesize
1.6MB

MD5
be6cb7a5a80ac3759b2ff07719161a90

SHA1
3089b6bd96b5c0cb94cfd9c35ae8b9c9b1c89d07

SHA256
ba704f1417773a44c62a12511b276fc304d853449aefca4488df0035b1dddbf3

SHA512
0e28dbb8ad0fb86ef49548a3663b7b2d47a5a317c480c9df907f4c2fa69b0b5419ddb539a58f8238e7497199b4865d1a365a0221a453b9ebf6806c11caeb93b7

Download Submit
C:\Windows\System\nyiSFVJ.exe

Filesize
1.6MB

MD5
01654c260d5adfe48c8386711998623d

SHA1
e1041f501bbdb3317a1efcd03a13ad0a816eb9d0

SHA256
92ce44d99fce9a8d4a1ef3e1bbebee3588e097b342c6520466abeb6a0c7f4a48

SHA512
19309fd7d7c507203d1efd29aa4aa9d6e53d0f1bb5d06c00dd638096feb9a3c416aca6985a2eb504a3272713b7e7bb5aafa0801f864a0e14fad9f081ad58b9ce

Download Submit
C:\Windows\System\rJmImcF.exe

Filesize
1.6MB

MD5
6f3a4b93aacd227b70fcd94f57b30613

SHA1
f80938f1850250a95cfbbca68ead8befdee448f0

SHA256
46537106bde378b50b04d04b685994d89499cbc736b5b9172568f3a240d15840

SHA512
96632f03cecade0e61ebd2835d8d8b5afa33658f0918ba7fd79c188a5d619e7f4ecfca05b602de5df1014d54ad71635376732f6b6f89216559d620a76640bf59

Download Submit
C:\Windows\System\tlnOqYo.exe

Filesize
1.6MB

MD5
74fe3a7ac1c2805c7b8dc5d2177ed538

SHA1
6152c22d18cda759b0120d147f455cf2a2281f8d

SHA256
4ac48b811e49d7efa361e30bfa1a918fd2e65ab291ee94a75543dec4a9fe9bae

SHA512
3192ccfd55ab39a47ad5424952ddfc070ade2fd6c49dbb9d480714fa0be3145ef95ecf6dfd258cfc95e4fa827cc47fe36553fc9937fafb0ccd70d8273bdee57d

Download Submit
C:\Windows\System\vuUKmHV.exe

Filesize
1.6MB

MD5
92cc08b4cc14b1b23c0d475d2a778e84

SHA1
8b3d2e231418e361cff844d326413f18fe7727d8

SHA256
c435470b3d2b32b796f07d1e48d4c3bc71018a2be4c91bcb8fda1988403e6520

SHA512
7d55ab9642a396cb8d27d662a706cdce30845aba7a2967e108a7e7368831b5fd70d3411724f15ce3b8db02cac0763168693eb68d1721186506de524c401e2cea

Download Submit
C:\Windows\System\zlghEFE.exe

Filesize
1.6MB

MD5
743732b62d47571a906048a33dd541fd

SHA1
8c4791b5ee7474447eb06d1c9360324e7552e8e0

SHA256
74a26566dbd00cac98aea7e22703604dd9a8fc91e6bf681beec9e8c58c624d60

SHA512
cf5e49d7b9e125252c55cd7d364b18da397c1d58d647945a3ba58584469f07b9b2e61995396a807c07a803b08036d1a7fd29169f5dab2f552d15a3f7bc6ed869

Download Submit
memory/3100-0-0x0000017F0E890000-0x0000017F0E8A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads